diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 267f0b62e..beead8192 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           build-args: "--wfail -v"
           test: false
-      # build-all lint driver compiles every lib/exe target with --wfail, so a
+      # build-all lint driver compiles production lib/exe targets with --wfail, so a
       # warning in any target (exes, benchmarks, Apps) — not just the default lib
       # lean-action builds above — fails CI.
       - name: Build all targets
@@ -86,6 +86,33 @@ jobs:
           use-github-cache: false
       - name: Test Ix CLI
         run: lake test --wfail -- cli
+      - name: Check Aiur proof boundaries and native verifier binding
+        run: lake run check-aiur
+      - name: Check certified source and claim adapters
+        run: lake run check-certified
+
+  compiler:
+    runs-on: warp-ubuntu-latest-x64-16x
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/setup-rust-toolchain
+      - uses: leanprover/lean-action@v1
+        with:
+          auto-config: false
+          use-github-cache: false
+      - name: Check compiler proofs, trust boundary, and native fixtures
+        run: lake run check-compiler
+
+  theory:
+    runs-on: warp-ubuntu-latest-x64-16x
+    steps:
+      - uses: actions/checkout@v7
+      - uses: leanprover/lean-action@v1
+        with:
+          auto-config: false
+          use-github-cache: false
+      - name: Check consistency model and exact foundation manifest
+        run: lake run check-theory
 
   rust-test:
     runs-on: warp-ubuntu-latest-x64-8x
diff --git a/.github/workflows/merge-tests.yml b/.github/workflows/merge-tests.yml
index dccdf83cd..420798b0b 100644
--- a/.github/workflows/merge-tests.yml
+++ b/.github/workflows/merge-tests.yml
@@ -47,13 +47,13 @@ jobs:
           - name: Valgrind FFI
             kind: valgrind
             runner: warp-ubuntu-latest-x64-8x
-          - name: Ix.Tc verification and parity
+          - name: Ix.Kernel verification and parity
             kind: tc
             runner: warp-ubuntu-latest-x64-16x
             test_args: >-
               --ignored
               tc-anon-diff tc-init tc-tutorial tc-roundtrip tc-ingress-meta
-              tc-pins tc-accel-diff lean4lean
+              tc-pins tc-accel-diff
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Validate merge-test variant
@@ -147,19 +147,22 @@ jobs:
             --suppressions=.github/valgrind.supp \
             .lake/build/bin/IxTests ffi
 
-      - name: Check Ix.Tc exported theorem trust manifest
+      - name: Check Ix.Kernel exported theorem trust manifest
         if: ${{ matrix.kind == 'tc' }}
-        run: lake build Ix.Tc.Verify.Audit.Completed Ix.Tc.Verify.Audit.Conditional Ix.Tc.Verify.Audit.Statements
-      - name: Build Ix.Tc formal verification
+        run: lake build Ix.Kernel.Verify.Audit.Completed Ix.Kernel.Verify.Audit.Conditional Ix.Kernel.Verify.Audit.Statements
+      - name: Build Ix.Kernel formal verification
         if: ${{ matrix.kind == 'tc' }}
-        run: lake build IxTcVerify
-      - name: Check Ix.Tc verification sorry frontier
+        run: lake build IxKernelVerify IxCompileVerify
+      - name: Check Ix.Kernel consistency refinement
         if: ${{ matrix.kind == 'tc' }}
-        run: lake build Ix.Tc.Verify.Audit.SorryFrontier
-      - name: Test Ix.Tc unit and adversarial fixtures
+        run: lake build --wfail IxKernelConsistency
+      - name: Check Ix.Kernel verification sorry frontier
+        if: ${{ matrix.kind == 'tc' }}
+        run: lake build Ix.Kernel.Verify.Audit.SorryFrontier
+      - name: Test Ix.Kernel unit and adversarial fixtures
         if: ${{ matrix.kind == 'tc' }}
         run: lake test --wfail -- tc-unit
-      - name: Run Ix.Tc ignored tests
+      - name: Run Ix.Kernel ignored tests
         if: ${{ matrix.kind == 'tc' }}
         run: lake test --wfail -- ${{ matrix.test_args }}
 
diff --git a/.github/workflows/set-theory-model.yml b/.github/workflows/set-theory-model.yml
new file mode 100644
index 000000000..e415b0c2a
--- /dev/null
+++ b/.github/workflows/set-theory-model.yml
@@ -0,0 +1,47 @@
+name: Set-theory model
+
+on:
+  pull_request:
+    paths:
+      - 'Models/SetTheory/**'
+      - 'Ix/Theory/Model/SetTheory/Core.lean'
+      - 'lakefile.lean'
+      - 'lake-manifest.json'
+      - 'lean-toolchain'
+      - '.github/workflows/set-theory-model.yml'
+  merge_group:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  model:
+    runs-on: warp-ubuntu-latest-x64-16x
+    timeout-minutes: 60
+    defaults:
+      run:
+        working-directory: Models/SetTheory
+    env:
+      MATHLIB_NO_CACHE_ON_UPDATE: '1'
+      MATHLIB_CACHE_DIR: .lake/mathlib-cache
+    steps:
+      - uses: actions/checkout@v7
+      - uses: leanprover/lean-action@v1
+        with:
+          auto-config: false
+          use-github-cache: false
+      - name: Check Lean toolchains match
+        run: cmp ../../lean-toolchain lean-toolchain
+      - uses: actions/cache@v6
+        with:
+          path: Models/SetTheory/.lake
+          key: set-theory-model-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Models/SetTheory/lean-toolchain', 'Models/SetTheory/lakefile.toml', 'Models/SetTheory/lake-manifest.json') }}
+      - name: Fetch the imported Mathlib modules and dependencies
+        run: lake exe cache get Mathlib.SetTheory.Cardinal.Regular Mathlib.SetTheory.ZFC.VonNeumann Mathlib.SetTheory.ZFC.Cardinal
+      - name: Build model and check axiom guard
+        run: lake build --wfail
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..006d21f21
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,6 @@
+# Repository guidelines
+
+- Keep local plans and work notes in the gitignored `plans/` directory.
+- Reserve `docs/` for polished, permanent, user-facing documentation.
+- Use Lean or Ix instead of Python, Perl, or shell scripts wherever possible.
+- Use Ixon instead of JSON wherever possible.
diff --git a/BENCHMARKS.md b/BENCHMARKS.md
index 6d1740331..5b1b683d0 100644
--- a/BENCHMARKS.md
+++ b/BENCHMARKS.md
@@ -2,7 +2,7 @@
 
 Head-to-head timings for every stage of the Ix pipeline across three
 environments, comparing the pure-Lean implementation (`Ix.CompileM` /
-`Ix.DecompileM` / `Ix.Tc`) against the Rust implementation
+`Ix.DecompileM` / `Ix.Kernel`) against the Rust implementation
 (`crates/compile` / `crates/kernel`).
 
 ## Methodology
@@ -119,7 +119,7 @@ Rust: `ix decompile` (the decompile pass over a `.ixe`). Lean:
 flags → Pass 2 aux regeneration/recovery) *plus* the hash comparison
 against the canonicalized source (comparison overhead ~5 s at 205k
 constants). Lean decompilation is dominated by Pass 2's kernel bridge
-(regeneration re-infers through `Ix.Tc`); Pass 2 runs on the
+(regeneration re-infers through `Ix.Kernel`); Pass 2 runs on the
 wave-parallel driver (`decompileEnvPass2Parallel`, 16 workers — the
 count is memory-bound, not core-bound; `IX_DECOMPILE_WORKERS`
 overrides). The sequential figures from before the parallel driver are
@@ -147,7 +147,7 @@ full verdict parity.
 worker config keeps warm caches; both a 32-worker meta run and a
 32-worker anon run without cache clearing were OOM-killed while
 swap-thrashing). The anon row uses the scale configuration from the
-`Ix.Tc` Mathlib-tier validation: 16 workers, `--clear-every 50`
+`Ix.Kernel` Mathlib-tier validation: 16 workers, `--clear-every 50`
 (whole-worker-state renewal every 50 items; RSS plateaus ~42 GB) —
 **640,658/640,658 passed, zero failures, full verdict parity**. Anon
 mode dedups alpha-identical constants, hence the smaller count.
diff --git a/Benchmarks/Compile/TruthMines/Members/Lean4Lean.lean b/Benchmarks/Compile/TruthMines/Members/Lean4Lean.lean
deleted file mode 100644
index f3f063175..000000000
--- a/Benchmarks/Compile/TruthMines/Members/Lean4Lean.lean
+++ /dev/null
@@ -1,2 +0,0 @@
-/- GENERATED by `lake exe truthmines gen` from `Benchmarks.TruthMinesSpec`; do not edit. -/
-import Drivers.Lean4Lean
diff --git a/Benchmarks/Compile/TruthMines/lake-manifest.json b/Benchmarks/Compile/TruthMines/lake-manifest.json
index a80f29677..1f25e71e6 100644
--- a/Benchmarks/Compile/TruthMines/lake-manifest.json
+++ b/Benchmarks/Compile/TruthMines/lake-manifest.json
@@ -375,16 +375,6 @@
    "inputRev": "453f4feb6508ec787fc325a70523d38e4378ef8f",
    "inherited": true,
    "configFile": "lakefile.lean"},
-  {"url": "https://github.com/digama0/lean4lean",
-   "type": "git",
-   "subDir": null,
-   "scope": "",
-   "rev": "e0e3f6bcccb840cb0ea6f11c2b274ada93a12e00",
-   "name": "lean4lean",
-   "manifestFile": "lake-manifest.json",
-   "inputRev": "e0e3f6bcccb840cb0ea6f11c2b274ada93a12e00",
-   "inherited": true,
-   "configFile": "lakefile.toml"},
   {"url": "https://github.com/leanprover-community/import-graph",
    "type": "git",
    "subDir": null,
diff --git a/Benchmarks/Compile/lake-manifest.json b/Benchmarks/Compile/lake-manifest.json
index 1112621d5..dbf19a9d3 100644
--- a/Benchmarks/Compile/lake-manifest.json
+++ b/Benchmarks/Compile/lake-manifest.json
@@ -168,16 +168,6 @@
    "inputRev": null,
    "inherited": true,
    "configFile": "lakefile.lean"},
-  {"url": "https://github.com/argumentcomputer/lean4ix",
-   "type": "git",
-   "subDir": null,
-   "scope": "",
-   "rev": "a4188d7c2979378d85c6bb41fdd96c3a48a71371",
-   "name": "lean4lean",
-   "manifestFile": "lake-manifest.json",
-   "inputRev": "a4188d7c2979378d85c6bb41fdd96c3a48a71371",
-   "inherited": true,
-   "configFile": "lakefile.toml"},
   {"url": "https://github.com/leanprover/lean4-cli",
    "type": "git",
    "subDir": null,
diff --git a/Benchmarks/Compiler.lean b/Benchmarks/Compiler.lean
new file mode 100644
index 000000000..05a2e3ea4
--- /dev/null
+++ b/Benchmarks/Compiler.lean
@@ -0,0 +1,52 @@
+import Benchmarks.Compiler.Reproduce
+import Benchmarks.Compiler.CounterFold
+
+open Ix.Compiler.Tools.Check
+
+def main (args : List String) : IO UInt32 := cli "benchmark failed" do
+  match args with
+  | "counter-fold-build" :: output :: options =>
+    let options ← checked (parseArgs ["--gcc", "--time"] options)
+    Benchmarks.Compiler.CounterFold.buildSuite output (option options "--gcc" "gcc") (option options "--time" "time")
+  | ["counter-fold-verify", build, output] => Benchmarks.Compiler.CounterFold.verifySuite build output
+  | ["counter-fold-smoke", build, output, core] =>
+    Benchmarks.Compiler.CounterFold.smokeSuite build output (← present core.toNat? "core must be a natural number")
+  | ["counter-fold-smoke", build, output] => Benchmarks.Compiler.CounterFold.smokeSuite build output (← Benchmarks.Compiler.firstCore)
+  | ["counter-fold-pilot", build, correctness, output, core] =>
+    Benchmarks.Compiler.CounterFold.pilotSuite build correctness output (← present core.toNat? "core must be a natural number")
+  | ["counter-fold-measure", build, correctness, pilot, output, core] =>
+    Benchmarks.Compiler.CounterFold.measureSuite build correctness pilot output (← present core.toNat? "core must be a natural number")
+  | ["counter-fold-analyze", build, measured, output] => Benchmarks.Compiler.CounterFold.analyzeSuite build measured output
+  | ["counter-fold-reproduce", build, measured, output] => Benchmarks.Compiler.CounterFold.reproduceSuite build measured output
+  | ["datasets", output] =>
+    Benchmarks.Compiler.writeDatasets output
+    IO.println "benchmark datasets: 585 inputs, 19305 arena capacity cases, 38 timing rows"
+  | "build" :: output :: options =>
+    let options ← checked (parseArgs ["--gcc", "--clang", "--compcert", "--cakeml", "--time"] options)
+    Benchmarks.Compiler.buildSuite output {
+      gcc := option options "--gcc" "gcc", clang := option options "--clang" "clang",
+      compcert := option options "--compcert" "ccomp", cakeml := option options "--cakeml" "cake",
+      timerTool := option options "--time" "time" }
+  | ["check-matrix", implementation, path] =>
+    let rows ← Benchmarks.Compiler.readLines path
+    let result ← Benchmarks.Compiler.inspectMatrix implementation rows
+    Benchmarks.Compiler.checkerRegressions implementation rows
+    IO.println result.compress
+  | ["verify", build, output] => Benchmarks.Compiler.verifySuite build output
+  | ["smoke", build, output, core] =>
+    Benchmarks.Compiler.smokeSuite build output (← present core.toNat? "core must be a natural number")
+  | ["smoke", build, output] => Benchmarks.Compiler.smokeSuite build output (← Benchmarks.Compiler.firstCore)
+  | ["gc-smoke", build, output, core] =>
+    Benchmarks.Compiler.gcSmokeSuite build output (← present core.toNat? "core must be a natural number")
+  | ["gc-smoke", build, output] => Benchmarks.Compiler.gcSmokeSuite build output (← Benchmarks.Compiler.firstCore)
+  | ["pilot", build, correctness, output, core] =>
+    Benchmarks.Compiler.pilotSuite build correctness output (← present core.toNat? "core must be a natural number")
+  | ["measure", build, correctness, pilot, output, core] =>
+    Benchmarks.Compiler.measureSuite build correctness pilot output (← present core.toNat? "core must be a natural number")
+  | ["analyze", build, measured, output] => Benchmarks.Compiler.analyzeSuite build measured output
+  | ["analysis-self-check"] => Benchmarks.Compiler.analysisSelfCheck
+  | ["diagnose", build, pilot, output, core] =>
+    Benchmarks.Compiler.diagnoseSuite build pilot output (← present core.toNat? "core must be a natural number")
+  | ["reproduce", build, measured, output] => Benchmarks.Compiler.reproduceSuite build measured output
+  | ["rebuild-check", build, output] => let _ ← Benchmarks.Compiler.rebuildArtifacts build output; pure ()
+  | _ => throw (IO.userError "usage: benchmark datasets OUT | build OUT [--gcc PATH --clang PATH --compcert PATH --cakeml PATH --time PATH] | verify BUILD OUT | smoke BUILD OUT [CORE] | gc-smoke BUILD OUT [CORE] | pilot BUILD VERIFY OUT CORE | measure BUILD VERIFY PILOT OUT CORE | diagnose BUILD PILOT OUT CORE | analyze BUILD MEASURED OUT | reproduce BUILD MEASURED OUT | analysis-self-check")
diff --git a/Benchmarks/Compiler/Analyze.lean b/Benchmarks/Compiler/Analyze.lean
new file mode 100644
index 000000000..fb769770a
--- /dev/null
+++ b/Benchmarks/Compiler/Analyze.lean
@@ -0,0 +1,317 @@
+import Benchmarks.Compiler.Measure
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def quantile (values : Array Float) (numerator denominator : Nat) : Float := Id.run do
+  if values.isEmpty then return 0
+  let sorted := values.qsort (· < ·)
+  let position := numerator * (values.size - 1)
+  let left := position / denominator
+  let fraction := (position % denominator).toFloat / denominator.toFloat
+  return sorted[left]! * (1 - fraction) + sorted[min (left + 1) (values.size - 1)]! * fraction
+
+def median (values : Array Float) : Float := quantile values 1 2
+
+/-- The same index vectors apply to every implementation and every ratio.
+Sessions are the outer cluster, and each selected session contributes ten
+paired blocks sampled with replacement. -/
+def bootstrapIndices (seed : UInt64 := 2671931027) (replicates : Nat := 10000) : Array (Array Nat) := Id.run do
+  let mut state := seed
+  let mut result := #[]
+  for _ in [:replicates] do
+    let mut indices := #[]
+    for _ in [:3] do
+      state := nextRandom state
+      let session := state.toNat % 3
+      for _ in [:10] do
+        state := nextRandom state
+        indices := indices.push (session * 10 + state.toNat % 10)
+    result := result.push indices
+  return result
+
+def distribution (indices : Array (Array Nat)) (values : Array Float) : Json :=
+  let bootstraps := indices.map fun sample => median (sample.map (values[·]!))
+  Json.mkObj [("blocks", toJson values.size), ("median", toJson (median values)),
+    ("q25", toJson (quantile values 1 4)), ("q75", toJson (quantile values 3 4)),
+    ("ci95_low", toJson (quantile bootstraps 1 40)), ("ci95_high", toJson (quantile bootstraps 39 40)),
+    ("session_medians", toJson ((List.range 3).map fun session => median (values.extract (session * 10) ((session + 1) * 10))))]
+
+def numeric (json : Json) : IO Float := do
+  let value ← checked (fromJson? json : Except String Float)
+  need (value.isFinite && value > 0) "analysis expects finite positive numeric observations"
+  return value
+
+def statistic (json : Json) (name : String) : IO Float := do numeric (← field json name)
+
+def analysisSelfCheck : IO Unit := do
+  let values := (List.range 30).toArray.map (fun n => (n + 1).toFloat)
+  need (median values == 15.5 && quantile values 1 4 == 8.25 && quantile values 3 4 == 22.75)
+    "analysis quantile regression"
+  let indices := bootstrapIndices 2671931027 1000
+  need (indices == bootstrapIndices 2671931027 1000 && indices.size == 1000 &&
+    indices.all (fun row => row.size == 30 && row.all (· < 30))) "analysis bootstrap is not reproducible or bounded"
+  for row in indices do
+    for cluster in [:3] do
+      let segment := row.extract (cluster * 10) ((cluster + 1) * 10)
+      need (segment.all (fun index => index / 10 == segment[0]! / 10)) "bootstrap broke a session cluster"
+  let ratios := values.map (fun value => (2 * value) / value)
+  let result := distribution indices ratios
+  for key in ["median", "q25", "q75", "ci95_low", "ci95_high"] do
+    need ((← statistic result key) == 2) "paired ratio bootstrap lost pairing"
+  rejects "zero analysis input" "finite positive" (numeric (toJson (0 : Nat)) *> pure ())
+  IO.println "benchmark analysis self-check: quantiles, deterministic hierarchical session clusters, paired ratios, and invalid numeric inputs passed"
+
+structure ObservedBlock where
+  -- Stable layout: row ID, implementation, then the three native observations.
+  samples : Array (Array (Array Json))
+  upstream : Array (Array Json)
+  initialRss : Array Nat
+
+def inspectMeasurement (build measured : FilePath) : IO (Json × Array ObservedBlock) := do
+  let metadata ← inspectBuild build
+  let freeze ← inspectFreeze build measured
+  let manifest ← readJson (measured / "measurement.json")
+  need ((← strField manifest "format") == "compilatrix/benchmark-measurement/1" &&
+    (← strField manifest "status") == "complete") "measurement is not complete"
+  let buildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  let freezeHash := digest (← IO.FS.readBinFile (measured / "freeze.json"))
+  need ((← strField manifest "build_blake3") == buildHash && (← strField manifest "freeze_blake3") == freezeHash)
+    "measurement build/freeze identity disagrees"
+  for (name, key) in [("samples.jsonl", "samples_blake3"), ("upstream.jsonl", "upstream_blake3")] do
+    need (digest (← IO.FS.readBinFile (measured / name)) == (← strField manifest key)) "retained sample digest disagrees"
+  let correctness ← readJson (measured / "correctness.json")
+  need ((← strField correctness "build_blake3") == buildHash && (← strField correctness "status") == "passed" &&
+    (← field correctness "executables") == (← field metadata "executables")) "measurement correctness record differs"
+  let reference ← field freeze "environment"
+  for file in ["environment-start.json", "environment-end.json"] do
+    need (← stableEnvironment reference (← readJson (measured / file))) "measurement environment drift"
+  let valid ← arrField manifest "valid_blocks"
+  need (valid.size == 30 && (← number manifest "samples") == 20520 && (← number manifest "upstream_samples") == 180)
+    "measurement block/sample inventory disagrees"
+  let mut observations := #[]
+  let mut reconstructed := #[]
+  let mut upstreamReconstructed := #[]
+  for block in (← arrField freeze "blocks") do
+    let id ← number block "block"
+    let session ← number block "session"
+    let status := valid[id]!
+    let attempt ← number status "attempt"
+    need ((← number status "block") == id && (← number status "session") == session &&
+      (← strField status "status") == "valid" && attempt < 3) "valid block identity disagrees"
+    let directory := measured / s!"session-{session}/block-{id}/attempt-{attempt}"
+    need ((← readJson (directory / "status.json")) == status) "retained block status disagrees"
+    for file in ["environment-start.json", "environment-end.json"] do
+      need (← stableEnvironment reference (← readJson (directory / file))) "valid block has environmental drift"
+    let schedule ← checked (fromJson? (← field block "schedule") : Except String Schedule)
+    let order ← (← arrField block "implementation_order").mapM string
+    let mut samples := Array.replicate 38 (Array.replicate 6 #[])
+    let mut initialRss := Array.replicate 6 0
+    for orderIndex in [:order.size] do
+      let implementation := order[orderIndex]!
+      let implementationIndex ← present (implementations.toList.idxOf? implementation) "unknown measured implementation"
+      let path := directory / s!"{implementation}.jsonl"
+      let rows ← readLines path
+      let native ← inspectRun implementation schedule rows true
+      initialRss := initialRss.set! implementationIndex (← number rows[0]! "initial_rss_kb")
+      let process ← readJson (path.withExtension "process.json")
+      need ((← number process "exit_code") == 0 && (← field process "schedule") == toJson schedule &&
+        (← number process "core") == (← number freeze "core") && (← strField process "implementation") == implementation &&
+        (← strField process "schedule_blake3") == digest schedule.bytes &&
+        (← strField process "stdout_blake3") == digest (← IO.FS.readBinFile path)) "raw process identity disagrees"
+      need ((← IO.FS.readBinFile (path.withExtension "bin")) == schedule.bytes) "raw binary schedule drifted"
+      let hash := digest (← IO.FS.readBinFile (build / s!"bin/{implementation}"))
+      for sample in native do
+        let row ← number sample "row"
+        need ((← number sample "peak_rss_kb") <= (← number freeze "resource_bound_rss_kb")) "valid block exceeded RSS limit"
+        samples := samples.set! row (samples[row]!.set! implementationIndex (samples[row]![implementationIndex]!.push sample))
+        reconstructed := reconstructed.push (enriched sample id session orderIndex attempt buildHash freezeHash hash)
+    let entries ← arrField freeze "upstream"
+    need (entries.size == 2) "upstream measured inventory changed"
+    let entries := if id % 2 == 0 then entries else entries.reverse
+    let mut upstream := Array.replicate 2 #[]
+    for upstreamOrder in [:entries.size] do
+      let entry := entries[upstreamOrder]!
+      let name ← strField entry "name"
+      let index := if name == "applyClosed" then 0 else 1
+      need (name == (if index == 0 then "applyClosed" else "letClosed")) "unknown upstream measured entry"
+      let value ← number entry "value"
+      let operations ← number entry "operations"
+      let rows ← readLines (directory / s!"upstream-{name}.jsonl")
+      need (rows.size == 4 && (← kind rows[0]!) == "warmup" && (← number rows[0]! "elapsed_ns") >= 1000000000)
+        "upstream native warm-up/sample inventory disagrees"
+      let hash := digest (← IO.FS.readBinFile (build / s!"bin/upstream-{name}"))
+      for i in [:3] do
+        let row := rows[i + 1]!
+        need ((← kind row) == "sample" && (← number row "sample") == i &&
+          (← number row "operations") == operations && (← number row "elapsed_ns") >= minimumNs &&
+          (← number row "sink") == operations * value &&
+          (← number row "peak_rss_kb") <= (← number freeze "resource_bound_rss_kb")) "upstream native sample identity, value or resource bound disagrees"
+        upstreamReconstructed := upstreamReconstructed.push (Json.mkObj [("name", toJson name),
+          ("sample", enriched row id session upstreamOrder attempt buildHash freezeHash hash)])
+      upstream := upstream.set! index (rows.extract 1 rows.size)
+    need (samples.all (fun row => row.all (·.size == 3)) && upstream.all (·.size == 3)) "block has missing paired rows"
+    observations := observations.push { samples, upstream, initialRss }
+  need ((← readLines (measured / "samples.jsonl")) == reconstructed) "combined samples differ from original paired process records"
+  need ((← readLines (measured / "upstream.jsonl")) == upstreamReconstructed) "combined upstream samples differ from process records"
+  return (freeze, observations)
+
+def nsPerOp (sample : Json) : IO Float := do
+  let elapsed ← number sample "elapsed_ns"
+  let count ← number sample "operations"
+  need (elapsed > 0 && count > 0) "zero time or operation count"
+  return elapsed.toFloat / count.toFloat
+
+def compactFloat (value : Float) : String :=
+  toString ((value * 100).round / 100)
+
+def analyzeSuite (build measured output : FilePath) : IO Unit := do
+  fresh output
+  analysisSelfCheck
+  let (freeze, blocks) ← inspectMeasurement build measured
+  let diagnostics ← readJson (measured / "diagnostics/diagnostics.json")
+  let diagnosticBuildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  need ((← strField diagnostics "status") == "passed" && (← strField diagnostics "build_blake3") ==
+    diagnosticBuildHash) "diagnostics do not match the measured build"
+  let gc ← field diagnostics "gc"
+  need ((← strField gc "raw_blake3") == digest (← IO.FS.readBinFile (measured / "diagnostics/cakeml-gc.jsonl")))
+    "retained collection diagnostics changed"
+  let indices := bootstrapIndices
+  let mut results := #[]
+  let mut report := "# Native reversal: shared-host reference run\n\n"
+  report := report ++ "This report covers one bounded reversal workload on one recorded x86-64 Linux host. " ++
+    "It compares the checked Ix.Compiler object with consuming Lean and CakeML programs and the same arena C kernel compiled by CompCert, GCC, and Clang. " ++
+    "The worker is pinned, but the host, SMT sibling, temperature, and turbo behavior are not controlled. These observations do not establish a dedicated regression baseline.\n\n" ++
+    "Every row has 30 paired blocks in three sessions, with the median of three samples per executable per block. " ++
+    "Samples accumulate at least 100 ms of measured work. Counts are identical across implementations in each paired case. " ++
+    "The raw timer and handoff control is retained without subtraction. All valid slow observations are included. " ++
+    "Intervals use 10,000 hierarchical paired bootstrap replicates (seed 2671931027), resampling sessions then blocks. " ++
+    "Only three session clusters are available, so interval precision and generalization remain limited. Full medians, quartiles, intervals, session medians, and paired ratios are in `summary.json`.\n\n"
+  for profile in [:2] do
+    report := report ++ s!"## {if profile == 0 then "Entry plus bounded handoff" else "Fresh allocation lifecycle"}\n\n" ++
+      "Nanoseconds per operation, median across block medians. Lifecycle includes construction, reversal, order-sensitive consumption, and normal memory management.\n\n" ++
+      "| Length | Payload domain | Ix.Compiler | Lean | CakeML | CompCert | GCC | Clang |\n" ++
+      "| ---: | --- | ---: | ---: | ---: | ---: | ---: | ---: |\n"
+    for localId in [:19] do
+      let id := profile * 19 + localId
+      let specification := timingCases[id]!
+      let mut implementationResults := #[]
+      let mut blockValues := #[]
+      for implementationIndex in [:6] do
+        let values ← blocks.mapM fun block => do
+          return median (← block.samples[id]![implementationIndex]!.mapM nsPerOp)
+        blockValues := blockValues.push values
+      for implementationIndex in [:6] do
+        let values := blockValues[implementationIndex]!
+        let stats := distribution indices values
+        let ratios := values.zipWith (· / ·) blockValues[0]!
+        let ratios := distribution indices ratios
+        let ns := median values
+        implementationResults := implementationResults.push (Json.mkObj [
+          ("implementation", toJson implementations[implementationIndex]!), ("ns_per_operation", stats),
+          ("ns_per_element", if specification.length == 0 then Json.null else toJson (ns / specification.length.toFloat)),
+          ("operations_per_second", toJson (1000000000 / ns)),
+          ("paired_speedup_baseline_over_compilatrix", ratios)])
+      let domain := if specification.domain == 0 then "six patterns, <2^30" else
+        ["", "2^63-1", "2^63", "2^64-1"][specification.domain]!
+      report := report ++ s!"| {specification.length} | {domain} | " ++
+        String.intercalate " | " ((blockValues.map (fun values => compactFloat (median values))).toList) ++ " |\n"
+      results := results.push (Json.mkObj [("row", toJson id), ("length", toJson specification.length),
+        ("domain", toJson specification.domain), ("profile", toJson (if profile == 0 then "entry+handoff" else "lifecycle")),
+        ("implementations", Json.arr implementationResults)])
+    report := report ++ "\n"
+  report := report ++ "## Paired comparison at the current 64-element bound\n\n" ++
+    "Each cell is baseline time / Ix.Compiler time, followed by its 95% interval. Values above one favor Ix.Compiler. " ++
+    "The JSON summary retains paired intervals for every other length as well.\n\n" ++
+    "| Profile | Domain | Lean | CakeML | CompCert | GCC | Clang |\n| --- | --- | --- | --- | --- | --- | --- |\n"
+  for row in results do
+    if (← number row "length") != 64 then continue
+    let cells ← (← arrField row "implementations").extract 1 6 |>.mapM fun implementation => do
+      let stats ← field implementation "paired_speedup_baseline_over_compilatrix"
+      return s!"{compactFloat (← statistic stats "median")} [{compactFloat (← statistic stats "ci95_low")}, {compactFloat (← statistic stats "ci95_high")}]"
+    report := report ++ s!"| {← strField row "profile"} | {domainName (← number row "domain")} | " ++ String.intercalate " | " cells.toList ++ " |\n"
+  let mut memory := #[]
+  report := report ++ "\n## Process memory and collection observations\n\n" ++
+    "RSS is read from `/proc/self/statm`; peak RSS is the maximum recorded `getrusage(RUSAGE_SELF)` high-water value. " ++
+    "Ready-process RSS includes initialized runtimes and immutable scalar datasets, before list work. " ++
+    "These process measurements include allocator/runtime reservation and differ from live application bytes.\n\n" ++
+    "| Implementation | Median ready RSS KiB | Minimum sample RSS KiB | Maximum sample RSS KiB | Maximum recorded peak KiB |\n| --- | ---: | ---: | ---: | ---: |\n"
+  for index in [:6] do
+    let initial := blocks.map fun block => block.initialRss[index]!.toFloat
+    let mut rssMin : Option Nat := none
+    let mut rssMax := 0
+    let mut peak := 0
+    for block in blocks do
+      for row in block.samples do
+        for sample in row[index]! do
+          let rss ← number sample "rss_kb"
+          rssMin := some (min rss (rssMin.getD rss))
+          rssMax := max rss rssMax
+          peak := max peak (← number sample "peak_rss_kb")
+    memory := memory.push (Json.mkObj [("implementation", toJson implementations[index]!),
+      ("ready_rss_kb_median", toJson (median initial)), ("minimum_sample_rss_kb", toJson rssMin),
+      ("maximum_sample_rss_kb", toJson rssMax), ("maximum_recorded_peak_rss_kb", toJson peak)])
+    report := report ++ s!"| {implementations[index]!} | {compactFloat (median initial)} | {rssMin.getD 0} | {rssMax} | {peak} |\n"
+  let terminal ← field gc "terminal_collection"
+  report := report ++ s!"\nThe separate CakeML lifecycle diagnostic observed {← number gc "natural_collections_in_sample_envelopes"} natural collections " ++
+    s!"across 20 samples. Maximum observed post-collection live data was {← number gc "maximum_post_gc_live_bytes"} bytes; " ++
+    s!"the separately timed terminal collection took {← number terminal "elapsed_ns"} ns and retained {← number terminal "post_gc_live_bytes"} bytes. " ++
+    "These instrumented event counts include each sample envelope and are separate from primary timing. " ++
+    s!"Hardware counters: {← strField (← field diagnostics "hardware_counters") "status"}; the diagnostic record gives the actual availability reason/event output.\n\n"
+  report := report ++ "## Native code and compiler work\n\n" ++
+    "The following object `.text` sizes come from retained `size -A` output. The CakeML object includes the ML driver and basis code; " ++
+    "the Lean object includes its generated module entry, and the C/Ix.Compiler rows isolate the arena kernels. " ++
+    "The complete sections, linked executable sizes, and dynamic dependencies are retained; these scopes are not interchangeable.\n\n" ++
+    "| Object | `.text` bytes |\n| --- | ---: |\n"
+  for entry in (← arrField diagnostics "code_sizes") do
+    let name ← strField entry "name"
+    if implementations.contains name then continue
+    let text ← strField entry "gnu_size_A"
+    let line := (text.splitOn "\n").find? (fun line => (words line).head? == some ".text")
+    let count := line.bind (fun line => (words line)[1]?.bind String.toNat?)
+    report := report ++ s!"| {name} | {count.map toString |>.getD "unavailable"} |\n"
+  report := report ++ "\nCompiler rows are single observed process envelopes. They include process startup and the named producer/checker work; " ++
+    "they are separate from seed installation, proof-library builds, and runtime comparisons. CPU time and peak compiler RSS are in the retained diagnostics.\n\n" ++
+    "| Operation | Elapsed ms | Peak RSS KiB |\n| --- | ---: | ---: |\n"
+  for cost in (← arrField diagnostics "compiler_costs") do
+    let command ← field cost "command"
+    let resources ← field cost "resources"
+    report := report ++ s!"| {← strField cost "name"} | {compactFloat ((← number command "envelope_ns").toFloat / 1000000)} | {← number resources "peak_rss_kb"} |\n"
+  report := report ++ "\n"
+  let mut upstream := #[]
+  report := report ++ "## Unchanged upstream computations\n\n" ++
+    "These closed entries retain their native successor instructions and four direct calls. They take no runtime arguments. " ++
+    "Their call timings are separate from the runtime-input reversal comparison.\n\n" ++
+    "| Entry | Result | Native text bytes | Object bytes | Median ns/call | 95% interval |\n| --- | ---: | ---: | ---: | ---: | --- |\n"
+  for index in [:2] do
+    let name := if index == 0 then "applyClosed" else "letClosed"
+    let values ← blocks.mapM fun block => do return median (← block.upstream[index]!.mapM nsPerOp)
+    let stats := distribution indices values
+    let native ← field (← readJson (build / s!"artifacts/upstream-{name}/upstream-{name}.json")) "native"
+    let row := Json.mkObj [("name", toJson name), ("ns_per_call", stats), ("value", ← field native "value"),
+      ("text_bytes", ← field native "text_bytes"), ("object_bytes", ← field native "object_bytes"),
+      ("native_heap", ← field native "native_heap"), ("executions", ← field native "executions")]
+    upstream := upstream.push row
+    report := report ++ s!"| {name} | {← number native "value"} | {← number native "text_bytes"} | {← number native "object_bytes"} | " ++
+      s!"{compactFloat (median values)} | {compactFloat (← statistic stats "ci95_low")}–{compactFloat (← statistic stats "ci95_high")} |\n"
+  report := report ++ "\nThe baseline source/physical heap is fully reclaimed in the checked artifacts. Native Nat values use one exact 64-bit word and allocate no heap. " ++
+    "The call traces write 48 bytes below the caller return slot. These closed translation-validation and supplied-state execution certificates do not close N3's open-call, branch/join, or F1's general stack contracts.\n\n" ++
+    "Code sizes, compiler/checker resource envelopes, runtime dependencies, RSS observations, GC diagnostics, and complete inputs are retained with the build and raw run. " ++
+    "Arena capacity is n+2 cells (80+32*(n+2) bytes); release clears cells before freeing the arena. " ++
+    "Lean uniqueness diagnostics establish exclusive spines and cons reuse. CakeML uses a 64 MiB simple copying heap and an 8 MiB stack; separate diagnostics report actual collection cycles and terminal collection. " ++
+    "Dropping roots is not immediate reclamation. Hardware counters are reported only when available.\n"
+  let summary := Json.mkObj [("format", toJson "compilatrix/benchmark-analysis/1"),
+    ("build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))) ,
+    ("measurement_blake3", toJson (digest (← IO.FS.readBinFile (measured / "measurement.json")))),
+    ("freeze_blake3", toJson (digest (← IO.FS.readBinFile (measured / "freeze.json")))),
+    ("bootstrap", ← field freeze "bootstrap"), ("bootstrap_replicates", toJson (10000 : Nat)),
+    ("bootstrap_seed", toJson (2671931027 : Nat)), ("quantile", toJson "linear interpolation at (n-1)*p"),
+    ("within_block", toJson "median of three samples"), ("rows", Json.arr results), ("upstream", Json.arr upstream),
+    ("process_memory", Json.arr memory), ("diagnostics", diagnostics),
+    ("diagnostics_blake3", toJson (digest (← IO.FS.readBinFile (measured / "diagnostics/diagnostics.json")))),
+    ("missing_rows", Json.arr #[]), ("failed_published_rows", Json.arr #[]), ("status", toJson "complete")]
+  writeJson (output / "summary.json") summary
+  IO.FS.writeFile (output / "report.md") report
+  IO.println "benchmark analysis: 38 rows, paired uncertainty, two upstream entries, and complete raw-record replay passed"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Build.lean b/Benchmarks/Compiler/Build.lean
new file mode 100644
index 000000000..52b91980a
--- /dev/null
+++ b/Benchmarks/Compiler/Build.lean
@@ -0,0 +1,255 @@
+import Benchmarks.Compiler.Check
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+structure Toolchains where
+  gcc : String := "gcc"
+  clang : String := "clang"
+  compcert : String := "ccomp"
+  cakeml : String := "cake"
+  timerTool : String := "time"
+  deriving ToJson, FromJson
+
+def cFlags : Array String := #["-O3", "-march=x86-64", "-mtune=generic", "-fno-lto", "-fomit-frame-pointer"]
+def runtimeEnv : Array (String × Option String) :=
+  #[("CML_HEAP_SIZE", some "64"), ("CML_STACK_SIZE", some "8")]
+
+def buildEnvNames : Array String := #["PATH", "LIBCLANG_PATH", "LEAN_PATH", "LEAN_CC", "LEAN_SYSROOT",
+  "NIX_CFLAGS_COMPILE", "NIX_LDFLAGS", "NIX_ENFORCE_PURITY", "NIX_CC", "NIX_BINTOOLS",
+  "NIX_CC_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu", "NIX_BINTOOLS_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu",
+  "NIX_HARDENING_ENABLE", "NIX_ENFORCE_NO_NATIVE", "LD_LIBRARY_PATH", "LIBRARY_PATH", "CPATH",
+  "C_INCLUDE_PATH", "CPLUS_INCLUDE_PATH", "NIX_STORE", "NIX_BUILD_TOP", "SOURCE_DATE_EPOCH", "LANG", "LC_ALL"]
+
+def absolute (path : FilePath) : IO FilePath := do
+  if path.isAbsolute then return path
+  return (← IO.currentDir) / path
+
+def fresh (output : FilePath) : IO Unit := do
+  need (!(← output.pathExists)) s!"fresh output directory required: {output}"
+  IO.FS.createDirAll output
+
+def writeJson (path : FilePath) (json : Json) : IO Unit :=
+  IO.FS.writeFile path (json.pretty 120 ++ "\n")
+
+def binaryOutput (args : IO.Process.SpawnArgs) (input : Option String) : IO (UInt32 × ByteArray × String) := do
+  let child ← if let some input := input then do
+      let (stdin, child) ← (← IO.Process.spawn { args with stdout := .piped, stderr := .piped, stdin := .piped }).takeStdin
+      stdin.putStr input
+      stdin.flush
+      pure child
+    else IO.Process.spawn { args with stdout := .piped, stderr := .piped, stdin := .null }
+  let stdout ← IO.asTask child.stdout.readBinToEnd Task.Priority.dedicated
+  let stderr ← child.stderr.readToEnd
+  let exitCode ← child.wait
+  return (exitCode, ← IO.ofExcept stdout.get, stderr)
+
+/-- Persist each raw timing record as it arrives, including partial output
+from interrupted or failed processes. The reader runs outside the worker. -/
+def streamed (args : IO.Process.SpawnArgs) (path : FilePath) : IO IO.Process.Output := do
+  let child ← IO.Process.spawn { args with stdout := .piped, stderr := .piped, stdin := .null }
+  let stderr ← IO.asTask child.stderr.readToEnd Task.Priority.dedicated
+  let file ← IO.FS.Handle.mk path .write
+  let mut stdout := ""
+  repeat
+    let line ← child.stdout.getLine
+    if line.isEmpty then break
+    file.putStr line
+    file.flush
+    stdout := stdout ++ line
+  let exitCode ← child.wait
+  return { exitCode, stdout, stderr := ← IO.ofExcept stderr.get }
+
+def logged (directory : FilePath) (name command : String) (args : Array String)
+    (env : Array (String × Option String) := #[]) (input : Option String := none)
+    (timeTool : String := "time") : IO String := do
+  IO.FS.createDirAll directory
+  let before ← IO.monoNanosNow
+  let (exitCode, stdout, stderr) ← binaryOutput {
+    cmd := timeTool
+    args := #["-f", "{\"user_seconds\":%U,\"system_seconds\":%S,\"wall_seconds\":%e,\"peak_rss_kb\":%M,\"exit_code\":%x}",
+      "-o", (directory / s!"{name}.resources.json").toString, command] ++ args
+    env := env } input
+  let elapsed := (← IO.monoNanosNow) - before
+  IO.FS.writeBinFile (directory / s!"{name}.stdout") stdout
+  IO.FS.writeFile (directory / s!"{name}.stderr") stderr
+  writeJson (directory / s!"{name}.command.json") (Json.mkObj [
+    ("command", toJson command), ("arguments", toJson args), ("environment_overrides", toJson env),
+    ("stdin_blake3", toJson (input.map (digest ·.toUTF8))), ("exit_code", toJson exitCode.toNat),
+    ("envelope_ns", toJson elapsed)])
+  need (exitCode == 0) s!"{name} exited {exitCode}; see {directory / s!"{name}.stderr"}\n{stderr}"
+  -- CakeML's exploration stream contains raw byte-string literals. Preserve
+  -- the exact bytes above; an ASCII projection is sufficient to inspect calls.
+  match String.fromUTF8? stdout with
+  | some text => return text
+  | none => return stdout.foldl (fun text byte => text.push (if byte.toNat < 128 then Char.ofNat byte.toNat else '?')) ""
+
+def recordFiles (root : FilePath) : IO Json := do
+  let paths ← files root
+  let rows ← paths.toArray.mapM fun path => do
+    let bytes ← IO.FS.readBinFile path
+    return Json.mkObj [("path", toJson (path.toString.drop (root.toString.length + 1)).toString),
+      ("bytes", toJson bytes.size), ("blake3", toJson (digest bytes))]
+  return Json.arr rows
+
+def inspectFiles (root : FilePath) (inventory : Json) : IO Unit := do
+  need ((← recordFiles root) == inventory) s!"artifact inventory or digest changed: {root}"
+
+def sourceSnapshot (output : FilePath) : IO Json := do
+  let git ← IO.Process.output { cmd := "git", args := #["rev-parse", "HEAD"] }
+  let names ← if git.exitCode == 0 then run "git" #["ls-files", "-z", "--cached", "--others", "--exclude-standard"]
+    else run "rg" #["--files", "--hidden", "-g", "!.lake", "-g", "!.git", "-0"]
+  let paths := names.splitOn "\x00" |>.filter (!·.isEmpty) |>.mergeSort (· ≤ ·)
+  let mut rows := #[]
+  let mut included := []
+  for name in paths do
+    if !(← (FilePath.mk name).pathExists) then continue
+    let bytes ← IO.FS.readBinFile name
+    rows := rows.push (Json.mkObj [("path", toJson name), ("bytes", toJson bytes.size), ("blake3", toJson (digest bytes))])
+    included := name :: included
+  IO.FS.writeFile (output / "source-files.list0") (String.intercalate "\x00" included.reverse ++ "\x00")
+  let _ ← run "tar" #["--null", "--verbatim-files-from", "--files-from", (output / "source-files.list0").toString,
+    "--sort=name", "--mtime=@1", "--owner=0", "--group=0", "--numeric-owner", "-czf", (output / "source.tar.gz").toString]
+  let snapshot := Json.mkObj [("revision", toJson (if git.exitCode == 0 then git.stdout.trimAscii.toString else "source-snapshot-without-git")),
+    ("status", toJson (← if git.exitCode == 0 then run "git" #["status", "--short"] else pure "Nix or extracted source snapshot")), ("files", Json.arr rows),
+    ("archive", toJson "source.tar.gz"), ("archive_blake3", toJson (digest (← IO.FS.readBinFile (output / "source.tar.gz"))))]
+  writeJson (output / "source.json") snapshot
+  return snapshot
+
+def buildSuite (output : FilePath) (tools : Toolchains) : IO Unit := do
+  let output ← absolute output
+  let cFlags := cFlags ++ #[s!"-ffile-prefix-map={output}=/benchmark-build"]
+  fresh output
+  for name in ["bin", "tools-bin", "artifacts/driver", "artifacts/lean", "artifacts/cakeml", "diagnostics/build"] do
+    IO.FS.createDirAll (output / name)
+  writeDatasets (output / "datasets")
+  let logs := output / "diagnostics/build"
+  let _ ← logged logs "worker-launcher" tools.gcc
+    (cFlags ++ #["-Wall", "-Wextra", "-Werror", "Benchmarks/Compiler/native/worker_launcher.c",
+      "-o", (output / "bin/worker-launcher").toString]) #[] none tools.timerTool
+  let mut versions := #[]
+  for (name, command, args, expected) in [
+      ("gcc", tools.gcc, #["--version"], "14.3.0"),
+      ("clang", tools.clang, #["--version"], "21.1.2"),
+      ("compcert", tools.compcert, #["-version"], "3.16"),
+      ("cakeml", tools.cakeml, #["--version"], "e8eca63affd1653105ca4b9cc2f5ca87a01cd0af"),
+      ("lean", "lean", #["--version"], "4.33.1")] do
+    let version ← logged logs s!"version-{name}" command args #[] none tools.timerTool
+    need (version.contains expected) s!"pinned {name} version unavailable"
+    versions := versions.push (Json.mkObj [("name", toJson name), ("version_output", toJson version)])
+  let n2 := output / "artifacts/compilatrix"
+  let _ ← logged logs "compilatrix-produce" ".lake/build/bin/compiler-source-native-runtime" #[n2.toString] #[] none tools.timerTool
+  let _ ← logged logs "compilatrix-independent-gate" ".lake/build/bin/compiler-check-source-native-runtime"
+    #["--fixture", ".lake/build/bin/compiler-source-native-runtime", "--cc", tools.gcc,
+      "--harness", "Tests/Fixtures/Compiler/source-native-runtime/native_harness.c"] #[] none tools.timerTool
+  for (name, value) in [("applyClosed", 3), ("letClosed", 4)] do
+    let upstream := output / s!"artifacts/upstream-{name}"
+    let _ ← logged logs s!"upstream-{name}-produce" ".lake/build/bin/compiler-source-native-upstream"
+      #[upstream.toString, name] #[] none tools.timerTool
+    let _ ← logged logs s!"upstream-{name}-check" ".lake/build/bin/compiler-check-source-native-upstream"
+      #["inspect", upstream.toString] #[] none tools.timerTool
+    let object := upstream / s!"upstream-{name}.o"
+    let executable := output / s!"bin/upstream-{name}"
+    let _ ← logged logs s!"upstream-{name}-link" tools.gcc
+      (cFlags ++ #["-Wall", "-Wextra", "-Werror", s!"-DEXPECTED_RESULT={value}",
+        "Tests/Fixtures/Compiler/source-native-upstream/native_harness.c", object.toString, "-Wl,-z,noexecstack", "-o", executable.toString])
+      #[] none tools.timerTool
+    let _ ← logged logs s!"upstream-{name}-native-check" executable.toString #[] #[] none tools.timerTool
+    let _ ← logged logs s!"upstream-{name}-size" "size" #["-A", object.toString, executable.toString] #[] none tools.timerTool
+    let _ ← logged logs s!"upstream-{name}-disassembly" "objdump" #["-d", object.toString] #[] none tools.timerTool
+  let manifest ← readJson "Benchmarks/Compiler/manifest.json"
+  let report ← readJson (n2 / "report.json")
+  for key in ["source_identity", "ixir1_root", "main_identity", "release_identity", "pipeline_identity"] do
+    need ((← field report key) == (← field (← field manifest "compilatrix") key)) s!"N2 {key} drifted"
+  for name in ["common", "driver", "arena_backend"] do
+    let _ ← logged logs s!"driver-{name}" tools.gcc (cFlags ++ #["-Wall", "-Wextra", "-Werror", "-c",
+      s!"Benchmarks/Compiler/native/{name}.c", "-o", (output / s!"artifacts/driver/{name}.o").toString]) #[] none tools.timerTool
+  for (name, command, flags) in [("gcc", tools.gcc, cFlags), ("clang", tools.clang, cFlags), ("compcert", tools.compcert, #["-O"])] do
+    IO.FS.createDirAll (output / s!"artifacts/{name}")
+    let _ ← logged logs s!"kernel-{name}" command (flags ++ #["-c", "Benchmarks/Compiler/native/arena_kernel.c",
+      "-o", (output / s!"artifacts/{name}/kernel.o").toString]) #[] none tools.timerTool
+  let driverObjects := #["common", "driver"].map fun name => (output / s!"artifacts/driver/{name}.o").toString
+  for name in ["compilatrix", "compcert", "gcc", "clang"] do
+    let kernels := if name == "compilatrix" then #[(n2 / "main.o").toString, (n2 / "release.o").toString]
+      else #[(output / s!"artifacts/{name}/kernel.o").toString]
+    let _ ← logged logs s!"link-{name}" tools.gcc (cFlags ++ driverObjects ++
+      #[(output / "artifacts/driver/arena_backend.o").toString] ++ kernels ++
+      #["-Wl,-z,noexecstack", "-o", (output / s!"bin/{name}").toString]) #[] none tools.timerTool
+  let leanRoot := ((← run "lean" #["--print-prefix"]).trimAscii.toString : FilePath)
+  let leanC := output / "artifacts/lean/LeanReverse.c"
+  let _ ← logged logs "lean-generate-c" "lean" #["--root=Benchmarks/Compiler/lean", "-c", leanC.toString, "Benchmarks/Compiler/lean/LeanReverse.lean"] #[] none tools.timerTool
+  let generated ← IO.FS.readFile leanC
+  requireAll generated ["lean_is_exclusive", "lean_ctor_set", "LEAN_EXPORT lean_object* bench_lean_reverse", "l_benchReverseOnto"] "Lean operation boundary"
+  for (name, source) in [("kernel", leanC.toString), ("backend", "Benchmarks/Compiler/native/lean_backend.c")] do
+    -- Lake's ordinary release configuration is -O3 -DNDEBUG. Use leanc's
+    -- installed C/ABI flags as well as the declared target and opaque boundary.
+    let _ ← logged logs s!"lean-{name}" "leanc" (cFlags ++ #["-DNDEBUG", "-I", (leanRoot / "include").toString,
+      "-c", source, "-o", (output / s!"artifacts/lean/{name}.o").toString]) #[("LEAN_CC", some tools.gcc)] none tools.timerTool
+  let _ ← logged logs "link-lean" "leanc" (cFlags ++ driverObjects ++
+    #["-Wl,-z,noexecstack", (output / "artifacts/lean/kernel.o").toString, (output / "artifacts/lean/backend.o").toString,
+      "-o", (output / "bin/lean").toString]) #[("LEAN_CC", some tools.gcc)] none tools.timerTool
+  let cakeDir := (FilePath.mk tools.cakeml).parent.getD "."
+  let basis := cakeDir / "basis_ffi.c"
+  need (← basis.pathExists) "CakeML bootstrap basis_ffi.c must be beside its executable"
+  IO.FS.writeFile (output / "artifacts/cakeml/basis_ffi.c") (← IO.FS.readFile basis)
+  let source ← IO.FS.readFile "Benchmarks/Compiler/cakeml/reverse.cml"
+  for (name, extra) in [("kernel", #[]), ("diagnostic", #["--emit_empty_ffi=true"])] do
+    let assembly ← logged logs s!"cakeml-{name}" tools.cakeml
+      (#["--target=x64", "--reg_alg=2", "--gc=simple"] ++ extra) #[] (some source) tools.timerTool
+    IO.FS.writeFile (output / s!"artifacts/cakeml/{name}.S") assembly
+    let definitions := if name == "diagnostic" then #["-DDEBUG_FFI", "-DBENCH_CAKEML_GC", "-include", "sys/time.h"] else #[]
+    let _ ← logged logs s!"cakeml-assemble-{name}" tools.gcc
+      (cFlags ++ #["-c", (output / s!"artifacts/cakeml/{name}.S").toString, "-o",
+        (output / s!"artifacts/cakeml/{name}.o").toString]) #[] none tools.timerTool
+    let _ ← logged logs s!"link-cakeml-{name}" tools.gcc (cFlags ++ definitions ++
+      #[(output / "artifacts/driver/common.o").toString, "Benchmarks/Compiler/native/cakeml_ffi.c",
+        (output / "artifacts/cakeml/basis_ffi.c").toString, (output / s!"artifacts/cakeml/{name}.o").toString,
+        "-lm", "-Wl,-z,noexecstack", "-o", (output / (if name == "kernel" then "bin/cakeml" else "bin/cakeml-diagnostic")).toString]) #[] none tools.timerTool
+  let explore ← logged logs "cakeml-explore" tools.cakeml
+    #["--target=x64", "--reg_alg=2", "--gc=simple", "--explore"] #[] (some source) tools.timerTool
+  requireAll explore ["(jump reverseOnto@", "(jump digest_loop@", "(jump make@", "(lifecycle_loop_clos@"] "CakeML operation boundary"
+  let _ ← logged logs "compress-cakeml-explore" "gzip" #["-n", (logs / "cakeml-explore.stdout").toString] #[] none tools.timerTool
+  for name in implementations do
+    let _ ← logged logs s!"size-{name}" "size" #["-A", (output / s!"bin/{name}").toString] #[] none tools.timerTool
+    let _ ← logged logs s!"dependencies-{name}" "ldd" #[(output / s!"bin/{name}").toString] #[] none tools.timerTool
+    let _ ← logged logs s!"disassembly-{name}" "objdump" #["-d", (output / s!"bin/{name}").toString] #[] none tools.timerTool
+  for (name, path) in [("compilatrix-main", n2 / "main.o"), ("compilatrix-release", n2 / "release.o"),
+      ("gcc-kernel", output / "artifacts/gcc/kernel.o"), ("clang-kernel", output / "artifacts/clang/kernel.o"),
+      ("compcert-kernel", output / "artifacts/compcert/kernel.o"), ("lean-kernel", output / "artifacts/lean/kernel.o"),
+      ("cakeml-kernel", output / "artifacts/cakeml/kernel.o")] do
+    let _ ← logged logs s!"size-{name}" "size" #["-A", path.toString] #[] none tools.timerTool
+  IO.FS.writeFile (output / "manifest.json") (← IO.FS.readFile "Benchmarks/Compiler/manifest.json")
+  IO.FS.writeFile (output / "toolchains.json") (← IO.FS.readFile "Benchmarks/Compiler/toolchains.json")
+  let mut toolRows := #[]
+  let mut storePaths : Array String := #[]
+  for (name, command) in [("gcc", tools.gcc), ("clang", tools.clang), ("compcert", tools.compcert),
+      ("cakeml", tools.cakeml), ("lean", "lean"), ("lake", "lake"), ("leanc", "leanc")] do
+    let path := ((← run "which" #[command]).trimAscii.toString : FilePath)
+    let resolved := (← run "readlink" #["-f", path.toString]).trimAscii.toString
+    toolRows := toolRows.push (Json.mkObj [("name", toJson name), ("command", toJson command),
+      ("resolved", toJson resolved), ("retained_path", if name == "cakeml" then toJson "tools-bin/cakeml-bootstrap" else Json.null),
+      ("blake3", toJson (digest (← IO.FS.readBinFile resolved)))])
+    if resolved.startsWith "/nix/store/" then
+      let storePath := String.intercalate "/" ((resolved.splitOn "/").take 4)
+      if !storePaths.contains storePath then storePaths := storePaths.push storePath
+  writeJson (output / "tool-identities.json") (Json.arr toolRows)
+  let closure ← IO.Process.output { cmd := "nix-store", args := #["--query", "--requisites"] ++ storePaths }
+  IO.FS.writeFile (output / "nix-closure.txt") closure.stdout
+  writeJson (output / "nix-closure-status.json") (Json.mkObj [("exit_code", toJson closure.exitCode.toNat),
+    ("stderr", toJson closure.stderr), ("roots", toJson storePaths)])
+  for name in ["benchmark", "source-native-runtime", "check-source-native-runtime", "source-native-upstream", "check-source-native-upstream"] do
+    let _ ← run "cp" #[s!".lake/build/bin/compiler-{name}", (output / s!"tools-bin/compiler-{name}").toString]
+  let _ ← run "cp" #[tools.cakeml, (output / "tools-bin/cakeml-bootstrap").toString]
+  IO.FS.writeFile (output / "tools-bin/basis_ffi.c") (← IO.FS.readFile basis)
+  writeJson (output / "build.json") (Json.mkObj [
+    ("format", toJson "compilatrix/benchmark-build/1"), ("tool_commands", toJson tools), ("versions", Json.arr versions),
+    ("build_environment", toJson (← buildEnvNames.mapM fun name => do return (name, ← IO.getEnv name))),
+    ("datasets_blake3", toJson (digest datasetBytes)), ("artifacts", ← recordFiles (output / "artifacts")),
+    ("executables", ← recordFiles (output / "bin")), ("tools", ← recordFiles (output / "tools-bin")),
+    ("tool_identities_blake3", toJson (digest (← IO.FS.readBinFile (output / "tool-identities.json")))),
+    ("manifest_blake3", toJson (digest (← IO.FS.readBinFile (output / "manifest.json")))),
+    ("toolchains_blake3", toJson (digest (← IO.FS.readBinFile (output / "toolchains.json"))))])
+  let _ ← sourceSnapshot output
+  IO.println s!"benchmark build: six implementations and separate CakeML GC executable in {output}"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Check.lean b/Benchmarks/Compiler/Check.lean
new file mode 100644
index 000000000..5251c45ed
--- /dev/null
+++ b/Benchmarks/Compiler/Check.lean
@@ -0,0 +1,121 @@
+import Benchmarks.Compiler.Data
+
+/-! The benchmark oracle imports diagnostic IO and hashing, not the source
+compiler, target selector, emitter, or any comparison implementation. -/
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def implementations : Array String := #["compilatrix", "lean", "cakeml", "compcert", "gcc", "clang"]
+def isArena (implementation : String) : Bool := !["lean", "cakeml"].contains implementation
+
+def readLines (path : FilePath) : IO (Array Json) := do
+  let lines := (← IO.FS.readFile path).splitOn "\n" |>.filter (!·.isEmpty)
+  lines.toArray.mapM fun line => checked (Json.parse line)
+
+def kind (row : Json) : IO String := strField row "kind"
+
+def inspectHeap (heap : Json) (input : Input) (capacity : Nat) (released : Bool) : IO Unit := do
+  let n := input.length
+  let header ← (← arrField heap "header").mapM nat
+  need (header == #[32 * (n + 2), 32 * capacity, n + 2, if released then n + 2 else 1,
+      n, if released then 0 else n + 1, n + 2, 0, 2 * n, 0]) "benchmark heap counters disagree"
+  let cells ← arrField heap "cells"
+  need (cells.size == n + 2) "benchmark allocated cell inventory disagrees"
+  for index in [:cells.size] do
+    let actual ← array cells[index]!
+    let expected := if released || index == 0 then
+        #[toJson (3 : Nat), toJson (0 : Nat), Json.null, toJson (0 : Nat)]
+      else if index == n + 1 then
+        #[toJson (0 : Nat), toJson (0 : Nat), Json.null, toJson (0 : Nat)]
+      else #[toJson (1 : Nat), toJson input.values[n - index]!.toNat, toJson (index + 1), toJson (0 : Nat)]
+    need (actual == expected) "benchmark cell value, ownership, or reclamation disagrees"
+
+def inspectCase (implementation : String) (input : Input) (capacity : Nat) (row : Json) : IO Unit := do
+  need ((← kind row) == "case" && (← number row "id") == input.id) "benchmark case identity disagrees"
+  need ((← field row "values") == toJson (input.values.reverse.map UInt64.toNat)) "benchmark reversed values disagree"
+  need ((← number row "digest") == input.expectedDigest.toNat) "benchmark case digest disagrees"
+  if isArena implementation then
+    need ((← number row "capacity") == capacity) "benchmark capacity disagrees"
+    inspectHeap (← field row "returned") input capacity false
+    inspectHeap (← field row "reclaimed") input capacity true
+    for flag in ["abi_preserved", "canaries_preserved", "unused_capacity_preserved"] do
+      need ((← field row flag) == toJson true) s!"benchmark {flag} failed"
+  else
+    need ((← field row "capacity") == Json.null) "language runtime declared an arena capacity"
+    if implementation == "lean" then
+      for key in ["exclusive_input_cons", "exclusive_output_cons", "reused_cons"] do
+        need ((← number row key) == input.length) s!"Lean {key} disagrees"
+      need ((← field row "released") == toJson true) "Lean result was not released"
+    else need ((← field row "roots_dropped") == toJson true) "CakeML result root retained"
+
+def inspectMetadata (implementation : String) (row : Json) : IO Unit := do
+  need ((← kind row) == "metadata" && (← strField row "format") == "compilatrix/benchmark-native/1" &&
+    (← strField row "implementation") == implementation && (← strField row "timer") == "CLOCK_MONOTONIC_RAW")
+    "benchmark metadata disagrees"
+  for key in ["resolution_ns", "timer_pair_min_ns", "initial_rss_kb"] do
+    need ((← number row key) > 0) s!"benchmark invalid metadata: {key}"
+  let mean ← checked (fromJson? (← field row "timer_pair_mean_ns") : Except String Float)
+  need (mean > 0 && mean < 1000000) "benchmark timer overhead invalid"
+
+def inspectControl (row : Json) : IO Unit := do
+  need ((← kind row) == "control" && (← number row "operations") == 4194304 &&
+    (← number row "elapsed_ns") > 0 && (← number row "sink") == 0) "benchmark driver control invalid"
+  need (["opaque-empty-handoff", "empty-reverse-handoff"].contains (← strField row "name")) "unknown driver control"
+
+def inspectMatrix (implementation : String) (rows : Array Json) : IO Json := do
+  need (implementations.contains implementation && rows.size >= 3) "benchmark implementation or matrix missing"
+  inspectMetadata implementation rows[0]!
+  inspectControl rows[1]!
+  let mut index := 2
+  for input in inputs do
+    let capacities := if isArena implementation then 65 - input.length else 1
+    for extra in [:capacities] do
+      need (index < rows.size) "benchmark missing correctness row"
+      inspectCase implementation input (input.length + 2 + extra) rows[index]!
+      index := index + 1
+  need (index + 1 == rows.size && (← kind rows[index]!) == "verified" &&
+    (← number rows[index]! "cases") == index - 2) "benchmark correctness inventory disagrees"
+  return Json.mkObj [("implementation", toJson implementation), ("cases", toJson (index - 2)),
+    ("full_values", toJson true), ("matrix_blake3", toJson (digest (Json.arr (rows.extract 2 index)).compress.toUTF8))]
+
+def sampleSink (row : TimingCase) (operations : Nat) : UInt64 := Id.run do
+  let ids := row.inputIds
+  let cycle := ids.foldl (fun total id => total + inputs[id]!.expectedDigest) 0
+  let rest := (ids.extract 0 (operations % ids.size)).foldl (fun total id => total + inputs[id]!.expectedDigest) 0
+  return cycle * (operations / ids.size).toUInt64 + rest
+
+def inspectSample (implementation : String) (mode rowId sample operations : Nat) (row : Json) : IO Unit := do
+  need (rowId < timingCases.size) "benchmark row outside inventory"
+  need ((← kind row) == "sample" && (← strField row "implementation") == implementation &&
+    (← number row "mode") == mode && (← number row "row") == rowId &&
+    (← number row "sample") == sample && (← number row "operations") == operations &&
+    operations > 0 && operations % (chunkSize * 6) == 0) "benchmark sample identity disagrees"
+  need ((← number row "sink") == (sampleSink timingCases[rowId]! operations).toNat) "benchmark timed sink disagrees"
+  let elapsed ← number row "elapsed_ns"
+  let minimum ← number row "minimum_chunk_ns"
+  let chunks := operations / chunkSize
+  need ((← number row "chunks") == chunks && (← number row "timer_calls") == 2 * chunks &&
+    minimum > 0 && elapsed >= minimum * chunks) "benchmark timer/chunk counts disagree"
+  for key in ["envelope_cpu_ns", "minor_faults", "major_faults", "voluntary_switches", "involuntary_switches"] do
+    let _ ← number row key
+  need ((← number row "envelope_ns") >= elapsed && (← number row "rss_kb") > 0 &&
+    (← number row "peak_rss_kb") > 0) "benchmark envelope or process memory invalid"
+
+def checkerRegressions (implementation : String) (rows : Array Json) : IO Unit := do
+  let row := rows[11]!
+  let id ← number row "id"
+  let input := inputs[id]!
+  let capacity ← if isArena implementation then number row "capacity" else pure (input.length + 2)
+  for (name, path, replacement, fragment) in [
+      ("case id", ["id"], toJson (585 : Nat), "case identity"),
+      ("case values", ["values"], toJson [123456789], "reversed values"),
+      ("case digest", ["digest"], toJson (0 : Nat), "case digest")] do
+    rejects name fragment (inspectCase implementation input capacity (← replaceAt row path replacement))
+  if isArena implementation then
+    for key in ["abi_preserved", "canaries_preserved", "unused_capacity_preserved"] do
+      rejects key key (inspectCase implementation input capacity (← replaceAt row [key] (toJson false)))
+    rejects "heap counters" "heap counters" (inspectCase implementation input capacity
+      (← replaceAt row ["reclaimed", "header"] (toJson ([] : List Nat))))
+  rejects "missing correctness row" "missing correctness row" (inspectMatrix implementation (rows.extract 0 8) *> pure ())
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/CounterFold.lean b/Benchmarks/Compiler/CounterFold.lean
new file mode 100644
index 000000000..0ba855088
--- /dev/null
+++ b/Benchmarks/Compiler/CounterFold.lean
@@ -0,0 +1,213 @@
+import Benchmarks.Compiler.CounterFoldRun
+import Benchmarks.Compiler.Reproduce
+
+namespace Benchmarks.Compiler.CounterFold
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def inspectProcess (process : Json) (variant executableHash stdoutHash : String) (core : Nat) (schedule : Schedule) : IO Unit := do
+  need ((← strField process "variant") == variant && (← strField process "executable_blake3") == executableHash &&
+    (← number process "exit_code") == 0 && (← number process "core") == core &&
+    (← field process "schedule") == toJson schedule &&
+    (← strField process "schedule_blake3") == digest schedule.bytes &&
+    (← strField process "stdout_blake3") == stdoutHash) "counter-fold raw process identity disagrees"
+
+def inspectMeasurement (build measured : FilePath) : IO (Json × Array ObservedBlock) := do
+  requireCorrectness build measured
+  let freeze ← inspectFreeze build measured
+  let manifest ← readJson (measured / "measurement.json")
+  let buildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  let freezeHash := digest (← IO.FS.readBinFile (measured / "freeze.json"))
+  need ((← strField manifest "format") == "compilatrix/counter-fold-measurement/1" &&
+    (← strField manifest "status") == "complete" && (← number manifest "samples") == 6840 &&
+    (← strField manifest "build_blake3") == buildHash && (← strField manifest "freeze_blake3") == freezeHash &&
+    (← strField manifest "samples_blake3") == digest (← IO.FS.readBinFile (measured / "samples.jsonl")))
+    "counter-fold measurement inventory or digest disagrees"
+  let reference ← field freeze "environment"
+  let core ← number freeze "core"
+  for file in ["environment-start.json", "environment-end.json"] do
+    need (← stableEnvironment reference (← readJson (measured / file))) "counter-fold measurement environment drift"
+  let valid ← arrField manifest "valid_blocks"
+  need (valid.size == 30) "counter-fold paired block inventory disagrees"
+  let mut observations := #[]
+  let mut reconstructed := #[]
+  for block in (← arrField freeze "blocks") do
+    let id ← number block "block"
+    let session ← number block "session"
+    let status := valid[id]!
+    let attempt ← number status "attempt"
+    need ((← number status "block") == id && (← number status "session") == session &&
+      (← strField status "status") == "valid" && (← field status "reason") == Json.null &&
+      (← number status "samples") == 228 && attempt < 3) "counter-fold valid block identity disagrees"
+    let directory := measured / s!"session-{session}/block-{id}/attempt-{attempt}"
+    need ((← readJson (directory / "status.json")) == status) "counter-fold retained block status disagrees"
+    for file in ["environment-start.json", "environment-end.json"] do
+      need (← stableEnvironment reference (← readJson (directory / file))) "counter-fold valid block environment drift"
+    let schedule ← checked (fromJson? (← field block "schedule") : Except String Schedule)
+    let order ← (← arrField block "variant_order").mapM string
+    let mut samples := Array.replicate 38 (Array.replicate 2 #[])
+    let mut initialRss := Array.replicate 2 0
+    for index in [:order.size] do
+      let variant := order[index]!
+      let variantIndex ← present (variants.toList.idxOf? variant) "unknown measured variant"
+      let path := directory / s!"{variant}.jsonl"
+      let rows ← readLines path
+      let native ← inspectRun "compilatrix" schedule rows true
+      initialRss := initialRss.set! variantIndex (← number rows[0]! "initial_rss_kb")
+      let process ← readJson (path.withExtension "process.json")
+      let hash := digest (← IO.FS.readBinFile (build / s!"bin/{variant}"))
+      let stdoutHash := digest (← IO.FS.readBinFile path)
+      inspectProcess process variant hash stdoutHash core schedule
+      need ((← IO.FS.readBinFile (path.withExtension "bin")) == schedule.bytes) "counter-fold raw binary schedule drift"
+      if id == 0 then
+        for (key, value) in [("variant", toJson "unknown"), ("executable_blake3", toJson "wrong"),
+            ("stdout_blake3", toJson "wrong"), ("core", toJson (core + 1)), ("exit_code", toJson (1 : Nat))] do
+          rejects key "raw process identity" (inspectProcess (← replaceAt process [key] value) variant hash stdoutHash core schedule)
+      for sample in native do
+        let row ← number sample "row"
+        need ((← number sample "peak_rss_kb") <= 2097152) "counter-fold valid block exceeded RSS bound"
+        samples := samples.set! row (samples[row]!.set! variantIndex (samples[row]![variantIndex]!.push sample))
+        reconstructed := reconstructed.push (enriched sample variant id session index attempt buildHash freezeHash hash)
+    need (samples.all (fun row => row.all (·.size == 3))) "counter-fold block has missing paired rows"
+    observations := observations.push { samples, upstream := #[], initialRss }
+  need ((← readLines (measured / "samples.jsonl")) == reconstructed) "counter-fold combined samples differ from paired raw process records"
+  return (freeze, observations)
+
+def analyzeSuite (build measured output : FilePath) : IO Unit := do
+  fresh output
+  analysisSelfCheck
+  let (freeze, blocks) ← inspectMeasurement build measured
+  let hash := digest (← IO.FS.readBinFile (build / "build.json"))
+  freezeRegressions hash freeze
+  let indices := bootstrapIndices
+  let mut results := #[]
+  let mut report := "# Checked reserve/reuse counter folding\n\n" ++
+    "One source function, two checked native lowerings, and identical C driver objects. " ++
+    "The only loop rewrite removes four cancelling reservation/live counter changes (12 instructions per element). " ++
+    "Every cell operation and cumulative reuse/payload counter update remains.\n\n" ++
+    "Each row contains 30 paired blocks across three sessions, using each variant's median of three native samples per block. " ++
+    "Operation counts are common within each row and frozen before measurement. Samples accumulate at least 100 ms. " ++
+    "The paired speedup is baseline time divided by folded time; values above one favor folding. " ++
+    "The 95% intervals use 10,000 hierarchical paired bootstrap draws, resampling sessions and then blocks (seed 2671931027). " ++
+    "All valid slow samples are retained and the timer control is not subtracted. " ++
+    "This is a shared host with a pinned worker, uncontrolled SMT sibling and only three session clusters; it establishes no CI timing threshold.\n\n"
+  for profile in [:2] do
+    report := report ++ s!"## {if profile == 0 then "Entry plus handoff" else "Complete lifecycle"}\n\n" ++
+      "Nanoseconds per operation; lifecycle includes fresh construction, reversal, digest and full reclamation.\n\n" ++
+      "| Length | Domain | Baseline ns | Folded ns | Paired speedup [95% interval] |\n" ++
+      "| ---: | --- | ---: | ---: | ---: |\n"
+    for localId in [:19] do
+      let id := profile * 19 + localId
+      let specification := timingCases[id]!
+      let values ← variants.mapIdxM fun variantIndex _ => blocks.mapM fun block => do
+        return median (← block.samples[id]![variantIndex]!.mapM nsPerOp)
+      let stats := values.map (distribution indices)
+      let ratio := distribution indices (values[0]!.zipWith (· / ·) values[1]!)
+      let row := Json.mkObj [("row", toJson id), ("case", specification.json),
+        ("baseline_ns_per_operation", stats[0]!), ("folded_ns_per_operation", stats[1]!),
+        ("paired_speedup_baseline_over_folded", ratio)]
+      results := results.push row
+      report := report ++ s!"| {specification.length} | {domainName specification.domain} | " ++
+        s!"{compactFloat (median values[0]!)} | {compactFloat (median values[1]!)} | " ++
+        s!"{compactFloat (← statistic ratio "median")} [{compactFloat (← statistic ratio "ci95_low")}, {compactFloat (← statistic ratio "ci95_high")}] |\n"
+    report := report ++ "\n"
+  let mut resources := #[]
+  let mut code := #[]
+  report := report ++ "## Code and checking work\n\n" ++
+    "The object text sizes below isolate the checked reversal and release functions. " ++
+    "Generation and independent-gate CPU/wall/RSS records are diagnostic envelopes: generation includes pipeline construction and modeled fixture executions; " ++
+    "each gate includes two fresh generations, decoding, corruption checks and a linked native harness. " ++
+    "They are retained as complete costs, without attributing them to an isolated compiler or proof-checker phase.\n\n" ++
+    "| Variant | Reversal `.text` bytes | Release `.text` bytes | Producer wall s | Gate wall s |\n" ++
+    "| --- | ---: | ---: | ---: | ---: |\n"
+  for variant in variants do
+    let mut sizes := #[]
+    for role in ["main", "release"] do
+      let text ← IO.FS.readFile (build / s!"diagnostics/build/size-{variant}-{role}.stdout")
+      let line ← present ((text.splitOn "\n").find? (fun line => (words line).head? == some ".text")) "missing object text size"
+      let size ← present ((words line)[1]?.bind String.toNat?) "invalid object text size"
+      sizes := sizes.push size
+    let generation ← readJson (build / s!"diagnostics/build/produce-{variant}.resources.json")
+    let gate ← readJson (build / s!"diagnostics/build/independent-gate-{variant}.resources.json")
+    let pipeline ← IO.FS.readBinFile (build / s!"artifacts/{variant}/pipeline.json")
+    code := code.push (Json.mkObj [("variant", toJson variant), ("main_text_bytes", toJson sizes[0]!),
+      ("release_text_bytes", toJson sizes[1]!), ("pipeline_json_bytes", toJson pipeline.size),
+      ("generation_envelope", generation), ("independent_gate_envelope", gate)])
+    report := report ++ s!"| {variant} | {sizes[0]!} | {sizes[1]!} | {← statistic generation "wall_seconds"} | {← statistic gate "wall_seconds"} |\n"
+  for index in [:2] do
+    let mut peak := 0
+    let mut currentMin : Option Nat := none
+    let mut currentMax := 0
+    for block in blocks do
+      for row in block.samples do
+        for sample in row[index]! do
+          let rss ← number sample "rss_kb"
+          currentMin := some (min rss (currentMin.getD rss))
+          currentMax := max currentMax rss
+          peak := max peak (← number sample "peak_rss_kb")
+    resources := resources.push (Json.mkObj [("variant", toJson variants[index]!),
+      ("ready_rss_kb_median", toJson (median (blocks.map (fun block => block.initialRss[index]!.toFloat)))),
+      ("minimum_sample_rss_kb", toJson currentMin), ("maximum_sample_rss_kb", toJson currentMax),
+      ("maximum_recorded_peak_rss_kb", toJson peak)])
+  writeJson (output / "summary.json") (Json.mkObj [("format", toJson "compilatrix/counter-fold-analysis/1"),
+    ("build_blake3", toJson hash), ("freeze_blake3", toJson (digest (← IO.FS.readBinFile (measured / "freeze.json")))),
+    ("measurement_blake3", toJson (digest (← IO.FS.readBinFile (measured / "measurement.json")))),
+    ("environment", ← field freeze "environment"), ("timing_policy", timingPolicy), ("results", toJson results),
+    ("code_and_checking", toJson code), ("process_memory", toJson resources)])
+  IO.FS.writeFile (output / "report.md") report
+  IO.println "counter-fold analysis: 38 paired comparisons, uncertainty, code/checking costs and process memory validated"
+
+def reproduceSuite (build measured output : FilePath) : IO Unit := do
+  let build ← absolute build
+  let measured ← absolute measured
+  let output ← absolute output
+  let (_, _) ← inspectMeasurement build measured
+  fresh output
+  let metadata ← inspectBuild build
+  let environment ← checked (fromJson? (← field metadata "build_environment") : Except String (Array (String × Option String)))
+  need (environment.map Prod.fst == buildEnvNames) "counter-fold replay environment inventory disagrees"
+  for row in (← array (← readJson (build / "tool-identities.json"))) do
+    need (digest (← IO.FS.readBinFile (← strField row "resolved")) == (← strField row "blake3")) "counter-fold installed tool drift"
+  let snapshot ← readJson (build / "source.json")
+  need (digest (← IO.FS.readBinFile (build / "source.tar.gz")) == (← strField snapshot "archive_blake3")) "counter-fold source archive digest disagrees"
+  let source := output / "source"
+  IO.FS.createDirAll source
+  let inventory ← arrField snapshot "files"
+  let names ← inventory.mapM (fun row => strField row "path")
+  need (names.toList.Nodup && names.all (fun name => !name.startsWith "/" &&
+    !(name.splitOn "/").any (fun part => part == ".." || part.isEmpty))) "unsafe counter-fold source inventory"
+  let listing := (← run "tar" #["-tzf", (build / "source.tar.gz").toString]).trimAscii.toString.splitOn "\n"
+  need (listing.mergeSort (· ≤ ·) == names.toList.mergeSort (· ≤ ·)) "counter-fold source tar inventory disagrees"
+  let _ ← run "tar" #["--no-same-owner", "--no-same-permissions", "-xzf", (build / "source.tar.gz").toString, "-C", source.toString]
+  for row in inventory do
+    let bytes ← IO.FS.readBinFile (source / (← strField row "path"))
+    need (bytes.size == (← number row "bytes") && digest bytes == (← strField row "blake3")) "counter-fold extracted source differs"
+  IO.FS.createDirAll (source / ".lake/build/bin")
+  for path in (← files (build / "tools-bin")) do
+    let _ ← run "cp" #[path.toString, (source / ".lake/build/bin" / path.fileName.getD "missing").toString]
+  let runner := (source / ".lake/build/bin/compiler-benchmark").toString
+  let rebuilt := output / "build"
+  replayCommand source environment runner #["counter-fold-build", rebuilt.toString, "--gcc", ← strField metadata "gcc",
+    "--time", ← strField metadata "timer_tool"] (output / "rebuild.jsonl")
+  let rebuiltMetadata ← inspectBuild rebuilt
+  for key in ["artifacts", "executables", "tools", "goldens", "datasets_blake3", "protocol_blake3"] do
+    need ((← field rebuiltMetadata key) == (← field metadata key)) s!"counter-fold independent rebuild changed {key}"
+  replayCommand source environment runner #["counter-fold-verify", rebuilt.toString, (output / "correctness").toString] (output / "verify.jsonl")
+  let original ← arrField (← readJson (measured / "correctness.json")) "matrices"
+  let repeated ← arrField (← readJson (output / "correctness/correctness.json")) "matrices"
+  need (original.size == 2 && repeated.size == 2) "counter-fold replay matrix inventory changed"
+  for i in [:2] do
+    need ((← field original[i]! "result") == (← field repeated[i]! "result")) "counter-fold independent matrix differs"
+  replayCommand source environment runner #["counter-fold-analyze", build.toString, measured.toString,
+    (output / "analysis").toString] (output / "analysis.jsonl")
+  for file in ["summary.json", "report.md"] do
+    need ((← IO.FS.readBinFile (output / "analysis" / file)) == (← IO.FS.readBinFile (measured / "analysis" / file)))
+      s!"counter-fold independent analysis changed {file}"
+  writeJson (output / "reproduction.json") (Json.mkObj [("format", toJson "compilatrix/counter-fold-reproduction/1"),
+    ("source_archive_blake3", ← field snapshot "archive_blake3"), ("original_build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))),
+    ("rebuilt_build_blake3", toJson (digest (← IO.FS.readBinFile (rebuilt / "build.json")))), ("source_files", toJson inventory.size),
+    ("artifacts_exact", toJson true), ("executables_exact", toJson true), ("correctness_exact", toJson true), ("analysis_exact", toJson true),
+    ("scope", toJson "fresh extracted source, empty process environment plus recorded variables, hashed producer/checker seeds, same host and pinned Nix closure"),
+    ("timing_samples_rerun", toJson false), ("status", toJson "passed")])
+  IO.println "counter-fold reproduction: exact rebuilt objects, executables, complete results and retained-sample analysis passed"
+
+end Benchmarks.Compiler.CounterFold
diff --git a/Benchmarks/Compiler/CounterFoldBuild.lean b/Benchmarks/Compiler/CounterFoldBuild.lean
new file mode 100644
index 000000000..20ae1101d
--- /dev/null
+++ b/Benchmarks/Compiler/CounterFoldBuild.lean
@@ -0,0 +1,182 @@
+import Benchmarks.Compiler.Schedule
+
+namespace Benchmarks.Compiler.CounterFold
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def variants : Array String := #["baseline", "counter-fold"]
+
+def inspectBuild (build : FilePath) : IO Json := do
+  checkData
+  let metadata ← readJson (build / "build.json")
+  need ((← strField metadata "format") == "compilatrix/counter-fold-build/1" &&
+    (← field metadata "variants") == toJson variants) "counter-fold build policy disagrees"
+  need ((← IO.FS.readBinFile (build / "datasets/datasets.bin")) == datasetBytes &&
+    (← readJson (build / "datasets/datasets.json")) == datasetJson &&
+    (← strField metadata "datasets_blake3") == digest datasetBytes) "counter-fold dataset drift"
+  for (directory, key) in [("artifacts", "artifacts"), ("bin", "executables"), ("tools-bin", "tools"), ("goldens", "goldens")] do
+    inspectFiles (build / directory) (← field metadata key)
+  need (digest (← IO.FS.readBinFile (build / "tool-identities.json")) == (← strField metadata "tool_identities_blake3") &&
+    digest (← IO.FS.readBinFile (build / "protocol.md")) == (← strField metadata "protocol_blake3")) "counter-fold tool/protocol drift"
+  let baseline ← readJson (build / "artifacts/baseline/report.json")
+  let folded ← readJson (build / "artifacts/counter-fold/report.json")
+  for variant in variants do
+    need ((← readJson (build / s!"artifacts/{variant}/report.json")) ==
+      (← readJson (build / s!"goldens/{variant}.json"))) "counter-fold artifact differs from reviewed golden"
+  for key in ["source_identity", "ixir1_root", "adapter_and_selection_rejections"] do
+    need ((← field baseline key) == (← field folded key)) "paired source or fallback behavior differs"
+  let original ← arrField baseline "cases"
+  let improved ← arrField folded "cases"
+  need (original.size == 8 && improved.size == 8) "paired artifact case inventory disagrees"
+  for i in [:8] do
+    for key in ["name", "input", "value", "release_steps", "rejections"] do
+      need ((← field original[i]! key) == (← field improved[i]! key)) "paired artifact semantics differ"
+    let count := (← arrField original[i]! "input").size
+    need ((← number original[i]! "main_steps") == 42 * count + 82 &&
+      (← number improved[i]! "main_steps") == 30 * count + 82) "paired instruction cost disagrees"
+  return metadata
+
+def buildSuite (output : FilePath) (gcc : String := "gcc") (timerTool : String := "time") : IO Unit := do
+  let output ← absolute output
+  fresh output
+  for directory in ["bin", "artifacts/driver", "tools-bin", "goldens", "diagnostics/build"] do
+    IO.FS.createDirAll (output / directory)
+  writeDatasets (output / "datasets")
+  IO.FS.writeFile (output / "protocol.md") (← IO.FS.readFile "Benchmarks/Compiler/counter-fold.md")
+  let logs := output / "diagnostics/build"
+  let flags := cFlags ++ #[s!"-ffile-prefix-map={output}=/counter-fold-build"]
+  let version ← logged logs "gcc-version" gcc #["--version"] #[] none timerTool
+  need (version.contains "14.3.0") "counter-fold requires pinned GCC 14.3.0"
+  let _ ← logged logs "worker-launcher" gcc
+    (flags ++ #["-Wall", "-Wextra", "-Werror", "Benchmarks/Compiler/native/worker_launcher.c", "-o", (output / "bin/worker-launcher").toString]) #[] none timerTool
+  for name in ["common", "driver", "arena_backend"] do
+    let _ ← logged logs s!"driver-{name}" gcc (flags ++ #["-Wall", "-Wextra", "-Werror", "-c",
+      s!"Benchmarks/Compiler/native/{name}.c", "-o", (output / s!"artifacts/driver/{name}.o").toString]) #[] none timerTool
+  let driver := #["common", "driver", "arena_backend"].map fun name => (output / s!"artifacts/driver/{name}.o").toString
+  for variant in variants do
+    let artifacts := output / s!"artifacts/{variant}"
+    let options := if variant == "counter-fold" then #["--counter-fold"] else #[]
+    let _ ← logged logs s!"produce-{variant}" ".lake/build/bin/compiler-source-native-runtime" (options ++ #[artifacts.toString]) #[] none timerTool
+    let expected := if variant == "counter-fold" then "expected-counter-fold.json" else "expected.json"
+    IO.FS.writeFile (output / s!"goldens/{variant}.json") (← IO.FS.readFile s!"Tests/Fixtures/Compiler/source-native-runtime/{expected}")
+    let _ ← logged logs s!"independent-gate-{variant}" ".lake/build/bin/compiler-check-source-native-runtime"
+      #["--fixture", ".lake/build/bin/compiler-source-native-runtime", "--variant", variant, "--artifacts", artifacts.toString, "--cc", gcc,
+        "--harness", "Tests/Fixtures/Compiler/source-native-runtime/native_harness.c"] #[] none timerTool
+    let _ ← logged logs s!"link-{variant}" gcc (flags ++ driver ++
+      #[(artifacts / "main.o").toString, (artifacts / "release.o").toString,
+        "-Wl,-z,noexecstack", "-o", (output / s!"bin/{variant}").toString]) #[] none timerTool
+    for role in ["main", "release"] do
+      let _ ← logged logs s!"size-{variant}-{role}" "size" #["-A", (artifacts / s!"{role}.o").toString] #[] none timerTool
+      let _ ← logged logs s!"disassembly-{variant}-{role}" "objdump" #["-d", (artifacts / s!"{role}.o").toString] #[] none timerTool
+    let _ ← logged logs s!"size-{variant}" "size" #["-A", (output / s!"bin/{variant}").toString] #[] none timerTool
+    let _ ← logged logs s!"dependencies-{variant}" "ldd" #[(output / s!"bin/{variant}").toString] #[] none timerTool
+  let mut identities := #[]
+  let mut roots : Array String := #[]
+  for (name, command) in [("gcc", gcc), ("lean", "lean"), ("lake", "lake"), ("time", timerTool)] do
+    let path := (← run "which" #[command]).trimAscii.toString
+    let resolved := (← run "readlink" #["-f", path]).trimAscii.toString
+    identities := identities.push (Json.mkObj [("name", toJson name), ("resolved", toJson resolved),
+      ("blake3", toJson (digest (← IO.FS.readBinFile resolved)))])
+    if resolved.startsWith "/nix/store/" then
+      let root := String.intercalate "/" ((resolved.splitOn "/").take 4)
+      if !roots.contains root then roots := roots.push root
+  writeJson (output / "tool-identities.json") (Json.arr identities)
+  let closure ← IO.Process.output { cmd := "nix-store", args := #["--query", "--requisites"] ++ roots }
+  IO.FS.writeFile (output / "nix-closure.txt") closure.stdout
+  writeJson (output / "nix-closure-status.json") (Json.mkObj [("roots", toJson roots),
+    ("exit_code", toJson closure.exitCode.toNat), ("stderr", toJson closure.stderr)])
+  for name in ["benchmark", "source-native-runtime", "check-source-native-runtime"] do
+    let _ ← run "cp" #[s!".lake/build/bin/compiler-{name}", (output / s!"tools-bin/compiler-{name}").toString]
+  writeJson (output / "build.json") (Json.mkObj [
+    ("format", toJson "compilatrix/counter-fold-build/1"), ("variants", toJson variants),
+    ("gcc", toJson gcc), ("timer_tool", toJson timerTool), ("gcc_version", toJson version),
+    ("build_environment", toJson (← buildEnvNames.mapM fun name => do return (name, ← IO.getEnv name))),
+    ("datasets_blake3", toJson (digest datasetBytes)), ("artifacts", ← recordFiles (output / "artifacts")),
+    ("executables", ← recordFiles (output / "bin")), ("tools", ← recordFiles (output / "tools-bin")),
+    ("goldens", ← recordFiles (output / "goldens")),
+    ("tool_identities_blake3", toJson (digest (← IO.FS.readBinFile (output / "tool-identities.json")))),
+    ("protocol_blake3", toJson (digest (← IO.FS.readBinFile (output / "protocol.md"))))])
+  let _ ← inspectBuild output
+  let _ ← sourceSnapshot output
+  IO.println s!"counter-fold build: two checked variants, identical driver objects, retained source and native artifacts in {output}"
+
+def runScheduled (build output : FilePath) (variant : String) (schedule : Schedule) (core : Nat) : IO (Array Json) := do
+  need (variants.contains variant) "unknown counter-fold variant"
+  writeSchedule (output.withExtension "bin") schedule
+  let result ← streamed { cmd := "taskset", args := #["--cpu-list", toString core,
+    (build / "bin/worker-launcher").toString, (build / s!"bin/{variant}").toString,
+    "compilatrix", "run", (build / "datasets/datasets.bin").toString, (output.withExtension "bin").toString], env := runtimeEnv } output
+  IO.FS.writeFile (output.withExtension "stderr") result.stderr
+  writeJson (output.withExtension "process.json") (Json.mkObj [("variant", toJson variant),
+    ("executable_blake3", toJson (digest (← IO.FS.readBinFile (build / s!"bin/{variant}")))),
+    ("exit_code", toJson result.exitCode.toNat), ("core", toJson core), ("schedule", toJson schedule),
+    ("schedule_blake3", toJson (digest schedule.bytes)), ("stdout_blake3", toJson (digest result.stdout.toUTF8))])
+  need (result.exitCode == 0) s!"counter-fold {variant} failed: {result.stderr}"
+  inspectRun "compilatrix" schedule (← readLines output) (schedule.mode == 2)
+
+def verifySuite (build output : FilePath) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  fresh output
+  let metadata ← inspectBuild build
+  let timer ← strField metadata "timer_tool"
+  let mut summaries := #[]
+  let mut matrixIdentity : Option Json := none
+  for variant in variants do
+    let result ← logged (output / "logs") s!"matrix-{variant}" (build / s!"bin/{variant}").toString
+      #["compilatrix", "verify", (build / "datasets/datasets.bin").toString] runtimeEnv none timer
+    IO.FS.writeFile (output / s!"{variant}.jsonl") result
+    let rows ← readLines (output / s!"{variant}.jsonl")
+    let start ← IO.monoNanosNow
+    let summary ← inspectMatrix "compilatrix" rows
+    checkerRegressions "compilatrix" rows
+    let checkNs := (← IO.monoNanosNow) - start
+    let identity ← field summary "matrix_blake3"
+    if let some expected := matrixIdentity then need (identity == expected) "paired complete arena observations differ"
+    matrixIdentity := some identity
+    summaries := summaries.push (Json.mkObj [("variant", toJson variant), ("result", summary), ("independent_check_ns", toJson checkNs)])
+    IO.println s!"counter-fold verify: {variant}, 585 inputs and 19305 complete arena observations"
+  let mut negatives := #[]
+  for (name, bytes, reason) in [
+      ("magic", datasetBytes.set! 0 0, "wrong binary magic"),
+      ("count", datasetBytes.set! 8 0, "wrong dataset inventory"),
+      ("metadata", datasetBytes.set! 16 1, "noncanonical dataset metadata"),
+      ("padding", datasetBytes.set! 48 1, "nonzero dataset padding"),
+      ("trailing", datasetBytes.push 0, "trailing binary input"),
+      ("truncated", datasetBytes.extract 0 (datasetBytes.size - 1), "truncated binary input")] do
+    let path := output / s!"bad-{name}.bin"
+    IO.FS.writeBinFile path bytes
+    for variant in variants do
+      let result ← IO.Process.output {
+        cmd := (build / s!"bin/{variant}").toString,
+        args := #["compilatrix", "verify", path.toString], env := runtimeEnv }
+      need (result.exitCode != 0 && result.stderr.contains reason) s!"{variant} accepted malformed dataset {name}"
+      negatives := negatives.push (Json.mkObj [("variant", toJson variant), ("case", toJson name),
+        ("exit_code", toJson result.exitCode.toNat), ("stderr", toJson result.stderr)])
+  let _ ← inspectBuild build
+  writeJson (output / "correctness.json") (Json.mkObj [("format", toJson "compilatrix/counter-fold-correctness/1"),
+    ("build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))),
+    ("executables", ← field metadata "executables"), ("matrices", Json.arr summaries),
+    ("malformed_datasets", Json.arr negatives), ("status", toJson "passed")])
+
+def smokeSuite (build output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  fresh output
+  let metadata ← inspectBuild build
+  let schedule : Schedule := {
+    mode := 0, samples := 1, warmNs := 10000000,
+    order := (List.range 38).toArray, operations := Array.replicate 38 (chunkSize * 6) }
+  let mut samples := #[]
+  for variant in variants do
+    let rows ← runScheduled build (output / s!"{variant}.jsonl") variant schedule core
+    samples := samples ++ rows
+  need (samples.size == 76) "counter-fold smoke inventory disagrees"
+  let first ← readLines (output / "baseline.jsonl")
+  rejects "missing paired sample" "run inventory" (inspectRun "compilatrix" schedule (first.pop) *> pure ())
+  for (key, value, reason) in [("operations", toJson (1 : Nat), "sample identity"),
+      ("sink", toJson (0 : Nat), "timed sink"), ("elapsed_ns", toJson (0 : Nat), "timer/chunk")] do
+    rejects key reason (inspectSample "compilatrix" 0 0 0 (chunkSize * 6) (← replaceAt samples[0]! [key] value))
+  writeJson (output / "smoke.json") (Json.mkObj [("format", toJson "compilatrix/counter-fold-smoke/1"),
+    ("executables", ← field metadata "executables"), ("samples", toJson samples), ("status", toJson "passed")])
+  IO.println "counter-fold smoke: both executables, 76 timing rows, full results and sample corruption checks passed"
+
+end Benchmarks.Compiler.CounterFold
diff --git a/Benchmarks/Compiler/CounterFoldRun.lean b/Benchmarks/Compiler/CounterFoldRun.lean
new file mode 100644
index 000000000..1e87b100e
--- /dev/null
+++ b/Benchmarks/Compiler/CounterFoldRun.lean
@@ -0,0 +1,184 @@
+import Benchmarks.Compiler.CounterFoldBuild
+import Benchmarks.Compiler.Analyze
+
+namespace Benchmarks.Compiler.CounterFold
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def requireCorrectness (build correctness : FilePath) : IO Unit := do
+  let result ← readJson (correctness / "correctness.json")
+  let metadata ← inspectBuild build
+  need ((← strField result "format") == "compilatrix/counter-fold-correctness/1" &&
+    (← strField result "status") == "passed" && (← strField result "build_blake3") ==
+    digest (← IO.FS.readBinFile (build / "build.json")) &&
+    (← field result "executables") == (← field metadata "executables")) "counter-fold correctness identity disagrees"
+
+def frozenBlocks (counts : Array Nat) : Array Json := Id.run do
+  let mut state := orderSeed
+  let mut blocks := #[]
+  for block in [:blockCount] do
+    let (order, next) := shuffled (List.range 38).toArray state
+    let (variantOrder, next) := shuffled #[0, 1] next
+    state := next
+    let schedule : Schedule := { mode := 2, samples := 3, warmNs := 1000000000, order, operations := counts }
+    blocks := blocks.push (Json.mkObj [("block", toJson block), ("session", toJson (block / 10)),
+      ("variant_order", toJson (variantOrder.map (variants[·]!))), ("schedule", toJson schedule)])
+  return blocks
+
+def timingPolicy : Json := Json.mkObj [
+  ("minimum_sample_ns", toJson minimumNs), ("pilot_target_ns", toJson pilotTargetNs),
+  ("order_seed", toJson orderSeed.toNat), ("resource_bound_rss_kb", toJson (2097152 : Nat)),
+  ("timer_chunk_minimum_factor", toJson (100 : Nat)), ("session_separation_seconds", toJson (60 : Nat)),
+  ("bootstrap_replicates", toJson (10000 : Nat)), ("bootstrap_seed", toJson (2671931027 : Nat)),
+  ("bootstrap", toJson "hierarchical paired bootstrap: resample three sessions, then ten whole paired blocks within each selected session")]
+
+def inspectFreezeValue (buildHash : String) (freeze : Json) : IO Unit := do
+  need ((← strField freeze "format") == "compilatrix/counter-fold-freeze/1" &&
+    (← strField freeze "build_blake3") == buildHash &&
+    (← field freeze "timing_policy") == timingPolicy) "counter-fold frozen identity or timing policy changed"
+  let counts ← (← arrField freeze "operations").mapM nat
+  let blocks ← arrField freeze "blocks"
+  need (blocks == frozenBlocks counts) "counter-fold frozen randomized order changed"
+  for block in blocks do
+    let schedule ← checked (fromJson? (← field block "schedule") : Except String Schedule)
+    need schedule.valid "counter-fold frozen schedule invalid"
+
+def inspectFreeze (build pilot : FilePath) : IO Json := do
+  let freeze ← readJson (pilot / "freeze.json")
+  inspectFreezeValue (digest (← IO.FS.readBinFile (build / "build.json"))) freeze
+  return freeze
+
+def freezeRegressions (hash : String) (freeze : Json) : IO Unit := do
+  for (name, path, value, reason) in [
+      ("build", ["build_blake3"], toJson "different", "frozen identity"),
+      ("floor", ["timing_policy", "minimum_sample_ns"], toJson (1 : Nat), "timing policy"),
+      ("bootstrap", ["timing_policy", "bootstrap_seed"], toJson (1 : Nat), "timing policy"),
+      ("missing block", ["blocks"], Json.arr #[], "randomized order")] do
+    rejects name reason (inspectFreezeValue hash (← replaceAt freeze path value))
+  let blocks ← arrField freeze "blocks"
+  let changed ← replaceAt blocks[0]! ["variant_order"] (toJson #["baseline", "baseline"])
+  rejects "duplicate variant" "randomized order"
+    (inspectFreezeValue hash (← replaceAt freeze ["blocks"] (toJson (blocks.set! 0 changed))))
+
+def pilotSuite (build correctness output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  requireCorrectness build correctness
+  fresh output
+  let before ← environment core
+  writeJson (output / "environment-start.json") before
+  environmentRegressions before
+  let initial : Schedule := {
+    mode := 1, samples := 1, warmNs := 1000000000,
+    order := (List.range 38).toArray, operations := Array.replicate 38 (chunkSize * 6) }
+  let mut counts := initial.operations
+  let mut estimates := #[]
+  for variant in variants do
+    let samples ← runScheduled build (output / s!"initial-{variant}.jsonl") variant initial core
+    for row in samples do
+      let id ← number row "row"
+      let operations ← number row "operations"
+      let elapsed ← number row "elapsed_ns"
+      counts := counts.set! id (max counts[id]! (roundOperations ((operations * pilotTargetNs + elapsed - 1) / elapsed)))
+      estimates := estimates.push (Json.mkObj [("variant", toJson variant), ("observation", row)])
+    IO.println s!"counter-fold pilot: initial {variant} complete"
+  let schedule := { initial with operations := counts }
+  let mut confirmation := #[]
+  for variant in variants do
+    let samples ← runScheduled build (output / s!"confirmation-{variant}.jsonl") variant schedule core
+    for row in samples do
+      need ((← number row "elapsed_ns") >= minimumNs) s!"new premeasurement calibration required: {variant}"
+      confirmation := confirmation.push (Json.mkObj [("variant", toJson variant), ("observation", row)])
+    IO.println s!"counter-fold pilot: confirmed {variant}"
+  let after ← environment core
+  writeJson (output / "environment-end.json") after
+  need (← stableEnvironment before after) "counter-fold pilot environment drift"
+  let _ ← inspectBuild build
+  let hash := digest (← IO.FS.readBinFile (build / "build.json"))
+  let freeze := Json.mkObj [("format", toJson "compilatrix/counter-fold-freeze/1"), ("build_blake3", toJson hash),
+    ("environment", before), ("core", toJson core), ("timing_policy", timingPolicy), ("operations", toJson counts),
+    ("blocks", toJson (frozenBlocks counts)), ("initial_estimates", toJson estimates), ("confirmation", toJson confirmation)]
+  inspectFreezeValue hash freeze
+  freezeRegressions hash freeze
+  writeJson (output / "freeze.json") freeze
+  IO.println "counter-fold pilot: common counts frozen for 30 paired blocks in three sessions"
+
+def enriched (sample : Json) (variant : String) (block session order attempt : Nat)
+    (buildHash freezeHash executableHash : String) : Json :=
+  Json.mkObj [("variant", toJson variant),
+    ("sample", Benchmarks.Compiler.enriched sample block session order attempt buildHash freezeHash executableHash)]
+
+def measureSuite (build correctness pilot output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  requireCorrectness build correctness
+  let freeze ← inspectFreeze build pilot
+  need ((← number freeze "core") == core) "counter-fold measurement core differs from pilot"
+  let reference ← field freeze "environment"
+  let initial ← environment core
+  need (← stableEnvironment reference initial) "counter-fold measurement environment differs from pilot"
+  fresh output
+  for (source, name) in [(pilot, "freeze.json"), (correctness, "correctness.json")] do
+    IO.FS.writeFile (output / name) (← IO.FS.readFile (source / name))
+  writeJson (output / "environment-start.json") initial
+  let buildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  let freezeHash := digest (← IO.FS.readBinFile (output / "freeze.json"))
+  let combined ← IO.FS.Handle.mk (output / "samples.jsonl") .write
+  let mut completed := #[]
+  for block in (← arrField freeze "blocks") do
+    let id ← number block "block"
+    let session ← number block "session"
+    if id > 0 && id % 10 == 0 then
+      IO.println s!"counter-fold measurement: session {session + 1} after the frozen 60-second idle interval"
+      IO.sleep 60000
+    let schedule ← checked (fromJson? (← field block "schedule") : Except String Schedule)
+    let order ← (← arrField block "variant_order").mapM string
+    let mut accepted := false
+    for attempt in [:3] do
+      if accepted then break
+      let directory := output / s!"session-{session}/block-{id}/attempt-{attempt}"
+      IO.FS.createDirAll directory
+      let before ← environment core
+      writeJson (directory / "environment-start.json") before
+      let mut samples := #[]
+      let mut reason : Option String := none
+      try
+        need (← stableEnvironment reference before) "environment drift before block"
+        let _ ← inspectBuild build
+        for index in [:order.size] do
+          let variant := order[index]!
+          let hash := digest (← IO.FS.readBinFile (build / s!"bin/{variant}"))
+          IO.println s!"counter-fold measurement: session {session + 1}/3, block {id + 1}/30, {variant}"
+          let rows ← runScheduled build (directory / s!"{variant}.jsonl") variant schedule core
+          for row in rows do
+            need ((← number row "peak_rss_kb") <= 2097152) "resource RSS bound exceeded"
+            samples := samples.push (enriched row variant id session index attempt buildHash freezeHash hash)
+        let after ← environment core
+        writeJson (directory / "environment-end.json") after
+        need (← stableEnvironment reference after) "environment drift after block"
+        let _ ← inspectBuild build
+      catch error => reason := some error.toString
+      let status := Json.mkObj [("block", toJson id), ("session", toJson session), ("attempt", toJson attempt),
+        ("status", toJson (if reason.isSome then "invalid" else "valid")), ("reason", toJson reason), ("samples", toJson samples.size)]
+      writeJson (directory / "status.json") status
+      if let some failure := reason then
+        IO.println s!"counter-fold measurement: retained invalid complete-block attempt {id}/{attempt}: {failure}"
+        need (["environment drift", "shorter than 100 ms", "does not dominate timer", "resource RSS bound"].any (fun fragment => failure.contains fragment))
+          s!"correctness or artifact failure; publication stopped: {failure}"
+      else
+        need (samples.size == 228) "counter-fold paired block is incomplete"
+        for sample in samples do combined.putStrLn sample.compress
+        combined.flush
+        completed := completed.push status
+        writeJson (output / "progress.json") (Json.mkObj [("valid_blocks", toJson completed), ("complete", toJson false)])
+        accepted := true
+    need accepted s!"block {id} exhausted three retained attempts"
+  let final ← environment core
+  writeJson (output / "environment-end.json") final
+  need (← stableEnvironment reference final) "environment drift at measurement completion"
+  writeJson (output / "measurement.json") (Json.mkObj [("format", toJson "compilatrix/counter-fold-measurement/1"),
+    ("build_blake3", toJson buildHash), ("freeze_blake3", toJson freezeHash), ("valid_blocks", toJson completed),
+    ("samples", toJson (6840 : Nat)), ("samples_blake3", toJson (digest (← IO.FS.readBinFile (output / "samples.jsonl")))),
+    ("status", toJson "complete")])
+  IO.println "counter-fold measurement: 6840 samples, all 38 rows, 30 paired blocks, three sessions complete"
+
+end Benchmarks.Compiler.CounterFold
diff --git a/Benchmarks/Compiler/Data.lean b/Benchmarks/Compiler/Data.lean
new file mode 100644
index 000000000..5f154393f
--- /dev/null
+++ b/Benchmarks/Compiler/Data.lean
@@ -0,0 +1,159 @@
+import Ix.Compiler.Tools.UniqueCheck
+
+namespace Benchmarks.Compiler
+
+open Lean Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def workload : String := "native-reverse/1"
+def datasetMagic : String := "CPBN001\n"
+def scheduleMagic : String := "CPBS001\n"
+def baseSeed : UInt64 := 0x6a09e667f3bcc909
+def chunkSize : Nat := 4096
+def primaryLimit : Nat := 2^30
+
+def word? (value : Nat) : Option UInt64 :=
+  if value < UInt64.size then some value.toUInt64 else none
+
+structure Input where
+  id : Nat
+  length : Nat
+  pattern : Nat
+  domain : Nat
+  seed : UInt64
+  values : Array UInt64
+  deriving Inhabited
+
+def Input.name (input : Input) : String :=
+  s!"n{input.length}-p{input.pattern}"
+
+def patternName (pattern : Nat) : String :=
+  (#[("zero" : String), "repeated", "ascending", "descending", "alternating", "random",
+    "2^63-1", "2^63", "2^64-1"])[pattern]!
+
+def domainName (domain : Nat) : String :=
+  (#[("primary" : String), "stress-2^63-1", "stress-2^63", "stress-2^64-1"])[domain]!
+
+def nextRandom (state : UInt64) : UInt64 :=
+  let state := state ^^^ (state >>> 12)
+  let state := state ^^^ (state <<< 25)
+  state ^^^ (state >>> 27)
+
+def input (length pattern : Nat) : Input := Id.run do
+  let seed := baseSeed ^^^ ((length.toUInt64 + 1) * 0x9e3779b97f4a7c15)
+  let mut state := seed
+  let mut values := #[]
+  for index in [:length] do
+    state := nextRandom state
+    let value : UInt64 := match pattern with
+      | 0 => 0
+      | 1 => 17
+      | 2 => index.toUInt64
+      | 3 => (length - index - 1).toUInt64
+      | 4 => if index % 2 == 0 then 0 else (primaryLimit - 1).toUInt64
+      | 5 => (state * 0x2545f4914f6cdd1d) &&& (primaryLimit - 1).toUInt64
+      | 6 => 0x7fffffffffffffff
+      | 7 => 0x8000000000000000
+      | _ => 0xffffffffffffffff
+    values := values.push value
+  return { id := length * 9 + pattern, length, pattern
+           domain := if pattern < 6 then 0 else pattern - 5
+           seed, values }
+
+def inputs : Array Input := Id.run do
+  let mut cases := #[]
+  for length in [:65] do
+    for pattern in [:9] do cases := cases.push (input length pattern)
+  return cases
+
+/-- Each list contributes a word-sized, order- and payload-sensitive digest.
+All arithmetic wraps modulo 2^64. Full correctness compares every value. -/
+def listDigest (values : Array UInt64) : UInt64 :=
+  values.foldl (fun hash value => (hash ^^^ value) * 0x100000001b3) 0xcbf29ce484222325
+
+def Input.expectedDigest (input : Input) : UInt64 := listDigest input.values.reverse
+
+def wordBytes (value : UInt64) : ByteArray := Id.run do
+  let mut bytes := ByteArray.empty
+  for index in [:8] do bytes := bytes.push (value >>> (8 * index).toUInt64).toUInt8
+  return bytes
+
+def Input.bytes (input : Input) : ByteArray := Id.run do
+  let mut bytes := wordBytes input.length.toUInt64 ++ wordBytes input.pattern.toUInt64 ++
+    wordBytes input.domain.toUInt64 ++ wordBytes input.seed
+  for index in [:64] do bytes := bytes ++ wordBytes (input.values[index]?.getD 0)
+  return bytes
+
+def datasetBytes : ByteArray :=
+  inputs.foldl (fun bytes input => bytes ++ input.bytes)
+    (datasetMagic.toUTF8 ++ wordBytes inputs.size.toUInt64)
+
+def Input.json (input : Input) : Json :=
+  Json.mkObj [
+    ("id", toJson input.id), ("name", toJson input.name), ("length", toJson input.length),
+    ("pattern", toJson (patternName input.pattern)), ("domain", toJson (domainName input.domain)),
+    ("seed", toJson input.seed.toNat), ("values", toJson (input.values.map UInt64.toNat)),
+    ("expected", toJson (input.values.reverse.map UInt64.toNat)),
+    ("expected_digest", toJson input.expectedDigest.toNat)]
+
+structure TimingCase where
+  length : Nat
+  domain : Nat
+  profile : Nat
+  deriving BEq, Repr, Inhabited
+
+def TimingCase.profileName (row : TimingCase) : String :=
+  if row.profile == 0 then "entry+handoff" else "lifecycle"
+
+def TimingCase.name (row : TimingCase) : String :=
+  s!"{domainName row.domain}-n{row.length}-{row.profileName}"
+
+def TimingCase.inputIds (row : TimingCase) : Array Nat :=
+  if row.domain == 0 then (List.range 6).toArray.map (row.length * 9 + ·)
+  else #[row.length * 9 + row.domain + 5]
+
+def timingCases : Array TimingCase := Id.run do
+  let mut rows := #[]
+  for profile in [:2] do
+    for length in [0, 1, 2, 4, 8, 16, 32, 48, 63, 64] do
+      rows := rows.push { length, domain := 0, profile }
+    for domain in [1, 2, 3] do
+      for length in [1, 16, 64] do rows := rows.push { length, domain, profile }
+  return rows
+
+def TimingCase.json (row : TimingCase) : Json :=
+  Json.mkObj [("name", toJson row.name), ("length", toJson row.length),
+    ("domain", toJson (domainName row.domain)), ("profile", toJson row.profileName),
+    ("input_ids", toJson row.inputIds), ("capacity", toJson (row.length + 2))]
+
+def datasetJson : Json :=
+  Json.mkObj [
+    ("format", toJson "compilatrix/benchmark-datasets/1"), ("workload", toJson workload),
+    ("generator", toJson "xorshift64star-patterns/1"), ("seed", toJson baseSeed.toNat),
+    ("binary", toJson "datasets.bin"), ("binary_bytes", toJson datasetBytes.size),
+    ("binary_blake3", toJson (digest datasetBytes)),
+    ("cases", toJson (inputs.map Input.json)), ("timing_cases", toJson (timingCases.map TimingCase.json))]
+
+def checkData : IO Unit := do
+  need (inputs.size == 585 && datasetBytes.size == 318256 && timingCases.size == 38)
+    "benchmark dataset inventory drifted"
+  need (word? UInt64.size == none && word? (UInt64.size + 1) == none &&
+      (word? (UInt64.size - 1)).map UInt64.toNat == some (UInt64.size - 1))
+    "benchmark Word admission wrapped a Nat"
+  let mut capacityCases := 0
+  for index in [:inputs.size] do
+    let input := inputs[index]!
+    need (input.id == index && input.length ≤ 64 && input.values.size == input.length && input.bytes.size == 544)
+      "benchmark input shape disagrees"
+    if input.domain == 0 then
+      need (input.values.all (fun word => word.toNat < primaryLimit)) "primary input needs boxing outside the common range"
+    capacityCases := capacityCases + (65 - input.length)
+  need (capacityCases == 19305) "benchmark capacity inventory drifted"
+
+def writeDatasets (output : System.FilePath) : IO Unit := do
+  checkData
+  need (!(← output.pathExists)) "benchmark datasets require a fresh output directory"
+  IO.FS.createDirAll output
+  IO.FS.writeBinFile (output / "datasets.bin") datasetBytes
+  IO.FS.writeFile (output / "datasets.json") (datasetJson.pretty 120 ++ "\n")
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Diagnostics.lean b/Benchmarks/Compiler/Diagnostics.lean
new file mode 100644
index 000000000..df2a429d6
--- /dev/null
+++ b/Benchmarks/Compiler/Diagnostics.lean
@@ -0,0 +1,139 @@
+import Benchmarks.Compiler.Analyze
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def collectionDiagnostic (build output : FilePath) (core : Nat) (schedule : Schedule)
+    (measurement : Bool) : IO Json := do
+  let path := output / "cakeml-gc.jsonl"
+  writeSchedule (path.withExtension "bin") schedule
+  let result ← streamed { cmd := "taskset", args := #["--cpu-list", toString core,
+    (build / "bin/worker-launcher").toString,
+    (build / "bin/cakeml-diagnostic").toString, "cakeml", "run", (build / "datasets/datasets.bin").toString,
+    (path.withExtension "bin").toString], env := runtimeEnv } path
+  IO.FS.writeFile (path.withExtension "stderr") result.stderr
+  need (result.exitCode == 0) "CakeML collection diagnostic failed"
+  let rows ← readLines path
+  let mut nativeRows := #[]
+  let mut collectionRows := #[]
+  let mut terminal : Option Json := none
+  for row in rows do
+    match ← kind row with
+    | "gc-sample" => collectionRows := collectionRows.push row
+    | "terminal-gc" =>
+      need terminal.isNone "duplicate terminal collection record"
+      terminal := some row
+    | _ => nativeRows := nativeRows.push row
+  let samples ← inspectRun "cakeml" schedule nativeRows measurement
+  need (collectionRows.size == schedule.order.size * schedule.samples) "incomplete collection diagnostic"
+  let mut collections := 0
+  let mut lastTotal := 0
+  let mut maximumLive := 0
+  let mut liveValues : Array Nat := #[]
+  let mut maxRss := 0
+  for i in [:collectionRows.size] do
+    let row := collectionRows[i]!
+    need ((← number row "row") == (← number samples[i]! "row") &&
+      (← number row "sample") == (← number samples[i]! "sample")) "collection diagnostic sample identity disagrees"
+    let count ← number row "collections"
+    let total ← number row "total_collections"
+    need (count > 0 && total >= lastTotal + count) "lifecycle diagnostic did not exercise natural collection cycles"
+    collections := collections + count
+    lastTotal := total
+    let live ← number row "last_post_gc_live_bytes"
+    need (live < 8388608) "post-collection retention exceeded the frozen diagnostic bound"
+    liveValues := liveValues.push live
+    maximumLive := max maximumLive live
+    maxRss := max maxRss (← number samples[i]! "rss_kb")
+  let terminalObservation ← present terminal "missing terminal collection observation"
+  need ((← number terminalObservation "total_collections") == lastTotal + 1 &&
+    (← number terminalObservation "post_gc_live_bytes") < 8388608) "terminal collection inventory or retention disagrees"
+  return Json.mkObj [("schedule", toJson schedule), ("natural_collections_in_sample_envelopes", toJson collections),
+    ("maximum_post_gc_live_bytes", toJson maximumLive), ("post_gc_live_bytes_across_samples", toJson liveValues),
+    ("maximum_current_rss_kb", toJson maxRss), ("terminal_collection", terminalObservation),
+    ("sample_envelopes", Json.arr collectionRows), ("raw_blake3", toJson (digest (← IO.FS.readBinFile path))),
+    ("interpretation", toJson "separate instrumented lifecycle executions; GC time uses the pinned runtime gettimeofday hook; terminal elapsed time uses CLOCK_MONOTONIC_RAW")]
+
+def gcSmokeSuite (build output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  fresh output
+  let _ ← inspectBuild build
+  let schedule : Schedule := {
+    mode := 0, samples := 1, warmNs := 10000000, order := #[28, 31, 34, 37],
+    operations := Array.replicate 38 (chunkSize * 6) }
+  let gc ← collectionDiagnostic build output core schedule false
+  writeJson (output / "gc-smoke.json") (Json.mkObj [("format", toJson "compilatrix/benchmark-gc-smoke/1"),
+    ("build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))) ,
+    ("gc", gc), ("status", toJson "passed")])
+  IO.println "benchmark GC smoke: all four lifecycle domains exercise natural collections, bounded retention, and one actual terminal collection"
+
+def diagnoseSuite (build pilot output : FilePath) (core : Nat) : IO Unit := do
+  fresh output
+  let freeze ← inspectFreeze build pilot
+  need (core == (← number freeze "core")) "diagnostic core differs from frozen run"
+  let first := (← arrField freeze "blocks")[0]!
+  let common ← checked (fromJson? (← field first "schedule") : Except String Schedule)
+  let schedule : Schedule := {
+    mode := 1, samples := 5, warmNs := 1000000000, order := #[28, 31, 34, 37], operations := common.operations }
+  let gc ← collectionDiagnostic build output core schedule true
+  let mut compilerCosts := #[]
+  for name in ["compilatrix-produce", "compilatrix-independent-gate", "lean-generate-c", "lean-kernel",
+      "cakeml-kernel", "kernel-compcert", "kernel-gcc", "kernel-clang",
+      "upstream-applyClosed-produce", "upstream-applyClosed-check", "upstream-letClosed-produce", "upstream-letClosed-check"] do
+    compilerCosts := compilerCosts.push (Json.mkObj [("name", toJson name),
+      ("resources", ← readJson (build / s!"diagnostics/build/{name}.resources.json")),
+      ("command", ← readJson (build / s!"diagnostics/build/{name}.command.json"))])
+  let mut sizes := #[]
+  for name in ["compilatrix-main", "compilatrix-release", "lean-kernel", "cakeml-kernel", "compcert-kernel", "gcc-kernel", "clang-kernel",
+      "compilatrix", "lean", "cakeml", "compcert", "gcc", "clang"] do
+    sizes := sizes.push (Json.mkObj [("name", toJson name),
+      ("gnu_size_A", toJson (← IO.FS.readFile (build / s!"diagnostics/build/size-{name}.stdout")))])
+  let mut upstream := #[]
+  for name in ["applyClosed", "letClosed"] do
+    let directory := build / s!"artifacts/upstream-{name}"
+    let snapshot ← readJson (directory / s!"upstream-{name}.json")
+    let native ← field snapshot "native"
+    let row := (← arrField (← readJson (directory / "report.json")) "cases")[0]!
+    let compilation ← field snapshot "compilation"
+    let mut encoded := #[]
+    for (label, container, key, payload) in [("ixir0_declarations", ← field compilation "ixir0", "declarations", "preimage"),
+        ("ixir1_artifacts", ← field compilation "ixir1", "artifacts", "preimage"),
+        ("hpt_certificates", ← field compilation "hpt", "artifacts", "bytes")] do
+      let artifacts ← arrField container key
+      let mut total := 0
+      for artifact in artifacts do total := total + (← byteField artifact payload).size
+      encoded := encoded.push (Json.mkObj [("name", toJson label), ("count", toJson artifacts.size), ("encoded_bytes", toJson total)])
+    let mut pieces := #[]
+    for key in ["input", "compilation", "observations", "native"] do
+      let json ← field snapshot key
+      pieces := pieces.push (Json.mkObj [("name", toJson key), ("canonical_json_bytes", toJson json.compress.toUTF8.size)])
+    upstream := upstream.push (Json.mkObj [("name", toJson name), ("root", ← field row "root"),
+      ("source_constants", ← field row "source_constants"), ("source_piece_bytes", toJson (if name == "applyClosed" then 662 else 670 : Nat)),
+      ("snapshot_bytes", toJson (← IO.FS.readBinFile (directory / s!"upstream-{name}.json")).size),
+      ("snapshot_parts", Json.arr pieces), ("encoded_artifacts", Json.arr encoded),
+      ("text_bytes", ← field native "text_bytes"), ("object_bytes", ← field native "object_bytes"),
+      ("baseline_counters", ← field row "observation"), ("native_heap", ← field native "native_heap"),
+      ("scope", toJson "serialized artifacts and executable certificates; Lean proof-term allocation is not inferred from JSON size")])
+  let hardware ← try
+      let which ← IO.Process.output { cmd := "which", args := #["perf"] }
+      if which.exitCode != 0 then pure (Json.mkObj [("status", toJson "unavailable"), ("reason", toJson "perf is not installed in the recorded runtime environment")])
+      else do
+        let perf ← IO.Process.output {
+          cmd := which.stdout.trimAscii.toString,
+          args := #["stat", "-x,", "-e", "cycles,instructions,branches,branch-misses,cache-misses,page-faults",
+            "--", "taskset", "--cpu-list", toString core, (build / "bin/upstream-applyClosed").toString, "1000000", "1"] }
+        IO.FS.writeFile (output / "perf.stdout") perf.stdout
+        IO.FS.writeFile (output / "perf.stderr") perf.stderr
+        pure (Json.mkObj [("status", toJson (if perf.exitCode == 0 then "available-diagnostic-only" else "unavailable")),
+          ("exit_code", toJson perf.exitCode.toNat), ("scope", toJson "whole upstream applyClosed diagnostic process including warmup and checks"),
+          ("raw_events_and_scaling", toJson perf.stderr)])
+    catch error => pure (Json.mkObj [("status", toJson "unavailable"), ("reason", toJson error.toString)])
+  let _ ← inspectBuild build
+  writeJson (output / "diagnostics.json") (Json.mkObj [("format", toJson "compilatrix/benchmark-diagnostics/1"),
+    ("build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))),
+    ("gc", gc),
+    ("hardware_counters", hardware), ("compiler_costs", Json.arr compilerCosts), ("code_sizes", Json.arr sizes),
+    ("upstream_artifact_growth", Json.arr upstream), ("status", toJson "passed")])
+  IO.println s!"benchmark diagnostics: {← number gc "natural_collections_in_sample_envelopes"} natural GC cycles, bounded post-collection storage, separate terminal GC, compiler costs and sizes retained"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Environment.lean b/Benchmarks/Compiler/Environment.lean
new file mode 100644
index 000000000..d34c6406b
--- /dev/null
+++ b/Benchmarks/Compiler/Environment.lean
@@ -0,0 +1,71 @@
+import Benchmarks.Compiler.Schedule
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def optionalFile (path : FilePath) : IO String := do
+  try return (← IO.FS.readFile path).trimAscii.toString
+  catch _ => return "unavailable"
+
+def firstCore : IO Nat := do
+  let status ← IO.FS.readFile "/proc/self/status"
+  let some line := (status.splitOn "\n").find? (·.startsWith "Cpus_allowed_list:") |
+    throw (IO.userError "Linux CPU affinity list unavailable")
+  let list := (line.drop "Cpus_allowed_list:".length).toString.trimAscii.toString
+  present (((list.splitOn ",").head!).splitOn "-").head!.toNat? "invalid Linux CPU affinity list"
+
+def environment (core : Nat) : IO Json := do
+  let cpu := s!"/sys/devices/system/cpu/cpu{core}"
+  let mut stable := #[]
+  for path in ["/proc/sys/kernel/random/boot_id", "/sys/devices/system/cpu/online",
+      "/sys/devices/system/cpu/smt/active", "/sys/devices/system/cpu/cpufreq/boost",
+      "/sys/devices/system/cpu/intel_pstate/no_turbo", "/sys/devices/system/clocksource/clocksource0/current_clocksource",
+      s!"{cpu}/topology/thread_siblings_list", s!"{cpu}/topology/core_id", s!"{cpu}/topology/physical_package_id",
+      s!"{cpu}/cpufreq/scaling_governor", s!"{cpu}/cpufreq/scaling_driver",
+      s!"{cpu}/cpufreq/cpuinfo_min_freq", s!"{cpu}/cpufreq/cpuinfo_max_freq", s!"{cpu}/microcode/version"] do
+    stable := stable.push (path, toJson (← optionalFile path))
+  let kernel ← run "uname" #["-srvmo"]
+  stable := stable.push ("kernel", toJson kernel.trimAscii.toString)
+  let cpuinfo ← IO.FS.readFile "/proc/cpuinfo"
+  let first := (cpuinfo.splitOn "\n\n").head!
+  let identity := (first.splitOn "\n").filter fun line =>
+    ["vendor_id", "cpu family", "model\t", "model name", "stepping", "microcode", "flags"].any (fun startText => line.startsWith startText)
+  stable := stable.push ("cpu_identity", toJson identity)
+  let topology ← run "lscpu" #["--json"]
+  let placement ← IO.Process.output { cmd := "taskset", args := #["--cpu-list", toString core, "sh", "-c", "cat /proc/self/status"] }
+  need (placement.exitCode == 0) "requested benchmark core is unavailable"
+  let affinity := (placement.stdout.splitOn "\n").filter fun line =>
+    ["Cpus_allowed_list:", "Mems_allowed_list:"].any (fun startText => line.startsWith startText)
+  stable := stable.push ("placed_affinity_and_numa_nodes", toJson affinity)
+  let controller ← IO.FS.readFile "/proc/self/status"
+  stable := stable.push ("controller_affinity_and_numa_nodes", toJson ((controller.splitOn "\n").filter fun line =>
+    ["Cpus_allowed_list:", "Mems_allowed_list:"].any (fun startText => line.startsWith startText)))
+  let stableFields := Json.mkObj stable.toList
+  let mut dynamic := #[]
+  for path in ["/proc/loadavg", "/proc/meminfo", "/proc/pressure/cpu", "/proc/pressure/memory",
+      s!"{cpu}/cpufreq/scaling_cur_freq", "/proc/sys/kernel/perf_event_paranoid", "/proc/sys/kernel/nmi_watchdog",
+      "/proc/1/cgroup", "/etc/os-release"] do
+    dynamic := dynamic.push (path, toJson (← optionalFile path))
+  let mut variables := #[]
+  for name in ["CML_HEAP_SIZE", "CML_STACK_SIZE", "MALLOC_ARENA_MAX", "MALLOC_PERTURB_", "LD_PRELOAD", "LD_LIBRARY_PATH",
+      "LEAN_NUM_THREADS", "OMP_NUM_THREADS", "NIX_CFLAGS_COMPILE", "NIX_LDFLAGS"] do
+    variables := variables.push (name, toJson (← IO.getEnv name))
+  return Json.mkObj [
+    ("format", toJson "compilatrix/benchmark-environment/1"), ("utc", toJson (← run "date" #["-u", "+%Y-%m-%dT%H:%M:%SZ"]).trimAscii.toString),
+    ("core", toJson core), ("stable", stableFields), ("stable_blake3", toJson (digest stableFields.compress.toUTF8)),
+    ("lscpu", ← checked (Json.parse topology)), ("observations", Json.mkObj dynamic.toList),
+    ("environment_variables", Json.mkObj variables.toList), ("runtime_overrides", toJson runtimeEnv),
+    ("limitations", toJson (["shared host; other tenants and SMT sibling are not controlled",
+      "worker affinity is pinned; NUMA follows Linux first-touch placement on the pinned worker",
+      "turbo, governor, system services, thermal state, and ambient load are observed, not administratively changed",
+      "this run is not a dedicated performance-regression baseline"] : List String))]
+
+def stableEnvironment (before after : Json) : IO Bool := do
+  pure ((← field before "stable") == (← field after "stable") &&
+    (← field before "environment_variables") == (← field after "environment_variables"))
+
+def environmentRegressions (original : Json) : IO Unit := do
+  let changed ← replaceAt original ["stable", "kernel"] (toJson "different kernel")
+  need (!(← stableEnvironment original changed)) "environment drift was not detected"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Measure.lean b/Benchmarks/Compiler/Measure.lean
new file mode 100644
index 000000000..d76c7a966
--- /dev/null
+++ b/Benchmarks/Compiler/Measure.lean
@@ -0,0 +1,149 @@
+import Benchmarks.Compiler.Pilot
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def inspectFreeze (build pilot : FilePath) : IO Json := do
+  let freeze ← readJson (pilot / "freeze.json")
+  let buildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  need ((← strField freeze "format") == "compilatrix/benchmark-freeze/1" &&
+    (← strField freeze "build_blake3") == buildHash) "frozen schedule belongs to a different build"
+  let manifest ← readJson (build / "manifest.json")
+  need ((← number freeze "minimum_sample_ns") == minimumNs && (← number freeze "pilot_target_ns") == pilotTargetNs &&
+    (← number freeze "order_seed") == orderSeed.toNat && (← number freeze "resource_bound_rss_kb") == 2097152 &&
+    (← number freeze "timer_chunk_minimum_factor") == 100 && (← number freeze "session_separation_seconds") == 60 &&
+    (← number freeze "bootstrap_replicates") == 10000 && (← number freeze "bootstrap_seed") == 2671931027 &&
+    (← field freeze "bootstrap") == (← field (← field manifest "analysis") "bootstrap")) "frozen timing/analysis policy changed"
+  let blocks ← arrField freeze "blocks"
+  need (blocks.size == blockCount) "frozen block inventory disagrees"
+  let mut common : Option (Array Nat) := none
+  let mut state := orderSeed
+  for index in [:blocks.size] do
+    let block := blocks[index]!
+    need ((← number block "block") == index && (← number block "session") == index / 10) "frozen block/session identity disagrees"
+    let schedule ← checked (fromJson? (← field block "schedule") : Except String Schedule)
+    need (schedule.valid && schedule.mode == 2) "frozen measurement schedule invalid"
+    let order ← (← arrField block "implementation_order").mapM string
+    need (order.toList.mergeSort (· ≤ ·) == implementations.toList.mergeSort (· ≤ ·)) "frozen comparison inventory disagrees"
+    let (expectedRows, next) := shuffled (List.range 38).toArray state
+    let (expectedImplementations, next) := shuffled (List.range 6).toArray next
+    state := next
+    need (schedule.order == expectedRows && order == expectedImplementations.map (implementations[·]!)) "frozen randomized order changed"
+    if let some counts := common then need (counts == schedule.operations) "frozen counts vary across blocks"
+    common := some schedule.operations
+  let upstream ← arrField freeze "upstream"
+  need (upstream.size == 2) "frozen upstream inventory changed"
+  for i in [:2] do
+    need ((← strField upstream[i]! "name") == (if i == 0 then "applyClosed" else "letClosed") &&
+      (← number upstream[i]! "value") == i + 3 && (← number upstream[i]! "operations") > 0 &&
+      (← number upstream[i]! "operations") <= 100000000000 && (← number upstream[i]! "operations") % (chunkSize * 6) == 0)
+      "frozen upstream counts or values changed"
+  return freeze
+
+def enriched (sample : Json) (block session order attempt : Nat) (buildHash freezeHash executableHash : String) : Json :=
+  let row := (sample.getObjValAs? Nat "row").toOption.map (timingCases[·]!)
+  Json.mkObj [("format", toJson "compilatrix/benchmark-sample/1"), ("block", toJson block), ("session", toJson session),
+    ("workload", toJson (if row.isSome then workload else "upstream-closed-nat")),
+    ("profile", toJson (row.map TimingCase.profileName |>.getD "native-call")),
+    ("case", row.map TimingCase.json |>.getD (Json.mkObj [("runtime_arguments", toJson (0 : Nat))])),
+    ("dataset_seeds", row.map (fun row => toJson (row.inputIds.map (fun id => inputs[id]!.seed.toNat))) |>.getD Json.null),
+    ("order", toJson order), ("attempt", toJson attempt), ("build_blake3", toJson buildHash),
+    ("freeze_blake3", toJson freezeHash), ("executable_blake3", toJson executableHash),
+    ("dataset_blake3", toJson (digest datasetBytes)), ("status", toJson "valid"), ("observation", sample)]
+
+def measureSuite (build correctness pilot output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  requireCorrectness build correctness
+  let freeze ← inspectFreeze build pilot
+  need ((← number freeze "core") == core) "measurement core differs from frozen pilot"
+  let reference ← field freeze "environment"
+  let initial ← environment core
+  need (← stableEnvironment reference initial) "measurement environment differs from pilot"
+  fresh output
+  IO.FS.writeFile (output / "freeze.json") (← IO.FS.readFile (pilot / "freeze.json"))
+  IO.FS.writeFile (output / "correctness.json") (← IO.FS.readFile (correctness / "correctness.json"))
+  writeJson (output / "environment-start.json") initial
+  let buildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  let freezeHash := digest (← IO.FS.readBinFile (output / "freeze.json"))
+  let allSamples ← IO.FS.Handle.mk (output / "samples.jsonl") .write
+  let upstreamSamples ← IO.FS.Handle.mk (output / "upstream.jsonl") .write
+  let mut completed := #[]
+  for block in (← arrField freeze "blocks") do
+    let id ← number block "block"
+    let session ← number block "session"
+    if id > 0 && id % 10 == 0 then
+      IO.println s!"benchmark measurement: session {session} starts after the frozen 60-second idle interval"
+      IO.sleep 60000
+    let schedule ← checked (fromJson? (← field block "schedule") : Except String Schedule)
+    let order ← (← arrField block "implementation_order").mapM string
+    let mut accepted := false
+    for attempt in [:3] do
+      if accepted then break
+      let directory := output / s!"session-{session}/block-{id}/attempt-{attempt}"
+      IO.FS.createDirAll directory
+      let before ← environment core
+      writeJson (directory / "environment-start.json") before
+      let mut samples := #[]
+      let mut upstreamRows := #[]
+      let mut reason : Option String := none
+      try
+        need (← stableEnvironment reference before) "environment drift before block"
+        let _ ← inspectBuild build
+        for orderIndex in [:order.size] do
+          let implementation := order[orderIndex]!
+          let hash := digest (← IO.FS.readBinFile (build / s!"bin/{implementation}"))
+          IO.println s!"benchmark measurement: session {session + 1}/3, block {id + 1}/30, {implementation}"
+          let rows ← runScheduled build (directory / s!"{implementation}.jsonl") implementation schedule core
+          for row in rows do
+            need ((← number row "peak_rss_kb") <= (← number freeze "resource_bound_rss_kb")) "resource RSS bound exceeded"
+            samples := samples.push (enriched row id session orderIndex attempt buildHash freezeHash hash)
+        let upstream := (← arrField freeze "upstream")
+        let upstream := if id % 2 == 0 then upstream else upstream.reverse
+        for upstreamOrder in [:upstream.size] do
+          let entry := upstream[upstreamOrder]!
+          let name ← strField entry "name"
+          let value ← number entry "value"
+          let operations ← number entry "operations"
+          let rows ← runUpstream build (directory / s!"upstream-{name}.jsonl") name value operations 3 core true
+          let hash := digest (← IO.FS.readBinFile (build / s!"bin/upstream-{name}"))
+          for row in rows do
+            need ((← number row "peak_rss_kb") <= (← number freeze "resource_bound_rss_kb")) "resource RSS bound exceeded"
+            upstreamRows := upstreamRows.push (Json.mkObj [("name", toJson name),
+              ("sample", enriched row id session upstreamOrder attempt buildHash freezeHash hash)])
+        let after ← environment core
+        writeJson (directory / "environment-end.json") after
+        need (← stableEnvironment reference after) "environment drift after block"
+        let _ ← inspectBuild build
+      catch error => reason := some error.toString
+      let status := Json.mkObj [("block", toJson id), ("session", toJson session), ("attempt", toJson attempt),
+        ("status", toJson (if reason.isSome then "invalid" else "valid")), ("reason", toJson reason),
+        ("samples", toJson samples.size), ("upstream_samples", toJson upstreamRows.size)]
+      writeJson (directory / "status.json") status
+      if let some failure := reason then
+        IO.println s!"benchmark measurement: retained invalid complete-block attempt {id}/{attempt}: {failure}"
+        -- Only environmental/timing validity failures admit a complete-block
+        -- rerun. A failed result, parser, process, or artifact stops the run.
+        need (["environment drift", "shorter than 100 ms", "does not dominate timer", "resource RSS bound"].any (fun fragment => failure.contains fragment))
+          s!"correctness or artifact failure; publication stopped: {failure}"
+      else
+        need (samples.size == 684 && upstreamRows.size == 6) "valid block is incomplete"
+        for sample in samples do allSamples.putStrLn sample.compress
+        for sample in upstreamRows do upstreamSamples.putStrLn sample.compress
+        allSamples.flush
+        upstreamSamples.flush
+        completed := completed.push status
+        writeJson (output / "progress.json") (Json.mkObj [("valid_blocks", Json.arr completed), ("complete", toJson false)])
+        accepted := true
+    need accepted s!"block {id} exhausted three recorded attempts; no complete report"
+  let final ← environment core
+  writeJson (output / "environment-end.json") final
+  need (← stableEnvironment reference final) "environment drift at measurement completion"
+  writeJson (output / "measurement.json") (Json.mkObj [("format", toJson "compilatrix/benchmark-measurement/1"),
+    ("build_blake3", toJson buildHash), ("freeze_blake3", toJson freezeHash), ("valid_blocks", Json.arr completed),
+    ("samples", toJson (20520 : Nat)), ("upstream_samples", toJson (180 : Nat)),
+    ("samples_blake3", toJson (digest (← IO.FS.readBinFile (output / "samples.jsonl")))),
+    ("upstream_blake3", toJson (digest (← IO.FS.readBinFile (output / "upstream.jsonl")))), ("status", toJson "complete")])
+  IO.println "benchmark measurement: all six implementations and two upstream entries completed 30 blocks across three sessions"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Pilot.lean b/Benchmarks/Compiler/Pilot.lean
new file mode 100644
index 000000000..32c0a7493
--- /dev/null
+++ b/Benchmarks/Compiler/Pilot.lean
@@ -0,0 +1,108 @@
+import Benchmarks.Compiler.Environment
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def minimumNs : Nat := 100000000
+def pilotTargetNs : Nat := 200000000
+def orderSeed : UInt64 := 1210345809
+def blockCount : Nat := 30
+def sessionCount : Nat := 3
+
+def roundOperations (count : Nat) : Nat :=
+  ((count + chunkSize * 6 - 1) / (chunkSize * 6)) * (chunkSize * 6)
+
+def requireCorrectness (build correctness : FilePath) : IO Unit := do
+  let result ← readJson (correctness / "correctness.json")
+  let buildHash := digest (← IO.FS.readBinFile (build / "build.json"))
+  need ((← strField result "status") == "passed" && (← strField result "build_blake3") ==
+    buildHash) "correctness record does not match the timed build"
+  need ((← field result "executables") == (← field (← inspectBuild build) "executables")) "correctness executable identities differ"
+
+def runUpstream (build output : FilePath) (name : String) (value operations samples core : Nat)
+    (measurement : Bool := false) : IO (Array Json) := do
+  let result ← streamed { cmd := "taskset", args := #["--cpu-list", toString core,
+    (build / "bin/worker-launcher").toString,
+    (build / s!"bin/upstream-{name}").toString, toString operations, toString samples] } output
+  IO.FS.writeFile (output.withExtension "stderr") result.stderr
+  need (result.exitCode == 0) s!"upstream {name} timing failed: {result.stderr}"
+  let rows ← readLines output
+  need (rows.size == samples + 1 && (← kind rows[0]!) == "warmup" &&
+    (← number rows[0]! "elapsed_ns") >= 1000000000) "upstream warm-up or sample inventory disagrees"
+  for i in [:samples] do
+    let row := rows[i + 1]!
+    need ((← kind row) == "sample" && (← number row "sample") == i &&
+      (← number row "operations") == operations && (← number row "sink") == value * operations &&
+      (← number row "elapsed_ns") > 0) "upstream timed sample identity or result disagrees"
+    if measurement then need ((← number row "elapsed_ns") >= minimumNs) "upstream measured sample shorter than 100 ms"
+  return rows.extract 1 rows.size
+
+def pilotSuite (build correctness output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  requireCorrectness build correctness
+  fresh output
+  let before ← environment core
+  writeJson (output / "environment-start.json") before
+  environmentRegressions before
+  let initial : Schedule := {
+    mode := 1, samples := 1, warmNs := 1000000000,
+    order := (List.range 38).toArray, operations := Array.replicate 38 (chunkSize * 6) }
+  let mut counts := initial.operations
+  let mut estimates : Array Json := #[]
+  for implementation in implementations do
+    let samples ← runScheduled build (output / s!"initial-{implementation}.jsonl") implementation initial core
+    for row in samples do
+      let id ← number row "row"
+      let operations ← number row "operations"
+      let elapsed ← number row "elapsed_ns"
+      let count := roundOperations ((operations * pilotTargetNs + elapsed - 1) / elapsed)
+      counts := counts.set! id (max counts[id]! count)
+      estimates := estimates.push (Json.mkObj [("implementation", toJson implementation), ("row", toJson id),
+        ("elapsed_ns", toJson elapsed), ("operations", toJson operations), ("envelope_ns", ← field row "envelope_ns")])
+    IO.println s!"benchmark pilot: initial {implementation} complete"
+  let schedule := { initial with operations := counts }
+  let mut confirmation := #[]
+  for implementation in implementations do
+    let samples ← runScheduled build (output / s!"confirmation-{implementation}.jsonl") implementation schedule core
+    for row in samples do
+      need ((← number row "elapsed_ns") >= minimumNs) s!"pilot count needs a new premeasurement calibration: {implementation}"
+      let id ← number row "row"
+      confirmation := confirmation.push (Json.mkObj [("implementation", toJson implementation), ("row", toJson id),
+        ("elapsed_ns", ← field row "elapsed_ns"), ("envelope_ns", ← field row "envelope_ns")])
+    IO.println s!"benchmark pilot: confirmed {implementation}"
+  let mut upstream := #[]
+  for (name, value) in [("applyClosed", 3), ("letClosed", 4)] do
+    let samples ← runUpstream build (output / s!"initial-upstream-{name}.jsonl") name value 1000000 1 core
+    let elapsed ← number samples[0]! "elapsed_ns"
+    let operations := roundOperations ((1000000 * pilotTargetNs + elapsed - 1) / elapsed)
+    let _ ← runUpstream build (output / s!"confirmation-upstream-{name}.jsonl") name value operations 1 core true
+    upstream := upstream.push (Json.mkObj [("name", toJson name), ("value", toJson value), ("operations", toJson operations)])
+  let after ← environment core
+  writeJson (output / "environment-end.json") after
+  need (← stableEnvironment before after) "pilot environment drifted; no schedule frozen"
+  let _ ← inspectBuild build
+  let mut state := orderSeed
+  let mut blocks := #[]
+  for block in [:blockCount] do
+    let (order, next) := shuffled (List.range 38).toArray state
+    let (implementationOrder, next) := shuffled (List.range implementations.size).toArray next
+    state := next
+    let schedule : Schedule := { mode := 2, samples := 3, warmNs := 1000000000, order, operations := counts }
+    blocks := blocks.push (Json.mkObj [("block", toJson block), ("session", toJson (block / 10)),
+      ("implementation_order", toJson (implementationOrder.map (implementations[·]!))), ("schedule", toJson schedule)])
+  writeJson (output / "freeze.json") (Json.mkObj [
+    ("format", toJson "compilatrix/benchmark-freeze/1"), ("build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))) ,
+    ("environment", before), ("core", toJson core), ("pilot_target_ns", toJson pilotTargetNs),
+    ("minimum_sample_ns", toJson minimumNs), ("resource_bound_rss_kb", toJson (2097152 : Nat)),
+    ("timer_chunk_minimum_factor", toJson (100 : Nat)), ("session_separation_seconds", toJson (60 : Nat)),
+    ("order_seed", toJson orderSeed.toNat), ("blocks", Json.arr blocks), ("upstream", Json.arr upstream),
+    ("initial_estimates", Json.arr estimates), ("confirmation", Json.arr confirmation),
+    ("invalidations", toJson (["changed boot, CPU identity/topology, kernel, affinity, governor/turbo, clocksource, or declared runtime environment",
+      "incorrect sink/schema, executable drift, process failure, RSS above 2 GiB, sample below 100 ms, chunk below 100 minimum clock-pair costs",
+      "slow samples, context switches, page faults, load, and frequency variation are retained and reported"] : List String)),
+    ("bootstrap", toJson "hierarchical paired bootstrap: resample three sessions, then ten whole paired blocks within each selected session"),
+    ("bootstrap_replicates", toJson (10000 : Nat)), ("bootstrap_seed", toJson (2671931027 : Nat))])
+  IO.println s!"benchmark pilot: fixed common counts, 30 randomized paired blocks, and two upstream entries frozen in {output}"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Reproduce.lean b/Benchmarks/Compiler/Reproduce.lean
new file mode 100644
index 000000000..4009ad29a
--- /dev/null
+++ b/Benchmarks/Compiler/Reproduce.lean
@@ -0,0 +1,98 @@
+import Benchmarks.Compiler.Diagnostics
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def replayCommand (directory : FilePath) (environment : Array (String × Option String))
+    (command : String) (arguments : Array String) (log : FilePath) : IO Unit := do
+  let assignments := environment.filterMap fun (name, value) => value.map (fun value => s!"{name}={value}")
+  let result ← streamed { cmd := "env", args := #["-i"] ++ assignments ++ #[command] ++ arguments, cwd := some directory } log
+  IO.FS.writeFile (log.withExtension "stderr") result.stderr
+  writeJson (log.withExtension "command.json") (Json.mkObj [("environment_policy", toJson "env -i plus the exact recorded build variables"),
+    ("environment", toJson environment), ("cwd", toJson directory.toString), ("command", toJson command),
+    ("arguments", toJson arguments), ("exit_code", toJson result.exitCode.toNat)])
+  need (result.exitCode == 0) s!"independent environment command failed; see {log}: {result.stderr}"
+
+def rebuildArtifacts (build output : FilePath) : IO FilePath := do
+  let build ← absolute build
+  let output ← absolute output
+  fresh output
+  let metadata ← inspectBuild build
+  let environment ← checked (fromJson? (← field metadata "build_environment") : Except String (Array (String × Option String)))
+  need (environment.map Prod.fst == buildEnvNames) "recorded build environment inventory disagrees"
+  let toolIdentities ← array (← readJson (build / "tool-identities.json"))
+  for row in toolIdentities do
+    let original ← strField row "resolved"
+    let path ← if (← strField row "name") == "cakeml" then
+        pure (build / (← strField row "retained_path"))
+      else pure (FilePath.mk original)
+    need (digest (← IO.FS.readBinFile path) == (← strField row "blake3")) "installed tool differs from retained compiler seed"
+  let snapshot ← readJson (build / "source.json")
+  need (digest (← IO.FS.readBinFile (build / "source.tar.gz")) == (← strField snapshot "archive_blake3")) "source archive digest disagrees"
+  let source := output / "source"
+  IO.FS.createDirAll source
+  let inventory ← arrField snapshot "files"
+  let names ← inventory.mapM (fun row => strField row "path")
+  need (names.toList.Nodup && names.all (fun name => !name.startsWith "/" &&
+    !(name.splitOn "/").any (fun part => part == ".." || part.isEmpty))) "unsafe source archive inventory"
+  let listing := (← run "tar" #["-tzf", (build / "source.tar.gz").toString]).trimAscii.toString.splitOn "\n"
+  need (listing.mergeSort (· ≤ ·) == names.toList.mergeSort (· ≤ ·)) "source tar inventory disagrees"
+  let _ ← run "tar" #["--no-same-owner", "--no-same-permissions", "-xzf", (build / "source.tar.gz").toString, "-C", source.toString]
+  for row in inventory do
+    let bytes ← IO.FS.readBinFile (source / (← strField row "path"))
+    need (bytes.size == (← number row "bytes") && digest bytes == (← strField row "blake3")) "extracted source differs from retained snapshot"
+  IO.FS.createDirAll (source / ".lake/build/bin")
+  for path in (← files (build / "tools-bin")) do
+    let _ ← run "cp" #[path.toString, (source / ".lake/build/bin" / path.fileName.getD "missing").toString]
+  let runner := (source / ".lake/build/bin/compiler-benchmark").toString
+  let recordedTools ← checked (fromJson? (← field metadata "tool_commands") : Except String Toolchains)
+  let tools := { recordedTools with cakeml := (source / ".lake/build/bin/cakeml-bootstrap").toString }
+  let rebuilt := output / "build"
+  replayCommand source environment runner #["build", rebuilt.toString, "--gcc", tools.gcc, "--clang", tools.clang,
+    "--compcert", tools.compcert, "--cakeml", tools.cakeml, "--time", tools.timerTool] (output / "rebuild.jsonl")
+  let rebuiltMetadata ← inspectBuild rebuilt
+  for key in ["artifacts", "executables", "tools", "datasets_blake3", "manifest_blake3", "toolchains_blake3"] do
+    need ((← field rebuiltMetadata key) == (← field metadata key)) s!"independent rebuild changed {key}"
+  writeJson (output / "rebuild-check.json") (Json.mkObj [("source_files", toJson inventory.size),
+    ("source_archive_blake3", ← field snapshot "archive_blake3"), ("artifacts_exact", toJson true),
+    ("executables_exact", toJson true), ("status", toJson "passed")])
+  IO.println "benchmark rebuild check: fresh source/environment produced exact objects and executables"
+  return source
+
+def reproduceSuite (build measured output : FilePath) : IO Unit := do
+  let build ← absolute build
+  let measured ← absolute measured
+  let output ← absolute output
+  let (_, _) ← inspectMeasurement build measured
+  let source ← rebuildArtifacts build output
+  let metadata ← inspectBuild build
+  let snapshot ← readJson (build / "source.json")
+  let inventory ← arrField snapshot "files"
+  let environment ← checked (fromJson? (← field metadata "build_environment") : Except String (Array (String × Option String)))
+  let runner := (source / ".lake/build/bin/compiler-benchmark").toString
+  let rebuilt := output / "build"
+  replayCommand source environment runner #["verify", rebuilt.toString, (output / "correctness").toString] (output / "verify.jsonl")
+  let originalCorrectness ← readJson (measured / "correctness.json")
+  let replayCorrectness ← readJson (output / "correctness/correctness.json")
+  let originalMatrices ← arrField originalCorrectness "matrices"
+  let replayMatrices ← arrField replayCorrectness "matrices"
+  need (originalMatrices.size == replayMatrices.size) "independent correctness inventory changed"
+  for i in [:originalMatrices.size] do
+    need ((← field originalMatrices[i]! "result") == (← field replayMatrices[i]! "result")) "independent complete matrix differs"
+  -- Retained samples remain inputs. Reproduction never asks clock readings
+  -- or diagnostic compiler resource envelopes to be byte-identical.
+  replayCommand source environment runner #["analyze", build.toString, measured.toString, (output / "analysis").toString]
+    (output / "analysis.jsonl")
+  for file in ["summary.json", "report.md"] do
+    need ((← IO.FS.readBinFile (output / "analysis" / file)) == (← IO.FS.readBinFile (measured / "analysis" / file)))
+      s!"independent analysis changed {file}"
+  writeJson (output / "reproduction.json") (Json.mkObj [("format", toJson "compilatrix/benchmark-reproduction/1"),
+    ("source_archive_blake3", ← field snapshot "archive_blake3"), ("original_build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))),
+    ("rebuilt_build_blake3", toJson (digest (← IO.FS.readBinFile (rebuilt / "build.json")))),
+    ("source_files", toJson inventory.size), ("artifacts_exact", toJson true), ("executables_exact", toJson true),
+    ("correctness_exact", toJson true), ("analysis_exact", toJson true),
+    ("scope", toJson "fresh extracted source directory and empty process environment; retained hashed compiler/checker seeds; same physical host and pinned Nix runtime closure"),
+    ("timing_samples_rerun", toJson false), ("status", toJson "passed")])
+  IO.println "benchmark reproduction: clean source/environment rebuild, exact objects/executables, complete correctness, and byte-exact analysis passed"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Schedule.lean b/Benchmarks/Compiler/Schedule.lean
new file mode 100644
index 000000000..f337017b2
--- /dev/null
+++ b/Benchmarks/Compiler/Schedule.lean
@@ -0,0 +1,146 @@
+import Benchmarks.Compiler.Verify
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+structure Schedule where
+  mode : Nat
+  samples : Nat
+  warmNs : Nat
+  order : Array Nat
+  operations : Array Nat
+  deriving ToJson, FromJson, BEq
+
+def Schedule.valid (schedule : Schedule) : Bool :=
+  schedule.mode ≤ 2 && 0 < schedule.samples && schedule.samples ≤ 10 && schedule.warmNs ≤ 10000000000 &&
+  0 < schedule.order.size && schedule.order.size ≤ 38 && schedule.order.toList.Nodup &&
+  schedule.order.all (· < 38) && schedule.operations.size == 38 &&
+  schedule.operations.all (fun count => 0 < count && count ≤ 1000000000000 && count % (chunkSize * 6) == 0) &&
+  (schedule.mode != 2 || (schedule.order.size == 38 && schedule.samples == 3 && schedule.warmNs ≥ 1000000000))
+
+def Schedule.bytes (schedule : Schedule) : ByteArray := Id.run do
+  let mut bytes := scheduleMagic.toUTF8
+  for value in [schedule.order.size, schedule.samples, schedule.warmNs, chunkSize, schedule.mode] do
+    bytes := bytes ++ wordBytes value.toUInt64
+  for id in schedule.order do
+    let row := timingCases[id]!
+    for value in [id, row.length, row.domain, row.profile, schedule.operations[id]!] do
+      bytes := bytes ++ wordBytes value.toUInt64
+  return bytes
+
+def writeSchedule (path : FilePath) (schedule : Schedule) : IO Unit := do
+  need schedule.valid "invalid benchmark schedule"
+  IO.FS.writeBinFile path schedule.bytes
+
+def shuffled (values : Array Nat) (seed : UInt64) : Array Nat × UInt64 := Id.run do
+  let mut values := values
+  let mut state := seed
+  for index in [:values.size] do
+    state := nextRandom state
+    let target := index + (state.toNat % (values.size - index))
+    values := values.swapIfInBounds index target
+  return (values, state)
+
+def inspectRun (implementation : String) (schedule : Schedule) (rows : Array Json)
+    (measurement : Bool := false) : IO (Array Json) := do
+  need schedule.valid "invalid benchmark schedule"
+  need (rows.size == 4 + schedule.order.size * schedule.samples) "benchmark run inventory disagrees"
+  inspectMetadata implementation rows[0]!
+  inspectControl rows[1]!
+  let warm := rows[2]!
+  need ((← kind warm) == "warmup" && (← number warm "elapsed_ns") >= schedule.warmNs &&
+    (← number warm "operations") > 0 && (← number warm "operations") % chunkSize == 0) "benchmark warm-up incomplete"
+  need ((← number warm "sink") == (sampleSink timingCases[28]! (← number warm "operations")).toNat) "benchmark warm-up sink disagrees"
+  let timerPair ← number rows[0]! "timer_pair_min_ns"
+  let mut index := 3
+  let mut samples := #[]
+  for id in schedule.order do
+    for sample in [:schedule.samples] do
+      let row := rows[index]!
+      inspectSample implementation schedule.mode id sample schedule.operations[id]! row
+      if measurement then
+        need ((← number row "elapsed_ns") >= 100000000) "measured sample shorter than 100 ms"
+        need ((← number row "minimum_chunk_ns") >= 100 * timerPair) "timed chunk does not dominate timer overhead"
+      samples := samples.push row
+      index := index + 1
+  need ((← kind rows[index]!) == "completed" && (← number rows[index]! "rows") == schedule.order.size &&
+    (← number rows[index]! "samples_per_row") == schedule.samples) "benchmark run did not complete"
+  return samples
+
+def runScheduled (build output : FilePath) (implementation : String) (schedule : Schedule)
+    (core : Nat) : IO (Array Json) := do
+  let schedulePath := output.withExtension "bin"
+  writeSchedule schedulePath schedule
+  -- All compilation has finished before this function is used for measurement.
+  let result ← streamed {
+    cmd := "taskset"
+    args := #["--cpu-list", toString core, (build / "bin/worker-launcher").toString,
+      (build / s!"bin/{implementation}").toString, implementation,
+      "run", (build / "datasets/datasets.bin").toString, schedulePath.toString]
+    env := runtimeEnv } output
+  IO.FS.writeFile (output.withExtension "stderr") result.stderr
+  writeJson (output.withExtension "process.json") (Json.mkObj [("exit_code", toJson result.exitCode.toNat),
+    ("implementation", toJson implementation), ("core", toJson core), ("schedule", toJson schedule),
+    ("schedule_blake3", toJson (digest schedule.bytes)), ("stdout_blake3", toJson (digest result.stdout.toUTF8))])
+  need (result.exitCode == 0) s!"benchmark {implementation} failed: {result.stderr}"
+  inspectRun implementation schedule (← readLines output) (schedule.mode == 2)
+
+def smokeSuite (build output : FilePath) (core : Nat) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  fresh output
+  let metadata ← inspectBuild build
+  let schedule : Schedule := {
+    mode := 0, samples := 1, warmNs := 10000000,
+    order := (List.range 38).toArray, operations := Array.replicate 38 (chunkSize * 6) }
+  let mut samples := #[]
+  for implementation in implementations do
+    let rows ← runScheduled build (output / s!"{implementation}.jsonl") implementation schedule core
+    samples := samples ++ rows
+    IO.println s!"benchmark smoke: {implementation}, {rows.size} timing rows and periodic full checks"
+  need (samples.size == 228) "smoke run incomplete"
+  let sample := samples[0]!
+  for (name, path, replacement, fragment) in [
+      ("mode", ["mode"], toJson (2 : Nat), "sample identity"),
+      ("profile id", ["row"], toJson (19 : Nat), "sample identity"),
+      ("implementation", ["implementation"], toJson "clang", "sample identity"),
+      ("operation count", ["operations"], toJson (1 : Nat), "sample identity"),
+      ("sink", ["sink"], toJson (0 : Nat), "timed sink"),
+      ("timer calls", ["timer_calls"], toJson (1 : Nat), "timer/chunk"),
+      ("zero time", ["elapsed_ns"], toJson (0 : Nat), "timer/chunk")] do
+    rejects name fragment (inspectSample "compilatrix" 0 0 0 (chunkSize * 6) (← replaceAt sample path replacement))
+  let first ← readLines (output / "compilatrix.jsonl")
+  rejects "missing samples" "run inventory" (inspectRun "compilatrix" schedule (first.extract 0 (first.size - 1)) *> pure ())
+  rejects "mixed samples" "sample identity" (inspectRun "gcc" schedule (first.set! 0 (← readLines (output / "gcc.jsonl"))[0]!) *> pure ())
+  let canonical := schedule.bytes
+  let badSchedules : Array (String × ByteArray × String) := #[
+    ("magic", canonical.set! 0 0, "wrong binary magic"),
+    ("empty", canonical.set! 8 0, "invalid schedule header"),
+    ("samples", canonical.set! 16 0, "invalid schedule header"),
+    ("chunk", canonical.set! 32 1, "invalid schedule header"),
+    ("mode", canonical.set! 40 3, "invalid schedule header"),
+    ("measurement-minimums", canonical.set! 40 2, "incomplete measurement schedule"),
+    ("row-id", canonical.set! 48 38, "schedule row id out of range"),
+    ("row-length", canonical.set! 56 1, "invalid schedule row"),
+    ("operations", canonical.set! 80 1, "invalid schedule row"),
+    ("duplicate", canonical.extract 0 88 ++ canonical.extract 48 88 ++ canonical.extract 128 canonical.size, "invalid schedule row"),
+    ("truncated", canonical.extract 0 (canonical.size - 1), "truncated binary input"),
+    ("trailing", canonical.push 0, "trailing binary input")]
+  let mut negativeRows := #[]
+  for (name, bytes, reason) in badSchedules do
+    let path := output / s!"bad-schedule-{name}.bin"
+    IO.FS.writeBinFile path bytes
+    for implementation in implementations do
+      let result ← IO.Process.output {
+        cmd := (build / s!"bin/{implementation}").toString,
+        args := #[implementation, "run", (build / "datasets/datasets.bin").toString, path.toString], env := runtimeEnv }
+      need (result.exitCode != 0 && result.stderr.contains reason) s!"{implementation} accepted malformed schedule {name}"
+      negativeRows := negativeRows.push (Json.mkObj [("implementation", toJson implementation), ("case", toJson name),
+        ("exit_code", toJson result.exitCode.toNat), ("stderr", toJson result.stderr)])
+  writeJson (output / "malformed-schedules.json") (Json.arr negativeRows)
+  writeJson (output / "smoke.json") (Json.mkObj [("format", toJson "compilatrix/benchmark-smoke/1"),
+    ("executables", ← field metadata "executables"), ("schedule", toJson schedule),
+    ("samples", Json.arr samples), ("status", toJson "passed")])
+  IO.println "benchmark smoke: six executables, 228 timing rows, periodic full results, and sample-schema corruptions passed"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/Verify.lean b/Benchmarks/Compiler/Verify.lean
new file mode 100644
index 000000000..948d5a7c9
--- /dev/null
+++ b/Benchmarks/Compiler/Verify.lean
@@ -0,0 +1,114 @@
+import Benchmarks.Compiler.Build
+
+namespace Benchmarks.Compiler
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def inspectBuild (build : FilePath) : IO Json := do
+  checkData
+  let metadata ← readJson (build / "build.json")
+  need ((← strField metadata "format") == "compilatrix/benchmark-build/1") "unknown benchmark build format"
+  for (name, key) in [("manifest.json", "manifest_blake3"), ("toolchains.json", "toolchains_blake3")] do
+    need (digest (← IO.FS.readBinFile (build / name)) == (← strField metadata key)) s!"{name} changed after build"
+  need ((← IO.FS.readBinFile (build / "datasets/datasets.bin")) == datasetBytes &&
+    (← readJson (build / "datasets/datasets.json")) == datasetJson &&
+    (← strField metadata "datasets_blake3") == digest datasetBytes) "benchmark datasets changed or disagree with oracle"
+  inspectFiles (build / "artifacts") (← field metadata "artifacts")
+  inspectFiles (build / "bin") (← field metadata "executables")
+  inspectFiles (build / "tools-bin") (← field metadata "tools")
+  need (digest (← IO.FS.readBinFile (build / "tool-identities.json")) == (← strField metadata "tool_identities_blake3"))
+    "tool identity inventory changed"
+  return metadata
+
+def originalHarness (build output : FilePath) (tools : Toolchains) : IO Json := do
+  let n2 := build / "artifacts/compilatrix"
+  let report ← readJson (n2 / "report.json")
+  let rows ← arrField report "cases"
+  let initializers ← rows.mapM fun row => do
+    let name ← strField row "name"
+    let values ← (← arrField row "input").mapM fun value => do return s!"UINT64_C({← nat value})"
+    return "{\"" ++ name ++ "\"," ++ toString values.size ++ ",{ " ++
+      (if values.isEmpty then "0" else String.intercalate "," values.toList) ++ " }}"
+  IO.FS.writeFile (output / "runtime_cases.h")
+    ("static const Input inputs[] = {\n" ++ String.intercalate ",\n" initializers.toList ++ "\n};\n")
+  let mut summaries := #[]
+  for implementation in ["compilatrix", "compcert", "gcc", "clang"] do
+    let objects := if implementation == "compilatrix" then #[(n2 / "main.o").toString, (n2 / "release.o").toString]
+      else #[(build / s!"artifacts/{implementation}/kernel.o").toString]
+    let binary := output / s!"original-{implementation}"
+    let _ ← logged (output / "logs") s!"original-link-{implementation}" tools.gcc
+      (#["-std=c11", "-O2", "-fomit-frame-pointer", "-Wall", "-Wextra", "-Werror", "-no-pie",
+        "-I", output.toString, "Tests/Fixtures/Compiler/source-native-runtime/native_harness.c"] ++ objects ++
+        #["-Wl,-z,noexecstack", "-o", binary.toString]) #[] none tools.timerTool
+    let result ← logged (output / "logs") s!"original-run-{implementation}" binary.toString #[] #[] none tools.timerTool
+    let observed ← array (← checked (Json.parse result))
+    need (observed.size == rows.size) "original native matrix incomplete"
+    let mut rejections := 0
+    for index in [:rows.size] do
+      let expected ← field (← readJson (n2 / (← strField rows[index]! "snapshot"))) "native"
+      need ((← field observed[index]! "name") == (← field rows[index]! "name")) "original native case name drifted"
+      for key in ["input", "root", "value", "returned", "reclaimed", "rejections"] do
+        need ((← field observed[index]! key) == (← field expected key)) s!"{implementation}: original byte/native {key} disagreement"
+      rejections := rejections + (← arrField observed[index]! "rejections").size
+    need (rejections == 203) "original malformed input inventory drifted"
+    summaries := summaries.push (Json.mkObj [("implementation", toJson implementation),
+      ("successful_inputs", toJson rows.size), ("malformed_inputs", toJson rejections),
+      ("observations_blake3", toJson (digest (Json.arr observed).compress.toUTF8))])
+  return Json.arr summaries
+
+def malformedDatasets (build output : FilePath) : IO Json := do
+  let cases : Array (String × ByteArray × String) := #[
+    ("magic", datasetBytes.set! 0 0, "wrong binary magic"),
+    ("count", datasetBytes.set! 8 0, "wrong dataset inventory"),
+    ("metadata", datasetBytes.set! 16 1, "noncanonical dataset metadata"),
+    ("padding", datasetBytes.set! 48 1, "nonzero dataset padding"),
+    ("trailing", datasetBytes.push 0, "trailing binary input"),
+    ("truncated", datasetBytes.extract 0 (datasetBytes.size - 1), "truncated binary input")]
+  let mut results := #[]
+  for (name, bytes, expected) in cases do
+    let path := output / s!"bad-{name}.bin"
+    IO.FS.writeBinFile path bytes
+    for implementation in implementations do
+      let result ← IO.Process.output {
+        cmd := (build / s!"bin/{implementation}").toString
+        args := #[implementation, "verify", path.toString]
+        env := runtimeEnv }
+      need (result.exitCode != 0 && result.stderr.contains expected) s!"{implementation} accepted malformed dataset {name}"
+      results := results.push (Json.mkObj [("implementation", toJson implementation), ("case", toJson name),
+        ("exit_code", toJson result.exitCode.toNat), ("stderr", toJson result.stderr)])
+  return Json.arr results
+
+def verifySuite (build output : FilePath) : IO Unit := do
+  let build ← absolute build
+  let output ← absolute output
+  fresh output
+  let metadata ← inspectBuild build
+  let tools ← checked (fromJson? (← field metadata "tool_commands") : Except String Toolchains)
+  let mut summaries := #[]
+  let mut arenaIdentity : Option Json := none
+  for implementation in implementations do
+    let result ← logged (output / "logs") s!"matrix-{implementation}" (build / s!"bin/{implementation}").toString
+      #[implementation, "verify", (build / "datasets/datasets.bin").toString] runtimeEnv none tools.timerTool
+    IO.FS.writeFile (output / s!"{implementation}.jsonl") result
+    let rows ← readLines (output / s!"{implementation}.jsonl")
+    let before ← IO.monoNanosNow
+    let summary ← inspectMatrix implementation rows
+    checkerRegressions implementation rows
+    let checkNs := (← IO.monoNanosNow) - before
+    if isArena implementation then
+      let identity ← field summary "matrix_blake3"
+      if let some expected := arenaIdentity then need (identity == expected) "matched arena complete observations differ"
+      arenaIdentity := some identity
+    summaries := summaries.push (Json.mkObj [("result", summary), ("independent_check_ns", toJson checkNs)])
+    IO.println s!"benchmark verify: {implementation} complete matrix checked"
+  let original ← originalHarness build output tools
+  let binaryNegatives ← malformedDatasets build output
+  -- Check the artifacts again after every executable and diagnostic has run.
+  let _ ← inspectBuild build
+  writeJson (output / "correctness.json") (Json.mkObj [
+    ("format", toJson "compilatrix/benchmark-correctness/1"), ("build_blake3", toJson (digest (← IO.FS.readBinFile (build / "build.json")))),
+    ("executables", ← field metadata "executables"), ("matrices", Json.arr summaries),
+    ("original_native_matrix", original), ("malformed_datasets", binaryNegatives),
+    ("word_overflow_rejected", toJson true), ("full_values", toJson true), ("status", toJson "passed")])
+  IO.println "benchmark verify: six implementations, original ABI/rejection matrix, malformed inputs, and checker corruptions passed"
+
+end Benchmarks.Compiler
diff --git a/Benchmarks/Compiler/cakeml/reverse.cml b/Benchmarks/Compiler/cakeml/reverse.cml
new file mode 100644
index 000000000..7ab51cc97
--- /dev/null
+++ b/Benchmarks/Compiler/cakeml/reverse.cml
@@ -0,0 +1,132 @@
+(* Ordinary int lists; each input spine is constructed independently.
+   Recursive reversal remains a callable boundary in the optimized IR. *)
+fun reverseOnto xs acc =
+  case xs of [] => acc | x::rest => reverseOnto rest (x::acc);
+fun reverse xs = reverseOnto xs [];
+
+val packet = Word8Array.array 1024 (Word8.fromInt 0);
+fun ffi command = #(bench) command packet;
+fun getWord offset =
+  let fun loop i acc = if i < 0 then acc else
+        loop (i - 1) (acc * 256 + Word8.toInt (Word8Array.sub packet (offset + i)))
+  in loop 7 0 end;
+fun putWord offset value =
+  let fun loop i rest = if i = 8 then () else
+        (Word8Array.update packet (offset + i) (Word8.fromInt (rest mod 256)); loop (i + 1) (rest div 256))
+  in loop 0 value end;
+fun times n f = let fun loop i = if i = n then () else (f i; loop (i + 1)) in loop 0 end;
+
+val () = ffi "init";
+val verifyMode = getWord 0 = 1;
+val rowCount = getWord 8;
+val samples = getWord 16;
+val diagnostic = getWord 32 = 1;
+val scalars = Array.tabulate 585 (fn id =>
+  (putWord 0 id; ffi "input"; Array.tabulate (getWord 0) (fn i => getWord (8 + 8 * i))));
+fun make id =
+  let val values = Array.sub scalars id
+      fun loop i acc = if i < 0 then acc else loop (i - 1) (Array.sub values i :: acc)
+  in loop (Array.length values - 1) [] end;
+
+(* The pinned Word64 basis has shifts and addition but no multiplication.
+   This exactly multiplies by 2^40 + 2^8 + 2^7 + 2^5 + 2^4 + 2 + 1. *)
+fun fnvMultiply x = Word64.+ (Word64.<< x 40)
+  (Word64.+ (Word64.<< x 8) (Word64.+ (Word64.<< x 7)
+  (Word64.+ (Word64.<< x 5) (Word64.+ (Word64.<< x 4) (Word64.+ (Word64.<< x 1) x)))));
+val basis = Word64.fromInt 14695981039346656037;
+val zeroWord = Word64.fromInt 0;
+fun digest xs =
+  let fun loop ys acc = case ys of [] => acc | x::rest => loop rest (fnvMultiply (Word64.xorb acc (Word64.fromInt x)))
+  in loop xs basis end;
+
+val inputSlots = Array.array 4096 (make 0);
+val outputSlots = Array.array 4096 (make 0);
+fun inputId n domain opIndex = n * 9 + (if domain = 0 then opIndex mod 6 else domain + 5);
+fun prepare n domain offset = times 4096 (fn i => Array.update inputSlots i (make (inputId n domain (offset + i))));
+fun enter () = times 4096 (fn i =>
+  let val owned = Array.sub inputSlots i
+      val () = Array.update inputSlots i []
+  in Array.update outputSlots i (reverse owned) end);
+fun consume () =
+  let fun loop i acc = if i = 4096 then acc else
+        let val owned = Array.sub outputSlots i
+            val () = Array.update outputSlots i []
+        in loop (i + 1) (Word64.+ acc (digest owned)) end
+  in loop 0 zeroWord end;
+fun lifecycle n domain offset =
+  let fun loop i acc = if i = 4096 then acc else
+        loop (i + 1) (Word64.+ acc (digest (reverse (make (inputId n domain (offset + i))))))
+  in loop 0 zeroWord end;
+fun chunk n domain profile offset timed =
+  if profile = 0 then
+    (prepare n domain offset;
+     if timed then ffi "clock-start" else ();
+     enter ();
+     if timed then ffi "clock-stop" else ();
+     consume ())
+  else
+    let val () = if timed then ffi "clock-start" else ()
+        val result = lifecycle n domain offset
+        val () = if timed then ffi "clock-stop" else ()
+    in result end;
+
+fun check id emit =
+  let val result = reverse (make id)
+      val n = Array.length (Array.sub scalars id)
+      fun values xs index = case xs of
+        [] => if index = n then () else Runtime.abort ()
+      | x::rest => if index >= n then Runtime.abort () else
+          (putWord (32 + 8 * index) x; values rest (index + 1))
+      val () = values result 0
+      val hash = digest result
+      val () = putWord 0 id
+      val () = putWord 8 n
+      val () = putWord 16 (Word64.toInt hash)
+      val () = putWord 24 emit
+  in ffi "verify" end;
+
+fun control () =
+  (ffi "control-start";
+   times 1024 (fn _ => enter ());
+   putWord 0 (List.length (Array.sub outputSlots 0));
+   ffi "control-end");
+fun warm () =
+  let val () = ffi "warm-start"
+      fun loop operations acc =
+        let val next = Word64.+ acc (chunk 64 0 1 operations False)
+            val count = operations + 4096
+            val () = ffi "warm-test"
+        in if getWord 0 = 1 then
+             (putWord 0 count; putWord 8 (Word64.toInt next); ffi "warm-end")
+           else loop count next
+        end
+  in loop 0 zeroWord end;
+fun runRow index =
+  let val () = putWord 0 index
+      val () = ffi "row"
+      val n = getWord 8
+      val domain = getWord 16
+      val profile = getWord 24
+      val operations = getWord 32
+      fun sample index =
+        let val () = ffi "sample-begin"
+            fun loop offset acc = if offset = operations then acc else
+              loop (offset + 4096) (Word64.+ acc (chunk n domain profile offset True))
+            val sink = loop 0 zeroWord
+            val () = putWord 0 index
+            val () = putWord 8 (Word64.toInt sink)
+            val () = ffi "sample-end"
+        in times (if domain = 0 then 6 else 1) (fn p => check (inputId n domain p) 0) end
+  in times samples sample end;
+
+val () = control ();
+val () = if verifyMode then times 585 (fn id => check id 1)
+         else (warm (); times rowCount runRow);
+(* Keep the request opaque: the pinned compiler folds an inlined ConfigGC
+ * with constant arguments. This separate diagnostic requires an actual
+ * additional traced collection, checked by the Lean runner. *)
+val () = if diagnostic then
+  let val request = Array.array 1 Runtime.fullGC
+  in ffi "terminal-start"; (Array.sub request 0) (); ffi "terminal-end" end
+  else ();
+val () = ffi "finish";
diff --git a/Benchmarks/Compiler/counter-fold.md b/Benchmarks/Compiler/counter-fold.md
new file mode 100644
index 000000000..3d16ce54c
--- /dev/null
+++ b/Benchmarks/Compiler/counter-fold.md
@@ -0,0 +1,80 @@
+# Checked reserve/reuse counter folding: paired protocol
+
+This PERF3 experiment uses the runtime reversal source and every dataset,
+timing row, full-result oracle, driver operation and timer convention from
+[protocol version 1](protocol.md). The comparison is `baseline` versus
+`counter-fold`, built by the same producer with identical GCC 14.3.0 driver
+objects and link options. Native records identify the common `compilatrix`
+driver; enclosing records bind the variant to its actual executable digest.
+
+The selected rewrite removes only the cancelling reservation/live counter
+changes in an adjacent reserve/reuse pair: twelve instructions per consumed
+cons cell. It retains all cell loads/stores and cumulative reuse/payload
+counter updates. Every final general-purpose register and arena word agrees
+with the baseline.
+The combined operation is atomic with respect to the source resource relation;
+intermediate reservation accounting is not an observation boundary for the
+folded body. The canonical exclusive-arena, guard, ABI and word-range contracts
+are identical. The default selector still emits the original baseline.
+
+Both variants pass the independent native artifact gate, eight runtime inputs,
+203 malformed calls, complete reclamation and corruption tests. The timing
+binaries also pass all 585 inputs and 19,305 capacity cases, with exact equality
+of complete arena observations, malformed-dataset checks and timing smoke.
+The gate's `--artifacts` option binds every benchmark artifact byte for byte
+to its freshly checked counterparts. The paired build pins both reviewed goldens; the original PERF1 manifest and
+reference bundle retain their original identities.
+
+The pilot targets 200 ms, taking the larger count required by either variant
+for each row and rounding to a multiple of 24,576 operations (4,096 chunks,
+six primary patterns). A confirmation pass requires at least 100 ms before
+freezing all counts. There are 30 paired blocks, in three groups of ten,
+separated by 60 seconds. Row and variant orders use the existing deterministic
+shuffle with seed 1210345809. Each variant starts a new worker process for
+each block, warms for one second and records three samples for all 38 rows:
+6,840 accepted samples in total. Workers and controller are pinned separately.
+All builds, checks and network setup finish before the pilot.
+
+The existing floors apply: at least 100 ms per sample, minimum chunk duration
+at least 100 times the observed minimum clock-pair cost, peak worker RSS no
+greater than 2 GiB, and no drift in recorded stable machine/environment fields.
+At most three complete attempts are retained for an invalid block; wrong
+results, artifacts, schemas or process failures stop publication. Every valid
+slow observation stays. The timer control is retained without subtraction.
+
+Analysis uses the median of three samples per variant/block and reports all
+38 baseline/folded distributions and paired ratios. Ratios above one favor
+folding. The same 10,000 hierarchical bootstrap index vectors resample three
+sessions and ten paired blocks within each selected session, seed 2671931027.
+This shared-host experiment and its three clusters cannot establish CI timing
+thresholds or remove between-day uncertainty. RSS, raw context switches,
+page faults, environment observations and timer controls remain in the bundle.
+
+Generation and independent-gate wall/CPU/RSS are diagnostic envelopes, not
+isolated compiler or proof-checker phases. Generation includes modeled fixture
+executions; each independent gate includes two generations, artifact checking,
+corruption regressions and a native harness. The report includes both envelopes,
+serialized pipeline bytes and object `.text` sizes. The proof checks are run
+before timing and documented separately.
+
+Run in the pinned repository environment, using fresh directories:
+
+```sh
+lake build compiler-benchmark compiler-source-native-runtime compiler-check-source-native-runtime
+.lake/build/bin/compiler-benchmark counter-fold-build BUILD
+.lake/build/bin/compiler-benchmark counter-fold-verify BUILD VERIFY
+.lake/build/bin/compiler-benchmark counter-fold-smoke BUILD SMOKE 2
+taskset --cpu-list 0 .lake/build/bin/compiler-benchmark counter-fold-pilot BUILD VERIFY PILOT 2
+taskset --cpu-list 0 .lake/build/bin/compiler-benchmark counter-fold-measure BUILD VERIFY PILOT MEASURED 2
+.lake/build/bin/compiler-benchmark counter-fold-analyze BUILD MEASURED MEASURED/analysis
+.lake/build/bin/compiler-benchmark counter-fold-reproduce BUILD MEASURED REPLAY
+```
+
+Select available controller/worker cores before piloting and retain them for
+measurement. Replay extracts and validates the source snapshot, uses an empty
+environment plus recorded variables and retained hashed producer/checker seeds,
+rebuilds exact objects/executables, repeats full correctness, and regenerates
+the same analysis from retained raw process records. It does not equate fresh
+clock readings or claim an independent physical host. The source, tools,
+objects, schedules, raw samples, diagnostic costs and replay are retained in
+a digest-addressed archive under `benchmarks/runs/`.
diff --git a/Benchmarks/Compiler/lean/LeanReverse.lean b/Benchmarks/Compiler/lean/LeanReverse.lean
new file mode 100644
index 000000000..e556a85eb
--- /dev/null
+++ b/Benchmarks/Compiler/lean/LeanReverse.lean
@@ -0,0 +1,12 @@
+import Init
+
+/- The consuming argument is deliberately not borrowed. The C driver owns
+each list exactly once, clears its input slot before this call, and checks
+exclusivity and cell reuse in a separate diagnostic run. -/
+@[noinline]
+def benchReverseOnto : List Nat → List Nat → List Nat
+  | [], accumulator => accumulator
+  | value :: rest, accumulator => benchReverseOnto rest (value :: accumulator)
+
+@[noinline, export bench_lean_reverse]
+def benchReverse (input : List Nat) : List Nat := benchReverseOnto input []
diff --git a/Benchmarks/Compiler/manifest.json b/Benchmarks/Compiler/manifest.json
new file mode 100644
index 000000000..e8886eeb1
--- /dev/null
+++ b/Benchmarks/Compiler/manifest.json
@@ -0,0 +1,88 @@
+{
+  "format": "compilatrix/benchmark-suite/1",
+  "workload": "native-reverse/1",
+  "toolchains": "toolchains.json",
+  "implementations": ["compilatrix", "lean", "cakeml", "compcert", "gcc", "clang"],
+  "comparison_groups": {
+    "language_runtime": ["compilatrix", "lean", "cakeml"],
+    "matched_arena": ["compilatrix", "compcert", "gcc", "clang"]
+  },
+  "compilatrix": {
+    "origin": "synthetic-ixon-runtime-function",
+    "producer": "source-native-runtime",
+    "correctness_gate": "check-source-native-runtime",
+    "source_identity": "98a3fce164301466d4a5bbc36d847a2515d45b1c97b788b38af411a6d2b17815",
+    "ixir1_root": "6f0a0fc8cd38011ce68c710019fe0f6dc53ebaf691508cf2c4ce67345865b1df",
+    "main_identity": "2e2e92297dc85259600f807045e2442e3e890812fdaa5af2f85a8f250bb80a9e",
+    "release_identity": "ee24dd7813f34e83cc165e2517e1d96a7c21f243d9c0fdf2301b11d63822263d",
+    "pipeline_identity": "bf9fc4c3d067dde6f3e3513f64910f68add1cb1862c86da616612e503af3b427",
+    "policy": "production guards, counters, and static unique reuse; one object pair for every input"
+  },
+  "datasets": {
+    "generator": "xorshift64star-patterns/1",
+    "generator_source": "Benchmark/Data.lean",
+    "binary_bytes": 318256,
+    "binary_blake3": "9e7b53b6321516f99019b0c55c99b719b89b046c0cf7281b7f545b3d9625a8f5",
+    "input_cases": 585,
+    "arena_capacity_cases": 19305,
+    "length_range": [0, 64],
+    "primary_patterns": ["zero", "repeated", "ascending", "descending", "alternating", "random"],
+    "primary_upper_bound_exclusive": 1073741824,
+    "stress_values": [9223372036854775807, 9223372036854775808, 18446744073709551615],
+    "primary_timing_lengths": [0, 1, 2, 4, 8, 16, 32, 48, 63, 64],
+    "stress_timing_lengths": [1, 16, 64],
+    "primary_pattern_schedule": "absolute operation index modulo six"
+  },
+  "ownership": {
+    "input_list_owners": 1,
+    "input_slot": "cleared before the consuming call",
+    "scalar_inputs": "immutable pre-generated scalar values may be shared",
+    "output_slots_per_chunk": 4096,
+    "reclamation": "release each returned list; tracing-GC cycles and terminal collection are reported separately"
+  },
+  "timing": {
+    "profiles": ["entry+handoff", "lifecycle"],
+    "rows": 38,
+    "storage_profile": "fresh allocation",
+    "arena_capacity": "length + 2",
+    "chunk_operations": 4096,
+    "timer": "CLOCK_MONOTONIC_RAW",
+    "minimum_sample_ns": 100000000,
+    "pilot_target_ns": 200000000,
+    "warmup_ns_per_process": 1000000000,
+    "samples_per_block": 3,
+    "blocks": 30,
+    "sessions": 3,
+    "session_separation_seconds": 60,
+    "maximum_rss_kb": 2097152,
+    "minimum_chunk_clock_pair_factor": 100,
+    "order_seed": 1210345809,
+    "outlier_policy": "retain every valid block, including slow observations",
+    "operation_counts": "pilot then freeze identical counts for every implementation in a paired case",
+    "sink": "per-list fold h=(h xor value)*1099511628211 modulo 2^64, starting at 14695981039346656037; sum list digests modulo 2^64"
+  },
+  "analysis": {
+    "within_block": "median",
+    "distribution": ["median", "q25", "q75", "ci95_low", "ci95_high"],
+    "speedup": "baseline_ns_per_operation / compilatrix_ns_per_operation",
+    "bootstrap": "hierarchical paired bootstrap: resample three sessions, then ten whole paired blocks within each selected session",
+    "bootstrap_replicates": 10000,
+    "bootstrap_seed": 2671931027,
+    "aggregate_workload_ranking": false
+  },
+  "diagnostics": {
+    "cakeml_lifecycle_rows": [28, 31, 34, 37],
+    "samples_per_row": 5,
+    "maximum_post_gc_live_bytes_exclusive": 8388608,
+    "minimum_natural_collections_per_sample": 1,
+    "terminal_collection": "one separately timed collection after all diagnostic samples"
+  },
+  "upstream_computations": {
+    "selector": "closed-unary-nat-calls/1",
+    "entries": ["applyClosed", "letClosed"],
+    "runtime_arguments": 0,
+    "profile": "opaque native call plus scalar sum sink; separate from reversal",
+    "blocks": 30,
+    "samples_per_block": 3
+  }
+}
diff --git a/Benchmarks/Compiler/native/arena.h b/Benchmarks/Compiler/native/arena.h
new file mode 100644
index 000000000..c7f292697
--- /dev/null
+++ b/Benchmarks/Compiler/native/arena.h
@@ -0,0 +1,17 @@
+#ifndef COMPILATRIX_BENCH_ARENA_H
+#define COMPILATRIX_BENCH_ARENA_H
+
+#include <stdint.h>
+
+enum { BENCH_MAX_LENGTH = 64, BENCH_MAX_CAPACITY = 66, HEADER_WORDS = 10, CELL_WORDS = 4 };
+enum { CURSOR, CAPACITY, ALLOCS, FREES, REUSES, LIVE, PEAK, RCOPS, PAYLOAD, RESERVATIONS };
+
+typedef struct {
+    uint64_t header[HEADER_WORDS];
+    uint64_t cells[][CELL_WORDS];
+} Arena;
+
+uint64_t compilatrix_runtime_reverse(Arena *arena, uint64_t length);
+uint64_t compilatrix_runtime_drop(Arena *arena, uint64_t root);
+
+#endif
diff --git a/Benchmarks/Compiler/native/arena_backend.c b/Benchmarks/Compiler/native/arena_backend.c
new file mode 100644
index 000000000..596e6161b
--- /dev/null
+++ b/Benchmarks/Compiler/native/arena_backend.c
@@ -0,0 +1,130 @@
+#include "common.h"
+#include "arena.h"
+#include <stdlib.h>
+#include <string.h>
+
+static void prepare(Arena *arena, const BenchInput *input, uint64_t capacity) {
+    memset(arena, 0, 80 + 32 * capacity);
+    arena->header[CURSOR] = 32 * (input->n + 1);
+    arena->header[CAPACITY] = 32 * capacity;
+    arena->header[ALLOCS] = arena->header[LIVE] = arena->header[PEAK] = input->n + 1;
+    for (uint64_t i = 1; i <= input->n; ++i) {
+        arena->cells[i][0] = 1;
+        arena->cells[i][1] = input->values[input->n - i];
+        arena->cells[i][2] = (uintptr_t)arena->cells[i - 1];
+    }
+}
+void backend_init(void) {}
+void backend_finish(void) {}
+BenchItem backend_make(const BenchInput *input, uint64_t capacity) {
+    Arena *arena = malloc(80 + 32 * capacity);
+    bench_need(arena != NULL, "arena allocation failed");
+    prepare(arena, input, capacity);
+    return (BenchItem){arena, input->n};
+}
+BenchItem backend_reverse(BenchItem input, uint64_t n) {
+    return (BenchItem){input.owner, compilatrix_runtime_reverse(input.owner, n)};
+}
+uint64_t backend_digest(BenchItem output) {
+    uint64_t *cell = (uint64_t *)(uintptr_t)output.value, hash = UINT64_C(14695981039346656037);
+    while (cell[0] == 1) {
+        hash = (hash ^ cell[1]) * UINT64_C(1099511628211);
+        cell = (uint64_t *)(uintptr_t)cell[2];
+    }
+    return hash;
+}
+void backend_release(BenchItem output) {
+    compilatrix_runtime_drop(output.owner, output.value);
+    free(output.owner);
+}
+uint64_t backend_capacity_count(const BenchInput *input) { return 65 - input->n; }
+
+/* Same physical SysV observations as the existing N2 gate. Diagnostics only. */
+__attribute__((noinline))
+static uint64_t checked_call(uint64_t (*entry)(Arena *, uint64_t), Arena *arena, uint64_t root) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp, %0" : "=r"(before));
+    uint64_t result = entry(arena, root);
+    __asm__ volatile("mov %%rsp, %0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    bench_need(before == after, "stack pointer changed");
+    bench_need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+        r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+        r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5), "callee-saved register changed");
+    return result;
+}
+static uint64_t spare(uint64_t cell, uint64_t field) {
+    return UINT64_C(0xc13fa9a902a6328f) ^ (cell * 17 + field);
+}
+static void frame(const uint64_t *storage, uint64_t words, const Arena *arena, uint64_t n, uint64_t capacity) {
+    bench_need(storage[0] == UINT64_C(0xfedcba9876543210) && storage[1] == UINT64_C(0x123456789abcdef0) &&
+        storage[words + 2] == UINT64_C(0xfedcba9876543210) && storage[words + 3] == UINT64_C(0x123456789abcdef0),
+        "arena canary changed");
+    for (uint64_t i = n + 2; i < capacity; ++i)
+        for (uint64_t j = 0; j < 4; ++j) bench_need(arena->cells[i][j] == spare(i, j), "unused capacity changed");
+}
+static void headers(const Arena *arena, uint64_t n, uint64_t capacity, int released) {
+    const uint64_t expected[10] = {32 * (n + 2), 32 * capacity, n + 2, released ? n + 2 : 1,
+        n, released ? 0 : n + 1, n + 2, 0, 2 * n, 0};
+    bench_need(memcmp(arena->header, expected, sizeof expected) == 0, "arena counters mismatch");
+}
+static void heap(const Arena *arena, uint64_t n) {
+    printf("{\"header\":"); bench_values(arena->header, 10); printf(",\"cells\":[");
+    for (uint64_t i = 0; i < n + 2; ++i) {
+        const uint64_t *cell = arena->cells[i];
+        printf("%s[%" PRIu64 ",%" PRIu64 ",", i ? "," : "", cell[0], cell[1]);
+        if (cell[2] == 0) printf("null");
+        else printf("%" PRIu64, (cell[2] - (uint64_t)(uintptr_t)arena->cells) / 32);
+        printf(",%" PRIu64 "]", cell[3]);
+    }
+    printf("]}");
+}
+void backend_verify(const BenchInput *input, uint64_t capacity, int emit) {
+    uint64_t n = input->n, words = 10 + 4 * capacity;
+    uint64_t *storage = malloc((words + 4) * 8);
+    bench_need(storage != NULL, "diagnostic allocation failed");
+    storage[0] = storage[words + 2] = UINT64_C(0xfedcba9876543210);
+    storage[1] = storage[words + 3] = UINT64_C(0x123456789abcdef0);
+    Arena *arena = (Arena *)(storage + 2);
+    prepare(arena, input, capacity);
+    for (uint64_t i = n + 2; i < capacity; ++i)
+        for (uint64_t j = 0; j < 4; ++j) arena->cells[i][j] = spare(i, j);
+    uint64_t root = checked_call(compilatrix_runtime_reverse, arena, n);
+    bench_need(root == (uintptr_t)arena->cells[1], "wrong arena result root");
+    headers(arena, n, capacity, 0); frame(storage, words, arena, n, capacity);
+    uint64_t values[MAX_N];
+    for (uint64_t i = 0; i < n + 2; ++i) {
+        const uint64_t *cell = arena->cells[i];
+        if (i == 0) bench_need(cell[0] == 3 && cell[1] == 0 && cell[2] == 0 && cell[3] == 0, "old nil not freed");
+        else if (i == n + 1) bench_need(cell[0] == 0 && cell[1] == 0 && cell[2] == 0 && cell[3] == 0, "new nil invalid");
+        else {
+            bench_need(cell[0] == 1 && cell[1] == input->values[n - i] &&
+                cell[2] == (uintptr_t)arena->cells[i + 1] && cell[3] == 0, "reversed cell mismatch");
+            values[i - 1] = cell[1];
+        }
+    }
+    uint64_t hash = backend_digest((BenchItem){arena, root});
+    bench_need(hash == input->digest, "arena digest mismatch");
+    if (emit) {
+        printf("{\"kind\":\"case\",\"id\":%" PRIu64 ",\"capacity\":%" PRIu64 ",\"values\":",
+            n * 9 + input->pattern, capacity);
+        bench_values(values, n); printf(",\"digest\":%" PRIu64 ",\"returned\":", hash); heap(arena, n);
+    }
+    bench_need(checked_call(compilatrix_runtime_drop, arena, root) == 0, "release result mismatch");
+    headers(arena, n, capacity, 1); frame(storage, words, arena, n, capacity);
+    for (uint64_t i = 0; i < n + 2; ++i)
+        bench_need(arena->cells[i][0] == 3 && arena->cells[i][1] == 0 &&
+            arena->cells[i][2] == 0 && arena->cells[i][3] == 0, "incomplete arena release");
+    if (emit) {
+        printf(",\"reclaimed\":"); heap(arena, n);
+        printf(",\"abi_preserved\":true,\"canaries_preserved\":true,\"unused_capacity_preserved\":true}\n");
+    }
+    free(storage);
+}
diff --git a/Benchmarks/Compiler/native/arena_kernel.c b/Benchmarks/Compiler/native/arena_kernel.c
new file mode 100644
index 000000000..94ba1368e
--- /dev/null
+++ b/Benchmarks/Compiler/native/arena_kernel.c
@@ -0,0 +1,70 @@
+/* One C implementation is compiled unchanged by CompCert, GCC, and Clang.
+   The caller supplies mapped, aligned storage for the declared capacity.
+   All integer checks precede cell pointer formation. The guards, counters,
+   cell reuse, and complete release match native-reverse/1's production ABI. */
+#include "arena.h"
+
+uint64_t compilatrix_runtime_reverse(Arena *arena, uint64_t length) {
+    uint64_t base = (uint64_t)(uintptr_t)arena;
+    uint64_t capacity, cursor, index, accumulator;
+    if (length > BENCH_MAX_LENGTH || base == 0 || base % 8 != 0)
+        return 0;
+    capacity = arena->header[CAPACITY];
+    cursor = 32 * (length + 1);
+    if (capacity > 32 * BENCH_MAX_CAPACITY || capacity % 32 != 0 ||
+        capacity < cursor + 32 || base > UINT64_MAX - 80 - capacity)
+        return 0;
+    if (arena->header[CURSOR] != cursor ||
+        arena->header[ALLOCS] != length + 1 || arena->header[FREES] != 0 ||
+        arena->header[REUSES] != 0 || arena->header[LIVE] != length + 1 ||
+        arena->header[PEAK] != length + 1 || arena->header[RCOPS] != 0 ||
+        arena->header[PAYLOAD] != 0 || arena->header[RESERVATIONS] != 0)
+        return 0;
+    if (arena->cells[0][0] != 0 || arena->cells[0][1] != 0 ||
+        arena->cells[0][2] != 0 || arena->cells[0][3] != 0)
+        return 0;
+    for (index = 1; index <= length; ++index) {
+        if (arena->cells[index][0] != 1 || arena->cells[index][3] != 0 ||
+            arena->cells[index][2] != (uint64_t)(uintptr_t)arena->cells[index - 1])
+            return 0;
+    }
+
+    index = length + 1;
+    arena->cells[index][0] = 0;
+    arena->cells[index][1] = 0;
+    arena->cells[index][2] = 0;
+    arena->cells[index][3] = 0;
+    accumulator = (uint64_t)(uintptr_t)arena->cells[index];
+    arena->header[CURSOR] += 32;
+    ++arena->header[ALLOCS];
+    ++arena->header[LIVE];
+    arena->header[PEAK] = arena->header[LIVE];
+    for (index = length; index != 0; --index) {
+        arena->cells[index][2] = accumulator;
+        accumulator = (uint64_t)(uintptr_t)arena->cells[index];
+        ++arena->header[REUSES];
+        arena->header[PAYLOAD] += 2;
+    }
+    arena->cells[0][0] = 3;
+    ++arena->header[FREES];
+    --arena->header[LIVE];
+    return accumulator;
+}
+
+/* As in the emitted release entry, root must own a well-formed returned
+   chain. Invalid-input diagnostics exercise reversal's guarded entry. */
+uint64_t compilatrix_runtime_drop(Arena *arena, uint64_t root) {
+    uint64_t current = root;
+    while (current != 0) {
+        uint64_t *cell = (uint64_t *)(uintptr_t)current;
+        uint64_t next = cell[0] == 1 ? cell[2] : 0;
+        cell[0] = 3;
+        cell[1] = 0;
+        cell[2] = 0;
+        cell[3] = 0;
+        ++arena->header[FREES];
+        --arena->header[LIVE];
+        current = next;
+    }
+    return 0;
+}
diff --git a/Benchmarks/Compiler/native/cakeml_ffi.c b/Benchmarks/Compiler/native/cakeml_ffi.c
new file mode 100644
index 000000000..30b30df47
--- /dev/null
+++ b/Benchmarks/Compiler/native/cakeml_ffi.c
@@ -0,0 +1,100 @@
+#include "common.h"
+#include <stdlib.h>
+#include <string.h>
+
+extern unsigned int argc;
+extern char **argv;
+#ifdef BENCH_CAKEML_GC
+extern int numGC;
+extern long prevOcc, numAllocBytes, microsecs;
+static int gc_before;
+#endif
+static int verifying;
+static uint64_t row_index, warm_start, terminal_start;
+
+static int command(const unsigned char *text, long length, const char *expected) {
+    return length == (long)strlen(expected) && memcmp(text, expected, length) == 0;
+}
+void ffibench(unsigned char *config, long length, unsigned char *bytes, long size) {
+    bench_need(size == 1024, "CakeML FFI packet size mismatch");
+    if (command(config, length, "init")) {
+        bench_need(argc == 4 || argc == 5, "invalid CakeML driver arguments");
+        bench_implementation = argv[1]; verifying = strcmp(argv[2], "verify") == 0;
+        bench_need((verifying && argc == 4) || (!verifying && argc == 5 && strcmp(argv[2], "run") == 0), "invalid CakeML mode");
+        bench_load(argv[3], verifying ? NULL : argv[4]);
+        bench_metadata();
+        bench_put_word(bytes, verifying); bench_put_word(bytes + 8, bench_schedule.count);
+        bench_put_word(bytes + 16, bench_schedule.samples); bench_put_word(bytes + 24, bench_schedule.warm_ns);
+#ifdef BENCH_CAKEML_GC
+        bench_put_word(bytes + 32, 1);
+#else
+        bench_put_word(bytes + 32, 0);
+#endif
+    } else if (command(config, length, "input")) {
+        uint64_t id = bench_word(bytes);
+        bench_need(id < INPUT_COUNT, "CakeML input id out of range");
+        bench_put_word(bytes, bench_inputs[id].n);
+        for (uint64_t i = 0; i < MAX_N; ++i) bench_put_word(bytes + 8 + i * 8, bench_inputs[id].values[i]);
+    } else if (command(config, length, "row")) {
+        row_index = bench_word(bytes);
+        bench_need(row_index < bench_schedule.count, "CakeML row out of range");
+        const BenchRow *row = &bench_schedule.rows[row_index];
+        bench_put_word(bytes, row->id); bench_put_word(bytes + 8, row->n); bench_put_word(bytes + 16, row->domain);
+        bench_put_word(bytes + 24, row->profile); bench_put_word(bytes + 32, row->operations);
+    } else if (command(config, length, "sample-begin")) {
+        bench_sample_begin();
+#ifdef BENCH_CAKEML_GC
+        gc_before = numGC;
+#endif
+    } else if (command(config, length, "clock-start")) bench_clock_start();
+    else if (command(config, length, "clock-stop")) bench_clock_stop();
+    else if (command(config, length, "sample-end")) {
+        uint64_t sample = bench_word(bytes), sink = bench_word(bytes + 8);
+        bench_sample_end(&bench_schedule.rows[row_index], sample, sink);
+#ifdef BENCH_CAKEML_GC
+        printf("{\"kind\":\"gc-sample\",\"row\":%" PRIu64 ",\"sample\":%" PRIu64
+            ",\"collections\":%d,\"total_collections\":%d,\"last_post_gc_live_bytes\":%ld,"
+            "\"allocated_bytes_at_last_gc\":%ld,\"total_gc_microseconds\":%ld}\n",
+            bench_schedule.rows[row_index].id, sample, numGC - gc_before, numGC, prevOcc, numAllocBytes, microsecs);
+#endif
+    } else if (command(config, length, "warm-start")) warm_start = bench_now();
+    else if (command(config, length, "warm-test")) bench_put_word(bytes, bench_now() - warm_start >= bench_schedule.warm_ns);
+    else if (command(config, length, "warm-end")) {
+        uint64_t operations = bench_word(bytes), sink = bench_word(bytes + 8);
+        BenchRow row = {28, 64, 0, 1, operations};
+        bench_need(sink == bench_expected_sink(&row, operations), "CakeML warm-up sink mismatch");
+        printf("{\"kind\":\"warmup\",\"elapsed_ns\":%" PRIu64 ",\"operations\":%" PRIu64
+            ",\"sink\":%" PRIu64 "}\n", bench_now() - warm_start, operations, sink);
+    } else if (command(config, length, "control-start")) terminal_start = bench_now();
+    else if (command(config, length, "control-end")) {
+        uint64_t duration = bench_now() - terminal_start;
+        bench_need(bench_word(bytes) == 0, "CakeML empty control mismatch");
+        printf("{\"kind\":\"control\",\"name\":\"empty-reverse-handoff\",\"operations\":4194304,\"elapsed_ns\":%" PRIu64
+            ",\"sink\":0}\n", duration);
+    } else if (command(config, length, "verify")) {
+        uint64_t id = bench_word(bytes), n = bench_word(bytes + 8), hash = bench_word(bytes + 16), emit = bench_word(bytes + 24);
+        bench_need(id < INPUT_COUNT && n == bench_inputs[id].n && hash == bench_inputs[id].digest, "CakeML result metadata mismatch");
+        uint64_t values[MAX_N];
+        for (uint64_t i = 0; i < n; ++i) {
+            values[i] = bench_word(bytes + 32 + 8 * i);
+            bench_need(values[i] == bench_inputs[id].values[n - i - 1], "CakeML reversed value mismatch");
+        }
+        if (emit) {
+            printf("{\"kind\":\"case\",\"id\":%" PRIu64 ",\"capacity\":null,\"values\":", id);
+            bench_values(values, n);
+            printf(",\"digest\":%" PRIu64 ",\"roots_dropped\":true}\n", hash);
+        }
+    } else if (command(config, length, "terminal-start")) terminal_start = bench_now();
+    else if (command(config, length, "terminal-end")) {
+#ifdef BENCH_CAKEML_GC
+        printf("{\"kind\":\"terminal-gc\",\"elapsed_ns\":%" PRIu64 ",\"total_collections\":%d,\"post_gc_live_bytes\":%ld,"
+            "\"rss_kb\":%" PRIu64 "}\n", bench_now() - terminal_start, numGC, prevOcc, bench_rss_kb());
+#else
+        bench_need(0, "terminal GC must use the diagnostic executable");
+#endif
+    } else if (command(config, length, "finish")) {
+        if (verifying) printf("{\"kind\":\"verified\",\"cases\":585}\n");
+        else printf("{\"kind\":\"completed\",\"rows\":%" PRIu64 ",\"samples_per_row\":%" PRIu64 "}\n",
+            bench_schedule.count, bench_schedule.samples);
+    } else bench_need(0, "unknown CakeML FFI command");
+}
diff --git a/Benchmarks/Compiler/native/common.c b/Benchmarks/Compiler/native/common.c
new file mode 100644
index 000000000..ac3b5061d
--- /dev/null
+++ b/Benchmarks/Compiler/native/common.c
@@ -0,0 +1,170 @@
+#define _GNU_SOURCE
+#include "common.h"
+#include <errno.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/resource.h>
+#include <time.h>
+#include <unistd.h>
+
+BenchInput bench_inputs[INPUT_COUNT];
+BenchSchedule bench_schedule;
+const char *bench_implementation;
+static uint64_t elapsed, started, chunks, minimum_chunk;
+static struct rusage sample_usage;
+static uint64_t sample_envelope;
+
+void bench_need(int ok, const char *message) {
+    if (!ok) { fprintf(stderr, "benchmark: %s\n", message); exit(1); }
+}
+uint64_t bench_word(const unsigned char *bytes) {
+    uint64_t value = 0;
+    for (unsigned i = 0; i < 8; ++i) value |= (uint64_t)bytes[i] << (8 * i);
+    return value;
+}
+void bench_put_word(unsigned char *bytes, uint64_t value) {
+    for (unsigned i = 0; i < 8; ++i) bytes[i] = value >> (8 * i);
+}
+static uint64_t read_word(FILE *file) {
+    unsigned char bytes[8];
+    bench_need(fread(bytes, 1, 8, file) == 8, "truncated binary input");
+    return bench_word(bytes);
+}
+static FILE *open_binary(const char *name, const char *magic) {
+    FILE *file = fopen(name, "rb");
+    unsigned char actual[8];
+    bench_need(file != NULL, "cannot open binary input");
+    bench_need(fread(actual, 1, 8, file) == 8 && memcmp(actual, magic, 8) == 0, "wrong binary magic");
+    return file;
+}
+static void close_binary(FILE *file) {
+    bench_need(fgetc(file) == EOF && !ferror(file), "trailing binary input");
+    bench_need(fclose(file) == 0, "cannot close binary input");
+}
+void bench_load(const char *datasets, const char *schedule) {
+    FILE *file = open_binary(datasets, "CPBN001\n");
+    bench_need(read_word(file) == INPUT_COUNT, "wrong dataset inventory");
+    for (uint64_t id = 0; id < INPUT_COUNT; ++id) {
+        BenchInput *input = &bench_inputs[id];
+        input->n = read_word(file); input->pattern = read_word(file);
+        input->domain = read_word(file); input->seed = read_word(file);
+        bench_need(input->n == id / 9 && input->pattern == id % 9 &&
+            input->domain == (id % 9 < 6 ? 0 : id % 9 - 5), "noncanonical dataset metadata");
+        for (uint64_t i = 0; i < MAX_N; ++i) {
+            input->values[i] = read_word(file);
+            bench_need(i < input->n || input->values[i] == 0, "nonzero dataset padding");
+            bench_need(input->domain != 0 || input->values[i] < (UINT64_C(1) << 30), "primary value out of range");
+        }
+        input->digest = UINT64_C(14695981039346656037);
+        for (uint64_t i = input->n; i != 0; --i)
+            input->digest = (input->digest ^ input->values[i - 1]) * UINT64_C(1099511628211);
+    }
+    close_binary(file);
+    if (schedule == NULL) return;
+    file = open_binary(schedule, "CPBS001\n");
+    bench_schedule.count = read_word(file); bench_schedule.samples = read_word(file);
+    bench_schedule.warm_ns = read_word(file); bench_schedule.chunk = read_word(file);
+    bench_schedule.mode = read_word(file);
+    bench_need(bench_schedule.count > 0 && bench_schedule.count <= ROW_COUNT &&
+        bench_schedule.samples > 0 && bench_schedule.samples <= 10 &&
+        bench_schedule.warm_ns <= UINT64_C(10000000000) && bench_schedule.chunk == CHUNK &&
+        bench_schedule.mode <= 2, "invalid schedule header");
+    if (bench_schedule.mode == 2)
+        bench_need(bench_schedule.count == ROW_COUNT && bench_schedule.samples == 3 &&
+            bench_schedule.warm_ns >= UINT64_C(1000000000), "incomplete measurement schedule");
+    uint64_t seen = 0;
+    const uint64_t lengths[10] = {0, 1, 2, 4, 8, 16, 32, 48, 63, 64};
+    const uint64_t stress_lengths[3] = {1, 16, 64};
+    for (uint64_t i = 0; i < bench_schedule.count; ++i) {
+        BenchRow *row = &bench_schedule.rows[i];
+        row->id = read_word(file); row->n = read_word(file); row->domain = read_word(file);
+        row->profile = read_word(file); row->operations = read_word(file);
+        bench_need(row->id < ROW_COUNT, "schedule row id out of range");
+        uint64_t local = row->id % 19;
+        bench_need(row->profile == row->id / 19 && row->domain == (local < 10 ? 0 : 1 + (local - 10) / 3) &&
+            row->n == (local < 10 ? lengths[local] : stress_lengths[(local - 10) % 3]) &&
+            row->operations > 0 && row->operations <= UINT64_C(1000000000000) &&
+            row->operations % (CHUNK * 6) == 0 && !(seen & (UINT64_C(1) << row->id)), "invalid schedule row");
+        seen |= UINT64_C(1) << row->id;
+    }
+    close_binary(file);
+}
+uint64_t bench_now(void) {
+    struct timespec value;
+    bench_need(clock_gettime(CLOCK_MONOTONIC_RAW, &value) == 0, "monotonic timer unavailable");
+    return (uint64_t)value.tv_sec * UINT64_C(1000000000) + value.tv_nsec;
+}
+uint64_t bench_rss_kb(void) {
+    FILE *file = fopen("/proc/self/statm", "r");
+    unsigned long pages, resident;
+    bench_need(file != NULL && fscanf(file, "%lu %lu", &pages, &resident) == 2, "cannot read process RSS");
+    fclose(file);
+    return (uint64_t)resident * (uint64_t)sysconf(_SC_PAGESIZE) / 1024;
+}
+void bench_metadata(void) {
+    uint64_t minimum = UINT64_MAX, sum = 0;
+    for (unsigned i = 0; i < 10000; ++i) {
+        uint64_t before = bench_now(), delta = bench_now() - before;
+        if (delta && delta < minimum) minimum = delta;
+        sum += delta;
+    }
+    struct timespec resolution;
+    bench_need(clock_getres(CLOCK_MONOTONIC_RAW, &resolution) == 0, "cannot read timer resolution");
+    printf("{\"kind\":\"metadata\",\"format\":\"compilatrix/benchmark-native/1\",\"implementation\":\"%s\","
+        "\"timer\":\"CLOCK_MONOTONIC_RAW\",\"resolution_ns\":%" PRIu64 ",\"timer_pair_min_ns\":%" PRIu64
+        ",\"timer_pair_mean_ns\":%.4f,\"initial_rss_kb\":%" PRIu64 "}\n", bench_implementation,
+        (uint64_t)resolution.tv_sec * UINT64_C(1000000000) + resolution.tv_nsec, minimum, sum / 10000.0, bench_rss_kb());
+}
+const BenchInput *bench_input(const BenchRow *row, uint64_t operation) {
+    uint64_t pattern = row->domain == 0 ? operation % 6 : row->domain + 5;
+    return &bench_inputs[row->n * 9 + pattern];
+}
+uint64_t bench_expected_sink(const BenchRow *row, uint64_t operations) {
+    if (row->domain != 0) return bench_input(row, 0)->digest * operations;
+    uint64_t cycle = 0, rest = 0;
+    for (uint64_t i = 0; i < 6; ++i) {
+        cycle += bench_input(row, i)->digest;
+        if (i < operations % 6) rest += bench_input(row, i)->digest;
+    }
+    return cycle * (operations / 6) + rest;
+}
+void bench_values(const uint64_t *values, uint64_t n) {
+    printf("[");
+    for (uint64_t i = 0; i < n; ++i) printf("%s%" PRIu64, i ? "," : "", values[i]);
+    printf("]");
+}
+void bench_sample_begin(void) {
+    elapsed = chunks = 0; minimum_chunk = UINT64_MAX;
+    bench_need(getrusage(RUSAGE_SELF, &sample_usage) == 0, "cannot read sample resource usage");
+    sample_envelope = bench_now();
+}
+void bench_clock_start(void) { started = bench_now(); }
+void bench_clock_stop(void) {
+    uint64_t delta = bench_now() - started;
+    elapsed += delta; ++chunks;
+    if (delta < minimum_chunk) minimum_chunk = delta;
+}
+uint64_t bench_elapsed(void) { return elapsed; }
+static uint64_t cpu_ns(struct rusage *usage) {
+    return ((uint64_t)usage->ru_utime.tv_sec + usage->ru_stime.tv_sec) * UINT64_C(1000000000) +
+        ((uint64_t)usage->ru_utime.tv_usec + usage->ru_stime.tv_usec) * 1000;
+}
+void bench_sample_end(const BenchRow *row, uint64_t sample, uint64_t sink) {
+    struct rusage usage;
+    uint64_t envelope = bench_now() - sample_envelope;
+    bench_need(getrusage(RUSAGE_SELF, &usage) == 0, "cannot read resource usage");
+    bench_need(sink == bench_expected_sink(row, row->operations), "timed sink mismatch");
+    bench_need(chunks == row->operations / CHUNK && elapsed > 0, "invalid timed chunk count");
+    printf("{\"kind\":\"sample\",\"implementation\":\"%s\",\"mode\":%" PRIu64
+        ",\"row\":%" PRIu64 ",\"sample\":%" PRIu64 ",\"operations\":%" PRIu64
+        ",\"elapsed_ns\":%" PRIu64 ",\"chunks\":%" PRIu64 ",\"timer_calls\":%" PRIu64
+        ",\"minimum_chunk_ns\":%" PRIu64 ",\"sink\":%" PRIu64 ",\"envelope_ns\":%" PRIu64
+        ",\"envelope_cpu_ns\":%" PRIu64 ",\"rss_kb\":%" PRIu64 ",\"peak_rss_kb\":%ld"
+        ",\"minor_faults\":%ld,\"major_faults\":%ld,\"voluntary_switches\":%ld,\"involuntary_switches\":%ld}\n",
+        bench_implementation, bench_schedule.mode, row->id, sample, row->operations, elapsed, chunks, chunks * 2,
+        minimum_chunk, sink, envelope, cpu_ns(&usage) - cpu_ns(&sample_usage), bench_rss_kb(), usage.ru_maxrss,
+        usage.ru_minflt - sample_usage.ru_minflt, usage.ru_majflt - sample_usage.ru_majflt,
+        usage.ru_nvcsw - sample_usage.ru_nvcsw, usage.ru_nivcsw - sample_usage.ru_nivcsw);
+    fflush(stdout);
+}
diff --git a/Benchmarks/Compiler/native/common.h b/Benchmarks/Compiler/native/common.h
new file mode 100644
index 000000000..eb64232a1
--- /dev/null
+++ b/Benchmarks/Compiler/native/common.h
@@ -0,0 +1,43 @@
+#ifndef COMPILATRIX_BENCH_COMMON_H
+#define COMPILATRIX_BENCH_COMMON_H
+#include <inttypes.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdio.h>
+
+enum { INPUT_COUNT = 585, MAX_N = 64, MAX_C = 66, CHUNK = 4096, ROW_COUNT = 38 };
+typedef struct { uint64_t n, pattern, domain, seed, values[MAX_N], digest; } BenchInput;
+typedef struct { uint64_t id, n, domain, profile, operations; } BenchRow;
+typedef struct {
+    BenchRow rows[ROW_COUNT];
+    uint64_t count, samples, warm_ns, chunk, mode;
+} BenchSchedule;
+extern BenchInput bench_inputs[INPUT_COUNT];
+extern BenchSchedule bench_schedule;
+extern const char *bench_implementation;
+void bench_need(int ok, const char *message);
+uint64_t bench_word(const unsigned char *bytes);
+void bench_put_word(unsigned char *bytes, uint64_t value);
+void bench_load(const char *datasets, const char *schedule);
+uint64_t bench_now(void);
+uint64_t bench_rss_kb(void);
+void bench_metadata(void);
+const BenchInput *bench_input(const BenchRow *row, uint64_t operation);
+uint64_t bench_expected_sink(const BenchRow *row, uint64_t operations);
+void bench_values(const uint64_t *values, uint64_t n);
+void bench_sample_begin(void);
+void bench_clock_start(void);
+void bench_clock_stop(void);
+uint64_t bench_elapsed(void);
+void bench_sample_end(const BenchRow *row, uint64_t sample, uint64_t sink);
+
+typedef struct { void *owner; uint64_t value; } BenchItem;
+void backend_init(void);
+void backend_finish(void);
+BenchItem backend_make(const BenchInput *input, uint64_t capacity);
+BenchItem backend_reverse(BenchItem input, uint64_t n);
+uint64_t backend_digest(BenchItem output);
+void backend_release(BenchItem output);
+void backend_verify(const BenchInput *input, uint64_t capacity, int emit);
+uint64_t backend_capacity_count(const BenchInput *input);
+#endif
diff --git a/Benchmarks/Compiler/native/driver.c b/Benchmarks/Compiler/native/driver.c
new file mode 100644
index 000000000..380105081
--- /dev/null
+++ b/Benchmarks/Compiler/native/driver.c
@@ -0,0 +1,90 @@
+#include "common.h"
+#include <stdlib.h>
+#include <string.h>
+
+static BenchItem inputs[CHUNK], outputs[CHUNK];
+static volatile uint64_t observed;
+
+static uint64_t run_chunk(const BenchRow *row, uint64_t offset, int timed) {
+    uint64_t sink = 0;
+    if (row->profile == 0) {
+        for (uint64_t i = 0; i < CHUNK; ++i) inputs[i] = backend_make(bench_input(row, offset + i), row->n + 2);
+        if (timed) bench_clock_start();
+        for (uint64_t i = 0; i < CHUNK; ++i) {
+            BenchItem owned = inputs[i]; inputs[i] = (BenchItem){0, 0};
+            outputs[i] = backend_reverse(owned, row->n);
+        }
+        if (timed) bench_clock_stop();
+        for (uint64_t i = 0; i < CHUNK; ++i) {
+            BenchItem owned = outputs[i]; outputs[i] = (BenchItem){0, 0};
+            sink += backend_digest(owned); backend_release(owned);
+        }
+    } else {
+        if (timed) bench_clock_start();
+        for (uint64_t i = 0; i < CHUNK; ++i) {
+            BenchItem owned = backend_make(bench_input(row, offset + i), row->n + 2);
+            owned = backend_reverse(owned, row->n);
+            sink += backend_digest(owned); backend_release(owned);
+        }
+        if (timed) bench_clock_stop();
+    }
+    return sink;
+}
+
+/* Opaque call and bounded slot traffic, without reversal. It exposes driver
+   overhead; its raw time is never subtracted from the workload samples. */
+__attribute__((noinline)) static BenchItem handoff(BenchItem item) {
+    __asm__ volatile("" : "+r"(item.owner), "+r"(item.value) : : "memory");
+    return item;
+}
+static void control(void) {
+    uint64_t total = 0, count = 1024 * CHUNK;
+    uint64_t before = bench_now();
+    for (uint64_t j = 0; j < 1024; ++j)
+        for (uint64_t i = 0; i < CHUNK; ++i) outputs[i] = handoff(inputs[i]);
+    uint64_t elapsed = bench_now() - before;
+    for (uint64_t i = 0; i < CHUNK; ++i) total += outputs[i].value;
+    observed = total;
+    printf("{\"kind\":\"control\",\"name\":\"opaque-empty-handoff\",\"operations\":%" PRIu64
+        ",\"elapsed_ns\":%" PRIu64 ",\"sink\":%" PRIu64 "}\n", count, elapsed, total);
+}
+
+int main(int argc, char **argv) {
+    bench_need(argc == 4 || argc == 5, "usage: executable IMPLEMENTATION verify DATASET | IMPLEMENTATION run DATASET SCHEDULE");
+    bench_implementation = argv[1];
+    int verify = strcmp(argv[2], "verify") == 0;
+    bench_need((verify && argc == 4) || (!verify && argc == 5 && strcmp(argv[2], "run") == 0), "unknown driver mode");
+    bench_load(argv[3], verify ? NULL : argv[4]);
+    backend_init(); bench_metadata(); control();
+    if (verify) {
+        uint64_t count = 0;
+        for (uint64_t i = 0; i < INPUT_COUNT; ++i)
+            for (uint64_t j = 0; j < backend_capacity_count(&bench_inputs[i]); ++j) {
+                backend_verify(&bench_inputs[i], bench_inputs[i].n + 2 + j, 1); ++count;
+            }
+        printf("{\"kind\":\"verified\",\"cases\":%" PRIu64 "}\n", count);
+    } else {
+        BenchRow warm = {28, 64, 0, 1, CHUNK};
+        uint64_t before = bench_now(), operations = 0, sink = 0;
+        do { sink += run_chunk(&warm, operations, 0); operations += CHUNK; }
+        while (bench_now() - before < bench_schedule.warm_ns);
+        bench_need(sink == bench_expected_sink(&warm, operations), "warm-up sink mismatch");
+        observed = sink;
+        printf("{\"kind\":\"warmup\",\"elapsed_ns\":%" PRIu64 ",\"operations\":%" PRIu64
+            ",\"sink\":%" PRIu64 "}\n", bench_now() - before, operations, sink);
+        for (uint64_t r = 0; r < bench_schedule.count; ++r) {
+            const BenchRow *row = &bench_schedule.rows[r];
+            for (uint64_t sample = 0; sample < bench_schedule.samples; ++sample) {
+                bench_sample_begin(); sink = 0;
+                for (uint64_t op = 0; op < row->operations; op += CHUNK) sink += run_chunk(row, op, 1);
+                observed = sink; bench_sample_end(row, sample, sink);
+                for (uint64_t pattern = 0; pattern < (row->domain ? 1 : 6); ++pattern)
+                    backend_verify(bench_input(row, pattern), row->n + 2, 0);
+            }
+        }
+        printf("{\"kind\":\"completed\",\"rows\":%" PRIu64 ",\"samples_per_row\":%" PRIu64 "}\n",
+            bench_schedule.count, bench_schedule.samples);
+    }
+    backend_finish();
+    return 0;
+}
diff --git a/Benchmarks/Compiler/native/lean_backend.c b/Benchmarks/Compiler/native/lean_backend.c
new file mode 100644
index 000000000..78c66c4ca
--- /dev/null
+++ b/Benchmarks/Compiler/native/lean_backend.c
@@ -0,0 +1,83 @@
+#include "common.h"
+#include <lean/lean.h>
+
+extern lean_object *bench_lean_reverse(lean_object *input);
+extern lean_object *initialize_LeanReverse(uint8_t builtin);
+extern void lean_initialize_runtime_module(void);
+static lean_object *scalars[INPUT_COUNT][MAX_N];
+
+void backend_init(void) {
+    lean_initialize_runtime_module();
+    lean_object *result = initialize_LeanReverse(1);
+    bench_need(lean_io_result_is_ok(result), "Lean initialization failed");
+    lean_dec_ref(result);
+    lean_io_mark_end_initialization();
+    for (uint64_t id = 0; id < INPUT_COUNT; ++id)
+        for (uint64_t i = 0; i < bench_inputs[id].n; ++i)
+            scalars[id][i] = lean_uint64_to_nat(bench_inputs[id].values[i]);
+}
+void backend_finish(void) {
+    for (uint64_t id = 0; id < INPUT_COUNT; ++id)
+        for (uint64_t i = 0; i < bench_inputs[id].n; ++i) lean_dec(scalars[id][i]);
+}
+BenchItem backend_make(const BenchInput *input, uint64_t capacity) {
+    (void)capacity;
+    uint64_t id = input - bench_inputs;
+    lean_object *list = lean_box(0);
+    for (uint64_t i = input->n; i != 0; --i) {
+        lean_object *node = lean_alloc_ctor(1, 2, 0), *value = scalars[id][i - 1];
+        lean_inc(value);
+        lean_ctor_set(node, 0, value); lean_ctor_set(node, 1, list); list = node;
+    }
+    return (BenchItem){list, 0};
+}
+BenchItem backend_reverse(BenchItem input, uint64_t n) {
+    (void)n;
+    return (BenchItem){bench_lean_reverse(input.owner), 0};
+}
+uint64_t backend_digest(BenchItem output) {
+    lean_object *list = output.owner;
+    uint64_t hash = UINT64_C(14695981039346656037);
+    while (!lean_is_scalar(list)) {
+        hash = (hash ^ lean_uint64_of_nat(lean_ctor_get(list, 0))) * UINT64_C(1099511628211);
+        list = lean_ctor_get(list, 1);
+    }
+    return hash;
+}
+void backend_release(BenchItem output) { lean_dec((lean_object *)output.owner); }
+uint64_t backend_capacity_count(const BenchInput *input) { (void)input; return 1; }
+void backend_verify(const BenchInput *input, uint64_t capacity, int emit) {
+    BenchItem owned = backend_make(input, capacity);
+    /* Integer addresses are diagnostic weak observations, never RC owners. */
+    uintptr_t addresses[MAX_N];
+    lean_object *cursor = owned.owner;
+    for (uint64_t i = 0; i < input->n; ++i) {
+        bench_need(!lean_is_scalar(cursor) && lean_is_exclusive(cursor), "Lean input spine is shared");
+        addresses[i] = (uintptr_t)cursor;
+        cursor = lean_ctor_get(cursor, 1);
+    }
+    bench_need(lean_is_scalar(cursor) && lean_unbox(cursor) == 0, "Lean input nil invalid");
+    cursor = NULL;
+    BenchItem result = backend_reverse(owned, input->n); owned = (BenchItem){0, 0};
+    cursor = result.owner;
+    uint64_t values[MAX_N], reused = 0;
+    for (uint64_t i = 0; i < input->n; ++i) {
+        bench_need(!lean_is_scalar(cursor) && lean_is_exclusive(cursor), "Lean output spine is shared or short");
+        values[i] = lean_uint64_of_nat(lean_ctor_get(cursor, 0));
+        bench_need(values[i] == input->values[input->n - i - 1], "Lean reversal value mismatch");
+        reused += (uintptr_t)cursor == addresses[input->n - i - 1];
+        cursor = lean_ctor_get(cursor, 1);
+    }
+    bench_need(lean_is_scalar(cursor) && lean_unbox(cursor) == 0 && reused == input->n, "Lean reuse or nil mismatch");
+    uint64_t hash = backend_digest(result);
+    bench_need(hash == input->digest, "Lean digest mismatch");
+    cursor = NULL;
+    backend_release(result); result = (BenchItem){0, 0};
+    if (emit) {
+        printf("{\"kind\":\"case\",\"id\":%" PRIu64 ",\"capacity\":null,\"values\":", input->n * 9 + input->pattern);
+        bench_values(values, input->n);
+        printf(",\"digest\":%" PRIu64 ",\"exclusive_input_cons\":%" PRIu64
+            ",\"exclusive_output_cons\":%" PRIu64 ",\"reused_cons\":%" PRIu64 ",\"released\":true}\n",
+            hash, input->n, input->n, reused);
+    }
+}
diff --git a/Benchmarks/Compiler/native/worker_launcher.c b/Benchmarks/Compiler/native/worker_launcher.c
new file mode 100644
index 000000000..f2f353234
--- /dev/null
+++ b/Benchmarks/Compiler/native/worker_launcher.c
@@ -0,0 +1,29 @@
+#include <errno.h>
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+/* Fork from this small image: Linux preserves a process's pre-exec RSS
+ * high-water mark, which would otherwise include the Lean runner's memory.
+ * The child starts with this launcher's current resident set. Startup and
+ * this fork are outside every recorded native timing interval. */
+int main(int argc, char **argv) {
+  if (argc < 2) return 2;
+  pid_t child = fork();
+  if (child < 0) { perror("benchmark worker fork"); return 2; }
+  if (child == 0) {
+    execv(argv[1], argv + 1);
+    perror("benchmark worker exec");
+    _exit(127);
+  }
+  int status;
+  while (waitpid(child, &status, 0) < 0) {
+    if (errno == EINTR) continue;
+    perror("benchmark worker wait");
+    return 2;
+  }
+  if (WIFEXITED(status)) return WEXITSTATUS(status);
+  if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
+  return 2;
+}
diff --git a/Benchmarks/Compiler/protocol.md b/Benchmarks/Compiler/protocol.md
new file mode 100644
index 000000000..960c96ebe
--- /dev/null
+++ b/Benchmarks/Compiler/protocol.md
@@ -0,0 +1,167 @@
+# Native reversal suite protocol, version 1
+
+The manifest freezes one synthetic runtime-input Compilatrix function and
+handwritten comparison programs. `Benchmarks/Compiler/Data.lean` defines every scalar
+input and its independent expected reversal. Inputs are read after compilation;
+all Compilatrix cases use the same checked reversal and release object pair.
+
+The dataset contains every length 0–64 with six primary patterns and three
+large-integer patterns. Primary values are below `2^30`. Stress values are
+`2^63-1`, `2^63`, and `2^64-1`, each repeated for its list. The arena checker
+also visits every capacity from `n+2` to 66, for 19,305 case/capacity pairs.
+The existing N2 gate supplies the original malformed-input and ABI matrix.
+The Nat-to-Word adapter rejects integers at least `2^64` before conversion;
+its input type excludes negative integers. Dataset padding and trailing bytes
+must be canonical, and JSON observations must match the nonnegative oracle.
+
+The binary format is exactly eight ASCII bytes `CPBN001\n`, an unsigned
+little-endian 64-bit case count, and 585 fixed 544-byte records. A record has
+four little-endian 64-bit words: length, pattern index, domain index, and
+generator seed. Sixty-four payload words follow; words after the list's length
+are zero. Record index is `9*length+pattern`. Patterns 0–5 are primary; patterns
+6–8 have domain indices 1–3 respectively. The file has 318,256 bytes and the
+manifest pins its BLAKE3. JSON diagnostics retain decimal integers exactly.
+
+The timing schedule has eight ASCII bytes `CPBS001\n`, followed by five
+little-endian 64-bit words: row count, samples per row, warm-up nanoseconds,
+chunk operations, and mode (0 smoke, 1 pilot, 2 measurement). Each row contains
+five more words: stable row ID, length, domain, profile, and operation count.
+Row IDs index `timingCases` in the dataset generator. Profiles 0 and 1 mean
+`entry+handoff` and `lifecycle`. The row order may change between paired blocks;
+all implementations receive identical schedule bytes within a block. Pilot and
+smoke records are excluded from the reference analysis.
+
+Both profiles use fresh allocation. For `entry+handoff`, prepare 4,096
+independently owned lists, clear each owning input slot before calling reversal,
+and retain at most 4,096 outputs. Calls and handoff are timed; preparation,
+full result checks, the digest, and release occur between timed chunks. At the
+largest arena size, the list storage occupies 8,978,432 bytes per chunk, plus
+the fixed input/output slots and allocator metadata. Only one list allocation
+is live at a time during lifecycle work. No application arena pool substitutes
+for fresh allocation; the system allocator can recycle its freed storage.
+
+Lifecycle timing includes input list construction, reversal, an order- and
+payload-sensitive result digest, and normal release. Immutable scalar datasets
+are prepared in each language's scalar representation before timing. Sharing
+those scalar values does not share the list spine. Each list digest folds the
+returned payload words using the manifest's 64-bit recurrence, and a sample
+sums its operation digests modulo `2^64`. Full correctness checks every value;
+the timing digest supplements those checks. Operation boundaries remain visible
+in generated code. Diagnostic instrumentation uses separate executions.
+
+Lean uses consuming `List Nat` arguments and explicit RC release, compiled
+through `leanc` with Lake's ordinary release flags (`-O3 -DNDEBUG`) and pinned
+GCC. Its compiled
+diagnostic inspects exclusive input spines and reused cons addresses. CakeML
+uses ordinary nonnegative integer lists, its default optimizing register
+allocator, and its simple copying collector with a 64 MiB heap and an 8 MiB
+stack. Collection-triggering allocations stay inside the timed interval.
+Separate GC diagnostics establish collection cycles, post-collection occupancy,
+and bounded process memory; a terminal forced collection is a distinct result.
+Dropping the final root is not reported as immediate reclamation.
+
+The pilot records timer resolution and a minimal driver control, chooses common
+operation counts, and freezes them before the 30 blocks in three sessions.
+Each implementation starts a fresh process for each block, warms for at least
+one second, and collects three samples for every scheduled row. Each sample
+must accumulate at least 100 ms of timed work, and chunks must dominate clock
+overhead. No outlier rule removes an observation merely for being slow.
+Compilation and network setup finish before measurement. The run records core
+placement, host limitations, executable identities, raw samples, and failures.
+
+A retained C launcher forks each timed worker from a small process image before
+executing it. Linux can preserve the pre-exec high-water RSS of the large Lean
+runner; this extra fork prevents that inherited memory from appearing as the
+worker's peak. Launcher startup is outside the native sample intervals. Current
+RSS still comes directly from the worker's `/proc/self/statm`, and peak RSS from
+its `getrusage(RUSAGE_SELF)` record.
+The reference invocation also pins the controller to a different core from the
+worker and its SMT sibling. Both affinity masks are retained in the environment.
+
+Analysis takes the median within a block, then reports the distribution across
+blocks. Speedup means baseline time divided by Compilatrix time. Bootstrap
+resampling first draws three sessions with replacement, then ten complete
+paired blocks within each selected session. The same 10,000 index vectors
+apply to every implementation and within-block ratio, using seed 2671931027.
+Quantiles interpolate linearly at `(n-1)*p`. Sessions consist of ten consecutive
+blocks; a fixed 60-second idle interval separates them. They share one host and
+one continuous run, so three session clusters give limited evidence about between-day variation.
+There is no suite-wide ranking of
+these lengths as if they were independent application workloads. A shared-host
+run does not establish a dedicated performance-regression baseline.
+
+The pilot targets 200 ms per aggregate sample to provide headroom above the
+100 ms acceptance floor. A block invalidates on drift in boot, CPU identity or
+topology, kernel, affinity/NUMA permissions, governor/turbo policy, clocksource,
+or declared environment variables; a sample below the timer/chunk floors or
+above 2 GiB peak RSS also invalidates its whole block. The runner retains up to
+three complete attempts. Wrong results, schemas, artifacts, or process exits
+stop publication. Slow observations, page faults, context switches, load, and
+instantaneous frequency changes remain in the data. The protocol does not
+reserve the host or SMT sibling.
+
+The separate CakeML diagnostic runs length 64 in all four payload domains,
+five samples each, using frozen operation counts. Every sample must include a
+natural collection, and observed post-collection live data must stay below
+8 MiB in the configured 64 MiB heap. It reports sample-envelope GC events,
+the pinned runtime's GC clock, current RSS, and one terminal collection with
+its own monotonic interval. Compiler wall/CPU/RSS envelopes and actual serialized
+IR/HPT evidence sizes accompany native text and executable/dependency sizes.
+The terminal request reads `Runtime.fullGC` through a runtime array because the
+pinned optimizer folds the directly inlined constant request. The diagnostic
+accepts only an actual additional GC event; `gc-smoke` checks this boundary in CI.
+
+Two unchanged upstream entries, `applyClosed` and `letClosed`, use the same
+sessions and block count for a separate opaque native-call profile. They return
+3 and 4 without runtime arguments; their successors and four direct calls remain
+in the emitted object. Full source/baseline heap observations, complete release,
+supplied-state call certificates, ABI checks, and precise fallback neighbors are
+retained. No runtime-input or general N3 claim follows from these closed rows.
+
+## Commands and replay
+
+Build the runner and producer/checker seeds in the pinned repository environment:
+
+```sh
+lake build compiler-benchmark compiler-source-native-runtime compiler-check-source-native-runtime \
+  compiler-source-native-upstream compiler-check-source-native-upstream
+```
+
+Use fresh directories for each command. The four compiler paths must resolve
+the exact lock in `toolchains.json`; CakeML's `basis_ffi.c` must be beside `cake`.
+The Nix correctness check builds that pinned bootstrap and all six adapters.
+
+```sh
+.lake/build/bin/compiler-benchmark build BUILD --gcc GCC_PATH --clang CLANG_PATH \
+  --compcert CCOMP_PATH --cakeml CAKE_PATH
+.lake/build/bin/compiler-benchmark verify BUILD VERIFY
+.lake/build/bin/compiler-benchmark smoke BUILD SMOKE 2
+.lake/build/bin/compiler-benchmark gc-smoke BUILD GC-SMOKE 2
+.lake/build/bin/compiler-benchmark analysis-self-check
+taskset --cpu-list 0 .lake/build/bin/compiler-benchmark pilot BUILD VERIFY PILOT 2
+taskset --cpu-list 0 .lake/build/bin/compiler-benchmark measure BUILD VERIFY PILOT MEASURED 2
+.lake/build/bin/compiler-benchmark diagnose BUILD PILOT MEASURED/diagnostics 2
+.lake/build/bin/compiler-benchmark analyze BUILD MEASURED MEASURED/analysis
+.lake/build/bin/compiler-benchmark reproduce BUILD MEASURED REPLAY
+```
+
+Replace `2` with an available core before the pilot; later commands must use
+that same core. `smoke` can choose the first permitted core when omitted.
+Network setup, builds, correctness, and any concurrent benchmark jobs finish
+before the pilot/reference measurement. The runner retains partial raw output
+as it arrives. It does not append to an old run or silently resume a partial one.
+
+`reproduce` extracts and validates every source file into a new directory,
+starts processes with an empty environment plus the recorded build variables,
+uses the retained hashed producer/checker/compiler seeds, rebuilds every kernel
+and executable, checks byte equality and complete correctness, and regenerates
+the analysis from the original raw records. A separate Nix check rebuilds the
+project and runs correctness/smoke in its sandbox. Reproduction does not require
+new clock readings to equal old ones or claim a second physical CPU.
+
+The build retains source and tool identities, Nix closure paths, a source
+archive including the dirty tree, commands/logs, actual objects, executables,
+and the runner/checker seeds. The source study retained reference bundles under `benchmarks/runs/`
+with digest-addressed archives; reviewed reports record their exact local
+retrieval path and digest. Copy the entire archive when moving a result to
+another storage service; temporary build directories are not its retention copy.
diff --git a/Benchmarks/Compiler/toolchains.json b/Benchmarks/Compiler/toolchains.json
new file mode 100644
index 000000000..737ea9f9a
--- /dev/null
+++ b/Benchmarks/Compiler/toolchains.json
@@ -0,0 +1,47 @@
+{
+  "format": "compilatrix/benchmark-toolchains/1",
+  "platform": "x86_64-linux",
+  "repository_lock": "../../flake.lock",
+  "scope": "Ix compiler import. Comparison compiler versions and their source Nixpkgs provenance are retained from the original study; the monorepo does not provision these external toolchains.",
+  "nixpkgs": {
+    "revision": "1306659b587dc277866c7b69eb97e5f07864d8c4",
+    "nar_hash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4="
+  },
+  "lean": {
+    "version": "4.33.1",
+    "revision": "819816b2e0a3bf405af45ae5c7af2491d8f5bee6",
+    "toolchain_file": "../../lean-toolchain",
+    "native_c_compiler": "gcc",
+    "c_flags": ["-O3", "-DNDEBUG", "-march=x86-64", "-mtune=generic", "-fno-lto", "-fomit-frame-pointer"],
+    "c_driver": "leanc with the installed Lean ABI flags and LEAN_CC set to pinned GCC"
+  },
+  "cakeml": {
+    "release": "v3479",
+    "revision": "e8eca63affd1653105ca4b9cc2f5ca87a01cd0af",
+    "bootstrap_url": "https://github.com/CakeML/cakeml/releases/download/v3479/cake-x64-64.tar.gz",
+    "bootstrap_sha256": "e110bfcba19d6524ee4748608a67a275647445a048928cf623c2c9a973e31c9a",
+    "hol_revision": "a390cbabd3a4521bab4ee20281e3e42933a8a3ae",
+    "bootstrap_polymL": "5.9",
+    "flags": ["--target=x64", "--reg_alg=2", "--gc=simple"],
+    "diagnostic_extra_flags": ["--emit_empty_ffi=true"],
+    "runtime_environment": {"CML_HEAP_SIZE": "64", "CML_STACK_SIZE": "8"},
+    "heap_units": "MiB",
+    "bootstrap_build": ["make", "cake", "CC=gcc"]
+  },
+  "compcert": {
+    "version": "3.16",
+    "source_revision": "v3.16",
+    "source_url": "https://github.com/AbsInt/CompCert/archive/refs/tags/v3.16.tar.gz",
+    "source_nar_hash": "sha256-Ep8bcSFs3Cu+lV5qgo89JJU2vh4TTq66Or0c4evo3gM=",
+    "nix_attribute": "compcert",
+    "coq_version": "9.0.1",
+    "coq_compatibility_patch": "https://github.com/AbsInt/CompCert/commit/a962ef9da0fb4ef2a4314ccedd111eb248e42cf2.patch",
+    "patch_nix_hash": "sha256-ipYqcfcgz3cKyI1NGSgfOgiVdV1WUwlv6DVB1S1hJvw=",
+    "configuration": ["x86_64-linux", "-clightgen", "-use-external-Flocq", "-use-external-MenhirLib"],
+    "nix_wrapper_flags": ["-U_FORTIFY_SOURCE"],
+    "kernel_flags": ["-O", "-c"]
+  },
+  "gcc": {"version": "14.3.0", "nix_attribute": "gcc", "kernel_flags": ["-O3", "-march=x86-64", "-mtune=generic", "-fno-lto", "-fomit-frame-pointer", "-c"]},
+  "clang": {"version": "21.1.2", "nix_attribute": "clang", "kernel_flags": ["-O3", "-march=x86-64", "-mtune=generic", "-fno-lto", "-fomit-frame-pointer", "-c"]},
+  "arena_driver": {"compiler": "gcc", "flags": ["-O3", "-march=x86-64", "-mtune=generic", "-fno-lto", "-fomit-frame-pointer"], "lto": false, "pgo": false}
+}
diff --git a/Benchmarks/Lean4Lean.lean b/Benchmarks/Lean4Lean.lean
deleted file mode 100644
index f7437b91c..000000000
--- a/Benchmarks/Lean4Lean.lean
+++ /dev/null
@@ -1,541 +0,0 @@
-import Cli
-import Lean4Lean.Environment
-import Ix.Meta
-import Ix.TracingTexray
-import Ix.Benchmark.Results
-import Ix.Cli.ConstsFile
-
-/-!
-# lean4lean typecheck benchmark
-
-Benchmarks the reference Lean4-in-Lean4 kernel —
-[lean4lean](https://github.com/digama0/lean4lean), required by the lakefile
-at a pinned rev — over the same library envs the other kernel backends
-measure (`Benchmarks/Compile/Compile<Lib>.lean`). It is the external
-yardstick for the Ix kernels: `ix check-rs` (Rust, the `ooc` backend) and
-`ix check-lean` (pure-Lean `Ix.Tc`) check the serialized `.ixe` of an env;
-this tool has lean4lean check the same library from its `.olean`s.
-
-```
-lake exe bench-lean4lean <path-to-env.lean> [flags]
-
-  <path>                the env's Lean source, same input `ix compile` takes
-                        (e.g. `Benchmarks/Compile/CompileInitStd.lean`). Its
-                        lake project supplies the module search path; the
-                        module set is the file's transitive import closure.
-  --consts <n1,n2,…>    per-constant mode: replay each named constant's whole
-                        transitive closure into a fresh kernel environment —
-                        one row per name, the lean4lean counterpart of the ooc
-                        backend's full-closure rows. Same flag/shape as
-                        `ix check-rs --consts`.
-  --consts-file <path>  additionally read names from a file (one per line,
-                        `#` comments ignored). Unions with --consts.
-  --json <path>         write benchmark results rows to <path> (the shared
-                        row contract, `Ix.Benchmark.Results`).
-  --json-name <name>    row key for the whole-library row (default: the
-                        file's stem). The orchestrator passes the env name.
-  --no-build            skip the `lake build` of the env module (for callers
-                        that know the oleans are fresh).
-  --verbose             print each declaration as it is added.
-```
-
-Without `--consts` the tool measures the **whole library**: every module in
-the import closure is replayed through lean4lean — each module's new
-constants are re-checked against its imports, one `IO.asTask` per module —
-upstream `lake exe lean4lean`'s default mode, i.e. the canonical "how does
-lean4lean perform on this library" number. Two driver divergences from
-upstream, both required to run at all on this toolchain (the kernel itself
-is untouched): duplicated cross-module realizations are skipped instead of
-spuriously rejected, and only import regions are freed per task — the
-stock binary segfaults freeing a module's own parts (see
-`replayFromImports` for both). The row
-carries `check-time` (wall over the sweep), `constants` (Σ declarations
-added), `throughput` (constants/s), `peak-rss`. Caveats for cross-kernel
-reading: lean4lean trusts `.olean` loading for a module's *imports* (every
-constant is still checked exactly once, in its home module's task), its
-parallelism unit is the module (tune with `LEAN_NUM_THREADS`), the
-constant count is Lean declarations rather than Ixon constants — compare
-end-to-end library numbers, not per-constant arithmetic — and auto-generated
-lemmas that v4.29 multi-part oleans materialize in several modules are
-checked once and skipped as duplicates thereafter (see `replayFromImports`;
-upstream re-declares and spuriously rejects them).
-
-A kernel rejection writes the row as `{"status": "rejected"}` (no metrics —
-a rejection is a correctness signal, not a benchmark datum) and the run
-exits with the reserved code 3; a missing `.olean` is an infrastructure
-error (exit 1) detected before any timed window. Rows are flushed after
-every result, so a killed run keeps the rows measured so far.
-
-The replay machinery (`Context`/`State`/`replayConstant`/`replay`,
-`replayFromImports`) is adapted from lean4lean's own `Main.lean`
-(Apache 2.0, © the lean4lean authors) at the pinned rev — kept in lockstep
-with the require so both sides agree on `Lean4Lean.addDecl`'s surface.
--/
-
-open Lean hiding Environment Exception
-open Kernel
-
-namespace BenchLean4Lean
-
-/-- Like `Expr.getUsedConstants`, but produce a `NameSet`. -/
-def getUsedConstants' (e : Expr) : NameSet :=
-  e.foldConsts {} fun c cs => cs.insert c
-
-/-- Return all names appearing in the type or value of a `ConstantInfo`.
-
-`allowOpaque := true` is load-bearing since v4.33: `ConstantInfo.value?`
-now hides theorem proofs (and opaque bodies) by default, and a replay walk
-that misses proof references skips their auxiliaries — e.g. the
-`._f` structural-recursion helpers (`Nat.add_comm._f`), so the kernel then
-rejects the theorem with "unknown constant". Mirrors the fork's
-`Lean4Lean.Replay` fix. -/
-def getUsedConstants (c : ConstantInfo) : NameSet :=
-  getUsedConstants' c.type ++ match c.value? (allowOpaque := true) with
-  | some v => getUsedConstants' v
-  | none => match c with
-    | .inductInfo val => .ofList val.ctors
-    | .ctorInfo val => ({} : NameSet).insert val.name
-    | .recInfo val => .ofList val.all
-    | _ => {}
-
-structure Context where
-  newConstants : Std.HashMap Name ConstantInfo
-  verbose := false
-  checkQuot := true
-
-structure State where
-  env : Environment
-  remaining : NameSet := {}
-  pending : NameSet := {}
-  postponedConstructors : NameSet := {}
-  postponedRecursors : NameSet := {}
-  numAdded : Nat := 0
-  hasStrings := false
-
-abbrev M := ReaderT Context <| StateRefT State IO
-
-/-- Check if a `Name` still needs processing. If so, move it from `remaining` to `pending`. -/
-def isTodo (name : Name) : M Bool := do
-  let r := (← get).remaining
-  if r.contains name then
-    modify fun s => { s with remaining := s.remaining.erase name, pending := s.pending.insert name }
-    return true
-  else
-    return false
-
-def mapEnvM [Monad m] (ex : Exception) (f : Environment → m Environment) : m Exception := do
-  match ex with
-  | .unknownConstant env c => return .unknownConstant (← f env) c
-  | .alreadyDeclared env c => return .alreadyDeclared (← f env) c
-  | .declTypeMismatch env d t => return .declTypeMismatch env d t
-  | .declHasMVars env c e => return .declHasMVars (← f env) c e
-  | .declHasFVars env c e => return .declHasFVars (← f env) c e
-  | .funExpected env lctx e => return .funExpected (← f env) lctx e
-  | .typeExpected env lctx e => return .typeExpected (← f env) lctx e
-  | .letTypeMismatch env lctx n t1 t2 => return .letTypeMismatch (← f env) lctx n t1 t2
-  | .exprTypeMismatch env lctx e t => return .exprTypeMismatch (← f env) lctx e t
-  | .appTypeMismatch env lctx e fn arg => return .appTypeMismatch (← f env) lctx e fn arg
-  | .invalidProj env lctx e => return .invalidProj (← f env) lctx e
-  | .thmTypeIsNotProp env c t => return .thmTypeIsNotProp (← f env) c t
-  | .other _
-  | .deterministicTimeout
-  | .excessiveMemory
-  | .deepRecursion
-  | .interrupted => return ex
-
-/-- Use the current `Environment` to throw a `Kernel.Exception`. -/
-def throwKernelException (ex : Exception) : M α := do
-  let options := pp.match.set (pp.rawOnError.set {} true) false
-  -- The replayed environment has no extension state, so it cannot back the
-  -- pretty printer; a fresh empty environment is good enough for basic
-  -- printing of the offending declaration.
-  let env ← mkEmptyEnvironment
-  let ex ← mapEnvM ex fun _ => return env.toKernelEnv
-  Prod.fst <$> (Lean.Core.CoreM.toIO · { fileName := "", options, fileMap := default } { env }) do
-    Lean.throwKernelException ex
-
-def declName : Declaration → String
-  | .axiomDecl d => s!"axiomDecl {d.name}"
-  | .defnDecl d => s!"defnDecl {d.name}"
-  | .thmDecl d => s!"thmDecl {d.name}"
-  | .opaqueDecl d => s!"opaqueDecl {d.name}"
-  | .quotDecl => s!"quotDecl"
-  | .mutualDefnDecl d => s!"mutualDefnDecl {d.map (·.name)}"
-  | .inductDecl _ _ d _ => s!"inductDecl {d.map (·.name)}"
-
-/-- Add a declaration through the lean4lean kernel, possibly throwing a
-    `KernelException`. -/
-def addDecl (d : Declaration) : M Unit := do
-  if (← read).verbose then
-    println! "adding {declName d}"
-  let t1 ← IO.monoMsNow
-  match Lean4Lean.addDecl (← get).env d true with
-  | .ok env =>
-    let t2 ← IO.monoMsNow
-    if t2 - t1 > 1000 then
-      println! "{declName d}: lean4lean took {t2 - t1}ms"
-    modify fun s => { s with env, numAdded := s.numAdded + 1 }
-  | .error ex =>
-    throwKernelException ex
-
-def hasStrLit (e : Expr) : Bool := (e.find? (·.isStringLit)).isSome
-
-def constHasStrLit (ci : ConstantInfo) : Bool :=
-  -- `allowOpaque := true` for the same reason as `getUsedConstants`: a string
-  -- literal inside a theorem proof must still pre-seed `String.ofList`.
-  hasStrLit ci.type || (ci.value? (allowOpaque := true)).any hasStrLit
-
-mutual
-/--
-Check if a `Name` still needs to be processed (i.e. is in `remaining`).
-
-If so, recursively replay any constants it refers to,
-to ensure we add declarations in the right order.
-
-Then construct the `Declaration` from its stored `ConstantInfo`,
-and add it to the environment.
--/
-partial def replayConstant (name : Name) : M Unit := do
-  if ← isTodo name then
-    let some ci := (← read).newConstants[name]? | unreachable!
-    let mut usedConstants := getUsedConstants ci
-    -- We want `String.ofList` to be available when encountering string literals.
-    unless (← get).hasStrings do
-      if constHasStrLit ci then
-        usedConstants := usedConstants.insert ``String.ofList
-        usedConstants := usedConstants.insert ``Char.ofNat
-        modify ({· with hasStrings := true })
-    replayConstants usedConstants
-    -- Check that this name is still pending: a mutual block may have taken care of it.
-    if (← get).pending.contains name then
-      let addDeclAt (d : Declaration) :=
-        try addDecl d catch e => throw <| IO.userError s!"at {name}: {e.toString}"
-      match ci with
-      | .defnInfo   info => addDeclAt (.defnDecl   info)
-      | .thmInfo    info => addDeclAt (.thmDecl    info)
-      | .axiomInfo  info => addDeclAt (.axiomDecl  info)
-      | .opaqueInfo info => addDeclAt (.opaqueDecl info)
-      | .inductInfo info =>
-        let lparams := info.levelParams
-        let nparams := info.numParams
-        let all ← info.all.mapM fun n => do pure <| (← read).newConstants[n]!
-        for o in all do
-          modify fun s =>
-            { s with remaining := s.remaining.erase o.name, pending := s.pending.erase o.name }
-        let ctorInfo ← all.mapM fun ci => do
-          pure (ci, ← ci.inductiveVal!.ctors.mapM fun n => do
-            pure (← read).newConstants[n]!)
-        -- Make sure we are really finished with the constructors.
-        for (_, ctors) in ctorInfo do
-          for ctor in ctors do
-            replayConstants (getUsedConstants ctor)
-        let types : List InductiveType := ctorInfo.map fun ⟨ci, ctors⟩ =>
-          { name := ci.name
-            type := ci.type
-            ctors := ctors.map fun ci => { name := ci.name, type := ci.type } }
-        addDeclAt (.inductDecl lparams nparams types false)
-      -- We postpone checking constructors,
-      -- and at the end make sure they are identical
-      -- to the constructors generated when we replay the inductives.
-      | .ctorInfo info =>
-        modify fun s => { s with postponedConstructors := s.postponedConstructors.insert info.name }
-      -- Similarly we postpone checking recursors.
-      | .recInfo info =>
-        modify fun s => { s with postponedRecursors := s.postponedRecursors.insert info.name }
-      | .quotInfo _ => addDeclAt .quotDecl
-      modify fun s => { s with pending := s.pending.erase name }
-
-/-- Replay a set of constants one at a time. -/
-partial def replayConstants (names : NameSet) : M Unit := do
-  for n in names do replayConstant n
-
-end
-
-end BenchLean4Lean
-
-deriving instance BEq for ConstantVal
-deriving instance BEq for ConstructorVal
-deriving instance BEq for RecursorRule
-deriving instance BEq for RecursorVal
-
-namespace BenchLean4Lean
-
-/--
-Check that all postponed constructors are identical to those generated
-when we replayed the inductives.
--/
-def checkPostponedConstructors : M Unit := do
-  for ctor in (← get).postponedConstructors do
-    match (← get).env.constants.find? ctor, (← read).newConstants[ctor]? with
-    | some (.ctorInfo info), some (.ctorInfo info') =>
-      unless info == info' do throw <| IO.userError s!"Invalid constructor {ctor}"
-    | _, _ => throw <| IO.userError s!"No such constructor {ctor}"
-
-/--
-Check that all postponed recursors are identical to those generated
-when we replayed the inductives.
--/
-def checkPostponedRecursors : M Unit := do
-  for ctor in (← get).postponedRecursors do
-    match (← get).env.constants.find? ctor, (← read).newConstants[ctor]? with
-    | some (.recInfo info), some (.recInfo info') =>
-      unless info == info' do throw <| IO.userError s!"Invalid recursor {ctor}"
-    | _, _ => throw <| IO.userError s!"No such recursor {ctor}"
-
-/-- Check that at the end of (any) file, the quotient module is initialized.
-(It will already be initialized at the beginning, unless this is the very
-first file, which is responsible for initializing it.) -/
-def checkQuotInit : M Unit := do
-  unless (← get).env.quotInit do
-    throw <| IO.userError s!"initial import (Init.Prelude) didn't initialize quotient module"
-
-/-- "Replay" some constants into an `Environment`, sending them to the
-    lean4lean kernel for checking. Returns the number of declarations added
-    and the final environment. -/
-def replay (ctx : Context) (env : Environment) (decl : Option Name := none) :
-    IO (Nat × Environment) := do
-  let mut remaining : NameSet := ∅
-  for (n, ci) in ctx.newConstants.toList do
-    -- We skip unsafe constants, and also partial constants.
-    if !ci.isUnsafe && !ci.isPartial then
-      remaining := remaining.insert n
-  let (_, s) ← StateRefT'.run (s := { env, remaining }) do
-    ReaderT.run (r := ctx) do
-      match decl with
-      | some d => replayConstant d
-      | none =>
-        for n in remaining do
-          replayConstant n
-      checkPostponedConstructors
-      checkPostponedRecursors
-      if (← read).checkQuot then checkQuotInit
-  return (s.numAdded, s.env)
-
-/-- Read a module's olean parts (base + server + private when present),
-    most complete last — the shape `readModuleDataParts` and the
-    toolchain's own `LeanChecker` frontend use. Shared by the closure
-    scanner and the replay tasks so both see the same (private-level)
-    import set. Throws when the base olean is missing. -/
-def readModuleParts (module : Name) : IO (Array (ModuleData × CompactedRegion)) := do
-  let mFile ← findOLean module
-  unless (← mFile.pathExists) do
-    throw <| IO.userError s!"object file '{mFile}' of module {module} does not exist"
-  let mut fnames := #[mFile]
-  let sFile := OLeanLevel.server.adjustFileName mFile
-  if (← sFile.pathExists) then
-    fnames := fnames.push sFile
-    let pFile := OLeanLevel.private.adjustFileName mFile
-    if (← pFile.pathExists) then
-      fnames := fnames.push pFile
-  readModuleDataParts fnames
-
-open private ImportedModule.mk from Lean.Environment in
-/-- Replay one module's new constants against its (trusted-loaded) imports —
-    upstream `lake exe lean4lean`'s per-module unit of work. -/
-unsafe def replayFromImports (module : Name) (verbose := false) : IO Nat := do
-  let parts ← readModuleParts module
-  let some (mod, _) := parts[parts.size - 1]? | unreachable! -- load private module data
-  let (_, s) ← (importModulesCore mod.imports).run
-  let env ← match Kernel.Environment.finalizeImport s mod.imports module 0 with
-    | .ok env => pure env
-    | .error e => throw <| .userError <| ← (e.toMessageData {}).toString
-  let mut newConstants := {}
-  for name in mod.constNames, ci in mod.constants do
-    -- v4.29 multi-part oleans can materialize the same auto-generated
-    -- lemma (`*.eq_1`, `*.congr_simp`, …) in several modules' parts; a
-    -- real import dedups those realizations in `finalizeImport`, so the
-    -- replay must skip names the imported env already provides instead of
-    -- re-declaring them (upstream replays them and spuriously rejects,
-    -- e.g. on v4.29 Std).
-    if (env.constants.find? name).isNone then
-      newConstants := newConstants.insert name ci
-  let (n, env') ← replay { newConstants, verbose } env
-  -- Free the task's IMPORT regions only (the memory that scales with the
-  -- sweep: every task maps its whole import closure). Upstream also frees
-  -- the module's own `parts` regions, which segfaults — reproducibly, in
-  -- the stock `lean4lean` binary too on this toolchain (decref of
-  -- persistent region objects after munmap at scope exit) — so the small
-  -- per-module parts stay mapped: one copy of the library across the
-  -- sweep, not one closure per task.
-  (Environment.ofKernelEnv env').freeRegions
-  pure n
-
-/-- Replay every module of the library through lean4lean, one `IO.asTask`
-    per module (parallelism follows the task pool, i.e. `LEAN_NUM_THREADS`).
-    Callers pre-flight olean existence via `moduleClosure`, so a task
-    failure here is a kernel rejection, not infrastructure. Returns the
-    total declarations added plus per-module failures. -/
-unsafe def replayLibrary (modules : Array Name) (verbose : Bool) :
-    IO (Nat × Array (Name × String)) := do
-  let mut tasks := #[]
-  for m in modules do
-    tasks := tasks.push (m, ← IO.asTask (replayFromImports m verbose))
-  let mut added := 0
-  let mut failures : Array (Name × String) := #[]
-  for (m, t) in tasks do
-    match t.get with
-    | .error e => failures := failures.push (m, toString e)
-    | .ok n => added := added + n
-  return (added, failures)
-
-/-- Transitive module closure of `roots`, discovered by scanning olean
-    headers (private-level parts, so `private import`s are covered). No
-    environment is imported here: the whole-library sweep's tasks free
-    their compacted regions when done — upstream's memory bound — which is
-    only sound while nothing else in the process shares mapped regions.
-    The scanner's own header regions stay mapped (the returned `Name`s
-    live inside them): one copy of the library's headers, not one per
-    task. A missing olean throws here, before any timed window. -/
-def moduleClosure (roots : Array Name) : IO (Array Name) := do
-  let mut seen : NameSet := {}
-  let mut order : Array Name := #[]
-  let mut stack : List Name := roots.toList
-  repeat
-    match stack with
-    | [] => break
-    | m :: rest =>
-      stack := rest
-      if seen.contains m then
-        continue
-      seen := seen.insert m
-      order := order.push m
-      let parts ← readModuleParts m
-      let some (mod, _) := parts[parts.size - 1]? | unreachable!
-      for imp in mod.imports do
-        unless seen.contains imp.module do
-          stack := imp.module :: stack
-  return order
-
-/-- Replay `target`'s whole transitive closure into a fresh kernel
-    environment — the full-closure check semantics of the ooc backend's
-    per-constant rows. Returns the closure size (declarations added). -/
-def replayClosure (env : Lean.Environment) (newConstants : Std.HashMap Name ConstantInfo)
-    (target : Name) (verbose : Bool) : IO Nat := do
-  let _ := env
-  (·.1) <$> replay { newConstants, verbose, checkQuot := false } (.empty default) (some target)
-
-/-- Resolve a raw `--consts` string against the env: `toName` first, then a
-    displayed-form scan (numeric/private components don't round-trip through
-    `toName`) — the same fallback the other tools' resolvers use. -/
-def resolveName (env : Lean.Environment) (raw : String) : Option Name :=
-  let n := raw.toName
-  if env.constants.contains n then some n
-  else env.constants.fold (init := none) fun acc cn _ =>
-    acc <|> if toString cn == raw then some cn else none
-
-open Ix.Benchmark.Results in
-unsafe def runBenchCmd (p : Cli.Parsed) : IO UInt32 := do
-  let some pathArg := p.positionalArg? "path"
-    | p.printError "error: must specify <path> to the env's Lean source (e.g. Benchmarks/Compile/CompileInitStd.lean)"
-      return exitUsage
-  let path := pathArg.as! String
-  let jsonOut : Option String := (p.flag? "json").map (·.as! String)
-  let jsonName := ((p.flag? "json-name").map (·.as! String)).getD
-    ((System.FilePath.mk path).fileStem.getD path)
-  let verbose := p.hasFlag "verbose"
-  let rawNames ← Ix.Cli.ConstsFile.gather p
-
-  -- Build the env module first (outside every timed window). The file's
-  -- lake project supplies the module search path — the same entry
-  -- `ix compile` uses, so both backends accept the same registry
-  -- `module` path.
-  unless p.hasFlag "no-build" do buildFile path
-
-  if rawNames.isEmpty then
-    -- Whole-library mode. The import closure is enumerated by scanning
-    -- olean headers — deliberately WITHOUT importing an environment into
-    -- this process: the replay tasks free their compacted regions when
-    -- done (upstream's memory bound, ~steady-state instead of the whole
-    -- library's fixed-up regions accumulating), and those frees are only
-    -- sound while no co-resident env shares mapped regions.
-    initLeanSearchPath (← IO.FS.realPath path).parent
-    let header ← Lean.parseImports' (← IO.FS.readFile path) path
-    let modules ← moduleClosure (header.imports.map (·.module))
-    IO.println s!"Loaded {path}: {modules.size} modules in the import closure"
-    TracingTexray.startSampler
-    -- Whole-library row: module-parallel replay of the import closure.
-    IO.println s!"replaying {modules.size} modules through lean4lean …"
-    (← IO.getStdout).flush
-    TracingTexray.resetPeakTreeRss
-    let t0 ← IO.monoNanosNow
-    let (added, failures) ← replayLibrary modules verbose
-    let t1 ← IO.monoNanosNow
-    let secs := (t1 - t0).toFloat / 1e9
-    let peak ← TracingTexray.peakTreeRssBytes
-    if failures.isEmpty then
-      if let some out := jsonOut then
-        writeRow out jsonName "ok"
-          [ ("check-time", jsonRound 6 secs)
-          , ("constants", Lean.toJson added)
-          , ("throughput", jsonRound 2 (if secs > 0 then added.toFloat / secs else 0))
-          , ("peak-rss", Lean.toJson peak) ]
-      IO.println s!"{jsonName}: checked {added} declarations in {secs}s \
-        ({(added.toFloat / secs).toUInt64} consts/s)"
-      return 0
-    else
-      for (m, e) in failures do
-        IO.eprintln s!"❌ lean4lean REJECTED module {m}: {e}"
-      if let some out := jsonOut then
-        writeRow out jsonName "rejected" []
-      return exitRejected
-  else
-    -- Per-constant mode: the elaborated file env supplies the constants
-    -- map (`getFileEnv`, the same entry `ix compile` uses — it also sets
-    -- the search path). Closure replays never free regions, so the
-    -- co-resident env is fine here. Each row is the name's whole
-    -- transitive closure into a fresh kernel env.
-    let env ← getFileEnv path
-    TracingTexray.startSampler
-    let newConstants := env.constants.fold
-      (init := ({} : Std.HashMap Name ConstantInfo)) fun m n ci => m.insert n ci
-    let mut anyRejected := false
-    let mut idx := 0
-    for raw in rawNames do
-      idx := idx + 1
-      match resolveName env raw with
-      | none => IO.eprintln s!"warning: {raw} not found in the env; skipping"
-      | some target =>
-        -- Announce BEFORE the replay (flushed): a kill mid-replay must
-        -- leave the in-flight constant's name in the log.
-        IO.println s!"  [{idx}/{rawNames.size}] replaying closure of {raw} …"
-        (← IO.getStdout).flush
-        TracingTexray.resetPeakTreeRss
-        let t0 ← IO.monoNanosNow
-        let res ← (replayClosure env newConstants target verbose).toBaseIO
-        let t1 ← IO.monoNanosNow
-        let secs := (t1 - t0).toFloat / 1e9
-        let peak ← TracingTexray.peakTreeRssBytes
-        match res with
-        | .ok added =>
-          if let some out := jsonOut then
-            writeRow out raw "ok"
-              [ ("check-time", jsonRound 6 secs)
-              , ("constants", Lean.toJson added)
-              , ("throughput", jsonRound 2 (if secs > 0 then added.toFloat / secs else 0))
-              , ("peak-rss", Lean.toJson peak) ]
-          IO.println s!"  {raw}: constants={added} check={secs}s"
-        | .error e =>
-          IO.eprintln s!"  ❌ {raw} FAILED TO TYPECHECK: {e}"
-          if let some out := jsonOut then
-            writeRow out raw "rejected" []
-          anyRejected := true
-    return if anyRejected then exitRejected else 0
-
-end BenchLean4Lean
-
-unsafe def benchLean4LeanCmd : Cli.Cmd := `[Cli|
-  "bench-lean4lean" VIA BenchLean4Lean.runBenchCmd;
-  "Benchmark the lean4lean reference kernel over a library env (whole-library module replay, or per-constant closures with --consts)"
-
-  FLAGS:
-    consts        : String; "Per-constant mode: comma-separated fully-qualified names, each replayed as its whole transitive closure into a fresh kernel env (the ooc backend's full-closure row shape). Same flag/shape as `ix check-rs --consts`."
-    "consts-file" : String; "Additionally read constant names from a file (one per line; `#` comments and blank lines ignored). Unions with --consts."
-    json          : String; "Write benchmark results rows to this path (shared row contract). Off by default."
-    "json-name"   : String; "Row key for the whole-library row (default: the file stem; the orchestrator passes the registry env name)."
-    "no-build";             "Skip the `lake build` of the env module (callers that know the oleans are fresh)."
-    verbose;                "Print each declaration as it is added."
-
-  ARGS:
-    path : String; "Path to the env's Lean source, e.g. Benchmarks/Compile/CompileInitStd.lean (same input as `ix compile`)"
-]
-
diff --git a/Benchmarks/Lean4LeanMain.lean b/Benchmarks/Lean4LeanMain.lean
deleted file mode 100644
index dbfb3d5b0..000000000
--- a/Benchmarks/Lean4LeanMain.lean
+++ /dev/null
@@ -1,11 +0,0 @@
-import Benchmarks.Lean4Lean
-
-/-!
-Exe root for `bench-lean4lean`. `main` lives here, in a module nothing
-imports, so the machinery in `Benchmarks.Lean4Lean` stays importable
-(the `lean4lean` ignored test runner uses it) without a root-level `main`
-collision.
--/
-
-unsafe def main (args : List String) : IO UInt32 :=
-  benchLean4LeanCmd.validate args
diff --git a/Benchmarks/TruthMines/Drivers/Lean4Lean.lean b/Benchmarks/TruthMines/Drivers/Lean4Lean.lean
deleted file mode 100644
index a866ccf8a..000000000
--- a/Benchmarks/TruthMines/Drivers/Lean4Lean.lean
+++ /dev/null
@@ -1,2 +0,0 @@
-/- GENERATED by `lake exe truthmines gen` from `Benchmarks.TruthMinesSpec`; do not edit. -/
-import Lean4Lean
diff --git a/Benchmarks/TruthMines/lake-manifest.json b/Benchmarks/TruthMines/lake-manifest.json
index 6f81f4e9f..e49130584 100644
--- a/Benchmarks/TruthMines/lake-manifest.json
+++ b/Benchmarks/TruthMines/lake-manifest.json
@@ -358,16 +358,6 @@
    "inputRev": "453f4feb6508ec787fc325a70523d38e4378ef8f",
    "inherited": false,
    "configFile": "lakefile.lean"},
-  {"url": "https://github.com/digama0/lean4lean",
-   "type": "git",
-   "subDir": null,
-   "scope": "",
-   "rev": "e0e3f6bcccb840cb0ea6f11c2b274ada93a12e00",
-   "name": "lean4lean",
-   "manifestFile": "lake-manifest.json",
-   "inputRev": "e0e3f6bcccb840cb0ea6f11c2b274ada93a12e00",
-   "inherited": false,
-   "configFile": "lakefile.toml"},
   {"url": "https://github.com/leanprover-community/import-graph",
    "type": "git",
    "subDir": null,
diff --git a/Benchmarks/TruthMines/lakefile.lean b/Benchmarks/TruthMines/lakefile.lean
index b5aa0ca1a..7916e9b75 100644
--- a/Benchmarks/TruthMines/lakefile.lean
+++ b/Benchmarks/TruthMines/lakefile.lean
@@ -49,7 +49,6 @@ require «Parser» from git "https://github.com/fgdorais/lean4-parser" @ "e2c243
 require «aesop» from git "https://github.com/leanprover-community/aesop" @ "3448c0bcc5ce01b2d1546e483ec3620e32df3d0e"
 require «i18n» from git "https://github.com/hhu-adam/lean-i18n" @ "1a99b00a940624c0a6c3009b756fb922acf0fe78"
 require «importGraph» from git "https://github.com/leanprover-community/import-graph" @ "16f02aa7642864af59f1ff0e384a015994db9118"
-require «lean4lean» from git "https://github.com/digama0/lean4lean" @ "e0e3f6bcccb840cb0ea6f11c2b274ada93a12e00"
 require «lean_eff» from git "https://github.com/palladin/lean-eff" @ "453f4feb6508ec787fc325a70523d38e4378ef8f"
 require «lean_reducers» from git "https://github.com/palladin/lean-reducers" @ "6e93e0ce326025f762d00b947716c2b98ce1fb06"
 require «protobuf» from git "https://github.com/Lean-zh/protobuf" @ "8c707f2cb4ab8eae280127651162d28e58164c1e"
@@ -141,7 +140,6 @@ def catalogRootModules : Array Lean.Name := #[
     `Aesop,
     `I18n,
     `ImportGraph,
-    `Lean4Lean,
     `LeanEff,
     `LeanReducers,
     `Protobuf,
diff --git a/Benchmarks/TruthMinesSpec/Catalog.lean b/Benchmarks/TruthMinesSpec/Catalog.lean
index 7d0b12c0f..2aa8b8938 100644
--- a/Benchmarks/TruthMinesSpec/Catalog.lean
+++ b/Benchmarks/TruthMinesSpec/Catalog.lean
@@ -326,11 +326,6 @@ member of the mini infrastructure tier."),
     "079463134b9c50450b8393e1566a09fc492a34d9"
     #[] "NONE" "2026-07-20"
     #[`Sail] (notes := "UNLICENSED. REMS' Sail-to-Lean runtime library, the substrate for Sail-generated ISA models. Zero deps."),
-  gitPackage "lean4lean" `Lean4Lean
-    "https://github.com/digama0/lean4lean"
-    "e0e3f6bcccb840cb0ea6f11c2b274ada93a12e00"
-    #["batteries"] "Apache-2.0" "2026-08-14"
-    #[`Lean4Lean] (notes := "The Lean 4 kernel reimplemented and verified in Lean 4. Clean pure-Lean build, batteries only. Library target is Lean4Lean, not the capitalisation Lake would guess from the package name."),
   gitPackage "phi-confluence" `PhiConfluence
     "https://github.com/objectionary/proof"
     "58aa7731076d02bf51b2dfbcdc06c4f764101fb4"
diff --git a/Benchmarks/TruthMinesSpec/Spec.lean b/Benchmarks/TruthMinesSpec/Spec.lean
index 18257b5d8..743df87b2 100644
--- a/Benchmarks/TruthMinesSpec/Spec.lean
+++ b/Benchmarks/TruthMinesSpec/Spec.lean
@@ -102,8 +102,6 @@ def catalogSpec : CatalogSpecProjection := {
     roots := #[`I18n] },
   { qualifier := `ImportGraph
     roots := #[`ImportGraph] },
-  { qualifier := `Lean4Lean
-    roots := #[`Lean4Lean] },
   { qualifier := `LeanEff
     roots := #[`LeanEff] },
   { qualifier := `LeanReducers
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 120000
index 000000000..47dc3e3d8
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+AGENTS.md
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index c8c03e78f..447526296 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -50,11 +50,20 @@ dependencies = [
 name = "aiur"
 version = "0.1.0"
 dependencies = [
+ "blake3",
  "hashbrown 0.15.5",
  "indexmap",
  "libc",
  "multi-stark",
  "num-bigint 0.4.6",
+ "p3-blake3",
+ "p3-challenger",
+ "p3-commit",
+ "p3-fri",
+ "p3-merkle-tree",
+ "p3-stir",
+ "p3-symmetric",
+ "p3-util",
  "rayon",
  "rustc-hash",
  "tracing",
@@ -2762,6 +2771,27 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "p3-stir"
+version = "0.6.0"
+source = "git+https://github.com/Plonky3/Plonky3?rev=3152b14a89067c83775a8076cc262ffc48a1fd7c#3152b14a89067c83775a8076cc262ffc48a1fd7c"
+dependencies = [
+ "itertools 0.15.0",
+ "libm",
+ "p3-challenger",
+ "p3-commit",
+ "p3-dft",
+ "p3-field",
+ "p3-matrix",
+ "p3-maybe-rayon",
+ "p3-security",
+ "p3-util",
+ "serde",
+ "spin 0.12.3",
+ "thiserror",
+ "tracing",
+]
+
 [[package]]
 name = "p3-symmetric"
 version = "0.6.0"
diff --git a/Ix.lean b/Ix.lean
index 9ad43890d..8f0c35502 100644
--- a/Ix.lean
+++ b/Ix.lean
@@ -17,7 +17,7 @@ public import Ix.Catalog
 public import Ix.ImportIxe
 public import Ix.IxEval
 public import Ix.KernelCheck
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.Claim
 public import Ix.Merkle
 public import Ix.AssumptionTree
diff --git a/Ix/Address.lean b/Ix/Address.lean
index a3a75bf25..a3196baaa 100644
--- a/Ix/Address.lean
+++ b/Ix/Address.lean
@@ -45,7 +45,12 @@ instance : Hashable Address where
     ||| ((h.get! 7).toUInt64 <<< 56)
 
 /-- Compute the Blake3 hash of a `ByteArray`, returning an `Address`. -/
-def Address.blake3 (x: ByteArray) : Address := ⟨(Blake3.Rust.hash x).val⟩
+def Address.blake3 (x: ByteArray) : Address :=
+  let hasher := Blake3.Rust.hasherUpdate (Blake3.Rust.hasherInit ()) x
+  -- Supply a kernel-checked size bound: the upstream `hash` helper fills
+  -- this argument using native evaluation, adding an unnecessary axiom.
+  ⟨(Blake3.HasherOps.finalizeWithLength hasher 32 (by
+    rcases System.Platform.numBits_eq with bits | bits <;> rw [bits] <;> decide)).val⟩
 
 /-- Convert a nibble (0--15) to its lowercase hexadecimal character. -/
 def hexOfNat : Nat -> Option Char
diff --git a/Ix/Aiur/Blake3.lean b/Ix/Aiur/Blake3.lean
new file mode 100644
index 000000000..ec56f77d5
--- /dev/null
+++ b/Ix/Aiur/Blake3.lean
@@ -0,0 +1,155 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Transcript
+
+/-! Total, unkeyed, 32-byte BLAKE3 for the native transcript and PCS.
+Words and compression blocks have checked dimensions. The canonical tree
+splits at the largest power of two strictly below the input byte length.
+The native input bound is separate from the total mathematical function.
+-/
+
+namespace Aiur.NativeAIR.Blake3
+
+abbrev CV := Vector UInt32 8
+abbrev Block := Vector UInt32 16
+abbrev Digest := Vector UInt8 32
+
+def iv : CV := #v[
+  0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
+  0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19]
+
+def schedules : Vector (Vector (Fin 16) 16) 7 := #v[
+  #v[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15],
+  #v[2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8],
+  #v[3, 4, 10, 12, 13, 2, 7, 14, 6, 5, 9, 0, 11, 15, 8, 1],
+  #v[10, 7, 12, 9, 14, 3, 13, 15, 4, 0, 11, 2, 5, 8, 1, 6],
+  #v[12, 13, 9, 11, 15, 10, 14, 8, 7, 2, 5, 3, 0, 1, 6, 4],
+  #v[9, 14, 11, 5, 8, 12, 15, 1, 13, 3, 0, 10, 2, 6, 4, 7],
+  #v[11, 15, 5, 0, 1, 9, 8, 6, 14, 10, 2, 12, 3, 4, 7, 13]]
+
+def rotateRight (word count : UInt32) : UInt32 :=
+  (word >>> count) ||| (word <<< (32 - count))
+
+def mix (a b c d x y : UInt32) : Vector UInt32 4 :=
+  let a := a + b + x
+  let d := rotateRight (d ^^^ a) 16
+  let c := c + d
+  let b := rotateRight (b ^^^ c) 12
+  let a := a + b + y
+  let d := rotateRight (d ^^^ a) 8
+  let c := c + d
+  let b := rotateRight (b ^^^ c) 7
+  #v[a, b, c, d]
+
+def g (state : Block) (a b c d : Fin 16) (x y : UInt32) : Block :=
+  let words := mix state[a] state[b] state[c] state[d] x y
+  (((state.set a words[0]).set b words[1]).set c words[2]).set d words[3]
+
+def round (state message : Block) (schedule : Vector (Fin 16) 16) : Block :=
+  let state := g state 0 4 8 12 message[schedule[0]] message[schedule[1]]
+  let state := g state 1 5 9 13 message[schedule[2]] message[schedule[3]]
+  let state := g state 2 6 10 14 message[schedule[4]] message[schedule[5]]
+  let state := g state 3 7 11 15 message[schedule[6]] message[schedule[7]]
+  let state := g state 0 5 10 15 message[schedule[8]] message[schedule[9]]
+  let state := g state 1 6 11 12 message[schedule[10]] message[schedule[11]]
+  let state := g state 2 7 8 13 message[schedule[12]] message[schedule[13]]
+  g state 3 4 9 14 message[schedule[14]] message[schedule[15]]
+
+def initialWords (cv : CV) (counter : UInt64) (blockLen flags : UInt32) : Block :=
+  #v[cv[0], cv[1], cv[2], cv[3], cv[4], cv[5], cv[6], cv[7],
+    iv[0], iv[1], iv[2], iv[3], counter.toUInt32, (counter >>> 32).toUInt32, blockLen, flags]
+
+def compress (cv : CV) (message : Block) (counter : UInt64) (blockLen flags : UInt32) : CV :=
+  let state := schedules.foldl (fun state schedule => round state message schedule)
+    (initialWords cv counter blockLen flags)
+  Vector.ofFn fun index => state[index.val] ^^^ state[index.val + 8]
+
+def wordBytes (word : UInt32) : Vector UInt8 4 :=
+  Vector.ofFn fun index => (word.toNat / 256^index.val).toUInt8
+
+def bytesWord (bytes : Vector UInt8 4) : UInt32 :=
+  UInt32.ofNat (Challenger.littleEndian bytes.toList)
+
+/-- Zero padding is part of block framing, including the empty input block. -/
+def blockWords (bytes : List UInt8) : Block :=
+  let input := bytes.toArray
+  Vector.ofFn fun word => bytesWord (Vector.ofFn fun byte => input[word.val * 4 + byte.val]?.getD 0)
+
+def cvBytes (cv : CV) : Digest :=
+  Vector.ofFn fun index => (wordBytes cv[index.val / 4])[index.val % 4]
+
+structure Output where
+  cv : CV
+  block : Block
+  blockLen : UInt32
+  counter : UInt64
+  flags : UInt32
+  deriving DecidableEq, Repr
+
+def Output.chainingValue (output : Output) : CV :=
+  compress output.cv output.block output.counter output.blockLen output.flags
+
+def Output.rootHash (output : Output) : Digest :=
+  cvBytes (compress output.cv output.block 0 output.blockLen (output.flags ||| 8))
+
+/-- A full last block receives CHUNK_END; it is never followed by an empty block. -/
+def chunkLoop (counter : UInt64) (cv : CV) (start : Bool) (input : List UInt8) : Output :=
+  if h : input.length ≤ 64 then
+    ⟨cv, blockWords input, input.length.toUInt32, counter, (if start then 1 else 0) ||| 2⟩
+  else
+    let next := compress cv (blockWords (input.take 64)) counter 64 (if start then 1 else 0)
+    chunkLoop counter next false (input.drop 64)
+termination_by input.length
+decreasing_by simp only [List.length_drop]; omega
+
+def chunkOutput (counter : UInt64) (input : List UInt8) : Output :=
+  chunkLoop counter iv true input
+
+/-- This internal BLAKE3 parent is distinct from hashing a PCS Merkle pair. -/
+def parentOutput (left right : CV) : Output :=
+  ⟨iv, left ++ right, 64, 0, 4⟩
+
+def leftLen (size : Nat) : Nat := 2 ^ (size - 1).log2
+
+theorem leftLen_positive (size : Nat) : 0 < leftLen size := Nat.two_pow_pos _
+
+theorem leftLen_lt {size : Nat} (large : 1024 < size) : leftLen size < size := by
+  have := Nat.log2_self_le (n := size - 1) (by omega)
+  unfold leftLen
+  omega
+
+def subtree (counter : Nat) (input : List UInt8) : Output :=
+  if _h : input.length ≤ 1024 then chunkOutput counter.toUInt64 input
+  else
+    let split := leftLen input.length
+    let left := subtree counter (input.take split)
+    let right := subtree (counter + split / 1024) (input.drop split)
+    parentOutput left.chainingValue right.chainingValue
+termination_by input.length
+decreasing_by
+  · have := leftLen_lt (size := input.length) (by omega)
+    simp only [List.length_take]; omega
+  · have := leftLen_positive input.length
+    simp only [List.length_drop]; omega
+
+def digest (input : List UInt8) : Digest := (subtree 0 input).rootHash
+
+def hash : Challenger.Hash32 :=
+  fun input =>
+    let bytes := digest input
+    fun index => bytes[index]
+
+/-- Native BLAKE3 supports at most 2^64 - 1 input bytes. -/
+def NativeInput (input : List UInt8) : Prop := input.length < 2^64
+
+def replay (fuel : Nat) (key : KeyCodec.Key) (proof : ProofCodec.Data)
+    (claims : List (List G)) : Option Transcript.Replay := Transcript.replay hash fuel key proof claims
+
+def verifyArithmetic (fuel : Nat) (key : KeyCodec.Key) (proof : ProofCodec.Data)
+    (claims : List (List G)) (rows : List ProofShape.Row) : Option Transcript.Replay :=
+  Transcript.verifyArithmetic hash fuel key proof claims rows
+
+end Aiur.NativeAIR.Blake3
diff --git a/Ix/Aiur/BoundVerifier.lean b/Ix/Aiur/BoundVerifier.lean
new file mode 100644
index 000000000..3ed75608f
--- /dev/null
+++ b/Ix/Aiur/BoundVerifier.lean
@@ -0,0 +1,143 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Compilation
+import Ix.Aiur.LookupShapes
+import Ix.Aiur.RowCounts
+import Ix.Aiur.EmissionChecks
+import Ix.Aiur.KeyCodec
+import Ix.Aiur.Protocol
+
+/-! A verifier whose caller selects the source, entrypoint, parameters and
+complete allowed key bytes. Untrusted proof bytes cannot select any of them.
+
+This is a program/statement/key binding component. It does not assert that
+the selected source implements the certified checker, that compilation or
+AIR constraints reflect source execution, or that the proof-system FFI is
+sound. Those are distinct C8 obligations. In particular, no certified release
+is instantiated here for the legacy `verify_claim` or the C2 pilot.
+-/
+
+namespace Aiur.BoundVerifier
+
+/-- Trusted deployment selection, independent of the proof being verified.
+Circuit grouping is explicit; environment-variable overrides are not used. -/
+structure Selection where
+  source : Source.Toplevel
+  groups : Array (String × Array String) := #[]
+  entrypoint : Lean.Name
+  function : Bytecode.FunIdx
+  inputSize : Nat
+  success : Array G
+  commitment : CommitmentParameters
+  fri : FriParameters
+  key : ByteArray
+
+def Selection.compile (selection : Selection) : Except String CompiledToplevel := do
+  let compiled ← selection.source.compile
+  if selection.groups.isEmpty then return compiled
+  compiled.groupFunctions selection.groups
+
+/-- The system is built from exactly the selected compilation and parameters.
+It is derived, rather than accepted as a second independent caller argument. -/
+def Selection.system (selection : Selection) (compiled : CompiledToplevel) : AiurSystem :=
+  AiurSystem.build compiled.bytecode selection.commitment selection.fri
+
+def Selection.keyParameters (selection : Selection) : NativeAIR.KeyCodec.Parameters :=
+  ⟨selection.commitment.logBlowup, selection.commitment.capHeight,
+    selection.fri.logFinalPolyLen, selection.fri.maxLogArity, selection.fri.numQueries,
+    selection.fri.commitProofOfWorkBits, selection.fri.queryProofOfWorkBits⟩
+
+structure Backend (selection : Selection) where
+  compiled : CompiledToplevel
+  compilation : selection.compile = .ok compiled
+  system : AiurSystem
+  systemBuilt : system = selection.system compiled
+  selected : compiled.getFuncIdx selection.entrypoint = some selection.function
+  functionRange : selection.function < gSize.toNat
+  entry : Bytecode.Function
+  present : compiled.bytecode.functions[selection.function]? = some entry
+  publicEntry : entry.entry = true
+  constrained : entry.constrained = true
+  arity : entry.layout.inputSize = selection.inputSize
+  returnArity : entry.body.returnsHaveSize selection.success.size = true
+  lookupShapes : compiled.bytecode.validateLookupShapes = true
+  rowCounts : compiled.bytecode.validateRowCounts = true
+  emissionChecks : compiled.bytecode.validateEmission = true
+  keyBound : system.vkBytes = selection.key
+  keyData : NativeAIR.KeyCodec.Key
+  keyDecoded : NativeAIR.KeyCodec.decodeCanonical selection.key = some keyData
+  keyParameters : keyData.parameters = selection.keyParameters
+
+def build (selection : Selection) : Except String (Backend selection) :=
+  match hc : selection.compile with
+  | .error e => .error e
+  | .ok compiled =>
+    if hs : compiled.getFuncIdx selection.entrypoint = some selection.function then
+      if hr : selection.function < gSize.toNat then
+        match hp : compiled.bytecode.functions[selection.function]? with
+        | none => .error "selected function is absent"
+        | some entry =>
+          if he : entry.entry = true ∧ entry.constrained = true ∧
+              entry.layout.inputSize = selection.inputSize then
+            if ho : entry.body.returnsHaveSize selection.success.size = true then
+              if hl : compiled.bytecode.validateLookupShapes = true then
+                if hn : compiled.bytecode.validateRowCounts = true then
+                  if hi : compiled.bytecode.validateEmission = true then
+                    let system := selection.system compiled
+                    if hk : system.vkBytes = selection.key then
+                      match hd : NativeAIR.KeyCodec.decodeCanonical selection.key with
+                      | none => .error "verification key is not a checked canonical v5 artifact"
+                      | some keyData =>
+                        if hm : keyData.parameters = selection.keyParameters then
+                          .ok ⟨compiled, hc, system, rfl, hs, hr, entry, hp, he.1, he.2.1, he.2.2, ho, hl, hn, hi, hk,
+                            keyData, hd, hm⟩
+                        else .error "verification key parameters differ from the selected parameters"
+                    else .error "verification key differs from the selected key"
+                  else .error "compiled circuit reads an invalid logical value or selector"
+                else .error "compiled circuit control counts exceed their bounds"
+              else .error "compiled lookup message arities differ"
+            else .error "selected success result has the wrong output arity"
+          else .error "selected function is not a constrained public entry of the expected arity"
+      else .error "function index is not a canonical field element"
+    else .error "entrypoint differs from the selected function"
+
+/-- `input` is the statement the caller expects. A serialized proof supplies
+neither a different statement nor an alternative key or success result. -/
+def verify {selection : Selection} (backend : Backend selection) (input : Array G)
+    (bytes : ByteArray) : Except String Unit := do
+  if input.size != selection.inputSize then throw "public input arity differs"
+  let proof ← Proof.ofBytesChecked bytes
+  backend.system.verify
+    (buildClaim selection.function input selection.success) proof
+
+theorem verify_success {selection : Selection} {backend : Backend selection}
+    {input : Array G} {bytes : ByteArray} (h : verify backend input bytes = .ok ()) :
+    input.size = selection.inputSize ∧
+      ∃ proof, Proof.ofBytesChecked bytes = .ok proof ∧
+        backend.system.verify
+          (buildClaim selection.function input selection.success) proof = .ok () := by
+  unfold verify at h
+  split at h
+  · cases h
+  · rename_i ha
+    refine ⟨by simpa using ha, ?_⟩
+    cases hp : Proof.ofBytesChecked bytes with
+    | error e => simp [hp, bind, Except.bind] at h
+    | ok proof => exact ⟨proof, rfl, by simpa [hp, bind, Except.bind] using h⟩
+
+/-- Every produced backend retains the actual compiler artifact, including
+the grouping result. No compiler-semantic claim is packed into this result. -/
+theorem Backend.compilation_stages {selection : Selection} (backend : Backend selection) :
+    ∃ initial, selection.source.compile = .ok initial ∧
+      (if selection.groups.isEmpty then .ok initial
+        else initial.groupFunctions selection.groups) = .ok backend.compiled := by
+  have h := backend.compilation
+  unfold Selection.compile at h
+  cases hc : selection.source.compile with
+  | error e => simp [hc, bind, Except.bind] at h
+  | ok initial => exact ⟨initial, rfl, by simpa [hc, bind, Except.bind, pure, Except.pure] using h⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Branchless.lean b/Ix/Aiur/Branchless.lean
new file mode 100644
index 000000000..a5c0ab9a4
--- /dev/null
+++ b/Ix/Aiur/Branchless.lean
@@ -0,0 +1,27 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+module
+public import Ix.Aiur.Stages.Bytecode
+
+/-! Ungated lookup messages require one writer per physical slot. A single
+selector does not ensure that: a branch with no terminal can still emit
+lookups. Restrict the optimization to one function with terminal control. -/
+
+public section
+@[expose] section
+namespace Aiur.Bytecode
+
+def Function.hasTerminalControl (function : Function) : Bool :=
+  match function.body.ctrl with
+  | .«return» .. | .yield .. => true
+  | _ => false
+
+def circuitBranchless (selectors : Nat) (functions : List Function) : Bool :=
+  selectors == 1 && match functions with
+    | [function] => function.hasTerminalControl
+    | _ => false
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Challenger.lean b/Ix/Aiur/Challenger.lean
new file mode 100644
index 000000000..5df23f431
--- /dev/null
+++ b/Ix/Aiur/Challenger.lean
@@ -0,0 +1,91 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofCodec
+
+/-! Total replay of the pinned byte-hash / serializing Goldilocks challenger.
+The hash is an explicit 32-byte function. The pending buffer is stored in
+sampling order, the reverse of the native vector. Rejection sampling uses
+explicit fuel; exhaustion rejects without returning a fabricated sample.
+-/
+
+namespace Aiur.NativeAIR.Challenger
+
+abbrev Hash32 := List UInt8 → Fin 32 → UInt8
+
+structure State where
+  input : List UInt8
+  pending : List UInt8
+  deriving DecidableEq, Repr
+
+def initial (seed : List UInt8) : State := ⟨seed, []⟩
+
+def observeByte (state : State) (byte : UInt8) : State :=
+  ⟨state.input ++ [byte], []⟩
+
+/-- Empty slices perform no byte observations and preserve pending output. -/
+def observeBytes (state : State) (bytes : List UInt8) : State :=
+  if bytes.isEmpty then state else ⟨state.input ++ bytes, []⟩
+
+def observeField (state : State) (value : G) : State :=
+  observeBytes state (ProofCodec.encodeField value)
+
+def observeExtension (state : State) (value : ProofCodec.Extension) : State :=
+  observeField (observeField state value.c0) value.c1
+
+/-- Caps are observed as digest bytes, without a vector length prefix. -/
+def observeCap (state : State) (cap : KeyCodec.MerkleCap) : State :=
+  observeBytes state cap.flatten
+
+def sampleByte (hash : Hash32) (state : State) : UInt8 × State :=
+  match state.pending with
+  | byte :: rest => (byte, ⟨state.input, rest⟩)
+  | [] =>
+    let digest := hash state.input
+    (digest 31, ⟨List.ofFn digest, (List.ofFn digest).reverse.drop 1⟩)
+
+def sampleBytes (hash : Hash32) : Nat → State → List UInt8 × State
+  | 0, state => ([], state)
+  | count + 1, state =>
+    let (byte, next) := sampleByte hash state
+    let (rest, final) := sampleBytes hash count next
+    (byte :: rest, final)
+
+def littleEndian (bytes : List UInt8) : Nat :=
+  bytes.foldr (fun byte rest => byte.toNat + 256 * rest) 0
+
+def sampleWord (hash : Hash32) (state : State) : Nat × State :=
+  let (bytes, next) := sampleBytes hash 8 state
+  (littleEndian bytes, next)
+
+def sampleField (hash : Hash32) : Nat → State → Option (G × State)
+  | 0, _ => none
+  | fuel + 1, state =>
+    let (word, next) := sampleWord hash state
+    if word < gSize.toNat then some (G.ofNat word, next)
+    else sampleField hash fuel next
+
+/-- Each basis coordinate has its own rejection-sampling budget. -/
+def sampleExtension (hash : Hash32) (fuel : Nat) (state : State) :
+    Option (ProofCodec.Extension × State) := do
+  let (c0, next) ← sampleField hash fuel state
+  let (c1, final) ← sampleField hash fuel next
+  return (⟨c0, c1⟩, final)
+
+def sampleBits (hash : Hash32) (bits : Nat) (state : State) : Option (Nat × State) :=
+  if bits < 64 ∧ 2^bits < gSize.toNat then
+    let (word, next) := sampleWord hash state
+    some (word % 2^bits, next)
+  else none
+
+/-- Unlike zero-bit sampling, a zero-bit witness check consumes nothing. -/
+def checkWitness (hash : Hash32) (bits : Nat) (witness : G) (state : State) :
+    Option (Bool × State) := do
+  if bits = 0 then return (true, state)
+  else
+    let (value, next) ← sampleBits hash bits (observeField state witness)
+    return (value == 0, next)
+
+end Aiur.NativeAIR.Challenger
diff --git a/Ix/Aiur/CompiledKey.lean b/Ix/Aiur/CompiledKey.lean
new file mode 100644
index 000000000..220be9d71
--- /dev/null
+++ b/Ix/Aiur/CompiledKey.lean
@@ -0,0 +1,92 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CompiledCircuitRows
+import Ix.Aiur.Proofs.CircuitCompletion
+import Ix.Aiur.Proofs.ByteColumns
+import Ix.Aiur.KeyCodec
+
+/-! Reconstruct the complete native circuit list from the selected bytecode.
+The comparison includes ordered graph nodes, constraints, lookups, dimensions,
+degrees, grouping and preprocessed indices. Commitment contents and proof
+verification are separate from this executable graph-binding check. -/
+
+namespace Aiur.NativeAIR.CompiledKey
+open Compiler CircuitEmitter
+
+def main (index : Nat) : Expr := .var ⟨.main, .current, index⟩
+def next (index : Nat) : Expr := .var ⟨.main, .next, index⟩
+def preprocessed (index : Nat) : Expr := .var ⟨.preprocessed, .current, index⟩
+
+def memoryEquations : List Expr :=
+  let selector := main 1
+  let transition := (next 1).frontMul .isTransition
+  [selector.frontMul (selector.frontSub (.konst 1)),
+    (main 0).frontMul ((Expr.konst 1).frontSub selector),
+    transition.frontMul (selector.frontSub (.konst 1)),
+    transition.frontMul (((main 2).frontAdd (.konst 1)).frontSub (next 2))]
+
+def memoryLookup (width : Nat) : ExprLookup :=
+  ⟨(main 0).frontNeg,
+    [Expr.konst 1, .konst (G.ofNat width), main 2].map ((main 1).frontMul) ++
+      (List.ofFn fun i : Fin width => (main 1).frontMul (main (3 + i.val)))⟩
+
+def byte1Lookup (kind : AIR.Byte1Kind) : ExprLookup :=
+  ⟨(main kind.column.val).frontNeg, match kind with
+    | .bits => [.konst 2, preprocessed 0] ++ List.ofFn (fun i : Fin 8 => preprocessed (1 + i.val))
+    | .shiftLeft => [.konst 3, preprocessed 0, preprocessed 9]
+    | .shiftRight => [.konst 4, preprocessed 0, preprocessed 10]⟩
+
+def byte2Lookup (kind : AIR.Byte2Kind) : ExprLookup :=
+  ⟨(main kind.column.val).frontNeg, [.konst kind.channel, preprocessed 0, preprocessed 1] ++ match kind with
+    | .xor => [preprocessed 2]
+    | .add => [preprocessed 3]
+    | .sub => [preprocessed 4]
+    | .and => [preprocessed 5]
+    | .or => [preprocessed 6]
+    | .lessThan => [preprocessed 7]
+    | .range => []
+    | .mul => [preprocessed 8, preprocessed 9]
+    | .split7 => [preprocessed 10, preprocessed 11]
+    | .split4 => [preprocessed 12, preprocessed 13]⟩
+
+def circuit (mainWidth preprocessedWidth preprocessedHeight groupSize : Nat)
+    (base : BaseCompilation) : Option KeyCodec.Circuit := do
+  let raw : KeyCodec.Circuit := ⟨mainWidth, preprocessedWidth, preprocessedHeight, 0, groupSize, base.graph⟩
+  let degree ← raw.computedDegree
+  let result := { raw with maxConstraintDegree := degree }
+  if result.valid then some result else none
+
+def functionCircuit (program : Bytecode.Toplevel) (source : Bytecode.Circuit) : Option KeyCodec.Circuit := do
+  let compiled ← compileCircuit (circuitWidths source) program source
+  let groupSize := if compiled.emission.branchless && 2 ≤ compiled.emission.lookups.length then 2 else 1
+  circuit source.layout.width 0 0 groupSize compiled.base
+
+def memoryCircuit (width : Nat) : Option KeyCodec.Circuit := do
+  let base ← compileBase ⟨0, 3 + width, 0, 0⟩ [memoryLookup width] memoryEquations
+  circuit (3 + width) 0 0 1 base
+
+def byte1Circuit : Option KeyCodec.Circuit := do
+  let base ← compileBase ⟨11, 3, 0, 0⟩ (AIR.Byte1Kind.all.map byte1Lookup) []
+  circuit 3 11 256 2 base
+
+def byte2Circuit : Option KeyCodec.Circuit := do
+  let base ← compileBase ⟨14, 10, 0, 0⟩ (AIR.Byte2Kind.all.map byte2Lookup) []
+  circuit 10 14 65536 2 base
+
+def circuits (program : Bytecode.Toplevel) : Option (List KeyCodec.Circuit) := do
+  let functions ← program.circuits.toList.mapM (functionCircuit program)
+  let memories ← program.memorySizes.toList.mapM memoryCircuit
+  let byte1 ← byte1Circuit
+  let byte2 ← byte2Circuit
+  return functions ++ memories ++ [byte1, byte2]
+
+def preprocessedIndices (program : Bytecode.Toplevel) : List (Option Nat) :=
+  List.replicate (program.circuits.size + program.memorySizes.size) none ++ [some 0, some 1]
+
+def check (program : Bytecode.Toplevel) (key : KeyCodec.Key) : Bool :=
+  circuits program == some key.circuits && key.preprocessedIndices == preprocessedIndices program
+
+end Aiur.NativeAIR.CompiledKey
diff --git a/Ix/Aiur/CompiledVerifier.lean b/Ix/Aiur/CompiledVerifier.lean
new file mode 100644
index 000000000..50558b54a
--- /dev/null
+++ b/Ix/Aiur/CompiledVerifier.lean
@@ -0,0 +1,47 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.BoundVerifier
+import Ix.Aiur.CompiledKey
+
+/-! Enforce equality between the selected native key and the complete checked
+circuit model. This strengthens program/key binding; native acceptance,
+preprocessed commitment meaning and certified source soundness remain open. -/
+
+namespace Aiur.BoundVerifier
+
+structure CompiledBackend (selection : Selection) extends Backend selection where
+  graphsChecked : NativeAIR.CompiledKey.check compiled.bytecode keyData = true
+
+def buildCompiled (selection : Selection) : Except String (CompiledBackend selection) := do
+  let backend ← build selection
+  if checked : NativeAIR.CompiledKey.check backend.compiled.bytecode backend.keyData = true then
+    return ⟨backend, checked⟩
+  else throw "verification key circuits differ from the checked compilation"
+
+def verifyCompiled {selection : Selection} (backend : CompiledBackend selection) (input : Array G)
+    (bytes : ByteArray) : Except String Unit :=
+  verify backend.toBackend input bytes
+
+theorem CompiledBackend.circuits_bound {selection : Selection} (backend : CompiledBackend selection) :
+    NativeAIR.CompiledKey.circuits backend.compiled.bytecode = some backend.keyData.circuits := by
+  have checked := backend.graphsChecked
+  simp only [NativeAIR.CompiledKey.check, Bool.and_eq_true, beq_iff_eq] at checked
+  exact checked.1
+
+theorem CompiledBackend.preprocessed_indices {selection : Selection} (backend : CompiledBackend selection) :
+    backend.keyData.preprocessedIndices = NativeAIR.CompiledKey.preprocessedIndices backend.compiled.bytecode := by
+  have checked := backend.graphsChecked
+  simp only [NativeAIR.CompiledKey.check, Bool.and_eq_true, beq_iff_eq] at checked
+  exact checked.2
+
+theorem verifyCompiled_success {selection : Selection} {backend : CompiledBackend selection}
+    {input : Array G} {bytes : ByteArray} (accepted : verifyCompiled backend input bytes = .ok ()) :
+    input.size = selection.inputSize ∧
+      ∃ proof, Proof.ofBytesChecked bytes = .ok proof ∧
+        backend.system.verify (buildClaim selection.function input selection.success) proof = .ok () :=
+  verify_success accepted
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Compiler.lean b/Ix/Aiur/Compiler.lean
index 5eb558e18..88542e5d4 100644
--- a/Ix/Aiur/Compiler.lean
+++ b/Ix/Aiur/Compiler.lean
@@ -189,12 +189,11 @@ def Bytecode.Toplevel.needsCircuit (t : Bytecode.Toplevel) : Array Bool := Id.ru
         stack := stack.push callee
   needs
 
-/-- Full compilation pipeline. -/
-def Source.Toplevel.compile (t : Source.Toplevel) : Except String CompiledToplevel := do
-  let t ← t.inlineCalls
-  let typedDecls ← t.checkAndSimplify.mapError toString
-  let concDecls ← typedDecls.concretize.mapError toString
-  let (bytecodeRaw, preNameMap) ← concDecls.toBytecode
+/-- The exact artifact produced by the total final compilation passes.
+Keeping this operation separate lets the compilation success theorem bind
+the returned bytecode and function map to the successful stage outputs. -/
+def finishCompilation (t : Source.Toplevel) (bytecodeRaw : Bytecode.Toplevel)
+    (preNameMap : Std.HashMap Global Bytecode.FunIdx) : CompiledToplevel := Id.run do
   let (bytecodeDedup, remap) := bytecodeRaw.deduplicate
   let needs := bytecodeDedup.needsCircuit
   let bytecode : Bytecode.Toplevel := { bytecodeDedup with
@@ -209,6 +208,14 @@ def Source.Toplevel.compile (t : Source.Toplevel) : Except String CompiledToplev
     circuits := bytecode.singletonCircuits fun i => reverseMap[i]?.getD s!"<fn {i}>" }
   pure (CompiledToplevel.mk t bytecode nameMap)
 
+/-- Full compilation pipeline. -/
+def Source.Toplevel.compile (t : Source.Toplevel) : Except String CompiledToplevel := do
+  let t ← t.inlineCalls
+  let typedDecls ← t.checkAndSimplify.mapError toString
+  let concDecls ← typedDecls.concretize.mapError toString
+  let (bytecodeRaw, preNameMap) ← concDecls.toBytecode
+  return finishCompilation t bytecodeRaw preNameMap
+
 /-- Name of the environment variable that switches function grouping OFF
 process-wide: when it is set to anything but `0` or the empty string,
 `compileWithGroups` ignores its grouping and compiles the singleton
diff --git a/Ix/Aiur/Compiler/Dedup.lean b/Ix/Aiur/Compiler/Dedup.lean
index 8a9d70bfa..521738be4 100644
--- a/Ix/Aiur/Compiler/Dedup.lean
+++ b/Ix/Aiur/Compiler/Dedup.lean
@@ -138,14 +138,14 @@ def assignClasses [BEq α] [Hashable α] (values : Array α) : Array Nat × Nat
       | none => (classes.push nextId, map.insert v nextId, nextId + 1)
   (classes, nextId)
 
-/-- Bounded refinement step. The `bound` caps iterations — `classes.size + 1`
-is always enough since the number of distinct equivalence classes can only
-increase (or stay the same) per step, and is bounded above by `classes.size`. -/
+/-- Bounded refinement step. The bound caps optimization work. The public
+pass validates the final candidate, so execution preservation does not
+depend on proving that this iteration has reached a fixed point. -/
 def partitionRefineBound : Nat → Array Nat → Array (Array FunIdx) → Array Nat
   | 0, classes, _ => classes
   | bound+1, classes, callees =>
     let signatures := classes.mapIdx fun i cls =>
-      (cls, callees[i]!.map (classes[·]!))
+      (cls, (callees[i]?.getD #[]).map fun callee => classes[callee]?.getD 0)
     let (newClasses, _) := assignClasses signatures
     if newClasses == classes then classes
     else partitionRefineBound bound newClasses callees
@@ -200,9 +200,9 @@ def deduplicate_newFunctions (functions : Array Function) (classes : Array Nat)
       else acc)
     #[]
 
-/-- Deduplicate bytecode functions via partition refinement.
-Returns the deduplicated toplevel and a mapping from old index to new index. -/
-def Toplevel.deduplicate (t : Toplevel) : Toplevel × (FunIdx → FunIdx) :=
+/-- Propose a deduplication by partition refinement. The public pass validates
+this candidate before returning it. -/
+def Toplevel.deduplicateCandidate (t : Toplevel) : Toplevel × (FunIdx → FunIdx) :=
   let functions := t.functions
   let n := functions.size
   if n == 0 then (t, id)
@@ -219,6 +219,37 @@ def Toplevel.deduplicate (t : Toplevel) : Toplevel × (FunIdx → FunIdx) :=
     let newFunctions := deduplicate_newFunctions functions classes canonical remapFn
     ({ t with functions := newFunctions }, remapFn)
 
+/-- Keep invalid source function indices outside the target's domain. -/
+def boundedRenaming (source : Toplevel) (rename : FunIdx → FunIdx) (i : FunIdx) : FunIdx :=
+  if i < source.functions.size then rename i else i
+
+/-- Every old function must map to a valid target with the same layout and
+the exact body obtained by rewriting calls. Target size and bounded renaming
+also prevent invalid source calls from becoming valid target calls. -/
+def validatesRenaming (source target : Toplevel) (rename : FunIdx → FunIdx) : Bool :=
+  target.functions.size ≤ source.functions.size &&
+    (Array.range source.functions.size).all fun i =>
+      if hi : i < source.functions.size then
+        if hj : rename i < target.functions.size then
+          source.functions[i].layout == target.functions[rename i].layout &&
+            rewriteBlock rename source.functions[i].body == target.functions[rename i].body
+        else false
+      else false
+
+/-- Use a proposed function renaming only after checking its complete code
+relation. An invalid candidate leaves the original program and indices intact. -/
+def checkedRenaming (source candidate : Toplevel) (rename : FunIdx → FunIdx) :
+    Toplevel × (FunIdx → FunIdx) :=
+  let bounded := boundedRenaming source rename
+  if validatesRenaming source candidate bounded then (candidate, bounded)
+  else (source, id)
+
+/-- Deduplicate bytecode functions via validated partition refinement.
+Returns the selected program and a mapping from old index to new index. -/
+def Toplevel.deduplicate (source : Toplevel) : Toplevel × (FunIdx → FunIdx) :=
+  let candidate := source.deduplicateCandidate
+  checkedRenaming source candidate.1 candidate.2
+
 end Bytecode
 
 end Aiur
diff --git a/Ix/Aiur/Compiler/Layout.lean b/Ix/Aiur/Compiler/Layout.lean
index a43f1469b..6676a7dfc 100644
--- a/Ix/Aiur/Compiler/Layout.lean
+++ b/Ix/Aiur/Compiler/Layout.lean
@@ -109,7 +109,8 @@ structure LayoutMState where
   degrees : Array Nat
 
 @[inline] def LayoutMState.new (inputSize : Nat) : LayoutMState :=
-  ⟨{ inputSize, selectors := 0, auxiliaries := 1, lookups := 0 }, .empty, Array.replicate inputSize 1⟩
+  -- Multiplicity plus six rank bytes, with three byte-pair range lookups.
+  ⟨{ inputSize, selectors := 0, auxiliaries := 7, lookups := 3 }, .empty, Array.replicate inputSize 1⟩
 
 abbrev LayoutM := StateM LayoutMState
 
@@ -174,7 +175,10 @@ def opLayout : Bytecode.Op → LayoutM Unit
   | .call _ _ outputSize unconstrained => do
     pushDegrees $ .replicate outputSize 1
     bumpAuxiliaries outputSize
-    if !unconstrained then bumpLookups
+    if !unconstrained then
+      -- Callee rank and six bytes for (callee rank - caller rank - 1).
+      bumpAuxiliaries 7
+      bumpLookups 4
   | .store values => do
     pushDegree 1; bumpAuxiliaries; bumpLookups; addMemSize values.size
   | .load size _ => do
diff --git a/Ix/Aiur/Compiler/Lower.lean b/Ix/Aiur/Compiler/Lower.lean
index 039eb7dcc..db1e22f26 100644
--- a/Ix/Aiur/Compiler/Lower.lean
+++ b/Ix/Aiur/Compiler/Lower.lean
@@ -250,9 +250,9 @@ def toIndex
     let eltSize ← match typSize layoutMap eltTyp with
       | .error e => throw e
       | .ok len => pure len
+    let val ← toIndex layoutMap bindings val
     let arr ← toIndex layoutMap bindings arr
     let left := arr.extract 0 (i * eltSize)
-    let val ← toIndex layoutMap bindings val
     let right := arr.extract ((i + 1) * eltSize)
     pure $ left ++ val ++ right
   | .store _ _ arg => do
diff --git a/Ix/Aiur/Domain.lean b/Ix/Aiur/Domain.lean
new file mode 100644
index 000000000..c56172cc3
--- /dev/null
+++ b/Ix/Aiur/Domain.lean
@@ -0,0 +1,66 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Extension
+
+/-! Natural trace domains and the pinned Goldilocks two-adic generators.
+The checked out-of-domain selector evaluator rejects every division pole.
+-/
+
+namespace Aiur.NativeAIR.Domain
+
+def generators : Array G := #[
+  0x0000000000000001, 0xffffffff00000000, 0x0001000000000000,
+  0xfffffffeff000001, 0xefffffff00000001, 0x00003fffffffc000,
+  0x0000008000000000, 0xf80007ff08000001, 0xbf79143ce60ca966,
+  0x1905d02a5c411f4e, 0x9d8f2ad78bfed972, 0x0653b4801da1c8cf,
+  0xf2c35199959dfcb6, 0x1544ef2335d17997, 0xe0ee099310bba1e2,
+  0xf6b2cffe2306baac, 0x54df9630bf79450e, 0xabd0a6e8aa3d8a0e,
+  0x81281a7b05f9beac, 0xfbd41c6b8caa3302, 0x30ba2ecd5e93e76d,
+  0xf502aef532322654, 0x4b2a18ade67246b5, 0xea9d5a1336fbc98b,
+  0x86cdcc31c307e171, 0x4bbaf5976ecfefd8, 0xed41d05b78d6e286,
+  0x10d78dd8915a171d, 0x59049500004a4485, 0xdfa8c93ba46d2666,
+  0x7e9bd009b86a0845, 0x400a7f755588e659, 0x185629dcda58878c]
+
+theorem generators_size : generators.size = 33 := rfl
+
+abbrev Subgroup := Fin 33
+
+def ofLogSize (bits : Nat) : Option Subgroup :=
+  if bounded : bits < 33 then some ⟨bits, bounded⟩ else none
+
+def size (domain : Subgroup) : Nat := 2 ^ domain.val
+
+def generator (domain : Subgroup) : G :=
+  generators[domain.val]'(by simpa only [generators_size] using domain.isLt)
+
+def point (domain : Subgroup) (index : Fin (size domain)) : G :=
+  (generator domain).pow index.val
+
+def lastPoint (domain : Subgroup) : G := (generator domain).inverse
+
+def normalizer (domain : Subgroup) : G := G.ofNat (size domain) * generator domain
+
+structure Selectors (W : Type) where
+  isFirst : W
+  isLast : W
+  isTransition : W
+  invVanishing : W
+  deriving DecidableEq, Repr
+
+open ProofCodec (Extension)
+
+def vanishing (domain : Subgroup) (value : Extension) : Extension :=
+  value.power (size domain) - 1
+
+def selectors (domain : Subgroup) (value : Extension) : Option (Selectors Extension) := do
+  let z := vanishing domain value
+  let lastDenominator := value - Extension.ofBase (lastPoint domain)
+  let firstInverse ← (value - 1).tryInverse
+  let lastInverse ← lastDenominator.tryInverse
+  let vanishingInverse ← z.tryInverse
+  return ⟨z * firstInverse, z * lastInverse, lastDenominator, vanishingInverse⟩
+
+end Aiur.NativeAIR.Domain
diff --git a/Ix/Aiur/EmissionChecks.lean b/Ix/Aiur/EmissionChecks.lean
new file mode 100644
index 000000000..99be67636
--- /dev/null
+++ b/Ix/Aiur/EmissionChecks.lean
@@ -0,0 +1,119 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+module
+public import Ix.Aiur.Stages.Bytecode
+
+/-!
+Structural checks for circuit emission. Each operation reads the incoming
+logical scope and then appends its outputs. Branches restore that scope;
+continuations append only their merge values. Unconstrained advice and I/O
+operations do not read their runtime operands while building constraints.
+
+The checked addition matches the supported 64-bit native index domain. These
+checks establish neither source typing nor the meaning of unchecked advice.
+-/
+
+public section
+@[expose] section
+
+namespace Aiur.Bytecode
+
+def indicesInScope (available : Nat) (indices : Array ValIdx) : Bool :=
+  indices.all fun index => decide (index < available)
+
+def wordInScope (available : Nat) (indices : Array ValIdx) : Bool :=
+  indices.size == 4 && indicesInScope available indices
+
+/-- Logical outputs include virtual carries, which occupy no fresh column. -/
+def Op.outputSize : Op → Nat
+  | .const .. | .add .. | .sub .. | .mul .. | .eqZero .. | .store ..
+  | .u8ShiftLeft .. | .u8ShiftRight .. | .u8Xor .. | .u8And .. | .u8Or ..
+  | .u8LessThan .. | .u32LessThan .. | .unconstrainedGInverse .. | .u32ToField .. => 1
+  | .call _ _ size _ | .load size _ | .ioRead _ _ size => size
+  | .assertEq .. | .ioSetInfo .. | .ioWrite .. | .debug .. | .u8RangeCheck .. => 0
+  | .ioGetInfo .. | .u8Add .. | .u8Mul .. | .u8Sub .. | .u8XorSplit7 ..
+  | .u8XorSplit4 .. | .unconstrainedBigUintDivMod .. => 2
+  | .u8BitDecomposition .. | .unconstrainedGToBytes .. => 8
+  | .unconstrainedU32Add .. | .unconstrainedU32Add3 .. => 5
+
+/-- Check precisely the operands consumed by the constraint builder. In
+particular, a store cannot read its own newly allocated pointer. -/
+def Op.emissionInputs (available : Nat) : Op → Bool
+  | .add a b | .sub a b | .mul a b | .u8Xor a b | .u8Add a b | .u8Mul a b
+  | .u8Sub a b | .u8And a b | .u8Or a b | .u8LessThan a b | .u32LessThan a b
+  | .u8XorSplit7 a b | .u8XorSplit4 a b | .u8RangeCheck a b =>
+    decide (a < available) && decide (b < available)
+  | .eqZero index | .load _ index | .u8BitDecomposition index
+  | .u8ShiftLeft index | .u8ShiftRight index => decide (index < available)
+  | .call _ indices _ false | .store indices => indicesInScope available indices
+  | .assertEq left right _ => left.size == right.size &&
+      (indicesInScope available left && indicesInScope available right)
+  | .unconstrainedU32Add left right => wordInScope available left && wordInScope available right
+  | .unconstrainedU32Add3 left middle right =>
+    wordInScope available left && (wordInScope available middle && wordInScope available right)
+  | .u32ToField indices => wordInScope available indices
+  | _ => true
+
+def addScope (available count : Nat) : Option Nat :=
+  let next := available + count
+  if next < 2^64 then some next else none
+
+def checkEmissionOps : List Op → Nat → Option Nat
+  | [], available => some available
+  | op :: ops, available => do
+    if !op.emissionInputs available then none else do
+      let next ← addScope available op.outputSize
+      checkEmissionOps ops next
+
+private theorem block_ctrl_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def Ctrl.emissionChecks (available selectors : Nat) (yieldSize : Option Nat) : Ctrl → Bool
+  | .return index outputs => decide (index < selectors) && indicesInScope available outputs
+  | .yield index outputs => decide (index < selectors) &&
+      (indicesInScope available outputs && yieldSize == some outputs.size)
+  | .match index branches fallback =>
+    decide (index < available) &&
+      (branches.attach.all (fun ⟨(_, block), _⟩ => block.emissionChecks available selectors yieldSize) &&
+        (match fallback with | none => true | some block => block.emissionChecks available selectors yieldSize))
+  | .matchContinue index branches fallback size _ _ continuation =>
+    decide (index < available) &&
+      (branches.attach.all (fun ⟨(_, block), _⟩ => block.emissionChecks available selectors (some size)) &&
+        ((match fallback with | none => true | some block => block.emissionChecks available selectors (some size)) &&
+          (match addScope available size with
+          | none => false
+          | some next => continuation.emissionChecks next selectors yieldSize)))
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.emissionChecks (available selectors : Nat) (yieldSize : Option Nat) (block : Block) : Bool :=
+  match checkEmissionOps block.ops.toList available with
+  | none => false
+  | some next => block.ctrl.emissionChecks next selectors yieldSize
+termination_by sizeOf block
+decreasing_by exact block_ctrl_smaller block
+
+end
+
+def Function.emissionChecks (function : Function) : Bool :=
+  decide (function.layout.inputSize < 2^64) &&
+    function.body.emissionChecks function.layout.inputSize function.layout.selectors none
+
+/-- Check every constrained body before invoking the native circuit builder. -/
+def Toplevel.validateEmission (program : Toplevel) : Bool :=
+  program.functions.all fun function => !function.constrained || function.emissionChecks
+
+end Aiur.Bytecode
+
+end
+end
diff --git a/Ix/Aiur/Extension.lean b/Ix/Aiur/Extension.lean
new file mode 100644
index 000000000..b23459aef
--- /dev/null
+++ b/Ix/Aiur/Extension.lean
@@ -0,0 +1,47 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofCodec
+
+/-! Arithmetic on the two canonical coordinates carried by native proofs.
+The pinned Goldilocks extension uses the basis `1, u` with `u² = 7`.
+These definitions do not authenticate polynomial openings or a transcript.
+-/
+
+namespace Aiur.NativeAIR.ProofCodec.Extension
+
+def ofBase (value : G) : Extension := ⟨value, 0⟩
+
+instance ofNat : OfNat Extension n := ⟨ofBase (G.ofNat n)⟩
+instance add : Add Extension := ⟨fun a b => ⟨a.c0 + b.c0, a.c1 + b.c1⟩⟩
+instance sub : Sub Extension := ⟨fun a b => ⟨a.c0 - b.c0, a.c1 - b.c1⟩⟩
+instance neg : Neg Extension := ⟨fun a => ⟨0 - a.c0, 0 - a.c1⟩⟩
+instance mul : Mul Extension := ⟨fun a b =>
+  ⟨a.c0 * b.c0 + a.c1 * (b.c1 * 7), a.c0 * b.c1 + a.c1 * b.c0⟩⟩
+
+def basis : Extension := ⟨0, 1⟩
+def conjugate (value : Extension) : Extension := ⟨value.c0, 0 - value.c1⟩
+def norm (value : Extension) : G := value.c0 * value.c0 - 7 * (value.c1 * value.c1)
+def scale (value : Extension) (scalar : G) : Extension :=
+  ⟨value.c0 * scalar, value.c1 * scalar⟩
+
+def powBits (value : Extension) (exponent : Nat) : Nat → Extension
+  | 0 => 1
+  | fuel + 1 =>
+    if exponent == 0 then 1
+    else
+      let half := powBits value (exponent / 2) fuel
+      let square := half * half
+      if exponent % 2 == 0 then square else square * value
+
+def power (value : Extension) (exponent : Nat) : Extension :=
+  powBits value exponent (exponent.log2 + 1)
+
+def tryInverse (value : Extension) : Option Extension :=
+  if value == 0 then none else some (value.conjugate.scale value.norm.inverse)
+
+def evalOps : EvalOps Extension := ⟨ofBase, (· + ·), (· - ·), (· * ·), (-·)⟩
+
+end Aiur.NativeAIR.ProofCodec.Extension
diff --git a/Ix/Aiur/ExtensionMmcs.lean b/Ix/Aiur/ExtensionMmcs.lean
new file mode 100644
index 000000000..2d4a8f4b1
--- /dev/null
+++ b/Ix/Aiur/ExtensionMmcs.lean
@@ -0,0 +1,62 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.PrunedMerkle
+import Ix.Aiur.ProofCodec
+
+/-! The native quadratic-extension MMCS adapter. Coordinates are flattened
+in basis order, and dimensions retain their heights. Width multiplication
+models release-mode machine arithmetic; `WidthsFit` states when it agrees
+with mathematical doubling and the original extension-row shape.
+-/
+
+namespace Aiur.NativeAIR.ExtensionMmcs
+
+open Merkle (Digest Hash Dimensions)
+open ProofCodec (Extension)
+
+def baseRow (values : List Extension) : List G :=
+  values.flatMap fun value => [value.c0, value.c1]
+
+def baseRows (rows : List (List Extension)) : List (List G) := rows.map baseRow
+
+def baseDimensions (wordBits : Nat) (dimensions : List Dimensions) : List Dimensions :=
+  dimensions.map fun dimension =>
+    { dimension with width := (dimension.width * 2) % 2^wordBits }
+
+def WidthsFit (wordBits : Nat) (dimensions : List Dimensions) : Prop :=
+  ∀ dimension ∈ dimensions, dimension.width * 2 < 2^wordBits
+
+def shape : List Dimensions → List (List Extension) → Bool
+  | [], [] => true
+  | dimension :: dimensions, row :: rows => row.length == dimension.width && shape dimensions rows
+  | _, _ => false
+
+def replay (hash : Hash) (wordBits : Nat) (dimensions : List Dimensions) (capHeight index : Nat)
+    (rows : List (List Extension)) (proof : List Digest) : Option Merkle.Replay :=
+  Merkle.replay hash (baseDimensions wordBits dimensions) capHeight index (baseRows rows) proof
+
+def verify (hash : Hash) (wordBits : Nat) (dimensions : List Dimensions) (capHeight index : Nat)
+    (cap : List Digest) (rows : List (List Extension)) (proof : List Digest) : Bool :=
+  Merkle.verify hash (baseDimensions wordBits dimensions) capHeight index cap (baseRows rows) proof
+
+def verifyCovered (hash : Hash) (wordBits : Nat) (dimensions : List Dimensions) (capHeight index : Nat)
+    (cap : List Digest) (rows : List (List Extension)) (proof : List Digest) : Bool :=
+  Merkle.covered dimensions capHeight && verify hash wordBits dimensions capHeight index cap rows proof
+
+def replayMulti (hash : Hash) (wordBits : Nat) (dimensions : List Dimensions) (capHeight : Nat)
+    (indices : List Nat) (rows : List (List (List Extension))) (proof : List Digest) :
+    PrunedMerkle.Logged (List PrunedMerkle.Node) :=
+  PrunedMerkle.replay hash (baseDimensions wordBits dimensions) capHeight indices (rows.map baseRows) proof
+
+def verifyMulti (hash : Hash) (wordBits : Nat) (dimensions : List Dimensions) (capHeight : Nat)
+    (indices : List Nat) (cap : List Digest) (rows : List (List (List Extension))) (proof : List Digest) : Bool :=
+  PrunedMerkle.verify hash (baseDimensions wordBits dimensions) capHeight indices cap (rows.map baseRows) proof
+
+def verifyMultiCovered (hash : Hash) (wordBits : Nat) (dimensions : List Dimensions) (capHeight : Nat)
+    (indices : List Nat) (cap : List Digest) (rows : List (List (List Extension))) (proof : List Digest) : Bool :=
+  Merkle.covered dimensions capHeight && verifyMulti hash wordBits dimensions capHeight indices cap rows proof
+
+end Aiur.NativeAIR.ExtensionMmcs
diff --git a/Ix/Aiur/Folding.lean b/Ix/Aiur/Folding.lean
new file mode 100644
index 000000000..f558cec8a
--- /dev/null
+++ b/Ix/Aiur/Folding.lean
@@ -0,0 +1,40 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Interpolation
+
+/-! Global coefficient folding and restriction to a folding coset.
+Coefficients use the ascending-power convention, with trailing zeros allowed.
+-/
+
+namespace Aiur.NativeAIR.Folding
+
+open _root_.Aiur.NativeAIR.Quotient (horner)
+
+def foldCoefficients [OfNat R 0] [Add R] [Mul R] (arity : Domain.Subgroup) (challenge : R)
+    (coefficients : List R) : List R :=
+  if _empty : coefficients = [] then []
+  else horner challenge (coefficients.take (Domain.size arity)) ::
+    foldCoefficients arity challenge (coefficients.drop (Domain.size arity))
+termination_by coefficients.length
+decreasing_by
+  have positive := (show 0 < Domain.size arity from Nat.two_pow_pos arity.val)
+  have nonempty := List.length_pos_iff.mpr _empty
+  simp only [List.length_drop]
+  omega
+
+def rowCoefficients [OfNat R 0] [Add R] [Mul R] (arity : Domain.Subgroup) (point : R)
+    (coefficients : List R) : List R :=
+  if _empty : coefficients = [] then []
+  else Polynomial.add (coefficients.take (Domain.size arity))
+    (Polynomial.scale point (rowCoefficients arity point (coefficients.drop (Domain.size arity))))
+termination_by coefficients.length
+decreasing_by
+  have positive := (show 0 < Domain.size arity from Nat.two_pow_pos arity.val)
+  have nonempty := List.length_pos_iff.mpr _empty
+  simp only [List.length_drop]
+  omega
+
+end Aiur.NativeAIR.Folding
diff --git a/Ix/Aiur/FriDomain.lean b/Ix/Aiur/FriDomain.lean
new file mode 100644
index 000000000..19a15e8ae
--- /dev/null
+++ b/Ix/Aiur/FriDomain.lean
@@ -0,0 +1,31 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Domain
+
+/-! Query locations for the pinned two-adic FRI strategy. Indices use
+bit-reversed order. `wordReverse` spells out the native word reversal and
+overflowing right shift; correspondence requires a supported bit count and
+an admitted domain index.
+-/
+
+namespace Aiur.NativeAIR.FriDomain
+
+def reverseBits (bits index : Nat) : Nat := (BitVec.ofNat bits index).reverse.toNat
+
+def wordReverse (wordBits bits index : Nat) : Nat :=
+  ((BitVec.ofNat wordBits index).reverse >>> ((wordBits - bits) % wordBits)).toNat
+
+def queryPoint (domain : Domain.Subgroup) (index : Nat) : G :=
+  (Domain.generator domain).pow (reverseBits domain.val index)
+
+def inputPoint (domain : Domain.Subgroup) (index : Nat) : G := 7 * queryPoint domain index
+
+/-- The interpolation node at `slot` of the native folding row `index`. -/
+def foldNode (parent arity : Domain.Subgroup) (index slot : Nat) : G :=
+  (Domain.generator parent).pow (reverseBits (parent.val - arity.val) index) *
+    (Domain.generator arity).pow (reverseBits arity.val slot)
+
+end Aiur.NativeAIR.FriDomain
diff --git a/Ix/Aiur/FriQuery.lean b/Ix/Aiur/FriQuery.lean
new file mode 100644
index 000000000..d1e14f560
--- /dev/null
+++ b/Ix/Aiur/FriQuery.lean
@@ -0,0 +1,92 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Interpolation
+
+/-! The native FRI query pass: reconstruct a row, fold it, then add at most
+one reduced opening at the new height. Captured rows precede this addition.
+The guards make the private native routine's caller preconditions explicit.
+-/
+
+namespace Aiur.NativeAIR.FriQuery
+
+open ProofCodec (Extension)
+open _root_.Aiur.NativeAIR.Quotient (horner)
+
+def reconstruct (arity : Domain.Subgroup) (index : Nat) (value : R) (siblings : List R) : Option (List R) :=
+  if siblings.length + 1 == Domain.size arity then
+    some (siblings.insertIdx (index % Domain.size arity) value)
+  else none
+
+structure State where
+  domain : Domain.Subgroup
+  index : Nat
+  value : Extension
+  deriving DecidableEq, Repr
+
+structure Round where
+  arity : Domain.Subgroup
+  challenge : Extension
+  siblings : List Extension
+  deriving DecidableEq, Repr
+
+structure Row where
+  domain : Domain.Subgroup
+  index : Nat
+  values : List Extension
+  deriving DecidableEq, Repr
+
+def roll (height : Nat) (factor value : Extension) : List (Nat × Extension) →
+    Extension × List (Nat × Extension)
+  | [] => (value, [])
+  | (nextHeight, next) :: rest =>
+    if nextHeight == height then (value + factor * next, rest)
+    else (value, (nextHeight, next) :: rest)
+
+structure StepResult where
+  state : State
+  remaining : List (Nat × Extension)
+  row : Row
+  deriving DecidableEq, Repr
+
+def step (state : State) (round : Round) (openings : List (Nat × Extension)) : Option StepResult := do
+  if round.arity.val == 0 || round.arity.val > state.domain.val then none
+  else
+    let child ← Domain.ofLogSize (state.domain.val - round.arity.val)
+    let values ← reconstruct round.arity state.index state.value round.siblings
+    let index := state.index / Domain.size round.arity
+    let folded ← Interpolation.foldRow state.domain round.arity index values round.challenge
+    let (value, remaining) := roll child.val (round.challenge.power (Domain.size round.arity)) folded openings
+    return ⟨⟨child, index, value⟩, remaining, ⟨child, index, values⟩⟩
+
+structure Result where
+  state : State
+  rows : List Row
+  deriving DecidableEq, Repr
+
+def walk (final : Domain.Subgroup) (state : State) (openings : List (Nat × Extension)) :
+    List Round → Option Result
+  | [] => if state.domain == final && openings.isEmpty then some ⟨state, []⟩ else none
+  | round :: rest => do
+    let result ← step state round openings
+    let tail ← walk final result.state result.remaining rest
+    return ⟨tail.state, result.row :: tail.rows⟩
+
+def run (initial final : Domain.Subgroup) (index : Nat) (openings : List (Nat × Extension))
+    (rounds : List Round) : Option Result := do
+  if index ≥ Domain.size initial then none
+  else match openings with
+    | [] => none
+    | (height, value) :: rest =>
+      if height == initial.val then walk final ⟨initial, index, value⟩ rest rounds else none
+
+def check (initial final : Domain.Subgroup) (index : Nat) (openings : List (Nat × Extension))
+    (rounds : List Round) (finalPolynomial : List Extension) : Option Result := do
+  let result ← run initial final index openings rounds
+  if horner (Extension.ofBase (FriDomain.queryPoint initial result.state.index)) finalPolynomial == result.state.value then
+    some result
+  else none
+
+end Aiur.NativeAIR.FriQuery
diff --git a/Ix/Aiur/Interpolation.lean b/Ix/Aiur/Interpolation.lean
new file mode 100644
index 000000000..6a09a3e8c
--- /dev/null
+++ b/Ix/Aiur/Interpolation.lean
@@ -0,0 +1,59 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Polynomial
+import Ix.Aiur.LogUp
+
+/-! Coefficients and evaluation of the native FRI row interpolant.
+The evaluator preserves the native early return at a node. Elsewhere it
+checks every inverse; the domain proofs establish that these checks succeed.
+-/
+
+namespace Aiur.NativeAIR.Interpolation
+
+def derivativeValue [OfNat R 0] [Add R] [Mul R] (point : R) : List R → R
+  | [] => 0
+  | _ :: rest => Quotient.horner point rest + point * derivativeValue point rest
+
+def combine [OfNat R 0] [Add R] [Mul R] (vanishing : List R) (scale : R) :
+    List (R × R) → List R
+  | [] => []
+  | (root, value) :: rest =>
+    Polynomial.add (Polynomial.scale (value * (root * scale)) (Polynomial.divide root vanishing))
+      (combine vanishing scale rest)
+
+def coefficients [OfNat R 0] [OfNat R 1] [Add R] [Sub R] [Mul R]
+    (samples : List (R × R)) (scale : R) : List R :=
+  combine (Polynomial.fromRoots (samples.map Prod.fst)) scale samples
+
+open ProofCodec (Extension)
+
+def weightedSum (scale point : Extension) : List (Extension × Extension) → Option Extension
+  | [] => some 0
+  | (root, value) :: rest => do
+    let inverse ← (point - root).tryInverse
+    let tail ← weightedSum scale point rest
+    return value * (root * scale) * inverse + tail
+
+def evaluate (scale point : Extension) (samples : List (Extension × Extension)) : Option Extension :=
+  match samples.find? (fun sample => point == sample.1) with
+  | some sample => some sample.2
+  | none => do
+    let sum ← weightedSum scale point samples
+    return sum * LogUp.product (samples.map (fun sample => point - sample.1))
+
+def foldSamples (parent arity : Domain.Subgroup) (index : Nat) (values : List Extension) :
+    List (Extension × Extension) :=
+  ((Polynomial.foldingNodes parent arity index).map Extension.ofBase).zip values
+
+def foldScale (parent arity : Domain.Subgroup) (index : Nat) : G :=
+  (G.ofNat (Domain.size arity) * (FriDomain.foldNode parent arity index 0).pow (Domain.size arity)).inverse
+
+def foldRow (parent arity : Domain.Subgroup) (index : Nat) (values : List Extension)
+    (point : Extension) : Option Extension :=
+  if arity.val > parent.val || index ≥ 2^(parent.val - arity.val) || values.length != Domain.size arity then none
+  else evaluate (Extension.ofBase (foldScale parent arity index)) point (foldSamples parent arity index values)
+
+end Aiur.NativeAIR.Interpolation
diff --git a/Ix/Aiur/KeyCodec.lean b/Ix/Aiur/KeyCodec.lean
new file mode 100644
index 000000000..335fede0d
--- /dev/null
+++ b/Ix/Aiur/KeyCodec.lean
@@ -0,0 +1,239 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ExpressionGraph
+
+/-! Total host codec for the dense v5 verifying-key format in `vk_codec.rs`.
+The decoded graph retains every serialized field. Derived widths, degrees,
+lookup prefixes and constraint counts use the native Goldilocks extension
+degree two. This module does not implement the PCS or instantiate a native
+verifier refinement assumption. -/
+
+namespace Aiur.NativeAIR.KeyCodec
+
+abbrev Reader := StateT (List UInt8) Option
+
+def readByte : Reader UInt8
+  | [] => none
+  | byte :: rest => some (byte, rest)
+
+def readNat : Nat → Reader Nat
+  | 0 => pure 0
+  | count + 1 => do
+    let byte ← readByte
+    let rest ← readNat count
+    return byte.toNat + 256 * rest
+
+def readMany (read : Reader α) : Nat → Reader (List α)
+  | 0 => pure []
+  | count + 1 => do
+    let first ← read
+    let rest ← readMany read count
+    return first :: rest
+
+def readVector (read : Reader α) : Reader (List α) := do
+  readMany read (← readNat 2)
+
+def encodeNat : Nat → Nat → List UInt8
+  | 0, _ => []
+  | count + 1, value => value.toUInt8 :: encodeNat count (value / 256)
+
+def encodeVector (encode : α → List UInt8) (values : List α) : List UInt8 :=
+  encodeNat 2 values.length ++ values.flatMap encode
+
+def readNode : Reader Node := do
+  match (← readByte).toNat with
+  | 0 => return .konst (G.ofNat (← readNat 2))
+  | 1 => return .konst (G.ofNat (← readNat 8))
+  | 2 => return .publicInput (← readNat 1)
+  | 3 => return .isFirstRow
+  | 4 => return .isLastRow
+  | 5 => return .isTransition
+  | 6 => return .add (← readNat 2) (← readNat 2)
+  | 7 => return .sub (← readNat 2) (← readNat 2)
+  | 8 => return .mul (← readNat 2) (← readNat 2)
+  | 9 => return .neg (← readNat 2)
+  | 10 => return .var ⟨.preprocessed, .current, ← readNat 2⟩
+  | 11 => return .var ⟨.preprocessed, .next, ← readNat 2⟩
+  | 12 => return .var ⟨.main, .current, ← readNat 2⟩
+  | 13 => return .var ⟨.main, .next, ← readNat 2⟩
+  | 14 => return .var ⟨.stage2, .current, ← readNat 2⟩
+  | 15 => return .var ⟨.stage2, .next, ← readNat 2⟩
+  | _ => failure
+
+def encodeNode : Node → List UInt8
+  | .konst value => if value.n < 65536 then 0 :: encodeNat 2 value.n else 1 :: encodeNat 8 value.n
+  | .publicInput index => 2 :: encodeNat 1 index
+  | .isFirstRow => [3]
+  | .isLastRow => [4]
+  | .isTransition => [5]
+  | .add a b => 6 :: (encodeNat 2 a ++ encodeNat 2 b)
+  | .sub a b => 7 :: (encodeNat 2 a ++ encodeNat 2 b)
+  | .mul a b => 8 :: (encodeNat 2 a ++ encodeNat 2 b)
+  | .neg child => 9 :: encodeNat 2 child
+  | .var column =>
+    let tag : UInt8 := match column.source, column.offset with
+      | .preprocessed, .current => 10 | .preprocessed, .next => 11
+      | .main, .current => 12 | .main, .next => 13
+      | .stage2, .current => 14 | .stage2, .next => 15
+    tag :: encodeNat 2 column.index
+
+def readLookup : Reader Lookup := do
+  let multiplicity ← readNat 2
+  let args ← readVector (readNat 2)
+  return ⟨multiplicity, args⟩
+
+def encodeLookup (lookup : Lookup) : List UInt8 :=
+  encodeNat 2 lookup.multiplicity ++ encodeVector (encodeNat 2) lookup.args
+
+structure Circuit where
+  mainWidth : Nat
+  preprocessedWidth : Nat
+  preprocessedHeight : Nat
+  maxConstraintDegree : Nat
+  lookupGroupSize : Nat
+  graph : Graph
+  deriving DecidableEq, Repr
+
+def Circuit.groups (circuit : Circuit) : Nat :=
+  max 1 ((circuit.graph.lookups.length + circuit.lookupGroupSize - 1) / circuit.lookupGroupSize)
+
+def Circuit.widths (circuit : Circuit) : GraphWidths :=
+  ⟨circuit.preprocessedWidth, circuit.mainWidth, circuit.groups * 2, 8⟩
+
+def Circuit.constraintCount (circuit : Circuit) : Nat :=
+  circuit.graph.zeros.length + circuit.groups * 2
+
+def nodeDegree (degrees : Array Nat) : Node → Option Nat
+  | .konst _ | .publicInput _ | .isTransition => some 0
+  | .var _ | .isFirstRow | .isLastRow => some 1
+  | .add a b | .sub a b => return max (← degrees[a]?) (← degrees[b]?)
+  | .mul a b => do
+    let sum := (← degrees[a]?) + (← degrees[b]?)
+    if sum < 2^32 then some sum else none
+  | .neg child => degrees[child]?
+
+def nodeDegreesFrom : List Node → Array Nat → Option (Array Nat)
+  | [], degrees => some degrees
+  | node :: nodes, degrees => do
+    nodeDegreesFrom nodes (degrees.push (← nodeDegree degrees node))
+
+def lookupDegrees (degrees : Array Nat) (lookup : Lookup) : Option (Nat × Nat) := do
+  let multiplicity ← degrees[lookup.multiplicity]?
+  let args ← lookup.args.mapM (fun index => degrees[index]?)
+  return (multiplicity, args.foldr max 0)
+
+/-- The at-most-eight-term native analytic logUp degree calculation. `Nat`
+arithmetic agrees with its u64 intermediates when all node degrees fit u32. -/
+def groupDegree (degrees : List (Nat × Nat)) : Nat :=
+  let sum := (degrees.map Prod.snd).sum
+  (degrees.map (fun (multiplicity, message) => multiplicity + sum - message)).foldr max (sum + 1)
+
+def Circuit.computedDegree (circuit : Circuit) : Option Nat := do
+  let degrees ← nodeDegreesFrom circuit.graph.nodes #[]
+  let zeros ← circuit.graph.zeros.mapM (fun index => degrees[index]?)
+  let lookups ← circuit.graph.lookups.mapM (lookupDegrees degrees)
+  let groups := (List.range circuit.groups).map fun index =>
+    groupDegree ((lookups.drop (index * circuit.lookupGroupSize)).take circuit.lookupGroupSize)
+  return groups.foldr max (max 1 (zeros.foldr max 0))
+
+def Circuit.valid (circuit : Circuit) : Bool :=
+  1 ≤ circuit.lookupGroupSize && circuit.lookupGroupSize ≤ 8 &&
+    (checkedGraphPrefix circuit.widths circuit.graph).isSome &&
+    circuit.computedDegree == some circuit.maxConstraintDegree
+
+def readCircuitData : Reader Circuit := do
+  let main ← readNat 2
+  let preprocessed ← readNat 2
+  let height ← readNat 4
+  let degree ← readNat 2
+  let group ← readNat 1
+  let nodes ← readVector readNode
+  let zeros ← readVector (readNat 2)
+  let lookups ← readVector readLookup
+  return ⟨main, preprocessed, height, degree, group, ⟨nodes, zeros, lookups⟩⟩
+
+def readCircuit : Reader Circuit := do
+  let circuit ← readCircuitData
+  if circuit.valid then return circuit else failure
+
+def encodeCircuit (circuit : Circuit) : List UInt8 :=
+  encodeNat 2 circuit.mainWidth ++ encodeNat 2 circuit.preprocessedWidth ++
+  encodeNat 4 circuit.preprocessedHeight ++ encodeNat 2 circuit.maxConstraintDegree ++
+  encodeNat 1 circuit.lookupGroupSize ++ encodeVector encodeNode circuit.graph.nodes ++
+  encodeVector (encodeNat 2) circuit.graph.zeros ++ encodeVector encodeLookup circuit.graph.lookups
+
+structure Parameters where
+  logBlowup : Nat
+  capHeight : Nat
+  logFinalPolyLen : Nat
+  maxLogArity : Nat
+  numQueries : Nat
+  commitProofOfWorkBits : Nat
+  queryProofOfWorkBits : Nat
+  deriving DecidableEq, Repr
+
+def readParameters : Reader Parameters := do
+  return ⟨← readNat 2, ← readNat 2, ← readNat 2, ← readNat 2,
+    ← readNat 2, ← readNat 2, ← readNat 2⟩
+
+def encodeParameters (parameters : Parameters) : List UInt8 :=
+  [parameters.logBlowup, parameters.capHeight, parameters.logFinalPolyLen,
+    parameters.maxLogArity, parameters.numQueries, parameters.commitProofOfWorkBits,
+    parameters.queryProofOfWorkBits].flatMap (encodeNat 2)
+
+abbrev MerkleCap := List (List UInt8)
+
+def readCommitment : Reader (Option MerkleCap) := do
+  match (← readByte).toNat with
+  | 0 => return none
+  | 1 =>
+    let cap ← readVector (readMany readByte 32)
+    if cap.length.isPowerOfTwo then return some cap else failure
+  | _ => failure
+
+def encodeCommitment : Option MerkleCap → List UInt8
+  | none => [0]
+  | some cap => 1 :: encodeVector id cap
+
+def readIndex : Reader (Option Nat) := do
+  let index ← readNat 2
+  return if index = 65535 then none else some index
+
+def encodeIndex (index : Option Nat) : List UInt8 :=
+  encodeNat 2 (index.getD 65535)
+
+structure Key where
+  parameters : Parameters
+  circuits : List Circuit
+  preprocessedCommitment : Option MerkleCap
+  preprocessedIndices : List (Option Nat)
+  deriving DecidableEq, Repr
+
+def readKey : Reader Key := do
+  let parameters ← readParameters
+  let circuits ← readVector readCircuit
+  let commitment ← readCommitment
+  let indices ← readMany readIndex circuits.length
+  return ⟨parameters, circuits, commitment, indices⟩
+
+def encodeKey (key : Key) : List UInt8 :=
+  encodeParameters key.parameters ++ encodeVector encodeCircuit key.circuits ++
+  encodeCommitment key.preprocessedCommitment ++ key.preprocessedIndices.flatMap encodeIndex
+
+/-- Complete consumption is mandatory; an extra suffix is not another key. -/
+def decode (bytes : ByteArray) : Option Key := do
+  let (key, rest) ← readKey bytes.data.toList
+  if rest.isEmpty then some key else none
+
+def encode (key : Key) : ByteArray := (encodeKey key).toByteArray
+
+/-- Optional canonical-byte gate. The native decoder also accepts big-tag
+small constants and reduces u64 field constants; canonical encoding does not. -/
+def decodeCanonical (bytes : ByteArray) : Option Key := do
+  let key ← decode bytes
+  if encode key = bytes then some key else none
+
+end Aiur.NativeAIR.KeyCodec
diff --git a/Ix/Aiur/LogUp.lean b/Ix/Aiur/LogUp.lean
new file mode 100644
index 000000000..17eb25d09
--- /dev/null
+++ b/Ix/Aiur/LogUp.lean
@@ -0,0 +1,81 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.LookupCoordinates
+
+/-! Checked degree-two logUp evaluation. Every external node and coordinate
+read is optional. Group zero has the native normalization to one; groups above
+eight are rejected. The returned list retains both coordinates in native order.
+Prefix and suffix scans include multiplication by one at their endpoints;
+ring reflection relates these to the native seeded scans. -/
+
+namespace Aiur.NativeAIR.LogUp
+
+def product [OfNat R 1] [Mul R] (values : List R) : R := values.foldr (· * ·) 1
+def sum [OfNat R 0] [Add R] (values : List R) : R := values.foldr (· + ·) 0
+
+/-- Denominator-cleared weighted numerator, defined without division. -/
+def numerator [OfNat R 0] [OfNat R 1] [Add R] [Mul R] : List (R × R) → R
+  | [] => 0
+  | (weight, message) :: rest =>
+    weight * product (rest.map Prod.snd) + message * numerator rest
+
+def prefixSuffixTerms [OfNat R 1] [Mul R] (initial : R) (entries : List (R × R)) : List R :=
+  let messages := entries.map Prod.snd
+  let prefixes := messages.scanl (· * ·) initial
+  let suffixes := (messages.scanr (· * ·) 1).tail
+  (entries.zip (prefixes.zip suffixes)).map fun (entry, before, after) => before * after * entry.1
+
+def groupEquation [OfNat R 0] [OfNat R 1] [Add R] [Sub R] [Mul R]
+    (entries : List (R × R)) (difference : R) : R :=
+  match entries with
+  | [] => difference
+  | [(weight, message)] => message * difference - weight
+  | _ => (entries.map Prod.snd).foldl (· * ·) 1 * difference -
+      (prefixSuffixTerms 1 entries).foldl (· + ·) 0
+
+section Evaluation
+
+variable {W : Type u} [OfNat W 0] [OfNat W 1] [OfNat W 7] [Add W] [Sub W] [Mul W]
+
+def fingerprint (gamma : Coordinates W) (args : List W) : Coordinates W :=
+  args.foldr (fun arg acc => acc * gamma + Coordinates.ofBase arg) 0
+
+def compress (beta gamma : Coordinates W) (lookups : List (W × List W)) :
+    List (Coordinates W × Coordinates W) :=
+  lookups.map fun (multiplicity, args) =>
+    (Coordinates.ofBase multiplicity, fingerprint gamma args + beta)
+
+def groupCount (groupSize lookupCount : Nat) : Nat :=
+  max 1 ((lookupCount + max groupSize 1 - 1) / max groupSize 1)
+
+def chunk (groupSize index : Nat) (lookups : List α) : List α :=
+  (lookups.drop (index * max groupSize 1)).take (max groupSize 1)
+
+def step (beta gamma injection next : Coordinates W) (stageCurrent : Array W)
+    (lookups : List (W × List W)) (groupSize index : Nat) : Option (Coordinates W) := do
+  let source ← Coordinates.read stageCurrent index
+  let target ← if index + 1 < groupCount groupSize lookups.length then Coordinates.read stageCurrent (index + 1)
+    else some (next + injection)
+  return groupEquation (compress beta gamma (chunk groupSize index lookups)) (target - source)
+
+def equations (lookups : List (W × List W)) (stageCurrent stageNext publics deltaScaled : Array W)
+    (isLast : W) (groupSize : Nat) : Option (List (Coordinates W)) := do
+  if 8 < groupSize then none else do
+    let beta ← Coordinates.read publics 0
+    let gamma ← Coordinates.read publics 1
+    let delta ← Coordinates.read deltaScaled 0
+    let injection := delta.scale isLast
+    let next ← Coordinates.read stageNext 0
+    let groups := groupCount groupSize lookups.length
+    (List.range groups).mapM (step beta gamma injection next stageCurrent lookups groupSize)
+
+def constraintValues (lookups : List Lookup) (nodeValues stageCurrent stageNext publics deltaScaled : Array W)
+    (isLast : W) (groupSize : Nat) : Option (List W) := do
+  let values ← lookups.mapM (readLookup nodeValues)
+  return Coordinates.flatten (← equations values stageCurrent stageNext publics deltaScaled isLast groupSize)
+
+end Evaluation
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/LookupCoordinates.lean b/Ix/Aiur/LookupCoordinates.lean
new file mode 100644
index 000000000..125702e54
--- /dev/null
+++ b/Ix/Aiur/LookupCoordinates.lean
@@ -0,0 +1,50 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Extension
+
+/-! The two coordinates checked by native degree-two logUp. At an opening
+point each coordinate is itself a challenge-field value. The two coordinates
+must remain separate there; this quadratic algebra need not be a field. -/
+
+namespace Aiur.NativeAIR.LogUp
+
+structure Coordinates (W : Type u) where
+  c0 : W
+  c1 : W
+  deriving DecidableEq, Repr
+
+namespace Coordinates
+
+def ofBase [OfNat W 0] (value : W) : Coordinates W := ⟨value, 0⟩
+
+instance ofNat [OfNat W n] [OfNat W 0] : OfNat (Coordinates W) n :=
+  ⟨ofBase (OfNat.ofNat n)⟩
+instance add [Add W] : Add (Coordinates W) := ⟨fun a b => ⟨a.c0 + b.c0, a.c1 + b.c1⟩⟩
+instance sub [Sub W] : Sub (Coordinates W) := ⟨fun a b => ⟨a.c0 - b.c0, a.c1 - b.c1⟩⟩
+instance neg [Neg W] : Neg (Coordinates W) := ⟨fun a => ⟨-a.c0, -a.c1⟩⟩
+
+/-- The native `mul2` Karatsuba formula, with the pinned nonresidue 7. -/
+instance mul [OfNat W 7] [Add W] [Sub W] [Mul W] : Mul (Coordinates W) := ⟨fun a b =>
+  let v0 := a.c0 * b.c0
+  let v1 := a.c1 * b.c1
+  ⟨v0 + v1 * 7, (a.c0 + a.c1) * (b.c0 + b.c1) - v0 - v1⟩⟩
+
+def scale [Mul W] (value : Coordinates W) (scalar : W) : Coordinates W :=
+  ⟨value.c0 * scalar, value.c1 * scalar⟩
+
+def map (f : W → V) (value : Coordinates W) : Coordinates V := ⟨f value.c0, f value.c1⟩
+
+def read (values : Array W) (slot : Nat) : Option (Coordinates W) := do
+  return ⟨← values[2 * slot]?, ← values[2 * slot + 1]?⟩
+
+def flatten (values : List (Coordinates W)) : List W := values.flatMap fun value => [value.c0, value.c1]
+
+/-- Only base-field coordinates have this identification with the native field. -/
+def toExtension (value : Coordinates G) : ProofCodec.Extension := ⟨value.c0, value.c1⟩
+def fromExtension (value : ProofCodec.Extension) : Coordinates G := ⟨value.c0, value.c1⟩
+
+end Coordinates
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/LookupShapes.lean b/Ix/Aiur/LookupShapes.lean
new file mode 100644
index 000000000..68bc15db1
--- /dev/null
+++ b/Ix/Aiur/LookupShapes.lean
@@ -0,0 +1,114 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+module
+public import Ix.Aiur.Stages.Bytecode
+
+/-!
+Total structural checks for the boundaries of zero-padded lookup messages.
+
+Function messages contain the function index, inputs, outputs and rank,
+without length separators. Calls must use their callee's input and return
+arities. Public result arity is checked separately against the entry body.
+These checks do not establish value-index or circuit-layout correctness.
+-/
+
+public section
+@[expose] section
+
+namespace Aiur.Bytecode
+
+private theorem block_ctrl_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+/-- Check every function return, including early returns from continuation
+arms. A yield returns to its enclosing continuation, not the function. -/
+def Ctrl.returnsHaveSize (size : Nat) : Ctrl → Bool
+  | .return _ values => values.size == size
+  | .yield .. => true
+  | .match _ branches fallback =>
+    branches.attach.all (fun ⟨(_, block), _⟩ => block.returnsHaveSize size) &&
+      (match fallback with | none => true | some block => block.returnsHaveSize size)
+  | .matchContinue _ branches fallback _ _ _ continuation =>
+    branches.attach.all (fun ⟨(_, block), _⟩ => block.returnsHaveSize size) &&
+      ((match fallback with | none => true | some block => block.returnsHaveSize size) &&
+        continuation.returnsHaveSize size)
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.returnsHaveSize (size : Nat) (block : Block) : Bool :=
+  block.ctrl.returnsHaveSize size
+termination_by sizeOf block
+decreasing_by exact block_ctrl_smaller block
+
+end
+
+def Op.lookupShape (program : Toplevel) : Op → Bool
+  | .call index inputs outputs false =>
+    match program.functions[index]? with
+    | none => false
+    | some callee => callee.constrained &&
+        (callee.layout.inputSize == inputs.size && callee.body.returnsHaveSize outputs)
+  | .store values => decide (values.size < gSize.toNat)
+  | .load size _ => decide (size < gSize.toNat)
+  | _ => true
+
+mutual
+
+def Ctrl.lookupShapes (program : Toplevel) (yieldSize : Option Nat) : Ctrl → Bool
+  | .return .. => true
+  | .yield _ values => yieldSize == some values.size
+  | .match _ branches fallback =>
+    branches.attach.all (fun ⟨(_, block), _⟩ => block.lookupShapes program yieldSize) &&
+      (match fallback with | none => true | some block => block.lookupShapes program yieldSize)
+  | .matchContinue _ branches fallback size _ _ continuation =>
+    branches.attach.all (fun ⟨(_, block), _⟩ => block.lookupShapes program (some size)) &&
+      ((match fallback with | none => true | some block => block.lookupShapes program (some size)) &&
+        continuation.lookupShapes program yieldSize)
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.lookupShapes (program : Toplevel) (yieldSize : Option Nat) (block : Block) : Bool :=
+  block.ops.all (Op.lookupShape program) && block.ctrl.lookupShapes program yieldSize
+termination_by sizeOf block
+decreasing_by exact block_ctrl_smaller block
+
+end
+
+/-- Mirror the native construction guard, including canonical function
+indices, canonical memory widths and continuation-yield arities. -/
+def Toplevel.validateLookupShapes (program : Toplevel) : Bool :=
+  decide (program.functions.size < gSize.toNat) &&
+    (program.memorySizes.all (fun size => decide (size < gSize.toNat)) &&
+      program.functions.all (fun function =>
+        !function.constrained || function.body.lookupShapes program none))
+
+/-- A public claim names a constrained public function and has exactly its
+input and return widths. The final zero rank is omitted from this encoding. -/
+def Toplevel.validClaimShape (program : Toplevel) (claim : Array G) : Bool :=
+  match claim.toList with
+  | channel :: index :: arguments =>
+    channel == 0 &&
+      (match program.functions[index.n]? with
+      | none => false
+      | some function => function.entry && function.constrained &&
+          (decide (function.layout.inputSize ≤ arguments.length) &&
+            function.body.returnsHaveSize (arguments.length - function.layout.inputSize)))
+  | _ => false
+
+end Aiur.Bytecode
+
+end
+end
diff --git a/Ix/Aiur/Merkle.lean b/Ix/Aiur/Merkle.lean
new file mode 100644
index 000000000..5509d7269
--- /dev/null
+++ b/Ix/Aiur/Merkle.lean
@@ -0,0 +1,113 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Blake3
+import Ix.Aiur.MerkleCap
+
+/-! Binary MMCS paths for verifier-selected power-of-two matrix heights.
+Rows at the same height retain their original matrix order. Every ordinary
+BLAKE3 input is retained, including both hashes around a shorter-row
+injection. Shared, pruned openings are a separate verification algorithm.
+-/
+
+namespace Aiur.NativeAIR.Merkle
+
+abbrev Digest := Blake3.Digest
+abbrev Hash := List UInt8 → Digest
+
+structure Dimensions where
+  width : Nat
+  logHeight : Nat
+  deriving DecidableEq, Repr
+
+def maxHeight (dimensions : List Dimensions) : Nat :=
+  MerkleCap.maxDegree (dimensions.map Dimensions.logHeight)
+
+def shape : List Dimensions → List (List G) → Bool
+  | [], [] => true
+  | dimension :: dimensions, row :: rows => row.length == dimension.width && shape dimensions rows
+  | _, _ => false
+
+def hasHeight (dimensions : List Dimensions) (height : Nat) : Bool :=
+  dimensions.any fun dimension => dimension.logHeight == height
+
+def rowsAt : List Dimensions → List (List G) → Nat → List (List G)
+  | dimension :: dimensions, row :: rows, height =>
+    if dimension.logHeight = height then row :: rowsAt dimensions rows height
+    else rowsAt dimensions rows height
+  | _, _, _ => []
+
+def rowBytes (dimensions : List Dimensions) (rows : List (List G)) (height : Nat) : List UInt8 :=
+  Transcript.fieldsBytes (rowsAt dimensions rows height).flatten
+
+def pairBytes (left right : Digest) : List UInt8 := left.toList ++ right.toList
+
+def branchBytes (index : Nat) (current sibling : Digest) : List UInt8 :=
+  if index % 2 = 0 then pairBytes current sibling else pairBytes sibling current
+
+structure Hashing where
+  digest : Digest
+  inputs : List (List UInt8)
+  deriving DecidableEq, Repr
+
+/-- `height` is the next layer, after pairing the current node and sibling. -/
+def step (hash : Hash) (dimensions : List Dimensions) (rows : List (List G))
+    (height index : Nat) (current sibling : Digest) : Hashing :=
+  let input := branchBytes index current sibling
+  let parent := hash input
+  if hasHeight dimensions height then
+    let leaf := rowBytes dimensions rows height
+    let inject := pairBytes parent (hash leaf)
+    ⟨hash inject, [input, leaf, inject]⟩
+  else ⟨parent, [input]⟩
+
+def walk (hash : Hash) (dimensions : List Dimensions) (rows : List (List G))
+    (height index : Nat) (current : Digest) : List Digest → Hashing
+  | [] => ⟨current, []⟩
+  | sibling :: proof =>
+    let first := step hash dimensions rows (height - 1) index current sibling
+    let rest := walk hash dimensions rows (height - 1) (index / 2) first.digest proof
+    ⟨rest.digest, first.inputs ++ rest.inputs⟩
+
+structure Replay where
+  logHeight : Nat
+  index : Nat
+  hashing : Hashing
+  deriving DecidableEq, Repr
+
+/-- Structural failure precedes hashing, as in native individual verification.
+The raw replay preserves the native omission of rows below the cap. -/
+def replay (hash : Hash) (dimensions : List Dimensions) (capHeight index : Nat)
+    (rows : List (List G)) (proof : List Digest) : Option Replay :=
+  let height := maxHeight dimensions
+  if dimensions.isEmpty || !shape dimensions rows ||
+      proof.length != height - capHeight || !(index < 2^height) then none
+  else
+    let leaf := rowBytes dimensions rows height
+    let result := walk hash dimensions rows height index (hash leaf) proof
+    some ⟨height - proof.length, index / 2^proof.length, ⟨result.digest, leaf :: result.inputs⟩⟩
+
+def accepts (cap : List Digest) (result : Replay) : Bool :=
+  cap[result.index]? == some result.hashing.digest
+
+def verify (hash : Hash) (dimensions : List Dimensions) (capHeight index : Nat)
+    (cap : List Digest) (rows : List (List G)) (proof : List Digest) : Bool :=
+  match replay hash dimensions capHeight index rows proof with
+  | none => false
+  | some result => accepts cap result
+
+def covered (dimensions : List Dimensions) (capHeight : Nat) : Bool :=
+  MerkleCap.coverage 0 capHeight (dimensions.map Dimensions.logHeight)
+
+def verifyCovered (hash : Hash) (dimensions : List Dimensions) (capHeight index : Nat)
+    (cap : List Digest) (rows : List (List G)) (proof : List Digest) : Bool :=
+  covered dimensions capHeight && verify hash dimensions capHeight index cap rows proof
+
+/-- A collision among the inputs actually queried by these replays. This is
+finite and gives an explicit witness; it does not assert global injectivity. -/
+def CollisionOn (hash : Hash) (inputs : List (List UInt8)) : Prop :=
+  ∃ left ∈ inputs, ∃ right ∈ inputs, left ≠ right ∧ hash left = hash right
+
+end Aiur.NativeAIR.Merkle
diff --git a/Ix/Aiur/MerkleCap.lean b/Ix/Aiur/MerkleCap.lean
new file mode 100644
index 000000000..51040dca4
--- /dev/null
+++ b/Ix/Aiur/MerkleCap.lean
@@ -0,0 +1,24 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofShape
+
+/-! A binary MMCS cap must retain every matrix injection. Heights here are
+logarithms of power-of-two row counts. Subtracting the common LDE blowup
+before comparing avoids machine addition overflow in the native guard.
+-/
+
+namespace Aiur.NativeAIR.MerkleCap
+
+def maxDegree (degrees : List Nat) : Nat := degrees.foldr max 0
+
+def coverage (logBlowup capHeight : Nat) (degrees : List Nat) : Bool :=
+  let effective := min (capHeight - logBlowup) (maxDegree degrees)
+  degrees.all fun degree => effective ≤ degree
+
+def check (key : KeyCodec.Key) (proof : ProofCodec.Data) : Bool :=
+  coverage key.parameters.logBlowup key.parameters.capHeight (proof.logDegrees.map UInt8.toNat)
+
+end Aiur.NativeAIR.MerkleCap
diff --git a/Ix/Aiur/Polynomial.lean b/Ix/Aiur/Polynomial.lean
new file mode 100644
index 000000000..a93f9d83c
--- /dev/null
+++ b/Ix/Aiur/Polynomial.lean
@@ -0,0 +1,52 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Quotient
+import Ix.Aiur.FriDomain
+
+/-! Coefficients in the native verifier's ascending-power convention.
+Trailing zeros are permitted. Synthetic division lowers the coefficient
+length without assuming an evaluation point is a root.
+-/
+
+namespace Aiur.NativeAIR.Polynomial
+
+def IsZero [OfNat R 0] (coefficients : List R) : Prop :=
+  ∀ coefficient ∈ coefficients, coefficient = 0
+
+def Monic [OfNat R 1] (coefficients : List R) : Prop :=
+  ∃ initial, coefficients = initial ++ [1]
+
+def add [Add R] : List R → List R → List R
+  | [], right => right
+  | left, [] => left
+  | first :: left, second :: right => (first + second) :: add left right
+
+def sub [OfNat R 0] [Sub R] : List R → List R → List R
+  | [], right => right.map (0 - ·)
+  | left, [] => left
+  | first :: left, second :: right => (first - second) :: sub left right
+
+def scale [Mul R] (scalar : R) (coefficients : List R) : List R :=
+  coefficients.map (scalar * ·)
+
+def mulLinear [OfNat R 0] [Sub R] [Mul R] (root : R) (coefficients : List R) : List R :=
+  sub (0 :: coefficients) (scale root coefficients)
+
+def fromRoots [OfNat R 0] [OfNat R 1] [Sub R] [Mul R] (roots : List R) : List R :=
+  roots.foldr mulLinear [1]
+
+def powerMinus [OfNat R 0] [OfNat R 1] [Sub R] (degree : Nat) (constant : R) : List R :=
+  sub (List.replicate degree 0 ++ [1]) [constant]
+
+def divide [OfNat R 0] [Add R] [Mul R] (point : R) : List R → List R
+  | [] => []
+  | [_] => []
+  | _ :: next :: rest => Quotient.horner point (next :: rest) :: divide point (next :: rest)
+
+def foldingNodes (parent arity : Domain.Subgroup) (index : Nat) : List G :=
+  (List.range (Domain.size arity)).map (FriDomain.foldNode parent arity index)
+
+end Aiur.NativeAIR.Polynomial
diff --git a/Ix/Aiur/ProofCodec.lean b/Ix/Aiur/ProofCodec.lean
new file mode 100644
index 000000000..8c4b6673e
--- /dev/null
+++ b/Ix/Aiur/ProofCodec.lean
@@ -0,0 +1,168 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.KeyCodec
+
+/-! Total codec for the pinned CPU Goldilocks/Blake3 multi-STARK proof.
+The native bincode configuration uses little-endian fixed-width integers,
+u64 vector lengths, one-byte booleans/options, and fixed arrays without a
+length prefix. Extension elements have two canonical Goldilocks coordinates.
+
+Every opening and authentication digest is retained. Parsing establishes
+byte framing only; proof shape, transcript checks and cryptographic meaning
+are separate obligations. Native `from_bytes` permits a trailing suffix;
+`decode` deliberately requires complete consumption.
+-/
+
+namespace Aiur.NativeAIR.ProofCodec
+
+open KeyCodec (Reader readByte readNat readMany encodeNat)
+
+structure Extension where
+  c0 : G
+  c1 : G
+  deriving DecidableEq, Repr
+
+abbrev Digest := List UInt8
+abbrev Cap := List Digest
+abbrev Openings (α : Type) := List (List (List α))
+
+def readVector (read : Reader α) : Reader (List α) := do
+  readMany read (← readNat 8)
+
+def encodeVector (encode : α → List UInt8) (values : List α) : List UInt8 :=
+  encodeNat 8 values.length ++ values.flatMap encode
+
+def readOption (read : Reader α) : Reader (Option α) := do
+  match (← readByte).toNat with
+  | 0 => return none
+  | 1 => return some (← read)
+  | _ => failure
+
+def encodeOption (encode : α → List UInt8) : Option α → List UInt8
+  | none => [0]
+  | some value => 1 :: encode value
+
+def readBool : Reader Bool := do
+  match (← readByte).toNat with
+  | 0 => return false
+  | 1 => return true
+  | _ => failure
+
+def encodeBool (value : Bool) : List UInt8 := [if value then 1 else 0]
+
+def readField : Reader G := do
+  let value ← readNat 8
+  if value < gSize.toNat then return G.ofNat value else failure
+
+def encodeField (value : G) : List UInt8 := encodeNat 8 value.n
+
+def readExtension : Reader Extension := do
+  return ⟨← readField, ← readField⟩
+
+def encodeExtension (value : Extension) : List UInt8 :=
+  encodeField value.c0 ++ encodeField value.c1
+
+def readCap : Reader Cap := readVector (readMany readByte 32)
+
+def encodeCap (cap : Cap) : List UInt8 := encodeVector id cap
+
+def readOpenings (read : Reader α) : Reader (Openings α) :=
+  readVector (readVector (readVector read))
+
+def encodeOpenings (encode : α → List UInt8) (values : Openings α) : List UInt8 :=
+  encodeVector (encodeVector (encodeVector encode)) values
+
+structure Commitments where
+  stage1 : Cap
+  stage2 : Cap
+  quotient : Cap
+  deriving DecidableEq, Repr
+
+def readCommitments : Reader Commitments := do
+  return ⟨← readCap, ← readCap, ← readCap⟩
+
+def encodeCommitments (value : Commitments) : List UInt8 :=
+  encodeCap value.stage1 ++ encodeCap value.stage2 ++ encodeCap value.quotient
+
+structure BatchOpening where
+  values : Openings G
+  siblingHashes : List Digest
+  deriving DecidableEq, Repr
+
+def readBatchOpening : Reader BatchOpening := do
+  return ⟨← readOpenings readField, ← readCap⟩
+
+def encodeBatchOpening (value : BatchOpening) : List UInt8 :=
+  encodeOpenings encodeField value.values ++ encodeCap value.siblingHashes
+
+structure CommitStep where
+  logArity : UInt8
+  siblingValues : List (List Extension)
+  siblingHashes : List Digest
+  deriving DecidableEq, Repr
+
+def readCommitStep : Reader CommitStep := do
+  return ⟨← readByte, ← readVector (readVector readExtension), ← readCap⟩
+
+def encodeCommitStep (value : CommitStep) : List UInt8 :=
+  value.logArity :: (encodeVector (encodeVector encodeExtension) value.siblingValues ++
+    encodeCap value.siblingHashes)
+
+structure Fri where
+  commits : List Cap
+  commitPowWitnesses : List G
+  inputOpenings : List BatchOpening
+  commitOpenings : List CommitStep
+  finalPoly : List Extension
+  queryPowWitness : G
+  deriving DecidableEq, Repr
+
+def readFri : Reader Fri := do
+  return ⟨← readVector readCap, ← readVector readField,
+    ← readVector readBatchOpening, ← readVector readCommitStep,
+    ← readVector readExtension, ← readField⟩
+
+def encodeFri (value : Fri) : List UInt8 :=
+  encodeVector encodeCap value.commits ++ encodeVector encodeField value.commitPowWitnesses ++
+  encodeVector encodeBatchOpening value.inputOpenings ++ encodeVector encodeCommitStep value.commitOpenings ++
+  encodeVector encodeExtension value.finalPoly ++ encodeField value.queryPowWitness
+
+structure Data where
+  active : List Bool
+  commitments : Commitments
+  accumulators : List Extension
+  logDegrees : List UInt8
+  fri : Fri
+  quotient : Openings Extension
+  preprocessed : Option (Openings Extension)
+  stage1 : Openings Extension
+  stage2 : Openings Extension
+  deriving DecidableEq, Repr
+
+def readData : Reader Data := do
+  return ⟨← readVector readBool, ← readCommitments, ← readVector readExtension,
+    ← readVector readByte, ← readFri, ← readOpenings readExtension,
+    ← readOption (readOpenings readExtension), ← readOpenings readExtension,
+    ← readOpenings readExtension⟩
+
+def encodeData (value : Data) : List UInt8 :=
+  encodeVector encodeBool value.active ++ encodeCommitments value.commitments ++
+  encodeVector encodeExtension value.accumulators ++ encodeVector (fun b => [b]) value.logDegrees ++
+  encodeFri value.fri ++ encodeOpenings encodeExtension value.quotient ++
+  encodeOption (encodeOpenings encodeExtension) value.preprocessed ++
+  encodeOpenings encodeExtension value.stage1 ++ encodeOpenings encodeExtension value.stage2
+
+def decode (bytes : ByteArray) : Option Data := do
+  let (value, rest) ← readData bytes.data.toList
+  if rest.isEmpty then some value else none
+
+def encode (value : Data) : ByteArray := (encodeData value).toByteArray
+
+def decodeCanonical (bytes : ByteArray) : Option Data := do
+  let value ← decode bytes
+  if encode value = bytes then some value else none
+
+end Aiur.NativeAIR.ProofCodec
diff --git a/Ix/Aiur/ProofShape.lean b/Ix/Aiur/ProofShape.lean
new file mode 100644
index 000000000..31f72b70f
--- /dev/null
+++ b/Ix/Aiur/ProofShape.lean
@@ -0,0 +1,108 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofCodec
+import Ix.Aiur.Proofs.ByteColumns
+
+/-! Checked extraction of the native verifier's per-active-circuit opening
+records. This mirrors `System::verify_shape` using checked indexed reads.
+The Aiur guards additionally bind fixed trace heights and the lookup budget.
+Opened values are claims about polynomials; shape checks alone do not prove
+that they arise from a satisfying execution trace.
+-/
+
+namespace Aiur.NativeAIR.ProofShape
+
+open ProofCodec (Extension Data)
+
+structure Pair where
+  current : List Extension
+  next : List Extension
+  deriving DecidableEq, Repr
+
+def pair : List (List Extension) → Option Pair
+  | [current, next] => some ⟨current, next⟩
+  | _ => none
+
+def single : List α → Option α
+  | [value] => some value
+  | _ => none
+
+def activeIndices (proof : Data) : List Nat :=
+  proof.active.zipIdx.filterMap fun (active, index) => if active then some index else none
+
+def quotientDegree (circuit : KeyCodec.Circuit) : Nat :=
+  (max circuit.maxConstraintDegree 2 - 1).nextPowerOfTwo
+
+structure Row where
+  circuitIndex : Nat
+  circuit : KeyCodec.Circuit
+  logDegree : UInt8
+  stage1 : Pair
+  stage2 : Pair
+  preprocessed : Option Pair
+  quotient : List Extension
+  accumulator : Extension
+  deriving DecidableEq, Repr
+
+def readPreprocessed (proof : Data) : Option Nat → Option (Option Pair)
+  | none => some none
+  | some slot => (proof.preprocessed >>= fun opened => opened[slot]? >>= pair).map some
+
+def readRow (key : KeyCodec.Key) (proof : Data) (index position : Nat) : Option Row := do
+  let circuit ← key.circuits[index]?
+  let preprocessedIndex ← key.preprocessedIndices[index]?
+  let degree ← proof.logDegrees[position]?
+  let stage1 ← pair (← proof.stage1[position]?)
+  let stage2 ← pair (← proof.stage2[position]?)
+  let quotient ← single (← proof.quotient[position]?)
+  let accumulator ← proof.accumulators[position]?
+  let preprocessed ← readPreprocessed proof preprocessedIndex
+  return ⟨index, circuit, degree, stage1, stage2, preprocessed, quotient, accumulator⟩
+
+def Pair.hasWidth (values : Pair) (width : Nat) : Bool :=
+  values.current.length == width && values.next.length == width
+
+def Row.fits (parameters : KeyCodec.Parameters) (row : Row) : Bool :=
+  row.stage1.hasWidth row.circuit.mainWidth && row.stage2.hasWidth row.circuit.widths.stage2 &&
+  (match row.preprocessed with | none => true | some values => values.hasWidth row.circuit.preprocessedWidth) &&
+  row.quotient.length == quotientDegree row.circuit * 2 &&
+  row.logDegree.toNat + (quotientDegree row.circuit).log2 ≤ 32 - parameters.logBlowup
+
+def header (key : KeyCodec.Key) (proof : Data) : Bool :=
+  let active := (activeIndices proof).length
+  let preprocessed := (key.preprocessedIndices.filter Option.isSome).length
+  !key.circuits.isEmpty && proof.active.length == key.circuits.length && active > 0 &&
+  key.preprocessedIndices.length == key.circuits.length &&
+  proof.logDegrees.length == active &&
+  key.preprocessedCommitment.isNone == (preprocessed == 0) &&
+  (proof.preprocessed.getD []).length == preprocessed &&
+  proof.stage1.length == active && proof.stage2.length == active &&
+  proof.quotient.length == active && proof.accumulators.length == active
+
+def inactivePreprocessed (key : KeyCodec.Key) (proof : Data) : Bool :=
+  (key.preprocessedIndices.zip proof.active).all fun (slot, active) =>
+    match slot, active with
+    | some index, false => (proof.preprocessed.getD [])[index]? == some []
+    | _, _ => true
+
+def rows (key : KeyCodec.Key) (proof : Data) : Option (List Row) :=
+  (activeIndices proof).zipIdx.mapM fun (index, position) => readRow key proof index position
+
+def check (key : KeyCodec.Key) (proof : Data) : Option (List Row) := do
+  if header key proof && inactivePreprocessed key proof then
+    let result ← rows key proof
+    if result.all (Row.fits key.parameters) then some result else none
+  else none
+
+def fixedHeights (key : KeyCodec.Key) (proof : Data) : Bool :=
+  fixedTraceHeights (key.circuits.map (·.preprocessedHeight)) proof.active
+    (proof.logDegrees.map UInt8.toNat)
+
+def queryBound (key : KeyCodec.Key) (proof : Data) : Option Nat :=
+  lookupQueryBound (key.circuits.map (·.graph.lookups.length)) proof.active
+    (proof.logDegrees.map UInt8.toNat)
+
+end Aiur.NativeAIR.ProofShape
diff --git a/Ix/Aiur/Proofs.lean b/Ix/Aiur/Proofs.lean
new file mode 100644
index 000000000..34c3ffa44
--- /dev/null
+++ b/Ix/Aiur/Proofs.lean
@@ -0,0 +1,70 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Activity
+import Ix.Aiur.Proofs.CallOrder
+import Ix.Aiur.Proofs.Lookup
+import Ix.Aiur.Proofs.Execution
+import Ix.Aiur.Proofs.Memory
+import Ix.Aiur.Proofs.Field
+import Ix.Aiur.Proofs.LocalConstraints
+import Ix.Aiur.Proofs.ByteArithmetic
+import Ix.Aiur.Proofs.ByteLookups
+import Ix.Aiur.Proofs.LookupMessages
+import Ix.Aiur.Proofs.LookupShapes
+import Ix.Aiur.Proofs.GlobalLookups
+import Ix.Aiur.Proofs.LookupBudget
+import Ix.Aiur.Proofs.SelectorMessages
+import Ix.Aiur.Proofs.SelectorControl
+import Ix.Aiur.Proofs.ReturnGates
+import Ix.Aiur.Proofs.BranchSelection
+import Ix.Aiur.Proofs.OperationRows
+import Ix.Aiur.Proofs.CallInventory
+import Ix.Aiur.Proofs.BlockRows
+import Ix.Aiur.Proofs.BlockRowProjection
+import Ix.Aiur.Proofs.BlockRowExecution
+import Ix.Aiur.Proofs.BlockRowCalls
+import Ix.Aiur.Proofs.BlockRowInputs
+import Ix.Aiur.Proofs.FunctionRows
+import Ix.Aiur.Proofs.QuerySlots
+import Ix.Aiur.Proofs.BlockQuerySlots
+import Ix.Aiur.Proofs.QuerySlotMessages
+import Ix.Aiur.Proofs.BlockQueryPool
+import Ix.Aiur.Proofs.CircuitRows
+import Ix.Aiur.Proofs.CircuitRowMembers
+import Ix.Aiur.Proofs.CircuitRowQueries
+import Ix.Aiur.Proofs.CircuitRowReturns
+import Ix.Aiur.Proofs.CircuitRowExecution
+import Ix.Aiur.Proofs.RowCounts
+import Ix.Aiur.Proofs.CircuitRowCounts
+import Ix.Aiur.Proofs.ProviderEquivalence
+import Ix.Aiur.Proofs.CircuitTableData
+import Ix.Aiur.Proofs.CircuitTableExecution
+import Ix.Aiur.Proofs.PublicCircuitExecution
+import Ix.Aiur.Proofs.BranchlessSlots
+import Ix.Aiur.Proofs.EncodedCircuitExecution
+import Ix.Aiur.Proofs.CircuitTraces
+import Ix.Aiur.Proofs.CircuitMembership
+import Ix.Aiur.Proofs.LookupLayout
+import Ix.Aiur.Proofs.MemoryColumns
+import Ix.Aiur.Proofs.ByteColumns
+import Ix.Aiur.Proofs.ExpressionGraph
+import Ix.Aiur.Proofs.FrontendExpressions
+import Ix.Aiur.Proofs.GraphCompilation
+import Ix.Aiur.Proofs.OperationExpressions
+import Ix.Aiur.Proofs.OperationReflection
+import Ix.Aiur.Proofs.OperationSequences
+import Ix.Aiur.Proofs.LookupExpressions
+import Ix.Aiur.Proofs.Metadata
+import Ix.Aiur.Proofs.Renaming
+import Ix.Aiur.Proofs.Dedup
+import Ix.Aiur.Proofs.TailMatches
+import Ix.Aiur.Proofs.NormalizationFrames
+import Ix.Aiur.Proofs.Compilation
+import Ix.Aiur.Proofs.Grouping
+import Ix.Aiur.Proofs.Audit
+
+/-! Audited compiler, grouping and verifier-binding components for Aiur.
+These roots do not yet establish full public acceptance-to-model soundness. -/
diff --git a/Ix/Aiur/Proofs/Activity.lean b/Ix/Aiur/Proofs/Activity.lean
new file mode 100644
index 000000000..a1d5abdaf
--- /dev/null
+++ b/Ix/Aiur/Proofs/Activity.lean
@@ -0,0 +1,60 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Goldilocks
+
+/-! Local arithmetic for the function and memory AIR's activity constraint.
+The Rust constraint emitter uses `multiplicity * (1 - selector)` on every
+function and memory circuit. This theorem rules out a nonzero return/pull
+multiplicity on an inactive row. It is not the full AIR/execution reflection
+theorem, nor a proof of the Rust field implementation or constraint emitter.
+-/
+
+namespace Aiur
+
+theorem G.ofNat_n (a : G) : G.ofNat a.n = a := by
+  have h : a.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp a.property
+  simp only [G.ofNat, Nat.mod_eq_of_lt h, Nat.toUInt64, UInt64.ofNat_toNat]
+  split
+  · rfl
+  · contradiction
+
+theorem G.mul_one (a : G) : a * 1 = a := by
+  change G.ofNat (a.n * (1 : G).n) = a
+  have h : (1 : G).n = 1 := rfl
+  rw [h, Nat.mul_one]
+  exact G.ofNat_n a
+
+theorem G.mul_zero (a : G) : a * 0 = 0 := by
+  change G.ofNat (a.n * (0 : G).n) = 0
+  have h : (0 : G).n = 0 := rfl
+  rw [h, Nat.mul_zero]
+  rfl
+
+namespace AIR
+
+/-- Exact polynomial appended by both the function and memory emitters. -/
+def activityConstraint (multiplicity selector : G) : G :=
+  multiplicity * (1 - selector)
+
+theorem inactive_multiplicity_zero {multiplicity selector : G}
+    (inactive : selector = 0) (satisfied : activityConstraint multiplicity selector = 0) :
+    multiplicity = 0 := by
+  subst selector
+  have h : (1 : G) - 0 = 1 := by decide
+  simpa only [activityConstraint, h, G.mul_one] using satisfied
+
+theorem nonzero_multiplicity_active {multiplicity selector : G}
+    (satisfied : activityConstraint multiplicity selector = 0)
+    (nonzero : multiplicity ≠ 0) : selector ≠ 0 := by
+  intro inactive
+  exact nonzero (inactive_multiplicity_zero inactive satisfied)
+
+theorem active_satisfies (multiplicity : G) : activityConstraint multiplicity 1 = 0 := by
+  have h : (1 : G) - 1 = 0 := by decide
+  simp only [activityConstraint, h, G.mul_zero]
+
+end AIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/Audit.lean b/Ix/Aiur/Proofs/Audit.lean
new file mode 100644
index 000000000..1cf70860b
--- /dev/null
+++ b/Ix/Aiur/Proofs/Audit.lean
@@ -0,0 +1,3947 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean
+import Ix.Aiur.BoundVerifier
+import Ix.Aiur.Proofs.Activity
+import Ix.Aiur.Proofs.CallOrder
+import Ix.Aiur.Proofs.Lookup
+import Ix.Aiur.Proofs.Execution
+import Ix.Aiur.Proofs.Memory
+import Ix.Aiur.Proofs.LocalConstraints
+import Ix.Aiur.Proofs.ByteLookups
+import Ix.Aiur.Proofs.LookupMessages
+import Ix.Aiur.Proofs.LookupShapes
+import Ix.Aiur.Proofs.GlobalLookups
+import Ix.Aiur.Proofs.LookupBudget
+import Ix.Aiur.Proofs.ReturnGates
+import Ix.Aiur.Proofs.BranchSelection
+import Ix.Aiur.Proofs.CallInventory
+import Ix.Aiur.Proofs.FunctionRows
+import Ix.Aiur.Proofs.BlockQueryPool
+import Ix.Aiur.Proofs.CircuitRowExecution
+import Ix.Aiur.Proofs.CircuitRowCounts
+import Ix.Aiur.Proofs.PublicCircuitExecution
+import Ix.Aiur.Proofs.EncodedCircuitExecution
+import Ix.Aiur.Proofs.CircuitTraces
+import Ix.Aiur.Proofs.CircuitMembership
+import Ix.Aiur.Proofs.LookupLayout
+import Ix.Aiur.Proofs.MemoryColumns
+import Ix.Aiur.Proofs.ByteColumns
+import Ix.Aiur.Proofs.ExpressionGraph
+import Ix.Aiur.Proofs.FrontendExpressions
+import Ix.Aiur.Proofs.GraphCompilation
+import Ix.Aiur.Proofs.LookupExpressions
+import Ix.Aiur.Proofs.CompiledCircuitRows
+import Ix.Aiur.Proofs.BlockAllocation
+import Ix.Aiur.Proofs.CircuitAllocation
+import Ix.Aiur.Proofs.CircuitCompletion
+import Ix.Aiur.Proofs.CheckedCircuit
+import Ix.Aiur.Proofs.KeyArtifact
+import Ix.Aiur.Proofs.CompiledKey
+import Ix.Aiur.Proofs.ShapedVerifier
+import Ix.Aiur.Proofs.ExtensionField
+import Ix.Aiur.Proofs.LogUpAccumulator
+import Ix.Aiur.Proofs.DomainAccumulator
+import Ix.Aiur.Proofs.Quotient
+import Ix.Aiur.Proofs.VerifierAccumulator
+import Ix.Aiur.Proofs.Blake3
+import Ix.Aiur.Proofs.MerkleCap
+import Ix.Aiur.Proofs.Merkle
+import Ix.Aiur.Proofs.PrunedMerkle
+import Ix.Aiur.Proofs.ExtensionMmcs
+import Ix.Aiur.Proofs.FriDomain
+import Ix.Aiur.Proofs.Polynomial
+import Ix.Aiur.Proofs.Interpolation
+import Ix.Aiur.Proofs.Folding
+import Ix.Aiur.Proofs.FriQuery
+import Ix.Aiur.Proofs.Transcript
+import Ix.Aiur.Proofs.Grouping
+import Ix.Aiur.Proofs.TailMatches
+import Ix.Aiur.Proofs.NormalizationFrames
+
+/-! Exact proof and execution inventory for the implemented C8 components.
+The compiler and proof-system runtime are inventoried here; their presence
+is not a proof of runtime refinement or public certified semantic soundness.
+-/
+
+open Lean Lean.Elab Command
+
+namespace Aiur.Proofs.Audit
+
+def callOrderRoots : Array Lean.Name := #[
+  `Aiur.G.n_ofNat, `Aiur.G.sub_eq_zero_iff, `Aiur.G.n_add, `Aiur.G.n_mul,
+  `Aiur.AIR.packRank_lt, `Aiur.AIR.call_order_strict, `Aiur.AIR.call_order_irrefl,
+  `Aiur.AIR.active_call_order_strict, `Aiur.AIR.packed_call_order_strict,
+  `Aiur.AIR.call_relation_wellFounded]
+
+def lookupRoots : Array Lean.Name := #[
+  `Aiur.G.zero_add, `Aiur.G.ofNat_ne_zero_of_lt,
+  `Aiur.AIR.characteristic_queries_balance, `Aiur.AIR.suppliedWeight_nonzero_provider,
+  `Aiur.AIR.exactLookupBalance_provider, `Aiur.AIR.byteRangeMessage_bounded,
+  `Aiur.AIR.exactLookupBalance_byteRange, `Aiur.AIR.exactLookupBalance_rankBytes,
+  `Aiur.AIR.exactLookupBalance_call_order]
+
+def executionRoots : Array Lean.Name := #[
+  `Aiur.AIR.FunctionRow.Valid.active_of_nonzero,
+  `Aiur.AIR.functionQueries_provider,
+  `Aiur.AIR.balancedRows_execute,
+  `Aiur.AIR.balancedRoots_execute]
+
+def memoryRoots : Array Lean.Name := #[
+  `Aiur.AIR.MemoryRowsValid.pointer_injective,
+  `Aiur.AIR.memoryFacts_functional,
+  `Aiur.AIR.memoryQueries_provider,
+  `Aiur.AIR.memoryQueries_width,
+  `Aiur.AIR.memoryQueries_consistent,
+  `Aiur.AIR.memoryQueries_fact]
+
+def fieldRoots : Array Lean.Name := #[
+  `Aiur.gSize_prime,
+  `Aiur.G.mul_eq_zero_iff,
+  `Aiur.G.boolean_of_constraint,
+  `Aiur.G.boolean_of_one_sub_constraint,
+  `Aiur.G.eqZero_of_constraints]
+
+def localConstraintRoots : Array Lean.Name := #[
+  `Aiur.AIR.selectorSum_count_le_one,
+  `Aiur.AIR.selectorSum_inactive,
+  `Aiur.AIR.selectorSum_active_split,
+  `Aiur.AIR.selectorSum_characteristic_cancel,
+  `Aiur.AIR.nonzero_multiplicity_selector_one,
+  `Aiur.AIR.active_eqZero,
+  `Aiur.AIR.active_case,
+  `Aiur.AIR.active_default,
+  `Aiur.AIR.MemoryRowsPolynomials.valid,
+  `Aiur.AIR.MemoryRowsPolynomials.functional]
+
+def byteArithmeticRoots : Array Lean.Name := #[
+  `Aiur.AIR.inverse256_correct,
+  `Aiur.AIR.byte_add_carry,
+  `Aiur.AIR.byte_sub_borrow,
+  `Aiur.AIR.byte_carry_relation,
+  `Aiur.AIR.pack4_n,
+  `Aiur.AIR.u32Carry_relation,
+  `Aiur.AIR.u32_less_than,
+  `Aiur.AIR.active_u32_less_than]
+
+def byteLookupRoots : Array Lean.Name := #[
+  `Aiur.AIR.exactLookupBalance_byte1,
+  `Aiur.AIR.exactLookupBalance_byte2,
+  `Aiur.AIR.exactLookupBalance_byte1_step,
+  `Aiur.AIR.exactLookupBalance_byte2_step,
+  `Aiur.AIR.active_u32_less_than_step]
+
+def lookupMessageRoots : Array Lean.Name := #[
+  `Aiur.AIR.padMessage_injective_of_shape,
+  `Aiur.AIR.exactLookupBalance_of_injective_on,
+  `Aiur.AIR.ExactLookupBalance.filter,
+  `Aiur.AIR.paddedLookupBalance_provider,
+  `Aiur.AIR.paddedLookupBalance_exact,
+  `Aiur.AIR.functionMessage_shape,
+  `Aiur.AIR.memoryMessage_shape,
+  `Aiur.AIR.byte1Request_shape,
+  `Aiur.AIR.byte2Request_shape,
+  `Aiur.AIR.functionMessage_injective,
+  `Aiur.AIR.exactLookupBalance_functionMessages,
+  `Aiur.AIR.memoryMessage_injective,
+  `Aiur.AIR.exactLookupBalance_memoryMessages,
+  `Aiur.AIR.padMessage_append_zero,
+  `Aiur.AIR.functionMessage_rank_alias]
+
+def lookupShapeRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.AIR.RunBlock.return_size,
+  `Aiur.Bytecode.AIR.RunFunction.return_size,
+  `Aiur.Bytecode.AIR.Step.calls_lookupShape,
+  `Aiur.Bytecode.AIR.RunOps.calls_lookupShape,
+  `Aiur.Bytecode.AIR.RunBlock.calls_lookupShape,
+  `Aiur.Bytecode.AIR.RunFunction.calls_lookupShape,
+  `Aiur.BoundVerifier.Backend.air_return_size,
+  `Aiur.BoundVerifier.Backend.claim_shape]
+
+def globalLookupRoots : Array Lean.Name := #[
+  `Aiur.AIR.padded_functionMessage_reflects,
+  `Aiur.AIR.GlobalLookups.function_provider,
+  `Aiur.AIR.GlobalLookups.byte1,
+  `Aiur.AIR.GlobalLookups.byte2,
+  `Aiur.AIR.GlobalLookups.memory_fact,
+  `Aiur.AIR.GlobalLookups.memory_consistent,
+  `Aiur.AIR.GlobalLookups.byte1_step,
+  `Aiur.AIR.GlobalLookups.byte2_step,
+  `Aiur.AIR.GlobalLookups.rank_bytes,
+  `Aiur.AIR.GlobalLookups.rows_execute,
+  `Aiur.AIR.GlobalLookups.roots_execute,
+  `Aiur.BoundVerifier.Backend.root_lookupShape,
+  `Aiur.BoundVerifier.claim_padding,
+  `Aiur.BoundVerifier.Backend.global_execution]
+
+def lookupBudgetRoots : Array Lean.Name := #[
+  `Aiur.lookupQueryBound_sound,
+  `Aiur.lookupQueryBound_consumer_count,
+  `Aiur.lookupQueryBound_shape,
+  `Aiur.lookupQueryBound_step_no_overflow,
+  `Aiur.lookupQueryBound_complete,
+  `Aiur.lookupSlotSum_bounded,
+  `Aiur.lookupQueryBound_encodedKey,
+  `Aiur.AIR.GlobalLookups.of_budget]
+
+def selectorControlRoots : Array Lean.Name := #[
+  `Aiur.AIR.weightedMessage_active,
+  `Aiur.AIR.weightedMessage_inactive,
+  `Aiur.AIR.slotMessage_active,
+  `Aiur.AIR.continuation_merge,
+  `Aiur.Bytecode.Block.selectorFlow_sound,
+  `Aiur.Bytecode.Block.selectorFlow_yields_empty,
+  `Aiur.Bytecode.Block.selectorFlow_active_return,
+  `Aiur.Bytecode.Block.selectorFlow_provider_return,
+  `Aiur.AIR.SelectorFlow.Sound.inactive_terminal,
+  `Aiur.AIR.SelectorFlow.Sound.return_stops_continuation,
+  `Aiur.AIR.SelectorFlow.Sound.yield_starts_continuation,
+  `Aiur.Bytecode.Block.returnGates_reflects,
+  `Aiur.Bytecode.Block.return_message]
+
+def operationRowRoots : Array Lean.Name := #[
+  `Aiur.AIR.emitOp_step,
+  `Aiur.AIR.emitOps_run,
+  `Aiur.AIR.emitOp_calls,
+  `Aiur.AIR.emitOps_calls,
+  `Aiur.AIR.CallsEmitted.ordered,
+  `Aiur.AIR.active_array_equality,
+  `Aiur.Bytecode.Block.selectorFlow_boolean,
+  `Aiur.Bytecode.MatchPolynomials.active_branch,
+  `Aiur.Bytecode.MatchPolynomials.active_match,
+  `Aiur.Bytecode.MatchPolynomials.active_matchContinue]
+
+def blockRowRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.Block.emitRow_projection,
+  `Aiur.Bytecode.Block.emitRow_selectors,
+  `Aiur.AIR.mergeEquations_chosen,
+  `Aiur.Bytecode.branchRows_selected,
+  `Aiur.Bytecode.Block.emitRow_run,
+  `Aiur.Bytecode.Block.emitRow_tracks_calls,
+  `Aiur.Bytecode.Block.emitRow_inputs,
+  `Aiur.Bytecode.Function.emitRow_run,
+  `Aiur.Bytecode.Function.emitRow_valid,
+  `Aiur.AIR.slotMessage_chosen,
+  `Aiur.Bytecode.Function.emitRow_message]
+
+def querySlotRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.Block.emitRow_equation_querySlots,
+  `Aiur.AIR.QuerySlots.slot_multiplicity,
+  `Aiur.AIR.QuerySlots.multiplicity_boolean,
+  `Aiur.AIR.QuerySlots.active_singleton,
+  `Aiur.AIR.QuerySlots.slot_message,
+  `Aiur.AIR.QuerySlots.queries_reflect,
+  `Aiur.AIR.QuerySlots.padded_balance,
+  `Aiur.AIR.decodedQueries_length,
+  `Aiur.Bytecode.Block.emitRow_queried_pool,
+  `Aiur.Bytecode.Function.emitRow_pool_valid]
+
+def circuitRowRoots : Array Lean.Name := #[
+  `Aiur.AIR.emitMembers_spec,
+  `Aiur.Bytecode.Circuit.emitRow_spec,
+  `Aiur.Bytecode.Circuit.emitRow_boolean,
+  `Aiur.Bytecode.Circuit.emitRow_active_member,
+  `Aiur.Bytecode.Circuit.emitRow_querySlots,
+  `Aiur.AIR.circuitEmission_rank_queried,
+  `Aiur.AIR.MemberEmission.FromProgram.return_count,
+  `Aiur.AIR.circuitEmission_return_count,
+  `Aiur.AIR.circuitEmission_return_message,
+  `Aiur.Bytecode.Circuit.emitRow_valid]
+
+def rowCountRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.Ctrl.controlCounts_spec,
+  `Aiur.Bytecode.Block.controlCounts_spec,
+  `Aiur.Bytecode.Block.rowBounds_of_controlCounts,
+  `Aiur.Bytecode.Block.return_bound_of_controlCounts,
+  `Aiur.Bytecode.Block.returns_le_selectors,
+  `Aiur.Bytecode.Toplevel.validateRowCounts_circuit,
+  `Aiur.Bytecode.Circuit.validateRowCounts_spec,
+  `Aiur.Bytecode.Circuit.emitRow_count_bounds,
+  `Aiur.Bytecode.Circuit.emitRow_valid_checked,
+  `Aiur.BoundVerifier.Backend.circuit_row_counts]
+
+def circuitTableRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.Circuit.emitRow_valid_in_pool,
+  `Aiur.AIR.suppliedWeight_padded_congr,
+  `Aiur.AIR.PaddedLookupBalance.congr_providers,
+  `Aiur.Bytecode.Circuit.emitRow_provider,
+  `Aiur.AIR.AuxiliaryTables.global_of_circuit_balance,
+  `Aiur.AIR.FunctionRow.inactive_valid,
+  `Aiur.AIR.CircuitWitness.provider_row,
+  `Aiur.AIR.CircuitWitness.interpreted_row,
+  `Aiur.AIR.circuitWitnesses_interpret,
+  `Aiur.AIR.circuitWitnesses_execute,
+  `Aiur.AIR.PaddedLookupBalance.congr_queries,
+  `Aiur.BoundVerifier.Backend.public_circuit_execution]
+
+def branchlessRoots : Array Lean.Name := #[
+  `Aiur.AIR.QueryWriters.single,
+  `Aiur.Bytecode.Function.emitRow_terminal_writers,
+  `Aiur.AIR.circuitEmission_queryWriters,
+  `Aiur.Bytecode.Circuit.emitRow_queryWriters,
+  `Aiur.Bytecode.Circuit.emitRow_queries_reflect,
+  `Aiur.AIR.slotMessage_member_length,
+  `Aiur.AIR.QuerySlots.decoded_widths,
+  `Aiur.AIR.circuitWitnesses_queries_reflect,
+  `Aiur.AIR.circuitWitnesses_decoded_widths,
+  `Aiur.BoundVerifier.Backend.encoded_circuit_execution]
+
+def circuitTraceRoots : Array Lean.Name := #[
+  `Aiur.AIR.CircuitTraces.slot_sum_append,
+  `Aiur.AIR.CircuitTraces.capacity_bounded,
+  `Aiur.AIR.emitCircuitWitness_spec,
+  `Aiur.AIR.encodedQueries_length,
+  `Aiur.AIR.encodedCircuitQueryPool_uniform_bound,
+  `Aiur.AIR.emitCircuitWitnesses_spec,
+  `Aiur.AIR.CircuitTraces.emitWitnesses_spec,
+  `Aiur.BoundVerifier.Backend.trace_circuit_execution]
+
+def circuitMembershipRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.singletonCircuits_constrained,
+  `Aiur.CompiledToplevel.groupFunctions_constrained,
+  `Aiur.finishCompilation_circuits_constrained,
+  `Aiur.Source.Toplevel.compile_circuits_constrained,
+  `Aiur.BoundVerifier.Backend.circuits_constrained,
+  `Aiur.Bytecode.Toplevel.validateLookupShapes_function,
+  `Aiur.AIR.CircuitWitness.shapes_of_compiled,
+  `Aiur.BoundVerifier.Backend.witness_shapes,
+  `Aiur.BoundVerifier.Backend.compiled_trace_execution]
+
+def lookupLayoutRoots : Array Lean.Name := #[
+  `Aiur.Concrete.Bytecode.opLayout_lookupUsage,
+  `Aiur.Concrete.Bytecode.opsLayout_lookupUsage,
+  `Aiur.AIR.emitOp_lookupUsage,
+  `Aiur.AIR.emitOps_lookupUsage,
+  `Aiur.Bytecode.branchRows_lookupUsage,
+  `Aiur.Bytecode.Ctrl.emitRow_lookupUsage,
+  `Aiur.Bytecode.Block.emitRow_lookupUsage,
+  `Aiur.Concrete.Bytecode.ctrlLayout_lookupUsage,
+  `Aiur.Concrete.Bytecode.blockLayout_lookupUsage,
+  `Aiur.Concrete.Function.compile_lookupLayout,
+  `Aiur.Concrete.Decls.toBytecode_lookupLayout,
+  `Aiur.Bytecode.rewriteCtrl_lookupUsage,
+  `Aiur.Bytecode.rewriteBlock_lookupUsage,
+  `Aiur.Bytecode.Toplevel.deduplicate_lookupLayout,
+  `Aiur.finishCompilation_lookupLayout,
+  `Aiur.Source.Toplevel.compile_lookupLayout,
+  `Aiur.BoundVerifier.Backend.functions_lookupLayout,
+  `Aiur.Bytecode.singletonCircuits_lookupBound,
+  `Aiur.Bytecode.merged_lookupBound,
+  `Aiur.CompiledToplevel.groupFunctions_lookupBound,
+  `Aiur.finishCompilation_lookupBound,
+  `Aiur.Source.Toplevel.compile_lookupBound,
+  `Aiur.BoundVerifier.Backend.circuits_lookupBound,
+  `Aiur.AIR.CircuitWitness.lookupBounds_of_compiled,
+  `Aiur.BoundVerifier.Backend.witness_lookupBounds,
+  `Aiur.BoundVerifier.Backend.bounded_trace_execution]
+
+def memoryColumnRoots : Array Lean.Name := #[
+  `Aiur.AIR.decodeMemoryRow_width,
+  `Aiur.AIR.decodeMemoryRows_size,
+  `Aiur.AIR.memoryColumnProvider_reflect,
+  `Aiur.AIR.decodeMemoryRows_polynomials,
+  `Aiur.AIR.decodeMemoryRows_valid,
+  `Aiur.AIR.decodeMemoryRows_providers,
+  `Aiur.AIR.memoryMatrixProviders_reflect,
+  `Aiur.Concrete.Decls.toBytecode_memorySizes_distinct,
+  `Aiur.Bytecode.Toplevel.deduplicate_memorySizes,
+  `Aiur.finishCompilation_memorySizes,
+  `Aiur.Source.Toplevel.compile_memorySizes_distinct,
+  `Aiur.BoundVerifier.Backend.memorySizes_distinct,
+  `Aiur.BoundVerifier.Backend.memorySizes_canonical,
+  `Aiur.AIR.MemoryTraces.slot_sum_append,
+  `Aiur.AIR.MemoryTraces.rows_valid,
+  `Aiur.AIR.MemoryTraces.rows_size_le,
+  `Aiur.AIR.MemoryTraces.providers_reflect,
+  `Aiur.AIR.MemoryTraces.capacity_bounded,
+  `Aiur.AIR.MemoryTraces.functional,
+  `Aiur.AIR.MemoryTraces.functional_of_budget,
+  `Aiur.AIR.MemoryTraces.circuitProviders_reflect,
+  `Aiur.BoundVerifier.Backend.memory_trace_execution]
+
+def byteColumnRoots : Array Lean.Name := #[
+  `Aiur.fixedTraceHeights_sound,
+  `Aiur.fixedTraceHeights_complete,
+  `Aiur.FixedTraceHeights.alignment,
+  `Aiur.fixedTraceHeights_bytes,
+  `Aiur.AIR.byte1ColumnProvider_reflect,
+  `Aiur.AIR.byte2ColumnProvider_reflect,
+  `Aiur.AIR.CircuitTraces.fixed_heights_append,
+  `Aiur.AIR.MemoryTraces.fixed_heights_append,
+  `Aiur.AIR.canonical_byte_metadata,
+  `Aiur.AIR.suppliedWeight_perm,
+  `Aiur.AIR.PaddedLookupBalance.perm_providers,
+  `Aiur.AIR.flatMap_map_swap,
+  `Aiur.AIR.byte1MatrixProviders_reflect,
+  `Aiur.AIR.byte2MatrixProviders_reflect,
+  `Aiur.AIR.ByteTraces.providers_reflect,
+  `Aiur.AIR.SystemTraces.fixed_heights,
+  `Aiur.AIR.SystemTraces.memory_functional,
+  `Aiur.BoundVerifier.Backend.column_trace_execution]
+
+def expressionGraphRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Node.check_iff,
+  `Aiur.NativeAIR.checkNodes_iff,
+  `Aiur.NativeAIR.checkedGraphPrefix_iff,
+  `Aiur.NativeAIR.roots_below_prefix,
+  `Aiur.NativeAIR.prefix_bounded,
+  `Aiur.NativeAIR.Graph.Valid.prefix_bounded,
+  `Aiur.NativeAIR.Node.eval_defined,
+  `Aiur.NativeAIR.sweepFrom_defined,
+  `Aiur.NativeAIR.Graph.Valid.sweep_defined,
+  `Aiur.NativeAIR.ValidNodes.take,
+  `Aiur.NativeAIR.Node.eval_withoutStage2,
+  `Aiur.NativeAIR.sweepFrom_withoutStage2,
+  `Aiur.NativeAIR.sweepFrom_append,
+  `Aiur.NativeAIR.sweepFrom_preserves,
+  `Aiur.NativeAIR.Graph.Valid.lookup_sweep_defined,
+  `Aiur.NativeAIR.Graph.Valid.lookup_sweep_agrees,
+  `Aiur.NativeAIR.Node.unfold_eval,
+  `Aiur.NativeAIR.Reflects.push,
+  `Aiur.NativeAIR.Node.unfold_defined,
+  `Aiur.NativeAIR.unfoldFrom_defined,
+  `Aiur.NativeAIR.unfoldFrom_reflects,
+  `Aiur.NativeAIR.Graph.Valid.unfold_defined,
+  `Aiur.NativeAIR.Graph.sweep_reflects,
+  `Aiur.NativeAIR.Reflects.readNodes,
+  `Aiur.NativeAIR.Reflects.readLookup,
+  `Aiur.NativeAIR.readNodes_congr,
+  `Aiur.NativeAIR.readNodes_defined,
+  `Aiur.NativeAIR.readLookup_defined,
+  `Aiur.NativeAIR.Graph.Valid.lookup_values_agree,
+  `Aiur.NativeAIR.Graph.Valid.lookup_values_reflect]
+
+def graphAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.ValidNodes.take,
+  `Aiur.NativeAIR.sweepFrom_append]
+
+def graphPropextRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Node.check_iff,
+  `Aiur.NativeAIR.checkNodes_iff,
+  `Aiur.NativeAIR.roots_below_prefix,
+  `Aiur.NativeAIR.prefix_bounded,
+  `Aiur.NativeAIR.Graph.Valid.prefix_bounded,
+  `Aiur.NativeAIR.Node.eval_withoutStage2]
+
+def graphClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Reflects.push,
+  `Aiur.NativeAIR.unfoldFrom_reflects,
+  `Aiur.NativeAIR.Graph.sweep_reflects,
+  `Aiur.NativeAIR.Graph.Valid.lookup_values_reflect]
+
+def frontendExpressionRoots : Array Lean.Name := #[
+  `Aiur.G.sub_zero,
+  `Aiur.G.neg_neg,
+  `Aiur.NativeAIR.Expr.isConstant_eq,
+  `Aiur.NativeAIR.Expr.frontNeg_noConstantNegs,
+  `Aiur.NativeAIR.Expr.frontNeg_isConstant,
+  `Aiur.NativeAIR.Expr.frontAdd_isConstant,
+  `Aiur.NativeAIR.Expr.frontSub_isConstant,
+  `Aiur.NativeAIR.Expr.frontAdd_noConstantNegs,
+  `Aiur.NativeAIR.Expr.frontSub_noConstantNegs,
+  `Aiur.NativeAIR.Expr.frontMul_noConstantNegs,
+  `Aiur.NativeAIR.Expr.frontNeg_eval,
+  `Aiur.NativeAIR.Expr.eval_constantValue,
+  `Aiur.NativeAIR.Expr.frontAdd_eval,
+  `Aiur.NativeAIR.Expr.frontSub_eval,
+  `Aiur.NativeAIR.Expr.frontMul_eval,
+  `Aiur.NativeAIR.goldilocks_add_zero,
+  `Aiur.NativeAIR.goldilocks_zero_add,
+  `Aiur.NativeAIR.goldilocks_sub_zero,
+  `Aiur.NativeAIR.goldilocks_zero_sub,
+  `Aiur.NativeAIR.goldilocks_mul_zero,
+  `Aiur.NativeAIR.goldilocks_zero_mul,
+  `Aiur.NativeAIR.goldilocks_mul_one,
+  `Aiur.NativeAIR.goldilocks_one_mul,
+  `Aiur.NativeAIR.goldilocks_neg_neg,
+  `Aiur.NativeAIR.goldilocks_konst_add,
+  `Aiur.NativeAIR.goldilocks_konst,
+  `Aiur.NativeAIR.goldilocks_add,
+  `Aiur.NativeAIR.goldilocks_sub,
+  `Aiur.NativeAIR.goldilocks_mul,
+  `Aiur.NativeAIR.goldilocks_konst_sub,
+  `Aiur.NativeAIR.goldilocks_konst_mul,
+  `Aiur.NativeAIR.goldilocks_konst_neg,
+  `Aiur.NativeAIR.goldilocksLaws,
+  `Aiur.NativeAIR.Expr.constantValue_eq_of_eval,
+  `Aiur.NativeAIR.Expr.frontMul_isConstant,
+  `Aiur.NativeAIR.RowExpr.reflects_iff_eval,
+  `Aiur.NativeAIR.RowExpr.konst_reflects,
+  `Aiur.NativeAIR.RowExpr.variable_reflects,
+  `Aiur.NativeAIR.RowExpr.add_reflects,
+  `Aiur.NativeAIR.RowExpr.sub_reflects,
+  `Aiur.NativeAIR.RowExpr.mul_reflects,
+  `Aiur.NativeAIR.ScalarEmission.eval_of,
+  `Aiur.NativeAIR.eqZeroRegular_reflects,
+  `Aiur.NativeAIR.emitEqZero_reflects,
+  `Aiur.NativeAIR.mulRegular_reflects,
+  `Aiur.NativeAIR.emitMul_reflects,
+  `Aiur.NativeAIR.emitEqZero_noConstantNegs,
+  `Aiur.NativeAIR.emitMul_noConstantNegs,
+  `Aiur.NativeAIR.emitAdd_reflects,
+  `Aiur.NativeAIR.emitSub_reflects]
+
+def frontendQuotRoots : Array Lean.Name := #[
+  `Aiur.G.neg_neg,
+  `Aiur.NativeAIR.goldilocks_neg_neg,
+  `Aiur.NativeAIR.goldilocksLaws,
+  `Aiur.NativeAIR.RowExpr.add_reflects,
+  `Aiur.NativeAIR.RowExpr.sub_reflects,
+  `Aiur.NativeAIR.ScalarEmission.eval_of,
+  `Aiur.NativeAIR.eqZeroRegular_reflects,
+  `Aiur.NativeAIR.mulRegular_reflects,
+  `Aiur.NativeAIR.emitAdd_reflects,
+  `Aiur.NativeAIR.emitSub_reflects]
+
+def frontendClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Expr.frontMul_isConstant,
+  `Aiur.NativeAIR.RowExpr.mul_reflects,
+  `Aiur.NativeAIR.emitEqZero_reflects,
+  `Aiur.NativeAIR.emitMul_reflects]
+
+def frontendExpressionPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Expr.isConstant,
+  `Aiur.NativeAIR.Expr.constantValue,
+  `Aiur.NativeAIR.Expr.frontNeg,
+  `Aiur.NativeAIR.Expr.frontAdd,
+  `Aiur.NativeAIR.Expr.frontSub,
+  `Aiur.NativeAIR.Expr.frontMul,
+  `Aiur.NativeAIR.EvalLaws.mk,
+  `Aiur.NativeAIR.Expr.noConstantNegs,
+  `Aiur.NativeAIR.RowExpr.mk,
+  `Aiur.NativeAIR.RowExpr.konst,
+  `Aiur.NativeAIR.RowExpr.variable,
+  `Aiur.NativeAIR.RowExpr.add,
+  `Aiur.NativeAIR.RowExpr.sub,
+  `Aiur.NativeAIR.RowExpr.mul,
+  `Aiur.NativeAIR.RowExpr.eval,
+  `Aiur.NativeAIR.RowExpr.Reflects,
+  `Aiur.NativeAIR.ScalarEmission.mk,
+  `Aiur.NativeAIR.ScalarEmission.eval,
+  `Aiur.NativeAIR.mainCurrent,
+  `Aiur.NativeAIR.eqZeroRegular,
+  `Aiur.NativeAIR.emitEqZero,
+  `Aiur.NativeAIR.mulRegular,
+  `Aiur.NativeAIR.emitMul]
+
+def graphCompilationRoots : Array Lean.Name := #[
+  `Aiur.G.sub_self,
+  `Aiur.NativeAIR.goldilocksGraphLaws,
+  `Aiur.NativeAIR.Compiler.Extends.refl,
+  `Aiur.NativeAIR.Compiler.Extends.trans,
+  `Aiur.NativeAIR.Compiler.Extends.push,
+  `Aiur.NativeAIR.Compiler.eval_extends,
+  `Aiur.NativeAIR.Compiler.Evaluation.empty,
+  `Aiur.NativeAIR.Compiler.Evaluation.push,
+  `Aiur.NativeAIR.Compiler.result_same,
+  `Aiur.NativeAIR.Compiler.intern_reflects,
+  `Aiur.NativeAIR.Compiler.asConst_reflects,
+  `Aiur.NativeAIR.Compiler.asConst_value,
+  `Aiur.NativeAIR.Compiler.konst_reflects,
+  `Aiur.NativeAIR.Compiler.neg_reflects,
+  `Aiur.NativeAIR.Compiler.sortedAdd_reflects,
+  `Aiur.NativeAIR.Compiler.sortedMul_reflects,
+  `Aiur.NativeAIR.Compiler.add_reflects,
+  `Aiur.NativeAIR.Compiler.sub_reflects,
+  `Aiur.NativeAIR.Compiler.mul_reflects,
+  `Aiur.NativeAIR.Compiler.result_prepend,
+  `Aiur.NativeAIR.Compiler.compileExpr_reflects,
+  `Aiur.NativeAIR.Compiler.compileExpr_sweep,
+  `Aiur.NativeAIR.Compiler.RootsReflect.grow,
+  `Aiur.NativeAIR.Compiler.compileExprs_reflects,
+  `Aiur.NativeAIR.Compiler.RootsReflect.read,
+  `Aiur.NativeAIR.Compiler.compileLookup_reflects,
+  `Aiur.NativeAIR.Compiler.RootsReflect.readLookup,
+  `Aiur.NativeAIR.Compiler.LookupsReflect.grow,
+  `Aiur.NativeAIR.Compiler.compileLookups_reflects,
+  `Aiur.NativeAIR.Compiler.recordZero_reflects,
+  `Aiur.NativeAIR.Compiler.Vanishes.append,
+  `Aiur.NativeAIR.Compiler.ExprsVanish.cons,
+  `Aiur.NativeAIR.Compiler.compileZeros_reflects,
+  `Aiur.NativeAIR.Compiler.canonicalZeros_vanish,
+  `Aiur.NativeAIR.Compiler.compileBase_reflects,
+  `Aiur.NativeAIR.Compiler.LookupsReflect.read,
+  `Aiur.NativeAIR.Compiler.compileBase_satisfaction]
+
+def graphCompilationAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Compiler.Extends.refl,
+  `Aiur.NativeAIR.Compiler.Extends.trans,
+  `Aiur.NativeAIR.Compiler.RootsReflect.grow,
+  `Aiur.NativeAIR.Compiler.LookupsReflect.grow]
+
+def graphCompilationQuotRoots : Array Lean.Name := #[
+  `Aiur.G.sub_self,
+  `Aiur.NativeAIR.goldilocksGraphLaws,
+  `Aiur.NativeAIR.Compiler.eval_extends,
+  `Aiur.NativeAIR.Compiler.Evaluation.push,
+  `Aiur.NativeAIR.Compiler.RootsReflect.read,
+  `Aiur.NativeAIR.Compiler.RootsReflect.readLookup,
+  `Aiur.NativeAIR.Compiler.recordZero_reflects,
+  `Aiur.NativeAIR.Compiler.Vanishes.append,
+  `Aiur.NativeAIR.Compiler.canonicalZeros_vanish,
+  `Aiur.NativeAIR.Compiler.LookupsReflect.read]
+
+def graphCompilationClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Compiler.intern_reflects,
+  `Aiur.NativeAIR.Compiler.konst_reflects,
+  `Aiur.NativeAIR.Compiler.neg_reflects,
+  `Aiur.NativeAIR.Compiler.sortedAdd_reflects,
+  `Aiur.NativeAIR.Compiler.sortedMul_reflects,
+  `Aiur.NativeAIR.Compiler.add_reflects,
+  `Aiur.NativeAIR.Compiler.sub_reflects,
+  `Aiur.NativeAIR.Compiler.mul_reflects,
+  `Aiur.NativeAIR.Compiler.compileExpr_reflects,
+  `Aiur.NativeAIR.Compiler.compileExpr_sweep,
+  `Aiur.NativeAIR.Compiler.compileExprs_reflects,
+  `Aiur.NativeAIR.Compiler.compileLookup_reflects,
+  `Aiur.NativeAIR.Compiler.compileLookups_reflects,
+  `Aiur.NativeAIR.Compiler.compileZeros_reflects,
+  `Aiur.NativeAIR.Compiler.compileBase_reflects,
+  `Aiur.NativeAIR.Compiler.compileBase_satisfaction]
+
+def graphCompilationPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.GraphEvalLaws.mk,
+  `Aiur.NativeAIR.Compiler.Extends,
+  `Aiur.NativeAIR.Compiler.Evaluation.mk,
+  `Aiur.NativeAIR.Compiler.intern,
+  `Aiur.NativeAIR.Compiler.asConst,
+  `Aiur.NativeAIR.Compiler.Result,
+  `Aiur.NativeAIR.Compiler.neg,
+  `Aiur.NativeAIR.Compiler.sortedAdd,
+  `Aiur.NativeAIR.Compiler.sortedMul,
+  `Aiur.NativeAIR.Compiler.add,
+  `Aiur.NativeAIR.Compiler.sub,
+  `Aiur.NativeAIR.Compiler.mul,
+  `Aiur.NativeAIR.Compiler.compileExpr,
+  `Aiur.NativeAIR.Compiler.compileExprs,
+  `Aiur.NativeAIR.Compiler.RootsReflect.nil,
+  `Aiur.NativeAIR.Compiler.RootsReflect.cons,
+  `Aiur.NativeAIR.Compiler.evalExprs,
+  `Aiur.NativeAIR.Compiler.ExprLookup.mk,
+  `Aiur.NativeAIR.Compiler.ExprLookup.exprs,
+  `Aiur.NativeAIR.Compiler.ExprLookup.eval,
+  `Aiur.NativeAIR.Compiler.compileLookup,
+  `Aiur.NativeAIR.Compiler.compileLookups,
+  `Aiur.NativeAIR.Compiler.LookupsReflect.nil,
+  `Aiur.NativeAIR.Compiler.LookupsReflect.cons,
+  `Aiur.NativeAIR.Compiler.recordZero,
+  `Aiur.NativeAIR.Compiler.Vanishes,
+  `Aiur.NativeAIR.Compiler.ExprsVanish,
+  `Aiur.NativeAIR.Compiler.compileZeros,
+  `Aiur.NativeAIR.Compiler.canonicalZeros,
+  `Aiur.NativeAIR.Compiler.BaseCompilation.mk,
+  `Aiur.NativeAIR.Compiler.compileBase]
+
+def operationExpressionRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.OpEmitter.list_mapM_read,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_read,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_size,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_push,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_of_map,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_ofFn,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_ofFn,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_transform,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_transform,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_refine,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_refine,
+  `Aiur.NativeAIR.OpEmitter.evalRows_empty,
+  `Aiur.NativeAIR.OpEmitter.evalRows_singleton,
+  `Aiur.NativeAIR.OpEmitter.evalRows_values,
+  `Aiur.NativeAIR.OpEmitter.evalRows_read,
+  `Aiur.NativeAIR.OpEmitter.select_reflects,
+  `Aiur.NativeAIR.OpEmitter.select_values,
+  `Aiur.NativeAIR.OpEmitter.select_normal,
+  `Aiur.NativeAIR.OpEmitter.array_ofFn_getD,
+  `Aiur.NativeAIR.OpEmitter.array_map_getD_of_mapM,
+  `Aiur.NativeAIR.OpEmitter.evalRows_getD,
+  `Aiur.NativeAIR.OpEmitter.advice_eval,
+  `Aiur.NativeAIR.OpEmitter.advice_normal,
+  `Aiur.NativeAIR.OpEmitter.CallExpr.eval_of,
+  `Aiur.NativeAIR.OpEmitter.emitAdvice_reflects,
+  `Aiur.NativeAIR.OpEmitter.Emission.eval_of,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_reflects,
+  `Aiur.NativeAIR.OpEmitter.scale_isConstant,
+  `Aiur.NativeAIR.OpEmitter.byteCarry_reflects,
+  `Aiur.NativeAIR.OpEmitter.byteCarry_normal,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_normal,
+  `Aiur.NativeAIR.OpEmitter.scale_reflects,
+  `Aiur.NativeAIR.OpEmitter.list_ofFn_four,
+  `Aiur.NativeAIR.OpEmitter.list_foldl_zip_four,
+  `Aiur.NativeAIR.OpEmitter.packFour_reflects,
+  `Aiur.NativeAIR.OpEmitter.packFour_normal,
+  `Aiur.NativeAIR.OpEmitter.readWord_reflects,
+  `Aiur.NativeAIR.OpEmitter.readWord_normal,
+  `Aiur.NativeAIR.OpEmitter.packedAdvice_reflects,
+  `Aiur.NativeAIR.OpEmitter.packedAdvice_normal,
+  `Aiur.NativeAIR.OpEmitter.packed_advice_not_constant,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_normal,
+  `Aiur.NativeAIR.OpEmitter.packed_advice_value,
+  `Aiur.NativeAIR.OpEmitter.carryStep_eval,
+  `Aiur.NativeAIR.OpEmitter.carryStep_normal,
+  `Aiur.NativeAIR.OpEmitter.carryStep_not_constant,
+  `Aiur.NativeAIR.OpEmitter.carries_eval,
+  `Aiur.NativeAIR.OpEmitter.carries_normal,
+  `Aiur.NativeAIR.OpEmitter.packSix_eval,
+  `Aiur.NativeAIR.OpEmitter.rangePair_eval,
+  `Aiur.NativeAIR.OpEmitter.rangeSix_eval,
+  `Aiur.NativeAIR.OpEmitter.emitCall_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitStore_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitLoad_reflects,
+  `Aiur.NativeAIR.OpEmitter.rangeFour_eval,
+  `Aiur.NativeAIR.OpEmitter.booleanExpr_eval,
+  `Aiur.NativeAIR.OpEmitter.emitU32LessThan_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitU32LessThan_normal,
+  `Aiur.NativeAIR.OpEmitter.rowValues_getD,
+  `Aiur.NativeAIR.OpEmitter.emitAssert_reflects,
+  `Aiur.NativeAIR.OpEmitter.fromScalar_eval,
+  `Aiur.NativeAIR.OpEmitter.empty_eval,
+  `Aiur.NativeAIR.OpEmitter.normal_empty,
+  `Aiur.NativeAIR.OpEmitter.normal_singleton,
+  `Aiur.NativeAIR.OpEmitter.Normal.read,
+  `Aiur.NativeAIR.OpEmitter.emitOp_byte1,
+  `Aiur.NativeAIR.OpEmitter.emitOp_byte2,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch,
+  `Aiur.NativeAIR.OpEmitter.list_ofFn_getD_pair,
+  `Aiur.NativeAIR.OpEmitter.emitOp_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_normal,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_normal,
+  `Aiur.NativeAIR.OpEmitter.emitOp_normal,
+  `Aiur.NativeAIR.OpEmitter.evalRows_append,
+  `Aiur.NativeAIR.OpEmitter.Normal.append,
+  `Aiur.NativeAIR.OpEmitter.Emission.eval_components,
+  `Aiur.NativeAIR.OpEmitter.OpsEmission.eval_of,
+  `Aiur.NativeAIR.OpEmitter.OpsEmission.eval_components,
+  `Aiur.NativeAIR.OpEmitter.emitOps_column,
+  `Aiur.NativeAIR.OpEmitter.emitOps_normal,
+  `Aiur.NativeAIR.OpEmitter.emitOps_reflects,
+  `Aiur.NativeAIR.LookupEmitter.addArgs_eval,
+  `Aiur.NativeAIR.LookupEmitter.gateArgs_eval,
+  `Aiur.NativeAIR.LookupEmitter.QueryExpr.eval_components,
+  `Aiur.NativeAIR.LookupEmitter.queryParts_cons,
+  `Aiur.NativeAIR.LookupEmitter.queryParts_eval,
+  `Aiur.NativeAIR.LookupEmitter.accumulate_eval,
+  `Aiur.NativeAIR.LookupEmitter.fold_eval,
+  `Aiur.NativeAIR.LookupEmitter.filter_eval,
+  `Aiur.NativeAIR.LookupEmitter.valuedFold_eq,
+  `Aiur.NativeAIR.LookupEmitter.slot_eval,
+  `Aiur.NativeAIR.LookupEmitter.slots_eval]
+
+def operationExpressionQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.OpEmitter.list_mapM_read,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_read,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_size,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_push,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_of_map,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_ofFn,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_transform,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_transform,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_refine,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_refine,
+  `Aiur.NativeAIR.OpEmitter.evalRows_empty,
+  `Aiur.NativeAIR.OpEmitter.evalRows_singleton,
+  `Aiur.NativeAIR.OpEmitter.evalRows_values,
+  `Aiur.NativeAIR.OpEmitter.select_values,
+  `Aiur.NativeAIR.OpEmitter.select_normal,
+  `Aiur.NativeAIR.OpEmitter.array_map_getD_of_mapM,
+  `Aiur.NativeAIR.OpEmitter.Emission.eval_of,
+  `Aiur.NativeAIR.OpEmitter.byteCarry_reflects,
+  `Aiur.NativeAIR.OpEmitter.scale_reflects,
+  `Aiur.NativeAIR.OpEmitter.list_ofFn_four,
+  `Aiur.NativeAIR.OpEmitter.list_foldl_zip_four,
+  `Aiur.NativeAIR.OpEmitter.carryStep_eval,
+  `Aiur.NativeAIR.OpEmitter.carries_eval,
+  `Aiur.NativeAIR.OpEmitter.carries_normal,
+  `Aiur.NativeAIR.OpEmitter.packSix_eval,
+  `Aiur.NativeAIR.OpEmitter.rangePair_eval,
+  `Aiur.NativeAIR.OpEmitter.rangeSix_eval,
+  `Aiur.NativeAIR.OpEmitter.rangeFour_eval,
+  `Aiur.NativeAIR.OpEmitter.booleanExpr_eval,
+  `Aiur.NativeAIR.OpEmitter.emitU32LessThan_normal,
+  `Aiur.NativeAIR.OpEmitter.rowValues_getD,
+  `Aiur.NativeAIR.OpEmitter.fromScalar_eval,
+  `Aiur.NativeAIR.OpEmitter.empty_eval,
+  `Aiur.NativeAIR.OpEmitter.list_ofFn_getD_pair,
+  `Aiur.NativeAIR.OpEmitter.evalRows_append,
+  `Aiur.NativeAIR.OpEmitter.Normal.append,
+  `Aiur.NativeAIR.OpEmitter.OpsEmission.eval_of,
+  `Aiur.NativeAIR.LookupEmitter.addArgs_eval,
+  `Aiur.NativeAIR.LookupEmitter.gateArgs_eval,
+  `Aiur.NativeAIR.LookupEmitter.accumulate_eval,
+  `Aiur.NativeAIR.LookupEmitter.fold_eval,
+  `Aiur.NativeAIR.LookupEmitter.filter_eval,
+  `Aiur.NativeAIR.LookupEmitter.slot_eval,
+  `Aiur.NativeAIR.LookupEmitter.slots_eval]
+
+def operationExpressionClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.OpEmitter.array_mapM_ofFn,
+  `Aiur.NativeAIR.OpEmitter.evalRows_read,
+  `Aiur.NativeAIR.OpEmitter.select_reflects,
+  `Aiur.NativeAIR.OpEmitter.array_ofFn_getD,
+  `Aiur.NativeAIR.OpEmitter.evalRows_getD,
+  `Aiur.NativeAIR.OpEmitter.advice_eval,
+  `Aiur.NativeAIR.OpEmitter.advice_normal,
+  `Aiur.NativeAIR.OpEmitter.CallExpr.eval_of,
+  `Aiur.NativeAIR.OpEmitter.emitAdvice_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_normal,
+  `Aiur.NativeAIR.OpEmitter.packFour_reflects,
+  `Aiur.NativeAIR.OpEmitter.readWord_reflects,
+  `Aiur.NativeAIR.OpEmitter.readWord_normal,
+  `Aiur.NativeAIR.OpEmitter.packedAdvice_reflects,
+  `Aiur.NativeAIR.OpEmitter.packed_advice_not_constant,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_normal,
+  `Aiur.NativeAIR.OpEmitter.packed_advice_value,
+  `Aiur.NativeAIR.OpEmitter.emitCall_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitStore_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitLoad_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitU32LessThan_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitAssert_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch,
+  `Aiur.NativeAIR.OpEmitter.emitOp_reflects,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_normal,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_normal,
+  `Aiur.NativeAIR.OpEmitter.emitOp_normal,
+  `Aiur.NativeAIR.OpEmitter.emitOps_normal,
+  `Aiur.NativeAIR.OpEmitter.emitOps_reflects,
+  `Aiur.NativeAIR.LookupEmitter.queryParts_cons,
+  `Aiur.NativeAIR.LookupEmitter.queryParts_eval]
+
+def operationExpressionPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.OpEmitter.evalExpr,
+  `Aiur.NativeAIR.OpEmitter.evalRows,
+  `Aiur.NativeAIR.OpEmitter.rowExprs,
+  `Aiur.NativeAIR.OpEmitter.Normal,
+  `Aiur.NativeAIR.OpEmitter.select,
+  `Aiur.NativeAIR.OpEmitter.advice,
+  `Aiur.NativeAIR.OpEmitter.CallExpr.mk,
+  `Aiur.NativeAIR.OpEmitter.CallExpr.eval,
+  `Aiur.NativeAIR.OpEmitter.Emission.mk,
+  `Aiur.NativeAIR.OpEmitter.Emission.eval,
+  `Aiur.NativeAIR.OpEmitter.fromScalar,
+  `Aiur.NativeAIR.OpEmitter.emitAdvice,
+  `Aiur.NativeAIR.OpEmitter.emitByte1,
+  `Aiur.NativeAIR.OpEmitter.byteCarry,
+  `Aiur.NativeAIR.OpEmitter.emitByte2,
+  `Aiur.NativeAIR.OpEmitter.packFour,
+  `Aiur.NativeAIR.OpEmitter.readWord,
+  `Aiur.NativeAIR.OpEmitter.packedAdvice,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum,
+  `Aiur.NativeAIR.OpEmitter.carryStep,
+  `Aiur.NativeAIR.OpEmitter.carries,
+  `Aiur.NativeAIR.OpEmitter.packSix,
+  `Aiur.NativeAIR.OpEmitter.rangePair,
+  `Aiur.NativeAIR.OpEmitter.rangeSix,
+  `Aiur.NativeAIR.OpEmitter.emitCall,
+  `Aiur.NativeAIR.OpEmitter.emitStore,
+  `Aiur.NativeAIR.OpEmitter.emitLoad,
+  `Aiur.NativeAIR.OpEmitter.rangeFour,
+  `Aiur.NativeAIR.OpEmitter.booleanExpr,
+  `Aiur.NativeAIR.OpEmitter.emitU32LessThan,
+  `Aiur.NativeAIR.OpEmitter.emitAssert,
+  `Aiur.NativeAIR.OpEmitter.emitOp,
+  `Aiur.NativeAIR.OpEmitter.OpsEmission.mk,
+  `Aiur.NativeAIR.OpEmitter.OpsEmission.eval,
+  `Aiur.NativeAIR.OpEmitter.emitOps,
+  `Aiur.NativeAIR.LookupEmitter.addArgs,
+  `Aiur.NativeAIR.LookupEmitter.gateArgs,
+  `Aiur.NativeAIR.LookupEmitter.QueryExpr.mk,
+  `Aiur.NativeAIR.LookupEmitter.QueryExpr.eval,
+  `Aiur.NativeAIR.LookupEmitter.queryParts,
+  `Aiur.NativeAIR.LookupEmitter.accumulate,
+  `Aiur.NativeAIR.LookupEmitter.valuedAccumulate,
+  `Aiur.NativeAIR.LookupEmitter.slot,
+  `Aiur.NativeAIR.LookupEmitter.slots]
+
+def blockCircuitRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.BlockEmitter.evaluated_read,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_evaluate,
+  `Aiur.NativeAIR.BlockEmitter.sum_fold_eval,
+  `Aiur.NativeAIR.BlockEmitter.sum_eval,
+  `Aiur.NativeAIR.BlockEmitter.selectors_array_eval,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector_reads,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector_reads,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector_eval,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector_eval,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_flatMap,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_foldl,
+  `Aiur.NativeAIR.BlockEmitter.Emission.eval_of,
+  `Aiur.NativeAIR.BlockEmitter.Emission.eval_components,
+  `Aiur.NativeAIR.BlockEmitter.Emission.prefix_eval,
+  `Aiur.NativeAIR.BlockEmitter.Emission.afterOps_eval,
+  `Aiur.NativeAIR.BlockEmitter.join_eval,
+  `Aiur.NativeAIR.BlockEmitter.Emission.continued_eval,
+  `Aiur.NativeAIR.BlockEmitter.YieldExpr.eval_of,
+  `Aiur.NativeAIR.BlockEmitter.YieldExpr.eval_components,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval_of,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval_components,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.message_eval,
+  `Aiur.NativeAIR.BlockEmitter.returned_eval,
+  `Aiur.NativeAIR.BlockEmitter.yielded_eval,
+  `Aiur.NativeAIR.BlockEmitter.evalRows_getD_any,
+  `Aiur.NativeAIR.BlockEmitter.yieldValue_eval,
+  `Aiur.NativeAIR.BlockEmitter.yieldGate_eval,
+  `Aiur.NativeAIR.BlockEmitter.mergeEquations_eval,
+  `Aiur.NativeAIR.BlockEmitter.yields_size,
+  `Aiur.NativeAIR.BlockEmitter.caseEquation_eval,
+  `Aiur.NativeAIR.BlockEmitter.defaultEquations_eval,
+  `Aiur.NativeAIR.BlockEmitter.fold_max_start,
+  `Aiur.NativeAIR.BlockEmitter.fold_max_member,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_match,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_matchContinue,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_invariants,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_invariants,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_invariants,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_refine_mem,
+  `Aiur.NativeAIR.BlockEmitter.caseRows_reflects,
+  `Aiur.NativeAIR.BlockEmitter.defaultRow_reflects,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_reflects,
+  `Aiur.NativeAIR.BlockEmitter.continueRow_column,
+  `Aiur.NativeAIR.BlockEmitter.advice_absolute_eval,
+  `Aiur.NativeAIR.BlockEmitter.continueRow_reflects,
+  `Aiur.NativeAIR.BlockEmitter.ctrl_reflects,
+  `Aiur.NativeAIR.BlockEmitter.block_reflects,
+  `Aiur.NativeAIR.BlockEmitter.returnArgs_fold_eval,
+  `Aiur.NativeAIR.BlockEmitter.returnArgs_eval,
+  `Aiur.NativeAIR.BlockEmitter.lookup_eval,
+  `Aiur.NativeAIR.CircuitEmitter.selectorExprs_reads,
+  `Aiur.NativeAIR.CircuitEmitter.Member.eval_of,
+  `Aiur.NativeAIR.CircuitEmitter.Member.eval_components,
+  `Aiur.NativeAIR.CircuitEmitter.selectorEquations_eval,
+  `Aiur.NativeAIR.CircuitEmitter.evalFin_of,
+  `Aiur.NativeAIR.CircuitEmitter.evalFin_components,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.eval_of,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.eval_components,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.lookup_eval,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.lookups_eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitMember_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.circuitEmission_eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.equations_vanish,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_reflects]
+
+def blockCircuitQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_evaluate,
+  `Aiur.NativeAIR.BlockEmitter.sum_fold_eval,
+  `Aiur.NativeAIR.BlockEmitter.sum_eval,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_flatMap,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_foldl,
+  `Aiur.NativeAIR.BlockEmitter.Emission.eval_of,
+  `Aiur.NativeAIR.BlockEmitter.Emission.prefix_eval,
+  `Aiur.NativeAIR.BlockEmitter.join_eval,
+  `Aiur.NativeAIR.BlockEmitter.Emission.continued_eval,
+  `Aiur.NativeAIR.BlockEmitter.YieldExpr.eval_of,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval_of,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.message_eval,
+  `Aiur.NativeAIR.BlockEmitter.returned_eval,
+  `Aiur.NativeAIR.BlockEmitter.yielded_eval,
+  `Aiur.NativeAIR.BlockEmitter.yieldGate_eval,
+  `Aiur.NativeAIR.BlockEmitter.yields_size,
+  `Aiur.NativeAIR.BlockEmitter.caseEquation_eval,
+  `Aiur.NativeAIR.BlockEmitter.list_mapM_refine_mem,
+  `Aiur.NativeAIR.BlockEmitter.returnArgs_fold_eval,
+  `Aiur.NativeAIR.BlockEmitter.returnArgs_eval,
+  `Aiur.NativeAIR.BlockEmitter.lookup_eval,
+  `Aiur.NativeAIR.CircuitEmitter.selectorEquations_eval,
+  `Aiur.NativeAIR.CircuitEmitter.equations_vanish]
+
+def blockCircuitClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.BlockEmitter.evaluated_read,
+  `Aiur.NativeAIR.BlockEmitter.selectors_array_eval,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector_reads,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector_reads,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector_eval,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector_eval,
+  `Aiur.NativeAIR.BlockEmitter.Emission.afterOps_eval,
+  `Aiur.NativeAIR.BlockEmitter.evalRows_getD_any,
+  `Aiur.NativeAIR.BlockEmitter.yieldValue_eval,
+  `Aiur.NativeAIR.BlockEmitter.mergeEquations_eval,
+  `Aiur.NativeAIR.BlockEmitter.defaultEquations_eval,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_match,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_matchContinue,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_invariants,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_invariants,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_invariants,
+  `Aiur.NativeAIR.BlockEmitter.caseRows_reflects,
+  `Aiur.NativeAIR.BlockEmitter.defaultRow_reflects,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_reflects,
+  `Aiur.NativeAIR.BlockEmitter.continueRow_column,
+  `Aiur.NativeAIR.BlockEmitter.advice_absolute_eval,
+  `Aiur.NativeAIR.BlockEmitter.continueRow_reflects,
+  `Aiur.NativeAIR.BlockEmitter.ctrl_reflects,
+  `Aiur.NativeAIR.BlockEmitter.block_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.selectorExprs_reads,
+  `Aiur.NativeAIR.CircuitEmitter.evalFin_of,
+  `Aiur.NativeAIR.CircuitEmitter.evalFin_components,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.eval_of,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.eval_components,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.lookup_eval,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.lookups_eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitMember_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.circuitEmission_eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_reflects,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_reflects]
+
+def blockCircuitPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.BlockEmitter.sum,
+  `Aiur.NativeAIR.BlockEmitter.SelectorReads,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector,
+  `Aiur.NativeAIR.BlockEmitter.Context.mk,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.mk,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval,
+  `Aiur.NativeAIR.BlockEmitter.ReturnExpr.message,
+  `Aiur.NativeAIR.BlockEmitter.YieldExpr.mk,
+  `Aiur.NativeAIR.BlockEmitter.YieldExpr.eval,
+  `Aiur.NativeAIR.BlockEmitter.evalGatedCall,
+  `Aiur.NativeAIR.BlockEmitter.Emission.mk,
+  `Aiur.NativeAIR.BlockEmitter.Emission.eval,
+  `Aiur.NativeAIR.BlockEmitter.Emission.prefix,
+  `Aiur.NativeAIR.BlockEmitter.Emission.afterOps,
+  `Aiur.NativeAIR.BlockEmitter.join,
+  `Aiur.NativeAIR.BlockEmitter.Emission.continued,
+  `Aiur.NativeAIR.BlockEmitter.returned,
+  `Aiur.NativeAIR.BlockEmitter.yielded,
+  `Aiur.NativeAIR.BlockEmitter.yieldValue,
+  `Aiur.NativeAIR.BlockEmitter.yieldGate,
+  `Aiur.NativeAIR.BlockEmitter.mergeEquations,
+  `Aiur.NativeAIR.BlockEmitter.caseEquation,
+  `Aiur.NativeAIR.BlockEmitter.defaultEquations,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock,
+  `Aiur.NativeAIR.BlockEmitter.caseRow,
+  `Aiur.NativeAIR.BlockEmitter.defaultRow,
+  `Aiur.NativeAIR.BlockEmitter.branchRows,
+  `Aiur.NativeAIR.BlockEmitter.continueRow,
+  `Aiur.NativeAIR.BlockEmitter.selectorAt,
+  `Aiur.NativeAIR.BlockEmitter.Context.valued,
+  `Aiur.NativeAIR.BlockEmitter.BlockReflects,
+  `Aiur.NativeAIR.BlockEmitter.CtrlReflects,
+  `Aiur.NativeAIR.BlockEmitter.returnArgs,
+  `Aiur.NativeAIR.BlockEmitter.lookup,
+  `Aiur.NativeAIR.CircuitEmitter.selectorExprs,
+  `Aiur.NativeAIR.CircuitEmitter.Member.mk,
+  `Aiur.NativeAIR.CircuitEmitter.Member.readBound,
+  `Aiur.NativeAIR.CircuitEmitter.Member.eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitMember,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers,
+  `Aiur.NativeAIR.CircuitEmitter.rankBytes,
+  `Aiur.NativeAIR.CircuitEmitter.selectorEquations,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.mk,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.readBound,
+  `Aiur.NativeAIR.CircuitEmitter.circuitEmission,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.lookup,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.lookups,
+  `Aiur.NativeAIR.CircuitEmitter.evalFin,
+  `Aiur.NativeAIR.CircuitEmitter.Emission.eval,
+  `Aiur.NativeAIR.CircuitEmitter.Compiled.mk,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit]
+
+def allocationRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.selectedDegree_initial,
+  `Aiur.Bytecode.selectedDegree_append,
+  `Aiur.Concrete.Bytecode.getDegree_list,
+  `Aiur.Concrete.Bytecode.getDegree_array,
+  `Aiur.Concrete.Bytecode.opLayout_allocation,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.konst,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.variable,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.add,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.sub,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.mul,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.empty,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.singleton,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.append,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.push,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.read,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.getD,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.select,
+  `Aiur.NativeAIR.OpEmitter.advice_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.packFour_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.readWord_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.fromScalar_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitMul_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitEqZero_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitU32LessThan_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitOp_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitOps_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitEqZero_allocation,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_empty,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_append,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_push,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_singleton,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_getD,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_read,
+  `Aiur.NativeAIR.OpEmitter.select_degrees,
+  `Aiur.NativeAIR.OpEmitter.advice_degrees,
+  `Aiur.NativeAIR.OpEmitter.packFour_degree,
+  `Aiur.NativeAIR.OpEmitter.readWord_degree,
+  `Aiur.NativeAIR.OpEmitter.emitAdvice_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitOp_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitOp_layout,
+  `Aiur.NativeAIR.OpEmitter.emitOps_fold_layout,
+  `Aiur.NativeAIR.OpEmitter.emitOps_layout,
+  `Aiur.Concrete.Bytecode.allocationBranchStep_degrees,
+  `Aiur.Concrete.Bytecode.allocationBranchStep_column,
+  `Aiur.Concrete.Bytecode.allocationBranchFold,
+  `Aiur.Concrete.Bytecode.allocationBranchLoop,
+  `Aiur.Concrete.Bytecode.matchLayout_allocation,
+  `Aiur.Concrete.Bytecode.ctrlLayout_continue,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_values,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_degreeValid,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_degreeValid,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_layout,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_layout,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_layout]
+
+def allocationAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.konst,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.variable]
+
+def allocationQuotRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.selectedDegree_initial,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.add,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.sub,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant.mul,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.append,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid.select,
+  `Aiur.NativeAIR.OpEmitter.packFour_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.readWord_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitMul_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_empty,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_append,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_push,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_singleton,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_getD,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees_read,
+  `Aiur.NativeAIR.OpEmitter.select_degrees]
+
+def allocationClassicalRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.selectedDegree_append,
+  `Aiur.Concrete.Bytecode.getDegree_list,
+  `Aiur.Concrete.Bytecode.getDegree_array,
+  `Aiur.Concrete.Bytecode.opLayout_allocation,
+  `Aiur.NativeAIR.OpEmitter.advice_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitOp_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.emitOps_degreeValid,
+  `Aiur.NativeAIR.OpEmitter.advice_degrees,
+  `Aiur.NativeAIR.OpEmitter.packFour_degree,
+  `Aiur.NativeAIR.OpEmitter.readWord_degree,
+  `Aiur.NativeAIR.OpEmitter.emitAdvice_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitWordSum_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitOp_allocation,
+  `Aiur.NativeAIR.OpEmitter.emitOp_layout,
+  `Aiur.NativeAIR.OpEmitter.emitOps_fold_layout,
+  `Aiur.NativeAIR.OpEmitter.emitOps_layout,
+  `Aiur.Concrete.Bytecode.allocationBranchStep_degrees,
+  `Aiur.Concrete.Bytecode.allocationBranchStep_column,
+  `Aiur.Concrete.Bytecode.allocationBranchFold,
+  `Aiur.Concrete.Bytecode.allocationBranchLoop,
+  `Aiur.Concrete.Bytecode.matchLayout_allocation,
+  `Aiur.Concrete.Bytecode.ctrlLayout_continue,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_values,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_degreeValid,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_degreeValid,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_layout,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_layout,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_layout]
+
+def allocationPremises : Array Lean.Name := #[
+  `Aiur.Bytecode.OpAllocation.mk,
+  `Aiur.Bytecode.OpAllocation.advice,
+  `Aiur.Bytecode.selectedDegree,
+  `Aiur.Bytecode.Op.allocation,
+  `Aiur.NativeAIR.RowExpr.ZeroConstant,
+  `Aiur.NativeAIR.OpEmitter.DegreeValid,
+  `Aiur.NativeAIR.OpEmitter.rowDegrees,
+  `Aiur.NativeAIR.OpEmitter.Emission.allocation,
+  `Aiur.Concrete.Bytecode.allocationBranchStep]
+
+def circuitAllocationRoots : Array Lean.Name := #[
+  `Aiur.Concrete.Bytecode.opLayout_fixed,
+  `Aiur.Concrete.Bytecode.opsLayout_fields,
+  `Aiur.Concrete.Bytecode.allocationBranchStep_fields,
+  `Aiur.Concrete.Bytecode.allocationBranchFold_fields,
+  `Aiur.Concrete.Bytecode.matchLayout_fields,
+  `Aiur.Concrete.Bytecode.ctrlLayout_fields,
+  `Aiur.Concrete.Bytecode.blockLayout_fields,
+  `Aiur.Concrete.Bytecode.ctrlLayout_match_list,
+  `Aiur.Concrete.Bytecode.rewriteOp_layout,
+  `Aiur.Concrete.Bytecode.matchLayout_rewrite,
+  `Aiur.Concrete.Bytecode.rewriteCtrl_layout,
+  `Aiur.Concrete.Bytecode.rewriteBlock_layout,
+  `Aiur.Bytecode.functionsComputedLayout_empty,
+  `Aiur.Bytecode.functionsComputedLayout_push,
+  `Aiur.Bytecode.Function.ComputedLayout.auxiliaries,
+  `Aiur.Bytecode.Function.ComputedLayout.reserved,
+  `Aiur.Bytecode.Function.ComputedLayout.selectors,
+  `Aiur.Concrete.Function.compile_computedLayout,
+  `Aiur.Concrete.Decls.toBytecode_computedLayout,
+  `Aiur.Bytecode.Function.ComputedLayout.rewrite,
+  `Aiur.Bytecode.deduplicate_newFunctions_computedLayout,
+  `Aiur.Bytecode.Toplevel.deduplicateCandidate_computedLayout,
+  `Aiur.Bytecode.Toplevel.deduplicate_computedLayout,
+  `Aiur.finishCompilation_computedLayout,
+  `Aiur.Source.Toplevel.compile_computedLayout,
+  `Aiur.BoundVerifier.Backend.functions_computedLayout,
+  `Aiur.Bytecode.merged_columnBound,
+  `Aiur.Bytecode.singletonCircuits_columnBound,
+  `Aiur.CompiledToplevel.groupFunctions_columnBound,
+  `Aiur.finishCompilation_columnBound,
+  `Aiur.Source.Toplevel.compile_columnBound,
+  `Aiur.BoundVerifier.Backend.circuits_columnBound,
+  `Aiur.NativeAIR.CircuitEmitter.emitMember_layout,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers_layout,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers_selectors,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_readBound,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_readBound,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_physical_reflects,
+  `Aiur.BoundVerifier.Backend.circuit_readBound,
+  `Aiur.BoundVerifier.Backend.compileCircuit_reflects]
+
+def circuitAllocationPremises : Array Lean.Name := #[
+  `Aiur.Bytecode.Function.ComputedLayout,
+  `Aiur.Bytecode.FunctionsComputedLayout,
+  `Aiur.Bytecode.MembersColumnBound,
+  `Aiur.Bytecode.CircuitsColumnBound]
+
+def circuitCompletionRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Compiler.compileExpr_defined,
+  `Aiur.NativeAIR.Compiler.compileExprs_defined,
+  `Aiur.NativeAIR.Compiler.compileLookup_defined,
+  `Aiur.NativeAIR.Compiler.compileLookups_defined,
+  `Aiur.NativeAIR.Compiler.recordZero_defined,
+  `Aiur.NativeAIR.Compiler.compileZeros_defined,
+  `Aiur.NativeAIR.Compiler.compileBase_defined,
+  `Aiur.AIR.selectorSum_zero,
+  `Aiur.AIR.emitOp_inactive,
+  `Aiur.AIR.emitOps_inactive,
+  `Aiur.AIR.BlockEmission.Inactive.prefix,
+  `Aiur.AIR.BlockEmission.Inactive.afterOps,
+  `Aiur.AIR.joinBlockEmissions_inactive,
+  `Aiur.AIR.BlockEmission.Inactive.continued,
+  `Aiur.Bytecode.branchSelectorFlows_entry_zero,
+  `Aiur.Bytecode.Ctrl.selectorFlow_entry_zero,
+  `Aiur.Bytecode.Block.selectorFlow_entry_zero,
+  `Aiur.Bytecode.branchRows_inactive,
+  `Aiur.Bytecode.Ctrl.emitRow_inactive,
+  `Aiur.Bytecode.Block.emitRow_inactive,
+  `Aiur.AIR.MemberEmission.entry_zero,
+  `Aiur.AIR.emitMember_zero,
+  `Aiur.AIR.emitMembers_zero,
+  `Aiur.AIR.circuitEmission_zero,
+  `Aiur.Bytecode.Circuit.emitRow_zero,
+  `Aiur.NativeAIR.CircuitEmitter.zeroValues_fits,
+  `Aiur.NativeAIR.CircuitEmitter.zeroValues_read,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_zero_eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_compiles,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_defined_iff,
+  `Aiur.BoundVerifier.Backend.emitCircuit_compiles,
+  `Aiur.BoundVerifier.Backend.emittedCircuit_reflects]
+
+def circuitCompletionQuotRoots : Array Lean.Name := #[
+  `Aiur.AIR.emitOp_inactive,
+  `Aiur.AIR.emitOps_inactive,
+  `Aiur.AIR.joinBlockEmissions_inactive]
+
+def circuitCompletionClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Compiler.compileExpr_defined,
+  `Aiur.NativeAIR.Compiler.compileExprs_defined,
+  `Aiur.NativeAIR.Compiler.compileLookup_defined,
+  `Aiur.NativeAIR.Compiler.compileLookups_defined,
+  `Aiur.NativeAIR.Compiler.recordZero_defined,
+  `Aiur.NativeAIR.Compiler.compileZeros_defined,
+  `Aiur.NativeAIR.Compiler.compileBase_defined,
+  `Aiur.Bytecode.branchSelectorFlows_entry_zero,
+  `Aiur.Bytecode.Ctrl.selectorFlow_entry_zero,
+  `Aiur.Bytecode.Block.selectorFlow_entry_zero,
+  `Aiur.Bytecode.branchRows_inactive,
+  `Aiur.Bytecode.Ctrl.emitRow_inactive,
+  `Aiur.Bytecode.Block.emitRow_inactive,
+  `Aiur.AIR.MemberEmission.entry_zero,
+  `Aiur.AIR.emitMember_zero,
+  `Aiur.AIR.emitMembers_zero,
+  `Aiur.AIR.circuitEmission_zero,
+  `Aiur.Bytecode.Circuit.emitRow_zero,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_zero_eval,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_compiles,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_defined_iff,
+  `Aiur.BoundVerifier.Backend.emitCircuit_compiles,
+  `Aiur.BoundVerifier.Backend.emittedCircuit_reflects]
+
+def circuitCompletionPremises : Array Lean.Name := #[
+  `Aiur.AIR.BlockEmission.Inactive,
+  `Aiur.NativeAIR.CircuitEmitter.circuitWidths,
+  `Aiur.NativeAIR.CircuitEmitter.zeroValues]
+
+def checkedCircuitRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.indicesInScope_spec,
+  `Aiur.Bytecode.wordInScope_spec,
+  `Aiur.Bytecode.addScope_eq,
+  `Aiur.Bytecode.checkEmissionOps_cons,
+  `Aiur.Bytecode.checkEmissionOps_le,
+  `Aiur.Bytecode.Op.allocation_outputSize,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_defined,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_defined,
+  `Aiur.NativeAIR.OpEmitter.select_defined,
+  `Aiur.NativeAIR.OpEmitter.readWord_defined,
+  `Aiur.NativeAIR.OpEmitter.emitOp_defined,
+  `Aiur.NativeAIR.OpEmitter.emitOp_outputSize,
+  `Aiur.NativeAIR.OpEmitter.emitOps_defined,
+  `Aiur.Bytecode.emissionChecks_match,
+  `Aiur.Bytecode.emissionChecks_matchContinue,
+  `Aiur.Bytecode.Block.emissionChecks_parts,
+  `Aiur.Bytecode.Toplevel.validateEmission_function,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector_defined,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector_defined,
+  `Aiur.NativeAIR.BlockEmitter.Emission.YieldShape.prefix,
+  `Aiur.NativeAIR.BlockEmitter.join_yieldShape,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_defined,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_defined,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_defined,
+  `Aiur.NativeAIR.CircuitEmitter.emitMember_defined,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers_defined,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_defined,
+  `Aiur.BoundVerifier.Backend.circuit_emits,
+  `Aiur.BoundVerifier.Backend.circuit_compiles,
+  `Aiur.BoundVerifier.Backend.circuit_graph_reflects]
+
+def checkedCircuitAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.addScope_eq,
+  `Aiur.NativeAIR.BlockEmitter.Emission.YieldShape.prefix]
+
+def checkedCircuitQuotRoots : Array Lean.Name := #[
+  `Aiur.Bytecode.indicesInScope_spec,
+  `Aiur.Bytecode.wordInScope_spec,
+  `Aiur.Bytecode.checkEmissionOps_le,
+  `Aiur.NativeAIR.OpEmitter.list_mapM_defined,
+  `Aiur.NativeAIR.OpEmitter.array_mapM_defined,
+  `Aiur.NativeAIR.OpEmitter.select_defined,
+  `Aiur.NativeAIR.OpEmitter.readWord_defined,
+  `Aiur.NativeAIR.OpEmitter.emitOp_defined,
+  `Aiur.NativeAIR.BlockEmitter.join_yieldShape]
+
+def checkedCircuitClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.OpEmitter.emitOp_outputSize,
+  `Aiur.NativeAIR.OpEmitter.emitOps_defined,
+  `Aiur.Bytecode.emissionChecks_match,
+  `Aiur.Bytecode.emissionChecks_matchContinue,
+  `Aiur.Bytecode.Block.emissionChecks_parts,
+  `Aiur.Bytecode.Toplevel.validateEmission_function,
+  `Aiur.NativeAIR.BlockEmitter.ctrlSelector_defined,
+  `Aiur.NativeAIR.BlockEmitter.blockSelector_defined,
+  `Aiur.NativeAIR.BlockEmitter.branchRows_defined,
+  `Aiur.NativeAIR.BlockEmitter.emitCtrl_defined,
+  `Aiur.NativeAIR.BlockEmitter.emitBlock_defined,
+  `Aiur.NativeAIR.CircuitEmitter.emitMember_defined,
+  `Aiur.NativeAIR.CircuitEmitter.emitMembers_defined,
+  `Aiur.NativeAIR.CircuitEmitter.emitCircuit_defined,
+  `Aiur.BoundVerifier.Backend.circuit_emits,
+  `Aiur.BoundVerifier.Backend.circuit_compiles,
+  `Aiur.BoundVerifier.Backend.circuit_graph_reflects]
+
+def checkedCircuitPremises : Array Lean.Name := #[
+  `Aiur.Bytecode.indicesInScope,
+  `Aiur.Bytecode.wordInScope,
+  `Aiur.Bytecode.Op.outputSize,
+  `Aiur.Bytecode.Op.emissionInputs,
+  `Aiur.Bytecode.addScope,
+  `Aiur.Bytecode.checkEmissionOps,
+  `Aiur.Bytecode.Ctrl.emissionChecks,
+  `Aiur.Bytecode.Block.emissionChecks,
+  `Aiur.Bytecode.Function.emissionChecks,
+  `Aiur.Bytecode.Toplevel.validateEmission,
+  `Aiur.NativeAIR.BlockEmitter.Emission.YieldShape]
+
+def keyCodecRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.KeyCodec.Reads.pure,
+  `Aiur.NativeAIR.KeyCodec.Reads.bind,
+  `Aiur.NativeAIR.KeyCodec.Reads.map,
+  `Aiur.NativeAIR.KeyCodec.Reads.result,
+  `Aiur.NativeAIR.KeyCodec.readByte_reads,
+  `Aiur.NativeAIR.KeyCodec.Reads.byte,
+  `Aiur.NativeAIR.KeyCodec.encodeNat_length,
+  `Aiur.NativeAIR.KeyCodec.readNat_reads,
+  `Aiur.NativeAIR.KeyCodec.readMany_reads,
+  `Aiur.NativeAIR.KeyCodec.readVector_reads,
+  `Aiur.NativeAIR.KeyCodec.readNode_reads,
+  `Aiur.NativeAIR.KeyCodec.readLookup_reads,
+  `Aiur.NativeAIR.KeyCodec.readCircuitData_reads,
+  `Aiur.NativeAIR.KeyCodec.readCircuit_reads,
+  `Aiur.NativeAIR.KeyCodec.readParameters_reads,
+  `Aiur.NativeAIR.KeyCodec.readCommitment_reads,
+  `Aiur.NativeAIR.KeyCodec.readIndex_reads,
+  `Aiur.NativeAIR.KeyCodec.readKey_reads,
+  `Aiur.NativeAIR.KeyCodec.decode_encode,
+  `Aiur.NativeAIR.KeyCodec.decodeCanonical_success,
+  `Aiur.NativeAIR.KeyCodec.decodeCanonical_encode,
+  `Aiur.NativeAIR.KeyCodec.canonical_bytes_unique,
+  `Aiur.NativeAIR.KeyCodec.encode_injective,
+  `Aiur.NativeAIR.KeyCodec.Returns.pure,
+  `Aiur.NativeAIR.KeyCodec.Returns.failure,
+  `Aiur.NativeAIR.KeyCodec.Returns.bind,
+  `Aiur.NativeAIR.KeyCodec.Returns.bind_any,
+  `Aiur.NativeAIR.KeyCodec.Returns.weaken,
+  `Aiur.NativeAIR.KeyCodec.Returns.result,
+  `Aiur.NativeAIR.KeyCodec.readMany_returns,
+  `Aiur.NativeAIR.KeyCodec.readVector_returns,
+  `Aiur.NativeAIR.KeyCodec.readCircuit_returns,
+  `Aiur.NativeAIR.KeyCodec.readCommitment_returns,
+  `Aiur.NativeAIR.KeyCodec.readKey_returns,
+  `Aiur.NativeAIR.KeyCodec.decode_success,
+  `Aiur.NativeAIR.KeyCodec.decode_valid,
+  `Aiur.NativeAIR.KeyCodec.readKey_commitment,
+  `Aiur.NativeAIR.KeyCodec.decode_commitment,
+  `Aiur.NativeAIR.KeyCodec.Circuit.valid_graph,
+  `Aiur.NativeAIR.KeyCodec.decoded_graph_sweeps,
+  `Aiur.NativeAIR.KeyCodec.decode_encoded_suffix,
+  `Aiur.BoundVerifier.Backend.key_decodes,
+  `Aiur.BoundVerifier.Backend.native_key_decodes,
+  `Aiur.BoundVerifier.Backend.native_key_encoding,
+  `Aiur.BoundVerifier.Backend.key_commitment,
+  `Aiur.BoundVerifier.Backend.key_graph_valid,
+  `Aiur.BoundVerifier.Backend.key_graph_reflects]
+
+def keyCodecAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.KeyCodec.Reads.pure,
+  `Aiur.NativeAIR.KeyCodec.Reads.map,
+  `Aiur.NativeAIR.KeyCodec.Reads.result,
+  `Aiur.NativeAIR.KeyCodec.readByte_reads,
+  `Aiur.NativeAIR.KeyCodec.Returns.pure,
+  `Aiur.NativeAIR.KeyCodec.Returns.failure,
+  `Aiur.NativeAIR.KeyCodec.Returns.weaken]
+
+def keyCodecQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.KeyCodec.readCircuit_reads,
+  `Aiur.NativeAIR.KeyCodec.readParameters_reads,
+  `Aiur.NativeAIR.KeyCodec.readIndex_reads,
+  `Aiur.NativeAIR.KeyCodec.readMany_returns,
+  `Aiur.NativeAIR.KeyCodec.readVector_returns,
+  `Aiur.NativeAIR.KeyCodec.Circuit.valid_graph]
+
+def keyCodecClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.KeyCodec.readCommitment_reads,
+  `Aiur.NativeAIR.KeyCodec.readKey_reads,
+  `Aiur.NativeAIR.KeyCodec.decode_encode,
+  `Aiur.NativeAIR.KeyCodec.decodeCanonical_success,
+  `Aiur.NativeAIR.KeyCodec.decodeCanonical_encode,
+  `Aiur.NativeAIR.KeyCodec.canonical_bytes_unique,
+  `Aiur.NativeAIR.KeyCodec.encode_injective,
+  `Aiur.NativeAIR.KeyCodec.readCommitment_returns,
+  `Aiur.NativeAIR.KeyCodec.readKey_returns,
+  `Aiur.NativeAIR.KeyCodec.decode_success,
+  `Aiur.NativeAIR.KeyCodec.decode_valid,
+  `Aiur.NativeAIR.KeyCodec.readKey_commitment,
+  `Aiur.NativeAIR.KeyCodec.decode_commitment,
+  `Aiur.NativeAIR.KeyCodec.decoded_graph_sweeps,
+  `Aiur.NativeAIR.KeyCodec.decode_encoded_suffix,
+  `Aiur.BoundVerifier.Backend.key_decodes,
+  `Aiur.BoundVerifier.Backend.native_key_decodes,
+  `Aiur.BoundVerifier.Backend.native_key_encoding,
+  `Aiur.BoundVerifier.Backend.key_commitment,
+  `Aiur.BoundVerifier.Backend.key_graph_valid,
+  `Aiur.BoundVerifier.Backend.key_graph_reflects]
+
+def keyCodecPremises : Array Lean.Name := #[
+  `Aiur.BoundVerifier.Selection.keyParameters,
+  `Aiur.NativeAIR.KeyCodec.Reader,
+  `Aiur.NativeAIR.KeyCodec.readByte,
+  `Aiur.NativeAIR.KeyCodec.readNat,
+  `Aiur.NativeAIR.KeyCodec.readMany,
+  `Aiur.NativeAIR.KeyCodec.readVector,
+  `Aiur.NativeAIR.KeyCodec.encodeNat,
+  `Aiur.NativeAIR.KeyCodec.encodeVector,
+  `Aiur.NativeAIR.KeyCodec.readNode,
+  `Aiur.NativeAIR.KeyCodec.encodeNode,
+  `Aiur.NativeAIR.KeyCodec.readLookup,
+  `Aiur.NativeAIR.KeyCodec.encodeLookup,
+  `Aiur.NativeAIR.KeyCodec.Circuit.mk,
+  `Aiur.NativeAIR.KeyCodec.Circuit.groups,
+  `Aiur.NativeAIR.KeyCodec.Circuit.widths,
+  `Aiur.NativeAIR.KeyCodec.Circuit.constraintCount,
+  `Aiur.NativeAIR.KeyCodec.nodeDegree,
+  `Aiur.NativeAIR.KeyCodec.nodeDegreesFrom,
+  `Aiur.NativeAIR.KeyCodec.lookupDegrees,
+  `Aiur.NativeAIR.KeyCodec.groupDegree,
+  `Aiur.NativeAIR.KeyCodec.Circuit.computedDegree,
+  `Aiur.NativeAIR.KeyCodec.Circuit.valid,
+  `Aiur.NativeAIR.KeyCodec.readCircuitData,
+  `Aiur.NativeAIR.KeyCodec.readCircuit,
+  `Aiur.NativeAIR.KeyCodec.encodeCircuit,
+  `Aiur.NativeAIR.KeyCodec.Parameters.mk,
+  `Aiur.NativeAIR.KeyCodec.readParameters,
+  `Aiur.NativeAIR.KeyCodec.encodeParameters,
+  `Aiur.NativeAIR.KeyCodec.MerkleCap,
+  `Aiur.NativeAIR.KeyCodec.readCommitment,
+  `Aiur.NativeAIR.KeyCodec.encodeCommitment,
+  `Aiur.NativeAIR.KeyCodec.readIndex,
+  `Aiur.NativeAIR.KeyCodec.encodeIndex,
+  `Aiur.NativeAIR.KeyCodec.Key.mk,
+  `Aiur.NativeAIR.KeyCodec.readKey,
+  `Aiur.NativeAIR.KeyCodec.encodeKey,
+  `Aiur.NativeAIR.KeyCodec.decode,
+  `Aiur.NativeAIR.KeyCodec.encode,
+  `Aiur.NativeAIR.KeyCodec.decodeCanonical,
+  `Aiur.NativeAIR.KeyCodec.Reads,
+  `Aiur.NativeAIR.KeyCodec.NodeWireFits,
+  `Aiur.NativeAIR.KeyCodec.LookupWireFits.mk,
+  `Aiur.NativeAIR.KeyCodec.CircuitWireFits.mk,
+  `Aiur.NativeAIR.KeyCodec.ParametersWireFits,
+  `Aiur.NativeAIR.KeyCodec.CommitmentWireFits,
+  `Aiur.NativeAIR.KeyCodec.IndexWireFits,
+  `Aiur.NativeAIR.KeyCodec.KeyWireFits.mk,
+  `Aiur.NativeAIR.KeyCodec.Returns,
+  `Aiur.NativeAIR.KeyCodec.CommitmentValid]
+
+def compiledKeyRoots : Array Lean.Name := #[
+  `Aiur.BoundVerifier.CompiledBackend.circuits_bound,
+  `Aiur.BoundVerifier.CompiledBackend.preprocessed_indices,
+  `Aiur.BoundVerifier.verifyCompiled_success,
+  `Aiur.NativeAIR.Compiler.compileExpr_widen,
+  `Aiur.NativeAIR.Compiler.compileExprs_widen,
+  `Aiur.NativeAIR.Compiler.compileLookup_widen,
+  `Aiur.NativeAIR.Compiler.compileLookups_widen,
+  `Aiur.NativeAIR.Compiler.compileZeros_widen,
+  `Aiur.NativeAIR.Compiler.compileBase_widen,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_widen,
+  `Aiur.NativeAIR.CircuitEmitter.circuitWidths_le,
+  `Aiur.NativeAIR.CompiledKey.column_eval,
+  `Aiur.NativeAIR.CompiledKey.memoryEquations_eval,
+  `Aiur.NativeAIR.CompiledKey.memoryLookup_eval,
+  `Aiur.NativeAIR.CompiledKey.byte1Lookup_eval,
+  `Aiur.NativeAIR.CompiledKey.byte2Lookup_eval,
+  `Aiur.NativeAIR.CompiledKey.circuit_success,
+  `Aiur.NativeAIR.CompiledKey.functionCircuit_success,
+  `Aiur.NativeAIR.CompiledKey.memoryCircuit_success,
+  `Aiur.NativeAIR.CompiledKey.byte1Circuit_success,
+  `Aiur.NativeAIR.CompiledKey.byte2Circuit_success,
+  `Aiur.NativeAIR.CompiledKey.circuits_parts,
+  `Aiur.NativeAIR.CompiledKey.circuits_length,
+  `Aiur.NativeAIR.CompiledKey.circuits_function,
+  `Aiur.NativeAIR.CompiledKey.circuits_memory,
+  `Aiur.NativeAIR.CompiledKey.circuits_bytes,
+  `Aiur.NativeAIR.CompiledKey.memoryCircuit_reflects,
+  `Aiur.NativeAIR.CompiledKey.byte1Circuit_reflects,
+  `Aiur.NativeAIR.CompiledKey.byte2Circuit_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.circuit_count,
+  `Aiur.BoundVerifier.CompiledBackend.function_graph_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.memory_graph_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.byte_graphs,
+  `Aiur.BoundVerifier.CompiledBackend.byte1_graph_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.byte2_graph_reflects]
+
+def compiledKeyQuotOnlyRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.CompiledKey.circuit_success]
+
+def compiledKeyQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Compiler.compileZeros_widen,
+  `Aiur.NativeAIR.Compiler.compileBase_widen,
+  `Aiur.NativeAIR.CompiledKey.memoryEquations_eval,
+  `Aiur.NativeAIR.CompiledKey.byte1Lookup_eval,
+  `Aiur.NativeAIR.CompiledKey.byte2Lookup_eval,
+  `Aiur.NativeAIR.CompiledKey.memoryCircuit_success,
+  `Aiur.NativeAIR.CompiledKey.byte1Circuit_success,
+  `Aiur.NativeAIR.CompiledKey.byte2Circuit_success]
+
+def compiledKeyClassicalRoots : Array Lean.Name := #[
+  `Aiur.BoundVerifier.CompiledBackend.circuits_bound,
+  `Aiur.BoundVerifier.CompiledBackend.preprocessed_indices,
+  `Aiur.BoundVerifier.verifyCompiled_success,
+  `Aiur.NativeAIR.CircuitEmitter.compileCircuit_widen,
+  `Aiur.NativeAIR.CompiledKey.memoryLookup_eval,
+  `Aiur.NativeAIR.CompiledKey.functionCircuit_success,
+  `Aiur.NativeAIR.CompiledKey.circuits_parts,
+  `Aiur.NativeAIR.CompiledKey.circuits_length,
+  `Aiur.NativeAIR.CompiledKey.circuits_function,
+  `Aiur.NativeAIR.CompiledKey.circuits_memory,
+  `Aiur.NativeAIR.CompiledKey.circuits_bytes,
+  `Aiur.NativeAIR.CompiledKey.memoryCircuit_reflects,
+  `Aiur.NativeAIR.CompiledKey.byte1Circuit_reflects,
+  `Aiur.NativeAIR.CompiledKey.byte2Circuit_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.circuit_count,
+  `Aiur.BoundVerifier.CompiledBackend.function_graph_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.memory_graph_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.byte_graphs,
+  `Aiur.BoundVerifier.CompiledBackend.byte1_graph_reflects,
+  `Aiur.BoundVerifier.CompiledBackend.byte2_graph_reflects]
+
+def compiledKeyPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.CompiledKey.main,
+  `Aiur.NativeAIR.CompiledKey.next,
+  `Aiur.NativeAIR.CompiledKey.preprocessed,
+  `Aiur.NativeAIR.CompiledKey.memoryEquations,
+  `Aiur.NativeAIR.CompiledKey.memoryLookup,
+  `Aiur.NativeAIR.CompiledKey.byte1Lookup,
+  `Aiur.NativeAIR.CompiledKey.byte2Lookup,
+  `Aiur.NativeAIR.CompiledKey.circuit,
+  `Aiur.NativeAIR.CompiledKey.functionCircuit,
+  `Aiur.NativeAIR.CompiledKey.memoryCircuit,
+  `Aiur.NativeAIR.CompiledKey.byte1Circuit,
+  `Aiur.NativeAIR.CompiledKey.byte2Circuit,
+  `Aiur.NativeAIR.CompiledKey.circuits,
+  `Aiur.NativeAIR.CompiledKey.preprocessedIndices,
+  `Aiur.NativeAIR.CompiledKey.check,
+  `Aiur.BoundVerifier.CompiledBackend.mk,
+  `Aiur.BoundVerifier.buildCompiled,
+  `Aiur.BoundVerifier.verifyCompiled,
+  `Aiur.NativeAIR.GraphWidths.Le,
+  `Aiur.NativeAIR.CompiledKey.columns]
+
+def proofAcceptanceRoots : Array Lean.Name := #[
+  `Aiur.BoundVerifier.verifyShaped_success,
+  `Aiur.NativeAIR.ProofCodec.readVector_reads,
+  `Aiur.NativeAIR.ProofCodec.readOption_reads,
+  `Aiur.NativeAIR.ProofCodec.readBool_reads,
+  `Aiur.NativeAIR.ProofCodec.readField_reads,
+  `Aiur.NativeAIR.ProofCodec.readExtension_reads,
+  `Aiur.NativeAIR.ProofCodec.readCap_reads,
+  `Aiur.NativeAIR.ProofCodec.readOpenings_reads,
+  `Aiur.NativeAIR.ProofCodec.readCommitments_reads,
+  `Aiur.NativeAIR.ProofCodec.readBatchOpening_reads,
+  `Aiur.NativeAIR.ProofCodec.readCommitStep_reads,
+  `Aiur.NativeAIR.ProofCodec.readFri_reads,
+  `Aiur.NativeAIR.ProofCodec.readData_reads,
+  `Aiur.NativeAIR.ProofCodec.decode_encode,
+  `Aiur.NativeAIR.ProofCodec.decode_success,
+  `Aiur.NativeAIR.ProofCodec.decodeCanonical_success,
+  `Aiur.NativeAIR.ProofCodec.decodeCanonical_encode,
+  `Aiur.NativeAIR.ProofCodec.canonical_bytes_unique,
+  `Aiur.NativeAIR.ProofCodec.encode_injective,
+  `Aiur.NativeAIR.ProofCodec.decode_append_rejected,
+  `Aiur.NativeAIR.ProofCodec.readNat_returns,
+  `Aiur.NativeAIR.ProofCodec.readVector_returns,
+  `Aiur.NativeAIR.ProofCodec.readOption_returns,
+  `Aiur.NativeAIR.ProofCodec.readCap_returns,
+  `Aiur.NativeAIR.ProofCodec.readOpenings_returns,
+  `Aiur.NativeAIR.ProofCodec.readCommitments_returns,
+  `Aiur.NativeAIR.ProofCodec.readBatchOpening_returns,
+  `Aiur.NativeAIR.ProofCodec.readCommitStep_returns,
+  `Aiur.NativeAIR.ProofCodec.readFri_returns,
+  `Aiur.NativeAIR.ProofCodec.readData_returns,
+  `Aiur.NativeAIR.ProofCodec.decode_fits,
+  `Aiur.NativeAIR.ProofShape.pair_success,
+  `Aiur.NativeAIR.ProofShape.single_success,
+  `Aiur.NativeAIR.ProofShape.readPreprocessed_none,
+  `Aiur.NativeAIR.ProofShape.readPreprocessed_some,
+  `Aiur.NativeAIR.ProofShape.readRow_success,
+  `Aiur.NativeAIR.ProofShape.Pair.hasWidth_success,
+  `Aiur.NativeAIR.ProofShape.Row.fits_success,
+  `Aiur.NativeAIR.ProofShape.check_success,
+  `Aiur.NativeAIR.ProofShape.check_length,
+  `Aiur.NativeAIR.ProofShape.activeIndices_mem,
+  `Aiur.NativeAIR.ProofShape.check_row,
+  `Aiur.NativeAIR.ProofShape.check_row_active,
+  `Aiur.NativeAIR.ProofShape.check_nonempty,
+  `Aiur.NativeAIR.ProofShape.fixedHeights_sound,
+  `Aiur.NativeAIR.ProofShape.queryBound_sound,
+  `Aiur.BoundVerifier.CheckedProof.framing,
+  `Aiur.BoundVerifier.CheckedProof.wire_bounds,
+  `Aiur.BoundVerifier.CheckedProof.row,
+  `Aiur.BoundVerifier.CheckedProof.nonempty,
+  `Aiur.BoundVerifier.CheckedProof.fixed_heights,
+  `Aiur.BoundVerifier.CheckedProof.lookup_budget,
+  `Aiur.BoundVerifier.verifyShaped_acceptance]
+
+def proofAcceptanceAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.ProofCodec.readBool_reads]
+
+def proofAcceptanceQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.ProofCodec.decode_success,
+  `Aiur.NativeAIR.ProofCodec.decodeCanonical_success,
+  `Aiur.NativeAIR.ProofCodec.decodeCanonical_encode,
+  `Aiur.NativeAIR.ProofCodec.canonical_bytes_unique,
+  `Aiur.NativeAIR.ProofCodec.readNat_returns,
+  `Aiur.NativeAIR.ProofCodec.readVector_returns,
+  `Aiur.NativeAIR.ProofCodec.readCap_returns,
+  `Aiur.NativeAIR.ProofCodec.readOpenings_returns,
+  `Aiur.NativeAIR.ProofCodec.readCommitments_returns,
+  `Aiur.NativeAIR.ProofCodec.readBatchOpening_returns,
+  `Aiur.NativeAIR.ProofCodec.readCommitStep_returns,
+  `Aiur.NativeAIR.ProofCodec.readFri_returns,
+  `Aiur.NativeAIR.ProofCodec.readData_returns,
+  `Aiur.NativeAIR.ProofCodec.decode_fits,
+  `Aiur.NativeAIR.ProofShape.readPreprocessed_some,
+  `Aiur.NativeAIR.ProofShape.readRow_success,
+  `Aiur.NativeAIR.ProofShape.Pair.hasWidth_success,
+  `Aiur.NativeAIR.ProofShape.Row.fits_success,
+  `Aiur.NativeAIR.ProofShape.check_success,
+  `Aiur.NativeAIR.ProofShape.check_length,
+  `Aiur.NativeAIR.ProofShape.activeIndices_mem,
+  `Aiur.NativeAIR.ProofShape.check_row,
+  `Aiur.NativeAIR.ProofShape.check_row_active,
+  `Aiur.NativeAIR.ProofShape.check_nonempty,
+  `Aiur.NativeAIR.ProofShape.fixedHeights_sound,
+  `Aiur.NativeAIR.ProofShape.queryBound_sound,
+  `Aiur.BoundVerifier.CheckedProof.framing,
+  `Aiur.BoundVerifier.CheckedProof.wire_bounds,
+  `Aiur.BoundVerifier.CheckedProof.row,
+  `Aiur.BoundVerifier.CheckedProof.nonempty,
+  `Aiur.BoundVerifier.CheckedProof.fixed_heights,
+  `Aiur.BoundVerifier.CheckedProof.lookup_budget]
+
+def proofAcceptanceClassicalRoots : Array Lean.Name := #[
+  `Aiur.BoundVerifier.verifyShaped_success,
+  `Aiur.BoundVerifier.verifyShaped_acceptance]
+
+def proofAcceptancePremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.ProofCodec.Extension.mk,
+  `Aiur.NativeAIR.ProofCodec.Digest,
+  `Aiur.NativeAIR.ProofCodec.Cap,
+  `Aiur.NativeAIR.ProofCodec.Openings,
+  `Aiur.NativeAIR.ProofCodec.readVector,
+  `Aiur.NativeAIR.ProofCodec.encodeVector,
+  `Aiur.NativeAIR.ProofCodec.readOption,
+  `Aiur.NativeAIR.ProofCodec.encodeOption,
+  `Aiur.NativeAIR.ProofCodec.readBool,
+  `Aiur.NativeAIR.ProofCodec.encodeBool,
+  `Aiur.NativeAIR.ProofCodec.readField,
+  `Aiur.NativeAIR.ProofCodec.encodeField,
+  `Aiur.NativeAIR.ProofCodec.readExtension,
+  `Aiur.NativeAIR.ProofCodec.encodeExtension,
+  `Aiur.NativeAIR.ProofCodec.readCap,
+  `Aiur.NativeAIR.ProofCodec.encodeCap,
+  `Aiur.NativeAIR.ProofCodec.readOpenings,
+  `Aiur.NativeAIR.ProofCodec.encodeOpenings,
+  `Aiur.NativeAIR.ProofCodec.Commitments.mk,
+  `Aiur.NativeAIR.ProofCodec.readCommitments,
+  `Aiur.NativeAIR.ProofCodec.encodeCommitments,
+  `Aiur.NativeAIR.ProofCodec.BatchOpening.mk,
+  `Aiur.NativeAIR.ProofCodec.readBatchOpening,
+  `Aiur.NativeAIR.ProofCodec.encodeBatchOpening,
+  `Aiur.NativeAIR.ProofCodec.CommitStep.mk,
+  `Aiur.NativeAIR.ProofCodec.readCommitStep,
+  `Aiur.NativeAIR.ProofCodec.encodeCommitStep,
+  `Aiur.NativeAIR.ProofCodec.Fri.mk,
+  `Aiur.NativeAIR.ProofCodec.readFri,
+  `Aiur.NativeAIR.ProofCodec.encodeFri,
+  `Aiur.NativeAIR.ProofCodec.Data.mk,
+  `Aiur.NativeAIR.ProofCodec.readData,
+  `Aiur.NativeAIR.ProofCodec.encodeData,
+  `Aiur.NativeAIR.ProofCodec.decode,
+  `Aiur.NativeAIR.ProofCodec.encode,
+  `Aiur.NativeAIR.ProofCodec.decodeCanonical,
+  `Aiur.NativeAIR.ProofShape.Pair.mk,
+  `Aiur.NativeAIR.ProofShape.pair,
+  `Aiur.NativeAIR.ProofShape.single,
+  `Aiur.NativeAIR.ProofShape.activeIndices,
+  `Aiur.NativeAIR.ProofShape.quotientDegree,
+  `Aiur.NativeAIR.ProofShape.Row.mk,
+  `Aiur.NativeAIR.ProofShape.readPreprocessed,
+  `Aiur.NativeAIR.ProofShape.readRow,
+  `Aiur.NativeAIR.ProofShape.Pair.hasWidth,
+  `Aiur.NativeAIR.ProofShape.Row.fits,
+  `Aiur.NativeAIR.ProofShape.header,
+  `Aiur.NativeAIR.ProofShape.inactivePreprocessed,
+  `Aiur.NativeAIR.ProofShape.rows,
+  `Aiur.NativeAIR.ProofShape.check,
+  `Aiur.NativeAIR.ProofShape.fixedHeights,
+  `Aiur.NativeAIR.ProofShape.queryBound,
+  `Aiur.BoundVerifier.CheckedProof.mk,
+  `Aiur.BoundVerifier.readProof,
+  `Aiur.BoundVerifier.verifyShaped,
+  `Aiur.NativeAIR.ProofCodec.VectorFits,
+  `Aiur.NativeAIR.ProofCodec.CapFits,
+  `Aiur.NativeAIR.ProofCodec.OpeningsFits,
+  `Aiur.NativeAIR.ProofCodec.CommitmentsFits.mk,
+  `Aiur.NativeAIR.ProofCodec.BatchOpeningFits.mk,
+  `Aiur.NativeAIR.ProofCodec.CommitStepFits.mk,
+  `Aiur.NativeAIR.ProofCodec.FriFits.mk,
+  `Aiur.NativeAIR.ProofCodec.DataFits.mk,
+  `Aiur.NativeAIR.ProofShape.Row.Sourced.mk,
+  `Aiur.NativeAIR.ProofShape.Row.Fits.mk]
+
+def extensionRoots : Array Lean.Name := #[
+  `Aiur.G.residue_injective,
+  `Aiur.G.residue_ofNat,
+  `Aiur.G.residue_add,
+  `Aiur.G.residue_mul,
+  `Aiur.G.residue_sub,
+  `Aiur.G.residue_numeral,
+  `Aiur.G.residue_zero,
+  `Aiur.G.residue_one,
+  `Aiur.G.residue_neg,
+  `Aiur.G.residue_ofInt,
+  `Aiur.G.left_distrib,
+  `Aiur.G.neg_add_cancel,
+  `Aiur.G.sub_eq_add_neg,
+  `Aiur.G.ofInt_neg,
+  `Aiur.G.neg_mul,
+  `Aiur.G.pow_go_eq,
+  `Aiur.G.pow_eq,
+  `Aiur.G.inverse_eq_power,
+  `Aiur.G.n_power,
+  `Aiur.G.mul_right_cancel,
+  `Aiur.G.nonzeroResidues_length,
+  `Aiur.G.mem_nonzeroResidues,
+  `Aiur.G.nonzeroResidues_nodup,
+  `Aiur.G.map_perm_of_injective,
+  `Aiur.G.multiplication_perm,
+  `Aiur.G.product_nonzero,
+  `Aiur.G.product_perm,
+  `Aiur.G.product_map_mul,
+  `Aiur.G.power_eq_one_of_perm,
+  `Aiur.G.fermat,
+  `Aiur.G.inverse_zero,
+  `Aiur.G.mul_inverse_cancel,
+  `Aiur.NativeAIR.ProofCodec.Extension.ext,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_injective,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_add,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_sub,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_neg,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.add_zero,
+  `Aiur.NativeAIR.ProofCodec.Extension.add_comm,
+  `Aiur.NativeAIR.ProofCodec.Extension.add_assoc,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_one,
+  `Aiur.NativeAIR.ProofCodec.Extension.zero_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_comm,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_assoc,
+  `Aiur.NativeAIR.ProofCodec.Extension.left_distrib,
+  `Aiur.NativeAIR.ProofCodec.Extension.neg_add_cancel,
+  `Aiur.NativeAIR.ProofCodec.Extension.sub_eq_add_neg,
+  `Aiur.NativeAIR.ProofCodec.Extension.neg_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.basis_square,
+  `Aiur.NativeAIR.ProofCodec.Extension.coordinates,
+  `Aiur.NativeAIR.ProofCodec.Extension.scale_eq_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.conjugate_conjugate,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_conjugate,
+  `Aiur.NativeAIR.ProofCodec.Extension.conjugate_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.norm_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.evalLaws,
+  `Aiur.NativeAIR.ProofCodec.Extension.powBits_eq,
+  `Aiur.NativeAIR.ProofCodec.Extension.power_eq,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_power,
+  `Aiur.NativeAIR.ProofCodec.Extension.inverse_formula,
+  `Aiur.G.seven_euler_certificate,
+  `Aiur.G.seven_not_square,
+  `Aiur.G.square_ratio,
+  `Aiur.NativeAIR.ProofCodec.Extension.norm_zero_iff,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_eq_zero_iff,
+  `Aiur.NativeAIR.ProofCodec.Extension.one_ne_zero,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_left_cancel,
+  `Aiur.NativeAIR.ProofCodec.Extension.inverse_correct,
+  `Aiur.NativeAIR.ProofCodec.Extension.tryInverse_none_iff,
+  `Aiur.NativeAIR.ProofCodec.Extension.tryInverse_some_iff]
+
+def extensionAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.G.residue_injective,
+  `Aiur.NativeAIR.ProofCodec.Extension.ext]
+
+def extensionQuotRoots : Array Lean.Name := #[
+  `Aiur.G.mem_nonzeroResidues,
+  `Aiur.G.nonzeroResidues_nodup,
+  `Aiur.NativeAIR.ProofCodec.Extension.add_comm,
+  `Aiur.NativeAIR.ProofCodec.Extension.conjugate_conjugate]
+
+def extensionClassicalRoots : Array Lean.Name := #[
+  `Aiur.G.residue_neg,
+  `Aiur.G.residue_ofInt,
+  `Aiur.G.left_distrib,
+  `Aiur.G.neg_add_cancel,
+  `Aiur.G.sub_eq_add_neg,
+  `Aiur.G.ofInt_neg,
+  `Aiur.G.neg_mul,
+  `Aiur.G.pow_go_eq,
+  `Aiur.G.pow_eq,
+  `Aiur.G.inverse_eq_power,
+  `Aiur.G.n_power,
+  `Aiur.G.mul_right_cancel,
+  `Aiur.G.map_perm_of_injective,
+  `Aiur.G.multiplication_perm,
+  `Aiur.G.product_nonzero,
+  `Aiur.G.product_perm,
+  `Aiur.G.product_map_mul,
+  `Aiur.G.power_eq_one_of_perm,
+  `Aiur.G.fermat,
+  `Aiur.G.mul_inverse_cancel,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_add,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_sub,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_neg,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_one,
+  `Aiur.NativeAIR.ProofCodec.Extension.zero_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_comm,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_assoc,
+  `Aiur.NativeAIR.ProofCodec.Extension.left_distrib,
+  `Aiur.NativeAIR.ProofCodec.Extension.neg_add_cancel,
+  `Aiur.NativeAIR.ProofCodec.Extension.sub_eq_add_neg,
+  `Aiur.NativeAIR.ProofCodec.Extension.neg_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.coordinates,
+  `Aiur.NativeAIR.ProofCodec.Extension.scale_eq_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_conjugate,
+  `Aiur.NativeAIR.ProofCodec.Extension.conjugate_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.norm_mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.evalLaws,
+  `Aiur.NativeAIR.ProofCodec.Extension.powBits_eq,
+  `Aiur.NativeAIR.ProofCodec.Extension.power_eq,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase_power,
+  `Aiur.NativeAIR.ProofCodec.Extension.inverse_formula,
+  `Aiur.G.seven_not_square,
+  `Aiur.G.square_ratio,
+  `Aiur.NativeAIR.ProofCodec.Extension.norm_zero_iff,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_eq_zero_iff,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul_left_cancel,
+  `Aiur.NativeAIR.ProofCodec.Extension.inverse_correct,
+  `Aiur.NativeAIR.ProofCodec.Extension.tryInverse_some_iff]
+
+def extensionPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.ProofCodec.Extension.ofBase,
+  `Aiur.NativeAIR.ProofCodec.Extension.ofNat,
+  `Aiur.NativeAIR.ProofCodec.Extension.add,
+  `Aiur.NativeAIR.ProofCodec.Extension.sub,
+  `Aiur.NativeAIR.ProofCodec.Extension.neg,
+  `Aiur.NativeAIR.ProofCodec.Extension.mul,
+  `Aiur.NativeAIR.ProofCodec.Extension.basis,
+  `Aiur.NativeAIR.ProofCodec.Extension.conjugate,
+  `Aiur.NativeAIR.ProofCodec.Extension.norm,
+  `Aiur.NativeAIR.ProofCodec.Extension.scale,
+  `Aiur.NativeAIR.ProofCodec.Extension.powBits,
+  `Aiur.NativeAIR.ProofCodec.Extension.power,
+  `Aiur.NativeAIR.ProofCodec.Extension.tryInverse,
+  `Aiur.NativeAIR.ProofCodec.Extension.evalOps,
+  `Aiur.G.characteristicNeZero,
+  `Aiur.G.residue,
+  `Aiur.G.neg,
+  `Aiur.G.natCast,
+  `Aiur.G.ofInt,
+  `Aiur.G.intCast,
+  `Aiur.G.nsmul,
+  `Aiur.G.zsmul,
+  `Aiur.G.npow,
+  `Aiur.G.commRing,
+  `Aiur.G.nonzeroResidues,
+  `Aiur.G.product,
+  `Aiur.NativeAIR.ProofCodec.Extension.natCast,
+  `Aiur.NativeAIR.ProofCodec.Extension.intCast,
+  `Aiur.NativeAIR.ProofCodec.Extension.nsmul,
+  `Aiur.NativeAIR.ProofCodec.Extension.zsmul,
+  `Aiur.NativeAIR.ProofCodec.Extension.npow,
+  `Aiur.NativeAIR.ProofCodec.Extension.commRing]
+
+def logUpRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.LogUp.Coordinates.ext,
+  `Aiur.NativeAIR.LogUp.Coordinates.zero_iff,
+  `Aiur.NativeAIR.LogUp.Coordinates.flatten_length,
+  `Aiur.NativeAIR.LogUp.Coordinates.flatten_zero_iff,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_schoolbook,
+  `Aiur.NativeAIR.LogUp.Coordinates.add_zero,
+  `Aiur.NativeAIR.LogUp.Coordinates.add_comm,
+  `Aiur.NativeAIR.LogUp.Coordinates.add_assoc,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_one,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_zero,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_comm,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_assoc,
+  `Aiur.NativeAIR.LogUp.Coordinates.left_distrib,
+  `Aiur.NativeAIR.LogUp.Coordinates.neg_add_cancel,
+  `Aiur.NativeAIR.LogUp.Coordinates.sub_eq_add_neg,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase_add,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase_neg,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.neg_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.scale_eq_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_injective,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_fromExtension,
+  `Aiur.NativeAIR.LogUp.Coordinates.fromExtension_toExtension,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_zero_iff,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_ofBase,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_add,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_sub,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.collapse_loses_constraint,
+  `Aiur.NativeAIR.LogUp.sub_zero_iff,
+  `Aiur.NativeAIR.LogUp.clears_cons,
+  `Aiur.NativeAIR.LogUp.product_cons,
+  `Aiur.NativeAIR.LogUp.product_append,
+  `Aiur.NativeAIR.LogUp.product_foldl,
+  `Aiur.NativeAIR.LogUp.sum_foldl,
+  `Aiur.NativeAIR.LogUp.sum_append,
+  `Aiur.NativeAIR.LogUp.telescope,
+  `Aiur.NativeAIR.LogUp.cyclic_accumulator,
+  `Aiur.NativeAIR.LogUp.final_accumulator,
+  `Aiur.NativeAIR.LogUp.prefix_products,
+  `Aiur.NativeAIR.LogUp.prefix_seeded,
+  `Aiur.NativeAIR.LogUp.suffix_seeded,
+  `Aiur.NativeAIR.LogUp.suffix_products,
+  `Aiur.NativeAIR.LogUp.prefixSuffixTerms_cons,
+  `Aiur.NativeAIR.LogUp.prefixSuffixTerms_sum,
+  `Aiur.NativeAIR.LogUp.groupEquation_polynomial,
+  `Aiur.NativeAIR.LogUp.numerator_append,
+  `Aiur.NativeAIR.LogUp.fingerprint_reverse_horner,
+  `Aiur.NativeAIR.LogUp.fingerprint_nil,
+  `Aiur.NativeAIR.LogUp.fingerprint_cons,
+  `Aiur.NativeAIR.LogUp.fingerprint_trailing_zero,
+  `Aiur.NativeAIR.LogUp.fingerprint_padding,
+  `Aiur.NativeAIR.LogUp.groupCount_positive,
+  `Aiur.NativeAIR.LogUp.groupCount_covers,
+  `Aiur.NativeAIR.LogUp.groupCount_zero,
+  `Aiur.NativeAIR.LogUp.groupCount_empty,
+  `Aiur.NativeAIR.LogUp.groupCount_key,
+  `Aiur.NativeAIR.LogUp.chunk_length,
+  `Aiur.NativeAIR.LogUp.chunks_take,
+  `Aiur.NativeAIR.LogUp.chunks_cover,
+  `Aiur.NativeAIR.LogUp.chunk_mem,
+  `Aiur.NativeAIR.LogUp.chunk_map,
+  `Aiur.NativeAIR.LogUp.mapM_some_reads,
+  `Aiur.NativeAIR.LogUp.mapM_defined,
+  `Aiur.NativeAIR.LogUp.read_coordinates_defined,
+  `Aiur.NativeAIR.LogUp.read_coordinates_success,
+  `Aiur.NativeAIR.LogUp.step_polynomial,
+  `Aiur.NativeAIR.LogUp.step_defined,
+  `Aiur.NativeAIR.LogUp.equations_success,
+  `Aiur.NativeAIR.LogUp.equations_defined,
+  `Aiur.NativeAIR.LogUp.equations_zero,
+  `Aiur.NativeAIR.LogUp.constraintValues_success,
+  `Aiur.NativeAIR.LogUp.constraintValues_length,
+  `Aiur.NativeAIR.LogUp.constraintValues_defined,
+  `Aiur.NativeAIR.LogUp.constraintValues_reflect,
+  `Aiur.NativeAIR.LogUp.inverseValue_correct,
+  `Aiur.NativeAIR.LogUp.product_nonzero,
+  `Aiur.NativeAIR.LogUp.poleFree_product,
+  `Aiur.NativeAIR.LogUp.fractionSum_cons,
+  `Aiur.NativeAIR.LogUp.fractionSum_append,
+  `Aiur.NativeAIR.LogUp.fractionSum_clears,
+  `Aiur.NativeAIR.LogUp.groupEquation_zero_iff,
+  `Aiur.NativeAIR.LogUp.product_toExtension,
+  `Aiur.NativeAIR.LogUp.fieldEntries_messages,
+  `Aiur.NativeAIR.LogUp.numerator_toExtension,
+  `Aiur.NativeAIR.LogUp.groupEquation_toExtension,
+  `Aiur.NativeAIR.LogUp.coordinate_group_zero_iff,
+  `Aiur.NativeAIR.LogUp.coordinate_polynomial_zero_iff,
+  `Aiur.NativeAIR.LogUp.fingerprint_toExtension,
+  `Aiur.NativeAIR.LogUp.pole_can_hide_step,
+  `Aiur.NativeAIR.LogUp.fractionSum_flatMap,
+  `Aiur.NativeAIR.LogUp.fieldEntries_compress_chunk,
+  `Aiur.NativeAIR.LogUp.lookupFractions_chunks,
+  `Aiur.NativeAIR.LogUp.equations_accumulator,
+  `Aiur.NativeAIR.LogUp.constraintValues_accumulator]
+
+def logUpAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.LogUp.Coordinates.ext,
+  `Aiur.NativeAIR.LogUp.Coordinates.zero_iff,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_injective,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_fromExtension,
+  `Aiur.NativeAIR.LogUp.Coordinates.fromExtension_toExtension,
+  `Aiur.NativeAIR.LogUp.product_cons,
+  `Aiur.NativeAIR.LogUp.fingerprint_nil,
+  `Aiur.NativeAIR.LogUp.fingerprint_cons,
+  `Aiur.NativeAIR.LogUp.groupCount_zero]
+
+def logUpQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.LogUp.Coordinates.flatten_length,
+  `Aiur.NativeAIR.LogUp.Coordinates.flatten_zero_iff,
+  `Aiur.NativeAIR.LogUp.prefix_seeded,
+  `Aiur.NativeAIR.LogUp.suffix_seeded,
+  `Aiur.NativeAIR.LogUp.suffix_products,
+  `Aiur.NativeAIR.LogUp.prefixSuffixTerms_cons,
+  `Aiur.NativeAIR.LogUp.fingerprint_reverse_horner,
+  `Aiur.NativeAIR.LogUp.groupCount_positive,
+  `Aiur.NativeAIR.LogUp.groupCount_empty,
+  `Aiur.NativeAIR.LogUp.mapM_some_reads,
+  `Aiur.NativeAIR.LogUp.mapM_defined,
+  `Aiur.NativeAIR.LogUp.read_coordinates_defined,
+  `Aiur.NativeAIR.LogUp.read_coordinates_success,
+  `Aiur.NativeAIR.LogUp.step_defined,
+  `Aiur.NativeAIR.LogUp.equations_success,
+  `Aiur.NativeAIR.LogUp.equations_defined,
+  `Aiur.NativeAIR.LogUp.constraintValues_success,
+  `Aiur.NativeAIR.LogUp.constraintValues_length,
+  `Aiur.NativeAIR.LogUp.constraintValues_defined,
+  `Aiur.NativeAIR.LogUp.constraintValues_reflect]
+
+def logUpClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_schoolbook,
+  `Aiur.NativeAIR.LogUp.Coordinates.add_zero,
+  `Aiur.NativeAIR.LogUp.Coordinates.add_comm,
+  `Aiur.NativeAIR.LogUp.Coordinates.add_assoc,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_one,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_zero,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_comm,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul_assoc,
+  `Aiur.NativeAIR.LogUp.Coordinates.left_distrib,
+  `Aiur.NativeAIR.LogUp.Coordinates.neg_add_cancel,
+  `Aiur.NativeAIR.LogUp.Coordinates.sub_eq_add_neg,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase_add,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase_neg,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.neg_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.scale_eq_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension_mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.collapse_loses_constraint,
+  `Aiur.NativeAIR.LogUp.sub_zero_iff,
+  `Aiur.NativeAIR.LogUp.clears_cons,
+  `Aiur.NativeAIR.LogUp.product_append,
+  `Aiur.NativeAIR.LogUp.product_foldl,
+  `Aiur.NativeAIR.LogUp.sum_foldl,
+  `Aiur.NativeAIR.LogUp.sum_append,
+  `Aiur.NativeAIR.LogUp.telescope,
+  `Aiur.NativeAIR.LogUp.cyclic_accumulator,
+  `Aiur.NativeAIR.LogUp.final_accumulator,
+  `Aiur.NativeAIR.LogUp.prefix_products,
+  `Aiur.NativeAIR.LogUp.prefixSuffixTerms_sum,
+  `Aiur.NativeAIR.LogUp.groupEquation_polynomial,
+  `Aiur.NativeAIR.LogUp.numerator_append,
+  `Aiur.NativeAIR.LogUp.fingerprint_trailing_zero,
+  `Aiur.NativeAIR.LogUp.fingerprint_padding,
+  `Aiur.NativeAIR.LogUp.groupCount_covers,
+  `Aiur.NativeAIR.LogUp.chunks_take,
+  `Aiur.NativeAIR.LogUp.chunks_cover,
+  `Aiur.NativeAIR.LogUp.step_polynomial,
+  `Aiur.NativeAIR.LogUp.equations_zero,
+  `Aiur.NativeAIR.LogUp.inverseValue_correct,
+  `Aiur.NativeAIR.LogUp.product_nonzero,
+  `Aiur.NativeAIR.LogUp.poleFree_product,
+  `Aiur.NativeAIR.LogUp.fractionSum_append,
+  `Aiur.NativeAIR.LogUp.fractionSum_clears,
+  `Aiur.NativeAIR.LogUp.groupEquation_zero_iff,
+  `Aiur.NativeAIR.LogUp.product_toExtension,
+  `Aiur.NativeAIR.LogUp.numerator_toExtension,
+  `Aiur.NativeAIR.LogUp.groupEquation_toExtension,
+  `Aiur.NativeAIR.LogUp.coordinate_group_zero_iff,
+  `Aiur.NativeAIR.LogUp.coordinate_polynomial_zero_iff,
+  `Aiur.NativeAIR.LogUp.fingerprint_toExtension,
+  `Aiur.NativeAIR.LogUp.pole_can_hide_step,
+  `Aiur.NativeAIR.LogUp.fractionSum_flatMap,
+  `Aiur.NativeAIR.LogUp.lookupFractions_chunks,
+  `Aiur.NativeAIR.LogUp.equations_accumulator,
+  `Aiur.NativeAIR.LogUp.constraintValues_accumulator]
+
+def logUpPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.LogUp.Coordinates.mk,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofBase,
+  `Aiur.NativeAIR.LogUp.Coordinates.ofNat,
+  `Aiur.NativeAIR.LogUp.Coordinates.add,
+  `Aiur.NativeAIR.LogUp.Coordinates.sub,
+  `Aiur.NativeAIR.LogUp.Coordinates.neg,
+  `Aiur.NativeAIR.LogUp.Coordinates.mul,
+  `Aiur.NativeAIR.LogUp.Coordinates.scale,
+  `Aiur.NativeAIR.LogUp.Coordinates.map,
+  `Aiur.NativeAIR.LogUp.Coordinates.read,
+  `Aiur.NativeAIR.LogUp.Coordinates.flatten,
+  `Aiur.NativeAIR.LogUp.Coordinates.toExtension,
+  `Aiur.NativeAIR.LogUp.Coordinates.fromExtension,
+  `Aiur.NativeAIR.LogUp.product,
+  `Aiur.NativeAIR.LogUp.sum,
+  `Aiur.NativeAIR.LogUp.numerator,
+  `Aiur.NativeAIR.LogUp.prefixSuffixTerms,
+  `Aiur.NativeAIR.LogUp.groupEquation,
+  `Aiur.NativeAIR.LogUp.fingerprint,
+  `Aiur.NativeAIR.LogUp.compress,
+  `Aiur.NativeAIR.LogUp.groupCount,
+  `Aiur.NativeAIR.LogUp.chunk,
+  `Aiur.NativeAIR.LogUp.step,
+  `Aiur.NativeAIR.LogUp.equations,
+  `Aiur.NativeAIR.LogUp.constraintValues,
+  `Aiur.NativeAIR.LogUp.Coordinates.natCast,
+  `Aiur.NativeAIR.LogUp.Coordinates.intCast,
+  `Aiur.NativeAIR.LogUp.Coordinates.nsmul,
+  `Aiur.NativeAIR.LogUp.Coordinates.zsmul,
+  `Aiur.NativeAIR.LogUp.Coordinates.npow,
+  `Aiur.NativeAIR.LogUp.Coordinates.commRing,
+  `Aiur.NativeAIR.LogUp.inverseValue,
+  `Aiur.NativeAIR.LogUp.fractionSum,
+  `Aiur.NativeAIR.LogUp.PoleFree,
+  `Aiur.NativeAIR.LogUp.fieldEntries,
+  `Aiur.NativeAIR.LogUp.lookupFractions]
+
+def domainRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Domain.generators_size,
+  `Aiur.NativeAIR.Domain.Algebra.power_zero,
+  `Aiur.NativeAIR.Domain.Algebra.power_mul,
+  `Aiur.NativeAIR.Domain.Algebra.power_period,
+  `Aiur.NativeAIR.Domain.Algebra.power_inverse,
+  `Aiur.NativeAIR.Domain.Algebra.predecessor_inverse,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers_factor,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers_diagonal,
+  `Aiur.NativeAIR.Domain.Algebra.root_dividedPowers,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers_off_root,
+  `Aiur.NativeAIR.Domain.ofLogSize_some,
+  `Aiur.NativeAIR.Domain.ofLogSize_defined,
+  `Aiur.NativeAIR.Domain.size_positive,
+  `Aiur.NativeAIR.Domain.size_bound,
+  `Aiur.NativeAIR.Domain.size_lt_characteristic,
+  `Aiur.NativeAIR.Domain.size_lt_u64,
+  `Aiur.NativeAIR.Domain.generator_zero,
+  `Aiur.NativeAIR.Domain.generator_square_certificate,
+  `Aiur.NativeAIR.Domain.generator_full_certificate,
+  `Aiur.NativeAIR.Domain.generator_half_certificate,
+  `Aiur.NativeAIR.Domain.generator_power,
+  `Aiur.NativeAIR.Domain.generator_half,
+  `Aiur.NativeAIR.Domain.generator_nonzero,
+  `Aiur.NativeAIR.Domain.point_eq,
+  `Aiur.NativeAIR.Domain.point_injective,
+  `Aiur.NativeAIR.Domain.generator_order,
+  `Aiur.NativeAIR.Domain.point_zero,
+  `Aiur.NativeAIR.Domain.point_power,
+  `Aiur.NativeAIR.Domain.point_nonzero,
+  `Aiur.NativeAIR.Domain.point_next,
+  `Aiur.NativeAIR.Domain.point_first_iff,
+  `Aiur.NativeAIR.Domain.lastPoint_eq_power,
+  `Aiur.NativeAIR.Domain.point_last,
+  `Aiur.NativeAIR.Domain.lastPoint_power,
+  `Aiur.NativeAIR.Domain.point_last_iff,
+  `Aiur.NativeAIR.Domain.lastPoint_nonzero,
+  `Aiur.NativeAIR.Domain.lastPoint_inverse,
+  `Aiur.NativeAIR.Domain.lastPoint_predecessor,
+  `Aiur.NativeAIR.Domain.normalizer_nonzero,
+  `Aiur.NativeAIR.Domain.first_at_row,
+  `Aiur.NativeAIR.Domain.last_at_row,
+  `Aiur.NativeAIR.Domain.transition_at_row,
+  `Aiur.NativeAIR.Domain.ofBase_dividedPowers,
+  `Aiur.NativeAIR.Domain.vanishing_eq,
+  `Aiur.NativeAIR.Domain.vanishing_at_row,
+  `Aiur.NativeAIR.Domain.lastPoint_extension_power,
+  `Aiur.NativeAIR.Domain.root_difference_nonzero,
+  `Aiur.NativeAIR.Domain.selectors_success,
+  `Aiur.NativeAIR.Domain.selectors_defined,
+  `Aiur.NativeAIR.Domain.selectors_defined_iff,
+  `Aiur.NativeAIR.Domain.selectors_none_at_row,
+  `Aiur.NativeAIR.LogUp.normalized_injection,
+  `Aiur.NativeAIR.LogUp.equations_domain_row,
+  `Aiur.NativeAIR.LogUp.equations_domain_sum,
+  `Aiur.NativeAIR.LogUp.constraintValues_domain_sum,
+  `Aiur.NativeAIR.Quotient.horner_nil,
+  `Aiur.NativeAIR.Quotient.horner_cons,
+  `Aiur.NativeAIR.Quotient.horner_append,
+  `Aiur.NativeAIR.Quotient.horner_powers,
+  `Aiur.NativeAIR.Quotient.composition_from,
+  `Aiur.NativeAIR.Quotient.composition_horner,
+  `Aiur.NativeAIR.Quotient.composition_order,
+  `Aiur.NativeAIR.Quotient.composition_append,
+  `Aiur.NativeAIR.Quotient.composition_zero,
+  `Aiur.NativeAIR.Quotient.inverse_check,
+  `Aiur.NativeAIR.Quotient.coefficients_flatten,
+  `Aiur.NativeAIR.Quotient.coefficients_success,
+  `Aiur.NativeAIR.Quotient.coefficients_length,
+  `Aiur.NativeAIR.Quotient.coefficients_defined,
+  `Aiur.NativeAIR.Quotient.coefficients_defined_iff,
+  `Aiur.NativeAIR.Quotient.evaluate_success,
+  `Aiur.NativeAIR.Quotient.evaluate_powers,
+  `Aiur.NativeAIR.Quotient.check_true_iff]
+
+def domainAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Domain.ofLogSize_some,
+  `Aiur.NativeAIR.Domain.size_positive,
+  `Aiur.NativeAIR.Quotient.horner_nil,
+  `Aiur.NativeAIR.Quotient.horner_cons]
+
+def domainQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Domain.Algebra.power_zero,
+  `Aiur.NativeAIR.Domain.size_bound,
+  `Aiur.NativeAIR.Domain.size_lt_characteristic,
+  `Aiur.NativeAIR.Domain.size_lt_u64,
+  `Aiur.NativeAIR.Domain.generator_square_certificate,
+  `Aiur.NativeAIR.Domain.generator_half_certificate,
+  `Aiur.NativeAIR.Quotient.coefficients_success,
+  `Aiur.NativeAIR.Quotient.coefficients_length]
+
+def domainClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Domain.Algebra.predecessor_inverse,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers_factor,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers_diagonal,
+  `Aiur.NativeAIR.Domain.Algebra.root_dividedPowers,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers_off_root,
+  `Aiur.NativeAIR.Domain.generator_power,
+  `Aiur.NativeAIR.Domain.generator_half,
+  `Aiur.NativeAIR.Domain.generator_nonzero,
+  `Aiur.NativeAIR.Domain.point_eq,
+  `Aiur.NativeAIR.Domain.point_injective,
+  `Aiur.NativeAIR.Domain.generator_order,
+  `Aiur.NativeAIR.Domain.point_zero,
+  `Aiur.NativeAIR.Domain.point_power,
+  `Aiur.NativeAIR.Domain.point_nonzero,
+  `Aiur.NativeAIR.Domain.point_next,
+  `Aiur.NativeAIR.Domain.point_first_iff,
+  `Aiur.NativeAIR.Domain.lastPoint_eq_power,
+  `Aiur.NativeAIR.Domain.point_last,
+  `Aiur.NativeAIR.Domain.lastPoint_power,
+  `Aiur.NativeAIR.Domain.point_last_iff,
+  `Aiur.NativeAIR.Domain.lastPoint_nonzero,
+  `Aiur.NativeAIR.Domain.lastPoint_inverse,
+  `Aiur.NativeAIR.Domain.lastPoint_predecessor,
+  `Aiur.NativeAIR.Domain.normalizer_nonzero,
+  `Aiur.NativeAIR.Domain.first_at_row,
+  `Aiur.NativeAIR.Domain.last_at_row,
+  `Aiur.NativeAIR.Domain.transition_at_row,
+  `Aiur.NativeAIR.Domain.ofBase_dividedPowers,
+  `Aiur.NativeAIR.Domain.vanishing_eq,
+  `Aiur.NativeAIR.Domain.vanishing_at_row,
+  `Aiur.NativeAIR.Domain.lastPoint_extension_power,
+  `Aiur.NativeAIR.Domain.root_difference_nonzero,
+  `Aiur.NativeAIR.Domain.selectors_success,
+  `Aiur.NativeAIR.Domain.selectors_defined,
+  `Aiur.NativeAIR.Domain.selectors_defined_iff,
+  `Aiur.NativeAIR.Domain.selectors_none_at_row,
+  `Aiur.NativeAIR.LogUp.normalized_injection,
+  `Aiur.NativeAIR.LogUp.equations_domain_row,
+  `Aiur.NativeAIR.LogUp.equations_domain_sum,
+  `Aiur.NativeAIR.LogUp.constraintValues_domain_sum,
+  `Aiur.NativeAIR.Quotient.horner_append,
+  `Aiur.NativeAIR.Quotient.horner_powers,
+  `Aiur.NativeAIR.Quotient.composition_from,
+  `Aiur.NativeAIR.Quotient.composition_horner,
+  `Aiur.NativeAIR.Quotient.composition_order,
+  `Aiur.NativeAIR.Quotient.composition_append,
+  `Aiur.NativeAIR.Quotient.composition_zero,
+  `Aiur.NativeAIR.Quotient.inverse_check,
+  `Aiur.NativeAIR.Quotient.coefficients_defined,
+  `Aiur.NativeAIR.Quotient.coefficients_defined_iff,
+  `Aiur.NativeAIR.Quotient.evaluate_success,
+  `Aiur.NativeAIR.Quotient.evaluate_powers,
+  `Aiur.NativeAIR.Quotient.check_true_iff]
+
+def domainPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Domain.generators,
+  `Aiur.NativeAIR.Domain.Subgroup,
+  `Aiur.NativeAIR.Domain.ofLogSize,
+  `Aiur.NativeAIR.Domain.size,
+  `Aiur.NativeAIR.Domain.generator,
+  `Aiur.NativeAIR.Domain.point,
+  `Aiur.NativeAIR.Domain.lastPoint,
+  `Aiur.NativeAIR.Domain.normalizer,
+  `Aiur.NativeAIR.Domain.Selectors.mk,
+  `Aiur.NativeAIR.Domain.vanishing,
+  `Aiur.NativeAIR.Domain.selectors,
+  `Aiur.NativeAIR.Quotient.horner,
+  `Aiur.NativeAIR.Quotient.composition,
+  `Aiur.NativeAIR.Quotient.coefficients,
+  `Aiur.NativeAIR.Quotient.evaluate,
+  `Aiur.NativeAIR.Quotient.check,
+  `Aiur.NativeAIR.Domain.Algebra.dividedPowers]
+
+def verifierArithmeticRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.CompiledKey.preprocessedIndices_none,
+  `Aiur.NativeAIR.CompiledKey.circuits_preprocessed_absent,
+  `Aiur.BoundVerifier.CompiledBackend.row_preprocessed_absent,
+  `Aiur.NativeAIR.VerifierArithmetic.publics_size,
+  `Aiur.NativeAIR.VerifierArithmetic.publics_beta,
+  `Aiur.NativeAIR.VerifierArithmetic.publics_gamma,
+  `Aiur.NativeAIR.VerifierArithmetic.publics_entering,
+  `Aiur.NativeAIR.VerifierArithmetic.publics_leaving,
+  `Aiur.NativeAIR.VerifierArithmetic.deltaScaled_size,
+  `Aiur.NativeAIR.VerifierArithmetic.deltaScaled_coordinates,
+  `Aiur.NativeAIR.VerifierArithmetic.view_fits,
+  `Aiur.NativeAIR.VerifierArithmetic.domain_defined,
+  `Aiur.NativeAIR.VerifierArithmetic.stage2_width,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_success,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.evaluate,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_defined,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_defined_iff,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_constraint_count,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_reflects,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.identity,
+  `Aiur.NativeAIR.VerifierArithmetic.check_true_iff,
+  `Aiur.NativeAIR.VerifierArithmetic.check_quotient,
+  `Aiur.BoundVerifier.CompiledBackend.checked_row_arithmetic,
+  `Aiur.NativeAIR.VerifierArithmetic.claimMessage_native,
+  `Aiur.NativeAIR.VerifierArithmetic.publicEntries_compress,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_nil,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_cons,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_success,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_defined,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_defined_iff,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_lookupFractions,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_cons,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_final,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_row,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_sum,
+  `Aiur.NativeAIR.VerifierArithmetic.verify_true_iff,
+  `Aiur.NativeAIR.VerifierArithmetic.verify_lookup_balance,
+  `Aiur.NativeAIR.VerifierArithmetic.verify_row,
+  `Aiur.BoundVerifier.CompiledBackend.checked_row_values]
+
+def verifierArithmeticAxiomFreeRoots : Array Lean.Name := #[]
+
+def verifierArithmeticQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.VerifierArithmetic.view_fits,
+  `Aiur.NativeAIR.VerifierArithmetic.domain_defined,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_success,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.evaluate,
+  `Aiur.NativeAIR.VerifierArithmetic.check_quotient,
+  `Aiur.NativeAIR.VerifierArithmetic.publicEntries_compress,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_cons,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_cons,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_final,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_row,
+  `Aiur.NativeAIR.VerifierArithmetic.verify_true_iff]
+
+def verifierArithmeticClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.CompiledKey.circuits_preprocessed_absent,
+  `Aiur.BoundVerifier.CompiledBackend.row_preprocessed_absent,
+  `Aiur.NativeAIR.VerifierArithmetic.deltaScaled_coordinates,
+  `Aiur.NativeAIR.VerifierArithmetic.stage2_width,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_defined,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_defined_iff,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_constraint_count,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate_reflects,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.identity,
+  `Aiur.NativeAIR.VerifierArithmetic.check_true_iff,
+  `Aiur.BoundVerifier.CompiledBackend.checked_row_arithmetic,
+  `Aiur.NativeAIR.VerifierArithmetic.claimMessage_native,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_success,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_defined,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_defined_iff,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_lookupFractions,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows_sum,
+  `Aiur.NativeAIR.VerifierArithmetic.verify_lookup_balance,
+  `Aiur.NativeAIR.VerifierArithmetic.verify_row,
+  `Aiur.BoundVerifier.CompiledBackend.checked_row_values]
+
+def verifierArithmeticPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.VerifierArithmetic.Challenges.mk,
+  `Aiur.NativeAIR.VerifierArithmetic.pairColumns,
+  `Aiur.NativeAIR.VerifierArithmetic.rowColumns,
+  `Aiur.NativeAIR.VerifierArithmetic.publics,
+  `Aiur.NativeAIR.VerifierArithmetic.deltaScaled,
+  `Aiur.NativeAIR.VerifierArithmetic.view,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.mk,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.constraints,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.accepts,
+  `Aiur.NativeAIR.VerifierArithmetic.evaluate,
+  `Aiur.NativeAIR.VerifierArithmetic.check,
+  `Aiur.NativeAIR.VerifierArithmetic.checkRows,
+  `Aiur.NativeAIR.VerifierArithmetic.claimMessage,
+  `Aiur.NativeAIR.VerifierArithmetic.initialAccumulator,
+  `Aiur.NativeAIR.VerifierArithmetic.verify,
+  `Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.mk,
+  `Aiur.NativeAIR.VerifierArithmetic.publicEntries]
+
+def transcriptRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Challenger.initial_valid,
+  `Aiur.NativeAIR.Challenger.State.Valid.bound,
+  `Aiur.NativeAIR.Challenger.observeBytes_nil,
+  `Aiur.NativeAIR.Challenger.observeBytes_append,
+  `Aiur.NativeAIR.Challenger.observeBytes_value,
+  `Aiur.NativeAIR.Challenger.observeBytes_fold,
+  `Aiur.NativeAIR.Challenger.observeBytes_valid,
+  `Aiur.NativeAIR.Challenger.observeField_value,
+  `Aiur.NativeAIR.Challenger.observeField_valid,
+  `Aiur.NativeAIR.Challenger.observeExtension_bytes,
+  `Aiur.NativeAIR.Challenger.observeExtension_valid,
+  `Aiur.NativeAIR.Challenger.observeExtensions_valid,
+  `Aiur.NativeAIR.Challenger.observeCap_empty,
+  `Aiur.NativeAIR.Challenger.observeCap_valid,
+  `Aiur.NativeAIR.Challenger.sampleByte_buffered,
+  `Aiur.NativeAIR.Challenger.sampleByte_refill,
+  `Aiur.NativeAIR.Challenger.sampleByte_valid,
+  `Aiur.NativeAIR.Challenger.digest_reverse,
+  `Aiur.NativeAIR.Challenger.sampleByte_pending_bound,
+  `Aiur.NativeAIR.Challenger.sampleBytes_length,
+  `Aiur.NativeAIR.Challenger.sampleBytes_pending_bound,
+  `Aiur.NativeAIR.Challenger.sampleBytes_valid,
+  `Aiur.NativeAIR.Challenger.sampleBytes_buffered,
+  `Aiur.NativeAIR.Challenger.sampleBytes_refill,
+  `Aiur.NativeAIR.Challenger.littleEndian_bound,
+  `Aiur.NativeAIR.Challenger.littleEndian_encode,
+  `Aiur.NativeAIR.Challenger.littleEndian_reads,
+  `Aiur.NativeAIR.Challenger.sampleWord_bound,
+  `Aiur.NativeAIR.Challenger.sampleWord_full_mask,
+  `Aiur.NativeAIR.Challenger.sampleWord_reads,
+  `Aiur.NativeAIR.Challenger.FieldSample.positive,
+  `Aiur.NativeAIR.Challenger.sampleField_success,
+  `Aiur.NativeAIR.Challenger.FieldSample.complete,
+  `Aiur.NativeAIR.Challenger.sampleField_iff,
+  `Aiur.NativeAIR.Challenger.sampleField_mono,
+  `Aiur.NativeAIR.Challenger.sampleField_unique,
+  `Aiur.NativeAIR.Challenger.FieldSample.valid,
+  `Aiur.NativeAIR.Challenger.sampleField_valid,
+  `Aiur.NativeAIR.Challenger.sampleField_canonical,
+  `Aiur.NativeAIR.Challenger.sampleExtension_success,
+  `Aiur.NativeAIR.Challenger.sampleExtension_mono,
+  `Aiur.NativeAIR.Challenger.sampleExtension_valid,
+  `Aiur.NativeAIR.Challenger.sampleBits_success,
+  `Aiur.NativeAIR.Challenger.sampleBits_zero,
+  `Aiur.NativeAIR.Challenger.sampleBits_mask,
+  `Aiur.NativeAIR.Challenger.sampleBits_valid,
+  `Aiur.NativeAIR.Challenger.checkWitness_zero,
+  `Aiur.NativeAIR.Challenger.checkWitness_positive,
+  `Aiur.NativeAIR.Challenger.checkWitness_true_iff,
+  `Aiur.NativeAIR.Challenger.checkWitness_valid,
+  `Aiur.NativeAIR.Transcript.seed_length,
+  `Aiur.NativeAIR.Transcript.circuitShape_length,
+  `Aiur.NativeAIR.Transcript.shape_length,
+  `Aiur.NativeAIR.Transcript.fieldsBytes_length,
+  `Aiur.NativeAIR.Transcript.observeFields_bytes,
+  `Aiur.NativeAIR.Transcript.claimsFields_framing,
+  `Aiur.NativeAIR.Transcript.lookupState_schedule,
+  `Aiur.NativeAIR.Transcript.lookupState_valid,
+  `Aiur.NativeAIR.Transcript.accumulatorState_valid,
+  `Aiur.NativeAIR.Transcript.replay_success,
+  `Aiur.NativeAIR.Transcript.Replay.Reads.complete,
+  `Aiur.NativeAIR.Transcript.replay_iff,
+  `Aiur.NativeAIR.Transcript.replay_mono,
+  `Aiur.NativeAIR.Transcript.replay_unique,
+  `Aiur.NativeAIR.Transcript.replay_valid,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic_success,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic_iff,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic_mono,
+  `Aiur.BoundVerifier.CompiledBackend.transcript_row]
+
+def transcriptAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Challenger.initial_valid,
+  `Aiur.NativeAIR.Challenger.observeBytes_nil,
+  `Aiur.NativeAIR.Challenger.observeBytes_value,
+  `Aiur.NativeAIR.Challenger.observeBytes_valid,
+  `Aiur.NativeAIR.Challenger.observeField_value,
+  `Aiur.NativeAIR.Challenger.observeField_valid,
+  `Aiur.NativeAIR.Challenger.observeExtension_valid,
+  `Aiur.NativeAIR.Challenger.observeExtensions_valid,
+  `Aiur.NativeAIR.Challenger.observeCap_empty,
+  `Aiur.NativeAIR.Challenger.observeCap_valid,
+  `Aiur.NativeAIR.Transcript.accumulatorState_valid]
+
+def transcriptQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Challenger.State.Valid.bound,
+  `Aiur.NativeAIR.Challenger.digest_reverse,
+  `Aiur.NativeAIR.Challenger.sampleByte_pending_bound,
+  `Aiur.NativeAIR.Challenger.sampleBytes_pending_bound,
+  `Aiur.NativeAIR.Challenger.sampleBytes_refill,
+  `Aiur.NativeAIR.Challenger.littleEndian_bound,
+  `Aiur.NativeAIR.Challenger.sampleWord_bound,
+  `Aiur.NativeAIR.Challenger.FieldSample.positive,
+  `Aiur.NativeAIR.Challenger.sampleField_success,
+  `Aiur.NativeAIR.Challenger.FieldSample.complete,
+  `Aiur.NativeAIR.Challenger.sampleField_iff,
+  `Aiur.NativeAIR.Challenger.sampleField_mono,
+  `Aiur.NativeAIR.Challenger.sampleField_unique,
+  `Aiur.NativeAIR.Challenger.sampleField_valid,
+  `Aiur.NativeAIR.Challenger.sampleField_canonical,
+  `Aiur.NativeAIR.Challenger.sampleExtension_success,
+  `Aiur.NativeAIR.Challenger.sampleExtension_mono,
+  `Aiur.NativeAIR.Challenger.sampleExtension_valid,
+  `Aiur.NativeAIR.Challenger.checkWitness_true_iff,
+  `Aiur.NativeAIR.Challenger.checkWitness_valid,
+  `Aiur.NativeAIR.Transcript.shape_length,
+  `Aiur.NativeAIR.Transcript.fieldsBytes_length,
+  `Aiur.NativeAIR.Transcript.replay_success,
+  `Aiur.NativeAIR.Transcript.replay_iff,
+  `Aiur.NativeAIR.Transcript.replay_mono,
+  `Aiur.NativeAIR.Transcript.replay_unique,
+  `Aiur.NativeAIR.Transcript.replay_valid,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic_success,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic_iff,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic_mono]
+
+def transcriptClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Challenger.sampleWord_full_mask,
+  `Aiur.NativeAIR.Challenger.sampleBits_mask,
+  `Aiur.BoundVerifier.CompiledBackend.transcript_row]
+
+def transcriptPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Challenger.Hash32,
+  `Aiur.NativeAIR.Challenger.State.mk,
+  `Aiur.NativeAIR.Challenger.initial,
+  `Aiur.NativeAIR.Challenger.observeByte,
+  `Aiur.NativeAIR.Challenger.observeBytes,
+  `Aiur.NativeAIR.Challenger.observeField,
+  `Aiur.NativeAIR.Challenger.observeExtension,
+  `Aiur.NativeAIR.Challenger.observeCap,
+  `Aiur.NativeAIR.Challenger.sampleByte,
+  `Aiur.NativeAIR.Challenger.sampleBytes,
+  `Aiur.NativeAIR.Challenger.littleEndian,
+  `Aiur.NativeAIR.Challenger.sampleWord,
+  `Aiur.NativeAIR.Challenger.sampleField,
+  `Aiur.NativeAIR.Challenger.sampleExtension,
+  `Aiur.NativeAIR.Challenger.sampleBits,
+  `Aiur.NativeAIR.Challenger.checkWitness,
+  `Aiur.NativeAIR.Transcript.parameterWords,
+  `Aiur.NativeAIR.Transcript.seed,
+  `Aiur.NativeAIR.Transcript.circuitShape,
+  `Aiur.NativeAIR.Transcript.shape,
+  `Aiur.NativeAIR.Transcript.claimsFields,
+  `Aiur.NativeAIR.Transcript.fieldsBytes,
+  `Aiur.NativeAIR.Transcript.prefixBytes,
+  `Aiur.NativeAIR.Transcript.lookupState,
+  `Aiur.NativeAIR.Transcript.accumulatorState,
+  `Aiur.NativeAIR.Transcript.Replay.mk,
+  `Aiur.NativeAIR.Transcript.replay,
+  `Aiur.NativeAIR.Transcript.verifyArithmetic,
+  `Aiur.NativeAIR.Challenger.State.Valid,
+  `Aiur.NativeAIR.Challenger.FieldSample.accept,
+  `Aiur.NativeAIR.Challenger.FieldSample.reject,
+  `Aiur.NativeAIR.Transcript.Replay.Reads.mk]
+
+def blake3Roots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Blake3.leftLen_positive,
+  `Aiur.NativeAIR.Blake3.leftLen_lt,
+  `Aiur.NativeAIR.Blake3.schedules_permute,
+  `Aiur.NativeAIR.Blake3.schedules_next,
+  `Aiur.NativeAIR.Blake3.rotateRight_bits,
+  `Aiur.NativeAIR.Blake3.bytesWord_value,
+  `Aiur.NativeAIR.Blake3.wordBytes_encoding,
+  `Aiur.NativeAIR.Blake3.bytesWord_wordBytes,
+  `Aiur.NativeAIR.Blake3.bytesWord_pack,
+  `Aiur.NativeAIR.Blake3.wordBytes_pack,
+  `Aiur.NativeAIR.Blake3.wordBytes_bytesWord,
+  `Aiur.NativeAIR.Blake3.bytesWord_injective,
+  `Aiur.NativeAIR.Blake3.blockWords_byte,
+  `Aiur.NativeAIR.Blake3.blockWords_value,
+  `Aiur.NativeAIR.Blake3.cvBytes_value,
+  `Aiur.NativeAIR.Blake3.g_unchanged,
+  `Aiur.NativeAIR.Blake3.g_values,
+  `Aiur.NativeAIR.Blake3.initialWords_counter,
+  `Aiur.NativeAIR.Blake3.parentOutput_values,
+  `Aiur.NativeAIR.Blake3.leftLen_bounds,
+  `Aiur.NativeAIR.Blake3.leftLen_chunks,
+  `Aiur.NativeAIR.Blake3.leftLen_chunk_multiple,
+  `Aiur.NativeAIR.Blake3.leftLen_unique,
+  `Aiur.NativeAIR.Blake3.chunkLoop_small,
+  `Aiur.NativeAIR.Blake3.chunkLoop_step,
+  `Aiur.NativeAIR.Blake3.chunkLoop_counter,
+  `Aiur.NativeAIR.Blake3.chunkOutput_counter,
+  `Aiur.NativeAIR.Blake3.chunkLoop_reads,
+  `Aiur.NativeAIR.Blake3.ChunkReads.complete,
+  `Aiur.NativeAIR.Blake3.chunkLoop_iff,
+  `Aiur.NativeAIR.Blake3.ChunkReads.framing,
+  `Aiur.NativeAIR.Blake3.chunkOutput_framing,
+  `Aiur.NativeAIR.Blake3.subtree_small,
+  `Aiur.NativeAIR.Blake3.subtree_step,
+  `Aiur.NativeAIR.Blake3.subtree_root_counter,
+  `Aiur.NativeAIR.Blake3.subtree_tree,
+  `Aiur.NativeAIR.Blake3.TreeHash.complete,
+  `Aiur.NativeAIR.Blake3.subtree_iff,
+  `Aiur.NativeAIR.Blake3.TreeHash.unique,
+  `Aiur.NativeAIR.Blake3.native_counter,
+  `Aiur.NativeAIR.Blake3.native_child_spans,
+  `Aiur.NativeAIR.Blake3.ChunkAt.native,
+  `Aiur.NativeAIR.Blake3.digest_native_counters,
+  `Aiur.NativeAIR.Blake3.digest_tree,
+  `Aiur.NativeAIR.Blake3.replay_iff,
+  `Aiur.NativeAIR.Blake3.replay_unique,
+  `Aiur.NativeAIR.Blake3.verifyArithmetic_iff,
+  `Aiur.NativeAIR.Blake3.hash_bytes,
+  `Aiur.BoundVerifier.CompiledBackend.blake3_transcript_row]
+
+def blake3AxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Blake3.leftLen_positive]
+
+def blake3QuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Blake3.leftLen_lt,
+  `Aiur.NativeAIR.Blake3.schedules_next,
+  `Aiur.NativeAIR.Blake3.rotateRight_bits,
+  `Aiur.NativeAIR.Blake3.bytesWord_value,
+  `Aiur.NativeAIR.Blake3.bytesWord_pack,
+  `Aiur.NativeAIR.Blake3.g_unchanged,
+  `Aiur.NativeAIR.Blake3.g_values,
+  `Aiur.NativeAIR.Blake3.initialWords_counter,
+  `Aiur.NativeAIR.Blake3.parentOutput_values,
+  `Aiur.NativeAIR.Blake3.leftLen_bounds,
+  `Aiur.NativeAIR.Blake3.leftLen_chunks,
+  `Aiur.NativeAIR.Blake3.leftLen_chunk_multiple,
+  `Aiur.NativeAIR.Blake3.leftLen_unique,
+  `Aiur.NativeAIR.Blake3.chunkLoop_small,
+  `Aiur.NativeAIR.Blake3.chunkLoop_step,
+  `Aiur.NativeAIR.Blake3.chunkLoop_counter,
+  `Aiur.NativeAIR.Blake3.chunkOutput_counter,
+  `Aiur.NativeAIR.Blake3.chunkLoop_reads,
+  `Aiur.NativeAIR.Blake3.ChunkReads.complete,
+  `Aiur.NativeAIR.Blake3.chunkLoop_iff,
+  `Aiur.NativeAIR.Blake3.ChunkReads.framing,
+  `Aiur.NativeAIR.Blake3.subtree_small,
+  `Aiur.NativeAIR.Blake3.subtree_step,
+  `Aiur.NativeAIR.Blake3.subtree_root_counter,
+  `Aiur.NativeAIR.Blake3.subtree_tree,
+  `Aiur.NativeAIR.Blake3.TreeHash.complete,
+  `Aiur.NativeAIR.Blake3.subtree_iff,
+  `Aiur.NativeAIR.Blake3.TreeHash.unique,
+  `Aiur.NativeAIR.Blake3.native_counter,
+  `Aiur.NativeAIR.Blake3.digest_tree,
+  `Aiur.NativeAIR.Blake3.replay_iff,
+  `Aiur.NativeAIR.Blake3.replay_unique,
+  `Aiur.NativeAIR.Blake3.verifyArithmetic_iff]
+
+def blake3ClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Blake3.schedules_permute,
+  `Aiur.NativeAIR.Blake3.wordBytes_encoding,
+  `Aiur.NativeAIR.Blake3.bytesWord_wordBytes,
+  `Aiur.NativeAIR.Blake3.wordBytes_pack,
+  `Aiur.NativeAIR.Blake3.wordBytes_bytesWord,
+  `Aiur.NativeAIR.Blake3.bytesWord_injective,
+  `Aiur.NativeAIR.Blake3.blockWords_byte,
+  `Aiur.NativeAIR.Blake3.blockWords_value,
+  `Aiur.NativeAIR.Blake3.cvBytes_value,
+  `Aiur.NativeAIR.Blake3.chunkOutput_framing,
+  `Aiur.NativeAIR.Blake3.native_child_spans,
+  `Aiur.NativeAIR.Blake3.ChunkAt.native,
+  `Aiur.NativeAIR.Blake3.digest_native_counters,
+  `Aiur.NativeAIR.Blake3.hash_bytes,
+  `Aiur.BoundVerifier.CompiledBackend.blake3_transcript_row]
+
+def blake3Premises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Blake3.CV,
+  `Aiur.NativeAIR.Blake3.Block,
+  `Aiur.NativeAIR.Blake3.Digest,
+  `Aiur.NativeAIR.Blake3.iv,
+  `Aiur.NativeAIR.Blake3.schedules,
+  `Aiur.NativeAIR.Blake3.rotateRight,
+  `Aiur.NativeAIR.Blake3.mix,
+  `Aiur.NativeAIR.Blake3.g,
+  `Aiur.NativeAIR.Blake3.round,
+  `Aiur.NativeAIR.Blake3.initialWords,
+  `Aiur.NativeAIR.Blake3.compress,
+  `Aiur.NativeAIR.Blake3.wordBytes,
+  `Aiur.NativeAIR.Blake3.bytesWord,
+  `Aiur.NativeAIR.Blake3.blockWords,
+  `Aiur.NativeAIR.Blake3.cvBytes,
+  `Aiur.NativeAIR.Blake3.Output.mk,
+  `Aiur.NativeAIR.Blake3.Output.chainingValue,
+  `Aiur.NativeAIR.Blake3.Output.rootHash,
+  `Aiur.NativeAIR.Blake3.chunkLoop,
+  `Aiur.NativeAIR.Blake3.chunkOutput,
+  `Aiur.NativeAIR.Blake3.parentOutput,
+  `Aiur.NativeAIR.Blake3.leftLen,
+  `Aiur.NativeAIR.Blake3.subtree,
+  `Aiur.NativeAIR.Blake3.digest,
+  `Aiur.NativeAIR.Blake3.hash,
+  `Aiur.NativeAIR.Blake3.NativeInput,
+  `Aiur.NativeAIR.Blake3.replay,
+  `Aiur.NativeAIR.Blake3.verifyArithmetic,
+  `Aiur.NativeAIR.Blake3.ChunkReads.last,
+  `Aiur.NativeAIR.Blake3.ChunkReads.step,
+  `Aiur.NativeAIR.Blake3.TreeHash.chunk,
+  `Aiur.NativeAIR.Blake3.TreeHash.parent,
+  `Aiur.NativeAIR.Blake3.ChunkAt.leaf,
+  `Aiur.NativeAIR.Blake3.ChunkAt.left,
+  `Aiur.NativeAIR.Blake3.ChunkAt.right]
+
+def merkleCapRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.MerkleCap.maxDegree_nil,
+  `Aiur.NativeAIR.MerkleCap.maxDegree_cons,
+  `Aiur.NativeAIR.MerkleCap.degree_le_max,
+  `Aiur.NativeAIR.MerkleCap.maxDegree_le,
+  `Aiur.NativeAIR.MerkleCap.maxDegree_mono,
+  `Aiur.NativeAIR.MerkleCap.coverage_iff,
+  `Aiur.NativeAIR.MerkleCap.coverage_height_iff,
+  `Aiur.NativeAIR.MerkleCap.coverage_empty,
+  `Aiur.NativeAIR.MerkleCap.coverage_low_cap,
+  `Aiur.NativeAIR.MerkleCap.coverage_uniform,
+  `Aiur.NativeAIR.MerkleCap.coverage_subset,
+  `Aiur.NativeAIR.MerkleCap.coverage_injection,
+  `Aiur.NativeAIR.MerkleCap.coverage_cap_size,
+  `Aiur.NativeAIR.MerkleCap.omitted_rejected,
+  `Aiur.NativeAIR.MerkleCap.shorter_matrix_rejected,
+  `Aiur.NativeAIR.MerkleCap.exact_injection_accepted,
+  `Aiur.NativeAIR.MerkleCap.check_iff,
+  `Aiur.NativeAIR.MerkleCap.check_degree,
+  `Aiur.BoundVerifier.CheckedProof.cap_coverage,
+  `Aiur.BoundVerifier.CheckedProof.row_cap,
+  `Aiur.BoundVerifier.CheckedProof.row_injection,
+  `Aiur.BoundVerifier.verifyShaped_cap]
+
+def merkleCapAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.MerkleCap.maxDegree_nil,
+  `Aiur.NativeAIR.MerkleCap.maxDegree_cons,
+  `Aiur.NativeAIR.MerkleCap.coverage_empty,
+  `Aiur.NativeAIR.MerkleCap.shorter_matrix_rejected,
+  `Aiur.NativeAIR.MerkleCap.exact_injection_accepted]
+
+def merkleCapClassicalRoots : Array Lean.Name := #[
+  `Aiur.BoundVerifier.verifyShaped_cap]
+
+def merkleCapPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.MerkleCap.maxDegree,
+  `Aiur.NativeAIR.MerkleCap.coverage,
+  `Aiur.NativeAIR.MerkleCap.check]
+
+def merkleRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.fieldsBytes_injective,
+  `Aiur.NativeAIR.Merkle.pairBytes_length,
+  `Aiur.NativeAIR.Merkle.pairBytes_injective,
+  `Aiur.NativeAIR.Merkle.branchBytes_injective,
+  `Aiur.NativeAIR.Merkle.shape_length,
+  `Aiur.NativeAIR.Merkle.rowsAt_absent,
+  `Aiur.NativeAIR.Merkle.rowsAt_injective,
+  `Aiur.NativeAIR.Merkle.rowBytes_injective,
+  `Aiur.NativeAIR.Merkle.CollisionOn.mono,
+  `Aiur.NativeAIR.Merkle.equal_of_no_collision,
+  `Aiur.NativeAIR.Merkle.step_calls,
+  `Aiur.NativeAIR.Merkle.walk_calls,
+  `Aiur.NativeAIR.Merkle.step_binding,
+  `Aiur.NativeAIR.Merkle.walk_binding,
+  `Aiur.NativeAIR.Merkle.replay_success,
+  `Aiur.NativeAIR.Merkle.replay_complete,
+  `Aiur.NativeAIR.Merkle.replay_calls,
+  `Aiur.NativeAIR.Merkle.replay_position,
+  `Aiur.NativeAIR.Merkle.replay_index_bound,
+  `Aiur.NativeAIR.Merkle.hasHeight_iff,
+  `Aiur.NativeAIR.Merkle.height_le_max,
+  `Aiur.NativeAIR.Merkle.covered_iff,
+  `Aiur.NativeAIR.Merkle.replay_binding,
+  `Aiur.NativeAIR.Merkle.verify_success,
+  `Aiur.NativeAIR.Merkle.verify_collision,
+  `Aiur.NativeAIR.Merkle.verifyCovered_collision,
+  `Aiur.NativeAIR.Merkle.blake3_collision,
+  `Aiur.NativeAIR.Merkle.branchBytes_length,
+  `Aiur.NativeAIR.Merkle.rowsAt_fields_le,
+  `Aiur.NativeAIR.Merkle.rowBytes_length_le,
+  `Aiur.NativeAIR.Merkle.step_input_length,
+  `Aiur.NativeAIR.Merkle.walk_input_length,
+  `Aiur.NativeAIR.Merkle.replay_input_length,
+  `Aiur.NativeAIR.Merkle.replay_native_input]
+
+def merkleAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.CollisionOn.mono,
+  `Aiur.NativeAIR.Merkle.equal_of_no_collision]
+
+def merkleQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.fieldsBytes_injective,
+  `Aiur.NativeAIR.Merkle.shape_length,
+  `Aiur.NativeAIR.Merkle.rowsAt_absent,
+  `Aiur.NativeAIR.Merkle.rowsAt_injective,
+  `Aiur.NativeAIR.Merkle.rowBytes_injective,
+  `Aiur.NativeAIR.Merkle.step_calls,
+  `Aiur.NativeAIR.Merkle.walk_calls,
+  `Aiur.NativeAIR.Merkle.walk_binding,
+  `Aiur.NativeAIR.Merkle.replay_success,
+  `Aiur.NativeAIR.Merkle.replay_complete,
+  `Aiur.NativeAIR.Merkle.replay_calls,
+  `Aiur.NativeAIR.Merkle.replay_position,
+  `Aiur.NativeAIR.Merkle.replay_index_bound,
+  `Aiur.NativeAIR.Merkle.hasHeight_iff,
+  `Aiur.NativeAIR.Merkle.height_le_max,
+  `Aiur.NativeAIR.Merkle.covered_iff,
+  `Aiur.NativeAIR.Merkle.replay_binding,
+  `Aiur.NativeAIR.Merkle.rowsAt_fields_le,
+  `Aiur.NativeAIR.Merkle.rowBytes_length_le,
+  `Aiur.NativeAIR.Merkle.step_input_length,
+  `Aiur.NativeAIR.Merkle.walk_input_length,
+  `Aiur.NativeAIR.Merkle.replay_input_length,
+  `Aiur.NativeAIR.Merkle.replay_native_input]
+
+def merkleClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.verify_success,
+  `Aiur.NativeAIR.Merkle.verify_collision,
+  `Aiur.NativeAIR.Merkle.verifyCovered_collision,
+  `Aiur.NativeAIR.Merkle.blake3_collision]
+
+def merklePremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.Digest,
+  `Aiur.NativeAIR.Merkle.Hash,
+  `Aiur.NativeAIR.Merkle.Dimensions.mk,
+  `Aiur.NativeAIR.Merkle.maxHeight,
+  `Aiur.NativeAIR.Merkle.shape,
+  `Aiur.NativeAIR.Merkle.hasHeight,
+  `Aiur.NativeAIR.Merkle.rowsAt,
+  `Aiur.NativeAIR.Merkle.rowBytes,
+  `Aiur.NativeAIR.Merkle.pairBytes,
+  `Aiur.NativeAIR.Merkle.branchBytes,
+  `Aiur.NativeAIR.Merkle.Hashing.mk,
+  `Aiur.NativeAIR.Merkle.step,
+  `Aiur.NativeAIR.Merkle.walk,
+  `Aiur.NativeAIR.Merkle.Replay.mk,
+  `Aiur.NativeAIR.Merkle.replay,
+  `Aiur.NativeAIR.Merkle.accepts,
+  `Aiur.NativeAIR.Merkle.verify,
+  `Aiur.NativeAIR.Merkle.covered,
+  `Aiur.NativeAIR.Merkle.verifyCovered,
+  `Aiur.NativeAIR.Merkle.CollisionOn]
+
+def prunedMerkleRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.walk_append,
+  `Aiur.NativeAIR.PrunedMerkle.Logged.bind_success,
+  `Aiur.NativeAIR.PrunedMerkle.Logged.bind_input_left,
+  `Aiur.NativeAIR.PrunedMerkle.Logged.bind_input_right,
+  `Aiur.NativeAIR.PrunedMerkle.Logged.bind_if,
+  `Aiur.NativeAIR.PrunedMerkle.hashInput_value,
+  `Aiur.NativeAIR.PrunedMerkle.hashInput_inputs,
+  `Aiur.NativeAIR.PrunedMerkle.TicketAt.mono,
+  `Aiur.NativeAIR.PrunedMerkle.NodeAt.mono,
+  `Aiur.NativeAIR.PrunedMerkle.PendingAt.mono,
+  `Aiur.NativeAIR.PrunedMerkle.PendingNode.mono,
+  `Aiur.NativeAIR.PrunedMerkle.TicketAt.extend,
+  `Aiur.NativeAIR.PrunedMerkle.TicketAt.finish,
+  `Aiur.NativeAIR.PrunedMerkle.PendingAt.finish_absent,
+  `Aiur.NativeAIR.PrunedMerkle.PendingAt.finish_injected,
+  `Aiur.NativeAIR.PrunedMerkle.NodeAt.singleton,
+  `Aiur.NativeAIR.PrunedMerkle.NodeAt.pair,
+  `Aiur.NativeAIR.PrunedMerkle.origins_cons,
+  `Aiur.NativeAIR.PrunedMerkle.origins_extend,
+  `Aiur.NativeAIR.PrunedMerkle.combine_refines,
+  `Aiur.NativeAIR.PrunedMerkle.inject_refines,
+  `Aiur.NativeAIR.PrunedMerkle.initial_refines,
+  `Aiur.NativeAIR.PrunedMerkle.walk_refines,
+  `Aiur.NativeAIR.PrunedMerkle.mapM_members,
+  `Aiur.NativeAIR.PrunedMerkle.representatives_refines,
+  `Aiur.NativeAIR.PrunedMerkle.replay_refines,
+  `Aiur.NativeAIR.PrunedMerkle.replay_individual,
+  `Aiur.NativeAIR.PrunedMerkle.verify_individual,
+  `Aiur.NativeAIR.PrunedMerkle.verifyCovered_individual,
+  `Aiur.NativeAIR.PrunedMerkle.verify_collision,
+  `Aiur.NativeAIR.PrunedMerkle.verifyCovered_collision,
+  `Aiur.NativeAIR.PrunedMerkle.blake3_collision,
+  `Aiur.NativeAIR.PrunedMerkle.blake3_native_collision]
+
+def prunedMerkleAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.PrunedMerkle.hashInput_value,
+  `Aiur.NativeAIR.PrunedMerkle.hashInput_inputs,
+  `Aiur.NativeAIR.PrunedMerkle.origins_cons]
+
+def prunedMerkleQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Merkle.walk_append,
+  `Aiur.NativeAIR.PrunedMerkle.TicketAt.finish,
+  `Aiur.NativeAIR.PrunedMerkle.PendingAt.finish_absent,
+  `Aiur.NativeAIR.PrunedMerkle.PendingAt.finish_injected,
+  `Aiur.NativeAIR.PrunedMerkle.NodeAt.singleton,
+  `Aiur.NativeAIR.PrunedMerkle.NodeAt.pair,
+  `Aiur.NativeAIR.PrunedMerkle.combine_refines,
+  `Aiur.NativeAIR.PrunedMerkle.inject_refines,
+  `Aiur.NativeAIR.PrunedMerkle.initial_refines,
+  `Aiur.NativeAIR.PrunedMerkle.walk_refines,
+  `Aiur.NativeAIR.PrunedMerkle.mapM_members,
+  `Aiur.NativeAIR.PrunedMerkle.representatives_refines,
+  `Aiur.NativeAIR.PrunedMerkle.replay_refines,
+  `Aiur.NativeAIR.PrunedMerkle.replay_individual]
+
+def prunedMerkleClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.PrunedMerkle.verify_individual,
+  `Aiur.NativeAIR.PrunedMerkle.verifyCovered_individual,
+  `Aiur.NativeAIR.PrunedMerkle.verify_collision,
+  `Aiur.NativeAIR.PrunedMerkle.verifyCovered_collision,
+  `Aiur.NativeAIR.PrunedMerkle.blake3_collision,
+  `Aiur.NativeAIR.PrunedMerkle.blake3_native_collision]
+
+def prunedMerklePremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.PrunedMerkle.Logged.mk,
+  `Aiur.NativeAIR.PrunedMerkle.Logged.pure,
+  `Aiur.NativeAIR.PrunedMerkle.Logged.bind,
+  `Aiur.NativeAIR.PrunedMerkle.reject,
+  `Aiur.NativeAIR.PrunedMerkle.ofOption,
+  `Aiur.NativeAIR.PrunedMerkle.hashInput,
+  `Aiur.NativeAIR.PrunedMerkle.Ticket.mk,
+  `Aiur.NativeAIR.PrunedMerkle.Ticket.extend,
+  `Aiur.NativeAIR.PrunedMerkle.Node.mk,
+  `Aiur.NativeAIR.PrunedMerkle.uniqueIndices,
+  `Aiur.NativeAIR.PrunedMerkle.parentIndices,
+  `Aiur.NativeAIR.PrunedMerkle.boundaryCount,
+  `Aiur.NativeAIR.PrunedMerkle.representatives,
+  `Aiur.NativeAIR.PrunedMerkle.initial,
+  `Aiur.NativeAIR.PrunedMerkle.combine,
+  `Aiur.NativeAIR.PrunedMerkle.inject,
+  `Aiur.NativeAIR.PrunedMerkle.walk,
+  `Aiur.NativeAIR.PrunedMerkle.replay,
+  `Aiur.NativeAIR.PrunedMerkle.accepts,
+  `Aiur.NativeAIR.PrunedMerkle.verify,
+  `Aiur.NativeAIR.PrunedMerkle.verifyCovered,
+  `Aiur.NativeAIR.PrunedMerkle.TicketAt.mk,
+  `Aiur.NativeAIR.PrunedMerkle.NodeAt,
+  `Aiur.NativeAIR.PrunedMerkle.PendingAt,
+  `Aiur.NativeAIR.PrunedMerkle.PendingNode,
+  `Aiur.NativeAIR.PrunedMerkle.origins,
+  `Aiur.NativeAIR.PrunedMerkle.instMonadLogged]
+
+def extensionMmcsRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.ExtensionMmcs.baseRow_length,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRow_injective,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_length,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_injective,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_fields,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions_length,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions_heights,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions_maxHeight,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions_covered,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions_exact,
+  `Aiur.NativeAIR.ExtensionMmcs.shape_base,
+  `Aiur.NativeAIR.ExtensionMmcs.fri_width_fits,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_query,
+  `Aiur.NativeAIR.ExtensionMmcs.replay_shape,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMulti_individual,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMulti_shape,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered_individual,
+  `Aiur.NativeAIR.ExtensionMmcs.replay_native_input,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyCovered_collision,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered_collision,
+  `Aiur.NativeAIR.ExtensionMmcs.blake3_native_collision,
+  `Aiur.NativeAIR.ExtensionMmcs.blake3_multi_native_collision]
+
+def extensionMmcsAxiomFreeRoots : Array Lean.Name := #[]
+
+def extensionMmcsQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.ExtensionMmcs.baseRow_length,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRow_injective,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_injective,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_fields,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions_exact,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows_query,
+  `Aiur.NativeAIR.ExtensionMmcs.replay_native_input]
+
+def extensionMmcsClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.ExtensionMmcs.shape_base,
+  `Aiur.NativeAIR.ExtensionMmcs.fri_width_fits,
+  `Aiur.NativeAIR.ExtensionMmcs.replay_shape,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMulti_individual,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMulti_shape,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered_individual,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyCovered_collision,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered_collision,
+  `Aiur.NativeAIR.ExtensionMmcs.blake3_native_collision,
+  `Aiur.NativeAIR.ExtensionMmcs.blake3_multi_native_collision]
+
+def extensionMmcsPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.ExtensionMmcs.baseRow,
+  `Aiur.NativeAIR.ExtensionMmcs.baseRows,
+  `Aiur.NativeAIR.ExtensionMmcs.baseDimensions,
+  `Aiur.NativeAIR.ExtensionMmcs.WidthsFit,
+  `Aiur.NativeAIR.ExtensionMmcs.shape,
+  `Aiur.NativeAIR.ExtensionMmcs.replay,
+  `Aiur.NativeAIR.ExtensionMmcs.verify,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyCovered,
+  `Aiur.NativeAIR.ExtensionMmcs.replayMulti,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMulti,
+  `Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered]
+
+def friDomainRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriDomain.reverseBits_bound,
+  `Aiur.NativeAIR.FriDomain.reverseBits_zero,
+  `Aiur.NativeAIR.FriDomain.reverseBits_zero_width,
+  `Aiur.NativeAIR.FriDomain.reverseBits_mod,
+  `Aiur.NativeAIR.FriDomain.reverseBits_involution,
+  `Aiur.NativeAIR.FriDomain.reverseBits_injective,
+  `Aiur.NativeAIR.FriDomain.reverseBits_surjective,
+  `Aiur.NativeAIR.FriDomain.index_split_bound,
+  `Aiur.NativeAIR.FriDomain.reverseBits_split,
+  `Aiur.NativeAIR.FriDomain.reverseBits_padding,
+  `Aiur.NativeAIR.FriDomain.wordReverse_eq,
+  `Aiur.NativeAIR.FriDomain.generator_nested,
+  `Aiur.NativeAIR.FriDomain.queryPoint_eq,
+  `Aiur.NativeAIR.FriDomain.queryPoint_domain,
+  `Aiur.NativeAIR.FriDomain.queryPoint_injective,
+  `Aiur.NativeAIR.FriDomain.queryPoint_surjective,
+  `Aiur.NativeAIR.FriDomain.queryPoint_nonzero,
+  `Aiur.NativeAIR.FriDomain.queryPoint_power,
+  `Aiur.NativeAIR.FriDomain.queryPoint_zero,
+  `Aiur.NativeAIR.FriDomain.queryPoint_padding,
+  `Aiur.NativeAIR.FriDomain.index_join_bound,
+  `Aiur.NativeAIR.FriDomain.reverseBits_join,
+  `Aiur.NativeAIR.FriDomain.foldNode_eq,
+  `Aiur.NativeAIR.FriDomain.foldNode_injective,
+  `Aiur.NativeAIR.FriDomain.foldNode_nonzero,
+  `Aiur.NativeAIR.FriDomain.foldNode_power,
+  `Aiur.NativeAIR.FriDomain.queryPoint_reduce,
+  `Aiur.NativeAIR.FriDomain.inputPoint_nonzero,
+  `Aiur.NativeAIR.FriDomain.inputPoint_injective,
+  `Aiur.NativeAIR.FriDomain.inputPoint_power,
+  `Aiur.NativeAIR.FriDomain.coset_shift_certificate,
+  `Aiur.NativeAIR.FriDomain.coset_shift_not_root,
+  `Aiur.NativeAIR.FriDomain.inputPoint_not_root,
+  `Aiur.NativeAIR.FriDomain.inputPoint_trace_disjoint]
+
+def friDomainQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriDomain.reverseBits_bound,
+  `Aiur.NativeAIR.FriDomain.reverseBits_zero,
+  `Aiur.NativeAIR.FriDomain.reverseBits_zero_width,
+  `Aiur.NativeAIR.FriDomain.reverseBits_mod,
+  `Aiur.NativeAIR.FriDomain.reverseBits_involution,
+  `Aiur.NativeAIR.FriDomain.reverseBits_injective,
+  `Aiur.NativeAIR.FriDomain.reverseBits_surjective,
+  `Aiur.NativeAIR.FriDomain.reverseBits_split,
+  `Aiur.NativeAIR.FriDomain.reverseBits_padding,
+  `Aiur.NativeAIR.FriDomain.wordReverse_eq,
+  `Aiur.NativeAIR.FriDomain.queryPoint_domain,
+  `Aiur.NativeAIR.FriDomain.queryPoint_surjective,
+  `Aiur.NativeAIR.FriDomain.index_join_bound,
+  `Aiur.NativeAIR.FriDomain.reverseBits_join]
+
+def friDomainClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriDomain.generator_nested,
+  `Aiur.NativeAIR.FriDomain.queryPoint_eq,
+  `Aiur.NativeAIR.FriDomain.queryPoint_injective,
+  `Aiur.NativeAIR.FriDomain.queryPoint_nonzero,
+  `Aiur.NativeAIR.FriDomain.queryPoint_power,
+  `Aiur.NativeAIR.FriDomain.queryPoint_zero,
+  `Aiur.NativeAIR.FriDomain.queryPoint_padding,
+  `Aiur.NativeAIR.FriDomain.foldNode_eq,
+  `Aiur.NativeAIR.FriDomain.foldNode_injective,
+  `Aiur.NativeAIR.FriDomain.foldNode_nonzero,
+  `Aiur.NativeAIR.FriDomain.foldNode_power,
+  `Aiur.NativeAIR.FriDomain.queryPoint_reduce,
+  `Aiur.NativeAIR.FriDomain.inputPoint_nonzero,
+  `Aiur.NativeAIR.FriDomain.inputPoint_injective,
+  `Aiur.NativeAIR.FriDomain.inputPoint_power,
+  `Aiur.NativeAIR.FriDomain.coset_shift_not_root,
+  `Aiur.NativeAIR.FriDomain.inputPoint_not_root,
+  `Aiur.NativeAIR.FriDomain.inputPoint_trace_disjoint]
+
+def friDomainPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriDomain.reverseBits,
+  `Aiur.NativeAIR.FriDomain.wordReverse,
+  `Aiur.NativeAIR.FriDomain.queryPoint,
+  `Aiur.NativeAIR.FriDomain.inputPoint,
+  `Aiur.NativeAIR.FriDomain.foldNode]
+
+def polynomialRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Polynomial.isZero_nil,
+  `Aiur.NativeAIR.Polynomial.isZero_iff_all,
+  `Aiur.NativeAIR.Polynomial.isZero_cons,
+  `Aiur.NativeAIR.Polynomial.isZero_append,
+  `Aiur.NativeAIR.Polynomial.monic_nonzero,
+  `Aiur.NativeAIR.Polynomial.sub_nil,
+  `Aiur.NativeAIR.Polynomial.horner_zero,
+  `Aiur.NativeAIR.Polynomial.add_length,
+  `Aiur.NativeAIR.Polynomial.sub_length,
+  `Aiur.NativeAIR.Polynomial.scale_length,
+  `Aiur.NativeAIR.Polynomial.sub_append,
+  `Aiur.NativeAIR.Polynomial.sub_append_left,
+  `Aiur.NativeAIR.Polynomial.horner_add,
+  `Aiur.NativeAIR.Polynomial.horner_neg,
+  `Aiur.NativeAIR.Polynomial.horner_sub,
+  `Aiur.NativeAIR.Polynomial.horner_scale,
+  `Aiur.NativeAIR.Polynomial.mulLinear_length,
+  `Aiur.NativeAIR.Polynomial.horner_mulLinear,
+  `Aiur.NativeAIR.Polynomial.fromRoots_length,
+  `Aiur.NativeAIR.Polynomial.horner_fromRoots,
+  `Aiur.NativeAIR.Polynomial.mulLinear_monic,
+  `Aiur.NativeAIR.Polynomial.fromRoots_monic,
+  `Aiur.NativeAIR.Polynomial.fromRoots_nonzero,
+  `Aiur.NativeAIR.Polynomial.fromRoots_vanishes,
+  `Aiur.NativeAIR.Polynomial.powerMinus_length,
+  `Aiur.NativeAIR.Polynomial.powerMinus_monic,
+  `Aiur.NativeAIR.Polynomial.horner_replicate_zero,
+  `Aiur.NativeAIR.Polynomial.horner_powerMinus,
+  `Aiur.NativeAIR.Polynomial.divide_length,
+  `Aiur.NativeAIR.Polynomial.divide_factor,
+  `Aiur.NativeAIR.Polynomial.zero_of_divide_zero,
+  `Aiur.NativeAIR.Polynomial.divide_nonzero,
+  `Aiur.NativeAIR.Polynomial.divide_root,
+  `Aiur.NativeAIR.Polynomial.roots_lt_length,
+  `Aiur.NativeAIR.Polynomial.roots_le_degree,
+  `Aiur.NativeAIR.Polynomial.zero_of_roots,
+  `Aiur.NativeAIR.Polynomial.zero_sub_of_samples,
+  `Aiur.NativeAIR.Polynomial.equal_of_samples,
+  `Aiur.NativeAIR.Polynomial.monic_zero_sub_of_samples,
+  `Aiur.NativeAIR.Polynomial.monic_equal_of_samples,
+  `Aiur.NativeAIR.Polynomial.root_product_identity,
+  `Aiur.NativeAIR.Polynomial.root_count_le,
+  `Aiur.NativeAIR.Polynomial.equal_count_le,
+  `Aiur.NativeAIR.Polynomial.base_roots_lt_length,
+  `Aiur.NativeAIR.Polynomial.extension_roots_lt_length,
+  `Aiur.NativeAIR.Polynomial.base_root_count_le,
+  `Aiur.NativeAIR.Polynomial.extension_root_count_le,
+  `Aiur.NativeAIR.Polynomial.foldingNodes_length,
+  `Aiur.NativeAIR.Polynomial.foldingNodes_nodup,
+  `Aiur.NativeAIR.Polynomial.foldingNodes_powers,
+  `Aiur.NativeAIR.Polynomial.folding_product_identity]
+
+def polynomialAxiomFreeRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Polynomial.isZero_nil,
+  `Aiur.NativeAIR.Polynomial.sub_nil]
+
+def polynomialQuotRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Polynomial.isZero_iff_all,
+  `Aiur.NativeAIR.Polynomial.isZero_cons,
+  `Aiur.NativeAIR.Polynomial.horner_zero,
+  `Aiur.NativeAIR.Polynomial.sub_append_left,
+  `Aiur.NativeAIR.Polynomial.mulLinear_length,
+  `Aiur.NativeAIR.Polynomial.fromRoots_length,
+  `Aiur.NativeAIR.Polynomial.mulLinear_monic,
+  `Aiur.NativeAIR.Polynomial.fromRoots_monic,
+  `Aiur.NativeAIR.Polynomial.fromRoots_nonzero,
+  `Aiur.NativeAIR.Polynomial.powerMinus_length,
+  `Aiur.NativeAIR.Polynomial.powerMinus_monic,
+  `Aiur.NativeAIR.Polynomial.horner_replicate_zero,
+  `Aiur.NativeAIR.Polynomial.divide_length,
+  `Aiur.NativeAIR.Polynomial.zero_of_divide_zero,
+  `Aiur.NativeAIR.Polynomial.divide_nonzero,
+  `Aiur.NativeAIR.Polynomial.foldingNodes_length]
+
+def polynomialClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Polynomial.sub_append,
+  `Aiur.NativeAIR.Polynomial.horner_add,
+  `Aiur.NativeAIR.Polynomial.horner_neg,
+  `Aiur.NativeAIR.Polynomial.horner_sub,
+  `Aiur.NativeAIR.Polynomial.horner_scale,
+  `Aiur.NativeAIR.Polynomial.horner_mulLinear,
+  `Aiur.NativeAIR.Polynomial.horner_fromRoots,
+  `Aiur.NativeAIR.Polynomial.fromRoots_vanishes,
+  `Aiur.NativeAIR.Polynomial.horner_powerMinus,
+  `Aiur.NativeAIR.Polynomial.divide_factor,
+  `Aiur.NativeAIR.Polynomial.divide_root,
+  `Aiur.NativeAIR.Polynomial.roots_lt_length,
+  `Aiur.NativeAIR.Polynomial.roots_le_degree,
+  `Aiur.NativeAIR.Polynomial.zero_of_roots,
+  `Aiur.NativeAIR.Polynomial.zero_sub_of_samples,
+  `Aiur.NativeAIR.Polynomial.equal_of_samples,
+  `Aiur.NativeAIR.Polynomial.monic_zero_sub_of_samples,
+  `Aiur.NativeAIR.Polynomial.monic_equal_of_samples,
+  `Aiur.NativeAIR.Polynomial.root_product_identity,
+  `Aiur.NativeAIR.Polynomial.root_count_le,
+  `Aiur.NativeAIR.Polynomial.equal_count_le,
+  `Aiur.NativeAIR.Polynomial.base_roots_lt_length,
+  `Aiur.NativeAIR.Polynomial.extension_roots_lt_length,
+  `Aiur.NativeAIR.Polynomial.base_root_count_le,
+  `Aiur.NativeAIR.Polynomial.extension_root_count_le,
+  `Aiur.NativeAIR.Polynomial.foldingNodes_nodup,
+  `Aiur.NativeAIR.Polynomial.foldingNodes_powers,
+  `Aiur.NativeAIR.Polynomial.folding_product_identity]
+
+def polynomialPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Polynomial.IsZero,
+  `Aiur.NativeAIR.Polynomial.Monic,
+  `Aiur.NativeAIR.Polynomial.add,
+  `Aiur.NativeAIR.Polynomial.sub,
+  `Aiur.NativeAIR.Polynomial.scale,
+  `Aiur.NativeAIR.Polynomial.mulLinear,
+  `Aiur.NativeAIR.Polynomial.fromRoots,
+  `Aiur.NativeAIR.Polynomial.powerMinus,
+  `Aiur.NativeAIR.Polynomial.divide,
+  `Aiur.NativeAIR.Polynomial.foldingNodes]
+
+def interpolationRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Interpolation.derivative_zero,
+  `Aiur.NativeAIR.Interpolation.derivative_neg,
+  `Aiur.NativeAIR.Interpolation.derivative_sub,
+  `Aiur.NativeAIR.Interpolation.divide_diagonal,
+  `Aiur.NativeAIR.Interpolation.monomial_value,
+  `Aiur.NativeAIR.Interpolation.monomial_derivative,
+  `Aiur.NativeAIR.Interpolation.powerMinus_derivative,
+  `Aiur.NativeAIR.Interpolation.root_product_derivative,
+  `Aiur.NativeAIR.Interpolation.root_quotient_diagonal,
+  `Aiur.NativeAIR.Interpolation.closed_weight_diagonal,
+  `Aiur.NativeAIR.Interpolation.combine_length,
+  `Aiur.NativeAIR.Interpolation.coefficients_length,
+  `Aiur.NativeAIR.Interpolation.combine_zero,
+  `Aiur.NativeAIR.Interpolation.combine_at_node,
+  `Aiur.NativeAIR.Interpolation.coefficients_at_node,
+  `Aiur.NativeAIR.Interpolation.coefficients_unique,
+  `Aiur.NativeAIR.Interpolation.coefficients_evaluate,
+  `Aiur.NativeAIR.Interpolation.divide_inverse_value,
+  `Aiur.NativeAIR.Interpolation.weightedSum_polynomial,
+  `Aiur.NativeAIR.Interpolation.evaluate_polynomial,
+  `Aiur.NativeAIR.Interpolation.foldSamples_roots,
+  `Aiur.NativeAIR.Interpolation.foldSamples_length,
+  `Aiur.NativeAIR.Interpolation.foldSamples_nodup,
+  `Aiur.NativeAIR.Interpolation.foldSamples_powers,
+  `Aiur.NativeAIR.Interpolation.foldScale_inverse,
+  `Aiur.NativeAIR.Interpolation.foldRow_polynomial,
+  `Aiur.NativeAIR.Interpolation.foldRow_reject_shape,
+  `Aiur.NativeAIR.Interpolation.foldRow_at_node,
+  `Aiur.NativeAIR.Interpolation.foldRow_evaluate,
+  `Aiur.NativeAIR.Interpolation.foldRow_success]
+
+def interpolationClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Interpolation.derivative_zero,
+  `Aiur.NativeAIR.Interpolation.derivative_neg,
+  `Aiur.NativeAIR.Interpolation.derivative_sub,
+  `Aiur.NativeAIR.Interpolation.divide_diagonal,
+  `Aiur.NativeAIR.Interpolation.monomial_value,
+  `Aiur.NativeAIR.Interpolation.monomial_derivative,
+  `Aiur.NativeAIR.Interpolation.powerMinus_derivative,
+  `Aiur.NativeAIR.Interpolation.root_product_derivative,
+  `Aiur.NativeAIR.Interpolation.root_quotient_diagonal,
+  `Aiur.NativeAIR.Interpolation.closed_weight_diagonal,
+  `Aiur.NativeAIR.Interpolation.combine_zero,
+  `Aiur.NativeAIR.Interpolation.combine_at_node,
+  `Aiur.NativeAIR.Interpolation.coefficients_at_node,
+  `Aiur.NativeAIR.Interpolation.coefficients_unique,
+  `Aiur.NativeAIR.Interpolation.coefficients_evaluate,
+  `Aiur.NativeAIR.Interpolation.divide_inverse_value,
+  `Aiur.NativeAIR.Interpolation.weightedSum_polynomial,
+  `Aiur.NativeAIR.Interpolation.evaluate_polynomial,
+  `Aiur.NativeAIR.Interpolation.foldSamples_nodup,
+  `Aiur.NativeAIR.Interpolation.foldSamples_powers,
+  `Aiur.NativeAIR.Interpolation.foldScale_inverse,
+  `Aiur.NativeAIR.Interpolation.foldRow_polynomial,
+  `Aiur.NativeAIR.Interpolation.foldRow_at_node,
+  `Aiur.NativeAIR.Interpolation.foldRow_evaluate,
+  `Aiur.NativeAIR.Interpolation.foldRow_success]
+
+def interpolationPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Interpolation.derivativeValue,
+  `Aiur.NativeAIR.Interpolation.combine,
+  `Aiur.NativeAIR.Interpolation.coefficients,
+  `Aiur.NativeAIR.Interpolation.weightedSum,
+  `Aiur.NativeAIR.Interpolation.evaluate,
+  `Aiur.NativeAIR.Interpolation.foldSamples,
+  `Aiur.NativeAIR.Interpolation.foldScale,
+  `Aiur.NativeAIR.Interpolation.foldRow]
+
+def foldingRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Folding.horner_split,
+  `Aiur.NativeAIR.Folding.rowCoefficients_length,
+  `Aiur.NativeAIR.Folding.rowCoefficients_value,
+  `Aiur.NativeAIR.Folding.rowCoefficients_fold,
+  `Aiur.NativeAIR.Folding.foldCoefficients_degree,
+  `Aiur.NativeAIR.Folding.foldRow_global,
+  `Aiur.NativeAIR.Folding.foldRow_codeword,
+  `Aiur.NativeAIR.Folding.foldRow_codeword_degree,
+  `Aiur.NativeAIR.Folding.values_of_agreement,
+  `Aiur.NativeAIR.Folding.interpolant_values,
+  `Aiur.NativeAIR.Folding.interpolants_different,
+  `Aiur.NativeAIR.Folding.foldRow_equal_count_le]
+
+def foldingClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.Folding.horner_split,
+  `Aiur.NativeAIR.Folding.rowCoefficients_value,
+  `Aiur.NativeAIR.Folding.rowCoefficients_fold,
+  `Aiur.NativeAIR.Folding.foldRow_global,
+  `Aiur.NativeAIR.Folding.foldRow_codeword,
+  `Aiur.NativeAIR.Folding.foldRow_codeword_degree,
+  `Aiur.NativeAIR.Folding.interpolant_values,
+  `Aiur.NativeAIR.Folding.interpolants_different,
+  `Aiur.NativeAIR.Folding.foldRow_equal_count_le]
+
+def foldingPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.Folding.foldCoefficients,
+  `Aiur.NativeAIR.Folding.rowCoefficients]
+
+def friQueryRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriQuery.reconstruct_eq,
+  `Aiur.NativeAIR.FriQuery.reconstruct_success,
+  `Aiur.NativeAIR.FriQuery.reconstruct_length,
+  `Aiur.NativeAIR.FriQuery.reconstruct_self,
+  `Aiur.NativeAIR.FriQuery.reconstruct_siblings,
+  `Aiur.NativeAIR.FriQuery.step_success,
+  `Aiur.NativeAIR.FriQuery.step_dimensions,
+  `Aiur.NativeAIR.FriQuery.step_row,
+  `Aiur.NativeAIR.FriQuery.step_index_bound,
+  `Aiur.NativeAIR.FriQuery.step_self_sample,
+  `Aiur.NativeAIR.FriQuery.step_polynomial,
+  `Aiur.NativeAIR.FriQuery.step_global,
+  `Aiur.NativeAIR.FriQuery.roll_length,
+  `Aiur.NativeAIR.FriQuery.roll_empty,
+  `Aiur.NativeAIR.FriQuery.roll_matching,
+  `Aiur.NativeAIR.FriQuery.roll_other,
+  `Aiur.NativeAIR.FriQuery.roll_count,
+  `Aiur.NativeAIR.FriQuery.roll_order,
+  `Aiur.NativeAIR.FriQuery.walk_nil_success,
+  `Aiur.NativeAIR.FriQuery.walk_cons_success,
+  `Aiur.NativeAIR.FriQuery.walk_summary,
+  `Aiur.NativeAIR.FriQuery.walk_openings,
+  `Aiur.NativeAIR.FriQuery.run_success,
+  `Aiur.NativeAIR.FriQuery.run_summary,
+  `Aiur.NativeAIR.FriQuery.check_success,
+  `Aiur.NativeAIR.FriQuery.check_final_polynomial]
+
+def friQueryPropextRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriQuery.roll_empty]
+
+def friQueryClassicalRoots : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriQuery.reconstruct_eq,
+  `Aiur.NativeAIR.FriQuery.reconstruct_self,
+  `Aiur.NativeAIR.FriQuery.step_dimensions,
+  `Aiur.NativeAIR.FriQuery.step_row,
+  `Aiur.NativeAIR.FriQuery.step_index_bound,
+  `Aiur.NativeAIR.FriQuery.step_self_sample,
+  `Aiur.NativeAIR.FriQuery.step_polynomial,
+  `Aiur.NativeAIR.FriQuery.step_global,
+  `Aiur.NativeAIR.FriQuery.roll_matching,
+  `Aiur.NativeAIR.FriQuery.roll_count,
+  `Aiur.NativeAIR.FriQuery.roll_order,
+  `Aiur.NativeAIR.FriQuery.walk_summary,
+  `Aiur.NativeAIR.FriQuery.walk_openings,
+  `Aiur.NativeAIR.FriQuery.run_summary,
+  `Aiur.NativeAIR.FriQuery.check_final_polynomial]
+
+def friQueryPremises : Array Lean.Name := #[
+  `Aiur.NativeAIR.FriQuery.reconstruct,
+  `Aiur.NativeAIR.FriQuery.State.mk,
+  `Aiur.NativeAIR.FriQuery.Round.mk,
+  `Aiur.NativeAIR.FriQuery.Row.mk,
+  `Aiur.NativeAIR.FriQuery.roll,
+  `Aiur.NativeAIR.FriQuery.StepResult.mk,
+  `Aiur.NativeAIR.FriQuery.step,
+  `Aiur.NativeAIR.FriQuery.Result.mk,
+  `Aiur.NativeAIR.FriQuery.walk,
+  `Aiur.NativeAIR.FriQuery.run,
+  `Aiur.NativeAIR.FriQuery.check]
+
+def roots : Array Lean.Name := #[
+  `Aiur.G.ofNat_n, `Aiur.G.mul_one, `Aiur.G.mul_zero,
+  `Aiur.AIR.inactive_multiplicity_zero,
+  `Aiur.AIR.nonzero_multiplicity_active, `Aiur.AIR.active_satisfies,
+  `Aiur.Bytecode.Eval.runFunction_sameCode,
+  `Aiur.finishCompilation_sameCode, `Aiur.finishCompilation_reflects,
+  `Aiur.Source.Toplevel.compile_artifact_of_ok,
+  `Aiur.BoundVerifier.build, `Aiur.BoundVerifier.verify_success,
+  `Aiur.BoundVerifier.Backend.compilation_stages,
+  `Aiur.CompiledToplevel.groupFunctions_preserves_code,
+  `Aiur.CompiledToplevel.groupFunctions_sameCode,
+  `Aiur.CompiledToplevel.groupFunctions_preserves_execution,
+  `Aiur.BoundVerifier.Backend.reference_execution,
+  `Aiur.BoundVerifier.Backend.execution_reflects,
+  `Aiur.Bytecode.Ctrl.beq_eq_true_iff,
+  `Aiur.Bytecode.Block.beq_eq_true_iff,
+  `Aiur.Bytecode.Eval.runFunction_renamed_iff,
+  `Aiur.Bytecode.Eval.deduplicate_preserves_execution,
+  `Aiur.finishCompilation_preserves_execution,
+  `Aiur.finishCompilation_nameMap_image,
+  `Aiur.BoundVerifier.Backend.execution_reflects_raw,
+  `Aiur.Source.Eval.interp_restoreTailMatches,
+  `Aiur.Source.Eval.interp_wrapLets,
+  `Aiur.Source.Eval.evalFrames_append,
+  `Aiur.Source.Eval.interp_peelLets,
+  `Aiur.Source.Eval.interp_ret_wrapLets,
+  `Aiur.Source.Eval.interp_ioWrite_sequence,
+  `Aiur.Source.Eval.interp_debug_sequence,
+  `Aiur.Source.Eval.interp_assertEq_sequence,
+  `Aiur.Source.Eval.interp_ioSetInfo_sequence,
+  `Aiur.Source.Eval.interp_app_mode,
+  `Aiur.AIR.memoryPointerCycle_valid,
+  `Aiur.AIR.memoryPointerCycle_inconsistent] ++ callOrderRoots ++ lookupRoots ++ executionRoots ++ memoryRoots ++
+    fieldRoots ++ localConstraintRoots ++ byteArithmeticRoots ++ byteLookupRoots ++
+    lookupMessageRoots ++ lookupShapeRoots ++ globalLookupRoots ++ lookupBudgetRoots ++
+    selectorControlRoots ++ operationRowRoots ++ blockRowRoots ++ querySlotRoots ++ circuitRowRoots ++
+    rowCountRoots ++ circuitTableRoots ++ branchlessRoots ++ circuitTraceRoots ++ circuitMembershipRoots ++ lookupLayoutRoots ++ memoryColumnRoots ++ byteColumnRoots ++ expressionGraphRoots ++ frontendExpressionRoots ++ graphCompilationRoots ++ operationExpressionRoots ++ blockCircuitRoots ++ allocationRoots ++ circuitAllocationRoots ++ circuitCompletionRoots ++ checkedCircuitRoots ++ keyCodecRoots ++ compiledKeyRoots ++ proofAcceptanceRoots ++ extensionRoots ++ logUpRoots ++ domainRoots ++ verifierArithmeticRoots ++ transcriptRoots ++ blake3Roots ++ merkleCapRoots ++ merkleRoots ++ prunedMerkleRoots ++ extensionMmcsRoots ++ friDomainRoots ++ polynomialRoots ++ interpolationRoots ++ foldingRoots ++ friQueryRoots
+
+def premises : Array Lean.Name := #[
+  `Aiur.AIR.activityConstraint,
+  `Aiur.Bytecode.Eval.SameCode.mk,
+  `Aiur.finishCompilation,
+  `Aiur.BoundVerifier.Selection.mk,
+  `Aiur.BoundVerifier.Selection.compile,
+  `Aiur.BoundVerifier.Selection.system,
+  `Aiur.BoundVerifier.Backend.mk,
+  `Aiur.BoundVerifier.verify,
+  `Aiur.CompiledToplevel.groupFunctions,
+  `Aiur.AIR.callRankBound, `Aiur.AIR.packRank, `Aiur.AIR.callOrderConstraint,
+  `Aiur.Concrete.Bytecode.LayoutMState.new, `Aiur.Concrete.Bytecode.opLayout,
+  `Aiur.AIR.suppliedWeight, `Aiur.AIR.ExactLookupBalance,
+  `Aiur.AIR.byteRangeMessage, `Aiur.AIR.byteRangeProviders, `Aiur.AIR.rankByteQueries,
+  `Aiur.Bytecode.instBEqCtrl, `Aiur.Bytecode.instBEqBlock,
+  `Aiur.Bytecode.instHashableCtrl, `Aiur.Bytecode.instHashableBlock,
+  `Aiur.Bytecode.Eval.RenamedCode.mk,
+  `Aiur.Bytecode.boundedRenaming, `Aiur.Bytecode.validatesRenaming,
+  `Aiur.Bytecode.checkedRenaming, `Aiur.Bytecode.Toplevel.deduplicate,
+  `Aiur.Bytecode.Toplevel.deduplicateCandidate,
+  `Aiur.Source.Term.restoreTailMatches, `Aiur.instHashableValue,
+  `Aiur.Source.Term.hoistLets, `Aiur.Source.Term.bindArguments, `Aiur.Source.Toplevel.inlineCalls,
+  `Aiur.Bytecode.AIR.Memory, `Aiur.Bytecode.AIR.Call.mk, `Aiur.Bytecode.AIR.primitive,
+  `Aiur.Bytecode.AIR.readValues, `Aiur.Bytecode.AIR.packWord, `Aiur.Bytecode.AIR.adviceOfSize,
+  `Aiur.Bytecode.AIR.unaryByte, `Aiur.Bytecode.AIR.binaryByte,
+  `Aiur.Bytecode.AIR.pairValues, `Aiur.Bytecode.AIR.readWord,
+  `Aiur.Bytecode.AIR.Step.primitive, `Aiur.Bytecode.AIR.Step.call,
+  `Aiur.Bytecode.AIR.Step.store, `Aiur.Bytecode.AIR.Step.load,
+  `Aiur.Bytecode.AIR.RunOps.nil, `Aiur.Bytecode.AIR.RunOps.cons,
+  `Aiur.Bytecode.AIR.SelectArm.case, `Aiur.Bytecode.AIR.SelectArm.fallback,
+  `Aiur.Bytecode.AIR.RunBlock.block,
+  `Aiur.Bytecode.AIR.RunCtrl.returned, `Aiur.Bytecode.AIR.RunCtrl.yielded,
+  `Aiur.Bytecode.AIR.RunCtrl.match, `Aiur.Bytecode.AIR.RunCtrl.matchContinueReturn,
+  `Aiur.Bytecode.AIR.RunCtrl.matchContinueYield,
+  `Aiur.Bytecode.AIR.RunFunction.function, `Aiur.Bytecode.AIR.Execution.function,
+  `Aiur.AIR.FunctionRow.mk, `Aiur.AIR.FunctionRow.Valid.mk,
+  `Aiur.AIR.FunctionRow.requests, `Aiur.AIR.FunctionRow.byteQueries,
+  `Aiur.AIR.functionProviders, `Aiur.AIR.functionQueries, `Aiur.AIR.functionByteQueries,
+  `Aiur.AIR.MemoryRow.mk, `Aiur.AIR.memoryActivityTransition,
+  `Aiur.AIR.memoryPointerTransition, `Aiur.AIR.MemoryRowsValid.mk,
+  `Aiur.AIR.memoryFacts, `Aiur.AIR.memoryProviders, `Aiur.AIR.memoryPointerCycle,
+  `Aiur.GoldilocksProof.squareMod, `Aiur.AIR.booleanConstraint,
+  `Aiur.AIR.oneSubBooleanConstraint, `Aiur.AIR.selectorSum,
+  `Aiur.AIR.MemoryRowsPolynomials.mk,
+  `Aiur.AIR.inverse256, `Aiur.AIR.pack4, `Aiur.AIR.pack4Nat,
+  `Aiur.AIR.carryStep, `Aiur.AIR.u32Carries,
+  `Aiur.AIR.Byte1Kind.all, `Aiur.AIR.Byte1Kind.channel, `Aiur.AIR.Byte1Kind.result,
+  `Aiur.AIR.byte1Outputs, `Aiur.AIR.byte1Request, `Aiur.AIR.byte1Providers,
+  `Aiur.AIR.Byte1Kind.op,
+  `Aiur.AIR.Byte2Kind.all, `Aiur.AIR.Byte2Kind.channel, `Aiur.AIR.Byte2Kind.result,
+  `Aiur.AIR.byte2Outputs, `Aiur.AIR.byte2Request, `Aiur.AIR.byte2Providers,
+  `Aiur.AIR.Byte2Kind.op, `Aiur.AIR.Byte2Kind.extendOutputs,
+  `Aiur.AIR.byte1Preprocessed, `Aiur.AIR.byte2Preprocessed,
+  `Aiur.AIR.padMessage, `Aiur.AIR.HasMessageShape, `Aiur.AIR.mapProviders,
+  `Aiur.AIR.PaddedLookupBalance, `Aiur.AIR.functionMessage, `Aiur.AIR.memoryMessage,
+  `Aiur.AIR.Byte1Kind.outputSize, `Aiur.AIR.Byte2Kind.outputSize,
+  `Aiur.AIR.lookupMessageWidth, `Aiur.AIR.FunctionMessageValid,
+  `Aiur.Bytecode.Ctrl.returnsHaveSize, `Aiur.Bytecode.Block.returnsHaveSize,
+  `Aiur.Bytecode.Op.lookupShape, `Aiur.Bytecode.Ctrl.lookupShapes,
+  `Aiur.Bytecode.Block.lookupShapes, `Aiur.Bytecode.Toplevel.validateLookupShapes,
+  `Aiur.Bytecode.Toplevel.validClaimShape, `Aiur.Bytecode.AIR.Call.LookupShape,
+  `Aiur.Bytecode.AIR.Outcome.ReturnSize,
+  `Aiur.AIR.LookupTables.mk, `Aiur.AIR.LookupTables.providers,
+  `Aiur.AIR.GlobalLookups.mk, `Aiur.AIR.rangeMessage,
+  `Aiur.lookupSlotSum, `Aiur.lookupQueryBoundAux, `Aiur.lookupQueryBound,
+  `Aiur.AIR.addMessages, `Aiur.AIR.scaleMessage, `Aiur.AIR.weightedMessage,
+  `Aiur.AIR.gateMessage, `Aiur.AIR.slotMessage,
+  `Aiur.AIR.SelectorFlow.mk, `Aiur.AIR.SelectorFlow.guard,
+  `Aiur.AIR.SelectorFlow.join, `Aiur.AIR.SelectorFlow.continue,
+  `Aiur.AIR.SelectorFlow.Satisfied, `Aiur.AIR.SelectorFlow.Sound.mk,
+  `Aiur.Bytecode.Ctrl.selectorFlow, `Aiur.Bytecode.Block.selectorFlow,
+  `Aiur.Bytecode.branchSelectorFlows, `Aiur.Bytecode.Ctrl.returnGates,
+  `Aiur.Bytecode.Block.returnGates, `Aiur.Bytecode.branchReturnGates,
+  `Aiur.AIR.RowValue.mk, `Aiur.AIR.RowValue.variable, `Aiur.AIR.RowValue.konst,
+  `Aiur.AIR.rowValues, `Aiur.AIR.RowValue.add, `Aiur.AIR.RowValue.sub,
+  `Aiur.AIR.RowValue.mul, `Aiur.AIR.rowAdvice, `Aiur.AIR.RowValue.pack,
+  `Aiur.AIR.readRowWord, `Aiur.AIR.OpEmission.mk, `Aiur.AIR.emitAdvice,
+  `Aiur.AIR.emitByte1, `Aiur.AIR.Byte2Kind.extendRowOutputs, `Aiur.AIR.emitByte2,
+  `Aiur.AIR.range4Queries, `Aiur.AIR.emitU32LessThan, `Aiur.AIR.emitU32Add,
+  `Aiur.AIR.emitOp, `Aiur.AIR.OpsEmission.mk, `Aiur.AIR.emitOps,
+  `Aiur.AIR.CallsEmitted, `Aiur.Bytecode.MatchPolynomials.mk,
+  `Aiur.AIR.RowContext.mk, `Aiur.AIR.QueryPart.mk, `Aiur.AIR.queryParts,
+  `Aiur.AIR.BlockEmission.mk, `Aiur.AIR.BlockEmission.prefix,
+  `Aiur.AIR.BlockEmission.afterOps, `Aiur.AIR.joinBlockEmissions,
+  `Aiur.AIR.mergeEquations, `Aiur.AIR.BlockEmission.continued,
+  `Aiur.Bytecode.Ctrl.emitRow, `Aiur.Bytecode.Block.emitRow,
+  `Aiur.AIR.SelectorFlow.unguard, `Aiur.AIR.EmissionProjection.mk,
+  `Aiur.Bytecode.caseRow, `Aiur.Bytecode.defaultRow, `Aiur.Bytecode.branchRows,
+  `Aiur.Bytecode.continueRow, `Aiur.AIR.BlockEmission.QueriesIn,
+  `Aiur.AIR.BlockEmission.CallsAt, `Aiur.AIR.BlockEmission.TerminalAt,
+  `Aiur.AIR.EmissionIncluded.mk, `Aiur.Bytecode.Ctrl.rowBounds,
+  `Aiur.Bytecode.Block.rowBounds, `Aiur.AIR.BlockEmission.HasQuery,
+  `Aiur.AIR.BlockEmission.TracksCalls, `Aiur.AIR.RowInputs,
+  `Aiur.AIR.InputPreservation.mk, `Aiur.Bytecode.Function.emitRow,
+  `Aiur.AIR.gateCount, `Aiur.AIR.queryCount, `Aiur.AIR.QuerySlots.mk,
+  `Aiur.AIR.activeQuerySlot, `Aiur.AIR.querySlotParts, `Aiur.AIR.querySlotMultiplicity,
+  `Aiur.AIR.decodedQuery, `Aiur.AIR.encodedQuery, `Aiur.AIR.decodedQueries,
+  `Aiur.AIR.encodedQueries, `Aiur.AIR.blockQueryPool,
+  `Aiur.AIR.MemberEmission.mk, `Aiur.AIR.MemberEmission.selector, `Aiur.AIR.MemberEmission.entry,
+  `Aiur.AIR.emitMember, `Aiur.AIR.emitMembers, `Aiur.AIR.CircuitEmission.mk,
+  `Aiur.AIR.circuitRankBytes, `Aiur.AIR.circuitEmission, `Aiur.AIR.CircuitEmission.lookup,
+  `Aiur.Bytecode.Circuit.emitRow, `Aiur.AIR.MemberEmission.FromProgram.mk,
+  `Aiur.AIR.CircuitEmission.QueriesIn, `Aiur.AIR.circuitQueryPool,
+  `Aiur.Bytecode.FunctionLayout.width,
+  `Aiur.Bytecode.ControlCounts.mk, `Aiur.Bytecode.ControlCounts.sum,
+  `Aiur.Bytecode.ControlCounts.branch, `Aiur.Bytecode.ControlCounts.continue,
+  `Aiur.Bytecode.Ctrl.controlCounts, `Aiur.Bytecode.Block.controlCounts,
+  `Aiur.Bytecode.branchControlCounts, `Aiur.Bytecode.Circuit.validateRowCounts,
+  `Aiur.Bytecode.Toplevel.validateRowCounts, `Aiur.Bytecode.ControlCounts.Describes.mk,
+  `Aiur.BoundVerifier.build,
+  `Aiur.AIR.Provider.PaddedEq, `Aiur.AIR.CircuitEmission.provider,
+  `Aiur.AIR.AuxiliaryTables.mk, `Aiur.AIR.AuxiliaryTables.withFunctions,
+  `Aiur.AIR.AuxiliaryTables.providers, `Aiur.AIR.AuxiliaryTables.circuitProviders,
+  `Aiur.AIR.circuitProviders, `Aiur.AIR.FunctionRow.Provides,
+  `Aiur.AIR.FunctionRow.inactive, `Aiur.AIR.FunctionRow.QueriesIn,
+  `Aiur.AIR.CircuitWitness.mk, `Aiur.AIR.CircuitWitness.Emitted,
+  `Aiur.AIR.CircuitWitness.Satisfied, `Aiur.AIR.CircuitWitness.Shapes,
+  `Aiur.AIR.CircuitWitness.LookupBounds,
+  `Aiur.Bytecode.Function.hasTerminalControl, `Aiur.Bytecode.circuitBranchless,
+  `Aiur.AIR.unitQuerySelectors, `Aiur.AIR.QueryWriters,
+  `Aiur.AIR.encodedCircuitQueryPool,
+  `Aiur.AIR.CircuitTraces.nil, `Aiur.AIR.CircuitTraces.inactive, `Aiur.AIR.CircuitTraces.active,
+  `Aiur.AIR.CircuitTraces.bitmap, `Aiur.AIR.CircuitTraces.degrees, `Aiur.AIR.CircuitTraces.capacity,
+  `Aiur.AIR.emitCircuitWitness, `Aiur.AIR.CircuitTraces.emitWitnesses,
+  `Aiur.Bytecode.Toplevel.singletonCircuits,
+  `Aiur.Bytecode.MembersConstrained, `Aiur.Bytecode.CircuitsConstrained,
+  `Aiur.Bytecode.Op.lookupUsage,
+  `Aiur.Bytecode.Ctrl.lookupUsage,
+  `Aiur.Bytecode.Block.lookupUsage,
+  `Aiur.Bytecode.branchLookupUsage,
+  `Aiur.Bytecode.Function.LookupLayout,
+  `Aiur.Bytecode.FunctionsLookupLayout,
+  `Aiur.Bytecode.MembersLookupBound,
+  `Aiur.Bytecode.CircuitsLookupBound,
+  `Aiur.AIR.MemoryColumns,
+  `Aiur.AIR.decodeMemoryRow,
+  `Aiur.AIR.memoryColumnEquations,
+  `Aiur.AIR.memoryColumnLookup,
+  `Aiur.AIR.memoryColumnProvider,
+  `Aiur.AIR.memoryNextIndex,
+  `Aiur.AIR.memoryMatrixEquations,
+  `Aiur.AIR.MemoryMatrixSatisfied,
+  `Aiur.AIR.decodeMemoryRows,
+  `Aiur.AIR.memoryMatrixProviders,
+  `Aiur.AIR.MemoryTraces.nil, `Aiur.AIR.MemoryTraces.inactive, `Aiur.AIR.MemoryTraces.active,
+  `Aiur.AIR.MemoryTraces.bitmap,
+  `Aiur.AIR.MemoryTraces.degrees,
+  `Aiur.AIR.MemoryTraces.capacity,
+  `Aiur.AIR.MemoryTraces.rows,
+  `Aiur.AIR.MemoryTraces.providers,
+  `Aiur.AIR.MemoryTraces.Satisfied,
+  `Aiur.AIR.memoryTableProviders,
+  `Aiur.AIR.MemoryTraces.auxiliary,
+  `Aiur.fixedTraceHeights,
+  `Aiur.FixedTraceHeights.nil,
+  `Aiur.FixedTraceHeights.inactive,
+  `Aiur.FixedTraceHeights.active,
+  `Aiur.AIR.Byte1Columns,
+  `Aiur.AIR.Byte2Columns,
+  `Aiur.AIR.Byte1Kind.column,
+  `Aiur.AIR.Byte2Kind.column,
+  `Aiur.AIR.byte1PreprocessedColumns,
+  `Aiur.AIR.byte2PreprocessedColumns,
+  `Aiur.AIR.byte1ColumnLookup,
+  `Aiur.AIR.byte2ColumnLookup,
+  `Aiur.AIR.byte1ColumnProvider,
+  `Aiur.AIR.byte2ColumnProvider,
+  `Aiur.AIR.byte1MatrixProviders,
+  `Aiur.AIR.byte2MatrixProviders,
+  `Aiur.AIR.ByteTraces.mk,
+  `Aiur.AIR.ByteTraces.providers,
+  `Aiur.AIR.ByteTraces.byte1Weights,
+  `Aiur.AIR.ByteTraces.byte2Weights,
+  `Aiur.AIR.SystemTraces.mk,
+  `Aiur.AIR.SystemTraces.bitmap,
+  `Aiur.AIR.SystemTraces.degrees,
+  `Aiur.AIR.SystemTraces.queryBound,
+  `Aiur.AIR.SystemTraces.providers,
+  `Aiur.AIR.systemFixedHeights,
+  `Aiur.AIR.systemLookupSlots,
+  `Aiur.NativeAIR.Source.preprocessed,
+  `Aiur.NativeAIR.Source.main,
+  `Aiur.NativeAIR.Source.stage2,
+  `Aiur.NativeAIR.RowOffset.current,
+  `Aiur.NativeAIR.RowOffset.next,
+  `Aiur.NativeAIR.ColRef.mk,
+  `Aiur.NativeAIR.Node.konst,
+  `Aiur.NativeAIR.Node.var,
+  `Aiur.NativeAIR.Node.publicInput,
+  `Aiur.NativeAIR.Node.isFirstRow,
+  `Aiur.NativeAIR.Node.isLastRow,
+  `Aiur.NativeAIR.Node.isTransition,
+  `Aiur.NativeAIR.Node.add,
+  `Aiur.NativeAIR.Node.sub,
+  `Aiur.NativeAIR.Node.mul,
+  `Aiur.NativeAIR.Node.neg,
+  `Aiur.NativeAIR.GraphWidths.mk,
+  `Aiur.NativeAIR.GraphWidths.width,
+  `Aiur.NativeAIR.Lookup.mk,
+  `Aiur.NativeAIR.Graph.mk,
+  `Aiur.NativeAIR.Lookup.roots,
+  `Aiur.NativeAIR.Graph.lookupRoots,
+  `Aiur.NativeAIR.Graph.lookupPrefix,
+  `Aiur.NativeAIR.Node.Valid,
+  `Aiur.NativeAIR.Node.check,
+  `Aiur.NativeAIR.checkNodes,
+  `Aiur.NativeAIR.ValidNodes.nil,
+  `Aiur.NativeAIR.ValidNodes.cons,
+  `Aiur.NativeAIR.checkedGraphPrefix,
+  `Aiur.NativeAIR.Graph.Valid.mk,
+  `Aiur.NativeAIR.EvalOps.mk,
+  `Aiur.NativeAIR.Values.mk,
+  `Aiur.NativeAIR.Values.Fits,
+  `Aiur.NativeAIR.Node.eval,
+  `Aiur.NativeAIR.sweepFrom,
+  `Aiur.NativeAIR.Graph.sweep,
+  `Aiur.NativeAIR.Values.withoutStage2,
+  `Aiur.NativeAIR.Graph.sweepLookupPrefix,
+  `Aiur.NativeAIR.Expr.konst,
+  `Aiur.NativeAIR.Expr.var,
+  `Aiur.NativeAIR.Expr.publicInput,
+  `Aiur.NativeAIR.Expr.isFirstRow,
+  `Aiur.NativeAIR.Expr.isLastRow,
+  `Aiur.NativeAIR.Expr.isTransition,
+  `Aiur.NativeAIR.Expr.add,
+  `Aiur.NativeAIR.Expr.sub,
+  `Aiur.NativeAIR.Expr.mul,
+  `Aiur.NativeAIR.Expr.neg,
+  `Aiur.NativeAIR.Expr.eval,
+  `Aiur.NativeAIR.Node.unfold,
+  `Aiur.NativeAIR.Reflects,
+  `Aiur.NativeAIR.unfoldFrom,
+  `Aiur.NativeAIR.Graph.unfold,
+  `Aiur.NativeAIR.readNodes,
+  `Aiur.NativeAIR.evalRoots,
+  `Aiur.NativeAIR.readLookup,
+  `Aiur.NativeAIR.evalLookup,
+  `Aiur.NativeAIR.goldilocksOps] ++ frontendExpressionPremises ++ graphCompilationPremises ++ operationExpressionPremises ++ blockCircuitPremises ++ allocationPremises ++ circuitAllocationPremises ++ circuitCompletionPremises ++ checkedCircuitPremises ++ keyCodecPremises ++ compiledKeyPremises ++ proofAcceptancePremises ++ extensionPremises ++ logUpPremises ++ domainPremises ++ verifierArithmeticPremises ++ transcriptPremises ++ blake3Premises ++ merkleCapPremises ++ merklePremises ++ prunedMerklePremises ++ extensionMmcsPremises ++ friDomainPremises ++ polynomialPremises ++ interpolationPremises ++ foldingPremises ++ friQueryPremises
+
+private def constants (info : Lean.ConstantInfo) : Array Lean.Name :=
+  info.type.getUsedConstants ++ match info with
+  | .thmInfo value => value.value.getUsedConstants
+  | .defnInfo value => value.value.getUsedConstants
+  | .opaqueInfo value => value.value.getUsedConstants
+  | .inductInfo value => value.ctors.toArray
+  | _ => #[]
+
+private partial def closure (env : Lean.Environment) (runtime : Bool) (pending : List Lean.Name)
+    (seen : NameSet := {}) : NameSet :=
+  match pending with
+  | [] => seen
+  | name :: rest =>
+    if seen.contains name then closure env runtime rest seen
+    else match env.checked.get.find? name with
+    | none => closure env runtime rest (seen.insert name)
+    | some info =>
+      let extras := if runtime then Id.run do
+        let mut names := #[]
+        let worker := Lean.Compiler.mkUnsafeRecName name
+        if (env.checked.get.find? worker).isSome then names := names.push worker
+        if let some other := Lean.Compiler.getImplementedBy? env name then
+          names := names.push other
+        if let some other := (Lean.Compiler.CSimp.ext.getState env).map.find? name then
+          names := names.push other.toDeclName
+        return names
+      else #[]
+      closure env runtime ((constants info ++ extras).toList ++ rest) (seen.insert name)
+
+private def projectConstant (env : Lean.Environment) (name : Lean.Name) : Bool :=
+  match env.getModuleIdxFor? name with
+  | none => false
+  | some idx => (`Ix).isPrefixOf env.allImportedModuleNames[idx.toNat]!
+
+private def sortedNames (names : Array Name) : Array Name := names.qsort Name.lt
+
+/-- Read checked types, bodies and constructors; imported cached axiom
+summaries can omit constructor dependencies. -/
+private def checkAxioms (env : Environment) (root : Name) (expected : Array Name) :
+    CommandElabM (Array Name) := do
+  let reachable := closure env false [root]
+  let mut actual := #[]
+  for name in reachable do
+    let some info := env.checked.get.find? name
+      | throwError "C8 component has an unavailable checked dependency: {name}"
+    if info.isAxiom then actual := actual.push name
+  let sorted := sortedNames actual
+  unless sorted == sortedNames expected do
+    throwError "C8 axiom boundary changed for {root}: expected {sortedNames expected}, actual {sorted}"
+  return sorted
+
+-- Constructor closure and exact-set failure paths are part of the audit.
+private inductive ConstructorAuditFixture where
+  | plain
+  | withProof (proof : propext (Iff.refl True) = rfl)
+
+run_cmd do
+  let _ ← checkAxioms (← getEnv) ``ConstructorAuditFixture.plain #[``propext]
+  let _ ← checkAxioms (← getEnv) ``Eq.refl #[]
+
+/-- error: C8 axiom boundary changed for Eq.refl: expected [propext], actual [] -/
+#guard_msgs in
+run_cmd do
+  let _ ← checkAxioms (← getEnv) ``Eq.refl #[``propext]
+
+/-- error: C8 axiom boundary changed for propext: expected [], actual [propext] -/
+#guard_msgs in
+run_cmd do
+  let _ ← checkAxioms (← getEnv) ``propext #[]
+
+end Aiur.Proofs.Audit
+
+open Aiur.Proofs.Audit in
+run_cmd do
+  let env ← getEnv
+  for root in roots do
+    let some info := env.checked.get.find? root | throwError "C8 component audit: missing root {root}"
+    let expected := if friQueryRoots.contains root then
+        if friQueryPropextRoots.contains root then #[``propext]
+        else if friQueryClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else #[``propext, ``Quot.sound]
+      else if foldingRoots.contains root then
+        if foldingClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else #[``propext, ``Quot.sound]
+      else if interpolationRoots.contains root then
+        if interpolationClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else #[``propext, ``Quot.sound]
+      else if polynomialRoots.contains root then
+        if polynomialAxiomFreeRoots.contains root then #[]
+        else if polynomialClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if polynomialQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if friDomainRoots.contains root then
+        if friDomainClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if friDomainQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if extensionMmcsRoots.contains root then
+        if extensionMmcsAxiomFreeRoots.contains root then #[]
+        else if extensionMmcsClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if extensionMmcsQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if prunedMerkleRoots.contains root then
+        if prunedMerkleAxiomFreeRoots.contains root then #[]
+        else if prunedMerkleClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if prunedMerkleQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if merkleRoots.contains root then
+        if merkleAxiomFreeRoots.contains root then #[]
+        else if merkleClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if merkleQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if merkleCapRoots.contains root then
+        if merkleCapAxiomFreeRoots.contains root then #[]
+        else if merkleCapClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else #[``propext, ``Quot.sound]
+      else if blake3Roots.contains root then
+        if blake3AxiomFreeRoots.contains root then #[]
+        else if blake3ClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if blake3QuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if transcriptRoots.contains root then
+        if transcriptAxiomFreeRoots.contains root then #[]
+        else if transcriptClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if transcriptQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if verifierArithmeticRoots.contains root then
+        if verifierArithmeticAxiomFreeRoots.contains root then #[]
+        else if verifierArithmeticClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if verifierArithmeticQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if domainRoots.contains root then
+        if domainAxiomFreeRoots.contains root then #[]
+        else if domainClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if domainQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if logUpRoots.contains root then
+        if logUpAxiomFreeRoots.contains root then #[]
+        else if logUpClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if logUpQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if extensionRoots.contains root then
+        if extensionAxiomFreeRoots.contains root then #[]
+        else if extensionClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if extensionQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if proofAcceptanceRoots.contains root then
+        if proofAcceptanceAxiomFreeRoots.contains root then #[]
+        else if proofAcceptanceClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if proofAcceptanceQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if compiledKeyRoots.contains root then
+        if compiledKeyQuotOnlyRoots.contains root then #[``Quot.sound]
+        else if compiledKeyClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if compiledKeyQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if keyCodecRoots.contains root then
+        if keyCodecAxiomFreeRoots.contains root then #[]
+        else if keyCodecClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if keyCodecQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if checkedCircuitRoots.contains root then
+        if checkedCircuitAxiomFreeRoots.contains root then #[]
+        else if checkedCircuitClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if checkedCircuitQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if circuitCompletionRoots.contains root then
+        if circuitCompletionClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if circuitCompletionQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if circuitAllocationRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+      else if allocationRoots.contains root then
+        if allocationAxiomFreeRoots.contains root then #[]
+        else if allocationClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if allocationQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if blockCircuitRoots.contains root then
+        if blockCircuitClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if blockCircuitQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if operationExpressionRoots.contains root then
+        if operationExpressionClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if operationExpressionQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if graphCompilationRoots.contains root then
+        if graphCompilationAxiomFreeRoots.contains root then #[]
+        else if graphCompilationClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if graphCompilationQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if frontendExpressionRoots.contains root then
+        if frontendClassicalRoots.contains root then #[``propext, ``Classical.choice, ``Quot.sound]
+        else if frontendQuotRoots.contains root then #[``propext, ``Quot.sound]
+        else #[``propext]
+      else if graphAxiomFreeRoots.contains root then #[]
+      else if graphPropextRoots.contains root || (roots.extract 0 6).contains root ||
+        #[`Aiur.G.n_ofNat, `Aiur.G.n_add, `Aiur.G.n_mul, `Aiur.G.zero_add,
+          `Aiur.AIR.suppliedWeight_nonzero_provider, `Aiur.AIR.inverse256_correct,
+          `Aiur.AIR.byte1Request_shape, `Aiur.AIR.byte2Request_shape,
+          `Aiur.AIR.functionMessage_injective, `Aiur.AIR.memoryMessage_injective,
+          `Aiur.AIR.decodedQueries_length,
+          `Aiur.AIR.encodedQueries_length,
+          `Aiur.AIR.slotMessage_member_length,
+          `Aiur.AIR.suppliedWeight_padded_congr,
+          `Aiur.AIR.PaddedLookupBalance.congr_providers,
+          `Aiur.FixedTraceHeights.alignment,
+          `Aiur.AIR.PaddedLookupBalance.congr_queries].contains root
+      then #[``propext]
+      else if (expressionGraphRoots.contains root && !graphClassicalRoots.contains root) ||
+          callOrderRoots.contains root || lookupRoots.contains root ||
+          executionRoots.contains root || memoryRoots.contains root ||
+          #[`Aiur.AIR.selectorSum_characteristic_cancel, `Aiur.AIR.active_case,
+            `Aiur.AIR.active_default, `Aiur.AIR.byte_add_carry, `Aiur.AIR.byte_sub_borrow,
+            `Aiur.AIR.byte_carry_relation, `Aiur.AIR.pack4_n,
+            `Aiur.AIR.exactLookupBalance_byte1, `Aiur.AIR.exactLookupBalance_byte2,
+            `Aiur.AIR.exactLookupBalance_byte1_step, `Aiur.AIR.exactLookupBalance_byte2_step,
+            `Aiur.AIR.padMessage_injective_of_shape, `Aiur.AIR.ExactLookupBalance.filter,
+            `Aiur.AIR.paddedLookupBalance_provider, `Aiur.AIR.padMessage_append_zero,
+            `Aiur.AIR.functionMessage_rank_alias,
+            `Aiur.AIR.GlobalLookups.byte1, `Aiur.AIR.GlobalLookups.byte2,
+            `Aiur.AIR.GlobalLookups.byte1_step, `Aiur.AIR.GlobalLookups.byte2_step,
+            `Aiur.AIR.GlobalLookups.rank_bytes, `Aiur.BoundVerifier.claim_padding,
+            `Aiur.lookupQueryBound_sound, `Aiur.lookupQueryBound_consumer_count,
+            `Aiur.AIR.CircuitTraces.slot_sum_append, `Aiur.AIR.CircuitTraces.capacity_bounded,
+            `Aiur.AIR.decodeMemoryRow_width, `Aiur.AIR.decodeMemoryRows_size,
+            `Aiur.AIR.MemoryTraces.slot_sum_append, `Aiur.AIR.MemoryTraces.rows_size_le,
+            `Aiur.AIR.MemoryTraces.capacity_bounded,
+            `Aiur.fixedTraceHeights_sound, `Aiur.fixedTraceHeights_complete,
+            `Aiur.AIR.byte2ColumnProvider_reflect, `Aiur.AIR.suppliedWeight_perm,
+            `Aiur.AIR.PaddedLookupBalance.perm_providers, `Aiur.AIR.flatMap_map_swap,
+            `Aiur.AIR.byte2MatrixProviders_reflect,
+            `Aiur.AIR.encodedCircuitQueryPool_uniform_bound,
+            `Aiur.lookupQueryBound_shape, `Aiur.lookupQueryBound_complete,
+            `Aiur.lookupSlotSum_bounded, `Aiur.lookupQueryBound_encodedKey,
+            `Aiur.AIR.GlobalLookups.of_budget,
+            `Aiur.AIR.emitOp_calls, `Aiur.AIR.emitOps_calls,
+            `Aiur.AIR.emitOp_lookupUsage, `Aiur.AIR.emitOps_lookupUsage,
+            `Aiur.AIR.AuxiliaryTables.global_of_circuit_balance,
+            `Aiur.AIR.FunctionRow.inactive_valid,
+            `Aiur.AIR.CallsEmitted.ordered, `Aiur.AIR.active_array_equality,
+            `Aiur.AIR.QuerySlots.active_singleton].contains root
+        then #[``propext, ``Quot.sound]
+      else #[``propext, ``Classical.choice, ``Quot.sound]
+    let axioms ← checkAxioms env root expected
+    liftTermElabM do logInfo m!"ROOT {root}\n{← Meta.ppExpr info.type}\nAXIOMS {axioms}"
+  for name in premises do
+    let some info := env.checked.get.find? name | throwError "C8 component audit: missing premise {name}"
+    liftTermElabM do
+      logInfo m!"PREMISE {name}\n{← Meta.ppExpr info.type}"
+      if let .defnInfo value := info then logInfo m!"DEFINITION\n{← Meta.ppExpr value.value}"
+  let logical := closure env false roots.toList
+  -- Also follow compiler workers and replacements transitively. They need
+  -- not occur in the logical body, especially for partial opaque functions.
+  let reachable := (closure env true roots.toList).toList.mergeSort (fun a b => a.toString < b.toString)
+  let mut workers : Array Lean.Name := #[]
+  let mut partials : Array Lean.Name := #[]
+  let mut externs : Array Lean.Name := #[]
+  let mut replacements : Array (Lean.Name × Lean.Name) := #[]
+  let mut runtime : Array Lean.Name := #[]
+  for name in reachable do
+    unless (env.checked.get.find? name).isSome do
+      throwError "C8 component has an unavailable checked runtime dependency: {name}"
+    if projectConstant env name then
+      if let some parent := Lean.Compiler.isUnsafeRecName? name then
+        match env.checked.get.find? parent with
+        | some (.defnInfo original) =>
+          unless original.safety == .safe do
+            throwError "C8 recursion worker source is not safe: {name}"
+        | some (.opaqueInfo original) =>
+          if original.isUnsafe then throwError "C8 recursion worker source is unsafe: {name}"
+          partials := partials.push parent
+        | _ => throwError "C8 recursion worker has no source definition: {name}"
+        workers := workers.push name
+      if Lean.isExtern env name then externs := externs.push name
+      if let some other := Lean.Compiler.getImplementedBy? env name then
+        replacements := replacements.push (name, other)
+      if let some other := (Lean.Compiler.CSimp.ext.getState env).map.find? name then
+        replacements := replacements.push (name, other.toDeclName)
+      if let some (.defnInfo definition) := env.checked.get.find? name then
+        unless definition.safety == .safe || (Lean.Compiler.isUnsafeRecName? name).isSome do
+          runtime := runtime.push name
+      if let some (.opaqueInfo definition) := env.checked.get.find? name then
+        if definition.isUnsafe then runtime := runtime.push name
+      if Lean.Elab.ComputedFields.computedFieldAttr.hasTag env name then
+        throwError "C8 component has an unreviewed computed field: {name}"
+  unless externs == #[`Aiur.AiurSystem.build, `Aiur.AiurSystem.verify,
+      `Aiur.AiurSystem.vkBytes, `Aiur.Proof.ofBytesChecked] do
+    throwError "C8 component runtime extern inventory changed: {externs}"
+  unless replacements.isEmpty do throwError "C8 component runtime replacements changed: {replacements}"
+  unless runtime.isEmpty do throwError "C8 component has an unreviewed unsafe runtime: {runtime}"
+  unless partials == #[`Aiur.instHashableTyp.hash,
+      `Aiur.instReprPattern.repr, `Aiur.instReprTyp.repr] do
+    throwError "C8 component partial opaque inventory changed: {partials}"
+  if reachable.contains `Aiur.functionGroupsDisabledImpl then
+    throwError "C8 selected program must not depend on the environment grouping override"
+  for name in workers.qsort Name.lt do
+    let some (.defnInfo value) := env.checked.get.find? name
+      | throwError "C8 recursion worker is missing: {name}"
+    liftTermElabM do
+      logInfo m!"RECURSION WORKER {name}\n{← Meta.ppExpr value.type}\nIMPLEMENTATION\n{← Meta.ppExpr value.value}"
+  logInfo m!"C8 component ROOTS {roots.size}; LOGICAL DECLARATIONS {logical.size}; WITH RUNTIME {reachable.length}"
+  logInfo m!"IX RUNTIME EXTERNS {externs}\nPARTIAL OPAQUE SOURCES {partials}\nOTHER UNSAFE RUNTIME {runtime}\nRECURSION WORKERS {workers.size}"
+  logInfo "Runtime diagnostics cover Ix modules, including private constants. Lean/Std runtime primitives remain an external execution boundary. Partial opaque implementations are inventoried, not proved to refine their logical defaults."
+  logInfo "The runtime inventory and theorem premises are frozen separately. These roots do not establish full compiler/AIR reflection or public certified claim semantics."
diff --git a/Ix/Aiur/Proofs/Blake3.lean b/Ix/Aiur/Proofs/Blake3.lean
new file mode 100644
index 000000000..7d7892a0f
--- /dev/null
+++ b/Ix/Aiur/Proofs/Blake3.lean
@@ -0,0 +1,402 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Blake3
+import Ix.Aiur.Proofs.Challenger
+import Ix.Aiur.Proofs.Transcript
+
+namespace Aiur.NativeAIR.Blake3
+
+theorem schedules_permute : ∀ index : Fin 7,
+    schedules[index].toList.Perm (List.finRange 16) := by decide
+
+theorem schedules_next : ∀ index : Fin 6,
+    schedules[index.val + 1] = Vector.ofFn (fun position : Fin 16 =>
+      schedules[index.val][schedules[1][position]]) := by decide
+
+theorem rotateRight_bits (word : UInt32) (count : UInt32)
+    (positive : 0 < count.toNat) (bounded : count.toNat < 32) :
+    (rotateRight word count).toBitVec = word.toBitVec.rotateRight count.toNat := by
+  simp [rotateRight, UInt32.toBitVec_shiftRight, UInt32.toBitVec_shiftLeft,
+    BitVec.rotateRight_def, Nat.mod_eq_of_lt bounded]
+  congr 2
+  omega
+
+theorem bytesWord_value (bytes : Vector UInt8 4) :
+    (bytesWord bytes).toNat = Challenger.littleEndian bytes.toList := by
+  have bound := Challenger.littleEndian_bound bytes.toList
+  simp only [Vector.length_toList] at bound
+  exact Nat.mod_eq_of_lt (by simpa using bound)
+
+theorem wordBytes_encoding (word : UInt32) : (wordBytes word).toList = KeyCodec.encodeNat 4 word.toNat := by
+  simp [wordBytes, Vector.toList_ofFn, List.ofFn_succ, KeyCodec.encodeNat, Nat.div_div_eq_div_mul]
+
+theorem bytesWord_wordBytes (word : UInt32) : bytesWord (wordBytes word) = word := by
+  apply UInt32.toNat_inj.mp
+  rw [bytesWord_value, wordBytes_encoding]
+  exact Challenger.littleEndian_encode 4 word.toNat (by exact word.toNat_lt)
+
+theorem bytesWord_pack (a b c d : UInt8) : (bytesWord #v[a, b, c, d]).toNat =
+    a.toNat + 256 * (b.toNat + 256 * (c.toNat + 256 * d.toNat)) := by
+  rw [bytesWord_value]
+  simp [Challenger.littleEndian]
+
+theorem wordBytes_pack (a b c d : UInt8) : wordBytes (bytesWord #v[a, b, c, d]) = #v[a, b, c, d] := by
+  have ha := a.toNat_lt
+  have hb := b.toNat_lt
+  have hc := c.toNat_lt
+  have hd := d.toNat_lt
+  apply Vector.ext
+  intro index bounded
+  have cases : index = 0 ∨ index = 1 ∨ index = 2 ∨ index = 3 := by omega
+  rcases cases with rfl | rfl | rfl | rfl <;>
+    apply UInt8.toNat_inj.mp <;> simp [wordBytes, bytesWord_pack] <;> omega
+
+theorem wordBytes_bytesWord (bytes : Vector UInt8 4) : wordBytes (bytesWord bytes) = bytes := by
+  have value : bytes = #v[bytes[0], bytes[1], bytes[2], bytes[3]] := by
+    apply Vector.ext
+    intro index bounded
+    have cases : index = 0 ∨ index = 1 ∨ index = 2 ∨ index = 3 := by omega
+    rcases cases with rfl | rfl | rfl | rfl <;> rfl
+  conv => lhs; rw [value]
+  rw [wordBytes_pack, ← value]
+
+theorem bytesWord_injective {first second : Vector UInt8 4} (equal : bytesWord first = bytesWord second) :
+    first = second := by rw [← wordBytes_bytesWord first, equal, wordBytes_bytesWord]
+
+theorem blockWords_byte (input : List UInt8) (word : Fin 16) (byte : Fin 4) :
+    ((Vector.ofFn fun byte : Fin 4 => input.toArray[word.val * 4 + byte.val]?.getD 0) : Vector UInt8 4)[byte]
+      = input[word.val * 4 + byte.val]?.getD 0 := by simp
+
+theorem blockWords_value (input : List UInt8) (word : Fin 16) :
+    (blockWords input)[word].toNat =
+      Challenger.littleEndian (List.ofFn fun byte : Fin 4 => input[word.val * 4 + byte.val]?.getD 0) := by
+  simpa [blockWords, Vector.toList_ofFn] using bytesWord_value
+    (Vector.ofFn fun byte : Fin 4 => input.toArray[word.val * 4 + byte.val]?.getD 0)
+
+theorem cvBytes_value (cv : CV) (index : Fin 32) :
+    (cvBytes cv)[index] = (cv[index.val / 4].toNat / 256^(index.val % 4)).toUInt8 := by
+  simp [cvBytes, wordBytes]
+
+theorem g_unchanged (state : Block) (a b c d index : Fin 16) (x y : UInt32)
+    (ha : a ≠ index) (hb : b ≠ index) (hc : c ≠ index) (hd : d ≠ index) :
+    (g state a b c d x y)[index] = state[index] := by
+  simp [g, Fin.getElem_fin, Fin.val_inj, ha, hb, hc, hd]
+
+theorem g_values (state : Block) (a b c d : Fin 16) (x y : UInt32)
+    (ab : a ≠ b) (ac : a ≠ c) (ad : a ≠ d) (bc : b ≠ c) (bd : b ≠ d) (cd : c ≠ d) :
+    let words := mix state[a] state[b] state[c] state[d] x y
+    (g state a b c d x y)[a] = words[0] ∧ (g state a b c d x y)[b] = words[1] ∧
+    (g state a b c d x y)[c] = words[2] ∧ (g state a b c d x y)[d] = words[3] := by
+  simp [g, Fin.getElem_fin, Fin.val_inj,
+    Ne.symm ab, Ne.symm ac, Ne.symm ad, Ne.symm bc, Ne.symm bd, Ne.symm cd]
+
+theorem initialWords_counter (cv : CV) (counter : UInt64) (blockLen flags : UInt32) :
+    (initialWords cv counter blockLen flags)[12].toNat +
+      2^32 * (initialWords cv counter blockLen flags)[13].toNat = counter.toNat := by
+  have bounded := counter.toNat_lt
+  simp [initialWords, Nat.shiftRight_eq_div_pow]
+  omega
+
+theorem parentOutput_values (left right : CV) :
+    (parentOutput left right).cv = iv ∧ (parentOutput left right).block = left ++ right ∧
+    (parentOutput left right).blockLen = 64 ∧ (parentOutput left right).counter = 0 ∧
+    (parentOutput left right).flags = 4 := ⟨rfl, rfl, rfl, rfl, rfl⟩
+
+theorem leftLen_bounds {size : Nat} (large : 1024 < size) :
+    leftLen size < size ∧ size ≤ 2 * leftLen size := by
+  have upper := Nat.lt_log2_self (n := size - 1)
+  rw [Nat.pow_succ] at upper
+  exact ⟨leftLen_lt large, by unfold leftLen; omega⟩
+
+theorem leftLen_chunks {size : Nat} (large : 1024 < size) :
+    ∃ exponent, leftLen size = 1024 * 2^exponent := by
+  have exponent : 10 ≤ (size - 1).log2 := (Nat.le_log2 (by omega)).mpr (by omega)
+  refine ⟨(size - 1).log2 - 10, ?_⟩
+  unfold leftLen
+  conv => lhs; rw [show (size - 1).log2 = 10 + ((size - 1).log2 - 10) by omega]
+  rw [Nat.pow_add]
+
+theorem leftLen_chunk_multiple {size : Nat} (large : 1024 < size) :
+    leftLen size / 1024 * 1024 = leftLen size := by
+  obtain ⟨exponent, value⟩ := leftLen_chunks large
+  rw [value]
+  omega
+
+theorem leftLen_unique {left right exponent : Nat}
+    (power : left = 1024 * 2^exponent) (positive : 0 < right) (bounded : right ≤ left) :
+    leftLen (left + right) = left := by
+  have pow : left = 2^(10 + exponent) := by rw [Nat.pow_add]; exact power
+  have nonzero : left + right - 1 ≠ 0 := by
+    have := Nat.two_pow_pos (10 + exponent)
+    omega
+  have log : (left + right - 1).log2 = 10 + exponent :=
+    (Nat.log2_eq_iff nonzero).mpr ⟨by omega, by rw [Nat.pow_succ, ← pow]; omega⟩
+  rw [leftLen, log, ← pow]
+
+theorem chunkLoop_small (counter : UInt64) (cv : CV) (start : Bool) (input : List UInt8)
+    (small : input.length ≤ 64) :
+    chunkLoop counter cv start input =
+      ⟨cv, blockWords input, input.length.toUInt32, counter, (if start then 1 else 0) ||| 2⟩ := by
+  rw [chunkLoop, dif_pos small]
+
+theorem chunkLoop_step (counter : UInt64) (cv : CV) (start : Bool) (input : List UInt8)
+    (large : 64 < input.length) :
+    chunkLoop counter cv start input =
+      chunkLoop counter (compress cv (blockWords (input.take 64)) counter 64 (if start then 1 else 0))
+        false (input.drop 64) := by
+  rw [chunkLoop, dif_neg (by omega)]
+
+theorem chunkLoop_counter (counter : UInt64) (cv : CV) (start : Bool) (input : List UInt8) :
+    (chunkLoop counter cv start input).counter = counter := by
+  rw [chunkLoop]
+  split
+  · rfl
+  · exact chunkLoop_counter _ _ _ _
+termination_by input.length
+decreasing_by simp only [List.length_drop]; omega
+
+theorem chunkOutput_counter (counter : UInt64) (input : List UInt8) :
+    (chunkOutput counter input).counter = counter := chunkLoop_counter _ _ _ _
+
+/-- Every non-final block has exactly 64 bytes. The final block may be full;
+only the empty input has an empty final block. -/
+inductive ChunkReads (counter : UInt64) : CV → Bool → List UInt8 → Output → Prop where
+  | last (cv : CV) (start : Bool) (input : List UInt8) (small : input.length ≤ 64) :
+      ChunkReads counter cv start input
+        ⟨cv, blockWords input, input.length.toUInt32, counter, (if start then 1 else 0) ||| 2⟩
+  | step (cv : CV) (start : Bool) (input : List UInt8) (output : Output)
+      (large : 64 < input.length)
+      (rest : ChunkReads counter
+        (compress cv (blockWords (input.take 64)) counter 64 (if start then 1 else 0))
+        false (input.drop 64) output) : ChunkReads counter cv start input output
+
+theorem chunkLoop_reads (counter : UInt64) (cv : CV) (start : Bool) (input : List UInt8) :
+    ChunkReads counter cv start input (chunkLoop counter cv start input) := by
+  by_cases small : input.length ≤ 64
+  · rw [chunkLoop_small _ _ _ _ small]
+    exact .last _ _ _ small
+  · rw [chunkLoop_step _ _ _ _ (by omega)]
+    exact .step _ _ _ _ (by omega) (chunkLoop_reads _ _ _ _)
+termination_by input.length
+decreasing_by simp only [List.length_drop]; omega
+
+theorem ChunkReads.complete {counter : UInt64} {cv : CV} {start : Bool} {input : List UInt8} {output : Output}
+    (reads : ChunkReads counter cv start input output) : chunkLoop counter cv start input = output := by
+  induction reads with
+  | last cv start input small => exact chunkLoop_small _ _ _ _ small
+  | step cv start input output large rest ih => rw [chunkLoop_step _ _ _ _ large, ih]
+
+theorem chunkLoop_iff (counter : UInt64) (cv : CV) (start : Bool) (input : List UInt8) (output : Output) :
+    chunkLoop counter cv start input = output ↔ ChunkReads counter cv start input output :=
+  ⟨fun equal => equal ▸ chunkLoop_reads _ _ _ _, ChunkReads.complete⟩
+
+theorem ChunkReads.framing {counter : UInt64} {cv : CV} {start : Bool} {input : List UInt8} {output : Output}
+    (reads : ChunkReads counter cv start input output) :
+    ∃ count, let remaining := input.drop (64 * count)
+      remaining.length ≤ 64 ∧ (input ≠ [] → 0 < remaining.length) ∧
+      output.block = blockWords remaining ∧ output.blockLen.toNat = remaining.length ∧
+      output.counter = counter ∧ output.flags = (if start && count == 0 then 1 else 0) ||| 2 := by
+  induction reads with
+  | last cv start input small =>
+    refine ⟨0, ?_⟩
+    simp only [Nat.mul_zero, List.drop_zero, Nat.reduceBEq, Bool.and_true]
+    refine ⟨small, ?_, by trivial, ?_, by trivial, by trivial⟩
+    · intro nonempty; exact List.length_pos_iff.mpr nonempty
+    · exact Nat.mod_eq_of_lt (by omega)
+  | step cv start input output large rest ih =>
+    obtain ⟨count, bound, positive, block, length, counterEq, flags⟩ := ih
+    refine ⟨count + 1, ?_⟩
+    simp only [List.drop_drop] at bound positive block length
+    have advance : 64 * (count + 1) = 64 + 64 * count := by omega
+    rw [advance]
+    refine ⟨bound, fun _ => positive (by simp only [← List.length_pos_iff, List.length_drop]; omega),
+      block, length, counterEq, ?_⟩
+    simpa using flags
+
+theorem chunkOutput_framing (counter : UInt64) (input : List UInt8) (bounded : input.length ≤ 1024) :
+    ∃ count, count < 16 ∧
+      let remaining := input.drop (64 * count)
+      remaining.length ≤ 64 ∧ (input ≠ [] → 0 < remaining.length) ∧
+      (chunkOutput counter input).block = blockWords remaining ∧
+      (chunkOutput counter input).blockLen.toNat = remaining.length ∧
+      (chunkOutput counter input).counter = counter ∧
+      (chunkOutput counter input).flags = (if count = 0 then 3 else 2) := by
+  obtain ⟨count, bound, positive, block, length, counterEq, flags⟩ := (chunkLoop_reads counter iv true input).framing
+  have countBound : count < 16 := by
+    by_cases nonempty : input = []
+    · subst input
+      have : count = 0 := by
+        have flagEmpty : (chunkLoop counter iv true []).flags = 3 := by rw [chunkLoop_small _ _ _ _ (by decide)]; rfl
+        rw [flagEmpty] at flags
+        by_cases zero : count = 0
+        · exact zero
+        · simp [zero] at flags
+      omega
+    · have := positive nonempty
+      simp only [List.length_drop] at this
+      omega
+  refine ⟨count, countBound, bound, positive, block, length, counterEq, ?_⟩
+  change (chunkLoop counter iv true input).flags = _
+  rw [flags]
+  by_cases zero : count = 0 <;> simp [zero] <;> decide
+
+theorem subtree_small (counter : Nat) (input : List UInt8) (small : input.length ≤ 1024) :
+    subtree counter input = chunkOutput counter.toUInt64 input := by
+  rw [subtree, dif_pos small]
+
+theorem subtree_step (counter : Nat) (input : List UInt8) (large : 1024 < input.length) :
+    subtree counter input = parentOutput
+      (subtree counter (input.take (leftLen input.length))).chainingValue
+      (subtree (counter + leftLen input.length / 1024) (input.drop (leftLen input.length))).chainingValue := by
+  rw [subtree, dif_neg (by omega)]
+
+theorem subtree_root_counter (input : List UInt8) : (subtree 0 input).counter = 0 := by
+  by_cases small : input.length ≤ 1024
+  · rw [subtree_small _ _ small, chunkOutput_counter]; rfl
+  · rw [subtree_step _ _ (by omega)]; rfl
+
+/-- Canonical BLAKE3 trees, specified by full power-of-two left subtrees
+and nonempty right subtrees no larger than their siblings. -/
+inductive TreeHash : Nat → List UInt8 → Output → Prop where
+  | chunk (counter : Nat) (input : List UInt8) (output : Output) (small : input.length ≤ 1024)
+      (blocks : ChunkReads counter.toUInt64 iv true input output) : TreeHash counter input output
+  | parent (counter exponent : Nat) (left right : List UInt8) (leftOutput rightOutput : Output)
+      (full : left.length = 1024 * 2^exponent) (nonempty : 0 < right.length) (bounded : right.length ≤ left.length)
+      (leftHash : TreeHash counter left leftOutput)
+      (rightHash : TreeHash (counter + left.length / 1024) right rightOutput) :
+      TreeHash counter (left ++ right) (parentOutput leftOutput.chainingValue rightOutput.chainingValue)
+
+theorem subtree_tree (counter : Nat) (input : List UInt8) : TreeHash counter input (subtree counter input) := by
+  by_cases small : input.length ≤ 1024
+  · rw [subtree_small _ _ small]
+    exact .chunk _ _ _ small (chunkLoop_reads _ _ _ _)
+  · have large : 1024 < input.length := by omega
+    have splitBound := leftLen_bounds large
+    obtain ⟨exponent, full⟩ := leftLen_chunks large
+    have takeLength : (input.take (leftLen input.length)).length = leftLen input.length := by
+      simp only [List.length_take]; omega
+    have result := TreeHash.parent counter exponent (input.take (leftLen input.length))
+      (input.drop (leftLen input.length)) _ _ (by rw [takeLength]; exact full)
+      (by simp only [List.length_drop]; omega)
+      (by simp only [List.length_drop, takeLength]; omega)
+      (subtree_tree _ _) (subtree_tree _ _)
+    rw [List.take_append_drop, takeLength] at result
+    rw [subtree_step _ _ large]
+    exact result
+termination_by input.length
+decreasing_by
+  · have := leftLen_lt (size := input.length) (by omega)
+    simp only [List.length_take]; omega
+  · have := leftLen_positive input.length
+    simp only [List.length_drop]; omega
+
+theorem TreeHash.complete {counter : Nat} {input : List UInt8} {output : Output}
+    (tree : TreeHash counter input output) : subtree counter input = output := by
+  induction tree with
+  | chunk counter input output small blocks => rw [subtree_small _ _ small]; exact blocks.complete
+  | parent counter exponent left right leftOutput rightOutput full nonempty bounded leftHash rightHash ihLeft ihRight =>
+    have positive := Nat.two_pow_pos exponent
+    have large : 1024 < (left ++ right).length := by simp only [List.length_append]; omega
+    have split := leftLen_unique full nonempty bounded
+    rw [subtree_step _ _ large, List.length_append, split,
+      List.take_left, List.drop_left, ihLeft, ihRight]
+
+theorem subtree_iff (counter : Nat) (input : List UInt8) (output : Output) :
+    subtree counter input = output ↔ TreeHash counter input output :=
+  ⟨fun equal => equal ▸ subtree_tree _ _, TreeHash.complete⟩
+
+theorem TreeHash.unique {counter : Nat} {input : List UInt8} {first second : Output}
+    (one : TreeHash counter input first) (two : TreeHash counter input second) : first = second :=
+  one.complete.symm.trans two.complete
+
+theorem native_counter {counter : Nat} {input : List UInt8}
+    (span : counter * 1024 + input.length < 2^64) :
+    counter < 2^54 ∧ counter.toUInt64.toNat = counter := by
+  constructor
+  · omega
+  · exact Nat.mod_eq_of_lt (by omega)
+
+theorem native_child_spans {counter : Nat} {input : List UInt8}
+    (span : counter * 1024 + input.length < 2^64) (large : 1024 < input.length) :
+    counter * 1024 + (input.take (leftLen input.length)).length < 2^64 ∧
+    (counter + leftLen input.length / 1024) * 1024 + (input.drop (leftLen input.length)).length < 2^64 := by
+  have splitBound := leftLen_lt large
+  have multiple := leftLen_chunk_multiple large
+  simp only [List.length_take, List.length_drop, Nat.add_mul]
+  omega
+
+/-- A particular leaf reached by the actual canonical subtree recursion. -/
+inductive ChunkAt : Nat → List UInt8 → Nat → List UInt8 → Prop where
+  | leaf (counter : Nat) (input : List UInt8) (small : input.length ≤ 1024) :
+      ChunkAt counter input counter input
+  | left {counter leaf : Nat} {input bytes : List UInt8} (large : 1024 < input.length)
+      (path : ChunkAt counter (input.take (leftLen input.length)) leaf bytes) :
+      ChunkAt counter input leaf bytes
+  | right {counter leaf : Nat} {input bytes : List UInt8} (large : 1024 < input.length)
+      (path : ChunkAt (counter + leftLen input.length / 1024) (input.drop (leftLen input.length)) leaf bytes) :
+      ChunkAt counter input leaf bytes
+
+theorem ChunkAt.native {counter leaf : Nat} {input bytes : List UInt8}
+    (path : ChunkAt counter input leaf bytes) (span : counter * 1024 + input.length < 2^64) :
+    bytes.length ≤ 1024 ∧ leaf < 2^54 ∧ leaf.toUInt64.toNat = leaf := by
+  induction path with
+  | leaf counter input small => exact ⟨small, native_counter span⟩
+  | left large path ih => exact ih (native_child_spans span large).1
+  | right large path ih => exact ih (native_child_spans span large).2
+
+theorem digest_native_counters {input bytes : List UInt8} (native : NativeInput input) {leaf : Nat}
+    (path : ChunkAt 0 input leaf bytes) : bytes.length ≤ 1024 ∧ leaf < 2^54 ∧ leaf.toUInt64.toNat = leaf :=
+  path.native (by simpa only [NativeInput, Nat.zero_mul, Nat.zero_add] using native)
+
+theorem digest_tree (input : List UInt8) :
+    ∃ output, TreeHash 0 input output ∧ output.counter = 0 ∧ digest input = output.rootHash :=
+  ⟨subtree 0 input, subtree_tree _ _, subtree_root_counter _, rfl⟩
+
+theorem replay_iff (fuel : Nat) (key : KeyCodec.Key) (proof : ProofCodec.Data)
+    (claims : List (List G)) (result : Transcript.Replay) :
+    replay fuel key proof claims = some result ↔ result.Reads hash fuel key proof claims :=
+  Transcript.replay_iff _ _ _ _ _ _
+
+theorem replay_unique {fuel more : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {first second : Transcript.Replay}
+    (one : replay fuel key proof claims = some first) (two : replay more key proof claims = some second) :
+    first = second := Transcript.replay_unique one two
+
+theorem verifyArithmetic_iff (fuel : Nat) (key : KeyCodec.Key) (proof : ProofCodec.Data)
+    (claims : List (List G)) (rows : List ProofShape.Row) (result : Transcript.Replay) :
+    verifyArithmetic fuel key proof claims rows = some result ↔
+      replay fuel key proof claims = some result ∧
+        VerifierArithmetic.verify result.challenges claims rows = some true :=
+  Transcript.verifyArithmetic_iff _ _ _ _ _ _ _
+
+theorem hash_bytes (input : List UInt8) : List.ofFn (hash input) = (digest input).toList := by
+  change List.ofFn (fun index : Fin 32 => (digest input)[index]) = _
+  exact Vector.toList_ofFn.symm.trans
+    (congrArg Vector.toList (Vector.ofFn_getElem (xs := digest input)))
+
+end Aiur.NativeAIR.Blake3
+
+namespace Aiur.BoundVerifier
+open NativeAIR
+
+/-- Concrete Blake3 supplies all transcript challenges and the continuing
+PCS state. Authentication and cryptographic soundness remain separate. -/
+theorem CompiledBackend.blake3_transcript_row {selection : Selection} (backend : CompiledBackend selection)
+    {bytes : ByteArray} (checked : CheckedProof backend.keyData bytes)
+    {fuel : Nat} {claims : List (List G)} {result : Transcript.Replay}
+    (accepted : Blake3.verifyArithmetic fuel backend.keyData checked.data claims checked.rows = some result)
+    {position : Nat} {row : ProofShape.Row} (present : checked.rows[position]? = some row) :
+    result.Reads Blake3.hash fuel backend.keyData checked.data claims ∧
+      row.Sourced backend.keyData checked.data row.circuitIndex position ∧ row.Fits backend.keyData.parameters ∧
+      ∃ initial before evaluation,
+        VerifierArithmetic.initialAccumulator result.challenges claims = some initial ∧
+        (initial :: checked.rows.map (·.accumulator))[position]? = some before ∧
+        VerifierArithmetic.evaluate result.challenges row before = some evaluation ∧
+        Quotient.composition result.challenges.alpha evaluation.constraints =
+          Domain.vanishing evaluation.domain result.challenges.zeta * evaluation.quotientValue :=
+  backend.transcript_row checked accepted present
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/BlockAllocation.lean b/Ix/Aiur/Proofs/BlockAllocation.lean
new file mode 100644
index 000000000..1dfea2364
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockAllocation.lean
@@ -0,0 +1,204 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockDegrees
+import Ix.Aiur.Proofs.EmissionAllocation
+import Ix.Aiur.Proofs.CompilerBranches
+
+/-! Recursive block emission has the logical degree map and physical column
+cursor calculated by the actual compiler layout pass. -/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter Aiur.Bytecode Concrete.Bytecode
+
+theorem branchRows_layout {selectors : Array Expr} {context : Context} {matched : RowExpr}
+    {rows : Array RowExpr} {column lookup : Nat} {branches : Array (G × Block)}
+    {fallback : Option Block} {emission : Emission} (index : Nat) (initial : LayoutMState) (base : Nat)
+    (aligned : rowDegrees rows = initial.degrees) (cursor : column = base + initial.functionLayout.auxiliaries)
+    (emitted : branchRows selectors context matched rows column lookup branches fallback = some emission)
+    (caseSound : ∀ pair ∈ branches.toList, ∀ entry result state,
+      rowDegrees rows = state.degrees → column = base + state.functionLayout.auxiliaries →
+      emitBlock selectors context entry rows column lookup pair.2 = some result →
+      result.column = base + ((blockLayout pair.2).run state).2.functionLayout.auxiliaries)
+    (defaultSound : ∀ block, fallback = some block → ∀ entry result state,
+      rowDegrees rows = state.degrees → column + branches.size = base + state.functionLayout.auxiliaries →
+      emitBlock selectors context entry rows (column + branches.size) lookup block = some result →
+      result.column = base + ((blockLayout block).run state).2.functionLayout.auxiliaries) :
+    ((ctrlLayout (.match index branches fallback)).run initial).2.degrees = rowDegrees emission.values ∧
+    emission.column = base + ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.auxiliaries := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i cases casesEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i defaults defaultsEmitted
+  cases emitted
+  have caseEffects : List.Forall₂ (fun pair result => ∀ state : LayoutMState,
+      state.degrees = initial.degrees → state.functionLayout.auxiliaries = initial.functionLayout.auxiliaries →
+      result.column = base + ((blockLayout pair.2).run state).2.functionLayout.auxiliaries)
+      branches.toList cases := by
+    apply AIR.mapM_forall₂ casesEmitted
+    intro pair member result resultEmitted
+    simp only [caseRow, bind, Option.bind] at resultEmitted
+    split at resultEmitted
+    · cases resultEmitted
+    rename_i entry entryRead
+    dsimp only at resultEmitted
+    split at resultEmitted
+    · cases resultEmitted
+    rename_i body bodyEmitted
+    cases resultEmitted
+    intro state degrees auxiliaries
+    exact caseSound pair member entry body state (aligned.trans degrees.symm)
+      (by rw [auxiliaries]; exact cursor) bodyEmitted
+  have defaultEffects : List.Forall₂ (fun block result => ∀ state : LayoutMState,
+      state.degrees = initial.degrees →
+      state.functionLayout.auxiliaries = initial.functionLayout.auxiliaries + branches.size →
+      result.column = base + ((blockLayout block).run state).2.functionLayout.auxiliaries)
+      fallback.toList defaults := by
+    cases present : fallback with
+    | none =>
+      simp only [defaultRow, present, Option.some.injEq] at defaultsEmitted
+      subst defaults
+      exact .nil
+    | some block =>
+      simp only [defaultRow, present, bind, Option.bind] at defaultsEmitted
+      split at defaultsEmitted
+      · cases defaultsEmitted
+      rename_i entry entryRead
+      dsimp only at defaultsEmitted
+      split at defaultsEmitted
+      · cases defaultsEmitted
+      rename_i body bodyEmitted
+      cases defaultsEmitted
+      refine .cons ?_ .nil
+      intro state degrees auxiliaries
+      exact defaultSound block present entry body state (aligned.trans degrees.symm)
+        (by rw [cursor, auxiliaries, Nat.add_assoc]) bodyEmitted
+  have layout := matchLayout_allocation index branches fallback initial base Emission.column caseEffects defaultEffects
+  rw [← cursor] at layout
+  exact ⟨layout.1.trans aligned.symm, layout.2.symm⟩
+
+private theorem case_allocation_smaller {branches : Array (G × Block)} {pair : G × Block}
+    (member : pair ∈ branches.toList) : sizeOf pair.2 < sizeOf branches := by
+  have bound := Array.sizeOf_lt_of_mem (Array.mem_toList_iff.mp member)
+  cases pair
+  simp at bound ⊢
+  omega
+
+private theorem default_allocation_smaller {fallback : Option Block} {block : Block}
+    (present : fallback = some block) : sizeOf block < sizeOf fallback := by
+  rw [present]
+  simp
+
+mutual
+
+theorem emitCtrl_layout {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {column lookup : Nat} (ctrl : Ctrl) {emission : Emission}
+    (initial : LayoutMState) (base : Nat) (valid : DegreeValid rows)
+    (aligned : rowDegrees rows = initial.degrees) (cursor : column = base + initial.functionLayout.auxiliaries)
+    (emitted : emitCtrl selectors context incoming rows column lookup ctrl = some emission) :
+    ((ctrlLayout ctrl).run initial).2.degrees = rowDegrees emission.values ∧
+    emission.column = base + ((ctrlLayout ctrl).run initial).2.functionLayout.auxiliaries := by
+  cases ctrl with
+  | «return» index indices | yield index indices =>
+    simp only [emitCtrl, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    rw [ctrlLayout.eq_def]
+    exact ⟨aligned.symm, cursor⟩
+  | «match» index branches fallback =>
+    rw [emitCtrl_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    apply branchRows_layout index initial base aligned cursor emitted
+    · intro pair member entry result state degrees column emitted
+      exact (emitBlock_layout pair.2 state base valid degrees column emitted).2
+    · intro block present entry result state degrees column emitted
+      exact (emitBlock_layout block state base valid degrees column emitted).2
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [emitCtrl_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i joined joinedEmitted
+    have joinedLayout := branchRows_layout index initial base aligned cursor joinedEmitted
+      (fun pair member entry result state degrees column emitted =>
+        (emitBlock_layout pair.2 state base valid degrees column emitted).2)
+      (fun block present entry result state degrees column emitted =>
+        (emitBlock_layout block state base valid degrees column emitted).2)
+    rw [branchRows_values joinedEmitted] at joinedLayout
+    simp only [continueRow] at emitted
+    split at emitted
+    · simp only [bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      rename_i continued continuedEmitted
+      cases emitted
+      let before := ((pushDegrees (.replicate size 1)).run
+        ((bumpAuxiliaries size).run ((ctrlLayout (.match index branches fallback)).run initial).2).2).2
+      have beforeDegrees : rowDegrees (rows ++ advice joined.column size) = before.degrees := by
+        change _ = ((ctrlLayout (.match index branches fallback)).run initial).2.degrees ++ .replicate size 1
+        rw [rowDegrees_append, advice_degrees, joinedLayout.1]
+      have beforeColumn : joined.column + size = base + before.functionLayout.auxiliaries := by
+        change _ = base + (((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.auxiliaries + size)
+        rw [joinedLayout.2, Nat.add_assoc]
+      have result := emitBlock_layout continuation before base (valid.append (advice_degreeValid _ _))
+        beforeDegrees beforeColumn continuedEmitted
+      rw [ctrlLayout_continue]
+      exact result
+    · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals subst ctrl
+  all_goals first
+    | (have bound := case_allocation_smaller ‹_ ∈ _›; simp; omega)
+    | (have bound := default_allocation_smaller ‹_ = some _›; simp; omega)
+    | decreasing_tactic
+
+theorem emitBlock_layout {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {column lookup : Nat} (block : Block) {emission : Emission}
+    (initial : LayoutMState) (base : Nat) (valid : DegreeValid rows)
+    (aligned : rowDegrees rows = initial.degrees) (cursor : column = base + initial.functionLayout.auxiliaries)
+    (emitted : emitBlock selectors context incoming rows column lookup block = some emission) :
+    ((blockLayout block).run initial).2.degrees = rowDegrees emission.values ∧
+    emission.column = base + ((blockLayout block).run initial).2.functionLayout.auxiliaries := by
+  simp only [emitBlock, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i operations operationsEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i control controlEmitted
+  cases emitted
+  have operationsLayout := emitOps_layout initial base valid aligned cursor operationsEmitted
+  have result := emitCtrl_layout block.ctrl ((block.ops.forM opLayout).run initial).2 base
+    (emitOps_degreeValid valid operationsEmitted) operationsLayout.1.symm operationsLayout.2 controlEmitted
+  rw [blockLayout]
+  exact result
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BlockCompletion.lean b/Ix/Aiur/Proofs/BlockCompletion.lean
new file mode 100644
index 000000000..17bb5bb60
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockCompletion.lean
@@ -0,0 +1,175 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.EmissionControls
+
+/-! Every checked block emits, with yields scoped to their own continuation. -/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter Bytecode
+
+def Emission.YieldShape (size : Option Nat) (emission : Emission) : Prop :=
+  ∀ part ∈ emission.yields, size = some part.values.size
+
+theorem Emission.YieldShape.prefix {emission : Emission} {size : Option Nat}
+    (valid : emission.YieldShape size) (equations : List Expr) :
+    (emission.prefix equations).YieldShape size := valid
+
+theorem join_yieldShape (rows : Array RowExpr) (column lookup : Nat) (emissions : List Emission)
+    {size : Option Nat} (valid : ∀ emission ∈ emissions, emission.YieldShape size) :
+    (join rows column lookup emissions).YieldShape size := by
+  intro part member
+  obtain ⟨emission, present, yielded⟩ := List.mem_flatMap.mp member
+  exact valid emission present part yielded
+
+private theorem list_mapM_defined_property {read : α → Option β} (inputs : List α) (property : β → Prop)
+    (defined : ∀ input ∈ inputs, ∃ output, read input = some output ∧ property output) :
+    ∃ outputs, inputs.mapM read = some outputs ∧ ∀ output ∈ outputs, property output := by
+  induction inputs with
+  | nil => exact ⟨[], rfl, by simp⟩
+  | cons input inputs ih =>
+    obtain ⟨output, head, valid⟩ := defined input List.mem_cons_self
+    obtain ⟨outputs, tail, rest⟩ := ih (fun value member => defined value (List.mem_cons_of_mem _ member))
+    exact ⟨output :: outputs,
+      by simp only [List.mapM_cons, head, tail, bind, Option.bind_some, pure],
+      by simpa only [List.forall_mem_cons] using And.intro valid rest⟩
+
+theorem branchRows_defined (selectors : Array Expr) (context : Context) (matched : RowExpr)
+    (rows : Array RowExpr) (column lookup : Nat) (branches : Array (G × Block))
+    (fallback : Option Block) (size : Option Nat)
+    (casesDefined : ∀ pair ∈ branches.toList, ∃ entry emission,
+      blockSelector selectors pair.2 = some entry ∧
+        emitBlock selectors context entry rows column lookup pair.2 = some emission ∧ emission.YieldShape size)
+    (defaultDefined : ∀ block, fallback = some block → ∃ entry emission,
+      blockSelector selectors block = some entry ∧
+        emitBlock selectors context entry rows (column + branches.size) lookup block = some emission ∧
+          emission.YieldShape size) :
+    ∃ emission, branchRows selectors context matched rows column lookup branches fallback = some emission ∧
+      emission.YieldShape size := by
+  obtain ⟨cases, casesEmitted, casesValid⟩ := list_mapM_defined_property branches.toList
+    (fun emission : Emission => emission.YieldShape size) (read := caseRow selectors context matched rows column lookup) (by
+      intro pair member
+      obtain ⟨entry, emission, selected, emitted, valid⟩ := casesDefined pair member
+      exact ⟨emission.prefix [caseEquation entry matched pair.1],
+        by simp only [caseRow, selected, emitted, bind, Option.bind_some, pure], valid.prefix _⟩)
+  have defaults : ∃ defaults,
+      defaultRow selectors context matched rows column lookup branches fallback = some defaults ∧
+        ∀ emission ∈ defaults, emission.YieldShape size := by
+    cases fallback with
+    | none => exact ⟨[], rfl, by simp⟩
+    | some block =>
+      obtain ⟨entry, emission, selected, emitted, valid⟩ := defaultDefined block rfl
+      exact ⟨[emission.prefix (defaultEquations entry matched column branches)],
+        by simp only [defaultRow, selected, emitted, bind, Option.bind_some, pure],
+        by simpa only [List.forall_mem_singleton] using valid.prefix (defaultEquations entry matched column branches)⟩
+  obtain ⟨defaults, defaultsEmitted, defaultsValid⟩ := defaults
+  refine ⟨join rows column lookup (cases ++ defaults), ?_, ?_⟩
+  · simp only [branchRows, casesEmitted, defaultsEmitted, bind, Option.bind_some, pure]
+  · exact join_yieldShape rows column lookup _ (by simpa only [List.forall_mem_append] using And.intro casesValid defaultsValid)
+
+mutual
+
+theorem emitCtrl_defined (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (column lookup : Nat) (ctrl : Ctrl) {size : Option Nat}
+    (valid : DegreeValid rows) (inputs : context.inputSize ≤ rows.size)
+    (checked : ctrl.emissionChecks rows.size selectors.size size = true) :
+    ∃ emission, emitCtrl selectors context incoming rows column lookup ctrl = some emission ∧ emission.YieldShape size := by
+  cases ctrl with
+  | «return» index outputs =>
+    obtain ⟨_, outputChecks⟩ : index < selectors.size ∧ indicesInScope rows.size outputs = true := by
+      simpa only [Ctrl.emissionChecks, Bool.and_eq_true, decide_eq_true_eq] using checked
+    have inputChecks : indicesInScope rows.size (Array.range context.inputSize) = true := by
+      rw [indicesInScope_spec]
+      intro index member
+      exact Nat.lt_of_lt_of_le (by simpa using member) inputs
+    obtain ⟨inputValues, inputsRead⟩ := select_defined inputChecks
+    obtain ⟨outputValues, outputsRead⟩ := select_defined outputChecks
+    refine ⟨returned context incoming rows inputValues outputValues column lookup, ?_, ?_⟩
+    · rw [emitCtrl.eq_def]
+      simp only [inputsRead, outputsRead, bind, Option.bind_some, pure]
+    · simp [Emission.YieldShape, returned]
+  | yield index outputs =>
+    obtain ⟨bound, outputChecks, width⟩ : index < selectors.size ∧
+        indicesInScope rows.size outputs = true ∧ size = some outputs.size := by
+      simpa only [Ctrl.emissionChecks, Bool.and_eq_true, decide_eq_true_eq, beq_iff_eq] using checked
+    obtain ⟨outputValues, outputsRead⟩ := select_defined outputChecks
+    refine ⟨yielded selectors[index] rows outputValues column lookup, ?_, ?_⟩
+    · rw [emitCtrl.eq_def]
+      simp only [getElem?_pos selectors index bound, outputsRead, bind, Option.bind_some, pure]
+    · simpa only [Emission.YieldShape, yielded, List.forall_mem_singleton, array_mapM_size outputsRead] using width
+  | «match» index branches fallback =>
+    obtain ⟨bound, casesValid, defaultValid⟩ := (emissionChecks_match _ _ _ _ _ _).mp checked
+    obtain ⟨emission, emitted, shape⟩ := branchRows_defined selectors context rows[index] rows column lookup branches fallback size
+      (by
+        intro pair member
+        obtain ⟨entry, selected⟩ := blockSelector_defined selectors pair.2 (casesValid pair member)
+        obtain ⟨emission, emitted, shape⟩ := emitBlock_defined selectors context entry rows column lookup pair.2
+          valid inputs (casesValid pair member)
+        exact ⟨entry, emission, selected, emitted, shape⟩)
+      (by
+        intro block present
+        obtain ⟨entry, selected⟩ := blockSelector_defined selectors block (defaultValid block present)
+        obtain ⟨emission, emitted, shape⟩ := emitBlock_defined selectors context entry rows (column + branches.size) lookup block
+          valid inputs (defaultValid block present)
+        exact ⟨entry, emission, selected, emitted, shape⟩)
+    exact ⟨emission, by rw [emitCtrl_match, getElem?_pos rows index bound]; exact emitted, shape⟩
+  | matchContinue index branches fallback outputs aux lookups continuation =>
+    obtain ⟨bound, casesValid, defaultValid, next, added, continuationValid⟩ :=
+      (emissionChecks_matchContinue _ _ _ _ _ _ _ _ _ _).mp checked
+    obtain ⟨joined, joinedEmitted, shape⟩ := branchRows_defined selectors context rows[index] rows column lookup branches fallback (some outputs)
+      (by
+        intro pair member
+        obtain ⟨entry, selected⟩ := blockSelector_defined selectors pair.2 (casesValid pair member)
+        obtain ⟨emission, emitted, shape⟩ := emitBlock_defined selectors context entry rows column lookup pair.2
+          valid inputs (casesValid pair member)
+        exact ⟨entry, emission, selected, emitted, shape⟩)
+      (by
+        intro block present
+        obtain ⟨entry, selected⟩ := blockSelector_defined selectors block (defaultValid block present)
+        obtain ⟨emission, emitted, shape⟩ := emitBlock_defined selectors context entry rows (column + branches.size) lookup block
+          valid inputs (defaultValid block present)
+        exact ⟨entry, emission, selected, emitted, shape⟩)
+    have yieldsValid : joined.yields.all (fun part => part.values.size == outputs) = true := by
+      rw [List.all_eq_true]
+      intro part member
+      exact beq_iff_eq.mpr (Option.some.inj (shape part member)).symm
+    have nextSize : (rows ++ advice joined.column outputs).size = next := by
+      simp only [Array.size_append, advice, Array.size_ofFn, (addScope_eq added).1]
+    have continuationChecks : continuation.emissionChecks (rows ++ advice joined.column outputs).size selectors.size size = true :=
+      nextSize ▸ continuationValid
+    obtain ⟨entry, selected⟩ := blockSelector_defined selectors continuation continuationChecks
+    obtain ⟨continued, continuedEmitted, continuedShape⟩ := emitBlock_defined selectors context (yieldGate joined.yields)
+      (rows ++ advice joined.column outputs) (joined.column + outputs) joined.lookup continuation
+      (valid.append (advice_degreeValid _ _)) (by simp only [Array.size_append]; omega) continuationChecks
+    refine ⟨joined.continued (mergeEquations incoming joined.column outputs joined.yields ++ [entry.frontSub (yieldGate joined.yields)]) continued, ?_, continuedShape⟩
+    rw [emitCtrl_matchContinue, getElem?_pos rows index bound]
+    simp only [joinedEmitted, continueRow, yieldsValid, if_true, selected, continuedEmitted,
+      bind, Option.bind_some, pure]
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (show pair ∈ branches from by simpa using member); grind)
+
+theorem emitBlock_defined (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (column lookup : Nat) (block : Block) {size : Option Nat}
+    (valid : DegreeValid rows) (inputs : context.inputSize ≤ rows.size)
+    (checked : block.emissionChecks rows.size selectors.size size = true) :
+    ∃ emission, emitBlock selectors context incoming rows column lookup block = some emission ∧ emission.YieldShape size := by
+  obtain ⟨next, checkedOps, checkedCtrl⟩ := Block.emissionChecks_parts checked
+  obtain ⟨entry, selected⟩ := blockSelector_defined selectors block checked
+  obtain ⟨operations, operationsEmitted, valuesSize⟩ := emitOps_defined incoming context.rank block.ops.toList rows column valid checkedOps
+  obtain ⟨control, controlEmitted, shape⟩ := emitCtrl_defined selectors context incoming operations.values operations.column
+    (lookup + operations.queries.length) block.ctrl (emitOps_degreeValid valid operationsEmitted)
+    (by have mono := checkEmissionOps_le checkedOps; omega) (valuesSize ▸ checkedCtrl)
+  refine ⟨(control.afterOps incoming lookup operations).prefix [entry.frontMul ((Expr.konst 1).frontSub entry)], ?_, shape⟩
+  rw [emitBlock.eq_def]
+  simp only [selected, operationsEmitted, controlEmitted, bind, Option.bind_some, pure]
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BlockDegrees.lean b/Ix/Aiur/Proofs/BlockDegrees.lean
new file mode 100644
index 000000000..ed25fe732
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockDegrees.lean
@@ -0,0 +1,101 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationDegrees
+import Ix.Aiur.Proofs.BlockExpressions
+
+/-! The degree-zero constant invariant survives branches and continuations. -/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter
+
+theorem branchRows_values {selectors : Array Expr} {context : Context} {matched : RowExpr}
+    {rows : Array RowExpr} {column lookup : Nat} {branches : Array (G × Bytecode.Block)}
+    {fallback : Option Bytecode.Block} {emission : Emission}
+    (emitted : branchRows selectors context matched rows column lookup branches fallback = some emission) :
+    emission.values = rows := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  cases emitted
+  rfl
+
+mutual
+
+theorem emitCtrl_degreeValid {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {column lookup : Nat} (ctrl : Bytecode.Ctrl) {emission : Emission}
+    (valid : DegreeValid rows)
+    (emitted : emitCtrl selectors context incoming rows column lookup ctrl = some emission) :
+    DegreeValid emission.values := by
+  cases ctrl with
+  | «return» index indices | yield index indices =>
+    simp only [emitCtrl, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact valid
+  | «match» index branches fallback =>
+    rw [emitCtrl_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    rw [branchRows_values emitted]
+    exact valid
+  | matchContinue index branches fallback size aux lookups continuation =>
+    rw [emitCtrl_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    simp only [continueRow] at emitted
+    split at emitted
+    · simp only [bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      rename_i continued continuedEmitted
+      cases emitted
+      change DegreeValid continued.values
+      exact emitBlock_degreeValid continuation (valid.append (advice_degreeValid _ _)) continuedEmitted
+    · cases emitted
+termination_by sizeOf ctrl
+decreasing_by all_goals decreasing_tactic
+
+theorem emitBlock_degreeValid {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {column lookup : Nat} (block : Bytecode.Block) {emission : Emission}
+    (valid : DegreeValid rows)
+    (emitted : emitBlock selectors context incoming rows column lookup block = some emission) :
+    DegreeValid emission.values := by
+  simp only [emitBlock, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i operations operationsEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i control controlEmitted
+  cases emitted
+  change DegreeValid control.values
+  exact emitCtrl_degreeValid block.ctrl (emitOps_degreeValid valid operationsEmitted) controlEmitted
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BlockExpressions.lean b/Ix/Aiur/Proofs/BlockExpressions.lean
new file mode 100644
index 000000000..cc08fb25f
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockExpressions.lean
@@ -0,0 +1,734 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockSelectors
+
+/-!
+Symbolic block emission retains returns, escaping yields, and gated call
+records alongside the native expressions. Branch joins restore the incoming
+logical map; continuations consume their local yields and append merge columns.
+-/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter LookupEmitter
+
+theorem list_mapM_flatMap {α β γ δ : Type} {read : α → Option β}
+    {inputs : List α} {outputs : List β} (evaluated : inputs.mapM read = some outputs)
+    (first : α → List γ) (second : β → List δ) (evaluate : γ → Option δ)
+    (related : ∀ input output, read input = some output →
+      (first input).mapM evaluate = some (second output)) :
+    (inputs.flatMap first).mapM evaluate = some (outputs.flatMap second) := by
+  induction inputs generalizing outputs with
+  | nil =>
+    cases evaluated
+    rfl
+  | cons input rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i output outputEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i tail tailEval
+    cases evaluated
+    simp only [List.flatMap_cons, List.mapM_append, related input output outputEval,
+      ih tailEval, bind, Option.bind_some, pure]
+
+theorem list_mapM_foldl {α β γ : Type} {read : α → Option β}
+    {inputs : List α} {outputs : List β} (evaluated : inputs.mapM read = some outputs)
+    (first : γ → α → γ) (second : γ → β → γ)
+    (related : ∀ input output, read input = some output → ∀ start, first start input = second start output)
+    (start : γ) : inputs.foldl first start = outputs.foldl second start := by
+  induction inputs generalizing outputs start with
+  | nil =>
+    cases evaluated
+    rfl
+  | cons input rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i output outputEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i tail tailEval
+    cases evaluated
+    simp only [List.foldl_cons, related input output outputEval, ih tailEval]
+
+structure Context where
+  function : Nat
+  inputSize : Nat
+  rank : Expr
+
+structure ReturnExpr where
+  selector : Expr
+  function : Nat
+  inputs : Array Expr
+  outputs : Array Expr
+  rank : Expr
+
+def ReturnExpr.eval (values : Values G) (returned : ReturnExpr) : Option (G × Bytecode.AIR.Call) := do
+  let selector ← evalExpr values returned.selector
+  let inputs ← returned.inputs.mapM (evalExpr values)
+  let outputs ← returned.outputs.mapM (evalExpr values)
+  let rank ← evalExpr values returned.rank
+  return (selector, ⟨returned.function, inputs, outputs, rank⟩)
+
+def ReturnExpr.message (returned : ReturnExpr) : List Expr :=
+  [.konst 0, .konst (G.ofNat returned.function)] ++ returned.inputs.toList ++
+    returned.outputs.toList ++ [returned.rank]
+
+structure YieldExpr where
+  selector : Expr
+  values : Array RowExpr
+
+def YieldExpr.eval (values : Values G) (yielded : YieldExpr) : Option (G × Array AIR.RowValue) := do
+  let selector ← evalExpr values yielded.selector
+  let outputs ← evalRows values yielded.values
+  return (selector, outputs)
+
+def evalGatedCall (values : Values G) (called : Expr × CallExpr) :
+    Option (G × (Bytecode.AIR.Call × (Fin 6 → G))) := do
+  let selector ← evalExpr values called.1
+  let call ← called.2.eval values
+  return (selector, call)
+
+structure Emission where
+  values : Array RowExpr
+  column : Nat
+  lookup : Nat
+  equations : List Expr := []
+  queries : List QueryExpr := []
+  returns : List ReturnExpr := []
+  yields : List YieldExpr := []
+  calls : List (Expr × CallExpr) := []
+
+def Emission.eval (values : Values G) (emission : Emission) : Option AIR.BlockEmission := do
+  let outputs ← evalRows values emission.values
+  let equations ← emission.equations.mapM (evalExpr values)
+  let queries ← emission.queries.mapM (QueryExpr.eval values)
+  let returns ← emission.returns.mapM (ReturnExpr.eval values)
+  let yields ← emission.yields.mapM (YieldExpr.eval values)
+  let calls ← emission.calls.mapM (evalGatedCall values)
+  return ⟨outputs, emission.column, emission.lookup, equations, queries, returns, yields, calls⟩
+
+theorem Emission.eval_of {values : Values G} {emission : Emission} {result : AIR.BlockEmission}
+    (outputs : evalRows values emission.values = some result.values)
+    (column : emission.column = result.column) (lookup : emission.lookup = result.lookup)
+    (equations : emission.equations.mapM (evalExpr values) = some result.equations)
+    (queries : emission.queries.mapM (QueryExpr.eval values) = some result.queries)
+    (returns : emission.returns.mapM (ReturnExpr.eval values) = some result.returns)
+    (yields : emission.yields.mapM (YieldExpr.eval values) = some result.yields)
+    (calls : emission.calls.mapM (evalGatedCall values) = some result.calls) :
+    emission.eval values = some result := by
+  simp only [Emission.eval, outputs, equations, queries, returns, yields, calls,
+    column, lookup, bind, Option.bind_some, pure]
+
+theorem Emission.eval_components {values : Values G} {emission : Emission} {result : AIR.BlockEmission}
+    (evaluated : emission.eval values = some result) :
+    evalRows values emission.values = some result.values ∧
+    emission.column = result.column ∧ emission.lookup = result.lookup ∧
+    emission.equations.mapM (evalExpr values) = some result.equations ∧
+    emission.queries.mapM (QueryExpr.eval values) = some result.queries ∧
+    emission.returns.mapM (ReturnExpr.eval values) = some result.returns ∧
+    emission.yields.mapM (YieldExpr.eval values) = some result.yields ∧
+    emission.calls.mapM (evalGatedCall values) = some result.calls := by
+  simp only [Emission.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i outputs outputsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i equations equationsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i queries queriesEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i returns returnsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i yields yieldsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i calls callsEval
+  cases evaluated
+  exact ⟨outputsEval, rfl, rfl, equationsEval, queriesEval, returnsEval, yieldsEval, callsEval⟩
+
+def Emission.prefix (equations : List Expr) (emission : Emission) : Emission :=
+  { emission with equations := equations ++ emission.equations }
+
+theorem Emission.prefix_eval {values : Values G} {emission : Emission} {result : AIR.BlockEmission}
+    {equations : List Expr} {results : List G} (evaluated : emission.eval values = some result)
+    (equationsEval : equations.mapM (evalExpr values) = some results) :
+    (emission.prefix equations).eval values = some (result.prefix results) := by
+  obtain ⟨outputs, column, lookup, oldEquations, queries, returns, yields, calls⟩ :=
+    Emission.eval_components evaluated
+  apply Emission.eval_of
+  · exact outputs
+  · exact column
+  · exact lookup
+  · simp only [Emission.prefix, List.mapM_append, equationsEval, oldEquations,
+      bind, Option.bind_some, pure, AIR.BlockEmission.prefix]
+  · exact queries
+  · exact returns
+  · exact yields
+  · exact calls
+
+def Emission.afterOps (incoming : Expr) (lookup : Nat) (ops : OpsEmission) (control : Emission) : Emission :=
+  { control with
+    equations := ops.equations ++ control.equations
+    queries := LookupEmitter.queryParts lookup incoming ops.queries ++ control.queries
+    calls := ops.calls.map (incoming, ·) ++ control.calls }
+
+theorem Emission.afterOps_eval {values : Values G} {incoming : Expr} {s : G} (lookup : Nat)
+    {ops : OpsEmission} {operations : AIR.OpsEmission} {control : Emission} {result : AIR.BlockEmission}
+    (incomingEval : evalExpr values incoming = some s)
+    (opsEval : ops.eval values = some operations) (controlEval : control.eval values = some result) :
+    (control.afterOps incoming lookup ops).eval values = some (result.afterOps s lookup operations) := by
+  obtain ⟨_, _, opEquations, opQueries, opCalls⟩ := OpsEmission.eval_components opsEval
+  obtain ⟨outputs, column, lookupEq, equations, queries, returns, yields, calls⟩ :=
+    Emission.eval_components controlEval
+  have gatedCalls : (ops.calls.map (incoming, ·)).mapM (evalGatedCall values) =
+      some (operations.calls.map (s, ·)) := by
+    apply list_mapM_transform opCalls (incoming, ·) (s, ·) (evalGatedCall values)
+    intro call result reflected
+    simp only [evalGatedCall, incomingEval, reflected, bind, Option.bind_some, pure]
+  apply Emission.eval_of
+  · exact outputs
+  · exact column
+  · exact lookupEq
+  · simp only [Emission.afterOps, List.mapM_append, opEquations, equations,
+      bind, Option.bind_some, pure, AIR.BlockEmission.afterOps]
+  · simp only [Emission.afterOps, List.mapM_append, LookupEmitter.queryParts_eval incomingEval opQueries,
+      queries, bind, Option.bind_some, pure, AIR.BlockEmission.afterOps]
+  · exact returns
+  · exact yields
+  · simp only [Emission.afterOps, List.mapM_append, gatedCalls, calls,
+      bind, Option.bind_some, pure, AIR.BlockEmission.afterOps]
+
+def join (values : Array RowExpr) (column lookup : Nat) (emissions : List Emission) : Emission :=
+  { values
+    column := emissions.foldl (fun column emission => max column emission.column) column
+    lookup := emissions.foldl (fun lookup emission => max lookup emission.lookup) lookup
+    equations := emissions.flatMap (·.equations)
+    queries := emissions.flatMap (·.queries)
+    returns := emissions.flatMap (·.returns)
+    yields := emissions.flatMap (·.yields)
+    calls := emissions.flatMap (·.calls) }
+
+theorem join_eval {values : Values G} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    (inputEval : evalRows values rows = some inputs) (column lookup : Nat)
+    {emissions : List Emission} {results : List AIR.BlockEmission}
+    (evaluated : emissions.mapM (Emission.eval values) = some results) :
+    (join rows column lookup emissions).eval values = some (AIR.joinBlockEmissions inputs column lookup results) := by
+  apply Emission.eval_of
+  · exact inputEval
+  · apply list_mapM_foldl evaluated
+    intro emission result reflected start
+    rw [(Emission.eval_components reflected).2.1]
+  · apply list_mapM_foldl evaluated
+    intro emission result reflected start
+    rw [(Emission.eval_components reflected).2.2.1]
+  · exact list_mapM_flatMap evaluated Emission.equations AIR.BlockEmission.equations
+      (evalExpr values) (fun _ _ reflected => (Emission.eval_components reflected).2.2.2.1)
+  · exact list_mapM_flatMap evaluated Emission.queries AIR.BlockEmission.queries
+      (QueryExpr.eval values) (fun _ _ reflected => (Emission.eval_components reflected).2.2.2.2.1)
+  · exact list_mapM_flatMap evaluated Emission.returns AIR.BlockEmission.returns
+      (ReturnExpr.eval values) (fun _ _ reflected => (Emission.eval_components reflected).2.2.2.2.2.1)
+  · exact list_mapM_flatMap evaluated Emission.yields AIR.BlockEmission.yields
+      (YieldExpr.eval values) (fun _ _ reflected => (Emission.eval_components reflected).2.2.2.2.2.2.1)
+  · exact list_mapM_flatMap evaluated Emission.calls AIR.BlockEmission.calls
+      (evalGatedCall values) (fun _ _ reflected => (Emission.eval_components reflected).2.2.2.2.2.2.2)
+
+def Emission.continued (branches : Emission) (equations : List Expr) (continuation : Emission) : Emission :=
+  { continuation with
+    equations := branches.equations ++ equations ++ continuation.equations
+    queries := branches.queries ++ continuation.queries
+    returns := branches.returns ++ continuation.returns
+    calls := branches.calls ++ continuation.calls }
+
+theorem Emission.continued_eval {values : Values G}
+    {branches continuation : Emission} {first last : AIR.BlockEmission}
+    {equations : List Expr} {results : List G}
+    (branchesEval : branches.eval values = some first)
+    (continuationEval : continuation.eval values = some last)
+    (equationsEval : equations.mapM (evalExpr values) = some results) :
+    (branches.continued equations continuation).eval values = some (first.continued results last) := by
+  obtain ⟨_, _, _, firstEquations, firstQueries, firstReturns, _, firstCalls⟩ :=
+    Emission.eval_components branchesEval
+  obtain ⟨outputs, column, lookup, lastEquations, lastQueries, lastReturns, yields, lastCalls⟩ :=
+    Emission.eval_components continuationEval
+  apply Emission.eval_of
+  · exact outputs
+  · exact column
+  · exact lookup
+  · simp only [Emission.continued, AIR.BlockEmission.continued, List.mapM_append,
+      firstEquations, equationsEval, lastEquations, bind, Option.bind_some, pure]
+  · simp only [Emission.continued, AIR.BlockEmission.continued, List.mapM_append,
+      firstQueries, lastQueries, bind, Option.bind_some, pure]
+  · simp only [Emission.continued, AIR.BlockEmission.continued, List.mapM_append,
+      firstReturns, lastReturns, bind, Option.bind_some, pure]
+  · exact yields
+  · simp only [Emission.continued, AIR.BlockEmission.continued, List.mapM_append,
+      firstCalls, lastCalls, bind, Option.bind_some, pure]
+
+theorem YieldExpr.eval_of {values : Values G} {yielded : YieldExpr} {s : G} {outputs : Array AIR.RowValue}
+    (selectorEval : evalExpr values yielded.selector = some s)
+    (outputsEval : evalRows values yielded.values = some outputs) :
+    yielded.eval values = some (s, outputs) := by
+  simp only [YieldExpr.eval, selectorEval, outputsEval, bind, Option.bind_some, pure]
+
+theorem YieldExpr.eval_components {values : Values G} {yielded : YieldExpr} {result : G × Array AIR.RowValue}
+    (evaluated : yielded.eval values = some result) :
+    evalExpr values yielded.selector = some result.1 ∧ evalRows values yielded.values = some result.2 := by
+  simp only [YieldExpr.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i selector selectorEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i outputs outputsEval
+  cases evaluated
+  exact ⟨selectorEval, outputsEval⟩
+
+theorem ReturnExpr.eval_of {values : Values G} {returned : ReturnExpr} {s r : G}
+    {inputs outputs : Array G} (selectorEval : evalExpr values returned.selector = some s)
+    (inputsEval : returned.inputs.mapM (evalExpr values) = some inputs)
+    (outputsEval : returned.outputs.mapM (evalExpr values) = some outputs)
+    (rankEval : evalExpr values returned.rank = some r) :
+    returned.eval values = some (s, ⟨returned.function, inputs, outputs, r⟩) := by
+  simp only [ReturnExpr.eval, selectorEval, inputsEval, outputsEval, rankEval, bind, Option.bind_some, pure]
+
+theorem ReturnExpr.eval_components {values : Values G} {returned : ReturnExpr} {result : G × Bytecode.AIR.Call}
+    (evaluated : returned.eval values = some result) :
+    returned.function = result.2.function ∧ evalExpr values returned.selector = some result.1 ∧
+    returned.inputs.mapM (evalExpr values) = some result.2.inputs ∧
+    returned.outputs.mapM (evalExpr values) = some result.2.outputs ∧
+    evalExpr values returned.rank = some result.2.rank := by
+  simp only [ReturnExpr.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i selector selectorEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i inputs inputsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i outputs outputsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i rank rankEval
+  cases evaluated
+  exact ⟨rfl, selectorEval, inputsEval, outputsEval, rankEval⟩
+
+theorem ReturnExpr.message_eval {values : Values G} {returned : ReturnExpr} {result : G × Bytecode.AIR.Call}
+    (evaluated : returned.eval values = some result) :
+    returned.message.mapM (evalExpr values) = some (AIR.functionMessage result.2) := by
+  obtain ⟨function, _, inputsEval, outputsEval, rankEval⟩ := ReturnExpr.eval_components evaluated
+  have inputs := congrArg (Functor.map Array.toList) inputsEval
+  have outputs := congrArg (Functor.map Array.toList) outputsEval
+  rw [Array.toList_mapM] at inputs outputs
+  simp only [Functor.map, Option.map_some] at inputs outputs
+  simp only [ReturnExpr.message, List.mapM_append, List.mapM_cons, List.mapM_nil,
+    inputs, outputs, rankEval,
+    show evalExpr values (.konst 0) = some 0 from rfl,
+    show evalExpr values (.konst (G.ofNat result.2.function)) = some (G.ofNat result.2.function) from rfl,
+    bind, Option.bind_some, pure, AIR.functionMessage, function,
+    List.cons_append, List.nil_append, List.append_assoc]
+
+def returned (context : Context) (incoming : Expr) (rows inputs outputs : Array RowExpr)
+    (column lookup : Nat) : Emission :=
+  { values := rows, column, lookup,
+    returns := [⟨incoming, context.function, rowExprs inputs, rowExprs outputs, context.rank⟩] }
+
+theorem returned_eval {values : Values G} {context : Context} {incoming : Expr} {s r : G}
+    {rows inputs outputs : Array RowExpr} {a b c : Array AIR.RowValue} (column lookup : Nat)
+    (incomingEval : evalExpr values incoming = some s) (rankEval : evalExpr values context.rank = some r)
+    (rowsEval : evalRows values rows = some a) (inputsEval : evalRows values inputs = some b)
+    (outputsEval : evalRows values outputs = some c) :
+    (returned context incoming rows inputs outputs column lookup).eval values =
+      some { values := a, column, lookup,
+             returns := [(s, ⟨context.function, AIR.rowValues b, AIR.rowValues c, r⟩)] } := by
+  have result := ReturnExpr.eval_of (returned :=
+    ⟨incoming, context.function, rowExprs inputs, rowExprs outputs, context.rank⟩)
+    incomingEval (evalRows_values inputsEval) (evalRows_values outputsEval) rankEval
+  apply Emission.eval_of rowsEval rfl rfl rfl rfl ?_ rfl rfl
+  simp only [returned, List.mapM_cons, List.mapM_nil, result, bind, Option.bind_some, pure]
+
+def yielded (selector : Expr) (rows outputs : Array RowExpr) (column lookup : Nat) : Emission :=
+  { values := rows, column, lookup, yields := [⟨selector, outputs⟩] }
+
+theorem yielded_eval {values : Values G} {selector : Expr} {s : G}
+    {rows outputs : Array RowExpr} {a b : Array AIR.RowValue} (column lookup : Nat)
+    (selectorEval : evalExpr values selector = some s)
+    (rowsEval : evalRows values rows = some a) (outputsEval : evalRows values outputs = some b) :
+    (yielded selector rows outputs column lookup).eval values =
+      some { values := a, column, lookup, yields := [(s, b)] } := by
+  have result := YieldExpr.eval_of (yielded := ⟨selector, outputs⟩) selectorEval outputsEval
+  apply Emission.eval_of rowsEval rfl rfl rfl rfl rfl ?_ rfl
+  simp only [yielded, List.mapM_cons, List.mapM_nil, result, bind, Option.bind_some, pure]
+
+theorem evalRows_getD_any {values : Values G} {rows : Array RowExpr} {results : Array AIR.RowValue}
+    (evaluated : evalRows values rows = some results) (index : Nat) :
+    (rows[index]?.getD (.konst 0)).Reflects values (results[index]?.getD (.konst 0)) := by
+  by_cases bound : index < rows.size
+  · exact evalRows_getD evaluated bound
+  · have size := array_mapM_size evaluated
+    have absent : rows[index]? = none := Array.getElem?_eq_none_iff.mpr (by omega)
+    have resultAbsent : results[index]? = none := Array.getElem?_eq_none_iff.mpr (by omega)
+    simp only [absent, resultAbsent, Option.getD_none]
+    exact RowExpr.konst_reflects _ _
+
+def yieldValue (yielded : YieldExpr) (index : Nat) : Expr :=
+  yielded.selector.frontMul (yielded.values[index]?.getD (.konst 0)).expr
+
+theorem yieldValue_eval {values : Values G} {yielded : YieldExpr} {result : G × Array AIR.RowValue}
+    (evaluated : yielded.eval values = some result) (index : Nat) :
+    evalExpr values (yieldValue yielded index) =
+      some (result.1 * (AIR.rowValues result.2)[index]?.getD 0) := by
+  obtain ⟨selectorEval, outputsEval⟩ := YieldExpr.eval_components evaluated
+  rw [rowValues_getD]
+  exact Expr.frontMul_eval goldilocksLaws values selectorEval (evalRows_getD_any outputsEval index).1
+
+def yieldGate (yields : List YieldExpr) : Expr := sum (yields.map (·.selector))
+
+theorem yieldGate_eval {values : Values G} {yields : List YieldExpr} {results : List (G × Array AIR.RowValue)}
+    (evaluated : yields.mapM (YieldExpr.eval values) = some results) :
+    evalExpr values (yieldGate yields) = some (AIR.selectorSum (results.map Prod.fst)) := by
+  apply sum_eval
+  exact list_mapM_transform evaluated YieldExpr.selector Prod.fst (evalExpr values)
+    (fun _ _ reflected => (YieldExpr.eval_components reflected).1)
+
+def mergeEquations (incoming : Expr) (column size : Nat) (yields : List YieldExpr) : List Expr :=
+  (List.range size).map fun index => incoming.frontMul
+    ((mainCurrent (column + index)).expr.frontSub (sum (yields.map (yieldValue · index))))
+
+theorem mergeEquations_eval {values : Values G} (row : Nat → G) {incoming : Expr} {s : G}
+    (column size : Nat) {yields : List YieldExpr} {results : List (G × Array AIR.RowValue)}
+    (incomingEval : evalExpr values incoming = some s)
+    (evaluated : yields.mapM (YieldExpr.eval values) = some results)
+    (reads : ∀ index < size, (values.columns .main .current)[column + index]? = some (row (column + index))) :
+    (mergeEquations incoming column size yields).mapM (evalExpr values) =
+      some (AIR.mergeEquations row s column size results) := by
+  apply list_mapM_of_map
+  intro index member
+  have sumValues := list_mapM_transform evaluated (yieldValue · index)
+    (fun result => result.1 * (AIR.rowValues result.2)[index]?.getD 0) (evalExpr values)
+    (fun _ _ reflected => yieldValue_eval reflected index)
+  have merged : evalExpr values (mainCurrent (column + index)).expr = some (row (column + index)) :=
+    reads index (List.mem_range.mp member)
+  exact Expr.frontMul_eval goldilocksLaws values incomingEval
+    (Expr.frontSub_eval goldilocksLaws values merged (sum_eval sumValues))
+
+theorem yields_size {values : Values G} {yields : List YieldExpr} {results : List (G × Array AIR.RowValue)}
+    (evaluated : yields.mapM (YieldExpr.eval values) = some results) (size : Nat) :
+    yields.all (fun part => part.values.size == size) = results.all (fun part => part.2.size == size) := by
+  have related := AIR.mapM_forall₂ evaluated (fun _ _ _ reflected =>
+    (array_mapM_size (YieldExpr.eval_components reflected).2).symm)
+  clear evaluated
+  induction related with
+  | nil => rfl
+  | cons head _ ih => simp only [List.all_cons, head, ih]
+
+def caseEquation (entry : Expr) (matched : RowExpr) (value : G) : Expr :=
+  entry.frontMul (matched.expr.frontSub (.konst value))
+
+theorem caseEquation_eval {values : Values G} {entry : Expr} {s : G} {matched : RowExpr} {value : AIR.RowValue}
+    (entryEval : evalExpr values entry = some s) (matchedRef : matched.Reflects values value) (branch : G) :
+    evalExpr values (caseEquation entry matched branch) = some (s * (value.value - branch)) :=
+  Expr.frontMul_eval goldilocksLaws values entryEval
+    (Expr.frontSub_eval goldilocksLaws values matchedRef.1 rfl)
+
+def defaultEquations (entry : Expr) (matched : RowExpr) (column : Nat)
+    (branches : Array (G × Bytecode.Block)) : List Expr :=
+  branches.toList.mapIdx fun index pair => entry.frontMul
+    (((matched.expr.frontSub (.konst pair.1)).frontMul (mainCurrent (column + index)).expr).frontSub (.konst 1))
+
+theorem defaultEquations_eval {values : Values G} (row : Nat → G)
+    {entry : Expr} {s : G} {matched : RowExpr} {value : AIR.RowValue}
+    (column : Nat) (branches : Array (G × Bytecode.Block))
+    (entryEval : evalExpr values entry = some s) (matchedRef : matched.Reflects values value)
+    (reads : ∀ index < branches.size,
+      (values.columns .main .current)[column + index]? = some (row (column + index))) :
+    (defaultEquations entry matched column branches).mapM (evalExpr values) =
+      some (branches.toList.mapIdx fun index pair => s * ((value.value - pair.1) * row (column + index) - 1)) := by
+  simp only [defaultEquations, List.mapIdx_eq_zipIdx_map]
+  apply list_mapM_of_map
+  intro pair member
+  have present := List.mk_mem_zipIdx_iff_getElem?.mp member
+  have bound : pair.2 < branches.size := by
+    have original := (List.getElem?_eq_some_iff.mp present).choose
+    simpa only [Array.length_toList] using original
+  have inverse : evalExpr values (mainCurrent (column + pair.2)).expr = some (row (column + pair.2)) :=
+    reads pair.2 bound
+  exact Expr.frontMul_eval goldilocksLaws values entryEval
+    (Expr.frontSub_eval goldilocksLaws values
+      (Expr.frontMul_eval goldilocksLaws values
+        (Expr.frontSub_eval goldilocksLaws values matchedRef.1 rfl) inverse) rfl)
+
+private theorem block_smaller (block : Bytecode.Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def emitCtrl (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (column lookup : Nat) : Bytecode.Ctrl → Option Emission
+  | .return _ indices => do
+    let inputs ← select rows (Array.range context.inputSize)
+    let outputs ← select rows indices
+    return returned context incoming rows inputs outputs column lookup
+  | .yield index indices => do
+    let selector ← selectors[index]?
+    let outputs ← select rows indices
+    return yielded selector rows outputs column lookup
+  | .match index branches fallback => do
+    let matched ← rows[index]?
+    let cases ← branches.attach.toList.mapM fun ⟨pair, _⟩ => do
+      let entry ← blockSelector selectors pair.2
+      let emission ← emitBlock selectors context entry rows column lookup pair.2
+      return emission.prefix [caseEquation entry matched pair.1]
+    let default : List Emission ← match fallback with
+      | none => some []
+      | some block => do
+        let entry ← blockSelector selectors block
+        let emission ← emitBlock selectors context entry rows (column + branches.size) lookup block
+        pure [emission.prefix (defaultEquations entry matched column branches)]
+    return join rows column lookup (cases ++ default)
+  | .matchContinue index branches fallback size _ _ continuation => do
+    let matched ← rows[index]?
+    let cases ← branches.attach.toList.mapM fun ⟨pair, _⟩ => do
+      let entry ← blockSelector selectors pair.2
+      let emission ← emitBlock selectors context entry rows column lookup pair.2
+      return emission.prefix [caseEquation entry matched pair.1]
+    let default : List Emission ← match fallback with
+      | none => some []
+      | some block => do
+        let entry ← blockSelector selectors block
+        let emission ← emitBlock selectors context entry rows (column + branches.size) lookup block
+        pure [emission.prefix (defaultEquations entry matched column branches)]
+    let joined := join rows column lookup (cases ++ default)
+    if joined.yields.all (fun part => part.values.size == size) then do
+      let gate := yieldGate joined.yields
+      let entry ← blockSelector selectors continuation
+      let equations := mergeEquations incoming joined.column size joined.yields ++ [entry.frontSub gate]
+      let continued ← emitBlock selectors context gate (rows ++ advice joined.column size)
+        (joined.column + size) joined.lookup continuation
+      return joined.continued equations continued
+    else none
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def emitBlock (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (column lookup : Nat) (block : Bytecode.Block) : Option Emission := do
+  let entry ← blockSelector selectors block
+  let operations ← OpEmitter.emitOps incoming context.rank block.ops.toList rows column
+  let control ← emitCtrl selectors context incoming operations.values operations.column
+    (lookup + operations.queries.length) block.ctrl
+  return (control.afterOps incoming lookup operations).prefix
+    [entry.frontMul ((Expr.konst 1).frontSub entry)]
+termination_by sizeOf block
+decreasing_by exact block_smaller block
+
+end
+
+theorem fold_max_start (measure : α → Nat) (items : List α) (start : Nat) :
+    start ≤ items.foldl (fun current item => max current (measure item)) start := by
+  induction items generalizing start with
+  | nil => exact Nat.le_refl _
+  | cons item items ih => exact Nat.le_trans (Nat.le_max_left _ _) (ih _)
+
+theorem fold_max_member (measure : α → Nat) {items : List α} {item : α}
+    (member : item ∈ items) (start : Nat) :
+    measure item ≤ items.foldl (fun current item => max current (measure item)) start := by
+  induction items generalizing start with
+  | nil => cases member
+  | cons head rest ih =>
+    rcases List.mem_cons.mp member with equal | tail
+    · subst item
+      exact Nat.le_trans (Nat.le_max_right _ _) (fold_max_start measure rest _)
+    · exact ih tail _
+
+def caseRow (selectors : Array Expr) (context : Context) (matched : RowExpr)
+    (rows : Array RowExpr) (column lookup : Nat) (pair : G × Bytecode.Block) : Option Emission := do
+  let entry ← blockSelector selectors pair.2
+  let emission ← emitBlock selectors context entry rows column lookup pair.2
+  return emission.prefix [caseEquation entry matched pair.1]
+
+def defaultRow (selectors : Array Expr) (context : Context) (matched : RowExpr)
+    (rows : Array RowExpr) (column lookup : Nat) (branches : Array (G × Bytecode.Block))
+    (fallback : Option Bytecode.Block) : Option (List Emission) :=
+  match fallback with
+  | none => some []
+  | some block => do
+    let entry ← blockSelector selectors block
+    let emission ← emitBlock selectors context entry rows (column + branches.size) lookup block
+    return [emission.prefix (defaultEquations entry matched column branches)]
+
+def branchRows (selectors : Array Expr) (context : Context) (matched : RowExpr)
+    (rows : Array RowExpr) (column lookup : Nat) (branches : Array (G × Bytecode.Block))
+    (fallback : Option Bytecode.Block) : Option Emission := do
+  let cases ← branches.toList.mapM (caseRow selectors context matched rows column lookup)
+  let default ← defaultRow selectors context matched rows column lookup branches fallback
+  return join rows column lookup (cases ++ default)
+
+def continueRow (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (size : Nat) (continuation : Bytecode.Block) (joined : Emission) : Option Emission :=
+  if joined.yields.all (fun part => part.values.size == size) then do
+    let gate := yieldGate joined.yields
+    let entry ← blockSelector selectors continuation
+    let equations := mergeEquations incoming joined.column size joined.yields ++ [entry.frontSub gate]
+    let continued ← emitBlock selectors context gate (rows ++ advice joined.column size)
+      (joined.column + size) joined.lookup continuation
+    return joined.continued equations continued
+  else none
+
+theorem emitCtrl_match (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (column lookup index : Nat) (branches : Array (G × Bytecode.Block))
+    (fallback : Option Bytecode.Block) :
+    emitCtrl selectors context incoming rows column lookup (.match index branches fallback) = (do
+      let matched ← rows[index]?
+      branchRows selectors context matched rows column lookup branches fallback) := by
+  rw [emitCtrl.eq_def]
+  simp only [branchRows, Array.toList_attach]
+  cases rows[index]? with
+  | none => simp only [bind, Option.bind_none]
+  | some matched =>
+    simp only [bind, Option.bind_some]
+    rw [AIR.attachWith_mapM_val _ _ _ (fun pair : G × Bytecode.Block =>
+      (blockSelector selectors pair.2).bind fun entry =>
+        (emitBlock selectors context entry rows column lookup pair.2).bind fun emission =>
+          pure (emission.prefix [caseEquation entry matched pair.1]))]
+    change (branches.toList.mapM (caseRow selectors context matched rows column lookup)).bind _ = _
+    congr 1
+    funext cases
+    cases fallback <;> simp only [defaultRow, bind, Option.bind_assoc, Option.bind_some]
+
+theorem emitCtrl_matchContinue (selectors : Array Expr) (context : Context) (incoming : Expr)
+    (rows : Array RowExpr) (column lookup index : Nat) (branches : Array (G × Bytecode.Block))
+    (fallback : Option Bytecode.Block) (size aux slots : Nat) (continuation : Bytecode.Block) :
+    emitCtrl selectors context incoming rows column lookup (.matchContinue index branches fallback size aux slots continuation) = (do
+      let matched ← rows[index]?
+      let joined ← branchRows selectors context matched rows column lookup branches fallback
+      continueRow selectors context incoming rows size continuation joined) := by
+  rw [emitCtrl.eq_def]
+  simp only [branchRows, Array.toList_attach]
+  cases rows[index]? with
+  | none => simp only [bind, Option.bind_none]
+  | some matched =>
+    simp only [bind, Option.bind_some]
+    rw [AIR.attachWith_mapM_val _ _ _ (fun pair : G × Bytecode.Block =>
+      (blockSelector selectors pair.2).bind fun entry =>
+        (emitBlock selectors context entry rows column lookup pair.2).bind fun emission =>
+          pure (emission.prefix [caseEquation entry matched pair.1]))]
+    simp only [Option.bind_assoc]
+    change (branches.toList.mapM (caseRow selectors context matched rows column lookup)).bind _ = _
+    congr 1
+    funext cases
+    cases fallback <;> simp only [defaultRow, continueRow, bind, pure, Option.bind_assoc, Option.bind_some]
+
+theorem branchRows_invariants {selectors : Array Expr} {context : Context} {matched : RowExpr}
+    {rows : Array RowExpr} {column lookup : Nat} {branches : Array (G × Bytecode.Block)}
+    {fallback : Option Bytecode.Block} {emission : Emission} (normal : Normal rows)
+    (emitted : branchRows selectors context matched rows column lookup branches fallback = some emission) :
+    Normal emission.values ∧ column ≤ emission.column := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  cases emitted
+  exact ⟨normal, fold_max_start Emission.column _ column⟩
+
+mutual
+
+theorem emitCtrl_invariants {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {column lookup : Nat} (ctrl : Bytecode.Ctrl) {emission : Emission}
+    (normal : Normal rows) (emitted : emitCtrl selectors context incoming rows column lookup ctrl = some emission) :
+    Normal emission.values ∧ column ≤ emission.column := by
+  cases ctrl with
+  | «return» index indices | yield index indices =>
+    simp only [emitCtrl, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact ⟨normal, Nat.le_refl _⟩
+  | «match» index branches fallback =>
+    rw [emitCtrl_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    exact branchRows_invariants normal emitted
+  | matchContinue index branches fallback size aux lookups continuation =>
+    rw [emitCtrl_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i joined joinedEmitted
+    have joinedBounds := branchRows_invariants normal joinedEmitted
+    simp only [continueRow] at emitted
+    split at emitted
+    · simp only [bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      rename_i continued continuedEmitted
+      cases emitted
+      have result := emitBlock_invariants continuation
+        (normal.append (advice_normal _ _)) continuedEmitted
+      exact ⟨result.1, Nat.le_trans joinedBounds.2 (Nat.le_trans (Nat.le_add_right _ _) result.2)⟩
+    · cases emitted
+termination_by sizeOf ctrl
+decreasing_by all_goals decreasing_tactic
+
+theorem emitBlock_invariants {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {column lookup : Nat} (block : Bytecode.Block) {emission : Emission}
+    (normal : Normal rows) (emitted : emitBlock selectors context incoming rows column lookup block = some emission) :
+    Normal emission.values ∧ column ≤ emission.column := by
+  simp only [emitBlock, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i operations operationsEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i control controlEmitted
+  cases emitted
+  have result := emitCtrl_invariants block.ctrl (emitOps_normal normal operationsEmitted) controlEmitted
+  exact ⟨result.1, Nat.le_trans (emitOps_column operationsEmitted) result.2⟩
+termination_by sizeOf block
+decreasing_by exact block_smaller block
+
+end
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BlockLookups.lean b/Ix/Aiur/Proofs/BlockLookups.lean
new file mode 100644
index 000000000..a9b59d6fa
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockLookups.lean
@@ -0,0 +1,69 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockReflection
+
+/-! Returns contribute arguments to the provider slot without adding weight.
+Consumer slots retain both multiplicities and gated argument accumulation. -/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter LookupEmitter Compiler
+
+def returnArgs (branchless : Bool) (returns : List ReturnExpr) : List Expr :=
+  returns.foldl (fun args returned => addArgs args (gateArgs branchless returned.selector returned.message)) []
+
+theorem returnArgs_fold_eval (branchless : Bool) {values : Values G}
+    {returns : List ReturnExpr} {results : List (G × Bytecode.AIR.Call)}
+    (evaluated : returns.mapM (ReturnExpr.eval values) = some results)
+    {initial : List Expr} {start : List G}
+    (initialEval : initial.mapM (evalExpr values) = some start) :
+    (returns.foldl (fun args returned => addArgs args (gateArgs branchless returned.selector returned.message)) initial).mapM
+      (evalExpr values) = some (results.foldl (fun args part =>
+        AIR.addMessages args (AIR.gateMessage branchless part.1 (AIR.functionMessage part.2))) start) := by
+  induction returns generalizing results initial start with
+  | nil =>
+    cases evaluated
+    exact initialEval
+  | cons returned rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i result resultEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i tail tailEval
+    cases evaluated
+    exact ih tailEval (addArgs_eval initialEval (gateArgs_eval branchless
+      (ReturnExpr.eval_components resultEval).2.1 (ReturnExpr.message_eval resultEval)))
+
+theorem returnArgs_eval (branchless : Bool) {values : Values G}
+    {returns : List ReturnExpr} {results : List (G × Bytecode.AIR.Call)}
+    (evaluated : returns.mapM (ReturnExpr.eval values) = some results) :
+    (returnArgs branchless returns).mapM (evalExpr values) = some
+      (AIR.slotMessage branchless (results.map fun part => (part.1, AIR.functionMessage part.2))) := by
+  simpa only [returnArgs, AIR.slotMessage, List.foldl_map] using
+    returnArgs_fold_eval branchless evaluated (show [].mapM (evalExpr values) = some [] from rfl)
+
+def lookup (branchless : Bool) (emission : Emission) (slot : Nat) : ExprLookup :=
+  if slot = 0 then ⟨.konst 0, returnArgs branchless emission.returns⟩
+  else LookupEmitter.slot branchless emission.queries slot
+
+theorem lookup_eval (branchless : Bool) {values : Values G} {emission : Emission} {result : AIR.BlockEmission}
+    (evaluated : emission.eval values = some result) (slot : Nat) :
+    (lookup branchless emission slot).eval goldilocksOps values = some
+      (if slot = 0 then (0, AIR.slotMessage branchless (result.returns.map fun part => (part.1, AIR.functionMessage part.2)))
+       else (AIR.querySlotMultiplicity result.queries slot,
+         AIR.slotMessage branchless (AIR.querySlotParts result.queries slot))) := by
+  obtain ⟨_, _, _, _, queries, returns, _, _⟩ := Emission.eval_components evaluated
+  by_cases zero : slot = 0
+  · simp only [lookup, zero, if_true]
+    change ((returnArgs branchless emission.returns).mapM (evalExpr values)).bind
+      (fun args => some (0, args)) = _
+    rw [returnArgs_eval branchless returns]
+    rfl
+  · simpa only [lookup, zero, if_false] using LookupEmitter.slot_eval branchless queries slot
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BlockQueryPool.lean b/Ix/Aiur/Proofs/BlockQueryPool.lean
new file mode 100644
index 000000000..6d7e3a8eb
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockQueryPool.lean
@@ -0,0 +1,71 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.QuerySlotMessages
+
+/-!
+Function-row validity using the query pool computed from valued block
+emissions. Slot exclusivity supplies active raw-query membership, removing
+that separate premise from the function-row theorem. Exact global lookup
+balance, count/layout validity and native verifier reflection remain open.
+-/
+
+namespace Aiur.AIR
+
+def blockQueryPool (emissions : List BlockEmission) : List (List G) :=
+  emissions.flatMap fun emission => decodedQueries emission.queries emission.lookup
+
+theorem QuerySlots.queried_pool {gate : G} {start : Nat} {emission : BlockEmission}
+    (slots : QuerySlots gate start emission.lookup emission.queries)
+    {emissions : List BlockEmission} (member : emission ∈ emissions) :
+    emission.QueriesIn (blockQueryPool emissions) := by
+  intro query present active
+  exact List.mem_flatMap.mpr ⟨emission, member, slots.decoded_member present active⟩
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Block.emitRow_queried_pool (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    (bounds : block.rowBounds selector) {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission)
+    (linked : incoming = (block.selectorFlow selector).entry)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    {emissions : List BlockEmission} (member : emission ∈ emissions) :
+    emission.QueriesIn (blockQueryPool emissions) :=
+  (block.emitRow_equation_querySlots row selector context incoming values column lookup
+    bounds emitted linked satisfied).queried_pool member
+
+theorem Function.emitRow_pool_valid {tables : LookupTables} {width : Nat}
+    {emissions : List BlockEmission} (global : GlobalLookups tables width (blockQueryPool emissions))
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (program : Toplevel) (row : Nat → G) (selector : SelIdx → G)
+    (functionIndex : FunIdx) (rankBytes : Fin 6 → G) (values : Array RowValue) (column lookup : Nat)
+    (function : Function) (present : program.functions[functionIndex]? = some function)
+    (arity : values.size = function.layout.inputSize)
+    (shape : function.body.lookupShapes program none = true) (bounds : function.body.rowBounds selector)
+    {emission : BlockEmission}
+    (emitted : function.emitRow row selector functionIndex (packRank rankBytes) values column lookup = some emission)
+    (member : emission ∈ emissions)
+    (multiplicity : G) (nonzero : multiplicity ≠ 0)
+    (activity : activityConstraint multiplicity (function.body.selectorFlow selector).entry = 0)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    ∃ interpreted : FunctionRow, interpreted.Valid program (memoryFacts tables.memory) ∧
+      (1, interpreted.request) ∈ emission.returns ∧
+      interpreted.request.function = functionIndex ∧ interpreted.request.inputs = rowValues values ∧
+      interpreted.request.rank = packRank rankBytes ∧ interpreted.rankBytes = rankBytes ∧
+      interpreted.selector = (function.body.selectorFlow selector).entry ∧
+      interpreted.multiplicity = multiplicity ∧ emission.CallsAt interpreted.calls ∧
+      CallsEmitted (packRank rankBytes) 1 emission.equations (blockQueryPool emissions) interpreted.calls := by
+  have bodyEmitted := emitted
+  rw [Function.emitRow] at bodyEmitted
+  have queried := function.body.emitRow_queried_pool row selector _ _ _ _ _ bounds bodyEmitted rfl satisfied member
+  exact function.emitRow_valid global memoryValid canonical program row selector functionIndex rankBytes
+    values column lookup present arity shape bounds emitted multiplicity nonzero activity satisfied queried
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockQuerySlots.lean b/Ix/Aiur/Proofs/BlockQuerySlots.lean
new file mode 100644
index 000000000..4d564bc11
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockQuerySlots.lean
@@ -0,0 +1,303 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.QuerySlots
+
+/-!
+The valued block emitter respects lookup-slot intervals and has at most
+one active query in each slot. Branch exclusivity follows from the emitted
+selector equations; continuations resume after the maximum branch cursor.
+An inactive parent also disables its continuation under the terminal bound.
+
+Only the selector equations and explicit syntax count bounds are needed.
+Native expression/layout reflection remains separate.
+-/
+
+namespace Aiur.AIR
+
+theorem selectorSum_all_zero {gates : List G} (zero : ∀ gate ∈ gates, gate = 0) :
+    selectorSum gates = 0 := by
+  induction gates with
+  | nil => rfl
+  | cons gate gates ih =>
+    rw [selectorSum_cons, zero gate List.mem_cons_self, G.zero_add]
+    exact ih (fun gate member => zero gate (List.mem_cons_of_mem _ member))
+
+theorem SelectorFlow.Sound.yield_gateCount {flow : SelectorFlow} (sound : flow.Sound)
+    (bounded : flow.returns.length + flow.yields.length < gSize.toNat)
+    (boolean : booleanConstraint flow.entry = 0) :
+    gateCount (selectorSum flow.yields) ≤ gateCount flow.entry := by
+  rcases G.boolean_of_constraint boolean with inactive | active
+  · have zero := sound.inactive_terminal bounded inactive
+    have yieldsZero := selectorSum_all_zero (fun gate member => zero gate (List.mem_append_right _ member))
+    rw [inactive, yieldsZero]
+    exact Nat.le_refl _
+  · rw [active]
+    exact gateCount_le_one _
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem branchSelectorFlows_case_satisfied {selector : SelIdx → G}
+    {branches : Array (G × Block)} {fallback : Option Block}
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied)
+    {pair : G × Block} (member : pair ∈ branches.toList) :
+    (pair.2.selectorFlow selector).Satisfied :=
+  SelectorFlow.join_satisfied valid _ (List.mem_append_left _ (List.mem_map.mpr ⟨pair, member, rfl⟩))
+
+theorem branchSelectorFlows_default_satisfied {selector : SelIdx → G}
+    {branches : Array (G × Block)} {fallback : Option Block}
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied)
+    {block : Block} (present : fallback = some block) : (block.selectorFlow selector).Satisfied := by
+  apply SelectorFlow.join_satisfied valid _
+  apply List.mem_append_right
+  rw [present]
+  exact List.mem_cons_self
+
+theorem branchRows_querySlots (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied)
+    (bounded : branches.size + fallback.toList.length < gSize.toNat)
+    (boolean : booleanConstraint (SelectorFlow.join (branchSelectorFlows selector branches fallback)).entry = 0)
+    (caseSound : ∀ pair ∈ branches.toList, ∀ emission,
+      pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup = some emission →
+      QuerySlots (pair.2.selectorFlow selector).entry lookup emission.lookup emission.queries)
+    (defaultSound : ∀ block, fallback = some block → ∀ emission,
+      block.emitRow row selector context (block.selectorFlow selector).entry values
+        (column + branches.size) lookup = some emission →
+      QuerySlots (block.selectorFlow selector).entry lookup emission.lookup emission.queries) :
+    QuerySlots (SelectorFlow.join (branchSelectorFlows selector branches fallback)).entry
+      lookup emission.lookup emission.queries := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      have casesRelated : List.Forall₂ (fun block emission =>
+          QuerySlots (block.selectorFlow selector).entry lookup emission.lookup emission.queries)
+          (branches.toList.map Prod.snd) cases := by
+        apply forall₂_map_left
+        apply mapM_forall₂ casesEmitted
+        intro pair member emission emitted
+        simp only [caseRow, bind, Option.bind] at emitted
+        split at emitted
+        · cases emitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj emitted
+          subst emission
+          exact caseSound pair member body bodyEmitted
+      have defaultRelated : List.Forall₂ (fun block emission =>
+          QuerySlots (block.selectorFlow selector).entry lookup emission.lookup emission.queries)
+          fallback.toList default := by
+        cases fallback with
+        | none =>
+          have equal := Option.some.inj defaultEmitted
+          subst default
+          exact .nil
+        | some block =>
+          simp only [defaultRow, bind, Option.bind] at defaultEmitted
+          split at defaultEmitted
+          · cases defaultEmitted
+          · rename_i body bodyEmitted
+            have equal := Option.some.inj defaultEmitted
+            subst default
+            exact .cons (defaultSound block rfl body bodyEmitted) .nil
+      have individual := branchSelectorFlows_boolean selector branches fallback valid
+      have count := selector_gateCount
+        (gates := (branchSelectorFlows selector branches fallback).map SelectorFlow.entry)
+        (fun gate member => by
+          obtain ⟨flow, flowMember, equal⟩ := List.mem_map.mp member
+          subst gate
+          exact individual flow flowMember)
+        (by simpa only [branchSelectorFlows, List.length_map, List.length_append, Array.length_toList] using bounded)
+        boolean
+      apply QuerySlots.join (fun block : Block => (block.selectorFlow selector).entry)
+        _ values column lookup (forall₂_append casesRelated defaultRelated)
+      apply Nat.le_of_eq
+      simpa only [SelectorFlow.join, branchSelectorFlows, List.map_append, List.map_map, Function.comp_def] using count
+
+private theorem block_query_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+private theorem block_query_pair_smaller (pair : G × Block) : sizeOf pair.2 < sizeOf pair := by
+  cases pair
+  simp
+  omega
+
+private theorem block_query_option_smaller {block : Block} {fallback : Option Block}
+    (present : fallback = some block) : sizeOf block < sizeOf fallback := by
+  rw [present]
+  simp
+
+mutual
+
+theorem Ctrl.emitRow_querySlots (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (ctrl : Ctrl)
+    (bounds : ctrl.rowBounds selector) {emission : BlockEmission}
+    (emitted : ctrl.emitRow row selector context incoming values column lookup = some emission)
+    (linked : incoming = (ctrl.selectorFlow selector).entry)
+    (valid : (ctrl.selectorFlow selector).Satisfied) :
+    QuerySlots incoming lookup emission.lookup emission.queries := by
+  cases ctrlEq : ctrl with
+  | «return» index indices =>
+    rw [ctrlEq] at bounds emitted linked valid
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · have equal := Option.some.inj emitted
+        subst emission
+        exact QuerySlots.empty incoming lookup
+  | yield index indices =>
+    rw [ctrlEq] at bounds emitted linked valid
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · have equal := Option.some.inj emitted
+      subst emission
+      exact QuerySlots.empty incoming lookup
+  | «match» index branches fallback =>
+    rw [ctrlEq] at bounds emitted linked valid
+    have boolean := (Ctrl.match index branches fallback).selectorFlow_boolean selector valid
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      rw [Ctrl.rowBounds.eq_def] at bounds
+      obtain ⟨branchBound, casesBounded, fallbackBounded⟩ := bounds
+      rw [Ctrl.selectorFlow_match] at valid boolean linked
+      have joinedValid := SelectorFlow.guard_satisfied valid
+      rw [linked]
+      apply branchRows_querySlots row selector context matched.value values column lookup branches fallback
+        emitted joinedValid branchBound boolean
+      · intro pair member body bodyEmitted
+        exact Block.emitRow_querySlots row selector context _ values column lookup pair.2
+          (casesBounded pair member) bodyEmitted rfl (branchSelectorFlows_case_satisfied joinedValid member)
+      · intro block present body bodyEmitted
+        have bounded : block.rowBounds selector := by rw [present] at fallbackBounded; exact fallbackBounded
+        exact Block.emitRow_querySlots row selector context _ values _ lookup block bounded bodyEmitted rfl
+          (branchSelectorFlows_default_satisfied joinedValid present)
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [ctrlEq] at bounds emitted linked valid
+    have boolean := (Ctrl.matchContinue index branches fallback size aux slots continuation).selectorFlow_boolean selector valid
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i joined branchesEmitted
+        simp only [continueRow] at emitted
+        split at emitted
+        · simp only [bind, Option.bind] at emitted
+          split at emitted
+          · cases emitted
+          · rename_i continued contEmitted
+            have equal := Option.some.inj emitted
+            subst emission
+            rw [Ctrl.rowBounds.eq_def] at bounds
+            obtain ⟨branchBound, terminalBound, casesBounded, fallbackBounded, contBounded⟩ := bounds
+            rw [Ctrl.selectorFlow_matchContinue] at valid boolean linked
+            obtain ⟨joinedValid, contValid, link⟩ :=
+              SelectorFlow.continue_satisfied (SelectorFlow.guard_satisfied valid)
+            have joinedSlots := branchRows_querySlots row selector context matched.value values column lookup
+              branches fallback branchesEmitted joinedValid branchBound boolean
+              (fun pair member body bodyEmitted =>
+                Block.emitRow_querySlots row selector context _ values column lookup pair.2
+                  (casesBounded pair member) bodyEmitted rfl (branchSelectorFlows_case_satisfied joinedValid member))
+              (fun block present body bodyEmitted =>
+                Block.emitRow_querySlots row selector context _ values _ lookup block
+                  (by rw [present] at fallbackBounded; exact fallbackBounded) bodyEmitted rfl
+                  (branchSelectorFlows_default_satisfied joinedValid present))
+            have projected := branchRows_selector_projection row selector context matched.value values column lookup
+              branches fallback branchesEmitted
+            have contLinked : selectorSum (joined.yields.map Prod.fst) =
+                (continuation.selectorFlow selector).entry := by
+              rw [projected.yielded]
+              exact link.symm
+            have continuedSlots := Block.emitRow_querySlots row selector context _ _ _ _ continuation
+              contBounded contEmitted contLinked contValid
+            have joinedSound := branchSelectorFlows_sound selector branches fallback joinedValid
+              (fun pair _ valid => pair.2.selectorFlow_sound selector valid)
+              (fun block _ valid => block.selectorFlow_sound selector valid)
+            have countBound := joinedSound.yield_gateCount terminalBound boolean
+            rw [← projected.yielded] at countBound
+            rw [linked]
+            exact joinedSlots.append (continuedSlots.weaken countBound)
+        · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals
+    try rw [ctrlEq]
+    first
+    | (have bound := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member)
+       have pairBound := block_query_pair_smaller pair
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (have optionBound := block_query_option_smaller present
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (simp only [Ctrl.matchContinue.sizeOf_spec]; omega)
+
+theorem Block.emitRow_querySlots (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    (bounds : block.rowBounds selector) {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission)
+    (linked : incoming = (block.selectorFlow selector).entry)
+    (valid : (block.selectorFlow selector).Satisfied) :
+    QuerySlots incoming lookup emission.lookup emission.queries := by
+  rw [Block.rowBounds] at bounds
+  have boolean : booleanConstraint incoming = 0 := by
+    rw [linked]
+    exact block.selectorFlow_boolean selector valid
+  rw [Block.selectorFlow] at linked valid
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i operations opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control ctrlEmitted
+      have controlSlots := Ctrl.emitRow_querySlots row selector context incoming _ _ _ block.ctrl
+        bounds ctrlEmitted linked valid
+      have equal := Option.some.inj emitted
+      subst emission
+      exact (QuerySlots.indexed incoming lookup operations.queries boolean).append controlSlots
+termination_by sizeOf block
+decreasing_by exact block_query_smaller block
+
+end
+
+theorem Block.emitRow_equation_querySlots (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    (bounds : block.rowBounds selector) {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission)
+    (linked : incoming = (block.selectorFlow selector).entry)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    QuerySlots incoming lookup emission.lookup emission.queries :=
+  block.emitRow_querySlots row selector context incoming values column lookup bounds emitted linked
+    (block.emitRow_selectors row selector context incoming values column lookup emitted satisfied)
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockReflection.lean b/Ix/Aiur/Proofs/BlockReflection.lean
new file mode 100644
index 000000000..06ed6dd4f
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockReflection.lean
@@ -0,0 +1,412 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockExpressions
+
+/-!
+Reflection of symbolic block and control emission into the valued model.
+Branch callbacks below are discharged by structural recursion over bytecode;
+fresh reads are restricted to the columns consumed by the complete emission.
+-/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter LookupEmitter
+
+def selectorAt (selectors : Array G) (index : Nat) : G := selectors[index]?.getD 0
+
+def Context.valued (context : Context) (rank : G) : AIR.RowContext :=
+  ⟨context.function, context.inputSize, rank⟩
+
+def BlockReflects (values : Values G) (row : Nat → G) (selectors : Array Expr) (selected : Nat → G)
+    (context : Context) (rank : G) (block : Bytecode.Block) : Prop :=
+  ∀ {incoming : Expr} {s : G} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    {column lookup : Nat} {emission : Emission},
+    evalExpr values incoming = some s → evalRows values rows = some inputs → Normal rows →
+    emitBlock selectors context incoming rows column lookup block = some emission →
+    (∀ index, column ≤ index → index < emission.column →
+      (values.columns .main .current)[index]? = some (row index)) →
+    ∃ result, block.emitRow row selected (context.valued rank) s inputs column lookup = some result ∧
+      emission.eval values = some result
+
+def CtrlReflects (values : Values G) (row : Nat → G) (selectors : Array Expr) (selected : Nat → G)
+    (context : Context) (rank : G) (ctrl : Bytecode.Ctrl) : Prop :=
+  ∀ {incoming : Expr} {s : G} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    {column lookup : Nat} {emission : Emission},
+    evalExpr values incoming = some s → evalRows values rows = some inputs → Normal rows →
+    emitCtrl selectors context incoming rows column lookup ctrl = some emission →
+    (∀ index, column ≤ index → index < emission.column →
+      (values.columns .main .current)[index]? = some (row index)) →
+    ∃ result, ctrl.emitRow row selected (context.valued rank) s inputs column lookup = some result ∧
+      emission.eval values = some result
+
+theorem list_mapM_refine_mem {α β γ : Type} {first : α → Option β} {second : α → Option γ}
+    {evaluate : β → Option γ} {inputs : List α} {outputs : List β}
+    (selected : inputs.mapM first = some outputs)
+    (related : ∀ input ∈ inputs, ∀ output ∈ outputs, first input = some output →
+      ∃ value, second input = some value ∧ evaluate output = some value) :
+    ∃ values, inputs.mapM second = some values ∧ outputs.mapM evaluate = some values := by
+  induction inputs generalizing outputs with
+  | nil =>
+    cases selected
+    exact ⟨[], rfl, rfl⟩
+  | cons input rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at selected
+    split at selected
+    · cases selected
+    rename_i output outputSelected
+    dsimp only at selected
+    split at selected
+    · cases selected
+    rename_i tail tailSelected
+    cases selected
+    obtain ⟨value, read, evaluated⟩ := related input List.mem_cons_self output List.mem_cons_self outputSelected
+    obtain ⟨values, reads, evaluations⟩ := ih tailSelected (fun input member output present selected =>
+      related input (List.mem_cons_of_mem _ member) output (List.mem_cons_of_mem _ present) selected)
+    refine ⟨value :: values, ?_, ?_⟩ <;>
+      simp only [List.mapM_cons, read, evaluated, reads, evaluations, bind, Option.bind_some, pure]
+
+theorem caseRows_reflects {values : Values G} (row : Nat → G)
+    {selectors : Array Expr} {selected : Nat → G} {context : Context} (rank : G)
+    {matched : RowExpr} {value : AIR.RowValue} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    (column lookup limit : Nat) {branches : Array (G × Bytecode.Block)} {emissions : List Emission}
+    (selectorEval : SelectorReads values selectors selected)
+    (matchedRef : matched.Reflects values value)
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (emitted : branches.toList.mapM (caseRow selectors context matched rows column lookup) = some emissions)
+    (bounds : ∀ emission ∈ emissions, emission.column ≤ limit)
+    (reads : ∀ index, column ≤ index → index < limit →
+      (values.columns .main .current)[index]? = some (row index))
+    (reflection : ∀ pair ∈ branches.toList, BlockReflects values row selectors selected context rank pair.2) :
+    ∃ results, branches.toList.mapM (Bytecode.caseRow row selected (context.valued rank)
+      value.value inputs column lookup) = some results ∧ emissions.mapM (Emission.eval values) = some results := by
+  apply list_mapM_refine_mem emitted
+  intro pair member emission present emitted
+  simp only [caseRow, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i entry entrySelected
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i child childEmitted
+  cases emitted
+  have upper := bounds _ present
+  have entryEval : evalExpr values entry = some (pair.2.selectorFlow selected).entry :=
+    blockSelector_reads selectorEval pair.2 entrySelected
+  obtain ⟨result, resultEmitted, resultEval⟩ := reflection pair member entryEval inputEval normal childEmitted
+    (fun index lower bound => reads index lower (Nat.lt_of_lt_of_le bound upper))
+  have equation : [caseEquation entry matched pair.1].mapM (evalExpr values) =
+      some [(pair.2.selectorFlow selected).entry * (value.value - pair.1)] := by
+    simp only [List.mapM_cons, List.mapM_nil, caseEquation_eval entryEval matchedRef,
+      bind, Option.bind_some, pure]
+  refine ⟨_, ?_, Emission.prefix_eval resultEval equation⟩
+  simp only [Bytecode.caseRow, resultEmitted, bind, Option.bind_some, pure]
+
+theorem defaultRow_reflects {values : Values G} (row : Nat → G)
+    {selectors : Array Expr} {selected : Nat → G} {context : Context} (rank : G)
+    {matched : RowExpr} {value : AIR.RowValue} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    (column lookup limit : Nat) (branches : Array (G × Bytecode.Block)) {fallback : Option Bytecode.Block}
+    {emissions : List Emission} (selectorEval : SelectorReads values selectors selected)
+    (matchedRef : matched.Reflects values value)
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (emitted : defaultRow selectors context matched rows column lookup branches fallback = some emissions)
+    (bounds : ∀ emission ∈ emissions, emission.column ≤ limit)
+    (reads : ∀ index, column ≤ index → index < limit →
+      (values.columns .main .current)[index]? = some (row index))
+    (reflection : ∀ block ∈ fallback.toList, BlockReflects values row selectors selected context rank block) :
+    ∃ results, Bytecode.defaultRow row selected (context.valued rank) value.value
+      inputs column lookup branches fallback = some results ∧ emissions.mapM (Emission.eval values) = some results := by
+  cases fallback with
+  | none =>
+    cases emitted
+    exact ⟨[], rfl, rfl⟩
+  | some block =>
+    simp only [defaultRow, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i entry entrySelected
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i child childEmitted
+    cases emitted
+    have upper := bounds _ List.mem_cons_self
+    have allocated := (emitBlock_invariants block normal childEmitted).2
+    have entryEval : evalExpr values entry = some (block.selectorFlow selected).entry :=
+      blockSelector_reads selectorEval block entrySelected
+    obtain ⟨result, resultEmitted, resultEval⟩ := reflection block List.mem_cons_self entryEval inputEval normal childEmitted
+      (fun index lower upperBound => reads index (by omega) (Nat.lt_of_lt_of_le upperBound upper))
+    have equations := defaultEquations_eval row column branches entryEval matchedRef
+      (fun index bound => reads (column + index) (by omega) (by dsimp only [Emission.prefix] at upper; omega))
+    have prefixed := Emission.prefix_eval resultEval equations
+    refine ⟨[result.prefix (branches.toList.mapIdx fun index pair =>
+      (block.selectorFlow selected).entry * ((value.value - pair.1) * row (column + index) - 1))], ?_, ?_⟩
+    · simp only [Bytecode.defaultRow, resultEmitted, bind, Option.bind_some, pure]
+    · simp only [List.mapM_cons, List.mapM_nil, prefixed, bind, Option.bind_some, pure]
+
+theorem branchRows_reflects {values : Values G} (row : Nat → G)
+    {selectors : Array Expr} {selected : Nat → G} {context : Context} (rank : G)
+    {matched : RowExpr} {value : AIR.RowValue} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    {column lookup : Nat} {branches : Array (G × Bytecode.Block)} {fallback : Option Bytecode.Block}
+    {emission : Emission} (selectorEval : SelectorReads values selectors selected)
+    (matchedRef : matched.Reflects values value)
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (emitted : branchRows selectors context matched rows column lookup branches fallback = some emission)
+    (reads : ∀ index, column ≤ index → index < emission.column →
+      (values.columns .main .current)[index]? = some (row index))
+    (casesReflect : ∀ pair ∈ branches.toList, BlockReflects values row selectors selected context rank pair.2)
+    (defaultReflect : ∀ block ∈ fallback.toList, BlockReflects values row selectors selected context rank block) :
+    ∃ result, Bytecode.branchRows row selected (context.valued rank) value.value
+      inputs column lookup branches fallback = some result ∧ emission.eval values = some result := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i cases casesEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i default defaultEmitted
+  cases emitted
+  obtain ⟨caseValues, casesRead, casesEval⟩ := caseRows_reflects row rank column lookup
+    (join rows column lookup (cases ++ default)).column selectorEval matchedRef inputEval normal casesEmitted
+    (fun emission member => fold_max_member Emission.column (List.mem_append_left default member) column) reads casesReflect
+  obtain ⟨defaultValues, defaultRead, defaultEval⟩ := defaultRow_reflects row rank column lookup
+    (join rows column lookup (cases ++ default)).column branches selectorEval matchedRef inputEval normal defaultEmitted
+    (fun emission member => fold_max_member Emission.column (List.mem_append_right cases member) column) reads defaultReflect
+  have combined : (cases ++ default).mapM (Emission.eval values) = some (caseValues ++ defaultValues) := by
+    simp only [List.mapM_append, casesEval, defaultEval, bind, Option.bind_some, pure]
+  refine ⟨_, ?_, join_eval inputEval column lookup combined⟩
+  simp only [Bytecode.branchRows, casesRead, defaultRead, bind, Option.bind_some, pure]
+
+theorem continueRow_column {selectors : Array Expr} {context : Context} {incoming : Expr}
+    {rows : Array RowExpr} {size : Nat} {continuation : Bytecode.Block} {joined emission : Emission}
+    (normal : Normal rows)
+    (emitted : continueRow selectors context incoming rows size continuation joined = some emission) :
+    joined.column ≤ emission.column := by
+  simp only [continueRow] at emitted
+  split at emitted
+  · simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i continued continuedEmitted
+    cases emitted
+    exact Nat.le_trans (Nat.le_add_right _ _)
+      (emitBlock_invariants continuation (normal.append (advice_normal _ _)) continuedEmitted).2
+  · cases emitted
+
+theorem advice_absolute_eval {values : Values G} (row : Nat → G) (column size : Nat)
+    (reads : ∀ index < size, (values.columns .main .current)[column + index]? = some (row (column + index))) :
+    evalRows values (advice column size) = some (AIR.rowAdvice row column size) := by
+  simpa only [AIR.rowAdvice, Nat.zero_add] using advice_eval values (fun index => row (column + index)) column size reads
+
+theorem continueRow_reflects {values : Values G} (row : Nat → G)
+    {selectors : Array Expr} {selected : Nat → G} {context : Context} (rank : G)
+    {incoming : Expr} {s : G} {rows : Array RowExpr} {inputs : Array AIR.RowValue}
+    (size : Nat) (continuation : Bytecode.Block) {joined emission : Emission} {branches : AIR.BlockEmission}
+    (selectorEval : SelectorReads values selectors selected)
+    (incomingEval : evalExpr values incoming = some s)
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (joinedEval : joined.eval values = some branches)
+    (emitted : continueRow selectors context incoming rows size continuation joined = some emission)
+    (reads : ∀ index, joined.column ≤ index → index < emission.column →
+      (values.columns .main .current)[index]? = some (row index))
+    (reflection : BlockReflects values row selectors selected context rank continuation) :
+    ∃ result, Bytecode.continueRow row selected (context.valued rank) s inputs size continuation branches =
+      some result ∧ emission.eval values = some result := by
+  simp only [continueRow] at emitted
+  split at emitted
+  · rename_i widths
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i entry entrySelected
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i continued continuedEmitted
+    cases emitted
+    have allocated := (emitBlock_invariants continuation (normal.append (advice_normal _ _)) continuedEmitted).2
+    obtain ⟨_, column, lookup, _, _, _, yieldsEval, _⟩ := Emission.eval_components joinedEval
+    have validWidths : branches.yields.all (fun part => part.2.size == size) = true :=
+      (yields_size yieldsEval size).symm.trans widths
+    have fresh : ∀ index < size,
+        (values.columns .main .current)[joined.column + index]? = some (row (joined.column + index)) :=
+      fun index bound => reads (joined.column + index) (by omega)
+        (by change joined.column + index < continued.column; omega)
+    have outputs := advice_absolute_eval row joined.column size fresh
+    have gateEval := yieldGate_eval yieldsEval
+    have entryEval : evalExpr values entry = some (continuation.selectorFlow selected).entry :=
+      blockSelector_reads selectorEval continuation entrySelected
+    obtain ⟨result, resultEmitted, resultEval⟩ := reflection gateEval (evalRows_append inputEval outputs)
+      (normal.append (advice_normal _ _)) continuedEmitted (fun index lower upper => reads index (by omega) upper)
+    have mergeEval := mergeEquations_eval row joined.column size incomingEval yieldsEval fresh
+    have linkEval := Expr.frontSub_eval goldilocksLaws values entryEval gateEval
+    have equations : (mergeEquations incoming joined.column size joined.yields ++ [entry.frontSub (yieldGate joined.yields)]).mapM
+        (evalExpr values) = some (AIR.mergeEquations row s joined.column size branches.yields ++
+          [(continuation.selectorFlow selected).entry - AIR.selectorSum (branches.yields.map Prod.fst)]) := by
+      simp only [List.mapM_append, List.mapM_cons, List.mapM_nil, mergeEval, linkEval,
+        bind, Option.bind_some, pure, goldilocks_sub]
+    refine ⟨_, ?_, Emission.continued_eval joinedEval resultEval equations⟩
+    simp only [Bytecode.continueRow, validWidths, if_true, ← column, ← lookup,
+      resultEmitted, bind, Option.bind_some, pure]
+  · cases emitted
+
+private theorem case_block_smaller {branches : Array (G × Bytecode.Block)} {pair : G × Bytecode.Block}
+    (member : pair ∈ branches.toList) : sizeOf pair.2 < sizeOf branches := by
+  have present : pair ∈ branches := Array.mem_toList_iff.mp member
+  have bound := Array.sizeOf_lt_of_mem present
+  cases pair
+  simp at bound ⊢
+  omega
+
+private theorem fallback_block_smaller {fallback : Option Bytecode.Block} {block : Bytecode.Block}
+    (member : block ∈ fallback.toList) : sizeOf block < sizeOf fallback := by
+  cases fallback with
+  | none => cases member
+  | some value =>
+    have equal := List.mem_singleton.mp member
+    subst block
+    simp
+
+private theorem block_smaller (block : Bytecode.Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+theorem ctrl_reflects (values : Values G) (row : Nat → G)
+    {selectors : Array Expr} {selected : Nat → G} {context : Context} {rank : G}
+    (selectorEval : SelectorReads values selectors selected)
+    (rankEval : evalExpr values context.rank = some rank) (ctrl : Bytecode.Ctrl) :
+    CtrlReflects values row selectors selected context rank ctrl := by
+  intro incoming s rows inputs column lookup emission incomingEval inputEval normal emitted reads
+  cases ctrl with
+  | «return» index indices =>
+    simp only [emitCtrl, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i arguments argsSelected
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i outputs outputsSelected
+    cases emitted
+    obtain ⟨args, argsRead, argsEval⟩ := select_reflects inputEval argsSelected
+    obtain ⟨out, outRead, outEval⟩ := select_reflects inputEval outputsSelected
+    refine ⟨_, ?_, returned_eval column lookup incomingEval rankEval inputEval argsEval outEval⟩
+    simp only [Bytecode.Ctrl.emitRow, Context.valued, select_values argsRead, select_values outRead,
+      bind, Option.bind_some, pure]
+  | yield index indices =>
+    simp only [emitCtrl, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i selector selectorRead
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i outputs outputsSelected
+    cases emitted
+    obtain ⟨out, outRead, outEval⟩ := select_reflects inputEval outputsSelected
+    have selectedEval : evalExpr values selector = some (selected index) := selectorEval selectorRead
+    have selectedList := congrArg (Functor.map Array.toList) outRead
+    rw [Array.toList_mapM] at selectedList
+    simp only [Functor.map, Option.map_some] at selectedList
+    refine ⟨_, ?_, yielded_eval column lookup selectedEval inputEval outEval⟩
+    simp only [Bytecode.Ctrl.emitRow, selectedList, bind, Option.bind_some, pure, Array.toArray_toList]
+  | «match» index branches fallback =>
+    rw [emitCtrl_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i matched matchedRead
+    dsimp only at emitted
+    obtain ⟨value, valueRead, valueRef⟩ := evalRows_read inputEval matchedRead
+    obtain ⟨result, resultEmitted, resultEval⟩ := branchRows_reflects row rank selectorEval valueRef inputEval normal emitted reads
+      (fun pair member => block_reflects values row selectorEval rankEval pair.2)
+      (fun block member => block_reflects values row selectorEval rankEval block)
+    refine ⟨result, ?_, resultEval⟩
+    simp only [Bytecode.Ctrl.emitRow_match, valueRead, resultEmitted, bind, Option.bind_some]
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [emitCtrl_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i matched matchedRead
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i joined joinedEmitted
+    dsimp only at emitted
+    have finish := continueRow_column normal emitted
+    have start := (branchRows_invariants normal joinedEmitted).2
+    obtain ⟨value, valueRead, valueRef⟩ := evalRows_read inputEval matchedRead
+    obtain ⟨branchValue, branchEmitted, branchEval⟩ := branchRows_reflects row rank selectorEval valueRef inputEval normal
+      joinedEmitted (fun index lower upper => reads index lower (Nat.lt_of_lt_of_le upper finish))
+      (fun pair member => block_reflects values row selectorEval rankEval pair.2)
+      (fun block member => block_reflects values row selectorEval rankEval block)
+    obtain ⟨result, resultEmitted, resultEval⟩ := continueRow_reflects row rank size continuation
+      selectorEval incomingEval inputEval normal branchEval emitted
+      (fun index lower upper => reads index (Nat.le_trans start lower) upper)
+      (block_reflects values row selectorEval rankEval continuation)
+    refine ⟨result, ?_, resultEval⟩
+    simp only [Bytecode.Ctrl.emitRow_matchContinue, valueRead, branchEmitted, resultEmitted, bind, Option.bind_some]
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals subst ctrl
+  all_goals first
+    | (have bound := case_block_smaller ‹_ ∈ _›; simp; omega)
+    | (have bound := fallback_block_smaller ‹_ ∈ _›; simp; omega)
+    | decreasing_tactic
+
+theorem block_reflects (values : Values G) (row : Nat → G)
+    {selectors : Array Expr} {selected : Nat → G} {context : Context} {rank : G}
+    (selectorEval : SelectorReads values selectors selected)
+    (rankEval : evalExpr values context.rank = some rank) (block : Bytecode.Block) :
+    BlockReflects values row selectors selected context rank block := by
+  intro incoming s rows inputs column lookup emission incomingEval inputEval normal emitted reads
+  simp only [emitBlock, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i entry entrySelected
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i operations operationsEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i control controlEmitted
+  cases emitted
+  have operationsNormal := emitOps_normal normal operationsEmitted
+  have endBound := (emitCtrl_invariants block.ctrl operationsNormal controlEmitted).2
+  have startBound := emitOps_column operationsEmitted
+  obtain ⟨opValue, opEmitted, opEval⟩ := emitOps_reflects values row incomingEval rankEval inputEval normal operationsEmitted
+    (fun index lower upper => reads index lower (by change index < control.column; omega))
+  obtain ⟨opValues, columnEq, _, queriesEval, _⟩ := OpsEmission.eval_components opEval
+  have queryCount := Bytecode.AIR.list_mapM_some_length _ _ _ queriesEval
+  obtain ⟨result, resultEmitted, resultEval⟩ := ctrl_reflects values row selectorEval rankEval block.ctrl
+    incomingEval opValues operationsNormal controlEmitted
+    (fun index lower upper => reads index (Nat.le_trans startBound lower) upper)
+  have entryEval : evalExpr values entry = some (block.selectorFlow selected).entry :=
+    blockSelector_reads selectorEval block entrySelected
+  have guard := Expr.frontMul_eval goldilocksLaws values entryEval
+    (Expr.frontSub_eval goldilocksLaws values (show evalExpr values (.konst 1) = some 1 from rfl) entryEval)
+  have guarded : [entry.frontMul ((Expr.konst 1).frontSub entry)].mapM (evalExpr values) =
+      some [AIR.oneSubBooleanConstraint (block.selectorFlow selected).entry] := by
+    simp only [List.mapM_cons, List.mapM_nil, guard, bind, Option.bind_some, pure, goldilocks_mul, goldilocks_sub]
+    rfl
+  refine ⟨_, ?_, Emission.prefix_eval (Emission.afterOps_eval lookup incomingEval opEval resultEval) guarded⟩
+  simp only [Bytecode.Block.emitRow, show (context.valued rank).rank = rank from rfl, opEmitted,
+    bind, Option.bind_some, ← columnEq, queryCount, resultEmitted, pure]
+termination_by sizeOf block
+decreasing_by exact block_smaller block
+
+end
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BlockRowCalls.lean b/Ix/Aiur/Proofs/BlockRowCalls.lean
new file mode 100644
index 000000000..7d6d81932
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockRowCalls.lean
@@ -0,0 +1,272 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockRowExecution
+
+/-!
+Every call recorded by the valued block emitter retains its own gate,
+function query, rank-byte queries and call-order equation through branching
+and continuations. Tracking holds for arbitrary assignments; an active
+execution then inherits the inventory required by the rank argument.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+def BlockEmission.HasQuery (emission : BlockEmission) (selector : G) (message : List G) : Prop :=
+  ∃ part ∈ emission.queries, part.selector = selector ∧ part.message = message
+
+def BlockEmission.TracksCalls (rank : G) (emission : BlockEmission) : Prop :=
+  ∀ part ∈ emission.calls,
+    emission.HasQuery part.1 (functionMessage part.2.1) ∧
+    (∀ message ∈ (rankByteQueries part.2.2).map rangeMessage, emission.HasQuery part.1 message) ∧
+    part.1 * callOrderConstraint rank part.2.1.rank (packRank part.2.2) ∈ emission.equations
+
+theorem BlockEmission.HasQuery.mono {first last : BlockEmission}
+    (included : first.queries ⊆ last.queries) {selector : G} {message : List G}
+    (queried : first.HasQuery selector message) : last.HasQuery selector message := by
+  obtain ⟨part, member, gate, equal⟩ := queried
+  exact ⟨part, included member, gate, equal⟩
+
+theorem BlockEmission.HasQuery.active {emission : BlockEmission} {queries : List (List G)}
+    (queried : emission.QueriesIn queries) {message : List G} (present : emission.HasQuery 1 message) :
+    message ∈ queries := by
+  obtain ⟨part, member, gate, equal⟩ := present
+  rw [← equal]
+  exact queried part member gate
+
+theorem BlockEmission.TracksCalls.prefix {rank : G} {emission : BlockEmission}
+    (tracked : emission.TracksCalls rank) (equations : List G) :
+    (emission.prefix equations).TracksCalls rank := by
+  intro part member
+  obtain ⟨query, bytes, equation⟩ := tracked part member
+  exact ⟨query, bytes, List.mem_append_right _ equation⟩
+
+theorem BlockEmission.TracksCalls.afterOps {rank incoming : G} {lookup : Nat}
+    {operations : OpsEmission} {control : BlockEmission}
+    (opsTracked : CallsEmitted rank incoming operations.equations operations.queries operations.calls)
+    (ctrlTracked : control.TracksCalls rank) :
+    (control.afterOps incoming lookup operations).TracksCalls rank := by
+  intro part member
+  rcases List.mem_append.mp member with first | last
+  · obtain ⟨edge, edgeMember, equal⟩ := List.mem_map.mp first
+    subst part
+    obtain ⟨query, bytes, equation⟩ := opsTracked edge edgeMember
+    have memberQuery : ∀ message ∈ operations.queries,
+        (control.afterOps incoming lookup operations).HasQuery incoming message := by
+      intro message member
+      obtain ⟨query, queryMember, gate, equal⟩ := queryParts_member lookup incoming member
+      exact ⟨query, List.mem_append_left _ queryMember, gate, equal⟩
+    exact ⟨memberQuery _ query, fun message member => memberQuery message (bytes member),
+      List.mem_append_left _ equation⟩
+  · obtain ⟨query, bytes, equation⟩ := ctrlTracked part last
+    exact ⟨query.mono (fun _ member => List.mem_append_right _ member),
+      fun message member => (bytes message member).mono (fun _ member => List.mem_append_right _ member),
+      List.mem_append_right _ equation⟩
+
+theorem BlockEmission.TracksCalls.join (rank : G) (values : Array RowValue) (column lookup : Nat)
+    (emissions : List BlockEmission) (tracked : ∀ emission ∈ emissions, emission.TracksCalls rank) :
+    (joinBlockEmissions values column lookup emissions).TracksCalls rank := by
+  intro part member
+  obtain ⟨emission, emissionMember, partMember⟩ := List.mem_flatMap.mp member
+  obtain ⟨query, bytes, equation⟩ := tracked emission emissionMember part partMember
+  have included := EmissionIncluded.join values column lookup emissionMember
+  exact ⟨query.mono included.queries, fun message member => (bytes message member).mono included.queries,
+    included.equations equation⟩
+
+theorem BlockEmission.TracksCalls.continued {rank : G} {branches continuation : BlockEmission}
+    (first : branches.TracksCalls rank) (last : continuation.TracksCalls rank) (equations : List G) :
+    (branches.continued equations continuation).TracksCalls rank := by
+  intro part member
+  rcases List.mem_append.mp member with left | right
+  · obtain ⟨query, bytes, equation⟩ := first part left
+    exact ⟨query.mono (fun _ member => List.mem_append_left _ member),
+      fun message member => (bytes message member).mono (fun _ member => List.mem_append_left _ member),
+      List.mem_append_left _ (List.mem_append_left _ equation)⟩
+  · obtain ⟨query, bytes, equation⟩ := last part right
+    exact ⟨query.mono (fun _ member => List.mem_append_right _ member),
+      fun message member => (bytes message member).mono (fun _ member => List.mem_append_right _ member),
+      List.mem_append_right _ equation⟩
+
+theorem BlockEmission.TracksCalls.active {rank : G} {emission : BlockEmission}
+    (tracked : emission.TracksCalls rank)
+    {queries : List (List G)} (queried : emission.QueriesIn queries)
+    {calls : List (Bytecode.AIR.Call × (Fin 6 → G))} (called : emission.CallsAt calls) :
+    CallsEmitted rank 1 emission.equations queries calls := by
+  intro edge member
+  obtain ⟨query, bytes, equation⟩ := tracked (1, edge) (called edge member)
+  exact ⟨query.active queried, fun _ member => (bytes _ member).active queried, equation⟩
+
+theorem forall₂_right_property {α β : Type} {source : List α} {emissions : List β} {property : β → Prop}
+    (related : List.Forall₂ (fun _ emission => property emission) source emissions) :
+    ∀ emission ∈ emissions, property emission := by
+  induction related with
+  | nil => simp
+  | cons first _ ih =>
+    intro emission member
+    rcases List.mem_cons.mp member with equal | tail
+    · subst emission; exact first
+    · exact ih emission tail
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem branchRows_tracks_calls (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (caseSound : ∀ pair ∈ branches.toList, ∀ emission,
+      pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup = some emission →
+      emission.TracksCalls context.rank)
+    (defaultSound : ∀ block, fallback = some block → ∀ emission,
+      block.emitRow row selector context (block.selectorFlow selector).entry values
+        (column + branches.size) lookup = some emission → emission.TracksCalls context.rank) :
+    emission.TracksCalls context.rank := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      have casesTracked : ∀ emission ∈ cases, emission.TracksCalls context.rank := by
+        apply forall₂_right_property
+        apply mapM_forall₂ casesEmitted
+        intro pair member result resultEmitted
+        simp only [caseRow, bind, Option.bind] at resultEmitted
+        split at resultEmitted
+        · cases resultEmitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj resultEmitted
+          subst result
+          exact (caseSound pair member body bodyEmitted).prefix _
+      have defaultTracked : ∀ emission ∈ default, emission.TracksCalls context.rank := by
+        cases fallback with
+        | none =>
+          simp only [defaultRow, Option.some.injEq] at defaultEmitted
+          subst default
+          simp
+        | some block =>
+          simp only [defaultRow, bind, Option.bind] at defaultEmitted
+          split at defaultEmitted
+          · cases defaultEmitted
+          · rename_i body bodyEmitted
+            have equal := Option.some.inj defaultEmitted
+            subst default
+            intro emission member
+            have equal := List.mem_singleton.mp member
+            subst emission
+            exact (defaultSound block rfl body bodyEmitted).prefix _
+      apply BlockEmission.TracksCalls.join
+      intro emission member
+      rcases List.mem_append.mp member with left | right
+      · exact casesTracked emission left
+      · exact defaultTracked emission right
+
+private theorem block_call_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+theorem Ctrl.emitRow_tracks_calls (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (ctrl : Ctrl)
+    {emission : BlockEmission}
+    (emitted : ctrl.emitRow row selector context incoming values column lookup = some emission) :
+    emission.TracksCalls context.rank := by
+  cases ctrl with
+  | «return» index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · have equal := Option.some.inj emitted
+        subst emission
+        simp [BlockEmission.TracksCalls]
+  | yield index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · have equal := Option.some.inj emitted
+      subst emission
+      simp [BlockEmission.TracksCalls]
+  | «match» index branches fallback =>
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      apply branchRows_tracks_calls row selector context matched.value values column lookup branches fallback emitted
+      · intro pair member body bodyEmitted
+        exact Block.emitRow_tracks_calls row selector context _ values column lookup pair.2 bodyEmitted
+      · intro block present body bodyEmitted
+        exact Block.emitRow_tracks_calls row selector context _ values _ lookup block bodyEmitted
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i joined branchesEmitted
+        have branchesTracked := branchRows_tracks_calls row selector context matched.value values column lookup
+          branches fallback branchesEmitted
+          (fun pair member body bodyEmitted =>
+            Block.emitRow_tracks_calls row selector context _ values column lookup pair.2 bodyEmitted)
+          (fun block present body bodyEmitted =>
+            Block.emitRow_tracks_calls row selector context _ values _ lookup block bodyEmitted)
+        simp only [continueRow] at emitted
+        split at emitted
+        · simp only [bind, Option.bind] at emitted
+          split at emitted
+          · cases emitted
+          · rename_i continued contEmitted
+            have contTracked := Block.emitRow_tracks_calls row selector context _ _ _ _ continuation contEmitted
+            have equal := Option.some.inj emitted
+            subst emission
+            exact branchesTracked.continued contTracked _
+        · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr ‹_ ∈ _›); grind)
+
+theorem Block.emitRow_tracks_calls (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission) :
+    emission.TracksCalls context.rank := by
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i operations opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control ctrlEmitted
+      have tracked := Ctrl.emitRow_tracks_calls row selector context incoming _ _ _ block.ctrl ctrlEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      exact (BlockEmission.TracksCalls.afterOps (emitOps_calls opsEmitted) tracked).prefix _
+termination_by sizeOf block
+decreasing_by exact block_call_smaller block
+
+end
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockRowExecution.lean b/Ix/Aiur/Proofs/BlockRowExecution.lean
new file mode 100644
index 000000000..9cd3c81ab
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockRowExecution.lean
@@ -0,0 +1,666 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockRowProjection
+
+/-!
+Execution extraction from the valued block emitter, covering operations,
+case and default selection, early returns, and continuation merges. The
+proof follows the actual emitted equations and logical value map.
+
+Active raw queries must belong to the global lookup pool, and the explicit
+branch and terminal counts must fit the field characteristic. Deriving
+these premises from shared slots and validated native layouts is separate.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem selector_pair_split {α : Type} {parts : List (G × α)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1) :
+    ∃ before chosen after, parts = before ++ chosen :: after ∧ chosen.1 = 1 ∧
+      ∀ part ∈ before ++ after, part.1 = 0 := by
+  obtain ⟨before, after, split, zero⟩ := selectorSum_active_split
+    (fun value member => by
+      obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+      subst value
+      exact individual part partMember)
+    (by simpa only [List.length_map] using bounded) active
+  obtain ⟨first, rest, partsEq, firstEq, restEq⟩ := List.map_eq_append_iff.mp split
+  obtain ⟨chosen, last, tailEq, activeChosen, lastEq⟩ := List.map_eq_cons_iff.mp restEq
+  refine ⟨first, chosen, last, by rw [partsEq, tailEq], activeChosen, ?_⟩
+  intro part member
+  apply zero part.1
+  rcases List.mem_append.mp member with firstMember | lastMember
+  · apply List.mem_append_left
+    rw [← firstEq]
+    exact List.mem_map.mpr ⟨part, firstMember, rfl⟩
+  · apply List.mem_append_right
+    rw [← lastEq]
+    exact List.mem_map.mpr ⟨part, lastMember, rfl⟩
+
+theorem selector_pair_chosen {α : Type} {parts : List (G × α)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1)
+    {chosen : G × α} (member : chosen ∈ parts) (selected : chosen.1 = 1) :
+    ∃ before after, parts = before ++ chosen :: after ∧
+      ∀ part ∈ before ++ after, part.1 = 0 := by
+  obtain ⟨before, other, after, equal, _, zero⟩ := selector_pair_split individual bounded active
+  rw [equal] at member
+  rcases List.mem_append.mp member with left | tail
+  · have inactive := zero chosen (List.mem_append_left _ left)
+    exact False.elim (G.one_ne_zero (selected.symm.trans inactive))
+  · rcases List.mem_cons.mp tail with same | right
+    · subst chosen
+      exact ⟨before, after, equal, zero⟩
+    · have inactive := zero chosen (List.mem_append_right _ right)
+      exact False.elim (G.one_ne_zero (selected.symm.trans inactive))
+
+theorem selector_weighted_zero {α : Type} (read : α → G) {parts : List (G × α)}
+    (zero : ∀ part ∈ parts, part.1 = 0) :
+    selectorSum (parts.map fun part => part.1 * read part.2) = 0 := by
+  induction parts with
+  | nil => rfl
+  | cons part parts ih =>
+    rw [List.map_cons, selectorSum_cons, zero part List.mem_cons_self,
+      G.mul_comm 0, G.mul_zero, G.zero_add]
+    exact ih (fun part member => zero part (List.mem_cons_of_mem _ member))
+
+theorem selector_weighted_chosen {α : Type} (read : α → G) {parts : List (G × α)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1)
+    {chosen : G × α} (member : chosen ∈ parts) (selected : chosen.1 = 1) :
+    selectorSum (parts.map fun part => part.1 * read part.2) = read chosen.2 := by
+  obtain ⟨before, after, equal, zero⟩ := selector_pair_chosen individual bounded active member selected
+  rw [equal, List.map_append, selectorSum_append,
+    selector_weighted_zero read (fun part member => zero part (List.mem_append_left _ member)),
+    G.zero_add, List.map_cons, selectorSum_cons,
+    selector_weighted_zero read (fun part member => zero part (List.mem_append_right _ member)),
+    G.add_zero, selected, G.mul_comm, G.mul_one]
+
+theorem mergeEquations_chosen (row : Nat → G) {parent : G} {column size : Nat}
+    {parts : List (G × Array RowValue)} (parentActive : parent = 1)
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1)
+    {chosen : Array RowValue} (member : (1, chosen) ∈ parts) (width : chosen.size = size)
+    (equations : ∀ equation ∈ mergeEquations row parent column size parts, equation = 0) :
+    rowValues (rowAdvice row column size) = rowValues chosen := by
+  apply Array.ext (by
+    rw [rowValues_advice_size]
+    simpa only [rowValues, Array.size_map] using width.symm)
+  intro index leftBound rightBound
+  have bound : index < size := by simpa only [rowValues_advice_size] using leftBound
+  have polynomial := equations _ (List.mem_map.mpr ⟨index, List.mem_range.mpr bound, rfl⟩)
+  change parent * (row (column + index) - selectorSum
+    (parts.map fun part => part.1 * (rowValues part.2)[index]?.getD 0)) = 0 at polynomial
+  rw [selector_weighted_chosen (fun values => (rowValues values)[index]?.getD 0)
+    individual bounded active member rfl] at polynomial
+  have equal := active_case parentActive polynomial
+  rw [Array.getElem?_eq_getElem rightBound, Option.getD_some] at equal
+  simpa only [rowValues, rowAdvice, Array.getElem_map, Array.getElem_ofFn,
+    RowValue.variable, Fin.getElem_fin] using equal
+
+def BlockEmission.QueriesIn (emission : BlockEmission) (queries : List (List G)) : Prop :=
+  ∀ part ∈ emission.queries, part.selector = 1 → part.message ∈ queries
+
+def BlockEmission.CallsAt (emission : BlockEmission)
+    (calls : List (Bytecode.AIR.Call × (Fin 6 → G))) : Prop :=
+  ∀ edge ∈ calls, (1, edge) ∈ emission.calls
+
+def BlockEmission.TerminalAt (emission : BlockEmission) : Bytecode.AIR.Outcome → Prop
+  | .returned outputs => ∃ request, (1, request) ∈ emission.returns ∧ request.outputs = outputs
+  | .yielded outputs => ∃ yielded, (1, yielded) ∈ emission.yields ∧ rowValues yielded = outputs
+
+structure EmissionIncluded (part whole : BlockEmission) : Prop where
+  equations : part.equations ⊆ whole.equations
+  queries : part.queries ⊆ whole.queries
+  returns : part.returns ⊆ whole.returns
+  yields : part.yields ⊆ whole.yields
+  calls : part.calls ⊆ whole.calls
+
+theorem EmissionIncluded.refl (emission : BlockEmission) : EmissionIncluded emission emission :=
+  ⟨List.Subset.refl _, List.Subset.refl _, List.Subset.refl _, List.Subset.refl _, List.Subset.refl _⟩
+
+theorem EmissionIncluded.trans {first middle last : BlockEmission}
+    (left : EmissionIncluded first middle) (right : EmissionIncluded middle last) :
+    EmissionIncluded first last :=
+  ⟨left.equations.trans right.equations, left.queries.trans right.queries,
+    left.returns.trans right.returns, left.yields.trans right.yields, left.calls.trans right.calls⟩
+
+theorem EmissionIncluded.prefix (emission : BlockEmission) (equations : List G) :
+    EmissionIncluded emission (emission.prefix equations) :=
+  ⟨fun _ member => List.mem_append_right _ member, List.Subset.refl _,
+    List.Subset.refl _, List.Subset.refl _, List.Subset.refl _⟩
+
+theorem EmissionIncluded.join (values : Array RowValue) (column lookup : Nat)
+    {emissions : List BlockEmission} {emission : BlockEmission} (member : emission ∈ emissions) :
+    EmissionIncluded emission (joinBlockEmissions values column lookup emissions) := by
+  constructor <;> exact fun _ present => List.mem_flatMap.mpr ⟨emission, member, present⟩
+
+theorem EmissionIncluded.satisfied {part whole : BlockEmission} (included : EmissionIncluded part whole)
+    (satisfied : ∀ equation ∈ whole.equations, equation = 0) :
+    ∀ equation ∈ part.equations, equation = 0 :=
+  fun equation member => satisfied equation (included.equations member)
+
+theorem EmissionIncluded.queried {part whole : BlockEmission} (included : EmissionIncluded part whole)
+    {queries : List (List G)} (queried : whole.QueriesIn queries) : part.QueriesIn queries :=
+  fun query member active => queried query (included.queries member) active
+
+theorem EmissionIncluded.terminal {part whole : BlockEmission} (included : EmissionIncluded part whole)
+    {outcome : Bytecode.AIR.Outcome} (terminal : part.TerminalAt outcome) : whole.TerminalAt outcome := by
+  cases outcome with
+  | returned outputs =>
+    obtain ⟨request, member, equal⟩ := terminal
+    exact ⟨request, included.returns member, equal⟩
+  | yielded outputs =>
+    obtain ⟨values, member, equal⟩ := terminal
+    exact ⟨values, included.yields member, equal⟩
+
+theorem EmissionIncluded.called {part whole : BlockEmission} (included : EmissionIncluded part whole)
+    {calls : List (Bytecode.AIR.Call × (Fin 6 → G))} (called : part.CallsAt calls) : whole.CallsAt calls :=
+  fun edge member => included.calls (called edge member)
+
+theorem forall₂_left_member {α β : Type} {relation : α → β → Prop} {source : List α}
+    {emissions : List β} (related : List.Forall₂ relation source emissions) {item : α}
+    (member : item ∈ source) : ∃ emission ∈ emissions, relation item emission := by
+  induction related with
+  | nil => cases member
+  | @cons head emission heads emissions first rest ih =>
+    rcases List.mem_cons.mp member with equal | tail
+    · subst item
+      exact ⟨emission, List.mem_cons_self, first⟩
+    · obtain ⟨body, bodyMember, correct⟩ := ih tail
+      exact ⟨body, List.mem_cons_of_mem _ bodyMember, correct⟩
+
+theorem mapM_member {α β : Type} {source : List α} {emissions : List β} {emit : α → Option β}
+    (emitted : source.mapM emit = some emissions) {item : α} (member : item ∈ source) :
+    ∃ emission ∈ emissions, emit item = some emission :=
+  forall₂_left_member (mapM_forall₂ emitted (fun _ _ _ equal => equal)) member
+
+theorem mapM_of_forall₂ {α β : Type} {source : List α} {emissions : List β} {emit : α → Option β}
+    (related : List.Forall₂ (fun item emission => emit item = some emission) source emissions) :
+    source.mapM emit = some emissions := by
+  induction related with
+  | nil => rfl
+  | cons first _ ih => rw [List.mapM_cons, first, ih]; rfl
+
+theorem readRowValues (values : Array RowValue) (indices : Array ValIdx) (outputs : List RowValue)
+    (read : indices.toList.mapM (fun index => values[index]?) = some outputs) :
+    Bytecode.AIR.readValues (rowValues values) indices = some (rowValues outputs.toArray) := by
+  have related := mapM_forall₂ read (fun _ _ _ equal => equal)
+  have mapped : List.Forall₂ (fun index value => (rowValues values)[index]? = some value)
+      indices.toList (outputs.map RowValue.value) := by
+    generalize sourceEq : indices.toList = source at related ⊢
+    clear read sourceEq
+    induction related with
+    | nil => exact .nil
+    | cons first _ ih => exact .cons (rowValues_read first) ih
+  have result := mapM_of_forall₂ mapped
+  have listResult : (Array.toList <$> Bytecode.AIR.readValues (rowValues values) indices) =
+      some (rowValues outputs.toArray).toList := by
+    rw [Bytecode.AIR.readValues, Array.toList_mapM]
+    simpa only [rowValues, Array.toList_map, List.toList_toArray] using result
+  cases emitted : Bytecode.AIR.readValues (rowValues values) indices with
+  | none => rw [emitted] at listResult; cases listResult
+  | some array =>
+    rw [emitted] at listResult
+    have equal := Array.toList_inj.mp (Option.some.inj listResult)
+    exact congrArg some equal
+
+theorem queryParts_member (slot : Nat) (selector : G) {queries : List (List G)} {message : List G}
+    (member : message ∈ queries) :
+    ∃ part ∈ queryParts slot selector queries, part.selector = selector ∧ part.message = message := by
+  obtain ⟨index, bound, equal⟩ := List.mem_iff_getElem.mp member
+  refine ⟨⟨slot + index, selector, message⟩, ?_, rfl, rfl⟩
+  exact List.mem_mapIdx.mpr ⟨index, bound, by rw [equal]⟩
+
+theorem EmissionIncluded.afterOps (incoming : G) (lookup : Nat) (operations : OpsEmission)
+    (control : BlockEmission) : EmissionIncluded control (control.afterOps incoming lookup operations) :=
+  ⟨fun _ member => List.mem_append_right _ member,
+    fun _ member => List.mem_append_right _ member, List.Subset.refl _, List.Subset.refl _,
+    fun _ member => List.mem_append_right _ member⟩
+
+theorem BlockEmission.afterOps_queried {incoming : G} {lookup : Nat} {operations : OpsEmission}
+    {control : BlockEmission} {queries : List (List G)} (active : incoming = 1)
+    (queried : (control.afterOps incoming lookup operations).QueriesIn queries) :
+    operations.queries ⊆ queries := by
+  intro message member
+  obtain ⟨part, partMember, gate, equal⟩ := queryParts_member lookup incoming member
+  rw [← equal]
+  exact queried part (List.mem_append_left _ partMember) (gate.trans active)
+
+theorem BlockEmission.afterOps_called {incoming : G} {lookup : Nat} {operations : OpsEmission}
+    {control : BlockEmission} {calls : List (Bytecode.AIR.Call × (Fin 6 → G))}
+    (active : incoming = 1) (called : control.CallsAt calls) :
+    (control.afterOps incoming lookup operations).CallsAt (operations.calls ++ calls) := by
+  intro edge member
+  rcases List.mem_append.mp member with first | rest
+  · exact List.mem_append_left _ (List.mem_map.mpr ⟨edge, first, by rw [active]⟩)
+  · exact List.mem_append_right _ (called edge rest)
+
+theorem EmissionIncluded.continued (branches : BlockEmission) (equations : List G)
+    (continuation : BlockEmission) : EmissionIncluded continuation (branches.continued equations continuation) :=
+  ⟨fun _ member => List.mem_append_right _ member,
+    fun _ member => List.mem_append_right _ member,
+    fun _ member => List.mem_append_right _ member, List.Subset.refl _,
+    fun _ member => List.mem_append_right _ member⟩
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+private theorem row_bounds_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def Ctrl.rowBounds (selector : SelIdx → G) : Ctrl → Prop
+  | .return .. | .yield .. => True
+  | .match _ branches fallback =>
+    branches.size + fallback.toList.length < gSize.toNat ∧
+      (∀ pair ∈ branches.toList, pair.2.rowBounds selector) ∧
+      (match fallback with | none => True | some block => block.rowBounds selector)
+  | .matchContinue _ branches fallback _ _ _ continuation =>
+    let flow := SelectorFlow.join (branchSelectorFlows selector branches fallback)
+    branches.size + fallback.toList.length < gSize.toNat ∧
+      flow.returns.length + flow.yields.length < gSize.toNat ∧
+      (∀ pair ∈ branches.toList, pair.2.rowBounds selector) ∧
+      (match fallback with | none => True | some block => block.rowBounds selector) ∧
+      continuation.rowBounds selector
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr ‹_ ∈ _›); grind)
+
+def Block.rowBounds (selector : SelIdx → G) (block : Block) : Prop :=
+  block.ctrl.rowBounds selector
+termination_by sizeOf block
+decreasing_by exact row_bounds_smaller block
+
+end
+
+theorem AIR.SelectArm.rowBounds {selector : SelIdx → G} {matched : G}
+    {branches : Array (G × Block)} {fallback : Option Block} {block : Block}
+    (selected : SelectArm matched branches fallback block)
+    (casesBounded : ∀ pair ∈ branches.toList, pair.2.rowBounds selector)
+    (fallbackBounded : ∀ block, fallback = some block → block.rowBounds selector) :
+    block.rowBounds selector := by
+  cases selected with
+  | case member => exact casesBounded _ member
+  | fallback present unmatched => exact fallbackBounded block present
+
+theorem AIR.SelectArm.smaller_match {matched : G} {branches : Array (G × Block)}
+    {fallback : Option Block} {block : Block} (selected : SelectArm matched branches fallback block)
+    (index : ValIdx) : sizeOf block < sizeOf (Ctrl.match index branches fallback) := by
+  cases selected with
+  | case member =>
+    have bound := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member)
+    simp only [Prod.mk.sizeOf_spec, Ctrl.match.sizeOf_spec] at *
+    omega
+  | fallback present unmatched => rw [present]; simp; omega
+
+theorem AIR.SelectArm.smaller_matchContinue {matched : G} {branches : Array (G × Block)}
+    {fallback : Option Block} {block : Block} (selected : SelectArm matched branches fallback block)
+    (index : ValIdx) (size aux slots : Nat) (continuation : Block) :
+    sizeOf block < sizeOf (Ctrl.matchContinue index branches fallback size aux slots continuation) := by
+  cases selected with
+  | case member =>
+    have bound := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member)
+    simp only [Prod.mk.sizeOf_spec, Ctrl.matchContinue.sizeOf_spec] at *
+    omega
+  | fallback present unmatched => rw [present]; simp; omega
+
+theorem branchRows_polynomials (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    MatchPolynomials selector matched branches fallback := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      constructor
+      · intro pair member
+        obtain ⟨result, resultMember, resultEmitted⟩ := mapM_member casesEmitted member
+        simp only [caseRow, bind, Option.bind] at resultEmitted
+        split at resultEmitted
+        · cases resultEmitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj resultEmitted
+          subst result
+          exact satisfied _ ((EmissionIncluded.join values column lookup
+            (List.mem_append_left _ resultMember)).equations List.mem_cons_self)
+      · intro block present pair member
+        rw [present] at defaultEmitted
+        simp only [defaultRow, bind, Option.bind] at defaultEmitted
+        split at defaultEmitted
+        · cases defaultEmitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj defaultEmitted
+          subst default
+          obtain ⟨index, bound, selected⟩ := List.mem_iff_getElem.mp member
+          refine ⟨row (column + index), ?_⟩
+          apply satisfied
+          apply (EmissionIncluded.join values column lookup
+            (List.mem_append_right cases List.mem_cons_self)).equations
+          apply List.mem_append_left
+          exact List.mem_mapIdx.mpr ⟨index, bound, by rw [selected]⟩
+
+theorem branchRows_body (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    {block : Block} (selected : AIR.SelectArm matched branches fallback block) :
+    ∃ bodyColumn body,
+      block.emitRow row selector context (block.selectorFlow selector).entry values bodyColumn lookup = some body ∧
+      EmissionIncluded body emission := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      cases selected with
+      | case member =>
+        obtain ⟨result, resultMember, resultEmitted⟩ := mapM_member casesEmitted member
+        simp only [caseRow, bind, Option.bind] at resultEmitted
+        split at resultEmitted
+        · cases resultEmitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj resultEmitted
+          subst result
+          exact ⟨column, body, bodyEmitted,
+            (EmissionIncluded.prefix body _).trans
+              (EmissionIncluded.join values column lookup (List.mem_append_left _ resultMember))⟩
+      | fallback present unmatched =>
+        rw [present] at defaultEmitted
+        simp only [defaultRow, bind, Option.bind] at defaultEmitted
+        split at defaultEmitted
+        · cases defaultEmitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj defaultEmitted
+          subst default
+          exact ⟨column + branches.size, body, bodyEmitted,
+            (EmissionIncluded.prefix body _).trans
+              (EmissionIncluded.join values column lookup
+                (List.mem_append_right _ List.mem_cons_self))⟩
+
+theorem branchRows_selector_projection (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission) :
+    EmissionProjection (SelectorFlow.join (branchSelectorFlows selector branches fallback))
+      (branchReturnGates selector branches fallback) emission :=
+  branchRows_projection row selector context matched values column lookup branches fallback emitted
+    (fun pair _ _ bodyEmitted => pair.2.emitRow_projection row selector context _ _ _ _ bodyEmitted)
+    (fun block _ _ bodyEmitted => block.emitRow_projection row selector context _ _ _ _ bodyEmitted)
+
+theorem branchRows_selected (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (bounded : branches.size + fallback.toList.length < gSize.toNat)
+    (active : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).entry = 1) :
+    ∃ block bodyColumn body, AIR.SelectArm matched branches fallback block ∧
+      (block.selectorFlow selector).entry = 1 ∧
+      block.emitRow row selector context (block.selectorFlow selector).entry values bodyColumn lookup = some body ∧
+      EmissionIncluded body emission := by
+  have projected := branchRows_selector_projection row selector context matched values column lookup
+    branches fallback emitted
+  have polynomials := branchRows_polynomials row selector context matched values column lookup
+    branches fallback emitted satisfied
+  obtain ⟨block, selected, _, blockActive⟩ := polynomials.active_branch
+    (fun equation member => satisfied equation (projected.equations member)) bounded active
+  obtain ⟨bodyColumn, body, bodyEmitted, included⟩ := branchRows_body row selector context matched values
+    column lookup branches fallback emitted selected
+  exact ⟨block, bodyColumn, body, selected, blockActive, bodyEmitted, included⟩
+
+mutual
+
+theorem Ctrl.emitRow_run {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (program : Toplevel) (yieldSize : Option Nat)
+    (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (ctrl : Ctrl)
+    (shape : ctrl.lookupShapes program yieldSize = true) (bounds : ctrl.rowBounds selector)
+    {emission : BlockEmission}
+    (emitted : ctrl.emitRow row selector context incoming values column lookup = some emission)
+    (active : incoming = 1) (linked : incoming = (ctrl.selectorFlow selector).entry)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) (queried : emission.QueriesIn queries) :
+    ∃ outcome calls,
+      AIR.RunCtrl (memoryFacts tables.memory) ctrl (rowValues values) outcome (calls.map Prod.fst) ∧
+      emission.TerminalAt outcome ∧ emission.CallsAt calls := by
+  cases ctrl with
+  | «return» index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i inputs readInputs
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i outputs readOutputs
+        have equal := Option.some.inj emitted
+        subst emission
+        refine ⟨.returned outputs, [], AIR.RunCtrl.returned readOutputs, ?_, by simp [BlockEmission.CallsAt]⟩
+        refine ⟨⟨context.function, inputs, outputs, context.rank⟩, ?_, rfl⟩
+        change (1, _) ∈ [(incoming, _)]
+        rw [active]
+        exact List.mem_cons_self
+  | yield index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i outputs readOutputs
+      have equal := Option.some.inj emitted
+      subst emission
+      rw [Ctrl.selectorFlow.eq_def] at linked
+      have selected : selector index = 1 := linked.symm.trans active
+      refine ⟨.yielded (rowValues outputs.toArray), [],
+        AIR.RunCtrl.yielded (readRowValues values indices outputs readOutputs), ?_,
+        by simp [BlockEmission.CallsAt]⟩
+      exact ⟨outputs.toArray, by change (1, _) ∈ [(selector index, _)]; rw [selected]; exact List.mem_cons_self, rfl⟩
+  | «match» index branches fallback =>
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      rw [Ctrl.rowBounds.eq_def] at bounds
+      obtain ⟨branchBound, casesBounded, fallbackBounded⟩ := bounds
+      obtain ⟨casesShape, fallbackShape⟩ := (lookupShapes_match _ _ _ _ _).mp shape
+      rw [Ctrl.selectorFlow_match] at linked
+      obtain ⟨arm, bodyColumn, body, selected, armActive, bodyEmitted, included⟩ :=
+        branchRows_selected row selector context matched.value values column lookup branches fallback
+          emitted satisfied branchBound (linked.symm.trans active)
+      have smaller := selected.smaller_match index
+      obtain ⟨outcome, calls, execution, terminal, called⟩ := Block.emitRow_run global memoryValid canonical
+        program yieldSize row selector context _ values bodyColumn lookup arm
+        (selected.lookupShapes program yieldSize casesShape fallbackShape)
+        (selected.rowBounds casesBounded (fun block present => by
+          rw [present] at fallbackBounded; exact fallbackBounded)) bodyEmitted armActive rfl
+        (included.satisfied satisfied) (included.queried queried)
+      exact ⟨outcome, calls, AIR.RunCtrl.match (rowValues_read read) selected execution,
+        included.terminal terminal, included.called called⟩
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i joined branchesEmitted
+        simp only [continueRow] at emitted
+        split at emitted
+        · rename_i sizes
+          simp only [bind, Option.bind] at emitted
+          split at emitted
+          · cases emitted
+          · rename_i continued contEmitted
+            have equal := Option.some.inj emitted
+            subst emission
+            rw [Ctrl.rowBounds.eq_def] at bounds
+            obtain ⟨branchBound, terminalBound, casesBounded, fallbackBounded, contBounded⟩ := bounds
+            obtain ⟨casesShape, fallbackShape, contShape⟩ :=
+              (lookupShapes_matchContinue _ _ _ _ _ _ _ _ _).mp shape
+            rw [Ctrl.selectorFlow_matchContinue] at linked
+            have joinedActive : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).entry = 1 :=
+              linked.symm.trans active
+            have joinedSatisfied : ∀ equation ∈ joined.equations, equation = 0 :=
+              fun equation member => satisfied equation
+                (List.mem_append_left _ (List.mem_append_left _ member))
+            have joinedQueried : joined.QueriesIn queries :=
+              fun part member gate => queried part (List.mem_append_left _ member) gate
+            obtain ⟨arm, bodyColumn, body, selected, armActive, bodyEmitted, included⟩ :=
+              branchRows_selected row selector context matched.value values column lookup branches fallback
+                branchesEmitted joinedSatisfied branchBound joinedActive
+            have smaller := selected.smaller_matchContinue index size aux slots continuation
+            obtain ⟨outcome, calls, execution, terminal, called⟩ := Block.emitRow_run global memoryValid canonical
+              program (some size) row selector context _ values bodyColumn lookup arm
+              (selected.lookupShapes program (some size) casesShape fallbackShape)
+              (selected.rowBounds casesBounded (fun block present => by
+                rw [present] at fallbackBounded; exact fallbackBounded)) bodyEmitted armActive rfl
+              (included.satisfied joinedSatisfied) (included.queried joinedQueried)
+            have joinedTerminal := included.terminal terminal
+            have joinedCalls := included.called called
+            cases outcome with
+            | returned outputs =>
+              refine ⟨.returned outputs, calls,
+                AIR.RunCtrl.matchContinueReturn (rowValues_read read) selected execution, ?_, ?_⟩
+              · obtain ⟨request, member, equal⟩ := joinedTerminal
+                exact ⟨request, List.mem_append_left _ member, equal⟩
+              · exact fun edge member => List.mem_append_left _ (joinedCalls edge member)
+            | yielded outputs =>
+              obtain ⟨yielded, yieldMember, yieldEqual⟩ := joinedTerminal
+              have projected := branchRows_selector_projection row selector context matched.value values column lookup
+                branches fallback branchesEmitted
+              have flowValid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied :=
+                fun equation member => joinedSatisfied equation (projected.equations member)
+              have flowSound := branchSelectorFlows_sound selector branches fallback flowValid
+                (fun pair _ valid => pair.2.selectorFlow_sound selector valid)
+                (fun block _ valid => block.selectorFlow_sound selector valid)
+              have oneYield : (1 : G) ∈ (SelectorFlow.join (branchSelectorFlows selector branches fallback)).yields := by
+                rw [← projected.yielded]
+                exact List.mem_map.mpr ⟨(1, yielded), yieldMember, rfl⟩
+              have gateOne : selectorSum (joined.yields.map Prod.fst) = 1 := by
+                rw [projected.yielded]
+                exact flowSound.yield_starts_continuation terminalBound joinedActive oneYield
+              have link : (continuation.selectorFlow selector).entry = selectorSum (joined.yields.map Prod.fst) := by
+                apply (G.sub_eq_zero_iff _ _).mp
+                apply satisfied
+                exact List.mem_append_left _ (List.mem_append_right _
+                  (List.mem_append_right _ List.mem_cons_self))
+              have yieldWidth : yielded.size = size :=
+                beq_iff_eq.mp ((List.all_eq_true.mp sizes) _ yieldMember)
+              have yieldBound : joined.yields.length < gSize.toNat := by
+                have lengths := congrArg List.length projected.yielded
+                simp only [List.length_map] at lengths
+                omega
+              have yieldBoolean : ∀ part ∈ joined.yields, booleanConstraint part.1 = 0 := by
+                intro part member
+                apply flowSound.yielded
+                rw [← projected.yielded]
+                exact List.mem_map.mpr ⟨part, member, rfl⟩
+              have mergeValues := mergeEquations_chosen row active yieldBoolean yieldBound gateOne
+                yieldMember yieldWidth (fun equation member => satisfied equation
+                  (List.mem_append_left _ (List.mem_append_right _ (List.mem_append_left _ member))))
+              have contIncluded := EmissionIncluded.continued joined
+                (mergeEquations row incoming joined.column size joined.yields ++
+                  [(continuation.selectorFlow selector).entry - selectorSum (joined.yields.map Prod.fst)]) continued
+              obtain ⟨result, contCalls, contRun, contTerminal, contCallsAt⟩ :=
+                Block.emitRow_run global memoryValid canonical program yieldSize row selector context _ _ _ _
+                  continuation contShape contBounded contEmitted gateOne link.symm
+                  (contIncluded.satisfied satisfied) (contIncluded.queried queried)
+              rw [rowValues_append, mergeValues, yieldEqual] at contRun
+              have outputSize : outputs.size = size := by
+                rw [← yieldEqual]
+                simpa only [rowValues, Array.size_map] using yieldWidth
+              refine ⟨result, calls ++ contCalls, ?_, contIncluded.terminal contTerminal, ?_⟩
+              · simpa only [List.map_append] using
+                  AIR.RunCtrl.matchContinueYield (rowValues_read read) selected execution outputSize contRun
+              · intro edge member
+                rcases List.mem_append.mp member with first | last
+                · exact List.mem_append_left _ (joinedCalls edge first)
+                · exact List.mem_append_right _ (contCallsAt edge last)
+        · cases emitted
+termination_by sizeOf ctrl
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem Block.emitRow_run {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (program : Toplevel) (yieldSize : Option Nat)
+    (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    (shape : block.lookupShapes program yieldSize = true) (bounds : block.rowBounds selector)
+    {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission)
+    (active : incoming = 1) (linked : incoming = (block.selectorFlow selector).entry)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) (queried : emission.QueriesIn queries) :
+    ∃ outcome calls,
+      AIR.RunBlock (memoryFacts tables.memory) block (rowValues values) outcome (calls.map Prod.fst) ∧
+      emission.TerminalAt outcome ∧ emission.CallsAt calls := by
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i operations opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control ctrlEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      have tailIncluded := EmissionIncluded.prefix (control.afterOps incoming lookup operations)
+        [oneSubBooleanConstraint (block.selectorFlow selector).entry]
+      have controlIncluded := (EmissionIncluded.afterOps incoming lookup operations control).trans tailIncluded
+      rw [Block.lookupShapes, Bool.and_eq_true] at shape
+      have opsRun := emitOps_run global memoryValid canonical
+        (fun op member => (Array.all_eq_true'.mp shape.1) op (Array.mem_def.mpr member))
+        opsEmitted active
+        (fun equation member => (tailIncluded.satisfied satisfied) equation (List.mem_append_left _ member))
+        (BlockEmission.afterOps_queried active (tailIncluded.queried queried))
+      obtain ⟨outcome, calls, ctrlRun, terminal, called⟩ := Ctrl.emitRow_run global memoryValid canonical
+        program yieldSize row selector context incoming _ _ _ block.ctrl shape.2
+        (by rwa [Block.rowBounds] at bounds) ctrlEmitted active
+        (by simpa only [Block.selectorFlow] using linked)
+        (controlIncluded.satisfied satisfied) (controlIncluded.queried queried)
+      refine ⟨outcome, operations.calls ++ calls, ?_, controlIncluded.terminal terminal, ?_⟩
+      · simpa only [List.map_append] using AIR.RunBlock.block opsRun ctrlRun
+      · exact tailIncluded.called (BlockEmission.afterOps_called active called)
+termination_by sizeOf block
+decreasing_by exact row_bounds_smaller block
+
+end
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockRowInputs.lean b/Ix/Aiur/Proofs/BlockRowInputs.lean
new file mode 100644
index 000000000..22870e7e6
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockRowInputs.lean
@@ -0,0 +1,312 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockRowCalls
+
+/-!
+Input-prefix preservation through the valued block emitter. Operation
+outputs and continuation merges append logical values, while branch joins
+restore their incoming scope. Every emitted return therefore identifies
+the original function, inputs and rank, including on inactive branches.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem option_array_eq_of_toList {α : Type} {result : Option (Array α)} {expected : Array α}
+    (equal : (Array.toList <$> result) = some expected.toList) : result = some expected := by
+  cases result with
+  | none => cases equal
+  | some array => exact congrArg some (Array.toList_inj.mp (Option.some.inj equal))
+
+theorem forall₂_imp {α β : Type} {source : List α} {target : List β}
+    {first last : α → β → Prop} (related : List.Forall₂ first source target)
+    (implies : ∀ left right, first left right → last left right) :
+    List.Forall₂ last source target := by
+  induction related with
+  | nil => exact .nil
+  | cons head _ ih => exact .cons (implies _ _ head) ih
+
+theorem forall₂_of_get {α β : Type} {source : List α} {target : List β} {relation : α → β → Prop}
+    (sizes : source.length = target.length)
+    (related : ∀ index (leftBound : index < source.length) (rightBound : index < target.length),
+      relation source[index] target[index]) : List.Forall₂ relation source target := by
+  induction source generalizing target with
+  | nil =>
+    have empty : target = [] := List.eq_nil_of_length_eq_zero sizes.symm
+    subst target
+    exact .nil
+  | cons head tail ih =>
+    cases target with
+    | nil => simp at sizes
+    | cons first rest =>
+      refine .cons (related 0 (by simp) (by simp)) ?_
+      apply ih (Nat.succ.inj sizes)
+      intro index leftBound rightBound
+      exact related (index + 1) (by simpa using leftBound) (by simpa using rightBound)
+
+theorem readValues_append {values extra : Array G} {indices : Array ValIdx} {outputs : Array G}
+    (read : Bytecode.AIR.readValues values indices = some outputs) :
+    Bytecode.AIR.readValues (values ++ extra) indices = some outputs := by
+  have listRead := congrArg (Functor.map Array.toList) read
+  rw [Bytecode.AIR.readValues, Array.toList_mapM] at listRead
+  have related := mapM_forall₂ listRead (fun _ _ _ equal => equal)
+  have lifted := forall₂_imp related (last := fun index value => (values ++ extra)[index]? = some value)
+    (fun index value present => by
+      have bound := (Array.getElem?_eq_some_iff.mp present).choose
+      rw [Array.getElem?_append_left bound]
+      exact present)
+  apply option_array_eq_of_toList
+  rw [Bytecode.AIR.readValues, Array.toList_mapM]
+  exact mapM_of_forall₂ lifted
+
+theorem readValues_range (values : Array G) :
+    Bytecode.AIR.readValues values (Array.range values.size) = some values := by
+  apply option_array_eq_of_toList
+  rw [Bytecode.AIR.readValues, Array.toList_mapM]
+  apply mapM_of_forall₂
+  apply forall₂_of_get (by simp)
+  intro index leftBound rightBound
+  have bound : index < values.size := by simpa only [Array.length_toList] using rightBound
+  simpa only [Array.getElem_toList, Array.getElem_range] using Array.getElem?_eq_getElem bound
+
+def RowInputs (size : Nat) (inputs : Array G) (values : Array RowValue) : Prop :=
+  Bytecode.AIR.readValues (rowValues values) (Array.range size) = some inputs
+
+theorem RowInputs.append {size : Nat} {inputs : Array G} {values extra : Array RowValue}
+    (preserved : RowInputs size inputs values) : RowInputs size inputs (values ++ extra) := by
+  unfold RowInputs at *
+  rw [rowValues_append]
+  exact readValues_append preserved
+
+theorem RowInputs.full (values : Array RowValue) : RowInputs values.size (rowValues values) values := by
+  have read := readValues_range (rowValues values)
+  simpa only [RowInputs, rowValues, Array.size_map] using read
+
+theorem emitOps_inputs {row : Nat → G} {selector rank : G} {ops : List Op}
+    {values : Array RowValue} {column : Nat} {emission : OpsEmission}
+    (emitted : emitOps row selector rank ops values column = some emission)
+    {size : Nat} {inputs : Array G} (preserved : RowInputs size inputs values) :
+    RowInputs size inputs emission.values := by
+  induction ops generalizing values column emission with
+  | nil =>
+    simp only [emitOps, Option.some.injEq] at emitted
+    subst emission
+    exact preserved
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i first firstEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i rest restEmitted
+        have equal := Option.some.inj emitted
+        subst emission
+        change RowInputs size inputs rest.values
+        exact ih restEmitted preserved.append
+
+structure InputPreservation (context : RowContext) (inputs : Array G) (emission : BlockEmission) : Prop where
+  values : RowInputs context.inputSize inputs emission.values
+  returned : ∀ part ∈ emission.returns,
+    part.2.function = context.function ∧ part.2.inputs = inputs ∧ part.2.rank = context.rank
+
+theorem InputPreservation.prefix {context : RowContext} {inputs : Array G} {emission : BlockEmission}
+    (preserved : InputPreservation context inputs emission) (equations : List G) :
+    InputPreservation context inputs (emission.prefix equations) :=
+  ⟨preserved.values, preserved.returned⟩
+
+theorem InputPreservation.afterOps {context : RowContext} {inputs : Array G} {control : BlockEmission}
+    (preserved : InputPreservation context inputs control) (incoming : G) (lookup : Nat)
+    (operations : OpsEmission) : InputPreservation context inputs (control.afterOps incoming lookup operations) :=
+  ⟨preserved.values, preserved.returned⟩
+
+theorem InputPreservation.join {context : RowContext} {inputs : Array G} {values : Array RowValue}
+    (initial : RowInputs context.inputSize inputs values) (column lookup : Nat) (emissions : List BlockEmission)
+    (preserved : ∀ emission ∈ emissions, InputPreservation context inputs emission) :
+    InputPreservation context inputs (joinBlockEmissions values column lookup emissions) := by
+  refine ⟨initial, ?_⟩
+  intro part member
+  obtain ⟨emission, emissionMember, partMember⟩ := List.mem_flatMap.mp member
+  exact (preserved emission emissionMember).returned part partMember
+
+theorem InputPreservation.continued {context : RowContext} {inputs : Array G}
+    {branches continuation : BlockEmission}
+    (first : InputPreservation context inputs branches) (last : InputPreservation context inputs continuation)
+    (equations : List G) : InputPreservation context inputs (branches.continued equations continuation) := by
+  refine ⟨last.values, ?_⟩
+  intro part member
+  rcases List.mem_append.mp member with left | right
+  · exact first.returned part left
+  · exact last.returned part right
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem branchRows_inputs (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    {inputs : Array G} (initial : RowInputs context.inputSize inputs values)
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (caseSound : ∀ pair ∈ branches.toList, ∀ emission,
+      pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup = some emission →
+      InputPreservation context inputs emission)
+    (defaultSound : ∀ block, fallback = some block → ∀ emission,
+      block.emitRow row selector context (block.selectorFlow selector).entry values
+        (column + branches.size) lookup = some emission → InputPreservation context inputs emission) :
+    InputPreservation context inputs emission := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      have casesPreserved : ∀ emission ∈ cases, InputPreservation context inputs emission := by
+        apply forall₂_right_property
+        apply mapM_forall₂ casesEmitted
+        intro pair member result resultEmitted
+        simp only [caseRow, bind, Option.bind] at resultEmitted
+        split at resultEmitted
+        · cases resultEmitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj resultEmitted
+          subst result
+          exact (caseSound pair member body bodyEmitted).prefix _
+      have defaultPreserved : ∀ emission ∈ default, InputPreservation context inputs emission := by
+        cases fallback with
+        | none =>
+          simp only [defaultRow, Option.some.injEq] at defaultEmitted
+          subst default
+          simp
+        | some block =>
+          simp only [defaultRow, bind, Option.bind] at defaultEmitted
+          split at defaultEmitted
+          · cases defaultEmitted
+          · rename_i body bodyEmitted
+            have equal := Option.some.inj defaultEmitted
+            subst default
+            intro emission member
+            have equal := List.mem_singleton.mp member
+            subst emission
+            exact (defaultSound block rfl body bodyEmitted).prefix _
+      apply InputPreservation.join initial
+      intro emission member
+      rcases List.mem_append.mp member with left | right
+      · exact casesPreserved emission left
+      · exact defaultPreserved emission right
+
+private theorem block_input_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+theorem Ctrl.emitRow_inputs (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (ctrl : Ctrl)
+    {emission : BlockEmission} {inputs : Array G} (initial : RowInputs context.inputSize inputs values)
+    (emitted : ctrl.emitRow row selector context incoming values column lookup = some emission) :
+    InputPreservation context inputs emission := by
+  cases ctrl with
+  | «return» index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i provided readInputs
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · have equal := Option.some.inj emitted
+        subst emission
+        refine ⟨initial, ?_⟩
+        intro part member
+        have equal := List.mem_singleton.mp member
+        subst part
+        exact ⟨rfl, Option.some.inj (readInputs.symm.trans initial), rfl⟩
+  | yield index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · have equal := Option.some.inj emitted
+      subst emission
+      exact ⟨initial, by simp⟩
+  | «match» index branches fallback =>
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      apply branchRows_inputs row selector context matched.value values column lookup branches fallback initial emitted
+      · intro pair member body bodyEmitted
+        exact Block.emitRow_inputs row selector context _ values column lookup pair.2 initial bodyEmitted
+      · intro block present body bodyEmitted
+        exact Block.emitRow_inputs row selector context _ values _ lookup block initial bodyEmitted
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i joined branchesEmitted
+        have branchesPreserved := branchRows_inputs row selector context matched.value values column lookup
+          branches fallback initial branchesEmitted
+          (fun pair member body bodyEmitted =>
+            Block.emitRow_inputs row selector context _ values column lookup pair.2 initial bodyEmitted)
+          (fun block present body bodyEmitted =>
+            Block.emitRow_inputs row selector context _ values _ lookup block initial bodyEmitted)
+        simp only [continueRow] at emitted
+        split at emitted
+        · simp only [bind, Option.bind] at emitted
+          split at emitted
+          · cases emitted
+          · rename_i continued contEmitted
+            have contPreserved := Block.emitRow_inputs row selector context _ _ _ _ continuation initial.append contEmitted
+            have equal := Option.some.inj emitted
+            subst emission
+            exact branchesPreserved.continued contPreserved _
+        · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr ‹_ ∈ _›); grind)
+
+theorem Block.emitRow_inputs (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    {emission : BlockEmission} {inputs : Array G} (initial : RowInputs context.inputSize inputs values)
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission) :
+    InputPreservation context inputs emission := by
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i operations opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control ctrlEmitted
+      have preserved := Ctrl.emitRow_inputs row selector context incoming _ _ _ block.ctrl
+        (emitOps_inputs opsEmitted initial) ctrlEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      exact (preserved.afterOps incoming lookup operations).prefix _
+termination_by sizeOf block
+decreasing_by exact block_input_smaller block
+
+end
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockRowProjection.lean b/Ix/Aiur/Proofs/BlockRowProjection.lean
new file mode 100644
index 000000000..696405cee
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockRowProjection.lean
@@ -0,0 +1,436 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockRows
+import Batteries.Data.List.Basic
+
+/-!
+The selector and return-gate projections of the valued block emitter.
+Successful emission suffices for the projection equalities; no satisfying
+assignment is assumed. Its equations therefore imply the previously checked
+selector-flow equations.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem mapM_forall₂ {α β : Type} {relation : α → β → Prop} {source : List α}
+    {emissions : List β} {emit : α → Option β}
+    (emitted : source.mapM emit = some emissions)
+    (each : ∀ item ∈ source, ∀ emission, emit item = some emission → relation item emission) :
+    List.Forall₂ relation source emissions := by
+  induction source generalizing emissions with
+  | nil =>
+    simp only [List.mapM_nil, pure, Option.some.injEq] at emitted
+    subst emissions
+    exact .nil
+  | cons item items ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i first firstEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i rest restEmitted
+        have equal := Option.some.inj emitted
+        subst emissions
+        exact .cons (each item List.mem_cons_self first firstEmitted)
+          (ih restEmitted (fun item member => each item (List.mem_cons_of_mem _ member)))
+
+theorem attachWith_mapM_val {α β : Type} (items : List α) (predicate : α → Prop)
+    (holds : ∀ item ∈ items, predicate item) (emit : α → Option β) :
+    (items.attachWith predicate holds).mapM (fun item => emit item.val) = items.mapM emit := by
+  have result := List.mapM_map (m := Option) (l := items.attachWith predicate holds)
+    (f := Subtype.val) (g := emit)
+  rw [List.attachWith_map_subtype_val] at result
+  exact result.symm
+
+theorem forall₂_map_left {α β γ : Type} {relation : β → γ → Prop} {map : α → β}
+    {left : List α} {right : List γ}
+    (related : List.Forall₂ (fun item result => relation (map item) result) left right) :
+    List.Forall₂ relation (left.map map) right := by
+  induction related with
+  | nil => exact .nil
+  | cons first _ ih => exact .cons first ih
+
+theorem forall₂_append {α β : Type} {relation : α → β → Prop}
+    {firstLeft restLeft : List α} {firstRight restRight : List β}
+    (first : List.Forall₂ relation firstLeft firstRight)
+    (rest : List.Forall₂ relation restLeft restRight) :
+    List.Forall₂ relation (firstLeft ++ restLeft) (firstRight ++ restRight) := by
+  induction first with
+  | nil => exact rest
+  | cons head _ ih => exact .cons head ih
+
+def SelectorFlow.unguard (flow : SelectorFlow) : SelectorFlow :=
+  { flow with equations := flow.equations.tail }
+
+structure EmissionProjection (flow : SelectorFlow) (gates : List G)
+    (emission : BlockEmission) : Prop where
+  returned : emission.returns.map Prod.fst = gates
+  yielded : emission.yields.map Prod.fst = flow.yields
+  equations : flow.equations ⊆ emission.equations
+
+theorem EmissionProjection.prefix {flow : SelectorFlow} {gates : List G}
+    {emission : BlockEmission} (projection : EmissionProjection flow gates emission)
+    (equations : List G) : EmissionProjection flow gates (emission.prefix equations) :=
+  ⟨projection.returned, projection.yielded,
+    fun _ member => List.mem_append_right _ (projection.equations member)⟩
+
+theorem EmissionProjection.join {α : Type} {source : List α} {emissions : List BlockEmission}
+    (flow : α → SelectorFlow) (gates : α → List G)
+    (projections : List.Forall₂ (fun item emission => EmissionProjection (flow item) (gates item) emission)
+      source emissions) (values : Array RowValue) (column lookup : Nat) :
+    EmissionProjection (SelectorFlow.join (source.map flow)) (source.flatMap gates)
+      (joinBlockEmissions values column lookup emissions) := by
+  induction projections with
+  | nil => exact ⟨rfl, rfl, by simp [SelectorFlow.join]⟩
+  | @cons item emission items emissions first rest ih =>
+    refine ⟨?_, ?_, ?_⟩
+    · change (emission.returns ++ emissions.flatMap (·.returns)).map Prod.fst =
+        gates item ++ items.flatMap gates
+      rw [List.map_append, first.returned]
+      exact congrArg (gates item ++ ·) ih.returned
+    · change (emission.yields ++ emissions.flatMap (·.yields)).map Prod.fst =
+        (flow item).yields ++ (items.map flow).flatMap (·.yields)
+      rw [List.map_append, first.yielded]
+      exact congrArg ((flow item).yields ++ ·) ih.yielded
+    · intro equation member
+      change equation ∈ (flow item).equations ++ (items.map flow).flatMap (·.equations) at member
+      change equation ∈ emission.equations ++ emissions.flatMap (·.equations)
+      rcases List.mem_append.mp member with left | right
+      · exact List.mem_append_left _ (first.equations left)
+      · exact List.mem_append_right _ (ih.equations right)
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Ctrl.selectorFlow_equations (selector : SelIdx → G) (ctrl : Ctrl) :
+    (ctrl.selectorFlow selector).equations =
+      oneSubBooleanConstraint (ctrl.selectorFlow selector).entry ::
+        (ctrl.selectorFlow selector).equations.tail := by
+  cases ctrl <;> rw [Ctrl.selectorFlow.eq_def]
+  all_goals rfl
+
+def caseRow (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat) (pair : G × Block) :
+    Option BlockEmission := do
+  let entry := (pair.2.selectorFlow selector).entry
+  let emission ← pair.2.emitRow row selector context entry values column lookup
+  return emission.prefix [entry * (matched - pair.1)]
+
+def defaultRow (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) : Option (List BlockEmission) :=
+  match fallback with
+  | none => some []
+  | some block => do
+    let entry := (block.selectorFlow selector).entry
+    let emission ← block.emitRow row selector context entry values (column + branches.size) lookup
+    return [emission.prefix (branches.toList.mapIdx fun i pair =>
+      entry * ((matched - pair.1) * row (column + i) - 1))]
+
+def branchRows (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) : Option BlockEmission := do
+  let cases ← branches.toList.mapM (caseRow row selector context matched values column lookup)
+  let default ← defaultRow row selector context matched values column lookup branches fallback
+  return joinBlockEmissions values column lookup (cases ++ default)
+
+theorem Ctrl.emitRow_match (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat)
+    (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).emitRow row selector context incoming values column lookup = (do
+      let matched ← values[index]?
+      branchRows row selector context matched.value values column lookup branches fallback) := by
+  rw [Ctrl.emitRow.eq_def]
+  simp only [branchRows, Array.toList_attach]
+  cases read : values[index]? with
+  | none => simp only [bind, Option.bind_none]
+  | some matched =>
+    simp only [bind, Option.bind_some]
+    rw [attachWith_mapM_val _ _ _ (fun pair : G × Block =>
+      (pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup).bind
+        fun emission => pure (emission.prefix
+          [(pair.2.selectorFlow selector).entry * (matched.value - pair.1)]))]
+    change (branches.toList.mapM (caseRow row selector context matched.value values column lookup)).bind _ = _
+    congr 1
+    funext cases
+    cases fallback with
+    | none => rfl
+    | some block => simp only [defaultRow, bind, Option.bind_assoc]
+
+def continueRow (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (size : Nat) (continuation : Block)
+    (joined : BlockEmission) : Option BlockEmission :=
+  if joined.yields.all (fun part => part.2.size == size) then do
+    let gate := selectorSum (joined.yields.map Prod.fst)
+    let merged := rowAdvice row joined.column size
+    let equations := mergeEquations row incoming joined.column size joined.yields ++
+      [(continuation.selectorFlow selector).entry - gate]
+    let continued ← continuation.emitRow row selector context gate (values ++ merged)
+      (joined.column + size) joined.lookup
+    return joined.continued equations continued
+  else none
+
+theorem Ctrl.emitRow_matchContinue (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat)
+    (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block)
+    (size aux slots : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback size aux slots continuation).emitRow
+      row selector context incoming values column lookup = (do
+        let matched ← values[index]?
+        let joined ← branchRows row selector context matched.value values column lookup branches fallback
+        continueRow row selector context incoming values size continuation joined) := by
+  rw [Ctrl.emitRow.eq_def]
+  simp only [branchRows, Array.toList_attach]
+  cases read : values[index]? with
+  | none => simp only [bind, Option.bind_none]
+  | some matched =>
+    simp only [bind, Option.bind_some]
+    rw [attachWith_mapM_val _ _ _ (fun pair : G × Block =>
+      (pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup).bind
+        fun emission => pure (emission.prefix
+          [(pair.2.selectorFlow selector).entry * (matched.value - pair.1)]))]
+    simp only [Option.bind_assoc]
+    change (branches.toList.mapM (caseRow row selector context matched.value values column lookup)).bind _ = _
+    congr 1
+    funext cases
+    cases fallback <;> simp only [defaultRow, continueRow, bind, pure,
+      Option.bind_assoc, Option.bind_some]
+
+theorem caseRows_projection (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) {emissions : List BlockEmission}
+    (emitted : branches.toList.mapM (caseRow row selector context matched values column lookup) = some emissions)
+    (sound : ∀ pair ∈ branches.toList, ∀ emission,
+      pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup = some emission →
+      EmissionProjection (pair.2.selectorFlow selector)
+        (pair.2.returnGates selector (pair.2.selectorFlow selector).entry) emission) :
+    List.Forall₂ (fun block emission => EmissionProjection (block.selectorFlow selector)
+      (block.returnGates selector (block.selectorFlow selector).entry) emission)
+      (branches.toList.map Prod.snd) emissions := by
+  apply forall₂_map_left
+  apply mapM_forall₂ emitted
+  intro pair member emission emitted
+  simp only [caseRow, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i body bodyEmitted
+    have equal := Option.some.inj emitted
+    subst emission
+    exact (sound pair member body bodyEmitted).prefix _
+
+theorem defaultRow_projection (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emissions : List BlockEmission}
+    (emitted : defaultRow row selector context matched values column lookup branches fallback = some emissions)
+    (sound : ∀ block, fallback = some block → ∀ emission,
+      block.emitRow row selector context (block.selectorFlow selector).entry values
+        (column + branches.size) lookup = some emission →
+      EmissionProjection (block.selectorFlow selector)
+        (block.returnGates selector (block.selectorFlow selector).entry) emission) :
+    List.Forall₂ (fun block emission => EmissionProjection (block.selectorFlow selector)
+      (block.returnGates selector (block.selectorFlow selector).entry) emission)
+      fallback.toList emissions := by
+  cases fallback with
+  | none =>
+    simp only [defaultRow, Option.some.injEq] at emitted
+    subst emissions
+    exact .nil
+  | some block =>
+    simp only [defaultRow, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i body bodyEmitted
+      have equal := Option.some.inj emitted
+      subst emissions
+      exact .cons ((sound block rfl body bodyEmitted).prefix _) .nil
+
+theorem branchRows_projection (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (caseSound : ∀ pair ∈ branches.toList, ∀ emission,
+      pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup = some emission →
+      EmissionProjection (pair.2.selectorFlow selector)
+        (pair.2.returnGates selector (pair.2.selectorFlow selector).entry) emission)
+    (defaultSound : ∀ block, fallback = some block → ∀ emission,
+      block.emitRow row selector context (block.selectorFlow selector).entry values
+        (column + branches.size) lookup = some emission →
+      EmissionProjection (block.selectorFlow selector)
+        (block.returnGates selector (block.selectorFlow selector).entry) emission) :
+    EmissionProjection (SelectorFlow.join (branchSelectorFlows selector branches fallback))
+      (branchReturnGates selector branches fallback) emission := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      have casesProjection := caseRows_projection row selector context matched values column lookup branches
+        casesEmitted caseSound
+      have defaultProjection := defaultRow_projection row selector context matched values column lookup
+        branches fallback defaultEmitted defaultSound
+      have result := EmissionProjection.join
+        (fun block : Block => block.selectorFlow selector)
+        (fun block : Block => block.returnGates selector (block.selectorFlow selector).entry)
+        (forall₂_append casesProjection defaultProjection) values column lookup
+      simpa only [branchSelectorFlows, branchReturnGates, List.map_append, List.map_map,
+        List.flatMap_append, List.flatMap_map, Function.comp_def] using result
+
+private theorem block_projection_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+theorem Ctrl.emitRow_projection (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (ctrl : Ctrl)
+    {emission : BlockEmission}
+    (emitted : ctrl.emitRow row selector context incoming values column lookup = some emission) :
+    EmissionProjection (ctrl.selectorFlow selector).unguard
+      (ctrl.returnGates selector incoming) emission := by
+  cases ctrl with
+  | «return» index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · have equal := Option.some.inj emitted
+        subst emission
+        rw [Ctrl.selectorFlow.eq_def, Ctrl.returnGates.eq_def]
+        exact ⟨rfl, rfl, by simp [SelectorFlow.unguard, SelectorFlow.guard]⟩
+  | yield index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · have equal := Option.some.inj emitted
+      subst emission
+      rw [Ctrl.selectorFlow.eq_def, Ctrl.returnGates.eq_def]
+      exact ⟨rfl, rfl, by simp [SelectorFlow.unguard, SelectorFlow.guard]⟩
+  | «match» index branches fallback =>
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      rw [Ctrl.selectorFlow_match, Ctrl.returnGates_match]
+      apply branchRows_projection row selector context matched.value values column lookup branches fallback emitted
+      · intro pair member body bodyEmitted
+        exact Block.emitRow_projection row selector context _ values column lookup pair.2 bodyEmitted
+      · intro block present body bodyEmitted
+        exact Block.emitRow_projection row selector context _ values _ lookup block bodyEmitted
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i joined branchesEmitted
+        have branchesProjection := branchRows_projection row selector context matched.value values column lookup
+          branches fallback branchesEmitted
+          (fun pair member body bodyEmitted =>
+            Block.emitRow_projection row selector context _ values column lookup pair.2 bodyEmitted)
+          (fun block present body bodyEmitted =>
+            Block.emitRow_projection row selector context _ values _ lookup block bodyEmitted)
+        simp only [continueRow] at emitted
+        split at emitted
+        · simp only [bind, Option.bind] at emitted
+          split at emitted
+          · cases emitted
+          · rename_i continued contEmitted
+            have contProjection := Block.emitRow_projection row selector context _ _ _ _ continuation contEmitted
+            have gate := congrArg selectorSum branchesProjection.yielded
+            have equal := Option.some.inj emitted
+            subst emission
+            rw [Ctrl.selectorFlow_matchContinue, Ctrl.returnGates_matchContinue]
+            refine ⟨?_, contProjection.yielded, ?_⟩
+            · change (joined.returns ++ continued.returns).map Prod.fst = _
+              rw [List.map_append, branchesProjection.returned, contProjection.returned, gate]
+            · intro equation member
+              change equation ∈
+                (SelectorFlow.join (branchSelectorFlows selector branches fallback)).equations ++
+                  ((continuation.selectorFlow selector).entry -
+                    selectorSum (SelectorFlow.join (branchSelectorFlows selector branches fallback)).yields) ::
+                    (continuation.selectorFlow selector).equations at member
+              change equation ∈ (joined.equations ++
+                (mergeEquations row incoming joined.column size joined.yields ++
+                  [(continuation.selectorFlow selector).entry - selectorSum (joined.yields.map Prod.fst)])) ++
+                continued.equations
+              rcases List.mem_append.mp member with branchEquation | contEquation
+              · exact List.mem_append_left _ (List.mem_append_left _
+                  (branchesProjection.equations branchEquation))
+              · rcases List.mem_cons.mp contEquation with link | contEquation
+                · rw [link, ← gate]
+                  exact List.mem_append_left _ (List.mem_append_right _
+                    (List.mem_append_right _ List.mem_cons_self))
+                · exact List.mem_append_right _ (contProjection.equations contEquation)
+        · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr ‹_ ∈ _›); grind)
+
+theorem Block.emitRow_projection (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission) :
+    EmissionProjection (block.selectorFlow selector)
+      (block.returnGates selector incoming) emission := by
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i operations opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control ctrlEmitted
+      have projected := Ctrl.emitRow_projection row selector context incoming _ _ _ block.ctrl ctrlEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      rw [Block.returnGates, Block.selectorFlow]
+      refine ⟨projected.returned, projected.yielded, ?_⟩
+      intro equation member
+      change equation ∈ oneSubBooleanConstraint (block.ctrl.selectorFlow selector).entry ::
+        (operations.equations ++ control.equations)
+      change equation ∈ (block.ctrl.selectorFlow selector).equations at member
+      rw [Ctrl.selectorFlow_equations] at member
+      rcases List.mem_cons.mp member with guard | tail
+      · rw [guard]
+        exact List.mem_cons_self
+      · exact List.mem_cons_of_mem _ (List.mem_append_right _ (projected.equations tail))
+termination_by sizeOf block
+decreasing_by exact block_projection_smaller block
+
+end
+
+theorem Block.emitRow_selectors (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    (block.selectorFlow selector).Satisfied :=
+  fun equation member => satisfied equation
+    ((block.emitRow_projection row selector context incoming values column lookup emitted).equations member)
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockRows.lean b/Ix/Aiur/Proofs/BlockRows.lean
new file mode 100644
index 000000000..2d392f8c7
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockRows.lean
@@ -0,0 +1,159 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CallInventory
+import Ix.Aiur.Proofs.BranchSelection
+
+/-!
+A total valued model of native block constraint emission. Branches share
+columns and lookup slots, default arms allocate inverse witnesses, and
+continuations consume local yields while preserving early returns. Selector
+gates match native emission even on assignments that violate its equations.
+
+Native expression reflection and successful emission from validated layouts
+remain separate obligations.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+structure RowContext where
+  function : FunIdx
+  inputSize : Nat
+  rank : G
+
+structure QueryPart where
+  slot : Nat
+  selector : G
+  message : List G
+  deriving Repr
+
+def queryParts (slot : Nat) (selector : G) (queries : List (List G)) : List QueryPart :=
+  queries.mapIdx fun index message => ⟨slot + index, selector, message⟩
+
+structure BlockEmission where
+  values : Array RowValue
+  column : Nat
+  lookup : Nat
+  equations : List G := []
+  queries : List QueryPart := []
+  returns : List (G × Bytecode.AIR.Call) := []
+  yields : List (G × Array RowValue) := []
+  calls : List (G × (Bytecode.AIR.Call × (Fin 6 → G))) := []
+
+def BlockEmission.prefix (equations : List G) (emission : BlockEmission) : BlockEmission :=
+  { emission with equations := equations ++ emission.equations }
+
+def BlockEmission.afterOps (incoming : G) (lookup : Nat) (ops : OpsEmission)
+    (control : BlockEmission) : BlockEmission :=
+  { control with
+    equations := ops.equations ++ control.equations
+    queries := queryParts lookup incoming ops.queries ++ control.queries
+    calls := ops.calls.map (incoming, ·) ++ control.calls }
+
+def joinBlockEmissions (values : Array RowValue) (column lookup : Nat)
+    (emissions : List BlockEmission) : BlockEmission :=
+  { values
+    column := emissions.foldl (fun column emission => max column emission.column) column
+    lookup := emissions.foldl (fun lookup emission => max lookup emission.lookup) lookup
+    equations := emissions.flatMap (·.equations)
+    queries := emissions.flatMap (·.queries)
+    returns := emissions.flatMap (·.returns)
+    yields := emissions.flatMap (·.yields)
+    calls := emissions.flatMap (·.calls) }
+
+def mergeEquations (row : Nat → G) (parent : G) (column size : Nat)
+    (yields : List (G × Array RowValue)) : List G :=
+  (List.range size).map fun index => parent * (row (column + index) -
+    selectorSum (yields.map fun part => part.1 * (rowValues part.2)[index]?.getD 0))
+
+def BlockEmission.continued (branches : BlockEmission) (equations : List G)
+    (continuation : BlockEmission) : BlockEmission :=
+  { continuation with
+    equations := branches.equations ++ equations ++ continuation.equations
+    queries := branches.queries ++ continuation.queries
+    returns := branches.returns ++ continuation.returns
+    calls := branches.calls ++ continuation.calls }
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+private theorem block_row_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def Ctrl.emitRow (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) : Ctrl → Option BlockEmission
+  | .return _ indices => do
+    let inputs ← AIR.readValues (rowValues values) (Array.range context.inputSize)
+    let outputs ← AIR.readValues (rowValues values) indices
+    return {
+      values, column, lookup
+      returns := [(incoming, ⟨context.function, inputs, outputs, context.rank⟩)] }
+  | .yield index indices => do
+    let outputs ← indices.toList.mapM fun index => values[index]?
+    return { values, column, lookup, yields := [(selector index, outputs.toArray)] }
+  | .match index branches fallback => do
+    let matched ← values[index]?
+    let cases ← branches.attach.toList.mapM fun ⟨pair, _⟩ => do
+      let entry := (pair.2.selectorFlow selector).entry
+      let emission ← pair.2.emitRow row selector context entry values column lookup
+      return emission.prefix [entry * (matched.value - pair.1)]
+    let default : List BlockEmission ← match fallback with
+      | none => some []
+      | some block => do
+        let entry := (block.selectorFlow selector).entry
+        let emission ← block.emitRow row selector context entry values (column + branches.size) lookup
+        pure [emission.prefix (branches.toList.mapIdx fun i pair =>
+          entry * ((matched.value - pair.1) * row (column + i) - 1))]
+    return joinBlockEmissions values column lookup (cases ++ default)
+  | .matchContinue index branches fallback size _ _ continuation => do
+    let matched ← values[index]?
+    let cases ← branches.attach.toList.mapM fun ⟨pair, _⟩ => do
+      let entry := (pair.2.selectorFlow selector).entry
+      let emission ← pair.2.emitRow row selector context entry values column lookup
+      return emission.prefix [entry * (matched.value - pair.1)]
+    let default : List BlockEmission ← match fallback with
+      | none => some []
+      | some block => do
+        let entry := (block.selectorFlow selector).entry
+        let emission ← block.emitRow row selector context entry values (column + branches.size) lookup
+        pure [emission.prefix (branches.toList.mapIdx fun i pair =>
+          entry * ((matched.value - pair.1) * row (column + i) - 1))]
+    let joined := joinBlockEmissions values column lookup (cases ++ default)
+    if joined.yields.all (fun part => part.2.size == size) then do
+      let gate := selectorSum (joined.yields.map Prod.fst)
+      let merged := rowAdvice row joined.column size
+      let equations := mergeEquations row incoming joined.column size joined.yields ++
+        [(continuation.selectorFlow selector).entry - gate]
+      let continued ← continuation.emitRow row selector context gate (values ++ merged)
+        (joined.column + size) joined.lookup
+      return joined.continued equations continued
+    else none
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.emitRow (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat)
+    (block : Block) : Option BlockEmission := do
+  let operations ← emitOps row incoming context.rank block.ops.toList values column
+  let control ← block.ctrl.emitRow row selector context incoming operations.values
+    operations.column (lookup + operations.queries.length)
+  return (control.afterOps incoming lookup operations).prefix
+    [oneSubBooleanConstraint (block.selectorFlow selector).entry]
+termination_by sizeOf block
+decreasing_by exact block_row_smaller block
+
+end
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BlockSelectors.lean b/Ix/Aiur/Proofs/BlockSelectors.lean
new file mode 100644
index 000000000..eaccf5ef3
--- /dev/null
+++ b/Ix/Aiur/Proofs/BlockSelectors.lean
@@ -0,0 +1,180 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LookupExpressions
+
+/-!
+The native block selector is a left-associated sum of its immediate branch
+selectors. A continuation's selector is excluded. Selector reads use a finite
+table so successful reflection requires no readings of unallocated columns.
+-/
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter
+
+theorem evaluated_read {values : Values G} {expressions : Array Expr} {results : Array G}
+    (evaluated : expressions.mapM (evalExpr values) = some results)
+    {index : Nat} {expr : Expr} (present : expressions[index]? = some expr) :
+    evalExpr values expr = some (results[index]?.getD 0) := by
+  have size := array_mapM_size evaluated
+  have inputBound := (Array.getElem?_eq_some_iff.mp present).choose
+  have bound : index < results.size := by omega
+  have read := array_mapM_read evaluated index
+  simpa only [present, bind, Option.bind_some, getElem?_pos results index bound,
+    Option.getD_some] using read
+
+theorem list_mapM_evaluate {α β γ : Type} {first : α → Option β} {evaluate : β → Option γ}
+    {inputs : List α} {outputs : List β} (selected : inputs.mapM first = some outputs)
+    (value : α → γ)
+    (related : ∀ input output, first input = some output → evaluate output = some (value input)) :
+    outputs.mapM evaluate = some (inputs.map value) := by
+  obtain ⟨results, selected, evaluated⟩ := list_mapM_refine selected
+    (second := fun input => some (value input))
+    (fun input output read => ⟨value input, rfl, related input output read⟩)
+  have equal : inputs.mapM (fun input => some (value input)) = some (inputs.map value) := by
+    simpa only [List.map_id] using list_mapM_of_map inputs id value
+      (fun input => some (value input)) (fun _ _ => rfl)
+  rw [equal] at selected
+  cases selected
+  exact evaluated
+
+def sum (expressions : List Expr) : Expr := expressions.foldl Expr.frontAdd (.konst 0)
+
+theorem sum_fold_eval {values : Values G} {expressions : List Expr} {results : List G}
+    (evaluated : expressions.mapM (evalExpr values) = some results)
+    {initial : Expr} {start : G} (initialEval : evalExpr values initial = some start) :
+    evalExpr values (expressions.foldl Expr.frontAdd initial) = some (results.foldl (· + ·) start) := by
+  induction expressions generalizing results initial start with
+  | nil =>
+    cases evaluated
+    exact initialEval
+  | cons expr rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i value valueEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i tail tailEval
+    cases evaluated
+    exact ih tailEval (Expr.frontAdd_eval goldilocksLaws values initialEval valueEval)
+
+theorem sum_eval {values : Values G} {expressions : List Expr} {results : List G}
+    (evaluated : expressions.mapM (evalExpr values) = some results) :
+    evalExpr values (sum expressions) = some (AIR.selectorSum results) := sum_fold_eval evaluated rfl
+
+def SelectorReads (values : Values G) (selectors : Array Expr) (selector : Nat → G) : Prop :=
+  ∀ {index : Nat} {expr : Expr}, selectors[index]? = some expr → evalExpr values expr = some (selector index)
+
+theorem selectors_array_eval {values : Values G} {selectors : Array Expr} {results : Array G}
+    (evaluated : selectors.mapM (evalExpr values) = some results) :
+    SelectorReads values selectors (fun index => results[index]?.getD 0) :=
+  fun read => evaluated_read evaluated read
+
+private theorem block_smaller (block : Bytecode.Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def ctrlSelector (selectors : Array Expr) : Bytecode.Ctrl → Option Expr
+  | .return index _ | .yield index _ => selectors[index]?
+  | .match _ branches fallback | .matchContinue _ branches fallback .. => do
+    let entries ← branches.attach.toList.mapM fun ⟨pair, _⟩ => blockSelector selectors pair.2
+    let last : List Expr ← match fallback with
+      | none => some []
+      | some block => (blockSelector selectors block).map (fun expr => [expr])
+    return sum (entries ++ last)
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def blockSelector (selectors : Array Expr) (block : Bytecode.Block) : Option Expr :=
+  ctrlSelector selectors block.ctrl
+termination_by sizeOf block
+decreasing_by exact block_smaller block
+
+end
+
+mutual
+
+theorem ctrlSelector_reads {values : Values G} {selectors : Array Expr} {selector : Nat → G}
+    (evaluated : SelectorReads values selectors selector)
+    (ctrl : Bytecode.Ctrl) {expr : Expr} (selected : ctrlSelector selectors ctrl = some expr) :
+    evalExpr values expr = some (ctrl.selectorFlow selector).entry := by
+  cases ctrl with
+  | «return» index indices | yield index indices =>
+    simp only [ctrlSelector] at selected
+    simpa only [Bytecode.Ctrl.selectorFlow, AIR.SelectorFlow.guard] using evaluated selected
+  | «match» index branches fallback | matchContinue index branches fallback size aux lookups continuation =>
+    simp only [ctrlSelector, bind, Option.bind] at selected
+    split at selected
+    · cases selected
+    rename_i entries entriesSelected
+    dsimp only at selected
+    have entriesEval := list_mapM_evaluate entriesSelected
+      (fun pair => (pair.val.2.selectorFlow selector).entry)
+      (fun ⟨pair, _⟩ output read => blockSelector_reads evaluated pair.2 read)
+    cases fallback with
+    | none =>
+      cases selected
+      have summed := sum_eval entriesEval
+      simpa only [Bytecode.Ctrl.selectorFlow, AIR.SelectorFlow.guard,
+        AIR.SelectorFlow.join, AIR.SelectorFlow.continue,
+        List.append_nil, List.map_map, Function.comp_def] using summed
+    | some block =>
+      cases entrySelected : blockSelector selectors block with
+      | none => simp only [entrySelected, Option.map_none] at selected; cases selected
+      | some entry =>
+        simp only [entrySelected, Option.map_some] at selected
+        cases selected
+        have entryEval := blockSelector_reads evaluated block entrySelected
+        have singleton : [entry].mapM (evalExpr values) =
+            some [(block.selectorFlow selector).entry] := by
+          simp only [List.mapM_cons, List.mapM_nil, entryEval, bind, Option.bind_some, pure]
+        have combined : (entries ++ [entry]).mapM (evalExpr values) =
+            some ((branches.attach.toList.map fun pair =>
+              (pair.val.2.selectorFlow selector).entry) ++
+                [(block.selectorFlow selector).entry]) := by
+          simp only [List.mapM_append, entriesEval, singleton, bind, Option.bind_some, pure]
+        have summed := sum_eval combined
+        simpa only [Bytecode.Ctrl.selectorFlow, AIR.SelectorFlow.guard,
+          AIR.SelectorFlow.join, AIR.SelectorFlow.continue, List.map_append,
+          List.map_cons, List.map_nil, List.map_map, Function.comp_def] using summed
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+theorem blockSelector_reads {values : Values G} {selectors : Array Expr} {selector : Nat → G}
+    (evaluated : SelectorReads values selectors selector)
+    (block : Bytecode.Block) {expr : Expr} (selected : blockSelector selectors block = some expr) :
+    evalExpr values expr = some (block.selectorFlow selector).entry := by
+  simp only [blockSelector] at selected
+  simpa only [Bytecode.Block.selectorFlow] using ctrlSelector_reads evaluated block.ctrl selected
+termination_by sizeOf block
+decreasing_by exact block_smaller block
+
+end
+
+
+theorem ctrlSelector_eval {values : Values G} {selectors : Array Expr} {results : Array G}
+    (evaluated : selectors.mapM (evalExpr values) = some results)
+    (ctrl : Bytecode.Ctrl) {expr : Expr} (selected : ctrlSelector selectors ctrl = some expr) :
+    evalExpr values expr = some (ctrl.selectorFlow (fun index => results[index]?.getD 0)).entry :=
+  ctrlSelector_reads (selectors_array_eval evaluated) ctrl selected
+
+theorem blockSelector_eval {values : Values G} {selectors : Array Expr} {results : Array G}
+    (evaluated : selectors.mapM (evalExpr values) = some results)
+    (block : Bytecode.Block) {expr : Expr} (selected : blockSelector selectors block = some expr) :
+    evalExpr values expr = some (block.selectorFlow (fun index => results[index]?.getD 0)).entry :=
+  blockSelector_reads (selectors_array_eval evaluated) block selected
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/BranchSelection.lean b/Ix/Aiur/Proofs/BranchSelection.lean
new file mode 100644
index 000000000..c19363738
--- /dev/null
+++ b/Ix/Aiur/Proofs/BranchSelection.lean
@@ -0,0 +1,117 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ReturnGates
+
+/-! Active case/default polynomial equations recover a branch of the actual
+bytecode and its selector constraints. The branch-count bound and decoding
+of the matched expression and default inverse columns remain explicit. -/
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Ctrl.selectorFlow_boolean (selector : SelIdx → G) (ctrl : Ctrl)
+    (valid : (ctrl.selectorFlow selector).Satisfied) :
+    booleanConstraint (ctrl.selectorFlow selector).entry = 0 := by
+  cases ctrl <;> rw [Ctrl.selectorFlow.eq_def] at valid ⊢
+  all_goals
+    have boolean := SelectorFlow.guard_boolean valid
+    exact boolean
+
+theorem Block.selectorFlow_boolean (selector : SelIdx → G) (block : Block)
+    (valid : (block.selectorFlow selector).Satisfied) :
+    booleanConstraint (block.selectorFlow selector).entry = 0 := by
+  rw [Block.selectorFlow] at valid ⊢
+  exact Ctrl.selectorFlow_boolean selector block.ctrl valid
+
+/-- Case and default polynomial forms after reading the matched expression.
+Default inverse advice is arbitrary; its equation establishes disequality. -/
+structure MatchPolynomials (selector : SelIdx → G) (scrutinee : G)
+    (branches : Array (G × Block)) (fallback : Option Block) : Prop where
+  cases : ∀ pair ∈ branches.toList,
+    (pair.2.selectorFlow selector).entry * (scrutinee - pair.1) = 0
+  default : ∀ block, fallback = some block → ∀ pair ∈ branches.toList,
+    ∃ inverse : G,
+      (block.selectorFlow selector).entry * ((scrutinee - pair.1) * inverse - 1) = 0
+
+theorem branchSelectorFlows_boolean (selector : SelIdx → G) (branches : Array (G × Block))
+    (fallback : Option Block)
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied) :
+    ∀ flow ∈ branchSelectorFlows selector branches fallback, booleanConstraint flow.entry = 0 := by
+  intro flow member
+  have satisfied := SelectorFlow.join_satisfied valid flow member
+  rcases List.mem_append.mp member with caseMember | defaultMember
+  · obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp caseMember
+    subst flow
+    exact pair.2.selectorFlow_boolean selector satisfied
+  · obtain ⟨block, blockMember, equal⟩ := List.mem_map.mp defaultMember
+    subst flow
+    exact block.selectorFlow_boolean selector satisfied
+
+/-- An active sum selects a branch that matches the scrutinee, with its own
+selector equations available for recursive local execution extraction. -/
+theorem MatchPolynomials.active_branch {selector : SelIdx → G} {scrutinee : G}
+    {branches : Array (G × Block)} {fallback : Option Block}
+    (polynomials : MatchPolynomials selector scrutinee branches fallback)
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied)
+    (bounded : branches.size + fallback.toList.length < gSize.toNat)
+    (active : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).entry = 1) :
+    ∃ block, AIR.SelectArm scrutinee branches fallback block ∧
+      (block.selectorFlow selector).Satisfied ∧ (block.selectorFlow selector).entry = 1 := by
+  have individual := branchSelectorFlows_boolean selector branches fallback valid
+  change selectorSum ((branchSelectorFlows selector branches fallback).map SelectorFlow.entry) = 1 at active
+  have count := selectorSum_active_count
+    (selectors := (branchSelectorFlows selector branches fallback).map SelectorFlow.entry)
+    (fun value member => by
+      obtain ⟨flow, flowMember, equal⟩ := List.mem_map.mp member
+      subst value
+      exact individual flow flowMember)
+    (by simpa only [List.length_map, branchSelectorFlows, List.length_append,
+      Array.length_toList] using bounded) active
+  have oneMember : (1 : G) ∈ (branchSelectorFlows selector branches fallback).map SelectorFlow.entry :=
+    List.count_pos_iff.mp (Nat.lt_of_lt_of_eq (by decide : 0 < 1) count.symm)
+  obtain ⟨flow, flowMember, selected⟩ := List.mem_map.mp oneMember
+  have satisfied := SelectorFlow.join_satisfied valid flow flowMember
+  rcases List.mem_append.mp flowMember with caseMember | defaultMember
+  · obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp caseMember
+    subst flow
+    refine ⟨pair.2, ?_, satisfied, selected⟩
+    apply AIR.SelectArm.case
+    have matchesEq := active_case selected (polynomials.cases pair pairMember)
+    rw [matchesEq]
+    exact pairMember
+  · obtain ⟨block, blockMember, equal⟩ := List.mem_map.mp defaultMember
+    subst flow
+    have present : fallback = some block := by simpa using blockMember
+    refine ⟨block, AIR.SelectArm.fallback present ?_, satisfied, selected⟩
+    intro pair pairMember
+    obtain ⟨inverse, equation⟩ := polynomials.default block present pair pairMember
+    exact (active_default selected equation).symm
+
+theorem MatchPolynomials.active_match {selector : SelIdx → G} {scrutinee : G}
+    {index : ValIdx} {branches : Array (G × Block)} {fallback : Option Block}
+    (polynomials : MatchPolynomials selector scrutinee branches fallback)
+    (valid : ((Ctrl.match index branches fallback).selectorFlow selector).Satisfied)
+    (bounded : branches.size + fallback.toList.length < gSize.toNat)
+    (active : ((Ctrl.match index branches fallback).selectorFlow selector).entry = 1) :
+    ∃ block, AIR.SelectArm scrutinee branches fallback block ∧
+      (block.selectorFlow selector).Satisfied ∧ (block.selectorFlow selector).entry = 1 := by
+  rw [Ctrl.selectorFlow_match] at valid active
+  exact polynomials.active_branch (SelectorFlow.guard_satisfied valid) bounded active
+
+theorem MatchPolynomials.active_matchContinue {selector : SelIdx → G} {scrutinee : G}
+    {index : ValIdx} {branches : Array (G × Block)} {fallback : Option Block}
+    {outputs aux lookups : Nat} {continuation : Block}
+    (polynomials : MatchPolynomials selector scrutinee branches fallback)
+    (valid : ((Ctrl.matchContinue index branches fallback outputs aux lookups continuation).selectorFlow selector).Satisfied)
+    (bounded : branches.size + fallback.toList.length < gSize.toNat)
+    (active : ((Ctrl.matchContinue index branches fallback outputs aux lookups continuation).selectorFlow selector).entry = 1) :
+    ∃ block, AIR.SelectArm scrutinee branches fallback block ∧
+      (block.selectorFlow selector).Satisfied ∧ (block.selectorFlow selector).entry = 1 := by
+  rw [Ctrl.selectorFlow_matchContinue] at valid active
+  exact polynomials.active_branch
+    (SelectorFlow.continue_satisfied (SelectorFlow.guard_satisfied valid)).1 bounded active
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/BranchlessSlots.lean b/Ix/Aiur/Proofs/BranchlessSlots.lean
new file mode 100644
index 000000000..956c7f7a8
--- /dev/null
+++ b/Ix/Aiur/Proofs/BranchlessSlots.lean
@@ -0,0 +1,177 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRowCounts
+
+/-! Every circuit eligible for ungated messages has a single function
+with terminal control. Its queries occupy disjoint slots, independent of
+witness selectors. This closes the single-writer premise and reflects all
+encoded consumer slots after padding; native expression reflection remains
+a separate obligation. -/
+
+namespace Aiur.AIR
+open Bytecode
+
+def unitQuerySelectors (queries : List QueryPart) : List QueryPart :=
+  queries.map fun query => { query with selector := 1 }
+
+def QueryWriters (start finish : Nat) (queries : List QueryPart) : Prop :=
+  QuerySlots 1 start finish (unitQuerySelectors queries)
+
+theorem unitQuerySelectors_parts (slot : Nat) (selector : G) (queries : List (List G)) :
+    unitQuerySelectors (queryParts slot selector queries) = queryParts slot 1 queries := by
+  induction queries generalizing slot with
+  | nil => rfl
+  | cons message queries ih =>
+    rw [queryParts_cons, queryParts_cons]
+    change _ :: unitQuerySelectors (queryParts (slot + 1) selector queries) = _
+    rw [ih]
+
+theorem QueryWriters.indexed (slot : Nat) (selector : G) (queries : List (List G)) :
+    QueryWriters slot (slot + queries.length) (queryParts slot selector queries) := by
+  rw [QueryWriters, unitQuerySelectors_parts]
+  exact QuerySlots.indexed 1 slot queries (by decide +kernel)
+
+theorem QueryWriters.append {start middle finish : Nat} {first rest : List QueryPart}
+    (left : QueryWriters start middle first) (right : QueryWriters middle finish rest) :
+    QueryWriters start finish (first ++ rest) := by
+  unfold QueryWriters unitQuerySelectors
+  rw [List.map_append]
+  exact QuerySlots.append left right
+
+theorem QueryWriters.extend {start finish limit : Nat} {queries : List QueryPart}
+    (writers : QueryWriters start finish queries) (bound : finish ≤ limit) :
+    QueryWriters start limit queries := QuerySlots.extend writers bound
+
+theorem QueryWriters.permuted {start finish : Nat} {queries other : List QueryPart}
+    (writers : QueryWriters start finish queries) (permutation : queries.Perm other) :
+    QueryWriters start finish other := QuerySlots.permuted writers (permutation.map _)
+
+theorem unitQuerySelectors_count (queries : List QueryPart) (slot : Nat) :
+    queryCount (unitQuerySelectors queries) slot = (querySlotParts queries slot).length := by
+  simp only [queryCount, unitQuerySelectors, List.filter_map, List.length_map,
+    querySlotParts, Function.comp_def, beq_self_eq_true, Bool.and_true]
+
+theorem QueryWriters.single {start finish : Nat} {queries : List QueryPart}
+    (writers : QueryWriters start finish queries) (slot : Nat) :
+    (querySlotParts queries slot).length ≤ 1 := by
+  rw [← unitQuerySelectors_count]
+  exact writers.count slot
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Function.emitRow_terminal_writers (row : Nat → G) (selector : SelIdx → G)
+    (function : Function) (functionIndex : FunIdx) (rank : G)
+    (inputs : Array RowValue) (column lookup : Nat) {emission : BlockEmission}
+    (terminal : function.hasTerminalControl = true)
+    (emitted : function.emitRow row selector functionIndex rank inputs column lookup = some emission) :
+    QueryWriters lookup emission.lookup emission.queries := by
+  rw [Function.emitRow, Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i ops opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control controlEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      cases ctrlEq : function.body.ctrl with
+      | «match» index branches fallback =>
+        simp only [Function.hasTerminalControl, ctrlEq, Bool.false_eq_true] at terminal
+      | matchContinue index branches fallback size aux slots continuation =>
+        simp only [Function.hasTerminalControl, ctrlEq, Bool.false_eq_true] at terminal
+      | «return» index indices =>
+        rw [ctrlEq, Ctrl.emitRow.eq_def] at controlEmitted
+        simp only [bind, Option.bind] at controlEmitted
+        split at controlEmitted
+        · cases controlEmitted
+        · dsimp only at controlEmitted
+          split at controlEmitted
+          · cases controlEmitted
+          · have equal := Option.some.inj controlEmitted
+            subst control
+            simpa only [BlockEmission.prefix, BlockEmission.afterOps, List.append_nil] using
+              QueryWriters.indexed lookup (function.body.selectorFlow selector).entry ops.queries
+      | yield index indices =>
+        rw [ctrlEq, Ctrl.emitRow.eq_def] at controlEmitted
+        simp only [bind, Option.bind] at controlEmitted
+        split at controlEmitted
+        · cases controlEmitted
+        · have equal := Option.some.inj controlEmitted
+          subst control
+          simpa only [BlockEmission.prefix, BlockEmission.afterOps, List.append_nil] using
+            QueryWriters.indexed lookup (function.body.selectorFlow selector).entry ops.queries
+
+end Aiur.Bytecode
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem circuitBranchless_member {selectors : Nat} {members : List MemberEmission}
+    (enabled : circuitBranchless selectors (members.map (·.function)) = true) :
+    ∃ member, members = [member] ∧ member.function.hasTerminalControl = true := by
+  cases members with
+  | nil => simp only [List.map_nil, circuitBranchless, Bool.and_false, Bool.false_eq_true] at enabled
+  | cons member rest =>
+    cases rest with
+    | nil =>
+      refine ⟨member, rfl, ?_⟩
+      simp only [List.map_cons, List.map_nil, circuitBranchless, Bool.and_eq_true] at enabled
+      exact enabled.2
+    | cons next rest =>
+      simp only [List.map_cons, circuitBranchless, Bool.and_false, Bool.false_eq_true] at enabled
+
+theorem circuitEmission_queryWriters {row : Nat → G} {rank : G} {column : Nat}
+    {program : Toplevel} {circuit : Circuit} {members : List MemberEmission}
+    (source : ∀ member ∈ members, member.FromProgram row rank column 4 program)
+    (enabled : (circuitEmission row circuit members).branchless = true)
+    (limits : ∀ member ∈ members, member.body.lookup ≤ circuit.layout.lookups) :
+    QueryWriters 1 circuit.layout.lookups (circuitEmission row circuit members).queries := by
+  obtain ⟨member, membersEq, terminal⟩ := circuitBranchless_member enabled
+  subst members
+  have body := member.function.emitRow_terminal_writers row (member.selector row)
+    member.functionIndex rank (rowAdvice row 0 member.function.layout.inputSize) column 4
+    terminal (source member List.mem_cons_self).emitted
+  have headers := QueryWriters.indexed 1 (circuitEmission row circuit [member]).selector
+    ((rankByteQueries (circuitRankBytes row circuit.layout)).map rangeMessage)
+  have combined := (headers.append (body.extend (limits member List.mem_cons_self))).permuted List.perm_append_comm
+  simpa only [circuitEmission, List.flatMap_cons, List.flatMap_nil, List.append_nil] using combined
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_queryWriters (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (enabled : emission.branchless = true)
+    (limits : ∀ member ∈ emission.members, member.body.lookup ≤ circuit.layout.lookups) :
+    QueryWriters 1 emission.lookupCount emission.queries := by
+  obtain ⟨description, _, source⟩ := circuit.emitRow_spec row program emitted
+  have writers := circuitEmission_queryWriters source (by rw [← description]; exact enabled) limits
+  have lookupEq := congrArg CircuitEmission.lookupCount description
+  change emission.lookupCount = circuit.layout.lookups at lookupEq
+  rw [← lookupEq, ← description] at writers
+  exact writers
+
+theorem Circuit.emitRow_queries_reflect (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (validated : circuit.validateRowCounts program = true)
+    (reserved : 4 ≤ circuit.layout.lookups)
+    (limits : ∀ member ∈ emission.members, member.body.lookup ≤ circuit.layout.lookups)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) (width : Nat) :
+    (encodedQueries emission.branchless emission.queries emission.lookupCount).map (padMessage width) =
+      (decodedQueries emission.queries emission.lookupCount).map (padMessage width) := by
+  obtain ⟨bounded, bounds, _, _⟩ := circuit.emitRow_count_bounds row program emitted validated satisfied
+  have slots := circuit.emitRow_querySlots row program emitted bounded bounds reserved limits satisfied
+  apply slots.queries_reflect
+  exact fun enabled slot => (circuit.emitRow_queryWriters row program emitted enabled limits).single slot
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/ByteArithmetic.lean b/Ix/Aiur/Proofs/ByteArithmetic.lean
new file mode 100644
index 000000000..fe7190a2b
--- /dev/null
+++ b/Ix/Aiur/Proofs/ByteArithmetic.lean
@@ -0,0 +1,185 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LocalConstraints
+
+/-!
+Virtual byte carries and the four-byte strict-comparison gadget.
+
+The native byte-add/subtract lookups supply only their low byte. Multiplying
+the residual by the inverse of 256 gives the carry or borrow in the semantic
+operation. For `u32_less_than`, twelve range-checked bytes and four boolean
+carry equations give the integer identity `a + witness + 1 = b + carry*2^32`.
+The range bounds make its final carry exactly the complement of `a < b`.
+
+All arithmetic is over the actual Goldilocks representation. Lookup-derived
+byte bounds and decoding the native expressions remain separate inputs.
+-/
+
+namespace Aiur
+
+theorem G.mul_assoc (a b c : G) : (a * b) * c = a * (b * c) := by
+  apply G.ext_n
+  simp only [G.n_mul, Nat.mod_mul_mod, Nat.mul_mod_mod, Nat.mul_assoc]
+
+theorem G.n_sub (a b : G) : (a - b).n = (a.n + gSize.toNat - b.n) % gSize.toNat :=
+  G.n_ofNat _
+
+namespace AIR
+
+def inverse256 : G := 18374686475393433601
+
+theorem inverse256_correct : inverse256 * 256 = 1 := by decide +kernel
+
+theorem byte_division_eq (value : G) : (value * inverse256) * 256 = value := by
+  rw [G.mul_assoc, inverse256_correct, G.mul_one]
+
+theorem byte_add_carry {x y low : G} (hx : x.n < 256) (hy : y.n < 256)
+    (hlow : low = G.ofNat ((x.n + y.n) % 256)) :
+    (x + y - low) * inverse256 = G.ofNat ((x.n + y.n) / 256) := by
+  apply G.ext_n
+  rw [hlow]
+  simp only [G.n_mul, G.n_sub, G.n_add, G.n_ofNat]
+  have p : gSize.toNat = 18446744069414584321 := by decide
+  have inv : inverse256.n = 18374686475393433601 := rfl
+  rw [p, inv]
+  omega
+
+theorem byte_sub_borrow {x y low : G} (hx : x.n < 256) (hy : y.n < 256)
+    (hlow : low = G.ofNat ((x.n + 256 - y.n) % 256)) :
+    (low + y - x) * inverse256 = if x.n < y.n then 1 else 0 := by
+  have diff : low + y - x = if x.n < y.n then 256 else 0 := by
+    apply G.ext_n
+    rw [hlow]
+    split
+    all_goals
+      simp only [G.n_sub, G.n_add, G.n_ofNat]
+      have full : (256 : G).n = 256 := rfl
+      have zero : (0 : G).n = 0 := rfl
+      simp only [full, zero]
+      have p : gSize.toNat = 18446744069414584321 := by decide
+      rw [p]
+      omega
+  rw [diff]
+  split <;> decide +kernel
+
+theorem byte_carry_relation {x y z previous carry : G}
+    (hx : x.n < 256) (hy : y.n < 256) (hz : z.n < 256)
+    (hp : previous = 0 ∨ previous = 1) (hc : carry = 0 ∨ carry = 1)
+    (computed : carry = (x + y + previous - z) * inverse256) :
+    x.n + y.n + previous.n = z.n + 256 * carry.n := by
+  have hp' : previous.n ≤ 1 := by rcases hp with rfl | rfl <;> decide
+  have hc' : carry.n ≤ 1 := by rcases hc with rfl | rfl <;> decide
+  have fieldEqual : carry * 256 = x + y + previous - z := by
+    rw [computed, byte_division_eq]
+  have numeric := congrArg G.n fieldEqual
+  simp only [G.n_mul, G.n_sub, G.n_add] at numeric
+  have scale : (256 : G).n = 256 := rfl
+  have p : gSize.toNat = 18446744069414584321 := by decide
+  rw [scale, p] at numeric
+  omega
+
+def pack4 (bytes : Fin 4 → G) : G :=
+  bytes 0 + 256 * bytes 1 + 65536 * bytes 2 + 16777216 * bytes 3
+
+def pack4Nat (bytes : Fin 4 → G) : Nat :=
+  (bytes 0).n + 256 * (bytes 1).n + 65536 * (bytes 2).n + 16777216 * (bytes 3).n
+
+theorem pack4_n (bytes : Fin 4 → G) (bounded : ∀ i, (bytes i).n < 256) :
+    (pack4 bytes).n = pack4Nat bytes ∧ (pack4 bytes).n < 2 ^ 32 := by
+  have h0 := bounded 0
+  have h1 := bounded 1
+  have h2 := bounded 2
+  have h3 := bounded 3
+  have totalBound : (bytes 0).n + 256 * (bytes 1).n + 65536 * (bytes 2).n +
+      16777216 * (bytes 3).n < 2 ^ 32 := by omega
+  have fieldBound : (bytes 0).n + 256 * (bytes 1).n + 65536 * (bytes 2).n +
+      16777216 * (bytes 3).n < 18446744069414584321 :=
+    Nat.lt_trans totalBound (by decide)
+  have s1 : (256 : G).n = 256 := rfl
+  have s2 : (65536 : G).n = 65536 := rfl
+  have s3 : (16777216 : G).n = 16777216 := rfl
+  simp only [pack4, pack4Nat, G.n_add, G.n_mul, s1, s2, s3]
+  have p : gSize.toNat = 18446744069414584321 := by decide
+  rw [p]
+  simp only [Nat.add_mod_mod, Nat.mod_add_mod]
+  rw [Nat.mod_eq_of_lt fieldBound]
+  exact ⟨rfl, totalBound⟩
+
+def carryStep (x y z previous : G) : G := (x + y + previous - z) * inverse256
+
+def u32Carries (x y z : Fin 4 → G) : Fin 5 → G :=
+  let c1 := carryStep (x 0) (y 0) (z 0) 1
+  let c2 := carryStep (x 1) (y 1) (z 1) c1
+  let c3 := carryStep (x 2) (y 2) (z 2) c2
+  let c4 := carryStep (x 3) (y 3) (z 3) c3
+  fun i => match i with
+    | 0 => 1
+    | 1 => c1
+    | 2 => c2
+    | 3 => c3
+    | 4 => c4
+
+theorem u32Carry_relation (x y z : Fin 4 → G)
+    (hx : ∀ i, (x i).n < 256) (hy : ∀ i, (y i).n < 256) (hz : ∀ i, (z i).n < 256)
+    (boolean : ∀ i : Fin 4, booleanConstraint (u32Carries x y z i.succ) = 0) :
+    pack4Nat x + pack4Nat y + 1 = pack4Nat z + 2 ^ 32 * (u32Carries x y z 4).n := by
+  have hc0 : u32Carries x y z 0 = 0 ∨ u32Carries x y z 0 = 1 := Or.inr rfl
+  have hc1 := G.boolean_of_constraint (boolean 0)
+  have hc2 := G.boolean_of_constraint (boolean 1)
+  have hc3 := G.boolean_of_constraint (boolean 2)
+  have hc4 := G.boolean_of_constraint (boolean 3)
+  have r0 := byte_carry_relation (hx 0) (hy 0) (hz 0) hc0 hc1 rfl
+  have r1 := byte_carry_relation (hx 1) (hy 1) (hz 1) hc1 hc2 rfl
+  have r2 := byte_carry_relation (hx 2) (hy 2) (hz 2) hc2 hc3 rfl
+  have r3 := byte_carry_relation (hx 3) (hy 3) (hz 3) hc3 hc4 rfl
+  simp only [show (0 : Fin 4).succ = (1 : Fin 5) from rfl,
+    show (1 : Fin 4).succ = (2 : Fin 5) from rfl,
+    show (2 : Fin 4).succ = (3 : Fin 5) from rfl,
+    show (3 : Fin 4).succ = (4 : Fin 5) from rfl] at r0 r1 r2 r3
+  have initial : (u32Carries x y z 0).n = 1 := rfl
+  rw [initial] at r0
+  unfold pack4Nat
+  omega
+
+theorem u32_less_than (x y z : Fin 4 → G)
+    (hx : ∀ i, (x i).n < 256) (hy : ∀ i, (y i).n < 256) (hz : ∀ i, (z i).n < 256)
+    (boolean : ∀ i : Fin 4, booleanConstraint (u32Carries x y z i.succ) = 0) :
+    1 - u32Carries x y z 4 = G.u32LessThan (pack4 x) (pack4 z) := by
+  have relation := u32Carry_relation x y z hx hy hz boolean
+  obtain ⟨nx, bx⟩ := pack4_n x hx
+  obtain ⟨ny, by'⟩ := pack4_n y hy
+  obtain ⟨nz, bz⟩ := pack4_n z hz
+  have last := G.boolean_of_constraint (boolean 3)
+  change u32Carries x y z 4 = 0 ∨ u32Carries x y z 4 = 1 at last
+  rcases last with zero | one
+  · have value : (u32Carries x y z 4).n = 0 := congrArg G.n zero
+    have less : (pack4 x).n < (pack4 z).n := by omega
+    rw [zero, G.u32LessThan, if_pos less]
+    decide +kernel
+  · have value : (u32Carries x y z 4).n = 1 := congrArg G.n one
+    have notLess : ¬(pack4 x).n < (pack4 z).n := by omega
+    rw [one, G.u32LessThan, if_neg notLess]
+    decide +kernel
+
+theorem active_u32_less_than {selector a b : G} (active : selector = 1)
+    (x y z : Fin 4 → G)
+    (hx : ∀ i, (x i).n < 256) (hy : ∀ i, (y i).n < 256) (hz : ∀ i, (z i).n < 256)
+    (decomposeA : selector * (a - pack4 x) = 0)
+    (decomposeB : selector * (b - pack4 z) = 0)
+    (carries : ∀ i : Fin 4, selector * booleanConstraint (u32Carries x y z i.succ) = 0) :
+    a.n < 2 ^ 32 ∧ b.n < 2 ^ 32 ∧
+      1 - u32Carries x y z 4 = G.u32LessThan a b := by
+  have ha := active_case active decomposeA
+  have hb := active_case active decomposeB
+  subst a b
+  refine ⟨(pack4_n x hx).2, (pack4_n z hz).2, u32_less_than x y z hx hy hz ?_⟩
+  intro i
+  have satisfied := carries i
+  rw [active, G.mul_comm, G.mul_one] at satisfied
+  exact satisfied
+
+end AIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/ByteColumns.lean b/Ix/Aiur/Proofs/ByteColumns.lean
new file mode 100644
index 000000000..32b1b1cfb
--- /dev/null
+++ b/Ix/Aiur/Proofs/ByteColumns.lean
@@ -0,0 +1,373 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.MemoryColumns
+
+/-!
+The native fixed-height guard requires active byte tables at degrees 8 and 16.
+Physical byte columns and fixed preprocessed columns supply exactly the
+logical byte providers, up to enumeration order. A system trace combines
+canonical function, memory and byte assignments and their lookup budget.
+Its balanced, satisfying columns imply execution of the selected success
+call and functional memory. Native expression/codec/verifier refinement,
+compiler refinement and the certified semantic/cryptographic endpoint remain
+separate obligations.
+-/
+
+namespace Aiur
+
+def fixedTraceHeights : List Nat → List Bool → List Nat → Bool
+  | [], [], [] => true
+  | height :: heights, false :: active, degrees => height == 0 && fixedTraceHeights heights active degrees
+  | height :: heights, true :: active, degree :: degrees =>
+    (height == 0 || (degree < 64 && height == 2^degree)) && fixedTraceHeights heights active degrees
+  | _, _, _ => false
+
+inductive FixedTraceHeights : List Nat → List Bool → List Nat → Prop where
+  | nil : FixedTraceHeights [] [] []
+  | inactive {heights : List Nat} {active : List Bool} {degrees : List Nat}
+      (rest : FixedTraceHeights heights active degrees) :
+      FixedTraceHeights (0 :: heights) (false :: active) degrees
+  | active (height degree : Nat) {heights : List Nat} {active : List Bool} {degrees : List Nat}
+      (matched : height = 0 ∨ degree < 64 ∧ height = 2^degree)
+      (rest : FixedTraceHeights heights active degrees) :
+      FixedTraceHeights (height :: heights) (true :: active) (degree :: degrees)
+
+theorem fixedTraceHeights_sound {heights : List Nat} {active : List Bool} {degrees : List Nat}
+    (accepted : fixedTraceHeights heights active degrees = true) : FixedTraceHeights heights active degrees := by
+  induction heights generalizing active degrees with
+  | nil =>
+    cases active <;> cases degrees <;> simp only [fixedTraceHeights, Bool.false_eq_true] at accepted
+    exact .nil
+  | cons height heights ih =>
+    cases active with
+    | nil => simp only [fixedTraceHeights, Bool.false_eq_true] at accepted
+    | cons enabled active =>
+      cases enabled with
+      | false =>
+        simp only [fixedTraceHeights, Bool.and_eq_true, beq_iff_eq] at accepted
+        obtain ⟨rfl, accepted⟩ := accepted
+        exact .inactive (ih accepted)
+      | true =>
+        cases degrees with
+        | nil => simp only [fixedTraceHeights, Bool.false_eq_true] at accepted
+        | cons degree degrees =>
+          simp only [fixedTraceHeights, Bool.and_eq_true, Bool.or_eq_true, beq_iff_eq,
+            decide_eq_true_eq] at accepted
+          exact .active height degree accepted.1 (ih accepted.2)
+
+theorem fixedTraceHeights_complete {heights : List Nat} {active : List Bool} {degrees : List Nat}
+    (valid : FixedTraceHeights heights active degrees) : fixedTraceHeights heights active degrees = true := by
+  induction valid with
+  | nil => rfl
+  | inactive rest ih => exact ih
+  | active height degree matched rest ih =>
+    simp only [fixedTraceHeights, Bool.and_eq_true, Bool.or_eq_true, beq_iff_eq,
+      decide_eq_true_eq]
+    exact ⟨matched, ih⟩
+
+theorem FixedTraceHeights.alignment {heights : List Nat} {active : List Bool} {degrees : List Nat}
+    (valid : FixedTraceHeights heights active degrees) :
+    heights.length = active.length ∧ degrees.length = (active.filter id).length := by
+  induction valid with
+  | nil => exact ⟨rfl, rfl⟩
+  | inactive rest ih => simpa only [List.length_cons, List.filter_cons, id_eq,
+      Bool.false_eq_true, ↓reduceIte, Nat.add_right_cancel_iff] using ih
+  | active height degree matched rest ih => simpa only [List.length_cons, List.filter_cons, id_eq,
+      ↓reduceIte, Nat.add_right_cancel_iff] using ih
+
+end Aiur
+
+namespace Aiur.AIR
+
+abbrev Byte1Columns := Fin 3 → G
+abbrev Byte2Columns := Fin 10 → G
+
+def Byte1Kind.column : Byte1Kind → Fin 3
+  | .bits => 0
+  | .shiftLeft => 1
+  | .shiftRight => 2
+
+def Byte2Kind.column : Byte2Kind → Fin 10
+  | .xor => 0
+  | .add => 1
+  | .sub => 2
+  | .and => 3
+  | .or => 4
+  | .lessThan => 5
+  | .range => 6
+  | .mul => 7
+  | .split7 => 8
+  | .split4 => 9
+
+def byte1PreprocessedColumns (row : Fin 256) : Fin 11 → G :=
+  fun column => (byte1Preprocessed row)[column.val]?.getD 0
+
+def byte2PreprocessedColumns (row : Fin 65536) : Fin 14 → G :=
+  fun column => (byte2Preprocessed row)[column.val]?.getD 0
+
+def byte1ColumnLookup (kind : Byte1Kind) (preprocessed : Fin 11 → G) (columns : Byte1Columns) :
+    G × List G :=
+  (0 - columns kind.column, match kind with
+    | .bits => [2, preprocessed 0] ++ List.ofFn (fun bit : Fin 8 => preprocessed ⟨1 + bit.val, by omega⟩)
+    | .shiftLeft => [3, preprocessed 0, preprocessed 9]
+    | .shiftRight => [4, preprocessed 0, preprocessed 10])
+
+def byte2ColumnLookup (kind : Byte2Kind) (preprocessed : Fin 14 → G) (columns : Byte2Columns) :
+    G × List G :=
+  (0 - columns kind.column, [kind.channel, preprocessed 0, preprocessed 1] ++ match kind with
+    | .xor => [preprocessed 2]
+    | .add => [preprocessed 3]
+    | .sub => [preprocessed 4]
+    | .and => [preprocessed 5]
+    | .or => [preprocessed 6]
+    | .lessThan => [preprocessed 7]
+    | .range => []
+    | .mul => [preprocessed 8, preprocessed 9]
+    | .split7 => [preprocessed 10, preprocessed 11]
+    | .split4 => [preprocessed 12, preprocessed 13])
+
+def byte1ColumnProvider (kind : Byte1Kind) (row : Fin 256) (columns : Byte1Columns) :
+    Provider (List G) := ((byte1ColumnLookup kind (byte1PreprocessedColumns row) columns).2, columns kind.column)
+
+def byte2ColumnProvider (kind : Byte2Kind) (row : Fin 65536) (columns : Byte2Columns) :
+    Provider (List G) := ((byte2ColumnLookup kind (byte2PreprocessedColumns row) columns).2, columns kind.column)
+
+theorem byte1ColumnProvider_reflect (kind : Byte1Kind) (row : Fin 256) (columns : Byte1Columns) :
+    byte1ColumnProvider kind row columns =
+      (byte1Request kind (G.ofNat row.val) (byte1Outputs kind row), columns kind.column) := by
+  cases kind <;>
+    simp [byte1ColumnProvider, byte1ColumnLookup, byte1PreprocessedColumns, byte1Preprocessed,
+      byte1Request, byte1Outputs, Byte1Kind.channel, Byte1Kind.column, List.ofFn_succ]
+  all_goals simp [Array.getElem_push,
+    show (9 : Fin 11).val = 9 from rfl, show (10 : Fin 11).val = 10 from rfl]
+
+theorem byte2ColumnProvider_reflect (kind : Byte2Kind) (row : Fin 65536) (columns : Byte2Columns) :
+    byte2ColumnProvider kind row columns =
+      (byte2Request kind (byteRangeMessage row).1 (byteRangeMessage row).2 (byte2Outputs kind row),
+        columns kind.column) := by
+  cases kind <;>
+    simp [byte2ColumnProvider, byte2ColumnLookup, byte2PreprocessedColumns, byte2Preprocessed,
+      byte2Request, byte2Outputs, Byte2Kind.channel, Byte2Kind.column]
+  all_goals repeat constructor
+  all_goals rfl
+
+end Aiur.AIR
+
+namespace Aiur
+
+theorem fixedTraceHeights_bytes {active : List Bool} {degrees : List Nat}
+    (accepted : fixedTraceHeights [256, 65536] active degrees = true) :
+    active = [true, true] ∧ degrees = [8, 16] := by
+  have valid := fixedTraceHeights_sound accepted
+  cases valid with
+  | active _ degree first rest =>
+    have firstPower : 2^degree = 2^8 := by
+      rcases first with impossible | ⟨_, power⟩
+      · contradiction
+      · exact power.symm
+    have firstDegree := (Nat.pow_right_inj (by decide : 1 < 2)).mp firstPower
+    cases rest with
+    | active _ next second rest =>
+      have secondPower : 2^next = 2^16 := by
+        rcases second with impossible | ⟨_, power⟩
+        · contradiction
+        · exact power.symm
+      have secondDegree := (Nat.pow_right_inj (by decide : 1 < 2)).mp secondPower
+      cases rest
+      exact ⟨rfl, by rw [firstDegree, secondDegree]⟩
+
+end Aiur
+
+namespace Aiur.AIR
+
+theorem CircuitTraces.fixed_heights_append {circuits : List Bytecode.Circuit} (traces : CircuitTraces circuits)
+    (heights : List Nat) (active : List Bool) (degrees : List Nat) :
+    fixedTraceHeights (List.replicate circuits.length 0 ++ heights)
+      (traces.bitmap ++ active) (traces.degrees ++ degrees) = fixedTraceHeights heights active degrees := by
+  induction traces with
+  | nil => rfl
+  | inactive circuit rest ih =>
+    simpa only [List.length_cons, List.replicate_succ, List.cons_append, bitmap, CircuitTraces.degrees,
+      fixedTraceHeights, beq_self_eq_true, Bool.true_and] using ih
+  | active circuit degree values rest ih =>
+    simpa only [List.length_cons, List.replicate_succ, List.cons_append, bitmap, CircuitTraces.degrees,
+      fixedTraceHeights, beq_self_eq_true, Bool.true_or, Bool.true_and] using ih
+
+theorem MemoryTraces.fixed_heights_append {widths : List Nat} (traces : MemoryTraces widths)
+    (heights : List Nat) (active : List Bool) (degrees : List Nat) :
+    fixedTraceHeights (List.replicate widths.length 0 ++ heights)
+      (traces.bitmap ++ active) (traces.degrees ++ degrees) = fixedTraceHeights heights active degrees := by
+  induction traces with
+  | nil => rfl
+  | inactive width rest ih =>
+    simpa only [List.length_cons, List.replicate_succ, List.cons_append, bitmap, MemoryTraces.degrees,
+      fixedTraceHeights, beq_self_eq_true, Bool.true_and] using ih
+  | active width degree matrix rest ih =>
+    simpa only [List.length_cons, List.replicate_succ, List.cons_append, bitmap, MemoryTraces.degrees,
+      fixedTraceHeights, beq_self_eq_true, Bool.true_or, Bool.true_and] using ih
+
+theorem canonical_byte_metadata {circuits : List Bytecode.Circuit} (functions : CircuitTraces circuits)
+    {widths : List Nat} (memories : MemoryTraces widths)
+    {active : List Bool} {degrees : List Nat}
+    (accepted : fixedTraceHeights
+      (List.replicate circuits.length 0 ++ (List.replicate widths.length 0 ++ [256, 65536]))
+      (functions.bitmap ++ (memories.bitmap ++ active))
+      (functions.degrees ++ (memories.degrees ++ degrees)) = true) :
+    active = [true, true] ∧ degrees = [8, 16] := by
+  rw [functions.fixed_heights_append, memories.fixed_heights_append] at accepted
+  exact fixedTraceHeights_bytes accepted
+
+end Aiur.AIR
+
+namespace Aiur.AIR
+
+theorem suppliedWeight_perm {α : Type} [DecidableEq α] {left right : List (Provider α)}
+    (permutation : left.Perm right) (message : α) : suppliedWeight message left = suppliedWeight message right := by
+  induction permutation with
+  | nil => rfl
+  | cons provider permutation ih =>
+    change (if provider.1 = message then provider.2 + suppliedWeight message _ else suppliedWeight message _) =
+      (if provider.1 = message then provider.2 + suppliedWeight message _ else suppliedWeight message _)
+    rw [ih]
+  | swap a b rest =>
+    by_cases left : a.1 = message <;> by_cases right : b.1 = message <;>
+      simp only [suppliedWeight, List.foldr_cons, left, right, ↓reduceIte]
+    rw [← G.add_assoc, G.add_comm b.2 a.2, G.add_assoc]
+  | trans first last ih ih' => exact ih.trans ih'
+
+theorem PaddedLookupBalance.perm_providers {width : Nat} {queries : List (List G)}
+    {left right : List (Provider (List G))} (balanced : PaddedLookupBalance width queries left)
+    (permutation : left.Perm right) : PaddedLookupBalance width queries right := by
+  intro message
+  exact (balanced message).trans (suppliedWeight_perm (permutation.map _) message)
+
+private theorem flatMap_append_perm {α β : Type} (items : List α) (left right : α → List β) :
+    (items.flatMap fun item => left item ++ right item).Perm (items.flatMap left ++ items.flatMap right) := by
+  induction items with
+  | nil => exact .nil
+  | cons item items ih =>
+    simp only [List.flatMap_cons]
+    have first := (List.Perm.refl (left item ++ right item)).append ih
+    apply first.trans
+    simpa only [List.append_assoc] using
+      ((show (right item ++ items.flatMap left).Perm (items.flatMap left ++ right item) from
+        List.perm_append_comm).append_right
+        (items.flatMap right)).append_left (left item)
+
+theorem flatMap_map_swap {α β γ : Type} (left : List α) (right : List β) (value : α → β → γ) :
+    (left.flatMap fun a => right.map (value a)).Perm (right.flatMap fun b => left.map (fun a => value a b)) := by
+  induction right with
+  | nil => simp
+  | cons b right ih =>
+    simp only [List.map_cons, List.flatMap_cons]
+    have split := flatMap_append_perm left (fun a => [value a b]) (fun a => right.map (value a))
+    simp only [← List.map_eq_flatMap] at split
+    exact split.trans ((List.Perm.refl _).append ih)
+
+def byte1MatrixProviders (matrix : Fin 256 → Byte1Columns) : List (Provider (List G)) :=
+  (List.finRange 256).flatMap fun row => Byte1Kind.all.map fun kind => byte1ColumnProvider kind row (matrix row)
+
+def byte2MatrixProviders (matrix : Fin 65536 → Byte2Columns) : List (Provider (List G)) :=
+  (List.finRange 65536).flatMap fun row => Byte2Kind.all.map fun kind => byte2ColumnProvider kind row (matrix row)
+
+theorem byte1MatrixProviders_reflect (matrix : Fin 256 → Byte1Columns) :
+    (byte1MatrixProviders matrix).Perm (byte1Providers fun kind row => matrix row kind.column) := by
+  have swapped := flatMap_map_swap (List.finRange 256) Byte1Kind.all
+    (fun row kind => byte1ColumnProvider kind row (matrix row))
+  simpa only [byte1MatrixProviders, byte1ColumnProvider_reflect, byte1Providers,
+    List.finRange, List.map_ofFn, Function.comp_def] using swapped
+
+theorem byte2MatrixProviders_reflect (matrix : Fin 65536 → Byte2Columns) :
+    (byte2MatrixProviders matrix).Perm (byte2Providers fun kind row => matrix row kind.column) := by
+  have swapped := flatMap_map_swap (List.finRange 65536) Byte2Kind.all
+    (fun row kind => byte2ColumnProvider kind row (matrix row))
+  simpa only [byte2MatrixProviders, byte2ColumnProvider_reflect, byte2Providers,
+    List.finRange, List.map_ofFn, Function.comp_def] using swapped
+
+structure ByteTraces where
+  unary : Fin 256 → Byte1Columns
+  binary : Fin 65536 → Byte2Columns
+
+def ByteTraces.providers (traces : ByteTraces) : List (Provider (List G)) :=
+  byte1MatrixProviders traces.unary ++ byte2MatrixProviders traces.binary
+
+def ByteTraces.byte1Weights (traces : ByteTraces) : Byte1Kind → Fin 256 → G :=
+  fun kind row => traces.unary row kind.column
+
+def ByteTraces.byte2Weights (traces : ByteTraces) : Byte2Kind → Fin 65536 → G :=
+  fun kind row => traces.binary row kind.column
+
+theorem ByteTraces.providers_reflect (traces : ByteTraces) :
+    traces.providers.Perm (byte1Providers traces.byte1Weights ++ byte2Providers traces.byte2Weights) :=
+  (byte1MatrixProviders_reflect traces.unary).append (byte2MatrixProviders_reflect traces.binary)
+
+structure SystemTraces (program : Bytecode.Toplevel) where
+  functions : CircuitTraces program.circuits.toList
+  memories : MemoryTraces program.memorySizes.toList
+  bytes : ByteTraces
+
+def SystemTraces.bitmap {program : Bytecode.Toplevel} (traces : SystemTraces program) : List Bool :=
+  traces.functions.bitmap ++ (traces.memories.bitmap ++ [true, true])
+
+def SystemTraces.degrees {program : Bytecode.Toplevel} (traces : SystemTraces program) : List Nat :=
+  traces.functions.degrees ++ (traces.memories.degrees ++ [8, 16])
+
+def systemFixedHeights (program : Bytecode.Toplevel) : List Nat :=
+  List.replicate program.circuits.size 0 ++ (List.replicate program.memorySizes.size 0 ++ [256, 65536])
+
+def systemLookupSlots (program : Bytecode.Toplevel) : List Nat :=
+  program.circuits.toList.map (·.layout.lookups) ++ (List.replicate program.memorySizes.size 1 ++ [3, 10])
+
+def SystemTraces.queryBound {program : Bytecode.Toplevel} (traces : SystemTraces program) : Option Nat :=
+  lookupQueryBound (systemLookupSlots program) traces.bitmap traces.degrees
+
+def SystemTraces.providers {program : Bytecode.Toplevel} (traces : SystemTraces program)
+    (circuits : List CircuitEmission) : List (Provider (List G)) :=
+  circuitProviders circuits ++ (traces.memories.providers ++ traces.bytes.providers)
+
+theorem SystemTraces.fixed_heights {program : Bytecode.Toplevel} (traces : SystemTraces program) :
+    fixedTraceHeights (systemFixedHeights program) traces.bitmap traces.degrees = true := by
+  unfold systemFixedHeights bitmap degrees
+  rw [← Array.length_toList, traces.functions.fixed_heights_append]
+  rw [← Array.length_toList, traces.memories.fixed_heights_append]
+  rfl
+
+theorem SystemTraces.memory_functional {program : Bytecode.Toplevel} (traces : SystemTraces program)
+    {result : Nat} (budget : traces.queryBound = some result) (satisfied : traces.memories.Satisfied)
+    {width : Nat} {pointer : G} {left right : Array G}
+    (loadedLeft : memoryFacts traces.memories.rows width pointer left)
+    (loadedRight : memoryFacts traces.memories.rows width pointer right) : left = right :=
+  traces.memories.functional_of_budget traces.functions budget satisfied loadedLeft loadedRight
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+theorem Backend.column_trace_execution {selection : Selection} (backend : Backend selection)
+    (traces : SystemTraces backend.compiled.bytecode) {witnesses : List CircuitWitness}
+    (emitted : traces.functions.emitWitnesses backend.compiled.bytecode = some witnesses)
+    {result : Nat} (budget : traces.queryBound = some result)
+    (width : Nat) (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        encodedCircuitQueryPool (witnesses.map (·.emission)))
+      (traces.providers (witnesses.map (·.emission))))
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied) (memorySatisfied : traces.memories.Satisfied) :
+    Execution backend.compiled.bytecode (memoryFacts traces.memories.rows)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  unfold SystemTraces.providers at balanced
+  have replaced := balanced.perm_providers
+    ((traces.bytes.providers_reflect.append_left traces.memories.providers).append_left
+      (circuitProviders (witnesses.map CircuitWitness.emission)))
+  rw [← List.append_assoc traces.memories.providers] at replaced
+  exact backend.memory_trace_execution traces.functions traces.memories
+    traces.bytes.byte1Weights traces.bytes.byte2Weights emitted budget width input arity
+    replaced publicWidth queryWidths satisfied memorySatisfied
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/ByteLookups.lean b/Ix/Aiur/Proofs/ByteLookups.lean
new file mode 100644
index 000000000..73e644c1f
--- /dev/null
+++ b/Ix/Aiur/Proofs/ByteLookups.lean
@@ -0,0 +1,284 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ByteArithmetic
+
+/-!
+Extraction of byte operations from fixed byte-table lookup messages.
+
+The three unary and ten binary channels, row order, output columns and
+arities match the native byte chips. Providers range over the complete
+fixed tables with arbitrary field multiplicities. Exact balance and a
+query-count bound force each requested input and output to match one row.
+The step theorems include virtual carry/borrow outputs omitted by lookups.
+
+Native preprocessed rows and lookup expressions are compared exhaustively
+against these definitions by the component gate. That executable comparison
+does not prove native refinement. Extracting balance for these exact tuples
+from the global padded/compressed lookup argument remains a separate task.
+-/
+
+namespace Aiur.AIR
+
+inductive Byte1Kind where
+  | bits | shiftLeft | shiftRight
+  deriving DecidableEq
+
+def Byte1Kind.all : List Byte1Kind := [.bits, .shiftLeft, .shiftRight]
+
+def Byte1Kind.channel : Byte1Kind → G
+  | .bits => 2
+  | .shiftLeft => 3
+  | .shiftRight => 4
+
+theorem Byte1Kind.channel_injective {left right : Byte1Kind}
+    (same : left.channel = right.channel) : left = right := by
+  revert same
+  cases left <;> cases right <;> decide +kernel
+
+def Byte1Kind.result : Byte1Kind → G → Array G
+  | .bits, input => Array.ofFn (G.u8BitDecomposition input)
+  | .shiftLeft, input => #[G.u8ShiftLeft input]
+  | .shiftRight, input => #[G.u8ShiftRight input]
+
+def byte1Outputs (kind : Byte1Kind) (row : Fin 256) : Array G :=
+  match kind with
+  | .bits => Array.ofFn fun bit : Fin 8 => G.ofNat ((row.val >>> bit.val) &&& 1)
+  | .shiftLeft => #[G.ofNat ((row.val * 2) % 256)]
+  | .shiftRight => #[G.ofNat (row.val / 2)]
+
+def byte1Request (kind : Byte1Kind) (input : G) (outputs : Array G) : List G :=
+  kind.channel :: input :: outputs.toList
+
+def byte1Providers (weights : Byte1Kind → Fin 256 → G) : List (Provider (List G)) :=
+  Byte1Kind.all.flatMap fun kind => List.ofFn fun row =>
+    (byte1Request kind (G.ofNat row.val) (byte1Outputs kind row), weights kind row)
+
+theorem byte1Outputs_correct (kind : Byte1Kind) (row : Fin 256) :
+    byte1Outputs kind row = kind.result (G.ofNat row.val) := by
+  have below : row.val < gSize.toNat := Nat.lt_trans row.isLt (by decide)
+  cases kind <;>
+    simp only [byte1Outputs, Byte1Kind.result, G.u8ShiftLeft,
+      G.u8ShiftRight, G.n_ofNat, Nat.mod_eq_of_lt below]
+  apply congrArg Array.ofFn
+  funext bit
+  simp only [G.u8BitDecomposition, G.n_ofNat, Nat.mod_eq_of_lt below]
+
+theorem exactLookupBalance_byte1 {queries : List (List G)}
+    (weights : Byte1Kind → Fin 256 → G)
+    (balanced : ExactLookupBalance queries (byte1Providers weights))
+    (bounded : queries.length < gSize.toNat)
+    {kind : Byte1Kind} {input : G} {outputs : Array G}
+    (queried : byte1Request kind input outputs ∈ queries) :
+    input.n < 256 ∧ outputs = kind.result input := by
+  obtain ⟨provider, member, same, _⟩ := exactLookupBalance_provider balanced bounded queried
+  obtain ⟨providerKind, _, rowMember⟩ := List.mem_flatMap.mp member
+  obtain ⟨row, equal⟩ := List.mem_ofFn.mp rowMember
+  subst provider
+  change byte1Request providerKind (G.ofNat row.val) (byte1Outputs providerKind row) =
+    byte1Request kind input outputs at same
+  obtain ⟨sameChannel, sameTail⟩ := List.cons.inj same
+  have equalKind := Byte1Kind.channel_injective sameChannel
+  subst providerKind
+  obtain ⟨sameInput, sameOutputs⟩ := List.cons.inj sameTail
+  have below : row.val < gSize.toNat := Nat.lt_trans row.isLt (by decide)
+  constructor
+  · rw [← sameInput, G.n_ofNat, Nat.mod_eq_of_lt below]
+    exact row.isLt
+  · rw [← sameInput]
+    exact (Array.toList_inj.mp sameOutputs).symm.trans (byte1Outputs_correct kind row)
+
+inductive Byte2Kind where
+  | xor | add | sub | and | or | lessThan | range | mul | split7 | split4
+  deriving DecidableEq
+
+def Byte2Kind.all : List Byte2Kind :=
+  [.xor, .add, .sub, .and, .or, .lessThan, .range, .mul, .split7, .split4]
+
+def Byte2Kind.channel : Byte2Kind → G
+  | .xor => 5
+  | .add => 6
+  | .sub => 7
+  | .and => 8
+  | .or => 9
+  | .lessThan => 10
+  | .range => 11
+  | .mul => 12
+  | .split7 => 13
+  | .split4 => 14
+
+theorem Byte2Kind.channel_injective {left right : Byte2Kind}
+    (same : left.channel = right.channel) : left = right := by
+  revert same
+  cases left <;> cases right <;> decide +kernel
+
+def Byte2Kind.result : Byte2Kind → G → G → Array G
+  | .xor, x, y => #[G.u8Xor x y]
+  | .add, x, y => #[(G.u8Add x y).1]
+  | .sub, x, y => #[(G.u8Sub x y).1]
+  | .and, x, y => #[G.u8And x y]
+  | .or, x, y => #[G.u8Or x y]
+  | .lessThan, x, y => #[G.u8LessThan x y]
+  | .range, _, _ => #[]
+  | .mul, x, y => Bytecode.AIR.pairValues (G.u8Mul x y)
+  | .split7, x, y => #[G.ofNat ((x.n ^^^ y.n) / 128), G.ofNat (((x.n ^^^ y.n) * 2) % 256)]
+  | .split4, x, y => #[G.ofNat ((x.n ^^^ y.n) / 16), G.ofNat (((x.n ^^^ y.n) * 16) % 256)]
+
+def byte2Outputs (kind : Byte2Kind) (row : Fin 65536) : Array G :=
+  let x := row.val / 256
+  let y := row.val % 256
+  match kind with
+  | .xor => #[G.ofNat (x ^^^ y)]
+  | .add => #[G.ofNat ((x + y) % 256)]
+  | .sub => #[G.ofNat ((x + 256 - y) % 256)]
+  | .and => #[G.ofNat (x &&& y)]
+  | .or => #[G.ofNat (x ||| y)]
+  | .lessThan => #[if x < y then 1 else 0]
+  | .range => #[]
+  | .mul => #[G.ofNat ((x * y) % 256), G.ofNat ((x * y) / 256)]
+  | .split7 => #[G.ofNat ((x ^^^ y) / 128), G.ofNat (((x ^^^ y) * 2) % 256)]
+  | .split4 => #[G.ofNat ((x ^^^ y) / 16), G.ofNat (((x ^^^ y) * 16) % 256)]
+
+def byte2Request (kind : Byte2Kind) (x y : G) (outputs : Array G) : List G :=
+  kind.channel :: x :: y :: outputs.toList
+
+def byte2Providers (weights : Byte2Kind → Fin 65536 → G) : List (Provider (List G)) :=
+  Byte2Kind.all.flatMap fun kind => List.ofFn fun row =>
+    let inputs := byteRangeMessage row
+    (byte2Request kind inputs.1 inputs.2 (byte2Outputs kind row), weights kind row)
+
+theorem byte2Outputs_correct (kind : Byte2Kind) (row : Fin 65536) :
+    byte2Outputs kind row = kind.result (byteRangeMessage row).1 (byteRangeMessage row).2 := by
+  have left : row.val / 256 < gSize.toNat :=
+    Nat.lt_trans (show row.val / 256 < 256 by omega) (by decide)
+  have right : row.val % 256 < gSize.toNat := Nat.lt_trans (Nat.mod_lt _ (by decide)) (by decide)
+  cases kind <;>
+    simp only [byte2Outputs, Byte2Kind.result, byteRangeMessage, G.u8Xor, G.u8Add,
+      G.u8Sub, G.u8And, G.u8Or, G.u8LessThan, G.u8Mul, Bytecode.AIR.pairValues,
+      G.n_ofNat, Nat.mod_eq_of_lt left, Nat.mod_eq_of_lt right]
+
+theorem exactLookupBalance_byte2 {queries : List (List G)}
+    (weights : Byte2Kind → Fin 65536 → G)
+    (balanced : ExactLookupBalance queries (byte2Providers weights))
+    (bounded : queries.length < gSize.toNat)
+    {kind : Byte2Kind} {x y : G} {outputs : Array G}
+    (queried : byte2Request kind x y outputs ∈ queries) :
+    x.n < 256 ∧ y.n < 256 ∧ outputs = kind.result x y := by
+  obtain ⟨provider, member, same, _⟩ := exactLookupBalance_provider balanced bounded queried
+  obtain ⟨providerKind, _, rowMember⟩ := List.mem_flatMap.mp member
+  obtain ⟨row, equal⟩ := List.mem_ofFn.mp rowMember
+  subst provider
+  change byte2Request providerKind (byteRangeMessage row).1 (byteRangeMessage row).2
+    (byte2Outputs providerKind row) = byte2Request kind x y outputs at same
+  obtain ⟨sameChannel, sameTail⟩ := List.cons.inj same
+  have equalKind := Byte2Kind.channel_injective sameChannel
+  subst providerKind
+  obtain ⟨sameX, sameTail⟩ := List.cons.inj sameTail
+  obtain ⟨sameY, sameOutputs⟩ := List.cons.inj sameTail
+  rw [← sameX, ← sameY]
+  refine ⟨(byteRangeMessage_bounded row).1, (byteRangeMessage_bounded row).2, ?_⟩
+  exact (Array.toList_inj.mp sameOutputs).symm.trans (byte2Outputs_correct kind row)
+
+def Byte1Kind.op : Byte1Kind → Bytecode.ValIdx → Bytecode.Op
+  | .bits => .u8BitDecomposition
+  | .shiftLeft => .u8ShiftLeft
+  | .shiftRight => .u8ShiftRight
+
+theorem byte1_primitive {kind : Byte1Kind} {values : Array G} {index : Bytecode.ValIdx}
+    {input : G} (read : values[index]? = some input) (bounded : input.n < 256) :
+    Bytecode.AIR.primitive (kind.op index) values #[] = some (kind.result input) := by
+  cases kind <;>
+    simp only [Byte1Kind.op, Byte1Kind.result, Bytecode.AIR.primitive,
+      Bytecode.AIR.unaryByte, read, bind, Option.bind, if_pos bounded, Function.comp_apply]
+
+theorem exactLookupBalance_byte1_step {queries : List (List G)}
+    (weights : Byte1Kind → Fin 256 → G)
+    (balanced : ExactLookupBalance queries (byte1Providers weights))
+    (bounded : queries.length < gSize.toNat)
+    (memory : Bytecode.AIR.Memory) {kind : Byte1Kind} {values : Array G}
+    {index : Bytecode.ValIdx} {input : G} {outputs : Array G}
+    (read : values[index]? = some input)
+    (queried : byte1Request kind input outputs ∈ queries) :
+    Bytecode.AIR.Step memory (kind.op index) values (values ++ outputs) [] := by
+  obtain ⟨range, correct⟩ := exactLookupBalance_byte1 weights balanced bounded queried
+  apply Bytecode.AIR.Step.primitive (advice := #[])
+  rw [correct]
+  exact byte1_primitive read range
+
+def Byte2Kind.op : Byte2Kind → Bytecode.ValIdx → Bytecode.ValIdx → Bytecode.Op
+  | .xor => .u8Xor
+  | .add => .u8Add
+  | .sub => .u8Sub
+  | .and => .u8And
+  | .or => .u8Or
+  | .lessThan => .u8LessThan
+  | .range => .u8RangeCheck
+  | .mul => .u8Mul
+  | .split7 => .u8XorSplit7
+  | .split4 => .u8XorSplit4
+
+def Byte2Kind.extendOutputs (kind : Byte2Kind) (x y : G) (outputs : Array G) : Array G :=
+  match kind with
+  | .add => outputs.push ((x + y - outputs[0]?.getD 0) * inverse256)
+  | .sub => outputs.push ((outputs[0]?.getD 0 + y - x) * inverse256)
+  | _ => outputs
+
+theorem byte2_primitive {kind : Byte2Kind} {values : Array G} {left right : Bytecode.ValIdx}
+    {x y : G} (readX : values[left]? = some x) (readY : values[right]? = some y)
+    (hx : x.n < 256) (hy : y.n < 256) :
+    Bytecode.AIR.primitive (kind.op left right) values #[] =
+      some (kind.extendOutputs x y (kind.result x y)) := by
+  cases kind <;>
+    simp only [Byte2Kind.op, Byte2Kind.result, Byte2Kind.extendOutputs,
+      Bytecode.AIR.primitive, Bytecode.AIR.binaryByte, readX, readY,
+      bind, Option.bind, if_pos (And.intro hx hy)]
+  · simp only [G.u8Add, Bytecode.AIR.pairValues, Array.getElem?_singleton, ite_true, Option.getD_some]
+    rw [byte_add_carry hx hy rfl]
+    rfl
+  · simp only [G.u8Sub, Bytecode.AIR.pairValues, Array.getElem?_singleton, ite_true, Option.getD_some]
+    rw [byte_sub_borrow hx hy rfl]
+    rfl
+
+theorem exactLookupBalance_byte2_step {queries : List (List G)}
+    (weights : Byte2Kind → Fin 65536 → G)
+    (balanced : ExactLookupBalance queries (byte2Providers weights))
+    (bounded : queries.length < gSize.toNat)
+    (memory : Bytecode.AIR.Memory) {kind : Byte2Kind} {values : Array G}
+    {left right : Bytecode.ValIdx} {x y : G} {outputs : Array G}
+    (readX : values[left]? = some x) (readY : values[right]? = some y)
+    (queried : byte2Request kind x y outputs ∈ queries) :
+    Bytecode.AIR.Step memory (kind.op left right) values
+      (values ++ kind.extendOutputs x y outputs) [] := by
+  obtain ⟨rangeX, rangeY, correct⟩ := exactLookupBalance_byte2 weights balanced bounded queried
+  apply Bytecode.AIR.Step.primitive (advice := #[])
+  rw [correct]
+  exact byte2_primitive readX readY rangeX rangeY
+
+theorem active_u32_less_than_step (memory : Bytecode.AIR.Memory)
+    {selector a b : G} {values : Array G} {left right : Bytecode.ValIdx}
+    (active : selector = 1) (readA : values[left]? = some a) (readB : values[right]? = some b)
+    (x y z : Fin 4 → G)
+    (hx : ∀ i, (x i).n < 256) (hy : ∀ i, (y i).n < 256) (hz : ∀ i, (z i).n < 256)
+    (decomposeA : selector * (a - pack4 x) = 0)
+    (decomposeB : selector * (b - pack4 z) = 0)
+    (carries : ∀ i : Fin 4, selector * booleanConstraint (u32Carries x y z i.succ) = 0) :
+    Bytecode.AIR.Step memory (.u32LessThan left right) values
+      (values ++ #[1 - u32Carries x y z 4]) [] := by
+  obtain ⟨rangeA, rangeB, correct⟩ := active_u32_less_than active x y z hx hy hz decomposeA decomposeB carries
+  apply Bytecode.AIR.Step.primitive (advice := #[])
+  simp only [Bytecode.AIR.primitive, readA, readB, bind, Option.bind, if_pos (And.intro rangeA rangeB), correct]
+
+def byte1Preprocessed (row : Fin 256) : Array G :=
+  #[G.ofNat row.val] ++ byte1Outputs .bits row ++
+    byte1Outputs .shiftLeft row ++ byte1Outputs .shiftRight row
+
+def byte2Preprocessed (row : Fin 65536) : Array G :=
+  let inputs := byteRangeMessage row
+  #[inputs.1, inputs.2] ++ byte2Outputs .xor row ++ byte2Outputs .add row ++
+    byte2Outputs .sub row ++ byte2Outputs .and row ++ byte2Outputs .or row ++
+    byte2Outputs .lessThan row ++ byte2Outputs .mul row ++ byte2Outputs .split7 row ++
+    byte2Outputs .split4 row
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/CallInventory.lean b/Ix/Aiur/Proofs/CallInventory.lean
new file mode 100644
index 000000000..69f790b63
--- /dev/null
+++ b/Ix/Aiur/Proofs/CallInventory.lean
@@ -0,0 +1,93 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationRows
+
+/-!
+Call inventories retain the exact function and gap queries and rank-order
+polynomials emitted alongside each operation. Sequence composition preserves
+this inventory. Active satisfying calls have strictly increasing bounded ranks
+when their byte queries belong to the shared global lookup pool.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+/-- Every recorded call has its function query, all gap range queries and
+its selector-gated rank-order equation in the same emission. -/
+def CallsEmitted (rank selector : G) (equations : List G) (queries : List (List G))
+    (calls : List (Bytecode.AIR.Call × (Fin 6 → G))) : Prop :=
+  ∀ edge ∈ calls, functionMessage edge.1 ∈ queries ∧
+    (rankByteQueries edge.2).map rangeMessage ⊆ queries ∧
+    selector * callOrderConstraint rank edge.1.rank (packRank edge.2) ∈ equations
+
+theorem emitOp_calls {row : Nat → G} {selector rank : G} {op : Op}
+    {values : Array RowValue} {emission : OpEmission}
+    (emitted : emitOp row selector rank op values = some emission) :
+    CallsEmitted rank selector emission.equations emission.queries emission.calls := by
+  cases op <;> simp only [emitOp, emitByte1, emitByte2, emitU32LessThan, emitU32Add,
+    emitAdvice, bind, Option.bind, Option.map, pure] at emitted
+  all_goals
+    repeat' first
+      | split at emitted
+      | (dsimp only at emitted; split at emitted)
+  all_goals cases emitted
+  all_goals simp [CallsEmitted]
+
+theorem CallsEmitted.append {rank selector : G} {firstEquations restEquations : List G}
+    {firstQueries restQueries : List (List G)}
+    {firstCalls restCalls : List (Bytecode.AIR.Call × (Fin 6 → G))}
+    (first : CallsEmitted rank selector firstEquations firstQueries firstCalls)
+    (rest : CallsEmitted rank selector restEquations restQueries restCalls) :
+    CallsEmitted rank selector (firstEquations ++ restEquations)
+      (firstQueries ++ restQueries) (firstCalls ++ restCalls) := by
+  intro edge member
+  rcases List.mem_append.mp member with left | right
+  · obtain ⟨query, bytes, equation⟩ := first edge left
+    exact ⟨List.mem_append_left _ query,
+      fun _ member => List.mem_append_left _ (bytes member),
+      List.mem_append_left _ equation⟩
+  · obtain ⟨query, bytes, equation⟩ := rest edge right
+    exact ⟨List.mem_append_right _ query,
+      fun _ member => List.mem_append_right _ (bytes member),
+      List.mem_append_right _ equation⟩
+
+theorem emitOps_calls {row : Nat → G} {selector rank : G} {ops : List Op}
+    {values : Array RowValue} {column : Nat} {emission : OpsEmission}
+    (emitted : emitOps row selector rank ops values column = some emission) :
+    CallsEmitted rank selector emission.equations emission.queries emission.calls := by
+  induction ops generalizing values column emission with
+  | nil =>
+    simp only [emitOps, Option.some.injEq] at emitted
+    subst emission
+    simp [CallsEmitted]
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i first firstEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i rest restEmitted
+        have equal := Option.some.inj emitted
+        subst emission
+        exact (emitOp_calls firstEmitted).append (ih restEmitted)
+
+theorem CallsEmitted.ordered {tables : LookupTables} {width : Nat} {pool : List (List G)}
+    (global : GlobalLookups tables width pool)
+    {rank selector : G} {equations : List G} {queries : List (List G)}
+    {calls : List (Bytecode.AIR.Call × (Fin 6 → G))}
+    (tracked : CallsEmitted rank selector equations queries calls)
+    (active : selector = 1) (satisfied : ∀ equation ∈ equations, equation = 0)
+    (queried : queries ⊆ pool) (rankBound : rank.n < callRankBound)
+    {edge : Bytecode.AIR.Call × (Fin 6 → G)} (called : edge ∈ calls)
+    (childBound : edge.1.rank.n < callRankBound) :
+    functionMessage edge.1 ∈ pool ∧ rank.n < edge.1.rank.n := by
+  obtain ⟨query, bytes, equation⟩ := tracked edge called
+  refine ⟨queried query, active_call_order_strict active rankBound childBound ?_ (satisfied _ equation)⟩
+  exact packRank_lt edge.2 (global.rank_bytes edge.2 (fun _ member => queried (bytes member)))
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/CallOrder.lean b/Ix/Aiur/Proofs/CallOrder.lean
new file mode 100644
index 000000000..5fde65ca6
--- /dev/null
+++ b/Ix/Aiur/Proofs/CallOrder.lean
@@ -0,0 +1,143 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Activity
+
+/-! Arithmetic for the call-order AIR. Each active function row carries a
+48-bit rank. A constrained call binds the callee's rank in its function
+lookup and supplies a 48-bit gap satisfying `child - parent - 1 - gap = 0`.
+The bounds prevent field wraparound and force strict increase. Connecting
+the byte-table lookups and native constraint emitter to these premises is
+part of the remaining AIR extraction proof.
+-/
+
+namespace Aiur
+
+theorem G.n_ofNat (n : Nat) : (G.ofNat n).n = n % gSize.toNat := by
+  have hm : n % gSize.toNat < gSize.toNat := Nat.mod_lt _ (by decide)
+  have hw : n % gSize.toNat < UInt64.size := Nat.lt_trans hm (by decide)
+  have hv : (n % gSize.toNat).toUInt64.toNat = n % gSize.toNat := by
+    simp [Nat.toUInt64, Nat.mod_eq_of_lt hw]
+  have h : (n % gSize.toNat).toUInt64 < gSize := by
+    simpa only [UInt64.lt_iff_toNat_lt, hv] using hm
+  simp only [G.ofNat, dif_pos h, G.n, hv]
+
+theorem G.sub_eq_zero_iff (a b : G) : a - b = 0 ↔ a = b := by
+  have ha : a.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp a.property
+  have hb : b.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp b.property
+  have hp : gSize.toNat = 18446744069414584321 := by decide
+  constructor
+  · intro h
+    have hn := congrArg G.n h
+    change (G.ofNat (a.n + gSize.toNat - b.n)).n = 0 at hn
+    rw [G.n_ofNat, hp] at hn
+    rw [hp] at ha hb
+    have he : a.n = b.n := by omega
+    apply Subtype.ext
+    exact UInt64.toNat_inj.mp he
+  · intro h
+    subst b
+    change G.ofNat (a.n + gSize.toNat - a.n) = 0
+    simp only [Nat.add_sub_cancel_left]
+    rfl
+
+theorem G.n_add (a b : G) : (a + b).n = (a.n + b.n) % gSize.toNat :=
+  G.n_ofNat _
+
+theorem G.n_mul (a b : G) : (a * b).n = (a.n * b.n) % gSize.toNat :=
+  G.n_ofNat _
+
+namespace AIR
+
+def callRankBound : Nat := 2 ^ 48
+
+/-- The six little-endian byte expressions used by the Rust emitter. -/
+def packRank (bytes : Fin 6 → G) : G :=
+  bytes 0 + 256 * bytes 1 + 65536 * bytes 2 + 16777216 * bytes 3 +
+    4294967296 * bytes 4 + 1099511627776 * bytes 5
+
+theorem packRank_lt (bytes : Fin 6 → G) (bounded : ∀ i, (bytes i).n < 256) :
+    (packRank bytes).n < callRankBound := by
+  have h0 := bounded 0
+  have h1 := bounded 1
+  have h2 := bounded 2
+  have h3 := bounded 3
+  have h4 := bounded 4
+  have h5 := bounded 5
+  have c1 : (256 : G).n = 256 := rfl
+  have c2 : (65536 : G).n = 65536 := rfl
+  have c3 : (16777216 : G).n = 16777216 := rfl
+  have c4 : (4294967296 : G).n = 4294967296 := rfl
+  have c5 : (1099511627776 : G).n = 1099511627776 := rfl
+  simp only [packRank, G.n_add, G.n_mul, c1, c2, c3, c4, c5]
+  have modulus : gSize.toNat = 18446744069414584321 := by decide
+  rw [modulus]
+  simp only [Nat.add_mod_mod, Nat.mod_add_mod]
+  apply Nat.lt_of_le_of_lt (Nat.mod_le _ _)
+  unfold callRankBound
+  omega
+
+/-- Exact active-call polynomial, before selector gating. -/
+def callOrderConstraint (parent child gap : G) : G :=
+  child - parent - 1 - gap
+
+theorem call_order_strict {parent child gap : G}
+    (hp : parent.n < callRankBound) (hc : child.n < callRankBound)
+    (hg : gap.n < callRankBound)
+    (satisfied : callOrderConstraint parent child gap = 0) :
+    parent.n < child.n := by
+  have h1 : child - parent - 1 = gap :=
+    (G.sub_eq_zero_iff _ _).mp satisfied
+  have h := congrArg G.n h1
+  change (G.ofNat ((G.ofNat (child.n + gSize.toNat - parent.n)).n +
+    gSize.toNat - 1)).n = gap.n at h
+  simp only [G.n_ofNat] at h
+  have modulus : gSize.toNat = 18446744069414584321 := by decide
+  rw [modulus] at h
+  unfold callRankBound at hp hc hg
+  omega
+
+theorem call_order_irrefl (rank gap : G) (hr : rank.n < callRankBound)
+    (hg : gap.n < callRankBound) : callOrderConstraint rank rank gap ≠ 0 := by
+  intro h
+  exact Nat.lt_irrefl _ (call_order_strict hr hr hg h)
+
+theorem active_call_order_strict {selector parent child gap : G}
+    (active : selector = 1)
+    (hp : parent.n < callRankBound) (hc : child.n < callRankBound)
+    (hg : gap.n < callRankBound)
+    (satisfied : selector * callOrderConstraint parent child gap = 0) :
+    parent.n < child.n := by
+  rw [active, G.mul_comm, G.mul_one] at satisfied
+  exact call_order_strict hp hc hg satisfied
+
+/-- Range-checked bytes suffice for the rank bounds in an active call. -/
+theorem packed_call_order_strict (parent child gap : Fin 6 → G)
+    (hp : ∀ i, (parent i).n < 256) (hc : ∀ i, (child i).n < 256)
+    (hg : ∀ i, (gap i).n < 256)
+    (satisfied : callOrderConstraint (packRank parent) (packRank child) (packRank gap) = 0) :
+    (packRank parent).n < (packRank child).n :=
+  call_order_strict (packRank_lt parent hp) (packRank_lt child hc)
+    (packRank_lt gap hg) satisfied
+
+/-- Any call relation satisfying the bounded-rank constraints is well founded.
+The relation is oriented `calls child parent`, as required by recursion. -/
+theorem call_relation_wellFounded {α : Sort u} (rank : α → G)
+    (bounded : ∀ node, (rank node).n < callRankBound) (calls : α → α → Prop)
+    (ordered : ∀ child parent, calls child parent →
+      ∃ gap : G, gap.n < callRankBound ∧
+        callOrderConstraint (rank parent) (rank child) gap = 0) :
+    WellFounded calls := by
+  apply Subrelation.wf (r := fun child parent =>
+    callRankBound - (rank child).n < callRankBound - (rank parent).n)
+    (fun {child parent} h => ?_)
+    (InvImage.wf (fun node => callRankBound - (rank node).n) Nat.lt_wfRel.wf)
+  obtain ⟨gap, hg, hs⟩ := ordered child parent h
+  have strict := call_order_strict (bounded parent) (bounded child) hg hs
+  have limit := bounded child
+  omega
+
+end AIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/Challenger.lean b/Ix/Aiur/Proofs/Challenger.lean
new file mode 100644
index 000000000..35a05bbbc
--- /dev/null
+++ b/Ix/Aiur/Proofs/Challenger.lean
@@ -0,0 +1,375 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Challenger
+import Ix.Aiur.Proofs.KeyCodec
+
+namespace Aiur.NativeAIR.Challenger
+
+/-- Pending bytes are a suffix of the reversed digest still held in the
+input buffer. Observations may leave any input and no pending output. -/
+def State.Valid (state : State) : Prop :=
+  state.pending = [] ∨ ∃ consumed, state.input.length = 32 ∧ state.pending = state.input.reverse.drop consumed
+
+theorem initial_valid (seed : List UInt8) : (initial seed).Valid := Or.inl rfl
+
+theorem State.Valid.bound {state : State} (valid : state.Valid) : state.pending.length ≤ 32 := by
+  rcases valid with empty | ⟨consumed, length, pending⟩
+  · simp only [empty, List.length_nil]; omega
+  · simp only [pending, List.length_drop, List.length_reverse, length]; omega
+
+theorem observeBytes_nil (state : State) : observeBytes state [] = state := rfl
+
+theorem observeBytes_append (state : State) (left right : List UInt8) :
+    observeBytes state (left ++ right) = observeBytes (observeBytes state left) right := by
+  cases left <;> cases right <;> simp [observeBytes, List.append_assoc]
+
+theorem observeBytes_value (state : State) (bytes : List UInt8) :
+    observeBytes state bytes = if bytes.isEmpty then state else ⟨state.input ++ bytes, []⟩ := rfl
+
+theorem observeBytes_fold (state : State) (bytes : List UInt8) :
+    observeBytes state bytes = bytes.foldl observeByte state := by
+  induction bytes generalizing state with
+  | nil => rfl
+  | cons byte bytes ih =>
+    rw [List.foldl_cons, ← ih]
+    cases bytes <;> simp [observeBytes, observeByte, List.append_assoc]
+
+theorem observeBytes_valid {state : State} (valid : state.Valid) (bytes : List UInt8) :
+    (observeBytes state bytes).Valid := by
+  rw [observeBytes_value]
+  split
+  · exact valid
+  · exact Or.inl rfl
+
+theorem observeField_value (state : State) (value : G) :
+    observeField state value = ⟨state.input ++ ProofCodec.encodeField value, []⟩ := by
+  rw [observeField, observeBytes_value]
+  rfl
+
+theorem observeField_valid {state : State} (valid : state.Valid) (value : G) :
+    (observeField state value).Valid := observeBytes_valid valid _
+
+theorem observeExtension_bytes (state : State) (value : ProofCodec.Extension) :
+    observeExtension state value = observeBytes state (ProofCodec.encodeExtension value) := by
+  rw [observeExtension, ProofCodec.encodeExtension, observeBytes_append]
+  rfl
+
+theorem observeExtension_valid {state : State} (valid : state.Valid) (value : ProofCodec.Extension) :
+    (observeExtension state value).Valid := observeField_valid (observeField_valid valid value.c0) value.c1
+
+theorem observeExtensions_valid {state : State} (valid : state.Valid) (values : List ProofCodec.Extension) :
+    (values.foldl observeExtension state).Valid := by
+  induction values generalizing state with
+  | nil => exact valid
+  | cons value values ih => exact ih (observeExtension_valid valid value)
+
+theorem observeCap_empty (state : State) : observeCap state [] = state := rfl
+
+theorem observeCap_valid {state : State} (valid : state.Valid) (cap : KeyCodec.MerkleCap) :
+    (observeCap state cap).Valid := observeBytes_valid valid _
+
+theorem sampleByte_buffered (hash : Hash32) (input : List UInt8) (byte : UInt8) (rest : List UInt8) :
+    sampleByte hash ⟨input, byte :: rest⟩ = (byte, ⟨input, rest⟩) := rfl
+
+theorem sampleByte_refill (hash : Hash32) (input : List UInt8) :
+    sampleByte hash ⟨input, []⟩ =
+      (hash input 31, ⟨List.ofFn (hash input), (List.ofFn (hash input)).reverse.drop 1⟩) := rfl
+
+theorem sampleByte_valid (hash : Hash32) {state : State} (valid : state.Valid) :
+    (sampleByte hash state).2.Valid := by
+  cases pending : state.pending with
+  | nil =>
+    simp only [sampleByte, pending]
+    exact Or.inr ⟨1, List.length_ofFn, rfl⟩
+  | cons byte rest =>
+    rcases valid with empty | ⟨consumed, length, remaining⟩
+    · rw [empty] at pending; cases pending
+    · change (sampleByte hash state).2.pending = [] ∨ _
+      right
+      refine ⟨consumed + 1, ?_, ?_⟩
+      · simpa only [sampleByte, pending] using length
+      · simp only [sampleByte, pending]
+        rw [← List.tail_drop, ← remaining, pending]
+        rfl
+
+theorem digest_reverse (digest : Fin 32 → UInt8) :
+    (List.ofFn digest).reverse = digest 31 :: (List.ofFn digest).reverse.drop 1 := by
+  conv => lhs; rw [List.ofFn_succ_last]
+  simp only [List.reverse_append, List.reverse_cons, List.reverse_nil, List.nil_append,
+    List.singleton_append]
+  rw [List.ofFn_succ_last]
+  simp
+
+theorem sampleByte_pending_bound (hash : Hash32) (state : State) (bounded : state.pending.length ≤ 32) :
+    (sampleByte hash state).2.pending.length ≤ 32 := by
+  cases pending : state.pending with
+  | nil => simp [sampleByte, pending]
+  | cons byte rest => simp only [sampleByte, pending]; simp_all; omega
+
+theorem sampleBytes_length (hash : Hash32) (count : Nat) (state : State) :
+    (sampleBytes hash count state).1.length = count := by
+  induction count generalizing state with
+  | zero => rfl
+  | succ count ih => simp only [sampleBytes, List.length_cons, ih]
+
+theorem sampleBytes_pending_bound (hash : Hash32) (count : Nat) (state : State)
+    (bounded : state.pending.length ≤ 32) : (sampleBytes hash count state).2.pending.length ≤ 32 := by
+  induction count generalizing state with
+  | zero => exact bounded
+  | succ count ih => exact ih _ (sampleByte_pending_bound hash state bounded)
+
+theorem sampleBytes_valid (hash : Hash32) (count : Nat) {state : State} (valid : state.Valid) :
+    (sampleBytes hash count state).2.Valid := by
+  induction count generalizing state with
+  | zero => exact valid
+  | succ count ih => exact ih (sampleByte_valid hash valid)
+
+theorem sampleBytes_buffered (hash : Hash32) (input bytes rest : List UInt8) :
+    sampleBytes hash bytes.length ⟨input, bytes ++ rest⟩ = (bytes, ⟨input, rest⟩) := by
+  induction bytes with
+  | nil => rfl
+  | cons byte bytes ih => simp only [List.length_cons, List.cons_append, sampleBytes, sampleByte, ih]
+
+theorem sampleBytes_refill (hash : Hash32) (input : List UInt8) :
+    sampleBytes hash 32 ⟨input, []⟩ =
+      ((List.ofFn (hash input)).reverse, ⟨List.ofFn (hash input), []⟩) := by
+  have tail := sampleBytes_buffered hash (List.ofFn (hash input))
+    ((List.ofFn (hash input)).reverse.drop 1) []
+  simp only [List.length_drop, List.length_reverse, List.length_ofFn, List.append_nil] at tail
+  rw [sampleBytes]
+  simp only [sampleByte]
+  rw [tail, ← digest_reverse]
+
+theorem littleEndian_bound (bytes : List UInt8) : littleEndian bytes < 256^bytes.length := by
+  induction bytes with
+  | nil => decide
+  | cons byte bytes ih =>
+    have bounded := byte.toNat_lt
+    simp only [littleEndian, List.foldr_cons, List.length_cons, Nat.pow_succ] at *
+    omega
+
+theorem littleEndian_encode (count value : Nat) (bounded : value < 256^count) :
+    littleEndian (KeyCodec.encodeNat count value) = value := by
+  induction count generalizing value with
+  | zero =>
+    have zero : value = 0 := by simpa using bounded
+    subst value
+    rfl
+  | succ count ih =>
+    have small : value / 256 < 256^count := by
+      apply (Nat.div_lt_iff_lt_mul (by decide : 0 < 256)).mpr
+      simpa only [Nat.pow_succ] using bounded
+    simp only [KeyCodec.encodeNat, littleEndian, List.foldr_cons]
+    change value.toUInt8.toNat + 256 * littleEndian (KeyCodec.encodeNat count (value / 256)) = value
+    rw [ih _ small]
+    exact Nat.mod_add_div _ _
+
+theorem littleEndian_reads (bytes : List UInt8) :
+    KeyCodec.Reads (KeyCodec.readNat bytes.length) bytes (littleEndian bytes) := by
+  induction bytes with
+  | nil => exact KeyCodec.Reads.pure 0
+  | cons byte bytes ih =>
+    exact KeyCodec.Reads.byte (ih.result (fun value => byte.toNat + 256 * value))
+
+theorem sampleWord_bound (hash : Hash32) (state : State) : (sampleWord hash state).1 < 2^64 := by
+  have bound := littleEndian_bound (sampleBytes hash 8 state).1
+  rw [sampleBytes_length] at bound
+  exact bound
+
+theorem sampleWord_full_mask (hash : Hash32) (state : State) :
+    (sampleWord hash state).1 &&& (2^64 - 1) = (sampleWord hash state).1 :=
+  Nat.and_two_pow_sub_one_of_lt_two_pow (sampleWord_bound hash state)
+
+theorem sampleWord_reads (hash : Hash32) (state : State) :
+    KeyCodec.Reads (KeyCodec.readNat 8) (sampleBytes hash 8 state).1 (sampleWord hash state).1 := by
+  have read := littleEndian_reads (sampleBytes hash 8 state).1
+  rw [sampleBytes_length] at read
+  exact read
+
+/-- A finite native execution: each rejected word advances to its returned
+state, and the first canonical word is the returned field representative. -/
+inductive FieldSample (hash : Hash32) : State → Nat → G → State → Prop where
+  | accept {state : State} (canonical : (sampleWord hash state).1 < gSize.toNat) :
+      FieldSample hash state 1 (G.ofNat (sampleWord hash state).1) (sampleWord hash state).2
+  | reject {state final : State} {count : Nat} {value : G}
+      (noncanonical : ¬(sampleWord hash state).1 < gSize.toNat)
+      (rest : FieldSample hash (sampleWord hash state).2 count value final) :
+      FieldSample hash state (count + 1) value final
+
+theorem FieldSample.positive {hash : Hash32} {state final : State} {count : Nat} {value : G}
+    (trace : FieldSample hash state count value final) : 0 < count := by
+  cases trace <;> omega
+
+theorem sampleField_success {hash : Hash32} {fuel : Nat} {state final : State} {value : G}
+    (accepted : sampleField hash fuel state = some (value, final)) :
+    ∃ count, count ≤ fuel ∧ FieldSample hash state count value final := by
+  induction fuel generalizing state with
+  | zero => cases accepted
+  | succ fuel ih =>
+    change (if (sampleWord hash state).1 < gSize.toNat then
+      some (G.ofNat (sampleWord hash state).1, (sampleWord hash state).2)
+      else sampleField hash fuel (sampleWord hash state).2) = some (value, final) at accepted
+    split at accepted
+    · obtain ⟨sameValue, sameState⟩ := Prod.mk.inj (Option.some.inj accepted)
+      rw [← sameValue, ← sameState]
+      exact ⟨1, by omega, .accept (by assumption)⟩
+    · obtain ⟨count, bound, trace⟩ := ih accepted
+      exact ⟨count + 1, by omega, .reject (by assumption) trace⟩
+
+theorem FieldSample.complete {hash : Hash32} {state final : State} {count : Nat} {value : G}
+    (trace : FieldSample hash state count value final) (fuel : Nat) (bound : count ≤ fuel) :
+    sampleField hash fuel state = some (value, final) := by
+  induction trace generalizing fuel with
+  | accept canonical =>
+    cases fuel with
+    | zero => omega
+    | succ fuel => simp only [sampleField, canonical, ↓reduceIte]
+  | reject noncanonical trace ih =>
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+      simp only [sampleField, noncanonical, ↓reduceIte]
+      exact ih fuel (by omega)
+
+theorem sampleField_iff (hash : Hash32) (fuel : Nat) (state final : State) (value : G) :
+    sampleField hash fuel state = some (value, final) ↔
+      ∃ count, count ≤ fuel ∧ FieldSample hash state count value final :=
+  ⟨sampleField_success, fun ⟨_, bound, trace⟩ => trace.complete fuel bound⟩
+
+theorem sampleField_mono {hash : Hash32} {fuel more : Nat} {state final : State} {value : G}
+    (accepted : sampleField hash fuel state = some (value, final)) (bound : fuel ≤ more) :
+    sampleField hash more state = some (value, final) := by
+  obtain ⟨count, small, trace⟩ := sampleField_success accepted
+  exact trace.complete more (Nat.le_trans small bound)
+
+theorem sampleField_unique {hash : Hash32} {fuel other : Nat} {state left right : State} {a b : G}
+    (first : sampleField hash fuel state = some (a, left))
+    (second : sampleField hash other state = some (b, right)) : a = b ∧ left = right := by
+  have one := sampleField_mono first (Nat.le_max_left fuel other)
+  have two := sampleField_mono second (Nat.le_max_right fuel other)
+  exact Prod.mk.inj (Option.some.inj (one.symm.trans two))
+
+theorem FieldSample.valid {hash : Hash32} {state final : State} {count : Nat} {value : G}
+    (trace : FieldSample hash state count value final) (valid : state.Valid) : final.Valid := by
+  induction trace with
+  | accept _ => exact sampleBytes_valid hash 8 valid
+  | @reject before _ _ _ _ _ ih =>
+    apply ih
+    change (sampleBytes hash 8 before).2.Valid
+    exact sampleBytes_valid hash 8 valid
+
+theorem sampleField_valid {hash : Hash32} {fuel : Nat} {state final : State} {value : G}
+    (accepted : sampleField hash fuel state = some (value, final)) (valid : state.Valid) : final.Valid := by
+  obtain ⟨_, _, trace⟩ := sampleField_success accepted
+  exact trace.valid valid
+
+theorem sampleField_canonical {hash : Hash32} {fuel : Nat} {state final : State} {value : G}
+    (accepted : sampleField hash fuel state = some (value, final)) :
+    ∃ before, sampleWord hash before = (value.n, final) ∧ value.n < gSize.toNat := by
+  obtain ⟨_, _, trace⟩ := sampleField_success accepted
+  clear accepted
+  rename_i count bound
+  clear bound
+  induction trace with
+  | @accept before canonical =>
+    refine ⟨before, ?_, ?_⟩
+    · simp only [G.n_ofNat, Nat.mod_eq_of_lt canonical]
+    · simpa only [G.n_ofNat, Nat.mod_eq_of_lt canonical] using canonical
+  | reject _ _ ih => exact ih
+
+theorem sampleExtension_success {hash : Hash32} {fuel : Nat} {state final : State}
+    {value : ProofCodec.Extension} (accepted : sampleExtension hash fuel state = some (value, final)) :
+    ∃ next, sampleField hash fuel state = some (value.c0, next) ∧
+      sampleField hash fuel next = some (value.c1, final) := by
+  simp only [sampleExtension, bind, pure, Option.bind_eq_some_iff, Option.some.injEq,
+    Prod.exists, Prod.mk.injEq] at accepted
+  obtain ⟨c0, next, first, c1, final', second, ⟨rfl, rfl⟩, rfl⟩ := accepted
+  exact ⟨next, first, second⟩
+
+theorem sampleExtension_mono {hash : Hash32} {fuel more : Nat} {state final : State}
+    {value : ProofCodec.Extension} (accepted : sampleExtension hash fuel state = some (value, final))
+    (bound : fuel ≤ more) : sampleExtension hash more state = some (value, final) := by
+  obtain ⟨next, first, second⟩ := sampleExtension_success accepted
+  simp only [sampleExtension, sampleField_mono first bound, sampleField_mono second bound,
+    bind, pure, Option.bind_some]
+
+theorem sampleExtension_valid {hash : Hash32} {fuel : Nat} {state final : State}
+    {value : ProofCodec.Extension} (accepted : sampleExtension hash fuel state = some (value, final))
+    (valid : state.Valid) : final.Valid := by
+  obtain ⟨next, first, second⟩ := sampleExtension_success accepted
+  exact sampleField_valid second (sampleField_valid first valid)
+
+theorem sampleBits_success {hash : Hash32} {bits value : Nat} {state final : State}
+    (accepted : sampleBits hash bits state = some (value, final)) :
+    bits < 64 ∧ 2^bits < gSize.toNat ∧ value = (sampleWord hash state).1 % 2^bits ∧
+      final = (sampleWord hash state).2 ∧ value < 2^bits := by
+  change (if bits < 64 ∧ 2^bits < gSize.toNat then
+    some ((sampleWord hash state).1 % 2^bits, (sampleWord hash state).2)
+    else none) = some (value, final) at accepted
+  split at accepted
+  · rename_i valid
+    obtain ⟨sameValue, sameState⟩ := Prod.mk.inj (Option.some.inj accepted)
+    refine ⟨valid.1, valid.2, sameValue.symm, sameState.symm, ?_⟩
+    rw [← sameValue]
+    exact Nat.mod_lt _ (Nat.two_pow_pos _)
+  · cases accepted
+
+theorem sampleBits_zero (hash : Hash32) (state : State) :
+    sampleBits hash 0 state = some (0, (sampleWord hash state).2) := by
+  have bound : 1 < gSize.toNat := by decide
+  change (if 0 < 64 ∧ 2^0 < gSize.toNat then
+    some ((sampleWord hash state).1 % 2^0, (sampleWord hash state).2) else none) = _
+  simp only [Nat.pow_zero, bound, Nat.mod_one, Nat.zero_lt_succ, and_self, ↓reduceIte]
+
+theorem sampleBits_mask {hash : Hash32} {bits value : Nat} {state final : State}
+    (accepted : sampleBits hash bits state = some (value, final)) :
+    value = (sampleWord hash state).1 &&& (2^bits - 1) := by
+  rw [Nat.and_two_pow_sub_one_eq_mod]
+  exact (sampleBits_success accepted).2.2.1
+
+theorem sampleBits_valid {hash : Hash32} {bits value : Nat} {state final : State}
+    (accepted : sampleBits hash bits state = some (value, final)) (valid : state.Valid) : final.Valid := by
+  rw [(sampleBits_success accepted).2.2.2.1]
+  exact sampleBytes_valid hash 8 valid
+
+theorem checkWitness_zero (hash : Hash32) (witness : G) (state : State) :
+    checkWitness hash 0 witness state = some (true, state) := rfl
+
+theorem checkWitness_positive (hash : Hash32) {bits : Nat} (positive : bits ≠ 0)
+    (witness : G) (state : State) : checkWitness hash bits witness state = do
+      let (value, next) ← sampleBits hash bits (observeField state witness)
+      return (value == 0, next) := by
+  simp only [checkWitness, positive, ↓reduceIte]
+
+theorem checkWitness_true_iff (hash : Hash32) (bits : Nat) (witness : G) (state final : State) :
+    checkWitness hash bits witness state = some (true, final) ↔
+      (bits = 0 ∧ final = state) ∨
+        (bits ≠ 0 ∧ sampleBits hash bits (observeField state witness) = some (0, final)) := by
+  by_cases zero : bits = 0
+  · subst bits
+    simp only [checkWitness_zero, Option.some.injEq, Prod.mk.injEq, true_and,
+      ne_eq, not_true_eq_false, false_and, or_false]
+    exact eq_comm
+  · rw [checkWitness_positive hash zero witness state]
+    simp only [bind, pure, Option.bind_eq_some_iff, Prod.exists, Option.some.injEq, Prod.mk.injEq,
+      beq_iff_eq, ne_eq, zero, false_and, not_false_eq_true, true_and, false_or]
+    constructor
+    · rintro ⟨value, next, read, rfl, rfl⟩; exact read
+    · intro read; exact ⟨0, final, read, rfl, rfl⟩
+
+theorem checkWitness_valid {hash : Hash32} {bits : Nat} {witness : G} {state final : State}
+    {accepted : Bool} (read : checkWitness hash bits witness state = some (accepted, final))
+    (valid : state.Valid) : final.Valid := by
+  by_cases zero : bits = 0
+  · subst bits
+    obtain ⟨_, same⟩ := Prod.mk.inj (Option.some.inj read)
+    exact same ▸ valid
+  · rw [checkWitness_positive hash zero witness state] at read
+    simp only [bind, pure, Option.bind_eq_some_iff, Prod.exists, Option.some.injEq, Prod.mk.injEq] at read
+    obtain ⟨value, next, sampled, _, rfl⟩ := read
+    exact sampleBits_valid sampled (observeField_valid valid witness)
+
+end Aiur.NativeAIR.Challenger
diff --git a/Ix/Aiur/Proofs/CheckedCircuit.lean b/Ix/Aiur/Proofs/CheckedCircuit.lean
new file mode 100644
index 000000000..d33be7e38
--- /dev/null
+++ b/Ix/Aiur/Proofs/CheckedCircuit.lean
@@ -0,0 +1,87 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockCompletion
+import Ix.Aiur.Proofs.CircuitCompletion
+
+/-! Checked backend construction supplies circuit emission and a physical graph. -/
+
+namespace Aiur.NativeAIR.CircuitEmitter
+open OpEmitter BlockEmitter Bytecode
+
+theorem emitMember_defined (rank : Expr) (column lookup selectorBase : Nat)
+    (program : Toplevel) (index : Nat) {function : Function}
+    (present : program.functions[index]? = some function) (checked : function.emissionChecks = true) :
+    ∃ member, emitMember rank column lookup selectorBase program index = some member := by
+  rw [Function.emissionChecks, Bool.and_eq_true] at checked
+  have bodyChecks : function.body.emissionChecks (advice 0 function.layout.inputSize).size
+      (selectorExprs selectorBase function.layout.selectors).size none = true := by
+    simpa only [advice, selectorExprs, Array.size_ofFn] using checked.2
+  obtain ⟨entry, selected⟩ := blockSelector_defined (selectorExprs selectorBase function.layout.selectors) function.body bodyChecks
+  obtain ⟨body, emitted, _⟩ := emitBlock_defined (selectorExprs selectorBase function.layout.selectors)
+    ⟨index, function.layout.inputSize, rank⟩ entry (advice 0 function.layout.inputSize) column lookup function.body
+    (advice_degreeValid _ _) (by simp only [advice, Array.size_ofFn, Nat.le_refl]) bodyChecks
+  refine ⟨⟨index, function, selectorBase, entry, body⟩, ?_⟩
+  simp only [emitMember, present, selected, emitted, bind, Option.bind_some, pure]
+
+theorem emitMembers_defined (rank : Expr) (column lookup selectorBase : Nat) (program : Toplevel) (indices : List Nat)
+    (checked : ∀ index ∈ indices, ∃ function, program.functions[index]? = some function ∧ function.emissionChecks = true) :
+    ∃ members, emitMembers rank column lookup selectorBase program indices = some members := by
+  induction indices generalizing selectorBase with
+  | nil => exact ⟨[], rfl⟩
+  | cons index indices ih =>
+    obtain ⟨function, present, valid⟩ := checked index List.mem_cons_self
+    obtain ⟨member, memberEmitted⟩ := emitMember_defined rank column lookup selectorBase program index present valid
+    obtain ⟨members, membersEmitted⟩ := ih (selectorBase + member.function.layout.selectors)
+      (fun index present => checked index (List.mem_cons_of_mem _ present))
+    exact ⟨member :: members, by simp only [emitMembers, memberEmitted, membersEmitted, bind, Option.bind_some, pure]⟩
+
+theorem emitCircuit_defined (program : Toplevel) (circuit : Circuit)
+    (checked : program.validateEmission = true) (members : MembersConstrained program.functions circuit.members) :
+    ∃ emission, emitCircuit program circuit = some emission := by
+  have valid : ∀ index ∈ circuit.members.toList,
+      ∃ function, program.functions[index]? = some function ∧ function.emissionChecks = true := by
+    intro index member
+    obtain ⟨function, present, constrained⟩ := members index (by simpa using member)
+    exact ⟨function, present, Toplevel.validateEmission_function checked (Array.mem_of_getElem? present) constrained⟩
+  obtain ⟨emissions, emitted⟩ := emitMembers_defined (packSix (rankBytes circuit.layout))
+    (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6) 4 circuit.layout.inputSize
+    program circuit.members.toList valid
+  refine ⟨circuitEmission circuit emissions, ?_⟩
+  simp only [emitCircuit, emitted, bind, Option.bind_some, pure]
+
+end Aiur.NativeAIR.CircuitEmitter
+
+namespace Aiur.BoundVerifier
+open NativeAIR NativeAIR.CircuitEmitter
+
+theorem Backend.circuit_emits {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits) :
+    ∃ emission, emitCircuit backend.compiled.bytecode circuit = some emission :=
+  emitCircuit_defined backend.compiled.bytecode circuit backend.emissionChecks (backend.circuits_constrained circuit member)
+
+theorem Backend.circuit_compiles {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits) :
+    ∃ compiled, compileCircuit (circuitWidths circuit) backend.compiled.bytecode circuit = some compiled := by
+  obtain ⟨emission, emitted⟩ := backend.circuit_emits member
+  obtain ⟨compiled, built, _⟩ := backend.emitCircuit_compiles member emitted
+  exact ⟨compiled, built⟩
+
+theorem Backend.circuit_graph_reflects {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits)
+    {values : Values G} (fits : values.Fits (circuitWidths circuit)) :
+    ∃ compiled result buffer,
+      compileCircuit (circuitWidths circuit) backend.compiled.bytecode circuit = some compiled ∧
+      circuit.emitRow (fun index => (values.columns .main .current)[index]?.getD 0) backend.compiled.bytecode = some result ∧
+      compiled.base.graph.sweep goldilocksOps values = some buffer ∧
+      (Compiler.Vanishes goldilocksOps buffer compiled.base.graph.zeros ↔ ∀ equation ∈ result.equations, equation = 0) ∧
+      compiled.base.graph.lookups.mapM (readLookup buffer) =
+        some (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) := by
+  obtain ⟨emission, emitted⟩ := backend.circuit_emits member
+  obtain ⟨compiled, result, buffer, built, _, resultEmitted, swept, satisfied, lookups⟩ :=
+    backend.emittedCircuit_reflects member fits emitted
+  exact ⟨compiled, result, buffer, built, resultEmitted, swept, satisfied, lookups⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/CircuitAllocation.lean b/Ix/Aiur/Proofs/CircuitAllocation.lean
new file mode 100644
index 000000000..1025ff853
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitAllocation.lean
@@ -0,0 +1,214 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitLayout
+import Ix.Aiur.Proofs.BlockAllocation
+import Ix.Aiur.Proofs.CompiledCircuitRows
+
+/-! Compiled layouts and checked row counts bound every symbolic circuit
+read by the actual main-trace width, including grouped selector regions. -/
+
+namespace Aiur.NativeAIR.CircuitEmitter
+open OpEmitter BlockEmitter Compiler Aiur.Bytecode
+
+theorem emitMember_layout {rank : Expr} {column lookup selectorBase base : Nat}
+    {program : Toplevel} {functionIndex : Nat} {member : Member}
+    (functions : FunctionsComputedLayout program.functions) (cursor : column = base + 7)
+    (emitted : emitMember rank column lookup selectorBase program functionIndex = some member) :
+    member.functionIndex = functionIndex ∧ program.functions[functionIndex]? = some member.function ∧
+    member.selectorBase = selectorBase ∧ member.body.column = base + member.function.layout.auxiliaries := by
+  simp only [emitMember, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i function functionRead
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i body bodyEmitted
+  cases emitted
+  have layout := BlockEmitter.emitBlock_layout function.body (.new function.layout.inputSize) base
+    (advice_degreeValid _ _) (advice_degrees _ _) cursor bodyEmitted
+  have valid := functions function (Array.mem_of_getElem? functionRead)
+  exact ⟨rfl, functionRead, rfl, layout.2.trans (congrArg (base + ·) valid.auxiliaries.symm)⟩
+
+theorem emitMembers_layout {rank : Expr} (column lookup selectorBase base : Nat)
+    (program : Toplevel) (indices : List Nat) {members : List Member}
+    (functions : FunctionsComputedLayout program.functions) (cursor : column = base + 7)
+    (emitted : emitMembers rank column lookup selectorBase program indices = some members) :
+    members.map Member.functionIndex = indices ∧
+    (∀ member ∈ members, program.functions[member.functionIndex]? = some member.function ∧
+      member.body.column = base + member.function.layout.auxiliaries ∧
+      member.selectorBase + member.function.layout.selectors ≤
+        selectorBase + (members.map (fun part => part.function.layout.selectors)).sum) := by
+  induction indices generalizing selectorBase members with
+  | nil =>
+    cases emitted
+    exact ⟨rfl, by simp⟩
+  | cons index indices ih =>
+    simp only [emitMembers, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i member memberEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    obtain ⟨indexEq, present, selectorEq, columnEq⟩ := emitMember_layout functions cursor memberEmitted
+    obtain ⟨indicesEq, tail⟩ := ih _ restEmitted
+    refine ⟨by simp only [List.map_cons, indexEq, indicesEq], ?_⟩
+    intro chosen memberOf
+    rcases List.mem_cons.mp memberOf with equal | later
+    · subst chosen
+      refine ⟨by rw [indexEq]; exact present, columnEq, ?_⟩
+      simp only [List.map_cons, List.sum_cons, selectorEq]
+      omega
+    · obtain ⟨present, columnEq, bounded⟩ := tail chosen later
+      refine ⟨present, columnEq, ?_⟩
+      simpa only [List.map_cons, List.sum_cons, Nat.add_assoc] using bounded
+
+private theorem member_functions_read (program : Toplevel) (members : List Member)
+    (present : ∀ member ∈ members, program.functions[member.functionIndex]? = some member.function) :
+    (members.map Member.functionIndex).mapM (fun index => program.functions[index]?) =
+      some (members.map Member.function) := by
+  induction members with
+  | nil => rfl
+  | cons member members ih =>
+    simp only [List.map_cons, List.mapM_cons, present member List.mem_cons_self,
+      ih (fun member present' => present member (List.mem_cons_of_mem _ present'))]
+    rfl
+
+theorem emitMembers_selectors {rank : Expr} (column lookup selectorBase base : Nat)
+    (program : Toplevel) (circuit : Circuit) {members : List Member}
+    (functions : FunctionsComputedLayout program.functions) (cursor : column = base + 7)
+    (validated : circuit.validateRowCounts program = true)
+    (emitted : emitMembers rank column lookup selectorBase program circuit.members.toList = some members) :
+    (members.map (fun member => member.function.layout.selectors)).sum ≤ circuit.layout.selectors := by
+  obtain ⟨indices, layout⟩ := emitMembers_layout column lookup selectorBase base program circuit.members.toList
+    functions cursor emitted
+  have present := member_functions_read program members (fun member memberOf => (layout member memberOf).1)
+  rw [indices] at present
+  rw [Circuit.validateRowCounts, present] at validated
+  simp only [Bool.and_eq_true, decide_eq_true_eq] at validated
+  have leaves : members.map (fun member => member.function.layout.selectors) =
+      (members.map Member.function).map (fun function => function.body.controlCounts.leaves) := by
+    rw [List.map_map]
+    apply List.map_congr_left
+    intro member memberOf
+    exact (functions member.function (Array.mem_of_getElem? (layout member memberOf).1)).selectors
+  rw [leaves]
+  exact validated.2.2
+
+private theorem fold_max_le {α : Type} (measure : α → Nat) (items : List α) (initial bound : Nat)
+    (before : initial ≤ bound) (members : ∀ item ∈ items, measure item ≤ bound) :
+    items.foldl (fun acc item => max acc (measure item)) initial ≤ bound := by
+  induction items generalizing initial with
+  | nil => exact before
+  | cons item items ih =>
+    exact ih (max initial (measure item)) (Nat.max_le.mpr ⟨before, members item List.mem_cons_self⟩)
+      (fun item member => members item (List.mem_cons_of_mem _ member))
+
+theorem emitCircuit_readBound (program : Toplevel) (circuit : Circuit) {emission : Emission}
+    (functions : FunctionsComputedLayout program.functions)
+    (columns : MembersColumnBound program.functions circuit.members circuit.layout)
+    (validated : circuit.validateRowCounts program = true)
+    (emitted : emitCircuit program circuit = some emission) :
+    emission.readBound ≤ circuit.layout.width := by
+  simp only [emitCircuit, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i members membersEmitted
+  cases emitted
+  let base := circuit.layout.inputSize + circuit.layout.selectors
+  have cursor : circuit.layout.inputSize + circuit.layout.selectors + 1 + 6 = base + 7 := by omega
+  obtain ⟨indices, layout⟩ := emitMembers_layout _ _ _ base program circuit.members.toList functions cursor membersEmitted
+  have selectors := emitMembers_selectors _ _ _ base program circuit functions cursor validated membersEmitted
+  apply fold_max_le Member.readBound
+  · change circuit.layout.inputSize + circuit.layout.selectors + 1 + 6 ≤
+      circuit.layout.inputSize + circuit.layout.selectors + circuit.layout.auxiliaries
+    have reserved := columns.1
+    omega
+  · intro member memberOf
+    obtain ⟨present, bodyColumn, selectorBound⟩ := layout member memberOf
+    have memberIndex : member.functionIndex ∈ circuit.members := by
+      apply Array.mem_toList_iff.mp
+      rw [← indices]
+      exact List.mem_map.mpr ⟨member, memberOf, rfl⟩
+    have bound := columns.2 member.functionIndex memberIndex
+    rw [Array.getElem!_eq_getD, Array.getD_eq_getD_getElem?, present] at bound
+    change member.function.layout.inputSize ≤ circuit.layout.inputSize ∧
+      member.function.layout.auxiliaries ≤ circuit.layout.auxiliaries at bound
+    change max member.function.layout.inputSize
+      (max (member.selectorBase + member.function.layout.selectors) member.body.column) ≤
+        circuit.layout.inputSize + circuit.layout.selectors + circuit.layout.auxiliaries
+    dsimp only [base] at bodyColumn
+    omega
+
+theorem compileCircuit_readBound {widths : GraphWidths} (program : Toplevel) (circuit : Circuit)
+    {compiled : Compiled} (functions : FunctionsComputedLayout program.functions)
+    (columns : MembersColumnBound program.functions circuit.members circuit.layout)
+    (validated : circuit.validateRowCounts program = true)
+    (built : compileCircuit widths program circuit = some compiled) :
+    compiled.emission.readBound ≤ circuit.layout.width := by
+  simp only [compileCircuit, bind, Option.bind] at built
+  split at built
+  · cases built
+  rename_i emission emitted
+  dsimp only at built
+  split at built
+  · cases built
+  cases built
+  exact emitCircuit_readBound program circuit functions columns validated emitted
+
+theorem compileCircuit_physical_reflects {values : Values G} {widths : GraphWidths}
+    (fits : values.Fits widths) (program : Toplevel) (circuit : Circuit) {compiled : Compiled}
+    (functions : FunctionsComputedLayout program.functions)
+    (columns : MembersColumnBound program.functions circuit.members circuit.layout)
+    (validated : circuit.validateRowCounts program = true) (physical : widths.main = circuit.layout.width)
+    (built : compileCircuit widths program circuit = some compiled) :
+    ∃ result buffer,
+      circuit.emitRow (fun index => (values.columns .main .current)[index]?.getD 0) program = some result ∧
+      compiled.base.graph.sweep goldilocksOps values = some buffer ∧
+      (Vanishes goldilocksOps buffer compiled.base.graph.zeros ↔ ∀ equation ∈ result.equations, equation = 0) ∧
+      compiled.base.graph.lookups.mapM (readLookup buffer) =
+        some (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) := by
+  have bound := compileCircuit_readBound program circuit functions columns validated built
+  apply compileCircuit_reflects _ fits program circuit built
+  intro index indexBound
+  have size : index < (values.columns .main .current).size := by
+    rw [fits.1, GraphWidths.width, physical]
+    exact Nat.lt_of_lt_of_le indexBound bound
+  simp only [Array.getElem?_eq_getElem size, Option.getD_some]
+
+end Aiur.NativeAIR.CircuitEmitter
+
+namespace Aiur.BoundVerifier
+open NativeAIR NativeAIR.CircuitEmitter
+
+theorem Backend.circuit_readBound {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits) {emission : Emission}
+    (emitted : emitCircuit backend.compiled.bytecode circuit = some emission) :
+    emission.readBound ≤ circuit.layout.width :=
+  emitCircuit_readBound backend.compiled.bytecode circuit backend.functions_computedLayout
+    (backend.circuits_columnBound circuit member) (backend.circuit_row_counts member) emitted
+
+theorem Backend.compileCircuit_reflects {selection : Selection} (backend : Backend selection)
+    {values : Values G} {widths : GraphWidths} (fits : values.Fits widths)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits) {compiled : Compiled}
+    (physical : widths.main = circuit.layout.width)
+    (built : compileCircuit widths backend.compiled.bytecode circuit = some compiled) :
+    ∃ result buffer,
+      circuit.emitRow (fun index => (values.columns .main .current)[index]?.getD 0) backend.compiled.bytecode = some result ∧
+      compiled.base.graph.sweep goldilocksOps values = some buffer ∧
+      (Compiler.Vanishes goldilocksOps buffer compiled.base.graph.zeros ↔ ∀ equation ∈ result.equations, equation = 0) ∧
+      compiled.base.graph.lookups.mapM (readLookup buffer) =
+        some (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) :=
+  compileCircuit_physical_reflects fits backend.compiled.bytecode circuit backend.functions_computedLayout
+    (backend.circuits_columnBound circuit member) (backend.circuit_row_counts member) physical built
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/CircuitCompletion.lean b/Ix/Aiur/Proofs/CircuitCompletion.lean
new file mode 100644
index 000000000..c8089b49a
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitCompletion.lean
@@ -0,0 +1,112 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitAllocation
+import Ix.Aiur.Proofs.GraphCompletion
+import Ix.Aiur.Proofs.InactiveRows
+
+/-! A successfully emitted compiled circuit always has a base graph at its
+physical width. Its zero row satisfies the equations, excluding rejection of
+nonzero constant constraints without assuming an active execution. -/
+
+namespace Aiur.NativeAIR.CircuitEmitter
+open Compiler Aiur.Bytecode
+
+def circuitWidths (circuit : Circuit) : GraphWidths := ⟨0, circuit.layout.width, 0, 0⟩
+
+def zeroValues (width : Nat) : Values G where
+  columns := fun source _ => match source with
+    | .main => Array.replicate width 0
+    | _ => #[]
+  publics := #[]
+  isFirstRow := 0
+  isLastRow := 0
+  isTransition := 0
+
+theorem zeroValues_fits (circuit : Circuit) : (zeroValues circuit.layout.width).Fits (circuitWidths circuit) := by
+  refine ⟨?_, rfl⟩
+  intro source offset
+  cases source <;> simp only [zeroValues, circuitWidths, GraphWidths.width, Array.size_replicate, Array.size_empty]
+
+theorem zeroValues_read (width index : Nat) (bound : index < width) :
+    ((zeroValues width).columns .main .current)[index]? = some 0 := by
+  simp only [zeroValues, Array.getElem?_replicate, bound, if_true]
+
+theorem emitCircuit_zero_eval (program : Toplevel) (circuit : Circuit) {emission : Emission}
+    (functions : FunctionsComputedLayout program.functions)
+    (columns : MembersColumnBound program.functions circuit.members circuit.layout)
+    (validated : circuit.validateRowCounts program = true)
+    (emitted : emitCircuit program circuit = some emission) :
+    ∃ result, emission.eval (zeroValues circuit.layout.width) = some result ∧
+      (∀ equation ∈ result.equations, equation = 0) := by
+  have bound := emitCircuit_readBound program circuit functions columns validated emitted
+  obtain ⟨result, resultEmitted, evaluated⟩ := emitCircuit_reflects (fun _ => 0) program circuit emitted
+    (fun index indexBound => zeroValues_read _ _ (Nat.lt_of_lt_of_le indexBound bound))
+  exact ⟨result, evaluated, circuit.emitRow_zero program resultEmitted⟩
+
+theorem emitCircuit_compiles (program : Toplevel) (circuit : Circuit) {emission : Emission}
+    (functions : FunctionsComputedLayout program.functions)
+    (columns : MembersColumnBound program.functions circuit.members circuit.layout)
+    (validated : circuit.validateRowCounts program = true)
+    (emitted : emitCircuit program circuit = some emission) :
+    ∃ compiled, compileCircuit (circuitWidths circuit) program circuit = some compiled ∧
+      compiled.emission = emission := by
+  obtain ⟨result, evaluated, satisfied⟩ := emitCircuit_zero_eval program circuit functions columns validated emitted
+  have equations := (Emission.eval_components evaluated).2.2.2.2.2.2.2.2.2.1
+  have zeros := (equations_vanish equations).mpr satisfied
+  obtain ⟨base, baseCompiled⟩ := compileBase_defined goldilocksGraphLaws
+    (show Function.Injective goldilocksOps.konst from fun _ _ equal => equal)
+    (zeroValues_fits circuit) rfl emission.lookups emission.equations (Emission.lookups_eval evaluated) zeros
+  refine ⟨⟨emission, base⟩, ?_, rfl⟩
+  simp only [compileCircuit, emitted, baseCompiled, bind, Option.bind_some, pure]
+
+theorem compileCircuit_defined_iff (program : Toplevel) (circuit : Circuit)
+    (functions : FunctionsComputedLayout program.functions)
+    (columns : MembersColumnBound program.functions circuit.members circuit.layout)
+    (validated : circuit.validateRowCounts program = true) :
+    (compileCircuit (circuitWidths circuit) program circuit).isSome = true ↔
+      (emitCircuit program circuit).isSome = true := by
+  constructor
+  · intro compiled
+    cases emitted : emitCircuit program circuit with
+    | none => simp only [compileCircuit, emitted, bind, Option.bind_none, Option.isSome_none, Bool.false_eq_true] at compiled
+    | some emission => rfl
+  · intro emitted
+    obtain ⟨emission, emitted⟩ := Option.isSome_iff_exists.mp emitted
+    obtain ⟨compiled, built, _⟩ := emitCircuit_compiles program circuit functions columns validated emitted
+    rw [built]
+    rfl
+
+end Aiur.NativeAIR.CircuitEmitter
+
+namespace Aiur.BoundVerifier
+open NativeAIR NativeAIR.CircuitEmitter
+
+theorem Backend.emitCircuit_compiles {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits) {emission : Emission}
+    (emitted : emitCircuit backend.compiled.bytecode circuit = some emission) :
+    ∃ compiled, compileCircuit (circuitWidths circuit) backend.compiled.bytecode circuit = some compiled ∧
+      compiled.emission = emission :=
+  CircuitEmitter.emitCircuit_compiles backend.compiled.bytecode circuit backend.functions_computedLayout
+    (backend.circuits_columnBound circuit member) (backend.circuit_row_counts member) emitted
+
+theorem Backend.emittedCircuit_reflects {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits)
+    {values : Values G} (fits : values.Fits (circuitWidths circuit)) {emission : Emission}
+    (emitted : emitCircuit backend.compiled.bytecode circuit = some emission) :
+    ∃ compiled result buffer,
+      compileCircuit (circuitWidths circuit) backend.compiled.bytecode circuit = some compiled ∧
+      compiled.emission = emission ∧
+      circuit.emitRow (fun index => (values.columns .main .current)[index]?.getD 0) backend.compiled.bytecode = some result ∧
+      compiled.base.graph.sweep goldilocksOps values = some buffer ∧
+      (Compiler.Vanishes goldilocksOps buffer compiled.base.graph.zeros ↔ ∀ equation ∈ result.equations, equation = 0) ∧
+      compiled.base.graph.lookups.mapM (readLookup buffer) =
+        some (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) := by
+  obtain ⟨compiled, built, same⟩ := backend.emitCircuit_compiles member emitted
+  obtain ⟨result, buffer, resultEmitted, swept, satisfied, lookups⟩ :=
+    backend.compileCircuit_reflects fits member rfl built
+  exact ⟨compiled, result, buffer, built, same, resultEmitted, swept, satisfied, lookups⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/CircuitExpressions.lean b/Ix/Aiur/Proofs/CircuitExpressions.lean
new file mode 100644
index 000000000..0a007a285
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitExpressions.lean
@@ -0,0 +1,271 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockLookups
+import Ix.Aiur.Proofs.CircuitRows
+
+/-!
+Symbolic function-circuit emission, preserving the native ordering of member
+constraints and shared lookup contributions. Members restart auxiliary and
+lookup cursors while their selector tables occupy consecutive regions.
+-/
+
+namespace Aiur.NativeAIR.CircuitEmitter
+open OpEmitter LookupEmitter BlockEmitter Compiler
+
+def selectorExprs (base count : Nat) : Array Expr :=
+  Array.ofFn fun index : Fin count => (mainCurrent (base + index.val)).expr
+
+theorem selectorExprs_reads {values : Values G} (row : Nat → G) (base count : Nat)
+    (reads : ∀ index < count,
+      (values.columns .main .current)[base + index]? = some (row (base + index))) :
+    SelectorReads values (selectorExprs base count) (fun index => row (base + index)) := by
+  intro index expr present
+  have bound : index < count := by
+    have bound := (Array.getElem?_eq_some_iff.mp present).choose
+    simpa only [selectorExprs, Array.size_ofFn] using bound
+  have equal : (selectorExprs base count)[index]? = some (mainCurrent (base + index)).expr := by
+    simp only [selectorExprs, Array.getElem?_ofFn, bound, dif_pos]
+  rw [equal] at present
+  cases present
+  exact reads index bound
+
+structure Member where
+  functionIndex : Nat
+  function : Bytecode.Function
+  selectorBase : Nat
+  entry : Expr
+  body : BlockEmitter.Emission
+
+def Member.readBound (member : Member) : Nat :=
+  max member.function.layout.inputSize
+    (max (member.selectorBase + member.function.layout.selectors) member.body.column)
+
+def Member.eval (values : Values G) (member : Member) : Option AIR.MemberEmission := do
+  let body ← member.body.eval values
+  return ⟨member.functionIndex, member.function, member.selectorBase, body⟩
+
+theorem Member.eval_of {values : Values G} {member : Member} {body : AIR.BlockEmission}
+    (evaluated : member.body.eval values = some body) :
+    member.eval values = some ⟨member.functionIndex, member.function, member.selectorBase, body⟩ := by
+  simp only [Member.eval, evaluated, bind, Option.bind_some, pure]
+
+theorem Member.eval_components {values : Values G} {member : Member} {result : AIR.MemberEmission}
+    (evaluated : member.eval values = some result) :
+    member.functionIndex = result.functionIndex ∧ member.function = result.function ∧
+    member.selectorBase = result.selectorBase ∧ member.body.eval values = some result.body := by
+  simp only [Member.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i body bodyEval
+  cases evaluated
+  exact ⟨rfl, rfl, rfl, bodyEval⟩
+
+def emitMember (rank : Expr) (column lookup selectorBase : Nat)
+    (program : Bytecode.Toplevel) (functionIndex : Nat) : Option Member := do
+  let function ← program.functions[functionIndex]?
+  let selectors := selectorExprs selectorBase function.layout.selectors
+  let entry ← blockSelector selectors function.body
+  let body ← emitBlock selectors ⟨functionIndex, function.layout.inputSize, rank⟩ entry
+    (advice 0 function.layout.inputSize) column lookup function.body
+  return ⟨functionIndex, function, selectorBase, entry, body⟩
+
+def emitMembers (rank : Expr) (column lookup selectorBase : Nat)
+    (program : Bytecode.Toplevel) : List Nat → Option (List Member)
+  | [] => some []
+  | index :: indices => do
+    let member ← emitMember rank column lookup selectorBase program index
+    let rest ← emitMembers rank column lookup (selectorBase + member.function.layout.selectors) program indices
+    return member :: rest
+
+def rankBytes (layout : Bytecode.FunctionLayout) : Fin 6 → Expr :=
+  fun index => (mainCurrent (layout.inputSize + layout.selectors + 1 + index.val)).expr
+
+def selectorEquations (layout : Bytecode.FunctionLayout) : List Expr :=
+  (List.range layout.selectors).map fun index =>
+    let selector := (mainCurrent (layout.inputSize + index)).expr
+    selector.frontMul (selector.frontSub (.konst 1))
+
+theorem selectorEquations_eval {values : Values G} (row : Nat → G) (layout : Bytecode.FunctionLayout)
+    (reads : ∀ index < layout.selectors,
+      (values.columns .main .current)[layout.inputSize + index]? = some (row (layout.inputSize + index))) :
+    (selectorEquations layout).mapM (evalExpr values) = some
+      ((List.range layout.selectors).map fun index => AIR.booleanConstraint (row (layout.inputSize + index))) := by
+  apply list_mapM_of_map
+  intro index member
+  have evaluated : evalExpr values (mainCurrent (layout.inputSize + index)).expr =
+      some (row (layout.inputSize + index)) := reads index (List.mem_range.mp member)
+  exact Expr.frontMul_eval goldilocksLaws values evaluated
+    (Expr.frontSub_eval goldilocksLaws values evaluated rfl)
+
+structure Emission where
+  members : List Member
+  selector : Expr
+  multiplicity : Expr
+  rankBytes : Fin 6 → Expr
+  width : Nat
+  selectorStart : Nat
+  selectorCount : Nat
+  lookupCount : Nat
+  branchless : Bool
+  equations : List Expr
+  queries : List QueryExpr
+  returns : List ReturnExpr
+
+def Emission.readBound (emission : Emission) : Nat :=
+  emission.members.foldl (fun bound member => max bound member.readBound)
+    (emission.selectorStart + emission.selectorCount + 1 + 6)
+
+def circuitEmission (circuit : Bytecode.Circuit) (members : List Member) : Emission :=
+  let selector := sum (members.map (·.entry))
+  let multiplicity := (mainCurrent (circuit.layout.inputSize + circuit.layout.selectors)).expr
+  let bytes := rankBytes circuit.layout
+  { members, selector, multiplicity, rankBytes := bytes
+    width := circuit.layout.width
+    selectorStart := circuit.layout.inputSize
+    selectorCount := circuit.layout.selectors
+    lookupCount := circuit.layout.lookups
+    branchless := Bytecode.circuitBranchless circuit.layout.selectors (members.map (·.function))
+    equations := members.flatMap (·.body.equations) ++ selectorEquations circuit.layout ++
+      (if 1 < circuit.members.size then [selector.frontMul ((Expr.konst 1).frontSub selector)] else []) ++
+      [multiplicity.frontMul ((Expr.konst 1).frontSub selector)]
+    queries := members.flatMap (·.body.queries) ++ queryParts 1 selector (rangeSix bytes)
+    returns := members.flatMap (·.body.returns) }
+
+def emitCircuit (program : Bytecode.Toplevel) (circuit : Bytecode.Circuit) : Option Emission := do
+  let rank := packSix (rankBytes circuit.layout)
+  let column := circuit.layout.inputSize + circuit.layout.selectors + 1 + 6
+  let members ← emitMembers rank column 4 circuit.layout.inputSize program circuit.members.toList
+  return circuitEmission circuit members
+
+def Emission.lookup (emission : Emission) (slot : Nat) : ExprLookup :=
+  if slot = 0 then ⟨emission.multiplicity.frontNeg, returnArgs emission.branchless emission.returns⟩
+  else LookupEmitter.slot emission.branchless emission.queries slot
+
+def Emission.lookups (emission : Emission) : List ExprLookup :=
+  List.ofFn fun slot : Fin emission.lookupCount => emission.lookup slot.val
+
+def evalFin (values : Values G) (expressions : Fin size → Expr) : Option (Fin size → G) := do
+  let results ← (Array.ofFn expressions).mapM (evalExpr values)
+  return fun index => results[index.val]?.getD 0
+
+theorem evalFin_of {values : Values G} {expressions : Fin size → Expr} {results : Fin size → G}
+    (evaluated : ∀ index, evalExpr values (expressions index) = some (results index)) :
+    evalFin values expressions = some results := by
+  have arrayEval := array_mapM_ofFn expressions results (evalExpr values) evaluated
+  simp only [evalFin, arrayEval, bind, Option.bind_some, pure]
+  congr 1
+  funext index
+  simp only [Array.getElem?_ofFn, index.isLt, dif_pos, Option.getD_some]
+
+theorem evalFin_components {values : Values G} {expressions : Fin size → Expr} {results : Fin size → G}
+    (evaluated : evalFin values expressions = some results) :
+    ∀ index, evalExpr values (expressions index) = some (results index) := by
+  simp only [evalFin, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i array arrayEval
+  cases evaluated
+  intro index
+  apply evaluated_read arrayEval
+  simp only [Array.getElem?_ofFn, index.isLt, dif_pos]
+
+def Emission.eval (values : Values G) (emission : Emission) : Option AIR.CircuitEmission := do
+  let members ← emission.members.mapM (Member.eval values)
+  let selector ← evalExpr values emission.selector
+  let multiplicity ← evalExpr values emission.multiplicity
+  let rankBytes ← evalFin values emission.rankBytes
+  let equations ← emission.equations.mapM (evalExpr values)
+  let queries ← emission.queries.mapM (QueryExpr.eval values)
+  let returns ← emission.returns.mapM (ReturnExpr.eval values)
+  return ⟨members, selector, multiplicity, rankBytes, emission.width, emission.selectorStart,
+    emission.selectorCount, emission.lookupCount, emission.branchless, equations, queries, returns⟩
+
+theorem Emission.eval_of {values : Values G} {emission : Emission} {result : AIR.CircuitEmission}
+    (members : emission.members.mapM (Member.eval values) = some result.members)
+    (selector : evalExpr values emission.selector = some result.selector)
+    (multiplicity : evalExpr values emission.multiplicity = some result.multiplicity)
+    (rankBytes : ∀ index, evalExpr values (emission.rankBytes index) = some (result.rankBytes index))
+    (width : emission.width = result.width) (start : emission.selectorStart = result.selectorStart)
+    (count : emission.selectorCount = result.selectorCount) (lookups : emission.lookupCount = result.lookupCount)
+    (branchless : emission.branchless = result.branchless)
+    (equations : emission.equations.mapM (evalExpr values) = some result.equations)
+    (queries : emission.queries.mapM (QueryExpr.eval values) = some result.queries)
+    (returns : emission.returns.mapM (ReturnExpr.eval values) = some result.returns) :
+    emission.eval values = some result := by
+  simp only [Emission.eval, members, selector, multiplicity, evalFin_of rankBytes, equations, queries, returns,
+    width, start, count, lookups, branchless, bind, Option.bind_some, pure]
+
+theorem Emission.eval_components {values : Values G} {emission : Emission} {result : AIR.CircuitEmission}
+    (evaluated : emission.eval values = some result) :
+    emission.members.mapM (Member.eval values) = some result.members ∧
+    evalExpr values emission.selector = some result.selector ∧
+    evalExpr values emission.multiplicity = some result.multiplicity ∧
+    (∀ index, evalExpr values (emission.rankBytes index) = some (result.rankBytes index)) ∧
+    emission.width = result.width ∧ emission.selectorStart = result.selectorStart ∧
+    emission.selectorCount = result.selectorCount ∧ emission.lookupCount = result.lookupCount ∧
+    emission.branchless = result.branchless ∧
+    emission.equations.mapM (evalExpr values) = some result.equations ∧
+    emission.queries.mapM (QueryExpr.eval values) = some result.queries ∧
+    emission.returns.mapM (ReturnExpr.eval values) = some result.returns := by
+  simp only [Emission.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i members membersEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i selector selectorEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i multiplicity multiplicityEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i bytes bytesEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i equations equationsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i queries queriesEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i returns returnsEval
+  cases evaluated
+  exact ⟨membersEval, selectorEval, multiplicityEval, evalFin_components bytesEval,
+    rfl, rfl, rfl, rfl, rfl, equationsEval, queriesEval, returnsEval⟩
+
+theorem Emission.lookup_eval {values : Values G} {emission : Emission} {result : AIR.CircuitEmission}
+    (evaluated : emission.eval values = some result) (slot : Nat) :
+    (emission.lookup slot).eval goldilocksOps values = some (result.lookup slot) := by
+  obtain ⟨_, _, multiplicity, _, _, _, _, _, branchless, _, queries, returns⟩ := Emission.eval_components evaluated
+  by_cases zero : slot = 0
+  · simp only [Emission.lookup, AIR.CircuitEmission.lookup, zero, if_true, ExprLookup.eval]
+    have weight := Expr.frontNeg_eval goldilocksLaws values multiplicity
+    change evalExpr values emission.multiplicity.frontNeg = some (0 - result.multiplicity) at weight
+    change ((evalExpr values emission.multiplicity.frontNeg).bind fun weight =>
+      ((returnArgs emission.branchless emission.returns).mapM (evalExpr values)).bind fun args => some (weight, args)) = _
+    rw [weight, returnArgs_eval emission.branchless returns, branchless]
+    rfl
+  · simpa only [Emission.lookup, AIR.CircuitEmission.lookup, zero, if_false, branchless] using
+      LookupEmitter.slot_eval emission.branchless queries slot
+
+theorem Emission.lookups_eval {values : Values G} {emission : Emission} {result : AIR.CircuitEmission}
+    (evaluated : emission.eval values = some result) :
+    emission.lookups.mapM (ExprLookup.eval goldilocksOps values) = some
+      (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) := by
+  have lookups := (Emission.eval_components evaluated).2.2.2.2.2.2.2.1
+  have reflected := list_mapM_ofFn (fun slot : Fin emission.lookupCount => emission.lookup slot.val)
+    (fun slot => result.lookup slot.val) (ExprLookup.eval goldilocksOps values)
+    (fun slot => Emission.lookup_eval evaluated slot.val)
+  rw [← lookups]
+  exact reflected
+
+end Aiur.NativeAIR.CircuitEmitter
diff --git a/Ix/Aiur/Proofs/CircuitLayout.lean b/Ix/Aiur/Proofs/CircuitLayout.lean
new file mode 100644
index 000000000..4971598d8
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitLayout.lean
@@ -0,0 +1,284 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FunctionLayout
+
+/-! Compiled circuit layouts contain every member's input and auxiliary
+columns. Selector extents are supplied separately by the checked row counts. -/
+
+namespace Aiur.Bytecode
+
+def MembersColumnBound (functions : Array Function) (members : Array FunIdx) (layout : FunctionLayout) : Prop :=
+  7 ≤ layout.auxiliaries ∧ ∀ index ∈ members,
+    functions[index]!.layout.inputSize ≤ layout.inputSize ∧
+    functions[index]!.layout.auxiliaries ≤ layout.auxiliaries
+
+def CircuitsColumnBound (functions : Array Function) (circuits : Array Circuit) : Prop :=
+  ∀ circuit ∈ circuits, MembersColumnBound functions circuit.members circuit.layout
+
+private theorem column_circuits_empty (functions : Array Function) : CircuitsColumnBound functions #[] := by
+  simp [CircuitsColumnBound]
+
+private theorem column_circuits_push {functions : Array Function} {circuits : Array Circuit} {circuit : Circuit}
+    (before : CircuitsColumnBound functions circuits)
+    (member : MembersColumnBound functions circuit.members circuit.layout) :
+    CircuitsColumnBound functions (circuits.push circuit) := by
+  intro c present
+  rcases Array.mem_push.mp present with prior | equal
+  · exact before c prior
+  · subst c; exact member
+
+private theorem column_bang_of_present {functions : Array Function} {index : Nat} {function : Function}
+    (present : functions[index]? = some function) : functions[index]! = function := by
+  rw [Array.getElem!_eq_getD, Array.getD_eq_getD_getElem?, present]
+  rfl
+
+private theorem column_member_singleton {functions : Array Function} {index : FunIdx} {function : Function}
+    (present : functions[index]? = some function) (valid : function.ComputedLayout) :
+    MembersColumnBound functions #[index] function.layout := by
+  refine ⟨valid.reserved, ?_⟩
+  intro i member
+  have equal : i = index := by simpa using member
+  subst i
+  rw [column_bang_of_present present]
+  exact ⟨Nat.le_refl _, Nat.le_refl _⟩
+
+private theorem column_array_bang {α : Type} [Inhabited α] (property : α → Prop)
+    {array : Array α} (valid : ∀ value ∈ array, property value) (fallback : property default) (index : Nat) :
+    property array[index]! := by
+  by_cases bound : index < array.size
+  · rw [getElem!_pos array index bound]
+    exact valid _ (Array.getElem_mem bound)
+  · rw [getElem!_neg array index bound]
+    exact fallback
+
+private theorem column_first_reserved {functions : Array Function} {members : Array FunIdx}
+    (valid : FunctionsComputedLayout functions) (nonempty : 0 < functions.size)
+    (constrained : MembersConstrained functions members) :
+    7 ≤ functions[members[0]!]!.layout.auxiliaries := by
+  refine column_array_bang (fun index : FunIdx => 7 ≤ functions[index]!.layout.auxiliaries)
+    (array := members) ?_ ?_ 0
+  · intro index member
+    obtain ⟨function, present, _⟩ := constrained index member
+    rw [column_bang_of_present present]
+    exact (valid function (Array.mem_of_getElem? present)).reserved
+  · change 7 ≤ functions[0]!.layout.auxiliaries
+    rw [getElem!_pos functions 0 nonempty]
+    exact (valid _ (Array.getElem_mem nonempty)).reserved
+
+private theorem column_merge_fold (functions : Array Function) (first : FunIdx) (members : List FunIdx)
+    (initial : FunctionLayout)
+    (firstInput : functions[first]!.layout.inputSize ≤ initial.inputSize)
+    (firstAux : functions[first]!.layout.auxiliaries ≤ initial.auxiliaries) :
+    let final := members.foldl (fun acc index => if index == first then acc else acc.merge functions[index]!.layout) initial
+    initial.inputSize ≤ final.inputSize ∧ initial.auxiliaries ≤ final.auxiliaries ∧
+      ∀ index ∈ members, functions[index]!.layout.inputSize ≤ final.inputSize ∧
+        functions[index]!.layout.auxiliaries ≤ final.auxiliaries := by
+  induction members generalizing initial with
+  | nil => exact ⟨Nat.le_refl _, Nat.le_refl _, by simp⟩
+  | cons index members ih =>
+    let next := if index == first then initial else initial.merge functions[index]!.layout
+    have before : initial.inputSize ≤ next.inputSize ∧ initial.auxiliaries ≤ next.auxiliaries := by
+      dsimp only [next]
+      split
+      · exact ⟨Nat.le_refl _, Nat.le_refl _⟩
+      · exact ⟨Nat.le_max_left _ _, Nat.le_max_left _ _⟩
+    have here : functions[index]!.layout.inputSize ≤ next.inputSize ∧
+        functions[index]!.layout.auxiliaries ≤ next.auxiliaries := by
+      dsimp only [next]
+      split
+      · rename_i equal
+        have eq : index = first := beq_iff_eq.mp equal
+        subst index
+        exact ⟨firstInput, firstAux⟩
+      · exact ⟨Nat.le_max_right _ _, Nat.le_max_right _ _⟩
+    have rest := ih next (Nat.le_trans firstInput before.1) (Nat.le_trans firstAux before.2)
+    refine ⟨Nat.le_trans before.1 rest.1, Nat.le_trans before.2 rest.2.1, ?_⟩
+    intro chosen member
+    rcases List.mem_cons.mp member with equal | later
+    · subst chosen
+      exact ⟨Nat.le_trans here.1 rest.1, Nat.le_trans here.2 rest.2.1⟩
+    · exact rest.2.2 chosen later
+
+theorem merged_columnBound (functions : Array Function) (members : Array FunIdx)
+    (valid : FunctionsComputedLayout functions) (nonempty : 0 < functions.size)
+    (constrained : MembersConstrained functions members) :
+    MembersColumnBound functions members
+      (members.foldl (init := functions[members[0]!]!.layout)
+        fun acc index => if index == members[0]! then acc else acc.merge functions[index]!.layout) := by
+  rw [← Array.foldl_toList]
+  have folded := column_merge_fold functions members[0]! members.toList functions[members[0]!]!.layout
+    (Nat.le_refl _) (Nat.le_refl _)
+  exact ⟨Nat.le_trans (column_first_reserved valid nonempty constrained) folded.2.1,
+    fun index member => folded.2.2 index (Array.mem_def.mp member)⟩
+
+private theorem list_forIn'_id_invariant {α β : Type} (items : List α)
+    (step : (item : α) → item ∈ items → β → Id (ForInStep β)) (property : β → Prop)
+    (initial : β) (before : property initial)
+    (preserved : ∀ item member acc, property acc → property (step item member acc).run.value) :
+    property (forIn' items initial step).run := by
+  induction items generalizing initial with
+  | nil => exact before
+  | cons item items ih =>
+    rw [List.forIn'_cons]
+    have first := preserved item List.mem_cons_self initial before
+    cases computed : step item List.mem_cons_self initial with
+    | done next =>
+      simp only [computed, Id.run, ForInStep.value] at first
+      exact first
+    | yield next =>
+      simp only [computed, Id.run, ForInStep.value] at first
+      exact ih (fun item member => step item (List.mem_cons_of_mem _ member)) next first
+        (fun item member acc => preserved item (List.mem_cons_of_mem _ member) acc)
+
+theorem singletonCircuits_columnBound (program : Toplevel) (nameOf : FunIdx → String)
+    (valid : FunctionsComputedLayout program.functions) :
+    CircuitsColumnBound program.functions (program.singletonCircuits nameOf) := by
+  unfold Toplevel.singletonCircuits
+  simp only [Id.run]
+  rw [Std.Legacy.Range.forIn'_eq_forIn'_range']
+  apply list_forIn'_id_invariant _ _ (CircuitsColumnBound program.functions) _ (column_circuits_empty _)
+  intro index member circuits before
+  split
+  · exact column_circuits_push before
+      (column_member_singleton (Array.getElem?_eq_getElem _) (valid _ (Array.getElem_mem _)))
+  · exact before
+
+end Aiur.Bytecode
+
+namespace Aiur
+open Bytecode
+
+private theorem list_forIn_except_invariant {ε α β : Type} (items : List α)
+    (step : α → β → Except ε (ForInStep β)) (property : β → Prop) (initial : β)
+    (before : property initial)
+    (preserved : ∀ item ∈ items, ∀ acc result, property acc → step item acc = .ok result → property result.value)
+    {result : β} (computed : forIn items initial step = .ok result) : property result := by
+  induction items generalizing initial with
+  | nil => cases computed; exact before
+  | cons item items ih =>
+    simp only [List.forIn_cons, bind, Except.bind] at computed
+    split at computed
+    · cases computed
+    · rename_i next nextComputed
+      have first := preserved item List.mem_cons_self initial next before nextComputed
+      cases next with
+      | done next => cases computed; exact first
+      | yield next =>
+        exact ih next first (fun item member => preserved item (List.mem_cons_of_mem _ member)) computed
+
+private theorem array_forIn_except_invariant {ε α β : Type} (items : Array α)
+    (step : α → β → Except ε (ForInStep β)) (property : β → Prop) (initial : β)
+    (before : property initial)
+    (preserved : ∀ item ∈ items, ∀ acc result, property acc → step item acc = .ok result → property result.value)
+    {result : β} (computed : forIn items initial step = .ok result) : property result := by
+  rw [← Array.forIn_toList] at computed
+  exact list_forIn_except_invariant items.toList step property initial before
+    (fun item member => preserved item (Array.mem_toList_iff.mp member)) computed
+
+private theorem column_members_empty (functions : Array Function) : MembersConstrained functions #[] := by
+  simp [MembersConstrained]
+
+private theorem column_members_push {functions : Array Function} {members : Array FunIdx} {index : FunIdx}
+    (before : MembersConstrained functions members) (constrained : functions[index]!.constrained = true) :
+    MembersConstrained functions (members.push index) := by
+  intro i member
+  rcases Array.mem_push.mp member with prior | equal
+  · exact before i prior
+  · subst i
+    by_cases bound : index < functions.size
+    · exact ⟨functions[index], Array.getElem?_eq_getElem bound,
+        by simpa only [getElem!_pos functions index bound] using constrained⟩
+    · rw [getElem!_neg functions index bound] at constrained
+      contradiction
+
+theorem CompiledToplevel.groupFunctions_columnBound {before after : CompiledToplevel}
+    {groups : Array (String × Array String)}
+    (functions : FunctionsComputedLayout before.bytecode.functions)
+    (nonempty : 0 < before.bytecode.functions.size)
+    (valid : CircuitsColumnBound before.bytecode.functions before.bytecode.circuits)
+    (accepted : before.groupFunctions groups = .ok after) :
+    CircuitsColumnBound after.bytecode.functions after.bytecode.circuits := by
+  unfold CompiledToplevel.groupFunctions at accepted
+  simp only [bind, Except.bind, pure, Except.pure, throw, throwThe, MonadExceptOf.throw] at accepted
+  split at accepted
+  · cases accepted
+  · rename_i resolved resolvedComputed
+    have resolvedValid : ∀ pair ∈ resolved.2, MembersConstrained before.bytecode.functions pair.2 := by
+      apply array_forIn_except_invariant _ _
+        (fun acc => ∀ pair ∈ acc.2, MembersConstrained before.bytecode.functions pair.2) _ ?_ ?_ resolvedComputed
+      · simp
+      · intro item member acc result accumulated step
+        rcases item with ⟨groupName, names⟩
+        dsimp only at step
+        split at step
+        · cases step
+        · split at step
+          · cases step
+          · rename_i named namedComputed
+            have namedValid : MembersConstrained before.bytecode.functions named.2 := by
+              apply array_forIn_except_invariant _ _
+                (fun acc => MembersConstrained before.bytecode.functions acc.2) _ (column_members_empty _) ?_ namedComputed
+              intro name nameMember acc result accumulated step
+              repeat' first | split at step | (dsimp only at step; split at step)
+              all_goals cases step
+              all_goals exact column_members_push accumulated (by assumption)
+            cases step
+            intro pair member
+            rcases Array.mem_push.mp member with prior | equal
+            · exact accumulated pair prior
+            · subst pair; exact namedValid
+    split at accepted
+    · cases accepted
+    · rename_i circuits circuitsComputed
+      cases accepted
+      apply array_forIn_except_invariant _ _
+        (fun acc => CircuitsColumnBound before.bytecode.functions acc.1) _ (column_circuits_empty _) ?_ circuitsComputed
+      intro circuit member acc result accumulated step
+      split at step
+      · split at step
+        · cases step
+          exact column_circuits_push accumulated (valid circuit member)
+        · split at step
+          · cases step
+            exact accumulated
+          · cases step
+            apply column_circuits_push accumulated
+            apply merged_columnBound _ _ functions nonempty
+            exact column_array_bang (fun pair : String × Array FunIdx =>
+              MembersConstrained before.bytecode.functions pair.2) resolvedValid (column_members_empty _) _
+      · cases step
+
+theorem finishCompilation_columnBound (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) (valid : FunctionsComputedLayout raw.functions) :
+    CircuitsColumnBound (finishCompilation source raw names).bytecode.functions
+      (finishCompilation source raw names).bytecode.circuits := by
+  unfold finishCompilation
+  apply singletonCircuits_columnBound
+  exact finishCompilation_computedLayout source raw names valid
+
+theorem Source.Toplevel.compile_columnBound {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (accepted : source.compile = .ok compiled) :
+    CircuitsColumnBound compiled.bytecode.functions compiled.bytecode.circuits := by
+  obtain ⟨inlined, typed, concrete, raw, names, _, _, _, lowered, artifact⟩ :=
+    source.compile_artifact_of_ok accepted
+  rw [artifact]
+  exact finishCompilation_columnBound inlined raw names (Concrete.Decls.toBytecode_computedLayout lowered)
+
+theorem BoundVerifier.Backend.circuits_columnBound {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) :
+    CircuitsColumnBound backend.compiled.bytecode.functions backend.compiled.bytecode.circuits := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  have valid := Source.Toplevel.compile_columnBound compiled
+  split at grouped
+  · cases grouped
+    exact valid
+  · have same := (CompiledToplevel.groupFunctions_preserves_code grouped).2.2.1
+    have bound := (Array.getElem?_eq_some_iff.mp backend.present).choose
+    rw [same] at bound
+    exact CompiledToplevel.groupFunctions_columnBound
+      (Source.Toplevel.compile_computedLayout compiled) (by omega) valid grouped
+
+end Aiur
diff --git a/Ix/Aiur/Proofs/CircuitMembership.lean b/Ix/Aiur/Proofs/CircuitMembership.lean
new file mode 100644
index 000000000..78fea71fc
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitMembership.lean
@@ -0,0 +1,234 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitTraces
+import Ix.Aiur.Proofs.Grouping
+import Std.Tactic.Do
+
+/-! The actual compiler and successful grouping produce only constrained
+circuit members. The selected backend's program shape check therefore
+discharges the shape condition for every successfully emitted trace row.
+Physical lookup bounds, native extraction and the cryptographic and
+source-semantic endpoint remain separate proof obligations. -/
+
+open Std.Do
+namespace Aiur.Bytecode
+
+def MembersConstrained (functions : Array Function) (members : Array FunIdx) : Prop :=
+  ∀ index ∈ members, ∃ function, functions[index]? = some function ∧ function.constrained = true
+
+def CircuitsConstrained (functions : Array Function) (circuits : Array Circuit) : Prop :=
+  ∀ circuit ∈ circuits, MembersConstrained functions circuit.members
+
+private theorem circuits_empty (functions : Array Function) : CircuitsConstrained functions #[] := by
+  simp [CircuitsConstrained]
+
+private theorem circuits_push {functions : Array Function} {circuits : Array Circuit} {circuit : Circuit}
+    (before : CircuitsConstrained functions circuits) (member : MembersConstrained functions circuit.members) :
+    CircuitsConstrained functions (circuits.push circuit) := by
+  intro c present
+  rcases Array.mem_push.mp present with prior | equal
+  · exact before c prior
+  · subst c; exact member
+
+private theorem member_singleton {functions : Array Function} {index : FunIdx} {function : Function}
+    (present : functions[index]? = some function) (constrained : function.constrained = true) :
+    MembersConstrained functions #[index] := by
+  intro i member
+  have equal : i = index := by simpa using member
+  subst i
+  exact ⟨function, present, constrained⟩
+
+private theorem members_empty (functions : Array Function) : MembersConstrained functions #[] := by
+  simp [MembersConstrained]
+
+private theorem members_push {functions : Array Function} {members : Array FunIdx} {index : FunIdx}
+    (before : MembersConstrained functions members) (constrained : functions[index]!.constrained = true) :
+    MembersConstrained functions (members.push index) := by
+  intro i member
+  rcases Array.mem_push.mp member with prior | equal
+  · exact before i prior
+  · subst i
+    by_cases bound : index < functions.size
+    · exact ⟨functions[index], Array.getElem?_eq_getElem bound,
+        by simpa only [getElem!_pos functions index bound] using constrained⟩
+    · rw [getElem!_neg functions index bound] at constrained
+      contradiction
+
+private theorem array_bang_valid {α : Type} [Inhabited α] (property : α → Prop)
+    {array : Array α} (valid : ∀ value ∈ array, property value) (fallback : property default) (index : Nat) :
+    property array[index]! := by
+  by_cases bound : index < array.size
+  · rw [getElem!_pos array index bound]
+    exact valid _ (Array.getElem_mem bound)
+  · rw [getElem!_neg array index bound]
+    exact fallback
+
+private theorem array_split_member {α : Type} {array : Array α} {pref suff : List α} {value : α}
+    (split : array.toList = pref ++ value :: suff) : value ∈ array := by
+  apply Array.mem_toList_iff.mp
+  rw [split]
+  simp
+
+set_option mvcgen.warning false in
+theorem singletonCircuits_constrained (program : Toplevel) (nameOf : FunIdx → String) :
+    CircuitsConstrained program.functions (program.singletonCircuits nameOf) := by
+  have spec : Triple (m := Id) (program.singletonCircuits nameOf) ⌜True⌝
+      (⇓ circuits => ⌜CircuitsConstrained program.functions circuits⌝) := by
+    mvcgen [Toplevel.singletonCircuits, Id.run] invariants
+    · ⇓⟨_, circuits⟩ => ⌜CircuitsConstrained program.functions circuits⌝
+    case vc1.step.isTrue =>
+      apply circuits_push (by assumption)
+      apply member_singleton (Array.getElem?_eq_getElem _)
+      assumption
+    case vc3.pre => exact circuits_empty _
+  exact Id.of_wp_run_eq rfl _ spec
+
+end Aiur.Bytecode
+
+namespace Aiur
+open Bytecode
+
+-- The library's corresponding specification has unused monad parameters.
+-- This specialization keeps loop verification conditions fully determined.
+private theorem throw_except {ε α : Type} {error : ε} {post : PostCond α (.except ε .pure)} :
+    Triple (ps := .except ε .pure) (throw error : Except ε α) (spred(post.2.1 error)) post := by
+  simp [Triple.iff]
+
+set_option mvcgen.warning false in
+theorem CompiledToplevel.groupFunctions_constrained {before after : CompiledToplevel}
+    {groups : Array (String × Array String)}
+    (valid : CircuitsConstrained before.bytecode.functions before.bytecode.circuits)
+    (accepted : before.groupFunctions groups = .ok after) :
+    CircuitsConstrained after.bytecode.functions after.bytecode.circuits := by
+  have spec : ⦃⌜True⌝⦄ before.groupFunctions groups
+      ⦃post⟨fun compiled => ⌜CircuitsConstrained compiled.bytecode.functions compiled.bytecode.circuits⌝,
+        fun _ => ⌜True⌝⟩⦄ := by
+    mvcgen [CompiledToplevel.groupFunctions, -Spec.throw_Except, throw_except] invariants
+    · post⟨fun ⟨_, _, resolved⟩ => ⌜∀ pair ∈ resolved,
+        MembersConstrained before.bytecode.functions pair.2⌝, fun _ => ⌜True⌝⟩
+    · post⟨fun ⟨_, _, members⟩ => ⌜MembersConstrained before.bytecode.functions members⌝,
+        fun _ => ⌜True⌝⟩
+    · post⟨fun ⟨_, circuits, _⟩ => ⌜CircuitsConstrained before.bytecode.functions circuits⌝,
+        fun _ => ⌜True⌝⟩
+    case vc4.step.h_1.isTrue.isFalse.isFalse => exact members_push (by assumption) (by assumption)
+    case vc7.step.isFalse.pre => exact members_empty _
+    case vc8.step.isFalse.post.success =>
+      intro pair member
+      rcases Array.mem_push.mp member with prior | equal
+      · apply_assumption; exact prior
+      · subst pair; assumption
+    case vc10.pre =>
+      change ∀ pair ∈ (#[] : Array (String × Array FunIdx)), _
+      simp
+    case vc11.step.isTrue.h_1 =>
+      apply circuits_push (by assumption)
+      apply valid
+      exact array_split_member (by assumption)
+    case vc13.step.isTrue.h_2.isFalse =>
+      apply circuits_push (by assumption)
+      exact array_bang_valid (fun pair : String × Array FunIdx =>
+        MembersConstrained before.bytecode.functions pair.2) (by assumption) (members_empty _) _
+    case vc15.post.success.pre => exact circuits_empty _
+  exact Except.of_wp_eq accepted (fun result => match result with
+    | .error _ => True
+    | .ok compiled => CircuitsConstrained compiled.bytecode.functions compiled.bytecode.circuits) spec
+
+theorem finishCompilation_circuits_constrained (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) :
+    CircuitsConstrained (finishCompilation source raw names).bytecode.functions
+      (finishCompilation source raw names).bytecode.circuits := by
+  unfold finishCompilation
+  exact singletonCircuits_constrained _ _
+
+theorem Source.Toplevel.compile_circuits_constrained {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (accepted : source.compile = .ok compiled) :
+    CircuitsConstrained compiled.bytecode.functions compiled.bytecode.circuits := by
+  obtain ⟨inlined, typed, concrete, raw, names, _, _, _, _, artifact⟩ :=
+    source.compile_artifact_of_ok accepted
+  rw [artifact]
+  exact finishCompilation_circuits_constrained inlined raw names
+
+theorem BoundVerifier.Backend.circuits_constrained {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) :
+    CircuitsConstrained backend.compiled.bytecode.functions backend.compiled.bytecode.circuits := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  have valid := Source.Toplevel.compile_circuits_constrained compiled
+  split at grouped
+  · cases grouped
+    exact valid
+  · exact CompiledToplevel.groupFunctions_constrained valid grouped
+
+end Aiur
+
+namespace Aiur.Bytecode
+
+theorem Toplevel.validateLookupShapes_function {program : Toplevel}
+    (valid : program.validateLookupShapes = true) {function : Function} {index : FunIdx}
+    (present : program.functions[index]? = some function) (constrained : function.constrained = true) :
+    function.body.lookupShapes program none = true := by
+  simp only [Toplevel.validateLookupShapes, Bool.and_eq_true] at valid
+  have checked := Array.all_eq_true'.mp valid.2.2 function (Array.mem_of_getElem? present)
+  simpa only [constrained, Bool.not_true, Bool.false_or] using checked
+
+end Aiur.Bytecode
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem CircuitWitness.shapes_of_compiled {program : Toplevel}
+    (shapes : program.validateLookupShapes = true)
+    (constrained : CircuitsConstrained program.functions program.circuits)
+    (witness : CircuitWitness) (circuit : witness.circuit ∈ program.circuits)
+    (emitted : witness.Emitted program) : witness.Shapes program := by
+  obtain ⟨_, indices, source⟩ := witness.circuit.emitRow_spec witness.values program emitted
+  intro part member
+  have index : part.functionIndex ∈ witness.circuit.members := by
+    apply Array.mem_toList_iff.mp
+    rw [← indices]
+    exact List.mem_map.mpr ⟨part, member, rfl⟩
+  obtain ⟨function, present, isConstrained⟩ := constrained witness.circuit circuit part.functionIndex index
+  have equal := Option.some.inj (present.symm.trans (source part member).present)
+  subst function
+  exact Toplevel.validateLookupShapes_function shapes present isConstrained
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+theorem Backend.witness_shapes {selection : Selection} (backend : Backend selection)
+    (witness : CircuitWitness) (circuit : witness.circuit ∈ backend.compiled.bytecode.circuits)
+    (emitted : witness.Emitted backend.compiled.bytecode) : witness.Shapes backend.compiled.bytecode :=
+  witness.shapes_of_compiled backend.lookupShapes backend.circuits_constrained circuit emitted
+
+theorem Backend.compiled_trace_execution {selection : Selection} (backend : Backend selection)
+    (tables : AuxiliaryTables) (traces : CircuitTraces backend.compiled.bytecode.circuits.toList)
+    {witnesses : List CircuitWitness}
+    (emitted : traces.emitWitnesses backend.compiled.bytecode = some witnesses)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (budget : lookupQueryBound
+      (backend.compiled.bytecode.circuits.toList.map (·.layout.lookups) ++ otherSlots)
+      (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) = some result)
+    (width : Nat) (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        encodedCircuitQueryPool (witnesses.map (·.emission)))
+      (tables.circuitProviders (witnesses.map (·.emission))))
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds) :
+    Execution backend.compiled.bytecode (memoryFacts tables.memory)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  have valid := (traces.emitWitnesses_spec emitted).1
+  apply backend.trace_circuit_execution tables traces emitted budget width input arity balanced
+    publicWidth queryWidths memoryValid canonical satisfied _ limits
+  intro witness member
+  exact backend.witness_shapes witness (by simpa using (valid witness member).1) (valid witness member).2
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/CircuitPoolExecution.lean b/Ix/Aiur/Proofs/CircuitPoolExecution.lean
new file mode 100644
index 000000000..a27a2537c
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitPoolExecution.lean
@@ -0,0 +1,114 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRowReturns
+
+/-!
+A nonzero provider row of the valued circuit model yields a valid
+function row from the same bytecode program. The interpreted inputs, rank
+bytes and multiplicity agree with the circuit, and its padded provider
+message names that same semantic call. All selected call and rank-byte
+queries belong to any ambient pool containing the computed circuit pool.
+
+Exact global lookup balance, memory validity, shape and count/layout bounds
+remain explicit. This is not yet extraction from native public verification.
+-/
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_valid_in_pool {tables : LookupTables} {width : Nat} {emissions : List CircuitEmission} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (member : emission ∈ emissions)
+    (pooled : circuitQueryPool emissions ⊆ queries)
+    (bounded : circuit.members.size < gSize.toNat)
+    (bounds : ∀ part ∈ emission.members, part.function.body.rowBounds (part.selector row))
+    (shape : ∀ part ∈ emission.members, part.function.body.lookupShapes program none = true)
+    (returnBound : ∀ part ∈ emission.members,
+      (part.function.body.selectorFlow (part.selector row)).returns.length < gSize.toNat)
+    (reserved : 4 ≤ circuit.layout.lookups)
+    (limits : ∀ part ∈ emission.members, part.body.lookup ≤ circuit.layout.lookups)
+    (single : emission.branchless = true → emission.returns.length ≤ 1)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (nonzero : emission.multiplicity ≠ 0) :
+    ∃ selected ∈ emission.members, ∃ interpreted : FunctionRow,
+      interpreted.Valid program (memoryFacts tables.memory) ∧
+      interpreted.request.function = selected.functionIndex ∧
+      interpreted.request.inputs = rowValues (rowAdvice row 0 selected.function.layout.inputSize) ∧
+      interpreted.request.rank = packRank emission.rankBytes ∧
+      interpreted.rankBytes = emission.rankBytes ∧
+      interpreted.selector = emission.selector ∧ interpreted.multiplicity = emission.multiplicity ∧
+      (1, interpreted.request) ∈ emission.returns ∧
+      padMessage width (emission.lookup 0).2 = padMessage width (functionMessage interpreted.request) ∧
+      selected.body.CallsAt interpreted.calls ∧
+      (interpreted.requests.map functionMessage) ⊆ queries ∧
+      (interpreted.byteQueries.map rangeMessage) ⊆ queries := by
+  obtain ⟨description, indices, source⟩ := circuit.emitRow_spec row program emitted
+  have count := congrArg List.length indices
+  simp only [List.length_map, Array.length_toList] at count
+  have valid : ∀ equation ∈ (circuitEmission row circuit emission.members).equations, equation = 0 := by
+    rw [← description]
+    exact satisfied
+  have slots := circuit.emitRow_querySlots row program emitted bounded bounds reserved limits satisfied
+  have inCircuit := slots.circuit_pool member
+  have queried : emission.QueriesIn queries := fun query present active =>
+    pooled (inCircuit query present active)
+  have wholeQueried : (circuitEmission row circuit emission.members).QueriesIn queries := by
+    rw [← description]
+    exact queried
+  have activity := circuitEmission_activity valid
+  rw [← description] at activity
+  have active := nonzero_multiplicity_selector_one activity nonzero
+  obtain ⟨selected, selectedMember, selectedActive, selectedSource⟩ :=
+    circuit.emitRow_active_member row program emitted satisfied bounded nonzero
+  have bodySatisfied := circuitEmission_member_satisfied valid selectedMember
+  have bodyQueried := circuitEmission_member_queried wholeQueried selectedMember
+  have selectedActivity : activityConstraint emission.multiplicity
+      (selected.function.body.selectorFlow (selected.selector row)).entry = 0 := by
+    change activityConstraint emission.multiplicity (selected.entry row) = 0
+    rw [selectedActive]
+    rw [active] at activity
+    exact activity
+  obtain ⟨interpreted, interpretedValid, returned, functionEq, inputsEq, rankEq,
+      rankBytesEq, selectorEq, multiplicityEq, called, inventory⟩ :=
+    selected.function.emitRow_valid global memoryValid canonical program row (selected.selector row)
+      selected.functionIndex emission.rankBytes (rowAdvice row 0 selected.function.layout.inputSize)
+      _ 4 selectedSource.present (by simp only [rowAdvice, Array.size_ofFn])
+      (shape selected selectedMember) (bounds selected selectedMember) selectedSource.emitted
+      emission.multiplicity nonzero selectedActivity bodySatisfied bodyQueried
+  have returnMember : (1, interpreted.request) ∈ emission.returns := by
+    have returnsEq := congrArg CircuitEmission.returns description
+    rw [returnsEq]
+    exact List.mem_flatMap.mpr ⟨selected, selectedMember, returned⟩
+  have message := circuitEmission_return_message source shape (by omega) returnBound valid
+    (by rw [← description]; exact active) width
+    (by rw [← description]; exact single)
+    (by rw [← description]; exact returnMember)
+  rw [← description] at message
+  have headers := circuitEmission_rank_queried wholeQueried (by rw [← description]; exact active)
+  rw [← description] at headers
+  refine ⟨selected, selectedMember, interpreted, interpretedValid, functionEq, inputsEq,
+    rankEq, rankBytesEq, ?_, multiplicityEq, returnMember, message, called, ?_, ?_⟩
+  · exact selectorEq.trans (selectedActive.trans active.symm)
+  · intro message member
+    simp only [FunctionRow.requests, List.map_map, List.mem_map, Function.comp_def] at member
+    obtain ⟨edge, edgeMember, equal⟩ := member
+    rw [← equal]
+    exact (inventory edge edgeMember).1
+  · intro message member
+    rw [FunctionRow.byteQueries, List.map_append] at member
+    rcases List.mem_append.mp member with header | gap
+    · rw [rankBytesEq] at header
+      exact headers header
+    · obtain ⟨pair, pairMember, messageEq⟩ := List.mem_map.mp gap
+      obtain ⟨edge, edgeMember, pairMember⟩ := List.mem_flatMap.mp pairMember
+      rw [← messageEq]
+      exact (inventory edge edgeMember).2.1 (List.mem_map.mpr ⟨pair, pairMember, rfl⟩)
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/CircuitReflection.lean b/Ix/Aiur/Proofs/CircuitReflection.lean
new file mode 100644
index 000000000..82f3f949e
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitReflection.lean
@@ -0,0 +1,168 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitExpressions
+
+/-!
+Reflection of complete symbolic function circuits into the valued circuit
+model. The row premise covers the finite header and member allocations;
+no equation values, query messages, or selected executions are assumed.
+-/
+
+namespace Aiur.NativeAIR.CircuitEmitter
+open OpEmitter LookupEmitter BlockEmitter Compiler
+
+theorem emitMember_reflects {values : Values G} (row : Nat → G) {rank : Expr} {r : G}
+    {column lookup selectorBase : Nat} {program : Bytecode.Toplevel} {functionIndex : Nat} {member : Member}
+    (rankEval : evalExpr values rank = some r)
+    (emitted : emitMember rank column lookup selectorBase program functionIndex = some member)
+    (reads : ∀ index < member.readBound, (values.columns .main .current)[index]? = some (row index)) :
+    ∃ result, AIR.emitMember row r column lookup selectorBase program functionIndex = some result ∧
+      member.eval values = some result ∧ evalExpr values member.entry = some (result.entry row) := by
+  simp only [emitMember, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i function functionRead
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i entry entryRead
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i body bodyEmitted
+  cases emitted
+  dsimp only [Member.readBound] at reads
+  have selectors : SelectorReads values (selectorExprs selectorBase function.layout.selectors)
+      (fun index => row (selectorBase + index)) := selectorExprs_reads row selectorBase function.layout.selectors
+    (fun index bound => reads (selectorBase + index) (by omega))
+  have entryEval := blockSelector_reads selectors function.body entryRead
+  have inputs := advice_absolute_eval row 0 function.layout.inputSize
+    (fun index bound => by simpa only [Nat.zero_add] using reads index (by omega))
+  obtain ⟨result, bodyRead, bodyEval⟩ := block_reflects values row selectors rankEval function.body
+    entryEval inputs (advice_normal _ _) bodyEmitted (fun index _ bound => reads index (by omega))
+  dsimp only [Context.valued] at bodyRead
+  refine ⟨⟨functionIndex, function, selectorBase, result⟩, ?_, Member.eval_of bodyEval, entryEval⟩
+  simp only [AIR.emitMember, functionRead, Bytecode.Function.emitRow, bodyRead, bind, Option.bind_some, pure]
+
+theorem emitMembers_reflects {values : Values G} (row : Nat → G) {rank : Expr} {r : G}
+    (column lookup selectorBase : Nat) (program : Bytecode.Toplevel) (indices : List Nat)
+    {members : List Member} (rankEval : evalExpr values rank = some r)
+    (emitted : emitMembers rank column lookup selectorBase program indices = some members)
+    (reads : ∀ member ∈ members, ∀ index < member.readBound,
+      (values.columns .main .current)[index]? = some (row index)) :
+    ∃ results, AIR.emitMembers row r column lookup selectorBase program indices = some results ∧
+      members.mapM (Member.eval values) = some results ∧
+      (members.map Member.entry).mapM (evalExpr values) = some (results.map (·.entry row)) := by
+  induction indices generalizing selectorBase members with
+  | nil =>
+    cases emitted
+    exact ⟨[], rfl, rfl, rfl⟩
+  | cons index indices ih =>
+    simp only [emitMembers, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i member memberEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i tail tailEmitted
+    cases emitted
+    obtain ⟨result, memberRead, memberEval, entryEval⟩ := emitMember_reflects row rankEval memberEmitted
+      (reads member List.mem_cons_self)
+    obtain ⟨results, resultsRead, resultsEval, entriesEval⟩ := ih _ tailEmitted
+      (fun member present => reads member (List.mem_cons_of_mem _ present))
+    have function := (Member.eval_components memberEval).2.1
+    refine ⟨result :: results, ?_, ?_, ?_⟩
+    · simp only [AIR.emitMembers, memberRead, bind, Option.bind_some, ← function, resultsRead, pure]
+    · simp only [List.mapM_cons, memberEval, resultsEval, bind, Option.bind_some, pure]
+    · simp only [List.map_cons, List.mapM_cons, entryEval, entriesEval, bind, Option.bind_some, pure]
+
+theorem circuitEmission_eval {values : Values G} (row : Nat → G) (circuit : Bytecode.Circuit)
+    {members : List Member} {results : List AIR.MemberEmission}
+    (membersEval : members.mapM (Member.eval values) = some results)
+    (entriesEval : (members.map Member.entry).mapM (evalExpr values) = some (results.map (·.entry row)))
+    (reads : ∀ index < circuit.layout.inputSize + circuit.layout.selectors + 1 + 6,
+      (values.columns .main .current)[index]? = some (row index)) :
+    (circuitEmission circuit members).eval values = some (AIR.circuitEmission row circuit results) := by
+  have selectorEval := sum_eval entriesEval
+  have rankEval (index : Fin 6) : evalExpr values (rankBytes circuit.layout index) =
+      some (AIR.circuitRankBytes row circuit.layout index) :=
+    reads (circuit.layout.inputSize + circuit.layout.selectors + 1 + index.val) (by omega)
+  have multiplicityEval : evalExpr values (mainCurrent (circuit.layout.inputSize + circuit.layout.selectors)).expr =
+      some (row (circuit.layout.inputSize + circuit.layout.selectors)) :=
+    reads (circuit.layout.inputSize + circuit.layout.selectors) (by omega)
+  have functions : members.map Member.function = results.map AIR.MemberEmission.function := by
+    have relation := AIR.mapM_forall₂ membersEval (fun _ _ _ reflected => (Member.eval_components reflected).2.1)
+    clear membersEval entriesEval selectorEval
+    induction relation with
+    | nil => rfl
+    | cons equal _ ih => simp only [List.map_cons, equal, ih]
+  have equations : (members.flatMap (·.body.equations)).mapM (evalExpr values) =
+      some (results.flatMap (·.body.equations)) :=
+    list_mapM_flatMap membersEval (fun member => member.body.equations) (fun result => result.body.equations)
+      (evalExpr values) (fun _ _ reflected =>
+        (BlockEmitter.Emission.eval_components (Member.eval_components reflected).2.2.2).2.2.2.1)
+  have queries : (members.flatMap (·.body.queries)).mapM (QueryExpr.eval values) =
+      some (results.flatMap (·.body.queries)) :=
+    list_mapM_flatMap membersEval (fun member => member.body.queries) (fun result => result.body.queries)
+      (QueryExpr.eval values) (fun _ _ reflected =>
+        (BlockEmitter.Emission.eval_components (Member.eval_components reflected).2.2.2).2.2.2.2.1)
+  have returns : (members.flatMap (·.body.returns)).mapM (ReturnExpr.eval values) =
+      some (results.flatMap (·.body.returns)) :=
+    list_mapM_flatMap membersEval (fun member => member.body.returns) (fun result => result.body.returns)
+      (ReturnExpr.eval values) (fun _ _ reflected =>
+        (BlockEmitter.Emission.eval_components (Member.eval_components reflected).2.2.2).2.2.2.2.2.1)
+  have oneMinus := Expr.frontSub_eval goldilocksLaws values
+    (show evalExpr values (.konst 1) = some 1 from rfl) selectorEval
+  have exclusive := Expr.frontMul_eval goldilocksLaws values selectorEval oneMinus
+  have activity := Expr.frontMul_eval goldilocksLaws values multiplicityEval oneMinus
+  have selectors := selectorEquations_eval row circuit.layout
+    (fun index bound => reads (circuit.layout.inputSize + index) (by omega))
+  have rankQueries := queryParts_eval selectorEval (rangeSix_eval (rankBytes circuit.layout)
+    (AIR.circuitRankBytes row circuit.layout) rankEval) 1
+  apply Emission.eval_of
+  · exact membersEval
+  · exact selectorEval
+  · exact multiplicityEval
+  · exact rankEval
+  · rfl
+  · rfl
+  · rfl
+  · rfl
+  · simp only [circuitEmission, AIR.circuitEmission, functions]
+  · simp only [circuitEmission, AIR.circuitEmission, List.mapM_append]
+    split <;> simp only [List.mapM_cons, List.mapM_nil, equations, selectors, exclusive, activity,
+      bind, Option.bind_some, pure, goldilocks_mul, goldilocks_sub,
+      AIR.oneSubBooleanConstraint, AIR.activityConstraint]
+  · simp only [circuitEmission, AIR.circuitEmission, List.mapM_append, queries, rankQueries,
+      bind, Option.bind_some, pure]
+  · exact returns
+
+theorem emitCircuit_reflects {values : Values G} (row : Nat → G) (program : Bytecode.Toplevel)
+    (circuit : Bytecode.Circuit) {emission : Emission}
+    (emitted : emitCircuit program circuit = some emission)
+    (reads : ∀ index < emission.readBound, (values.columns .main .current)[index]? = some (row index)) :
+    ∃ result, circuit.emitRow row program = some result ∧ emission.eval values = some result := by
+  simp only [emitCircuit, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i members membersEmitted
+  cases emitted
+  have header := fold_max_start Member.readBound members
+    (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6)
+  have headerReads : ∀ index < circuit.layout.inputSize + circuit.layout.selectors + 1 + 6,
+      (values.columns .main .current)[index]? = some (row index) :=
+    fun index bound => reads index (Nat.lt_of_lt_of_le bound header)
+  have rankEval := packSix_eval values (rankBytes circuit.layout) (AIR.circuitRankBytes row circuit.layout)
+    (fun index => headerReads (circuit.layout.inputSize + circuit.layout.selectors + 1 + index.val) (by omega))
+  obtain ⟨results, resultsRead, resultsEval, entriesEval⟩ := emitMembers_reflects row
+    (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6) 4 circuit.layout.inputSize program circuit.members.toList
+    rankEval membersEmitted (fun member present index bound => reads index
+      (Nat.lt_of_lt_of_le bound (fold_max_member Member.readBound present _)))
+  refine ⟨_, ?_, circuitEmission_eval row circuit resultsEval entriesEval headerReads⟩
+  simp only [Bytecode.Circuit.emitRow, resultsRead, bind, Option.bind_some, pure]
+
+end Aiur.NativeAIR.CircuitEmitter
diff --git a/Ix/Aiur/Proofs/CircuitRowCounts.lean b/Ix/Aiur/Proofs/CircuitRowCounts.lean
new file mode 100644
index 000000000..6304c6e6e
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitRowCounts.lean
@@ -0,0 +1,133 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.RowCounts
+
+/-! A successful circuit count check discharges all branch and terminal
+count premises and the branchless single-return condition in row extraction.
+Native expression reflection and the remaining layout obligations are separate. -/
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Toplevel.validateRowCounts_circuit {program : Toplevel}
+    (validated : program.validateRowCounts = true) {circuit : Circuit}
+    (member : circuit ∈ program.circuits) : circuit.validateRowCounts program = true := by
+  rw [Toplevel.validateRowCounts, Array.all_eq_true'] at validated
+  exact validated circuit member
+
+private theorem mapM_of_members {α β γ : Type} (items : List α) (index : α → β) (value : α → γ)
+    (read : β → Option γ) (present : ∀ item ∈ items, read (index item) = some (value item)) :
+    (items.map index).mapM read = some (items.map value) := by
+  induction items with
+  | nil => rfl
+  | cons item rest ih =>
+    simp only [List.map_cons, List.mapM_cons, present item List.mem_cons_self,
+      ih (fun item member => present item (List.mem_cons_of_mem _ member))]
+    rfl
+
+theorem Circuit.validateRowCounts_spec (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (validated : circuit.validateRowCounts program = true) :
+    circuit.members.size < gSize.toNat ∧
+      (∀ part ∈ emission.members, part.function.body.controlCounts.nodes < gSize.toNat) ∧
+      (emission.members.map (fun part => part.function.body.controlCounts.leaves)).sum ≤ circuit.layout.selectors := by
+  obtain ⟨_, indices, source⟩ := circuit.emitRow_spec row program emitted
+  have present := mapM_of_members emission.members (·.functionIndex) (·.function)
+    (fun index => program.functions[index]?) (fun part member => (source part member).present)
+  rw [indices] at present
+  rw [Circuit.validateRowCounts, present] at validated
+  simpa only [Bool.and_eq_true, decide_eq_true_eq, List.all_map, List.all_eq_true,
+    List.map_map, Function.comp_def] using validated
+
+private theorem flatMap_length_le_sum {α β : Type} (items : List α) (parts : α → List β)
+    (bound : α → Nat) (bounded : ∀ item ∈ items, (parts item).length ≤ bound item) :
+    (items.flatMap parts).length ≤ (items.map bound).sum := by
+  induction items with
+  | nil => exact Nat.le_refl _
+  | cons first rest ih =>
+    have head := bounded first List.mem_cons_self
+    have tail := ih (fun item member => bounded item (List.mem_cons_of_mem _ member))
+    simp only [List.flatMap_cons, List.length_append, List.map_cons, List.sum_cons]
+    omega
+
+theorem Circuit.emitRow_count_bounds (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (validated : circuit.validateRowCounts program = true)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    circuit.members.size < gSize.toNat ∧
+      (∀ part ∈ emission.members, part.function.body.rowBounds (part.selector row)) ∧
+      (∀ part ∈ emission.members,
+        (part.function.body.selectorFlow (part.selector row)).returns.length < gSize.toNat) ∧
+      (emission.branchless = true → emission.returns.length ≤ 1) := by
+  obtain ⟨bounded, nodes, leaves⟩ := circuit.validateRowCounts_spec row program emitted validated
+  refine ⟨bounded, ?_, ?_, ?_⟩
+  · intro part member
+    exact part.function.body.rowBounds_of_controlCounts (part.selector row) (nodes part member)
+  · intro part member
+    exact part.function.body.return_bound_of_controlCounts (part.selector row) (nodes part member)
+  · intro branchless
+    obtain ⟨description, _, source⟩ := circuit.emitRow_spec row program emitted
+    have valid : ∀ equation ∈ (circuitEmission row circuit emission.members).equations, equation = 0 := by
+      rw [← description]
+      exact satisfied
+    have each : ∀ part ∈ emission.members, part.body.returns.length ≤ part.function.body.controlCounts.leaves := by
+      intro part member
+      have gates := congrArg List.length ((source part member).return_gates
+        (circuitEmission_member_satisfied valid member))
+      simp only [List.length_map] at gates
+      rw [gates]
+      exact part.function.body.returns_le_selectors (part.selector row)
+    have combined := flatMap_length_le_sum emission.members (·.body.returns)
+      (fun part => part.function.body.controlCounts.leaves) each
+    have returnsEq := congrArg CircuitEmission.returns description
+    rw [returnsEq]
+    rw [description] at branchless
+    change circuitBranchless circuit.layout.selectors (emission.members.map (·.function)) = true at branchless
+    unfold circuitBranchless at branchless
+    rw [Bool.and_eq_true] at branchless
+    have one := beq_iff_eq.mp branchless.1
+    change (emission.members.flatMap (·.body.returns)).length ≤ 1
+    omega
+
+theorem Circuit.emitRow_valid_checked {tables : LookupTables} {width : Nat} {emissions : List CircuitEmission}
+    (global : GlobalLookups tables width (circuitQueryPool emissions))
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (member : emission ∈ emissions)
+    (validated : circuit.validateRowCounts program = true)
+    (shape : ∀ part ∈ emission.members, part.function.body.lookupShapes program none = true)
+    (reserved : 4 ≤ circuit.layout.lookups)
+    (limits : ∀ part ∈ emission.members, part.body.lookup ≤ circuit.layout.lookups)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (nonzero : emission.multiplicity ≠ 0) :
+    ∃ selected ∈ emission.members, ∃ interpreted : FunctionRow,
+      interpreted.Valid program (memoryFacts tables.memory) ∧
+      interpreted.request.function = selected.functionIndex ∧
+      interpreted.request.inputs = rowValues (rowAdvice row 0 selected.function.layout.inputSize) ∧
+      interpreted.request.rank = packRank emission.rankBytes ∧
+      interpreted.rankBytes = emission.rankBytes ∧
+      interpreted.selector = emission.selector ∧ interpreted.multiplicity = emission.multiplicity ∧
+      (1, interpreted.request) ∈ emission.returns ∧
+      padMessage width (emission.lookup 0).2 = padMessage width (functionMessage interpreted.request) ∧
+      selected.body.CallsAt interpreted.calls ∧
+      (interpreted.requests.map functionMessage) ⊆ circuitQueryPool emissions ∧
+      (interpreted.byteQueries.map rangeMessage) ⊆ circuitQueryPool emissions := by
+  obtain ⟨bounded, bounds, returnBound, single⟩ := circuit.emitRow_count_bounds row program emitted validated satisfied
+  exact circuit.emitRow_valid global memoryValid canonical row program emitted member bounded bounds shape
+    returnBound reserved limits single satisfied nonzero
+
+end Aiur.Bytecode
+
+namespace Aiur.BoundVerifier
+
+theorem Backend.circuit_row_counts {selection : Selection} (backend : Backend selection)
+    {circuit : Bytecode.Circuit} (member : circuit ∈ backend.compiled.bytecode.circuits) :
+    circuit.validateRowCounts backend.compiled.bytecode = true :=
+  Bytecode.Toplevel.validateRowCounts_circuit backend.rowCounts member
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/CircuitRowExecution.lean b/Ix/Aiur/Proofs/CircuitRowExecution.lean
new file mode 100644
index 000000000..8bb78947b
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitRowExecution.lean
@@ -0,0 +1,54 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitPoolExecution
+
+/-!
+A nonzero provider row of the valued circuit model yields a valid
+function row from the same bytecode program. The interpreted inputs, rank
+bytes and multiplicity agree with the circuit, and its padded provider
+message names that same semantic call. All selected call and rank-byte
+queries belong to the computed circuit pool.
+
+Exact global lookup balance, memory validity, shape and count/layout bounds
+remain explicit. This is not yet extraction from native public verification.
+-/
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_valid {tables : LookupTables} {width : Nat} {emissions : List CircuitEmission}
+    (global : GlobalLookups tables width (circuitQueryPool emissions))
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (member : emission ∈ emissions)
+    (bounded : circuit.members.size < gSize.toNat)
+    (bounds : ∀ part ∈ emission.members, part.function.body.rowBounds (part.selector row))
+    (shape : ∀ part ∈ emission.members, part.function.body.lookupShapes program none = true)
+    (returnBound : ∀ part ∈ emission.members,
+      (part.function.body.selectorFlow (part.selector row)).returns.length < gSize.toNat)
+    (reserved : 4 ≤ circuit.layout.lookups)
+    (limits : ∀ part ∈ emission.members, part.body.lookup ≤ circuit.layout.lookups)
+    (single : emission.branchless = true → emission.returns.length ≤ 1)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (nonzero : emission.multiplicity ≠ 0) :
+    ∃ selected ∈ emission.members, ∃ interpreted : FunctionRow,
+      interpreted.Valid program (memoryFacts tables.memory) ∧
+      interpreted.request.function = selected.functionIndex ∧
+      interpreted.request.inputs = rowValues (rowAdvice row 0 selected.function.layout.inputSize) ∧
+      interpreted.request.rank = packRank emission.rankBytes ∧
+      interpreted.rankBytes = emission.rankBytes ∧
+      interpreted.selector = emission.selector ∧ interpreted.multiplicity = emission.multiplicity ∧
+      (1, interpreted.request) ∈ emission.returns ∧
+      padMessage width (emission.lookup 0).2 = padMessage width (functionMessage interpreted.request) ∧
+      selected.body.CallsAt interpreted.calls ∧
+      (interpreted.requests.map functionMessage) ⊆ circuitQueryPool emissions ∧
+      (interpreted.byteQueries.map rangeMessage) ⊆ circuitQueryPool emissions := by
+  exact circuit.emitRow_valid_in_pool global memoryValid canonical row program emitted member
+    (List.Subset.refl _) bounded bounds shape returnBound reserved limits single satisfied nonzero
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/CircuitRowMembers.lean b/Ix/Aiur/Proofs/CircuitRowMembers.lean
new file mode 100644
index 000000000..57f34166b
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitRowMembers.lean
@@ -0,0 +1,203 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRows
+
+/-!
+Successful circuit emission retains the actual program functions and
+member selector offsets. Satisfying header and body equations make the
+circuit selector boolean. Nonzero provider multiplicity selects an active
+member under the explicit member-count bound.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+structure MemberEmission.FromProgram (row : Nat → G) (rank : G) (column lookup : Nat)
+    (program : Toplevel) (member : MemberEmission) : Prop where
+  present : program.functions[member.functionIndex]? = some member.function
+  emitted : member.function.emitRow row (member.selector row) member.functionIndex rank
+    (rowAdvice row 0 member.function.layout.inputSize) column lookup = some member.body
+
+theorem emitMember_spec (row : Nat → G) (rank : G) (column lookup selectorBase : Nat)
+    (program : Toplevel) (functionIndex : FunIdx) {member : MemberEmission}
+    (emitted : emitMember row rank column lookup selectorBase program functionIndex = some member) :
+    member.functionIndex = functionIndex ∧ member.selectorBase = selectorBase ∧
+      member.FromProgram row rank column lookup program := by
+  simp only [emitMember, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i function present
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i body bodyEmitted
+      have equal := Option.some.inj emitted
+      subst member
+      exact ⟨rfl, rfl, present, bodyEmitted⟩
+
+theorem emitMembers_spec (row : Nat → G) (rank : G) (column lookup selectorBase : Nat)
+    (program : Toplevel) (indices : List FunIdx) {members : List MemberEmission}
+    (emitted : emitMembers row rank column lookup selectorBase program indices = some members) :
+    members.map MemberEmission.functionIndex = indices ∧
+      ∀ member ∈ members, member.FromProgram row rank column lookup program := by
+  induction indices generalizing selectorBase members with
+  | nil =>
+    have equal := Option.some.inj emitted
+    subst members
+    exact ⟨rfl, by simp⟩
+  | cons index indices ih =>
+    simp only [emitMembers, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i member memberEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i rest restEmitted
+        have equal := Option.some.inj emitted
+        subst members
+        obtain ⟨indexEq, _, first⟩ := emitMember_spec row rank column lookup selectorBase program index memberEmitted
+        obtain ⟨indicesEq, remaining⟩ := ih _ restEmitted
+        refine ⟨by rw [List.map_cons, indexEq, indicesEq], ?_⟩
+        intro item present
+        rcases List.mem_cons.mp present with equal | tail
+        · subst item
+          exact first
+        · exact remaining item tail
+
+theorem MemberEmission.FromProgram.selector_satisfied {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {member : MemberEmission} (source : member.FromProgram row rank column lookup program)
+    (satisfied : ∀ equation ∈ member.body.equations, equation = 0) :
+    (member.function.body.selectorFlow (member.selector row)).Satisfied := by
+  have emitted := source.emitted
+  rw [Bytecode.Function.emitRow] at emitted
+  exact member.function.body.emitRow_selectors row (member.selector row) _ _ _ _ _ emitted satisfied
+
+theorem circuitEmission_member_satisfied {row : Nat → G} {circuit : Circuit} {members : List MemberEmission}
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0)
+    {member : MemberEmission} (present : member ∈ members) :
+    ∀ equation ∈ member.body.equations, equation = 0 := by
+  intro equation member
+  apply satisfied equation
+  exact List.mem_append_left _ (List.mem_append_left _ (List.mem_append_left _
+    (List.mem_flatMap.mpr ⟨_, present, member⟩)))
+
+theorem circuitEmission_activity {row : Nat → G} {circuit : Circuit} {members : List MemberEmission}
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0) :
+    activityConstraint (circuitEmission row circuit members).multiplicity
+      (circuitEmission row circuit members).selector = 0 :=
+  satisfied _ (List.mem_append_right _ List.mem_cons_self)
+
+theorem circuitEmission_member_boolean {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {circuit : Circuit} {members : List MemberEmission}
+    (source : ∀ member ∈ members, member.FromProgram row rank column lookup program)
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0) :
+    ∀ member ∈ members, booleanConstraint (member.entry row) = 0 := by
+  intro member present
+  exact member.function.body.selectorFlow_boolean (member.selector row)
+    ((source member present).selector_satisfied (circuitEmission_member_satisfied satisfied present))
+
+theorem circuitEmission_boolean {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {circuit : Circuit} {members : List MemberEmission}
+    (source : ∀ member ∈ members, member.FromProgram row rank column lookup program)
+    (count : members.length = circuit.members.size)
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0) :
+    booleanConstraint (circuitEmission row circuit members).selector = 0 := by
+  by_cases grouped : 1 < circuit.members.size
+  · have constraint : oneSubBooleanConstraint (circuitEmission row circuit members).selector = 0 := by
+      apply satisfied _
+      apply List.mem_append_left
+      apply List.mem_append_right
+      simp only [if_pos grouped]
+      exact List.mem_cons_self
+    rcases G.boolean_of_one_sub_constraint constraint with inactive | active
+    · rw [inactive]; rfl
+    · rw [active]; rfl
+  · have bounded : members.length ≤ 1 := by omega
+    cases members with
+    | nil =>
+      change booleanConstraint 0 = 0
+      rw [booleanConstraint, G.mul_comm, G.mul_zero]
+    | cons member rest =>
+      have empty : rest = [] := List.length_eq_zero_iff.mp (by simp only [List.length_cons] at bounded; omega)
+      subst rest
+      have boolean := circuitEmission_member_boolean source satisfied member List.mem_cons_self
+      change booleanConstraint (selectorSum [member.entry row]) = 0
+      rw [selectorSum_cons]
+      change booleanConstraint (member.entry row + 0) = 0
+      rw [G.add_zero]
+      exact boolean
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_spec (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission) :
+    emission = circuitEmission row circuit emission.members ∧
+      emission.members.map MemberEmission.functionIndex = circuit.members.toList ∧
+      ∀ member ∈ emission.members,
+        member.FromProgram row (packRank (circuitRankBytes row circuit.layout))
+          (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6) 4 program := by
+  simp only [Circuit.emitRow, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i members membersEmitted
+    have equal := Option.some.inj emitted
+    subst emission
+    obtain ⟨indices, source⟩ := emitMembers_spec row _ _ _ _ program _ membersEmitted
+    exact ⟨rfl, indices, source⟩
+
+theorem Circuit.emitRow_boolean (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    booleanConstraint emission.selector = 0 := by
+  obtain ⟨description, indices, source⟩ := circuit.emitRow_spec row program emitted
+  have count := congrArg List.length indices
+  simp only [List.length_map, Array.length_toList] at count
+  have valid : ∀ equation ∈ (circuitEmission row circuit emission.members).equations, equation = 0 := by
+    rw [← description]
+    exact satisfied
+  have boolean := circuitEmission_boolean source count valid
+  rw [← description] at boolean
+  exact boolean
+
+theorem Circuit.emitRow_active_member (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (bounded : circuit.members.size < gSize.toNat) (nonzero : emission.multiplicity ≠ 0) :
+    ∃ member ∈ emission.members, member.entry row = 1 ∧
+      member.FromProgram row (packRank emission.rankBytes)
+        (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6) 4 program := by
+  obtain ⟨description, indices, source⟩ := circuit.emitRow_spec row program emitted
+  have length := congrArg List.length indices
+  simp only [List.length_map, Array.length_toList] at length
+  have valid : ∀ equation ∈ (circuitEmission row circuit emission.members).equations, equation = 0 := by
+    rw [← description]
+    exact satisfied
+  have activity := circuitEmission_activity valid
+  rw [← description] at activity
+  have active := nonzero_multiplicity_selector_one activity nonzero
+  have individual := circuitEmission_member_boolean source valid
+  have selectorEq := congrArg CircuitEmission.selector description
+  have count := selectorSum_active_count
+    (selectors := emission.members.map (fun member : MemberEmission => member.entry row))
+    (fun gate member => by
+      obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+      subst gate
+      exact individual part partMember)
+    (by simpa only [List.length_map, length] using bounded)
+    (show selectorSum (emission.members.map (fun member => member.entry row)) = 1 from selectorEq.symm.trans active)
+  have existsOne : (1 : G) ∈ emission.members.map (·.entry row) :=
+    List.count_pos_iff.mp (Nat.lt_of_lt_of_eq (by decide : 0 < 1) count.symm)
+  obtain ⟨member, present, selected⟩ := List.mem_map.mp existsOne
+  refine ⟨member, present, selected, ?_⟩
+  have rankEq := congrArg CircuitEmission.rankBytes description
+  rw [rankEq]
+  exact source member present
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/CircuitRowQueries.lean b/Ix/Aiur/Proofs/CircuitRowQueries.lean
new file mode 100644
index 000000000..98b733860
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitRowQueries.lean
@@ -0,0 +1,160 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRowMembers
+
+/-!
+Shared-slot extraction across circuit members and the three reserved
+rank-byte lookup slots. Validated body bounds and lookup cursor limits give
+one active query per physical slot and a computed circuit query pool.
+Native layout enforcement and verifier-to-valued-model reflection remain
+separate.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem QuerySlots.extend {gate : G} {start finish limit : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (bound : finish ≤ limit) :
+    QuerySlots gate start limit queries :=
+  ⟨Nat.le_trans slots.extent bound,
+    fun query member => ⟨(slots.range query member).1, Nat.lt_of_lt_of_le (slots.range query member).2 bound⟩,
+    slots.boolean, slots.count⟩
+
+theorem QuerySlots.permuted {gate : G} {start finish : Nat} {queries other : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (permutation : queries.Perm other) :
+    QuerySlots gate start finish other := by
+  refine ⟨slots.extent, ?_, ?_, ?_⟩
+  · exact fun query member => slots.range query (permutation.mem_iff.mpr member)
+  · exact fun query member => slots.boolean query (permutation.mem_iff.mpr member)
+  · intro slot
+    have counts : queryCount queries slot = queryCount other slot := (permutation.filter _).length_eq
+    rw [← counts]
+    exact slots.count slot
+
+theorem fold_lookup_upper (emissions : List BlockEmission) (start limit : Nat)
+    (initial : start ≤ limit) (bounded : ∀ emission ∈ emissions, emission.lookup ≤ limit) :
+    emissions.foldl (fun current emission => max current emission.lookup) start ≤ limit := by
+  induction emissions generalizing start with
+  | nil => exact initial
+  | cons emission rest ih =>
+    apply ih
+    · exact Nat.max_le.mpr ⟨initial, bounded emission List.mem_cons_self⟩
+    · exact fun item member => bounded item (List.mem_cons_of_mem _ member)
+
+theorem forall₂_self_map {α β : Type} (items : List α) (map : α → β) (relation : α → β → Prop)
+    (related : ∀ item ∈ items, relation item (map item)) : List.Forall₂ relation items (items.map map) := by
+  induction items with
+  | nil => exact .nil
+  | cons item rest ih =>
+    exact .cons (related item List.mem_cons_self) (ih (fun item member => related item (List.mem_cons_of_mem _ member)))
+
+theorem MemberEmission.FromProgram.querySlots {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {member : MemberEmission} (source : member.FromProgram row rank column lookup program)
+    (bounds : member.function.body.rowBounds (member.selector row))
+    (satisfied : ∀ equation ∈ member.body.equations, equation = 0) :
+    QuerySlots (member.entry row) lookup member.body.lookup member.body.queries := by
+  have emitted := source.emitted
+  rw [Bytecode.Function.emitRow] at emitted
+  exact member.function.body.emitRow_equation_querySlots row (member.selector row) _ _ _ _ _ bounds emitted rfl satisfied
+
+theorem circuitEmission_querySlots {row : Nat → G} {rank : G} {column : Nat}
+    {program : Toplevel} {circuit : Circuit} {members : List MemberEmission}
+    (source : ∀ member ∈ members, member.FromProgram row rank column 4 program)
+    (count : members.length = circuit.members.size)
+    (bounded : circuit.members.size < gSize.toNat)
+    (bounds : ∀ member ∈ members, member.function.body.rowBounds (member.selector row))
+    (reserved : 4 ≤ circuit.layout.lookups)
+    (limits : ∀ member ∈ members, member.body.lookup ≤ circuit.layout.lookups)
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0) :
+    QuerySlots (circuitEmission row circuit members).selector 1 circuit.layout.lookups
+      (circuitEmission row circuit members).queries := by
+  have boolean := circuitEmission_boolean source count satisfied
+  have individual := circuitEmission_member_boolean source satisfied
+  have slots : ∀ member ∈ members, QuerySlots (member.entry row) 4 member.body.lookup member.body.queries :=
+    fun member present => (source member present).querySlots (bounds member present)
+      (circuitEmission_member_satisfied satisfied present)
+  have related := forall₂_self_map members MemberEmission.body
+    (fun member body => QuerySlots (member.entry row) 4 body.lookup body.queries) slots
+  have selectorCount := selector_gateCount
+    (gates := members.map (fun member : MemberEmission => member.entry row))
+    (fun gate member => by
+      obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+      subst gate
+      exact individual part partMember)
+    (by simpa only [List.length_map, count] using bounded) boolean
+  have joined := QuerySlots.join (fun member : MemberEmission => member.entry row)
+    (circuitEmission row circuit members).selector #[] 0 4 related (Nat.le_of_eq selectorCount)
+  have upper : (joinBlockEmissions #[] 0 4 (members.map MemberEmission.body)).lookup ≤ circuit.layout.lookups := by
+    apply fold_lookup_upper _ _ _ reserved
+    intro body member
+    obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+    subst body
+    exact limits part partMember
+  have bodies := joined.extend upper
+  have rankSlots : QuerySlots (circuitEmission row circuit members).selector 1 4
+      (queryParts 1 (circuitEmission row circuit members).selector
+        ((rankByteQueries (circuitRankBytes row circuit.layout)).map rangeMessage)) :=
+    QuerySlots.indexed _ 1 ((rankByteQueries (circuitRankBytes row circuit.layout)).map rangeMessage) boolean
+  have combined := (rankSlots.append bodies).permuted List.perm_append_comm
+  simpa only [joinBlockEmissions, List.flatMap_map, Function.comp_def, circuitEmission] using combined
+
+def CircuitEmission.QueriesIn (emission : CircuitEmission) (queries : List (List G)) : Prop :=
+  ∀ part ∈ emission.queries, part.selector = 1 → part.message ∈ queries
+
+def circuitQueryPool (emissions : List CircuitEmission) : List (List G) :=
+  emissions.flatMap fun emission => decodedQueries emission.queries emission.lookupCount
+
+theorem QuerySlots.circuit_pool {emission : CircuitEmission}
+    (slots : QuerySlots emission.selector 1 emission.lookupCount emission.queries)
+    {emissions : List CircuitEmission} (member : emission ∈ emissions) :
+    emission.QueriesIn (circuitQueryPool emissions) := by
+  intro query present active
+  exact List.mem_flatMap.mpr ⟨emission, member, slots.decoded_member present active⟩
+
+theorem circuitEmission_member_queried {row : Nat → G} {circuit : Circuit} {members : List MemberEmission}
+    {queries : List (List G)} (queried : (circuitEmission row circuit members).QueriesIn queries)
+    {member : MemberEmission} (present : member ∈ members) : member.body.QueriesIn queries := by
+  intro query member active
+  exact queried query (List.mem_append_left _ (List.mem_flatMap.mpr ⟨_, present, member⟩)) active
+
+theorem circuitEmission_rank_queried {row : Nat → G} {circuit : Circuit} {members : List MemberEmission}
+    {queries : List (List G)} (queried : (circuitEmission row circuit members).QueriesIn queries)
+    (active : (circuitEmission row circuit members).selector = 1) :
+    (rankByteQueries (circuitEmission row circuit members).rankBytes).map rangeMessage ⊆ queries := by
+  intro message member
+  obtain ⟨part, partMember, selectorEq, messageEq⟩ :=
+    queryParts_member 1 (circuitEmission row circuit members).selector member
+  have result := queried part (List.mem_append_right _ partMember) (selectorEq.trans active)
+  rw [messageEq] at result
+  exact result
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_querySlots (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (bounded : circuit.members.size < gSize.toNat)
+    (bounds : ∀ member ∈ emission.members, member.function.body.rowBounds (member.selector row))
+    (reserved : 4 ≤ circuit.layout.lookups)
+    (limits : ∀ member ∈ emission.members, member.body.lookup ≤ circuit.layout.lookups)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) :
+    QuerySlots emission.selector 1 emission.lookupCount emission.queries := by
+  obtain ⟨description, indices, source⟩ := circuit.emitRow_spec row program emitted
+  have count := congrArg List.length indices
+  simp only [List.length_map, Array.length_toList] at count
+  have valid : ∀ equation ∈ (circuitEmission row circuit emission.members).equations, equation = 0 := by
+    rw [← description]
+    exact satisfied
+  have slots := circuitEmission_querySlots source count bounded bounds reserved limits valid
+  have lookupEq := congrArg CircuitEmission.lookupCount description
+  change emission.lookupCount = circuit.layout.lookups at lookupEq
+  rw [← lookupEq] at slots
+  rw [← description] at slots
+  exact slots
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/CircuitRowReturns.lean b/Ix/Aiur/Proofs/CircuitRowReturns.lean
new file mode 100644
index 000000000..77ed1e5df
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitRowReturns.lean
@@ -0,0 +1,117 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRowQueries
+
+/-!
+The combined circuit return slot encodes the selected semantic return.
+Per-function selector conservation and return-count bounds compose across
+grouped members without an extra bound on the total inactive return count.
+The single-writer premise for the ungated branchless optimization is explicit.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem MemberEmission.FromProgram.return_gates {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {member : MemberEmission} (source : member.FromProgram row rank column lookup program)
+    (satisfied : ∀ equation ∈ member.body.equations, equation = 0) :
+    member.body.returns.map Prod.fst = (member.function.body.selectorFlow (member.selector row)).returns := by
+  have emitted := source.emitted
+  rw [Bytecode.Function.emitRow] at emitted
+  have projected := member.function.body.emitRow_projection row (member.selector row) _ _ _ _ _ emitted
+  exact projected.returned.trans (member.function.body.returnGates_reflects (member.selector row) _
+    (source.selector_satisfied satisfied) rfl)
+
+theorem MemberEmission.FromProgram.return_boolean {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {member : MemberEmission} (source : member.FromProgram row rank column lookup program)
+    (satisfied : ∀ equation ∈ member.body.equations, equation = 0) :
+    ∀ part ∈ member.body.returns, booleanConstraint part.1 = 0 := by
+  intro part present
+  have sound := member.function.body.selectorFlow_sound (member.selector row) (source.selector_satisfied satisfied)
+  apply sound.returned part.1
+  rw [← source.return_gates satisfied]
+  exact List.mem_map.mpr ⟨part, present, rfl⟩
+
+theorem MemberEmission.FromProgram.return_count {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {member : MemberEmission} (source : member.FromProgram row rank column lookup program)
+    (shape : member.function.body.lookupShapes program none = true)
+    (bounded : (member.function.body.selectorFlow (member.selector row)).returns.length < gSize.toNat)
+    (satisfied : ∀ equation ∈ member.body.equations, equation = 0) :
+    (member.body.returns.map Prod.fst).count 1 = gateCount (member.entry row) := by
+  have valid := source.selector_satisfied satisfied
+  have sound := member.function.body.selectorFlow_sound (member.selector row) valid
+  have empty := member.function.body.selectorFlow_yields_empty (member.selector row) program shape
+  have conservation := sound.conservation
+  rw [empty] at conservation
+  change _ = selectorSum (member.function.body.selectorFlow (member.selector row)).returns + 0 at conservation
+  rw [G.add_zero] at conservation
+  rw [source.return_gates satisfied, MemberEmission.entry, conservation]
+  apply selector_gateCount sound.returned bounded
+  rw [← conservation]
+  exact member.function.body.selectorFlow_boolean (member.selector row) valid
+
+theorem flatMap_return_count {α β : Type} (items : List α) (gate : α → G) (parts : α → List (G × β))
+    (count : ∀ item ∈ items, ((parts item).map Prod.fst).count 1 = gateCount (gate item)) :
+    ((items.flatMap parts).map Prod.fst).count 1 = (items.map gate).count 1 := by
+  have summed : ((items.flatMap parts).map Prod.fst).count 1 = ((items.map gate).map gateCount).sum := by
+    induction items with
+    | nil => rfl
+    | cons item rest ih =>
+      rw [List.flatMap_cons, List.map_append, List.count_append, count item List.mem_cons_self,
+        ih (fun item member => count item (List.mem_cons_of_mem _ member))]
+      rfl
+  exact summed.trans (gateCount_list _)
+
+theorem circuitEmission_return_count {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {circuit : Circuit} {members : List MemberEmission}
+    (source : ∀ member ∈ members, member.FromProgram row rank column lookup program)
+    (shape : ∀ member ∈ members, member.function.body.lookupShapes program none = true)
+    (bounded : members.length < gSize.toNat)
+    (returnBound : ∀ member ∈ members,
+      (member.function.body.selectorFlow (member.selector row)).returns.length < gSize.toNat)
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0)
+    (active : (circuitEmission row circuit members).selector = 1) :
+    ((circuitEmission row circuit members).returns.map Prod.fst).count 1 = 1 := by
+  have each := fun member present => (source member present).return_count (shape member present)
+    (returnBound member present) (circuitEmission_member_satisfied satisfied present)
+  change ((members.flatMap (·.body.returns)).map Prod.fst).count 1 = 1
+  rw [flatMap_return_count members (fun member => member.entry row) (fun member => member.body.returns) each]
+  have individual := circuitEmission_member_boolean source satisfied
+  apply selectorSum_active_count
+  · intro gate member
+    obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+    subst gate
+    exact individual part partMember
+  · simpa only [List.length_map] using bounded
+  · exact active
+
+theorem circuitEmission_return_message {row : Nat → G} {rank : G} {column lookup : Nat}
+    {program : Toplevel} {circuit : Circuit} {members : List MemberEmission}
+    (source : ∀ member ∈ members, member.FromProgram row rank column lookup program)
+    (shape : ∀ member ∈ members, member.function.body.lookupShapes program none = true)
+    (bounded : members.length < gSize.toNat)
+    (returnBound : ∀ member ∈ members,
+      (member.function.body.selectorFlow (member.selector row)).returns.length < gSize.toNat)
+    (satisfied : ∀ equation ∈ (circuitEmission row circuit members).equations, equation = 0)
+    (active : (circuitEmission row circuit members).selector = 1)
+    (width : Nat)
+    (single : (circuitEmission row circuit members).branchless = true →
+      (circuitEmission row circuit members).returns.length ≤ 1)
+    {request : Bytecode.AIR.Call} (present : (1, request) ∈ (circuitEmission row circuit members).returns) :
+    padMessage width ((circuitEmission row circuit members).lookup 0).2 = padMessage width (functionMessage request) := by
+  have count := circuitEmission_return_count source shape bounded returnBound satisfied active
+  apply slotMessage_chosen_count width (circuitEmission row circuit members).branchless
+    (by simpa only [List.length_map] using single)
+    (fun part member => ?_)
+    (by simpa only [List.map_map, Function.comp_def] using count)
+    (List.mem_map.mpr ⟨(1, request), present, rfl⟩) rfl
+  obtain ⟨returned, returnMember, equal⟩ := List.mem_map.mp member
+  subst part
+  obtain ⟨body, bodyMember, returnedMember⟩ := List.mem_flatMap.mp returnMember
+  exact (source body bodyMember).return_boolean (circuitEmission_member_satisfied satisfied bodyMember)
+    returned returnedMember
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/CircuitRows.lean b/Ix/Aiur/Proofs/CircuitRows.lean
new file mode 100644
index 000000000..3968f591b
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitRows.lean
@@ -0,0 +1,102 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockQueryPool
+import Ix.Aiur.Branchless
+
+/-!
+A valued model of the complete native function-circuit builder. Grouped
+members share auxiliary columns, rank bytes, multiplicity and lookup slots,
+while their selector columns occupy consecutive regions. The model retains
+the native header equations and provider-message combination on arbitrary
+assignments. Native expression/codec reflection and layout validity remain
+separate obligations.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+structure MemberEmission where
+  functionIndex : FunIdx
+  function : Function
+  selectorBase : Nat
+  body : BlockEmission
+
+def MemberEmission.selector (row : Nat → G) (member : MemberEmission) : SelIdx → G :=
+  fun index => row (member.selectorBase + index)
+
+def MemberEmission.entry (row : Nat → G) (member : MemberEmission) : G :=
+  (member.function.body.selectorFlow (member.selector row)).entry
+
+def emitMember (row : Nat → G) (rank : G) (column lookup selectorBase : Nat)
+    (program : Toplevel) (functionIndex : FunIdx) : Option MemberEmission := do
+  let function ← program.functions[functionIndex]?
+  let body ← function.emitRow row (fun index => row (selectorBase + index)) functionIndex rank
+    (rowAdvice row 0 function.layout.inputSize) column lookup
+  return ⟨functionIndex, function, selectorBase, body⟩
+
+def emitMembers (row : Nat → G) (rank : G) (column lookup selectorBase : Nat)
+    (program : Toplevel) : List FunIdx → Option (List MemberEmission)
+  | [] => some []
+  | index :: indices => do
+    let member ← emitMember row rank column lookup selectorBase program index
+    let rest ← emitMembers row rank column lookup (selectorBase + member.function.layout.selectors) program indices
+    return member :: rest
+
+structure CircuitEmission where
+  members : List MemberEmission
+  selector : G
+  multiplicity : G
+  rankBytes : Fin 6 → G
+  width : Nat
+  selectorStart : Nat
+  selectorCount : Nat
+  lookupCount : Nat
+  branchless : Bool
+  equations : List G
+  queries : List QueryPart
+  returns : List (G × Bytecode.AIR.Call)
+
+def circuitRankBytes (row : Nat → G) (layout : Bytecode.FunctionLayout) : Fin 6 → G :=
+  fun index => row (layout.inputSize + layout.selectors + 1 + index.val)
+
+def circuitEmission (row : Nat → G) (circuit : Circuit) (members : List MemberEmission) : CircuitEmission :=
+  let selector := selectorSum (members.map (·.entry row))
+  let multiplicity := row (circuit.layout.inputSize + circuit.layout.selectors)
+  let rankBytes := circuitRankBytes row circuit.layout
+  { members, selector, multiplicity, rankBytes
+    width := circuit.layout.width
+    selectorStart := circuit.layout.inputSize
+    selectorCount := circuit.layout.selectors
+    lookupCount := circuit.layout.lookups
+    branchless := circuitBranchless circuit.layout.selectors (members.map (·.function))
+    equations := members.flatMap (·.body.equations) ++
+      (List.range circuit.layout.selectors).map (fun index => booleanConstraint (row (circuit.layout.inputSize + index))) ++
+      (if 1 < circuit.members.size then [oneSubBooleanConstraint selector] else []) ++
+      [activityConstraint multiplicity selector]
+    queries := members.flatMap (·.body.queries) ++
+      queryParts 1 selector ((rankByteQueries rankBytes).map rangeMessage)
+    returns := members.flatMap (·.body.returns) }
+
+def CircuitEmission.lookup (emission : CircuitEmission) (slot : Nat) : G × List G :=
+  if slot = 0 then
+    (0 - emission.multiplicity,
+      slotMessage emission.branchless (emission.returns.map fun part => (part.1, functionMessage part.2)))
+  else
+    (querySlotMultiplicity emission.queries slot,
+      slotMessage emission.branchless (querySlotParts emission.queries slot))
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+def Circuit.emitRow (row : Nat → G) (program : Toplevel) (circuit : Circuit) : Option CircuitEmission := do
+  let rank := packRank (circuitRankBytes row circuit.layout)
+  let column := circuit.layout.inputSize + circuit.layout.selectors + 1 + 6
+  let members ← emitMembers row rank column 4 circuit.layout.inputSize program circuit.members.toList
+  return circuitEmission row circuit members
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/CircuitTableData.lean b/Ix/Aiur/Proofs/CircuitTableData.lean
new file mode 100644
index 000000000..6fd625f9c
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitTableData.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ProviderEquivalence
+
+/-! Physical circuit providers, auxiliary tables and witness assignments.
+Provider-only function rows initialize lookup extraction; their local validity
+is not assumed. Zero-weight rows can be represented by a valid inactive row. -/
+
+namespace Aiur.AIR
+open Bytecode
+
+/-- Memory and fixed byte tables before any function-row interpretation. -/
+structure AuxiliaryTables where
+  memoryWidths : List Nat
+  memory : Nat → Array MemoryRow
+  byte1 : Byte1Kind → Fin 256 → G
+  byte2 : Byte2Kind → Fin 65536 → G
+
+def AuxiliaryTables.withFunctions (tables : AuxiliaryTables) (functions : List FunctionRow) : LookupTables :=
+  ⟨functions, tables.memoryWidths, tables.memory, tables.byte1, tables.byte2⟩
+
+def AuxiliaryTables.providers (tables : AuxiliaryTables) : List (Provider (List G)) :=
+  tables.memoryWidths.flatMap (fun width =>
+    mapProviders (fun request => memoryMessage width request.1 request.2)
+      (memoryProviders (tables.memory width))) ++
+    byte1Providers tables.byte1 ++ byte2Providers tables.byte2
+
+def circuitProviders (emissions : List CircuitEmission) : List (Provider (List G)) :=
+  emissions.map CircuitEmission.provider
+
+def AuxiliaryTables.circuitProviders (tables : AuxiliaryTables) (emissions : List CircuitEmission) :
+    List (Provider (List G)) := Aiur.AIR.circuitProviders emissions ++ tables.providers
+
+theorem AuxiliaryTables.withFunctions_providers (tables : AuxiliaryTables) (functions : List FunctionRow) :
+    (tables.withFunctions functions).providers =
+      mapProviders functionMessage (functionProviders functions) ++ tables.providers := by
+  simp only [withFunctions, LookupTables.providers, providers, List.append_assoc]
+
+def FunctionRow.Provides (width : Nat) (emission : CircuitEmission) (row : FunctionRow) : Prop :=
+  Provider.PaddedEq width emission.provider (functionMessage row.request, row.multiplicity)
+
+theorem AuxiliaryTables.providers_related (tables : AuxiliaryTables) {width : Nat}
+    {emissions : List CircuitEmission} {functions : List FunctionRow}
+    (related : List.Forall₂ (FunctionRow.Provides width) emissions functions) :
+    List.Forall₂ (Provider.PaddedEq width) (tables.circuitProviders emissions)
+      (tables.withFunctions functions).providers := by
+  rw [tables.withFunctions_providers]
+  apply forall₂_append
+  · induction related with
+    | nil => exact .nil
+    | cons first rest ih => exact .cons first ih
+  · exact paddedProviders_refl width tables.providers
+
+theorem AuxiliaryTables.global_of_circuit_balance (tables : AuxiliaryTables)
+    {width : Nat} {queries : List (List G)} {emissions : List CircuitEmission}
+    {functions : List FunctionRow}
+    (balanced : PaddedLookupBalance width queries (tables.circuitProviders emissions))
+    (bounded : queries.length < gSize.toNat)
+    (widths : ∀ query ∈ queries, query.length ≤ width)
+    (related : List.Forall₂ (FunctionRow.Provides width) emissions functions) :
+    GlobalLookups (tables.withFunctions functions) width queries :=
+  ⟨balanced.congr_providers (tables.providers_related related), bounded, widths⟩
+
+def FunctionRow.inactive : FunctionRow :=
+  ⟨⟨0, #[], #[], 0⟩, [], fun _ => 0, 0, 0⟩
+
+theorem FunctionRow.inactive_valid (program : Toplevel) (memory : Bytecode.AIR.Memory) :
+    inactive.Valid program memory := by
+  have notActive : inactive.selector ≠ 1 := by
+    intro equal
+    have bad := congrArg G.n equal
+    change 0 = 1 at bad
+    omega
+  refine ⟨Or.inl rfl, ?_, fun active => False.elim (notActive active),
+    fun active => False.elim (notActive active), ?_⟩
+  · change (0 : G) * (1 - 0) = 0
+    rw [G.mul_comm, G.mul_zero]
+  · intro edge member
+    cases member
+
+theorem FunctionRow.inactive_provides (width : Nat) {emission : CircuitEmission}
+    (zero : emission.multiplicity = 0) : Provides width emission inactive :=
+  ⟨zero, fun nonzero => False.elim (nonzero zero)⟩
+
+theorem forall₂_exists_right {α β : Type} (source : List α) (relation : α → β → Prop)
+    (available : ∀ item ∈ source, ∃ value, relation item value) :
+    ∃ target, List.Forall₂ relation source target := by
+  induction source with
+  | nil => exact ⟨[], .nil⟩
+  | cons first rest ih =>
+    obtain ⟨value, firstRelated⟩ := available first List.mem_cons_self
+    obtain ⟨values, restRelated⟩ := ih (fun item member => available item (List.mem_cons_of_mem _ member))
+    exact ⟨value :: values, .cons firstRelated restRelated⟩
+
+/-- One valued row, retaining the selected circuit and the assignment used
+by its emitter. Membership, successful emission and satisfaction are proved
+separately when extracting a trace. -/
+structure CircuitWitness where
+  circuit : Circuit
+  values : Nat → G
+  emission : CircuitEmission
+
+def CircuitWitness.Emitted (program : Toplevel) (witness : CircuitWitness) : Prop :=
+  witness.circuit.emitRow witness.values program = some witness.emission
+
+def CircuitWitness.Satisfied (witness : CircuitWitness) : Prop :=
+  ∀ equation ∈ witness.emission.equations, equation = 0
+
+def CircuitWitness.Shapes (program : Toplevel) (witness : CircuitWitness) : Prop :=
+  ∀ part ∈ witness.emission.members, part.function.body.lookupShapes program none = true
+
+def CircuitWitness.LookupBounds (witness : CircuitWitness) : Prop :=
+  4 ≤ witness.circuit.layout.lookups ∧
+    ∀ part ∈ witness.emission.members, part.body.lookup ≤ witness.circuit.layout.lookups
+
+theorem CircuitWitness.provider_row {program : Toplevel} (witness : CircuitWitness)
+    (emitted : witness.Emitted program) (satisfied : witness.Satisfied)
+    (validated : witness.circuit.validateRowCounts program = true) (shape : witness.Shapes program)
+    (width : Nat) : ∃ row : FunctionRow, row.Provides width witness.emission := by
+  by_cases zero : witness.emission.multiplicity = 0
+  · exact ⟨FunctionRow.inactive, FunctionRow.inactive_provides width zero⟩
+  · obtain ⟨request, _, message⟩ := witness.circuit.emitRow_provider witness.values program
+      emitted validated shape satisfied zero width
+    exact ⟨⟨request, [], witness.emission.rankBytes, 0, witness.emission.multiplicity⟩,
+      rfl, fun _ => message⟩
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/CircuitTableExecution.lean b/Ix/Aiur/Proofs/CircuitTableExecution.lean
new file mode 100644
index 000000000..f4a1e2e85
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitTableExecution.lean
@@ -0,0 +1,152 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitTableData
+
+/-! Construct locally valid function rows from valued circuit witnesses and
+physical provider balance, then derive finite call executions. The two-stage
+construction avoids assuming the validity of the table being extracted.
+Native extraction and the explicit layout/shape conditions remain separate. -/
+
+namespace Aiur.AIR
+open Bytecode
+
+private theorem forall₂_weaken {α β : Type} {left : List α} {right : List β}
+    {first second : α → β → Prop} (related : List.Forall₂ first left right)
+    (weaken : ∀ a b, first a b → second a b) : List.Forall₂ second left right := by
+  induction related with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (weaken _ _ head) ih
+
+def FunctionRow.QueriesIn (queries : List (List G)) (row : FunctionRow) : Prop :=
+  row.selector = 1 → row.requests.map functionMessage ⊆ queries ∧ row.byteQueries.map rangeMessage ⊆ queries
+
+theorem FunctionRow.inactive_queried (queries : List (List G)) : inactive.QueriesIn queries := by
+  intro active
+  have bad := congrArg G.n active
+  change 0 = 1 at bad
+  omega
+
+theorem CircuitWitness.interpreted_row {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} {emissions : List CircuitEmission}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    {program : Toplevel} (witness : CircuitWitness)
+    (emitted : witness.Emitted program) (satisfied : witness.Satisfied)
+    (validated : witness.circuit.validateRowCounts program = true) (shape : witness.Shapes program)
+    (limits : witness.LookupBounds) (member : witness.emission ∈ emissions)
+    (pooled : circuitQueryPool emissions ⊆ queries) :
+    ∃ row : FunctionRow, row.Valid program (memoryFacts tables.memory) ∧
+      row.Provides width witness.emission ∧ row.QueriesIn queries := by
+  by_cases zero : witness.emission.multiplicity = 0
+  · exact ⟨FunctionRow.inactive, FunctionRow.inactive_valid _ _,
+      FunctionRow.inactive_provides width zero, FunctionRow.inactive_queried queries⟩
+  · obtain ⟨bounded, bounds, returnBound, single⟩ := witness.circuit.emitRow_count_bounds
+      witness.values program emitted validated satisfied
+    obtain ⟨_, _, row, valid, _, _, _, _, _, multiplicity, _, message, _, called, bytes⟩ :=
+      witness.circuit.emitRow_valid_in_pool global memoryValid canonical witness.values program
+        emitted member pooled bounded bounds shape returnBound limits.1 limits.2 single satisfied zero
+    exact ⟨row, valid, ⟨multiplicity.symm, fun _ => message⟩, fun _ => ⟨called, bytes⟩⟩
+
+theorem functionQueries_in_pool {queries : List (List G)} {roots : List Bytecode.AIR.Call}
+    {rows : List FunctionRow} (rootQueries : roots.map functionMessage ⊆ queries)
+    (queried : ∀ row ∈ rows, row.QueriesIn queries) :
+    (functionQueries roots rows).map functionMessage ⊆ queries := by
+  intro message member
+  obtain ⟨request, requestMember, equal⟩ := List.mem_map.mp member
+  subst message
+  rcases List.mem_append.mp requestMember with root | called
+  · exact rootQueries (List.mem_map.mpr ⟨request, root, rfl⟩)
+  · obtain ⟨row, rowMember, callMember⟩ := List.mem_flatMap.mp called
+    by_cases active : row.selector = 1
+    · rw [if_pos active] at callMember
+      exact (queried row rowMember active).1 (List.mem_map.mpr ⟨request, callMember, rfl⟩)
+    · rw [if_neg active] at callMember
+      cases callMember
+
+theorem functionByteQueries_in_pool {queries : List (List G)} {rows : List FunctionRow}
+    (queried : ∀ row ∈ rows, row.QueriesIn queries) :
+    (functionByteQueries rows).map rangeMessage ⊆ queries := by
+  intro message member
+  obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp member
+  subst message
+  obtain ⟨row, rowMember, queryMember⟩ := List.mem_flatMap.mp pairMember
+  by_cases active : row.selector = 1
+  · rw [if_pos active] at queryMember
+    exact (queried row rowMember active).2 (List.mem_map.mpr ⟨pair, queryMember, rfl⟩)
+  · rw [if_neg active] at queryMember
+    cases queryMember
+
+/-- Construct locally valid function rows from the complete circuit witness
+list. The input balance names only physical circuit providers and auxiliary
+tables. Function-row validity is a conclusion, not an input. -/
+theorem circuitWitnesses_interpret (tables : AuxiliaryTables) {program : Toplevel}
+    (witnesses : List CircuitWitness) {width : Nat} {queries : List (List G)}
+    (balanced : PaddedLookupBalance width queries (tables.circuitProviders (witnesses.map (·.emission))))
+    (bounded : queries.length < gSize.toNat) (widths : ∀ query ∈ queries, query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (counted : program.validateRowCounts = true)
+    (circuits : ∀ witness ∈ witnesses, witness.circuit ∈ program.circuits)
+    (emitted : ∀ witness ∈ witnesses, witness.Emitted program)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (shapes : ∀ witness ∈ witnesses, witness.Shapes program)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds)
+    (pooled : circuitQueryPool (witnesses.map (·.emission)) ⊆ queries) :
+    ∃ functions : List FunctionRow,
+      List.Forall₂ (FunctionRow.Provides width) (witnesses.map (·.emission)) functions ∧
+      GlobalLookups (tables.withFunctions functions) width queries ∧
+      (∀ row ∈ functions, row.Valid program (memoryFacts tables.memory)) ∧
+      (∀ row ∈ functions, row.QueriesIn queries) := by
+  have counts := fun witness member => Toplevel.validateRowCounts_circuit counted (circuits witness member)
+  obtain ⟨provisional, providers⟩ := forall₂_exists_right witnesses
+    (fun witness (row : FunctionRow) => row.Provides width witness.emission)
+    (fun witness member => witness.provider_row (emitted witness member) (satisfied witness member)
+      (counts witness member) (shapes witness member) width)
+  have providerRows := forall₂_map_left providers
+  have global := tables.global_of_circuit_balance balanced bounded widths providerRows
+  obtain ⟨functions, interpreted⟩ := forall₂_exists_right witnesses
+    (fun witness (row : FunctionRow) => row.Valid program (memoryFacts tables.memory) ∧
+      row.Provides width witness.emission ∧ row.QueriesIn queries)
+    (fun witness member => witness.interpreted_row global memoryValid canonical
+      (emitted witness member) (satisfied witness member) (counts witness member) (shapes witness member)
+      (limits witness member) (List.mem_map.mpr ⟨witness, member, rfl⟩) pooled)
+  have provided : List.Forall₂ (FunctionRow.Provides width) (witnesses.map (·.emission)) functions := by
+    apply forall₂_map_left
+    exact forall₂_weaken interpreted (fun _ _ evidence => evidence.2.1)
+  refine ⟨functions, provided, tables.global_of_circuit_balance balanced bounded widths provided, ?_, ?_⟩
+  · intro row member
+    obtain ⟨witness, _, evidence⟩ := forall₂_right_member interpreted member
+    exact evidence.1
+  · intro row member
+    obtain ⟨witness, _, evidence⟩ := forall₂_right_member interpreted member
+    exact evidence.2.2
+
+theorem circuitWitnesses_execute (tables : AuxiliaryTables) {program : Toplevel}
+    (witnesses : List CircuitWitness) {width : Nat} {queries : List (List G)}
+    (balanced : PaddedLookupBalance width queries (tables.circuitProviders (witnesses.map (·.emission))))
+    (bounded : queries.length < gSize.toNat) (widths : ∀ query ∈ queries, query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (counted : program.validateRowCounts = true) (programShapes : program.validateLookupShapes = true)
+    (circuits : ∀ witness ∈ witnesses, witness.circuit ∈ program.circuits)
+    (emitted : ∀ witness ∈ witnesses, witness.Emitted program)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (shapes : ∀ witness ∈ witnesses, witness.Shapes program)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds)
+    (pooled : circuitQueryPool (witnesses.map (·.emission)) ⊆ queries)
+    {request : Bytecode.AIR.Call} (shape : request.LookupShape program)
+    (root : functionMessage request ∈ queries) :
+    Bytecode.AIR.Execution program (memoryFacts tables.memory) request := by
+  obtain ⟨functions, _, global, valid, queried⟩ := circuitWitnesses_interpret tables witnesses
+    balanced bounded widths memoryValid canonical counted circuits emitted satisfied shapes limits pooled
+  apply global.roots_execute (roots := [request]) programShapes valid
+    (functionQueries_in_pool ?_ queried) (functionByteQueries_in_pool queried) shape List.mem_cons_self
+  intro message member
+  have equal : message = functionMessage request := List.mem_singleton.mp member
+  rwa [equal]
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/CircuitTraces.lean b/Ix/Aiur/Proofs/CircuitTraces.lean
new file mode 100644
index 000000000..d11a5f147
--- /dev/null
+++ b/Ix/Aiur/Proofs/CircuitTraces.lean
@@ -0,0 +1,217 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.EncodedCircuitExecution
+import Ix.Aiur.Proofs.LookupBudget
+
+/-! Canonical circuit traces encode the activation bitmap and active-order
+degrees directly. Successful emission supplies every row's circuit and
+lookup extent. Unit consumers fit the trace capacity, which the checked
+global budget bounds below the field characteristic. Native extraction
+from the accepted commitments and proof metadata remains separate. -/
+
+namespace Aiur.AIR
+open Bytecode
+
+/-- Trace assignments indexed by the canonical circuit order. An active
+circuit has exactly the height specified by its active-position degree. -/
+inductive CircuitTraces : List Circuit → Type where
+  | nil : CircuitTraces []
+  | inactive (circuit : Circuit) {circuits : List Circuit} (rest : CircuitTraces circuits) :
+      CircuitTraces (circuit :: circuits)
+  | active (circuit : Circuit) (degree : Nat) (values : Fin (2 ^ degree) → Nat → G)
+      {circuits : List Circuit} (rest : CircuitTraces circuits) : CircuitTraces (circuit :: circuits)
+
+def CircuitTraces.bitmap {circuits : List Circuit} : CircuitTraces circuits → List Bool
+  | .nil => []
+  | .inactive _ rest => false :: rest.bitmap
+  | .active _ _ _ rest => true :: rest.bitmap
+
+def CircuitTraces.degrees {circuits : List Circuit} : CircuitTraces circuits → List Nat
+  | .nil => []
+  | .inactive _ rest => rest.degrees
+  | .active _ degree _ rest => degree :: rest.degrees
+
+def CircuitTraces.capacity {circuits : List Circuit} : CircuitTraces circuits → Nat
+  | .nil => 0
+  | .inactive _ rest => rest.capacity
+  | .active circuit degree _ rest => 2 ^ degree * circuit.layout.lookups + rest.capacity
+
+def emitCircuitWitness (program : Toplevel) (circuit : Circuit) (values : Nat → G) : Option CircuitWitness := do
+  let emission ← circuit.emitRow values program
+  return ⟨circuit, values, emission⟩
+
+def CircuitTraces.emitWitnesses {circuits : List Circuit} (program : Toplevel) :
+    CircuitTraces circuits → Option (List CircuitWitness)
+  | .nil => some []
+  | .inactive _ rest => rest.emitWitnesses program
+  | .active circuit _ values rest => do
+    let first ← (List.ofFn values).mapM (emitCircuitWitness program circuit)
+    let later ← rest.emitWitnesses program
+    return first ++ later
+
+theorem CircuitTraces.slot_sum_append {circuits : List Circuit} (traces : CircuitTraces circuits)
+    (otherSlots : List Nat) (otherActive : List Bool) (otherDegrees : List Nat) :
+    lookupSlotSum (circuits.map (·.layout.lookups) ++ otherSlots)
+      (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) =
+      (lookupSlotSum otherSlots otherActive otherDegrees).map (traces.capacity + ·) := by
+  induction traces with
+  | nil =>
+    simp only [List.map_nil, List.nil_append, bitmap, degrees, capacity, Nat.zero_add]
+    cases lookupSlotSum otherSlots otherActive otherDegrees <;> rfl
+  | inactive circuit rest ih =>
+    simp only [List.map_cons, List.cons_append, bitmap, degrees, capacity, lookupSlotSum]
+    exact ih
+  | active circuit degree values rest ih =>
+    simp only [List.map_cons, List.cons_append, bitmap, degrees, capacity, lookupSlotSum, ih,
+      bind, Option.bind]
+    cases lookupSlotSum otherSlots otherActive otherDegrees <;>
+      simp only [Option.map_none, Option.map_some, pure, Nat.add_assoc]
+
+theorem CircuitTraces.capacity_bounded {circuits : List Circuit} (traces : CircuitTraces circuits)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (accepted : lookupQueryBound (circuits.map (·.layout.lookups) ++ otherSlots)
+      (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) = some result) :
+    traces.capacity + 1 < gSize.toNat := by
+  obtain ⟨_, total, shape, count, bounded⟩ := lookupQueryBound_sound accepted
+  rw [traces.slot_sum_append] at shape
+  cases other : lookupSlotSum otherSlots otherActive otherDegrees with
+  | none => simp only [other, Option.map_none, reduceCtorEq] at shape
+  | some extra =>
+    simp only [other, Option.map_some, Option.some.injEq] at shape
+    omega
+
+theorem emitCircuitWitness_spec {program : Toplevel} {circuit : Circuit} {values : Nat → G}
+    {witness : CircuitWitness} (emitted : emitCircuitWitness program circuit values = some witness) :
+    witness.circuit = circuit ∧ witness.values = values ∧ witness.Emitted program ∧
+      witness.emission.lookupCount = circuit.layout.lookups := by
+  simp only [emitCircuitWitness, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i emission emissionEq
+    have equal := Option.some.inj emitted
+    subst witness
+    have description := (circuit.emitRow_spec values program emissionEq).1
+    refine ⟨rfl, rfl, emissionEq, ?_⟩
+    exact congrArg CircuitEmission.lookupCount description
+
+theorem encodedQueries_length (branchless : Bool) (queries : List QueryPart) (limit : Nat) :
+    (encodedQueries branchless queries limit).length ≤ limit := by
+  simpa only [encodedQueries, List.length_range] using
+    List.length_filterMap_le (encodedQuery branchless queries) (List.range limit)
+
+theorem encodedCircuitQueryPool_uniform_bound (witnesses : List CircuitWitness) (slots : Nat)
+    (bounded : ∀ witness ∈ witnesses, witness.emission.lookupCount ≤ slots) :
+    (encodedCircuitQueryPool (witnesses.map (·.emission))).length ≤ witnesses.length * slots := by
+  induction witnesses with
+  | nil => simp only [List.map_nil, encodedCircuitQueryPool, List.flatMap_nil, List.length_nil, Nat.zero_mul, Nat.le_refl]
+  | cons witness rest ih =>
+    have first := Nat.le_trans (encodedQueries_length witness.emission.branchless
+      witness.emission.queries witness.emission.lookupCount) (bounded witness List.mem_cons_self)
+    have later := ih (fun item member => bounded item (List.mem_cons_of_mem _ member))
+    simp only [encodedCircuitQueryPool, List.map_cons, List.flatMap_cons,
+      List.length_append, List.length_cons, Nat.add_mul, Nat.one_mul] at *
+    omega
+
+theorem emitCircuitWitnesses_spec {program : Toplevel} {circuit : Circuit}
+    {values : List (Nat → G)} {witnesses : List CircuitWitness}
+    (emitted : values.mapM (emitCircuitWitness program circuit) = some witnesses) :
+    witnesses.length = values.length ∧
+      (∀ witness ∈ witnesses, witness.circuit = circuit ∧ witness.Emitted program ∧
+        witness.emission.lookupCount = circuit.layout.lookups) := by
+  have related : List.Forall₂ (fun _ witness => witness.circuit = circuit ∧ witness.Emitted program ∧
+      witness.emission.lookupCount = circuit.layout.lookups) values witnesses := by
+    apply mapM_forall₂ emitted
+    intro value member witness produced
+    obtain ⟨same, _, emitted, count⟩ := emitCircuitWitness_spec produced
+    exact ⟨same, emitted, count⟩
+  have length : witnesses.length = values.length := by
+    clear emitted
+    induction related with
+    | nil => rfl
+    | cons first rest ih => simpa only [List.length_cons] using congrArg (· + 1) ih
+  refine ⟨length, ?_⟩
+  intro witness member
+  obtain ⟨_, _, evidence⟩ := forall₂_right_member related member
+  exact evidence
+
+theorem CircuitTraces.emitWitnesses_spec {circuits : List Circuit} (traces : CircuitTraces circuits)
+    {program : Toplevel} {witnesses : List CircuitWitness}
+    (emitted : traces.emitWitnesses program = some witnesses) :
+    (∀ witness ∈ witnesses, witness.circuit ∈ circuits ∧ witness.Emitted program) ∧
+      (encodedCircuitQueryPool (witnesses.map (·.emission))).length ≤ traces.capacity := by
+  induction traces generalizing witnesses with
+  | nil =>
+    have equal := Option.some.inj emitted
+    subst witnesses
+    exact ⟨by simp only [List.not_mem_nil, false_implies, implies_true], Nat.le_refl 0⟩
+  | inactive circuit rest ih =>
+    obtain ⟨valid, bounded⟩ := ih emitted
+    exact ⟨fun witness member => ⟨List.mem_cons_of_mem _ (valid witness member).1,
+      (valid witness member).2⟩, bounded⟩
+  | active circuit degree values rest ih =>
+    simp only [emitWitnesses, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i first firstEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i later laterEmitted
+        have equal := Option.some.inj emitted
+        subst witnesses
+        obtain ⟨valid, bounded⟩ := ih laterEmitted
+        obtain ⟨length, firstValid⟩ := emitCircuitWitnesses_spec firstEmitted
+        have firstBound := encodedCircuitQueryPool_uniform_bound first circuit.layout.lookups
+          (fun witness member => Nat.le_of_eq (firstValid witness member).2.2)
+        simp only [List.length_ofFn] at length
+        rw [length] at firstBound
+        refine ⟨?_, ?_⟩
+        · intro witness member
+          rcases List.mem_append.mp member with before | after
+          · have evidence := firstValid witness before
+            exact ⟨List.mem_cons.mpr (Or.inl evidence.1), evidence.2.1⟩
+          · exact ⟨List.mem_cons_of_mem _ (valid witness after).1, (valid witness after).2⟩
+        · simp only [encodedCircuitQueryPool, List.map_append, List.flatMap_append,
+            List.length_append, capacity] at *
+          omega
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+/-- Trace rows and the checked native-style budget replace the separate
+query-count premise. Native commitment/trace extraction remains separate. -/
+theorem Backend.trace_circuit_execution {selection : Selection} (backend : Backend selection)
+    (tables : AuxiliaryTables) (traces : CircuitTraces backend.compiled.bytecode.circuits.toList)
+    {witnesses : List CircuitWitness}
+    (emitted : traces.emitWitnesses backend.compiled.bytecode = some witnesses)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (budget : lookupQueryBound
+      (backend.compiled.bytecode.circuits.toList.map (·.layout.lookups) ++ otherSlots)
+      (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) = some result)
+    (width : Nat) (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        encodedCircuitQueryPool (witnesses.map (·.emission)))
+      (tables.circuitProviders (witnesses.map (·.emission))))
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (shapes : ∀ witness ∈ witnesses, witness.Shapes backend.compiled.bytecode)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds) :
+    Execution backend.compiled.bytecode (memoryFacts tables.memory)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  obtain ⟨valid, bound⟩ := traces.emitWitnesses_spec emitted
+  have totalBound := traces.capacity_bounded budget
+  apply backend.encoded_circuit_execution tables witnesses width input arity balanced (by omega)
+    publicWidth queryWidths memoryValid canonical
+    (fun witness member => by simpa using (valid witness member).1)
+    (fun witness member => (valid witness member).2) satisfied shapes limits
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/Compilation.lean b/Ix/Aiur/Proofs/Compilation.lean
new file mode 100644
index 000000000..1c36ddbc4
--- /dev/null
+++ b/Ix/Aiur/Proofs/Compilation.lean
@@ -0,0 +1,98 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Compiler
+import Ix.Aiur.Proofs.Metadata
+import Ix.Aiur.Proofs.Dedup
+import Std.Data.HashMap.Lemmas
+
+/-! Artifact binding for the actual compilation pipeline. This strengthens
+stage existence with equality to the returned artifact. Semantic success
+reflection through these stages remains a separate obligation. -/
+
+namespace Aiur
+
+theorem Source.Toplevel.compile_artifact_of_ok
+    {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (h : source.compile = .ok compiled) :
+    ∃ inlined typed concrete raw names,
+      source.inlineCalls = .ok inlined ∧
+      inlined.checkAndSimplify = .ok typed ∧
+      typed.concretize = .ok concrete ∧
+      concrete.toBytecode = .ok (raw, names) ∧
+      compiled = finishCompilation inlined raw names := by
+  obtain ⟨inlined, typed, concrete, raw, names, hi, ht, hc, hb⟩ :=
+    source.compile_stages_of_ok h
+  refine ⟨inlined, typed, concrete, raw, names, hi, ht, hc, hb, ?_⟩
+  simpa only [Source.Toplevel.compile, hi, ht, hc, hb, Except.mapError,
+    bind, Except.bind, pure, Except.pure, Except.ok.injEq] using h.symm
+
+/-- Circuit reachability flags and partition construction retain every
+bytecode body and input layout of the deduplicated program. -/
+theorem finishCompilation_sameCode (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) :
+    Bytecode.Eval.SameCode (finishCompilation source raw names).bytecode raw.deduplicate.1 := by
+  constructor
+  · simp [finishCompilation]
+  · intro i ha hb
+    simp [finishCompilation]
+  · intro i ha hb
+    simp [finishCompilation]
+
+/-- Backward success reflection for the final reachability/partition passes.
+The preceding deduplication and source-to-bytecode passes remain separate. -/
+theorem finishCompilation_reflects {source : Source.Toplevel} {raw : Bytecode.Toplevel}
+    {names : Std.HashMap Global Bytecode.FunIdx} {function : Bytecode.FunIdx}
+    {args : Array G} {io : IOBuffer} {fuel : Nat} {result : Array G × IOBuffer}
+    (h : Bytecode.Eval.runFunction (finishCompilation source raw names).bytecode
+      function args io fuel = .ok result) :
+    Bytecode.Eval.runFunction raw.deduplicate.1 function args io fuel = .ok result :=
+  (Bytecode.Eval.runFunction_sameCode (finishCompilation_sameCode source raw names)
+    function args io fuel).symm.trans h
+
+/-- Checked deduplication, reachability metadata and circuit construction
+preserve and reflect success at the actual remapping of each original index. -/
+theorem finishCompilation_preserves_execution (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) (function : Bytecode.FunIdx)
+    (args : Array G) (io : IOBuffer) (fuel : Nat) (result : Array G × IOBuffer) :
+    Bytecode.Eval.runFunction raw function args io fuel = .ok result ↔
+      Bytecode.Eval.runFunction (finishCompilation source raw names).bytecode
+        (raw.deduplicate.2 function) args io fuel = .ok result := by
+  rw [Bytecode.Eval.runFunction_sameCode (finishCompilation_sameCode source raw names)]
+  exact Bytecode.Eval.deduplicate_preserves_execution raw function args io fuel result
+
+private theorem fold_renamed_name_image {α : Type} [BEq α] [Hashable α] [LawfulBEq α]
+    (items : List (α × Nat)) (initial : Std.HashMap α Nat) (rename : Nat → Nat)
+    {name : α} {value : Nat}
+    (present : (items.foldl (fun acc item => acc.insert item.1 (rename item.2)) initial)[name]? =
+      some value) :
+    initial[name]? = some value ∨ ∃ before, (name, before) ∈ items ∧ rename before = value := by
+  induction items generalizing initial with
+  | nil => exact Or.inl present
+  | cons item items ih =>
+    simp only [List.foldl_cons] at present
+    rcases ih _ present with prior | ⟨before, member, eq⟩
+    · rw [Std.HashMap.getElem?_insert] at prior
+      split at prior
+      next same =>
+        have hname : item.1 = name := eq_of_beq same
+        have hvalue : rename item.2 = value := Option.some.inj prior
+        exact Or.inr ⟨item.2, List.mem_cons.mpr (Or.inl (Prod.ext hname.symm rfl)), hvalue⟩
+      next different => exact Or.inl prior
+    · exact Or.inr ⟨before, by simp [member], eq⟩
+
+/-- A compiled entrypoint comes from the same name before deduplication,
+with its index transformed by the actual selected renaming. -/
+theorem finishCompilation_nameMap_image {source : Source.Toplevel} {raw : Bytecode.Toplevel}
+    {names : Std.HashMap Global Bytecode.FunIdx} {name : Lean.Name} {function : Bytecode.FunIdx}
+    (present : (finishCompilation source raw names).getFuncIdx name = some function) :
+    ∃ original, names[Global.mk name]? = some original ∧ raw.deduplicate.2 original = function := by
+  simp only [finishCompilation, CompiledToplevel.getFuncIdx, Id.run, pure] at present
+  rw [Std.HashMap.fold_eq_foldl_toList] at present
+  rcases fold_renamed_name_image names.toList ∅ raw.deduplicate.2 present with impossible | ⟨original, member, eq⟩
+  · simp at impossible
+  · exact ⟨original, by simpa using member, eq⟩
+
+end Aiur
diff --git a/Ix/Aiur/Proofs/CompiledCircuitRows.lean b/Ix/Aiur/Proofs/CompiledCircuitRows.lean
new file mode 100644
index 000000000..a531e963e
--- /dev/null
+++ b/Ix/Aiur/Proofs/CompiledCircuitRows.lean
@@ -0,0 +1,68 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitReflection
+
+/-!
+Compose native-style circuit emission and base-graph compilation. Swept graph
+constraints and every physical lookup slot have the valued circuit meaning,
+including constant-zero elimination, root deduplication, and shared providers.
+-/
+
+namespace Aiur.NativeAIR.CircuitEmitter
+open OpEmitter Compiler
+
+theorem equations_vanish {values : Values G} {expressions : List Expr} {results : List G}
+    (evaluated : expressions.mapM (evalExpr values) = some results) :
+    ExprsVanish goldilocksOps values expressions ↔ ∀ result ∈ results, result = 0 := by
+  have related := AIR.mapM_forall₂ evaluated (fun _ _ _ reflected => reflected)
+  clear evaluated
+  induction related with
+  | nil => constructor <;> intro _ _ member <;> cases member
+  | cons reflected _ ih =>
+    rw [ExprsVanish.cons, List.forall_mem_cons]
+    constructor
+    · intro ⟨zero, zeros⟩
+      exact ⟨Option.some.inj (reflected.symm.trans zero), ih.mp zeros⟩
+    · intro ⟨zero, zeros⟩
+      exact ⟨zero ▸ reflected, ih.mpr zeros⟩
+
+structure Compiled where
+  emission : Emission
+  base : BaseCompilation
+
+def compileCircuit (widths : GraphWidths) (program : Bytecode.Toplevel) (circuit : Bytecode.Circuit) : Option Compiled := do
+  let emission ← emitCircuit program circuit
+  let base ← compileBase widths emission.lookups emission.equations
+  return ⟨emission, base⟩
+
+theorem compileCircuit_reflects {values : Values G} (row : Nat → G) {widths : GraphWidths}
+    (fits : values.Fits widths) (program : Bytecode.Toplevel) (circuit : Bytecode.Circuit) {compiled : Compiled}
+    (built : compileCircuit widths program circuit = some compiled)
+    (reads : ∀ index < compiled.emission.readBound,
+      (values.columns .main .current)[index]? = some (row index)) :
+    ∃ result buffer, circuit.emitRow row program = some result ∧
+      compiled.base.graph.sweep goldilocksOps values = some buffer ∧
+      (Vanishes goldilocksOps buffer compiled.base.graph.zeros ↔ ∀ equation ∈ result.equations, equation = 0) ∧
+      compiled.base.graph.lookups.mapM (readLookup buffer) =
+        some (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) := by
+  simp only [compileCircuit, bind, Option.bind] at built
+  split at built
+  · cases built
+  rename_i emission emitted
+  dsimp only at built
+  split at built
+  · cases built
+  rename_i base baseCompiled
+  cases built
+  obtain ⟨result, resultEmitted, evaluated⟩ := emitCircuit_reflects row program circuit emitted reads
+  obtain ⟨buffer, swept, lookups, zeros⟩ := compileBase_reflects goldilocksGraphLaws fits
+    emission.lookups emission.equations baseCompiled
+  have equations := (Emission.eval_components evaluated).2.2.2.2.2.2.2.2.2.1
+  obtain ⟨messages, exprReads, graphReads⟩ := lookups.read
+  exact ⟨result, buffer, resultEmitted, swept, zeros.trans (equations_vanish equations),
+    graphReads.trans (exprReads.symm.trans (Emission.lookups_eval evaluated))⟩
+
+end Aiur.NativeAIR.CircuitEmitter
diff --git a/Ix/Aiur/Proofs/CompiledKey.lean b/Ix/Aiur/Proofs/CompiledKey.lean
new file mode 100644
index 000000000..920df6795
--- /dev/null
+++ b/Ix/Aiur/Proofs/CompiledKey.lean
@@ -0,0 +1,308 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.CompiledVerifier
+import Ix.Aiur.Proofs.GraphWidths
+import Ix.Aiur.Proofs.TableExpressions
+import Ix.Aiur.Proofs.KeyArtifact
+
+/-! The enforced compiled-key comparison supplies graph equality and native
+dimensions. Every function, memory and byte circuit in the selected key has
+the corresponding physical row meaning, without a graph-equality premise. -/
+
+namespace Aiur.NativeAIR.CompiledKey
+open Compiler CircuitEmitter OpEmitter
+
+theorem circuit_success {mainWidth preprocessedWidth preprocessedHeight groupSize : Nat}
+    {base : BaseCompilation} {result : KeyCodec.Circuit}
+    (built : circuit mainWidth preprocessedWidth preprocessedHeight groupSize base = some result) :
+    result.graph = base.graph ∧ result.mainWidth = mainWidth ∧
+      result.preprocessedWidth = preprocessedWidth ∧ result.preprocessedHeight = preprocessedHeight ∧
+      result.lookupGroupSize = groupSize ∧ result.valid = true := by
+  simp only [circuit, bind, Option.bind] at built
+  split at built
+  · cases built
+  · dsimp only at built
+    split at built
+    · cases built
+      exact ⟨rfl, rfl, rfl, rfl, rfl, ‹_›⟩
+    · cases built
+
+theorem functionCircuit_success {program : Bytecode.Toplevel} {source : Bytecode.Circuit}
+    {result : KeyCodec.Circuit} (built : functionCircuit program source = some result) :
+    ∃ compiled, compileCircuit (circuitWidths source) program source = some compiled ∧
+      result.graph = compiled.base.graph ∧ result.mainWidth = source.layout.width ∧
+      result.preprocessedWidth = 0 ∧ result.preprocessedHeight = 0 ∧
+      result.lookupGroupSize = (if compiled.emission.branchless && 2 ≤ compiled.emission.lookups.length then 2 else 1) := by
+  cases compiled : compileCircuit (circuitWidths source) program source with
+  | none => simp only [functionCircuit, compiled, bind, Option.bind_none, reduceCtorEq] at built
+  | some output =>
+    simp only [functionCircuit, compiled, bind, Option.bind_some] at built
+    have fields := circuit_success built
+    exact ⟨output, rfl, fields.1, fields.2.1, fields.2.2.1, fields.2.2.2.1, fields.2.2.2.2.1⟩
+
+theorem memoryCircuit_success {width : Nat} {result : KeyCodec.Circuit}
+    (built : memoryCircuit width = some result) :
+    ∃ base, compileBase ⟨0, 3 + width, 0, 0⟩ [memoryLookup width] memoryEquations = some base ∧
+      result.graph = base.graph ∧ result.mainWidth = 3 + width ∧
+      result.preprocessedWidth = 0 ∧ result.preprocessedHeight = 0 ∧ result.lookupGroupSize = 1 := by
+  cases compiled : compileBase ⟨0, 3 + width, 0, 0⟩ [memoryLookup width] memoryEquations with
+  | none => simp only [memoryCircuit, compiled, bind, Option.bind_none, reduceCtorEq] at built
+  | some base =>
+    simp only [memoryCircuit, compiled, bind, Option.bind_some] at built
+    have fields := circuit_success built
+    exact ⟨base, rfl, fields.1, fields.2.1, fields.2.2.1, fields.2.2.2.1, fields.2.2.2.2.1⟩
+
+theorem byte1Circuit_success {result : KeyCodec.Circuit} (built : byte1Circuit = some result) :
+    ∃ base, compileBase ⟨11, 3, 0, 0⟩ (AIR.Byte1Kind.all.map byte1Lookup) [] = some base ∧
+      result.graph = base.graph ∧ result.mainWidth = 3 ∧ result.preprocessedWidth = 11 ∧
+      result.preprocessedHeight = 256 ∧ result.lookupGroupSize = 2 := by
+  cases compiled : compileBase ⟨11, 3, 0, 0⟩ (AIR.Byte1Kind.all.map byte1Lookup) [] with
+  | none => simp only [byte1Circuit, compiled, bind, Option.bind_none, reduceCtorEq] at built
+  | some base =>
+    simp only [byte1Circuit, compiled, bind, Option.bind_some] at built
+    have fields := circuit_success built
+    exact ⟨base, rfl, fields.1, fields.2.1, fields.2.2.1, fields.2.2.2.1, fields.2.2.2.2.1⟩
+
+theorem byte2Circuit_success {result : KeyCodec.Circuit} (built : byte2Circuit = some result) :
+    ∃ base, compileBase ⟨14, 10, 0, 0⟩ (AIR.Byte2Kind.all.map byte2Lookup) [] = some base ∧
+      result.graph = base.graph ∧ result.mainWidth = 10 ∧ result.preprocessedWidth = 14 ∧
+      result.preprocessedHeight = 65536 ∧ result.lookupGroupSize = 2 := by
+  cases compiled : compileBase ⟨14, 10, 0, 0⟩ (AIR.Byte2Kind.all.map byte2Lookup) [] with
+  | none => simp only [byte2Circuit, compiled, bind, Option.bind_none, reduceCtorEq] at built
+  | some base =>
+    simp only [byte2Circuit, compiled, bind, Option.bind_some] at built
+    have fields := circuit_success built
+    exact ⟨base, rfl, fields.1, fields.2.1, fields.2.2.1, fields.2.2.2.1, fields.2.2.2.2.1⟩
+
+theorem circuits_parts {program : Bytecode.Toplevel} {result : List KeyCodec.Circuit}
+    (built : circuits program = some result) :
+    ∃ functions memories byte1 byte2,
+      program.circuits.toList.mapM (functionCircuit program) = some functions ∧
+      program.memorySizes.toList.mapM memoryCircuit = some memories ∧
+      byte1Circuit = some byte1 ∧ byte2Circuit = some byte2 ∧
+      result = functions ++ memories ++ [byte1, byte2] := by
+  cases functionsBuilt : program.circuits.toList.mapM (functionCircuit program) with
+  | none => simp only [circuits, functionsBuilt, bind, Option.bind_none, reduceCtorEq] at built
+  | some functions =>
+    cases memoriesBuilt : program.memorySizes.toList.mapM memoryCircuit with
+    | none => simp only [circuits, functionsBuilt, memoriesBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at built
+    | some memories =>
+      cases first : byte1Circuit with
+      | none => simp only [circuits, functionsBuilt, memoriesBuilt, first, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at built
+      | some byte1 =>
+        cases second : byte2Circuit with
+        | none => simp only [circuits, functionsBuilt, memoriesBuilt, first, second, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at built
+        | some byte2 =>
+          simp only [circuits, functionsBuilt, memoriesBuilt, first, second, bind, Option.bind_some, pure, Option.some.injEq] at built
+          exact ⟨functions, memories, byte1, byte2, rfl, rfl, rfl, rfl, built.symm⟩
+
+theorem circuits_length {program : Bytecode.Toplevel} {result : List KeyCodec.Circuit}
+    (built : circuits program = some result) :
+    result.length = program.circuits.size + program.memorySizes.size + 2 := by
+  obtain ⟨functions, memories, _, _, functionsBuilt, memoriesBuilt, _, _, equal⟩ := circuits_parts built
+  have fl := Bytecode.AIR.list_mapM_some_length _ _ _ functionsBuilt
+  have ml := Bytecode.AIR.list_mapM_some_length _ _ _ memoriesBuilt
+  simp only [equal, List.length_append, fl, ml, Array.length_toList, List.length_cons, List.length_nil]
+
+theorem circuits_function {program : Bytecode.Toplevel} {result : List KeyCodec.Circuit}
+    (built : circuits program = some result) {index : Nat} {source : Bytecode.Circuit} {artifact : KeyCodec.Circuit}
+    (present : program.circuits[index]? = some source) (selected : result[index]? = some artifact) :
+    functionCircuit program source = some artifact := by
+  obtain ⟨functions, memories, byte1, byte2, functionsBuilt, _, _, _, equal⟩ := circuits_parts built
+  have length := Bytecode.AIR.list_mapM_some_length _ _ _ functionsBuilt
+  have bound : index < functions.length := by
+    rw [length, Array.length_toList]
+    exact (Array.getElem?_eq_some_iff.mp present).1
+  rw [equal, List.append_assoc, List.getElem?_append_left bound] at selected
+  have read := list_mapM_read functionsBuilt index
+  simpa only [Array.getElem?_toList, present, Option.bind_some, selected, bind] using read
+
+theorem circuits_memory {program : Bytecode.Toplevel} {result : List KeyCodec.Circuit}
+    (built : circuits program = some result) {index width : Nat} {artifact : KeyCodec.Circuit}
+    (present : program.memorySizes[index]? = some width)
+    (selected : result[program.circuits.size + index]? = some artifact) :
+    memoryCircuit width = some artifact := by
+  obtain ⟨functions, memories, byte1, byte2, functionsBuilt, memoriesBuilt, _, _, equal⟩ := circuits_parts built
+  have fl := Bytecode.AIR.list_mapM_some_length _ _ _ functionsBuilt
+  have ml := Bytecode.AIR.list_mapM_some_length _ _ _ memoriesBuilt
+  have first : functions.length ≤ program.circuits.size + index := by simp only [fl, Array.length_toList]; omega
+  have inside : index < memories.length := by
+    rw [ml, Array.length_toList]
+    exact (Array.getElem?_eq_some_iff.mp present).1
+  rw [equal, List.append_assoc, List.getElem?_append_right first] at selected
+  simp only [fl, Array.length_toList, Nat.add_sub_cancel_left, List.getElem?_append_left inside] at selected
+  have read := list_mapM_read memoriesBuilt index
+  simpa only [Array.getElem?_toList, present, Option.bind_some, selected, bind] using read
+
+theorem circuits_bytes {program : Bytecode.Toplevel} {result : List KeyCodec.Circuit}
+    (built : circuits program = some result) :
+    ∃ byte1 byte2, byte1Circuit = some byte1 ∧ byte2Circuit = some byte2 ∧
+      result[program.circuits.size + program.memorySizes.size]? = some byte1 ∧
+      result[program.circuits.size + program.memorySizes.size + 1]? = some byte2 := by
+  obtain ⟨functions, memories, byte1, byte2, functionsBuilt, memoriesBuilt, first, second, equal⟩ := circuits_parts built
+  have fl := Bytecode.AIR.list_mapM_some_length _ _ _ functionsBuilt
+  have ml := Bytecode.AIR.list_mapM_some_length _ _ _ memoriesBuilt
+  have length : (functions ++ memories).length = program.circuits.size + program.memorySizes.size := by
+    simp only [List.length_append, fl, ml, Array.length_toList]
+  refine ⟨byte1, byte2, first, second, ?_, ?_⟩
+  · rw [equal, List.getElem?_append_right (by omega), length, Nat.sub_self]
+    rfl
+  · rw [equal, List.getElem?_append_right (by omega), length]
+    simp only [Nat.add_sub_cancel_left, List.getElem?_cons_succ, List.getElem?_cons_zero]
+
+theorem memoryCircuit_reflects {width : Nat} {artifact : KeyCodec.Circuit}
+    (built : memoryCircuit width = some artifact) {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ buffer, artifact.graph.sweep goldilocksOps values = some buffer ∧
+      (Vanishes goldilocksOps buffer artifact.graph.zeros ↔
+        ∀ equation ∈ AIR.memoryColumnEquations width (columns values .main .current (3 + width))
+          (columns values .main .next (3 + width)) values.isTransition, equation = 0) ∧
+      artifact.graph.lookups.mapM (readLookup buffer) =
+        some [AIR.memoryColumnLookup width (columns values .main .current (3 + width))] := by
+  obtain ⟨base, compiled, graph, mainWidth, _, _, _⟩ := memoryCircuit_success built
+  have widths : (GraphWidths.mk 0 (3 + width) 0 0).Le artifact.widths := by
+    refine ⟨?_, Nat.zero_le _⟩
+    intro source
+    cases source <;> simp only [GraphWidths.width, KeyCodec.Circuit.widths, mainWidth, Nat.le_refl, Nat.zero_le]
+  have wide := compileBase_widen widths _ _ compiled
+  obtain ⟨buffer, swept, lookups, equations⟩ := compileBase_reflects goldilocksGraphLaws fits _ _ wide
+  have mainBound : 3 + width ≤ artifact.widths.main := by simp only [KeyCodec.Circuit.widths, mainWidth, Nat.le_refl]
+  have eqs := memoryEquations_eval fits width mainBound
+  have lookup := memoryLookup_eval fits width mainBound
+  obtain ⟨results, exprReads, graphReads⟩ := lookups.read
+  refine ⟨buffer, graph ▸ swept, ?_, ?_⟩
+  · rw [graph]
+    exact equations.trans (equations_vanish eqs)
+  · rw [graph]
+    exact graphReads.trans (exprReads.symm.trans (by
+      simp only [List.mapM_cons, List.mapM_nil, lookup, bind, Option.bind_some, pure]))
+
+theorem byte1Circuit_reflects {artifact : KeyCodec.Circuit} (built : byte1Circuit = some artifact)
+    {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ buffer, artifact.graph.sweep goldilocksOps values = some buffer ∧
+      Vanishes goldilocksOps buffer artifact.graph.zeros ∧
+      artifact.graph.lookups.mapM (readLookup buffer) = some
+        (AIR.Byte1Kind.all.map fun kind => AIR.byte1ColumnLookup kind
+          (columns values .preprocessed .current 11) (columns values .main .current 3)) := by
+  obtain ⟨base, compiled, graph, mainWidth, preWidth, _, _⟩ := byte1Circuit_success built
+  have widths : (GraphWidths.mk 11 3 0 0).Le artifact.widths := by
+    refine ⟨?_, Nat.zero_le _⟩
+    intro source
+    cases source <;> simp only [GraphWidths.width, KeyCodec.Circuit.widths, mainWidth, preWidth, Nat.le_refl, Nat.zero_le]
+  have wide := compileBase_widen widths _ _ compiled
+  obtain ⟨buffer, swept, lookups, equations⟩ := compileBase_reflects goldilocksGraphLaws fits _ _ wide
+  have mainBound : 3 ≤ artifact.widths.main := by simp only [KeyCodec.Circuit.widths, mainWidth, Nat.le_refl]
+  have preBound : 11 ≤ artifact.widths.preprocessed := by simp only [KeyCodec.Circuit.widths, preWidth, Nat.le_refl]
+  have evaluated := list_mapM_of_map AIR.Byte1Kind.all byte1Lookup _ (ExprLookup.eval goldilocksOps values)
+    (fun kind _ => byte1Lookup_eval fits mainBound preBound kind)
+  obtain ⟨results, exprReads, graphReads⟩ := lookups.read
+  refine ⟨buffer, graph ▸ swept, ?_, ?_⟩
+  · rw [graph]
+    exact equations.mpr (fun _ member => nomatch member)
+  · rw [graph]
+    exact graphReads.trans (exprReads.symm.trans evaluated)
+
+theorem byte2Circuit_reflects {artifact : KeyCodec.Circuit} (built : byte2Circuit = some artifact)
+    {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ buffer, artifact.graph.sweep goldilocksOps values = some buffer ∧
+      Vanishes goldilocksOps buffer artifact.graph.zeros ∧
+      artifact.graph.lookups.mapM (readLookup buffer) = some
+        (AIR.Byte2Kind.all.map fun kind => AIR.byte2ColumnLookup kind
+          (columns values .preprocessed .current 14) (columns values .main .current 10)) := by
+  obtain ⟨base, compiled, graph, mainWidth, preWidth, _, _⟩ := byte2Circuit_success built
+  have widths : (GraphWidths.mk 14 10 0 0).Le artifact.widths := by
+    refine ⟨?_, Nat.zero_le _⟩
+    intro source
+    cases source <;> simp only [GraphWidths.width, KeyCodec.Circuit.widths, mainWidth, preWidth, Nat.le_refl, Nat.zero_le]
+  have wide := compileBase_widen widths _ _ compiled
+  obtain ⟨buffer, swept, lookups, equations⟩ := compileBase_reflects goldilocksGraphLaws fits _ _ wide
+  have mainBound : 10 ≤ artifact.widths.main := by simp only [KeyCodec.Circuit.widths, mainWidth, Nat.le_refl]
+  have preBound : 14 ≤ artifact.widths.preprocessed := by simp only [KeyCodec.Circuit.widths, preWidth, Nat.le_refl]
+  have evaluated := list_mapM_of_map AIR.Byte2Kind.all byte2Lookup _ (ExprLookup.eval goldilocksOps values)
+    (fun kind _ => byte2Lookup_eval fits mainBound preBound kind)
+  obtain ⟨results, exprReads, graphReads⟩ := lookups.read
+  refine ⟨buffer, graph ▸ swept, ?_, ?_⟩
+  · rw [graph]
+    exact equations.mpr (fun _ member => nomatch member)
+  · rw [graph]
+    exact graphReads.trans (exprReads.symm.trans evaluated)
+
+end Aiur.NativeAIR.CompiledKey
+
+namespace Aiur.BoundVerifier
+open NativeAIR NativeAIR.CircuitEmitter NativeAIR.Compiler
+
+theorem CompiledBackend.circuit_count {selection : Selection} (backend : CompiledBackend selection) :
+    backend.keyData.circuits.length =
+      backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size + 2 :=
+  CompiledKey.circuits_length backend.circuits_bound
+
+theorem CompiledBackend.function_graph_reflects {selection : Selection} (backend : CompiledBackend selection)
+    {index : Nat} {source : Bytecode.Circuit} {artifact : KeyCodec.Circuit}
+    (present : backend.compiled.bytecode.circuits[index]? = some source)
+    (selected : backend.keyData.circuits[index]? = some artifact)
+    {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ result buffer,
+      source.emitRow (fun index => (values.columns .main .current)[index]?.getD 0) backend.compiled.bytecode = some result ∧
+      artifact.graph.sweep goldilocksOps values = some buffer ∧
+      (Vanishes goldilocksOps buffer artifact.graph.zeros ↔ ∀ equation ∈ result.equations, equation = 0) ∧
+      artifact.graph.lookups.mapM (readLookup buffer) =
+        some (List.ofFn fun slot : Fin result.lookupCount => result.lookup slot.val) := by
+  have bound := CompiledKey.circuits_function backend.circuits_bound present selected
+  obtain ⟨compiled, built, graph, mainWidth, _, _, _⟩ := CompiledKey.functionCircuit_success bound
+  have physical : artifact.widths.main = source.layout.width := mainWidth
+  have wide := compileCircuit_widen (circuitWidths_le (Nat.le_of_eq physical.symm)) _ _ built
+  obtain ⟨result, buffer, emitted, swept, satisfied, lookups⟩ := backend.toBackend.compileCircuit_reflects
+    fits (Array.mem_of_getElem? present) physical wide
+  exact ⟨result, buffer, emitted, graph ▸ swept, graph ▸ satisfied, graph ▸ lookups⟩
+
+theorem CompiledBackend.memory_graph_reflects {selection : Selection} (backend : CompiledBackend selection)
+    {index width : Nat} {artifact : KeyCodec.Circuit}
+    (present : backend.compiled.bytecode.memorySizes[index]? = some width)
+    (selected : backend.keyData.circuits[backend.compiled.bytecode.circuits.size + index]? = some artifact)
+    {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ buffer, artifact.graph.sweep goldilocksOps values = some buffer ∧
+      (Vanishes goldilocksOps buffer artifact.graph.zeros ↔
+        ∀ equation ∈ AIR.memoryColumnEquations width (CompiledKey.columns values .main .current (3 + width))
+          (CompiledKey.columns values .main .next (3 + width)) values.isTransition, equation = 0) ∧
+      artifact.graph.lookups.mapM (readLookup buffer) =
+        some [AIR.memoryColumnLookup width (CompiledKey.columns values .main .current (3 + width))] :=
+  CompiledKey.memoryCircuit_reflects (CompiledKey.circuits_memory backend.circuits_bound present selected) fits
+
+theorem CompiledBackend.byte_graphs {selection : Selection} (backend : CompiledBackend selection) :
+    ∃ byte1 byte2, CompiledKey.byte1Circuit = some byte1 ∧ CompiledKey.byte2Circuit = some byte2 ∧
+      backend.keyData.circuits[backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size]? = some byte1 ∧
+      backend.keyData.circuits[backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size + 1]? = some byte2 :=
+  CompiledKey.circuits_bytes backend.circuits_bound
+
+theorem CompiledBackend.byte1_graph_reflects {selection : Selection} (backend : CompiledBackend selection)
+    {artifact : KeyCodec.Circuit}
+    (selected : backend.keyData.circuits[backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size]? = some artifact)
+    {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ buffer, artifact.graph.sweep goldilocksOps values = some buffer ∧
+      Vanishes goldilocksOps buffer artifact.graph.zeros ∧
+      artifact.graph.lookups.mapM (readLookup buffer) = some
+        (AIR.Byte1Kind.all.map fun kind => AIR.byte1ColumnLookup kind
+          (CompiledKey.columns values .preprocessed .current 11) (CompiledKey.columns values .main .current 3)) := by
+  obtain ⟨byte1, _, built, _, present, _⟩ := backend.byte_graphs
+  have equal := Option.some.inj (present.symm.trans selected)
+  subst artifact
+  exact CompiledKey.byte1Circuit_reflects built fits
+
+theorem CompiledBackend.byte2_graph_reflects {selection : Selection} (backend : CompiledBackend selection)
+    {artifact : KeyCodec.Circuit}
+    (selected : backend.keyData.circuits[backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size + 1]? = some artifact)
+    {values : Values G} (fits : values.Fits artifact.widths) :
+    ∃ buffer, artifact.graph.sweep goldilocksOps values = some buffer ∧
+      Vanishes goldilocksOps buffer artifact.graph.zeros ∧
+      artifact.graph.lookups.mapM (readLookup buffer) = some
+        (AIR.Byte2Kind.all.map fun kind => AIR.byte2ColumnLookup kind
+          (CompiledKey.columns values .preprocessed .current 14) (CompiledKey.columns values .main .current 10)) := by
+  obtain ⟨_, byte2, _, built, _, present⟩ := backend.byte_graphs
+  have equal := Option.some.inj (present.symm.trans selected)
+  subst artifact
+  exact CompiledKey.byte2Circuit_reflects built fits
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/CompilerAllocation.lean b/Ix/Aiur/Proofs/CompilerAllocation.lean
new file mode 100644
index 000000000..15386d556
--- /dev/null
+++ b/Ix/Aiur/Proofs/CompilerAllocation.lean
@@ -0,0 +1,50 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationAllocation
+import Ix.Aiur.Proofs.LookupLayout
+
+/-! The allocation projection describes the actual compiler layout step. -/
+
+namespace Aiur.Concrete.Bytecode
+open Aiur.Bytecode
+
+theorem getDegree_list (indices : List ValIdx) (initial : LayoutMState) :
+    (indices.mapM getDegree).run initial = (indices.map (fun i => initial.degrees[i]?.getD 0), initial) := by
+  induction indices with
+  | nil => rfl
+  | cons index indices ih =>
+    rw [List.mapM_cons]
+    change (let (values, final) := (indices.mapM getDegree).run initial;
+      (initial.degrees[index]?.getD 0 :: values, final)) =
+      (initial.degrees[index]?.getD 0 :: indices.map (fun i => initial.degrees[i]?.getD 0), initial)
+    rw [ih]
+
+theorem getDegree_array (indices : Array ValIdx) :
+    indices.mapM getDegree = (fun initial => pure (indices.map (fun i => initial.degrees[i]?.getD 0), initial)) := by
+  rw [Array.mapM_eq_mapM_toList]
+  funext initial
+  change (let (values, final) := (indices.toList.mapM getDegree).run initial;
+      (values.toArray, final)) = (indices.map (fun i => initial.degrees[i]?.getD 0), initial)
+  rw [getDegree_list]
+  simp only [← List.map_toArray, Array.toArray_toList]
+
+theorem opLayout_allocation (op : Op) (initial : LayoutMState) :
+    ((opLayout op).run initial).2.degrees = initial.degrees ++ (op.allocation initial.degrees).degrees ∧
+    ((opLayout op).run initial).2.functionLayout.auxiliaries =
+      initial.functionLayout.auxiliaries + (op.allocation initial.degrees).auxiliaries := by
+  cases op <;>
+    simp only [opLayout, getDegree_array, bumpLookups, bumpAuxiliaries, getDegree,
+      pushDegree, pushDegrees, addMemSize, Op.allocation, OpAllocation.advice]
+  all_goals dsimp [StateT.run, StateT.bind, StateT.pure, StateT.get, StateT.modifyGet,
+    get, getThe, MonadStateOf.get, modify, modifyGet, MonadStateOf.modifyGet,
+    instMonadStateOfMonadStateOf, instMonadStateOfStateTOfMonad,
+    bind, pure]
+  all_goals try simp [selectedDegree]
+  all_goals try split
+  all_goals try simp_all
+  all_goals first | rfl | exact ⟨rfl, rfl⟩
+
+end Aiur.Concrete.Bytecode
diff --git a/Ix/Aiur/Proofs/CompilerBranches.lean b/Ix/Aiur/Proofs/CompilerBranches.lean
new file mode 100644
index 000000000..d58d11b6a
--- /dev/null
+++ b/Ix/Aiur/Proofs/CompilerBranches.lean
@@ -0,0 +1,124 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CompilerAllocation
+
+/-! Branch layout restores the incoming logical degrees and retains the maximum
+physical allocation, including the inverse columns of a default branch. -/
+
+namespace Aiur.Concrete.Bytecode
+open Aiur.Bytecode
+
+def allocationBranchStep (shared : SharedData) (degrees : Array Nat) (acc : SharedData)
+    (block : Block) : LayoutM SharedData := do
+  setSharedData shared
+  blockLayout block
+  let used ← getSharedData
+  setDegrees degrees
+  return acc.maximals used
+
+theorem allocationBranchStep_degrees (shared : SharedData) (degrees : Array Nat) (acc : SharedData)
+    (block : Block) (initial : LayoutMState) :
+    ((allocationBranchStep shared degrees acc block).run initial).2.degrees = degrees := rfl
+
+theorem allocationBranchStep_column (shared : SharedData) (degrees : Array Nat) (acc : SharedData)
+    (block : Block) (initial : LayoutMState) (base column : Nat) (aligned : initial.degrees = degrees)
+    (effect : ∀ state : LayoutMState, state.degrees = degrees →
+      state.functionLayout.auxiliaries = shared.auxiliaries →
+      column = base + ((blockLayout block).run state).2.functionLayout.auxiliaries) :
+    base + ((allocationBranchStep shared degrees acc block).run initial).1.auxiliaries =
+      max (base + acc.auxiliaries) column := by
+  have body := effect ((setSharedData shared).run initial).2 aligned rfl
+  change base + max acc.auxiliaries
+    ((blockLayout block).run ((setSharedData shared).run initial).2).2.functionLayout.auxiliaries = _
+  rw [← Nat.add_max_add_left, ← body]
+
+theorem allocationBranchFold {α β : Type} {items : List α} {emissions : List β}
+    (blockOf : α → Block) (measure : β → Nat) (shared : SharedData) (degrees : Array Nat) (base : Nat)
+    (related : List.Forall₂ (fun item emission => ∀ state : LayoutMState,
+      state.degrees = degrees → state.functionLayout.auxiliaries = shared.auxiliaries →
+      measure emission = base + ((blockLayout (blockOf item)).run state).2.functionLayout.auxiliaries)
+      items emissions)
+    (acc : SharedData) (initial : LayoutMState) (aligned : initial.degrees = degrees) :
+    ((items.foldlM (fun acc item => allocationBranchStep shared degrees acc (blockOf item)) acc).run initial).2.degrees =
+      degrees ∧
+    base + ((items.foldlM (fun acc item => allocationBranchStep shared degrees acc (blockOf item)) acc).run initial).1.auxiliaries =
+      emissions.foldl (fun current emission => max current (measure emission)) (base + acc.auxiliaries) := by
+  induction related generalizing acc initial with
+  | nil => exact ⟨aligned, rfl⟩
+  | @cons item emission items emissions effect related ih =>
+    rw [List.foldlM_cons]
+    have next := ih ((allocationBranchStep shared degrees acc (blockOf item)).run initial).1
+      ((allocationBranchStep shared degrees acc (blockOf item)).run initial).2
+      (allocationBranchStep_degrees ..)
+    rw [allocationBranchStep_column shared degrees acc (blockOf item) initial base
+      (measure emission) aligned effect] at next
+    exact next
+
+theorem allocationBranchLoop (branches : Array (G × Block)) (shared : SharedData) (degrees : Array Nat) :
+    branches.attach.foldlM (fun acc pair => allocationBranchStep shared degrees acc pair.val.2) shared =
+      branches.toList.foldlM (fun acc pair => allocationBranchStep shared degrees acc pair.2) shared := by
+  rw [← Array.foldlM_toList, Array.toList_attach, ← List.foldlM_map,
+    List.attachWith_map_val, List.foldlM_map]
+
+theorem matchLayout_allocation {β : Type} (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (initial : LayoutMState) (base : Nat) (measure : β → Nat)
+    {cases defaults : List β}
+    (caseEffects : List.Forall₂ (fun pair emission => ∀ state : LayoutMState,
+      state.degrees = initial.degrees → state.functionLayout.auxiliaries = initial.functionLayout.auxiliaries →
+      measure emission = base + ((blockLayout pair.2).run state).2.functionLayout.auxiliaries)
+      branches.toList cases)
+    (defaultEffects : List.Forall₂ (fun block emission => ∀ state : LayoutMState,
+      state.degrees = initial.degrees →
+      state.functionLayout.auxiliaries = initial.functionLayout.auxiliaries + branches.size →
+      measure emission = base + ((blockLayout block).run state).2.functionLayout.auxiliaries)
+      fallback.toList defaults) :
+    ((ctrlLayout (.match index branches fallback)).run initial).2.degrees = initial.degrees ∧
+    base + ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.auxiliaries =
+      (cases ++ defaults).foldl (fun current emission => max current (measure emission))
+        (base + initial.functionLayout.auxiliaries) := by
+  let shared : SharedData := ⟨initial.functionLayout.auxiliaries, initial.functionLayout.lookups⟩
+  let loop : LayoutM SharedData := branches.attach.foldlM
+    (fun acc pair => allocationBranchStep shared initial.degrees acc pair.val.2) shared
+  have loopResult : (loop.run initial).2.degrees = initial.degrees ∧
+      base + (loop.run initial).1.auxiliaries =
+        cases.foldl (fun current emission => max current (measure emission))
+          (base + initial.functionLayout.auxiliaries) := by
+    dsimp only [loop]
+    rw [allocationBranchLoop]
+    exact allocationBranchFold Prod.snd measure shared initial.degrees base caseEffects shared initial rfl
+  rw [ctrlLayout.eq_def]
+  cases fallback with
+  | none =>
+    cases defaultEffects
+    change (loop.run initial).2.degrees = initial.degrees ∧
+      base + (loop.run initial).1.auxiliaries = _
+    simpa only [List.append_nil] using loopResult
+  | some block =>
+    cases defaultEffects with
+    | cons effect tail =>
+      cases tail
+      let before := ((bumpAuxiliaries branches.size).run
+        ((setSharedData shared).run (loop.run initial).2).2).2
+      have body := effect before loopResult.1 rfl
+      change initial.degrees = initial.degrees ∧
+        base + max (loop.run initial).1.auxiliaries
+          ((blockLayout block).run before).2.functionLayout.auxiliaries = _
+      constructor
+      · rfl
+      · rw [← Nat.add_max_add_left, ← body, loopResult.2]
+        simp only [List.foldl_append, List.foldl_cons, List.foldl_nil]
+
+theorem ctrlLayout_continue (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (size aux slots : Nat) (continuation : Block) :
+    ctrlLayout (.matchContinue index branches fallback size aux slots continuation) = (do
+      ctrlLayout (.match index branches fallback)
+      bumpAuxiliaries size
+      pushDegrees (.replicate size 1)
+      blockLayout continuation) := by
+  cases fallback <;> simp only [ctrlLayout.eq_def, bind_assoc]
+  all_goals rfl
+
+end Aiur.Concrete.Bytecode
diff --git a/Ix/Aiur/Proofs/CompilerLayout.lean b/Ix/Aiur/Proofs/CompilerLayout.lean
new file mode 100644
index 000000000..2f9df1188
--- /dev/null
+++ b/Ix/Aiur/Proofs/CompilerLayout.lean
@@ -0,0 +1,316 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CompilerBranches
+
+/-! The compiler preserves input width, counts every leaf selector, and
+retains the reserved auxiliary columns through branches and continuations. -/
+
+namespace Aiur.Concrete.Bytecode
+open Aiur.Bytecode
+
+theorem opLayout_fixed (op : Op) (initial : LayoutMState) :
+    ((opLayout op).run initial).2.functionLayout.inputSize = initial.functionLayout.inputSize ∧
+    ((opLayout op).run initial).2.functionLayout.selectors = initial.functionLayout.selectors := by
+  cases op <;>
+    simp only [opLayout, getDegree_array, bumpLookups, bumpAuxiliaries, getDegree,
+      pushDegree, pushDegrees, addMemSize]
+  all_goals dsimp [StateT.run, StateT.bind, StateT.pure, StateT.get, StateT.modifyGet,
+    get, getThe, MonadStateOf.get, modify, modifyGet, MonadStateOf.modifyGet,
+    instMonadStateOfMonadStateOf, instMonadStateOfStateTOfMonad, bind, pure]
+  all_goals try split
+  all_goals exact ⟨rfl, rfl⟩
+
+private theorem ops_fold_fields (ops : List Op) (initial : LayoutMState) :
+    let final := ((ops.foldlM (fun _ op => opLayout op) ()).run initial).2.functionLayout
+    final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors ∧
+    initial.functionLayout.auxiliaries ≤ final.auxiliaries := by
+  induction ops generalizing initial with
+  | nil => exact ⟨rfl, rfl, Nat.le_refl _⟩
+  | cons op ops ih =>
+    rw [List.foldlM_cons]
+    have fixed := opLayout_fixed op initial
+    have allocated := (opLayout_allocation op initial).2
+    have rest := ih ((opLayout op).run initial).2
+    exact ⟨rest.1.trans fixed.1, rest.2.1.trans fixed.2,
+      Nat.le_trans (by rw [allocated]; exact Nat.le_add_right _ _) rest.2.2⟩
+
+theorem opsLayout_fields (ops : Array Op) (initial : LayoutMState) :
+    let final := ((ops.forM opLayout).run initial).2.functionLayout
+    final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors ∧
+    initial.functionLayout.auxiliaries ≤ final.auxiliaries := by
+  unfold Array.forM
+  rw [← Array.foldlM_toList]
+  exact ops_fold_fields ops.toList initial
+
+theorem allocationBranchStep_fields (shared : SharedData) (degrees : Array Nat) (acc : SharedData)
+    (block : Block) (initial : LayoutMState)
+    (effect : ∀ state : LayoutMState,
+      ((blockLayout block).run state).2.functionLayout.inputSize = state.functionLayout.inputSize ∧
+      ((blockLayout block).run state).2.functionLayout.selectors =
+        state.functionLayout.selectors + block.controlCounts.leaves) :
+    let final := (allocationBranchStep shared degrees acc block).run initial
+    final.2.functionLayout.inputSize = initial.functionLayout.inputSize ∧
+    final.2.functionLayout.selectors = initial.functionLayout.selectors + block.controlCounts.leaves ∧
+    acc.auxiliaries ≤ final.1.auxiliaries := by
+  have body := effect ((setSharedData shared).run initial).2
+  exact ⟨body.1, body.2, Nat.le_max_left _ _⟩
+
+theorem allocationBranchFold_fields {α : Type} (items : List α) (blockOf : α → Block)
+    (shared : SharedData) (degrees : Array Nat) (acc : SharedData) (initial : LayoutMState)
+    (effect : ∀ item ∈ items, ∀ state : LayoutMState,
+      ((blockLayout (blockOf item)).run state).2.functionLayout.inputSize = state.functionLayout.inputSize ∧
+      ((blockLayout (blockOf item)).run state).2.functionLayout.selectors =
+        state.functionLayout.selectors + (blockOf item).controlCounts.leaves) :
+    let final := (items.foldlM (fun acc item => allocationBranchStep shared degrees acc (blockOf item)) acc).run initial
+    final.2.functionLayout.inputSize = initial.functionLayout.inputSize ∧
+    final.2.functionLayout.selectors = initial.functionLayout.selectors +
+      (items.map (fun item => (blockOf item).controlCounts.leaves)).sum ∧
+    acc.auxiliaries ≤ final.1.auxiliaries := by
+  induction items generalizing acc initial with
+  | nil => exact ⟨rfl, (Nat.add_zero _).symm, Nat.le_refl _⟩
+  | cons item items ih =>
+    rw [List.foldlM_cons]
+    have first := allocationBranchStep_fields shared degrees acc (blockOf item) initial
+      (effect item List.mem_cons_self)
+    have rest := ih ((allocationBranchStep shared degrees acc (blockOf item)).run initial).1
+      ((allocationBranchStep shared degrees acc (blockOf item)).run initial).2
+      (fun item member => effect item (List.mem_cons_of_mem _ member))
+    refine ⟨rest.1.trans first.1, ?_, Nat.le_trans first.2.2 rest.2.2⟩
+    exact rest.2.1.trans (by rw [first.2.1]; simp only [List.map_cons, List.sum_cons, Nat.add_assoc])
+
+theorem matchLayout_fields (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (initial : LayoutMState)
+    (caseEffect : ∀ pair ∈ branches.toList, ∀ state : LayoutMState,
+      ((blockLayout pair.2).run state).2.functionLayout.inputSize = state.functionLayout.inputSize ∧
+      ((blockLayout pair.2).run state).2.functionLayout.selectors =
+        state.functionLayout.selectors + pair.2.controlCounts.leaves)
+    (defaultEffect : ∀ block, fallback = some block → ∀ state : LayoutMState,
+      ((blockLayout block).run state).2.functionLayout.inputSize = state.functionLayout.inputSize ∧
+      ((blockLayout block).run state).2.functionLayout.selectors =
+        state.functionLayout.selectors + block.controlCounts.leaves) :
+    let final := ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout
+    final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors +
+      (ControlCounts.sum (branchControlCounts branches fallback)).leaves ∧
+    initial.functionLayout.auxiliaries ≤ final.auxiliaries := by
+  let shared : SharedData := ⟨initial.functionLayout.auxiliaries, initial.functionLayout.lookups⟩
+  let loop : LayoutM SharedData := branches.attach.foldlM
+    (fun acc pair => allocationBranchStep shared initial.degrees acc pair.val.2) shared
+  have loopResult : (loop.run initial).2.functionLayout.inputSize = initial.functionLayout.inputSize ∧
+      (loop.run initial).2.functionLayout.selectors = initial.functionLayout.selectors +
+        (branches.toList.map (fun pair => pair.2.controlCounts.leaves)).sum ∧
+      initial.functionLayout.auxiliaries ≤ (loop.run initial).1.auxiliaries := by
+    dsimp only [loop]
+    rw [allocationBranchLoop]
+    exact allocationBranchFold_fields branches.toList Prod.snd shared initial.degrees shared initial caseEffect
+  rw [ctrlLayout.eq_def]
+  cases present : fallback with
+  | none =>
+    change (loop.run initial).2.functionLayout.inputSize = _ ∧
+      (loop.run initial).2.functionLayout.selectors = _ ∧
+      initial.functionLayout.auxiliaries ≤ (loop.run initial).1.auxiliaries
+    simpa only [branchControlCounts, ControlCounts.sum, Option.toList_none, List.map_nil,
+      List.append_nil, List.map_map, Function.comp_def] using loopResult
+  | some block =>
+    let before := ((bumpAuxiliaries branches.size).run ((setSharedData shared).run (loop.run initial).2).2).2
+    have body := defaultEffect block present before
+    change ((blockLayout block).run before).2.functionLayout.inputSize = _ ∧
+      ((blockLayout block).run before).2.functionLayout.selectors = _ ∧
+      initial.functionLayout.auxiliaries ≤ max (loop.run initial).1.auxiliaries _
+    refine ⟨body.1.trans loopResult.1, ?_, Nat.le_trans loopResult.2.2 (Nat.le_max_left _ _)⟩
+    rw [body.2]
+    change (loop.run initial).2.functionLayout.selectors + block.controlCounts.leaves = _
+    rw [loopResult.2.1]
+    simp only [branchControlCounts, ControlCounts.sum, Option.toList_some, List.map_cons,
+      List.map_nil, List.map_append, List.map_map, Function.comp_def, List.sum_append,
+      List.sum_cons, List.sum_nil, Nat.add_zero, Nat.add_assoc]
+
+private theorem layout_case_smaller {branches : Array (G × Block)} {pair : G × Block}
+    (member : pair ∈ branches.toList) : sizeOf pair.2 < sizeOf branches := by
+  have bound := Array.sizeOf_lt_of_mem (Array.mem_toList_iff.mp member)
+  cases pair
+  simp at bound ⊢
+  omega
+
+private theorem layout_default_smaller {fallback : Option Block} {block : Block}
+    (present : fallback = some block) : sizeOf block < sizeOf fallback := by
+  rw [present]
+  simp
+
+mutual
+
+theorem ctrlLayout_fields (ctrl : Ctrl) (initial : LayoutMState) :
+    let final := ((ctrlLayout ctrl).run initial).2.functionLayout
+    final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors + ctrl.controlCounts.leaves ∧
+    initial.functionLayout.auxiliaries ≤ final.auxiliaries := by
+  cases ctrl with
+  | «return» index indices | yield index indices =>
+    rw [ctrlLayout.eq_def, Ctrl.controlCounts.eq_def]
+    exact ⟨rfl, rfl, Nat.le_refl _⟩
+  | «match» index branches fallback =>
+    rw [Ctrl.controlCounts_match]
+    exact matchLayout_fields index branches fallback initial
+      (fun pair member state => ⟨(blockLayout_fields pair.2 state).1, (blockLayout_fields pair.2 state).2.1⟩)
+      (fun block present state => ⟨(blockLayout_fields block state).1, (blockLayout_fields block state).2.1⟩)
+  | matchContinue index branches fallback size aux slots continuation =>
+    have first := matchLayout_fields index branches fallback initial
+      (fun pair member state => ⟨(blockLayout_fields pair.2 state).1, (blockLayout_fields pair.2 state).2.1⟩)
+      (fun block present state => ⟨(blockLayout_fields block state).1, (blockLayout_fields block state).2.1⟩)
+    let before := ((pushDegrees (.replicate size 1)).run ((bumpAuxiliaries size).run
+      ((ctrlLayout (.match index branches fallback)).run initial).2).2).2
+    have rest := blockLayout_fields continuation before
+    rw [ctrlLayout_continue, Ctrl.controlCounts_matchContinue]
+    refine ⟨rest.1.trans first.1, ?_, ?_⟩
+    · change ((blockLayout continuation).run before).2.functionLayout.selectors = _
+      rw [rest.2.1]
+      change ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.selectors + _ = _
+      rw [first.2.1, Nat.add_assoc]
+      rfl
+    · have monotone := rest.2.2
+      change ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.auxiliaries + size ≤ _ at monotone
+      exact Nat.le_trans first.2.2 (Nat.le_trans (Nat.le_add_right _ _) monotone)
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals subst ctrl
+  all_goals first
+    | (have bound := layout_case_smaller ‹_ ∈ _›; simp; omega)
+    | (have bound := layout_default_smaller ‹_ = some _›; simp; omega)
+    | decreasing_tactic
+
+theorem blockLayout_fields (block : Block) (initial : LayoutMState) :
+    let final := ((blockLayout block).run initial).2.functionLayout
+    final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors + block.controlCounts.leaves ∧
+    initial.functionLayout.auxiliaries ≤ final.auxiliaries := by
+  rw [blockLayout, Block.controlCounts]
+  have first := opsLayout_fields block.ops initial
+  have rest := ctrlLayout_fields block.ctrl ((block.ops.forM opLayout).run initial).2
+  exact ⟨rest.1.trans first.1, rest.2.1.trans (congrArg (· + block.ctrl.controlCounts.leaves) first.2.1),
+    Nat.le_trans first.2.2 rest.2.2⟩
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+theorem ctrlLayout_match_list (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block) :
+    ctrlLayout (.match index branches fallback) = (do
+      let shared ← getSharedData
+      let degrees ← getDegrees
+      let acc ← branches.toList.foldlM (fun acc pair => allocationBranchStep shared degrees acc pair.2) shared
+      let final ← match fallback with
+        | none => pure acc
+        | some block => do
+          setSharedData shared
+          bumpAuxiliaries branches.size
+          blockLayout block
+          let used ← getSharedData
+          setDegrees degrees
+          pure (acc.maximals used)
+      setSharedData final) := by
+  rw [ctrlLayout.eq_def]
+  change (do
+    let shared ← getSharedData
+    let degrees ← getDegrees
+    let acc ← branches.attach.foldlM
+      (fun acc (pair : {pair // pair ∈ branches}) => allocationBranchStep shared degrees acc pair.val.2) shared
+    let final ← match fallback with
+      | none => pure acc
+      | some block => do
+        setSharedData shared
+        bumpAuxiliaries branches.size
+        blockLayout block
+        let used ← getSharedData
+        setDegrees degrees
+        pure (acc.maximals used)
+    setSharedData final) = _
+  simp only [allocationBranchLoop]
+
+theorem rewriteOp_layout (rename : FunIdx → FunIdx) (op : Op) :
+    opLayout (rewriteOp rename op) = opLayout op := by
+  cases op <;> rfl
+
+private theorem rewrite_branches_list (rename : FunIdx → FunIdx) (branches : Array (G × Block)) :
+    (branches.attach.map fun ⟨(tag, block), _⟩ => (tag, rewriteBlock rename block)).toList =
+      branches.toList.map (fun pair => (pair.1, rewriteBlock rename pair.2)) := by
+  simp only [Array.toList_map, Array.toList_attach]
+  exact List.attachWith_map_val (f := fun pair : G × Block => (pair.1, rewriteBlock rename pair.2)) _
+
+private theorem foldlM_equal {α β : Type} {m : Type → Type} [Monad m] [LawfulMonad m]
+    (items : List α) (first second : β → α → m β)
+    (equal : ∀ item ∈ items, ∀ acc, first acc item = second acc item) (initial : β) :
+    items.foldlM first initial = items.foldlM second initial := by
+  induction items generalizing initial with
+  | nil => rfl
+  | cons item items ih =>
+    simp only [List.foldlM_cons, equal item List.mem_cons_self]
+    congr 1
+    funext acc
+    exact ih (fun item member => equal item (List.mem_cons_of_mem _ member)) acc
+
+theorem matchLayout_rewrite (rename : FunIdx → FunIdx) (index : ValIdx)
+    (branches : Array (G × Block)) (fallback : Option Block)
+    (caseEqual : ∀ pair ∈ branches.toList, blockLayout (rewriteBlock rename pair.2) = blockLayout pair.2)
+    (defaultEqual : ∀ block, fallback = some block → blockLayout (rewriteBlock rename block) = blockLayout block) :
+    ctrlLayout (.match index
+      (branches.attach.map fun ⟨(tag, block), _⟩ => (tag, rewriteBlock rename block))
+      (fallback.map (rewriteBlock rename))) = ctrlLayout (.match index branches fallback) := by
+  rw [ctrlLayout_match_list, ctrlLayout_match_list, rewrite_branches_list]
+  simp only [List.foldlM_map]
+  have loops (shared : SharedData) (degrees : Array Nat) :
+      branches.toList.foldlM (fun acc pair => allocationBranchStep shared degrees acc (rewriteBlock rename pair.2)) shared =
+        branches.toList.foldlM (fun acc pair => allocationBranchStep shared degrees acc pair.2) shared := by
+    apply foldlM_equal
+    intro pair member acc
+    simp only [allocationBranchStep, caseEqual pair member]
+  simp only [loops, Array.size_map, Array.size_attach]
+  cases present : fallback with
+  | none => rfl
+  | some block => simp only [Option.map_some, defaultEqual block present]
+
+mutual
+
+theorem rewriteCtrl_layout (rename : FunIdx → FunIdx) (ctrl : Ctrl) :
+    ctrlLayout (rewriteCtrl rename ctrl) = ctrlLayout ctrl := by
+  cases ctrl with
+  | «return» index indices | yield index indices => rw [rewriteCtrl.eq_def]
+  | «match» index branches fallback =>
+    rw [rewriteCtrl.eq_def]
+    have equal := matchLayout_rewrite rename index branches fallback
+      (fun pair member => rewriteBlock_layout rename pair.2)
+      (fun block present => rewriteBlock_layout rename block)
+    cases fallback <;> exact equal
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [rewriteCtrl.eq_def, ctrlLayout_continue, ctrlLayout_continue, rewriteBlock_layout]
+    have equal := matchLayout_rewrite rename index branches fallback
+      (fun pair member => rewriteBlock_layout rename pair.2)
+      (fun block present => rewriteBlock_layout rename block)
+    congr 1
+    cases fallback <;> exact equal
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals subst ctrl
+  all_goals first
+    | (have bound := layout_case_smaller ‹_ ∈ _›; simp; omega)
+    | (have bound := layout_default_smaller ‹_ = some _›; simp; omega)
+    | decreasing_tactic
+
+theorem rewriteBlock_layout (rename : FunIdx → FunIdx) (block : Block) :
+    blockLayout (rewriteBlock rename block) = blockLayout block := by
+  rw [rewriteBlock, blockLayout, blockLayout, rewriteCtrl_layout]
+  congr 1
+  simp only [Array.forM, ← Array.foldlM_toList, Array.toList_map, List.foldlM_map]
+  apply foldlM_equal
+  intro op _ _
+  exact rewriteOp_layout rename op
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+end Aiur.Concrete.Bytecode
diff --git a/Ix/Aiur/Proofs/Dedup.lean b/Ix/Aiur/Proofs/Dedup.lean
new file mode 100644
index 000000000..96d754b3a
--- /dev/null
+++ b/Ix/Aiur/Proofs/Dedup.lean
@@ -0,0 +1,67 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Renaming
+
+/-! The actual deduplication pass validates its proposed transformation.
+These proofs require no correctness assumption about partition refinement. -/
+
+namespace Aiur.Bytecode.Eval
+
+theorem validatesRenaming_sound {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (valid : validatesRenaming a b (boundedRenaming a rename) = true) :
+    RenamedCode a b (boundedRenaming a rename) := by
+  simp only [validatesRenaming, Bool.and_eq_true, decide_eq_true_eq] at valid
+  have all := Array.all_eq_true.mp valid.2
+  simp only [Array.size_range, Array.getElem_range] at all
+  have checked (i : Nat) (hi : i < a.functions.size) :
+      ∃ hj : boundedRenaming a rename i < b.functions.size,
+        a.functions[i].layout = b.functions[boundedRenaming a rename i].layout ∧
+        rewriteBlock (boundedRenaming a rename) a.functions[i].body =
+          b.functions[boundedRenaming a rename i].body := by
+    have h := all i hi
+    simp only [dif_pos hi] at h
+    split at h
+    next hj => exact ⟨hj, by simpa only [Bool.and_eq_true, beq_iff_eq] using h⟩
+    next hj => contradiction
+  constructor
+  · intro i
+    constructor
+    · intro hi
+      obtain ⟨hj, _⟩ := checked i hi
+      exact hj
+    · intro hj
+      by_cases hi : i < a.functions.size
+      · exact hi
+      · simp only [boundedRenaming, if_neg hi] at hj
+        exact Nat.lt_of_lt_of_le hj valid.1
+  · intro i hi hj
+    obtain ⟨_, _, body⟩ := checked i hi
+    exact body
+  · intro i hi hj
+    obtain ⟨_, layout, _⟩ := checked i hi
+    exact congrArg FunctionLayout.inputSize layout
+
+theorem checkedRenaming_preserves_execution (source candidate : Toplevel) (rename : FunIdx → FunIdx)
+    (function : FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat) (result : Array G × IOBuffer) :
+    runFunction source function args io fuel = .ok result ↔
+      runFunction (checkedRenaming source candidate rename).1
+        ((checkedRenaming source candidate rename).2 function)
+        args io fuel = .ok result := by
+  unfold checkedRenaming
+  dsimp only
+  split
+  next valid => exact runFunction_renamed_iff (validatesRenaming_sound valid) function args io fuel result
+  next invalid => rfl
+
+theorem deduplicate_preserves_execution (source : Toplevel)
+    (function : FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat) (result : Array G × IOBuffer) :
+    runFunction source function args io fuel = .ok result ↔
+      runFunction source.deduplicate.1 (source.deduplicate.2 function)
+        args io fuel = .ok result :=
+  checkedRenaming_preserves_execution source source.deduplicateCandidate.1 source.deduplicateCandidate.2
+    function args io fuel result
+
+end Aiur.Bytecode.Eval
diff --git a/Ix/Aiur/Proofs/Domain.lean b/Ix/Aiur/Proofs/Domain.lean
new file mode 100644
index 000000000..2321e26d8
--- /dev/null
+++ b/Ix/Aiur/Proofs/Domain.lean
@@ -0,0 +1,179 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Domain
+import Ix.Aiur.Proofs.SelectorAlgebra
+
+/-! Exact orders and row locations for all 33 native trace-domain generators.
+The finite certificates evaluate bounded repeated squaring in the kernel;
+the domain itself is represented by an index function, without enumeration.
+-/
+
+namespace Aiur.NativeAIR.Domain
+
+open Lean.Grind
+
+theorem ofLogSize_some {bits : Nat} {domain : Subgroup}
+    (accepted : ofLogSize bits = some domain) : domain.val = bits := by
+  simp only [ofLogSize] at accepted
+  split at accepted
+  · exact congrArg Fin.val (Option.some.inj accepted).symm
+  · cases accepted
+
+theorem ofLogSize_defined (bits : Nat) : (ofLogSize bits).isSome = (bits < 33) := by
+  simp only [ofLogSize]
+  split <;> simp_all
+
+theorem size_positive (domain : Subgroup) : 0 < size domain := Nat.two_pow_pos _
+
+theorem size_bound (domain : Subgroup) : size domain ≤ 2 ^ 32 := by
+  apply Nat.pow_le_pow_right (by decide)
+  have := domain.isLt
+  omega
+
+theorem size_lt_characteristic (domain : Subgroup) : size domain < gSize.toNat :=
+  Nat.lt_of_le_of_lt (size_bound domain) (by decide)
+
+theorem size_lt_u64 (domain : Subgroup) : size domain < 2 ^ 64 :=
+  Nat.lt_of_le_of_lt (size_bound domain) (by decide)
+
+theorem generator_zero : generator 0 = 1 := by decide +kernel
+
+theorem generator_square_certificate : ∀ index : Fin 32,
+    generator ⟨index.val + 1, by omega⟩ * generator ⟨index.val + 1, by omega⟩ =
+      generator ⟨index.val, by omega⟩ := by
+  decide +kernel
+
+theorem generator_full_certificate : ∀ domain : Subgroup,
+    G.pow (generator domain) (size domain) = 1 := by
+  decide +kernel
+
+theorem generator_half_certificate : ∀ index : Fin 32,
+    G.pow (generator ⟨index.val + 1, by omega⟩) (2 ^ index.val) = 0 - 1 := by
+  decide +kernel
+
+theorem generator_power (domain : Subgroup) : generator domain ^ size domain = 1 := by
+  rw [← G.pow_eq _ _ (size_lt_u64 domain)]
+  exact generator_full_certificate domain
+
+theorem generator_half (index : Fin 32) :
+    generator ⟨index.val + 1, by omega⟩ ^ (2 ^ index.val) = 0 - 1 := by
+  rw [← G.pow_eq _ _ (by
+    apply Nat.lt_of_le_of_lt (Nat.pow_le_pow_right (by decide) (Nat.le_of_lt index.isLt))
+    decide)]
+  exact generator_half_certificate index
+
+theorem generator_nonzero (domain : Subgroup) : generator domain ≠ 0 := by
+  intro zero
+  have power := generator_power domain
+  have positive := size_positive domain
+  have successor : size domain = (size domain - 1) + 1 := by omega
+  rw [zero, successor, Semiring.pow_succ, G.mul_zero] at power
+  exact G.one_ne_zero power.symm
+
+theorem point_eq (domain : Subgroup) (index : Fin (size domain)) :
+    point domain index = generator domain ^ index.val :=
+  G.pow_eq _ _ (Nat.lt_trans index.isLt (size_lt_u64 domain))
+
+theorem point_injective (domain : Subgroup) {i j : Fin (size domain)}
+    (equal : point domain i = point domain j) : i = j := by
+  apply Fin.ext
+  cases domain with
+  | mk bits bounded =>
+    cases bits with
+    | zero => have := i.isLt; have := j.isLt; simp only [size, Nat.pow_zero] at *; omega
+    | succ bits =>
+      have full := congrArg G.n (generator_power ⟨bits + 1, bounded⟩)
+      have half := congrArg G.n (generator_half ⟨bits, by omega⟩)
+      have same := congrArg G.n equal
+      simp only [point_eq, G.n_power] at same
+      simp only [G.n_power, size] at full half
+      apply GoldilocksProof.pow_mod_injective (by decide) full
+        (fun h => (by decide : G.n (0 - 1) ≠ 1) (half.symm.trans h)) i.isLt j.isLt same
+
+theorem generator_order (domain : Subgroup) (n : Nat) :
+    generator domain ^ n = 1 ↔ size domain ∣ n := by
+  have period := Algebra.power_period (generator domain) (generator_power domain) n
+  constructor
+  · intro equal
+    have same : point domain ⟨n % size domain, Nat.mod_lt _ (size_positive domain)⟩ =
+        point domain ⟨0, size_positive domain⟩ := by
+      simp only [point_eq, Semiring.pow_zero]
+      exact period.symm.trans equal
+    have zero := congrArg Fin.val (point_injective domain same)
+    exact Nat.dvd_of_mod_eq_zero zero
+  · intro divides
+    rw [period, Nat.mod_eq_zero_of_dvd divides, Semiring.pow_zero]
+
+theorem point_zero (domain : Subgroup) : point domain ⟨0, size_positive domain⟩ = 1 := by
+  rw [point_eq, Semiring.pow_zero]
+
+theorem point_power (domain : Subgroup) (index : Fin (size domain)) :
+    point domain index ^ size domain = 1 := by
+  rw [point_eq, ← Algebra.power_mul, Nat.mul_comm, Algebra.power_mul,
+    generator_power, Semiring.one_pow]
+
+theorem point_nonzero (domain : Subgroup) (index : Fin (size domain)) :
+    point domain index ≠ 0 := by
+  intro zero
+  have power := point_power domain index
+  rw [zero, Algebra.power_zero _ (size_positive domain)] at power
+  exact G.one_ne_zero power.symm
+
+theorem point_next (domain : Subgroup) (index : Fin (size domain)) :
+    point domain ⟨(index.val + 1) % size domain, Nat.mod_lt _ (size_positive domain)⟩ =
+      point domain index * generator domain := by
+  rw [point_eq, point_eq, ← Algebra.power_period _ (generator_power domain), Semiring.pow_succ]
+
+theorem point_first_iff (domain : Subgroup) (index : Fin (size domain)) :
+    point domain index = 1 ↔ index.val = 0 := by
+  constructor
+  · intro equal
+    exact congrArg Fin.val (point_injective domain (equal.trans (point_zero domain).symm))
+  · intro zero
+    rw [point_eq, zero, Semiring.pow_zero]
+
+theorem lastPoint_eq_power (domain : Subgroup) :
+    lastPoint domain = generator domain ^ (size domain - 1) := by
+  exact (Algebra.predecessor_inverse _ _ (size_positive domain) (generator_power domain)
+    (G.mul_inverse_cancel _ (generator_nonzero domain))).symm
+
+theorem point_last (domain : Subgroup) :
+    point domain ⟨size domain - 1, by have := size_positive domain; omega⟩ = lastPoint domain := by
+  rw [point_eq, lastPoint_eq_power]
+
+theorem lastPoint_power (domain : Subgroup) : lastPoint domain ^ size domain = 1 := by
+  rw [← point_last domain]
+  exact point_power _ _
+
+theorem point_last_iff (domain : Subgroup) (index : Fin (size domain)) :
+    point domain index = lastPoint domain ↔ index.val = size domain - 1 := by
+  constructor
+  · intro equal
+    exact congrArg Fin.val (point_injective domain (equal.trans (point_last domain).symm))
+  · intro equal
+    rw [point_eq, equal, lastPoint_eq_power]
+
+theorem lastPoint_nonzero (domain : Subgroup) : lastPoint domain ≠ 0 := by
+  rw [← point_last domain]
+  exact point_nonzero _ _
+
+theorem lastPoint_inverse (domain : Subgroup) : lastPoint domain * generator domain = 1 := by
+  rw [G.mul_comm]
+  exact G.mul_inverse_cancel _ (generator_nonzero domain)
+
+theorem lastPoint_predecessor (domain : Subgroup) :
+    lastPoint domain ^ (size domain - 1) = generator domain :=
+  Algebra.predecessor_inverse _ _ (size_positive domain) (lastPoint_power domain)
+    (lastPoint_inverse domain)
+
+theorem normalizer_nonzero (domain : Subgroup) : normalizer domain ≠ 0 := by
+  intro zero
+  have factors := (G.mul_eq_zero_iff _ _).mp zero
+  exact factors.elim
+    (G.ofNat_ne_zero_of_lt (size_positive domain) (size_lt_characteristic domain))
+    (generator_nonzero domain)
+
+end Aiur.NativeAIR.Domain
diff --git a/Ix/Aiur/Proofs/DomainAccumulator.lean b/Ix/Aiur/Proofs/DomainAccumulator.lean
new file mode 100644
index 000000000..b6ed1fa3f
--- /dev/null
+++ b/Ix/Aiur/Proofs/DomainAccumulator.lean
@@ -0,0 +1,142 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Selectors
+import Ix.Aiur.Proofs.LogUpAccumulator
+
+/-! Actual domain normalization discharges the scaled boundary injection.
+Every checked group in every cyclic trace row contributes to the circuit's
+lookup fraction sum, provided the compressed base-field messages avoid poles.
+-/
+
+namespace Aiur.NativeAIR.LogUp
+
+open ProofCodec (Extension)
+
+theorem normalized_injection (domain : Domain.Subgroup) (index : Fin (Domain.size domain))
+    (delta : Coordinates G) :
+    (delta.scale (Domain.normalizer domain).inverse).scale
+      (Domain.Algebra.dividedPowers (Domain.point domain index) (Domain.lastPoint domain) (Domain.size domain)) =
+      if index.val = Domain.size domain - 1 then delta else 0 := by
+  rw [Domain.last_at_row]
+  have cancel : (Domain.normalizer domain).inverse * Domain.normalizer domain = 1 := by
+    rw [G.mul_comm]
+    exact G.mul_inverse_cancel _ (Domain.normalizer_nonzero domain)
+  by_cases last : index.val = Domain.size domain - 1
+  · simp only [if_pos last]
+    apply Coordinates.ext <;> simp only [Coordinates.scale] <;> rw [G.mul_assoc, cancel, G.mul_one]
+  · simp only [if_neg last]
+    apply Coordinates.ext <;> simp only [Coordinates.scale, G.mul_zero] <;> rfl
+
+theorem equations_domain_row (domain : Domain.Subgroup) (index : Fin (Domain.size domain))
+    {lookups : List (G × List G)} {stageCurrent stageNext publics deltaScaled : Array G}
+    {groupSize : Nat} {result : List (Coordinates G)} {beta gamma delta : Coordinates G}
+    (betaRead : Coordinates.read publics 0 = some beta) (gammaRead : Coordinates.read publics 1 = some gamma)
+    (deltaRead : Coordinates.read deltaScaled 0 = some (delta.scale (Domain.normalizer domain).inverse))
+    (accepted : equations lookups stageCurrent stageNext publics deltaScaled
+      (Domain.Algebra.dividedPowers (Domain.point domain index) (Domain.lastPoint domain) (Domain.size domain))
+      groupSize = some result)
+    (zero : ∀ value ∈ result, value = 0)
+    (free : PoleFree (fieldEntries (compress beta gamma lookups))) :
+    ∃ first next, Coordinates.read stageCurrent 0 = some first ∧
+      Coordinates.read stageNext 0 = some next ∧
+      next.toExtension - first.toExtension +
+        (if index.val = Domain.size domain - 1 then delta.toExtension else 0) =
+          lookupFractions beta gamma lookups := by
+  obtain ⟨first, next, scaled, hf, hn, hd, equation⟩ := equations_accumulator betaRead gammaRead accepted zero free
+  have same := Option.some.inj (hd.symm.trans deltaRead)
+  subst scaled
+  rw [normalized_injection] at equation
+  refine ⟨first, next, hf, hn, ?_⟩
+  by_cases last : index.val = Domain.size domain - 1
+  · simpa only [if_pos last] using equation
+  · have zeroEmbed : (0 : Coordinates G).toExtension = 0 := (Coordinates.toExtension_zero_iff _).mpr rfl
+    simpa only [if_neg last, zeroEmbed] using equation
+
+theorem equations_domain_sum (domain : Domain.Subgroup)
+    (lookups : Fin (Domain.size domain) → List (G × List G))
+    (stageRows : Fin (Domain.size domain) → Array G) (publics deltaScaled : Array G)
+    (groupSize : Nat) (beta gamma delta : Coordinates G)
+    (betaRead : Coordinates.read publics 0 = some beta) (gammaRead : Coordinates.read publics 1 = some gamma)
+    (deltaRead : Coordinates.read deltaScaled 0 = some (delta.scale (Domain.normalizer domain).inverse))
+    (rows : ∀ index : Fin (Domain.size domain), ∃ result,
+      equations (lookups index) (stageRows index)
+        (stageRows ⟨(index.val + 1) % Domain.size domain, Nat.mod_lt _ (Domain.size_positive domain)⟩)
+        publics deltaScaled
+        (Domain.Algebra.dividedPowers (Domain.point domain index) (Domain.lastPoint domain) (Domain.size domain))
+        groupSize = some result ∧ (∀ value ∈ result, value = 0))
+    (free : ∀ index, PoleFree (fieldEntries (compress beta gamma (lookups index)))) :
+    sum (List.ofFn fun index => lookupFractions beta gamma (lookups index)) = delta.toExtension := by
+  let rowIndex := fun index => (⟨index % Domain.size domain, Nat.mod_lt _ (Domain.size_positive domain)⟩ :
+    Fin (Domain.size domain))
+  let states := fun index => ((Coordinates.read (stageRows (rowIndex index)) 0).getD 0).toExtension
+  let fractions := fun index => lookupFractions beta gamma (lookups (rowIndex index))
+  have wrap : states (Domain.size domain) = states 0 := by
+    simp only [states, rowIndex, Nat.mod_self, Nat.zero_mod]
+  have steps : ∀ index, index < Domain.size domain →
+      states (index + 1) - states index +
+        (if index + 1 = Domain.size domain then delta.toExtension else 0) = fractions index := by
+    intro index bound
+    let i : Fin (Domain.size domain) := ⟨index, bound⟩
+    obtain ⟨result, accepted, zero⟩ := rows i
+    obtain ⟨first, next, hf, hn, equation⟩ :=
+      equations_domain_row domain i betaRead gammaRead deltaRead accepted zero (free i)
+    dsimp only [i] at hf hn
+    have source : states index = first.toExtension := by
+      simp only [states, rowIndex, Nat.mod_eq_of_lt bound, hf, Option.getD_some]
+    have target : states (index + 1) = next.toExtension := by
+      simp only [states, rowIndex, hn, Option.getD_some]
+    have fraction : fractions index = lookupFractions beta gamma (lookups i) := by
+      simp only [fractions, rowIndex, Nat.mod_eq_of_lt bound, i]
+    rw [source, target, fraction]
+    have condition : (i.val = Domain.size domain - 1) ↔ (index + 1 = Domain.size domain) := by
+      have := Domain.size_positive domain
+      simp only [i]
+      omega
+    simpa only [condition] using equation
+  have total := cyclic_accumulator states fractions (Domain.size domain) delta.toExtension
+    (Domain.size_positive domain) wrap steps
+  have enumeration : (List.range (Domain.size domain)).map fractions =
+      List.ofFn (fun index => lookupFractions beta gamma (lookups index)) := by
+    apply List.ext_getElem
+    · simp only [List.length_map, List.length_range, List.length_ofFn]
+    · intro index left right
+      have bound : index < Domain.size domain := by simpa only [List.length_ofFn] using right
+      simp only [List.getElem_map, List.getElem_range, List.getElem_ofFn,
+        fractions, rowIndex, Nat.mod_eq_of_lt bound]
+  rwa [enumeration] at total
+
+theorem constraintValues_domain_sum (domain : Domain.Subgroup) (lookups : List Lookup)
+    (nodeRows stageRows : Fin (Domain.size domain) → Array G) (publics deltaScaled : Array G)
+    (groupSize : Nat) (beta gamma delta : Coordinates G)
+    (betaRead : Coordinates.read publics 0 = some beta) (gammaRead : Coordinates.read publics 1 = some gamma)
+    (deltaRead : Coordinates.read deltaScaled 0 = some (delta.scale (Domain.normalizer domain).inverse))
+    (rows : ∀ index : Fin (Domain.size domain), ∃ result,
+      constraintValues lookups (nodeRows index) (stageRows index)
+        (stageRows ⟨(index.val + 1) % Domain.size domain, Nat.mod_lt _ (Domain.size_positive domain)⟩)
+        publics deltaScaled
+        (Domain.Algebra.dividedPowers (Domain.point domain index) (Domain.lastPoint domain) (Domain.size domain))
+        groupSize = some result ∧ (∀ value ∈ result, value = 0))
+    (free : ∀ index values, lookups.mapM (readLookup (nodeRows index)) = some values →
+      PoleFree (fieldEntries (compress beta gamma values))) :
+    ∃ values : Fin (Domain.size domain) → List (G × List G),
+      (∀ index, lookups.mapM (readLookup (nodeRows index)) = some (values index)) ∧
+      sum (List.ofFn fun index => lookupFractions beta gamma (values index)) = delta.toExtension := by
+  let values := fun index => (lookups.mapM (readLookup (nodeRows index))).getD []
+  have reads : ∀ index, lookups.mapM (readLookup (nodeRows index)) = some (values index) := by
+    intro index
+    obtain ⟨result, accepted, _⟩ := rows index
+    obtain ⟨readValues, _, read, _, _⟩ := constraintValues_success accepted
+    simp only [values, read, Option.getD_some]
+  refine ⟨values, reads, equations_domain_sum domain values stageRows publics deltaScaled groupSize
+    beta gamma delta betaRead gammaRead deltaRead ?_ (fun index => free index (values index) (reads index))⟩
+  intro index
+  obtain ⟨result, accepted, zero⟩ := rows index
+  obtain ⟨readValues, coordinates, read, equations, rfl⟩ := constraintValues_success accepted
+  have same := Option.some.inj (read.symm.trans (reads index))
+  subst readValues
+  exact ⟨coordinates, equations, (Coordinates.flatten_zero_iff coordinates).mp zero⟩
+
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/Proofs/EmissionAllocation.lean b/Ix/Aiur/Proofs/EmissionAllocation.lean
new file mode 100644
index 000000000..b62bfc64b
--- /dev/null
+++ b/Ix/Aiur/Proofs/EmissionAllocation.lean
@@ -0,0 +1,310 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationDegrees
+import Ix.Aiur.Proofs.CompilerAllocation
+
+/-! Symbolic emission agrees with the compiler's logical degrees and physical
+auxiliary allocation. Degree-zero constant folding is justified by the invariant
+preserved from the initial advice map. -/
+
+namespace Aiur.NativeAIR.OpEmitter
+open Aiur.Bytecode
+
+def rowDegrees (rows : Array RowExpr) : Array Nat := rows.map RowExpr.degree
+
+theorem rowDegrees_empty : rowDegrees #[] = #[] := Array.map_empty
+
+theorem rowDegrees_append (left right : Array RowExpr) :
+    rowDegrees (left ++ right) = rowDegrees left ++ rowDegrees right := Array.map_append
+
+theorem rowDegrees_push (rows : Array RowExpr) (row : RowExpr) :
+    rowDegrees (rows.push row) = (rowDegrees rows).push row.degree := Array.map_push
+
+theorem rowDegrees_singleton (row : RowExpr) : rowDegrees #[row] = #[row.degree] :=
+  Array.map_singleton
+
+theorem rowDegrees_getD (rows : Array RowExpr) (index : Nat) :
+    (rowDegrees rows)[index]?.getD 0 = (rows[index]?.getD (.konst 0)).degree := by
+  simp only [rowDegrees, Array.getElem?_map]
+  cases rows[index]? <;> rfl
+
+theorem rowDegrees_read {rows : Array RowExpr} {index : Nat} {row : RowExpr}
+    (read : rows[index]? = some row) : (rowDegrees rows)[index]?.getD 0 = row.degree := by
+  rw [rowDegrees_getD, read]
+  rfl
+
+theorem select_degrees {rows : Array RowExpr} {indices : Array Nat} {selected : Array RowExpr}
+    (read : select rows indices = some selected) :
+    indices.map (fun index => (rowDegrees rows)[index]?.getD 0) = rowDegrees selected := by
+  have selectedMap := congrArg rowDegrees (array_map_getD_of_mapM (.konst 0) read)
+  simpa only [rowDegrees, Array.map_map, Function.comp_def, ← rowDegrees_getD] using selectedMap
+
+theorem advice_degrees (first count : Nat) :
+    rowDegrees (advice first count) = Array.replicate count 1 := by
+  apply Array.ext (by simp only [rowDegrees, Array.size_map, advice, Array.size_ofFn, Array.size_replicate])
+  intro index _ _
+  simp only [rowDegrees, advice, Array.getElem_map, Array.getElem_ofFn,
+    Array.getElem_replicate, mainCurrent, RowExpr.variable]
+
+theorem packFour_degree (bytes : Fin 4 → RowExpr) :
+    (packFour bytes).degree = (rowDegrees (Array.ofFn bytes)).foldl Nat.max 0 := by
+  simp only [rowDegrees, Array.map_ofFn, ← Array.foldl_toList, Array.toList_ofFn,
+    list_ofFn_four, List.foldl_cons, List.foldl_nil, Function.comp_def,
+    packFour, RowExpr.add, RowExpr.mul, RowExpr.konst, Nat.add_zero]
+
+theorem readWord_degree {rows : Array RowExpr} {indices : Array Nat} {word : RowExpr}
+    (read : readWord rows indices = some word) :
+    word.degree = selectedDegree (rowDegrees rows) indices 0 := by
+  simp only [readWord, bind, Option.bind] at read
+  split at read
+  · cases read
+  next size =>
+    cases selected : select rows indices <;> simp only [selected] at read
+    · cases read
+    next bytes =>
+      cases read
+      have width : indices.size = 4 := by omega
+      rw [packFour_degree, array_ofFn_getD bytes (.konst 0) ((array_mapM_size selected).trans width)]
+      simp only [selectedDegree, select_degrees selected]
+
+def Emission.allocation (emission : Emission) : OpAllocation :=
+  ⟨rowDegrees emission.outputs, emission.used⟩
+
+theorem emitAdvice_allocation (first count : Nat) :
+    (emitAdvice first count).allocation = .advice count := by
+  simp only [Emission.allocation, emitAdvice, advice_degrees, OpAllocation.advice]
+
+theorem emitWordSum_allocation (first : Nat) (sum : RowExpr) :
+    (emitWordSum first sum).allocation = ⟨(Array.replicate 4 1).push (max sum.degree 1), 4⟩ := by
+  simp only [Emission.allocation, emitWordSum, rowDegrees_push, advice_degrees,
+    RowExpr.mul, RowExpr.sub, RowExpr.konst, packedAdvice, packFour, RowExpr.add,
+    mainCurrent, RowExpr.variable, Nat.add_zero]
+  rfl
+
+theorem emitByte1_dispatch_allocation (selector rank : Expr) (first : Nat) (kind : AIR.Byte1Kind)
+    (index : Nat) {rows : Array RowExpr} {emission : Emission}
+    (emitted : emitOp selector rank first (kind.op index) rows = some emission) :
+    emission.allocation = (kind.op index).allocation (rowDegrees rows) := by
+  rw [emitOp_byte1] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  cases emitted
+  cases kind <;> simp only [Emission.allocation, emitByte1, advice_degrees,
+    AIR.Byte1Kind.op, AIR.Byte1Kind.outputSize, Op.allocation, OpAllocation.advice]
+
+theorem emitByte2_dispatch_allocation (selector rank : Expr) (first : Nat) (kind : AIR.Byte2Kind)
+    (a b : Nat) {rows : Array RowExpr} {emission : Emission}
+    (emitted : emitOp selector rank first (kind.op a b) rows = some emission) :
+    emission.allocation = (kind.op a b).allocation (rowDegrees rows) := by
+  rw [emitOp_byte2] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i left readA
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i right readB
+  cases emitted
+  have degreeA := rowDegrees_read readA
+  have degreeB := rowDegrees_read readB
+  cases kind <;> simp only [Emission.allocation, emitByte2, advice_degrees, rowDegrees_push,
+    AIR.Byte2Kind.op, AIR.Byte2Kind.outputSize, Op.allocation, OpAllocation.advice,
+    byteCarry, degreeA, degreeB] <;> rfl
+
+theorem emitOp_allocation {selector rank : Expr} {first : Nat} {op : Op}
+    {rows : Array RowExpr} {emission : Emission} (valid : DegreeValid rows)
+    (emitted : emitOp selector rank first op rows = some emission) :
+    emission.allocation = op.allocation (rowDegrees rows) := by
+  cases op with
+  | const value =>
+    cases emitted
+    simp only [Emission.allocation, fromScalar, rowDegrees_singleton, RowExpr.konst, Op.allocation]
+  | add a b | sub a b | mul a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    have degreeA := rowDegrees_read readA
+    have degreeB := rowDegrees_read readB
+    simp only [Emission.allocation, fromScalar, rowDegrees_singleton, Op.allocation, degreeA, degreeB]
+    first
+    | rfl
+    | (simp only [emitMul, RowExpr.mul]; split <;>
+        simp_all only [if_pos, mulRegular, mainCurrent, RowExpr.variable, OpAllocation.advice] <;> rfl)
+  | eqZero index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i input read
+    cases emitted
+    have allocated := emitEqZero_allocation selector first (valid.read read)
+    simp only [Emission.allocation, fromScalar, rowDegrees_singleton, Op.allocation, rowDegrees_read read]
+    split at allocated <;>
+      simp_all only [Prod.mk.injEq, if_true, if_false]
+  | call function indices size unconstrained =>
+    cases unconstrained with
+    | true =>
+      cases emitted
+      simp only [emitAdvice_allocation, Op.allocation, if_true, Nat.add_zero, OpAllocation.advice]
+    | false =>
+      simp only [emitOp, Bool.false_eq_true, if_false, bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      cases emitted
+      simp only [Emission.allocation, emitCall, advice_degrees, Op.allocation,
+        Bool.false_eq_true, if_false]
+  | store indices | load size index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    simp only [Emission.allocation, emitStore, emitLoad, advice_degrees, Op.allocation, OpAllocation.advice]
+  | assertEq xs ys message =>
+    simp only [emitOp] at emitted
+    split at emitted
+    · cases emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    simp only [Emission.allocation, emitAssert, rowDegrees_empty, Op.allocation]
+  | ioGetInfo | ioRead | unconstrainedBigUintDivMod | unconstrainedGToBytes | unconstrainedGInverse =>
+    cases emitted
+    exact emitAdvice_allocation _ _
+  | ioSetInfo | ioWrite | debug =>
+    cases emitted
+    simp only [Emission.allocation, rowDegrees_empty, Op.allocation]
+  | u8BitDecomposition index => exact emitByte1_dispatch_allocation selector rank first .bits index emitted
+  | u8ShiftLeft index => exact emitByte1_dispatch_allocation selector rank first .shiftLeft index emitted
+  | u8ShiftRight index => exact emitByte1_dispatch_allocation selector rank first .shiftRight index emitted
+  | u8Xor a b => exact emitByte2_dispatch_allocation selector rank first .xor a b emitted
+  | u8Add a b => exact emitByte2_dispatch_allocation selector rank first .add a b emitted
+  | u8Sub a b => exact emitByte2_dispatch_allocation selector rank first .sub a b emitted
+  | u8And a b => exact emitByte2_dispatch_allocation selector rank first .and a b emitted
+  | u8Or a b => exact emitByte2_dispatch_allocation selector rank first .or a b emitted
+  | u8LessThan a b => exact emitByte2_dispatch_allocation selector rank first .lessThan a b emitted
+  | u8RangeCheck a b => exact emitByte2_dispatch_allocation selector rank first .range a b emitted
+  | u8Mul a b => exact emitByte2_dispatch_allocation selector rank first .mul a b emitted
+  | u8XorSplit7 a b => exact emitByte2_dispatch_allocation selector rank first .split7 a b emitted
+  | u8XorSplit4 a b => exact emitByte2_dispatch_allocation selector rank first .split4 a b emitted
+  | u32LessThan a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    simp only [Emission.allocation, emitU32LessThan, rowDegrees_singleton, Op.allocation]
+  | unconstrainedU32Add a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    simp only [emitWordSum_allocation, Op.allocation, RowExpr.add,
+      readWord_degree readA, readWord_degree readB, selectedDegree_append,
+      selectedDegree_initial (rowDegrees rows) a 1]
+    simp only [Nat.max_assoc, Nat.max_comm]
+  | unconstrainedU32Add3 a b c =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i third readC
+    cases emitted
+    simp only [emitWordSum_allocation, Op.allocation, RowExpr.add,
+      readWord_degree readA, readWord_degree readB, readWord_degree readC,
+      selectedDegree_append, selectedDegree_initial (rowDegrees rows) a 1]
+    simp only [Nat.max_assoc, Nat.max_comm]
+  | u32ToField indices =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i word read
+    cases emitted
+    simp only [Emission.allocation, fromScalar, rowDegrees_singleton, Op.allocation, readWord_degree read]
+
+theorem emitOp_layout {selector rank : Expr} {first : Nat} {op : Op}
+    {rows : Array RowExpr} {emission : Emission} (initial : Concrete.Bytecode.LayoutMState)
+    (valid : DegreeValid rows) (aligned : rowDegrees rows = initial.degrees)
+    (emitted : emitOp selector rank first op rows = some emission) :
+    ((Concrete.Bytecode.opLayout op).run initial).2.degrees = rowDegrees (rows ++ emission.outputs) ∧
+    ((Concrete.Bytecode.opLayout op).run initial).2.functionLayout.auxiliaries =
+      initial.functionLayout.auxiliaries + emission.used := by
+  have allocated := emitOp_allocation valid emitted
+  rw [aligned] at allocated
+  have degrees := congrArg OpAllocation.degrees allocated
+  have auxiliaries := congrArg OpAllocation.auxiliaries allocated
+  obtain ⟨layoutDegrees, layoutAux⟩ := Concrete.Bytecode.opLayout_allocation op initial
+  simp only [Emission.allocation] at degrees auxiliaries
+  rw [← degrees] at layoutDegrees
+  rw [← auxiliaries] at layoutAux
+  exact ⟨by simpa only [rowDegrees_append, aligned] using layoutDegrees, layoutAux⟩
+
+theorem emitOps_fold_layout {selector rank : Expr} {ops : List Op} {rows : Array RowExpr}
+    {column : Nat} {emission : OpsEmission} (initial : Concrete.Bytecode.LayoutMState) (base : Nat)
+    (valid : DegreeValid rows) (aligned : rowDegrees rows = initial.degrees)
+    (cursor : column = base + initial.functionLayout.auxiliaries)
+    (emitted : emitOps selector rank ops rows column = some emission) :
+    ((ops.foldlM (fun _ op => Concrete.Bytecode.opLayout op) ()).run initial).2.degrees =
+      rowDegrees emission.values ∧
+    emission.column = base +
+      ((ops.foldlM (fun _ op => Concrete.Bytecode.opLayout op) ()).run initial).2.functionLayout.auxiliaries := by
+  induction ops generalizing rows column emission initial with
+  | nil =>
+    cases emitted
+    exact ⟨aligned.symm, cursor⟩
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i first firstEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    obtain ⟨nextDegrees, nextAux⟩ := emitOp_layout initial valid aligned firstEmitted
+    have reflected := ih ((Concrete.Bytecode.opLayout op).run initial).2
+      (valid.append (emitOp_degreeValid valid firstEmitted)) nextDegrees.symm
+      (by rw [cursor, nextAux, Nat.add_assoc]) restEmitted
+    rw [List.foldlM_cons]
+    exact reflected
+
+theorem emitOps_layout {selector rank : Expr} {ops : Array Op} {rows : Array RowExpr}
+    {column : Nat} {emission : OpsEmission} (initial : Concrete.Bytecode.LayoutMState) (base : Nat)
+    (valid : DegreeValid rows) (aligned : rowDegrees rows = initial.degrees)
+    (cursor : column = base + initial.functionLayout.auxiliaries)
+    (emitted : emitOps selector rank ops.toList rows column = some emission) :
+    ((ops.forM Concrete.Bytecode.opLayout).run initial).2.degrees = rowDegrees emission.values ∧
+    emission.column = base + ((ops.forM Concrete.Bytecode.opLayout).run initial).2.functionLayout.auxiliaries := by
+  unfold Array.forM
+  rw [← Array.foldlM_toList]
+  exact emitOps_fold_layout initial base valid aligned cursor emitted
+
+end Aiur.NativeAIR.OpEmitter
diff --git a/Ix/Aiur/Proofs/EmissionControls.lean b/Ix/Aiur/Proofs/EmissionControls.lean
new file mode 100644
index 000000000..432859bc1
--- /dev/null
+++ b/Ix/Aiur/Proofs/EmissionControls.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.EmissionInputs
+import Ix.Aiur.Proofs.BlockDegrees
+
+/-! Checked control scopes provide every selector used by circuit emission. -/
+
+namespace Aiur.Bytecode
+
+theorem emissionChecks_match (available selectors : Nat) (yieldSize : Option Nat)
+    (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).emissionChecks available selectors yieldSize = true ↔
+      index < available ∧
+        (∀ pair ∈ branches.toList, pair.2.emissionChecks available selectors yieldSize = true) ∧
+          (∀ block, fallback = some block → block.emissionChecks available selectors yieldSize = true) := by
+  rw [Ctrl.emissionChecks.eq_def]
+  simp only [Bool.and_eq_true, decide_eq_true_eq, Array.all_eq_true',
+    Array.mem_attach, forall_const, Subtype.forall]
+  cases fallback <;> simp
+
+theorem emissionChecks_matchContinue (available selectors : Nat) (yieldSize : Option Nat)
+    (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block)
+    (size aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback size aux lookups continuation).emissionChecks
+      available selectors yieldSize = true ↔
+      index < available ∧
+        (∀ pair ∈ branches.toList, pair.2.emissionChecks available selectors (some size) = true) ∧
+          (∀ block, fallback = some block → block.emissionChecks available selectors (some size) = true) ∧
+            ∃ next, addScope available size = some next ∧ continuation.emissionChecks next selectors yieldSize = true := by
+  rw [Ctrl.emissionChecks.eq_def]
+  simp only [Bool.and_eq_true, decide_eq_true_eq, Array.all_eq_true',
+    Array.mem_attach, forall_const, Subtype.forall]
+  cases fallback <;> cases added : addScope available size <;> simp
+
+theorem Block.emissionChecks_parts {block : Block} {available selectors : Nat} {yieldSize : Option Nat}
+    (checked : block.emissionChecks available selectors yieldSize = true) :
+    ∃ next, checkEmissionOps block.ops.toList available = some next ∧
+      block.ctrl.emissionChecks next selectors yieldSize = true := by
+  unfold Block.emissionChecks at checked
+  split at checked
+  · cases checked
+  next next checkedOps => exact ⟨next, checkedOps, checked⟩
+
+theorem Toplevel.validateEmission_function {program : Toplevel} (checked : program.validateEmission = true)
+    {function : Function} (member : function ∈ program.functions) (constrained : function.constrained = true) :
+    function.emissionChecks = true := by
+  rw [Toplevel.validateEmission, Array.all_eq_true'] at checked
+  simpa only [constrained, Bool.not_true, Bool.false_or] using checked function member
+
+end Aiur.Bytecode
+
+namespace Aiur.NativeAIR.BlockEmitter
+open OpEmitter Bytecode
+
+private theorem branchSelectors_defined (selectors : Array Expr) (branches : Array (G × Block))
+    (fallback : Option Block)
+    (casesDefined : ∀ pair ∈ branches.toList, ∃ entry, blockSelector selectors pair.2 = some entry)
+    (defaultDefined : ∀ block, fallback = some block → ∃ entry, blockSelector selectors block = some entry) :
+    ∃ entries last,
+      (branches.attach.toList.mapM fun pair => blockSelector selectors pair.val.2) = some entries ∧
+      (match fallback with
+      | none => some []
+      | some block => (blockSelector selectors block).map (fun entry => [entry])) = some last := by
+  obtain ⟨entries, casesRead⟩ := list_mapM_defined branches.attach.toList (fun pair _ =>
+    casesDefined pair.val (by simpa using pair.property))
+  cases fallback with
+  | none => exact ⟨entries, [], casesRead, rfl⟩
+  | some block =>
+    obtain ⟨entry, defaultRead⟩ := defaultDefined block rfl
+    exact ⟨entries, [entry], casesRead, by simp only [defaultRead, Option.map_some]⟩
+
+mutual
+
+theorem ctrlSelector_defined (selectors : Array Expr) (ctrl : Ctrl) {available : Nat} {yieldSize : Option Nat}
+    (checked : ctrl.emissionChecks available selectors.size yieldSize = true) :
+    ∃ entry, ctrlSelector selectors ctrl = some entry := by
+  cases ctrl with
+  | «return» index outputs | yield index outputs =>
+    have bound : index < selectors.size := by
+      simp only [Ctrl.emissionChecks, Bool.and_eq_true, decide_eq_true_eq] at checked
+      exact checked.1
+    exact ⟨selectors[index], by simpa only [ctrlSelector] using getElem?_pos selectors index bound⟩
+  | «match» index branches fallback =>
+    obtain ⟨_, casesValid, defaultValid⟩ := (emissionChecks_match _ _ _ _ _ _).mp checked
+    obtain ⟨entries, last, casesRead, defaultRead⟩ := branchSelectors_defined selectors branches fallback
+      (fun pair member => blockSelector_defined selectors pair.2 (casesValid pair member))
+      (fun block present => blockSelector_defined selectors block (defaultValid block present))
+    refine ⟨sum (entries ++ last), ?_⟩
+    rw [ctrlSelector.eq_def]
+    cases fallback with
+    | none => cases defaultRead; simp only [casesRead, bind, Option.bind_some, pure]
+    | some block =>
+      simp only at defaultRead
+      simp only [casesRead, bind, Option.bind_some, pure]
+      rw [defaultRead]
+      rfl
+  | matchContinue index branches fallback size aux lookups continuation =>
+    obtain ⟨_, casesValid, defaultValid, _⟩ := (emissionChecks_matchContinue _ _ _ _ _ _ _ _ _ _).mp checked
+    obtain ⟨entries, last, casesRead, defaultRead⟩ := branchSelectors_defined selectors branches fallback
+      (fun pair member => blockSelector_defined selectors pair.2 (casesValid pair member))
+      (fun block present => blockSelector_defined selectors block (defaultValid block present))
+    refine ⟨sum (entries ++ last), ?_⟩
+    rw [ctrlSelector.eq_def]
+    cases fallback with
+    | none => cases defaultRead; simp only [casesRead, bind, Option.bind_some, pure]
+    | some block =>
+      simp only at defaultRead
+      simp only [casesRead, bind, Option.bind_some, pure]
+      rw [defaultRead]
+      rfl
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (show pair ∈ branches from by simpa using member); grind)
+
+theorem blockSelector_defined (selectors : Array Expr) (block : Block) {available : Nat} {yieldSize : Option Nat}
+    (checked : block.emissionChecks available selectors.size yieldSize = true) :
+    ∃ entry, blockSelector selectors block = some entry := by
+  obtain ⟨_, _, control⟩ := Block.emissionChecks_parts checked
+  simpa only [blockSelector] using ctrlSelector_defined selectors block.ctrl control
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+end Aiur.NativeAIR.BlockEmitter
diff --git a/Ix/Aiur/Proofs/EmissionInputs.lean b/Ix/Aiur/Proofs/EmissionInputs.lean
new file mode 100644
index 000000000..a1f0ed67d
--- /dev/null
+++ b/Ix/Aiur/Proofs/EmissionInputs.lean
@@ -0,0 +1,172 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.EmissionChecks
+import Ix.Aiur.Proofs.EmissionAllocation
+
+/-! Checked operand scopes supply operation emission and its exact output size. -/
+
+namespace Aiur.Bytecode
+
+theorem indicesInScope_spec (available : Nat) (indices : Array ValIdx) :
+    indicesInScope available indices = true ↔ ∀ index ∈ indices, index < available := by
+  simp only [indicesInScope, Array.all_eq_true', decide_eq_true_eq]
+
+theorem wordInScope_spec (available : Nat) (indices : Array ValIdx) :
+    wordInScope available indices = true ↔ indices.size = 4 ∧ indicesInScope available indices = true := by
+  simp only [wordInScope, Bool.and_eq_true, beq_iff_eq]
+
+theorem addScope_eq {available count next : Nat} (checked : addScope available count = some next) :
+    next = available + count ∧ next < 2^64 := by
+  unfold addScope at checked
+  dsimp only at checked
+  split at checked
+  · cases checked
+    exact ⟨rfl, ‹_›⟩
+  · cases checked
+
+theorem checkEmissionOps_cons {op : Op} {ops : List Op} {available next : Nat}
+    (checked : checkEmissionOps (op :: ops) available = some next) :
+    op.emissionInputs available = true ∧
+      ∃ after, addScope available op.outputSize = some after ∧ checkEmissionOps ops after = some next := by
+  simp only [checkEmissionOps] at checked
+  split at checked
+  · cases checked
+  next valid =>
+    refine ⟨by simpa using valid, ?_⟩
+    simp only [bind, Option.bind] at checked
+    split at checked
+    · cases checked
+    next after added => exact ⟨after, added, checked⟩
+
+theorem checkEmissionOps_le {ops : List Op} {available next : Nat}
+    (checked : checkEmissionOps ops available = some next) : available ≤ next := by
+  induction ops generalizing available with
+  | nil => cases checked; exact Nat.le_refl _
+  | cons op ops ih =>
+    obtain ⟨_, after, added, rest⟩ := checkEmissionOps_cons checked
+    have size := (addScope_eq added).1
+    have mono := ih rest
+    omega
+
+theorem Op.allocation_outputSize (op : Op) (degrees : Array Nat) :
+    (op.allocation degrees).degrees.size = op.outputSize := by
+  cases op <;> simp only [Op.allocation, Op.outputSize, OpAllocation.advice]
+  all_goals first
+    | rfl
+    | simp only [Array.size_replicate]
+    | (split <;> rfl)
+
+end Aiur.Bytecode
+
+namespace Aiur.NativeAIR.OpEmitter
+open Bytecode
+
+theorem list_mapM_defined {read : α → Option β} (inputs : List α)
+    (defined : ∀ input ∈ inputs, ∃ output, read input = some output) :
+    ∃ outputs, inputs.mapM read = some outputs := by
+  induction inputs with
+  | nil => exact ⟨[], rfl⟩
+  | cons input inputs ih =>
+    obtain ⟨output, head⟩ := defined input List.mem_cons_self
+    obtain ⟨outputs, tail⟩ := ih (fun value member => defined value (List.mem_cons_of_mem _ member))
+    exact ⟨output :: outputs, by simp only [List.mapM_cons, head, tail, bind, Option.bind_some, pure]⟩
+
+theorem array_mapM_defined {read : α → Option β} (inputs : Array α)
+    (defined : ∀ input ∈ inputs, ∃ output, read input = some output) :
+    ∃ outputs, inputs.mapM read = some outputs := by
+  obtain ⟨outputs, evaluated⟩ := list_mapM_defined inputs.toList (by simpa using defined)
+  exact ⟨outputs.toArray, by simp only [Array.mapM_eq_mapM_toList, evaluated, Functor.map, Option.map_some]⟩
+
+theorem select_defined {rows : Array RowExpr} {indices : Array Nat}
+    (checked : indicesInScope rows.size indices = true) : ∃ outputs, select rows indices = some outputs := by
+  apply array_mapM_defined
+  intro index member
+  have bound := (indicesInScope_spec _ _).mp checked index member
+  exact ⟨rows[index], getElem?_pos rows index bound⟩
+
+theorem readWord_defined {rows : Array RowExpr} {indices : Array Nat}
+    (checked : wordInScope rows.size indices = true) : ∃ output, readWord rows indices = some output := by
+  obtain ⟨size, valid⟩ := (wordInScope_spec _ _).mp checked
+  obtain ⟨outputs, selected⟩ := select_defined valid
+  exact ⟨_, by simp only [readWord, size, ne_eq, not_true_eq_false, if_false, selected,
+    bind, Option.bind_some, pure]; rfl⟩
+
+theorem emitOp_defined (selector rank : Expr) (first : Nat) (op : Op) (rows : Array RowExpr)
+    (checked : op.emissionInputs rows.size = true) : ∃ emission, emitOp selector rank first op rows = some emission := by
+  cases op with
+  | const | ioGetInfo | ioRead | ioSetInfo | ioWrite | debug | unconstrainedBigUintDivMod
+  | unconstrainedGToBytes | unconstrainedGInverse => exact ⟨_, rfl⟩
+  | add a b | sub a b | mul a b | u8Xor a b | u8Add a b | u8Mul a b | u8Sub a b
+  | u8And a b | u8Or a b | u8LessThan a b | u32LessThan a b | u8XorSplit7 a b
+  | u8XorSplit4 a b | u8RangeCheck a b =>
+    obtain ⟨left, right⟩ : a < rows.size ∧ b < rows.size := by
+      simpa only [Op.emissionInputs, Bool.and_eq_true, decide_eq_true_eq] using checked
+    exact ⟨_, by simp only [emitOp, getElem?_pos rows a left, getElem?_pos rows b right,
+      bind, Option.bind_some, pure]; rfl⟩
+  | eqZero index | load size index | u8BitDecomposition index | u8ShiftLeft index | u8ShiftRight index =>
+    have bound : index < rows.size := by simpa only [Op.emissionInputs, decide_eq_true_eq] using checked
+    exact ⟨_, by simp only [emitOp, getElem?_pos rows index bound, bind, Option.bind_some, pure]; rfl⟩
+  | call function indices size unconstrained =>
+    cases unconstrained with
+    | true => exact ⟨_, rfl⟩
+    | false =>
+      obtain ⟨outputs, selected⟩ := select_defined checked
+      exact ⟨_, by simp only [emitOp, Bool.false_eq_true, if_false, selected, bind, Option.bind_some, pure]; rfl⟩
+  | store indices =>
+    obtain ⟨outputs, selected⟩ := select_defined checked
+    exact ⟨_, by simp only [emitOp, selected, bind, Option.bind_some, pure]; rfl⟩
+  | assertEq left right message =>
+    obtain ⟨size, leftValid, rightValid⟩ : left.size = right.size ∧
+        indicesInScope rows.size left = true ∧ indicesInScope rows.size right = true := by
+      simpa only [Op.emissionInputs, Bool.and_eq_true, beq_iff_eq] using checked
+    obtain ⟨xs, leftRead⟩ := select_defined leftValid
+    obtain ⟨ys, rightRead⟩ := select_defined rightValid
+    exact ⟨_, by simp only [emitOp, size, ne_eq, not_true_eq_false, if_false, leftRead, rightRead,
+      bind, Option.bind_some, pure]; rfl⟩
+  | unconstrainedU32Add left right =>
+    obtain ⟨leftValid, rightValid⟩ : wordInScope rows.size left = true ∧ wordInScope rows.size right = true := by
+      simpa only [Op.emissionInputs, Bool.and_eq_true] using checked
+    obtain ⟨a, leftRead⟩ := readWord_defined leftValid
+    obtain ⟨b, rightRead⟩ := readWord_defined rightValid
+    exact ⟨_, by simp only [emitOp, leftRead, rightRead, bind, Option.bind_some, pure]; rfl⟩
+  | unconstrainedU32Add3 left middle right =>
+    obtain ⟨leftValid, middleValid, rightValid⟩ : wordInScope rows.size left = true ∧
+        wordInScope rows.size middle = true ∧ wordInScope rows.size right = true := by
+      simpa only [Op.emissionInputs, Bool.and_eq_true] using checked
+    obtain ⟨a, leftRead⟩ := readWord_defined leftValid
+    obtain ⟨b, middleRead⟩ := readWord_defined middleValid
+    obtain ⟨c, rightRead⟩ := readWord_defined rightValid
+    exact ⟨_, by simp only [emitOp, leftRead, middleRead, rightRead, bind, Option.bind_some, pure]; rfl⟩
+  | u32ToField indices =>
+    obtain ⟨output, selected⟩ := readWord_defined checked
+    exact ⟨_, by simp only [emitOp, selected, bind, Option.bind_some, pure]; rfl⟩
+
+theorem emitOp_outputSize {selector rank : Expr} {first : Nat} {op : Op}
+    {rows : Array RowExpr} {emission : Emission} (valid : DegreeValid rows)
+    (emitted : emitOp selector rank first op rows = some emission) :
+    emission.outputs.size = op.outputSize := by
+  have allocated := congrArg (fun allocation => allocation.degrees.size) (emitOp_allocation valid emitted)
+  simpa only [Emission.allocation, rowDegrees, Array.size_map, Op.allocation_outputSize] using allocated
+
+theorem emitOps_defined (selector rank : Expr) (ops : List Op) (rows : Array RowExpr) (column : Nat)
+    {next : Nat} (valid : DegreeValid rows) (checked : checkEmissionOps ops rows.size = some next) :
+    ∃ emission, emitOps selector rank ops rows column = some emission ∧ emission.values.size = next := by
+  induction ops generalizing rows column with
+  | nil => cases checked; exact ⟨_, rfl, rfl⟩
+  | cons op ops ih =>
+    obtain ⟨inputs, after, added, rest⟩ := checkEmissionOps_cons checked
+    obtain ⟨first, firstEmitted⟩ := emitOp_defined selector rank column op rows inputs
+    have size := emitOp_outputSize valid firstEmitted
+    have nextSize : (rows ++ first.outputs).size = after := by
+      simp only [Array.size_append, size, (addScope_eq added).1]
+    obtain ⟨last, lastEmitted, lastSize⟩ := ih (rows ++ first.outputs) (column + first.used)
+      (valid.append (emitOp_degreeValid valid firstEmitted)) (nextSize ▸ rest)
+    refine ⟨{ last with
+      equations := first.equations ++ last.equations,
+      queries := first.queries ++ last.queries, calls := first.calls ++ last.calls }, ?_, lastSize⟩
+    simp only [emitOps, firstEmitted, lastEmitted, bind, Option.bind_some, pure]
+
+end Aiur.NativeAIR.OpEmitter
diff --git a/Ix/Aiur/Proofs/EncodedCircuitExecution.lean b/Ix/Aiur/Proofs/EncodedCircuitExecution.lean
new file mode 100644
index 000000000..288662132
--- /dev/null
+++ b/Ix/Aiur/Proofs/EncodedCircuitExecution.lean
@@ -0,0 +1,159 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BranchlessSlots
+import Ix.Aiur.Proofs.PublicCircuitExecution
+
+/-! Encoded circuit consumer messages give the same padded query pool
+and query count as decoded active operations. Their physical message widths
+bound the decoded widths. This connects valued slot balance to execution
+of the selected public success call without a single-writer assumption.
+Native trace extraction and the cryptographic reduction remain separate. -/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem gateMessage_length (branchless : Bool) (gate : G) (message : List G) :
+    (gateMessage branchless gate message).length = message.length := by
+  cases branchless <;> simp only [gateMessage, Bool.false_eq_true, if_false,
+    scaleMessage, List.length_map, if_true]
+
+private theorem slotMessage_fold_start (branchless : Bool) (parts : List (G × List G)) (start : List G) :
+    start.length ≤ (parts.foldl (fun combined part => addMessages combined
+      (gateMessage branchless part.1 part.2)) start).length := by
+  induction parts generalizing start with
+  | nil => exact Nat.le_refl _
+  | cons part rest ih =>
+    have step := ih (addMessages start (gateMessage branchless part.1 part.2))
+    simp only [List.foldl_cons]
+    apply Nat.le_trans _ step
+    rw [addMessages_length]
+    exact Nat.le_max_left _ _
+
+private theorem slotMessage_fold_member (branchless : Bool) {parts : List (G × List G)}
+    {part : G × List G} (member : part ∈ parts) (start : List G) :
+    part.2.length ≤ (parts.foldl (fun combined part => addMessages combined
+      (gateMessage branchless part.1 part.2)) start).length := by
+  induction parts generalizing start with
+  | nil => cases member
+  | cons first rest ih =>
+    rcases List.mem_cons.mp member with equal | later
+    · subst part
+      apply Nat.le_trans _ (slotMessage_fold_start branchless rest _)
+      rw [addMessages_length, gateMessage_length]
+      exact Nat.le_max_right _ _
+    · exact ih later _
+
+theorem slotMessage_member_length (branchless : Bool) {parts : List (G × List G)}
+    {part : G × List G} (member : part ∈ parts) : part.2.length ≤ (slotMessage branchless parts).length :=
+  slotMessage_fold_member branchless member []
+
+theorem QuerySlots.encoded_member {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (branchless : Bool)
+    {query : QueryPart} (member : query ∈ queries) (active : query.selector = 1) :
+    slotMessage branchless (querySlotParts queries query.slot) ∈ encodedQueries branchless queries finish := by
+  have count : queryCount queries query.slot = 1 := congrArg List.length (slots.active_singleton member active)
+  have multiplicity : querySlotMultiplicity queries query.slot = 1 := by
+    rw [slots.slot_multiplicity, count]
+    rfl
+  apply List.mem_filterMap.mpr
+  refine ⟨query.slot, List.mem_range.mpr (slots.range query member).2, ?_⟩
+  simp only [encodedQuery, multiplicity, if_true]
+
+theorem QuerySlots.decoded_widths {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (branchless : Bool) (width : Nat)
+    (widths : ∀ message ∈ encodedQueries branchless queries finish, message.length ≤ width) :
+    ∀ message ∈ decodedQueries queries finish, message.length ≤ width := by
+  intro message present
+  obtain ⟨slot, _, decoded⟩ := List.mem_filterMap.mp present
+  cases found : activeQuerySlot queries slot with
+  | nil => simp only [decodedQuery, found, List.head?_nil, Option.map_none, reduceCtorEq] at decoded
+  | cons query rest =>
+    have member : query ∈ activeQuerySlot queries slot := by rw [found]; exact List.mem_cons_self
+    obtain ⟨original, _, active⟩ := by
+      simpa only [activeQuerySlot, List.mem_filter, Bool.and_eq_true, beq_iff_eq] using member
+    simp only [decodedQuery, found, List.head?_cons, Option.map_some, Option.some.injEq] at decoded
+    rw [← decoded]
+    exact Nat.le_trans (slotMessage_member_length branchless (querySlotParts_member original))
+      (widths _ (slots.encoded_member branchless original active))
+
+/-- Unit consumers encoded by the valued circuit's physical lookup slots.
+The return provider is kept separately in `circuitProviders`. -/
+def encodedCircuitQueryPool (emissions : List CircuitEmission) : List (List G) :=
+  emissions.flatMap fun emission => encodedQueries emission.branchless emission.queries emission.lookupCount
+
+theorem circuitWitnesses_queries_reflect {program : Toplevel} (witnesses : List CircuitWitness)
+    (counted : program.validateRowCounts = true)
+    (circuits : ∀ witness ∈ witnesses, witness.circuit ∈ program.circuits)
+    (emitted : ∀ witness ∈ witnesses, witness.Emitted program)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds) (width : Nat) :
+    (encodedCircuitQueryPool (witnesses.map (·.emission))).map (padMessage width) =
+      (circuitQueryPool (witnesses.map (·.emission))).map (padMessage width) := by
+  simp only [encodedCircuitQueryPool, circuitQueryPool, List.map_flatMap]
+  rw [List.flatMap, List.flatMap]
+  apply congrArg List.flatten
+  apply List.map_congr_left
+  intro emission member
+  obtain ⟨witness, witnessMember, equal⟩ := List.mem_map.mp member
+  subst emission
+  exact witness.circuit.emitRow_queries_reflect witness.values program (emitted witness witnessMember)
+    (Toplevel.validateRowCounts_circuit counted (circuits witness witnessMember))
+    (limits witness witnessMember).1 (limits witness witnessMember).2 (satisfied witness witnessMember) width
+
+theorem circuitWitnesses_decoded_widths {program : Toplevel} (witnesses : List CircuitWitness)
+    (counted : program.validateRowCounts = true)
+    (circuits : ∀ witness ∈ witnesses, witness.circuit ∈ program.circuits)
+    (emitted : ∀ witness ∈ witnesses, witness.Emitted program)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds) (width : Nat)
+    (widths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width) :
+    ∀ query ∈ circuitQueryPool (witnesses.map (·.emission)), query.length ≤ width := by
+  intro query member
+  obtain ⟨emission, emissionMember, queryMember⟩ := List.mem_flatMap.mp member
+  obtain ⟨witness, witnessMember, equal⟩ := List.mem_map.mp emissionMember
+  subst emission
+  obtain ⟨bounded, bounds, _, _⟩ := witness.circuit.emitRow_count_bounds witness.values program
+    (emitted witness witnessMember) (Toplevel.validateRowCounts_circuit counted (circuits witness witnessMember))
+    (satisfied witness witnessMember)
+  have slots := witness.circuit.emitRow_querySlots witness.values program (emitted witness witnessMember)
+    bounded bounds (limits witness witnessMember).1 (limits witness witnessMember).2 (satisfied witness witnessMember)
+  exact slots.decoded_widths witness.emission.branchless width
+    (fun message present => widths message (List.mem_flatMap.mpr
+      ⟨witness.emission, List.mem_map.mpr ⟨witness, witnessMember, rfl⟩, present⟩)) query queryMember
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+theorem Backend.encoded_circuit_execution {selection : Selection} (backend : Backend selection)
+    (tables : AuxiliaryTables) (witnesses : List CircuitWitness) (width : Nat)
+    (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        encodedCircuitQueryPool (witnesses.map (·.emission)))
+      (tables.circuitProviders (witnesses.map (·.emission))))
+    (bounded : (encodedCircuitQueryPool (witnesses.map (·.emission))).length + 1 < gSize.toNat)
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (circuits : ∀ witness ∈ witnesses, witness.circuit ∈ backend.compiled.bytecode.circuits)
+    (emitted : ∀ witness ∈ witnesses, witness.Emitted backend.compiled.bytecode)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (shapes : ∀ witness ∈ witnesses, witness.Shapes backend.compiled.bytecode)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds) :
+    Execution backend.compiled.bytecode (memoryFacts tables.memory)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  have messages := circuitWitnesses_queries_reflect witnesses backend.rowCounts circuits emitted satisfied limits width
+  have lengths := congrArg List.length messages
+  simp only [List.length_map] at lengths
+  apply backend.public_circuit_execution tables witnesses width input arity
+    (balanced.congr_queries (by simp only [List.map_cons, messages])) (by rwa [← lengths]) publicWidth
+    (circuitWitnesses_decoded_widths witnesses backend.rowCounts circuits emitted satisfied limits width queryWidths)
+    memoryValid canonical circuits emitted satisfied shapes limits
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/Execution.lean b/Ix/Aiur/Proofs/Execution.lean
new file mode 100644
index 000000000..f34e5688a
--- /dev/null
+++ b/Ix/Aiur/Proofs/Execution.lean
@@ -0,0 +1,182 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Semantics.AIR
+import Ix.Aiur.Proofs.Lookup
+
+/-!
+Finite execution from locally interpreted rows and exact lookup balance.
+
+The interface keeps function requests, provider multiplicities, active-row
+rank bytes and call-gap bytes explicit. Local row interpretation is still an
+extraction obligation for the native constraint emitter. This theorem closes
+the global call-table obligation once those local interpretations, exact
+balance and the query-count bounds have been established. In particular, it
+does not assume that a matching provider already has a finite execution.
+-/
+
+namespace Aiur.AIR
+
+open Bytecode.AIR
+
+/-- One interpreted function row; each call carries its six gap bytes. -/
+structure FunctionRow where
+  request : Call
+  calls : List (Call × (Fin 6 → G))
+  rankBytes : Fin 6 → G
+  selector : G
+  multiplicity : G
+
+def FunctionRow.requests (row : FunctionRow) : List Call := row.calls.map Prod.fst
+
+def FunctionRow.byteQueries (row : FunctionRow) : List (G × G) :=
+  rankByteQueries row.rankBytes ++ row.calls.flatMap fun edge => rankByteQueries edge.2
+
+/-- The concrete local obligations of an interpreted row. The execution
+field resolves operations and control flow but leaves calls as requests. -/
+structure FunctionRow.Valid (program : Bytecode.Toplevel) (memory : Memory)
+    (row : FunctionRow) : Prop where
+  selector : row.selector = 0 ∨ row.selector = 1
+  activity : activityConstraint row.multiplicity row.selector = 0
+  rank : row.selector = 1 → row.request.rank = packRank row.rankBytes
+  execution : row.selector = 1 → RunFunction program memory row.request row.requests
+  order : ∀ edge ∈ row.calls,
+    row.selector * callOrderConstraint row.request.rank edge.1.rank (packRank edge.2) = 0
+
+def functionProviders (rows : List FunctionRow) : List (Provider Call) :=
+  rows.map fun row => (row.request, row.multiplicity)
+
+def functionQueries (roots : List Call) (rows : List FunctionRow) : List Call :=
+  roots ++ rows.flatMap fun row => if row.selector = 1 then row.requests else []
+
+def functionByteQueries (rows : List FunctionRow) : List (G × G) :=
+  rows.flatMap fun row => if row.selector = 1 then row.byteQueries else []
+
+theorem FunctionRow.Valid.active_of_nonzero {program : Bytecode.Toplevel}
+    {memory : Memory} {row : FunctionRow} (valid : row.Valid program memory)
+    (nonzero : row.multiplicity ≠ 0) : row.selector = 1 := by
+  rcases valid.selector with inactive | active
+  · exact False.elim (nonzero (inactive_multiplicity_zero inactive valid.activity))
+  · exact active
+
+theorem functionByteQueries_member {rows : List FunctionRow} {row : FunctionRow}
+    (member : row ∈ rows) (active : row.selector = 1) :
+    row.byteQueries ⊆ functionByteQueries rows := by
+  intro query queried
+  apply List.mem_flatMap.mpr
+  exact ⟨row, member, by simpa only [if_pos active] using queried⟩
+
+theorem functionQueries_member {roots : List Call} {rows : List FunctionRow}
+    {row : FunctionRow} (member : row ∈ rows) (active : row.selector = 1) :
+    row.requests ⊆ functionQueries roots rows := by
+  intro query queried
+  apply List.mem_append_right
+  apply List.mem_flatMap.mpr
+  exact ⟨row, member, by simpa only [if_pos active] using queried⟩
+
+/-- Every requested call has an active row supplying exactly that call,
+including its rank. Provider multiplicities need not be natural counts. -/
+theorem functionQueries_provider {program : Bytecode.Toplevel} {memory : Memory}
+    {roots : List Call} {rows : List FunctionRow}
+    (valid : ∀ row ∈ rows, row.Valid program memory)
+    (balanced : ExactLookupBalance (functionQueries roots rows) (functionProviders rows))
+    (bounded : (functionQueries roots rows).length < gSize.toNat)
+    {request : Call} (queried : request ∈ functionQueries roots rows) :
+    ∃ row ∈ rows, row.request = request ∧ row.selector = 1 := by
+  obtain ⟨provider, member, same, nonzero⟩ :=
+    exactLookupBalance_provider balanced bounded queried
+  obtain ⟨row, rowMember, providerEq⟩ := List.mem_map.mp member
+  subst provider
+  exact ⟨row, rowMember, same, (valid row rowMember).active_of_nonzero nonzero⟩
+
+theorem FunctionRow.Valid.rank_bounded {program : Bytecode.Toplevel}
+    {memory : Memory} {rows : List FunctionRow} {row : FunctionRow}
+    (valid : row.Valid program memory) (member : row ∈ rows) (active : row.selector = 1)
+    (weights : Fin 65536 → G)
+    (balanced : ExactLookupBalance (functionByteQueries rows) (byteRangeProviders weights))
+    (bounded : (functionByteQueries rows).length < gSize.toNat) :
+    row.request.rank.n < callRankBound := by
+  rw [valid.rank active]
+  apply packRank_lt
+  apply exactLookupBalance_rankBytes weights balanced bounded
+  intro pair queried
+  apply functionByteQueries_member member active
+  exact List.mem_append_left _ queried
+
+theorem FunctionRow.Valid.call_order {program : Bytecode.Toplevel} {memory : Memory}
+    {rows : List FunctionRow} {row : FunctionRow} (valid : row.Valid program memory)
+    (member : row ∈ rows) (active : row.selector = 1)
+    (weights : Fin 65536 → G)
+    (balanced : ExactLookupBalance (functionByteQueries rows) (byteRangeProviders weights))
+    (bounded : (functionByteQueries rows).length < gSize.toNat)
+    {edge : Call × (Fin 6 → G)} (called : edge ∈ row.calls)
+    (childBound : edge.1.rank.n < callRankBound) :
+    row.request.rank.n < edge.1.rank.n := by
+  have gapBound : (packRank edge.2).n < callRankBound := by
+    apply packRank_lt
+    apply exactLookupBalance_rankBytes weights balanced bounded
+    intro pair queried
+    apply functionByteQueries_member member active
+    apply List.mem_append_right
+    exact List.mem_flatMap.mpr ⟨edge, called, queried⟩
+  exact active_call_order_strict active
+    (valid.rank_bounded member active weights balanced bounded)
+    childBound gapBound (valid.order edge called)
+
+/-- Active locally valid rows give finite call derivations. The proof uses
+the actual 48-bit rank/gap equations and balanced byte-table queries, not a
+postulated acyclic call graph or an execution assumption on callees. -/
+theorem balancedRows_execute {program : Bytecode.Toplevel} {memory : Memory}
+    {roots : List Call} {rows : List FunctionRow}
+    (valid : ∀ row ∈ rows, row.Valid program memory)
+    (balanced : ExactLookupBalance (functionQueries roots rows) (functionProviders rows))
+    (bounded : (functionQueries roots rows).length < gSize.toNat)
+    (weights : Fin 65536 → G)
+    (bytesBalanced : ExactLookupBalance (functionByteQueries rows) (byteRangeProviders weights))
+    (bytesBounded : (functionByteQueries rows).length < gSize.toNat)
+    {row : FunctionRow} (member : row ∈ rows) (active : row.selector = 1) :
+    Execution program memory row.request := by
+  have all : ∀ n : Nat, ∀ row : FunctionRow,
+      callRankBound - row.request.rank.n = n → row ∈ rows → row.selector = 1 →
+      Execution program memory row.request := by
+    intro n
+    induction n using Nat.strongRecOn with
+    | ind n ih =>
+      intro parent measure member active
+      apply Execution.function ((valid parent member).execution active)
+      intro child called
+      obtain ⟨edge, edgeMember, edgeEq⟩ := List.mem_map.mp called
+      obtain ⟨provider, providerMember, same, providerActive⟩ :=
+        functionQueries_provider valid balanced bounded
+          (functionQueries_member member active called)
+      have childBound := (valid provider providerMember).rank_bounded
+        providerMember providerActive weights bytesBalanced bytesBounded
+      have order := (valid parent member).call_order member active weights
+        bytesBalanced bytesBounded edgeMember
+        (by simpa only [edgeEq, ← same] using childBound)
+      rw [edgeEq, ← same] at order
+      have smaller : callRankBound - provider.request.rank.n < n := by omega
+      rw [← same]
+      exact ih _ smaller provider rfl providerMember providerActive
+  exact all _ row rfl member active
+
+/-- Every public/root request has a finite derivation under the same local,
+balance and count obligations. Root rank zero may be imposed by the public
+message encoding without changing this statement. -/
+theorem balancedRoots_execute {program : Bytecode.Toplevel} {memory : Memory}
+    {roots : List Call} {rows : List FunctionRow}
+    (valid : ∀ row ∈ rows, row.Valid program memory)
+    (balanced : ExactLookupBalance (functionQueries roots rows) (functionProviders rows))
+    (bounded : (functionQueries roots rows).length < gSize.toNat)
+    (weights : Fin 65536 → G)
+    (bytesBalanced : ExactLookupBalance (functionByteQueries rows) (byteRangeProviders weights))
+    (bytesBounded : (functionByteQueries rows).length < gSize.toNat)
+    {request : Call} (root : request ∈ roots) : Execution program memory request := by
+  obtain ⟨row, member, same, active⟩ := functionQueries_provider valid balanced bounded
+    (List.mem_append_left _ root)
+  rw [← same]
+  exact balancedRows_execute valid balanced bounded weights bytesBalanced bytesBounded member active
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/ExpressionGraph.lean b/Ix/Aiur/Proofs/ExpressionGraph.lean
new file mode 100644
index 000000000..eeddcf2f4
--- /dev/null
+++ b/Ix/Aiur/Proofs/ExpressionGraph.lean
@@ -0,0 +1,561 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Field
+
+/-!
+The native base-node graph, its checked read layout, and forward evaluation.
+The layout checker requires children before parents, bounded roots and leaf
+indices, and no stage-two columns in the lookup prefix. Valid inputs admit
+both sweeps. Their results agree with unfolded expressions for arbitrary
+working operations, and their lookup values agree on the shared prefix.
+
+These are total Lean definitions. The native comparison evaluates actual
+Rust graphs and the guard on malformed layouts. Refinement of Rust execution,
+frontend compilation, key decoding and cryptographic acceptance remains open.
+-/
+
+namespace Aiur.NativeAIR
+
+inductive Source where
+  | preprocessed | main | stage2
+  deriving DecidableEq, Repr
+
+inductive RowOffset where
+  | current | next
+  deriving DecidableEq, Repr
+
+structure ColRef where
+  source : Source
+  offset : RowOffset
+  index : Nat
+  deriving DecidableEq, Repr
+
+inductive Node where
+  | konst (value : G)
+  | var (column : ColRef)
+  | publicInput (index : Nat)
+  | isFirstRow | isLastRow | isTransition
+  | add (left right : Nat)
+  | sub (left right : Nat)
+  | mul (left right : Nat)
+  | neg (child : Nat)
+  deriving DecidableEq, Repr
+
+structure GraphWidths where
+  preprocessed : Nat
+  main : Nat
+  stage2 : Nat
+  publics : Nat
+  deriving DecidableEq, Repr
+
+def GraphWidths.width (widths : GraphWidths) : Source → Nat
+  | .preprocessed => widths.preprocessed
+  | .main => widths.main
+  | .stage2 => widths.stage2
+
+structure Lookup where
+  multiplicity : Nat
+  args : List Nat
+  deriving DecidableEq, Repr
+
+structure Graph where
+  nodes : List Node
+  zeros : List Nat
+  lookups : List Lookup
+  deriving DecidableEq, Repr
+
+def Lookup.roots (lookup : Lookup) : List Nat := lookup.multiplicity :: lookup.args
+def Graph.lookupRoots (graph : Graph) : List Nat := graph.lookups.flatMap Lookup.roots
+/-- The dense prefix reconstructed by the native codec. Compilation can
+intern extra nodes before folding its last lookup, so its stored prefix can
+be longer. Children before parents make this root-derived prefix sufficient. -/
+def Graph.lookupPrefix (graph : Graph) : Nat :=
+  graph.lookupRoots.foldr (fun index rest => max (index + 1) rest) 0
+
+def Node.Valid (widths : GraphWidths) (lookupEnd index : Nat) : Node → Prop
+  | .konst _ | .isFirstRow | .isLastRow | .isTransition => True
+  | .var column => column.index < widths.width column.source ∧
+      (column.source = .stage2 → lookupEnd ≤ index)
+  | .publicInput input => input < widths.publics
+  | .add a b | .sub a b | .mul a b => a < index ∧ b < index
+  | .neg a => a < index
+
+def Node.check (widths : GraphWidths) (lookupEnd index : Nat) : Node → Bool
+  | .konst _ | .isFirstRow | .isLastRow | .isTransition => true
+  | .var column => column.index < widths.width column.source &&
+      (column.source != .stage2 || lookupEnd ≤ index)
+  | .publicInput input => input < widths.publics
+  | .add a b | .sub a b | .mul a b => a < index && b < index
+  | .neg a => a < index
+
+theorem Node.check_iff (widths : GraphWidths) (lookupEnd index : Nat) (node : Node) :
+    node.check widths lookupEnd index = true ↔ node.Valid widths lookupEnd index := by
+  cases node <;> simp only [Node.check, Node.Valid, Bool.and_eq_true,
+    Bool.or_eq_true, bne_iff_ne, decide_eq_true_eq, iff_self]
+  case var column =>
+    cases column.source <;> simp
+
+def checkNodes (widths : GraphWidths) (lookupEnd : Nat) : Nat → List Node → Bool
+  | _, [] => true
+  | index, node :: nodes => node.check widths lookupEnd index && checkNodes widths lookupEnd (index + 1) nodes
+
+inductive ValidNodes (widths : GraphWidths) (lookupEnd : Nat) : Nat → List Node → Prop where
+  | nil (index : Nat) : ValidNodes widths lookupEnd index []
+  | cons {index : Nat} {node : Node} {nodes : List Node}
+      (valid : node.Valid widths lookupEnd index)
+      (rest : ValidNodes widths lookupEnd (index + 1) nodes) :
+      ValidNodes widths lookupEnd index (node :: nodes)
+
+theorem checkNodes_iff (widths : GraphWidths) (lookupEnd index : Nat) (nodes : List Node) :
+    checkNodes widths lookupEnd index nodes = true ↔ ValidNodes widths lookupEnd index nodes := by
+  induction nodes generalizing index with
+  | nil => exact ⟨fun _ => .nil _, fun _ => rfl⟩
+  | cons node nodes ih =>
+    simp only [checkNodes, Bool.and_eq_true, Node.check_iff, ih]
+    exact ⟨fun ⟨valid, rest⟩ => .cons valid rest, fun valid => by cases valid; exact ⟨‹_›, ‹_›⟩⟩
+
+def checkedGraphPrefix (widths : GraphWidths) (graph : Graph) : Option Nat :=
+  if graph.zeros.all (· < graph.nodes.length) && graph.lookupRoots.all (· < graph.nodes.length) &&
+      checkNodes widths graph.lookupPrefix 0 graph.nodes then
+    some graph.lookupPrefix
+  else none
+
+structure Graph.Valid (widths : GraphWidths) (graph : Graph) : Prop where
+  nodes : ValidNodes widths graph.lookupPrefix 0 graph.nodes
+  zeros : ∀ index ∈ graph.zeros, index < graph.nodes.length
+  lookups : ∀ index ∈ graph.lookupRoots, index < graph.nodes.length
+
+theorem checkedGraphPrefix_iff (widths : GraphWidths) (graph : Graph) (lookupEnd : Nat) :
+    checkedGraphPrefix widths graph = some lookupEnd ↔ graph.Valid widths ∧ lookupEnd = graph.lookupPrefix := by
+  simp only [checkedGraphPrefix]
+  split
+  next accepted =>
+    simp only [Bool.and_eq_true, List.all_eq_true, decide_eq_true_eq, checkNodes_iff] at accepted
+    obtain ⟨⟨zeros, lookups⟩, nodes⟩ := accepted
+    exact ⟨fun equal => ⟨⟨nodes, zeros, lookups⟩, (Option.some.inj equal).symm⟩,
+      fun ⟨_, equal⟩ => congrArg some equal.symm⟩
+  next rejected =>
+    constructor
+    · intro equal; cases equal
+    · rintro ⟨valid, _⟩
+      apply False.elim
+      apply rejected
+      simp only [Bool.and_eq_true, List.all_eq_true, decide_eq_true_eq, checkNodes_iff]
+      exact ⟨⟨valid.zeros, valid.lookups⟩, valid.nodes⟩
+
+theorem roots_below_prefix (roots : List Nat) (index : Nat) (member : index ∈ roots) :
+    index < roots.foldr (fun root rest => max (root + 1) rest) 0 := by
+  induction roots with
+  | nil => simp only [List.not_mem_nil] at member
+  | cons root roots ih =>
+    simp only [List.mem_cons] at member
+    simp only [List.foldr_cons]
+    rcases member with rfl | member
+    · exact Nat.lt_of_lt_of_le (Nat.lt_succ_self _) (Nat.le_max_left _ _)
+    · exact Nat.lt_of_lt_of_le (ih member) (Nat.le_max_right _ _)
+
+theorem prefix_bounded (roots : List Nat) (bound : Nat) (bounded : ∀ index ∈ roots, index < bound) :
+    roots.foldr (fun root rest => max (root + 1) rest) 0 ≤ bound := by
+  induction roots with
+  | nil => exact Nat.zero_le _
+  | cons root roots ih =>
+    simp only [List.foldr_cons, Nat.max_le]
+    exact ⟨bounded root (by simp), ih (fun index member => bounded index (by simp [member]))⟩
+
+theorem Graph.Valid.prefix_bounded {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths) :
+    graph.lookupPrefix ≤ graph.nodes.length := Aiur.NativeAIR.prefix_bounded _ _ valid.lookups
+
+structure EvalOps (W : Type u) where
+  konst : G → W
+  add : W → W → W
+  sub : W → W → W
+  mul : W → W → W
+  neg : W → W
+
+structure Values (W : Type u) where
+  columns : Source → RowOffset → Array W
+  publics : Array W
+  isFirstRow : W
+  isLastRow : W
+  isTransition : W
+
+def Values.Fits (values : Values W) (widths : GraphWidths) : Prop :=
+  (∀ source offset, (values.columns source offset).size = widths.width source) ∧
+    values.publics.size = widths.publics
+
+def Node.eval (ops : EvalOps W) (values : Values W) (buffer : Array W) : Node → Option W
+  | .konst value => some (ops.konst value)
+  | .var column => (values.columns column.source column.offset)[column.index]?
+  | .publicInput index => values.publics[index]?
+  | .isFirstRow => some values.isFirstRow
+  | .isLastRow => some values.isLastRow
+  | .isTransition => some values.isTransition
+  | .add a b => return ops.add (← buffer[a]?) (← buffer[b]?)
+  | .sub a b => return ops.sub (← buffer[a]?) (← buffer[b]?)
+  | .mul a b => return ops.mul (← buffer[a]?) (← buffer[b]?)
+  | .neg a => return ops.neg (← buffer[a]?)
+
+theorem Node.eval_defined (ops : EvalOps W) (values : Values W) (buffer : Array W)
+    {widths : GraphWidths} {lookupEnd : Nat} {node : Node}
+    (fits : values.Fits widths) (valid : node.Valid widths lookupEnd buffer.size) :
+    ∃ value, node.eval ops values buffer = some value := by
+  cases node <;> simp only [Node.Valid] at valid
+  all_goals try exact ⟨_, rfl⟩
+  case var column =>
+    have bounded : column.index < (values.columns column.source column.offset).size := by
+      rw [fits.1]; exact valid.1
+    exact ⟨_, Array.getElem?_eq_getElem bounded⟩
+  case publicInput input =>
+    have bounded : input < values.publics.size := by rw [fits.2]; exact valid
+    exact ⟨_, Array.getElem?_eq_getElem bounded⟩
+  case add a b => simp [Node.eval, Array.getElem?_eq_getElem valid.1, Array.getElem?_eq_getElem valid.2]
+  case sub a b => simp [Node.eval, Array.getElem?_eq_getElem valid.1, Array.getElem?_eq_getElem valid.2]
+  case mul a b => simp [Node.eval, Array.getElem?_eq_getElem valid.1, Array.getElem?_eq_getElem valid.2]
+  case neg a => simp [Node.eval, Array.getElem?_eq_getElem valid]
+
+def sweepFrom (ops : EvalOps W) (values : Values W) : List Node → Array W → Option (Array W)
+  | [], buffer => some buffer
+  | node :: nodes, buffer => do
+    let value ← node.eval ops values buffer
+    sweepFrom ops values nodes (buffer.push value)
+
+def Graph.sweep (graph : Graph) (ops : EvalOps W) (values : Values W) : Option (Array W) :=
+  sweepFrom ops values graph.nodes #[]
+
+theorem sweepFrom_defined (ops : EvalOps W) (values : Values W) (nodes : List Node) (buffer : Array W)
+    {widths : GraphWidths} {lookupEnd : Nat} (fits : values.Fits widths)
+    (valid : ValidNodes widths lookupEnd buffer.size nodes) :
+    ∃ result, sweepFrom ops values nodes buffer = some result ∧ result.size = buffer.size + nodes.length := by
+  induction nodes generalizing buffer with
+  | nil => exact ⟨buffer, rfl, by simp⟩
+  | cons node nodes ih =>
+    cases valid with
+    | cons valid rest =>
+      obtain ⟨value, evaluated⟩ := Node.eval_defined ops values buffer fits valid
+      obtain ⟨result, swept, length⟩ := ih (buffer.push value) (by simpa only [Array.size_push] using rest)
+      refine ⟨result, ?_, ?_⟩
+      · simp only [sweepFrom, evaluated, bind, Option.bind, swept]
+      · simp only [Array.size_push, List.length_cons] at length ⊢; omega
+
+theorem Graph.Valid.sweep_defined {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths)
+    (ops : EvalOps W) (values : Values W) (fits : values.Fits widths) :
+    ∃ result, graph.sweep ops values = some result ∧ result.size = graph.nodes.length := by
+  simpa only [Graph.sweep, Array.size_empty, Nat.zero_add] using
+    sweepFrom_defined ops values graph.nodes #[] fits valid.nodes
+
+theorem ValidNodes.take {widths : GraphWidths} {lookupEnd index : Nat} {nodes : List Node}
+    (valid : ValidNodes widths lookupEnd index nodes) (count : Nat) :
+    ValidNodes widths lookupEnd index (nodes.take count) := by
+  induction valid generalizing count with
+  | nil index => simpa using ValidNodes.nil (widths := widths) (lookupEnd := lookupEnd) index
+  | cons valid rest ih =>
+    cases count with
+    | zero => exact .nil _
+    | succ count => exact .cons valid (ih count)
+
+def Values.withoutStage2 (values : Values W) : Values W :=
+  { values with columns := fun source offset =>
+      match source with
+      | .stage2 => #[]
+      | _ => values.columns source offset }
+
+theorem Node.eval_withoutStage2 (ops : EvalOps W) (values : Values W) (buffer : Array W)
+    {widths : GraphWidths} {lookupEnd : Nat} {node : Node}
+    (valid : node.Valid widths lookupEnd buffer.size) (inside : buffer.size < lookupEnd) :
+    node.eval ops values.withoutStage2 buffer = node.eval ops values buffer := by
+  cases node <;> try rfl
+  case var column =>
+    cases source : column.source <;> simp only [Node.eval, Values.withoutStage2, source]
+    exact False.elim (Nat.not_lt_of_ge (valid.2 source) inside)
+
+theorem sweepFrom_withoutStage2 (ops : EvalOps W) (values : Values W) (nodes : List Node) (buffer : Array W)
+    {widths : GraphWidths} {lookupEnd : Nat} (valid : ValidNodes widths lookupEnd buffer.size nodes)
+    (inside : buffer.size + nodes.length ≤ lookupEnd) :
+    sweepFrom ops values.withoutStage2 nodes buffer = sweepFrom ops values nodes buffer := by
+  induction nodes generalizing buffer with
+  | nil => rfl
+  | cons node nodes ih =>
+    cases valid with
+    | cons valid rest =>
+      have lt : buffer.size < lookupEnd := by simp only [List.length_cons] at inside; omega
+      simp only [sweepFrom, Node.eval_withoutStage2 ops values buffer valid lt]
+      cases evaluated : node.eval ops values buffer with
+      | none => rfl
+      | some value =>
+        simp only [bind, Option.bind]
+        exact ih (buffer.push value) (by simpa only [Array.size_push] using rest)
+          (by simp only [Array.size_push, List.length_cons] at inside ⊢; omega)
+
+theorem sweepFrom_append (ops : EvalOps W) (values : Values W) (left right : List Node) (buffer : Array W) :
+    sweepFrom ops values (left ++ right) buffer =
+      (sweepFrom ops values left buffer).bind (sweepFrom ops values right) := by
+  induction left generalizing buffer with
+  | nil => rfl
+  | cons node nodes ih =>
+    simp only [List.cons_append, sweepFrom]
+    cases node.eval ops values buffer with
+    | none => rfl
+    | some value => exact ih (buffer.push value)
+
+theorem sweepFrom_preserves (ops : EvalOps W) (values : Values W) (nodes : List Node)
+    {buffer result : Array W} (swept : sweepFrom ops values nodes buffer = some result)
+    (index : Nat) (bound : index < buffer.size) : result[index]? = buffer[index]? := by
+  induction nodes generalizing buffer with
+  | nil => cases swept; rfl
+  | cons node nodes ih =>
+    simp only [sweepFrom] at swept
+    cases evaluated : node.eval ops values buffer with
+    | none => simp only [evaluated, bind, Option.bind, reduceCtorEq] at swept
+    | some value =>
+      simp only [evaluated, bind, Option.bind] at swept
+      exact (ih swept (by simp only [Array.size_push]; omega)).trans
+        ((Array.getElem?_push_lt bound).trans (Array.getElem?_eq_getElem bound).symm)
+
+def Graph.sweepLookupPrefix (graph : Graph) (ops : EvalOps W) (values : Values W) : Option (Array W) :=
+  sweepFrom ops values.withoutStage2 (graph.nodes.take graph.lookupPrefix) #[]
+
+theorem Graph.Valid.lookup_sweep_defined {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths)
+    (ops : EvalOps W) (values : Values W) (fits : values.Fits widths) :
+    ∃ result, graph.sweepLookupPrefix ops values = some result ∧ result.size = graph.lookupPrefix := by
+  have nodes := valid.nodes.take graph.lookupPrefix
+  have length : (graph.nodes.take graph.lookupPrefix).length = graph.lookupPrefix :=
+    List.length_take_of_le valid.prefix_bounded
+  unfold Graph.sweepLookupPrefix
+  rw [sweepFrom_withoutStage2 ops values _ #[] nodes (by simp only [Array.size_empty, Nat.zero_add, length, Nat.le_refl])]
+  simpa only [Array.size_empty, Nat.zero_add, length] using sweepFrom_defined ops values _ #[] fits nodes
+
+theorem Graph.Valid.lookup_sweep_agrees {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths)
+    (ops : EvalOps W) (values : Values W) {full prefixValues : Array W}
+    (fullSweep : graph.sweep ops values = some full)
+    (partialSweep : graph.sweepLookupPrefix ops values = some prefixValues)
+    (index : Nat) (bound : index < prefixValues.size) : full[index]? = prefixValues[index]? := by
+  have nodes := valid.nodes.take graph.lookupPrefix
+  have length : (graph.nodes.take graph.lookupPrefix).length = graph.lookupPrefix :=
+    List.length_take_of_le valid.prefix_bounded
+  unfold Graph.sweepLookupPrefix at partialSweep
+  rw [sweepFrom_withoutStage2 ops values _ #[] nodes (by simp only [Array.size_empty, Nat.zero_add, length, Nat.le_refl])]
+    at partialSweep
+  unfold Graph.sweep at fullSweep
+  rw [← List.take_append_drop graph.lookupPrefix graph.nodes, sweepFrom_append, partialSweep] at fullSweep
+  exact sweepFrom_preserves ops values _ fullSweep index bound
+
+inductive Expr where
+  | konst (value : G)
+  | var (column : ColRef)
+  | publicInput (index : Nat)
+  | isFirstRow | isLastRow | isTransition
+  | add (left right : Expr)
+  | sub (left right : Expr)
+  | mul (left right : Expr)
+  | neg (child : Expr)
+  deriving DecidableEq, Repr
+
+def Expr.eval (ops : EvalOps W) (values : Values W) : Expr → Option W
+  | .konst value => some (ops.konst value)
+  | .var column => (values.columns column.source column.offset)[column.index]?
+  | .publicInput index => values.publics[index]?
+  | .isFirstRow => some values.isFirstRow
+  | .isLastRow => some values.isLastRow
+  | .isTransition => some values.isTransition
+  | .add a b => return ops.add (← a.eval ops values) (← b.eval ops values)
+  | .sub a b => return ops.sub (← a.eval ops values) (← b.eval ops values)
+  | .mul a b => return ops.mul (← a.eval ops values) (← b.eval ops values)
+  | .neg a => return ops.neg (← a.eval ops values)
+
+def Node.unfold (trees : Array Expr) : Node → Option Expr
+  | .konst value => some (.konst value)
+  | .var column => some (.var column)
+  | .publicInput index => some (.publicInput index)
+  | .isFirstRow => some .isFirstRow
+  | .isLastRow => some .isLastRow
+  | .isTransition => some .isTransition
+  | .add a b => return .add (← trees[a]?) (← trees[b]?)
+  | .sub a b => return .sub (← trees[a]?) (← trees[b]?)
+  | .mul a b => return .mul (← trees[a]?) (← trees[b]?)
+  | .neg a => return .neg (← trees[a]?)
+
+def Reflects (ops : EvalOps W) (values : Values W) (trees : Array Expr) (buffer : Array W) : Prop :=
+  buffer.size = trees.size ∧ ∀ index : Nat, buffer[index]? = (trees[index]?).bind (Expr.eval ops values)
+
+theorem Node.unfold_eval (ops : EvalOps W) (values : Values W) {trees : Array Expr} {buffer : Array W}
+    (reflects : Reflects ops values trees buffer) (node : Node) {expr : Expr}
+    (unfolded : node.unfold trees = some expr) : node.eval ops values buffer = expr.eval ops values := by
+  cases node <;> simp only [Node.unfold] at unfolded
+  all_goals first
+    | (cases unfolded; rfl)
+    | skip
+  all_goals simp only [Node.eval, reflects.2]
+  all_goals
+    repeat first
+      | (split at unfolded)
+      | (rename_i a b; cases ha : trees[a]? <;> cases hb : trees[b]? <;>
+          simp only [ha, hb, bind, Option.bind, pure, reduceCtorEq] at unfolded ⊢)
+      | (rename_i a; cases ha : trees[a]? <;>
+          simp only [ha, bind, Option.bind, pure, reduceCtorEq] at unfolded ⊢)
+  all_goals cases unfolded; rfl
+
+theorem Reflects.push {ops : EvalOps W} {values : Values W} {trees : Array Expr} {buffer : Array W}
+    (reflects : Reflects ops values trees buffer) (expr : Expr) (value : W)
+    (evaluated : expr.eval ops values = some value) :
+    Reflects ops values (trees.push expr) (buffer.push value) := by
+  refine ⟨by simpa only [Array.size_push] using congrArg (· + 1) reflects.1, ?_⟩
+  intro index
+  simp only [Array.getElem?_push, reflects.1]
+  split
+  · simpa only [Option.bind_some] using evaluated.symm
+  · exact reflects.2 index
+
+def unfoldFrom : List Node → Array Expr → Option (Array Expr)
+  | [], trees => some trees
+  | node :: nodes, trees => do
+    let expr ← node.unfold trees
+    unfoldFrom nodes (trees.push expr)
+
+def Graph.unfold (graph : Graph) : Option (Array Expr) := unfoldFrom graph.nodes #[]
+
+theorem Node.unfold_defined {trees : Array Expr} {widths : GraphWidths} {lookupEnd : Nat} {node : Node}
+    (valid : node.Valid widths lookupEnd trees.size) : ∃ expr, node.unfold trees = some expr := by
+  cases node <;> simp only [Node.Valid] at valid
+  all_goals try exact ⟨_, rfl⟩
+  case add a b => simp [Node.unfold, Array.getElem?_eq_getElem valid.1, Array.getElem?_eq_getElem valid.2]
+  case sub a b => simp [Node.unfold, Array.getElem?_eq_getElem valid.1, Array.getElem?_eq_getElem valid.2]
+  case mul a b => simp [Node.unfold, Array.getElem?_eq_getElem valid.1, Array.getElem?_eq_getElem valid.2]
+  case neg a => simp [Node.unfold, Array.getElem?_eq_getElem valid]
+
+theorem unfoldFrom_defined {nodes : List Node} {trees : Array Expr} {widths : GraphWidths} {lookupEnd : Nat}
+    (valid : ValidNodes widths lookupEnd trees.size nodes) :
+    ∃ result, unfoldFrom nodes trees = some result ∧ result.size = trees.size + nodes.length := by
+  induction nodes generalizing trees with
+  | nil => exact ⟨trees, rfl, by simp⟩
+  | cons node nodes ih =>
+    cases valid with
+    | cons valid rest =>
+      obtain ⟨expr, unfolded⟩ := Node.unfold_defined valid
+      obtain ⟨result, extended, length⟩ := ih (trees := trees.push expr) (by simpa only [Array.size_push] using rest)
+      refine ⟨result, ?_, ?_⟩
+      · simp only [unfoldFrom, unfolded, bind, Option.bind, extended]
+      · simp only [Array.size_push, List.length_cons] at length ⊢; omega
+
+theorem unfoldFrom_reflects (ops : EvalOps W) (values : Values W) (nodes : List Node)
+    {trees resultTrees : Array Expr} {buffer resultBuffer : Array W}
+    (reflects : Reflects ops values trees buffer)
+    (unfolded : unfoldFrom nodes trees = some resultTrees)
+    (swept : sweepFrom ops values nodes buffer = some resultBuffer) :
+    Reflects ops values resultTrees resultBuffer := by
+  induction nodes generalizing trees buffer with
+  | nil => cases unfolded; cases swept; exact reflects
+  | cons node nodes ih =>
+    simp only [unfoldFrom] at unfolded
+    cases tree : node.unfold trees with
+    | none => simp only [tree, bind, Option.bind, reduceCtorEq] at unfolded
+    | some expr =>
+      simp only [tree, bind, Option.bind] at unfolded
+      simp only [sweepFrom] at swept
+      cases evaluated : node.eval ops values buffer with
+      | none => simp only [evaluated, bind, Option.bind, reduceCtorEq] at swept
+      | some value =>
+        simp only [evaluated, bind, Option.bind] at swept
+        have exprEval : expr.eval ops values = some value :=
+          (Node.unfold_eval ops values reflects node tree).symm.trans evaluated
+        exact ih (reflects.push expr value exprEval) unfolded swept
+
+theorem Graph.Valid.unfold_defined {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths) :
+    ∃ trees, graph.unfold = some trees ∧ trees.size = graph.nodes.length := by
+  simpa only [Graph.unfold, Array.size_empty, Nat.zero_add] using unfoldFrom_defined (trees := #[]) valid.nodes
+
+theorem Graph.sweep_reflects (graph : Graph) (ops : EvalOps W) (values : Values W)
+    {trees : Array Expr} {buffer : Array W}
+    (unfolded : graph.unfold = some trees) (swept : graph.sweep ops values = some buffer) :
+    Reflects ops values trees buffer :=
+  unfoldFrom_reflects ops values graph.nodes ⟨rfl, fun _ => rfl⟩ unfolded swept
+
+def readNodes (buffer : Array W) (roots : List Nat) : Option (List W) :=
+  roots.mapM fun index => buffer[index]?
+
+def evalRoots (ops : EvalOps W) (values : Values W) (trees : Array Expr) (roots : List Nat) : Option (List W) :=
+  roots.mapM fun index => (trees[index]?).bind (Expr.eval ops values)
+
+def readLookup (buffer : Array W) (lookup : Lookup) : Option (W × List W) := do
+  let multiplicity ← buffer[lookup.multiplicity]?
+  let args ← readNodes buffer lookup.args
+  return (multiplicity, args)
+
+def evalLookup (ops : EvalOps W) (values : Values W) (trees : Array Expr)
+    (lookup : Lookup) : Option (W × List W) := do
+  let multiplicity ← (trees[lookup.multiplicity]?).bind (Expr.eval ops values)
+  let args ← evalRoots ops values trees lookup.args
+  return (multiplicity, args)
+
+theorem Reflects.readNodes {ops : EvalOps W} {values : Values W} {trees : Array Expr} {buffer : Array W}
+    (reflects : Reflects ops values trees buffer) (roots : List Nat) :
+    readNodes buffer roots = evalRoots ops values trees roots := by
+  simp only [Aiur.NativeAIR.readNodes, evalRoots, reflects.2]
+
+theorem Reflects.readLookup {ops : EvalOps W} {values : Values W} {trees : Array Expr} {buffer : Array W}
+    (reflects : Reflects ops values trees buffer) (lookup : Lookup) :
+    readLookup buffer lookup = evalLookup ops values trees lookup := by
+  simp only [Aiur.NativeAIR.readLookup, evalLookup, reflects.2, reflects.readNodes]
+
+theorem readNodes_congr (left right : Array W) (roots : List Nat)
+    (agree : ∀ index ∈ roots, left[index]? = right[index]?) : readNodes left roots = readNodes right roots := by
+  induction roots with
+  | nil => rfl
+  | cons root roots ih =>
+    simp only [readNodes, List.mapM_cons, agree root (by simp)]
+    rw [show roots.mapM (fun index => left[index]?) = roots.mapM (fun index => right[index]?) from
+      ih (fun index member => agree index (by simp [member]))]
+
+theorem readNodes_defined (buffer : Array W) (roots : List Nat)
+    (bound : ∀ index ∈ roots, index < buffer.size) :
+    ∃ values, readNodes buffer roots = some values ∧ values.length = roots.length := by
+  induction roots with
+  | nil => exact ⟨[], rfl, rfl⟩
+  | cons root roots ih =>
+    obtain ⟨values, read, size⟩ := ih (fun index member => bound index (by simp [member]))
+    have rootBound := bound root (by simp)
+    refine ⟨buffer[root] :: values, ?_, congrArg (· + 1) size⟩
+    simp only [readNodes, List.mapM_cons, Array.getElem?_eq_getElem rootBound, bind, Option.bind]
+    change (readNodes buffer roots).bind (fun values => some (buffer[root] :: values)) = _
+    rw [read]; rfl
+
+theorem readLookup_defined (buffer : Array W) (lookup : Lookup)
+    (bound : ∀ index ∈ lookup.roots, index < buffer.size) :
+    ∃ value, readLookup buffer lookup = some value ∧ value.2.length = lookup.args.length := by
+  have rootBound := bound lookup.multiplicity (by simp [Lookup.roots])
+  obtain ⟨args, read, length⟩ := readNodes_defined buffer lookup.args
+    (fun index member => bound index (by simp [Lookup.roots, member]))
+  exact ⟨(buffer[lookup.multiplicity], args), by
+    simp only [readLookup, Array.getElem?_eq_getElem rootBound, read, bind, Option.bind, pure], length⟩
+
+theorem Graph.Valid.lookup_values_agree {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths)
+    (ops : EvalOps W) (values : Values W) {full prefixValues : Array W}
+    (fullSweep : graph.sweep ops values = some full)
+    (partialSweep : graph.sweepLookupPrefix ops values = some prefixValues)
+    (size : prefixValues.size = graph.lookupPrefix) (lookup : Lookup) (member : lookup ∈ graph.lookups) :
+    readLookup full lookup = readLookup prefixValues lookup := by
+  have bound : ∀ index ∈ lookup.roots, index < prefixValues.size := by
+    intro index root
+    rw [size]
+    exact roots_below_prefix graph.lookupRoots index (List.mem_flatMap.mpr ⟨lookup, member, root⟩)
+  have agree : ∀ index ∈ lookup.roots, full[index]? = prefixValues[index]? :=
+    fun index root => valid.lookup_sweep_agrees ops values fullSweep partialSweep index (bound index root)
+  simp only [readLookup, agree lookup.multiplicity (by simp [Lookup.roots])]
+  rw [readNodes_congr full prefixValues lookup.args
+    (fun index root => agree index (by simp [Lookup.roots, root]))]
+
+theorem Graph.Valid.lookup_values_reflect {widths : GraphWidths} {graph : Graph} (valid : graph.Valid widths)
+    (ops : EvalOps W) (values : Values W) {trees : Array Expr} {full prefixValues : Array W}
+    (unfolded : graph.unfold = some trees)
+    (fullSweep : graph.sweep ops values = some full)
+    (partialSweep : graph.sweepLookupPrefix ops values = some prefixValues)
+    (size : prefixValues.size = graph.lookupPrefix) (lookup : Lookup) (member : lookup ∈ graph.lookups) :
+    readLookup prefixValues lookup = evalLookup ops values trees lookup :=
+  (valid.lookup_values_agree ops values fullSweep partialSweep size lookup member).symm.trans
+    ((graph.sweep_reflects ops values unfolded fullSweep).readLookup lookup)
+
+def goldilocksOps : EvalOps G := ⟨id, (· + ·), (· - ·), (· * ·), (0 - ·)⟩
+
+end Aiur.NativeAIR
diff --git a/Ix/Aiur/Proofs/Extension.lean b/Ix/Aiur/Proofs/Extension.lean
new file mode 100644
index 000000000..c2daaf43f
--- /dev/null
+++ b/Ix/Aiur/Proofs/Extension.lean
@@ -0,0 +1,220 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Extension
+import Ix.Aiur.Proofs.GoldilocksAlgebra
+
+/-! Algebra of the native quadratic coordinates, with base embedding,
+conjugation, norm and the working operations used by expression reflection.
+Ring laws alone do not establish that the quadratic algebra is a field.
+-/
+
+namespace Aiur.NativeAIR.ProofCodec.Extension
+
+theorem ext {a b : Extension} (c0 : a.c0 = b.c0) (c1 : a.c1 = b.c1) : a = b := by
+  cases a; cases b; cases c0; cases c1; rfl
+
+theorem ofBase_injective {a b : G} (equal : ofBase a = ofBase b) : a = b :=
+  congrArg Extension.c0 equal
+
+theorem ofBase_add (a b : G) : ofBase (a + b) = ofBase a + ofBase b := by
+  apply ext
+  · rfl
+  · change (0 : G) = 0 + 0; grind
+
+theorem ofBase_sub (a b : G) : ofBase (a - b) = ofBase a - ofBase b := by
+  apply ext
+  · rfl
+  · change (0 : G) = 0 - 0; grind
+
+theorem ofBase_neg (a : G) : ofBase (-a) = -ofBase a := by
+  apply ext
+  · rfl
+  · change (0 : G) = 0 - 0; grind
+
+theorem ofBase_mul (a b : G) : ofBase (a * b) = ofBase a * ofBase b := by
+  apply ext
+  · change a * b = a * b + 0 * (0 * 7); grind
+  · change (0 : G) = a * 0 + 0 * b; grind
+
+theorem add_zero (a : Extension) : a + 0 = a := by
+  apply ext
+  · exact G.add_zero a.c0
+  · exact G.add_zero a.c1
+
+theorem add_comm (a b : Extension) : a + b = b + a :=
+  ext (G.add_comm _ _) (G.add_comm _ _)
+
+theorem add_assoc (a b c : Extension) : a + b + c = a + (b + c) :=
+  ext (G.add_assoc _ _ _) (G.add_assoc _ _ _)
+
+theorem mul_one (a : Extension) : a * 1 = a := by
+  apply ext
+  · change a.c0 * 1 + a.c1 * (0 * 7) = a.c0; grind
+  · change a.c0 * 0 + a.c1 * 1 = a.c1; grind
+
+theorem zero_mul (a : Extension) : 0 * a = 0 := by
+  apply ext
+  · change 0 * a.c0 + 0 * (a.c1 * 7) = (0 : G); grind
+  · change 0 * a.c1 + 0 * a.c0 = (0 : G); grind
+
+theorem mul_comm (a b : Extension) : a * b = b * a := by
+  apply ext
+  · change a.c0 * b.c0 + a.c1 * (b.c1 * 7) = b.c0 * a.c0 + b.c1 * (a.c1 * 7); grind
+  · change a.c0 * b.c1 + a.c1 * b.c0 = b.c0 * a.c1 + b.c1 * a.c0; grind
+
+theorem mul_assoc (a b c : Extension) : a * b * c = a * (b * c) := by
+  apply ext
+  · change (a.c0 * b.c0 + a.c1 * (b.c1 * 7)) * c.c0 +
+      (a.c0 * b.c1 + a.c1 * b.c0) * (c.c1 * 7) =
+      a.c0 * (b.c0 * c.c0 + b.c1 * (c.c1 * 7)) + a.c1 * ((b.c0 * c.c1 + b.c1 * c.c0) * 7)
+    grind
+  · change (a.c0 * b.c0 + a.c1 * (b.c1 * 7)) * c.c1 +
+      (a.c0 * b.c1 + a.c1 * b.c0) * c.c0 =
+      a.c0 * (b.c0 * c.c1 + b.c1 * c.c0) + a.c1 * (b.c0 * c.c0 + b.c1 * (c.c1 * 7))
+    grind
+
+theorem left_distrib (a b c : Extension) : a * (b + c) = a * b + a * c := by
+  apply ext
+  · change a.c0 * (b.c0 + c.c0) + a.c1 * ((b.c1 + c.c1) * 7) =
+      (a.c0 * b.c0 + a.c1 * (b.c1 * 7)) + (a.c0 * c.c0 + a.c1 * (c.c1 * 7))
+    grind
+  · change a.c0 * (b.c1 + c.c1) + a.c1 * (b.c0 + c.c0) =
+      (a.c0 * b.c1 + a.c1 * b.c0) + (a.c0 * c.c1 + a.c1 * c.c0)
+    grind
+
+theorem neg_add_cancel (a : Extension) : -a + a = 0 := by
+  apply ext
+  · exact G.neg_add_cancel a.c0
+  · exact G.neg_add_cancel a.c1
+
+theorem sub_eq_add_neg (a b : Extension) : a - b = a + -b :=
+  ext (G.sub_eq_add_neg _ _) (G.sub_eq_add_neg _ _)
+
+instance natCast : NatCast Extension := ⟨fun n => ofBase (G.ofNat n)⟩
+instance intCast : IntCast Extension := ⟨fun n => ofBase (G.ofInt n)⟩
+instance nsmul : SMul Nat Extension := ⟨fun n a => ofBase (G.ofNat n) * a⟩
+instance zsmul : SMul Int Extension := ⟨fun n a => ofBase (G.ofInt n) * a⟩
+instance npow : HPow Extension Nat Extension := ⟨fun a n => npowRec n a⟩
+
+theorem neg_mul (a b : Extension) : -a * b = -(a * b) := by
+  apply ext
+  · change (0 - a.c0) * b.c0 + (0 - a.c1) * (b.c1 * 7) =
+      0 - (a.c0 * b.c0 + a.c1 * (b.c1 * 7))
+    grind
+  · change (0 - a.c0) * b.c1 + (0 - a.c1) * b.c0 =
+      0 - (a.c0 * b.c1 + a.c1 * b.c0)
+    grind
+
+instance commRing : Lean.Grind.CommRing Extension where
+  add_zero := add_zero
+  add_comm := add_comm
+  add_assoc := add_assoc
+  mul_assoc := mul_assoc
+  mul_comm := mul_comm
+  mul_one := mul_one
+  left_distrib := left_distrib
+  zero_mul := zero_mul
+  mul_zero a := by rw [mul_comm, zero_mul]
+  pow_zero _ := rfl
+  pow_succ _ _ := rfl
+  ofNat_succ n := by
+    change ofBase (G.ofNat (n + 1)) = ofBase (G.ofNat n) + ofBase 1
+    rw [G.ofNat_add, ofBase_add]
+    rfl
+  neg_add_cancel := neg_add_cancel
+  sub_eq_add_neg := sub_eq_add_neg
+  intCast_neg n := by
+    change ofBase (G.ofInt (-n)) = -ofBase (G.ofInt n)
+    rw [G.ofInt_neg, ofBase_neg]
+  neg_zsmul n a := by
+    change ofBase (G.ofInt (-n)) * a = -(ofBase (G.ofInt n) * a)
+    rw [G.ofInt_neg, ofBase_neg, neg_mul]
+
+theorem basis_square : basis * basis = ofBase 7 := by decide +kernel
+
+theorem coordinates (a : Extension) : a = ofBase a.c0 + ofBase a.c1 * basis := by
+  apply ext
+  · change a.c0 = a.c0 + (a.c1 * 0 + 0 * (1 * 7)); grind
+  · change a.c1 = 0 + (a.c1 * 1 + 0 * 0); grind
+
+theorem scale_eq_mul (a : Extension) (b : G) : a.scale b = a * ofBase b := by
+  apply ext
+  · change a.c0 * b = a.c0 * b + a.c1 * (0 * 7); grind
+  · change a.c1 * b = a.c0 * 0 + a.c1 * b; grind
+
+theorem conjugate_conjugate (a : Extension) : a.conjugate.conjugate = a := by
+  apply ext
+  · rfl
+  · exact G.neg_neg a.c1
+
+theorem mul_conjugate (a : Extension) : a * a.conjugate = ofBase a.norm := by
+  apply ext
+  · change a.c0 * a.c0 + a.c1 * ((0 - a.c1) * 7) = a.c0 * a.c0 - 7 * (a.c1 * a.c1)
+    grind
+  · change a.c0 * (0 - a.c1) + a.c1 * a.c0 = (0 : G); grind
+
+theorem conjugate_mul (a b : Extension) : (a * b).conjugate = a.conjugate * b.conjugate := by
+  apply ext
+  · change a.c0 * b.c0 + a.c1 * (b.c1 * 7) = a.c0 * b.c0 + (0 - a.c1) * ((0 - b.c1) * 7)
+    grind
+  · change 0 - (a.c0 * b.c1 + a.c1 * b.c0) = a.c0 * (0 - b.c1) + (0 - a.c1) * b.c0
+    grind
+
+theorem norm_mul (a b : Extension) : (a * b).norm = a.norm * b.norm := by
+  apply ofBase_injective
+  rw [ofBase_mul, ← mul_conjugate, ← mul_conjugate, ← mul_conjugate, conjugate_mul]
+  grind
+
+theorem evalLaws : EvalLaws evalOps where
+  konst_add := ofBase_add
+  konst_sub := ofBase_sub
+  konst_mul := ofBase_mul
+  konst_neg := ofBase_neg
+  add_zero := add_zero
+  zero_add a := by change 0 + a = a; grind
+  sub_zero a := by change a - 0 = a; grind
+  zero_sub a := by change 0 - a = -a; grind
+  mul_zero a := by change a * 0 = 0; grind
+  zero_mul := zero_mul
+  mul_one := mul_one
+  one_mul a := by change 1 * a = a; grind
+  neg_neg a := by change - - a = a; grind
+
+theorem powBits_eq (a : Extension) (n fuel : Nat) (bounded : n < 2 ^ fuel) :
+    powBits a n fuel = a ^ n := by
+  induction fuel generalizing n with
+  | zero =>
+    have zero : n = 0 := by simpa using bounded
+    subst n
+    rfl
+  | succ fuel ih =>
+    by_cases zero : n = 0
+    · subst n
+      rfl
+    · have half : n / 2 < 2 ^ fuel :=
+        (Nat.div_lt_iff_lt_mul (by decide)).mpr (by simpa only [Nat.pow_succ] using bounded)
+      simp only [powBits, beq_iff_eq, if_neg zero, ih _ half]
+      by_cases even : n % 2 = 0
+      · rw [if_pos even, ← Lean.Grind.Semiring.pow_add]
+        congr 1
+        omega
+      · rw [if_neg even, ← Lean.Grind.Semiring.pow_add, ← Lean.Grind.Semiring.pow_succ]
+        congr 1
+        omega
+
+theorem power_eq (a : Extension) (n : Nat) : power a n = a ^ n :=
+  powBits_eq a n _ Nat.lt_log2_self
+
+theorem ofBase_power (a : G) (n : Nat) : ofBase (a ^ n) = ofBase a ^ n := by
+  induction n with
+  | zero => rfl
+  | succ n ih => rw [Lean.Grind.Semiring.pow_succ, Lean.Grind.Semiring.pow_succ, ofBase_mul, ih]
+
+theorem inverse_formula (a : Extension) :
+    a.tryInverse = if a = 0 then none else some (a.conjugate * ofBase (a.norm ^ (gSize.toNat - 2))) := by
+  simp only [tryInverse, beq_iff_eq, scale_eq_mul, G.inverse_eq_power]
+
+end Aiur.NativeAIR.ProofCodec.Extension
diff --git a/Ix/Aiur/Proofs/ExtensionField.lean b/Ix/Aiur/Proofs/ExtensionField.lean
new file mode 100644
index 000000000..8220bdc3a
--- /dev/null
+++ b/Ix/Aiur/Proofs/ExtensionField.lean
@@ -0,0 +1,108 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Extension
+import Ix.Aiur.Proofs.GoldilocksInverse
+
+/-! The native relation `u² = 7` gives a field. A kernel-evaluated Euler
+certificate and the proved Goldilocks Fermat theorem exclude square roots
+of seven. The norm is therefore nonzero on every nonzero extension value,
+which validates the concrete inverse formula used by the native backend.
+-/
+
+namespace Aiur.G
+
+theorem seven_euler_certificate : G.pow 7 ((gSize.toNat - 1) / 2) = 0 - 1 := by
+  decide +kernel
+
+theorem seven_not_square (a : G) : a * a ≠ 7 := by
+  intro square
+  have nonzero : a ≠ 0 := by
+    intro zero
+    rw [zero, G.mul_zero] at square
+    exact (by decide : (0 : G) ≠ 7) square
+  have raised := congrArg (fun value : G => value ^ ((gSize.toNat - 1) / 2)) square
+  rw [Lean.Grind.CommSemiring.mul_pow, ← Lean.Grind.Semiring.pow_add] at raised
+  have twice : (gSize.toNat - 1) / 2 + (gSize.toNat - 1) / 2 = gSize.toNat - 1 := by decide
+  rw [twice, fermat a nonzero, ← G.pow_eq _ _ (by decide), seven_euler_certificate] at raised
+  exact (by decide : (1 : G) ≠ 0 - 1) raised
+
+theorem square_ratio (x y inverse : G) (square : x * x = 7 * (y * y))
+    (cancel : y * inverse = 1) : (x * inverse) * (x * inverse) = 7 := by
+  grind
+
+end Aiur.G
+
+namespace Aiur.NativeAIR.ProofCodec.Extension
+
+theorem norm_zero_iff (a : Extension) : a.norm = 0 ↔ a = 0 := by
+  constructor
+  · intro zero
+    have square : a.c0 * a.c0 = 7 * (a.c1 * a.c1) := by
+      change a.c0 * a.c0 - 7 * (a.c1 * a.c1) = 0 at zero
+      exact (G.sub_eq_zero_iff _ _).mp zero
+    by_cases last : a.c1 = 0
+    · rw [last, G.mul_zero, G.mul_zero] at square
+      have first := (G.mul_eq_zero_iff _ _).mp square
+      apply ext
+      · exact first.elim id id
+      · exact last
+    · have inverse := G.mul_inverse_cancel a.c1 last
+      exact False.elim (G.seven_not_square (a.c0 * a.c1.inverse) (G.square_ratio _ _ _ square inverse))
+  · intro zero
+    rw [zero]
+    rfl
+
+theorem mul_eq_zero_iff (a b : Extension) : a * b = 0 ↔ a = 0 ∨ b = 0 := by
+  constructor
+  · intro zero
+    have norms := congrArg norm zero
+    rw [norm_mul] at norms
+    change a.norm * b.norm = 0 at norms
+    rcases (G.mul_eq_zero_iff _ _).mp norms with left | right
+    · exact Or.inl ((norm_zero_iff a).mp left)
+    · exact Or.inr ((norm_zero_iff b).mp right)
+  · rintro (rfl | rfl) <;> grind
+
+theorem one_ne_zero : (1 : Extension) ≠ 0 := by decide
+
+theorem mul_left_cancel {a b c : Extension} (nonzero : a ≠ 0) (equal : a * b = a * c) : b = c := by
+  have zero : a * (b - c) = 0 := by grind
+  have equal := (mul_eq_zero_iff _ _).mp zero |>.resolve_left nonzero
+  grind
+
+theorem inverse_correct (a : Extension) (nonzero : a ≠ 0) :
+    a.tryInverse = some (a.conjugate.scale a.norm.inverse) ∧
+      a * (a.conjugate.scale a.norm.inverse) = 1 := by
+  constructor
+  · simp only [tryInverse, beq_iff_eq, if_neg nonzero]
+  · have normNonzero : a.norm ≠ 0 := fun zero => nonzero ((norm_zero_iff a).mp zero)
+    rw [scale_eq_mul, ← mul_assoc, mul_conjugate, ← ofBase_mul, G.mul_inverse_cancel _ normNonzero]
+    rfl
+
+theorem tryInverse_none_iff (a : Extension) : a.tryInverse = none ↔ a = 0 := by
+  simp only [tryInverse, beq_iff_eq]
+  split <;> simp_all
+
+theorem tryInverse_some_iff (a b : Extension) : a.tryInverse = some b ↔ a * b = 1 := by
+  constructor
+  · intro accepted
+    have nonzero : a ≠ 0 := by
+      intro zero
+      rw [zero, tryInverse] at accepted
+      cases accepted
+    obtain ⟨returned, correct⟩ := inverse_correct a nonzero
+    have same := Option.some.inj (accepted.symm.trans returned)
+    exact same ▸ correct
+  · intro inverse
+    have nonzero : a ≠ 0 := by
+      intro zero
+      rw [zero, zero_mul] at inverse
+      exact one_ne_zero inverse.symm
+    obtain ⟨returned, correct⟩ := inverse_correct a nonzero
+    have result := mul_left_cancel nonzero (inverse.trans correct.symm)
+    exact result.symm ▸ returned
+
+end Aiur.NativeAIR.ProofCodec.Extension
diff --git a/Ix/Aiur/Proofs/ExtensionMmcs.lean b/Ix/Aiur/Proofs/ExtensionMmcs.lean
new file mode 100644
index 000000000..14474cc1f
--- /dev/null
+++ b/Ix/Aiur/Proofs/ExtensionMmcs.lean
@@ -0,0 +1,255 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ExtensionMmcs
+import Ix.Aiur.Proofs.PrunedMerkle
+
+/-! Extension-coordinate packing and its authenticated row correspondence. -/
+
+namespace Aiur.NativeAIR.ExtensionMmcs
+
+open Merkle (Digest Hash Dimensions)
+open ProofCodec (Extension)
+
+theorem baseRow_length (values : List Extension) : (baseRow values).length = values.length * 2 := by
+  induction values with
+  | nil => rfl
+  | cons value values ih =>
+    simp only [baseRow, List.flatMap_cons, List.cons_append, List.nil_append, List.length_cons] at ih ⊢
+    omega
+
+theorem baseRow_injective {left right : List Extension} (same : baseRow left = baseRow right) : left = right := by
+  induction left generalizing right with
+  | nil =>
+    have count := congrArg List.length same
+    rw [baseRow_length, baseRow_length] at count
+    have empty : right.length = 0 := by simp only [List.length_nil] at count; omega
+    exact (List.eq_nil_of_length_eq_zero empty).symm
+  | cons value values ih =>
+    cases right with
+    | nil =>
+      have count := congrArg List.length same
+      rw [baseRow_length, baseRow_length] at count
+      simp only [List.length_cons, List.length_nil] at count
+      omega
+    | cons other others =>
+      simp only [baseRow, List.flatMap_cons, List.cons_append, List.nil_append, List.cons.injEq] at same
+      have rowEq : value = other := by
+        cases value
+        cases other
+        simp only [Extension.mk.injEq]
+        exact ⟨same.1, same.2.1⟩
+      rw [rowEq, ih same.2.2]
+
+theorem baseRows_length (rows : List (List Extension)) : (baseRows rows).length = rows.length :=
+  List.length_map _
+
+theorem baseRows_injective {left right : List (List Extension)} (same : baseRows left = baseRows right) : left = right := by
+  induction left generalizing right with
+  | nil =>
+    have count := congrArg List.length same
+    rw [baseRows_length, baseRows_length] at count
+    exact (List.eq_nil_of_length_eq_zero count.symm).symm
+  | cons row rows ih =>
+    cases right with
+    | nil => simp only [baseRows, List.map_cons, List.map_nil, List.cons_ne_nil] at same
+    | cons other others =>
+      simp only [baseRows, List.map_cons, List.cons.injEq] at same
+      rw [baseRow_injective same.1, ih same.2]
+
+theorem baseRows_fields (rows : List (List Extension)) :
+    (baseRows rows).flatten.length = rows.flatten.length * 2 := by
+  induction rows with
+  | nil => rfl
+  | cons row rows ih =>
+    simp only [baseRows, List.map_cons, List.flatten_cons, List.length_append, baseRow_length] at ih ⊢
+    omega
+
+theorem baseDimensions_length (wordBits : Nat) (dimensions : List Dimensions) :
+    (baseDimensions wordBits dimensions).length = dimensions.length := List.length_map _
+
+theorem baseDimensions_heights (wordBits : Nat) (dimensions : List Dimensions) :
+    (baseDimensions wordBits dimensions).map Dimensions.logHeight = dimensions.map Dimensions.logHeight := by
+  simp only [baseDimensions, List.map_map, Function.comp_def]
+
+theorem baseDimensions_maxHeight (wordBits : Nat) (dimensions : List Dimensions) :
+    Merkle.maxHeight (baseDimensions wordBits dimensions) = Merkle.maxHeight dimensions := by
+  simp only [Merkle.maxHeight, baseDimensions_heights]
+
+theorem baseDimensions_covered (wordBits : Nat) (dimensions : List Dimensions) (capHeight : Nat) :
+    Merkle.covered (baseDimensions wordBits dimensions) capHeight = Merkle.covered dimensions capHeight := by
+  simp only [Merkle.covered, baseDimensions_heights]
+
+theorem baseDimensions_exact {wordBits : Nat} {dimensions : List Dimensions} (bounded : WidthsFit wordBits dimensions) :
+    baseDimensions wordBits dimensions = dimensions.map (fun dimension => { dimension with width := dimension.width * 2 }) := by
+  apply List.map_congr_left
+  intro dimension member
+  simp only [Nat.mod_eq_of_lt (bounded dimension member)]
+
+theorem shape_base {wordBits : Nat} {dimensions : List Dimensions} {rows : List (List Extension)}
+    (bounded : WidthsFit wordBits dimensions) :
+    Merkle.shape (baseDimensions wordBits dimensions) (baseRows rows) = shape dimensions rows := by
+  rw [baseDimensions_exact bounded]
+  induction dimensions generalizing rows with
+  | nil => cases rows <;> rfl
+  | cons dimension dimensions ih =>
+    have tailBound : WidthsFit wordBits dimensions :=
+      fun child member => bounded child (List.mem_cons.mpr (Or.inr member))
+    cases rows with
+    | nil => rfl
+    | cons row rows =>
+      have count : ((baseRow row).length == dimension.width * 2) = (row.length == dimension.width) := by
+        rw [baseRow_length]
+        have equality : (row.length * 2 = dimension.width * 2) ↔ row.length = dimension.width := by omega
+        apply Bool.eq_iff_iff.mpr
+        simpa only [beq_iff_eq] using equality
+      change (((baseRow row).length == dimension.width * 2) &&
+        Merkle.shape (dimensions.map (fun dimension => { dimension with width := dimension.width * 2 }))
+          (baseRows rows)) = ((row.length == dimension.width) && shape dimensions rows)
+      rw [count, ih tailBound]
+
+theorem fri_width_fits {logArity height : Nat} (bounded : logArity ≤ 32) :
+    WidthsFit 64 [⟨2^logArity, height⟩] := by
+  intro dimension member
+  obtain rfl := List.mem_singleton.mp member
+  change 2^logArity * 2 < 2^64
+  rw [← Nat.pow_succ]
+  exact Nat.pow_lt_pow_right (by decide) (by omega)
+
+theorem baseRows_query {indices : List Nat} {rows : List (List (List Extension))}
+    {index : Nat} {query : List (List Extension)} (member : (index, query) ∈ indices.zip rows) :
+    (index, baseRows query) ∈ indices.zip (rows.map baseRows) := by
+  rw [List.zip_map_right]
+  exact List.mem_map.mpr ⟨(index, query), member, rfl⟩
+
+theorem replay_shape {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {rows : List (List Extension)} {proof : List Digest} {result : Merkle.Replay}
+    (bounded : WidthsFit wordBits dimensions)
+    (success : replay hash wordBits dimensions capHeight index rows proof = some result) :
+    shape dimensions rows = true := by
+  have fits := (Merkle.replay_success success).2.1
+  rwa [shape_base bounded] at fits
+
+theorem verifyMulti_individual {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {indices : List Nat} {cap : List Digest} {rows : List (List (List Extension))} {query : List (List Extension)}
+    {proof : List Digest}
+    (accepted : verifyMulti hash wordBits dimensions capHeight indices cap rows proof = true)
+    (member : (index, query) ∈ indices.zip rows) :
+    ∃ path result, replay hash wordBits dimensions capHeight index query path = some result ∧
+      verify hash wordBits dimensions capHeight index cap query path = true ∧
+      result.hashing.inputs ⊆ (replayMulti hash wordBits dimensions capHeight indices rows proof).inputs :=
+  PrunedMerkle.verify_individual accepted (baseRows_query member)
+
+theorem verifyMulti_shape {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {indices : List Nat} {cap : List Digest} {rows : List (List (List Extension))} {query : List (List Extension)}
+    {proof : List Digest}
+    (bounded : WidthsFit wordBits dimensions)
+    (accepted : verifyMulti hash wordBits dimensions capHeight indices cap rows proof = true)
+    (member : (index, query) ∈ indices.zip rows) : shape dimensions query = true := by
+  obtain ⟨_, _, result, _, _⟩ := verifyMulti_individual accepted member
+  exact replay_shape bounded result
+
+theorem verifyMultiCovered_individual {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {indices : List Nat} {cap : List Digest} {rows : List (List (List Extension))} {query : List (List Extension)}
+    {proof : List Digest}
+    (accepted : verifyMultiCovered hash wordBits dimensions capHeight indices cap rows proof = true)
+    (member : (index, query) ∈ indices.zip rows) :
+    ∃ path result, replay hash wordBits dimensions capHeight index query path = some result ∧
+      verifyCovered hash wordBits dimensions capHeight index cap query path = true ∧
+      result.hashing.inputs ⊆ (replayMulti hash wordBits dimensions capHeight indices rows proof).inputs := by
+  simp only [verifyMultiCovered, Bool.and_eq_true] at accepted
+  obtain ⟨path, result, evaluated, verified, subset⟩ := verifyMulti_individual accepted.2 member
+  exact ⟨path, result, evaluated, by simp only [verifyCovered, accepted.1, verified, Bool.and_self], subset⟩
+
+theorem replay_native_input {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {rows : List (List Extension)} {proof : List Digest} {result : Merkle.Replay}
+    (success : replay hash wordBits dimensions capHeight index rows proof = some result)
+    (bounded : rows.flatten.length < 2^60) {input : List UInt8} (member : input ∈ result.hashing.inputs) :
+    Blake3.NativeInput input := by
+  have baseBound : (baseRows rows).flatten.length < 2^61 := by rw [baseRows_fields]; omega
+  exact Merkle.replay_native_input success baseBound member
+
+theorem verifyCovered_collision {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {cap : List Digest} {leftRows rightRows : List (List Extension)} {leftProof rightProof : List Digest}
+    (left : verifyCovered hash wordBits dimensions capHeight index cap leftRows leftProof = true)
+    (right : verifyCovered hash wordBits dimensions capHeight index cap rightRows rightProof = true)
+    (different : leftRows ≠ rightRows) :
+    ∃ left right, replay hash wordBits dimensions capHeight index leftRows leftProof = some left ∧
+      replay hash wordBits dimensions capHeight index rightRows rightProof = some right ∧
+      Merkle.CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) ∧
+      (left.hashing.inputs ++ right.hashing.inputs).length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) := by
+  simp only [verifyCovered, Bool.and_eq_true] at left right
+  have coverage : Merkle.covered (baseDimensions wordBits dimensions) capHeight = true := by
+    simpa only [baseDimensions_covered] using left.1
+  have distinct : baseRows leftRows ≠ baseRows rightRows := fun same => different (baseRows_injective same)
+  simpa only [replay, baseDimensions_maxHeight] using Merkle.verify_collision coverage left.2 right.2 distinct
+
+theorem verifyMultiCovered_collision {hash : Hash} {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {leftIndices rightIndices : List Nat} {cap : List Digest}
+    {leftRows rightRows : List (List (List Extension))} {leftQuery rightQuery : List (List Extension)}
+    {leftProof rightProof : List Digest}
+    (left : verifyMultiCovered hash wordBits dimensions capHeight leftIndices cap leftRows leftProof = true)
+    (right : verifyMultiCovered hash wordBits dimensions capHeight rightIndices cap rightRows rightProof = true)
+    (leftMember : (index, leftQuery) ∈ leftIndices.zip leftRows)
+    (rightMember : (index, rightQuery) ∈ rightIndices.zip rightRows)
+    (different : leftQuery ≠ rightQuery) :
+    ∃ inputs,
+      inputs ⊆ (replayMulti hash wordBits dimensions capHeight leftIndices leftRows leftProof).inputs ++
+        (replayMulti hash wordBits dimensions capHeight rightIndices rightRows rightProof).inputs ∧
+      Merkle.CollisionOn hash inputs ∧ inputs.length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ inputs, input.length ≤ max 64 (16 * max leftQuery.flatten.length rightQuery.flatten.length) := by
+  simp only [verifyMultiCovered, Bool.and_eq_true] at left right
+  have coverage : Merkle.covered (baseDimensions wordBits dimensions) capHeight = true := by
+    simpa only [baseDimensions_covered] using left.1
+  have distinct : baseRows leftQuery ≠ baseRows rightQuery := fun same => different (baseRows_injective same)
+  obtain ⟨inputs, subset, collision, count, bytes⟩ := PrunedMerkle.verify_collision coverage left.2 right.2
+    (baseRows_query leftMember) (baseRows_query rightMember) distinct
+  refine ⟨inputs, subset, collision, ?_, ?_⟩
+  · simpa only [baseDimensions_maxHeight] using count
+  · intro input member
+    have bounded := bytes input member
+    rw [baseRows_fields, baseRows_fields] at bounded
+    omega
+
+theorem blake3_native_collision {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {cap : List Digest} {leftRows rightRows : List (List Extension)} {leftProof rightProof : List Digest}
+    (left : verifyCovered Blake3.digest wordBits dimensions capHeight index cap leftRows leftProof = true)
+    (right : verifyCovered Blake3.digest wordBits dimensions capHeight index cap rightRows rightProof = true)
+    (different : leftRows ≠ rightRows)
+    (leftBound : leftRows.flatten.length < 2^60) (rightBound : rightRows.flatten.length < 2^60) :
+    ∃ left right, replay Blake3.digest wordBits dimensions capHeight index leftRows leftProof = some left ∧
+      replay Blake3.digest wordBits dimensions capHeight index rightRows rightProof = some right ∧
+      Merkle.CollisionOn Blake3.digest (left.hashing.inputs ++ right.hashing.inputs) ∧
+      (left.hashing.inputs ++ right.hashing.inputs).length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ left.hashing.inputs ++ right.hashing.inputs, Blake3.NativeInput input := by
+  obtain ⟨left, right, leftReplay, rightReplay, collision, count⟩ := verifyCovered_collision left right different
+  refine ⟨left, right, leftReplay, rightReplay, collision, count, ?_⟩
+  intro input member
+  exact (List.mem_append.mp member).elim (replay_native_input leftReplay leftBound)
+    (replay_native_input rightReplay rightBound)
+
+theorem blake3_multi_native_collision {wordBits capHeight index : Nat} {dimensions : List Dimensions}
+    {leftIndices rightIndices : List Nat} {cap : List Digest}
+    {leftRows rightRows : List (List (List Extension))} {leftQuery rightQuery : List (List Extension)}
+    {leftProof rightProof : List Digest}
+    (left : verifyMultiCovered Blake3.digest wordBits dimensions capHeight leftIndices cap leftRows leftProof = true)
+    (right : verifyMultiCovered Blake3.digest wordBits dimensions capHeight rightIndices cap rightRows rightProof = true)
+    (leftMember : (index, leftQuery) ∈ leftIndices.zip leftRows)
+    (rightMember : (index, rightQuery) ∈ rightIndices.zip rightRows)
+    (different : leftQuery ≠ rightQuery)
+    (leftBound : leftQuery.flatten.length < 2^60) (rightBound : rightQuery.flatten.length < 2^60) :
+    ∃ inputs,
+      inputs ⊆ (replayMulti Blake3.digest wordBits dimensions capHeight leftIndices leftRows leftProof).inputs ++
+        (replayMulti Blake3.digest wordBits dimensions capHeight rightIndices rightRows rightProof).inputs ∧
+      Merkle.CollisionOn Blake3.digest inputs ∧ inputs.length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ inputs, Blake3.NativeInput input := by
+  obtain ⟨inputs, subset, collision, count, bytes⟩ := verifyMultiCovered_collision left right leftMember rightMember different
+  refine ⟨inputs, subset, collision, count, ?_⟩
+  intro input member
+  have := bytes input member
+  unfold Blake3.NativeInput
+  omega
+
+end Aiur.NativeAIR.ExtensionMmcs
diff --git a/Ix/Aiur/Proofs/Field.lean b/Ix/Aiur/Proofs/Field.lean
new file mode 100644
index 000000000..07da05f5e
--- /dev/null
+++ b/Ix/Aiur/Proofs/Field.lean
@@ -0,0 +1,268 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Lookup
+import Init.Data.Nat.Coprime
+import Init.Data.List.Nat.Range
+import Init.Data.List.Perm
+
+/-!
+Primality and local field consequences for the actual Goldilocks model.
+
+A kernel-checked certificate gives a unit of order `2^32` modulo every
+nontrivial divisor of `2^64 - 2^32 + 1`. Its first `2^32` powers are distinct,
+so each such divisor is at least `2^32`. Two nontrivial factors would have
+product at least `2^64`, proving primality. Only 32 modular squarings are
+evaluated; the proof neither enumerates the field nor evaluates enormous
+unreduced powers. It uses no native-evaluation axiom or external field oracle.
+
+The resulting no-zero-divisors theorem discharges boolean-selector and
+equality-test polynomial implications. These are arithmetic facts about
+Lean's `G`; extraction from native constraint expressions remains separate.
+-/
+
+namespace Aiur.GoldilocksProof
+
+/-- Repeated modular squaring, with an explicit modulus and base. -/
+def squareMod (modulus base : Nat) : Nat → Nat
+  | 0 => base % modulus
+  | n + 1 => let previous := squareMod modulus base n; previous * previous % modulus
+
+theorem squareMod_eq (modulus base n : Nat) :
+    squareMod modulus base n = base ^ (2 ^ n) % modulus := by
+  induction n with
+  | zero => simp [squareMod]
+  | succ n ih =>
+    rw [squareMod, ih, Nat.pow_succ, Nat.pow_mul]
+    simp only [Nat.pow_two, Nat.mul_mod_mod, Nat.mod_mul_mod]
+
+theorem squareMod_half : squareMod gSize.toNat 1753635133440165772 31 = gSize.toNat - 1 := by
+  decide +kernel
+
+theorem squareMod_full : squareMod gSize.toNat 1753635133440165772 32 = 1 := by
+  decide +kernel
+
+theorem pow_mod_period {modulus base period : Nat} (hmod : 1 < modulus)
+    (hperiod : base ^ period % modulus = 1) (exponent : Nat) :
+    base ^ exponent % modulus = base ^ (exponent % period) % modulus := by
+  conv => lhs; rw [← Nat.mod_add_div exponent period]
+  rw [Nat.pow_add, Nat.pow_mul, Nat.mul_mod, Nat.pow_mod (base ^ period), hperiod]
+  simp only [Nat.one_pow, Nat.mod_eq_of_lt hmod, Nat.mul_one, Nat.mod_mod]
+
+theorem pow_mod_gcd {modulus base : Nat} (hmod : 1 < modulus) (a b : Nat)
+    (ha : base ^ a % modulus = 1) (hb : base ^ b % modulus = 1) :
+    base ^ (Nat.gcd a b) % modulus = 1 := by
+  induction a using Nat.strongRecOn generalizing b with
+  | ind a ih =>
+    by_cases hz : a = 0
+    · subst a; simpa only [Nat.gcd_zero_left] using hb
+    · rw [Nat.gcd_rec]
+      apply ih (b % a) (Nat.mod_lt _ (Nat.pos_of_ne_zero hz)) a
+      · exact (pow_mod_period hmod ha b).symm.trans hb
+      · exact ha
+
+theorem divisor_two_pow {d n : Nat} (divides : d ∣ 2 ^ n) :
+    ∃ k, k ≤ n ∧ d = 2 ^ k := by
+  induction n generalizing d with
+  | zero => exact ⟨0, Nat.le_refl _, Nat.eq_one_of_dvd_one divides⟩
+  | succ n ih =>
+    rw [Nat.pow_succ, Nat.dvd_mul] at divides
+    obtain ⟨a, b, ha, hb, equal⟩ := divides
+    obtain ⟨k, hk, rfl⟩ := ih ha
+    have bound : b ≤ 2 := Nat.le_of_dvd (by decide) hb
+    have positive : 0 < b := Nat.pos_of_dvd_of_pos hb (by decide)
+    have cases : b = 1 ∨ b = 2 := by omega
+    rcases cases with rfl | rfl
+    · exact ⟨k, by omega, by simpa only [Nat.mul_one] using equal.symm⟩
+    · exact ⟨k + 1, by omega, by simpa only [Nat.pow_succ] using equal.symm⟩
+
+theorem proper_divisor_two_pow {d n : Nat} (divides : d ∣ 2 ^ (n + 1))
+    (proper : d < 2 ^ (n + 1)) : d ∣ 2 ^ n := by
+  obtain ⟨k, hk, rfl⟩ := divisor_two_pow divides
+  apply Nat.pow_dvd_pow
+  have ne : k ≠ n + 1 := by intro equal; subst k; exact Nat.lt_irrefl _ proper
+  omega
+
+theorem pow_mod_ne_one {modulus base n : Nat} (hmod : 1 < modulus)
+    (full : base ^ (2 ^ (n + 1)) % modulus = 1)
+    (half : base ^ (2 ^ n) % modulus ≠ 1)
+    {k : Nat} (positive : 0 < k) (small : k < 2 ^ (n + 1)) :
+    base ^ k % modulus ≠ 1 := by
+  intro equal
+  have hg := pow_mod_gcd hmod k (2 ^ (n + 1)) equal full
+  have gd : Nat.gcd k (2 ^ (n + 1)) ∣ 2 ^ n := by
+    apply proper_divisor_two_pow (Nat.gcd_dvd_right _ _)
+    exact Nat.lt_of_le_of_lt (Nat.gcd_le_left _ positive) small
+  apply half
+  rw [pow_mod_period hmod hg, Nat.mod_eq_zero_of_dvd gd]
+  exact Nat.mod_eq_of_lt hmod
+
+theorem pow_mod_injective {modulus base n : Nat} (hmod : 1 < modulus)
+    (full : base ^ (2 ^ (n + 1)) % modulus = 1)
+    (half : base ^ (2 ^ n) % modulus ≠ 1)
+    {i j : Nat} (hi : i < 2 ^ (n + 1)) (hj : j < 2 ^ (n + 1))
+    (equal : base ^ i % modulus = base ^ j % modulus) : i = j := by
+  suffices step : ∀ i j, i < j → j < 2 ^ (n + 1) →
+      base ^ i % modulus = base ^ j % modulus → False by
+    by_cases h : i < j
+    · exact False.elim (step i j h hj equal)
+    · by_cases h' : j < i
+      · exact False.elim (step j i h' hi equal.symm)
+      · omega
+  intro i j lt bound same
+  have translated : base ^ (i + (2 ^ (n + 1) - i)) % modulus =
+      base ^ (j + (2 ^ (n + 1) - i)) % modulus := by
+    rw [Nat.pow_add base i, Nat.pow_add base j,
+      Nat.mul_mod (base ^ i), Nat.mul_mod (base ^ j), same]
+  have left : i + (2 ^ (n + 1) - i) = 2 ^ (n + 1) := by omega
+  have right : j + (2 ^ (n + 1) - i) = (j - i) + 2 ^ (n + 1) := by omega
+  rw [left, full, right, Nat.pow_add, Nat.mul_mod, full, Nat.mul_one, Nat.mod_mod] at translated
+  exact pow_mod_ne_one hmod full half (by omega) (by omega) translated.symm
+
+theorem two_pow_le_modulus {modulus base n : Nat} (hmod : 1 < modulus)
+    (full : base ^ (2 ^ (n + 1)) % modulus = 1)
+    (half : base ^ (2 ^ n) % modulus ≠ 1) : 2 ^ (n + 1) ≤ modulus := by
+  let residues := List.ofFn fun i : Fin (2 ^ (n + 1)) => base ^ i.val % modulus
+  have distinct : residues.Nodup := by
+    apply List.pairwise_iff_getElem.mpr
+    intro i j hi hj lt same
+    simp only [residues, List.getElem_ofFn] at same
+    have hi' : i < 2 ^ (n + 1) := by simpa only [residues, List.length_ofFn] using hi
+    have hj' : j < 2 ^ (n + 1) := by simpa only [residues, List.length_ofFn] using hj
+    have equal := pow_mod_injective hmod full half hi' hj' same
+    omega
+  have subset : residues ⊆ List.range modulus := by
+    intro value member
+    obtain ⟨i, rfl⟩ := List.mem_ofFn.mp member
+    exact List.mem_range.mpr (Nat.mod_lt _ (by omega))
+  have bound := distinct.length_le_of_subset subset
+  simpa only [residues, List.length_ofFn, List.length_range] using bound
+
+/-- A power-of-two order certificate forces every nontrivial divisor to
+contain at least that many distinct residues. -/
+theorem two_power_divisor_bound {modulus base n : Nat}
+    (certificateFull : squareMod modulus base (n + 1) = 1)
+    (certificateHalf : Nat.gcd modulus (squareMod modulus base n - 1) = 1)
+    {d : Nat} (divides : d ∣ modulus) (nontrivial : 1 < d) : 2 ^ (n + 1) ≤ d := by
+  have full : base ^ (2 ^ (n + 1)) % d = 1 := by
+    have h := congrArg (· % d) certificateFull
+    rw [squareMod_eq, Nat.mod_mod_of_dvd _ divides, Nat.mod_eq_of_lt nontrivial] at h
+    exact h
+  have half : base ^ (2 ^ n) % d ≠ 1 := by
+    intro equal
+    have h : squareMod modulus base n % d = 1 := by
+      rw [squareMod_eq, Nat.mod_mod_of_dvd _ divides, equal]
+    have hd : d ∣ squareMod modulus base n - 1 :=
+      Nat.dvd_of_mod_eq_zero (Nat.sub_mod_eq_zero_of_mod_eq
+        (h.trans (Nat.mod_eq_of_lt nontrivial).symm))
+    have one := Nat.dvd_gcd divides hd
+    rw [certificateHalf] at one
+    have := Nat.eq_one_of_dvd_one one
+    omega
+  exact two_pow_le_modulus nontrivial full half
+
+theorem nontrivial_divisor_large {d : Nat} (divides : d ∣ gSize.toNat)
+    (nontrivial : 1 < d) : 2 ^ 32 ≤ d := by
+  apply two_power_divisor_bound (modulus := gSize.toNat) (base := 1753635133440165772)
+    (n := 31) squareMod_full ?_ divides nontrivial
+  rw [squareMod_half]
+  decide +kernel
+
+theorem goldilocks_divisors {d : Nat} (divides : d ∣ gSize.toNat) :
+    d = 1 ∨ d = gSize.toNat := by
+  obtain ⟨e, product⟩ := divides
+  by_cases hd : d = 1
+  · exact Or.inl hd
+  · by_cases he : e = 1
+    · exact Or.inr (by simpa only [he, Nat.mul_one] using product.symm)
+    · have positiveD : 0 < d := Nat.pos_of_dvd_of_pos ⟨e, product⟩ (by decide)
+      have dividesE : e ∣ gSize.toNat := ⟨d, product.trans (Nat.mul_comm _ _)⟩
+      have positiveE : 0 < e := Nat.pos_of_dvd_of_pos dividesE (by decide)
+      have boundD := nontrivial_divisor_large ⟨e, product⟩ (by omega)
+      have boundE := nontrivial_divisor_large dividesE (by omega)
+      have impossible := Nat.mul_le_mul boundD boundE
+      rw [← product] at impossible
+      have bad : ¬(2 ^ 32 * 2 ^ 32 ≤ gSize.toNat) := by decide +kernel
+      exact False.elim (bad impossible)
+
+end Aiur.GoldilocksProof
+
+namespace Aiur
+
+/-- Primality stated explicitly as the nontriviality and divisor criterion. -/
+theorem gSize_prime : 1 < gSize.toNat ∧
+    ∀ d : Nat, d ∣ gSize.toNat → d = 1 ∨ d = gSize.toNat :=
+  ⟨by decide, fun _ => GoldilocksProof.goldilocks_divisors⟩
+
+theorem G.n_eq_zero_iff (a : G) : a.n = 0 ↔ a = 0 := by
+  constructor
+  · intro equal
+    rw [← G.ofNat_n a, equal]
+    rfl
+  · intro equal; subst a; rfl
+
+theorem G.coprime_characteristic_of_ne_zero {a : G} (nonzero : a ≠ 0) :
+    Nat.Coprime gSize.toNat a.n := by
+  have positive : 0 < a.n := Nat.pos_of_ne_zero fun equal => nonzero ((G.n_eq_zero_iff a).mp equal)
+  have bounded : a.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp a.property
+  rcases GoldilocksProof.goldilocks_divisors (Nat.gcd_dvd_left gSize.toNat a.n) with one | whole
+  · exact one
+  · have small := Nat.gcd_le_right gSize.toNat positive
+    rw [whole] at small
+    omega
+
+theorem G.mul_eq_zero_iff (a b : G) : a * b = 0 ↔ a = 0 ∨ b = 0 := by
+  constructor
+  · intro equal
+    by_cases zero : a = 0
+    · exact Or.inl zero
+    · apply Or.inr
+      have numeric := congrArg G.n equal
+      rw [G.n_mul] at numeric
+      have divides : gSize.toNat ∣ b.n :=
+        (G.coprime_characteristic_of_ne_zero zero).dvd_of_dvd_mul_left
+          (Nat.dvd_of_mod_eq_zero numeric)
+      have bound : b.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp b.property
+      apply (G.n_eq_zero_iff b).mp
+      by_cases z : b.n = 0
+      · exact z
+      · have large := Nat.le_of_dvd (Nat.pos_of_ne_zero z) divides
+        omega
+  · rintro (rfl | rfl)
+    · rw [G.mul_comm, G.mul_zero]
+    · exact G.mul_zero a
+
+theorem G.mul_eq_zero_of_left_ne_zero {a b : G} (nonzero : a ≠ 0) (zero : a * b = 0) :
+    b = 0 := (G.mul_eq_zero_iff a b).mp zero |>.resolve_left nonzero
+
+theorem G.boolean_of_constraint {value : G} (satisfied : value * (value - 1) = 0) :
+    value = 0 ∨ value = 1 := by
+  rcases (G.mul_eq_zero_iff _ _).mp satisfied with zero | one
+  · exact Or.inl zero
+  · exact Or.inr ((G.sub_eq_zero_iff value 1).mp one)
+
+theorem G.boolean_of_one_sub_constraint {value : G} (satisfied : value * (1 - value) = 0) :
+    value = 0 ∨ value = 1 := by
+  rcases (G.mul_eq_zero_iff _ _).mp satisfied with zero | one
+  · exact Or.inl zero
+  · exact Or.inr (((G.sub_eq_zero_iff 1 value).mp one).symm)
+
+theorem G.eqZero_of_constraints {input inverse output : G}
+    (annihilate : input * output = 0)
+    (complement : input * inverse + output - 1 = 0) : output = G.eqZero input := by
+  by_cases zero : input = 0
+  · rw [zero, G.mul_comm (0 : G), G.mul_zero, G.zero_add] at complement
+    rw [G.eqZero, if_pos zero]
+    exact (G.sub_eq_zero_iff output 1).mp complement
+  · rw [G.eqZero, if_neg zero]
+    exact G.mul_eq_zero_of_left_ne_zero zero annihilate
+
+theorem G.ne_zero_of_inverse_constraint {input inverse : G}
+    (satisfied : input * inverse - 1 = 0) : input ≠ 0 := by
+  intro zero
+  rw [zero, G.mul_comm (0 : G), G.mul_zero] at satisfied
+  exact G.one_ne_zero ((G.sub_eq_zero_iff (0 : G) 1).mp satisfied).symm
+
+end Aiur
diff --git a/Ix/Aiur/Proofs/Folding.lean b/Ix/Aiur/Proofs/Folding.lean
new file mode 100644
index 000000000..569a907fe
--- /dev/null
+++ b/Ix/Aiur/Proofs/Folding.lean
@@ -0,0 +1,202 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Folding
+import Ix.Aiur.Proofs.Interpolation
+
+/-! A native row fold evaluates one global polynomial of reduced degree.
+The same global coefficients apply at every child-domain query point.
+-/
+
+namespace Aiur.NativeAIR.Folding
+
+open Lean.Grind
+open _root_.Aiur.NativeAIR.Quotient (horner horner_nil horner_cons)
+
+variable {R : Type} [CommRing R]
+
+theorem horner_split (point : R) (width : Nat) (coefficients : List R) :
+    horner point coefficients = horner point (coefficients.take width) +
+      point ^ width * horner point (coefficients.drop width) := by
+  have split := Quotient.horner_append point (coefficients.take width) (coefficients.drop width)
+  rw [List.take_append_drop, List.length_take] at split
+  by_cases enough : width ≤ coefficients.length
+  · simpa only [Nat.min_eq_left enough] using split
+  · have empty : coefficients.drop width = [] := List.drop_eq_nil_iff.mpr (by omega)
+    rw [empty, horner_nil, Semiring.mul_zero, Semiring.add_zero] at split ⊢
+    exact split
+
+theorem rowCoefficients_length (arity : Domain.Subgroup) (point : R) (coefficients : List R) :
+    (rowCoefficients arity point coefficients).length ≤ Domain.size arity := by
+  induction coefficients using rowCoefficients.induct arity with
+  | case1 => rw [rowCoefficients, dif_pos rfl]; exact Nat.zero_le _
+  | case2 coefficients nonempty ih =>
+    rw [rowCoefficients, dif_neg nonempty, Polynomial.add_length, Polynomial.scale_length]
+    apply Nat.max_le.mpr
+    exact ⟨by simp only [List.length_take]; omega, ih⟩
+
+theorem rowCoefficients_value (arity : Domain.Subgroup) (point root : R) (coefficients : List R)
+    (power : root ^ Domain.size arity = point) :
+    horner root (rowCoefficients arity point coefficients) = horner root coefficients := by
+  induction coefficients using rowCoefficients.induct arity with
+  | case1 => rw [rowCoefficients, dif_pos rfl]
+  | case2 coefficients nonempty ih =>
+    rw [rowCoefficients, dif_neg nonempty, Polynomial.horner_add, Polynomial.horner_scale, ih]
+    exact (horner_split root (Domain.size arity) coefficients |>.trans (by rw [power])).symm
+
+theorem rowCoefficients_fold (arity : Domain.Subgroup) (point challenge : R) (coefficients : List R) :
+    horner challenge (rowCoefficients arity point coefficients) =
+      horner point (foldCoefficients arity challenge coefficients) := by
+  induction coefficients using rowCoefficients.induct arity with
+  | case1 => rw [rowCoefficients, dif_pos rfl, foldCoefficients, dif_pos rfl]; rfl
+  | case2 coefficients nonempty ih =>
+    rw [rowCoefficients, dif_neg nonempty, foldCoefficients, dif_neg nonempty,
+      Polynomial.horner_add, Polynomial.horner_scale, horner_cons, ih]
+
+theorem foldCoefficients_degree (arity : Domain.Subgroup) (challenge : R) (degree : Nat)
+    (coefficients : List R) (bounded : coefficients.length ≤ Domain.size arity * degree) :
+    (foldCoefficients arity challenge coefficients).length ≤ degree := by
+  induction degree generalizing coefficients with
+  | zero =>
+    have empty : coefficients = [] := by simpa only [Nat.mul_zero, Nat.le_zero, List.length_eq_zero_iff] using bounded
+    subst coefficients
+    rw [foldCoefficients, dif_pos rfl]
+    exact Nat.le_refl _
+  | succ degree ih =>
+    by_cases empty : coefficients = []
+    · subst coefficients; rw [foldCoefficients, dif_pos rfl]; exact Nat.zero_le _
+    · rw [foldCoefficients, dif_neg empty, List.length_cons]
+      apply Nat.succ_le_succ
+      apply ih
+      simp only [List.length_drop]
+      rw [Nat.mul_succ] at bounded
+      omega
+
+open ProofCodec (Extension)
+
+theorem foldRow_global (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (values coefficients : List Extension)
+    (shape : values.length = Domain.size arity)
+    (agrees : ∀ sample ∈ Interpolation.foldSamples parent arity index values,
+      horner sample.1 coefficients = sample.2) (challenge : Extension) :
+    Interpolation.foldRow parent arity index values challenge =
+      some (horner (Extension.ofBase (FriDomain.queryPoint child index))
+        (foldCoefficients arity challenge coefficients)) := by
+  rw [← rowCoefficients_fold]
+  apply Interpolation.foldRow_evaluate parent child arity dimensions bounded values
+    (rowCoefficients arity (Extension.ofBase (FriDomain.queryPoint child index)) coefficients)
+    shape (rowCoefficients_length arity _ coefficients)
+  intro sample member
+  rw [rowCoefficients_value arity _ sample.1 coefficients, agrees sample member]
+  have power := Interpolation.foldSamples_powers parent child arity dimensions index values shape sample member
+  rwa [Interpolation.foldSamples_length parent arity index values shape] at power
+
+theorem foldRow_codeword (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (coefficients : List Extension)
+    (challenge : Extension) :
+    Interpolation.foldRow parent arity index
+      ((Polynomial.foldingNodes parent arity index).map (fun root => horner (Extension.ofBase root) coefficients))
+      challenge = some (horner (Extension.ofBase (FriDomain.queryPoint child index))
+        (foldCoefficients arity challenge coefficients)) := by
+  apply foldRow_global parent child arity dimensions bounded _ coefficients
+  · simp only [List.length_map, Polynomial.foldingNodes_length]
+  · intro sample member
+    unfold Interpolation.foldSamples at member
+    have mapped :
+        (Polynomial.foldingNodes parent arity index).map (fun root => horner (Extension.ofBase root) coefficients) =
+          ((Polynomial.foldingNodes parent arity index).map Extension.ofBase).map (fun root => horner root coefficients) := by
+      rw [List.map_map]
+      rfl
+    rw [mapped, ← List.map_prod_left_eq_zip] at member
+    obtain ⟨root, _, rfl⟩ := List.mem_map.mp member
+    rfl
+
+theorem foldRow_codeword_degree (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) (degree : Nat)
+    (coefficients : List Extension) (length : coefficients.length ≤ Domain.size arity * degree)
+    (challenge : Extension) :
+    ∃ folded : List Extension, folded.length ≤ degree ∧
+      ∀ index, index < 2^(parent.val - arity.val) →
+        Interpolation.foldRow parent arity index
+          ((Polynomial.foldingNodes parent arity index).map (fun root => horner (Extension.ofBase root) coefficients))
+          challenge = some (horner (Extension.ofBase (FriDomain.queryPoint child index)) folded) := by
+  exact ⟨foldCoefficients arity challenge coefficients,
+    foldCoefficients_degree arity challenge degree coefficients length,
+    fun _ bounded => foldRow_codeword parent child arity dimensions bounded coefficients challenge⟩
+
+theorem values_of_agreement (parent arity : Domain.Subgroup) (index : Nat)
+    (values coefficients : List Extension) (shape : values.length = Domain.size arity)
+    (agrees : ∀ sample ∈ Interpolation.foldSamples parent arity index values,
+      horner sample.1 coefficients = sample.2) :
+    values = (Polynomial.foldingNodes parent arity index).map (fun root => horner (Extension.ofBase root) coefficients) := by
+  calc
+    values = (Interpolation.foldSamples parent arity index values).map Prod.snd := by
+      apply Eq.symm
+      apply List.map_snd_zip
+      simp only [List.length_map, Polynomial.foldingNodes_length, shape, Nat.le_refl]
+    _ = (Interpolation.foldSamples parent arity index values).map (fun sample => horner sample.1 coefficients) :=
+      List.map_congr_left (fun sample member => (agrees sample member).symm)
+    _ = _ := by
+      simpa only [List.map_map, Function.comp_def] using
+        congrArg (List.map (fun root => horner root coefficients))
+          (Interpolation.foldSamples_roots parent arity index values shape)
+
+theorem interpolant_values (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (values : List Extension)
+    (shape : values.length = Domain.size arity) :
+    values = (Polynomial.foldingNodes parent arity index).map (fun root => horner (Extension.ofBase root)
+      (Interpolation.coefficients (Interpolation.foldSamples parent arity index values)
+        (Extension.ofBase (Interpolation.foldScale parent arity index)))) := by
+  apply values_of_agreement parent arity index values _ shape
+  intro sample member
+  have atNode := Interpolation.foldRow_at_node parent child arity dimensions bounded values shape sample.1 sample.2 member
+  rw [Interpolation.foldRow_polynomial parent child arity dimensions bounded values shape] at atNode
+  exact Option.some.inj atNode
+
+theorem interpolants_different (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (left right : List Extension)
+    (leftShape : left.length = Domain.size arity) (rightShape : right.length = Domain.size arity)
+    (different : left ≠ right) :
+    ¬ Polynomial.IsZero (Polynomial.sub
+      (Interpolation.coefficients (Interpolation.foldSamples parent arity index left)
+        (Extension.ofBase (Interpolation.foldScale parent arity index)))
+      (Interpolation.coefficients (Interpolation.foldSamples parent arity index right)
+        (Extension.ofBase (Interpolation.foldScale parent arity index)))) := by
+  intro zero
+  apply different
+  conv => lhs; rw [interpolant_values parent child arity dimensions bounded left leftShape]
+  conv => rhs; rw [interpolant_values parent child arity dimensions bounded right rightShape]
+  apply List.map_congr_left
+  intro root _
+  have equal := Polynomial.horner_zero (Extension.ofBase root) zero
+  rw [Polynomial.horner_sub] at equal
+  exact (LogUp.sub_zero_iff _ _).mp equal
+
+/-- A deterministic bound for two fixed distinct rows and distinct challenges. -/
+theorem foldRow_equal_count_le (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (left right challenges : List Extension)
+    (leftShape : left.length = Domain.size arity) (rightShape : right.length = Domain.size arity)
+    (different : left ≠ right) (unique : challenges.Nodup) :
+    (challenges.filter (fun challenge => Interpolation.foldRow parent arity index left challenge ==
+      Interpolation.foldRow parent arity index right challenge)).length ≤ Domain.size arity - 1 := by
+  have bound := Polynomial.equal_count_le (fun a b => (Extension.mul_eq_zero_iff a b).mp) _ _ challenges
+    (interpolants_different parent child arity dimensions bounded left right leftShape rightShape different) unique
+  have leftBound := Interpolation.coefficients_length (Interpolation.foldSamples parent arity index left)
+    (Extension.ofBase (Interpolation.foldScale parent arity index))
+  have rightBound := Interpolation.coefficients_length (Interpolation.foldSamples parent arity index right)
+    (Extension.ofBase (Interpolation.foldScale parent arity index))
+  rw [Interpolation.foldSamples_length parent arity index left leftShape] at leftBound
+  rw [Interpolation.foldSamples_length parent arity index right rightShape] at rightBound
+  simp only [Interpolation.foldRow_polynomial parent child arity dimensions bounded left leftShape,
+    Interpolation.foldRow_polynomial parent child arity dimensions bounded right rightShape,
+    Option.some_beq_some]
+  omega
+
+end Aiur.NativeAIR.Folding
diff --git a/Ix/Aiur/Proofs/FriDomain.lean b/Ix/Aiur/Proofs/FriDomain.lean
new file mode 100644
index 000000000..049883c3f
--- /dev/null
+++ b/Ix/Aiur/Proofs/FriDomain.lean
@@ -0,0 +1,286 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.FriDomain
+import Ix.Aiur.Proofs.Domain
+
+/-! The bit-reversal permutation, nested two-adic generators, and the
+field points used by FRI input openings, row folding and final evaluation.
+-/
+
+namespace Aiur.NativeAIR.FriDomain
+
+open Lean.Grind
+
+theorem reverseBits_bound (bits index : Nat) : reverseBits bits index < 2^bits :=
+  (BitVec.ofNat bits index).reverse.isLt
+
+theorem reverseBits_zero (bits : Nat) : reverseBits bits 0 = 0 := by
+  unfold reverseBits
+  rw [show BitVec.ofNat bits 0 = 0#bits from rfl,
+    (BitVec.reverse_eq_zero_iff).mpr rfl]
+  rfl
+
+theorem reverseBits_zero_width (index : Nat) : reverseBits 0 index = 0 := by
+  have := reverseBits_bound 0 index
+  simp only [Nat.pow_zero] at this
+  omega
+
+theorem reverseBits_mod (bits index : Nat) :
+    reverseBits bits (index % 2^bits) = reverseBits bits index := by
+  unfold reverseBits
+  congr 2
+  apply BitVec.eq_of_toNat_eq
+  simp
+
+theorem reverseBits_involution (bits index : Nat) :
+    reverseBits bits (reverseBits bits index) = index % 2^bits := by
+  simp only [reverseBits, BitVec.ofNat_toNat, BitVec.setWidth_eq,
+    BitVec.reverse_reverse_eq, BitVec.toNat_ofNat]
+
+theorem reverseBits_injective {bits left right : Nat}
+    (leftBound : left < 2^bits) (rightBound : right < 2^bits)
+    (equal : reverseBits bits left = reverseBits bits right) : left = right := by
+  have same := congrArg (reverseBits bits) equal
+  simpa only [reverseBits_involution, Nat.mod_eq_of_lt leftBound,
+    Nat.mod_eq_of_lt rightBound] using same
+
+theorem reverseBits_surjective {bits index : Nat} (bounded : index < 2^bits) :
+    ∃ original < 2^bits, reverseBits bits original = index :=
+  ⟨reverseBits bits index, reverseBits_bound _ _,
+    (reverseBits_involution _ _).trans (Nat.mod_eq_of_lt bounded)⟩
+
+theorem index_split_bound {low high index : Nat} (bounded : index < 2^(high + low)) :
+    index / 2^low < 2^high := by
+  rw [Nat.div_lt_iff_lt_mul (Nat.two_pow_pos _)]
+  simpa only [Nat.pow_add] using bounded
+
+theorem reverseBits_split {high low index : Nat} (bounded : index < 2^(high + low)) :
+    reverseBits (high + low) index =
+      reverseBits low (index % 2^low) * 2^high + reverseBits high (index / 2^low) := by
+  have decomposition : BitVec.ofNat (high + low) index =
+      BitVec.ofNat high (index / 2^low) ++ BitVec.ofNat low index := by
+    apply BitVec.eq_of_toNat_eq
+    simp only [BitVec.toNat_ofNat, Nat.mod_eq_of_lt bounded, BitVec.toNat_append,
+      Nat.mod_eq_of_lt (index_split_bound bounded)]
+    rw [← Nat.shiftLeft_add_eq_or_of_lt (Nat.mod_lt _ (Nat.two_pow_pos _)), Nat.shiftLeft_eq]
+    have := Nat.mod_add_div index (2^low)
+    rw [Nat.mul_comm] at this
+    omega
+  unfold reverseBits
+  rw [decomposition, BitVec.reverse_append, BitVec.toNat_cast, BitVec.toNat_append]
+  rw [show BitVec.ofNat low (index % 2^low) = BitVec.ofNat low index by
+    apply BitVec.eq_of_toNat_eq; simp]
+  rw [← Nat.shiftLeft_add_eq_or_of_lt (BitVec.isLt _), Nat.shiftLeft_eq]
+
+theorem reverseBits_padding {bits index : Nat} (bounded : index < 2^bits) (extra : Nat) :
+    reverseBits (extra + bits) index = reverseBits bits index * 2^extra := by
+  have bound : index < 2^(extra + bits) := Nat.lt_of_lt_of_le bounded
+    (Nat.pow_le_pow_right (by decide) (by omega))
+  rw [reverseBits_split bound, Nat.mod_eq_of_lt bounded, Nat.div_eq_of_lt bounded,
+    reverseBits_zero, Nat.add_zero]
+
+theorem wordReverse_eq {wordBits bits index : Nat}
+    (supported : bits ≤ wordBits) (bounded : index < 2^bits) :
+    wordReverse wordBits bits index = reverseBits bits index := by
+  by_cases empty : bits = 0
+  · subst bits
+    have zero : index = 0 := by simpa using bounded
+    subst index
+    simp only [wordReverse, Nat.sub_zero, Nat.mod_self,
+      reverseBits_zero, BitVec.toNat_ushiftRight, Nat.shiftRight_zero]
+    exact reverseBits_zero wordBits
+  · have shiftBound : wordBits - bits < wordBits := by omega
+    unfold wordReverse
+    rw [Nat.mod_eq_of_lt shiftBound, BitVec.toNat_ushiftRight, Nat.shiftRight_eq_div_pow]
+    change reverseBits wordBits index / 2^(wordBits - bits) = reverseBits bits index
+    conv => lhs; arg 1; rw [← Nat.sub_add_cancel supported]
+    rw [reverseBits_padding bounded, Nat.mul_div_cancel _ (Nat.two_pow_pos _)]
+
+theorem generator_nested (parent child : Domain.Subgroup) (nested : child.val ≤ parent.val) :
+    Domain.generator parent ^ (2^(parent.val - child.val)) = Domain.generator child := by
+  have step : ∀ (extra bits : Nat) (bounded : bits + extra < 33),
+      Domain.generator ⟨bits + extra, bounded⟩ ^ (2^extra) =
+        Domain.generator ⟨bits, by omega⟩ := by
+    intro extra
+    induction extra with
+    | zero => intro bits bounded; simp only [Nat.add_zero, Nat.pow_zero, Semiring.pow_one]
+    | succ extra ih =>
+      intro bits bounded
+      have square := Domain.generator_square_certificate ⟨bits + extra, by omega⟩
+      have powerSquare : Domain.generator ⟨bits + (extra + 1), bounded⟩ ^ 2 =
+          Domain.generator ⟨bits + extra, by omega⟩ := by
+        simpa only [Semiring.pow_succ, Semiring.pow_zero, Semiring.one_mul, Nat.add_assoc] using square
+      rw [Nat.pow_succ, Nat.mul_comm, Domain.Algebra.power_mul, powerSquare]
+      exact ih bits (by omega)
+  have result := step (parent.val - child.val) child.val (by have := parent.isLt; omega)
+  simpa only [Nat.add_sub_of_le nested] using result
+
+theorem queryPoint_eq (domain : Domain.Subgroup) (index : Nat) :
+    queryPoint domain index = Domain.generator domain ^ reverseBits domain.val index := by
+  exact G.pow_eq _ _ (Nat.lt_trans (reverseBits_bound _ _) (Domain.size_lt_u64 domain))
+
+theorem queryPoint_domain (domain : Domain.Subgroup) (index : Nat) :
+    queryPoint domain index = Domain.point domain ⟨reverseBits domain.val index, reverseBits_bound _ _⟩ := rfl
+
+theorem queryPoint_injective (domain : Domain.Subgroup) {left right : Nat}
+    (leftBound : left < Domain.size domain) (rightBound : right < Domain.size domain)
+    (equal : queryPoint domain left = queryPoint domain right) : left = right := by
+  have same := congrArg Fin.val (Domain.point_injective domain equal)
+  exact reverseBits_injective leftBound rightBound same
+
+theorem queryPoint_surjective (domain : Domain.Subgroup) (index : Fin (Domain.size domain)) :
+    ∃ query < Domain.size domain, queryPoint domain query = Domain.point domain index := by
+  obtain ⟨query, bound, reversed⟩ := reverseBits_surjective index.isLt
+  refine ⟨query, bound, ?_⟩
+  rw [queryPoint_domain]
+  congr 1
+  exact Fin.ext reversed
+
+theorem queryPoint_nonzero (domain : Domain.Subgroup) (index : Nat) :
+    queryPoint domain index ≠ 0 := Domain.point_nonzero _ _
+
+theorem queryPoint_power (domain : Domain.Subgroup) (index : Nat) :
+    queryPoint domain index ^ Domain.size domain = 1 := Domain.point_power _ _
+
+theorem queryPoint_zero (domain : Domain.Subgroup) : queryPoint domain 0 = 1 := by
+  rw [queryPoint_eq, reverseBits_zero, Semiring.pow_zero]
+
+theorem queryPoint_padding (parent child : Domain.Subgroup) (nested : child.val ≤ parent.val)
+    {index : Nat} (bounded : index < Domain.size child) :
+    queryPoint parent index = queryPoint child index := by
+  rw [queryPoint_eq, queryPoint_eq]
+  conv => lhs; arg 2; arg 1; rw [← Nat.sub_add_cancel nested]
+  rw [reverseBits_padding bounded, Nat.mul_comm, Domain.Algebra.power_mul, generator_nested _ _ nested]
+
+theorem index_join_bound {high low index slot : Nat}
+    (indexBound : index < 2^high) (slotBound : slot < 2^low) :
+    index * 2^low + slot < 2^(high + low) := by
+  have bound := Nat.mul_le_mul_right (2^low) (Nat.succ_le_of_lt indexBound)
+  rw [Nat.succ_mul, ← Nat.pow_add] at bound
+  omega
+
+theorem reverseBits_join {high low index slot : Nat}
+    (indexBound : index < 2^high) (slotBound : slot < 2^low) :
+    reverseBits (high + low) (index * 2^low + slot) =
+      reverseBits low slot * 2^high + reverseBits high index := by
+  rw [reverseBits_split (index_join_bound indexBound slotBound), Nat.mul_comm index,
+    Nat.mul_add_mod, Nat.mod_eq_of_lt slotBound,
+    Nat.mul_add_div (Nat.two_pow_pos _),
+    Nat.div_eq_of_lt slotBound, Nat.add_zero]
+
+theorem foldNode_eq (parent arity : Domain.Subgroup) (nested : arity.val ≤ parent.val)
+    {index slot : Nat} (indexBound : index < 2^(parent.val - arity.val))
+    (slotBound : slot < Domain.size arity) :
+    foldNode parent arity index slot = queryPoint parent (index * Domain.size arity + slot) := by
+  have firstBound : reverseBits (parent.val - arity.val) index < 2^64 :=
+    Nat.lt_of_lt_of_le (reverseBits_bound _ _)
+      (Nat.pow_le_pow_right (by decide) (by have := parent.isLt; omega))
+  rw [foldNode, G.pow_eq _ _ firstBound,
+    G.pow_eq _ _ (Nat.lt_trans (reverseBits_bound _ _) (Domain.size_lt_u64 arity)), queryPoint_eq]
+  change _ = Domain.generator parent ^
+    reverseBits parent.val (index * 2^arity.val + slot)
+  conv => rhs; arg 2; arg 1; rw [← Nat.sub_add_cancel nested]
+  rw [reverseBits_join indexBound slotBound, Semiring.pow_add,
+    Nat.mul_comm, Domain.Algebra.power_mul, generator_nested _ _ nested]
+  exact G.mul_comm _ _
+
+theorem foldNode_injective (parent arity : Domain.Subgroup) (nested : arity.val ≤ parent.val)
+    {index left right : Nat} (indexBound : index < 2^(parent.val - arity.val))
+    (leftBound : left < Domain.size arity) (rightBound : right < Domain.size arity)
+    (equal : foldNode parent arity index left = foldNode parent arity index right) : left = right := by
+  rw [foldNode_eq _ _ nested indexBound leftBound,
+    foldNode_eq _ _ nested indexBound rightBound] at equal
+  have boundLeft := index_join_bound indexBound leftBound
+  have boundRight := index_join_bound indexBound rightBound
+  rw [Nat.sub_add_cancel nested] at boundLeft boundRight
+  have same := queryPoint_injective parent boundLeft boundRight equal
+  omega
+
+theorem foldNode_nonzero (parent arity : Domain.Subgroup) (nested : arity.val ≤ parent.val)
+    {index slot : Nat} (indexBound : index < 2^(parent.val - arity.val))
+    (slotBound : slot < Domain.size arity) : foldNode parent arity index slot ≠ 0 := by
+  rw [foldNode_eq _ _ nested indexBound slotBound]
+  exact queryPoint_nonzero _ _
+
+theorem foldNode_power (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) (index slot : Nat) :
+    foldNode parent arity index slot ^ Domain.size arity = queryPoint child index := by
+  have nested : child.val ≤ parent.val := by omega
+  have height : parent.val - arity.val = child.val := by omega
+  have power : 2^(parent.val - child.val) = Domain.size arity := by
+    unfold Domain.size
+    congr 1
+    omega
+  unfold foldNode
+  rw [height, G.pow_eq _ _ (Nat.lt_trans (reverseBits_bound _ _) (Domain.size_lt_u64 child)),
+    G.pow_eq _ _ (Nat.lt_trans (reverseBits_bound _ _) (Domain.size_lt_u64 arity)),
+    CommSemiring.mul_pow]
+  have right : (Domain.generator arity ^ reverseBits arity.val slot) ^ Domain.size arity = 1 := by
+    rw [← Domain.Algebra.power_mul, Nat.mul_comm, Domain.Algebra.power_mul,
+      Domain.generator_power, Semiring.one_pow]
+  rw [right, Semiring.mul_one, ← Domain.Algebra.power_mul, Nat.mul_comm,
+    Domain.Algebra.power_mul, ← power, generator_nested _ _ nested, queryPoint_eq]
+
+theorem queryPoint_reduce (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < Domain.size parent) :
+    queryPoint parent index ^ Domain.size arity =
+      queryPoint child (index / Domain.size arity) := by
+  have nested : arity.val ≤ parent.val := by omega
+  have bound : index / Domain.size arity < 2^(parent.val - arity.val) := by
+    apply index_split_bound
+    simpa only [Nat.sub_add_cancel nested, Domain.size] using bounded
+  have reconstruct : index / Domain.size arity * Domain.size arity + index % Domain.size arity = index := by
+    have := Nat.mod_add_div index (Domain.size arity)
+    rw [Nat.mul_comm] at this
+    omega
+  have row := foldNode_eq parent arity nested bound (Nat.mod_lt index (Domain.size_positive arity))
+  rw [reconstruct] at row
+  rw [← row, foldNode_power _ _ _ dimensions]
+
+theorem inputPoint_nonzero (domain : Domain.Subgroup) (index : Nat) :
+    inputPoint domain index ≠ 0 := by
+  intro zero
+  exact ((G.mul_eq_zero_iff _ _).mp zero).elim (by decide) (queryPoint_nonzero _ _)
+
+theorem inputPoint_injective (domain : Domain.Subgroup) {left right : Nat}
+    (leftBound : left < Domain.size domain) (rightBound : right < Domain.size domain)
+    (equal : inputPoint domain left = inputPoint domain right) : left = right := by
+  apply queryPoint_injective domain leftBound rightBound
+  unfold inputPoint at equal
+  have zero : (7 : G) * (queryPoint domain left - queryPoint domain right) = 0 := by grind
+  exact (G.sub_eq_zero_iff _ _).mp (((G.mul_eq_zero_iff _ _).mp zero).resolve_left (by decide))
+
+theorem inputPoint_power (domain : Domain.Subgroup) (index : Nat) :
+    inputPoint domain index ^ Domain.size domain = (7 : G) ^ Domain.size domain := by
+  rw [inputPoint, CommSemiring.mul_pow, queryPoint_power, Semiring.mul_one]
+
+theorem coset_shift_certificate : G.pow 7 (2^32) ≠ 1 := by decide +kernel
+
+theorem coset_shift_not_root (domain : Domain.Subgroup) : (7 : G) ^ Domain.size domain ≠ 1 := by
+  intro root
+  have power := congrArg (fun value : G => value ^ (2^(32 - domain.val))) root
+  rw [← Domain.Algebra.power_mul, Domain.size, ← Nat.pow_add,
+    Nat.add_sub_of_le (by have := domain.isLt; omega), Semiring.one_pow,
+    ← G.pow_eq _ _ (by decide)] at power
+  exact coset_shift_certificate power
+
+theorem inputPoint_not_root (domain : Domain.Subgroup) (index : Nat) :
+    inputPoint domain index ^ Domain.size domain ≠ 1 := by
+  rw [inputPoint_power]
+  exact coset_shift_not_root domain
+
+theorem inputPoint_trace_disjoint (query trace : Domain.Subgroup)
+    (nested : trace.val ≤ query.val) (index : Nat) (row : Fin (Domain.size trace)) :
+    inputPoint query index ≠ Domain.point trace row := by
+  intro equal
+  apply inputPoint_not_root query index
+  rw [equal]
+  have sizes : Domain.size query = Domain.size trace * 2^(query.val - trace.val) := by
+    simp only [Domain.size, ← Nat.pow_add, Nat.add_sub_of_le nested]
+  rw [sizes, Domain.Algebra.power_mul, Domain.point_power, Semiring.one_pow]
+
+end Aiur.NativeAIR.FriDomain
diff --git a/Ix/Aiur/Proofs/FriQuery.lean b/Ix/Aiur/Proofs/FriQuery.lean
new file mode 100644
index 000000000..da8c59393
--- /dev/null
+++ b/Ix/Aiur/Proofs/FriQuery.lean
@@ -0,0 +1,355 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.FriQuery
+import Ix.Aiur.Proofs.Folding
+
+/-! Accepted query steps preserve sibling order and the carried value,
+evaluate the row interpolant and implement global polynomial folding.
+Complete chains consume descending input heights and reach the exact final
+index and polynomial value. The captured rows still require authentication.
+-/
+
+namespace Aiur.NativeAIR.FriQuery
+
+open ProofCodec (Extension)
+open _root_.Aiur.NativeAIR.Quotient (horner)
+
+theorem reconstruct_eq (arity : Domain.Subgroup) (index : Nat) (value : R) (siblings : List R)
+    (shape : siblings.length + 1 = Domain.size arity) :
+    reconstruct arity index value siblings = some (siblings.insertIdx (index % Domain.size arity) value) := by
+  simp only [reconstruct, shape, beq_self_eq_true, if_true]
+
+theorem reconstruct_success {arity : Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R}
+    (accepted : reconstruct arity index value siblings = some row) :
+    siblings.length + 1 = Domain.size arity ∧ row = siblings.insertIdx (index % Domain.size arity) value := by
+  unfold reconstruct at accepted
+  split at accepted
+  next shape => exact ⟨beq_iff_eq.mp shape, (Option.some.inj accepted).symm⟩
+  next _ => cases accepted
+
+theorem reconstruct_length {arity : Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R}
+    (accepted : reconstruct arity index value siblings = some row) : row.length = Domain.size arity := by
+  obtain ⟨shape, rfl⟩ := reconstruct_success accepted
+  rw [List.length_insertIdx_of_le_length _ value, shape]
+  have bounded := Nat.mod_lt index (Domain.size_positive arity)
+  omega
+
+theorem reconstruct_self {arity : Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R}
+    (accepted : reconstruct arity index value siblings = some row) :
+    row[index % Domain.size arity]? = some value := by
+  obtain ⟨shape, rfl⟩ := reconstruct_success accepted
+  rw [List.getElem?_insertIdx_self, if_pos]
+  have bounded := Nat.mod_lt index (Domain.size_positive arity)
+  omega
+
+theorem reconstruct_siblings {arity : Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R}
+    (accepted : reconstruct arity index value siblings = some row) :
+    row.eraseIdx (index % Domain.size arity) = siblings := by
+  obtain ⟨_, rfl⟩ := reconstruct_success accepted
+  exact List.eraseIdx_insertIdx_self value
+
+theorem step_success {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) :
+    0 < round.arity.val ∧ round.arity.val ≤ state.domain.val ∧
+      ∃ child values folded,
+        Domain.ofLogSize (state.domain.val - round.arity.val) = some child ∧
+        reconstruct round.arity state.index state.value round.siblings = some values ∧
+        Interpolation.foldRow state.domain round.arity (state.index / Domain.size round.arity) values round.challenge = some folded ∧
+        result = ⟨⟨child, state.index / Domain.size round.arity,
+          (roll child.val (round.challenge.power (Domain.size round.arity)) folded openings).1⟩,
+          (roll child.val (round.challenge.power (Domain.size round.arity)) folded openings).2,
+          ⟨child, state.index / Domain.size round.arity, values⟩⟩ := by
+  unfold step at accepted
+  split at accepted
+  next _ => cases accepted
+  next admitted =>
+    simp only [Bool.or_eq_true, beq_iff_eq, decide_eq_true_eq] at admitted
+    cases childRead : Domain.ofLogSize (state.domain.val - round.arity.val) with
+    | none => simp only [childRead, bind, Option.bind_none] at accepted; cases accepted
+    | some child =>
+      simp only [childRead, bind, Option.bind_some] at accepted
+      cases rowRead : reconstruct round.arity state.index state.value round.siblings with
+      | none => simp only [rowRead, Option.bind_none] at accepted; cases accepted
+      | some values =>
+        simp only [rowRead, Option.bind_some] at accepted
+        cases foldRead : Interpolation.foldRow state.domain round.arity
+            (state.index / Domain.size round.arity) values round.challenge with
+        | none => simp only [foldRead, Option.bind_none] at accepted; cases accepted
+        | some folded =>
+          simp only [foldRead, Option.bind_some, pure] at accepted
+          exact ⟨by omega, by omega, child, values, folded, rfl, rfl, foldRead,
+            (Option.some.inj accepted).symm⟩
+
+theorem step_dimensions {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) :
+    0 < round.arity.val ∧ state.domain.val = result.state.domain.val + round.arity.val ∧
+      result.state.index = state.index / Domain.size round.arity ∧
+      result.state.index < Domain.size result.state.domain ∧
+      result.row.domain = result.state.domain ∧ result.row.index = result.state.index := by
+  obtain ⟨positive, nested, child, values, folded, childRead, _, foldRead, rfl⟩ := step_success accepted
+  have childValue := Domain.ofLogSize_some childRead
+  have bounded := (Interpolation.foldRow_success foldRead).2.1
+  refine ⟨positive, by simp only; omega, rfl, ?_, rfl, rfl⟩
+  simpa only [Domain.size, childValue] using bounded
+
+theorem step_row {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) :
+    result.row.values.length = Domain.size round.arity ∧
+      result.row.values[state.index % Domain.size round.arity]? = some state.value ∧
+      result.row.values.eraseIdx (state.index % Domain.size round.arity) = round.siblings := by
+  obtain ⟨_, _, _, _, _, _, rowRead, _, rfl⟩ := step_success accepted
+  exact ⟨reconstruct_length rowRead, reconstruct_self rowRead, reconstruct_siblings rowRead⟩
+
+theorem step_index_bound {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) : state.index < Domain.size state.domain := by
+  obtain ⟨_, dimensions, index, bounded, _, _⟩ := step_dimensions accepted
+  rw [index, Nat.div_lt_iff_lt_mul (Domain.size_positive round.arity)] at bounded
+  simpa only [Domain.size, dimensions, Nat.pow_add] using bounded
+
+theorem step_self_sample {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) :
+    (Extension.ofBase (FriDomain.queryPoint state.domain state.index), state.value) ∈
+      Interpolation.foldSamples state.domain round.arity result.state.index result.row.values := by
+  obtain ⟨_, dimensions, index, bounded, _, _⟩ := step_dimensions accepted
+  have nested : round.arity.val ≤ state.domain.val := by omega
+  have groupBound : result.state.index < 2^(state.domain.val - round.arity.val) := by
+    simpa only [Domain.size, dimensions, Nat.add_sub_cancel] using bounded
+  have slotBound := Nat.mod_lt state.index (Domain.size_positive round.arity)
+  have node := FriDomain.foldNode_eq state.domain round.arity nested groupBound slotBound
+  have joined : result.state.index * Domain.size round.arity + state.index % Domain.size round.arity = state.index := by
+    rw [index, Nat.mul_comm, Nat.div_add_mod]
+  rw [joined] at node
+  apply List.mem_of_getElem? (i := state.index % Domain.size round.arity)
+  apply List.getElem?_zip_eq_some.mpr
+  constructor
+  · simp only [Polynomial.foldingNodes, List.getElem?_map, List.getElem?_range slotBound, Option.map_some, node]
+  · exact (step_row accepted).2.1
+
+theorem step_polynomial {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) :
+    ∃ candidate : List Extension, candidate.length ≤ Domain.size round.arity ∧
+      horner (Extension.ofBase (FriDomain.queryPoint state.domain state.index)) candidate = state.value ∧
+      (∀ sample ∈ Interpolation.foldSamples state.domain round.arity result.state.index result.row.values,
+        horner sample.1 candidate = sample.2) ∧
+      (result.state.value, result.remaining) = roll result.state.domain.val
+        (round.challenge.power (Domain.size round.arity)) (horner round.challenge candidate) openings := by
+  have self := step_self_sample accepted
+  obtain ⟨_, _, child, values, folded, _, _, foldRead, output⟩ := step_success accepted
+  obtain ⟨_, _, _, candidate, degree, agrees, value⟩ := Interpolation.foldRow_success foldRead
+  refine ⟨candidate, degree, ?_, ?_, ?_⟩
+  · exact agrees (Extension.ofBase (FriDomain.queryPoint state.domain state.index), state.value)
+      (by simpa only [output] using self)
+  · simpa only [output] using agrees
+  · simp only [output]
+    rw [← value]
+
+theorem step_global {state : State} {round : Round} {openings : List (Nat × Extension)} {result : StepResult}
+    (accepted : step state round openings = some result) (coefficients : List Extension)
+    (agrees : ∀ sample ∈ Interpolation.foldSamples state.domain round.arity result.state.index result.row.values,
+      horner sample.1 coefficients = sample.2) :
+    (result.state.value, result.remaining) = roll result.state.domain.val
+      (round.challenge.power (Domain.size round.arity))
+      (horner (Extension.ofBase (FriDomain.queryPoint result.state.domain result.state.index))
+        (Folding.foldCoefficients round.arity round.challenge coefficients)) openings := by
+  obtain ⟨_, nested, child, values, folded, childRead, rowRead, foldRead, rfl⟩ := step_success accepted
+  have dimensions : state.domain.val = child.val + round.arity.val := by
+    have := Domain.ofLogSize_some childRead
+    omega
+  have bounded := (Interpolation.foldRow_success foldRead).2.1
+  rw [Folding.foldRow_global state.domain child round.arity dimensions bounded values coefficients
+    (reconstruct_length rowRead) agrees] at foldRead
+  rw [Option.some.inj foldRead]
+
+theorem roll_length (height : Nat) (factor value : Extension) (openings : List (Nat × Extension)) :
+    (roll height factor value openings).2.length ≤ openings.length := by
+  cases openings with
+  | nil => exact Nat.le_refl _
+  | cons entry rest =>
+    rcases entry with ⟨nextHeight, next⟩
+    change (if nextHeight == height then (value + factor * next, rest)
+      else (value, (nextHeight, next) :: rest)).2.length ≤ rest.length + 1
+    split <;> simp only [List.length_cons] <;> omega
+
+theorem roll_empty (height : Nat) (factor value : Extension) : roll height factor value [] = (value, []) := rfl
+
+theorem roll_matching (height : Nat) (factor value next : Extension) (rest : List (Nat × Extension)) :
+    roll height factor value ((height, next) :: rest) = (value + factor * next, rest) := by
+  simp only [roll, beq_self_eq_true, if_true]
+
+theorem roll_other (height nextHeight : Nat) (factor value next : Extension) (rest : List (Nat × Extension))
+    (different : nextHeight ≠ height) :
+    roll height factor value ((nextHeight, next) :: rest) = (value, (nextHeight, next) :: rest) := by
+  simp only [roll, beq_iff_eq, if_neg different]
+
+theorem roll_count (height : Nat) (factor value : Extension) (openings : List (Nat × Extension)) :
+    openings.length ≤ (roll height factor value openings).2.length + 1 := by
+  cases openings with
+  | nil => exact Nat.zero_le _
+  | cons entry rest =>
+    rcases entry with ⟨nextHeight, next⟩
+    by_cases same : nextHeight = height
+    · subst nextHeight
+      rw [roll_matching]
+      exact Nat.le_refl _
+    · rw [roll_other height nextHeight factor value next rest same]
+      exact Nat.le_succ _
+
+theorem roll_order (height : Nat) (factor value : Extension) (openings : List (Nat × Extension))
+    (unique : (roll height factor value openings).2.Pairwise (fun left right => right.1 < left.1))
+    (bounded : ∀ entry ∈ (roll height factor value openings).2, entry.1 < height) :
+    openings.Pairwise (fun left right => right.1 < left.1) ∧
+      ∀ entry ∈ openings, entry.1 ≤ height := by
+  cases openings with
+  | nil => exact ⟨List.Pairwise.nil, fun _ member => by cases member⟩
+  | cons entry rest =>
+    rcases entry with ⟨nextHeight, next⟩
+    by_cases same : nextHeight = height
+    · subst nextHeight
+      rw [roll_matching] at unique bounded
+      refine ⟨List.pairwise_cons.mpr ⟨bounded, unique⟩, ?_⟩
+      intro entry member
+      rcases List.mem_cons.mp member with rfl | later
+      · exact Nat.le_refl _
+      · exact Nat.le_of_lt (bounded entry later)
+    · rw [roll_other height nextHeight factor value next rest same] at unique bounded
+      exact ⟨unique, fun entry member => Nat.le_of_lt (bounded entry member)⟩
+
+theorem walk_nil_success {final : Domain.Subgroup} {state : State}
+    {openings : List (Nat × Extension)} {result : Result}
+    (accepted : walk final state openings [] = some result) :
+    state.domain = final ∧ openings = [] ∧ result = ⟨state, []⟩ := by
+  unfold walk at accepted
+  split at accepted
+  next shape =>
+    obtain ⟨height, empty⟩ := (by simpa only [Bool.and_eq_true, beq_iff_eq, List.isEmpty_iff] using shape :
+      state.domain = final ∧ openings = [])
+    exact ⟨height, empty, (Option.some.inj accepted).symm⟩
+  next _ => cases accepted
+
+theorem walk_cons_success {final : Domain.Subgroup} {state : State}
+    {openings : List (Nat × Extension)} {round : Round} {rest : List Round} {result : Result}
+    (accepted : walk final state openings (round :: rest) = some result) :
+    ∃ head tail, step state round openings = some head ∧
+      walk final head.state head.remaining rest = some tail ∧ result = ⟨tail.state, head.row :: tail.rows⟩ := by
+  rw [walk] at accepted
+  cases headRead : step state round openings with
+  | none => simp only [headRead, bind, Option.bind_none] at accepted; cases accepted
+  | some head =>
+    simp only [headRead, bind, Option.bind_some] at accepted
+    cases tailRead : walk final head.state head.remaining rest with
+    | none => simp only [tailRead, Option.bind_none] at accepted; cases accepted
+    | some tail =>
+      simp only [tailRead, Option.bind_some, pure] at accepted
+      exact ⟨head, tail, rfl, tailRead, (Option.some.inj accepted).symm⟩
+
+theorem walk_summary {final : Domain.Subgroup} {state : State}
+    {openings : List (Nat × Extension)} {rounds : List Round} {result : Result}
+    (accepted : walk final state openings rounds = some result) :
+    result.state.domain = final ∧ result.rows.length = rounds.length ∧
+      state.domain.val = final.val + (rounds.map (fun round => round.arity.val)).sum ∧
+      result.state.index = state.index / 2^((rounds.map (fun round => round.arity.val)).sum) := by
+  induction rounds generalizing state openings result with
+  | nil =>
+    obtain ⟨height, _, rfl⟩ := walk_nil_success accepted
+    refine ⟨height, rfl, ?_, ?_⟩
+    · simpa only [List.map_nil, List.sum_nil, Nat.add_zero] using congrArg Fin.val height
+    · simp only [List.map_nil, List.sum_nil, Nat.pow_zero, Nat.div_one]
+  | cons round rest ih =>
+    obtain ⟨head, tail, stepRead, tailRead, rfl⟩ := walk_cons_success accepted
+    obtain ⟨height, length, dimensions, index⟩ := ih tailRead
+    obtain ⟨_, headDimensions, headIndex, _, _, _⟩ := step_dimensions stepRead
+    simp only [List.map_cons, List.sum_cons, List.length_cons]
+    refine ⟨height, by simp only [length], by omega, ?_⟩
+    rw [index, headIndex, Nat.div_div_eq_div_mul, Domain.size, ← Nat.pow_add]
+
+theorem walk_openings {final : Domain.Subgroup} {state : State}
+    {openings : List (Nat × Extension)} {rounds : List Round} {result : Result}
+    (accepted : walk final state openings rounds = some result) :
+    openings.Pairwise (fun left right => right.1 < left.1) ∧
+      (∀ entry ∈ openings, entry.1 < state.domain.val) ∧ openings.length ≤ rounds.length := by
+  induction rounds generalizing state openings result with
+  | nil =>
+    obtain ⟨_, rfl, _⟩ := walk_nil_success accepted
+    exact ⟨List.Pairwise.nil, (fun _ member => by cases member), Nat.le_refl _⟩
+  | cons round rest ih =>
+    obtain ⟨head, tail, stepRead, tailRead, _⟩ := walk_cons_success accepted
+    obtain ⟨positive, nested, child, values, folded, childRead, _, _, rfl⟩ := step_success stepRead
+    obtain ⟨unique, bounded, count⟩ := ih tailRead
+    change (roll child.val (round.challenge.power (Domain.size round.arity)) folded openings).2.length ≤ rest.length at count
+    obtain ⟨oldUnique, oldBounded⟩ := roll_order child.val
+      (round.challenge.power (Domain.size round.arity)) folded openings unique bounded
+    have childValue := Domain.ofLogSize_some childRead
+    have childLess : child.val < state.domain.val := by omega
+    have removed := roll_count child.val (round.challenge.power (Domain.size round.arity)) folded openings
+    exact ⟨oldUnique, fun entry member => Nat.lt_of_le_of_lt (oldBounded entry member) childLess,
+      by simp only [List.length_cons]; omega⟩
+
+theorem run_success {initial final : Domain.Subgroup} {index : Nat}
+    {openings : List (Nat × Extension)} {rounds : List Round} {result : Result}
+    (accepted : run initial final index openings rounds = some result) :
+    index < Domain.size initial ∧ ∃ value rest, openings = (initial.val, value) :: rest ∧
+      walk final ⟨initial, index, value⟩ rest rounds = some result := by
+  unfold run at accepted
+  split at accepted
+  next _ => cases accepted
+  next admitted =>
+    refine ⟨by omega, ?_⟩
+    cases openings with
+    | nil => cases accepted
+    | cons entry rest =>
+      rcases entry with ⟨height, value⟩
+      change (if height == initial.val then walk final ⟨initial, index, value⟩ rest rounds else none) = some result at accepted
+      split at accepted
+      next matching =>
+        have same : height = initial.val := beq_iff_eq.mp matching
+        subst height
+        exact ⟨value, rest, rfl, accepted⟩
+      next _ => cases accepted
+
+theorem run_summary {initial final : Domain.Subgroup} {index : Nat}
+    {openings : List (Nat × Extension)} {rounds : List Round} {result : Result}
+    (accepted : run initial final index openings rounds = some result) :
+    index < Domain.size initial ∧ result.state.domain = final ∧
+      result.rows.length = rounds.length ∧
+      initial.val = final.val + (rounds.map (fun round => round.arity.val)).sum ∧
+      result.state.index = index / 2^((rounds.map (fun round => round.arity.val)).sum) ∧
+      result.state.index < Domain.size final ∧
+      openings.Pairwise (fun left right => right.1 < left.1) ∧ openings.length ≤ rounds.length + 1 := by
+  obtain ⟨indexBound, value, rest, rfl, walked⟩ := run_success accepted
+  obtain ⟨height, length, dimensions, finalIndex⟩ := walk_summary walked
+  change initial.val = final.val + (rounds.map (fun round => round.arity.val)).sum at dimensions
+  obtain ⟨unique, bounded, count⟩ := walk_openings walked
+  refine ⟨indexBound, height, length, dimensions, finalIndex, ?_,
+    List.pairwise_cons.mpr ⟨bounded, unique⟩, by simp only [List.length_cons]; omega⟩
+  rw [finalIndex, Nat.div_lt_iff_lt_mul (Nat.two_pow_pos _)]
+  simpa only [Domain.size, dimensions, Nat.pow_add] using indexBound
+
+theorem check_success {initial final : Domain.Subgroup} {index : Nat}
+    {openings : List (Nat × Extension)} {rounds : List Round} {finalPolynomial : List Extension} {result : Result}
+    (accepted : check initial final index openings rounds finalPolynomial = some result) :
+    run initial final index openings rounds = some result ∧
+      horner (Extension.ofBase (FriDomain.queryPoint initial result.state.index)) finalPolynomial = result.state.value := by
+  unfold check at accepted
+  cases runRead : run initial final index openings rounds with
+  | none => simp only [runRead, bind, Option.bind_none] at accepted; cases accepted
+  | some output =>
+    simp only [runRead, bind, Option.bind_some] at accepted
+    split at accepted
+    next matching =>
+      cases accepted
+      exact ⟨rfl, beq_iff_eq.mp matching⟩
+    next _ => cases accepted
+
+theorem check_final_polynomial {initial final : Domain.Subgroup} {index : Nat}
+    {openings : List (Nat × Extension)} {rounds : List Round} {finalPolynomial : List Extension} {result : Result}
+    (accepted : check initial final index openings rounds finalPolynomial = some result) :
+    horner (Extension.ofBase (FriDomain.queryPoint final result.state.index)) finalPolynomial = result.state.value := by
+  obtain ⟨runRead, equal⟩ := check_success accepted
+  obtain ⟨_, _, _, dimensions, _, bounded, _, _⟩ := run_summary runRead
+  rw [FriDomain.queryPoint_padding initial final (by omega) bounded] at equal
+  exact equal
+
+end Aiur.NativeAIR.FriQuery
diff --git a/Ix/Aiur/Proofs/FrontendExpressions.lean b/Ix/Aiur/Proofs/FrontendExpressions.lean
new file mode 100644
index 000000000..f51e7fe00
--- /dev/null
+++ b/Ix/Aiur/Proofs/FrontendExpressions.lean
@@ -0,0 +1,647 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ExpressionGraph
+import Ix.Aiur.Proofs.OperationRows
+
+/-!
+Smart expression construction, evaluated metadata and scalar operation emission.
+The operators mirror the pinned native frontend's folds. Evaluation is preserved
+for working operations satisfying the stated algebra laws, which are proved for
+Goldilocks. A preserved check excluding negated constant nodes makes syntactic
+constant flags precise, independently of conservative degree bookkeeping.
+
+The addition, subtraction, multiplication and equality-test emitters reflect
+the valued operation model, including allocated columns and every equation. Native comparison
+checks actual expression trees and operation emission. Rust execution refinement,
+remaining operation forms, graph compilation and cryptographic acceptance
+are separate obligations.
+-/
+
+namespace Aiur
+
+theorem G.sub_zero (value : G) : value - 0 = value := by
+  apply G.ext_n
+  simp only [G.n_sub, show (0 : G).n = 0 from rfl, Nat.sub_zero, Nat.add_mod_right]
+  exact Nat.mod_eq_of_lt (UInt64.lt_iff_toNat_lt.mp value.property)
+
+theorem G.neg_neg (value : G) : 0 - (0 - value) = value := by
+  have bound := UInt64.lt_iff_toNat_lt.mp value.property
+  apply G.ext_n
+  simp only [G.n_sub, show (0 : G).n = 0 from rfl, Nat.zero_add]
+  change value.n < gSize.toNat at bound
+  by_cases zero : value.n = 0
+  · simp only [zero, Nat.sub_zero, Nat.mod_self]
+  · have inside : gSize.toNat - value.n < gSize.toNat := by omega
+    rw [Nat.mod_eq_of_lt inside]
+    have cancel : gSize.toNat - (gSize.toNat - value.n) = value.n := by omega
+    rw [cancel, Nat.mod_eq_of_lt bound]
+
+namespace NativeAIR
+
+def Expr.isConstant : Expr → Bool
+  | .konst _ => true
+  | _ => false
+
+def Expr.constantValue : Expr → Option G
+  | .konst value => some value
+  | _ => none
+
+def Expr.frontNeg : Expr → Expr
+  | .konst value => .konst (0 - value)
+  | .neg value => value
+  | value => .neg value
+
+def Expr.frontAdd (left right : Expr) : Expr :=
+  match left.constantValue, right.constantValue with
+  | some a, some b => .konst (a + b)
+  | some a, none => if a == 0 then right else .add left right
+  | none, some b => if b == 0 then left else .add left right
+  | none, none => .add left right
+
+def Expr.frontSub (left right : Expr) : Expr :=
+  match left.constantValue, right.constantValue with
+  | some a, some b => .konst (a - b)
+  | none, some b => if b == 0 then left else .sub left right
+  | some a, none => if a == 0 then right.frontNeg else .sub left right
+  | none, none => .sub left right
+
+def Expr.frontMul (left right : Expr) : Expr :=
+  match left.constantValue, right.constantValue with
+  | some a, some b => .konst (a * b)
+  | some a, none => if a == 0 then .konst 0 else if a == 1 then right else .mul left right
+  | none, some b => if b == 0 then .konst 0 else if b == 1 then left else .mul left right
+  | none, none => .mul left right
+
+structure EvalLaws (ops : EvalOps W) : Prop where
+  konst_add : ∀ a b, ops.konst (a + b) = ops.add (ops.konst a) (ops.konst b)
+  konst_sub : ∀ a b, ops.konst (a - b) = ops.sub (ops.konst a) (ops.konst b)
+  konst_mul : ∀ a b, ops.konst (a * b) = ops.mul (ops.konst a) (ops.konst b)
+  konst_neg : ∀ a, ops.konst (0 - a) = ops.neg (ops.konst a)
+  add_zero : ∀ a, ops.add a (ops.konst 0) = a
+  zero_add : ∀ a, ops.add (ops.konst 0) a = a
+  sub_zero : ∀ a, ops.sub a (ops.konst 0) = a
+  zero_sub : ∀ a, ops.sub (ops.konst 0) a = ops.neg a
+  mul_zero : ∀ a, ops.mul a (ops.konst 0) = ops.konst 0
+  zero_mul : ∀ a, ops.mul (ops.konst 0) a = ops.konst 0
+  mul_one : ∀ a, ops.mul a (ops.konst 1) = a
+  one_mul : ∀ a, ops.mul (ops.konst 1) a = a
+  neg_neg : ∀ a, ops.neg (ops.neg a) = a
+
+def Expr.noConstantNegs : Expr → Bool
+  | .neg child => !child.isConstant && child.noConstantNegs
+  | .add a b | .sub a b | .mul a b => a.noConstantNegs && b.noConstantNegs
+  | _ => true
+
+theorem Expr.isConstant_eq (expr : Expr) : expr.isConstant = expr.constantValue.isSome := by
+  cases expr <;> rfl
+
+theorem Expr.frontNeg_noConstantNegs {expr : Expr} (valid : expr.noConstantNegs = true) :
+    expr.frontNeg.noConstantNegs = true := by
+  cases expr <;> simp_all only [Expr.noConstantNegs, Expr.frontNeg, Expr.isConstant,
+    Bool.not_false, Bool.true_and, Bool.and_eq_true]
+
+theorem Expr.frontNeg_isConstant {expr : Expr} (valid : expr.noConstantNegs = true) :
+    expr.frontNeg.isConstant = expr.isConstant := by
+  cases expr <;> try rfl
+  case neg child =>
+    simp only [Expr.noConstantNegs, Bool.and_eq_true, Bool.not_eq_true'] at valid
+    exact valid.1
+
+theorem Expr.frontAdd_isConstant (left right : Expr) :
+    (left.frontAdd right).isConstant = (left.isConstant && right.isConstant) := by
+  have leftC := left.isConstant_eq
+  have rightC := right.isConstant_eq
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  all_goals simp only [hl, hr, Option.isSome_none, Option.isSome_some] at leftC rightC
+  · rw [leftC, rightC]; simp only [Expr.frontAdd, hl, hr]; rfl
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [Expr.frontAdd, hl, hr, beq_iff_eq, if_pos zero, leftC, rightC, Bool.false_and]
+    · rw [leftC, rightC]; simp only [Expr.frontAdd, hl, hr, beq_iff_eq, if_neg zero]; rfl
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [Expr.frontAdd, hl, hr, beq_iff_eq, if_pos zero, leftC, rightC, Bool.true_and]
+    · rw [leftC, rightC]; simp only [Expr.frontAdd, hl, hr, beq_iff_eq, if_neg zero]; rfl
+  · rw [leftC, rightC]; simp only [Expr.frontAdd, hl, hr]; rfl
+
+theorem Expr.frontSub_isConstant (left right : Expr) (valid : right.noConstantNegs = true) :
+    (left.frontSub right).isConstant = (left.isConstant && right.isConstant) := by
+  have leftC := left.isConstant_eq
+  have rightC := right.isConstant_eq
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  all_goals simp only [hl, hr, Option.isSome_none, Option.isSome_some] at leftC rightC
+  · rw [leftC, rightC]; simp only [Expr.frontSub, hl, hr]; rfl
+
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [Expr.frontSub, hl, hr, beq_iff_eq, if_pos zero, leftC, rightC, Bool.false_and]
+    · rw [leftC, rightC]; simp only [Expr.frontSub, hl, hr, beq_iff_eq, if_neg zero]; rfl
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [Expr.frontSub, hl, hr, beq_iff_eq, if_pos zero, Expr.frontNeg_isConstant valid,
+        leftC, rightC, Bool.true_and]
+    · rw [leftC, rightC]; simp only [Expr.frontSub, hl, hr, beq_iff_eq, if_neg zero]; rfl
+  · rw [leftC, rightC]; simp only [Expr.frontSub, hl, hr]; rfl
+
+theorem Expr.frontAdd_noConstantNegs {left right : Expr}
+    (leftValid : left.noConstantNegs = true) (rightValid : right.noConstantNegs = true) :
+    (left.frontAdd right).noConstantNegs = true := by
+  have raw : (Expr.add left right).noConstantNegs = true := by
+    simp only [Expr.noConstantNegs, leftValid, rightValid, Bool.true_and]
+  unfold Expr.frontAdd
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  · exact raw
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, if_pos zero]; exact leftValid
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, if_pos zero]; exact rightValid
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rfl
+
+theorem Expr.frontSub_noConstantNegs {left right : Expr}
+    (leftValid : left.noConstantNegs = true) (rightValid : right.noConstantNegs = true) :
+    (left.frontSub right).noConstantNegs = true := by
+  have raw : (Expr.sub left right).noConstantNegs = true := by
+    simp only [Expr.noConstantNegs, leftValid, rightValid, Bool.true_and]
+  unfold Expr.frontSub
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  · exact raw
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, if_pos zero]; exact leftValid
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, if_pos zero]; exact Expr.frontNeg_noConstantNegs rightValid
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rfl
+
+theorem Expr.frontMul_noConstantNegs {left right : Expr}
+    (leftValid : left.noConstantNegs = true) (rightValid : right.noConstantNegs = true) :
+    (left.frontMul right).noConstantNegs = true := by
+  have raw : (Expr.mul left right).noConstantNegs = true := by
+    simp only [Expr.noConstantNegs, leftValid, rightValid, Bool.true_and]
+  unfold Expr.frontMul
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  · exact raw
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, if_pos zero]; rfl
+    · by_cases one : c = 1
+      · simp only [beq_iff_eq, if_neg zero, if_pos one]; exact leftValid
+      · simp only [beq_iff_eq, if_neg zero, if_neg one]; exact raw
+  · rename_i c
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, if_pos zero]; rfl
+    · by_cases one : c = 1
+      · simp only [beq_iff_eq, if_neg zero, if_pos one]; exact rightValid
+      · simp only [beq_iff_eq, if_neg zero, if_neg one]; exact raw
+  · rfl
+
+theorem Expr.frontNeg_eval {ops : EvalOps W} (laws : EvalLaws ops) (values : Values W) {expr : Expr} {value : W}
+    (evaluated : expr.eval ops values = some value) :
+    expr.frontNeg.eval ops values = some (ops.neg value) := by
+  have raw : (Expr.neg expr).eval ops values = some (ops.neg value) := by
+    change (expr.eval ops values).bind (fun c => some (ops.neg c)) = _
+    rw [evaluated]; rfl
+  cases expr <;> try exact raw
+  case konst c =>
+    change some (ops.konst c) = some value at evaluated
+    cases evaluated
+    exact congrArg some (laws.konst_neg c)
+  case neg expr =>
+    change (expr.eval ops values).bind (fun c => some (ops.neg c)) = some value at evaluated
+    cases inner : expr.eval ops values with
+    | none => simp only [inner, Option.bind_none, reduceCtorEq] at evaluated
+    | some result =>
+      simp only [inner, Option.bind_some, Option.some.injEq] at evaluated
+      subst value
+      simpa only [Expr.frontNeg, laws.neg_neg] using inner
+
+theorem Expr.eval_constantValue (ops : EvalOps W) (values : Values W) {expr : Expr} {value : W} {constant : G}
+    (evaluated : expr.eval ops values = some value)
+    (known : expr.constantValue = some constant) : ops.konst constant = value := by
+  cases expr <;> simp only [Expr.constantValue, reduceCtorEq] at known
+  case konst c => cases known; exact Option.some.inj evaluated
+
+theorem Expr.frontAdd_eval {ops : EvalOps W} (laws : EvalLaws ops) (values : Values W) {left right : Expr} {a b : W}
+    (leftEval : left.eval ops values = some a)
+    (rightEval : right.eval ops values = some b) :
+    (left.frontAdd right).eval ops values = some (ops.add a b) := by
+  have raw : (Expr.add left right).eval ops values = some (ops.add a b) := by
+    change (left.eval ops values).bind (fun x =>
+      (right.eval ops values).bind (fun y => some (ops.add x y))) = _
+    rw [leftEval, Option.bind_some, rightEval]; rfl
+  unfold Expr.frontAdd
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  · exact raw
+  · rename_i c
+    have equal := Expr.eval_constantValue ops values rightEval hr
+    subst b
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, zero, laws.add_zero]; exact leftEval
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rename_i c
+    have equal := Expr.eval_constantValue ops values leftEval hl
+    subst a
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, zero, laws.zero_add]; exact rightEval
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rename_i c d
+    have leftEq := Expr.eval_constantValue ops values leftEval hl
+    have rightEq := Expr.eval_constantValue ops values rightEval hr
+    subst a; subst b
+    exact congrArg some (laws.konst_add c d)
+
+theorem Expr.frontSub_eval {ops : EvalOps W} (laws : EvalLaws ops) (values : Values W) {left right : Expr} {a b : W}
+    (leftEval : left.eval ops values = some a)
+    (rightEval : right.eval ops values = some b) :
+    (left.frontSub right).eval ops values = some (ops.sub a b) := by
+  have raw : (Expr.sub left right).eval ops values = some (ops.sub a b) := by
+    change (left.eval ops values).bind (fun x =>
+      (right.eval ops values).bind (fun y => some (ops.sub x y))) = _
+    rw [leftEval, Option.bind_some, rightEval]; rfl
+  unfold Expr.frontSub
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  · exact raw
+  · rename_i c
+    have equal := Expr.eval_constantValue ops values rightEval hr
+    subst b
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, zero, laws.sub_zero]; exact leftEval
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rename_i c
+    have equal := Expr.eval_constantValue ops values leftEval hl
+    subst a
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, zero, laws.zero_sub]; exact Expr.frontNeg_eval laws values rightEval
+    · simp only [beq_iff_eq, if_neg zero]; exact raw
+  · rename_i c d
+    have leftEq := Expr.eval_constantValue ops values leftEval hl
+    have rightEq := Expr.eval_constantValue ops values rightEval hr
+    subst a; subst b
+    exact congrArg some (laws.konst_sub c d)
+
+theorem Expr.frontMul_eval {ops : EvalOps W} (laws : EvalLaws ops) (values : Values W) {left right : Expr} {a b : W}
+    (leftEval : left.eval ops values = some a)
+    (rightEval : right.eval ops values = some b) :
+    (left.frontMul right).eval ops values = some (ops.mul a b) := by
+  have raw : (Expr.mul left right).eval ops values = some (ops.mul a b) := by
+    change (left.eval ops values).bind (fun x =>
+      (right.eval ops values).bind (fun y => some (ops.mul x y))) = _
+    rw [leftEval, Option.bind_some, rightEval]; rfl
+  unfold Expr.frontMul
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  · exact raw
+  · rename_i c
+    have equal := Expr.eval_constantValue ops values rightEval hr
+    subst b
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, zero, laws.mul_zero]; rfl
+    · by_cases one : c = 1
+      · simp only [beq_iff_eq, one, laws.mul_one]; exact leftEval
+      · simp only [beq_iff_eq, if_neg zero, if_neg one]; exact raw
+  · rename_i c
+    have equal := Expr.eval_constantValue ops values leftEval hl
+    subst a
+    by_cases zero : c = 0
+    · simp only [beq_iff_eq, zero, laws.zero_mul]; rfl
+    · by_cases one : c = 1
+      · simp only [beq_iff_eq, one, laws.one_mul]; exact rightEval
+      · simp only [beq_iff_eq, if_neg zero, if_neg one]; exact raw
+  · rename_i c d
+    have leftEq := Expr.eval_constantValue ops values leftEval hl
+    have rightEq := Expr.eval_constantValue ops values rightEval hr
+    subst a; subst b
+    exact congrArg some (laws.konst_mul c d)
+
+theorem goldilocks_add_zero (a : G) : goldilocksOps.add a (goldilocksOps.konst 0) = a := G.add_zero a
+theorem goldilocks_zero_add (a : G) : goldilocksOps.add (goldilocksOps.konst 0) a = a := G.zero_add a
+theorem goldilocks_sub_zero (a : G) : goldilocksOps.sub a (goldilocksOps.konst 0) = a := G.sub_zero a
+theorem goldilocks_zero_sub (a : G) : goldilocksOps.sub (goldilocksOps.konst 0) a = goldilocksOps.neg a := rfl
+theorem goldilocks_mul_zero (a : G) : goldilocksOps.mul a (goldilocksOps.konst 0) = goldilocksOps.konst 0 := G.mul_zero a
+theorem goldilocks_zero_mul (a : G) : goldilocksOps.mul (goldilocksOps.konst 0) a = goldilocksOps.konst 0 :=
+  (G.mul_comm 0 a).trans (G.mul_zero a)
+theorem goldilocks_mul_one (a : G) : goldilocksOps.mul a (goldilocksOps.konst 1) = a := G.mul_one a
+theorem goldilocks_one_mul (a : G) : goldilocksOps.mul (goldilocksOps.konst 1) a = a :=
+  (G.mul_comm 1 a).trans (G.mul_one a)
+theorem goldilocks_neg_neg (a : G) : goldilocksOps.neg (goldilocksOps.neg a) = a := G.neg_neg a
+
+theorem goldilocks_konst_add (a b : G) : goldilocksOps.konst (a + b) = goldilocksOps.add (goldilocksOps.konst a) (goldilocksOps.konst b) := rfl
+theorem goldilocks_konst (a : G) : goldilocksOps.konst a = a := rfl
+theorem goldilocks_add (a b : G) : goldilocksOps.add a b = a + b := rfl
+theorem goldilocks_sub (a b : G) : goldilocksOps.sub a b = a - b := rfl
+theorem goldilocks_mul (a b : G) : goldilocksOps.mul a b = a * b := rfl
+theorem goldilocks_konst_sub (a b : G) : goldilocksOps.konst (a - b) = goldilocksOps.sub (goldilocksOps.konst a) (goldilocksOps.konst b) := calc
+  _ = a - b := goldilocks_konst _
+  _ = goldilocksOps.konst a - goldilocksOps.konst b :=
+    (congrArg (fun x : G => x - b) (goldilocks_konst a).symm).trans
+      (congrArg (fun y : G => goldilocksOps.konst a - y) (goldilocks_konst b).symm)
+  _ = _ := (goldilocks_sub _ _).symm
+theorem goldilocks_konst_mul (a b : G) : goldilocksOps.konst (a * b) = goldilocksOps.mul (goldilocksOps.konst a) (goldilocksOps.konst b) := rfl
+theorem goldilocks_konst_neg (a : G) : goldilocksOps.konst (0 - a) = goldilocksOps.neg (goldilocksOps.konst a) := rfl
+
+theorem goldilocksLaws : EvalLaws goldilocksOps where
+  konst_add := goldilocks_konst_add
+  konst_sub := goldilocks_konst_sub
+  konst_mul := goldilocks_konst_mul
+  konst_neg := goldilocks_konst_neg
+  add_zero := goldilocks_add_zero
+  zero_add := goldilocks_zero_add
+  sub_zero := goldilocks_sub_zero
+  zero_sub := goldilocks_zero_sub
+  mul_zero := goldilocks_mul_zero
+  zero_mul := goldilocks_zero_mul
+  mul_one := goldilocks_mul_one
+  one_mul := goldilocks_one_mul
+  neg_neg := goldilocks_neg_neg
+
+theorem Expr.constantValue_eq_of_eval (values : Values G) {expr : Expr} {value constant : G}
+    (evaluated : expr.eval goldilocksOps values = some value)
+    (known : expr.constantValue = some constant) : constant = value :=
+  (goldilocks_konst constant).symm.trans (Expr.eval_constantValue goldilocksOps values evaluated known)
+
+theorem Expr.frontMul_isConstant (values : Values G) {left right : Expr} {a b : G}
+    (leftEval : left.eval goldilocksOps values = some a)
+    (rightEval : right.eval goldilocksOps values = some b) :
+    (left.frontMul right).isConstant =
+      ((left.isConstant && right.isConstant) || (left.isConstant && a == 0) ||
+        (right.isConstant && b == 0)) := by
+  have leftC := left.isConstant_eq
+  have rightC := right.isConstant_eq
+  cases hl : left.constantValue <;> cases hr : right.constantValue
+  all_goals simp only [hl, hr, Option.isSome_none, Option.isSome_some] at leftC rightC
+  all_goals rw [leftC, rightC]
+  · simp only [Expr.frontMul, hl, hr]; rfl
+  · rename_i c
+    have equal := Expr.constantValue_eq_of_eval values rightEval hr
+    subst b
+    by_cases zero : c = 0
+    · simp [Expr.frontMul, hl, hr, zero, Expr.isConstant]
+    · have eqZero : (c == 0) = false := by simpa only [beq_eq_false_iff_ne] using zero
+      by_cases one : c = 1
+      · simp only [Expr.frontMul, hl, hr, eqZero, Bool.false_eq_true, if_false, beq_iff_eq,
+          if_pos one, leftC, Bool.false_and, Bool.true_and, Bool.false_or]
+      · simp only [Expr.frontMul, hl, hr, eqZero, Bool.false_eq_true, if_false, beq_iff_eq,
+          if_neg one, Bool.false_and, Bool.true_and, Bool.false_or]; rfl
+  · rename_i c
+    have equal := Expr.constantValue_eq_of_eval values leftEval hl
+    subst a
+    by_cases zero : c = 0
+    · simp [Expr.frontMul, hl, hr, zero, Expr.isConstant]
+    · have eqZero : (c == 0) = false := by simpa only [beq_eq_false_iff_ne] using zero
+      by_cases one : c = 1
+      · simp only [Expr.frontMul, hl, hr, eqZero, Bool.false_eq_true, if_false, beq_iff_eq,
+          if_pos one, rightC, Bool.false_and, Bool.true_and, Bool.false_or]
+      · simp only [Expr.frontMul, hl, hr, eqZero, Bool.false_eq_true, if_false, beq_iff_eq,
+          if_neg one, Bool.false_and, Bool.true_and, Bool.false_or]; rfl
+  · simp [Expr.frontMul, hl, hr, Expr.isConstant]
+
+structure RowExpr where
+  expr : Expr
+  degree : Nat
+  deriving Repr, DecidableEq
+
+def RowExpr.konst (value : G) : RowExpr := ⟨.konst value, 0⟩
+def RowExpr.variable (column : ColRef) : RowExpr := ⟨.var column, 1⟩
+def RowExpr.add (left right : RowExpr) : RowExpr :=
+  ⟨left.expr.frontAdd right.expr, max left.degree right.degree⟩
+def RowExpr.sub (left right : RowExpr) : RowExpr :=
+  ⟨left.expr.frontSub right.expr, max left.degree right.degree⟩
+def RowExpr.mul (left right : RowExpr) : RowExpr :=
+  ⟨left.expr.frontMul right.expr, left.degree + right.degree⟩
+
+def RowExpr.eval (values : Values G) (expr : RowExpr) : Option AIR.RowValue := do
+  let value ← expr.expr.eval goldilocksOps values
+  return ⟨value, expr.degree, expr.expr.isConstant⟩
+
+def RowExpr.Reflects (values : Values G) (expr : RowExpr) (value : AIR.RowValue) : Prop :=
+  expr.expr.eval goldilocksOps values = some value.value ∧
+    expr.degree = value.degree ∧ expr.expr.isConstant = value.constant
+
+theorem RowExpr.reflects_iff_eval (values : Values G) (expr : RowExpr) (value : AIR.RowValue) :
+    expr.Reflects values value ↔ expr.eval values = some value := by
+  unfold RowExpr.Reflects RowExpr.eval
+  cases h : expr.expr.eval goldilocksOps values with
+  | none => simp only [bind, Option.bind_none, reduceCtorEq, false_and]
+  | some output =>
+    cases value
+    simp only [Option.some.injEq, bind, Option.bind_some, pure, AIR.RowValue.mk.injEq]
+
+theorem RowExpr.konst_reflects (values : Values G) (value : G) :
+    (RowExpr.konst value).Reflects values (AIR.RowValue.konst value) := ⟨rfl, rfl, rfl⟩
+
+theorem RowExpr.variable_reflects (values : Values G) {column : ColRef} {value : G}
+    (read : (values.columns column.source column.offset)[column.index]? = some value) :
+    (RowExpr.variable column).Reflects values (AIR.RowValue.variable value) := ⟨read, rfl, rfl⟩
+
+theorem RowExpr.add_reflects (values : Values G) {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b) :
+    (left.add right).Reflects values (a.add b) := by
+  refine ⟨Expr.frontAdd_eval goldilocksLaws values leftRef.1 rightRef.1, ?_, ?_⟩
+  · change max left.degree right.degree = max a.degree b.degree
+    rw [leftRef.2.1, rightRef.2.1]
+  · change (left.expr.frontAdd right.expr).isConstant = (a.constant && b.constant)
+    rw [Expr.frontAdd_isConstant, leftRef.2.2, rightRef.2.2]
+
+theorem RowExpr.sub_reflects (values : Values G) {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b)
+    (rightValid : right.expr.noConstantNegs = true) :
+    (left.sub right).Reflects values (a.sub b) := by
+  refine ⟨Expr.frontSub_eval goldilocksLaws values leftRef.1 rightRef.1, ?_, ?_⟩
+  · change max left.degree right.degree = max a.degree b.degree
+    rw [leftRef.2.1, rightRef.2.1]
+  · change (left.expr.frontSub right.expr).isConstant = (a.constant && b.constant)
+    rw [Expr.frontSub_isConstant _ _ rightValid, leftRef.2.2, rightRef.2.2]
+
+theorem RowExpr.mul_reflects (values : Values G) {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b) :
+    (left.mul right).Reflects values (a.mul b) := by
+  refine ⟨Expr.frontMul_eval goldilocksLaws values leftRef.1 rightRef.1, ?_, ?_⟩
+  · change left.degree + right.degree = a.degree + b.degree
+    rw [leftRef.2.1, rightRef.2.1]
+  · change (left.expr.frontMul right.expr).isConstant =
+      ((a.constant && b.constant) || (a.constant && a.value == 0) || (b.constant && b.value == 0))
+    rw [Expr.frontMul_isConstant values leftRef.1 rightRef.1, leftRef.2.2, rightRef.2.2]
+
+structure ScalarEmission where
+  output : RowExpr
+  used : Nat := 0
+  equations : List Expr := []
+
+def ScalarEmission.eval (values : Values G) (emission : ScalarEmission) : Option AIR.OpEmission := do
+  let output ← emission.output.eval values
+  let equations ← emission.equations.mapM (Expr.eval goldilocksOps values)
+  return { outputs := #[output], used := emission.used, equations }
+
+theorem ScalarEmission.eval_of (values : Values G) {output : RowExpr} {value : AIR.RowValue}
+    {used : Nat} {equations : List Expr} {results : List G}
+    (reflected : output.Reflects values value)
+    (evaluated : equations.mapM (Expr.eval goldilocksOps values) = some results) :
+    (ScalarEmission.mk output used equations).eval values =
+      some { outputs := #[value], used, equations := results } := by
+  have outputEval := (RowExpr.reflects_iff_eval values output value).mp reflected
+  simp only [ScalarEmission.eval, outputEval, evaluated, bind, Option.bind, pure]
+
+def mainCurrent (index : Nat) : RowExpr := .variable ⟨.main, .current, index⟩
+
+def eqZeroRegular (selector : Expr) (first : Nat) (input : RowExpr) : ScalarEmission :=
+  let d := mainCurrent first
+  let x := mainCurrent (first + 1)
+  ⟨x, 2, [(selector.frontMul input.expr).frontMul x.expr,
+    selector.frontMul (((input.expr.frontMul d.expr).frontAdd x.expr).frontSub (.konst 1))]⟩
+
+def emitEqZero (selector : Expr) (first : Nat) (input : RowExpr) : ScalarEmission :=
+  match input.expr.constantValue, input.degree with
+  | some value, 0 => ⟨.konst (G.eqZero value), 0, []⟩
+  | _, _ => eqZeroRegular selector first input
+
+theorem eqZeroRegular_reflects (values : Values G) (row : Nat → G) {selector : Expr} {s : G}
+    {first : Nat} {input : RowExpr} {value : AIR.RowValue}
+    (selectorEval : selector.eval goldilocksOps values = some s)
+    (inputRef : input.Reflects values value)
+    (firstRead : (values.columns .main .current)[first]? = some (row 0))
+    (secondRead : (values.columns .main .current)[first + 1]? = some (row 1)) :
+    (eqZeroRegular selector first input).eval values =
+      some { outputs := #[AIR.RowValue.variable (row 1)], used := 2, equations :=
+        [s * value.value * row 1, s * (value.value * row 0 + row 1 - 1)] } := by
+  have dRef := RowExpr.variable_reflects values (column := ⟨.main, .current, first⟩) firstRead
+  have xRef := RowExpr.variable_reflects values (column := ⟨.main, .current, first + 1⟩) secondRead
+  have oneEval : (Expr.konst 1).eval goldilocksOps values = some 1 := rfl
+  have firstEval := Expr.frontMul_eval goldilocksLaws values
+    (Expr.frontMul_eval goldilocksLaws values selectorEval inputRef.1) xRef.1
+  have secondEval := Expr.frontMul_eval goldilocksLaws values selectorEval
+    (Expr.frontSub_eval goldilocksLaws values
+      (Expr.frontAdd_eval goldilocksLaws values
+        (Expr.frontMul_eval goldilocksLaws values inputRef.1 dRef.1) xRef.1) oneEval)
+  apply ScalarEmission.eval_of values xRef
+  simp only [mainCurrent, List.mapM_cons, List.mapM_nil, firstEval, secondEval, bind, Option.bind, pure]
+  simp only [goldilocks_add, goldilocks_sub, goldilocks_mul, AIR.RowValue.variable]
+
+theorem emitEqZero_reflects (values : Values G) (row : Nat → G) {selector : Expr} {s : G}
+    {first : Nat} {input : RowExpr} {value : AIR.RowValue}
+    (selectorEval : selector.eval goldilocksOps values = some s)
+    (inputRef : input.Reflects values value)
+    (reads : ∀ index < (emitEqZero selector first input).used,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitEqZero selector first input).eval values = AIR.emitOp row s 0 (.eqZero 0) #[value] := by
+  have known := input.expr.isConstant_eq
+  have constant := inputRef.2.2
+  have degree := inputRef.2.1
+  cases hc : input.expr.constantValue with
+  | none =>
+    have notConstant : value.constant = false := by
+      rw [hc] at known
+      exact constant.symm.trans known
+    simp only [emitEqZero, hc]
+    simp only [AIR.emitOp, Array.getElem?_singleton, if_true, bind, Option.bind_some, notConstant,
+      Bool.false_and, Bool.false_eq_true, if_false]
+    apply eqZeroRegular_reflects values row selectorEval inputRef
+    · simpa only [Nat.add_zero] using reads 0 (by simp only [emitEqZero, hc, eqZeroRegular]; decide)
+    · exact reads 1 (by simp only [emitEqZero, hc, eqZeroRegular]; decide)
+  | some c =>
+    have isConstant : value.constant = true := by
+      rw [hc] at known
+      exact constant.symm.trans known
+    have valueEq := Expr.constantValue_eq_of_eval values inputRef.1 hc
+    cases hd : input.degree with
+    | zero =>
+      have zeroDegree : value.degree = 0 := degree.symm.trans hd
+      simp only [emitEqZero, hc, hd]
+      simp only [AIR.emitOp, Array.getElem?_singleton, if_true, bind, Option.bind_some, isConstant,
+        zeroDegree, beq_self_eq_true, Bool.true_and, if_true]
+      rw [valueEq]
+      exact ScalarEmission.eval_of values (RowExpr.konst_reflects values _) rfl
+    | succ n =>
+      have positiveDegree : value.degree = n + 1 := degree.symm.trans hd
+      simp only [emitEqZero, hc, hd]
+      simp only [AIR.emitOp, Array.getElem?_singleton, if_true, bind, Option.bind_some, isConstant,
+        positiveDegree, Nat.succ_ne_zero, beq_iff_eq, Bool.true_and, if_false]
+      apply eqZeroRegular_reflects values row selectorEval inputRef
+      · simpa only [Nat.add_zero] using reads 0 (by simp only [emitEqZero, hc, hd, eqZeroRegular]; decide)
+      · exact reads 1 (by simp only [emitEqZero, hc, hd, eqZeroRegular]; decide)
+
+def mulRegular (selector : Expr) (first : Nat) (product : RowExpr) : ScalarEmission :=
+  let output := mainCurrent first
+  ⟨output, 1, [selector.frontMul (output.expr.frontSub product.expr)]⟩
+
+def emitMul (selector : Expr) (first : Nat) (left right : RowExpr) : ScalarEmission :=
+  let product := left.mul right
+  if product.degree < 2 then ⟨product, 0, []⟩ else mulRegular selector first product
+
+theorem mulRegular_reflects (values : Values G) (row : Nat → G) {selector : Expr} {s : G}
+    {first : Nat} {product : RowExpr} {value : AIR.RowValue}
+    (selectorEval : selector.eval goldilocksOps values = some s)
+    (productRef : product.Reflects values value)
+    (read : (values.columns .main .current)[first]? = some (row 0)) :
+    (mulRegular selector first product).eval values =
+      some { outputs := #[AIR.RowValue.variable (row 0)], used := 1, equations := [s * (row 0 - value.value)] } := by
+  have outputRef := RowExpr.variable_reflects values (column := ⟨.main, .current, first⟩) read
+  have equationEval := Expr.frontMul_eval goldilocksLaws values selectorEval
+    (Expr.frontSub_eval goldilocksLaws values outputRef.1 productRef.1)
+  apply ScalarEmission.eval_of values outputRef
+  simp only [mainCurrent, List.mapM_cons, List.mapM_nil, equationEval, bind, Option.bind, pure]
+  simp only [goldilocks_mul, goldilocks_sub, AIR.RowValue.variable]
+
+theorem emitMul_reflects (values : Values G) (row : Nat → G) {selector : Expr} {s : G}
+    {first : Nat} {left right : RowExpr} {a b : AIR.RowValue}
+    (selectorEval : selector.eval goldilocksOps values = some s)
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b)
+    (reads : ∀ index < (emitMul selector first left right).used,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitMul selector first left right).eval values = AIR.emitOp row s 0 (.mul 0 1) #[a, b] := by
+  have productRef := RowExpr.mul_reflects values leftRef rightRef
+  simp only [AIR.emitOp, show (#[a, b][0]?) = some a from rfl,
+    show (#[a, b][1]?) = some b from rfl, bind, Option.bind_some]
+  rw [← productRef.2.1]
+  unfold emitMul
+  split
+  next small =>
+    rw [if_pos small]
+    exact ScalarEmission.eval_of values productRef rfl
+  next large =>
+    rw [if_neg large]
+    apply mulRegular_reflects values row selectorEval productRef
+    simpa only [Nat.add_zero] using reads 0 (by simp only [emitMul, if_neg large, mulRegular]; decide)
+
+theorem emitEqZero_noConstantNegs (selector : Expr) (first : Nat) (input : RowExpr) :
+    (emitEqZero selector first input).output.expr.noConstantNegs = true := by
+  unfold emitEqZero
+  cases input.expr.constantValue <;> cases input.degree <;> rfl
+
+theorem emitMul_noConstantNegs (selector : Expr) (first : Nat) {left right : RowExpr}
+    (leftValid : left.expr.noConstantNegs = true) (rightValid : right.expr.noConstantNegs = true) :
+    (emitMul selector first left right).output.expr.noConstantNegs = true := by
+  unfold emitMul
+  dsimp only
+  split
+  · exact Expr.frontMul_noConstantNegs leftValid rightValid
+  · rfl
+
+theorem emitAdd_reflects (values : Values G) (row : Nat → G) (selector rank : G)
+    {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b) :
+    (ScalarEmission.mk (left.add right) 0 []).eval values =
+      AIR.emitOp row selector rank (.add 0 1) #[a, b] := by
+  simp only [AIR.emitOp, show (#[a, b][0]?) = some a from rfl,
+    show (#[a, b][1]?) = some b from rfl, bind, Option.bind_some]
+  exact ScalarEmission.eval_of values (RowExpr.add_reflects values leftRef rightRef) rfl
+
+theorem emitSub_reflects (values : Values G) (row : Nat → G) (selector rank : G)
+    {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b)
+    (rightValid : right.expr.noConstantNegs = true) :
+    (ScalarEmission.mk (left.sub right) 0 []).eval values =
+      AIR.emitOp row selector rank (.sub 0 1) #[a, b] := by
+  simp only [AIR.emitOp, show (#[a, b][0]?) = some a from rfl,
+    show (#[a, b][1]?) = some b from rfl, bind, Option.bind_some]
+  exact ScalarEmission.eval_of values (RowExpr.sub_reflects values leftRef rightRef rightValid) rfl
+
+end NativeAIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/FunctionLayout.lean b/Ix/Aiur/Proofs/FunctionLayout.lean
new file mode 100644
index 000000000..ad3e91c5b
--- /dev/null
+++ b/Ix/Aiur/Proofs/FunctionLayout.lean
@@ -0,0 +1,192 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CompilerLayout
+
+/-! Successful compilation supplies the exact computed layout for every
+function. The property survives deduplication and circuit grouping. -/
+
+namespace Aiur.Bytecode
+
+def Function.ComputedLayout (function : Function) : Prop :=
+  let computed := ((Concrete.Bytecode.blockLayout function.body).run
+    (.new function.layout.inputSize)).2.functionLayout
+  function.layout = { computed with lookups := computed.lookups + 1 }
+
+def FunctionsComputedLayout (functions : Array Function) : Prop :=
+  ∀ function ∈ functions, function.ComputedLayout
+
+theorem functionsComputedLayout_empty : FunctionsComputedLayout #[] := by
+  simp [FunctionsComputedLayout]
+
+theorem functionsComputedLayout_push {functions : Array Function} {function : Function}
+    (before : FunctionsComputedLayout functions) (valid : function.ComputedLayout) :
+    FunctionsComputedLayout (functions.push function) := by
+  intro chosen member
+  rcases Array.mem_push.mp member with prior | equal
+  · exact before chosen prior
+  · subst chosen; exact valid
+
+theorem Function.ComputedLayout.auxiliaries {function : Function} (valid : function.ComputedLayout) :
+    function.layout.auxiliaries = ((Concrete.Bytecode.blockLayout function.body).run
+      (.new function.layout.inputSize)).2.functionLayout.auxiliaries := by
+  have field := congrArg FunctionLayout.auxiliaries valid
+  exact field
+
+theorem Function.ComputedLayout.reserved {function : Function} (valid : function.ComputedLayout) :
+    7 ≤ function.layout.auxiliaries := by
+  rw [valid.auxiliaries]
+  exact (Concrete.Bytecode.blockLayout_fields function.body (.new function.layout.inputSize)).2.2
+
+theorem Function.ComputedLayout.selectors {function : Function} (valid : function.ComputedLayout) :
+    function.layout.selectors = function.body.controlCounts.leaves := by
+  have field := congrArg FunctionLayout.selectors valid
+  have count := (Concrete.Bytecode.blockLayout_fields function.body (.new function.layout.inputSize)).2.1
+  exact field.trans (by simpa only [Concrete.Bytecode.LayoutMState.new, Nat.zero_add] using count)
+
+end Aiur.Bytecode
+
+namespace Aiur.Concrete
+open Aiur.Bytecode
+
+private theorem layout_result_computed {body : Block} {size : Nat} {state : Bytecode.LayoutMState}
+    {resultUnit : Unit} (computed : (Bytecode.blockLayout body).run (.new size) = (resultUnit, state)) :
+    let final := { state.functionLayout with lookups := state.functionLayout.lookups + 1 }
+    let calculated := ((Bytecode.blockLayout body).run (.new final.inputSize)).2.functionLayout
+    final = { calculated with lookups := calculated.lookups + 1 } := by
+  have input := (Bytecode.blockLayout_fields body (.new size)).1
+  rw [computed] at input
+  change state.functionLayout.inputSize = size at input
+  dsimp only
+  rw [input, computed]
+  simp only [input]
+
+theorem Function.compile_computedLayout {layoutMap : LayoutMap} {function : Function}
+    {body : Block} {state : Bytecode.LayoutMState}
+    (compiled : function.compile layoutMap = .ok (body, state)) (entry constrained : Bool) :
+    (Aiur.Bytecode.Function.mk body state.functionLayout entry constrained).ComputedLayout := by
+  unfold Function.compile at compiled
+  simp only [bind, Except.bind, pure, Except.pure] at compiled
+  repeat' first
+    | split at compiled
+    | (dsimp only at compiled; split at compiled)
+  all_goals cases compiled
+  all_goals exact layout_result_computed (by assumption)
+
+private theorem except_foldlM_invariant {ε α β : Type} (items : List α) (step : β → α → Except ε β)
+    (property : β → Prop) (initial : β) (before : property initial)
+    (preserved : ∀ acc item result, property acc → step acc item = .ok result → property result)
+    {result : β} (computed : items.foldlM step initial = .ok result) : property result := by
+  induction items generalizing initial with
+  | nil => cases computed; exact before
+  | cons item items ih =>
+    simp only [List.foldlM_cons, bind, Except.bind] at computed
+    split at computed
+    · cases computed
+    · rename_i next nextComputed
+      exact ih next (preserved initial item next before nextComputed) computed
+
+theorem Decls.toBytecode_computedLayout {decls : Decls} {program : Toplevel}
+    {names : Std.HashMap Global FunIdx} (compiled : decls.toBytecode = .ok (program, names)) :
+    FunctionsComputedLayout program.functions := by
+  unfold Decls.toBytecode at compiled
+  simp only [bind, Except.bind, pure, Except.pure] at compiled
+  split at compiled
+  · cases compiled
+  · split at compiled
+    · cases compiled
+    · rename_i result folded
+      cases compiled
+      unfold IndexMap.foldlM at folded
+      rw [← Array.foldlM_toList] at folded
+      apply except_foldlM_invariant _ _ (fun result => FunctionsComputedLayout result.1) _
+        functionsComputedLayout_empty ?_ folded
+      intro acc item result before step
+      rcases item with ⟨name, declaration⟩
+      cases declaration <;> dsimp only at step
+      all_goals first
+        | (cases step; exact before)
+        | (split at step
+           · cases step
+           · rename_i result compiled
+             cases step
+             exact functionsComputedLayout_push before (Function.compile_computedLayout compiled _ _))
+
+end Aiur.Concrete
+
+namespace Aiur.Bytecode
+
+theorem Function.ComputedLayout.rewrite {function : Function} (valid : function.ComputedLayout)
+    (rename : FunIdx → FunIdx) : { function with body := rewriteBlock rename function.body }.ComputedLayout := by
+  unfold Function.ComputedLayout at *
+  rw [Concrete.Bytecode.rewriteBlock_layout]
+  exact valid
+
+theorem deduplicate_newFunctions_computedLayout (functions : Array Function)
+    (classes : Array Nat) (canonical : Array Bool) (rename : FunIdx → FunIdx)
+    (valid : FunctionsComputedLayout functions) :
+    FunctionsComputedLayout (deduplicate_newFunctions functions classes canonical rename) := by
+  unfold deduplicate_newFunctions
+  apply Array.foldl_induction (fun _ result => FunctionsComputedLayout result) functionsComputedLayout_empty
+  intro index accumulated before
+  dsimp only
+  split
+  · apply functionsComputedLayout_push before
+    apply Function.ComputedLayout.rewrite
+    apply valid
+    exact (Array.of_mem_zip (Array.getElem_mem index.isLt)).2
+  · exact before
+
+theorem Toplevel.deduplicateCandidate_computedLayout (program : Toplevel)
+    (valid : FunctionsComputedLayout program.functions) :
+    FunctionsComputedLayout program.deduplicateCandidate.1.functions := by
+  unfold Toplevel.deduplicateCandidate
+  dsimp only
+  split
+  · exact valid
+  · exact deduplicate_newFunctions_computedLayout _ _ _ _ valid
+
+theorem Toplevel.deduplicate_computedLayout (program : Toplevel)
+    (valid : FunctionsComputedLayout program.functions) :
+    FunctionsComputedLayout program.deduplicate.1.functions := by
+  unfold Toplevel.deduplicate checkedRenaming
+  dsimp only
+  split
+  · exact program.deduplicateCandidate_computedLayout valid
+  · exact valid
+
+end Aiur.Bytecode
+
+namespace Aiur
+open Bytecode
+
+theorem finishCompilation_computedLayout (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) (valid : FunctionsComputedLayout raw.functions) :
+    FunctionsComputedLayout (finishCompilation source raw names).bytecode.functions := by
+  unfold finishCompilation
+  intro function member
+  obtain ⟨index, bound, equal⟩ := Array.exists_of_mem_mapIdx member
+  subst function
+  change raw.deduplicate.1.functions[index].ComputedLayout
+  exact raw.deduplicate_computedLayout valid _ (Array.getElem_mem bound)
+
+theorem Source.Toplevel.compile_computedLayout {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (accepted : source.compile = .ok compiled) : FunctionsComputedLayout compiled.bytecode.functions := by
+  obtain ⟨inlined, typed, concrete, raw, names, _, _, _, lowered, artifact⟩ :=
+    source.compile_artifact_of_ok accepted
+  rw [artifact]
+  exact finishCompilation_computedLayout inlined raw names (Concrete.Decls.toBytecode_computedLayout lowered)
+
+theorem BoundVerifier.Backend.functions_computedLayout {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) : FunctionsComputedLayout backend.compiled.bytecode.functions := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  have valid := Source.Toplevel.compile_computedLayout compiled
+  split at grouped
+  · cases grouped
+    exact valid
+  · rw [(CompiledToplevel.groupFunctions_preserves_code grouped).2.2.1]
+    exact valid
+
+end Aiur
diff --git a/Ix/Aiur/Proofs/FunctionRows.lean b/Ix/Aiur/Proofs/FunctionRows.lean
new file mode 100644
index 000000000..20722840b
--- /dev/null
+++ b/Ix/Aiur/Proofs/FunctionRows.lean
@@ -0,0 +1,168 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockRowInputs
+
+/-!
+Whole-function execution and local function-row validity derived from the
+valued emitter. The same semantic return determines the combined provider
+message, including shared slots with differing raw message lengths.
+
+Lookup membership, count bounds, function layout and activity premises are
+explicit. These theorems do not yet extract rows from the Rust verifier or
+establish public acceptance-to-certified-claim soundness.
+-/
+
+namespace Aiur.AIR
+
+theorem slotMessage_chosen (width : Nat) (branchless : Bool) {parts : List (G × List G)}
+    (single : branchless = true → parts.length = 1)
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1)
+    {chosen : G × List G} (member : chosen ∈ parts) (selected : chosen.1 = 1) :
+    padMessage width (slotMessage branchless parts) = padMessage width chosen.2 := by
+  cases branchless with
+  | false =>
+    obtain ⟨before, after, equal, zero⟩ := selector_pair_chosen individual bounded active member selected
+    rw [equal]
+    exact weightedMessage_split width before after chosen selected zero
+  | true =>
+    obtain ⟨part, equal⟩ := List.length_eq_one_iff.mp (single rfl)
+    subst parts
+    have same := List.mem_singleton.mp member
+    subst chosen
+    rfl
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+def Function.emitRow (row : Nat → G) (selector : SelIdx → G) (functionIndex : FunIdx) (rank : G)
+    (values : Array RowValue) (column lookup : Nat) (function : Function) : Option BlockEmission :=
+  function.body.emitRow row selector ⟨functionIndex, function.layout.inputSize, rank⟩
+    (function.body.selectorFlow selector).entry values column lookup
+
+theorem Function.emitRow_run {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (program : Toplevel) (row : Nat → G) (selector : SelIdx → G)
+    (functionIndex : FunIdx) (rank : G) (values : Array RowValue) (column lookup : Nat)
+    (function : Function) (present : program.functions[functionIndex]? = some function)
+    (arity : values.size = function.layout.inputSize)
+    (shape : function.body.lookupShapes program none = true) (bounds : function.body.rowBounds selector)
+    {emission : BlockEmission}
+    (emitted : function.emitRow row selector functionIndex rank values column lookup = some emission)
+    (active : (function.body.selectorFlow selector).entry = 1)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) (queried : emission.QueriesIn queries) :
+    ∃ request calls, (1, request) ∈ emission.returns ∧
+      request.function = functionIndex ∧ request.inputs = rowValues values ∧ request.rank = rank ∧
+      AIR.RunFunction program (memoryFacts tables.memory) request (calls.map Prod.fst) ∧
+      emission.CallsAt calls ∧ CallsEmitted rank 1 emission.equations queries calls := by
+  have bodyEmitted := emitted
+  rw [Function.emitRow] at bodyEmitted
+  have initial : RowInputs function.layout.inputSize (rowValues values) values := by
+    rw [← arity]
+    exact RowInputs.full values
+  have preserved := function.body.emitRow_inputs row selector _ _ _ _ _ initial bodyEmitted
+  have tracked := function.body.emitRow_tracks_calls row selector _ _ _ _ _ bodyEmitted
+  obtain ⟨outcome, calls, execution, terminal, called⟩ := function.body.emitRow_run global memoryValid canonical
+    program none row selector _ _ _ _ _ shape bounds bodyEmitted active rfl satisfied queried
+  cases outcome with
+  | returned outputs =>
+    obtain ⟨request, member, outputsEq⟩ := terminal
+    obtain ⟨functionEq, inputsEq, rankEq⟩ := preserved.returned (1, request) member
+    refine ⟨request, calls, member, functionEq, inputsEq, rankEq, ?_, called, tracked.active queried called⟩
+    apply AIR.RunFunction.function
+    · rw [functionEq]
+      exact present
+    · rw [inputsEq]
+      simpa only [rowValues, Array.size_map] using arity.symm
+    · rw [inputsEq, outputsEq]
+      exact execution
+  | yielded outputs =>
+    obtain ⟨yielded, member, _⟩ := terminal
+    have empty := function.body.selectorFlow_yields_empty selector program shape
+    have projected := function.body.emitRow_projection row selector _ _ _ _ _ bodyEmitted
+    have one : (1 : G) ∈ emission.yields.map Prod.fst :=
+      List.mem_map.mpr ⟨(1, yielded), member, rfl⟩
+    rw [projected.yielded, empty] at one
+    cases one
+
+theorem Function.emitRow_valid {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (program : Toplevel) (row : Nat → G) (selector : SelIdx → G)
+    (functionIndex : FunIdx) (rankBytes : Fin 6 → G) (values : Array RowValue) (column lookup : Nat)
+    (function : Function) (present : program.functions[functionIndex]? = some function)
+    (arity : values.size = function.layout.inputSize)
+    (shape : function.body.lookupShapes program none = true) (bounds : function.body.rowBounds selector)
+    {emission : BlockEmission}
+    (emitted : function.emitRow row selector functionIndex (packRank rankBytes) values column lookup = some emission)
+    (multiplicity : G) (nonzero : multiplicity ≠ 0)
+    (activity : activityConstraint multiplicity (function.body.selectorFlow selector).entry = 0)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0) (queried : emission.QueriesIn queries) :
+    ∃ interpreted : FunctionRow, interpreted.Valid program (memoryFacts tables.memory) ∧
+      (1, interpreted.request) ∈ emission.returns ∧
+      interpreted.request.function = functionIndex ∧ interpreted.request.inputs = rowValues values ∧
+      interpreted.request.rank = packRank rankBytes ∧ interpreted.rankBytes = rankBytes ∧
+      interpreted.selector = (function.body.selectorFlow selector).entry ∧
+      interpreted.multiplicity = multiplicity ∧ emission.CallsAt interpreted.calls ∧
+      CallsEmitted (packRank rankBytes) 1 emission.equations queries interpreted.calls := by
+  have active := nonzero_multiplicity_selector_one activity nonzero
+  obtain ⟨request, calls, member, functionEq, inputsEq, rankEq, execution, called, inventory⟩ :=
+    function.emitRow_run global memoryValid canonical program row selector functionIndex (packRank rankBytes)
+      values column lookup present arity shape bounds emitted active satisfied queried
+  let interpreted : FunctionRow := ⟨request, calls, rankBytes, 1, multiplicity⟩
+  refine ⟨interpreted, ?_, member, functionEq, inputsEq, rankEq, rfl, active.symm, rfl, called, inventory⟩
+  refine ⟨Or.inr rfl, ?_, fun _ => rankEq, fun _ => execution, ?_⟩
+  · rw [active] at activity
+    exact activity
+  · intro edge edgeMember
+    change 1 * callOrderConstraint request.rank edge.1.rank (packRank edge.2) = 0
+    rw [rankEq]
+    exact satisfied _ (inventory edge edgeMember).2.2
+
+theorem Function.emitRow_message (row : Nat → G) (selector : SelIdx → G)
+    (functionIndex : FunIdx) (rank : G) (values : Array RowValue) (column lookup : Nat)
+    (function : Function) (program : Toplevel)
+    (shape : function.body.lookupShapes program none = true)
+    {emission : BlockEmission}
+    (emitted : function.emitRow row selector functionIndex rank values column lookup = some emission)
+    (active : (function.body.selectorFlow selector).entry = 1)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (bounded : emission.returns.length < gSize.toNat)
+    (width : Nat) (branchless : Bool) (single : branchless = true → emission.returns.length = 1)
+    {request : AIR.Call} (member : (1, request) ∈ emission.returns) :
+    padMessage width (slotMessage branchless
+      (emission.returns.map fun part => (part.1, functionMessage part.2))) =
+      padMessage width (functionMessage request) := by
+  have bodyEmitted := emitted
+  rw [Function.emitRow] at bodyEmitted
+  have projection := function.body.emitRow_projection row selector _ _ _ _ _ bodyEmitted
+  have valid := function.body.emitRow_selectors row selector _ _ _ _ _ bodyEmitted satisfied
+  have gates := projection.returned.trans (function.body.returnGates_reflects selector _ valid rfl)
+  have empty := function.body.selectorFlow_yields_empty selector program shape
+  have sound := function.body.selectorFlow_sound selector valid
+  have conservation := sound.conservation
+  rw [empty] at conservation
+  change _ = selectorSum (function.body.selectorFlow selector).returns + 0 at conservation
+  rw [G.add_zero, active] at conservation
+  apply slotMessage_chosen width branchless
+    (by simpa only [List.length_map] using single)
+    (fun part present => ?_)
+    (by simpa only [List.length_map] using bounded)
+    (by simpa only [List.map_map, Function.comp_def, gates] using conservation.symm)
+    (List.mem_map.mpr ⟨(1, request), member, rfl⟩) rfl
+  obtain ⟨returned, returnMember, equal⟩ := List.mem_map.mp present
+  subst part
+  apply sound.returned returned.1
+  rw [← gates]
+  exact List.mem_map.mpr ⟨returned, returnMember, rfl⟩
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/GlobalLookups.lean b/Ix/Aiur/Proofs/GlobalLookups.lean
new file mode 100644
index 000000000..c381a1b73
--- /dev/null
+++ b/Ix/Aiur/Proofs/GlobalLookups.lean
@@ -0,0 +1,536 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LookupMessages
+import Ix.Aiur.Proofs.LookupShapes
+import Ix.Aiur.Proofs.Execution
+import Ix.Aiur.Proofs.Memory
+
+/-!
+Function execution, immutable memory facts and byte operations from one
+mixed pool of zero-padded lookup messages.
+
+The native function, memory and thirteen byte channels determine the
+provider family. Query widths and the actual structural call checks prevent
+padding aliases. Only reachable calls need a checked shape; an active row's
+local execution determines its return width and propagates the callee checks.
+Byte lookups from the same pool bound all call ranks and gaps, giving finite
+execution by strict rank increase.
+
+The pool retains arbitrary field provider multiplicities, inactive rows and
+all consumer kinds. It assumes local row interpretation, exact padded
+balance, and explicit query-count and width bounds. Extraction of these
+obligations from native AIR and cryptographic verification is still required.
+-/
+
+namespace Aiur.AIR
+
+open Bytecode.AIR
+
+structure LookupTables where
+  functions : List FunctionRow
+  memoryWidths : List Nat
+  memory : Nat → Array MemoryRow
+  byte1 : Byte1Kind → Fin 256 → G
+  byte2 : Byte2Kind → Fin 65536 → G
+
+def LookupTables.providers (tables : LookupTables) : List (Provider (List G)) :=
+  mapProviders functionMessage (functionProviders tables.functions) ++
+  tables.memoryWidths.flatMap (fun width =>
+    mapProviders (fun request => memoryMessage width request.1 request.2)
+      (memoryProviders (tables.memory width))) ++
+  byte1Providers tables.byte1 ++ byte2Providers tables.byte2
+
+theorem LookupTables.provider_cases {tables : LookupTables} {provider : Provider (List G)}
+    (member : provider ∈ tables.providers) :
+    (∃ row ∈ tables.functions, provider = (functionMessage row.request, row.multiplicity)) ∨
+    (∃ width ∈ tables.memoryWidths, ∃ i : Fin (tables.memory width).size,
+      provider = (memoryMessage width (tables.memory width)[i].pointer
+        (tables.memory width)[i].contents, (tables.memory width)[i].multiplicity)) ∨
+    (∃ kind : Byte1Kind, ∃ row : Fin 256,
+      provider = (byte1Request kind (G.ofNat row.val) (byte1Outputs kind row), tables.byte1 kind row)) ∨
+    (∃ kind : Byte2Kind, ∃ row : Fin 65536,
+      provider = (byte2Request kind (byteRangeMessage row).1 (byteRangeMessage row).2
+        (byte2Outputs kind row), tables.byte2 kind row)) := by
+  simp only [LookupTables.providers, List.mem_append] at member
+  rcases member with ((function | memory) | byte1) | byte2
+  · obtain ⟨original, originalMember, equal⟩ := List.mem_map.mp function
+    obtain ⟨row, rowMember, rowEq⟩ := List.mem_map.mp originalMember
+    subst original
+    exact Or.inl ⟨row, rowMember, equal.symm⟩
+  · obtain ⟨width, widthMember, originalMember⟩ := List.mem_flatMap.mp memory
+    obtain ⟨original, rowMember, equal⟩ := List.mem_map.mp originalMember
+    obtain ⟨row, rowEq⟩ := List.mem_ofFn.mp rowMember
+    subst original
+    exact Or.inr (Or.inl ⟨width, widthMember, row, equal.symm⟩)
+  · obtain ⟨kind, _, rowMember⟩ := List.mem_flatMap.mp byte1
+    obtain ⟨row, equal⟩ := List.mem_ofFn.mp rowMember
+    exact Or.inr (Or.inr (Or.inl ⟨kind, row, equal.symm⟩))
+  · obtain ⟨kind, _, rowMember⟩ := List.mem_flatMap.mp byte2
+    obtain ⟨row, equal⟩ := List.mem_ofFn.mp rowMember
+    exact Or.inr (Or.inr (Or.inr ⟨kind, row, equal.symm⟩))
+
+theorem Byte1Kind.channel_range (kind : Byte1Kind) :
+    2 ≤ kind.channel.n ∧ kind.channel.n ≤ 4 := by
+  cases kind <;> decide +kernel
+
+theorem Byte2Kind.channel_range (kind : Byte2Kind) :
+    5 ≤ kind.channel.n ∧ kind.channel.n ≤ 14 := by
+  cases kind <;> decide +kernel
+
+theorem padMessage_channel {width : Nat} {left right : List G}
+    (positive : 0 < width) (same : padMessage width left = padMessage width right) :
+    left[0]?.getD 0 = right[0]?.getD 0 := by
+  have first := congrArg (fun message => message[0]?.getD 0) same
+  simpa only [padMessage_read left 0 positive, padMessage_read right 0 positive] using first
+
+theorem LookupTables.function_provider {tables : LookupTables} {provider : Provider (List G)}
+    (member : provider ∈ tables.providers) (channel : provider.1[0]?.getD 0 = 0) :
+    ∃ row ∈ tables.functions, provider = (functionMessage row.request, row.multiplicity) := by
+  rcases tables.provider_cases member with function | ⟨width, _, i, equal⟩ |
+      ⟨kind, row, equal⟩ | ⟨kind, row, equal⟩
+  · exact function
+  · subst provider
+    have bad := congrArg G.n channel
+    change 1 = 0 at bad
+    omega
+  · subst provider
+    have bad := congrArg G.n channel
+    change kind.channel.n = 0 at bad
+    have range := kind.channel_range
+    omega
+  · subst provider
+    have bad := congrArg G.n channel
+    change kind.channel.n = 0 at bad
+    have range := kind.channel_range
+    omega
+
+theorem LookupTables.memory_provider {tables : LookupTables} {provider : Provider (List G)}
+    (member : provider ∈ tables.providers) (channel : provider.1[0]?.getD 0 = 1) :
+    ∃ width ∈ tables.memoryWidths, ∃ i : Fin (tables.memory width).size,
+      provider = (memoryMessage width (tables.memory width)[i].pointer
+        (tables.memory width)[i].contents, (tables.memory width)[i].multiplicity) := by
+  rcases tables.provider_cases member with ⟨row, _, equal⟩ | memory |
+      ⟨kind, row, equal⟩ | ⟨kind, row, equal⟩
+  · subst provider
+    have bad := congrArg G.n channel
+    change 0 = 1 at bad
+    omega
+  · exact memory
+  · subst provider
+    have bad := congrArg G.n channel
+    change kind.channel.n = 1 at bad
+    have range := kind.channel_range
+    omega
+  · subst provider
+    have bad := congrArg G.n channel
+    change kind.channel.n = 1 at bad
+    have range := kind.channel_range
+    omega
+
+theorem LookupTables.byte1_provider {tables : LookupTables} {provider : Provider (List G)}
+    {kind : Byte1Kind} (member : provider ∈ tables.providers)
+    (channel : provider.1[0]?.getD 0 = kind.channel) :
+    ∃ row : Fin 256,
+      provider = (byte1Request kind (G.ofNat row.val) (byte1Outputs kind row), tables.byte1 kind row) := by
+  have range := kind.channel_range
+  rcases tables.provider_cases member with ⟨row, _, equal⟩ | ⟨width, _, i, equal⟩ |
+      ⟨providedKind, row, equal⟩ | ⟨providedKind, row, equal⟩
+  · subst provider
+    have bad := congrArg G.n channel
+    change 0 = kind.channel.n at bad
+    omega
+  · subst provider
+    have bad := congrArg G.n channel
+    change 1 = kind.channel.n at bad
+    omega
+  · subst provider
+    have same := Byte1Kind.channel_injective channel
+    subst providedKind
+    exact ⟨row, rfl⟩
+  · subst provider
+    have bad := congrArg G.n channel
+    change providedKind.channel.n = kind.channel.n at bad
+    have providedRange := providedKind.channel_range
+    omega
+
+theorem LookupTables.byte2_provider {tables : LookupTables} {provider : Provider (List G)}
+    {kind : Byte2Kind} (member : provider ∈ tables.providers)
+    (channel : provider.1[0]?.getD 0 = kind.channel) :
+    ∃ row : Fin 65536,
+      provider = (byte2Request kind (byteRangeMessage row).1 (byteRangeMessage row).2
+        (byte2Outputs kind row), tables.byte2 kind row) := by
+  have range := kind.channel_range
+  rcases tables.provider_cases member with ⟨row, _, equal⟩ | ⟨width, _, i, equal⟩ |
+      ⟨providedKind, row, equal⟩ | ⟨providedKind, row, equal⟩
+  · subst provider
+    have bad := congrArg G.n channel
+    change 0 = kind.channel.n at bad
+    omega
+  · subst provider
+    have bad := congrArg G.n channel
+    change 1 = kind.channel.n at bad
+    omega
+  · subst provider
+    have bad := congrArg G.n channel
+    change providedKind.channel.n = kind.channel.n at bad
+    have providedRange := providedKind.channel_range
+    omega
+  · subst provider
+    have same := Byte2Kind.channel_injective channel
+    subst providedKind
+    exact ⟨row, rfl⟩
+
+theorem functionMessage_minimum (request : Call) : 3 ≤ (functionMessage request).length := by
+  simp only [functionMessage, List.length_cons, List.length_append, List.length_nil]
+  omega
+
+theorem padded_functionMessage_index {width : Nat} {left right : Call}
+    (leftBound : left.function < gSize.toNat) (rightBound : right.function < gSize.toNat)
+    (widthBound : (functionMessage left).length ≤ width)
+    (same : padMessage width (functionMessage left) = padMessage width (functionMessage right)) :
+    left.function = right.function := by
+  have minimum := functionMessage_minimum left
+  have key := congrArg (fun message => message[1]?.getD 0) same
+  rw [padMessage_read (functionMessage left) 1 (by omega),
+    padMessage_read (functionMessage right) 1 (by omega)] at key
+  exact G.ofNat_injective_below leftBound rightBound key
+
+/-- The query's structural return check and the provider's local execution
+determine the same message width, even when some callees never return. -/
+theorem padded_functionMessage_reflects {width : Nat} {program : Bytecode.Toplevel}
+    {memory : Memory} {request provided : Call} {calls : List Call}
+    (programBound : program.functions.size < gSize.toNat)
+    (shape : request.LookupShape program)
+    (execution : RunFunction program memory provided calls)
+    (widthBound : (functionMessage request).length ≤ width)
+    (same : padMessage width (functionMessage request) = padMessage width (functionMessage provided)) :
+    request = provided := by
+  obtain ⟨callee, present, constrained, inputSize, returnSize⟩ := shape
+  have requestBound : request.function < gSize.toNat :=
+    Nat.lt_trans (Array.getElem?_eq_some_iff.mp present).choose programBound
+  cases execution with
+  | function supplied arity body =>
+    have providedBound : provided.function < gSize.toNat :=
+      Nat.lt_trans (Array.getElem?_eq_some_iff.mp supplied).choose programBound
+    have index := padded_functionMessage_index requestBound providedBound widthBound same
+    have calleeEq := Option.some.inj ((index ▸ present).symm.trans supplied)
+    subst callee
+    have inputEq : request.inputs.size = provided.inputs.size := inputSize.symm.trans arity
+    have outputEq : request.outputs.size = provided.outputs.size :=
+      (body.return_size request.outputs.size returnSize).symm
+    have lengths : (functionMessage request).length = (functionMessage provided).length := by
+      simp only [functionMessage, List.length_cons, List.length_append, Array.length_toList,
+        inputEq, outputEq]
+    have raw := padMessage_injective_of_length widthBound lengths same
+    exact functionMessage_injective (arities := fun _ => (request.inputs.size, request.outputs.size))
+      ⟨requestBound, rfl, rfl⟩ ⟨providedBound, inputEq.symm, outputEq.symm⟩ raw
+
+/-- One mixed padded pool. Only consumer counts are bounded; provider
+multiplicities are arbitrary field elements. Message widths are checked on
+queries, without imposing a global output-arity table on function rows. -/
+structure GlobalLookups (tables : LookupTables) (width : Nat) (queries : List (List G)) : Prop where
+  balance : PaddedLookupBalance width queries tables.providers
+  count : queries.length < gSize.toNat
+  widths : ∀ query ∈ queries, query.length ≤ width
+
+theorem GlobalLookups.function_provider {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {program : Bytecode.Toplevel} {memory : Memory}
+    (valid : ∀ row ∈ tables.functions, row.Valid program memory)
+    (programBound : program.functions.size < gSize.toNat)
+    {request : Call} (shape : request.LookupShape program)
+    (queried : functionMessage request ∈ queries) :
+    ∃ row ∈ tables.functions, row.request = request ∧ row.selector = 1 := by
+  obtain ⟨provider, member, same, nonzero⟩ :=
+    paddedLookupBalance_provider global.balance global.count queried
+  have widthBound := global.widths _ queried
+  have minimum := functionMessage_minimum request
+  have channel := padMessage_channel (by omega : 0 < width) same
+  obtain ⟨row, rowMember, equal⟩ := tables.function_provider member channel
+  subst provider
+  have active := (valid row rowMember).active_of_nonzero nonzero
+  have exactCall := padded_functionMessage_reflects programBound shape
+    ((valid row rowMember).execution active) widthBound same.symm
+  exact ⟨row, rowMember, exactCall.symm, active⟩
+
+theorem GlobalLookups.byte1 {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {kind : Byte1Kind} {input : G} {outputs : Array G}
+    (sized : outputs.size = kind.outputSize)
+    (queried : byte1Request kind input outputs ∈ queries) :
+    input.n < 256 ∧ outputs = kind.result input := by
+  obtain ⟨provider, member, same, _⟩ :=
+    paddedLookupBalance_provider global.balance global.count queried
+  have shape := byte1Request_shape (fun _ => (0, 0)) kind input outputs sized
+  have widthBound := global.widths _ queried
+  have minimum := shape.1
+  have channel := padMessage_channel (by omega : 0 < width) same
+  obtain ⟨row, equal⟩ := tables.byte1_provider member channel
+  subst provider
+  have raw := (padMessage_injective_of_shape shape
+    (byte1Request_shape _ kind _ _ (byte1Outputs_size kind row)) widthBound same.symm).symm
+  obtain ⟨_, tail⟩ := List.cons.inj raw
+  obtain ⟨sameInput, sameOutputs⟩ := List.cons.inj tail
+  have below : row.val < gSize.toNat := Nat.lt_trans row.isLt (by decide)
+  constructor
+  · rw [← sameInput, G.n_ofNat, Nat.mod_eq_of_lt below]
+    exact row.isLt
+  · rw [← sameInput]
+    exact (Array.toList_inj.mp sameOutputs).symm.trans (byte1Outputs_correct kind row)
+
+theorem GlobalLookups.byte2 {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {kind : Byte2Kind} {x y : G} {outputs : Array G}
+    (sized : outputs.size = kind.outputSize)
+    (queried : byte2Request kind x y outputs ∈ queries) :
+    x.n < 256 ∧ y.n < 256 ∧ outputs = kind.result x y := by
+  obtain ⟨provider, member, same, _⟩ :=
+    paddedLookupBalance_provider global.balance global.count queried
+  have shape := byte2Request_shape (fun _ => (0, 0)) kind x y outputs sized
+  have widthBound := global.widths _ queried
+  have minimum := shape.1
+  have channel := padMessage_channel (by omega : 0 < width) same
+  obtain ⟨row, equal⟩ := tables.byte2_provider member channel
+  subst provider
+  have raw := (padMessage_injective_of_shape shape
+    (byte2Request_shape _ kind _ _ _ (byte2Outputs_size kind row)) widthBound same.symm).symm
+  obtain ⟨_, tail⟩ := List.cons.inj raw
+  obtain ⟨sameX, tail⟩ := List.cons.inj tail
+  obtain ⟨sameY, sameOutputs⟩ := List.cons.inj tail
+  rw [← sameX, ← sameY]
+  refine ⟨(byteRangeMessage_bounded row).1, (byteRangeMessage_bounded row).2, ?_⟩
+  exact (Array.toList_inj.mp sameOutputs).symm.trans (byte2Outputs_correct kind row)
+
+theorem GlobalLookups.memory_fact {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    (valid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    {size : Nat} {pointer : G} {contents : Array G}
+    (sizeBound : size < gSize.toNat) (sized : contents.size = size)
+    (queried : memoryMessage size pointer contents ∈ queries) :
+    memoryFacts tables.memory size pointer contents := by
+  obtain ⟨provider, member, same, nonzero⟩ :=
+    paddedLookupBalance_provider global.balance global.count queried
+  have shape := memoryMessage_shape (fun _ => (0, 0)) size pointer contents sizeBound sized
+  have widthBound := global.widths _ queried
+  have minimum := shape.1
+  have channel := padMessage_channel (by omega : 0 < width) same
+  obtain ⟨providedSize, sizeMember, row, equal⟩ := tables.memory_provider member channel
+  subst provider
+  have raw := (padMessage_injective_of_shape shape
+    (memoryMessage_shape _ providedSize _ _ (canonical _ sizeMember)
+      ((valid providedSize).widths row row.isLt)) widthBound same.symm).symm
+  obtain ⟨sameSize, tail⟩ := List.cons.inj (List.cons.inj raw).2
+  have sizeEq := G.ofNat_injective_below (canonical _ sizeMember) sizeBound sameSize
+  subst providedSize
+  obtain ⟨samePointer, sameContents⟩ := List.cons.inj tail
+  have active : (tables.memory size)[row].selector = 1 := by
+    rcases (valid size).selectors row row.isLt with inactive | active
+    · exact False.elim (nonzero (inactive_multiplicity_zero inactive
+        ((valid size).activity row row.isLt)))
+    · exact active
+  exact ⟨row, row.isLt, active, samePointer, Array.toList_inj.mp sameContents⟩
+
+theorem GlobalLookups.memory_consistent {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    (valid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (heights : ∀ size, (tables.memory size).size < gSize.toNat)
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    {size : Nat} {pointer : G} {left right : Array G}
+    (sizeBound : size < gSize.toNat) (leftSize : left.size = size) (rightSize : right.size = size)
+    (queriedLeft : memoryMessage size pointer left ∈ queries)
+    (queriedRight : memoryMessage size pointer right ∈ queries) : left = right :=
+  memoryFacts_functional tables.memory valid heights
+    (global.memory_fact valid canonical sizeBound leftSize queriedLeft)
+    (global.memory_fact valid canonical sizeBound rightSize queriedRight)
+
+theorem GlobalLookups.byte1_step {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    (memory : Memory) {kind : Byte1Kind} {values : Array G}
+    {index : Bytecode.ValIdx} {input : G} {outputs : Array G}
+    (read : values[index]? = some input) (sized : outputs.size = kind.outputSize)
+    (queried : byte1Request kind input outputs ∈ queries) :
+    Step memory (kind.op index) values (values ++ outputs) [] := by
+  obtain ⟨range, correct⟩ := global.byte1 sized queried
+  apply Step.primitive (advice := #[])
+  rw [correct]
+  exact byte1_primitive read range
+
+theorem GlobalLookups.byte2_step {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    (memory : Memory) {kind : Byte2Kind} {values : Array G}
+    {left right : Bytecode.ValIdx} {x y : G} {outputs : Array G}
+    (readX : values[left]? = some x) (readY : values[right]? = some y)
+    (sized : outputs.size = kind.outputSize)
+    (queried : byte2Request kind x y outputs ∈ queries) :
+    Step memory (kind.op left right) values
+      (values ++ kind.extendOutputs x y outputs) [] := by
+  obtain ⟨rangeX, rangeY, correct⟩ := global.byte2 sized queried
+  apply Step.primitive (advice := #[])
+  rw [correct]
+  exact byte2_primitive readX readY rangeX rangeY
+
+def rangeMessage (pair : G × G) : List G := byte2Request .range pair.1 pair.2 #[]
+
+theorem GlobalLookups.rank_bytes {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    (bytes : Fin 6 → G) (queried : (rankByteQueries bytes).map rangeMessage ⊆ queries) :
+    ∀ i, (bytes i).n < 256 := by
+  have pairRange : ∀ pair ∈ rankByteQueries bytes, pair.1.n < 256 ∧ pair.2.n < 256 := by
+    intro pair member
+    have result := global.byte2 (kind := .range) (outputs := #[]) rfl
+      (queried (List.mem_map.mpr ⟨pair, member, rfl⟩))
+    exact ⟨result.1, result.2.1⟩
+  have p0 := pairRange _ (by simp [rankByteQueries] : (bytes 0, bytes 1) ∈ rankByteQueries bytes)
+  have p1 := pairRange _ (by simp [rankByteQueries] : (bytes 2, bytes 3) ∈ rankByteQueries bytes)
+  have p2 := pairRange _ (by simp [rankByteQueries] : (bytes 4, bytes 5) ∈ rankByteQueries bytes)
+  intro i
+  have cases : i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 ∨ i = 4 ∨ i = 5 := by omega
+  rcases cases with rfl | rfl | rfl | rfl | rfl | rfl
+  · exact p0.1
+  · exact p0.2
+  · exact p1.1
+  · exact p1.2
+  · exact p2.1
+  · exact p2.2
+
+theorem FunctionRow.Valid.global_rank_bounded {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {program : Bytecode.Toplevel} {memory : Memory} {row : FunctionRow}
+    (valid : row.Valid program memory) (member : row ∈ tables.functions) (active : row.selector = 1)
+    (queried : (functionByteQueries tables.functions).map rangeMessage ⊆ queries) :
+    row.request.rank.n < callRankBound := by
+  rw [valid.rank active]
+  apply packRank_lt
+  apply global.rank_bytes
+  intro message messageMember
+  obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp messageMember
+  apply queried
+  exact List.mem_map.mpr ⟨pair, functionByteQueries_member member active
+    (List.mem_append_left _ pairMember), equal⟩
+
+theorem FunctionRow.Valid.global_call_order {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {program : Bytecode.Toplevel} {memory : Memory} {row : FunctionRow}
+    (valid : row.Valid program memory) (member : row ∈ tables.functions) (active : row.selector = 1)
+    (queried : (functionByteQueries tables.functions).map rangeMessage ⊆ queries)
+    {edge : Call × (Fin 6 → G)} (called : edge ∈ row.calls)
+    (childBound : edge.1.rank.n < callRankBound) :
+    row.request.rank.n < edge.1.rank.n := by
+  have gapBound : (packRank edge.2).n < callRankBound := by
+    apply packRank_lt
+    apply global.rank_bytes
+    intro message messageMember
+    obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp messageMember
+    apply queried
+    exact List.mem_map.mpr ⟨pair, functionByteQueries_member member active
+      (List.mem_append_right _ (List.mem_flatMap.mpr ⟨edge, called, pairMember⟩)), equal⟩
+  exact active_call_order_strict active
+    (valid.global_rank_bounded global member active queried)
+    childBound gapBound (valid.order edge called)
+
+/-- Reachable rows execute finitely using one global padded lookup balance.
+Only the current request is assumed to have a checked call shape; structural
+program validation propagates that fact to its children. -/
+theorem GlobalLookups.rows_execute {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {program : Bytecode.Toplevel} {memory : Memory} {roots : List Call}
+    (programValid : program.validateLookupShapes = true)
+    (valid : ∀ row ∈ tables.functions, row.Valid program memory)
+    (functionsQueried : (functionQueries roots tables.functions).map functionMessage ⊆ queries)
+    (bytesQueried : (functionByteQueries tables.functions).map rangeMessage ⊆ queries)
+    {row : FunctionRow} (member : row ∈ tables.functions) (active : row.selector = 1)
+    (shape : row.request.LookupShape program) : Execution program memory row.request := by
+  have programBound : program.functions.size < gSize.toNat := by
+    have checked := programValid
+    simp only [Bytecode.Toplevel.validateLookupShapes, Bool.and_eq_true, decide_eq_true_eq] at checked
+    exact checked.1
+  have all : ∀ n : Nat, ∀ row : FunctionRow,
+      callRankBound - row.request.rank.n = n → row ∈ tables.functions → row.selector = 1 →
+      row.request.LookupShape program → Execution program memory row.request := by
+    intro n
+    induction n using Nat.strongRecOn with
+    | ind n ih =>
+      intro parent measure member active shape
+      have body := (valid parent member).execution active
+      have children : ∀ child ∈ parent.requests, child.LookupShape program := by
+        obtain ⟨callee, present, constrained, _, _⟩ := shape
+        exact body.calls_lookupShape programValid present constrained
+      apply Execution.function body
+      intro child called
+      obtain ⟨edge, edgeMember, edgeEq⟩ := List.mem_map.mp called
+      obtain ⟨provider, providerMember, same, providerActive⟩ :=
+        global.function_provider valid programBound (children child called)
+          (functionsQueried (List.mem_map.mpr
+            ⟨child, functionQueries_member member active called, rfl⟩))
+      have childBound := (valid provider providerMember).global_rank_bounded
+        global providerMember providerActive bytesQueried
+      have order := (valid parent member).global_call_order global member active bytesQueried
+        edgeMember (by simpa only [edgeEq, ← same] using childBound)
+      rw [edgeEq, ← same] at order
+      have smaller : callRankBound - provider.request.rank.n < n := by omega
+      rw [← same]
+      exact ih _ smaller provider rfl providerMember providerActive (same ▸ children child called)
+  exact all _ row rfl member active shape
+
+theorem GlobalLookups.roots_execute {tables : LookupTables} {width : Nat}
+    {queries : List (List G)} (global : GlobalLookups tables width queries)
+    {program : Bytecode.Toplevel} {memory : Memory} {roots : List Call}
+    (programValid : program.validateLookupShapes = true)
+    (valid : ∀ row ∈ tables.functions, row.Valid program memory)
+    (functionsQueried : (functionQueries roots tables.functions).map functionMessage ⊆ queries)
+    (bytesQueried : (functionByteQueries tables.functions).map rangeMessage ⊆ queries)
+    {request : Call} (shape : request.LookupShape program) (root : request ∈ roots) :
+    Execution program memory request := by
+  have programBound : program.functions.size < gSize.toNat := by
+    have checked := programValid
+    simp only [Bytecode.Toplevel.validateLookupShapes, Bool.and_eq_true, decide_eq_true_eq] at checked
+    exact checked.1
+  obtain ⟨row, member, same, active⟩ := global.function_provider valid programBound shape
+    (functionsQueried (List.mem_map.mpr ⟨request, List.mem_append_left _ root, rfl⟩))
+  rw [← same]
+  exact global.rows_execute programValid valid functionsQueried bytesQueried member active (same ▸ shape)
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+
+open AIR Bytecode.AIR
+
+theorem Backend.root_lookupShape {selection : Selection} (backend : Backend selection)
+    (input : Array G) (arity : input.size = selection.inputSize) :
+    Call.LookupShape backend.compiled.bytecode ⟨selection.function, input, selection.success, 0⟩ :=
+  ⟨backend.entry, backend.present, backend.constrained, backend.arity.trans arity.symm,
+    backend.returnArity⟩
+
+theorem claim_padding (selection : Selection)
+    (width : Nat) (input : Array G) :
+    padMessage width (functionMessage ⟨selection.function, input, selection.success, 0⟩) =
+      padMessage width (buildClaim selection.function input selection.success).toList := by
+  have encoding : functionMessage ⟨selection.function, input, selection.success, 0⟩ =
+      (buildClaim selection.function input selection.success).toList ++ [0] := by
+    simp only [functionMessage, buildClaim, Array.toList_append, List.cons_append,
+      List.nil_append, functionChannel]
+    rfl
+  rw [encoding]
+  exact padMessage_append_zero _
+
+/-- The selected success request has a finite AIR execution once its local
+row and mixed lookup obligations are discharged. This is still conditional
+on those obligations, not a theorem about public verifier acceptance. -/
+theorem Backend.global_execution {selection : Selection} (backend : Backend selection)
+    {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries) {memory : Memory}
+    (input : Array G) (arity : input.size = selection.inputSize)
+    (valid : ∀ row ∈ tables.functions, row.Valid backend.compiled.bytecode memory)
+    (functionsQueried : (functionQueries [⟨selection.function, input, selection.success, 0⟩]
+      tables.functions).map functionMessage ⊆ queries)
+    (bytesQueried : (functionByteQueries tables.functions).map rangeMessage ⊆ queries) :
+    Execution backend.compiled.bytecode memory ⟨selection.function, input, selection.success, 0⟩ :=
+  global.roots_execute backend.lookupShapes valid functionsQueried bytesQueried
+    (backend.root_lookupShape input arity) List.mem_cons_self
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/GoldilocksAlgebra.lean b/Ix/Aiur/Proofs/GoldilocksAlgebra.lean
new file mode 100644
index 000000000..3e488d9f0
--- /dev/null
+++ b/Ix/Aiur/Proofs/GoldilocksAlgebra.lean
@@ -0,0 +1,157 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FrontendExpressions
+import Init.GrindInstances.Ring.Fin
+import Batteries.Tactic.OpenPrivate
+
+/-! Ring operations for the actual canonical Goldilocks representation.
+The residue map proves the laws without changing the runtime operations.
+Natural powers in the ring instance are the mathematical recursive powers;
+the existing bounded repeated-squaring routine has a separate specification.
+-/
+
+namespace Aiur.G
+
+open Fin.NatCast Fin.IntCast
+open private Aiur.G.pow.go from Ix.Aiur.Goldilocks
+
+instance characteristicNeZero : NeZero gSize.toNat := ⟨by decide⟩
+
+def residue (value : G) : Fin gSize.toNat :=
+  ⟨value.n, UInt64.lt_iff_toNat_lt.mp value.property⟩
+
+theorem residue_injective {a b : G} (equal : residue a = residue b) : a = b := by
+  have numeric := congrArg (fun x : Fin gSize.toNat => x.val) equal
+  exact G.ext_n numeric
+
+theorem residue_ofNat (n : Nat) : residue (G.ofNat n) = Fin.ofNat _ n := by
+  apply Fin.ext
+  exact G.n_ofNat n
+
+theorem residue_add (a b : G) : residue (a + b) = residue a + residue b := by
+  apply Fin.ext
+  exact G.n_add a b
+
+theorem residue_mul (a b : G) : residue (a * b) = residue a * residue b := by
+  apply Fin.ext
+  exact G.n_mul a b
+
+theorem residue_sub (a b : G) : residue (a - b) = residue a - residue b := by
+  apply Fin.ext
+  simp only [Fin.sub_def, residue]
+  rw [G.n_sub, Nat.add_sub_assoc (Nat.le_of_lt (UInt64.lt_iff_toNat_lt.mp b.property)), Nat.add_comm]
+
+instance neg : Neg G := ⟨(0 - ·)⟩
+instance natCast : NatCast G := ⟨G.ofNat⟩
+
+def ofInt : Int → G
+  | .ofNat n => G.ofNat n
+  | .negSucc n => -G.ofNat (n + 1)
+
+instance intCast : IntCast G := ⟨ofInt⟩
+instance nsmul : SMul Nat G := ⟨fun n a => G.ofNat n * a⟩
+instance zsmul : SMul Int G := ⟨fun n a => ofInt n * a⟩
+instance npow : HPow G Nat G := ⟨fun a n => npowRec n a⟩
+
+theorem residue_numeral (n : Nat) : residue (OfNat.ofNat n : G) = OfNat.ofNat n :=
+  residue_ofNat n
+
+theorem residue_zero : residue 0 = 0 := rfl
+theorem residue_one : residue 1 = 1 := rfl
+
+theorem residue_neg (a : G) : residue (-a) = -residue a := by
+  change residue (0 - a) = -residue a
+  rw [residue_sub, residue_numeral]
+  grind
+
+theorem residue_ofInt (n : Int) : residue (ofInt n) = Int.cast n := by
+  cases n with
+  | ofNat n => exact residue_ofNat n
+  | negSucc n =>
+    change residue (-G.ofNat (n + 1)) = Int.cast (Int.negSucc n)
+    rw [residue_neg, residue_ofNat]
+    rfl
+
+theorem left_distrib (a b c : G) : a * (b + c) = a * b + a * c := by
+  apply residue_injective
+  simp only [residue_add, residue_mul]
+  grind
+
+theorem neg_add_cancel (a : G) : -a + a = 0 := by
+  apply residue_injective
+  simp only [residue_add, residue_neg, residue_zero]
+  grind
+
+theorem sub_eq_add_neg (a b : G) : a - b = a + -b := by
+  apply residue_injective
+  simp only [residue_sub, residue_add, residue_neg]
+  grind
+
+theorem ofInt_neg (n : Int) : ofInt (-n) = -ofInt n := by
+  apply residue_injective
+  simp only [residue_ofInt, residue_neg]
+  exact Lean.Grind.Ring.intCast_neg n
+
+theorem neg_mul (a b : G) : -a * b = -(a * b) := by
+  apply residue_injective
+  simp only [residue_mul, residue_neg]
+  grind
+
+instance commRing : Lean.Grind.CommRing G where
+  add_zero := G.add_zero
+  add_comm := G.add_comm
+  add_assoc := G.add_assoc
+  mul_assoc := G.mul_assoc
+  mul_comm := G.mul_comm
+  mul_one := G.mul_one
+  left_distrib := left_distrib
+  zero_mul a := by rw [G.mul_comm, G.mul_zero]
+  mul_zero := G.mul_zero
+  pow_zero _ := rfl
+  pow_succ _ _ := rfl
+  ofNat_succ n := G.ofNat_add n 1
+  neg_add_cancel := neg_add_cancel
+  sub_eq_add_neg := sub_eq_add_neg
+  intCast_neg := ofInt_neg
+  neg_zsmul n a := by
+    change ofInt (-n) * a = -(ofInt n * a)
+    rw [ofInt_neg, neg_mul]
+
+theorem pow_go_eq (a : G) (n fuel : Nat) (bounded : n < 2 ^ fuel) :
+    Aiur.G.pow.go a n fuel = a ^ n := by
+  induction fuel generalizing n with
+  | zero =>
+    have zero : n = 0 := by simpa using bounded
+    subst n
+    rfl
+  | succ fuel ih =>
+    by_cases zero : n = 0
+    · subst n
+      rfl
+    · have half : n / 2 < 2 ^ fuel :=
+        (Nat.div_lt_iff_lt_mul (by decide)).mpr (by simpa only [Nat.pow_succ] using bounded)
+      simp only [Aiur.G.pow.go, beq_iff_eq, if_neg zero, ih _ half]
+      by_cases even : n % 2 = 0
+      · rw [if_pos even, ← Lean.Grind.Semiring.pow_add]
+        congr 1
+        omega
+      · rw [if_neg even, ← Lean.Grind.Semiring.pow_add, ← Lean.Grind.Semiring.pow_succ]
+        congr 1
+        omega
+
+theorem pow_eq (a : G) (n : Nat) (bounded : n < 2 ^ 64) : G.pow a n = a ^ n :=
+  pow_go_eq a n 64 bounded
+
+theorem inverse_eq_power (a : G) : G.inverse a = a ^ (gSize.toNat - 2) :=
+  pow_eq a _ (by decide)
+
+theorem n_power (a : G) (n : Nat) : (a ^ n).n = a.n ^ n % gSize.toNat := by
+  induction n with
+  | zero => rfl
+  | succ n ih =>
+    rw [Lean.Grind.Semiring.pow_succ, G.n_mul, ih, Nat.mod_mul_mod, Nat.pow_succ]
+
+end Aiur.G
diff --git a/Ix/Aiur/Proofs/GoldilocksInverse.lean b/Ix/Aiur/Proofs/GoldilocksInverse.lean
new file mode 100644
index 000000000..4bca3ea94
--- /dev/null
+++ b/Ix/Aiur/Proofs/GoldilocksInverse.lean
@@ -0,0 +1,137 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.GoldilocksAlgebra
+import Ix.Aiur.Proofs.Field
+
+/-! Fermat's theorem for the actual Goldilocks representation. Multiplication
+by a nonzero element permutes the finite list of nonzero residues. Cancelling
+its nonzero product proves the exponent identity and the runtime inverse law.
+The argument is symbolic; the list of field elements is never evaluated.
+-/
+
+namespace Aiur.G
+
+theorem mul_right_cancel {a b c : G} (nonzero : c ≠ 0) (equal : a * c = b * c) : a = b := by
+  have zero : (a - b) * c = 0 := by grind
+  have same := (G.mul_eq_zero_iff _ _).mp zero |>.resolve_right nonzero
+  exact (G.sub_eq_zero_iff a b).mp same
+
+/-- A mathematical enumeration, excluded from runtime initialization. -/
+noncomputable def nonzeroResidues : List G :=
+  List.ofFn fun index : Fin (gSize.toNat - 1) => G.ofNat (index.val + 1)
+
+theorem nonzeroResidues_length : nonzeroResidues.length = gSize.toNat - 1 := List.length_ofFn
+
+theorem mem_nonzeroResidues (a : G) : a ∈ nonzeroResidues ↔ a ≠ 0 := by
+  constructor
+  · intro member
+    obtain ⟨index, rfl⟩ := List.mem_ofFn.mp member
+    apply G.ofNat_ne_zero_of_lt (by omega)
+    have bound := index.isLt
+    omega
+  · intro nonzero
+    have positive : 0 < a.n := Nat.pos_of_ne_zero fun equal => nonzero ((G.n_eq_zero_iff a).mp equal)
+    have bounded := UInt64.lt_iff_toNat_lt.mp a.property
+    change a.n < gSize.toNat at bounded
+    apply List.mem_ofFn.mpr
+    refine ⟨⟨a.n - 1, by omega⟩, ?_⟩
+    change G.ofNat (a.n - 1 + 1) = a
+    rw [Nat.sub_add_cancel positive, G.ofNat_n]
+
+theorem nonzeroResidues_nodup : nonzeroResidues.Nodup := by
+  apply List.pairwise_iff_getElem.mpr
+  intro i j hi hj lt same
+  simp only [nonzeroResidues, List.getElem_ofFn] at same
+  have bi : i < gSize.toNat - 1 := by simpa only [nonzeroResidues_length] using hi
+  have bj : j < gSize.toNat - 1 := by simpa only [nonzeroResidues_length] using hj
+  have equal := G.ofNat_injective_below (by omega : i + 1 < gSize.toNat)
+    (by omega : j + 1 < gSize.toNat) same
+  omega
+
+theorem map_perm_of_injective (values : List G) (f : G → G) (nodup : values.Nodup)
+    (injective : ∀ {x y}, f x = f y → x = y) (subset : values.map f ⊆ values) :
+    (values.map f).Perm values := by
+  have distinct : (values.map f).Nodup :=
+    List.Pairwise.map f (fun _ _ different equal => different (injective equal)) nodup
+  apply (List.perm_ext_iff_of_nodup distinct nodup).mpr
+  intro value
+  constructor
+  · exact fun member => subset member
+  · intro member
+    by_cases included : value ∈ values.map f
+    · exact included
+    · have enlarged : (value :: values.map f).Nodup :=
+        List.nodup_cons.mpr ⟨included, distinct⟩
+      have bound := enlarged.length_le_of_subset (l₂ := values) (by
+        intro x present
+        rcases List.mem_cons.mp present with equal | tail
+        · exact equal ▸ member
+        · exact subset tail)
+      simp only [List.length_cons, List.length_map] at bound
+      omega
+
+theorem multiplication_perm (a : G) (nonzero : a ≠ 0) :
+    (nonzeroResidues.map (a * ·)).Perm nonzeroResidues := by
+  apply map_perm_of_injective nonzeroResidues (a * ·) nonzeroResidues_nodup
+  · intro x y equal
+    apply mul_right_cancel nonzero
+    simpa only [G.mul_comm _ a] using equal
+  · intro value member
+    obtain ⟨x, present, rfl⟩ := List.mem_map.mp member
+    apply (mem_nonzeroResidues _).mpr
+    intro zero
+    exact ((G.mul_eq_zero_iff _ _).mp zero).elim nonzero ((mem_nonzeroResidues x).mp present)
+
+def product : List G → G
+  | [] => 1
+  | value :: values => value * product values
+
+theorem product_nonzero (values : List G) (nonzero : ∀ x ∈ values, x ≠ 0) : product values ≠ 0 := by
+  induction values with
+  | nil => exact G.one_ne_zero
+  | cons x xs ih =>
+    intro zero
+    exact ((G.mul_eq_zero_iff _ _).mp zero).elim
+      (nonzero x List.mem_cons_self)
+      (ih (fun x member => nonzero x (List.mem_cons_of_mem _ member)))
+
+theorem product_perm {left right : List G} (permuted : left.Perm right) : product left = product right := by
+  induction permuted with
+  | nil => rfl
+  | cons x _ ih => simp only [product, ih]
+  | swap a b rest => simp only [product]; grind
+  | trans _ _ first second => exact first.trans second
+
+theorem product_map_mul (a : G) (values : List G) :
+    product (values.map (a * ·)) = a ^ values.length * product values := by
+  induction values with
+  | nil => rfl
+  | cons x xs ih =>
+    simp only [List.map_cons, List.length_cons, product, ih, Lean.Grind.Semiring.pow_succ]
+    grind
+
+theorem power_eq_one_of_perm (a : G) (values : List G)
+    (nonzero : ∀ x ∈ values, x ≠ 0) (permuted : (values.map (a * ·)).Perm values) :
+    a ^ values.length = 1 := by
+  have same := product_perm permuted
+  rw [product_map_mul] at same
+  apply mul_right_cancel (product_nonzero values nonzero)
+  simpa only [Lean.Grind.Semiring.one_mul] using same
+
+theorem fermat (a : G) (nonzero : a ≠ 0) : a ^ (gSize.toNat - 1) = 1 := by
+  have same := power_eq_one_of_perm a nonzeroResidues
+    (fun x member => (mem_nonzeroResidues x).mp member) (multiplication_perm a nonzero)
+  simpa only [nonzeroResidues_length] using same
+
+theorem inverse_zero : G.inverse 0 = 0 := by decide +kernel
+
+theorem mul_inverse_cancel (a : G) (nonzero : a ≠ 0) : a * a.inverse = 1 := by
+  rw [G.inverse_eq_power, G.mul_comm, ← Lean.Grind.Semiring.pow_succ]
+  have successor : gSize.toNat - 2 + 1 = gSize.toNat - 1 := by decide
+  rw [successor]
+  exact fermat a nonzero
+
+end Aiur.G
diff --git a/Ix/Aiur/Proofs/GraphCompilation.lean b/Ix/Aiur/Proofs/GraphCompilation.lean
new file mode 100644
index 000000000..540580245
--- /dev/null
+++ b/Ix/Aiur/Proofs/GraphCompilation.lean
@@ -0,0 +1,757 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FrontendExpressions
+
+/-!
+Value preservation for base expression graph compilation. A linear structural
+interner models the native hash table's insertion order. Smart graph operators
+fold constants, share nodes, sort commutative operands and cancel equal ids.
+Successful compilation preserves earlier node values, constraint satisfaction,
+and ordered lookup multiplicities and arguments. The required working algebra
+laws are proved for Goldilocks.
+
+The model uses natural-number node indices. Native comparison checks actual
+base graphs and compilation rejections. Rust execution and hash-table refinement,
+machine bounds, extension-coordinate expansion, and cryptographic acceptance
+remain separate obligations.
+-/
+
+namespace Aiur
+
+theorem G.sub_self (value : G) : value - value = 0 := by
+  apply G.ext_n
+  simp only [G.n_sub, show (0 : G).n = 0 from rfl]
+  rw [show value.n + gSize.toNat - value.n = gSize.toNat from by omega]
+  exact Nat.mod_self _
+
+namespace NativeAIR
+
+structure GraphEvalLaws (ops : EvalOps W) : Prop extends EvalLaws ops where
+  add_comm : ∀ a b, ops.add a b = ops.add b a
+  mul_comm : ∀ a b, ops.mul a b = ops.mul b a
+  sub_self : ∀ a, ops.sub a a = ops.konst 0
+
+theorem goldilocksGraphLaws : GraphEvalLaws goldilocksOps where
+  toEvalLaws := goldilocksLaws
+  add_comm := G.add_comm
+  mul_comm := G.mul_comm
+  sub_self := G.sub_self
+
+namespace Compiler
+
+def Extends (before after : Array W) : Prop :=
+  ∀ (index : Nat) (value : W), before[index]? = some value → after[index]? = some value
+
+theorem Extends.refl (buffer : Array W) : Extends buffer buffer := fun _ _ read => read
+
+theorem Extends.trans {first second third : Array W}
+    (left : Extends first second) (right : Extends second third) : Extends first third :=
+  fun index value read => right index value (left index value read)
+
+theorem Extends.push (buffer : Array W) (value : W) : Extends buffer (buffer.push value) := by
+  intro index old read
+  have bound := (Array.getElem?_eq_some_iff.mp read).1
+  rw [Array.getElem?_push_lt bound, (Array.getElem?_eq_some_iff.mp read).2]
+
+theorem eval_extends (ops : EvalOps W) (values : Values W) {before after : Array W}
+    (growth : Extends before after) (node : Node) {value : W}
+    (evaluated : node.eval ops values before = some value) :
+    node.eval ops values after = some value := by
+  cases node <;> simp only [Node.eval] at evaluated ⊢
+  all_goals try exact evaluated
+  case add a b | sub a b | mul a b =>
+    cases ha : before[a]? <;> cases hb : before[b]? <;>
+      simp only [ha, hb, bind, Option.bind, pure, reduceCtorEq] at evaluated
+    all_goals
+      rename_i va vb
+      simpa only [growth a va ha, growth b vb hb, bind, Option.bind, pure] using evaluated
+  case neg a =>
+    cases ha : before[a]? <;>
+      simp only [ha, bind, Option.bind, pure, reduceCtorEq] at evaluated
+    rename_i va
+    simpa only [growth a va ha, bind, Option.bind, pure] using evaluated
+
+structure Evaluation (ops : EvalOps W) (values : Values W) (nodes : List Node)
+    (buffer : Array W) : Prop where
+  size : buffer.size = nodes.length
+  sweep : sweepFrom ops values nodes #[] = some buffer
+  cached : ∀ (index : Nat) (node : Node), nodes[index]? = some node → node.eval ops values buffer = buffer[index]?
+
+theorem Evaluation.empty (ops : EvalOps W) (values : Values W) :
+    Evaluation ops values [] #[] := ⟨rfl, rfl, fun _ _ read => by cases read⟩
+
+theorem Evaluation.push {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) (node : Node) (value : W)
+    (evaluated : node.eval ops values buffer = some value) :
+    Evaluation ops values (nodes ++ [node]) (buffer.push value) := by
+  refine ⟨by simp only [Array.size_push, List.length_append, List.length_singleton, valid.size], ?_, ?_⟩
+  · simp only [sweepFrom_append, valid.sweep, sweepFrom, evaluated, bind, Option.bind]
+  · intro index old found
+    by_cases bound : index < nodes.length
+    · rw [List.getElem?_append_left bound] at found
+      have bnd : index < buffer.size := by rw [valid.size]; exact bound
+      have read := Array.getElem?_eq_getElem bnd
+      have oldEval := (valid.cached index old found).trans read
+      exact (eval_extends ops values (Extends.push buffer value) old oldEval).trans
+        (Array.getElem?_push_lt bnd).symm
+    · rw [List.getElem?_append_right (by omega)] at found
+      have pos : index = nodes.length := by
+        have bnd := (List.getElem?_eq_some_iff.mp found).1
+        simp only [List.length_singleton] at bnd
+        omega
+      subst index
+      simp only [Nat.sub_self, List.getElem?_cons_zero, Option.some.injEq] at found
+      subst old
+      simpa only [← valid.size, Array.getElem?_push_size] using
+        eval_extends ops values (Extends.push buffer value) node evaluated
+
+def intern (nodes : List Node) (node : Node) : List Node × Nat :=
+  match nodes.findIdx? (fun old => decide (old = node)) with
+  | some index => (nodes, index)
+  | none => (nodes ++ [node], nodes.length)
+
+def asConst (nodes : List Node) (index : Nat) : Option G :=
+  match nodes[index]? with
+  | some (.konst value) => some value
+  | _ => none
+
+def Result (ops : EvalOps W) (values : Values W) (before : Array W)
+    (result : List Node × Nat) (value : W) : Prop :=
+  ∃ after, Evaluation ops values result.1 after ∧ Extends before after ∧ after[result.2]? = some value
+
+theorem result_same {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {index : Nat} {value : W}
+    (read : buffer[index]? = some value) : Result ops values buffer (nodes, index) value :=
+  ⟨buffer, valid, Extends.refl buffer, read⟩
+
+theorem intern_reflects {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) (node : Node) {value : W}
+    (evaluated : node.eval ops values buffer = some value) :
+    Result ops values buffer (intern nodes node) value := by
+  unfold intern
+  split
+  next index found =>
+    obtain ⟨bound, equal, _⟩ := List.findIdx?_eq_some_iff_getElem.mp found
+    simp only [decide_eq_true_eq] at equal
+    have nodeRead : nodes[index]? = some node := by rw [List.getElem?_eq_getElem bound, equal]
+    exact result_same valid ((valid.cached index node nodeRead).symm.trans evaluated)
+  next =>
+    exact ⟨buffer.push value, valid.push node value evaluated, Extends.push buffer value,
+      by simp only [← valid.size, Array.getElem?_push_size]⟩
+
+theorem asConst_reflects {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {index : Nat} {constant : G}
+    (found : asConst nodes index = some constant) : buffer[index]? = some (ops.konst constant) := by
+  unfold asConst at found
+  split at found
+  next value nodeRead =>
+    cases found
+    exact (valid.cached index (.konst constant) nodeRead).symm
+  next => cases found
+
+theorem asConst_value {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {index : Nat} {constant : G} {value : W}
+    (found : asConst nodes index = some constant) (read : buffer[index]? = some value) :
+    value = ops.konst constant := Option.some.inj (read.symm.trans (asConst_reflects valid found))
+
+def neg (nodes : List Node) (a : Nat) : List Node × Nat :=
+  match asConst nodes a with
+  | some value => intern nodes (.konst (0 - value))
+  | none => match nodes[a]? with
+    | some (.neg inner) => (nodes, inner)
+    | _ => intern nodes (.neg a)
+
+def sortedAdd (nodes : List Node) (a b : Nat) : List Node × Nat :=
+  intern nodes (if a ≤ b then .add a b else .add b a)
+
+def sortedMul (nodes : List Node) (a b : Nat) : List Node × Nat :=
+  intern nodes (if a ≤ b then .mul a b else .mul b a)
+
+def add (nodes : List Node) (a b : Nat) : List Node × Nat :=
+  match asConst nodes a, asConst nodes b with
+  | some x, some y => intern nodes (.konst (x + y))
+  | some x, none => if x == 0 then (nodes, b) else sortedAdd nodes a b
+  | none, some y => if y == 0 then (nodes, a) else sortedAdd nodes a b
+  | none, none => sortedAdd nodes a b
+
+def sub (nodes : List Node) (a b : Nat) : List Node × Nat :=
+  if a = b then intern nodes (.konst 0) else
+  match asConst nodes a, asConst nodes b with
+  | some x, some y => intern nodes (.konst (x - y))
+  | none, some y => if y == 0 then (nodes, a) else intern nodes (.sub a b)
+  | some x, none => if x == 0 then neg nodes b else intern nodes (.sub a b)
+  | none, none => intern nodes (.sub a b)
+
+def mul (nodes : List Node) (a b : Nat) : List Node × Nat :=
+  match asConst nodes a, asConst nodes b with
+  | some x, some y => intern nodes (.konst (x * y))
+  | some x, none => if x == 0 then (nodes, a) else if x == 1 then (nodes, b) else sortedMul nodes a b
+  | none, some y => if y == 0 then (nodes, b) else if y == 1 then (nodes, a) else sortedMul nodes a b
+  | none, none => sortedMul nodes a b
+
+theorem konst_reflects {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) (value : G) :
+    Result ops values buffer (intern nodes (.konst value)) (ops.konst value) :=
+  intern_reflects valid (.konst value) rfl
+
+theorem neg_reflects {ops : EvalOps W} (laws : EvalLaws ops)
+    {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {a : Nat} {value : W}
+    (read : buffer[a]? = some value) : Result ops values buffer (neg nodes a) (ops.neg value) := by
+  unfold neg
+  split
+  next constant found =>
+    rw [asConst_value valid found read, ← laws.konst_neg]
+    exact konst_reflects valid _
+  next =>
+    split
+    next inner found =>
+      have evaluated := (valid.cached a (.neg inner) found).trans read
+      cases innerRead : buffer[inner]? with
+      | none => simp only [Node.eval, innerRead, bind, Option.bind, reduceCtorEq] at evaluated
+      | some child =>
+        simp only [Node.eval, innerRead, bind, Option.bind, pure, Option.some.injEq] at evaluated
+        rw [← evaluated, laws.neg_neg]
+        exact result_same valid innerRead
+    next =>
+      exact intern_reflects valid (.neg a) (by simp only [Node.eval, read, bind, Option.bind, pure])
+
+theorem sortedAdd_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {a b : Nat} {left right : W}
+    (leftRead : buffer[a]? = some left) (rightRead : buffer[b]? = some right) :
+    Result ops values buffer (sortedAdd nodes a b) (ops.add left right) := by
+  unfold sortedAdd
+  split <;> apply intern_reflects valid <;>
+    simp only [Node.eval, leftRead, rightRead, bind, Option.bind, pure]
+  exact congrArg some (laws.add_comm right left)
+
+theorem sortedMul_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {a b : Nat} {left right : W}
+    (leftRead : buffer[a]? = some left) (rightRead : buffer[b]? = some right) :
+    Result ops values buffer (sortedMul nodes a b) (ops.mul left right) := by
+  unfold sortedMul
+  split <;> apply intern_reflects valid <;>
+    simp only [Node.eval, leftRead, rightRead, bind, Option.bind, pure]
+  exact congrArg some (laws.mul_comm right left)
+
+theorem add_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {a b : Nat} {left right : W}
+    (leftRead : buffer[a]? = some left) (rightRead : buffer[b]? = some right) :
+    Result ops values buffer (add nodes a b) (ops.add left right) := by
+  cases ha : asConst nodes a <;> cases hb : asConst nodes b
+  all_goals simp only [add, ha, hb]
+  · exact sortedAdd_reflects laws valid leftRead rightRead
+  · rename_i y
+    split
+    next zero =>
+      have zero : y = 0 := beq_iff_eq.mp zero
+      rw [asConst_value valid hb rightRead, zero, laws.add_zero]
+      exact result_same valid leftRead
+    next => exact sortedAdd_reflects laws valid leftRead rightRead
+  · rename_i x
+    split
+    next zero =>
+      have zero : x = 0 := beq_iff_eq.mp zero
+      rw [asConst_value valid ha leftRead, zero, laws.zero_add]
+      exact result_same valid rightRead
+    next => exact sortedAdd_reflects laws valid leftRead rightRead
+  · rw [asConst_value valid ha leftRead, asConst_value valid hb rightRead, ← laws.konst_add]
+    exact konst_reflects valid _
+
+theorem sub_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {a b : Nat} {left right : W}
+    (leftRead : buffer[a]? = some left) (rightRead : buffer[b]? = some right) :
+    Result ops values buffer (sub nodes a b) (ops.sub left right) := by
+  have raw : Result ops values buffer (intern nodes (.sub a b)) (ops.sub left right) :=
+    intern_reflects valid (.sub a b) (by simp only [Node.eval, leftRead, rightRead, bind, Option.bind, pure])
+  unfold sub
+  split
+  next equal =>
+    subst b
+    have equal := Option.some.inj (leftRead.symm.trans rightRead)
+    rw [equal, laws.sub_self]
+    exact konst_reflects valid _
+  next =>
+    cases ha : asConst nodes a <;> cases hb : asConst nodes b
+    all_goals dsimp only
+    · exact raw
+    · rename_i y
+      split
+      next zero =>
+        have zero : y = 0 := beq_iff_eq.mp zero
+        rw [asConst_value valid hb rightRead, zero, laws.sub_zero]
+        exact result_same valid leftRead
+      next => exact raw
+    · rename_i x
+      split
+      next zero =>
+        have zero : x = 0 := beq_iff_eq.mp zero
+        rw [asConst_value valid ha leftRead, zero, laws.zero_sub]
+        exact neg_reflects laws.toEvalLaws valid rightRead
+      next => exact raw
+    · rw [asConst_value valid ha leftRead, asConst_value valid hb rightRead, ← laws.konst_sub]
+      exact konst_reflects valid _
+
+theorem mul_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {a b : Nat} {left right : W}
+    (leftRead : buffer[a]? = some left) (rightRead : buffer[b]? = some right) :
+    Result ops values buffer (mul nodes a b) (ops.mul left right) := by
+  cases ha : asConst nodes a <;> cases hb : asConst nodes b
+  all_goals simp only [mul, ha, hb]
+  · exact sortedMul_reflects laws valid leftRead rightRead
+  · rename_i y
+    split
+    next zero =>
+      have zero : y = 0 := beq_iff_eq.mp zero
+      rw [asConst_value valid hb rightRead, zero, laws.mul_zero]
+      exact result_same valid (by simpa only [zero] using asConst_reflects valid hb)
+    next =>
+      split
+      next one =>
+        have one : y = 1 := beq_iff_eq.mp one
+        rw [asConst_value valid hb rightRead, one, laws.mul_one]
+        exact result_same valid leftRead
+      next => exact sortedMul_reflects laws valid leftRead rightRead
+  · rename_i x
+    split
+    next zero =>
+      have zero : x = 0 := beq_iff_eq.mp zero
+      rw [asConst_value valid ha leftRead, zero, laws.zero_mul]
+      exact result_same valid (by simpa only [zero] using asConst_reflects valid ha)
+    next =>
+      split
+      next one =>
+        have one : x = 1 := beq_iff_eq.mp one
+        rw [asConst_value valid ha leftRead, one, laws.one_mul]
+        exact result_same valid rightRead
+      next => exact sortedMul_reflects laws valid leftRead rightRead
+  · rw [asConst_value valid ha leftRead, asConst_value valid hb rightRead, ← laws.konst_mul]
+    exact konst_reflects valid _
+
+def compileExpr (widths : GraphWidths) (allowStage2 : Bool) : Expr → List Node → Option (List Node × Nat)
+  | .konst value, nodes => some (intern nodes (.konst value))
+  | .var column, nodes =>
+    if (column.source != .stage2 || allowStage2) && column.index < widths.width column.source then
+      some (intern nodes (.var column))
+    else none
+  | .publicInput index, nodes =>
+    if index < widths.publics then some (intern nodes (.publicInput index)) else none
+  | .isFirstRow, nodes => some (intern nodes .isFirstRow)
+  | .isLastRow, nodes => some (intern nodes .isLastRow)
+  | .isTransition, nodes => some (intern nodes .isTransition)
+  | .add left right, nodes => do
+    let (nodes, a) ← compileExpr widths allowStage2 left nodes
+    let (nodes, b) ← compileExpr widths allowStage2 right nodes
+    return add nodes a b
+  | .sub left right, nodes => do
+    let (nodes, a) ← compileExpr widths allowStage2 left nodes
+    let (nodes, b) ← compileExpr widths allowStage2 right nodes
+    return sub nodes a b
+  | .mul left right, nodes => do
+    let (nodes, a) ← compileExpr widths allowStage2 left nodes
+    let (nodes, b) ← compileExpr widths allowStage2 right nodes
+    return mul nodes a b
+  | .neg child, nodes => do
+    let (nodes, a) ← compileExpr widths allowStage2 child nodes
+    return neg nodes a
+
+theorem result_prepend {ops : EvalOps W} {values : Values W} {before middle : Array W}
+    (growth : Extends before middle) {result : List Node × Nat} {value : W}
+    (reflected : Result ops values middle result value) : Result ops values before result value := by
+  obtain ⟨after, valid, rest, read⟩ := reflected
+  exact ⟨after, valid, growth.trans rest, read⟩
+
+theorem compileExpr_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (allowStage2 : Bool) (expr : Expr) {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {result : List Node × Nat}
+    (compiled : compileExpr widths allowStage2 expr nodes = some result) :
+    ∃ value, expr.eval ops values = some value ∧ Result ops values buffer result value := by
+  induction expr generalizing nodes buffer result with
+  | konst value =>
+    cases compiled
+    exact ⟨_, rfl, konst_reflects valid value⟩
+  | var column =>
+    simp only [compileExpr] at compiled
+    split at compiled
+    next accepted =>
+      cases compiled
+      have bound : column.index < (values.columns column.source column.offset).size := by
+        rw [fits.1]
+        simp only [Bool.and_eq_true, decide_eq_true_eq] at accepted
+        exact accepted.2
+      have read := Array.getElem?_eq_getElem bound
+      exact ⟨_, read, intern_reflects valid (.var column) read⟩
+    next => cases compiled
+  | publicInput index =>
+    simp only [compileExpr] at compiled
+    split at compiled
+    next bound =>
+      cases compiled
+      have bound : index < values.publics.size := by rw [fits.2]; exact bound
+      have read := Array.getElem?_eq_getElem bound
+      exact ⟨_, read, intern_reflects valid (.publicInput index) read⟩
+    next => cases compiled
+  | isFirstRow | isLastRow | isTransition =>
+    cases compiled
+    exact ⟨_, rfl, intern_reflects valid _ rfl⟩
+  | add left right ihLeft ihRight | sub left right ihLeft ihRight | mul left right ihLeft ihRight =>
+    simp only [compileExpr] at compiled
+    cases leftCompiled : compileExpr widths allowStage2 left nodes with
+    | none => simp only [leftCompiled, bind, Option.bind, reduceCtorEq] at compiled
+    | some leftResult =>
+      cases rightCompiled : compileExpr widths allowStage2 right leftResult.1 with
+      | none => simp only [leftCompiled, rightCompiled, bind, Option.bind, reduceCtorEq] at compiled
+      | some rightResult =>
+        simp only [leftCompiled, rightCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+        subst result
+        obtain ⟨leftValue, leftEval, leftBuffer, leftValid, leftGrowth, leftRead⟩ := ihLeft valid leftCompiled
+        obtain ⟨rightValue, rightEval, rightBuffer, rightValid, rightGrowth, rightRead⟩ := ihRight leftValid rightCompiled
+        simp only [Expr.eval, leftEval, rightEval, bind, Option.bind, pure, Option.some.injEq]
+        refine ⟨_, rfl, result_prepend (leftGrowth.trans rightGrowth) ?_⟩
+        first
+        | exact add_reflects laws rightValid (rightGrowth _ _ leftRead) rightRead
+        | exact sub_reflects laws rightValid (rightGrowth _ _ leftRead) rightRead
+        | exact mul_reflects laws rightValid (rightGrowth _ _ leftRead) rightRead
+  | neg child ih =>
+    simp only [compileExpr] at compiled
+    cases childCompiled : compileExpr widths allowStage2 child nodes with
+    | none => simp only [childCompiled, bind, Option.bind, reduceCtorEq] at compiled
+    | some childResult =>
+      simp only [childCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+      subst result
+      obtain ⟨value, evaluated, childBuffer, childValid, growth, read⟩ := ih valid childCompiled
+      exact ⟨ops.neg value, by simp only [Expr.eval, evaluated, bind, Option.bind, pure],
+        result_prepend growth (neg_reflects laws.toEvalLaws childValid read)⟩
+
+theorem compileExpr_sweep {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (allowStage2 : Bool) (expr : Expr) {result : List Node × Nat}
+    (compiled : compileExpr widths allowStage2 expr [] = some result) :
+    ∃ buffer, sweepFrom ops values result.1 #[] = some buffer ∧
+      buffer[result.2]? = expr.eval ops values := by
+  obtain ⟨value, evaluated, buffer, valid, _, read⟩ :=
+    compileExpr_reflects laws fits allowStage2 expr (Evaluation.empty ops values) compiled
+  exact ⟨buffer, valid.sweep, read.trans evaluated.symm⟩
+
+def compileExprs (widths : GraphWidths) (allowStage2 : Bool) :
+    List Expr → List Node → Option (List Node × List Nat)
+  | [], nodes => some (nodes, [])
+  | expr :: exprs, nodes => do
+    let (nodes, root) ← compileExpr widths allowStage2 expr nodes
+    let (nodes, roots) ← compileExprs widths allowStage2 exprs nodes
+    return (nodes, root :: roots)
+
+inductive RootsReflect (ops : EvalOps W) (values : Values W) (buffer : Array W) :
+    List Nat → List Expr → Prop where
+  | nil : RootsReflect ops values buffer [] []
+  | cons {root : Nat} {expr : Expr} {roots : List Nat} {exprs : List Expr}
+      (head : ∃ value, expr.eval ops values = some value ∧ buffer[root]? = some value)
+      (tail : RootsReflect ops values buffer roots exprs) :
+      RootsReflect ops values buffer (root :: roots) (expr :: exprs)
+
+theorem RootsReflect.grow {ops : EvalOps W} {values : Values W} {before after : Array W}
+    (growth : Extends before after) {roots : List Nat} {exprs : List Expr}
+    (reflected : RootsReflect ops values before roots exprs) : RootsReflect ops values after roots exprs := by
+  induction reflected with
+  | nil => exact .nil
+  | cons head _ ih =>
+    obtain ⟨value, evaluated, read⟩ := head
+    exact .cons ⟨value, evaluated, growth _ _ read⟩ ih
+
+theorem compileExprs_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (allowStage2 : Bool) (exprs : List Expr) {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {result : List Node × List Nat}
+    (compiled : compileExprs widths allowStage2 exprs nodes = some result) :
+    ∃ after, Evaluation ops values result.1 after ∧ Extends buffer after ∧
+      RootsReflect ops values after result.2 exprs := by
+  induction exprs generalizing nodes buffer result with
+  | nil => cases compiled; exact ⟨buffer, valid, Extends.refl buffer, .nil⟩
+  | cons expr exprs ih =>
+    simp only [compileExprs] at compiled
+    cases headCompiled : compileExpr widths allowStage2 expr nodes with
+    | none => simp only [headCompiled, bind, Option.bind, reduceCtorEq] at compiled
+    | some headResult =>
+      cases restCompiled : compileExprs widths allowStage2 exprs headResult.1 with
+      | none => simp only [headCompiled, restCompiled, bind, Option.bind, reduceCtorEq] at compiled
+      | some restResult =>
+        simp only [headCompiled, restCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+        subst result
+        obtain ⟨value, evaluated, middle, middleValid, growth, read⟩ :=
+          compileExpr_reflects laws fits allowStage2 expr valid headCompiled
+        obtain ⟨after, afterValid, restGrowth, reflected⟩ := ih middleValid restCompiled
+        exact ⟨after, afterValid, growth.trans restGrowth, .cons ⟨value, evaluated, restGrowth _ _ read⟩ reflected⟩
+
+def evalExprs (ops : EvalOps W) (values : Values W) (exprs : List Expr) : Option (List W) :=
+  exprs.mapM (Expr.eval ops values)
+
+theorem RootsReflect.read {ops : EvalOps W} {values : Values W} {buffer : Array W}
+    {roots : List Nat} {exprs : List Expr} (reflected : RootsReflect ops values buffer roots exprs) :
+    ∃ result, evalExprs ops values exprs = some result ∧ readNodes buffer roots = some result := by
+  induction reflected with
+  | nil => exact ⟨[], rfl, rfl⟩
+  | cons head _ ih =>
+    obtain ⟨value, evaluated, read⟩ := head
+    obtain ⟨rest, restEval, restRead⟩ := ih
+    refine ⟨value :: rest, ?_, ?_⟩
+    · simp only [evalExprs, List.mapM_cons, evaluated, bind, Option.bind]
+      change (evalExprs ops values _).bind _ = _
+      rw [restEval]; rfl
+    · simp only [readNodes, List.mapM_cons, read, bind, Option.bind]
+      change (readNodes buffer _).bind _ = _
+      rw [restRead]; rfl
+
+structure ExprLookup where
+  multiplicity : Expr
+  args : List Expr
+  deriving DecidableEq, Repr
+
+def ExprLookup.exprs (lookup : ExprLookup) : List Expr := lookup.multiplicity :: lookup.args
+
+def ExprLookup.eval (ops : EvalOps W) (values : Values W) (lookup : ExprLookup) : Option (W × List W) := do
+  let multiplicity ← lookup.multiplicity.eval ops values
+  let args ← evalExprs ops values lookup.args
+  return (multiplicity, args)
+
+def compileLookup (widths : GraphWidths) (lookup : ExprLookup) (nodes : List Node) :
+    Option (List Node × Lookup) := do
+  let (nodes, roots) ← compileExprs widths false lookup.exprs nodes
+  match roots with
+  | [] => none
+  | root :: roots => return (nodes, ⟨root, roots⟩)
+
+theorem compileLookup_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (lookup : ExprLookup) {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {result : List Node × Lookup}
+    (compiled : compileLookup widths lookup nodes = some result) :
+    ∃ after, Evaluation ops values result.1 after ∧ Extends buffer after ∧
+      RootsReflect ops values after result.2.roots lookup.exprs := by
+  simp only [compileLookup] at compiled
+  cases exprsCompiled : compileExprs widths false lookup.exprs nodes with
+  | none => simp only [exprsCompiled, bind, Option.bind, reduceCtorEq] at compiled
+  | some rootsResult =>
+    obtain ⟨after, afterValid, growth, reflected⟩ := compileExprs_reflects laws fits false lookup.exprs valid exprsCompiled
+    cases rootsResult with
+    | mk nodes roots =>
+      cases roots with
+      | nil => simp only [exprsCompiled, bind, Option.bind, reduceCtorEq] at compiled
+      | cons root roots =>
+        simp only [exprsCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+        subst result
+        exact ⟨after, afterValid, growth, reflected⟩
+
+theorem RootsReflect.readLookup {ops : EvalOps W} {values : Values W} {buffer : Array W}
+    {lookup : Lookup} {exprs : ExprLookup}
+    (reflected : RootsReflect ops values buffer lookup.roots exprs.exprs) :
+    ∃ read, exprs.eval ops values = some read ∧ readLookup buffer lookup = some read := by
+  cases reflected with
+  | cons head tail =>
+    obtain ⟨multiplicity, multiplicityEval, multiplicityRead⟩ := head
+    obtain ⟨args, argsEval, argsRead⟩ := RootsReflect.read tail
+    exact ⟨(multiplicity, args),
+      by simp only [ExprLookup.eval, multiplicityEval, argsEval, bind, Option.bind, pure],
+      by simp only [Aiur.NativeAIR.readLookup, multiplicityRead, argsRead, bind, Option.bind, pure]⟩
+
+def compileLookups (widths : GraphWidths) : List ExprLookup → List Node → Option (List Node × List Lookup)
+  | [], nodes => some (nodes, [])
+  | lookup :: lookups, nodes => do
+    let (nodes, root) ← compileLookup widths lookup nodes
+    let (nodes, roots) ← compileLookups widths lookups nodes
+    return (nodes, root :: roots)
+
+inductive LookupsReflect (ops : EvalOps W) (values : Values W) (buffer : Array W) :
+    List Lookup → List ExprLookup → Prop where
+  | nil : LookupsReflect ops values buffer [] []
+  | cons {lookup : Lookup} {expr : ExprLookup} {lookups : List Lookup} {exprs : List ExprLookup}
+      (head : RootsReflect ops values buffer lookup.roots expr.exprs)
+      (tail : LookupsReflect ops values buffer lookups exprs) :
+      LookupsReflect ops values buffer (lookup :: lookups) (expr :: exprs)
+
+theorem LookupsReflect.grow {ops : EvalOps W} {values : Values W} {before after : Array W}
+    (growth : Extends before after) {lookups : List Lookup} {exprs : List ExprLookup}
+    (reflected : LookupsReflect ops values before lookups exprs) : LookupsReflect ops values after lookups exprs := by
+  induction reflected with
+  | nil => exact .nil
+  | cons head _ ih => exact .cons (head.grow growth) ih
+
+theorem compileLookups_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (lookups : List ExprLookup) {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {result : List Node × List Lookup}
+    (compiled : compileLookups widths lookups nodes = some result) :
+    ∃ after, Evaluation ops values result.1 after ∧ Extends buffer after ∧
+      LookupsReflect ops values after result.2 lookups := by
+  induction lookups generalizing nodes buffer result with
+  | nil => cases compiled; exact ⟨buffer, valid, Extends.refl buffer, .nil⟩
+  | cons lookup lookups ih =>
+    simp only [compileLookups] at compiled
+    cases headCompiled : compileLookup widths lookup nodes with
+    | none => simp only [headCompiled, bind, Option.bind, reduceCtorEq] at compiled
+    | some headResult =>
+      cases restCompiled : compileLookups widths lookups headResult.1 with
+      | none => simp only [headCompiled, restCompiled, bind, Option.bind, reduceCtorEq] at compiled
+      | some restResult =>
+        simp only [headCompiled, restCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+        subst result
+        obtain ⟨middle, middleValid, growth, reflected⟩ := compileLookup_reflects laws fits lookup valid headCompiled
+        obtain ⟨after, afterValid, restGrowth, restReflected⟩ := ih middleValid restCompiled
+        exact ⟨after, afterValid, growth.trans restGrowth, .cons (reflected.grow restGrowth) restReflected⟩
+
+def recordZero (nodes : List Node) (root : Nat) : Option (List Nat) :=
+  match asConst nodes root with
+  | none => some [root]
+  | some value => if value == 0 then some [] else none
+
+def Vanishes (ops : EvalOps W) (buffer : Array W) (roots : List Nat) : Prop :=
+  ∀ root ∈ roots, buffer[root]? = some (ops.konst 0)
+
+def ExprsVanish (ops : EvalOps W) (values : Values W) (exprs : List Expr) : Prop :=
+  ∀ expr ∈ exprs, expr.eval ops values = some (ops.konst 0)
+
+theorem recordZero_reflects {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer after : Array W}
+    (valid : Evaluation ops values nodes buffer) (growth : Extends buffer after) {root : Nat} {value : W}
+    (read : buffer[root]? = some value) {roots : List Nat} (recorded : recordZero nodes root = some roots) :
+    Vanishes ops after roots ↔ value = ops.konst 0 := by
+  unfold recordZero at recorded
+  cases found : asConst nodes root with
+  | none =>
+    simp only [found, Option.some.injEq] at recorded
+    subst roots
+    simp only [Vanishes, List.mem_singleton, forall_eq, growth root value read, Option.some.injEq]
+  | some constant =>
+    simp only [found] at recorded
+    split at recorded
+    next zero =>
+      have zero : constant = 0 := beq_iff_eq.mp zero
+      cases recorded
+      rw [asConst_value valid found read, zero]
+      simp only [Vanishes, List.not_mem_nil, false_implies, forall_const, iff_self]
+    next => cases recorded
+
+theorem Vanishes.append (ops : EvalOps W) (buffer : Array W) (left right : List Nat) :
+    Vanishes ops buffer (left ++ right) ↔ Vanishes ops buffer left ∧ Vanishes ops buffer right := by
+  simp only [Vanishes, List.mem_append, or_imp, forall_and]
+
+theorem ExprsVanish.cons (ops : EvalOps W) (values : Values W) (head : Expr) (tail : List Expr) :
+    ExprsVanish ops values (head :: tail) ↔ head.eval ops values = some (ops.konst 0) ∧ ExprsVanish ops values tail := by
+  simp only [ExprsVanish, List.forall_mem_cons]
+
+def compileZeros (widths : GraphWidths) : List Expr → List Node → Option (List Node × List Nat)
+  | [], nodes => some (nodes, [])
+  | expr :: exprs, nodes => do
+    let (nodes, root) ← compileExpr widths false expr nodes
+    let head ← recordZero nodes root
+    let (nodes, roots) ← compileZeros widths exprs nodes
+    return (nodes, head ++ roots)
+
+theorem compileZeros_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (exprs : List Expr) {nodes : List Node} {buffer : Array W}
+    (valid : Evaluation ops values nodes buffer) {result : List Node × List Nat}
+    (compiled : compileZeros widths exprs nodes = some result) :
+    ∃ after, Evaluation ops values result.1 after ∧ Extends buffer after ∧
+      (Vanishes ops after result.2 ↔ ExprsVanish ops values exprs) := by
+  induction exprs generalizing nodes buffer result with
+  | nil =>
+    cases compiled
+    exact ⟨buffer, valid, Extends.refl buffer, by constructor <;> intro _ _ member <;> cases member⟩
+  | cons expr exprs ih =>
+    simp only [compileZeros] at compiled
+    cases headCompiled : compileExpr widths false expr nodes with
+    | none => simp only [headCompiled, bind, Option.bind, reduceCtorEq] at compiled
+    | some headResult =>
+      cases recorded : recordZero headResult.1 headResult.2 with
+      | none => simp only [headCompiled, recorded, bind, Option.bind, reduceCtorEq] at compiled
+      | some headRoots =>
+        cases restCompiled : compileZeros widths exprs headResult.1 with
+        | none => simp only [headCompiled, recorded, restCompiled, bind, Option.bind, reduceCtorEq] at compiled
+        | some restResult =>
+          simp only [headCompiled, recorded, restCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+          subst result
+          obtain ⟨value, evaluated, middle, middleValid, growth, read⟩ := compileExpr_reflects laws fits false expr valid headCompiled
+          obtain ⟨after, afterValid, restGrowth, reflected⟩ := ih middleValid restCompiled
+          refine ⟨after, afterValid, growth.trans restGrowth, ?_⟩
+          rw [Vanishes.append, recordZero_reflects middleValid restGrowth read recorded, reflected,
+            ExprsVanish.cons, evaluated, Option.some.injEq]
+
+def canonicalZeros (roots : List Nat) : List Nat :=
+  (roots.mergeSort (· ≤ ·)).eraseDups
+
+theorem canonicalZeros_vanish (ops : EvalOps W) (buffer : Array W) (roots : List Nat) :
+    Vanishes ops buffer (canonicalZeros roots) ↔ Vanishes ops buffer roots := by
+  simp only [Vanishes, canonicalZeros, List.mem_eraseDups, List.mem_mergeSort]
+
+structure BaseCompilation where
+  graph : Graph
+  lookupEnd : Nat
+  deriving DecidableEq, Repr
+
+def compileBase (widths : GraphWidths) (lookups : List ExprLookup) (constraints : List Expr) :
+    Option BaseCompilation := do
+  let (lookupNodes, lookups) ← compileLookups widths lookups []
+  let (nodes, zeros) ← compileZeros widths constraints lookupNodes
+  return ⟨⟨nodes, canonicalZeros zeros, lookups⟩, lookupNodes.length⟩
+
+theorem compileBase_reflects {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (lookups : List ExprLookup) (constraints : List Expr) {result : BaseCompilation}
+    (compiled : compileBase widths lookups constraints = some result) :
+    ∃ buffer, result.graph.sweep ops values = some buffer ∧
+      LookupsReflect ops values buffer result.graph.lookups lookups ∧
+      (Vanishes ops buffer result.graph.zeros ↔ ExprsVanish ops values constraints) := by
+  simp only [compileBase] at compiled
+  cases lookupsCompiled : compileLookups widths lookups [] with
+  | none => simp only [lookupsCompiled, bind, Option.bind, reduceCtorEq] at compiled
+  | some lookupResult =>
+    cases zerosCompiled : compileZeros widths constraints lookupResult.1 with
+    | none => simp only [lookupsCompiled, zerosCompiled, bind, Option.bind, reduceCtorEq] at compiled
+    | some zeroResult =>
+      simp only [lookupsCompiled, zerosCompiled, bind, Option.bind, pure, Option.some.injEq] at compiled
+      subst result
+      obtain ⟨middle, middleValid, _, lookupsReflected⟩ :=
+        compileLookups_reflects laws fits lookups (Evaluation.empty ops values) lookupsCompiled
+      obtain ⟨buffer, bufferValid, growth, zerosReflected⟩ :=
+        compileZeros_reflects laws fits constraints middleValid zerosCompiled
+      exact ⟨buffer, bufferValid.sweep, lookupsReflected.grow growth,
+        (canonicalZeros_vanish ops buffer zeroResult.2).trans zerosReflected⟩
+
+theorem LookupsReflect.read {ops : EvalOps W} {values : Values W} {buffer : Array W}
+    {lookups : List Lookup} {exprs : List ExprLookup}
+    (reflected : LookupsReflect ops values buffer lookups exprs) :
+    ∃ result, exprs.mapM (ExprLookup.eval ops values) = some result ∧
+      lookups.mapM (readLookup buffer) = some result := by
+  induction reflected with
+  | nil => exact ⟨[], rfl, rfl⟩
+  | cons head _ ih =>
+    obtain ⟨value, evaluated, read⟩ := head.readLookup
+    obtain ⟨rest, restEval, restRead⟩ := ih
+    exact ⟨value :: rest,
+      by simp only [List.mapM_cons, evaluated, restEval, bind, Option.bind, pure],
+      by simp only [List.mapM_cons, read, restRead, bind, Option.bind, pure]⟩
+
+theorem compileBase_satisfaction {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    {values : Values W} {widths : GraphWidths} (fits : values.Fits widths)
+    (lookups : List ExprLookup) (constraints : List Expr) {result : BaseCompilation}
+    (compiled : compileBase widths lookups constraints = some result) {buffer : Array W}
+    (swept : result.graph.sweep ops values = some buffer) :
+    (Vanishes ops buffer result.graph.zeros ↔ ExprsVanish ops values constraints) ∧
+      result.graph.lookups.mapM (readLookup buffer) = lookups.mapM (ExprLookup.eval ops values) := by
+  obtain ⟨actual, actualSweep, lookupsReflected, zerosReflected⟩ := compileBase_reflects laws fits lookups constraints compiled
+  have equal := Option.some.inj (actualSweep.symm.trans swept)
+  subst actual
+  obtain ⟨reads, exprReads, graphReads⟩ := lookupsReflected.read
+  exact ⟨zerosReflected, graphReads.trans exprReads.symm⟩
+
+end Compiler
+end NativeAIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/GraphCompletion.lean b/Ix/Aiur/Proofs/GraphCompletion.lean
new file mode 100644
index 000000000..6a6aa3ce4
--- /dev/null
+++ b/Ix/Aiur/Proofs/GraphCompletion.lean
@@ -0,0 +1,162 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.GraphCompilation
+
+/-! Defined reads make expression and lookup compilation total. A satisfying
+assignment also excludes the compiler's rejection of a nonzero constant
+constraint. The latter requires an injective interpretation of constants. -/
+
+namespace Aiur.NativeAIR.Compiler
+
+theorem compileExpr_defined {ops : EvalOps W} {values : Values W} {widths : GraphWidths}
+    (fits : values.Fits widths) (allowStage2 : Bool) (stage : widths.stage2 = 0 ∨ allowStage2 = true)
+    (expr : Expr) (nodes : List Node) {value : W} (evaluated : expr.eval ops values = some value) :
+    ∃ result, compileExpr widths allowStage2 expr nodes = some result := by
+  induction expr generalizing nodes value with
+  | konst constant => exact ⟨_, rfl⟩
+  | var column =>
+    have bound := (Array.getElem?_eq_some_iff.mp evaluated).choose
+    rw [fits.1] at bound
+    have enabled : (column.source != .stage2 || allowStage2) = true := by
+      rcases stage with empty | allowed
+      · cases source : column.source
+        · rfl
+        · rfl
+        · rw [source, GraphWidths.width, empty] at bound
+          omega
+      · simp only [allowed, Bool.or_true]
+    simp only [compileExpr, enabled, decide_eq_true bound, Bool.and_self, ite_true]
+    exact ⟨_, rfl⟩
+  | publicInput index =>
+    have bound := (Array.getElem?_eq_some_iff.mp evaluated).choose
+    rw [fits.2] at bound
+    simp only [compileExpr, bound, if_true]
+    exact ⟨_, rfl⟩
+  | isFirstRow | isLastRow | isTransition => exact ⟨_, rfl⟩
+  | add left right leftIH rightIH | sub left right leftIH rightIH | mul left right leftIH rightIH =>
+    simp only [Expr.eval, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i leftValue leftRead
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i rightValue rightRead
+    obtain ⟨middle, first⟩ := leftIH nodes leftRead
+    obtain ⟨result, last⟩ := rightIH middle.1 rightRead
+    simp only [compileExpr, first, last, bind, Option.bind_some, pure]
+    exact ⟨_, rfl⟩
+  | neg child ih =>
+    simp only [Expr.eval, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i childValue childRead
+    obtain ⟨result, compiled⟩ := ih nodes childRead
+    simp only [compileExpr, compiled, bind, Option.bind_some, pure]
+    exact ⟨_, rfl⟩
+
+theorem compileExprs_defined {ops : EvalOps W} {values : Values W} {widths : GraphWidths}
+    (fits : values.Fits widths) (allowStage2 : Bool) (stage : widths.stage2 = 0 ∨ allowStage2 = true)
+    (exprs : List Expr) (nodes : List Node) {results : List W}
+    (evaluated : evalExprs ops values exprs = some results) :
+    ∃ result, compileExprs widths allowStage2 exprs nodes = some result := by
+  induction exprs generalizing nodes results with
+  | nil => exact ⟨_, rfl⟩
+  | cons expr exprs ih =>
+    simp only [evalExprs, List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i value valueRead
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i rest restRead
+    obtain ⟨middle, first⟩ := compileExpr_defined fits allowStage2 stage expr nodes valueRead
+    obtain ⟨result, last⟩ := ih middle.1 restRead
+    simp only [compileExprs, first, last, bind, Option.bind_some, pure]
+    exact ⟨_, rfl⟩
+
+theorem compileLookup_defined {ops : EvalOps W} {values : Values W} {widths : GraphWidths}
+    (fits : values.Fits widths) (stage : widths.stage2 = 0) (lookup : ExprLookup) (nodes : List Node)
+    {value : W × List W} (evaluated : lookup.eval ops values = some value) :
+    ∃ result, compileLookup widths lookup nodes = some result := by
+  simp only [ExprLookup.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i multiplicity weightRead
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i args argsRead
+  obtain ⟨middle, first⟩ := compileExpr_defined fits false (.inl stage) lookup.multiplicity nodes weightRead
+  obtain ⟨result, last⟩ := compileExprs_defined fits false (.inl stage) lookup.args middle.1 argsRead
+  simp only [compileLookup, ExprLookup.exprs, compileExprs, first, last, bind, Option.bind_some, pure]
+  exact ⟨_, rfl⟩
+
+theorem compileLookups_defined {ops : EvalOps W} {values : Values W} {widths : GraphWidths}
+    (fits : values.Fits widths) (stage : widths.stage2 = 0) (lookups : List ExprLookup) (nodes : List Node)
+    {valuesRead : List (W × List W)} (evaluated : lookups.mapM (ExprLookup.eval ops values) = some valuesRead) :
+    ∃ result, compileLookups widths lookups nodes = some result := by
+  induction lookups generalizing nodes valuesRead with
+  | nil => exact ⟨_, rfl⟩
+  | cons lookup lookups ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i value valueRead
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i rest restRead
+    obtain ⟨middle, first⟩ := compileLookup_defined fits stage lookup nodes valueRead
+    obtain ⟨result, last⟩ := ih middle.1 restRead
+    simp only [compileLookups, first, last, bind, Option.bind_some, pure]
+    exact ⟨_, rfl⟩
+
+theorem recordZero_defined {ops : EvalOps W} {values : Values W} {nodes : List Node} {buffer : Array W}
+    (injective : Function.Injective ops.konst) (valid : Evaluation ops values nodes buffer) {root : Nat}
+    (read : buffer[root]? = some (ops.konst 0)) : ∃ roots, recordZero nodes root = some roots := by
+  unfold recordZero
+  cases found : asConst nodes root with
+  | none => exact ⟨_, rfl⟩
+  | some constant =>
+    have zero : constant = 0 := (injective (asConst_value valid found read)).symm
+    simp only [zero, beq_self_eq_true, if_true]
+    exact ⟨_, rfl⟩
+
+theorem compileZeros_defined {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    (injective : Function.Injective ops.konst) {values : Values W} {widths : GraphWidths}
+    (fits : values.Fits widths) (stage : widths.stage2 = 0) (exprs : List Expr)
+    {nodes : List Node} {buffer : Array W} (valid : Evaluation ops values nodes buffer)
+    (satisfied : ExprsVanish ops values exprs) :
+    ∃ result, compileZeros widths exprs nodes = some result := by
+  induction exprs generalizing nodes buffer with
+  | nil => exact ⟨_, rfl⟩
+  | cons expr exprs ih =>
+    have valueRead := satisfied expr List.mem_cons_self
+    obtain ⟨middle, compiled⟩ := compileExpr_defined fits false (.inl stage) expr nodes valueRead
+    obtain ⟨value, evaluated, after, afterValid, _, read⟩ :=
+      compileExpr_reflects laws fits false expr valid compiled
+    have equal := Option.some.inj (evaluated.symm.trans valueRead)
+    rw [equal] at read
+    obtain ⟨roots, recorded⟩ := recordZero_defined injective afterValid read
+    obtain ⟨result, rest⟩ := ih afterValid (fun expr member => satisfied expr (List.mem_cons_of_mem _ member))
+    simp only [compileZeros, compiled, recorded, rest, bind, Option.bind_some, pure]
+    exact ⟨_, rfl⟩
+
+theorem compileBase_defined {ops : EvalOps W} (laws : GraphEvalLaws ops)
+    (injective : Function.Injective ops.konst) {values : Values W} {widths : GraphWidths}
+    (fits : values.Fits widths) (stage : widths.stage2 = 0) (lookups : List ExprLookup) (constraints : List Expr)
+    {valuesRead : List (W × List W)} (lookupsRead : lookups.mapM (ExprLookup.eval ops values) = some valuesRead)
+    (satisfied : ExprsVanish ops values constraints) :
+    ∃ result, compileBase widths lookups constraints = some result := by
+  obtain ⟨middle, compiled⟩ := compileLookups_defined fits stage lookups [] lookupsRead
+  obtain ⟨buffer, valid, _, _⟩ := compileLookups_reflects laws fits lookups (Evaluation.empty ops values) compiled
+  obtain ⟨result, zeros⟩ := compileZeros_defined laws injective fits stage constraints valid satisfied
+  simp only [compileBase, compiled, zeros, bind, Option.bind_some, pure]
+  exact ⟨_, rfl⟩
+
+end Aiur.NativeAIR.Compiler
diff --git a/Ix/Aiur/Proofs/GraphWidths.lean b/Ix/Aiur/Proofs/GraphWidths.lean
new file mode 100644
index 000000000..76cfc8bc3
--- /dev/null
+++ b/Ix/Aiur/Proofs/GraphWidths.lean
@@ -0,0 +1,163 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CheckedCircuit
+
+/-! Additional columns do not change successful graph compilation. Widths
+only guard variable reads; interning, folding and root order are preserved.
+This lets physical function circuits use the complete native key widths. -/
+
+namespace Aiur.NativeAIR
+
+def GraphWidths.Le (small large : GraphWidths) : Prop :=
+  (∀ source, small.width source ≤ large.width source) ∧ small.publics ≤ large.publics
+
+namespace Compiler
+
+theorem compileExpr_widen {small large : GraphWidths} (widths : small.Le large)
+    (allowStage2 : Bool) (expr : Expr) {nodes : List Node} {result : List Node × Nat}
+    (compiled : compileExpr small allowStage2 expr nodes = some result) :
+    compileExpr large allowStage2 expr nodes = some result := by
+  induction expr generalizing nodes result with
+  | konst | isFirstRow | isLastRow | isTransition => exact compiled
+  | var column =>
+    simp only [compileExpr] at compiled ⊢
+    split at compiled
+    · rename_i valid
+      simp only [Bool.and_eq_true, decide_eq_true_eq] at valid
+      have bound := Nat.lt_of_lt_of_le valid.2 (widths.1 column.source)
+      simpa only [valid.1, bound, decide_true, Bool.true_and, if_true] using compiled
+    · cases compiled
+  | publicInput index =>
+    simp only [compileExpr] at compiled ⊢
+    split at compiled
+    · rename_i bound
+      simpa only [Nat.lt_of_lt_of_le bound widths.2, if_true] using compiled
+    · cases compiled
+  | add left right ihLeft ihRight | sub left right ihLeft ihRight | mul left right ihLeft ihRight =>
+    cases leftBuilt : compileExpr small allowStage2 left nodes with
+    | none => simp only [compileExpr, leftBuilt, bind, Option.bind_none, reduceCtorEq] at compiled
+    | some leftResult =>
+      cases rightBuilt : compileExpr small allowStage2 right leftResult.1 with
+      | none => simp only [compileExpr, leftBuilt, rightBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at compiled
+      | some rightResult =>
+        simp only [compileExpr, leftBuilt, rightBuilt, bind, Option.bind_some] at compiled
+        simpa only [compileExpr, ihLeft leftBuilt, ihRight rightBuilt, bind, Option.bind_some] using compiled
+  | neg child ih =>
+    cases childBuilt : compileExpr small allowStage2 child nodes with
+    | none => simp only [compileExpr, childBuilt, bind, Option.bind_none, reduceCtorEq] at compiled
+    | some childResult =>
+      simp only [compileExpr, childBuilt, bind, Option.bind_some] at compiled
+      simpa only [compileExpr, ih childBuilt, bind, Option.bind_some] using compiled
+
+theorem compileExprs_widen {small large : GraphWidths} (widths : small.Le large)
+    (allowStage2 : Bool) (exprs : List Expr) {nodes : List Node} {result : List Node × List Nat}
+    (compiled : compileExprs small allowStage2 exprs nodes = some result) :
+    compileExprs large allowStage2 exprs nodes = some result := by
+  induction exprs generalizing nodes result with
+  | nil => exact compiled
+  | cons expr exprs ih =>
+    cases headBuilt : compileExpr small allowStage2 expr nodes with
+    | none => simp only [compileExprs, headBuilt, bind, Option.bind_none, reduceCtorEq] at compiled
+    | some headResult =>
+      cases tailBuilt : compileExprs small allowStage2 exprs headResult.1 with
+      | none => simp only [compileExprs, headBuilt, tailBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at compiled
+      | some tailResult =>
+        have headWide := compileExpr_widen widths allowStage2 expr headBuilt
+        have tailWide := ih tailBuilt
+        simp only [compileExprs, headBuilt, tailBuilt, bind, Option.bind_some] at compiled
+        simpa only [compileExprs, headWide, tailWide, bind, Option.bind_some] using compiled
+
+theorem compileLookup_widen {small large : GraphWidths} (widths : small.Le large)
+    (lookup : ExprLookup) {nodes : List Node} {result : List Node × Lookup}
+    (compiled : compileLookup small lookup nodes = some result) :
+    compileLookup large lookup nodes = some result := by
+  cases built : compileExprs small false lookup.exprs nodes with
+  | none => simp only [compileLookup, built, bind, Option.bind_none, reduceCtorEq] at compiled
+  | some exprs =>
+    have wide := compileExprs_widen widths false lookup.exprs built
+    simp only [compileLookup, built, bind, Option.bind_some] at compiled
+    simpa only [compileLookup, wide, bind, Option.bind_some] using compiled
+
+theorem compileLookups_widen {small large : GraphWidths} (widths : small.Le large)
+    (lookups : List ExprLookup) {nodes : List Node} {result : List Node × List Lookup}
+    (compiled : compileLookups small lookups nodes = some result) :
+    compileLookups large lookups nodes = some result := by
+  induction lookups generalizing nodes result with
+  | nil => exact compiled
+  | cons lookup lookups ih =>
+    cases headBuilt : compileLookup small lookup nodes with
+    | none => simp only [compileLookups, headBuilt, bind, Option.bind_none, reduceCtorEq] at compiled
+    | some headResult =>
+      cases tailBuilt : compileLookups small lookups headResult.1 with
+      | none => simp only [compileLookups, headBuilt, tailBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at compiled
+      | some tailResult =>
+        have headWide := compileLookup_widen widths lookup headBuilt
+        have tailWide := ih tailBuilt
+        simp only [compileLookups, headBuilt, tailBuilt, bind, Option.bind_some] at compiled
+        simpa only [compileLookups, headWide, tailWide, bind, Option.bind_some] using compiled
+
+theorem compileZeros_widen {small large : GraphWidths} (widths : small.Le large)
+    (exprs : List Expr) {nodes : List Node} {result : List Node × List Nat}
+    (compiled : compileZeros small exprs nodes = some result) :
+    compileZeros large exprs nodes = some result := by
+  induction exprs generalizing nodes result with
+  | nil => exact compiled
+  | cons expr exprs ih =>
+    cases headBuilt : compileExpr small false expr nodes with
+    | none => simp only [compileZeros, headBuilt, bind, Option.bind_none, reduceCtorEq] at compiled
+    | some headResult =>
+      cases recorded : recordZero headResult.1 headResult.2 with
+      | none => simp only [compileZeros, headBuilt, recorded, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at compiled
+      | some roots =>
+        cases tailBuilt : compileZeros small exprs headResult.1 with
+        | none => simp only [compileZeros, headBuilt, recorded, tailBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at compiled
+        | some tailResult =>
+          have headWide := compileExpr_widen widths false expr headBuilt
+          have tailWide := ih tailBuilt
+          simp only [compileZeros, headBuilt, recorded, tailBuilt, bind, Option.bind_some] at compiled
+          simpa only [compileZeros, headWide, recorded, tailWide, bind, Option.bind_some] using compiled
+
+theorem compileBase_widen {small large : GraphWidths} (widths : small.Le large)
+    (lookups : List ExprLookup) (constraints : List Expr) {result : BaseCompilation}
+    (compiled : compileBase small lookups constraints = some result) :
+    compileBase large lookups constraints = some result := by
+  cases lookupsBuilt : compileLookups small lookups [] with
+  | none => simp only [compileBase, lookupsBuilt, bind, Option.bind_none, reduceCtorEq] at compiled
+  | some lookupResult =>
+    cases zerosBuilt : compileZeros small constraints lookupResult.1 with
+    | none => simp only [compileBase, lookupsBuilt, zerosBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at compiled
+    | some zeroResult =>
+      have lookupsWide := compileLookups_widen widths lookups lookupsBuilt
+      have zerosWide := compileZeros_widen widths constraints zerosBuilt
+      simp only [compileBase, lookupsBuilt, zerosBuilt, bind, Option.bind_some] at compiled
+      simpa only [compileBase, lookupsWide, zerosWide, bind, Option.bind_some] using compiled
+
+end Compiler
+
+namespace CircuitEmitter
+
+theorem compileCircuit_widen {small large : GraphWidths} (widths : small.Le large)
+    (program : Bytecode.Toplevel) (circuit : Bytecode.Circuit) {compiled : Compiled}
+    (built : compileCircuit small program circuit = some compiled) :
+    compileCircuit large program circuit = some compiled := by
+  cases emitted : emitCircuit program circuit with
+  | none => simp only [compileCircuit, emitted, bind, Option.bind_none, reduceCtorEq] at built
+  | some emission =>
+    cases baseBuilt : Compiler.compileBase small emission.lookups emission.equations with
+    | none => simp only [compileCircuit, emitted, baseBuilt, bind, Option.bind_some, Option.bind_none, reduceCtorEq] at built
+    | some base =>
+      have baseWide := Compiler.compileBase_widen widths emission.lookups emission.equations baseBuilt
+      simp only [compileCircuit, emitted, baseBuilt, bind, Option.bind_some] at built
+      simpa only [compileCircuit, emitted, baseWide, bind, Option.bind_some] using built
+
+theorem circuitWidths_le {circuit : Bytecode.Circuit} {widths : GraphWidths}
+    (main : circuit.layout.width ≤ widths.main) : (circuitWidths circuit).Le widths := by
+  refine ⟨?_, Nat.zero_le _⟩
+  intro source
+  cases source <;> simp only [circuitWidths, GraphWidths.width, Nat.zero_le, main]
+
+end CircuitEmitter
+end Aiur.NativeAIR
diff --git a/Ix/Aiur/Proofs/Grouping.lean b/Ix/Aiur/Proofs/Grouping.lean
new file mode 100644
index 000000000..8b87dc367
--- /dev/null
+++ b/Ix/Aiur/Proofs/Grouping.lean
@@ -0,0 +1,139 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.BoundVerifier
+
+/-!
+# Reference execution through the selected circuit grouping
+
+Successful grouping preserves the source, function map, complete function
+array and memory widths. Its partition change therefore preserves reference
+execution, including errors and final I/O state. The selected backend can
+reflect that execution back through final compilation metadata and checked
+deduplication to the same named function in the actual lowering output. This
+does not yet extract execution from AIR witnesses or reflect earlier passes.
+-/
+
+namespace Aiur
+
+theorem CompiledToplevel.groupFunctions_preserves_code
+    {before after : CompiledToplevel} {groups : Array (String × Array String)}
+    (accepted : before.groupFunctions groups = .ok after) :
+    after.source = before.source ∧ after.nameMap = before.nameMap ∧
+    after.bytecode.functions = before.bytecode.functions ∧
+    after.bytecode.memorySizes = before.bytecode.memorySizes := by
+  unfold CompiledToplevel.groupFunctions at accepted
+  simp only [bind, Except.bind, pure, Except.pure] at accepted
+  split at accepted
+  · cases accepted
+  · split at accepted
+    · cases accepted
+    · cases accepted
+      exact ⟨rfl, rfl, rfl, rfl⟩
+
+theorem CompiledToplevel.groupFunctions_sameCode
+    {before after : CompiledToplevel} {groups : Array (String × Array String)}
+    (accepted : before.groupFunctions groups = .ok after) :
+    Bytecode.Eval.SameCode after.bytecode before.bytecode := by
+  have same := (groupFunctions_preserves_code accepted).2.2.1
+  constructor
+  · exact congrArg Array.size same
+  · intro i ha hb
+    simp only [same]
+  · intro i ha hb
+    simp only [same]
+
+/-- Equality includes error results and final I/O state at every fuel value. -/
+theorem CompiledToplevel.groupFunctions_preserves_execution
+    {before after : CompiledToplevel} {groups : Array (String × Array String)}
+    (accepted : before.groupFunctions groups = .ok after)
+    (function : Bytecode.FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat) :
+    Bytecode.Eval.runFunction after.bytecode function args io fuel =
+      Bytecode.Eval.runFunction before.bytecode function args io fuel :=
+  Bytecode.Eval.runFunction_sameCode (groupFunctions_sameCode accepted)
+    function args io fuel
+
+/-- The actual selected compilation preserves the ungrouped reference run. -/
+theorem BoundVerifier.Backend.reference_execution
+    {selection : BoundVerifier.Selection} (backend : BoundVerifier.Backend selection)
+    (function : Bytecode.FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat) :
+    ∃ initial, selection.source.compile = .ok initial ∧
+      Bytecode.Eval.runFunction backend.compiled.bytecode function args io fuel =
+        Bytecode.Eval.runFunction initial.bytecode function args io fuel := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  refine ⟨initial, compiled, ?_⟩
+  split at grouped
+  · cases grouped
+    rfl
+  · exact CompiledToplevel.groupFunctions_preserves_execution grouped function args io fuel
+
+/-- Reference success at the selected entrypoint reflects to the exact
+deduplicated output of the successful source compiler stages. No AIR or
+cryptographic acceptance premise is substituted for reference execution. -/
+theorem BoundVerifier.Backend.execution_reflects
+    {selection : BoundVerifier.Selection} (backend : BoundVerifier.Backend selection)
+    {args : Array G} {io : IOBuffer} {fuel : Nat} {result : Array G × IOBuffer}
+    (accepted : Bytecode.Eval.runFunction backend.compiled.bytecode
+      selection.function args io fuel = .ok result) :
+    ∃ inlined typed concrete raw names,
+      selection.source.inlineCalls = .ok inlined ∧
+      inlined.checkAndSimplify = .ok typed ∧
+      typed.concretize = .ok concrete ∧
+      concrete.toBytecode = .ok (raw, names) ∧
+      Bytecode.Eval.runFunction raw.deduplicate.1
+        selection.function args io fuel = .ok result := by
+  obtain ⟨initial, compiled, execution⟩ :=
+    backend.reference_execution selection.function args io fuel
+  obtain ⟨inlined, typed, concrete, raw, names, hi, ht, hc, hb, artifact⟩ :=
+    Source.Toplevel.compile_artifact_of_ok compiled
+  refine ⟨inlined, typed, concrete, raw, names, hi, ht, hc, hb, ?_⟩
+  apply finishCompilation_reflects (source := inlined) (names := names)
+  rw [← artifact]
+  exact execution.symm.trans accepted
+
+/-- Grouping retains the selected entrypoint as well as its reference run. -/
+theorem BoundVerifier.Backend.reference_entrypoint
+    {selection : BoundVerifier.Selection} (backend : BoundVerifier.Backend selection)
+    (args : Array G) (io : IOBuffer) (fuel : Nat) :
+    ∃ initial, selection.source.compile = .ok initial ∧
+      initial.getFuncIdx selection.entrypoint = some selection.function ∧
+      Bytecode.Eval.runFunction backend.compiled.bytecode selection.function args io fuel =
+        Bytecode.Eval.runFunction initial.bytecode selection.function args io fuel := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  refine ⟨initial, compiled, ?_⟩
+  split at grouped
+  · cases grouped
+    exact ⟨backend.selected, rfl⟩
+  · have sameNames := (CompiledToplevel.groupFunctions_preserves_code grouped).2.1
+    exact ⟨by simpa only [CompiledToplevel.getFuncIdx, sameNames] using backend.selected,
+      CompiledToplevel.groupFunctions_preserves_execution grouped selection.function args io fuel⟩
+
+/-- Successful execution of the selected backend reflects through grouping,
+metadata and checked deduplication to the same named function in the actual
+lowering output. The earlier source passes and AIR extraction are separate. -/
+theorem BoundVerifier.Backend.execution_reflects_raw
+    {selection : BoundVerifier.Selection} (backend : BoundVerifier.Backend selection)
+    {args : Array G} {io : IOBuffer} {fuel : Nat} {result : Array G × IOBuffer}
+    (accepted : Bytecode.Eval.runFunction backend.compiled.bytecode
+      selection.function args io fuel = .ok result) :
+    ∃ inlined typed concrete raw names original,
+      selection.source.inlineCalls = .ok inlined ∧
+      inlined.checkAndSimplify = .ok typed ∧
+      typed.concretize = .ok concrete ∧
+      concrete.toBytecode = .ok (raw, names) ∧
+      names[Global.mk selection.entrypoint]? = some original ∧
+      raw.deduplicate.2 original = selection.function ∧
+      Bytecode.Eval.runFunction raw original args io fuel = .ok result := by
+  obtain ⟨initial, compiled, selected, execution⟩ := backend.reference_entrypoint args io fuel
+  obtain ⟨inlined, typed, concrete, raw, names, hi, ht, hc, hb, artifact⟩ :=
+    Source.Toplevel.compile_artifact_of_ok compiled
+  rw [artifact] at selected
+  obtain ⟨original, named, remapped⟩ := finishCompilation_nameMap_image selected
+  refine ⟨inlined, typed, concrete, raw, names, original, hi, ht, hc, hb, named, remapped, ?_⟩
+  apply (finishCompilation_preserves_execution inlined raw names original args io fuel result).mpr
+  rw [remapped, ← artifact]
+  exact execution.symm.trans accepted
+
+end Aiur
diff --git a/Ix/Aiur/Proofs/InactiveRows.lean b/Ix/Aiur/Proofs/InactiveRows.lean
new file mode 100644
index 000000000..7fa115fd7
--- /dev/null
+++ b/Ix/Aiur/Proofs/InactiveRows.lean
@@ -0,0 +1,378 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRows
+
+/-! Zero selectors satisfy every successfully emitted block, for arbitrary
+logical values and advice. The all-zero circuit row therefore witnesses that
+symbolic circuit constraints contain no contradictory constant equation. -/
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem selectorSum_zero (values : List G) (zero : ∀ value ∈ values, value = 0) :
+    selectorSum values = 0 := by
+  induction values with
+  | nil => rfl
+  | cons value values ih =>
+    rw [selectorSum_cons, zero value List.mem_cons_self,
+      ih (fun value member => zero value (List.mem_cons_of_mem _ member)), G.zero_add]
+
+theorem emitOp_inactive {row : Nat → G} {rank : G} (op : Op) {values : Array RowValue}
+    {emission : OpEmission} (emitted : emitOp row 0 rank op values = some emission) :
+    ∀ equation ∈ emission.equations, equation = 0 := by
+  cases op <;> simp only [emitOp, emitAdvice, emitByte1, emitByte2, emitU32LessThan,
+    emitU32Add, bind, Option.bind] at emitted
+  all_goals repeat' first | split at emitted | (dsimp only at emitted; split at emitted)
+  all_goals cases emitted
+  all_goals simp [G.mul_comm (0 : G), G.mul_zero]
+
+theorem emitOps_inactive {row : Nat → G} {rank : G} (ops : List Op) {values : Array RowValue}
+    {column : Nat} {emission : OpsEmission} (emitted : emitOps row 0 rank ops values column = some emission) :
+    ∀ equation ∈ emission.equations, equation = 0 := by
+  induction ops generalizing values column emission with
+  | nil => cases emitted; simp
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i first firstEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    intro equation member
+    rcases List.mem_append.mp member with firstMember | restMember
+    · exact emitOp_inactive op firstEmitted equation firstMember
+    · exact ih restEmitted equation restMember
+
+def BlockEmission.Inactive (emission : BlockEmission) : Prop :=
+  (∀ equation ∈ emission.equations, equation = 0) ∧ ∀ part ∈ emission.yields, part.1 = 0
+
+theorem BlockEmission.Inactive.prefix {emission : BlockEmission} (inactive : emission.Inactive)
+    (equations : List G) (zero : ∀ equation ∈ equations, equation = 0) :
+    (emission.prefix equations).Inactive := by
+  refine ⟨?_, inactive.2⟩
+  intro equation member
+  rcases List.mem_append.mp member with first | last
+  · exact zero equation first
+  · exact inactive.1 equation last
+
+theorem BlockEmission.Inactive.afterOps {emission : BlockEmission} (inactive : emission.Inactive)
+    (incoming : G) (lookup : Nat) (ops : OpsEmission) (zero : ∀ equation ∈ ops.equations, equation = 0) :
+    (emission.afterOps incoming lookup ops).Inactive := inactive.prefix _ zero
+
+theorem joinBlockEmissions_inactive (values : Array RowValue) (column lookup : Nat)
+    (emissions : List BlockEmission) (inactive : ∀ emission ∈ emissions, emission.Inactive) :
+    (joinBlockEmissions values column lookup emissions).Inactive := by
+  constructor
+  · intro equation member
+    obtain ⟨emission, member, present⟩ := List.mem_flatMap.mp member
+    exact (inactive emission member).1 equation present
+  · intro part member
+    obtain ⟨emission, member, present⟩ := List.mem_flatMap.mp member
+    exact (inactive emission member).2 part present
+
+theorem BlockEmission.Inactive.continued {branches continuation : BlockEmission}
+    (first : branches.Inactive) (last : continuation.Inactive)
+    (equations : List G) (zero : ∀ equation ∈ equations, equation = 0) :
+    (branches.continued equations continuation).Inactive := by
+  refine ⟨?_, last.2⟩
+  intro equation member
+  rcases List.mem_append.mp member with before | after
+  · rcases List.mem_append.mp before with branch | link
+    · exact first.1 equation branch
+    · exact zero equation link
+  · exact last.1 equation after
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+private theorem inactive_case_smaller {branches : Array (G × Block)} {pair : G × Block}
+    (member : pair ∈ branches.toList) : sizeOf pair.2 < sizeOf branches := by
+  have bound := Array.sizeOf_lt_of_mem (Array.mem_toList_iff.mp member)
+  cases pair
+  simp at bound ⊢
+  omega
+
+private theorem inactive_default_smaller {fallback : Option Block} {block : Block}
+    (present : fallback = some block) : sizeOf block < sizeOf fallback := by
+  rw [present]
+  simp
+
+theorem branchSelectorFlows_entry_zero (branches : Array (G × Block)) (fallback : Option Block)
+    (caseZero : ∀ pair ∈ branches.toList, (pair.2.selectorFlow (fun _ => 0)).entry = 0)
+    (defaultZero : ∀ block, fallback = some block → (block.selectorFlow (fun _ => 0)).entry = 0) :
+    (SelectorFlow.join (branchSelectorFlows (fun _ => 0) branches fallback)).entry = 0 := by
+  apply selectorSum_zero
+  intro value member
+  obtain ⟨flow, flowMember, equal⟩ := List.mem_map.mp member
+  subst value
+  rcases List.mem_append.mp flowMember with first | last
+  · obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp first
+    subst flow
+    exact caseZero pair pairMember
+  · obtain ⟨block, blockMember, equal⟩ := List.mem_map.mp last
+    subst flow
+    exact defaultZero block (by simpa only [Option.mem_toList] using blockMember)
+
+mutual
+
+theorem Ctrl.selectorFlow_entry_zero (ctrl : Ctrl) : (ctrl.selectorFlow (fun _ => 0)).entry = 0 := by
+  cases ctrl with
+  | «return» index values | yield index values => rw [Ctrl.selectorFlow.eq_def]; rfl
+  | «match» index branches fallback =>
+    rw [Ctrl.selectorFlow_match]
+    exact branchSelectorFlows_entry_zero branches fallback
+      (fun pair member => Block.selectorFlow_entry_zero pair.2)
+      (fun block present => Block.selectorFlow_entry_zero block)
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [Ctrl.selectorFlow_matchContinue]
+    exact branchSelectorFlows_entry_zero branches fallback
+      (fun pair member => Block.selectorFlow_entry_zero pair.2)
+      (fun block present => Block.selectorFlow_entry_zero block)
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals subst ctrl
+  all_goals first
+    | (have bound := inactive_case_smaller ‹_ ∈ _›; simp; omega)
+    | (have bound := inactive_default_smaller ‹_ = some _›; simp; omega)
+
+theorem Block.selectorFlow_entry_zero (block : Block) : (block.selectorFlow (fun _ => 0)).entry = 0 := by
+  rw [Block.selectorFlow]
+  exact Ctrl.selectorFlow_entry_zero block.ctrl
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+theorem branchRows_inactive (row : Nat → G) (context : RowContext) (matched : G)
+    (values : Array RowValue) (column lookup : Nat) (branches : Array (G × Block)) (fallback : Option Block)
+    {emission : BlockEmission}
+    (caseSound : ∀ pair ∈ branches.toList, ∀ result,
+      pair.2.emitRow row (fun _ => 0) context 0 values column lookup = some result → result.Inactive)
+    (defaultSound : ∀ block, fallback = some block → ∀ result,
+      block.emitRow row (fun _ => 0) context 0 values (column + branches.size) lookup = some result → result.Inactive)
+    (emitted : branchRows row (fun _ => 0) context matched values column lookup branches fallback = some emission) :
+    emission.Inactive := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i cases casesEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i defaults defaultsEmitted
+  cases emitted
+  have casesValid : ∀ result ∈ cases, result.Inactive := by
+    have related : List.Forall₂ (fun _ result => result.Inactive) branches.toList cases := by
+      apply mapM_forall₂ casesEmitted
+      intro pair member result resultEmitted
+      simp only [caseRow, Block.selectorFlow_entry_zero, bind, Option.bind] at resultEmitted
+      split at resultEmitted
+      · cases resultEmitted
+      rename_i body bodyEmitted
+      cases resultEmitted
+      exact (caseSound pair member body bodyEmitted).prefix _ (by simp [G.mul_comm (0 : G), G.mul_zero])
+    intro result member
+    obtain ⟨_, _, valid⟩ := forall₂_right_member related member
+    exact valid
+  have defaultsValid : ∀ result ∈ defaults, result.Inactive := by
+    cases present : fallback with
+    | none =>
+      simp only [defaultRow, present, Option.some.injEq] at defaultsEmitted
+      subst defaults
+      simp
+    | some block =>
+      simp only [defaultRow, present, Block.selectorFlow_entry_zero, bind, Option.bind] at defaultsEmitted
+      split at defaultsEmitted
+      · cases defaultsEmitted
+      rename_i body bodyEmitted
+      cases defaultsEmitted
+      intro result member
+      have equal := List.mem_singleton.mp member
+      subst result
+      apply (defaultSound block present body bodyEmitted).prefix
+      simp [G.mul_comm (0 : G), G.mul_zero]
+  apply joinBlockEmissions_inactive
+  intro result member
+  rcases List.mem_append.mp member with first | last
+  · exact casesValid result first
+  · exact defaultsValid result last
+
+mutual
+
+theorem Ctrl.emitRow_inactive (row : Nat → G) (context : RowContext) (ctrl : Ctrl)
+    (values : Array RowValue) (column lookup : Nat) {emission : BlockEmission}
+    (emitted : ctrl.emitRow row (fun _ => 0) context 0 values column lookup = some emission) :
+    emission.Inactive := by
+  cases ctrl with
+  | «return» index indices | yield index indices =>
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    repeat' first | split at emitted | (dsimp only at emitted; split at emitted)
+    all_goals cases emitted
+    all_goals simp [BlockEmission.Inactive]
+  | «match» index branches fallback =>
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    exact branchRows_inactive row context _ values column lookup branches fallback
+      (fun pair member result emitted => Block.emitRow_inactive row context pair.2 values column lookup emitted)
+      (fun block present result emitted => Block.emitRow_inactive row context block values _ lookup emitted) emitted
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i joined joinedEmitted
+    have joinedValid := branchRows_inactive row context _ values column lookup branches fallback
+      (fun pair member result emitted => Block.emitRow_inactive row context pair.2 values column lookup emitted)
+      (fun block present result emitted => Block.emitRow_inactive row context block values _ lookup emitted) joinedEmitted
+    have gate : selectorSum (joined.yields.map Prod.fst) = 0 := by
+      apply selectorSum_zero
+      intro value member
+      obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+      subst value
+      exact joinedValid.2 part partMember
+    simp only [continueRow, gate, Block.selectorFlow_entry_zero] at emitted
+    split at emitted
+    · simp only [bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      rename_i continued continuedEmitted
+      cases emitted
+      apply joinedValid.continued (Block.emitRow_inactive row context continuation _ _ _ continuedEmitted)
+      intro equation member
+      rcases List.mem_append.mp member with merged | linked
+      · obtain ⟨index, _, equal⟩ := List.mem_map.mp merged
+        rw [← equal]
+        exact (G.mul_comm 0 _).trans (G.mul_zero _)
+      · have equal := List.mem_singleton.mp linked
+        exact equal.trans (show (0 : G) - 0 = 0 from rfl)
+    · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals subst ctrl
+  all_goals first
+    | (have bound := inactive_case_smaller ‹_ ∈ _›; simp; omega)
+    | (have bound := inactive_default_smaller ‹_ = some _›; simp; omega)
+    | decreasing_tactic
+
+theorem Block.emitRow_inactive (row : Nat → G) (context : RowContext) (block : Block)
+    (values : Array RowValue) (column lookup : Nat) {emission : BlockEmission}
+    (emitted : block.emitRow row (fun _ => 0) context 0 values column lookup = some emission) :
+    emission.Inactive := by
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i operations opsEmitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i control ctrlEmitted
+  cases emitted
+  have controlValid := Ctrl.emitRow_inactive row context block.ctrl _ _ _ ctrlEmitted
+  apply (controlValid.afterOps _ _ _ (emitOps_inactive block.ops.toList opsEmitted)).prefix
+  simp [Block.selectorFlow_entry_zero, oneSubBooleanConstraint, G.mul_comm (0 : G), G.mul_zero]
+termination_by sizeOf block
+decreasing_by cases block; simp; omega
+
+end
+
+end Aiur.Bytecode
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem MemberEmission.entry_zero (member : MemberEmission) : member.entry (fun _ => 0) = 0 :=
+  Block.selectorFlow_entry_zero member.function.body
+
+theorem emitMember_zero {rank : G} {column lookup selectorBase : Nat} {program : Toplevel}
+    {functionIndex : FunIdx} {member : MemberEmission}
+    (emitted : emitMember (fun _ => 0) rank column lookup selectorBase program functionIndex = some member) :
+    member.body.Inactive := by
+  simp only [emitMember, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i function functionRead
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i body bodyEmitted
+  cases emitted
+  simp only [Function.emitRow, Block.selectorFlow_entry_zero] at bodyEmitted
+  exact Block.emitRow_inactive _ _ _ _ _ _ bodyEmitted
+
+theorem emitMembers_zero {rank : G} (column lookup selectorBase : Nat) (program : Toplevel)
+    (indices : List FunIdx) {members : List MemberEmission}
+    (emitted : emitMembers (fun _ => 0) rank column lookup selectorBase program indices = some members) :
+    ∀ member ∈ members, member.body.Inactive := by
+  induction indices generalizing selectorBase members with
+  | nil => cases emitted; simp
+  | cons index indices ih =>
+    simp only [emitMembers, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i member memberEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    intro chosen memberOf
+    rcases List.mem_cons.mp memberOf with equal | later
+    · subst chosen; exact emitMember_zero memberEmitted
+    · exact ih _ restEmitted chosen later
+
+theorem circuitEmission_zero (circuit : Circuit) (members : List MemberEmission)
+    (inactive : ∀ member ∈ members, member.body.Inactive) :
+    ∀ equation ∈ (circuitEmission (fun _ => 0) circuit members).equations, equation = 0 := by
+  have selected : selectorSum (members.map (·.entry (fun _ => 0))) = 0 := by
+    apply selectorSum_zero
+    intro value member
+    obtain ⟨part, _, equal⟩ := List.mem_map.mp member
+    subst value
+    exact part.entry_zero
+  intro equation member
+  dsimp only [circuitEmission] at member
+  rw [selected] at member
+  rcases List.mem_append.mp member with prior | activity
+  · rcases List.mem_append.mp prior with prior | group
+    · rcases List.mem_append.mp prior with body | boolean
+      · obtain ⟨part, partMember, present⟩ := List.mem_flatMap.mp body
+        exact (inactive part partMember).1 equation present
+      · obtain ⟨_, _, equal⟩ := List.mem_map.mp boolean
+        exact equal.symm.trans (show booleanConstraint 0 = 0 from rfl)
+    · split at group
+      · exact (List.mem_singleton.mp group).trans (show oneSubBooleanConstraint 0 = 0 from rfl)
+      · cases group
+  · exact (List.mem_singleton.mp activity).trans (show activityConstraint 0 0 = 0 from rfl)
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_zero (program : Toplevel) (circuit : Circuit) {emission : CircuitEmission}
+    (emitted : circuit.emitRow (fun _ => 0) program = some emission) :
+    ∀ equation ∈ emission.equations, equation = 0 := by
+  simp only [Circuit.emitRow, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i members membersEmitted
+  cases emitted
+  exact circuitEmission_zero circuit members (emitMembers_zero _ _ _ program circuit.members.toList membersEmitted)
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/Interpolation.lean b/Ix/Aiur/Proofs/Interpolation.lean
new file mode 100644
index 000000000..96b1faf6f
--- /dev/null
+++ b/Ix/Aiur/Proofs/Interpolation.lean
@@ -0,0 +1,408 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Interpolation
+import Ix.Aiur.Proofs.Polynomial
+
+/-! Lagrange interpolation on the native folding cosets. Synthetic division
+and the checked polynomial root bound establish the diagonal weights, exact
+node values, degree bound and uniqueness. The runtime formula is then proved
+to evaluate those coefficients, with its node branch preceding inversion.
+-/
+
+namespace Aiur.NativeAIR.Interpolation
+
+open Lean.Grind
+open _root_.Aiur.NativeAIR.Quotient (horner horner_nil horner_cons)
+attribute [local instance] Semiring.natCast Ring.intCast
+
+variable {R : Type} [CommRing R]
+
+theorem derivative_zero (point : R) {coefficients : List R} (zero : Polynomial.IsZero coefficients) :
+    derivativeValue point coefficients = 0 := by
+  induction coefficients with
+  | nil => rfl
+  | cons coefficient rest ih =>
+    obtain ⟨_, tailZero⟩ := (Polynomial.isZero_cons _ _).mp zero
+    rw [derivativeValue, Polynomial.horner_zero point tailZero, ih tailZero]
+    grind
+
+theorem derivative_neg (point : R) (coefficients : List R) :
+    derivativeValue point (coefficients.map (0 - ·)) = 0 - derivativeValue point coefficients := by
+  induction coefficients with
+  | nil => change (0 : R) = 0 - 0; grind
+  | cons first rest ih =>
+    simp only [List.map_cons, derivativeValue, Polynomial.horner_neg, ih]
+    grind
+
+theorem derivative_sub (point : R) (left right : List R) :
+    derivativeValue point (Polynomial.sub left right) = derivativeValue point left - derivativeValue point right := by
+  induction left generalizing right with
+  | nil => rw [Polynomial.sub, derivative_neg, derivativeValue]
+  | cons first left ih =>
+    cases right with
+    | nil => rw [Polynomial.sub_nil, derivativeValue]; grind
+    | cons second right =>
+      rw [Polynomial.sub, derivativeValue, Polynomial.horner_sub, ih, derivativeValue, derivativeValue]
+      grind
+
+theorem divide_diagonal (point : R) (coefficients : List R) :
+    horner point (Polynomial.divide point coefficients) = derivativeValue point coefficients := by
+  induction coefficients using Polynomial.divide.induct with
+  | case1 => rfl
+  | case2 first => simp only [Polynomial.divide, horner_nil, derivativeValue]; grind
+  | case3 first next rest ih =>
+    change horner point (next :: rest) + point * horner point (Polynomial.divide point (next :: rest)) =
+      horner point (next :: rest) + point * derivativeValue point (next :: rest)
+    rw [ih]
+
+theorem monomial_value (point : R) (degree : Nat) :
+    horner point (List.replicate degree 0 ++ [1]) = point ^ degree := by
+  rw [Quotient.horner_append, Polynomial.horner_replicate_zero, List.length_replicate]
+  simp only [horner_cons, horner_nil]
+  grind
+
+theorem monomial_derivative (point : R) (degree : Nat) :
+    derivativeValue point (List.replicate degree 0 ++ [1]) = (degree : R) * point ^ (degree - 1) := by
+  induction degree with
+  | zero =>
+    simp only [List.replicate_zero, List.nil_append, derivativeValue, horner_nil, Semiring.natCast_zero]
+    grind
+  | succ degree ih =>
+    rw [List.replicate_succ, List.cons_append, derivativeValue, monomial_value, ih, Semiring.natCast_succ]
+    cases degree with
+    | zero => simp only [Nat.zero_sub, Nat.add_sub_cancel, Semiring.pow_zero, Semiring.natCast_zero]; grind
+    | succ degree => simp only [Nat.add_sub_cancel, Semiring.pow_succ]; grind
+
+theorem powerMinus_derivative (point constant : R) (degree : Nat) :
+    derivativeValue point (Polynomial.powerMinus degree constant) = (degree : R) * point ^ (degree - 1) := by
+  rw [Polynomial.powerMinus, derivative_sub, monomial_derivative]
+  simp only [derivativeValue, horner_nil]
+  grind
+
+theorem root_product_derivative (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+    (roots : List R) (constant : R) (unique : roots.Nodup) (positive : 0 < roots.length)
+    (powers : ∀ root ∈ roots, root ^ roots.length = constant) (point : R) :
+    derivativeValue point (Polynomial.fromRoots roots) = (roots.length : R) * point ^ (roots.length - 1) := by
+  have zero : Polynomial.IsZero (Polynomial.sub (Polynomial.fromRoots roots) (Polynomial.powerMinus roots.length constant)) := by
+    apply Polynomial.monic_zero_sub_of_samples noZeroDivisors _ _ roots
+      (Polynomial.fromRoots_monic roots) (Polynomial.powerMinus_monic positive constant) unique
+    · rw [Polynomial.fromRoots_length, Polynomial.powerMinus_length]
+    · rw [Polynomial.fromRoots_length]
+      omega
+    · intro root member
+      rw [Polynomial.fromRoots_vanishes roots root member, Polynomial.horner_powerMinus, powers root member]
+      grind
+  have difference := derivative_zero point zero
+  rw [derivative_sub, powerMinus_derivative] at difference
+  exact (LogUp.sub_zero_iff _ _).mp difference
+
+theorem root_quotient_diagonal (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+    (roots : List R) (constant : R) (unique : roots.Nodup) (positive : 0 < roots.length)
+    (powers : ∀ root ∈ roots, root ^ roots.length = constant) (point : R) :
+    horner point (Polynomial.divide point (Polynomial.fromRoots roots)) =
+      (roots.length : R) * point ^ (roots.length - 1) := by
+  rw [divide_diagonal, root_product_derivative noZeroDivisors roots constant unique positive powers]
+
+theorem closed_weight_diagonal (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+    (roots : List R) (constant scale root : R) (unique : roots.Nodup) (positive : 0 < roots.length)
+    (powers : ∀ root ∈ roots, root ^ roots.length = constant) (member : root ∈ roots)
+    (inverts : (roots.length : R) * constant * scale = 1) :
+    (root * scale) * horner root (Polynomial.divide root (Polynomial.fromRoots roots)) = 1 := by
+  rw [root_quotient_diagonal noZeroDivisors roots constant unique positive powers]
+  have power : root ^ (roots.length - 1) * root = constant := by
+    rw [← Semiring.pow_succ, Nat.sub_add_cancel (by omega)]
+    exact powers root member
+  grind
+
+theorem combine_length (vanishing : List R) (scale : R) (samples : List (R × R)) :
+    (combine vanishing scale samples).length ≤ vanishing.length - 1 := by
+  induction samples with
+  | nil => exact Nat.zero_le _
+  | cons sample samples ih =>
+    rw [combine, Polynomial.add_length, Polynomial.scale_length, Polynomial.divide_length]
+    exact Nat.max_le.mpr ⟨Nat.le_refl _, ih⟩
+
+theorem coefficients_length (samples : List (R × R)) (scale : R) :
+    (coefficients samples scale).length ≤ samples.length := by
+  have bounded := combine_length (Polynomial.fromRoots (samples.map Prod.fst)) scale samples
+  simpa only [coefficients, Polynomial.fromRoots_length, Nat.add_sub_cancel, List.length_map] using bounded
+
+theorem combine_zero (vanishing : List R) (scale point : R) (samples : List (R × R))
+    (zero : ∀ sample ∈ samples, horner point (Polynomial.divide sample.1 vanishing) = 0) :
+    horner point (combine vanishing scale samples) = 0 := by
+  induction samples with
+  | nil => rfl
+  | cons sample samples ih =>
+    rw [combine, Polynomial.horner_add, Polynomial.horner_scale,
+      zero sample List.mem_cons_self, ih (fun value member => zero value (List.mem_cons_of_mem _ member))]
+    grind
+
+theorem combine_at_node (vanishing : List R) (scale root value : R) (samples : List (R × R))
+    (unique : (samples.map Prod.fst).Nodup) (member : (root, value) ∈ samples)
+    (diagonal : (root * scale) * horner root (Polynomial.divide root vanishing) = 1)
+    (offDiagonal : ∀ sample ∈ samples, sample.1 ≠ root → horner root (Polynomial.divide sample.1 vanishing) = 0) :
+    horner root (combine vanishing scale samples) = value := by
+  induction samples with
+  | nil => cases member
+  | cons sample samples ih =>
+    obtain ⟨absent, tailUnique⟩ := List.nodup_cons.mp unique
+    rw [combine, Polynomial.horner_add, Polynomial.horner_scale]
+    rcases List.mem_cons.mp member with same | later
+    · subst sample
+      have tailZero : horner root (combine vanishing scale samples) = 0 := by
+        apply combine_zero
+        intro sample member
+        apply offDiagonal sample (List.mem_cons_of_mem _ member)
+        intro equal
+        exact absent (List.mem_map.mpr ⟨sample, member, equal⟩)
+      rw [tailZero]
+      grind
+    · have different : sample.1 ≠ root := by
+        intro same
+        exact absent (List.mem_map.mpr ⟨(root, value), later, same.symm⟩)
+      rw [offDiagonal sample List.mem_cons_self different,
+        ih tailUnique later (fun item member => offDiagonal item (List.mem_cons_of_mem _ member))]
+      grind
+
+theorem coefficients_at_node (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+    (samples : List (R × R)) (constant scale root value : R)
+    (unique : (samples.map Prod.fst).Nodup) (positive : 0 < samples.length)
+    (powers : ∀ sample ∈ samples, sample.1 ^ samples.length = constant)
+    (inverts : (samples.length : R) * constant * scale = 1) (member : (root, value) ∈ samples) :
+    horner root (coefficients samples scale) = value := by
+  have rootMember : root ∈ samples.map Prod.fst := List.mem_map.mpr ⟨(root, value), member, rfl⟩
+  apply combine_at_node _ scale root value samples unique member
+  · apply closed_weight_diagonal noZeroDivisors (samples.map Prod.fst) constant scale root unique
+      (by simpa only [List.length_map] using positive) _ rootMember
+      (by simpa only [List.length_map] using inverts)
+    intro node nodeMember
+    obtain ⟨sample, sampleMember, rfl⟩ := List.mem_map.mp nodeMember
+    simpa only [List.length_map] using powers sample sampleMember
+  · intro sample sampleMember different
+    apply Polynomial.divide_root noZeroDivisors sample.1 root _
+      (Polynomial.fromRoots_vanishes _ _ (List.mem_map.mpr ⟨sample, sampleMember, rfl⟩))
+      (Polynomial.fromRoots_vanishes _ _ rootMember)
+    exact Ne.symm different
+
+theorem coefficients_unique (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+    (samples : List (R × R)) (constant scale : R) (candidate : List R)
+    (unique : (samples.map Prod.fst).Nodup) (positive : 0 < samples.length)
+    (powers : ∀ sample ∈ samples, sample.1 ^ samples.length = constant)
+    (inverts : (samples.length : R) * constant * scale = 1)
+    (bounded : candidate.length ≤ samples.length)
+    (agrees : ∀ sample ∈ samples, horner sample.1 candidate = sample.2) :
+    Polynomial.IsZero (Polynomial.sub candidate (coefficients samples scale)) := by
+  apply Polynomial.zero_sub_of_samples noZeroDivisors candidate (coefficients samples scale)
+    (samples.map Prod.fst) unique
+  · simpa only [List.length_map] using bounded
+  · simpa only [List.length_map] using coefficients_length samples scale
+  · intro root member
+    obtain ⟨sample, sampleMember, rfl⟩ := List.mem_map.mp member
+    rw [agrees sample sampleMember]
+    exact (coefficients_at_node noZeroDivisors samples constant scale sample.1 sample.2
+      unique positive powers inverts sampleMember).symm
+
+theorem coefficients_evaluate (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+    (samples : List (R × R)) (constant scale : R) (candidate : List R)
+    (unique : (samples.map Prod.fst).Nodup) (positive : 0 < samples.length)
+    (powers : ∀ sample ∈ samples, sample.1 ^ samples.length = constant)
+    (inverts : (samples.length : R) * constant * scale = 1)
+    (bounded : candidate.length ≤ samples.length)
+    (agrees : ∀ sample ∈ samples, horner sample.1 candidate = sample.2) (point : R) :
+    horner point (coefficients samples scale) = horner point candidate := by
+  have zero := Polynomial.horner_zero point (coefficients_unique noZeroDivisors samples constant scale candidate
+    unique positive powers inverts bounded agrees)
+  rw [Polynomial.horner_sub] at zero
+  exact ((LogUp.sub_zero_iff _ _).mp zero).symm
+
+theorem divide_inverse_value (vanishing : List R) (point root inverse : R)
+    (vanishes : horner root vanishing = 0) (inverts : (point - root) * inverse = 1) :
+    inverse * horner point vanishing = horner point (Polynomial.divide root vanishing) := by
+  have factor := Polynomial.divide_factor point root vanishing
+  rw [vanishes] at factor
+  calc
+    inverse * horner point vanishing = inverse * ((point - root) * horner point (Polynomial.divide root vanishing)) := by
+      rw [factor]
+      grind
+    _ = horner point (Polynomial.divide root vanishing) := by grind
+
+open ProofCodec (Extension)
+
+theorem weightedSum_polynomial (vanishing : List Extension) (scale point : Extension)
+    (samples : List (Extension × Extension))
+    (roots : ∀ sample ∈ samples, horner sample.1 vanishing = 0)
+    (away : ∀ sample ∈ samples, point ≠ sample.1) :
+    ∃ result, weightedSum scale point samples = some result ∧
+      result * horner point vanishing = horner point (combine vanishing scale samples) := by
+  induction samples with
+  | nil => exact ⟨0, rfl, by change 0 * horner point vanishing = 0; grind⟩
+  | cons sample samples ih =>
+    have nonzero : point - sample.1 ≠ 0 := fun zero =>
+      away sample List.mem_cons_self ((LogUp.sub_zero_iff _ _).mp zero)
+    obtain ⟨returned, inverse⟩ := Extension.inverse_correct (point - sample.1) nonzero
+    obtain ⟨tail, tailRead, tailValue⟩ := ih
+      (fun entry member => roots entry (List.mem_cons_of_mem _ member))
+      (fun entry member => away entry (List.mem_cons_of_mem _ member))
+    refine ⟨sample.2 * (sample.1 * scale) * (point - sample.1).conjugate.scale (point - sample.1).norm.inverse + tail, ?_, ?_⟩
+    · simp only [weightedSum, returned, tailRead, bind, Option.bind_some, pure]
+    · have head := divide_inverse_value vanishing point sample.1 _ (roots sample List.mem_cons_self) inverse
+      rw [combine, Polynomial.horner_add, Polynomial.horner_scale]
+      rw [Semiring.right_distrib, Semiring.mul_assoc, head, tailValue]
+
+theorem evaluate_polynomial (samples : List (Extension × Extension)) (constant scale point : Extension)
+    (unique : (samples.map Prod.fst).Nodup) (positive : 0 < samples.length)
+    (powers : ∀ sample ∈ samples, sample.1 ^ samples.length = constant)
+    (inverts : (samples.length : Extension) * constant * scale = 1) :
+    evaluate scale point samples = some (horner point (coefficients samples scale)) := by
+  unfold evaluate
+  split
+  next sample found =>
+    have member := List.mem_of_find?_eq_some found
+    have test : (point == sample.1) = true :=
+      List.find?_some (p := fun entry : Extension × Extension => point == entry.1) found
+    have same : point = sample.1 := beq_iff_eq.mp test
+    rw [same, coefficients_at_node (fun a b => (Extension.mul_eq_zero_iff a b).mp)
+      samples constant scale sample.1 sample.2 unique positive powers inverts member]
+  next missing =>
+    have away : ∀ sample ∈ samples, point ≠ sample.1 := by
+      intro sample member same
+      have absent := List.find?_eq_none.mp missing sample member
+      simp only [same, beq_self_eq_true] at absent
+      contradiction
+    obtain ⟨result, returned, correct⟩ := weightedSum_polynomial
+      (Polynomial.fromRoots (samples.map Prod.fst)) scale point samples
+      (fun sample member => Polynomial.fromRoots_vanishes _ _ (List.mem_map.mpr ⟨sample, member, rfl⟩)) away
+    simp only [returned, bind, Option.bind_some, pure]
+    rw [Polynomial.horner_fromRoots] at correct
+    simpa only [coefficients, List.map_map, Function.comp_def] using congrArg some correct
+
+theorem foldSamples_roots (parent arity : Domain.Subgroup) (index : Nat) (values : List Extension)
+    (shape : values.length = Domain.size arity) :
+    (foldSamples parent arity index values).map Prod.fst =
+      (Polynomial.foldingNodes parent arity index).map Extension.ofBase := by
+  apply List.map_fst_zip
+  simp only [List.length_map, Polynomial.foldingNodes_length, shape, Nat.le_refl]
+
+theorem foldSamples_length (parent arity : Domain.Subgroup) (index : Nat) (values : List Extension)
+    (shape : values.length = Domain.size arity) :
+    (foldSamples parent arity index values).length = Domain.size arity := by
+  have length := congrArg List.length (foldSamples_roots parent arity index values shape)
+  simpa only [List.length_map, Polynomial.foldingNodes_length] using length
+
+theorem foldSamples_nodup (parent arity : Domain.Subgroup) (nested : arity.val ≤ parent.val)
+    {index : Nat} (bounded : index < 2^(parent.val - arity.val)) (values : List Extension)
+    (shape : values.length = Domain.size arity) : (foldSamples parent arity index values |>.map Prod.fst).Nodup := by
+  rw [foldSamples_roots parent arity index values shape, List.nodup_iff_pairwise_ne, List.pairwise_map]
+  exact (Polynomial.foldingNodes_nodup parent arity nested bounded).imp
+    (fun different equal => different (Extension.ofBase_injective equal))
+
+theorem foldSamples_powers (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) (index : Nat) (values : List Extension)
+    (shape : values.length = Domain.size arity) : ∀ sample ∈ foldSamples parent arity index values,
+    sample.1 ^ (foldSamples parent arity index values).length = Extension.ofBase (FriDomain.queryPoint child index) := by
+  intro sample member
+  have rootMember : sample.1 ∈ (foldSamples parent arity index values).map Prod.fst :=
+    List.mem_map.mpr ⟨sample, member, rfl⟩
+  rw [foldSamples_roots parent arity index values shape] at rootMember
+  obtain ⟨node, nodeMember, same⟩ := List.mem_map.mp rootMember
+  rw [foldSamples_length parent arity index values shape, ← same, ← Extension.ofBase_power,
+    Polynomial.foldingNodes_powers parent child arity dimensions index node nodeMember]
+
+theorem foldScale_inverse (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) (index : Nat) :
+    (Domain.size arity : Extension) * Extension.ofBase (FriDomain.queryPoint child index) *
+      Extension.ofBase (foldScale parent arity index) = 1 := by
+  have nonzero : G.ofNat (Domain.size arity) * FriDomain.queryPoint child index ≠ 0 := by
+    intro zero
+    exact ((G.mul_eq_zero_iff _ _).mp zero).elim
+      (G.ofNat_ne_zero_of_lt (Domain.size_positive arity) (Domain.size_lt_characteristic arity))
+      (FriDomain.queryPoint_nonzero child index)
+  unfold foldScale
+  rw [G.pow_eq _ _ (Domain.size_lt_u64 arity), FriDomain.foldNode_power parent child arity dimensions]
+  change Extension.ofBase (G.ofNat (Domain.size arity)) * Extension.ofBase (FriDomain.queryPoint child index) *
+    Extension.ofBase (G.ofNat (Domain.size arity) * FriDomain.queryPoint child index).inverse = Extension.ofBase 1
+  rw [← Extension.ofBase_mul, ← Extension.ofBase_mul, G.mul_inverse_cancel _ nonzero]
+
+theorem foldRow_polynomial (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (values : List Extension)
+    (shape : values.length = Domain.size arity) (point : Extension) :
+    foldRow parent arity index values point = some (horner point
+      (coefficients (foldSamples parent arity index values) (Extension.ofBase (foldScale parent arity index)))) := by
+  have nested : arity.val ≤ parent.val := by omega
+  have length := foldSamples_length parent arity index values shape
+  simp only [foldRow, gt_iff_lt, decide_eq_true_eq, Bool.or_eq_true, bne_iff_ne, _root_.or_assoc,
+    if_neg (by omega : ¬(parent.val < arity.val ∨ 2^(parent.val - arity.val) ≤ index ∨ values.length ≠ Domain.size arity))]
+  apply evaluate_polynomial _ (Extension.ofBase (FriDomain.queryPoint child index))
+  · exact foldSamples_nodup parent arity nested bounded values shape
+  · rw [length]; exact Domain.size_positive arity
+  · exact foldSamples_powers parent child arity dimensions index values shape
+  · rw [length]; exact foldScale_inverse parent child arity dimensions index
+
+theorem foldRow_reject_shape (parent arity : Domain.Subgroup) (index : Nat) (values : List Extension)
+    (point : Extension) (malformed : arity.val > parent.val ∨ index ≥ 2^(parent.val - arity.val) ∨ values.length ≠ Domain.size arity) :
+    foldRow parent arity index values point = none := by
+  simp only [foldRow, decide_eq_true_eq, Bool.or_eq_true, bne_iff_ne, _root_.or_assoc, if_pos malformed]
+
+theorem foldRow_at_node (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (values : List Extension)
+    (shape : values.length = Domain.size arity) (root value : Extension)
+    (member : (root, value) ∈ foldSamples parent arity index values) :
+    foldRow parent arity index values root = some value := by
+  rw [foldRow_polynomial parent child arity dimensions bounded values shape]
+  congr 1
+  apply coefficients_at_node (fun a b => (Extension.mul_eq_zero_iff a b).mp)
+    _ (Extension.ofBase (FriDomain.queryPoint child index)) _ root value _ _ _ _ member
+  · exact foldSamples_nodup parent arity (by omega) bounded values shape
+  · rw [foldSamples_length parent arity index values shape]; exact Domain.size_positive arity
+  · exact foldSamples_powers parent child arity dimensions index values shape
+  · rw [foldSamples_length parent arity index values shape]; exact foldScale_inverse parent child arity dimensions index
+
+theorem foldRow_evaluate (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (values candidate : List Extension)
+    (shape : values.length = Domain.size arity) (degree : candidate.length ≤ Domain.size arity)
+    (agrees : ∀ sample ∈ foldSamples parent arity index values, horner sample.1 candidate = sample.2)
+    (point : Extension) : foldRow parent arity index values point = some (horner point candidate) := by
+  rw [foldRow_polynomial parent child arity dimensions bounded values shape]
+  congr 1
+  apply coefficients_evaluate (fun a b => (Extension.mul_eq_zero_iff a b).mp)
+    _ (Extension.ofBase (FriDomain.queryPoint child index)) _ candidate
+  · exact foldSamples_nodup parent arity (by omega) bounded values shape
+  · rw [foldSamples_length parent arity index values shape]; exact Domain.size_positive arity
+  · exact foldSamples_powers parent child arity dimensions index values shape
+  · rw [foldSamples_length parent arity index values shape]; exact foldScale_inverse parent child arity dimensions index
+  · rwa [foldSamples_length parent arity index values shape]
+  · exact agrees
+
+theorem foldRow_success {parent arity : Domain.Subgroup} {index : Nat} {values : List Extension}
+    {point result : Extension} (accepted : foldRow parent arity index values point = some result) :
+    arity.val ≤ parent.val ∧ index < 2^(parent.val - arity.val) ∧ values.length = Domain.size arity ∧
+      ∃ candidate : List Extension, candidate.length ≤ Domain.size arity ∧
+        (∀ sample ∈ foldSamples parent arity index values, horner sample.1 candidate = sample.2) ∧
+        result = horner point candidate := by
+  have wellFormed : ¬(arity.val > parent.val ∨ index ≥ 2^(parent.val - arity.val) ∨ values.length ≠ Domain.size arity) := by
+    intro malformed
+    rw [foldRow_reject_shape parent arity index values point malformed] at accepted
+    cases accepted
+  have nested : arity.val ≤ parent.val := by omega
+  have bounded : index < 2^(parent.val - arity.val) := by omega
+  have shape : values.length = Domain.size arity := by omega
+  let child : Domain.Subgroup := ⟨parent.val - arity.val, by have := parent.isLt; omega⟩
+  have dimensions : parent.val = child.val + arity.val := by change parent.val = parent.val - arity.val + arity.val; omega
+  refine ⟨nested, bounded, shape,
+    coefficients (foldSamples parent arity index values) (Extension.ofBase (foldScale parent arity index)), ?_, ?_, ?_⟩
+  · have length := coefficients_length (foldSamples parent arity index values) (Extension.ofBase (foldScale parent arity index))
+    rwa [foldSamples_length parent arity index values shape] at length
+  · intro sample member
+    have atNode := foldRow_at_node parent child arity dimensions bounded values shape sample.1 sample.2 member
+    rw [foldRow_polynomial parent child arity dimensions bounded values shape] at atNode
+    exact Option.some.inj atNode
+  · rw [foldRow_polynomial parent child arity dimensions bounded values shape] at accepted
+    exact (Option.some.inj accepted).symm
+
+end Aiur.NativeAIR.Interpolation
diff --git a/Ix/Aiur/Proofs/KeyArtifact.lean b/Ix/Aiur/Proofs/KeyArtifact.lean
new file mode 100644
index 000000000..5c1404af7
--- /dev/null
+++ b/Ix/Aiur/Proofs/KeyArtifact.lean
@@ -0,0 +1,63 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.BoundVerifier
+import Ix.Aiur.Proofs.KeyCodec
+
+/-! The backend's selected native key has a checked canonical v5 meaning.
+This establishes byte interpretation and decoded graph evaluation. Equality
+with the compiler's graph, native verifier execution and cryptographic
+acceptance-to-satisfaction are separate obligations. -/
+
+namespace Aiur.BoundVerifier
+open NativeAIR
+
+theorem Backend.key_decodes {selection : Selection} (backend : Backend selection) :
+    KeyCodec.decode selection.key = some backend.keyData :=
+  (KeyCodec.decodeCanonical_success backend.keyDecoded).1
+
+theorem Backend.native_key_decodes {selection : Selection} (backend : Backend selection) :
+    KeyCodec.decodeCanonical backend.system.vkBytes = some backend.keyData := by
+  rw [backend.keyBound]
+  exact backend.keyDecoded
+
+theorem Backend.native_key_encoding {selection : Selection} (backend : Backend selection) :
+    KeyCodec.encode backend.keyData = backend.system.vkBytes := by
+  rw [backend.keyBound]
+  exact (KeyCodec.decodeCanonical_success backend.keyDecoded).2
+
+theorem Backend.key_commitment {selection : Selection} (backend : Backend selection) :
+    KeyCodec.CommitmentValid backend.keyData.preprocessedCommitment :=
+  KeyCodec.decode_commitment backend.key_decodes
+
+theorem Backend.key_graph_valid {selection : Selection} (backend : Backend selection)
+    {circuit : KeyCodec.Circuit} (member : circuit ∈ backend.keyData.circuits) :
+    circuit.graph.Valid circuit.widths :=
+  (KeyCodec.Circuit.valid_graph ((KeyCodec.decode_valid backend.key_decodes).1 circuit member)).2.2.1
+
+theorem Backend.key_graph_reflects {selection : Selection} (backend : Backend selection)
+    {circuit : KeyCodec.Circuit} (member : circuit ∈ backend.keyData.circuits)
+    (ops : EvalOps W) (values : Values W) (fits : values.Fits circuit.widths) :
+    ∃ trees full lookupValues,
+      circuit.graph.unfold = some trees ∧ circuit.graph.sweep ops values = some full ∧
+      circuit.graph.sweepLookupPrefix ops values = some lookupValues ∧
+      trees.size = circuit.graph.nodes.length ∧ full.size = circuit.graph.nodes.length ∧
+      lookupValues.size = circuit.graph.lookupPrefix ∧ Reflects ops values trees full ∧
+      readNodes full circuit.graph.zeros = evalRoots ops values trees circuit.graph.zeros ∧
+      ∀ lookup ∈ circuit.graph.lookups,
+        readLookup lookupValues lookup = readLookup full lookup ∧
+        readLookup lookupValues lookup = evalLookup ops values trees lookup := by
+  have valid := backend.key_graph_valid member
+  obtain ⟨trees, unfolded, treesSize⟩ := valid.unfold_defined
+  obtain ⟨full, swept, fullSize⟩ := valid.sweep_defined ops values fits
+  obtain ⟨lookupValues, lookupSwept, lookupSize⟩ := valid.lookup_sweep_defined ops values fits
+  have reflected := circuit.graph.sweep_reflects ops values unfolded swept
+  refine ⟨trees, full, lookupValues, unfolded, swept, lookupSwept, treesSize, fullSize,
+    lookupSize, reflected, reflected.readNodes _, ?_⟩
+  intro lookup present
+  exact ⟨(valid.lookup_values_agree ops values swept lookupSwept lookupSize lookup present).symm,
+    valid.lookup_values_reflect ops values unfolded swept lookupSwept lookupSize lookup present⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/KeyCodec.lean b/Ix/Aiur/Proofs/KeyCodec.lean
new file mode 100644
index 000000000..249b0a137
--- /dev/null
+++ b/Ix/Aiur/Proofs/KeyCodec.lean
@@ -0,0 +1,462 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.KeyCodec
+
+/-! Exact v5 byte framing, canonical round trips and checked graph meaning. -/
+
+namespace Aiur.NativeAIR.KeyCodec
+
+def Reads (read : Reader α) (bytes : List UInt8) (value : α) : Prop :=
+  ∀ rest, read (bytes ++ rest) = some (value, rest)
+
+theorem Reads.pure (value : α) : Reads (pure value) [] value := by
+  intro rest
+  rfl
+
+theorem Reads.bind {read : Reader α} {next : α → Reader β}
+    {left right : List UInt8} {middle : α} {value : β}
+    (first : Reads read left middle) (second : Reads (next middle) right value) :
+    Reads (read >>= next) (left ++ right) value := by
+  intro rest
+  change (StateT.bind read next) _ = _
+  rw [List.append_assoc, StateT.bind, first (right ++ rest)]
+  exact second rest
+
+theorem Reads.map {read : Reader α} {bytes : List UInt8} {value : α}
+    (readValue : Reads read bytes value) (f : α → β) :
+    Reads (f <$> read) bytes (f value) := by
+  intro rest
+  change (StateT.map f read) _ = _
+  rw [StateT.map, readValue rest]
+  rfl
+
+theorem Reads.result {read : Reader α} {bytes : List UInt8} {value : α}
+    (readValue : Reads read bytes value) (f : α → β) :
+    Reads (do let value ← read; Pure.pure (f value)) bytes (f value) := by
+  intro rest
+  change (StateT.bind read _) _ = _
+  rw [StateT.bind, readValue rest]
+  rfl
+
+theorem readByte_reads (byte : UInt8) : Reads readByte [byte] byte := fun _ => rfl
+
+theorem Reads.byte {next : UInt8 → Reader α} {byte : UInt8} {bytes : List UInt8} {value : α}
+    (body : Reads (next byte) bytes value) : Reads (readByte >>= next) (byte :: bytes) value :=
+  (readByte_reads byte).bind body
+
+theorem encodeNat_length (count value : Nat) : (encodeNat count value).length = count := by
+  induction count generalizing value with
+  | zero => rfl
+  | succ count ih => simp only [encodeNat, List.length_cons, ih]
+
+theorem readNat_reads (count value : Nat) (bounded : value < 256^count) :
+    Reads (readNat count) (encodeNat count value) value := by
+  induction count generalizing value with
+  | zero =>
+    have zero : value = 0 := by simpa using bounded
+    subst value
+    exact Reads.pure 0
+  | succ count ih =>
+    have small : value / 256 < 256^count := by
+      apply (Nat.div_lt_iff_lt_mul (by decide : 0 < 256)).mpr
+      simpa only [Nat.pow_succ] using bounded
+    have rest := ih (value / 256) small
+    have number : value.toUInt8.toNat + 256 * (value / 256) = value := by
+      simp only [Nat.toUInt8_eq]
+      exact Nat.mod_add_div _ _
+    rw [readNat, encodeNat]
+    apply Reads.byte
+    simpa only [number] using rest.result (fun n => value.toUInt8.toNat + 256 * n)
+
+theorem readMany_reads {read : Reader α} (encode : α → List UInt8) (values : List α)
+    (elements : ∀ value ∈ values, Reads read (encode value) value) :
+    Reads (readMany read values.length) (values.flatMap encode) values := by
+  induction values with
+  | nil => exact Reads.pure []
+  | cons value values ih =>
+    have first := elements value List.mem_cons_self
+    have rest := ih (fun value member => elements value (List.mem_cons_of_mem _ member))
+    exact first.bind (rest.result (value :: ·))
+
+theorem readVector_reads {read : Reader α} (encode : α → List UInt8) (values : List α)
+    (bounded : values.length < 65536)
+    (elements : ∀ value ∈ values, Reads read (encode value) value) :
+    Reads (readVector read) (encodeVector encode values) values :=
+  (readNat_reads 2 values.length bounded).bind (readMany_reads encode values elements)
+
+def NodeWireFits : Node → Prop
+  | .konst _ | .isFirstRow | .isLastRow | .isTransition => True
+  | .var column => column.index < 65536
+  | .publicInput index => index < 256
+  | .add a b | .sub a b | .mul a b => a < 65536 ∧ b < 65536
+  | .neg child => child < 65536
+
+theorem readNode_reads (node : Node) (fits : NodeWireFits node) :
+    Reads readNode (encodeNode node) node := by
+  cases node with
+  | konst value =>
+    simp only [encodeNode]
+    split
+    next small =>
+      unfold readNode
+      apply Reads.byte
+      change Reads (do let n ← readNat 2; pure (Node.konst (G.ofNat n))) _ _
+      simpa only [Function.comp_apply, G.ofNat_n] using
+        (readNat_reads 2 value.n small).result (Node.konst ∘ G.ofNat)
+    next _ =>
+      have bounded : value.n < 256^8 := UInt64.toNat_lt value.val
+      unfold readNode
+      apply Reads.byte
+      change Reads (do let n ← readNat 8; pure (Node.konst (G.ofNat n))) _ _
+      simpa only [Function.comp_apply, G.ofNat_n] using
+        (readNat_reads 8 value.n bounded).result (Node.konst ∘ G.ofNat)
+  | publicInput index =>
+    unfold readNode encodeNode
+    apply Reads.byte
+    exact (readNat_reads 1 index fits).result Node.publicInput
+  | isFirstRow => intro rest; rfl
+  | isLastRow => intro rest; rfl
+  | isTransition => intro rest; rfl
+  | add a b | sub a b | mul a b =>
+    unfold readNode encodeNode
+    apply Reads.byte
+    apply Reads.bind (readNat_reads 2 a fits.1)
+    exact (readNat_reads 2 b fits.2).result _
+  | neg child =>
+    unfold readNode encodeNode
+    apply Reads.byte
+    exact (readNat_reads 2 child fits).result Node.neg
+  | var column =>
+    obtain ⟨source, offset, index⟩ := column
+    cases source <;> cases offset <;> unfold readNode encodeNode <;>
+      apply Reads.byte <;> exact (readNat_reads 2 index fits).result _
+
+structure LookupWireFits (lookup : Lookup) : Prop where
+  multiplicity : lookup.multiplicity < 65536
+  count : lookup.args.length < 65536
+  args : ∀ arg ∈ lookup.args, arg < 65536
+
+theorem readLookup_reads (lookup : Lookup) (fits : LookupWireFits lookup) :
+    Reads readLookup (encodeLookup lookup) lookup := by
+  unfold readLookup encodeLookup
+  apply Reads.bind (readNat_reads 2 lookup.multiplicity fits.multiplicity)
+  exact (readVector_reads (encodeNat 2) lookup.args fits.count
+    (fun arg member => readNat_reads 2 arg (fits.args arg member))).result _
+
+structure CircuitWireFits (circuit : Circuit) : Prop where
+  mainWidth : circuit.mainWidth < 65536
+  preprocessedWidth : circuit.preprocessedWidth < 65536
+  preprocessedHeight : circuit.preprocessedHeight < 2^32
+  maxConstraintDegree : circuit.maxConstraintDegree < 65536
+  lookupGroupSize : circuit.lookupGroupSize < 256
+  nodesCount : circuit.graph.nodes.length < 65536
+  nodes : ∀ node ∈ circuit.graph.nodes, NodeWireFits node
+  zerosCount : circuit.graph.zeros.length < 65536
+  zeros : ∀ index ∈ circuit.graph.zeros, index < 65536
+  lookupsCount : circuit.graph.lookups.length < 65536
+  lookups : ∀ lookup ∈ circuit.graph.lookups, LookupWireFits lookup
+
+theorem readCircuitData_reads (circuit : Circuit) (fits : CircuitWireFits circuit) :
+    Reads readCircuitData (encodeCircuit circuit) circuit := by
+  unfold readCircuitData encodeCircuit
+  simp only [List.append_assoc]
+  apply Reads.bind (readNat_reads 2 circuit.mainWidth fits.mainWidth)
+  apply Reads.bind (readNat_reads 2 circuit.preprocessedWidth fits.preprocessedWidth)
+  apply Reads.bind (readNat_reads 4 circuit.preprocessedHeight fits.preprocessedHeight)
+  apply Reads.bind (readNat_reads 2 circuit.maxConstraintDegree fits.maxConstraintDegree)
+  apply Reads.bind (readNat_reads 1 circuit.lookupGroupSize fits.lookupGroupSize)
+  apply Reads.bind (readVector_reads encodeNode circuit.graph.nodes fits.nodesCount
+    (fun node member => readNode_reads node (fits.nodes node member)))
+  apply Reads.bind (readVector_reads (encodeNat 2) circuit.graph.zeros fits.zerosCount
+    (fun index member => readNat_reads 2 index (fits.zeros index member)))
+  exact (readVector_reads encodeLookup circuit.graph.lookups fits.lookupsCount
+    (fun lookup member => readLookup_reads lookup (fits.lookups lookup member))).result _
+
+theorem readCircuit_reads (circuit : Circuit) (fits : CircuitWireFits circuit)
+    (valid : circuit.valid = true) : Reads readCircuit (encodeCircuit circuit) circuit := by
+  intro rest
+  simp only [readCircuit, bind, StateT.bind, readCircuitData_reads circuit fits rest,
+    Option.bind_some, valid, ite_true, pure, StateT.pure]
+
+def ParametersWireFits (parameters : Parameters) : Prop :=
+  ∀ value ∈ [parameters.logBlowup, parameters.capHeight, parameters.logFinalPolyLen,
+    parameters.maxLogArity, parameters.numQueries, parameters.commitProofOfWorkBits,
+    parameters.queryProofOfWorkBits], value < 65536
+
+theorem readParameters_reads (parameters : Parameters) (fits : ParametersWireFits parameters) :
+    Reads readParameters (encodeParameters parameters) parameters := by
+  unfold ParametersWireFits at fits
+  simp only [List.mem_cons, List.not_mem_nil, or_false, forall_eq_or_imp, forall_eq] at fits
+  unfold readParameters encodeParameters
+  simp only [List.flatMap_cons, List.flatMap_nil, List.append_nil]
+  apply Reads.bind (readNat_reads 2 parameters.logBlowup fits.1)
+  apply Reads.bind (readNat_reads 2 parameters.capHeight fits.2.1)
+  apply Reads.bind (readNat_reads 2 parameters.logFinalPolyLen fits.2.2.1)
+  apply Reads.bind (readNat_reads 2 parameters.maxLogArity fits.2.2.2.1)
+  apply Reads.bind (readNat_reads 2 parameters.numQueries fits.2.2.2.2.1)
+  apply Reads.bind (readNat_reads 2 parameters.commitProofOfWorkBits fits.2.2.2.2.2.1)
+  exact (readNat_reads 2 parameters.queryProofOfWorkBits fits.2.2.2.2.2.2).result _
+
+def CommitmentWireFits : Option MerkleCap → Prop
+  | none => True
+  | some cap => cap.length < 65536 ∧ cap.length.isPowerOfTwo ∧ ∀ digest ∈ cap, digest.length = 32
+
+theorem readCommitment_reads (commitment : Option MerkleCap) (fits : CommitmentWireFits commitment) :
+    Reads readCommitment (encodeCommitment commitment) commitment := by
+  cases commitment with
+  | none => intro rest; rfl
+  | some cap =>
+    unfold readCommitment encodeCommitment
+    apply Reads.byte
+    have body : Reads (readVector (readMany readByte 32)) (encodeVector id cap) cap := by
+      apply readVector_reads id cap fits.1
+      intro digest member
+      have bytes := readMany_reads (fun byte => [byte]) digest (fun byte _ => readByte_reads byte)
+      simpa only [fits.2.2 digest member, List.flatMap_singleton', id_eq] using bytes
+    intro rest
+    change (StateT.bind (readVector (readMany readByte 32)) _) _ = _
+    rw [StateT.bind, body rest]
+    simp only [bind, Option.bind_some, fits.2.1, ite_true, pure, StateT.pure]
+
+def IndexWireFits : Option Nat → Prop
+  | none => True
+  | some index => index < 65535
+
+theorem readIndex_reads (index : Option Nat) (fits : IndexWireFits index) :
+    Reads readIndex (encodeIndex index) index := by
+  unfold readIndex encodeIndex
+  have bounded : index.getD 65535 < 65536 := by
+    cases index <;> simp only [IndexWireFits, Option.getD] at fits ⊢ <;> omega
+  have equal : (if index.getD 65535 = 65535 then none else some (index.getD 65535)) = index := by
+    cases index <;> simp only [IndexWireFits, Option.getD] at fits ⊢
+    · rfl
+    · rw [if_neg (by omega)]
+  simpa only [equal] using
+    (readNat_reads 2 (index.getD 65535) bounded).result (fun n => if n = 65535 then none else some n)
+
+structure KeyWireFits (key : Key) : Prop where
+  parameters : ParametersWireFits key.parameters
+  circuitCount : key.circuits.length < 65536
+  circuits : ∀ circuit ∈ key.circuits, CircuitWireFits circuit
+  commitment : CommitmentWireFits key.preprocessedCommitment
+  indexCount : key.preprocessedIndices.length = key.circuits.length
+  indices : ∀ index ∈ key.preprocessedIndices, IndexWireFits index
+
+theorem readKey_reads (key : Key) (fits : KeyWireFits key)
+    (valid : ∀ circuit ∈ key.circuits, circuit.valid = true) :
+    Reads readKey (encodeKey key) key := by
+  unfold readKey encodeKey
+  simp only [List.append_assoc]
+  apply Reads.bind (readParameters_reads key.parameters fits.parameters)
+  apply Reads.bind (readVector_reads encodeCircuit key.circuits fits.circuitCount
+    (fun circuit member => readCircuit_reads circuit (fits.circuits circuit member) (valid circuit member)))
+  apply Reads.bind (readCommitment_reads key.preprocessedCommitment fits.commitment)
+  rw [← fits.indexCount]
+  exact (readMany_reads encodeIndex key.preprocessedIndices
+    (fun index member => readIndex_reads index (fits.indices index member))).result _
+
+theorem decode_encode (key : Key) (fits : KeyWireFits key)
+    (valid : ∀ circuit ∈ key.circuits, circuit.valid = true) : decode (encode key) = some key := by
+  have read := readKey_reads key fits valid []
+  simp only [List.append_nil] at read
+  simp only [decode, encode, List.toList_data_toByteArray, read,
+    bind, Option.bind_some, List.isEmpty_nil, ite_true]
+
+theorem decodeCanonical_success {bytes : ByteArray} {key : Key}
+    (accepted : decodeCanonical bytes = some key) : decode bytes = some key ∧ encode key = bytes := by
+  unfold decodeCanonical at accepted
+  cases parsed : decode bytes with
+  | none => simp [parsed, bind, Option.bind] at accepted
+  | some result =>
+    simp only [parsed, bind, Option.bind_some] at accepted
+    split at accepted
+    next encoded => cases accepted; exact ⟨rfl, encoded⟩
+    next => cases accepted
+
+theorem decodeCanonical_encode (key : Key) (fits : KeyWireFits key)
+    (valid : ∀ circuit ∈ key.circuits, circuit.valid = true) :
+    decodeCanonical (encode key) = some key := by
+  simp only [decodeCanonical, decode_encode key fits valid, bind, Option.bind_some, ite_true]
+
+theorem canonical_bytes_unique {first second : ByteArray} {key : Key}
+    (left : decodeCanonical first = some key) (right : decodeCanonical second = some key) : first = second :=
+  (decodeCanonical_success left).2.symm.trans (decodeCanonical_success right).2
+
+theorem encode_injective {first second : Key} (leftFits : KeyWireFits first) (rightFits : KeyWireFits second)
+    (leftValid : ∀ circuit ∈ first.circuits, circuit.valid = true)
+    (rightValid : ∀ circuit ∈ second.circuits, circuit.valid = true)
+    (equal : encode first = encode second) : first = second := by
+  have decoded := congrArg decode equal
+  rw [decode_encode first leftFits leftValid, decode_encode second rightFits rightValid] at decoded
+  exact Option.some.inj decoded
+
+def Returns (read : Reader α) (property : α → Prop) : Prop :=
+  ∀ bytes value rest, read bytes = some (value, rest) → property value
+
+theorem Returns.pure {value : α} {property : α → Prop} (valid : property value) :
+    Returns (Pure.pure value) property := by
+  intro bytes result rest parsed
+  cases parsed
+  exact valid
+
+theorem Returns.failure (property : α → Prop) : Returns failure property := by
+  intro bytes value rest parsed
+  cases parsed
+
+theorem Returns.bind {read : Reader α} {next : α → Reader β} {left : α → Prop} {right : β → Prop}
+    (first : Returns read left) (second : ∀ value, left value → Returns (next value) right) :
+    Returns (read >>= next) right := by
+  intro bytes value rest parsed
+  change (StateT.bind read next) bytes = _ at parsed
+  cases readFirst : read bytes with
+  | none => simp [StateT.bind, readFirst] at parsed
+  | some pair =>
+    obtain ⟨middle, unread⟩ := pair
+    rw [StateT.bind, readFirst] at parsed
+    change next middle unread = some (value, rest) at parsed
+    exact second middle (first bytes middle unread readFirst) unread value rest parsed
+
+theorem Returns.bind_any {read : Reader α} {next : α → Reader β} {property : β → Prop}
+    (body : ∀ value, Returns (next value) property) : Returns (read >>= next) property :=
+  Returns.bind (fun _ _ _ _ => True.intro) (fun value _ => body value)
+
+theorem Returns.weaken {read : Reader α} {left right : α → Prop}
+    (valid : Returns read left) (weaken : ∀ value, left value → right value) : Returns read right :=
+  fun bytes value rest parsed => weaken value (valid bytes value rest parsed)
+
+theorem Returns.result {read : Reader α} {left : α → Prop} {right : β → Prop}
+    (valid : Returns read left) (f : α → β) (preserves : ∀ value, left value → right (f value)) :
+    Returns (do let value ← read; Pure.pure (f value)) right :=
+  Returns.bind valid (fun value known => Returns.pure (preserves value known))
+
+theorem readMany_returns {read : Reader α} {property : α → Prop} (valid : Returns read property) (count : Nat) :
+    Returns (readMany read count) (fun values => values.length = count ∧ ∀ value ∈ values, property value) := by
+  induction count with
+  | zero => exact Returns.pure ⟨rfl, by simp⟩
+  | succ count ih =>
+    refine Returns.bind (right := fun values : List α =>
+      values.length = count + 1 ∧ ∀ value ∈ values, property value) valid ?_
+    intro value first
+    refine Returns.result (right := fun values : List α =>
+      values.length = count + 1 ∧ ∀ value ∈ values, property value) ih (value :: ·) ?_
+    intro values rest
+    exact ⟨by simp only [List.length_cons, rest.1], fun entry member => by
+      rcases List.mem_cons.mp member with rfl | member
+      · exact first
+      · exact rest.2 entry member⟩
+
+theorem readVector_returns {read : Reader α} {property : α → Prop} (valid : Returns read property) :
+    Returns (readVector read) (fun values => ∀ value ∈ values, property value) :=
+  Returns.bind_any (fun count => (readMany_returns valid count).weaken (fun _ known => known.2))
+
+theorem readCircuit_returns : Returns readCircuit (fun circuit => circuit.valid = true) := by
+  unfold readCircuit
+  apply Returns.bind_any
+  intro circuit
+  split
+  next valid => exact Returns.pure valid
+  next => exact Returns.failure _
+
+def CommitmentValid : Option MerkleCap → Prop
+  | none => True
+  | some cap => cap.length.isPowerOfTwo ∧ ∀ digest ∈ cap, digest.length = 32
+
+theorem readCommitment_returns : Returns readCommitment CommitmentValid := by
+  unfold readCommitment
+  refine Returns.bind_any (property := CommitmentValid) ?_
+  intro byte
+  split
+  · exact Returns.pure True.intro
+  · refine Returns.bind (right := CommitmentValid)
+      (readVector_returns ((readMany_returns (read := readByte) (property := fun _ => True)
+        (fun _ _ _ _ => True.intro) 32).weaken (fun _ known => known.1))) ?_
+    intro cap digests
+    split
+    next power => exact Returns.pure ⟨power, digests⟩
+    next => exact Returns.failure _
+  · exact Returns.failure _
+
+theorem readKey_returns : Returns readKey (fun key =>
+    (∀ circuit ∈ key.circuits, circuit.valid = true) ∧ key.preprocessedIndices.length = key.circuits.length) := by
+  unfold readKey
+  refine Returns.bind_any (read := readParameters) (property := fun key : Key =>
+    (∀ circuit ∈ key.circuits, circuit.valid = true) ∧ key.preprocessedIndices.length = key.circuits.length) ?_
+  intro parameters
+  refine Returns.bind (right := fun key : Key =>
+    (∀ circuit ∈ key.circuits, circuit.valid = true) ∧ key.preprocessedIndices.length = key.circuits.length)
+    (readVector_returns readCircuit_returns) ?_
+  intro circuits valid
+  refine Returns.bind_any (read := readCommitment) (property := fun key : Key =>
+    (∀ circuit ∈ key.circuits, circuit.valid = true) ∧ key.preprocessedIndices.length = key.circuits.length) ?_
+  intro commitment
+  apply Returns.result (right := fun key : Key =>
+    (∀ circuit ∈ key.circuits, circuit.valid = true) ∧ key.preprocessedIndices.length = key.circuits.length)
+    (readMany_returns (read := readIndex) (property := fun _ => True)
+    (fun _ _ _ _ => True.intro) circuits.length)
+    (fun indices => Key.mk parameters circuits commitment indices)
+  intro indices known
+  exact ⟨valid, known.1⟩
+
+theorem decode_success {bytes : ByteArray} {key : Key} (parsed : decode bytes = some key) :
+    readKey bytes.data.toList = some (key, []) := by
+  unfold decode at parsed
+  cases read : readKey bytes.data.toList with
+  | none => simp [read, bind, Option.bind] at parsed
+  | some pair =>
+    obtain ⟨result, rest⟩ := pair
+    simp only [read, bind, Option.bind_some] at parsed
+    split at parsed
+    next empty =>
+      have empty : rest = [] := List.isEmpty_iff.mp empty
+      cases parsed
+      simp only [empty]
+    next => cases parsed
+
+theorem decode_valid {bytes : ByteArray} {key : Key} (parsed : decode bytes = some key) :
+    (∀ circuit ∈ key.circuits, circuit.valid = true) ∧ key.preprocessedIndices.length = key.circuits.length :=
+  readKey_returns _ _ _ (decode_success parsed)
+
+theorem readKey_commitment : Returns readKey (fun key => CommitmentValid key.preprocessedCommitment) := by
+  unfold readKey
+  refine Returns.bind_any (read := readParameters)
+    (property := fun key : Key => CommitmentValid key.preprocessedCommitment) ?_
+  intro parameters
+  refine Returns.bind_any (read := readVector readCircuit)
+    (property := fun key : Key => CommitmentValid key.preprocessedCommitment) ?_
+  intro circuits
+  refine Returns.bind (right := fun key : Key => CommitmentValid key.preprocessedCommitment)
+    readCommitment_returns ?_
+  intro commitment valid
+  refine Returns.bind_any (read := readMany readIndex circuits.length)
+    (property := fun key : Key => CommitmentValid key.preprocessedCommitment) ?_
+  intro indices
+  exact Returns.pure valid
+
+theorem decode_commitment {bytes : ByteArray} {key : Key} (parsed : decode bytes = some key) :
+    CommitmentValid key.preprocessedCommitment := readKey_commitment _ _ _ (decode_success parsed)
+
+theorem Circuit.valid_graph {circuit : Circuit} (valid : circuit.valid = true) :
+    1 ≤ circuit.lookupGroupSize ∧ circuit.lookupGroupSize ≤ 8 ∧
+      circuit.graph.Valid circuit.widths ∧ circuit.computedDegree = some circuit.maxConstraintDegree := by
+  simp only [Circuit.valid, Bool.and_eq_true, decide_eq_true_eq, beq_iff_eq] at valid
+  obtain ⟨⟨⟨positive, bounded⟩, prefixRead⟩, degrees⟩ := valid
+  cases read : checkedGraphPrefix circuit.widths circuit.graph with
+  | none => simp only [read, Option.isSome_none, Bool.false_eq_true] at prefixRead
+  | some index => exact ⟨positive, bounded, (checkedGraphPrefix_iff _ _ _).mp read |>.1, degrees⟩
+
+theorem decoded_graph_sweeps {bytes : ByteArray} {key : Key} (parsed : decode bytes = some key)
+    {circuit : Circuit} (member : circuit ∈ key.circuits) (ops : EvalOps W) (values : Values W)
+    (fits : values.Fits circuit.widths) :
+    ∃ buffer, circuit.graph.sweep ops values = some buffer ∧ buffer.size = circuit.graph.nodes.length :=
+  ((Circuit.valid_graph ((decode_valid parsed).1 circuit member)).2.2.1).sweep_defined ops values fits
+
+theorem decode_encoded_suffix (key : Key) (fits : KeyWireFits key)
+    (valid : ∀ circuit ∈ key.circuits, circuit.valid = true) (rest : List UInt8) :
+    decode ((encodeKey key ++ rest).toByteArray) = if rest = [] then some key else none := by
+  simp only [decode, List.toList_data_toByteArray, readKey_reads key fits valid rest, bind, Option.bind_some]
+  cases rest <;> rfl
+
+end Aiur.NativeAIR.KeyCodec
diff --git a/Ix/Aiur/Proofs/LocalConstraints.lean b/Ix/Aiur/Proofs/LocalConstraints.lean
new file mode 100644
index 000000000..add26a239
--- /dev/null
+++ b/Ix/Aiur/Proofs/LocalConstraints.lean
@@ -0,0 +1,190 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Field
+import Ix.Aiur.Proofs.Memory
+
+/-!
+Arithmetic extraction from the native AIR's local polynomial forms.
+
+Boolean selector equations, the two `eq_zero` equations, case equality and
+default disequality imply their semantic properties over `G`. Boolean sums
+select at most one branch when the number of summands is below the field
+characteristic. The bound is explicit and a cancellation counterexample
+shows its necessity. These sums use the native emitter's left-fold order.
+
+Memory-table functionality now follows from its polynomial equations and
+trace-height bound without separately assuming boolean selectors. Decoding
+the Rust expressions, trace widths and transition selectors, and extracting
+exact lookup balance from proof verification, remain separate obligations.
+-/
+
+namespace Aiur.AIR
+
+/-- Selector-column equation used in function and memory circuits. -/
+def booleanConstraint (value : G) : G := value * (value - 1)
+
+/-- Block and grouped-circuit selector equation, with the opposite sign. -/
+def oneSubBooleanConstraint (value : G) : G := value * (1 - value)
+
+def selectorSum (selectors : List G) : G := selectors.foldl (· + ·) 0
+
+theorem foldl_add_eq (selectors : List G) (initial : G) :
+    selectors.foldl (· + ·) initial = initial + selectorSum selectors := by
+  induction selectors generalizing initial with
+  | nil => exact (G.add_zero initial).symm
+  | cons head tail ih =>
+    simp only [List.foldl_cons, selectorSum]
+    rw [ih, ih]
+    simp only [G.zero_add, G.add_assoc]
+
+theorem selectorSum_cons (head : G) (tail : List G) :
+    selectorSum (head :: tail) = head + selectorSum tail := by
+  simpa only [selectorSum, List.foldl_cons, G.zero_add] using foldl_add_eq tail head
+
+theorem selectorSum_eq_count (selectors : List G)
+    (boolean : ∀ value ∈ selectors, value = 0 ∨ value = 1) :
+    selectorSum selectors = G.ofNat (selectors.count 1) := by
+  induction selectors with
+  | nil => rfl
+  | cons head tail ih =>
+    have rest : ∀ value ∈ tail, value = 0 ∨ value = 1 :=
+      fun value member => boolean value (List.mem_cons_of_mem _ member)
+    rcases boolean head List.mem_cons_self with rfl | rfl
+    · rw [selectorSum_cons, G.zero_add, List.count_cons_of_ne (Ne.symm G.one_ne_zero), ih rest]
+    · rw [selectorSum_cons, List.count_cons_self, ih rest, G.ofNat_add, G.add_comm]
+      rfl
+
+theorem selectorSum_n_eq_count {selectors : List G}
+    (boolean : ∀ value ∈ selectors, value = 0 ∨ value = 1)
+    (bounded : selectors.length < gSize.toNat) :
+    (selectorSum selectors).n = selectors.count 1 := by
+  rw [selectorSum_eq_count selectors boolean, G.n_ofNat]
+  exact Nat.mod_eq_of_lt (Nat.lt_of_le_of_lt List.count_le_length bounded)
+
+theorem selectorSum_count_le_one {selectors : List G}
+    (individual : ∀ value ∈ selectors, booleanConstraint value = 0)
+    (combined : oneSubBooleanConstraint (selectorSum selectors) = 0)
+    (bounded : selectors.length < gSize.toNat) : selectors.count 1 ≤ 1 := by
+  have boolean : ∀ value ∈ selectors, value = 0 ∨ value = 1 :=
+    fun value member => G.boolean_of_constraint (individual value member)
+  have count := selectorSum_n_eq_count boolean bounded
+  rcases G.boolean_of_one_sub_constraint combined with zero | one
+  · rw [zero] at count
+    change 0 = selectors.count 1 at count
+    omega
+  · rw [one] at count
+    change 1 = selectors.count 1 at count
+    omega
+
+theorem selectorSum_inactive {selectors : List G}
+    (individual : ∀ value ∈ selectors, booleanConstraint value = 0)
+    (bounded : selectors.length < gSize.toNat)
+    (inactive : selectorSum selectors = 0) : ∀ value ∈ selectors, value = 0 := by
+  have boolean : ∀ value ∈ selectors, value = 0 ∨ value = 1 :=
+    fun value member => G.boolean_of_constraint (individual value member)
+  have count := selectorSum_n_eq_count boolean bounded
+  rw [inactive] at count
+  have absent : (1 : G) ∉ selectors := List.count_eq_zero.mp count.symm
+  intro value member
+  rcases boolean value member with zero | one
+  · exact zero
+  · subst value; exact False.elim (absent member)
+
+theorem selectorSum_active_count {selectors : List G}
+    (individual : ∀ value ∈ selectors, booleanConstraint value = 0)
+    (bounded : selectors.length < gSize.toNat)
+    (active : selectorSum selectors = 1) : selectors.count 1 = 1 := by
+  have boolean : ∀ value ∈ selectors, value = 0 ∨ value = 1 :=
+    fun value member => G.boolean_of_constraint (individual value member)
+  have count := selectorSum_n_eq_count boolean bounded
+  rw [active] at count
+  exact count.symm
+
+/-- An active bounded sum has exactly one active occurrence; all other
+occurrences are zero, even when list values repeat. -/
+theorem selectorSum_active_split {selectors : List G}
+    (individual : ∀ value ∈ selectors, booleanConstraint value = 0)
+    (bounded : selectors.length < gSize.toNat) (active : selectorSum selectors = 1) :
+    ∃ before after : List G, selectors = before ++ 1 :: after ∧
+      ∀ value ∈ before ++ after, value = 0 := by
+  have count := selectorSum_active_count individual bounded active
+  have member : (1 : G) ∈ selectors := List.count_pos_iff.mp (by omega)
+  obtain ⟨before, after, equal, _⟩ := List.eq_append_cons_of_mem member
+  refine ⟨before, after, equal, ?_⟩
+  rw [equal, List.count_append, List.count_cons_self] at count
+  have absent : (1 : G) ∉ before ++ after := by
+    apply List.count_eq_zero.mp
+    rw [List.count_append]
+    omega
+  intro value member
+  have member' : value ∈ selectors := by
+    rw [equal]
+    rcases List.mem_append.mp member with left | right
+    · exact List.mem_append_left _ left
+    · exact List.mem_append_right _ (List.mem_cons_of_mem _ right)
+  rcases G.boolean_of_constraint (individual value member') with zero | one
+  · exact zero
+  · subst value; exact False.elim (absent member)
+
+/-- Boolean summands alone do not prevent a full characteristic of active
+branches from being represented by an inactive field sum. -/
+theorem selectorSum_characteristic_cancel :
+    selectorSum (List.replicate gSize.toNat (1 : G)) = 0 := by
+  rw [selectorSum_eq_count _ (fun value member =>
+    Or.inr (List.eq_of_mem_replicate member)), List.count_replicate_self]
+  rfl
+
+theorem nonzero_multiplicity_selector_one {multiplicity selector : G}
+    (satisfied : activityConstraint multiplicity selector = 0)
+    (nonzero : multiplicity ≠ 0) : selector = 1 := by
+  have zero := G.mul_eq_zero_of_left_ne_zero nonzero satisfied
+  exact ((G.sub_eq_zero_iff 1 selector).mp zero).symm
+
+theorem active_eqZero {selector input inverse output : G} (active : selector = 1)
+    (annihilate : selector * input * output = 0)
+    (complement : selector * (input * inverse + output - 1) = 0) :
+    output = G.eqZero input := by
+  rw [active, G.mul_comm (1 : G) input, G.mul_one] at annihilate
+  rw [active, G.mul_comm, G.mul_one] at complement
+  exact G.eqZero_of_constraints annihilate complement
+
+theorem active_case {selector matched key : G} (active : selector = 1)
+    (satisfied : selector * (matched - key) = 0) : matched = key := by
+  rw [active, G.mul_comm, G.mul_one] at satisfied
+  exact (G.sub_eq_zero_iff matched key).mp satisfied
+
+theorem active_default {selector matched key inverse : G} (active : selector = 1)
+    (satisfied : selector * ((matched - key) * inverse - 1) = 0) : matched ≠ key := by
+  rw [active, G.mul_comm, G.mul_one] at satisfied
+  intro equal
+  have nonzero := G.ne_zero_of_inverse_constraint satisfied
+  exact nonzero ((G.sub_eq_zero_iff matched key).mpr equal)
+
+/-- The four memory polynomial forms, with interior transition gating
+resolved and column widths decoded. No boolean-selector premise. -/
+structure MemoryRowsPolynomials (width : Nat) (rows : Array MemoryRow) : Prop where
+  selectors : ∀ i (hi : i < rows.size), booleanConstraint rows[i].selector = 0
+  activity : ∀ i (hi : i < rows.size), activityConstraint rows[i].multiplicity rows[i].selector = 0
+  widths : ∀ i (hi : i < rows.size), rows[i].contents.size = width
+  activityTransition : ∀ i (hi : i + 1 < rows.size),
+    memoryActivityTransition (rows[i]'(by omega)) rows[i + 1] = 0
+  pointerTransition : ∀ i (hi : i + 1 < rows.size),
+    memoryPointerTransition (rows[i]'(by omega)) rows[i + 1] = 0
+
+theorem MemoryRowsPolynomials.valid {width : Nat} {rows : Array MemoryRow}
+    (polynomials : MemoryRowsPolynomials width rows) : MemoryRowsValid width rows :=
+  ⟨fun i hi => G.boolean_of_constraint (polynomials.selectors i hi),
+    polynomials.activity, polynomials.widths, polynomials.activityTransition, polynomials.pointerTransition⟩
+
+theorem MemoryRowsPolynomials.functional (tables : Nat → Array MemoryRow)
+    (polynomials : ∀ width, MemoryRowsPolynomials width (tables width))
+    (bounded : ∀ width, (tables width).size < gSize.toNat)
+    {width : Nat} {pointer : G} {left right : Array G}
+    (loadedLeft : memoryFacts tables width pointer left)
+    (loadedRight : memoryFacts tables width pointer right) : left = right :=
+  memoryFacts_functional tables (fun width => (polynomials width).valid) bounded loadedLeft loadedRight
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/LogUp.lean b/Ix/Aiur/Proofs/LogUp.lean
new file mode 100644
index 000000000..8d03b68fa
--- /dev/null
+++ b/Ix/Aiur/Proofs/LogUp.lean
@@ -0,0 +1,248 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LogUpAlgebra
+import Ix.Aiur.KeyCodec
+
+/-! Checked reads, complete grouping, and the polynomial equations extracted
+from the executable logUp evaluator. These results preserve both coordinates
+and their order, including the last-row boundary injection. -/
+
+namespace Aiur.NativeAIR.LogUp
+
+theorem groupCount_positive (groupSize lookupCount : Nat) : 0 < groupCount groupSize lookupCount := by
+  simp only [groupCount]; omega
+
+theorem groupCount_covers (groupSize lookupCount : Nat) :
+    lookupCount ≤ groupCount groupSize lookupCount * max groupSize 1 := by
+  apply (Nat.le_mul_iff_le_left (by omega : 0 < max groupSize 1)).mpr
+  exact Nat.le_max_right _ _
+
+theorem groupCount_zero (lookupCount : Nat) : groupCount 0 lookupCount = groupCount 1 lookupCount := rfl
+
+theorem groupCount_empty (groupSize : Nat) : groupCount groupSize 0 = 1 := by
+  have positive : 0 < max groupSize 1 := by omega
+  simp only [groupCount, Nat.zero_add, Nat.div_eq_of_lt (by omega : max groupSize 1 - 1 < max groupSize 1)]
+  rfl
+
+theorem groupCount_key (circuit : KeyCodec.Circuit) (positive : 0 < circuit.lookupGroupSize) :
+    groupCount circuit.lookupGroupSize circuit.graph.lookups.length = circuit.groups := by
+  simp only [groupCount, KeyCodec.Circuit.groups, Nat.max_eq_left positive]
+
+theorem chunk_length (groupSize index : Nat) (values : List α) :
+    (chunk groupSize index values).length = min (max groupSize 1) (values.length - index * max groupSize 1) := by
+  simp only [chunk, List.length_take, List.length_drop]
+
+theorem chunks_take (groupSize count : Nat) (values : List α) :
+    (List.range count).flatMap (fun index => chunk groupSize index values) = values.take (count * max groupSize 1) := by
+  induction count with
+  | zero => simp only [List.range_zero, List.flatMap_nil, Nat.zero_mul, List.take_zero]
+  | succ count ih =>
+    rw [List.range_succ, List.flatMap_append, ih]
+    simp only [List.flatMap_cons, List.flatMap_nil, List.append_nil, chunk, Nat.add_mul,
+      Nat.one_mul, List.take_add]
+
+theorem chunks_cover (groupSize : Nat) (values : List α) :
+    (List.range (groupCount groupSize values.length)).flatMap (fun index => chunk groupSize index values) = values := by
+  rw [chunks_take, List.take_of_length_le (groupCount_covers groupSize values.length)]
+
+theorem chunk_mem {groupSize index : Nat} {values : List α} {value : α}
+    (member : value ∈ chunk groupSize index values) : value ∈ values :=
+  List.mem_of_mem_drop (List.mem_of_mem_take member)
+
+theorem chunk_map (groupSize index : Nat) (values : List α) (f : α → β) :
+    chunk groupSize index (values.map f) = (chunk groupSize index values).map f := by
+  simp only [chunk, List.map_take, List.map_drop]
+
+theorem mapM_some_reads {read : α → Option β} {inputs : List α} {outputs : List β}
+    (accepted : inputs.mapM read = some outputs) : outputs.length = inputs.length ∧
+      ∀ (index : Nat) input, inputs[index]? = some input → ∃ output, outputs[index]? = some output ∧ read input = some output := by
+  induction inputs generalizing outputs with
+  | nil =>
+    cases accepted
+    exact ⟨rfl, fun _ _ impossible => by simp at impossible⟩
+  | cons input inputs ih =>
+    simp only [List.mapM_cons, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at accepted
+    obtain ⟨output, head, rest, tail, rfl⟩ := accepted
+    obtain ⟨length, reads⟩ := ih tail
+    refine ⟨congrArg (· + 1) length, ?_⟩
+    intro index value valueRead
+    cases index with
+    | zero =>
+      have same := Option.some.inj valueRead
+      subst value
+      exact ⟨output, rfl, head⟩
+    | succ index => exact reads index value valueRead
+
+theorem mapM_defined (inputs : List α) (read : α → Option β)
+    (defined : ∀ input ∈ inputs, ∃ output, read input = some output) :
+    ∃ outputs, inputs.mapM read = some outputs := by
+  induction inputs with
+  | nil => exact ⟨[], rfl⟩
+  | cons input inputs ih =>
+    obtain ⟨output, head⟩ := defined input List.mem_cons_self
+    obtain ⟨outputs, tail⟩ := ih (fun value member => defined value (List.mem_cons_of_mem _ member))
+    exact ⟨output :: outputs, by simp only [List.mapM_cons, head, tail, bind, Option.bind_some, pure]⟩
+
+theorem read_coordinates_defined (values : Array W) (slot : Nat) (bounded : 2 * slot + 1 < values.size) :
+    ∃ value, Coordinates.read values slot = some value := by
+  have first : 2 * slot < values.size := by omega
+  exact ⟨⟨values[2 * slot], values[2 * slot + 1]⟩, by
+    simp only [Coordinates.read, Array.getElem?_eq_getElem first, Array.getElem?_eq_getElem bounded,
+      bind, Option.bind_some, pure]⟩
+
+theorem read_coordinates_success {values : Array W} {slot : Nat} {value : Coordinates W}
+    (accepted : Coordinates.read values slot = some value) :
+    values[2 * slot]? = some value.c0 ∧ values[2 * slot + 1]? = some value.c1 := by
+  simp only [Coordinates.read, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at accepted
+  obtain ⟨first, hf, second, hs, rfl⟩ := accepted
+  exact ⟨hf, hs⟩
+
+section Evaluation
+
+variable {W : Type u} [Lean.Grind.CommRing W]
+
+theorem step_polynomial {beta gamma injection next : Coordinates W} {stageCurrent : Array W}
+    {lookups : List (W × List W)} {groupSize index : Nat} {result : Coordinates W}
+    (accepted : step beta gamma injection next stageCurrent lookups groupSize index = some result) :
+    ∃ source target, Coordinates.read stageCurrent index = some source ∧
+      (if index + 1 < groupCount groupSize lookups.length then Coordinates.read stageCurrent (index + 1)
+        else some (next + injection)) = some target ∧
+      result = product ((compress beta gamma (chunk groupSize index lookups)).map Prod.snd) *
+        (target - source) - numerator (compress beta gamma (chunk groupSize index lookups)) := by
+  simp only [step, bind, Option.bind_eq_some_iff, pure] at accepted
+  obtain ⟨source, hs, accepted⟩ := accepted
+  split at accepted
+  next interior =>
+    simp only [Option.bind_eq_some_iff] at accepted
+    obtain ⟨target, ht, accepted⟩ := accepted
+    cases accepted
+    exact ⟨source, target, hs, by rw [if_pos interior]; exact ht, groupEquation_polynomial _ _⟩
+  next final =>
+    cases accepted
+    exact ⟨source, next + injection, hs, by rw [if_neg final], groupEquation_polynomial _ _⟩
+
+theorem step_defined (beta gamma injection next : Coordinates W) (stageCurrent : Array W)
+    (lookups : List (W × List W)) (groupSize index : Nat)
+    (width : groupCount groupSize lookups.length * 2 ≤ stageCurrent.size)
+    (bounded : index < groupCount groupSize lookups.length) :
+    ∃ result, step beta gamma injection next stageCurrent lookups groupSize index = some result := by
+  obtain ⟨source, hs⟩ := read_coordinates_defined stageCurrent index (by omega)
+  have target : ∃ target, (if index + 1 < groupCount groupSize lookups.length then
+      Coordinates.read stageCurrent (index + 1) else some (next + injection)) = some target := by
+    split
+    next bound => exact read_coordinates_defined stageCurrent (index + 1) (by omega)
+    next => exact ⟨_, rfl⟩
+  obtain ⟨target, ht⟩ := target
+  refine ⟨groupEquation (compress beta gamma (chunk groupSize index lookups)) (target - source), ?_⟩
+  by_cases interior : index + 1 < groupCount groupSize lookups.length
+  · rw [if_pos interior] at ht
+    simp only [step, hs, if_pos interior, ht, bind, Option.bind_some, pure]
+  · rw [if_neg interior] at ht
+    have same := Option.some.inj ht
+    simp only [step, hs, if_neg interior, same, bind, Option.bind_some, pure]
+
+theorem equations_success {lookups : List (W × List W)} {stageCurrent stageNext publics deltaScaled : Array W}
+    {isLast : W} {groupSize : Nat} {result : List (Coordinates W)}
+    (accepted : equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result) :
+    groupSize ≤ 8 ∧ ∃ beta gamma delta next,
+      Coordinates.read publics 0 = some beta ∧ Coordinates.read publics 1 = some gamma ∧
+      Coordinates.read deltaScaled 0 = some delta ∧ Coordinates.read stageNext 0 = some next ∧
+      result.length = groupCount groupSize lookups.length ∧
+      ∀ index, index < groupCount groupSize lookups.length → ∃ value,
+        result[index]? = some value ∧
+        step beta gamma (delta.scale isLast) next stageCurrent lookups groupSize index = some value := by
+  unfold equations at accepted
+  split at accepted
+  next => cases accepted
+  next bounded =>
+    simp only [bind, Option.bind_eq_some_iff] at accepted
+    obtain ⟨beta, hb, gamma, hg, delta, hd, next, hn, steps⟩ := accepted
+    obtain ⟨length, reads⟩ := mapM_some_reads steps
+    refine ⟨by omega, beta, gamma, delta, next, hb, hg, hd, hn, ?_, ?_⟩
+    · simpa only [List.length_range] using length
+    · intro index bound
+      exact reads index index (List.getElem?_range bound)
+
+theorem equations_defined (lookups : List (W × List W)) (stageCurrent stageNext publics deltaScaled : Array W)
+    (isLast : W) (groupSize : Nat) (bounded : groupSize ≤ 8)
+    (currentWidth : groupCount groupSize lookups.length * 2 ≤ stageCurrent.size)
+    (nextWidth : 2 ≤ stageNext.size) (publicWidth : 4 ≤ publics.size) (deltaWidth : 2 ≤ deltaScaled.size) :
+    ∃ result, equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result := by
+  obtain ⟨beta, hb⟩ := read_coordinates_defined publics 0 (by omega)
+  obtain ⟨gamma, hg⟩ := read_coordinates_defined publics 1 (by omega)
+  obtain ⟨delta, hd⟩ := read_coordinates_defined deltaScaled 0 (by omega)
+  obtain ⟨next, hn⟩ := read_coordinates_defined stageNext 0 (by omega)
+  obtain ⟨result, steps⟩ := mapM_defined (List.range (groupCount groupSize lookups.length))
+    (step beta gamma (delta.scale isLast) next stageCurrent lookups groupSize)
+    (fun index member => step_defined _ _ _ _ _ _ _ _ currentWidth (List.mem_range.mp member))
+  exact ⟨result, by simp only [equations, if_neg (by omega : ¬8 < groupSize), hb, hg, hd, hn,
+    bind, Option.bind_some, steps]⟩
+
+theorem equations_zero {lookups : List (W × List W)} {stageCurrent stageNext publics deltaScaled : Array W}
+    {isLast : W} {groupSize : Nat} {result : List (Coordinates W)}
+    (accepted : equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result)
+    (zero : ∀ value ∈ result, value = 0) :
+    ∃ beta gamma delta next,
+      Coordinates.read publics 0 = some beta ∧ Coordinates.read publics 1 = some gamma ∧
+      Coordinates.read deltaScaled 0 = some delta ∧ Coordinates.read stageNext 0 = some next ∧
+      ∀ index, index < groupCount groupSize lookups.length → ∃ source target,
+        Coordinates.read stageCurrent index = some source ∧
+        (if index + 1 < groupCount groupSize lookups.length then Coordinates.read stageCurrent (index + 1)
+          else some (next + delta.scale isLast)) = some target ∧
+        product ((compress beta gamma (chunk groupSize index lookups)).map Prod.snd) *
+          (target - source) = numerator (compress beta gamma (chunk groupSize index lookups)) := by
+  obtain ⟨_, beta, gamma, delta, next, hb, hg, hd, hn, _, steps⟩ := equations_success accepted
+  refine ⟨beta, gamma, delta, next, hb, hg, hd, hn, ?_⟩
+  intro index bound
+  obtain ⟨value, valueRead, stepRead⟩ := steps index bound
+  obtain ⟨source, target, hs, ht, equation⟩ := step_polynomial stepRead
+  have vanishes := zero value (List.mem_of_getElem? valueRead)
+  exact ⟨source, target, hs, ht, by rw [vanishes] at equation; grind⟩
+
+theorem constraintValues_success {lookups : List Lookup} {nodeValues stageCurrent stageNext publics deltaScaled : Array W}
+    {isLast : W} {groupSize : Nat} {result : List W}
+    (accepted : constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast groupSize = some result) :
+    ∃ values coordinates, lookups.mapM (readLookup nodeValues) = some values ∧
+      equations values stageCurrent stageNext publics deltaScaled isLast groupSize = some coordinates ∧
+      result = Coordinates.flatten coordinates := by
+  simp only [constraintValues, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at accepted
+  obtain ⟨values, hv, coordinates, hc, rfl⟩ := accepted
+  exact ⟨values, coordinates, hv, hc, rfl⟩
+
+theorem constraintValues_length {lookups : List Lookup} {nodeValues stageCurrent stageNext publics deltaScaled : Array W}
+    {isLast : W} {groupSize : Nat} {result : List W}
+    (accepted : constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast groupSize = some result) :
+    result.length = 2 * groupCount groupSize lookups.length := by
+  obtain ⟨values, coordinates, hv, hc, rfl⟩ := constraintValues_success accepted
+  obtain ⟨_, _, _, _, _, _, _, _, _, length, _⟩ := equations_success hc
+  rw [Coordinates.flatten_length, length, (mapM_some_reads hv).1]
+
+theorem constraintValues_defined (lookups : List Lookup) (nodeValues stageCurrent stageNext publics deltaScaled : Array W)
+    (isLast : W) (groupSize : Nat) (bounded : groupSize ≤ 8)
+    (roots : ∀ lookup ∈ lookups, ∀ index ∈ lookup.roots, index < nodeValues.size)
+    (currentWidth : groupCount groupSize lookups.length * 2 ≤ stageCurrent.size)
+    (nextWidth : 2 ≤ stageNext.size) (publicWidth : 4 ≤ publics.size) (deltaWidth : 2 ≤ deltaScaled.size) :
+    ∃ result, constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast groupSize = some result := by
+  obtain ⟨values, hv⟩ := mapM_defined lookups (readLookup nodeValues) (by
+    intro lookup member
+    obtain ⟨value, read, _⟩ := readLookup_defined nodeValues lookup (roots lookup member)
+    exact ⟨value, read⟩)
+  have lengths := (mapM_some_reads hv).1
+  obtain ⟨coordinates, hc⟩ := equations_defined values stageCurrent stageNext publics deltaScaled isLast groupSize
+    bounded (by simpa only [lengths] using currentWidth) nextWidth publicWidth deltaWidth
+  exact ⟨Coordinates.flatten coordinates, by simp only [constraintValues, hv, hc, bind, Option.bind_some, pure]⟩
+
+theorem constraintValues_reflect {ops : EvalOps W} {values : Values W} {trees : Array Expr} {buffer : Array W}
+    (reflects : Reflects ops values trees buffer) (lookups : List Lookup)
+    (stageCurrent stageNext publics deltaScaled : Array W) (isLast : W) (groupSize : Nat) :
+    constraintValues lookups buffer stageCurrent stageNext publics deltaScaled isLast groupSize =
+      (do let lookupValues ← lookups.mapM (evalLookup ops values trees)
+          return Coordinates.flatten (← equations lookupValues stageCurrent stageNext publics deltaScaled isLast groupSize)) := by
+  have same : readLookup buffer = evalLookup ops values trees := funext reflects.readLookup
+  simp only [constraintValues, same]
+
+end Evaluation
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/Proofs/LogUpAccumulator.lean b/Ix/Aiur/Proofs/LogUpAccumulator.lean
new file mode 100644
index 000000000..59fbbe251
--- /dev/null
+++ b/Ix/Aiur/Proofs/LogUpAccumulator.lean
@@ -0,0 +1,109 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LogUpFractions
+
+/-! A complete row's checked grouped equations imply the sum-of-fractions
+accumulator identity when its base-field messages avoid poles. The proof
+telescopes every group, including the empty pass-through case, and retains
+the caller's scaled last-row injection. -/
+
+namespace Aiur.NativeAIR.LogUp
+
+open ProofCodec (Extension)
+
+def lookupFractions (beta gamma : Coordinates G) (lookups : List (G × List G)) : Extension :=
+  fractionSum (fieldEntries (compress beta gamma lookups))
+
+theorem fractionSum_flatMap (inputs : List α) (entries : α → List (Extension × Extension)) :
+    fractionSum (inputs.flatMap entries) = sum (inputs.map fun input => fractionSum (entries input)) := by
+  induction inputs with
+  | nil => rfl
+  | cons input inputs ih =>
+    simp only [List.flatMap_cons, fractionSum_append, List.map_cons, sum, List.foldr_cons] at *
+    rw [ih]
+
+theorem fieldEntries_compress_chunk (beta gamma : Coordinates G) (lookups : List (G × List G))
+    (groupSize index : Nat) :
+    fieldEntries (compress beta gamma (chunk groupSize index lookups)) =
+      chunk groupSize index (fieldEntries (compress beta gamma lookups)) := by
+  simp only [fieldEntries, compress, chunk_map]
+
+theorem lookupFractions_chunks (beta gamma : Coordinates G) (lookups : List (G × List G)) (groupSize : Nat) :
+    sum ((List.range (groupCount groupSize lookups.length)).map
+      (fun index => lookupFractions beta gamma (chunk groupSize index lookups))) = lookupFractions beta gamma lookups := by
+  simp only [lookupFractions, fieldEntries_compress_chunk]
+  rw [← fractionSum_flatMap]
+  have length : (fieldEntries (compress beta gamma lookups)).length = lookups.length := by
+    simp only [fieldEntries, compress, List.length_map]
+  rw [← length, chunks_cover]
+
+theorem equations_accumulator {lookups : List (G × List G)} {stageCurrent stageNext publics deltaScaled : Array G}
+    {isLast : G} {groupSize : Nat} {result : List (Coordinates G)}
+    {beta gamma : Coordinates G}
+    (betaRead : Coordinates.read publics 0 = some beta) (gammaRead : Coordinates.read publics 1 = some gamma)
+    (accepted : equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result)
+    (zero : ∀ value ∈ result, value = 0)
+    (free : PoleFree (fieldEntries (compress beta gamma lookups))) :
+    ∃ first next delta, Coordinates.read stageCurrent 0 = some first ∧
+      Coordinates.read stageNext 0 = some next ∧ Coordinates.read deltaScaled 0 = some delta ∧
+      next.toExtension - first.toExtension + (delta.scale isLast).toExtension = lookupFractions beta gamma lookups := by
+  obtain ⟨readBeta, readGamma, delta, next, hb, hg, hd, hn, groups⟩ := equations_zero accepted zero
+  have sameBeta := Option.some.inj (hb.symm.trans betaRead)
+  have sameGamma := Option.some.inj (hg.symm.trans gammaRead)
+  subst readBeta
+  subst readGamma
+  let count := groupCount groupSize lookups.length
+  let injection := delta.scale isLast
+  let states := fun index => if index < count then
+    ((Coordinates.read stageCurrent index).getD 0).toExtension else (next + injection).toExtension
+  let increments := fun index => lookupFractions beta gamma (chunk groupSize index lookups)
+  have steps : ∀ index, index < count → states (index + 1) - states index = increments index := by
+    intro index bound
+    obtain ⟨source, target, hs, ht, equation⟩ := groups index bound
+    have localFree : PoleFree (fieldEntries (compress beta gamma (chunk groupSize index lookups))) := by
+      rw [fieldEntries_compress_chunk]
+      exact fun entry member => free entry (chunk_mem member)
+    have fraction := (coordinate_polynomial_zero_iff _ _ localFree).mp equation
+    rw [Coordinates.toExtension_sub] at fraction
+    have sourceRead : states index = source.toExtension := by
+      simp only [states, if_pos bound, hs, Option.getD_some]
+    have targetRead : states (index + 1) = target.toExtension := by
+      by_cases interior : index + 1 < count
+      · rw [if_pos interior] at ht
+        simp only [states, if_pos interior, ht, Option.getD_some]
+      · rw [if_neg interior] at ht
+        have same := Option.some.inj ht
+        simp only [states, if_neg interior, injection, same]
+    rw [sourceRead, targetRead]
+    exact fraction
+  have telescoped := telescope states increments count steps
+  rw [lookupFractions_chunks] at telescoped
+  obtain ⟨first, _, hf, _, _⟩ := groups 0 (groupCount_positive _ _)
+  have positive : 0 < count := groupCount_positive _ _
+  have firstState : states 0 = first.toExtension := by
+    simp only [states, if_pos positive, hf, Option.getD_some]
+  have finalState : states count = next.toExtension + injection.toExtension := by
+    simp only [states, Nat.lt_irrefl, ↓reduceIte, Coordinates.toExtension_add]
+  rw [firstState, finalState] at telescoped
+  exact ⟨first, next, delta, hf, hn, hd, by change _ + injection.toExtension = _; grind⟩
+
+theorem constraintValues_accumulator {lookups : List Lookup} {nodeValues stageCurrent stageNext publics deltaScaled : Array G}
+    {isLast : G} {groupSize : Nat} {result : List G} {beta gamma : Coordinates G}
+    (betaRead : Coordinates.read publics 0 = some beta) (gammaRead : Coordinates.read publics 1 = some gamma)
+    (accepted : constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast groupSize = some result)
+    (zero : ∀ value ∈ result, value = 0)
+    (free : ∀ values, lookups.mapM (readLookup nodeValues) = some values →
+      PoleFree (fieldEntries (compress beta gamma values))) :
+    ∃ values first next delta, lookups.mapM (readLookup nodeValues) = some values ∧
+      Coordinates.read stageCurrent 0 = some first ∧ Coordinates.read stageNext 0 = some next ∧
+      Coordinates.read deltaScaled 0 = some delta ∧
+      next.toExtension - first.toExtension + (delta.scale isLast).toExtension = lookupFractions beta gamma values := by
+  obtain ⟨values, coordinates, hv, hc, rfl⟩ := constraintValues_success accepted
+  have vanishes := (Coordinates.flatten_zero_iff coordinates).mp zero
+  obtain ⟨first, next, delta, hf, hn, hd, equation⟩ := equations_accumulator betaRead gammaRead hc vanishes (free values hv)
+  exact ⟨values, first, next, delta, hv, hf, hn, hd, equation⟩
+
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/Proofs/LogUpAlgebra.lean b/Ix/Aiur/Proofs/LogUpAlgebra.lean
new file mode 100644
index 000000000..a5ecd89af
--- /dev/null
+++ b/Ix/Aiur/Proofs/LogUpAlgebra.lean
@@ -0,0 +1,195 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.LogUp
+import Ix.Aiur.Proofs.LookupCoordinates
+
+/-! Product reflection for grouped logUp, valid in a commutative ring even
+when the coordinate algebra has zero divisors. Denominator cancellation is
+deliberately a separate result requiring nonzero native field messages. -/
+
+namespace Aiur.NativeAIR.LogUp
+
+section Algebra
+
+variable {R : Type u} [Lean.Grind.CommRing R]
+
+theorem sub_zero_iff (left right : R) : left - right = 0 ↔ left = right := by
+  constructor <;> intro equal <;> grind
+
+theorem clears_cons (weight message inverse denominator fractions cleared : R)
+    (inverts : message * inverse = 1) (tail : denominator * fractions = cleared) :
+    message * denominator * (weight * inverse + fractions) = weight * denominator + message * cleared := by
+  grind
+
+theorem product_cons (value : R) (values : List R) : product (value :: values) = value * product values := rfl
+
+theorem product_append (left right : List R) : product (left ++ right) = product left * product right := by
+  induction left with
+  | nil => simp only [List.nil_append, product, List.foldr_nil]; grind
+  | cons x xs ih =>
+    simp only [List.cons_append, product, List.foldr_cons] at *
+    rw [ih]
+    grind
+
+theorem product_foldl (values : List R) (initial : R) :
+    values.foldl (· * ·) initial = initial * product values := by
+  induction values generalizing initial with
+  | nil => simp only [List.foldl_nil, product, List.foldr_nil]; grind
+  | cons x xs ih => simp only [List.foldl_cons, ih, product, List.foldr_cons]; grind
+
+theorem sum_foldl (values : List R) (initial : R) :
+    values.foldl (· + ·) initial = initial + sum values := by
+  induction values generalizing initial with
+  | nil => simp only [List.foldl_nil, sum, List.foldr_nil]; grind
+  | cons x xs ih => simp only [List.foldl_cons, ih, sum, List.foldr_cons]; grind
+
+theorem sum_append (left right : List R) : sum (left ++ right) = sum left + sum right := by
+  induction left with
+  | nil => change sum right = 0 + sum right; grind
+  | cons x xs ih =>
+    change x + sum (xs ++ right) = (x + sum xs) + sum right
+    rw [ih]
+    grind
+
+theorem telescope (states increments : Nat → R) (count : Nat)
+    (steps : ∀ index, index < count → states (index + 1) - states index = increments index) :
+    states count - states 0 = sum ((List.range count).map increments) := by
+  induction count with
+  | zero => change states 0 - states 0 = 0; grind
+  | succ count ih =>
+    have earlier := ih (fun index bound => steps index (by omega))
+    have last := steps count (by omega)
+    rw [List.range_succ, List.map_append, sum_append]
+    change states (count + 1) - states 0 = sum ((List.range count).map increments) + (increments count + 0)
+    grind
+
+theorem cyclic_accumulator (states fractions : Nat → R) (count : Nat) (delta : R)
+    (positive : 0 < count) (wrap : states count = states 0)
+    (rows : ∀ index, index < count →
+      states (index + 1) - states index + (if index + 1 = count then delta else 0) = fractions index) :
+    sum ((List.range count).map fractions) = delta := by
+  cases count with
+  | zero => omega
+  | succ count =>
+    have earlier := telescope states fractions count (by
+      intro index bound
+      have row := rows index (by omega)
+      rw [if_neg (by omega : index + 1 ≠ count + 1), Lean.Grind.Semiring.add_zero] at row
+      exact row)
+    have last := rows count (by omega)
+    rw [if_pos rfl, wrap] at last
+    rw [List.range_succ, List.map_append, sum_append]
+    change sum ((List.range count).map fractions) + (fractions count + 0) = delta
+    grind
+
+theorem final_accumulator (accumulators contributions : Nat → R) (count : Nat)
+    (finalZero : accumulators count = 0)
+    (circuits : ∀ index, index < count → accumulators (index + 1) - accumulators index = contributions index) :
+    accumulators 0 + sum ((List.range count).map contributions) = 0 := by
+  have total := telescope accumulators contributions count circuits
+  rw [finalZero] at total
+  grind
+
+theorem prefix_products (values : List R) (initial : R) (index : Nat) :
+    (values.scanl (· * ·) initial)[index]? =
+      if index ≤ values.length then some (initial * product (values.take index)) else none := by
+  rw [List.getElem?_scanl, product_foldl]
+
+theorem prefix_seeded (first : R) (rest : List R) :
+    (first :: rest).scanl (· * ·) 1 = 1 :: rest.scanl (· * ·) first := by
+  rw [List.scanl_cons, Lean.Grind.Semiring.one_mul]
+
+theorem suffix_seeded (rest : List R) (last : R) :
+    (rest ++ [last]).scanr (· * ·) 1 = rest.scanr (· * ·) last ++ [1] := by
+  simp only [List.scanr_append, List.foldr_cons, List.foldr_nil, Lean.Grind.Semiring.mul_one,
+    List.scanr_cons, List.scanr_nil, List.tail_cons]
+
+theorem suffix_products (values : List R) (index : Nat) :
+    (values.scanr (· * ·) 1)[index]? =
+      if index ≤ values.length then some (product (values.drop index)) else none := by
+  induction values generalizing index with
+  | nil => cases index <;> simp [product]
+  | cons x xs ih =>
+    cases index with
+    | zero => simp only [List.scanr_cons, List.getElem?_cons_zero, Nat.zero_le,
+        ↓reduceIte, List.drop_zero, product]
+    | succ index =>
+      simp only [List.scanr_cons, List.getElem?_cons_succ, List.length_cons,
+        Nat.succ_le_succ_iff, List.drop_succ_cons, ih]
+
+theorem prefixSuffixTerms_cons (weight message initial : R) (entries : List (R × R)) :
+    prefixSuffixTerms initial ((weight, message) :: entries) =
+      initial * product (entries.map Prod.snd) * weight :: prefixSuffixTerms (initial * message) entries := by
+  cases entries <;>
+    simp [prefixSuffixTerms, List.scanl_cons, List.scanr_cons, product]
+
+theorem prefixSuffixTerms_sum (entries : List (R × R)) (initial : R) :
+    sum (prefixSuffixTerms initial entries) = initial * numerator entries := by
+  induction entries generalizing initial with
+  | nil => simp only [prefixSuffixTerms, List.map_nil, List.zip_nil_left, sum, List.foldr_nil,
+      numerator]; grind
+  | cons entry entries ih =>
+    obtain ⟨weight, message⟩ := entry
+    rw [prefixSuffixTerms_cons]
+    change initial * product (entries.map Prod.snd) * weight +
+      sum (prefixSuffixTerms (initial * message) entries) = _
+    rw [ih]
+    simp only [numerator]
+    grind
+
+theorem groupEquation_polynomial (entries : List (R × R)) (difference : R) :
+    groupEquation entries difference = product (entries.map Prod.snd) * difference - numerator entries := by
+  cases entries with
+  | nil => simp only [groupEquation, List.map_nil, product, List.foldr_nil, numerator]; grind
+  | cons entry entries =>
+    obtain ⟨weight, message⟩ := entry
+    cases entries with
+    | nil => simp only [groupEquation, List.map_cons, List.map_nil, product, List.foldr_cons,
+        List.foldr_nil, numerator]; grind
+    | cons entry entries =>
+      rw [groupEquation, product_foldl, sum_foldl, prefixSuffixTerms_sum] <;> grind
+
+theorem numerator_append (left right : List (R × R)) :
+    numerator (left ++ right) = numerator left * product (right.map Prod.snd) +
+      product (left.map Prod.snd) * numerator right := by
+  induction left with
+  | nil => simp only [List.nil_append, numerator, List.map_nil, product, List.foldr_nil]; grind
+  | cons entry entries ih =>
+    obtain ⟨weight, message⟩ := entry
+    simp only [List.cons_append, numerator, List.map_append, product_append, ih,
+      List.map_cons, product_cons]
+    grind
+
+end Algebra
+
+section Fingerprint
+
+variable {W : Type u} [Lean.Grind.CommRing W]
+
+theorem fingerprint_reverse_horner (gamma : Coordinates W) (args : List W) :
+    fingerprint gamma args = args.reverse.foldl (fun acc arg => acc * gamma + Coordinates.ofBase arg) 0 := by
+  simp only [fingerprint, List.foldl_reverse]
+
+theorem fingerprint_nil (gamma : Coordinates W) : fingerprint gamma [] = 0 := rfl
+
+theorem fingerprint_cons (gamma : Coordinates W) (arg : W) (args : List W) :
+    fingerprint gamma (arg :: args) = fingerprint gamma args * gamma + Coordinates.ofBase arg := rfl
+
+theorem fingerprint_trailing_zero (gamma : Coordinates W) (args : List W) :
+    fingerprint gamma (args ++ [0]) = fingerprint gamma args := by
+  induction args with
+  | nil => change 0 * gamma + (0 : Coordinates W) = 0; grind
+  | cons arg args ih => simp only [List.cons_append, fingerprint_cons, ih]
+
+theorem fingerprint_padding (gamma : Coordinates W) (args : List W) (count : Nat) :
+    fingerprint gamma (args ++ List.replicate count 0) = fingerprint gamma args := by
+  induction count with
+  | zero => simp only [List.replicate_zero, List.append_nil]
+  | succ count ih =>
+    rw [List.replicate_succ', ← List.append_assoc, fingerprint_trailing_zero, ih]
+
+end Fingerprint
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/Proofs/LogUpFractions.lean b/Ix/Aiur/Proofs/LogUpFractions.lean
new file mode 100644
index 000000000..e49bca854
--- /dev/null
+++ b/Ix/Aiur/Proofs/LogUpFractions.lean
@@ -0,0 +1,151 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LogUp
+
+/-! Denominator cancellation on base-field trace rows. The coordinate pairs
+then identify with the proved native extension field. This identification
+and cancellation are not applied to arbitrary challenge-field coordinates.
+The pole-free premise remains a cryptographic obligation. -/
+
+namespace Aiur.NativeAIR.LogUp
+
+open ProofCodec (Extension)
+
+/-- The total inverse convention is used only under `PoleFree` below. -/
+def inverseValue (value : Extension) : Extension := value.tryInverse.getD 0
+
+def fractionSum (entries : List (Extension × Extension)) : Extension :=
+  sum (entries.map fun (weight, message) => weight * inverseValue message)
+
+def PoleFree (entries : List (Extension × Extension)) : Prop :=
+  ∀ entry ∈ entries, entry.2 ≠ 0
+
+def fieldEntries (entries : List (Coordinates G × Coordinates G)) : List (Extension × Extension) :=
+  entries.map fun (weight, message) => (weight.toExtension, message.toExtension)
+
+theorem inverseValue_correct (value : Extension) (nonzero : value ≠ 0) :
+    value * inverseValue value = 1 := by
+  obtain ⟨read, correct⟩ := Extension.inverse_correct value nonzero
+  simpa only [inverseValue, read, Option.getD_some] using correct
+
+theorem product_nonzero (values : List Extension) (nonzero : ∀ value ∈ values, value ≠ 0) :
+    product values ≠ 0 := by
+  induction values with
+  | nil => exact Extension.one_ne_zero
+  | cons value values ih =>
+    rw [product_cons]
+    intro zero
+    exact ((Extension.mul_eq_zero_iff _ _).mp zero).elim
+      (nonzero value List.mem_cons_self)
+      (ih (fun value member => nonzero value (List.mem_cons_of_mem _ member)))
+
+theorem poleFree_product (entries : List (Extension × Extension)) (free : PoleFree entries) :
+    product (entries.map Prod.snd) ≠ 0 := by
+  apply product_nonzero
+  intro value member
+  obtain ⟨entry, present, rfl⟩ := List.mem_map.mp member
+  exact free entry present
+
+theorem fractionSum_cons (weight message : Extension) (entries : List (Extension × Extension)) :
+    fractionSum ((weight, message) :: entries) = weight * inverseValue message + fractionSum entries := rfl
+
+theorem fractionSum_append (left right : List (Extension × Extension)) :
+    fractionSum (left ++ right) = fractionSum left + fractionSum right := by
+  induction left with
+  | nil => change fractionSum right = 0 + fractionSum right; grind
+  | cons entry entries ih =>
+    obtain ⟨weight, message⟩ := entry
+    simp only [List.cons_append, fractionSum_cons, ih]
+    grind
+
+theorem fractionSum_clears (entries : List (Extension × Extension)) (free : PoleFree entries) :
+    product (entries.map Prod.snd) * fractionSum entries = numerator entries := by
+  induction entries with
+  | nil => change (1 : Extension) * 0 = 0; grind
+  | cons entry entries ih =>
+    obtain ⟨weight, message⟩ := entry
+    have inverse := inverseValue_correct message (free _ List.mem_cons_self)
+    have tail := ih (fun entry member => free entry (List.mem_cons_of_mem _ member))
+    simp only [List.map_cons, product_cons, fractionSum_cons, numerator]
+    exact clears_cons _ _ _ _ _ _ inverse tail
+
+theorem groupEquation_zero_iff (entries : List (Extension × Extension)) (difference : Extension)
+    (free : PoleFree entries) : groupEquation entries difference = 0 ↔ difference = fractionSum entries := by
+  rw [groupEquation_polynomial, sub_zero_iff]
+  constructor
+  · intro zero
+    apply Extension.mul_left_cancel (poleFree_product entries free)
+    rw [fractionSum_clears entries free]
+    exact zero
+  · intro same
+    rw [same, fractionSum_clears entries free]
+
+theorem product_toExtension (values : List (Coordinates G)) :
+    (product values).toExtension = product (values.map Coordinates.toExtension) := by
+  induction values with
+  | nil => rfl
+  | cons value values ih =>
+    simp only [product_cons, Coordinates.toExtension_mul, List.map_cons, ih]
+
+theorem fieldEntries_messages (entries : List (Coordinates G × Coordinates G)) :
+    (fieldEntries entries).map Prod.snd = (entries.map Prod.snd).map Coordinates.toExtension := by
+  simp only [fieldEntries, List.map_map]
+  rfl
+
+theorem numerator_toExtension (entries : List (Coordinates G × Coordinates G)) :
+    (numerator entries).toExtension = numerator (fieldEntries entries) := by
+  induction entries with
+  | nil => rfl
+  | cons entry entries ih =>
+    obtain ⟨weight, message⟩ := entry
+    change (weight * product (entries.map Prod.snd) + message * numerator entries).toExtension =
+      weight.toExtension * product ((fieldEntries entries).map Prod.snd) +
+        message.toExtension * numerator (fieldEntries entries)
+    rw [Coordinates.toExtension_add, Coordinates.toExtension_mul, Coordinates.toExtension_mul,
+      product_toExtension, fieldEntries_messages, ih]
+
+theorem groupEquation_toExtension (entries : List (Coordinates G × Coordinates G)) (difference : Coordinates G) :
+    (groupEquation entries difference).toExtension = groupEquation (fieldEntries entries) difference.toExtension := by
+  rw [groupEquation_polynomial, groupEquation_polynomial, Coordinates.toExtension_sub,
+    Coordinates.toExtension_mul, product_toExtension, numerator_toExtension, fieldEntries_messages]
+
+theorem coordinate_group_zero_iff (entries : List (Coordinates G × Coordinates G)) (difference : Coordinates G)
+    (free : PoleFree (fieldEntries entries)) :
+    groupEquation entries difference = 0 ↔ difference.toExtension = fractionSum (fieldEntries entries) := by
+  rw [← Coordinates.toExtension_zero_iff, groupEquation_toExtension, groupEquation_zero_iff _ _ free]
+
+theorem coordinate_polynomial_zero_iff (entries : List (Coordinates G × Coordinates G)) (difference : Coordinates G)
+    (free : PoleFree (fieldEntries entries)) :
+    product (entries.map Prod.snd) * difference = numerator entries ↔
+      difference.toExtension = fractionSum (fieldEntries entries) := by
+  have reflected := coordinate_group_zero_iff entries difference free
+  rw [groupEquation_polynomial] at reflected
+  have subtract : product (entries.map Prod.snd) * difference - numerator entries = 0 ↔
+      product (entries.map Prod.snd) * difference = numerator entries := by
+    constructor <;> intro equal <;> grind
+  exact subtract.symm.trans reflected
+
+theorem fingerprint_toExtension (gamma : Coordinates G) (args : List G) :
+    (fingerprint gamma args).toExtension =
+      args.foldr (fun arg acc => acc * gamma.toExtension + Extension.ofBase arg) 0 := by
+  induction args with
+  | nil => rfl
+  | cons arg args ih =>
+    rw [fingerprint_cons, Coordinates.toExtension_add, Coordinates.toExtension_mul, ih]
+    rfl
+
+/-- A zero denominator can make an accumulator step unconstrained. -/
+theorem pole_can_hide_step :
+    groupEquation ([(0, 0)] : List (Extension × Extension)) 1 = 0 ∧
+      (1 : Extension) ≠ fractionSum [(0, 0)] := by
+  constructor
+  · change (0 : Extension) * 1 - 0 = 0; grind
+  · have zero : fractionSum ([(0, 0)] : List (Extension × Extension)) = 0 := by
+      change (0 : Extension) * inverseValue 0 + 0 = 0; grind
+    rw [zero]
+    exact Extension.one_ne_zero
+
+end Aiur.NativeAIR.LogUp
diff --git a/Ix/Aiur/Proofs/Lookup.lean b/Ix/Aiur/Proofs/Lookup.lean
new file mode 100644
index 000000000..01f4a4989
--- /dev/null
+++ b/Ix/Aiur/Proofs/Lookup.lean
@@ -0,0 +1,168 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CallOrder
+
+/-! Exact lookup balance over the actual Goldilocks representation.
+
+Consumer queries have unit weight; providers may have arbitrary field
+multiplicities. A query count below the characteristic cannot disappear by
+modular cancellation, so every queried message has a nonzero provider.
+Instantiating this result with the fixed 256-by-256 byte table recovers byte
+bounds, including the six bytes used by the call-order constraint.
+
+These theorems assume exact message balance. They do not extract that
+balance from a cryptographic transcript or identify the Rust emitter with
+this mathematical interface.
+-/
+
+namespace Aiur
+
+theorem G.zero_add (a : G) : 0 + a = a := by
+  change G.ofNat (0 + a.n) = a
+  simpa only [Nat.zero_add] using G.ofNat_n a
+
+theorem G.ofNat_ne_zero_of_lt {n : Nat} (positive : 0 < n)
+    (bounded : n < gSize.toNat) : G.ofNat n ≠ 0 := by
+  intro h
+  have hn := congrArg G.n h
+  rw [G.n_ofNat, Nat.mod_eq_of_lt bounded] at hn
+  change n = 0 at hn
+  omega
+
+namespace AIR
+
+/-- A supplied message and its return/pull multiplicity. -/
+abbrev Provider (α : Type u) := α × G
+
+/-- Total supplied weight for one exact message. -/
+def suppliedWeight [DecidableEq α] (message : α) (providers : List (Provider α)) : G :=
+  providers.foldr (fun provider rest =>
+    if provider.1 = message then provider.2 + rest else rest) 0
+
+/-- Exact tuple balance, before randomized message compression. Each
+consumer contributes one; arbitrary provider weights are field elements. -/
+def ExactLookupBalance [DecidableEq α] (queries : List α)
+    (providers : List (Provider α)) : Prop :=
+  ∀ message, G.ofNat (queries.count message) = suppliedWeight message providers
+
+/-- The count bound is necessary: exactly one characteristic's worth of
+identical queries has zero field weight, even with no providers. -/
+theorem characteristic_queries_balance [DecidableEq α] (message : α) :
+    ExactLookupBalance (List.replicate gSize.toNat message) [] := by
+  intro query
+  simp only [List.count_replicate, suppliedWeight]
+  split <;> rfl
+
+theorem suppliedWeight_nonzero_provider [DecidableEq α] (message : α)
+    (providers : List (Provider α))
+    (nonzero : suppliedWeight message providers ≠ 0) :
+    ∃ provider ∈ providers, provider.1 = message ∧ provider.2 ≠ 0 := by
+  induction providers with
+  | nil => exact False.elim (nonzero rfl)
+  | cons provider rest ih =>
+    obtain ⟨provided, multiplicity⟩ := provider
+    by_cases same : provided = message
+    · by_cases zero : multiplicity = 0
+      · have hn : suppliedWeight message rest ≠ 0 := by
+          simpa only [suppliedWeight, List.foldr_cons, if_pos same, zero, G.zero_add] using nonzero
+        obtain ⟨provider, member, hm, hw⟩ := ih hn
+        exact ⟨provider, List.mem_cons_of_mem _ member, hm, hw⟩
+      · exact ⟨(provided, multiplicity), List.mem_cons_self, same, zero⟩
+    · have hn : suppliedWeight message rest ≠ 0 := by
+        simpa only [suppliedWeight, List.foldr_cons, if_neg same] using nonzero
+      obtain ⟨provider, member, hm, hw⟩ := ih hn
+      exact ⟨provider, List.mem_cons_of_mem _ member, hm, hw⟩
+
+/-- A bounded positive request cannot be supplied solely by zero weights,
+even when other providers use negative field multiplicities. -/
+theorem exactLookupBalance_provider [DecidableEq α]
+    {queries : List α} {providers : List (Provider α)}
+    (balanced : ExactLookupBalance queries providers)
+    (bounded : queries.length < gSize.toNat) {message : α}
+    (queried : message ∈ queries) :
+    ∃ provider ∈ providers, provider.1 = message ∧ provider.2 ≠ 0 := by
+  have positive : 0 < queries.count message := List.count_pos_iff.mpr queried
+  have countBound : queries.count message < gSize.toNat :=
+    Nat.lt_of_le_of_lt List.count_le_length bounded
+  have nonzero := G.ofNat_ne_zero_of_lt positive countBound
+  rw [balanced message] at nonzero
+  exact suppliedWeight_nonzero_provider message providers nonzero
+
+/-- Row order of the two-byte preprocessed table: outer first byte, inner
+second byte, each ranging from 0 through 255. -/
+def byteRangeMessage (row : Fin 65536) : G × G :=
+  (G.ofNat (row.val / 256), G.ofNat (row.val % 256))
+
+def byteRangeProviders (weights : Fin 65536 → G) : List (Provider (G × G)) :=
+  List.ofFn fun row => (byteRangeMessage row, weights row)
+
+theorem byteRangeMessage_bounded (row : Fin 65536) :
+    (byteRangeMessage row).1.n < 256 ∧ (byteRangeMessage row).2.n < 256 := by
+  have first : row.val / 256 < 256 := by omega
+  have second : row.val % 256 < 256 := Nat.mod_lt _ (by decide)
+  have firstField : row.val / 256 < gSize.toNat := by
+    exact Nat.lt_trans first (by decide)
+  have secondField : row.val % 256 < gSize.toNat := by
+    exact Nat.lt_trans second (by decide)
+  simpa only [byteRangeMessage, G.n_ofNat, Nat.mod_eq_of_lt firstField,
+    Nat.mod_eq_of_lt secondField] using And.intro first second
+
+/-- Exact balance against the fixed byte table establishes both byte
+bounds. The table's multiplicity column remains arbitrary. -/
+theorem exactLookupBalance_byteRange {queries : List (G × G)}
+    (weights : Fin 65536 → G)
+    (balanced : ExactLookupBalance queries (byteRangeProviders weights))
+    (bounded : queries.length < gSize.toNat) {a b : G}
+    (queried : (a, b) ∈ queries) : a.n < 256 ∧ b.n < 256 := by
+  obtain ⟨provider, member, message, _⟩ :=
+    exactLookupBalance_provider balanced bounded queried
+  obtain ⟨row, hrow⟩ := List.mem_ofFn.mp member
+  have same : byteRangeMessage row = (a, b) := by
+    exact (congrArg Prod.fst hrow).trans message
+  simpa only [same] using byteRangeMessage_bounded row
+
+/-- The three pair queries emitted for one six-byte rank or gap. -/
+def rankByteQueries (bytes : Fin 6 → G) : List (G × G) :=
+  [(bytes 0, bytes 1), (bytes 2, bytes 3), (bytes 4, bytes 5)]
+
+theorem exactLookupBalance_rankBytes {queries : List (G × G)}
+    (weights : Fin 65536 → G)
+    (balanced : ExactLookupBalance queries (byteRangeProviders weights))
+    (bounded : queries.length < gSize.toNat) (bytes : Fin 6 → G)
+    (queried : rankByteQueries bytes ⊆ queries) :
+    ∀ i, (bytes i).n < 256 := by
+  have p0 := exactLookupBalance_byteRange weights balanced bounded
+    (queried (by simp [rankByteQueries] : (bytes 0, bytes 1) ∈ rankByteQueries bytes))
+  have p1 := exactLookupBalance_byteRange weights balanced bounded
+    (queried (by simp [rankByteQueries] : (bytes 2, bytes 3) ∈ rankByteQueries bytes))
+  have p2 := exactLookupBalance_byteRange weights balanced bounded
+    (queried (by simp [rankByteQueries] : (bytes 4, bytes 5) ∈ rankByteQueries bytes))
+  intro i
+  have cases : i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 ∨ i = 4 ∨ i = 5 := by omega
+  rcases cases with rfl | rfl | rfl | rfl | rfl | rfl
+  · exact p0.1
+  · exact p0.2
+  · exact p1.1
+  · exact p1.2
+  · exact p2.1
+  · exact p2.2
+
+theorem exactLookupBalance_call_order {queries : List (G × G)}
+    (weights : Fin 65536 → G)
+    (balanced : ExactLookupBalance queries (byteRangeProviders weights))
+    (bounded : queries.length < gSize.toNat) (parent child gap : Fin 6 → G)
+    (hp : rankByteQueries parent ⊆ queries)
+    (hc : rankByteQueries child ⊆ queries)
+    (hg : rankByteQueries gap ⊆ queries)
+    (satisfied : callOrderConstraint (packRank parent) (packRank child) (packRank gap) = 0) :
+    (packRank parent).n < (packRank child).n :=
+  packed_call_order_strict parent child gap
+    (exactLookupBalance_rankBytes weights balanced bounded parent hp)
+    (exactLookupBalance_rankBytes weights balanced bounded child hc)
+    (exactLookupBalance_rankBytes weights balanced bounded gap hg) satisfied
+
+end AIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/LookupBudget.lean b/Ix/Aiur/Proofs/LookupBudget.lean
new file mode 100644
index 000000000..7a3ff6c9f
--- /dev/null
+++ b/Ix/Aiur/Proofs/LookupBudget.lean
@@ -0,0 +1,268 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.GlobalLookups
+
+/-!
+The native verifier's conservative lookup-consumer budget.
+
+Canonical slot counts and active-order trace heights determine the bound:
+one public claim plus every lookup slot in every active trace row. The total
+natural-number model below checks sequence alignment, shift bounds and the
+strict field-characteristic bound. Its accepted arithmetic fits the native
+checked u64 operations. The component gate compares both implementations.
+
+Interpreting actual consumer multiplicities as zero or one and counting them
+within these slots still belongs to native AIR extraction. These definitions
+and comparisons are not a proof of Rust execution refinement.
+-/
+
+namespace Aiur
+
+/-- Canonical circuit slot counts and the activation bitmap consume trace
+degrees in active order. Missing, extra and misaligned entries fail. -/
+def lookupSlotSum : List Nat → List Bool → List Nat → Option Nat
+  | [], [], [] => some 0
+  | _ :: slots, false :: active, degrees => lookupSlotSum slots active degrees
+  | slots :: rest, true :: active, degree :: degrees => do
+    let tail ← lookupSlotSum rest active degrees
+    pure (2 ^ degree * slots + tail)
+  | _, _, _ => none
+
+def lookupQueryBoundAux : List Nat → List Bool → List Nat → Nat → Option Nat
+  | [], [], [], used => some used
+  | _ :: slots, false :: active, degrees, used => lookupQueryBoundAux slots active degrees used
+  | slots :: rest, true :: active, degree :: degrees, used =>
+    if degree < 64 then
+      let next := used + 2 ^ degree * slots
+      if next < gSize.toNat then lookupQueryBoundAux rest active degrees next else none
+    else none
+  | _, _, _, _ => none
+
+/-- Total natural-number mirror of the native checked-u64 budget guard.
+Counting every slot includes providers and bounds unit consumers from above.
+The initial one is the single public claim. -/
+def lookupQueryBound (slots : List Nat) (active : List Bool) (degrees : List Nat) : Option Nat :=
+  if active.any id then lookupQueryBoundAux slots active degrees 1 else none
+
+theorem lookupQueryBoundAux_sound {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {used result : Nat} (below : used < gSize.toNat)
+    (accepted : lookupQueryBoundAux slots active degrees used = some result) :
+    ∃ total, lookupSlotSum slots active degrees = some total ∧ result = used + total ∧
+      result < gSize.toNat := by
+  induction slots generalizing active degrees used with
+  | nil =>
+    cases active <;> cases degrees <;> simp only [lookupQueryBoundAux, reduceCtorEq] at accepted
+    cases accepted
+    exact ⟨0, rfl, by omega, below⟩
+  | cons count slots ih =>
+    cases active with
+    | nil => simp only [lookupQueryBoundAux, reduceCtorEq] at accepted
+    | cons enabled active =>
+      cases enabled with
+      | false => exact ih below accepted
+      | true =>
+        cases degrees with
+        | nil => simp only [lookupQueryBoundAux, reduceCtorEq] at accepted
+        | cons degree degrees =>
+          simp only [lookupQueryBoundAux] at accepted
+          split at accepted
+          next degreeBound =>
+            split at accepted
+            next nextBound =>
+              obtain ⟨total, shape, sum, bounded⟩ := ih nextBound accepted
+              refine ⟨2 ^ degree * count + total, ?_, by omega, bounded⟩
+              simp only [lookupSlotSum, shape, bind, Option.bind, pure]
+            next => contradiction
+          next => contradiction
+
+theorem lookupQueryBound_sound {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {result : Nat} (accepted : lookupQueryBound slots active degrees = some result) :
+    active.any id = true ∧ ∃ total, lookupSlotSum slots active degrees = some total ∧
+      result = 1 + total ∧ result < gSize.toNat := by
+  simp only [lookupQueryBound] at accepted
+  split at accepted
+  next enabled => exact ⟨enabled, lookupQueryBoundAux_sound (by decide) accepted⟩
+  next => contradiction
+
+theorem lookupQueryBound_consumer_count {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {result total : Nat} (accepted : lookupQueryBound slots active degrees = some result)
+    (shape : lookupSlotSum slots active degrees = some total)
+    {α : Type u} (queries : List α) (perSlot : queries.length ≤ total) :
+    (queries.length + 1) < gSize.toNat := by
+  obtain ⟨_, sum, sameShape, sameResult, below⟩ := lookupQueryBound_sound accepted
+  have equal := Option.some.inj (sameShape.symm.trans shape)
+  omega
+
+theorem lookupQueryBoundAux_shape {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {used result : Nat} (accepted : lookupQueryBoundAux slots active degrees used = some result) :
+    slots.length = active.length ∧ degrees.length = active.count true ∧
+      ∀ degree ∈ degrees, degree < 64 := by
+  induction slots generalizing active degrees used with
+  | nil =>
+    cases active <;> cases degrees <;> simp only [lookupQueryBoundAux, reduceCtorEq] at accepted
+    exact ⟨rfl, rfl, by simp only [List.not_mem_nil, false_implies, implies_true]⟩
+  | cons count slots ih =>
+    cases active with
+    | nil => simp only [lookupQueryBoundAux, reduceCtorEq] at accepted
+    | cons enabled active =>
+      cases enabled with
+      | false =>
+        obtain ⟨aligned, degreesCount, bounded⟩ := ih accepted
+        refine ⟨by simpa only [List.length_cons] using congrArg Nat.succ aligned, ?_, bounded⟩
+        simpa only [List.count_cons, beq_iff_eq, Bool.false_eq_true, ↓reduceIte, Nat.add_zero]
+          using degreesCount
+      | true =>
+        cases degrees with
+        | nil => simp only [lookupQueryBoundAux, reduceCtorEq] at accepted
+        | cons degree degrees =>
+          simp only [lookupQueryBoundAux] at accepted
+          split at accepted
+          next degreeBound =>
+            split at accepted
+            next =>
+              obtain ⟨aligned, degreesCount, bounded⟩ := ih accepted
+              refine ⟨by simpa only [List.length_cons] using congrArg Nat.succ aligned, ?_, ?_⟩
+              · simpa only [List.length_cons, List.count_cons, beq_iff_eq, ↓reduceIte, Nat.succ_eq_add_one]
+                  using congrArg Nat.succ degreesCount
+              · intro d member
+                rcases List.mem_cons.mp member with same | later
+                · exact same ▸ degreeBound
+                · exact bounded d later
+            next => contradiction
+          next => contradiction
+
+theorem lookupQueryBound_shape {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {result : Nat} (accepted : lookupQueryBound slots active degrees = some result) :
+    active.any id = true ∧ slots.length = active.length ∧
+      degrees.length = active.count true ∧ ∀ degree ∈ degrees, degree < 64 := by
+  simp only [lookupQueryBound] at accepted
+  split at accepted
+  next enabled => exact ⟨enabled, lookupQueryBoundAux_shape accepted⟩
+  next => contradiction
+
+/-- A step admitted by the natural-number guard fits both native checked
+u64 operations. Arithmetic overflow can never turn a rejected sum into an
+accepted smaller count. -/
+theorem lookupQueryBound_step_no_overflow {used height slots : Nat}
+    (accepted : used + height * slots < gSize.toNat) :
+    height * slots < 2 ^ 64 ∧ used + height * slots < 2 ^ 64 := by
+  have modulus : gSize.toNat < 2 ^ 64 := by decide +kernel
+  omega
+
+theorem lookupQueryBoundAux_complete {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {used total : Nat} (shape : lookupSlotSum slots active degrees = some total)
+    (degreesBound : ∀ degree ∈ degrees, degree < 64)
+    (bounded : used + total < gSize.toNat) :
+    lookupQueryBoundAux slots active degrees used = some (used + total) := by
+  induction slots generalizing active degrees used total with
+  | nil =>
+    cases active <;> cases degrees <;> simp only [lookupSlotSum, reduceCtorEq] at shape
+    cases shape
+    rfl
+  | cons count slots ih =>
+    cases active with
+    | nil => simp only [lookupSlotSum, reduceCtorEq] at shape
+    | cons enabled active =>
+      cases enabled with
+      | false => exact ih shape degreesBound bounded
+      | true =>
+        cases degrees with
+        | nil => simp only [lookupSlotSum, reduceCtorEq] at shape
+        | cons degree degrees =>
+          cases tail : lookupSlotSum slots active degrees with
+          | none => simp only [lookupSlotSum, tail, bind, Option.bind, reduceCtorEq] at shape
+          | some rest =>
+            have totalEq : 2 ^ degree * count + rest = total := by
+              simpa only [lookupSlotSum, tail, bind, Option.bind, pure, Option.some.injEq] using shape
+            have nextBound : used + 2 ^ degree * count < gSize.toNat := by omega
+            have continued := ih tail
+              (fun d member => degreesBound d (List.mem_cons_of_mem degree member))
+              (used := used + 2 ^ degree * count) (by omega)
+            simp only [lookupQueryBoundAux, if_pos (degreesBound degree List.mem_cons_self),
+              if_pos nextBound, continued]
+            congr 1
+            omega
+
+theorem lookupQueryBound_complete {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {total : Nat} (enabled : active.any id = true)
+    (shape : lookupSlotSum slots active degrees = some total)
+    (degreesBound : ∀ degree ∈ degrees, degree < 64)
+    (bounded : 1 + total < gSize.toNat) :
+    lookupQueryBound slots active degrees = some (1 + total) := by
+  simp only [lookupQueryBound, enabled, ↓reduceIte]
+  exact lookupQueryBoundAux_complete shape degreesBound bounded
+
+theorem lookupSlotSum_bounded {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {total maxSlots maxDegree : Nat} (shape : lookupSlotSum slots active degrees = some total)
+    (slotsBound : ∀ count ∈ slots, count ≤ maxSlots)
+    (degreesBound : ∀ degree ∈ degrees, degree ≤ maxDegree) :
+    total ≤ slots.length * (2 ^ maxDegree * maxSlots) := by
+  induction slots generalizing active degrees total with
+  | nil =>
+    cases active <;> cases degrees <;> simp only [lookupSlotSum, reduceCtorEq] at shape
+    cases shape
+    exact Nat.zero_le _
+  | cons count slots ih =>
+    have tailSlots : ∀ n ∈ slots, n ≤ maxSlots :=
+      fun n member => slotsBound n (List.mem_cons_of_mem count member)
+    cases active with
+    | nil => simp only [lookupSlotSum, reduceCtorEq] at shape
+    | cons enabled active =>
+      cases enabled with
+      | false =>
+        have bound := ih shape tailSlots degreesBound
+        simp only [List.length_cons, Nat.add_mul]
+        omega
+      | true =>
+        cases degrees with
+        | nil => simp only [lookupSlotSum, reduceCtorEq] at shape
+        | cons degree degrees =>
+          cases tail : lookupSlotSum slots active degrees with
+          | none => simp only [lookupSlotSum, tail, bind, Option.bind, reduceCtorEq] at shape
+          | some rest =>
+            have totalEq : 2 ^ degree * count + rest = total := by
+              simpa only [lookupSlotSum, tail, bind, Option.bind, pure, Option.some.injEq] using shape
+            have tailBound := ih tail tailSlots
+              (fun d member => degreesBound d (List.mem_cons_of_mem degree member))
+            have powerBound : 2 ^ degree ≤ 2 ^ maxDegree :=
+              Nat.pow_le_pow_right (by decide) (degreesBound degree List.mem_cons_self)
+            have headBound := Nat.mul_le_mul powerBound (slotsBound count List.mem_cons_self)
+            simp only [List.length_cons, Nat.add_mul]
+            omega
+
+/-- Version-five keys encode circuit and slot counts as u16. Together with
+Goldilocks' maximum 2^32 trace height, those format limits already leave a
+strict margin below the characteristic. The explicit budget guard preserves
+every such well-shaped proof, independently of its chosen activation subset. -/
+theorem lookupQueryBound_encodedKey {slots : List Nat} {active : List Bool} {degrees : List Nat}
+    {total : Nat} (enabled : active.any id = true)
+    (shape : lookupSlotSum slots active degrees = some total)
+    (circuitCount : slots.length < 65536)
+    (slotsBound : ∀ count ∈ slots, count < 65536)
+    (degreesBound : ∀ degree ∈ degrees, degree ≤ 32) :
+    lookupQueryBound slots active degrees = some (1 + total) := by
+  apply lookupQueryBound_complete enabled shape
+    (fun degree member => Nat.lt_of_le_of_lt (degreesBound degree member) (by decide))
+  have totalBound := lookupSlotSum_bounded shape (maxSlots := 65535)
+    (fun count member => Nat.le_sub_one_of_lt (slotsBound count member)) degreesBound
+  have countBound : slots.length ≤ 65535 := by omega
+  have outerBound := Nat.mul_le_mul_right (2 ^ 32 * 65535) countBound
+  have margin : 1 + 65535 * (2 ^ 32 * 65535) < gSize.toNat := by decide +kernel
+  omega
+
+/-- The checked native budget supplies the global count premise once local
+AIR extraction bounds internal unit consumers by the trace's slot total. -/
+theorem AIR.GlobalLookups.of_budget {tables : AIR.LookupTables} {width : Nat}
+    {slots : List Nat} {active : List Bool} {degrees : List Nat} {result total : Nat}
+    (accepted : lookupQueryBound slots active degrees = some result)
+    (shape : lookupSlotSum slots active degrees = some total)
+    (root : List G) (queries : List (List G)) (perSlot : queries.length ≤ total)
+    (balance : AIR.PaddedLookupBalance width (root :: queries) tables.providers)
+    (widths : ∀ query ∈ root :: queries, query.length ≤ width) :
+    AIR.GlobalLookups tables width (root :: queries) :=
+  ⟨balance, lookupQueryBound_consumer_count accepted shape queries perSlot, widths⟩
+
+end Aiur
diff --git a/Ix/Aiur/Proofs/LookupCoordinates.lean b/Ix/Aiur/Proofs/LookupCoordinates.lean
new file mode 100644
index 000000000..512859400
--- /dev/null
+++ b/Ix/Aiur/Proofs/LookupCoordinates.lean
@@ -0,0 +1,199 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.LookupCoordinates
+import Ix.Aiur.Proofs.ExtensionField
+
+/-! Ring laws for the separate logUp coordinates, and the field identification
+available on base-field trace rows. No field instance is assigned to coordinates
+over the challenge field. -/
+
+namespace Aiur.NativeAIR.LogUp.Coordinates
+
+theorem ext {a b : Coordinates W} (first : a.c0 = b.c0) (second : a.c1 = b.c1) : a = b := by
+  cases a; cases b; cases first; cases second; rfl
+
+theorem zero_iff [OfNat W 0] (a : Coordinates W) : a = 0 ↔ a.c0 = 0 ∧ a.c1 = 0 := by
+  constructor
+  · intro same; cases same; exact ⟨rfl, rfl⟩
+  · exact fun same => ext same.1 same.2
+
+theorem flatten_length (values : List (Coordinates W)) : (flatten values).length = 2 * values.length := by
+  induction values with
+  | nil => rfl
+  | cons value values ih => simp only [flatten, List.flatMap_cons, List.length_append,
+      List.length_cons, List.length_nil] at *; omega
+
+theorem flatten_zero_iff [OfNat W 0] (values : List (Coordinates W)) :
+    (∀ x ∈ flatten values, x = 0) ↔ ∀ value ∈ values, value = 0 := by
+  constructor
+  · intro zero value member
+    apply (zero_iff value).mpr
+    exact ⟨zero _ (List.mem_flatMap.mpr ⟨value, member, by simp⟩),
+      zero _ (List.mem_flatMap.mpr ⟨value, member, by simp⟩)⟩
+  · intro zero x member
+    obtain ⟨value, present, coordinate⟩ := List.mem_flatMap.mp member
+    cases zero value present
+    change x ∈ [(0 : W), 0] at coordinate
+    simpa only [List.mem_cons, List.not_mem_nil, or_false, or_self] using coordinate
+
+section Algebra
+
+variable {W : Type u} [Lean.Grind.CommRing W]
+
+attribute [local instance] Lean.Grind.Semiring.natCast Lean.Grind.Ring.intCast
+
+theorem mul_schoolbook (a b : Coordinates W) :
+    a * b = ⟨a.c0 * b.c0 + 7 * a.c1 * b.c1, a.c0 * b.c1 + a.c1 * b.c0⟩ := by
+  apply ext
+  · change a.c0 * b.c0 + (a.c1 * b.c1) * 7 = _; grind
+  · change (a.c0 + a.c1) * (b.c0 + b.c1) - a.c0 * b.c0 - a.c1 * b.c1 = _; grind
+
+theorem add_zero (a : Coordinates W) : a + 0 = a := by
+  apply ext <;> change _ + (0 : W) = _ <;> grind
+
+theorem add_comm (a b : Coordinates W) : a + b = b + a := by
+  apply ext <;> change (_ : W) + _ = _ + _ <;> grind
+
+theorem add_assoc (a b c : Coordinates W) : a + b + c = a + (b + c) := by
+  apply ext <;> change (_ : W) + _ + _ = _ + (_ + _) <;> grind
+
+theorem mul_one (a : Coordinates W) : a * 1 = a := by
+  rw [mul_schoolbook]
+  apply ext
+  · change a.c0 * 1 + 7 * a.c1 * 0 = a.c0; grind
+  · change a.c0 * 0 + a.c1 * 1 = a.c1; grind
+
+theorem mul_zero (a : Coordinates W) : a * 0 = 0 := by
+  rw [mul_schoolbook]
+  apply ext
+  · change a.c0 * 0 + 7 * a.c1 * 0 = (0 : W); grind
+  · change a.c0 * 0 + a.c1 * 0 = (0 : W); grind
+
+theorem mul_comm (a b : Coordinates W) : a * b = b * a := by
+  rw [mul_schoolbook, mul_schoolbook]
+  apply ext <;> dsimp only <;> grind
+
+theorem mul_assoc (a b c : Coordinates W) : a * b * c = a * (b * c) := by
+  simp only [mul_schoolbook]
+  apply ext <;> dsimp only <;> grind
+
+theorem left_distrib (a b c : Coordinates W) : a * (b + c) = a * b + a * c := by
+  simp only [mul_schoolbook]
+  apply ext
+  · change a.c0 * (b.c0 + c.c0) + 7 * a.c1 * (b.c1 + c.c1) =
+      (a.c0 * b.c0 + 7 * a.c1 * b.c1) + (a.c0 * c.c0 + 7 * a.c1 * c.c1)
+    grind
+  · change a.c0 * (b.c1 + c.c1) + a.c1 * (b.c0 + c.c0) =
+      (a.c0 * b.c1 + a.c1 * b.c0) + (a.c0 * c.c1 + a.c1 * c.c0)
+    grind
+
+theorem neg_add_cancel (a : Coordinates W) : -a + a = 0 := by
+  apply ext <;> change -(_ : W) + _ = 0 <;> grind
+
+theorem sub_eq_add_neg (a b : Coordinates W) : a - b = a + -b := by
+  apply ext <;> change (_ : W) - _ = _ + -_ <;> grind
+
+theorem ofBase_add (a b : W) : ofBase (a + b) = ofBase a + ofBase b := by
+  apply ext
+  · rfl
+  · change (0 : W) = 0 + 0; grind
+
+theorem ofBase_neg (a : W) : ofBase (-a) = -ofBase a := by
+  apply ext
+  · rfl
+  · change (0 : W) = -0; grind
+
+theorem ofBase_mul (a b : W) : ofBase (a * b) = ofBase a * ofBase b := by
+  rw [mul_schoolbook]
+  apply ext
+  · change a * b = a * b + 7 * 0 * 0; grind
+  · change (0 : W) = a * 0 + 0 * b; grind
+
+instance natCast : NatCast (Coordinates W) := ⟨fun n => ofBase (Nat.cast n)⟩
+instance intCast : IntCast (Coordinates W) := ⟨fun n => ofBase (Int.cast n)⟩
+instance nsmul : SMul Nat (Coordinates W) := ⟨fun n a => ofBase (Nat.cast n) * a⟩
+instance zsmul : SMul Int (Coordinates W) := ⟨fun n a => ofBase (Int.cast n) * a⟩
+instance npow : HPow (Coordinates W) Nat (Coordinates W) := ⟨fun a n => npowRec n a⟩
+
+theorem neg_mul (a b : Coordinates W) : -a * b = -(a * b) := by
+  simp only [mul_schoolbook]
+  apply ext
+  · change -a.c0 * b.c0 + 7 * -a.c1 * b.c1 = -(a.c0 * b.c0 + 7 * a.c1 * b.c1); grind
+  · change -a.c0 * b.c1 + -a.c1 * b.c0 = -(a.c0 * b.c1 + a.c1 * b.c0); grind
+
+instance commRing : Lean.Grind.CommRing (Coordinates W) where
+  add_zero := add_zero
+  add_comm := add_comm
+  add_assoc := add_assoc
+  mul_assoc := mul_assoc
+  mul_comm := mul_comm
+  mul_one := mul_one
+  left_distrib := left_distrib
+  zero_mul a := by rw [mul_comm, mul_zero]
+  mul_zero := mul_zero
+  pow_zero _ := rfl
+  pow_succ _ _ := rfl
+  ofNat_succ n := by
+    change ofBase (OfNat.ofNat (n + 1) : W) = ofBase (OfNat.ofNat n : W) + ofBase (1 : W)
+    rw [Lean.Grind.Semiring.ofNat_succ, ofBase_add]
+  ofNat_eq_natCast n := by
+    change ofBase (OfNat.ofNat n : W) = ofBase (Nat.cast n : W)
+    rw [Lean.Grind.Semiring.ofNat_eq_natCast]
+  neg_add_cancel := neg_add_cancel
+  sub_eq_add_neg := sub_eq_add_neg
+  intCast_neg n := by
+    change ofBase (Int.cast (-n) : W) = -ofBase (Int.cast n : W)
+    rw [Lean.Grind.Ring.intCast_neg, ofBase_neg]
+  intCast_ofNat n := by
+    change ofBase (Int.cast (OfNat.ofNat n) : W) = ofBase (OfNat.ofNat n : W)
+    rw [Lean.Grind.Ring.intCast_ofNat]
+  zsmul_natCast_eq_nsmul n a := by
+    change ofBase (Int.cast (Nat.cast n) : W) * a = ofBase (Nat.cast n : W) * a
+    rw [Lean.Grind.Ring.intCast_natCast]
+  neg_zsmul n a := by
+    change ofBase (Int.cast (-n) : W) * a = -(ofBase (Int.cast n : W) * a)
+    rw [Lean.Grind.Ring.intCast_neg, ofBase_neg, neg_mul]
+
+theorem scale_eq_mul (a : Coordinates W) (b : W) : a.scale b = a * ofBase b := by
+  rw [mul_schoolbook]
+  apply ext
+  · change a.c0 * b = a.c0 * b + 7 * a.c1 * 0; grind
+  · change a.c1 * b = a.c0 * 0 + a.c1 * b; grind
+
+end Algebra
+
+theorem toExtension_injective {a b : Coordinates G} (same : a.toExtension = b.toExtension) : a = b :=
+  ext (congrArg ProofCodec.Extension.c0 same) (congrArg ProofCodec.Extension.c1 same)
+
+theorem toExtension_fromExtension (a : ProofCodec.Extension) : (fromExtension a).toExtension = a := rfl
+
+theorem fromExtension_toExtension (a : Coordinates G) : fromExtension a.toExtension = a := rfl
+
+theorem toExtension_zero_iff (a : Coordinates G) : a.toExtension = 0 ↔ a = 0 :=
+  ⟨fun same => toExtension_injective (b := 0) same, fun same => same ▸ rfl⟩
+
+theorem toExtension_ofBase (a : G) : (ofBase a).toExtension = ProofCodec.Extension.ofBase a := rfl
+theorem toExtension_add (a b : Coordinates G) : (a + b).toExtension = a.toExtension + b.toExtension := rfl
+theorem toExtension_sub (a b : Coordinates G) : (a - b).toExtension = a.toExtension - b.toExtension := rfl
+
+theorem toExtension_mul (a b : Coordinates G) : (a * b).toExtension = a.toExtension * b.toExtension := by
+  rw [mul_schoolbook]
+  apply ProofCodec.Extension.ext
+  · change a.c0 * b.c0 + 7 * a.c1 * b.c1 = a.c0 * b.c0 + a.c1 * (b.c1 * 7); grind
+  · rfl
+
+/-- Over challenge-field coordinates, combining them with the basis loses a
+constraint: this nonzero pair combines to zero. -/
+theorem collapse_loses_constraint :
+    let a : Coordinates ProofCodec.Extension := ⟨-ProofCodec.Extension.basis, 1⟩
+    a ≠ 0 ∧ a.c0 + a.c1 * ProofCodec.Extension.basis = 0 := by
+  constructor
+  · intro same
+    exact ProofCodec.Extension.one_ne_zero (congrArg Coordinates.c1 same)
+  · change -ProofCodec.Extension.basis + 1 * ProofCodec.Extension.basis = 0
+    grind
+
+end Aiur.NativeAIR.LogUp.Coordinates
diff --git a/Ix/Aiur/Proofs/LookupExpressions.lean b/Ix/Aiur/Proofs/LookupExpressions.lean
new file mode 100644
index 000000000..b914a9738
--- /dev/null
+++ b/Ix/Aiur/Proofs/LookupExpressions.lean
@@ -0,0 +1,248 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationSequences
+import Ix.Aiur.Proofs.GraphCompilation
+import Ix.Aiur.Proofs.QuerySlotMessages
+
+/-!
+Native lookup argument gating and accumulation, retaining exact frontend
+expression trees. A slot's evaluation is the existing valued multiplicity
+and combined message, including unequal message widths and repeated writers.
+The resulting expression lookups feed the checked base-graph compiler.
+-/
+
+namespace Aiur.NativeAIR
+namespace LookupEmitter
+open OpEmitter Compiler
+
+def addArgs : List Expr → List Expr → List Expr
+  | [], right => right
+  | left, [] => left
+  | x :: left, y :: right => x.frontAdd y :: addArgs left right
+
+def gateArgs (branchless : Bool) (selector : Expr) (args : List Expr) : List Expr :=
+  if branchless then args else args.map selector.frontMul
+
+theorem addArgs_eval {values : Values G} {left right : List Expr} {a b : List G}
+    (leftEval : left.mapM (evalExpr values) = some a)
+    (rightEval : right.mapM (evalExpr values) = some b) :
+    (addArgs left right).mapM (evalExpr values) = some (AIR.addMessages a b) := by
+  induction left generalizing right a b with
+  | nil =>
+    cases leftEval
+    exact rightEval
+  | cons x left ih =>
+    cases right with
+    | nil =>
+      cases rightEval
+      have empty : AIR.addMessages a [] = a := by cases a <;> rfl
+      simpa only [addArgs, List.reverse_nil, empty] using leftEval
+    | cons y right =>
+      simp only [List.mapM_cons, bind, Option.bind] at leftEval rightEval
+      split at leftEval
+      · cases leftEval
+      rename_i xValue xEval
+      dsimp only at leftEval
+      split at leftEval
+      · cases leftEval
+      rename_i leftValues leftValuesEval
+      cases leftEval
+      split at rightEval
+      · cases rightEval
+      rename_i yValue yEval
+      dsimp only at rightEval
+      split at rightEval
+      · cases rightEval
+      rename_i rightValues rightValuesEval
+      cases rightEval
+      simp only [addArgs, AIR.addMessages, List.mapM_cons,
+        Expr.frontAdd_eval goldilocksLaws values xEval yEval,
+        ih leftValuesEval rightValuesEval, bind, Option.bind_some, pure, goldilocks_add]
+
+theorem gateArgs_eval (branchless : Bool) {values : Values G} {selector : Expr} {s : G}
+    {args : List Expr} {results : List G} (selectorEval : evalExpr values selector = some s)
+    (argsEval : args.mapM (evalExpr values) = some results) :
+    (gateArgs branchless selector args).mapM (evalExpr values) =
+      some (AIR.gateMessage branchless s results) := by
+  cases branchless with
+  | true => exact argsEval
+  | false =>
+    exact list_mapM_transform argsEval selector.frontMul (s * ·) (evalExpr values)
+      (fun _ _ evaluated => Expr.frontMul_eval goldilocksLaws values selectorEval evaluated)
+
+structure QueryExpr where
+  slot : Nat
+  selector : Expr
+  message : List Expr
+
+def QueryExpr.eval (values : Values G) (query : QueryExpr) : Option AIR.QueryPart := do
+  let selector ← evalExpr values query.selector
+  let message ← query.message.mapM (evalExpr values)
+  return ⟨query.slot, selector, message⟩
+
+theorem QueryExpr.eval_components {values : Values G} {query : QueryExpr} {result : AIR.QueryPart}
+    (evaluated : query.eval values = some result) :
+    query.slot = result.slot ∧ evalExpr values query.selector = some result.selector ∧
+      query.message.mapM (evalExpr values) = some result.message := by
+  simp only [QueryExpr.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i selector selectorEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i message messageEval
+  cases evaluated
+  exact ⟨rfl, selectorEval, messageEval⟩
+
+def queryParts (slot : Nat) (selector : Expr) (queries : List (List Expr)) : List QueryExpr :=
+  queries.mapIdx fun index message => ⟨slot + index, selector, message⟩
+
+theorem queryParts_cons (slot : Nat) (selector : Expr) (message : List Expr) (queries : List (List Expr)) :
+    queryParts slot selector (message :: queries) =
+      ⟨slot, selector, message⟩ :: queryParts (slot + 1) selector queries := by
+  simp [queryParts, List.mapIdx_cons, Nat.add_comm, Nat.add_left_comm]
+
+theorem queryParts_eval {values : Values G} {selector : Expr} {s : G}
+    {queries : List (List Expr)} {messages : List (List G)}
+    (selectorEval : evalExpr values selector = some s)
+    (evaluated : queries.mapM (List.mapM (evalExpr values)) = some messages) (slot : Nat) :
+    (queryParts slot selector queries).mapM (QueryExpr.eval values) =
+      some (AIR.queryParts slot s messages) := by
+  induction queries generalizing messages slot with
+  | nil =>
+    cases evaluated
+    rfl
+  | cons query queries ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i message messageEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i rest restEval
+    cases evaluated
+    rw [queryParts_cons, AIR.queryParts_cons]
+    have head : (QueryExpr.mk slot selector query).eval values = some ⟨slot, s, message⟩ := by
+      simp only [QueryExpr.eval, selectorEval, messageEval, bind, Option.bind_some, pure]
+    simp only [List.mapM_cons, head, ih restEval, bind, Option.bind_some, pure]
+
+def accumulate (branchless : Bool) (lookup : ExprLookup) (query : QueryExpr) : ExprLookup :=
+  ⟨lookup.multiplicity.frontAdd query.selector,
+    addArgs lookup.args (gateArgs branchless query.selector query.message)⟩
+
+theorem accumulate_eval (branchless : Bool) {values : Values G}
+    {lookup : ExprLookup} {query : QueryExpr} {initial : G × List G} {part : AIR.QueryPart}
+    (initialEval : lookup.eval goldilocksOps values = some initial)
+    (queryEval : query.eval values = some part) :
+    (accumulate branchless lookup query).eval goldilocksOps values =
+      some (initial.1 + part.selector,
+        AIR.addMessages initial.2 (AIR.gateMessage branchless part.selector part.message)) := by
+  obtain ⟨_, selectorEval, messageEval⟩ := QueryExpr.eval_components queryEval
+  simp only [ExprLookup.eval, bind, Option.bind] at initialEval
+  split at initialEval
+  · cases initialEval
+  rename_i multiplicity multiplicityEval
+  dsimp only at initialEval
+  split at initialEval
+  · cases initialEval
+  rename_i args argsEval
+  cases initialEval
+  have weight := Expr.frontAdd_eval goldilocksLaws values multiplicityEval selectorEval
+  have message := addArgs_eval argsEval (gateArgs_eval branchless selectorEval messageEval)
+  simp only [accumulate, ExprLookup.eval, weight, show evalExprs goldilocksOps values
+    (addArgs lookup.args (gateArgs branchless query.selector query.message)) =
+      some (AIR.addMessages args (AIR.gateMessage branchless part.selector part.message)) from message,
+    bind, Option.bind_some, pure, goldilocks_add]
+
+def valuedAccumulate (branchless : Bool) (lookup : G × List G) (query : AIR.QueryPart) : G × List G :=
+  (lookup.1 + query.selector, AIR.addMessages lookup.2 (AIR.gateMessage branchless query.selector query.message))
+
+theorem fold_eval (branchless : Bool) {values : Values G}
+    {queries : List QueryExpr} {parts : List AIR.QueryPart}
+    (evaluated : queries.mapM (QueryExpr.eval values) = some parts)
+    {initial : ExprLookup} {start : G × List G} (initialEval : initial.eval goldilocksOps values = some start) :
+    (queries.foldl (accumulate branchless) initial).eval goldilocksOps values =
+      some (parts.foldl (valuedAccumulate branchless) start) := by
+  induction queries generalizing parts initial start with
+  | nil =>
+    cases evaluated
+    exact initialEval
+  | cons query queries ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i part partEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i rest restEval
+    cases evaluated
+    exact ih restEval (accumulate_eval branchless initialEval partEval)
+
+theorem filter_eval {values : Values G} {queries : List QueryExpr} {parts : List AIR.QueryPart}
+    (evaluated : queries.mapM (QueryExpr.eval values) = some parts) (slot : Nat) :
+    (queries.filter (fun query => query.slot == slot)).mapM (QueryExpr.eval values) =
+      some (parts.filter fun query => query.slot == slot) := by
+  induction queries generalizing parts with
+  | nil =>
+    cases evaluated
+    rfl
+  | cons query queries ih =>
+    simp only [List.mapM_cons, bind, Option.bind] at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i part partEval
+    dsimp only at evaluated
+    split at evaluated
+    · cases evaluated
+    rename_i rest restEval
+    cases evaluated
+    have same := (QueryExpr.eval_components partEval).1
+    simp only [List.filter_cons, same]
+    split
+    · simp only [List.mapM_cons, partEval, ih restEval, bind, Option.bind_some, pure]
+    · exact ih restEval
+
+theorem valuedFold_eq (branchless : Bool) (parts : List AIR.QueryPart) (start : G × List G) :
+    parts.foldl (valuedAccumulate branchless) start =
+      ((parts.map AIR.QueryPart.selector).foldl (· + ·) start.1,
+        (parts.map fun part => (part.selector, part.message)).foldl
+          (fun args part => AIR.addMessages args (AIR.gateMessage branchless part.1 part.2)) start.2) := by
+  induction parts generalizing start with
+  | nil => rfl
+  | cons part parts ih => exact ih _
+
+def slot (branchless : Bool) (queries : List QueryExpr) (index : Nat) : ExprLookup :=
+  (queries.filter fun query => query.slot == index).foldl (accumulate branchless) ⟨.konst 0, []⟩
+
+theorem slot_eval (branchless : Bool) {values : Values G}
+    {queries : List QueryExpr} {parts : List AIR.QueryPart}
+    (evaluated : queries.mapM (QueryExpr.eval values) = some parts) (index : Nat) :
+    (slot branchless queries index).eval goldilocksOps values =
+      some (AIR.querySlotMultiplicity parts index,
+        AIR.slotMessage branchless (AIR.querySlotParts parts index)) := by
+  have result := fold_eval branchless (filter_eval evaluated index)
+    (show (ExprLookup.mk (.konst 0) []).eval goldilocksOps values = some (0, []) from rfl)
+  rw [valuedFold_eq] at result
+  simpa only [slot, AIR.querySlotMultiplicity, AIR.querySlotParts, AIR.selectorSum,
+    AIR.slotMessage, List.map_map, Function.comp_def] using result
+
+def slots (branchless : Bool) (queries : List QueryExpr) (count : Nat) : List ExprLookup :=
+  List.ofFn fun index : Fin count => slot branchless queries index.val
+
+theorem slots_eval (branchless : Bool) {values : Values G}
+    {queries : List QueryExpr} {parts : List AIR.QueryPart}
+    (evaluated : queries.mapM (QueryExpr.eval values) = some parts) (count : Nat) :
+    (slots branchless queries count).mapM (ExprLookup.eval goldilocksOps values) =
+      some (List.ofFn fun index : Fin count =>
+        (AIR.querySlotMultiplicity parts index.val,
+          AIR.slotMessage branchless (AIR.querySlotParts parts index.val))) := by
+  exact list_mapM_ofFn _ _ _ (fun index => slot_eval branchless evaluated index.val)
+
+end LookupEmitter
+end Aiur.NativeAIR
diff --git a/Ix/Aiur/Proofs/LookupLayout.lean b/Ix/Aiur/Proofs/LookupLayout.lean
new file mode 100644
index 000000000..aa833192f
--- /dev/null
+++ b/Ix/Aiur/Proofs/LookupLayout.lean
@@ -0,0 +1,1021 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitMembership
+
+/-!
+The compiler's lookup allocation equals the valued emitter's physical extent.
+The equality is preserved by function renaming and deduplication; final
+compilation and grouping bound every member by its selected circuit layout.
+Canonical trace execution therefore needs no independent per-witness lookup
+limit or shape hypothesis. Native extraction, memory validity and the complete
+compiler and certified semantic/cryptographic endpoint remain obligations.
+-/
+
+namespace Aiur.Bytecode
+
+def Op.lookupUsage : Op → Nat
+  | .call _ _ _ unconstrained => if unconstrained then 0 else 4
+  | .store _ | .load _ _ | .u8BitDecomposition _ | .u8ShiftLeft _ | .u8ShiftRight _
+  | .u8Xor .. | .u8And .. | .u8Or .. | .u8Add .. | .u8Sub .. | .u8Mul ..
+  | .u8XorSplit7 .. | .u8XorSplit4 .. | .u8LessThan .. | .u8RangeCheck .. => 1
+  | .u32LessThan .. => 6
+  | _ => 0
+
+private theorem lookup_block_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def Ctrl.lookupUsage : Ctrl → Nat
+  | .return .. | .yield .. => 0
+  | .match _ branches fallback => (
+      (branches.attach.toList.map fun ⟨pair, _⟩ => pair.2.lookupUsage) ++
+      (match fallback with | none => [] | some block => [block.lookupUsage])).foldl Nat.max 0
+  | .matchContinue _ branches fallback _ _ _ continuation => (
+      (branches.attach.toList.map fun ⟨pair, _⟩ => pair.2.lookupUsage) ++
+      (match fallback with | none => [] | some block => [block.lookupUsage])).foldl Nat.max 0 +
+        continuation.lookupUsage
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.lookupUsage (block : Block) : Nat :=
+  (block.ops.toList.map Op.lookupUsage).sum + block.ctrl.lookupUsage
+termination_by sizeOf block
+decreasing_by exact lookup_block_smaller block
+
+end
+
+def branchLookupUsage (branches : Array (G × Block)) (fallback : Option Block) : Nat :=
+  (branches.toList.map (fun pair => pair.2.lookupUsage) ++
+    fallback.toList.map (fun block => block.lookupUsage)).foldl Nat.max 0
+
+theorem Ctrl.lookupUsage_match (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).lookupUsage = branchLookupUsage branches fallback := by
+  rw [Ctrl.lookupUsage.eq_def]
+  simp only [branchLookupUsage, Array.toList_attach]
+  rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.lookupUsage)]
+  cases fallback <;> rfl
+
+theorem Ctrl.lookupUsage_matchContinue (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (outputs aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback outputs aux lookups continuation).lookupUsage =
+      branchLookupUsage branches fallback + continuation.lookupUsage := by
+  rw [Ctrl.lookupUsage.eq_def]
+  simp only [branchLookupUsage, Array.toList_attach]
+  rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.lookupUsage)]
+  cases fallback <;> rfl
+
+end Aiur.Bytecode
+
+namespace Aiur.Concrete.Bytecode
+open Aiur.Bytecode Std.Do
+
+private theorem list_getDegree (indices : List ValIdx) (initial : LayoutMState) :
+    (indices.mapM getDegree).run initial = (indices.map (fun i => initial.degrees[i]?.getD 0), initial) := by
+  induction indices with
+  | nil => rfl
+  | cons index indices ih =>
+    rw [List.mapM_cons]
+    change (let (values, final) := (indices.mapM getDegree).run initial;
+      (initial.degrees[index]?.getD 0 :: values, final)) =
+      (initial.degrees[index]?.getD 0 :: indices.map (fun i => initial.degrees[i]?.getD 0), initial)
+    rw [ih]
+
+private theorem array_getDegree (indices : Array ValIdx) :
+    indices.mapM getDegree = (fun initial => pure (indices.map (fun i => initial.degrees[i]?.getD 0), initial)) := by
+  rw [Array.mapM_eq_mapM_toList]
+  funext initial
+  change (let (values, final) := (indices.toList.mapM getDegree).run initial;
+      (values.toArray, final)) = (indices.map (fun i => initial.degrees[i]?.getD 0), initial)
+  rw [list_getDegree]
+  simp only [← List.map_toArray, Array.toArray_toList]
+
+set_option mvcgen.warning false in
+theorem opLayout_lookupUsage (op : Op) (initial : LayoutMState) :
+    ((opLayout op).run initial).2.functionLayout.lookups = initial.functionLayout.lookups + op.lookupUsage := by
+  cases op <;>
+    simp only [opLayout, array_getDegree] <;>
+    apply StateM.of_wp_run_eq rfl (fun result : Unit × LayoutMState =>
+      result.2.functionLayout.lookups = _)
+  all_goals
+    mvcgen [opLayout, array_getDegree, bumpLookups, bumpAuxiliaries, getDegree, getDegrees,
+      pushDegree, pushDegrees, addMemSize]
+  all_goals simp_all [Op.lookupUsage]
+  all_goals try rfl
+
+private theorem ops_fold_lookupUsage (ops : List Op) (initial : LayoutMState) :
+    ((ops.foldlM (fun _ op => opLayout op) ()).run initial).2.functionLayout.lookups =
+      initial.functionLayout.lookups + (ops.map Op.lookupUsage).sum := by
+  induction ops generalizing initial with
+  | nil => rfl
+  | cons op ops ih =>
+    rw [List.foldlM_cons]
+    change ((ops.foldlM (fun _ op => opLayout op) ()).run ((opLayout op).run initial).2).2.functionLayout.lookups = _
+    rw [ih, opLayout_lookupUsage, List.map_cons, List.sum_cons, Nat.add_assoc]
+
+theorem opsLayout_lookupUsage (ops : Array Op) (initial : LayoutMState) :
+    ((ops.forM opLayout).run initial).2.functionLayout.lookups =
+      initial.functionLayout.lookups + (ops.toList.map Op.lookupUsage).sum := by
+  unfold Array.forM
+  rw [← Array.foldlM_toList]
+  exact ops_fold_lookupUsage ops.toList initial
+
+private def branchLayoutStep (shared : SharedData) (degrees : Array Nat) (acc : SharedData)
+    (block : Block) : LayoutM SharedData := do
+  setSharedData shared
+  blockLayout block
+  let used ← getSharedData
+  setDegrees degrees
+  return acc.maximals used
+
+private theorem branchLayoutStep_lookupUsage (shared : SharedData) (degrees : Array Nat) (acc : SharedData)
+    (block : Block) (initial : LayoutMState)
+    (effect : ∀ state, ((blockLayout block).run state).2.functionLayout.lookups =
+      state.functionLayout.lookups + block.lookupUsage) :
+    ((branchLayoutStep shared degrees acc block).run initial).1.lookups =
+      max acc.lookups (shared.lookups + block.lookupUsage) := by
+  change max acc.lookups ((blockLayout block).run ((setSharedData shared).run initial).2).2.functionLayout.lookups = _
+  rw [effect]
+  rfl
+
+private theorem branchFold_lookupUsage {α : Type} (items : List α) (blockOf : α → Block)
+    (shared : SharedData) (degrees : Array Nat) (acc : SharedData) (initial : LayoutMState)
+    (start : Nat) (aligned : acc.lookups = shared.lookups + start)
+    (effect : ∀ item ∈ items, ∀ state, ((blockLayout (blockOf item)).run state).2.functionLayout.lookups =
+      state.functionLayout.lookups + (blockOf item).lookupUsage) :
+    ((items.foldlM (fun acc item => branchLayoutStep shared degrees acc (blockOf item)) acc).run initial).1.lookups =
+      shared.lookups + (items.map (fun item => (blockOf item).lookupUsage)).foldl Nat.max start := by
+  induction items generalizing acc initial start with
+  | nil => exact aligned
+  | cons item items ih =>
+    rw [List.foldlM_cons]
+    change ((items.foldlM (fun acc item => branchLayoutStep shared degrees acc (blockOf item))
+        ((branchLayoutStep shared degrees acc (blockOf item)).run initial).1).run
+        ((branchLayoutStep shared degrees acc (blockOf item)).run initial).2).1.lookups = _
+    simp only [List.map_cons, List.foldl_cons]
+    apply ih _ _ _ _ (fun item member => effect item (List.mem_cons_of_mem _ member))
+    rw [branchLayoutStep_lookupUsage shared degrees acc (blockOf item) initial
+      (effect item List.mem_cons_self), aligned, Nat.add_max_add_left]
+
+private theorem matchLayout_lookupUsage (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (initial : LayoutMState)
+    (caseEffect : ∀ pair ∈ branches.toList, ∀ state, ((blockLayout pair.2).run state).2.functionLayout.lookups =
+      state.functionLayout.lookups + pair.2.lookupUsage)
+    (defaultEffect : ∀ block, fallback = some block → ∀ state,
+      ((blockLayout block).run state).2.functionLayout.lookups =
+        state.functionLayout.lookups + block.lookupUsage) :
+    ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.lookups =
+      initial.functionLayout.lookups + branchLookupUsage branches fallback := by
+  let shared : SharedData := ⟨initial.functionLayout.auxiliaries, initial.functionLayout.lookups⟩
+  let loop : LayoutM SharedData := branches.attach.foldlM (init := shared)
+    fun acc pair => branchLayoutStep shared initial.degrees acc pair.val.2
+  have loopCount : (loop.run initial).1.lookups = initial.functionLayout.lookups +
+      (branches.toList.map (fun pair => pair.2.lookupUsage)).foldl Nat.max 0 := by
+    dsimp only [loop]
+    rw [← Array.foldlM_toList]
+    have count := branchFold_lookupUsage branches.attach.toList (fun pair => pair.val.2)
+      shared initial.degrees shared initial 0 (Nat.add_zero _).symm
+      (fun pair _ => caseEffect pair.val (Array.mem_def.mp pair.property))
+    simp only [Array.toList_attach] at count ⊢
+    rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.lookupUsage)] at count
+    exact count
+  rw [ctrlLayout.eq_def]
+  cases fallbackEq : fallback with
+  | none =>
+    change (loop.run initial).1.lookups = _
+    simpa only [branchLookupUsage, fallbackEq, Option.toList_none, List.map_nil, List.append_nil] using loopCount
+  | some block =>
+    change max (loop.run initial).1.lookups
+      ((blockLayout block).run ((bumpAuxiliaries branches.size).run
+        ((setSharedData shared).run (loop.run initial).2).2).2).2.functionLayout.lookups = _
+    rw [defaultEffect block fallbackEq]
+    change max (loop.run initial).1.lookups (initial.functionLayout.lookups + block.lookupUsage) = _
+    rw [loopCount, Nat.add_max_add_left]
+    simp only [branchLookupUsage, Option.toList_some, List.map_cons, List.map_nil,
+      List.foldl_append, List.foldl_cons, List.foldl_nil]
+
+end Aiur.Concrete.Bytecode
+
+namespace Aiur.Bytecode
+
+def Function.LookupLayout (function : Function) : Prop :=
+  function.layout.lookups = 4 + function.body.lookupUsage
+
+def FunctionsLookupLayout (functions : Array Function) : Prop :=
+  ∀ function ∈ functions, function.LookupLayout
+
+private theorem functionsLookupLayout_empty : FunctionsLookupLayout #[] := by
+  simp [FunctionsLookupLayout]
+
+private theorem functionsLookupLayout_push {functions : Array Function} {function : Function}
+    (before : FunctionsLookupLayout functions) (valid : function.LookupLayout) :
+    FunctionsLookupLayout (functions.push function) := by
+  intro fn member
+  rcases Array.mem_push.mp member with prior | equal
+  · exact before fn prior
+  · subst fn; exact valid
+
+end Aiur.Bytecode
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem emitOp_lookupUsage {row : Nat → G} {selector rank : G} {op : Op}
+    {values : Array RowValue} {emission : OpEmission}
+    (emitted : emitOp row selector rank op values = some emission) :
+    emission.queries.length = op.lookupUsage := by
+  cases op <;> simp only [emitOp, emitByte1, emitByte2, emitU32LessThan, emitU32Add,
+    emitAdvice, bind, Option.bind, Option.map, pure] at emitted
+  all_goals
+    repeat' first
+      | split at emitted
+      | (dsimp only at emitted; split at emitted)
+  all_goals cases emitted
+  all_goals simp_all [Op.lookupUsage, rankByteQueries, range4Queries]
+
+theorem emitOps_lookupUsage {row : Nat → G} {selector rank : G} {ops : List Op}
+    {values : Array RowValue} {column : Nat} {emission : OpsEmission}
+    (emitted : emitOps row selector rank ops values column = some emission) :
+    emission.queries.length = (ops.map Op.lookupUsage).sum := by
+  induction ops generalizing values column emission with
+  | nil =>
+    have equal := Option.some.inj emitted
+    subst emission
+    rfl
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i first firstEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i rest restEmitted
+        have equal := Option.some.inj emitted
+        subst emission
+        simp only [List.length_append, List.map_cons, List.sum_cons,
+          emitOp_lookupUsage firstEmitted, ih restEmitted]
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+private theorem lookup_fold_related {blocks : List Block} {emissions : List BlockEmission} {lookup : Nat}
+    (related : List.Forall₂ (fun block emission => emission.lookup = lookup + block.lookupUsage) blocks emissions)
+    (acc : Nat) :
+    emissions.foldl (fun value emission => max value emission.lookup) (lookup + acc) =
+      lookup + (blocks.map Block.lookupUsage).foldl Nat.max acc := by
+  induction related generalizing acc with
+  | nil => rfl
+  | cons first rest ih =>
+    simp only [List.foldl_cons, List.map_cons, first, Nat.add_max_add_left]
+    exact ih _
+
+theorem branchRows_lookupUsage (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (matched : G) (values : Array RowValue) (column lookup : Nat)
+    (branches : Array (G × Block)) (fallback : Option Block) {emission : BlockEmission}
+    (emitted : branchRows row selector context matched values column lookup branches fallback = some emission)
+    (caseSound : ∀ pair ∈ branches.toList, ∀ emission,
+      pair.2.emitRow row selector context (pair.2.selectorFlow selector).entry values column lookup = some emission →
+      emission.lookup = lookup + pair.2.lookupUsage)
+    (defaultSound : ∀ block, fallback = some block → ∀ emission,
+      block.emitRow row selector context (block.selectorFlow selector).entry values
+        (column + branches.size) lookup = some emission →
+      emission.lookup = lookup + block.lookupUsage) :
+    emission.lookup = lookup + branchLookupUsage branches fallback := by
+  simp only [branchRows, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i cases casesEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i default defaultEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      have casesRelated : List.Forall₂ (fun block emission => emission.lookup = lookup + block.lookupUsage)
+          (branches.toList.map Prod.snd) cases := by
+        apply forall₂_map_left
+        apply mapM_forall₂ casesEmitted
+        intro pair member emission emitted
+        simp only [caseRow, bind, Option.bind] at emitted
+        split at emitted
+        · cases emitted
+        · rename_i body bodyEmitted
+          have equal := Option.some.inj emitted
+          subst emission
+          exact caseSound pair member body bodyEmitted
+      have defaultRelated : List.Forall₂ (fun block emission => emission.lookup = lookup + block.lookupUsage)
+          fallback.toList default := by
+        cases fallbackEq : fallback with
+        | none =>
+          simp only [defaultRow, fallbackEq, Option.some.injEq] at defaultEmitted
+          subst default
+          exact .nil
+        | some block =>
+          simp only [defaultRow, fallbackEq, bind, Option.bind] at defaultEmitted
+          split at defaultEmitted
+          · cases defaultEmitted
+          · rename_i body bodyEmitted
+            have equal := Option.some.inj defaultEmitted
+            subst default
+            exact .cons (defaultSound block fallbackEq body bodyEmitted) .nil
+      have joined := lookup_fold_related (forall₂_append casesRelated defaultRelated) 0
+      simpa only [Nat.add_zero, joinBlockEmissions, branchLookupUsage, List.map_append,
+        List.map_map, Function.comp_def] using joined
+
+private theorem lookup_pair_smaller (pair : G × Block) : sizeOf pair.2 < sizeOf pair := by
+  cases pair
+  simp
+  omega
+
+private theorem lookup_option_smaller {fallback : Option Block} {block : Block}
+    (present : fallback = some block) : sizeOf block < sizeOf fallback := by
+  rw [present]
+  simp
+
+mutual
+
+theorem Ctrl.emitRow_lookupUsage (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (ctrl : Ctrl)
+    {emission : BlockEmission}
+    (emitted : ctrl.emitRow row selector context incoming values column lookup = some emission) :
+    emission.lookup = lookup + ctrl.lookupUsage := by
+  cases ctrlEq : ctrl with
+  | «return» index indices =>
+    rw [ctrlEq] at emitted
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · have equal := Option.some.inj emitted
+        subst emission
+        simp only [Ctrl.lookupUsage, Nat.add_zero]
+  | yield index indices =>
+    rw [ctrlEq] at emitted
+    rw [Ctrl.emitRow.eq_def] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · have equal := Option.some.inj emitted
+      subst emission
+      simp only [Ctrl.lookupUsage, Nat.add_zero]
+  | «match» index branches fallback =>
+    rw [ctrlEq] at emitted
+    rw [Ctrl.lookupUsage_match]
+    rw [Ctrl.emitRow_match] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      apply branchRows_lookupUsage row selector context matched.value values column lookup branches fallback emitted
+      · intro pair member body bodyEmitted
+        exact Block.emitRow_lookupUsage row selector context _ values column lookup pair.2 bodyEmitted
+      · intro block present body bodyEmitted
+        exact Block.emitRow_lookupUsage row selector context _ values _ lookup block bodyEmitted
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [ctrlEq] at emitted
+    rw [Ctrl.lookupUsage_matchContinue]
+    rw [Ctrl.emitRow_matchContinue] at emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i matched read
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i joined branchesEmitted
+        simp only [continueRow] at emitted
+        split at emitted
+        · simp only [bind, Option.bind] at emitted
+          split at emitted
+          · cases emitted
+          · rename_i continued contEmitted
+            have equal := Option.some.inj emitted
+            subst emission
+            have joinedLookup := branchRows_lookupUsage row selector context matched.value values column lookup
+              branches fallback branchesEmitted
+              (fun pair member body bodyEmitted =>
+                Block.emitRow_lookupUsage row selector context _ values column lookup pair.2 bodyEmitted)
+              (fun block present body bodyEmitted =>
+                Block.emitRow_lookupUsage row selector context _ values _ lookup block bodyEmitted)
+            have contLookup := Block.emitRow_lookupUsage row selector context _ _ _ _ continuation contEmitted
+            simpa only [BlockEmission.continued, joinedLookup, Nat.add_assoc] using contLookup
+        · cases emitted
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals
+    try rw [ctrlEq]
+    first
+    | (have bound := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member)
+       have pairBound := lookup_pair_smaller pair
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (have optionBound := lookup_option_smaller present
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (simp only [Ctrl.matchContinue.sizeOf_spec]; omega)
+
+theorem Block.emitRow_lookupUsage (row : Nat → G) (selector : SelIdx → G) (context : RowContext)
+    (incoming : G) (values : Array RowValue) (column lookup : Nat) (block : Block)
+    {emission : BlockEmission}
+    (emitted : block.emitRow row selector context incoming values column lookup = some emission) :
+    emission.lookup = lookup + block.lookupUsage := by
+  rw [Block.emitRow] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i operations opsEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i control ctrlEmitted
+      have controlLookup := Ctrl.emitRow_lookupUsage row selector context incoming _ _ _ block.ctrl ctrlEmitted
+      have equal := Option.some.inj emitted
+      subst emission
+      simpa only [BlockEmission.prefix, BlockEmission.afterOps, Block.lookupUsage,
+        emitOps_lookupUsage opsEmitted, Nat.add_assoc] using controlLookup
+termination_by sizeOf block
+decreasing_by exact lookup_block_smaller block
+
+end
+
+end Aiur.Bytecode
+
+namespace Aiur.Concrete.Bytecode
+open Aiur.Bytecode
+
+private theorem ctrlLayout_matchContinue (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (size aux slots : Nat) (continuation : Block) :
+    ctrlLayout (.matchContinue index branches fallback size aux slots continuation) = (do
+      ctrlLayout (.match index branches fallback)
+      bumpAuxiliaries size
+      pushDegrees (.replicate size 1)
+      blockLayout continuation) := by
+  cases fallback <;> simp only [ctrlLayout.eq_def, bind_assoc]
+  all_goals rfl
+
+mutual
+
+theorem ctrlLayout_lookupUsage (ctrl : Ctrl) (initial : LayoutMState) :
+    ((ctrlLayout ctrl).run initial).2.functionLayout.lookups =
+      initial.functionLayout.lookups + ctrl.lookupUsage := by
+  cases ctrlEq : ctrl with
+  | «return» index indices =>
+    rw [ctrlLayout.eq_def, Ctrl.lookupUsage.eq_def]
+    rfl
+  | yield index indices =>
+    rw [ctrlLayout.eq_def, Ctrl.lookupUsage.eq_def]
+    rfl
+  | «match» index branches fallback =>
+    rw [Ctrl.lookupUsage_match]
+    apply matchLayout_lookupUsage index branches fallback initial
+    · intro pair member state
+      exact blockLayout_lookupUsage pair.2 state
+    · intro block present state
+      exact blockLayout_lookupUsage block state
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [ctrlLayout_matchContinue, Ctrl.lookupUsage_matchContinue]
+    change ((blockLayout continuation).run ((pushDegrees (.replicate size 1)).run
+      ((bumpAuxiliaries size).run ((ctrlLayout (.match index branches fallback)).run initial).2).2).2).2.functionLayout.lookups = _
+    rw [blockLayout_lookupUsage]
+    change ((ctrlLayout (.match index branches fallback)).run initial).2.functionLayout.lookups +
+      continuation.lookupUsage = _
+    have first := matchLayout_lookupUsage index branches fallback initial
+      (fun pair member state => blockLayout_lookupUsage pair.2 state)
+      (fun block present state => blockLayout_lookupUsage block state)
+    rw [first, Nat.add_assoc]
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals
+    try rw [ctrlEq]
+    first
+    | (have bound := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member)
+       have pairBound := lookup_pair_smaller pair
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (have optionBound := lookup_option_smaller present
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (simp only [Ctrl.matchContinue.sizeOf_spec]; omega)
+
+theorem blockLayout_lookupUsage (block : Block) (initial : LayoutMState) :
+    ((blockLayout block).run initial).2.functionLayout.lookups =
+      initial.functionLayout.lookups + block.lookupUsage := by
+  rw [blockLayout]
+  change ((ctrlLayout block.ctrl).run ((block.ops.forM opLayout).run initial).2).2.functionLayout.lookups = _
+  rw [ctrlLayout_lookupUsage, opsLayout_lookupUsage, Block.lookupUsage, Nat.add_assoc]
+termination_by sizeOf block
+decreasing_by exact lookup_block_smaller block
+
+end
+
+end Aiur.Concrete.Bytecode
+
+namespace Aiur.Concrete
+open Aiur.Bytecode
+
+private theorem layout_result_lookupUsage {body : Block} {size : Nat} {state : Bytecode.LayoutMState}
+    {resultUnit : Unit} (computed : (Bytecode.blockLayout body).run (.new size) = (resultUnit, state)) :
+    state.functionLayout.lookups + 1 = 4 + body.lookupUsage := by
+  have count := Bytecode.blockLayout_lookupUsage body (.new size)
+  rw [computed] at count
+  simp only [Bytecode.LayoutMState.new] at count
+  omega
+
+theorem Function.compile_lookupLayout {layoutMap : LayoutMap} {function : Function}
+    {body : Block} {state : Bytecode.LayoutMState}
+    (compiled : function.compile layoutMap = .ok (body, state)) :
+    state.functionLayout.lookups = 4 + body.lookupUsage := by
+  unfold Function.compile at compiled
+  simp only [bind, Except.bind, pure, Except.pure] at compiled
+  repeat' first
+    | split at compiled
+    | (dsimp only at compiled; split at compiled)
+  all_goals cases compiled
+  all_goals
+    change _ + 1 = 4 + _
+    exact layout_result_lookupUsage (by assumption)
+
+open Std.Do
+
+private theorem except_post {ε α : Type} (action : Except ε α) (property : α → Prop)
+    (valid : ∀ value, action = .ok value → property value) :
+    ⦃⌜True⌝⦄ action ⦃post⟨fun value => ⌜property value⌝, fun _ => ⌜True⌝⟩⦄ := by
+  cases computed : action with
+  | error error =>
+    change ⦃⌜True⌝⦄ (throw error : Except ε α) ⦃post⟨fun value => ⌜property value⌝, fun _ => ⌜True⌝⟩⦄
+    simp [Triple.iff]
+  | ok value =>
+    change ⦃⌜True⌝⦄ (pure value : Except ε α) ⦃post⟨fun value => ⌜property value⌝, fun _ => ⌜True⌝⟩⦄
+    simpa [Triple.iff] using valid value computed
+
+private theorem lookup_throw {ε α : Type} {error : ε} {post : PostCond α (.except ε .pure)} :
+    Triple (ps := .except ε .pure) (throw error : Except ε α) (spred(post.2.1 error)) post := by
+  simp [Triple.iff]
+
+private theorem layoutMap_spec (decls : Decls) :
+    ⦃⌜True⌝⦄ decls.layoutMap ⦃post⟨fun _ => ⌜True⌝, fun _ => ⌜True⌝⟩⦄ :=
+  except_post decls.layoutMap (fun _ => True) (fun _ _ => trivial)
+
+set_option mvcgen.warning false in
+theorem Decls.toBytecode_lookupLayout {decls : Decls} {program : Toplevel}
+    {names : Std.HashMap Global FunIdx} (compiled : decls.toBytecode = .ok (program, names)) :
+    FunctionsLookupLayout program.functions := by
+  have spec : ⦃⌜True⌝⦄ decls.toBytecode
+      ⦃post⟨fun result => ⌜FunctionsLookupLayout result.1.functions⌝, fun _ => ⌜True⌝⟩⦄ := by
+    mvcgen [Decls.toBytecode, IndexMap.foldlM, ← Array.foldlM_toList,
+      layoutMap_spec, -Spec.throw_Except, lookup_throw] invariants
+    · post⟨fun ⟨_, functions, _⟩ => ⌜FunctionsLookupLayout functions⌝, fun _ => ⌜True⌝⟩
+    case vc2.step.h_1.h_2 =>
+      apply functionsLookupLayout_push (by assumption)
+      exact Function.compile_lookupLayout (by assumption)
+    case vc4.success.pre => exact functionsLookupLayout_empty
+  exact Except.of_wp_eq compiled (fun result => match result with
+    | .error _ => True
+    | .ok result => FunctionsLookupLayout result.1.functions) spec
+
+end Aiur.Concrete
+
+namespace Aiur.Bytecode
+
+theorem rewriteOp_lookupUsage (rename : FunIdx → FunIdx) (op : Op) :
+    (rewriteOp rename op).lookupUsage = op.lookupUsage := by
+  cases op <;> rfl
+
+private theorem branchLookupUsage_rewrite (rename : FunIdx → FunIdx)
+    (branches : Array (G × Block)) (fallback : Option Block)
+    (caseEqual : ∀ pair ∈ branches.toList, (rewriteBlock rename pair.2).lookupUsage = pair.2.lookupUsage)
+    (defaultEqual : ∀ block, fallback = some block → (rewriteBlock rename block).lookupUsage = block.lookupUsage) :
+  branchLookupUsage (branches.attach.map fun ⟨(tag, block), _⟩ => (tag, rewriteBlock rename block))
+      (fallback.map (rewriteBlock rename)) =
+      branchLookupUsage branches fallback := by
+  unfold branchLookupUsage
+  apply congrArg (fun values : List Nat => values.foldl Nat.max 0)
+  congr 1
+  · simp only [Array.toList_map, Array.toList_attach, List.map_map, Function.comp_def]
+    rw [← List.attachWith_map_val (p := fun pair => pair ∈ branches)
+      (f := fun pair : G × Block => pair.2.lookupUsage) (fun _ member => Array.mem_def.mpr member)]
+    apply List.map_congr_left
+    intro pair member
+    rcases pair with ⟨⟨tag, block⟩, present⟩
+    exact caseEqual (tag, block) (Array.mem_def.mp present)
+  · cases fallbackEq : fallback with
+    | none => rfl
+    | some block =>
+      simp only [Option.map_some, Option.toList_some, List.map_cons, List.map_nil]
+      rw [defaultEqual block fallbackEq]
+
+mutual
+
+theorem rewriteCtrl_lookupUsage (rename : FunIdx → FunIdx) (ctrl : Ctrl) :
+    (rewriteCtrl rename ctrl).lookupUsage = ctrl.lookupUsage := by
+  cases ctrlEq : ctrl with
+  | «return» index indices => rw [rewriteCtrl.eq_def]
+  | yield index indices => rw [rewriteCtrl.eq_def]
+  | «match» index branches fallback =>
+    rw [rewriteCtrl.eq_def, Ctrl.lookupUsage_match, Ctrl.lookupUsage_match]
+    have equal := branchLookupUsage_rewrite rename branches fallback
+      (fun pair member => rewriteBlock_lookupUsage rename pair.2)
+      (fun block present => rewriteBlock_lookupUsage rename block)
+    cases fallback <;> exact equal
+  | matchContinue index branches fallback size aux slots continuation =>
+    rw [rewriteCtrl.eq_def, Ctrl.lookupUsage_matchContinue, Ctrl.lookupUsage_matchContinue,
+      rewriteBlock_lookupUsage rename continuation]
+    congr 1
+    have equal := branchLookupUsage_rewrite rename branches fallback
+      (fun pair member => rewriteBlock_lookupUsage rename pair.2)
+      (fun block present => rewriteBlock_lookupUsage rename block)
+    cases fallback <;> exact equal
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals
+    try rw [ctrlEq]
+    first
+    | (have bound := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member)
+       have pairBound := lookup_pair_smaller pair
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (have optionBound := lookup_option_smaller present
+       first | simp only [Ctrl.match.sizeOf_spec] | simp only [Ctrl.matchContinue.sizeOf_spec]
+       omega)
+    | (simp only [Ctrl.matchContinue.sizeOf_spec]; omega)
+
+theorem rewriteBlock_lookupUsage (rename : FunIdx → FunIdx) (block : Block) :
+    (rewriteBlock rename block).lookupUsage = block.lookupUsage := by
+  rw [rewriteBlock, Block.lookupUsage, Block.lookupUsage, rewriteCtrl_lookupUsage]
+  simp only [Array.toList_map, List.map_map, Function.comp_def, rewriteOp_lookupUsage]
+termination_by sizeOf block
+decreasing_by exact lookup_block_smaller block
+
+end
+
+theorem deduplicate_newFunctions_lookupLayout (functions : Array Function)
+    (classes : Array Nat) (canonical : Array Bool) (rename : FunIdx → FunIdx)
+    (valid : FunctionsLookupLayout functions) :
+    FunctionsLookupLayout (deduplicate_newFunctions functions classes canonical rename) := by
+  unfold deduplicate_newFunctions
+  apply Array.foldl_induction (fun _ result => FunctionsLookupLayout result) functionsLookupLayout_empty
+  intro index accumulated before
+  dsimp only
+  split
+  · apply functionsLookupLayout_push before
+    change (((classes.zip canonical).zip functions)[index]).2.layout.lookups =
+      4 + (rewriteBlock rename (((classes.zip canonical).zip functions)[index]).2.body).lookupUsage
+    rw [rewriteBlock_lookupUsage]
+    apply valid
+    exact (Array.of_mem_zip (Array.getElem_mem index.isLt)).2
+  · exact before
+
+theorem Toplevel.deduplicateCandidate_lookupLayout (program : Toplevel)
+    (valid : FunctionsLookupLayout program.functions) :
+    FunctionsLookupLayout program.deduplicateCandidate.1.functions := by
+  unfold Toplevel.deduplicateCandidate
+  dsimp only
+  split
+  · exact valid
+  · exact deduplicate_newFunctions_lookupLayout _ _ _ _ valid
+
+theorem Toplevel.deduplicate_lookupLayout (program : Toplevel)
+    (valid : FunctionsLookupLayout program.functions) :
+    FunctionsLookupLayout program.deduplicate.1.functions := by
+  unfold Toplevel.deduplicate checkedRenaming
+  dsimp only
+  split
+  · exact program.deduplicateCandidate_lookupLayout valid
+  · exact valid
+
+end Aiur.Bytecode
+
+namespace Aiur
+open Bytecode
+
+theorem finishCompilation_lookupLayout (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) (valid : FunctionsLookupLayout raw.functions) :
+    FunctionsLookupLayout (finishCompilation source raw names).bytecode.functions := by
+  unfold finishCompilation
+  intro function member
+  obtain ⟨index, bound, equal⟩ := Array.exists_of_mem_mapIdx member
+  subst function
+  change raw.deduplicate.1.functions[index].LookupLayout
+  exact raw.deduplicate_lookupLayout valid _ (Array.getElem_mem bound)
+
+theorem Source.Toplevel.compile_lookupLayout {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (accepted : source.compile = .ok compiled) : FunctionsLookupLayout compiled.bytecode.functions := by
+  obtain ⟨inlined, typed, concrete, raw, names, _, _, _, lowered, artifact⟩ :=
+    source.compile_artifact_of_ok accepted
+  rw [artifact]
+  exact finishCompilation_lookupLayout inlined raw names (Concrete.Decls.toBytecode_lookupLayout lowered)
+
+theorem BoundVerifier.Backend.functions_lookupLayout {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) : FunctionsLookupLayout backend.compiled.bytecode.functions := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  have valid := Source.Toplevel.compile_lookupLayout compiled
+  split at grouped
+  · cases grouped
+    exact valid
+  · rw [(CompiledToplevel.groupFunctions_preserves_code grouped).2.2.1]
+    exact valid
+
+end Aiur
+
+namespace Aiur.Bytecode
+
+def MembersLookupBound (functions : Array Function) (members : Array FunIdx) (slots : Nat) : Prop :=
+  4 ≤ slots ∧ ∀ index ∈ members, functions[index]!.layout.lookups ≤ slots
+
+def CircuitsLookupBound (functions : Array Function) (circuits : Array Circuit) : Prop :=
+  ∀ circuit ∈ circuits, MembersLookupBound functions circuit.members circuit.layout.lookups
+
+private theorem lookup_circuits_empty (functions : Array Function) : CircuitsLookupBound functions #[] := by
+  simp [CircuitsLookupBound]
+
+private theorem lookup_circuits_push {functions : Array Function} {circuits : Array Circuit} {circuit : Circuit}
+    (before : CircuitsLookupBound functions circuits)
+    (member : MembersLookupBound functions circuit.members circuit.layout.lookups) :
+    CircuitsLookupBound functions (circuits.push circuit) := by
+  intro c present
+  rcases Array.mem_push.mp present with prior | equal
+  · exact before c prior
+  · subst c; exact member
+
+private theorem lookup_member_singleton {functions : Array Function} {index : FunIdx} {function : Function}
+    (present : functions[index]? = some function) (valid : function.LookupLayout) :
+    MembersLookupBound functions #[index] function.layout.lookups := by
+  constructor
+  · change function.layout.lookups = 4 + function.body.lookupUsage at valid
+    omega
+  · intro i member
+    have equal : i = index := by simpa using member
+    subst i
+    rw [Array.getElem!_eq_getD, Array.getD_eq_getD_getElem?, present]
+    exact Nat.le_refl _
+
+open Std.Do
+
+set_option mvcgen.warning false in
+theorem singletonCircuits_lookupBound (program : Toplevel) (nameOf : FunIdx → String)
+    (valid : FunctionsLookupLayout program.functions) :
+    CircuitsLookupBound program.functions (program.singletonCircuits nameOf) := by
+  have spec : Triple (m := Id) (program.singletonCircuits nameOf) ⌜True⌝
+      (⇓ circuits => ⌜CircuitsLookupBound program.functions circuits⌝) := by
+    mvcgen [Toplevel.singletonCircuits, Id.run] invariants
+    · ⇓⟨_, circuits⟩ => ⌜CircuitsLookupBound program.functions circuits⌝
+    case vc1.step.isTrue =>
+      apply lookup_circuits_push (by assumption)
+      exact lookup_member_singleton (Array.getElem?_eq_getElem _) (valid _ (Array.getElem_mem _))
+    case vc3.pre => exact lookup_circuits_empty _
+  exact Id.of_wp_run_eq rfl _ spec
+
+private theorem lookup_bang_of_present {functions : Array Function} {index : Nat} {function : Function}
+    (present : functions[index]? = some function) : functions[index]! = function := by
+  rw [Array.getElem!_eq_getD, Array.getD_eq_getD_getElem?, present]
+  rfl
+
+private theorem lookup_array_bang {α : Type} [Inhabited α] (property : α → Prop)
+    {array : Array α} (valid : ∀ value ∈ array, property value) (fallback : property default) (index : Nat) :
+    property array[index]! := by
+  by_cases bound : index < array.size
+  · rw [getElem!_pos array index bound]
+    exact valid _ (Array.getElem_mem bound)
+  · rw [getElem!_neg array index bound]
+    exact fallback
+
+private theorem lookup_first_reserved {functions : Array Function} {members : Array FunIdx}
+    (valid : FunctionsLookupLayout functions) (nonempty : 0 < functions.size)
+    (constrained : MembersConstrained functions members) :
+    4 ≤ functions[members[0]!]!.layout.lookups := by
+  refine lookup_array_bang (fun index : FunIdx => 4 ≤ functions[index]!.layout.lookups)
+    (array := members) ?_ ?_ 0
+  · intro index member
+    obtain ⟨function, present, _⟩ := constrained index member
+    rw [lookup_bang_of_present present]
+    have bound := valid function (Array.mem_of_getElem? present)
+    change function.layout.lookups = 4 + function.body.lookupUsage at bound
+    omega
+  · change 4 ≤ functions[0]!.layout.lookups
+    rw [getElem!_pos functions 0 nonempty]
+    have bound := valid _ (Array.getElem_mem nonempty)
+    change functions[0].layout.lookups = 4 + functions[0].body.lookupUsage at bound
+    omega
+
+private theorem lookup_merge_fold (functions : Array Function) (first : FunIdx) (members : List FunIdx)
+    (initial : FunctionLayout) (firstBound : functions[first]!.layout.lookups ≤ initial.lookups) :
+    let final := members.foldl (fun acc index => if index == first then acc else acc.merge functions[index]!.layout) initial
+    initial.lookups ≤ final.lookups ∧ ∀ index ∈ members, functions[index]!.layout.lookups ≤ final.lookups := by
+  induction members generalizing initial with
+  | nil => exact ⟨Nat.le_refl _, by simp⟩
+  | cons index members ih =>
+    let next := if index == first then initial else initial.merge functions[index]!.layout
+    have before : initial.lookups ≤ next.lookups := by
+      dsimp only [next]
+      split
+      · exact Nat.le_refl _
+      · exact Nat.le_max_left _ _
+    have here : functions[index]!.layout.lookups ≤ next.lookups := by
+      dsimp only [next]
+      split
+      · rename_i equal
+        have eq : index = first := beq_iff_eq.mp equal
+        subst index
+        exact firstBound
+      · exact Nat.le_max_right _ _
+    have rest := ih next (Nat.le_trans firstBound before)
+    refine ⟨Nat.le_trans before rest.1, ?_⟩
+    intro chosen member
+    rcases List.mem_cons.mp member with equal | later
+    · subst chosen; exact Nat.le_trans here rest.1
+    · exact rest.2 chosen later
+
+theorem merged_lookupBound (functions : Array Function) (members : Array FunIdx)
+    (valid : FunctionsLookupLayout functions) (nonempty : 0 < functions.size)
+    (constrained : MembersConstrained functions members) :
+    MembersLookupBound functions members
+      (members.foldl (init := functions[members[0]!]!.layout)
+        fun acc index => if index == members[0]! then acc else acc.merge functions[index]!.layout).lookups := by
+  rw [← Array.foldl_toList]
+  have folded := lookup_merge_fold functions members[0]! members.toList functions[members[0]!]!.layout
+    (Nat.le_refl _)
+  exact ⟨Nat.le_trans (lookup_first_reserved valid nonempty constrained) folded.1,
+    fun index member => folded.2 index (Array.mem_def.mp member)⟩
+
+end Aiur.Bytecode
+
+namespace Aiur
+open Bytecode Std.Do
+
+private theorem lookup_throw_except {ε α : Type} {error : ε} {post : PostCond α (.except ε .pure)} :
+    Triple (ps := .except ε .pure) (throw error : Except ε α) (spred(post.2.1 error)) post := by
+  simp [Triple.iff]
+
+private theorem lookup_members_empty (functions : Array Function) : MembersConstrained functions #[] := by
+  simp [MembersConstrained]
+
+private theorem lookup_members_push {functions : Array Function} {members : Array FunIdx} {index : FunIdx}
+    (before : MembersConstrained functions members) (constrained : functions[index]!.constrained = true) :
+    MembersConstrained functions (members.push index) := by
+  intro i member
+  rcases Array.mem_push.mp member with prior | equal
+  · exact before i prior
+  · subst i
+    by_cases bound : index < functions.size
+    · exact ⟨functions[index], Array.getElem?_eq_getElem bound,
+        by simpa only [getElem!_pos functions index bound] using constrained⟩
+    · rw [getElem!_neg functions index bound] at constrained
+      contradiction
+
+private theorem lookup_split_member {α : Type} {array : Array α} {pref suff : List α} {value : α}
+    (split : array.toList = pref ++ value :: suff) : value ∈ array := by
+  apply Array.mem_toList_iff.mp
+  rw [split]
+  simp
+
+set_option mvcgen.warning false in
+theorem CompiledToplevel.groupFunctions_lookupBound {before after : CompiledToplevel}
+    {groups : Array (String × Array String)}
+    (functions : FunctionsLookupLayout before.bytecode.functions)
+    (nonempty : 0 < before.bytecode.functions.size)
+    (valid : CircuitsLookupBound before.bytecode.functions before.bytecode.circuits)
+    (accepted : before.groupFunctions groups = .ok after) :
+    CircuitsLookupBound after.bytecode.functions after.bytecode.circuits := by
+  have spec : ⦃⌜True⌝⦄ before.groupFunctions groups
+      ⦃post⟨fun compiled => ⌜CircuitsLookupBound compiled.bytecode.functions compiled.bytecode.circuits⌝,
+        fun _ => ⌜True⌝⟩⦄ := by
+    mvcgen [CompiledToplevel.groupFunctions, -Spec.throw_Except, lookup_throw_except] invariants
+    · post⟨fun ⟨_, _, resolved⟩ => ⌜∀ pair ∈ resolved,
+        MembersConstrained before.bytecode.functions pair.2⌝, fun _ => ⌜True⌝⟩
+    · post⟨fun ⟨_, _, members⟩ => ⌜MembersConstrained before.bytecode.functions members⌝,
+        fun _ => ⌜True⌝⟩
+    · post⟨fun ⟨_, circuits, _⟩ => ⌜CircuitsLookupBound before.bytecode.functions circuits⌝,
+        fun _ => ⌜True⌝⟩
+    case vc4.step.h_1.isTrue.isFalse.isFalse => exact lookup_members_push (by assumption) (by assumption)
+    case vc7.step.isFalse.pre => exact lookup_members_empty _
+    case vc8.step.isFalse.post.success =>
+      intro pair member
+      rcases Array.mem_push.mp member with prior | equal
+      · apply_assumption; exact prior
+      · subst pair; assumption
+    case vc10.pre =>
+      change ∀ pair ∈ (#[] : Array (String × Array FunIdx)), _
+      simp
+    case vc11.step.isTrue.h_1 =>
+      apply lookup_circuits_push (by assumption)
+      apply valid
+      exact lookup_split_member (by assumption)
+    case vc13.step.isTrue.h_2.isFalse =>
+      apply lookup_circuits_push (by assumption)
+      apply merged_lookupBound _ _ functions nonempty
+      exact lookup_array_bang (fun pair : String × Array FunIdx =>
+        MembersConstrained before.bytecode.functions pair.2) (by assumption) (lookup_members_empty _) _
+    case vc15.post.success.pre => exact lookup_circuits_empty _
+  exact Except.of_wp_eq accepted (fun result => match result with
+    | .error _ => True
+    | .ok compiled => CircuitsLookupBound compiled.bytecode.functions compiled.bytecode.circuits) spec
+
+theorem finishCompilation_lookupBound (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) (valid : FunctionsLookupLayout raw.functions) :
+    CircuitsLookupBound (finishCompilation source raw names).bytecode.functions
+      (finishCompilation source raw names).bytecode.circuits := by
+  unfold finishCompilation
+  apply singletonCircuits_lookupBound
+  exact finishCompilation_lookupLayout source raw names valid
+
+theorem Source.Toplevel.compile_lookupBound {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (accepted : source.compile = .ok compiled) :
+    CircuitsLookupBound compiled.bytecode.functions compiled.bytecode.circuits := by
+  obtain ⟨inlined, typed, concrete, raw, names, _, _, _, lowered, artifact⟩ :=
+    source.compile_artifact_of_ok accepted
+  rw [artifact]
+  exact finishCompilation_lookupBound inlined raw names (Concrete.Decls.toBytecode_lookupLayout lowered)
+
+theorem BoundVerifier.Backend.circuits_lookupBound {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) :
+    CircuitsLookupBound backend.compiled.bytecode.functions backend.compiled.bytecode.circuits := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  have valid := Source.Toplevel.compile_lookupBound compiled
+  split at grouped
+  · cases grouped
+    exact valid
+  · have same := (CompiledToplevel.groupFunctions_preserves_code grouped).2.2.1
+    have bound := (Array.getElem?_eq_some_iff.mp backend.present).choose
+    rw [same] at bound
+    exact CompiledToplevel.groupFunctions_lookupBound
+      (Source.Toplevel.compile_lookupLayout compiled) (by omega) valid grouped
+
+end Aiur
+
+namespace Aiur.AIR
+open Bytecode
+
+theorem CircuitWitness.lookupBounds_of_compiled {program : Toplevel}
+    (functions : FunctionsLookupLayout program.functions)
+    (layouts : CircuitsLookupBound program.functions program.circuits)
+    (witness : CircuitWitness) (circuit : witness.circuit ∈ program.circuits)
+    (emitted : witness.Emitted program) : witness.LookupBounds := by
+  obtain ⟨_, indices, source⟩ := witness.circuit.emitRow_spec witness.values program emitted
+  have bounds := layouts witness.circuit circuit
+  refine ⟨bounds.1, ?_⟩
+  intro part member
+  have index : part.functionIndex ∈ witness.circuit.members := by
+    apply Array.mem_toList_iff.mp
+    rw [← indices]
+    exact List.mem_map.mpr ⟨part, member, rfl⟩
+  have present := (source part member).present
+  have count := Block.emitRow_lookupUsage witness.values (part.selector witness.values) _ _ _ _ _
+    part.function.body (source part member).emitted
+  have layout := functions part.function (Array.mem_of_getElem? present)
+  change part.function.layout.lookups = 4 + part.function.body.lookupUsage at layout
+  have limit := bounds.2 part.functionIndex index
+  rw [lookup_bang_of_present present] at limit
+  rw [count, ← layout]
+  exact limit
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+theorem Backend.witness_lookupBounds {selection : Selection} (backend : Backend selection)
+    (witness : CircuitWitness) (circuit : witness.circuit ∈ backend.compiled.bytecode.circuits)
+    (emitted : witness.Emitted backend.compiled.bytecode) : witness.LookupBounds :=
+  witness.lookupBounds_of_compiled backend.functions_lookupLayout backend.circuits_lookupBound circuit emitted
+
+theorem Backend.bounded_trace_execution {selection : Selection} (backend : Backend selection)
+    (tables : AuxiliaryTables) (traces : CircuitTraces backend.compiled.bytecode.circuits.toList)
+    {witnesses : List CircuitWitness}
+    (emitted : traces.emitWitnesses backend.compiled.bytecode = some witnesses)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (budget : lookupQueryBound
+      (backend.compiled.bytecode.circuits.toList.map (·.layout.lookups) ++ otherSlots)
+      (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) = some result)
+    (width : Nat) (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        encodedCircuitQueryPool (witnesses.map (·.emission)))
+      (tables.circuitProviders (witnesses.map (·.emission))))
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied) :
+    Execution backend.compiled.bytecode (memoryFacts tables.memory)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  have valid := (traces.emitWitnesses_spec emitted).1
+  apply backend.compiled_trace_execution tables traces emitted budget width input arity balanced
+    publicWidth queryWidths memoryValid canonical satisfied
+  intro witness member
+  exact backend.witness_lookupBounds witness (by simpa using (valid witness member).1) (valid witness member).2
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/LookupMessages.lean b/Ix/Aiur/Proofs/LookupMessages.lean
new file mode 100644
index 000000000..482a07d1f
--- /dev/null
+++ b/Ix/Aiur/Proofs/LookupMessages.lean
@@ -0,0 +1,371 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ByteLookups
+
+/-!
+Exact lookup messages from their zero-padded representations.
+
+The first two fields determine message length through the native channel
+and function-arity schema. Padding is then injective, and exact balance
+passes through padding and channel filtering. Zero-weight providers may
+contain arbitrary data. Function and memory encodings recover the typed
+messages used by execution and memory-table proofs.
+
+These results do not extract padded balance from the cryptographic verifier.
+Connecting all native active rows to the function-arity schema is also an
+obligation; an arbitrary bytecode program need not have uniform returns.
+-/
+
+namespace Aiur.AIR
+
+def padMessage (width : Nat) (message : List G) : List G :=
+  List.ofFn fun i : Fin width => message[i.val]?.getD 0
+
+theorem padMessage_length (width : Nat) (message : List G) :
+    (padMessage width message).length = width := List.length_ofFn
+
+theorem padMessage_read {width : Nat} (message : List G) (i : Nat) (hi : i < width) :
+    (padMessage width message)[i]?.getD 0 = message[i]?.getD 0 := by
+  simp only [padMessage, List.getElem?_ofFn, dif_pos hi, Option.getD_some]
+
+theorem padMessage_injective_of_length {width : Nat} {left right : List G}
+    (bounded : left.length ≤ width) (lengths : left.length = right.length)
+    (same : padMessage width left = padMessage width right) : left = right := by
+  apply List.ext_getElem lengths
+  intro i hi hj
+  have equal := congrArg (fun message => message[i]?.getD 0) same
+  rw [padMessage_read left i (by omega), padMessage_read right i (by omega)] at equal
+  simpa only [List.getElem?_eq_getElem hi, List.getElem?_eq_getElem hj,
+    Option.getD_some] using equal
+
+/-- The message length is determined by its first two entries. -/
+def HasMessageShape (widths : G → G → Nat) (message : List G) : Prop :=
+  2 ≤ message.length ∧ message.length = widths (message[0]?.getD 0) (message[1]?.getD 0)
+
+theorem padMessage_injective_of_shape {width : Nat} {widths : G → G → Nat}
+    {left right : List G} (leftShape : HasMessageShape widths left)
+    (rightShape : HasMessageShape widths right) (bounded : left.length ≤ width)
+    (same : padMessage width left = padMessage width right) : left = right := by
+  have minimum := leftShape.1
+  have first := congrArg (fun message => message[0]?.getD 0) same
+  have second := congrArg (fun message => message[1]?.getD 0) same
+  rw [padMessage_read left 0 (by omega), padMessage_read right 0 (by omega)] at first
+  rw [padMessage_read left 1 (by omega), padMessage_read right 1 (by omega)] at second
+  apply padMessage_injective_of_length bounded _ same
+  rw [leftShape.2, rightShape.2, first, second]
+
+def mapProviders (encode : α → β) (providers : List (Provider α)) : List (Provider β) :=
+  providers.map fun provider => (encode provider.1, provider.2)
+
+theorem count_map_of_matching [DecidableEq α] [DecidableEq β]
+    (encode : α → β) (message : α) (queries : List α)
+    (matching : ∀ query ∈ queries, encode query = encode message ↔ query = message) :
+    (queries.map encode).count (encode message) = queries.count message := by
+  induction queries with
+  | nil => rfl
+  | cons query queries ih =>
+    have head := matching query List.mem_cons_self
+    have tail := ih (fun value member => matching value (List.mem_cons_of_mem query member))
+    simp only [List.map_cons, List.count_cons, beq_iff_eq, head, tail]
+
+theorem suppliedWeight_map_of_matching [DecidableEq α] [DecidableEq β]
+    (encode : α → β) (message : α) (providers : List (Provider α))
+    (matching : ∀ provider ∈ providers,
+      provider.2 ≠ 0 → (encode provider.1 = encode message ↔ provider.1 = message)) :
+    suppliedWeight (encode message) (mapProviders encode providers) =
+      suppliedWeight message providers := by
+  induction providers with
+  | nil => rfl
+  | cons provider providers ih =>
+    have tail := ih (fun value member => matching value (List.mem_cons_of_mem provider member))
+    change (if encode provider.1 = encode message then
+      provider.2 + suppliedWeight (encode message) (mapProviders encode providers)
+      else suppliedWeight (encode message) (mapProviders encode providers)) =
+      (if provider.1 = message then provider.2 + suppliedWeight message providers
+        else suppliedWeight message providers)
+    by_cases zero : provider.2 = 0
+    · simp only [zero, G.zero_add, ite_self, tail]
+    · have head := matching provider List.mem_cons_self zero
+      simp only [head, tail]
+
+theorem suppliedWeight_eq_zero_of_absent [DecidableEq α] (message : α)
+    (providers : List (Provider α))
+    (absent : ∀ provider ∈ providers, provider.2 ≠ 0 → provider.1 ≠ message) :
+    suppliedWeight message providers = 0 := by
+  induction providers with
+  | nil => rfl
+  | cons provider providers ih =>
+    have tail := ih (fun value member => absent value (List.mem_cons_of_mem provider member))
+    change (if provider.1 = message then provider.2 + suppliedWeight message providers
+      else suppliedWeight message providers) = 0
+    by_cases zero : provider.2 = 0
+    · simpa only [zero, G.zero_add, ite_self] using tail
+    · have head := absent provider List.mem_cons_self zero
+      simpa only [if_neg head] using tail
+
+theorem exactLookupBalance_of_injective_on [DecidableEq α] [DecidableEq β]
+    (encode : α → β) (admissible : α → Prop)
+    (injective : ∀ {left right}, admissible left → admissible right →
+      encode left = encode right → left = right)
+    {queries : List α} {providers : List (Provider α)}
+    (queriesAdmissible : ∀ query ∈ queries, admissible query)
+    (providersAdmissible : ∀ provider ∈ providers, provider.2 ≠ 0 → admissible provider.1)
+    (balanced : ExactLookupBalance (queries.map encode) (mapProviders encode providers)) :
+    ExactLookupBalance queries providers := by
+  intro message
+  by_cases valid : admissible message
+  · have queryMatching : ∀ query ∈ queries,
+        encode query = encode message ↔ query = message := by
+      intro query member
+      exact ⟨injective (queriesAdmissible query member) valid, congrArg encode⟩
+    have providerMatching : ∀ provider ∈ providers,
+        provider.2 ≠ 0 → (encode provider.1 = encode message ↔ provider.1 = message) := by
+      intro provider member nonzero
+      exact ⟨injective (providersAdmissible provider member nonzero) valid, congrArg encode⟩
+    have result := balanced (encode message)
+    rw [count_map_of_matching encode message queries queryMatching,
+      suppliedWeight_map_of_matching encode message providers providerMatching] at result
+    exact result
+  · have absent : message ∉ queries := fun member => valid (queriesAdmissible message member)
+    rw [List.count_eq_zero.mpr absent, suppliedWeight_eq_zero_of_absent message providers]
+    · rfl
+    · intro provider member nonzero equal
+      exact valid (equal ▸ providersAdmissible provider member nonzero)
+
+theorem suppliedWeight_filter [DecidableEq α] (keep : α → Bool) (message : α)
+    (providers : List (Provider α)) :
+    suppliedWeight message (providers.filter fun provider => keep provider.1) =
+      if keep message then suppliedWeight message providers else 0 := by
+  induction providers with
+  | nil => simp only [suppliedWeight, List.filter_nil, List.foldr_nil, ite_self]
+  | cons provider providers ih =>
+    by_cases same : provider.1 = message
+    · by_cases retained : keep message = true
+      · simp only [List.filter_cons, same, retained, ↓reduceIte, suppliedWeight, List.foldr_cons] at *
+        rw [ih]
+      · have dropped : keep message = false := Bool.eq_false_iff.mpr retained
+        simp only [List.filter_cons, same, dropped, Bool.false_eq_true, ↓reduceIte]
+        simpa only [dropped, Bool.false_eq_true, ↓reduceIte] using ih
+    · by_cases retained : keep provider.1 = true
+      · simp only [List.filter_cons, retained, ↓reduceIte, suppliedWeight,
+          List.foldr_cons, if_neg same] at *
+        exact ih
+      · have dropped : keep provider.1 = false := Bool.eq_false_iff.mpr retained
+        simp only [List.filter_cons, dropped, Bool.false_eq_true, ↓reduceIte]
+        simpa only [suppliedWeight, List.foldr_cons, if_neg same] using ih
+
+/-- Restrict global exact balance to any collection of message channels. -/
+theorem ExactLookupBalance.filter [DecidableEq α] {queries : List α}
+    {providers : List (Provider α)} (balanced : ExactLookupBalance queries providers)
+    (keep : α → Bool) :
+    ExactLookupBalance (queries.filter keep) (providers.filter fun provider => keep provider.1) := by
+  intro message
+  rw [suppliedWeight_filter]
+  by_cases retained : keep message = true
+  · rw [if_pos retained, List.count_filter retained, balanced]
+  · rw [if_neg retained]
+    have absent : message ∉ queries.filter keep := fun member =>
+      retained (List.mem_filter.mp member).2
+    rw [List.count_eq_zero.mpr absent]
+    rfl
+
+def PaddedLookupBalance (width : Nat) (queries : List (List G))
+    (providers : List (Provider (List G))) : Prop :=
+  ExactLookupBalance (queries.map (padMessage width)) (mapProviders (padMessage width) providers)
+
+/-- A bounded query has a nonzero provider with the same padded message.
+No message-shape hypothesis is needed for this first extraction step. -/
+theorem paddedLookupBalance_provider {width : Nat} {queries : List (List G)}
+    {providers : List (Provider (List G))} (balanced : PaddedLookupBalance width queries providers)
+    (bounded : queries.length < gSize.toNat) {message : List G} (queried : message ∈ queries) :
+    ∃ provider ∈ providers, padMessage width provider.1 = padMessage width message ∧ provider.2 ≠ 0 := by
+  obtain ⟨provider, member, same, nonzero⟩ := exactLookupBalance_provider balanced
+    (by simpa only [List.length_map] using bounded) (List.mem_map.mpr ⟨message, queried, rfl⟩)
+  obtain ⟨original, originalMember, equal⟩ := List.mem_map.mp member
+  subst provider
+  exact ⟨original, originalMember, same, nonzero⟩
+
+theorem paddedLookupBalance_exact {width : Nat} (widths : G → G → Nat)
+    {queries : List (List G)} {providers : List (Provider (List G))}
+    (queryShapes : ∀ query ∈ queries, HasMessageShape widths query ∧ query.length ≤ width)
+    (providerShapes : ∀ provider ∈ providers, provider.2 ≠ 0 →
+      HasMessageShape widths provider.1 ∧ provider.1.length ≤ width)
+    (balanced : PaddedLookupBalance width queries providers) :
+    ExactLookupBalance queries providers := by
+  apply exactLookupBalance_of_injective_on (padMessage width)
+    (fun message => HasMessageShape widths message ∧ message.length ≤ width) _
+    queryShapes providerShapes balanced
+  intro left right hl hr same
+  exact padMessage_injective_of_shape hl.1 hr.1 hl.2 same
+
+/-- Input and output widths for each function index. -/
+abbrev FunctionArities := Nat → Nat × Nat
+
+def functionMessage (request : Bytecode.AIR.Call) : List G :=
+  0 :: G.ofNat request.function ::
+    (request.inputs.toList ++ request.outputs.toList ++ [request.rank])
+
+def memoryMessage (width : Nat) (pointer : G) (contents : Array G) : List G :=
+  1 :: G.ofNat width :: pointer :: contents.toList
+
+def Byte1Kind.outputSize : Byte1Kind → Nat
+  | .bits => 8
+  | .shiftLeft | .shiftRight => 1
+
+def Byte2Kind.outputSize : Byte2Kind → Nat
+  | .range => 0
+  | .mul | .split7 | .split4 => 2
+  | _ => 1
+
+/-- Length of a native message, determined by its channel and second field.
+Function messages include the final call-order rank. -/
+def lookupMessageWidth (arities : FunctionArities) (channel key : G) : Nat :=
+  match channel.n with
+  | 0 => 3 + (arities key.n).1 + (arities key.n).2
+  | 1 => 3 + key.n
+  | 2 => 10
+  | 3 | 4 => 3
+  | 5 | 6 | 7 | 8 | 9 | 10 => 4
+  | 11 => 3
+  | 12 | 13 | 14 => 5
+  | _ => 0
+
+def FunctionMessageValid (arities : FunctionArities) (request : Bytecode.AIR.Call) : Prop :=
+  request.function < gSize.toNat ∧
+    request.inputs.size = (arities request.function).1 ∧
+    request.outputs.size = (arities request.function).2
+
+theorem functionMessage_shape (arities : FunctionArities) (request : Bytecode.AIR.Call)
+    (valid : FunctionMessageValid arities request) :
+    HasMessageShape (lookupMessageWidth arities) (functionMessage request) := by
+  obtain ⟨indexBound, inputs, outputs⟩ := valid
+  simp only [HasMessageShape, functionMessage, List.length_cons, List.length_append,
+    List.length_nil, Array.length_toList, List.getElem?_cons_zero,
+    List.getElem?_cons_succ, Option.getD_some, lookupMessageWidth, G.n_ofNat,
+    Nat.mod_eq_of_lt indexBound]
+  change _ ∧ _ = 3 + (arities request.function).1 + (arities request.function).2
+  omega
+
+theorem memoryMessage_shape (arities : FunctionArities) (width : Nat)
+    (pointer : G) (contents : Array G) (bounded : width < gSize.toNat)
+    (sized : contents.size = width) :
+    HasMessageShape (lookupMessageWidth arities) (memoryMessage width pointer contents) := by
+  simp only [HasMessageShape, memoryMessage, List.length_cons, Array.length_toList,
+    List.getElem?_cons_zero, List.getElem?_cons_succ, Option.getD_some,
+    lookupMessageWidth, G.n_ofNat, Nat.mod_eq_of_lt bounded]
+  change _ ∧ _ = 3 + width
+  omega
+
+theorem byte1Request_shape (arities : FunctionArities) (kind : Byte1Kind) (input : G)
+    (outputs : Array G) (sized : outputs.size = kind.outputSize) :
+    HasMessageShape (lookupMessageWidth arities) (byte1Request kind input outputs) := by
+  cases kind <;>
+    simp only [Byte1Kind.outputSize] at sized <;>
+    simp only [HasMessageShape, byte1Request, List.length_cons, Array.length_toList,
+      List.getElem?_cons_zero, List.getElem?_cons_succ, Option.getD_some,
+      lookupMessageWidth, Byte1Kind.channel, sized] <;> exact ⟨by decide +kernel, rfl⟩
+
+theorem byte2Request_shape (arities : FunctionArities) (kind : Byte2Kind) (x y : G)
+    (outputs : Array G) (sized : outputs.size = kind.outputSize) :
+    HasMessageShape (lookupMessageWidth arities) (byte2Request kind x y outputs) := by
+  cases kind <;>
+    simp only [Byte2Kind.outputSize] at sized <;>
+    simp only [HasMessageShape, byte2Request, List.length_cons, Array.length_toList,
+      List.getElem?_cons_zero, List.getElem?_cons_succ, Option.getD_some,
+      lookupMessageWidth, Byte2Kind.channel, sized] <;> exact ⟨by decide +kernel, rfl⟩
+
+theorem byte1Outputs_size (kind : Byte1Kind) (row : Fin 256) :
+    (byte1Outputs kind row).size = kind.outputSize := by
+  cases kind <;> simp only [byte1Outputs, Byte1Kind.outputSize, Array.size_ofFn,
+    List.size_toArray, List.length_cons, List.length_nil]
+
+theorem byte2Outputs_size (kind : Byte2Kind) (row : Fin 65536) :
+    (byte2Outputs kind row).size = kind.outputSize := by
+  cases kind <;> simp only [byte2Outputs, Byte2Kind.outputSize,
+    List.size_toArray, List.length_cons, List.length_nil]
+
+theorem functionMessage_injective {arities : FunctionArities}
+    {left right : Bytecode.AIR.Call}
+    (validLeft : FunctionMessageValid arities left)
+    (validRight : FunctionMessageValid arities right)
+    (same : functionMessage left = functionMessage right) : left = right := by
+  obtain ⟨lf, li, lo, lr⟩ := left
+  obtain ⟨rf, ri, ro, rr⟩ := right
+  obtain ⟨lb, lis, los⟩ := validLeft
+  obtain ⟨rb, ris, ros⟩ := validRight
+  obtain ⟨index, values⟩ := List.cons.inj (List.cons.inj same).2
+  have index := G.ofNat_injective_below lb rb index
+  change lf = rf at index
+  subst rf
+  have inputSize : li.toList.length = ri.toList.length := by
+    simp only [Array.length_toList]
+    exact lis.trans ris.symm
+  change (li.toList ++ lo.toList) ++ [lr] = (ri.toList ++ ro.toList) ++ [rr] at values
+  obtain ⟨data, rank⟩ := List.append_inj' values rfl
+  obtain ⟨input, output⟩ := List.append_inj data inputSize
+  have input := Array.toList_inj.mp input
+  have output := Array.toList_inj.mp output
+  have rank := (List.cons.inj rank).1
+  subst ri
+  subst ro
+  subst rr
+  rfl
+
+theorem exactLookupBalance_functionMessages (arities : FunctionArities)
+    {queries : List Bytecode.AIR.Call} {providers : List (Provider Bytecode.AIR.Call)}
+    (queryShapes : ∀ query ∈ queries, FunctionMessageValid arities query)
+    (providerShapes : ∀ provider ∈ providers, provider.2 ≠ 0 →
+      FunctionMessageValid arities provider.1)
+    (balanced : ExactLookupBalance (queries.map functionMessage) (mapProviders functionMessage providers)) :
+    ExactLookupBalance queries providers :=
+  exactLookupBalance_of_injective_on functionMessage (FunctionMessageValid arities)
+    (fun left right same => functionMessage_injective left right same)
+    queryShapes providerShapes balanced
+
+theorem memoryMessage_injective {width : Nat} {left right : G × Array G}
+    (same : memoryMessage width left.1 left.2 = memoryMessage width right.1 right.2) :
+    left = right := by
+  obtain ⟨pointer, contents⟩ := List.cons.inj (List.cons.inj (List.cons.inj same).2).2
+  exact Prod.ext pointer (Array.toList_inj.mp contents)
+
+theorem exactLookupBalance_memoryMessages (width : Nat)
+    {queries : List (G × Array G)} {providers : List (Provider (G × Array G))}
+    (balanced : ExactLookupBalance (queries.map fun request => memoryMessage width request.1 request.2)
+      (mapProviders (fun request => memoryMessage width request.1 request.2) providers)) :
+    ExactLookupBalance queries providers :=
+  exactLookupBalance_of_injective_on (fun request => memoryMessage width request.1 request.2)
+    (fun _ => True) (fun _ _ same => memoryMessage_injective same)
+    (fun _ _ => True.intro) (fun _ _ _ => True.intro) balanced
+
+/-- Root messages omit the final rank field; appending its fixed zero does
+not change any padded lookup message. -/
+theorem padMessage_append_zero {width : Nat} (message : List G) :
+    padMessage width (message ++ [0]) = padMessage width message := by
+  apply congrArg List.ofFn
+  funext i
+  by_cases inside : i.val < message.length
+  · simp only [List.getElem?_append_left inside]
+  · rw [List.getElem?_append_right (by omega)]
+    have outside : message[i.val]? = none := List.getElem?_eq_none (by omega)
+    rw [outside, Option.getD_none]
+    by_cases last : i.val = message.length
+    · simp only [last, Nat.sub_self, List.getElem?_cons_zero, Option.getD_some]
+    · rw [List.getElem?_eq_none (by simp only [List.length_cons, List.length_nil]; omega)]
+      rfl
+
+/-- Without an output-arity check, the last output of one request can be
+the rank of a shorter return. This holds at every padding width. -/
+theorem functionMessage_rank_alias (width : Nat) :
+    let output : Bytecode.AIR.Call := ⟨0, #[], #[7], 0⟩
+    let rank : Bytecode.AIR.Call := ⟨0, #[], #[], 7⟩
+    output ≠ rank ∧ padMessage width (functionMessage output) =
+      padMessage width (functionMessage rank) := by
+  constructor
+  · decide +kernel
+  · change padMessage width ([0, 0, 7] ++ [0]) = padMessage width [0, 0, 7]
+    exact padMessage_append_zero _
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/LookupShapes.lean b/Ix/Aiur/Proofs/LookupShapes.lean
new file mode 100644
index 000000000..c54900191
--- /dev/null
+++ b/Ix/Aiur/Proofs/LookupShapes.lean
@@ -0,0 +1,264 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.LookupShapes
+import Ix.Aiur.Semantics.AIR
+import Ix.Aiur.BoundVerifier
+import Ix.Aiur.Proofs.CallOrder
+
+/-! A checked return-arity validator implies the output size of every AIR
+execution, including early returns and match continuations. -/
+
+namespace Aiur.Bytecode
+
+theorem returnsHaveSize_match (size : Nat) (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) :
+    (Ctrl.match index branches fallback).returnsHaveSize size = true ↔
+      (∀ pair ∈ branches.toList, pair.2.returnsHaveSize size = true) ∧
+        (∀ block, fallback = some block → block.returnsHaveSize size = true) := by
+  rw [Ctrl.returnsHaveSize.eq_def]
+  simp only [Bool.and_eq_true, Array.all_eq_true',
+    Array.mem_attach, forall_const, Subtype.forall]
+  cases fallback <;> simp
+
+theorem returnsHaveSize_matchContinue (size : Nat) (index : ValIdx)
+    (branches : Array (G × Block)) (fallback : Option Block)
+    (outputs aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback outputs aux lookups continuation).returnsHaveSize size = true ↔
+      (∀ pair ∈ branches.toList, pair.2.returnsHaveSize size = true) ∧
+        (∀ block, fallback = some block → block.returnsHaveSize size = true) ∧
+        continuation.returnsHaveSize size = true := by
+  rw [Ctrl.returnsHaveSize.eq_def]
+  simp only [Bool.and_eq_true, Array.all_eq_true',
+    Array.mem_attach, forall_const, Subtype.forall]
+  cases fallback <;> simp
+
+namespace AIR
+
+/-- A function query uses the input and return boundaries of its selected
+callee. Returnless functions satisfy the last check vacuously; they still
+need a finite execution before they can provide a return. -/
+def Call.LookupShape (program : Toplevel) (request : Call) : Prop :=
+  ∃ callee, program.functions[request.function]? = some callee ∧
+    callee.constrained = true ∧ callee.layout.inputSize = request.inputs.size ∧
+    callee.body.returnsHaveSize request.outputs.size = true
+
+theorem list_mapM_some_length (f : α → Option β) (inputs : List α) (outputs : List β)
+    (result : inputs.mapM f = some outputs) : outputs.length = inputs.length := by
+  induction inputs generalizing outputs with
+  | nil => simp only [List.mapM_nil, pure, Option.some.injEq] at result
+           subst outputs; rfl
+  | cons input inputs ih =>
+    simp only [List.mapM_cons, bind, Option.bind, pure] at result
+    cases head : f input with
+    | none => simp only [head, reduceCtorEq] at result
+    | some output =>
+      cases tail : inputs.mapM f with
+      | none => simp only [head, tail, reduceCtorEq] at result
+      | some rest =>
+        simp only [head, tail, Option.some.injEq] at result
+        subst outputs
+        simp only [List.length_cons, ih rest tail]
+
+theorem readValues_size {values : Array G} {indices : Array ValIdx} {outputs : Array G}
+    (read : readValues values indices = some outputs) : outputs.size = indices.size := by
+  have listResult := congrArg (Functor.map Array.toList) read
+  rw [readValues, Array.toList_mapM] at listResult
+  have sizes := list_mapM_some_length (fun index => values[index]?) indices.toList outputs.toList listResult
+  simpa only [Array.length_toList] using sizes
+
+theorem SelectArm.returnsHaveSize {scrutinee : G} {branches : Array (G × Block)}
+    {fallback : Option Block} {arm : Block} (selected : SelectArm scrutinee branches fallback arm)
+    (size : Nat) (casesValid : ∀ pair ∈ branches.toList, pair.2.returnsHaveSize size = true)
+    (fallbackValid : ∀ block, fallback = some block → block.returnsHaveSize size = true) :
+    arm.returnsHaveSize size = true := by
+  cases selected with
+  | case member => exact casesValid _ member
+  | fallback present unmatched => exact fallbackValid _ present
+
+def Outcome.ReturnSize (outcome : Outcome) (size : Nat) : Prop :=
+  match outcome with
+  | .returned outputs => outputs.size = size
+  | .yielded _ => True
+
+theorem RunBlock.return_size {memory : Memory} {block : Block} {values : Array G}
+    {outcome : Outcome} {calls : List Call} (execution : RunBlock memory block values outcome calls)
+    (size : Nat) (valid : block.returnsHaveSize size = true) : outcome.ReturnSize size := by
+  revert valid
+  induction execution using RunBlock.rec
+    (motive_2 := fun ctrl _ outcome _ _ => ctrl.returnsHaveSize size = true → outcome.ReturnSize size) with
+  | block operations control ih =>
+    intro valid
+    apply ih
+    simpa only [Block.returnsHaveSize] using valid
+  | returned result valid =>
+    rw [Ctrl.returnsHaveSize] at valid
+    have sized : _ = size := beq_iff_eq.mp valid
+    exact (readValues_size result).trans sized
+  | yielded result valid => exact True.intro
+  | «match» value selected branch ih valid =>
+    obtain ⟨casesValid, fallbackValid⟩ := (returnsHaveSize_match _ _ _ _).mp valid
+    exact ih (selected.returnsHaveSize size casesValid fallbackValid)
+  | matchContinueReturn value selected branch ih valid =>
+    obtain ⟨casesValid, fallbackValid, _⟩ := (returnsHaveSize_matchContinue _ _ _ _ _ _ _ _).mp valid
+    exact ih (selected.returnsHaveSize size casesValid fallbackValid)
+  | matchContinueYield value selected branch outputSize continued ihBranch ihCont valid =>
+    obtain ⟨_, _, contValid⟩ := (returnsHaveSize_matchContinue _ _ _ _ _ _ _ _).mp valid
+    exact ihCont contValid
+
+theorem RunFunction.return_size {program : Toplevel} {memory : Memory}
+    {request : Call} {calls : List Call} (execution : RunFunction program memory request calls)
+    {callee : Function} (present : program.functions[request.function]? = some callee)
+    (size : Nat) (valid : callee.body.returnsHaveSize size = true) : request.outputs.size = size := by
+  cases execution with
+  | function selected arity body =>
+    have same := Option.some.inj (selected.symm.trans present)
+    subst callee
+    exact body.return_size size valid
+
+theorem Step.calls_lookupShape {program : Toplevel} {memory : Memory} {op : Op}
+    {values outputs : Array G} {calls : List Call} (execution : Step memory op values outputs calls)
+    (valid : op.lookupShape program = true) : ∀ request ∈ calls, request.LookupShape program := by
+  intro request member
+  cases execution with
+  | primitive evaluated => cases member
+  | call arguments outputSize =>
+    have same := List.mem_singleton.mp member
+    subst request
+    simp only [Op.lookupShape] at valid
+    split at valid
+    · cases valid
+    · rename_i callee present
+      obtain ⟨constrained, inputSize, returnSize⟩ :=
+        (show _ ∧ _ ∧ _ from by simpa only [Bool.and_eq_true, beq_iff_eq] using valid)
+      refine ⟨callee, present, constrained, ?_, ?_⟩
+      · exact inputSize.trans (readValues_size arguments).symm
+      · simpa only [outputSize] using returnSize
+  | store arguments stored => cases member
+  | load address width loaded => cases member
+
+theorem RunOps.calls_lookupShape {program : Toplevel} {memory : Memory} {ops : List Op}
+    {values outputs : Array G} {calls : List Call} (execution : RunOps memory ops values outputs calls)
+    (valid : ∀ op ∈ ops, op.lookupShape program = true) :
+    ∀ request ∈ calls, request.LookupShape program := by
+  induction execution with
+  | nil => intro request member; cases member
+  | @cons op ops values intermediate firstCalls finalValues restCalls first rest ih =>
+    intro request member
+    rcases List.mem_append.mp member with firstMember | restMember
+    · exact first.calls_lookupShape (valid op List.mem_cons_self) request firstMember
+    · exact ih (fun op member => valid op (List.mem_cons_of_mem _ member)) request restMember
+
+end AIR
+
+theorem lookupShapes_match (program : Toplevel) (yieldSize : Option Nat)
+    (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).lookupShapes program yieldSize = true ↔
+      (∀ pair ∈ branches.toList, pair.2.lookupShapes program yieldSize = true) ∧
+        (∀ block, fallback = some block → block.lookupShapes program yieldSize = true) := by
+  rw [Ctrl.lookupShapes.eq_def]
+  simp only [Bool.and_eq_true, Array.all_eq_true',
+    Array.mem_attach, forall_const, Subtype.forall]
+  cases fallback <;> simp
+
+theorem lookupShapes_matchContinue (program : Toplevel) (yieldSize : Option Nat)
+    (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block)
+    (outputs aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback outputs aux lookups continuation).lookupShapes program yieldSize = true ↔
+      (∀ pair ∈ branches.toList, pair.2.lookupShapes program (some outputs) = true) ∧
+        (∀ block, fallback = some block → block.lookupShapes program (some outputs) = true) ∧
+        continuation.lookupShapes program yieldSize = true := by
+  rw [Ctrl.lookupShapes.eq_def]
+  simp only [Bool.and_eq_true, Array.all_eq_true',
+    Array.mem_attach, forall_const, Subtype.forall]
+  cases fallback <;> simp
+
+namespace AIR
+
+theorem SelectArm.lookupShapes {scrutinee : G} {branches : Array (G × Block)}
+    {fallback : Option Block} {arm : Block} (selected : SelectArm scrutinee branches fallback arm)
+    (program : Toplevel) (yieldSize : Option Nat)
+    (casesValid : ∀ pair ∈ branches.toList, pair.2.lookupShapes program yieldSize = true)
+    (fallbackValid : ∀ block, fallback = some block → block.lookupShapes program yieldSize = true) :
+    arm.lookupShapes program yieldSize = true := by
+  cases selected with
+  | case member => exact casesValid _ member
+  | fallback present unmatched => exact fallbackValid _ present
+
+theorem RunBlock.calls_lookupShape {program : Toplevel} {memory : Memory} {block : Block}
+    {values : Array G} {outcome : Outcome} {calls : List Call}
+    (execution : RunBlock memory block values outcome calls)
+    (yieldSize : Option Nat) (valid : block.lookupShapes program yieldSize = true) :
+    ∀ request ∈ calls, request.LookupShape program := by
+  revert yieldSize valid
+  induction execution using RunBlock.rec
+    (motive_2 := fun ctrl _ _ calls _ => ∀ yieldSize,
+      ctrl.lookupShapes program yieldSize = true →
+        ∀ request ∈ calls, request.LookupShape program) with
+  | block operations control ih =>
+    intro yieldSize valid request member
+    obtain ⟨opsValid, ctrlValid⟩ := (show _ ∧ _ from by
+      simpa only [Block.lookupShapes, Bool.and_eq_true] using valid)
+    rcases List.mem_append.mp member with first | last
+    · apply operations.calls_lookupShape _ request first
+      simpa only [Array.all_eq_true', Array.mem_def] using opsValid
+    · exact ih yieldSize ctrlValid request last
+  | returned result yieldSize valid request member => cases member
+  | yielded result yieldSize valid request member => cases member
+  | «match» value selected branch ih yieldSize valid request member =>
+    obtain ⟨casesValid, fallbackValid⟩ := (lookupShapes_match _ _ _ _ _).mp valid
+    exact ih yieldSize (selected.lookupShapes program yieldSize casesValid fallbackValid) request member
+  | matchContinueReturn value selected branch ih yieldSize valid request member =>
+    obtain ⟨casesValid, fallbackValid, _⟩ := (lookupShapes_matchContinue _ _ _ _ _ _ _ _ _).mp valid
+    exact ih _ (selected.lookupShapes program _ casesValid fallbackValid) request member
+  | matchContinueYield value selected branch outputSize continued ihBranch ihCont yieldSize valid request member =>
+    obtain ⟨casesValid, fallbackValid, contValid⟩ := (lookupShapes_matchContinue _ _ _ _ _ _ _ _ _).mp valid
+    rcases List.mem_append.mp member with first | last
+    · exact ihBranch _ (selected.lookupShapes program _ casesValid fallbackValid) request first
+    · exact ihCont yieldSize contValid request last
+
+theorem RunFunction.calls_lookupShape {program : Toplevel} {memory : Memory}
+    {request : Call} {calls : List Call} (execution : RunFunction program memory request calls)
+    (valid : program.validateLookupShapes = true)
+    {callee : Function} (present : program.functions[request.function]? = some callee)
+    (constrained : callee.constrained = true) :
+    ∀ child ∈ calls, child.LookupShape program := by
+  simp only [Toplevel.validateLookupShapes, Bool.and_eq_true] at valid
+  have functionsValid := valid.2.2
+  have member : callee ∈ program.functions := Array.mem_of_getElem? present
+  have bodyValid := Array.all_eq_true'.mp functionsValid callee member
+  simp only [constrained, Bool.not_true, Bool.false_or] at bodyValid
+  cases execution with
+  | function selected arity body =>
+    have same := Option.some.inj (selected.symm.trans present)
+    subst callee
+    exact body.calls_lookupShape none bodyValid
+
+end AIR
+end Aiur.Bytecode
+
+namespace Aiur.BoundVerifier
+
+theorem Backend.air_return_size {selection : Selection} (backend : Backend selection)
+    {memory : Bytecode.AIR.Memory} {request : Bytecode.AIR.Call}
+    {calls : List Bytecode.AIR.Call}
+    (execution : Bytecode.AIR.RunFunction backend.compiled.bytecode memory request calls)
+    (selected : request.function = selection.function) :
+    request.outputs.size = selection.success.size := by
+  apply execution.return_size (callee := backend.entry) _ _ backend.returnArity
+  simpa only [selected] using backend.present
+
+theorem Backend.claim_shape {selection : Selection} (backend : Backend selection)
+    (input : Array G) (arity : input.size = selection.inputSize) :
+    backend.compiled.bytecode.validClaimShape
+      (buildClaim selection.function input selection.success) = true := by
+  simp only [Bytecode.Toplevel.validClaimShape, buildClaim, Array.toList_append,
+    List.cons_append, List.nil_append, G.n_ofNat,
+    Nat.mod_eq_of_lt backend.functionRange, backend.present, backend.publicEntry,
+    backend.constrained, functionChannel, Bool.true_and, Bool.and_true, List.length_append,
+    Array.length_toList, backend.arity, arity, Nat.add_sub_cancel_left, backend.returnArity]
+  exact decide_eq_true (by omega)
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/Memory.lean b/Ix/Aiur/Proofs/Memory.lean
new file mode 100644
index 000000000..369fdc836
--- /dev/null
+++ b/Ix/Aiur/Proofs/Memory.lean
@@ -0,0 +1,236 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Semantics.AIR
+import Ix.Aiur.Proofs.Lookup
+
+/-!
+Immutable memory facts from incrementing memory tables and exact balance.
+
+The native memory AIR has no first-pointer-zero constraint. Active rows form
+a prefix and their pointers increment in the field; an arbitrary initial
+pointer and wraparound are permitted. A trace-height bound below the field
+characteristic suffices to make these pointers distinct. A separate bound
+on query counts prevents modular cancellation in the lookup argument.
+
+The local polynomial and exact-message interfaces below still require
+extraction from the native proof system. Contents need not be injectively
+stored, acyclic, or created by earlier runtime operations. These theorems
+establish functionality at a fixed width and pointer, not refinement to the
+reference evaluator's insertion-order memory.
+-/
+
+namespace Aiur
+
+theorem G.ext_n {a b : G} (equal : a.n = b.n) : a = b :=
+  Subtype.ext (UInt64.toNat_inj.mp equal)
+
+theorem G.add_zero (a : G) : a + 0 = a := by
+  change G.ofNat (a.n + 0) = a
+  simpa only [Nat.add_zero] using G.ofNat_n a
+
+theorem G.ofNat_add (a b : Nat) : G.ofNat (a + b) = G.ofNat a + G.ofNat b := by
+  apply G.ext_n
+  simp only [G.n_ofNat, G.n_add, Nat.add_mod, Nat.mod_mod]
+
+theorem G.add_assoc (a b c : G) : (a + b) + c = a + (b + c) := by
+  apply G.ext_n
+  simp only [G.n_add, Nat.mod_add_mod, Nat.add_mod_mod, Nat.add_assoc]
+
+theorem G.add_left_cancel (a : G) {b c : G} (equal : a + b = a + c) : b = c := by
+  have ha : a.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp a.property
+  have hb : b.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp b.property
+  have hc : c.n < gSize.toNat := UInt64.lt_iff_toNat_lt.mp c.property
+  have equal := congrArg G.n equal
+  simp only [G.n_add] at equal
+  apply G.ext_n
+  have modulus : gSize.toNat = 18446744069414584321 := by decide
+  rw [modulus] at ha hb hc equal
+  omega
+
+theorem G.ofNat_injective_below {a b : Nat} (ha : a < gSize.toNat)
+    (hb : b < gSize.toNat) (equal : G.ofNat a = G.ofNat b) : a = b := by
+  have equal := congrArg G.n equal
+  simpa only [G.n_ofNat, Nat.mod_eq_of_lt ha, Nat.mod_eq_of_lt hb] using equal
+
+namespace AIR
+
+/-- Columns of a memory row; the table fixes the contents width. -/
+structure MemoryRow where
+  selector : G
+  multiplicity : G
+  pointer : G
+  contents : Array G
+
+/-- Interior transition polynomial: an active successor requires an active row. -/
+def memoryActivityTransition (row next : MemoryRow) : G :=
+  next.selector * (row.selector - 1)
+
+/-- Interior transition polynomial for the incrementing pointer column. -/
+def memoryPointerTransition (row next : MemoryRow) : G :=
+  next.selector * (row.pointer + 1 - next.pointer)
+
+/-- Local memory constraints after decoding boolean selectors. The last row
+has no successor constraint, matching the native transition selector. -/
+structure MemoryRowsValid (width : Nat) (rows : Array MemoryRow) : Prop where
+  selectors : ∀ i (hi : i < rows.size), rows[i].selector = 0 ∨ rows[i].selector = 1
+  activity : ∀ i (hi : i < rows.size), activityConstraint rows[i].multiplicity rows[i].selector = 0
+  widths : ∀ i (hi : i < rows.size), rows[i].contents.size = width
+  activityTransition : ∀ i (hi : i + 1 < rows.size),
+    memoryActivityTransition (rows[i]'(by omega)) rows[i + 1] = 0
+  pointerTransition : ∀ i (hi : i + 1 < rows.size),
+    memoryPointerTransition (rows[i]'(by omega)) rows[i + 1] = 0
+
+theorem MemoryRowsValid.previous_active {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) (i : Nat) (hi : i + 1 < rows.size)
+    (active : rows[i + 1].selector = 1) : (rows[i]'(by omega)).selector = 1 := by
+  have satisfied := valid.activityTransition i hi
+  unfold memoryActivityTransition at satisfied
+  rw [active, G.mul_comm, G.mul_one] at satisfied
+  exact (G.sub_eq_zero_iff (rows[i]'(by omega)).selector 1).mp satisfied
+
+theorem MemoryRowsValid.next_pointer {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) (i : Nat) (hi : i + 1 < rows.size)
+    (active : rows[i + 1].selector = 1) :
+    rows[i + 1].pointer = (rows[i]'(by omega)).pointer + 1 := by
+  have satisfied := valid.pointerTransition i hi
+  unfold memoryPointerTransition at satisfied
+  rw [active, G.mul_comm, G.mul_one] at satisfied
+  exact ((G.sub_eq_zero_iff ((rows[i]'(by omega)).pointer + 1) rows[i + 1].pointer).mp satisfied).symm
+
+theorem MemoryRowsValid.pointer_eq_first_add {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) (i : Nat) (hi : i < rows.size)
+    (active : rows[i].selector = 1) :
+    rows[i].pointer = (rows[0]'(by omega)).pointer + G.ofNat i := by
+  induction i with
+  | zero => simp only [show G.ofNat 0 = (0 : G) from rfl, G.add_zero]
+  | succ i ih =>
+    rw [valid.next_pointer i hi active]
+    rw [ih (by omega) (valid.previous_active i hi active), G.ofNat_add, G.add_assoc]
+    rfl
+
+theorem MemoryRowsValid.pointer_injective {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) (bounded : rows.size < gSize.toNat)
+    (i j : Nat) (hi : i < rows.size) (hj : j < rows.size)
+    (activeI : rows[i].selector = 1) (activeJ : rows[j].selector = 1)
+    (same : rows[i].pointer = rows[j].pointer) : i = j := by
+  rw [valid.pointer_eq_first_add i hi activeI, valid.pointer_eq_first_add j hj activeJ] at same
+  exact G.ofNat_injective_below (by omega) (by omega) (G.add_left_cancel _ same)
+
+def memoryFacts (tables : Nat → Array MemoryRow) : Bytecode.AIR.Memory :=
+  fun width pointer contents => ∃ i : Nat, ∃ hi : i < (tables width).size,
+    (tables width)[i].selector = 1 ∧ (tables width)[i].pointer = pointer ∧
+    (tables width)[i].contents = contents
+
+theorem memoryFacts_functional (tables : Nat → Array MemoryRow)
+    (valid : ∀ width, MemoryRowsValid width (tables width))
+    (bounded : ∀ width, (tables width).size < gSize.toNat)
+    {width : Nat} {pointer : G} {left right : Array G}
+    (loadedLeft : memoryFacts tables width pointer left)
+    (loadedRight : memoryFacts tables width pointer right) : left = right := by
+  obtain ⟨i, hi, ai, pi, vi⟩ := loadedLeft
+  obtain ⟨j, hj, aj, pj, vj⟩ := loadedRight
+  have same := (valid width).pointer_injective (bounded width) i j hi hj ai aj (pi.trans pj.symm)
+  subst j
+  exact vi.symm.trans vj
+
+/-- Providers for one fixed-width memory table, in native row order. -/
+def memoryProviders (rows : Array MemoryRow) : List (Provider (G × Array G)) :=
+  List.ofFn fun i : Fin rows.size =>
+    ((rows[i].pointer, rows[i].contents), rows[i].multiplicity)
+
+theorem memoryQueries_provider {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) {queries : List (G × Array G)}
+    (balanced : ExactLookupBalance queries (memoryProviders rows))
+    (bounded : queries.length < gSize.toNat)
+    {pointer : G} {contents : Array G} (queried : (pointer, contents) ∈ queries) :
+    ∃ i : Nat, ∃ hi : i < rows.size,
+      rows[i].selector = 1 ∧ rows[i].pointer = pointer ∧ rows[i].contents = contents := by
+  obtain ⟨provider, member, same, nonzero⟩ := exactLookupBalance_provider balanced bounded queried
+  obtain ⟨i, provided⟩ := List.mem_ofFn.mp member
+  subst provider
+  have active : rows[i].selector = 1 := by
+    rcases valid.selectors i i.isLt with inactive | active
+    · exact False.elim (nonzero (inactive_multiplicity_zero inactive (valid.activity i i.isLt)))
+    · exact active
+  exact ⟨i, i.isLt, active, congrArg Prod.fst same, congrArg Prod.snd same⟩
+
+theorem memoryQueries_width {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) {queries : List (G × Array G)}
+    (balanced : ExactLookupBalance queries (memoryProviders rows))
+    (bounded : queries.length < gSize.toNat)
+    {pointer : G} {contents : Array G} (queried : (pointer, contents) ∈ queries) :
+    contents.size = width := by
+  obtain ⟨i, hi, _, _, same⟩ := memoryQueries_provider valid balanced bounded queried
+  rw [← same]
+  exact valid.widths i hi
+
+/-- Two balanced requests for the same width and pointer have equal data.
+The trace-height bound prevents a pointer from recurring after a full field
+cycle; the query-count bound separately prevents requests cancelling out. -/
+theorem memoryQueries_consistent {width : Nat} {rows : Array MemoryRow}
+    (valid : MemoryRowsValid width rows) (heightBound : rows.size < gSize.toNat)
+    {queries : List (G × Array G)}
+    (balanced : ExactLookupBalance queries (memoryProviders rows))
+    (queryBound : queries.length < gSize.toNat)
+    {pointer : G} {left right : Array G}
+    (queriedLeft : (pointer, left) ∈ queries)
+    (queriedRight : (pointer, right) ∈ queries) : left = right := by
+  obtain ⟨i, hi, ai, pi, vi⟩ := memoryQueries_provider valid balanced queryBound queriedLeft
+  obtain ⟨j, hj, aj, pj, vj⟩ := memoryQueries_provider valid balanced queryBound queriedRight
+  have same := valid.pointer_injective heightBound i j hi hj ai aj (pi.trans pj.symm)
+  subst j
+  exact vi.symm.trans vj
+
+theorem memoryQueries_fact (tables : Nat → Array MemoryRow)
+    (valid : ∀ width, MemoryRowsValid width (tables width))
+    (queries : Nat → List (G × Array G))
+    (balanced : ∀ width, ExactLookupBalance (queries width) (memoryProviders (tables width)))
+    (bounded : ∀ width, (queries width).length < gSize.toNat)
+    {width : Nat} {pointer : G} {contents : Array G}
+    (queried : (pointer, contents) ∈ queries width) :
+    memoryFacts tables width pointer contents :=
+  memoryQueries_provider (valid width) (balanced width) (bounded width) queried
+
+/-- A size-parameterized table used symbolically at `period = p`. Keeping
+the size as an argument avoids a native initializer allocating `p + 1` rows
+when this proof module is imported. -/
+def memoryPointerCycle (period : Nat) : Array MemoryRow :=
+  Array.ofFn fun i : Fin (period + 1) =>
+    ⟨1, 0, G.ofNat i.val, #[G.ofNat (i.val / period)]⟩
+
+theorem memoryPointerCycle_valid : MemoryRowsValid 1 (memoryPointerCycle gSize.toNat) := by
+  constructor
+  · intro i hi
+    right
+    simp only [memoryPointerCycle, Array.getElem_ofFn]
+  · intro i hi
+    simp only [memoryPointerCycle, Array.getElem_ofFn]
+    exact active_satisfies 0
+  · intro i hi
+    simp only [memoryPointerCycle, Array.getElem_ofFn, List.size_toArray, List.length_cons,
+      List.length_nil]
+  · intro i hi
+    simp only [memoryActivityTransition, memoryPointerCycle, Array.getElem_ofFn]
+    have same : (1 : G) - 1 = 0 := (G.sub_eq_zero_iff _ _).mpr rfl
+    rw [same, G.mul_zero]
+  · intro i hi
+    simp only [memoryPointerTransition, memoryPointerCycle, Array.getElem_ofFn]
+    have same : G.ofNat i + 1 = G.ofNat (i + 1) := (G.ofNat_add i 1).symm
+    rw [same, (G.sub_eq_zero_iff _ _).mpr rfl, G.mul_zero]
+
+theorem memoryPointerCycle_inconsistent :
+    ∃ i j : Fin (memoryPointerCycle gSize.toNat).size,
+      (memoryPointerCycle gSize.toNat)[i].selector = 1 ∧ (memoryPointerCycle gSize.toNat)[j].selector = 1 ∧
+      (memoryPointerCycle gSize.toNat)[i].pointer = (memoryPointerCycle gSize.toNat)[j].pointer ∧
+      (memoryPointerCycle gSize.toNat)[i].contents ≠ (memoryPointerCycle gSize.toNat)[j].contents := by
+  have size : (memoryPointerCycle gSize.toNat).size = gSize.toNat + 1 := by
+    simp only [memoryPointerCycle, Array.size_ofFn]
+  refine ⟨⟨0, by rw [size]; omega⟩, ⟨gSize.toNat, by rw [size]; omega⟩, ?_⟩
+  simp only [Fin.getElem_fin, memoryPointerCycle, Array.getElem_ofFn]
+  decide
+
+end AIR
+end Aiur
diff --git a/Ix/Aiur/Proofs/MemoryColumns.lean b/Ix/Aiur/Proofs/MemoryColumns.lean
new file mode 100644
index 000000000..729aa2faf
--- /dev/null
+++ b/Ix/Aiur/Proofs/MemoryColumns.lean
@@ -0,0 +1,457 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LookupLayout
+
+/-!
+Decode the native memory column layout and its four valued equations.
+Satisfied canonical traces supply valid memory rows and the same weighted
+lookup providers; the checked global trace budget gives functional memory.
+Compilation supplies distinct canonical memory widths. This removes separate
+memory-validity and width hypotheses from backend trace execution. Extraction
+from the native verifier, compiler refinement and certified semantic and
+cryptographic soundness remain separate obligations.
+-/
+
+namespace Aiur.AIR
+
+abbrev MemoryColumns (width : Nat) := Fin (3 + width) → G
+
+def decodeMemoryRow (width : Nat) (columns : MemoryColumns width) : MemoryRow :=
+  ⟨columns ⟨1, by omega⟩, columns ⟨0, by omega⟩, columns ⟨2, by omega⟩,
+    Array.ofFn fun i : Fin width => columns ⟨3 + i.val, by omega⟩⟩
+
+def memoryColumnEquations (width : Nat) (current next : MemoryColumns width) (transition : G) : List G :=
+  let selector := current ⟨1, by omega⟩
+  let nextSelector := next ⟨1, by omega⟩
+  [selector * (selector - 1),
+    current ⟨0, by omega⟩ * (1 - selector),
+    (nextSelector * transition) * (selector - 1),
+    (nextSelector * transition) * (current ⟨2, by omega⟩ + 1 - next ⟨2, by omega⟩)]
+
+def memoryColumnLookup (width : Nat) (columns : MemoryColumns width) : G × List G :=
+  (0 - columns ⟨0, by omega⟩,
+    (memoryMessage width (columns ⟨2, by omega⟩) (decodeMemoryRow width columns).contents).map
+      fun value => columns ⟨1, by omega⟩ * value)
+
+def memoryColumnProvider (width : Nat) (columns : MemoryColumns width) : Provider (List G) :=
+  ((memoryColumnLookup width columns).2, columns ⟨0, by omega⟩)
+
+def memoryNextIndex {height : Nat} (index : Fin height) : Fin height :=
+  if next : index.val + 1 < height then ⟨index.val + 1, next⟩ else ⟨0, by omega⟩
+
+def memoryMatrixEquations (width height : Nat) (matrix : Fin height → MemoryColumns width)
+    (index : Fin height) : List G :=
+  memoryColumnEquations width (matrix index) (matrix (memoryNextIndex index))
+    (if index.val + 1 < height then 1 else 0)
+
+def MemoryMatrixSatisfied (width height : Nat) (matrix : Fin height → MemoryColumns width) : Prop :=
+  ∀ index, ∀ equation ∈ memoryMatrixEquations width height matrix index, equation = 0
+
+def decodeMemoryRows (width height : Nat) (matrix : Fin height → MemoryColumns width) : Array MemoryRow :=
+  Array.ofFn fun index => decodeMemoryRow width (matrix index)
+
+def memoryMatrixProviders (width height : Nat) (matrix : Fin height → MemoryColumns width) :
+    List (Provider (List G)) :=
+  List.ofFn fun index => memoryColumnProvider width (matrix index)
+
+theorem decodeMemoryRow_width (width : Nat) (columns : MemoryColumns width) :
+    (decodeMemoryRow width columns).contents.size = width := by
+  simp only [decodeMemoryRow, Array.size_ofFn]
+
+theorem decodeMemoryRows_size (width height : Nat) (matrix : Fin height → MemoryColumns width) :
+    (decodeMemoryRows width height matrix).size = height := by
+  simp only [decodeMemoryRows, Array.size_ofFn]
+
+theorem memoryColumnProvider_reflect (width : Nat) (current next : MemoryColumns width) (transition : G)
+    (satisfied : ∀ equation ∈ memoryColumnEquations width current next transition, equation = 0)
+    (messageWidth : Nat) :
+    Provider.PaddedEq messageWidth (memoryColumnProvider width current)
+      (memoryMessage width (decodeMemoryRow width current).pointer
+        (decodeMemoryRow width current).contents, (decodeMemoryRow width current).multiplicity) := by
+  refine ⟨rfl, ?_⟩
+  intro nonzero
+  have activity : activityConstraint (current ⟨0, by omega⟩) (current ⟨1, by omega⟩) = 0 :=
+    satisfied _ (by simp only [memoryColumnEquations, List.mem_cons]; exact Or.inr (Or.inl rfl))
+  have active := nonzero_multiplicity_selector_one activity nonzero
+  change padMessage messageWidth
+    ((memoryMessage width (current ⟨2, by omega⟩) (decodeMemoryRow width current).contents).map
+      fun value => current ⟨1, by omega⟩ * value) = _
+  rw [active]
+  simp only [G.mul_comm (1 : G), G.mul_one]
+  rw [List.map_id']
+  rfl
+
+theorem decodeMemoryRows_polynomials (width height : Nat) (matrix : Fin height → MemoryColumns width)
+    (satisfied : MemoryMatrixSatisfied width height matrix) :
+    MemoryRowsPolynomials width (decodeMemoryRows width height matrix) := by
+  constructor
+  · intro i bound
+    have rowBound : i < height := by simpa only [decodeMemoryRows_size] using bound
+    have checked := satisfied ⟨i, rowBound⟩
+    simp only [decodeMemoryRows, Array.getElem_ofFn, decodeMemoryRow, booleanConstraint]
+    exact checked _ (by simp [memoryMatrixEquations, memoryColumnEquations])
+  · intro i bound
+    have rowBound : i < height := by simpa only [decodeMemoryRows_size] using bound
+    have checked := satisfied ⟨i, rowBound⟩
+    simp only [decodeMemoryRows, Array.getElem_ofFn, decodeMemoryRow, activityConstraint]
+    exact checked _ (by simp [memoryMatrixEquations, memoryColumnEquations])
+  · intro i bound
+    simp only [decodeMemoryRows, Array.getElem_ofFn, decodeMemoryRow_width]
+  · intro i bound
+    have rowBound : i + 1 < height := by simpa only [decodeMemoryRows_size] using bound
+    have checked := satisfied ⟨i, by omega⟩
+    have equation := checked _ (show ((matrix (memoryNextIndex ⟨i, by omega⟩)) ⟨1, by omega⟩ *
+      (if i + 1 < height then (1 : G) else 0)) * (matrix ⟨i, by omega⟩ ⟨1, by omega⟩ - 1) ∈
+      memoryMatrixEquations width height matrix ⟨i, by omega⟩ from by
+        simp [memoryMatrixEquations, memoryColumnEquations])
+    simpa only [memoryNextIndex, rowBound, if_pos, dif_pos, G.mul_one,
+      memoryActivityTransition, decodeMemoryRows, Array.getElem_ofFn, decodeMemoryRow] using equation
+  · intro i bound
+    have rowBound : i + 1 < height := by simpa only [decodeMemoryRows_size] using bound
+    have checked := satisfied ⟨i, by omega⟩
+    have equation := checked _ (show ((matrix (memoryNextIndex ⟨i, by omega⟩)) ⟨1, by omega⟩ *
+      (if i + 1 < height then (1 : G) else 0)) *
+        (matrix ⟨i, by omega⟩ ⟨2, by omega⟩ + 1 - matrix (memoryNextIndex ⟨i, by omega⟩) ⟨2, by omega⟩) ∈
+      memoryMatrixEquations width height matrix ⟨i, by omega⟩ from by
+        simp [memoryMatrixEquations, memoryColumnEquations])
+    simpa only [memoryNextIndex, rowBound, if_pos, dif_pos, G.mul_one,
+      memoryPointerTransition, decodeMemoryRows, Array.getElem_ofFn, decodeMemoryRow] using equation
+
+theorem decodeMemoryRows_valid (width height : Nat) (matrix : Fin height → MemoryColumns width)
+    (satisfied : MemoryMatrixSatisfied width height matrix) :
+    MemoryRowsValid width (decodeMemoryRows width height matrix) :=
+  (decodeMemoryRows_polynomials width height matrix satisfied).valid
+
+private theorem memory_forall₂_ofFn {α β : Type} {relation : α → β → Prop}
+    {height : Nat} (left : Fin height → α) (right : Fin height → β)
+    (related : ∀ index, relation (left index) (right index)) :
+    List.Forall₂ relation (List.ofFn left) (List.ofFn right) := by
+  induction height with
+  | zero => simp only [List.ofFn_zero]; exact .nil
+  | succ height ih =>
+    rw [List.ofFn_succ, List.ofFn_succ]
+    exact .cons (related 0) (ih (fun i => left i.succ) (fun i => right i.succ) (fun i => related i.succ))
+
+private theorem memoryProviders_toList (rows : Array MemoryRow) :
+    memoryProviders rows = rows.toList.map (fun row => ((row.pointer, row.contents), row.multiplicity)) := by
+  have list := congrArg (List.map fun row : MemoryRow => ((row.pointer, row.contents), row.multiplicity))
+    (List.ofFn_getElem (xs := rows.toList))
+  simpa only [memoryProviders, List.map_ofFn, Function.comp_def, Array.length_toList,
+    Fin.getElem_fin, Array.getElem_toList] using list
+
+theorem decodeMemoryRows_providers (width height : Nat) (matrix : Fin height → MemoryColumns width) :
+    mapProviders (fun request => memoryMessage width request.1 request.2)
+      (memoryProviders (decodeMemoryRows width height matrix)) =
+      List.ofFn (fun index =>
+        (memoryMessage width (decodeMemoryRow width (matrix index)).pointer
+          (decodeMemoryRow width (matrix index)).contents, (decodeMemoryRow width (matrix index)).multiplicity)) := by
+  rw [memoryProviders_toList]
+  simp only [mapProviders, decodeMemoryRows, Array.toList_ofFn,
+    List.map_ofFn, Function.comp_def]
+
+theorem memoryMatrixProviders_reflect (width height : Nat) (matrix : Fin height → MemoryColumns width)
+    (satisfied : MemoryMatrixSatisfied width height matrix) (messageWidth : Nat) :
+    List.Forall₂ (Provider.PaddedEq messageWidth) (memoryMatrixProviders width height matrix)
+      (mapProviders (fun request => memoryMessage width request.1 request.2)
+        (memoryProviders (decodeMemoryRows width height matrix))) := by
+  rw [decodeMemoryRows_providers]
+  apply memory_forall₂_ofFn
+  intro index
+  exact memoryColumnProvider_reflect width (matrix index) (matrix (memoryNextIndex index))
+    (if index.val + 1 < height then 1 else 0) (satisfied index) messageWidth
+
+end Aiur.AIR
+
+namespace Aiur
+
+private theorem memorySizes_distinct (sizes : Concrete.Bytecode.MemSizes) : sizes.toArray.toList.Nodup := by
+  change sizes.toArray.toList.Pairwise (fun a b => a ≠ b)
+  simpa only [Std.TreeSet.toList_toArray, Std.compare_eq_iff_eq] using sizes.distinct_toList
+
+theorem Concrete.Decls.toBytecode_memorySizes_distinct {decls : Concrete.Decls}
+    {program : Bytecode.Toplevel} {names : Std.HashMap Global Bytecode.FunIdx}
+    (compiled : decls.toBytecode = .ok (program, names)) : program.memorySizes.toList.Nodup := by
+  unfold Concrete.Decls.toBytecode at compiled
+  simp only [bind, Except.bind, pure, Except.pure] at compiled
+  split at compiled
+  · cases compiled
+  · split at compiled
+    · cases compiled
+    · cases compiled
+      exact memorySizes_distinct _
+
+theorem Bytecode.Toplevel.deduplicate_memorySizes (program : Bytecode.Toplevel) :
+    program.deduplicate.1.memorySizes = program.memorySizes := by
+  unfold Bytecode.Toplevel.deduplicate Bytecode.checkedRenaming
+  dsimp only
+  split
+  · unfold Bytecode.Toplevel.deduplicateCandidate
+    dsimp only
+    split <;> rfl
+  · rfl
+
+theorem finishCompilation_memorySizes (source : Source.Toplevel) (raw : Bytecode.Toplevel)
+    (names : Std.HashMap Global Bytecode.FunIdx) :
+    (finishCompilation source raw names).bytecode.memorySizes = raw.memorySizes := by
+  unfold finishCompilation
+  exact raw.deduplicate_memorySizes
+
+theorem Source.Toplevel.compile_memorySizes_distinct {source : Source.Toplevel} {compiled : CompiledToplevel}
+    (accepted : source.compile = .ok compiled) : compiled.bytecode.memorySizes.toList.Nodup := by
+  obtain ⟨inlined, typed, concrete, raw, names, _, _, _, lowered, artifact⟩ :=
+    source.compile_artifact_of_ok accepted
+  rw [artifact, finishCompilation_memorySizes]
+  exact Concrete.Decls.toBytecode_memorySizes_distinct lowered
+
+theorem BoundVerifier.Backend.memorySizes_distinct {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) : backend.compiled.bytecode.memorySizes.toList.Nodup := by
+  obtain ⟨initial, compiled, grouped⟩ := backend.compilation_stages
+  have distinct := Source.Toplevel.compile_memorySizes_distinct compiled
+  split at grouped
+  · cases grouped; exact distinct
+  · rw [(CompiledToplevel.groupFunctions_preserves_code grouped).2.2.2]
+    exact distinct
+
+theorem BoundVerifier.Backend.memorySizes_canonical {selection : BoundVerifier.Selection}
+    (backend : BoundVerifier.Backend selection) :
+    ∀ width ∈ backend.compiled.bytecode.memorySizes.toList, width < gSize.toNat := by
+  have checked := backend.lookupShapes
+  simp only [Bytecode.Toplevel.validateLookupShapes, Bool.and_eq_true] at checked
+  intro width member
+  have valid := Array.all_eq_true'.mp checked.2.1 width (Array.mem_toList_iff.mp member)
+  exact of_decide_eq_true valid
+
+end Aiur
+
+namespace Aiur.AIR
+
+inductive MemoryTraces : List Nat → Type where
+  | nil : MemoryTraces []
+  | inactive (width : Nat) {widths : List Nat} (rest : MemoryTraces widths) : MemoryTraces (width :: widths)
+  | active (width degree : Nat) (matrix : Fin (2^degree) → MemoryColumns width)
+      {widths : List Nat} (rest : MemoryTraces widths) : MemoryTraces (width :: widths)
+
+def MemoryTraces.bitmap {widths : List Nat} : MemoryTraces widths → List Bool
+  | .nil => []
+  | .inactive _ rest => false :: rest.bitmap
+  | .active _ _ _ rest => true :: rest.bitmap
+
+def MemoryTraces.degrees {widths : List Nat} : MemoryTraces widths → List Nat
+  | .nil => []
+  | .inactive _ rest => rest.degrees
+  | .active _ degree _ rest => degree :: rest.degrees
+
+def MemoryTraces.capacity {widths : List Nat} : MemoryTraces widths → Nat
+  | .nil => 0
+  | .inactive _ rest => rest.capacity
+  | .active _ degree _ rest => 2^degree + rest.capacity
+
+def MemoryTraces.rows {widths : List Nat} : MemoryTraces widths → Nat → Array MemoryRow
+  | .nil, _ => #[]
+  | .inactive width rest, size => if size = width then #[] else rest.rows size
+  | .active width degree matrix rest, size =>
+    if size = width then decodeMemoryRows width (2^degree) matrix else rest.rows size
+
+def MemoryTraces.providers {widths : List Nat} : MemoryTraces widths → List (Provider (List G))
+  | .nil => []
+  | .inactive _ rest => rest.providers
+  | .active width degree matrix rest => memoryMatrixProviders width (2^degree) matrix ++ rest.providers
+
+def MemoryTraces.Satisfied {widths : List Nat} : MemoryTraces widths → Prop
+  | .nil => True
+  | .inactive _ rest => rest.Satisfied
+  | .active width degree matrix rest => MemoryMatrixSatisfied width (2^degree) matrix ∧ rest.Satisfied
+
+theorem MemoryTraces.slot_sum_append {widths : List Nat} (traces : MemoryTraces widths)
+    (otherSlots : List Nat) (otherActive : List Bool) (otherDegrees : List Nat) :
+    lookupSlotSum (List.replicate widths.length 1 ++ otherSlots)
+      (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) =
+      (lookupSlotSum otherSlots otherActive otherDegrees).map (traces.capacity + ·) := by
+  induction traces with
+  | nil =>
+    simp only [List.length_nil, List.replicate_zero, List.nil_append, bitmap, degrees, capacity, Nat.zero_add]
+    cases lookupSlotSum otherSlots otherActive otherDegrees <;> rfl
+  | inactive width rest ih =>
+    simp only [List.length_cons, List.replicate_succ, List.cons_append, bitmap, degrees, capacity, lookupSlotSum]
+    exact ih
+  | active width degree matrix rest ih =>
+    simp only [List.length_cons, List.replicate_succ, List.cons_append, bitmap, degrees, capacity,
+      lookupSlotSum, ih, bind, Option.bind, Nat.mul_one]
+    cases lookupSlotSum otherSlots otherActive otherDegrees <;>
+      simp only [Option.map_none, Option.map_some, pure, Nat.add_assoc]
+
+private theorem memoryRows_empty_valid (width : Nat) : MemoryRowsValid width #[] := by
+  constructor <;> intro i bound <;> simp at bound
+
+theorem MemoryTraces.rows_valid {widths : List Nat} (traces : MemoryTraces widths)
+    (satisfied : traces.Satisfied) (width : Nat) : MemoryRowsValid width (traces.rows width) := by
+  induction traces with
+  | nil => exact memoryRows_empty_valid _
+  | inactive size rest ih =>
+    simp only [MemoryTraces.rows]
+    split
+    · exact memoryRows_empty_valid _
+    · exact ih satisfied
+  | active size degree matrix rest ih =>
+    simp only [MemoryTraces.rows]
+    split
+    · rename_i equal
+      subst width
+      exact decodeMemoryRows_valid _ _ _ satisfied.1
+    · exact ih satisfied.2
+
+theorem MemoryTraces.rows_size_le {widths : List Nat} (traces : MemoryTraces widths) (width : Nat) :
+    (traces.rows width).size ≤ traces.capacity := by
+  induction traces with
+  | nil => exact Nat.le_refl _
+  | inactive size rest ih =>
+    simp only [MemoryTraces.rows, MemoryTraces.capacity]
+    split
+    · exact Nat.zero_le _
+    · exact ih
+  | active size degree matrix rest ih =>
+    simp only [MemoryTraces.rows, MemoryTraces.capacity]
+    split
+    · rw [decodeMemoryRows_size]; omega
+    · exact Nat.le_trans ih (Nat.le_add_left _ _)
+
+def memoryTableProviders (widths : List Nat) (rows : Nat → Array MemoryRow) : List (Provider (List G)) :=
+  widths.flatMap fun width => mapProviders (fun request => memoryMessage width request.1 request.2)
+    (memoryProviders (rows width))
+
+private theorem memoryTableProviders_cons (width : Nat) (widths : List Nat) (rows : Nat → Array MemoryRow) :
+    memoryTableProviders (width :: widths) rows =
+      mapProviders (fun request => memoryMessage width request.1 request.2) (memoryProviders (rows width)) ++
+        memoryTableProviders widths rows := rfl
+
+private theorem memoryTableProviders_congr (widths : List Nat) (left right : Nat → Array MemoryRow)
+    (equal : ∀ width ∈ widths, left width = right width) :
+    memoryTableProviders widths left = memoryTableProviders widths right := by
+  induction widths with
+  | nil => rfl
+  | cons width widths ih =>
+    rw [memoryTableProviders_cons, memoryTableProviders_cons, equal width List.mem_cons_self]
+    rw [ih (fun size member => equal size (List.mem_cons_of_mem _ member))]
+
+theorem MemoryTraces.providers_reflect {widths : List Nat} (traces : MemoryTraces widths)
+    (distinct : widths.Nodup) (satisfied : traces.Satisfied) (messageWidth : Nat) :
+    List.Forall₂ (Provider.PaddedEq messageWidth) traces.providers (memoryTableProviders widths traces.rows) := by
+  induction traces with
+  | nil => exact .nil
+  | @inactive width widths rest ih =>
+    have unique := List.nodup_cons.mp distinct
+    have tail : memoryTableProviders widths (MemoryTraces.rows (.inactive width rest)) =
+        memoryTableProviders widths rest.rows := by
+      apply memoryTableProviders_congr
+      intro size member
+      have different : size ≠ width := fun equal => unique.1 (equal ▸ member)
+      simp only [MemoryTraces.rows, if_neg different]
+    rw [memoryTableProviders_cons, tail]
+    have empty : MemoryTraces.rows (.inactive width rest) width = #[] := by simp [MemoryTraces.rows]
+    rw [empty]
+    simpa only [memoryProviders, Array.size_empty, List.ofFn_zero, mapProviders, List.map_nil,
+      List.nil_append, MemoryTraces.providers] using ih unique.2 satisfied
+  | @active width degree matrix widths rest ih =>
+    have unique := List.nodup_cons.mp distinct
+    have tail : memoryTableProviders widths (MemoryTraces.rows (.active width degree matrix rest)) =
+        memoryTableProviders widths rest.rows := by
+      apply memoryTableProviders_congr
+      intro size member
+      have different : size ≠ width := fun equal => unique.1 (equal ▸ member)
+      simp only [MemoryTraces.rows, if_neg different]
+    rw [memoryTableProviders_cons, tail]
+    have first : MemoryTraces.rows (.active width degree matrix rest) width =
+        decodeMemoryRows width (2^degree) matrix := by simp [MemoryTraces.rows]
+    rw [first]
+    exact forall₂_append (memoryMatrixProviders_reflect _ _ _ satisfied.1 messageWidth)
+      (ih unique.2 satisfied.2)
+
+theorem MemoryTraces.capacity_bounded {widths : List Nat} (traces : MemoryTraces widths)
+    {circuits : List Bytecode.Circuit} (functions : CircuitTraces circuits)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (accepted : lookupQueryBound
+      (circuits.map (·.layout.lookups) ++ (List.replicate widths.length 1 ++ otherSlots))
+      (functions.bitmap ++ (traces.bitmap ++ otherActive))
+      (functions.degrees ++ (traces.degrees ++ otherDegrees)) = some result) :
+    traces.capacity + 1 < gSize.toNat := by
+  obtain ⟨_, total, shape, count, bounded⟩ := lookupQueryBound_sound accepted
+  rw [functions.slot_sum_append, traces.slot_sum_append] at shape
+  cases other : lookupSlotSum otherSlots otherActive otherDegrees with
+  | none => simp only [other, Option.map_none, reduceCtorEq] at shape
+  | some extra =>
+    simp only [other, Option.map_some, Option.some.injEq] at shape
+    omega
+
+theorem MemoryTraces.functional {widths : List Nat} (traces : MemoryTraces widths)
+    (satisfied : traces.Satisfied) (bounded : traces.capacity < gSize.toNat)
+    {width : Nat} {pointer : G} {left right : Array G}
+    (loadedLeft : memoryFacts traces.rows width pointer left)
+    (loadedRight : memoryFacts traces.rows width pointer right) : left = right :=
+  memoryFacts_functional traces.rows (traces.rows_valid satisfied)
+    (fun size => Nat.lt_of_le_of_lt (traces.rows_size_le size) bounded) loadedLeft loadedRight
+
+theorem MemoryTraces.functional_of_budget {widths : List Nat} (traces : MemoryTraces widths)
+    {circuits : List Bytecode.Circuit} (functions : CircuitTraces circuits)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (accepted : lookupQueryBound
+      (circuits.map (·.layout.lookups) ++ (List.replicate widths.length 1 ++ otherSlots))
+      (functions.bitmap ++ (traces.bitmap ++ otherActive))
+      (functions.degrees ++ (traces.degrees ++ otherDegrees)) = some result)
+    (satisfied : traces.Satisfied) {width : Nat} {pointer : G} {left right : Array G}
+    (loadedLeft : memoryFacts traces.rows width pointer left)
+    (loadedRight : memoryFacts traces.rows width pointer right) : left = right := by
+  have bounded := traces.capacity_bounded functions accepted
+  exact traces.functional satisfied (by omega) loadedLeft loadedRight
+
+def MemoryTraces.auxiliary {widths : List Nat} (traces : MemoryTraces widths)
+    (byte1 : Byte1Kind → Fin 256 → G) (byte2 : Byte2Kind → Fin 65536 → G) : AuxiliaryTables :=
+  ⟨widths, traces.rows, byte1, byte2⟩
+
+theorem MemoryTraces.circuitProviders_reflect {widths : List Nat} (traces : MemoryTraces widths)
+    (distinct : widths.Nodup) (satisfied : traces.Satisfied) (messageWidth : Nat)
+    (byte1 : Byte1Kind → Fin 256 → G) (byte2 : Byte2Kind → Fin 65536 → G)
+    (circuits : List CircuitEmission) :
+    List.Forall₂ (Provider.PaddedEq messageWidth)
+      (circuitProviders circuits ++ (traces.providers ++ byte1Providers byte1 ++ byte2Providers byte2))
+      ((traces.auxiliary byte1 byte2).circuitProviders circuits) :=
+  forall₂_append (paddedProviders_refl _ _) (forall₂_append
+    (forall₂_append (traces.providers_reflect distinct satisfied messageWidth) (paddedProviders_refl _ _))
+    (paddedProviders_refl _ _))
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+theorem Backend.memory_trace_execution {selection : Selection} (backend : Backend selection)
+    (functions : CircuitTraces backend.compiled.bytecode.circuits.toList)
+    (memories : MemoryTraces backend.compiled.bytecode.memorySizes.toList)
+    (byte1 : Byte1Kind → Fin 256 → G) (byte2 : Byte2Kind → Fin 65536 → G)
+    {witnesses : List CircuitWitness}
+    (emitted : functions.emitWitnesses backend.compiled.bytecode = some witnesses)
+    {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat}
+    (budget : lookupQueryBound
+      (backend.compiled.bytecode.circuits.toList.map (·.layout.lookups) ++
+        (List.replicate backend.compiled.bytecode.memorySizes.size 1 ++ otherSlots))
+      (functions.bitmap ++ (memories.bitmap ++ otherActive))
+      (functions.degrees ++ (memories.degrees ++ otherDegrees)) = some result)
+    (width : Nat) (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        encodedCircuitQueryPool (witnesses.map (·.emission)))
+      (circuitProviders (witnesses.map (·.emission)) ++
+        (memories.providers ++ byte1Providers byte1 ++ byte2Providers byte2)))
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ encodedCircuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied) (memorySatisfied : memories.Satisfied) :
+    Execution backend.compiled.bytecode (memoryFacts memories.rows)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  have decoded := balanced.congr_providers
+    (memories.circuitProviders_reflect backend.memorySizes_distinct memorySatisfied width byte1 byte2 _)
+  exact backend.bounded_trace_execution (memories.auxiliary byte1 byte2) functions emitted budget width input arity
+    decoded publicWidth queryWidths (memories.rows_valid memorySatisfied) backend.memorySizes_canonical satisfied
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/Merkle.lean b/Ix/Aiur/Proofs/Merkle.lean
new file mode 100644
index 000000000..b85fea51e
--- /dev/null
+++ b/Ix/Aiur/Proofs/Merkle.lean
@@ -0,0 +1,467 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Merkle
+import Ix.Aiur.Proofs.Blake3
+import Ix.Aiur.Proofs.MerkleCap
+
+/-! Fixed-width row packing and binary path authentication. Hash security
+is reduced to a collision among the explicitly retained query inputs. -/
+
+namespace Aiur.NativeAIR.Merkle
+
+theorem fieldsBytes_injective {left right : List G}
+    (same : Transcript.fieldsBytes left = Transcript.fieldsBytes right) : left = right := by
+  have lengths := congrArg List.length same
+  rw [Transcript.fieldsBytes_length, Transcript.fieldsBytes_length] at lengths
+  have count : left.length = right.length := by omega
+  have l := KeyCodec.readMany_reads ProofCodec.encodeField left
+    (fun value _ => ProofCodec.readField_reads value) []
+  have r := KeyCodec.readMany_reads ProofCodec.encodeField right
+    (fun value _ => ProofCodec.readField_reads value) []
+  change KeyCodec.readMany ProofCodec.readField left.length
+    (Transcript.fieldsBytes left ++ []) = some (left, []) at l
+  change KeyCodec.readMany ProofCodec.readField right.length
+    (Transcript.fieldsBytes right ++ []) = some (right, []) at r
+  rw [same, count, r] at l
+  exact (congrArg Prod.fst (Option.some.inj l)).symm
+
+theorem pairBytes_length (left right : Digest) : (pairBytes left right).length = 64 := by
+  simp [pairBytes]
+
+theorem pairBytes_injective {left right otherLeft otherRight : Digest}
+    (same : pairBytes left right = pairBytes otherLeft otherRight) :
+    left = otherLeft ∧ right = otherRight := by
+  have heads := congrArg (List.take 32) same
+  have tails := congrArg (List.drop 32) same
+  simp [pairBytes] at heads tails
+  exact ⟨Vector.toList_inj.mp heads, Vector.toList_inj.mp tails⟩
+
+theorem branchBytes_injective {index : Nat} {left right leftSibling rightSibling : Digest}
+    (same : branchBytes index left leftSibling = branchBytes index right rightSibling) :
+    left = right ∧ leftSibling = rightSibling := by
+  unfold branchBytes at same
+  split at same
+  · exact pairBytes_injective same
+  · exact (pairBytes_injective same).symm
+
+theorem shape_length {dimensions : List Dimensions} {rows : List (List G)}
+    (fits : shape dimensions rows = true) : rows.length = dimensions.length := by
+  induction dimensions generalizing rows with
+  | nil => cases rows <;> simp_all [shape]
+  | cons dimension dimensions ih =>
+    cases rows with
+    | nil => simp [shape] at fits
+    | cons row rows =>
+      simp only [shape, Bool.and_eq_true, beq_iff_eq] at fits
+      simp only [List.length_cons, ih fits.2]
+
+theorem rowsAt_absent {dimensions : List Dimensions} {rows : List (List G)} {height : Nat}
+    (absent : hasHeight dimensions height = false) : rowsAt dimensions rows height = [] := by
+  induction dimensions generalizing rows with
+  | nil => rfl
+  | cons dimension dimensions ih =>
+    simp only [hasHeight, List.any_cons, Bool.or_eq_false_iff, beq_eq_false_iff_ne] at absent
+    cases rows with
+    | nil => rfl
+    | cons row rows => simp only [rowsAt, if_neg absent.1, ih absent.2]
+
+theorem rowsAt_injective {dimensions : List Dimensions} {left right : List (List G)}
+    (lf : shape dimensions left = true) (rf : shape dimensions right = true)
+    (same : ∀ height, (rowsAt dimensions left height).flatten = (rowsAt dimensions right height).flatten) :
+    left = right := by
+  induction dimensions generalizing left right with
+  | nil => cases left <;> cases right <;> simp_all [shape]
+  | cons dimension dimensions ih =>
+    cases left with
+    | nil => simp [shape] at lf
+    | cons l left =>
+      cases right with
+      | nil => simp [shape] at rf
+      | cons r right =>
+        simp only [shape, Bool.and_eq_true, beq_iff_eq] at lf rf
+        have first := same dimension.logHeight
+        simp only [rowsAt] at first
+        have pieces := List.append_inj first (lf.1.trans rf.1.symm)
+        obtain rfl := pieces.1
+        congr 1
+        apply ih lf.2 rf.2
+        intro height
+        have next := same height
+        by_cases equal : dimension.logHeight = height
+        · simp only [rowsAt, if_pos equal, List.flatten_cons] at next
+          exact List.append_cancel_left next
+        · simpa only [rowsAt, if_neg equal] using next
+
+theorem rowBytes_injective {dimensions : List Dimensions} {left right : List (List G)}
+    (lf : shape dimensions left = true) (rf : shape dimensions right = true)
+    (same : ∀ height, rowBytes dimensions left height = rowBytes dimensions right height) :
+    left = right :=
+  rowsAt_injective lf rf fun height => fieldsBytes_injective (same height)
+
+theorem CollisionOn.mono {hash : Hash} {smaller larger : List (List UInt8)}
+    (subset : ∀ input ∈ smaller, input ∈ larger) (collision : CollisionOn hash smaller) :
+    CollisionOn hash larger := by
+  obtain ⟨left, hl, right, hr, different, same⟩ := collision
+  exact ⟨left, subset left hl, right, subset right hr, different, same⟩
+
+theorem equal_of_no_collision {hash : Hash} {inputs : List (List UInt8)}
+    (free : ¬CollisionOn hash inputs) {left right : List UInt8}
+    (hl : left ∈ inputs) (hr : right ∈ inputs) (same : hash left = hash right) : left = right := by
+  by_cases equal : left = right
+  · exact equal
+  · exact False.elim (free ⟨left, hl, right, hr, equal, same⟩)
+
+theorem step_calls (hash : Hash) (dimensions : List Dimensions) (rows : List (List G))
+    (height index : Nat) (current sibling : Digest) :
+    (step hash dimensions rows height index current sibling).inputs.length ≤ 3 := by
+  unfold step
+  split <;> simp only [List.length_cons, List.length_nil] <;> omega
+
+theorem walk_calls (hash : Hash) (dimensions : List Dimensions) (rows : List (List G))
+    (height index : Nat) (current : Digest) (proof : List Digest) :
+    (walk hash dimensions rows height index current proof).inputs.length ≤ 3 * proof.length := by
+  induction proof generalizing height index current with
+  | nil => simp [walk]
+  | cons sibling proof ih =>
+    simp only [walk, List.length_append, List.length_cons]
+    have := step_calls hash dimensions rows (height - 1) index current sibling
+    have := ih (height - 1) (index / 2) (step hash dimensions rows (height - 1) index current sibling).digest
+    omega
+
+theorem step_binding {hash : Hash} {dimensions : List Dimensions} {leftRows rightRows : List (List G)}
+    {height index : Nat} {left right leftSibling rightSibling : Digest}
+    (free : ¬CollisionOn hash
+      ((step hash dimensions leftRows height index left leftSibling).inputs ++
+       (step hash dimensions rightRows height index right rightSibling).inputs))
+    (same : (step hash dimensions leftRows height index left leftSibling).digest =
+      (step hash dimensions rightRows height index right rightSibling).digest) :
+    left = right ∧ (hasHeight dimensions height = true →
+      rowBytes dimensions leftRows height = rowBytes dimensions rightRows height) := by
+  by_cases inject : hasHeight dimensions height = true
+  · simp only [step, inject, ↓reduceIte] at same
+    have outer := equal_of_no_collision free (same := same)
+      (by simp [step, inject]) (by simp [step, inject])
+    have parts := pairBytes_injective outer
+    have branch := equal_of_no_collision free
+      (by simp [step, inject]) (by simp [step, inject]) parts.1
+    have leaf := equal_of_no_collision free
+      (by simp [step, inject]) (by simp [step, inject]) parts.2
+    exact ⟨(branchBytes_injective branch).1, fun _ => leaf⟩
+  · simp only [step, if_neg inject] at same
+    have branch := equal_of_no_collision free (same := same)
+      (by simp [step, inject]) (by simp [step, inject])
+    exact ⟨(branchBytes_injective branch).1, fun impossible => False.elim (inject impossible)⟩
+
+/-- Equal final nodes bind the starting digest and every injected height,
+unless the two walks have queried a concrete hash collision. -/
+theorem walk_binding {hash : Hash} {dimensions : List Dimensions} {leftRows rightRows : List (List G)}
+    {height index : Nat} {left right : Digest} {leftProof rightProof : List Digest}
+    (count : leftProof.length = rightProof.length)
+    (free : ¬CollisionOn hash
+      ((walk hash dimensions leftRows height index left leftProof).inputs ++
+       (walk hash dimensions rightRows height index right rightProof).inputs))
+    (same : (walk hash dimensions leftRows height index left leftProof).digest =
+      (walk hash dimensions rightRows height index right rightProof).digest) :
+    left = right ∧ ∀ depth < leftProof.length,
+      hasHeight dimensions (height - (depth + 1)) = true →
+      rowBytes dimensions leftRows (height - (depth + 1)) =
+        rowBytes dimensions rightRows (height - (depth + 1)) := by
+  induction leftProof generalizing rightProof height index left right with
+  | nil =>
+    have empty : rightProof = [] := List.eq_nil_of_length_eq_zero count.symm
+    subst rightProof
+    exact ⟨same, fun depth bound => by simp at bound⟩
+  | cons leftSibling leftProof ih =>
+    cases rightProof with
+    | nil => simp at count
+    | cons rightSibling rightProof =>
+      have tailCount : leftProof.length = rightProof.length := Nat.succ.inj count
+      have freeTail : ¬CollisionOn hash
+          ((walk hash dimensions leftRows (height - 1) (index / 2)
+              (step hash dimensions leftRows (height - 1) index left leftSibling).digest leftProof).inputs ++
+           (walk hash dimensions rightRows (height - 1) (index / 2)
+              (step hash dimensions rightRows (height - 1) index right rightSibling).digest rightProof).inputs) := by
+        intro collision
+        apply free (collision.mono ?_)
+        intro input member
+        simp only [List.mem_append] at member
+        simp only [walk, List.mem_append]
+        exact member.elim (fun h => Or.inl (Or.inr h)) (fun h => Or.inr (Or.inr h))
+      have tail := ih tailCount freeTail same
+      have freeStep : ¬CollisionOn hash
+          ((step hash dimensions leftRows (height - 1) index left leftSibling).inputs ++
+           (step hash dimensions rightRows (height - 1) index right rightSibling).inputs) := by
+        intro collision
+        apply free (collision.mono ?_)
+        intro input member
+        simp only [List.mem_append] at member
+        simp only [walk, List.mem_append]
+        exact member.elim (fun h => Or.inl (Or.inl h)) (fun h => Or.inr (Or.inl h))
+      have first := step_binding freeStep tail.1
+      refine ⟨first.1, ?_⟩
+      intro depth bound inject
+      cases depth with
+      | zero => exact first.2 inject
+      | succ depth =>
+        have shorter : depth < leftProof.length := by simpa using bound
+        have heightEq : height - (depth + 1 + 1) = (height - 1) - (depth + 1) := by omega
+        rw [heightEq] at inject ⊢
+        exact tail.2 depth shorter inject
+
+theorem replay_success {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest} {result : Replay}
+    (success : replay hash dimensions capHeight index rows proof = some result) :
+    dimensions ≠ [] ∧ shape dimensions rows = true ∧ proof.length = maxHeight dimensions - capHeight ∧
+      index < 2^maxHeight dimensions ∧
+      result = ⟨maxHeight dimensions - proof.length, index / 2^proof.length,
+        ⟨(walk hash dimensions rows (maxHeight dimensions) index
+            (hash (rowBytes dimensions rows (maxHeight dimensions))) proof).digest,
+         rowBytes dimensions rows (maxHeight dimensions) ::
+           (walk hash dimensions rows (maxHeight dimensions) index
+             (hash (rowBytes dimensions rows (maxHeight dimensions))) proof).inputs⟩⟩ := by
+  unfold replay at success
+  dsimp only at success
+  split at success
+  · cases success
+  next valid =>
+    simp only [Bool.or_eq_true, List.isEmpty_iff, Bool.not_eq_true',
+      bne_iff_ne, Bool.not_eq_false, decide_eq_true_eq, not_or] at valid
+    exact ⟨valid.1.1.1, by simpa using valid.1.1.2,
+      Decidable.not_not.mp valid.1.2, valid.2, (Option.some.inj success).symm⟩
+
+theorem replay_complete {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest}
+    (nonempty : dimensions ≠ []) (fits : shape dimensions rows = true)
+    (count : proof.length = maxHeight dimensions - capHeight) (bounded : index < 2^maxHeight dimensions) :
+    replay hash dimensions capHeight index rows proof =
+      some ⟨maxHeight dimensions - proof.length, index / 2^proof.length,
+        ⟨(walk hash dimensions rows (maxHeight dimensions) index
+            (hash (rowBytes dimensions rows (maxHeight dimensions))) proof).digest,
+         rowBytes dimensions rows (maxHeight dimensions) ::
+           (walk hash dimensions rows (maxHeight dimensions) index
+             (hash (rowBytes dimensions rows (maxHeight dimensions))) proof).inputs⟩⟩ := by
+  simp only [replay, List.isEmpty_eq_false_iff.mpr nonempty, fits, Bool.not_true, Bool.or_self,
+    count, bne_self_eq_false, bounded, decide_true, Bool.false_eq_true, ↓reduceIte]
+
+theorem replay_calls {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest} {result : Replay}
+    (success : replay hash dimensions capHeight index rows proof = some result) :
+    result.hashing.inputs.length ≤ 1 + 3 * proof.length := by
+  obtain ⟨_, _, _, _, rfl⟩ := replay_success success
+  have := walk_calls hash dimensions rows (maxHeight dimensions) index
+    (hash (rowBytes dimensions rows (maxHeight dimensions))) proof
+  simp only [List.length_cons]
+  omega
+
+theorem replay_position {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest} {result : Replay}
+    (success : replay hash dimensions capHeight index rows proof = some result) :
+    result.logHeight = min capHeight (maxHeight dimensions) ∧
+      result.index = index / 2^(maxHeight dimensions - capHeight) := by
+  obtain ⟨_, _, count, _, rfl⟩ := replay_success success
+  simp only [count]
+  constructor
+  · omega
+  · trivial
+
+theorem replay_index_bound {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest} {result : Replay}
+    (success : replay hash dimensions capHeight index rows proof = some result) :
+    result.index < 2^result.logHeight := by
+  obtain ⟨_, _, count, bounded, rfl⟩ := replay_success success
+  apply (Nat.div_lt_iff_lt_mul (Nat.two_pow_pos _)).mpr
+  have lengthBound : proof.length ≤ maxHeight dimensions := by omega
+  simpa only [← Nat.pow_add, Nat.sub_add_cancel lengthBound] using bounded
+
+theorem hasHeight_iff {dimensions : List Dimensions} {height : Nat} :
+    hasHeight dimensions height = true ↔ ∃ dimension ∈ dimensions, dimension.logHeight = height := by
+  simp only [hasHeight, List.any_eq_true, beq_iff_eq]
+
+theorem height_le_max {dimensions : List Dimensions} {dimension : Dimensions}
+    (member : dimension ∈ dimensions) : dimension.logHeight ≤ maxHeight dimensions :=
+  MerkleCap.degree_le_max (List.mem_map.mpr ⟨dimension, member, rfl⟩)
+
+theorem covered_iff {dimensions : List Dimensions} {capHeight : Nat} :
+    covered dimensions capHeight = true ↔
+      ∀ dimension ∈ dimensions, min capHeight (maxHeight dimensions) ≤ dimension.logHeight := by
+  simp only [covered, MerkleCap.coverage_iff, Nat.sub_zero, List.forall_mem_map, maxHeight]
+
+/-- Coverage makes every matrix row recoverable from the authenticated
+height groups. Both paths may supply different sibling digests. -/
+theorem replay_binding {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {leftRows rightRows : List (List G)} {leftProof rightProof : List Digest} {left right : Replay}
+    (coverage : covered dimensions capHeight = true)
+    (ls : replay hash dimensions capHeight index leftRows leftProof = some left)
+    (rs : replay hash dimensions capHeight index rightRows rightProof = some right)
+    (free : ¬CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs))
+    (same : left.hashing.digest = right.hashing.digest) : leftRows = rightRows := by
+  obtain ⟨_, lf, lc, _, rfl⟩ := replay_success ls
+  obtain ⟨_, rf, rc, _, rfl⟩ := replay_success rs
+  have freeWalk : ¬CollisionOn hash
+      ((walk hash dimensions leftRows (maxHeight dimensions) index
+          (hash (rowBytes dimensions leftRows (maxHeight dimensions))) leftProof).inputs ++
+       (walk hash dimensions rightRows (maxHeight dimensions) index
+          (hash (rowBytes dimensions rightRows (maxHeight dimensions))) rightProof).inputs) := by
+    intro collision
+    apply free (collision.mono ?_)
+    intro input member
+    simp only [List.mem_append] at member
+    simp only [List.mem_append, List.mem_cons]
+    exact member.elim (fun h => Or.inl (Or.inr h)) (fun h => Or.inr (Or.inr h))
+  have path := walk_binding (lc.trans rc.symm) freeWalk same
+  have leaf := equal_of_no_collision free
+    (by simp) (by simp) path.1
+  apply rowBytes_injective lf rf
+  intro height
+  by_cases present : hasHeight dimensions height = true
+  · obtain ⟨dimension, member, atHeight⟩ := hasHeight_iff.mp present
+    have upper := height_le_max member
+    have lower := covered_iff.mp coverage dimension member
+    rw [atHeight] at upper lower
+    by_cases atTop : height = maxHeight dimensions
+    · simpa only [atTop] using leaf
+    · have depthBound : maxHeight dimensions - height - 1 < leftProof.length := by omega
+      have heightEq : maxHeight dimensions - (maxHeight dimensions - height - 1 + 1) = height := by omega
+      have inject : hasHeight dimensions (maxHeight dimensions - (maxHeight dimensions - height - 1 + 1)) = true := by
+        simpa only [heightEq] using present
+      simpa only [heightEq] using path.2 _ depthBound inject
+  · have absent : hasHeight dimensions height = false := by simpa using present
+    simp only [rowBytes, rowsAt_absent absent]
+
+theorem verify_success {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {cap : List Digest} {rows : List (List G)} {proof : List Digest}
+    (accepted : verify hash dimensions capHeight index cap rows proof = true) :
+    ∃ result, replay hash dimensions capHeight index rows proof = some result ∧
+      cap[result.index]? = some result.hashing.digest := by
+  cases running : replay hash dimensions capHeight index rows proof with
+  | none => simp [verify, running] at accepted
+  | some result =>
+    exact ⟨result, rfl, by simpa only [verify, running, accepts, beq_iff_eq] using accepted⟩
+
+/-- Two different accepted rows at the same public dimensions, cap and
+index exhibit a collision within at most two path transcripts. -/
+theorem verify_collision {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {cap : List Digest} {leftRows rightRows : List (List G)} {leftProof rightProof : List Digest}
+    (coverage : covered dimensions capHeight = true)
+    (la : verify hash dimensions capHeight index cap leftRows leftProof = true)
+    (ra : verify hash dimensions capHeight index cap rightRows rightProof = true)
+    (different : leftRows ≠ rightRows) :
+    ∃ left right, replay hash dimensions capHeight index leftRows leftProof = some left ∧
+      replay hash dimensions capHeight index rightRows rightProof = some right ∧
+      CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) ∧
+      (left.hashing.inputs ++ right.hashing.inputs).length ≤ 2 + 6 * (maxHeight dimensions - capHeight) := by
+  classical
+  obtain ⟨left, ls, lc⟩ := verify_success la
+  obtain ⟨right, rs, rc⟩ := verify_success ra
+  have li := (replay_position ls).2
+  have ri := (replay_position rs).2
+  have sameIndex := li.trans ri.symm
+  rw [sameIndex, rc] at lc
+  have same := (Option.some.inj lc).symm
+  have collision : CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) := by
+    by_cases collides : CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs)
+    · exact collides
+    · exact False.elim (different (replay_binding coverage ls rs collides same))
+  refine ⟨left, right, ls, rs, collision, ?_⟩
+  have leftBound := replay_calls ls
+  have rightBound := replay_calls rs
+  have leftCount := (replay_success ls).2.2.1
+  have rightCount := (replay_success rs).2.2.1
+  simp only [List.length_append]
+  omega
+
+theorem verifyCovered_collision {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {cap : List Digest} {leftRows rightRows : List (List G)} {leftProof rightProof : List Digest}
+    (la : verifyCovered hash dimensions capHeight index cap leftRows leftProof = true)
+    (ra : verifyCovered hash dimensions capHeight index cap rightRows rightProof = true)
+    (different : leftRows ≠ rightRows) :
+    ∃ left right, replay hash dimensions capHeight index leftRows leftProof = some left ∧
+      replay hash dimensions capHeight index rightRows rightProof = some right ∧
+      CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) ∧
+      (left.hashing.inputs ++ right.hashing.inputs).length ≤ 2 + 6 * (maxHeight dimensions - capHeight) := by
+  simp only [verifyCovered, Bool.and_eq_true] at la ra
+  exact verify_collision la.1 la.2 ra.2 different
+
+theorem blake3_collision {dimensions : List Dimensions} {capHeight index : Nat}
+    {cap : List Digest} {leftRows rightRows : List (List G)} {leftProof rightProof : List Digest}
+    (la : verifyCovered Blake3.digest dimensions capHeight index cap leftRows leftProof = true)
+    (ra : verifyCovered Blake3.digest dimensions capHeight index cap rightRows rightProof = true)
+    (different : leftRows ≠ rightRows) :
+    ∃ left right, replay Blake3.digest dimensions capHeight index leftRows leftProof = some left ∧
+      replay Blake3.digest dimensions capHeight index rightRows rightProof = some right ∧
+      CollisionOn Blake3.digest (left.hashing.inputs ++ right.hashing.inputs) ∧
+      (left.hashing.inputs ++ right.hashing.inputs).length ≤ 2 + 6 * (maxHeight dimensions - capHeight) :=
+  verifyCovered_collision la ra different
+
+theorem branchBytes_length (index : Nat) (current sibling : Digest) :
+    (branchBytes index current sibling).length = 64 := by
+  unfold branchBytes
+  split <;> exact pairBytes_length _ _
+
+theorem rowsAt_fields_le (dimensions : List Dimensions) (rows : List (List G)) (height : Nat) :
+    (rowsAt dimensions rows height).flatten.length ≤ rows.flatten.length := by
+  induction dimensions generalizing rows with
+  | nil => simp [rowsAt]
+  | cons dimension dimensions ih =>
+    cases rows with
+    | nil => simp [rowsAt]
+    | cons row rows =>
+      have rest := ih rows
+      unfold rowsAt
+      split <;> simp only [List.flatten_cons, List.length_append] <;> omega
+
+theorem rowBytes_length_le (dimensions : List Dimensions) (rows : List (List G)) (height : Nat) :
+    (rowBytes dimensions rows height).length ≤ 8 * rows.flatten.length := by
+  rw [rowBytes, Transcript.fieldsBytes_length]
+  exact Nat.mul_le_mul_left 8 (rowsAt_fields_le dimensions rows height)
+
+theorem step_input_length {hash : Hash} {dimensions : List Dimensions} {rows : List (List G)}
+    {height index : Nat} {current sibling : Digest} {input : List UInt8}
+    (member : input ∈ (step hash dimensions rows height index current sibling).inputs) :
+    input.length ≤ max 64 (8 * rows.flatten.length) := by
+  unfold step at member
+  split at member
+  · simp only [List.mem_cons, List.not_mem_nil, or_false] at member
+    rcases member with rfl | rfl | rfl
+    · rw [branchBytes_length]; exact Nat.le_max_left _ _
+    · exact Nat.le_trans (rowBytes_length_le dimensions rows height) (Nat.le_max_right _ _)
+    · rw [pairBytes_length]; exact Nat.le_max_left _ _
+  · simp only [List.mem_singleton] at member
+    subst input
+    rw [branchBytes_length]
+    exact Nat.le_max_left _ _
+
+theorem walk_input_length {hash : Hash} {dimensions : List Dimensions} {rows : List (List G)}
+    {height index : Nat} {current : Digest} {proof : List Digest} {input : List UInt8}
+    (member : input ∈ (walk hash dimensions rows height index current proof).inputs) :
+    input.length ≤ max 64 (8 * rows.flatten.length) := by
+  induction proof generalizing height index current with
+  | nil => cases member
+  | cons sibling proof ih =>
+    simp only [walk, List.mem_append] at member
+    exact member.elim step_input_length ih
+
+theorem replay_input_length {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest} {result : Replay}
+    (success : replay hash dimensions capHeight index rows proof = some result)
+    {input : List UInt8} (member : input ∈ result.hashing.inputs) :
+    input.length ≤ max 64 (8 * rows.flatten.length) := by
+  obtain ⟨_, _, _, _, rfl⟩ := replay_success success
+  simp only [List.mem_cons] at member
+  rcases member with rfl | member
+  · exact Nat.le_trans (rowBytes_length_le dimensions rows (maxHeight dimensions)) (Nat.le_max_right _ _)
+  · exact walk_input_length member
+
+theorem replay_native_input {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {rows : List (List G)} {proof : List Digest} {result : Replay}
+    (success : replay hash dimensions capHeight index rows proof = some result)
+    (bounded : rows.flatten.length < 2^61) {input : List UInt8} (member : input ∈ result.hashing.inputs) :
+    Blake3.NativeInput input := by
+  have bound := replay_input_length success member
+  unfold Blake3.NativeInput
+  omega
+
+end Aiur.NativeAIR.Merkle
diff --git a/Ix/Aiur/Proofs/MerkleCap.lean b/Ix/Aiur/Proofs/MerkleCap.lean
new file mode 100644
index 000000000..4d58acb0e
--- /dev/null
+++ b/Ix/Aiur/Proofs/MerkleCap.lean
@@ -0,0 +1,168 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.MerkleCap
+import Ix.Aiur.Proofs.ShapedVerifier
+
+/-! Cap coverage puts every selected power-of-two matrix injection on the
+authenticated path. Hash binding and native path replay remain separate.
+-/
+
+namespace Aiur.NativeAIR.MerkleCap
+
+theorem maxDegree_nil : maxDegree [] = 0 := rfl
+
+theorem maxDegree_cons (degree : Nat) (degrees : List Nat) :
+    maxDegree (degree :: degrees) = max degree (maxDegree degrees) := rfl
+
+theorem degree_le_max {degree : Nat} {degrees : List Nat} (member : degree ∈ degrees) :
+    degree ≤ maxDegree degrees := by
+  induction degrees with
+  | nil => cases member
+  | cons first rest ih =>
+    simp only [List.mem_cons] at member
+    rw [maxDegree_cons]
+    rcases member with rfl | member
+    · omega
+    · have := ih member; omega
+
+theorem maxDegree_le {degrees : List Nat} {bound : Nat}
+    (bounded : ∀ degree ∈ degrees, degree ≤ bound) : maxDegree degrees ≤ bound := by
+  induction degrees with
+  | nil => exact Nat.zero_le _
+  | cons degree rest ih =>
+    have first := bounded degree (by simp)
+    have tail := ih (fun d member => bounded d (by simp [member]))
+    rw [maxDegree_cons]
+    omega
+
+theorem maxDegree_mono {selected degrees : List Nat}
+    (subset : ∀ degree ∈ selected, degree ∈ degrees) : maxDegree selected ≤ maxDegree degrees :=
+  maxDegree_le fun degree member => degree_le_max (subset degree member)
+
+theorem coverage_iff {logBlowup capHeight : Nat} {degrees : List Nat} :
+    coverage logBlowup capHeight degrees = true ↔
+      ∀ degree ∈ degrees, min (capHeight - logBlowup) (maxDegree degrees) ≤ degree := by
+  simp only [coverage, List.all_eq_true, decide_eq_true_eq]
+
+theorem coverage_height_iff {logBlowup capHeight : Nat} {degrees : List Nat} :
+    coverage logBlowup capHeight degrees = true ↔
+      ∀ degree ∈ degrees,
+        min capHeight (logBlowup + maxDegree degrees) ≤ logBlowup + degree := by
+  rw [coverage_iff]
+  constructor <;> intro covered degree member
+  · have := covered degree member; omega
+  · have := covered degree member; omega
+
+theorem coverage_empty (logBlowup capHeight : Nat) : coverage logBlowup capHeight [] = true := rfl
+
+theorem coverage_low_cap {logBlowup capHeight : Nat} (low : capHeight ≤ logBlowup)
+    (degrees : List Nat) : coverage logBlowup capHeight degrees = true := by
+  apply coverage_iff.mpr
+  intro degree member
+  omega
+
+theorem coverage_uniform {logBlowup capHeight degree : Nat} {degrees : List Nat}
+    (uniform : ∀ d ∈ degrees, d = degree) : coverage logBlowup capHeight degrees = true := by
+  have bound : maxDegree degrees ≤ degree := maxDegree_le fun d member => by
+    rw [uniform d member]
+    exact Nat.le_refl _
+  apply coverage_iff.mpr
+  intro d member
+  rw [uniform d member]
+  omega
+
+theorem coverage_subset {logBlowup capHeight : Nat} {degrees selected : List Nat}
+    (covered : coverage logBlowup capHeight degrees = true)
+    (subset : ∀ degree ∈ selected, degree ∈ degrees) :
+    coverage logBlowup capHeight selected = true := by
+  have bound := maxDegree_mono subset
+  apply coverage_iff.mpr
+  intro degree member
+  have := coverage_iff.mp covered degree (subset degree member)
+  omega
+
+/-- The matrix is injected no later than the final authenticated path step.
+Clamping the cap to the tree's depth is included in the right-hand side. -/
+theorem coverage_injection {logBlowup capHeight : Nat} {degrees : List Nat}
+    (covered : coverage logBlowup capHeight degrees = true) {degree : Nat}
+    (member : degree ∈ degrees) :
+    (logBlowup + maxDegree degrees) - (logBlowup + degree) ≤
+      (logBlowup + maxDegree degrees) - min capHeight (logBlowup + maxDegree degrees) := by
+  have := coverage_height_iff.mp covered degree member
+  omega
+
+theorem coverage_cap_size {logBlowup capHeight : Nat} {degrees : List Nat}
+    (covered : coverage logBlowup capHeight degrees = true) {degree : Nat}
+    (member : degree ∈ degrees) :
+    2 ^ min capHeight (logBlowup + maxDegree degrees) ≤ 2 ^ (logBlowup + degree) :=
+  Nat.pow_le_pow_right (by decide) (coverage_height_iff.mp covered degree member)
+
+/-- A matrix omitted by the truncated walk must fail the coverage guard. -/
+theorem omitted_rejected {logBlowup capHeight degree : Nat} {degrees : List Nat}
+    (member : degree ∈ degrees)
+    (omitted : (logBlowup + maxDegree degrees) - min capHeight (logBlowup + maxDegree degrees) <
+      (logBlowup + maxDegree degrees) - (logBlowup + degree)) :
+    coverage logBlowup capHeight degrees = false := by
+  cases accepted : coverage logBlowup capHeight degrees with
+  | false => rfl
+  | true => have := coverage_injection accepted member; omega
+
+theorem shorter_matrix_rejected : coverage 0 2 [3, 1] = false := by decide
+
+theorem exact_injection_accepted : coverage 0 1 [3, 1] = true := by decide
+
+theorem check_iff {key : KeyCodec.Key} {proof : ProofCodec.Data} :
+    check key proof = true ↔
+      ∀ degree ∈ proof.logDegrees,
+        min key.parameters.capHeight
+          (key.parameters.logBlowup + maxDegree (proof.logDegrees.map UInt8.toNat)) ≤
+          key.parameters.logBlowup + degree.toNat := by
+  simp only [check, coverage_height_iff, List.forall_mem_map]
+
+theorem check_degree {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    (accepted : check key proof = true) {position : Nat} {degree : UInt8}
+    (present : proof.logDegrees[position]? = some degree) :
+    min key.parameters.capHeight
+      (key.parameters.logBlowup + maxDegree (proof.logDegrees.map UInt8.toNat)) ≤
+      key.parameters.logBlowup + degree.toNat :=
+  check_iff.mp accepted degree (List.mem_of_getElem? present)
+
+end Aiur.NativeAIR.MerkleCap
+
+namespace Aiur.BoundVerifier
+
+theorem CheckedProof.cap_coverage {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) :
+    NativeAIR.MerkleCap.coverage key.parameters.logBlowup key.parameters.capHeight
+      (checked.data.logDegrees.map UInt8.toNat) = true := checked.cap
+
+theorem CheckedProof.row_cap {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) {position : Nat} {row : NativeAIR.ProofShape.Row}
+    (present : checked.rows[position]? = some row) :
+    min key.parameters.capHeight
+      (key.parameters.logBlowup + NativeAIR.MerkleCap.maxDegree (checked.data.logDegrees.map UInt8.toNat)) ≤
+      key.parameters.logBlowup + row.logDegree.toNat :=
+  NativeAIR.MerkleCap.check_degree checked.cap (checked.row present).2.1.degree
+
+theorem CheckedProof.row_injection {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) {position : Nat} {row : NativeAIR.ProofShape.Row}
+    (present : checked.rows[position]? = some row) :
+    (key.parameters.logBlowup + NativeAIR.MerkleCap.maxDegree (checked.data.logDegrees.map UInt8.toNat)) -
+      (key.parameters.logBlowup + row.logDegree.toNat) ≤
+      (key.parameters.logBlowup + NativeAIR.MerkleCap.maxDegree (checked.data.logDegrees.map UInt8.toNat)) -
+        key.parameters.capHeight := by
+  have := checked.row_cap present
+  omega
+
+theorem verifyShaped_cap {selection : Selection} {backend : CompiledBackend selection}
+    {input : Array G} {bytes : ByteArray} (accepted : verifyShaped backend input bytes = .ok ()) :
+    ∃ checked : CheckedProof backend.keyData bytes,
+      readProof backend.keyData bytes = .ok checked ∧
+      NativeAIR.MerkleCap.check backend.keyData checked.data = true := by
+  obtain ⟨checked, parsed, _⟩ := verifyShaped_success accepted
+  exact ⟨checked, parsed, checked.cap⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/Metadata.lean b/Ix/Aiur/Proofs/Metadata.lean
new file mode 100644
index 000000000..416a8ab57
--- /dev/null
+++ b/Ix/Aiur/Proofs/Metadata.lean
@@ -0,0 +1,159 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Semantics.BytecodeEval
+
+/-! Circuit metadata does not change reference bytecode execution. The
+theorem preserves errors and state as well as successful outputs, and works
+in both directions. It does not interpret satisfying AIR witnesses as
+executions of the reference evaluator. -/
+
+namespace Aiur.Bytecode.Eval
+
+structure SameCode (a b : Toplevel) : Prop where
+  size : a.functions.size = b.functions.size
+  body : ∀ i (ha : i < a.functions.size) (hb : i < b.functions.size),
+    a.functions[i].body = b.functions[i].body
+  inputSize : ∀ i (ha : i < a.functions.size) (hb : i < b.functions.size),
+    a.functions[i].layout.inputSize = b.functions[i].layout.inputSize
+
+private theorem ops_lt (b : Block) : sizeOf b.ops < sizeOf b := by
+  cases b; simp; omega
+
+private theorem ctrl_lt (b : Block) : sizeOf b.ctrl < sizeOf b := by
+  cases b; simp; omega
+
+private theorem case_lt (cases : Array (G × Block)) (defaultBlock : Option Block)
+    (i : Nat) (h : i < cases.size) :
+    sizeOf cases[i].2 < sizeOf cases + sizeOf defaultBlock := by
+  have h1 := Array.sizeOf_get cases i h
+  have h2 : sizeOf cases[i].2 < sizeOf cases[i] := by
+    cases cases[i]; simp; omega
+  omega
+
+mutual
+
+theorem evalOp_sameCode {a b : Toplevel} (code : SameCode a b)
+    (fuel : Nat) (op : Op) (st : EvalState) :
+    evalOp a fuel op st = evalOp b fuel op st := by
+  cases op <;> simp only [evalOp]
+  case call fi args outputSize unconstrained =>
+    cases hg : readIdxs st args with
+    | error e => rfl
+    | ok gs =>
+      simp only [bind, Except.bind]
+      by_cases ha : fi < a.functions.size
+      · have hb : fi < b.functions.size := by rwa [← code.size]
+        simp only [dif_pos ha, dif_pos hb, code.inputSize fi ha hb]
+        split
+        · rfl
+        · cases fuel with
+          | zero => rfl
+          | succ fuel =>
+            simp only
+            rw [code.body fi ha hb, evalBlock_sameCode code]
+      · have hb : ¬ fi < b.functions.size := by rwa [← code.size]
+        simp only [dif_neg ha, dif_neg hb]
+termination_by (fuel, sizeOf op, 0)
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem runOps_sameCode {a b : Toplevel} (code : SameCode a b)
+    (fuel : Nat) (ops : Array Op) (st : EvalState) (i : Nat) :
+    runOps a fuel ops st i = runOps b fuel ops st i := by
+  rw [runOps.eq_1 a, runOps.eq_1 b]
+  by_cases h : i < ops.size
+  · simp only [dif_pos h, evalOp_sameCode code fuel ops[i] st]
+    cases evalOp b fuel ops[i] st with
+    | error e => rfl
+    | ok st' => exact runOps_sameCode code fuel ops st' (i + 1)
+  · simp only [dif_neg h]
+termination_by (fuel, sizeOf ops, 1 + (ops.size - i))
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem evalBlock_sameCode {a b : Toplevel} (code : SameCode a b)
+    (fuel : Nat) (block : Block) (st : EvalState) :
+    evalBlock a fuel block st = evalBlock b fuel block st := by
+  rw [evalBlock.eq_1 a, evalBlock.eq_1 b, runOps_sameCode code]
+  cases runOps b fuel block.ops st 0 with
+  | error e => rfl
+  | ok st' => exact evalCtrl_sameCode code fuel block.ctrl st'
+termination_by (fuel, sizeOf block, 4)
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (apply Prod.Lex.right; apply Prod.Lex.left; exact ops_lt _)
+    | (apply Prod.Lex.right; apply Prod.Lex.left; exact ctrl_lt _)
+    | omega
+
+theorem evalCtrl_sameCode {a b : Toplevel} (code : SameCode a b)
+    (fuel : Nat) (ctrl : Ctrl) (st : EvalState) :
+    evalCtrl a fuel ctrl st = evalCtrl b fuel ctrl st := by
+  cases ctrl with
+  | «return» sel outs => simp only [evalCtrl]
+  | «yield» sel outs => simp only [evalCtrl]
+  | «match» idx cases fallback =>
+    simp only [evalCtrl]
+    cases readIdx st idx with
+    | error e => rfl
+    | ok scrut => exact evalMatchArm_sameCode code fuel cases fallback scrut st 0
+  | matchContinue idx cases fallback out aux lookups cont =>
+    simp only [evalCtrl]
+    cases readIdx st idx with
+    | error e => rfl
+    | ok scrut =>
+      simp only
+      rw [evalMatchArm_sameCode code]
+      cases evalMatchArm b fuel cases fallback scrut st with
+      | error e => rfl
+      | ok result => exact evalBlock_sameCode code fuel cont _
+termination_by (fuel, sizeOf ctrl, 3)
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem evalMatchArm_sameCode {a b : Toplevel} (code : SameCode a b)
+    (fuel : Nat) (cases : Array (G × Block)) (fallback : Option Block)
+    (scrut : G) (st : EvalState) (i : Nat) :
+    evalMatchArm a fuel cases fallback scrut st i = evalMatchArm b fuel cases fallback scrut st i := by
+  rw [evalMatchArm.eq_1 a, evalMatchArm.eq_1 b]
+  by_cases h : i < cases.size
+  · simp only [dif_pos h]
+    split
+    · exact evalBlock_sameCode code fuel cases[i].2 st
+    · exact evalMatchArm_sameCode code fuel cases fallback scrut st (i + 1)
+  · simp only [dif_neg h]
+    exact evalDefaultBlock_sameCode code fuel fallback st
+termination_by (fuel, sizeOf cases + sizeOf fallback, 2 + (cases.size - i))
+decreasing_by
+  all_goals
+    clean_wf
+    first
+    | decreasing_tactic
+    | (apply Prod.Lex.right; apply Prod.Lex.left; exact case_lt cases fallback i ‹_›)
+    | (apply Prod.Lex.right; apply Prod.Lex.left
+       cases cases; simp; omega)
+    | omega
+
+theorem evalDefaultBlock_sameCode {a b : Toplevel} (code : SameCode a b)
+    (fuel : Nat) (fallback : Option Block) (st : EvalState) :
+    evalDefaultBlock a fuel fallback st = evalDefaultBlock b fuel fallback st := by
+  cases fallback with
+  | none => simp only [evalDefaultBlock]
+  | some block => simpa only [evalDefaultBlock] using evalBlock_sameCode code fuel block st
+termination_by (fuel, sizeOf fallback, 1)
+decreasing_by all_goals first | decreasing_tactic | (simp_wf; omega)
+
+end
+
+theorem runFunction_sameCode {a b : Toplevel} (code : SameCode a b)
+    (function : FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat) :
+    runFunction a function args io fuel = runFunction b function args io fuel := by
+  rw [runFunction.eq_1 a, runFunction.eq_1 b]
+  by_cases ha : function < a.functions.size
+  · have hb : function < b.functions.size := by rwa [← code.size]
+    simp only [dif_pos ha, dif_pos hb, code.inputSize function ha hb,
+      code.body function ha hb, evalBlock_sameCode code]
+  · have hb : ¬ function < b.functions.size := by rwa [← code.size]
+    simp only [dif_neg ha, dif_neg hb]
+
+end Aiur.Bytecode.Eval
diff --git a/Ix/Aiur/Proofs/NormalizationFrames.lean b/Ix/Aiur/Proofs/NormalizationFrames.lean
new file mode 100644
index 000000000..fca517727
--- /dev/null
+++ b/Ix/Aiur/Proofs/NormalizationFrames.lean
@@ -0,0 +1,162 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Semantics.SourceEval
+
+/-! Semantic identities for let frames, continuation sequencing and call
+modes. They preserve complete results at unchanged call fuel. These are
+components of normalization; fresh naming and complete argument hoisting
+require separate proofs. -/
+
+namespace Aiur.Source.Eval
+
+theorem wrapLets_peelLets (term : Term) :
+    Term.wrapLets term.peelLets.1 term.peelLets.2 = term := by
+  induction term using Term.peelLets.induct with
+  | case1 pattern value body frames core peeled ih =>
+    simpa only [Term.peelLets, peeled, Term.wrapLets] using congrArg (Term.let pattern value) ih
+  | case2 term notLet =>
+    rw [Term.peelLets.eq_def]
+    split
+    · exact False.elim (notLet _ _ _ rfl)
+    · rfl
+
+def evalFrames (decls : Decls) (fuel : Nat) :
+    List (Pattern × Term) → Bindings → EvalState → Except SourceError (Bindings × EvalState)
+  | [], bindings, st => .ok (bindings, st)
+  | (pattern, value) :: frames, bindings, st => do
+    let (value, st) ← interp decls fuel bindings value st
+    let some added := matchPattern st.store pattern value | .error .patternFail
+    evalFrames decls fuel frames (added ++ bindings) st
+
+theorem interp_wrapLets (decls : Decls) (fuel : Nat) (frames : List (Pattern × Term))
+    (body : Term) (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings (Term.wrapLets frames body) st =
+      (do let (bindings, st) ← evalFrames decls fuel frames bindings st
+          interp decls fuel bindings body st) := by
+  induction frames generalizing bindings st with
+  | nil => rfl
+  | cons frame frames ih =>
+    rcases frame with ⟨pattern, value⟩
+    simp only [Term.wrapLets, interp, evalFrames]
+    cases interp decls fuel bindings value st with
+    | error error => rfl
+    | ok result =>
+      rcases result with ⟨value, st'⟩
+      dsimp only [bind, Except.bind]
+      cases matchPattern st'.store pattern value with
+      | none => rfl
+      | some added => exact ih (added ++ bindings) st'
+
+theorem evalFrames_append (decls : Decls) (fuel : Nat)
+    (first rest : List (Pattern × Term)) (bindings : Bindings) (st : EvalState) :
+    evalFrames decls fuel (first ++ rest) bindings st =
+      (do let (bindings, st) ← evalFrames decls fuel first bindings st
+          evalFrames decls fuel rest bindings st) := by
+  induction first generalizing bindings st with
+  | nil => rfl
+  | cons frame frames ih =>
+    rcases frame with ⟨pattern, value⟩
+    simp only [List.cons_append, evalFrames]
+    cases interp decls fuel bindings value st with
+    | error error => rfl
+    | ok result =>
+      rcases result with ⟨value, st'⟩
+      dsimp only [bind, Except.bind]
+      cases matchPattern st'.store pattern value with
+      | none => rfl
+      | some added => exact ih (added ++ bindings) st'
+
+theorem interp_peelLets (decls : Decls) (fuel : Nat) (term : Term)
+    (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings term st =
+      (do let (bindings, st) ← evalFrames decls fuel term.peelLets.1 bindings st
+          interp decls fuel bindings term.peelLets.2 st) := by
+  rw [← interp_wrapLets, wrapLets_peelLets]
+
+theorem interp_ret_wrapLets (decls : Decls) (fuel : Nat)
+    (frames : List (Pattern × Term)) (body : Term) (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings (.ret (Term.wrapLets frames body)) st =
+      interp decls fuel bindings (Term.wrapLets frames (.ret body)) st := by
+  rw [interp_wrapLets]
+  simp only [interp, interp_wrapLets]
+  cases evalFrames decls fuel frames bindings st with
+  | error error => rfl
+  | ok result => cases result; rfl
+
+theorem interp_ioWrite_sequence (decls : Decls) (fuel : Nat)
+    (channel data continuation : Term) (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings (.ioWrite channel data continuation) st =
+      interp decls fuel bindings (.let .wildcard (.ioWrite channel data .unit) continuation) st := by
+  simp only [interp]
+  cases interp decls fuel bindings channel st <;> simp only
+  next result =>
+    rcases result with ⟨channel, st⟩
+    cases interp decls fuel bindings data st <;> simp only
+    next result =>
+      rcases result with ⟨data, st⟩
+      cases channel <;> cases data <;> simp only
+      split <;> simp only [matchPattern, List.nil_append]
+
+theorem interp_debug_sequence (decls : Decls) (fuel : Nat)
+    (label : String) (value : Option Term) (continuation : Term)
+    (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings (.debug label value continuation) st =
+      interp decls fuel bindings (.let .wildcard (.debug label value .unit) continuation) st := by
+  cases value with
+  | none => simp only [interp, matchPattern, List.nil_append]
+  | some value =>
+    simp only [interp]
+    cases interp decls fuel bindings value st with
+    | error error => rfl
+    | ok result =>
+      rcases result with ⟨value, st'⟩
+      simp only [matchPattern, List.nil_append]
+
+theorem interp_assertEq_sequence (decls : Decls) (fuel : Nat)
+    (first second : Term) (message : Option String) (continuation : Term)
+    (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings (.assertEq first second message continuation) st =
+      interp decls fuel bindings
+        (.let .wildcard (.assertEq first second message .unit) continuation) st := by
+  cases message <;> (
+    simp only [interp]
+    cases interp decls fuel bindings first st <;> simp only
+    next result =>
+      rcases result with ⟨first, st⟩
+      cases interp decls fuel bindings second st <;> simp only
+      next result =>
+        rcases result with ⟨second, st⟩
+        split <;> simp only [matchPattern, List.nil_append])
+
+theorem interp_ioSetInfo_sequence (decls : Decls) (fuel : Nat)
+    (channel key index length continuation : Term) (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings (.ioSetInfo channel key index length continuation) st =
+      interp decls fuel bindings
+        (.let .wildcard (.ioSetInfo channel key index length .unit) continuation) st := by
+  simp only [interp]
+  cases interp decls fuel bindings channel st <;> simp only
+  next result =>
+    rcases result with ⟨channel, st⟩
+    cases interp decls fuel bindings key st <;> simp only
+    next result =>
+      rcases result with ⟨key, st⟩
+      cases interp decls fuel bindings index st <;> simp only
+      next result =>
+        rcases result with ⟨index, st⟩
+        cases interp decls fuel bindings length st <;> simp only
+        next result =>
+          rcases result with ⟨length, st⟩
+          cases channel <;> cases key <;> cases index <;> cases length <;> simp only
+          split <;> try simp only
+          split <;> simp only [matchPattern, List.nil_append]
+
+theorem interp_app_mode (decls : Decls) (fuel : Nat) (bindings : Bindings)
+    (global : Global) (args : List Term) (before after : CallMode) (st : EvalState) :
+    interp decls fuel bindings (.app global args before) st =
+      interp decls fuel bindings (.app global args after) st := by
+  simp only [interp]
+
+end Aiur.Source.Eval
diff --git a/Ix/Aiur/Proofs/OpeningShape.lean b/Ix/Aiur/Proofs/OpeningShape.lean
new file mode 100644
index 000000000..3a613b4a2
--- /dev/null
+++ b/Ix/Aiur/Proofs/OpeningShape.lean
@@ -0,0 +1,144 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.VerifierArithmetic
+import Ix.Aiur.Proofs.ShapedVerifier
+import Ix.Aiur.Proofs.Selectors
+import Ix.Aiur.Proofs.LogUp
+
+/-! The selected compiled key supplies the missing preprocessed-slot
+invariant. Together with checked proof shape it gives the complete graph
+view, lookup widths and valid logarithmic trace domain.
+-/
+
+namespace Aiur.NativeAIR.CompiledKey
+
+theorem preprocessedIndices_none (program : Bytecode.Toplevel) (index : Nat) :
+    (preprocessedIndices program)[index]? = some none ↔
+      index < program.circuits.size + program.memorySizes.size := by
+  unfold preprocessedIndices
+  by_cases inside : index < program.circuits.size + program.memorySizes.size
+  · rw [List.getElem?_append_left (by simpa only [List.length_replicate] using inside)]
+    simp only [List.getElem?_replicate, inside, if_true]
+  · rw [List.getElem?_append_right (by simpa using Nat.le_of_not_lt inside)]
+    simp only [List.length_replicate]
+    constructor
+    · intro present
+      have member := List.mem_of_getElem? present
+      simp only [List.mem_cons, List.not_mem_nil, reduceCtorEq, false_or] at member
+    · intro bound; exact False.elim (inside bound)
+
+theorem circuits_preprocessed_absent {program : Bytecode.Toplevel} {result : List KeyCodec.Circuit}
+    (built : circuits program = some result) {index : Nat} {artifact : KeyCodec.Circuit}
+    (selected : result[index]? = some artifact)
+    (absent : (preprocessedIndices program)[index]? = some none) : artifact.preprocessedWidth = 0 := by
+  have bound := (preprocessedIndices_none program index).mp absent
+  by_cases first : index < program.circuits.size
+  · have source := Array.getElem?_eq_getElem first
+    obtain ⟨_, _, _, _, width, _, _⟩ := functionCircuit_success (circuits_function built source selected)
+    exact width
+  · have memory : index - program.circuits.size < program.memorySizes.size := by omega
+    have source := Array.getElem?_eq_getElem memory
+    have equal : program.circuits.size + (index - program.circuits.size) = index := by omega
+    have compiled := circuits_memory built source (equal ▸ selected)
+    obtain ⟨_, _, _, _, width, _, _⟩ := memoryCircuit_success compiled
+    exact width
+
+end Aiur.NativeAIR.CompiledKey
+
+namespace Aiur.BoundVerifier
+open NativeAIR
+
+theorem CompiledBackend.row_preprocessed_absent {selection : Selection}
+    (backend : CompiledBackend selection) {proof : ProofCodec.Data} {index position : Nat}
+    {row : ProofShape.Row} (sourced : row.Sourced backend.keyData proof index position)
+    (absent : row.preprocessed = none) : row.circuit.preprocessedWidth = 0 := by
+  obtain ⟨slot, present, read⟩ := sourced.preprocessed
+  cases slot with
+  | none =>
+    rw [backend.preprocessed_indices] at present
+    exact CompiledKey.circuits_preprocessed_absent backend.circuits_bound sourced.circuit present
+  | some slot =>
+    obtain ⟨_, _, _, _, someRow⟩ := ProofShape.readPreprocessed_some read
+    rw [absent] at someRow
+    cases someRow
+
+end Aiur.BoundVerifier
+
+namespace Aiur.NativeAIR.VerifierArithmetic
+open ProofCodec (Extension)
+open LogUp (Coordinates)
+
+theorem publics_size (challenges : Challenges) (entering leaving : Extension) :
+    (publics challenges entering leaving).size = 8 := rfl
+
+theorem publics_beta (challenges : Challenges) (entering leaving : Extension) :
+    Coordinates.read (publics challenges entering leaving) 0 =
+      some ((Coordinates.fromExtension challenges.beta).map Extension.ofBase) := rfl
+
+theorem publics_gamma (challenges : Challenges) (entering leaving : Extension) :
+    Coordinates.read (publics challenges entering leaving) 1 =
+      some ((Coordinates.fromExtension challenges.gamma).map Extension.ofBase) := rfl
+
+theorem publics_entering (challenges : Challenges) (entering leaving : Extension) :
+    Coordinates.read (publics challenges entering leaving) 2 =
+      some ((Coordinates.fromExtension entering).map Extension.ofBase) := rfl
+
+theorem publics_leaving (challenges : Challenges) (entering leaving : Extension) :
+    Coordinates.read (publics challenges entering leaving) 3 =
+      some ((Coordinates.fromExtension leaving).map Extension.ofBase) := rfl
+
+theorem deltaScaled_size (domain : Domain.Subgroup) (entering leaving : Extension) :
+    (deltaScaled domain entering leaving).size = 2 := rfl
+
+theorem deltaScaled_coordinates (domain : Domain.Subgroup) (entering leaving : Extension) :
+    Coordinates.read (deltaScaled domain entering leaving) 0 =
+      some (((Coordinates.fromExtension (leaving - entering)).scale (Domain.normalizer domain).inverse).map
+        Extension.ofBase) := by
+  change some (⟨(Extension.ofBase leaving.c0 - Extension.ofBase entering.c0) *
+      Extension.ofBase (Domain.normalizer domain).inverse,
+    (Extension.ofBase leaving.c1 - Extension.ofBase entering.c1) *
+      Extension.ofBase (Domain.normalizer domain).inverse⟩ : Coordinates Extension) =
+    some ⟨Extension.ofBase ((leaving.c0 - entering.c0) * (Domain.normalizer domain).inverse),
+      Extension.ofBase ((leaving.c1 - entering.c1) * (Domain.normalizer domain).inverse)⟩
+  rw [Extension.ofBase_mul, Extension.ofBase_mul, Extension.ofBase_sub, Extension.ofBase_sub]
+
+theorem view_fits {parameters : KeyCodec.Parameters} {row : ProofShape.Row}
+    (fits : row.Fits parameters) (absent : row.preprocessed = none → row.circuit.preprocessedWidth = 0)
+    (challenges : Challenges) (entering : Extension) (selectors : Domain.Selectors Extension) :
+    (view challenges row entering selectors).Fits row.circuit.widths := by
+  refine ⟨?_, rfl⟩
+  intro source offset
+  cases source with
+  | main => cases offset <;> simp only [view, rowColumns, pairColumns, List.size_toArray,
+      KeyCodec.Circuit.widths, GraphWidths.width, fits.stage1]
+  | stage2 =>
+    cases offset with
+    | current => exact fits.stage2.1
+    | next => exact fits.stage2.2
+  | preprocessed =>
+    cases selected : row.preprocessed with
+    | none => simp only [view, rowColumns, selected, Array.size_empty, KeyCodec.Circuit.widths,
+        GraphWidths.width, absent selected]
+    | some pair =>
+      have dimensions := fits.preprocessed pair selected
+      cases offset <;> simp only [view, rowColumns, selected, pairColumns, List.size_toArray,
+        KeyCodec.Circuit.widths, GraphWidths.width, dimensions]
+
+theorem domain_defined {parameters : KeyCodec.Parameters} {row : ProofShape.Row} (fits : row.Fits parameters) :
+    ∃ domain, Domain.ofLogSize row.logDegree.toNat = some domain := by
+  have bounded : row.logDegree.toNat < 33 := by have := fits.degree; omega
+  exact ⟨⟨row.logDegree.toNat, bounded⟩, by simp only [Domain.ofLogSize, dif_pos bounded]⟩
+
+theorem stage2_width {parameters : KeyCodec.Parameters} {row : ProofShape.Row} (fits : row.Fits parameters)
+    (positive : 0 < row.circuit.lookupGroupSize) :
+    LogUp.groupCount row.circuit.lookupGroupSize row.circuit.graph.lookups.length * 2 ≤
+      (rowColumns row .stage2 .current).size ∧ 2 ≤ (rowColumns row .stage2 .next).size := by
+  simp only [rowColumns, pairColumns, List.size_toArray, fits.stage2, KeyCodec.Circuit.widths,
+    ← LogUp.groupCount_key row.circuit positive]
+  have := LogUp.groupCount_positive row.circuit.lookupGroupSize row.circuit.graph.lookups.length
+  omega
+
+end Aiur.NativeAIR.VerifierArithmetic
diff --git a/Ix/Aiur/Proofs/OperationAllocation.lean b/Ix/Aiur/Proofs/OperationAllocation.lean
new file mode 100644
index 000000000..87af88c3b
--- /dev/null
+++ b/Ix/Aiur/Proofs/OperationAllocation.lean
@@ -0,0 +1,59 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Stages.Bytecode
+
+/-! Logical output degrees and physical auxiliary allocation of one operation.
+This projection retains the compiler's independent degree bookkeeping. -/
+
+namespace Aiur.Bytecode
+
+structure OpAllocation where
+  degrees : Array Nat
+  auxiliaries : Nat
+  deriving DecidableEq, Repr
+
+def OpAllocation.advice (size : Nat) : OpAllocation := ⟨Array.replicate size 1, size⟩
+
+def selectedDegree (degrees : Array Nat) (indices : Array Nat) (initial : Nat) : Nat :=
+  (indices.map fun index => degrees[index]?.getD 0).foldl Nat.max initial
+
+theorem selectedDegree_initial (degrees : Array Nat) (indices : Array Nat) (initial : Nat) :
+    selectedDegree degrees indices initial = max initial (selectedDegree degrees indices 0) := by
+  simpa only [selectedDegree, Nat.max_zero] using
+    (Array.foldl_assoc (op := Nat.max) (xs := indices.map fun index => degrees[index]?.getD 0)
+      (a₁ := initial) (a₂ := 0))
+
+theorem selectedDegree_append (degrees : Array Nat) (left right : Array Nat) (initial : Nat) :
+    selectedDegree degrees (left ++ right) initial =
+      max (selectedDegree degrees left initial) (selectedDegree degrees right 0) := by
+  simp only [selectedDegree, Array.map_append, Array.foldl_append]
+  exact selectedDegree_initial degrees right _
+
+def Op.allocation (degrees : Array Nat) : Op → OpAllocation
+  | .const _ => ⟨#[0], 0⟩
+  | .add a b | .sub a b => ⟨#[max (degrees[a]?.getD 0) (degrees[b]?.getD 0)], 0⟩
+  | .mul a b =>
+    let degree := degrees[a]?.getD 0 + degrees[b]?.getD 0
+    if degree < 2 then ⟨#[degree], 0⟩ else .advice 1
+  | .eqZero a => if degrees[a]?.getD 0 = 0 then ⟨#[0], 0⟩ else ⟨#[1], 2⟩
+  | .call _ _ size unconstrained =>
+    ⟨Array.replicate size 1, size + (if unconstrained then 0 else 7)⟩
+  | .store _ => .advice 1
+  | .load size _ | .ioRead _ _ size => .advice size
+  | .assertEq .. | .ioSetInfo .. | .ioWrite .. | .debug .. | .u8RangeCheck .. => ⟨#[], 0⟩
+  | .ioGetInfo .. | .unconstrainedBigUintDivMod .. => .advice 2
+  | .u8BitDecomposition .. | .unconstrainedGToBytes .. => .advice 8
+  | .u8ShiftLeft .. | .u8ShiftRight .. | .u8Xor .. | .u8And .. | .u8Or .. | .u8LessThan ..
+  | .unconstrainedGInverse .. => .advice 1
+  | .u8Add a b | .u8Sub a b =>
+    ⟨#[1, max (max (degrees[a]?.getD 0) (degrees[b]?.getD 0)) 1], 1⟩
+  | .u8Mul .. | .u8XorSplit7 .. | .u8XorSplit4 .. => .advice 2
+  | .u32LessThan .. => ⟨#[1], 12⟩
+  | .unconstrainedU32Add a b => ⟨(Array.replicate 4 1).push (selectedDegree degrees (a ++ b) 1), 4⟩
+  | .unconstrainedU32Add3 a b c => ⟨(Array.replicate 4 1).push (selectedDegree degrees (a ++ b ++ c) 1), 4⟩
+  | .u32ToField indices => ⟨#[selectedDegree degrees indices 0], 0⟩
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/OperationDegrees.lean b/Ix/Aiur/Proofs/OperationDegrees.lean
new file mode 100644
index 000000000..5c262d43b
--- /dev/null
+++ b/Ix/Aiur/Proofs/OperationDegrees.lean
@@ -0,0 +1,343 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationSequences
+
+/-!
+Tracked degree zero implies a constant frontend expression. Positive tracked
+degrees may still accompany folded constants; no converse is imposed. This
+invariant is needed to identify equality-test allocation with compiler layout.
+-/
+
+namespace Aiur.NativeAIR
+
+def RowExpr.ZeroConstant (row : RowExpr) : Prop :=
+  row.degree = 0 → ∃ value, row.expr = .konst value
+
+theorem RowExpr.ZeroConstant.konst (value : G) : (RowExpr.konst value).ZeroConstant :=
+  fun _ => ⟨value, rfl⟩
+
+theorem RowExpr.ZeroConstant.variable (column : ColRef) : (RowExpr.variable column).ZeroConstant := by
+  intro zero
+  cases zero
+
+theorem RowExpr.ZeroConstant.add {left right : RowExpr} (a : left.ZeroConstant) (b : right.ZeroConstant) :
+    (left.add right).ZeroConstant := by
+  intro zero
+  change max left.degree right.degree = 0 at zero
+  obtain ⟨x, hx⟩ := a (by omega)
+  obtain ⟨y, hy⟩ := b (by omega)
+  exact ⟨x + y, by simp only [RowExpr.add, hx, hy, Expr.frontAdd, Expr.constantValue]⟩
+
+theorem RowExpr.ZeroConstant.sub {left right : RowExpr} (a : left.ZeroConstant) (b : right.ZeroConstant) :
+    (left.sub right).ZeroConstant := by
+  intro zero
+  change max left.degree right.degree = 0 at zero
+  obtain ⟨x, hx⟩ := a (by omega)
+  obtain ⟨y, hy⟩ := b (by omega)
+  exact ⟨x - y, by simp only [RowExpr.sub, hx, hy, Expr.frontSub, Expr.constantValue]⟩
+
+theorem RowExpr.ZeroConstant.mul {left right : RowExpr} (a : left.ZeroConstant) (b : right.ZeroConstant) :
+    (left.mul right).ZeroConstant := by
+  intro zero
+  change left.degree + right.degree = 0 at zero
+  obtain ⟨x, hx⟩ := a (by omega)
+  obtain ⟨y, hy⟩ := b (by omega)
+  exact ⟨x * y, by simp only [RowExpr.mul, hx, hy, Expr.frontMul, Expr.constantValue]⟩
+
+namespace OpEmitter
+
+def DegreeValid (rows : Array RowExpr) : Prop := ∀ row ∈ rows, row.ZeroConstant
+
+theorem DegreeValid.empty : DegreeValid #[] := by
+  intro row member
+  exact False.elim (Array.not_mem_empty row member)
+
+theorem DegreeValid.singleton {row : RowExpr} (valid : row.ZeroConstant) : DegreeValid #[row] := by
+  intro expr member
+  have equal := Array.mem_singleton.mp member
+  subst expr
+  exact valid
+
+theorem DegreeValid.append {left right : Array RowExpr} (a : DegreeValid left) (b : DegreeValid right) :
+    DegreeValid (left ++ right) := by
+  intro row member
+  rcases Array.mem_append.mp member with member | member
+  · exact a row member
+  · exact b row member
+
+theorem DegreeValid.push {rows : Array RowExpr} {row : RowExpr} (valid : DegreeValid rows)
+    (added : row.ZeroConstant) : DegreeValid (rows.push row) := by
+  intro expr member
+  rcases Array.mem_push.mp member with member | rfl
+  · exact valid expr member
+  · exact added
+
+theorem DegreeValid.read {rows : Array RowExpr} (valid : DegreeValid rows) {index : Nat} {row : RowExpr}
+    (present : rows[index]? = some row) : row.ZeroConstant := valid row (Array.mem_of_getElem? present)
+
+theorem DegreeValid.getD {rows : Array RowExpr} (valid : DegreeValid rows) (index : Nat) :
+    (rows[index]?.getD (.konst 0)).ZeroConstant := by
+  cases present : rows[index]? with
+  | none => exact RowExpr.ZeroConstant.konst 0
+  | some row => exact valid.read present
+
+theorem DegreeValid.select {rows : Array RowExpr} (valid : DegreeValid rows)
+    {indices : Array Nat} {selected : Array RowExpr} (read : select rows indices = some selected) :
+    DegreeValid selected := by
+  intro row member
+  obtain ⟨index, bound, equal⟩ := Array.mem_iff_getElem.mp member
+  have selectedRead : selected[index]? = some row := Array.getElem?_eq_some_iff.mpr ⟨bound, equal⟩
+  have input := array_mapM_read read index
+  rw [selectedRead] at input
+  cases indexRead : indices[index]? with
+  | none => rw [indexRead] at input; cases input
+  | some actual =>
+    simp only [indexRead, bind, Option.bind_some] at input
+    exact valid.read input
+
+theorem advice_degreeValid (first count : Nat) : DegreeValid (advice first count) := by
+  intro row member
+  obtain ⟨index, rfl⟩ := Array.mem_ofFn.mp member
+  exact RowExpr.ZeroConstant.variable _
+
+theorem packFour_degreeValid (bytes : Fin 4 → RowExpr) (valid : ∀ index, (bytes index).ZeroConstant) :
+    (packFour bytes).ZeroConstant := by
+  exact ((((RowExpr.ZeroConstant.konst 0).add ((valid 0).mul (RowExpr.ZeroConstant.konst _))).add
+    ((valid 1).mul (RowExpr.ZeroConstant.konst _))).add
+    ((valid 2).mul (RowExpr.ZeroConstant.konst _))).add
+    ((valid 3).mul (RowExpr.ZeroConstant.konst _))
+
+theorem readWord_degreeValid {rows : Array RowExpr} (valid : DegreeValid rows)
+    {indices : Array Nat} {word : RowExpr} (read : readWord rows indices = some word) : word.ZeroConstant := by
+  simp only [readWord] at read
+  split at read
+  · cases read
+  · simp only [bind, Option.bind] at read
+    split at read
+    · cases read
+    rename_i selected selectedRead
+    cases read
+    exact packFour_degreeValid _ (fun index => (valid.select selectedRead).getD index.val)
+
+theorem fromScalar_degreeValid {scalar : ScalarEmission} (valid : scalar.output.ZeroConstant) :
+    DegreeValid (fromScalar scalar).outputs := DegreeValid.singleton valid
+
+theorem emitMul_degreeValid (selector : Expr) (first : Nat) {left right : RowExpr}
+    (a : left.ZeroConstant) (b : right.ZeroConstant) : (emitMul selector first left right).output.ZeroConstant := by
+  dsimp only [emitMul]
+  split
+  · exact a.mul b
+  · exact RowExpr.ZeroConstant.variable _
+
+theorem emitEqZero_degreeValid (selector : Expr) (first : Nat) (input : RowExpr) :
+    (emitEqZero selector first input).output.ZeroConstant := by
+  unfold emitEqZero
+  split
+  · exact RowExpr.ZeroConstant.konst _
+  · exact RowExpr.ZeroConstant.variable _
+
+theorem emitByte2_degreeValid (first : Nat) (kind : AIR.Byte2Kind) (left right : RowExpr) :
+    DegreeValid (emitByte2 first kind left right).outputs := by
+  have carry (subtract : Bool) : (byteCarry first subtract left right).ZeroConstant := by
+    intro zero
+    change max (max left.degree right.degree) 1 = 0 at zero
+    omega
+  cases kind <;> first
+    | exact advice_degreeValid _ _
+    | exact (advice_degreeValid _ _).push (carry _)
+
+theorem emitWordSum_degreeValid (first : Nat) {sum : RowExpr} (valid : sum.ZeroConstant) :
+    DegreeValid (emitWordSum first sum).outputs :=
+  (advice_degreeValid _ _).push ((valid.sub
+    (packFour_degreeValid _ (fun _ => RowExpr.ZeroConstant.variable _))).mul (RowExpr.ZeroConstant.konst _))
+
+theorem emitU32LessThan_degreeValid (selector : Expr) (first : Nat) (left right : RowExpr) :
+    DegreeValid (emitU32LessThan selector first left right).outputs := by
+  apply DegreeValid.singleton
+  intro zero
+  cases zero
+
+theorem emitByte1_dispatch_degreeValid (selector rank : Expr) (first : Nat) (kind : AIR.Byte1Kind) (index : Nat)
+    {rows : Array RowExpr} {emission : Emission}
+    (emitted : emitOp selector rank first (kind.op index) rows = some emission) : DegreeValid emission.outputs := by
+  rw [emitOp_byte1] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  cases emitted
+  exact advice_degreeValid _ _
+
+theorem emitByte2_dispatch_degreeValid (selector rank : Expr) (first : Nat) (kind : AIR.Byte2Kind) (a b : Nat)
+    {rows : Array RowExpr} {emission : Emission}
+    (emitted : emitOp selector rank first (kind.op a b) rows = some emission) : DegreeValid emission.outputs := by
+  rw [emitOp_byte2] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  cases emitted
+  exact emitByte2_degreeValid _ _ _ _
+
+theorem emitOp_degreeValid {selector rank : Expr} {first : Nat} {op : Bytecode.Op}
+    {rows : Array RowExpr} {emission : Emission} (valid : DegreeValid rows)
+    (emitted : emitOp selector rank first op rows = some emission) :
+    DegreeValid emission.outputs := by
+  cases op with
+  | const value =>
+    cases emitted
+    exact DegreeValid.singleton (RowExpr.ZeroConstant.konst _)
+  | add a b | sub a b | mul a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    apply DegreeValid.singleton
+    first
+    | exact RowExpr.ZeroConstant.add (valid.read readA) (valid.read readB)
+    | exact RowExpr.ZeroConstant.sub (valid.read readA) (valid.read readB)
+    | exact emitMul_degreeValid selector first (valid.read readA) (valid.read readB)
+  | eqZero index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact DegreeValid.singleton (emitEqZero_degreeValid _ _ _)
+  | call function indices size unconstrained =>
+    cases unconstrained with
+    | true =>
+      cases emitted
+      exact advice_degreeValid _ _
+    | false =>
+      simp only [emitOp, Bool.false_eq_true, if_false, bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      cases emitted
+      exact advice_degreeValid _ _
+  | store indices | load size index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact advice_degreeValid _ _
+  | assertEq xs ys message =>
+    simp only [emitOp] at emitted
+    split at emitted
+    · cases emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact DegreeValid.empty
+  | ioGetInfo | ioRead | unconstrainedBigUintDivMod | unconstrainedGToBytes | unconstrainedGInverse =>
+    cases emitted
+    exact advice_degreeValid _ _
+  | ioSetInfo | ioWrite | debug =>
+    cases emitted
+    exact DegreeValid.empty
+  | u8BitDecomposition index => exact emitByte1_dispatch_degreeValid selector rank first .bits index emitted
+  | u8ShiftLeft index => exact emitByte1_dispatch_degreeValid selector rank first .shiftLeft index emitted
+  | u8ShiftRight index => exact emitByte1_dispatch_degreeValid selector rank first .shiftRight index emitted
+  | u8Xor a b => exact emitByte2_dispatch_degreeValid selector rank first .xor a b emitted
+  | u8Add a b => exact emitByte2_dispatch_degreeValid selector rank first .add a b emitted
+  | u8Sub a b => exact emitByte2_dispatch_degreeValid selector rank first .sub a b emitted
+  | u8And a b => exact emitByte2_dispatch_degreeValid selector rank first .and a b emitted
+  | u8Or a b => exact emitByte2_dispatch_degreeValid selector rank first .or a b emitted
+  | u8LessThan a b => exact emitByte2_dispatch_degreeValid selector rank first .lessThan a b emitted
+  | u8RangeCheck a b => exact emitByte2_dispatch_degreeValid selector rank first .range a b emitted
+  | u8Mul a b => exact emitByte2_dispatch_degreeValid selector rank first .mul a b emitted
+  | u8XorSplit7 a b => exact emitByte2_dispatch_degreeValid selector rank first .split7 a b emitted
+  | u8XorSplit4 a b => exact emitByte2_dispatch_degreeValid selector rank first .split4 a b emitted
+  | u32LessThan a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact emitU32LessThan_degreeValid _ _ _ _
+  | unconstrainedU32Add a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    exact emitWordSum_degreeValid _ (RowExpr.ZeroConstant.add
+      (readWord_degreeValid valid readA) (readWord_degreeValid valid readB))
+  | unconstrainedU32Add3 a b c =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i third readC
+    cases emitted
+    exact emitWordSum_degreeValid _ (RowExpr.ZeroConstant.add
+      (RowExpr.ZeroConstant.add (readWord_degreeValid valid readA) (readWord_degreeValid valid readB))
+      (readWord_degreeValid valid readC))
+  | u32ToField indices =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i word read
+    cases emitted
+    exact DegreeValid.singleton (readWord_degreeValid valid read)
+
+theorem emitOps_degreeValid {selector rank : Expr} {ops : List Bytecode.Op} {rows : Array RowExpr}
+    {column : Nat} {emission : OpsEmission} (valid : DegreeValid rows)
+    (emitted : emitOps selector rank ops rows column = some emission) : DegreeValid emission.values := by
+  induction ops generalizing rows column emission with
+  | nil =>
+    cases emitted
+    exact valid
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i first firstEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    exact ih (emission := rest) (valid.append (emitOp_degreeValid valid firstEmitted)) restEmitted
+
+theorem emitEqZero_allocation (selector : Expr) (first : Nat) {input : RowExpr}
+    (valid : input.ZeroConstant) :
+    ((emitEqZero selector first input).used, (emitEqZero selector first input).output.degree) =
+      if input.degree = 0 then (0, 0) else (2, 1) := by
+  by_cases zero : input.degree = 0
+  · obtain ⟨value, constant⟩ := valid zero
+    simp only [emitEqZero, constant, Expr.constantValue, zero, if_true, RowExpr.konst]
+  · cases constant : input.expr.constantValue <;>
+      simp only [emitEqZero, constant, zero, if_false, eqZeroRegular, mainCurrent, RowExpr.variable]
+    split
+    · rename_i impossible
+      exact False.elim (zero impossible)
+    · rfl
+
+end OpEmitter
+end Aiur.NativeAIR
diff --git a/Ix/Aiur/Proofs/OperationExpressions.lean b/Ix/Aiur/Proofs/OperationExpressions.lean
new file mode 100644
index 000000000..377b6d669
--- /dev/null
+++ b/Ix/Aiur/Proofs/OperationExpressions.lean
@@ -0,0 +1,1104 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FrontendExpressions
+
+/-!
+Symbolic operation emission and its evaluation in the valued AIR model.
+The symbolic outputs retain the frontend expression trees and independently
+tracked degrees. Queries are the ungated contributions later assembled into
+physical lookup slots. The call records retain the same expressions as those
+queries and the six allocated rank-gap bytes.
+-/
+
+namespace Aiur.NativeAIR
+namespace OpEmitter
+
+theorem list_mapM_read {read : α → Option β} {inputs : List α} {outputs : List β}
+    (evaluated : inputs.mapM read = some outputs) (index : Nat) :
+    (inputs[index]? >>= read) = outputs[index]? := by
+  induction inputs generalizing outputs index with
+  | nil =>
+    simp only [List.mapM_nil, pure, Option.some.injEq] at evaluated
+    subst outputs
+    rfl
+  | cons input rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind, pure] at evaluated
+    cases head : read input <;> simp only [head] at evaluated
+    · cases evaluated
+    cases tail : rest.mapM read <;> simp only [tail] at evaluated
+    · cases evaluated
+    cases evaluated
+    cases index with
+    | zero => exact head
+    | succ index => exact ih tail index
+
+theorem array_mapM_read {read : α → Option β} {inputs : Array α} {outputs : Array β}
+    (evaluated : inputs.mapM read = some outputs) (index : Nat) :
+    (inputs[index]? >>= read) = outputs[index]? := by
+  have lists := congrArg (Functor.map Array.toList) evaluated
+  rw [Array.toList_mapM] at lists
+  simpa only [Array.getElem?_toList] using list_mapM_read lists index
+
+theorem array_mapM_size {read : α → Option β} {inputs : Array α} {outputs : Array β}
+    (evaluated : inputs.mapM read = some outputs) : outputs.size = inputs.size := by
+  have lists := congrArg (Functor.map Array.toList) evaluated
+  rw [Array.toList_mapM] at lists
+  exact Bytecode.AIR.list_mapM_some_length read inputs.toList outputs.toList lists
+
+theorem array_mapM_push (read : α → Option β) (inputs : Array α) (input : α) :
+    (inputs.push input).mapM read = (do
+      let outputs ← inputs.mapM read
+      let output ← read input
+      return outputs.push output) := by
+  simp only [Array.mapM_eq_mapM_toList, Array.toList_push, List.mapM_append,
+    List.mapM_cons, List.mapM_nil]
+  cases inputs.toList.mapM read <;> cases read input <;>
+    simp only [bind, Option.bind, pure, Functor.map, Option.map]
+  congr 1
+  apply Array.toList_inj.mp
+  simp only [Array.toList_push]
+
+theorem list_mapM_of_map (items : List α) (input : α → β) (output : α → γ)
+    (read : β → Option γ) (evaluated : ∀ item ∈ items, read (input item) = some (output item)) :
+    (items.map input).mapM read = some (items.map output) := by
+  induction items with
+  | nil => rfl
+  | cons item rest ih =>
+    simp only [List.map_cons, List.mapM_cons, evaluated item List.mem_cons_self,
+      ih (fun value member => evaluated value (List.mem_cons_of_mem _ member))]
+    rfl
+
+theorem array_mapM_ofFn {n : Nat} (input : Fin n → α) (output : Fin n → β)
+    (read : α → Option β) (evaluated : ∀ index, read (input index) = some (output index)) :
+    (Array.ofFn input).mapM read = some (Array.ofFn output) := by
+  rw [Array.mapM_eq_mapM_toList, Array.toList_ofFn]
+  have listEval : (List.ofFn input).mapM read = some (List.ofFn output) := by
+    simpa only [List.map_ofFn, Function.comp_id] using
+      list_mapM_of_map (List.ofFn id) input output read (fun index _ => evaluated index)
+  rw [listEval]
+  simp only [Functor.map, Option.map_some, List.toArray_ofFn]
+
+theorem list_mapM_ofFn {n : Nat} (input : Fin n → α) (output : Fin n → β)
+    (read : α → Option β) (evaluated : ∀ index, read (input index) = some (output index)) :
+    (List.ofFn input).mapM read = some (List.ofFn output) := by
+  simpa only [List.map_ofFn, Function.comp_id] using
+    list_mapM_of_map (List.ofFn id) input output read (fun index _ => evaluated index)
+
+theorem list_mapM_transform {read : α → Option β} {inputs : List α} {outputs : List β}
+    (evaluated : inputs.mapM read = some outputs) (input : α → γ) (output : β → δ)
+    (next : γ → Option δ)
+    (related : ∀ a b, read a = some b → next (input a) = some (output b)) :
+    (inputs.map input).mapM next = some (outputs.map output) := by
+  induction inputs generalizing outputs with
+  | nil =>
+    simp only [List.mapM_nil, pure, Option.some.injEq] at evaluated
+    subst outputs
+    rfl
+  | cons a rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind, pure] at evaluated
+    cases head : read a <;> simp only [head] at evaluated
+    · cases evaluated
+    cases tail : rest.mapM read <;> simp only [tail] at evaluated
+    · cases evaluated
+    cases evaluated
+    simp only [List.map_cons, List.mapM_cons, related _ _ head, ih tail]
+    rfl
+
+theorem array_mapM_transform {read : α → Option β} {inputs : Array α} {outputs : Array β}
+    (evaluated : inputs.mapM read = some outputs) (input : α → γ) (output : β → δ)
+    (next : γ → Option δ)
+    (related : ∀ a b, read a = some b → next (input a) = some (output b)) :
+    (inputs.map input).mapM next = some (outputs.map output) := by
+  have lists := congrArg (Functor.map Array.toList) evaluated
+  rw [Array.toList_mapM] at lists
+  rw [Array.mapM_eq_mapM_toList, Array.toList_map,
+    list_mapM_transform lists input output next related]
+  simp only [Functor.map, Option.map_some, ← Array.toList_map, Array.toArray_toList]
+
+theorem list_mapM_refine {first : α → Option β} {second : α → Option γ} {evaluate : β → Option γ}
+    {inputs : List α} {outputs : List β} (selected : inputs.mapM first = some outputs)
+    (related : ∀ input output, first input = some output →
+      ∃ value, second input = some value ∧ evaluate output = some value) :
+    ∃ values, inputs.mapM second = some values ∧ outputs.mapM evaluate = some values := by
+  induction inputs generalizing outputs with
+  | nil =>
+    simp only [List.mapM_nil, pure, Option.some.injEq] at selected
+    subst outputs
+    exact ⟨[], rfl, rfl⟩
+  | cons input rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind, pure] at selected
+    cases head : first input <;> simp only [head] at selected
+    · cases selected
+    cases tail : rest.mapM first <;> simp only [tail] at selected
+    · cases selected
+    cases selected
+    obtain ⟨value, read, evaluated⟩ := related _ _ head
+    obtain ⟨values, reads, evaluations⟩ := ih tail
+    refine ⟨value :: values, ?_, ?_⟩ <;>
+      simp only [List.mapM_cons, read, evaluated, reads, evaluations, bind, Option.bind_some, pure]
+
+theorem array_mapM_refine {first : α → Option β} {second : α → Option γ} {evaluate : β → Option γ}
+    {inputs : Array α} {outputs : Array β} (selected : inputs.mapM first = some outputs)
+    (related : ∀ input output, first input = some output →
+      ∃ value, second input = some value ∧ evaluate output = some value) :
+    ∃ values, inputs.mapM second = some values ∧ outputs.mapM evaluate = some values := by
+  have lists := congrArg (Functor.map Array.toList) selected
+  rw [Array.toList_mapM] at lists
+  obtain ⟨values, reads, evaluations⟩ := list_mapM_refine lists related
+  refine ⟨values.toArray, ?_, ?_⟩ <;>
+    simp only [Array.mapM_eq_mapM_toList, reads, evaluations, Functor.map, Option.map_some]
+
+abbrev evalExpr (values : Values G) := Expr.eval goldilocksOps values
+
+def evalRows (values : Values G) (rows : Array RowExpr) : Option (Array AIR.RowValue) :=
+  rows.mapM (RowExpr.eval values)
+
+theorem evalRows_empty (values : Values G) : evalRows values #[] = some #[] :=
+  Array.mapM_empty _
+
+theorem evalRows_singleton {values : Values G} {expr : RowExpr} {value : AIR.RowValue}
+    (reflected : expr.Reflects values value) : evalRows values #[expr] = some #[value] := by
+  change ((#[] : Array RowExpr).push expr).mapM (RowExpr.eval values) = some #[value]
+  rw [array_mapM_push, Array.mapM_empty, (RowExpr.reflects_iff_eval _ _ _).mp reflected]
+  rfl
+
+def rowExprs (rows : Array RowExpr) : Array Expr := rows.map RowExpr.expr
+
+def Normal (rows : Array RowExpr) : Prop :=
+  ∀ row ∈ rows, row.expr.noConstantNegs = true
+
+theorem evalRows_values {values : Values G} {rows : Array RowExpr} {outputs : Array AIR.RowValue}
+    (evaluated : evalRows values rows = some outputs) :
+    (rowExprs rows).mapM (evalExpr values) = some (AIR.rowValues outputs) := by
+  apply array_mapM_transform evaluated RowExpr.expr AIR.RowValue.value
+  intro expr value result
+  exact ((RowExpr.reflects_iff_eval _ _ _).mpr result).1
+
+theorem evalRows_read {values : Values G} {rows : Array RowExpr} {outputs : Array AIR.RowValue}
+    (evaluated : evalRows values rows = some outputs) {index : Nat} {row : RowExpr}
+    (present : rows[index]? = some row) :
+    ∃ output, outputs[index]? = some output ∧ row.Reflects values output := by
+  have read := array_mapM_read evaluated index
+  rw [present] at read
+  dsimp only [bind, Option.bind_some] at read
+  cases result : row.eval values with
+  | none =>
+    have sizes := array_mapM_size evaluated
+    obtain ⟨bound, _⟩ := Array.getElem?_eq_some_iff.mp present
+    have absent := Array.getElem?_eq_none_iff.mp (read.symm.trans result)
+    omega
+  | some output =>
+    exact ⟨output, read.symm.trans result, (RowExpr.reflects_iff_eval _ _ _).mpr result⟩
+
+def select (rows : Array RowExpr) (indices : Array Nat) : Option (Array RowExpr) :=
+  indices.mapM fun index => rows[index]?
+
+theorem select_reflects {values : Values G} {rows : Array RowExpr} {outputs : Array AIR.RowValue}
+    (evaluated : evalRows values rows = some outputs) {indices : Array Nat} {selected : Array RowExpr}
+    (read : select rows indices = some selected) :
+    ∃ results, indices.mapM (fun index => outputs[index]?) = some results ∧
+      evalRows values selected = some results := by
+  apply array_mapM_refine read
+  intro index expr present
+  obtain ⟨value, present, reflected⟩ := evalRows_read evaluated present
+  exact ⟨value, present, (RowExpr.reflects_iff_eval _ _ _).mp reflected⟩
+
+theorem select_values {rows : Array AIR.RowValue} {indices : Array Nat} {outputs : Array AIR.RowValue}
+    (read : indices.mapM (fun index => rows[index]?) = some outputs) :
+    Bytecode.AIR.readValues (AIR.rowValues rows) indices = some (AIR.rowValues outputs) := by
+  have result := array_mapM_transform read id AIR.RowValue.value
+    (fun index => (AIR.rowValues rows)[index]?) (fun _ _ present => AIR.rowValues_read present)
+  simpa only [Array.map_id, Bytecode.AIR.readValues, AIR.rowValues] using result
+
+theorem select_normal {rows : Array RowExpr} (normal : Normal rows)
+    {indices : Array Nat} {selected : Array RowExpr} (read : select rows indices = some selected) :
+    Normal selected := by
+  intro expr member
+  obtain ⟨index, bound, equal⟩ := Array.mem_iff_getElem.mp member
+  have selectedRead : selected[index]? = some expr := Array.getElem?_eq_some_iff.mpr ⟨bound, equal⟩
+  have input := array_mapM_read read index
+  rw [selectedRead] at input
+  cases indexRead : indices[index]? with
+  | none => simp only [indexRead, bind, Option.bind_none, reduceCtorEq] at input
+  | some inputIndex =>
+    simp only [indexRead, bind, Option.bind_some] at input
+    exact normal expr (Array.mem_of_getElem? input)
+
+theorem array_ofFn_getD (items : Array α) (fallback : α) {count : Nat} (size : items.size = count) :
+    Array.ofFn (fun index : Fin count => items[index.val]?.getD fallback) = items := by
+  apply Array.ext (by simp only [Array.size_ofFn, size])
+  intro index _ bound
+  simp only [Array.getElem_ofFn, getElem?_pos items index bound, Option.getD_some]
+
+theorem array_map_getD_of_mapM {α : Type} {items : Array α} {indices : Array Nat} {selected : Array α}
+    (fallback : α) (read : indices.mapM (fun index => items[index]?) = some selected) :
+    indices.map (fun index => items[index]?.getD fallback) = selected := by
+  have size := array_mapM_size read
+  apply Array.ext (by simp only [Array.size_map, size])
+  intro index inputBound outputBound
+  have bound : index < indices.size := by simpa only [Array.size_map] using inputBound
+  have result := array_mapM_read read index
+  simp only [getElem?_pos indices index bound, getElem?_pos selected index outputBound,
+    bind, Option.bind_some] at result
+  simp only [Array.getElem_map, result, Option.getD_some]
+
+theorem evalRows_getD {values : Values G} {rows : Array RowExpr} {outputs : Array AIR.RowValue}
+    (evaluated : evalRows values rows = some outputs) {index : Nat} (bound : index < rows.size) :
+    (rows[index]?.getD (.konst 0)).Reflects values (outputs[index]?.getD (.konst 0)) := by
+  have present : rows[index]? = some rows[index] := getElem?_pos rows index bound
+  obtain ⟨value, output, reflected⟩ := evalRows_read evaluated present
+  simpa only [present, output, Option.getD_some] using reflected
+
+def advice (first count : Nat) : Array RowExpr :=
+  Array.ofFn fun index : Fin count => mainCurrent (first + index.val)
+
+theorem advice_eval (values : Values G) (row : Nat → G) (first count : Nat)
+    (reads : ∀ index < count,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    evalRows values (advice first count) = some (AIR.rowAdvice row 0 count) := by
+  apply array_mapM_ofFn
+  intro index
+  exact (RowExpr.reflects_iff_eval _ _ _).mp
+    (RowExpr.variable_reflects values (by simpa only [Nat.zero_add] using reads index.val index.isLt))
+
+theorem advice_normal (first count : Nat) : Normal (advice first count) := by
+  intro expr member
+  obtain ⟨index, rfl⟩ := Array.mem_ofFn.mp member
+  rfl
+
+structure CallExpr where
+  function : Nat
+  inputs : Array Expr
+  outputs : Array Expr
+  rank : Expr
+  gap : Fin 6 → Expr
+
+def CallExpr.eval (values : Values G) (call : CallExpr) :
+    Option (Bytecode.AIR.Call × (Fin 6 → G)) := do
+  let inputs ← call.inputs.mapM (evalExpr values)
+  let outputs ← call.outputs.mapM (evalExpr values)
+  let rank ← call.rank.eval goldilocksOps values
+  let gap ← (Array.ofFn call.gap).mapM (evalExpr values)
+  return (⟨call.function, inputs, outputs, rank⟩, fun index => gap[index.val]?.getD 0)
+
+theorem CallExpr.eval_of {values : Values G} {call : CallExpr} {inputs outputs : Array G}
+    {rank : G} {gap : Fin 6 → G}
+    (inputEval : call.inputs.mapM (evalExpr values) = some inputs)
+    (outputEval : call.outputs.mapM (evalExpr values) = some outputs)
+    (rankEval : evalExpr values call.rank = some rank)
+    (gapEval : ∀ index, evalExpr values (call.gap index) = some (gap index)) :
+    call.eval values = some (⟨call.function, inputs, outputs, rank⟩, gap) := by
+  have bytes := array_mapM_ofFn call.gap gap (evalExpr values) gapEval
+  simp only [CallExpr.eval, inputEval, outputEval, rankEval, bytes, bind, Option.bind_some, pure]
+  congr 2
+  funext index
+  simp only [Array.getElem?_ofFn, index.isLt, dif_pos, Option.getD_some]
+
+structure Emission where
+  outputs : Array RowExpr := #[]
+  used : Nat := 0
+  equations : List Expr := []
+  queries : List (List Expr) := []
+  calls : List CallExpr := []
+
+def Emission.eval (values : Values G) (emission : Emission) : Option AIR.OpEmission := do
+  let outputs ← evalRows values emission.outputs
+  let equations ← emission.equations.mapM (evalExpr values)
+  let queries ← emission.queries.mapM (List.mapM (evalExpr values))
+  let calls ← emission.calls.mapM (CallExpr.eval values)
+  return ⟨outputs, emission.used, equations, queries, calls⟩
+
+def fromScalar (emission : ScalarEmission) : Emission :=
+  { outputs := #[emission.output], used := emission.used, equations := emission.equations }
+
+def emitAdvice (first count : Nat) : Emission :=
+  { outputs := advice first count, used := count }
+
+theorem emitAdvice_reflects (values : Values G) (row : Nat → G) (first count : Nat)
+    (reads : ∀ index < count,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitAdvice first count).eval values = some (AIR.emitAdvice row count) := by
+  simp only [Emission.eval, emitAdvice, advice_eval values row first count reads,
+    List.mapM_nil, bind, Option.bind_some, pure, AIR.emitAdvice]
+
+theorem Emission.eval_of {values : Values G} {emission : Emission} {result : AIR.OpEmission}
+    (outputs : evalRows values emission.outputs = some result.outputs)
+    (used : emission.used = result.used)
+    (equations : emission.equations.mapM (evalExpr values) = some result.equations)
+    (queries : emission.queries.mapM (List.mapM (evalExpr values)) = some result.queries)
+    (calls : emission.calls.mapM (CallExpr.eval values) = some result.calls) :
+    emission.eval values = some result := by
+  simp only [Emission.eval, outputs, equations, queries, calls, used, bind, Option.bind_some, pure]
+
+def emitByte1 (first : Nat) (kind : AIR.Byte1Kind) (input : RowExpr) : Emission :=
+  let outputs := advice first kind.outputSize
+  { outputs, used := kind.outputSize,
+    queries := [[.konst kind.channel, input.expr] ++ (rowExprs outputs).toList] }
+
+theorem emitByte1_reflects (values : Values G) (row : Nat → G) (first : Nat) (kind : AIR.Byte1Kind)
+    {input : RowExpr} {value : AIR.RowValue} (inputRef : input.Reflects values value)
+    (reads : ∀ index < kind.outputSize,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitByte1 first kind input).eval values =
+      some { outputs := AIR.rowAdvice row 0 kind.outputSize, used := kind.outputSize,
+             queries := [AIR.byte1Request kind value.value
+               (AIR.rowValues (AIR.rowAdvice row 0 kind.outputSize))] } := by
+  have outputs := advice_eval values row first kind.outputSize reads
+  have raw := congrArg (Functor.map Array.toList) (evalRows_values outputs)
+  rw [Array.toList_mapM] at raw
+  simp only [Functor.map, Option.map_some] at raw
+  apply Emission.eval_of outputs rfl rfl ?_ rfl
+  simp only [emitByte1, List.mapM_cons, List.mapM_nil, List.cons_append, List.nil_append,
+    inputRef.1, show evalExpr values (.konst kind.channel) = some kind.channel from rfl,
+    raw, bind, Option.bind_some, pure, AIR.byte1Request]
+
+def byteCarry (first : Nat) (subtract : Bool) (left right : RowExpr) : RowExpr :=
+  let low := (mainCurrent first).expr
+  let numerator := if subtract then (low.frontAdd right.expr).frontSub left.expr
+    else (left.expr.frontAdd right.expr).frontSub low
+  ⟨numerator.frontMul (.konst AIR.inverse256), max (max left.degree right.degree) 1⟩
+
+theorem scale_isConstant (expr : Expr) {coefficient : G} (nonzero : coefficient ≠ 0) :
+    (expr.frontMul (.konst coefficient)).isConstant = expr.isConstant := by
+  have known := expr.isConstant_eq
+  have notZero : (coefficient == 0) = false := by simpa only [beq_eq_false_iff_ne] using nonzero
+  cases constant : expr.constantValue with
+  | none =>
+    simp only [constant, Option.isSome_none] at known
+    simp only [Expr.frontMul, constant,
+      show (Expr.konst coefficient).constantValue = some coefficient from rfl,
+      notZero, Bool.false_eq_true, if_false]
+    split
+    · rfl
+    · exact known.symm
+  | some value =>
+    simp only [constant, Option.isSome_some] at known
+    simp only [Expr.frontMul, constant,
+      show (Expr.konst coefficient).constantValue = some coefficient from rfl]
+    exact known.symm
+
+theorem byteCarry_reflects (values : Values G) (row : Nat → G) (first : Nat) (subtract : Bool)
+    {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b)
+    (leftNormal : left.expr.noConstantNegs = true)
+    (read : (values.columns .main .current)[first]? = some (row 0)) :
+    (byteCarry first subtract left right).Reflects values
+      ⟨(if subtract then row 0 + b.value - a.value else a.value + b.value - row 0) * AIR.inverse256,
+        max (max a.degree b.degree) 1, false⟩ := by
+  have low : evalExpr values (mainCurrent first).expr = some (row 0) := read
+  have coeff : evalExpr values (.konst AIR.inverse256) = some AIR.inverse256 := rfl
+  have invNonzero : AIR.inverse256 ≠ 0 := by decide +kernel
+  unfold RowExpr.Reflects
+  cases subtract <;> simp only [byteCarry, Bool.false_eq_true, if_false, if_true]
+  all_goals refine ⟨?_, ?_, ?_⟩
+  · exact Expr.frontMul_eval goldilocksLaws values
+      (Expr.frontSub_eval goldilocksLaws values
+        (Expr.frontAdd_eval goldilocksLaws values leftRef.1 rightRef.1) low) coeff
+  · rw [leftRef.2.1, rightRef.2.1]
+  · rw [scale_isConstant _ invNonzero, Expr.frontSub_isConstant _ _ (by rfl)]
+    exact Bool.and_false _
+  · exact Expr.frontMul_eval goldilocksLaws values
+      (Expr.frontSub_eval goldilocksLaws values
+        (Expr.frontAdd_eval goldilocksLaws values low rightRef.1) leftRef.1) coeff
+  · rw [leftRef.2.1, rightRef.2.1]
+  · rw [scale_isConstant _ invNonzero, Expr.frontSub_isConstant _ _ leftNormal,
+      Expr.frontAdd_isConstant]
+    rfl
+
+theorem byteCarry_normal (first : Nat) (subtract : Bool) {left right : RowExpr}
+    (leftNormal : left.expr.noConstantNegs = true)
+    (rightNormal : right.expr.noConstantNegs = true) :
+    (byteCarry first subtract left right).expr.noConstantNegs = true := by
+  cases subtract
+  · exact Expr.frontMul_noConstantNegs
+      (Expr.frontSub_noConstantNegs (Expr.frontAdd_noConstantNegs leftNormal rightNormal) rfl) rfl
+  · exact Expr.frontMul_noConstantNegs
+      (Expr.frontSub_noConstantNegs (Expr.frontAdd_noConstantNegs rfl rightNormal) leftNormal) rfl
+
+def emitByte2 (first : Nat) (kind : AIR.Byte2Kind) (left right : RowExpr) : Emission :=
+  let allocated := advice first kind.outputSize
+  let outputs := match kind with
+    | .add => allocated.push (byteCarry first false left right)
+    | .sub => allocated.push (byteCarry first true left right)
+    | _ => allocated
+  { outputs, used := kind.outputSize,
+    queries := [[.konst kind.channel, left.expr, right.expr] ++ (rowExprs allocated).toList] }
+
+theorem emitByte2_reflects (values : Values G) (row : Nat → G) (first : Nat) (kind : AIR.Byte2Kind)
+    {left right : RowExpr} {a b : AIR.RowValue}
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b)
+    (leftNormal : left.expr.noConstantNegs = true)
+    (reads : ∀ index < kind.outputSize,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitByte2 first kind left right).eval values =
+      some { outputs := kind.extendRowOutputs a b (AIR.rowAdvice row 0 kind.outputSize),
+             used := kind.outputSize,
+             queries := [AIR.byte2Request kind a.value b.value
+               (AIR.rowValues (AIR.rowAdvice row 0 kind.outputSize))] } := by
+  have allocated := advice_eval values row first kind.outputSize reads
+  have raw := congrArg (Functor.map Array.toList) (evalRows_values allocated)
+  rw [Array.toList_mapM] at raw
+  simp only [Functor.map, Option.map_some] at raw
+  apply Emission.eval_of ?_ rfl rfl ?_ rfl
+  · cases kind <;> try exact allocated
+    all_goals
+      have firstRead : (values.columns .main .current)[first]? = some (row 0) := by
+        simpa only [Nat.add_zero] using reads 0 (by decide)
+      have carry (subtract : Bool) := (RowExpr.reflects_iff_eval _ _ _).mp
+        (byteCarry_reflects values row first subtract leftRef rightRef leftNormal firstRead)
+      simp only [emitByte2, AIR.Byte2Kind.extendRowOutputs, AIR.Byte2Kind.outputSize, evalRows, array_mapM_push,
+        show (advice first 1).mapM (RowExpr.eval values) = some (AIR.rowAdvice row 0 1) from allocated,
+        carry, bind, Option.bind_some, pure, AIR.rowValues, AIR.rowAdvice,
+        Array.map_ofFn, Array.getElem?_ofFn, Nat.zero_lt_succ, dif_pos, Option.getD_some,
+        AIR.RowValue.variable, Nat.zero_add, Function.comp_def, Bool.false_eq_true, if_false, if_true]
+  · simp only [emitByte2, List.mapM_cons, List.mapM_nil, List.cons_append, List.nil_append,
+      leftRef.1, rightRef.1, show evalExpr values (.konst kind.channel) = some kind.channel from rfl,
+      raw, bind, Option.bind_some, pure, AIR.byte2Request]
+
+theorem emitByte2_normal (first : Nat) (kind : AIR.Byte2Kind) {left right : RowExpr}
+    (leftNormal : left.expr.noConstantNegs = true)
+    (rightNormal : right.expr.noConstantNegs = true) :
+    Normal (emitByte2 first kind left right).outputs := by
+  cases kind <;> try exact advice_normal _ _
+  all_goals
+    intro expr member
+    rcases Array.mem_push.mp member with member | rfl
+    · exact advice_normal _ _ expr member
+    · exact byteCarry_normal _ _ leftNormal rightNormal
+
+/-- The native four-term, little-endian left fold, including its initial
+zero and unit coefficient. Metadata follows the same maximum fold. -/
+def packFour (bytes : Fin 4 → RowExpr) : RowExpr :=
+  ((((RowExpr.konst 0).add ((bytes 0).mul (.konst (G.ofNat (256^0))))).add
+    ((bytes 1).mul (.konst (G.ofNat (256^1))))).add
+    ((bytes 2).mul (.konst (G.ofNat (256^2))))).add
+      ((bytes 3).mul (.konst (G.ofNat (256^3))))
+
+theorem scale_reflects (values : Values G) {expr : RowExpr} {value : AIR.RowValue}
+    (reflected : expr.Reflects values value) (coefficient : G) (nonzero : coefficient ≠ 0) :
+    (expr.mul (.konst coefficient)).Reflects values
+      ⟨value.value * coefficient, value.degree, value.constant⟩ := by
+  refine ⟨Expr.frontMul_eval goldilocksLaws values reflected.1 rfl, ?_, ?_⟩
+  · exact reflected.2.1
+  · exact (scale_isConstant expr.expr nonzero).trans reflected.2.2
+
+private def packFourValue (results : Fin 4 → AIR.RowValue) : AIR.RowValue :=
+  ((((AIR.RowValue.konst 0).add
+    ⟨(results 0).value * G.ofNat (256^0), (results 0).degree, (results 0).constant⟩).add
+    ⟨(results 1).value * G.ofNat (256^1), (results 1).degree, (results 1).constant⟩).add
+    ⟨(results 2).value * G.ofNat (256^2), (results 2).degree, (results 2).constant⟩).add
+    ⟨(results 3).value * G.ofNat (256^3), (results 3).degree, (results 3).constant⟩
+
+theorem list_ofFn_four (values : Fin 4 → α) :
+    List.ofFn values = [values 0, values 1, values 2, values 3] := by
+  simp only [List.ofFn_succ, List.ofFn_zero, Fin.succ_zero_eq_one,
+    show (1 : Fin 2).succ = (2 : Fin 3) from rfl,
+    show (1 : Fin 3).succ = (2 : Fin 4) from rfl,
+    show (2 : Fin 3).succ = (3 : Fin 4) from rfl]
+
+theorem list_foldl_zip_four (values : Fin 4 → α) (step : β → α × Nat → β) (initial : β) :
+    (List.ofFn values).zipIdx.foldl step initial =
+      step (step (step (step initial (values 0, 0)) (values 1, 1)) (values 2, 2)) (values 3, 3) := by
+  rw [list_ofFn_four]
+  rfl
+
+private theorem rowValue_ext {left right : AIR.RowValue}
+    (value : left.value = right.value) (degree : left.degree = right.degree)
+    (constant : left.constant = right.constant) : left = right := by
+  cases left
+  cases right
+  cases value
+  cases degree
+  cases constant
+  rfl
+
+private theorem packFourValue_eq (results : Fin 4 → AIR.RowValue) :
+    packFourValue results = AIR.RowValue.pack (Array.ofFn results) := by
+  apply rowValue_ext
+  · change (0 + (results 0).value * G.ofNat (256^0) + (results 1).value * G.ofNat (256^1) +
+      (results 2).value * G.ofNat (256^2) + (results 3).value * G.ofNat (256^3)) =
+        ((Array.ofFn results).map AIR.RowValue.value).toList.zipIdx.foldl
+          (fun value (byte, index) => value + byte * G.ofNat (256^index)) 0
+    rw [Array.map_ofFn, Array.toList_ofFn]
+    exact (list_foldl_zip_four (fun index => (results index).value)
+      (fun value (byte, index) => value + byte * G.ofNat (256^index)) 0).symm
+  · change max (max (max (max 0 (results 0).degree) (results 1).degree) (results 2).degree)
+      (results 3).degree = (Array.ofFn results).toList.foldl (fun d v => max d v.degree) 0
+    simp only [Array.toList_ofFn, list_ofFn_four, List.foldl_cons, List.foldl_nil]
+  · change ((((true && (results 0).constant) && (results 1).constant) && (results 2).constant) &&
+      (results 3).constant) = (Array.ofFn results).all AIR.RowValue.constant
+    simp only [← Array.all_toList, Array.toList_ofFn, list_ofFn_four, List.all_cons,
+      List.all_nil, Bool.true_and, Bool.and_true, Bool.and_assoc]
+
+theorem packFour_reflects (values : Values G) (bytes : Fin 4 → RowExpr)
+    (results : Fin 4 → AIR.RowValue)
+    (reflected : ∀ index, (bytes index).Reflects values (results index)) :
+    (packFour bytes).Reflects values (AIR.RowValue.pack (Array.ofFn results)) := by
+  have r0 := scale_reflects values (reflected 0) (G.ofNat (256^0)) (by decide +kernel)
+  have r1 := scale_reflects values (reflected 1) (G.ofNat (256^1)) (by decide +kernel)
+  have r2 := scale_reflects values (reflected 2) (G.ofNat (256^2)) (by decide +kernel)
+  have r3 := scale_reflects values (reflected 3) (G.ofNat (256^3)) (by decide +kernel)
+  have result := RowExpr.add_reflects values
+    (RowExpr.add_reflects values
+      (RowExpr.add_reflects values
+        (RowExpr.add_reflects values (RowExpr.konst_reflects values 0) r0) r1) r2) r3
+  change (packFour bytes).Reflects values (packFourValue results) at result
+  rw [packFourValue_eq] at result
+  exact result
+
+theorem packFour_normal (bytes : Fin 4 → RowExpr)
+    (normal : ∀ index, (bytes index).expr.noConstantNegs = true) :
+    (packFour bytes).expr.noConstantNegs = true := by
+  exact Expr.frontAdd_noConstantNegs
+    (Expr.frontAdd_noConstantNegs
+      (Expr.frontAdd_noConstantNegs
+        (Expr.frontAdd_noConstantNegs rfl
+          (Expr.frontMul_noConstantNegs (normal 0) rfl))
+        (Expr.frontMul_noConstantNegs (normal 1) rfl))
+      (Expr.frontMul_noConstantNegs (normal 2) rfl))
+    (Expr.frontMul_noConstantNegs (normal 3) rfl)
+
+def readWord (rows : Array RowExpr) (indices : Array Nat) : Option RowExpr := do
+  if indices.size ≠ 4 then none else do
+    let bytes ← select rows indices
+    return packFour fun index => bytes[index.val]?.getD (.konst 0)
+
+theorem readWord_reflects {values : Values G} {rows : Array RowExpr} {outputs : Array AIR.RowValue}
+    (evaluated : evalRows values rows = some outputs) {indices : Array Nat} {word : RowExpr}
+    (read : readWord rows indices = some word) :
+    ∃ value, AIR.readRowWord outputs indices = some value ∧ word.Reflects values value := by
+  simp only [readWord, bind, Option.bind] at read
+  split at read
+  · cases read
+  next size =>
+    have width : indices.size = 4 := by omega
+    cases selected : select rows indices <;> simp only [selected] at read
+    · cases read
+    next bytes =>
+      cases read
+      have byteSize := (array_mapM_size selected).trans width
+      obtain ⟨results, resultRead, resultEval⟩ := select_reflects evaluated selected
+      have resultSize := (array_mapM_size resultRead).trans width
+      have reflected := packFour_reflects values
+        (fun index => bytes[index.val]?.getD (.konst 0))
+        (fun index => results[index.val]?.getD (.konst 0))
+        (fun index => evalRows_getD resultEval (by omega))
+      rw [array_ofFn_getD results (.konst 0) resultSize] at reflected
+      refine ⟨AIR.RowValue.pack results, ?_, reflected⟩
+      simp only [AIR.readRowWord, Bytecode.AIR.readWord, if_neg size,
+        select_values resultRead, bind, Option.bind_some]
+      rw [array_map_getD_of_mapM (.konst 0) resultRead]
+      rfl
+
+theorem readWord_normal {rows : Array RowExpr} (normal : Normal rows)
+    {indices : Array Nat} {word : RowExpr} (read : readWord rows indices = some word) :
+    word.expr.noConstantNegs = true := by
+  simp only [readWord, bind, Option.bind] at read
+  split at read
+  · cases read
+  next size =>
+    cases selected : select rows indices <;> simp only [selected] at read
+    · cases read
+    next bytes =>
+      cases read
+      apply packFour_normal
+      intro index
+      have byteSize := array_mapM_size selected
+      have bound : index.val < bytes.size := by omega
+      simp only [getElem?_pos bytes index.val bound, Option.getD_some]
+      exact select_normal normal selected _ (Array.getElem_mem ..)
+
+def packedAdvice (first : Nat) : RowExpr :=
+  packFour fun index => mainCurrent (first + index.val)
+
+theorem packedAdvice_reflects (values : Values G) (row : Nat → G) (first : Nat)
+    (reads : ∀ index < 4,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (packedAdvice first).Reflects values (AIR.RowValue.pack (AIR.rowAdvice row 0 4)) := by
+  apply packFour_reflects
+  intro index
+  apply RowExpr.variable_reflects values
+  simpa only [Nat.zero_add] using reads index.val index.isLt
+
+theorem packedAdvice_normal (first : Nat) : (packedAdvice first).expr.noConstantNegs = true :=
+  packFour_normal _ (fun _ => rfl)
+
+theorem packed_advice_not_constant (row : Nat → G) :
+    (AIR.RowValue.pack (AIR.rowAdvice row 0 4)).constant = false := by
+  change (Array.ofFn (fun index : Fin 4 => AIR.RowValue.variable (row (0 + index.val)))).all
+    AIR.RowValue.constant = false
+  simp only [← Array.all_toList, Array.toList_ofFn, list_ofFn_four,
+    List.all_cons, List.all_nil, AIR.RowValue.variable, Bool.false_and]
+
+def emitWordSum (first : Nat) (sum : RowExpr) : Emission :=
+  let packed := packedAdvice first
+  { outputs := (advice first 4).push ((sum.sub packed).mul (.konst 0xfffffffe00000002)), used := 4 }
+
+theorem emitWordSum_reflects (values : Values G) (row : Nat → G) (first : Nat)
+    {sum : RowExpr} {value : AIR.RowValue} (sumRef : sum.Reflects values value)
+    (reads : ∀ index < 4,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitWordSum first sum).eval values =
+      some { outputs := (AIR.rowAdvice row 0 4).push
+               ⟨(value.value - (AIR.RowValue.pack (AIR.rowAdvice row 0 4)).value) * 0xfffffffe00000002,
+                 max value.degree (AIR.RowValue.pack (AIR.rowAdvice row 0 4)).degree, false⟩,
+             used := 4 } := by
+  have allocated := advice_eval values row first 4 reads
+  have packed := packedAdvice_reflects values row first reads
+  have difference := RowExpr.sub_reflects values sumRef packed (packedAdvice_normal first)
+  have carry := scale_reflects values difference 0xfffffffe00000002 (by decide +kernel)
+  have absent := packed_advice_not_constant row
+  have carryEval := (RowExpr.reflects_iff_eval _ _ _).mp carry
+  have constant : (value.sub (AIR.RowValue.pack (AIR.rowAdvice row 0 4))).constant = false := by
+    change (value.constant && (AIR.RowValue.pack (AIR.rowAdvice row 0 4)).constant) = false
+    rw [absent, Bool.and_false]
+  rw [constant] at carryEval
+  apply Emission.eval_of ?_ rfl rfl rfl rfl
+  simp only [emitWordSum, evalRows, array_mapM_push,
+    show (advice first 4).mapM (RowExpr.eval values) = some (AIR.rowAdvice row 0 4) from allocated,
+    carryEval, bind, Option.bind_some, pure]
+  rfl
+
+theorem emitWordSum_normal (first : Nat) {sum : RowExpr}
+    (normal : sum.expr.noConstantNegs = true) : Normal (emitWordSum first sum).outputs := by
+  intro expr member
+  rcases Array.mem_push.mp member with member | rfl
+  · exact advice_normal _ _ expr member
+  · exact Expr.frontMul_noConstantNegs
+      (Expr.frontSub_noConstantNegs normal (packedAdvice_normal first)) rfl
+
+theorem packed_advice_value (row : Nat → G) :
+    (AIR.RowValue.pack (AIR.rowAdvice row 0 4)).value = AIR.pack4 (fun index => row index.val) := by
+  change ((Array.ofFn (fun index : Fin 4 => AIR.RowValue.variable (row (0 + index.val)))).map
+    AIR.RowValue.value).toList.zipIdx.foldl (fun acc (byte, index) => acc + byte * G.ofNat (256^index)) 0 = _
+  rw [Array.map_ofFn, Array.toList_ofFn, list_foldl_zip_four]
+  change 0 + row 0 * G.ofNat (256^0) + row 1 * G.ofNat (256^1) + row 2 * G.ofNat (256^2) +
+    row 3 * G.ofNat (256^3) = AIR.pack4 (fun index => row index.val)
+  rw [show G.ofNat (256^0) = (1 : G) from by decide +kernel,
+    show G.ofNat (256^1) = (256 : G) from by decide +kernel,
+    show G.ofNat (256^2) = (65536 : G) from by decide +kernel,
+    show G.ofNat (256^3) = (16777216 : G) from by decide +kernel,
+    G.mul_one, G.zero_add, G.mul_comm (row 1) 256, G.mul_comm (row 2) 65536,
+    G.mul_comm (row 3) 16777216]
+  rfl
+
+def carryStep (x y z previous : Expr) : Expr :=
+  (((x.frontAdd y).frontAdd previous).frontSub z).frontMul (.konst AIR.inverse256)
+
+theorem carryStep_eval {values : Values G} {x y z previous : Expr} {a b c d : G}
+    (xe : evalExpr values x = some a) (ye : evalExpr values y = some b)
+    (ze : evalExpr values z = some c) (pe : evalExpr values previous = some d) :
+    evalExpr values (carryStep x y z previous) = some (AIR.carryStep a b c d) :=
+  Expr.frontMul_eval goldilocksLaws values
+    (Expr.frontSub_eval goldilocksLaws values
+      (Expr.frontAdd_eval goldilocksLaws values
+        (Expr.frontAdd_eval goldilocksLaws values xe ye) pe) ze) rfl
+
+theorem carryStep_normal {x y z previous : Expr}
+    (xn : x.noConstantNegs = true) (yn : y.noConstantNegs = true)
+    (zn : z.noConstantNegs = true) (pn : previous.noConstantNegs = true) :
+    (carryStep x y z previous).noConstantNegs = true :=
+  Expr.frontMul_noConstantNegs
+    (Expr.frontSub_noConstantNegs
+      (Expr.frontAdd_noConstantNegs (Expr.frontAdd_noConstantNegs xn yn) pn) zn) rfl
+
+theorem carryStep_not_constant {x y z previous : Expr}
+    (zn : z.noConstantNegs = true) (zc : z.isConstant = false) :
+    (carryStep x y z previous).isConstant = false := by
+  rw [carryStep, scale_isConstant _ (show AIR.inverse256 ≠ 0 from by decide +kernel),
+    Expr.frontSub_isConstant _ _ zn, zc, Bool.and_false]
+
+def carries (x y z : Fin 4 → Expr) : Fin 5 → Expr :=
+  let c1 := carryStep (x 0) (y 0) (z 0) (.konst 1)
+  let c2 := carryStep (x 1) (y 1) (z 1) c1
+  let c3 := carryStep (x 2) (y 2) (z 2) c2
+  let c4 := carryStep (x 3) (y 3) (z 3) c3
+  fun index => match index with
+    | 0 => .konst 1
+    | 1 => c1
+    | 2 => c2
+    | 3 => c3
+    | 4 => c4
+
+theorem carries_eval {values : Values G} {x y z : Fin 4 → Expr} {a b c : Fin 4 → G}
+    (xe : ∀ index, evalExpr values (x index) = some (a index))
+    (ye : ∀ index, evalExpr values (y index) = some (b index))
+    (ze : ∀ index, evalExpr values (z index) = some (c index)) :
+    ∀ index, evalExpr values (carries x y z index) = some (AIR.u32Carries a b c index) := by
+  have c1 := carryStep_eval (xe 0) (ye 0) (ze 0)
+    (show evalExpr values (.konst 1) = some 1 from rfl)
+  have c2 := carryStep_eval (xe 1) (ye 1) (ze 1) c1
+  have c3 := carryStep_eval (xe 2) (ye 2) (ze 2) c2
+  have c4 := carryStep_eval (xe 3) (ye 3) (ze 3) c3
+  intro ⟨index, bound⟩
+  have options : index = 0 ∨ index = 1 ∨ index = 2 ∨ index = 3 ∨ index = 4 := by omega
+  rcases options with rfl | rfl | rfl | rfl | rfl
+  · rfl
+  · exact c1
+  · exact c2
+  · exact c3
+  · exact c4
+
+theorem carries_normal {x y z : Fin 4 → Expr}
+    (xn : ∀ index, (x index).noConstantNegs = true)
+    (yn : ∀ index, (y index).noConstantNegs = true)
+    (zn : ∀ index, (z index).noConstantNegs = true) :
+    ∀ index, (carries x y z index).noConstantNegs = true := by
+  have first := carryStep_normal (xn 0) (yn 0) (zn 0) (show (Expr.konst 1).noConstantNegs = true from rfl)
+  have second := carryStep_normal (xn 1) (yn 1) (zn 1) first
+  have third := carryStep_normal (xn 2) (yn 2) (zn 2) second
+  have fourth := carryStep_normal (xn 3) (yn 3) (zn 3) third
+  intro ⟨index, bound⟩
+  have options : index = 0 ∨ index = 1 ∨ index = 2 ∨ index = 3 ∨ index = 4 := by omega
+  rcases options with rfl | rfl | rfl | rfl | rfl
+  · rfl
+  · exact first
+  · exact second
+  · exact third
+  · exact fourth
+
+def packSix (bytes : Fin 6 → Expr) : Expr :=
+  ((((((Expr.konst 0).frontAdd ((bytes 0).frontMul (.konst 1))).frontAdd
+    ((bytes 1).frontMul (.konst 256))).frontAdd ((bytes 2).frontMul (.konst 65536))).frontAdd
+    ((bytes 3).frontMul (.konst 16777216))).frontAdd
+    ((bytes 4).frontMul (.konst 4294967296))).frontAdd
+    ((bytes 5).frontMul (.konst 1099511627776))
+
+private def packSixValue (bytes : Fin 6 → G) : G :=
+  0 + bytes 0 * 1 + bytes 1 * 256 + bytes 2 * 65536 + bytes 3 * 16777216 +
+    bytes 4 * 4294967296 + bytes 5 * 1099511627776
+
+private theorem packSixValue_eq (bytes : Fin 6 → G) : packSixValue bytes = AIR.packRank bytes := by
+  unfold packSixValue AIR.packRank
+  rw [G.mul_one, G.zero_add, G.mul_comm (bytes 1) 256, G.mul_comm (bytes 2) 65536,
+    G.mul_comm (bytes 3) 16777216, G.mul_comm (bytes 4) 4294967296,
+    G.mul_comm (bytes 5) 1099511627776]
+
+theorem packSix_eval (values : Values G) (bytes : Fin 6 → Expr) (results : Fin 6 → G)
+    (evaluated : ∀ index, evalExpr values (bytes index) = some (results index)) :
+    evalExpr values (packSix bytes) = some (AIR.packRank results) := by
+  have term (index : Fin 6) (coefficient : G) := Expr.frontMul_eval goldilocksLaws values
+    (evaluated index) (show evalExpr values (.konst coefficient) = some coefficient from rfl)
+  have packed := Expr.frontAdd_eval goldilocksLaws values
+    (Expr.frontAdd_eval goldilocksLaws values
+      (Expr.frontAdd_eval goldilocksLaws values
+        (Expr.frontAdd_eval goldilocksLaws values
+          (Expr.frontAdd_eval goldilocksLaws values
+            (Expr.frontAdd_eval goldilocksLaws values
+              (show evalExpr values (.konst 0) = some 0 from rfl) (term 0 1))
+            (term 1 256)) (term 2 65536)) (term 3 16777216)) (term 4 4294967296))
+      (term 5 1099511627776)
+  change evalExpr values (packSix bytes) = some (packSixValue results) at packed
+  rw [packSixValue_eq] at packed
+  exact packed
+
+def rangePair (left right : Expr) : List Expr := [.konst 11, left, right]
+
+def rangeSix (bytes : Fin 6 → Expr) : List (List Expr) :=
+  [rangePair (bytes 0) (bytes 1), rangePair (bytes 2) (bytes 3), rangePair (bytes 4) (bytes 5)]
+
+theorem rangePair_eval {values : Values G} {left right : Expr} {a b : G}
+    (leftEval : evalExpr values left = some a) (rightEval : evalExpr values right = some b) :
+    (rangePair left right).mapM (evalExpr values) = some (AIR.rangeMessage (a, b)) := by
+  simp only [rangePair, List.mapM_cons, List.mapM_nil, leftEval, rightEval,
+    show evalExpr values (.konst 11) = some 11 from rfl, bind, Option.bind_some, pure]
+  rfl
+
+theorem rangeSix_eval {values : Values G} (bytes : Fin 6 → Expr) (results : Fin 6 → G)
+    (evaluated : ∀ index, evalExpr values (bytes index) = some (results index)) :
+    (rangeSix bytes).mapM (List.mapM (evalExpr values)) =
+      some ((AIR.rankByteQueries results).map AIR.rangeMessage) := by
+  simp only [rangeSix, List.mapM_cons, List.mapM_nil,
+    rangePair_eval (evaluated 0) (evaluated 1), rangePair_eval (evaluated 2) (evaluated 3),
+    rangePair_eval (evaluated 4) (evaluated 5), bind, Option.bind_some, pure]
+  rfl
+
+def emitCall (selector rank : Expr) (first function : Nat) (inputs : Array RowExpr)
+    (size : Nat) : Emission :=
+  let outputs := advice first size
+  let child := (mainCurrent (first + size)).expr
+  let gap : Fin 6 → Expr := fun index => (mainCurrent (first + size + 1 + index.val)).expr
+  { outputs, used := size + 7,
+    equations := [selector.frontMul
+      (((child.frontSub rank).frontSub (.konst 1)).frontSub (packSix gap))],
+    queries := ([.konst 0, .konst (G.ofNat function)] ++
+      (rowExprs inputs).toList ++ (rowExprs outputs).toList ++ [child]) :: rangeSix gap,
+    calls := [⟨function, rowExprs inputs, rowExprs outputs, child, gap⟩] }
+
+theorem emitCall_reflects (values : Values G) (row : Nat → G) (first function size : Nat)
+    {selector rank : Expr} {s r : G} {inputs : Array RowExpr} {arguments : Array AIR.RowValue}
+    (selectorEval : evalExpr values selector = some s) (rankEval : evalExpr values rank = some r)
+    (inputEval : evalRows values inputs = some arguments)
+    (reads : ∀ index < size + 7,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitCall selector rank first function inputs size).eval values =
+      some { outputs := AIR.rowAdvice row 0 size, used := size + 7,
+             equations := [s * AIR.callOrderConstraint r (row size)
+               (AIR.packRank (fun index => row (size + 1 + index.val)))],
+             queries := AIR.functionMessage
+               ⟨function, AIR.rowValues arguments, AIR.rowValues (AIR.rowAdvice row 0 size), row size⟩ ::
+               (AIR.rankByteQueries (fun index => row (size + 1 + index.val))).map AIR.rangeMessage,
+             calls := [(⟨function, AIR.rowValues arguments, AIR.rowValues (AIR.rowAdvice row 0 size), row size⟩,
+               fun index => row (size + 1 + index.val))] } := by
+  have outputs := advice_eval values row first size (fun index bound => reads index (by omega))
+  have child : evalExpr values (mainCurrent (first + size)).expr = some (row size) :=
+    reads size (by omega)
+  have gap (index : Fin 6) :
+      evalExpr values (mainCurrent (first + size + 1 + index.val)).expr =
+        some (row (size + 1 + index.val)) := by
+    change (values.columns .main .current)[first + size + 1 + index.val]? = _
+    simpa only [Nat.add_assoc] using reads (size + 1 + index.val) (by omega)
+  have order := Expr.frontMul_eval goldilocksLaws values selectorEval
+    (Expr.frontSub_eval goldilocksLaws values
+      (Expr.frontSub_eval goldilocksLaws values
+        (Expr.frontSub_eval goldilocksLaws values child rankEval)
+        (show evalExpr values (.konst 1) = some 1 from rfl))
+      (packSix_eval values _ _ gap))
+  have args := congrArg (Functor.map Array.toList) (evalRows_values inputEval)
+  have outs := congrArg (Functor.map Array.toList) (evalRows_values outputs)
+  rw [Array.toList_mapM] at args outs
+  simp only [Functor.map, Option.map_some] at args outs
+  apply Emission.eval_of outputs rfl ?_ ?_ ?_
+  · simp only [emitCall, List.mapM_cons, List.mapM_nil, order, bind, Option.bind_some, pure]
+    rfl
+  · simp only [emitCall, List.mapM_cons, List.mapM_append, List.mapM_nil,
+      show evalExpr values (.konst 0) = some 0 from rfl,
+      show evalExpr values (.konst (G.ofNat function)) = some (G.ofNat function) from rfl,
+      args, outs, child, rangeSix_eval _ _ gap, bind, Option.bind_some, pure]
+    rfl
+  · have call := CallExpr.eval_of
+      (call := ⟨function, rowExprs inputs, rowExprs (advice first size),
+        (mainCurrent (first + size)).expr,
+        fun index => (mainCurrent (first + size + 1 + index.val)).expr⟩)
+      (evalRows_values inputEval) (evalRows_values outputs) child gap
+    simp only [emitCall, List.mapM_cons, List.mapM_nil, call, bind, Option.bind_some, pure]
+
+def emitStore (first : Nat) (contents : Array RowExpr) : Emission :=
+  { outputs := advice first 1, used := 1,
+    queries := [[.konst 1, .konst (G.ofNat contents.size), (mainCurrent first).expr] ++
+      (rowExprs contents).toList] }
+
+theorem emitStore_reflects (values : Values G) (row : Nat → G) (first : Nat)
+    {contents : Array RowExpr} {stored : Array AIR.RowValue}
+    (contentsEval : evalRows values contents = some stored)
+    (read : (values.columns .main .current)[first]? = some (row 0)) :
+    (emitStore first contents).eval values =
+      some { outputs := AIR.rowAdvice row 0 1, used := 1,
+             queries := [AIR.memoryMessage contents.size (row 0) (AIR.rowValues stored)] } := by
+  have outputs := advice_eval values row first 1 (by
+    intro index bound
+    have equal : index = 0 := by omega
+    subst index
+    simpa only [Nat.add_zero] using read)
+  have storedEval := congrArg (Functor.map Array.toList) (evalRows_values contentsEval)
+  rw [Array.toList_mapM] at storedEval
+  simp only [Functor.map, Option.map_some] at storedEval
+  apply Emission.eval_of outputs rfl rfl ?_ rfl
+  simp only [emitStore, List.cons_append, List.nil_append, List.mapM_cons, List.mapM_nil,
+    show evalExpr values (.konst 1) = some 1 from rfl,
+    show evalExpr values (.konst (G.ofNat contents.size)) = some (G.ofNat contents.size) from rfl,
+    show evalExpr values (mainCurrent first).expr = some (row 0) from read,
+    storedEval, bind, Option.bind_some, pure, AIR.memoryMessage]
+
+def emitLoad (first size : Nat) (pointer : RowExpr) : Emission :=
+  let outputs := advice first size
+  { outputs, used := size,
+    queries := [[.konst 1, .konst (G.ofNat size), pointer.expr] ++ (rowExprs outputs).toList] }
+
+theorem emitLoad_reflects (values : Values G) (row : Nat → G) (first size : Nat)
+    {pointer : RowExpr} {address : AIR.RowValue} (pointerRef : pointer.Reflects values address)
+    (reads : ∀ index < size,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitLoad first size pointer).eval values =
+      some { outputs := AIR.rowAdvice row 0 size, used := size,
+             queries := [AIR.memoryMessage size address.value (AIR.rowValues (AIR.rowAdvice row 0 size))] } := by
+  have outputs := advice_eval values row first size reads
+  have raw := congrArg (Functor.map Array.toList) (evalRows_values outputs)
+  rw [Array.toList_mapM] at raw
+  simp only [Functor.map, Option.map_some] at raw
+  apply Emission.eval_of outputs rfl rfl ?_ rfl
+  simp only [emitLoad, List.cons_append, List.nil_append, List.mapM_cons, List.mapM_nil,
+    show evalExpr values (.konst 1) = some 1 from rfl,
+    show evalExpr values (.konst (G.ofNat size)) = some (G.ofNat size) from rfl,
+    pointerRef.1, raw, bind, Option.bind_some, pure, AIR.memoryMessage]
+
+def rangeFour (bytes : Fin 4 → Expr) : List (List Expr) :=
+  [rangePair (bytes 0) (bytes 1), rangePair (bytes 2) (bytes 3)]
+
+theorem rangeFour_eval {values : Values G} (bytes : Fin 4 → Expr) (results : Fin 4 → G)
+    (evaluated : ∀ index, evalExpr values (bytes index) = some (results index)) :
+    (rangeFour bytes).mapM (List.mapM (evalExpr values)) = some (AIR.range4Queries results) := by
+  simp only [rangeFour, List.mapM_cons, List.mapM_nil,
+    rangePair_eval (evaluated 0) (evaluated 1), rangePair_eval (evaluated 2) (evaluated 3),
+    bind, Option.bind_some, pure]
+  rfl
+
+def booleanExpr (expr : Expr) : Expr := expr.frontMul (expr.frontSub (.konst 1))
+
+theorem booleanExpr_eval {values : Values G} {expr : Expr} {value : G}
+    (evaluated : evalExpr values expr = some value) :
+    evalExpr values (booleanExpr expr) = some (AIR.booleanConstraint value) :=
+  Expr.frontMul_eval goldilocksLaws values evaluated
+    (Expr.frontSub_eval goldilocksLaws values evaluated rfl)
+
+def emitU32LessThan (selector : Expr) (first : Nat) (left right : RowExpr) : Emission :=
+  let x : Fin 4 → Expr := fun index => (mainCurrent (first + index.val)).expr
+  let y : Fin 4 → Expr := fun index => (mainCurrent (first + 4 + index.val)).expr
+  let z : Fin 4 → Expr := fun index => (mainCurrent (first + 8 + index.val)).expr
+  let chain := carries x y z
+  { outputs := #[⟨(Expr.konst 1).frontSub (chain 4), 1⟩], used := 12,
+    equations := selector.frontMul (left.expr.frontSub (packedAdvice first).expr) ::
+      selector.frontMul (right.expr.frontSub (packedAdvice (first + 8)).expr) ::
+      List.ofFn (fun index : Fin 4 => selector.frontMul (booleanExpr (chain index.succ))),
+    queries := rangeFour x ++ rangeFour y ++ rangeFour z }
+
+theorem emitU32LessThan_reflects (values : Values G) (row : Nat → G) (first : Nat)
+    {selector : Expr} {s : G} {left right : RowExpr} {a b : AIR.RowValue}
+    (selectorEval : evalExpr values selector = some s)
+    (leftRef : left.Reflects values a) (rightRef : right.Reflects values b)
+    (reads : ∀ index < 12,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    (emitU32LessThan selector first left right).eval values =
+      some { outputs := #[⟨1 - AIR.u32Carries (fun i => row i.val)
+               (fun i => row (4 + i.val)) (fun i => row (8 + i.val)) 4, 1, false⟩],
+             used := 12,
+             equations := s * (a.value - AIR.pack4 (fun i => row i.val)) ::
+               s * (b.value - AIR.pack4 (fun i => row (8 + i.val))) ::
+               List.ofFn (fun i : Fin 4 => s * AIR.booleanConstraint
+                 (AIR.u32Carries (fun i => row i.val) (fun i => row (4 + i.val))
+                   (fun i => row (8 + i.val)) i.succ)),
+             queries := AIR.range4Queries (fun i => row i.val) ++
+               AIR.range4Queries (fun i => row (4 + i.val)) ++ AIR.range4Queries (fun i => row (8 + i.val)) } := by
+  let x : Fin 4 → Expr := fun index => (mainCurrent (first + index.val)).expr
+  let y : Fin 4 → Expr := fun index => (mainCurrent (first + 4 + index.val)).expr
+  let z : Fin 4 → Expr := fun index => (mainCurrent (first + 8 + index.val)).expr
+  have xe (index : Fin 4) : evalExpr values (x index) = some (row index.val) :=
+    reads index.val (by omega)
+  have ye (index : Fin 4) : evalExpr values (y index) = some (row (4 + index.val)) := by
+    change (values.columns .main .current)[first + 4 + index.val]? = _
+    simpa only [Nat.add_assoc] using reads (4 + index.val) (by omega)
+  have ze (index : Fin 4) : evalExpr values (z index) = some (row (8 + index.val)) := by
+    change (values.columns .main .current)[first + 8 + index.val]? = _
+    simpa only [Nat.add_assoc] using reads (8 + index.val) (by omega)
+  have chain := carries_eval xe ye ze
+  have px := (packedAdvice_reflects values row first (fun index bound => reads index (by omega))).1
+  have pz := (packedAdvice_reflects values (fun index => row (8 + index)) (first + 8) (by
+    intro index bound
+    simpa only [Nat.add_assoc] using reads (8 + index) (by omega))).1
+  rw [packed_advice_value] at px pz
+  have firstEq := Expr.frontMul_eval goldilocksLaws values selectorEval
+    (Expr.frontSub_eval goldilocksLaws values leftRef.1 px)
+  have secondEq := Expr.frontMul_eval goldilocksLaws values selectorEval
+    (Expr.frontSub_eval goldilocksLaws values rightRef.1 pz)
+  have restEq (index : Fin 4) := Expr.frontMul_eval goldilocksLaws values selectorEval
+    (booleanExpr_eval (chain index.succ))
+  have chainNormal : (carries x y z 4).noConstantNegs = true :=
+    carries_normal (fun _ => rfl) (fun _ => rfl) (fun _ => rfl) 4
+  have chainNonconstant : (carries x y z 4).isConstant = false := carryStep_not_constant rfl rfl
+  have output : (⟨(Expr.konst 1).frontSub (carries x y z 4), 1⟩ : RowExpr).Reflects values
+      ⟨1 - AIR.u32Carries (fun i => row i.val) (fun i => row (4 + i.val))
+        (fun i => row (8 + i.val)) 4, 1, false⟩ := by
+    refine ⟨Expr.frontSub_eval goldilocksLaws values
+      (show evalExpr values (.konst 1) = some 1 from rfl) (chain 4), rfl, ?_⟩
+    change ((Expr.konst 1).frontSub (carries x y z 4)).isConstant = false
+    rw [Expr.frontSub_isConstant _ _ chainNormal, chainNonconstant, Bool.and_false]
+  apply Emission.eval_of (evalRows_singleton output) rfl ?_ ?_ rfl
+  · have remaining := list_mapM_ofFn _ _ (evalExpr values) restEq
+    dsimp only [x, y, z] at remaining
+    simp only [emitU32LessThan, List.mapM_cons, firstEq, secondEq, remaining,
+      bind, Option.bind_some, pure, goldilocks_mul, goldilocks_sub]
+  · have rx := rangeFour_eval x _ xe
+    have ry := rangeFour_eval y _ ye
+    have rz := rangeFour_eval z _ ze
+    dsimp only [x, y, z] at rx ry rz
+    simp only [emitU32LessThan, List.mapM_append, rx, ry, rz, bind, Option.bind_some, pure]
+
+theorem emitU32LessThan_normal (selector : Expr) (first : Nat) (left right : RowExpr) :
+    Normal (emitU32LessThan selector first left right).outputs := by
+  intro expr member
+  have equal := Array.mem_singleton.mp member
+  subst expr
+  let x : Fin 4 → Expr := fun index => (mainCurrent (first + index.val)).expr
+  let y : Fin 4 → Expr := fun index => (mainCurrent (first + 4 + index.val)).expr
+  let z : Fin 4 → Expr := fun index => (mainCurrent (first + 8 + index.val)).expr
+  have normal : (carries x y z 4).noConstantNegs = true :=
+    carries_normal (fun _ => rfl) (fun _ => rfl) (fun _ => rfl) 4
+  exact Expr.frontSub_noConstantNegs (left := Expr.konst 1) (right := carries x y z 4) rfl normal
+
+def emitAssert (selector : Expr) (left right : Array RowExpr) : Emission :=
+  { equations := List.ofFn fun index : Fin left.size => selector.frontMul
+      ((left[index.val]?.getD (.konst 0)).expr.frontSub (right[index.val]?.getD (.konst 0)).expr) }
+
+theorem rowValues_getD (rows : Array AIR.RowValue) (index : Nat) :
+    (AIR.rowValues rows)[index]?.getD 0 = (rows[index]?.getD (.konst 0)).value := by
+  simp only [AIR.rowValues, Array.getElem?_map]
+  cases rows[index]? <;> rfl
+
+theorem emitAssert_reflects {values : Values G} {selector : Expr} {s : G}
+    {left right : Array RowExpr} {a b : Array AIR.RowValue}
+    (selectorEval : evalExpr values selector = some s)
+    (leftEval : evalRows values left = some a) (rightEval : evalRows values right = some b)
+    (size : left.size = right.size) :
+    (emitAssert selector left right).eval values =
+      some { equations := List.ofFn fun index : Fin left.size =>
+        s * ((AIR.rowValues a)[index.val]?.getD 0 - (AIR.rowValues b)[index.val]?.getD 0) } := by
+  apply Emission.eval_of (evalRows_empty values) rfl ?_ rfl rfl
+  apply list_mapM_ofFn
+  intro index
+  have leftRef := evalRows_getD leftEval index.isLt
+  have rightRef := evalRows_getD rightEval (index := index.val) (by omega)
+  rw [rowValues_getD, rowValues_getD]
+  exact Expr.frontMul_eval goldilocksLaws values selectorEval
+    (Expr.frontSub_eval goldilocksLaws values leftRef.1 rightRef.1)
+
+/-- The operation dispatcher mirrors the native emitter's fresh-column order.
+Operand reads here are checked in the incoming logical scope. The native store
+reads after pushing its pointer, so that correspondence also uses the checked
+program's incoming-scope index validity. -/
+def emitOp (selector rank : Expr) (first : Nat) (op : Bytecode.Op)
+    (rows : Array RowExpr) : Option Emission :=
+  match op with
+  | .const value => some (fromScalar ⟨.konst value, 0, []⟩)
+  | .add a b => do return fromScalar ⟨(← rows[a]?).add (← rows[b]?), 0, []⟩
+  | .sub a b => do return fromScalar ⟨(← rows[a]?).sub (← rows[b]?), 0, []⟩
+  | .mul a b => do return fromScalar (NativeAIR.emitMul selector first (← rows[a]?) (← rows[b]?))
+  | .eqZero a => do return fromScalar (NativeAIR.emitEqZero selector first (← rows[a]?))
+  | .call function indices size unconstrained =>
+    if unconstrained then some (emitAdvice first size)
+    else do return emitCall selector rank first function (← select rows indices) size
+  | .store indices => do return emitStore first (← select rows indices)
+  | .load size index => do return emitLoad first size (← rows[index]?)
+  | .assertEq xs ys _ =>
+    if xs.size ≠ ys.size then none
+    else do return emitAssert selector (← select rows xs) (← select rows ys)
+  | .ioGetInfo .. => some (emitAdvice first 2)
+  | .ioRead _ _ size => some (emitAdvice first size)
+  | .ioSetInfo .. | .ioWrite .. | .debug .. => some {}
+  | .u8BitDecomposition index => do return emitByte1 first .bits (← rows[index]?)
+  | .u8ShiftLeft index => do return emitByte1 first .shiftLeft (← rows[index]?)
+  | .u8ShiftRight index => do return emitByte1 first .shiftRight (← rows[index]?)
+  | .u8Xor a b => do return emitByte2 first .xor (← rows[a]?) (← rows[b]?)
+  | .u8Add a b => do return emitByte2 first .add (← rows[a]?) (← rows[b]?)
+  | .u8Sub a b => do return emitByte2 first .sub (← rows[a]?) (← rows[b]?)
+  | .u8And a b => do return emitByte2 first .and (← rows[a]?) (← rows[b]?)
+  | .u8Or a b => do return emitByte2 first .or (← rows[a]?) (← rows[b]?)
+  | .u8LessThan a b => do return emitByte2 first .lessThan (← rows[a]?) (← rows[b]?)
+  | .u8RangeCheck a b => do return emitByte2 first .range (← rows[a]?) (← rows[b]?)
+  | .u8Mul a b => do return emitByte2 first .mul (← rows[a]?) (← rows[b]?)
+  | .u8XorSplit7 a b => do return emitByte2 first .split7 (← rows[a]?) (← rows[b]?)
+  | .u8XorSplit4 a b => do return emitByte2 first .split4 (← rows[a]?) (← rows[b]?)
+  | .u32LessThan a b => do return emitU32LessThan selector first (← rows[a]?) (← rows[b]?)
+  | .unconstrainedBigUintDivMod .. => some (emitAdvice first 2)
+  | .unconstrainedGToBytes .. => some (emitAdvice first 8)
+  | .unconstrainedGInverse .. => some (emitAdvice first 1)
+  | .unconstrainedU32Add a b => do
+    return emitWordSum first ((← readWord rows a).add (← readWord rows b))
+  | .unconstrainedU32Add3 a b c => do
+    return emitWordSum first (((← readWord rows a).add (← readWord rows b)).add (← readWord rows c))
+  | .u32ToField indices => do return fromScalar ⟨← readWord rows indices, 0, []⟩
+
+end OpEmitter
+end Aiur.NativeAIR
diff --git a/Ix/Aiur/Proofs/OperationReflection.lean b/Ix/Aiur/Proofs/OperationReflection.lean
new file mode 100644
index 000000000..1896f63fc
--- /dev/null
+++ b/Ix/Aiur/Proofs/OperationReflection.lean
@@ -0,0 +1,495 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationExpressions
+
+/-!
+Reflection of complete symbolic operation emission into the valued AIR.
+Successful incoming evaluations and reads of the allocated fresh columns
+derive all output values, metadata, equations, raw queries and call records.
+-/
+
+namespace Aiur.NativeAIR.OpEmitter
+
+theorem fromScalar_eval (values : Values G) (emission : ScalarEmission) :
+    (fromScalar emission).eval values = emission.eval values := by
+  have singleton : evalRows values #[emission.output] = do
+      let output ← emission.output.eval values
+      return #[output] := by
+    change ((#[] : Array RowExpr).push emission.output).mapM _ = _
+    rw [array_mapM_push, Array.mapM_empty]
+    rfl
+  simp only [fromScalar, Emission.eval, singleton, ScalarEmission.eval, List.mapM_nil,
+    bind, Option.bind, pure]
+  cases emission.output.eval values <;> simp only
+
+theorem empty_eval (values : Values G) : ({} : Emission).eval values = some {} := by
+  exact Emission.eval_of (evalRows_empty values) rfl rfl rfl rfl
+
+theorem normal_empty : Normal #[] := by
+  intro row member
+  exact False.elim (Array.not_mem_empty row member)
+
+theorem normal_singleton {row : RowExpr} (normal : row.expr.noConstantNegs = true) :
+    Normal #[row] := by
+  intro item member
+  have equal := Array.mem_singleton.mp member
+  subst item
+  exact normal
+
+theorem Normal.read {rows : Array RowExpr} (normal : Normal rows)
+    {index : Nat} {row : RowExpr} (read : rows[index]? = some row) :
+    row.expr.noConstantNegs = true := normal row (Array.mem_of_getElem? read)
+
+theorem emitOp_byte1 (selector rank : Expr) (first : Nat) (kind : AIR.Byte1Kind)
+    (index : Nat) (rows : Array RowExpr) :
+    emitOp selector rank first (kind.op index) rows = do
+      return emitByte1 first kind (← rows[index]?) := by
+  cases kind <;> rfl
+
+theorem emitOp_byte2 (selector rank : Expr) (first : Nat) (kind : AIR.Byte2Kind)
+    (left right : Nat) (rows : Array RowExpr) :
+    emitOp selector rank first (kind.op left right) rows = do
+      return emitByte2 first kind (← rows[left]?) (← rows[right]?) := by
+  cases kind <;> rfl
+
+theorem emitByte1_dispatch (values : Values G) (row : Nat → G) (selector rank : Expr)
+    (s r : G) (first : Nat) (kind : AIR.Byte1Kind) (index : Nat)
+    {rows : Array RowExpr} {inputs : Array AIR.RowValue} {emission : Emission}
+    (inputEval : evalRows values rows = some inputs)
+    (emitted : emitOp selector rank first (kind.op index) rows = some emission)
+    (reads : ∀ index < emission.used,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    ∃ result, AIR.emitOp row s r (kind.op index) inputs = some result ∧
+      emission.eval values = some result := by
+  rw [emitOp_byte1] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i input read
+  cases emitted
+  obtain ⟨value, readValue, reflected⟩ := evalRows_read inputEval read
+  refine ⟨_, ?_, emitByte1_reflects values row first kind reflected reads⟩
+  cases kind <;> simp only [AIR.Byte1Kind.op, AIR.emitOp, AIR.emitByte1,
+    readValue, bind, Option.bind_some, pure]
+
+theorem emitByte2_dispatch (values : Values G) (row : Nat → G) (selector rank : Expr)
+    (s r : G) (first : Nat) (kind : AIR.Byte2Kind) (left right : Nat)
+    {rows : Array RowExpr} {inputs : Array AIR.RowValue} {emission : Emission}
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (emitted : emitOp selector rank first (kind.op left right) rows = some emission)
+    (reads : ∀ index < emission.used,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    ∃ result, AIR.emitOp row s r (kind.op left right) inputs = some result ∧
+      emission.eval values = some result := by
+  rw [emitOp_byte2] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i a readA
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i b readB
+  cases emitted
+  obtain ⟨x, readX, refX⟩ := evalRows_read inputEval readA
+  obtain ⟨y, readY, refY⟩ := evalRows_read inputEval readB
+  refine ⟨_, ?_, emitByte2_reflects values row first kind refX refY (normal.read readA) reads⟩
+  cases kind <;> simp only [AIR.Byte2Kind.op, AIR.emitOp, AIR.emitByte2,
+    readX, readY, bind, Option.bind_some, pure]
+
+theorem list_ofFn_getD_pair {α β γ : Type} (left : Array α) (right : Array β)
+    (leftDefault : α) (rightDefault : β) (f : α → β → γ) {count : Nat}
+    (size : left.size = count) :
+    (List.ofFn fun index : Fin count =>
+      f (left[index.val]?.getD leftDefault) (right[index.val]?.getD rightDefault)) =
+      List.ofFn fun index : Fin left.size => f left[index] (right[index.val]?.getD rightDefault) := by
+  subst count
+  congr 1
+  funext index
+  rw [getElem?_pos left index.val index.isLt, Option.getD_some]
+  rfl
+
+theorem emitOp_reflects (values : Values G) (row : Nat → G)
+    {selector rank : Expr} {s r : G} {first : Nat} {op : Bytecode.Op}
+    {rows : Array RowExpr} {inputs : Array AIR.RowValue} {emission : Emission}
+    (selectorEval : evalExpr values selector = some s) (rankEval : evalExpr values rank = some r)
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (emitted : emitOp selector rank first op rows = some emission)
+    (reads : ∀ index < emission.used,
+      (values.columns .main .current)[first + index]? = some (row index)) :
+    ∃ result, AIR.emitOp row s r op inputs = some result ∧ emission.eval values = some result := by
+  cases op with
+  | const value =>
+    cases emitted
+    refine ⟨_, rfl, ?_⟩
+    rw [fromScalar_eval]
+    exact ScalarEmission.eval_of values (RowExpr.konst_reflects values value) rfl
+  | add a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    obtain ⟨x, readX, refX⟩ := evalRows_read inputEval readA
+    obtain ⟨y, readY, refY⟩ := evalRows_read inputEval readB
+    refine ⟨{ outputs := #[x.add y] }, ?_, ?_⟩
+    · simp only [AIR.emitOp, readX, readY, bind, Option.bind_some, pure]
+    · rw [fromScalar_eval]
+      exact ScalarEmission.eval_of values (RowExpr.add_reflects values refX refY) rfl
+  | sub a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    obtain ⟨x, readX, refX⟩ := evalRows_read inputEval readA
+    obtain ⟨y, readY, refY⟩ := evalRows_read inputEval readB
+    refine ⟨{ outputs := #[x.sub y] }, ?_, ?_⟩
+    · simp only [AIR.emitOp, readX, readY, bind, Option.bind_some, pure]
+    · rw [fromScalar_eval]
+      exact ScalarEmission.eval_of values
+        (RowExpr.sub_reflects values refX refY (normal.read readB)) rfl
+  | mul a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    obtain ⟨x, readX, refX⟩ := evalRows_read inputEval readA
+    obtain ⟨y, readY, refY⟩ := evalRows_read inputEval readB
+    have reflected := NativeAIR.emitMul_reflects values row selectorEval refX refY reads
+    have indexed : AIR.emitOp row s r (.mul a b) inputs = AIR.emitOp row s 0 (.mul 0 1) #[x, y] := by
+      simp only [AIR.emitOp, readX, readY, show #[x, y][0]? = some x from rfl,
+        show #[x, y][1]? = some y from rfl, bind, Option.bind_some]
+    rw [indexed]
+    have total : ∃ result, AIR.emitOp row s 0 (.mul 0 1) #[x, y] = some result := by
+      simp only [AIR.emitOp, show #[x, y][0]? = some x from rfl,
+        show #[x, y][1]? = some y from rfl, bind, Option.bind_some]
+      split <;> exact ⟨_, rfl⟩
+    obtain ⟨result, resultEq⟩ := total
+    exact ⟨result, resultEq, (fromScalar_eval _ _).trans (reflected.trans resultEq)⟩
+  | eqZero index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i input read
+    cases emitted
+    obtain ⟨value, readValue, refValue⟩ := evalRows_read inputEval read
+    have reflected := NativeAIR.emitEqZero_reflects values row selectorEval refValue reads
+    have indexed : AIR.emitOp row s r (.eqZero index) inputs = AIR.emitOp row s 0 (.eqZero 0) #[value] := by
+      simp only [AIR.emitOp, readValue, show #[value][0]? = some value from rfl, bind, Option.bind_some]
+    rw [indexed]
+    have total : ∃ result, AIR.emitOp row s 0 (.eqZero 0) #[value] = some result := by
+      simp only [AIR.emitOp, show #[value][0]? = some value from rfl, bind, Option.bind_some]
+      split <;> exact ⟨_, rfl⟩
+    obtain ⟨result, resultEq⟩ := total
+    exact ⟨result, resultEq, (fromScalar_eval _ _).trans (reflected.trans resultEq)⟩
+  | call function indices size unconstrained =>
+    cases unconstrained with
+    | true =>
+      cases emitted
+      exact ⟨_, rfl, emitAdvice_reflects values row first size reads⟩
+    | false =>
+      simp only [emitOp, Bool.false_eq_true, if_false, bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      rename_i arguments selected
+      cases emitted
+      obtain ⟨args, argsRead, argsEval⟩ := select_reflects inputEval selected
+      refine ⟨_, ?_, emitCall_reflects values row first function size selectorEval rankEval argsEval reads⟩
+      simp only [AIR.emitOp, Bool.false_eq_true, if_false, select_values argsRead,
+        bind, Option.bind_some, pure]
+  | store indices =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i contents selected
+    cases emitted
+    obtain ⟨stored, storedRead, storedEval⟩ := select_reflects inputEval selected
+    have size : contents.size = indices.size := array_mapM_size selected
+    have read : (values.columns .main .current)[first]? = some (row 0) := by
+      simpa only [Nat.add_zero] using reads 0 (by change 0 < 1; decide)
+    refine ⟨_, ?_, emitStore_reflects values row first storedEval read⟩
+    simp only [AIR.emitOp, select_values storedRead, bind, Option.bind_some, pure, size]
+    rfl
+  | load size index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i pointer read
+    cases emitted
+    obtain ⟨address, addressRead, addressRef⟩ := evalRows_read inputEval read
+    refine ⟨_, ?_, emitLoad_reflects values row first size addressRef reads⟩
+    simp only [AIR.emitOp, addressRead, bind, Option.bind_some, pure]
+  | assertEq xs ys message =>
+    simp only [emitOp] at emitted
+    split at emitted
+    · cases emitted
+    rename_i size
+    have same : xs.size = ys.size := Classical.not_not.mp size
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left selectedLeft
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right selectedRight
+    cases emitted
+    obtain ⟨a, readA, evalA⟩ := select_reflects inputEval selectedLeft
+    obtain ⟨b, readB, evalB⟩ := select_reflects inputEval selectedRight
+    have leftSize := array_mapM_size selectedLeft
+    have rightSize := array_mapM_size selectedRight
+    have resultSize : (AIR.rowValues a).size = left.size := by
+      simpa only [AIR.rowValues, Array.size_map] using array_mapM_size evalA
+    refine ⟨_, ?_, emitAssert_reflects selectorEval evalA evalB (by omega)⟩
+    simp only [AIR.emitOp, same, ne_eq, not_true_eq_false, if_false,
+      select_values readA, select_values readB, bind, Option.bind_some, pure]
+    rw [list_ofFn_getD_pair (AIR.rowValues a) (AIR.rowValues b) 0 0 (fun x y => s * (x - y)) resultSize]
+  | ioGetInfo | ioRead | unconstrainedBigUintDivMod | unconstrainedGToBytes | unconstrainedGInverse =>
+    cases emitted
+    exact ⟨_, rfl, emitAdvice_reflects values row first _ reads⟩
+  | ioSetInfo | ioWrite | debug =>
+    cases emitted
+    exact ⟨_, rfl, empty_eval values⟩
+  | u8BitDecomposition index => exact emitByte1_dispatch values row selector rank s r first .bits index inputEval emitted reads
+  | u8ShiftLeft index => exact emitByte1_dispatch values row selector rank s r first .shiftLeft index inputEval emitted reads
+  | u8ShiftRight index => exact emitByte1_dispatch values row selector rank s r first .shiftRight index inputEval emitted reads
+  | u8Xor a b => exact emitByte2_dispatch values row selector rank s r first .xor a b inputEval normal emitted reads
+  | u8Add a b => exact emitByte2_dispatch values row selector rank s r first .add a b inputEval normal emitted reads
+  | u8Sub a b => exact emitByte2_dispatch values row selector rank s r first .sub a b inputEval normal emitted reads
+  | u8And a b => exact emitByte2_dispatch values row selector rank s r first .and a b inputEval normal emitted reads
+  | u8Or a b => exact emitByte2_dispatch values row selector rank s r first .or a b inputEval normal emitted reads
+  | u8LessThan a b => exact emitByte2_dispatch values row selector rank s r first .lessThan a b inputEval normal emitted reads
+  | u8RangeCheck a b => exact emitByte2_dispatch values row selector rank s r first .range a b inputEval normal emitted reads
+  | u8Mul a b => exact emitByte2_dispatch values row selector rank s r first .mul a b inputEval normal emitted reads
+  | u8XorSplit7 a b => exact emitByte2_dispatch values row selector rank s r first .split7 a b inputEval normal emitted reads
+  | u8XorSplit4 a b => exact emitByte2_dispatch values row selector rank s r first .split4 a b inputEval normal emitted reads
+  | u32LessThan a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    obtain ⟨x, readX, refX⟩ := evalRows_read inputEval readA
+    obtain ⟨y, readY, refY⟩ := evalRows_read inputEval readB
+    refine ⟨_, ?_, emitU32LessThan_reflects values row first selectorEval refX refY reads⟩
+    simp only [AIR.emitOp, AIR.emitU32LessThan, readX, readY, bind, Option.bind_some, pure]
+  | unconstrainedU32Add a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    obtain ⟨x, readX, refX⟩ := readWord_reflects inputEval readA
+    obtain ⟨y, readY, refY⟩ := readWord_reflects inputEval readB
+    refine ⟨_, ?_, emitWordSum_reflects values row first (RowExpr.add_reflects values refX refY) reads⟩
+    simp only [AIR.emitOp, AIR.emitU32Add, readX, readY, bind, Option.bind_some, pure]
+  | unconstrainedU32Add3 a b c =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i third readC
+    cases emitted
+    obtain ⟨x, readX, refX⟩ := readWord_reflects inputEval readA
+    obtain ⟨y, readY, refY⟩ := readWord_reflects inputEval readB
+    obtain ⟨z, readZ, refZ⟩ := readWord_reflects inputEval readC
+    refine ⟨_, ?_, emitWordSum_reflects values row first
+      (RowExpr.add_reflects values (RowExpr.add_reflects values refX refY) refZ) reads⟩
+    simp only [AIR.emitOp, AIR.emitU32Add, readX, readY, readZ,
+      Option.map_some, bind, Option.bind_some, pure]
+  | u32ToField indices =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i word read
+    cases emitted
+    obtain ⟨value, readValue, refValue⟩ := readWord_reflects inputEval read
+    refine ⟨{ outputs := #[value] }, ?_, ?_⟩
+    · simp only [AIR.emitOp, readValue, bind, Option.bind_some, pure]
+    · rw [fromScalar_eval]
+      exact ScalarEmission.eval_of values refValue rfl
+
+theorem emitByte1_dispatch_normal (selector rank : Expr) (first : Nat)
+    (kind : AIR.Byte1Kind) (index : Nat) {rows : Array RowExpr} {emission : Emission}
+    (emitted : emitOp selector rank first (kind.op index) rows = some emission) :
+    Normal emission.outputs := by
+  rw [emitOp_byte1] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  cases emitted
+  exact advice_normal _ _
+
+theorem emitByte2_dispatch_normal (selector rank : Expr) (first : Nat)
+    (kind : AIR.Byte2Kind) (a b : Nat) {rows : Array RowExpr} {emission : Emission}
+    (normal : Normal rows)
+    (emitted : emitOp selector rank first (kind.op a b) rows = some emission) :
+    Normal emission.outputs := by
+  rw [emitOp_byte2] at emitted
+  simp only [bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  rename_i left readA
+  dsimp only at emitted
+  split at emitted
+  · cases emitted
+  rename_i right readB
+  cases emitted
+  exact emitByte2_normal _ _ (normal.read readA) (normal.read readB)
+
+theorem emitOp_normal {selector rank : Expr} {first : Nat} {op : Bytecode.Op}
+    {rows : Array RowExpr} {emission : Emission} (normal : Normal rows)
+    (emitted : emitOp selector rank first op rows = some emission) :
+    Normal emission.outputs := by
+  cases op with
+  | const value =>
+    cases emitted
+    exact normal_singleton rfl
+  | add a b | sub a b | mul a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    apply normal_singleton
+    first
+    | exact Expr.frontAdd_noConstantNegs (normal.read readA) (normal.read readB)
+    | exact Expr.frontSub_noConstantNegs (normal.read readA) (normal.read readB)
+    | exact NativeAIR.emitMul_noConstantNegs selector first (normal.read readA) (normal.read readB)
+  | eqZero index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact normal_singleton (NativeAIR.emitEqZero_noConstantNegs _ _ _)
+  | call function indices size unconstrained =>
+    cases unconstrained with
+    | true =>
+      cases emitted
+      exact advice_normal _ _
+    | false =>
+      simp only [emitOp, Bool.false_eq_true, if_false, bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      cases emitted
+      exact advice_normal _ _
+  | store indices | load size index =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact advice_normal _ _
+  | assertEq xs ys message =>
+    simp only [emitOp] at emitted
+    split at emitted
+    · cases emitted
+    simp only [bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact normal_empty
+  | ioGetInfo | ioRead | unconstrainedBigUintDivMod | unconstrainedGToBytes | unconstrainedGInverse =>
+    cases emitted
+    exact advice_normal _ _
+  | ioSetInfo | ioWrite | debug =>
+    cases emitted
+    exact normal_empty
+  | u8BitDecomposition index => exact emitByte1_dispatch_normal selector rank first .bits index emitted
+  | u8ShiftLeft index => exact emitByte1_dispatch_normal selector rank first .shiftLeft index emitted
+  | u8ShiftRight index => exact emitByte1_dispatch_normal selector rank first .shiftRight index emitted
+  | u8Xor a b => exact emitByte2_dispatch_normal selector rank first .xor a b normal emitted
+  | u8Add a b => exact emitByte2_dispatch_normal selector rank first .add a b normal emitted
+  | u8Sub a b => exact emitByte2_dispatch_normal selector rank first .sub a b normal emitted
+  | u8And a b => exact emitByte2_dispatch_normal selector rank first .and a b normal emitted
+  | u8Or a b => exact emitByte2_dispatch_normal selector rank first .or a b normal emitted
+  | u8LessThan a b => exact emitByte2_dispatch_normal selector rank first .lessThan a b normal emitted
+  | u8RangeCheck a b => exact emitByte2_dispatch_normal selector rank first .range a b normal emitted
+  | u8Mul a b => exact emitByte2_dispatch_normal selector rank first .mul a b normal emitted
+  | u8XorSplit7 a b => exact emitByte2_dispatch_normal selector rank first .split7 a b normal emitted
+  | u8XorSplit4 a b => exact emitByte2_dispatch_normal selector rank first .split4 a b normal emitted
+  | u32LessThan a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    cases emitted
+    exact emitU32LessThan_normal _ _ _ _
+  | unconstrainedU32Add a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    cases emitted
+    exact emitWordSum_normal _ (Expr.frontAdd_noConstantNegs
+      (readWord_normal normal readA) (readWord_normal normal readB))
+  | unconstrainedU32Add3 a b c =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i left readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i right readB
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i third readC
+    cases emitted
+    exact emitWordSum_normal _ (Expr.frontAdd_noConstantNegs
+      (Expr.frontAdd_noConstantNegs (readWord_normal normal readA) (readWord_normal normal readB))
+      (readWord_normal normal readC))
+  | u32ToField indices =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i word read
+    cases emitted
+    exact normal_singleton (readWord_normal normal read)
+
+end Aiur.NativeAIR.OpEmitter
diff --git a/Ix/Aiur/Proofs/OperationRows.lean b/Ix/Aiur/Proofs/OperationRows.lean
new file mode 100644
index 000000000..2504fcfcf
--- /dev/null
+++ b/Ix/Aiur/Proofs/OperationRows.lean
@@ -0,0 +1,661 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.GlobalLookups
+
+/-!
+Valued emission and local execution for every native bytecode operation.
+The model retains expression degree, constant folding, fresh auxiliary-column
+allocation, logical map extension, polynomial values and raw query parts.
+Active satisfying emissions derive relational steps and operation sequences
+using byte and memory facts from the global lookup pool.
+
+This is a total Lean model. Identifying its reads and metadata with the Rust
+expression emitter, proving index and layout validity, and extracting its
+active query parts from shared slots remain explicit obligations.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+/-- One evaluated logical value, retaining the native emitter's expression
+degree and whether its frontend expression is syntactically constant. -/
+structure RowValue where
+  value : G
+  degree : Nat
+  constant : Bool
+  deriving Repr, DecidableEq
+
+def RowValue.variable (value : G) : RowValue := ⟨value, 1, false⟩
+def RowValue.konst (value : G) : RowValue := ⟨value, 0, true⟩
+def rowValues (values : Array RowValue) : Array G := values.map RowValue.value
+
+def RowValue.add (left right : RowValue) : RowValue :=
+  ⟨left.value + right.value, max left.degree right.degree, left.constant && right.constant⟩
+
+def RowValue.sub (left right : RowValue) : RowValue :=
+  ⟨left.value - right.value, max left.degree right.degree, left.constant && right.constant⟩
+
+/-- Multiplication by a known zero also folds a nonconstant expression to
+a constant; the native operation's degree bookkeeping remains independent. -/
+def RowValue.mul (left right : RowValue) : RowValue :=
+  ⟨left.value * right.value, left.degree + right.degree,
+    (left.constant && right.constant) || (left.constant && left.value == 0) ||
+      (right.constant && right.value == 0)⟩
+
+def rowAdvice (row : Nat → G) (start count : Nat) : Array RowValue :=
+  Array.ofFn fun index : Fin count => RowValue.variable (row (start + index.val))
+
+def RowValue.pack (values : Array RowValue) : RowValue :=
+  ⟨Bytecode.AIR.packWord (rowValues values),
+    values.toList.foldl (fun degree value => max degree value.degree) 0,
+    values.all (·.constant)⟩
+
+def readRowWord (values : Array RowValue) (indices : Array ValIdx) : Option RowValue := do
+  let word ← Bytecode.AIR.readWord (rowValues values) indices
+  let bytes := indices.map fun index => values[index]?.getD (RowValue.konst 0)
+  return { RowValue.pack bytes with value := word }
+
+/-- One operation's evaluated outputs and newly emitted constraints. Lookup
+messages are ungated contributions; slot assembly supplies their selector.
+`used` is the exact number of fresh auxiliary columns consumed. -/
+structure OpEmission where
+  outputs : Array RowValue := #[]
+  used : Nat := 0
+  equations : List G := []
+  queries : List (List G) := []
+  calls : List (Bytecode.AIR.Call × (Fin 6 → G)) := []
+
+def emitAdvice (row : Nat → G) (count : Nat) : OpEmission :=
+  { outputs := rowAdvice row 0 count, used := count }
+
+def emitByte1 (row : Nat → G) (kind : Byte1Kind) (index : ValIdx)
+    (values : Array RowValue) : Option OpEmission := do
+  let input ← values[index]?
+  let outputs := rowAdvice row 0 kind.outputSize
+  return {
+    outputs, used := kind.outputSize
+    queries := [byte1Request kind input.value (rowValues outputs)] }
+
+def Byte2Kind.extendRowOutputs (kind : Byte2Kind) (left right : RowValue)
+    (outputs : Array RowValue) : Array RowValue :=
+  let low := ((rowValues outputs)[0]?).getD 0
+  let degree := max (max left.degree right.degree) 1
+  match kind with
+  | .add => outputs.push ⟨(left.value + right.value - low) * inverse256, degree, false⟩
+  | .sub => outputs.push ⟨(low + right.value - left.value) * inverse256, degree, false⟩
+  | _ => outputs
+
+def emitByte2 (row : Nat → G) (kind : Byte2Kind) (left right : ValIdx)
+    (values : Array RowValue) : Option OpEmission := do
+  let x ← values[left]?
+  let y ← values[right]?
+  let outputs := rowAdvice row 0 kind.outputSize
+  return {
+    outputs := kind.extendRowOutputs x y outputs, used := kind.outputSize
+    queries := [byte2Request kind x.value y.value (rowValues outputs)] }
+
+def range4Queries (bytes : Fin 4 → G) : List (List G) :=
+  [rangeMessage (bytes 0, bytes 1), rangeMessage (bytes 2, bytes 3)]
+
+def emitU32LessThan (row : Nat → G) (selector : G) (left right : ValIdx)
+    (values : Array RowValue) : Option OpEmission := do
+  let a ← values[left]?
+  let b ← values[right]?
+  let x : Fin 4 → G := fun index => row index.val
+  let y : Fin 4 → G := fun index => row (4 + index.val)
+  let z : Fin 4 → G := fun index => row (8 + index.val)
+  return {
+    outputs := #[⟨1 - u32Carries x y z 4, 1, false⟩], used := 12
+    equations := selector * (a.value - pack4 x) :: selector * (b.value - pack4 z) ::
+      List.ofFn (fun index : Fin 4 => selector * booleanConstraint (u32Carries x y z index.succ)),
+    queries := range4Queries x ++ range4Queries y ++ range4Queries z }
+
+def emitU32Add (row : Nat → G) (left right : Array ValIdx)
+    (third : Option (Array ValIdx)) (values : Array RowValue) : Option OpEmission := do
+  let x ← readRowWord values left
+  let y ← readRowWord values right
+  let sum ← match third with
+    | none => some (x.add y)
+    | some indices => (readRowWord values indices).map fun z => (x.add y).add z
+  let bytes := rowAdvice row 0 4
+  let packed := RowValue.pack bytes
+  return { outputs := bytes.push ⟨(sum.value - packed.value) * 0xfffffffe00000002,
+      max sum.degree packed.degree, false⟩, used := 4 }
+
+/-- Valued model of one native operation. Invalid reads and malformed word
+widths return `none`. Constant `eq_zero` inputs with positive tracked degree
+use the ordinary two-column emission, preserving the compiled layout.
+Store operands are checked in the incoming logical scope; identifying that
+scope with the Rust emitter's post-pointer reads requires index validity. -/
+def emitOp (row : Nat → G) (selector rank : G) (op : Op)
+    (values : Array RowValue) : Option OpEmission :=
+  match op with
+  | .const value => some { outputs := #[RowValue.konst value] }
+  | .add a b => do return { outputs := #[(← values[a]?).add (← values[b]?)] }
+  | .sub a b => do return { outputs := #[(← values[a]?).sub (← values[b]?)] }
+  | .mul a b => do
+    let x ← values[a]?
+    let y ← values[b]?
+    let product := x.mul y
+    if product.degree < 2 then return { outputs := #[product] }
+    else return {
+      outputs := #[RowValue.variable (row 0)], used := 1
+      equations := [selector * (row 0 - product.value)] }
+  | .eqZero a => do
+    let input ← values[a]?
+    if input.constant && input.degree == 0 then
+      return { outputs := #[RowValue.konst (G.eqZero input.value)] }
+    else return {
+      outputs := #[RowValue.variable (row 1)], used := 2
+      equations := [selector * input.value * row 1,
+        selector * (input.value * row 0 + row 1 - 1)] }
+  | .call function indices size unconstrained =>
+    if unconstrained then some (emitAdvice row size)
+    else do
+      let inputs ← Bytecode.AIR.readValues (rowValues values) indices
+      let outputs := rowAdvice row 0 size
+      let request : Bytecode.AIR.Call := ⟨function, inputs, rowValues outputs, row size⟩
+      let gap : Fin 6 → G := fun index => row (size + 1 + index.val)
+      return {
+        outputs, used := size + 7
+        equations := [selector * callOrderConstraint rank request.rank (packRank gap)],
+        queries := functionMessage request :: (rankByteQueries gap).map rangeMessage,
+        calls := [(request, gap)] }
+  | .store indices => do
+    let contents ← Bytecode.AIR.readValues (rowValues values) indices
+    return {
+      outputs := #[RowValue.variable (row 0)], used := 1
+      queries := [memoryMessage indices.size (row 0) contents] }
+  | .load size index => do
+    let pointer ← values[index]?
+    let outputs := rowAdvice row 0 size
+    return {
+      outputs, used := size
+      queries := [memoryMessage size pointer.value (rowValues outputs)] }
+  | .assertEq xs ys _ => do
+    if xs.size ≠ ys.size then none else do
+      let left ← Bytecode.AIR.readValues (rowValues values) xs
+      let right ← Bytecode.AIR.readValues (rowValues values) ys
+      return { equations := List.ofFn fun i : Fin left.size =>
+        selector * (left[i] - right[i.val]?.getD 0) }
+  | .ioGetInfo .. => some (emitAdvice row 2)
+  | .ioRead _ _ size => some (emitAdvice row size)
+  | .ioSetInfo .. | .ioWrite .. | .debug .. => some {}
+  | .u8BitDecomposition index => emitByte1 row .bits index values
+  | .u8ShiftLeft index => emitByte1 row .shiftLeft index values
+  | .u8ShiftRight index => emitByte1 row .shiftRight index values
+  | .u8Xor a b => emitByte2 row .xor a b values
+  | .u8Add a b => emitByte2 row .add a b values
+  | .u8Sub a b => emitByte2 row .sub a b values
+  | .u8And a b => emitByte2 row .and a b values
+  | .u8Or a b => emitByte2 row .or a b values
+  | .u8LessThan a b => emitByte2 row .lessThan a b values
+  | .u8RangeCheck a b => emitByte2 row .range a b values
+  | .u8Mul a b => emitByte2 row .mul a b values
+  | .u8XorSplit7 a b => emitByte2 row .split7 a b values
+  | .u8XorSplit4 a b => emitByte2 row .split4 a b values
+  | .u32LessThan a b => emitU32LessThan row selector a b values
+  | .unconstrainedBigUintDivMod .. => some (emitAdvice row 2)
+  | .unconstrainedGToBytes .. => some (emitAdvice row 8)
+  | .unconstrainedGInverse .. => some (emitAdvice row 1)
+  | .unconstrainedU32Add a b => emitU32Add row a b none values
+  | .unconstrainedU32Add3 a b c => emitU32Add row a b (some c) values
+  | .u32ToField indices => do return { outputs := #[← readRowWord values indices] }
+
+theorem rowValues_read {values : Array RowValue} {index : ValIdx} {value : RowValue}
+    (read : values[index]? = some value) : (rowValues values)[index]? = some value.value := by
+  simp only [rowValues, Array.getElem?_map, read, Option.map_some]
+
+theorem rowValues_advice_size (row : Nat → G) (start count : Nat) :
+    (rowValues (rowAdvice row start count)).size = count := by
+  simp only [rowValues, rowAdvice, Array.size_map, Array.size_ofFn]
+
+theorem rowValues_singleton (value : RowValue) : rowValues #[value] = #[value.value] := by
+  simp only [rowValues, Array.map_singleton]
+
+theorem rowValues_empty : rowValues #[] = #[] := by
+  simp only [rowValues, Array.map_empty]
+
+theorem rowValues_extendOutputs (kind : Byte2Kind) (left right : RowValue)
+    (outputs : Array RowValue) :
+    rowValues (kind.extendRowOutputs left right outputs) =
+      kind.extendOutputs left.value right.value (rowValues outputs) := by
+  cases kind <;> simp only [Byte2Kind.extendRowOutputs, Byte2Kind.extendOutputs,
+    rowValues, Array.map_push]
+
+theorem readRowWord_value {values : Array RowValue} {indices : Array ValIdx} {word : RowValue}
+    (read : readRowWord values indices = some word) :
+    Bytecode.AIR.readWord (rowValues values) indices = some word.value := by
+  simp only [readRowWord, bind, Option.bind] at read
+  split at read
+  · cases read
+  · have equal := Option.some.inj read
+    rw [← equal]
+    assumption
+
+theorem emitByte1_step {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries) (memory : Bytecode.AIR.Memory)
+    {row : Nat → G} {kind : Byte1Kind} {index : ValIdx} {values : Array RowValue}
+    {emission : OpEmission} (emitted : emitByte1 row kind index values = some emission)
+    (queried : emission.queries ⊆ queries) :
+    Bytecode.AIR.Step memory (kind.op index) (rowValues values)
+      (rowValues values ++ rowValues emission.outputs) (emission.calls.map Prod.fst) := by
+  simp only [emitByte1, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i input read
+    have equal := Option.some.inj emitted
+    subst emission
+    exact global.byte1_step memory (rowValues_read read) (rowValues_advice_size _ _ _)
+      (queried List.mem_cons_self)
+
+theorem emitByte2_step {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries) (memory : Bytecode.AIR.Memory)
+    {row : Nat → G} {kind : Byte2Kind} {left right : ValIdx} {values : Array RowValue}
+    {emission : OpEmission} (emitted : emitByte2 row kind left right values = some emission)
+    (queried : emission.queries ⊆ queries) :
+    Bytecode.AIR.Step memory (kind.op left right) (rowValues values)
+      (rowValues values ++ rowValues emission.outputs) (emission.calls.map Prod.fst) := by
+  simp only [emitByte2, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i x readX
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i y readY
+      have equal := Option.some.inj emitted
+      subst emission
+      simp only [rowValues_extendOutputs]
+      exact global.byte2_step memory (rowValues_read readX) (rowValues_read readY)
+        (rowValues_advice_size _ _ _) (queried List.mem_cons_self)
+
+theorem GlobalLookups.range4 {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries) (bytes : Fin 4 → G)
+    (queried : range4Queries bytes ⊆ queries) : ∀ i, (bytes i).n < 256 := by
+  have first := global.byte2 (kind := .range) (x := bytes 0) (y := bytes 1) (outputs := #[]) rfl
+    (queried (by simp [range4Queries, rangeMessage]))
+  have last := global.byte2 (kind := .range) (outputs := #[]) rfl
+    (queried (by simp [range4Queries, rangeMessage] : rangeMessage (bytes 2, bytes 3) ∈ range4Queries bytes))
+  intro i
+  have cases : i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 := by omega
+  rcases cases with rfl | rfl | rfl | rfl
+  · exact first.1
+  · exact first.2.1
+  · exact last.1
+  · exact last.2.1
+
+theorem emitU32LessThan_step {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries) (memory : Bytecode.AIR.Memory)
+    {row : Nat → G} {selector : G} {left right : ValIdx} {values : Array RowValue}
+    {emission : OpEmission} (emitted : emitU32LessThan row selector left right values = some emission)
+    (active : selector = 1) (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (queried : emission.queries ⊆ queries) :
+    Bytecode.AIR.Step memory (.u32LessThan left right) (rowValues values)
+      (rowValues values ++ rowValues emission.outputs) (emission.calls.map Prod.fst) := by
+  simp only [emitU32LessThan, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i a readA
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i b readB
+      have equal := Option.some.inj emitted
+      subst emission
+      simp only [rowValues_singleton]
+      apply active_u32_less_than_step memory active (rowValues_read readA) (rowValues_read readB)
+        (fun index => row index.val) (fun index => row (4 + index.val)) (fun index => row (8 + index.val))
+      · exact global.range4 _ (fun message member => queried
+          (List.mem_append_left _ (List.mem_append_left _ member)))
+      · exact global.range4 _ (fun message member => queried
+          (List.mem_append_left _ (List.mem_append_right _ member)))
+      · exact global.range4 _ (fun message member => queried (List.mem_append_right _ member))
+      · exact satisfied _ List.mem_cons_self
+      · exact satisfied _ (List.mem_cons_of_mem _ List.mem_cons_self)
+      · intro index
+        apply satisfied
+        exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _ (List.mem_ofFn.mpr ⟨index, rfl⟩))
+
+theorem emitU32Add_step (memory : Bytecode.AIR.Memory)
+    {row : Nat → G} {left right : Array ValIdx} {values : Array RowValue} {emission : OpEmission}
+    (emitted : emitU32Add row left right none values = some emission) :
+    Bytecode.AIR.Step memory (.unconstrainedU32Add left right) (rowValues values)
+      (rowValues values ++ rowValues emission.outputs) (emission.calls.map Prod.fst) := by
+  simp only [emitU32Add, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i x readX
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i y readY
+      have equal := Option.some.inj emitted
+      subst emission
+      apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 4))
+      simp only [Bytecode.AIR.primitive, readRowWord_value readX, readRowWord_value readY,
+        Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, bind, Option.bind]
+      simp only [RowValue.add, RowValue.pack, rowValues, Array.map_push, pure]
+
+theorem emitU32Add3_step (memory : Bytecode.AIR.Memory)
+    {row : Nat → G} {left right third : Array ValIdx} {values : Array RowValue} {emission : OpEmission}
+    (emitted : emitU32Add row left right (some third) values = some emission) :
+    Bytecode.AIR.Step memory (.unconstrainedU32Add3 left right third) (rowValues values)
+      (rowValues values ++ rowValues emission.outputs) (emission.calls.map Prod.fst) := by
+  simp only [emitU32Add, bind, Option.bind] at emitted
+  split at emitted
+  · cases emitted
+  · rename_i x readX
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    · rename_i y readY
+      dsimp only at emitted
+      cases readZ : readRowWord values third with
+      | none => simp only [readZ, Option.map_none] at emitted; cases emitted
+      | some z =>
+        simp only [readZ, Option.map_some] at emitted
+        have equal := Option.some.inj emitted
+        subst emission
+        apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 4))
+        simp only [Bytecode.AIR.primitive, readRowWord_value readX, readRowWord_value readY,
+          readRowWord_value readZ, Bytecode.AIR.adviceOfSize, rowValues_advice_size,
+          ite_true, bind, Option.bind]
+        simp only [RowValue.add, RowValue.pack, rowValues, Array.map_push, pure]
+
+theorem active_array_equality {selector : G} {left right : Array G}
+    (active : selector = 1) (sizes : left.size = right.size)
+    (equations : ∀ equation ∈ (List.ofFn fun i : Fin left.size =>
+      selector * (left[i] - right[i.val]?.getD 0)), equation = 0) : left = right := by
+  apply Array.ext sizes
+  intro index leftBound rightBound
+  have equal := active_case active (equations _ (List.mem_ofFn.mpr ⟨⟨index, leftBound⟩, rfl⟩))
+  simpa only [Fin.getElem_fin, Array.getElem?_eq_getElem rightBound, Option.getD_some] using equal
+
+/-- A successful valued emission on an active row has the full relational
+meaning of its bytecode operation. Byte and memory facts come from the one
+global pool; constrained calls remain requests for the later rank induction. -/
+theorem emitOp_step {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    {program : Toplevel} {op : Op} (shape : op.lookupShape program = true)
+    {row : Nat → G} {selector rank : G} {values : Array RowValue} {emission : OpEmission}
+    (emitted : emitOp row selector rank op values = some emission)
+    (active : selector = 1) (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (queried : emission.queries ⊆ queries) :
+    Bytecode.AIR.Step (memoryFacts tables.memory) op (rowValues values)
+      (rowValues values ++ rowValues emission.outputs) (emission.calls.map Prod.fst) := by
+  cases op with
+  | const value =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := #[])
+    simp only [Bytecode.AIR.primitive, rowValues_singleton, RowValue.konst]
+  | add a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i x readX
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i y readY
+        have equal := Option.some.inj emitted
+        subst emission
+        apply Bytecode.AIR.Step.primitive (advice := #[])
+        simp only [Bytecode.AIR.primitive, rowValues_read readX, rowValues_read readY,
+          bind, Option.bind, pure, rowValues_singleton, RowValue.add]
+  | sub a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i x readX
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i y readY
+        have equal := Option.some.inj emitted
+        subst emission
+        apply Bytecode.AIR.Step.primitive (advice := #[])
+        simp only [Bytecode.AIR.primitive, rowValues_read readX, rowValues_read readY,
+          bind, Option.bind, pure, rowValues_singleton, RowValue.sub]
+  | mul a b =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i x readX
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i y readY
+        dsimp only at emitted
+        split at emitted
+        · have equal := Option.some.inj emitted
+          subst emission
+          apply Bytecode.AIR.Step.primitive (advice := #[])
+          simp only [Bytecode.AIR.primitive, rowValues_read readX, rowValues_read readY,
+            bind, Option.bind, pure, rowValues_singleton, RowValue.mul]
+        · have equal := Option.some.inj emitted
+          subst emission
+          have product := active_case active (satisfied _ List.mem_cons_self)
+          apply Bytecode.AIR.Step.primitive (advice := #[])
+          simp only [Bytecode.AIR.primitive, rowValues_read readX, rowValues_read readY,
+            bind, Option.bind, pure, rowValues_singleton, RowValue.variable, product, RowValue.mul]
+  | eqZero a =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i input read
+      dsimp only at emitted
+      split at emitted
+      · have equal := Option.some.inj emitted
+        subst emission
+        apply Bytecode.AIR.Step.primitive (advice := #[])
+        simp only [Bytecode.AIR.primitive, rowValues_read read, bind, Option.bind,
+          pure, rowValues_singleton, RowValue.konst]
+      · have equal := Option.some.inj emitted
+        subst emission
+        have result := active_eqZero active (satisfied _ List.mem_cons_self)
+          (satisfied _ (List.mem_cons_of_mem _ List.mem_cons_self))
+        apply Bytecode.AIR.Step.primitive (advice := #[])
+        simp only [Bytecode.AIR.primitive, rowValues_read read, bind, Option.bind,
+          pure, rowValues_singleton, RowValue.variable, result]
+  | call function indices size unconstrained =>
+    cases unconstrained with
+    | true =>
+      simp only [emitOp, ite_true, Option.some.injEq] at emitted
+      subst emission
+      apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 size))
+      simp only [Bytecode.AIR.primitive, Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, emitAdvice]
+    | false =>
+      simp only [emitOp, Bool.false_eq_true, ite_false, bind, Option.bind] at emitted
+      split at emitted
+      · cases emitted
+      · rename_i inputs read
+        have equal := Option.some.inj emitted
+        subst emission
+        exact Bytecode.AIR.Step.call
+          (request := ⟨function, inputs, rowValues (rowAdvice row 0 size), row size⟩)
+          read (rowValues_advice_size row 0 size)
+  | store indices =>
+    have widthBound : indices.size < gSize.toNat := by
+      simpa only [Op.lookupShape, decide_eq_true_eq] using shape
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i contents read
+      have equal := Option.some.inj emitted
+      subst emission
+      have size := Bytecode.AIR.readValues_size read
+      have fact := global.memory_fact memoryValid canonical widthBound size (queried List.mem_cons_self)
+      rw [← size] at fact
+      simpa only [rowValues_singleton, RowValue.variable, Array.push_eq_append, List.map_nil] using
+        Bytecode.AIR.Step.store read fact
+  | load size index =>
+    have widthBound : size < gSize.toNat := by
+      simpa only [Op.lookupShape, decide_eq_true_eq] using shape
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i pointer read
+      have equal := Option.some.inj emitted
+      subst emission
+      exact Bytecode.AIR.Step.load (rowValues_read read) (rowValues_advice_size _ _ _)
+        (global.memory_fact memoryValid canonical widthBound (rowValues_advice_size _ _ _)
+          (queried List.mem_cons_self))
+  | assertEq xs ys message =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i sameSize
+      split at emitted
+      · cases emitted
+      · rename_i left readLeft
+        dsimp only at emitted
+        split at emitted
+        · cases emitted
+        · rename_i right readRight
+          have equal := Option.some.inj emitted
+          subst emission
+          have sizes : left.size = right.size := by
+            have := Bytecode.AIR.readValues_size readLeft
+            have := Bytecode.AIR.readValues_size readRight
+            omega
+          have contents := active_array_equality active sizes satisfied
+          apply Bytecode.AIR.Step.primitive (advice := #[])
+          simp only [rowValues_empty]
+          simp only [Bytecode.AIR.primitive, readLeft, readRight, bind, Option.bind,
+            if_pos contents]
+  | ioGetInfo key data =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 2))
+    simp only [Bytecode.AIR.primitive, Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, emitAdvice]
+  | ioRead key offset size =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 size))
+    simp only [Bytecode.AIR.primitive, Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, emitAdvice]
+  | ioSetInfo key data flag length =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := #[])
+    simp only [Bytecode.AIR.primitive, rowValues, Array.map_empty]
+  | ioWrite key data =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := #[])
+    simp only [Bytecode.AIR.primitive, rowValues, Array.map_empty]
+  | debug message data =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := #[])
+    simp only [Bytecode.AIR.primitive, rowValues, Array.map_empty]
+  | u8BitDecomposition index => exact emitByte1_step global _ emitted queried
+  | u8ShiftLeft index => exact emitByte1_step global _ emitted queried
+  | u8ShiftRight index => exact emitByte1_step global _ emitted queried
+  | u8Xor a b => exact emitByte2_step global _ emitted queried
+  | u8Add a b => exact emitByte2_step global _ emitted queried
+  | u8Sub a b => exact emitByte2_step global _ emitted queried
+  | u8And a b => exact emitByte2_step global _ emitted queried
+  | u8Or a b => exact emitByte2_step global _ emitted queried
+  | u8LessThan a b => exact emitByte2_step global _ emitted queried
+  | u8RangeCheck a b => exact emitByte2_step global _ emitted queried
+  | u8Mul a b => exact emitByte2_step global _ emitted queried
+  | u8XorSplit7 a b => exact emitByte2_step global _ emitted queried
+  | u8XorSplit4 a b => exact emitByte2_step global _ emitted queried
+  | u32LessThan a b => exact emitU32LessThan_step global _ emitted active satisfied queried
+  | unconstrainedBigUintDivMod a b =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 2))
+    simp only [Bytecode.AIR.primitive, Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, emitAdvice]
+  | unconstrainedGToBytes index =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 8))
+    simp only [Bytecode.AIR.primitive, Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, emitAdvice]
+  | unconstrainedGInverse index =>
+    simp only [emitOp, Option.some.injEq] at emitted
+    subst emission
+    apply Bytecode.AIR.Step.primitive (advice := rowValues (rowAdvice row 0 1))
+    simp only [Bytecode.AIR.primitive, Bytecode.AIR.adviceOfSize, rowValues_advice_size, ite_true, emitAdvice]
+  | unconstrainedU32Add a b => exact emitU32Add_step _ emitted
+  | unconstrainedU32Add3 a b c => exact emitU32Add3_step _ emitted
+  | u32ToField indices =>
+    simp only [emitOp, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i word read
+      have equal := Option.some.inj emitted
+      subst emission
+      apply Bytecode.AIR.Step.primitive (advice := #[])
+      simp only [Bytecode.AIR.primitive, readRowWord_value read, bind, Option.bind,
+        pure, rowValues_singleton]
+
+structure OpsEmission where
+  values : Array RowValue
+  column : Nat
+  equations : List G := []
+  queries : List (List G) := []
+  calls : List (Bytecode.AIR.Call × (Fin 6 → G)) := []
+
+/-- Native operation order, including the logical map extension and exact
+advance of the auxiliary-column cursor after each operation. -/
+def emitOps (row : Nat → G) (selector rank : G) :
+    List Op → Array RowValue → Nat → Option OpsEmission
+  | [], values, column => some { values, column }
+  | op :: ops, values, column => do
+    let first ← emitOp (fun i => row (column + i)) selector rank op values
+    let rest ← emitOps row selector rank ops (values ++ first.outputs) (column + first.used)
+    return { rest with
+      equations := first.equations ++ rest.equations
+      queries := first.queries ++ rest.queries
+      calls := first.calls ++ rest.calls }
+
+theorem rowValues_append (left right : Array RowValue) :
+    rowValues (left ++ right) = rowValues left ++ rowValues right := by
+  simp only [rowValues, Array.map_append]
+
+theorem emitOps_run {tables : LookupTables} {width : Nat} {queries : List (List G)}
+    (global : GlobalLookups tables width queries)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    {program : Toplevel} {ops : List Op} (shapes : ∀ op ∈ ops, op.lookupShape program = true)
+    {row : Nat → G} {selector rank : G} {values : Array RowValue} {column : Nat}
+    {emission : OpsEmission} (emitted : emitOps row selector rank ops values column = some emission)
+    (active : selector = 1) (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (queried : emission.queries ⊆ queries) :
+    Bytecode.AIR.RunOps (memoryFacts tables.memory) ops (rowValues values)
+      (rowValues emission.values) (emission.calls.map Prod.fst) := by
+  induction ops generalizing values column emission with
+  | nil =>
+    simp only [emitOps, Option.some.injEq] at emitted
+    subst emission
+    exact Bytecode.AIR.RunOps.nil
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    · rename_i first firstEmitted
+      dsimp only at emitted
+      split at emitted
+      · cases emitted
+      · rename_i rest restEmitted
+        have equal := Option.some.inj emitted
+        subst emission
+        have firstStep := emitOp_step global memoryValid canonical (shapes op List.mem_cons_self)
+          firstEmitted active
+          (fun equation member => satisfied equation (List.mem_append_left _ member))
+          (fun message member => queried (List.mem_append_left _ member))
+        have restRun := ih (fun op member => shapes op (List.mem_cons_of_mem _ member))
+          restEmitted (fun equation member => satisfied equation (List.mem_append_right _ member))
+          (fun message member => queried (List.mem_append_right _ member))
+        rw [rowValues_append] at restRun
+        simpa only [List.map_append] using Bytecode.AIR.RunOps.cons firstStep restRun
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/OperationSequences.lean b/Ix/Aiur/Proofs/OperationSequences.lean
new file mode 100644
index 000000000..7e24a5bb7
--- /dev/null
+++ b/Ix/Aiur/Proofs/OperationSequences.lean
@@ -0,0 +1,207 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationReflection
+
+/-!
+Symbolic operation sequences preserve the logical value map and fresh-column
+cursor. Their reflection derives the entire valued emission from successful
+symbolic emission and defined reads of exactly the consumed column interval.
+-/
+
+namespace Aiur.NativeAIR.OpEmitter
+
+theorem evalRows_append {values : Values G} {left right : Array RowExpr}
+    {a b : Array AIR.RowValue} (leftEval : evalRows values left = some a)
+    (rightEval : evalRows values right = some b) :
+    evalRows values (left ++ right) = some (a ++ b) := by
+  have leftList := congrArg (Functor.map Array.toList) leftEval
+  have rightList := congrArg (Functor.map Array.toList) rightEval
+  change (Functor.map Array.toList) (left.mapM (RowExpr.eval values)) = _ at leftList
+  change (Functor.map Array.toList) (right.mapM (RowExpr.eval values)) = _ at rightList
+  rw [Array.toList_mapM] at leftList rightList
+  simp only [Functor.map, Option.map_some] at leftList rightList
+  simp only [evalRows, Array.mapM_eq_mapM_toList, Array.toList_append,
+    List.mapM_append, leftList, rightList, bind, Option.bind_some, pure,
+    Functor.map, Option.map_some]
+  congr 1
+  apply Array.toList_inj.mp
+  simp only [Array.toList_append]
+
+theorem Normal.append {left right : Array RowExpr} (a : Normal left) (b : Normal right) :
+    Normal (left ++ right) := by
+  intro row member
+  rcases Array.mem_append.mp member with member | member
+  · exact a row member
+  · exact b row member
+
+theorem Emission.eval_components {values : Values G} {emission : Emission} {result : AIR.OpEmission}
+    (evaluated : emission.eval values = some result) :
+    evalRows values emission.outputs = some result.outputs ∧ emission.used = result.used ∧
+    emission.equations.mapM (evalExpr values) = some result.equations ∧
+    emission.queries.mapM (List.mapM (evalExpr values)) = some result.queries ∧
+    emission.calls.mapM (CallExpr.eval values) = some result.calls := by
+  simp only [Emission.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i outputs outputsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i equations equationsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i queries queriesEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i calls callsEval
+  cases evaluated
+  exact ⟨outputsEval, rfl, equationsEval, queriesEval, callsEval⟩
+
+structure OpsEmission where
+  values : Array RowExpr
+  column : Nat
+  equations : List Expr := []
+  queries : List (List Expr) := []
+  calls : List CallExpr := []
+
+def OpsEmission.eval (values : Values G) (emission : OpsEmission) : Option AIR.OpsEmission := do
+  let outputs ← evalRows values emission.values
+  let equations ← emission.equations.mapM (evalExpr values)
+  let queries ← emission.queries.mapM (List.mapM (evalExpr values))
+  let calls ← emission.calls.mapM (CallExpr.eval values)
+  return ⟨outputs, emission.column, equations, queries, calls⟩
+
+theorem OpsEmission.eval_of {values : Values G} {emission : OpsEmission} {result : AIR.OpsEmission}
+    (outputs : evalRows values emission.values = some result.values)
+    (column : emission.column = result.column)
+    (equations : emission.equations.mapM (evalExpr values) = some result.equations)
+    (queries : emission.queries.mapM (List.mapM (evalExpr values)) = some result.queries)
+    (calls : emission.calls.mapM (CallExpr.eval values) = some result.calls) :
+    emission.eval values = some result := by
+  simp only [OpsEmission.eval, outputs, equations, queries, calls, column, bind, Option.bind_some, pure]
+
+theorem OpsEmission.eval_components {values : Values G} {emission : OpsEmission} {result : AIR.OpsEmission}
+    (evaluated : emission.eval values = some result) :
+    evalRows values emission.values = some result.values ∧ emission.column = result.column ∧
+    emission.equations.mapM (evalExpr values) = some result.equations ∧
+    emission.queries.mapM (List.mapM (evalExpr values)) = some result.queries ∧
+    emission.calls.mapM (CallExpr.eval values) = some result.calls := by
+  simp only [OpsEmission.eval, bind, Option.bind] at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i outputs outputsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i equations equationsEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i queries queriesEval
+  dsimp only at evaluated
+  split at evaluated
+  · cases evaluated
+  rename_i calls callsEval
+  cases evaluated
+  exact ⟨outputsEval, rfl, equationsEval, queriesEval, callsEval⟩
+
+def emitOps (selector rank : Expr) : List Bytecode.Op → Array RowExpr → Nat → Option OpsEmission
+  | [], rows, column => some { values := rows, column }
+  | op :: ops, rows, column => do
+    let first ← emitOp selector rank column op rows
+    let rest ← emitOps selector rank ops (rows ++ first.outputs) (column + first.used)
+    return { rest with
+      equations := first.equations ++ rest.equations
+      queries := first.queries ++ rest.queries
+      calls := first.calls ++ rest.calls }
+
+theorem emitOps_column {selector rank : Expr} {ops : List Bytecode.Op} {rows : Array RowExpr}
+    {column : Nat} {emission : OpsEmission}
+    (emitted : emitOps selector rank ops rows column = some emission) : column ≤ emission.column := by
+  induction ops generalizing rows column emission with
+  | nil =>
+    cases emitted
+    exact Nat.le_refl _
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    exact Nat.le_trans (Nat.le_add_right _ _) (ih (emission := rest) restEmitted)
+
+theorem emitOps_normal {selector rank : Expr} {ops : List Bytecode.Op} {rows : Array RowExpr}
+    {column : Nat} {emission : OpsEmission} (normal : Normal rows)
+    (emitted : emitOps selector rank ops rows column = some emission) : Normal emission.values := by
+  induction ops generalizing rows column emission with
+  | nil =>
+    cases emitted
+    exact normal
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i first firstEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    exact ih (emission := rest) (normal.append (emitOp_normal normal firstEmitted)) restEmitted
+
+theorem emitOps_reflects (values : Values G) (row : Nat → G)
+    {selector rank : Expr} {s r : G} {ops : List Bytecode.Op} {rows : Array RowExpr}
+    {inputs : Array AIR.RowValue} {column : Nat} {emission : OpsEmission}
+    (selectorEval : evalExpr values selector = some s) (rankEval : evalExpr values rank = some r)
+    (inputEval : evalRows values rows = some inputs) (normal : Normal rows)
+    (emitted : emitOps selector rank ops rows column = some emission)
+    (reads : ∀ index, column ≤ index → index < emission.column →
+      (values.columns .main .current)[index]? = some (row index)) :
+    ∃ result, AIR.emitOps row s r ops inputs column = some result ∧ emission.eval values = some result := by
+  induction ops generalizing rows inputs column emission with
+  | nil =>
+    cases emitted
+    exact ⟨_, rfl, OpsEmission.eval_of inputEval rfl rfl rfl rfl⟩
+  | cons op ops ih =>
+    simp only [emitOps, bind, Option.bind] at emitted
+    split at emitted
+    · cases emitted
+    rename_i first firstEmitted
+    dsimp only at emitted
+    split at emitted
+    · cases emitted
+    rename_i rest restEmitted
+    cases emitted
+    have bound := emitOps_column restEmitted
+    obtain ⟨firstValue, firstValueEmitted, firstEval⟩ := emitOp_reflects values
+      (fun index => row (column + index)) selectorEval rankEval inputEval normal firstEmitted
+      (fun index indexBound => reads (column + index) (by omega) (by dsimp only; omega))
+    obtain ⟨firstOutputs, used, firstEquations, firstQueries, firstCalls⟩ :=
+      Emission.eval_components firstEval
+    obtain ⟨restValue, restValueEmitted, restEval⟩ := ih (evalRows_append inputEval firstOutputs)
+      (normal.append (emitOp_normal normal firstEmitted)) restEmitted
+      (fun index lower upper => reads index (by omega) upper)
+    obtain ⟨restOutputs, finish, restEquations, restQueries, restCalls⟩ :=
+      OpsEmission.eval_components restEval
+    refine ⟨{ restValue with
+      equations := firstValue.equations ++ restValue.equations
+      queries := firstValue.queries ++ restValue.queries
+      calls := firstValue.calls ++ restValue.calls }, ?_, ?_⟩
+    · simp only [AIR.emitOps, firstValueEmitted, bind, Option.bind_some, ← used,
+        restValueEmitted, pure]
+    · apply OpsEmission.eval_of
+      · exact restOutputs
+      · exact finish
+      all_goals
+        simp only [List.mapM_append, firstEquations, restEquations, firstQueries,
+          restQueries, firstCalls, restCalls, bind, Option.bind_some, pure]
+
+end Aiur.NativeAIR.OpEmitter
diff --git a/Ix/Aiur/Proofs/Polynomial.lean b/Ix/Aiur/Proofs/Polynomial.lean
new file mode 100644
index 000000000..1e9c7840f
--- /dev/null
+++ b/Ix/Aiur/Proofs/Polynomial.lean
@@ -0,0 +1,463 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Polynomial
+import Ix.Aiur.Proofs.QuotientAlgebra
+import Ix.Aiur.Proofs.FriDomain
+
+/-! Coefficient identities and the distinct-root bound used by native
+polynomial checks. Ring identities are separate from the no-zero-divisor
+condition, which is proved for both native fields below.
+-/
+
+namespace Aiur.NativeAIR.Polynomial
+
+open Lean.Grind
+open _root_.Aiur.NativeAIR.Quotient (horner horner_nil horner_cons)
+
+section Ring
+
+variable {R : Type} [CommRing R]
+
+theorem isZero_nil : IsZero ([] : List R) := by intro coefficient member; cases member
+
+theorem isZero_iff_all [BEq R] [LawfulBEq R] (coefficients : List R) :
+    IsZero coefficients ↔ coefficients.all (· == 0) = true := by
+  simp only [IsZero, List.all_eq_true, beq_iff_eq]
+
+theorem isZero_cons (coefficient : R) (rest : List R) :
+    IsZero (coefficient :: rest) ↔ coefficient = 0 ∧ IsZero rest := by
+  simp only [IsZero, List.mem_cons, forall_eq_or_imp]
+
+theorem isZero_append (left right : List R) : IsZero (left ++ right) ↔ IsZero left ∧ IsZero right := by
+  constructor
+  · intro zero
+    exact ⟨fun value member => zero value (List.mem_append_left _ member),
+      fun value member => zero value (List.mem_append_right _ member)⟩
+  · rintro ⟨leftZero, rightZero⟩ value member
+    exact (List.mem_append.mp member).elim (leftZero value) (rightZero value)
+
+theorem monic_nonzero {coefficients : List R} (monic : Monic coefficients)
+    (nontrivial : (1 : R) ≠ 0) : ¬ IsZero coefficients := by
+  obtain ⟨initial, rfl⟩ := monic
+  intro zero
+  exact nontrivial (zero 1 (by simp))
+
+theorem sub_nil (left : List R) : sub left [] = left := by cases left <;> rfl
+
+theorem horner_zero (point : R) {coefficients : List R} (zero : IsZero coefficients) :
+    horner point coefficients = 0 := by
+  induction coefficients with
+  | nil => rfl
+  | cons coefficient rest ih =>
+    obtain ⟨first, tail⟩ := (isZero_cons _ _).mp zero
+    rw [horner_cons, first, ih tail, Semiring.mul_zero, Semiring.add_zero]
+
+theorem add_length (left right : List R) : (add left right).length = max left.length right.length := by
+  induction left generalizing right with
+  | nil => simp only [add, List.length_nil, Nat.zero_max]
+  | cons first left ih =>
+    cases right with
+    | nil => simp only [add, List.length_nil, Nat.max_zero]
+    | cons second right => simp only [add, List.length_cons, ih, Nat.succ_max_succ]
+
+theorem sub_length (left right : List R) : (sub left right).length = max left.length right.length := by
+  induction left generalizing right with
+  | nil => simp only [sub, List.length_map, List.length_nil, Nat.zero_max]
+  | cons first left ih =>
+    cases right with
+    | nil => simp only [sub, List.length_nil, Nat.max_zero]
+    | cons second right => simp only [sub, List.length_cons, ih, Nat.succ_max_succ]
+
+theorem scale_length (scalar : R) (coefficients : List R) :
+    (scale scalar coefficients).length = coefficients.length := List.length_map _
+
+theorem sub_append (left right firstTail secondTail : List R) (same : left.length = right.length) :
+    sub (left ++ firstTail) (right ++ secondTail) = sub left right ++ sub firstTail secondTail := by
+  induction left generalizing right with
+  | nil =>
+    have empty : right = [] := by simpa using same.symm
+    subst right
+    rfl
+  | cons first left ih =>
+    cases right with
+    | nil => simp only [List.length_nil, List.length_cons] at same; omega
+    | cons second right =>
+      have tailSame : left.length = right.length := by simpa only [List.length_cons, Nat.succ.injEq] using same
+      simp only [List.cons_append, sub, ih right tailSame]
+
+theorem sub_append_left (left right tail : List R) (bounded : right.length ≤ left.length) :
+    sub (left ++ tail) right = sub left right ++ tail := by
+  induction left generalizing right with
+  | nil =>
+    have empty : right = [] := by simpa using bounded
+    subst right
+    simp only [List.nil_append, sub_nil]
+  | cons first left ih =>
+    cases right with
+    | nil => simp only [sub_nil]
+    | cons second right =>
+      have tailBound : right.length ≤ left.length := by simp only [List.length_cons] at bounded; omega
+      simp only [List.cons_append, sub, ih right tailBound]
+
+theorem horner_add (point : R) (left right : List R) :
+    horner point (add left right) = horner point left + horner point right := by
+  induction left generalizing right with
+  | nil => rw [add, horner_nil]; grind
+  | cons first left ih =>
+    cases right with
+    | nil => change horner point (first :: left) = horner point (first :: left) + 0; grind
+    | cons second right => rw [add, horner_cons, ih, horner_cons, horner_cons]; grind
+
+theorem horner_neg (point : R) (coefficients : List R) :
+    horner point (coefficients.map (0 - ·)) = 0 - horner point coefficients := by
+  induction coefficients with
+  | nil => simp only [List.map_nil, horner_nil]; grind
+  | cons first rest ih => rw [List.map_cons, horner_cons, ih, horner_cons]; grind
+
+theorem horner_sub (point : R) (left right : List R) :
+    horner point (sub left right) = horner point left - horner point right := by
+  induction left generalizing right with
+  | nil => rw [sub, horner_neg, horner_nil]
+  | cons first left ih =>
+    cases right with
+    | nil => change horner point (first :: left) = horner point (first :: left) - 0; grind
+    | cons second right => rw [sub, horner_cons, ih, horner_cons, horner_cons]; grind
+
+theorem horner_scale (point scalar : R) (coefficients : List R) :
+    horner point (scale scalar coefficients) = scalar * horner point coefficients := by
+  induction coefficients with
+  | nil => change 0 = scalar * 0; grind
+  | cons first rest ih =>
+    change scalar * first + point * horner point (scale scalar rest) = scalar * (first + point * horner point rest)
+    rw [ih]
+    grind
+
+theorem mulLinear_length (root : R) (coefficients : List R) :
+    (mulLinear root coefficients).length = coefficients.length + 1 := by
+  rw [mulLinear, sub_length, scale_length, List.length_cons, Nat.max_eq_left (by omega)]
+
+theorem horner_mulLinear (point root : R) (coefficients : List R) :
+    horner point (mulLinear root coefficients) = (point - root) * horner point coefficients := by
+  rw [mulLinear, horner_sub, horner_cons, horner_scale]
+  grind
+
+theorem fromRoots_length (roots : List R) : (fromRoots roots).length = roots.length + 1 := by
+  induction roots with
+  | nil => rfl
+  | cons root roots ih =>
+    change (mulLinear root (fromRoots roots)).length = (root :: roots).length + 1
+    rw [mulLinear_length, ih, List.length_cons]
+
+theorem horner_fromRoots (point : R) (roots : List R) :
+    horner point (fromRoots roots) = LogUp.product (roots.map (point - ·)) := by
+  induction roots with
+  | nil => change 1 + point * 0 = 1; grind
+  | cons root roots ih =>
+    change horner point (mulLinear root (fromRoots roots)) = _
+    rw [horner_mulLinear, ih, List.map_cons, LogUp.product_cons]
+
+theorem mulLinear_monic (root : R) {coefficients : List R} (monic : Monic coefficients) :
+    Monic (mulLinear root coefficients) := by
+  obtain ⟨initial, rfl⟩ := monic
+  refine ⟨sub (0 :: initial) (scale root (initial ++ [1])), ?_⟩
+  rw [mulLinear, ← List.cons_append, sub_append_left]
+  simp only [scale_length, List.length_append, List.length_cons, List.length_nil]
+  omega
+
+theorem fromRoots_monic (roots : List R) : Monic (fromRoots roots) := by
+  induction roots with
+  | nil => exact ⟨[], rfl⟩
+  | cons root roots ih => exact mulLinear_monic root ih
+
+theorem fromRoots_nonzero (roots : List R) (nontrivial : (1 : R) ≠ 0) : ¬ IsZero (fromRoots roots) :=
+  monic_nonzero (fromRoots_monic roots) nontrivial
+
+theorem fromRoots_vanishes (roots : List R) (point : R) (member : point ∈ roots) :
+    horner point (fromRoots roots) = 0 := by
+  induction roots with
+  | nil => cases member
+  | cons root roots ih =>
+    change horner point (mulLinear root (fromRoots roots)) = 0
+    rw [horner_mulLinear]
+    rcases List.mem_cons.mp member with same | later
+    · rw [same]; grind
+    · rw [ih later, Semiring.mul_zero]
+
+theorem powerMinus_length (degree : Nat) (constant : R) :
+    (powerMinus degree constant).length = degree + 1 := by
+  rw [powerMinus, sub_length]
+  simp only [List.length_append, List.length_replicate, List.length_cons, List.length_nil]
+  omega
+
+theorem powerMinus_monic {degree : Nat} (positive : 0 < degree) (constant : R) :
+    Monic (powerMinus degree constant) := by
+  refine ⟨sub (List.replicate degree 0) [constant], ?_⟩
+  rw [powerMinus, sub_append_left]
+  simp only [List.length_cons, List.length_nil, List.length_replicate]
+  omega
+
+theorem horner_replicate_zero (point : R) (count : Nat) : horner point (List.replicate count 0) = 0 :=
+  horner_zero point (by intro value member; exact List.mem_replicate.mp member |>.2)
+
+theorem horner_powerMinus (point constant : R) (degree : Nat) :
+    horner point (powerMinus degree constant) = point ^ degree - constant := by
+  rw [powerMinus, horner_sub, Quotient.horner_append, horner_replicate_zero, List.length_replicate]
+  simp only [horner_cons, horner_nil]
+  grind
+
+theorem divide_length (point : R) (coefficients : List R) :
+    (divide point coefficients).length = coefficients.length - 1 := by
+  induction coefficients using divide.induct with
+  | case1 => rfl
+  | case2 first => rfl
+  | case3 first next rest ih =>
+    simp only [divide, List.length_cons, ih]
+    omega
+
+theorem divide_factor (point root : R) (coefficients : List R) :
+    horner point coefficients = horner root coefficients + (point - root) * horner point (divide root coefficients) := by
+  induction coefficients using divide.induct with
+  | case1 => simp only [divide, horner_nil]; grind
+  | case2 first => simp only [divide, horner_cons, horner_nil]; grind
+  | case3 first next rest ih =>
+    change first + point * horner point (next :: rest) =
+      first + root * horner root (next :: rest) + (point - root) *
+        (horner root (next :: rest) + point * horner point (divide root (next :: rest)))
+    grind
+
+theorem zero_of_divide_zero (root : R) (coefficients : List R)
+    (vanishes : horner root coefficients = 0) (zero : IsZero (divide root coefficients)) : IsZero coefficients := by
+  induction coefficients using divide.induct with
+  | case1 => exact isZero_nil
+  | case2 first =>
+    apply (isZero_cons _ _).mpr
+    constructor
+    · simpa only [horner_cons, horner_nil, Semiring.mul_zero, Semiring.add_zero] using vanishes
+    · exact isZero_nil
+  | case3 first next rest ih =>
+    obtain ⟨nextZero, tailZero⟩ := (isZero_cons _ _).mp zero
+    have tail := ih nextZero tailZero
+    apply (isZero_cons _ _).mpr
+    constructor
+    · simpa only [horner_cons, nextZero, Semiring.mul_zero, Semiring.add_zero] using vanishes
+    · exact tail
+
+theorem divide_nonzero (root : R) {coefficients : List R}
+    (nonzero : ¬ IsZero coefficients) (vanishes : horner root coefficients = 0) :
+    ¬ IsZero (divide root coefficients) := fun zero => nonzero (zero_of_divide_zero root coefficients vanishes zero)
+
+end Ring
+
+section Domain
+
+variable {R : Type} [CommRing R]
+variable (noZeroDivisors : ∀ a b : R, a * b = 0 → a = 0 ∨ b = 0)
+include noZeroDivisors
+
+theorem divide_root (root point : R) (coefficients : List R)
+    (atRoot : horner root coefficients = 0) (atPoint : horner point coefficients = 0)
+    (different : point ≠ root) : horner point (divide root coefficients) = 0 := by
+  have factor := divide_factor point root coefficients
+  rw [atRoot, atPoint] at factor
+  have productZero : (point - root) * horner point (divide root coefficients) = 0 := by grind
+  exact (noZeroDivisors _ _ productZero).resolve_left
+    (fun zero => different ((LogUp.sub_zero_iff _ _).mp zero))
+
+theorem roots_lt_length (coefficients roots : List R) (nonzero : ¬ IsZero coefficients)
+    (unique : roots.Nodup) (vanishes : ∀ point ∈ roots, horner point coefficients = 0) :
+    roots.length < coefficients.length := by
+  suffices bounded : ∀ fuel (coefficients roots : List R), coefficients.length ≤ fuel →
+      ¬ IsZero coefficients → roots.Nodup →
+      (∀ point ∈ roots, horner point coefficients = 0) → roots.length < coefficients.length from
+    bounded coefficients.length coefficients roots (by omega) nonzero unique vanishes
+  intro fuel
+  induction fuel with
+  | zero =>
+    intro coefficients roots lengthBound nonzero unique vanishes
+    cases coefficients with
+    | nil => exact False.elim (nonzero isZero_nil)
+    | cons first rest => simp only [List.length_cons] at lengthBound; omega
+  | succ fuel ih =>
+    intro coefficients roots lengthBound nonzero unique vanishes
+    cases roots with
+    | nil =>
+      cases coefficients with
+      | nil => exact False.elim (nonzero isZero_nil)
+      | cons first rest => exact Nat.zero_lt_succ _
+    | cons root roots =>
+      obtain ⟨absent, tailUnique⟩ := List.nodup_cons.mp unique
+      have atRoot := vanishes root (by simp)
+      have quotientNonzero := divide_nonzero root nonzero atRoot
+      have quotientBound : (divide root coefficients).length ≤ fuel := by rw [divide_length]; omega
+      have tailZero : ∀ point ∈ roots, horner point (divide root coefficients) = 0 := by
+        intro point member
+        apply divide_root noZeroDivisors root point coefficients atRoot (vanishes point (by simp [member]))
+        intro equal
+        exact absent (equal ▸ member)
+      have shorter := ih (divide root coefficients) roots quotientBound quotientNonzero tailUnique tailZero
+      rw [divide_length] at shorter
+      simp only [List.length_cons]
+      omega
+
+theorem roots_le_degree (coefficients roots : List R) (nonzero : ¬ IsZero coefficients)
+    (unique : roots.Nodup) (vanishes : ∀ point ∈ roots, horner point coefficients = 0) :
+    roots.length ≤ coefficients.length - 1 := by
+  have := roots_lt_length noZeroDivisors coefficients roots nonzero unique vanishes
+  omega
+
+theorem zero_of_roots (coefficients roots : List R) (unique : roots.Nodup)
+    (enough : coefficients.length ≤ roots.length)
+    (vanishes : ∀ point ∈ roots, horner point coefficients = 0) : IsZero coefficients := by
+  apply Classical.byContradiction
+  intro nonzero
+  have := roots_lt_length noZeroDivisors coefficients roots nonzero unique vanishes
+  omega
+
+theorem zero_sub_of_samples (left right samples : List R) (unique : samples.Nodup)
+    (leftBound : left.length ≤ samples.length) (rightBound : right.length ≤ samples.length)
+    (equal : ∀ point ∈ samples, horner point left = horner point right) : IsZero (sub left right) := by
+  apply zero_of_roots noZeroDivisors (sub left right) samples unique
+  · rw [sub_length]
+    exact Nat.max_le.mpr ⟨leftBound, rightBound⟩
+  · intro point member
+    rw [horner_sub, equal point member]
+    grind
+
+theorem equal_of_samples (left right samples : List R) (unique : samples.Nodup)
+    (leftBound : left.length ≤ samples.length) (rightBound : right.length ≤ samples.length)
+    (equal : ∀ point ∈ samples, horner point left = horner point right) (point : R) :
+    horner point left = horner point right := by
+  have zero := horner_zero point (zero_sub_of_samples noZeroDivisors left right samples unique leftBound rightBound equal)
+  rw [horner_sub] at zero
+  exact (LogUp.sub_zero_iff _ _).mp zero
+
+theorem monic_zero_sub_of_samples (left right samples : List R)
+    (leftMonic : Monic left) (rightMonic : Monic right) (unique : samples.Nodup)
+    (sameLength : left.length = right.length) (enough : left.length ≤ samples.length + 1)
+    (equal : ∀ point ∈ samples, horner point left = horner point right) : IsZero (sub left right) := by
+  obtain ⟨leftPrefix, rfl⟩ := leftMonic
+  obtain ⟨rightPrefix, rfl⟩ := rightMonic
+  have same : leftPrefix.length = rightPrefix.length := by
+    simp only [List.length_append, List.length_cons, List.length_nil] at sameLength
+    omega
+  have tail : sub ([1] : List R) [1] = [0] := by simp only [sub]; congr 1; grind
+  rw [sub_append _ _ _ _ same, tail, isZero_append]
+  refine ⟨?_, (isZero_cons _ _).mpr ⟨rfl, isZero_nil⟩⟩
+  apply zero_of_roots noZeroDivisors (sub leftPrefix rightPrefix) samples unique
+  · rw [sub_length, same, Nat.max_self]
+    simp only [List.length_append, List.length_cons, List.length_nil] at enough
+    omega
+  · intro point member
+    have atPoint := equal point member
+    simp only [Quotient.horner_append, horner_cons, horner_nil, same] at atPoint
+    rw [horner_sub]
+    grind
+
+theorem monic_equal_of_samples (left right samples : List R)
+    (leftMonic : Monic left) (rightMonic : Monic right) (unique : samples.Nodup)
+    (sameLength : left.length = right.length) (enough : left.length ≤ samples.length + 1)
+    (equal : ∀ point ∈ samples, horner point left = horner point right) (point : R) :
+    horner point left = horner point right := by
+  have zero := horner_zero point
+    (monic_zero_sub_of_samples noZeroDivisors left right samples leftMonic rightMonic unique sameLength enough equal)
+  rw [horner_sub] at zero
+  exact (LogUp.sub_zero_iff _ _).mp zero
+
+theorem root_product_identity (roots : List R) (constant : R) (unique : roots.Nodup)
+    (positive : 0 < roots.length) (powers : ∀ root ∈ roots, root ^ roots.length = constant) (point : R) :
+    LogUp.product (roots.map (point - ·)) = point ^ roots.length - constant := by
+  rw [← horner_fromRoots, ← horner_powerMinus]
+  apply monic_equal_of_samples noZeroDivisors (fromRoots roots) (powerMinus roots.length constant) roots
+    (fromRoots_monic roots) (powerMinus_monic positive constant) unique
+  · rw [fromRoots_length, powerMinus_length]
+  · rw [fromRoots_length]
+    omega
+  · intro root member
+    rw [fromRoots_vanishes roots root member, horner_powerMinus, powers root member]
+    grind
+
+theorem root_count_le [BEq R] [LawfulBEq R] (coefficients samples : List R)
+    (nonzero : ¬ IsZero coefficients) (unique : samples.Nodup) :
+    (samples.filter (fun point => horner point coefficients == 0)).length ≤ coefficients.length - 1 := by
+  apply roots_le_degree noZeroDivisors coefficients _ nonzero (unique.filter _)
+  intro point member
+  exact beq_iff_eq.mp (List.mem_filter.mp member).2
+
+theorem equal_count_le [BEq R] [LawfulBEq R] (left right samples : List R)
+    (different : ¬ IsZero (sub left right)) (unique : samples.Nodup) :
+    (samples.filter (fun point => horner point left == horner point right)).length ≤
+      max left.length right.length - 1 := by
+  rw [← sub_length]
+  apply roots_le_degree noZeroDivisors (sub left right) _ different (unique.filter _)
+  intro point member
+  rw [horner_sub, beq_iff_eq.mp (List.mem_filter.mp member).2]
+  grind
+
+end Domain
+
+theorem base_roots_lt_length (coefficients roots : List G) (nonzero : ¬ IsZero coefficients)
+    (unique : roots.Nodup) (vanishes : ∀ point ∈ roots, horner point coefficients = 0) :
+    roots.length < coefficients.length :=
+  roots_lt_length (fun a b => (G.mul_eq_zero_iff a b).mp) coefficients roots nonzero unique vanishes
+
+theorem extension_roots_lt_length (coefficients roots : List ProofCodec.Extension)
+    (nonzero : ¬ IsZero coefficients) (unique : roots.Nodup)
+    (vanishes : ∀ point ∈ roots, horner point coefficients = 0) : roots.length < coefficients.length :=
+  roots_lt_length (fun a b => (ProofCodec.Extension.mul_eq_zero_iff a b).mp) coefficients roots nonzero unique vanishes
+
+theorem base_root_count_le (coefficients samples : List G)
+    (nonzero : ¬ IsZero coefficients) (unique : samples.Nodup) :
+    (samples.filter (fun point => horner point coefficients == 0)).length ≤ coefficients.length - 1 :=
+  root_count_le (fun a b => (G.mul_eq_zero_iff a b).mp) coefficients samples nonzero unique
+
+theorem extension_root_count_le (coefficients samples : List ProofCodec.Extension)
+    (nonzero : ¬ IsZero coefficients) (unique : samples.Nodup) :
+    (samples.filter (fun point => horner point coefficients == 0)).length ≤ coefficients.length - 1 :=
+  root_count_le (fun a b => (ProofCodec.Extension.mul_eq_zero_iff a b).mp) coefficients samples nonzero unique
+
+theorem foldingNodes_length (parent arity : Domain.Subgroup) (index : Nat) :
+    (foldingNodes parent arity index).length = Domain.size arity := by
+  simp only [foldingNodes, List.length_map, List.length_range]
+
+theorem foldingNodes_nodup (parent arity : Domain.Subgroup) (nested : arity.val ≤ parent.val)
+    {index : Nat} (bounded : index < 2^(parent.val - arity.val)) :
+    (foldingNodes parent arity index).Nodup := by
+  unfold foldingNodes
+  rw [List.nodup_iff_pairwise_ne, List.pairwise_map]
+  apply List.Pairwise.imp_of_mem (R := fun left right : Nat => left ≠ right) _ List.nodup_range
+  intro left right leftMem rightMem different equal
+  exact different (FriDomain.foldNode_injective parent arity nested bounded
+    (List.mem_range.mp leftMem) (List.mem_range.mp rightMem) equal)
+
+theorem foldingNodes_powers (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) (index : Nat) :
+    ∀ node ∈ foldingNodes parent arity index, node ^ Domain.size arity = FriDomain.queryPoint child index := by
+  intro node member
+  obtain ⟨slot, _, rfl⟩ := List.mem_map.mp member
+  exact FriDomain.foldNode_power parent child arity dimensions index slot
+
+theorem folding_product_identity (parent child arity : Domain.Subgroup)
+    (dimensions : parent.val = child.val + arity.val) {index : Nat}
+    (bounded : index < 2^(parent.val - arity.val)) (point : ProofCodec.Extension) :
+    LogUp.product ((foldingNodes parent arity index).map (fun node => point - ProofCodec.Extension.ofBase node)) =
+      point ^ Domain.size arity - ProofCodec.Extension.ofBase (FriDomain.queryPoint child index) := by
+  let roots := (foldingNodes parent arity index).map ProofCodec.Extension.ofBase
+  have length : roots.length = Domain.size arity := by simp only [roots, List.length_map, foldingNodes_length]
+  have unique : roots.Nodup := by
+    rw [show roots = (foldingNodes parent arity index).map ProofCodec.Extension.ofBase from rfl,
+      List.nodup_iff_pairwise_ne, List.pairwise_map]
+    exact (foldingNodes_nodup parent arity (by omega) bounded).imp
+      (fun different equal => different (ProofCodec.Extension.ofBase_injective equal))
+  have powers : ∀ root ∈ roots, root ^ roots.length = ProofCodec.Extension.ofBase (FriDomain.queryPoint child index) := by
+    intro root member
+    change root ∈ (foldingNodes parent arity index).map ProofCodec.Extension.ofBase at member
+    obtain ⟨node, nodeMember, rfl⟩ := List.mem_map.mp member
+    rw [length, ← ProofCodec.Extension.ofBase_power, foldingNodes_powers parent child arity dimensions index node nodeMember]
+  have result := root_product_identity (fun a b => (ProofCodec.Extension.mul_eq_zero_iff a b).mp)
+    roots _ unique (by rw [length]; exact Domain.size_positive arity) powers point
+  simpa only [roots, List.map_map, Function.comp_def, length] using result
+
+end Aiur.NativeAIR.Polynomial
diff --git a/Ix/Aiur/Proofs/ProofCodec.lean b/Ix/Aiur/Proofs/ProofCodec.lean
new file mode 100644
index 000000000..8924e342e
--- /dev/null
+++ b/Ix/Aiur/Proofs/ProofCodec.lean
@@ -0,0 +1,315 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofCodec
+import Ix.Aiur.Proofs.KeyCodec
+
+/-! Complete proof framing and injective canonical serialization. Bounds
+below concern the u64 wire lengths and 32-byte digest arrays, not security. -/
+
+namespace Aiur.NativeAIR.ProofCodec
+
+open KeyCodec (Reader Reads Returns readByte readMany readNat_reads readMany_reads readByte_reads)
+
+def VectorFits (property : α → Prop) (values : List α) : Prop :=
+  values.length < 256^8 ∧ ∀ value ∈ values, property value
+
+def CapFits (cap : Cap) : Prop := VectorFits (fun digest => digest.length = 32) cap
+
+def OpeningsFits (values : Openings α) : Prop :=
+  VectorFits (VectorFits (VectorFits (fun _ => True))) values
+
+theorem readVector_reads {read : Reader α} (encode : α → List UInt8) (values : List α)
+    (bounded : values.length < 256^8)
+    (elements : ∀ value ∈ values, Reads read (encode value) value) :
+    Reads (readVector read) (encodeVector encode values) values :=
+  (readNat_reads 8 values.length bounded).bind (readMany_reads encode values elements)
+
+theorem readOption_reads {read : Reader α} (encode : α → List UInt8) (value : Option α)
+    (element : ∀ entry, value = some entry → Reads read (encode entry) entry) :
+    Reads (readOption read) (encodeOption encode value) value := by
+  cases value with
+  | none => intro rest; rfl
+  | some value =>
+    unfold readOption encodeOption
+    exact Reads.byte ((element value rfl).result some)
+
+theorem readBool_reads (value : Bool) : Reads readBool (encodeBool value) value := by
+  cases value <;> intro rest <;> rfl
+
+theorem readField_reads (value : G) : Reads readField (encodeField value) value := by
+  unfold readField encodeField
+  apply Reads.bind (readNat_reads 8 value.n (UInt64.toNat_lt value.val))
+  rw [if_pos (UInt64.lt_iff_toNat_lt.mp value.property), G.ofNat_n]
+  exact Reads.pure value
+
+theorem readExtension_reads (value : Extension) :
+    Reads readExtension (encodeExtension value) value :=
+  (readField_reads value.c0).bind ((readField_reads value.c1).result (Extension.mk value.c0))
+
+theorem readCap_reads (cap : Cap) (fits : CapFits cap) : Reads readCap (encodeCap cap) cap := by
+  apply readVector_reads id cap fits.1
+  intro digest member
+  rw [← fits.2 digest member]
+  simpa using readMany_reads (fun byte => [byte]) digest
+    (fun byte _ => readByte_reads byte)
+
+theorem readOpenings_reads {read : Reader α} (encode : α → List UInt8)
+    (element : ∀ value, Reads read (encode value) value)
+    (values : Openings α) (fits : OpeningsFits values) :
+    Reads (readOpenings read) (encodeOpenings encode values) values := by
+  apply readVector_reads _ _ fits.1
+  intro matrix member
+  apply readVector_reads _ _ (fits.2 matrix member).1
+  intro row rowMember
+  exact readVector_reads _ _ ((fits.2 matrix member).2 row rowMember).1 (fun value _ => element value)
+
+structure CommitmentsFits (value : Commitments) : Prop where
+  stage1 : CapFits value.stage1
+  stage2 : CapFits value.stage2
+  quotient : CapFits value.quotient
+
+theorem readCommitments_reads (value : Commitments) (fits : CommitmentsFits value) :
+    Reads readCommitments (encodeCommitments value) value := by
+  unfold readCommitments encodeCommitments
+  rw [List.append_assoc]
+  apply Reads.bind (readCap_reads value.stage1 fits.stage1)
+  exact (readCap_reads value.stage2 fits.stage2).bind
+    ((readCap_reads value.quotient fits.quotient).result (Commitments.mk value.stage1 value.stage2))
+
+structure BatchOpeningFits (value : BatchOpening) : Prop where
+  values : OpeningsFits value.values
+  siblingHashes : CapFits value.siblingHashes
+
+theorem readBatchOpening_reads (value : BatchOpening) (fits : BatchOpeningFits value) :
+    Reads readBatchOpening (encodeBatchOpening value) value :=
+  (readOpenings_reads encodeField readField_reads value.values fits.values).bind
+    ((readCap_reads value.siblingHashes fits.siblingHashes).result (BatchOpening.mk value.values))
+
+structure CommitStepFits (value : CommitStep) : Prop where
+  siblingValues : VectorFits (VectorFits (fun _ => True)) value.siblingValues
+  siblingHashes : CapFits value.siblingHashes
+
+theorem readCommitStep_reads (value : CommitStep) (fits : CommitStepFits value) :
+    Reads readCommitStep (encodeCommitStep value) value := by
+  unfold readCommitStep encodeCommitStep
+  apply Reads.byte
+  apply Reads.bind (readVector_reads _ _ fits.siblingValues.1 (fun row member =>
+    readVector_reads _ _ (fits.siblingValues.2 row member).1 (fun item _ => readExtension_reads item)))
+  exact (readCap_reads value.siblingHashes fits.siblingHashes).result (CommitStep.mk value.logArity value.siblingValues)
+
+structure FriFits (value : Fri) : Prop where
+  commits : VectorFits CapFits value.commits
+  commitPowWitnesses : value.commitPowWitnesses.length < 256^8
+  inputOpenings : VectorFits BatchOpeningFits value.inputOpenings
+  commitOpenings : VectorFits CommitStepFits value.commitOpenings
+  finalPoly : value.finalPoly.length < 256^8
+
+theorem readFri_reads (value : Fri) (fits : FriFits value) :
+    Reads readFri (encodeFri value) value := by
+  unfold readFri encodeFri
+  simp only [List.append_assoc]
+  apply Reads.bind (readVector_reads _ _ fits.commits.1
+    (fun cap member => readCap_reads cap (fits.commits.2 cap member)))
+  apply Reads.bind (readVector_reads _ _ fits.commitPowWitnesses (fun item _ => readField_reads item))
+  apply Reads.bind (readVector_reads _ _ fits.inputOpenings.1
+    (fun opening member => readBatchOpening_reads opening (fits.inputOpenings.2 opening member)))
+  apply Reads.bind (readVector_reads _ _ fits.commitOpenings.1
+    (fun opening member => readCommitStep_reads opening (fits.commitOpenings.2 opening member)))
+  apply Reads.bind (readVector_reads _ _ fits.finalPoly (fun item _ => readExtension_reads item))
+  exact (readField_reads value.queryPowWitness).result
+    (Fri.mk value.commits value.commitPowWitnesses value.inputOpenings value.commitOpenings value.finalPoly)
+
+structure DataFits (value : Data) : Prop where
+  active : value.active.length < 256^8
+  commitments : CommitmentsFits value.commitments
+  accumulators : value.accumulators.length < 256^8
+  logDegrees : value.logDegrees.length < 256^8
+  fri : FriFits value.fri
+  quotient : OpeningsFits value.quotient
+  preprocessed : ∀ openings, value.preprocessed = some openings → OpeningsFits openings
+  stage1 : OpeningsFits value.stage1
+  stage2 : OpeningsFits value.stage2
+
+theorem readData_reads (value : Data) (fits : DataFits value) :
+    Reads readData (encodeData value) value := by
+  unfold readData encodeData
+  simp only [List.append_assoc]
+  apply Reads.bind (readVector_reads _ _ fits.active (fun item _ => readBool_reads item))
+  apply Reads.bind (readCommitments_reads value.commitments fits.commitments)
+  apply Reads.bind (readVector_reads _ _ fits.accumulators (fun item _ => readExtension_reads item))
+  apply Reads.bind (readVector_reads _ _ fits.logDegrees (fun item _ => readByte_reads item))
+  apply Reads.bind (readFri_reads value.fri fits.fri)
+  apply Reads.bind (readOpenings_reads _ readExtension_reads value.quotient fits.quotient)
+  apply Reads.bind (readOption_reads _ _ (fun openings present =>
+    readOpenings_reads _ readExtension_reads openings (fits.preprocessed openings present)))
+  apply Reads.bind (readOpenings_reads _ readExtension_reads value.stage1 fits.stage1)
+  exact (readOpenings_reads _ readExtension_reads value.stage2 fits.stage2).result
+    (Data.mk value.active value.commitments value.accumulators value.logDegrees value.fri
+      value.quotient value.preprocessed value.stage1)
+
+theorem decode_encode (value : Data) (fits : DataFits value) : decode (encode value) = some value := by
+  have read := readData_reads value fits []
+  simp only [List.append_nil] at read
+  simp only [decode, encode, List.toList_data_toByteArray, read,
+    bind, Option.bind_some, List.isEmpty_nil, ite_true]
+
+theorem decode_success {bytes : ByteArray} {value : Data} (accepted : decode bytes = some value) :
+    readData bytes.data.toList = some (value, []) := by
+  unfold decode at accepted
+  cases parsed : readData bytes.data.toList with
+  | none => simp [parsed, bind, Option.bind] at accepted
+  | some pair =>
+    obtain ⟨result, rest⟩ := pair
+    simp only [parsed, bind, Option.bind_some] at accepted
+    split at accepted
+    next empty => cases accepted; simp only [List.isEmpty_iff.mp empty]
+    next => cases accepted
+
+theorem decodeCanonical_success {bytes : ByteArray} {value : Data}
+    (accepted : decodeCanonical bytes = some value) : decode bytes = some value ∧ encode value = bytes := by
+  unfold decodeCanonical at accepted
+  cases parsed : decode bytes with
+  | none => simp [parsed, bind, Option.bind] at accepted
+  | some result =>
+    simp only [parsed, bind, Option.bind_some] at accepted
+    split at accepted
+    next encoded => cases accepted; exact ⟨rfl, encoded⟩
+    next => cases accepted
+
+theorem decodeCanonical_encode (value : Data) (fits : DataFits value) :
+    decodeCanonical (encode value) = some value := by
+  simp only [decodeCanonical, decode_encode value fits, bind, Option.bind_some, ite_true]
+
+theorem canonical_bytes_unique {first second : ByteArray} {value : Data}
+    (left : decodeCanonical first = some value) (right : decodeCanonical second = some value) : first = second :=
+  (decodeCanonical_success left).2.symm.trans (decodeCanonical_success right).2
+
+theorem encode_injective {first second : Data} (leftFits : DataFits first) (rightFits : DataFits second)
+    (equal : encode first = encode second) : first = second := by
+  have decoded := congrArg decode equal
+  rw [decode_encode first leftFits, decode_encode second rightFits] at decoded
+  exact Option.some.inj decoded
+
+theorem decode_append_rejected (value : Data) (fits : DataFits value) (suffix : List UInt8)
+    (nonempty : suffix ≠ []) : decode ((encodeData value ++ suffix).toByteArray) = none := by
+  have read := readData_reads value fits suffix
+  simp only [decode, List.toList_data_toByteArray, read, bind, Option.bind_some]
+  rw [if_neg (by simpa only [List.isEmpty_iff] using nonempty)]
+
+theorem readNat_returns (count : Nat) :
+    Returns (KeyCodec.readNat count) (fun value => value < 256^count) := by
+  induction count with
+  | zero => exact Returns.pure (by decide)
+  | succ count ih =>
+    unfold KeyCodec.readNat
+    apply Returns.bind_any (property := fun value => value < 256^(count + 1))
+    intro byte
+    apply Returns.result (right := fun value => value < 256^(count + 1)) ih
+    intro value bounded
+    have small := UInt8.toNat_lt byte
+    rw [Nat.pow_succ]
+    omega
+
+theorem readVector_returns {read : Reader α} {property : α → Prop}
+    (valid : Returns read property) : Returns (readVector read) (VectorFits property) := by
+  unfold readVector
+  apply Returns.bind (right := VectorFits property) (readNat_returns 8)
+  intro count bounded
+  exact (KeyCodec.readMany_returns valid count).weaken (fun _ known => ⟨known.1 ▸ bounded, known.2⟩)
+
+theorem readOption_returns {read : Reader α} {property : α → Prop}
+    (valid : Returns read property) : Returns (readOption read)
+      (fun result => ∀ value, result = some value → property value) := by
+  unfold readOption
+  apply Returns.bind_any (property := fun result => ∀ value, result = some value → property value)
+  intro byte
+  split
+  · exact Returns.pure (by intro value equal; cases equal)
+  · apply Returns.result (right := fun result => ∀ value, result = some value → property value) valid
+    intro value known result equal
+    cases equal
+    exact known
+  · exact Returns.failure _
+
+theorem readCap_returns : Returns readCap CapFits := by
+  apply readVector_returns
+  exact (KeyCodec.readMany_returns (read := readByte) (property := fun _ => True)
+    (fun _ _ _ _ => True.intro) 32).weaken (fun _ known => known.1)
+
+theorem readOpenings_returns (read : Reader α) : Returns (readOpenings read) OpeningsFits :=
+  readVector_returns (readVector_returns (readVector_returns (fun _ _ _ _ => True.intro)))
+
+theorem readCommitments_returns : Returns readCommitments CommitmentsFits := by
+  unfold readCommitments
+  apply Returns.bind (right := CommitmentsFits) readCap_returns
+  intro first hf
+  apply Returns.bind (right := CommitmentsFits) readCap_returns
+  intro second hs
+  apply Returns.result (right := CommitmentsFits) readCap_returns
+  intro quotient hq
+  exact ⟨hf, hs, hq⟩
+
+theorem readBatchOpening_returns : Returns readBatchOpening BatchOpeningFits := by
+  unfold readBatchOpening
+  apply Returns.bind (right := BatchOpeningFits) (readOpenings_returns readField)
+  intro values hv
+  apply Returns.result (right := BatchOpeningFits) readCap_returns
+  intro hashes hh
+  exact ⟨hv, hh⟩
+
+theorem readCommitStep_returns : Returns readCommitStep CommitStepFits := by
+  unfold readCommitStep
+  apply Returns.bind_any (property := CommitStepFits)
+  intro arity
+  apply Returns.bind (right := CommitStepFits)
+    (readVector_returns (readVector_returns (property := fun _ => True) (fun _ _ _ _ => True.intro)))
+  intro values hv
+  apply Returns.result (right := CommitStepFits) readCap_returns
+  intro hashes hh
+  exact ⟨hv, hh⟩
+
+theorem readFri_returns : Returns readFri FriFits := by
+  unfold readFri
+  apply Returns.bind (right := FriFits) (readVector_returns readCap_returns)
+  intro commits hc
+  apply Returns.bind (right := FriFits) (readVector_returns (property := fun _ => True) (fun _ _ _ _ => True.intro))
+  intro witnesses hw
+  apply Returns.bind (right := FriFits) (readVector_returns readBatchOpening_returns)
+  intro inputs hi
+  apply Returns.bind (right := FriFits) (readVector_returns readCommitStep_returns)
+  intro openings ho
+  apply Returns.bind (right := FriFits) (readVector_returns (property := fun _ => True) (fun _ _ _ _ => True.intro))
+  intro finalPoly hf
+  apply Returns.bind_any (property := FriFits)
+  intro witness
+  exact Returns.pure ⟨hc, hw.1, hi, ho, hf.1⟩
+
+theorem readData_returns : Returns readData DataFits := by
+  unfold readData
+  apply Returns.bind (right := DataFits) (readVector_returns (property := fun _ => True) (fun _ _ _ _ => True.intro))
+  intro active ha
+  apply Returns.bind (right := DataFits) readCommitments_returns
+  intro commitments hc
+  apply Returns.bind (right := DataFits) (readVector_returns (property := fun _ => True) (fun _ _ _ _ => True.intro))
+  intro accumulators hs
+  apply Returns.bind (right := DataFits) (readVector_returns (property := fun _ => True) (fun _ _ _ _ => True.intro))
+  intro degrees hd
+  apply Returns.bind (right := DataFits) readFri_returns
+  intro fri hf
+  apply Returns.bind (right := DataFits) (readOpenings_returns readExtension)
+  intro quotient hq
+  apply Returns.bind (right := DataFits) (readOption_returns (readOpenings_returns readExtension))
+  intro preprocessed hp
+  apply Returns.bind (right := DataFits) (readOpenings_returns readExtension)
+  intro first hfirst
+  apply Returns.result (right := DataFits) (readOpenings_returns readExtension)
+  intro second hsecond
+  exact ⟨ha.1, hc, hs.1, hd.1, hf, hq, hp, hfirst, hsecond⟩
+
+theorem decode_fits {bytes : ByteArray} {value : Data} (accepted : decode bytes = some value) : DataFits value :=
+  readData_returns _ value [] (decode_success accepted)
+
+end Aiur.NativeAIR.ProofCodec
diff --git a/Ix/Aiur/Proofs/ProofShape.lean b/Ix/Aiur/Proofs/ProofShape.lean
new file mode 100644
index 000000000..68d1c9071
--- /dev/null
+++ b/Ix/Aiur/Proofs/ProofShape.lean
@@ -0,0 +1,173 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofShape
+import Ix.Aiur.Proofs.CompiledKey
+
+/-! Shape acceptance supplies the actual selected opening records and their
+checked dimensions. Polynomial authentication and trace satisfaction are
+not assumed or concluded by these results. -/
+
+namespace Aiur.NativeAIR.ProofShape
+
+open ProofCodec (Data)
+
+theorem pair_success {values : List (List ProofCodec.Extension)} {result : Pair}
+    (accepted : pair values = some result) : values = [result.current, result.next] := by
+  cases values with
+  | nil => cases accepted
+  | cons current rest =>
+    cases rest with
+    | nil => cases accepted
+    | cons next rest =>
+      cases rest with
+      | nil => cases accepted; rfl
+      | cons _ _ => cases accepted
+
+theorem single_success {values : List α} {result : α} (accepted : single values = some result) :
+    values = [result] := by
+  cases values with
+  | nil => cases accepted
+  | cons value rest =>
+    cases rest with
+    | nil => cases accepted; rfl
+    | cons _ _ => cases accepted
+
+theorem readPreprocessed_none (proof : Data) : readPreprocessed proof none = some none := rfl
+
+theorem readPreprocessed_some {proof : Data} {slot : Nat} {result : Option Pair}
+    (accepted : readPreprocessed proof (some slot) = some result) :
+    ∃ values opened, proof.preprocessed = some opened ∧
+      opened[slot]? = some [values.current, values.next] ∧ result = some values := by
+  simp only [readPreprocessed, Option.map_eq_some_iff, bind, Option.bind_eq_some_iff] at accepted
+  obtain ⟨values, ⟨opened, hp, matrix, hm, hv⟩, rfl⟩ := accepted
+  exact ⟨values, opened, hp, (pair_success hv) ▸ hm, rfl⟩
+
+structure Row.Sourced (key : KeyCodec.Key) (proof : Data) (index position : Nat) (row : Row) : Prop where
+  index_eq : row.circuitIndex = index
+  circuit : key.circuits[index]? = some row.circuit
+  degree : proof.logDegrees[position]? = some row.logDegree
+  stage1 : proof.stage1[position]? = some [row.stage1.current, row.stage1.next]
+  stage2 : proof.stage2[position]? = some [row.stage2.current, row.stage2.next]
+  quotient : proof.quotient[position]? = some [row.quotient]
+  accumulator : proof.accumulators[position]? = some row.accumulator
+  preprocessed : ∃ slot, key.preprocessedIndices[index]? = some slot ∧
+    readPreprocessed proof slot = some row.preprocessed
+
+theorem readRow_success {key : KeyCodec.Key} {proof : Data} {index position : Nat} {row : Row}
+    (accepted : readRow key proof index position = some row) : row.Sourced key proof index position := by
+  simp only [readRow, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at accepted
+  obtain ⟨circuit, hc, slot, hi, degree, hd, first, hf, firstPair, hfp,
+    second, hs, secondPair, hsp, quotient, hq, singleQ, hqs, accumulator, ha,
+    preprocessed, hp, rfl⟩ := accepted
+  exact ⟨rfl, hc, hd, (pair_success hfp) ▸ hf, (pair_success hsp) ▸ hs,
+    (single_success hqs) ▸ hq, ha, slot, hi, hp⟩
+
+theorem Pair.hasWidth_success {values : Pair} {width : Nat} (accepted : values.hasWidth width = true) :
+    values.current.length = width ∧ values.next.length = width := by
+  simpa only [Pair.hasWidth, Bool.and_eq_true, beq_iff_eq] using accepted
+
+structure Row.Fits (parameters : KeyCodec.Parameters) (row : Row) : Prop where
+  stage1 : row.stage1.current.length = row.circuit.mainWidth ∧ row.stage1.next.length = row.circuit.mainWidth
+  stage2 : row.stage2.current.length = row.circuit.widths.stage2 ∧ row.stage2.next.length = row.circuit.widths.stage2
+  preprocessed : ∀ values, row.preprocessed = some values →
+    values.current.length = row.circuit.preprocessedWidth ∧ values.next.length = row.circuit.preprocessedWidth
+  quotient : row.quotient.length = quotientDegree row.circuit * 2
+  degree : row.logDegree.toNat + (quotientDegree row.circuit).log2 ≤ 32 - parameters.logBlowup
+
+theorem Row.fits_success {parameters : KeyCodec.Parameters} {row : Row} (accepted : row.fits parameters = true) :
+    row.Fits parameters := by
+  simp only [Row.fits, Bool.and_eq_true, beq_iff_eq, decide_eq_true_eq] at accepted
+  obtain ⟨⟨⟨⟨first, second⟩, preprocessed⟩, quotient⟩, degree⟩ := accepted
+  refine ⟨Pair.hasWidth_success first, Pair.hasWidth_success second, ?_, quotient, degree⟩
+  intro values present
+  rw [present] at preprocessed
+  exact Pair.hasWidth_success preprocessed
+
+theorem check_success {key : KeyCodec.Key} {proof : Data} {result : List Row}
+    (accepted : check key proof = some result) : header key proof = true ∧
+    inactivePreprocessed key proof = true ∧ rows key proof = some result ∧
+    ∀ row ∈ result, row.Fits key.parameters := by
+  unfold check at accepted
+  split at accepted
+  next initial =>
+    have initial' : header key proof = true ∧ inactivePreprocessed key proof = true := by
+      simpa only [Bool.and_eq_true] using initial
+    obtain ⟨header, inactive⟩ := initial'
+    cases parsed : rows key proof with
+    | none => simp [parsed, bind, Option.bind] at accepted
+    | some entries =>
+      simp only [parsed, bind, Option.bind_some] at accepted
+      split at accepted
+      next fits =>
+        cases accepted
+        exact ⟨header, inactive, rfl, fun row member => Row.fits_success (List.all_eq_true.mp fits row member)⟩
+      next => cases accepted
+  next => cases accepted
+
+theorem check_length {key : KeyCodec.Key} {proof : Data} {result : List Row}
+    (accepted : check key proof = some result) : result.length = (activeIndices proof).length := by
+  have parsed := (check_success accepted).2.2.1
+  have same := Bytecode.AIR.list_mapM_some_length _ _ _ parsed
+  simpa only [List.length_zipIdx] using same
+
+theorem activeIndices_mem {proof : Data} {index : Nat} :
+    index ∈ activeIndices proof ↔ proof.active[index]? = some true := by
+  unfold activeIndices
+  constructor
+  · intro member
+    obtain ⟨⟨enabled, ci⟩, present, value⟩ := List.mem_filterMap.mp member
+    cases enabled with
+    | false => cases value
+    | true =>
+      cases value
+      exact List.mk_mem_zipIdx_iff_getElem?.mp present
+  · intro present
+    exact List.mem_filterMap.mpr ⟨(true, index), List.mk_mem_zipIdx_iff_getElem?.mpr present, rfl⟩
+
+theorem check_row {key : KeyCodec.Key} {proof : Data} {result : List Row}
+    (accepted : check key proof = some result) {position : Nat} {row : Row}
+    (present : result[position]? = some row) :
+    ∃ index, (activeIndices proof)[position]? = some index ∧ row.Sourced key proof index position ∧ row.Fits key.parameters := by
+  have parsed := (check_success accepted).2.2.1
+  have read := OpEmitter.list_mapM_read parsed position
+  rw [present] at read
+  simp only [List.getElem?_zipIdx] at read
+  cases located : (activeIndices proof)[position]? with
+  | none => simp [located] at read
+  | some index =>
+    simp only [located, Option.map_some, bind, Option.bind_some, Nat.zero_add] at read
+    exact ⟨index, rfl, readRow_success read,
+      (check_success accepted).2.2.2 row (List.mem_of_getElem? present)⟩
+
+theorem check_row_active {key : KeyCodec.Key} {proof : Data} {result : List Row}
+    (accepted : check key proof = some result) {position : Nat} {row : Row}
+    (present : result[position]? = some row) : proof.active[row.circuitIndex]? = some true := by
+  obtain ⟨index, located, sourced, _⟩ := check_row accepted present
+  rw [sourced.index_eq]
+  exact activeIndices_mem.mp (List.mem_of_getElem? located)
+
+theorem check_nonempty {key : KeyCodec.Key} {proof : Data} {result : List Row}
+    (accepted : check key proof = some result) : result ≠ [] := by
+  have lengths := check_length accepted
+  have valid := (check_success accepted).1
+  simp only [header, Bool.and_eq_true, beq_iff_eq, decide_eq_true_eq] at valid
+  intro empty
+  rw [empty] at lengths
+  have positive : 0 < (activeIndices proof).length := valid.1.1.1.1.1.1.1.1.2
+  simp only [List.length_nil] at lengths
+  omega
+
+theorem fixedHeights_sound {key : KeyCodec.Key} {proof : Data} (accepted : fixedHeights key proof = true) :
+    FixedTraceHeights (key.circuits.map (·.preprocessedHeight)) proof.active (proof.logDegrees.map UInt8.toNat) :=
+  fixedTraceHeights_sound accepted
+
+theorem queryBound_sound {key : KeyCodec.Key} {proof : Data} {bound : Nat}
+    (accepted : queryBound key proof = some bound) :
+    ∃ total, lookupSlotSum (key.circuits.map (·.graph.lookups.length)) proof.active
+      (proof.logDegrees.map UInt8.toNat) = some total ∧ bound = 1 + total ∧ bound < gSize.toNat :=
+  (lookupQueryBound_sound accepted).2
+
+end Aiur.NativeAIR.ProofShape
diff --git a/Ix/Aiur/Proofs/ProviderEquivalence.lean b/Ix/Aiur/Proofs/ProviderEquivalence.lean
new file mode 100644
index 000000000..2b4c940e1
--- /dev/null
+++ b/Ix/Aiur/Proofs/ProviderEquivalence.lean
@@ -0,0 +1,103 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRowCounts
+import Ix.Aiur.Proofs.CircuitPoolExecution
+
+/-! Provider replacement preserves padded balance when multiplicities and
+nonzero messages agree. A satisfying nonzero circuit provides an actual
+return message before any operation or function-row interpretation. -/
+
+namespace Aiur.AIR
+
+/-- Providers have the same contribution to every padded-message balance.
+The raw message of a zero-weight provider has no effect. -/
+def Provider.PaddedEq (width : Nat) (left right : Provider (List G)) : Prop :=
+  left.2 = right.2 ∧ (left.2 ≠ 0 → padMessage width left.1 = padMessage width right.1)
+
+theorem Provider.PaddedEq.refl (width : Nat) (provider : Provider (List G)) :
+    PaddedEq width provider provider := ⟨rfl, fun _ => rfl⟩
+
+theorem Provider.PaddedEq.symm {width : Nat} {left right : Provider (List G)}
+    (same : PaddedEq width left right) : PaddedEq width right left :=
+  ⟨same.1.symm, fun nonzero => (same.2 (same.1 ▸ nonzero)).symm⟩
+
+theorem Provider.PaddedEq.trans {width : Nat} {left middle right : Provider (List G)}
+    (first : PaddedEq width left middle) (last : PaddedEq width middle right) : PaddedEq width left right :=
+  ⟨first.1.trans last.1, fun nonzero => (first.2 nonzero).trans (last.2 (first.1 ▸ nonzero))⟩
+
+theorem suppliedWeight_padded_congr {width : Nat} {left right : List (Provider (List G))}
+    (related : List.Forall₂ (Provider.PaddedEq width) left right) (message : List G) :
+    suppliedWeight message (mapProviders (padMessage width) left) =
+      suppliedWeight message (mapProviders (padMessage width) right) := by
+  induction related with
+  | nil => rfl
+  | @cons first last rest rest' head tail ih =>
+    change (if padMessage width first.1 = message then
+      first.2 + suppliedWeight message (mapProviders (padMessage width) rest)
+      else suppliedWeight message (mapProviders (padMessage width) rest)) =
+      (if padMessage width last.1 = message then
+      last.2 + suppliedWeight message (mapProviders (padMessage width) rest')
+      else suppliedWeight message (mapProviders (padMessage width) rest'))
+    by_cases zero : first.2 = 0
+    · have lastZero := head.1.symm.trans zero
+      simp only [zero, lastZero, G.zero_add, ite_self, ih]
+    · rw [head.2 zero, head.1, ih]
+
+theorem PaddedLookupBalance.congr_providers {width : Nat} {queries : List (List G)}
+    {left right : List (Provider (List G))} (balanced : PaddedLookupBalance width queries left)
+    (related : List.Forall₂ (Provider.PaddedEq width) left right) :
+    PaddedLookupBalance width queries right := fun message =>
+  (balanced message).trans (suppliedWeight_padded_congr related message)
+
+theorem paddedProviders_refl (width : Nat) (providers : List (Provider (List G))) :
+    List.Forall₂ (Provider.PaddedEq width) providers providers := by
+  induction providers with
+  | nil => exact .nil
+  | cons provider rest ih => exact .cons (Provider.PaddedEq.refl width provider) ih
+
+def CircuitEmission.provider (emission : CircuitEmission) : Provider (List G) :=
+  ((emission.lookup 0).2, emission.multiplicity)
+
+theorem CircuitEmission.provider_multiplicity (emission : CircuitEmission) :
+    (emission.lookup 0).1 = 0 - emission.provider.2 := rfl
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+theorem Circuit.emitRow_provider (row : Nat → G) (program : Toplevel) (circuit : Circuit)
+    {emission : CircuitEmission} (emitted : circuit.emitRow row program = some emission)
+    (validated : circuit.validateRowCounts program = true)
+    (shape : ∀ part ∈ emission.members, part.function.body.lookupShapes program none = true)
+    (satisfied : ∀ equation ∈ emission.equations, equation = 0)
+    (nonzero : emission.multiplicity ≠ 0) (width : Nat) :
+    ∃ request : AIR.Call, (1, request) ∈ emission.returns ∧
+      padMessage width (emission.lookup 0).2 = padMessage width (functionMessage request) := by
+  obtain ⟨bounded, _, returnBound, single⟩ := circuit.emitRow_count_bounds row program emitted validated satisfied
+  obtain ⟨description, indices, source⟩ := circuit.emitRow_spec row program emitted
+  have size := congrArg List.length indices
+  simp only [List.length_map, Array.length_toList] at size
+  have valid : ∀ equation ∈ (circuitEmission row circuit emission.members).equations, equation = 0 := by
+    rw [← description]
+    exact satisfied
+  have active : (circuitEmission row circuit emission.members).selector = 1 :=
+    nonzero_multiplicity_selector_one (circuitEmission_activity valid) (by
+      rw [← description]
+      exact nonzero)
+  have count := circuitEmission_return_count source shape (by omega) returnBound valid active
+  rw [← description] at count
+  have present : (1 : G) ∈ emission.returns.map Prod.fst := List.count_pos_iff.mp (by rw [count]; decide)
+  obtain ⟨⟨gate, request⟩, member, gateEq⟩ := List.mem_map.mp present
+  change gate = 1 at gateEq
+  subst gate
+  refine ⟨request, member, ?_⟩
+  have message := circuitEmission_return_message source shape (by omega) returnBound valid active width
+    (by rw [← description]; exact single) (by rw [← description]; exact member)
+  rw [← description] at message
+  exact message
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/PrunedMerkle.lean b/Ix/Aiur/Proofs/PrunedMerkle.lean
new file mode 100644
index 000000000..2937b6c8b
--- /dev/null
+++ b/Ix/Aiur/Proofs/PrunedMerkle.lean
@@ -0,0 +1,743 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.PrunedMerkle
+import Ix.Aiur.Proofs.Merkle
+
+/-! Shared frontier authentication through reconstructed individual paths.
+Hash logs include work performed before a rejected group injection. -/
+
+namespace Aiur.NativeAIR.Merkle
+
+theorem walk_append (hash : Hash) (dimensions : List Dimensions) (rows : List (List G))
+    (height index : Nat) (current : Digest) (before after : List Digest) :
+    walk hash dimensions rows height index current (before ++ after) =
+      let middle := walk hash dimensions rows height index current before
+      let final := walk hash dimensions rows (height - before.length) (index / 2^before.length) middle.digest after
+      ⟨final.digest, middle.inputs ++ final.inputs⟩ := by
+  induction before generalizing height index current with
+  | nil => simp only [List.nil_append, walk, List.length_nil, Nat.sub_zero, Nat.pow_zero, Nat.div_one]
+  | cons sibling before ih =>
+    have subtract : height - 1 - before.length = height - (before.length + 1) := by omega
+    have divide : index / 2 / 2^before.length = index / 2^(before.length + 1) := by
+      rw [Nat.div_div_eq_div_mul, Nat.pow_succ, Nat.mul_comm 2]
+    simp only [List.cons_append, walk, ih, List.length_cons, subtract, divide, List.append_assoc]
+
+end Aiur.NativeAIR.Merkle
+
+namespace Aiur.NativeAIR.PrunedMerkle
+
+theorem Logged.bind_success {first : Logged α} {next : α → Logged β} {value : β}
+    (success : (first >>= next).result = some value) :
+    ∃ middle, first.result = some middle ∧ (next middle).result = some value ∧
+      (first >>= next).inputs = first.inputs ++ (next middle).inputs := by
+  change (Logged.bind first next).result = some value at success
+  cases running : first.result with
+  | none => simp [Logged.bind, running] at success
+  | some middle =>
+    exact ⟨middle, rfl, by simpa only [Logged.bind, running] using success,
+      by change (Logged.bind first next).inputs = _; simp only [Logged.bind, running]⟩
+
+theorem Logged.bind_input_left {first : Logged α} {next : α → Logged β} {input : List UInt8}
+    (member : input ∈ first.inputs) : input ∈ (first >>= next).inputs := by
+  change input ∈ (Logged.bind first next).inputs
+  cases running : first.result with
+  | none => simpa only [Logged.bind, running] using member
+  | some middle => simp only [Logged.bind, running, List.mem_append]; exact Or.inl member
+
+theorem Logged.bind_input_right {first : Logged α} {next : α → Logged β} {middle : α}
+    (success : first.result = some middle) {input : List UInt8} (member : input ∈ (next middle).inputs) :
+    input ∈ (first >>= next).inputs := by
+  change input ∈ (Logged.bind first next).inputs
+  simp only [Logged.bind, success, List.mem_append]
+  exact Or.inr member
+
+theorem Logged.bind_if (condition : Prop) [Decidable condition] (left right : Logged α)
+    (next : α → Logged β) :
+    ((if condition then left else right) >>= next) =
+      if condition then left >>= next else right >>= next := by
+  by_cases condition <;> simp only [*, ↓reduceIte]
+
+theorem hashInput_value (hash : Merkle.Hash) (input : List UInt8) :
+    (hashInput hash input).result = some (hash input) := rfl
+
+theorem hashInput_inputs (hash : Merkle.Hash) (input : List UInt8) :
+    (hashInput hash input).inputs = [input] := rfl
+
+open Merkle (Digest Hash Dimensions)
+
+/-- An individual path ending at the current shared node, with every
+ordinary hash input contained in the shared execution log. -/
+structure TicketAt (hash : Hash) (dimensions : List Dimensions) (height index : Nat)
+    (digest : Digest) (inputs : List (List UInt8)) (ticket : Ticket) : Prop where
+  shape : Merkle.shape dimensions ticket.rows = true
+  bound : ticket.index < 2^Merkle.maxHeight dimensions
+  depth : ticket.proof.length + height = Merkle.maxHeight dimensions
+  position : ticket.index / 2^ticket.proof.length = index
+  digest_eq : (Merkle.walk hash dimensions ticket.rows (Merkle.maxHeight dimensions) ticket.index
+    (hash (Merkle.rowBytes dimensions ticket.rows (Merkle.maxHeight dimensions))) ticket.proof).digest = digest
+  calls : Merkle.rowBytes dimensions ticket.rows (Merkle.maxHeight dimensions) ::
+    (Merkle.walk hash dimensions ticket.rows (Merkle.maxHeight dimensions) ticket.index
+      (hash (Merkle.rowBytes dimensions ticket.rows (Merkle.maxHeight dimensions))) ticket.proof).inputs ⊆ inputs
+
+def NodeAt (hash : Hash) (dimensions : List Dimensions) (height : Nat)
+    (inputs : List (List UInt8)) (node : Node) : Prop :=
+  ∀ ticket ∈ node.tickets, TicketAt hash dimensions height node.index node.digest inputs ticket
+
+/-- A sibling has been paired, but shorter rows have not yet been injected.
+The native verifier pairs the whole layer before performing these injections. -/
+def PendingAt (hash : Hash) (dimensions : List Dimensions) (height index : Nat)
+    (digest : Digest) (inputs : List (List UInt8)) (ticket : Ticket) : Prop :=
+  ∃ before sibling previousIndex previousDigest,
+    ticket = before.extend sibling ∧
+    TicketAt hash dimensions (height + 1) previousIndex previousDigest inputs before ∧
+    index = previousIndex / 2 ∧
+    digest = hash (Merkle.branchBytes previousIndex previousDigest sibling) ∧
+    Merkle.branchBytes previousIndex previousDigest sibling ∈ inputs
+
+def PendingNode (hash : Hash) (dimensions : List Dimensions) (height : Nat)
+    (inputs : List (List UInt8)) (node : Node) : Prop :=
+  ∀ ticket ∈ node.tickets, PendingAt hash dimensions height node.index node.digest inputs ticket
+
+def origins (nodes : List Node) : List (Nat × List (List G)) :=
+  nodes.flatMap fun node => node.tickets.map fun ticket => (ticket.index, ticket.rows)
+
+theorem TicketAt.mono {hash : Hash} {dimensions : List Dimensions} {height index : Nat}
+    {digest : Digest} {before after : List (List UInt8)} {ticket : Ticket}
+    (valid : TicketAt hash dimensions height index digest before ticket) (subset : before ⊆ after) :
+    TicketAt hash dimensions height index digest after ticket :=
+  { valid with calls := fun _ member => subset (valid.calls member) }
+
+theorem NodeAt.mono {hash : Hash} {dimensions : List Dimensions} {height : Nat}
+    {before after : List (List UInt8)} {node : Node}
+    (valid : NodeAt hash dimensions height before node) (subset : before ⊆ after) :
+    NodeAt hash dimensions height after node :=
+  fun _ member => (valid _ member).mono subset
+
+theorem PendingAt.mono {hash : Hash} {dimensions : List Dimensions} {height index : Nat}
+    {digest : Digest} {before after : List (List UInt8)} {ticket : Ticket}
+    (valid : PendingAt hash dimensions height index digest before ticket) (subset : before ⊆ after) :
+    PendingAt hash dimensions height index digest after ticket := by
+  obtain ⟨previous, sibling, previousIndex, previousDigest, same, path, position, digestEq, member⟩ := valid
+  exact ⟨previous, sibling, previousIndex, previousDigest, same, path.mono subset,
+    position, digestEq, subset member⟩
+
+theorem PendingNode.mono {hash : Hash} {dimensions : List Dimensions} {height : Nat}
+    {before after : List (List UInt8)} {node : Node}
+    (valid : PendingNode hash dimensions height before node) (subset : before ⊆ after) :
+    PendingNode hash dimensions height after node :=
+  fun _ member => (valid _ member).mono subset
+
+theorem TicketAt.extend {hash : Hash} {dimensions : List Dimensions} {height index : Nat}
+    {digest : Digest} {inputs : List (List UInt8)} {ticket : Ticket} (sibling : Digest)
+    (valid : TicketAt hash dimensions (height + 1) index digest inputs ticket)
+    (member : Merkle.branchBytes index digest sibling ∈ inputs) :
+    PendingAt hash dimensions height (index / 2)
+      (hash (Merkle.branchBytes index digest sibling)) inputs (ticket.extend sibling) :=
+  ⟨ticket, sibling, index, digest, rfl, valid, rfl, rfl, member⟩
+
+theorem TicketAt.finish {hash : Hash} {dimensions : List Dimensions} {height index : Nat}
+    {digest : Digest} {inputs : List (List UInt8)} {ticket : Ticket} (sibling : Digest)
+    (valid : TicketAt hash dimensions (height + 1) index digest inputs ticket)
+    (calls : (Merkle.step hash dimensions ticket.rows height index digest sibling).inputs ⊆ inputs) :
+    TicketAt hash dimensions height (index / 2)
+      (Merkle.step hash dimensions ticket.rows height index digest sibling).digest inputs
+      (ticket.extend sibling) := by
+  have level : Merkle.maxHeight dimensions - ticket.proof.length = height + 1 := by
+    have := valid.depth
+    omega
+  have path := Merkle.walk_append hash dimensions ticket.rows (Merkle.maxHeight dimensions)
+    ticket.index (hash (Merkle.rowBytes dimensions ticket.rows (Merkle.maxHeight dimensions)))
+    ticket.proof [sibling]
+  simp only [level, valid.position, valid.digest_eq, Merkle.walk, Nat.add_sub_cancel,
+    List.append_nil] at path
+  refine ⟨valid.shape, valid.bound, ?_, ?_, ?_, ?_⟩
+  · simp only [Ticket.extend, List.length_append, List.length_singleton]
+    have := valid.depth
+    omega
+  · simp only [Ticket.extend, List.length_append, List.length_singleton, Nat.pow_succ,
+      ← Nat.div_div_eq_div_mul, valid.position]
+  · simp only [Ticket.extend, path]
+  · simp only [Ticket.extend, path]
+    intro input member
+    simp only [List.mem_cons, List.mem_append] at member
+    rcases member with leaf | previous | current
+    · exact valid.calls (List.mem_cons.mpr (Or.inl leaf))
+    · exact valid.calls (List.mem_cons.mpr (Or.inr previous))
+    · exact calls current
+
+theorem PendingAt.finish_absent {hash : Hash} {dimensions : List Dimensions} {height index : Nat}
+    {digest : Digest} {inputs : List (List UInt8)} {ticket : Ticket}
+    (valid : PendingAt hash dimensions height index digest inputs ticket)
+    (absent : Merkle.hasHeight dimensions height = false) :
+    TicketAt hash dimensions height index digest inputs ticket := by
+  obtain ⟨before, sibling, previousIndex, previousDigest, rfl, path, rfl, rfl, member⟩ := valid
+  have calls : (Merkle.step hash dimensions before.rows height previousIndex previousDigest sibling).inputs ⊆ inputs := by
+    simpa only [Merkle.step, absent, Bool.false_eq_true, ↓reduceIte, List.cons_subset,
+      List.nil_subset, and_true] using member
+  simpa only [Merkle.step, absent, Bool.false_eq_true, ↓reduceIte] using path.finish sibling calls
+
+theorem PendingAt.finish_injected {hash : Hash} {dimensions : List Dimensions} {height index : Nat}
+    {digest : Digest} {inputs : List (List UInt8)} {ticket : Ticket} {rows : List (List G)}
+    (valid : PendingAt hash dimensions height index digest inputs ticket)
+    (present : Merkle.hasHeight dimensions height = true)
+    (same : Merkle.rowsAt dimensions ticket.rows height = Merkle.rowsAt dimensions rows height)
+    (leaf : Merkle.rowBytes dimensions rows height ∈ inputs)
+    (inject : Merkle.pairBytes digest (hash (Merkle.rowBytes dimensions rows height)) ∈ inputs) :
+    TicketAt hash dimensions height index
+      (hash (Merkle.pairBytes digest (hash (Merkle.rowBytes dimensions rows height)))) inputs ticket := by
+  obtain ⟨before, sibling, previousIndex, previousDigest, rfl, path, rfl, rfl, member⟩ := valid
+  have bytes : Merkle.rowBytes dimensions before.rows height = Merkle.rowBytes dimensions rows height := by
+    change Merkle.rowsAt dimensions before.rows height = Merkle.rowsAt dimensions rows height at same
+    exact congrArg (fun (values : List (List G)) => Transcript.fieldsBytes values.flatten) same
+  have calls : (Merkle.step hash dimensions before.rows height previousIndex previousDigest sibling).inputs ⊆ inputs := by
+    simpa only [Merkle.step, present, ↓reduceIte, bytes, List.cons_subset, List.nil_subset, and_true]
+      using And.intro member (And.intro leaf inject)
+  simpa only [Merkle.step, present, ↓reduceIte, bytes] using path.finish sibling calls
+
+theorem NodeAt.singleton {hash : Hash} {dimensions : List Dimensions} {height : Nat}
+    {inputs : List (List UInt8)} {node : Node} (sibling : Digest)
+    (valid : NodeAt hash dimensions (height + 1) inputs node)
+    (member : Merkle.branchBytes node.index node.digest sibling ∈ inputs) :
+    PendingNode hash dimensions height inputs
+      ⟨node.index / 2, hash (Merkle.branchBytes node.index node.digest sibling),
+        node.tickets.map (Ticket.extend sibling)⟩ := by
+  intro ticket ticketMem
+  obtain ⟨before, beforeMem, rfl⟩ := List.mem_map.mp ticketMem
+  exact (valid before beforeMem).extend sibling member
+
+theorem NodeAt.pair {hash : Hash} {dimensions : List Dimensions} {height : Nat}
+    {inputs : List (List UInt8)} {first second : Node}
+    (left : NodeAt hash dimensions (height + 1) inputs first)
+    (right : NodeAt hash dimensions (height + 1) inputs second)
+    (adjacent : first.index % 2 = 0 ∧ second.index = first.index + 1)
+    (member : Merkle.pairBytes first.digest second.digest ∈ inputs) :
+    PendingNode hash dimensions height inputs
+      ⟨first.index / 2, hash (Merkle.pairBytes first.digest second.digest),
+        first.tickets.map (Ticket.extend second.digest) ++ second.tickets.map (Ticket.extend first.digest)⟩ := by
+  have leftBytes : Merkle.branchBytes first.index first.digest second.digest =
+      Merkle.pairBytes first.digest second.digest := by simp only [Merkle.branchBytes, adjacent.1, ↓reduceIte]
+  have odd : second.index % 2 ≠ 0 := by omega
+  have rightBytes : Merkle.branchBytes second.index second.digest first.digest =
+      Merkle.pairBytes first.digest second.digest := by simp only [Merkle.branchBytes, odd, ↓reduceIte]
+  have position : second.index / 2 = first.index / 2 := by omega
+  intro ticket ticketMem
+  rcases List.mem_append.mp ticketMem with leftMem | rightMem
+  · obtain ⟨before, beforeMem, rfl⟩ := List.mem_map.mp leftMem
+    simpa only [leftBytes] using (left before beforeMem).extend second.digest (leftBytes ▸ member)
+  · obtain ⟨before, beforeMem, rfl⟩ := List.mem_map.mp rightMem
+    simpa only [rightBytes, position] using (right before beforeMem).extend first.digest (rightBytes ▸ member)
+
+theorem origins_cons (node : Node) (nodes : List Node) :
+    origins (node :: nodes) = node.tickets.map (fun ticket => (ticket.index, ticket.rows)) ++ origins nodes := rfl
+
+theorem origins_extend (tickets : List Ticket) (sibling : Digest) :
+    (tickets.map (Ticket.extend sibling)).map (fun ticket => (ticket.index, ticket.rows)) =
+      tickets.map (fun ticket => (ticket.index, ticket.rows)) := by
+  simp only [List.map_map, Function.comp_def, Ticket.extend]
+
+theorem combine_refines {hash : Hash} {dimensions : List Dimensions} {height : Nat}
+    {inputs : List (List UInt8)} {nodes : List Node} {proof : List Digest}
+    {parents : List Node} {remaining : List Digest}
+    (valid : ∀ node ∈ nodes, NodeAt hash dimensions (height + 1) inputs node)
+    (success : (combine hash nodes proof).result = some (parents, remaining)) :
+    (∀ parent ∈ parents, PendingNode hash dimensions height (inputs ++ (combine hash nodes proof).inputs) parent) ∧
+      origins parents = origins nodes := by
+  fun_induction combine hash nodes proof generalizing parents remaining with
+  | case1 proof =>
+    have same : ([], proof) = (parents, remaining) := Option.some.inj success
+    cases same
+    exact ⟨by simp, rfl⟩
+  | case2 first proof second tail adjacent ih =>
+    cases running : (combine hash tail proof).result with
+    | none => simp [bind, Logged.bind, hashInput, running] at success
+    | some result =>
+      rcases result with ⟨rest, boundary⟩
+      have tailValid : ∀ node ∈ tail, NodeAt hash dimensions (height + 1) inputs node :=
+        fun node member => valid node (by simp only [List.mem_cons]; exact Or.inr (Or.inr member))
+      obtain ⟨restValid, restOrigins⟩ := ih tailValid running
+      simp only [bind, pure, Logged.bind, hashInput,
+        running, Logged.pure, Option.some.injEq, Prod.mk.injEq] at success
+      rcases success with ⟨rfl, rfl⟩
+      simp only [bind, pure, Logged.bind, hashInput,
+        running, Logged.pure, List.append_nil]
+      constructor
+      · intro node member
+        rcases List.mem_cons.mp member with rfl | restMem
+        · apply NodeAt.pair
+          · exact (valid first (by simp)).mono (by intro input h; simp only [List.mem_append]; exact Or.inl h)
+          · exact (valid second (by simp)).mono (by intro input h; simp only [List.mem_append]; exact Or.inl h)
+          · exact adjacent
+          · simp
+        · apply (restValid node restMem).mono
+          intro input h
+          simp only [List.mem_append] at h ⊢
+          exact h.elim Or.inl (fun h => Or.inr (by simp only [List.mem_cons]; exact Or.inr h))
+      · simp only [origins_cons, List.map_append, origins_extend, restOrigins, List.append_assoc]
+  | case3 first second tail adjacent sibling boundary ih =>
+    cases running : (combine hash (second :: tail) boundary).result with
+    | none => simp [bind, Logged.bind, hashInput, running] at success
+    | some result =>
+      rcases result with ⟨rest, leftover⟩
+      have tailValid : ∀ node ∈ second :: tail, NodeAt hash dimensions (height + 1) inputs node :=
+        fun node member => valid node (List.mem_cons.mpr (Or.inr member))
+      obtain ⟨restValid, restOrigins⟩ := ih tailValid running
+      simp only [bind, pure, Logged.bind, hashInput,
+        running, Logged.pure, Option.some.injEq, Prod.mk.injEq] at success
+      rcases success with ⟨rfl, rfl⟩
+      simp only [bind, pure, Logged.bind, hashInput,
+        running, Logged.pure, List.append_nil]
+      constructor
+      · intro node member
+        rcases List.mem_cons.mp member with rfl | restMem
+        · apply NodeAt.singleton
+          · exact (valid first (by simp)).mono (by intro input h; simp only [List.mem_append]; exact Or.inl h)
+          · simp
+        · apply (restValid node restMem).mono
+          intro input h
+          simp only [List.mem_append] at h ⊢
+          exact h.elim Or.inl (fun h => Or.inr (by simp only [List.mem_cons]; exact Or.inr h))
+      · simp only [origins_cons, origins_extend, restOrigins]
+  | case4 => cases success
+  | case5 first sibling boundary =>
+    simp only [bind, pure, Logged.bind, hashInput, Logged.pure,
+      Option.some.injEq, Prod.mk.injEq] at success
+    rcases success with ⟨rfl, rfl⟩
+    simp only [bind, pure, Logged.bind, hashInput, Logged.pure, List.append_nil]
+    constructor
+    · intro node member
+      obtain rfl := List.mem_singleton.mp member
+      apply NodeAt.singleton
+      · exact (valid first (by simp)).mono (by intro input h; simp only [List.mem_append]; exact Or.inl h)
+      · simp
+    · simp only [origins_cons, origins_extend]
+  | case6 => cases success
+
+theorem inject_refines {hash : Hash} {dimensions : List Dimensions} {height : Nat}
+    {inputs : List (List UInt8)} {nodes output : List Node}
+    (present : Merkle.hasHeight dimensions height = true)
+    (valid : ∀ node ∈ nodes, PendingNode hash dimensions height inputs node)
+    (success : (inject hash dimensions height nodes).result = some output) :
+    (∀ node ∈ output, NodeAt hash dimensions height (inputs ++ (inject hash dimensions height nodes).inputs) node) ∧
+      origins output = origins nodes := by
+  induction nodes generalizing output with
+  | nil =>
+    have same : [] = output := Option.some.inj success
+    subst output
+    exact ⟨by simp, rfl⟩
+  | cons node nodes ih =>
+    unfold inject at success ⊢
+    cases ticketsEq : node.tickets with
+    | nil => simp only [ticketsEq] at success; cases success
+    | cons lead members =>
+      simp only [ticketsEq] at success ⊢
+      by_cases consistent : (members.all fun ticket =>
+          Merkle.rowsAt dimensions ticket.rows height == Merkle.rowsAt dimensions lead.rows height) = true
+      · simp only [consistent, Bool.not_true, Bool.false_eq_true, ↓reduceIte] at success ⊢
+        cases running : (inject hash dimensions height nodes).result with
+        | none => simp [bind, Logged.bind, hashInput, running] at success
+        | some rest =>
+          have tailValid : ∀ child ∈ nodes, PendingNode hash dimensions height inputs child :=
+            fun child member => valid child (List.mem_cons.mpr (Or.inr member))
+          obtain ⟨restValid, restOrigins⟩ := ih tailValid running
+          simp only [bind, pure, Logged.bind, hashInput, running, Logged.pure, Option.some.injEq] at success
+          subst output
+          simp only [bind, pure, Logged.bind, hashInput, running, Logged.pure, List.append_nil]
+          constructor
+          · intro child member
+            rcases List.mem_cons.mp member with rfl | restMem
+            · intro ticket ticketMem
+              apply PendingAt.finish_injected (rows := lead.rows)
+              · exact (valid node (by simp) ticket (by simpa only [ticketsEq] using ticketMem)).mono
+                  (by intro input h; simp only [List.mem_append]; exact Or.inl h)
+              · exact present
+              · rcases List.mem_cons.mp ticketMem with rfl | member
+                · rfl
+                · exact beq_iff_eq.mp (List.all_eq_true.mp consistent ticket member)
+              · simp
+              · simp
+            · apply (restValid child restMem).mono
+              intro input h
+              simp only [List.mem_append] at h ⊢
+              exact h.elim Or.inl (fun h => Or.inr (by simp only [List.mem_cons]; exact Or.inr (Or.inr h)))
+          · simp only [origins_cons, restOrigins, ticketsEq]
+      · have rejected : (members.all fun ticket =>
+            Merkle.rowsAt dimensions ticket.rows height == Merkle.rowsAt dimensions lead.rows height) = false :=
+          Bool.eq_false_iff.mpr consistent
+        simp only [rejected, Bool.not_false, ↓reduceIte] at success
+        cases success
+
+theorem initial_refines {hash : Hash} {dimensions : List Dimensions}
+    {inputs : List (List UInt8)} {tickets : List Ticket} {nodes : List Node}
+    (valid : ∀ ticket ∈ tickets, Merkle.shape dimensions ticket.rows = true ∧
+      ticket.index < 2^Merkle.maxHeight dimensions ∧ ticket.proof = [])
+    (success : (initial hash dimensions (Merkle.maxHeight dimensions) tickets).result = some nodes) :
+    (∀ node ∈ nodes, NodeAt hash dimensions (Merkle.maxHeight dimensions)
+      (inputs ++ (initial hash dimensions (Merkle.maxHeight dimensions) tickets).inputs) node) ∧
+      origins nodes = tickets.map (fun ticket => (ticket.index, ticket.rows)) := by
+  induction tickets generalizing nodes with
+  | nil =>
+    have same : [] = nodes := Option.some.inj success
+    subst nodes
+    exact ⟨by simp, rfl⟩
+  | cons ticket tickets ih =>
+    cases running : (initial hash dimensions (Merkle.maxHeight dimensions) tickets).result with
+    | none => simp [initial, bind, Logged.bind, hashInput, running] at success
+    | some rest =>
+      have tailValid : ∀ child ∈ tickets, Merkle.shape dimensions child.rows = true ∧
+          child.index < 2^Merkle.maxHeight dimensions ∧ child.proof = [] :=
+        fun child member => valid child (List.mem_cons.mpr (Or.inr member))
+      obtain ⟨restValid, restOrigins⟩ := ih tailValid running
+      simp only [initial, bind, pure, Logged.bind, hashInput, running, Logged.pure, Option.some.injEq] at success
+      subst nodes
+      simp only [initial, bind, pure, Logged.bind, hashInput, running, Logged.pure, List.append_nil]
+      constructor
+      · intro node member
+        rcases List.mem_cons.mp member with rfl | restMem
+        · intro child childMem
+          obtain rfl := List.mem_singleton.mp childMem
+          obtain ⟨shape, bound, empty⟩ := valid child (by simp)
+          refine ⟨shape, bound, ?_, ?_, ?_, ?_⟩
+          · simp only [empty, List.length_nil, Nat.zero_add]
+          · simp only [empty, List.length_nil, Nat.pow_zero, Nat.div_one]
+          · simp only [empty, Merkle.walk]
+          · intro input member
+            simp only [empty, Merkle.walk, List.mem_singleton] at member
+            subst input
+            simp
+        · apply (restValid node restMem).mono
+          intro input h
+          simp only [List.mem_append] at h ⊢
+          exact h.elim Or.inl (fun h => Or.inr (by simp only [List.mem_cons]; exact Or.inr h))
+      · simp only [origins_cons, restOrigins, List.map_cons, List.map_nil, List.singleton_append]
+
+theorem walk_refines {hash : Hash} {dimensions : List Dimensions} {steps height : Nat}
+    {inputs : List (List UInt8)} {nodes output : List Node} {proof remaining : List Digest}
+    (bounded : steps ≤ height)
+    (valid : ∀ node ∈ nodes, NodeAt hash dimensions height inputs node)
+    (success : (walk hash dimensions steps height nodes proof).result = some (output, remaining)) :
+    (∀ node ∈ output, NodeAt hash dimensions (height - steps)
+      (inputs ++ (walk hash dimensions steps height nodes proof).inputs) node) ∧
+      origins output = origins nodes := by
+  induction steps generalizing height inputs nodes output proof remaining with
+  | zero =>
+    have same : (nodes, proof) = (output, remaining) := Option.some.inj success
+    cases same
+    simp only [walk, pure, Logged.pure, Nat.sub_zero, List.append_nil]
+    exact ⟨valid, trivial⟩
+  | succ steps ih =>
+    have level : height - 1 + 1 = height := by omega
+    unfold walk at success ⊢
+    obtain ⟨⟨parents, boundary⟩, combined, continued, logEq⟩ := Logged.bind_success success
+    obtain ⟨parentValid, parentOrigins⟩ := combine_refines (height := height - 1)
+      (by simpa only [level] using valid) combined
+    dsimp only at continued logEq
+    rw [← Logged.bind_if] at continued logEq
+    obtain ⟨next, injected, finished, nextLog⟩ := Logged.bind_success continued
+    have nextValid : ∀ node ∈ next, NodeAt hash dimensions (height - 1)
+        ((inputs ++ (combine hash nodes proof).inputs) ++
+          (if Merkle.hasHeight dimensions (height - 1) then inject hash dimensions (height - 1) parents
+           else pure parents).inputs) node := by
+      by_cases present : Merkle.hasHeight dimensions (height - 1) = true
+      · simp only [present, ↓reduceIte] at injected ⊢
+        exact (inject_refines present parentValid injected).1
+      · simp only [present, Bool.false_eq_true, ↓reduceIte] at injected ⊢
+        have same : parents = next := Option.some.inj injected
+        subst next
+        intro node member ticket ticketMem
+        have missing : Merkle.hasHeight dimensions (height - 1) = false := Bool.eq_false_iff.mpr present
+        simpa only [pure, Logged.pure, List.append_nil] using
+          (parentValid node member ticket ticketMem).finish_absent missing
+    have nextOrigins : origins next = origins parents := by
+      split at injected
+      next present => exact (inject_refines present parentValid injected).2
+      next absent =>
+        have same : parents = next := Option.some.inj injected
+        subst next
+        rfl
+    obtain ⟨outputValid, outputOrigins⟩ := ih (by omega) nextValid finished
+    constructor
+    · have finalHeight : height - 1 - steps = height - (steps + 1) := by omega
+      simpa only [logEq, nextLog, List.append_assoc, finalHeight] using outputValid
+    · exact outputOrigins.trans (nextOrigins.trans parentOrigins)
+
+theorem mapM_members {read : α → Option β} {inputs : List α} {outputs : List β}
+    (success : inputs.mapM read = some outputs) :
+    (∀ input ∈ inputs, ∃ output ∈ outputs, read input = some output) ∧
+      (∀ output ∈ outputs, ∃ input ∈ inputs, read input = some output) := by
+  induction inputs generalizing outputs with
+  | nil =>
+    have same : [] = outputs := Option.some.inj success
+    subst outputs
+    simp
+  | cons input inputs ih =>
+    simp only [List.mapM_cons, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at success
+    obtain ⟨output, first, rest, running, rfl⟩ := success
+    obtain ⟨forward, backward⟩ := ih running
+    constructor
+    · intro source member
+      rcases List.mem_cons.mp member with rfl | member
+      · exact ⟨output, by simp, first⟩
+      · obtain ⟨result, member, read⟩ := forward source member
+        exact ⟨result, List.mem_cons.mpr (Or.inr member), read⟩
+    · intro result member
+      rcases List.mem_cons.mp member with rfl | member
+      · exact ⟨input, by simp, first⟩
+      · obtain ⟨source, member, read⟩ := backward result member
+        exact ⟨source, List.mem_cons.mpr (Or.inr member), read⟩
+
+theorem representatives_refines {indices : List Nat} {rows : List (List (List G))}
+    {tickets : List Ticket} (success : representatives indices rows = some tickets) :
+    (∀ ticket ∈ tickets, ticket.index ∈ indices ∧ ticket.proof = []) ∧
+      ∀ source ∈ indices.zip rows, ∃ ticket ∈ tickets, ticket.index = source.1 ∧ ticket.rows = source.2 := by
+  let read : Nat → Option Ticket := fun index => do
+    let (_, values) ← (indices.zip rows).find? fun entry => entry.1 == index
+    if (indices.zip rows).all (fun entry => entry.1 != index || entry.2 == values) then
+      some (Ticket.mk index values [])
+    else none
+  change (uniqueIndices indices).mapM read = some tickets at success
+  have readSpec {index : Nat} {ticket : Ticket} (evaluated : read index = some ticket) :
+      ticket.index = index ∧ ticket.proof = [] ∧
+        ∀ source ∈ indices.zip rows, source.1 = index → ticket.rows = source.2 := by
+    simp only [read, bind, Option.bind_eq_some_iff] at evaluated
+    obtain ⟨⟨found, values⟩, _, checked⟩ := evaluated
+    split at checked
+    next consistent =>
+      have same := Option.some.inj checked
+      subst ticket
+      refine ⟨rfl, rfl, ?_⟩
+      intro source member atIndex
+      have equality := List.all_eq_true.mp consistent source member
+      simp only [atIndex, bne_self_eq_false, Bool.false_or, beq_iff_eq] at equality
+      exact equality.symm
+    next => cases checked
+  obtain ⟨forward, backward⟩ := mapM_members success
+  constructor
+  · intro ticket member
+    obtain ⟨index, indexMem, evaluated⟩ := backward ticket member
+    obtain ⟨position, empty, _⟩ := readSpec evaluated
+    refine ⟨?_, empty⟩
+    simpa only [position, uniqueIndices, List.mem_eraseDups, List.mem_mergeSort] using indexMem
+  · intro source member
+    have indexMem : source.1 ∈ uniqueIndices indices := by
+      simpa only [uniqueIndices, List.mem_eraseDups, List.mem_mergeSort] using (List.of_mem_zip member).1
+    obtain ⟨ticket, ticketMem, evaluated⟩ := forward source.1 indexMem
+    obtain ⟨position, _, same⟩ := readSpec evaluated
+    exact ⟨ticket, ticketMem, position, same source member rfl⟩
+
+theorem replay_refines {hash : Hash} {dimensions : List Dimensions} {capHeight : Nat}
+    {indices : List Nat} {rows : List (List (List G))} {proof : List Digest} {nodes : List Node}
+    (success : (replay hash dimensions capHeight indices rows proof).result = some nodes) :
+    dimensions ≠ [] ∧ rows.length = indices.length ∧
+      (∀ node ∈ nodes, NodeAt hash dimensions (min capHeight (Merkle.maxHeight dimensions))
+        (replay hash dimensions capHeight indices rows proof).inputs node) ∧
+      ∀ source ∈ indices.zip rows, source ∈ origins nodes := by
+  unfold replay at success ⊢
+  split at success
+  · cases success
+  next structural =>
+    have nonempty : dimensions ≠ [] := by
+      simp only [Bool.or_eq_true, List.isEmpty_iff, bne_iff_ne, not_or] at structural
+      exact structural.1
+    have count : rows.length = indices.length := by
+      simp only [Bool.or_eq_true, List.isEmpty_iff, bne_iff_ne, not_or] at structural
+      exact Decidable.not_not.mp structural.2
+    simp only [if_neg structural]
+    dsimp only at success ⊢
+    split at success
+    · cases success
+    next bounded =>
+      simp only [if_neg bounded]
+      have bounds : ∀ index ∈ indices, index < 2^Merkle.maxHeight dimensions := by
+        simpa only [Bool.not_eq_true', Bool.not_eq_false, List.all_eq_true, decide_eq_true_eq] using bounded
+      obtain ⟨tickets, represented, continued, firstLog⟩ := Logged.bind_success success
+      have representation : representatives indices rows = some tickets := represented
+      obtain ⟨ticketIndices, sources⟩ := representatives_refines representation
+      split at continued
+      · cases continued
+      next fitted =>
+        have fits : ∀ ticket ∈ tickets, Merkle.shape dimensions ticket.rows = true := by
+          have checked := fitted
+          simp only [Bool.or_eq_true, bne_iff_ne, Bool.not_eq_true', not_or] at checked
+          exact List.all_eq_true.mp (by simpa only [Bool.not_eq_false] using checked.2)
+        obtain ⟨leaves, initialized, walked, leafLog⟩ := Logged.bind_success continued
+        have initialValid : ∀ ticket ∈ tickets, Merkle.shape dimensions ticket.rows = true ∧
+            ticket.index < 2^Merkle.maxHeight dimensions ∧ ticket.proof = [] := by
+          intro ticket member
+          exact ⟨fits ticket member, bounds ticket.index (ticketIndices ticket member).1,
+            (ticketIndices ticket member).2⟩
+        obtain ⟨leafValid, leafOrigins⟩ := initial_refines (inputs := []) initialValid initialized
+        obtain ⟨⟨roots, remaining⟩, traversed, finished, walkLog⟩ := Logged.bind_success walked
+        obtain ⟨rootValid, rootOrigins⟩ := walk_refines (Nat.sub_le _ _) leafValid traversed
+        dsimp only at finished walkLog
+        split at finished
+        next consumed =>
+          have same : roots = nodes := Option.some.inj finished
+          subst nodes
+          refine ⟨nonempty, count, ?_, ?_⟩
+          · have heightEq : Merkle.maxHeight dimensions - (Merkle.maxHeight dimensions - capHeight) =
+                min capHeight (Merkle.maxHeight dimensions) := by omega
+            rw [firstLog, if_neg fitted, leafLog, walkLog]
+            simpa only [consumed, ↓reduceIte,
+              pure, Logged.pure, ofOption, List.nil_append, List.append_nil, heightEq] using rootValid
+          · intro source member
+            obtain ⟨ticket, ticketMem, indexEq, rowsEq⟩ := sources source member
+            rw [rootOrigins, leafOrigins]
+            exact List.mem_map.mpr ⟨ticket, ticketMem, by simp only [indexEq, rowsEq]⟩
+        next => cases finished
+
+/-- Every original query, including duplicates and queries merged along the
+frontier, has an individual path reaching its shared node. -/
+theorem replay_individual {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {indices : List Nat} {rows : List (List (List G))} {query : List (List G)}
+    {proof : List Digest} {nodes : List Node}
+    (success : (replay hash dimensions capHeight indices rows proof).result = some nodes)
+    (member : (index, query) ∈ indices.zip rows) :
+    ∃ node ∈ nodes, ∃ path result,
+      Merkle.replay hash dimensions capHeight index query path = some result ∧
+      result.index = node.index ∧ result.hashing.digest = node.digest ∧
+      result.hashing.inputs ⊆ (replay hash dimensions capHeight indices rows proof).inputs := by
+  obtain ⟨nonempty, _, valid, sources⟩ := replay_refines success
+  have source := sources (index, query) member
+  simp only [origins, List.mem_flatMap, List.mem_map] at source
+  obtain ⟨node, nodeMem, ticket, ticketMem, same⟩ := source
+  obtain ⟨indexEq, rowsEq⟩ := Prod.mk.inj same
+  subst index
+  subst query
+  have path := valid node nodeMem ticket ticketMem
+  have count : ticket.proof.length = Merkle.maxHeight dimensions - capHeight := by
+    have := path.depth
+    omega
+  exact ⟨node, nodeMem, ticket.proof, _,
+    Merkle.replay_complete nonempty path.shape count path.bound,
+    path.position, path.digest_eq, path.calls⟩
+
+theorem verify_individual {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {indices : List Nat} {cap : List Digest} {rows : List (List (List G))} {query : List (List G)}
+    {proof : List Digest}
+    (accepted : verify hash dimensions capHeight indices cap rows proof = true)
+    (member : (index, query) ∈ indices.zip rows) :
+    ∃ path result, Merkle.replay hash dimensions capHeight index query path = some result ∧
+      Merkle.verify hash dimensions capHeight index cap query path = true ∧
+      result.hashing.inputs ⊆ (replay hash dimensions capHeight indices rows proof).inputs := by
+  cases running : (replay hash dimensions capHeight indices rows proof).result with
+  | none => simp only [verify, running, Bool.false_eq_true] at accepted
+  | some nodes =>
+    obtain ⟨node, nodeMem, path, result, individual, position, digestEq, inputs⟩ :=
+      replay_individual running member
+    have capEq : cap[node.index]? = some node.digest := by
+      simp only [verify, running, accepts, List.all_eq_true] at accepted
+      exact beq_iff_eq.mp (accepted node nodeMem)
+    refine ⟨path, result, individual, ?_, inputs⟩
+    simp only [Merkle.verify, individual, Merkle.accepts, position, digestEq, capEq, beq_self_eq_true]
+
+theorem verifyCovered_individual {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {indices : List Nat} {cap : List Digest} {rows : List (List (List G))} {query : List (List G)}
+    {proof : List Digest}
+    (accepted : verifyCovered hash dimensions capHeight indices cap rows proof = true)
+    (member : (index, query) ∈ indices.zip rows) :
+    ∃ path result, Merkle.replay hash dimensions capHeight index query path = some result ∧
+      Merkle.verifyCovered hash dimensions capHeight index cap query path = true ∧
+      result.hashing.inputs ⊆ (replay hash dimensions capHeight indices rows proof).inputs := by
+  simp only [verifyCovered, Bool.and_eq_true] at accepted
+  obtain ⟨path, result, individual, verified, inputs⟩ := verify_individual accepted.2 member
+  exact ⟨path, result, individual,
+    by simp only [Merkle.verifyCovered, accepted.1, verified, Bool.and_self], inputs⟩
+
+/-- Conflicting shared openings at a common public index expose a collision
+within two reconstructed paths. All witness inputs occur in the actual
+shared executions, although native verification may reuse their hashes. -/
+theorem verify_collision {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {leftIndices rightIndices : List Nat} {cap : List Digest}
+    {leftRows rightRows : List (List (List G))} {leftQuery rightQuery : List (List G)}
+    {leftProof rightProof : List Digest}
+    (coverage : Merkle.covered dimensions capHeight = true)
+    (left : verify hash dimensions capHeight leftIndices cap leftRows leftProof = true)
+    (right : verify hash dimensions capHeight rightIndices cap rightRows rightProof = true)
+    (leftMember : (index, leftQuery) ∈ leftIndices.zip leftRows)
+    (rightMember : (index, rightQuery) ∈ rightIndices.zip rightRows)
+    (different : leftQuery ≠ rightQuery) :
+    ∃ inputs,
+      inputs ⊆ (replay hash dimensions capHeight leftIndices leftRows leftProof).inputs ++
+        (replay hash dimensions capHeight rightIndices rightRows rightProof).inputs ∧
+      Merkle.CollisionOn hash inputs ∧ inputs.length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ inputs, input.length ≤ max 64 (8 * max leftQuery.flatten.length rightQuery.flatten.length) := by
+  obtain ⟨leftPath, leftResult, leftReplay, leftAccepted, leftInputs⟩ := verify_individual left leftMember
+  obtain ⟨rightPath, rightResult, rightReplay, rightAccepted, rightInputs⟩ := verify_individual right rightMember
+  obtain ⟨leftWitness, rightWitness, leftRun, rightRun, collision, count⟩ :=
+    Merkle.verify_collision coverage leftAccepted rightAccepted different
+  have leftSame := Option.some.inj (leftRun.symm.trans leftReplay)
+  have rightSame := Option.some.inj (rightRun.symm.trans rightReplay)
+  subst leftWitness
+  subst rightWitness
+  refine ⟨leftResult.hashing.inputs ++ rightResult.hashing.inputs, ?_, collision, count, ?_⟩
+  · intro input member
+    simp only [List.mem_append] at member ⊢
+    exact member.elim (fun h => Or.inl (leftInputs h)) (fun h => Or.inr (rightInputs h))
+  · intro input member
+    rcases List.mem_append.mp member with member | member
+    · have := Merkle.replay_input_length leftReplay member
+      omega
+    · have := Merkle.replay_input_length rightReplay member
+      omega
+
+theorem verifyCovered_collision {hash : Hash} {dimensions : List Dimensions} {capHeight index : Nat}
+    {leftIndices rightIndices : List Nat} {cap : List Digest}
+    {leftRows rightRows : List (List (List G))} {leftQuery rightQuery : List (List G)}
+    {leftProof rightProof : List Digest}
+    (left : verifyCovered hash dimensions capHeight leftIndices cap leftRows leftProof = true)
+    (right : verifyCovered hash dimensions capHeight rightIndices cap rightRows rightProof = true)
+    (leftMember : (index, leftQuery) ∈ leftIndices.zip leftRows)
+    (rightMember : (index, rightQuery) ∈ rightIndices.zip rightRows)
+    (different : leftQuery ≠ rightQuery) :
+    ∃ inputs,
+      inputs ⊆ (replay hash dimensions capHeight leftIndices leftRows leftProof).inputs ++
+        (replay hash dimensions capHeight rightIndices rightRows rightProof).inputs ∧
+      Merkle.CollisionOn hash inputs ∧ inputs.length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ inputs, input.length ≤ max 64 (8 * max leftQuery.flatten.length rightQuery.flatten.length) := by
+  simp only [verifyCovered, Bool.and_eq_true] at left right
+  exact verify_collision left.1 left.2 right.2 leftMember rightMember different
+
+theorem blake3_collision {dimensions : List Dimensions} {capHeight index : Nat}
+    {leftIndices rightIndices : List Nat} {cap : List Digest}
+    {leftRows rightRows : List (List (List G))} {leftQuery rightQuery : List (List G)}
+    {leftProof rightProof : List Digest}
+    (left : verifyCovered Blake3.digest dimensions capHeight leftIndices cap leftRows leftProof = true)
+    (right : verifyCovered Blake3.digest dimensions capHeight rightIndices cap rightRows rightProof = true)
+    (leftMember : (index, leftQuery) ∈ leftIndices.zip leftRows)
+    (rightMember : (index, rightQuery) ∈ rightIndices.zip rightRows)
+    (different : leftQuery ≠ rightQuery) :
+    ∃ inputs,
+      inputs ⊆ (replay Blake3.digest dimensions capHeight leftIndices leftRows leftProof).inputs ++
+        (replay Blake3.digest dimensions capHeight rightIndices rightRows rightProof).inputs ∧
+      Merkle.CollisionOn Blake3.digest inputs ∧
+      inputs.length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ inputs, input.length ≤ max 64 (8 * max leftQuery.flatten.length rightQuery.flatten.length) :=
+  verifyCovered_collision left right leftMember rightMember different
+
+theorem blake3_native_collision {dimensions : List Dimensions} {capHeight index : Nat}
+    {leftIndices rightIndices : List Nat} {cap : List Digest}
+    {leftRows rightRows : List (List (List G))} {leftQuery rightQuery : List (List G)}
+    {leftProof rightProof : List Digest}
+    (left : verifyCovered Blake3.digest dimensions capHeight leftIndices cap leftRows leftProof = true)
+    (right : verifyCovered Blake3.digest dimensions capHeight rightIndices cap rightRows rightProof = true)
+    (leftMember : (index, leftQuery) ∈ leftIndices.zip leftRows)
+    (rightMember : (index, rightQuery) ∈ rightIndices.zip rightRows)
+    (different : leftQuery ≠ rightQuery)
+    (leftBound : leftQuery.flatten.length < 2^61) (rightBound : rightQuery.flatten.length < 2^61) :
+    ∃ inputs,
+      inputs ⊆ (replay Blake3.digest dimensions capHeight leftIndices leftRows leftProof).inputs ++
+        (replay Blake3.digest dimensions capHeight rightIndices rightRows rightProof).inputs ∧
+      Merkle.CollisionOn Blake3.digest inputs ∧
+      inputs.length ≤ 2 + 6 * (Merkle.maxHeight dimensions - capHeight) ∧
+      ∀ input ∈ inputs, Blake3.NativeInput input := by
+  obtain ⟨inputs, subset, collision, count, bytes⟩ := blake3_collision left right leftMember rightMember different
+  refine ⟨inputs, subset, collision, count, ?_⟩
+  intro input member
+  have := bytes input member
+  unfold Blake3.NativeInput
+  omega
+
+end Aiur.NativeAIR.PrunedMerkle
diff --git a/Ix/Aiur/Proofs/PublicCircuitExecution.lean b/Ix/Aiur/Proofs/PublicCircuitExecution.lean
new file mode 100644
index 000000000..5239dac92
--- /dev/null
+++ b/Ix/Aiur/Proofs/PublicCircuitExecution.lean
@@ -0,0 +1,78 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitTableExecution
+
+/-! Finite execution of the selected public success call from valued circuit
+witnesses. Public rank-zero padding is normalized without changing lookup
+balance. Native witness/lookup reflection and cryptographic reduction remain
+separate obligations. -/
+
+namespace Aiur.AIR
+
+theorem PaddedLookupBalance.congr_queries {width : Nat} {left right : List (List G)}
+    {providers : List (Provider (List G))} (balanced : PaddedLookupBalance width left providers)
+    (same : left.map (padMessage width) = right.map (padMessage width)) :
+    PaddedLookupBalance width right providers := by
+  change ExactLookupBalance _ _ at balanced ⊢
+  rwa [← same]
+
+end Aiur.AIR
+
+namespace Aiur.BoundVerifier
+open AIR Bytecode.AIR
+
+theorem claim_message (selection : Selection) (input : Array G) :
+    functionMessage ⟨selection.function, input, selection.success, 0⟩ =
+      (buildClaim selection.function input selection.success).toList ++ [0] := by
+  simp only [functionMessage, buildClaim, Array.toList_append, List.cons_append,
+    List.nil_append, functionChannel]
+  rfl
+
+/-- The selected public success call executes from valued circuit witnesses
+and their physical provider balance. The public query has the actual claim
+encoding, whose omitted rank is zero. Native witness extraction, lookup-slot
+encoding/layout reflection and the cryptographic reduction remain separate. -/
+theorem Backend.public_circuit_execution {selection : Selection} (backend : Backend selection)
+    (tables : AuxiliaryTables) (witnesses : List CircuitWitness) (width : Nat)
+    (input : Array G) (arity : input.size = selection.inputSize)
+    (balanced : PaddedLookupBalance width
+      ((buildClaim selection.function input selection.success).toList ::
+        circuitQueryPool (witnesses.map (·.emission)))
+      (tables.circuitProviders (witnesses.map (·.emission))))
+    (bounded : (circuitQueryPool (witnesses.map (·.emission))).length + 1 < gSize.toNat)
+    (publicWidth : (buildClaim selection.function input selection.success).size + 1 ≤ width)
+    (queryWidths : ∀ query ∈ circuitQueryPool (witnesses.map (·.emission)), query.length ≤ width)
+    (memoryValid : ∀ size, MemoryRowsValid size (tables.memory size))
+    (canonical : ∀ size ∈ tables.memoryWidths, size < gSize.toNat)
+    (circuits : ∀ witness ∈ witnesses, witness.circuit ∈ backend.compiled.bytecode.circuits)
+    (emitted : ∀ witness ∈ witnesses, witness.Emitted backend.compiled.bytecode)
+    (satisfied : ∀ witness ∈ witnesses, witness.Satisfied)
+    (shapes : ∀ witness ∈ witnesses, witness.Shapes backend.compiled.bytecode)
+    (limits : ∀ witness ∈ witnesses, witness.LookupBounds) :
+    Execution backend.compiled.bytecode (memoryFacts tables.memory)
+      ⟨selection.function, input, selection.success, 0⟩ := by
+  let request : Call := ⟨selection.function, input, selection.success, 0⟩
+  have normalized : PaddedLookupBalance width
+      (functionMessage request :: circuitQueryPool (witnesses.map (·.emission)))
+      (tables.circuitProviders (witnesses.map (·.emission))) := by
+    apply balanced.congr_queries
+    change padMessage width (buildClaim selection.function input selection.success).toList :: _ =
+      padMessage width (functionMessage request) :: _
+    rw [show padMessage width (functionMessage request) =
+      padMessage width (buildClaim selection.function input selection.success).toList from
+      claim_padding selection width input]
+  apply circuitWitnesses_execute tables witnesses normalized bounded ?_ memoryValid canonical
+    backend.rowCounts backend.lookupShapes circuits emitted satisfied shapes limits
+    (fun _ member => List.mem_cons_of_mem _ member) (backend.root_lookupShape input arity) List.mem_cons_self
+  intro query member
+  rcases List.mem_cons.mp member with same | rest
+  · subst query
+    change (functionMessage ⟨selection.function, input, selection.success, 0⟩).length ≤ width
+    rw [claim_message, List.length_append, List.length_singleton, Array.length_toList]
+    exact publicWidth
+  · exact queryWidths query rest
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/QuerySlotMessages.lean b/Ix/Aiur/Proofs/QuerySlotMessages.lean
new file mode 100644
index 000000000..2de72f2ce
--- /dev/null
+++ b/Ix/Aiur/Proofs/QuerySlotMessages.lean
@@ -0,0 +1,216 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockQuerySlots
+
+/-!
+Decode the unique active query in each valued lookup slot. Its message
+equals the native-style combined message after padding, and its multiplicity
+is zero or one. The decoded list preserves exact padded lookup balance and
+has at most one query per allocated slot.
+
+The single-writer premise for ungated branchless slots remains explicit.
+The model-to-native and randomized-compression reductions are separate.
+-/
+
+namespace Aiur.AIR
+
+def activeQuerySlot (queries : List QueryPart) (slot : Nat) : List QueryPart :=
+  queries.filter fun query => query.slot == slot && query.selector == 1
+
+def querySlotParts (queries : List QueryPart) (slot : Nat) : List (G × List G) :=
+  (queries.filter fun query => query.slot == slot).map fun query => (query.selector, query.message)
+
+def querySlotMultiplicity (queries : List QueryPart) (slot : Nat) : G :=
+  selectorSum ((querySlotParts queries slot).map Prod.fst)
+
+def decodedQuery (queries : List QueryPart) (slot : Nat) : Option (List G) :=
+  (activeQuerySlot queries slot).head?.map (·.message)
+
+def encodedQuery (branchless : Bool) (queries : List QueryPart) (slot : Nat) : Option (List G) :=
+  if querySlotMultiplicity queries slot = 1 then some (slotMessage branchless (querySlotParts queries slot))
+  else none
+
+def decodedQueries (queries : List QueryPart) (limit : Nat) : List (List G) :=
+  (List.range limit).filterMap (decodedQuery queries)
+
+def encodedQueries (branchless : Bool) (queries : List QueryPart) (limit : Nat) : List (List G) :=
+  (List.range limit).filterMap (encodedQuery branchless queries)
+
+theorem singleton_of_member_length_le_one {α : Type} {items : List α} {item : α}
+    (member : item ∈ items) (bound : items.length ≤ 1) : items = [item] := by
+  cases items with
+  | nil => cases member
+  | cons head tail =>
+    have empty : tail = [] := List.length_eq_zero_iff.mp (by simp only [List.length_cons] at bound; omega)
+    subst tail
+    have equal := List.mem_singleton.mp member
+    subst item
+    rfl
+
+theorem selector_pair_chosen_count {α : Type} {parts : List (G × α)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (count : (parts.map Prod.fst).count 1 = 1)
+    {chosen : G × α} (member : chosen ∈ parts) (active : chosen.1 = 1) :
+    ∃ before after, parts = before ++ chosen :: after ∧
+      ∀ part ∈ before ++ after, part.1 = 0 := by
+  obtain ⟨before, after, equal⟩ := List.mem_iff_append.mp member
+  have counts := count
+  rw [equal, List.map_append, List.count_append, List.map_cons, active, List.count_cons_self] at counts
+  have empty : ((before ++ after).map Prod.fst).count 1 = 0 := by
+    rw [List.map_append, List.count_append]
+    omega
+  have absent := List.count_eq_zero.mp empty
+  refine ⟨before, after, equal, ?_⟩
+  intro part present
+  have original : part ∈ parts := by
+    rw [equal]
+    rcases List.mem_append.mp present with left | right
+    · exact List.mem_append_left _ left
+    · exact List.mem_append_right _ (List.mem_cons_of_mem _ right)
+  rcases G.boolean_of_constraint (individual part original) with inactive | selected
+  · exact inactive
+  · exact False.elim (absent (List.mem_map.mpr ⟨part, present, selected⟩))
+
+theorem slotMessage_chosen_count (width : Nat) (branchless : Bool) {parts : List (G × List G)}
+    (single : branchless = true → parts.length ≤ 1)
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (count : (parts.map Prod.fst).count 1 = 1)
+    {chosen : G × List G} (member : chosen ∈ parts) (active : chosen.1 = 1) :
+    padMessage width (slotMessage branchless parts) = padMessage width chosen.2 := by
+  cases branchless with
+  | false =>
+    obtain ⟨before, after, equal, zero⟩ := selector_pair_chosen_count individual count member active
+    rw [equal]
+    exact weightedMessage_split width before after chosen active zero
+  | true =>
+    rw [singleton_of_member_length_le_one member (single rfl)]
+    rfl
+
+theorem querySlotParts_count (queries : List QueryPart) (slot : Nat) :
+    ((querySlotParts queries slot).map Prod.fst).count 1 = queryCount queries slot := by
+  rw [querySlotParts, List.map_map, List.count_eq_countP, List.countP_map,
+    List.countP_eq_length_filter, List.filter_filter]
+  simp only [Function.comp_def, queryCount, Bool.and_comm]
+
+theorem querySlotParts_member {queries : List QueryPart} {query : QueryPart}
+    (member : query ∈ queries) : (query.selector, query.message) ∈ querySlotParts queries query.slot := by
+  apply List.mem_map.mpr
+  exact ⟨query, List.mem_filter.mpr ⟨member, by simp⟩, rfl⟩
+
+theorem QuerySlots.slot_boolean {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (slot : Nat) :
+    ∀ part ∈ querySlotParts queries slot, booleanConstraint part.1 = 0 := by
+  intro part member
+  obtain ⟨query, queryMember, equal⟩ := List.mem_map.mp member
+  subst part
+  exact slots.boolean query (List.mem_filter.mp queryMember).1
+
+theorem QuerySlots.slot_multiplicity {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (slot : Nat) :
+    querySlotMultiplicity queries slot = G.ofNat (queryCount queries slot) := by
+  rw [querySlotMultiplicity, selectorSum_eq_count]
+  · rw [querySlotParts_count]
+  · intro value member
+    obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+    subst value
+    exact G.boolean_of_constraint (slots.slot_boolean slot part partMember)
+
+theorem QuerySlots.multiplicity_boolean {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (slot : Nat) :
+    querySlotMultiplicity queries slot = 0 ∨ querySlotMultiplicity queries slot = 1 := by
+  have bound := Nat.le_trans (slots.count slot) (gateCount_le_one gate)
+  have count : queryCount queries slot = 0 ∨ queryCount queries slot = 1 := by omega
+  rw [slots.slot_multiplicity slot]
+  rcases count with zero | one
+  · rw [zero]
+    exact Or.inl rfl
+  · rw [one]
+    exact Or.inr rfl
+
+theorem QuerySlots.active_singleton {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) {query : QueryPart}
+    (member : query ∈ queries) (active : query.selector = 1) :
+    activeQuerySlot queries query.slot = [query] := by
+  apply singleton_of_member_length_le_one
+  · exact List.mem_filter.mpr ⟨member, by simp only [Bool.and_eq_true, beq_iff_eq]; exact ⟨trivial, active⟩⟩
+  · exact Nat.le_trans (slots.count _) (gateCount_le_one gate)
+
+theorem QuerySlots.decoded {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) {query : QueryPart}
+    (member : query ∈ queries) (active : query.selector = 1) :
+    decodedQuery queries query.slot = some query.message := by
+  rw [decodedQuery, slots.active_singleton member active]
+  rfl
+
+theorem QuerySlots.decoded_member {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) {query : QueryPart}
+    (member : query ∈ queries) (active : query.selector = 1) :
+    query.message ∈ decodedQueries queries finish := by
+  apply List.mem_filterMap.mpr
+  exact ⟨query.slot, List.mem_range.mpr (slots.range query member).2, slots.decoded member active⟩
+
+theorem QuerySlots.slot_message {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (width : Nat) (branchless : Bool)
+    (single : branchless = true → ∀ slot, (querySlotParts queries slot).length ≤ 1)
+    {query : QueryPart} (member : query ∈ queries) (active : query.selector = 1) :
+    padMessage width (slotMessage branchless (querySlotParts queries query.slot)) = padMessage width query.message := by
+  have count : queryCount queries query.slot = 1 :=
+    congrArg List.length (slots.active_singleton member active)
+  exact slotMessage_chosen_count width branchless (fun enabled => single enabled query.slot)
+    (slots.slot_boolean _) ((querySlotParts_count _ _).trans count)
+    (querySlotParts_member member) active
+
+theorem QuerySlots.slot_reflects {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (width : Nat) (branchless : Bool)
+    (single : branchless = true → ∀ slot, (querySlotParts queries slot).length ≤ 1) (slot : Nat) :
+    (encodedQuery branchless queries slot).map (padMessage width) =
+      (decodedQuery queries slot).map (padMessage width) := by
+  cases found : activeQuerySlot queries slot with
+  | nil =>
+    have count : queryCount queries slot = 0 := congrArg List.length found
+    have inactive : querySlotMultiplicity queries slot = 0 := by rw [slots.slot_multiplicity slot, count]; rfl
+    simp only [encodedQuery, decodedQuery, found, inactive, Ne.symm G.one_ne_zero, if_false,
+      List.head?_nil, Option.map_none]
+  | cons query rest =>
+    have member : query ∈ activeQuerySlot queries slot := by rw [found]; exact List.mem_cons_self
+    obtain ⟨original, same, active⟩ := by
+      simpa only [activeQuerySlot, List.mem_filter, Bool.and_eq_true, beq_iff_eq] using member
+    have singleton := slots.active_singleton original active
+    rw [same] at singleton
+    have count : queryCount queries slot = 1 := congrArg List.length singleton
+    have multiplicity : querySlotMultiplicity queries slot = 1 := by rw [slots.slot_multiplicity slot, count]; rfl
+    have message := slots.slot_message width branchless single original active
+    rw [same] at message
+    simp only [encodedQuery, decodedQuery, singleton, multiplicity, if_true,
+      List.head?_cons, Option.map_some]
+    exact congrArg some message
+
+theorem QuerySlots.queries_reflect {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (width : Nat) (branchless : Bool)
+    (single : branchless = true → ∀ slot, (querySlotParts queries slot).length ≤ 1) (limit : Nat) :
+    (encodedQueries branchless queries limit).map (padMessage width) =
+      (decodedQueries queries limit).map (padMessage width) := by
+  simp only [encodedQueries, decodedQueries, List.map_filterMap]
+  apply congrArg (fun read : Nat → Option (List G) => (List.range limit).filterMap read)
+  funext slot
+  exact slots.slot_reflects width branchless single slot
+
+theorem QuerySlots.padded_balance {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (width : Nat) (branchless : Bool)
+    (single : branchless = true → ∀ slot, (querySlotParts queries slot).length ≤ 1)
+    (limit : Nat) (providers : List (Provider (List G)))
+    (balanced : PaddedLookupBalance width (encodedQueries branchless queries limit) providers) :
+    PaddedLookupBalance width (decodedQueries queries limit) providers := by
+  unfold PaddedLookupBalance at balanced ⊢
+  rw [← slots.queries_reflect width branchless single limit]
+  exact balanced
+
+theorem decodedQueries_length (queries : List QueryPart) (limit : Nat) :
+    (decodedQueries queries limit).length ≤ limit := by
+  simpa only [decodedQueries, List.length_range] using
+    List.length_filterMap_le (decodedQuery queries) (List.range limit)
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/QuerySlots.lean b/Ix/Aiur/Proofs/QuerySlots.lean
new file mode 100644
index 000000000..0f9d6d5e4
--- /dev/null
+++ b/Ix/Aiur/Proofs/QuerySlots.lean
@@ -0,0 +1,203 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FunctionRows
+
+/-!
+Lookup-slot intervals and natural active-query counts. Sequential regions
+are disjoint, while shared regions combine bounded selector families. The
+count invariant excludes duplicate active contributions without requiring
+the number of inactive writers in a slot to fit the field characteristic.
+-/
+
+namespace Aiur.AIR
+open Bytecode
+
+def gateCount (gate : G) : Nat := if gate = 1 then 1 else 0
+
+def queryCount (queries : List QueryPart) (slot : Nat) : Nat :=
+  (queries.filter fun query => query.slot == slot && query.selector == 1).length
+
+structure QuerySlots (gate : G) (start finish : Nat) (queries : List QueryPart) : Prop where
+  extent : start ≤ finish
+  range : ∀ query ∈ queries, start ≤ query.slot ∧ query.slot < finish
+  boolean : ∀ query ∈ queries, booleanConstraint query.selector = 0
+  count : ∀ slot, queryCount queries slot ≤ gateCount gate
+
+theorem gateCount_le_one (gate : G) : gateCount gate ≤ 1 := by
+  simp only [gateCount]
+  split <;> omega
+
+theorem gateCount_zero : gateCount 0 = 0 := by
+  simp [gateCount, Ne.symm G.one_ne_zero]
+
+theorem queryCount_append (first rest : List QueryPart) (slot : Nat) :
+    queryCount (first ++ rest) slot = queryCount first slot + queryCount rest slot := by
+  simp only [queryCount, List.filter_append, List.length_append]
+
+theorem QuerySlots.empty (gate : G) (start : Nat) : QuerySlots gate start start [] :=
+  ⟨Nat.le_refl _, by simp, by simp, by simp [queryCount]⟩
+
+theorem QuerySlots.outside {gate : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots gate start finish queries) (slot : Nat)
+    (outside : slot < start ∨ finish ≤ slot) : queryCount queries slot = 0 := by
+  apply List.length_eq_zero_iff.mpr
+  apply List.filter_eq_nil_iff.mpr
+  intro query member
+  have range := slots.range query member
+  simp only [Bool.and_eq_true, beq_iff_eq]
+  intro same
+  omega
+
+theorem QuerySlots.weaken {first last : G} {start finish : Nat} {queries : List QueryPart}
+    (slots : QuerySlots first start finish queries) (bound : gateCount first ≤ gateCount last) :
+    QuerySlots last start finish queries :=
+  ⟨slots.extent, slots.range, slots.boolean, fun slot => Nat.le_trans (slots.count slot) bound⟩
+
+theorem QuerySlots.append {gate : G} {start middle finish : Nat} {first rest : List QueryPart}
+    (left : QuerySlots gate start middle first) (right : QuerySlots gate middle finish rest) :
+    QuerySlots gate start finish (first ++ rest) := by
+  refine ⟨Nat.le_trans left.extent right.extent, ?_, ?_, ?_⟩
+  · intro query member
+    rcases List.mem_append.mp member with before | after
+    · have range := left.range query before
+      exact ⟨range.1, Nat.lt_of_lt_of_le range.2 right.extent⟩
+    · have range := right.range query after
+      exact ⟨Nat.le_trans left.extent range.1, range.2⟩
+  · intro query member
+    rcases List.mem_append.mp member with before | after
+    · exact left.boolean query before
+    · exact right.boolean query after
+  · intro slot
+    rw [queryCount_append]
+    by_cases before : slot < middle
+    · rw [right.outside slot (Or.inl before), Nat.add_zero]
+      exact left.count slot
+    · rw [left.outside slot (Or.inr (by omega)), Nat.zero_add]
+      exact right.count slot
+
+theorem QuerySlots.single (gate : G) (slot : Nat) (message : List G)
+    (boolean : booleanConstraint gate = 0) :
+    QuerySlots gate slot (slot + 1) [⟨slot, gate, message⟩] := by
+  refine ⟨by omega, ?_, ?_, ?_⟩
+  · intro query member
+    have same := List.mem_singleton.mp member
+    subst query
+    exact ⟨Nat.le_refl _, Nat.lt_succ_self slot⟩
+  · intro query member
+    have same := List.mem_singleton.mp member
+    subst query
+    exact boolean
+  · intro index
+    simp only [queryCount, gateCount, List.filter_cons, List.filter_nil,
+      Bool.and_eq_true, beq_iff_eq]
+    split
+    · rename_i selected
+      rw [selected.2]
+      exact Nat.le_refl 1
+    · exact Nat.zero_le _
+
+theorem queryParts_cons (slot : Nat) (gate : G) (message : List G) (queries : List (List G)) :
+    queryParts slot gate (message :: queries) =
+      ⟨slot, gate, message⟩ :: queryParts (slot + 1) gate queries := by
+  simp [queryParts, List.mapIdx_cons, Nat.add_comm, Nat.add_left_comm]
+
+theorem QuerySlots.indexed (gate : G) (slot : Nat) (queries : List (List G))
+    (boolean : booleanConstraint gate = 0) :
+    QuerySlots gate slot (slot + queries.length) (queryParts slot gate queries) := by
+  induction queries generalizing slot with
+  | nil => exact QuerySlots.empty gate slot
+  | cons message queries ih =>
+    rw [queryParts_cons]
+    have result := (QuerySlots.single gate slot message boolean).append (ih (slot + 1))
+    simpa only [List.singleton_append, List.length_cons, Nat.add_assoc,
+      Nat.add_comm 1 queries.length] using result
+
+theorem fold_lookup_start (emissions : List BlockEmission) (start : Nat) :
+    start ≤ emissions.foldl (fun current emission => max current emission.lookup) start := by
+  induction emissions generalizing start with
+  | nil => exact Nat.le_refl _
+  | cons emission emissions ih =>
+    exact Nat.le_trans (Nat.le_max_left start emission.lookup) (ih _)
+
+theorem fold_lookup_member {emissions : List BlockEmission} {emission : BlockEmission}
+    (member : emission ∈ emissions) (start : Nat) :
+    emission.lookup ≤ emissions.foldl (fun current emission => max current emission.lookup) start := by
+  induction emissions generalizing start with
+  | nil => cases member
+  | cons head rest ih =>
+    rcases List.mem_cons.mp member with equal | tail
+    · subst emission
+      exact Nat.le_trans (Nat.le_max_right start head.lookup) (fold_lookup_start rest _)
+    · exact ih tail _
+
+theorem gateCount_list (gates : List G) : (gates.map gateCount).sum = gates.count 1 := by
+  induction gates with
+  | nil => rfl
+  | cons gate gates ih =>
+    by_cases active : gate = 1
+    · subst gate
+      simp [gateCount, ih, List.count_cons_self, Nat.add_comm]
+    · simp [gateCount, active, ih]
+
+theorem selector_gateCount {gates : List G}
+    (individual : ∀ gate ∈ gates, booleanConstraint gate = 0)
+    (bounded : gates.length < gSize.toNat)
+    (combined : booleanConstraint (selectorSum gates) = 0) :
+    gates.count 1 = gateCount (selectorSum gates) := by
+  have count := selectorSum_n_eq_count
+    (fun gate member => G.boolean_of_constraint (individual gate member)) bounded
+  rcases G.boolean_of_constraint combined with inactive | active
+  · rw [inactive, gateCount_zero]
+    exact count.symm.trans (congrArg G.n inactive)
+  · rw [active]
+    exact count.symm.trans (congrArg G.n active)
+
+theorem queryCount_flatMap_le {α : Type} {source : List α} {emissions : List BlockEmission}
+    (gate : α → G) (start : Nat)
+    (related : List.Forall₂ (fun item emission =>
+      QuerySlots (gate item) start emission.lookup emission.queries) source emissions) (slot : Nat) :
+    queryCount (emissions.flatMap (·.queries)) slot ≤ ((source.map gate).map gateCount).sum := by
+  induction related with
+  | nil => exact Nat.le_refl 0
+  | @cons item emission items emissions first rest ih =>
+    simp only [List.flatMap_cons, queryCount_append, List.map_cons, List.sum_cons]
+    exact Nat.add_le_add (first.count slot) ih
+
+theorem forall₂_right_member {α β : Type} {source : List α} {target : List β}
+    {relation : α → β → Prop} (related : List.Forall₂ relation source target)
+    {item : β} (member : item ∈ target) : ∃ original ∈ source, relation original item := by
+  induction related with
+  | nil => cases member
+  | @cons head result heads results first rest ih =>
+    rcases List.mem_cons.mp member with equal | tail
+    · subst item
+      exact ⟨head, List.mem_cons_self, first⟩
+    · obtain ⟨original, present, evidence⟩ := ih tail
+      exact ⟨original, List.mem_cons_of_mem _ present, evidence⟩
+
+theorem QuerySlots.join {α : Type} {source : List α} {emissions : List BlockEmission}
+    (gate : α → G) (parent : G) (values : Array RowValue) (column lookup : Nat)
+    (related : List.Forall₂ (fun item emission =>
+      QuerySlots (gate item) lookup emission.lookup emission.queries) source emissions)
+    (count : (source.map gate).count 1 ≤ gateCount parent) :
+    QuerySlots parent lookup (joinBlockEmissions values column lookup emissions).lookup
+      (joinBlockEmissions values column lookup emissions).queries := by
+  refine ⟨fold_lookup_start emissions lookup, ?_, ?_, ?_⟩
+  · intro query member
+    obtain ⟨emission, emissionMember, queryMember⟩ := List.mem_flatMap.mp member
+    obtain ⟨item, _, evidence⟩ := forall₂_right_member related emissionMember
+    have range := evidence.range query queryMember
+    exact ⟨range.1, Nat.lt_of_lt_of_le range.2 (fold_lookup_member emissionMember lookup)⟩
+  · intro query member
+    obtain ⟨emission, emissionMember, queryMember⟩ := List.mem_flatMap.mp member
+    obtain ⟨item, _, evidence⟩ := forall₂_right_member related emissionMember
+    exact evidence.boolean query queryMember
+  · intro slot
+    have bounded := queryCount_flatMap_le gate lookup related slot
+    rw [gateCount_list] at bounded
+    exact Nat.le_trans bounded count
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/Quotient.lean b/Ix/Aiur/Proofs/Quotient.lean
new file mode 100644
index 000000000..345a0e987
--- /dev/null
+++ b/Ix/Aiur/Proofs/Quotient.lean
@@ -0,0 +1,114 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.QuotientAlgebra
+import Ix.Aiur.Proofs.Selectors
+
+/-! Checked coordinate pairing and the exact out-of-domain equality.
+This reflects arithmetic only; commitment binding and low-degree extraction
+remain distinct obligations before the equality implies trace constraints.
+-/
+
+namespace Aiur.NativeAIR.Quotient
+
+open ProofCodec (Extension)
+open LogUp (Coordinates)
+
+theorem coefficients_flatten (pairs : List (Coordinates Extension)) :
+    coefficients (Coordinates.flatten pairs) =
+      some (pairs.map fun pair => pair.c0 + pair.c1 * Extension.basis) := by
+  induction pairs with
+  | nil => rfl
+  | cons pair pairs ih =>
+    simp only [Coordinates.flatten, List.flatMap_cons, List.cons_append, List.nil_append,
+      List.map_cons] at *
+    simp only [coefficients, ih, bind, pure, Option.bind_some]
+
+theorem coefficients_success {row values : List Extension} (accepted : coefficients row = some values) :
+    ∃ pairs : List (Coordinates Extension), row = Coordinates.flatten pairs ∧
+      values = pairs.map (fun pair => pair.c0 + pair.c1 * Extension.basis) := by
+  induction row using coefficients.induct generalizing values with
+  | case1 => cases accepted; exact ⟨[], rfl, rfl⟩
+  | case2 first => cases accepted
+  | case3 first second rest ih =>
+    simp only [coefficients, bind, pure, Option.bind_eq_some_iff, Option.some.injEq] at accepted
+    obtain ⟨tail, tailRead, rfl⟩ := accepted
+    obtain ⟨pairs, restEqual, tailEqual⟩ := ih tailRead
+    refine ⟨⟨first, second⟩ :: pairs, ?_, ?_⟩
+    · simp only [Coordinates.flatten, List.flatMap_cons, List.cons_append, List.nil_append] at *
+      rw [restEqual]
+    · rw [tailEqual]; rfl
+
+theorem coefficients_length {row values : List Extension} (accepted : coefficients row = some values) :
+    row.length = 2 * values.length := by
+  obtain ⟨pairs, rfl, rfl⟩ := coefficients_success accepted
+  rw [Coordinates.flatten_length, List.length_map]
+
+theorem coefficients_defined (row : List Extension) (even : row.length % 2 = 0) :
+    ∃ values, coefficients row = some values := by
+  induction row using coefficients.induct with
+  | case1 => exact ⟨[], rfl⟩
+  | case2 first => simp only [List.length_cons, List.length_nil] at even; omega
+  | case3 first second rest ih =>
+    have tailEven : rest.length % 2 = 0 := by
+      simp only [List.length_cons] at even
+      omega
+    obtain ⟨tail, read⟩ := ih tailEven
+    exact ⟨(first + second * Extension.basis) :: tail, by
+      simp only [coefficients, read, bind, pure, Option.bind_some]⟩
+
+theorem coefficients_defined_iff (row : List Extension) :
+    (∃ values, coefficients row = some values) ↔ row.length % 2 = 0 := by
+  constructor
+  · rintro ⟨values, accepted⟩
+    rw [coefficients_length accepted]
+    omega
+  · exact coefficients_defined row
+
+theorem evaluate_success (domain : Domain.Subgroup) (point : Extension) {row : List Extension} {value : Extension}
+    (accepted : evaluate domain point row = some value) :
+    ∃ values, coefficients row = some values ∧
+      value = horner (point ^ Domain.size domain) values := by
+  simp only [evaluate, bind, pure, Option.bind_eq_some_iff, Option.some.injEq] at accepted
+  obtain ⟨values, read, rfl⟩ := accepted
+  exact ⟨values, read, by rw [Extension.power_eq]⟩
+
+theorem evaluate_powers (domain : Domain.Subgroup) (point : Extension) {row : List Extension} {value : Extension}
+    (accepted : evaluate domain point row = some value) :
+    ∃ pairs : List (Coordinates Extension), row = Coordinates.flatten pairs ∧
+      value = LogUp.sum ((pairs.zipIdx).map fun (pair, index) =>
+        point ^ (Domain.size domain * index) * (pair.c0 + pair.c1 * Extension.basis)) := by
+  obtain ⟨values, read, rfl⟩ := evaluate_success domain point accepted
+  obtain ⟨pairs, rowEqual, rfl⟩ := coefficients_success read
+  refine ⟨pairs, rowEqual, ?_⟩
+  have powers := horner_powers (point ^ Domain.size domain)
+    (pairs.map fun pair => pair.c0 + pair.c1 * Extension.basis) 0
+  simp only [Lean.Grind.Semiring.pow_zero, Lean.Grind.Semiring.one_mul] at powers
+  rw [powers]
+  simp only [List.zipIdx_map, List.map_map, Function.comp_def, Domain.Algebra.power_mul,
+    Prod.map, id]
+
+theorem check_true_iff (domain : Domain.Subgroup) (point alpha : Extension) (constraints row : List Extension) :
+    check domain point alpha constraints row = some true ↔
+      Domain.vanishing domain point ≠ 0 ∧ ∃ values, coefficients row = some values ∧
+        composition alpha constraints =
+          Domain.vanishing domain point * horner (point ^ Domain.size domain) values := by
+  constructor
+  · intro accepted
+    simp only [check, bind, pure, Option.bind_eq_some_iff, Option.some.injEq, beq_iff_eq] at accepted
+    obtain ⟨selected, selectorsRead, value, valueRead, equal⟩ := accepted
+    have invert := (Domain.selectors_success domain point selected selectorsRead).2.2.2
+    obtain ⟨values, read, valueEqual⟩ := evaluate_success domain point valueRead
+    refine ⟨(Domain.selectors_defined_iff _ _).mp ⟨selected, selectorsRead⟩, values, read, ?_⟩
+    rw [← valueEqual]
+    exact (inverse_check _ _ _ _ invert).mp equal
+  · rintro ⟨nonzero, values, read, identity⟩
+    obtain ⟨selected, selectorsRead⟩ := Domain.selectors_defined domain point nonzero
+    have invert := (Domain.selectors_success domain point selected selectorsRead).2.2.2
+    have equal := (inverse_check _ _ _ _ invert).mpr identity
+    simp only [check, selectorsRead, evaluate, read, bind, pure, Option.bind_some,
+      Extension.power_eq, equal, beq_self_eq_true]
+
+end Aiur.NativeAIR.Quotient
diff --git a/Ix/Aiur/Proofs/QuotientAlgebra.lean b/Ix/Aiur/Proofs/QuotientAlgebra.lean
new file mode 100644
index 000000000..e39a36a1d
--- /dev/null
+++ b/Ix/Aiur/Proofs/QuotientAlgebra.lean
@@ -0,0 +1,93 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Quotient
+import Ix.Aiur.Proofs.SelectorAlgebra
+import Ix.Aiur.Proofs.LogUpAlgebra
+
+/-! The two Horner conventions used by the native verifier: quotient
+coefficients in ascending powers and constraints in descending powers.
+-/
+
+namespace Aiur.NativeAIR.Quotient
+
+open Lean.Grind
+variable {W : Type} [CommRing W]
+
+theorem horner_nil (point : W) : horner point [] = 0 := rfl
+
+theorem horner_cons (point first : W) (rest : List W) :
+    horner point (first :: rest) = first + point * horner point rest := rfl
+
+theorem horner_append (point : W) (left right : List W) :
+    horner point (left ++ right) = horner point left + point ^ left.length * horner point right := by
+  induction left with
+  | nil => simp only [List.nil_append, List.length_nil, horner_nil, Semiring.pow_zero]; grind
+  | cons first rest ih =>
+    simp only [List.cons_append, horner_cons, ih, List.length_cons, Semiring.pow_succ]
+    grind
+
+theorem horner_powers (point : W) (values : List W) (offset : Nat) :
+    point ^ offset * horner point values =
+      LogUp.sum ((values.zipIdx offset).map fun (value, index) => point ^ index * value) := by
+  induction values generalizing offset with
+  | nil => simp only [horner_nil, Semiring.mul_zero, List.zipIdx_nil, List.map_nil, LogUp.sum, List.foldr_nil]
+  | cons first rest ih =>
+    simp only [horner_cons, List.zipIdx_cons, List.map_cons, LogUp.sum, List.foldr_cons]
+    have tail := ih (offset + 1)
+    rw [Semiring.pow_succ] at tail
+    simp only [LogUp.sum] at tail
+    grind
+
+theorem composition_from (point initial : W) (values : List W) :
+    values.foldl (fun accumulated value => accumulated * point + value) initial =
+      initial * point ^ values.length + horner point values.reverse := by
+  induction values generalizing initial with
+  | nil => simp only [List.foldl_nil, List.length_nil, List.reverse_nil, horner_nil, Semiring.pow_zero]; grind
+  | cons first rest ih =>
+    simp only [List.foldl_cons, ih, List.length_cons, List.reverse_cons, horner_append,
+      List.length_reverse, horner_cons, horner_nil, Semiring.pow_succ]
+    grind
+
+theorem composition_horner (point : W) (values : List W) : composition point values = horner point values.reverse := by
+  rw [composition, composition_from, Semiring.zero_mul]
+  grind
+
+theorem composition_order (point : W) (values : List W) :
+    composition point values =
+      LogUp.sum ((values.reverse.zipIdx).map fun (value, index) => point ^ index * value) := by
+  rw [composition_horner]
+  have powers := horner_powers point values.reverse 0
+  simpa only [Semiring.pow_zero, Semiring.one_mul] using powers
+
+theorem composition_append (point : W) (user lookup : List W) :
+    composition point (user ++ lookup) =
+      composition point user * point ^ lookup.length + composition point lookup := by
+  rw [composition, List.foldl_append, composition_from, ← composition_horner]
+  rfl
+
+theorem composition_zero (point : W) (values : List W) (zero : ∀ value ∈ values, value = 0) :
+    composition point values = 0 := by
+  rw [composition_horner]
+  suffices h : ∀ values : List W, (∀ value ∈ values, value = 0) → horner point values = 0 from
+    h values.reverse (by simpa only [List.mem_reverse] using zero)
+  intro values zero
+  induction values with
+  | nil => rfl
+  | cons first rest ih =>
+    rw [horner_cons, zero first (by simp), ih (fun value member => zero value (by simp [member]))]
+    grind
+
+theorem inverse_check (vanishing inverse composition quotient : W) (cancel : vanishing * inverse = 1) :
+    composition * inverse = quotient ↔ composition = vanishing * quotient := by
+  constructor
+  · intro accepted
+    have multiplied := congrArg (fun value => vanishing * value) accepted
+    grind
+  · intro identity
+    rw [identity]
+    grind
+
+end Aiur.NativeAIR.Quotient
diff --git a/Ix/Aiur/Proofs/Renaming.lean b/Ix/Aiur/Proofs/Renaming.lean
new file mode 100644
index 000000000..ac1117f3d
--- /dev/null
+++ b/Ix/Aiur/Proofs/Renaming.lean
@@ -0,0 +1,284 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Compiler.Dedup
+import Ix.Aiur.Semantics.BytecodeEval
+
+/-! Exact successful-execution equivalence under checked function renaming.
+The relation retains memory, I/O and the early-return escape channel. -/
+
+namespace Aiur.Bytecode.Eval
+
+/-- Function renaming preserves the call domain, every rewritten body and
+the input arity. It may merge multiple old functions into one target. -/
+structure RenamedCode (a b : Toplevel) (rename : FunIdx → FunIdx) : Prop where
+  domain : ∀ i, i < a.functions.size ↔ rename i < b.functions.size
+  body : ∀ i (ha : i < a.functions.size) (hb : rename i < b.functions.size),
+    rewriteBlock rename a.functions[i].body = b.functions[rename i].body
+  inputSize : ∀ i (ha : i < a.functions.size) (hb : rename i < b.functions.size),
+    a.functions[i].layout.inputSize = b.functions[rename i].layout.inputSize
+
+/-- Errors may contain function indices changed by renaming. Successful
+results and the evaluator's early-return channel retain their full values. -/
+def returnObservation : BytecodeError → Option (Array G × EvalState)
+  | .earlyReturn outs st => some (outs, st)
+  | _ => none
+
+def observe (result : Except BytecodeError α) : Except (Option (Array G × EvalState)) α :=
+  result.mapError returnObservation
+
+theorem observe_ok_iff {result : Except BytecodeError α} {value : α} :
+    observe result = .ok value ↔ result = .ok value := by
+  cases result <;> simp [observe, Except.mapError]
+
+theorem observe_bind {x y : Except BytecodeError α}
+    (h : observe x = observe y) {f g : α → Except BytecodeError β}
+    (hf : ∀ value, observe (f value) = observe (g value)) :
+    observe (match x with | .error e => .error e | .ok value => f value) =
+      observe (match y with | .error e => .error e | .ok value => g value) := by
+  cases x <;> cases y <;> simp_all [observe, Except.mapError]
+
+theorem observe_pairBind {x y : Except BytecodeError (Array G × EvalState)}
+    (h : observe x = observe y) {f g : Array G → EvalState → Except BytecodeError β}
+    (hf : ∀ outs st, observe (f outs st) = observe (g outs st)) :
+    observe (match x with | .error e => .error e | .ok (outs, st) => f outs st) =
+      observe (match y with | .error e => .error e | .ok (outs, st) => g outs st) := by
+  cases x <;> cases y <;> simp_all [observe, Except.mapError]
+
+private def finishCall (st : EvalState) (outputSize : Nat)
+    (result : Except BytecodeError (Array G × EvalState)) : Except BytecodeError EvalState :=
+  match result with
+  | .error (.earlyReturn outs innerSt) | .ok (outs, innerSt) =>
+    if outs.size != outputSize then .error .callOutputSizeMismatch
+    else .ok (appendMap (setIoBuffer { st with memory := innerSt.memory } innerSt.ioBuffer) outs)
+  | .error e => .error e
+
+private def finishObservedCall (st : EvalState) (outputSize : Nat)
+    (result : Except (Option (Array G × EvalState)) (Array G × EvalState)) :
+    Except (Option (Array G × EvalState)) EvalState :=
+  match result with
+  | .error (some (outs, innerSt)) | .ok (outs, innerSt) =>
+    if outs.size != outputSize then .error none
+    else .ok (appendMap (setIoBuffer { st with memory := innerSt.memory } innerSt.ioBuffer) outs)
+  | .error none => .error none
+
+private theorem observe_finishCall (st : EvalState) (outputSize : Nat)
+    (result : Except BytecodeError (Array G × EvalState)) :
+    observe (finishCall st outputSize result) =
+      finishObservedCall st outputSize (observe result) := by
+  cases result with
+  | ok value =>
+    rcases value with ⟨outs, innerSt⟩
+    by_cases h : outs.size != outputSize <;>
+      simp [finishCall, finishObservedCall, observe, Except.mapError, returnObservation, h]
+  | error error =>
+    cases error <;> try rfl
+    case earlyReturn outs innerSt =>
+      by_cases h : outs.size != outputSize <;>
+        simp [finishCall, finishObservedCall, observe, Except.mapError, returnObservation, h]
+
+private theorem ops_lt (b : Block) : sizeOf b.ops < sizeOf b := by
+  cases b; simp; omega
+
+private theorem ctrl_lt (b : Block) : sizeOf b.ctrl < sizeOf b := by
+  cases b; simp; omega
+
+private theorem case_lt (cases : Array (G × Block)) (fallback : Option Block)
+    (i : Nat) (h : i < cases.size) :
+    sizeOf cases[i].2 < sizeOf cases + sizeOf fallback := by
+  have h1 := Array.sizeOf_get cases i h
+  have h2 : sizeOf cases[i].2 < sizeOf cases[i] := by
+    cases cases[i]; simp; omega
+  omega
+
+mutual
+
+theorem evalOp_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (fuel : Nat) (op : Op) (st : EvalState) :
+    observe (evalOp a fuel op st) = observe (evalOp b fuel (rewriteOp rename op) st) := by
+  cases op <;> simp only [rewriteOp, evalOp]
+  all_goals try rfl
+  case call fi args outputSize unconstrained =>
+    cases hg : readIdxs st args with
+    | error e => rfl
+    | ok gs =>
+      simp only [bind, Except.bind]
+      by_cases ha : fi < a.functions.size
+      · have hb := (code.domain fi).mp ha
+        simp only [dif_pos ha, dif_pos hb, code.inputSize fi ha hb]
+        split
+        · rfl
+        · cases fuel with
+          | zero => rfl
+          | succ fuel =>
+            change observe (finishCall st outputSize (evalBlock a fuel a.functions[fi].body _)) =
+              observe (finishCall st outputSize (evalBlock b fuel b.functions[rename fi].body _))
+            rw [observe_finishCall, observe_finishCall,
+              ← code.body fi ha hb, evalBlock_renamed code]
+      · have hb : ¬ rename fi < b.functions.size := by simpa [← code.domain fi] using ha
+        simp only [dif_neg ha, dif_neg hb]
+        rfl
+termination_by (fuel, sizeOf op, 0)
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem runOps_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (fuel : Nat) (ops : Array Op) (st : EvalState) (i : Nat) :
+    observe (runOps a fuel ops st i) =
+      observe (runOps b fuel (ops.map (rewriteOp rename)) st i) := by
+  rw [runOps.eq_1 a, runOps.eq_1 b]
+  simp only [Array.size_map]
+  by_cases h : i < ops.size
+  · simp only [dif_pos h, Array.getElem_map]
+    have related := observe_bind (f := fun st' => runOps a fuel ops st' (i + 1))
+      (g := fun st' => runOps b fuel (ops.map (rewriteOp rename)) st' (i + 1))
+      (evalOp_renamed code fuel ops[i] st) (fun st' => runOps_renamed code fuel ops st' (i + 1))
+    cases hleft : evalOp a fuel ops[i] st <;>
+      cases hright : evalOp b fuel (rewriteOp rename ops[i]) st <;>
+      simpa only [hleft, hright] using related
+  · simp only [dif_neg h]
+termination_by (fuel, sizeOf ops, 1 + (ops.size - i))
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem evalBlock_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (fuel : Nat) (block : Block) (st : EvalState) :
+    observe (evalBlock a fuel block st) =
+      observe (evalBlock b fuel (rewriteBlock rename block) st) := by
+  rw [evalBlock.eq_1 a, evalBlock.eq_1 b]
+  simp only [rewriteBlock]
+  have related := observe_bind (f := fun st' => evalCtrl a fuel block.ctrl st')
+    (g := fun st' => evalCtrl b fuel (rewriteCtrl rename block.ctrl) st')
+    (runOps_renamed code fuel block.ops st 0) (fun st' => evalCtrl_renamed code fuel block.ctrl st')
+  cases hleft : runOps a fuel block.ops st 0 <;>
+    cases hright : runOps b fuel (block.ops.map (rewriteOp rename)) st 0 <;>
+    simpa only [hleft, hright] using related
+termination_by (fuel, sizeOf block, 4)
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (apply Prod.Lex.right; apply Prod.Lex.left; exact ops_lt _)
+    | (apply Prod.Lex.right; apply Prod.Lex.left; exact ctrl_lt _)
+    | omega
+
+theorem evalCtrl_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (fuel : Nat) (ctrl : Ctrl) (st : EvalState) :
+    observe (evalCtrl a fuel ctrl st) =
+      observe (evalCtrl b fuel (rewriteCtrl rename ctrl) st) := by
+  cases ctrl with
+  | «return» sel outs => simp only [rewriteCtrl, evalCtrl]
+  | «yield» sel outs => simp only [rewriteCtrl, evalCtrl]
+  | «match» idx cases fallback =>
+    rw [rewriteCtrl.eq_def]
+    simp only [evalCtrl]
+    cases readIdx st idx with
+    | error e => rfl
+    | ok scrut =>
+      cases fallback <;>
+        simpa only [Option.map] using evalMatchArm_renamed code fuel cases _ scrut st 0
+  | matchContinue idx cases fallback out aux lookups cont =>
+    rw [rewriteCtrl.eq_def]
+    simp only [evalCtrl]
+    cases readIdx st idx with
+    | error e => rfl
+    | ok scrut =>
+      cases fallback
+      all_goals
+        with_unfolding_all
+          apply observe_pairBind
+            (f := fun outs st' => evalBlock a fuel cont { st' with map := st.map ++ outs })
+            (g := fun outs st' => evalBlock b fuel (rewriteBlock rename cont)
+              { st' with map := st.map ++ outs })
+            (evalMatchArm_renamed code fuel cases _ scrut st 0)
+      all_goals intro outs st'
+      all_goals exact evalBlock_renamed code fuel cont _
+termination_by (fuel, sizeOf ctrl, 3)
+decreasing_by all_goals first | decreasing_tactic | omega
+
+theorem evalMatchArm_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (fuel : Nat) (cases : Array (G × Block))
+    (fallback : Option Block) (scrut : G) (st : EvalState) (i : Nat) :
+    observe (evalMatchArm a fuel cases fallback scrut st i) =
+      observe (evalMatchArm b fuel
+        (cases.attach.map fun pair => (pair.val.1, rewriteBlock rename pair.val.2))
+        (fallback.map (rewriteBlock rename)) scrut st i) := by
+  rw [evalMatchArm.eq_1 a, evalMatchArm.eq_1 b]
+  simp only [Array.size_map, Array.size_attach]
+  by_cases h : i < cases.size
+  · simp only [dif_pos h, Array.getElem_map, Array.getElem_attach]
+    split
+    · exact evalBlock_renamed code fuel cases[i].2 st
+    · exact evalMatchArm_renamed code fuel cases fallback scrut st (i + 1)
+  · simp only [dif_neg h]
+    exact evalDefaultBlock_renamed code fuel fallback st
+termination_by (fuel, sizeOf cases + sizeOf fallback, 2 + (cases.size - i))
+decreasing_by
+  all_goals
+    clean_wf
+    first
+    | decreasing_tactic
+    | (apply Prod.Lex.right; apply Prod.Lex.left; exact case_lt cases fallback i ‹_›)
+    | (apply Prod.Lex.right; apply Prod.Lex.left
+       cases cases; simp; omega)
+    | omega
+
+theorem evalDefaultBlock_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (fuel : Nat) (fallback : Option Block) (st : EvalState) :
+    observe (evalDefaultBlock a fuel fallback st) =
+      observe (evalDefaultBlock b fuel (fallback.map (rewriteBlock rename)) st) := by
+  cases fallback with
+  | none => simp only [Option.map, evalDefaultBlock]
+  | some block => simpa only [Option.map, evalDefaultBlock] using evalBlock_renamed code fuel block st
+termination_by (fuel, sizeOf fallback, 1)
+decreasing_by all_goals first | decreasing_tactic | (simp_wf; omega)
+
+end
+
+private def finishFunction (result : Except BytecodeError (Array G × EvalState)) :
+    Except BytecodeError (Array G × IOBuffer) :=
+  match result with
+  | .error (.earlyReturn outs st) | .ok (outs, st) => .ok (outs, st.ioBuffer)
+  | .error error => .error error
+
+private def finishObservedFunction
+    (result : Except (Option (Array G × EvalState)) (Array G × EvalState)) :
+    Except (Option (Array G × EvalState)) (Array G × IOBuffer) :=
+  match result with
+  | .error (some (outs, st)) | .ok (outs, st) => .ok (outs, st.ioBuffer)
+  | .error none => .error none
+
+private theorem observe_finishFunction (result : Except BytecodeError (Array G × EvalState)) :
+    observe (finishFunction result) = finishObservedFunction (observe result) := by
+  cases result with
+  | ok value => cases value; rfl
+  | error error => cases error <;> rfl
+
+theorem runFunction_renamed {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (function : FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat) :
+    observe (runFunction a function args io fuel) =
+      observe (runFunction b (rename function) args io fuel) := by
+  rw [runFunction.eq_1 a, runFunction.eq_1 b]
+  by_cases ha : function < a.functions.size
+  · have hb := (code.domain function).mp ha
+    simp only [dif_pos ha, dif_pos hb, code.inputSize function ha hb]
+    split
+    · rfl
+    · change observe (finishFunction (evalBlock a fuel a.functions[function].body _)) =
+        observe (finishFunction (evalBlock b fuel b.functions[rename function].body _))
+      rw [observe_finishFunction, observe_finishFunction, ← code.body function ha hb,
+        evalBlock_renamed code]
+  · have hb : ¬ rename function < b.functions.size := by
+      simpa [← code.domain function] using ha
+    simp only [dif_neg ha, dif_neg hb]
+    rfl
+
+/-- Renaming preserves and reflects every successful result and final I/O
+state at the same fuel. Failures may report different function indices. -/
+theorem runFunction_renamed_iff {a b : Toplevel} {rename : FunIdx → FunIdx}
+    (code : RenamedCode a b rename) (function : FunIdx) (args : Array G) (io : IOBuffer) (fuel : Nat)
+    (result : Array G × IOBuffer) :
+    runFunction a function args io fuel = .ok result ↔
+      runFunction b (rename function) args io fuel = .ok result := by
+  rw [← observe_ok_iff, ← observe_ok_iff, runFunction_renamed code]
+
+end Aiur.Bytecode.Eval
diff --git a/Ix/Aiur/Proofs/ReturnGates.lean b/Ix/Aiur/Proofs/ReturnGates.lean
new file mode 100644
index 000000000..d9102f296
--- /dev/null
+++ b/Ix/Aiur/Proofs/ReturnGates.lean
@@ -0,0 +1,214 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.SelectorControl
+
+/-!
+The emitter gates a continuation with its yield sum. Its continuation-link
+equation identifies that sum with the continuation block's selector. These
+definitions retain the distinction on arbitrary field assignments and prove
+that satisfying selector equations identify all return gates with their leaf
+selectors. A nonzero provider's combined message then recovers one return.
+
+Reflection of native argument values and layout remains an obligation. The
+branchless single-writer property and terminal-count bound are explicit.
+-/
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+private theorem return_gate_block_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+/-- Return arguments are gated by the selector passed to the emitter. At a
+continuation this is the yield sum, equal to the block selector only when
+the emitted continuation-link equation is satisfied. -/
+def Ctrl.returnGates (selector : SelIdx → G) (incoming : G) : Ctrl → List G
+  | .return .. => [incoming]
+  | .yield .. => []
+  | .match _ branches fallback =>
+    (branches.attach.toList.flatMap fun ⟨pair, _⟩ =>
+      pair.2.returnGates selector (pair.2.selectorFlow selector).entry) ++
+      (match fallback with
+      | none => []
+      | some block => block.returnGates selector (block.selectorFlow selector).entry)
+  | .matchContinue _ branches fallback _ _ _ continuation =>
+    (branches.attach.toList.flatMap fun ⟨pair, _⟩ =>
+      pair.2.returnGates selector (pair.2.selectorFlow selector).entry) ++
+      (match fallback with
+      | none => []
+      | some block => block.returnGates selector (block.selectorFlow selector).entry) ++
+      continuation.returnGates selector
+        (selectorSum (SelectorFlow.join (branchSelectorFlows selector branches fallback)).yields)
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.returnGates (selector : SelIdx → G) (incoming : G) (block : Block) : List G :=
+  block.ctrl.returnGates selector incoming
+termination_by sizeOf block
+decreasing_by exact return_gate_block_smaller block
+
+end
+
+def branchReturnGates (selector : SelIdx → G) (branches : Array (G × Block))
+    (fallback : Option Block) : List G :=
+  branches.toList.flatMap (fun pair => pair.2.returnGates selector (pair.2.selectorFlow selector).entry) ++
+    fallback.toList.flatMap (fun block => block.returnGates selector (block.selectorFlow selector).entry)
+
+private theorem flatMap_attachWith_val {α β : Type} (items : List α) (p : α → Prop)
+    (h : ∀ item ∈ items, p item) (f : α → List β) :
+    (items.attachWith p h).flatMap (fun item => f item.val) = items.flatMap f := by
+  rw [List.flatMap, List.flatMap, List.attachWith_map_val]
+
+theorem Ctrl.returnGates_match (selector : SelIdx → G) (incoming : G) (index : ValIdx)
+    (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).returnGates selector incoming =
+      branchReturnGates selector branches fallback := by
+  rw [Ctrl.returnGates.eq_def]
+  simp only [branchReturnGates, Array.toList_attach]
+  rw [flatMap_attachWith_val _ _ _ (fun pair : G × Block =>
+    pair.2.returnGates selector (pair.2.selectorFlow selector).entry)]
+  cases fallback <;> simp
+
+theorem Ctrl.returnGates_matchContinue (selector : SelIdx → G) (incoming : G) (index : ValIdx)
+    (branches : Array (G × Block)) (fallback : Option Block)
+    (outputs aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback outputs aux lookups continuation).returnGates selector incoming =
+      branchReturnGates selector branches fallback ++ continuation.returnGates selector
+        (selectorSum (SelectorFlow.join (branchSelectorFlows selector branches fallback)).yields) := by
+  rw [Ctrl.returnGates.eq_def]
+  simp only [branchReturnGates, Array.toList_attach]
+  rw [flatMap_attachWith_val _ _ _ (fun pair : G × Block =>
+    pair.2.returnGates selector (pair.2.selectorFlow selector).entry)]
+  cases fallback <;> simp
+
+private theorem flatMap_congr_mem {α β : Type} (items : List α) (left right : α → List β)
+    (equal : ∀ item ∈ items, left item = right item) : items.flatMap left = items.flatMap right := by
+  rw [List.flatMap, List.flatMap]
+  exact congrArg List.flatten (List.map_congr_left equal)
+
+theorem branchReturnGates_reflects (selector : SelIdx → G) (branches : Array (G × Block))
+    (fallback : Option Block)
+    (casesEqual : ∀ pair ∈ branches.toList,
+      pair.2.returnGates selector (pair.2.selectorFlow selector).entry =
+        (pair.2.selectorFlow selector).returns)
+    (fallbackEqual : ∀ block, fallback = some block →
+      block.returnGates selector (block.selectorFlow selector).entry =
+        (block.selectorFlow selector).returns) :
+    branchReturnGates selector branches fallback =
+      (SelectorFlow.join (branchSelectorFlows selector branches fallback)).returns := by
+  simp only [branchReturnGates, branchSelectorFlows, SelectorFlow.join,
+    List.flatMap_append, List.flatMap_map]
+  congr 1
+  · exact flatMap_congr_mem _ _ _ casesEqual
+  · apply flatMap_congr_mem
+    intro block member
+    exact fallbackEqual block (by simpa using member)
+
+theorem branchSelectorFlows_satisfied (selector : SelIdx → G) (branches : Array (G × Block))
+    (fallback : Option Block)
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied) :
+    (∀ pair ∈ branches.toList, (pair.2.selectorFlow selector).Satisfied) ∧
+      (∀ block, fallback = some block → (block.selectorFlow selector).Satisfied) := by
+  refine ⟨?_, ?_⟩
+  · intro pair member
+    apply SelectorFlow.join_satisfied valid
+    exact List.mem_append_left _ (List.mem_map.mpr ⟨pair, member, rfl⟩)
+  · intro block present
+    apply SelectorFlow.join_satisfied valid
+    apply List.mem_append_right
+    rw [present]
+    exact List.mem_cons_self
+
+mutual
+
+theorem Ctrl.returnGates_reflects (selector : SelIdx → G) (incoming : G) (ctrl : Ctrl)
+    (valid : (ctrl.selectorFlow selector).Satisfied)
+    (linked : incoming = (ctrl.selectorFlow selector).entry) :
+    ctrl.returnGates selector incoming = (ctrl.selectorFlow selector).returns := by
+  cases ctrl with
+  | «return» index values =>
+    rw [Ctrl.returnGates.eq_def, linked, Ctrl.selectorFlow.eq_def]
+    rfl
+  | yield index values => rw [Ctrl.returnGates.eq_def, Ctrl.selectorFlow.eq_def]; rfl
+  | «match» index branches fallback =>
+    rw [Ctrl.selectorFlow_match] at valid ⊢
+    rw [Ctrl.returnGates_match]
+    obtain ⟨casesValid, fallbackValid⟩ :=
+      branchSelectorFlows_satisfied selector branches fallback (SelectorFlow.guard_satisfied valid)
+    apply branchReturnGates_reflects
+    · intro pair member
+      exact Block.returnGates_reflects selector _ pair.2 (casesValid pair member) rfl
+    · intro block present
+      exact Block.returnGates_reflects selector _ block (fallbackValid block present) rfl
+  | matchContinue index branches fallback outputs aux lookups continuation =>
+    rw [Ctrl.selectorFlow_matchContinue] at valid ⊢
+    rw [Ctrl.returnGates_matchContinue]
+    obtain ⟨branchesValid, contValid, link⟩ :=
+      SelectorFlow.continue_satisfied (SelectorFlow.guard_satisfied valid)
+    obtain ⟨casesValid, fallbackValid⟩ := branchSelectorFlows_satisfied selector branches fallback branchesValid
+    change _ ++ _ = _ ++ _
+    congr 1
+    · apply branchReturnGates_reflects
+      · intro pair member
+        exact Block.returnGates_reflects selector _ pair.2 (casesValid pair member) rfl
+      · intro block present
+        exact Block.returnGates_reflects selector _ block (fallbackValid block present) rfl
+    · exact Block.returnGates_reflects selector _ continuation contValid link.symm
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr member); grind)
+
+theorem Block.returnGates_reflects (selector : SelIdx → G) (incoming : G) (block : Block)
+    (valid : (block.selectorFlow selector).Satisfied)
+    (linked : incoming = (block.selectorFlow selector).entry) :
+    block.returnGates selector incoming = (block.selectorFlow selector).returns := by
+  rw [Block.returnGates, Block.selectorFlow] at *
+  exact Ctrl.returnGates_reflects selector incoming block.ctrl valid linked
+termination_by sizeOf block
+decreasing_by exact return_gate_block_smaller block
+
+end
+
+theorem Block.return_message (selector : SelIdx → G) (block : Block) (program : Toplevel)
+    (shape : block.lookupShapes program none = true)
+    (valid : (block.selectorFlow selector).Satisfied)
+    (bounded : (block.selectorFlow selector).returns.length < gSize.toNat)
+    (multiplicity : G) (nonzero : multiplicity ≠ 0)
+    (activity : activityConstraint multiplicity (block.selectorFlow selector).entry = 0)
+    (width : Nat) (branchless : Bool) (parts : List (G × List G))
+    (gates : parts.map Prod.fst = block.returnGates selector (block.selectorFlow selector).entry)
+    (single : branchless = true → parts.length = 1) :
+    ∃ chosen ∈ parts, chosen.1 = 1 ∧
+      padMessage width (slotMessage branchless parts) = padMessage width chosen.2 := by
+  have reflected := block.returnGates_reflects selector _ valid rfl
+  rw [reflected] at gates
+  have empty := block.selectorFlow_yields_empty selector program shape
+  have conservation := (block.selectorFlow_sound selector valid).conservation
+  have active := nonzero_multiplicity_selector_one activity nonzero
+  rw [empty] at conservation
+  change _ = selectorSum (block.selectorFlow selector).returns + 0 at conservation
+  rw [G.add_zero, active] at conservation
+  apply slotMessage_active width branchless single
+  · intro part member
+    apply (block.selectorFlow_sound selector valid).returned part.1
+    rw [← gates]
+    exact List.mem_map.mpr ⟨part, member, rfl⟩
+  · have lengths := congrArg List.length gates
+    simp only [List.length_map] at lengths
+    omega
+  · rw [gates]
+    exact conservation.symm
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/RowCounts.lean b/Ix/Aiur/Proofs/RowCounts.lean
new file mode 100644
index 000000000..d947d4f2b
--- /dev/null
+++ b/Ix/Aiur/Proofs/RowCounts.lean
@@ -0,0 +1,236 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.RowCounts
+import Ix.Aiur.Proofs.CircuitRowExecution
+
+/-! Control counts bound the selector flow of every field assignment.
+The node count also bounds all branch arities and nested continuation joins.
+Consumed yields contribute to the leaf count even after leaving the flow. -/
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+structure ControlCounts.Describes (counts : ControlCounts) (flow : SelectorFlow) : Prop where
+  returned : flow.returns.length = counts.returns
+  yielded : flow.yields.length = counts.yields
+  terminals : counts.returns + counts.yields ≤ counts.leaves
+  leaves : counts.leaves ≤ counts.nodes
+
+theorem ControlCounts.Describes.unguard {counts : ControlCounts} {flow : SelectorFlow}
+    (describes : counts.Describes flow.guard) : counts.Describes flow :=
+  ⟨describes.returned, describes.yielded, describes.terminals, describes.leaves⟩
+
+theorem ControlCounts.sum_describes {counts : List ControlCounts} {flows : List SelectorFlow}
+    (related : List.Forall₂ Describes counts flows) :
+    (sum counts).Describes (SelectorFlow.join flows) := by
+  induction related with
+  | nil => exact ⟨rfl, rfl, Nat.le_refl _, Nat.le_refl _⟩
+  | @cons first firstFlow rest restFlows head tail ih =>
+    obtain ⟨hr, hy, ht, hl⟩ := head
+    obtain ⟨tr, ty, tt, tl⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_⟩ <;>
+      dsimp only [sum, SelectorFlow.join] at * <;>
+      simp only [List.map_cons, List.sum_cons, List.flatMap_cons, List.length_append] at * <;> omega
+
+theorem ControlCounts.branch_describes {counts : List ControlCounts} {flows : List SelectorFlow}
+    (related : List.Forall₂ Describes counts flows) :
+    (branch counts).Describes (SelectorFlow.join flows).guard := by
+  obtain ⟨returned, yielded, terminals, leaves⟩ := sum_describes related
+  exact ⟨returned, yielded, terminals, by change (sum counts).leaves ≤ (sum counts).nodes + 1; omega⟩
+
+theorem ControlCounts.continue_describes {branches continuation : ControlCounts}
+    {branchFlow contFlow : SelectorFlow} (first : branches.Describes branchFlow)
+    (last : continuation.Describes contFlow) :
+    (branches.continue continuation).Describes (branchFlow.continue contFlow).guard := by
+  obtain ⟨fr, fy, ft, fl⟩ := first
+  obtain ⟨lr, ly, lt, ll⟩ := last
+  refine ⟨?_, ly, ?_, ?_⟩
+  · change (branchFlow.returns ++ contFlow.returns).length = _
+    rw [List.length_append, fr, lr]
+    rfl
+  · change branches.returns + continuation.returns + continuation.yields ≤ branches.leaves + continuation.leaves
+    omega
+  · change branches.leaves + continuation.leaves ≤ branches.nodes + continuation.nodes
+    omega
+
+theorem ControlCounts.member_nodes_le {items : List ControlCounts} {item : ControlCounts}
+    (member : item ∈ items) : item.nodes ≤ (sum items).nodes := by
+  induction items with
+  | nil => cases member
+  | cons first rest ih =>
+    rcases List.mem_cons.mp member with equal | member
+    · subst item
+      change first.nodes ≤ first.nodes + (sum rest).nodes
+      omega
+    · have bounded := ih member
+      change item.nodes ≤ first.nodes + (sum rest).nodes
+      omega
+
+theorem ControlCounts.length_le_nodes {items : List ControlCounts}
+    (positive : ∀ item ∈ items, 0 < item.nodes) : items.length ≤ (sum items).nodes := by
+  induction items with
+  | nil => exact Nat.le_refl _
+  | cons first rest ih =>
+    have head := positive first List.mem_cons_self
+    have tail := ih (fun item member => positive item (List.mem_cons_of_mem _ member))
+    change rest.length + 1 ≤ first.nodes + (sum rest).nodes
+    omega
+
+theorem branchControlCounts_all {branches : Array (G × Block)} {fallback : Option Block}
+    (property : ControlCounts → Prop)
+    (casesValid : ∀ pair ∈ branches.toList, property pair.2.controlCounts)
+    (fallbackValid : ∀ block, fallback = some block → property block.controlCounts) :
+    ∀ counts ∈ branchControlCounts branches fallback, property counts := by
+  intro counts member
+  rcases List.mem_append.mp member with first | last
+  · obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp first
+    subst counts
+    exact casesValid pair pairMember
+  · obtain ⟨block, blockMember, equal⟩ := List.mem_map.mp last
+    subst counts
+    exact fallbackValid block (by simpa using blockMember)
+
+theorem branchControlCounts_describes (selector : SelIdx → G)
+    (branches : Array (G × Block)) (fallback : Option Block)
+    (casesValid : ∀ pair ∈ branches.toList, pair.2.controlCounts.Describes (pair.2.selectorFlow selector))
+    (fallbackValid : ∀ block, fallback = some block →
+      block.controlCounts.Describes (block.selectorFlow selector)) :
+    List.Forall₂ ControlCounts.Describes (branchControlCounts branches fallback)
+      (branchSelectorFlows selector branches fallback) := by
+  apply forall₂_append
+  · apply forall₂_map_left
+    exact forall₂_self_map _ _ _ casesValid
+  · apply forall₂_map_left
+    apply forall₂_self_map
+    intro block member
+    exact fallbackValid block (by simpa using member)
+
+theorem branchControlCounts_case_le (branches : Array (G × Block)) (fallback : Option Block)
+    {pair : G × Block} (member : pair ∈ branches.toList) :
+    pair.2.controlCounts.nodes ≤ (ControlCounts.sum (branchControlCounts branches fallback)).nodes :=
+  ControlCounts.member_nodes_le (List.mem_append_left _ (List.mem_map.mpr ⟨pair, member, rfl⟩))
+
+theorem branchControlCounts_default_le (branches : Array (G × Block)) (fallback : Option Block)
+    {block : Block} (present : fallback = some block) :
+    block.controlCounts.nodes ≤ (ControlCounts.sum (branchControlCounts branches fallback)).nodes := by
+  apply ControlCounts.member_nodes_le
+  apply List.mem_append_right
+  rw [present]
+  exact List.mem_cons_self
+
+private theorem counts_spec_block_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+theorem Ctrl.controlCounts_spec (selector : SelIdx → G) (ctrl : Ctrl) :
+    ctrl.controlCounts.Describes (ctrl.selectorFlow selector) ∧
+      0 < ctrl.controlCounts.nodes ∧
+      (ctrl.controlCounts.nodes < gSize.toNat → ctrl.rowBounds selector) := by
+  cases ctrl with
+  | «return» index values =>
+    rw [Ctrl.controlCounts.eq_def, Ctrl.selectorFlow.eq_def, Ctrl.rowBounds.eq_def]
+    exact ⟨⟨rfl, rfl, Nat.le_refl _, Nat.le_refl _⟩, Nat.zero_lt_succ 0, fun _ => True.intro⟩
+  | yield index values =>
+    rw [Ctrl.controlCounts.eq_def, Ctrl.selectorFlow.eq_def, Ctrl.rowBounds.eq_def]
+    exact ⟨⟨rfl, rfl, Nat.le_refl _, Nat.le_refl _⟩, Nat.zero_lt_succ 0, fun _ => True.intro⟩
+  | «match» index branches fallback =>
+    have casesSpec := fun pair (_ : pair ∈ branches.toList) => Block.controlCounts_spec selector pair.2
+    have defaultSpec := fun block (_ : fallback = some block) => Block.controlCounts_spec selector block
+    have related := branchControlCounts_describes selector branches fallback
+      (fun pair member => (casesSpec pair member).1) (fun block present => (defaultSpec block present).1)
+    have positive := branchControlCounts_all (fun counts => 0 < counts.nodes)
+      (fun pair member => (casesSpec pair member).2.1) (fun block present => (defaultSpec block present).2.1)
+    have arity : branches.size + fallback.toList.length ≤
+        (ControlCounts.sum (branchControlCounts branches fallback)).nodes := by
+      simpa only [branchControlCounts, List.length_append, List.length_map, Array.length_toList]
+        using ControlCounts.length_le_nodes positive
+    rw [Ctrl.controlCounts_match, Ctrl.selectorFlow_match, Ctrl.rowBounds.eq_def]
+    refine ⟨ControlCounts.branch_describes related, by change 0 < _ + 1; omega, ?_⟩
+    intro bounded
+    change (ControlCounts.sum (branchControlCounts branches fallback)).nodes + 1 < gSize.toNat at bounded
+    refine ⟨?_, ?_, ?_⟩
+    · omega
+    · intro pair member
+      apply (casesSpec pair member).2.2
+      have le := branchControlCounts_case_le branches fallback member
+      omega
+    · cases fallback with
+      | none => exact True.intro
+      | some block =>
+        apply (defaultSpec block rfl).2.2
+        have le := branchControlCounts_default_le branches (some block) rfl
+        omega
+  | matchContinue index branches fallback outputs aux lookups continuation =>
+    have casesSpec := fun pair (_ : pair ∈ branches.toList) => Block.controlCounts_spec selector pair.2
+    have defaultSpec := fun block (_ : fallback = some block) => Block.controlCounts_spec selector block
+    have continued := Block.controlCounts_spec selector continuation
+    have related := branchControlCounts_describes selector branches fallback
+      (fun pair member => (casesSpec pair member).1) (fun block present => (defaultSpec block present).1)
+    have positive := branchControlCounts_all (fun counts => 0 < counts.nodes)
+      (fun pair member => (casesSpec pair member).2.1) (fun block present => (defaultSpec block present).2.1)
+    have arity : branches.size + fallback.toList.length ≤
+        (ControlCounts.sum (branchControlCounts branches fallback)).nodes := by
+      simpa only [branchControlCounts, List.length_append, List.length_map, Array.length_toList]
+        using ControlCounts.length_le_nodes positive
+    rw [Ctrl.controlCounts_matchContinue, Ctrl.selectorFlow_matchContinue, Ctrl.rowBounds.eq_def]
+    refine ⟨ControlCounts.continue_describes (ControlCounts.branch_describes related).unguard continued.1,
+      by change 0 < _ + 1 + _; omega, ?_⟩
+    intro bounded
+    change (ControlCounts.sum (branchControlCounts branches fallback)).nodes + 1 +
+      continuation.controlCounts.nodes < gSize.toNat at bounded
+    refine ⟨?_, ?_, ?_, ?_, ?_⟩
+    · omega
+    · obtain ⟨returned, yielded, terminals, leaves⟩ := ControlCounts.sum_describes related
+      rw [returned, yielded]
+      omega
+    · intro pair member
+      apply (casesSpec pair member).2.2
+      have le := branchControlCounts_case_le branches fallback member
+      omega
+    · cases fallback with
+      | none => exact True.intro
+      | some block =>
+        apply (defaultSpec block rfl).2.2
+        have le := branchControlCounts_default_le branches (some block) rfl
+        omega
+    · apply continued.2.2
+      omega
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr ‹_ ∈ _›); grind)
+
+theorem Block.controlCounts_spec (selector : SelIdx → G) (block : Block) :
+    block.controlCounts.Describes (block.selectorFlow selector) ∧
+      0 < block.controlCounts.nodes ∧
+      (block.controlCounts.nodes < gSize.toNat → block.rowBounds selector) := by
+  rw [Block.controlCounts, Block.selectorFlow, Block.rowBounds]
+  exact Ctrl.controlCounts_spec selector block.ctrl
+termination_by sizeOf block
+decreasing_by exact counts_spec_block_smaller block
+
+end
+
+theorem Block.rowBounds_of_controlCounts (selector : SelIdx → G) (block : Block)
+    (bounded : block.controlCounts.nodes < gSize.toNat) : block.rowBounds selector :=
+  (block.controlCounts_spec selector).2.2 bounded
+
+theorem Block.return_bound_of_controlCounts (selector : SelIdx → G) (block : Block)
+    (bounded : block.controlCounts.nodes < gSize.toNat) :
+    (block.selectorFlow selector).returns.length < gSize.toNat := by
+  obtain ⟨returned, _, terminals, leaves⟩ := (block.controlCounts_spec selector).1
+  omega
+
+theorem Block.returns_le_selectors (selector : SelIdx → G) (block : Block) :
+    (block.selectorFlow selector).returns.length ≤ block.controlCounts.leaves := by
+  obtain ⟨returned, _, terminals, _⟩ := (block.controlCounts_spec selector).1
+  omega
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/SelectorAlgebra.lean b/Ix/Aiur/Proofs/SelectorAlgebra.lean
new file mode 100644
index 000000000..c624cdfa6
--- /dev/null
+++ b/Ix/Aiur/Proofs/SelectorAlgebra.lean
@@ -0,0 +1,78 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ExtensionField
+
+/-! Polynomial identities underlying the native domain selectors.
+The divided-power polynomial is symbolic: native evaluation uses the
+checked rational formula away from roots, without enumerating the domain.
+-/
+
+namespace Aiur.NativeAIR.Domain.Algebra
+
+open Lean.Grind
+attribute [local instance] Semiring.natCast Ring.intCast
+
+variable {R : Type} [CommRing R]
+
+theorem power_zero (n : Nat) (positive : 0 < n) : (0 : R) ^ n = 0 := by
+  have successor : n = (n - 1) + 1 := by omega
+  rw [successor, Semiring.pow_succ, Semiring.mul_zero]
+
+theorem power_mul (a : R) (m n : Nat) : a ^ (m * n) = (a ^ m) ^ n := by
+  induction n with
+  | zero => simp only [Nat.mul_zero, Semiring.pow_zero]
+  | succ n ih => rw [Nat.mul_succ, Semiring.pow_add, ih, Semiring.pow_succ]
+
+theorem power_period (a : R) {period : Nat} (order : a ^ period = 1) (n : Nat) :
+    a ^ n = a ^ (n % period) := by
+  conv => lhs; rw [← Nat.mod_add_div n period]
+  rw [Semiring.pow_add, power_mul, order, Semiring.one_pow, Semiring.mul_one]
+
+theorem power_inverse (a inverse : R) (cancel : a * inverse = 1) (n : Nat) :
+    a ^ n * inverse ^ n = 1 := by
+  rw [← CommSemiring.mul_pow, cancel, Semiring.one_pow]
+
+theorem predecessor_inverse (a inverse : R) {n : Nat} (positive : 0 < n)
+    (order : a ^ n = 1) (cancel : a * inverse = 1) : a ^ (n - 1) = inverse := by
+  have successor : n = (n - 1) + 1 := by omega
+  rw [successor, Semiring.pow_succ] at order
+  have multiplied := congrArg (fun x => x * inverse) order
+  grind
+
+/-- `sum (x^(n-1-j) * a^j)`, kept out of runtime initialization. -/
+noncomputable def dividedPowers (x a : R) : Nat → R
+  | 0 => 0
+  | n + 1 => x ^ n + a * dividedPowers x a n
+
+theorem dividedPowers_factor (x a : R) (n : Nat) :
+    (x - a) * dividedPowers x a n = x ^ n - a ^ n := by
+  induction n with
+  | zero => simp only [dividedPowers, Semiring.pow_zero]; grind
+  | succ n ih => rw [dividedPowers, Semiring.pow_succ, Semiring.pow_succ]; grind
+
+theorem dividedPowers_diagonal (a : R) (n : Nat) :
+    dividedPowers a a n = (n : R) * a ^ (n - 1) := by
+  induction n with
+  | zero => simp only [dividedPowers, Semiring.natCast_zero, Semiring.zero_mul]
+  | succ n ih =>
+    rw [dividedPowers, ih, Semiring.natCast_succ]
+    cases n with
+    | zero => simp only [Nat.zero_sub, Nat.add_sub_cancel, Semiring.pow_zero,
+        Semiring.natCast_zero]; grind
+    | succ n => simp only [Nat.add_sub_cancel, Semiring.pow_succ]; grind
+
+theorem root_dividedPowers (x a : R) {n : Nat} (root : a ^ n = 1) :
+    (x - a) * dividedPowers x a n = x ^ n - 1 := by
+  rw [dividedPowers_factor, root]
+
+theorem dividedPowers_off_root (x a inverse : R) {n : Nat}
+    (root : a ^ n = 1) (cancel : (x - a) * inverse = 1) :
+    (x ^ n - 1) * inverse = dividedPowers x a n := by
+  have factor := root_dividedPowers x a root
+  have multiplied := congrArg (fun z => z * inverse) factor
+  grind
+
+end Aiur.NativeAIR.Domain.Algebra
diff --git a/Ix/Aiur/Proofs/SelectorControl.lean b/Ix/Aiur/Proofs/SelectorControl.lean
new file mode 100644
index 000000000..320ee7959
--- /dev/null
+++ b/Ix/Aiur/Proofs/SelectorControl.lean
@@ -0,0 +1,377 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.SelectorMessages
+import Ix.Aiur.Proofs.LookupShapes
+
+/-!
+Conservation and exclusivity for the selector portion of native control
+constraints, computed over the actual bytecode tree. A continuation consumes
+only its branches' escaping yields; early returns remain function returns.
+The existing shape validator excludes yields escaping an entire function.
+
+Native-expression reflection, value-index and layout correctness, branch
+matching and operation extraction remain separate obligations. The terminal
+count bound is explicit; this module does not assume it follows from syntax.
+-/
+
+namespace Aiur.AIR
+
+/-- Selector-only projection of the native control emitter. `yields` lists
+only yields escaping this block to its nearest enclosing continuation. -/
+structure SelectorFlow where
+  entry : G
+  returns : List G
+  yields : List G
+  equations : List G
+  deriving Repr
+
+def SelectorFlow.guard (flow : SelectorFlow) : SelectorFlow :=
+  { flow with equations := oneSubBooleanConstraint flow.entry :: flow.equations }
+
+def SelectorFlow.join (flows : List SelectorFlow) : SelectorFlow :=
+  ⟨selectorSum (flows.map (·.entry)), flows.flatMap (·.returns),
+    flows.flatMap (·.yields), flows.flatMap (·.equations)⟩
+
+def SelectorFlow.continue (branches continuation : SelectorFlow) : SelectorFlow :=
+  ⟨branches.entry, branches.returns ++ continuation.returns, continuation.yields,
+    branches.equations ++
+      (continuation.entry - selectorSum branches.yields) :: continuation.equations⟩
+
+def SelectorFlow.Satisfied (flow : SelectorFlow) : Prop :=
+  ∀ equation ∈ flow.equations, equation = 0
+
+structure SelectorFlow.Sound (flow : SelectorFlow) : Prop where
+  conservation : flow.entry = selectorSum flow.returns + selectorSum flow.yields
+  returned : ∀ value ∈ flow.returns, booleanConstraint value = 0
+  yielded : ∀ value ∈ flow.yields, booleanConstraint value = 0
+
+theorem SelectorFlow.guard_sound {flow : SelectorFlow} (sound : flow.Sound) : flow.guard.Sound :=
+  ⟨sound.conservation, sound.returned, sound.yielded⟩
+
+theorem SelectorFlow.guard_satisfied {flow : SelectorFlow} (valid : flow.guard.Satisfied) :
+    flow.Satisfied := fun equation member => valid equation (List.mem_cons_of_mem _ member)
+
+theorem SelectorFlow.guard_boolean {flow : SelectorFlow} (valid : flow.guard.Satisfied) :
+    booleanConstraint flow.entry = 0 := by
+  have boolean := G.boolean_of_one_sub_constraint (valid _ List.mem_cons_self)
+  rcases boolean with zero | one
+  · rw [zero]; rfl
+  · rw [one]; rfl
+
+theorem SelectorFlow.join_satisfied {flows : List SelectorFlow} (valid : (join flows).Satisfied) :
+    ∀ flow ∈ flows, flow.Satisfied := by
+  intro flow member equation equationMember
+  exact valid equation (List.mem_flatMap.mpr ⟨flow, member, equationMember⟩)
+
+theorem SelectorFlow.continue_satisfied {branches continuation : SelectorFlow}
+    (valid : (branches.continue continuation).Satisfied) :
+    branches.Satisfied ∧ continuation.Satisfied ∧
+      continuation.entry = selectorSum branches.yields := by
+  refine ⟨?_, ?_, ?_⟩
+  · exact fun equation member => valid _ (List.mem_append_left _ member)
+  · exact fun equation member =>
+      valid _ (List.mem_append_right _ (List.mem_cons_of_mem _ member))
+  · exact (G.sub_eq_zero_iff _ _).mp
+      (valid _ (List.mem_append_right _ List.mem_cons_self))
+
+theorem SelectorFlow.join_sound {flows : List SelectorFlow}
+    (sound : ∀ flow ∈ flows, flow.Sound) : (join flows).Sound := by
+  induction flows with
+  | nil => exact ⟨rfl, by simp [join], by simp [join]⟩
+  | cons flow flows ih =>
+    have head := sound flow List.mem_cons_self
+    have tail := ih (fun flow member => sound flow (List.mem_cons_of_mem _ member))
+    have tailEq := tail.conservation
+    dsimp only [join] at tailEq
+    refine ⟨?_, ?_, ?_⟩
+    · change selectorSum (flow.entry :: flows.map (·.entry)) =
+        selectorSum (flow.returns ++ flows.flatMap (·.returns)) +
+        selectorSum (flow.yields ++ flows.flatMap (·.yields))
+      rw [selectorSum_cons, selectorSum_append, selectorSum_append,
+        head.conservation, tailEq]
+      simp only [G.add_assoc]
+      apply congrArg (selectorSum flow.returns + ·)
+      rw [← G.add_assoc, G.add_comm (selectorSum flow.yields)
+        (selectorSum (flows.flatMap (·.returns))), G.add_assoc]
+    · intro value member
+      change value ∈ flow.returns ++ flows.flatMap (·.returns) at member
+      rcases List.mem_append.mp member with first | last
+      · exact head.returned _ first
+      · exact tail.returned _ last
+    · intro value member
+      change value ∈ flow.yields ++ flows.flatMap (·.yields) at member
+      rcases List.mem_append.mp member with first | last
+      · exact head.yielded _ first
+      · exact tail.yielded _ last
+
+theorem SelectorFlow.continue_sound {branches continuation : SelectorFlow}
+    (first : branches.Sound) (last : continuation.Sound)
+    (link : continuation.entry = selectorSum branches.yields) :
+    (branches.continue continuation).Sound := by
+  refine ⟨?_, ?_, last.yielded⟩
+  · change branches.entry = selectorSum (branches.returns ++ continuation.returns) +
+      selectorSum continuation.yields
+    rw [selectorSum_append, G.add_assoc, ← last.conservation, link, ← first.conservation]
+  · intro value member
+    rcases List.mem_append.mp member with firstMember | lastMember
+    · exact first.returned _ firstMember
+    · exact last.returned _ lastMember
+
+theorem SelectorFlow.Sound.terminal_boolean {flow : SelectorFlow} (sound : flow.Sound) :
+    ∀ value ∈ flow.returns ++ flow.yields, booleanConstraint value = 0 := by
+  intro value member
+  rcases List.mem_append.mp member with returned | yielded
+  · exact sound.returned value returned
+  · exact sound.yielded value yielded
+
+theorem SelectorFlow.Sound.active_terminal {flow : SelectorFlow} (sound : flow.Sound)
+    (bounded : flow.returns.length + flow.yields.length < gSize.toNat)
+    (active : flow.entry = 1) :
+    ∃ before after, flow.returns ++ flow.yields = before ++ 1 :: after ∧
+      ∀ value ∈ before ++ after, value = 0 := by
+  apply selectorSum_active_split sound.terminal_boolean
+    (by simpa only [List.length_append] using bounded)
+  rw [selectorSum_append, ← sound.conservation, active]
+
+theorem SelectorFlow.Sound.inactive_terminal {flow : SelectorFlow} (sound : flow.Sound)
+    (bounded : flow.returns.length + flow.yields.length < gSize.toNat)
+    (inactive : flow.entry = 0) :
+    ∀ value ∈ flow.returns ++ flow.yields, value = 0 := by
+  apply selectorSum_inactive sound.terminal_boolean
+    (by simpa only [List.length_append] using bounded)
+  rw [selectorSum_append, ← sound.conservation, inactive]
+
+theorem SelectorFlow.Sound.return_stops_continuation {flow : SelectorFlow} (sound : flow.Sound)
+    (bounded : flow.returns.length + flow.yields.length < gSize.toNat)
+    (active : flow.entry = 1) (returned : (1 : G) ∈ flow.returns) :
+    selectorSum flow.yields = 0 := by
+  have count := selectorSum_active_count sound.terminal_boolean
+    (by simpa only [List.length_append] using bounded)
+    (show selectorSum (flow.returns ++ flow.yields) = 1 by
+      rw [selectorSum_append, ← sound.conservation, active])
+  have positive := List.count_pos_iff.mpr returned
+  rw [List.count_append] at count
+  have noYields : flow.yields.count 1 = 0 := by omega
+  rw [selectorSum_eq_count _ (fun value member =>
+    G.boolean_of_constraint (sound.yielded value member)), noYields]
+  rfl
+
+theorem SelectorFlow.Sound.yield_starts_continuation {flow : SelectorFlow} (sound : flow.Sound)
+    (bounded : flow.returns.length + flow.yields.length < gSize.toNat)
+    (active : flow.entry = 1) (yielded : (1 : G) ∈ flow.yields) :
+    selectorSum flow.yields = 1 := by
+  have count := selectorSum_active_count sound.terminal_boolean
+    (by simpa only [List.length_append] using bounded)
+    (show selectorSum (flow.returns ++ flow.yields) = 1 by
+      rw [selectorSum_append, ← sound.conservation, active])
+  have positive := List.count_pos_iff.mpr yielded
+  rw [List.count_append] at count
+  have oneYield : flow.yields.count 1 = 1 := by omega
+  rw [selectorSum_eq_count _ (fun value member =>
+    G.boolean_of_constraint (sound.yielded value member)), oneYield]
+  rfl
+
+end Aiur.AIR
+
+namespace Aiur.Bytecode
+open Aiur.AIR
+
+private theorem selector_block_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def Ctrl.selectorFlow (selector : SelIdx → G) : Ctrl → SelectorFlow
+  | .return index _ => (⟨selector index, [selector index], [], []⟩ : SelectorFlow).guard
+  | .yield index _ => (⟨selector index, [], [selector index], []⟩ : SelectorFlow).guard
+  | .match _ branches fallback =>
+    (SelectorFlow.join (
+      (branches.attach.toList.map fun ⟨pair, _⟩ => pair.2.selectorFlow selector) ++
+      (match fallback with | none => [] | some block => [block.selectorFlow selector]))).guard
+  | .matchContinue _ branches fallback _ _ _ continuation =>
+    ((SelectorFlow.join (
+      (branches.attach.toList.map fun ⟨pair, _⟩ => pair.2.selectorFlow selector) ++
+      (match fallback with | none => [] | some block => [block.selectorFlow selector]))).continue
+        (continuation.selectorFlow selector)).guard
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.selectorFlow (selector : SelIdx → G) (block : Block) : SelectorFlow :=
+  block.ctrl.selectorFlow selector
+termination_by sizeOf block
+decreasing_by exact selector_block_smaller block
+
+end
+
+def branchSelectorFlows (selector : SelIdx → G) (branches : Array (G × Block))
+    (fallback : Option Block) : List SelectorFlow :=
+  branches.toList.map (fun pair => pair.2.selectorFlow selector) ++
+    fallback.toList.map (fun block => block.selectorFlow selector)
+
+theorem Ctrl.selectorFlow_match (selector : SelIdx → G) (index : ValIdx)
+    (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).selectorFlow selector =
+      (SelectorFlow.join (branchSelectorFlows selector branches fallback)).guard := by
+  rw [Ctrl.selectorFlow.eq_def]
+  simp only [branchSelectorFlows, Array.toList_attach]
+  rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.selectorFlow selector)]
+  cases fallback <;> rfl
+
+theorem Ctrl.selectorFlow_matchContinue (selector : SelIdx → G) (index : ValIdx)
+    (branches : Array (G × Block)) (fallback : Option Block)
+    (outputs aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback outputs aux lookups continuation).selectorFlow selector =
+      ((SelectorFlow.join (branchSelectorFlows selector branches fallback)).continue
+        (continuation.selectorFlow selector)).guard := by
+  rw [Ctrl.selectorFlow.eq_def]
+  simp only [branchSelectorFlows, Array.toList_attach]
+  rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.selectorFlow selector)]
+  cases fallback <;> rfl
+
+theorem branchSelectorFlows_sound (selector : SelIdx → G) (branches : Array (G × Block))
+    (fallback : Option Block)
+    (valid : (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Satisfied)
+    (casesSound : ∀ pair ∈ branches.toList,
+      (pair.2.selectorFlow selector).Satisfied → (pair.2.selectorFlow selector).Sound)
+    (fallbackSound : ∀ block, fallback = some block →
+      (block.selectorFlow selector).Satisfied → (block.selectorFlow selector).Sound) :
+    (SelectorFlow.join (branchSelectorFlows selector branches fallback)).Sound := by
+  apply SelectorFlow.join_sound
+  intro flow member
+  have flowValid := SelectorFlow.join_satisfied valid flow member
+  rcases List.mem_append.mp member with caseMember | defaultMember
+  · obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp caseMember
+    subst flow
+    exact casesSound pair pairMember flowValid
+  · obtain ⟨block, blockMember, equal⟩ := List.mem_map.mp defaultMember
+    subst flow
+    exact fallbackSound block (by simpa using blockMember) flowValid
+
+mutual
+
+theorem Ctrl.selectorFlow_sound (selector : SelIdx → G) (ctrl : Ctrl)
+    (valid : (ctrl.selectorFlow selector).Satisfied) : (ctrl.selectorFlow selector).Sound := by
+  cases ctrl with
+  | «return» index values =>
+    rw [Ctrl.selectorFlow.eq_def] at valid ⊢
+    have boolean := SelectorFlow.guard_boolean valid
+    exact ⟨by simp only [SelectorFlow.guard,
+        selectorSum, List.foldl_nil, List.foldl_cons, G.add_zero, G.zero_add],
+      fun value member => (List.mem_singleton.mp member).symm ▸ boolean,
+      by simp [SelectorFlow.guard]⟩
+  | yield index values =>
+    rw [Ctrl.selectorFlow.eq_def] at valid ⊢
+    have boolean := SelectorFlow.guard_boolean valid
+    exact ⟨by simp only [SelectorFlow.guard,
+        selectorSum, List.foldl_nil, List.foldl_cons, G.zero_add],
+      by simp [SelectorFlow.guard],
+      fun value member => (List.mem_singleton.mp member).symm ▸ boolean⟩
+  | «match» index branches fallback =>
+    rw [Ctrl.selectorFlow_match] at valid ⊢
+    apply SelectorFlow.guard_sound
+    apply branchSelectorFlows_sound selector branches fallback (SelectorFlow.guard_satisfied valid)
+    · intro pair member satisfied
+      exact Block.selectorFlow_sound selector pair.2 satisfied
+    · intro block present satisfied
+      exact Block.selectorFlow_sound selector block satisfied
+  | matchContinue index branches fallback outputs aux lookups continuation =>
+    rw [Ctrl.selectorFlow_matchContinue] at valid ⊢
+    obtain ⟨branchesValid, continuationValid, link⟩ :=
+      SelectorFlow.continue_satisfied (SelectorFlow.guard_satisfied valid)
+    apply SelectorFlow.guard_sound
+    apply SelectorFlow.continue_sound _ (Block.selectorFlow_sound selector continuation continuationValid) link
+    apply branchSelectorFlows_sound selector branches fallback branchesValid
+    · intro pair member satisfied
+      exact Block.selectorFlow_sound selector pair.2 satisfied
+    · intro block present satisfied
+      exact Block.selectorFlow_sound selector block satisfied
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr ‹_ ∈ _›); grind)
+
+theorem Block.selectorFlow_sound (selector : SelIdx → G) (block : Block)
+    (valid : (block.selectorFlow selector).Satisfied) : (block.selectorFlow selector).Sound := by
+  rw [Block.selectorFlow] at valid ⊢
+  exact Ctrl.selectorFlow_sound selector block.ctrl valid
+termination_by sizeOf block
+decreasing_by exact selector_block_smaller block
+
+end
+
+mutual
+
+theorem Ctrl.selectorFlow_yields_empty (selector : SelIdx → G) (ctrl : Ctrl)
+    (program : Toplevel) (valid : ctrl.lookupShapes program none = true) :
+    (ctrl.selectorFlow selector).yields = [] := by
+  cases ctrl with
+  | «return» index values => rw [Ctrl.selectorFlow.eq_def]; rfl
+  | yield index values => simp only [Ctrl.lookupShapes, reduceCtorEq, beq_iff_eq] at valid
+  | «match» index branches fallback =>
+    obtain ⟨casesValid, fallbackValid⟩ := (lookupShapes_match _ _ _ _ _).mp valid
+    rw [Ctrl.selectorFlow_match]
+    change (branchSelectorFlows selector branches fallback).flatMap (·.yields) = []
+    apply List.flatMap_eq_nil_iff.mpr
+    intro flow member
+    rcases List.mem_append.mp member with caseMember | defaultMember
+    · obtain ⟨pair, pairMember, equal⟩ := List.mem_map.mp caseMember
+      subst flow
+      exact Block.selectorFlow_yields_empty selector pair.2 program (casesValid pair pairMember)
+    · obtain ⟨block, blockMember, equal⟩ := List.mem_map.mp defaultMember
+      subst flow
+      have present : fallback = some block := by simpa using blockMember
+      exact Block.selectorFlow_yields_empty selector block program (fallbackValid block present)
+  | matchContinue index branches fallback outputs aux lookups continuation =>
+    obtain ⟨_, _, contValid⟩ := (lookupShapes_matchContinue _ _ _ _ _ _ _ _ _).mp valid
+    rw [Ctrl.selectorFlow_matchContinue]
+    exact Block.selectorFlow_yields_empty selector continuation program contValid
+termination_by sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem (Array.mem_def.mpr pairMember); grind)
+
+theorem Block.selectorFlow_yields_empty (selector : SelIdx → G) (block : Block)
+    (program : Toplevel) (valid : block.lookupShapes program none = true) :
+    (block.selectorFlow selector).yields = [] := by
+  rw [Block.selectorFlow]
+  rw [Block.lookupShapes, Bool.and_eq_true] at valid
+  exact Ctrl.selectorFlow_yields_empty selector block.ctrl program valid.2
+termination_by sizeOf block
+decreasing_by exact selector_block_smaller block
+
+end
+
+theorem Block.selectorFlow_active_return (selector : SelIdx → G) (block : Block)
+    (program : Toplevel) (shape : block.lookupShapes program none = true)
+    (valid : (block.selectorFlow selector).Satisfied)
+    (bounded : (block.selectorFlow selector).returns.length < gSize.toNat)
+    (active : (block.selectorFlow selector).entry = 1) :
+    ∃ before after, (block.selectorFlow selector).returns = before ++ 1 :: after ∧
+      ∀ value ∈ before ++ after, value = 0 := by
+  have empty := block.selectorFlow_yields_empty selector program shape
+  have sound := block.selectorFlow_sound selector valid
+  have result := sound.active_terminal (by simpa only [empty, List.length_nil, Nat.add_zero] using bounded) active
+  simpa only [empty, List.append_nil] using result
+
+theorem Block.selectorFlow_provider_return (selector : SelIdx → G) (block : Block)
+    (program : Toplevel) (shape : block.lookupShapes program none = true)
+    (valid : (block.selectorFlow selector).Satisfied)
+    (bounded : (block.selectorFlow selector).returns.length < gSize.toNat)
+    (multiplicity : G) (nonzero : multiplicity ≠ 0)
+    (activity : activityConstraint multiplicity (block.selectorFlow selector).entry = 0) :
+    ∃ before after, (block.selectorFlow selector).returns = before ++ 1 :: after ∧
+      ∀ value ∈ before ++ after, value = 0 :=
+  block.selectorFlow_active_return selector program shape valid bounded
+    (nonzero_multiplicity_selector_one activity nonzero)
+
+end Aiur.Bytecode
diff --git a/Ix/Aiur/Proofs/SelectorMessages.lean b/Ix/Aiur/Proofs/SelectorMessages.lean
new file mode 100644
index 000000000..0a5efe53e
--- /dev/null
+++ b/Ix/Aiur/Proofs/SelectorMessages.lean
@@ -0,0 +1,217 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LookupMessages
+import Ix.Aiur.Proofs.LocalConstraints
+
+/-!
+Selector-weighted messages in the native shared lookup slots and continuation
+merges. Adding variable-length messages retains the longer tail; zero padding
+recovers the uniquely selected message without a common raw-length premise.
+
+The field-characteristic bound, selector equations, layout's single-writer
+property and continuation parent activity remain explicit. These lemmas do
+not by themselves reflect the Rust emitter or extract its satisfying rows.
+-/
+
+namespace Aiur.AIR
+
+/-- The native argument combiner adds overlapping fields and retains the
+longer tail, so messages of different lengths share zero-padded slots. -/
+def addMessages : List G → List G → List G
+  | [], right => right
+  | left, [] => left
+  | x :: left, y :: right => (x + y) :: addMessages left right
+
+def scaleMessage (selector : G) (message : List G) : List G :=
+  message.map (selector * ·)
+
+def weightedMessage (parts : List (G × List G)) : List G :=
+  parts.foldl (fun combined part => addMessages combined (scaleMessage part.1 part.2)) []
+
+theorem addMessages_read (left right : List G) (i : Nat) :
+    (addMessages left right)[i]?.getD 0 = left[i]?.getD 0 + right[i]?.getD 0 := by
+  induction left generalizing right i with
+  | nil => simp only [addMessages, List.getElem?_nil, Option.getD_none, G.zero_add]
+  | cons value left ih =>
+    cases right with
+    | nil => simp only [addMessages, List.getElem?_nil, Option.getD_none, G.add_zero]
+    | cons other right =>
+      cases i with
+      | zero => rfl
+      | succ i => exact ih right i
+
+theorem addMessages_length (left right : List G) :
+    (addMessages left right).length = max left.length right.length := by
+  induction left generalizing right with
+  | nil => simp only [addMessages, List.length_nil, Nat.zero_max]
+  | cons value left ih =>
+    cases right with
+    | nil => simp only [addMessages, List.length_nil, Nat.max_zero]
+    | cons other right => simp only [addMessages, List.length_cons, ih, Nat.add_max_add_right]
+
+theorem scaleMessage_read (selector : G) (message : List G) (i : Nat) :
+    (scaleMessage selector message)[i]?.getD 0 = selector * message[i]?.getD 0 := by
+  induction message generalizing i with
+  | nil => simp only [scaleMessage, List.map_nil, List.getElem?_nil, Option.getD_none, G.mul_zero]
+  | cons value message ih =>
+    cases i with
+    | zero => rfl
+    | succ i => exact ih i
+
+theorem weightedMessage_fold_read (parts : List (G × List G)) (start : List G) (i : Nat) :
+    (parts.foldl (fun combined part => addMessages combined (scaleMessage part.1 part.2)) start)[i]?.getD 0 =
+      (parts.map fun part => part.1 * part.2[i]?.getD 0).foldl (· + ·) (start[i]?.getD 0) := by
+  induction parts generalizing start with
+  | nil => rfl
+  | cons part parts ih =>
+    simp only [List.foldl_cons, List.map_cons, ih, addMessages_read, scaleMessage_read]
+
+theorem weightedMessage_read (parts : List (G × List G)) (i : Nat) :
+    (weightedMessage parts)[i]?.getD 0 = selectorSum (parts.map fun part => part.1 * part.2[i]?.getD 0) :=
+  weightedMessage_fold_read parts [] i
+
+theorem selectorSum_append (left right : List G) :
+    selectorSum (left ++ right) = selectorSum left + selectorSum right := by
+  change (left ++ right).foldl (· + ·) 0 = left.foldl (· + ·) 0 + selectorSum right
+  rw [List.foldl_append, foldl_add_eq]
+
+theorem weighted_value_zero {parts : List (G × List G)}
+    (zero : ∀ part ∈ parts, part.1 = 0) (i : Nat) :
+    selectorSum (parts.map fun part => part.1 * part.2[i]?.getD 0) = 0 := by
+  induction parts with
+  | nil => rfl
+  | cons part parts ih =>
+    have tail := ih (fun p member => zero p (List.mem_cons_of_mem part member))
+    simp only [List.map_cons, selectorSum_cons, zero part List.mem_cons_self,
+      G.mul_comm 0, G.mul_zero, G.zero_add, tail]
+
+theorem weightedMessage_split (width : Nat) (before after : List (G × List G)) (chosen : G × List G)
+    (active : chosen.1 = 1) (zero : ∀ part ∈ before ++ after, part.1 = 0) :
+    padMessage width (weightedMessage (before ++ chosen :: after)) = padMessage width chosen.2 := by
+  apply congrArg List.ofFn
+  funext i
+  have beforeZero := weighted_value_zero (fun p member => zero p (List.mem_append_left _ member)) i.val
+  have afterZero := weighted_value_zero (fun p member => zero p (List.mem_append_right _ member)) i.val
+  change (weightedMessage (before ++ chosen :: after))[i.val]?.getD 0 = chosen.2[i.val]?.getD 0
+  rw [weightedMessage_read, List.map_append, selectorSum_append, beforeZero, G.zero_add,
+    List.map_cons, selectorSum_cons, afterZero, G.add_zero, active, G.mul_comm, G.mul_one]
+
+theorem selector_parts_active_split {parts : List (G × List G)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1) :
+    ∃ before chosen after, parts = before ++ chosen :: after ∧ chosen.1 = 1 ∧
+      ∀ part ∈ before ++ after, part.1 = 0 := by
+  obtain ⟨before, after, split, zero⟩ := selectorSum_active_split
+    (fun value member => by
+      obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+      subst value
+      exact individual part partMember)
+    (by simpa only [List.length_map] using bounded) active
+  obtain ⟨first, rest, partsEq, firstEq, restEq⟩ := List.map_eq_append_iff.mp split
+  obtain ⟨chosen, last, tailEq, activeChosen, lastEq⟩ := List.map_eq_cons_iff.mp restEq
+  refine ⟨first, chosen, last, by rw [partsEq, tailEq], activeChosen, ?_⟩
+  intro part member
+  apply zero part.1
+  rcases List.mem_append.mp member with firstMember | lastMember
+  · apply List.mem_append_left
+    rw [← firstEq]
+    exact List.mem_map.mpr ⟨part, firstMember, rfl⟩
+  · apply List.mem_append_right
+    rw [← lastEq]
+    exact List.mem_map.mpr ⟨part, lastMember, rfl⟩
+
+/-- A shared slot contains exactly the selected branch's padded message.
+Inactive branches may have different lengths and arbitrary field values. -/
+theorem weightedMessage_active (width : Nat) {parts : List (G × List G)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1) :
+    ∃ chosen ∈ parts, chosen.1 = 1 ∧
+      padMessage width (weightedMessage parts) = padMessage width chosen.2 := by
+  obtain ⟨before, chosen, after, partsEq, activeChosen, zero⟩ :=
+    selector_parts_active_split individual bounded active
+  refine ⟨chosen, ?_, activeChosen, ?_⟩
+  · rw [partsEq]
+    exact List.mem_append_right _ List.mem_cons_self
+  · rw [partsEq]
+    exact weightedMessage_split width before after chosen activeChosen zero
+
+theorem weightedMessage_inactive (width : Nat) {parts : List (G × List G)}
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (inactive : selectorSum (parts.map Prod.fst) = 0) :
+    padMessage width (weightedMessage parts) = padMessage width [] := by
+  have zero := selectorSum_inactive
+    (fun value member => by
+      obtain ⟨part, partMember, equal⟩ := List.mem_map.mp member
+      subst value
+      exact individual part partMember)
+    (by simpa only [List.length_map] using bounded) inactive
+  apply congrArg List.ofFn
+  funext i
+  change (weightedMessage parts)[i.val]?.getD 0 = 0
+  rw [weightedMessage_read]
+  exact weighted_value_zero (fun part member => zero _ (List.mem_map.mpr ⟨part, member, rfl⟩)) i.val
+
+/-- Native lookup gating omits the selector product for a slot known to
+have just one writer. Multiplicity still determines whether it is used. -/
+def gateMessage (branchless : Bool) (selector : G) (message : List G) : List G :=
+  if branchless then message else scaleMessage selector message
+
+def slotMessage (branchless : Bool) (parts : List (G × List G)) : List G :=
+  parts.foldl (fun combined part => addMessages combined (gateMessage branchless part.1 part.2)) []
+
+theorem gateMessage_active (branchless : Bool) {selector : G} (message : List G)
+    (active : selector = 1) : gateMessage branchless selector message = message := by
+  cases branchless <;> simp [gateMessage, scaleMessage, active, G.mul_comm, G.mul_one]
+
+/-- The branchless optimization is sound on an active slot when its layout
+actually gives it one writer. That layout property is an explicit premise. -/
+theorem slotMessage_active (width : Nat) (branchless : Bool) {parts : List (G × List G)}
+    (single : branchless = true → parts.length = 1)
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1) :
+    ∃ chosen ∈ parts, chosen.1 = 1 ∧
+      padMessage width (slotMessage branchless parts) = padMessage width chosen.2 := by
+  cases branchless with
+  | false => exact weightedMessage_active width individual bounded active
+  | true =>
+    obtain ⟨part, equal⟩ := List.length_eq_one_iff.mp (single rfl)
+    subst parts
+    have selected : part.1 = 1 := by
+      simpa only [List.map_cons, List.map_nil, selectorSum_cons,
+        selectorSum, List.foldl_nil, List.foldl_cons, G.zero_add, G.add_zero] using active
+    exact ⟨part, List.mem_cons_self, selected, rfl⟩
+
+/-- A continuation's active merge columns equal the values of its unique
+active yield. The caller must establish that the parent is active and that
+the native continuation-link equation makes the yield sum one. -/
+theorem continuation_merge {parent : G} {parts : List (G × List G)} {merged : List G}
+    (parentActive : parent = 1)
+    (individual : ∀ part ∈ parts, booleanConstraint part.1 = 0)
+    (bounded : parts.length < gSize.toNat)
+    (active : selectorSum (parts.map Prod.fst) = 1)
+    (sizes : ∀ part ∈ parts, part.2.length = merged.length)
+    (equations : ∀ i, i < merged.length →
+      parent * (merged[i]?.getD 0 -
+        selectorSum (parts.map fun part => part.1 * part.2[i]?.getD 0)) = 0) :
+    ∃ chosen ∈ parts, chosen.1 = 1 ∧ merged = chosen.2 := by
+  obtain ⟨chosen, member, selected, message⟩ :=
+    weightedMessage_active merged.length individual bounded active
+  refine ⟨chosen, member, selected, ?_⟩
+  apply padMessage_injective_of_length (Nat.le_refl _) (sizes chosen member).symm
+  apply Eq.trans _ message
+  apply congrArg List.ofFn
+  funext i
+  change merged[i.val]?.getD 0 = (weightedMessage parts)[i.val]?.getD 0
+  rw [weightedMessage_read]
+  have equation := equations i.val i.isLt
+  rw [parentActive, G.mul_comm, G.mul_one] at equation
+  exact (G.sub_eq_zero_iff _ _).mp equation
+
+end Aiur.AIR
diff --git a/Ix/Aiur/Proofs/Selectors.lean b/Ix/Aiur/Proofs/Selectors.lean
new file mode 100644
index 000000000..f80f84b6b
--- /dev/null
+++ b/Ix/Aiur/Proofs/Selectors.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Domain
+
+/-! The checked native rational formulas evaluate the selector polynomials
+away from the trace domain. Their row values include the native, unnormalized
+last-row factor `n * generator`, which is a nonzero Goldilocks element.
+-/
+
+namespace Aiur.NativeAIR.Domain
+
+open Lean.Grind
+open ProofCodec (Extension)
+open Algebra
+
+theorem first_at_row (domain : Subgroup) (index : Fin (size domain)) :
+    dividedPowers (point domain index) (1 : G) (size domain) =
+      if index.val = 0 then G.ofNat (size domain) else 0 := by
+  by_cases first : index.val = 0
+  · rw [if_pos first, (point_first_iff domain index).mpr first, dividedPowers_diagonal,
+      Semiring.one_pow, Semiring.mul_one]
+    rfl
+  · rw [if_neg first]
+    have factor := root_dividedPowers (point domain index) (1 : G)
+      (Semiring.one_pow (size domain))
+    rw [point_power, (by decide : (1 : G) - 1 = 0)] at factor
+    exact ((G.mul_eq_zero_iff _ _).mp factor).resolve_left
+      (fun zero => first ((point_first_iff domain index).mp ((G.sub_eq_zero_iff _ _).mp zero)))
+
+theorem last_at_row (domain : Subgroup) (index : Fin (size domain)) :
+    dividedPowers (point domain index) (lastPoint domain) (size domain) =
+      if index.val = size domain - 1 then normalizer domain else 0 := by
+  by_cases last : index.val = size domain - 1
+  · rw [if_pos last, (point_last_iff domain index).mpr last, dividedPowers_diagonal,
+      lastPoint_predecessor]
+    rfl
+  · rw [if_neg last]
+    have factor := root_dividedPowers (point domain index) (lastPoint domain) (lastPoint_power domain)
+    rw [point_power, (by decide : (1 : G) - 1 = 0)] at factor
+    exact ((G.mul_eq_zero_iff _ _).mp factor).resolve_left
+      (fun zero => last ((point_last_iff domain index).mp ((G.sub_eq_zero_iff _ _).mp zero)))
+
+theorem transition_at_row (domain : Subgroup) (index : Fin (size domain)) :
+    point domain index - lastPoint domain = 0 ↔ index.val = size domain - 1 := by
+  rw [G.sub_eq_zero_iff, point_last_iff]
+
+theorem ofBase_dividedPowers (x a : G) (n : Nat) :
+    Extension.ofBase (dividedPowers x a n) =
+      dividedPowers (Extension.ofBase x) (Extension.ofBase a) n := by
+  induction n with
+  | zero => rfl
+  | succ n ih => rw [dividedPowers, dividedPowers, Extension.ofBase_add,
+      Extension.ofBase_mul, Extension.ofBase_power, ih]
+
+theorem vanishing_eq (domain : Subgroup) (value : Extension) :
+    vanishing domain value = value ^ size domain - 1 := by
+  rw [vanishing, Extension.power_eq]
+
+theorem vanishing_at_row (domain : Subgroup) (index : Fin (size domain)) :
+    vanishing domain (Extension.ofBase (point domain index)) = 0 := by
+  rw [vanishing_eq, ← Extension.ofBase_power, point_power]
+  change (1 : Extension) - 1 = 0
+  grind
+
+theorem lastPoint_extension_power (domain : Subgroup) :
+    Extension.ofBase (lastPoint domain) ^ size domain = 1 := by
+  rw [← Extension.ofBase_power, lastPoint_power]
+  rfl
+
+theorem root_difference_nonzero (x a : Extension) {n : Nat}
+    (root : a ^ n = 1) (nonzero : x ^ n - 1 ≠ 0) : x - a ≠ 0 := by
+  intro zero
+  have same : x = a := by grind
+  subst x
+  apply nonzero
+  rw [root]
+  grind
+
+theorem selectors_success (domain : Subgroup) (value : Extension) (selected : Selectors Extension)
+    (accepted : selectors domain value = some selected) :
+    selected.isFirst = dividedPowers value 1 (size domain) ∧
+    selected.isLast = dividedPowers value (Extension.ofBase (lastPoint domain)) (size domain) ∧
+    selected.isTransition = value - Extension.ofBase (lastPoint domain) ∧
+    vanishing domain value * selected.invVanishing = 1 := by
+  simp only [selectors, bind, pure, Option.bind_eq_some_iff, Option.some.injEq] at accepted
+  obtain ⟨firstInverse, first, lastInverse, last, vanishingInverse, invert, rfl⟩ := accepted
+  exact ⟨by
+    rw [vanishing_eq]
+    exact dividedPowers_off_root value 1 firstInverse (Semiring.one_pow _)
+      ((Extension.tryInverse_some_iff _ _).mp first), by
+    rw [vanishing_eq]
+    exact dividedPowers_off_root value _ lastInverse (lastPoint_extension_power domain)
+      ((Extension.tryInverse_some_iff _ _).mp last), rfl,
+    (Extension.tryInverse_some_iff _ _).mp invert⟩
+
+theorem selectors_defined (domain : Subgroup) (value : Extension)
+    (nonzero : vanishing domain value ≠ 0) : ∃ selected, selectors domain value = some selected := by
+  have polynomial : value ^ size domain - 1 ≠ 0 := by rwa [vanishing_eq] at nonzero
+  obtain ⟨first, firstDefined⟩ := Option.ne_none_iff_exists'.mp (fun absent =>
+    root_difference_nonzero value 1 (Semiring.one_pow _) polynomial
+      ((Extension.tryInverse_none_iff _).mp absent))
+  obtain ⟨last, lastDefined⟩ := Option.ne_none_iff_exists'.mp (fun absent =>
+    root_difference_nonzero value _ (lastPoint_extension_power domain) polynomial
+      ((Extension.tryInverse_none_iff _).mp absent))
+  obtain ⟨inverse, inverseDefined⟩ := Option.ne_none_iff_exists'.mp (fun absent =>
+    nonzero ((Extension.tryInverse_none_iff _).mp absent))
+  refine ⟨⟨vanishing domain value * first, vanishing domain value * last,
+    value - Extension.ofBase (lastPoint domain), inverse⟩, ?_⟩
+  simp only [selectors, firstDefined, lastDefined, inverseDefined, bind, pure, Option.bind_some]
+
+theorem selectors_defined_iff (domain : Subgroup) (value : Extension) :
+    (∃ selected, selectors domain value = some selected) ↔ vanishing domain value ≠ 0 := by
+  constructor
+  · rintro ⟨selected, accepted⟩ zero
+    have inverse := (selectors_success domain value selected accepted).2.2.2
+    rw [zero, Extension.zero_mul] at inverse
+    exact Extension.one_ne_zero inverse.symm
+  · exact selectors_defined domain value
+
+theorem selectors_none_at_row (domain : Subgroup) (index : Fin (size domain)) :
+    selectors domain (Extension.ofBase (point domain index)) = none := by
+  by_cases absent : selectors domain (Extension.ofBase (point domain index)) = none
+  · exact absent
+  · obtain ⟨selected, accepted⟩ := Option.ne_none_iff_exists'.mp absent
+    exact False.elim ((selectors_defined_iff _ _).mp ⟨selected, accepted⟩ (vanishing_at_row _ _))
+
+end Aiur.NativeAIR.Domain
diff --git a/Ix/Aiur/Proofs/ShapedVerifier.lean b/Ix/Aiur/Proofs/ShapedVerifier.lean
new file mode 100644
index 000000000..fd7054c21
--- /dev/null
+++ b/Ix/Aiur/Proofs/ShapedVerifier.lean
@@ -0,0 +1,61 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ShapedVerifier
+import Ix.Aiur.Proofs.ProofCodec
+import Ix.Aiur.Proofs.ProofShape
+
+/-! Shape and framing facts follow from the bytes accepted by the actual
+checked wrapper. Native transcript/PCS/AIR correctness remains to be proved. -/
+
+namespace Aiur.BoundVerifier
+
+theorem CheckedProof.framing {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) :
+    NativeAIR.ProofCodec.readData bytes.data.toList = some (checked.data, []) ∧
+      NativeAIR.ProofCodec.encode checked.data = bytes := by
+  obtain ⟨decoded, encoded⟩ := NativeAIR.ProofCodec.decodeCanonical_success checked.decoded
+  exact ⟨NativeAIR.ProofCodec.decode_success decoded, encoded⟩
+
+theorem CheckedProof.wire_bounds {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) : NativeAIR.ProofCodec.DataFits checked.data :=
+  NativeAIR.ProofCodec.decode_fits (NativeAIR.ProofCodec.decodeCanonical_success checked.decoded).1
+
+theorem CheckedProof.row {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) {position : Nat} {row : NativeAIR.ProofShape.Row}
+    (present : checked.rows[position]? = some row) :
+    checked.data.active[row.circuitIndex]? = some true ∧
+      row.Sourced key checked.data row.circuitIndex position ∧ row.Fits key.parameters := by
+  obtain ⟨index, _, sourced, fits⟩ := NativeAIR.ProofShape.check_row checked.shape present
+  exact ⟨NativeAIR.ProofShape.check_row_active checked.shape present, sourced.index_eq ▸ sourced, fits⟩
+
+theorem CheckedProof.nonempty {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) : checked.rows ≠ [] :=
+  NativeAIR.ProofShape.check_nonempty checked.shape
+
+theorem CheckedProof.fixed_heights {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) :
+    FixedTraceHeights (key.circuits.map (·.preprocessedHeight)) checked.data.active
+      (checked.data.logDegrees.map UInt8.toNat) :=
+  NativeAIR.ProofShape.fixedHeights_sound checked.fixed
+
+theorem CheckedProof.lookup_budget {key : NativeAIR.KeyCodec.Key} {bytes : ByteArray}
+    (checked : CheckedProof key bytes) :
+    ∃ total, lookupSlotSum (key.circuits.map (·.graph.lookups.length)) checked.data.active
+      (checked.data.logDegrees.map UInt8.toNat) = some total ∧
+      checked.bound = 1 + total ∧ checked.bound < gSize.toNat :=
+  NativeAIR.ProofShape.queryBound_sound checked.budget
+
+theorem verifyShaped_acceptance {selection : Selection} {backend : CompiledBackend selection}
+    {input : Array G} {bytes : ByteArray} (accepted : verifyShaped backend input bytes = .ok ()) :
+    input.size = selection.inputSize ∧
+      ∃ (checked : CheckedProof backend.keyData bytes) (native : Proof),
+        readProof backend.keyData bytes = .ok checked ∧ Proof.ofBytesChecked bytes = .ok native ∧
+        backend.system.verify (buildClaim selection.function input selection.success) native = .ok () := by
+  obtain ⟨checked, parsed, verified⟩ := verifyShaped_success accepted
+  obtain ⟨arity, native, decoded, checkedNative⟩ := verifyCompiled_success verified
+  exact ⟨arity, checked, native, parsed, decoded, checkedNative⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/TableExpressions.lean b/Ix/Aiur/Proofs/TableExpressions.lean
new file mode 100644
index 000000000..a136a2a6b
--- /dev/null
+++ b/Ix/Aiur/Proofs/TableExpressions.lean
@@ -0,0 +1,115 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.CompiledKey
+
+/-! The memory and byte expression builders evaluate to their physical
+column models. Every read follows from the matrix dimensions. -/
+
+namespace Aiur.NativeAIR.CompiledKey
+open Compiler OpEmitter
+
+def columns (values : Values G) (source : Source) (offset : RowOffset) (width : Nat) : Fin width → G :=
+  fun index => (values.columns source offset)[index.val]?.getD 0
+
+theorem column_eval {values : Values G} {widths : GraphWidths} (fits : values.Fits widths)
+    (source : Source) (offset : RowOffset) {width : Nat} (bound : width ≤ widths.width source)
+    (index : Fin width) :
+    (Expr.var ⟨source, offset, index.val⟩).eval goldilocksOps values =
+      some (columns values source offset width index) := by
+  have inside : index.val < (values.columns source offset).size := by
+    rw [fits.1]
+    exact Nat.lt_of_lt_of_le index.isLt bound
+  simp only [Expr.eval, columns, Array.getElem?_eq_getElem inside, Option.getD_some]
+
+theorem memoryEquations_eval {values : Values G} {widths : GraphWidths} (fits : values.Fits widths)
+    (width : Nat) (bound : 3 + width ≤ widths.main) :
+    memoryEquations.mapM (Expr.eval goldilocksOps values) = some
+      (AIR.memoryColumnEquations width (columns values .main .current (3 + width))
+        (columns values .main .next (3 + width)) values.isTransition) := by
+  have cur := column_eval fits .main .current bound
+  have nxt := column_eval fits .main .next bound
+  have one : (Expr.konst 1).eval goldilocksOps values = some 1 := rfl
+  have selector := cur ⟨1, by omega⟩
+  have multiplicity := cur ⟨0, by omega⟩
+  have transition := Expr.frontMul_eval goldilocksLaws values (nxt ⟨1, by omega⟩)
+    (show Expr.isTransition.eval goldilocksOps values = some values.isTransition from rfl)
+  have minusOne := Expr.frontSub_eval goldilocksLaws values selector one
+  have first := Expr.frontMul_eval goldilocksLaws values selector minusOne
+  have second := Expr.frontMul_eval goldilocksLaws values multiplicity
+    (Expr.frontSub_eval goldilocksLaws values one selector)
+  have third := Expr.frontMul_eval goldilocksLaws values transition minusOne
+  have fourth := Expr.frontMul_eval goldilocksLaws values transition
+    (Expr.frontSub_eval goldilocksLaws values
+      (Expr.frontAdd_eval goldilocksLaws values (cur ⟨2, by omega⟩) one) (nxt ⟨2, by omega⟩))
+  simp only [memoryEquations, main, next, AIR.memoryColumnEquations, List.mapM_cons, List.mapM_nil,
+    first, second, third, fourth, bind, Option.bind_some, pure]
+  rfl
+
+theorem memoryLookup_eval {values : Values G} {widths : GraphWidths} (fits : values.Fits widths)
+    (width : Nat) (bound : 3 + width ≤ widths.main) :
+    (memoryLookup width).eval goldilocksOps values =
+      some (AIR.memoryColumnLookup width (columns values .main .current (3 + width))) := by
+  let row := columns values .main .current (3 + width)
+  have cur := column_eval fits .main .current bound
+  have selector := cur ⟨1, by omega⟩
+  have multiplicity := Expr.frontNeg_eval goldilocksLaws values (cur ⟨0, by omega⟩)
+  have channel := Expr.frontMul_eval goldilocksLaws values selector
+    (show (Expr.konst 1).eval goldilocksOps values = some 1 from rfl)
+  have size := Expr.frontMul_eval goldilocksLaws values selector
+    (show (Expr.konst (G.ofNat width)).eval goldilocksOps values = some (G.ofNat width) from rfl)
+  have pointer := Expr.frontMul_eval goldilocksLaws values selector (cur ⟨2, by omega⟩)
+  have contents := list_mapM_ofFn
+    (fun i : Fin width => (main 1).frontMul (main (3 + i.val)))
+    (fun i : Fin width => row ⟨1, by omega⟩ * row ⟨3 + i.val, by omega⟩)
+    (Expr.eval goldilocksOps values)
+    (fun i => Expr.frontMul_eval goldilocksLaws values selector (cur ⟨3 + i.val, by omega⟩))
+  simp only [main] at contents
+  simp only [memoryLookup, ExprLookup.eval, evalExprs, main, List.map_cons, List.map_nil,
+    List.cons_append, List.nil_append, List.mapM_cons,
+    multiplicity, channel, size, pointer, contents, bind, Option.bind_some, pure,
+    AIR.memoryColumnLookup, AIR.memoryMessage, AIR.decodeMemoryRow, Array.toList_ofFn,
+    List.map_ofFn, Function.comp_def]
+  rfl
+
+theorem byte1Lookup_eval {values : Values G} {widths : GraphWidths} (fits : values.Fits widths)
+    (mainBound : 3 ≤ widths.main) (preprocessedBound : 11 ≤ widths.preprocessed) (kind : AIR.Byte1Kind) :
+    (byte1Lookup kind).eval goldilocksOps values = some
+      (AIR.byte1ColumnLookup kind (columns values .preprocessed .current 11) (columns values .main .current 3)) := by
+  have cur := column_eval fits .main .current mainBound
+  have pre (index : Nat) (bound : index < 11) :
+      (values.columns .preprocessed .current)[index]? =
+        some (columns values .preprocessed .current 11 ⟨index, bound⟩) :=
+    column_eval fits .preprocessed .current preprocessedBound ⟨index, bound⟩
+  have multiplicity := Expr.frontNeg_eval goldilocksLaws values (cur kind.column)
+  have bits := list_mapM_ofFn (fun i : Fin 8 => preprocessed (1 + i.val))
+    (fun i : Fin 8 => columns values .preprocessed .current 11 ⟨1 + i.val, by omega⟩)
+    (Expr.eval goldilocksOps values) (fun i => pre (1 + i.val) (by omega))
+  simp only [preprocessed] at bits
+  cases kind <;>
+    simp only [byte1Lookup, ExprLookup.eval, evalExprs, List.cons_append, List.nil_append,
+      List.mapM_cons, List.mapM_nil, main, multiplicity, preprocessed, Expr.eval, bits,
+      pre 0 (by decide), pre 9 (by decide), pre 10 (by decide),
+      bind, Option.bind_some, pure, AIR.byte1ColumnLookup] <;> rfl
+
+theorem byte2Lookup_eval {values : Values G} {widths : GraphWidths} (fits : values.Fits widths)
+    (mainBound : 10 ≤ widths.main) (preprocessedBound : 14 ≤ widths.preprocessed) (kind : AIR.Byte2Kind) :
+    (byte2Lookup kind).eval goldilocksOps values = some
+      (AIR.byte2ColumnLookup kind (columns values .preprocessed .current 14) (columns values .main .current 10)) := by
+  have cur := column_eval fits .main .current mainBound
+  have pre (index : Nat) (bound : index < 14) :
+      (values.columns .preprocessed .current)[index]? =
+        some (columns values .preprocessed .current 14 ⟨index, bound⟩) :=
+    column_eval fits .preprocessed .current preprocessedBound ⟨index, bound⟩
+  have multiplicity := Expr.frontNeg_eval goldilocksLaws values (cur kind.column)
+  cases kind <;>
+    simp only [byte2Lookup, ExprLookup.eval, evalExprs, List.cons_append, List.nil_append,
+      List.mapM_cons, List.mapM_nil, main, multiplicity, preprocessed, Expr.eval,
+      pre 0 (by decide), pre 1 (by decide), pre 2 (by decide), pre 3 (by decide), pre 4 (by decide),
+      pre 5 (by decide), pre 6 (by decide), pre 7 (by decide), pre 8 (by decide), pre 9 (by decide),
+      pre 10 (by decide), pre 11 (by decide), pre 12 (by decide), pre 13 (by decide),
+      bind, Option.bind_some, pure, AIR.byte2ColumnLookup] <;> rfl
+
+end Aiur.NativeAIR.CompiledKey
diff --git a/Ix/Aiur/Proofs/TailMatches.lean b/Ix/Aiur/Proofs/TailMatches.lean
new file mode 100644
index 000000000..37c429ef7
--- /dev/null
+++ b/Ix/Aiur/Proofs/TailMatches.lean
@@ -0,0 +1,85 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Semantics.SourceEval
+
+/-! Tail-match restoration preserves the complete source evaluator result.
+This covers the normalization helper used by inlining; expansion and let
+hoisting require separate proofs. -/
+
+namespace Aiur.Source.Eval
+
+private theorem evalMatchCases_map (decls : Decls) (fuel : Nat)
+    (transform : Term → Term) (arms : List (Pattern × Term))
+    (equivalent : ∀ arm ∈ arms, ∀ bindings st,
+      interp decls fuel bindings arm.2 st = interp decls fuel bindings (transform arm.2) st)
+    (bindings : Bindings) (st : EvalState) (value : Value) :
+    evalMatchCases decls fuel bindings st value arms =
+      evalMatchCases decls fuel bindings st value (arms.map fun arm => (arm.1, transform arm.2)) := by
+  induction arms with
+  | nil => rfl
+  | cons arm arms ih =>
+    rcases arm with ⟨pattern, body⟩
+    simp only [List.map_cons, evalMatchCases]
+    cases matchPattern st.store pattern value with
+    | some bs => exact equivalent (pattern, body) (by simp) (bs ++ bindings) st
+    | none => exact ih (fun arm member => equivalent arm (by simp [member]))
+
+/-- All successes, errors and early returns are identical, including their
+full memory and I/O states. Fuel is unchanged because it counts calls. -/
+theorem interp_restoreTailMatches (decls : Decls) (fuel : Nat) (term : Term)
+    (bindings : Bindings) (st : EvalState) :
+    interp decls fuel bindings term st =
+      interp decls fuel bindings term.restoreTailMatches st := by
+  induction term using Term.restoreTailMatches.induct generalizing bindings st with
+  | case1 x value y same ih =>
+    simp only [Term.restoreTailMatches, if_pos same]
+    rw [← ih]
+    simp only [interp]
+    cases interp decls fuel bindings value st with
+    | error e => rfl
+    | ok result =>
+      rcases result with ⟨v, st'⟩
+      simp [matchPattern, same]
+  | case2 x value y different => simp only [Term.restoreTailMatches, if_neg different]
+  | case3 pattern value body notEta ih =>
+    rw [Term.restoreTailMatches.eq_def]
+    split
+    next x value' y impossible =>
+      cases impossible
+      exact False.elim (notEta x y rfl rfl)
+    next =>
+      rename_i p v b _ heq
+      cases heq
+      simp only [interp]
+      cases interp decls fuel bindings value st with
+      | error e => rfl
+      | ok result =>
+        rcases result with ⟨v, st'⟩
+        dsimp only
+        cases matchPattern st'.store pattern v with
+        | none => rfl
+        | some bs => exact ih (bs ++ bindings) st'
+    next s arms impossible => cases impossible
+    next => rfl
+  | case4 scrut arms ih =>
+    simp only [Term.restoreTailMatches, interp]
+    cases interp decls fuel bindings scrut st with
+    | error e => rfl
+    | ok result =>
+      rcases result with ⟨v, st'⟩
+      simpa only [List.attach_map_val (f := fun (arm : Pattern × Term) =>
+        (arm.1, arm.2.restoreTailMatches))] using
+        evalMatchCases_map decls fuel Term.restoreTailMatches arms
+          (fun arm member => ih ⟨arm, member⟩) bindings st' v
+  | case5 term notEta notLet notMatch =>
+    rw [Term.restoreTailMatches.eq_def]
+    split
+    · exact False.elim (notEta _ _ _ rfl)
+    · exact False.elim (notLet _ _ _ rfl)
+    · exact False.elim (notMatch _ _ rfl)
+    · rfl
+
+end Aiur.Source.Eval
diff --git a/Ix/Aiur/Proofs/Transcript.lean b/Ix/Aiur/Proofs/Transcript.lean
new file mode 100644
index 000000000..6c94eec86
--- /dev/null
+++ b/Ix/Aiur/Proofs/Transcript.lean
@@ -0,0 +1,179 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Transcript
+import Ix.Aiur.Proofs.Challenger
+import Ix.Aiur.Proofs.VerifierAccumulator
+
+namespace Aiur.NativeAIR.Transcript
+
+open Challenger
+open ProofCodec (Extension)
+
+theorem seed_length (parameters : KeyCodec.Parameters) : (seed parameters).length = 70 := by
+  simp only [seed, parameterWords, List.flatMap_cons, List.flatMap_nil, List.length_append,
+    KeyCodec.encodeNat_length, List.length_nil]
+  rfl
+
+theorem circuitShape_length (circuit : KeyCodec.Circuit) : (circuitShape circuit).length = 7 := by
+  simp only [circuitShape, List.length_map, List.length_cons, List.length_nil]
+
+theorem shape_length (key : KeyCodec.Key) : (shape key).length = 1 + 7 * key.circuits.length := by
+  have length (circuits : List KeyCodec.Circuit) : (circuits.flatMap circuitShape).length = 7 * circuits.length := by
+    induction circuits with
+    | nil => rfl
+    | cons circuit circuits ih =>
+      simp only [List.flatMap_cons, List.length_append, circuitShape_length, List.length_cons, ih]
+      omega
+  simp only [shape, List.length_cons, length]
+  omega
+
+theorem fieldsBytes_length (values : List G) : (fieldsBytes values).length = 8 * values.length := by
+  induction values with
+  | nil => rfl
+  | cons value values ih =>
+    simp only [fieldsBytes, List.flatMap_cons, List.length_append, ProofCodec.encodeField,
+      KeyCodec.encodeNat_length, List.length_cons] at *
+    omega
+
+theorem observeFields_bytes (state : State) (values : List G) :
+    values.foldl observeField state = observeBytes state (fieldsBytes values) := by
+  induction values generalizing state with
+  | nil => rfl
+  | cons value values ih =>
+    simp only [List.foldl_cons, ih, fieldsBytes, List.flatMap_cons, observeBytes_append]
+    rfl
+
+theorem claimsFields_framing (claims : List (List G)) :
+    claimsFields claims = G.ofNat claims.length :: claims.flatMap (fun claim => G.ofNat claim.length :: claim) := rfl
+
+/-- Actual native observation order, including the full activation bitmap
+and all claim boundaries, before either lookup challenge is drawn. -/
+theorem lookupState_schedule (key : KeyCodec.Key) (proof : ProofCodec.Data) (claims : List (List G)) :
+    lookupState key proof claims =
+      (claimsFields claims).foldl observeField
+        ((proof.logDegrees.map (fun degree => G.ofNat degree.toNat)).foldl observeField
+          (observeCap
+            (observeCap
+              ((proof.active.map (fun active => if active then 1 else 0)).foldl observeField
+                ((shape key).foldl observeField (initial (seed key.parameters))))
+              (key.preprocessedCommitment.getD []))
+            proof.commitments.stage1)) := by
+  simp only [lookupState, prefixBytes, observeBytes_append, observeFields_bytes, observeCap]
+
+theorem lookupState_valid (key : KeyCodec.Key) (proof : ProofCodec.Data) (claims : List (List G)) :
+    (lookupState key proof claims).Valid := observeBytes_valid (initial_valid _) _
+
+theorem accumulatorState_valid (proof : ProofCodec.Data) {state : State} (valid : state.Valid) :
+    (accumulatorState proof state).Valid := observeExtensions_valid (observeCap_valid valid _) _
+
+/-- Sampling transitions with the states on both sides of each native
+observation. The final state is the one passed into polynomial verification. -/
+structure Replay.Reads (hash : Hash32) (fuel : Nat) (key : KeyCodec.Key)
+    (proof : ProofCodec.Data) (claims : List (List G)) (result : Replay) : Prop where
+  states : ∃ afterBeta afterGamma afterAlpha,
+    sampleExtension hash fuel (lookupState key proof claims) = some (result.challenges.beta, afterBeta) ∧
+    sampleExtension hash fuel (observeExtension afterBeta result.challenges.beta) =
+      some (result.challenges.gamma, afterGamma) ∧
+    sampleExtension hash fuel (accumulatorState proof (observeExtension afterGamma result.challenges.gamma)) =
+      some (result.challenges.alpha, afterAlpha) ∧
+    sampleExtension hash fuel (observeCap afterAlpha proof.commitments.quotient) =
+      some (result.challenges.zeta, result.state)
+
+theorem replay_success {hash : Hash32} {fuel : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {result : Replay} (accepted : replay hash fuel key proof claims = some result) :
+    result.Reads hash fuel key proof claims := by
+  simp only [replay, bind, pure, Option.bind_eq_some_iff, Option.some.injEq, Prod.exists] at accepted
+  obtain ⟨beta, afterBeta, first, gamma, afterGamma, second, alpha, afterAlpha, third,
+    zeta, final, fourth, rfl⟩ := accepted
+  exact ⟨afterBeta, afterGamma, afterAlpha, first, second, third, fourth⟩
+
+theorem Replay.Reads.complete {hash : Hash32} {fuel : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {result : Replay} (reads : result.Reads hash fuel key proof claims) :
+    replay hash fuel key proof claims = some result := by
+  obtain ⟨afterBeta, afterGamma, afterAlpha, first, second, third, fourth⟩ := reads.states
+  simp only [replay, first, second, third, fourth, bind, pure, Option.bind_some]
+
+theorem replay_iff (hash : Hash32) (fuel : Nat) (key : KeyCodec.Key) (proof : ProofCodec.Data)
+    (claims : List (List G)) (result : Replay) : replay hash fuel key proof claims = some result ↔
+      result.Reads hash fuel key proof claims := ⟨replay_success, Replay.Reads.complete⟩
+
+theorem replay_mono {hash : Hash32} {fuel more : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {result : Replay} (accepted : replay hash fuel key proof claims = some result)
+    (bound : fuel ≤ more) : replay hash more key proof claims = some result := by
+  obtain ⟨afterBeta, afterGamma, afterAlpha, first, second, third, fourth⟩ := (replay_success accepted).states
+  exact (Replay.Reads.complete ⟨afterBeta, afterGamma, afterAlpha, sampleExtension_mono first bound,
+    sampleExtension_mono second bound, sampleExtension_mono third bound, sampleExtension_mono fourth bound⟩)
+
+theorem replay_unique {hash : Hash32} {fuel other : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {left right : Replay} (first : replay hash fuel key proof claims = some left)
+    (second : replay hash other key proof claims = some right) : left = right := by
+  have one := replay_mono first (Nat.le_max_left fuel other)
+  have two := replay_mono second (Nat.le_max_right fuel other)
+  exact Option.some.inj (one.symm.trans two)
+
+theorem replay_valid {hash : Hash32} {fuel : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {result : Replay} (accepted : replay hash fuel key proof claims = some result) :
+    result.state.Valid := by
+  obtain ⟨afterBeta, afterGamma, afterAlpha, first, second, third, fourth⟩ := (replay_success accepted).states
+  have beta := sampleExtension_valid first (lookupState_valid key proof claims)
+  have gamma := sampleExtension_valid second (observeExtension_valid beta _)
+  have alpha := sampleExtension_valid third (accumulatorState_valid proof (observeExtension_valid gamma _))
+  exact sampleExtension_valid fourth (observeCap_valid alpha _)
+
+theorem verifyArithmetic_success {hash : Hash32} {fuel : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {rows : List ProofShape.Row} {result : Replay}
+    (accepted : verifyArithmetic hash fuel key proof claims rows = some result) :
+    replay hash fuel key proof claims = some result ∧
+      VerifierArithmetic.verify result.challenges claims rows = some true := by
+  simp only [verifyArithmetic, bind, Option.bind_eq_some_iff] at accepted
+  obtain ⟨replayed, replayRead, check, arithmetic, accepted⟩ := accepted
+  cases check with
+  | false => cases accepted
+  | true => cases accepted; exact ⟨replayRead, arithmetic⟩
+
+theorem verifyArithmetic_iff (hash : Hash32) (fuel : Nat) (key : KeyCodec.Key) (proof : ProofCodec.Data)
+    (claims : List (List G)) (rows : List ProofShape.Row) (result : Replay) :
+    verifyArithmetic hash fuel key proof claims rows = some result ↔
+      replay hash fuel key proof claims = some result ∧
+        VerifierArithmetic.verify result.challenges claims rows = some true := by
+  constructor
+  · exact verifyArithmetic_success
+  · rintro ⟨replayed, accepted⟩
+    simp only [verifyArithmetic, replayed, accepted, bind, Option.bind_some, ↓reduceIte]
+
+theorem verifyArithmetic_mono {hash : Hash32} {fuel more : Nat} {key : KeyCodec.Key} {proof : ProofCodec.Data}
+    {claims : List (List G)} {rows : List ProofShape.Row} {result : Replay}
+    (accepted : verifyArithmetic hash fuel key proof claims rows = some result) (bound : fuel ≤ more) :
+    verifyArithmetic hash more key proof claims rows = some result := by
+  obtain ⟨replayed, arithmetic⟩ := verifyArithmetic_success accepted
+  exact (verifyArithmetic_iff _ _ _ _ _ _ _).mpr ⟨replay_mono replayed bound, arithmetic⟩
+
+end Aiur.NativeAIR.Transcript
+
+namespace Aiur.BoundVerifier
+open NativeAIR
+
+/-- The checked selected key and proof supply the entire transcript. This
+conclusion still needs PCS authentication and the cryptographic bad-event
+analysis before it can imply a satisfying execution trace. -/
+theorem CompiledBackend.transcript_row {selection : Selection} (backend : CompiledBackend selection)
+    {bytes : ByteArray} (checked : CheckedProof backend.keyData bytes) {hash : Challenger.Hash32}
+    {fuel : Nat} {claims : List (List G)} {result : Transcript.Replay}
+    (accepted : Transcript.verifyArithmetic hash fuel backend.keyData checked.data claims checked.rows = some result)
+    {position : Nat} {row : ProofShape.Row} (present : checked.rows[position]? = some row) :
+    result.Reads hash fuel backend.keyData checked.data claims ∧
+      row.Sourced backend.keyData checked.data row.circuitIndex position ∧ row.Fits backend.keyData.parameters ∧
+      ∃ initial before evaluation,
+        VerifierArithmetic.initialAccumulator result.challenges claims = some initial ∧
+        (initial :: checked.rows.map (·.accumulator))[position]? = some before ∧
+        VerifierArithmetic.evaluate result.challenges row before = some evaluation ∧
+        Quotient.composition result.challenges.alpha evaluation.constraints =
+          Domain.vanishing evaluation.domain result.challenges.zeta * evaluation.quotientValue := by
+  obtain ⟨replayed, arithmetic⟩ := Transcript.verifyArithmetic_success accepted
+  obtain ⟨_, sourced, fits⟩ := checked.row present
+  exact ⟨Transcript.replay_success replayed, sourced, fits, VerifierArithmetic.verify_row arithmetic present⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/VerifierAccumulator.lean b/Ix/Aiur/Proofs/VerifierAccumulator.lean
new file mode 100644
index 000000000..fadc4a18a
--- /dev/null
+++ b/Ix/Aiur/Proofs/VerifierAccumulator.lean
@@ -0,0 +1,232 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.VerifierArithmetic
+import Ix.Aiur.Proofs.DomainAccumulator
+
+/-! Public claims initialize the positive sum of inverse compressed messages.
+Ordered active rows use consecutive accumulator values and finish at zero.
+These are arithmetic facts with explicit challenges, without a transcript
+or polynomial-authentication assumption disguised as a conclusion.
+-/
+
+namespace Aiur.NativeAIR.VerifierArithmetic
+open ProofCodec (Extension)
+open LogUp (Coordinates)
+
+theorem claimMessage_native (challenges : Challenges) (claim : List G) :
+    claimMessage challenges claim = challenges.beta +
+      claim.foldr (fun arg accumulated => accumulated * challenges.gamma + Extension.ofBase arg) 0 := by
+  rw [claimMessage, LogUp.fingerprint_toExtension]
+  rfl
+
+def publicEntries (challenges : Challenges) (claims : List (List G)) : List (Extension × Extension) :=
+  claims.map fun claim => (1, claimMessage challenges claim)
+
+theorem publicEntries_compress (challenges : Challenges) (claims : List (List G)) :
+    LogUp.fieldEntries (LogUp.compress (Coordinates.fromExtension challenges.beta)
+      (Coordinates.fromExtension challenges.gamma) (claims.map fun claim => (1, claim))) =
+      publicEntries challenges claims := by
+  simp only [LogUp.fieldEntries, LogUp.compress, publicEntries, List.map_map, Function.comp_def]
+  apply List.map_congr_left
+  intro claim _
+  change ((1 : Extension), (LogUp.fingerprint (Coordinates.fromExtension challenges.gamma) claim +
+    Coordinates.fromExtension challenges.beta).toExtension) = (1, claimMessage challenges claim)
+  rw [Coordinates.toExtension_add, claimMessage]
+  change ((1 : Extension), _ + challenges.beta) = (1, challenges.beta + _)
+  rw [Extension.add_comm]
+
+theorem initialAccumulator_nil (challenges : Challenges) : initialAccumulator challenges [] = some 0 := rfl
+
+theorem initialAccumulator_cons (challenges : Challenges) (claim : List G) (claims : List (List G)) :
+    initialAccumulator challenges (claim :: claims) = do
+      let inverse ← (claimMessage challenges claim).tryInverse
+      let rest ← initialAccumulator challenges claims
+      return inverse + rest := by
+  unfold initialAccumulator
+  rw [List.mapM_cons]
+  cases first : (claimMessage challenges claim).tryInverse <;>
+    cases rest : claims.mapM (fun claim => (claimMessage challenges claim).tryInverse) <;> rfl
+
+theorem initialAccumulator_success {challenges : Challenges} {claims : List (List G)} {accumulator : Extension}
+    (accepted : initialAccumulator challenges claims = some accumulator) :
+    LogUp.PoleFree (publicEntries challenges claims) ∧
+      accumulator = LogUp.fractionSum (publicEntries challenges claims) := by
+  induction claims generalizing accumulator with
+  | nil =>
+    constructor
+    · intro _ member; cases member
+    · cases accepted; rfl
+  | cons claim claims ih =>
+    rw [initialAccumulator_cons] at accepted
+    simp only [bind, pure, Option.bind_eq_some_iff, Option.some.injEq] at accepted
+    obtain ⟨inverse, inverseRead, rest, restRead, rfl⟩ := accepted
+    obtain ⟨free, equal⟩ := ih restRead
+    have nonzero : claimMessage challenges claim ≠ 0 := by
+      intro zero
+      have none := (Extension.tryInverse_none_iff _).mpr zero
+      rw [none] at inverseRead
+      cases inverseRead
+    refine ⟨?_, ?_⟩
+    · intro entry member
+      simp only [publicEntries, List.map_cons, List.mem_cons] at member
+      rcases member with rfl | member
+      · exact nonzero
+      · exact free entry member
+    · rw [publicEntries, List.map_cons, LogUp.fractionSum_cons]
+      simp only [LogUp.inverseValue, inverseRead, Option.getD_some, Lean.Grind.Semiring.one_mul]
+      rw [equal]
+      rfl
+
+theorem initialAccumulator_defined (challenges : Challenges) (claims : List (List G))
+    (free : LogUp.PoleFree (publicEntries challenges claims)) :
+    ∃ accumulator, initialAccumulator challenges claims = some accumulator := by
+  induction claims with
+  | nil => exact ⟨0, rfl⟩
+  | cons claim claims ih =>
+    have head : claimMessage challenges claim ≠ 0 := free (1, claimMessage challenges claim) List.mem_cons_self
+    obtain ⟨inverseRead, _⟩ := Extension.inverse_correct _ head
+    obtain ⟨rest, restRead⟩ := ih (fun entry member => free entry (List.mem_cons_of_mem _ member))
+    exact ⟨(claimMessage challenges claim).conjugate.scale (claimMessage challenges claim).norm.inverse + rest,
+      by simp only [initialAccumulator_cons, inverseRead, restRead, bind, pure, Option.bind_some]⟩
+
+theorem initialAccumulator_defined_iff (challenges : Challenges) (claims : List (List G)) :
+    (∃ accumulator, initialAccumulator challenges claims = some accumulator) ↔
+      LogUp.PoleFree (publicEntries challenges claims) :=
+  ⟨fun ⟨_, read⟩ => (initialAccumulator_success read).1, initialAccumulator_defined challenges claims⟩
+
+theorem initialAccumulator_lookupFractions {challenges : Challenges} {claims : List (List G)} {accumulator : Extension}
+    (accepted : initialAccumulator challenges claims = some accumulator) :
+    accumulator = LogUp.lookupFractions (Coordinates.fromExtension challenges.beta)
+      (Coordinates.fromExtension challenges.gamma) (claims.map fun claim => (1, claim)) := by
+  rw [LogUp.lookupFractions, publicEntries_compress]
+  exact (initialAccumulator_success accepted).2
+
+theorem checkRows_cons (challenges : Challenges) (row : ProofShape.Row) (rows : List ProofShape.Row)
+    (entering final : Extension) :
+    checkRows challenges (row :: rows) entering = some final ↔
+      check challenges row entering = some true ∧ checkRows challenges rows row.accumulator = some final := by
+  simp only [checkRows, bind, Option.bind_eq_some_iff]
+  constructor
+  · rintro ⟨accepted, checked, tail⟩
+    cases accepted with
+    | false => cases tail
+    | true => exact ⟨checked, tail⟩
+  · rintro ⟨checked, tail⟩; exact ⟨true, checked, tail⟩
+
+theorem checkRows_final {challenges : Challenges} {rows : List ProofShape.Row} {entering final : Extension}
+    (accepted : checkRows challenges rows entering = some final) :
+    rows.foldl (fun _ row => row.accumulator) entering = final := by
+  induction rows generalizing entering with
+  | nil => exact Option.some.inj accepted
+  | cons row rows ih => exact ih ((checkRows_cons _ _ _ _ _).mp accepted).2
+
+theorem checkRows_row {challenges : Challenges} {rows : List ProofShape.Row} {entering final : Extension}
+    (accepted : checkRows challenges rows entering = some final) {position : Nat} {row : ProofShape.Row}
+    (present : rows[position]? = some row) :
+    ∃ before, (entering :: rows.map (·.accumulator))[position]? = some before ∧
+      check challenges row before = some true := by
+  induction rows generalizing entering position with
+  | nil => simp only [List.getElem?_nil, reduceCtorEq] at present
+  | cons first rows ih =>
+    obtain ⟨checked, tail⟩ := (checkRows_cons _ _ _ _ _).mp accepted
+    cases position with
+    | zero => cases present; exact ⟨entering, rfl, checked⟩
+    | succ position =>
+      obtain ⟨before, beforeRead, rowRead⟩ := ih tail present
+      exact ⟨before, beforeRead, rowRead⟩
+
+theorem checkRows_sum {challenges : Challenges} {rows : List ProofShape.Row} {entering final : Extension}
+    (accepted : checkRows challenges rows entering = some final) (fraction : ProofShape.Row → Extension)
+    (rowIdentity : ∀ row ∈ rows, ∀ before, check challenges row before = some true →
+      fraction row = row.accumulator - before) :
+    LogUp.sum (rows.map fraction) = final - entering := by
+  induction rows generalizing entering with
+  | nil =>
+    have same := Option.some.inj accepted
+    change (0 : Extension) = final - entering
+    rw [same]
+    grind
+  | cons row rows ih =>
+    obtain ⟨checked, tail⟩ := (checkRows_cons _ _ _ _ _).mp accepted
+    have head := rowIdentity row List.mem_cons_self entering checked
+    have rest := ih tail (fun item member => rowIdentity item (List.mem_cons_of_mem _ member))
+    change fraction row + LogUp.sum (rows.map fraction) = final - entering
+    rw [head, rest]
+    grind
+
+theorem verify_true_iff (challenges : Challenges) (claims : List (List G)) (rows : List ProofShape.Row) :
+    verify challenges claims rows = some true ↔ rows ≠ [] ∧
+      ∃ entering, initialAccumulator challenges claims = some entering ∧ checkRows challenges rows entering = some 0 := by
+  unfold verify
+  cases rows with
+  | nil => simp only [List.isEmpty_nil, if_true, reduceCtorEq, ne_eq, not_true_eq_false, false_and]
+  | cons row rows =>
+    simp only [List.isEmpty_cons, Bool.false_eq_true, if_false, bind, pure,
+      Option.bind_eq_some_iff, Option.some.injEq, beq_iff_eq, ne_eq, reduceCtorEq, not_false_eq_true, true_and]
+    constructor
+    · rintro ⟨entering, initial, final, checked, rfl⟩; exact ⟨entering, initial, checked⟩
+    · rintro ⟨entering, initial, checked⟩; exact ⟨entering, initial, 0, checked, rfl⟩
+
+theorem verify_lookup_balance {challenges : Challenges} {claims : List (List G)} {rows : List ProofShape.Row}
+    (accepted : verify challenges claims rows = some true) (fraction : ProofShape.Row → Extension)
+    (rowIdentity : ∀ row ∈ rows, ∀ before, check challenges row before = some true →
+      fraction row = row.accumulator - before) :
+    LogUp.lookupFractions (Coordinates.fromExtension challenges.beta) (Coordinates.fromExtension challenges.gamma)
+      (claims.map fun claim => (1, claim)) + LogUp.sum (rows.map fraction) = 0 := by
+  obtain ⟨_, entering, initial, checked⟩ := (verify_true_iff _ _ _).mp accepted
+  rw [checkRows_sum checked fraction rowIdentity, ← initialAccumulator_lookupFractions initial]
+  grind
+
+theorem verify_row {challenges : Challenges} {claims : List (List G)} {rows : List ProofShape.Row}
+    (accepted : verify challenges claims rows = some true) {position : Nat} {row : ProofShape.Row}
+    (present : rows[position]? = some row) :
+    ∃ initial before result,
+      initialAccumulator challenges claims = some initial ∧
+      (initial :: rows.map (·.accumulator))[position]? = some before ∧
+      evaluate challenges row before = some result ∧
+      Quotient.composition challenges.alpha result.constraints =
+        Domain.vanishing result.domain challenges.zeta * result.quotientValue := by
+  obtain ⟨_, initial, initialRead, checked⟩ := (verify_true_iff _ _ _).mp accepted
+  obtain ⟨before, beforeRead, rowChecked⟩ := checkRows_row checked present
+  obtain ⟨result, evaluated, identity⟩ := (check_true_iff _ _ _).mp rowChecked
+  exact ⟨initial, before, result, initialRead, beforeRead, evaluated, identity⟩
+
+end Aiur.NativeAIR.VerifierArithmetic
+
+namespace Aiur.BoundVerifier
+open NativeAIR
+open NativeAIR.VerifierArithmetic
+
+/-- Every arithmetic-accepted active opening is tied to its actual key,
+proof position, entering accumulator and unfolded graph expressions. -/
+theorem CompiledBackend.checked_row_values {selection : Selection} (backend : CompiledBackend selection)
+    {bytes : ByteArray} (checked : CheckedProof backend.keyData bytes) {challenges : Challenges}
+    {claims : List (List G)} (accepted : VerifierArithmetic.verify challenges claims checked.rows = some true)
+    {position : Nat} {row : ProofShape.Row} (present : checked.rows[position]? = some row) :
+    row.Sourced backend.keyData checked.data row.circuitIndex position ∧ row.Fits backend.keyData.parameters ∧
+      ∃ initial before result trees lookups coordinates,
+        initialAccumulator challenges claims = some initial ∧
+        (initial :: checked.rows.map (·.accumulator))[position]? = some before ∧
+        evaluate challenges row before = some result ∧ row.circuit.graph.unfold = some trees ∧
+        evalRoots ProofCodec.Extension.evalOps (view challenges row before result.selectors)
+          trees row.circuit.graph.zeros = some result.userValues ∧
+        row.circuit.graph.lookups.mapM
+          (evalLookup ProofCodec.Extension.evalOps (view challenges row before result.selectors) trees) = some lookups ∧
+        LogUp.equations lookups (rowColumns row .stage2 .current) (rowColumns row .stage2 .next)
+          (publics challenges before row.accumulator) (deltaScaled result.domain before row.accumulator)
+          result.selectors.isLast row.circuit.lookupGroupSize = some coordinates ∧
+        result.lookupValues = LogUp.Coordinates.flatten coordinates ∧
+        Quotient.composition challenges.alpha result.constraints =
+          Domain.vanishing result.domain challenges.zeta * result.quotientValue := by
+  obtain ⟨_, sourced, fits⟩ := checked.row present
+  obtain ⟨initial, before, result, initialRead, beforeRead, evaluated, identity⟩ := verify_row accepted present
+  have valid := backend.toBackend.key_graph_valid (List.mem_of_getElem? sourced.circuit)
+  obtain ⟨trees, lookups, coordinates, unfolded, _, roots, lookupValues, equations, equal⟩ :=
+    evaluate_reflects evaluated valid
+  exact ⟨sourced, fits, initial, before, result, trees, lookups, coordinates, initialRead, beforeRead,
+    evaluated, unfolded, roots, lookupValues, equations, equal, identity⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Proofs/VerifierArithmetic.lean b/Ix/Aiur/Proofs/VerifierArithmetic.lean
new file mode 100644
index 000000000..c7fef666d
--- /dev/null
+++ b/Ix/Aiur/Proofs/VerifierArithmetic.lean
@@ -0,0 +1,173 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OpeningShape
+import Ix.Aiur.Proofs.Quotient
+
+/-! The complete opened-row arithmetic check has defined reads on a shaped
+row from the selected compiled key. Acceptance reflects the graph's unfolded
+expressions and the quotient identity at the supplied challenge. It does
+not by itself imply individual constraints vanish on the trace domain.
+-/
+
+namespace Aiur.NativeAIR.VerifierArithmetic
+open ProofCodec (Extension)
+
+structure Evaluation.Reads (challenges : Challenges) (row : ProofShape.Row) (entering : Extension)
+    (result : Evaluation) : Prop where
+  domain : Domain.ofLogSize row.logDegree.toNat = some result.domain
+  selectors : Domain.selectors result.domain challenges.zeta = some result.selectors
+  nodes : row.circuit.graph.sweep Extension.evalOps (view challenges row entering result.selectors) = some result.nodeValues
+  user : readNodes result.nodeValues row.circuit.graph.zeros = some result.userValues
+  lookup : LogUp.constraintValues row.circuit.graph.lookups result.nodeValues
+    (rowColumns row .stage2 .current) (rowColumns row .stage2 .next)
+    (publics challenges entering row.accumulator) (deltaScaled result.domain entering row.accumulator)
+    result.selectors.isLast row.circuit.lookupGroupSize = some result.lookupValues
+  quotient : Quotient.evaluate result.domain challenges.zeta row.quotient = some result.quotientValue
+
+theorem evaluate_success {challenges : Challenges} {row : ProofShape.Row} {entering : Extension}
+    {result : Evaluation} (accepted : evaluate challenges row entering = some result) :
+    result.Reads challenges row entering := by
+  simp only [evaluate, bind, pure, Option.bind_eq_some_iff, Option.some.injEq] at accepted
+  obtain ⟨domain, hd, selectors, hs, nodes, hn, user, hu, lookup, hl, quotient, hq, rfl⟩ := accepted
+  exact ⟨hd, hs, hn, hu, hl, hq⟩
+
+theorem Evaluation.Reads.evaluate {challenges : Challenges} {row : ProofShape.Row} {entering : Extension}
+    {result : Evaluation} (reads : result.Reads challenges row entering) :
+    evaluate challenges row entering = some result := by
+  simp only [VerifierArithmetic.evaluate, bind, pure, Option.bind_eq_some_iff, Option.some.injEq]
+  exact ⟨result.domain, reads.domain, result.selectors, reads.selectors, result.nodeValues, reads.nodes,
+    result.userValues, reads.user, result.lookupValues, reads.lookup, result.quotientValue, reads.quotient, rfl⟩
+
+theorem evaluate_defined {parameters : KeyCodec.Parameters} {row : ProofShape.Row}
+    (fits : row.Fits parameters) (valid : row.circuit.valid = true)
+    (absent : row.preprocessed = none → row.circuit.preprocessedWidth = 0)
+    (challenges : Challenges) (entering : Extension) {domain : Domain.Subgroup}
+    (domainRead : Domain.ofLogSize row.logDegree.toNat = some domain)
+    (nonzero : Domain.vanishing domain challenges.zeta ≠ 0) :
+    ∃ result, evaluate challenges row entering = some result := by
+  obtain ⟨positive, bounded, graphValid, _⟩ := KeyCodec.Circuit.valid_graph valid
+  obtain ⟨selectors, selectorsRead⟩ := Domain.selectors_defined domain challenges.zeta nonzero
+  let values := view challenges row entering selectors
+  obtain ⟨nodes, swept, length⟩ := graphValid.sweep_defined Extension.evalOps values
+    (view_fits fits absent challenges entering selectors)
+  obtain ⟨user, userRead, _⟩ := readNodes_defined nodes row.circuit.graph.zeros (by
+    intro index member; rw [length]; exact graphValid.zeros index member)
+  have widths := stage2_width fits positive
+  obtain ⟨lookup, lookupRead⟩ := LogUp.constraintValues_defined row.circuit.graph.lookups nodes
+    (rowColumns row .stage2 .current) (rowColumns row .stage2 .next)
+    (publics challenges entering row.accumulator) (deltaScaled domain entering row.accumulator)
+    selectors.isLast row.circuit.lookupGroupSize bounded
+    (by intro lookup member index root
+        rw [length]
+        exact graphValid.lookups index (List.mem_flatMap.mpr ⟨lookup, member, root⟩))
+    widths.1 widths.2 (by rw [publics_size]; decide) (by rw [deltaScaled_size]; decide)
+  obtain ⟨coefficients, coefficientRead⟩ := Quotient.coefficients_defined row.quotient (by rw [fits.quotient]; omega)
+  refine ⟨⟨domain, selectors, nodes, user, lookup, Quotient.horner (challenges.zeta.power (Domain.size domain)) coefficients⟩,
+    Evaluation.Reads.evaluate ⟨domainRead, selectorsRead, swept, userRead, lookupRead, ?_⟩⟩
+  simp only [Quotient.evaluate, coefficientRead, bind, pure, Option.bind_some]
+
+theorem evaluate_defined_iff {parameters : KeyCodec.Parameters} {row : ProofShape.Row}
+    (fits : row.Fits parameters) (valid : row.circuit.valid = true)
+    (absent : row.preprocessed = none → row.circuit.preprocessedWidth = 0)
+    (challenges : Challenges) (entering : Extension) :
+    (∃ result, evaluate challenges row entering = some result) ↔
+      ∃ domain, Domain.ofLogSize row.logDegree.toNat = some domain ∧ Domain.vanishing domain challenges.zeta ≠ 0 := by
+  constructor
+  · rintro ⟨result, evaluated⟩
+    have reads := evaluate_success evaluated
+    exact ⟨result.domain, reads.domain, (Domain.selectors_defined_iff _ _).mp ⟨result.selectors, reads.selectors⟩⟩
+  · rintro ⟨domain, read, nonzero⟩
+    exact evaluate_defined fits valid absent challenges entering read nonzero
+
+theorem evaluate_constraint_count {challenges : Challenges} {row : ProofShape.Row} {entering : Extension}
+    {result : Evaluation} (accepted : evaluate challenges row entering = some result)
+    (positive : 0 < row.circuit.lookupGroupSize) :
+    result.constraints.length = row.circuit.constraintCount := by
+  have reads := evaluate_success accepted
+  have user := Bytecode.AIR.list_mapM_some_length _ _ _ reads.user
+  have lookup := LogUp.constraintValues_length reads.lookup
+  simp only [Evaluation.constraints, List.length_append, KeyCodec.Circuit.constraintCount,
+    user, lookup, LogUp.groupCount_key row.circuit positive]
+  omega
+
+theorem evaluate_reflects {challenges : Challenges} {row : ProofShape.Row} {entering : Extension}
+    {result : Evaluation} (accepted : evaluate challenges row entering = some result)
+    (valid : row.circuit.graph.Valid row.circuit.widths) :
+    ∃ trees lookups coordinates,
+      row.circuit.graph.unfold = some trees ∧
+      Reflects Extension.evalOps (view challenges row entering result.selectors) trees result.nodeValues ∧
+      evalRoots Extension.evalOps (view challenges row entering result.selectors) trees row.circuit.graph.zeros =
+        some result.userValues ∧
+      row.circuit.graph.lookups.mapM (evalLookup Extension.evalOps (view challenges row entering result.selectors) trees) =
+        some lookups ∧
+      LogUp.equations lookups (rowColumns row .stage2 .current) (rowColumns row .stage2 .next)
+        (publics challenges entering row.accumulator) (deltaScaled result.domain entering row.accumulator)
+        result.selectors.isLast row.circuit.lookupGroupSize = some coordinates ∧
+      result.lookupValues = LogUp.Coordinates.flatten coordinates := by
+  have reads := evaluate_success accepted
+  obtain ⟨trees, unfolded, _⟩ := valid.unfold_defined
+  have reflected := row.circuit.graph.sweep_reflects Extension.evalOps _ unfolded reads.nodes
+  obtain ⟨lookups, coordinates, lookupRead, equationsRead, equal⟩ := LogUp.constraintValues_success reads.lookup
+  have same : readLookup result.nodeValues =
+      evalLookup Extension.evalOps (view challenges row entering result.selectors) trees :=
+    funext reflected.readLookup
+  exact ⟨trees, lookups, coordinates, unfolded, reflected,
+    (reflected.readNodes _).symm.trans reads.user, same ▸ lookupRead, equationsRead, equal⟩
+
+theorem Evaluation.Reads.identity {challenges : Challenges} {row : ProofShape.Row} {entering : Extension}
+    {result : Evaluation} (reads : result.Reads challenges row entering) :
+    result.accepts challenges.alpha = true ↔
+      Quotient.composition challenges.alpha result.constraints =
+        Domain.vanishing result.domain challenges.zeta * result.quotientValue := by
+  have invert := (Domain.selectors_success _ _ _ reads.selectors).2.2.2
+  simp only [Evaluation.accepts, beq_iff_eq]
+  exact Quotient.inverse_check _ _ _ _ invert
+
+theorem check_true_iff (challenges : Challenges) (row : ProofShape.Row) (entering : Extension) :
+    check challenges row entering = some true ↔
+      ∃ result, evaluate challenges row entering = some result ∧
+        Quotient.composition challenges.alpha result.constraints =
+          Domain.vanishing result.domain challenges.zeta * result.quotientValue := by
+  simp only [check, bind, pure, Option.bind_eq_some_iff, Option.some.injEq]
+  constructor
+  · rintro ⟨result, read, accepted⟩
+    exact ⟨result, read, (evaluate_success read).identity.mp accepted⟩
+  · rintro ⟨result, read, identity⟩
+    exact ⟨result, read, (evaluate_success read).identity.mpr identity⟩
+
+theorem check_quotient {challenges : Challenges} {row : ProofShape.Row} {entering : Extension}
+    {result : Evaluation} (evaluated : evaluate challenges row entering = some result) :
+    check challenges row entering =
+      Quotient.check result.domain challenges.zeta challenges.alpha result.constraints row.quotient := by
+  have reads := evaluate_success evaluated
+  simp only [check, evaluated, Quotient.check, reads.selectors, reads.quotient, Evaluation.accepts,
+    bind, pure, Option.bind_some]
+
+end Aiur.NativeAIR.VerifierArithmetic
+
+namespace Aiur.BoundVerifier
+open NativeAIR
+
+theorem CompiledBackend.checked_row_arithmetic {selection : Selection} (backend : CompiledBackend selection)
+    {bytes : ByteArray} (checked : CheckedProof backend.keyData bytes) {position : Nat} {row : ProofShape.Row}
+    (present : checked.rows[position]? = some row)
+    (challenges : VerifierArithmetic.Challenges) (entering : ProofCodec.Extension) :
+    ∃ domain, Domain.ofLogSize row.logDegree.toNat = some domain ∧
+      ((∃ result, VerifierArithmetic.evaluate challenges row entering = some result) ↔
+        Domain.vanishing domain challenges.zeta ≠ 0) := by
+  obtain ⟨_, sourced, fits⟩ := checked.row present
+  obtain ⟨domain, domainRead⟩ := VerifierArithmetic.domain_defined fits
+  have valid := (KeyCodec.decode_valid backend.toBackend.key_decodes).1 row.circuit
+    (List.mem_of_getElem? sourced.circuit)
+  refine ⟨domain, domainRead, ?_⟩
+  rw [VerifierArithmetic.evaluate_defined_iff fits valid (backend.row_preprocessed_absent sourced)]
+  constructor
+  · rintro ⟨other, otherRead, nonzero⟩
+    cases Option.some.inj (domainRead.symm.trans otherRead)
+    exact nonzero
+  · intro nonzero; exact ⟨domain, domainRead, nonzero⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/PrunedMerkle.lean b/Ix/Aiur/PrunedMerkle.lean
new file mode 100644
index 000000000..932198dcc
--- /dev/null
+++ b/Ix/Aiur/PrunedMerkle.lean
@@ -0,0 +1,155 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Merkle
+
+/-! Binary shared MMCS replay. The verifier-selected indices determine the
+sorted frontier and the exact boundary proof length. Logs survive rejection:
+native group-consistency checks can fail after earlier hashes in the layer.
+Reconstructed individual paths are retained for authentication proofs.
+-/
+
+namespace Aiur.NativeAIR.PrunedMerkle
+
+open Merkle (Digest Hash Dimensions)
+
+structure Logged (α : Type) where
+  result : Option α
+  inputs : List (List UInt8)
+  deriving DecidableEq, Repr
+
+def Logged.pure (value : α) : Logged α := ⟨some value, []⟩
+
+def Logged.bind (first : Logged α) (next : α → Logged β) : Logged β :=
+  match first.result with
+  | none => ⟨none, first.inputs⟩
+  | some value =>
+    let rest := next value
+    ⟨rest.result, first.inputs ++ rest.inputs⟩
+
+instance : Monad Logged where
+  pure := Logged.pure
+  bind := Logged.bind
+
+def reject : Logged α := ⟨none, []⟩
+
+def ofOption (value : Option α) : Logged α := ⟨value, []⟩
+
+def hashInput (hash : Hash) (input : List UInt8) : Logged Digest := ⟨some (hash input), [input]⟩
+
+structure Ticket where
+  index : Nat
+  rows : List (List G)
+  proof : List Digest
+  deriving DecidableEq, Repr
+
+def Ticket.extend (sibling : Digest) (ticket : Ticket) : Ticket :=
+  { ticket with proof := ticket.proof ++ [sibling] }
+
+structure Node where
+  index : Nat
+  digest : Digest
+  tickets : List Ticket
+  deriving DecidableEq, Repr
+
+def uniqueIndices (indices : List Nat) : List Nat := (indices.mergeSort (· ≤ ·)).eraseDups
+
+def parentIndices (indices : List Nat) : List Nat := (indices.map (· / 2)).eraseDups
+
+/-- Each binary parent has two children; only uncovered children are sent. -/
+def boundaryCount : Nat → List Nat → Nat
+  | 0, _ => 0
+  | steps + 1, indices =>
+    let parents := parentIndices indices
+    (2 * parents.length - indices.length) + boundaryCount steps parents
+
+def representatives (indices : List Nat) (rows : List (List (List G))) : Option (List Ticket) :=
+  let originals := indices.zip rows
+  (uniqueIndices indices).mapM fun index => do
+    let (_, values) ← originals.find? fun entry => entry.1 == index
+    if originals.all (fun entry => entry.1 != index || entry.2 == values) then
+      some ⟨index, values, []⟩
+    else none
+
+def initial (hash : Hash) (dimensions : List Dimensions) (height : Nat) : List Ticket → Logged (List Node)
+  | [] => pure []
+  | ticket :: tickets => do
+    let digest ← hashInput hash (Merkle.rowBytes dimensions ticket.rows height)
+    let rest ← initial hash dimensions height tickets
+    return ⟨ticket.index, digest, [ticket]⟩ :: rest
+
+/-- Pair every parent before injecting any shorter rows at this layer. -/
+def combine (hash : Hash) : List Node → List Digest → Logged (List Node × List Digest)
+  | [], proof => pure ([], proof)
+  | first :: rest, proof =>
+    match rest with
+    | second :: tail =>
+      if first.index % 2 = 0 ∧ second.index = first.index + 1 then do
+        let digest ← hashInput hash (Merkle.pairBytes first.digest second.digest)
+        let (nodes, remaining) ← combine hash tail proof
+        let tickets := first.tickets.map (Ticket.extend second.digest) ++
+          second.tickets.map (Ticket.extend first.digest)
+        return (⟨first.index / 2, digest, tickets⟩ :: nodes, remaining)
+      else do
+        let sibling :: remaining := proof | reject
+        let digest ← hashInput hash (Merkle.branchBytes first.index first.digest sibling)
+        let (nodes, remaining) ← combine hash rest remaining
+        return (⟨first.index / 2, digest, first.tickets.map (Ticket.extend sibling)⟩ :: nodes, remaining)
+    | [] => do
+      let sibling :: remaining := proof | reject
+      let digest ← hashInput hash (Merkle.branchBytes first.index first.digest sibling)
+      return ([⟨first.index / 2, digest, first.tickets.map (Ticket.extend sibling)⟩], remaining)
+
+def inject (hash : Hash) (dimensions : List Dimensions) (height : Nat) : List Node → Logged (List Node)
+  | [] => pure []
+  | node :: nodes => do
+    let lead :: members := node.tickets | reject
+    if !(members.all fun ticket =>
+        Merkle.rowsAt dimensions ticket.rows height == Merkle.rowsAt dimensions lead.rows height) then reject
+    else
+      let leaf ← hashInput hash (Merkle.rowBytes dimensions lead.rows height)
+      let digest ← hashInput hash (Merkle.pairBytes node.digest leaf)
+      let rest ← inject hash dimensions height nodes
+      return { node with digest } :: rest
+
+def walk (hash : Hash) (dimensions : List Dimensions) :
+    Nat → Nat → List Node → List Digest → Logged (List Node × List Digest)
+  | 0, _, nodes, proof => pure (nodes, proof)
+  | steps + 1, height, nodes, proof => do
+    let (parents, remaining) ← combine hash nodes proof
+    let next ← if Merkle.hasHeight dimensions (height - 1) then
+      inject hash dimensions (height - 1) parents else pure parents
+    walk hash dimensions steps (height - 1) next remaining
+
+def replay (hash : Hash) (dimensions : List Dimensions) (capHeight : Nat)
+    (indices : List Nat) (rows : List (List (List G))) (proof : List Digest) : Logged (List Node) := do
+  if dimensions.isEmpty || rows.length != indices.length then reject
+  else
+    let height := Merkle.maxHeight dimensions
+    let steps := height - capHeight
+    if !(indices.all fun index => index < 2^height) then reject
+    else
+      let tickets ← ofOption (representatives indices rows)
+      if proof.length != boundaryCount steps (uniqueIndices indices) ||
+          !(tickets.all fun ticket => Merkle.shape dimensions ticket.rows) then reject
+      else
+        let leaves ← initial hash dimensions height tickets
+        let (nodes, remaining) ← walk hash dimensions steps height leaves proof
+        if remaining.isEmpty then pure nodes else reject
+
+def accepts (cap : List Digest) (nodes : List Node) : Bool :=
+  nodes.all fun node => cap[node.index]? == some node.digest
+
+def verify (hash : Hash) (dimensions : List Dimensions) (capHeight : Nat)
+    (indices : List Nat) (cap : List Digest) (rows : List (List (List G))) (proof : List Digest) : Bool :=
+  match (replay hash dimensions capHeight indices rows proof).result with
+  | none => false
+  | some nodes => accepts cap nodes
+
+def verifyCovered (hash : Hash) (dimensions : List Dimensions) (capHeight : Nat)
+    (indices : List Nat) (cap : List Digest) (rows : List (List (List G))) (proof : List Digest) : Bool :=
+  Merkle.covered dimensions capHeight && verify hash dimensions capHeight indices cap rows proof
+
+end Aiur.NativeAIR.PrunedMerkle
diff --git a/Ix/Aiur/Quotient.lean b/Ix/Aiur/Quotient.lean
new file mode 100644
index 000000000..2b20f627d
--- /dev/null
+++ b/Ix/Aiur/Quotient.lean
@@ -0,0 +1,37 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Domain
+
+/-! The native composition fold and quotient coefficient recombination.
+Each quotient slice combines two challenge-field values with the native
+extension basis. An odd number of coordinates or a selector pole is rejected.
+-/
+
+namespace Aiur.NativeAIR.Quotient
+
+open ProofCodec (Extension)
+
+def horner [OfNat W 0] [Add W] [Mul W] (point : W) (coefficients : List W) : W :=
+  coefficients.foldr (fun coefficient rest => coefficient + point * rest) 0
+
+def composition [OfNat W 0] [Add W] [Mul W] (alpha : W) (constraints : List W) : W :=
+  constraints.foldl (fun accumulated value => accumulated * alpha + value) 0
+
+def coefficients : List Extension → Option (List Extension)
+  | [] => some []
+  | [_] => none
+  | first :: second :: rest => return (first + second * Extension.basis) :: (← coefficients rest)
+
+def evaluate (domain : Domain.Subgroup) (point : Extension) (row : List Extension) : Option Extension := do
+  return horner (point.power (Domain.size domain)) (← coefficients row)
+
+def check (domain : Domain.Subgroup) (point alpha : Extension)
+    (constraints row : List Extension) : Option Bool := do
+  let selected ← Domain.selectors domain point
+  let quotient ← evaluate domain point row
+  return composition alpha constraints * selected.invVanishing == quotient
+
+end Aiur.NativeAIR.Quotient
diff --git a/Ix/Aiur/RowCounts.lean b/Ix/Aiur/RowCounts.lean
new file mode 100644
index 000000000..81e888c73
--- /dev/null
+++ b/Ix/Aiur/RowCounts.lean
@@ -0,0 +1,105 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+module
+public import Ix.Aiur.Stages.Bytecode
+
+/-! Total control counts and circuit checks independent of witness values.
+These checks bound branch/terminal counts and the number of raw return writers.
+Physical columns, lookup cursors and value indices remain separate. -/
+
+public section
+@[expose] section
+
+namespace Aiur.Bytecode
+
+/-- Counts of control nodes, allocated leaf selectors, returns and escaping
+yields. Consumed yields still allocate selectors. -/
+structure ControlCounts where
+  nodes : Nat
+  leaves : Nat
+  returns : Nat
+  yields : Nat
+  deriving Repr, DecidableEq
+
+def ControlCounts.sum (items : List ControlCounts) : ControlCounts :=
+  ⟨(items.map (·.nodes)).sum, (items.map (·.leaves)).sum,
+    (items.map (·.returns)).sum, (items.map (·.yields)).sum⟩
+
+def ControlCounts.branch (items : List ControlCounts) : ControlCounts :=
+  { sum items with nodes := (sum items).nodes + 1 }
+
+def ControlCounts.continue (branches continuation : ControlCounts) : ControlCounts :=
+  ⟨branches.nodes + continuation.nodes, branches.leaves + continuation.leaves,
+    branches.returns + continuation.returns, continuation.yields⟩
+
+private theorem counts_block_smaller (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+def Ctrl.controlCounts : Ctrl → ControlCounts
+  | .return .. => ⟨1, 1, 1, 0⟩
+  | .yield .. => ⟨1, 1, 0, 1⟩
+  | .match _ branches fallback => ControlCounts.branch (
+      (branches.attach.toList.map fun ⟨pair, _⟩ => pair.2.controlCounts) ++
+      (match fallback with | none => [] | some block => [block.controlCounts]))
+  | .matchContinue _ branches fallback _ _ _ continuation => (ControlCounts.branch (
+      (branches.attach.toList.map fun ⟨pair, _⟩ => pair.2.controlCounts) ++
+      (match fallback with | none => [] | some block => [block.controlCounts]))).continue
+        continuation.controlCounts
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+
+def Block.controlCounts (block : Block) : ControlCounts := block.ctrl.controlCounts
+termination_by sizeOf block
+decreasing_by exact counts_block_smaller block
+
+end
+
+def branchControlCounts (branches : Array (G × Block)) (fallback : Option Block) : List ControlCounts :=
+  branches.toList.map (fun pair => pair.2.controlCounts) ++
+    fallback.toList.map (fun block => block.controlCounts)
+
+/-- Syntax-only count checks for the functions actually named by a circuit.
+The allocated selector count bounds all return/yield leaves, including yields
+consumed by continuations. Other layout and value-index checks are separate. -/
+def Circuit.validateRowCounts (program : Toplevel) (circuit : Circuit) : Bool :=
+  circuit.members.size < gSize.toNat &&
+    match circuit.members.toList.mapM (fun index => program.functions[index]?) with
+    | none => false
+    | some functions =>
+      functions.all (fun function => function.body.controlCounts.nodes < gSize.toNat) &&
+        (functions.map (fun function => function.body.controlCounts.leaves)).sum ≤ circuit.layout.selectors
+
+def Toplevel.validateRowCounts (program : Toplevel) : Bool :=
+  program.circuits.all (Circuit.validateRowCounts program)
+
+theorem Ctrl.controlCounts_match (index : ValIdx) (branches : Array (G × Block)) (fallback : Option Block) :
+    (Ctrl.match index branches fallback).controlCounts =
+      ControlCounts.branch (branchControlCounts branches fallback) := by
+  rw [Ctrl.controlCounts.eq_def]
+  simp only [branchControlCounts, Array.toList_attach]
+  rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.controlCounts)]
+  cases fallback <;> rfl
+
+theorem Ctrl.controlCounts_matchContinue (index : ValIdx) (branches : Array (G × Block))
+    (fallback : Option Block) (outputs aux lookups : Nat) (continuation : Block) :
+    (Ctrl.matchContinue index branches fallback outputs aux lookups continuation).controlCounts =
+      (ControlCounts.branch (branchControlCounts branches fallback)).continue continuation.controlCounts := by
+  rw [Ctrl.controlCounts.eq_def]
+  simp only [branchControlCounts, Array.toList_attach]
+  rw [List.attachWith_map_val (f := fun pair : G × Block => pair.2.controlCounts)]
+  cases fallback <;> rfl
+
+end Aiur.Bytecode
+
+end
+end
diff --git a/Ix/Aiur/Semantics/AIR.lean b/Ix/Aiur/Semantics/AIR.lean
new file mode 100644
index 000000000..f3acc5df8
--- /dev/null
+++ b/Ix/Aiur/Semantics/AIR.lean
@@ -0,0 +1,214 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+module
+public import Ix.Aiur.Stages.Bytecode
+
+/-!
+Relational bytecode semantics for AIR extraction.
+
+Each local execution records its constrained call requests. Advice is chosen
+at each operation, including I/O reads and unconstrained calls. I/O writes,
+key insertion and debugging impose no relation, as in the native constraint
+emitter. Memory is a shared relation between width, pointer and contents;
+its functionality is a separate memory-table obligation.
+
+`Execution` closes local executions into finite call derivations. It neither
+replays the runtime cache nor identifies advice with native hint results.
+Proving that arbitrary native AIR rows have these local semantics, and that
+the selected certified program checks the advice it needs, remain obligations.
+-/
+
+public section
+@[expose] section
+
+namespace Aiur.Bytecode.AIR
+
+/-- Immutable memory facts supplied by the memory tables. -/
+abbrev Memory := Nat → G → Array G → Prop
+
+/-- A full function lookup, before channel encoding or compression. -/
+structure Call where
+  function : FunIdx
+  inputs : Array G
+  outputs : Array G
+  rank : G
+  deriving DecidableEq
+
+/-- Read all indexed values, rejecting an invalid index. -/
+def readValues (values : Array G) (indices : Array ValIdx) : Option (Array G) :=
+  indices.mapM fun index => values[index]?
+
+/-- Little-endian packing as field arithmetic. The caller checks length four. -/
+def packWord (bytes : Array G) : G :=
+  bytes.toList.zipIdx.foldl (fun value (byte, index) =>
+    value + byte * G.ofNat (256 ^ index)) 0
+
+def adviceOfSize (size : Nat) (advice : Array G) : Option (Array G) :=
+  if advice.size = size then some advice else none
+
+def unaryByte (values : Array G) (index : ValIdx)
+    (compute : G → Array G) : Option (Array G) := do
+  let value ← values[index]?
+  if value.n < 256 then some (compute value) else none
+
+def binaryByte (values : Array G) (left right : ValIdx)
+    (compute : G → G → Array G) : Option (Array G) := do
+  let x ← values[left]?
+  let y ← values[right]?
+  if x.n < 256 ∧ y.n < 256 then some (compute x y) else none
+
+def pairValues (pair : G × G) : Array G := #[pair.1, pair.2]
+
+def readWord (values : Array G) (indices : Array ValIdx) : Option G := do
+  if indices.size ≠ 4 then none else do
+    let bytes ← readValues values indices
+    some (packWord bytes)
+
+/-- Local operation outputs. Calls constrained by function lookups and
+memory operations have separate `Step` constructors. All other constructors
+are covered here, including the virtual carry of an unconstrained u32 sum.
+Byte gadgets require their table input ranges; advice bytes do not. -/
+def primitive (op : Op) (values advice : Array G) : Option (Array G) :=
+  match op with
+  | .const value => some #[value]
+  | .add a b => do return #[(← values[a]?) + (← values[b]?)]
+  | .sub a b => do return #[(← values[a]?) - (← values[b]?)]
+  | .mul a b => do return #[(← values[a]?) * (← values[b]?)]
+  | .eqZero a => do return #[G.eqZero (← values[a]?)]
+  | .call _ _ outputSize true => adviceOfSize outputSize advice
+  | .call _ _ _ false | .store _ | .load _ _ => none
+  | .assertEq xs ys _ => do
+    let left ← readValues values xs
+    let right ← readValues values ys
+    if left = right then some #[] else none
+  | .ioGetInfo _ _ => adviceOfSize 2 advice
+  | .ioRead _ _ size => adviceOfSize size advice
+  | .ioSetInfo _ _ _ _ | .ioWrite _ _ | .debug _ _ => some #[]
+  | .u8BitDecomposition a => unaryByte values a (Array.ofFn ∘ G.u8BitDecomposition)
+  | .u8ShiftLeft a => unaryByte values a fun x => #[G.u8ShiftLeft x]
+  | .u8ShiftRight a => unaryByte values a fun x => #[G.u8ShiftRight x]
+  | .u8Xor a b => binaryByte values a b fun x y => #[G.u8Xor x y]
+  | .u8Add a b => binaryByte values a b fun x y => pairValues (G.u8Add x y)
+  | .u8Mul a b => binaryByte values a b fun x y => pairValues (G.u8Mul x y)
+  | .u8Sub a b => binaryByte values a b fun x y => pairValues (G.u8Sub x y)
+  | .u8And a b => binaryByte values a b fun x y => #[G.u8And x y]
+  | .u8Or a b => binaryByte values a b fun x y => #[G.u8Or x y]
+  | .u8LessThan a b => binaryByte values a b fun x y => #[G.u8LessThan x y]
+  | .u8XorSplit7 a b => binaryByte values a b fun x y =>
+      let z := x.n ^^^ y.n
+      #[G.ofNat (z / 128), G.ofNat ((z * 2) % 256)]
+  | .u8XorSplit4 a b => binaryByte values a b fun x y =>
+      let z := x.n ^^^ y.n
+      #[G.ofNat (z / 16), G.ofNat ((z * 16) % 256)]
+  | .u8RangeCheck a b => binaryByte values a b fun _ _ => #[]
+  | .u32LessThan a b => do
+    let x ← values[a]?
+    let y ← values[b]?
+    if x.n < 2 ^ 32 ∧ y.n < 2 ^ 32 then some #[G.u32LessThan x y] else none
+  | .unconstrainedBigUintDivMod _ _ => adviceOfSize 2 advice
+  | .unconstrainedGToBytes _ => adviceOfSize 8 advice
+  | .unconstrainedGInverse _ => adviceOfSize 1 advice
+  | .unconstrainedU32Add a b => do
+    let x ← readWord values a
+    let y ← readWord values b
+    let bytes ← adviceOfSize 4 advice
+    return bytes.push ((x + y - packWord bytes) * 0xfffffffe00000002)
+  | .unconstrainedU32Add3 a b c => do
+    let x ← readWord values a
+    let y ← readWord values b
+    let z ← readWord values c
+    let bytes ← adviceOfSize 4 advice
+    return bytes.push ((x + y + z - packWord bytes) * 0xfffffffe00000002)
+  | .u32ToField bytes => do return #[← readWord values bytes]
+
+/-- One operation, with the constrained calls it requests. Advice is local
+to this occurrence, even when the same operation appears in another row. -/
+inductive Step (memory : Memory) : Op → Array G → Array G → List Call → Prop
+  | primitive (evaluated : primitive op values advice = some outputs) :
+      Step memory op values (values ++ outputs) []
+  | call (arguments : readValues values indices = some request.inputs)
+      (outputSize : request.outputs.size = size) :
+      Step memory (.call request.function indices size false) values
+        (values ++ request.outputs) [request]
+  | store (arguments : readValues values indices = some contents)
+      (stored : memory contents.size pointer contents) :
+      Step memory (.store indices) values (values.push pointer) []
+  | load (address : values[index]? = some pointer)
+      (width : contents.size = size) (loaded : memory size pointer contents) :
+      Step memory (.load size index) values (values ++ contents) []
+
+inductive RunOps (memory : Memory) : List Op → Array G → Array G → List Call → Prop
+  | nil : RunOps memory [] values values []
+  | cons (first : Step memory op values intermediate firstCalls)
+      (rest : RunOps memory ops intermediate finalValues restCalls) :
+      RunOps memory (op :: ops) values finalValues (firstCalls ++ restCalls)
+
+/-- Returns escape the function; yields enter the nearest continuation. -/
+inductive Outcome where
+  | returned : Array G → Outcome
+  | yielded : Array G → Outcome
+
+/-- A matching branch, or the default when no discriminant matches.
+Duplicate case keys remain nondeterministic here, as permitted by the
+selector equations; compiler uniqueness is a separate obligation. -/
+inductive SelectArm (scrutinee : G) (cases : Array (G × Block))
+    (fallback : Option Block) : Block → Prop
+  | case (member : (scrutinee, block) ∈ cases.toList) :
+      SelectArm scrutinee cases fallback block
+  | fallback (selected : fallback = some block)
+      (unmatched : ∀ pair ∈ cases.toList, pair.1 ≠ scrutinee) :
+      SelectArm scrutinee cases fallback block
+
+mutual
+
+inductive RunBlock (memory : Memory) : Block → Array G → Outcome → List Call → Prop
+  | block (operations : RunOps memory block.ops.toList values intermediate opCalls)
+      (control : RunCtrl memory block.ctrl intermediate outcome ctrlCalls) :
+      RunBlock memory block values outcome (opCalls ++ ctrlCalls)
+
+inductive RunCtrl (memory : Memory) : Ctrl → Array G → Outcome → List Call → Prop
+  | returned (result : readValues values indices = some outputs) :
+      RunCtrl memory (.return selector indices) values (.returned outputs) []
+  | yielded (result : readValues values indices = some outputs) :
+      RunCtrl memory (.yield selector indices) values (.yielded outputs) []
+  | match (value : values[index]? = some scrutinee)
+      (selected : SelectArm scrutinee cases fallback arm)
+      (branch : RunBlock memory arm values outcome calls) :
+      RunCtrl memory (.match index cases fallback) values outcome calls
+  | matchContinueReturn (value : values[index]? = some scrutinee)
+      (selected : SelectArm scrutinee cases fallback arm)
+      (branch : RunBlock memory arm values (.returned outputs) calls) :
+      RunCtrl memory (.matchContinue index cases fallback size aux lookups continuation)
+        values (.returned outputs) calls
+  | matchContinueYield (value : values[index]? = some scrutinee)
+      (selected : SelectArm scrutinee cases fallback arm)
+      (branch : RunBlock memory arm values (.yielded yielded) branchCalls)
+      (outputSize : yielded.size = size)
+      (continued : RunBlock memory continuation (values ++ yielded) outcome contCalls) :
+      RunCtrl memory (.matchContinue index cases fallback size aux lookups continuation)
+        values outcome (branchCalls ++ contCalls)
+
+end
+
+/-- Local meaning of one function row, before resolving its call requests. -/
+inductive RunFunction (program : Toplevel) (memory : Memory) : Call → List Call → Prop
+  | function (selected : program.functions[request.function]? = some function)
+      (arity : function.layout.inputSize = request.inputs.size)
+      (body : RunBlock memory function.body request.inputs (.returned request.outputs) calls) :
+      RunFunction program memory request calls
+
+/-- A finite derivation: every constrained call has its own finite derivation.
+Rows may be reused by several callers. Advice and immutable memory facts are
+retained by the local relations, without asserting sequential cache effects. -/
+inductive Execution (program : Toplevel) (memory : Memory) : Call → Prop
+  | function (row : RunFunction program memory request calls)
+      (children : ∀ child ∈ calls, Execution program memory child) :
+      Execution program memory request
+
+end Aiur.Bytecode.AIR
+
+end
+end
diff --git a/Ix/Aiur/Semantics/BytecodeEval.lean b/Ix/Aiur/Semantics/BytecodeEval.lean
index 7656bcec9..987fc6c6f 100644
--- a/Ix/Aiur/Semantics/BytecodeEval.lean
+++ b/Ix/Aiur/Semantics/BytecodeEval.lean
@@ -6,17 +6,18 @@ public import Ix.IndexMap
 /-!
 Lean-native bytecode reference evaluator.
 
-Mirrors `src/aiur/execute.rs` in big-step form:
+Uncached big-step model of bytecode operations:
 - No `QueryRecord` (trace-side bookkeeping).
 - No call cache.
-- No `unconstrained` branching (both branches of every `if unconstrained` produce
-  the same value; they differ only in whether a query is logged).
+- No `unconstrained` branching or constrained promotion.
 - No stack machine — direct big-step.
 - Call-only fuel decrement at `Op.call`.
 - Errors return, never panic.
 
-Per-width memory buckets mirror Rust's `QueryRecord.memory_queries`
-(`execute.rs:36-40`). Each `Op.store values` uses `values.size` as the width key.
+Runtime cache hits and promotion can change effect multiplicity. Relating this
+model to native execution requires a separate refinement argument. Per-width
+memory buckets mirror Rust's `QueryRecord.memory_queries`; each
+`Op.store values` uses `values.size` as the width key.
 -/
 
 public section
diff --git a/Ix/Aiur/Semantics/Flatten.lean b/Ix/Aiur/Semantics/Flatten.lean
index 81c643912..91344179c 100644
--- a/Ix/Aiur/Semantics/Flatten.lean
+++ b/Ix/Aiur/Semantics/Flatten.lean
@@ -26,12 +26,33 @@ inductive Value : Type where
   | array   : Array Value → Value
   | ctor    : Global → Array Value → Value
   | fn      : Global → Value
-  /-- `width, index` — width is the flat size of the stored element's type. In the
-  Source-form evaluator only `index` is meaningful; in the Concrete-form
-  evaluator `width` selects the per-width memory bucket to match Rust's
+  /-- `width, index` — width selects the memory bucket and index selects an
+  entry within that bucket in both reference evaluators, matching Rust's
   `memory_queries`. -/
   | pointer : (width : Nat) → (index : Nat) → Value
-  deriving Repr, Hashable, Inhabited
+  deriving Repr, Inhabited
+
+/-- Total structural hashing for reference-evaluator memory keys. Tags,
+array seed and traversal order retain the original native derivation. -/
+def Value.hash : Value → UInt64
+  | .unit => 0
+  | .field g => mixHash 1 (Hashable.hash g)
+  | .tuple values => mixHash 2 (values.attach.foldl
+      (fun acc value => mixHash acc (Value.hash value.val)) 7)
+  | .array values => mixHash 3 (values.attach.foldl
+      (fun acc value => mixHash acc (Value.hash value.val)) 7)
+  | .ctor global values => mixHash (mixHash 4 (Hashable.hash global)) (values.attach.foldl
+      (fun acc value => mixHash acc (Value.hash value.val)) 7)
+  | .fn global => mixHash 5 (Hashable.hash global)
+  | .pointer width index => mixHash (mixHash 6 (Hashable.hash width)) (Hashable.hash index)
+termination_by value => sizeOf value
+decreasing_by
+  all_goals
+    have bound := Array.sizeOf_lt_of_mem value.property
+    simp_all
+    omega
+
+instance : Hashable Value := ⟨Value.hash⟩
 
 deriving instance DecidableEq for Global
 
diff --git a/Ix/Aiur/Semantics/SourceEval.lean b/Ix/Aiur/Semantics/SourceEval.lean
index c0ce18fc6..198d84dd2 100644
--- a/Ix/Aiur/Semantics/SourceEval.lean
+++ b/Ix/Aiur/Semantics/SourceEval.lean
@@ -7,17 +7,18 @@ public import Ix.Aiur.Protocol
 Source-form reference evaluator — proof-bearing semantics on `Source.Term`.
 
 Design:
-- **No cache.** The cache is a debug-interpreter optimization (`Ix/Aiur/Interpret.lean`)
-  and a Rust trace-multiplicity device, not part of the semantic model.
+- **Uncached calls.** Runtime and interpreter cache hits can change the I/O of
+  repeated effectful calls. Relating this model to those engines requires a
+  separate refinement argument with explicit conditions on the program.
 - **No stack trace.** Errors are tagged; debugging is the debug interpreter's job.
 - **Fuel-indexed, call-only accounting.** `fuel : Nat` decrements only at `applyGlobal`.
   Intra-body recursion is structural.
 - **Errors return, never panic.** `ioSetInfo` on existing key, `ioRead` OOB, pattern
   failure, type mismatch, etc. all produce `Except.error`.
 
-This source-level evaluator does not yet distinguish pointer widths — source
-pointers are a single global store. The width-bucketed `Concrete.Eval`
-evaluator fixes that divergence with Rust.
+Memory uses width buckets computed by flattening source values. Relating
+these widths to the concrete evaluator's type layouts remains a compiler
+reflection obligation.
 -/
 
 public section
@@ -619,7 +620,11 @@ def interp (decls : Decls) (fuel : Nat) (bindings : Bindings)
   -- `toField` / `u8FromFieldUnsafe` are erased coercions: value unchanged.
   | .toField t | .u8FromFieldUnsafe t => interp decls fuel bindings t st
   | .u8Lit n => .ok (.field (G.ofNat n), st)
-  | .debug _ _ ret => interp decls fuel bindings ret st
+  | .debug _ none ret => interp decls fuel bindings ret st
+  | .debug _ (some value) ret =>
+      match interp decls fuel bindings value st with
+      | .error error => .error error
+      | .ok (_, st') => interp decls fuel bindings ret st'
   | .ioGetInfo channel key =>
       match interp decls fuel bindings channel st with
       | .error e => .error e
diff --git a/Ix/Aiur/ShapedVerifier.lean b/Ix/Aiur/ShapedVerifier.lean
new file mode 100644
index 000000000..5742474c9
--- /dev/null
+++ b/Ix/Aiur/ShapedVerifier.lean
@@ -0,0 +1,57 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.CompiledVerifier
+import Ix.Aiur.ProofShape
+import Ix.Aiur.MerkleCap
+
+/-! The selected compiled key determines proof framing, active opening
+dimensions, fixed trace heights, cap coverage and the lookup budget before native
+verification. This still delegates the transcript/PCS/AIR acceptance checks
+to the existing FFI and does not instantiate a certified checker release. -/
+
+namespace Aiur.BoundVerifier
+
+structure CheckedProof (key : NativeAIR.KeyCodec.Key) (bytes : ByteArray) where
+  data : NativeAIR.ProofCodec.Data
+  rows : List NativeAIR.ProofShape.Row
+  bound : Nat
+  decoded : NativeAIR.ProofCodec.decodeCanonical bytes = some data
+  shape : NativeAIR.ProofShape.check key data = some rows
+  fixed : NativeAIR.ProofShape.fixedHeights key data = true
+  budget : NativeAIR.ProofShape.queryBound key data = some bound
+  cap : NativeAIR.MerkleCap.check key data = true
+
+def readProof (key : NativeAIR.KeyCodec.Key) (bytes : ByteArray) : Except String (CheckedProof key bytes) :=
+  match parsed : NativeAIR.ProofCodec.decodeCanonical bytes with
+  | none => .error "proof is not a canonical complete artifact"
+  | some data =>
+    match shape : NativeAIR.ProofShape.check key data with
+    | none => .error "proof opening shape differs from the selected key"
+    | some rows =>
+      if fixed : NativeAIR.ProofShape.fixedHeights key data = true then
+        match budget : NativeAIR.ProofShape.queryBound key data with
+        | none => .error "proof lookup budget exceeds its bound"
+        | some bound =>
+          if cap : NativeAIR.MerkleCap.check key data = true then
+            .ok ⟨data, rows, bound, parsed, shape, fixed, budget, cap⟩
+          else .error "proof Merkle cap omits a committed matrix height"
+      else .error "proof fixed table heights differ from the selected key"
+
+def verifyShaped {selection : Selection} (backend : CompiledBackend selection)
+    (input : Array G) (bytes : ByteArray) : Except String Unit := do
+  let _ ← readProof backend.keyData bytes
+  verifyCompiled backend input bytes
+
+theorem verifyShaped_success {selection : Selection} {backend : CompiledBackend selection}
+    {input : Array G} {bytes : ByteArray} (accepted : verifyShaped backend input bytes = .ok ()) :
+    ∃ checked : CheckedProof backend.keyData bytes, readProof backend.keyData bytes = .ok checked ∧
+      verifyCompiled backend input bytes = .ok () := by
+  unfold verifyShaped at accepted
+  cases parsed : readProof backend.keyData bytes with
+  | error message => simp [parsed, bind, Except.bind] at accepted
+  | ok checked => exact ⟨checked, rfl, by simpa [parsed, bind, Except.bind] using accepted⟩
+
+end Aiur.BoundVerifier
diff --git a/Ix/Aiur/Stages/Bytecode.lean b/Ix/Aiur/Stages/Bytecode.lean
index 21c52fd66..887939f8a 100644
--- a/Ix/Aiur/Stages/Bytecode.lean
+++ b/Ix/Aiur/Stages/Bytecode.lean
@@ -72,7 +72,12 @@ inductive Op
   | unconstrainedU32Add3 : Array ValIdx → Array ValIdx → Array ValIdx → Op
   /-- Virtual LE-byte packing expression; allocates no auxiliary column. -/
   | u32ToField : Array ValIdx → Op
-  deriving Repr, BEq, Hashable
+  deriving Repr, BEq, ReflBEq, Hashable
+
+instance : LawfulBEq Op := ⟨by
+  deriving_LawfulEq_tactic
+  intro h
+  exact congrArg Op.const (eq_of_beq h)⟩
 
 mutual
   inductive Ctrl where
@@ -90,8 +95,204 @@ mutual
     deriving Inhabited, Repr
 end
 
-deriving instance BEq, Hashable for Ctrl, Block
+/-! Total recursive comparison and hashing for deduplication. The ordinary
+mutual deriving handlers produce partial opaque logical defaults with
+separate native workers. These definitions expose the actual algorithms to
+proofs while retaining the native comparison order, hash tags and seeds. -/
+
+private theorem Block.ctrl_lt (block : Block) : sizeOf block.ctrl < sizeOf block := by
+  cases block
+  simp
+  omega
+
+mutual
+
+/-- Compare all control fields, including layout metadata and continuations. -/
+def Ctrl.beq : Ctrl → Ctrl → Bool
+  | .match idx cases fallback, .match idx' cases' fallback' =>
+    idx == idx' && (beqBranches cases cases' && beqFallback fallback fallback')
+  | .return sel outs, .return sel' outs' => sel == sel' && outs == outs'
+  | .yield sel outs, .yield sel' outs' => sel == sel' && outs == outs'
+  | .matchContinue idx cases fallback outputs aux lookups cont,
+      .matchContinue idx' cases' fallback' outputs' aux' lookups' cont' =>
+    idx == idx' && (beqBranches cases cases' && (beqFallback fallback fallback' &&
+      (outputs == outputs' && (aux == aux' && (lookups == lookups' && Block.beq cont cont')))))
+  | _, _ => false
+termination_by left _ => (sizeOf left, 0)
+decreasing_by all_goals decreasing_tactic
+
+def Block.beq (left right : Block) : Bool :=
+  left.ops == right.ops && Ctrl.beq left.ctrl right.ctrl
+termination_by (sizeOf left, 0)
+decreasing_by
+  apply Prod.Lex.left
+  exact Block.ctrl_lt left
+
+def beqFallback : Option Block → Option Block → Bool
+  | none, none => true
+  | some left, some right => Block.beq left right
+  | _, _ => false
+termination_by left _ => (sizeOf left, 0)
+decreasing_by all_goals decreasing_tactic
+
+def beqBranches (left right : Array (G × Block)) : Bool :=
+  if h : left.size = right.size then beqBranchesAux left right h left.size (Nat.le_refl _)
+  else false
+termination_by (sizeOf left, left.size + 1)
+decreasing_by all_goals decreasing_tactic
+
+/-- Match `Array.isEqvAux`'s reverse traversal without hiding recursive
+block comparisons behind an unbounded callback. -/
+def beqBranchesAux (left right : Array (G × Block)) (hsz : left.size = right.size) :
+    (n : Nat) → n ≤ left.size → Bool
+  | 0, _ => true
+  | n + 1, h =>
+    (left[n].1 == (right[n]'(hsz ▸ h)).1 && Block.beq left[n].2 (right[n]'(hsz ▸ h)).2) &&
+      beqBranchesAux left right hsz n (by omega)
+termination_by n _ => (sizeOf left, n)
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (apply Prod.Lex.left
+       have arrayBound := Array.sizeOf_get left n (by omega)
+       have pairBound : sizeOf left[n].2 < sizeOf left[n] := by
+         cases left[n]; simp; omega
+       omega)
+
+end
+
+instance : BEq Ctrl := ⟨Ctrl.beq⟩
+instance : BEq Block := ⟨Block.beq⟩
+
+mutual
+
+/-- Boolean comparison reflects exact syntax equality. -/
+theorem Ctrl.beq_eq_true_iff (left right : Ctrl) : Ctrl.beq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp only [Ctrl.beq, Bool.and_eq_true, beq_iff_eq, reduceCtorEq, Bool.false_eq_true,
+      Ctrl.match.injEq, Ctrl.return.injEq, Ctrl.yield.injEq, Ctrl.matchContinue.injEq]
+  all_goals rw [beqBranches_eq_true_iff, beqFallback_eq_true_iff]
+  all_goals rw [Block.beq_eq_true_iff]
+termination_by (sizeOf left, 0)
+decreasing_by all_goals decreasing_tactic
+
+theorem Block.beq_eq_true_iff (left right : Block) : Block.beq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp only [Block.beq, Bool.and_eq_true, beq_iff_eq, Block.mk.injEq]
+  rw [Ctrl.beq_eq_true_iff]
+termination_by (sizeOf left, 0)
+decreasing_by all_goals decreasing_tactic
+
+theorem beqFallback_eq_true_iff (left right : Option Block) :
+    beqFallback left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp only [beqFallback, reduceCtorEq, Bool.false_eq_true, Option.some.injEq]
+  rw [Block.beq_eq_true_iff]
+termination_by (sizeOf left, 0)
+decreasing_by all_goals decreasing_tactic
+
+theorem beqBranches_eq_true_iff (left right : Array (G × Block)) :
+    beqBranches left right = true ↔ left = right := by
+  unfold beqBranches
+  split
+  next hsz =>
+    rw [beqBranchesAux_eq_true_iff]
+    constructor
+    · intro h
+      exact Array.ext hsz (fun i hi _ => h i hi)
+    · intro h
+      subst right
+      intros
+      rfl
+  next hsz =>
+    simp only [Bool.false_eq_true, false_iff]
+    intro h
+    exact hsz (congrArg Array.size h)
+termination_by (sizeOf left, left.size + 1)
+decreasing_by all_goals decreasing_tactic
+
+theorem beqBranchesAux_eq_true_iff (left right : Array (G × Block))
+    (hsz : left.size = right.size) (n : Nat) (hn : n ≤ left.size) :
+    beqBranchesAux left right hsz n hn = true ↔
+      ∀ i (hi : i < n), (left[i]'(by omega)) = (right[i]'(by omega)) := by
+  cases n with
+  | zero => simp [beqBranchesAux]
+  | succ n =>
+    rw [beqBranchesAux, Bool.and_eq_true, Bool.and_eq_true,
+      beq_iff_eq, Block.beq_eq_true_iff, beqBranchesAux_eq_true_iff]
+    constructor
+    · rintro ⟨⟨hg, hb⟩, tail⟩ i hi
+      by_cases h : i < n
+      · exact tail i h
+      · have : i = n := by omega
+        subst i
+        exact Prod.ext hg hb
+    · intro h
+      refine ⟨⟨congrArg Prod.fst (h n (by omega)), congrArg Prod.snd (h n (by omega))⟩, ?_⟩
+      intro i hi
+      exact h i (by omega)
+termination_by (sizeOf left, n)
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (apply Prod.Lex.left
+       have arrayBound := Array.sizeOf_get left n (by omega)
+       have pairBound : sizeOf left[n].2 < sizeOf left[n] := by
+         cases left[n]; simp; omega
+       omega)
+
+end
+
+instance : LawfulBEq Ctrl where
+  eq_of_beq {left right} h := (Ctrl.beq_eq_true_iff left right).mp h
+  rfl {value} := (Ctrl.beq_eq_true_iff value value).mpr rfl
+
+instance : LawfulBEq Block where
+  eq_of_beq {left right} h := (Block.beq_eq_true_iff left right).mp h
+  rfl {value} := (Block.beq_eq_true_iff value value).mpr rfl
+
+mutual
+
+/-- Preserve the derived hash algorithm: constructor tags 0–3, array seed
+7, option tags 11/13 and the original left-to-right field mixing. -/
+def Ctrl.hash : Ctrl → UInt64
+  | .match idx branches fallback =>
+    let branchesHash := branches.attach.foldl (fun acc pair =>
+      mixHash acc (mixHash (hash pair.val.1) (Block.hash pair.val.2))) 7
+    let fallbackHash := match fallback with
+      | none => 11
+      | some block => mixHash (Block.hash block) 13
+    mixHash (mixHash (mixHash 0 (hash idx)) branchesHash) fallbackHash
+  | .return sel outs => mixHash (mixHash 1 (hash sel)) (hash outs)
+  | .yield sel outs => mixHash (mixHash 2 (hash sel)) (hash outs)
+  | .matchContinue idx branches fallback outputs aux lookups cont =>
+    let branchesHash := branches.attach.foldl (fun acc pair =>
+      mixHash acc (mixHash (hash pair.val.1) (Block.hash pair.val.2))) 7
+    let fallbackHash := match fallback with
+      | none => 11
+      | some block => mixHash (Block.hash block) 13
+    mixHash (mixHash (mixHash (mixHash (mixHash (mixHash (mixHash 3 (hash idx))
+      branchesHash) fallbackHash) (hash outputs)) (hash aux)) (hash lookups)) (Block.hash cont)
+termination_by ctrl => sizeOf ctrl
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have arrayBound := Array.sizeOf_lt_of_mem pair.property
+       have pairBound : sizeOf pair.val.2 < sizeOf pair.val := by
+         cases pair.val; simp; omega
+       simp_all
+       omega)
+
+def Block.hash (block : Block) : UInt64 :=
+  mixHash (mixHash 0 (hash block.ops)) (Ctrl.hash block.ctrl)
+termination_by sizeOf block
+decreasing_by exact Block.ctrl_lt block
+
+end
 
+instance : Hashable Ctrl := ⟨Ctrl.hash⟩
+instance : Hashable Block := ⟨Block.hash⟩
 
 /-- The circuit layout of a function (non-semantic; the bytecode evaluator ignores it). -/
 structure FunctionLayout where
@@ -99,7 +300,7 @@ structure FunctionLayout where
   selectors : Nat
   auxiliaries : Nat
   lookups : Nat
-  deriving Inhabited, Repr, BEq, Hashable, DecidableEq
+  deriving Inhabited, Repr, BEq, ReflBEq, LawfulBEq, Hashable, DecidableEq
 
 def FunctionLayout.width (l : FunctionLayout) : Nat :=
   l.inputSize + l.selectors + l.auxiliaries
diff --git a/Ix/Aiur/Stages/Source.lean b/Ix/Aiur/Stages/Source.lean
index 52c0c7426..2b5779af5 100644
--- a/Ix/Aiur/Stages/Source.lean
+++ b/Ix/Aiur/Stages/Source.lean
@@ -379,8 +379,9 @@ namespace Source
   output columns at the call site).
 * `unconstrained` — a call whose callee is trusted (no lookup / circuit
   constraint); the old `unconstrained := true`.
-* `inlined` — the callee's body is spliced into the caller at compile
-  time (no separate circuit, no interface columns). Eliminated by
+* `inlined` — request that the callee's body be spliced into the caller.
+  Callees with explicit returns retain a normal function-call boundary.
+  Eliminated by
   `Toplevel.inlineCalls` before typechecking; forbidden for callees that
   are (transitively) inline-recursive. -/
 inductive CallMode
@@ -575,40 +576,40 @@ where
         result := result.push item
     pure (globals, result)
 
-/-- Rename every local bound in a pattern to a fresh `.str "inl#N"` name,
-extending `subst` for the pattern's scope and advancing the fresh counter.
--/
-def Pattern.freshen (cnt : Nat) (subst : Std.HashMap Local Local) :
+/-- Allocate one fresh name per binder in a pattern. Alternative arms
+reuse the same renaming for names they bind in common. -/
+def Pattern.freshenBindings (stem : String) (cnt : Nat) (subst : Std.HashMap Local Local) :
     Pattern → Nat × Std.HashMap Local Local × Pattern
   | .var x =>
-    let x' : Local := .str s!"inl#{cnt}"
+    if let some x' := subst[x]? then (cnt, subst, .var x') else
+    let x' : Local := .str (stem ++ toString cnt)
     (cnt + 1, subst.insert x x', .var x')
   | .wildcard => (cnt, subst, .wildcard)
   | .field g => (cnt, subst, .field g)
   | .ref g ps =>
     let (cnt, subst, ps') := ps.attach.foldl (init := (cnt, subst, ([] : List Pattern)))
       fun (cnt, subst, acc) ⟨p, _⟩ =>
-        let (cnt, subst, p') := Pattern.freshen cnt subst p
+        let (cnt, subst, p') := Pattern.freshenBindings stem cnt subst p
         (cnt, subst, acc ++ [p'])
     (cnt, subst, .ref g ps')
   | .tuple ps =>
     let (cnt, subst, ps') := ps.attach.foldl (init := (cnt, subst, (#[] : Array Pattern)))
       fun (cnt, subst, acc) ⟨p, _⟩ =>
-        let (cnt, subst, p') := Pattern.freshen cnt subst p
+        let (cnt, subst, p') := Pattern.freshenBindings stem cnt subst p
         (cnt, subst, acc.push p')
     (cnt, subst, .tuple ps')
   | .array ps =>
     let (cnt, subst, ps') := ps.attach.foldl (init := (cnt, subst, (#[] : Array Pattern)))
       fun (cnt, subst, acc) ⟨p, _⟩ =>
-        let (cnt, subst, p') := Pattern.freshen cnt subst p
+        let (cnt, subst, p') := Pattern.freshenBindings stem cnt subst p
         (cnt, subst, acc.push p')
     (cnt, subst, .array ps')
   | .or p q =>
-    let (cnt, subst, p') := Pattern.freshen cnt subst p
-    let (cnt, subst, q') := Pattern.freshen cnt subst q
+    let (cnt, subst, p') := Pattern.freshenBindings stem cnt subst p
+    let (cnt, subst, q') := Pattern.freshenBindings stem cnt subst q
     (cnt, subst, .or p' q')
   | .pointer p =>
-    let (cnt, subst, p') := Pattern.freshen cnt subst p
+    let (cnt, subst, p') := Pattern.freshenBindings stem cnt subst p
     (cnt, subst, .pointer p')
 termination_by p => sizeOf p
 decreasing_by
@@ -617,97 +618,105 @@ decreasing_by
     | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
     | (have := List.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
 
-/-- Consistently α-rename the locals bound inside `t` to fresh names,
-following `subst` for the currently-renamed variables. Used before
-splicing an inlined body so its locals cannot collide with the caller's
-(the `Simple` pass floats nested `let`s outward, which would otherwise
-capture reused names). Only bound occurrences are rewritten; free
-variables that are the callee's inputs are handled by `subst` seeded at
-the call site. -/
-def Term.freshen (cnt : Nat) (subst : Std.HashMap Local Local) :
+
+def Pattern.freshenWith (stem : String) (cnt : Nat)
+    (subst : Std.HashMap Local Local) (pattern : Pattern) :
+    Nat × Std.HashMap Local Local × Pattern :=
+  let (cnt, names, pattern) := Pattern.freshenBindings stem cnt ∅ pattern
+  (cnt, names.fold (init := subst) (fun subst old fresh => subst.insert old fresh), pattern)
+
+def renameLocalCall (subst : Std.HashMap Local Local) (global : Global) : Global :=
+  match global.toName with
+  | .str .anonymous name =>
+    match subst[Local.str name]? with
+    | some (.str fresh) => Global.init fresh
+    | _ => global
+  | _ => global
+
+def Term.freshenWith (stem : String) (cnt : Nat) (subst : Std.HashMap Local Local) :
     Term → Nat × Term :=
   fun t =>
   match t with
   | .var x => (cnt, .var (subst.getD x x))
   | .unit | .ref _ | .field _ | .u8Lit _ => (cnt, t)
   | .let p v b =>
-    let (cnt, v') := Term.freshen cnt subst v
-    let (cnt, subst', p') := Pattern.freshen cnt subst p
-    let (cnt, b') := Term.freshen cnt subst' b
+    let (cnt, v') := Term.freshenWith stem cnt subst v
+    let (cnt, subst', p') := Pattern.freshenWith stem cnt subst p
+    let (cnt, b') := Term.freshenWith stem cnt subst' b
     (cnt, .let p' v' b')
   | .match s arms =>
-    let (cnt, s') := Term.freshen cnt subst s
+    let (cnt, s') := Term.freshenWith stem cnt subst s
     let (cnt, arms') := arms.attach.foldl (init := (cnt, ([] : List (Pattern × Term))))
       fun (cnt, acc) ⟨(p, a), _⟩ =>
-        let (cnt, subst', p') := Pattern.freshen cnt subst p
-        let (cnt, a') := Term.freshen cnt subst' a
+        let (cnt, subst', p') := Pattern.freshenWith stem cnt subst p
+        let (cnt, a') := Term.freshenWith stem cnt subst' a
         (cnt, acc ++ [(p', a')])
     (cnt, .match s' arms')
   | .tuple ts =>
     let (cnt, ts') := ts.attach.foldl (init := (cnt, #[])) fun (cnt, acc) ⟨x, _⟩ =>
-      let (cnt, x') := Term.freshen cnt subst x; (cnt, acc.push x')
+      let (cnt, x') := Term.freshenWith stem cnt subst x; (cnt, acc.push x')
     (cnt, .tuple ts')
   | .array ts =>
     let (cnt, ts') := ts.attach.foldl (init := (cnt, #[])) fun (cnt, acc) ⟨x, _⟩ =>
-      let (cnt, x') := Term.freshen cnt subst x; (cnt, acc.push x')
+      let (cnt, x') := Term.freshenWith stem cnt subst x; (cnt, acc.push x')
     (cnt, .array ts')
   | .app g args mode =>
     let (cnt, args') := args.attach.foldl (init := (cnt, ([] : List Term))) fun (cnt, acc) ⟨x, _⟩ =>
-      let (cnt, x') := Term.freshen cnt subst x; (cnt, acc ++ [x'])
-    (cnt, .app g args' mode)
-  | .ret a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .ret a')
-  | .add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .add a' b')
-  | .sub a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .sub a' b')
-  | .mul a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .mul a' b')
-  | .eqZero a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .eqZero a')
-  | .proj a n => let (cnt, a') := Term.freshen cnt subst a; (cnt, .proj a' n)
-  | .get a n => let (cnt, a') := Term.freshen cnt subst a; (cnt, .get a' n)
-  | .slice a i j => let (cnt, a') := Term.freshen cnt subst a; (cnt, .slice a' i j)
-  | .set a n v => let (cnt, a') := Term.freshen cnt subst a; let (cnt, v') := Term.freshen cnt subst v; (cnt, .set a' n v')
-  | .store a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .store a')
-  | .load a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .load a')
-  | .ptrVal a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .ptrVal a')
-  | .ann τ a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .ann τ a')
+      let (cnt, x') := Term.freshenWith stem cnt subst x; (cnt, acc ++ [x'])
+    (cnt, .app (renameLocalCall subst g) args' mode)
+  | .ret a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .ret a')
+  | .add a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .add a' b')
+  | .sub a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .sub a' b')
+  | .mul a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .mul a' b')
+  | .eqZero a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .eqZero a')
+  | .proj a n => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .proj a' n)
+  | .get a n => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .get a' n)
+  | .slice a i j => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .slice a' i j)
+  | .set a n v => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, v') := Term.freshenWith stem cnt subst v; (cnt, .set a' n v')
+  | .store a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .store a')
+  | .load a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .load a')
+  | .ptrVal a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .ptrVal a')
+  | .ann τ a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .ann τ a')
   | .assertEq a b msg c =>
-    let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; let (cnt, c') := Term.freshen cnt subst c
+    let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; let (cnt, c') := Term.freshenWith stem cnt subst c
     (cnt, .assertEq a' b' msg c')
-  | .ioGetInfo c k => let (cnt, c') := Term.freshen cnt subst c; let (cnt, k') := Term.freshen cnt subst k; (cnt, .ioGetInfo c' k')
+  | .ioGetInfo c k => let (cnt, c') := Term.freshenWith stem cnt subst c; let (cnt, k') := Term.freshenWith stem cnt subst k; (cnt, .ioGetInfo c' k')
   | .ioSetInfo c k i l rv =>
-    let (cnt, c') := Term.freshen cnt subst c; let (cnt, k') := Term.freshen cnt subst k; let (cnt, i') := Term.freshen cnt subst i
-    let (cnt, l') := Term.freshen cnt subst l; let (cnt, rv') := Term.freshen cnt subst rv
+    let (cnt, c') := Term.freshenWith stem cnt subst c; let (cnt, k') := Term.freshenWith stem cnt subst k; let (cnt, i') := Term.freshenWith stem cnt subst i
+    let (cnt, l') := Term.freshenWith stem cnt subst l; let (cnt, rv') := Term.freshenWith stem cnt subst rv
     (cnt, .ioSetInfo c' k' i' l' rv')
-  | .ioRead c i n => let (cnt, c') := Term.freshen cnt subst c; let (cnt, i') := Term.freshen cnt subst i; (cnt, .ioRead c' i' n)
+  | .ioRead c i n => let (cnt, c') := Term.freshenWith stem cnt subst c; let (cnt, i') := Term.freshenWith stem cnt subst i; (cnt, .ioRead c' i' n)
   | .ioWrite c d rv =>
-    let (cnt, c') := Term.freshen cnt subst c; let (cnt, d') := Term.freshen cnt subst d; let (cnt, rv') := Term.freshen cnt subst rv
+    let (cnt, c') := Term.freshenWith stem cnt subst c; let (cnt, d') := Term.freshenWith stem cnt subst d; let (cnt, rv') := Term.freshenWith stem cnt subst rv
     (cnt, .ioWrite c' d' rv')
-  | .u8BitDecomposition a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8BitDecomposition a')
-  | .u8ShiftLeft a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8ShiftLeft a')
-  | .u8ShiftRight a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8ShiftRight a')
-  | .u8Xor a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Xor a' b')
-  | .u8Add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Add a' b')
-  | .u8Mul a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Mul a' b')
-  | .u8Sub a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Sub a' b')
-  | .u8And a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8And a' b')
-  | .u8Or a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8Or a' b')
-  | .u8LessThan a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8LessThan a' b')
-  | .u32LessThan a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u32LessThan a' b')
-  | .u8XorSplit7 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit7 a' b')
-  | .u8XorSplit4 a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8XorSplit4 a' b')
-  | .unconstrainedU32Add a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .unconstrainedU32Add a' b')
-  | .unconstrainedU32Add3 a b c => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; let (cnt, c') := Term.freshen cnt subst c; (cnt, .unconstrainedU32Add3 a' b' c')
-  | .u32ToField a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u32ToField a')
+  | .u8BitDecomposition a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .u8BitDecomposition a')
+  | .u8ShiftLeft a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .u8ShiftLeft a')
+  | .u8ShiftRight a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .u8ShiftRight a')
+  | .u8Xor a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8Xor a' b')
+  | .u8Add a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8Add a' b')
+  | .u8Mul a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8Mul a' b')
+  | .u8Sub a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8Sub a' b')
+  | .u8And a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8And a' b')
+  | .u8Or a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8Or a' b')
+  | .u8LessThan a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8LessThan a' b')
+  | .u32LessThan a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u32LessThan a' b')
+  | .u8XorSplit7 a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8XorSplit7 a' b')
+  | .u8XorSplit4 a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8XorSplit4 a' b')
+  | .unconstrainedU32Add a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .unconstrainedU32Add a' b')
+  | .unconstrainedU32Add3 a b c => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; let (cnt, c') := Term.freshenWith stem cnt subst c; (cnt, .unconstrainedU32Add3 a' b' c')
+  | .u32ToField a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .u32ToField a')
   | .unconstrainedBigUintDivMod a b =>
-    let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .unconstrainedBigUintDivMod a' b')
-  | .u8RangeCheck a b => let (cnt, a') := Term.freshen cnt subst a; let (cnt, b') := Term.freshen cnt subst b; (cnt, .u8RangeCheck a' b')
-  | .toField a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .toField a')
-  | .u8FromFieldUnsafe a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .u8FromFieldUnsafe a')
-  | .unconstrainedGToBytes a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .unconstrainedGToBytes a')
-  | .unconstrainedGInverse a => let (cnt, a') := Term.freshen cnt subst a; (cnt, .unconstrainedGInverse a')
+    let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .unconstrainedBigUintDivMod a' b')
+  | .u8RangeCheck a b => let (cnt, a') := Term.freshenWith stem cnt subst a; let (cnt, b') := Term.freshenWith stem cnt subst b; (cnt, .u8RangeCheck a' b')
+  | .toField a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .toField a')
+  | .u8FromFieldUnsafe a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .u8FromFieldUnsafe a')
+  | .unconstrainedGToBytes a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .unconstrainedGToBytes a')
+  | .unconstrainedGInverse a => let (cnt, a') := Term.freshenWith stem cnt subst a; (cnt, .unconstrainedGInverse a')
   | .debug s o a =>
     let (cnt, o') := match o with
       | none => (cnt, none)
-      | some x => let (cnt, x') := Term.freshen cnt subst x; (cnt, some x')
-    let (cnt, a') := Term.freshen cnt subst a
+      | some x => let (cnt, x') := Term.freshenWith stem cnt subst x; (cnt, some x')
+    let (cnt, a') := Term.freshenWith stem cnt subst a
     (cnt, .debug s o' a')
 termination_by t => sizeOf t
 decreasing_by
@@ -716,6 +725,16 @@ decreasing_by
     | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
     | (have := List.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
 
+
+/-- Freshen an inlined pattern with the inline-expansion name stem. -/
+def Pattern.freshen (cnt : Nat) (subst : Std.HashMap Local Local) (pattern : Pattern) :
+    Nat × Std.HashMap Local Local × Pattern :=
+  Pattern.freshenWith "inl#" cnt subst pattern
+
+/-- Freshen an inlined body, including local function-call names. -/
+def Term.freshen (cnt : Nat) (subst : Std.HashMap Local Local) (term : Term) : Nat × Term :=
+  Term.freshenWith "inl#" cnt subst term
+
 /-- Peel the leading `let` bindings off a term: returns the binding frames
 (outermost first) and the non-`let` core. -/
 def Term.peelLets : Term → List (Pattern × Term) × Term
@@ -765,9 +784,47 @@ decreasing_by
     | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
     | (have := List.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
 
-/-- Structurally splice every `.app g args .inlined` in `t`, given `done`,
+/-- Explicit returns require a function-call boundary when considering
+inlining. Splicing them would let a callee return from its caller. -/
+def Term.hasExplicitReturn : Term → Bool
+  | .ret _ => true
+  | .var _ | .unit | .field _ | .u8Lit _ | .ref _ => false
+  | .app _ args _ => args.attach.any fun arg => Term.hasExplicitReturn arg.val
+  | .tuple terms | .array terms => terms.attach.any fun term => Term.hasExplicitReturn term.val
+  | .let _ value body => Term.hasExplicitReturn value || Term.hasExplicitReturn body
+  | .match scrut arms => Term.hasExplicitReturn scrut ||
+      arms.attach.any fun arm => Term.hasExplicitReturn arm.val.2
+  | .eqZero a | .proj a _ | .get a _ | .slice a _ _
+  | .store a | .load a | .ptrVal a | .ann _ a
+  | .u8BitDecomposition a | .u8ShiftLeft a | .u8ShiftRight a
+  | .u32ToField a | .unconstrainedGToBytes a | .unconstrainedGInverse a
+  | .toField a | .u8FromFieldUnsafe a => Term.hasExplicitReturn a
+  | .add a b | .sub a b | .mul a b | .set a _ b | .ioGetInfo a b | .ioRead a b _
+  | .u8Xor a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b
+  | .u8LessThan a b | .u32LessThan a b | .u8XorSplit7 a b | .u8XorSplit4 a b
+  | .unconstrainedU32Add a b | .unconstrainedBigUintDivMod a b | .u8RangeCheck a b =>
+    Term.hasExplicitReturn a || Term.hasExplicitReturn b
+  | .assertEq a b _ c | .ioWrite a b c | .unconstrainedU32Add3 a b c =>
+    Term.hasExplicitReturn a || Term.hasExplicitReturn b || Term.hasExplicitReturn c
+  | .ioSetInfo a b c d e => Term.hasExplicitReturn a || Term.hasExplicitReturn b ||
+      Term.hasExplicitReturn c || Term.hasExplicitReturn d || Term.hasExplicitReturn e
+  | .debug _ none continuation => Term.hasExplicitReturn continuation
+  | .debug _ (some value) continuation =>
+    Term.hasExplicitReturn value || Term.hasExplicitReturn continuation
+termination_by term => sizeOf term
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem term.property; grind)
+    | (have := List.sizeOf_lt_of_mem arg.property; grind)
+    | (have := List.sizeOf_lt_of_mem arm.property
+       have : sizeOf arm.val.2 < sizeOf arm.val := by cases arm.val; simp; omega
+       simp_all; omega)
+
+/-- Structurally splice `.app g args .inlined` in `t`, given `done`,
 which maps each already-expanded callee to its input locals and its (already
-inline-free) body. At an inline site the callee's inputs and body are
+inline-free) body. Callees containing an explicit return become normal calls
+so their return cannot escape the caller. At other inline sites the inputs and body are
 α-renamed to fresh `inl#N` names (`Term.freshen`, seeded with the inputs),
 then each fresh input is bound to its argument via a `let`. Freshening the
 inputs BEFORE binding the arguments is essential: arguments are caller terms,
@@ -787,6 +844,7 @@ def Term.expandOnce (done : Std.HashMap Global (List Local × Term)) (cnt : Nat)
     match done[g]? with
     | none => (cnt, .app g args' .inlined)
     | some (ins, body) =>
+      if body.hasExplicitReturn then (cnt, .app g args' .normal) else
       let (cnt, subst, freshInputs) := ins.foldl
         (init := (cnt, (∅ : Std.HashMap Local Local), ([] : List Local)))
         fun (cnt, subst, acc) inp =>
@@ -890,9 +948,8 @@ decreasing_by
     | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
     | (have := List.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
 
-/-- Peel leading lets off each of `ts` (already hoisted), collecting the
-frames left-to-right so evaluation order is preserved, and returning the
-frame chain plus the cores. -/
+/-- Collect leading let frames in argument order and retain their cores.
+Callers must also sequence each core before later frames and avoid capture. -/
 def Term.peelListLets (ts : List Term) : List (Pattern × Term) × List Term :=
   ts.foldr
     (fun t (fs, cs) => let (f, c) := Term.peelLets t; (f ++ fs, c :: cs))
@@ -902,115 +959,267 @@ def Term.peelArrayLets (ts : Array Term) : List (Pattern × Term) × Array Term
   let (fs, cs) := Term.peelListLets ts.toList
   (fs, cs.toArray)
 
-/-- Hoist every `let`-chain out of a strict argument position into a
-wrapping `let`. Inlining splices a callee body (a `let`-chain ending in a
-value) wherever the `@`-call appeared; in a `let`-RHS or tail position the
-`Simple` pass already floats those lets outward, but in an argument
-position (a `set`/array element, an operator operand, …) they would stay
-nested, which the lowering cannot handle. This normalizes all such
-positions. `let`-RHS, `match` arm bodies, and `ret`/`debug` continuations
-are already handled downstream, so their lets are left in place. -/
-def Term.hoistLets : Term → Term :=
-  fun t =>
-  -- Hoist a construct's argument terms: peel each arg's lets and wrap.
-  match t with
-  | .unit | .var _ | .ref _ | .field _ | .u8Lit _ => t
-  | .let p v b => .let p (Term.hoistLets v) (Term.hoistLets b)
-  | .match s arms =>
-    let (fs, sc) := Term.peelLets (Term.hoistLets s)
-    Term.wrapLets fs (.match sc (arms.attach.map fun ⟨(p, a), _⟩ => (p, Term.hoistLets a)))
-  | .ret a => .ret (Term.hoistLets a)
-  | .debug s o a =>
-    .debug s (match o with | none => none | some x => some (Term.hoistLets x)) (Term.hoistLets a)
-  | .tuple ts =>
-    let (fs, cs) := Term.peelArrayLets (ts.attach.map fun ⟨x, _⟩ => Term.hoistLets x)
-    Term.wrapLets fs (.tuple cs)
-  | .array ts =>
-    let (fs, cs) := Term.peelArrayLets (ts.attach.map fun ⟨x, _⟩ => Term.hoistLets x)
-    Term.wrapLets fs (.array cs)
-  | .app g args mode =>
-    let (fs, cs) := Term.peelListLets (args.attach.map fun ⟨x, _⟩ => Term.hoistLets x)
-    Term.wrapLets fs (.app g cs mode)
-  | .assertEq a b msg c =>
-    let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b, Term.hoistLets c]
-    match cs with
-    | [a, b, c] => Term.wrapLets fs (.assertEq a b msg c)
-    | _ => t
-  | .ioSetInfo a b c d e =>
-    let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b, Term.hoistLets c, Term.hoistLets d, Term.hoistLets e]
-    match cs with
-    | [a, b, c, d, e] => Term.wrapLets fs (.ioSetInfo a b c d e)
-    | _ => t
-  | .ioWrite a b c =>
-    let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b, Term.hoistLets c]
-    match cs with
-    | [a, b, c] => Term.wrapLets fs (.ioWrite a b c)
-    | _ => t
+/-! Argument normalization uses a fresh name stem and evaluates each
+argument completely before the next one. Continuations stay after their
+operation; array updates evaluate the new value before the array. -/
+
+def Pattern.maxNameLength : Pattern → Nat
+  | .var (.str name) => name.length
+  | .var (.idx _) | .wildcard | .field _ => 0
+  | .ref global ps => ps.attach.foldl
+      (fun n p => max n (Pattern.maxNameLength p.val)) global.toName.toString.length
+  | .tuple ps | .array ps => ps.attach.foldl
+      (fun n p => max n (Pattern.maxNameLength p.val)) 0
+  | .or p q => max (Pattern.maxNameLength p) (Pattern.maxNameLength q)
+  | .pointer p => Pattern.maxNameLength p
+termination_by p => sizeOf p
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem p.property; grind)
+    | (have := List.sizeOf_lt_of_mem p.property; grind)
+
+def Term.maxNameLength : Term → Nat
+  | .var (.str name) => name.length
+  | .var (.idx _) | .unit | .field _ | .u8Lit _ => 0
+  | .ref global => global.toName.toString.length
+  | .app global args _ => args.attach.foldl
+      (fun n arg => max n (Term.maxNameLength arg.val)) global.toName.toString.length
+  | .tuple terms | .array terms => terms.attach.foldl
+      (fun n term => max n (Term.maxNameLength term.val)) 0
+  | .let pattern value body =>
+    max (Pattern.maxNameLength pattern) (max (Term.maxNameLength value) (Term.maxNameLength body))
+  | .match scrut arms => arms.attach.foldl
+      (fun n arm => max n (max (Pattern.maxNameLength arm.val.1) (Term.maxNameLength arm.val.2)))
+      (Term.maxNameLength scrut)
+  | .ret a | .eqZero a | .proj a _ | .get a _ | .slice a _ _
+  | .store a | .load a | .ptrVal a | .ann _ a
+  | .u8BitDecomposition a | .u8ShiftLeft a | .u8ShiftRight a
+  | .u32ToField a | .unconstrainedGToBytes a | .unconstrainedGInverse a
+  | .toField a | .u8FromFieldUnsafe a => Term.maxNameLength a
+  | .add a b | .sub a b | .mul a b | .set a _ b | .ioGetInfo a b | .ioRead a b _
+  | .u8Xor a b | .u8Add a b | .u8Mul a b | .u8Sub a b | .u8And a b | .u8Or a b
+  | .u8LessThan a b | .u32LessThan a b | .u8XorSplit7 a b | .u8XorSplit4 a b
+  | .unconstrainedU32Add a b | .unconstrainedBigUintDivMod a b | .u8RangeCheck a b =>
+    max (Term.maxNameLength a) (Term.maxNameLength b)
+  | .assertEq a b _ c | .ioWrite a b c | .unconstrainedU32Add3 a b c =>
+    max (Term.maxNameLength a) (max (Term.maxNameLength b) (Term.maxNameLength c))
+  | .ioSetInfo a b c d e => max (Term.maxNameLength a)
+      (max (Term.maxNameLength b) (max (Term.maxNameLength c)
+        (max (Term.maxNameLength d) (Term.maxNameLength e))))
+  | .debug _ none continuation => Term.maxNameLength continuation
+  | .debug _ (some value) continuation => max (Term.maxNameLength value) (Term.maxNameLength continuation)
+termination_by term => sizeOf term
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have := Array.sizeOf_lt_of_mem term.property; grind)
+    | (have := List.sizeOf_lt_of_mem arg.property; grind)
+    | (have := List.sizeOf_lt_of_mem arm.property
+       have : sizeOf arm.val.2 < sizeOf arm.val := by cases arm.val; simp; omega
+       simp_all; omega)
+
+def freshTemporary (stem : String) : StateM Nat Local := do
+  let n ← get
+  modify Nat.succ
+  return .str (stem ++ toString n)
+
+def Term.bindArguments (stem : String) :
+    List Term → StateM Nat (List (Pattern × Term) × List Term)
+  | [] => pure ([], [])
+  | arg :: args => do
+    let name ← freshTemporary stem
+    let (leading, core) := arg.peelLets
+    let (frames, values) ← Term.bindArguments stem args
+    return (leading ++ [(.var name, core)] ++ frames, .var name :: values)
+
+def buildWithArguments (stem : String) (args : List Term)
+    (build : List Term → Term) : StateM Nat Term := do
+  let (frames, values) ← Term.bindArguments stem args
+  return Term.wrapLets frames (build values)
+
+def Term.hoistLetsAux (stem : String) (term : Term) : StateM Nat Term := do
+  match term with
+  | .unit | .var _ | .ref _ | .field _ | .u8Lit _ => return term
+  | .let pattern value body =>
+    let value ← Term.hoistLetsAux stem value
+    let body ← Term.hoistLetsAux stem body
+    let (frames, core) := value.peelLets
+    return Term.wrapLets frames (.let pattern core body)
+  | .match scrut arms =>
+    let scrut ← Term.hoistLetsAux stem scrut
+    let arms ← arms.attach.mapM fun arm => do
+      return (arm.val.1, ← Term.hoistLetsAux stem arm.val.2)
+    buildWithArguments stem [scrut] fun
+      | [scrut] => .match scrut arms
+      | _ => term
+  | .ret value =>
+    let value ← Term.hoistLetsAux stem value
+    let (frames, core) := value.peelLets
+    return Term.wrapLets frames (.ret core)
+  | .debug label value continuation =>
+    let continuation ← Term.hoistLetsAux stem continuation
+    return .let .wildcard (.debug label value .unit) continuation
+  | .tuple terms =>
+    let terms ← terms.attach.mapM fun t => Term.hoistLetsAux stem t.val
+    buildWithArguments stem terms.toList (.tuple ∘ List.toArray)
+  | .array terms =>
+    let terms ← terms.attach.mapM fun t => Term.hoistLetsAux stem t.val
+    buildWithArguments stem terms.toList (.array ∘ List.toArray)
+  | .app global args mode =>
+    let args ← args.attach.mapM fun t => Term.hoistLetsAux stem t.val
+    buildWithArguments stem args (.app global · mode)
+  | .assertEq a b msg continuation =>
+    let a ← Term.hoistLetsAux stem a
+    let b ← Term.hoistLetsAux stem b
+    let continuation ← Term.hoistLetsAux stem continuation
+    buildWithArguments stem [a, b] fun
+      | [a, b] => .let .wildcard (.assertEq a b msg .unit) continuation
+      | _ => term
+  | .ioWrite channel data continuation =>
+    let channel ← Term.hoistLetsAux stem channel
+    let data ← Term.hoistLetsAux stem data
+    let continuation ← Term.hoistLetsAux stem continuation
+    buildWithArguments stem [channel, data] fun
+      | [channel, data] => .let .wildcard (.ioWrite channel data .unit) continuation
+      | _ => term
+  | .ioSetInfo channel key idx len continuation =>
+    let channel ← Term.hoistLetsAux stem channel
+    let key ← Term.hoistLetsAux stem key
+    let idx ← Term.hoistLetsAux stem idx
+    let len ← Term.hoistLetsAux stem len
+    let continuation ← Term.hoistLetsAux stem continuation
+    buildWithArguments stem [channel, key, idx, len] fun
+      | [channel, key, idx, len] => .let .wildcard (.ioSetInfo channel key idx len .unit) continuation
+      | _ => term
+  | .set arr index value =>
+    let value ← Term.hoistLetsAux stem value
+    let arr ← Term.hoistLetsAux stem arr
+    buildWithArguments stem [value, arr] fun
+      | [value, arr] => .set arr index value
+      | _ => term
+  | .add a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .add a b | _ => term
+  | .sub a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .sub a b | _ => term
+  | .mul a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .mul a b | _ => term
   | .ioGetInfo a b =>
-    let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-    match cs with | [a, b] => Term.wrapLets fs (.ioGetInfo a b) | _ => t
-  | .ioRead a b n =>
-    let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-    match cs with | [a, b] => Term.wrapLets fs (.ioRead a b n) | _ => t
-  | .add a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                match cs with | [a, b] => Term.wrapLets fs (.add a b) | _ => t
-  | .sub a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                match cs with | [a, b] => Term.wrapLets fs (.sub a b) | _ => t
-  | .mul a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                match cs with | [a, b] => Term.wrapLets fs (.mul a b) | _ => t
-  | .eqZero a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.eqZero c)
-  | .proj a n => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.proj c n)
-  | .get a n => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.get c n)
-  | .slice a i j => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.slice c i j)
-  | .set a n v =>
-    let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets v]
-    match cs with | [a, v] => Term.wrapLets fs (.set a n v) | _ => t
-  | .store a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.store c)
-  | .load a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.load c)
-  | .ptrVal a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.ptrVal c)
-  | .ann τ a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.ann τ c)
-  | .u8BitDecomposition a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.u8BitDecomposition c)
-  | .u8ShiftLeft a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.u8ShiftLeft c)
-  | .u8ShiftRight a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.u8ShiftRight c)
-  | .toField a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.toField c)
-  | .u8FromFieldUnsafe a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.u8FromFieldUnsafe c)
-  | .unconstrainedGToBytes a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.unconstrainedGToBytes c)
-  | .unconstrainedGInverse a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.unconstrainedGInverse c)
-  | .u8Xor a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                  match cs with | [a, b] => Term.wrapLets fs (.u8Xor a b) | _ => t
-  | .u8Add a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                  match cs with | [a, b] => Term.wrapLets fs (.u8Add a b) | _ => t
-  | .u8Mul a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                  match cs with | [a, b] => Term.wrapLets fs (.u8Mul a b) | _ => t
-  | .u8Sub a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                  match cs with | [a, b] => Term.wrapLets fs (.u8Sub a b) | _ => t
-  | .u8And a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                  match cs with | [a, b] => Term.wrapLets fs (.u8And a b) | _ => t
-  | .u8Or a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                 match cs with | [a, b] => Term.wrapLets fs (.u8Or a b) | _ => t
-  | .u8LessThan a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                       match cs with | [a, b] => Term.wrapLets fs (.u8LessThan a b) | _ => t
-  | .u32LessThan a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                        match cs with | [a, b] => Term.wrapLets fs (.u32LessThan a b) | _ => t
-  | .u8XorSplit7 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                        match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit7 a b) | _ => t
-  | .u8XorSplit4 a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                        match cs with | [a, b] => Term.wrapLets fs (.u8XorSplit4 a b) | _ => t
-  | .unconstrainedU32Add a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                       match cs with | [a, b] => Term.wrapLets fs (.unconstrainedU32Add a b) | _ => t
-  | .unconstrainedU32Add3 a b c => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b, Term.hoistLets c]
-                          match cs with | [a, b, c] => Term.wrapLets fs (.unconstrainedU32Add3 a b c) | _ => t
-  | .u32ToField a => let (fs, c) := Term.peelLets (Term.hoistLets a); Term.wrapLets fs (.u32ToField c)
-  | .unconstrainedBigUintDivMod a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                                       match cs with | [a, b] => Term.wrapLets fs (.unconstrainedBigUintDivMod a b) | _ => t
-  | .u8RangeCheck a b => let (fs, cs) := Term.peelListLets [Term.hoistLets a, Term.hoistLets b]
-                         match cs with | [a, b] => Term.wrapLets fs (.u8RangeCheck a b) | _ => t
-termination_by t => sizeOf t
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .ioGetInfo a b | _ => term
+  | .ioRead a b len =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .ioRead a b len | _ => term
+  | .u8Xor a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8Xor a b | _ => term
+  | .u8Add a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8Add a b | _ => term
+  | .u8Mul a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8Mul a b | _ => term
+  | .u8Sub a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8Sub a b | _ => term
+  | .u8And a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8And a b | _ => term
+  | .u8Or a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8Or a b | _ => term
+  | .u8LessThan a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8LessThan a b | _ => term
+  | .u32LessThan a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u32LessThan a b | _ => term
+  | .u8XorSplit7 a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8XorSplit7 a b | _ => term
+  | .u8XorSplit4 a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8XorSplit4 a b | _ => term
+  | .unconstrainedU32Add a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .unconstrainedU32Add a b | _ => term
+  | .unconstrainedBigUintDivMod a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .unconstrainedBigUintDivMod a b | _ => term
+  | .u8RangeCheck a b =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    buildWithArguments stem [a, b] fun | [a, b] => .u8RangeCheck a b | _ => term
+  | .unconstrainedU32Add3 a b c =>
+    let a ← Term.hoistLetsAux stem a; let b ← Term.hoistLetsAux stem b
+    let c ← Term.hoistLetsAux stem c
+    buildWithArguments stem [a, b, c] fun | [a, b, c] => .unconstrainedU32Add3 a b c | _ => term
+  | .eqZero a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .eqZero a | _ => term
+  | .proj a index =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .proj a index | _ => term
+  | .get a index =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .get a index | _ => term
+  | .slice a start stop =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .slice a start stop | _ => term
+  | .store a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .store a | _ => term
+  | .load a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .load a | _ => term
+  | .ptrVal a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .ptrVal a | _ => term
+  | .ann typ a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .ann typ a | _ => term
+  | .u8BitDecomposition a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .u8BitDecomposition a | _ => term
+  | .u8ShiftLeft a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .u8ShiftLeft a | _ => term
+  | .u8ShiftRight a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .u8ShiftRight a | _ => term
+  | .u32ToField a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .u32ToField a | _ => term
+  | .unconstrainedGToBytes a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .unconstrainedGToBytes a | _ => term
+  | .unconstrainedGInverse a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .unconstrainedGInverse a | _ => term
+  | .toField a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .toField a | _ => term
+  | .u8FromFieldUnsafe a =>
+    let a ← Term.hoistLetsAux stem a
+    buildWithArguments stem [a] fun | [a] => .u8FromFieldUnsafe a | _ => term
+termination_by sizeOf term
 decreasing_by
   all_goals first
     | decreasing_tactic
-    | (have := Array.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
-    | (have := List.sizeOf_lt_of_mem ‹_ ∈ _›; grind)
+    | (have := Array.sizeOf_lt_of_mem t.property; grind)
+    | (have := List.sizeOf_lt_of_mem t.property; grind)
+    | (have := List.sizeOf_lt_of_mem arm.property
+       have : sizeOf arm.val.2 < sizeOf arm.val := by cases arm.val; simp; omega
+       simp_all; omega)
+
+/-- Normalize argument evaluation into let bindings with distinct local
+names. The name stem is longer than every original local or global name. -/
+def Term.hoistLets (term : Term) : Term :=
+  let stem := String.ofList (List.replicate (term.maxNameLength + 1) '#')
+  let (next, renamed) := Term.freshenWith stem 0 ∅ term
+  (Term.hoistLetsAux stem renamed).run' next
 
 /-- Kahn-style topological sort of the inline-dependency graph: each pass
 emits every function whose inline-callees are already emitted, so callees
@@ -1045,14 +1254,22 @@ context; left in tail position it turns a legal tail match into a
 lowering rejects ("non-tail match in arbitrary position"). The rewrite
 is the eta step `let x = v; x → v`, applied only through tail positions
 (let bodies and match arms), so non-tail wraps are untouched. -/
-partial def Term.restoreTailMatches : Term → Term
-  | .let p v b =>
-    match p, b with
-    | .var x, .var y =>
-      if x == y then Term.restoreTailMatches v else .let p v b
-    | _, _ => .let p v (Term.restoreTailMatches b)
-  | .match s arms => .match s (arms.map fun (p, a) => (p, Term.restoreTailMatches a))
+def Term.restoreTailMatches : Term → Term
+  | .let (.var x) v (.var y) =>
+    if x == y then Term.restoreTailMatches v else .let (.var x) v (.var y)
+  | .let p v b => .let p v (Term.restoreTailMatches b)
+  | .match s arms =>
+    .match s (arms.attach.map fun arm => (arm.val.1, Term.restoreTailMatches arm.val.2))
   | t => t
+termination_by term => sizeOf term
+decreasing_by
+  all_goals first
+    | decreasing_tactic
+    | (have listBound := List.sizeOf_lt_of_mem arm.property
+       have pairBound : sizeOf arm.val.2 < sizeOf arm.val := by
+         cases arm.val; simp; omega
+       simp_all
+       omega)
 
 /-- Inline-expand every function body in the toplevel, eliminating all
 `.inlined` applications. Run before typechecking.
diff --git a/Ix/Aiur/Transcript.lean b/Ix/Aiur/Transcript.lean
new file mode 100644
index 000000000..efbed95e5
--- /dev/null
+++ b/Ix/Aiur/Transcript.lean
@@ -0,0 +1,73 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Challenger
+import Ix.Aiur.VerifierArithmetic
+
+/-! The multi-STARK transcript through the out-of-domain challenge, with
+the continuing challenger state retained for PCS verification. This replay
+does not authenticate the openings or assert hash security.
+-/
+
+namespace Aiur.NativeAIR.Transcript
+
+open Challenger
+open ProofCodec (Extension)
+
+def parameterWords (parameters : KeyCodec.Parameters) : List Nat :=
+  [parameters.logBlowup, parameters.capHeight, parameters.logFinalPolyLen,
+    parameters.maxLogArity, parameters.numQueries, parameters.commitProofOfWorkBits,
+    parameters.queryProofOfWorkBits]
+
+def seed (parameters : KeyCodec.Parameters) : List UInt8 :=
+  "multi-stark/v0".toUTF8.data.toList ++ (parameterWords parameters).flatMap (KeyCodec.encodeNat 8)
+
+def circuitShape (circuit : KeyCodec.Circuit) : List G :=
+  [circuit.constraintCount, circuit.maxConstraintDegree, circuit.preprocessedHeight,
+    circuit.preprocessedWidth, circuit.mainWidth, circuit.widths.stage2, circuit.lookupGroupSize].map G.ofNat
+
+def shape (key : KeyCodec.Key) : List G :=
+  G.ofNat key.circuits.length :: key.circuits.flatMap circuitShape
+
+def claimsFields (claims : List (List G)) : List G :=
+  G.ofNat claims.length :: claims.flatMap (fun claim => G.ofNat claim.length :: claim)
+
+def fieldsBytes (values : List G) : List UInt8 := values.flatMap ProofCodec.encodeField
+
+def prefixBytes (key : KeyCodec.Key) (proof : ProofCodec.Data) (claims : List (List G)) : List UInt8 :=
+  fieldsBytes (shape key) ++
+    fieldsBytes (proof.active.map (fun active => if active then 1 else 0)) ++
+    (key.preprocessedCommitment.getD []).flatten ++ proof.commitments.stage1.flatten ++
+    fieldsBytes (proof.logDegrees.map (fun degree => G.ofNat degree.toNat)) ++
+    fieldsBytes (claimsFields claims)
+
+def lookupState (key : KeyCodec.Key) (proof : ProofCodec.Data) (claims : List (List G)) : State :=
+  observeBytes (initial (seed key.parameters)) (prefixBytes key proof claims)
+
+def accumulatorState (proof : ProofCodec.Data) (state : State) : State :=
+  proof.accumulators.foldl observeExtension (observeCap state proof.commitments.stage2)
+
+structure Replay where
+  challenges : VerifierArithmetic.Challenges
+  state : State
+  deriving DecidableEq, Repr
+
+def replay (hash : Hash32) (fuel : Nat) (key : KeyCodec.Key)
+    (proof : ProofCodec.Data) (claims : List (List G)) : Option Replay := do
+  let (beta, afterBeta) ← sampleExtension hash fuel (lookupState key proof claims)
+  let (gamma, afterGamma) ← sampleExtension hash fuel (observeExtension afterBeta beta)
+  let (alpha, afterAlpha) ← sampleExtension hash fuel
+    (accumulatorState proof (observeExtension afterGamma gamma))
+  let (zeta, final) ← sampleExtension hash fuel (observeCap afterAlpha proof.commitments.quotient)
+  return ⟨⟨beta, gamma, alpha, zeta⟩, final⟩
+
+/-- Arithmetic with transcript-derived challenges. The PCS still has to
+authenticate the polynomial openings using the returned challenger state. -/
+def verifyArithmetic (hash : Hash32) (fuel : Nat) (key : KeyCodec.Key)
+    (proof : ProofCodec.Data) (claims : List (List G)) (rows : List ProofShape.Row) : Option Replay := do
+  let result ← replay hash fuel key proof claims
+  if ← VerifierArithmetic.verify result.challenges claims rows then some result else none
+
+end Aiur.NativeAIR.Transcript
diff --git a/Ix/Aiur/VerifierArithmetic.lean b/Ix/Aiur/VerifierArithmetic.lean
new file mode 100644
index 000000000..c3f9cdc9f
--- /dev/null
+++ b/Ix/Aiur/VerifierArithmetic.lean
@@ -0,0 +1,105 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ProofShape
+import Ix.Aiur.LogUp
+import Ix.Aiur.Quotient
+
+/-! Total arithmetic on the opened rows of an active circuit. The ordering,
+coordinate embedding and boundary normalization follow the pinned native
+verifier. Challenges are explicit inputs; this does not authenticate them
+or the polynomial openings.
+-/
+
+namespace Aiur.NativeAIR.VerifierArithmetic
+
+open ProofCodec (Extension)
+open ProofShape (Row Pair)
+
+structure Challenges where
+  beta : Extension
+  gamma : Extension
+  alpha : Extension
+  zeta : Extension
+  deriving DecidableEq, Repr
+
+def pairColumns (pair : Pair) : RowOffset → Array Extension
+  | .current => pair.current.toArray
+  | .next => pair.next.toArray
+
+def rowColumns (row : Row) : Source → RowOffset → Array Extension
+  | .preprocessed => match row.preprocessed with
+    | none => fun _ => #[]
+    | some pair => pairColumns pair
+  | .main => pairColumns row.stage1
+  | .stage2 => pairColumns row.stage2
+
+/-- Each extension value contributes its two base coordinates, each embedded
+separately into the working extension field. -/
+def publics (challenges : Challenges) (entering leaving : Extension) : Array Extension :=
+  #[Extension.ofBase challenges.beta.c0, Extension.ofBase challenges.beta.c1,
+    Extension.ofBase challenges.gamma.c0, Extension.ofBase challenges.gamma.c1,
+    Extension.ofBase entering.c0, Extension.ofBase entering.c1,
+    Extension.ofBase leaving.c0, Extension.ofBase leaving.c1]
+
+def deltaScaled (domain : Domain.Subgroup) (entering leaving : Extension) : Array Extension :=
+  let normalizer := Extension.ofBase (Domain.normalizer domain).inverse
+  #[(Extension.ofBase leaving.c0 - Extension.ofBase entering.c0) * normalizer,
+    (Extension.ofBase leaving.c1 - Extension.ofBase entering.c1) * normalizer]
+
+def view (challenges : Challenges) (row : Row) (entering : Extension)
+    (selectors : Domain.Selectors Extension) : Values Extension :=
+  ⟨rowColumns row, publics challenges entering row.accumulator,
+    selectors.isFirst, selectors.isLast, selectors.isTransition⟩
+
+structure Evaluation where
+  domain : Domain.Subgroup
+  selectors : Domain.Selectors Extension
+  nodeValues : Array Extension
+  userValues : List Extension
+  lookupValues : List Extension
+  quotientValue : Extension
+  deriving DecidableEq, Repr
+
+def Evaluation.constraints (result : Evaluation) : List Extension :=
+  result.userValues ++ result.lookupValues
+
+def Evaluation.accepts (result : Evaluation) (alpha : Extension) : Bool :=
+  Quotient.composition alpha result.constraints * result.selectors.invVanishing == result.quotientValue
+
+def evaluate (challenges : Challenges) (row : Row) (entering : Extension) : Option Evaluation := do
+  let domain ← Domain.ofLogSize row.logDegree.toNat
+  let selectors ← Domain.selectors domain challenges.zeta
+  let values := view challenges row entering selectors
+  let nodes ← row.circuit.graph.sweep Extension.evalOps values
+  let userValues ← readNodes nodes row.circuit.graph.zeros
+  let lookupValues ← LogUp.constraintValues row.circuit.graph.lookups nodes
+    (values.columns .stage2 .current) (values.columns .stage2 .next) values.publics
+    (deltaScaled domain entering row.accumulator) values.isLastRow row.circuit.lookupGroupSize
+  let quotientValue ← Quotient.evaluate domain challenges.zeta row.quotient
+  return ⟨domain, selectors, nodes, userValues, lookupValues, quotientValue⟩
+
+def check (challenges : Challenges) (row : Row) (entering : Extension) : Option Bool := do
+  return (← evaluate challenges row entering).accepts challenges.alpha
+
+/-- The leaving accumulator of each accepted row enters the next active row. -/
+def checkRows (challenges : Challenges) : List Row → Extension → Option Extension
+  | [], entering => some entering
+  | row :: rows, entering => do
+    if ← check challenges row entering then checkRows challenges rows row.accumulator else none
+
+def claimMessage (challenges : Challenges) (claim : List G) : Extension :=
+  challenges.beta + (LogUp.fingerprint (LogUp.Coordinates.fromExtension challenges.gamma) claim).toExtension
+
+def initialAccumulator (challenges : Challenges) (claims : List (List G)) : Option Extension := do
+  let inverses ← claims.mapM fun claim => (claimMessage challenges claim).tryInverse
+  return LogUp.sum inverses
+
+def verify (challenges : Challenges) (claims : List (List G)) (rows : List Row) : Option Bool := do
+  if rows.isEmpty then none else do
+    let entering ← initialAccumulator challenges claims
+    return (← checkRows challenges rows entering) == 0
+
+end Aiur.NativeAIR.VerifierArithmetic
diff --git a/Ix/AuxGen/ExprUtils.lean b/Ix/AuxGen/ExprUtils.lean
index 9f2a14ffa..fc6618a79 100644
--- a/Ix/AuxGen/ExprUtils.lean
+++ b/Ix/AuxGen/ExprUtils.lean
@@ -13,7 +13,7 @@
   The kernel-backed half of expr_utils.rs (TcScope, kenv ingress,
   `decompose_inductive_type`, `kexpr_to_lean`, `to_kexpr_static`, the
   WHNF source-name restore machinery) is intentionally NOT here — it is a
-  separate milestone that bridges to `Ix.Tc`.
+  separate milestone that bridges to `Ix.Kernel`.
 
   PARITY RULE: every constructed node goes through the hash-maintaining
   smart constructors in `Ix.Environment` (`Expr.mkApp`, `Level.mkMax`, ...)
diff --git a/Ix/AuxGen/Kernel.lean b/Ix/AuxGen/Kernel.lean
index 5de7681e6..10604ae7b 100644
--- a/Ix/AuxGen/Kernel.lean
+++ b/Ix/AuxGen/Kernel.lean
@@ -6,7 +6,7 @@
   compile-side entry points of `crates/kernel/src/ingress.rs` (:2097-2270).
   aux_gen needs exactly four kernel operations — `whnf`, `infer` +
   `ensureSort`, `isDefEq`, `isLargeEliminator` — over Meta-mode `KExpr`;
-  the pure-Lean kernel `Ix.Tc` exposes all four (Knot.lean), so this file
+  the pure-Lean kernel `Ix.Kernel` exposes all four (Knot.lean), so this file
   only supplies the VALUE bridge:
 
   - `Ix.Expr → KExpr .meta` (`toKexprStatic` for open terms in an FVar
@@ -16,13 +16,13 @@
     `ensureInKenvOf` family) under PROVISIONAL addresses
     (`resolveLeanNameAddr`: compiled address if known, else the name
     hash — mirrors KernelCtx's "addresses may shift" model);
-  - `TcScope`: a scoped view running `Ix.Tc.TcM` actions against the
+  - `TcScope`: a scoped view running `Ix.Kernel.TcM` actions against the
     bridge state, with the fault-in retry loop and WHNF source-name
     restoration.
 
   State model: Rust's `KernelCtx { kenv }` + `KEnv.ingress_cache` become
   `AuxKernelCtx { tcState, ingressCache }` — the cache lives HERE, not in
-  `Ix.Tc.KEnv` (`Ix/Tc` is consumed, never modified). Rust's fresh
+  `Ix.Kernel.KEnv` (`Ix/Kernel` is consumed, never modified). Rust's fresh
   `TypeChecker::new(&mut kenv)` per scope = fresh `TcState.new` carrying
   over the persistent `KEnv` (whose whnf/infer caches live inside it,
   matching the Rust split of TC-transient vs kenv-persistent state).
@@ -32,7 +32,7 @@ public import Ix.Common
 public import Ix.Address
 public import Ix.Environment
 public import Ix.CompileM
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.AuxGen.Types
 public import Ix.AuxGen.ExprUtils
 public import Ix.AuxGen.Levels
@@ -43,16 +43,16 @@ namespace Ix.AuxGen
 
 open Ix.CompileM (CompileM CompileError)
 
-abbrev MKExpr := Ix.Tc.KExpr .meta
-abbrev MKUniv := Ix.Tc.KUniv .meta
-abbrev MKId := Ix.Tc.KId .meta
-abbrev MKConst := Ix.Tc.KConst .meta
+abbrev MKExpr := Ix.Kernel.KExpr .meta
+abbrev MKUniv := Ix.Kernel.KUniv .meta
+abbrev MKId := Ix.Kernel.KId .meta
+abbrev MKConst := Ix.Kernel.KConst .meta
 
-/-- Inverse of `Ix.Tc.EgressLean.safetyToLean`. -/
+/-- Inverse of `Ix.Kernel.EgressLean.safetyToLean`. -/
 def safetyOfLean : Lean.DefinitionSafety → Ix.DefinitionSafety
   | .unsafe => .unsaf | .safe => .safe | .partial => .part
 
-/-- Inverse of `Ix.Tc.EgressLean.quotKindToLean`. -/
+/-- Inverse of `Ix.Kernel.EgressLean.quotKindToLean`. -/
 def quotKindOfLean : Lean.QuotKind → Ix.QuotKind
   | .type => .type | .ctor => .ctor | .lift => .lift | .ind => .ind
 
@@ -98,17 +98,17 @@ def AddrMaps.ofCompileEnv (cenv : Ix.CompileM.CompileEnv)
     SMART `mkMax`/`mkIMax` (Rust `KUniv::max/imax` normalize). -/
 partial def leanLevelToKuniv (lvl : Level) (paramNames : Array Name) : MKUniv :=
   match lvl with
-  | .zero _ => Ix.Tc.KUniv.mkZero
-  | .succ l _ => Ix.Tc.KUniv.mkSucc (leanLevelToKuniv l paramNames)
+  | .zero _ => Ix.Kernel.KUniv.mkZero
+  | .succ l _ => Ix.Kernel.KUniv.mkSucc (leanLevelToKuniv l paramNames)
   | .max a b _ =>
-    Ix.Tc.KUniv.mkMax (leanLevelToKuniv a paramNames)
+    Ix.Kernel.KUniv.mkMax (leanLevelToKuniv a paramNames)
       (leanLevelToKuniv b paramNames)
   | .imax a b _ =>
-    Ix.Tc.KUniv.mkIMax (leanLevelToKuniv a paramNames)
+    Ix.Kernel.KUniv.mkIMax (leanLevelToKuniv a paramNames)
       (leanLevelToKuniv b paramNames)
   | .param name _ =>
     match paramNames.findIdx? (· == name) with
-    | some idx => Ix.Tc.KUniv.mkParam idx.toUInt64 name
+    | some idx => Ix.Kernel.KUniv.mkParam idx.toUInt64 name
     | none =>
       panic! s!"unknown level param `{name.pretty}` not found in param_names \
 {paramNames.toList.map (·.pretty)}"
@@ -135,7 +135,7 @@ partial def kunivToLevel (u : MKUniv) (paramNames : Array Name) : Level :=
 /-- Rust `KernelCtx` + `KEnv.ingress_cache`. The cache key is
     `(expr contentHash, paramNamesHash)` — Rust ingress.rs:2216. -/
 structure AuxKernelCtx where
-  tcState : Ix.Tc.TcState .meta
+  tcState : Ix.Kernel.TcState .meta
   ingressCache : Std.HashMap (Address × Address) MKExpr := {}
   /-- Mirrors Rust `KernelCtx.aux_ingress_seen`: ids whose
       `ingressAuxGenDep` dispatch already ran against this kenv. The
@@ -152,16 +152,16 @@ structure AuxKernelCtx where
     simply never match the provisional-address constants — same shape as
     the Rust bridge, whose static prim addresses don't match either). -/
 def AuxKernelCtx.new : AuxKernelCtx :=
-  { tcState := Ix.Tc.TcState.new {}
-      (Ix.Tc.Primitives.ofResolve .canonical fun _ => none) }
+  { tcState := Ix.Kernel.TcState.new {}
+      (Ix.Kernel.Primitives.ofResolve .canonical fun _ => none) }
 
 /-- Bridge monad: aux kernel state over CompileM. -/
 abbrev KBridgeM := StateT AuxKernelCtx CompileM
 
-/-- Run an `Ix.Tc.TcM` action against the bridge's kernel state,
+/-- Run an `Ix.Kernel.TcM` action against the bridge's kernel state,
     threading the state back in BOTH outcomes (Rust's `&mut` semantics —
     caches warmed by a failing call stay warm). -/
-def runTc (act : Ix.Tc.TcM .meta α) : KBridgeM (Except (Ix.Tc.TcError .meta) α) := do
+def runTc (act : Ix.Kernel.TcM .meta α) : KBridgeM (Except (Ix.Kernel.TcError .meta) α) := do
   let kctx ← get
   match act kctx.tcState with
   | .ok a st' =>
@@ -214,7 +214,7 @@ partial def leanExprToKexprCached (e : Expr) (paramNames : Array Name)
     return hit
 
   -- Accumulate consecutive mdata wrappers.
-  let mut mdataLayers : Array Ix.Tc.MData := #[]
+  let mut mdataLayers : Array Ix.Kernel.MData := #[]
   let mut cur := e
   let mut go := true
   while go do
@@ -230,50 +230,50 @@ partial def leanExprToKexprCached (e : Expr) (paramNames : Array Name)
         if idx < binderNames.size then
           return binderNames[binderNames.size - 1 - idx]!
         return Name.mkAnon
-      pure (Ix.Tc.KExpr.mkVar (UInt64.ofNat idx) name mdataLayers)
+      pure (Ix.Kernel.KExpr.mkVar (UInt64.ofNat idx) name mdataLayers)
     | .sort lvl _ =>
-      pure (Ix.Tc.KExpr.mkSort (leanLevelToKuniv lvl paramNames) mdataLayers)
+      pure (Ix.Kernel.KExpr.mkSort (leanLevelToKuniv lvl paramNames) mdataLayers)
     | .const name us _ =>
       let zid : MKId := ⟨maps.resolve name, name⟩
       let zus := us.map (leanLevelToKuniv · paramNames)
-      pure (Ix.Tc.KExpr.mkConst zid zus mdataLayers)
+      pure (Ix.Kernel.KExpr.mkConst zid zus mdataLayers)
     | .app f a _ =>
       let fk ← leanExprToKexprCached f paramNames binderNames pnHash maps
       let ak ← leanExprToKexprCached a paramNames binderNames pnHash maps
-      pure (Ix.Tc.KExpr.mkApp fk ak mdataLayers)
+      pure (Ix.Kernel.KExpr.mkApp fk ak mdataLayers)
     | .forallE binderName dom body bi _ =>
       let dk ← leanExprToKexprCached dom paramNames binderNames pnHash maps
       let bk ← leanExprToKexprCached body paramNames
         (binderNames.push binderName) pnHash maps
-      pure (Ix.Tc.KExpr.mkAll binderName bi dk bk mdataLayers)
+      pure (Ix.Kernel.KExpr.mkAll binderName bi dk bk mdataLayers)
     | .lam binderName dom body bi _ =>
       let dk ← leanExprToKexprCached dom paramNames binderNames pnHash maps
       let bk ← leanExprToKexprCached body paramNames
         (binderNames.push binderName) pnHash maps
-      pure (Ix.Tc.KExpr.mkLam binderName bi dk bk mdataLayers)
+      pure (Ix.Kernel.KExpr.mkLam binderName bi dk bk mdataLayers)
     | .letE binderName ty val body nd _ =>
       let tk ← leanExprToKexprCached ty paramNames binderNames pnHash maps
       let vk ← leanExprToKexprCached val paramNames binderNames pnHash maps
       let bk ← leanExprToKexprCached body paramNames
         (binderNames.push binderName) pnHash maps
-      pure (Ix.Tc.KExpr.mkLet binderName tk vk bk nd mdataLayers)
+      pure (Ix.Kernel.KExpr.mkLet binderName tk vk bk nd mdataLayers)
     | .proj pname idx s _ =>
       let zid : MKId := ⟨maps.resolve pname, pname⟩
       let sk ← leanExprToKexprCached s paramNames binderNames pnHash maps
-      pure (Ix.Tc.KExpr.mkPrj zid (UInt64.ofNat idx) sk mdataLayers)
+      pure (Ix.Kernel.KExpr.mkPrj zid (UInt64.ofNat idx) sk mdataLayers)
     | .lit (.natVal n) _ =>
       -- Compile-side blob convention: 8-byte u64 LE (Rust to_kexpr_static
       -- / ingress use `nat_to_u64(n).to_le_bytes()`), NOT the kernel's
       -- trimmed `natBlob`.
-      pure (Ix.Tc.KExpr.mkNat n (Address.blake3 (UInt64.ofNat n).toLEBytes) mdataLayers)
+      pure (Ix.Kernel.KExpr.mkNat n (Address.blake3 (UInt64.ofNat n).toLEBytes) mdataLayers)
     | .lit (.strVal s) _ =>
-      pure (Ix.Tc.KExpr.mkStr s (Address.blake3 s.toUTF8) mdataLayers)
+      pure (Ix.Kernel.KExpr.mkStr s (Address.blake3 s.toUTF8) mdataLayers)
     | .fvar _ _ =>
       -- Closed-term converter: fvars have no meaning here (Rust `_raw`
       -- has no Fvar arm reachable from ensure-in-kenv callers).
-      pure (Ix.Tc.KExpr.mkSort Ix.Tc.KUniv.mkZero)
+      pure (Ix.Kernel.KExpr.mkSort Ix.Kernel.KUniv.mkZero)
     | .mvar _ _ =>
-      pure (Ix.Tc.KExpr.mkSort Ix.Tc.KUniv.mkZero)
+      pure (Ix.Kernel.KExpr.mkSort Ix.Kernel.KUniv.mkZero)
     | .mdata .. => unreachable!
 
   let result ← internK raw
@@ -303,11 +303,11 @@ def ensurePreludeInKenvOf (maps : AddrMaps) : KBridgeM Unit := do
 
   let uName := Name.mkStr .mkAnon "u"
   -- PUnit.{u} : Sort u ; PUnit.unit : PUnit.{u}
-  let u0 : MKUniv := Ix.Tc.KUniv.mkParam 0 uName
-  let punitTy := Ix.Tc.KExpr.mkSort u0
+  let u0 : MKUniv := Ix.Kernel.KUniv.mkParam 0 uName
+  let punitTy := Ix.Kernel.KExpr.mkSort u0
   let unitName := Name.mkStr punitName "unit"
   let unitId : MKId := ⟨maps.resolve unitName, unitName⟩
-  let unitTy := Ix.Tc.KExpr.mkConst punitId #[Ix.Tc.KUniv.mkParam 0 uName]
+  let unitTy := Ix.Kernel.KExpr.mkConst punitId #[Ix.Kernel.KUniv.mkParam 0 uName]
   kenvInsert unitId (.ctor unitName #[uName] false 1 punitId 0 0 0 unitTy)
   kenvInsert punitId
     (.indc punitName #[uName] 1 0 0 false punitId 0 punitTy #[unitId] #[])
@@ -320,28 +320,28 @@ def ensurePreludeInKenvOf (maps : AddrMaps) : KBridgeM Unit := do
   let betaName := Name.mkStr .mkAnon "β"
   let fstName := Name.mkStr .mkAnon "fst"
   let sndName := Name.mkStr .mkAnon "snd"
-  let u0' : MKUniv := Ix.Tc.KUniv.mkParam 0 uName
-  let u1 : MKUniv := Ix.Tc.KUniv.mkParam 1 vName
-  let sortU := Ix.Tc.KExpr.mkSort u0'
-  let sortV := Ix.Tc.KExpr.mkSort u1
+  let u0' : MKUniv := Ix.Kernel.KUniv.mkParam 0 uName
+  let u1 : MKUniv := Ix.Kernel.KUniv.mkParam 1 vName
+  let sortU := Ix.Kernel.KExpr.mkSort u0'
+  let sortV := Ix.Kernel.KExpr.mkSort u1
   -- Lean stores `max 1 u v` LEFT-associated: max(max(1,u),v). Essential:
   -- after substitution the normalizing max collapses differently for the
   -- right-associated form (expr_utils.rs:1813-1821).
-  let max1uv := Ix.Tc.KUniv.mkMax
-    (Ix.Tc.KUniv.mkMax (Ix.Tc.KUniv.mkSucc Ix.Tc.KUniv.mkZero) u0') u1
-  let pprodTy := Ix.Tc.KExpr.mkAll alphaName Lean.BinderInfo.default sortU
-    (Ix.Tc.KExpr.mkAll betaName Lean.BinderInfo.default sortV (Ix.Tc.KExpr.mkSort max1uv))
+  let max1uv := Ix.Kernel.KUniv.mkMax
+    (Ix.Kernel.KUniv.mkMax (Ix.Kernel.KUniv.mkSucc Ix.Kernel.KUniv.mkZero) u0') u1
+  let pprodTy := Ix.Kernel.KExpr.mkAll alphaName Lean.BinderInfo.default sortU
+    (Ix.Kernel.KExpr.mkAll betaName Lean.BinderInfo.default sortV (Ix.Kernel.KExpr.mkSort max1uv))
   -- PProd.mk : {α : Sort u} → {β : Sort v} → α → β → PProd.{u,v} α β
   let mkName := Name.mkStr pprodName "mk"
   let mkId : MKId := ⟨maps.resolve mkName, mkName⟩
-  let pprodApp := Ix.Tc.KExpr.mkApp
-    (Ix.Tc.KExpr.mkApp (Ix.Tc.KExpr.mkConst pprodId #[u0', u1])
-      (Ix.Tc.KExpr.mkVar 3 Name.mkAnon))
-    (Ix.Tc.KExpr.mkVar 2 Name.mkAnon)
-  let mkTy := Ix.Tc.KExpr.mkAll alphaName Lean.BinderInfo.implicit sortU
-    (Ix.Tc.KExpr.mkAll betaName Lean.BinderInfo.implicit sortV
-      (Ix.Tc.KExpr.mkAll fstName Lean.BinderInfo.default (Ix.Tc.KExpr.mkVar 1 Name.mkAnon)
-        (Ix.Tc.KExpr.mkAll sndName Lean.BinderInfo.default (Ix.Tc.KExpr.mkVar 1 Name.mkAnon)
+  let pprodApp := Ix.Kernel.KExpr.mkApp
+    (Ix.Kernel.KExpr.mkApp (Ix.Kernel.KExpr.mkConst pprodId #[u0', u1])
+      (Ix.Kernel.KExpr.mkVar 3 Name.mkAnon))
+    (Ix.Kernel.KExpr.mkVar 2 Name.mkAnon)
+  let mkTy := Ix.Kernel.KExpr.mkAll alphaName Lean.BinderInfo.implicit sortU
+    (Ix.Kernel.KExpr.mkAll betaName Lean.BinderInfo.implicit sortV
+      (Ix.Kernel.KExpr.mkAll fstName Lean.BinderInfo.default (Ix.Kernel.KExpr.mkVar 1 Name.mkAnon)
+        (Ix.Kernel.KExpr.mkAll sndName Lean.BinderInfo.default (Ix.Kernel.KExpr.mkVar 1 Name.mkAnon)
           pprodApp)))
   kenvInsert mkId (.ctor mkName #[uName, vName] false 2 pprodId 0 2 2 mkTy)
   kenvInsert pprodId
@@ -451,41 +451,41 @@ partial def toKexprStatic (e : Expr) (fvarLevels : Std.HashMap Name Nat)
   match e with
   | .fvar fname _ =>
     match fvarLevels.get? fname with
-    | some level => Ix.Tc.KExpr.mkVar (UInt64.ofNat (ctxDepth - level - 1)) .mkAnon
-    | none => Ix.Tc.KExpr.mkSort Ix.Tc.KUniv.mkZero
-  | .bvar idx _ => Ix.Tc.KExpr.mkVar (UInt64.ofNat idx) .mkAnon
-  | .sort lvl _ => Ix.Tc.KExpr.mkSort (leanLevelToKuniv lvl paramNames)
+    | some level => Ix.Kernel.KExpr.mkVar (UInt64.ofNat (ctxDepth - level - 1)) .mkAnon
+    | none => Ix.Kernel.KExpr.mkSort Ix.Kernel.KUniv.mkZero
+  | .bvar idx _ => Ix.Kernel.KExpr.mkVar (UInt64.ofNat idx) .mkAnon
+  | .sort lvl _ => Ix.Kernel.KExpr.mkSort (leanLevelToKuniv lvl paramNames)
   | .const cname us _ =>
     let zid : MKId := ⟨maps.resolve cname, cname⟩
-    Ix.Tc.KExpr.mkConst zid (us.map (leanLevelToKuniv · paramNames))
+    Ix.Kernel.KExpr.mkConst zid (us.map (leanLevelToKuniv · paramNames))
   | .app f a _ =>
-    Ix.Tc.KExpr.mkApp (toKexprStatic f fvarLevels ctxDepth paramNames maps)
+    Ix.Kernel.KExpr.mkApp (toKexprStatic f fvarLevels ctxDepth paramNames maps)
       (toKexprStatic a fvarLevels ctxDepth paramNames maps)
   | .forallE binderName dom body bi _ =>
-    Ix.Tc.KExpr.mkAll binderName bi
+    Ix.Kernel.KExpr.mkAll binderName bi
       (toKexprStatic dom fvarLevels ctxDepth paramNames maps)
       (toKexprStatic body fvarLevels (ctxDepth + 1) paramNames maps)
   | .lam binderName dom body bi _ =>
-    Ix.Tc.KExpr.mkLam binderName bi
+    Ix.Kernel.KExpr.mkLam binderName bi
       (toKexprStatic dom fvarLevels ctxDepth paramNames maps)
       (toKexprStatic body fvarLevels (ctxDepth + 1) paramNames maps)
   | .letE binderName ty val body nd _ =>
-    Ix.Tc.KExpr.mkLet binderName
+    Ix.Kernel.KExpr.mkLet binderName
       (toKexprStatic ty fvarLevels ctxDepth paramNames maps)
       (toKexprStatic val fvarLevels ctxDepth paramNames maps)
       (toKexprStatic body fvarLevels (ctxDepth + 1) paramNames maps) nd
   | .proj pname idx s _ =>
     let zid : MKId := ⟨maps.resolve pname, pname⟩
-    Ix.Tc.KExpr.mkPrj zid (UInt64.ofNat idx)
+    Ix.Kernel.KExpr.mkPrj zid (UInt64.ofNat idx)
       (toKexprStatic s fvarLevels ctxDepth paramNames maps)
   | .lit (.natVal n) _ =>
     -- 8-byte u64 LE blob convention (see leanExprToKexprCached).
-    Ix.Tc.KExpr.mkNat n (Address.blake3 (UInt64.ofNat n).toLEBytes)
+    Ix.Kernel.KExpr.mkNat n (Address.blake3 (UInt64.ofNat n).toLEBytes)
   | .lit (.strVal s) _ =>
-    Ix.Tc.KExpr.mkStr s (Address.blake3 s.toUTF8)
+    Ix.Kernel.KExpr.mkStr s (Address.blake3 s.toUTF8)
   | .mdata _ inner _ =>
     toKexprStatic inner fvarLevels ctxDepth paramNames maps
-  | .mvar _ _ => Ix.Tc.KExpr.mkSort Ix.Tc.KUniv.mkZero
+  | .mvar _ _ => Ix.Kernel.KExpr.mkSort Ix.Kernel.KUniv.mkZero
 
 /-- `KExpr .meta → Ix.Expr` reconstructing FVars from de-Bruijn `Var`s:
     indices below `localDepth` stay BVars; above, level =
@@ -683,7 +683,7 @@ def new (outerFvarCtx : Array LocalDecl) (paramNames : Array Name)
     (maps : AddrMaps) : KBridgeM TcScopeSt := do
   -- Fresh TC portions, persistent env (caches live in KEnv).
   modify fun kctx => { kctx with tcState :=
-    { Ix.Tc.TcState.new kctx.tcState.env kctx.tcState.prims with
+    { Ix.Kernel.TcState.new kctx.tcState.env kctx.tcState.prims with
       inferOnly := true } }
   let mut fvarLevels : Std.HashMap Name Nat := {}
   for (decl, i) in outerFvarCtx.zipIdx do
@@ -692,7 +692,7 @@ def new (outerFvarCtx : Array LocalDecl) (paramNames : Array Name)
     { fvarLevels, baseDepth := outerFvarCtx.size, paramNames, maps }
   for (decl, i) in outerFvarCtx.zipIdx do
     let kty := toKexprStatic decl.domain fvarLevels i paramNames maps
-    discard <| runTc (Ix.Tc.TcM.pushLocal kty)
+    discard <| runTc (Ix.Kernel.TcM.pushLocal kty)
   return scope
 
 /-- Push additional locals (e.g. minor-premise binders); balance with
@@ -706,7 +706,7 @@ def pushLocals (scope : TcScopeSt) (decls : Array LocalDecl)
       fvarLevels := scope.fvarLevels.insert decl.fvarName (depth0 + i) }
     let kty := toKexprStatic decl.domain scope.fvarLevels (depth0 + i)
       scope.paramNames scope.maps
-    discard <| runTc (Ix.Tc.TcM.pushLocal kty)
+    discard <| runTc (Ix.Kernel.TcM.pushLocal kty)
   return { scope with extraLocals := scope.extraLocals + decls.size }
 
 /-- Mirrors Rust `pop_locals` (expr_utils.rs:2274). -/
@@ -714,7 +714,7 @@ def popLocals (scope : TcScopeSt) (decls : Array LocalDecl)
     : KBridgeM TcScopeSt := do
   let mut scope := scope
   for decl in decls.reverse do
-    discard <| runTc Ix.Tc.TcM.popLocal
+    discard <| runTc Ix.Kernel.TcM.popLocal
     scope := { scope with fvarLevels := scope.fvarLevels.erase decl.fvarName }
   return { scope with extraLocals := scope.extraLocals - decls.size }
 
@@ -829,7 +829,7 @@ partial def getLevel (scope : TcScopeSt) (ty : Expr) : KBridgeM Level := do
   let mut faultedAddrs : Std.HashSet Address := {}
   let mut inferred? : Option MKExpr := none
   while inferred?.isNone do
-    match ← runTc (Ix.Tc.TcM.infer kexpr) with
+    match ← runTc (Ix.Kernel.TcM.infer kexpr) with
     | .ok e => inferred? := some e
     | .error (.unknownConst addr) =>
       if !faultedAddrs.contains addr then
@@ -847,7 +847,7 @@ partial def getLevel (scope : TcScopeSt) (ty : Expr) : KBridgeM Level := do
         s!"TcScope::get_level: tc.infer failed: {e}")
   let inferred := inferred?.get!
 
-  let ku ← match ← runTc (Ix.Tc.TcM.ensureSort inferred) with
+  let ku ← match ← runTc (Ix.Kernel.TcM.ensureSort inferred) with
     | .ok u => pure u
     | .error e =>
       throw (.unsupportedExpr s!"TcScope::get_level: ensure_sort failed: {e}")
@@ -865,7 +865,7 @@ def whnfLean (scope : TcScopeSt) (ty : Expr) : KBridgeM Expr := do
   let depth := scope.depth
   let kexpr := toKexprStatic ty scope.fvarLevels depth
     scope.paramNames scope.maps
-  let whnfed ← match ← runTc (Ix.Tc.TcM.whnf kexpr) with
+  let whnfed ← match ← runTc (Ix.Kernel.TcM.whnf kexpr) with
     | .ok k => pure k
     | .error _ => return ty
   let out := kexprToLean whnfed depth scope.fvarLevels 0 scope.paramNames
@@ -883,7 +883,7 @@ def isDefEq (scope : TcScopeSt) (a b : Expr) : KBridgeM Bool := do
   let depth := scope.depth
   let ka := toKexprStatic a scope.fvarLevels depth scope.paramNames scope.maps
   let kb := toKexprStatic b scope.fvarLevels depth scope.paramNames scope.maps
-  match ← runTc (Ix.Tc.TcM.isDefEq ka kb) with
+  match ← runTc (Ix.Kernel.TcM.isDefEq ka kb) with
   | .ok r => return r
   | .error _ => return false
 
@@ -896,7 +896,7 @@ def isDefEq (scope : TcScopeSt) (a b : Expr) : KBridgeM Bool := do
 def inferLean (scope : TcScopeSt) (e : Expr) : KBridgeM (Option Expr) := do
   let depth := scope.depth
   let ke := toKexprStatic e scope.fvarLevels depth scope.paramNames scope.maps
-  match ← runTc (Ix.Tc.TcM.infer ke) with
+  match ← runTc (Ix.Kernel.TcM.infer ke) with
   | .ok ty => return some (kexprToLean ty depth scope.fvarLevels 0
       scope.paramNames)
   | .error _ => return none
diff --git a/Ix/AuxGen/Nested.lean b/Ix/AuxGen/Nested.lean
index eeb21a566..b4542ecfb 100644
--- a/Ix/AuxGen/Nested.lean
+++ b/Ix/AuxGen/Nested.lean
@@ -18,7 +18,7 @@
   `AuxLayout {perm, sourceCtorCounts}` metadata.
 
   The kernel re-derives this order via blake3 `AUX_INDC_VIEW` /
-  `AUX_MARKER_VIEW` seed addresses (`Ix/Tc/Inductive.lean:canonicalAuxOrder`,
+  `AUX_MARKER_VIEW` seed addresses (`Ix/Kernel/Inductive.lean:canonicalAuxOrder`,
   `crates/kernel/src/inductive.rs:canonical_aux_order`) — those seed
   strings are the CONSUMER's reconstruction and must not appear here: the
   compile side orders purely by marker ctor + `sortConsts`.
diff --git a/Ix/AuxGen/Recursor.lean b/Ix/AuxGen/Recursor.lean
index 72e62ed9f..edff092e3 100644
--- a/Ix/AuxGen/Recursor.lean
+++ b/Ix/AuxGen/Recursor.lean
@@ -1606,12 +1606,12 @@ def computeIsLargeAndK (classes : Array FlatInfo) (nClasses nParams : Nat)
   -- Fresh TypeChecker over the persistent kenv (Rust
   -- `TypeChecker::new(&mut kctx.kenv)`).
   modify fun kctx => { kctx with
-    tcState := Ix.Tc.TcState.new kctx.tcState.env kctx.tcState.prims }
+    tcState := Ix.Kernel.TcState.new kctx.tcState.env kctx.tcState.prims }
 
   -- WHNF-reduced result sort level via the kernel.
   let resultKuniv ←
-    match ← runTc (Ix.Tc.TcM.runRec
-        (Ix.Tc.RecM.getResultSortLevel firstTyZ
+    match ← runTc (Ix.Kernel.TcM.runRec
+        (Ix.Kernel.RecM.getResultSortLevel firstTyZ
           (nParams + firstNIndices.toNat))) with
     | .ok u => pure u
     | .error e =>
@@ -1620,8 +1620,8 @@ def computeIsLargeAndK (classes : Array FlatInfo) (nClasses nParams : Nat)
 {classes[0]!.ind.cnst.name.pretty}: {e}")
 
   let isLarge ←
-    match ← runTc (Ix.Tc.TcM.runRec
-        (Ix.Tc.RecM.isLargeEliminator resultKuniv indInfos)) with
+    match ← runTc (Ix.Kernel.TcM.runRec
+        (Ix.Kernel.RecM.isLargeEliminator resultKuniv indInfos)) with
     | .ok b => pure b
     | .error e =>
       throw (.invalidMutualBlock
diff --git a/Ix/BenchConstants.lean b/Ix/BenchConstants.lean
index cee6bc26a..434f499ad 100644
--- a/Ix/BenchConstants.lean
+++ b/Ix/BenchConstants.lean
@@ -1,7 +1,7 @@
 /-
   The shared benchmark constant set: the single source of truth for which
-  constants every per-constant benchmark backend (aiur, zisk, sp1, ooc,
-  lean4lean) runs. Every backend runs this same set — spanning the cheap →
+  constants every per-constant benchmark backend (aiur, zisk, sp1, ooc)
+  runs. Every backend runs this same set — spanning the cheap →
   heavy cost range across the registry envs — so their numbers stay
   comparable per constant; the only per-backend carve-outs are the hard
   feasibility exclusions in `Ix.Cli.BenchCmd.benchExclusions`.
diff --git a/Ix/Certified.lean b/Ix/Certified.lean
new file mode 100644
index 000000000..05cb4f0ef
--- /dev/null
+++ b/Ix/Certified.lean
@@ -0,0 +1,13 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Command
+import Ix.Certified.ClaimCommand
+
+/-! Source and claim adapters for the explicit certified profile.
+Their validation receipts connect authenticated Ixon inputs to the set model.
+The production checker's general inference path and Aiur public acceptance
+have separate refinement obligations.
+-/
diff --git a/Ix/Certified/Audit.lean b/Ix/Certified/Audit.lean
new file mode 100644
index 000000000..c5e47e3c9
--- /dev/null
+++ b/Ix/Certified/Audit.lean
@@ -0,0 +1,28 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.AuditSupport
+import Ix.Certified.Bytes
+
+/-!
+The serialized host adapter has its own audit. This is not the pure model's
+import boundary or an Aiur compiler/AIR soundness theorem. Foreign hashing and
+its output contract remain explicit runtime dependencies.
+-/
+
+open Lean Lean.Elab Command
+
+namespace Ix.Certified.Audit
+
+def roots : Array Lean.Name := #[
+  `Ix.Certified.decodeObject?, `Ix.Certified.decodeNatural?,
+  `Ix.Certified.readSignature?, `Ix.Certified.prepare?,
+  `Ix.Certified.acceptsSerialized_prepared,
+  `Ix.Certified.accepted_serialized_has_model,
+  `Ix.Certified.no_serialized_proof_of_False]
+
+run_cmd AuditSupport.report "serialized" roots #[]
+
+end Ix.Certified.Audit
diff --git a/Ix/Certified/AuditAll.lean b/Ix/Certified/AuditAll.lean
new file mode 100644
index 000000000..a6f8b020c
--- /dev/null
+++ b/Ix/Certified/AuditAll.lean
@@ -0,0 +1,25 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Audit
+import Ix.Certified.TcAudit
+import Ix.Certified.SourceAudit
+import Ix.Certified.ClaimAudit
+import Ix.Certified.ModeledAudit
+
+/-! The union of the five historical adapter boundaries, without duplicate
+root, premise or worker reports. Each component remains independently audited. -/
+
+namespace Ix.Certified.AuditAll
+
+def roots : Array Lean.Name := AuditSupport.distinct
+  (Audit.roots ++ TcAudit.roots ++ SourceAudit.roots ++ ClaimAudit.roots ++ ModeledAudit.roots)
+
+def premises : Array Lean.Name := AuditSupport.distinct
+  (TcAudit.premises ++ SourceAudit.premises ++ ClaimAudit.premises ++ ModeledAudit.premises)
+
+run_cmd AuditSupport.report "Certified host adapters" roots premises
+
+end Ix.Certified.AuditAll
diff --git a/Ix/Certified/AuditSupport.lean b/Ix/Certified/AuditSupport.lean
new file mode 100644
index 000000000..f27c6ff67
--- /dev/null
+++ b/Ix/Certified/AuditSupport.lean
@@ -0,0 +1,162 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean
+
+/-! Checked declaration traversal for the certified host adapters. Runtime
+workers and foreign interfaces are inventoried separately from proof axioms. -/
+
+open Lean Lean.Elab Command
+
+namespace Ix.Certified.AuditSupport
+
+private def constants (info : ConstantInfo) : Array Name :=
+  info.type.getUsedConstants ++ match info with
+  | .thmInfo value => value.value.getUsedConstants
+  | .defnInfo value => value.value.getUsedConstants
+  | .opaqueInfo value => value.value.getUsedConstants
+  | .inductInfo value => value.ctors.toArray
+  | _ => #[]
+
+private partial def closure (env : Environment) (runtime : Bool) (pending : List Name)
+    (seen : NameSet := {}) : NameSet :=
+  match pending with
+  | [] => seen
+  | name :: rest =>
+    if seen.contains name then closure env runtime rest seen
+    else match env.checked.get.find? name with
+    | none => closure env runtime rest (seen.insert name)
+    | some info =>
+      let extras := if runtime then Id.run do
+        let mut names := #[]
+        let worker := Lean.Compiler.mkUnsafeRecName name
+        if (env.checked.get.find? worker).isSome then names := names.push worker
+        if let some other := Lean.Compiler.getImplementedBy? env name then
+          names := names.push other
+        if let some other := (Lean.Compiler.CSimp.ext.getState env).map.find? name then
+          names := names.push other.toDeclName
+        return names
+      else #[]
+      closure env runtime ((constants info ++ extras).toList ++ rest) (seen.insert name)
+
+private def projectConstant (env : Environment) (name : Name) : Bool :=
+  match env.getModuleIdxFor? name with
+  | none => false
+  | some idx =>
+    let moduleName := env.allImportedModuleNames[idx.toNat]!
+    (`Ix).isPrefixOf moduleName || (`Blake3).isPrefixOf moduleName
+
+/-- Include constructor types and full checked bodies instead of relying on
+imported axiom summaries. Both added and removed assumptions require review. -/
+def checkAxioms (env : Environment) (root : Name) (expected : Array Name) :
+    CommandElabM (Array Name) := do
+  let mut actual := #[]
+  for name in closure env false [root] do
+    let some info := env.checked.get.find? name
+      | throwError "certified adapter has an unavailable checked dependency: {name}"
+    if info.isAxiom then actual := actual.push name
+  let sorted := actual.qsort Name.lt
+  unless sorted == expected.qsort Name.lt do
+    throwError "certified axiom boundary changed for {root}: expected {expected.qsort Name.lt}, actual {sorted}"
+  return sorted
+
+private def expectedAxioms (root : Name) : Array Name :=
+  if #[`Ix.Certified.readLevel_value, `Ix.Certified.treeLeaves_join].contains root then
+    #[``propext]
+  else if #[`Ix.Certified.readSignature?, `Ix.Certified.constantBytes?,
+      `Ix.Certified.resolveReference_iff, `Ix.Certified.readExpr_sound,
+      `Ix.Certified.ExprReading.unique, `Ix.Certified.readExpr_fuel_independent,
+      `Ix.Certified.readBlock_sourceHeader, `Ix.Certified.readStore_sourceHeader,
+      `Ix.Certified.readSignature_sound, `Ix.Theory.Certificate.Modeled.witness?,
+      `Ix.Theory.Certificate.sourceGroup?, `Ix.Theory.Certificate.proofWitness?,
+      `Ix.Certified.modelCandidate?, `Ix.Certified.modelCandidates?].contains root then
+    #[``propext, ``Quot.sound]
+  else #[``propext, ``Classical.choice, ``Quot.sound]
+
+def distinct (names : Array Name) : Array Name :=
+  names.foldl (fun result name => if result.contains name then result else result.push name) #[]
+
+/-- Freeze theorem types, premise definitions, and transitive execution
+dependencies. This does not establish correctness of native execution. -/
+def report (label : String) (roots premises : Array Name) : CommandElabM Unit := do
+  let env ← getEnv
+  for root in roots do
+    let some info := env.checked.get.find? root
+      | throwError "certified audit: missing root {root}"
+    let axioms ← checkAxioms env root (expectedAxioms root)
+    liftTermElabM do logInfo m!"ROOT {root}\n{← Meta.ppExpr info.type}\nAXIOMS {axioms}"
+  for name in premises do
+    let some info := env.checked.get.find? name
+      | throwError "certified audit: missing premise {name}"
+    liftTermElabM do
+      logInfo m!"PREMISE {name}\n{← Meta.ppExpr info.type}"
+      if let .defnInfo value := info then logInfo m!"DEFINITION\n{← Meta.ppExpr value.value}"
+  let logical := closure env false roots.toList
+  let reachable := (closure env true roots.toList).toList.mergeSort (fun a b => a.toString < b.toString)
+  let mut workers : Array Name := #[]
+  let mut externs : Array Name := #[]
+  let mut replacements : Array (Name × Name) := #[]
+  for name in reachable do
+    let some info := env.checked.get.find? name
+      | throwError "certified adapter has an unavailable checked runtime dependency: {name}"
+    if projectConstant env name then
+      if let some parent := Lean.Compiler.isUnsafeRecName? name then
+        match env.checked.get.find? parent with
+        | some (.defnInfo original) =>
+          unless original.safety == .safe do
+            throwError "certified recursion worker source is not safe: {name}"
+        | _ => throwError "certified recursion worker has no safe source definition: {name}"
+        workers := workers.push name
+      if Lean.isExtern env name then externs := externs.push name
+      if let some other := Lean.Compiler.getImplementedBy? env name then
+        replacements := replacements.push (name, other)
+      if let some other := (Lean.Compiler.CSimp.ext.getState env).map.find? name then
+        replacements := replacements.push (name, other.toDeclName)
+      if let .defnInfo definition := info then
+        unless definition.safety == .safe || (Lean.Compiler.isUnsafeRecName? name).isSome do
+          throwError "certified adapter has an unreviewed unsafe runtime: {name}"
+      if let .opaqueInfo definition := info then
+        if definition.isUnsafe then throwError "certified adapter has an unsafe opaque runtime: {name}"
+      if Lean.Elab.ComputedFields.computedFieldAttr.hasTag env name then
+        throwError "certified adapter has an unreviewed computed field: {name}"
+  unless externs == #[`Blake3.Rust.hasherFinalize, `Blake3.Rust.hasherInit,
+      `Blake3.Rust.hasherInitDeriveKey, `Blake3.Rust.hasherInitKeyed,
+      `Blake3.Rust.hasherUpdate] do
+    throwError "certified runtime extern inventory changed: {externs}"
+  unless replacements.isEmpty do
+    throwError "certified runtime replacements changed: {replacements}"
+  for name in externs do
+    let some info := env.checked.get.find? name
+      | throwError "certified runtime extern is missing: {name}"
+    liftTermElabM do logInfo m!"RUNTIME EXTERN {name}\n{← Meta.ppExpr info.type}"
+  for name in workers.qsort Name.lt do
+    let some (.defnInfo value) := env.checked.get.find? name
+      | throwError "certified recursion worker is missing: {name}"
+    liftTermElabM do
+      logInfo m!"RECURSION WORKER {name}\n{← Meta.ppExpr value.type}\nIMPLEMENTATION\n{← Meta.ppExpr value.value}"
+  logInfo m!"{label} ROOTS {roots.size}; LOGICAL DECLARATIONS {logical.size}; WITH RUNTIME {reachable.length}"
+  logInfo m!"RUNTIME EXTERNS {externs}\nRECURSION WORKERS {workers.size}"
+  logInfo "All inventoried recursion workers have safe logical sources; no partial opaque source or executable replacement is permitted. Runtime diagnostics cover Ix and Blake3 modules, including private constants. Lean/Std execution and the BLAKE3 foreign interface remain external runtime boundaries."
+  logInfo "These host-adapter roots establish semantic claims under the enforced profile and explicit model premises. They do not establish full production-checker refinement or Aiur compiler/AIR soundness."
+
+private inductive ConstructorAuditFixture where
+  | plain
+  | withProof (proof : propext (Iff.refl True) = rfl)
+
+run_cmd do
+  let _ ← checkAxioms (← getEnv) ``ConstructorAuditFixture.plain #[``propext]
+  let _ ← checkAxioms (← getEnv) ``Eq.refl #[]
+
+/-- error: certified axiom boundary changed for Eq.refl: expected [propext], actual [] -/
+#guard_msgs in
+run_cmd do
+  let _ ← checkAxioms (← getEnv) ``Eq.refl #[``propext]
+
+/-- error: certified axiom boundary changed for propext: expected [], actual [propext] -/
+#guard_msgs in
+run_cmd do
+  let _ ← checkAxioms (← getEnv) ``propext #[]
+
+end Ix.Certified.AuditSupport
diff --git a/Ix/Certified/Bytes.lean b/Ix/Certified/Bytes.lean
new file mode 100644
index 000000000..01107d4e7
--- /dev/null
+++ b/Ix/Certified/Bytes.lean
@@ -0,0 +1,151 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Ixon
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified
+open Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+/-- These external constant addresses are part of the selected public profile,
+not fields supplied by an annotation or typing witness. -/
+structure Profile where
+  falseType : Address
+  falseElim : Address
+  natType : Option Address := none
+  deriving DecidableEq
+
+abbrev ConstantBlobs := List (Address × ByteArray)
+
+abbrev DecodedObject (address : Address) (bytes : ByteArray) :=
+  { value : Ixon.Constant //
+    address.hash.size = 32 ∧ Address.blake3 bytes = address ∧
+    Ixon.runGetExact Ixon.getConstant bytes = .ok value ∧ Ixon.serConstant value = bytes }
+
+/-- Check canonical re-encoding after a single parse. Keeping the parser's
+result as a separate argument makes the cache reflection equation explicit. -/
+def canonicalObject? (address : Address) (bytes : ByteArray)
+    (auth : address.hash.size = 32 ∧ Address.blake3 bytes = address)
+    (result : Except String Ixon.Constant)
+    (parsed : Ixon.runGetExact Ixon.getConstant bytes = result) : Option (DecodedObject address bytes) :=
+  match result, parsed with
+  | .error _, _ => none
+  | .ok source, hp =>
+    if hc : Ixon.serConstant source = bytes then some ⟨source, auth.1, auth.2, hp, hc⟩ else none
+
+/-- The accepted byte domain consists of complete canonical Ixon constants.
+The returned proof records authentication, exact consumption, and re-encoding
+of the same bytes. It grants no typing or semantic acceptance by itself. -/
+def decodeObject? (address : Address) (bytes : ByteArray) : Option (DecodedObject address bytes) :=
+  if h : address.hash.size = 32 ∧ Address.blake3 bytes = address then
+    canonicalObject? address bytes h (Ixon.runGetExact Ixon.getConstant bytes) rfl
+  else none
+
+def decodeObjects? (blobs : ConstantBlobs) : Option Objects :=
+  blobs.mapM fun (address, bytes) => do
+    let source ← decodeObject? address bytes
+    return (address, source.val)
+
+/-- Natural blobs use Ix's unsigned little-endian encoding, with authentication
+and canonical re-encoding checked before any literal is read. -/
+def decodeNatural? (address : Address) (bytes : ByteArray) :
+    Option { value : Nat //
+      address.hash.size = 32 ∧ Address.blake3 bytes = address ∧
+      Nat.fromBytesLE bytes.data = value ∧ ByteArray.mk value.toBytesLE = bytes } :=
+  if h : address.hash.size = 32 ∧ Address.blake3 bytes = address then
+    let value := Nat.fromBytesLE bytes.data
+    if hc : ByteArray.mk value.toBytesLE = bytes then some ⟨value, h.1, h.2, rfl, hc⟩ else none
+  else none
+
+def decodeNaturals? (blobs : ConstantBlobs) : Option Naturals :=
+  blobs.mapM fun (address, bytes) => do
+    let value ← decodeNatural? address bytes
+    return (address, value.val)
+
+def readSignature? (profile : Profile) (objects : Objects) :
+    Option (PrimitiveSignature Address) := do
+  let falseType ← resolveReference? objects profile.falseType
+  let falseElim ← resolveReference? objects profile.falseElim
+  let natType ← match profile.natType with
+    | none => some none
+    | some address => (resolveReference? objects address).map some
+  if h : falseType ≠ falseElim then
+    return ⟨falseType, falseElim, h, natType⟩
+  else none
+
+structure PreparedInput where
+  signature : PrimitiveSignature Address
+  input : ProofInput Address
+
+def prepare? (fuel : Nat) (profile : Profile) (target : Address) (blobs : ConstantBlobs)
+    (literalBlobs : ConstantBlobs := []) : Option PreparedInput := do
+  if !((blobs ++ literalBlobs).map Prod.fst).Nodup then none else do
+  let naturals ← decodeNaturals? literalBlobs
+  let objects ← decodeObjects? blobs
+  let signature ← readSignature? profile objects
+  let input ← readProofInput? fuel objects target naturals
+  return ⟨signature, input⟩
+
+/-- The actual serialized-input gate invokes the mathematical validator after
+authentication and decoding. The byte/statement preservation and compiled
+execution theorems remain separate obligations. -/
+def acceptsSerialized (fuel : Nat) (profile : Profile) (target : Address)
+    (blobs : ConstantBlobs) (witness : ProofWitness Address)
+    (literalBlobs : ConstantBlobs := []) : Bool :=
+  match prepare? fuel profile target blobs literalBlobs with
+  | none => false
+  | some prepared =>
+    acceptsCertified.{0,v} fuel prepared.signature prepared.input witness
+
+theorem acceptsSerialized_prepared {fuel : Nat} {profile : Profile} {target : Address}
+    {blobs literalBlobs : ConstantBlobs} {witness : ProofWitness Address}
+    (h : acceptsSerialized.{v} fuel profile target blobs witness literalBlobs = true) :
+    ∃ prepared, prepare? fuel profile target blobs literalBlobs = some prepared ∧
+      acceptsCertified.{0,v} fuel prepared.signature prepared.input witness = true := by
+  unfold acceptsSerialized at h
+  cases hp : prepare? fuel profile target blobs literalBlobs with
+  | none => simp [hp] at h
+  | some prepared => exact ⟨prepared, rfl, by simpa only [hp] using h⟩
+
+/-- A successful serialized host check constructs the model of its decoded
+input. Relating that input to a public cryptographic proposition is C6/C8. -/
+theorem accepted_serialized_has_model {fuel : Nat} {profile : Profile} {target : Address}
+    {blobs literalBlobs : ConstantBlobs} {witness : ProofWitness Address}
+    (h : acceptsSerialized.{v} fuel profile target blobs witness literalBlobs = true)
+    (V : Type v) [SetTheory V] (levels : List Nat) (env : Nat → V) :
+    ∃ prepared, prepare? fuel profile target blobs literalBlobs = some prepared ∧
+      ∃ result : CheckedProof.{0,v} prepared.signature prepared.input,
+        checkProofCertified fuel prepared.signature prepared.input witness = some result ∧
+        ∃ constants : Assignment Address V,
+          prepared.signature.Compatible result.environment.entries constants ∧
+          WellDenoted constants levels env result.proof.val ∧
+          WellDenoted constants levels env result.proposition.val ∧
+          interp constants levels env result.proof.val ∈ˢ
+            interp constants levels env result.proposition.val := by
+  obtain ⟨prepared, hp, ha⟩ := acceptsSerialized_prepared h
+  exact ⟨prepared, hp, accepted_has_model ha V levels env⟩
+
+/-- This checks the decoded target statement against the profile's exact
+empty proposition. It performs no theorem or semantic witness search. -/
+def isFalseStatement (fuel : Nat) (profile : Profile) (target : Address)
+    (blobs : ConstantBlobs) (literalBlobs : ConstantBlobs := []) : Bool :=
+  match prepare? fuel profile target blobs literalBlobs with
+  | none => false
+  | some prepared => decide (prepared.input.proposition = prepared.signature.falseExpr)
+
+theorem no_serialized_proof_of_False {fuel : Nat} {profile : Profile} {target : Address}
+    {blobs literalBlobs : ConstantBlobs} {witness : ProofWitness Address}
+    (V : Type v) [SetTheory V]
+    (hf : isFalseStatement fuel profile target blobs literalBlobs = true)
+    (h : acceptsSerialized.{v} fuel profile target blobs witness literalBlobs = true) : False := by
+  obtain ⟨prepared, hp, ha⟩ := acceptsSerialized_prepared h
+  have he : prepared.input.proposition = prepared.signature.falseExpr := by
+    simpa only [isFalseStatement, hp, decide_eq_true_eq] using hf
+  exact no_proof_of_False V he ha
+
+end Ix.Certified
diff --git a/Ix/Certified/ClaimAccept.lean b/Ix/Certified/ClaimAccept.lean
new file mode 100644
index 000000000..7e5203f5d
--- /dev/null
+++ b/Ix/Certified/ClaimAccept.lean
@@ -0,0 +1,164 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Reveal
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+def LogicalKind : Ix.Claim → Prop
+  | .check .. | .checkEnv .. | .catalog .. => True
+  | _ => False
+
+theorem LogicalReceipt.kind (receipt : LogicalReceipt.{v} source fuel envelope witness) :
+    LogicalKind envelope.claim := by
+  have h := receipt.checked.content.meaning
+  cases hc : envelope.claim <;> simp_all [LogicalKind]
+
+/-- Meaning of the exact source declarations selected by the public claim.
+The annotated readings remain tied to their original type fields and tables. -/
+def SubjectsInterpreted (receipt : LogicalReceipt.{v} source fuel envelope witness)
+    (V : Type v) [SetTheory V] (constants : Assignment Address V) : Prop :=
+  ∀ ref ∈ receipt.checked.subjects, ∃ entry,
+    SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+    ∀ levels, levels.length = entry.universes → ∀ env,
+      WellDenoted constants levels env entry.type ∧
+      constants ref levels ∈ˢ interp constants levels env entry.type
+
+def LogicalMeaning (source : Ixon.Env) (fuel : Nat) (envelope : Envelope) : Prop :=
+  ∃ witness : LogicalWitness, ∃ receipt : LogicalReceipt.{v} source fuel envelope witness,
+    SignatureReading envelope.profile receipt.snapshot.decodedObjects receipt.checked.signature ∧
+    (∀ ref ∈ receipt.checked.frontierRefs, ∃ entry,
+      receipt.checked.batch.receipt.frontier.interface.entries ref = some entry ∧
+      SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry) ∧
+    (∀ ref ∈ receipt.checked.axiomRefs, ∃ entry,
+      Standard.EntrySource receipt.checked.store ref entry ∨ Quotient.EntrySource receipt.checked.store ref entry) ∧
+    (∀ (V : Type v) [SetTheory V] (constants : Assignment Address V),
+      receipt.checked.signature.Compatible receipt.checked.batch.receipt.frontier.interface.entries constants →
+      ∃ constants' : Assignment Address V,
+        receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants' ∧
+        Assignment.AgreesOn receipt.checked.batch.receipt.frontier.interface.entries constants constants' ∧
+        SubjectsInterpreted receipt V constants') ∧
+    (claimFrontier envelope.claim = none → ∀ (V : Type v) [SetTheory V],
+      ∃ constants : Assignment Address V,
+        receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants ∧
+        SubjectsInterpreted receipt V constants)
+
+theorem LogicalReceipt.meaning (receipt : LogicalReceipt.{v} source fuel envelope witness) :
+    LogicalMeaning.{v} source fuel envelope :=
+  ⟨witness, receipt, readSignature_sound receipt.checked.signatureReading,
+    fun _ h => receipt.checked.original_frontier h,
+    fun _ h => receipt.checked.logical_policy h,
+    fun V _ constants hM => receipt.subject_meaning V constants hM,
+    fun closed V _ => receipt.closed_subject_meaning closed V⟩
+
+/-- One contract for the versioned claim protocol. Structural membership and
+revelation remain structural. Evaluation is excluded until a separate
+execution/result interpretation has been proved and bound to the profile. -/
+def SemanticClaimMeaning (source : Ixon.Env) (fuel : Nat) (envelope : Envelope) : Prop :=
+  envelope.protocol = Protocol.current ∧
+    match envelope.claim with
+    | .check .. | .checkEnv .. | .catalog .. => LogicalMeaning.{v} source fuel envelope
+    | .contains root target => envelope.logicalAxioms = none ∧ TreeMembership root target
+    | .reveal commitment info => envelope.logicalAxioms = none ∧ RevealMeaning source commitment info
+    | .eval .. => False
+
+inductive ClaimWitness where
+  | logical (witness : LogicalWitness)
+  | contains (tree : ByteArray)
+  | reveal (witness : RevealWitness)
+
+inductive ClaimAction (source : Ixon.Env) (fuel : Nat) (envelope : Envelope) where
+  | logical {witness : LogicalWitness} (receipt : LogicalReceipt.{v} source fuel envelope witness)
+  | contains {root target : Address} {bytes : ByteArray}
+      (claim : envelope.claim = .contains root target)
+      (noAxioms : envelope.logicalAxioms = none) (opening : TreeOpening fuel root bytes)
+      (member : target ∈ treeLeaves opening.tree)
+  | reveal {commitment : Address} {info : Ix.RevealConstantInfo} {witness : RevealWitness}
+      (claim : envelope.claim = .reveal commitment info)
+      (noAxioms : envelope.logicalAxioms = none) (receipt : RevealReceipt source commitment info witness)
+
+structure ClaimReceipt (source : Ixon.Env) (fuel : Nat) (address : Address) (bytes : ByteArray) where
+  reading : EnvelopeReading address bytes
+  action : ClaimAction.{v} source fuel reading.envelope
+
+def checkClaimAction? (fuel : Nat) (source : Ixon.Env) (envelope : Envelope) (witness : ClaimWitness) :
+    Read source (ClaimAction.{v} source fuel envelope) :=
+  match hc : envelope.claim, witness with
+  | .check .., .logical witness | .checkEnv .., .logical witness | .catalog .., .logical witness => do
+    let receipt ← checkLogicalSource?.{v} fuel source envelope witness
+    return .logical receipt
+  | .contains root target, .contains bytes =>
+    if ha : envelope.logicalAxioms = none then
+      match readTree? fuel root bytes with
+      | none => failure
+      | some opening =>
+        if hm : (treeLeaves opening.tree).contains target = true then
+          pure (.contains hc ha opening (List.contains_iff_mem.mp hm)) else failure
+    else failure
+  | .reveal commitment info, .reveal witness =>
+    if ha : envelope.logicalAxioms = none then do
+      let receipt ← checkReveal? source commitment info witness
+      return .reveal hc ha receipt
+    else failure
+  | _, _ => failure
+
+/-- Public source acceptance starts with exact authenticated claim bytes.
+Protocol and policy versions are checked before any dispatcher branch. -/
+def checkClaimBytes? (fuel : Nat) (source : Ixon.Env) (address : Address) (bytes : ByteArray)
+    (witness : ClaimWitness) : Read source (ClaimReceipt.{v} source fuel address bytes) :=
+  match readEnvelope? fuel address bytes with
+  | none => failure
+  | some reading => do
+    let action ← checkClaimAction?.{v} fuel source reading.envelope witness
+    return ⟨reading, action⟩
+
+def acceptsClaimBytes (fuel : Nat) (source : Ixon.Env) (address : Address) (bytes : ByteArray)
+    (witness : ClaimWitness) : Bool :=
+  (checkClaimBytes?.{v} fuel source address bytes witness {}).isSome
+
+theorem ClaimReceipt.meaning (receipt : ClaimReceipt.{v} source fuel address bytes) :
+    SemanticClaimMeaning.{v} source fuel receipt.reading.envelope := by
+  refine ⟨receipt.reading.supported, ?_⟩
+  cases receipt.action with
+  | logical logical =>
+    have kind := logical.kind
+    have meaning := logical.meaning
+    cases hc : receipt.reading.envelope.claim <;> simp_all [LogicalKind]
+  | contains claim noAxioms opening member =>
+    rw [claim]
+    exact ⟨noAxioms, opening.membership member⟩
+  | reveal claim noAxioms revealed =>
+    rw [claim]
+    exact ⟨noAxioms, revealed.meaning⟩
+
+/-- Successful source checking yields the meaning of the exact authenticated
+public envelope, including profile, statement, frontier and logical-use root. -/
+theorem accepted_claim_meaning {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray}
+    {witness : ClaimWitness} (h : acceptsClaimBytes.{v} fuel source address bytes witness = true) :
+    ∃ receipt : ClaimReceipt.{v} source fuel address bytes, ∃ cache,
+      checkClaimBytes? fuel source address bytes witness {} = some (receipt, cache) ∧
+      Address.blake3 bytes = address ∧ envelopeBytes receipt.reading.envelope = bytes ∧
+      SemanticClaimMeaning.{v} source fuel receipt.reading.envelope := by
+  unfold acceptsClaimBytes at h
+  obtain ⟨⟨receipt, cache⟩, hc⟩ := Option.isSome_iff_exists.mp h
+  exact ⟨receipt, cache, hc, receipt.reading.authenticated, receipt.reading.canonical, receipt.meaning⟩
+
+theorem evaluation_not_semantic {source : Ixon.Env} {fuel : Nat} {envelope : Envelope}
+    {input output : Address} {frontier : Option Address}
+    (h : envelope.claim = .eval input output frontier) : ¬ SemanticClaimMeaning.{v} source fuel envelope := by
+  simp [SemanticClaimMeaning, h]
+
+theorem membership_not_leaf {fuel : Nat} {root target : Address} {bytes : Option ByteArray} :
+    readSubjectView? fuel (.contains root target) bytes = none := by cases bytes <;> rfl
+
+theorem revelation_not_leaf {fuel : Nat} {commitment : Address} {info : Ix.RevealConstantInfo}
+    {bytes : Option ByteArray} : readSubjectView? fuel (.reveal commitment info) bytes = none := by
+  cases bytes <;> rfl
+
+end Ix.Certified
diff --git a/Ix/Certified/ClaimAudit.lean b/Ix/Certified/ClaimAudit.lean
new file mode 100644
index 000000000..23b9676b7
--- /dev/null
+++ b/Ix/Certified/ClaimAudit.lean
@@ -0,0 +1,49 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.AuditSupport
+import Ix.Certified.ClaimCommand
+
+/-! Trust, runtime and premise inventory of the versioned semantic claim
+checker, source command and actual TcM acceptance boundary. -/
+
+open Lean Lean.Elab Command
+
+namespace Ix.Certified.ClaimAudit
+
+def roots : Array Lean.Name := #[
+  `Ix.Certified.TreeOpening.membership, `Ix.Certified.TreeOpening.unique,
+  `Ix.Certified.treeLeaves_join, `Ix.Certified.EnvelopeReading.unique,
+  `Ix.Certified.readEnvelope?, `Ix.Certified.readTree?,
+  `Ix.Certified.LogicalChecking.original_subject, `Ix.Certified.LogicalChecking.original_frontier,
+  `Ix.Certified.LogicalChecking.logical_policy, `Ix.Certified.LogicalChecking.closed_frontier,
+  `Ix.Certified.LogicalReceipt.subject_meaning, `Ix.Certified.LogicalReceipt.closed_subject_meaning,
+  `Ix.Certified.LogicalReceipt.no_False,
+  `Ix.Certified.RevealReceipt.meaning, `Ix.Certified.ClaimReceipt.meaning,
+  `Ix.Certified.accepted_claim_meaning, `Ix.Certified.evaluation_not_semantic,
+  `Ix.Certified.membership_not_leaf, `Ix.Certified.revelation_not_leaf,
+  `Ix.Kernel.TcM.checkClaimCertified_success,
+  `Ix.Kernel.certifiedClaimStep_failure, `Ix.Kernel.certifiedClaimStep_success,
+  `Ix.Kernel.accepted_tc_claim_meaning,
+  `Ix.Certified.ClaimCommand.readRequest,
+  `Ix.Certified.ClaimCommand.run_success, `Ix.Certified.ClaimCommand.run_meaning]
+
+def premises : Array Lean.Name := #[
+  `Ix.Certified.Protocol.current, `Ix.Certified.envelopeMagic,
+  `Ix.Certified.putEnvelope, `Ix.Certified.getEnvelope,
+  `Ix.Certified.EnvelopeReading.mk, `Ix.Certified.TreeOpening.mk,
+  `Ix.Certified.OptionalTreeOpening.mk, `Ix.Certified.SubjectView.mk,
+  `Ix.Certified.PreparedLeaf.mk, `Ix.Certified.ContentView.mk,
+  `Ix.Certified.ownedReferences, `Ix.Certified.claimFrontier,
+  `Ix.Certified.LogicalChecking.mk, `Ix.Certified.LogicalReceipt.mk,
+  `Ix.Certified.SubjectsInterpreted, `Ix.Certified.LogicalMeaning,
+  `Ix.Certified.RevealMatches, `Ix.Certified.ConstructorMatches,
+  `Ix.Certified.ConstructorsMatch, `Ix.Certified.MutMatches,
+  `Ix.Certified.ComponentsMatch, `Ix.Certified.RulesMatch,
+  `Ix.Certified.RevealMeaning, `Ix.Certified.SemanticClaimMeaning]
+
+run_cmd AuditSupport.report "claim meaning" roots premises
+
+end Ix.Certified.ClaimAudit
diff --git a/Ix/Certified/ClaimCheck.lean b/Ix/Certified/ClaimCheck.lean
new file mode 100644
index 000000000..7a8b8cb43
--- /dev/null
+++ b/Ix/Certified/ClaimCheck.lean
@@ -0,0 +1,104 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.ClaimInput
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+structure LogicalWitness where
+  selection : InputSelection
+  leaves : List LeafWitness
+  subjects : Option ByteArray
+  members : Option ByteArray
+  frontierTree : Option ByteArray
+  frontier : List (FrontierWitness Address)
+  axiomTree : Option ByteArray
+
+structure LogicalChecking {source : Ixon.Env} (snapshot : SourceSnapshot source)
+    (fuel : Nat) (envelope : Envelope) (witness : LogicalWitness) where
+  uniqueSource : ((snapshot.blobs ++ snapshot.literalBlobs).map Prod.fst).Nodup
+  signature : PrimitiveSignature Address
+  signatureReading : readSignature? envelope.profile snapshot.decodedObjects = some signature
+  store : Store Address
+  storeReading : readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals = some store
+  leaves : List (LeafInput fuel snapshot.decodedObjects)
+  leavesReading : witness.leaves.mapM (readLeafInput? fuel snapshot.decodedObjects) = some leaves
+  content : ContentView fuel envelope.claim witness.subjects witness.members leaves
+  subjects : List (ConstRef Address)
+  subjectsReading : content.addresses.flatMapM (subjectReferences? snapshot.decodedObjects) = some subjects
+  frontier : OptionalTreeOpening fuel (claimFrontier envelope.claim) witness.frontierTree
+  frontierRefs : List (ConstRef Address)
+  frontierReading : frontier.leaves.flatMapM (subjectReferences? snapshot.decodedObjects) = some frontierRefs
+  batch : CheckedBatch.{0,v} fuel signature store (leaves.map (fun leaf => leaf.prepared.node signature))
+  batchChecking : checkBatch? fuel signature store witness.frontier
+    (leaves.map (fun leaf => leaf.prepared.node signature)) = some batch
+  exactSubjects : ∀ ref, ref ∈ nodeSubjects batch.nodes ↔ ref ∈ ownedReferences signature subjects
+  exactFrontier : ∀ ref, ref ∈ batch.receipt.frontier.refs ↔ ref ∈ frontierRefs
+  axioms : OptionalTreeOpening fuel envelope.logicalAxioms witness.axiomTree
+  axiomRefs : List (ConstRef Address)
+  axiomsReading : axioms.leaves.flatMapM (subjectReferences? snapshot.decodedObjects) = some axiomRefs
+  exactAxioms : ∀ ref, ref ∈ batch.logicalUses ↔ ref ∈ axiomRefs
+
+def checkLogicalSnapshot? {source : Ixon.Env} (snapshot : SourceSnapshot source)
+    (fuel : Nat) (envelope : Envelope) (witness : LogicalWitness) :
+    Option (LogicalChecking.{v} snapshot fuel envelope witness) :=
+  if hu : ((snapshot.blobs ++ snapshot.literalBlobs).map Prod.fst).Nodup then
+    match hs : readSignature? envelope.profile snapshot.decodedObjects with
+    | none => none
+    | some signature =>
+      match ht : readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals with
+      | none => none
+      | some store =>
+        match hl : witness.leaves.mapM (readLeafInput? fuel snapshot.decodedObjects) with
+        | none => none
+        | some leaves => do
+          let content ← readContentView? fuel envelope.claim witness.subjects witness.members leaves
+          match htargets : content.addresses.flatMapM (subjectReferences? snapshot.decodedObjects) with
+          | none => none
+          | some subjects => do
+            let frontier ← readOptionalTree? fuel (claimFrontier envelope.claim) witness.frontierTree
+            match hfrontier : frontier.leaves.flatMapM (subjectReferences? snapshot.decodedObjects) with
+            | none => none
+            | some frontierRefs =>
+              match hc : checkBatch?.{0,v} fuel signature store witness.frontier
+                  (leaves.map (fun leaf => leaf.prepared.node signature)) with
+              | none => none
+              | some batch =>
+                if hsubjects : sameMembers (nodeSubjects batch.nodes) (ownedReferences signature subjects) = true then
+                  if hf : sameMembers batch.receipt.frontier.refs frontierRefs = true then do
+                    let axioms ← readOptionalTree? fuel envelope.logicalAxioms witness.axiomTree
+                    match haxioms : axioms.leaves.flatMapM (subjectReferences? snapshot.decodedObjects) with
+                    | none => none
+                    | some axiomRefs =>
+                      if ha : sameMembers batch.logicalUses axiomRefs = true then
+                        some ⟨hu, signature, hs, store, ht, leaves, hl, content, subjects, htargets,
+                          frontier, frontierRefs, hfrontier, batch, hc, sameMembers_iff.mp hsubjects,
+                          sameMembers_iff.mp hf, axioms, axiomRefs, haxioms, sameMembers_iff.mp ha⟩
+                      else none
+                  else none
+                else none
+  else none
+
+structure LogicalReceipt (source : Ixon.Env) (fuel : Nat) (envelope : Envelope) (witness : LogicalWitness) where
+  snapshot : SourceSnapshot source
+  checked : LogicalChecking.{v} snapshot fuel envelope witness
+  supported : envelope.protocol = Protocol.current
+
+/-- Every cache hit revalidates the actual complete claim. Only authenticated
+data is reused; claim, policy, frontier and model checks run on every request. -/
+def checkLogicalSource? (fuel : Nat) (source : Ixon.Env) (envelope : Envelope) (witness : LogicalWitness) :
+    Read source (LogicalReceipt.{v} source fuel envelope witness) :=
+  if hp : envelope.protocol = Protocol.current then do
+    let snapshot ← readSnapshot? fuel source witness.selection
+    match checkLogicalSnapshot?.{v} snapshot fuel envelope witness with
+    | none => failure
+    | some checked => return ⟨snapshot, checked, hp⟩
+  else failure
+
+end Ix.Certified
diff --git a/Ix/Certified/ClaimCommand.lean b/Ix/Certified/ClaimCommand.lean
new file mode 100644
index 000000000..659c87de0
--- /dev/null
+++ b/Ix/Certified/ClaimCommand.lean
@@ -0,0 +1,117 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.ClaimSuggest
+import Ix.Kernel.CertifiedClaims
+
+/-! Generic command for the versioned public claim protocol. Public bytes
+and their expected address are inputs; JSON supplies only untrusted search
+hints. Each successful command ends in the certified TcM claim checker. -/
+
+namespace Ix.Certified.ClaimCommand
+
+universe v
+
+inductive Hint where
+  | logical (hint : LogicalHint)
+  | contains (tree : ByteArray)
+  | reveal (witness : RevealWitness)
+
+structure Request where
+  address : Address
+  hint : Hint
+
+def readAddress (value : String) : Except String Address :=
+  match Address.fromString value with
+  | none => .error "expected a 32-byte hexadecimal address"
+  | some address => .ok address
+
+def readHex (value : String) : Except String ByteArray :=
+  match bytesOfHex value with
+  | none => .error "expected an even-length hexadecimal byte string"
+  | some bytes => .ok bytes
+
+def readOptionalHex (json : Lean.Json) (field : String) : Except String (Option ByteArray) := do
+  (← json.getObjValAs? (Option String) field).mapM readHex
+
+def readLeaf (json : Lean.Json) : Except String LeafHint := do
+  let bytes ← readHex (← json.getObjValAs? String "claim")
+  let claim ← Ixon.runGetExact Ix.Claim.get bytes
+  if Ix.Claim.ser claim != bytes then throw "noncanonical leaf claim bytes"
+  return ⟨claim, ← readOptionalHex json "subjects", ← readOptionalHex json "frontier"⟩
+
+def readLogicalHint (json : Lean.Json) : Except String LogicalHint := do
+  let objects ← (← json.getObjValAs? (List String) "objects").mapM readAddress
+  let naturals ← (← json.getObjValAs? (List String) "naturals").mapM readAddress
+  let leaves ← (← json.getObjValAs? (List Lean.Json) "leaves").mapM readLeaf
+  return ⟨⟨objects, naturals⟩, leaves, ← readOptionalHex json "subjects",
+    ← readOptionalHex json "members", ← readOptionalHex json "frontier", ← readOptionalHex json "axioms",
+    ← ModelHint.readOptional json⟩
+
+def readRequest (json : Lean.Json) : Except String Request := do
+  let address ← readAddress (← json.getObjValAs? String "address")
+  let kind ← json.getObjValAs? String "kind"
+  let hint : Hint ← if kind = "logical" then do pure (Hint.logical (← readLogicalHint json))
+    else if kind = "contains" then do pure (Hint.contains (← readHex (← json.getObjValAs? String "tree")))
+    else if kind = "reveal" then do
+      let secret ← readAddress (← json.getObjValAs? String "secret")
+      let payload ← readAddress (← json.getObjValAs? String "payload")
+      pure (Hint.reveal ⟨⟨secret, payload⟩⟩)
+    else throw "kind must be logical, contains or reveal"
+  return ⟨address, hint⟩
+
+def suggestWitness? (fuel : Nat) (source : Ixon.Env) (bytes : ByteArray) (request : Request) :
+    Option ClaimWitness := do
+  let reading ← readEnvelope? fuel request.address bytes
+  match request.hint with
+  | .logical hint => return .logical (← suggestLogical? fuel source reading.envelope hint)
+  | .contains tree => return .contains tree
+  | .reveal witness => return .reveal witness
+
+def run (fuel : Nat) (source : Ixon.Env) (bytes : ByteArray) (request : Request) : Except String Unit := do
+  let some witness := suggestWitness? fuel source bytes request
+    | throw "certified envelope or witness search declined"
+  if Kernel.acceptsCertifiedClaim.{v} fuel source request.address bytes witness then return ()
+  else throw "certified claim validation rejected the witness"
+
+theorem run_success {fuel : Nat} {source : Ixon.Env} {bytes : ByteArray} {request : Request}
+    (h : run.{v} fuel source bytes request = .ok ()) :
+    ∃ witness, Kernel.acceptsCertifiedClaim.{v} fuel source request.address bytes witness = true := by
+  cases hw : suggestWitness? fuel source bytes request with
+  | none => simp [run, hw] at h
+  | some witness =>
+    by_cases ha : Kernel.acceptsCertifiedClaim.{v} fuel source request.address bytes witness = true
+    · exact ⟨witness, ha⟩
+    · simp [run, hw, ha] at h
+
+theorem run_meaning {fuel : Nat} {source : Ixon.Env} {bytes : ByteArray} {request : Request}
+    (h : run.{v} fuel source bytes request = .ok ()) :
+    ∃ receipt : ClaimReceipt.{v} source fuel request.address bytes,
+      Address.blake3 bytes = request.address ∧ envelopeBytes receipt.reading.envelope = bytes ∧
+      SemanticClaimMeaning.{v} source fuel receipt.reading.envelope := by
+  obtain ⟨witness, hw⟩ := run_success h
+  obtain ⟨receipt, _, ha, hb, hm⟩ := Kernel.accepted_tc_claim_meaning hw
+  exact ⟨receipt, ha, hb, hm⟩
+
+def main (args : List String) : IO UInt32 := do
+  let [sourcePath, envelopePath, requestPath] := args | do
+    IO.eprintln "usage: certified-claim-check SOURCE.ixe ENVELOPE.bin REQUEST.json"
+    return 2
+  let sourceBytes ← IO.FS.readBinFile sourcePath
+  let envelope ← IO.FS.readBinFile envelopePath
+  let requestText ← IO.FS.readFile requestPath
+  let result := do
+    let request ← readRequest (← Lean.Json.parse requestText)
+    let parts ← Ixon.deEnvVerifiedLazy sourceBytes
+    run.{0} 6400 parts.env envelope request
+    return request.address
+  match result with
+  | .error error => IO.eprintln error; return 1
+  | .ok address =>
+    IO.println <| (Lean.Json.mkObj [("accepted", Lean.toJson true),
+      ("address", Lean.toJson (hexOfBytes address.hash))]).compress
+    return 0
+
+end Ix.Certified.ClaimCommand
diff --git a/Ix/Certified/ClaimInput.lean b/Ix/Certified/ClaimInput.lean
new file mode 100644
index 000000000..c5497b8a5
--- /dev/null
+++ b/Ix/Certified/ClaimInput.lean
@@ -0,0 +1,145 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Envelope
+import Ix.Theory.Certified.ClaimComposition
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model
+
+def sameMembers {α : Type _} [DecidableEq α] (a b : List α) : Bool :=
+  a.all (b.contains ·) && b.all (a.contains ·)
+
+theorem sameMembers_iff {α : Type _} [DecidableEq α] {a b : List α} :
+    sameMembers a b = true ↔ ∀ x, x ∈ a ↔ x ∈ b := by
+  simp only [sameMembers, Bool.and_eq_true, List.all_eq_true, List.contains_iff_mem]
+  exact ⟨fun h x => ⟨h.1 x, h.2 x⟩, fun h => ⟨fun x => (h x).mp, fun x => (h x).mpr⟩⟩
+
+def claimFrontier : Ix.Claim → Option Address
+  | .check _ frontier | .checkEnv _ frontier | .catalog _ _ frontier | .eval _ _ frontier => frontier
+  | _ => none
+
+structure SubjectView (fuel : Nat) (claim : Ix.Claim) (bytes : Option ByteArray) where
+  addresses : List Address
+  meaning : match claim with
+    | .check address _ => bytes = none ∧ addresses = [address]
+    | .checkEnv root _ => ∃ raw, bytes = some raw ∧
+        ∃ opening : TreeOpening fuel root raw, treeLeaves opening.tree = addresses
+    | _ => False
+
+def readSubjectView? (fuel : Nat) (claim : Ix.Claim) (bytes : Option ByteArray) :
+    Option (SubjectView fuel claim bytes) :=
+  match claim, bytes with
+  | .check address _, none => some ⟨[address], rfl, rfl⟩
+  | .checkEnv root _, some raw => do
+    let opening ← readTree? fuel root raw
+    return ⟨treeLeaves opening.tree, raw, rfl, opening, rfl⟩
+  | _, _ => none
+
+def ownedReferences (signature : PrimitiveSignature Address) (refs : List (ConstRef Address)) :
+    List (ConstRef Address) :=
+  (refs.filter fun ref => ref != signature.falseType && ref != signature.falseElim).eraseDups
+
+theorem mem_ownedReferences {signature : PrimitiveSignature Address} {refs : List (ConstRef Address)}
+    {ref : ConstRef Address} : ref ∈ ownedReferences signature refs ↔
+      ref ∈ refs ∧ ref ≠ signature.falseType ∧ ref ≠ signature.falseElim := by
+  simp [ownedReferences]
+
+structure LeafWitness where
+  claim : Ix.Claim
+  subjects : Option ByteArray
+  frontierTree : Option ByteArray
+  frontier : List (FrontierWitness Address)
+  declarations : List (DeclarationWitness Address)
+
+structure PreparedLeaf (fuel : Nat) (objects : Objects) (witness : LeafWitness) where
+  subjectView : SubjectView fuel witness.claim witness.subjects
+  subjectRefs : List (ConstRef Address)
+  subjectsResolved : subjectView.addresses.flatMapM (subjectReferences? objects) = some subjectRefs
+  frontierView : OptionalTreeOpening fuel (claimFrontier witness.claim) witness.frontierTree
+  frontierRefs : List (ConstRef Address)
+  frontierResolved : frontierView.leaves.flatMapM (subjectReferences? objects) = some frontierRefs
+  frontierExact : ∀ ref, ref ∈ witness.frontier.map (·.ref) ↔ ref ∈ frontierRefs
+
+def prepareLeaf? (fuel : Nat) (objects : Objects) (witness : LeafWitness) :
+    Option (PreparedLeaf fuel objects witness) := do
+  let subjectView ← readSubjectView? fuel witness.claim witness.subjects
+  match hs : subjectView.addresses.flatMapM (subjectReferences? objects) with
+  | none => none
+  | some subjectRefs => do
+    let frontierView ← readOptionalTree? fuel (claimFrontier witness.claim) witness.frontierTree
+    match hf : frontierView.leaves.flatMapM (subjectReferences? objects) with
+    | none => none
+    | some frontierRefs =>
+      if he : sameMembers (witness.frontier.map (·.ref)) frontierRefs = true then
+        some ⟨subjectView, subjectRefs, hs, frontierView, frontierRefs, hf, sameMembers_iff.mp he⟩
+      else none
+
+def PreparedLeaf.node {fuel : Nat} {objects : Objects} {witness : LeafWitness}
+    (leaf : PreparedLeaf fuel objects witness) (signature : PrimitiveSignature Address) : ClaimNode Address :=
+  ⟨ownedReferences signature leaf.subjectRefs, witness.frontier, witness.declarations⟩
+
+structure LeafInput (fuel : Nat) (objects : Objects) where
+  witness : LeafWitness
+  prepared : PreparedLeaf fuel objects witness
+
+def readLeafInput? (fuel : Nat) (objects : Objects) (witness : LeafWitness) :
+    Option (LeafInput fuel objects) := do
+  let prepared ← prepareLeaf? fuel objects witness
+  return ⟨witness, prepared⟩
+
+def leafAddresses {fuel : Nat} {objects : Objects} (leaves : List (LeafInput fuel objects)) : List Address :=
+  leaves.flatMap (·.prepared.subjectView.addresses)
+
+def environmentRoot? : Ix.Claim → Option Address
+  | .checkEnv root _ => some root
+  | _ => none
+
+structure ContentView (fuel : Nat) (claim : Ix.Claim) (subjects members : Option ByteArray)
+    {objects : Objects} (leaves : List (LeafInput fuel objects)) where
+  addresses : List Address
+  exactLeaves : ∀ address, address ∈ addresses ↔ address ∈ leafAddresses leaves
+  meaning : match claim with
+    | .check address _ => subjects = none ∧ members = none ∧ addresses = [address]
+    | .checkEnv root _ => members = none ∧ ∃ raw, subjects = some raw ∧
+        ∃ opening : TreeOpening fuel root raw, treeLeaves opening.tree = addresses
+    | .catalog memberRoot contentRoot _ => ∃ rawContent rawMembers,
+        subjects = some rawContent ∧ members = some rawMembers ∧
+        ∃ content : TreeOpening fuel contentRoot rawContent,
+        ∃ membership : TreeOpening fuel memberRoot rawMembers,
+          treeLeaves content.tree = addresses ∧
+          ∃ roots, leaves.mapM (fun leaf => environmentRoot? leaf.witness.claim) = some roots ∧
+            ∀ root, root ∈ treeLeaves membership.tree ↔ root ∈ roots
+    | _ => False
+
+def readContentView? (fuel : Nat) (claim : Ix.Claim) (subjects members : Option ByteArray)
+    {objects : Objects} (leaves : List (LeafInput fuel objects)) :
+    Option (ContentView fuel claim subjects members leaves) :=
+  match claim, subjects, members with
+  | .check address _, none, none =>
+    if he : sameMembers [address] (leafAddresses leaves) = true then
+      some ⟨[address], sameMembers_iff.mp he, rfl, rfl, rfl⟩
+    else none
+  | .checkEnv root _, some raw, none => do
+    let opening ← readTree? fuel root raw
+    if he : sameMembers (treeLeaves opening.tree) (leafAddresses leaves) = true then
+      some ⟨treeLeaves opening.tree, sameMembers_iff.mp he, rfl, raw, rfl, opening, rfl⟩
+    else none
+  | .catalog memberRoot contentRoot _, some rawContent, some rawMembers => do
+    let content ← readTree? fuel contentRoot rawContent
+    let membership ← readTree? fuel memberRoot rawMembers
+    match hr : leaves.mapM (fun leaf => environmentRoot? leaf.witness.claim) with
+    | none => none
+    | some roots =>
+      if he : sameMembers (treeLeaves content.tree) (leafAddresses leaves) = true then
+        if hm : sameMembers (treeLeaves membership.tree) roots = true then
+          some ⟨treeLeaves content.tree, sameMembers_iff.mp he, rawContent, rawMembers, rfl, rfl,
+            content, membership, rfl, roots, hr, sameMembers_iff.mp hm⟩
+        else none
+      else none
+  | _, _, _ => none
+
+end Ix.Certified
diff --git a/Ix/Certified/ClaimMain.lean b/Ix/Certified/ClaimMain.lean
new file mode 100644
index 000000000..2028b1f52
--- /dev/null
+++ b/Ix/Certified/ClaimMain.lean
@@ -0,0 +1,8 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.ClaimCommand
+
+def main := Ix.Certified.ClaimCommand.main
diff --git a/Ix/Certified/ClaimMeaning.lean b/Ix/Certified/ClaimMeaning.lean
new file mode 100644
index 000000000..08158bd8f
--- /dev/null
+++ b/Ix/Certified/ClaimMeaning.lean
@@ -0,0 +1,151 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.ClaimCheck
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+variable {source : Ixon.Env} {snapshot : SourceSnapshot source}
+  {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+
+theorem OptionalTreeOpening.none_leaves (opening : OptionalTreeOpening fuel none bytes) :
+    opening.leaves = [] := by
+  cases bytes with
+  | none => exact opening.evidence
+  | some => exact False.elim opening.evidence
+
+theorem OptionalTreeOpening.closed_leaves (opening : OptionalTreeOpening fuel root bytes)
+    (closed : root = none) : opening.leaves = [] := by
+  subst root
+  exact opening.none_leaves
+
+theorem LogicalChecking.target_entry
+    (checked : LogicalChecking.{v} snapshot fuel envelope witness)
+    {ref : ConstRef Address} (hr : ref ∈ checked.subjects) :
+    ∃ entry, checked.batch.receipt.checked.result.entries ref = some entry ∧
+      EntrySource checked.signature checked.store ref entry := by
+  have validated := (checked.signature.validate_iff checked.store).mp checked.batch.receipt.frontier.validated
+  by_cases hF : ref = checked.signature.falseType
+  · subst ref
+    exact ⟨PrimitiveSignature.falseEntry, checked.batch.receipt.checked.result.present.1,
+      Or.inl ⟨rfl, rfl, validated.1⟩⟩
+  · by_cases hE : ref = checked.signature.falseElim
+    · subst ref
+      exact ⟨checked.signature.falseElimEntry, checked.batch.receipt.checked.result.present.2,
+        Or.inr (Or.inl ⟨rfl, rfl, validated.2⟩)⟩
+    · have owned := (checked.exactSubjects ref).mpr (mem_ownedReferences.mpr ⟨hr, hF, hE⟩)
+      have hp := checked.batch.receipt.present ref owned
+      obtain ⟨entry, he⟩ := Option.isSome_iff_exists.mp hp
+      refine ⟨entry, he, ?_⟩
+      rcases checked.batch.receipt.checked.source ref entry he with old | new
+      · rw [checked.batch.receipt.fresh ref owned] at old
+        cases old
+      · exact new
+
+theorem LogicalChecking.original_subject
+    (checked : LogicalChecking.{v} snapshot fuel envelope witness)
+    {ref : ConstRef Address} (hr : ref ∈ checked.subjects) :
+    ∃ entry, checked.batch.receipt.checked.result.entries ref = some entry ∧
+      SourceDeclarationReading source snapshot.decodedObjects snapshot.decodedNaturals ref entry := by
+  obtain ⟨entry, he, hs⟩ := checked.target_entry hr
+  exact ⟨entry, he, snapshot.declaration_reading checked.storeReading hs.header⟩
+
+theorem LogicalChecking.original_frontier
+    (checked : LogicalChecking.{v} snapshot fuel envelope witness)
+    {ref : ConstRef Address} (hr : ref ∈ checked.frontierRefs) :
+    ∃ entry, checked.batch.receipt.frontier.interface.entries ref = some entry ∧
+      SourceDeclarationReading source snapshot.decodedObjects snapshot.decodedNaturals ref entry := by
+  have hm := (checked.exactFrontier ref).mpr hr
+  obtain ⟨header, hh, rfl⟩ := List.mem_map.mp hm
+  exact ⟨header.entry, checked.batch.receipt.frontier.formed.lookup hh,
+    snapshot.declaration_reading checked.storeReading (checked.batch.receipt.frontier.header_source hh)⟩
+
+/-- The claim's public axiom tree contains every use, including uses retained
+from leaves. Each address resolves to an exactly realized source schema. -/
+theorem LogicalChecking.logical_policy
+    (checked : LogicalChecking.{v} snapshot fuel envelope witness)
+    {ref : ConstRef Address} (hr : ref ∈ checked.axiomRefs) :
+    ∃ entry, Standard.EntrySource checked.store ref entry ∨ Quotient.EntrySource checked.store ref entry :=
+  checked.batch.logicalUses_authorized ((checked.exactAxioms ref).mpr hr)
+
+theorem LogicalChecking.closed_frontier
+    (checked : LogicalChecking.{v} snapshot fuel envelope witness)
+    (closed : claimFrontier envelope.claim = none) : checked.batch.receipt.frontier.refs = [] := by
+  have hl : checked.frontier.leaves = [] := by
+    exact checked.frontier.closed_leaves closed
+  have hr : checked.frontierRefs = [] := by
+    have h := checked.frontierReading
+    rw [hl] at h
+    simpa using h.symm
+  apply List.eq_nil_iff_forall_not_mem.mpr
+  intro ref hm
+  have h := (checked.exactFrontier ref).mp hm
+  rw [hr] at h
+  cases h
+
+/-- Conditional soundness of every original source member or constructor in
+the exact committed subject set. All declared frontier values are preserved
+at every universe instance while the shared interpretation is extended. -/
+theorem LogicalReceipt.subject_meaning
+    (receipt : LogicalReceipt.{v} source fuel envelope witness)
+    (V : Type v) [SetTheory V] (constants : Assignment Address V)
+    (hM : receipt.checked.signature.Compatible receipt.checked.batch.receipt.frontier.interface.entries constants) :
+    ∃ constants' : Assignment Address V,
+      receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants' ∧
+      Assignment.AgreesOn receipt.checked.batch.receipt.frontier.interface.entries constants constants' ∧
+      ∀ ref ∈ receipt.checked.subjects, ∃ entry,
+        SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+        ∀ levels, levels.length = entry.universes → ∀ env,
+          WellDenoted constants' levels env entry.type ∧
+          constants' ref levels ∈ˢ interp constants' levels env entry.type := by
+  obtain ⟨constants', hm, ha⟩ := receipt.checked.batch.receipt.checked.extension.models V constants hM
+  refine ⟨constants', hm, ha, ?_⟩
+  intro ref hr
+  obtain ⟨entry, he, hs⟩ := receipt.checked.original_subject hr
+  refine ⟨entry, hs, ?_⟩
+  intro levels hl env
+  exact ⟨hm.realizes.typeValid ref entry he levels hl env,
+    hm.realizes.member ref entry he levels hl env⟩
+
+/-- A public claim with no structural frontier constructs its model. This
+does not assert that its separately recorded logical-axiom set is empty. -/
+theorem LogicalReceipt.closed_subject_meaning
+    (receipt : LogicalReceipt.{v} source fuel envelope witness)
+    (closed : claimFrontier envelope.claim = none) (V : Type v) [SetTheory V] :
+    ∃ constants : Assignment Address V,
+      receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants ∧
+      ∀ ref ∈ receipt.checked.subjects, ∃ entry,
+        SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+        ∀ levels, levels.length = entry.universes → ∀ env,
+          WellDenoted constants levels env entry.type ∧
+          constants ref levels ∈ˢ interp constants levels env entry.type := by
+  have hf := receipt.checked.closed_frontier closed
+  have initial : receipt.checked.signature.Compatible receipt.checked.batch.receipt.frontier.interface.entries
+      (receipt.checked.signature.assignment (V := V)) := by
+    rw [receipt.checked.batch.receipt.frontier.empty_interface hf]
+    exact receipt.checked.signature.compatible_assignment
+  obtain ⟨constants, hm, _, subjects⟩ := receipt.subject_meaning V receipt.checked.signature.assignment initial
+  exact ⟨constants, hm, subjects⟩
+
+theorem LogicalReceipt.no_False
+    (receipt : LogicalReceipt.{v} source fuel envelope witness)
+    (closed : claimFrontier envelope.claim = none) {ref : ConstRef Address}
+    (subject : ref ∈ receipt.checked.subjects)
+    (type : receipt.checked.store.type ref = some receipt.checked.signature.falseExpr)
+    (V : Type v) [SetTheory V] : False := by
+  have hf := receipt.checked.closed_frontier closed
+  obtain ⟨constants, hm, _⟩ := receipt.checked.batch.closed_has_model hf V
+  obtain ⟨entry, he, hs⟩ := receipt.checked.target_entry subject
+  have hc : entry.type = .const receipt.checked.signature.falseType [] :=
+    AExpr.eq_const_of_erase_eq (Option.some.inj (hs.header.type.symm.trans type))
+  have hmem := hm.realizes.member ref entry he (List.replicate entry.universes 0) (by simp) (fun _ => empty)
+  rw [hc] at hmem
+  simp only [interp, List.map_nil, hm.falseValue] at hmem
+  exact not_mem_empty _ hmem
+
+end Ix.Certified
diff --git a/Ix/Certified/ClaimSuggest.lean b/Ix/Certified/ClaimSuggest.lean
new file mode 100644
index 000000000..4052efd7c
--- /dev/null
+++ b/Ix/Certified/ClaimSuggest.lean
@@ -0,0 +1,75 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Claims
+import Ix.Certified.ClaimAccept
+import Ix.Certified.ModelHints
+
+/-! Untrusted witness construction. The acceptance path imports none of
+these search functions and checks the public envelope and complete returned
+witness again. Trees are hints whose public Merkle roots are checked. -/
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model
+
+structure LeafHint where
+  claim : Ix.Claim
+  subjects : Option ByteArray
+  frontierTree : Option ByteArray
+
+structure LogicalHint where
+  selection : InputSelection
+  leaves : List LeafHint
+  subjects : Option ByteArray
+  members : Option ByteArray
+  frontierTree : Option ByteArray
+  axiomTree : Option ByteArray
+  models : List ModelHint := []
+
+/-- Header dependency order is independent of the Merkle tree's leaf order. -/
+def frontierOrder? (fuel : Nat) (signature : PrimitiveSignature Address) (store : Store Address)
+    (allowed pending visited active : List (ConstRef Address)) : Option (List (ConstRef Address)) :=
+  match fuel, pending with
+  | _, [] => some visited
+  | 0, _ :: _ => none
+  | fuel + 1, ref :: rest =>
+    if ref = signature.falseType ∨ ref = signature.falseElim ∨ ref ∈ visited then
+      frontierOrder? fuel signature store allowed rest visited active
+    else if ref ∈ active ∨ ref ∉ allowed then none
+    else do
+      let type ← store.type ref
+      let visited ← frontierOrder? fuel signature store allowed type.refs visited (ref :: active)
+      frontierOrder? fuel signature store allowed rest (visited ++ [ref]) active
+
+def frontierSuggestion? (fuel : Nat) (signature : PrimitiveSignature Address) (store : Store Address)
+    (objects : Objects) (root : Option Address) (bytes : Option ByteArray) :
+    Option (List (ConstRef Address) × List (FrontierWitness Address)) := do
+  let opening ← readOptionalTree? fuel root bytes
+  let refs ← opening.leaves.flatMapM (subjectReferences? objects)
+  let ordered ← frontierOrder? fuel signature store refs refs [] []
+  let (_, witnesses) ← Certificate.frontierWitnesses? fuel store signature.environment ordered
+  return (ordered, witnesses)
+
+def leafSuggestion? (fuel : Nat) (signature : PrimitiveSignature Address) (store : Store Address)
+    (objects : Objects) (hint : LeafHint) (models : List (Certificate.Modeled.Candidate Address) := []) : Option LeafWitness := do
+  let subjects ← readSubjectView? fuel hint.claim hint.subjects
+  let refs ← subjects.addresses.flatMapM (subjectReferences? objects)
+  let (frontier, _) ← frontierSuggestion? fuel signature store objects (claimFrontier hint.claim) hint.frontierTree
+  let node ← Certificate.claimNode? fuel signature store frontier (ownedReferences signature refs) models
+  return ⟨hint.claim, hint.subjects, hint.frontierTree, node.frontier, node.declarations⟩
+
+def suggestLogical? (fuel : Nat) (source : Ixon.Env) (envelope : Envelope) (hint : LogicalHint) :
+    Option LogicalWitness := do
+  let (snapshot, _) ← readSnapshot? fuel source hint.selection {}
+  let signature ← readSignature? envelope.profile snapshot.decodedObjects
+  let store ← readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals
+  let models ← modelCandidates? snapshot.decodedObjects store hint.models
+  let leaves ← hint.leaves.mapM (fun leaf => leafSuggestion? fuel signature store snapshot.decodedObjects leaf models)
+  let (_, frontier) ← frontierSuggestion? fuel signature store snapshot.decodedObjects
+    (claimFrontier envelope.claim) hint.frontierTree
+  return ⟨hint.selection, leaves, hint.subjects, hint.members, hint.frontierTree, frontier, hint.axiomTree⟩
+
+end Ix.Certified
diff --git a/Ix/Certified/Command.lean b/Ix/Certified/Command.lean
new file mode 100644
index 000000000..0ad2ba24c
--- /dev/null
+++ b/Ix/Certified/Command.lean
@@ -0,0 +1,96 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Suggest
+import Ix.Kernel.Certified
+
+/-! Generic source-file driver for the certified profile. The JSON request
+selects the expected target/subjects, primitive signature and finite source
+closure. Witness search is untrusted and always followed by certified TcM
+validation. There is no inference-only or unchecked fallback command. -/
+
+namespace Ix.Certified.Command
+
+universe v
+
+structure Request where
+  profile : Profile
+  target : Address
+  subjects : List Address
+  selection : InputSelection
+  models : List ModelHint := []
+
+def readAddress (value : String) : Except String Address :=
+  match Address.fromString value with
+  | none => .error "expected a 32-byte hexadecimal address"
+  | some address => .ok address
+
+def readRequest (json : Lean.Json) : Except String Request := do
+  let falseType ← readAddress (← json.getObjValAs? String "falseType")
+  let falseElim ← readAddress (← json.getObjValAs? String "falseElim")
+  let natural ← json.getObjValAs? (Option String) "natType"
+  let natType ← natural.mapM readAddress
+  let target ← readAddress (← json.getObjValAs? String "target")
+  let subjects ← (← json.getObjValAs? (List String) "subjects").mapM readAddress
+  let objects ← (← json.getObjValAs? (List String) "objects").mapM readAddress
+  let naturals ← (← json.getObjValAs? (List String) "naturals").mapM readAddress
+  return ⟨⟨falseType, falseElim, natType⟩, target, subjects, ⟨objects, naturals⟩, ← ModelHint.readOptional json⟩
+
+def run (mode : String) (fuel : Nat) (source : Ixon.Env) (request : Request) : Except String Unit := do
+  if mode = "proof" then
+    let some witness := suggestSource? fuel source request.profile request.target request.selection request.models
+      | throw "certified proof witness search declined"
+    if Kernel.acceptsCertifiedSource.{v} fuel source request.profile request.target request.selection witness then
+      return ()
+    else throw "certified proof validation rejected the witness"
+  else if mode = "store" then
+    let some witness := suggestStore? fuel source request.profile request.subjects request.selection request.models
+      | throw "certified declaration witness search declined"
+    if Kernel.acceptsCertifiedStoreSource.{v} fuel source request.profile request.subjects request.selection witness then
+      return ()
+    else throw "certified declaration validation rejected the witness"
+  else throw "mode must be proof or store"
+
+/-- The generic command can report success only after an actual certified
+source run. Witness search is not an alternate acceptance path. -/
+theorem run_success {mode : String} {fuel : Nat} {source : Ixon.Env} {request : Request}
+    (h : run.{v} mode fuel source request = .ok ()) :
+    (mode = "proof" ∧ ∃ witness, Kernel.acceptsCertifiedSource.{v} fuel source
+      request.profile request.target request.selection witness = true) ∨
+    (mode = "store" ∧ ∃ witness, Kernel.acceptsCertifiedStoreSource.{v} fuel source
+      request.profile request.subjects request.selection witness = true) := by
+  by_cases hp : mode = "proof"
+  · cases hw : suggestSource? fuel source request.profile request.target request.selection request.models with
+    | none => simp [run, hp, hw] at h
+    | some witness =>
+      by_cases ha : Kernel.acceptsCertifiedSource.{v} fuel source request.profile request.target request.selection witness = true
+      · exact .inl ⟨hp, witness, ha⟩
+      · simp [run, hp, hw, ha] at h
+  · by_cases hs : mode = "store"
+    · cases hw : suggestStore? fuel source request.profile request.subjects request.selection request.models with
+      | none => simp [run, hs, hw] at h
+      | some witness =>
+        by_cases ha : Kernel.acceptsCertifiedStoreSource.{v} fuel source request.profile request.subjects request.selection witness = true
+        · exact .inr ⟨hs, witness, ha⟩
+        · simp [run, hs, hw, ha] at h
+    · simp [run, hp, hs] at h
+
+def main (args : List String) : IO UInt32 := do
+  let [mode, sourcePath, requestPath] := args | do
+    IO.eprintln "usage: certified-check proof|store SOURCE.ixe REQUEST.json"
+    return 2
+  let bytes ← IO.FS.readBinFile sourcePath
+  let requestText ← IO.FS.readFile requestPath
+  let result := do
+    let request ← readRequest (← Lean.Json.parse requestText)
+    let parts ← Ixon.deEnvVerifiedLazy bytes
+    run.{0} mode 6400 parts.env request
+  match result with
+  | .error error => IO.eprintln error; return 1
+  | .ok () =>
+    IO.println <| (Lean.Json.mkObj [("accepted", Lean.toJson true), ("mode", Lean.toJson mode)]).compress
+    return 0
+
+end Ix.Certified.Command
diff --git a/Ix/Certified/Corpus.lean b/Ix/Certified/Corpus.lean
new file mode 100644
index 000000000..688c899db
--- /dev/null
+++ b/Ix/Certified/Corpus.lean
@@ -0,0 +1,123 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Fixtures
+
+namespace Ix.Certified.Corpus
+
+open Fixtures
+
+def idType (level : UInt64) : Ixon.Expr :=
+  .leanAll (.sort level) (.leanAll (.var 0) (.var 1))
+
+def idBody (level : UInt64) : Ixon.Expr :=
+  .leanLam (.sort level) (.leanLam (.var 0) (.var 0))
+
+def polyId (kind : Ix.DefKind) : Ixon.Constant := {
+  info := .defn {
+    kind, safety := .safe, lvls := 1, typ := idType 0, value := idBody 0 }
+  sharing := #[], refs := #[], univs := #[.var 0]
+}
+
+def polyUse (kind : Ix.DefKind) (large : Bool) : Ixon.Constant := {
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := 0, typ := idType 0,
+    value := if large then
+      .app (.leanLam (idType 1) (idBody 0)) (.ref 0 #[1])
+      else .ref 0 #[0] }
+  sharing := #[], refs := #[(encode (polyId kind)).1],
+  univs := #[.zero, .succ .zero]
+}
+
+def dependent (n : UInt64) (u : Ixon.Univ) : Ixon.Constant := {
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := n,
+    typ := .leanAll (.sort 0)
+      (.leanAll (.leanAll (.var 0) (.sort 1))
+        (.leanAll (.leanAll (.var 1) (.app (.var 1) (.var 0)))
+          (.leanAll (.var 2) (.app (.var 2) (.var 0))))),
+    value := .leanLam (.sort 0)
+      (.leanLam (.leanAll (.var 0) (.sort 1))
+        (.leanLam (.leanAll (.var 1) (.app (.var 1) (.var 0)))
+          (.leanLam (.var 2) (.app (.var 1) (.var 0))))) }
+  sharing := #[], refs := #[], univs := #[u, .zero]
+}
+
+-- The declared proposition contains a beta redex. The body is checked
+-- against that original proposition through a beta conversion certificate.
+def betaStatement : Ixon.Constant := {
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := 0,
+    typ := .app (.leanLam (.sort 0) (.var 0)) (idType 0),
+    value := idBody 0 }
+  sharing := #[], refs := #[], univs := #[.zero]
+}
+
+-- ∀ A : Prop, ∀ F : (A → A) → Prop, ∀ f, F f → F (fun x => f x).
+-- The supplied proof returns its last argument, so admission needs eta
+-- beneath a dependent application and a telescope of products.
+def etaStatement : Ixon.Constant := {
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := 0,
+    typ := .leanAll (.sort 0)
+      (.leanAll (.leanAll (.leanAll (.var 0) (.var 1)) (.sort 0))
+        (.leanAll (.leanAll (.var 1) (.var 2))
+          (.leanAll (.app (.var 1) (.var 0))
+            (.app (.var 2) (.leanLam (.var 3) (.app (.var 2) (.var 0))))))),
+    value := .leanLam (.sort 0)
+      (.leanLam (.leanAll (.leanAll (.var 0) (.var 1)) (.sort 0))
+        (.leanLam (.leanAll (.var 1) (.var 2))
+          (.leanLam (.app (.var 1) (.var 0)) (.var 0)))) }
+  sharing := #[], refs := #[], univs := #[.zero]
+}
+
+def eliminatorStatement : Ixon.Constant := {
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := 0,
+    typ := .leanAll (.leanAll (.ref 0 #[]) (.sort 0))
+      (.leanAll (.ref 0 #[]) (.app (.var 1) (.var 0))),
+    value := .ref 1 #[0] }
+  sharing := #[], refs := #[falseObject.1, falseElimObject.1], univs := #[.zero]
+}
+
+structure Case where
+  name : String
+  target : Address
+  blobs : ConstantBlobs
+
+def one (name : String) (source : Ixon.Constant)
+    (dependencies : List Ixon.Constant := []) : Case :=
+  let object := encode source
+  ⟨name, object.1, prelude ++ dependencies.map encode ++ [object]⟩
+
+def positive : List Case := [
+  one "identity" identity,
+  one "dependent-polymorphic" (dependent 1 (.var 0)),
+  one "dependent-Prop" (dependent 0 .zero),
+  one "dependent-Type" (dependent 0 (.succ .zero)),
+  one "dependent-Type1" (dependent 0 (.succ (.succ .zero))),
+  one "definition-at-Prop" (polyUse .defn false) [polyId .defn],
+  one "definition-at-Type" (polyUse .defn true) [polyId .defn],
+  one "theorem-at-Prop" (polyUse .thm false) [polyId .thm],
+  one "opaque-at-Type" (polyUse .opaq true) [polyId .opaq],
+  one "beta-statement" betaStatement,
+  one "eta-statement" etaStatement,
+  one "False-eliminator" eliminatorStatement
+]
+
+#guard positive.all fun c => accepted c.blobs c.target
+
+/-- Syntactic exclusions measured separately from failed witness generation.
+The selected profile never enables literals or linear binder flags. -/
+def declined : List Case := [
+  one "linear-binder-profile" linearIdentity,
+  one "literal-profile" { identity with info := .defn {
+    kind := .thm, safety := .safe, lvls := 0,
+    typ := idType 0, value := .nat 0 } }
+]
+
+#guard declined.all fun c => (prepare? 300 profile c.target c.blobs).isNone
+
+end Ix.Certified.Corpus
diff --git a/Ix/Certified/Envelope.lean b/Ix/Certified/Envelope.lean
new file mode 100644
index 000000000..c88cb93e9
--- /dev/null
+++ b/Ix/Certified/Envelope.lean
@@ -0,0 +1,92 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Trees
+import Ix.Claim
+
+/-! Versioned public claims for the certified source checker. This envelope
+binds the original Ix claim, primitive addresses, modeled logical policy and
+axiom-use root. The thin-frontier convention is distinct from the legacy
+whole-environment convention. A backend still has to bind its actual program
+and permitted keys to this source program version. -/
+
+namespace Ix.Certified
+
+structure Protocol where
+  format : UInt64 := 1
+  codec : UInt64 := 1
+  checker : UInt64 := 1
+  policy : UInt64 := 1
+  aggregation : UInt64 := 1
+  deriving DecidableEq
+
+/-- Checker version 2 includes checked model companions for mutual and
+nested declarations. Older checker identities do not select this program. -/
+def Protocol.current : Protocol := { checker := 2 }
+
+structure Envelope where
+  protocol : Protocol
+  profile : Profile
+  claim : Ix.Claim
+  logicalAxioms : Option Address
+
+def envelopeMagic : ByteArray := "IX-CERTIFIED-CLAIM".toUTF8 ++ ⟨#[0]⟩
+
+def putEnvelope (envelope : Envelope) : Ixon.PutM Unit := do
+  Ixon.putBytes envelopeMagic
+  Ixon.putTag0 ⟨envelope.protocol.format⟩
+  Ixon.putTag0 ⟨envelope.protocol.codec⟩
+  Ixon.putTag0 ⟨envelope.protocol.checker⟩
+  Ixon.putTag0 ⟨envelope.protocol.policy⟩
+  Ixon.putTag0 ⟨envelope.protocol.aggregation⟩
+  Ixon.Serialize.put envelope.profile.falseType
+  Ixon.Serialize.put envelope.profile.falseElim
+  Ix.Claim.putOptAddr envelope.profile.natType
+  Ix.Claim.put envelope.claim
+  Ix.Claim.putOptAddr envelope.logicalAxioms
+
+def envelopeBytes (envelope : Envelope) : ByteArray := Ixon.runPut (putEnvelope envelope)
+
+def getEnvelope : Ixon.GetM Envelope := do
+  if (← Ixon.getBytes envelopeMagic.size) != envelopeMagic then throw "invalid certified claim magic"
+  let format := (← Ixon.getTag0).size
+  let codec := (← Ixon.getTag0).size
+  let checker := (← Ixon.getTag0).size
+  let policy := (← Ixon.getTag0).size
+  let aggregation := (← Ixon.getTag0).size
+  let falseType ← Ixon.Serialize.get
+  let falseElim ← Ixon.Serialize.get
+  let natType ← Ix.Claim.getOptAddr
+  let claim ← Ix.Claim.get
+  let logicalAxioms ← Ix.Claim.getOptAddr
+  return ⟨⟨format, codec, checker, policy, aggregation⟩, ⟨falseType, falseElim, natType⟩, claim, logicalAxioms⟩
+
+structure EnvelopeReading (address : Address) (bytes : ByteArray) where
+  envelope : Envelope
+  addressSize : address.hash.size = 32
+  authenticated : Address.blake3 bytes = address
+  parsing : Ixon.runGetExact getEnvelope bytes = .ok envelope
+  canonical : envelopeBytes envelope = bytes
+  supported : envelope.protocol = Protocol.current
+
+def readEnvelope? (fuel : Nat) (address : Address) (bytes : ByteArray) :
+    Option (EnvelopeReading address bytes) :=
+  if bytes.size > fuel then none else
+  if ha : address.hash.size = 32 ∧ Address.blake3 bytes = address then
+    match hp : Ixon.runGetExact getEnvelope bytes with
+    | .error _ => none
+    | .ok envelope =>
+      if hc : envelopeBytes envelope = bytes then
+        if hs : envelope.protocol = Protocol.current then some ⟨envelope, ha.1, ha.2, hp, hc, hs⟩
+        else none
+      else none
+  else none
+
+/-- Exact parsing fixes the complete public claim and profile. Semantic or
+expression equality is never used to recover the authenticated bytes. -/
+theorem EnvelopeReading.unique {a b : EnvelopeReading address bytes} : a.envelope = b.envelope :=
+  Except.ok.inj (a.parsing.symm.trans b.parsing)
+
+end Ix.Certified
diff --git a/Ix/Certified/Fixtures.lean b/Ix/Certified/Fixtures.lean
new file mode 100644
index 000000000..e7306ffd3
--- /dev/null
+++ b/Ix/Certified/Fixtures.lean
@@ -0,0 +1,141 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Bytes
+import Ix.Theory.Certificate.Build
+
+namespace Ix.Certified.Fixtures
+
+open Ix.Theory Ix.Theory.Certified
+
+def encode (source : Ixon.Constant) : Address × ByteArray :=
+  let bytes := Ixon.serConstant source
+  (Address.blake3 bytes, bytes)
+
+def falseBlock : Ixon.Constant := {
+  info := .muts #[.indc {
+    isUnsafe := false, lvls := 0, params := 0, indices := 0,
+    typ := .sort 0, ctors := #[]
+  }]
+  sharing := #[]
+  refs := #[]
+  univs := #[.zero]
+}
+
+def falseBlockObject := encode falseBlock
+
+def falseProjection : Ixon.Constant :=
+  ⟨.iPrj ⟨0, falseBlockObject.1⟩, #[], #[], #[]⟩
+
+def falseObject := encode falseProjection
+
+def falseElim : Ixon.Constant := {
+  info := .recr {
+    k := false, isUnsafe := false, lvls := 1, params := 0, indices := 0,
+    motives := 1, minors := 0,
+    typ := .leanAll (.leanAll (.ref 0 #[]) (.sort 0))
+      (.leanAll (.ref 0 #[]) (.app (.var 1) (.var 0))),
+    rules := #[]
+  }
+  sharing := #[]
+  refs := #[falseObject.1]
+  univs := #[.var 0]
+}
+
+def falseElimObject := encode falseElim
+
+def profile : Profile := ⟨falseObject.1, falseElimObject.1, none⟩
+def prelude : ConstantBlobs := [falseBlockObject, falseObject, falseElimObject]
+
+def identity : Ixon.Constant := {
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := 0,
+    typ := .leanAll (.sort 0) (.leanAll (.var 0) (.var 1)),
+    value := .leanLam (.sort 0) (.leanLam (.var 0) (.var 0))
+  }
+  sharing := #[]
+  refs := #[]
+  univs := #[.zero]
+}
+
+def identityObject := encode identity
+def identityBlobs : ConstantBlobs := prelude ++ [identityObject]
+
+def witness? (blobs : ConstantBlobs) (target : Address) : Option (ProofWitness Address) := do
+  let prepared ← prepare? 300 profile target blobs
+  Ix.Theory.Certificate.proofWitness? 300 prepared.signature prepared.input
+
+def accepted (blobs : ConstantBlobs) (target : Address) : Bool :=
+  (witness? blobs target).any (acceptsSerialized.{0} 300 profile target blobs)
+
+#guard accepted identityBlobs identityObject.1
+
+-- A new valid hash cannot license trailing data outside the constant grammar.
+def trailingIdentity : Address × ByteArray :=
+  let bytes := identityObject.2.push 0
+  (Address.blake3 bytes, bytes)
+#guard (prepare? 300 profile trailingIdentity.1 (prelude ++ [trailingIdentity])).isNone
+
+-- Changed bytes under an old address fail authentication.
+#guard (prepare? 300 profile identityObject.1
+  (prelude ++ [(identityObject.1, identityObject.2.push 0)])).isNone
+
+-- Duplicate object addresses are not silently overwritten.
+#guard (prepare? 300 profile identityObject.1 (identityBlobs ++ [identityObject])).isNone
+
+def linearIdentity : Ixon.Constant :=
+  { identity with info := .defn {
+      kind := .thm, safety := .safe, lvls := 0,
+      typ := .leanAll (.sort 0) (.leanAll (.var 0) (.var 1)),
+      value := .lam .linear (.sort 0) (.leanLam (.var 0) (.var 0))
+    } }
+
+def linearIdentityObject := encode linearIdentity
+#guard (prepare? 300 profile linearIdentityObject.1
+  (prelude ++ [linearIdentityObject])).isNone
+
+def wrongTable : Ixon.Constant := { identity with univs := #[] }
+def wrongTableObject := encode wrongTable
+#guard (prepare? 300 profile wrongTableObject.1 (prelude ++ [wrongTableObject])).isNone
+
+def cyclicSharing : Ixon.Constant := {
+  identity with
+  info := .defn {
+    kind := .thm, safety := .safe, lvls := 0,
+    typ := .leanAll (.sort 0) (.leanAll (.var 0) (.var 1)), value := .share 0 }
+  sharing := #[.share 0]
+}
+def cyclicSharingObject := encode cyclicSharing
+#guard (prepare? 30 profile cyclicSharingObject.1 (prelude ++ [cyclicSharingObject])).isNone
+
+def axiomIdentity : Ixon.Constant := {
+  identity with
+  info := .axio {
+    isUnsafe := false, lvls := 0,
+    typ := .leanAll (.sort 0) (.leanAll (.var 0) (.var 1)) }
+}
+def axiomIdentityObject := encode axiomIdentity
+
+-- Force an untrusted proof witness through the actual acceptance gate. This
+-- is a policy rejection, not merely a failure of the suggestion producer.
+def axiomRejected : Bool :=
+  match witness? identityBlobs identityObject.1 with
+  | none => false
+  | some witness =>
+    let forged := { witness with declarations := witness.declarations.map fun declaration =>
+      match declaration with
+      | .definition definition => .definition { definition with ref := .member axiomIdentityObject.1 0 }
+      | .ordinary block => .ordinary block
+      | .standard witness => .standard witness
+      | .quotient witness => .quotient witness
+      | .structure witness => .structure witness
+      | .natural witness => .natural witness
+      | .modeled witness => .modeled witness }
+    !acceptsSerialized.{0} 300 profile axiomIdentityObject.1
+      (prelude ++ [axiomIdentityObject]) forged
+
+#guard axiomRejected
+
+end Ix.Certified.Fixtures
diff --git a/Ix/Certified/Ingress.lean b/Ix/Certified/Ingress.lean
new file mode 100644
index 000000000..8e799407f
--- /dev/null
+++ b/Ix/Certified/Ingress.lean
@@ -0,0 +1,315 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Store
+
+/-! Certified lazy reads from the actual Ixon environment. Only selected
+addresses are visited. Materialized source caches and kernel judgment caches
+cannot replace authenticated bytes. The reusable cache stores decoded data;
+each hit also compares the exact current source bytes. -/
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+/-- A constant window must be wholly inside its backing buffer. The cached
+materialization in `LazyConstant` is intentionally not an input to this read. -/
+def constantBytes? (source : Ixon.Env) (address : Address) : Option ByteArray := do
+  let entry ← source.consts.get? address
+  if entry.off ≤ entry.buf.size ∧ entry.len ≤ entry.buf.size - entry.off then
+    some entry.rawBytes
+  else none
+
+abbrev DecodedNatural (address : Address) (bytes : ByteArray) :=
+  { value : Nat //
+    address.hash.size = 32 ∧ Address.blake3 bytes = address ∧
+    Nat.fromBytesLE bytes.data = value ∧ ByteArray.mk value.toBytesLE = bytes }
+
+theorem decodeObject_complete {address : Address} {bytes : ByteArray}
+    (value : DecodedObject address bytes) : decodeObject? address bytes = some value := by
+  rcases value with ⟨value, hs, hh, hp, hc⟩
+  unfold decodeObject?
+  split
+  · rename_i auth
+    have he : canonicalObject? address bytes auth (Ixon.runGetExact Ixon.getConstant bytes) rfl =
+        canonicalObject? address bytes auth (.ok value) hp := by congr 1
+    rw [he]
+    simp [canonicalObject?, hc]
+  · rename_i h
+    exact False.elim (h ⟨hs, hh⟩)
+
+theorem decodeNatural_complete {address : Address} {bytes : ByteArray}
+    (value : DecodedNatural address bytes) : decodeNatural? address bytes = some value := by
+  rcases value with ⟨value, hs, hh, hp, hc⟩
+  simp [decodeNatural?, hs, hh, hp, hc]
+
+structure CachedObject where
+  address : Address
+  bytes : ByteArray
+  decoded : DecodedObject address bytes
+
+structure CachedNatural where
+  address : Address
+  bytes : ByteArray
+  decoded : DecodedNatural address bytes
+
+/-- The public driver starts with this empty cache. Entries contain only
+canonical, authenticated data; no typing, conversion or admission verdicts. -/
+structure InputCache where
+  objects : List CachedObject := []
+  naturals : List CachedNatural := []
+  hits : Nat := 0
+  misses : Nat := 0
+
+namespace InputCache
+
+def object? (address : Address) (bytes : ByteArray) :
+    List CachedObject → Option (DecodedObject address bytes)
+  | [] => none
+  | entry :: rest =>
+    if ha : entry.address = address then
+      if hb : entry.bytes = bytes then some (by simpa only [← ha, ← hb] using entry.decoded)
+      else object? address bytes rest
+    else object? address bytes rest
+
+def natural? (address : Address) (bytes : ByteArray) :
+    List CachedNatural → Option (DecodedNatural address bytes)
+  | [] => none
+  | entry :: rest =>
+    if ha : entry.address = address then
+      if hb : entry.bytes = bytes then some (by simpa only [← ha, ← hb] using entry.decoded)
+      else natural? address bytes rest
+    else natural? address bytes rest
+
+end InputCache
+
+structure SourceObject (source : Ixon.Env) extends CachedObject where
+  fromSource : constantBytes? source address = some bytes
+
+structure SourceNatural (source : Ixon.Env) extends CachedNatural where
+  fromSource : source.getBlob? address = some bytes
+
+abbrev Read (_source : Ixon.Env) := StateT InputCache Option
+
+def readObject? (source : Ixon.Env) (address : Address) : Read source (SourceObject source) := fun cache =>
+  match hs : constantBytes? source address with
+  | none => none
+  | some bytes =>
+    match InputCache.object? address bytes cache.objects with
+    | some decoded => some (⟨⟨address, bytes, decoded⟩, hs⟩, { cache with hits := cache.hits + 1 })
+    | none => do
+      let decoded ← decodeObject? address bytes
+      let entry : CachedObject := ⟨address, bytes, decoded⟩
+      return (⟨entry, hs⟩, { cache with objects := entry :: cache.objects, misses := cache.misses + 1 })
+
+def readNatural? (source : Ixon.Env) (address : Address) : Read source (SourceNatural source) := fun cache =>
+  match hs : source.getBlob? address with
+  | none => none
+  | some bytes =>
+    match InputCache.natural? address bytes cache.naturals with
+    | some decoded => some (⟨⟨address, bytes, decoded⟩, hs⟩, { cache with hits := cache.hits + 1 })
+    | none => do
+      let decoded ← decodeNatural? address bytes
+      let entry : CachedNatural := ⟨address, bytes, decoded⟩
+      return (⟨entry, hs⟩, { cache with naturals := entry :: cache.naturals, misses := cache.misses + 1 })
+
+/-- An untrusted finite selection of source addresses. It must include all
+source groups and raw blobs required by the independently checked witness. -/
+structure InputSelection where
+  objects : List Address
+  naturals : List Address := []
+
+structure SourceSnapshot (source : Ixon.Env) where
+  objects : List (SourceObject source)
+  naturals : List (SourceNatural source)
+
+namespace SourceSnapshot
+
+def blobs (snapshot : SourceSnapshot source) : ConstantBlobs :=
+  snapshot.objects.map fun entry => (entry.address, entry.bytes)
+
+def literalBlobs (snapshot : SourceSnapshot source) : ConstantBlobs :=
+  snapshot.naturals.map fun entry => (entry.address, entry.bytes)
+
+def decodedObjects (snapshot : SourceSnapshot source) : Objects :=
+  snapshot.objects.map fun entry => (entry.address, entry.decoded.val)
+
+def decodedNaturals (snapshot : SourceSnapshot source) : Naturals :=
+  snapshot.naturals.map fun entry => (entry.address, entry.decoded.val)
+
+theorem objects_decode (snapshot : SourceSnapshot source) :
+    decodeObjects? snapshot.blobs = some snapshot.decodedObjects := by
+  rcases snapshot with ⟨objects, naturals⟩
+  simp only [blobs, decodedObjects, decodeObjects?]
+  induction objects with
+  | nil => rfl
+  | cons entry rest ih =>
+    dsimp only [bind, pure] at ih
+    simp only [List.map_cons, List.mapM_cons, decodeObject_complete entry.decoded,
+      bind, Option.bind_some, ih, pure]
+
+theorem naturals_decode (snapshot : SourceSnapshot source) :
+    decodeNaturals? snapshot.literalBlobs = some snapshot.decodedNaturals := by
+  rcases snapshot with ⟨objects, naturals⟩
+  simp only [literalBlobs, decodedNaturals, decodeNaturals?]
+  induction naturals with
+  | nil => rfl
+  | cons entry rest ih =>
+    dsimp only [bind, pure] at ih
+    simp only [List.map_cons, List.mapM_cons, decodeNatural_complete entry.decoded,
+      bind, Option.bind_some, ih, pure]
+
+/-- Reusing decoded data saves hashing/parsing. Scope, source metadata,
+primitive selection, dependency order and semantic validation still run. -/
+def prepare? (fuel : Nat) (profile : Profile) (target : Address)
+    (snapshot : SourceSnapshot source) : Option PreparedInput := do
+  if !((snapshot.blobs ++ snapshot.literalBlobs).map Prod.fst).Nodup then none else do
+  let signature ← readSignature? profile snapshot.decodedObjects
+  let input ← readProofInput? fuel snapshot.decodedObjects target snapshot.decodedNaturals
+  return ⟨signature, input⟩
+
+theorem prepare_eq (fuel : Nat) (profile : Profile) (target : Address)
+    (snapshot : SourceSnapshot source) :
+    Ix.Certified.prepare? fuel profile target snapshot.blobs snapshot.literalBlobs =
+      snapshot.prepare? fuel profile target := by
+  simp only [Ix.Certified.prepare?, prepare?, snapshot.objects_decode, snapshot.naturals_decode,
+    bind, Option.bind_some]
+
+/-- Each byte string consumed by the cached checker comes from the current
+source environment, even when that address occurred in an earlier request. -/
+theorem objects_from_source (snapshot : SourceSnapshot source) {address : Address} {bytes : ByteArray}
+    (h : (address, bytes) ∈ snapshot.blobs) : constantBytes? source address = some bytes := by
+  obtain ⟨entry, _, he⟩ := List.mem_map.mp h
+  cases he
+  exact entry.fromSource
+
+theorem naturals_from_source (snapshot : SourceSnapshot source) {address : Address} {bytes : ByteArray}
+    (h : (address, bytes) ∈ snapshot.literalBlobs) : source.getBlob? address = some bytes := by
+  obtain ⟨entry, _, he⟩ := List.mem_map.mp h
+  cases he
+  exact entry.fromSource
+
+end SourceSnapshot
+
+/-- Failure returns no partially loaded snapshot or semantic verdict. -/
+def readSnapshot? (fuel : Nat) (source : Ixon.Env) (selection : InputSelection) :
+    Read source (SourceSnapshot source) := do
+  if selection.objects.length + selection.naturals.length > fuel then failure else do
+  let objects ← selection.objects.mapM (readObject? source)
+  let naturals ← selection.naturals.mapM (readNatural? source)
+  return ⟨objects, naturals⟩
+
+/-- A receipt is produced only after complete checking against the snapshot.
+All semantic fields are computed by the validator; they are not input data. -/
+structure SourceReceipt (source : Ixon.Env) (fuel : Nat) (profile : Profile) (target : Address)
+    (witness : ProofWitness Address) where
+  snapshot : SourceSnapshot source
+  prepared : PreparedInput
+  preparation : snapshot.prepare? fuel profile target = some prepared
+  proof : CheckedProof.{0,v} prepared.signature prepared.input
+  checked : checkProofCertified fuel prepared.signature prepared.input witness = some proof
+
+def checkSource? (fuel : Nat) (source : Ixon.Env) (profile : Profile) (target : Address)
+    (selection : InputSelection) (witness : ProofWitness Address) :
+    Read source (SourceReceipt.{v} source fuel profile target witness) := do
+  let snapshot ← readSnapshot? fuel source selection
+  match hp : snapshot.prepare? fuel profile target with
+  | none => failure
+  | some prepared =>
+    match hc : checkProofCertified fuel prepared.signature prepared.input witness with
+    | none => failure
+    | some proof => return ⟨snapshot, prepared, hp, proof, hc⟩
+
+namespace SourceReceipt
+
+theorem serialized (receipt : SourceReceipt.{v} source fuel profile target witness) :
+    acceptsSerialized.{v} fuel profile target receipt.snapshot.blobs witness receipt.snapshot.literalBlobs = true := by
+  have hp := receipt.snapshot.prepare_eq fuel profile target
+  rw [receipt.preparation] at hp
+  simp only [acceptsSerialized, hp, acceptsCertified, receipt.checked, Option.isSome_some]
+
+theorem has_model (receipt : SourceReceipt.{v} source fuel profile target witness)
+    (V : Type v) [SetTheory V] (levels : List Nat) (env : Nat → V) :
+    ∃ constants : Assignment Address V,
+      receipt.prepared.signature.Compatible receipt.proof.environment.entries constants ∧
+      WellDenoted constants levels env receipt.proof.proof.val ∧
+      WellDenoted constants levels env receipt.proof.proposition.val ∧
+      interp constants levels env receipt.proof.proof.val ∈ˢ
+        interp constants levels env receipt.proof.proposition.val := by
+  have ha : acceptsCertified.{0,v} fuel receipt.prepared.signature receipt.prepared.input witness = true := by
+    simp only [acceptsCertified, receipt.checked, Option.isSome_some]
+  obtain ⟨result, hr, constants, hM, hW, hP, hm⟩ := accepted_has_model ha V levels env
+  have he : result = receipt.proof := Option.some.inj (hr.symm.trans receipt.checked)
+  subst result
+  exact ⟨constants, hM, hW, hP, hm⟩
+
+end SourceReceipt
+
+
+namespace SourceSnapshot
+
+def prepareStore? (fuel : Nat) (profile : Profile) (subjects : List Address)
+    (snapshot : SourceSnapshot source) : Option PreparedStore := do
+  if !((snapshot.blobs ++ snapshot.literalBlobs).map Prod.fst).Nodup then none else
+  prepareStoreObjects? fuel profile subjects snapshot.decodedObjects snapshot.decodedNaturals
+
+theorem prepareStore_eq (fuel : Nat) (profile : Profile) (subjects : List Address)
+    (snapshot : SourceSnapshot source) :
+    Ix.Certified.prepareStore? fuel profile subjects snapshot.blobs snapshot.literalBlobs =
+      snapshot.prepareStore? fuel profile subjects := by
+  simp only [Ix.Certified.prepareStore?, prepareStore?, snapshot.objects_decode, snapshot.naturals_decode,
+    bind, Option.bind_some]
+
+end SourceSnapshot
+
+structure StoreReceipt (source : Ixon.Env) (fuel : Nat) (profile : Profile) (subjects : List Address)
+    (witness : List (DeclarationWitness Address)) where
+  snapshot : SourceSnapshot source
+  prepared : PreparedStore
+  preparation : snapshot.prepareStore? fuel profile subjects = some prepared
+  result : CheckedStore.{0,v} prepared.signature prepared.store prepared.targets
+  checked : checkStoreCertified fuel prepared.signature prepared.store prepared.targets witness = some result
+
+def checkSourceStore? (fuel : Nat) (source : Ixon.Env) (profile : Profile) (subjects : List Address)
+    (selection : InputSelection) (witness : List (DeclarationWitness Address)) :
+    Read source (StoreReceipt.{v} source fuel profile subjects witness) := do
+  let snapshot ← readSnapshot? fuel source selection
+  match hp : snapshot.prepareStore? fuel profile subjects with
+  | none => failure
+  | some prepared =>
+    match hc : checkStoreCertified fuel prepared.signature prepared.store prepared.targets witness with
+    | none => failure
+    | some result => return ⟨snapshot, prepared, hp, result, hc⟩
+
+namespace StoreReceipt
+
+theorem serialized (receipt : StoreReceipt.{v} source fuel profile subjects witness) :
+    acceptsSerializedStore.{v} fuel profile subjects receipt.snapshot.blobs witness receipt.snapshot.literalBlobs = true := by
+  have hp := receipt.snapshot.prepareStore_eq fuel profile subjects
+  rw [receipt.preparation] at hp
+  simp only [acceptsSerializedStore, hp, acceptsStoreCertified, receipt.checked, Option.isSome_some]
+
+theorem has_model (receipt : StoreReceipt.{v} source fuel profile subjects witness)
+    (V : Type v) [SetTheory V] :
+    ∃ constants : Assignment Address V,
+      receipt.prepared.signature.Compatible receipt.result.environment.entries constants ∧
+      ∀ r ∈ receipt.prepared.targets, ∃ entry, receipt.result.environment.entries r = some entry ∧
+        EntrySource receipt.prepared.signature receipt.prepared.store r entry ∧
+        ∀ levels, levels.length = entry.universes → ∀ env : Nat → V,
+          WellDenoted constants levels env entry.type ∧
+          constants r levels ∈ˢ interp constants levels env entry.type := by
+  have ha : acceptsStoreCertified.{0,v} fuel receipt.prepared.signature receipt.prepared.store
+      receipt.prepared.targets witness = true := by
+    simp only [acceptsStoreCertified, receipt.checked, Option.isSome_some]
+  obtain ⟨result, hr, hM⟩ := accepted_store_has_model ha V
+  have he : result = receipt.result := Option.some.inj (hr.symm.trans receipt.checked)
+  subst result
+  exact hM
+
+end StoreReceipt
+
+end Ix.Certified
diff --git a/Ix/Certified/Ixon.lean b/Ix/Certified/Ixon.lean
new file mode 100644
index 000000000..303d1f328
--- /dev/null
+++ b/Ix/Certified/Ixon.lean
@@ -0,0 +1,225 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Ixon
+import Ix.Theory.Certified
+
+/-!
+# Ixon input adapter for the certified profile
+
+This adapter checks table indices, projection ownership/kinds, ordinary Lean
+binder modes, and bounded sharing expansion. It preserves block/member
+positions and constructor metadata, including checked constructor positions.
+Natural literals use a separately authenticated canonical blob table.
+Lets and strings are not enabled here. Semantic admission independently
+restricts inductive shapes. Byte authentication and the public claim binding
+are separate from this structural adapter.
+-/
+
+namespace Ix.Certified
+
+open Ix.Theory
+open Ix.Theory.Certified
+
+instance addressDecidableEq : DecidableEq Address := fun a b =>
+  if h : a.hash = b.hash then
+    .isTrue (by cases a; cases b; cases h; rfl)
+  else .isFalse (fun he => h (congrArg Address.hash he))
+
+def lookup (entries : List (Address × α)) (address : Address) : Option α :=
+  match entries with
+  | [] => none
+  | (key, value) :: rest => if address = key then some value else lookup rest address
+
+theorem lookup_isSome (entries : List (Address × α)) (address : Address) :
+    (lookup entries address).isSome ↔ address ∈ entries.map Prod.fst := by
+  induction entries with
+  | nil => simp [lookup]
+  | cons entry rest ih =>
+    obtain ⟨key, value⟩ := entry
+    by_cases h : address = key <;> simp_all [lookup]
+
+def readLevel : Ixon.Univ → VLevel
+  | .zero => .zero
+  | .succ u => .succ (readLevel u)
+  | .max u v => .max (readLevel u) (readLevel v)
+  | .imax u v => .imax (readLevel u) (readLevel v)
+  | .var i => .param i.toNat
+
+abbrev Objects := List (Address × Ixon.Constant)
+abbrev Naturals := List (Address × Nat)
+
+def mutMember? (objects : Objects) (block : Address) (index : UInt64) : Option Ixon.MutConst := do
+  let source ← lookup objects block
+  let .muts members := source.info | none
+  members[index.toNat]?
+
+/-- Projection wrappers must refer to the matching source member kind. -/
+def resolveReference? (objects : Objects) (address : Address) : Option (ConstRef Address) := do
+  let source ← lookup objects address
+  match source.info with
+  | .defn _ | .recr _ | .axio _ | .quot _ => some (.member address 0)
+  | .iPrj projection => do
+    let .indc _ ← mutMember? objects projection.block projection.idx | none
+    return .member projection.block projection.idx.toNat
+  | .rPrj projection => do
+    let .recr _ ← mutMember? objects projection.block projection.idx | none
+    return .member projection.block projection.idx.toNat
+  | .dPrj projection => do
+    let .defn _ ← mutMember? objects projection.block projection.idx | none
+    return .member projection.block projection.idx.toNat
+  | .cPrj projection => do
+    let .indc family ← mutMember? objects projection.block projection.idx | none
+    let _ ← family.ctors[projection.cidx.toNat]?
+    return .ctor projection.block projection.idx.toNat projection.cidx.toNat
+  | .muts _ => none
+
+def readLevels? (source : Ixon.Constant) (indices : Array UInt64) : Option (List VLevel) :=
+  indices.toList.mapM fun index => (source.univs[index.toNat]?).map readLevel
+
+def readExpr? (fuel : Nat) (objects : Objects) (naturals : Naturals) (block : Address) (source : Ixon.Constant) :
+    Ixon.Expr → Option (VExpr Address) :=
+  match fuel with
+  | 0 => fun _ => none
+  | fuel + 1 => fun expression =>
+    match expression with
+    | .var index => some (.bvar index.toNat)
+    | .sort index => (source.univs[index.toNat]?).map (VExpr.sort ∘ readLevel)
+    | .ref index levels => do
+      let address ← source.refs[index.toNat]?
+      let reference ← resolveReference? objects address
+      let levels ← readLevels? source levels
+      return .const reference levels
+    | .recur index levels => do
+      let levels ← readLevels? source levels
+      return .const (.member block index.toNat) levels
+    | .app f a => do
+      let f ← readExpr? fuel objects naturals block source f
+      let a ← readExpr? fuel objects naturals block source a
+      return .app f a
+    | .lam .many A b => do
+      let A ← readExpr? fuel objects naturals block source A
+      let b ← readExpr? fuel objects naturals block source b
+      return .lam A b
+    | .all .many .shared A B => do
+      let A ← readExpr? fuel objects naturals block source A
+      let B ← readExpr? fuel objects naturals block source B
+      return .forallE A B
+    | .prj owner field value => do
+      let address ← source.refs[owner.toNat]?
+      let ownerSource ← lookup objects address
+      let .iPrj _ := ownerSource.info | none
+      let reference ← resolveReference? objects address
+      let value ← readExpr? fuel objects naturals block source value
+      return .proj reference field.toNat value
+    | .nat index => do
+      let address ← source.refs[index.toNat]?
+      return .natLit (← lookup naturals address)
+    | .share index => do
+      let shared ← source.sharing[index.toNat]?
+      readExpr? fuel objects naturals block source shared
+    | _ => none
+
+def readSafety : Ix.DefinitionSafety → Safety
+  | .safe => .safe
+  | .unsaf => .unsafe
+  | .part => .partial
+
+def readDefKind : Ix.DefKind → Ix.Theory.DefKind
+  | .defn => .definition
+  | .thm => .theorem
+  | .opaq => .opaque
+
+def readQuotKind : Ix.QuotKind → Ix.Theory.QuotKind
+  | .type => .type
+  | .ctor => .ctor
+  | .lift => .lift
+  | .ind => .ind
+
+def readDefinition? (fuel : Nat) (objects : Objects) (naturals : Naturals) (block : Address)
+    (source : Ixon.Constant) (definition : Ixon.Definition) : Option (Const Address) := do
+  let type ← readExpr? fuel objects naturals block source definition.typ
+  let body ← readExpr? fuel objects naturals block source definition.value
+  return .defn definition.lvls.toNat (readDefKind definition.kind) type body
+    (readSafety definition.safety)
+
+def readRecursor? (fuel : Nat) (objects : Objects) (naturals : Naturals) (block : Address)
+    (source : Ixon.Constant) (recursor : Ixon.Recursor) : Option (Const Address) := do
+  let type ← readExpr? fuel objects naturals block source recursor.typ
+  let rules ← recursor.rules.toList.mapM fun rule => do
+    let rhs ← readExpr? fuel objects naturals block source rule.rhs
+    return (⟨rule.fields.toNat, rhs⟩ : RecRule Address)
+  return .recursor recursor.lvls.toNat recursor.params.toNat recursor.indices.toNat
+    recursor.motives.toNat recursor.minors.toNat type rules recursor.k
+    (if recursor.isUnsafe then .unsafe else .safe)
+
+def readInductive? (fuel : Nat) (objects : Objects) (naturals : Naturals) (block : Address)
+    (source : Ixon.Constant) (family : Ixon.Inductive) : Option (Const Address) := do
+  let type ← readExpr? fuel objects naturals block source family.typ
+  let constructors ← family.ctors.toList.zipIdx.mapM fun (ctor, index) => do
+    if ctor.cidx.toNat != index then none else do
+      let type ← readExpr? fuel objects naturals block source ctor.typ
+      return (⟨ctor.lvls.toNat, ctor.params.toNat, ctor.fields.toNat, type,
+        if ctor.isUnsafe then .unsafe else .safe⟩ : Ctor Address)
+  return .induct family.lvls.toNat family.params.toNat family.indices.toNat
+    type constructors (if family.isUnsafe then .unsafe else .safe)
+
+def readMutualMember? (fuel : Nat) (objects : Objects) (naturals : Naturals) (block : Address)
+    (source : Ixon.Constant) : Ixon.MutConst → Option (Const Address)
+  | .defn definition => readDefinition? fuel objects naturals block source definition
+  | .recr recursor => readRecursor? fuel objects naturals block source recursor
+  | .indc family => readInductive? fuel objects naturals block source family
+
+def readBlock? (fuel : Nat) (objects : Objects) (naturals : Naturals) (block : Address)
+    (source : Ixon.Constant) : Option (Block Address) :=
+  match source.info with
+  | .defn definition => do return ⟨[← readDefinition? fuel objects naturals block source definition]⟩
+  | .recr recursor => do return ⟨[← readRecursor? fuel objects naturals block source recursor]⟩
+  | .axio declaration => do
+    let type ← readExpr? fuel objects naturals block source declaration.typ
+    return ⟨[.axiom declaration.lvls.toNat type (if declaration.isUnsafe then .unsafe else .safe)]⟩
+  | .quot quotient => do
+    let type ← readExpr? fuel objects naturals block source quotient.typ
+    return ⟨[.quot (readQuotKind quotient.kind) quotient.lvls.toNat type]⟩
+  | .muts members => do
+    return ⟨← members.toList.mapM (readMutualMember? fuel objects naturals block source)⟩
+  | _ => none
+
+def isProjection : Ixon.ConstantInfo → Bool
+  | .iPrj _ | .rPrj _ | .dPrj _ | .cPrj _ => true
+  | _ => false
+
+def readBlocks? (fuel : Nat) (objects : Objects) (naturals : Naturals) :
+    Objects → Option (List (Address × Block Address))
+  | [] => some []
+  | (address, source) :: rest => do
+    if isProjection source.info then
+      let _ ← resolveReference? objects address
+      readBlocks? fuel objects naturals rest
+    else
+      let block ← readBlock? fuel objects naturals address source
+      let rest ← readBlocks? fuel objects naturals rest
+      return (address, block) :: rest
+
+def readStore? (fuel : Nat) (objects : Objects) (naturals : Naturals := []) : Option (Store Address) := do
+  if (objects.map Prod.fst).Nodup then
+    let blocks ← readBlocks? fuel objects naturals objects
+    if h : (blocks.map Prod.fst).Nodup then
+      return ⟨blocks.map Prod.fst, h, lookup blocks, lookup_isSome blocks⟩
+    else none
+  else none
+
+def readProofInput? (fuel : Nat) (objects : Objects) (target : Address)
+    (naturals : Naturals := []) :
+    Option (ProofInput Address) := do
+  let store ← readStore? fuel objects naturals
+  let reference ← resolveReference? objects target
+  let declaration ← store.lookup reference
+  if declaration.uvars ≤ fuel then
+    return ⟨store, declaration.uvars, .const reference (VLevel.params declaration.uvars),
+      declaration.type⟩
+  else none
+
+end Ix.Certified
diff --git a/Ix/Certified/Main.lean b/Ix/Certified/Main.lean
new file mode 100644
index 000000000..0570b7cec
--- /dev/null
+++ b/Ix/Certified/Main.lean
@@ -0,0 +1,8 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Command
+
+def main := Ix.Certified.Command.main
diff --git a/Ix/Certified/ModelHints.lean b/Ix/Certified/ModelHints.lean
new file mode 100644
index 000000000..4d65dec82
--- /dev/null
+++ b/Ix/Certified/ModelHints.lean
@@ -0,0 +1,104 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Bytes
+import Ix.Theory.Certificate.Modeled
+
+/-! Optional untrusted model-package hints refer to actual stored objects.
+No mathematical declaration is imported from JSON: model definitions and
+equation proofs come from the selected authenticated source store and are
+admitted before the original block by the ordinary certified checker. -/
+
+namespace Ix.Certified
+
+open Ix.Theory
+
+structure ModelProofHint where
+  equality : Address
+  reflexivity : Address
+  eliminator : Address
+  proof : Address
+
+structure ModelRuleHints where
+  owner : Address
+  proofs : List (Option ModelProofHint)
+
+structure ModelHint where
+  source : Address
+  recursors : List Address
+  targets : List Address
+  proofs : List ModelRuleHints := []
+
+def modelCandidate? (objects : Objects) (store : Store Address) (hint : ModelHint) :
+    Option (Certificate.Modeled.Candidate Address) := do
+  let recursors ← hint.recursors.mapM (resolveReference? objects)
+  let targets ← hint.targets.mapM (resolveReference? objects)
+  let proofs ← hint.proofs.mapM fun rules => do
+    let owner ← resolveReference? objects rules.owner
+    let universes ← store.uvars owner
+    let proofs ← rules.proofs.mapM fun proof => proof.mapM fun proof => do
+      let equality ← resolveReference? objects proof.equality
+      let reflexivity ← resolveReference? objects proof.reflexivity
+      let eliminator ← resolveReference? objects proof.eliminator
+      let ref ← resolveReference? objects proof.proof
+      return (⟨equality, reflexivity, eliminator,
+        .const ref ((List.range universes).map VLevel.param)⟩ : Certificate.Modeled.ProofHint Address)
+    return (owner, proofs)
+  return ⟨hint.source, recursors, targets, proofs⟩
+
+def modelCandidates? (objects : Objects) (store : Store Address) (hints : List ModelHint) :
+    Option (List (Certificate.Modeled.Candidate Address)) := hints.mapM (modelCandidate? objects store)
+
+namespace ModelHint
+
+def address (value : String) : Except String Address :=
+  match Address.fromString value with
+  | none => .error "expected a 32-byte hexadecimal model address"
+  | some address => .ok address
+
+def readProof (json : Lean.Json) : Except String ModelProofHint := do
+  return ⟨← address (← json.getObjValAs? String "equality"),
+    ← address (← json.getObjValAs? String "reflexivity"),
+    ← address (← json.getObjValAs? String "eliminator"),
+    ← address (← json.getObjValAs? String "proof")⟩
+
+def readRules (json : Lean.Json) : Except String ModelRuleHints := do
+  let owner ← address (← json.getObjValAs? String "owner")
+  let values ← json.getObjValAs? (List (Option Lean.Json)) "proofs"
+  let proofs ← values.mapM (Option.mapM readProof)
+  return ⟨owner, proofs⟩
+
+def read (json : Lean.Json) : Except String ModelHint := do
+  let source ← address (← json.getObjValAs? String "source")
+  let recursors ← (← json.getObjValAs? (List String) "recursors").mapM address
+  let targets ← (← json.getObjValAs? (List String) "targets").mapM address
+  let proofs ← match json.getObjVal? "proofs" with
+    | .error _ => pure []
+    | .ok values => (← values.getArr?).toList.mapM readRules
+  return ⟨source, recursors, targets, proofs⟩
+
+def readOptional (json : Lean.Json) : Except String (List ModelHint) := do
+  match json.getObjVal? "models" with
+  | .error _ => pure []
+  | .ok models => (← models.getArr?).toList.mapM read
+
+def proofJson (hint : ModelProofHint) : Lean.Json := Lean.Json.mkObj [
+  ("equality", Lean.toJson (hexOfBytes hint.equality.hash)),
+  ("reflexivity", Lean.toJson (hexOfBytes hint.reflexivity.hash)),
+  ("eliminator", Lean.toJson (hexOfBytes hint.eliminator.hash)),
+  ("proof", Lean.toJson (hexOfBytes hint.proof.hash))]
+
+def rulesJson (hint : ModelRuleHints) : Lean.Json := Lean.Json.mkObj [
+  ("owner", Lean.toJson (hexOfBytes hint.owner.hash)),
+  ("proofs", Lean.toJson (hint.proofs.map (Option.map proofJson)))]
+
+def json (hint : ModelHint) : Lean.Json := Lean.Json.mkObj [
+  ("source", Lean.toJson (hexOfBytes hint.source.hash)),
+  ("recursors", Lean.toJson (hint.recursors.map (hexOfBytes ·.hash))),
+  ("targets", Lean.toJson (hint.targets.map (hexOfBytes ·.hash))),
+  ("proofs", Lean.toJson (hint.proofs.map rulesJson))]
+
+end ModelHint
+end Ix.Certified
diff --git a/Ix/Certified/ModeledAudit.lean b/Ix/Certified/ModeledAudit.lean
new file mode 100644
index 000000000..738fe740b
--- /dev/null
+++ b/Ix/Certified/ModeledAudit.lean
@@ -0,0 +1,56 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.AuditSupport
+import Ix.Certified.ClaimCommand
+import Ix.Certified.Command
+
+/-! Trust, runtime and premise inventory of the versioned semantic claim
+checker, source command and actual TcM acceptance boundary. -/
+
+open Lean Lean.Elab Command
+
+namespace Ix.Certified.ModeledAudit
+
+def roots : Array Lean.Name := #[
+  `Ix.Theory.Certified.Modeled.check?_sound,
+  `Ix.Theory.Certified.Modeled.checkEquation?_sound,
+  `Ix.Theory.Certified.Modeled.assignment_realizes,
+  `Ix.Theory.Certified.Modeled.assignment_agrees,
+  `Ix.Theory.Certified.checkModeledExtension?,
+  `Ix.Theory.Certificate.Modeled.witness?,
+  `Ix.Theory.Certificate.sourceGroup?,
+  `Ix.Theory.Certificate.proofWitness?,
+  `Ix.Certified.modelCandidate?, `Ix.Certified.modelCandidates?,
+  `Ix.Certified.ModelHint.readOptional, `Ix.Certified.ModelHint.read,
+  `Ix.Certified.suggestSource?, `Ix.Certified.suggestStore?,
+  `Ix.Certified.Command.readRequest, `Ix.Certified.Command.run_success,
+  `Ix.Certified.suggestLogical?, `Ix.Certified.ClaimCommand.readRequest,
+  `Ix.Certified.ClaimCommand.run_meaning,
+  `Ix.Kernel.acceptsCertifiedSource, `Ix.Kernel.acceptsCertifiedStoreSource,
+  `Ix.Kernel.accepted_tc_claim_meaning]
+
+def premises : Array Lean.Name := #[
+  `Ix.Certified.Protocol.current,
+  `Ix.Certified.ModelHint.mk, `Ix.Certified.ModelRuleHints.mk,
+  `Ix.Certified.ModelProofHint.mk,
+  `Ix.Theory.Certificate.Modeled.Candidate.mk,
+  `Ix.Theory.Certificate.Modeled.ProofHint.mk,
+  `Ix.Theory.Certified.Modeled.Witness.mk,
+  `Ix.Theory.Certified.Modeled.Checked.mk,
+  `Ix.Theory.Certified.Modeled.SourceMatches,
+  `Ix.Theory.Certified.Modeled.sourceRefs?,
+  `Ix.Theory.Certified.Modeled.recursorSource?,
+  `Ix.Theory.Certified.Modeled.majorSource?,
+  `Ix.Theory.Certified.Modeled.ruleSource?,
+  `Ix.Theory.Certified.Modeled.Companion.entry,
+  `Ix.Theory.Certified.Modeled.CompanionChecked.mk,
+  `Ix.Theory.Certified.Modeled.CheckedCompanions.mk,
+  `Ix.Theory.Certified.Modeled.CheckedEquation.mk,
+  `Ix.Theory.Certified.Modeled.checkEquation?]
+
+run_cmd AuditSupport.report "modeled source" roots premises
+
+end Ix.Certified.ModeledAudit
diff --git a/Ix/Certified/NOTICE b/Ix/Certified/NOTICE
new file mode 100644
index 000000000..5f678355b
--- /dev/null
+++ b/Ix/Certified/NOTICE
@@ -0,0 +1,22 @@
+Certified source and claim adapters
+
+Copyright (c) 2026 Argument Computer Corporation.
+Licensed under MIT OR Apache-2.0; see LICENSE-MIT and LICENSE-APACHE at the
+repository root.
+
+The cumulative C2-C7 adapters were reconstructed from the authenticated
+ix-pilot.patch and ix-c3.patch through ix-c7.patch supplied with the former
+Lean4Ix consistency work. Original adapter files, patches, source identities,
+reports, licenses and differential fixtures are retained in
+Tests/Fixtures/Certified/c7-handoff.tar.gz. Individual source and maintained
+file identities appear in Tests/Certified/ImportManifest.lean.
+
+Maintained theory imports use Ix.Theory, and the checker wrappers use
+Ix.Kernel. The five historical audits now traverse full checked declaration
+graphs and transitive runtime workers. The unused historical native profiling
+counter module is preserved in the archive but is not maintained or linked.
+
+The set model and its separate attribution are maintained under Ix/Theory.
+The old checkout is not a build or test dependency. This handoff archive
+contains the selected adapter sources and regression evidence, not the
+complete historical Ix base checkout.
diff --git a/Ix/Certified/Packet.lean b/Ix/Certified/Packet.lean
new file mode 100644
index 000000000..7a3c8466e
--- /dev/null
+++ b/Ix/Certified/Packet.lean
@@ -0,0 +1,185 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Bytes
+import Ix.Aiur.Semantics.BytecodeFfi
+
+/-!
+Untrusted certificate packet producer for the C2 Aiur pilot. It reads source
+declarations from the decoded input store and transports the exact proposed
+rule witnesses. It does not run the semantic checker. All words are checked
+before field conversion, and the VM independently checks the same bounds.
+-/
+
+namespace Ix.Certified.Packet
+
+open Ix.Theory Ix.Theory.Certified Model
+
+abbrev Emit := StateT (Array Nat) (Except String)
+
+def nat (n : Nat) : Emit Unit := do
+  if n ≥ 65536 then throw "certificate scalar exceeds the pilot bound"
+  modify (·.push n)
+
+def bool (b : Bool) : Emit Unit := nat (if b then 1 else 0)
+
+def address (a : Address) : Emit Unit := do
+  if a.hash.size != 32 then throw "certificate address is not 32 bytes"
+  for byte in a.hash.data do nat byte.toNat
+
+def ref : ConstRef Address → Emit Unit
+  | .member a i => nat 0 *> address a *> nat i
+  | .ctor a i j => nat 1 *> address a *> nat i *> nat j
+
+def list (emit : α → Emit Unit) (xs : List α) : Emit Unit := do
+  nat xs.length
+  xs.forM emit
+
+def condition : PropWhen → Emit Unit
+  | .never => nat 0
+  | .allZero xs _ => nat 1 *> list nat xs
+
+def level : VLevel → Emit Unit
+  | .zero => nat 0
+  | .succ l => nat 1 *> level l
+  | .max a b => nat 2 *> level a *> level b
+  | .imax a b => nat 3 *> level a *> level b
+  | .param i => nat 4 *> nat i
+
+def expr : AExpr Address → Emit Unit
+  | .sort l => nat 0 *> level l
+  | .bvar i => nat 1 *> nat i
+  | .const r ls => nat 2 *> ref r *> list level ls
+  | .app f a => nat 3 *> expr f *> expr a
+  | .lam p a b => nat 4 *> condition p *> expr a *> expr b
+  | .forallE p a b => nat 5 *> condition p *> expr a *> expr b
+  | .proj .. | .natLit .. => throw "unsupported expression in the C2 pilot"
+
+def sourceExpr : VExpr Address → Emit Unit
+  | .sort l => nat 0 *> level l
+  | .bvar i => nat 1 *> nat i
+  | .const r ls => nat 2 *> ref r *> list level ls
+  | .app f a => nat 3 *> sourceExpr f *> sourceExpr a
+  | .lam a b => nat 4 *> nat 0 *> sourceExpr a *> sourceExpr b
+  | .forallE a b => nat 5 *> nat 0 *> sourceExpr a *> sourceExpr b
+  | .proj .. | .natLit .. => throw "unsupported source expression in the C2 pilot"
+
+mutual
+def typing : TypingWitness Address → Emit Unit
+  | .sort => nat 0
+  | .bvar => nat 1
+  | .const => nat 2
+  | .app p d b wf wa =>
+    nat 3 *> condition p *> expr d *> expr b *> typing wf *> typing wa
+  | .lam ld lb b wd wb wt =>
+    nat 4 *> level ld *> level lb *> expr b *> typing wd *> typing wb *> typing wt
+  | .forallE ld lb wd wb => nat 5 *> level ld *> level lb *> typing wd *> typing wb
+  | .fact .. | .natLit .. | .betaResult .. => throw "semantic facts require the expanded VM profile"
+  | .conv b la we wa wc => nat 6 *> expr b *> level la *> typing we *> typing wa *> conversion wc
+
+def conversion : ConversionWitness Address → Emit Unit
+  | .refl => nat 0
+  | .symm w => nat 1 *> conversion w
+  | .trans c wl wr => nat 2 *> expr c *> conversion wl *> conversion wr
+  | .app wf wa => nat 3 *> conversion wf *> conversion wa
+  | .lam ld wd wa wb => nat 4 *> level ld *> typing wd *> conversion wa *> conversion wb
+  | .forallE ld wd wa wb => nat 5 *> level ld *> typing wd *> conversion wa *> conversion wb
+  | .beta t wl wa => nat 6 *> expr t *> typing wl *> typing wa
+  | .eta b wf => nat 7 *> expr b *> typing wf
+  | .proofIrrel a wt wa wb => nat 8 *> expr a *> typing wt *> typing wa *> typing wb
+  | .delta => nat 9
+  | .sort => nat 10
+  | .proj .. | .natLiteral .. => throw "projection and literal conversions require the expanded VM profile"
+  | .equation .. => throw "ordinary equations require the expanded VM profile"
+end
+
+def safety : Safety → Emit Unit
+  | .safe => nat 0
+  | .unsafe => nat 1
+  | .partial => nat 2
+
+def kind : Ix.Theory.DefKind → Emit Unit
+  | .definition => nat 0
+  | .theorem => nat 1
+  | .opaque => nat 2
+
+def source : Const Address → Emit Unit
+  | .axiom n t s => nat 0 *> nat n *> sourceExpr t *> safety s
+  | .defn n k t b s => nat 1 *> nat n *> kind k *> sourceExpr t *> sourceExpr b *> safety s
+  | .induct n p i t cs s =>
+    nat 2 *> nat n *> nat p *> nat i *> sourceExpr t *> nat cs.length *> safety s
+  | .recursor n p i m b t rs k s =>
+    nat 3 *> nat n *> nat p *> nat i *> nat m *> nat b *> sourceExpr t *>
+      nat rs.length *> bool k *> safety s
+  | .quot .. => nat 4
+
+def lookup (input : ProofInput Address) (r : ConstRef Address) : Emit (Const Address) := do
+  match input.store.lookup r with
+  | none => throw "missing source declaration"
+  | some declaration => pure declaration
+
+def definition (input : ProofInput Address) (w : DefinitionWitness Address) : Emit Unit := do
+  ref w.ref
+  let declaration ← lookup input w.ref
+  source declaration
+  -- Reading only connects occurrence annotations to source syntax. All
+  -- semantic rule checks still run in Aiur, including unsafe/kind rejection.
+  let .defn n _ t b _ := declaration
+    | throw "a definition packet requires a source body"
+  let some t ← pure (readAnnotations? n 0 t w.typeAnnotations)
+    | throw "cannot read the proposed type annotations"
+  let some b ← pure (readAnnotations? n 0 b w.bodyAnnotations)
+    | throw "cannot read the proposed body annotations"
+  expr t.val
+  expr b.val
+  level w.typeLevel
+  typing w.typeWitness
+  typing w.bodyWitness
+
+def emit (signature : PrimitiveSignature Address) (input : ProofInput Address)
+    (w : ProofWitness Address) : Emit Unit := do
+  if signature.natType.isSome then throw "natural primitives require the expanded VM profile"
+  nat 1
+  source (← lookup input signature.falseType)
+  source (← lookup input signature.falseElim)
+  list (fun declaration => match declaration with
+    | .definition witness => definition input witness
+    | .ordinary _ => throw "ordinary blocks require the expanded VM profile"
+    | .standard _ => throw "standard axioms require the expanded VM profile"
+    | .quotient _ => throw "quotients require the expanded VM profile"
+    | .structure _ => throw "structures require the expanded VM profile"
+    | .natural _ => throw "natural primitives require the expanded VM profile"
+    | .modeled _ => throw "modeled blocks require the expanded VM profile") w.declarations
+  nat input.universes
+  sourceExpr input.proof
+  sourceExpr input.proposition
+  let some e ← pure (readAnnotations? input.universes 0 input.proof w.proofAnnotations)
+    | throw "cannot read the proposed proof annotations"
+  let some p ← pure (readAnnotations? input.universes 0 input.proposition w.propositionAnnotations)
+    | throw "cannot read the proposed proposition annotations"
+  expr e.val
+  expr p.val
+  typing w.proofWitness
+  typing w.propositionWitness
+
+def words (signature : PrimitiveSignature Address) (input : ProofInput Address)
+    (w : ProofWitness Address) : Except String (Array Nat) := do
+  let (_, result) ← emit signature input w #[]
+  if result.size ≥ 65536 then throw "certificate packet exceeds the pilot bound"
+  return result
+
+def args (signature : PrimitiveSignature Address) : Except String (Array Aiur.G) := do
+  if signature.natType.isSome then throw "natural primitives require the expanded VM profile"
+  let .member f i := signature.falseType | throw "False must be a block member"
+  let .member e j := signature.falseElim | throw "False.elim must be a block member"
+  if f.hash.size != 32 || e.hash.size != 32 || i ≥ 65536 || j ≥ 65536 then
+    throw "primitive signature exceeds the pilot bounds"
+  return (f.hash.data.map (.ofNat ∘ UInt8.toNat)).push (.ofNat i) ++
+    (e.hash.data.map (.ofNat ∘ UInt8.toNat)).push (.ofNat j)
+
+def ioBuffer (words : Array Nat) : Aiur.IOBuffer :=
+  (default : Aiur.IOBuffer).extend 17 #[0] (words.map Aiur.G.ofNat)
+
+end Ix.Certified.Packet
diff --git a/Ix/Certified/Reveal.lean b/Ix/Certified/Reveal.lean
new file mode 100644
index 000000000..993a492ca
--- /dev/null
+++ b/Ix/Certified/Reveal.lean
@@ -0,0 +1,155 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.ClaimMeaning
+
+namespace Ix.Certified
+
+def Selected {α : Type _} (expected : Option α) (actual : α) : Prop :=
+  match expected with
+  | none => True
+  | some value => value = actual
+
+instance {α : Type _} [DecidableEq α] (expected : Option α) (actual : α) :
+    Decidable (Selected expected actual) := by
+  unfold Selected
+  split <;> infer_instance
+
+/-- The structural reveal protocol commits to the exact serialized raw
+expression, including its original table indices and sharing references. -/
+def expressionAddress (expression : Ixon.Expr) : Address :=
+  Address.blake3 (Ixon.runPut (Ixon.putExpr expression))
+
+def ConstructorMatches (expected : Ix.RevealConstructorInfo) (actual : Ixon.Constructor) : Prop :=
+  Selected expected.isUnsafe actual.isUnsafe ∧ Selected expected.lvls actual.lvls ∧
+    Selected expected.cidx actual.cidx ∧ Selected expected.params actual.params ∧
+    Selected expected.fields actual.fields ∧ Selected expected.typ (expressionAddress actual.typ)
+
+instance (expected : Ix.RevealConstructorInfo) (actual : Ixon.Constructor) :
+    Decidable (ConstructorMatches expected actual) := inferInstanceAs (Decidable (_ ∧ _ ∧ _ ∧ _ ∧ _ ∧ _))
+
+def ConstructorsMatch (expected : Option (Array (UInt64 × Ix.RevealConstructorInfo)))
+    (actual : Array Ixon.Constructor) : Prop :=
+  match expected with
+  | none => True
+  | some constructors => ∀ pair ∈ constructors.toList,
+    match actual[pair.1.toNat]? with
+    | none => False
+    | some constructor => ConstructorMatches pair.2 constructor
+
+instance (expected : Option (Array (UInt64 × Ix.RevealConstructorInfo))) (actual : Array Ixon.Constructor) :
+    Decidable (ConstructorsMatch expected actual) := by
+  unfold ConstructorsMatch
+  split
+  · infer_instance
+  · apply @List.decidableBAll _ _ (fun pair => by split <;> infer_instance)
+
+def RulesMatch (expected : Option (Array Ix.RevealRecursorRule)) (actual : Array Ixon.RecursorRule) : Prop :=
+  match expected with
+  | none => True
+  | some rules => ∀ rule ∈ rules.toList,
+    match actual[rule.ruleIdx.toNat]? with
+    | none => False
+    | some actual => rule.fields = actual.fields ∧ rule.rhs = expressionAddress actual.rhs
+
+instance (expected : Option (Array Ix.RevealRecursorRule)) (actual : Array Ixon.RecursorRule) :
+    Decidable (RulesMatch expected actual) := by
+  unfold RulesMatch
+  split
+  · infer_instance
+  · apply @List.decidableBAll _ _ (fun rule => by split <;> infer_instance)
+
+def MutMatches (expected : Ix.RevealMutConstInfo) (actual : Ixon.MutConst) : Prop :=
+  match expected, actual with
+  | .defn kind safety levels type value, .defn actual =>
+    Selected kind actual.kind ∧ Selected safety actual.safety ∧ Selected levels actual.lvls ∧
+      Selected type (expressionAddress actual.typ) ∧ Selected value (expressionAddress actual.value)
+  | .indc safety levels params indices type ctors, .indc actual =>
+    Selected safety actual.isUnsafe ∧ Selected levels actual.lvls ∧ Selected params actual.params ∧
+      Selected indices actual.indices ∧ Selected type (expressionAddress actual.typ) ∧ ConstructorsMatch ctors actual.ctors
+  | .recr k safety levels params indices motives minors type rules, .recr actual =>
+    Selected k actual.k ∧ Selected safety actual.isUnsafe ∧ Selected levels actual.lvls ∧
+      Selected params actual.params ∧ Selected indices actual.indices ∧ Selected motives actual.motives ∧
+      Selected minors actual.minors ∧ Selected type (expressionAddress actual.typ) ∧ RulesMatch rules actual.rules
+  | _, _ => False
+
+instance (expected : Ix.RevealMutConstInfo) (actual : Ixon.MutConst) : Decidable (MutMatches expected actual) := by
+  unfold MutMatches
+  cases expected <;> cases actual <;> infer_instance
+
+def ComponentsMatch (expected : Array (UInt64 × Ix.RevealMutConstInfo)) (actual : Array Ixon.MutConst) : Prop :=
+  ∀ pair ∈ expected.toList, match actual[pair.1.toNat]? with
+    | none => False
+    | some member => MutMatches pair.2 member
+
+instance (expected : Array (UInt64 × Ix.RevealMutConstInfo)) (actual : Array Ixon.MutConst) :
+    Decidable (ComponentsMatch expected actual) := by
+  unfold ComponentsMatch
+  apply @List.decidableBAll _ _ (fun pair => by split <;> infer_instance)
+
+def RevealMatches (expected : Ix.RevealConstantInfo) (actual : Ixon.ConstantInfo) : Prop :=
+  match expected, actual with
+  | .defn kind safety levels type value, .defn actual =>
+    Selected kind actual.kind ∧ Selected safety actual.safety ∧ Selected levels actual.lvls ∧
+      Selected type (expressionAddress actual.typ) ∧ Selected value (expressionAddress actual.value)
+  | .recr k safety levels params indices motives minors type rules, .recr actual =>
+    Selected k actual.k ∧ Selected safety actual.isUnsafe ∧ Selected levels actual.lvls ∧
+      Selected params actual.params ∧ Selected indices actual.indices ∧ Selected motives actual.motives ∧
+      Selected minors actual.minors ∧ Selected type (expressionAddress actual.typ) ∧ RulesMatch rules actual.rules
+  | .axio safety levels type, .axio actual =>
+    Selected safety actual.isUnsafe ∧ Selected levels actual.lvls ∧ Selected type (expressionAddress actual.typ)
+  | .quot kind levels type, .quot actual =>
+    Selected kind actual.kind ∧ Selected levels actual.lvls ∧ Selected type (expressionAddress actual.typ)
+  | .cPrj index constructor block, .cPrj actual =>
+    Selected index actual.idx ∧ Selected constructor actual.cidx ∧ Selected block actual.block
+  | .iPrj index block, .iPrj actual | .rPrj index block, .rPrj actual | .dPrj index block, .dPrj actual =>
+    Selected index actual.idx ∧ Selected block actual.block
+  | .muts components, .muts actual => ComponentsMatch components actual
+  | _, _ => False
+
+instance (expected : Ix.RevealConstantInfo) (actual : Ixon.ConstantInfo) : Decidable (RevealMatches expected actual) := by
+  unfold RevealMatches
+  cases expected <;> cases actual <;> infer_instance
+
+structure RevealWitness where
+  opening : Ixon.Comm
+
+structure RevealReceipt (source : Ixon.Env) (commitment : Address) (info : Ix.RevealConstantInfo)
+    (witness : RevealWitness) where
+  secretSize : witness.opening.secret.hash.size = 32
+  payloadSize : witness.opening.payload.hash.size = 32
+  bound : witness.opening.commit = commitment
+  object : SourceObject source
+  payload : object.address = witness.opening.payload
+  fields : RevealMatches info object.decoded.val.info
+
+def checkReveal? (source : Ixon.Env) (commitment : Address) (info : Ix.RevealConstantInfo)
+    (witness : RevealWitness) : Read source (RevealReceipt source commitment info witness) :=
+  if hs : witness.opening.secret.hash.size = 32 then
+    if hp : witness.opening.payload.hash.size = 32 then
+      if hb : witness.opening.commit = commitment then do
+        let object ← readObject? source witness.opening.payload
+        if ha : object.address = witness.opening.payload then
+          if hf : RevealMatches info object.decoded.val.info then
+            return ⟨hs, hp, hb, object, ha, hf⟩
+          else failure
+        else failure
+      else failure
+    else failure
+  else failure
+
+def RevealMeaning (source : Ixon.Env) (commitment : Address) (info : Ix.RevealConstantInfo) : Prop :=
+  ∃ opening : Ixon.Comm, opening.secret.hash.size = 32 ∧ opening.payload.hash.size = 32 ∧
+    opening.commit = commitment ∧ ∃ bytes object, ObjectBytes source opening.payload bytes object ∧
+      RevealMatches info object.info
+
+theorem RevealReceipt.meaning (receipt : RevealReceipt source commitment info witness) :
+    RevealMeaning source commitment info := by
+  refine ⟨witness.opening, receipt.secretSize, receipt.payloadSize, receipt.bound,
+    receipt.object.bytes, receipt.object.decoded.val, ?_, receipt.fields⟩
+  rw [← receipt.payload]
+  exact ⟨receipt.object.fromSource, receipt.object.decoded.property⟩
+
+end Ix.Certified
diff --git a/Ix/Certified/SourceAudit.lean b/Ix/Certified/SourceAudit.lean
new file mode 100644
index 000000000..110acf5d1
--- /dev/null
+++ b/Ix/Certified/SourceAudit.lean
@@ -0,0 +1,39 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.AuditSupport
+import Ix.Certified.SourceMeaning
+
+/-! The C6 source audit freezes original expression/statement meaning and
+its connection to the actual canonical source bytes. Claim composition and
+backend execution are audited by their separate roots when connected. -/
+
+open Lean Lean.Elab Command
+
+namespace Ix.Certified.SourceAudit
+
+def roots : Array Lean.Name := #[
+  `Ix.Certified.resolveReference_iff, `Ix.Certified.readLevel_value,
+  `Ix.Certified.readExpr_sound, `Ix.Certified.ExprReading.unique,
+  `Ix.Certified.readExpr_fuel_independent,
+  `Ix.Certified.readBlock_sourceHeader, `Ix.Certified.readStore_sourceHeader,
+  `Ix.Certified.SourceSnapshot.object_bytes, `Ix.Certified.SourceSnapshot.natural_bytes,
+  `Ix.Certified.readSignature_sound,
+  `Ix.Certified.StoreReceipt.subject_meaning, `Ix.Certified.SourceReceipt.proposition_meaning,
+  `Ix.Certified.StoreReceipt.subject_coverage]
+
+def premises : Array Lean.Name := #[
+  `Ix.Certified.MemberMeaning, `Ix.Certified.ReferenceTarget, `Ix.Certified.ReferenceMeaning,
+  `Ix.Certified.LevelsReading.nil, `Ix.Certified.LevelsReading.cons,
+  `Ix.Certified.ExprReading.var, `Ix.Certified.ExprReading.sort, `Ix.Certified.ExprReading.ref,
+  `Ix.Certified.ExprReading.recur, `Ix.Certified.ExprReading.app, `Ix.Certified.ExprReading.lam,
+  `Ix.Certified.ExprReading.all, `Ix.Certified.ExprReading.prj, `Ix.Certified.ExprReading.nat,
+  `Ix.Certified.ExprReading.share, `Ix.Certified.rawHeader?,
+  `Ix.Certified.ObjectBytes, `Ix.Certified.NaturalBytes,
+  `Ix.Certified.SignatureReading, `Ix.Certified.SourceDeclarationReading, `Ix.Certified.SubjectReading]
+
+run_cmd AuditSupport.report "source meaning" roots premises
+
+end Ix.Certified.SourceAudit
diff --git a/Ix/Certified/SourceExpr.lean b/Ix/Certified/SourceExpr.lean
new file mode 100644
index 000000000..5f29a49e9
--- /dev/null
+++ b/Ix/Certified/SourceExpr.lean
@@ -0,0 +1,274 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Ixon
+
+/-! Structural meaning of original Ixon expressions. References retain their
+actual table positions and wrapper ownership; sharing expands only through
+the original constant's sharing table. This relation has no typing premise. -/
+
+namespace Ix.Certified
+
+open Ix.Theory
+
+def MemberMeaning (objects : Objects) (block : Address) (index : UInt64)
+    (member : Ixon.MutConst) : Prop :=
+  ∃ source members, lookup objects block = some source ∧ source.info = .muts members ∧
+    members[index.toNat]? = some member
+
+theorem mutMember_iff {objects : Objects} {block : Address} {index : UInt64} {member : Ixon.MutConst} :
+    mutMember? objects block index = some member ↔ MemberMeaning objects block index member := by
+  constructor
+  · intro h
+    unfold mutMember? at h
+    cases hs : lookup objects block with
+    | none => simp [hs] at h
+    | some source =>
+      cases hi : source.info <;> simp [hs, hi] at h
+      exact ⟨source, _, hs, hi, h⟩
+  · rintro ⟨source, members, hs, hi, hm⟩
+    simp [mutMember?, hs, hi, hm]
+
+def ReferenceTarget (objects : Objects) (address : Address) (source : Ixon.Constant)
+    (ref : ConstRef Address) : Prop :=
+  match source.info with
+  | .defn _ | .recr _ | .axio _ | .quot _ => ref = .member address 0
+  | .iPrj projection =>
+    (∃ family, MemberMeaning objects projection.block projection.idx (.indc family)) ∧
+      ref = .member projection.block projection.idx.toNat
+  | .rPrj projection =>
+    (∃ recursor, MemberMeaning objects projection.block projection.idx (.recr recursor)) ∧
+      ref = .member projection.block projection.idx.toNat
+  | .dPrj projection =>
+    (∃ definition, MemberMeaning objects projection.block projection.idx (.defn definition)) ∧
+      ref = .member projection.block projection.idx.toNat
+  | .cPrj projection =>
+    (∃ family ctor, MemberMeaning objects projection.block projection.idx (.indc family) ∧
+      family.ctors[projection.cidx.toNat]? = some ctor) ∧
+      ref = .ctor projection.block projection.idx.toNat projection.cidx.toNat
+  | .muts _ => False
+
+def ReferenceMeaning (objects : Objects) (address : Address) (ref : ConstRef Address) : Prop :=
+  ∃ source, lookup objects address = some source ∧ ReferenceTarget objects address source ref
+
+theorem resolveReference_iff {objects : Objects} {address : Address} {ref : ConstRef Address} :
+    resolveReference? objects address = some ref ↔ ReferenceMeaning objects address ref := by
+  cases hs : lookup objects address with
+  | none => simp [resolveReference?, ReferenceMeaning, hs]
+  | some source =>
+    simp only [ReferenceMeaning, hs, Option.some.injEq]
+    unfold resolveReference?
+    simp only [hs, bind, Option.bind_some]
+    unfold ReferenceTarget
+    rcases source with ⟨info, sharing, references, universes⟩
+    cases info
+    all_goals dsimp only
+    all_goals try solve | simp [eq_comm]
+    all_goals simp only [← mutMember_iff]
+    all_goals rename_i projection
+    all_goals cases hm : mutMember? objects projection.block projection.idx with
+    | none => simp [hm]
+    | some member =>
+      cases member <;> simp [hm, eq_comm, exists_and_left]
+
+      all_goals rename_i family
+      all_goals cases hf : family.ctors[projection.cidx.toNat]? <;> simp [eq_comm]
+
+theorem ReferenceMeaning.unique {objects : Objects} {address : Address} {left right : ConstRef Address}
+    (hl : ReferenceMeaning objects address left) (hr : ReferenceMeaning objects address right) : left = right :=
+  Option.some.inj ((resolveReference_iff.mpr hl).symm.trans (resolveReference_iff.mpr hr))
+
+def sourceLevelValue (levels : List Nat) : Ixon.Univ → Nat
+  | .zero => 0
+  | .succ level => sourceLevelValue levels level + 1
+  | .max left right => max (sourceLevelValue levels left) (sourceLevelValue levels right)
+  | .imax left right =>
+    if sourceLevelValue levels right = 0 then 0 else max (sourceLevelValue levels left) (sourceLevelValue levels right)
+  | .var index => levels.getD index.toNat 0
+
+theorem readLevel_value (level : Ixon.Univ) (levels : List Nat) :
+    (readLevel level).eval levels = sourceLevelValue levels level := by
+  induction level <;> simp_all [readLevel, VLevel.eval, VLevel.natIMax, sourceLevelValue]
+
+inductive LevelsReading (source : Ixon.Constant) : List UInt64 → List VLevel → Prop where
+  | nil : LevelsReading source [] []
+  | cons {index indices level levels} : source.univs[index.toNat]? = some level →
+      LevelsReading source indices levels →
+      LevelsReading source (index :: indices) (readLevel level :: levels)
+
+theorem readLevelsList_sound {source : Ixon.Constant} {indices : List UInt64} {levels : List VLevel}
+    (h : indices.mapM (fun index => (source.univs[index.toNat]?).map readLevel) = some levels) :
+    LevelsReading source indices levels := by
+  induction indices generalizing levels with
+  | nil =>
+    simp at h
+    subst levels
+    exact .nil
+  | cons index indices ih =>
+    cases hi : source.univs[index.toNat]? with
+    | none => simp [List.mapM_cons, hi] at h
+    | some level =>
+      cases ht : indices.mapM (fun index => (source.univs[index.toNat]?).map readLevel) with
+      | none => simp [List.mapM_cons, hi, ht] at h
+      | some tail =>
+        simp [List.mapM_cons, hi, ht] at h
+        subst levels
+        exact .cons hi (ih ht)
+
+theorem readLevels_sound {source : Ixon.Constant} {indices : Array UInt64} {levels : List VLevel}
+    (h : readLevels? source indices = some levels) : LevelsReading source indices.toList levels :=
+  readLevelsList_sound h
+
+theorem LevelsReading.unique {source : Ixon.Constant} {indices : List UInt64} {left right : List VLevel}
+    (hl : LevelsReading source indices left) (hr : LevelsReading source indices right) : left = right := by
+  induction hl generalizing right with
+  | nil => cases hr; rfl
+  | cons hs _ ih =>
+    cases hr with
+    | cons ht hr =>
+      cases Option.some.inj (hs.symm.trans ht)
+      exact congrArg (_ :: ·) (ih hr)
+
+/-- A reading of the original source syntax, including all reference and
+sharing-table lookups. Unsupported binder modes and literal forms have no
+constructor in this relation. -/
+inductive ExprReading (objects : Objects) (naturals : Naturals) (block : Address) (source : Ixon.Constant) :
+    Ixon.Expr → VExpr Address → Prop where
+  | var (index) : ExprReading objects naturals block source (.var index) (.bvar index.toNat)
+  | sort {index level} : source.univs[index.toNat]? = some level →
+      ExprReading objects naturals block source (.sort index) (.sort (readLevel level))
+  | ref {index indices address ref levels} : source.refs[index.toNat]? = some address →
+      ReferenceMeaning objects address ref → LevelsReading source indices.toList levels →
+      ExprReading objects naturals block source (.ref index indices) (.const ref levels)
+  | recur {index indices levels} : LevelsReading source indices.toList levels →
+      ExprReading objects naturals block source (.recur index indices) (.const (.member block index.toNat) levels)
+  | app {f a fr ar} : ExprReading objects naturals block source f fr →
+      ExprReading objects naturals block source a ar →
+      ExprReading objects naturals block source (.app f a) (.app fr ar)
+  | lam {A b Ar br} : ExprReading objects naturals block source A Ar →
+      ExprReading objects naturals block source b br →
+      ExprReading objects naturals block source (.lam .many A b) (.lam Ar br)
+  | all {A B Ar Br} : ExprReading objects naturals block source A Ar →
+      ExprReading objects naturals block source B Br →
+      ExprReading objects naturals block source (.all .many .shared A B) (.forallE Ar Br)
+  | prj {owner field value address ownerSource projection ref reading} :
+      source.refs[owner.toNat]? = some address → lookup objects address = some ownerSource →
+      ownerSource.info = .iPrj projection → ReferenceMeaning objects address ref →
+      ExprReading objects naturals block source value reading →
+      ExprReading objects naturals block source (.prj owner field value) (.proj ref field.toNat reading)
+  | nat {index address value} : source.refs[index.toNat]? = some address → lookup naturals address = some value →
+      ExprReading objects naturals block source (.nat index) (.natLit value)
+  | share {index shared reading} : source.sharing[index.toNat]? = some shared →
+      ExprReading objects naturals block source shared reading →
+      ExprReading objects naturals block source (.share index) reading
+
+theorem readExpr_sound {fuel : Nat} {objects : Objects} {naturals : Naturals} {block : Address}
+    {source : Ixon.Constant} {expression : Ixon.Expr} {reading : VExpr Address}
+    (h : readExpr? fuel objects naturals block source expression = some reading) :
+    ExprReading objects naturals block source expression reading := by
+  induction fuel generalizing expression reading with
+  | zero => simp [readExpr?] at h
+  | succ fuel ih =>
+    cases expression with
+    | var index =>
+      simp [readExpr?] at h
+      subst reading
+      exact .var index
+    | sort index =>
+      simp only [readExpr?, Option.map_eq_some_iff] at h
+      obtain ⟨level, hl, rfl⟩ := h
+      exact .sort hl
+    | ref index indices =>
+      simp only [readExpr?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      obtain ⟨address, ha, ref, hr, levels, hl, rfl⟩ := h
+      exact .ref ha (resolveReference_iff.mp hr) (readLevels_sound hl)
+    | recur index indices =>
+      simp only [readExpr?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      obtain ⟨levels, hl, rfl⟩ := h
+      exact .recur (readLevels_sound hl)
+    | app f a =>
+      simp only [readExpr?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      obtain ⟨fr, hf, ar, ha, rfl⟩ := h
+      exact .app (ih hf) (ih ha)
+    | lam uses A b =>
+      cases uses <;> simp only [readExpr?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      all_goals try contradiction
+      obtain ⟨Ar, hA, br, hb, rfl⟩ := h
+      exact .lam (ih hA) (ih hb)
+    | all uses owned A B =>
+      cases uses <;> cases owned <;>
+        simp only [readExpr?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      all_goals try contradiction
+      obtain ⟨Ar, hA, Br, hB, rfl⟩ := h
+      exact .all (ih hA) (ih hB)
+    | prj owner field value =>
+      simp only [readExpr?, bind, Option.bind_eq_some_iff] at h
+      obtain ⟨address, ha, ownerSource, hs, h⟩ := h
+      cases hp : ownerSource.info <;> simp only [hp] at h
+      all_goals try contradiction
+      simp only [Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      obtain ⟨ref, hr, reading, hv, rfl⟩ := h
+      exact .prj ha hs hp (resolveReference_iff.mp hr) (ih hv)
+    | nat index =>
+      simp only [readExpr?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      obtain ⟨address, ha, value, hv, rfl⟩ := h
+      exact .nat ha hv
+    | share index =>
+      simp only [readExpr?, bind, Option.bind_eq_some_iff] at h
+      obtain ⟨shared, hs, hr⟩ := h
+      exact .share hs (ih hr)
+    | str | letE => simp [readExpr?] at h
+
+/-- The original tables determine one expanded expression. Neither fuel nor
+a different sharing-expansion derivation can change the statement. -/
+theorem ExprReading.unique {objects : Objects} {naturals : Naturals} {block : Address}
+    {source : Ixon.Constant} {expression : Ixon.Expr} {left right : VExpr Address}
+    (hl : ExprReading objects naturals block source expression left)
+    (hr : ExprReading objects naturals block source expression right) : left = right := by
+  induction hl generalizing right with
+  | var => cases hr; rfl
+  | sort hs =>
+    cases hr with
+    | sort ht => cases Option.some.inj (hs.symm.trans ht); rfl
+  | ref ha hm hl =>
+    cases hr with
+    | ref hb hn hr =>
+      cases Option.some.inj (ha.symm.trans hb)
+      exact congr (congrArg VExpr.const (hm.unique hn)) (hl.unique hr)
+  | recur hl =>
+    cases hr with
+    | recur hr => exact congrArg (VExpr.const _) (hl.unique hr)
+  | app _ _ ihf iha =>
+    cases hr with
+    | app hf ha => exact congr (congrArg VExpr.app (ihf hf)) (iha ha)
+  | lam _ _ ihA ihb =>
+    cases hr with
+    | lam hA hb => exact congr (congrArg VExpr.lam (ihA hA)) (ihb hb)
+  | all _ _ ihA ihB =>
+    cases hr with
+    | all hA hB => exact congr (congrArg VExpr.forallE (ihA hA)) (ihB hB)
+  | prj ha _ _ hm _ ih =>
+    cases hr with
+    | prj hb _ _ hn hv =>
+      cases Option.some.inj (ha.symm.trans hb)
+      exact congr (congrArg (fun r e => VExpr.proj r _ e) (hm.unique hn)) (ih hv)
+  | nat ha hv =>
+    cases hr with
+    | nat hb hw =>
+      cases Option.some.inj (ha.symm.trans hb)
+      exact congrArg VExpr.natLit (Option.some.inj (hv.symm.trans hw))
+  | share hs _ ih =>
+    cases hr with
+    | share ht hr =>
+      cases Option.some.inj (hs.symm.trans ht)
+      exact ih hr
+
+theorem readExpr_fuel_independent {fuel₁ fuel₂ : Nat} {objects : Objects} {naturals : Naturals}
+    {block : Address} {source : Ixon.Constant} {expression : Ixon.Expr} {left right : VExpr Address}
+    (hl : readExpr? fuel₁ objects naturals block source expression = some left)
+    (hr : readExpr? fuel₂ objects naturals block source expression = some right) : left = right :=
+  (readExpr_sound hl).unique (readExpr_sound hr)
+
+end Ix.Certified
diff --git a/Ix/Certified/SourceMeaning.lean b/Ix/Certified/SourceMeaning.lean
new file mode 100644
index 000000000..4f8aae276
--- /dev/null
+++ b/Ix/Certified/SourceMeaning.lean
@@ -0,0 +1,245 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.SourceStore
+import Ix.Kernel.Certified
+
+/-! Authenticated source-statement meaning for successful certified source
+runs. The original bytes, raw type and table-resolved reading occur together
+in the contract; semantic equality never substitutes for byte identity. -/
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+def ObjectBytes (source : Ixon.Env) (address : Address) (bytes : ByteArray) (value : Ixon.Constant) : Prop :=
+  constantBytes? source address = some bytes ∧ address.hash.size = 32 ∧
+    Address.blake3 bytes = address ∧ Ixon.runGetExact Ixon.getConstant bytes = .ok value ∧
+    Ixon.serConstant value = bytes
+
+def NaturalBytes (source : Ixon.Env) (address : Address) (bytes : ByteArray) (value : Nat) : Prop :=
+  source.getBlob? address = some bytes ∧ address.hash.size = 32 ∧
+    Address.blake3 bytes = address ∧ Nat.fromBytesLE bytes.data = value ∧
+    ByteArray.mk value.toBytesLE = bytes
+
+theorem SourceSnapshot.object_bytes (snapshot : SourceSnapshot source) {address : Address} {value : Ixon.Constant}
+    (h : lookup snapshot.decodedObjects address = some value) : ∃ bytes, ObjectBytes source address bytes value := by
+  obtain ⟨entry, _, he⟩ := List.mem_map.mp (lookup_mem h)
+  rcases Prod.mk.inj he with ⟨rfl, rfl⟩
+  exact ⟨entry.bytes, entry.fromSource, entry.decoded.property⟩
+
+theorem SourceSnapshot.natural_bytes (snapshot : SourceSnapshot source) {address : Address} {value : Nat}
+    (h : lookup snapshot.decodedNaturals address = some value) : ∃ bytes, NaturalBytes source address bytes value := by
+  obtain ⟨entry, _, he⟩ := List.mem_map.mp (lookup_mem h)
+  rcases Prod.mk.inj he with ⟨rfl, rfl⟩
+  exact ⟨entry.bytes, entry.fromSource, entry.decoded.property⟩
+
+def SignatureReading (profile : Profile) (objects : Objects) (signature : PrimitiveSignature Address) : Prop :=
+  ReferenceMeaning objects profile.falseType signature.falseType ∧
+  ReferenceMeaning objects profile.falseElim signature.falseElim ∧
+  match profile.natType, signature.natType with
+  | none, none => True
+  | some address, some ref => ReferenceMeaning objects address ref
+  | _, _ => False
+
+theorem readSignature_sound {profile : Profile} {objects : Objects} {signature : PrimitiveSignature Address}
+    (h : readSignature? profile objects = some signature) : SignatureReading profile objects signature := by
+  rcases profile with ⟨falseAddress, elimAddress, natural⟩
+  cases natural with
+  | none =>
+    simp only [readSignature?, bind, Option.bind_some, Option.bind_eq_some_iff] at h
+    obtain ⟨falseType, hF, falseElim, hE, h⟩ := h
+    split at h
+    · cases Option.some.inj h
+      exact ⟨resolveReference_iff.mp hF, resolveReference_iff.mp hE, trivial⟩
+    · cases h
+  | some address =>
+    simp only [readSignature?, bind, Option.bind_eq_some_iff, Option.map_eq_some_iff] at h
+    obtain ⟨falseType, hF, falseElim, hE, _, ⟨ref, hn, rfl⟩, h⟩ := h
+    split at h
+    · cases Option.some.inj h
+      exact ⟨resolveReference_iff.mp hF, resolveReference_iff.mp hE, resolveReference_iff.mp hn⟩
+    · cases h
+
+theorem SourceSnapshot.prepareStore_parts {source : Ixon.Env} (snapshot : SourceSnapshot source)
+    {fuel : Nat} {profile : Profile} {subjects : List Address} {prepared : PreparedStore}
+    (h : snapshot.prepareStore? fuel profile subjects = some prepared) :
+    readSignature? profile snapshot.decodedObjects = some prepared.signature ∧
+    readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals = some prepared.store ∧
+    subjects.flatMapM (subjectReferences? snapshot.decodedObjects) = some prepared.targets := by
+  unfold SourceSnapshot.prepareStore? at h
+  split at h
+  · cases h
+  · simp only [prepareStoreObjects?, bind, Option.bind_eq_some_iff] at h
+    obtain ⟨signature, hs, store, hstore, targets, ht, h⟩ := h
+    split at h
+    · cases h
+    · cases Option.some.inj h
+      exact ⟨hs, hstore, ht⟩
+
+theorem SourceSnapshot.prepare_parts {source : Ixon.Env} (snapshot : SourceSnapshot source)
+    {fuel : Nat} {profile : Profile} {target : Address} {prepared : PreparedInput}
+    (h : snapshot.prepare? fuel profile target = some prepared) :
+    readSignature? profile snapshot.decodedObjects = some prepared.signature ∧
+    readProofInput? fuel snapshot.decodedObjects target snapshot.decodedNaturals = some prepared.input := by
+  unfold SourceSnapshot.prepare? at h
+  split at h
+  · cases h
+  · simp only [bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨signature, hs, input, hi, rfl⟩ := h
+    exact ⟨hs, hi⟩
+
+def SourceDeclarationReading (source : Ixon.Env) (objects : Objects) (naturals : Naturals)
+    (ref : ConstRef Address) (entry : ConstantEntry Address) : Prop :=
+  ∃ bytes declaration rawType,
+    ObjectBytes source ref.block bytes declaration ∧ lookup objects ref.block = some declaration ∧
+    rawHeader? declaration ref = some (entry.universes, rawType) ∧
+    ExprReading objects naturals ref.block declaration rawType entry.type.erase
+
+theorem SourceSnapshot.declaration_reading {source : Ixon.Env} (snapshot : SourceSnapshot source)
+    {fuel : Nat} {store : Store Address} {ref : ConstRef Address} {entry : ConstantEntry Address}
+    (h : readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals = some store)
+    (hh : SourceHeader store ref entry) :
+    SourceDeclarationReading source snapshot.decodedObjects snapshot.decodedNaturals ref entry := by
+  obtain ⟨declaration, rawType, hs, ht, hr⟩ := readStore_sourceHeader h hh
+  obtain ⟨bytes, hb⟩ := snapshot.object_bytes hs
+  exact ⟨bytes, declaration, rawType, hb, hs, ht, hr⟩
+
+/-- Every original requested source declaration is realized in every compatible
+model, with its complete canonical bytes and its original raw type retained. -/
+theorem StoreReceipt.subject_meaning
+    (receipt : StoreReceipt.{v} source fuel profile subjects witness)
+    {ref : ConstRef Address} (hr : ref ∈ receipt.prepared.targets) :
+    ∃ entry, receipt.result.environment.entries ref = some entry ∧
+      SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+      ∀ (V : Type v) [SetTheory V] (constants : Assignment Address V),
+        receipt.prepared.signature.Compatible receipt.result.environment.entries constants →
+        ∀ levels, levels.length = entry.universes → ∀ env,
+          WellDenoted constants levels env entry.type ∧
+          constants ref levels ∈ˢ interp constants levels env entry.type := by
+  obtain ⟨entry, he, hh, hm⟩ := receipt.result.subject_sound hr
+  exact ⟨entry, he, receipt.snapshot.declaration_reading
+    (receipt.snapshot.prepareStore_parts receipt.preparation).2.1 hh, hm⟩
+
+theorem readProofInput_parts {fuel : Nat} {objects : Objects} {naturals : Naturals} {target : Address}
+    {input : ProofInput Address} (h : readProofInput? fuel objects target naturals = some input) :
+    readStore? fuel objects naturals = some input.store ∧
+    ∃ ref declaration, resolveReference? objects target = some ref ∧
+      input.store.lookup ref = some declaration ∧ input.universes = declaration.uvars ∧
+      input.proof = .const ref (VLevel.params input.universes) ∧ input.proposition = declaration.type := by
+  unfold readProofInput? at h
+  simp only [bind, Option.bind_eq_some_iff] at h
+  obtain ⟨store, hs, ref, hr, declaration, hd, h⟩ := h
+  split at h
+  · cases Option.some.inj h
+    exact ⟨hs, ref, declaration, hr, hd, rfl, rfl, rfl⟩
+  · cases h
+
+theorem SourceReceipt.target_entry
+    (receipt : SourceReceipt.{v} source fuel profile target witness) :
+    ∃ ref entry, ReferenceMeaning receipt.snapshot.decodedObjects target ref ∧
+      receipt.proof.environment.entries ref = some entry ∧
+      SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+      receipt.prepared.input.universes = entry.universes ∧
+      receipt.prepared.input.proposition = entry.type.erase := by
+  have hp := receipt.snapshot.prepare_parts receipt.preparation
+  obtain ⟨hs, ref, declaration, hr, hd, hu, he, ht⟩ := readProofInput_parts hp.2
+  have hproof : receipt.proof.proof.val = .const ref (VLevel.params receipt.prepared.input.universes) :=
+    AExpr.eq_const_of_erase_eq (receipt.proof.proof.property.1.trans he)
+  have hmem : (receipt.proof.environment.entries ref).isSome = true := by
+    simpa [hproof, AExpr.ReferencesIn, AExpr.references] using receipt.proof.proofReferences
+  cases hf : receipt.proof.environment.entries ref with
+  | none => simp [hf] at hmem
+  | some entry =>
+    have hh := receipt.proof.environment.sourceHeader hf
+    have hu' : declaration.uvars = entry.universes := by simpa [Store.uvars, hd] using hh.universes
+    have ht' : declaration.type = entry.type.erase := by simpa [Store.type, hd] using hh.type
+    exact ⟨ref, entry, resolveReference_iff.mp hr, hf,
+      receipt.snapshot.declaration_reading hs hh, hu.trans hu', ht.trans ht'⟩
+
+/-- This is the original serialized proposition's type field, with its exact
+source bytes and a validated reading of the original tables. The proposition
+is inhabited in every compatible interpretation, not just a chosen model. -/
+theorem SourceReceipt.proposition_meaning
+    (receipt : SourceReceipt.{v} source fuel profile target witness) :
+    SignatureReading profile receipt.snapshot.decodedObjects receipt.prepared.signature ∧
+    ∃ ref bytes declaration rawType,
+      ReferenceMeaning receipt.snapshot.decodedObjects target ref ∧
+      ObjectBytes source ref.block bytes declaration ∧
+      rawHeader? declaration ref = some (receipt.prepared.input.universes, rawType) ∧
+      ExprReading receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref.block declaration
+        rawType receipt.proof.proposition.val.erase ∧
+      ∀ (V : Type v) [SetTheory V] (constants : Assignment Address V),
+        receipt.prepared.signature.Compatible receipt.proof.environment.entries constants → ∀ levels env,
+          WellDenoted constants levels env receipt.proof.proposition.val ∧
+          interp constants levels env receipt.proof.proposition.val ∈ˢ univ 0 ∧
+          interp constants levels env receipt.proof.proof.val ∈ˢ
+            interp constants levels env receipt.proof.proposition.val := by
+  refine ⟨readSignature_sound (receipt.snapshot.prepare_parts receipt.preparation).1, ?_⟩
+  obtain ⟨ref, entry, hr, _, ⟨bytes, declaration, rawType, hb, _, ht, hread⟩, hu, hp⟩ := receipt.target_entry
+  refine ⟨ref, bytes, declaration, rawType, hr, hb, hu ▸ ht, ?_, ?_⟩
+  · rw [receipt.proof.proposition.property.1, hp]
+    exact hread
+  · intro V _ constants hM levels env
+    have hs := receipt.proof.isProp V constants hM.realizes levels env (Context.valid_nil constants levels env)
+    exact ⟨hs.1, hs.2.2, (receipt.proof.typing V constants hM.realizes levels env
+      (Context.valid_nil constants levels env)).2.2⟩
+
+def SubjectReading (objects : Objects) (subject : Address) (refs : List (ConstRef Address)) : Prop :=
+  ∃ source, lookup objects subject = some source ∧
+    match source.info with
+    | .muts members => members.isEmpty = false ∧ refs =
+        (members.toList.zipIdx.flatMap fun (member, index) =>
+          .member subject index :: match member with
+            | .indc family => (List.range family.ctors.size).map (.ctor subject index ·)
+            | _ => [])
+    | _ => ∃ ref, ReferenceMeaning objects subject ref ∧ refs = [ref]
+
+theorem subjectReferences_iff {objects : Objects} {subject : Address} {refs : List (ConstRef Address)} :
+    subjectReferences? objects subject = some refs ↔ SubjectReading objects subject refs := by
+  cases hs : lookup objects subject with
+  | none => simp [subjectReferences?, SubjectReading, hs]
+  | some source =>
+    rcases source with ⟨info, sharing, references, levels⟩
+    cases info <;>
+      simp only [subjectReferences?, SubjectReading, hs, ← resolveReference_iff, bind,
+        Option.bind_some, Option.bind_eq_some_iff, pure, Option.some.injEq, exists_eq_left']
+    all_goals try solve | simp only [eq_comm]
+    rename_i members
+    cases he : members.isEmpty <;> simp [eq_comm]
+    rfl
+
+theorem flatMapM_mem_iff {α β : Type} {f : α → Option (List β)} {xs : List α} {ys : List β}
+    (h : xs.flatMapM f = some ys) (value : β) :
+    value ∈ ys ↔ ∃ source ∈ xs, ∃ values, f source = some values ∧ value ∈ values := by
+  induction xs generalizing ys with
+  | nil => simp at h; subst ys; simp
+  | cons x xs ih =>
+    simp only [List.flatMapM_cons, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨values, hv, tail, ht, rfl⟩ := h
+    constructor
+    · intro hm
+      rcases List.mem_append.mp hm with hm | hm
+      · exact ⟨x, List.mem_cons_self .., values, hv, hm⟩
+      · obtain ⟨source, hs, values, hf, hm⟩ := (ih ht).mp hm
+        exact ⟨source, List.mem_cons_of_mem _ hs, values, hf, hm⟩
+    · rintro ⟨source, hs, result, hf, hm⟩
+      rcases List.mem_cons.mp hs with rfl | hs
+      · cases Option.some.inj (hv.symm.trans hf)
+        exact List.mem_append_left _ hm
+      · exact List.mem_append_right _ ((ih ht).mpr ⟨source, hs, result, hf, hm⟩)
+
+/-- Exact subject coverage: projection owners, every block member and every
+constructor are retained. No unrelated declaration is silently discharged. -/
+theorem StoreReceipt.subject_coverage
+    (receipt : StoreReceipt.{v} source fuel profile subjects witness) (ref : ConstRef Address) :
+    ref ∈ receipt.prepared.targets ↔
+      ∃ subject ∈ subjects, ∃ refs, SubjectReading receipt.snapshot.decodedObjects subject refs ∧ ref ∈ refs := by
+  have h := flatMapM_mem_iff (receipt.snapshot.prepareStore_parts receipt.preparation).2.2 ref
+  simpa only [subjectReferences_iff] using h
+
+end Ix.Certified
diff --git a/Ix/Certified/SourceStore.lean b/Ix/Certified/SourceStore.lean
new file mode 100644
index 000000000..2555a34fd
--- /dev/null
+++ b/Ix/Certified/SourceStore.lean
@@ -0,0 +1,318 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.SourceExpr
+import Ix.Theory.Certified.Source
+
+/-! Exact original declaration headers through the source block reader. -/
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified
+
+theorem mapM_get_right {α β : Type} {f : α → Option β} {xs : List α} {ys : List β}
+    {index : Nat} {value : β} (h : xs.mapM f = some ys) (hy : ys[index]? = some value) :
+    ∃ source, xs[index]? = some source ∧ f source = some value := by
+  induction xs generalizing ys index with
+  | nil => simp at h; subst ys; simp at hy
+  | cons x xs ih =>
+    simp only [List.mapM_cons, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨y, hf, tail, ht, rfl⟩ := h
+    cases index with
+    | zero => simp at hy; subst value; exact ⟨x, rfl, hf⟩
+    | succ index =>
+      obtain ⟨source, hs, hf⟩ := ih ht hy
+      exact ⟨source, hs, hf⟩
+
+def memberRawHeader : Ixon.MutConst → Nat × Ixon.Expr
+  | .defn value => (value.lvls.toNat, value.typ)
+  | .recr value => (value.lvls.toNat, value.typ)
+  | .indc value => (value.lvls.toNat, value.typ)
+
+def rawHeader? (source : Ixon.Constant) : ConstRef Address → Option (Nat × Ixon.Expr)
+  | .member _ index =>
+    match source.info with
+    | .muts members => members[index]?.map memberRawHeader
+    | .defn value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | .recr value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | .axio value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | .quot value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | _ => none
+  | .ctor _ index field => do
+    let .muts members := source.info | none
+    let .indc family ← members[index]? | none
+    let ctor ← family.ctors[field]?
+    return (ctor.lvls.toNat, ctor.typ)
+
+def blockHeader? (block : Block Address) : ConstRef Address → Option (Nat × VExpr Address)
+  | .member _ index => block.members[index]?.map fun declaration => (declaration.uvars, declaration.type)
+  | .ctor _ index field => do
+    let .induct _ _ _ _ ctors _ ← block.members[index]? | none
+    let ctor ← ctors[field]?
+    return (ctor.uvars, ctor.type)
+
+theorem readMember_header {fuel : Nat} {objects : Objects} {naturals : Naturals} {block : Address}
+    {source : Ixon.Constant} {member : Ixon.MutConst} {declaration : Const Address}
+    (h : readMutualMember? fuel objects naturals block source member = some declaration) :
+    declaration.uvars = (memberRawHeader member).1 ∧
+      readExpr? fuel objects naturals block source (memberRawHeader member).2 = some declaration.type := by
+  cases member with
+  | defn value =>
+    simp only [readMutualMember?, readDefinition?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨type, ht, body, _, rfl⟩ := h
+    exact ⟨rfl, ht⟩
+  | recr value =>
+    simp only [readMutualMember?, readRecursor?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨type, ht, rules, _, rfl⟩ := h
+    exact ⟨rfl, ht⟩
+  | indc value =>
+    simp only [readMutualMember?, readInductive?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨type, ht, constructors, _, rfl⟩ := h
+    exact ⟨rfl, ht⟩
+
+theorem readInductive_constructor {fuel : Nat} {objects : Objects} {naturals : Naturals} {block : Address}
+    {source : Ixon.Constant} {family : Ixon.Inductive} {declaration : Const Address}
+    {index : Nat} {universes : Nat} {type : VExpr Address}
+    (h : readInductive? fuel objects naturals block source family = some declaration)
+    (hc : blockHeader? ⟨[declaration]⟩ (.ctor block 0 index) = some (universes, type)) :
+    ∃ ctor, family.ctors[index]? = some ctor ∧ ctor.lvls.toNat = universes ∧
+      readExpr? fuel objects naturals block source ctor.typ = some type := by
+  simp only [readInductive?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+  obtain ⟨familyType, _, ctors, hm, rfl⟩ := h
+  simp only [blockHeader?, List.getElem?_cons_zero, bind, Option.bind_some,
+    Option.bind_eq_some_iff, pure, Option.some.injEq, Prod.mk.injEq] at hc
+  obtain ⟨ctor, hc, hn, ht⟩ := hc
+  obtain ⟨⟨raw, position⟩, hr, hp⟩ := mapM_get_right hm hc
+  simp only [List.getElem?_zipIdx, Array.getElem?_toList, Nat.zero_add,
+    Option.map_eq_some_iff, Prod.mk.injEq] at hr
+  obtain ⟨raw', hs, rfl, rfl⟩ := hr
+  split at hp
+  · contradiction
+  · simp only [Option.bind_eq_some_iff, Option.some.injEq] at hp
+    obtain ⟨reading, ht', he⟩ := hp
+    cases he
+    exact ⟨raw', hs, hn, ht ▸ ht'⟩
+
+theorem readBlock_sourceHeader {fuel : Nat} {objects : Objects} {naturals : Naturals} {block : Address}
+    {source : Ixon.Constant} {result : Block Address} {ref : ConstRef Address}
+    {universes : Nat} {type : VExpr Address}
+    (h : readBlock? fuel objects naturals block source = some result)
+    (hh : blockHeader? result ref = some (universes, type)) :
+    ∃ raw, rawHeader? source ref = some (universes, raw) ∧
+      ExprReading objects naturals block source raw type := by
+  rcases source with ⟨info, sharing, references, levels⟩
+  cases info with
+  | defn value =>
+    simp only [readBlock?, readDefinition?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨_, ⟨type, ht, body, _, rfl⟩, rfl⟩ := h
+    cases ref with
+    | member owner index =>
+      cases index with
+      | zero =>
+        simp only [blockHeader?, List.getElem?_cons_zero, Option.map_some,
+          Const.uvars, Const.type, Option.some.injEq, Prod.mk.injEq] at hh
+        rcases hh with ⟨rfl, rfl⟩
+        exact ⟨_, rfl, readExpr_sound ht⟩
+      | succ index => simp [blockHeader?] at hh
+    | ctor owner index field => cases index <;> simp [blockHeader?] at hh
+  | recr value =>
+    simp only [readBlock?, readRecursor?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨_, ⟨type, ht, rules, _, rfl⟩, rfl⟩ := h
+    cases ref with
+    | member owner index =>
+      cases index with
+      | zero =>
+        simp only [blockHeader?, List.getElem?_cons_zero, Option.map_some,
+          Const.uvars, Const.type, Option.some.injEq, Prod.mk.injEq] at hh
+        rcases hh with ⟨rfl, rfl⟩
+        exact ⟨_, rfl, readExpr_sound ht⟩
+      | succ index => simp [blockHeader?] at hh
+    | ctor owner index field => cases index <;> simp [blockHeader?] at hh
+  | axio value =>
+    simp only [readBlock?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨type, ht, rfl⟩ := h
+    cases ref with
+    | member owner index =>
+      cases index with
+      | zero =>
+        simp only [blockHeader?, List.getElem?_cons_zero, Option.map_some,
+          Const.uvars, Const.type, Option.some.injEq, Prod.mk.injEq] at hh
+        rcases hh with ⟨rfl, rfl⟩
+        exact ⟨_, rfl, readExpr_sound ht⟩
+      | succ index => simp [blockHeader?] at hh
+    | ctor owner index field => cases index <;> simp [blockHeader?] at hh
+  | quot value =>
+    simp only [readBlock?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨type, ht, rfl⟩ := h
+    cases ref with
+    | member owner index =>
+      cases index with
+      | zero =>
+        simp only [blockHeader?, List.getElem?_cons_zero, Option.map_some,
+          Const.uvars, Const.type, Option.some.injEq, Prod.mk.injEq] at hh
+        rcases hh with ⟨rfl, rfl⟩
+        exact ⟨_, rfl, readExpr_sound ht⟩
+      | succ index => simp [blockHeader?] at hh
+    | ctor owner index field => cases index <;> simp [blockHeader?] at hh
+  | muts rawMembers =>
+    simp only [readBlock?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨members, hm, rfl⟩ := h
+    cases ref with
+    | member owner index =>
+      simp only [blockHeader?, Option.map_eq_some_iff, Prod.mk.injEq] at hh
+      obtain ⟨declaration, hd, hn, ht⟩ := hh
+      obtain ⟨raw, hr, hread⟩ := mapM_get_right hm hd
+      have ⟨hu, htype⟩ := readMember_header hread
+      refine ⟨(memberRawHeader raw).2, ?_, readExpr_sound (ht ▸ htype)⟩
+      simp only [rawHeader?, ← Array.getElem?_toList, hr, Option.map_some]
+      exact congrArg some (congrArg (·, (memberRawHeader raw).2) (hu.symm.trans hn))
+    | ctor owner index field =>
+      simp only [blockHeader?, bind, Option.bind_eq_some_iff] at hh
+      obtain ⟨declaration, hd, hc⟩ := hh
+      obtain ⟨raw, hr, hread⟩ := mapM_get_right hm hd
+      have hc' : blockHeader? ⟨[declaration]⟩ (.ctor block 0 field) = some (universes, type) := by
+        simpa only [blockHeader?, List.getElem?_cons_zero, bind, Option.bind_some] using hc
+      cases raw with
+      | defn value =>
+        simp only [readMutualMember?, readDefinition?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at hread
+        obtain ⟨type, _, body, _, rfl⟩ := hread
+        simp [blockHeader?] at hc'
+      | recr value =>
+        simp only [readMutualMember?, readRecursor?, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at hread
+        obtain ⟨type, _, rules, _, rfl⟩ := hread
+        simp [blockHeader?] at hc'
+      | indc family =>
+        obtain ⟨ctor, hctor, hn, htype⟩ := readInductive_constructor hread hc'
+        refine ⟨ctor.typ, ?_, readExpr_sound htype⟩
+        have hr' : rawMembers[index]? = some (.indc family) := by simpa using hr
+        simp [rawHeader?, hr', hctor, hn]
+  | cPrj | rPrj | iPrj | dPrj => simp [readBlock?] at h
+
+theorem lookup_mem {α : Type} {entries : List (Address × α)} {address : Address} {value : α}
+    (h : lookup entries address = some value) : (address, value) ∈ entries := by
+  induction entries with
+  | nil => cases h
+  | cons entry rest ih =>
+    obtain ⟨key, data⟩ := entry
+    unfold lookup at h
+    split at h
+    · rename_i hk
+      subst address
+      cases Option.some.inj h
+      exact List.mem_cons_self ..
+    · exact List.mem_cons_of_mem _ (ih h)
+
+theorem lookup_of_mem {α : Type} {entries : List (Address × α)} {address : Address} {value : α}
+    (hn : (entries.map Prod.fst).Nodup) (h : (address, value) ∈ entries) :
+    lookup entries address = some value := by
+  induction entries with
+  | nil => cases h
+  | cons entry rest ih =>
+    obtain ⟨key, data⟩ := entry
+    have hn := List.nodup_cons.mp hn
+    rcases List.mem_cons.mp h with he | hr
+    · cases he
+      simp [lookup]
+    · have hk : address ≠ key := by
+        intro he
+        apply hn.1
+        exact List.mem_map.mpr ⟨(address, value), hr, he⟩
+      simp only [lookup, hk, ↓reduceIte]
+      exact ih hn.2 hr
+
+theorem readBlocks_mem {fuel : Nat} {objects pending : Objects} {naturals : Naturals}
+    {blocks : List (Address × Block Address)} {address : Address} {block : Block Address}
+    (h : readBlocks? fuel objects naturals pending = some blocks) (hm : (address, block) ∈ blocks) :
+    ∃ source, (address, source) ∈ pending ∧ readBlock? fuel objects naturals address source = some block := by
+  induction pending generalizing blocks with
+  | nil => simp [readBlocks?] at h; subst blocks; cases hm
+  | cons entry rest ih =>
+    obtain ⟨key, source⟩ := entry
+    unfold readBlocks? at h
+    split at h
+    · simp only [bind, Option.bind_eq_some_iff] at h
+      obtain ⟨_, _, h⟩ := h
+      obtain ⟨source, hs, hb⟩ := ih h hm
+      exact ⟨source, List.mem_cons_of_mem _ hs, hb⟩
+    · simp only [bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+      obtain ⟨decoded, hd, tail, ht, rfl⟩ := h
+      rcases List.mem_cons.mp hm with he | hr
+      · rcases Prod.mk.inj he with ⟨rfl, rfl⟩
+        exact ⟨source, List.mem_cons_self .., hd⟩
+      · obtain ⟨source, hs, hb⟩ := ih ht hr
+        exact ⟨source, List.mem_cons_of_mem _ hs, hb⟩
+
+theorem readStore_sourceBlock {fuel : Nat} {objects : Objects} {naturals : Naturals}
+    {store : Store Address} {address : Address} {block : Block Address}
+    (h : readStore? fuel objects naturals = some store) (hb : store.blocks address = some block) :
+    ∃ source, lookup objects address = some source ∧ readBlock? fuel objects naturals address source = some block := by
+  unfold readStore? at h
+  split at h
+  · rename_i hn
+    simp only [bind, Option.bind_eq_some_iff] at h
+    obtain ⟨blocks, hblocks, h⟩ := h
+    split at h
+    · cases Option.some.inj h
+      obtain ⟨source, hs, hr⟩ := readBlocks_mem hblocks (lookup_mem hb)
+      exact ⟨source, lookup_of_mem hn hs, hr⟩
+    · cases h
+  · cases h
+
+def storeHeader? (store : Store Address) (ref : ConstRef Address) : Option (Nat × VExpr Address) := do
+  let block ← store.blocks ref.block
+  blockHeader? block ref
+
+theorem storeHeader_maps (store : Store Address) (ref : ConstRef Address) :
+    (storeHeader? store ref).map Prod.fst = store.uvars ref ∧
+    (storeHeader? store ref).map Prod.snd = store.type ref := by
+  cases ref with
+  | member address index =>
+    cases hs : store.blocks address with
+    | none => simp [storeHeader?, ConstRef.block, Store.type, Store.uvars, Store.lookup, Store.lookupCtor, hs]
+    | some block =>
+      cases hm : block.members[index]? <;>
+        simp [storeHeader?, ConstRef.block, blockHeader?, Store.type, Store.uvars, Store.lookup, Store.lookupCtor, hs, hm]
+  | ctor address index field =>
+    cases hs : store.blocks address with
+    | none => simp [storeHeader?, ConstRef.block, Store.type, Store.uvars, Store.lookup, Store.lookupCtor, hs]
+    | some block =>
+      cases hm : block.members[index]? with
+      | none => simp [storeHeader?, ConstRef.block, blockHeader?, Store.type, Store.uvars, Store.lookup, Store.lookupCtor, hs, hm]
+      | some declaration =>
+        cases declaration <;>
+          simp [storeHeader?, ConstRef.block, blockHeader?, Store.type, Store.uvars, Store.lookup, Store.lookupCtor, hs, hm]
+        rename_i ctors _
+        cases hc : ctors[field]? <;> simp
+
+theorem sourceHeader_pair {store : Store Address} {ref : ConstRef Address} {entry : Ix.Theory.Model.ConstantEntry Address}
+    (h : SourceHeader store ref entry) : storeHeader? store ref = some (entry.universes, entry.type.erase) := by
+  have ⟨hu, ht⟩ := storeHeader_maps store ref
+  rw [h.universes] at hu
+  rw [h.type] at ht
+  cases hh : storeHeader? store ref with
+  | none => simp [hh] at ht
+  | some header =>
+    rcases header with ⟨universes, type⟩
+    simp only [hh, Option.map_some, Option.some.injEq] at hu ht
+    cases hu
+    cases ht
+    rfl
+
+/-- Exact source type, source universe arity and a unique structural reading
+of that original type, for every admitted source member or constructor. -/
+theorem readStore_sourceHeader {fuel : Nat} {objects : Objects} {naturals : Naturals}
+    {store : Store Address} {ref : ConstRef Address} {entry : Ix.Theory.Model.ConstantEntry Address}
+    (h : readStore? fuel objects naturals = some store) (hh : SourceHeader store ref entry) :
+    ∃ source raw, lookup objects ref.block = some source ∧
+      rawHeader? source ref = some (entry.universes, raw) ∧
+      ExprReading objects naturals ref.block source raw entry.type.erase := by
+  have hp := sourceHeader_pair hh
+  simp only [storeHeader?, bind, Option.bind_eq_some_iff] at hp
+  obtain ⟨block, hb, hp⟩ := hp
+  obtain ⟨source, hs, hr⟩ := readStore_sourceBlock h hb
+  obtain ⟨raw, hraw, hread⟩ := readBlock_sourceHeader hr hp
+  exact ⟨source, raw, hs, hraw, hread⟩
+
+end Ix.Certified
diff --git a/Ix/Certified/Store.lean b/Ix/Certified/Store.lean
new file mode 100644
index 000000000..40d9d5cba
--- /dev/null
+++ b/Ix/Certified/Store.lean
@@ -0,0 +1,74 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Bytes
+import Ix.Theory.Certified.Store
+
+namespace Ix.Certified
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+/-- A block subject requests every member and constructor. A projection
+subject must resolve to its actual matching source kind and position. -/
+def subjectReferences? (objects : Objects) (subject : Address) : Option (List (ConstRef Address)) := do
+  let source ← lookup objects subject
+  match source.info with
+  | .muts members =>
+    if members.isEmpty then none else
+    return members.toList.zipIdx.flatMap fun (member, index) =>
+      .member subject index :: match member with
+        | .indc family => (List.range family.ctors.size).map (.ctor subject index ·)
+        | _ => []
+  | _ => return [← resolveReference? objects subject]
+
+structure PreparedStore where
+  signature : PrimitiveSignature Address
+  store : Store Address
+  targets : List (ConstRef Address)
+
+def prepareStoreObjects? (fuel : Nat) (profile : Profile) (subjects : List Address)
+    (objects : Objects) (naturals : Naturals) : Option PreparedStore := do
+  let signature ← readSignature? profile objects
+  let store ← readStore? fuel objects naturals
+  let targets ← subjects.flatMapM (subjectReferences? objects)
+  if targets.length > fuel then none else return ⟨signature, store, targets⟩
+
+def prepareStore? (fuel : Nat) (profile : Profile) (subjects : List Address)
+    (blobs : ConstantBlobs) (literalBlobs : ConstantBlobs := []) : Option PreparedStore := do
+  if !((blobs ++ literalBlobs).map Prod.fst).Nodup then none else do
+  let naturals ← decodeNaturals? literalBlobs
+  let objects ← decodeObjects? blobs
+  prepareStoreObjects? fuel profile subjects objects naturals
+
+def acceptsSerializedStore (fuel : Nat) (profile : Profile) (subjects : List Address)
+    (blobs : ConstantBlobs) (witness : List (DeclarationWitness Address))
+    (literalBlobs : ConstantBlobs := []) : Bool :=
+  match prepareStore? fuel profile subjects blobs literalBlobs with
+  | none => false
+  | some prepared => acceptsStoreCertified.{0,v} fuel prepared.signature prepared.store prepared.targets witness
+
+theorem accepted_serialized_store_has_model {fuel : Nat} {profile : Profile} {subjects : List Address}
+    {blobs literalBlobs : ConstantBlobs} {witness : List (DeclarationWitness Address)}
+    (h : acceptsSerializedStore.{v} fuel profile subjects blobs witness literalBlobs = true)
+    (V : Type v) [SetTheory V] :
+    ∃ prepared, prepareStore? fuel profile subjects blobs literalBlobs = some prepared ∧
+      ∃ result : CheckedStore.{0,v} prepared.signature prepared.store prepared.targets,
+        checkStoreCertified fuel prepared.signature prepared.store prepared.targets witness = some result ∧
+        ∃ constants : Assignment Address V,
+          prepared.signature.Compatible result.environment.entries constants ∧
+          ∀ r ∈ prepared.targets, ∃ entry, result.environment.entries r = some entry ∧
+            EntrySource prepared.signature prepared.store r entry ∧
+            ∀ levels, levels.length = entry.universes → ∀ env : Nat → V,
+              WellDenoted constants levels env entry.type ∧
+              constants r levels ∈ˢ interp constants levels env entry.type := by
+  unfold acceptsSerializedStore at h
+  cases hp : prepareStore? fuel profile subjects blobs literalBlobs with
+  | none => simp [hp] at h
+  | some prepared =>
+    exact ⟨prepared, rfl, accepted_store_has_model (by simpa only [hp] using h) V⟩
+
+end Ix.Certified
diff --git a/Ix/Certified/Suggest.lean b/Ix/Certified/Suggest.lean
new file mode 100644
index 000000000..6a1340edb
--- /dev/null
+++ b/Ix/Certified/Suggest.lean
@@ -0,0 +1,31 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Ingress
+import Ix.Theory.Certificate.Build
+import Ix.Certified.ModelHints
+
+namespace Ix.Certified
+
+open Ix.Theory.Certified
+
+/-- Untrusted witness search from selected addresses in the actual source
+store. A returned witness still has to pass the certified TcM entry point. -/
+def suggestSource? (fuel : Nat) (source : Ixon.Env) (profile : Profile) (target : Address)
+    (selection : InputSelection) (hints : List ModelHint := []) : Option (ProofWitness Address) := do
+  let (snapshot, _) ← readSnapshot? fuel source selection {}
+  let prepared ← snapshot.prepare? fuel profile target
+  let models ← modelCandidates? snapshot.decodedObjects prepared.input.store hints
+  Ix.Theory.Certificate.proofWitness? fuel prepared.signature prepared.input models
+
+/-- Search for complete declaration groups for every requested source subject. -/
+def suggestStore? (fuel : Nat) (source : Ixon.Env) (profile : Profile) (subjects : List Address)
+    (selection : InputSelection) (hints : List ModelHint := []) : Option (List (DeclarationWitness Address)) := do
+  let (snapshot, _) ← readSnapshot? fuel source selection {}
+  let prepared ← snapshot.prepareStore? fuel profile subjects
+  let models ← modelCandidates? snapshot.decodedObjects prepared.store hints
+  Ix.Theory.Certificate.storeWitness? fuel prepared.signature prepared.store prepared.targets models
+
+end Ix.Certified
diff --git a/Ix/Certified/TcAudit.lean b/Ix/Certified/TcAudit.lean
new file mode 100644
index 000000000..768d38a30
--- /dev/null
+++ b/Ix/Certified/TcAudit.lean
@@ -0,0 +1,42 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.AuditSupport
+import Ix.Kernel.Certified
+import Ix.Certified.Command
+
+/-! The C5 audit covers the actual TcM certified entry points, the decoder
+cache and source receipts. It does not promote legacy TcM successes. -/
+
+open Lean Lean.Elab Command
+
+namespace Ix.Certified.TcAudit
+
+def roots : Array Lean.Name := #[
+  `Ix.Certified.constantBytes?, `Ix.Certified.decodeObject_complete,
+  `Ix.Certified.decodeNatural_complete,
+  `Ix.Certified.SourceSnapshot.prepare_eq, `Ix.Certified.SourceSnapshot.prepareStore_eq,
+  `Ix.Certified.SourceSnapshot.objects_from_source, `Ix.Certified.SourceSnapshot.naturals_from_source,
+  `Ix.Certified.SourceReceipt.serialized, `Ix.Certified.StoreReceipt.serialized,
+  `Ix.Certified.accepted_serialized_store_has_model,
+  `Ix.Kernel.TcM.checkCertified_success, `Ix.Kernel.TcM.checkCertified_failure,
+  `Ix.Kernel.TcM.checkStoreCertified_success,
+  `Ix.Kernel.certifiedStep_success, `Ix.Kernel.certifiedStep_failure,
+  `Ix.Kernel.certifiedStoreStep_success, `Ix.Kernel.certifiedStoreStep_failure,
+  `Ix.Kernel.initialCertifiedState, `Ix.Kernel.accepted_tc_has_model,
+  `Ix.Kernel.accepted_tc_store_has_model, `Ix.Kernel.no_tc_proof_of_False,
+  `Ix.Certified.Command.run_success]
+
+def premises : Array Lean.Name := #[
+  `Ix.Certified.InputCache.mk, `Ix.Certified.CachedObject.mk, `Ix.Certified.CachedNatural.mk,
+  `Ix.Certified.DecodedObject, `Ix.Certified.DecodedNatural,
+  `Ix.Certified.SourceObject.mk, `Ix.Certified.SourceNatural.mk,
+  `Ix.Certified.SourceReceipt.mk, `Ix.Certified.StoreReceipt.mk,
+  `Ix.Certified.InputSelection.mk, `Ix.Certified.subjectReferences?,
+  `Ix.Kernel.CertifiedState.mk]
+
+run_cmd AuditSupport.report "certified checker" roots premises
+
+end Ix.Certified.TcAudit
diff --git a/Ix/Certified/Trees.lean b/Ix/Certified/Trees.lean
new file mode 100644
index 000000000..59276b734
--- /dev/null
+++ b/Ix/Certified/Trees.lean
@@ -0,0 +1,117 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.SourceMeaning
+import Ix.AssumptionTree
+
+/-! Total checking of Ix's existing Merkle-tree wire representation. The
+public slot determines whether leaves mean constant addresses, environment
+roots, or logical-axiom addresses. Padding is never a declaration. -/
+
+namespace Ix.Certified
+
+instance addressLawfulBEq : LawfulBEq Address where
+  eq_of_beq := by
+    intro a b h
+    change (a.hash.data == b.hash.data) = true at h
+    cases a
+    cases b
+    exact congrArg Address.mk (congrArg ByteArray.mk (eq_of_beq h))
+  rfl := by
+    intro a
+    change (a.hash.data == a.hash.data) = true
+    exact beq_self_eq_true _
+
+def treeRoot : AssumptionTree → Address
+  | .leaf address => Merkle.leafHash address
+  | .padding => Merkle.zeroAddress
+  | .node left right => Merkle.nodeHash (treeRoot left) (treeRoot right)
+
+def treeLeaves : AssumptionTree → List Address
+  | .leaf address => [address]
+  | .padding => []
+  | .node left right => treeLeaves left ++ treeLeaves right
+
+def putTreeBody : AssumptionTree → Ixon.PutM Unit
+  | .leaf address => do Ixon.putU8 0; Ixon.Serialize.put address
+  | .padding => Ixon.putU8 1
+  | .node left right => do
+    Ixon.putU8 2
+    putTreeBody left
+    putTreeBody right
+
+def treeBytes (tree : AssumptionTree) : ByteArray := Ixon.runPut do
+  Ixon.putTag4 ⟨AssumptionTree.FLAG, AssumptionTree.VARIANT⟩
+  putTreeBody tree
+
+def getTreeBody : Nat → Ixon.GetM AssumptionTree
+  | 0 => throw "certified tree depth limit"
+  | fuel + 1 => do
+    match ← Ixon.getU8 with
+    | 0 => return .leaf (← Ixon.Serialize.get)
+    | 1 => return .padding
+    | 2 => return .node (← getTreeBody fuel) (← getTreeBody fuel)
+    | _ => throw "invalid certified tree node"
+
+def getTree (fuel : Nat) : Ixon.GetM AssumptionTree := do
+  let tag ← Ixon.getTag4
+  if tag.flag != AssumptionTree.FLAG || tag.size != AssumptionTree.VARIANT then
+    throw "invalid certified tree tag"
+  getTreeBody fuel
+
+structure TreeOpening (fuel : Nat) (root : Address) (bytes : ByteArray) where
+  tree : AssumptionTree
+  parsing : Ixon.runGetExact (getTree fuel) bytes = .ok tree
+  canonical : treeBytes tree = bytes
+  rootBound : treeRoot tree = root
+  addresses : ∀ address ∈ treeLeaves tree, address.hash.size = 32
+
+def readTree? (fuel : Nat) (root : Address) (bytes : ByteArray) :
+    Option (TreeOpening fuel root bytes) :=
+  match hp : Ixon.runGetExact (getTree fuel) bytes with
+  | .error _ => none
+  | .ok tree =>
+    if hc : treeBytes tree = bytes then
+      if hr : treeRoot tree = root then
+        if ha : (treeLeaves tree).all (fun address => address.hash.size == 32) = true then
+          some ⟨tree, hp, hc, hr, by simpa using List.all_eq_true.mp ha⟩
+        else none
+      else none
+    else none
+
+structure OptionalTreeOpening (fuel : Nat) (root : Option Address) (bytes : Option ByteArray) where
+  leaves : List Address
+  evidence : match root, bytes with
+    | none, none => leaves = []
+    | some root, some bytes => ∃ opening : TreeOpening fuel root bytes, treeLeaves opening.tree = leaves
+    | _, _ => False
+
+def readOptionalTree? (fuel : Nat) (root : Option Address) (bytes : Option ByteArray) :
+    Option (OptionalTreeOpening fuel root bytes) :=
+  match root, bytes with
+  | none, none => some ⟨[], rfl⟩
+  | some root, some bytes => do
+    let opening ← readTree? fuel root bytes
+    return ⟨treeLeaves opening.tree, ⟨opening, rfl⟩⟩
+  | _, _ => none
+
+def TreeMembership (root target : Address) : Prop :=
+  ∃ tree, treeRoot tree = root ∧ target ∈ treeLeaves tree ∧
+    ∀ address ∈ treeLeaves tree, address.hash.size = 32
+
+/-- Membership is a structural assertion only. No environment or typing
+judgment occurs in its conclusion. -/
+theorem TreeOpening.membership (opening : TreeOpening fuel root bytes) {target : Address}
+    (h : target ∈ treeLeaves opening.tree) : TreeMembership root target :=
+  ⟨opening.tree, opening.rootBound, h, opening.addresses⟩
+
+theorem treeLeaves_join (left right : AssumptionTree) (address : Address) :
+    address ∈ treeLeaves (.node left right) ↔ address ∈ treeLeaves left ∨ address ∈ treeLeaves right :=
+  List.mem_append
+
+theorem TreeOpening.unique {a b : TreeOpening fuel root bytes} : a.tree = b.tree :=
+  Except.ok.inj (a.parsing.symm.trans b.parsing)
+
+end Ix.Certified
diff --git a/Ix/Cli/BenchCmd.lean b/Ix/Cli/BenchCmd.lean
index 139154378..0fd410ed6 100644
--- a/Ix/Cli/BenchCmd.lean
+++ b/Ix/Cli/BenchCmd.lean
@@ -12,7 +12,6 @@
      the benchmark);
   3. spawns the run's measured tool — `bench-typecheck` (aiur),
      `zisk-host`/`sp1-host` (zkVM execute), `ix check-rs` (ooc),
-     `bench-lean4lean` (lean4lean; olean-driven, no `.ixe`),
      `ix compile` (compile) — wrapped in the RAM watchdog (`Ix.Watchdog`:
      cgroup `memory.max` via a systemd user scope; the kernel OOM-kills
      at the ceiling). The per-constant backends (aiur, zkVM) spawn
@@ -335,22 +334,6 @@ def backendSpecs : List BackendSpec := [
     metrics := [("execute", ["check-time", "throughput", "peak-rss"])],
     thresholds := [("constants", "0", "0"), ("check-time", "0.10", "_"),
                    ("throughput", "_", "0.10"), ("peak-rss", "0.10", "_")] },
-  -- lean4lean (github.com/digama0/lean4lean, required by the lakefile at a
-  -- pinned rev): the reference Lean4-in-Lean4 kernel, the external
-  -- yardstick for the Ix kernels (`ooc` / `ix check-lean`) on the same
-  -- libraries. Checks the env's library from its oleans (no `.ixe`):
-  -- whole-library row (module-parallel replay of the import closure) plus
-  -- one full-closure row per constant, mirroring ooc's row shape and
-  -- metric names so cross-kernel tables line up. Disabled in CI until a
-  -- bencher testbed exists — `ix bench run --backend lean4lean` works
-  -- locally regardless (`disabled` only gates the CI matrix and
-  -- `!benchmark` scheduling).
-  { name := "lean4lean", defaultMode := "execute",
-    inputs := .perConstantWithEnv,
-    disabled := some "local-only: no bencher testbed yet",
-    testbeds := [("execute", "lean4lean-check-x64-32x")],
-    metrics := [("execute", ["check-time", "throughput", "peak-rss",
-                             "constants"])] },
   -- AnthropicFLT remains on-demand: its from-scratch upstream build needs
   -- substantially more than the per-push workflow's one-hour budget. An
   -- explicit `--env AnthropicFLT` or `BENCH_ENVS=AnthropicFLT` still runs it.
@@ -804,27 +787,6 @@ is not a benchmark run"
         "--json", out, "--json-name", info.name]
     if exit != 0 && exit != exitRejected then
       IO.eprintln s!"[bench] whole-env aiur check failed (exit {exit})"
-  | "lean4lean" =>
-    -- The reference Lean4-in-Lean4 kernel checks the env's library from
-    -- its oleans, so no `.ixe` is resolved. The tool takes the same
-    -- registry `module` path `ix compile` does (its lake project supplies
-    -- the search path; the tool builds the module itself, outside every
-    -- timed window). Whole-library row keyed by the env name …
-    let bl ← resolveBin repo "bench-lean4lean"
-    let modulePath := s!"{repo}/{info.module}"
-    let exit ← runGuarded watchdog ceilingGb bl
-      #[modulePath, "--json", out, "--json-name", info.name]
-    if exit != 0 && exit != exitRejected then
-      IO.eprintln s!"[bench] whole-library replay failed (exit {exit})"
-    -- … plus one full-closure row per constant. ONE process for all names
-    -- (the ooc pattern): the imported env is shared across the closure
-    -- replays instead of re-paying the library import per name.
-    if !names.isEmpty then
-      IO.FS.writeFile namesFile ("\n".intercalate names.toList ++ "\n")
-      let exit ← runGuarded watchdog ceilingGb bl
-        #[modulePath, "--no-build", "--consts-file", namesFile, "--json", out]
-      if exit != 0 && exit != exitRejected then
-        IO.eprintln s!"[bench] per-constant closures failed (exit {exit})"
   | "aiur" =>
     -- prove runs the whole pipeline (`bench-typecheck --recursive`):
     -- every stage per constant, closed by the pipeline ledger. One process
@@ -891,7 +853,7 @@ is not a benchmark run"
   let expected := match backend with
     | "compile" => #[info.name]
     | "decompile" => #[info.name]
-    | "ooc" | "lean4lean" => #[info.name] ++ names
+    | "ooc" => #[info.name] ++ names
     | _ => names
   let code ← gate out expected
   if code == 0 || code == exitRejected then
@@ -930,7 +892,7 @@ def benchRunCmd : Cli.Cmd := `[Cli|
   "Execute one benchmark run (backend × env × mode), writing benchmark results JSON. Exits 0 on success (rows saved as the local baseline), 3 when the kernel rejected any constant, 1 when no rows were produced."
 
   FLAGS:
-    backend      : String; "aiur | aiur-sharded-env | zisk | sp1 | ooc | lean4lean | compile | decompile"
+    backend      : String; "aiur | aiur-sharded-env | zisk | sp1 | ooc | compile | decompile"
     env          : String; "Benchmark env from the registry (default: InitStd)"
     mode         : String; "prove | execute (default: the backend's defaultMode)"
     out          : String; "Benchmark results JSON output path (default: bench.json)"
diff --git a/Ix/Cli/CheckLeanCmd.lean b/Ix/Cli/CheckLeanCmd.lean
index af1c420be..298b992f1 100644
--- a/Ix/Cli/CheckLeanCmd.lean
+++ b/Ix/Cli/CheckLeanCmd.lean
@@ -1,6 +1,6 @@
 /-
   `ix check-lean <path.ixe>`: typecheck a serialized `.ixe` environment
-  through the pure-Lean `Ix.Tc` kernel — the reference-kernel counterpart
+  through the pure-Lean `Ix.Kernel` kernel — the reference-kernel counterpart
   of `ix check-rs`, with matching mode default, live progress, and exit
   codes. Correctness-first: expect the Rust kernel to be much faster.
 
@@ -17,7 +17,7 @@
   subject-only but still reads dependencies' declared types, so every
   constant must be present. `--max` therefore bounds the check phase
   only, never ingress. Checking then runs work-stealing parallel workers
-  over the shared env (see `Ix.Tc.ParCheck`).
+  over the shared env (see `Ix.Kernel.ParCheck`).
 
   Progress mirrors `check-rs`: a periodic aggregate line (done/total,
   rate, eta, oldest in-flight) on stderr, persistent lines only for
@@ -38,14 +38,14 @@ module
 public import Cli
 public import Ix.Common
 public import Ix.Cli.ConstsFile
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.Benchmark.Results
 
 public section
 
 namespace Ix.Cli.CheckLeanCmd
 
-open Ix.Tc
+open Ix.Kernel
 
 /-- First set env var wins; else the default. Zero is a valid setting. -/
 def envNat (names : List String) (dflt : Nat) : IO Nat := do
@@ -222,7 +222,7 @@ def runCheckLeanCmd (p : Cli.Parsed) : IO UInt32 := do
     maxRecFuel? := ((← IO.getEnv "IX_MAX_REC_FUEL").bind
       (·.trimAscii.toString.toNat?)).map (·.toUInt64) }
 
-  IO.println s!"Running Ix.Tc kernel check \
+  IO.println s!"Running Ix.Kernel kernel check \
                 ({if anon then "anon" else "meta"} mode) on {envPath}"
   let t0 ← IO.monoMsNow
   let bytes ← IO.FS.readBinFile envPath
@@ -271,7 +271,7 @@ end Ix.Cli.CheckLeanCmd
 open Ix.Cli.CheckLeanCmd in
 def checkLeanCmd : Cli.Cmd := `[Cli|
   "check-lean" VIA runCheckLeanCmd;
-  "Typecheck a `.ixe` through the pure-Lean Ix.Tc kernel (meta mode by default; parallel)"
+  "Typecheck a `.ixe` through the pure-Lean Ix.Kernel kernel (meta mode by default; parallel)"
 
   FLAGS:
     anon;                   "Run in anon mode (metadata never reaches the kernel; `#hex` labels)"
diff --git a/Ix/Cli/ValidateLeanCmd.lean b/Ix/Cli/ValidateLeanCmd.lean
index 8441d1711..9f8359a99 100644
--- a/Ix/Cli/ValidateLeanCmd.lean
+++ b/Ix/Cli/ValidateLeanCmd.lean
@@ -1,6 +1,6 @@
 /-
   `ix validate-lean <file.lean>`: run the pure-Lean Ix pipeline validation
-  against the Lean environment for any file — the `Ix.Tc` counterpart to
+  against the Lean environment for any file — the `Ix.Kernel` counterpart to
   `ix validate` (which drives the Rust implementation's 8-phase pipeline).
 
   Phases (all pure-Lean):
@@ -44,7 +44,7 @@ public import Ix.DecompileM
 public import Ix.DecompileDriver
 public import Ix.DecompileRoundtrip
 public import Ix.Meta
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.Cli.ValidateCmd
 
 public section
@@ -54,7 +54,7 @@ open Ix.EnvScope
 
 namespace Ix.Cli.ValidateLeanCmd
 
-open Ix.Tc
+open Ix.Kernel
 
 /-- Phase outcome for the final report. -/
 inductive PhaseResult where
diff --git a/Ix/Compile/Verify/Audit/SorryFrontier.lean b/Ix/Compile/Verify/Audit/SorryFrontier.lean
index db3ee1f65..0595ae8b1 100644
--- a/Ix/Compile/Verify/Audit/SorryFrontier.lean
+++ b/Ix/Compile/Verify/Audit/SorryFrontier.lean
@@ -4,7 +4,7 @@ import Ix.Compile.Verify.Audit.Statements
 # Compiler-verification source sorry frontier
 
 Fail the build if any declaration emitted from an `Ix.Compile.Verify` source
-module directly references `sorryAx`.  Upstream Lean4Lean debt is handled by
+module directly references `sorryAx`. Named-specification debt is handled by
 per-root transitive manifests rather than being confused with local source
 placeholders.
 -/
diff --git a/Ix/Compile/Verify/Audit/Statements.lean b/Ix/Compile/Verify/Audit/Statements.lean
index 4bee84cf0..d30f4c7a4 100644
--- a/Ix/Compile/Verify/Audit/Statements.lean
+++ b/Ix/Compile/Verify/Audit/Statements.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Audit.Basic
+import Ix.Kernel.Verify.Audit.Basic
 import Ix.Compile.Verify.Statements
 
 /-!
@@ -13,25 +13,20 @@ a premise.
 
 namespace Ix.Compile.Verify.Audit.Statements
 
-open Ix.Tc.Verify.Audit
+open Ix.Kernel.Verify.Audit
 
 private def standard : Array Lean.Name :=
   #[``propext, ``Classical.choice, ``Quot.sound]
 
 private def noChoice : Array Lean.Name := #[``propext, ``Quot.sound]
 
-private def blake3Native : Array Lean.Name := #[
-  nativeAxiom `Blake3
-    `Blake3.HasherOps.hash._native.native_decide.ax_1
-]
-
 private def nameNative : Array Lean.Name := #[
   nativeAxiom `Ix.Environment
     `Ix.Name.mkStr._native.native_decide.ax_1
 ]
 
 private def singletonDriverNative : Array Lean.Name :=
-  blake3Native ++ nameNative
+  nameNative
 
 private def roots : Array RootAllowance := #[
   { root := ``Ix.Compile.Verify.IxonExprRel.eraseModes_iff,
@@ -71,7 +66,7 @@ private def roots : Array RootAllowance := #[
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.ExprTableWF.mono },
   { root := ``Ix.Compile.Verify.Catalog.empty_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.Catalog.ofEnv_finite,
     standardAxioms := noChoice },
   { root := ``Ix.Compile.Verify.BlockState.internRef_wf,
@@ -91,24 +86,24 @@ private def roots : Array RootAllowance := #[
   { root := ``Ix.Compile.Verify.compileAndInternUnivCanon_run_refines,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileAndInternUnivCanon_array_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileUniv_run_value,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.canonPreseedUnivs_run_refines,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.collectExprTablesStructural_run_ready,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.collectExprTablesStructural_run_ready_covers,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.collectPreseedExprs_singleton_run_ready_covers,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.collectPreseedExprs_pair_run_ready_covers,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.singletonPreseedCovers_of_ready,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.singletonPreseedCapacity_of_ready,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.internPreseedRefs_run_wf,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.internPreseedRefs_run_total,
@@ -129,130 +124,130 @@ private def roots : Array RootAllowance := #[
     standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.PreseedCollectionCovers.compileExprRef_of_indexed,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.BlockWireTablesWF.of_preseed,
     standardAxioms := noChoice },
   { root := ``Ix.Compile.Verify.preseedExprTables_singleton_run_ready,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.preseedExprTables_singleton_run_ready_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.preseedExprTables_singleton_run_ready_frozenRef,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.preseedExprTables_of_collect_run_ready_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.preseedExprTables_pair_run_ready_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.preseedExprTables_pair_run_ready_frozenRefs,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.preseedExprTables_roots_run_ready_frozenRefs,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.collectPreseedExprs_inputs_run_ready_covers,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.preseedExprTables_inputs_run_ready_frozenRefs,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.heterogeneousPreseedSeenSafe_of_uniform,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.preseedExprTables_inputs_run_uniform_ready_frozenRefs,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.preseedExprTables_run_univsFinal,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.serializeIxSyntax_run_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.KVMapSupported.all,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileKVMap_run_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.metaCompileSupport_finite,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.BlockState_compileName_strict,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.serializeIxSyntax_run_strictStores,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileDataValue_run_strictStores,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileKVMap_run_strictStores,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.StructuralExprCacheWF.insert,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.OrdinaryExprCacheWF.insert,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_surgeryFree,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExprNoSurgeryFuel_structural_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_structural_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_structural_value,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_sort_value,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_constEmpty_recur_value,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_constEmpty_ref_value,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_lit_value,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExprNoSurgeryFuel_ordinary_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_ordinary_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_ordinary_codec_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.deConstant_serUnsharedAxiomConstant,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.deConstant_serUnsharedDefinitionConstant,
     standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExpr_run_ordinary_axiomConstant_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExpr_run_ordinary_definitionConstant_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.BlockResult.mk'_codec_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.buildConstantWithSharing_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.BlockResult.constantInfo_codec_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.constantInfoRootExprs_toList,
     standardAxioms := #[``propext] },
   { root :=
       ``Ix.Compile.Verify.finishConstantInfoWithSharing_run_codecWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileAxiom_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.finishQuotientCompilation_run,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileQuotient_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileRecursorRules_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.finishRecursorCompilation_run,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileRecursor_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileConstructor_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileInductiveConstructors_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.finishInductiveCompilation_run,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileInductive_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileInductiveData_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileMutConsts_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.buildCompiledMutualBlock_codecWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileMutualBlock_run_of_preseed_ordinary_codecWF,
     standardAxioms := standard, nativeAxioms := singletonDriverNative },
@@ -281,20 +276,20 @@ private def roots : Array RootAllowance := #[
       ``Ix.Compile.Verify.compileConstant_run_mutual_of_lookup_sorted_codecWF,
     standardAxioms := standard, nativeAxioms := singletonDriverNative },
   { root := ``Ix.Compile.Verify.finishInductiveFamilyBlock_run_codecWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.lookupInductiveConstructors_run_of_lookup,
     standardAxioms := standard, nativeAxioms := nameNative },
   { root := ``Ix.Compile.Verify.compileDefinition_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.finishDefinitionDataCompilation_run,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileDefinitionData_run_ordinary_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileDefinitionDataInfo_run_ready_codecWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.axiomCompileStartState_frozen,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileConstantInfo_axiom_run_ordinary_codecWF,
     standardAxioms := standard, nativeAxioms := singletonDriverNative },
@@ -325,30 +320,30 @@ private def roots : Array RootAllowance := #[
   { root := ``Ix.Compile.Verify.rewriteWithSharing_wireWF,
     standardAxioms := standard },
   { root := ``Ix.Compile.Verify.applySharing_wireWF,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExpr_run_ordinary_axiomBlock_noSharing_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExpr_run_ordinary_definitionBlock_noSharing_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExpr_run_ordinary_axiomBlock_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExpr_run_ordinary_definitionBlock_roundtrip,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_ordinary_value,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root :=
       ``Ix.Compile.Verify.compileExprNoSurgeryFuel_ordinary_arena_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_ordinary_arena_refines,
-    standardAxioms := standard, nativeAxioms := blake3Native },
+    standardAxioms := standard },
   { root := ``Ix.Compile.Verify.compileExpr_run_ordinary_arena_value,
-    standardAxioms := standard, nativeAxioms := blake3Native }
+    standardAxioms := standard }
 ]
 
-run_cmd Ix.Tc.Verify.Audit.check roots
+run_cmd Ix.Kernel.Verify.Audit.check roots
 
 end Ix.Compile.Verify.Audit.Statements
diff --git a/Ix/Compile/Verify/Catalog.lean b/Ix/Compile/Verify/Catalog.lean
index 3ff230550..4eafad6c1 100644
--- a/Ix/Compile/Verify/Catalog.lean
+++ b/Ix/Compile/Verify/Catalog.lean
@@ -5,7 +5,7 @@ import Std.Data.HashMap.Lemmas
 /-!
 # Immutable compiler catalog and representation well-formedness
 
-This module states the X1 representation boundary without running Ix.Tc.  It
+This module states the X1 representation boundary without running Ix.Kernel.  It
 separates content-address integrity, finite immutable lookup support, logical
 environment views, wire representability, and expression-table resolution.
 
@@ -393,7 +393,7 @@ structure Catalog.Finite (catalog : Catalog) : Prop where
   memberAddrs : FinitelySupported catalog.memberAddrs
 
 /-- X1 in-memory catalog integrity.  This is representation
-well-formedness, not Lean4Lean `VEnv.WF`. -/
+well-formedness, not Ix.Theory.Named `VEnv.WF`. -/
 structure Catalog.WF (catalog : Catalog) : Prop where
   finite : catalog.Finite
   constants : ∀ {addr constant}, catalog.constants addr = some constant →
@@ -434,7 +434,7 @@ theorem Catalog.empty_wf : Catalog.empty.WF := by
 
 /-- Immutable view of a concrete `Ixon.Env`.  `nameOf` and mutual member
 addresses remain explicit semantic inputs because the wire environment stores
-Ix names and projection constants, not Lean4Lean names or a redundant member
+Ix names and projection constants, not Ix.Theory.Named names or a redundant member
 array. -/
 def Catalog.ofEnv (env : Ixon.Env)
     (nameOf : Address → Option Lean.Name)
diff --git a/Ix/Compile/Verify/CompileExpr.lean b/Ix/Compile/Verify/CompileExpr.lean
index 8d2cf06a9..85347ceab 100644
--- a/Ix/Compile/Verify/CompileExpr.lean
+++ b/Ix/Compile/Verify/CompileExpr.lean
@@ -24,7 +24,7 @@ closes the complete ordinary-expression tree: sorts, arbitrary-universe local
 and external constants, recursive projections, literals, structural
 composition, and arbitrary metadata maps including recursive syntax values.
 The proof covers warm caches, universe spelling patches, blob/name commits,
-and independent Lean4Lean values. Its strengthened frontier also relates the
+and independent Ix.Theory.Named values. Its strengthened frontier also relates the
 returned `UInt64` root, including the encoded KV map, to the append-only
 presentation arena under an explicit no-wrap capacity premise.
 -/
@@ -1309,11 +1309,11 @@ theorem compileExpr_run_sort_refines
   exact hrun
 
 /-- The production sort result therefore denotes the same independent
-Lean4Lean value as the source sort. -/
+Ix.Theory.Named value as the source sort. -/
 theorem compileExpr_run_sort_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (snapshot : Ix.CompileM.BlockState) {levelSupport : Ix.Level → Prop}
@@ -1324,7 +1324,7 @@ theorem compileExpr_run_sort_value
     (hctx : RefCompileCtxRel
       (frozenRefCompileCtx compileEnv blockEnv snapshot) sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {level : Ix.Level} {hash : Address}
-    {raw : Ixon.Univ} {idx : UInt64} {value : Lean4Lean.VExpr}
+    {raw : Ixon.Univ} {idx : UInt64} {value : Ix.Theory.Named.VExpr}
     (hlevel : levelSupport level)
     (hstate : FrozenExprStateWF compileEnv blockEnv levelSupport snapshot state)
     (hraw : compileUnivRef (univParamIndex blockEnv.univCtx) level = some raw)
@@ -2097,9 +2097,9 @@ theorem compileExpr_run_constEmpty_ref_refines
     Ix.CompileM.exprCompileDepth] using hrun
 
 theorem compileExpr_run_constEmpty_recur_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (snapshot : Ix.CompileM.BlockState) {levelSupport : Ix.Level → Prop}
@@ -2108,7 +2108,7 @@ theorem compileExpr_run_constEmpty_recur_value
     (hctx : RefCompileCtxRel
       (frozenRefCompileCtx compileEnv blockEnv snapshot) sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {name : Ix.Name} {hash : Address}
-    {recIdx : Nat} {value : Lean4Lean.VExpr}
+    {recIdx : Nat} {value : Ix.Theory.Named.VExpr}
     (hstate : FrozenExprStateWF compileEnv blockEnv levelSupport snapshot state)
     (hmut : blockEnv.mutCtx.get? name = some recIdx)
     (hsource : SourceExprRel (uvars := uvars) venv sctx trProj locals
@@ -2138,9 +2138,9 @@ theorem compileExpr_run_constEmpty_recur_value
     compileExprRef_value hctx hsource href⟩
 
 theorem compileExpr_run_constEmpty_ref_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (snapshot : Ix.CompileM.BlockState) {levelSupport : Ix.Level → Prop}
@@ -2149,7 +2149,7 @@ theorem compileExpr_run_constEmpty_ref_value
     (hctx : RefCompileCtxRel
       (frozenRefCompileCtx compileEnv blockEnv snapshot) sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {name : Ix.Name} {hash addr : Address}
-    {refIdx : UInt64} {value : Lean4Lean.VExpr}
+    {refIdx : UInt64} {value : Ix.Theory.Named.VExpr}
     (hstate : FrozenExprStateWF compileEnv blockEnv levelSupport snapshot state)
     (hmut : blockEnv.mutCtx.get? name = none)
     (hresolve : resolveConstAddr? compileEnv snapshot name = some addr)
@@ -2317,9 +2317,9 @@ theorem compileExpr_run_lit_refines
     Ix.CompileM.exprCompileDepth] using hrun
 
 theorem compileExpr_run_lit_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (snapshot : Ix.CompileM.BlockState) {levelSupport : Ix.Level → Prop}
@@ -2328,7 +2328,7 @@ theorem compileExpr_run_lit_value
     (hctx : RefCompileCtxRel
       (frozenRefCompileCtx compileEnv blockEnv snapshot) sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {literal : Lean.Literal} {hash : Address}
-    {refIdx : UInt64} {value : Lean4Lean.VExpr}
+    {refIdx : UInt64} {value : Ix.Theory.Named.VExpr}
     (hstate : FrozenExprStateWF compileEnv blockEnv levelSupport snapshot state)
     (hpreseed : snapshot.refsIndex.get? (literalAddress literal) = some refIdx)
     (hsource : SourceExprRel (uvars := uvars) venv sctx trProj locals
@@ -2460,18 +2460,18 @@ theorem compileExpr_run_structural_refines
   exact hrun
 
 /-- The production result in the structural fragment therefore denotes the
-same independent Lean4Lean value as its named Ix source. -/
+same independent Ix.Theory.Named value as its named Ix source. -/
 theorem compileExpr_run_structural_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {ctx : RefCompileCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (hfree : compileEnv.surgeryFree = true)
     (hfaithful : ExprKeyFaithfulOn StructuralExpr)
     (hctx : RefCompileCtxRel ctx sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {source : Ix.Expr}
-    {target : Ixon.Expr} {value : Lean4Lean.VExpr}
+    {target : Ixon.Expr} {value : Ix.Theory.Named.VExpr}
     (hstruct : StructuralExpr source)
     (hstate : StructuralExprCacheWF ctx state)
     (hsource : SourceExprRel (uvars := uvars) venv sctx trProj locals source value)
@@ -4140,12 +4140,12 @@ theorem compileExpr_run_ordinary_wireWF
       hlevelFaithful hexprFaithful hsource hstate href
   exact ⟨root, state', hrun, hstate', compileExprRef_wireWF hbound href⟩
 
-/-- Complete ordinary compilation preserves the independent Lean4Lean value
+/-- Complete ordinary compilation preserves the independent Ix.Theory.Named value
 assigned to the source expression. -/
 theorem compileExpr_run_ordinary_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (snapshot : Ix.CompileM.BlockState) {levelSupport : Ix.Level → Prop}
@@ -4156,7 +4156,7 @@ theorem compileExpr_run_ordinary_value
     (hctx : RefCompileCtxRel
       (frozenRefCompileCtx compileEnv blockEnv snapshot) sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {source : Ix.Expr}
-    {target : Ixon.Expr} {value : Lean4Lean.VExpr}
+    {target : Ixon.Expr} {value : Ix.Theory.Named.VExpr}
     (hordinary : SupportedOrdinaryExpr levelSupport source)
     (hstate : FrozenExprStateWF compileEnv blockEnv levelSupport snapshot state)
     (hsource : SourceExprRel (uvars := uvars) venv sctx trProj locals source value)
@@ -4320,9 +4320,9 @@ theorem compileExpr_run_ordinary_arena_refines
 /-- The strengthened public theorem exposes canonical value preservation and
 the faithful presentation sidecar in one result. -/
 theorem compileExpr_run_ordinary_arena_value
-    {venv : Lean4Lean.VEnv} {sctx : SourceCtx} {catalog : Catalog}
+    {venv : Ix.Theory.Named.VEnv} {sctx : SourceCtx} {catalog : Catalog}
     {dctx : DecodeCtx} {trProj : ProjectionRel}
-    {uvars : Nat} {locals : List Lean4Lean.VExpr}
+    {uvars : Nat} {locals : List Ix.Theory.Named.VExpr}
     (compileEnv : Ix.CompileM.CompileEnv)
     (blockEnv : Ix.CompileM.BlockEnv)
     (snapshot : Ix.CompileM.BlockState) {levelSupport : Ix.Level → Prop}
@@ -4333,7 +4333,7 @@ theorem compileExpr_run_ordinary_arena_value
     (hctx : RefCompileCtxRel
       (frozenRefCompileCtx compileEnv blockEnv snapshot) sctx catalog dctx)
     {state : Ix.CompileM.BlockState} {source : Ix.Expr}
-    {target : Ixon.Expr} {value : Lean4Lean.VExpr}
+    {target : Ixon.Expr} {value : Ix.Theory.Named.VExpr}
     (hordinary : SupportedOrdinaryExpr levelSupport source)
     (hstate : FrozenExprStateWF compileEnv blockEnv levelSupport snapshot state)
     (harena : ArenaCacheWF state)
diff --git a/Ix/Compile/Verify/CompilePreseed.lean b/Ix/Compile/Verify/CompilePreseed.lean
index 2611fa215..5fee400be 100644
--- a/Ix/Compile/Verify/CompilePreseed.lean
+++ b/Ix/Compile/Verify/CompilePreseed.lean
@@ -1,5 +1,5 @@
 import Ix.Compile.Verify.CompileConstantCodec
-import Lean4Lean.Verify.QSort
+import Ix.Theory.Named.Verify.QSort
 
 /-!
 # Production expression-table preseeding
@@ -350,7 +350,9 @@ theorem PreseedCollectionWireWF.pushUniv
 
 theorem addressBlake3_wire (bytes : ByteArray) :
     (Address.blake3 bytes).hash.size = 32 := by
-  exact (Blake3.Rust.hash bytes).property
+  exact (Blake3.HasherOps.finalizeWithLength
+    (Blake3.Rust.hasherUpdate (Blake3.Rust.hasherInit ()) bytes) 32 (by
+      rcases System.Platform.numBits_eq with bits | bits <;> rw [bits] <;> decide)).property
 
 /-- Conservative number of reference payloads a source walk can append.
 Seen-set deduplication can only decrease this cost. -/
diff --git a/Ix/Compile/Verify/CompileUniv.lean b/Ix/Compile/Verify/CompileUniv.lean
index 6f5fe1e58..f548ee31b 100644
--- a/Ix/Compile/Verify/CompileUniv.lean
+++ b/Ix/Compile/Verify/CompileUniv.lean
@@ -2,6 +2,8 @@ import Ix.Compile.Verify.CompileState
 import Ix.Compile.Verify.Reference
 import Std.Data.HashMap.Lemmas
 
+open Ix.Theory (VLevel)
+
 /-!
 # Production universe-compiler refinement
 
@@ -689,7 +691,7 @@ theorem compileAndInternUnivCanon_run_refines
     rw [run_bind compileEnv blockEnv canonState _ _, horiginalRun]
     rfl
 
-/-- The production result therefore has the independent Lean4Lean universe
+/-- The production result therefore has the independent Ix.Theory.Named universe
 value assigned to the named source level. -/
 theorem compileUniv_run_value
     (compileEnv : Ix.CompileM.CompileEnv) (blockEnv : Ix.CompileM.BlockEnv)
diff --git a/Ix/Compile/Verify/IxonValue.lean b/Ix/Compile/Verify/IxonValue.lean
index 84358438e..41f25cd50 100644
--- a/Ix/Compile/Verify/IxonValue.lean
+++ b/Ix/Compile/Verify/IxonValue.lean
@@ -1,12 +1,14 @@
 import Ix.Ixon
-import Lean4Lean.Theory.Literals
-import Lean4Lean.Theory.Typing.Env
+import Ix.Theory.Named.Literals
+import Ix.Theory.Named.Typing.Env
+
+open Ix.Theory (VLevel)
 
 /-!
-# Ixon v2 expressions and Lean4Lean values
+# Ixon v2 expressions and Ix.Theory.Named values
 
 This is the first compiler-facing semantic boundary.  It interprets an Ixon
-expression directly as a Lean4Lean `VExpr`; it does not run Ix.Tc and does not
+expression directly as a Ix.Theory.Named `VExpr`; it does not run Ix.Kernel and does not
 use checker acceptance as a specification.
 
 The relation is table-aware.  It resolves universe, reference, mutual-member,
@@ -19,7 +21,7 @@ available to later substructural passes without changing the Lean meaning.
 
 namespace Ix.Compile.Verify
 
-open Lean4Lean (VConstant VEnv VExpr VLevel)
+open Ix.Theory.Named (VConstant VEnv VExpr)
 
 /-- Immutable semantic views needed to interpret an Ixon expression. -/
 structure Catalog where
@@ -70,7 +72,7 @@ def DecodeCtx.univArgs? (ctx : DecodeCtx) (idxs : Array UInt64) :
 
 /-- Projection interpretation is supplied by the surrounding declaration
 model.  Its universe/local-context indices match the existing raw Theory
-boundary, while this module remains independent of Ix.Tc. -/
+boundary, while this module remains independent of Ix.Kernel. -/
 abbrev ProjectionRel :=
   Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop
 
@@ -81,7 +83,7 @@ def none : ProjectionRel := fun _ _ _ _ _ _ => False
 
 end ProjectionRel
 
-/-- Direct semantic relation from table-indexed Ixon syntax to Lean4Lean
+/-- Direct semantic relation from table-indexed Ixon syntax to Ix.Theory.Named
 syntax.  This is a raw representation relation: typing and source-kernel
 well-formedness are separate obligations. -/
 inductive IxonExprRel (venv : VEnv) (catalog : Catalog) (dctx : DecodeCtx)
@@ -307,7 +309,7 @@ theorem eraseModes_iff {venv : VEnv} {catalog : Catalog} {dctx : DecodeCtx}
 
 end IxonExprRel
 
-/-- Honest boundary for source-kernel meaning while upstream Lean4Lean
+/-- Honest boundary for source-kernel meaning while upstream Ix.Theory.Named
 construction remains incomplete.  Compiler theorems consume this explicit
 witness; no axiom is needed for the structural Ixon conversion itself. -/
 structure KernelSourceWitness where
diff --git a/Ix/Compile/Verify/Reference.lean b/Ix/Compile/Verify/Reference.lean
index 9a5610c02..327e47377 100644
--- a/Ix/Compile/Verify/Reference.lean
+++ b/Ix/Compile/Verify/Reference.lean
@@ -1,6 +1,8 @@
 import Ix.Compile.Verify.Catalog
 import Ix.Environment
-import Lean4Lean.Std.Basic
+import Ix.Theory.Named.Std.Basic
+
+open Ix.Theory (VLevel)
 
 /-!
 # Total ordinary-fragment compiler specification
@@ -35,7 +37,7 @@ def compileUnivRef (paramIndex : Ix.Name → Option UInt64) :
 /-- Independent Theory reading of a named Ix universe under the same
 positional parameter assignment. -/
 def sourceUnivValue (paramIndex : Ix.Name → Option UInt64) :
-    Ix.Level → Option Lean4Lean.VLevel
+    Ix.Level → Option Ix.Theory.VLevel
   | .zero _ => some .zero
   | .succ level _ => return .succ (← sourceUnivValue paramIndex level)
   | .max left right _ =>
@@ -161,8 +163,8 @@ private theorem array_mapM_size_of_eq_some {f : α → Option β}
   have hmapped := congrArg (Option.map Array.toList) h
   change Array.toList <$> xs.mapM f = Option.map Array.toList (some ys) at hmapped
   rw [Array.toList_mapM] at hmapped
-  have hlength := Lean4Lean.List.Forall₂.length_eq
-    (Lean4Lean.List.mapM_eq_some.mp hmapped)
+  have hlength := Ix.Theory.Named.List.Forall₂.length_eq
+    (Ix.Theory.Named.List.mapM_eq_some.mp hmapped)
   simpa using hlength.symm
 
 /-- Reference compilation preserves the three root-spine lengths used by the
diff --git a/Ix/Compile/Verify/SourceValue.lean b/Ix/Compile/Verify/SourceValue.lean
index 04fe77053..54051328a 100644
--- a/Ix/Compile/Verify/SourceValue.lean
+++ b/Ix/Compile/Verify/SourceValue.lean
@@ -1,10 +1,12 @@
 import Ix.Compile.Verify.Reference
 
+open Ix.Theory (VLevel)
+
 /-!
 # Source-to-Ixon value preservation
 
 This module closes the first expression-level compiler square.  `SourceExprRel`
-gives a named `Ix.Expr` an independent Lean4Lean meaning.  `RefCompileCtxRel`
+gives a named `Ix.Expr` an independent Ix.Theory.Named meaning.  `RefCompileCtxRel`
 states that the finite indices chosen by `compileExprRef` point at the same
 universes, names, and literal bytes in the target tables.  The preservation
 theorem then constructs `IxonExprRel` for the exact compiler result.
@@ -12,7 +14,7 @@ theorem then constructs `IxonExprRel` for the exact compiler result.
 
 namespace Ix.Compile.Verify
 
-open Lean4Lean (VConstant VEnv VExpr VLevel)
+open Ix.Theory.Named (VConstant VEnv VExpr)
 
 /-- Independent semantic interpretation choices for named source syntax. -/
 structure SourceCtx where
@@ -114,7 +116,7 @@ structure RefCompileCtxRel (compile : RefCompileCtx) (source : SourceCtx)
       String.fromUTF8? bytes = some value
 
 /-- Ordinary reference compilation preserves the independently stated
-Lean4Lean value. -/
+Ix.Theory.Named value. -/
 theorem compileExprRef_value {venv : VEnv} {sctx : SourceCtx}
     {catalog : Catalog} {dctx : DecodeCtx} {compile : RefCompileCtx}
     {trProj : ProjectionRel} {uvars : Nat} {locals : List VExpr}
diff --git a/Ix/Compile/Verify/Statements.lean b/Ix/Compile/Verify/Statements.lean
index 83c9d5cbe..5e53765a5 100644
--- a/Ix/Compile/Verify/Statements.lean
+++ b/Ix/Compile/Verify/Statements.lean
@@ -27,7 +27,7 @@ import Ix.Compile.Verify.SourceValue
 /-!
 # Public compiler-verification frontier
 
-The first slice exports a direct, table-aware Ixon-to-Lean4Lean relation, the
+The first slice exports a direct, table-aware Ixon-to-Ix.Theory.Named relation, the
 constructive theorem that v2 binder modes do not change the related Theory
 value, a total ordinary-fragment reference compiler, and proofs that its
 universe values are preserved and its expression outputs inhabit the
@@ -158,14 +158,14 @@ digest-key faithfulness, well-addressed v2 expression tables and constants,
 and refinement proofs for the production reference/universe interning
 operations through `CompileM.run`. Production `compileUniv` is structurally
 total and refines the reference compiler while preserving both memo-cache
-soundness and the independent Lean4Lean universe value. In surgery-free
+soundness and the independent Ix.Theory.Named universe value. In surgery-free
 environments, production `compileExpr` now selects a kernel-visible total
 path; its recursive structural fragment refines `compileExprRef`, preserves a
 sound collision-disciplined expression cache, retains flattened App-spine
-semantics, and composes with the independent Lean4Lean expression value. A
+semantics, and composes with the independent Ix.Theory.Named expression value. A
 frozen-preseed state relation now closes the complete ordinary-expression
 tree through the actual production dispatcher, including arbitrary-universe
-local and external constants, recursive projections, and their Lean4Lean
+local and external constants, recursive projections, and their Ix.Theory.Named
 value corollary. The strengthened theorem also exposes a structural
 `ArenaRel` for the returned metadata root, preserves every warm-cache root
 under append-only growth, and makes the `UInt64` arena-capacity boundary
@@ -211,6 +211,6 @@ for every variant in the explicit wire domain, with arbitrary canonical
 application, lambda, and forall spines in every expression payload.
 `KernelSourceWitness` is the sole
 upstream source-semantics boundary; later compiler-preservation slices take it
-as an explicit hypothesis until Lean4Lean can construct it for a replayed Lean
+as an explicit hypothesis until Ix.Theory.Named can construct it for a replayed Lean
 environment.
 -/
diff --git a/Ix/Compiler.lean b/Ix/Compiler.lean
new file mode 100644
index 000000000..ad9dfb818
--- /dev/null
+++ b/Ix/Compiler.lean
@@ -0,0 +1,164 @@
+import Ix.Compiler.Fuel
+import Ix.Compiler.X86.NatCallsSim
+import Ix.Compiler.X86.NatCallsExamples
+import Ix.Compiler.Ixon.Serialize
+import Ix.Compiler.Ixon.Uses
+import Ix.Compiler.Ixon.Address
+import Ix.Compiler.Ixon.Univ
+import Ix.Compiler.Ixon.Expr
+import Ix.Compiler.Ixon.Const
+import Ix.Compiler.Ixon.Work
+import Ix.Compiler.Ixon.Sharing
+import Ix.Compiler.Ixon.DecodeCheck
+import Ix.Compiler.Ixon.UsageCheck
+import Ix.Compiler.Ixon.Eval
+import Ix.Compiler.Ixon.Sharing.Eval
+import Ix.Compiler.Ixon.Hash
+import Ix.Compiler.Ixon.Merkle
+import Ix.Compiler.Ixon.Catalog
+import Ix.Compiler.Ixon.CatalogIO
+import Ix.Compiler.DurableSync
+import Ix.Compiler.AddressEnv
+import Ix.Compiler.IxIR.Encoding
+import Ix.Compiler.IxIR.Decode
+import Ix.Compiler.IxIR0.Basic
+import Ix.Compiler.IxIR0.Serialize
+import Ix.Compiler.IxIR0.Decode
+import Ix.Compiler.IxIR0.MutualBlock
+import Ix.Compiler.IxIR0.Readdress
+import Ix.Compiler.IxIR0.Eval
+import Ix.Compiler.IxIR0.ReaddressSim
+import Ix.Compiler.IxIR0.ProjectionSafe
+import Ix.Compiler.IxIR0.ProjectionFree
+import Ix.Compiler.IxIR0.DynamicCost
+import Ix.Compiler.IxIR0.ReaddressProjectionSafe
+import Ix.Compiler.IxIR0.ReaddressOracle
+import Ix.Compiler.IxIR0.Examples
+import Ix.Compiler.IxIR0.ReaddressOracleExamples
+import Ix.Compiler.IxIR0.Mono
+import Ix.Compiler.Erase
+import Ix.Compiler.EraseAddressed
+import Ix.Compiler.EraseAddressedSim
+import Ix.Compiler.Sim
+import Ix.Compiler.EraseValidator
+import Ix.Compiler.SimInstance
+import Ix.Compiler.UsageSound
+import Ix.Compiler.IxIR1.Basic
+import Ix.Compiler.IxIR1.Serialize
+import Ix.Compiler.IxIR1.Decode
+import Ix.Compiler.IxIR1.Readdress
+import Ix.Compiler.IxIR1.MutualBlock
+import Ix.Compiler.IxIR1.ReaddressAll
+import Ix.Compiler.IxIR1.ReaddressSim
+import Ix.Compiler.IxIR1.ReaddressOwnership
+import Ix.Compiler.IxIR1.ReaddressAllSim
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.IxIR1.HPT
+import Ix.Compiler.IxIR1.HPTSound
+import Ix.Compiler.IxIR1.HPTProduce
+import Ix.Compiler.IxIR1.HPTCache
+import Ix.Compiler.IxIR1.HPTCacheIO
+import Ix.Compiler.IxIR1.HPTCacheDirIO
+import Ix.Compiler.IxIR1.HPTCasePrune
+import Ix.Compiler.IxIR1.HPTCasePruneProgram
+import Ix.Compiler.IxIR1.HPTPAPFuse
+import Ix.Compiler.IxIR1.Reachability
+import Ix.Compiler.IxIR1.HPTPAPFuseProgram
+import Ix.Compiler.IxIR1.Optimizer
+import Ix.Compiler.IxIR1.Mono
+import Ix.Compiler.IxIR1.EvalHistory
+import Ix.Compiler.IxIR1.Progress
+import Ix.Compiler.IxIR1.Reclamation
+import Ix.Compiler.IxIR1.Examples
+import Ix.Compiler.IxIR1.Lower
+import Ix.Compiler.IxIR1.LowerAddressed
+import Ix.Compiler.IxIR1.LowerFullyAddressed
+import Ix.Compiler.IxIR1.LowerFullyAddressedSim
+import Ix.Compiler.IxIR1.WellModedGen
+import Ix.Compiler.IxIR1.ThesisBench
+import Ix.Compiler.IxIR1.Sim
+import Ix.Compiler.IxIR1.EvalIso
+import Ix.Compiler.IxIR1.LowerSim
+import Ix.Compiler.IxIR1.LowerStateSim
+import Ix.Compiler.IxIR1.NoReuse
+import Ix.Compiler.IxIR1.NoReuseAddressed
+import Ix.Compiler.IxIR1.CostInstance
+import Ix.Compiler.IxIR1.CostModel
+import Ix.Compiler.IxIR1.CostTrace
+import Ix.Compiler.IxIR1.LowerProgress
+import Ix.Compiler.IxIR1.LowerAddressedSim
+import Ix.Compiler.IxIR1.LowerMutualAddressedSim
+import Ix.Compiler.IxIR1.LowerMutualAddressedProgress
+import Ix.Compiler.IxIR2.Basic
+import Ix.Compiler.IxIR2.Validate
+import Ix.Compiler.IxIR2.ValidateExamples
+import Ix.Compiler.IxIR2.Liveness
+import Ix.Compiler.IxIR2.LivenessExamples
+import Ix.Compiler.IxIR2.Eval
+import Ix.Compiler.IxIR2.EvalFuel
+import Ix.Compiler.IxIR2.CreditFree
+import Ix.Compiler.IxIR2.Interpretation
+import Ix.Compiler.IxIR2.EvalCounter
+import Ix.Compiler.IxIR2.EvalExamples
+import Ix.Compiler.IxIR2.Lower
+import Ix.Compiler.IxIR2.LowerExamples
+import Ix.Compiler.IxIR2.LowerSim
+import Ix.Compiler.Pipeline
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR2.PipelineSim
+import Ix.Compiler.IxIR2.PipelinePhysical
+import Ix.Compiler.IxIR2.Reuse
+import Ix.Compiler.IxIR2.ReuseSim
+import Ix.Compiler.IxIR2.ReuseLiveSim
+import Ix.Compiler.IxIR2.ReuseSimExamples
+import Ix.Compiler.IxIR2.ReuseExamples
+import Ix.Compiler.X86.Basic
+import Ix.Compiler.X86.Eval
+import Ix.Compiler.X86.EvalExamples
+import Ix.Compiler.X86.ScalarApply
+import Ix.Compiler.X86.Select
+import Ix.Compiler.X86.PipelineSim
+import Ix.Compiler.X86.ValidatedScalar
+import Ix.Compiler.X86.ScalarSourceObject
+import Ix.Compiler.X86.ScalarSources
+import Ix.Compiler.X86.PhysicalScalarExport
+import Ix.Compiler.X86.PhysicalScalarSourceObject
+import Ix.Compiler.X86.PhysicalScalarCapturedSourceObject
+import Ix.Compiler.X86.PhysicalScalarSources
+import Ix.Compiler.X86.PhysicalScalarExamples
+import Ix.Compiler.Coverage.StdContact
+import Ix.Compiler.X86.SelectExamples
+import Ix.Compiler.X86.Encode
+import Ix.Compiler.X86.EncodeExamples
+import Ix.Compiler.X86.ByteExamples
+import Ix.Compiler.X86.StreamExamples
+import Ix.Compiler.X86.ELF
+import Ix.Compiler.X86.ELFExamples
+import Ix.Compiler.PipelineSound
+import Ix.Compiler.IxIR0.Recursion
+import Ix.Compiler.IxIR0.RecursionSim
+import Ix.Compiler.Recursion.Pipeline
+import Ix.Compiler.Recursion.Sim
+import Ix.Compiler.Recursion.PhysicalSim
+import Ix.Compiler.Recursion.Resources
+import Ix.Compiler.Recursion.Allocation
+import Ix.Compiler.Recursion.Costs
+import Ix.Compiler.Recursion.Rejections
+import Ix.Compiler.CallReuse.Sim
+import Ix.Compiler.CallReuse.MapSim
+import Ix.Compiler.CallReuse.Rejections
+import Ix.Compiler.UniqueReuse.PipelineSim
+import Ix.Compiler.UniqueReuse.Rejections
+import Ix.Compiler.UniqueReuse.NativeSim
+import Ix.Compiler.UniqueReuse.NativeObject
+import Ix.Compiler.UniqueReuse.RuntimeNativeSim
+import Ix.Compiler.UniqueReuse.RuntimeObjectSim
+import Ix.Compiler.X86.RuntimeReject
+import Ix.Compiler.IxIR2.CreditRefinement
+import Ix.Compiler.IxIR2.CreditExamples
+import Ix.Compiler.Borrow.Pipeline
+import Ix.Compiler.IxIR2.Borrow.Examples
+import Ix.Compiler.Borrow.RuntimeSim
+import Ix.Compiler.Borrow.RuntimeInput
+import Ix.Compiler.IxIR2.Borrow.OpenExamples
+import Ix.Compiler.Fence
diff --git a/Ix/Compiler/AddressEnv.lean b/Ix/Compiler/AddressEnv.lean
new file mode 100644
index 000000000..c3af5ffcb
--- /dev/null
+++ b/Ix/Compiler/AddressEnv.lean
@@ -0,0 +1,58 @@
+import Ix.Compiler.Ixon.Address
+import Std.Data.HashMap.Lemmas
+
+/-!
+# Indexed address environments
+
+Proof-facing IR environments are functions whose list constructor uses
+`List.find?`.  That definition is intentionally transparent and convenient in
+the kernel, but repeated global lookup is linear in the size of a corpus.
+
+This module supplies an extensionally equal two-stage implementation: build a
+hash index once, preserving `List.find?`'s first-binding-wins behavior, and
+then close over its lookup function.  Keeping those stages explicit matters:
+a curried `List → Address → Option α` implementation can otherwise rebuild the
+index at every saturated call after compiler arity analysis.
+-/
+
+namespace Ix.Compiler.AddressEnv
+
+open Ixon (Address)
+
+abbrev Index (α : Type) := Std.HashMap Address α
+
+/-- Build from right to left so an earlier duplicate overwrites a later one,
+exactly matching `List.find?`.  Lean's proved `List.foldr` compiler rewrite
+uses its stack-safe implementation in generated code. -/
+def build (entries : List (Address × α)) : Index α :=
+  entries.foldr (fun entry index => index.insert entry.1 entry.2) {}
+
+/-- Turn an already-built index into the proof model's function type. Partial
+application captures the index; it never rebuilds it during lookup. -/
+def lookup (index : Index α) : Address → Option α :=
+  fun address => index.get? address
+
+theorem get?_build (entries : List (Address × α)) (address : Address) :
+    (build entries).get? address =
+      (entries.find? (fun entry => entry.1 == address)).map (·.2) := by
+  induction entries with
+  | nil => simp [build]
+  | cons entry rest ih =>
+    rw [show build (entry :: rest) = (build rest).insert entry.1 entry.2 by
+      rfl]
+    rw [Std.HashMap.get?_insert, ih]
+    by_cases h : entry.1 = address <;> simp [h]
+
+/-- Lookup equivalence, including duplicate-key precedence and misses. -/
+theorem lookup_build_apply (entries : List (Address × α)) (address : Address) :
+    lookup (build entries) address =
+      (entries.find? (fun entry => entry.1 == address)).map (·.2) := by
+  exact get?_build entries address
+
+theorem lookup_build (entries : List (Address × α)) :
+    lookup (build entries) = fun address =>
+      (entries.find? (fun entry => entry.1 == address)).map (·.2) := by
+  funext address
+  exact lookup_build_apply entries address
+
+end Ix.Compiler.AddressEnv
diff --git a/Ix/Compiler/Borrow/Pipeline.lean b/Ix/Compiler/Borrow/Pipeline.lean
new file mode 100644
index 000000000..32c6cd487
--- /dev/null
+++ b/Ix/Compiler/Borrow/Pipeline.lean
@@ -0,0 +1,141 @@
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR2.Borrow.Replay
+
+/-! Attach the optional borrowed-call pass to the actual validated Ixon
+compiler. In addition to the exact baseline/rewrite replay, selection checks
+the source evaluation internally. A failed optional check retains the entire
+checked baseline attachment. Invalid source is still a compiler error. -/
+
+namespace Ix.Compiler.Borrow
+
+open Ix.Compiler.Ixon (Address Owned)
+
+structure Options where
+  maxCandidates : Nat := 32
+  maxRounds : Nat := 16
+  maxAttempts : Nat := 256
+  sourceFuel : Nat := 1000
+  budget : IxIR2.Borrow.Budget := {}
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Options.limits (options : Options) : IxIR2.Borrow.Limits :=
+  { maxCandidates := options.maxCandidates, maxRounds := options.maxRounds
+    maxAttempts := options.maxAttempts }
+
+structure SourceExecution (constants : List (Address × Ixon.Constant))
+    (root : Address) (config : Pipeline.Config) (fuel : Nat) where
+  number : Nat
+  ran : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) fuel
+    (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource =
+      .ok (.litV (.natL number))
+
+def executeSource (constants : List (Address × Ixon.Constant))
+    (root : Address) (config : Pipeline.Config) (fuel : Nat) :
+    Except String (SourceExecution constants root config fuel) :=
+  match ran : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) fuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource with
+  | .ok (.litV (.natL number)) => .ok ⟨number, ran⟩
+  | .ok _ => .error "source result is outside the closed scalar borrow boundary"
+  | .error error => .error s!"source replay failed: {repr error}"
+
+structure Improved {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel)
+    (options : Options) where
+  target : IxIR2.Borrow.Improved options.limits attached.target.artifact.validationContext
+    options.budget attached.target.artifact.program
+  source : SourceExecution constants root config options.sourceFuel
+  agrees : source.number = target.before.number
+
+inductive Fallback where
+  | target (reason : IxIR2.Borrow.Fallback)
+  | source (message : String)
+  | sourceMismatch
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+structure Selection {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel)
+    (options : Options) where
+  inference : IxIR2.Borrow.Inference
+  attempt : Except Fallback (Improved attached options)
+
+def select {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel)
+    (options : Options := {}) : Selection attached options :=
+  let baselineChecked : IxIR2.Validate.Checked options.limits.validator
+      attached.target.artifact.validationContext attached.target.artifact.program :=
+    ⟨attached.target.stats, attached.target.accepted⟩
+  let selected := IxIR2.Borrow.optimize baselineChecked options.budget
+  let attempt := match selected.decision with
+    | .baseline reason => .error (.target reason)
+    | .improved target =>
+        match executeSource constants root config options.sourceFuel with
+        | .error message => .error (.source message)
+        | .ok source =>
+            if agrees : source.number = target.before.number then
+              .ok ⟨target, source, agrees⟩
+            else .error .sourceMismatch
+  ⟨selected.inference, attempt⟩
+
+def Selection.program {constants root config world eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel}
+    (selection : Selection attached options) : IxIR2.Program :=
+  match selection.attempt with
+  | .error _ => attached.target.artifact.program
+  | .ok improved => improved.target.rewrite.program
+
+structure Compilation (constants : List (Address × Ixon.Constant)) (root : Address)
+    (config : Pipeline.Config) (world : Owned) (eraseFuel lowerFuel : Nat)
+    (options : Options) where
+  baseline : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel
+  selection : Selection baseline options
+
+def compileValidated (constants : List (Address × Ixon.Constant)) (root : Address)
+    (config : Pipeline.Config) (world : Owned) (checkFuel eraseFuel validateFuel lowerFuel maxDepth : Nat)
+    (options : Options := {}) :
+    Except IxIR2.Pipeline.Error (Compilation constants root config world eraseFuel lowerFuel options) := do
+  let baseline ← IxIR2.Pipeline.compileValidated constants root config world
+    checkFuel eraseFuel validateFuel lowerFuel maxDepth
+  pure ⟨baseline, select baseline options⟩
+
+theorem Improved.sourcePreservation {constants root config world eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel}
+    (result : Improved attached options) :
+    Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) options.sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource =
+        .ok (.litV (.natL result.source.number)) ∧
+    IxIR2.Borrow.run attached.target.artifact.validationContext options.budget
+        result.target.rewrite.program = .ok result.target.after.result ∧
+    result.target.after.result.value = .lit (.nat result.source.number) := by
+  refine ⟨result.source.ran, result.target.after.ran, ?_⟩
+  rw [result.target.after.scalar, result.agrees, result.target.same]
+
+theorem Improved.resources {constants root config world eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel}
+    (result : Improved attached options) :
+    IxIR2.Borrow.Reclaimed result.target.before.result.store ∧
+    IxIR2.Borrow.Reclaimed result.target.after.result.store ∧
+    result.target.after.result.store.heap.rcops < result.target.before.result.store.heap.rcops ∧
+    result.target.after.result.store.peakLiveNodes ≤ result.target.before.result.store.peakLiveNodes :=
+  result.target.resources
+
+theorem Selection.valid {constants root config world eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel}
+    (selection : Selection attached options) :
+    IxIR2.Validate.Valid attached.target.artifact.validationContext selection.program := by
+  cases h : selection.attempt with
+  | error _ =>
+      simpa [Selection.program, h] using
+        (show IxIR2.Validate.Valid attached.target.artifact.validationContext
+            attached.target.artifact.program from ⟨attached.target.stats, attached.target.accepted⟩)
+  | ok improved =>
+      simpa [Selection.program, h, Options.limits, IxIR2.Validate.Valid] using
+        improved.target.rewrite.valid
+
+theorem Selection.fallbackExact {constants root config world eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel}
+    (selection : Selection attached options) {reason : Fallback}
+    (fallback : selection.attempt = .error reason) :
+    selection.program = attached.target.artifact.program := by
+  simp [Selection.program, fallback]
+
+end Ix.Compiler.Borrow
diff --git a/Ix/Compiler/Borrow/Report.lean b/Ix/Compiler/Borrow/Report.lean
new file mode 100644
index 000000000..e718e7ce3
--- /dev/null
+++ b/Ix/Compiler/Borrow/Report.lean
@@ -0,0 +1,148 @@
+import Ix.Compiler.Borrow.Pipeline
+import Ix.Compiler.Borrow.Sources
+import Ix.Compiler.IxIR2.Borrow.Examples
+import Ix.Compiler.Coverage.Run
+import Ix.Compiler.Coverage.HeapSnapshot
+
+namespace Ix.Compiler.Borrow
+
+open Lean Ix.Compiler.Ixon
+
+deriving instance ToJson for IxIR2.Borrow.Summary
+deriving instance ToJson for IxIR2.Borrow.Inference
+deriving instance ToJson for IxIR2.Borrow.Budget
+deriving instance ToJson for Options
+
+def resultJson (result : IxIR2.Eval.Result) : Json :=
+  Json.mkObj [("value", toJson result.value), ("store", toJson result.store),
+    ("control_remaining", toJson result.controlRemaining), ("heap_remaining", toJson result.heapRemaining)]
+
+def programSize (program : IxIR2.Program) : Json :=
+  let functions := program.main :: program.declarations.filterMap fun
+    | (_, .fn definition) => some definition
+    | _ => none
+  Json.mkObj [("declarations", toJson program.declarations.length),
+    ("blocks", toJson (functions.foldl (fun n f => n + f.blocks.size) 0)),
+    ("instructions", toJson (functions.foldl (fun n f =>
+      n + f.blocks.foldl (fun n b => n + b.instructions.size) 0) 0))]
+
+private def controlJson (program : IxIR2.Program) (control : IxIR2.Eval.Control) :
+    Except String Json := do
+  match control with
+  | .halted value => pure (Json.mkObj [("halted", toJson value)])
+  | .running frame stack =>
+      let owner ← if frame.definition == program.main then pure "main" else do
+        let some entry := program.declarations.find? fun entry =>
+          match entry.2 with | .fn definition => definition == frame.definition | _ => false
+          | throw "execution frame does not belong to the compiled program"
+        pure entry.1.toHex
+      pure (Json.mkObj [("owner", toJson owner), ("block", toJson frame.block),
+        ("pc", toJson frame.pc), ("values", toJson frame.values), ("stack_depth", toJson stack.length)])
+
+/-- Complete heap slots and frame values at every actual evaluator step.
+The terminal state must agree with the proof-carrying replay result. -/
+def prefixesFrom (context : IxIR2.Validate.Context) (budget : IxIR2.Borrow.Budget)
+    (program : IxIR2.Program) (initial : IxIR2.Eval.Machine) (result : IxIR2.Eval.Result) : Except String Json := do
+  let mut machine := initial
+  let mut rows := #[]
+  for step in [:budget.control + 1] do
+    rows := rows.push (Json.mkObj [("step", toJson step), ("store", toJson machine.store),
+      ("heap_remaining", toJson machine.heapFuel), ("control", ← controlJson program machine.control)])
+    match machine.control with
+    | .halted value =>
+        if toJson machine.store != toJson result.store || toJson value != toJson result.value ||
+            machine.heapFuel != result.heapRemaining || step + result.controlRemaining != budget.control then
+          throw "execution-prefix terminal state differs from the checked replay"
+        return Json.arr rows
+    | .running .. =>
+        machine ← (IxIR2.Eval.step (IxIR2.Eval.Context.ofProgram program context.schemas)
+          .physical machine).mapError (fun error => s!"prefix execution: {repr error}")
+  throw "execution-prefix budget exhausted"
+
+def prefixes (context : IxIR2.Validate.Context) (budget : IxIR2.Borrow.Budget)
+    (program : IxIR2.Program) (result : IxIR2.Eval.Result) : Except String Json :=
+  prefixesFrom context budget program (IxIR2.Eval.initialMachine program.main #[] budget.heap) result
+
+def nativeBoundary (program : IxIR2.Program) : Except String String :=
+  match X86.Select.select program with
+  | .error (.invalidSource (.invalid _ .schema "missing constructor schema")) =>
+      .ok "missingConstructorSchema"
+  | .error error => .error s!"unexpected scalar selector boundary: {repr error}"
+  | .ok _ => .error "borrowed heap chain unexpectedly became natively selectable"
+
+structure CaseResult where
+  name : String
+  row : Json
+  snapshot : Json
+  compileMs : Nat
+  borrowMs : Nat
+
+private def checked {α : Type} (value : Except String α) : IO α :=
+  match value with
+  | .ok result => pure result
+  | .error message => throw (IO.userError message)
+
+private def fallbacks (source : Coverage.Source) (attached : source.Attached) :
+    Except String Json := do
+  let mut rows := #[]
+  for (name, options) in [
+      ("inference-budget", ({ maxAttempts := 0 } : Options)),
+      ("target-replay-budget", { budget := { control := 0 } }),
+      ("source-replay-budget", { sourceFuel := 0 })] do
+    let selected := select attached options
+    let .error reason := selected.attempt | throw s!"{name}: missing checked fallback"
+    if selected.program != attached.target.artifact.program then
+      throw s!"{name}: fallback changed the checked baseline"
+    rows := rows.push (Json.mkObj [("name", toJson name), ("options", toJson options),
+      ("reason", toJson (reprStr reason)), ("program", toJson selected.program)])
+  return Json.arr rows
+
+def runCase (depth : Nat) (successorCase : Bool) : IO CaseResult := do
+  let source ← checked (Examples.source depth successorCase)
+  let number := if successorCase then 22 else 11
+  let start ← IO.monoMsNow
+  let attached ← checked (source.compile.mapError (fun error => s!"source compilation: {repr error}"))
+  let compiled ← IO.monoMsNow
+  let selection := select attached
+  let improved ← checked (selection.attempt.mapError (fun error => s!"borrow selection: {repr error}"))
+  let borrowed ← IO.monoMsNow
+  let before := improved.target.before.result
+  let after := improved.target.after.result
+  let program := improved.target.rewrite.program
+  let baseline := attached.target.artifact.program
+  let context := attached.target.artifact.validationContext
+  let observations ← checked (source.observe attached number)
+  if improved.source.number != number || before.store.heap.rcops != 5 || after.store.heap.rcops != 3 ||
+      before.store.heap.allocs != 3 || after.store.heap.allocs != 3 ||
+      before.store.peakLiveNodes != 2 || after.store.peakLiveNodes != 2 ||
+      improved.target.rewrite.summaries.length != depth + 3 then
+    throw (IO.userError "borrow witness result, RC, peak, or inferred ABI count drifted")
+  let nativeBefore ← checked (nativeBoundary baseline)
+  let nativeAfter ← checked (nativeBoundary program)
+  let fallback ← if depth == 0 && !successorCase then checked (fallbacks source attached)
+    else pure (toJson (#[] : Array Json))
+  let beforePrefixes ← checked (prefixes context {} baseline before)
+  let afterPrefixes ← checked (prefixes context {} program after)
+  let row := Json.mkObj [
+    ("name", toJson source.name), ("depth", toJson depth), ("successor", toJson successorCase),
+    ("origin", toJson "synthetic-ixon"), ("source_root", toJson source.root),
+    ("number", toJson number), ("snapshot", toJson s!"{source.name}.json"),
+    ("baseline", toJson before.store.counters), ("borrowed", toJson after.store.counters),
+    ("baseline_size", programSize baseline), ("borrowed_size", programSize program),
+    ("inference", toJson selection.inference),
+    ("baseline_control_steps", toJson (1000 - before.controlRemaining)),
+    ("borrowed_control_steps", toJson (1000 - after.controlRemaining)),
+    ("baseline_heap_work", toJson (1000 - before.heapRemaining)),
+    ("borrowed_heap_work", toJson (1000 - after.heapRemaining)),
+    ("native_baseline", toJson nativeBefore), ("native_borrowed", toJson nativeAfter)]
+  let snapshot := Json.mkObj [
+    ("format", toJson "compilatrix/source-borrow-case/1"), ("summary", row),
+    ("compilation", source.compilationSnapshot attached), ("options", toJson ({} : Options)),
+    ("rewritten", toJson program), ("validation_stats", toJson improved.target.rewrite.checked.stats),
+    ("observations", observations.stages), ("baseline_execution", resultJson before),
+    ("borrowed_execution", resultJson after), ("baseline_prefixes", beforePrefixes),
+    ("borrowed_prefixes", afterPrefixes), ("fallbacks", fallback)]
+  return { name := source.name, row, snapshot
+           compileMs := compiled - start, borrowMs := borrowed - compiled }
+
+end Ix.Compiler.Borrow
diff --git a/Ix/Compiler/Borrow/Runtime.lean b/Ix/Compiler/Borrow/Runtime.lean
new file mode 100644
index 000000000..644e32951
--- /dev/null
+++ b/Ix/Compiler/Borrow/Runtime.lean
@@ -0,0 +1,92 @@
+import Ix.Compiler.Borrow.RuntimeSource
+
+/-! Ordinary validated source compilation followed by optional structural
+borrow certification. Options contain only compiler/checker work limits;
+runtime arguments and evaluation fuel are absent from selection. -/
+
+namespace Ix.Compiler.Borrow.Runtime
+
+open Ix.Compiler.Ixon (Address)
+
+structure Options where
+  maxCandidates : Nat := 32
+  maxRounds : Nat := 16
+  maxAttempts : Nat := 256
+  maxSourceDepth : Nat := 32
+  policy : IxIR2.Borrow.Open.Policy := {}
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Options.limits (options : Options) : IxIR2.Borrow.Limits :=
+  { maxCandidates := options.maxCandidates, maxRounds := options.maxRounds, maxAttempts := options.maxAttempts }
+
+structure Certified {constants root config eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel) (options : Options) where
+  target : IxIR2.Borrow.Open.Certificate options.limits attached.target.artifact.validationContext attached.target.artifact.program
+  source : Source.Shape attached.source.erasure.result.raw (.ref root) target.schema.zeroResult target.schema.succResult
+  sameDepth : source.chain.depth = target.entry.beforeBody.depth
+
+inductive Rejection where
+  | target (reason : IxIR2.Borrow.Open.Rejection)
+  | source
+  | depth
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+structure Selection {constants root config eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel) (options : Options) where
+  inference : IxIR2.Borrow.Inference
+  attempt : Except Rejection (Certified attached options)
+
+def select {constants root config eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (options : Options := {}) : Selection attached options :=
+  let checked : IxIR2.Validate.Checked options.limits.validator
+      attached.target.artifact.validationContext attached.target.artifact.program :=
+    ⟨attached.target.stats, attached.target.accepted⟩
+  let target := IxIR2.Borrow.Open.optimize checked options.policy
+  let attempt := do
+    let target ← target.attempt.mapError Rejection.target
+    let some source := Source.recognize attached.source.erasure.result.raw (.ref root)
+        target.schema.zeroResult target.schema.succResult options.maxSourceDepth | throw .source
+    if sameDepth : source.chain.depth = target.entry.beforeBody.depth then
+      pure (⟨target, source, sameDepth⟩ : Certified attached options)
+    else throw .depth
+  ⟨target.inference, attempt⟩
+
+def Selection.program {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (selection : Selection attached options) : IxIR2.Program :=
+  match selection.attempt with
+  | .ok certified => certified.target.rewrite.program
+  | .error _ => attached.target.artifact.program
+
+structure Compilation (constants : List (Address × Ixon.Constant)) (root : Address) (config : Pipeline.Config)
+    (eraseFuel lowerFuel : Nat) (options : Options) where
+  baseline : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel
+  selection : Selection baseline options
+
+def compileValidated (constants : List (Address × Ixon.Constant)) (root : Address) (config : Pipeline.Config)
+    (checkFuel eraseFuel validateFuel lowerFuel maxDepth : Nat) (options : Options := {}) :
+    Except IxIR2.Pipeline.Error (Compilation constants root config eraseFuel lowerFuel options) := do
+  let baseline ← IxIR2.Pipeline.compileValidated constants root config .shared
+    checkFuel eraseFuel validateFuel lowerFuel maxDepth
+  return ⟨baseline, select baseline options⟩
+
+theorem Selection.valid {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (selection : Selection attached options) :
+    IxIR2.Validate.Valid attached.target.artifact.validationContext selection.program := by
+  cases h : selection.attempt with
+  | error _ =>
+      simpa [Selection.program, h] using
+        (show IxIR2.Validate.Valid attached.target.artifact.validationContext attached.target.artifact.program from
+          ⟨attached.target.stats, attached.target.accepted⟩)
+  | ok result =>
+      simpa [Selection.program, h, Options.limits, IxIR2.Validate.Valid] using result.target.rewrite.valid
+
+theorem Selection.fallbackExact {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (selection : Selection attached options) {reason : Rejection}
+    (fallback : selection.attempt = .error reason) : selection.program = attached.target.artifact.program := by
+  simp [Selection.program, fallback]
+
+end Ix.Compiler.Borrow.Runtime
diff --git a/Ix/Compiler/Borrow/RuntimeInput.lean b/Ix/Compiler/Borrow/RuntimeInput.lean
new file mode 100644
index 000000000..fbf865c16
--- /dev/null
+++ b/Ix/Compiler/Borrow/RuntimeInput.lean
@@ -0,0 +1,132 @@
+import Ix.Compiler.Borrow.RuntimeSim
+
+/-! Caller-side input construction, separate from the compiler and selector.
+The construction proof covers every finite constructor chain and scalar
+payload, not only the regression matrix. -/
+
+namespace Ix.Compiler.Borrow.Runtime
+
+open Ix.Compiler.Ixon (Address)
+open IxIR2.Eval
+open IxIR2.Borrow.Open (Schema Major Input)
+open Ix.Compiler.IxIR1.Sim (RootOwnership rootsFor nodeChildren)
+open Ix.Compiler.IxIR1.Reclamation (AllocationOrderInvariant)
+
+inductive Tree where
+  | scalar (value : Nat)
+  | zero
+  | succ (tail : Tree)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Tree.nodes : Tree → Nat
+  | .scalar _ => 0
+  | .zero => 1
+  | .succ tail => tail.nodes + 1
+
+def Tree.nested : Nat → Tree → Tree
+  | 0, tail => tail
+  | count + 1, tail => .succ (nested count tail)
+
+def Tree.make (schema : Schema) : Tree → Store × RVal
+  | .scalar value => ({}, .lit (.nat value))
+  | .zero =>
+      let allocated := ({} : Store).allocNode .shared (.ctorN schema.zero #[])
+      (allocated.1, .loc allocated.2)
+  | .succ tail =>
+      let input := tail.make schema
+      let allocated := input.1.allocNode .shared (.ctorN schema.succ #[input.2])
+      (allocated.1, .loc allocated.2)
+
+def Tree.sourceValue (block : Address) : Tree → Ixon.Eval.Value
+  | .scalar value => .litV (.natL value)
+  | .zero => .ctorV block 0 0 []
+  | .succ tail => .ctorV block 0 1 [tail.sourceValue block]
+
+def Tree.rawValue (schema : Schema) : Tree → IxIR0.Value
+  | .scalar value => .lit (.nat value)
+  | .zero => .ctor schema.zero.block 0 []
+  | .succ tail => .ctor schema.succ.block 1 [tail.rawValue schema]
+
+structure Ready (store : Store) (value : RVal) : Prop where
+  owned : RootOwnership store.heap [⟨.shared, value⟩]
+  ordered : AllocationOrderInvariant store.heap
+  accounted : store.heap.allocs = store.live + store.heap.frees
+  peak : store.live ≤ store.peakLiveNodes
+
+private theorem allocatedReady (store : Store) (cid : IxIR2.CtorId) (values : Array RVal)
+    (owned : RootOwnership store.heap (rootsFor .shared values.toList))
+    (ordered : AllocationOrderInvariant store.heap)
+    (accounted : store.heap.allocs = store.live + store.heap.frees) :
+    Ready (store.allocNode .shared (.ctorN cid values)).1 (.loc (store.allocNode .shared (.ctorN cid values)).2) := by
+  have children : ∀ child ∈ nodeChildren (.ctorN cid values), IxIR1.Sim.LiveRVal store.heap child := by
+    intro child member
+    exact IxIR2.CreditRefinement.live_of_world
+      (owned.roots_world ⟨.shared, child⟩ (by simpa [rootsFor, nodeChildren] using member))
+  refine ⟨?_, ordered.allocNode children, ?_, ?_⟩
+  · exact RootOwnership.allocNode (rest := []) (by simpa [nodeChildren] using owned) trivial
+  · rw [Store.live_allocNode]
+    simp only [Store.allocNode_heap, IxIR1.Store.allocNode]
+    omega
+  · rw [Store.peakLive_allocNode]
+    exact Nat.le_max_right _ _
+
+theorem Tree.ready (schema : Schema) (tree : Tree) : Ready (tree.make schema).1 (tree.make schema).2 := by
+  induction tree with
+  | scalar value =>
+      exact ⟨RootOwnership.addNoLocation rfl RootOwnership.empty, .empty, rfl, Nat.le_refl _⟩
+  | zero =>
+      exact allocatedReady {} schema.zero #[] RootOwnership.empty .empty rfl
+  | succ tail ih =>
+      exact allocatedReady (tail.make schema).1 schema.succ #[(tail.make schema).2]
+        (by simpa [rootsFor] using ih.owned) ih.ordered ih.accounted
+
+theorem Tree.counts (schema : Schema) (tree : Tree) :
+    (tree.make schema).1.heap.allocs = tree.nodes ∧
+    (tree.make schema).1.heap.frees = 0 ∧
+    (tree.make schema).1.heap.rcops = 0 ∧
+    (tree.make schema).1.live = tree.nodes ∧
+    (tree.make schema).1.peakLiveNodes = tree.nodes := by
+  induction tree with
+  | scalar => exact ⟨rfl, rfl, rfl, rfl, rfl⟩
+  | zero => exact ⟨rfl, rfl, rfl, rfl, rfl⟩
+  | succ tail ih =>
+      rcases ih with ⟨allocs, frees, rcops, live, peak⟩
+      refine ⟨?_, frees, rcops, ?_, ?_⟩
+      · simp [Tree.make, Tree.nodes, IxIR1.Store.allocNode, allocs]
+      · simpa [Tree.make, Tree.nodes, Store.live_allocNode] using live
+      · simp only [Tree.make, Store.peakLive_allocNode, Store.live_allocNode, peak, live, Tree.nodes]
+        omega
+
+inductive Argument where
+  | zero
+  | succ (payload : Tree)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Argument.tree : Argument → Tree
+  | .zero => .zero
+  | .succ payload => .succ payload
+
+def Argument.make (schema : Schema) : Argument → Store × Nat
+  | .zero => ({} : Store).allocNode .shared (.ctorN schema.zero #[])
+  | .succ payload =>
+      let input := payload.make schema
+      input.1.allocNode .shared (.ctorN schema.succ #[input.2])
+
+def Argument.major (schema : Schema) : Argument → Major
+  | .zero => .zero
+  | .succ payload => .succ (payload.make schema).2
+
+def Argument.source (schema : Schema) : Argument → Source.Argument
+  | .zero => .zero schema.zero.block
+  | .succ payload => .succ schema.succ.block (payload.rawValue schema)
+
+theorem Argument.input (schema : Schema) (argument : Argument) :
+    Input schema (argument.major schema) (argument.make schema).1 (argument.make schema).2 1 := by
+  have ready := argument.tree.ready schema
+  cases argument with
+  | zero =>
+      exact ⟨IxIR1.Sim.HeapIso.get?_allocNode_new .., ready.owned, ready.ordered, ready.accounted, ready.peak⟩
+  | succ payload =>
+      exact ⟨IxIR1.Sim.HeapIso.get?_allocNode_new .., ready.owned, ready.ordered, ready.accounted, ready.peak⟩
+
+end Ix.Compiler.Borrow.Runtime
diff --git a/Ix/Compiler/Borrow/RuntimeReport.lean b/Ix/Compiler/Borrow/RuntimeReport.lean
new file mode 100644
index 000000000..dd9240d11
--- /dev/null
+++ b/Ix/Compiler/Borrow/RuntimeReport.lean
@@ -0,0 +1,199 @@
+import Ix.Compiler.Borrow.RuntimeInput
+import Ix.Compiler.Borrow.Report
+
+namespace Ix.Compiler.Borrow.Runtime
+
+open Lean
+open Ix.Compiler.Ixon (Address)
+open IxIR2.Eval
+open IxIR2.Borrow.Open (Schema)
+
+deriving instance ToJson for IxIR2.Borrow.Open.Schema
+deriving instance ToJson for IxIR2.Borrow.Open.Policy
+deriving instance ToJson for Options
+deriving instance ToJson for Tree
+deriving instance ToJson for Argument
+
+def inputs : Array (String × Argument) := #[
+  ("zero", .zero),
+  ("succ-0", .succ (.scalar 0)),
+  ("succ-1", .succ (.scalar 1)),
+  ("succ-wide", .succ (.scalar (2 ^ 256 + 19))),
+  ("nested-zero-1", .succ .zero),
+  ("nested-zero-8", .succ (Tree.nested 7 .zero)),
+  ("nested-zero-32", .succ (Tree.nested 31 .zero)),
+  ("nested-scalar-17", .succ (Tree.nested 16 (.scalar 4096)))]
+
+/-- A caller adapter exercises exact PAP saturation of the preserved owned
+export. Its construction is separate from source compilation and selection. -/
+def dynamicCaller (entry : Address) : IxIR2.Function :=
+  { signature := { params := #[{ world := .shared, passing := .owned }], result := .shared, papSafe := false }
+    blocks := #[{
+      valueParams := #[.owned .shared], creditParams := #[]
+      instructions := #[.papp entry #[], .apply (.reg 1) #[.reg 0]]
+      terminator := .ret (.reg 2) }] }
+
+def callerAddress : Address := .replicate 240
+
+def withCaller (program : IxIR2.Program) (entry : Address) : IxIR2.Program :=
+  { program with declarations := program.declarations ++ [(callerAddress, .fn (dynamicCaller entry))] }
+
+private def checked {α : Type} (value : Except String α) : IO α :=
+  match value with
+  | .ok result => pure result
+  | .error message => throw (IO.userError message)
+
+private def run (validation : IxIR2.Validate.Context) (program : IxIR2.Program)
+    (definition : IxIR2.Function) (argument : RVal) (store : Store) : Except String Result :=
+  (runFunction (.ofProgram program validation.schemas) .physical definition #[argument] 1000 1000 store).mapError reprStr
+
+private def sourceNumber (source : Coverage.Source) (block : Address) (argument : Argument) : Except String Nat := do
+  let ctx := Pipeline.validatedEvalCtx source.constants source.config
+  let function ← (Ixon.Eval.eval ctx 1000 (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError reprStr
+  let result ← (Ixon.Eval.apply ctx 1000 function (argument.tree.sourceValue block)).mapError reprStr
+  let .litV (.natL number) := result | throw "runtime Ixon application did not return a Nat literal"
+  return number
+
+private def rawNumber {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (certified : Certified attached options) (argument : Argument) : Except String Nat := do
+  let ctx : IxIR0.Ctx := { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+  let function ← (IxIR0.eval ctx 1000 [] (.ref root)).mapError reprStr
+  let result ← (IxIR0.apply ctx 1000 function (argument.source certified.target.schema).value).mapError reprStr
+  let .lit (.nat number) := result | throw "runtime raw IxIR0 application did not return a Nat literal"
+  return number
+
+private def executeInput {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (certified : Certified attached options) (source : Coverage.Source)
+    (dataBlock : Address) (name : String) (argument : Argument) : Except String Json := do
+  let schema := certified.target.schema
+  let input := argument.make schema
+  let value : RVal := .loc input.2
+  let expected := (argument.major schema).result schema
+  let ixon ← sourceNumber source dataBlock argument
+  let raw ← rawNumber certified argument
+  if ixon != expected || raw != expected then throw "runtime source result disagrees with the structural certificate"
+  let validation := attached.target.artifact.validationContext
+  let baseline := attached.target.artifact.program
+  let rewritten := certified.target.rewrite.program
+  let entry := certified.target.entry
+  let mut paths := #[]
+  for dynamic in [false, true] do
+    let beforeProgram := if dynamic then withCaller baseline entry.summary.owner else baseline
+    let afterProgram := if dynamic then withCaller rewritten entry.summary.owner else rewritten
+    if dynamic then
+      let _ ← (IxIR2.Validate.validate validation beforeProgram).mapError reprStr
+      let _ ← (IxIR2.Validate.validate validation afterProgram).mapError reprStr
+    let beforeDefinition := if dynamic then dynamicCaller entry.summary.owner else entry.before
+    let afterDefinition := if dynamic then dynamicCaller entry.summary.owner else IxIR2.Borrow.ownedWrapper entry.summary.borrowed entry.before
+    let before ← run validation beforeProgram beforeDefinition value input.1
+    let after ← run validation afterProgram afterDefinition value input.1
+    let beforePrefixes ← Borrow.prefixesFrom validation {} beforeProgram
+      (initialMachine beforeDefinition #[value] 1000 input.1) before
+    let afterPrefixes ← Borrow.prefixesFrom validation {} afterProgram
+      (initialMachine afterDefinition #[value] 1000 input.1) after
+    let allocations := argument.tree.nodes + (if dynamic then 1 else 0)
+    let extra := if dynamic then 3 else 0
+    if before.value != .lit (.nat expected) || after.value != before.value ||
+        before.store.heap.rcops != after.store.heap.rcops + 2 ||
+        before.store.heap.allocs != allocations || after.store.heap.allocs != allocations ||
+        before.store.heap.frees != allocations || after.store.heap.frees != allocations ||
+        before.store.live != 0 || after.store.live != 0 ||
+        before.store.peakLiveNodes != allocations || after.store.peakLiveNodes != allocations ||
+        1000 - before.controlRemaining != entry.beforeBody.ownedCost (argument.major schema).fieldCost + extra ||
+        1000 - after.controlRemaining != entry.afterBody.readCost (argument.major schema).fieldCost + 3 + extra ||
+        before.heapRemaining + 1 != after.heapRemaining then
+      throw "open borrowed execution drifted from its structural cost/resource laws"
+    paths := paths.push (Json.mkObj [
+      ("kind", toJson (if dynamic then "dynamic" else "direct")),
+      ("baseline", Borrow.resultJson before), ("borrowed", Borrow.resultJson after),
+      ("baseline_prefixes", beforePrefixes), ("borrowed_prefixes", afterPrefixes)])
+  return Json.mkObj [
+    ("name", toJson name), ("argument", toJson argument), ("input_store", toJson input.1),
+    ("input_value", toJson value), ("nodes", toJson argument.tree.nodes), ("number", toJson expected),
+    ("ixon", toJson ixon), ("raw_ixir0", toJson raw), ("paths", toJson paths)]
+
+private def lender {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (certified : Certified attached options) : Except String Json := do
+  let argument : Argument := .succ (Tree.nested 7 .zero)
+  let input := argument.make certified.target.schema
+  let value : RVal := .loc input.2
+  let retained ← (retainShared input.1 value >>= (retainShared · value)).mapError reprStr
+  let validation := attached.target.artifact.validationContext
+  let program := certified.target.rewrite.program
+  let result ← run validation program certified.target.entry.after value retained
+  let trace ← Borrow.prefixesFrom validation {} program
+    (initialMachine certified.target.entry.after #[value] 1000 retained) result
+  if toJson result.store != toJson retained || result.value != .lit (.nat certified.target.schema.succResult) then
+    throw "borrowed entry changed the caller's aliased lender"
+  let mut cleanup := result.store
+  let mut fuel := result.heapRemaining
+  for _ in [:3] do
+    let released ← (releaseShared fuel cleanup value).mapError reprStr
+    cleanup := released.1
+    fuel := released.2
+  if cleanup.live != 0 || cleanup.heap.allocs != cleanup.heap.frees then
+    throw "caller could not reclaim the returned lender"
+  return Json.mkObj [
+    ("argument", toJson argument), ("owners", toJson (3 : Nat)),
+    ("input_store", toJson retained), ("input_value", toJson value),
+    ("execution", Borrow.resultJson result), ("prefixes", trace),
+    ("cleanup_store", toJson cleanup), ("cleanup_remaining", toJson fuel)]
+
+private def fallbacks {constants root config eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel) : Except String Json := do
+  let mut rows := #[]
+  for (name, options) in [
+      ("disabled", ({ policy := { enabled := false } } : Options)),
+      ("inference-budget", { maxAttempts := 0 }),
+      ("target-structure-budget", { policy := { maxDepth := 0 } }),
+      ("source-structure-budget", { maxSourceDepth := 0 })] do
+    let selected := select attached options
+    let .error reason := selected.attempt | throw s!"{name}: fallback was not selected"
+    if selected.program != attached.target.artifact.program then throw s!"{name}: fallback changed baseline"
+    rows := rows.push (Json.mkObj [("name", toJson name), ("options", toJson options),
+      ("reason", toJson (reprStr reason)), ("program", toJson selected.program)])
+  return toJson rows
+
+structure CaseResult where
+  name : String
+  row : Json
+  snapshot : Json
+  compileMs : Nat
+  checkMs : Nat
+
+def runCase (depth : Nat) : IO CaseResult := do
+  let source ← checked (Runtime.source depth)
+  let started ← IO.monoMsNow
+  let attached ← checked (source.compile.mapError reprStr)
+  let compiled ← IO.monoMsNow
+  let selection := select attached
+  let certified ← checked (selection.attempt.mapError reprStr)
+  let selected ← IO.monoMsNow
+  if certified.target.rewrite.summaries.length != depth + 2 || certified.source.chain.depth != depth then
+    throw (IO.userError "runtime summary or source chain depth drifted")
+  let some block := source.constants[0]? | throw (IO.userError "missing source declaration group")
+  let observations ← checked (inputs.mapM fun (name, argument) => executeInput certified source block.1 name argument)
+  let lender ← checked (lender certified)
+  let fallbacks ← checked (fallbacks attached)
+  let nativeBefore ← checked (Borrow.nativeBoundary attached.target.artifact.program)
+  let nativeAfter ← checked (Borrow.nativeBoundary certified.target.rewrite.program)
+  let row := Json.mkObj [
+    ("name", toJson source.name), ("depth", toJson depth), ("source_root", toJson source.root),
+    ("snapshot", toJson s!"{source.name}.json"), ("origin", toJson "synthetic-ixon"),
+    ("entry", toJson certified.target.entry.summary.owner), ("borrowed_entry", toJson certified.target.entry.summary.borrowed),
+    ("factory", toJson certified.target.exported.factoryAddress), ("schema", toJson certified.target.schema),
+    ("inference", toJson selection.inference),
+    ("baseline_size", Borrow.programSize attached.target.artifact.program),
+    ("borrowed_size", Borrow.programSize certified.target.rewrite.program),
+    ("runtime_inputs", toJson observations.size), ("native_baseline", toJson nativeBefore), ("native_borrowed", toJson nativeAfter)]
+  let snapshot := Json.mkObj [
+    ("format", toJson "compilatrix/source-borrow-runtime-case/1"), ("summary", row),
+    ("compilation", source.compilationSnapshot attached), ("rewritten", toJson certified.target.rewrite.program),
+    ("options", toJson ({} : Options)), ("validation_stats", toJson certified.target.rewrite.checked.stats),
+    ("observations", toJson observations), ("lender", lender), ("fallbacks", fallbacks)]
+  return { name := source.name, row, snapshot, compileMs := compiled - started, checkMs := selected - compiled }
+
+end Ix.Compiler.Borrow.Runtime
diff --git a/Ix/Compiler/Borrow/RuntimeSim.lean b/Ix/Compiler/Borrow/RuntimeSim.lean
new file mode 100644
index 000000000..55afa7cd4
--- /dev/null
+++ b/Ix/Compiler/Borrow/RuntimeSim.lean
@@ -0,0 +1,166 @@
+import Ix.Compiler.Borrow.Runtime
+import Ix.Compiler.SimApply
+
+namespace Ix.Compiler.Borrow.Runtime
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR0.Recursion (Evaluates Applies)
+
+private theorem frameWF (root : Address) : (Pipeline.validatedMainFrame root).SharingWF := by
+  constructor
+  · rfl
+  · intro index member found
+    simp [Pipeline.validatedMainFrame] at found
+
+/-- Project the actual source compiler's erasure certificate, including its
+mutual-member scope. No source execution is performed by selection. -/
+theorem erasureFunction {constants root config eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    {fuel : Nat} {function : Ixon.Eval.Value}
+    (oracles : @Sim.OracleRel attached.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList attached.source.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) fuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok function) :
+    ∃ targetFuel targetFunction,
+      IxIR0.eval { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+        targetFuel [] (.ref root) = .ok targetFunction ∧
+      @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+        { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+        function targetFunction attached.source.memberScope := by
+  letI : Sim.MemberScope := attached.source.memberScope
+  have inlined := Ixon.Eval.eval_inlineSharing contextWF (frameWF root) .nil
+    (by rfl) evaluated
+  have entry := attached.source.entry.related
+  rw [EraseValidator.inlineTables_tablesOfFrame] at entry
+  obtain ⟨fuel, value, run, related⟩ := Sim.erasure_sim_with_members
+    attached.source.members oracles inlined.1 entry (by
+      simpa [Ixon.Eval.valuesInlineSharing] using
+        (Sim.EnvRel.nil (ectx := (Pipeline.validatedEvalCtx constants config).inlineSharing)
+          (ictx := { env := IxIR0.Env.ofList attached.source.erasure.result.raw })
+          (refs := (Pipeline.validatedMainFrame root).inlineSharing.refs)
+          (muts := (Pipeline.validatedMainFrame root).inlineSharing.selfMuts)
+          (sa := (Pipeline.validatedMainFrame root).inlineSharing.selfAddr)))
+  rw [attached.source.entryTarget] at run
+  exact ⟨fuel, value, run, related⟩
+
+private theorem applies_unique {ctx : IxIR0.Ctx} {function argument left right : IxIR0.Value}
+    (first : Applies ctx function argument left) (second : Applies ctx function argument right) : left = right := by
+  obtain ⟨a, ha⟩ := first
+  obtain ⟨b, hb⟩ := second
+  have ha' := IxIR0.apply_mono (fuel' := a + b) (by omega) ha
+  have hb' := IxIR0.apply_mono (fuel' := a + b) (by omega) hb
+  exact Except.ok.inj (ha'.symm.trans hb')
+
+/-- Source preservation on every represented argument. Sharing and oracle
+premises are the existing erasure boundary; the function/application proof
+comes from the checked source graph and never from a supplied callback. -/
+theorem Certified.sourcePreservation {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (certified : Certified attached options) (argument : Source.Argument)
+    {functionFuel applyFuel : Nat} {function sourceArgument result : Ixon.Eval.Value}
+    (oracles : @Sim.OracleRel attached.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList attached.source.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) functionFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok function)
+    (argumentWF : sourceArgument.SharingWF)
+    (argumentRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+      sourceArgument argument.value attached.source.memberScope)
+    (applied : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config)
+      applyFuel function sourceArgument = .ok result) :
+    @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+      result (.lit (.nat (argument.result certified.target.schema.zeroResult certified.target.schema.succResult)))
+      attached.source.memberScope := by
+  letI : Sim.MemberScope := attached.source.memberScope
+  obtain ⟨_, _, functionRun, functionRel⟩ := erasureFunction attached oracles contextWF evaluated
+  have functionEq := Evaluates.unique ⟨_, functionRun⟩ certified.source.evaluates
+  rw [functionEq] at functionRel
+  have functionWF := (Ixon.Eval.eval_inlineSharing contextWF (frameWF root) .nil (by rfl) evaluated).2
+  obtain ⟨_, _, resultRun, resultRel⟩ := Sim.apply_sim_inlineSharing attached.source.members
+    oracles contextWF functionWF argumentWF applied functionRel argumentRel
+  have resultEq := applies_unique ⟨_, resultRun⟩ (certified.source.applies argument)
+  simpa only [resultEq] using resultRel
+
+/-- The same accepted source function has two actual target executions on
+every owned runtime heap in the stated domain. Their scalar results agree,
+both reclaim the whole input, and borrowing removes exactly two RC ticks. -/
+theorem Certified.runtimePreservation {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (certified : Certified attached options) (argument : Source.Argument) (field : IxIR2.Eval.RVal)
+    {store : IxIR2.Eval.Store} {location rc : Nat}
+    (input : IxIR2.Borrow.Open.Input certified.target.schema (argument.target field) store location rc)
+    (mode : IxIR2.Eval.Interpretation) (exit : IxIR2.Borrow.Open.Exit) :
+    let target := certified.target
+    let number := argument.result target.schema.zeroResult target.schema.succResult
+    ∃ fuel output,
+      IxIR2.Eval.Steps (IxIR2.Borrow.Open.context attached.target.artifact.validationContext attached.target.artifact.program)
+        mode (target.entry.beforeBody.ownedCost (argument.target field).fieldCost)
+        (IxIR2.Borrow.Open.start target.entry.before location store (fuel + 2) exit)
+        (IxIR2.Borrow.Open.finish (IxIR2.Borrow.Open.bump output 2) 0 number exit) ∧
+      IxIR2.Eval.Steps (IxIR2.Borrow.Open.context attached.target.artifact.validationContext target.rewrite.program)
+        mode (target.entry.afterBody.readCost (argument.target field).fieldCost + 3)
+        (IxIR2.Borrow.Open.start (IxIR2.Borrow.ownedWrapper target.entry.summary.borrowed target.entry.before)
+          location store (fuel + 1) exit)
+        (IxIR2.Borrow.Open.finish output 0 number exit) ∧
+      IxIR2.Borrow.Open.FullyReleased output ∧ IxIR2.Borrow.Open.FullyReleased (IxIR2.Borrow.Open.bump output 2) ∧
+      output.peakLiveNodes = store.peakLiveNodes ∧ output.heap.rcops < (IxIR2.Borrow.Open.bump output 2).heap.rcops := by
+  simpa only [Source.Argument.target_result] using
+    certified.target.strictImprovement mode (argument.target field) input exit
+
+/-- Compose the actual source erasure/application certificate with the two
+public target runners. The input relation needs only the observed outer tag;
+the ownership contract governs reclamation of the entire target payload. -/
+theorem Certified.sourceToRuntime {constants root config eraseFuel lowerFuel options}
+    {attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel}
+    (certified : Certified attached options) (argument : Source.Argument) (field : IxIR2.Eval.RVal)
+    {functionFuel applyFuel : Nat} {function sourceArgument result : Ixon.Eval.Value}
+    (oracles : @Sim.OracleRel attached.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList attached.source.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) functionFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok function)
+    (argumentWF : sourceArgument.SharingWF)
+    (argumentRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+      sourceArgument argument.value attached.source.memberScope)
+    (applied : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config)
+      applyFuel function sourceArgument = .ok result)
+    {store : IxIR2.Eval.Store} {location rc : Nat}
+    (input : IxIR2.Borrow.Open.Input certified.target.schema (argument.target field) store location rc)
+    (mode : IxIR2.Eval.Interpretation) :
+    let target := certified.target
+    let major := argument.target field
+    let number := argument.result target.schema.zeroResult target.schema.succResult
+    ∃ fuel output,
+      @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+        { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+        result (.lit (.nat number)) attached.source.memberScope ∧
+      IxIR2.Eval.runFunction
+        (IxIR2.Borrow.Open.context attached.target.artifact.validationContext attached.target.artifact.program)
+        mode target.entry.before #[.loc location] (target.entry.beforeBody.ownedCost major.fieldCost)
+        (fuel + 2) store = .ok {
+          store := IxIR2.Borrow.Open.bump output 2, value := .lit (.nat number)
+          controlRemaining := 0, heapRemaining := 0 } ∧
+      IxIR2.Eval.runFunction
+        (IxIR2.Borrow.Open.context attached.target.artifact.validationContext target.rewrite.program)
+        mode (IxIR2.Borrow.ownedWrapper target.entry.summary.borrowed target.entry.before) #[.loc location]
+        (target.entry.afterBody.readCost major.fieldCost + 3) (fuel + 1) store = .ok {
+          store := output, value := .lit (.nat number), controlRemaining := 0, heapRemaining := 0 } ∧
+      IxIR2.Borrow.Open.FullyReleased output ∧
+      IxIR2.Borrow.Open.FullyReleased (IxIR2.Borrow.Open.bump output 2) ∧
+      output.peakLiveNodes = store.peakLiveNodes ∧
+      (IxIR2.Borrow.Open.bump output 2).heap.rcops = output.heap.rcops + 2 := by
+  have source := certified.sourcePreservation argument oracles contextWF evaluated argumentWF argumentRel applied
+  obtain ⟨fuel, output, before, after, clean, beforeClean, peak⟩ :=
+    certified.target.runFunctions mode (argument.target field) input
+  refine ⟨fuel, output, source, ?_, ?_, clean, beforeClean, peak, rfl⟩
+  · simpa only [Source.Argument.target_result] using before
+  · simpa only [Source.Argument.target_result] using after
+
+end Ix.Compiler.Borrow.Runtime
diff --git a/Ix/Compiler/Borrow/RuntimeSource.lean b/Ix/Compiler/Borrow/RuntimeSource.lean
new file mode 100644
index 000000000..efc9037eb
--- /dev/null
+++ b/Ix/Compiler/Borrow/RuntimeSource.lean
@@ -0,0 +1,151 @@
+import Ix.Compiler.Borrow.Sources
+import Ix.Compiler.IxIR0.RecursionSim
+import Ix.Compiler.IxIR2.Borrow.OpenResources
+
+namespace Ix.Compiler.Borrow.Runtime
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR0
+open Ix.Compiler.IxIR0.Recursion (Evaluates Applies evaluatesDef evaluatesLam evaluatesVar
+  evaluatesApp evaluatesLet evaluatesLit evaluatesRecursor appliesClosure appliesRecursor)
+
+/-- The canonical function and constructor declarations contain no runtime
+input. Removing B1's closed application also removes its literal payload. -/
+def source (depth : Nat) : Except String Coverage.Source := do
+  let closed ← Examples.source depth true
+  let some worker := closed.constants[2]? | throw "borrow source worker is missing"
+  return { closed with
+    name := s!"read-tag-runtime-{depth}"
+    constants := closed.constants.take 5
+    root := worker.1
+    literals := [11, 22] }
+
+namespace Source
+
+def reader (zeroResult succResult : Nat) : Decl :=
+  .recursor 0 false #[{ fields := 0, rhs := .lit (.nat zeroResult) },
+    { fields := 1, rhs := .lit (.nat succResult) }]
+
+def forwardBody (callee : Address) : Expr := .app (.ref callee) (.var 0)
+
+def twiceBody (callee : Address) : Expr :=
+  .letE .many (.app (.ref callee) (.var 0)) (.app (.ref callee) (.var 1))
+
+inductive Chain (env : Env) (zeroResult succResult : Nat) : Address → Type where
+  | reader (address : Address) (found : env address = some (reader zeroResult succResult)) :
+      Chain env zeroResult succResult address
+  | forward (address callee : Address)
+      (found : env address = some (.defn .shared (.lam .many (forwardBody callee))))
+      (tail : Chain env zeroResult succResult callee) : Chain env zeroResult succResult address
+
+def Chain.depth {env zeroResult succResult address} : Chain env zeroResult succResult address → Nat
+  | .reader .. => 0
+  | .forward _ _ _ tail => tail.depth + 1
+
+def Chain.value {env zeroResult succResult address} : Chain env zeroResult succResult address → Value
+  | .reader address _ => .pap (.rec_ address 1) []
+  | .forward _ callee .. => .clos .many [] (forwardBody callee)
+
+def recognizeChain (env : Env) (zeroResult succResult : Nat) :
+    Nat → (address : Address) → Option (Chain env zeroResult succResult address)
+  | 0, _ => none
+  | fuel + 1, address =>
+      if found : env address = some (reader zeroResult succResult) then
+        some (.reader address found)
+      else do
+        let some (.defn .shared (.lam .many (.app (.ref callee) (.var 0)))) := env address | none
+        let tail ← recognizeChain env zeroResult succResult fuel callee
+        if found : env address = some (.defn .shared (.lam .many (forwardBody callee))) then
+          some (.forward address callee found tail)
+        else none
+
+structure Shape (declarations : List (Address × Decl)) (main : Expr) (zeroResult succResult : Nat) where
+  root : Address
+  worker : Address
+  callee : Address
+  mainEq : main = .ref root
+  rootAt : Env.ofList declarations root = some (.defn .shared (.ref worker))
+  workerAt : Env.ofList declarations worker = some (.defn .shared (.lam .many (twiceBody callee)))
+  chain : Chain (Env.ofList declarations) zeroResult succResult callee
+
+def recognize (declarations : List (Address × Decl)) (main : Expr)
+    (zeroResult succResult fuel : Nat) : Option (Shape declarations main zeroResult succResult) := do
+  let .ref root := main | none
+  let env := Env.ofList declarations
+  let some (.defn .shared (.ref worker)) := env root | none
+  let some (.defn .shared (.lam .many (.letE .many
+      (.app (.ref callee) (.var 0)) (.app (.ref _) (.var 1))))) := env worker | none
+  let chain ← recognizeChain env zeroResult succResult fuel callee
+  if mainEq : main = .ref root then
+    if rootAt : env root = some (.defn .shared (.ref worker)) then
+      if workerAt : env worker = some (.defn .shared (.lam .many (twiceBody callee))) then
+        some ⟨root, worker, callee, mainEq, rootAt, workerAt, chain⟩
+      else none
+    else none
+  else none
+
+/-- Constructor payloads are unrestricted. The reader observes only the
+outer tag and arity; the successor field may itself represent a large heap. -/
+inductive Argument where
+  | zero (constructor : Address)
+  | succ (constructor : Address) (field : Value)
+
+def Argument.value : Argument → Value
+  | .zero constructor => .ctor constructor 0 []
+  | .succ constructor field => .ctor constructor 1 [field]
+
+def Argument.target (field : IxIR2.Eval.RVal) : Argument → IxIR2.Borrow.Open.Major
+  | .zero _ => .zero
+  | .succ .. => .succ field
+
+def Argument.result (zeroResult succResult : Nat) : Argument → Nat
+  | .zero _ => zeroResult
+  | .succ .. => succResult
+
+theorem Chain.evaluates {ctx : Ctx} {zeroResult succResult address}
+    (chain : Chain ctx.env zeroResult succResult address) (env : List Value) :
+    Evaluates ctx env (.ref address) chain.value := by
+  cases chain with
+  | reader _ found => exact evaluatesRecursor found
+  | forward _ _ found _ => exact evaluatesDef found (evaluatesLam ctx [] .many _)
+
+theorem Chain.applies {ctx : Ctx} {zeroResult succResult address}
+    (chain : Chain ctx.env zeroResult succResult address) (argument : Argument) :
+    Applies ctx chain.value argument.value (.lit (.nat (argument.result zeroResult succResult))) := by
+  induction chain with
+  | reader address found =>
+      cases argument with
+      | zero constructor =>
+          exact appliesRecursor found rfl rfl rfl (evaluatesLit ctx _ _)
+      | succ constructor field =>
+          exact appliesRecursor found rfl rfl rfl (evaluatesLit ctx _ _)
+  | forward address callee found tail ih =>
+      exact appliesClosure (evaluatesApp (tail.evaluates _) (evaluatesVar rfl) ih)
+
+def Shape.value {declarations main zeroResult succResult}
+    (shape : Shape declarations main zeroResult succResult) : Value :=
+  .clos .many [] (twiceBody shape.callee)
+
+theorem Shape.evaluates {declarations main zeroResult succResult}
+    (shape : Shape declarations main zeroResult succResult) :
+    Evaluates { env := Env.ofList declarations } [] main shape.value := by
+  simpa only [shape.mainEq, Shape.value] using
+    (evaluatesDef shape.rootAt (evaluatesDef shape.workerAt
+      (evaluatesLam { env := Env.ofList declarations } [] .many _)))
+
+theorem Shape.applies {declarations main zeroResult succResult}
+    (shape : Shape declarations main zeroResult succResult) (argument : Argument) :
+    Applies { env := Env.ofList declarations } shape.value argument.value
+      (.lit (.nat (argument.result zeroResult succResult))) := by
+  have applied := Chain.applies (ctx := { env := Env.ofList declarations }) shape.chain argument
+  apply appliesClosure
+  apply evaluatesLet
+  · exact evaluatesApp (shape.chain.evaluates _) (evaluatesVar rfl) applied
+  · exact evaluatesApp (shape.chain.evaluates _) (evaluatesVar rfl) applied
+
+theorem Argument.target_result (schema : IxIR2.Borrow.Open.Schema) (argument : Argument) (field : IxIR2.Eval.RVal) :
+    (argument.target field).result schema = argument.result schema.zeroResult schema.succResult := by
+  cases argument <;> rfl
+
+end Source
+end Ix.Compiler.Borrow.Runtime
diff --git a/Ix/Compiler/Borrow/Sources.lean b/Ix/Compiler/Borrow/Sources.lean
new file mode 100644
index 000000000..9614fcf35
--- /dev/null
+++ b/Ix/Compiler/Borrow/Sources.lean
@@ -0,0 +1,72 @@
+import Ix.Compiler.Coverage.Sources
+
+/-! Canonical synthetic Ixon inputs for borrowed direct calls. A shared Nat
+constructor is inspected twice through named functions in one source group.
+The group permits known calls to the recursor, whose tag read returns 11 or
+22. No intermediate IR is provided. -/
+
+namespace Ix.Compiler.Borrow.Examples
+
+open Ix.Compiler.Ixon
+
+private def definition (value typ : Expr) (refs : Array Address) : Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def projection (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def ghost (value : Expr) : Expr :=
+  .app (.lam .erased (.sort 0) value) (.sort 0)
+
+private def natInductive : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0, typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+        typ := .recur 0 #[] },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .all .many .shared (.recur 0 #[]) (.recur 0 #[]) }] }
+
+/-- `depth` forwarding functions precede a caller that reads the same value
+ twice. Zero and successor cases both perform a constructor dispatch. -/
+def source (depth : Nat) (successorCase : Bool) : Except String Coverage.Source := do
+  if depth > 8 then throw "borrow fixture exceeds eight forwarding functions"
+  let natT := Expr.recur 0 #[]
+  let typ := Expr.all .many .shared natT natT
+  let reader : Recursor :=
+    { k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0
+      motives := 0, minors := 0, typ
+      rules := #[
+        { fields := 0, rhs := .nat 0 },
+        { fields := 1, rhs := .lam .many natT (.nat 1) }] }
+  let mut members : Array MutConst := #[.indc natInductive, .recr reader]
+  for index in [:depth] do
+    members := members.push (.defn
+      { kind := .defn, safety := .safe, lvls := 0, typ
+        value := .lam .many natT (.app (.recur (index + 1).toUInt64 #[]) (.var 0)) })
+  let call := fun value => Expr.app (.recur (depth + 1).toUInt64 #[]) value
+  members := members.push (.defn
+    { kind := .defn, safety := .safe, lvls := 0, typ
+      value := .lam .many natT
+        (.letE false natT (call (.var 0)) (call (.var 1))) })
+  let block ← Coverage.addressed
+    { info := .muts members, sharing := #[], univs := #[.zero]
+      refs := #[X86.ValidatedScalar.literalAddress 11, X86.ValidatedScalar.literalAddress 22] }
+  let natType ← Coverage.addressed (projection (.iPrj { idx := 0, block := block.1 }))
+  let worker ← Coverage.addressed
+    (projection (.dPrj { idx := (depth + 2).toUInt64, block := block.1 }))
+  let zero ← Coverage.addressed (projection (.cPrj { idx := 0, cidx := 0, block := block.1 }))
+  let successor ← Coverage.addressed
+    (projection (.cPrj { idx := 0, cidx := 1, block := block.1 }))
+  let major := if successorCase then .app (.ref 2 #[]) (ghost (.nat 4))
+    else ghost (.ref 1 #[])
+  let entry ← Coverage.addressed (definition (.app (.ref 0 #[]) major)
+    (.ref 3 #[]) #[worker.1, zero.1, successor.1, natType.1,
+      X86.ValidatedScalar.literalAddress 42])
+  return {
+    name := s!"read-tag-{depth}-{if successorCase then "succ" else "zero"}"
+    constants := [block, natType, worker, zero, successor, entry]
+    root := entry.1, literals := [11, 22, 42]
+    expected := .scalar (if successorCase then 22 else 11) false }
+
+end Ix.Compiler.Borrow.Examples
diff --git a/Ix/Compiler/CallReuse/MapPipeline.lean b/Ix/Compiler/CallReuse/MapPipeline.lean
new file mode 100644
index 000000000..8547c4f8d
--- /dev/null
+++ b/Ix/Compiler/CallReuse/MapPipeline.lean
@@ -0,0 +1,105 @@
+import Ix.Compiler.CallReuse.Pipeline
+import Ix.Compiler.IxIR0.MapRecovery
+
+/-! Optional exact map specialization feeds the ordinary ownership compiler
+and common checked backend. Every failure keeps the validated literal source
+artifact. The v1 reuse selection itself retains checked baseline fallback. -/
+
+namespace Ix.Compiler.CallReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+
+def mapInput (result : IxIR1.ReaddressAll.Result) : IxIR2.Lower.Input :=
+  { declarations := result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations
+    main := result.main, mainResult := .shared }
+
+def mapSidecars {fuel : Nat} (plan : IxIR0.MapRecovery.Plan)
+    (source : Pipeline.LoweredCompilation .shared fuel) :
+    Except IxIR2.Pipeline.Error (IxIR2.Pipeline.BuiltCompiledSidecars source) := do
+  let hpt ← (IxIR1.HPT.produce source.lowering.result.artifacts).mapError .hpt
+  let constructors : List IxIR2.Pipeline.ConstructorInfo :=
+    [{ identity := IxIR1.Lower.ctorIdOf plan.schema.nil 0, arity := 0 },
+      { identity := IxIR1.Lower.ctorIdOf plan.schema.cons 1, arity := 2 }] ++
+      plan.retainedAlias.toList.map fun pair => { identity := IxIR1.Lower.ctorIdOf pair 0, arity := 2 }
+  let sidecars : IxIR2.Pipeline.Sidecars := {
+    input := mapInput source.lowering.result
+    parameterEntries := source.targetDecls.filterMap fun (address, declaration) => match declaration with
+      | .fn definition => some (address, Array.replicate definition.arity .shared)
+      | .extern _ => none
+    constructors
+    hptCertificate := hpt.certificate }
+  return { sidecars, hpt, certificateProduced := rfl, inputProduced := rfl }
+
+structure MapLowered {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    (recovery : IxIR0.MapRecovery.Recovered declarations main) (fuel : Nat) where
+  lowering : IxIR1.Lower.FullyAddressedTrace
+    (IxIR0.MapRecovery.targetDeclarations recovery.checked.plan recovery.address)
+    (recovery.checked.plan.directMain recovery.address) .shared fuel
+  certificate : Pipeline.LoweringCertificate
+    (IxIR0.MapRecovery.targetDeclarations recovery.checked.plan recovery.address)
+    (lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)
+  backend : IxIR2.Pipeline.CompiledRun (Pipeline.LoweredCompilation.ofTrace lowering certificate)
+  reuse : IxIR2.CallReuse.Selection IxIR2.Validate.defaultLimits
+    backend.val.target.artifact.validationContext backend.val.target.artifact.program
+
+def MapLowered.compilation {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.MapRecovery.Recovered declarations main} {fuel : Nat}
+    (lowered : MapLowered recovery fuel) : Pipeline.LoweredCompilation .shared fuel :=
+  Pipeline.LoweredCompilation.ofTrace lowered.lowering lowered.certificate
+def MapLowered.attached {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.MapRecovery.Recovered declarations main} {fuel : Nat}
+    (lowered : MapLowered recovery fuel) : IxIR2.Pipeline.CompiledAttachment .shared fuel := lowered.backend.val
+theorem MapLowered.sourceProduced {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.MapRecovery.Recovered declarations main} {fuel : Nat}
+    (lowered : MapLowered recovery fuel) : lowered.attached.source = lowered.compilation := lowered.backend.property
+
+inductive MapSkip where
+  | recovery (reason : IxIR0.Recursion.Skip)
+  | lowering (message : String)
+  | attachment (error : IxIR2.Pipeline.Error)
+  deriving Repr
+
+def lowerMap {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    (recovery : IxIR0.MapRecovery.Recovered declarations main) (fuel : Nat) (maxDepth : Nat) :
+    Except MapSkip (MapLowered recovery fuel) := do
+  let lowering ← (IxIR1.Lower.lowerAllIndexedFullyAddressedWithTrace
+    (IxIR0.MapRecovery.targetDeclarations recovery.checked.plan recovery.address)
+    (recovery.checked.plan.directMain recovery.address) .shared fuel).mapError .lowering
+  let certificate ← (Pipeline.checkLoweringCertificate
+    (IxIR0.MapRecovery.targetDeclarations recovery.checked.plan recovery.address)
+    (lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)).mapError .lowering
+  let compilation := Pipeline.LoweredCompilation.ofTrace lowering certificate.down
+  let built ← (mapSidecars recovery.checked.plan compilation).mapError .attachment
+  let backend ← (IxIR2.Pipeline.attachCompiled compilation built maxDepth).mapError .attachment
+  let reuse := IxIR2.CallReuse.selectChecked IxIR2.Validate.defaultLimits
+    backend.val.target.artifact.validationContext backend.val.target.artifact.program
+    ⟨backend.val.target.stats, backend.val.target.accepted⟩
+  return { lowering, certificate := certificate.down, backend, reuse }
+
+inductive MapOutcome (declarations : List (Address × IxIR0.Decl)) (main : IxIR0.Expr) (fuel : Nat) where
+  | literal (reason : MapSkip)
+  | recovered (recovery : IxIR0.MapRecovery.Recovered declarations main) (lowered : MapLowered recovery fuel)
+def MapOutcome.selected {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr} {fuel : Nat} :
+    MapOutcome declarations main fuel → IxIR0.MapRecovery.Selection declarations main
+  | .literal (.recovery reason) => .literal reason
+  | .literal _ => .literal .rejectedTarget
+  | .recovered recovery _ => .recovered recovery
+
+structure MapCompilation (constants : List (Address × Constant)) (root : Address)
+    (config : Pipeline.Config) (eraseFuel lowerFuel : Nat) where
+  source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel
+  outcome : MapOutcome source.erasure.result.raw (.ref root) lowerFuel
+
+def compileMap (constants : List (Address × Constant)) (root : Address) (config : Pipeline.Config := {})
+    (checkFuel : Nat := 1000) (eraseFuel : Nat := 1000) (validateFuel : Nat := 1000)
+    (lowerFuel : Nat := 1000) (maxDepth : Nat := 1000) :
+    Except Pipeline.Error (MapCompilation constants root config eraseFuel lowerFuel) := do
+  let source ← Pipeline.compileValidatedWithTrace constants root config .shared checkFuel eraseFuel validateFuel lowerFuel
+  let outcome := match IxIR0.MapRecovery.select source.erasure.result.raw (.ref root) with
+    | .literal reason => MapOutcome.literal (.recovery reason)
+    | .recovered recovery => match lowerMap recovery lowerFuel maxDepth with
+      | .error reason => .literal reason
+      | .ok lowered => .recovered recovery lowered
+  return { source, outcome }
+
+end Ix.Compiler.CallReuse
diff --git a/Ix/Compiler/CallReuse/MapSim.lean b/Ix/Compiler/CallReuse/MapSim.lean
new file mode 100644
index 000000000..b836e0017
--- /dev/null
+++ b/Ix/Compiler/CallReuse/MapSim.lean
@@ -0,0 +1,130 @@
+import Ix.Compiler.CallReuse.MapPipeline
+import Ix.Compiler.IxIR0.MapRecoverySim
+import Ix.Compiler.Recursion.Resources
+import Ix.Compiler.IxIR2.PipelineCallReuse
+
+/-! The valid Ixon map, exact checked specialization, ordinary ownership
+lowering, and selected call-credit execution compose with the original source
+contracts. Optional specialization/backend failure retains literal owned
+execution and reclamation; successful attachment carries all R4 cost laws. -/
+
+namespace Ix.Compiler.CallReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+
+namespace MapLowered
+
+variable {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+  {recovery : IxIR0.MapRecovery.Recovered declarations main} {fuel : Nat}
+
+def PhysicalValueRel (lowered : MapLowered recovery fuel) (sourceValue : IxIR0.Value)
+    (result : IxIR2.Eval.Result) : Prop :=
+  ∃ store value baseline locRel,
+    IxIR1.LowerSim.AddressedValueGraph
+      (lowered.lowering.result.rebuildRename lowered.lowering.raw)
+      lowered.compilation.functionRel store sourceValue value ∧
+    IxIR2.Lower.Sim.OutcomeRel (store, value) baseline ∧
+    IxIR2.ReuseSim.StableHeapRel baseline.store result.store locRel ∧
+    IxIR1.Sim.RValIso locRel baseline.value result.value
+
+theorem physicalMainCostLaws (lowered : MapLowered recovery fuel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (sourceRun : IxIR0.eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main = .ok sourceValue) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.Policy.runMain lowered.reuse.policy
+        (IxIR2.Eval.Context.ofProgram lowered.reuse.target lowered.attached.target.artifact.validationContext.schemas)
+        .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+      lowered.PhysicalValueRel sourceValue result ∧ result.SharedResources ∧
+      lowered.attached.CallCostComparison lowered.reuse heapFuel result := by
+  have trace : IxIR0.ProjectionSafe.Eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main sourceValue := recovery.projectionSafe sourceRun
+  obtain ⟨ir1Fuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    lowered.compilation.addressedOwnedMain trace
+  have attachedRun : IxIR1.runOwnedMain lowered.attached.simulationSourceContext
+      lowered.attached.target.artifact.source.mainResult
+      lowered.attached.target.artifact.source.main ir1Fuel = .ok (store, value) := by
+    rw [lowered.attached.simulationSourceContext_eq_addressedCtx,
+      lowered.attached.targetSourceProduced, lowered.attached.inputProduced, lowered.sourceProduced]
+    exact ownedRun
+  obtain ⟨baselineControl, controlFuel, heapFuel, baseline, result, locRel,
+      baselineRun, run, baselineRelation, heaps, values, baselineResources, resources,
+      allocations, costs, reclaimed, prefixes⟩ :=
+    lowered.attached.selectedCallPhysicalMainCostLaws lowered.reuse attachedRun
+  exact ⟨controlFuel, heapFuel, result, run,
+    ⟨store, value, baseline, locRel, ⟨rawStore, addressImage, graph⟩, baselineRelation, heaps, values⟩,
+    resources, baselineControl, heapFuel, baseline, baselineRun, baselineResources,
+    allocations, costs, reclaimed, prefixes⟩
+
+end MapLowered
+
+namespace MapCompilation
+
+variable {constants : List (Address × Constant)} {root : Address}
+  {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+/-- A proof-only view reuses the established literal source/owned endpoint.
+It contains the same validated compilation and performs no transformation. -/
+def literalView (compilation : MapCompilation constants root config eraseFuel lowerFuel) :
+    Recursion.Compilation constants root config eraseFuel lowerFuel :=
+  { source := compilation.source, outcome := .literal (.recovery .unrecognized) }
+
+abbrev SourceValueRel (compilation : MapCompilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) (rawValue : IxIR0.Value) : Prop :=
+  compilation.literalView.SourceValueRel sourceValue rawValue
+
+theorem sourceRefines (compilation : MapCompilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    ∃ targetFuel rawValue,
+      IxIR0.eval { env := IxIR0.Env.ofList compilation.outcome.selected.declarations }
+        targetFuel [] compilation.outcome.selected.main = .ok rawValue ∧
+      compilation.SourceValueRel sourceValue rawValue := by
+  obtain ⟨rawFuel, rawValue, rawRun, sourceRelation⟩ := compilation.literalView.sourceRefines horacles hctx hsource
+  obtain ⟨targetFuel, targetRun⟩ := compilation.outcome.selected.forwardSimulation rawRun
+  exact ⟨targetFuel, rawValue, targetRun, sourceRelation⟩
+
+def SelectedExecutionWithCostLaws (compilation : MapCompilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) : Prop :=
+  match compilation.outcome with
+  | .literal _ => compilation.literalView.SelectedExecutionWithResources sourceValue
+  | .recovered _ lowered =>
+      ∃ rawValue controlFuel heapFuel result,
+        compilation.SourceValueRel sourceValue rawValue ∧
+        IxIR2.Eval.Policy.runMain lowered.reuse.policy
+          (IxIR2.Eval.Context.ofProgram lowered.reuse.target lowered.attached.target.artifact.validationContext.schemas)
+          .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+        lowered.PhysicalValueRel rawValue result ∧ result.SharedResources ∧
+        lowered.attached.CallCostComparison lowered.reuse heapFuel result
+
+/-- Composed source correctness, checked fallback, full result reclamation,
+and allocation/free/RC/peak laws. The only caller premises are the original
+source sharing/oracle contracts and successful Ixon evaluation. -/
+theorem sourceRefinesWithCostLaws (compilation : MapCompilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    compilation.SelectedExecutionWithCostLaws sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      simpa only [SelectedExecutionWithCostLaws, selected] using
+        compilation.literalView.sourceRefinesSelectedWithResources horacles hctx hsource
+  | recovered recovery lowered =>
+      obtain ⟨rawFuel, rawValue, rawRun, sourceRelation⟩ := compilation.sourceRefines horacles hctx hsource
+      rw [selected] at rawRun
+      obtain ⟨controlFuel, heapFuel, result, run, related, resources, costs⟩ := lowered.physicalMainCostLaws rawRun
+      simp only [SelectedExecutionWithCostLaws, selected]
+      exact ⟨rawValue, controlFuel, heapFuel, result, sourceRelation, run, related, resources, costs⟩
+
+end MapCompilation
+
+end Ix.Compiler.CallReuse
diff --git a/Ix/Compiler/CallReuse/Observations.lean b/Ix/Compiler/CallReuse/Observations.lean
new file mode 100644
index 000000000..e5ac6e8a3
--- /dev/null
+++ b/Ix/Compiler/CallReuse/Observations.lean
@@ -0,0 +1,340 @@
+import Ix.Compiler.CallReuse.Sources
+import Ix.Compiler.CallReuse.Provenance
+import Ix.Compiler.Coverage.HeapSnapshot
+import Ix.Compiler.IxIR2.ReservationOwnership
+
+/-! Source-driven map execution, full heap release, and actual prefix
+observations. Every constructor observation checks its complete identity. -/
+
+namespace Ix.Compiler.CallReuse.Examples
+
+open Lean Ix.Compiler.Ixon
+
+deriving instance ToJson for IxIR2.CallReuse.Report
+deriving instance ToJson for IxIR0.MapRecovery.Schema
+deriving instance ToJson for IxIR0.MapRecovery.Plan
+
+inductive Observation where
+  | list (values : List Nat)
+  | pair (mapped retained : List Nat)
+  deriving BEq, Repr, ToJson
+
+private def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+private def sourceList? (source : Source) : Nat → Ixon.Eval.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctorV block 1 tag fields =>
+      if block != source.dataBlock then none
+      else match tag, fields with
+        | 0, [] => some []
+        | 1, [.litV (.natL n), tail] => (n :: ·) <$> sourceList? source fuel tail
+        | _, _ => none
+  | _, _ => none
+
+private def sourceObservation? (source : Source) (value : Ixon.Eval.Value) : Option Observation :=
+  if source.aliased then
+    match value with
+    | .ctorV block 2 0 [left, right] => do
+        if block != source.dataBlock then none
+        else return .pair (← sourceList? source 1000 left) (← sourceList? source 1000 right)
+    | _ => none
+  else .list <$> sourceList? source 1000 value
+
+private def list0? (source : Source) : Nat → IxIR0.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctor address tag fields =>
+      if address == source.nil && tag == 0 && fields.isEmpty then some []
+      else if address == source.cons && tag == 1 then
+        match fields with
+        | [.lit (.nat n), tail] => (n :: ·) <$> list0? source fuel tail
+        | _ => none
+      else none
+  | _, _ => none
+
+private def observation0? (source : Source) (value : IxIR0.Value) : Option Observation :=
+  if source.aliased then
+    match value with
+    | .ctor address 0 [left, right] => do
+        if address != source.pair then none
+        else return .pair (← list0? source 1000 left) (← list0? source 1000 right)
+    | _ => none
+  else .list <$> list0? source 1000 value
+
+private def list1? (source : Source) : Nat → IxIR1.Store → IxIR1.RVal → Option (List Nat)
+  | 0, _, _ => none
+  | fuel + 1, store, .loc location => do
+      let box ← store.get? location
+      let .ctorN identity fields := box.node | none
+      if identity == IxIR1.Lower.ctorIdOf source.nil 0 && fields.isEmpty then some []
+      else if identity == IxIR1.Lower.ctorIdOf source.cons 1 then
+        match fields.toList with
+        | [.lit (.nat n), tail] => (n :: ·) <$> list1? source fuel store tail
+        | _ => none
+      else none
+  | _, _, _ => none
+
+private def observation1? (source : Source) (store : IxIR1.Store)
+    (value : IxIR1.RVal) : Option Observation :=
+  if source.aliased then do
+    let .loc location := value | none
+    let box ← store.get? location
+    let .ctorN identity fields := box.node | none
+    if identity != IxIR1.Lower.ctorIdOf source.pair 0 then none
+    else match fields.toList with
+      | [left, right] => return .pair (← list1? source 1000 store left) (← list1? source 1000 store right)
+      | _ => none
+  else .list <$> list1? source 1000 store value
+
+private def expected (source : Source) : Observation :=
+  let mapped := source.values.map (fun _ => source.replacement)
+  if source.aliased then .pair mapped (source.values.drop source.uniquePrefix) else .list mapped
+
+private def agree (source : Source) (stage : String) (actual : Option Observation) : Except String Unit :=
+  need (actual == some (expected source)) s!"{stage}: expected {repr (expected source)}, got {repr actual}"
+
+private def observe0 (source : Source) (stage : String) (declarations : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) : Except String Unit := do
+  let value ← (IxIR0.eval { env := IxIR0.Env.ofList declarations } 10000 [] main).mapError
+    (fun error => s!"{stage}: {repr error}")
+  agree source stage (observation0? source value)
+
+private def observe1 (source : Source) (stage : String) (context : IxIR1.Ctx)
+    (main : IxIR1.Code) : Except String (IxIR1.Store × Json) := do
+  let (store, value) ← (IxIR1.runOwnedMain context .shared main 10000).mapError
+    (fun error => s!"{stage}: {repr error}")
+  agree source stage (observation1? source store value)
+  need (store.live + store.frees == store.allocs) s!"{stage}: terminal allocation balance"
+  let reclaimed ← (IxIR1.dropVal context 10000 store value).mapError (fun error => s!"{stage}: {repr error}")
+  need (reclaimed.live == 0 && reclaimed.allocs == reclaimed.frees) s!"{stage}: incomplete reclamation"
+  return (store, Json.mkObj [("value", toJson (expected source)), ("store", toJson store),
+    ("reclaimed", toJson reclaimed)])
+
+private def observe2 (source : Source) (stage : String) (context : IxIR2.Validate.Context)
+    (program : IxIR2.Program) (policy : IxIR2.CreditPolicy) (mode : IxIR2.Eval.Interpretation) :
+    Except String (IxIR2.Eval.Result × IxIR2.Eval.Store × Json) := do
+  let result ← (IxIR2.Eval.Policy.runMain policy (IxIR2.Eval.Context.ofProgram program context.schemas)
+    mode program 10000 10000).mapError (fun error => s!"{stage}: {repr error}")
+  agree source stage (observation1? source result.store.heap result.value)
+  need (result.store.live + result.store.heap.frees == result.store.heap.allocs) s!"{stage}: terminal allocation balance"
+  let (reclaimed, remaining) ← (IxIR2.Eval.releaseShared 10000 result.store result.value).mapError
+    (fun error => s!"{stage} reclamation: {repr error}")
+  need (reclaimed.live == 0 && reclaimed.heap.allocs == reclaimed.heap.frees) s!"{stage}: incomplete reclamation"
+  return (result, reclaimed, Json.mkObj [
+    ("value", toJson (expected source)), ("store", toJson result.store),
+    ("control_remaining", toJson result.controlRemaining), ("heap_remaining", toJson result.heapRemaining),
+    ("reclaimed", toJson reclaimed), ("reclamation_remaining", toJson remaining)])
+
+/-- Inspect every actual physical prefix, including the states between reset,
+call entry, nested return, and credit consumption. -/
+def prefixObservations (context : IxIR2.Validate.Context) (program : IxIR2.Program)
+    (policy : IxIR2.CreditPolicy) (baseline final : IxIR2.Eval.Result) :
+    Except String (Array Json × Nat × Nat) := do
+  let context := IxIR2.Eval.Context.ofProgram program context.schemas
+  let mut machine := IxIR2.Eval.initialMachine program.main #[] 10000
+  let mut rows := #[]
+  let mut maximum := 0
+  let mut suspendedCalls := 0
+  for index in [:10001] do
+    let (active, saved, creditCounts) : List Nat × List (List Nat) × List Nat := match machine.control with
+      | .halted _ => ([], [], [])
+      | .running frame stack => (frame.reservations, stack.map IxIR2.Eval.Continuation.reservations,
+          frame.liveCredits.length :: stack.map (fun (continuation : IxIR2.Eval.Continuation) => match continuation with
+            | .resume frame | .applyMore _ frame => frame.liveCredits.length))
+    let reservations := active ++ saved.flatten
+    let emptySlots := (List.range machine.store.heap.nodes.size).filter fun location =>
+      match machine.store.heap.nodes[location]? with | some none => true | _ => false
+    need (reservations.eraseDups.length == reservations.length && reservations.all emptySlots.contains)
+      "prefix reservation duplicated or aliases a live heap slot"
+    need (machine.store.live + machine.store.heap.frees + reservations.length == machine.store.heap.allocs)
+      "prefix physical allocation balance"
+    need (machine.store.heap.rcops ≤ baseline.store.heap.rcops &&
+      machine.store.peakLiveNodes ≤ baseline.store.peakLiveNodes &&
+      machine.store.live ≤ machine.store.peakLiveNodes) "prefix RC or peak-live bound"
+    maximum := max maximum creditCounts.sum
+    rows := rows.push (Json.mkObj [("step", toJson index), ("counters", toJson machine.store.counters),
+      ("live", toJson machine.store.live), ("owners", toJson (active :: saved)),
+      ("empty_slots", toJson emptySlots), ("credit_counts", toJson creditCounts)])
+    match machine.control with
+    | .halted value =>
+        need (toJson machine.store == toJson final.store && value == final.value &&
+          machine.heapFuel == final.heapRemaining) "prefix traversal disagrees with runMain"
+        return (rows, maximum, suspendedCalls)
+    | .running frame _ =>
+        let next ← (IxIR2.Eval.Policy.step policy context .physical machine).mapError reprStr
+        if (IxIR2.Eval.Policy.directCall? frame).isSome then
+          let .running callee (.resume caller :: _) := next.control
+            | throw "direct call did not suspend exactly one caller"
+          need (callee.credits.isEmpty && caller.credits == frame.credits &&
+            toJson machine.store == toJson next.store) "direct-call credit ownership changed"
+          if !frame.liveCredits.isEmpty then suspendedCalls := suspendedCalls + 1
+        machine := next
+  throw "prefix traversal exceeded execution budget"
+
+private def costGate (source : Source) (baseline logical physical : IxIR2.Eval.Result)
+    (baselineReleased physicalReleased : IxIR2.Eval.Store) : Except String Unit := do
+  for (label, base, selected) in [("terminal", baseline.store, physical.store),
+      ("reclaimed", baselineReleased, physicalReleased)] do
+    let b := base.counters
+    let p := selected.counters
+    need (b.reuses == 0 && b.allocs == p.allocs + p.reuses && b.frees == p.frees + p.reuses)
+      s!"{label}: baseline/selected allocation or free law"
+    need (p.rcops ≤ b.rcops && p.peakLiveNodes ≤ b.peakLiveNodes) s!"{label}: RC or peak-live bound"
+  let l := logical.store.counters
+  let p := physical.store.counters
+  need (l.allocs == p.allocs + p.reuses && l.frees == p.frees + p.reuses && l.rcops == p.rcops &&
+    logical.store.live == physical.store.live && l.resetAttempts == p.resetAttempts &&
+    l.hotResets == p.hotResets && l.coldResets == p.coldResets) "logical/physical allocation accounting"
+  let hot := if source.aliased then source.uniquePrefix else source.values.length
+  need (p.resetAttempts == source.values.length && p.hotResets == hot &&
+    p.coldResets == source.values.length - hot && p.reuses == hot && p.reusedPayloadUnits == 2 * hot)
+    "reset/reuse count differs from source alias structure"
+
+structure CaseResult where
+  name : String
+  summary : Json
+  snapshot : Json
+
+def runCase (name : String) (values : List Nat) (replacement : Nat) (aliased : Bool)
+    (uniquePrefix : Nat := 0) : Except String CaseResult := do
+  let source ← Examples.source values replacement aliased uniquePrefix
+  let sourceValue ← (Ixon.Eval.eval (Pipeline.validatedEvalCtx source.constants source.config) 10000
+    (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError
+      (fun error => s!"Ixon: {repr error}")
+  agree source "Ixon" (sourceObservation? source sourceValue)
+  let compilation ← source.compile.mapError (fun error => s!"validated compilation: {repr error}")
+  let .recovered recovery lowered := compilation.outcome
+    | throw s!"map specialization did not reach the checked backend"
+  let attached := lowered.attached
+  let baseline := attached.target
+  let context := baseline.artifact.validationContext
+  let selected := lowered.reuse
+  let .optimized output _ := selected | throw "ordinary source unexpectedly used baseline fallback"
+  let report := IxIR2.CallReuse.report IxIR2.Validate.defaultLimits context baseline.artifact.program
+  need (report.rewritten == 1 && report.suspendedCallSites == 2) "compiler did not expose both map calls"
+  need (match IxIR2.Validate.validate context selected.target with | .error _ => true | .ok _ => false)
+    "v0 accepted live credits across map calls"
+  let erasure := compilation.source.erasure.result
+  let lowering := lowered.lowering
+  observe0 source "raw IxIR0" erasure.raw (.ref source.root)
+  observe0 source "addressed IxIR0" erasure.declarations erasure.main
+  observe0 source "specialized IxIR0"
+    (IxIR0.MapRecovery.targetDeclarations recovery.checked.plan recovery.address)
+    (recovery.checked.plan.directMain recovery.address)
+  let (_, literalRawJson) ← observe1 source "literal raw IxIR1"
+    { decls := IxIR1.Env.ofList compilation.source.lowering.raw } compilation.source.lowering.mainCode
+  let (_, literalJson) ← observe1 source "literal IxIR1"
+    { decls := compilation.source.artifact.targetDeclEnv } compilation.source.artifact.main
+  let (rawStore, rawJson) ← observe1 source "raw IxIR1" { decls := IxIR1.Env.ofList lowering.raw } lowering.mainCode
+  let (store, ir1Json) ← observe1 source "addressed IxIR1"
+    { decls := IxIR1.HPT.programDeclEnv lowering.result.artifacts } lowering.result.main
+  let (baseLogical, _, baseLogicalJson) ← observe2 source "baseline logical" context baseline.artifact.program .callLocalV0 .logical
+  let (base, baseReleased, baseJson) ← observe2 source "baseline physical" context baseline.artifact.program .callLocalV0 .physical
+  need (toJson rawStore == toJson store && toJson store == toJson base.store.heap &&
+    toJson baseLogical.store == toJson base.store) "ordinary lowering or baseline interpretation drifted"
+  let (logical, _, logicalJson) ← observe2 source "selected logical" context selected.target selected.policy .logical
+  let (physical, released, physicalJson) ← observe2 source "selected physical" context selected.target selected.policy .physical
+  costGate source base logical physical baseReleased released
+  let (prefixes, maximumCredits, suspendedCalls) ← prefixObservations context selected.target selected.policy base physical
+  need (suspendedCalls == 2 * values.length && maximumCredits == values.length)
+    "nested calls did not suspend the expected independent caller credits"
+  need (IxIR2.CallReuse.rewriteProgram IxIR2.Validate.defaultLimits context selected.target == selected.target)
+    "call reuse is not idempotent"
+  let provenance := lowered.provenance source.root
+  need (({ provenance with execution := .callLocalV0 }).bytes != provenance.bytes &&
+    ({ provenance with execution := .callLocalV0 }).identity != provenance.identity)
+    "execution policy did not change provenance"
+  let summary := Json.mkObj [
+    ("name", toJson name), ("snapshot", toJson s!"{name}.json"),
+    ("source_root", toJson source.root), ("source_constants", toJson source.constants.length),
+    ("input", toJson values), ("replacement", toJson replacement),
+    ("aliased", toJson aliased), ("unique_prefix", toJson uniquePrefix), ("value", toJson (expected source)),
+    ("ixir1_root", toJson provenance.ir1Root), ("provenance", toJson provenance.identity),
+    ("map_specialization", toJson recovery.address),
+    ("literal_ixir1_root", toJson (IxIR1.Optimizer.graphRoot
+      compilation.source.lowering.result.artifacts compilation.source.lowering.result.main)),
+    ("policy", toJson selected.policy.tag), ("pass", toJson IxIR2.CallReuse.policyTag),
+    ("hpt_roots", toJson provenance.hptRoots), ("reuse", toJson report),
+    ("baseline", toJson base.store.counters), ("logical", toJson logical.store.counters),
+    ("physical", toJson physical.store.counters), ("maximum_credits", toJson maximumCredits),
+    ("suspended_calls", toJson suspendedCalls), ("prefixes", toJson prefixes.size),
+    ("all_heaps_reclaimed", toJson true)]
+  let sidecars := attached.sidecars
+  let common := attached.source
+  let snapshot := Json.mkObj [
+    ("format", toJson "compilatrix/source-call-reuse-case/1"), ("summary", summary),
+    ("source", Json.mkObj [("root", toJson source.root), ("limits", toJson source.config.limits),
+      ("fuel", Json.mkObj [("usage", toJson (1000 : Nat)), ("erasure", toJson (1000 : Nat)),
+        ("validation", toJson (1000 : Nat)), ("ownership_lowering", toJson (1000 : Nat)),
+        ("evaluation", toJson (10000 : Nat)), ("control", toJson (10000 : Nat)),
+        ("heap", toJson (10000 : Nat)), ("reclamation", toJson (10000 : Nat))]),
+      ("constants", toJson (source.constants.map fun (address, constant) =>
+        Json.mkObj [("key", toJson address), ("bytes", Coverage.byteJson (ser constant))])),
+      ("literals", toJson ((replacement :: values).eraseDups.map fun n =>
+        Json.mkObj [("key", toJson (X86.ValidatedScalar.literalAddress n)), ("nat", toJson n)]))]),
+    ("ixir0", Json.mkObj [("raw", Coverage.ir0Entries erasure.raw),
+      ("raw_main", Coverage.byteJson (IxIR0.Expr.ref source.root).bytes),
+      ("groups", toJson (erasure.groups.map Coverage.ir0Group)),
+      ("declarations", Coverage.ir0Entries erasure.declarations), ("main", Coverage.byteJson erasure.main.bytes),
+      ("blocks", toJson (erasure.addressed.blocks.map Coverage.ir0Block)), ("address_map", toJson erasure.addressMap)]),
+    ("ixir1", Json.mkObj [("root", toJson provenance.ir1Root),
+      ("raw_declarations", Coverage.ir1Entries lowering.raw), ("raw_main", Coverage.byteJson lowering.mainCode.bytes),
+      ("artifacts", toJson (lowering.result.artifacts.map Coverage.ir1Artifact)),
+      ("declarations", Coverage.ir1Entries common.targetDecls),
+      ("main", Coverage.byteJson lowering.result.main.bytes), ("address_map", toJson lowering.result.addressMap),
+      ("reserved", toJson lowering.result.reserved)]),
+    ("literal_ixir1", Json.mkObj [
+      ("root", toJson (IxIR1.Optimizer.graphRoot compilation.source.lowering.result.artifacts
+        compilation.source.lowering.result.main)),
+      ("raw_declarations", Coverage.ir1Entries compilation.source.lowering.raw),
+      ("raw_main", Coverage.byteJson compilation.source.lowering.mainCode.bytes),
+      ("artifacts", toJson (compilation.source.lowering.result.artifacts.map Coverage.ir1Artifact)),
+      ("declarations", Coverage.ir1Entries compilation.source.artifact.targetDecls),
+      ("main", Coverage.byteJson compilation.source.artifact.main.bytes),
+      ("address_map", toJson compilation.source.lowering.result.addressMap),
+      ("reserved", toJson compilation.source.lowering.result.reserved)]),
+    ("map_specialization", Json.mkObj [("policy", toJson IxIR0.MapRecovery.policyTag),
+      ("plan", toJson recovery.checked.plan), ("derived_key", toJson recovery.address),
+      ("declarations", Coverage.ir0Entries (IxIR0.MapRecovery.targetDeclarations recovery.checked.plan recovery.address)),
+      ("main", Coverage.byteJson (recovery.checked.plan.directMain recovery.address).bytes)]),
+    ("ownership_lowering", Json.mkObj [("declarations", Coverage.ir0Entries common.declarations),
+      ("main", Coverage.byteJson common.main.bytes),
+      ("source_rows_selected", toJson (Pipeline.sourceRowsSelected common.declarations)),
+      ("source_externs_rejected", toJson (Pipeline.firstValidatedExtern? common.declarations).isNone),
+      ("target_externs_rejected", toJson (Pipeline.firstValidatedTargetExtern? common.targetDecls).isNone)]),
+    ("hpt", Json.mkObj [("producer_limits", toJson IxIR1.HPT.defaultProducerLimits),
+      ("producer_stats", toJson attached.hpt.stats),
+      ("candidate", toJson (attached.hpt.certificate.artifacts.map Coverage.hptCandidate)),
+      ("artifacts", toJson (attached.hpt.result.artifacts.map Coverage.hptArtifact))]),
+    ("sidecars", Json.mkObj [("input_declarations", Coverage.ir1Entries sidecars.input.declarations),
+      ("input_main", Coverage.byteJson sidecars.input.main.bytes), ("main_world", toJson sidecars.input.mainResult),
+      ("parameter_worlds", toJson sidecars.parameterEntries), ("constructors", toJson sidecars.constructors),
+      ("recursor_origins", toJson sidecars.recursorOrigins),
+      ("hpt_certificate", toJson (sidecars.hptCertificate.artifacts.map Coverage.hptCandidate))]),
+    ("provenance", Json.mkObj [("kind", toJson "ixir1-plus-policy"), ("identity", toJson provenance.identity),
+      ("bytes", Coverage.byteJson provenance.bytes), ("lowering_version", toJson provenance.loweringVersion),
+      ("pass", toJson provenance.pass), ("execution_policy", toJson provenance.execution.tag),
+      ("specialization", toJson provenance.specialization),
+      ("optimized", toJson provenance.optimized)]),
+    ("ixir2_diagnostic", Json.mkObj [("baseline", toJson baseline.artifact.program),
+      ("baseline_stats", toJson baseline.stats), ("selected", toJson output.target),
+      ("selected_stats", toJson output.targetChecked.stats), ("reuse", toJson report),
+      ("max_depth", toJson attached.maxDepth),
+      ("schemas", toJson (sidecars.constructors.map fun c =>
+        (c.identity, attached.loweringContext.schemas .shared c.identity)))]),
+    ("observations", Json.mkObj [("literal_raw_ixir1", literalRawJson), ("literal_ixir1", literalJson),
+      ("raw_ixir1", rawJson), ("ixir1", ir1Json),
+      ("baseline_logical", baseLogicalJson), ("baseline_physical", baseJson),
+      ("selected_logical", logicalJson), ("selected_physical", physicalJson)]),
+    ("prefixes", toJson prefixes)]
+  return { name, summary, snapshot }
+
+def cases : List (String × List Nat × Nat × Bool × Nat) :=
+  [("empty-hot", [], 42, false, 0), ("empty-cold", [], 42, true, 0),
+    ("singleton-hot", [17], 42, false, 0), ("singleton-cold", [17], 42, true, 0),
+    ("three-hot", [1, 2, 3], 42, false, 0), ("three-cold", [1, 2, 3], 42, true, 0),
+    ("mixed-values-hot", [0, 3, 3, UInt64.size, 1, 42, 0], UInt64.size + 7, false, 0),
+    ("mixed-values-cold", [0, 3, 3, UInt64.size, 1, 42, 0], UInt64.size + 7, true, 0),
+    ("mixed-ownership", [5, 4, 3, 2, 1], 0, true, 2)]
+
+end Ix.Compiler.CallReuse.Examples
diff --git a/Ix/Compiler/CallReuse/Pipeline.lean b/Ix/Compiler/CallReuse/Pipeline.lean
new file mode 100644
index 000000000..3bb250c2f
--- /dev/null
+++ b/Ix/Compiler/CallReuse/Pipeline.lean
@@ -0,0 +1,32 @@
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR2.CallReuse
+
+/-! Ordinary validated Ixon compilation with the versioned direct-call pass.
+The selection retains either the checked rewrite or the checked baseline and
+its rejection reason. No fixture-specific IR is supplied to this boundary. -/
+
+namespace Ix.Compiler.CallReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+
+structure Compilation (constants : List (Address × Constant)) (root : Address)
+    (config : Pipeline.Config) (eraseFuel lowerFuel : Nat) where
+  attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel
+  selection : IxIR2.CallReuse.Selection IxIR2.Validate.defaultLimits
+    attached.target.artifact.validationContext attached.target.artifact.program
+
+def compileValidated (constants : List (Address × Constant)) (root : Address)
+    (config : Pipeline.Config := {})
+    (checkFuel : Nat := Ixon.UsageCheck.defaultFuel)
+    (eraseFuel : Nat := Erase.defaultFuel) (validateFuel : Nat := Erase.defaultFuel)
+    (lowerFuel : Nat := 10000) (maxDepth : Nat := 100000) :
+    Except IxIR2.Pipeline.Error (Compilation constants root config eraseFuel lowerFuel) := do
+  let attached ← IxIR2.Pipeline.compileValidated constants root config .shared
+    checkFuel eraseFuel validateFuel lowerFuel maxDepth
+  return {
+    attached
+    selection := IxIR2.CallReuse.selectChecked IxIR2.Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program
+      ⟨attached.target.stats, attached.target.accepted⟩ }
+
+end Ix.Compiler.CallReuse
diff --git a/Ix/Compiler/CallReuse/PolicyExamples.lean b/Ix/Compiler/CallReuse/PolicyExamples.lean
new file mode 100644
index 000000000..0e95d3249
--- /dev/null
+++ b/Ix/Compiler/CallReuse/PolicyExamples.lean
@@ -0,0 +1,200 @@
+import Ix.Compiler.CallReuse.Observations
+
+/-! Independent policy and rejection witnesses. These hand-built boundary
+tests supplement the source-produced map matrix; they are not compiler input
+fixtures for the source theorem or its artifact gate. -/
+
+namespace Ix.Compiler.CallReuse.PolicyExamples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+open Lean
+
+private def layout : Address := Address.replicate 0x91
+private def node : CtorId := { block := Address.replicate 0x92, indIdx := 0, cidx := 0 }
+private def other : CtorId := { node with cidx := 1 }
+private def leafAddress : Address := Address.replicate 0x93
+private def childAddress : Address := Address.replicate 0x94
+
+private def schemas (world : Owned) (ctor : CtorId) : Option CtorSchema :=
+  if ctor == node then some { layout, fields := #[world] }
+  else if ctor == other then some { layout := Address.replicate 0x95, fields := #[world] }
+  else none
+
+private def validation : Validate.Context := { schemas }
+private def signature (world : Owned := .shared) : Signature :=
+  { params := #[], result := world, papSafe := world == .shared }
+private def block (instructions : Array Instr) (terminator : Terminator) : Block :=
+  { valueParams := #[], creditParams := #[], instructions, terminator }
+private def leaf : Function :=
+  { signature := signature, blocks := #[block #[] (.ret (.lit (.nat 23)))] }
+
+private def prefixInstructions (world : Owned := .shared) : Array Instr :=
+  #[.alloc world node #[.lit (.nat 7)],
+    match world with | .shared => .resetShared (.reg 0) node | .unique => .takeUnique (.reg 0) node]
+
+private def reuseBody (world : Owned := .shared) (callee : Address := leafAddress) : Function :=
+  { signature := signature world
+    blocks := #[block (prefixInstructions world ++
+      #[.call callee #[], .releaseShared (.reg 2), .allocWith 0 world node #[.reg 1]]) (.ret (.reg 3))] }
+
+private def reuseProgram (world : Owned := .shared) : Program :=
+  { declarations := [(leafAddress, .fn leaf)], main := reuseBody world }
+
+private def discardProgram (world : Owned := .shared) : Program :=
+  { declarations := [(leafAddress, .fn leaf)]
+    main := {
+      signature := signature
+      blocks := #[block (prefixInstructions world ++ #[.call leafAddress #[], .discardCredit 0,
+        match world with | .shared => .releaseShared (.reg 1) | .unique => .dropUnique (.reg 1)])
+        (.ret (.reg 2))] } }
+
+private def coldProgram : Program :=
+  { declarations := [(leafAddress, .fn leaf)]
+    main := {
+      signature := signature
+      blocks := #[block #[.alloc .shared node #[.lit (.nat 7)], .retainShared (.reg 0),
+        .resetShared (.reg 0) node, .call leafAddress #[], .releaseShared (.reg 3),
+        .allocWith 0 .shared node #[.reg 2], .releaseShared (.reg 1)] (.ret (.reg 4))] } }
+
+private def nestedProgram : Program :=
+  { declarations := [(leafAddress, .fn leaf), (childAddress, .fn (reuseBody))]
+    main := reuseBody .shared childAddress }
+
+private def edgeProgram (credits : Array Nat) (targetCredits : Array CreditCap)
+    (targetInstructions : Array Instr) : Program :=
+  { declarations := [(leafAddress, .fn leaf)]
+    main := {
+      signature := signature
+      blocks := #[
+        block (prefixInstructions ++ #[.call leafAddress #[], .releaseShared (.reg 1), .releaseShared (.reg 2)])
+          (.jump { target := 1, values := #[], credits }),
+        { valueParams := #[], creditParams := targetCredits, instructions := targetInstructions
+          terminator := .ret (.lit (.nat 9)) }] } }
+
+private def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+private def accepted (program : Program) : Except String Unit := do
+  let _ ← (Validate.validateWithPolicy .suspendedCallsV1 Validate.defaultLimits validation program).mapError
+    (fun error => s!"v1 rejected: {repr error}")
+  match Validate.validate validation program with
+  | .ok _ => throw "v0 accepted a live call credit"
+  | .error (.invalid _ .credit _) => pure ()
+  | .error error => throw s!"v0 rejected at the wrong boundary: {repr error}"
+
+private def rejected (name : String) (program : Program) (violation : Validate.Violation := .credit) :
+    Except String String := do
+  match Validate.validateWithPolicy .suspendedCallsV1 Validate.defaultLimits validation program with
+  | .ok _ => throw s!"{name}: v1 unexpectedly accepted"
+  | .error (.invalid _ actual _) => need (actual == violation) s!"{name}: rejected for {repr actual}"
+  | .error error => throw s!"{name}: wrong rejection {repr error}"
+  return name
+
+private def run (program : Program) (mode : Eval.Interpretation) : Except String Eval.Result :=
+  (Eval.Policy.runMain .suspendedCallsV1 (Eval.Context.ofProgram program schemas)
+    mode program 10000 10000).mapError reprStr
+
+private def releaseResult (program : Program) (result : Eval.Result) : Except String Eval.Store := do
+  let (released, _) ← (match program.main.signature.result with
+    | .shared => Eval.releaseShared 10000 result.store result.value
+    | .unique => Eval.dropUniqueWork 10000 result.store [result.value]).mapError reprStr
+  need (released.live == 0 && released.heap.allocs == released.heap.frees) "policy result did not reclaim fully"
+  return released
+
+private def execution (name : String) (program : Program) (expectedReuses expectedCredits : Nat) :
+    Except String String := do
+  accepted program
+  let logical ← run program .logical
+  let physical ← run program .physical
+  let (_, maximum, _) ← Examples.prefixObservations validation program .suspendedCallsV1 physical physical
+  need (physical.store.heap.reuses == expectedReuses && maximum == expectedCredits) s!"{name}: credit/reuse counts"
+  need (logical.store.heap.allocs == physical.store.heap.allocs + physical.store.heap.reuses &&
+    logical.store.heap.frees == physical.store.heap.frees + physical.store.heap.reuses &&
+    logical.store.heap.rcops == physical.store.heap.rcops) s!"{name}: logical/physical counters"
+  let _ ← releaseResult program logical
+  let _ ← releaseResult program physical
+  match Eval.runMain (Eval.Context.ofProgram program schemas) .physical program 10000 10000 with
+  | .ok _ => throw s!"{name}: original evaluator crossed a live call credit"
+  | .error (.mem detail) => need (detail.contains "credit") s!"{name}: wrong original error"
+  | .error error => throw s!"{name}: wrong original rejection {repr error}"
+  return name
+
+private def withSuffix (instructions : Array Instr) (terminator : Terminator) : Program :=
+  { declarations := [(leafAddress, .fn leaf)]
+    main := { signature := signature, blocks := #[block (prefixInstructions ++ instructions) terminator] } }
+
+/-- Policy v1 permits only direct non-tail calls at a live-credit boundary;
+linear consumption, frame isolation, and every other boundary remain checked. -/
+def checks : Except String (List String) := do
+  let mut names := []
+  for (name, program, reuses, maximum) in [
+      ("optional-hot-call", reuseProgram, 1, 1),
+      ("optional-cold-call", coldProgram, 0, 1),
+      ("required-call", reuseProgram .unique, 1, 1),
+      ("optional-discard-after-return", discardProgram, 0, 1),
+      ("required-discard-after-return", discardProgram .unique, 0, 1),
+      ("nested-independent-callers", nestedProgram, 2, 2),
+      ("edge-transfer-after-return", edgeProgram #[0] #[.optional layout] #[.discardCredit 0], 0, 1)] do
+    names := names ++ [← (execution name program reuses maximum).mapError (fun message => s!"{name}: {message}")]
+  let self := withSuffix #[.callSelf #[], .releaseShared (.reg 2), .allocWith 0 .shared node #[.reg 1]] (.ret (.reg 3))
+  accepted self
+  names := names ++ ["callSelf-policy-boundary"]
+  let malformed := [
+    ("double-consumption", withSuffix #[.call leafAddress #[], .discardCredit 0, .discardCredit 0] (.ret (.reg 2)), Validate.Violation.credit),
+    ("unconsumed-return", withSuffix #[.call leafAddress #[], .releaseShared (.reg 1)] (.ret (.reg 2)), .resources),
+    ("tail-call-live-credit", withSuffix #[] (.tailCall leafAddress #[]), .credit),
+    ("tail-self-live-credit", withSuffix #[] (.tailCallSelf #[]), .credit),
+    ("papp-live-credit", withSuffix #[.papp leafAddress #[]] (.ret (.reg 2)), .credit),
+    ("apply-live-credit", withSuffix #[.apply (.lit (.nat 0)) #[]] (.ret (.reg 2)), .credit),
+    ("extern-live-credit", withSuffix #[.extern leafAddress #[]] (.ret (.reg 2)), .credit),
+    ("layout-mismatch-after-return", withSuffix #[.call leafAddress #[], .releaseShared (.reg 2),
+      .allocWith 0 .shared other #[.reg 1]] (.ret (.reg 3)), .credit),
+    ("duplicate-edge-credit", edgeProgram #[0, 0] #[.optional layout, .optional layout]
+      #[.discardCredit 0, .discardCredit 1], .credit),
+    ("omitted-edge-credit", edgeProgram #[] #[] #[], .resources)]
+  for (name, program, violation) in malformed do names := names ++ [← rejected name program violation]
+  let thief := { reuseProgram with
+    declarations := [(leafAddress, .fn { leaf with blocks := #[block #[.discardCredit 0] (.ret (.lit (.nat 0)))] })] }
+  names := names ++ [← rejected "callee-cannot-consume-ancestor-credit" thief .register]
+  match run thief .physical with
+  | .ok _ => throw "callee accessed its ancestor's credit register"
+  | .error message => need (message.contains "credit") "callee failed for unrelated reason"
+  let fallback : Program := {
+    declarations := []
+    main := {
+      signature := signature .unique
+      blocks := #[block (prefixInstructions .unique ++ #[.allocWith 0 .unique node #[.reg 1]]) (.ret (.reg 2))] } }
+  match sourceAccepted : Validate.validateWith Validate.defaultLimits validation fallback with
+  | .error error => throw s!"fallback baseline invalid: {repr error}"
+  | .ok stats =>
+      let selected := CallReuse.selectChecked Validate.defaultLimits validation fallback ⟨stats, sourceAccepted⟩
+      match selected with
+      | .optimized .. => throw "credit-bearing source escaped the source-ready check"
+      | .baseline _ (.unsupportedSource) _ =>
+          need (selected.target == fallback && selected.policy == .callLocalV0) "fallback changed its program or policy"
+          let actual ← (Eval.Policy.runMain selected.policy (Eval.Context.ofProgram selected.target schemas)
+            .physical selected.target 10000 10000).mapError reprStr
+          let original ← (Eval.runMain (Eval.Context.ofProgram fallback schemas)
+            .physical fallback 10000 10000).mapError reprStr
+          need (toJson actual.store == toJson original.store && actual.value == original.value)
+            "checked fallback changed execution"
+      | .baseline _ error _ => throw s!"unexpected fallback reason {repr error}"
+  names := names ++ ["checked-baseline-fallback"]
+  let shape : CallReuse.Shape := {
+    valueParams := #[.owned .shared], source := 0, sourceConstructor := node, fieldCount := 1
+    calls := #[.call leafAddress #[]], allocationConstructor := node
+    allocationArguments := #[.reg 2], result := .reg 4 }
+  need ((CallReuse.inspect Validate.defaultLimits validation shape.baseline).isSome) "canonical site was not recognized"
+  for (name, changed) in [
+      ("site-indirect-call", { shape with calls := #[.papp leafAddress #[]] }),
+      ("site-no-call", { shape with calls := #[] }),
+      ("site-live-owner", { shape with calls := #[.call leafAddress #[.reg 0]] }),
+      ("site-layout-mismatch", { shape with allocationConstructor := other })] do
+    need ((CallReuse.inspect Validate.defaultLimits validation changed.baseline).isNone &&
+      CallReuse.rewriteBlock Validate.defaultLimits validation changed.baseline == changed.baseline)
+      s!"{name}: unsupported site was rewritten"
+    names := names ++ [name]
+  return names
+
+end Ix.Compiler.CallReuse.PolicyExamples
diff --git a/Ix/Compiler/CallReuse/Provenance.lean b/Ix/Compiler/CallReuse/Provenance.lean
new file mode 100644
index 000000000..bf080060a
--- /dev/null
+++ b/Ix/Compiler/CallReuse/Provenance.lean
@@ -0,0 +1,63 @@
+import Ix.Compiler.CallReuse.Pipeline
+import Ix.Compiler.CallReuse.MapPipeline
+import Ix.Compiler.IxIR1.Optimizer
+
+/-!
+# IxIR₁ and policy provenance for call reuse
+
+This identity commits to the canonical addressed IxIR₁ graph and the source,
+HPT, and versioned policies that determine its lowering. It is provenance for
+rebuilding the selected program, not a content address of serialized IxIR₂.
+The diagnostic JSON has no cache or wire-format role.
+-/
+
+namespace Ix.Compiler.CallReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR
+
+structure Provenance where
+  sourceRoot : Address
+  ir1Root : Address
+  hptRoots : List Address
+  maxDepth : Nat
+  loweringVersion : Nat := 1
+  pass : String := IxIR2.CallReuse.policyTag
+  execution : IxIR2.CreditPolicy
+  optimized : Bool
+  specialization : Option (String × Address) := none
+
+def Provenance.bytes (provenance : Provenance) : ByteArray :=
+  "compilatrix/call-reuse-provenance/1\x00".toUTF8 ++
+    Encoding.address provenance.sourceRoot ++ Encoding.address provenance.ir1Root ++
+    Encoding.list Encoding.address provenance.hptRoots ++ Encoding.nat provenance.maxDepth ++
+    Encoding.nat provenance.loweringVersion ++ Encoding.blob provenance.pass.toUTF8 ++
+    Encoding.blob provenance.execution.tag.toUTF8 ++ Encoding.tag (if provenance.optimized then 1 else 0) ++
+    Encoding.list (fun (policy, address) => Encoding.string policy ++ Encoding.address address)
+      provenance.specialization.toList
+
+def Provenance.identity (provenance : Provenance) : Address := Address.blake3 provenance.bytes
+
+def Compilation.provenance {constants : List (Address × Constant)} {root : Address}
+    {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+    (compilation : Compilation constants root config eraseFuel lowerFuel) : Provenance :=
+  { sourceRoot := root
+    ir1Root := IxIR1.Optimizer.graphRoot compilation.attached.source.artifact.targetArtifacts
+      compilation.attached.source.artifact.main
+    hptRoots := compilation.attached.hpt.result.artifacts.map (·.address)
+    maxDepth := compilation.attached.maxDepth
+    execution := compilation.selection.policy
+    optimized := match compilation.selection with | .optimized .. => true | .baseline .. => false }
+
+def MapLowered.provenance {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.MapRecovery.Recovered declarations main} {fuel : Nat}
+    (lowered : MapLowered recovery fuel) (root : Address) : Provenance :=
+  { sourceRoot := root
+    ir1Root := IxIR1.Optimizer.graphRoot lowered.lowering.result.artifacts lowered.lowering.result.main
+    hptRoots := lowered.attached.hpt.result.artifacts.map (·.address)
+    maxDepth := lowered.attached.maxDepth
+    execution := lowered.reuse.policy
+    optimized := match lowered.reuse with | .optimized .. => true | .baseline .. => false
+    specialization := some (IxIR0.MapRecovery.policyTag, recovery.address) }
+
+end Ix.Compiler.CallReuse
diff --git a/Ix/Compiler/CallReuse/Rejections.lean b/Ix/Compiler/CallReuse/Rejections.lean
new file mode 100644
index 000000000..bab0d18bb
--- /dev/null
+++ b/Ix/Compiler/CallReuse/Rejections.lean
@@ -0,0 +1,71 @@
+import Ix.Compiler.CallReuse.PolicyExamples
+
+/-! Fail-closed map specialization and policy regression matrix. -/
+
+namespace Ix.Compiler.CallReuse.Examples
+
+open Lean Ix.Compiler.Ixon
+
+private def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+private def replace (entries : List (Address × IxIR0.Decl)) (address : Address)
+    (declaration : IxIR0.Decl) : List (Address × IxIR0.Decl) :=
+  entries.map fun entry => if entry.1 == address then (address, declaration) else entry
+
+def rejectionChecks : Except String (List String) := do
+  let mut names ← PolicyExamples.checks
+  let source ← Examples.source [1, 2, 3] 42 false
+  let compilation ← source.compile.mapError reprStr
+  let .recovered recovery _ := compilation.outcome | throw "rejection fixture did not specialize"
+  let p := recovery.checked.plan
+  let s := p.schema
+  let entries := compilation.source.erasure.result.raw
+  for (name, changed) in [
+      ("map-wrong-worker", replace entries s.worker (.defn .shared (.lam .many (.var 0)))),
+      ("map-wrong-step", replace entries s.step (.defn .shared (.lam .many (.lam .many (.lam .many (.var 0)))))),
+      ("map-wrong-base", replace entries s.base (.defn .shared .erased)),
+      ("map-wrong-recursor", replace entries s.recursor (.recursor 2 true #[])),
+      ("map-wrong-cons-arity", replace entries s.cons (.ctor 1 1)),
+      ("map-wrong-nil-tag", replace entries s.nil (.ctor 1 0)),
+      ("map-wrong-alias", replace entries s.alias (.defn .unique (.ref s.recursor))),
+      ("map-wrong-entry", replace entries source.root (.defn .shared (.ref s.base)))] do
+    need ((IxIR0.MapRecovery.check changed (.ref source.root) p).isNone) s!"{name}: proposal accepted"
+    match IxIR0.MapRecovery.select changed (.ref source.root) with
+    | .recovered _ => throw s!"{name}: automatic recovery accepted"
+    | .literal _ => pure ()
+    names := names ++ [name]
+  let collision := (recovery.address, .defn .shared .erased) :: entries
+  match IxIR0.MapRecovery.selectWith collision (.ref source.root) (some p) with
+  | .literal .addressConflict => pure ()
+  | _ => throw "map specialization reused an existing declaration identity"
+  names := names ++ ["map-address-conflict"]
+  match lowerMap recovery 1000 0 with
+  | .error (.attachment (.lowering _)) => pure ()
+  | .error error => throw s!"map backend fallback failed for wrong reason: {repr error}"
+  | .ok _ => throw "map backend depth limit was ignored"
+  names := names ++ ["map-backend-fallback"]
+  let skipped ← (compileMap source.constants source.root source.config 1000 1000 1000 1000 0).mapError reprStr
+  match skipped.outcome with
+  | .literal (.attachment (.lowering _)) =>
+      need (skipped.source.artifact.main.bytes == compilation.source.artifact.main.bytes &&
+        Coverage.ir1Entries skipped.source.artifact.targetDecls == Coverage.ir1Entries compilation.source.artifact.targetDecls)
+        "map fallback changed the literal compiler artifact"
+      let (store, value) ← (IxIR1.runOwnedMain
+        { decls := skipped.source.artifact.targetDeclEnv } .shared skipped.source.artifact.main 10000).mapError reprStr
+      let released ← (IxIR1.dropVal { decls := skipped.source.artifact.targetDeclEnv } 10000 store value).mapError reprStr
+      need (released.live == 0 && released.frees == released.allocs) "literal map fallback did not reclaim"
+  | _ => throw "map compilation did not select its literal fallback"
+  names := names ++ ["map-literal-fallback-execution"]
+  return names
+
+def runAll : Except String (List CaseResult × List String) := do
+  let results ← cases.mapM fun (name, values, replacement, aliased, uniquePrefix) =>
+    (runCase name values replacement aliased uniquePrefix).mapError (fun message => s!"{name}: {message}")
+  return (results, ← rejectionChecks)
+
+def report (results : List CaseResult) (checks : List String) : Json :=
+  Json.mkObj [("format", toJson "compilatrix/source-call-reuse-report/1"),
+    ("cases", toJson (results.map (·.summary))), ("policy_and_rejection_checks", toJson checks)]
+
+end Ix.Compiler.CallReuse.Examples
diff --git a/Ix/Compiler/CallReuse/Sim.lean b/Ix/Compiler/CallReuse/Sim.lean
new file mode 100644
index 000000000..62e5f0a2f
--- /dev/null
+++ b/Ix/Compiler/CallReuse/Sim.lean
@@ -0,0 +1,98 @@
+import Ix.Compiler.CallReuse.Pipeline
+import Ix.Compiler.LoweredCompilationSim
+import Ix.Compiler.IxIR2.PipelineCallReuse
+
+/-!
+# Source refinement with suspended call credits
+
+The original shared-source certificate supplies a call-aware erasure trace.
+The ordinary ownership compiler and exact checked attachment supply execution,
+ownership, and the physical baseline. The versioned selection then supplies
+the same semantic heap/value relations and R4 resource and cost laws.
+-/
+
+namespace Ix.Compiler.CallReuse.Compilation
+
+open Ix.Compiler.Ixon (Address Constant)
+
+variable {constants : List (Address × Constant)} {root : Address}
+  {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+abbrev SourceValueRel (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) (rawValue : IxIR0.Value) : Prop :=
+  @Ix.Compiler.Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList compilation.attached.source.erasure.result.raw }
+    sourceValue rawValue compilation.attached.source.memberScope
+
+/-- The existing source, address, baseline, and live-heap relations composed
+without any counter condition in their semantic meaning. -/
+def PhysicalValueRel (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) (result : IxIR2.Eval.Result) : Prop :=
+  ∃ rawValue store value baseline locRel,
+    compilation.SourceValueRel sourceValue rawValue ∧
+    IxIR1.LowerSim.MutualAddressedValueGraph
+      (IxIR0.MutualBlock.Renaming.apply compilation.attached.source.erasure.result.addressMap)
+      (compilation.attached.source.lowering.result.rebuildRename compilation.attached.source.lowering.raw)
+      compilation.attached.source.lowered.functionRel store rawValue value ∧
+    IxIR2.Lower.Sim.OutcomeRel (store, value) baseline ∧
+    IxIR2.ReuseSim.StableHeapRel baseline.store result.store locRel ∧
+    IxIR1.Sim.RValIso locRel baseline.value result.value
+
+/-- Source correctness, full shared-result reclamation, allocation/free laws,
+RC and peak bounds for every accepted shared compilation and either selection
+branch. Only the original source sharing/oracle contracts and evaluation are
+premises; ownership and all compiler/heap/cost facts are derived internally. -/
+theorem sourceRefinesWithCostLaws
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.attached.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.attached.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.Policy.runMain compilation.selection.policy
+        (IxIR2.Eval.Context.ofProgram compilation.selection.target
+          compilation.attached.target.artifact.validationContext.schemas)
+        .physical compilation.selection.target controlFuel heapFuel = .ok result ∧
+      compilation.PhysicalValueRel sourceValue result ∧ result.SharedResources ∧
+      compilation.attached.compiled.CallCostComparison compilation.selection heapFuel result := by
+  let source := compilation.attached.source
+  letI : Ix.Compiler.Sim.MemberScope := source.memberScope
+  have hframe : (Pipeline.validatedMainFrame root).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [Pipeline.validatedMainFrame] at found
+  have hbelow : Ixon.Sharing.sharesBelow (Pipeline.validatedMainFrame root).sharing.size
+      Pipeline.validatedMainSource = true := rfl
+  have herase : EraseAddressed.run
+      (EraseValidator.eraseCtxOf (Pipeline.validatedEvalCtx constants config)) constants
+      source.entry.target eraseFuel = .ok source.erasure.result := by
+    rw [source.entryTarget]
+    exact source.erasure.runEq
+  obtain ⟨traceFuel, addressedValue, trace, rawValue, sourceRelation, addressedEq⟩ :=
+    IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members
+      (fun _ _ => none) (fun _ _ => none) source.members source.entry herase
+      (by intro address arguments; rfl) horacles hctx hframe hbelow hsource
+  subst addressedValue
+  obtain ⟨ir1Fuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    source.lowered.addressedOwnedMain trace
+  have attachedRun : IxIR1.runOwnedMain compilation.attached.compiled.simulationSourceContext
+      compilation.attached.compiled.target.artifact.source.mainResult
+      compilation.attached.compiled.target.artifact.source.main ir1Fuel = .ok (store, value) := by
+    rw [compilation.attached.compiled.simulationSourceContext_eq_addressedCtx,
+      compilation.attached.compiled.targetSourceProduced, compilation.attached.compiled.inputProduced]
+    exact ownedRun
+  obtain ⟨baselineControl, controlFuel, heapFuel, baseline, result, locRel,
+      baselineRun, run, baselineRelation, heaps, values, baselineResources, resources,
+      allocations, costs, reclaimed, prefixes⟩ :=
+    compilation.attached.compiled.selectedCallPhysicalMainCostLaws compilation.selection attachedRun
+  exact ⟨controlFuel, heapFuel, result, run,
+    ⟨rawValue, store, value, baseline, locRel, sourceRelation,
+      ⟨rawStore, addressImage, graph⟩, baselineRelation, heaps, values⟩,
+    resources, baselineControl, heapFuel, baseline, baselineRun, baselineResources,
+    allocations, costs, reclaimed, prefixes⟩
+
+end Ix.Compiler.CallReuse.Compilation
diff --git a/Ix/Compiler/CallReuse/Sources.lean b/Ix/Compiler/CallReuse/Sources.lean
new file mode 100644
index 000000000..a6da9e0a7
--- /dev/null
+++ b/Ix/Compiler/CallReuse/Sources.lean
@@ -0,0 +1,135 @@
+import Ix.Compiler.Coverage.Sources
+import Ix.Compiler.CallReuse.MapPipeline
+
+/-!
+# Ixon map inputs for suspended-credit reuse
+
+These synthetic sources map a constant-valued direct function over a list.
+The constructor wraps a non-tail recursive call. Inputs contain only canonical
+Ixon constants; the ordinary validated compiler produces both intermediate IRs.
+-/
+
+namespace Ix.Compiler.CallReuse.Examples
+
+open Ix.Compiler.Ixon
+
+private def definition (value typ : Expr) (refs : Array Address) : Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def projection (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def ghost (value : Expr) : Expr :=
+  .app (.lam .erased (.sort 0) value) (.sort 0)
+
+private def app2 (f x y : Expr) : Expr := .app (.app f x) y
+
+private def inductiveType (types : Array (Nat × Expr)) : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0, typ := .sort 0
+    ctors := types.mapIdx fun i row =>
+      { isUnsafe := false, lvls := 0, cidx := i.toUInt64, params := 0
+        fields := row.1.toUInt64, typ := row.2 } }
+
+structure Source where
+  constants : List (Address × Constant)
+  root : Address
+  values : List Nat
+  replacement : Nat
+  aliased : Bool
+  uniquePrefix : Nat
+  dataBlock : Address
+  nil : Address
+  cons : Address
+  pair : Address
+
+def Source.config (source : Source) : Pipeline.Config :=
+  { blobs := fun address => ((source.replacement :: source.values).find? fun value =>
+      X86.ValidatedScalar.literalAddress value == address).map .natB
+    limits :=
+      { maxConstants := 32, maxExpressionUnits := 4096, maxExpandedExpressionUnits := 4096
+        maxLayer1NodeVisits := 262144, maxErasedDeclarations := 128
+        maxErasureAppendCells := 8192, maxCertificateCandidates := 64
+        maxCertificateValidationAttempts := 4160, maxCertificateSourceNodeWork := 1048576
+        maxUsageFuel := 1000, maxErasureFuel := 1000
+        maxValidationFuel := 1000, maxLoweringFuel := 1000 } }
+
+abbrev Source.Compilation (source : Source) :=
+  CallReuse.MapCompilation source.constants source.root source.config 1000 1000
+
+def Source.compile (source : Source) : Except Pipeline.Error source.Compilation :=
+  CallReuse.compileMap source.constants source.root source.config
+    1000 1000 1000 1000 1000
+
+def source (values : List Nat) (replacement : Nat) (aliased : Bool) (uniquePrefix : Nat := 0) :
+    Except String Source := do
+  if values.length > 64 then throw "map fixture exceeds 64 list elements"
+  if uniquePrefix > values.length || (!aliased && uniquePrefix != 0) then
+    throw "map alias prefix is outside the input"
+  let natT := Expr.recur 0 #[]
+  let listT := Expr.recur 1 #[]
+  let stepT := .all .many .shared natT
+    (.all .many .shared listT (.all .many .shared listT listT))
+  let recursor : Recursor :=
+    { k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0
+      motives := 0, minors := 2
+      typ := .all .many .shared listT
+        (.all .many .shared stepT (.all .many .shared listT listT))
+      rules := #[
+        { fields := 0, rhs := .lam .many listT (.lam .many stepT (.var 1)) },
+        { fields := 2
+          rhs := .lam .many listT (.lam .many stepT (.lam .many natT (.lam .many listT
+            (.app (app2 (.var 2) (.var 1) (.var 0))
+              (.app (app2 (.recur 3 #[]) (.var 3) (.var 2)) (.var 0)))))) }] }
+  let dataBlock ← Coverage.addressed
+    { info := .muts #[
+        .indc (inductiveType #[(0, .recur 0 #[]),
+          (1, .all .many .shared (.recur 0 #[]) (.recur 0 #[]))]),
+        .indc (inductiveType #[(0, .recur 1 #[]),
+          (2, .all .many .shared (.recur 0 #[])
+            (.all .many .shared (.recur 1 #[]) (.recur 1 #[])))]),
+        .indc (inductiveType #[(2, .all .many .shared (.recur 1 #[])
+          (.all .many .shared (.recur 1 #[]) (.recur 2 #[])))]),
+        .recr recursor]
+      sharing := #[], refs := #[], univs := #[.zero] }
+  let nil ← Coverage.addressed (projection (.cPrj { idx := 1, cidx := 0, block := dataBlock.1 }))
+  let cons ← Coverage.addressed (projection (.cPrj { idx := 1, cidx := 1, block := dataBlock.1 }))
+  let pair ← Coverage.addressed (projection (.cPrj { idx := 2, cidx := 0, block := dataBlock.1 }))
+  let natType ← Coverage.addressed (projection (.iPrj { idx := 0, block := dataBlock.1 }))
+  let listType ← Coverage.addressed (projection (.iPrj { idx := 1, block := dataBlock.1 }))
+  let pairType ← Coverage.addressed (projection (.iPrj { idx := 2, block := dataBlock.1 }))
+  let worker ← Coverage.addressed (definition
+    (.lam .many (.ref 0 #[]) (ghost (.nat 1)))
+    (.all .many .shared (.ref 0 #[]) (.ref 0 #[]))
+    #[natType.1, X86.ValidatedScalar.literalAddress replacement])
+  let base ← Coverage.addressed (definition (ghost (.ref 0 #[])) (.ref 1 #[]) #[nil.1, listType.1])
+  let step ← Coverage.addressed (definition
+    (.lam .many (.ref 2 #[]) (.lam .many (.ref 3 #[]) (.lam .many (.ref 3 #[])
+      (app2 (.ref 0 #[]) (.app (.ref 1 #[]) (.var 2)) (.var 0)))))
+    (.all .many .shared (.ref 2 #[])
+      (.all .many .shared (.ref 3 #[]) (.all .many .shared (.ref 3 #[]) (.ref 3 #[]))))
+    #[cons.1, worker.1, natType.1, listType.1])
+  let map ← Coverage.addressed (projection (.rPrj { idx := 3, block := dataBlock.1 }))
+  let call := fun major => .app (app2 (.ref 0 #[]) (.ref 6 #[]) (.ref 7 #[])) major
+  let heads := values.mapIdx fun index _ => ghost (.nat (index + 8).toUInt64)
+  let input := heads.foldr (fun head tail => app2 (.ref 2 #[]) head tail)
+    (ghost (.ref 1 #[]))
+  let body := if aliased then
+    let suffix := (heads.drop uniquePrefix).foldr (fun head tail => app2 (.ref 2 #[]) head tail)
+      (ghost (.ref 1 #[]))
+    let withPrefix := (heads.take uniquePrefix).foldr (fun head tail => app2 (.ref 2 #[]) head tail)
+      (.var 0)
+    .letE false (.ref 3 #[]) suffix
+      (app2 (.ref 4 #[]) (call withPrefix) (.var 0))
+    else call input
+  let entry ← Coverage.addressed (definition body
+    (if aliased then .ref 5 #[] else .ref 3 #[])
+    (#[map.1, nil.1, cons.1, listType.1, pair.1, pairType.1, base.1, step.1] ++
+      (values.map X86.ValidatedScalar.literalAddress).toArray))
+  return {
+    constants := [dataBlock, nil, cons, pair, natType, listType, pairType,
+      worker, map, base, step, entry]
+    root := entry.1, values, replacement, aliased, uniquePrefix
+    dataBlock := dataBlock.1, nil := nil.1, cons := cons.1, pair := pair.1 }
+
+end Ix.Compiler.CallReuse.Examples
diff --git a/Ix/Compiler/Coverage/HeapSnapshot.lean b/Ix/Compiler/Coverage/HeapSnapshot.lean
new file mode 100644
index 000000000..abef39a70
--- /dev/null
+++ b/Ix/Compiler/Coverage/HeapSnapshot.lean
@@ -0,0 +1,16 @@
+import Ix.Compiler.Coverage.Snapshot
+
+/-! Shared JSON observations for source-driven heap fixtures. -/
+
+namespace Ix.Compiler.Coverage
+
+open Lean
+
+deriving instance ToJson for IxIR1.RVal
+deriving instance ToJson for IxIR1.Node
+deriving instance ToJson for IxIR1.NodeBox
+deriving instance ToJson for IxIR1.Store
+deriving instance ToJson for IxIR2.Eval.Counters
+deriving instance ToJson for IxIR2.Eval.Store
+
+end Ix.Compiler.Coverage
diff --git a/Ix/Compiler/Coverage/Report.lean b/Ix/Compiler/Coverage/Report.lean
new file mode 100644
index 000000000..e7b454f4c
--- /dev/null
+++ b/Ix/Compiler/Coverage/Report.lean
@@ -0,0 +1,120 @@
+import Ix.Compiler.Coverage.Run
+import Ix.Compiler.Coverage.StdContact
+import Ix.Compiler.Coverage.Upstream
+import Ix.Compiler.IxIR1.WellModedGen
+
+/-! The production negative boundary and the pre-existing generated IR corpus
+accompany the positive synthetic Ixon cases in one deterministic report. -/
+
+namespace Ix.Compiler.Coverage
+
+open Lean Ix.Compiler.Ixon
+
+deriving instance ToJson for Catalog.Stats
+deriving instance ToJson for IxIR1.WellModedGen.Summary
+
+private def productionInput (loaded : Catalog.Loaded)
+    (constants : List (Address × Constant)) (root : Address) : Except String Json := do
+  let stored := loaded.pieces.toList.flatMap (·.constants.toList)
+  let records ← constants.mapM fun (address, constant) => do
+    let some record := stored.find? (·.address == address)
+      | throw "production source snapshot lost an original byte record"
+    if record.constant != constant then throw "production source snapshot changed a constant"
+    return Json.mkObj [("key", toJson address), ("bytes", byteJson record.bytes)]
+  let references := constants.flatMap (fun entry => CatalogContactFixture.dependencies entry.2)
+  let blobs := loaded.blobs.filter (fun entry => references.contains entry.1)
+  return Json.mkObj [
+    ("root", toJson root), ("constants", toJson records),
+    ("blob_inputs", toJson (blobs.map fun (address, bytes) =>
+      Json.mkObj [("key", toJson address), ("bytes", byteJson bytes)])),
+    ("provenance", Json.mkObj [
+      ("members_root", toJson loaded.manifest.membersRoot),
+      ("content_root", toJson loaded.manifest.contentRoot),
+      ("piece_hash", toJson CatalogContactFixture.expectedPieceHash),
+      ("toolchain", toJson "leanprover/lean4:v4.33.1"),
+      ("source_pin", toJson "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4")]),
+    ("check_fuel", toJson UsageCheck.defaultFuel), ("limits", toJson Pipeline.defaultLimits)]
+
+private def productionCase (loaded : Catalog.Loaded) (name rootKind : String)
+    (constants : List (Address × Constant)) (root : Address) (stage : String) (failure : Json)
+    (details : Json) (partialCompilation : Json := Json.null) : Except String CaseResult := do
+  let input ← productionInput loaded constants root
+  return {
+    name
+    row := Json.mkObj [
+      ("name", toJson name), ("origin", toJson "production-ixon"),
+      ("root_kind", toJson rootKind), ("root", toJson root),
+      ("source_constants", toJson constants.length), ("last_accepted_stage", toJson stage),
+      ("rejection", failure), ("observation", Json.null),
+      ("ir1_root", Json.null), ("hpt_roots", Json.null), ("features", Json.null),
+      ("snapshot", toJson s!"{name}.json"), ("object", Json.null)]
+    snapshot := Json.mkObj [("format", toJson "compilatrix/source-case/1"),
+      ("input", input), ("compilation", partialCompilation), ("observations", failure), ("details", details)] }
+
+def productionCases (loaded : Catalog.Loaded) : Except String (List CaseResult) := do
+  let some rejected := loaded.constants.find? (fun entry =>
+      entry.1.toHex == CatalogContactFixture.expectedPipelineAddress)
+    | throw "production contact lost the rejected constant"
+  let closure := CatalogContactFixture.dependencyClosure loaded.constants rejected.1
+  if closure.length != 17 || !CatalogContactFixture.isClosed loaded.constants closure ||
+      CatalogContactFixture.dependencyClosure closure rejected.1 != closure then
+    throw "production dependency closure drifted"
+  for entry in closure do
+    if entry.1 != rejected.1 && CatalogContactFixture.isClosed loaded.constants
+        (closure.filter (fun candidate => candidate.1 != entry.1)) then
+      throw "production dependency closure contains a removable constant"
+  -- Missing definitions alter telescope/erasure decisions, so deleting all
+  -- dependencies is not a valid minimization of this production failure.
+  match Pipeline.checkProgram [rejected] with
+  | .error (.usage root (.typeBinderRuntimeUse .linear)) =>
+      if root != rejected.1 then throw "isolated production rejection changed root"
+  | _ => throw "isolated production context diagnostic drifted"
+  let some remaining := loaded.constants.find? (fun entry =>
+      entry.1.toHex == CatalogContactFixture.expectedRemainingFreezeAddress)
+    | throw "production contact lost the remaining freeze root"
+  if !CatalogContactFixture.freezesAt loaded.constants remaining.1 then
+    throw "production contact remaining freezeNeeded rejection drifted"
+  match Pipeline.checkProgram closure with
+  | .ok () => pure ()
+  | .error error => throw s!"original closed production slice no longer passes usage: {repr error}"
+  match Pipeline.compileValidated closure rejected.1 with
+  | .error (.validate address message) =>
+    if address != rejected.1 || message != "reference lacks a Covered certificate" then
+      throw "production slice Covered diagnostic drifted"
+  | _ => throw "production slice no longer reaches its checked erasure boundary"
+  let partialCompilation ← addressedSnapshot closure rejected.1 {} Erase.defaultFuel
+  let full ← productionCase loaded "std-contact" "environment" loaded.constants
+    loaded.manifest.contentRoot "ixon"
+    (Json.mkObj [("stage", toJson "usage"), ("code", toJson "freezeNeeded"),
+      ("root", toJson remaining.1), ("message", Json.null)]) (toJson loaded.stats)
+  let minimized ← productionCase loaded "std-failure-closure" "constant" closure rejected.1 "addressed-ixir0"
+    (Json.mkObj [("stage", toJson "validated-erasure"), ("code", toJson "missingCovered"),
+      ("root", toJson rejected.1), ("message", toJson "reference lacks a Covered certificate")])
+    (Json.mkObj [
+      ("parent_environment", toJson loaded.manifest.contentRoot),
+      ("original_constants", toJson loaded.constants.length),
+      ("closure_keys", toJson (closure.map (·.1))),
+      ("closed", toJson true), ("single_deletion_minimal", toJson true),
+      ("previous_rejection", toJson "reservedIdentityCollision"), ("usage_now_accepted", toJson true),
+      ("isolated_rejection", Json.mkObj [
+        ("code", toJson "typeBinderRuntimeUse"), ("uses", toJson "linear")])]) partialCompilation
+  return [full, minimized]
+
+def generatedCorpus : Except String Json := do
+  match IxIR1.WellModedGen.checkCorpus with
+  | some failure => throw s!"generated IxIR0 corpus failed: {repr failure}"
+  | none =>
+      return Json.mkObj [
+        ("origin", toJson "generated-ixir0"),
+        ("seed", toJson IxIR1.WellModedGen.defaultSeed),
+        ("summary", toJson (IxIR1.WellModedGen.summarize)),
+        ("property", toJson "IxIR0/IxIR1 value agreement and result reclamation, or exact lowering rejection")]
+
+def report (results : List CaseResult) (corpus : Json) : Json :=
+  Json.mkObj [
+    ("format", toJson "compilatrix/source-coverage/1"),
+    ("policy_version", toJson (2 : Nat)),
+    ("source_cases", toJson (results.map (·.row))),
+    ("generated_ir_corpus", corpus)]
+
+end Ix.Compiler.Coverage
diff --git a/Ix/Compiler/Coverage/Run.lean b/Ix/Compiler/Coverage/Run.lean
new file mode 100644
index 000000000..600eb8972
--- /dev/null
+++ b/Ix/Compiler/Coverage/Run.lean
@@ -0,0 +1,218 @@
+import Ix.Compiler.Coverage.Snapshot
+import Ix.Compiler.X86.ELFValidate
+
+/-! Run each fixed Ixon input through the actual compiler and independently
+observe each executable stage. Expected rejection is part of the coverage
+matrix; any other rejection or observation drift fails the gate. -/
+
+namespace Ix.Compiler.Coverage
+
+open Lean Ix.Compiler.Ixon
+
+structure Features where
+  directCalls : Nat := 0
+  tailCalls : Nat := 0
+  papps : Nat := 0
+  applies : Nat := 0
+  constructorSwitches : Nat := 0
+  natSwitches : Nat := 0
+  deriving ToJson
+
+def features (program : IxIR2.Program) : Features := Id.run do
+  let functions := program.main :: program.declarations.filterMap fun
+    | (_, .fn function) => some function
+    | _ => none
+  let mut result : Features := {}
+  for function in functions do
+    for block in function.blocks do
+      for instruction in block.instructions do
+        result := match instruction with
+          | .call .. | .callSelf .. => { result with directCalls := result.directCalls + 1 }
+          | .papp .. => { result with papps := result.papps + 1 }
+          | .apply .. => { result with applies := result.applies + 1 }
+          | _ => result
+      result := match block.terminator with
+        | .tailCall .. | .tailCallSelf .. => { result with tailCalls := result.tailCalls + 1 }
+        | .switchValue _ constructors natPeel =>
+            { result with
+              constructorSwitches := result.constructorSwitches + (if constructors.isEmpty then 0 else 1)
+              natSwitches := result.natSwitches + (if natPeel.isSome then 1 else 0) }
+        | _ => result
+  return result
+
+private def scalar0 (name : String) : Except IxIR0.Err IxIR0.Value → Except String Nat
+  | .ok (.lit (.nat number)) => .ok number
+  | .ok _ => .error s!"{name} returned a non-Nat value"
+  | .error error => .error s!"{name} failed: {repr error}"
+
+private def scalar1 (name : String) (value : IxIR1.RVal) : Except String Nat :=
+  match value with
+  | .lit (.nat number) => .ok number
+  | _ => .error s!"{name} returned a non-Nat value"
+
+private def heapCounters (store : IxIR1.Store) : Json :=
+  Json.mkObj [("allocs", toJson store.allocs), ("frees", toJson store.frees),
+    ("rcops", toJson store.rcops), ("reuses", toJson store.reuses), ("live", toJson store.live)]
+
+private def sameCounters (first second : IxIR1.Store) : Bool :=
+  first.allocs == second.allocs && first.frees == second.frees &&
+    first.rcops == second.rcops && first.reuses == second.reuses && first.live == second.live
+
+private def sameStore (first second : IxIR2.Eval.Store) : Bool :=
+  first.counters == second.counters && first.heap.nodes.size == second.heap.nodes.size &&
+    (first.heap.nodes.zip second.heap.nodes).all fun
+      | (none, none) => true
+      | (some left, some right) =>
+          left.world == right.world && left.rc == right.rc && left.node == right.node
+      | _ => false
+
+private def physicalObservation (source : Source) (number : Nat)
+    (result : IxIR2.Eval.Result) : Json :=
+  Json.mkObj [
+    ("nat", toJson number), ("heap", heapCounters result.store.heap),
+    ("peak_live_nodes", toJson result.store.peakLiveNodes),
+    ("control_steps", toJson (source.policy.controlFuel - result.controlRemaining)),
+    ("heap_work", toJson (source.policy.heapFuel - result.heapRemaining)),
+    ("reset_attempts", toJson result.store.resetAttempts),
+    ("hot_resets", toJson result.store.hotResets), ("cold_resets", toJson result.store.coldResets),
+    ("reused_payload_units", toJson result.store.reusedPayloadUnits)]
+
+structure Observation where
+  summary : Json
+  stages : Json
+
+def Source.observe (source : Source) (attached : source.Attached)
+    (number : Nat) : Except String Observation := do
+  let sourceNumber ←
+    match Ixon.Eval.eval (Pipeline.validatedEvalCtx source.constants source.config)
+        source.policy.evalFuel (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource with
+    | .ok (.litV (.natL number)) => pure number
+    | .ok _ => throw "Ixon returned a non-Nat value"
+    | .error error => throw s!"Ixon execution failed: {repr error}"
+  let artifact := attached.source.artifact
+  let raw0 ← scalar0 "raw IxIR0" (IxIR0.eval { env := IxIR0.Env.ofList artifact.rawErasedDecls }
+    source.policy.evalFuel [] (.ref source.root))
+  let addressed0 ← scalar0 "addressed IxIR0" (IxIR0.eval { env := IxIR0.Env.ofList artifact.erasedDecls }
+    source.policy.evalFuel [] attached.source.erasure.result.main)
+  let (rawStore, rawValue) ←
+    (IxIR1.runOwnedMain { decls := IxIR1.Env.ofList attached.source.lowering.raw }
+      .shared attached.source.lowering.mainCode source.policy.evalFuel).mapError
+        (fun error => s!"raw IxIR1 failed: {repr error}")
+  let raw1 ← scalar1 "raw IxIR1" rawValue
+  let (store, value) ←
+    (IxIR1.runOwnedMain { decls := artifact.targetDeclEnv } .shared artifact.main source.policy.evalFuel).mapError
+      (fun error => s!"addressed IxIR1 failed: {repr error}")
+  let addressed1 ← scalar1 "addressed IxIR1" value
+  let context := IxIR2.Eval.Context.ofProgram attached.target.artifact.program
+    attached.target.artifact.validationContext.schemas
+  let logical ← (IxIR2.Eval.runMain context .logical attached.target.artifact.program
+    source.policy.controlFuel source.policy.heapFuel).mapError (fun error => s!"logical IxIR2 failed: {repr error}")
+  let physical ← (IxIR2.Eval.runMain context .physical attached.target.artifact.program
+    source.policy.controlFuel source.policy.heapFuel).mapError (fun error => s!"physical IxIR2 failed: {repr error}")
+  let logicalNumber ← scalar1 "logical IxIR2" logical.value
+  let physicalNumber ← scalar1 "physical IxIR2" physical.value
+  if [sourceNumber, raw0, addressed0, raw1, addressed1, logicalNumber, physicalNumber].any (· != number) then
+    throw "source and intermediate Nat observations disagree"
+  if !sameCounters rawStore store || !sameCounters store logical.store.heap ||
+      !sameCounters store physical.store.heap || !sameStore logical.store physical.store ||
+      logical.controlRemaining != physical.controlRemaining || logical.heapRemaining != physical.heapRemaining ||
+      store.live != 0 then
+    throw "intermediate counters, complete baseline stores, or execution budgets disagree"
+  let summary := physicalObservation source number physical
+  return {
+    summary
+    stages := Json.mkObj [
+      ("ixon", toJson sourceNumber), ("raw_ixir0", toJson raw0), ("ixir0", toJson addressed0),
+      ("raw_ixir1", Json.mkObj [("nat", toJson raw1), ("heap", heapCounters rawStore)]),
+      ("ixir1", Json.mkObj [("nat", toJson addressed1), ("heap", heapCounters store)]),
+      ("logical_ixir2", physicalObservation source logicalNumber logical),
+      ("physical_ixir2", summary)] }
+
+structure CaseResult where
+  name : String
+  row : Json
+  snapshot : Json
+  object : Option ByteArray := none
+
+private def rejection (stage code : String) (root : Address)
+    (message : Option String := none) : Json :=
+  Json.mkObj [("stage", toJson stage), ("code", toJson code),
+    ("root", toJson root), ("message", toJson message)]
+
+private def sourceRow (source : Source) (stage : String) (failure observation : Json)
+    (compiled : Option source.Attached := none) (hasObject : Bool := false) : Json :=
+  Json.mkObj [
+    ("name", toJson source.name), ("origin", toJson "synthetic-ixon"),
+    ("root_kind", toJson "constant"), ("root", toJson source.root),
+    ("source_constants", toJson source.constants.length), ("last_accepted_stage", toJson stage),
+    ("rejection", failure), ("observation", observation),
+    ("ir1_root", match compiled with
+      | none => Json.null
+      | some attached => toJson (IxIR1.Optimizer.graphRoot attached.source.artifact.targetArtifacts
+          attached.source.artifact.main)),
+    ("hpt_roots", match compiled with | none => Json.null | some attached => toJson attached.hpt.result.addresses),
+    ("features", match compiled with | none => Json.null | some attached => toJson (features attached.target.artifact.program)),
+    ("snapshot", toJson s!"{source.name}.json"),
+    ("object", if hasObject then toJson s!"{source.name}.o" else Json.null)]
+
+private def caseSnapshot (source : Source) (compilation observations : Json) : Json :=
+  Json.mkObj [("format", toJson "compilatrix/source-case/1"),
+    ("input", source.inputSnapshot), ("compilation", compilation), ("observations", observations)]
+
+def runSource (source : Source) : Except String CaseResult := do
+  match source.compile with
+  | .error (.pipeline (.usage root .freezeNeeded)) =>
+      if source.expected != .usageFreeze || root != source.root then
+        throw "unexpected source freezeNeeded rejection"
+      let failure := rejection "usage" "freezeNeeded" root
+      return { name := source.name, row := sourceRow source "ixon" failure Json.null
+               snapshot := caseSnapshot source Json.null failure }
+  | .error (.pipeline (.validate root message)) =>
+      if source.expected != .externRejected || root != source.root ||
+          message != "validated extern ownership ABI rejects this declaration" then
+        throw s!"unexpected erasure-validation rejection: {root}: {message}"
+      let failure := rejection "validated-erasure" "extern-ownership" root (some message)
+      return { name := source.name, row := sourceRow source "usage" failure Json.null
+               snapshot := caseSnapshot source Json.null failure }
+  | .error error => throw s!"compiler rejected {source.name}: {repr error}"
+  | .ok attached =>
+      let .scalar number shouldSelect := source.expected | throw "compiler accepted a negative source case"
+      let observation ← source.observe attached number
+      let compilation := source.compilationSnapshot attached
+      match X86.Select.select attached.target.artifact.program with
+      | .error .unsupportedScalarShape =>
+          if shouldSelect then throw "source scalar failed selection"
+          let failure := rejection "x86-selection" "unsupportedScalarShape" source.root
+          return { name := source.name
+                   row := sourceRow source "ixir2" failure observation.summary (some attached)
+                   snapshot := caseSnapshot source compilation observation.stages }
+      | .error (.invalidSource (.invalid _ .schema "missing constructor schema")) =>
+          if shouldSelect || !(source.name.startsWith "ctor-" || source.name.startsWith "nat-") then
+            throw "unexpected constructor-schema boundary in scalar selection"
+          let failure := rejection "x86-selection" "missingConstructorSchema" source.root
+          return { name := source.name
+                   row := sourceRow source "ixir2" failure observation.summary (some attached)
+                   snapshot := caseSnapshot source compilation observation.stages }
+      | .error error => throw s!"unexpected selector error: {repr error}"
+      | .ok selected =>
+          if !shouldSelect || selected.word.toNat != number then
+            throw "selector accepted an unexpected graph or truncated its Nat"
+          let targetRun := X86.runFrom X86.Runtime.rejecting selected.target 2 (X86.Core.empty 0x1008)
+          if targetRun.status != .halted selected.word || targetRun.core.readReg .rsp != 0x1008 then
+            throw "typed x86 observation disagrees with the source"
+          let stream ← (X86.Stream.encode selected.target).mapError (fun error => reprStr error)
+          let encoded := stream.output
+          let provenance : X86.ELF.Provenance :=
+            .ixir1Policy (IxIR1.Optimizer.graphRoot attached.source.artifact.targetArtifacts
+              attached.source.artifact.main) X86.ValidatedScalar.loweringVersion X86.ValidatedScalar.passPolicyVersion
+          let object ← (X86.ELF.writeChecked
+            { encoded, entryBlock := selected.target.program.entry, provenance }).mapError (fun error => reprStr error)
+          return {
+            name := source.name
+            row := sourceRow source "elf" Json.null observation.summary (some attached) true
+            snapshot := caseSnapshot source compilation
+              (Json.mkObj [("intermediate", observation.stages), ("typed_x86", toJson selected.word),
+                ("text", byteJson encoded.text), ("provenance", byteJson provenance.bytes)])
+            object := some object.bytes }
+
+end Ix.Compiler.Coverage
diff --git a/Ix/Compiler/Coverage/Snapshot.lean b/Ix/Compiler/Coverage/Snapshot.lean
new file mode 100644
index 000000000..68ad4382e
--- /dev/null
+++ b/Ix/Compiler/Coverage/Snapshot.lean
@@ -0,0 +1,164 @@
+import Lean
+import Ix.Compiler.Coverage.Sources
+import Ix.Compiler.IxIR1.HPTCache
+
+/-! Complete diagnostic snapshots for comparing fresh compiler processes.
+Ixon, IxIR₀, IxIR₁, and HPT records use their existing canonical bytes and
+identities. The IxIR₂ JSON is a structural diagnostic only: it has no decoder,
+content address, persistent cache role, or claim to be an IxIR₂ wire format.
+Proof terms are erased; their retained executable artifacts are compared. -/
+
+namespace Ix.Compiler.Coverage
+
+open Lean Ix.Compiler.Ixon
+
+instance : ToJson Address := ⟨fun address => toJson address.toHex⟩
+deriving instance ToJson for Owned
+deriving instance ToJson for Pipeline.Limits
+deriving instance ToJson for Policy
+deriving instance ToJson for IxIR1.HPT.Limits
+deriving instance ToJson for IxIR1.HPT.ProducerLimits
+deriving instance ToJson for IxIR1.HPT.ProducerStats
+deriving instance ToJson for IxIR0.Literal
+deriving instance ToJson for IxIR1.CtorId
+deriving instance ToJson for IxIR2.Atom
+deriving instance ToJson for IxIR2.ParamPassing
+deriving instance ToJson for IxIR2.Param
+deriving instance ToJson for IxIR2.Signature
+deriving instance ToJson for IxIR2.BorrowLender
+deriving instance ToJson for IxIR2.ValueCap
+deriving instance ToJson for IxIR2.CreditCap
+deriving instance ToJson for IxIR2.CtorSchema
+deriving instance ToJson for IxIR2.Instr
+deriving instance ToJson for IxIR2.Edge
+deriving instance ToJson for IxIR2.CtorAlt
+deriving instance ToJson for IxIR2.NatPeel
+deriving instance ToJson for IxIR2.Terminator
+deriving instance ToJson for IxIR2.Block
+deriving instance ToJson for IxIR2.Function
+deriving instance ToJson for IxIR2.Decl
+deriving instance ToJson for IxIR2.Program
+deriving instance ToJson for IxIR2.Validate.Stats
+deriving instance ToJson for IxIR2.Pipeline.ConstructorInfo
+deriving instance ToJson for IxIR2.Pipeline.RecursorOrigin
+
+def hex (bytes : ByteArray) : String := Id.run do
+  let digits := "0123456789abcdef".toList.toArray
+  let mut chars : Array Char := #[]
+  for byte in bytes do
+    chars := chars.push digits[byte.toNat / 16]!
+    chars := chars.push digits[byte.toNat % 16]!
+  return String.ofList chars.toList
+
+def byteJson (bytes : ByteArray) : Json := toJson (hex bytes)
+
+def ir0Entries (entries : List (Address × IxIR0.Decl)) : Json :=
+  toJson (entries.map fun (address, declaration) =>
+    Json.mkObj [("key", toJson address), ("preimage", byteJson declaration.preimage)])
+
+def ir1Entries (entries : List (Address × IxIR1.Decl)) : Json :=
+  toJson (entries.map fun (address, declaration) =>
+    Json.mkObj [("key", toJson address), ("preimage", byteJson declaration.preimage)])
+
+def ir0Block (block : IxIR0.MutualBlock.Result) : Json :=
+  Json.mkObj [
+    ("root", toJson block.blockAddress),
+    ("preimage", byteJson (IxIR0.MutualBlock.Block.preimage block.blockMembers)),
+    ("members", ir0Entries block.members), ("address_map", toJson block.addressMap)]
+
+def ir0Group (group : IxIR0.Readdress.Group) : Json :=
+  Json.mkObj [
+    ("kind", toJson (match group with | .stable _ => "stable" | .mutual _ => "mutual")),
+    ("entries", ir0Entries group.entries)]
+
+/-- Complete eraser/addressing output, before the source erasure certificate
+has been accepted. This is useful even when the next validator rejects. -/
+def erasedSnapshot (root : Address) (erasure : EraseAddressed.Result) : Json :=
+  Json.mkObj [
+    ("raw_declarations", ir0Entries erasure.raw),
+    ("raw_main", byteJson (IxIR0.Expr.bytes (.ref root))),
+    ("groups", toJson (erasure.groups.map ir0Group)),
+    ("declarations", ir0Entries erasure.declarations),
+    ("main", byteJson erasure.main.bytes),
+    ("blocks", toJson (erasure.addressed.blocks.map ir0Block)),
+    ("address_map", toJson erasure.addressMap)]
+
+def addressedSnapshot (constants : List (Address × Constant)) (root : Address)
+    (config : Pipeline.Config) (fuel : Nat) : Except String Json := do
+  let ctx := EraseValidator.eraseCtxOf (Pipeline.validatedEvalCtx constants config)
+  let erasure ← (EraseAddressed.run ctx constants (.ref root) fuel).mapError reprStr
+  return Json.mkObj [
+    ("format", toJson "compilatrix/addressed-erasure/1"),
+    ("source_erasure_certified", toJson false),
+    ("ixir0", erasedSnapshot root erasure)]
+
+def ir1Artifact : IxIR1.ReaddressAll.Artifact → Json
+  | .stable address declaration =>
+      Json.mkObj [("kind", toJson "stable"), ("root", toJson address),
+        ("preimage", byteJson declaration.preimage)]
+  | .ordinary address declaration =>
+      Json.mkObj [("kind", toJson "ordinary"), ("root", toJson address),
+        ("preimage", byteJson declaration.preimage)]
+  | .mutual block =>
+      Json.mkObj [("kind", toJson "mutual"), ("root", toJson block.blockAddress),
+        ("preimage", byteJson (IxIR1.MutualBlock.Block.preimage block.blockMembers)),
+        ("members", ir1Entries block.members), ("address_map", toJson block.addressMap)]
+
+private def hptMembers (members : List (Address × IxIR1.HPT.Fact)) : Json :=
+  toJson (members.map fun (address, fact) =>
+    Json.mkObj [("key", toJson address), ("fact_bytes", byteJson fact.bytes)])
+
+def hptCandidate (candidate : IxIR1.HPT.CandidateArtifact) : Json :=
+  Json.mkObj [("program_root", toJson candidate.programIdentity),
+    ("members", hptMembers candidate.members)]
+
+def hptArtifact (artifact : IxIR1.HPT.Artifact) : Json :=
+  Json.mkObj [
+    ("program_root", toJson artifact.programIdentity),
+    ("cache_key", toJson artifact.cacheKey), ("root", toJson artifact.address),
+    ("dependencies", toJson artifact.dependencies), ("members", hptMembers artifact.members),
+    ("bytes", byteJson (IxIR1.HPT.Cache.encodeArtifact artifact))]
+
+def Source.inputSnapshot (source : Source) : Json :=
+  Json.mkObj [
+    ("root", toJson source.root),
+    ("constants", toJson (source.constants.map fun (address, constant) =>
+      Json.mkObj [("key", toJson address), ("bytes", byteJson (ser constant))])),
+    ("literal_inputs", toJson (source.literals.map fun number =>
+      Json.mkObj [("key", toJson (X86.ValidatedScalar.literalAddress number)),
+        ("nat", toJson number)])),
+    ("nat_block", toJson source.natBlock), ("policy", toJson source.policy)]
+
+/-- Compare both pre-address and final graphs, every renaming map and mutual
+artifact, the actual checked HPT certificate and summary records, and the
+finite IxIR₂ sidecars. No `repr` digest stands in for any of these artifacts. -/
+def Source.compilationSnapshot (source : Source) (attached : source.Attached) : Json :=
+  let erasure := attached.source.erasure.result
+  let lowering := attached.source.lowering
+  let artifact := attached.source.artifact
+  Json.mkObj [
+    ("format", toJson "compilatrix/compiler-snapshot/1"),
+    ("source", source.inputSnapshot),
+    ("ixir0", erasedSnapshot source.root erasure),
+    ("ixir1", Json.mkObj [
+      ("root", toJson (IxIR1.Optimizer.graphRoot artifact.targetArtifacts artifact.main)),
+      ("raw_declarations", ir1Entries lowering.raw),
+      ("raw_main", byteJson lowering.mainCode.bytes),
+      ("artifacts", toJson (artifact.targetArtifacts.map ir1Artifact)),
+      ("declarations", ir1Entries artifact.targetDecls),
+      ("main", byteJson artifact.main.bytes),
+      ("address_map", toJson artifact.targetAddressMap),
+      ("reserved", toJson lowering.result.reserved)]),
+    ("hpt", Json.mkObj [
+      ("producer_limits", toJson IxIR1.HPT.defaultProducerLimits),
+      ("producer_stats", toJson attached.hpt.stats),
+      ("candidate", toJson (attached.hpt.certificate.artifacts.map hptCandidate)),
+      ("artifacts", toJson (attached.hpt.result.artifacts.map hptArtifact))]),
+    ("ixir2_diagnostic", Json.mkObj [
+      ("program", toJson attached.target.artifact.program),
+      ("validation_stats", toJson attached.target.stats),
+      ("parameter_worlds", toJson attached.sidecars.parameterEntries),
+      ("constructors", toJson attached.sidecars.constructors),
+      ("recursor_origins", toJson attached.sidecars.recursorOrigins)])]
+
+end Ix.Compiler.Coverage
diff --git a/Ix/Compiler/Coverage/Sources.lean b/Ix/Compiler/Coverage/Sources.lean
new file mode 100644
index 000000000..4979cc43e
--- /dev/null
+++ b/Ix/Compiler/Coverage/Sources.lean
@@ -0,0 +1,169 @@
+import Ix.Compiler.X86.ValidatedScalar
+
+/-! Fixed, bounded Ixon inputs for the source-coverage gate. These inputs are
+synthetic; the production-writer contact is loaded separately without rewriting
+its bytes. Every constructed constant crosses the canonical source address gate.
+No intermediate IR is supplied by these fixtures. -/
+
+namespace Ix.Compiler.Coverage
+
+open Ix.Compiler.Ixon
+
+structure Policy where
+  limits : Pipeline.Limits
+  checkFuel : Nat := 500
+  eraseFuel : Nat := 500
+  validateFuel : Nat := 500
+  lowerFuel : Nat := 500
+  maxDepth : Nat := 500
+  evalFuel : Nat := 1000
+  controlFuel : Nat := 1000
+  heapFuel : Nat := 1000
+
+def sourcePolicy : Policy :=
+  { limits :=
+      { maxConstants := 16, maxExpressionUnits := 512, maxExpandedExpressionUnits := 512
+        maxLayer1NodeVisits := 65536, maxErasedDeclarations := 128, maxErasureAppendCells := 8192
+        maxCertificateCandidates := 32, maxCertificateValidationAttempts := 1024
+        maxCertificateSourceNodeWork := 524288, maxUsageFuel := 500, maxErasureFuel := 500
+        maxValidationFuel := 500, maxLoweringFuel := 500 } }
+
+inductive Expected where
+  | scalar (number : Nat) (selected : Bool)
+  | usageFreeze
+  | externRejected
+  deriving BEq, Repr
+
+structure Source where
+  name : String
+  constants : List (Address × Constant)
+  root : Address
+  literals : List Nat
+  natBlock : Option Address := none
+  policy : Policy := sourcePolicy
+  expected : Expected
+
+def Source.config (source : Source) : Pipeline.Config :=
+  { blobs := fun address =>
+      (source.literals.find? fun number =>
+        address == X86.ValidatedScalar.literalAddress number).map .natB
+    natBlock := source.natBlock
+    limits := source.policy.limits }
+
+abbrev Source.Attached (source : Source) :=
+  IxIR2.Pipeline.Attached source.constants source.root source.config .shared
+    source.policy.eraseFuel source.policy.lowerFuel
+
+def Source.compile (source : Source) : Except IxIR2.Pipeline.Error source.Attached :=
+  IxIR2.Pipeline.compileValidated source.constants source.root source.config .shared
+    source.policy.checkFuel source.policy.eraseFuel source.policy.validateFuel
+    source.policy.lowerFuel source.policy.maxDepth
+
+/-- Canonicalize the synthetic expression table before crossing the ordinary
+bounded semantic address gate. Production contact bytes never use this helper. -/
+def addressed (constant : Constant) : Except String (Address × Constant) := do
+  let some compressed := Sharing.compress? (Sharing.inlineBodies constant)
+    | throw "synthetic source compression failed"
+  let some info := ConstantIdentityLaws.replaceInfoExprs? constant.info compressed.bodies.toList
+    | throw "synthetic source body restoration failed"
+  let canonical := { constant with info, sharing := compressed.table }
+  match canonical.addressChecked with
+  | .error error => throw s!"synthetic source address rejected: {repr error}"
+  | .ok address => return (address, canonical)
+
+private def definition (value : Expr) (refs : Array Address := #[])
+    (typ : Expr := .sort 0) : Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def ghost (value : Expr) : Expr :=
+  .app (.lam .erased (.sort 0) value) (.sort 0)
+
+private def projection (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def natInductive : Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+        typ := .recur 0 #[] },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .all .many .shared (.recur 0 #[]) (.recur 0 #[]) }] }
+
+/-- A two-way recursor returns 11 for zero and 22 for successor. Its field
+is intentionally unused; both alternatives must still execute through the
+checked constructor/Nat dispatch path. -/
+private def tagRecursor : Recursor :=
+  { k := false, isUnsafe := false, lvls := 0
+    params := 0, indices := 0, motives := 0, minors := 0
+    typ := .all .many .shared (.recur 0 #[]) (.sort 0)
+    rules := #[
+      { fields := 0, rhs := .nat 0 },
+      { fields := 1, rhs := .lam .many (.recur 0 #[]) (.nat 1) }] }
+
+def scalar (name : String) (number : Nat) (selected : Bool) : Except String Source := do
+  let entry ← addressed (X86.ValidatedScalar.constant number)
+  return {
+    name, constants := [entry], root := entry.1, literals := [number]
+    policy := { limits := (X86.ValidatedScalar.config number).limits
+                checkFuel := 100, eraseFuel := 100, validateFuel := 100
+                lowerFuel := 100, maxDepth := 100 }
+    expected := .scalar number selected }
+
+/-- Two uses of a known identity force an ordinary direct call followed by a
+tail call. Its Nat argument is computed through the shared PAP path. -/
+def directCall : Except String Source := do
+  let block ← addressed
+    { info := .muts #[.indc natInductive], sharing := #[], refs := #[], univs := #[.zero] }
+  let natType ← addressed (projection (.iPrj { idx := 0, block := block.1 }))
+  let worker ← addressed (definition (.lam .many (.ref 0 #[]) (.var 0))
+    #[natType.1] (.all .many .shared (.ref 0 #[]) (.ref 0 #[])))
+  let entry ← addressed (definition
+    (.app (.ref 0 #[]) (.app (.ref 0 #[]) (ghost (.nat 1))))
+    #[worker.1, X86.ValidatedScalar.literalAddress 42, natType.1] (.ref 2 #[]))
+  return {
+    name := "direct-call", constants := [block, natType, worker, entry]
+    root := entry.1, literals := [42], expected := .scalar 42 false }
+
+def dispatch (literal successorCase : Bool) : Except String Source := do
+  let block ← addressed
+    { info := .muts #[.indc natInductive, .recr tagRecursor]
+      sharing := #[]
+      refs := #[X86.ValidatedScalar.literalAddress 11, X86.ValidatedScalar.literalAddress 22]
+      univs := #[.zero] }
+  let recursor ← addressed (projection (.rPrj { idx := 1, block := block.1 }))
+  let zero ← addressed (projection (.cPrj { idx := 0, cidx := 0, block := block.1 }))
+  let successor ← addressed (projection (.cPrj { idx := 0, cidx := 1, block := block.1 }))
+  let number := if successorCase then 3 else 0
+  let major := if literal then ghost (.nat 1)
+    else if successorCase then .app (.ref 3 #[]) (ghost (.nat 1))
+    else ghost (.ref 2 #[])
+  let entry ← addressed (definition (.app (.ref 0 #[]) major)
+    #[recursor.1, X86.ValidatedScalar.literalAddress number, zero.1, successor.1])
+  return {
+    name := s!"{if literal then "nat" else "ctor"}-{if successorCase then "succ" else "zero"}"
+    constants := [block, recursor, zero, successor, entry], root := entry.1
+    literals := [number, 11, 22], natBlock := if literal then some block.1 else none
+    expected := .scalar (if successorCase then 22 else 11) false }
+
+def bareLiteral : Except String Source := do
+  let entry ← addressed (X86.ValidatedScalar.constant 42 false)
+  return { name := "bare-literal", constants := [entry], root := entry.1
+           literals := [42], expected := .usageFreeze }
+
+def externSource : Except String Source := do
+  let entry ← addressed
+    { info := .axio { isUnsafe := false, lvls := 0, typ := .sort 0 }
+      sharing := #[], refs := #[], univs := #[.zero] }
+  return { name := "extern", constants := [entry], root := entry.1
+           literals := [], expected := .externRejected }
+
+def sources : Except String (List Source) := do
+  return [← scalar "scalar-zero" 0 true, ← scalar "scalar-42" 42 true,
+    ← scalar "scalar-max" (UInt64.size - 1) true,
+    ← scalar "scalar-overflow" UInt64.size false,
+    ← directCall, ← dispatch false false, ← dispatch false true,
+    ← dispatch true false, ← dispatch true true, ← bareLiteral, ← externSource]
+
+end Ix.Compiler.Coverage
diff --git a/Ix/Compiler/Coverage/StdContact.lean b/Ix/Compiler/Coverage/StdContact.lean
new file mode 100644
index 000000000..ae790e013
--- /dev/null
+++ b/Ix/Compiler/Coverage/StdContact.lean
@@ -0,0 +1,136 @@
+import Ix.Compiler.Ixon.Catalog
+import Ix.Compiler.Pipeline
+
+/-! Shared byte-exact production-writer fixture data for runtime tests and the
+source-coverage gate. Loading never rewrites or reencodes the captured input. -/
+
+open Ix.Compiler.Ixon
+
+namespace CatalogContactFixture
+
+def directory : String := "Tests/Fixtures/Compiler/ixon-std-contact"
+
+def isWhitespace (c : Char) : Bool :=
+  c == ' ' || c == '\n' || c == '\r' || c == '\t'
+
+def hexNibble? (c : Char) : Option UInt8 :=
+  if '0' ≤ c && c ≤ '9' then some (c.toNat - '0'.toNat).toUInt8
+  else if 'a' ≤ c && c ≤ 'f' then some (c.toNat - 'a'.toNat + 10).toUInt8
+  else if 'A' ≤ c && c ≤ 'F' then some (c.toNat - 'A'.toNat + 10).toUInt8
+  else none
+
+def decodeHex (text : String) : Except String ByteArray := do
+  let digits := (text.toList.filter fun c => !isWhitespace c).toArray
+  if digits.size % 2 != 0 then
+    throw s!"odd hex digit count {digits.size}"
+  let mut bytes := ByteArray.empty
+  for index in [:digits.size / 2] do
+    let some high := hexNibble? digits[2 * index]!
+      | throw s!"invalid hex digit at {2 * index}"
+    let some low := hexNibble? digits[2 * index + 1]!
+      | throw s!"invalid hex digit at {2 * index + 1}"
+    bytes := bytes.push (high * 16 + low)
+  return bytes
+
+def readHexAt (root : System.FilePath) (filename : String) : IO (Except String ByteArray) := do
+  try
+    let path := root / filename
+    if (← path.metadata).byteSize > 65536 then
+      return .error s!"contact hex file exceeds the 64 KiB fixture limit: {filename}"
+    return decodeHex (← IO.FS.readFile path)
+  catch error =>
+    return .error error.toString
+
+def readHex (filename : String) : IO (Except String ByteArray) :=
+  readHexAt directory filename
+
+def expectedStats : Catalog.Stats :=
+  { manifestBytes := 267
+    members := 1
+    dependencyEdges := 0
+    storageUnits := 1
+    pieceBytes := 14600
+    constantEntries := 54
+    constantBytes := 8828
+    blobEntries := 91
+    blobBytes := 819
+    assumptions := 0
+    hints := 30
+    expressionUnits := 2143
+    expandedExpressionUnits := 3877
+    layer1NodeVisits := 34656
+    unionConstants := 54 }
+
+def expectedMembersRoot : String :=
+  "4585514401609ffa79ea09af28a0e1eb87be6b3306fe357511bc59323e18e18e"
+
+def expectedContentRoot : String :=
+  "1bc7e2215a1967d8c937f48526facdc7006cd4c9b7b6ef4f1063bb55c50dee02"
+
+def expectedPieceHash : String :=
+  "688985515005111bde0e25969181c649ada8b77d70287a71e18751f36b495988"
+
+def expectedPipelineAddress : String :=
+  "131533e96baa7f50ba89d01892243e11a1221c8831e2f394eb14f89e9a54c6c4"
+
+/-- C2 admits the original closed failure slice. The unchanged full catalog
+then encounters this later unique-to-shared sink. -/
+def expectedRemainingFreezeAddress : String :=
+  "a3b83ad0799bcd3d1c70c01df44141d79e7358e1f23d7d7e5cf9e01dbdc73c85"
+
+def load (root : System.FilePath) : IO (Except String Catalog.Loaded) := do
+  let manifest ← readHexAt root "manifest.hex"
+  let piece ← readHexAt root "CompilatrixStdContact.ixe.hex"
+  return do
+    let manifest ← manifest
+    let piece ← piece
+    if manifest.size != 267 || piece.size != 14600 ||
+        (Address.blake3 piece).toHex != expectedPieceHash then
+      throw "production contact byte sizes or hash drifted"
+    let loaded ← (Catalog.load manifest #[piece]).mapError (fun error => reprStr error)
+    if loaded.manifest.membersRoot.toHex != expectedMembersRoot ||
+        loaded.manifest.contentRoot.toHex != expectedContentRoot ||
+        loaded.stats != expectedStats then
+      throw "production contact commitments or counters drifted"
+    let some member := loaded.manifest.members[0]? | throw "production contact member is absent"
+    if member.label != "CompilatrixStdContact" || member.toolchain != "leanprover/lean4:v4.33.1" ||
+        member.sourcePin != "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4" ||
+        member.constCount != 54 then
+      throw "production contact provenance drifted"
+    return loaded
+
+/-- The dependency closure uses all reference-table entries and projection
+block keys. Blob references remain in the loaded catalog; no constant bytes
+or references are edited while shrinking the compilation unit. -/
+def dependencies (constant : Constant) : List Address :=
+  constant.refs.toList ++ match constant.info with
+    | .iPrj projection => [projection.block]
+    | .cPrj projection => [projection.block]
+    | .rPrj projection => [projection.block]
+    | .dPrj projection => [projection.block]
+    | _ => []
+
+def dependencyClosure (constants : List (Address × Constant)) (root : Address) :
+    List (Address × Constant) := Id.run do
+  let available := constants.map (·.1)
+  let mut reachable := [root]
+  for _ in [:constants.length] do
+    for entry in constants do
+      if reachable.contains entry.1 then
+        for address in dependencies entry.2 do
+          if available.contains address && !reachable.contains address then
+            reachable := reachable ++ [address]
+  return constants.filter fun entry => reachable.contains entry.1
+
+def isClosed (available subset : List (Address × Constant)) : Bool :=
+  let allKeys := available.map (·.1)
+  let subsetKeys := subset.map (·.1)
+  subset.all fun entry => (dependencies entry.2).all fun address =>
+    !allKeys.contains address || subsetKeys.contains address
+
+def freezesAt (constants : List (Address × Constant)) (root : Address) : Bool :=
+  match Ix.Compiler.Pipeline.checkProgram constants with
+  | .error (.usage rejected .freezeNeeded) => rejected == root
+  | _ => false
+
+end CatalogContactFixture
diff --git a/Ix/Compiler/Coverage/Upstream.lean b/Ix/Compiler/Coverage/Upstream.lean
new file mode 100644
index 000000000..417eb01ee
--- /dev/null
+++ b/Ix/Compiler/Coverage/Upstream.lean
@@ -0,0 +1,289 @@
+import Ix.Compiler.Coverage.Run
+import Ix.Compiler.Coverage.HeapSnapshot
+import Ix.Compiler.Coverage.StdContact
+
+/-! Byte-exact exports from the pinned upstream Lean-to-Ixon writer. Every
+positive case enters the public checked pipeline with its complete original
+constant closure. The observations follow constructor identities through both
+address maps and reclaim the actual returned heaps. -/
+
+namespace Ix.Compiler.Coverage.Upstream
+
+open Lean Ix.Compiler.Ixon
+
+def directory : String := "Tests/Fixtures/Compiler/ixon-upstream"
+
+def writerPin : String := "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4"
+
+inductive Expected where
+  | nat (number : Nat)
+  | missingCovered (address : String)
+
+structure Fixture where
+  name : String
+  pieceBytes : Nat
+  pieceHash : String
+  root : String
+  count : Nat
+  expected : Expected
+
+def fixtures : List Fixture := [
+  ⟨"applyClosed", 662, "2e4873546afd7558d5c02b244d2713229c02f6f684c298739f0b7431e7b8df02",
+    "b81b754f02c1b63279a609ab4b55b609fd6f87fab7b14879f4021c3327c2eb40", 6, .nat 3⟩,
+  ⟨"captureClosed", 666, "280ab6f15706a3c0ed76511604abd5653a524dba4b5893b193c904db2f66f852",
+    "5628cfe1b4f959fb116661fc50ae8e9e4bfa470ac5d0e639a75b9d23aed12953", 6, .nat 2⟩,
+  ⟨"letClosed", 670, "717c04ee467799465d08c0e624f312fe619badbe7394c7fa0637f1b0c975744b",
+    "6c737171f1a3c482ba96cbe4998ea660fda824c578fe668ab9fdc4aae1b9754f", 6, .nat 4⟩,
+  ⟨"addClosed", 3072, "ce2cc4e16ffbe9166b9be201c524cbc7530705fdc5b8ff7602627aba70f5f4d0",
+    "799b7939dcc3c158620a49e645c9fee367674251e5298594bf8801747e49f990", 19,
+    .missingCovered "1ce12e12485a4793aa5baf4f197f5d5ceb5fb8e166f1a06640b87f9c91dad725"⟩,
+  ⟨"recClosed", 796, "4c0c64ad2997001a63b5d6a70475f656cd27eb8dd30ba8c3acb8bd87564b3f49",
+    "1248f5d1b9eb3c50a6818d4d6d1e2413a7e9587e0990de2421e997d756da7aa1", 6,
+    .missingCovered "1248f5d1b9eb3c50a6818d4d6d1e2413a7e9587e0990de2421e997d756da7aa1"⟩]
+
+def policy : Policy :=
+  { sourcePolicy with
+    limits := { sourcePolicy.limits with
+      maxConstants := 32, maxExpressionUnits := 4096, maxExpandedExpressionUnits := 8192
+      maxLayer1NodeVisits := 262144, maxErasedDeclarations := 256
+      maxErasureAppendCells := 16384, maxCertificateCandidates := 64
+      maxCertificateSourceNodeWork := 2097152 }
+    evalFuel := 10000, controlFuel := 10000, heapFuel := 10000 }
+
+structure Input where
+  source : Source
+  snapshot : Json
+  provenance : Json
+  expected : Expected
+
+def load (path : System.FilePath) (fixture : Fixture) : IO (Except String Input) := do
+  let manifest ← CatalogContactFixture.readHexAt path s!"{fixture.name}.manifest.hex"
+  let piece ← CatalogContactFixture.readHexAt path s!"{fixture.name}.ixe.hex"
+  if (← (path / "CompilatrixUpstream.lean").metadata).byteSize > 4096 then
+    return .error "upstream source module exceeds the 4 KiB fixture limit"
+  let moduleBytes ← IO.FS.readBinFile (path / "CompilatrixUpstream.lean")
+  return do
+    let manifest ← manifest
+    let piece ← piece
+    if piece.size != fixture.pieceBytes || (Address.blake3 piece).toHex != fixture.pieceHash then
+      throw "upstream original piece bytes drifted"
+    let loaded ← (Catalog.load manifest #[piece]).mapError (fun error => reprStr error)
+    let some member := loaded.manifest.members[0]? | throw "upstream member missing"
+    let some stored := loaded.pieces[0]? | throw "upstream piece missing"
+    let some root := stored.main | throw "upstream MAIN missing"
+    if member.label != s!"CompilatrixUpstream.{fixture.name}" ||
+        member.toolchain != "leanprover/lean4:v4.33.1" || member.sourcePin != writerPin ||
+        root.toHex != fixture.root || loaded.constants.length != fixture.count ||
+        !stored.assumptions.isEmpty || loaded.manifest.members.size != 1 then
+      throw "upstream provenance, root, or complete closure drifted"
+    if CatalogContactFixture.dependencyClosure loaded.constants root != loaded.constants then
+      throw "upstream pack is not the exact reachable dependency closure"
+    let constants ← stored.constants.toList.mapM fun record => do
+      if ser record.constant != record.bytes then throw "upstream constant bytes changed after decoding"
+      return Json.mkObj [("key", toJson record.address), ("bytes", byteJson record.bytes)]
+    let provenance := Json.mkObj [
+      ("members_root", toJson loaded.manifest.membersRoot),
+      ("content_root", toJson loaded.manifest.contentRoot), ("piece_hash", toJson fixture.pieceHash),
+      ("toolchain", toJson member.toolchain), ("source_pin", toJson member.sourcePin),
+      ("source_module_hash", toJson (Address.blake3 moduleBytes)),
+      ("source_module", byteJson moduleBytes)]
+    let source : Source :=
+      { name := s!"upstream-{fixture.name}", constants := loaded.constants
+        root, literals := [], policy, expected := .scalar 0 false }
+    return {
+      source, provenance, expected := fixture.expected
+      snapshot := Json.mkObj [
+        ("root", toJson root), ("constants", toJson constants),
+        ("manifest_bytes", byteJson manifest), ("piece_bytes", byteJson piece),
+        ("blob_inputs", toJson (loaded.blobs.map fun (address, bytes) =>
+          Json.mkObj [("key", toJson address), ("bytes", byteJson bytes)])),
+        ("policy", toJson policy), ("provenance", provenance)] }
+
+structure NatIds where
+  block : Address
+  zero : Address
+  succ : Address
+
+def natIds (source : Source) : Except String NatIds := do
+  let some zero := source.constants.find? (fun (_, constant) => match constant.info with
+    | .cPrj projection => projection.idx == 0 && projection.cidx == 0
+    | _ => false)
+    | throw "missing upstream Nat.zero"
+  let some succ := source.constants.find? (fun (_, constant) => match constant.info with
+    | .cPrj projection => projection.idx == 0 && projection.cidx == 1
+    | _ => false)
+    | throw "missing upstream Nat.succ"
+  let .cPrj zeroInfo := zero.2.info | throw "Nat.zero projection changed"
+  let .cPrj succInfo := succ.2.info | throw "Nat.succ projection changed"
+  if zeroInfo.block != succInfo.block then throw "upstream Nat constructor blocks disagree"
+  return { block := zeroInfo.block, zero := zero.1, succ := succ.1 }
+
+private def sourceNat? (ids : NatIds) : Nat → Ixon.Eval.Value → Option Nat
+  | 0, _ => none
+  | fuel + 1, .ctorV block 0 tag fields =>
+    if block != ids.block then none else
+      match tag, fields with
+      | 0, [] => some 0
+      | 1, [tail] => (· + 1) <$> sourceNat? ids fuel tail
+      | _, _ => none
+  | _, _ => none
+
+private def nat0? (zero succ : Address) : Nat → IxIR0.Value → Option Nat
+  | 0, _ => none
+  | fuel + 1, .ctor address tag fields =>
+    if address == zero && tag == 0 && fields.isEmpty then some 0
+    else if address == succ && tag == 1 then
+      match fields with
+      | [tail] => (· + 1) <$> nat0? zero succ fuel tail
+      | _ => none
+    else none
+  | _, _ => none
+
+private def nat1? (zero succ : Address) : Nat → IxIR1.Store → IxIR1.RVal → Option Nat
+  | 0, _, _ => none
+  | fuel + 1, store, .loc location => do
+    let box ← store.get? location
+    if box.world != .shared then none else do
+      let .ctorN identity fields := box.node | none
+      if identity == IxIR1.Lower.ctorIdOf zero 0 && fields.isEmpty then some 0
+      else if identity == IxIR1.Lower.ctorIdOf succ 1 then
+        match fields.toList with
+        | [tail] => (· + 1) <$> nat1? zero succ fuel store tail
+        | _ => none
+      else none
+  | _, _, _ => none
+
+private def agree (stage : String) (expected : Nat) (actual : Option Nat) : Except String Unit :=
+  if actual == some expected then .ok ()
+  else .error s!"{stage}: expected Nat {expected}, observed {repr actual}"
+
+private def counters (store : IxIR1.Store) : Json :=
+  Json.mkObj [("allocs", toJson store.allocs), ("frees", toJson store.frees),
+    ("rcops", toJson store.rcops), ("live", toJson store.live), ("reuses", toJson store.reuses)]
+
+def observe (source : Source) (attached : source.Attached) (number : Nat) :
+    Except String Observation := do
+  let ids ← natIds source
+  let value ← (Ixon.Eval.eval (Pipeline.validatedEvalCtx source.constants source.config)
+    policy.evalFuel (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError
+      (fun error => s!"Ixon: {repr error}")
+  agree "Ixon" number (sourceNat? ids policy.evalFuel value)
+  let artifact := attached.source.artifact
+  let rename0 := IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap
+  let rename1 := IxIR1.Readdress.Renaming.apply artifact.targetAddressMap
+  let mut stages := [("ixon", toJson number)]
+  for (stage, declarations, main, zero, succ) in [
+      ("raw_ixir0", artifact.rawErasedDecls, IxIR0.Expr.ref source.root, ids.zero, ids.succ),
+      ("ixir0", artifact.erasedDecls, attached.source.erasure.result.main, rename0 ids.zero, rename0 ids.succ)] do
+    let value ← (IxIR0.eval { env := IxIR0.Env.ofList declarations } policy.evalFuel [] main).mapError
+      (fun error => s!"{stage}: {repr error}")
+    agree stage number (nat0? zero succ policy.evalFuel value)
+    stages := stages ++ [(stage, toJson number)]
+  let mut stores : List IxIR1.Store := []
+  let mut released : List IxIR1.Store := []
+  for (stage, declarations, main, zero, succ) in [
+      ("raw_ixir1", attached.source.lowering.raw, attached.source.lowering.mainCode,
+        rename0 ids.zero, rename0 ids.succ),
+      ("ixir1", artifact.targetDecls, artifact.main, rename1 (rename0 ids.zero), rename1 (rename0 ids.succ))] do
+    let context : IxIR1.Ctx := { decls := IxIR1.Env.ofList declarations }
+    let (store, value) ← (IxIR1.runOwnedMain context .shared main policy.evalFuel).mapError
+      (fun error => s!"{stage}: {repr error}")
+    agree stage number (nat1? zero succ policy.evalFuel store value)
+    let reclaimed ← (IxIR1.dropVal context policy.heapFuel store value).mapError
+      (fun error => s!"{stage} reclamation: {repr error}")
+    stores := stores ++ [store]
+    released := released ++ [reclaimed]
+    stages := stages ++ [(stage, Json.mkObj [("nat", toJson number),
+      ("value", toJson value), ("store", toJson store), ("reclaimed", toJson reclaimed)])]
+  let program := attached.target.artifact.program
+  let context := IxIR2.Eval.Context.ofProgram program attached.target.artifact.validationContext.schemas
+  let mut physicalStores : List Json := []
+  let mut summary := Json.null
+  for (stage, mode) in [("logical_ixir2", IxIR2.Eval.Interpretation.logical), ("physical_ixir2", .physical)] do
+    let result ← (IxIR2.Eval.runMain context mode program policy.controlFuel policy.heapFuel).mapError
+      (fun error => s!"{stage}: {repr error}")
+    agree stage number (nat1? (rename1 (rename0 ids.zero)) (rename1 (rename0 ids.succ))
+      policy.evalFuel result.store.heap result.value)
+    let (reclaimed, remaining) ← (IxIR2.Eval.releaseShared policy.heapFuel result.store result.value).mapError
+      (fun error => s!"{stage} reclamation: {repr error}")
+    stores := stores ++ [result.store.heap]
+    released := released ++ [reclaimed.heap]
+    let stageObservation := Json.mkObj [("nat", toJson number), ("value", toJson result.value),
+      ("store", toJson result.store), ("reclaimed", toJson reclaimed),
+      ("control_remaining", toJson result.controlRemaining), ("heap_remaining", toJson result.heapRemaining),
+      ("reclamation_remaining", toJson remaining)]
+    physicalStores := physicalStores ++ [stageObservation]
+    stages := stages ++ [(stage, stageObservation)]
+    summary := Json.mkObj [("nat", toJson number), ("heap", counters result.store.heap),
+      ("reclaimed", counters reclaimed.heap), ("peak_live_nodes", toJson result.store.peakLiveNodes),
+      ("control_steps", toJson (policy.controlFuel - result.controlRemaining)),
+      ("heap_work", toJson (policy.heapFuel - result.heapRemaining))]
+  if stores.any (fun store => store.allocs != store.frees + store.live) ||
+      released.any (fun store => store.live != 0 || store.allocs != store.frees) ||
+      (stores.map counters).any (· != (stores.map counters).head!) ||
+      (released.map counters).any (· != (released.map counters).head!) ||
+      physicalStores[0]? != physicalStores[1]? then
+    throw "upstream stage counters, complete baseline stores, budgets, or reclamation disagree"
+  return { summary, stages := Json.mkObj stages }
+
+def result (input : Input) (stage : String) (failure observation : Json)
+    (compiled : Option input.source.Attached := none) (stages : Json := Json.null)
+    (partialCompilation : Json := Json.null) (native : Json := Json.null)
+    (object : Option ByteArray := none) : CaseResult :=
+  let source := input.source
+  { name := source.name
+    row := Json.mkObj [
+      ("name", toJson source.name), ("origin", toJson "upstream-lean"), ("root_kind", toJson "constant"),
+      ("root", toJson source.root), ("source_constants", toJson source.constants.length),
+      ("last_accepted_stage", toJson stage), ("rejection", failure), ("observation", observation),
+      ("optimization_policy", toJson (if object.isSome then "baseline-ixir2; " ++
+        (native.getObjValAs? String "selector").toOption.getD "unknown" else "baseline-only")),
+      ("provenance", input.provenance),
+      ("ir1_root", match compiled with
+        | none => Json.null
+        | some attached => toJson (IxIR1.Optimizer.graphRoot
+            attached.source.artifact.targetArtifacts attached.source.artifact.main)),
+      ("hpt_roots", match compiled with | none => Json.null | some attached => toJson attached.hpt.result.addresses),
+      ("features", match compiled with | none => Json.null | some attached => toJson (features attached.target.artifact.program)),
+      ("snapshot", toJson s!"{source.name}.json"),
+      ("object", if object.isSome then toJson s!"{source.name}.o" else Json.null)]
+    snapshot := Json.mkObj ([("format", toJson "compilatrix/source-case/1"), ("input", input.snapshot),
+      ("compilation", match compiled with | none => partialCompilation | some attached => source.compilationSnapshot attached),
+      ("observations", if compiled.isSome then stages else failure)] ++
+      (if native == Json.null then [] else [("native", native)]))
+    object }
+
+def run (input : Input) : Except String CaseResult := do
+  let source := input.source
+  match source.compile, input.expected with
+  | .ok attached, .nat number =>
+    let observation ← observe source attached number
+    let code ← match X86.Select.select attached.target.artifact.program with
+      | .error .unsupportedScalarShape => pure "unsupportedScalarShape"
+      | .error (.invalidSource (.invalid _ .schema "missing constructor schema")) =>
+        pure "missingConstructorSchema"
+      | .error error => throw s!"upstream native selection diagnostic drifted: {repr error}"
+      | .ok _ => throw "upstream constructor graph unexpectedly passed scalar selection"
+    let failure := Json.mkObj [("stage", toJson "x86-selection"), ("code", toJson code),
+      ("root", toJson source.root), ("message", Json.null)]
+    return result input "ixir2" failure observation.summary (some attached) observation.stages
+  | .error (.pipeline (.validate address message)), .missingCovered expectedAddress =>
+    if address.toHex != expectedAddress || message != "reference lacks a Covered certificate" then
+      throw "upstream Covered diagnostic drifted"
+    let partialCompilation ← addressedSnapshot source.constants source.root source.config source.policy.eraseFuel
+    return result input "addressed-ixir0" (Json.mkObj [
+      ("stage", toJson "validated-erasure"), ("code", toJson "missingCovered"),
+      ("root", toJson address), ("message", toJson message)]) Json.null
+      (partialCompilation := partialCompilation)
+  | .error error, _ => throw s!"unexpected upstream compilation error: {repr error}"
+  | .ok _, _ => throw "upstream negative case unexpectedly compiled"
+
+def cases (path : System.FilePath := directory) : IO (Except String (List CaseResult)) := do
+  let mut results := []
+  for fixture in fixtures do
+    match (← load path fixture).bind run with
+    | .error message => return .error s!"{fixture.name}: {message}"
+    | .ok result => results := results ++ [result]
+  return .ok results
+
+end Ix.Compiler.Coverage.Upstream
diff --git a/Ix/Compiler/Coverage/UpstreamNative.lean b/Ix/Compiler/Coverage/UpstreamNative.lean
new file mode 100644
index 000000000..f481d3f64
--- /dev/null
+++ b/Ix/Compiler/Coverage/UpstreamNative.lean
@@ -0,0 +1,147 @@
+import Ix.Compiler.Coverage.Upstream
+import Ix.Compiler.X86.NatCallsSim
+
+namespace Ix.Compiler.Coverage.UpstreamNative
+open Lean Ix.Compiler.X86 Ix.Compiler.X86.NatCalls
+
+def policy : String := "upstream-closed-nat/2"
+
+def schema (source : Source) (attached : source.Attached) : Except String NatCalls.Schema := do
+  let ids ← Upstream.natIds source
+  let rename0 := IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap
+  let rename1 := IxIR1.Readdress.Renaming.apply attached.source.artifact.targetAddressMap
+  return {
+    zero := IxIR1.Lower.ctorIdOf (rename1 (rename0 ids.zero)) 0
+    succ := IxIR1.Lower.ctorIdOf (rename1 (rename0 ids.succ)) 1 }
+
+def expressionJson : NatCalls.Expr → Json
+  | .argument => Json.mkObj [("op", toJson "argument")]
+  | .constant value => Json.mkObj [("op", toJson "constant"), ("value", toJson value.toNat)]
+  | .successor value => Json.mkObj [("op", toJson "successor"), ("value", expressionJson value)]
+  | .call function value => Json.mkObj [("op", toJson "call"), ("function", toJson function), ("value", expressionJson value)]
+
+def parameterJson : NatCalls.Param → Json
+  | .nat => Json.mkObj [("kind", toJson "nat")]
+  | .closure address none => Json.mkObj [("kind", toJson "known-capture-free-pap"), ("function", toJson address)]
+  | .closure address (some expression) => Json.mkObj [("kind", toJson "known-static-capture-pap"),
+      ("function", toJson address), ("capture", expressionJson expression)]
+  | .staticNat expression => Json.mkObj [("kind", toJson "static-nat"), ("value", expressionJson expression)]
+  | .erased => Json.mkObj [("kind", toJson "erased")]
+
+def residualJson (residual : NatCalls.Residual) : Json :=
+  Json.mkObj [("entry", toJson residual.entry), ("functions", toJson (residual.functions.map fun function =>
+    Json.mkObj [("origin", toJson function.origin), ("parameters", toJson (function.parameters.map parameterJson)),
+      ("body", expressionJson function.body)]))]
+
+/-- A finite readable stack, with writes confined below the caller's return
+slot. Distinct saved registers and nonzero initial bytes expose frame errors. -/
+def core (stack : Word) (seed : Word) (capacity : Word := 64) : Core :=
+  let registers := fun register => seed + (SysV.calleeSaved.toList.idxOf register + 1).toUInt64 * 0x102030405060708
+  let memory : Memory := {
+    bytes := fun address => (address ^^^ seed).toUInt8
+    readable := fun address => decide (stack - capacity ≤ address && address < stack + 8)
+    writable := fun address => decide (stack - capacity ≤ address && address < stack) }
+  { registers := Registers.set registers .rsp stack, memory := memory.write64 stack 0x12345678 }
+
+def executionJson {source context schema} (object : NatCalls.Object source context schema)
+    (stack seed base : Word) : Except String Json := do
+  let initial := core stack seed
+  let execution ← certifyExecution object initial 100
+  let mut machine := Machine.initial object.selected.target initial
+  let mut steps := 0
+  let mut calls := 0
+  let mut minimum := stack
+  for _ in [:100] do
+    if machine.status != .running then break
+    if let some block := object.selected.target.program.blocks[machine.pc.block.toNat]? then
+      if let some (.call _) := block.instructions[machine.pc.offset.toNat]? then calls := calls + 1
+    machine := X86.step Runtime.rejecting object.selected.target machine
+    minimum := min minimum (machine.core.readReg .rsp)
+    steps := steps + 1
+  let final ← (ObjectEval.run object.object.bytes object.input.exportName base steps initial).mapError reprStr
+  if final.rip != execution.returnAddress || final.core.readReg .rax != object.selected.word ||
+      final.core.readReg .rsp != stack + 8 ||
+      !final.core.calleeSavedMatch initial.calleeSavedSnapshot then
+    throw "actual object-byte execution disagrees with typed execution"
+  return Json.mkObj [("stack", toJson stack.toNat), ("seed", toJson seed.toNat), ("text_base", toJson base.toNat),
+    ("value", toJson (final.core.readReg .rax).toNat), ("return_address", toJson final.rip.toNat),
+    ("typed_steps", toJson steps), ("byte_steps", toJson steps), ("direct_calls", toJson calls),
+    ("stack_written_bytes", toJson (stack - minimum).toNat), ("stack_capacity_bytes", toJson (64 : Nat)),
+    ("saved_registers_preserved", toJson true), ("stack_restored_before_ret", toJson true),
+    ("call_trace_certified", toJson true), ("object_entry_certified", toJson true)]
+
+def snapshot {source context schema} (object : NatCalls.Object source context schema) : Except String Json := do
+  let mut executions := #[]
+  for (stack, seed, base) in [(0x4008, 0xabcdef01, 0x100000), (0x8008, 0x12345678, 0x400000),
+      (0x100000008, 0xffffffffffffffff, 0x100000000), (0x7fffffffe008, 0x1020304050607080, 0x7fff00000000)] do
+    executions := executions.push (← executionJson object stack seed base)
+  let selected := object.selected
+  let mut fallback := #[]
+  for (name, limits) in [("zero-depth", { depth := 0 : NatCalls.Limits }),
+      ("zero-functions", { functions := 0 : NatCalls.Limits }),
+      ("zero-instructions", { instructions := 0 : NatCalls.Limits })] do
+    match NatCalls.select source context schema limits selected.captureMode with
+    | .error (.lowering .budget) => fallback := fallback.push (Json.mkObj [
+        ("name", toJson name), ("reason", toJson "budget"), ("path", toJson "checked-baseline-ixir2")])
+    | _ => throw "native budget fallback changed"
+  if selected.captureMode == .staticNat then
+    match NatCalls.select source context schema { captureFuel := 0 } .staticNat with
+    | .error (.lowering .budget) => fallback := fallback.push (Json.mkObj [
+        ("name", toJson "zero-capture-fuel"), ("reason", toJson "budget"), ("path", toJson "checked-baseline-ixir2")])
+    | _ => throw "native capture budget fallback changed"
+    match NatCalls.select source context schema with
+    | .error (.lowering .capturedPap) => fallback := fallback.push (Json.mkObj [
+        ("name", toJson "capture-free-policy"), ("reason", toJson "capturedPap"), ("path", toJson "checked-baseline-ixir2")])
+    | _ => throw "capture-free policy boundary changed"
+  for (name, initial) in [("misaligned-stack", core 0x8000 1), ("insufficient-stack", core 0x8008 1 32)] do
+    match certifyExecution object initial 100 with
+    | .error _ => fallback := fallback.push (Json.mkObj [("name", toJson name),
+        ("reason", toJson "execution-condition"), ("path", toJson "no-native-execution-certificate")])
+    | .ok _ => throw "invalid native stack admitted"
+  return Json.mkObj [
+    ("format", toJson "compilatrix/upstream-native/1"), ("selector", toJson selected.captureMode.policy),
+    ("representation", toJson "closed shared unary Nat constructors to exact UInt64"),
+    ("runtime_arguments", toJson (0 : Nat)), ("schema", Json.mkObj [("zero", toJson schema.zero), ("succ", toJson schema.succ)]),
+    ("residual", residualJson selected.residual), ("typed_program_diagnostic", toJson (reprStr selected.target.program)),
+    ("value", toJson selected.number), ("word_exact", toJson true),
+    ("physical_store", toJson selected.physical.store), ("physical_value", toJson selected.physical.value),
+    ("reclaimed_store", toJson selected.reclaimed),
+    ("native_heap", Json.mkObj [("allocs", toJson (0 : Nat)), ("frees", toJson (0 : Nat)),
+      ("rcops", toJson (0 : Nat)), ("result_bytes", toJson (8 : Nat)), ("result_release", toJson "unboxed word; no heap root")]),
+    ("text", byteJson object.stream.output.text), ("text_bytes", toJson object.stream.output.text.size),
+    ("block_offsets", toJson (object.stream.output.blockOffsets.map id)),
+    ("symbol", toJson object.input.exportName), ("lowering_version", toJson selected.captureMode.loweringVersion.toNat), ("pass_policy_version", toJson (1 : Nat)),
+    ("object", byteJson object.object.bytes), ("object_bytes", toJson object.object.bytes.size),
+    ("object_identity", toJson (Ixon.Address.blake3 object.object.bytes)),
+    ("executions", Json.arr executions), ("fallbacks_and_rejections", Json.arr fallback)]
+
+def run (input : Upstream.Input) : Except String CaseResult := do
+  let source := input.source
+  match source.compile, input.expected with
+  | .ok attached, .nat number =>
+    let observed ← Upstream.observe source attached number
+    let schema ← schema source attached
+    let selected := match NatCalls.select attached.target.artifact.program attached.target.artifact.validationContext schema with
+      | .error (.lowering .capturedPap) => NatCalls.select attached.target.artifact.program attached.target.artifact.validationContext schema {} .staticNat
+      | result => result
+    match selected with
+    | .error error => throw s!"upstream computational native selection failed: {repr error}"
+    | .ok selected =>
+      if selected.number != number || !["upstream-applyClosed", "upstream-captureClosed", "upstream-letClosed"].contains source.name then
+        throw "upstream native accepted inventory or source value drifted"
+      let root := IxIR1.Optimizer.graphRoot attached.source.artifact.targetArtifacts attached.source.artifact.main
+      let object ← selected.emit root "compilatrix_main"
+      let native ← snapshot object
+      return Upstream.result input "elf" Json.null observed.summary (some attached) observed.stages
+        (native := native) (object := some object.object.bytes)
+  | _, _ => Upstream.run input
+
+def cases (path : System.FilePath := Upstream.directory) : IO (Except String (List CaseResult)) := do
+  let mut results := []
+  for fixture in Upstream.fixtures do
+    match (← Upstream.load path fixture).bind run with
+    | .error message => return .error s!"{fixture.name}: {message}"
+    | .ok result => results := results ++ [result]
+  return .ok results
+
+end Ix.Compiler.Coverage.UpstreamNative
diff --git a/Ix/Compiler/DurableSync.lean b/Ix/Compiler/DurableSync.lean
new file mode 100644
index 000000000..c01edc3e1
--- /dev/null
+++ b/Ix/Compiler/DurableSync.lean
@@ -0,0 +1,23 @@
+/-!
+# Narrow durable-filesystem boundary
+
+Lean's portable `IO.FS.Handle.flush` empties the runtime buffer but does not
+request stable storage. These two operations are the intentionally small native
+boundary used by the persistent HPT cache around its atomic rename.
+
+Both functions reject a path of the wrong kind. Their filesystem and hardware
+semantics remain assumptions recorded in the trusted-extern ledger; they do
+not participate in any logical theorem or bless cache bytes as valid.
+-/
+
+namespace Ix.Compiler.DurableSync
+
+/-- Request stable storage for one regular file. -/
+@[extern "compilatrix_durable_sync_file"]
+opaque file (path : @& System.FilePath) : IO Unit
+
+/-- Request stable storage for one directory's entries. -/
+@[extern "compilatrix_durable_sync_directory"]
+opaque directory (path : @& System.FilePath) : IO Unit
+
+end Ix.Compiler.DurableSync
diff --git a/Ix/Compiler/Erase.lean b/Ix/Compiler/Erase.lean
new file mode 100644
index 000000000..ea2798bd7
--- /dev/null
+++ b/Ix/Compiler/Erase.lean
@@ -0,0 +1,930 @@
+import Ix.Compiler.Ixon.Eval
+import Ix.Compiler.IxIR0.Eval
+
+/-!
+# The erasure pass: Ixon → IxIR₀
+
+The middle of the certification spine. Executable, total (fueled),
+and **arity-preserving**: erased binders keep their lambda (and their
+argument slot), but
+
+- arguments in erased **positions** are replaced by the unevaluated
+  `◻` literal — dropping their *evaluation* is the semantic content
+  of erasure (gate A);
+- occurrences of dropped binders erase to `◻` (never to a variable
+  read — dropped slots are dead by construction);
+- types (`sort`, `all`) erase to `◻` wholesale;
+- recursor **index** arguments and constructor **param** arguments
+  are removed from spines outright — the two deliberate arity
+  changes. Constructor values carry kept fields only (the IxIR₀
+  object-model contract); complete visible indexed recursor spines
+  and protected partial spines whose remaining indices are supplied later
+  are covered by the simulation theorem. Arity *trimming* of ghost
+  slots is a later IxIR₀ˢ optimization, not erasure's job.
+
+A binder/position is erased when its mode is 0 **or** its domain is
+syntactically sort-like (`Sort`, or a Π-chain into one, through
+shares) — Coq-extraction-style type-scheme erasure, no typing needed.
+The approximation degrades safely: an undetected type flows as a
+value and meets `◻` only where syntax reveals it.
+
+Recursors erase **structurally** (their stored counts, not modes):
+motives are ghost positions, indices are dropped, minors and value
+params are kept. A rule's right-hand side (a kernel-shaped closed
+lambda chain over params/motives/minors/fields) is peeled and
+re-expressed in the `RecRule` environment convention; the source's
+`recur`-self becomes the recSelf slot — `var mask.length`, the index
+just past all peeled binders, exactly where IxIR₀'s ι binds the
+unapplied recursor.
+
+Addresses survive erasure as environment keys. Members of a `muts`
+block get fixed-width synthetic addresses (`memberAddr`; scaffolding
+until erased IR is content-addressed);
+projection constants become indirections (`defn (ref member)`), ctor
+projections become `Decl.ctor` directly, inductive-type constants
+become `defn ◻`, opaque/partial definitions and axioms become
+`Decl.extern` (the ledger boundary), and quotients compile away
+(`mk ↦ λλλ.v₀`, `lift ↦ λ⁶. f q`, `ind ↦ λ⁵. mk q`).
+
+Known v1 boundaries (recorded): unknown-telescope **ghost** positions
+(higher-order heads) keep their arguments — sound but unerased; first-class
+unfoldable definition and recursor mutual-member references are certified only
+when named by a finite simultaneous member plan. Configured opaque mutual
+members use their synthetic member address as both source-oracle identity and
+target extern key; broader dropped-variable reads remain outside the certified
+relation. Split
+**constructor-parameter** spines are protected by ignored target closures: a
+visible prefix drops the parameters it consumes and wraps the target
+constructor for exactly the remaining source parameters. Split **indexed
+recursor** spines use a let-captured pre-major target pap plus one ignored
+closure binder per remaining source-only index. Either wrapper may escape
+through variables or lets; later generic applications consume it before the
+target constructor or recursor becomes fireable, so source and target cannot
+fire at different points. The indexed wrapper applies both to projection heads
+and rule-local recursive self heads. Literal
+blobs are resolved and inlined at erase time; `natLit` peeling is
+enabled by well-known-address comparison against the Nat block.
+
+The pass is validated two ways: differential `#guard`s below run the
+same programs through the Ixon reference evaluator and the erased
+IxIR₀ interpreter, and `Ix/Compiler/Sim.lean` proves the simulation
+theorem against a proof-producing relational erasure certificate.
+-/
+
+namespace Ix.Compiler.Erase
+
+open Ix.Compiler.Ixon (Address Uses Owned Constant ConstantInfo MutConst
+  Recursor RecursorRule Constructor Definition Univ)
+open Ix.Compiler.Ixon.Eval (Blob unfoldable)
+
+inductive EraseErr where
+  | fuel
+  | unsupported (msg : String)
+  | unknownBlob (adr : Address)
+  deriving BEq, Repr
+
+structure EraseCtx where
+  resolve : Address → Option Constant
+  blobs : Address → Option Blob := fun _ => none
+  /-- Well-known address of the `Nat` block: sets `natLit` on its
+  recursor's erasure. -/
+  natBlock : Option Address := none
+
+/-- Tables of the constant being erased, plus rule-erasure state. -/
+structure ETables where
+  sharing : Array Ix.Compiler.Ixon.Expr := #[]
+  refs : Array Address := #[]
+  selfMuts : Array MutConst := #[]
+  curBlock : Option Address := none
+  /-- When erasing a recursor rule: the member index whose `recur`
+  occurrences map to the recSelf slot. -/
+  recSelf : Option Nat := none
+
+/-! Keep the historical eraser-qualified name while sharing the constructor
+with the source evaluator's opaque-member semantics. -/
+abbrev memberAddr := Address.memberAddr
+
+@[simp] theorem memberAddr_get (block : Address) (idx : Nat) (i : Fin 32) :
+    (memberAddr block idx).get i =
+      if i.val < 24 then block.get i
+      else block.get i ^^^
+        UInt8.ofNat (((idx + 1) >>> (8 * (i.val - 24))) % 256) := by
+  exact Address.memberAddr_get block idx i
+
+def defaultFuel : Nat := 100000
+
+/-! ## Syntactic classification -/
+
+def expandShare (sharing : Array Ix.Compiler.Ixon.Expr) :
+    Nat → Ix.Compiler.Ixon.Expr → Except EraseErr Ix.Compiler.Ixon.Expr
+  | 0, _ => .error .fuel
+  | fuel + 1, e =>
+    match e with
+    | .share i =>
+      match sharing[i.toNat]? with
+      | some e' => expandShare sharing fuel e'
+      | none => .error (.unsupported s!"share {i.toNat} out of range")
+    | e => .ok e
+
+/-- Is this type expression a type *scheme* — `Sort`, or a Π-chain
+into one (through shares)? Binders with sort-like domains are erased. -/
+def sortLike (sharing : Array Ix.Compiler.Ixon.Expr) :
+    Nat → Ix.Compiler.Ixon.Expr → Bool
+  | 0, _ => false
+  | fuel + 1, e =>
+    match e with
+    | .sort _ => true
+    | .all _ _ _ cod => sortLike sharing fuel cod
+    | .share i =>
+      match sharing[i.toNat]? with
+      | some e' => sortLike sharing fuel e'
+      | none => false
+    | _ => false
+
+/-- Telescope binders (uses, domain) of a type, through shares. -/
+def teleBinders (sharing : Array Ix.Compiler.Ixon.Expr) :
+    Nat → Ix.Compiler.Ixon.Expr → List (Uses × Ix.Compiler.Ixon.Expr)
+  | 0, _ => []
+  | fuel + 1, e =>
+    match e with
+    | .all u _ dom cod => (u, dom) :: teleBinders sharing fuel cod
+    | .share i =>
+      match sharing[i.toNat]? with
+      | some e' => teleBinders sharing fuel e'
+      | none => []
+    | _ => []
+
+/-- The result world promised by the innermost arrow in a definition
+type. A non-function (or an unresolved type share) defaults to shared,
+matching `UsageCheck.peelDefn`; fuel exhaustion retains the last visible
+arrow rather than inventing a stronger promise. -/
+private def teleResultOwned? (sharing : Array Ix.Compiler.Ixon.Expr) :
+    Nat → Ix.Compiler.Ixon.Expr → Option Owned
+  | 0, _ => none
+  | fuel + 1, e =>
+    match e with
+    | .all _ result _ cod =>
+      match teleResultOwned? sharing fuel cod with
+      | some inner => some inner
+      | none => some result
+    | .share i =>
+      match sharing[i.toNat]? with
+      | some e' => teleResultOwned? sharing fuel e'
+      | none => none
+    | _ => none
+
+def teleResultOwned (sharing : Array Ix.Compiler.Ixon.Expr) (fuel : Nat)
+    (typ : Ix.Compiler.Ixon.Expr) : Owned :=
+  (teleResultOwned? sharing fuel typ).getD .shared
+
+/-- Should a binder with this mode and domain be erased? -/
+def dropBinder (sharing : Array Ix.Compiler.Ixon.Expr) (fuel : Nat)
+    (u : Uses) (dom : Ix.Compiler.Ixon.Expr) : Bool :=
+  u == .erased || sortLike sharing fuel dom
+
+/-! ## Argument policies -/
+
+/-- What erasure does to an argument at a given telescope position. -/
+inductive ArgPolicy where
+  | keep
+  | ghost
+  | drop
+  deriving BEq, Repr
+
+def telePolicies (sharing : Array Ix.Compiler.Ixon.Expr) (fuel : Nat)
+    (typ : Ix.Compiler.Ixon.Expr) : List ArgPolicy :=
+  (teleBinders sharing fuel typ).map fun (u, dom) =>
+    if dropBinder sharing fuel u dom then .ghost else .keep
+
+/-- Structural policies for a recursor's applications: value params
+kept, type params ghost, motives ghost, minors kept, indices dropped. -/
+def recPolicies (sharing : Array Ix.Compiler.Ixon.Expr) (fuel : Nat)
+    (r : Recursor) : List ArgPolicy :=
+  let doms := (teleBinders sharing fuel r.typ).take r.params.toNat
+  let pPol := doms.map fun (u, dom) =>
+    if dropBinder sharing fuel u dom then ArgPolicy.ghost else .keep
+  let pPol := pPol ++ List.replicate (r.params.toNat - pPol.length) .keep
+  pPol ++ List.replicate r.motives.toNat .ghost
+    ++ List.replicate r.minors.toNat .keep
+    ++ List.replicate r.indices.toNat .drop
+
+def ctorPolicies (ct : Constructor) : List ArgPolicy :=
+  List.replicate ct.params.toNat .drop
+    ++ List.replicate ct.fields.toNat .keep
+
+private def mutMember (ctx : EraseCtx) (block : Address) (idx : Nat) :
+    Option (Constant × MutConst) := do
+  let bc ← ctx.resolve block
+  match bc.info with
+  | .muts ms => do
+    let m ← ms[idx]?
+    some (bc, m)
+  | _ => none
+
+def memberPolicies (ctx : EraseCtx) (fuel : Nat)
+    (sharing : Array Ix.Compiler.Ixon.Expr) : MutConst → List ArgPolicy
+  | .defn d => telePolicies sharing fuel d.typ
+  | .recr r => recPolicies sharing fuel r
+  | .indc _ => []
+
+/-- Argument policies for a reference to a resolved constant. Unknown
+resolution degrades to keep-everything (sound, unerased). -/
+def constPolicies (ctx : EraseCtx) (fuel : Nat) (c : Constant) :
+    List ArgPolicy :=
+  match c.info with
+  | .defn d => telePolicies c.sharing fuel d.typ
+  | .axio a => telePolicies c.sharing fuel a.typ
+  | .quot q => telePolicies c.sharing fuel q.typ
+  | .recr r => recPolicies c.sharing fuel r
+  | .cPrj p =>
+    match mutMember ctx p.block p.idx.toNat with
+    | some (_, .indc ind) =>
+      match ind.ctors[p.cidx.toNat]? with
+      | some ct => ctorPolicies ct
+      | none => []
+    | _ => []
+  | .rPrj p =>
+    match mutMember ctx p.block p.idx.toNat with
+    | some (bc, .recr r) => recPolicies bc.sharing fuel r
+    | _ => []
+  | .dPrj p =>
+    match mutMember ctx p.block p.idx.toNat with
+    | some (bc, .defn d) => telePolicies bc.sharing fuel d.typ
+    | _ => []
+  | .iPrj _ => []
+  | .muts _ => []
+
+/-- Build `n` ignored, unrestricted target binders around `body`. -/
+def lamManyN : Nat → IxIR0.Expr → IxIR0.Expr
+  | 0, body => body
+  | n + 1, body => .lam .many (lamManyN n body)
+
+/-- Evaluate `value` before exposing `n` ignored binders, then return the
+captured value after those binders have been consumed.  The let is important:
+`value` may mention the surrounding environment, so wrapping it directly in
+lambdas would capture its de Bruijn variables. -/
+def captureThenIgnoreN (n : Nat) (value : IxIR0.Expr) : IxIR0.Expr :=
+  .letE .many value (lamManyN n (.var n))
+
+/-- Number of source-only recursor indices still missing from a visible
+reference spine, once every parameter/motive/minor argument has been supplied.
+Outside that half-open index window no protection is required. -/
+def refRecIndicesRemaining (ctx : EraseCtx) (T : ETables) (idx : UInt64)
+    (visibleArgs : Nat) : Nat :=
+  match T.refs[idx.toNat]? with
+  | some address =>
+    match ctx.resolve address with
+    | some c =>
+      match c.info with
+      | .rPrj p =>
+        match mutMember ctx p.block p.idx.toNat with
+        | some (_, .recr r) =>
+          let ruleArgs := r.params.toNat + r.motives.toNat + r.minors.toNat
+          let preMajor := ruleArgs + r.indices.toNat
+          if ruleArgs ≤ visibleArgs && visibleArgs < preMajor then
+            preMajor - visibleArgs
+          else 0
+        | _ => 0
+      | _ => 0
+    | none => 0
+  | none => 0
+
+/-- `recur`-head counterpart of `refRecIndicesRemaining`. -/
+def selfRecIndicesRemaining (T : ETables) (idx visibleArgs : Nat) : Nat :=
+  match T.selfMuts[idx]? with
+  | some (.recr r) =>
+    let ruleArgs := r.params.toNat + r.motives.toNat + r.minors.toNat
+    let preMajor := ruleArgs + r.indices.toNat
+    if ruleArgs ≤ visibleArgs && visibleArgs < preMajor then
+      preMajor - visibleArgs
+    else 0
+  | _ => 0
+
+/-- Protect a target pre-major recursor value while its source still owes
+source-only indices. -/
+def protectRecIndices (ctx : EraseCtx) (T : ETables)
+    (base : Ix.Compiler.Ixon.Expr) (visibleArgs : Nat)
+    (target : IxIR0.Expr) : IxIR0.Expr :=
+  let remaining := match base with
+    | .ref idx _ => refRecIndicesRemaining ctx T idx visibleArgs
+    | .recur idx _ => selfRecIndicesRemaining T idx.toNat visibleArgs
+    | _ => 0
+  if remaining = 0 then target else captureThenIgnoreN remaining target
+
+/-- Dropped-parameter count of reference `idx` when it resolves to a
+known constructor (`cPrj`); `0` for anything else or unresolved. -/
+def refCtorParams (ctx : EraseCtx) (T : ETables) (idx : UInt64) : Nat :=
+  match T.refs[idx.toNat]? with
+  | none => 0
+  | some a =>
+    match ctx.resolve a with
+    | none => 0
+    | some c =>
+      match c.info with
+      | .cPrj p =>
+        match mutMember ctx p.block p.idx.toNat with
+        | some (_, .indc ind) =>
+          match ind.ctors[p.cidx.toNat]? with
+          | some ct => ct.params.toNat
+          | none => 0
+        | _ => 0
+      | _ => 0
+
+/-- Erase a visible reference head. A parameterized constructor whose visible
+spine has not consumed every dropped source parameter becomes a chain of
+ignored target closures around the real constructor reference. Once the
+complete prefix is visible, the wrappers are unnecessary and the head erases
+directly to the target constructor. -/
+def eraseRefHead (ctx : EraseCtx) (T : ETables) (idx : UInt64)
+    (visibleArgs : Nat) : Except EraseErr IxIR0.Expr :=
+  match T.refs[idx.toNat]? with
+  | none => .error (.unsupported s!"ref {idx.toNat} out of range")
+  | some address =>
+    let params := refCtorParams ctx T idx
+    if visibleArgs < params then
+      .ok (lamManyN (params - visibleArgs) (.ref address))
+    else .ok (.ref address)
+
+/-- Target of a `recur` reference: the recSelf slot when erasing the
+recursor's own rules, a member address otherwise. -/
+def recurTarget (T : ETables) (mask : List Bool) (idx : Nat) :
+    Except EraseErr IxIR0.Expr :=
+  if T.recSelf == some idx then .ok (.var mask.length)
+  else
+    match T.curBlock with
+    | some blk => .ok (.ref (memberAddr blk idx))
+    | none => .error (.unsupported "recur reference outside a mutual block")
+
+def headPolicies (ctx : EraseCtx) (fuel : Nat) (T : ETables) :
+    Ix.Compiler.Ixon.Expr → List ArgPolicy
+  | .ref idx _ =>
+    match T.refs[idx.toNat]? with
+    | some a =>
+      match ctx.resolve a with
+      | some c => constPolicies ctx fuel c
+      | none => []
+    | none => []
+  | .recur idx _ =>
+    match T.selfMuts[idx.toNat]? with
+    | some m => memberPolicies ctx fuel T.sharing m
+    | none => []
+  | e@(.lam ..) =>
+    (Ix.Compiler.Ixon.Expr.collectLam e).1.map fun (u, dom) =>
+      if dropBinder T.sharing fuel u dom then ArgPolicy.ghost else .keep
+  | _ => []
+
+/-! ## Expression erasure -/
+
+mutual
+
+def eraseExpr (ctx : EraseCtx) (fuel : Nat) (T : ETables)
+    (mask : List Bool) (e : Ix.Compiler.Ixon.Expr) :
+    Except EraseErr IxIR0.Expr :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match e with
+    | .var i =>
+      match mask[i.toNat]? with
+      | some true => .ok (.var i.toNat)
+      | some false => .ok .erased
+      | none => .error (.unsupported s!"unbound variable {i.toNat}")
+    | .sort _ => .ok .erased
+    | .all _ _ _ _ => .ok .erased
+    | .lam u dom body =>
+      let dropped := dropBinder T.sharing fuel u dom
+      let u' := if dropped then Uses.many else u
+      (.lam u' ·) <$> eraseExpr ctx fuel T ((!dropped) :: mask) body
+    | .letE _ _ val body => do
+      let val' ← eraseExpr ctx fuel T mask val
+      let body' ← eraseExpr ctx fuel T (true :: mask) body
+      .ok (.letE .many val' body')
+    | .prj _ fieldIdx val =>
+      (.proj fieldIdx.toNat ·) <$> eraseExpr ctx fuel T mask val
+    | .nat idx =>
+      match T.refs[idx.toNat]? with
+      | none => .error (.unsupported s!"nat literal ref {idx.toNat} out of range")
+      | some a =>
+        match ctx.blobs a with
+        | some (.natB n) => .ok (.lit (.nat n))
+        | some (.strB _) => .error (.unsupported "nat literal address holds a string")
+        | none => .error (.unknownBlob a)
+    | .str idx =>
+      match T.refs[idx.toNat]? with
+      | none => .error (.unsupported s!"str literal ref {idx.toNat} out of range")
+      | some a =>
+        match ctx.blobs a with
+        | some (.strB s) => .ok (.lit (.str s))
+        | some (.natB _) => .error (.unsupported "str literal address holds a nat")
+        | none => .error (.unknownBlob a)
+    | .share i =>
+      match T.sharing[i.toNat]? with
+      | none => .error (.unsupported s!"share {i.toNat} out of range")
+      | some e' => eraseExpr ctx fuel T mask e'
+    | e@(.ref idx _) => do
+      let head ← eraseRefHead ctx T idx 0
+      .ok (protectRecIndices ctx T e 0 head)
+    | e@(.recur idx _) => do
+      let head ← recurTarget T mask idx.toNat
+      .ok (protectRecIndices ctx T e 0 head)
+    | .app f a => do
+      let (args, base₀) := Ix.Compiler.Ixon.Expr.collectApp (.app f a)
+      let base ← expandShare T.sharing fuel base₀
+      let pols := headPolicies ctx fuel T base
+      let head : IxIR0.Expr ←
+        match base with
+        | .ref idx _ => eraseRefHead ctx T idx args.length
+        | .recur idx _ => recurTarget T mask idx.toNat
+        | _ => eraseExpr ctx fuel T mask base
+      let target ← eraseArgs ctx fuel T mask pols 0 args head
+      .ok (protectRecIndices ctx T base args.length target)
+  termination_by fuel
+
+/-- Fold spine arguments over their policies onto the erased head. -/
+def eraseArgs (ctx : EraseCtx) (fuel : Nat) (T : ETables)
+    (mask : List Bool) (pols : List ArgPolicy) (i : Nat)
+    (args : List Ix.Compiler.Ixon.Expr) (head : IxIR0.Expr) :
+    Except EraseErr IxIR0.Expr :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match args with
+    | [] => .ok head
+    | a :: rest =>
+      match pols[i]? with
+      | some .ghost =>
+        eraseArgs ctx fuel T mask pols (i + 1) rest (.app head .erased)
+      | some .drop => eraseArgs ctx fuel T mask pols (i + 1) rest head
+      | _ => do
+        let a' ← eraseExpr ctx fuel T mask a
+        eraseArgs ctx fuel T mask pols (i + 1) rest (.app head a')
+  termination_by fuel
+
+end
+
+/-! ## Constant erasure -/
+
+/-- Peel a kernel-shaped lambda chain against outermost-first keep
+flags, accumulating the (innermost-first) mask. -/
+def peelRule (sharing : Array Ix.Compiler.Ixon.Expr) :
+    Nat → List Bool → List Bool → Ix.Compiler.Ixon.Expr →
+    Except EraseErr (List Bool × Ix.Compiler.Ixon.Expr)
+  | 0, _, _, _ => .error .fuel
+  | _ + 1, [], mask, e => .ok (mask, e)
+  | fuel + 1, flag :: flags, mask, e => do
+    match ← expandShare sharing fuel e with
+    | .lam _ _ body => peelRule sharing fuel flags (flag :: mask) body
+    | _ => .error (.unsupported "recursor rule is not a kernel-shaped lambda chain")
+
+def eraseRecursor (ctx : EraseCtx) (fuel : Nat) (T : ETables)
+    (blockAddr : Address) (selfIdx : Nat) (r : Recursor) :
+    Except EraseErr IxIR0.Decl := do
+  let p := r.params.toNat
+  let m := r.motives.toNat
+  let mi := r.minors.toNat
+  let doms := (teleBinders T.sharing fuel r.typ).take p
+  let pFlags := doms.map fun (u, dom) => !dropBinder T.sharing fuel u dom
+  let pFlags := pFlags ++ List.replicate (p - pFlags.length) true
+  let flags := pFlags ++ List.replicate m false ++ List.replicate mi true
+  let rules ← r.rules.mapM fun rule => do
+    let fl := flags ++ List.replicate rule.fields.toNat true
+    let (mask, body) ← peelRule T.sharing fuel fl [] rule.rhs
+    let rhs ← eraseExpr ctx fuel { T with recSelf := some selfIdx } mask body
+    pure ({ fields := rule.fields.toNat, rhs } : IxIR0.RecRule)
+  pure (.recursor (p + m + mi) (ctx.natBlock == some blockAddr) rules)
+
+def quotientCore : Ixon.QuotKind → IxIR0.Expr
+  | Ixon.QuotKind.type => .erased
+  | Ixon.QuotKind.ctor => .var 0
+  | Ixon.QuotKind.lift => .app (.var 2) (.var 0)
+  | Ixon.QuotKind.ind => .app (.var 1) (.var 0)
+
+def quotMkBody : IxIR0.Expr :=
+  lamManyN (Ixon.Eval.quotArity Ixon.QuotKind.ctor)
+    (quotientCore Ixon.QuotKind.ctor)
+
+def quotLiftBody : IxIR0.Expr :=
+  lamManyN (Ixon.Eval.quotArity Ixon.QuotKind.lift)
+    (quotientCore Ixon.QuotKind.lift)
+
+def quotIndBody : IxIR0.Expr :=
+  lamManyN (Ixon.Eval.quotArity Ixon.QuotKind.ind)
+    (quotientCore Ixon.QuotKind.ind)
+
+def quotientBody : Ixon.QuotKind → IxIR0.Expr
+  | Ixon.QuotKind.type => .erased
+  | Ixon.QuotKind.ctor => quotMkBody
+  | Ixon.QuotKind.lift => quotLiftBody
+  | Ixon.QuotKind.ind => quotIndBody
+
+/-- Erase one constant into environment entries (a block yields one
+entry per member). -/
+def eraseConstant (ctx : EraseCtx) (adr : Address) (c : Constant)
+    (fuel : Nat := defaultFuel) :
+    Except EraseErr (List (Address × IxIR0.Decl)) := do
+  let T : ETables :=
+    { sharing := c.sharing, refs := c.refs
+      selfMuts := Ixon.selfMutsOf c.info }
+  match c.info with
+  | .defn d =>
+    if unfoldable d then do
+      let body ← eraseExpr ctx fuel T [] d.value
+      pure [(adr, .defn (teleResultOwned c.sharing fuel d.typ) body)]
+    else
+      pure [(adr, .extern (teleBinders c.sharing fuel d.typ).length)]
+  | .axio a => pure [(adr, .extern (teleBinders c.sharing fuel a.typ).length)]
+  | .quot q =>
+    let result := teleResultOwned c.sharing fuel q.typ
+    pure [(adr, .defn result (quotientBody q.kind))]
+  | .recr r => do
+    let d ← eraseRecursor ctx fuel { T with curBlock := some adr } adr 0 r
+    pure [(adr, d)]
+  | .cPrj p =>
+    match mutMember ctx p.block p.idx.toNat with
+    | some (_, .indc ind) =>
+      match ind.ctors[p.cidx.toNat]? with
+      | some ct => pure [(adr, .ctor p.cidx.toNat ct.fields.toNat)]
+      | none => .error (.unsupported "constructor projection out of range")
+    | _ => .error (.unsupported "unresolvable constructor projection")
+  | .iPrj _ => pure [(adr, .defn .shared .erased)]
+  | .rPrj p => pure [(adr, .defn .shared (.ref (memberAddr p.block p.idx.toNat)))]
+  | .dPrj p =>
+    let result := match mutMember ctx p.block p.idx.toNat with
+      | some (bc, .defn d) => teleResultOwned bc.sharing fuel d.typ
+      | _ => .shared
+    pure [(adr, .defn result (.ref (memberAddr p.block p.idx.toNat)))]
+  | .muts ms => do
+    let T := { T with curBlock := some adr }
+    let mut out := []
+    for hi : i in [0:ms.size] do
+      match ms[i]! with
+      | .defn d =>
+        if unfoldable d then do
+          let body ← eraseExpr ctx fuel T [] d.value
+          let result := teleResultOwned c.sharing fuel d.typ
+          out := out ++ [(memberAddr adr i, IxIR0.Decl.defn result body)]
+        else
+          out := out ++ [(memberAddr adr i,
+            IxIR0.Decl.extern (teleBinders c.sharing fuel d.typ).length)]
+      | .indc _ =>
+        out := out ++ [(memberAddr adr i, IxIR0.Decl.defn .shared .erased)]
+      | .recr r => do
+        let d ← eraseRecursor ctx fuel T adr i r
+        out := out ++ [(memberAddr adr i, d)]
+    pure out
+
+/-- Erase a set of constants into an IxIR₀ environment listing. -/
+def eraseProgram (ctx : EraseCtx)
+    (consts : List (Address × Constant)) (fuel : Nat := defaultFuel) :
+    Except EraseErr (List (Address × IxIR0.Decl)) := do
+  let mut out := []
+  for (adr, c) in consts do
+    out := out ++ (← eraseConstant ctx adr c fuel)
+  pure out
+
+/-! ## Differential tests
+
+The same store as the reference-evaluator suite (Nat block with
+kernel-shaped rules, projection constants, unerased `add`, literal
+blobs, a two-param `Pair`), erased and run on **both** interpreters —
+an independent executable check of recursors, ghost motives, dropped
+constructor parameters, and literal peeling alongside the simulation theorem.
+-/
+
+section Tests
+
+open Ix.Compiler.Ixon.Eval
+
+private def addrOf (n : UInt8) : Address :=
+  Address.replicate n
+
+private def aNatBlock := addrOf 0x10
+private def aNat := addrOf 0x11
+private def aZero := addrOf 0x12
+private def aSucc := addrOf 0x13
+private def aNatRec := addrOf 0x14
+private def aAdd := addrOf 0x15
+private def aTwo := addrOf 0x16
+private def aThree := addrOf 0x17
+private def aPairBlock := addrOf 0x20
+private def aMk := addrOf 0x21
+private def aPair := addrOf 0x23
+
+private def natInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+        typ := .recur 0 #[] },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .all .many .shared (.recur 0 #[]) (.recur 0 #[]) }] }
+
+private def natRec : Recursor :=
+  { k := false, isUnsafe := false, lvls := 1, params := 0, indices := 0
+    motives := 1, minors := 2, typ := .sort 0
+    rules := #[
+      { fields := 0
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.var 1))) },
+      { fields := 1
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.lam .many (.recur 0 #[])
+            (.app (.app (.var 1) (.var 0))
+              (.app (.app (.app (.app (.recur 1 #[0]) (.var 3)) (.var 2))
+                (.var 1)) (.var 0)))))) }] }
+
+private def cNatBlock : Constant :=
+  { info := .muts #[.indc natInd, .recr natRec]
+    sharing := #[], refs := #[], univs := #[.var 0] }
+
+private def prjConst (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def cNat := prjConst (.iPrj { idx := 0, block := aNatBlock })
+private def cZero := prjConst (.cPrj { idx := 0, cidx := 0, block := aNatBlock })
+private def cSucc := prjConst (.cPrj { idx := 0, cidx := 1, block := aNatBlock })
+private def cNatRec := prjConst (.rPrj { idx := 1, block := aNatBlock })
+
+private def cAdd : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .shared (.ref 0 #[])
+          (.all .many .shared (.ref 0 #[]) (.ref 0 #[]))
+        value := .lam .many (.ref 0 #[]) (.lam .many (.ref 0 #[])
+          (.app
+            (.app (.app (.app (.ref 3 #[0])
+              (.lam .many (.ref 0 #[]) (.ref 0 #[])))
+              (.var 1))
+              (.lam .many (.ref 0 #[]) (.lam .many (.ref 0 #[])
+                (.app (.ref 2 #[]) (.var 0)))))
+            (.var 0))) }
+    sharing := #[], refs := #[aNat, aZero, aSucc, aNatRec]
+    univs := #[.succ .zero] }
+
+/-- A focused non-Lean-fragment declaration proving that result ownership
+is read from the source arrow rather than defaulted by erasure. -/
+private def cUniqueIdentity : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .affine .unique (.ref 0 #[]) (.ref 0 #[])
+        value := .lam .affine (.ref 0 #[]) (.var 0) }
+    sharing := #[], refs := #[aNat], univs := #[] }
+
+private def pairInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 2, indices := 0
+    typ := .sort 0
+    ctors := #[{ isUnsafe := false, lvls := 0, cidx := 0, params := 2
+                 fields := 2, typ := .sort 0 }] }
+
+private def cPairBlock : Constant :=
+  { info := .muts #[.indc pairInd]
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+private def cMk := prjConst (.cPrj { idx := 0, cidx := 0, block := aPairBlock })
+private def cPair := prjConst (.iPrj { idx := 0, block := aPairBlock })
+
+private def program : List (Address × Constant) :=
+  [(aNatBlock, cNatBlock), (aNat, cNat), (aZero, cZero), (aSucc, cSucc),
+   (aNatRec, cNatRec), (aAdd, cAdd), (aPairBlock, cPairBlock), (aMk, cMk),
+   (aPair, cPair)]
+
+private def resolver : Address → Option Constant := fun a =>
+  (program.find? (fun p => p.1 == a)).map (·.2)
+
+private def testBlobs : Address → Option Blob := fun a =>
+  if a == aTwo then some (.natB 2)
+  else if a == aThree then some (.natB 3)
+  else none
+
+private def sctx : EvalCtx :=
+  { resolve := resolver, blobs := testBlobs, natBlock := some aNatBlock }
+
+private def ectx : EraseCtx :=
+  { resolve := resolver, blobs := testBlobs, natBlock := some aNatBlock }
+
+/-- Test frame refs: 0 = add, 1 = zero, 2 = succ, 3 = blob 2,
+4 = blob 3, 5 = mk, 6 = Pair. -/
+private def testF : Frame :=
+  { refs := #[aAdd, aZero, aSucc, aTwo, aThree, aMk, aPair]
+    univs := #[.succ (.succ .zero)] }
+
+private def testT : ETables :=
+  { refs := #[aAdd, aZero, aSucc, aTwo, aThree, aMk, aPair] }
+
+private def ienv : IxIR0.Env :=
+  IxIR0.Env.ofList ((eraseProgram ectx program).toOption.getD [])
+
+private def ictx : IxIR0.Ctx := { env := ienv }
+
+private def sToNatGo : Nat → Value → Option Nat
+  | 0, _ => none
+  | _, .litV (.natL n) => some n
+  | _, .ctorV _ _ 0 [] => some 0
+  | f + 1, .ctorV _ _ 1 [v] => (sToNatGo f v).map (· + 1)
+  | _, _ => none
+
+private def iToNatGo : Nat → IxIR0.Value → Option Nat
+  | 0, _ => none
+  | _, .lit (.nat n) => some n
+  | _, .ctor _ 0 [] => some 0
+  | f + 1, .ctor _ 1 [v] => (iToNatGo f v).map (· + 1)
+  | _, _ => none
+
+/-- The differential oracle: source-evaluate, erase, target-evaluate,
+compare through the numeral decoders. Demands source success. -/
+private def diffNat (e : Ix.Compiler.Ixon.Expr) : Bool :=
+  let sv := match evalClosed sctx testF e with
+    | .ok v => sToNatGo 1000000 v
+    | .error _ => none
+  let tv := match eraseExpr ectx defaultFuel testT [] e with
+    | .ok e' =>
+      match IxIR0.eval ictx 100000 [] e' with
+      | .ok v => iToNatGo 1000000 v
+      | .error _ => none
+    | .error _ => none
+  sv.isSome && sv == tv
+
+private def natE : Nat → Ix.Compiler.Ixon.Expr
+  | 0 => .ref 1 #[]
+  | n + 1 => .app (.ref 2 #[]) (natE n)
+
+-- β, let, ctor numerals through the erased env
+#guard diffNat (natE 5)
+#guard diffNat (.app (.lam .many (.ref 1 #[]) (.var 0)) (natE 4))
+#guard diffNat (.letE false (.sort 0) (natE 2) (.app (.ref 2 #[]) (.var 0)))
+
+-- recursor ι with ghost motive slots, both numeral forms
+#guard diffNat (.app (.app (.ref 0 #[]) (natE 2)) (natE 3))
+#guard diffNat (.app (.app (.ref 0 #[]) (natE 0)) (natE 0))
+#guard diffNat (.app (.app (.ref 0 #[]) (natE 7)) (natE 0))
+#guard diffNat (.app (.app (.ref 0 #[]) (.nat 3)) (.nat 4))
+#guard diffNat (.app (.app (.ref 0 #[]) (natE 1)) (.nat 4))
+
+-- dropped ctor params + projections: mk A B x y, prj skips params on
+-- the source side and params are gone on the target side
+#guard diffNat (.prj 6 0 (.app (.app (.app (.app (.ref 5 #[]) (.sort 0))
+  (.sort 0)) (natE 1)) (natE 2)))
+#guard diffNat (.prj 6 1 (.app (.app (.app (.app (.ref 5 #[]) (.sort 0))
+  (.sort 0)) (natE 1)) (natE 2)))
+
+-- an erased-binder redex: the argument slot gets ◻ on the target side
+#guard diffNat (.app (.app (.lam .many (.sort 0)
+  (.lam .many (.ref 1 #[]) (.var 0))) (.sort 0)) (natE 3))
+
+-- structural expectations on the erased declarations
+#guard teleResultOwned #[] 100
+  (.all .many .shared (.sort 0)
+    (.all .affine .unique (.sort 0) (.sort 0))) == .unique
+#guard teleResultOwned
+  #[.all .many .unique (.sort 0) (.sort 0)] 100 (.share 0) == .unique
+#guard
+  match eraseConstant ectx (addrOf 0x22) cUniqueIdentity with
+  | .ok [(_, .defn .unique (.lam .affine (.var 0)))] => true
+  | _ => false
+#guard (match ienv aSucc with | some (.ctor 1 1) => true | _ => false)
+#guard (match ienv aZero with | some (.ctor 0 0) => true | _ => false)
+#guard (match ienv (memberAddr aNatBlock 1) with
+  | some (.recursor 3 true _) => true | _ => false)
+#guard (match ienv aNat with
+  | some (.defn .shared .erased) => true | _ => false)
+#guard (match ienv aNatRec with
+  | some (.defn .shared (.ref _)) => true | _ => false)
+
+/-! Split/under-saturated constructor-parameter spines lower through ignored
+target wrappers. The formerly silent early-fire miscompile stays closed while
+partial constructor values may now escape and be applied later. -/
+
+/-- `(let f := mk A in f) B x y`: the dropped-parameter prefix escapes
+the visible spine. The source saturates fine through the binding. -/
+private def splitSpine : Ix.Compiler.Ixon.Expr :=
+  .app (.app (.app (.letE false (.sort 0)
+    (.app (.ref 5 #[]) (.sort 0)) (.var 0)) (.sort 0)) (natE 1)) (natE 2)
+
+-- The source and the newly wrapped target both evaluate to the full pair.
+#guard (match evalClosed sctx testF splitSpine with
+  | .ok (.ctorV _ 0 0 [_, _, _, _]) => true
+  | _ => false)
+
+#guard (match eraseExpr ectx defaultFuel testT [] splitSpine with
+  | .ok target =>
+    match IxIR0.eval ictx 100000 [] target with
+    | .ok (.ctor address 0 [_, _]) => address == aMk
+    | _ => false
+  | .error _ => false)
+
+-- A bare head gets two wrappers; one visible parameter leaves one wrapper.
+#guard (match eraseExpr ectx defaultFuel testT [] (.ref 5 #[]) with
+  | .ok (.lam .many (.lam .many (.ref address))) => address == aMk
+  | _ => false)
+#guard (match eraseExpr ectx defaultFuel testT []
+    (.app (.ref 5 #[]) (.sort 0)) with
+  | .ok (.lam .many (.ref address)) => address == aMk
+  | _ => false)
+
+-- A bare head may escape through a let and consume both wrappers later.
+#guard (match eraseExpr ectx defaultFuel testT []
+    (.letE false (.sort 0) (.ref 5 #[])
+      (.app (.app (.app (.app (.var 0) (.sort 0)) (.sort 0)) (natE 1))
+        (natE 2))) with
+  | .ok target =>
+    match IxIR0.eval ictx 100000 [] target with
+    | .ok (.ctor address 0 [_, _]) => address == aMk
+    | _ => false
+  | .error _ => false)
+
+-- the complete parameter prefix still erases to the first-class head
+#guard (match eraseExpr ectx defaultFuel testT []
+    (.app (.app (.ref 5 #[]) (.sort 0)) (.sort 0)) with
+  | .ok (.ref a) => a == aMk
+  | _ => false)
+
+/-! Configured quotient primitives use their real source arities and the
+fixed erased definitions above.  These deliberately small, all-kept
+telescopes isolate the semantic seam: both `lift` and `ind` must open the
+representative stored by `mk`, while the target runs the emitted lambda
+bodies. -/
+
+private def aQuotCtor := addrOf 0x30
+private def aQuotLift := addrOf 0x31
+private def aQuotInd := addrOf 0x32
+private def aQuotPayload := addrOf 0x33
+
+private def quotTestType : Nat → Ix.Compiler.Ixon.Expr
+  | 0 => .var 0
+  | n + 1 => .all .many .shared (.var 0) (quotTestType n)
+
+private def quotConst (kind : Ix.Compiler.Ixon.QuotKind)
+    (arity : Nat) : Constant :=
+  { info := .quot { kind, lvls := 0, typ := quotTestType arity }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def quotProgram : List (Address × Constant) :=
+  [(aQuotCtor, quotConst Ix.Compiler.Ixon.QuotKind.ctor 3),
+   (aQuotLift, quotConst Ix.Compiler.Ixon.QuotKind.lift 6),
+   (aQuotInd, quotConst Ix.Compiler.Ixon.QuotKind.ind 5)]
+
+private def quotResolver : Address → Option Constant := fun a =>
+  (quotProgram.find? (fun p => p.1 == a)).map (·.2)
+
+private def quotKindAt : Address → Option Ix.Compiler.Ixon.QuotKind := fun a =>
+  if a == aQuotCtor then some Ix.Compiler.Ixon.QuotKind.ctor
+  else if a == aQuotLift then some Ix.Compiler.Ixon.QuotKind.lift
+  else if a == aQuotInd then some Ix.Compiler.Ixon.QuotKind.ind
+  else none
+
+private def quotSctx : EvalCtx :=
+  { resolve := quotResolver
+    blobs := fun a => if a == aQuotPayload then some (.natB 37) else none
+    quotientKind := quotKindAt }
+
+private def quotEctx : EraseCtx :=
+  { resolve := quotResolver
+    blobs := fun a => if a == aQuotPayload then some (.natB 37) else none }
+
+private def quotF : Frame :=
+  { refs := #[aQuotCtor, aQuotLift, aQuotInd, aQuotPayload]
+    univs := #[.zero] }
+
+private def quotT : ETables :=
+  { refs := #[aQuotCtor, aQuotLift, aQuotInd, aQuotPayload] }
+
+private def quotIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList
+      ((eraseProgram quotEctx quotProgram).toOption.getD []) }
+
+private def ixApps (head : Ix.Compiler.Ixon.Expr)
+    (args : List Ix.Compiler.Ixon.Expr) : Ix.Compiler.Ixon.Expr :=
+  args.foldl .app head
+
+private def quotMk37 : Ix.Compiler.Ixon.Expr :=
+  ixApps (.ref 0 #[]) [.sort 0, .sort 0, .nat 3]
+
+private def quotLift37 : Ix.Compiler.Ixon.Expr :=
+  ixApps (.ref 1 #[])
+    [.sort 0, .sort 0, .sort 0,
+     .lam .many (.var 0) (.var 0), .sort 0, quotMk37]
+
+private def quotInd37 : Ix.Compiler.Ixon.Expr :=
+  ixApps (.ref 2 #[])
+    [.sort 0, .sort 0, .sort 0,
+     .lam .many (.var 0) (.var 0), quotMk37]
+
+private def diffQuotNat (source : Ix.Compiler.Ixon.Expr) : Bool :=
+  let sourceResult := match evalClosed quotSctx quotF source with
+    | .ok (.litV (.natL n)) => some n
+    | _ => none
+  let targetResult :=
+    match eraseExpr quotEctx defaultFuel quotT [] source with
+    | .ok target =>
+      match IxIR0.eval quotIctx 100000 [] target with
+      | .ok (.lit (.nat n)) => some n
+      | _ => none
+    | .error _ => none
+  sourceResult == some 37 && sourceResult == targetResult
+
+#guard diffQuotNat quotLift37
+#guard diffQuotNat quotInd37
+
+end Tests
+
+end Ix.Compiler.Erase
diff --git a/Ix/Compiler/EraseAddressed.lean b/Ix/Compiler/EraseAddressed.lean
new file mode 100644
index 000000000..998c0f81b
--- /dev/null
+++ b/Ix/Compiler/EraseAddressed.lean
@@ -0,0 +1,144 @@
+import Ix.Compiler.Erase
+import Ix.Compiler.IxIR0.Readdress
+
+/-!
+# Artifact-facing addressed erasure
+
+The proof-facing eraser still emits transient mutual-member keys.  This module
+preserves that exact intermediate result, records constant boundaries, and
+then applies the certified whole-IxIR₀ block readdresser.  It is the migration
+seam for later evaluator transport and pipeline adoption; no existing erasure
+theorem is weakened or silently retargeted.
+-/
+
+namespace Ix.Compiler.EraseAddressed
+
+open Ix.Compiler.Ixon (Address Constant ConstantInfo)
+
+inductive Error where
+  | erase (error : Erase.EraseErr)
+  | readdress (message : String)
+  deriving Repr
+
+/-- Erase each source constant while retaining whether its output is one
+stable group or one mutual block. -/
+def eraseGroups (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant))
+    (fuel : Nat := Erase.defaultFuel) :
+    Except Error (List IxIR0.Readdress.Group) := do
+  let mut groups := []
+  for (address, constant) in consts do
+    let entries ←
+      match Erase.eraseConstant ctx address constant fuel with
+      | .ok entries => pure entries
+      | .error error => throw (.erase error)
+    let group :=
+      match constant.info with
+      | .muts _ => IxIR0.Readdress.Group.mutual entries
+      | _ => IxIR0.Readdress.Group.stable entries
+    groups := groups ++ [group]
+  return groups
+
+/-- Complete artifact-facing erasure result. `raw` is exactly the old eraser
+output; `addressed` is its collision-checked block-address image. -/
+structure Result where
+  raw : List (Address × IxIR0.Decl)
+  groups : List IxIR0.Readdress.Group
+  addressed : IxIR0.Readdress.Result
+
+namespace Result
+
+def addressMap (result : Result) : IxIR0.MutualBlock.Renaming :=
+  result.addressed.addressMap
+
+def declarations (result : Result) : List (Address × IxIR0.Decl) :=
+  result.addressed.declarations
+
+def main (result : Result) : IxIR0.Expr :=
+  result.addressed.main
+
+/-- Executable bridge pinning both seams: group flattening equals the existing
+eraser's exact output, and the addressed result is the certified image of
+that grouping. -/
+def semanticAudit (result : Result) (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr)
+    (fuel : Nat) : Bool :=
+  result.raw == IxIR0.Readdress.rawDeclarations result.groups &&
+    (match Erase.eraseProgram ctx consts fuel with
+    | .ok raw => raw == result.raw
+    | .error _ => false) &&
+    result.addressed.semanticAudit (consts.map (·.1)) result.groups main
+
+end Result
+
+abbrev CertifiedResult (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr) (fuel : Nat) :=
+  { result : Result // result.semanticAudit ctx consts main fuel = true }
+
+private def certify (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr) (fuel : Nat)
+    (result : Result) : Except Error (CertifiedResult ctx consts main fuel) :=
+  if haudit : result.semanticAudit ctx consts main fuel then
+    .ok ⟨result, haudit⟩
+  else
+    .error (.readdress
+      "internal: addressed erasure failed its exact-output audit")
+
+/-- Run the existing eraser, then readdress every `.muts` output as a
+cycle-safe block. Every source constant address is protected, including the
+Ixon identity of each mutual block. -/
+def runCertified (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr)
+    (fuel : Nat := Erase.defaultFuel) :
+    Except Error (CertifiedResult ctx consts main fuel) := do
+  let groups ← eraseGroups ctx consts fuel
+  let raw := IxIR0.Readdress.rawDeclarations groups
+  let addressed ←
+    match IxIR0.Readdress.run (consts.map (·.1)) groups main with
+    | .ok result => pure result
+    | .error message => throw (.readdress message)
+  certify ctx consts main fuel { raw, groups, addressed }
+
+/-- Artifact-facing projection of `runCertified`. -/
+def run (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr)
+    (fuel : Nat := Erase.defaultFuel) : Except Error Result := do
+  return (← runCertified ctx consts main fuel).1
+
+/-- Proof-facing execution record for addressed erasure.  The ordinary API
+returns the same `Result`; this companion retains the exact successful run
+equation needed to compose the validator and lowering simulations. -/
+structure RunTrace (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr)
+    (fuel : Nat) where
+  result : Result
+  runEq : run ctx consts main fuel = .ok result
+
+/-- Execute addressed erasure once and retain its successful equation. -/
+def runWithTrace (ctx : Erase.EraseCtx)
+    (consts : List (Address × Constant)) (main : IxIR0.Expr)
+    (fuel : Nat := Erase.defaultFuel) :
+    Except Error (RunTrace ctx consts main fuel) :=
+  match hrun : run ctx consts main fuel with
+  | .error error => .error error
+  | .ok result => .ok { result, runEq := hrun }
+
+/-- Successful addressed erasure retains the exact-output/address-image
+audit. -/
+theorem semanticAudit_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {fuel : Nat} {result : Result}
+    (hrun : run ctx consts main fuel = .ok result) :
+    result.semanticAudit ctx consts main fuel = true := by
+  unfold run at hrun
+  cases hcertified : runCertified ctx consts main fuel with
+  | error error =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2
+
+end Ix.Compiler.EraseAddressed
diff --git a/Ix/Compiler/EraseAddressedSim.lean b/Ix/Compiler/EraseAddressedSim.lean
new file mode 100644
index 000000000..3dcd31b0e
--- /dev/null
+++ b/Ix/Compiler/EraseAddressedSim.lean
@@ -0,0 +1,229 @@
+import Ix.Compiler.EraseAddressed
+import Ix.Compiler.IxIR0.ReaddressOracle
+
+/-!
+# Semantic boundary for addressed erasure
+
+`EraseAddressed.run` deliberately retains the legacy eraser output and then
+applies the certified cycle-safe IxIR₀ readdresser.  This module exposes both
+halves of that executable audit as ordinary equalities and composes the
+IxIR₀ evaluator-equivariance theorem with the artifact-facing erasure API.
+
+The source evaluator context contains the legacy declarations plus stable
+aliases for derived keys.  It therefore agrees exactly with every lookup in
+the legacy environment while being total enough for closures or recursor
+values that already contain a derived address.
+-/
+
+namespace Ix.Compiler.EraseAddressed
+
+open Ix.Compiler.Ixon (Address Constant)
+
+namespace Result
+
+/-- The exact legacy declaration environment consumed by the erasure
+validator before block readdressing. -/
+def rawCtx (result : Result)
+    (oracle : IxIR0.Oracle := fun _ _ => none) : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList result.raw, oracle }
+
+/-- The recorded raw declarations are exactly the grouped eraser output. -/
+theorem raw_eq_grouped {result : Result} {ctx : Erase.EraseCtx}
+    {consts : List (Address × Constant)} {main : IxIR0.Expr} {fuel : Nat}
+    (haudit : result.semanticAudit ctx consts main fuel = true) :
+    result.raw = IxIR0.Readdress.rawDeclarations result.groups := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  exact (beq_iff_eq).mp haudit.1.1
+
+/-- The legacy eraser succeeded with exactly the raw declarations retained in
+the addressed artifact. -/
+theorem eraseProgram_eq_ok {result : Result} {ctx : Erase.EraseCtx}
+    {consts : List (Address × Constant)} {main : IxIR0.Expr} {fuel : Nat}
+    (haudit : result.semanticAudit ctx consts main fuel = true) :
+    Erase.eraseProgram ctx consts fuel = .ok result.raw := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  cases herase : Erase.eraseProgram ctx consts fuel with
+  | error error => simp [herase] at haudit
+  | ok raw =>
+      have hequal : raw = result.raw :=
+        (beq_iff_eq).mp (by simpa [herase] using haudit.1.2)
+      exact congrArg Except.ok hequal
+
+/-- The addressed half retains the complete whole-program semantic audit. -/
+theorem addressed_audit {result : Result} {ctx : Erase.EraseCtx}
+    {consts : List (Address × Constant)} {main : IxIR0.Expr} {fuel : Nat}
+    (haudit : result.semanticAudit ctx consts main fuel = true) :
+    result.addressed.semanticAudit (consts.map (·.1)) result.groups main =
+      true := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  exact haudit.2
+
+end Result
+
+/-- Successful addressed erasure transports closed IxIR₀ evaluation through
+the certified mutual-block map.  Extern behavior is parameterized by the
+same structural oracle-equivariance condition as the generic evaluator
+theorem. -/
+theorem run_semantics_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply result.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply result.addressMap)))
+    (evalFuel : Nat := 100000) :
+    (result.addressed.addressedCtx afterOracle).run result.main evalFuel =
+      IxIR0.Readdress.mapResult
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap)
+        ((result.addressed.preAddressCtx result.groups beforeOracle).run
+          main evalFuel) := by
+  have haudit := semanticAudit_of_run_eq_ok hrun
+  have haddressed := result.addressed_audit haudit
+  simp only [Result.main, Result.addressMap]
+  rw [result.addressed.main_eq_mapAddresses haddressed]
+  exact IxIR0.Readdress.Ctx.run_mapAddresses
+    (result.addressed.renames_preAddressCtx haddressed
+      beforeOracle afterOracle horacle)
+    main evalFuel
+
+/-- Pure addressed programs require no oracle premise. -/
+theorem run_emptyOracle_semantics_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    (evalFuel : Nat := 100000) :
+    (result.addressed.addressedCtx).run result.main evalFuel =
+      IxIR0.Readdress.mapResult
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap)
+        ((result.addressed.preAddressCtx result.groups).run main evalFuel) := by
+  apply run_semantics_of_run_eq_ok hrun
+    (fun _ _ => none) (fun _ _ => none) _ evalFuel
+  intro address arguments
+  rfl
+
+/-- A successful legacy-side run yields the address-renamed value in the
+addressed artifact. -/
+theorem run_success_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply result.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply result.addressMap)))
+    {evalFuel : Nat} {value : IxIR0.Value}
+    (hsource :
+      (result.addressed.preAddressCtx result.groups beforeOracle).run
+        main evalFuel = .ok value) :
+    (result.addressed.addressedCtx afterOracle).run result.main evalFuel =
+      .ok (IxIR0.Readdress.Value.mapAddresses
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap) value) := by
+  rw [run_semantics_of_run_eq_ok hrun beforeOracle afterOracle horacle
+    evalFuel, hsource]
+  rfl
+
+/-- A successful addressed erasure transports the validator's exact
+call-aware main trace from its literal raw environment to the final emitted
+environment. -/
+theorem run_projectionSafeMain_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply result.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply result.addressMap)))
+    {traceFuel : Nat} {value : IxIR0.Value}
+    (trace : IxIR0.ProjectionSafe.Eval (result.rawCtx beforeOracle)
+      traceFuel [] main value) :
+    IxIR0.ProjectionSafe.Eval
+      (result.addressed.addressedCtx afterOracle) traceFuel [] result.main
+      (IxIR0.Readdress.Value.mapAddresses
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap) value) := by
+  have haudit := semanticAudit_of_run_eq_ok hrun
+  have hraw := result.raw_eq_grouped haudit
+  have haddressed := result.addressed_audit haudit
+  have trace' : IxIR0.ProjectionSafe.Eval
+      (result.addressed.rawCtx result.groups beforeOracle)
+      traceFuel [] main value := by
+    simpa [Result.rawCtx, IxIR0.Readdress.Result.rawCtx, hraw] using trace
+  exact result.addressed.projectionSafeMain_of_audit haddressed
+    beforeOracle afterOracle horacle trace'
+
+/-- Pure addressed programs transport their exact main trace without an
+oracle premise. -/
+theorem run_emptyOracle_projectionSafeMain_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    {traceFuel : Nat} {value : IxIR0.Value}
+    (trace : IxIR0.ProjectionSafe.Eval result.rawCtx traceFuel [] main value) :
+    IxIR0.ProjectionSafe.Eval result.addressed.addressedCtx traceFuel []
+      result.main
+      (IxIR0.Readdress.Value.mapAddresses
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap) value) := by
+  apply run_projectionSafeMain_of_run_eq_ok hrun
+    (fun _ _ => none) (fun _ _ => none) _ trace
+  intro address arguments
+  rfl
+
+/-- Executable-oracle specialization of closed evaluator transport. The
+caller proves only the compact legacy-oracle coherence law; the addressed
+oracle and the full evaluator compatibility equation are constructed here. -/
+theorem run_readdressOracle_semantics_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    (beforeOracle : IxIR0.Oracle)
+    (horacle : IxIR0.Readdress.Oracle.Readdressable result.addressMap
+      beforeOracle)
+    (evalFuel : Nat := 100000) :
+    (result.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress result.addressMap beforeOracle)).run
+        result.main evalFuel =
+      IxIR0.Readdress.mapResult
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap)
+        ((result.addressed.preAddressCtx result.groups beforeOracle).run
+          main evalFuel) :=
+  run_semantics_of_run_eq_ok hrun beforeOracle
+    (IxIR0.Readdress.Oracle.readdress result.addressMap beforeOracle)
+    (IxIR0.Readdress.Oracle.readdress_compatible horacle) evalFuel
+
+/-- Executable-oracle specialization of exact call-aware trace transport. -/
+theorem run_readdressOracle_projectionSafeMain_of_run_eq_ok
+    {ctx : Erase.EraseCtx} {consts : List (Address × Constant)}
+    {main : IxIR0.Expr} {eraseFuel : Nat} {result : Result}
+    (hrun : run ctx consts main eraseFuel = .ok result)
+    (beforeOracle : IxIR0.Oracle)
+    (horacle : IxIR0.Readdress.Oracle.Readdressable result.addressMap
+      beforeOracle)
+    {traceFuel : Nat} {value : IxIR0.Value}
+    (trace : IxIR0.ProjectionSafe.Eval (result.rawCtx beforeOracle)
+      traceFuel [] main value) :
+    IxIR0.ProjectionSafe.Eval
+      (result.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress result.addressMap beforeOracle))
+      traceFuel [] result.main
+      (IxIR0.Readdress.Value.mapAddresses
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap) value) :=
+  run_projectionSafeMain_of_run_eq_ok hrun beforeOracle
+    (IxIR0.Readdress.Oracle.readdress result.addressMap beforeOracle)
+    (IxIR0.Readdress.Oracle.readdress_compatible horacle) trace
+
+end Ix.Compiler.EraseAddressed
diff --git a/Ix/Compiler/EraseValidator.lean b/Ix/Compiler/EraseValidator.lean
new file mode 100644
index 000000000..642be9cee
--- /dev/null
+++ b/Ix/Compiler/EraseValidator.lean
@@ -0,0 +1,1538 @@
+import Ix.Compiler.Sim
+
+/-!
+# Proof-producing executable-erasure validator
+
+`Erase.eraseExpr` intentionally accepts more syntax than the core fragment
+covered directly by `Sim.PErase`: general dropped-variable reads still need
+their simulation machinery. Unfoldable definition projections and non-self
+inductive members are checked structurally. Non-self unfoldable-definition and
+recursor heads are admitted through a finite `MemberScope`; after public
+coverage succeeds, `validateMemberCoverage` checks every named body/rule set
+against that same plan, closing cyclic blocks without recursive validator
+calls. Configured opaque mutual projections and members are admitted only when
+the source extern arity and target declaration agree at the exact synthetic
+member address; semantic oracle agreement remains a theorem premise.
+Constructor parameter prefixes are certified by `CtorParamSpine`; partial and
+split prefixes use ignored target wrappers, while complete visible prefixes
+expose the field-arity constructor. Indexed recursor spines use
+`RecEraseSpine`; a spine that stops in its source-only index suffix is
+certified by structurally reconstructing the let-captured ignored continuation
+(`PErase.recW`), including after escape through a variable or let. Rule-local
+indexed `recur` heads use the environment's already-certified self member, so
+rule validation does not recurse through its own member oracle.
+Ordinary unfoldable definition heads use `DefSpine`: declaration-type policy
+must agree with the literal implementation binder before a ghost argument is
+certified. Definition coverage also reconstructs the fuel-free
+`TeleResultOwned` relation, so the emitted declaration's ownership cannot
+drift from the source telescope. Configured quotient coverage checks the
+address/kind identity, exact compiler-generated lambda body, and the same
+result-ownership relation. Opaque definitions and axioms are certified only
+when the source evaluator is configured at the compiler-emitted extern arity;
+their semantic oracle correspondence remains an explicit theorem premise. Raw
+`.share` syntax also stays out of `PErase`, but the
+`certifyShared*` entry points validate the real eraser output against the
+semantically inlined source. This module provides the roadmap-approved
+bridge between the executable pass and the theorem: run the real eraser,
+check its exact output against the relation, and return the `PErase` proof
+as part of the result.
+
+The validator is deliberately partial in the proof sense, not in Lean's
+termination sense.  It rejects an executable erasure that lies outside the
+current simulation fragment.  A successful result cannot drift from the
+compiler output: `CertifiedExpr.erased` records the actual `eraseExpr`
+equation and `CertifiedExpr.related` records the kernel-checked relational
+witness for that same target expression. `CertifiedSharedExpr` adds the
+inlining/evaluator-coherence bridge while retaining the original erasure
+equation.
+-/
+
+namespace Ix.Compiler.EraseValidator
+
+open Ix.Compiler.Ixon (Address Constant MutConst Owned Recursor RecursorRule Uses)
+open Ix.Compiler.Sim
+
+/-- Use exactly the evaluator's resolver, blob store, and Nat identity when
+running the executable eraser for a simulation certificate. Quotient identity
+is not an eraser input: it remains on `ectx` and is checked by
+`validateCovered` before a quotient reference receives a certificate.
+
+Parameterized constructor heads use the same ignored-wrapper lowering as the
+executable eraser. The validator reconstructs that wrapper structurally; no
+configuration switch separates raw and certified erasure. -/
+def eraseCtxOf (ectx : Ixon.Eval.EvalCtx) : Erase.EraseCtx :=
+  { resolve := ectx.resolve, blobs := ectx.blobs, natBlock := ectx.natBlock }
+
+/-- Eraser tables corresponding to semantic full inlining.  Reference and
+rule-state metadata are unchanged; source roots in mutual members are inlined
+against the same table as the enclosing expression, and the table is cleared. -/
+def inlineTables (T : Erase.ETables) : Erase.ETables :=
+  { sharing := #[]
+    refs := T.refs
+    selfMuts := T.selfMuts.map
+      (MutConst.mapExprs (Ixon.Sharing.inlineExpr T.sharing))
+    curBlock := T.curBlock
+    recSelf := T.recSelf }
+
+/-- The eraser-table view of an evaluator frame for a closed expression.
+`recSelf` is absent outside an individual recursor-rule certificate. -/
+def tablesOfFrame (F : Ixon.Eval.Frame) : Erase.ETables :=
+  { sharing := F.sharing
+    refs := F.refs
+    selfMuts := F.selfMuts
+    curBlock := F.selfAddr }
+
+/-- Normalizing eraser tables built from a frame is exactly the eraser-table
+view of the normalized evaluator frame. -/
+@[simp] theorem inlineTables_tablesOfFrame (F : Ixon.Eval.Frame) :
+    inlineTables (tablesOfFrame F) = tablesOfFrame F.inlineSharing := by
+  rfl
+
+@[simp] theorem inlineTables_refs (T : Erase.ETables) :
+    (inlineTables T).refs = T.refs := rfl
+
+@[simp] theorem inlineTables_curBlock (T : Erase.ETables) :
+    (inlineTables T).curBlock = T.curBlock := rfl
+
+@[simp] theorem inlineTables_recSelf (T : Erase.ETables) :
+    (inlineTables T).recSelf = T.recSelf := rfl
+
+section MemberScoped
+
+variable [scope : MemberScope]
+
+/-- Program-level facts are supplied independently of expression checking.
+This is the usual CompCert split: environment validation establishes
+`Covered`; expression validation consumes those facts at references. -/
+abbrev CoverOracle (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) :=
+  (a : Address) → Option (PLift (Covered ectx ictx a))
+
+/-- Indexed recursor spines cannot use `Covered`, because their bare target
+head has fewer visible arguments than the source head.  An entry-expression
+certificate instead supplies the already checked member fact directly. -/
+abbrev RecMemberOracle (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) :=
+  (block : Address) → (idx : Nat) → (bc : Constant) → (r : Recursor) →
+    Ixon.Eval.resolveMut ectx block idx = .ok (bc, .recr r) →
+    Option (PLift (RecMember ectx ictx block idx r))
+
+/-- The index-free default used by the existing public validator API. -/
+def noRecMembers {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx} :
+    RecMemberOracle ectx ictx :=
+  fun _ _ _ _ _ => none
+
+/-- A proof that `e` is an index-free recursor prefix, when it can be
+reconstructed directly from the current source frame. -/
+def recPrefix? (ectx : Ixon.Eval.EvalCtx) (refs : Array Address)
+    (muts : Array MutConst) (sa : Option Address) (e : Ixon.Expr) :
+    Option (Σ r : Recursor, PLift (RecPrefix ectx refs muts sa e r)) :=
+  match e with
+  | .ref refIdx _ =>
+    match href : refs[refIdx.toNat]? with
+    | some a =>
+      match hc : ectx.resolve a with
+      | some c =>
+        match hi : c.info with
+        | .rPrj p =>
+          match hm : Ixon.Eval.resolveMut ectx p.block p.idx.toNat with
+          | .ok (_bc, .recr r) =>
+            if hx : r.indices.toNat = 0 then
+              some ⟨r, ⟨.refH href hc hi hm hx⟩⟩
+            else none
+          | _ => none
+        | _ => none
+      | none => none
+    | none => none
+  | .recur recIdx _ =>
+    match sa with
+    | some _block =>
+      match hm : muts[recIdx.toNat]? with
+      | some (.recr r) =>
+        if hx : r.indices.toNat = 0 then
+          some ⟨r, ⟨.recurH rfl hm hx⟩⟩
+        else none
+      | _ => none
+    | none => none
+  | _ => none
+
+/-- Reconstruct a guarded recursor spine and its number of supplied
+pre-major arguments. The step constructor prevents walking past the
+parameter/motive/minor policy. -/
+def recSpine? (ectx : Ixon.Eval.EvalCtx) (refs : Array Address)
+    (muts : Array MutConst) (sa : Option Address) :
+    Nat → (e : Ixon.Expr) →
+      Option (Σ r : Recursor, Σ j : Nat,
+        PLift (RecSpine ectx refs muts sa e r j))
+  | 0, _ => none
+  | fuel + 1, e =>
+    match recPrefix? ectx refs muts sa e with
+    | some ⟨r, h⟩ => some ⟨r, 0, ⟨.head h.down⟩⟩
+    | none =>
+      match e with
+      | .app f _ =>
+        match recSpine? ectx refs muts sa fuel f with
+        | some ⟨r, j, h⟩ =>
+          if hj : j < (recRulePolicy r).length then
+            some ⟨r, j + 1, ⟨.step h.down hj⟩⟩
+          else none
+        | none => none
+      | _ => none
+
+/-- Dependent package returned while following an unfoldable ordinary
+definition through its literal implementation telescope. -/
+structure DefSpineCert (ectx : Ixon.Eval.EvalCtx)
+    (refs : Array Address) (e : Ixon.Expr) where
+  residual : Ixon.Expr
+  spine : DefSpine ectx refs e residual
+
+/-- Reconstruct the implementation-side definition spine used to justify a
+ghost application.  Declaration-type policy drives executable erasure; this
+second check ensures the lambda actually reached at run time drops the same
+argument. -/
+def defSpine? (ectx : Ixon.Eval.EvalCtx) (refs : Array Address) :
+    Nat → (e : Ixon.Expr) → Option (DefSpineCert ectx refs e)
+  | 0, _ => none
+  | fuel + 1, e =>
+    match e with
+    | .ref refIdx univIdxs =>
+      match hr : refs[refIdx.toNat]? with
+      | some address =>
+        match hc : ectx.resolve address with
+        | some constant =>
+          match hi : constant.info with
+          | .defn definition =>
+            match hu : Ixon.Eval.unfoldable definition with
+            | true => some
+                { residual := definition.value
+                  spine := .head hr hc hi hu }
+            | false => none
+          | _ => none
+        | none => none
+      | none => none
+    | .app function argument =>
+      match defSpine? ectx refs fuel function with
+      | some cert =>
+        match hr : cert.residual with
+        | .lam uses domain body => by
+            have hspine := cert.spine
+            rw [hr] at hspine
+            exact some
+              { residual := body
+                spine := .step hspine }
+        | _ => none
+      | none => none
+    | _ => none
+
+/-- Dependent package returned while reconstructing a syntactically visible
+constructor parameter spine. -/
+structure CtorParamSpineCert (ectx : Ixon.Eval.EvalCtx)
+    (refs : Array Address) (e : Ixon.Expr) where
+  address : Address
+  block : Address
+  indIdx : Nat
+  cidx : Nat
+  params : Nat
+  fields : Nat
+  consumed : Nat
+  spine : CtorParamSpine ectx refs e address block indIdx cidx params fields
+    consumed
+
+/-- Reconstruct a constructor head and the dropped-parameter prefix consumed
+so far.  Walking stops before the first runtime field. -/
+def ctorParamSpine? (ectx : Ixon.Eval.EvalCtx) (refs : Array Address) :
+    Nat → (e : Ixon.Expr) → Option (CtorParamSpineCert ectx refs e)
+  | 0, _ => none
+  | fuel + 1, e =>
+    match e with
+    | .ref refIdx _univIdxs =>
+      match hr : refs[refIdx.toNat]? with
+      | some a =>
+        match hc : ectx.resolve a with
+        | some c =>
+          match hi : c.info with
+          | .cPrj p =>
+            match hm : Ixon.Eval.resolveMut ectx p.block p.idx.toNat with
+            | .ok (bc, .indc ind) =>
+              match ht : ind.ctors[p.cidx.toNat]? with
+              | some ct =>
+                if hp : ind.params.toNat = ct.params.toNat then
+                  some
+                    { address := a
+                      block := p.block
+                      indIdx := p.idx.toNat
+                      cidx := p.cidx.toNat
+                      params := ct.params.toNat
+                      fields := ct.fields.toNat
+                      consumed := 0
+                      spine := .head hr hc hi
+                        ⟨bc, ind, ct, hm, ht, hp, rfl, rfl⟩ }
+                else none
+              | none => none
+            | _ => none
+          | _ => none
+        | none => none
+      | none => none
+    | .app f _arg =>
+      match ctorParamSpine? ectx refs fuel f with
+      | some cert =>
+        if hj : cert.consumed < cert.params then
+          some
+            { address := cert.address
+              block := cert.block
+              indIdx := cert.indIdx
+              cidx := cert.cidx
+              params := cert.params
+              fields := cert.fields
+              consumed := cert.consumed + 1
+              spine := .step cert.spine hj }
+        else none
+      | none => none
+    | _ => none
+
+private def fail {P : Prop} (msg : String) : Except String (PLift P) :=
+  .error msg
+
+/-- Construct the fuel-free result-ownership relation.  Fuel controls only
+checker termination: exhaustion rejects instead of manufacturing the shared
+default, so a successful certificate is independent of the chosen bound. -/
+def validateTeleResultOwned (sharing : Array Ixon.Expr) :
+    Nat → (typ : Ixon.Expr) →
+      Except String (Σ candidate : Option Owned,
+        PLift (TeleResultOwned sharing typ candidate))
+  | 0, _ => .error "result-ownership validation fuel exhausted"
+  | fuel + 1, typ =>
+    match typ with
+    | .all _uses result _domain codomain => do
+      let cert ← validateTeleResultOwned sharing fuel codomain
+      match cert with
+      | ⟨none, proof⟩ =>
+        pure ⟨some result, ⟨.allHere proof.down⟩⟩
+      | ⟨some inner, proof⟩ =>
+        pure ⟨some inner, ⟨.allInner proof.down⟩⟩
+    | .share index =>
+      match hlookup : sharing[index.toNat]? with
+      | none => .ok ⟨none, ⟨.shareMissing hlookup⟩⟩
+      | some target => do
+        let cert ← validateTeleResultOwned sharing fuel target
+        pure ⟨cert.1, ⟨.share hlookup cert.2.down⟩⟩
+    | .sort _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .var _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .ref _ _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .recur _ _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .prj _ _ _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .str _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .nat _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .app _ _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .lam _ _ _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+    | .letE _ _ _ _ => .ok ⟨none, ⟨.terminal rfl⟩⟩
+
+/-- Recognize the four closed quotient definitions emitted by the eraser.
+Keeping this structural avoids assuming a global decidable-equality law for
+IxIR₀ expressions merely to validate these fixed compiler-generated bodies. -/
+private def validateQuotientBody (kind : Ixon.QuotKind)
+    (body : IxIR0.Expr) :
+    Except String (PLift (body = Erase.quotientBody kind)) :=
+  match kind, body with
+  | .type, .erased => .ok ⟨rfl⟩
+  | .ctor, .lam .many (.lam .many (.lam .many (.var 0))) => .ok ⟨rfl⟩
+  | .lift,
+      .lam .many (.lam .many (.lam .many (.lam .many (.lam .many
+        (.lam .many (.app (.var 2) (.var 0))))))) => .ok ⟨rfl⟩
+  | .ind,
+      .lam .many (.lam .many (.lam .many (.lam .many
+        (.lam .many (.app (.var 1) (.var 0)))))) => .ok ⟨rfl⟩
+  | _, _ => .error "erased quotient body mismatch"
+
+/-- Check an ignored constructor-parameter wrapper without assuming global
+decidable equality for target expressions. -/
+private def validateCtorWrapper : (remaining : Nat) → (address : Address) →
+    (body : IxIR0.Expr) →
+      Except String (PLift (body = Erase.lamManyN remaining (.ref address)))
+  | 0, address, .ref target =>
+    if haddress : target = address then by
+      subst target
+      exact .ok ⟨rfl⟩
+    else .error "constructor wrapper address mismatch"
+  | remaining + 1, address, .lam .many body =>
+    match validateCtorWrapper remaining address body with
+    | .ok hbody => by
+      rw [hbody.down]
+      exact .ok ⟨rfl⟩
+    | .error message => .error message
+  | _ + 1, _, .lam _ _ => .error "constructor wrapper binder mode mismatch"
+  | _, _, _ => .error "constructor wrapper body mismatch"
+
+/-- Check the body of an indexed-recursor continuation.  `anchor` remains
+constant while ignored binders are peeled because it names the let-captured
+pre-major pap below the entire wrapper telescope. -/
+private def validateRecIndexWrapper : (remaining anchor : Nat) →
+    (body : IxIR0.Expr) →
+      Except String
+        (PLift (body = Erase.lamManyN remaining (.var anchor)))
+  | 0, anchor, .var target =>
+    if hindex : target = anchor then by
+      subst target
+      exact .ok ⟨rfl⟩
+    else .error "indexed recursor wrapper capture mismatch"
+  | remaining + 1, anchor, .lam .many body =>
+    match validateRecIndexWrapper remaining anchor body with
+    | .ok hbody => by
+      rw [hbody.down]
+      exact .ok ⟨rfl⟩
+    | .error message => .error message
+  | _ + 1, _, .lam _ _ =>
+      .error "indexed recursor wrapper binder mode mismatch"
+  | _, _, _ => .error "indexed recursor wrapper body mismatch"
+
+/-- Certify that a pending recursor-policy suffix contains only source drops. -/
+private def validateDropSuffix : (rest : List Erase.ArgPolicy) →
+    Except String
+      (PLift (rest = List.replicate rest.length Erase.ArgPolicy.drop))
+  | [] => .ok ⟨rfl⟩
+  | .drop :: rest =>
+    match validateDropSuffix rest with
+    | .ok hrest => by
+      rw [hrest.down]
+      exact .ok ⟨by simp [List.replicate_succ]⟩
+    | .error message => .error message
+  | _ :: _ => .error "indexed recursor wrapper begins before the index suffix"
+
+private def validateRecurSafety (muts : Array MutConst) (recIdx : UInt64) :
+    Except String (PLift (∀ r, muts[recIdx.toNat]? = some (.recr r) →
+      r.indices.toNat = 0)) :=
+  match hm : muts[recIdx.toNat]? with
+  | some (.recr r) =>
+    if hx : r.indices.toNat = 0 then
+      .ok ⟨by
+        intro r' hr
+        injection hr with heq
+        cases heq
+        exact hx⟩
+    else .error "indexed recursive self calls are outside the proved fragment"
+  | none => .ok ⟨by
+      intro r hr
+      simp at hr⟩
+  | some (.defn d) => .ok ⟨by
+      intro r hr
+      simp at hr⟩
+  | some (.indc ind) => .ok ⟨by
+      intro r hr
+      simp at hr⟩
+
+mutual
+  /-- Validate one source/target expression pair and construct its `PErase`
+  derivation.  This checks the relation rather than merely reimplementing an
+  equality test; the return type is the soundness theorem. -/
+  def validateExprWithRec (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+      (cover : CoverOracle ectx ictx) (recMembers : RecMemberOracle ectx ictx)
+      (sc : Option (Address × Nat)) (refs : Array Address)
+      (muts : Array MutConst) (sa : Option Address) (mask : List Bool) :
+      Nat → (e : Ixon.Expr) → (e' : IxIR0.Expr) →
+        Except String (PLift (PErase ectx ictx sc refs muts sa mask e e'))
+    | 0, _, _ => fail "validation fuel exhausted"
+    | fuel + 1, e, e' =>
+      match validateRecSpine ectx ictx cover recMembers sc refs muts sa mask
+          fuel e e' with
+      | .ok ⟨r, [], hs⟩ => .ok ⟨.recP hs.down⟩
+      | _ =>
+        match e, e' with
+        | .var i, .var j =>
+          if hij : i.toNat = j then
+            match hm : mask[i.toNat]? with
+            | some true => by
+              subst j
+              exact .ok ⟨.var hm⟩
+            | _ => fail s!"variable {i.toNat} is not a kept slot"
+          else fail "variable index mismatch"
+        | .sort _, .erased => .ok ⟨.sortE⟩
+        | .all _ _ _ _, .erased => .ok ⟨.allE⟩
+        | .lam u dom body, .lam u' body' =>
+          match hd : dropB u dom with
+          | true =>
+            if hu : u' = .many then by
+              subst u'
+              match validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+                  (false :: mask) fuel body body' with
+              | .ok hb => exact .ok ⟨.lamD hd hb.down⟩
+              | .error msg => exact .error msg
+            else fail "dropped lambda binder did not lower to many"
+          | false =>
+            if hu : u' = u then by
+              subst u'
+              match validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+                  (true :: mask) fuel body body' with
+              | .ok hb => exact .ok ⟨.lamK hd hb.down⟩
+              | .error msg => exact .error msg
+            else fail "kept lambda binder mode changed"
+        | source, .lam .many body' =>
+          match ctorParamSpine? ectx refs (fuel + 1) source with
+          | some cert =>
+            if hj : cert.consumed < cert.params then
+              match validateCtorWrapper
+                  (cert.params - cert.consumed - 1) cert.address body' with
+              | .error message => .error message
+              | .ok hbody => by
+                rw [hbody.down]
+                exact match he : ictx.env cert.address with
+                | some (.ctor tag fields) =>
+                  if ht : cert.cidx = tag then by
+                    subst tag
+                    exact if hf : cert.fields = fields then by
+                      subst fields
+                      exact .ok ⟨.ctorW cert.spine hj he⟩
+                    else fail "constructor field count mismatch"
+                  else fail "constructor tag mismatch"
+                | _ => fail "erased constructor declaration is missing"
+            else fail "constructor wrapper has no remaining parameters"
+          | none => fail "source is not a partial constructor parameter spine"
+        | .app f a, .app f' .erased =>
+          let normal (f₀ a₀ : Ixon.Expr) (f₀' a₀' : IxIR0.Expr) :
+              Except String (PLift (PErase ectx ictx sc refs muts sa mask
+                (.app f₀ a₀) (.app f₀' a₀'))) := do
+            let hf ← validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+              mask fuel f₀ f₀'
+            let ha ← validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+              mask fuel a₀ a₀'
+            pure ⟨.app hf.down ha.down⟩
+          let fallback : Except String
+              (PLift (PErase ectx ictx sc refs muts sa mask
+                (.app f a) (.app f' .erased))) :=
+            match f with
+            | .lam u dom body =>
+              match hd : dropB u dom with
+              | true => do
+                let hf ← validateExprWithRec ectx ictx cover recMembers sc refs muts sa mask
+                  fuel (.lam u dom body) f'
+                pure ⟨.appE hd hf.down⟩
+              | false => normal (.lam u dom body) a f' .erased
+            | other => normal other a f' .erased
+          let definitionFallback : Except String
+              (PLift (PErase ectx ictx sc refs muts sa mask
+                (.app f a) (.app f' .erased))) :=
+            match defSpine? ectx refs (fuel + 1) f with
+            | some cert =>
+              match hr : cert.residual with
+              | .lam uses domain body =>
+                match hd : dropB uses domain with
+                | true => by
+                  have hspine := cert.spine
+                  rw [hr] at hspine
+                  exact do
+                    let hf ← validateExprWithRec ectx ictx cover recMembers sc
+                      refs muts sa mask fuel f f'
+                    pure ⟨.appDG hspine hd hf.down⟩
+                | false => fallback
+              | _ => fallback
+            | none => fallback
+          match recSpine? ectx refs muts sa (fuel + 1) f with
+          | some ⟨r, j, hs⟩ =>
+            match hj : (recRulePolicy r)[j]? with
+            | some .ghost => do
+              let hf ← validateExprWithRec ectx ictx cover recMembers sc refs muts sa mask
+                fuel f f'
+              pure ⟨.appG hs.down hj hf.down⟩
+            | _ => definitionFallback
+          | none => definitionFallback
+        | .app f a, .app f' a' => do
+          let hf ← validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+            mask fuel f f'
+          let ha ← validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+            mask fuel a a'
+          pure ⟨.app hf.down ha.down⟩
+        | .app f a, .ref a' =>
+          match ctorParamSpine? ectx refs (fuel + 1) (.app f a) with
+          | some cert =>
+            if ha : cert.address = a' then by
+              subst a'
+              exact if hp : 0 < cert.params then
+                if hj : cert.consumed = cert.params then
+                  match he : ictx.env cert.address with
+                  | some (.ctor tag fields) =>
+                    if ht : cert.cidx = tag then by
+                      subst tag
+                      exact if hf : cert.fields = fields then by
+                        subst fields
+                        have hspine := cert.spine
+                        rw [hj] at hspine
+                        exact .ok ⟨.ctorP hp hspine he⟩
+                      else fail "constructor field count mismatch"
+                    else fail "constructor tag mismatch"
+                  | _ => fail "erased constructor declaration is missing"
+                else fail "constructor parameter prefix is incomplete"
+              else fail "constructor drop spine has no parameters"
+            else fail "constructor address mismatch"
+          | none => fail "source is not a visible constructor parameter spine"
+        | source, .letE .many val' body' =>
+          match validateRecSpine ectx ictx cover recMembers sc refs muts sa mask
+              fuel source val' with
+          | .ok ⟨r, rest, hs⟩ =>
+            if hpositive : 0 < rest.length then
+              match validateDropSuffix rest with
+              | .error message => .error message
+              | .ok hrest =>
+                match validateRecIndexWrapper rest.length rest.length body' with
+                | .error message => .error message
+                | .ok hbody => by
+                  rw [hrest.down] at hs
+                  rw [hbody.down]
+                  simpa [Erase.captureThenIgnoreN] using
+                    (.ok ⟨PErase.recW hs.down hpositive⟩ :
+                      Except String (PLift (PErase ectx ictx sc refs muts sa
+                        mask source
+                        (Erase.captureThenIgnoreN rest.length val'))))
+            else fail "indexed recursor wrapper has no pending indices"
+          | .error _ =>
+            match source with
+            | .letE _ _ val body => do
+              let hv ← validateExprWithRec ectx ictx cover recMembers sc refs
+                muts sa mask fuel val val'
+              let hb ← validateExprWithRec ectx ictx cover recMembers sc refs
+                muts sa (true :: mask) fuel body body'
+              pure ⟨.letE hv.down hb.down⟩
+            | _ => fail "target let is not an indexed recursor wrapper"
+        | .ref idx us, .ref a' =>
+          match hr : refs[idx.toNat]? with
+          | some a =>
+            if ha : a = a' then by
+              subst a'
+              match hc : cover a with
+              | some cov => exact .ok ⟨.ref hr cov.down⟩
+              | none => exact fail "reference lacks a Covered certificate"
+            else fail "reference address mismatch"
+          | none => fail s!"reference {idx.toNat} is out of range"
+        | .recur recIdx us, .ref member =>
+          match sa with
+          | some block =>
+            if hmember : member =
+                Erase.memberAddr block recIdx.toNat then by
+              subst member
+              exact match hm : Ixon.Eval.resolveMut ectx block
+                  recIdx.toNat with
+              | .ok (bc, .defn d) =>
+                if hrefs : refs = bc.refs then
+                  if hmuts : muts = Ixon.selfMutsOf bc.info then
+                    match hu : Ixon.Eval.unfoldable d with
+                    | true =>
+                      if hplan : (⟨block, recIdx.toNat⟩ : MemberKey) ∈
+                          scope.plan then
+                        .ok ⟨.recurD rfl hm hrefs hmuts hu hplan⟩
+                      else fail
+                        "definition member is absent from the simultaneous plan"
+                    | false =>
+                      match hconfigured : ectx.externArity
+                          (Erase.memberAddr block recIdx.toNat) with
+                      | none => fail
+                          "opaque definition member extern is not configured"
+                      | some arity =>
+                        if hplan : (⟨block, recIdx.toNat⟩ : MemberKey) ∈
+                            scope.plan then
+                          .ok ⟨.recurO rfl hm hrefs hmuts hu hconfigured hplan⟩
+                        else fail
+                          "opaque definition member is absent from the simultaneous plan"
+                  else fail "definition-member frame table mismatch"
+                else fail "definition-member refs mismatch"
+              | .ok (bc, .recr r) =>
+                if hrefs : refs = bc.refs then
+                  if hmuts : muts = Ixon.selfMutsOf bc.info then
+                    if hi : r.indices.toNat = 0 then
+                      if hplan : (⟨block, recIdx.toNat⟩ : MemberKey) ∈
+                          scope.plan then
+                        .ok ⟨.recurR rfl hm hrefs hmuts hi hplan⟩
+                      else fail
+                        "recursor member is absent from the simultaneous plan"
+                    else fail
+                      "indexed recursor member requires protected-spine validation"
+                  else fail "recursor-member frame table mismatch"
+                else fail "recursor-member refs mismatch"
+              | .ok (bc, .indc ind) =>
+                if hrefs : refs = bc.refs then
+                  match hi : muts[recIdx.toNat]? with
+                  | some (.indc frameInd) =>
+                    if hind : frameInd = ind then by
+                      subst frameInd
+                      exact match he : ictx.env
+                          (Erase.memberAddr block recIdx.toNat) with
+                      | some (.defn .shared .erased) =>
+                        .ok ⟨.recurI rfl hm hrefs hi he⟩
+                      | _ => fail "erased inductive member is missing"
+                    else fail "non-self recur mutual member mismatch"
+                  | _ => fail
+                      "non-self recur does not target an inductive member"
+                else fail "non-self recur refs mismatch"
+              | .error _ => fail "non-self recur member is unresolved"
+            else fail "non-self recur member address mismatch"
+          | none => fail "non-self recur is outside a mutual block"
+        | .recur recIdx us, .var j =>
+          match sc with
+          | some (block, idx) =>
+            if hi : recIdx.toNat = idx then
+              if hj : mask.length = j then by
+                subst j
+                match validateRecurSafety muts recIdx with
+                | .ok hs => exact .ok ⟨.recurS hi hs.down⟩
+                | .error msg => exact .error msg
+              else fail "recursor-self slot mismatch"
+            else fail "recursor-self member mismatch"
+          | none => fail "non-self recur is outside the proved fragment"
+        | .nat idx, .lit (.nat n') =>
+          match hr : refs[idx.toNat]? with
+          | some a =>
+            match hb : ectx.blobs a with
+            | some (.natB n) =>
+              if hn : n = n' then by
+                subst n'
+                exact .ok ⟨.natE hr hb⟩
+              else fail "nat literal value mismatch"
+            | _ => fail "nat literal blob mismatch"
+          | none => fail s!"nat literal ref {idx.toNat} is out of range"
+        | .str idx, .lit (.str s') =>
+          match hr : refs[idx.toNat]? with
+          | some a =>
+            match hb : ectx.blobs a with
+            | some (.strB s) =>
+              if hs : s = s' then by
+                subst s'
+                exact .ok ⟨.strE hr hb⟩
+              else fail "string literal value mismatch"
+            | _ => fail "string literal blob mismatch"
+          | none => fail s!"string literal ref {idx.toNat} is out of range"
+        | .prj _ fieldIdx val, .proj fieldIdx' val' =>
+          if hi : fieldIdx.toNat = fieldIdx' then by
+            subst fieldIdx'
+            match validateExprWithRec ectx ictx cover recMembers sc refs muts sa mask
+                fuel val val' with
+            | .ok hv => exact .ok ⟨.prjE hv.down⟩
+            | .error msg => exact .error msg
+          else fail "projection field mismatch"
+        | .share _, _ =>
+          fail "raw shares require sharing-aware inlining before PErase validation"
+        | _, _ => fail "source and target erasure shapes do not match"
+
+  /-- Reconstruct the exact visible prefix of an indexed recursor.  A `drop`
+  step consumes only the source argument; `keep` and `ghost` steps follow the
+  target application spine. -/
+  def validateRecSpine (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+      (cover : CoverOracle ectx ictx) (recMembers : RecMemberOracle ectx ictx)
+      (sc : Option (Address × Nat)) (refs : Array Address)
+      (muts : Array MutConst) (sa : Option Address) (mask : List Bool) :
+      Nat → (e : Ixon.Expr) → (e' : IxIR0.Expr) →
+        Except String (Σ r : Recursor, Σ rest : List Erase.ArgPolicy,
+          PLift (RecEraseSpine ectx ictx sc refs muts sa mask e e' r rest))
+    | 0, _, _ => .error "indexed recursor-spine validation fuel exhausted"
+    | fuel + 1, e, e' =>
+      match e with
+      | .ref refIdx univIdxs =>
+        match e' with
+        | .ref a' =>
+          match hr : refs[refIdx.toNat]? with
+          | some a =>
+            if ha : a = a' then
+              match hc : ectx.resolve a with
+              | some c =>
+                match hi : c.info with
+                | .rPrj p =>
+                  match hm : Ixon.Eval.resolveMut ectx p.block p.idx.toNat with
+                  | .ok (bc, .recr r) =>
+                    if hx : 0 < r.indices.toNat then
+                      match hd : ictx.env a with
+                      | some (.defn .shared (.ref member)) =>
+                        if hmember : member =
+                            Erase.memberAddr p.block p.idx.toNat then
+                          match ho : recMembers p.block p.idx.toNat bc r hm with
+                          | some hrec => by
+                            subst a'
+                            subst member
+                            exact .ok ⟨r, recPolicy r,
+                              ⟨.head hr hc hi hm hx hd hrec.down⟩⟩
+                          | none =>
+                            .error
+                              "indexed recursor member lacks a certificate"
+                        else .error
+                          "indexed recursor projection points at the wrong member"
+                      | _ => .error
+                          "indexed recursor projection declaration is missing"
+                    else .error "recursor has no source-only indices"
+                  | _ => .error
+                      "recursor projection does not resolve to a recursor"
+                | _ => .error
+                    "source reference is not a recursor projection"
+              | none => .error "recursor projection address is unresolved"
+            else .error "indexed recursor projection address mismatch"
+          | none => .error "indexed recursor source reference is out of range"
+        | _ => .error "indexed recursor head did not erase to a reference"
+      | .recur recIdx univIdxs =>
+        match e' with
+        | .var targetIndex =>
+          match sc with
+          | some (block, idx) =>
+            if hself : recIdx.toNat = idx then
+              if hslot : mask.length = targetIndex then by
+                subst targetIndex
+                exact if hsa : sa = some block then
+                  match hm : Ixon.Eval.resolveMut ectx block idx with
+                  | .ok (bc, .recr r) =>
+                    if hx : 0 < r.indices.toNat then
+                      if hrefs : refs = bc.refs then
+                        match hlookup : muts[recIdx.toNat]? with
+                        | some (.recr selfR) =>
+                          if hrecur : selfR = r then by
+                            subst selfR
+                            exact .ok ⟨r, recPolicy r,
+                              ⟨.selfHead rfl hsa hself hm hrefs hlookup hx⟩⟩
+                          else .error
+                            "indexed recursive self recursor mismatch"
+                        | _ => .error
+                            "indexed recursive self mutual slot mismatch"
+                      else .error "indexed recursive self refs mismatch"
+                    else .error "recursive self has no source-only indices"
+                  | _ => .error "indexed recursive self does not resolve"
+                else .error "indexed recursive self block mismatch"
+              else .error "indexed recursive self slot mismatch"
+            else .error "indexed recursive self member mismatch"
+          | none => .error "indexed recursive self lacks a self context"
+        | .ref member =>
+          match sa with
+          | some block =>
+            if hmember : member =
+                Erase.memberAddr block recIdx.toNat then by
+              subst member
+              exact match hm : Ixon.Eval.resolveMut ectx block
+                  recIdx.toNat with
+              | .ok (bc, .recr r) =>
+                if hx : 0 < r.indices.toNat then
+                  if hrefs : refs = bc.refs then
+                    if hmuts : muts = Ixon.selfMutsOf bc.info then
+                      if hplan : (⟨block, recIdx.toNat⟩ : MemberKey) ∈
+                          scope.plan then
+                        .ok ⟨r, recPolicy r,
+                          ⟨.memberHead rfl hm hrefs hmuts hx hplan⟩⟩
+                      else .error
+                        "indexed recursor is absent from the simultaneous plan"
+                    else .error "indexed recursor frame table mismatch"
+                  else .error "indexed recursor refs mismatch"
+                else .error "recursor has no source-only indices"
+              | _ => .error "mutual member is not an indexed recursor"
+            else .error "indexed mutual recursor member address mismatch"
+          | none => .error "indexed mutual recursor is outside a block"
+        | _ => .error "indexed recursive self head did not erase to its slot"
+      | .app f a =>
+        match validateRecSpine ectx ictx cover recMembers sc refs muts sa mask
+            fuel f e' with
+        | .ok ⟨r, .drop :: rest, hs⟩ =>
+          .ok ⟨r, rest, ⟨.drop hs.down⟩⟩
+        | _ =>
+          match e' with
+          | .app f' a' =>
+            match validateRecSpine ectx ictx cover recMembers sc refs muts sa
+                mask fuel f f' with
+            | .ok ⟨r, .keep :: rest, hs⟩ =>
+              match validateExprWithRec ectx ictx cover recMembers sc refs muts
+                  sa mask fuel a a' with
+              | .ok ha => .ok ⟨r, rest, ⟨.keep hs.down ha.down⟩⟩
+              | .error msg => .error msg
+            | .ok ⟨r, .ghost :: rest, hs⟩ =>
+              match a' with
+              | .erased => .ok ⟨r, rest, ⟨.ghost hs.down⟩⟩
+              | _ => .error "recursor ghost argument is not erased"
+            | .ok ⟨_, .drop :: _, _⟩ =>
+              .error "recursor drop unexpectedly emitted a target argument"
+            | .ok ⟨_, [], _⟩ =>
+              .error "recursor spine extends past the pre-major policy"
+            | .error msg => .error msg
+          | _ => .error "recursor keep/ghost step lacks a target application"
+      | _ => .error "source is not a visible indexed recursor spine"
+end
+
+/-- Backward-compatible index-free validator entry point. -/
+def validateExpr (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (cover : CoverOracle ectx ictx)
+    (sc : Option (Address × Nat)) (refs : Array Address)
+    (muts : Array MutConst) (sa : Option Address) (mask : List Bool)
+    (fuel : Nat) (e : Ixon.Expr) (e' : IxIR0.Expr) :
+    Except String (PLift (PErase ectx ictx sc refs muts sa mask e e')) :=
+  validateExprWithRec ectx ictx cover noRecMembers sc refs muts sa mask
+    fuel e e'
+
+/-- Extract the relation proof from a successful validation.  Concrete
+programs normally discharge `h` by reduction (`rfl`/`decide`), replacing a
+hand-written `PErase` constructor tree with one checked computation. -/
+theorem related_of_validateExprWithRec
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {cover : CoverOracle ectx ictx}
+    {recMembers : RecMemberOracle ectx ictx}
+    {sc : Option (Address × Nat)} {refs : Array Address}
+    {muts : Array MutConst} {sa : Option Address}
+    {mask : List Bool} {fuel : Nat} {e : Ixon.Expr} {e' : IxIR0.Expr}
+    (h : (validateExprWithRec ectx ictx cover recMembers sc refs muts sa
+      mask fuel e e').toOption.isSome) :
+    PErase ectx ictx sc refs muts sa mask e e' :=
+  ((validateExprWithRec ectx ictx cover recMembers sc refs muts sa mask
+    fuel e e').toOption.get h).down
+
+theorem related_of_validateExpr
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {cover : CoverOracle ectx ictx} {sc : Option (Address × Nat)}
+    {refs : Array Address} {muts : Array MutConst} {sa : Option Address}
+    {mask : List Bool} {fuel : Nat} {e : Ixon.Expr} {e' : IxIR0.Expr}
+    (h : (validateExpr ectx ictx cover sc refs muts sa mask fuel e e').toOption.isSome) :
+    PErase ectx ictx sc refs muts sa mask e e' :=
+  ((validateExpr ectx ictx cover sc refs muts sa mask fuel e e').toOption.get h).down
+
+/-! ## Program coverage validation
+
+Expression validation consumes `Covered` facts.  The finite database and
+validators below construct those facts from the source resolver and target
+environment.  Dependencies are supplied in topological order; this is an
+explicit certificate schedule, not trusted graph analysis. -/
+
+structure CoveredEntry (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) where
+  address : Address
+  covered : Covered ectx ictx address
+
+abbrev CoverageDB (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) :=
+  List (CoveredEntry ectx ictx)
+
+def CoverageDB.lookup {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx} :
+    CoverageDB ectx ictx → (a : Address) → Option (PLift (Covered ectx ictx a))
+  | [], _ => none
+  | entry :: rest, a =>
+    if h : entry.address = a then
+      some ⟨by cases h; exact entry.covered⟩
+    else lookup rest a
+
+def CoverageDB.oracle {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    (db : CoverageDB ectx ictx) : CoverOracle ectx ictx :=
+  db.lookup
+
+/-- Validate the finite mutual-block parameter layout stored by `RecMember`.
+Only inductive members constrain the common count. -/
+def validateBlockParams (params : Nat) :
+    (members : List MutConst) →
+      Except String (PLift (BlockParams params members))
+  | [] => .ok ⟨.nil⟩
+  | .defn _ :: rest => do
+      let hrest ← validateBlockParams params rest
+      pure ⟨.defn hrest.down⟩
+  | .recr _ :: rest => do
+      let hrest ← validateBlockParams params rest
+      pure ⟨.recr hrest.down⟩
+  | .indc ind :: rest =>
+      if hp : ind.params.toNat = params then do
+        let hrest ← validateBlockParams params rest
+        pure ⟨.indc hp hrest.down⟩
+      else fail "mutual-block inductive parameter count disagrees with recursor"
+
+/-- Validate corresponding recursor rules, including each peeled body. -/
+def validateRules (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (db : CoverageDB ectx ictx) (block : Address) (idx : Nat)
+    (r : Recursor) (refs : Array Address) (muts : Array MutConst) :
+    Nat → (rules : List RecursorRule) → (trules : List IxIR0.RecRule) →
+      Except String (PLift
+        (RulesRel ectx ictx block idx r refs muts rules trules))
+  | 0, _, _ => fail "rule validation fuel exhausted"
+  | _ + 1, [], [] => .ok ⟨.nil⟩
+  | fuel + 1, rule :: rest, trule :: trest =>
+    if hf : trule.fields = rule.fields.toNat then
+      match hp : peelChain
+          (r.params.toNat + r.motives.toNat + r.minors.toNat +
+            rule.fields.toNat)
+          rule.rhs with
+      | some body => do
+        let hb ← validateExpr ectx ictx db.oracle (some (block, idx))
+          refs muts (some block)
+          (recRuleMask r rule.fields.toNat)
+          fuel body trule.rhs
+        let hr ← validateRules ectx ictx db block idx r refs muts
+          fuel rest trest
+        pure ⟨.cons hf hp hb.down hr.down⟩
+      | none => fail "recursor rule is not a literal lambda chain"
+    else fail "recursor rule field count mismatch"
+  | _ + 1, _, _ => fail "recursor rule list length mismatch"
+
+/-- Validate the member-level declaration and rules for one recursor. -/
+def validateRecMember (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (db : CoverageDB ectx ictx) (block : Address) (idx : Nat)
+    (bc : Constant) (r : Recursor)
+    (hm : Ixon.Eval.resolveMut ectx block idx = .ok (bc, .recr r))
+    (fuel : Nat) : Except String (PLift (RecMember ectx ictx block idx r)) :=
+  match validateBlockParams r.params.toNat
+      (Ixon.selfMutsOf bc.info).toList with
+  | .error msg => .error msg
+  | .ok hparams =>
+    match he : ictx.env (Erase.memberAddr block idx) with
+    | some (.recursor n natLit trules) =>
+      if hn : n = r.params.toNat + r.motives.toNat +
+          r.minors.toNat then
+        if hl : natLit = (ectx.natBlock == some block) then
+          match validateRules ectx ictx db block idx r bc.refs
+              (Ixon.selfMutsOf bc.info) fuel r.rules.toList
+              trules.toList with
+          | .ok hrs => by
+            subst n
+            subst natLit
+            exact .ok ⟨.mk hm hparams.down he hrs.down⟩
+          | .error msg => .error msg
+        else fail "recursor natLit identity mismatch"
+      else fail "recursor erased arity mismatch"
+    | _ => fail "erased recursor member declaration is missing"
+
+/-- Extract a member certificate from one successful checked computation. -/
+theorem recMember_of_validate
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {db : CoverageDB ectx ictx} {block : Address} {idx : Nat}
+    {bc : Constant} {r : Recursor}
+    {hm : Ixon.Eval.resolveMut ectx block idx = .ok (bc, .recr r)}
+    {fuel : Nat}
+    (h : (validateRecMember ectx ictx db block idx bc r hm fuel).toOption.isSome) :
+    RecMember ectx ictx block idx r :=
+  ((validateRecMember ectx ictx db block idx bc r hm fuel).toOption.get h).down
+
+/-- Validate one address against the source resolver and erased target
+environment, constructing the corresponding `Covered` proof. -/
+def validateCovered (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (db : CoverageDB ectx ictx) (fuel : Nat) (a : Address) :
+    Except String (PLift (Covered ectx ictx a)) :=
+  match fuel with
+  | 0 => fail "coverage validation fuel exhausted"
+  | fuel + 1 =>
+    match hc : ectx.resolve a with
+    | none => fail "coverage address is absent from the source resolver"
+    | some c =>
+      match hi : c.info with
+      | .defn d =>
+        match hu : Ixon.Eval.unfoldable d with
+        | true =>
+          match he : ictx.env a with
+          | some (.defn result body') => do
+            let hresult ← validateTeleResultOwned c.sharing fuel d.typ
+            if heq : result = hresult.1.getD .shared then
+              let hb ← validateExpr ectx ictx db.oracle none c.refs
+                (Ixon.selfMutsOf c.info) none [] fuel d.value body'
+              let howned : DefinitionResultOwned c.sharing d.typ result :=
+                ⟨hresult.1, hresult.2.down, heq⟩
+              pure ⟨.defn hc hi hu he howned hb.down⟩
+            else fail "definition result ownership mismatch"
+          | _ => fail "erased definition is missing"
+        | false =>
+          match hconfigured : ectx.externArity a with
+          | none => fail "extern address is not configured"
+          | some arity =>
+            match he : ictx.env a with
+            | some (.extern targetArity) =>
+              if harity : targetArity = arity then by
+                subst targetArity
+                exact .ok ⟨.externDefn hc hi hu hconfigured he⟩
+              else fail "configured extern arity mismatch"
+            | _ => fail "erased extern declaration is missing"
+      | .axio ax =>
+        match hconfigured : ectx.externArity a with
+        | none => fail "extern address is not configured"
+        | some arity =>
+          match he : ictx.env a with
+          | some (.extern targetArity) =>
+            if harity : targetArity = arity then by
+              subst targetArity
+              exact .ok ⟨.externAxio hc hi hconfigured he⟩
+            else fail "configured extern arity mismatch"
+          | _ => fail "erased extern declaration is missing"
+      | .cPrj p =>
+        match hm : Ixon.Eval.resolveMut ectx p.block p.idx.toNat with
+        | .ok (bc, .indc ind) =>
+          match ht : ind.ctors[p.cidx.toNat]? with
+          | some ct =>
+            if hip : ind.params.toNat = 0 then
+              if hcp : ct.params.toNat = 0 then
+                match he : ictx.env a with
+                | some (.ctor tag fields) =>
+                  if htag : p.cidx.toNat = tag then
+                    if hfields : ct.fields.toNat = fields then by
+                      subst tag
+                      subst fields
+                      let shape : CtorShape ectx p.block p.idx.toNat
+                          p.cidx.toNat 0 ct.fields.toNat :=
+                        ⟨bc, ind, ct, hm, ht, hip, hcp, rfl⟩
+                      exact .ok ⟨.ctor hc hi shape he⟩
+                    else fail "constructor field count mismatch"
+                  else fail "constructor tag mismatch"
+                | _ => fail "erased constructor declaration is missing"
+              else fail "bare parameterized constructor heads are outside Covered"
+            else fail "inductive parameters are outside the current simulation fragment"
+          | none => fail "constructor projection is out of range"
+        | _ => fail "constructor projection does not resolve to an inductive"
+      | .iPrj p =>
+        match he : ictx.env a with
+        | some (.defn .shared .erased) => .ok ⟨.tyf hc hi he⟩
+        | _ => fail "erased inductive-type projection is missing"
+      | .quot q =>
+        match hconfigured : ectx.quotientKind a with
+        | none => fail "quotient address is not configured"
+        | some kind =>
+          if hkind : kind = q.kind then by
+            subst kind
+            exact match he : ictx.env a with
+            | some (.defn result body) =>
+              match validateQuotientBody q.kind body with
+              | .error msg => .error msg
+              | .ok hbody => by
+                rw [hbody.down] at he
+                exact do
+                  let hresult ← validateTeleResultOwned c.sharing fuel q.typ
+                  if heq : result = hresult.1.getD .shared then
+                    let howned : DefinitionResultOwned c.sharing q.typ result :=
+                      ⟨hresult.1, hresult.2.down, heq⟩
+                    pure ⟨.quot hc hi hconfigured he howned⟩
+                  else fail "quotient result ownership mismatch"
+            | _ => fail "erased quotient declaration is missing"
+          else fail "configured quotient kind mismatch"
+      | .dPrj p =>
+        match hm : Ixon.Eval.resolveMut ectx p.block p.idx.toNat with
+        | .ok (bc, .defn d) =>
+          match hu : Ixon.Eval.unfoldable d with
+          | true =>
+            match ha : ictx.env a with
+            | some (.defn aliasResult (.ref member)) =>
+              if hmember : member =
+                  Erase.memberAddr p.block p.idx.toNat then by
+                subst member
+                exact match he : ictx.env
+                    (Erase.memberAddr p.block p.idx.toNat) with
+                | some (.defn result body') =>
+                  if hresult : aliasResult = result then
+                    match ho : validateTeleResultOwned bc.sharing fuel d.typ with
+                    | .error message => .error message
+                    | .ok ⟨candidate, howned⟩ =>
+                      if heq : result = candidate.getD .shared then
+                        match hb : validateExpr ectx ictx db.oracle none bc.refs
+                            (Ixon.selfMutsOf bc.info) (some p.block) []
+                            fuel d.value body' with
+                        | .error message => .error message
+                        | .ok hbody => by
+                          have halias : ictx.env a = some (.defn result
+                              (.ref (Erase.memberAddr p.block
+                                p.idx.toNat))) := by
+                            simpa [hresult] using ha
+                          exact .ok ⟨Covered.defnProj hc hi hm hu halias he
+                            ⟨candidate, howned.down, heq⟩ hbody.down⟩
+                      else fail
+                        "definition-projection result ownership mismatch"
+                  else fail "definition-projection alias ownership mismatch"
+                | _ => fail "erased definition member is missing"
+              else fail "definition projection points at the wrong member"
+            | _ => fail "erased definition projection is missing"
+          | false =>
+            match ha : ictx.env a with
+            | some (.defn aliasResult (.ref member)) =>
+              if hmember : member =
+                  Erase.memberAddr p.block p.idx.toNat then by
+                subst member
+                exact match hconfigured : ectx.externArity
+                    (Erase.memberAddr p.block p.idx.toNat) with
+                | none => fail
+                    "opaque definition member extern is not configured"
+                | some arity =>
+                  match he : ictx.env
+                      (Erase.memberAddr p.block p.idx.toNat) with
+                  | some (.extern targetArity) =>
+                    if harity : targetArity = arity then by
+                      subst targetArity
+                      exact match ho : validateTeleResultOwned bc.sharing fuel
+                          d.typ with
+                      | .error message => .error message
+                      | .ok ⟨candidate, howned⟩ =>
+                        if heq : aliasResult = candidate.getD .shared then
+                          let hresult : DefinitionResultOwned bc.sharing d.typ
+                              aliasResult := ⟨candidate, howned.down, heq⟩
+                          .ok ⟨Covered.externDefnProj hc hi hm hu hconfigured
+                            ha he hresult⟩
+                        else fail
+                          "definition-projection result ownership mismatch"
+                    else fail "opaque definition member extern arity mismatch"
+                  | _ => fail "erased opaque definition member extern is missing"
+              else fail "definition projection points at the wrong member"
+            | _ => fail "erased opaque definition projection is missing"
+        | _ => fail "definition projection does not resolve to a definition"
+      | .rPrj p =>
+        match hm : Ixon.Eval.resolveMut ectx p.block p.idx.toNat with
+        | .ok (bc, .recr r) =>
+          if hx : r.indices.toNat = 0 then
+            match he : ictx.env a with
+            | some (.defn .shared (.ref member)) =>
+              if ha : member = Erase.memberAddr p.block p.idx.toNat then by
+                subst member
+                match validateRecMember ectx ictx db p.block p.idx.toNat
+                    bc r hm fuel with
+                | .ok hr => exact .ok ⟨.recrP hc hi hm hx he hr.down⟩
+                | .error msg => exact .error msg
+              else fail "recursor projection points at the wrong member"
+            | _ => fail "erased recursor projection is missing"
+          else fail "bare indexed recursor projections are outside Covered"
+        | _ => fail "recursor projection does not resolve to a recursor"
+      | _ => fail "constant kind is outside the current Covered fragment"
+
+/-- Check a dependency-ordered address plan, extending the proof database
+after each successful entry. -/
+def validateCoveragePlan (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) :
+    Nat → CoverageDB ectx ictx → List Address →
+      Except String (CoverageDB ectx ictx)
+  | 0, _, _ => .error "coverage-plan validation fuel exhausted"
+  | _ + 1, db, [] => .ok db
+  | fuel + 1, db, a :: rest => do
+    let ha ← validateCovered ectx ictx db fuel a
+    validateCoveragePlan ectx ictx fuel
+      ({ address := a, covered := ha.down } :: db) rest
+
+/-- Extract a `Covered` proof from one successful checked computation. -/
+theorem covered_of_validate
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {db : CoverageDB ectx ictx} {fuel : Nat} {a : Address}
+    (h : (validateCovered ectx ictx db fuel a).toOption.isSome) :
+    Covered ectx ictx a :=
+  ((validateCovered ectx ictx db fuel a).toOption.get h).down
+
+/-- Validate one entry of a simultaneous mutual-member plan. The expression
+and rule bodies are checked against the already completed public coverage
+database, but recursive member edges close through `scope.plan` rather than
+recursing in the validator. -/
+def validateMemberRel (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (db : CoverageDB ectx ictx) :
+    Nat → (key : MemberKey) →
+      Except String (PLift (MemberRel ectx ictx key))
+  | 0, _ => fail "member validation fuel exhausted"
+  | fuel + 1, ⟨block, idx⟩ =>
+    match hm : Ixon.Eval.resolveMut ectx block idx with
+    | .ok (bc, .defn d) =>
+      match hu : Ixon.Eval.unfoldable d with
+      | false =>
+        match hconfigured : ectx.externArity
+            (Erase.memberAddr block idx) with
+        | none => fail "opaque definition member extern is not configured"
+        | some arity =>
+          match he : ictx.env (Erase.memberAddr block idx) with
+          | some (.extern targetArity) =>
+            if harity : targetArity = arity then by
+              subst targetArity
+              exact .ok ⟨MemberRel.externDefn hm hu hconfigured he⟩
+            else fail "opaque definition member extern arity mismatch"
+          | _ => fail "erased opaque definition member extern is missing"
+      | true =>
+        match he : ictx.env (Erase.memberAddr block idx) with
+        | some (.defn result body') => do
+          let hresult ← validateTeleResultOwned bc.sharing fuel d.typ
+          if heq : result = hresult.1.getD .shared then
+            let hbody ← validateExpr ectx ictx db.oracle none bc.refs
+              (Ixon.selfMutsOf bc.info) (some block) [] fuel d.value body'
+            let howned : DefinitionResultOwned bc.sharing d.typ result :=
+              ⟨hresult.1, hresult.2.down, heq⟩
+            pure ⟨MemberRel.defn hm hu he howned hbody.down⟩
+          else fail "mutual-definition result ownership mismatch"
+        | _ => fail "erased mutual-definition member is missing"
+    | .ok (bc, .recr r) => do
+      let hmember ← validateRecMember ectx ictx db block idx bc r hm fuel
+      pure ⟨MemberRel.recr hmember.down⟩
+    | .ok (_, .indc _) =>
+      fail "inductive members do not require simultaneous body coverage"
+    | .error _ => fail "simultaneous member is unresolved"
+
+/-- Close every open member edge with one finite certificate. -/
+def validateMemberCoverage (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (db : CoverageDB ectx ictx) :
+    Nat → (keys : List MemberKey) →
+      Except String (PLift (MemberCoverage ectx ictx keys))
+  | 0, _ => fail "member-plan validation fuel exhausted"
+  | _ + 1, [] =>
+    if hneutral : ectx.preserveNeutralElims = false then
+      if hstrings : ectx.stringLiteral = none then
+        .ok ⟨.nil ⟨hneutral, hstrings⟩⟩
+      else
+        fail "certified erasure requires String-literal expansion disabled"
+    else
+      fail "certified erasure requires strict neutral-elimination mode"
+  | fuel + 1, key :: rest => do
+    let hkey ← validateMemberRel ectx ictx db fuel key
+    let hrest ← validateMemberCoverage ectx ictx db fuel rest
+    pure ⟨.cons hkey.down hrest.down⟩
+
+/-- Extract simultaneous coverage from a successful checked computation. -/
+theorem memberCoverage_of_validate
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {db : CoverageDB ectx ictx} {fuel : Nat} {keys : List MemberKey}
+    (h : (validateMemberCoverage ectx ictx db fuel keys).toOption.isSome) :
+    MemberCoverage ectx ictx keys :=
+  ((validateMemberCoverage ectx ictx db fuel keys).toOption.get h).down
+
+inductive CertErr where
+  | erase (err : Erase.EraseErr)
+  | relation (msg : String)
+  deriving BEq, Repr
+
+/-- A whole executable-erasure result plus a database of `Covered` proofs
+checked against the target environment built from that exact result. -/
+structure CertifiedProgram (ectx : Ixon.Eval.EvalCtx)
+    (consts : List (Address × Constant)) (eraseFuel : Nat) where
+  target : List (Address × IxIR0.Decl)
+  erased : Erase.eraseProgram (eraseCtxOf ectx) consts eraseFuel = .ok target
+  coverage : CoverageDB ectx { env := IxIR0.Env.ofList target }
+  members : MemberCoverage ectx { env := IxIR0.Env.ofList target } scope.plan
+
+/-- Run the real program eraser and validate a dependency-ordered list of
+addresses against its exact output.  The returned database is a reusable
+`CoverOracle` for certifying entry expressions. -/
+def certifyProgram (ectx : Ixon.Eval.EvalCtx)
+    (consts : List (Address × Constant)) (coverageOrder : List Address)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel) :
+    Except CertErr (CertifiedProgram ectx consts eraseFuel) :=
+  match he : Erase.eraseProgram (eraseCtxOf ectx) consts eraseFuel with
+  | .error err => .error (.erase err)
+  | .ok target =>
+    let targetIndex := IxIR0.Env.Index.ofList target
+    let ictx : IxIR0.Ctx := { env := targetIndex.toEnv }
+    match validateCoveragePlan ectx ictx validateFuel [] coverageOrder with
+    | .error msg => .error (.relation msg)
+    | .ok coverage =>
+      match validateMemberCoverage ectx ictx coverage validateFuel
+          scope.plan with
+      | .error msg => .error (.relation msg)
+      | .ok members =>
+        have hictx : ictx = { env := IxIR0.Env.ofList target } := by
+          simp [ictx, targetIndex]
+        .ok ⟨target, he, hictx ▸ coverage, hictx ▸ members.down⟩
+
+end MemberScoped
+
+/-- A real erasure of the original shared program, paired with coverage facts
+for the semantically inlined resolver.  The target environment is shared by
+both facts, so no unproved eraser/inliner equality is assumed. -/
+structure CertifiedSharedProgram (ectx : Ixon.Eval.EvalCtx)
+    (consts : List (Address × Constant)) (eraseFuel : Nat)
+    [scope : MemberScope] where
+  target : List (Address × IxIR0.Decl)
+  erased : Erase.eraseProgram (eraseCtxOf ectx) consts eraseFuel = .ok target
+  coverage : CoverageDB ectx.inlineSharing
+    { env := IxIR0.Env.ofList target }
+  members : MemberCoverage ectx.inlineSharing
+    { env := IxIR0.Env.ofList target } scope.plan
+
+/-- Run the executable eraser on the original shared constants, then validate
+its exact output against fully inlined constants obtained through the source
+resolver.  Success produces the `Covered` database needed by sharing-aware
+entry-expression certificates. -/
+def certifySharedProgram [scope : MemberScope]
+    (ectx : Ixon.Eval.EvalCtx)
+    (consts : List (Address × Constant)) (coverageOrder : List Address)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel) :
+    Except CertErr (CertifiedSharedProgram ectx consts eraseFuel) :=
+  match he : Erase.eraseProgram (eraseCtxOf ectx) consts eraseFuel with
+  | .error err => .error (.erase err)
+  | .ok target =>
+    let targetIndex := IxIR0.Env.Index.ofList target
+    let ictx : IxIR0.Ctx := { env := targetIndex.toEnv }
+    match validateCoveragePlan ectx.inlineSharing ictx validateFuel []
+        coverageOrder with
+    | .error msg => .error (.relation msg)
+    | .ok coverage =>
+      match validateMemberCoverage ectx.inlineSharing ictx coverage
+          validateFuel scope.plan with
+      | .error msg => .error (.relation msg)
+      | .ok members =>
+        have hictx : ictx = { env := IxIR0.Env.ofList target } := by
+          simp [ictx, targetIndex]
+        .ok ⟨target, he, hictx ▸ coverage, hictx ▸ members.down⟩
+
+section MemberScopedExpr
+
+variable [scope : MemberScope]
+
+/-- An executable result and its relational proof, tied to exactly the same
+source expression, tables, mask, and eraser invocation. -/
+structure CertifiedExpr (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (sc : Option (Address × Nat)) (T : Erase.ETables) (sa : Option Address)
+    (mask : List Bool) (eraseFuel : Nat) (source : Ixon.Expr) where
+  target : IxIR0.Expr
+  erased : Erase.eraseExpr (eraseCtxOf ectx) eraseFuel T mask source = .ok target
+  related : PErase ectx ictx sc T.refs T.selfMuts sa mask source target
+
+/-- Run the real executable eraser, then validate its exact result, with
+member certificates available for projection-headed indexed recursor spines. -/
+def certifyExprWithRec (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (cover : CoverOracle ectx ictx) (recMembers : RecMemberOracle ectx ictx)
+    (sc : Option (Address × Nat)) (T : Erase.ETables) (sa : Option Address)
+    (mask : List Bool) (source : Ixon.Expr)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel) :
+    Except CertErr (CertifiedExpr ectx ictx sc T sa mask eraseFuel source) :=
+  match he : Erase.eraseExpr (eraseCtxOf ectx) eraseFuel T mask source with
+  | .error err => .error (.erase err)
+  | .ok target =>
+    match validateExprWithRec ectx ictx cover recMembers sc T.refs T.selfMuts
+        sa mask validateFuel source target with
+    | .error msg => .error (.relation msg)
+    | .ok related => .ok ⟨target, he, related.down⟩
+
+/-- Index-free compatibility wrapper for existing entry certificates. -/
+def certifyExpr (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (cover : CoverOracle ectx ictx)
+    (sc : Option (Address × Nat)) (T : Erase.ETables) (sa : Option Address)
+    (mask : List Bool) (source : Ixon.Expr)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel) :
+    Except CertErr (CertifiedExpr ectx ictx sc T sa mask eraseFuel source) :=
+  certifyExprWithRec ectx ictx cover noRecMembers sc T sa mask source
+    eraseFuel validateFuel
+
+end MemberScopedExpr
+
+/-- An executable erasure of an original shared expression and a `PErase`
+proof for the fully inlined expression, both tied to the exact same target. -/
+structure CertifiedSharedExpr (ectx : Ixon.Eval.EvalCtx)
+    (ictx : IxIR0.Ctx) (sc : Option (Address × Nat))
+    (T : Erase.ETables) (sa : Option Address) (mask : List Bool)
+    (eraseFuel : Nat) (source : Ixon.Expr) [scope : MemberScope] where
+  target : IxIR0.Expr
+  erased : Erase.eraseExpr (eraseCtxOf ectx) eraseFuel T mask source =
+    .ok target
+  related : PErase ectx.inlineSharing ictx sc (inlineTables T).refs
+    (inlineTables T).selfMuts sa mask
+    (Ixon.Sharing.inlineExpr T.sharing source) target
+
+/-- Run the real eraser before inlining, then validate its exact output against
+the fully inlined expression and resolver.  This is the executable bridge to
+`Sim.erasure_sim_inlineSharing`; malformed sharing still fails either erasure
+or relation validation. -/
+def certifySharedExpr [scope : MemberScope]
+    (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (cover : CoverOracle ectx.inlineSharing ictx)
+    (sc : Option (Address × Nat)) (T : Erase.ETables)
+    (sa : Option Address) (mask : List Bool) (source : Ixon.Expr)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel) :
+    Except CertErr
+      (CertifiedSharedExpr ectx ictx sc T sa mask eraseFuel source) :=
+  match he : Erase.eraseExpr (eraseCtxOf ectx) eraseFuel T mask source with
+  | .error err => .error (.erase err)
+  | .ok target =>
+    match validateExpr ectx.inlineSharing ictx cover sc
+        (inlineTables T).refs (inlineTables T).selfMuts sa mask validateFuel
+        (Ixon.Sharing.inlineExpr T.sharing source) target with
+    | .error msg => .error (.relation msg)
+    | .ok related => .ok ⟨target, he, related.down⟩
+
+/-- Closed-frame specialization of `certifySharedExpr`.  Its result indexes
+the relation by exactly the normalized frame consumed by the semantic
+composition theorem. -/
+def certifySharedClosedExpr [scope : MemberScope]
+    (ectx : Ixon.Eval.EvalCtx)
+    (ictx : IxIR0.Ctx) (cover : CoverOracle ectx.inlineSharing ictx)
+    (F : Ixon.Eval.Frame) (source : Ixon.Expr)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel) :
+    Except CertErr (CertifiedSharedExpr ectx ictx none (tablesOfFrame F)
+      F.selfAddr [] eraseFuel source) :=
+  certifySharedExpr ectx ictx cover none (tablesOfFrame F) F.selfAddr []
+    source eraseFuel validateFuel
+
+/-- A successful closed sharing-aware expression certificate plugs directly
+into the composed semantic theorem.  The conclusion refers to the certificate's
+exact executable target, not a separately reconstructed expression. -/
+theorem CertifiedSharedExpr.simulatesClosed
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {F : Ixon.Eval.Frame} {source : Ixon.Expr} {eraseFuel fuel : Nat}
+    {value : Ixon.Eval.Value}
+    (cert : CertifiedSharedExpr ectx ictx none (tablesOfFrame F)
+      F.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (hsource : Ixon.Sharing.sharesBelow F.sharing.size source = true)
+    (heval : Ixon.Eval.eval ectx fuel F [] source = .ok value) :
+    ∃ fuel' targetValue,
+      IxIR0.eval ictx fuel' [] cert.target = .ok targetValue ∧
+      InlinedValRel ectx ictx value targetValue := by
+  apply erasure_sim_inlineSharing_closed hstrict hctx hF horacles hsource heval
+  have hrelated := cert.related
+  rw [inlineTables_tablesOfFrame] at hrelated
+  exact hrelated
+
+/-! Small boundary guards: the validator accepts kept and ghost applications
+that `PErase` covers, while rejecting a successful erasure which reads a
+dropped slot (the exact obligation reserved for usage-checker soundness). -/
+
+private def emptyEctx : Ixon.Eval.EvalCtx :=
+  { resolve := fun _ => none }
+
+private def openEctx : Ixon.Eval.EvalCtx :=
+  { emptyEctx with preserveNeutralElims := true }
+
+private def stringOpenEctx : Ixon.Eval.EvalCtx :=
+  { emptyEctx with
+      stringLiteral := some
+        { charType := Address.replicate 0xE0
+          charOfNat := Address.replicate 0xE1
+          stringOfList := Address.replicate 0xE2
+          listNil := Address.replicate 0xE3
+          listCons := Address.replicate 0xE4 } }
+
+private def emptyIctx : IxIR0.Ctx :=
+  { env := fun _ => none }
+
+private def noCover : CoverOracle emptyEctx emptyIctx := fun _ => none
+
+private def noInlineCover : CoverOracle emptyEctx.inlineSharing emptyIctx :=
+  fun _ => none
+
+-- Whole-program certification seals the strict runtime boundary used by the
+-- constructor-only projection simulation theorem.
+#guard (match certifyProgram openEctx [] [] 100 100 with
+  | .error (.relation
+      "certified erasure requires strict neutral-elimination mode") => true
+  | _ => false)
+
+#guard (match certifyProgram stringOpenEctx [] [] 100 100 with
+  | .error (.relation
+      "certified erasure requires String-literal expansion disabled") => true
+  | _ => false)
+
+private def certifies (e : Ixon.Expr) : Bool :=
+  match certifyExpr emptyEctx emptyIctx noCover none {} none [] e 100 100 with
+  | .ok _ => true
+  | .error _ => false
+
+#guard certifies (.app (.lam .many (.var 99) (.var 0)) (.sort 0))
+#guard certifies (.app (.lam .erased (.sort 0) (.sort 0)) (.share 99))
+#guard !certifies (.lam .erased (.var 99) (.var 0))
+
+-- The ordinary relation still has no `.share` constructor.  The sharing-aware
+-- certificate runs the original eraser, inlines semantically, and validates
+-- both paths against the same emitted expression.
+private def oneShareTables : Erase.ETables :=
+  { sharing := #[.sort 0] }
+
+#guard (match certifySharedExpr emptyEctx emptyIctx noInlineCover none
+    oneShareTables none [] (.share 0) 100 100 with
+  | .ok cert => cert.target == .erased
+  | .error _ => false)
+
+private def sharedAddress : Address := Address.replicate 0xE1
+
+private def sharedConstant : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .share 0, value := .share 0 }
+    sharing := #[.sort 0], refs := #[], univs := #[] }
+
+private def sharedEctx : Ixon.Eval.EvalCtx :=
+  { resolve := fun address =>
+      if address == sharedAddress then some sharedConstant else none }
+
+-- Both authoritative roots use the entry, so this is decoder-level layer 1,
+-- not merely a raw table accepted by the expression fixture above.
+#guard sharedConstant.sharingWF
+
+#guard (match certifySharedProgram sharedEctx
+    [(sharedAddress, sharedConstant)] [sharedAddress] 100 100 with
+  | .ok cert =>
+    cert.target == [(sharedAddress, .defn .shared .erased)] &&
+      cert.coverage.length == 1
+  | .error _ => false)
+
+end Ix.Compiler.EraseValidator
diff --git a/Ix/Compiler/Fence.lean b/Ix/Compiler/Fence.lean
new file mode 100644
index 000000000..88e3830ee
--- /dev/null
+++ b/Ix/Compiler/Fence.lean
@@ -0,0 +1,7405 @@
+import Ix.Compiler.Sim
+import Ix.Compiler.X86.NatCallsSim
+import Ix.Compiler.X86.ScalarSourceObject
+import Ix.Compiler.X86.PhysicalScalarSourceObject
+import Ix.Compiler.X86.PhysicalScalarCapturedSourceObject
+import Ix.Compiler.UniqueReuse.PipelineSim
+import Ix.Compiler.UniqueReuse.NativeSim
+import Ix.Compiler.UniqueReuse.RuntimeNativeSim
+import Ix.Compiler.UniqueReuse.RuntimeObjectSim
+import Ix.Compiler.X86.RuntimeReject
+import Ix.Compiler.X86.ByteBranch
+import Ix.Compiler.X86.ByteCall
+import Ix.Compiler.X86.StreamExamples
+import Ix.Compiler.IxIR2.CreditRefinement
+import Ix.Compiler.Borrow.Pipeline
+import Ix.Compiler.Borrow.RuntimeSim
+import Ix.Compiler.Borrow.RuntimeInput
+import Ix.Compiler.IxIR1.Sim
+import Ix.Compiler.IxIR1.Reclamation
+import Ix.Compiler.IxIR1.LowerSim
+import Ix.Compiler.IxIR1.LowerProgress
+import Ix.Compiler.IxIR1.LowerAddressedSim
+import Ix.Compiler.IxIR1.LowerFullyAddressedSim
+import Ix.Compiler.IxIR1.NoReuseAddressed
+import Ix.Compiler.IxIR1.CostInstance
+import Ix.Compiler.IxIR1.CostModel
+import Ix.Compiler.IxIR1.CostTrace
+import Ix.Compiler.IxIR1.LowerMutualAddressedSim
+import Ix.Compiler.IxIR1.LowerMutualAddressedProgress
+import Ix.Compiler.IxIR0.Decode
+import Ix.Compiler.IxIR0.MutualBlock
+import Ix.Compiler.IxIR0.ReaddressSim
+import Ix.Compiler.IxIR0.ProjectionFree
+import Ix.Compiler.IxIR0.DynamicCost
+import Ix.Compiler.IxIR0.ReaddressProjectionSafe
+import Ix.Compiler.IxIR0.ReaddressOracle
+import Ix.Compiler.IxIR0.ReaddressOracleExamples
+import Ix.Compiler.EraseAddressedSim
+import Ix.Compiler.IxIR1.Decode
+import Ix.Compiler.IxIR1.MutualBlock
+import Ix.Compiler.IxIR1.ReaddressAll
+import Ix.Compiler.IxIR1.HPT
+import Ix.Compiler.IxIR1.HPTSound
+import Ix.Compiler.IxIR1.HPTProduce
+import Ix.Compiler.IxIR1.HPTCache
+import Ix.Compiler.IxIR1.HPTCasePrune
+import Ix.Compiler.IxIR1.HPTCasePruneProgram
+import Ix.Compiler.IxIR1.HPTPAPFuse
+import Ix.Compiler.IxIR1.HPTFetchForward
+import Ix.Compiler.IxIR1.HPTDestroy
+import Ix.Compiler.IxIR1.Reachability
+import Ix.Compiler.IxIR1.HPTPAPFuseProgram
+import Ix.Compiler.SimInstance
+import Ix.Compiler.UsageSound
+import Ix.Compiler.Ixon.Address
+import Ix.Compiler.Ixon.Const
+import Ix.Compiler.IxIR2.EvalCounter
+import Ix.Compiler.IxIR2.Lower
+import Ix.Compiler.IxIR2.LowerSim
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR2.PipelineSim
+import Ix.Compiler.IxIR2.LivenessExamples
+import Ix.Compiler.IxIR2.Reuse
+import Ix.Compiler.IxIR2.ReuseSim
+import Ix.Compiler.IxIR2.ReuseLiveSim
+import Ix.Compiler.IxIR2.ReuseSimExamples
+import Ix.Compiler.IxIR2.ReuseExamples
+import Ix.Compiler.X86.Basic
+import Ix.Compiler.X86.Eval
+import Ix.Compiler.X86.EvalExamples
+import Ix.Compiler.X86.Select
+import Ix.Compiler.X86.PipelineSim
+import Ix.Compiler.X86.SelectExamples
+import Ix.Compiler.X86.Encode
+import Ix.Compiler.X86.EncodeExamples
+import Ix.Compiler.X86.ELF
+import Ix.Compiler.X86.ELFExamples
+import Ix.Compiler.Pipeline
+import Ix.Compiler.PipelineSound
+import Ix.Compiler.Recursion.Sim
+import Ix.Compiler.Recursion.PhysicalSim
+import Ix.Compiler.Recursion.Resources
+import Ix.Compiler.Recursion.Allocation
+import Ix.Compiler.Recursion.Costs
+import Ix.Compiler.CallReuse.Sim
+import Ix.Compiler.CallReuse.MapSim
+
+/-!
+# Sorry/axiom fence (roadmap M0)
+
+The mechanical fence for the roadmap's M0 "sorry/axiom fence" row: each
+flagship theorem's axiom set is pinned with a `#guard_msgs`-checked
+`#print axioms`, so `lake build` fails if a `sorryAx` or any new axiom
+enters its dependency cone. Pure theorem sets are subsets of the intended
+triple `propext`/`Classical.choice`/`Quot.sound`, spelled exactly as
+reported (`invoke_fn_result_hasWorld` happens not to use
+`Classical.choice`; a pin that widens is as much a diff as one that
+breaks). The production content-addressing pins additionally expose the one
+native BLAKE3 axiom already inventoried in the trusted-extern ledger; their
+generic evaluator-renaming core remains inside the pure set.
+
+The codec proof layer is pinned too: `Address`, `Univ`, `Expr`,
+`ConstantInfo`, and `Constant` each contribute their roundtrip and
+canonical-decoding laws, while IxIR₀ and IxIR₁ declarations contribute
+framed roundtrip, accepted-byte canonicality, and preimage injectivity. The
+two cycle-safe block codecs contribute the same three laws. Their proofs use
+kernel-checked extensionality and arithmetic, so all twenty-two laws
+stay inside the same intended axiom triple.
+-/
+
+/-! ## Erasure simulation (`Ix/Compiler/Sim.lean`) -/
+
+/-- info: 'Ix.Compiler.Ixon.Eval.projectValue_ok_of_strict' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Eval.projectValue_ok_of_strict
+
+/-- info: 'Ix.Compiler.Sim.erasure_sim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_sim
+
+/-- info: 'Ix.Compiler.Sim.erasure_sim_with_members' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_sim_with_members
+
+/-- info: 'Ix.Compiler.Sim.erasure_sim_projectionSafe_with_members' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_sim_projectionSafe_with_members
+
+/-- info: 'Ix.Compiler.Sim.erasure_sim_closed' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_sim_closed
+
+/-- info: 'Ix.Compiler.Sim.erasure_sim_inlineSharing' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_sim_inlineSharing
+
+/-- info: 'Ix.Compiler.Sim.erasure_sim_inlineSharing_closed' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_sim_inlineSharing_closed
+
+/-- info: 'Ix.Compiler.Sim.erasure_proj_sim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_proj_sim
+
+/-- info: 'Ix.Compiler.Sim.erasure_proj_sim_inlineSharing' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.erasure_proj_sim_inlineSharing
+
+/-- info: 'Ix.Compiler.SimInstance.ghostDefinitionHeadSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.ghostDefinitionHeadSim
+
+/-- info: 'Ix.Compiler.SimInstance.quotientIndSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.quotientIndSim
+
+/-- info: 'Ix.Compiler.SimInstance.externAnswerSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.externAnswerSim
+
+/-- info: 'Ix.Compiler.SimInstance.pairSplitProjectionSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.pairSplitProjectionSim
+
+/-- info: 'Ix.Compiler.SimInstance.indexedRecSplitSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.indexedRecSplitSim
+
+/-- info: 'Ix.Compiler.SimInstance.indexedRecSelfSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.indexedRecSelfSim
+
+/-- info: 'Ix.Compiler.SimInstance.definitionProjectionSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.definitionProjectionSim
+
+/-- info: 'Ix.Compiler.SimInstance.mutualInductiveMemberSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.mutualInductiveMemberSim
+
+/-- info: 'Ix.Compiler.SimInstance.cyclicDefinitionMembersSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.cyclicDefinitionMembersSim
+
+/-- info: 'Ix.Compiler.SimInstance.cyclicRecursorMembersSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.cyclicRecursorMembersSim
+
+/-- info: 'Ix.Compiler.SimInstance.opaqueMutualMemberSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.opaqueMutualMemberSim
+
+/-- info: 'Ix.Compiler.SimInstance.opaqueMutualProjectionSim' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.opaqueMutualProjectionSim
+
+/-! ## Usage-checker non-interference (`Ix/Compiler/UsageSound.lean`)
+
+Pin the generic common-erasure observation theorem, its contentful checked
+and certified dropped-variable instance, and the corresponding whole-entry
+forward simulation. -/
+
+/-- info: 'Ix.Compiler.Ixon.UsageCheck.closureWorld_shared_iff' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.UsageCheck.closureWorld_shared_iff
+
+/-- info: 'Ix.Compiler.Ixon.UsageCheck.check_lam_shared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.UsageCheck.check_lam_shared
+
+/-- info: 'Ix.Compiler.UsageSound.computedErased_eval_noninterference' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UsageSound.computedErased_eval_noninterference
+
+/-- info: 'Ix.Compiler.UsageSound.DroppedVariableFixture.droppedVariableOccurrenceNoninterference' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UsageSound.DroppedVariableFixture.droppedVariableOccurrenceNoninterference
+
+/-- info: 'Ix.Compiler.UsageSound.DroppedVariableFixture.droppedVariableOccurrenceSim' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UsageSound.DroppedVariableFixture.droppedVariableOccurrenceSim
+
+/-! ## IxIR₀ → IxIR₁ lowering soundness (`Ix/Compiler/IxIR1/Sim.lean`) -/
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.reuse_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.reuse_sound
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.reuse_shared_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.reuse_shared_sound
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.invoke_fn_result_hasWorld' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.invoke_fn_result_hasWorld
+
+/-! ## IxIR₁ reclamation (`Ix/Compiler/IxIR1/Reclamation.lean`,
+`Ix/Compiler/IxIR1/NoReuse.lean`, and
+`Ix/Compiler/IxIR1/NoReuseAddressed.lean`)
+
+Pin the finite empty-root theorem, the public semantic bridge, the actual
+no-`reuse` compiler proof, and its pure address-transport boundary.  The
+production SCC corollary additionally carries the already-ledgered native
+BLAKE3 audit axiom. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Reclamation.live_eq_zero_of_empty_roots' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reclamation.live_eq_zero_of_empty_roots
+
+/-- info: 'Ix.Compiler.IxIR1.Reclamation.shared_reclamation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reclamation.shared_reclamation
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.reclamation_of_run_invariants' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.reclamation_of_run_invariants
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.reclamation_of_run_ownership_and_zero_reuses' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.reclamation_of_run_ownership_and_zero_reuses
+
+/-- info: 'Ix.Compiler.IxIR1.Reclamation.runMain_order_of_reuses_eq_zero' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reclamation.runMain_order_of_reuses_eq_zero
+
+/-- info: 'Ix.Compiler.IxIR1.Reclamation.runOp_order_of_reuses_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reclamation.runOp_order_of_reuses_eq
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.runMain_reuses_eq_zero' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.runMain_reuses_eq_zero
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.runOp_reuses_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.runOp_reuses_eq
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.invoke_reuses_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.invoke_reuses_eq
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.applyGo_reuses_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.applyGo_reuses_eq
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.runOwnedMain_ok' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.runOwnedMain_ok
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.checkCode_eq_true_iff' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.checkCode_eq_true_iff
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.checkDeclarations_eq_true_iff' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.checkDeclarations_eq_true_iff
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_main_owned' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_main_owned
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllAction_noReuse' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllAction_noReuse
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllAction_reclamation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllAction_reclamation
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.reclamation_mapAddresses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.reclamation_mapAddresses
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_reclamation_of_raw' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_reclamation_of_raw
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_reclamation_of_exact_raw' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_reclamation_of_exact_raw
+
+/-! ## IxIR₁ cost refinement (`Ix/Compiler/IxIR1/LowerSim.lean`,
+`Ix/Compiler/IxIR1/NoReuse.lean`, and
+`Ix/Compiler/IxIR1/NoReuseAddressed.lean`, and
+`Ix/Compiler/IxIR1/CostInstance.lean`, and
+`Ix/Compiler/IxIR1/CostModel.lean`,
+`Ix/Compiler/IxIR0/DynamicCost.lean`,
+`Ix/Compiler/IxIR0/ProjectionFree.lean`, and
+`Ix/Compiler/IxIR1/CostTrace.lean`)
+
+Pin the target-only counter interface, the first concrete whole-pass equation
+(`reuses = 0`), both pure and production address transport, and a
+nonvacuous exact `(allocs, reuses, frees, rcops) = (1, 0, 0, 0)` compiler
+instance.  The general runtime balance additionally pins
+`nodes.size = allocs` and `live + frees = allocs`; its counter-facing
+consequence is `frees ≤ allocs`.  The parametric unary-constructor fragment
+then connects actual whole-pass lowering to the exact source-result equation
+`allocs = constructorNodes`, with zero reuse/free/RC traffic.  The dynamic
+extension pins additive call/recursor profiles, structural trace recovery for
+projection-free executions, and the generic profile-to-counter bridge.  Its
+retain-width extension and counter-growth algebra expose the unbounded PAP/
+closure dimension needed by a compiler-derived RC tariff; the first runtime
+producer bounds `dupVals` by the retained prefix length.  The shared-RC
+potential then makes arbitrary recursive shared and unique release locally
+free: every shared drop exchanges one outstanding-count unit for one RC
+instruction.  The primitive classifier covers every non-recursive append-only
+operation and lifts its allowance through identity, operation emission,
+emitter composition, and return sealing while preserving allocation order and
+environment bounds.  A generic run certificate combines that potential bound
+with allocation/reuse facts and the existing heap balance to recover the
+public four-counter tariff. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Reclamation.runMain_nodes_size_eq_allocs' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reclamation.runMain_nodes_size_eq_allocs
+
+/-- info: 'Ix.Compiler.IxIR1.Reclamation.runMain_live_add_frees_eq_allocs' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reclamation.runMain_live_add_frees_eq_allocs
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.RunCostInvariant.costRefinement' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.RunCostInvariant.costRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CostRefinement.and' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CostRefinement.and
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.allocationFreeCostRefinement' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.allocationFreeCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllAction_reuseCostRefinement' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllAction_reuseCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllAction_costRefinement' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllAction_costRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.runCostInvariant_mapAddresses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.runCostInvariant_mapAddresses
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_runCostInvariant_of_exact_raw' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_runCostInvariant_of_exact_raw
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_reuseCostRefinement' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_reuseCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_costRefinement' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.NoReuse.lowerAllIndexedFullyAddressed_costRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.CostInstance.exactCostRefinement' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostInstance.exactCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.CostInstance.loweringCostWitness' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostInstance.loweringCostWitness
+
+/-- info: 'Ix.Compiler.IxIR1.CostModel.lowerAllAction_run' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostModel.lowerAllAction_run
+
+/-- info: 'Ix.Compiler.IxIR1.CostModel.sourceSensitiveCostRefinement' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostModel.sourceSensitiveCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.CostModel.sourceSensitiveBoundsCostRefinement' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostModel.sourceSensitiveBoundsCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.CostModel.loweringCostWitness' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostModel.loweringCostWitness
+
+/-- info: 'Ix.Compiler.IxIR0.DynamicCost.Eval.ofTrace' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.DynamicCost.Eval.ofTrace
+
+/-- info: 'Ix.Compiler.IxIR0.DynamicCost.Applies.append' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.DynamicCost.Applies.append
+
+/-- info: 'Ix.Compiler.IxIR0.ProjectionFree.Eval.of_run' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.ProjectionFree.Eval.of_run
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.ProfileCostRefinement.of_witness' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.ProfileCostRefinement.of_witness
+
+/-- info: 'Ix.Compiler.IxIR0.DynamicCost.Eval.surfaceEvals_le' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.DynamicCost.Eval.surfaceEvals_le
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.ObservationGrowthLE.trans' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.ObservationGrowthLE.trans
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.dupVals_growth' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.dupVals_growth
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.withinBudget_ownershipAmortized_iff' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.withinBudget_ownershipAmortized_iff
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.RcPotentialGrowthLE.trans' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.RcPotentialGrowthLE.trans
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.dupVals_rcPotential_growth' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.dupVals_rcPotential_growth
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.dropVal_amortizedRc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.dropVal_amortizedRc
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.dropUVal_amortizedRc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.dropUVal_amortizedRc
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.runOp_localRcPotential_growth' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.runOp_localRcPotential_growth
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.OpRcPotentialSound.of_local' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.OpRcPotentialSound.of_local
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.EmitRcPotentialSound.comp' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.EmitRcPotentialSound.comp
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.EmitRcPotentialSound.localOp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.EmitRcPotentialSound.localOp
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.dropVal_allocs' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.dropVal_allocs
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.runOp_localOwnership_growth' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.runOp_localOwnership_growth
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.OpOwnershipCostSound.of_local' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.OpOwnershipCostSound.of_local
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.EmitOwnershipCostSound.comp' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.EmitOwnershipCostSound.comp
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.EmitOwnershipCostSound.localOp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.EmitOwnershipCostSound.localOp
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.ProfileFundedEmitStateRunSound.ofOp' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.ProfileFundedEmitStateRunSound.ofOp
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.ProfileFundedApplyRun.papOver' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.ProfileFundedApplyRun.papOver
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.LowerResultProfileSound.installThen' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.LowerResultProfileSound.installThen
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerE_let_run_profile_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerE_let_run_profile_sound
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerBorrow_run_profile_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerBorrow_run_profile_sound
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.projectionSlotReleased_profileFundedEmitStateRunSound' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.projectionSlotReleased_profileFundedEmitStateRunSound
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerE_proj_run_profile_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerE_proj_run_profile_sound
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.papp_graph_op' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.papp_graph_op
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.LowerResultProfileSound.consArgs' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.LowerResultProfileSound.consArgs
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerCaptures_run_profile_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerCaptures_run_profile_sound
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerLam_run_profile_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerLam_run_profile_sound
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerE_lam_run_profile_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerE_lam_run_profile_sound
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.sourceProfileOwnershipAllowance_add' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.sourceProfileOwnershipAllowance_add
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.CodeOwnershipCostSound.runCertificate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.CodeOwnershipCostSound.runCertificate
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.CodeOwnershipCostSound.withinBudget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.CodeOwnershipCostSound.withinBudget
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.OwnershipAmortizedRunCertificate.spec' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.OwnershipAmortizedRunCertificate.spec
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.ProfileCostRefinement.of_ownershipAmortizedCertificate' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.ProfileCostRefinement.of_ownershipAmortizedCertificate
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerAllAction_compilerProfileContracts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerAllAction_compilerProfileContracts
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerAllAction_main_ownershipAmortizedCertificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerAllAction_main_ownershipAmortizedCertificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerAllAction_profileCostRefinement_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerAllAction_profileCostRefinement_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerAllIndexedFullyAddressed_profileCostRefinement_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerAllIndexedFullyAddressed_profileCostRefinement_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.CostTrace.lowerAllIndexedFullyAddressed_profileCostRefinement_exact_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.CostTrace.lowerAllIndexedFullyAddressed_profileCostRefinement_exact_sealed
+
+/-! ## Whole-pass lowering instance (`Ix/Compiler/SimInstance.lean`)
+
+The four boundaries the M2b ledger claims for the actual compiled
+`add 2̂ 3̂` output: exact ownership contracts, the source-to-target
+`ValueGraph` forward simulation, all-fuel memory-error exclusion, and the
+call/recursion-sensitive source-profile cost refinement.
+Pinning them here is what makes
+"without `native_decide`" mechanical rather than editorial. -/
+
+/-- info: 'Ix.Compiler.SimInstance.addIxIR1CompilerContracts' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.addIxIR1CompilerContracts
+
+/-- info: 'Ix.Compiler.SimInstance.addIxIR1SemanticForwardSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.addIxIR1SemanticForwardSimulation
+
+/-- info: 'Ix.Compiler.SimInstance.addIxIR1MemoryErrorUnreachable' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.addIxIR1MemoryErrorUnreachable
+
+/-- info: 'Ix.Compiler.SimInstance.addIxIR1DynamicCostRefinement' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.SimInstance.addIxIR1DynamicCostRefinement
+
+/-! ## Generic whole-pass target safety
+(`Ix/Compiler/IxIR1/LowerProgress.lean`) -/
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_memoryErrorUnreachable_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_memoryErrorUnreachable_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_unknownRefUnreachable_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_unknownRefUnreachable_sealed
+
+/-! ## Content-addressed lowering transport
+(`Ix/Compiler/IxIR1/ReaddressSim.lean`,
+`Ix/Compiler/IxIR1/ReaddressOwnership.lean`,
+`Ix/Compiler/IxIR1/LowerAddressedSim.lean`)
+
+The generic evaluator proof is independent of hashing.  The production
+corollaries consume a successful native BLAKE3 post-pass run, so the exact
+native implementation axiom is an intentional, mechanically visible member
+of those cones.  Pin the indexed artifact boundary used by `Pipeline` across
+identity protection, exact runs, addressed value graphs, all three dynamic
+error classes, and cost counters. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Readdress.evalTransportAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Readdress.evalTransportAt
+
+/-- info: 'Ix.Compiler.IxIR1.Readdress.applyGo_mapAddresses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Readdress.applyGo_mapAddresses
+
+/-- info: 'Ix.Compiler.IxIR1.Readdress.dupVals_success_preimage' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Readdress.dupVals_success_preimage
+
+/-- info: 'Ix.Compiler.IxIR1.Readdress.dropVal_success_preimage' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Readdress.dropVal_success_preimage
+
+/-- info: 'Ix.Compiler.IxIR1.Readdress.runOp_success_preimage' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Readdress.runOp_success_preimage
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.rootOwnership_mapAddresses_iff' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.rootOwnership_mapAddresses_iff
+
+/-- info: 'Ix.Compiler.IxIR1.Readdress.runMain_mapAddresses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Readdress.runMain_mapAddresses
+
+/-! IxIR₀ now has the corresponding full-value transport: closures,
+constructor identities, PAP heads, oracle calls, and address-bearing errors
+all commute with the map. -/
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.evalTransportAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.evalTransportAt
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.Ctx.run_mapAddresses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.Ctx.run_mapAddresses
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.ProjectionSafe.Eval.mapAddresses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.ProjectionSafe.Eval.mapAddresses
+
+/-! The executable oracle view reverse-resolves only declaration keys and
+maps returned values forward. Its compatibility theorem remains independent
+of hashing; the successful production wrapper below exposes the native hash
+boundary used to construct the recorded program map. -/
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.Oracle.readdress_compatible' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.Oracle.readdress_compatible
+
+/-- info: 'Ix.Compiler.EraseAddressed.run_readdressOracle_semantics_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.EraseAddressed.run_readdressOracle_semantics_of_run_eq_ok
+
+/-! The cycle-safe IxIR₀ block codec is pure, while successful transient-name
+materialization intentionally crosses the same native BLAKE3 boundary. -/
+
+/-- info: 'Ix.Compiler.IxIR0.MutualBlock.semanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MutualBlock.semanticAudit_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.MutualBlock.semanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.MutualBlock.semanticAudit_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.semanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.semanticAudit_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.reserved_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.reserved_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.rebuildSemanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.rebuildSemanticAudit_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.Result.raw_lookup_of_mem_of_rebuildSemanticAudit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.Result.raw_lookup_of_mem_of_rebuildSemanticAudit
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.Result.declaration_preimage_of_lookup_of_rebuildSemanticAudit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.Result.declaration_preimage_of_lookup_of_rebuildSemanticAudit
+
+/-! Checked HPT summaries expose both the untrusted candidate's post-fixpoint
+condition and the exact cache/content-address audit. Materialization uses the
+same ledgered BLAKE3 boundary as the program artifacts. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.postFixpoint_of_runWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.postFixpoint_of_runWith_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.semanticAudit_of_runWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.semanticAudit_of_runWith_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.postFixpoint_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.postFixpoint_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.semanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.semanticAudit_of_run_eq_ok
+
+/-! The abstract interpreter's evaluator concretization is pure.  Composing
+that theorem with accepted native-addressed certificates exposes exactly the
+same ledgered BLAKE3 axiom as the existing post-fixpoint/materialization
+boundary, including through the pipeline API. -/
+
+/-! Recursive field refinement itself is hash-independent. These pins cover
+the mutually recursive order transport and both directions of the bounded
+root/field conversion used by allocation, fetch, and case binders. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FieldShape.holds_of_le' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FieldShape.holds_of_le
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FieldFact.holds_of_le' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FieldFact.holds_of_le
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FieldFactsHold.holds_of_listLe' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FieldFactsHold.holds_of_listLe
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.HeapShape.toFieldShape_holds' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.HeapShape.toFieldShape_holds
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FieldShape.toHeapShape_holds' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FieldShape.toHeapShape_holds
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FieldFact.ofFact_holds' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FieldFact.ofFact_holds
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FieldFact.toFact_holds' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FieldFact.toFact_holds
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Fact.exactConstructor?_eq_some' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Fact.exactConstructor?_eq_some
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Fact.exactConstructor?_holds_loc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Fact.exactConstructor?_holds_loc
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Fact.caseFields_ctor_holds' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Fact.caseFields_ctor_holds
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Fact.caseFields_natSucc_holds' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Fact.caseFields_natSucc_holds
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.analyzeOp_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.analyzeOp_sound
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.invoke_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.invoke_sound
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.functionSummary_sound_of_runWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.functionSummary_sound_of_runWith_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.functionSummary_sound_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.functionSummary_sound_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_checkHPTWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_checkHPTWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_checkHPT_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_checkHPT_eq_ok
+
+/-! Deterministic production remains outside the trust boundary: its output
+stores an equality showing that the ordinary checker accepted it.  These pins
+make the resulting post-fixpoint, audit, and evaluator guarantees expose the
+same native materialization dependency and nothing further. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Production.postFixpoint' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Production.postFixpoint
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Production.semanticAudit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Production.semanticAudit
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Production.functionSummary_sound' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Production.functionSummary_sound
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_producedHPT' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_producedHPT
+
+/-! Persistent-cache hits and artifact-local rebuilds are likewise outside the
+trust boundary: the returned value stores the exact ordinary checker equality.
+The filesystem adapter carries no theorem and cannot weaken these cones. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Cache.Production.postFixpoint' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Cache.Production.postFixpoint
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Cache.Production.semanticAudit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Cache.Production.semanticAudit
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Cache.Production.functionSummary_sound' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Cache.Production.functionSummary_sound
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_cachedHPT' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.functionSummary_sound_of_cachedHPT
+
+/-! The first HPT consumer, including owner-sensitive whole-function fact
+propagation, recursive supplied-code traversal, self-call-aware rewriting, and
+declaration-graph rebuilding, is pure through its logical old-keyed layer.
+Checked, directly produced, cached, and content-address rebuild wrappers add
+exactly the already-ledgered native digest dependency, and no
+transformation-specific assumption. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runCode_runWithFacts_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runCode_runWithFacts_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runCode_rewriteCurrentAt_body_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runCode_rewriteCurrentAt_body_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runCode_run_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runCode_run_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runCode_run_eq_of_runWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runCode_run_eq_of_runWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runCode_pruneCase_of_checkHPTWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runCode_pruneCase_of_checkHPTWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runCode_pruneCaseWithProducedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runCode_pruneCaseWithProducedHPT_eq
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runCode_pruneCaseWithCachedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runCode_pruneCaseWithCachedHPT_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runCode_runRecursive_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runCode_runRecursive_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runCode_runRecursive_eq_of_runWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runCode_runRecursive_eq_of_runWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runCode_pruneCasesRecursive_of_checkHPTWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runCode_pruneCasesRecursive_of_checkHPTWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runCode_pruneCasesRecursiveWithProducedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runCode_pruneCasesRecursiveWithProducedHPT_eq
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runCode_pruneCasesRecursiveWithCachedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runCode_pruneCasesRecursiveWithCachedHPT_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runMain_runRecursive_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runMain_runRecursive_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runMain_runRecursive_eq_of_runWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runMain_runRecursive_eq_of_runWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runMain_pruneMain_of_checkHPTWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runMain_pruneMain_of_checkHPTWith_eq_ok
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runMain_pruneMainWithProducedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runMain_pruneMainWithProducedHPT_eq
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runMain_pruneMainWithCachedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runMain_pruneMainWithCachedHPT_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runMain_rewriteProgram_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runMain_rewriteProgram_eq
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.runMain_exact_of_rebuild_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.runMain_exact_of_rebuild_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.ReaddressAll.runMain_exact_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ReaddressAll.runMain_exact_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.CasePrune.runMain_rebuild_rewriteProgram' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.CasePrune.runMain_rebuild_rewriteProgram
+
+/-! Scalar fetch forwarding is exact both at one accepted constructor/fetch
+pair and through its owner-sensitive recursive traversal. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FetchForward.runCode_forwardHead?_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FetchForward.runCode_forwardHead?_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.FetchForward.runCode_runWithFacts_eq_ownerCompatible' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.FetchForward.runCode_runWithFacts_eq_ownerCompatible
+
+/-! Shape-specialized destruction is pure at both the accepted local
+decision and the complete owner-sensitive fact traversal. -/
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Destroy.runOp_specialize?_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Destroy.runOp_specialize?_success
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.Destroy.runCode_runWithFacts_success_ownerCompatible' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.Destroy.runCode_runWithFacts_success_ownerCompatible
+
+/-! Rooted reachability is exact after validation and through its fail-soft
+produce/check/apply wrapper.  Both public theorems expose the native BLAKE3
+axiom because validation commits to the exact input graph digest. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Reachability.runMain_filterEntries_eq_of_validate' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reachability.runMain_filterEntries_eq_of_validate
+
+/-- info: 'Ix.Compiler.IxIR1.Reachability.runMain_run_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Reachability.runMain_run_eq
+
+/-! The first allocation-shrinking consumer is pure through both the generic
+heap-history evaluator congruence and its executable local decision theorem. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.HeapHistoryIso.toHeapIso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.HeapHistoryIso.toHeapIso
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.HeapHistoryIso.toHeapIso_rel' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.HeapHistoryIso.toHeapIso_rel
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.HeapHistoryIso.of_toHeapIso_rel' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.HeapHistoryIso.of_toHeapIso_rel
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.runCode_historyIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.runCode_historyIso
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.PAPFuse.fusePair?_refines' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.PAPFuse.fusePair?_refines
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.runCode_abstractEnvironment' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.runCode_abstractEnvironment
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.runCode_exactEnvironment_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.runCode_exactEnvironment_eq
+
+/-- info: 'Ix.Compiler.IxIR1.HPT.OptimizeProgram.runMain_rebuildProgram_of_runWith_eq_ok_defaultOracle' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.HPT.OptimizeProgram.runMain_rebuildProgram_of_runWith_eq_ok_defaultOracle
+
+/-! Fail-soft optimizer reclamation uses one forwarded execution, evaluator
+determinism, allocation-history release transport, and the exact final rebuild.
+The produced and cached wrappers expose the same native digest boundary as the
+checked HPT and rebuild inputs. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Optimizer.Outcome.reclamation_of_witness' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Optimizer.Outcome.reclamation_of_witness
+
+/-- info: 'Ix.Compiler.IxIR1.Optimizer.reclamation_of_runWithProducedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Optimizer.reclamation_of_runWithProducedHPT_eq
+
+/-- info: 'Ix.Compiler.IxIR1.Optimizer.reclamation_of_runWithCachedHPT_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Optimizer.reclamation_of_runWithCachedHPT_eq
+
+/-- info: 'Ix.Compiler.Pipeline.Artifact.runMain_pruneProgram_of_checkAndPruneProgramWith_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.Artifact.runMain_pruneProgram_of_checkAndPruneProgramWith_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.semanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.semanticAudit_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.Result.declaration_lookup_of_mem_of_semanticAudit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.Result.declaration_lookup_of_mem_of_semanticAudit
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.isolates_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.isolates_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.Oracle.Readdressable.examples_of_isolates' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.Oracle.Readdressable.examples_of_isolates
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.Oracle.Readdressable.examples_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.Oracle.Readdressable.examples_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.EraseAddressed.semanticAudit_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.EraseAddressed.semanticAudit_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.EraseAddressed.run_semantics_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.EraseAddressed.run_semantics_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.EraseAddressed.run_projectionSafeMain_of_run_eq_ok' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.EraseAddressed.run_projectionSafeMain_of_run_eq_ok
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.AddressedSemanticForwardSimulation.precomposeIxIR0' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.AddressedSemanticForwardSimulation.precomposeIxIR0
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_after_addressedErasure' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_after_addressedErasure
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_protectsSourceAddresses' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_protectsSourceAddresses
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_runMain' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_runMain
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_semanticForwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_semanticForwardSimulation
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_memoryErrorUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_memoryErrorUnreachable
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_ordinaryStuckUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_ordinaryStuckUnreachable
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_unknownRefUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_unknownRefUnreachable
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_runMain_cost' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_runMain_cost
+
+/-! The SCC-aware production boundary carries the same native digest axiom
+and now permits source-function rekeying while auditing constructor stability. -/
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain_exact' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain_exact
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain_exact_success' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain_exact_success
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_apply_constructorIdentity' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_apply_constructorIdentity
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_exact' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_exact
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_memoryErrorUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_memoryErrorUnreachable
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_ordinaryStuckUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_ordinaryStuckUnreachable
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_unknownRefUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_unknownRefUnreachable
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain_cost' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_runMain_cost
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_after_addressedErasure' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_after_addressedErasure
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_exact_after_addressedErasure' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_exact_after_addressedErasure
+
+/-! ## Erasure-safe whole-pass progress
+(`Ix/Compiler/IxIR1/LowerProgress.lean`)
+
+The certified-erasure route rules out the raw lowering's erased-projection
+absorber.  Pin both the source-side projection-safety bridge and the resulting
+whole-main progress/simulation boundaries.  The call-aware pins additionally
+ensure that callable target progress is reconstructed from exact source-fuel
+traces and whole-pass provenance, rather than from `CompilerProgressContracts`.
+-/
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_erasure' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_erasure
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_erasure_with_members' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_erasure_with_members
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_erasure_inlineSharing' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_erasure_inlineSharing
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_certifiedSharedClosed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.ProjectionSafeEval.of_certifiedSharedClosed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_erasure_inlineSharing_with_members' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_erasure_inlineSharing_with_members
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_with_members' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_with_members
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_erasure_with_members' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_erasure_with_members
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_addressed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_addressed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_main_progress_of_certificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_main_progress_of_certificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_semanticForwardSimulation_of_certificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAddressed_semanticForwardSimulation_of_certificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_main_progress_of_certificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_main_progress_of_certificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAction_main_progress_of_addressed_certificate_with_members_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedAction_main_progress_of_addressed_certificate_with_members_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_main_progress_of_addressed_certificate_with_members_exact_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_main_progress_of_addressed_certificate_with_members_exact_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_exact_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_exact_sealed
+
+/-! The validated pipeline retains the exact member scope, erasure certificate,
+member coverage, and both address-pass equations consumed by the production
+semantic endpoint.  Its O1 projection pins semantic preservation, progress,
+memory-error exclusion, reclamation, and the evaluator-universal allocation/
+free law directly on the artifact selected by the fail-soft optimizer. -/
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.targetDeclEnv_ne_extern' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.targetDeclEnv_ne_extern
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.externValueContract' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.externValueContract
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.externTraceProgressContract' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.externTraceProgressContract
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.semanticForwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.semanticForwardSimulation
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.semanticForwardSimulationOfProducedOptimizedArtifact' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.semanticForwardSimulationOfProducedOptimizedArtifact
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.targetProgressAfterProducedOptimization' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.targetProgressAfterProducedOptimization
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.memoryErrorUnreachableAfterProducedOptimization' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.memoryErrorUnreachableAfterProducedOptimization
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.reclamationAfterProducedOptimization' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.reclamationAfterProducedOptimization
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.allocationFreeCostInvariantAfterProducedOptimization' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.allocationFreeCostInvariantAfterProducedOptimization
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.sourceCallableRowsSelected' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.sourceCallableRowsSelected
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.sourceDeclLayout' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.sourceDeclLayout
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.sourcePapSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.sourcePapSafe
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.fnDeclCovered' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.fnDeclCovered
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.exactExtraRepresented' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.exactExtraRepresented
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.exactCompilerContracts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.exactCompilerContracts
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.targetProgress' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.targetProgress
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.memoryErrorUnreachable' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.memoryErrorUnreachable
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.reclamation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.reclamation
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.costRefinement' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.costRefinement
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.ownershipAmortizedCostRefinement' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.ownershipAmortizedCostRefinement
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_compilerTraceProgressContracts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_compilerTraceProgressContracts
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_main_progress_of_certificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_main_progress_of_certificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_main_progress_of_projectionSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_main_progress_of_projectionSafe
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_ordinaryStuckUnreachable_of_erasure_inlineSharing_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_ordinaryStuckUnreachable_of_erasure_inlineSharing_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_semanticForwardSimulation_of_erasure_inlineSharing_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_semanticForwardSimulation_of_erasure_inlineSharing_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_semanticForwardSimulation_of_certificate_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_semanticForwardSimulation_of_certificate_sealed
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_semanticForwardSimulation_of_certificate_trace_sealed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_semanticForwardSimulation_of_certificate_trace_sealed
+
+/-! ## Owner-sensitive dynamic application
+
+Dynamic PAP entry is guarded by declaration metadata, while saturated direct
+calls retain heterogeneous ownership boundaries. These pins keep the computed
+metadata, whole-pass provenance, strictly-weaker mixed-mode premise, and joint
+contract seal inside the ordinary proof axiom envelope. -/
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_sourceDeclLayout' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_sourceDeclLayout
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_sourcePapSafe' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_sourcePapSafe
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_fnDeclCovered' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_fnDeclCovered
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_extraProvenance_empty' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_extraProvenance_empty
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.GeneratedDeclProvenance.fnPreservesAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.GeneratedDeclProvenance.fnPreservesAt
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_sourceFnPreservesAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_sourceFnPreservesAt
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_compilerContracts' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_compilerContracts
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerDecl_defn_papSafe_of_run' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerDecl_defn_papSafe_of_run
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerDecl_recursor_papSafe_of_run' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerDecl_recursor_papSafe_of_run
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerAllAction_compilerFunction_declPapSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerAllAction_compilerFunction_declPapSafe
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.SourceAllShared.papSafe' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.SourceAllShared.papSafe
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.sourcePapSafe_not_sourceAllShared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.sourcePapSafe_not_sourceAllShared
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.papSafeDeclContractsBelow_of_source_extra' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.papSafeDeclContractsBelow_of_source_extra
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.compilerContracts_of_source_extra_below_step' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.compilerContracts_of_source_extra_below_step
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.applyOwnershipContract_of_papSafeDecls' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.applyOwnershipContract_of_papSafeDecls
+
+/-! ## Semantic projection (`Ix/Compiler/IxIR1/LowerSim.lean`)
+
+The premise-free member of the projection value pipeline: variable-target
+projection needs no compiler-induction hypothesis, so its cone is the whole
+borrow/fetch/retain/release argument. -/
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerE_proj_var_run_value_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerE_proj_var_run_value_sound
+
+/-- info: 'Ix.Compiler.IxIR1.LowerSim.lowerE_proj_erasure_run_value_progress_within' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.LowerSim.lowerE_proj_erasure_run_value_progress_within
+
+/-! ## Indexed address environments (`Ix/Compiler/AddressEnv.lean`)
+
+The corpus path builds each hash index once, while these equalities retain the
+transparent first-binding-wins list semantics as the proof specification. -/
+
+/-- info: 'Ix.Compiler.AddressEnv.lookup_build' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.AddressEnv.lookup_build
+
+/-- info: 'Ix.Compiler.IxIR1.Lower.lowerAllIndexed_eq_lowerAll' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Lower.lowerAllIndexed_eq_lowerAll
+
+/-- info: 'Ix.Compiler.Pipeline.ResolverIndex.resolve_ofList' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ResolverIndex.resolve_ofList
+
+/-! ## Codec laws -/
+
+/-- info: 'Ix.Compiler.Ixon.Address.roundtripLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Address.roundtripLaw
+
+/-- info: 'Ix.Compiler.Ixon.Address.canonicalLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Address.canonicalLaw
+
+/-- info: 'Ix.Compiler.Ixon.Univ.roundtripLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Univ.roundtripLaw
+
+/-- info: 'Ix.Compiler.Ixon.Univ.canonicalLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Univ.canonicalLaw
+
+/-- info: 'Ix.Compiler.Ixon.Expr.roundtripLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Expr.roundtripLaw
+
+/-- info: 'Ix.Compiler.Ixon.Expr.canonicalLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Expr.canonicalLaw
+
+/-- info: 'Ix.Compiler.Ixon.ConstantInfo.roundtripLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.ConstantInfo.roundtripLaw
+
+/-- info: 'Ix.Compiler.Ixon.ConstantInfo.canonicalLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.ConstantInfo.canonicalLaw
+
+/-- info: 'Ix.Compiler.Ixon.Constant.roundtripLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Constant.roundtripLaw
+
+/-- info: 'Ix.Compiler.Ixon.Constant.canonicalLaw' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Ixon.Constant.canonicalLaw
+
+/-- info: 'Ix.Compiler.IxIR0.Decl.decodePreimage_roundtrip' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Decl.decodePreimage_roundtrip
+
+/-- info: 'Ix.Compiler.IxIR0.Decl.decodePreimage_canonical' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Decl.decodePreimage_canonical
+
+/-- info: 'Ix.Compiler.IxIR0.Decl.preimage_injective' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Decl.preimage_injective
+
+/-- info: 'Ix.Compiler.IxIR1.Decl.decodePreimage_roundtrip' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Decl.decodePreimage_roundtrip
+
+/-- info: 'Ix.Compiler.IxIR1.Decl.decodePreimage_canonical' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Decl.decodePreimage_canonical
+
+/-- info: 'Ix.Compiler.IxIR1.Decl.preimage_injective' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Decl.preimage_injective
+
+/-- info: 'Ix.Compiler.IxIR0.MutualBlock.Block.decodePreimage_roundtrip' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MutualBlock.Block.decodePreimage_roundtrip
+
+/-- info: 'Ix.Compiler.IxIR0.MutualBlock.Block.decodePreimage_canonical' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MutualBlock.Block.decodePreimage_canonical
+
+/-- info: 'Ix.Compiler.IxIR0.MutualBlock.Block.preimage_injective' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MutualBlock.Block.preimage_injective
+
+/-- info: 'Ix.Compiler.IxIR1.MutualBlock.Block.decodePreimage_roundtrip' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.MutualBlock.Block.decodePreimage_roundtrip
+
+/-- info: 'Ix.Compiler.IxIR1.MutualBlock.Block.decodePreimage_canonical' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.MutualBlock.Block.decodePreimage_canonical
+
+/-- info: 'Ix.Compiler.IxIR1.MutualBlock.Block.preimage_injective' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.MutualBlock.Block.preimage_injective
+
+/-! ## IxIR₂ credit-counter algebra -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CounterLaw.afterHotReset' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CounterLaw.afterHotReset
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CounterLaw.afterReuse' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CounterLaw.afterReuse
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CounterLaw.afterDiscard' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CounterLaw.afterDiscard
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CounterLaw.terminalFrees' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CounterLaw.terminalFrees
+
+/-! ## IxIR₂ structured-lowering acceptance -/
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.headBlock_mem_blocks' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.headBlock_mem_blocks
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.blocks_subset_of_child' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.blocks_subset_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.blocks_subset' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.blocks_subset
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountMatches' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountMatches
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountsMatch' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountMatches_of_match' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountMatches_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCount_eq_headParams_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCount_eq_headParams_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountsMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.entryValueCountsMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.entryValueCountsMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.entryValueCountsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.inductTree' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.inductTree
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.letOpSyntax_of_match' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.letOpSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.operationSyntax_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.operationSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.letOpOperationSyntax_of_match' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.letOpOperationSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.retSyntax_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.retSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.tailCallSyntax_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.tailCallSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.tailCallSelfSyntax_of_match' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.tailCallSelfSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.switchSyntax_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.switchSyntax_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.syntaxMatches_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.syntaxMatches_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.syntaxMatches' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.syntaxMatches
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.fetchPrologueAt_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.fetchPrologueAt_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_getElem?' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_getElem?
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_tag' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_tag
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.constructorBranchMatchAt_of_switch_match' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.constructorBranchMatchAt_of_switch_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.natZeroBranchMatchAt_of_switch_match' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.natZeroBranchMatchAt_of_switch_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.natBranchPairMatch_of_switch_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.natBranchPairMatch_of_switch_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.switchBranchShape_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.switchBranchShape_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.switchBranchesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.switchBranchesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantSwitchBranchesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantSwitchBranchesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.letOpMatch_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.letOpMatch_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.instructionAt_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.instructionAt_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.headBlock_eq_sourceBlock_of_match' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.headBlock_eq_sourceBlock_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.InputMap.forgets_of_check' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.InputMap.forgets_of_check
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.inputMapForgets_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.inputMapForgets_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.inputMapSize_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.inputMapSize_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.instructionsMatch_of_child' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.instructionsMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.instructionsMatch' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.instructionsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.inputMapsMatch_of_child' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.inputMapsMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.inputMapsMatch' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.inputMapsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.functionSourceMatch_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.functionSourceMatch_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.functionSourceEq_eq_true_iff' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.functionSourceEq_eq_true_iff
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.inputEq_eq_true_iff' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.inputEq_eq_true_iff
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.functionTraceMatch_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.functionTraceMatch_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.rootSourceCode' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.rootSourceCode
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.sourceArity' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.sourceArity
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.sourceResult' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.sourceResult
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.sourcePapSafe' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.sourcePapSafe
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.entryBlock' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.entryBlock
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.entryPc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.entryPc
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.entryValueCount' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.entryValueCount
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.entryInput' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.entryInput
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.rootHeadBlock' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.rootHeadBlock
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainOwner' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainOwner
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainSource' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainSource
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainGenerated' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainGenerated
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainArity' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainArity
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainRootSourceCode' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainRootSourceCode
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainEntryInput' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainEntryInput
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainHeadBlockAt' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainHeadBlockAt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainNonempty' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainNonempty
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.blockAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.blockAt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.blockAt_of_mem' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.blockAt_of_mem
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.headBlockAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.headBlockAt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantHeadBlockAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantHeadBlockAt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantInstructionsMatch' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantInstructionsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantInputMapsMatch' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantInputMapsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantEntryValueCount' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantEntryValueCount
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantSyntaxMatches' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantSyntaxMatches
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantOperationSyntax' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantOperationSyntax
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.generatedNonempty' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.generatedNonempty
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantLetOpMatch' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.FunctionTrace.descendantLetOpMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.programTraceOrder_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.programTraceOrder_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.functionTrace_of_source_mem' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.functionTrace_of_source_mem
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.valid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.valid
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CheckedRun.valid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CheckedRun.valid
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolveAtom_of_envRel' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolveAtom_of_envRel
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolveAtom_of_envRel_target' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolveAtom_of_envRel_target
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.initial' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.initial
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.empty' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.empty
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.blockAt' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.blockAt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.instructionAt' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.instructionAt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.letOpNext' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.letOpNext
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.forget' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.forget
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.forgetTracedValue' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.forgetTracedValue
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.forgetTracedErased' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.forgetTracedErased
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.entry' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.entry
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.functionEntryCodeState' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.functionEntryCodeState
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.initialMainState' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.initialMainState
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.initialMainCodeState' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.initialMainCodeState
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.runMain_eq_initialMainMachine' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.runMain_eq_initialMainMachine
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolveAtom_shift' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolveAtom_shift
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.sourceMapOf' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.sourceMapOf
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.constructorFields' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.constructorFields
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_edge_transfer' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_edge_transfer
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolvedAtoms_of_resolveAtoms' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolvedAtoms_of_resolveAtoms
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolveAtoms_exists_of_pointwise' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolveAtoms_exists_of_pointwise
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.ResolvedAtomsList.getElem?' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.ResolvedAtomsList.getElem?
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.of_edge_arguments' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.of_edge_arguments
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_edge_transfer_from_parent' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_edge_transfer_from_parent
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EdgeArgsRel.canonical' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EdgeArgsRel.canonical
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_generated_edge_transfer' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_generated_edge_transfer
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.edgeRuntimeReady_of_envRel' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.edgeRuntimeReady_of_envRel
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.move' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.move
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolveAtoms_of_envRel' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolveAtoms_of_envRel
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.resolveAtoms_of_envRel_target' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.resolveAtoms_of_envRel_target
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.atomsRel_of_translateAtoms' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.atomsRel_of_translateAtoms
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.bindValue' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.bindValue
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.letOpValueNext' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.letOpValueNext
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_pure_move' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_pure_move
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_pure_move' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_pure_move
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_pure_move_state' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_pure_move_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_pure_move_success_step' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_pure_move_success_step
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.alloc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.alloc
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.alloc' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.alloc
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_alloc' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_alloc
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_alloc_state' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_alloc_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.pappFn' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.pappFn
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_papp_fn' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_papp_fn
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_papp_fn_state' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_papp_fn_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.RetainSharedMany.empty' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.RetainSharedMany.empty
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.RetainSharedMany.cons' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.RetainSharedMany.cons
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.RetainSharedMany.cons_inv' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.RetainSharedMany.cons_inv
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ApplyTransfer.erased' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ApplyTransfer.erased
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ApplyTransfer.papUnder' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ApplyTransfer.papUnder
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ApplyTransfer.papFn' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ApplyTransfer.papFn
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ApplyTransfer.papExtern' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ApplyTransfer.papExtern
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ApplyTransferCase.transfer' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ApplyTransferCase.transfer
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ApplyTransfer.classify' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ApplyTransfer.classify
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.apply' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.apply
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retApplyMore' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retApplyMore
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dupVals_simulates_retainSharedMany' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dupVals_simulates_retainSharedMany
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.empty' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.empty
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.positiveSharedRC' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.positiveSharedRC
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.resolveAtom' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.resolveAtom
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.resolveAtoms' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.resolveAtoms
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.resolveAtomsReverse' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.resolveAtomsReverse
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.constructorBranch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.constructorBranch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.natSuccessor' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.natSuccessor
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runCode' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runCode
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runOp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runOp
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.invoke' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.invoke
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.applyGo' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.applyGo
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runCodeNoReuse' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runCodeNoReuse
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runOpNoReuse' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.runOpNoReuse
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.invokeNoReuse' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.invokeNoReuse
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.applyGoNoReuse' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceRuntimeInvariant.applyGoNoReuse
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.PositiveSharedRC.dupVals' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.PositiveSharedRC.dupVals
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_prepare' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_prepare
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_erased' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_erased
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_pap_under' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_pap_under
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_pap_saturated_enter' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_pap_saturated_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_pap_over_enter' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_applyGo_pap_over_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_under' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_under
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_saturated_enter' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_saturated_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_over_enter' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_apply_pap_over_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_apply_transfer_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_apply_transfer_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_apply_pap_saturated_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_apply_pap_saturated_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_apply_pap_over_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_apply_pap_over_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_apply_more' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_apply_more
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_apply_more_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_apply_more_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.source_runOp_call_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.source_runOp_call_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.source_runOp_callSelf_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.source_runOp_callSelf_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.source_runCode_tail_call_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.source_runCode_tail_call_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.source_runCode_tail_callSelf_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.source_runCode_tail_callSelf_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_call_fn_enter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_call_fn_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_call_fn_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_call_fn_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_call_self_enter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_call_self_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_tail_call_fn_enter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_tail_call_fn_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_tail_call_fn_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_tail_call_fn_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_tail_call_self_enter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_tail_call_self_enter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_call_fn_enter_source_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_call_fn_enter_source_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_call_self_enter_source_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_call_self_enter_source_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_tail_call_fn_enter_source_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_tail_call_fn_enter_source_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_tail_call_self_enter_source_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_tail_call_self_enter_source_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Steps.trans' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Steps.trans
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.initialMachine_store_empty' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.initialMachine_store_empty
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runFunction_eq_runMachine' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runFunction_eq_runMachine
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runMain_eq_runMachine' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runMain_eq_runMachine
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Steps.runMachine' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Steps.runMachine
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Steps.runMachine_halted' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Steps.runMachine_halted
+
+/-! The credit-aware evaluator proof seam used by reuse-insertion proofs. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditLookup.of_getElem' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditLookup.of_getElem
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTake.of_lookup' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTake.of_lookup
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTakeMany.single' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTakeMany.single
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ConstructorView.of_box' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ConstructorView.of_box
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ConstructorView.parts' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ConstructorView.parts
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.EdgeTransfer.of_parts' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.EdgeTransfer.of_parts
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.branchCreditPresent' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.branchCreditPresent
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.branchCreditAbsent' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.branchCreditAbsent
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.allocWithAbsent' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.allocWithAbsent
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.allocWithLogical' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.allocWithLogical
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.allocWithPhysical' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.allocWithPhysical
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.discardCreditAbsent' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.discardCreditAbsent
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.discardCreditLogical' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.discardCreditLogical
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.discardCreditPhysical' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.discardCreditPhysical
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.takeUniqueLogical' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.takeUniqueLogical
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.takeUniquePhysical' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.takeUniquePhysical
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.resetSharedLogicalHot' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.resetSharedLogicalHot
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.resetSharedPhysicalHot' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.resetSharedPhysicalHot
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.resetSharedCold' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.resetSharedCold
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.EdgeTransfer.baseline' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.EdgeTransfer.baseline
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.jump' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.jump
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.switchCtor' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.switchCtor
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.switchNatZero' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.switchNatZero
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.switchNatSucc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.switchNatSucc
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.callFn' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.callFn
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.callSelf' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.callSelf
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.tailCallFn' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.tailCallFn
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.tailCallSelf' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.tailCallSelf
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.tailCallSelfCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.tailCallSelfCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retResumeCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retResumeCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retHaltCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retHaltCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retApplyMoreCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retApplyMoreCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.tailCallFnCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.tailCallFnCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.callFnCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.callFnCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.callSelfCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.callSelfCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.pappFnCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.pappFnCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.pappExternCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.pappExternCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.externCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.externCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.applyCleared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.applyCleared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.InstructionTransferCase.step' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.InstructionTransferCase.step
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.InstructionTransfer.classify' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.InstructionTransfer.classify
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.TerminatorTransferCase.step' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.TerminatorTransferCase.step
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.TerminatorTransfer.classify' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.TerminatorTransfer.classify
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.StepCase.step' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.StepCase.step
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.classify' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.classify
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retResume' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retResume
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_letOp_continuation' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_letOp_continuation
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_case_ctor_branch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_case_ctor_branch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_case_nat_zero_branch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_case_nat_zero_branch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_case_nat_succ_branch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_case_nat_succ_branch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_fetch_prologue' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_fetch_prologue
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_switch_ctor_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_switch_ctor_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_switch_nat_zero_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_switch_nat_zero_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_switch_nat_succ_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_switch_nat_succ_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_resume' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_resume
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_resume_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_resume_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_return_to_letOp_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_return_to_letOp_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retHalt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retHalt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_halt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_halt
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_halt_state' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_halt_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_halt_success' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_ret_halt_success
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_halt_runMachine' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_ret_halt_runMachine
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.retainShared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.retainShared
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.rcTick' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.rcTick
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_dup_retain_scalar' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_dup_retain_scalar
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_dup_retain_shared' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_dup_retain_shared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.fetch' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.fetch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_fetch' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_fetch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_fetch_state' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_fetch_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.releaseShared' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.releaseShared
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.freeUnique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.freeUnique
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.kill' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.kill
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.releaseShared_of_scalar' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.releaseShared_of_scalar
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.EnvRel.bindErased' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.EnvRel.bindErased
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_scalar' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_scalar
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_free_freeUnique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_free_freeUnique
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_free_freeUnique_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_free_freeUnique_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.dropUnique' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.dropUnique
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropUnique_of_scalar' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropUnique_of_scalar
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_dropU_dropUnique_scalar' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_dropU_dropUnique_scalar
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_shared_nonunit' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_shared_nonunit
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.sourceDropMany_of_scalars' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.sourceDropMany_of_scalars
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.sourceDropManyU_of_scalars' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.sourceDropManyU_of_scalars
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_of_scalars' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_of_scalars
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropUniqueWork_of_scalars' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropUniqueWork_of_scalars
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_dropU_dropUnique_scalar_ctor' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_dropU_dropUnique_scalar_ctor
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_shared_unit_scalar_ctor' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_shared_unit_scalar_ctor
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropUniqueWork_append' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropUniqueWork_append
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.uniqueDropWork_simulation' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.uniqueDropWork_simulation
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropUVal_simulates_dropUniqueWork' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropUVal_simulates_dropUniqueWork
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropManyU_simulates_dropUniqueWork' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropManyU_simulates_dropUniqueWork
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_dropU_dropUnique_recursive' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_dropU_dropUnique_recursive
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_dropU_dropUnique_recursive_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_dropU_dropUnique_recursive_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_append' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_append
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_success_unique' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_success_unique
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.sharedReleaseWork_simulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.sharedReleaseWork_simulation
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropVal_simulates_releaseSharedWork' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropVal_simulates_releaseSharedWork
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropMany_simulates_releaseSharedWork' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropMany_simulates_releaseSharedWork
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_recursive' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_drop_release_recursive
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_drop_release_recursive_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_drop_release_recursive_state
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.FieldWorlds.of_replicate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.FieldWorlds.of_replicate
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.hasWorld_eq_true_iff' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.hasWorld_eq_true_iff
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_replicate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_replicate
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_replicate_of_ownership' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_replicate_of_ownership
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.resultWorld' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CodeStateRel.resultWorld
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.ProgramTraceOrder.main_of_mem_owner' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.ProgramTraceOrder.main_of_mem_owner
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.functionTraceSource_eq_of_match' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.functionTraceSource_eq_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.codeScalarLeavesMatch_of_child' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.codeScalarLeavesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.codeScalarLeavesMatch_descendant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.codeScalarLeavesMatch_descendant
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.functionCodeScalarLeavesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.functionCodeScalarLeavesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_of_codeScalarLeavesMatch' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_of_codeScalarLeavesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.codeExactFetchesMatch_of_child' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.codeExactFetchesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.codeExactFetchesMatch_descendant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.codeExactFetchesMatch_descendant
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.functionCodeExactFetchesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.functionCodeExactFetchesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_of_codeExactFetchesMatch' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_of_codeExactFetchesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.mainAnalysisCurrentCompatible' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.mainAnalysisCurrentCompatible
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.functionTraceAnalysisCurrentCompatible' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.functionTraceAnalysisCurrentCompatible
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.functionTraceAnalysisCurrent' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.functionTraceAnalysisCurrent
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.exactConstructorAt?_of_fetch_descendant' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.exactConstructorAt?_of_fetch_descendant
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.scalarLeafAt?_of_free_descendant' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.scalarLeafAt?_of_free_descendant
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.schema_fields_replicate' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.schema_fields_replicate
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.schema_fields_replicate' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.schema_fields_replicate
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteFacts?_next' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteFacts?_next
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_next' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_next
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_alternative' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_alternative
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_root' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_root
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_main' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_main
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteFacts?_sourceCodeAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteFacts?_sourceCodeAt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteFacts?_alternative_of_sourceCodeAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteFacts?_alternative_of_sourceCodeAt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_root' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_root
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_main' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_main
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_alternative_ctor' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_alternative_ctor
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_alternative_natZero' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_alternative_natZero
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_alternative_natSucc' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_alternative_natSucc
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_next' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_next
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_next_of_currentCompatible' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.siteEnvironmentHolds_next_of_currentCompatible
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_eq_some' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_eq_some
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_runtime' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_runtime
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_matches_node' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.exactConstructorAt?_matches_node
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_eq_some' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_eq_some
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_runtime' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_runtime
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_matches_node' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.scalarLeafAt?_matches_node
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_free_freeUnique_state_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_free_freeUnique_state_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_fetch_state_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_fetch_state_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_fetch_state_of_run_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_fetch_state_of_run_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_free_freeUnique_state_of_run_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_free_freeUnique_state_of_run_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_functionRoot' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.sourceCodeAt?_functionRoot
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.functionEntryTraceState' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.functionEntryTraceState
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.declarationFunctionEntryTraceState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.declarationFunctionEntryTraceState
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.mainFunctionEntryTraceState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.mainFunctionEntryTraceState
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.functionEntryTraceState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.functionEntryTraceState
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.initialMainTraceState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.initialMainTraceState
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.initialMainSourceOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.initialMainSourceOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.traceState_next' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.traceState_next
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.traceState_next_of_member' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.traceState_next_of_member
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.mainTraceState_next' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.mainTraceState_next
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_apply_transfer_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_apply_transfer_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_apply_erased_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_apply_erased_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_apply_pap_under_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_apply_pap_under_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_apply_pap_saturated_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_apply_pap_saturated_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_apply_pap_over_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_apply_pap_over_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_apply_more_success' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_apply_more_success
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_apply_more_pap_saturated_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_apply_more_pap_saturated_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_apply_more_pap_over_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_apply_more_pap_over_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_apply_more_pap_under_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_apply_more_pap_under_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_apply_more_erased_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_apply_more_erased_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_call_fn_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_call_fn_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_call_self_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_call_self_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_tail_call_fn_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_tail_call_fn_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_tail_call_self_enter_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_tail_call_self_enter_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_return_to_letOp_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_return_to_letOp_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_halt_success' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_halt_success
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_pure_move_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_pure_move_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_pure_move_success_step' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_pure_move_success_step
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_alloc_checked_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_alloc_checked_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_alloc_checked_success_step' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_alloc_checked_success_step
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dup_retain_scalar_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dup_retain_scalar_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dup_retain_shared_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dup_retain_shared_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_drop_release_scalar_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_drop_release_scalar_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dropU_dropUnique_scalar_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dropU_dropUnique_scalar_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dropU_dropUnique_recursive_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dropU_dropUnique_recursive_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_drop_release_recursive_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_drop_release_recursive_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_papp_fn_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_papp_fn_state
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_fetch_state_of_run_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_fetch_state_of_run_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_free_freeUnique_state_of_run_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_free_freeUnique_state_of_run_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.next' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.next
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.constructorChild' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.constructorChild
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.natZeroChild' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.natZeroChild
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.natSuccChild' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.TraceStateRel.natSuccChild
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_switch_ctor_state_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_switch_ctor_state_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_switch_nat_zero_state_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_switch_nat_zero_state_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_switch_nat_succ_state_hpt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.simulate_traced_switch_nat_succ_state_hpt
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.hptPostFixpoint' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.hptPostFixpoint
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.hptLocalPostFixpoint' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.hptLocalPostFixpoint
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.sidecarDeclarationEnvironment' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.sidecarDeclarationEnvironment
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.hptSidecarLocalPostFixpoint' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.hptSidecarLocalPostFixpoint
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.siteEnvironmentHolds_next' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.siteEnvironmentHolds_next
+
+/-- info: 'Ix.Compiler.IxIR1.resolveAtoms_length' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.resolveAtoms_length
+
+/-- info: 'Ix.Compiler.IxIR1.runCode_ret_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runCode_ret_success
+
+/-- info: 'Ix.Compiler.IxIR1.runCode_letOp_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runCode_letOp_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_pure_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_pure_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_alloc_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_alloc_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_free_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_free_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_fetch_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_fetch_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_reuse_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_reuse_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_dup_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_dup_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_drop_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_drop_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_dropU_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_dropU_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_call_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_call_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_callSelf_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_callSelf_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_papp_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_papp_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_apply_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_apply_success
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_extern_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_extern_success
+
+/-- info: 'Ix.Compiler.IxIR1.invoke_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.invoke_success
+
+/-- info: 'Ix.Compiler.IxIR1.runCode_case_success' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runCode_case_success
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_map_fst' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_map_fst
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_of_find?' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.sourceAlternativeAtTag?_of_find?
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.indexedCaseSuccess_of_run' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.indexedCaseSuccess_of_run
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.allocationSchema_of_match' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.allocationSchema_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.allocationSchemasMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.allocationSchemasMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionAllocationSchemasMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionAllocationSchemasMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.allocationSchema' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.allocationSchema
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.allocationSchemaFields' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.allocationSchemaFields
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.allocationPosition_of_capabilities_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.allocationPosition_of_capabilities_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.sourceCapabilities_size_of_coordinateMatch' depends on axioms: [propext,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.sourceCapabilities_size_of_coordinateMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.positionMatches_of_positionsMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.positionMatches_of_positionsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.position_of_positionsMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.position_of_positionsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.positionsMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.positionsMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.positionsMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.positionsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionPositionsMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionPositionsMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.position' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.position
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.BindingCap.matchesParameter' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.BindingCap.matchesParameter
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.parameterCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.parameterCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.capability_of_parameterCapabilitiesMatch' depends on axioms: [propext,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.capability_of_parameterCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.owned_of_parameterCapabilitiesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.owned_of_parameterCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.parameterCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.parameterCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.positionParameterCapabilitiesMatch_of_match' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.positionParameterCapabilitiesMatch_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.positionParameterCapabilities_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.positionParameterCapabilities_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.parameterCapabilitiesMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.parameterCapabilitiesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.parameterCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.parameterCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionParameterCapabilitiesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionParameterCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.ownedParameterCapability' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.ownedParameterCapability
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.parameterCapability' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.parameterCapability
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.pureTransition_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.pureTransition_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.pureCapabilitiesMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.pureCapabilitiesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.pureCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.pureCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionPureCapabilitiesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionPureCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.pureTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.pureTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.dupTransition_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.dupTransition_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.dupCapabilitiesMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.dupCapabilitiesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.dupCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.dupCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionDupCapabilitiesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionDupCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.dupTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.dupTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.fetchTransition_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.fetchTransition_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.fetchCapabilitiesMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.fetchCapabilitiesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.fetchCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.fetchCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionFetchCapabilitiesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionFetchCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.fetchTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.fetchTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.retireOwnerCapabilities?_size' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.retireOwnerCapabilities?_size
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.destructionTransition_of_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.destructionTransition_of_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.destructionTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.destructionTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.consumeCapability?_size' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.consumeCapability?_size
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.consumeCapabilitiesList?_size' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.consumeCapabilitiesList?_size
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.allocationTransition_of_capabilities_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.allocationTransition_of_capabilities_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.allocationTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.allocationTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.pappTransition_of_capabilities_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.pappTransition_of_capabilities_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.pappTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.pappTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.callTransition_of_capabilities_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.callTransition_of_capabilities_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.callSelfTransition_of_capabilities_match' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.callSelfTransition_of_capabilities_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.callTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.callTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.callSelfTransition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.callSelfTransition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.sourceCapabilities_size_of_allocationMatch' depends on axioms: [propext,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.sourceCapabilities_size_of_allocationMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.coordinateMatches_of_allocationMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.coordinateMatches_of_allocationMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.sourceCapability_canConsume_of_allocationMatch' depends on axioms: [propext,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.sourceCapability_canConsume_of_allocationMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.allocationCapabilitiesMatch_of_child' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.allocationCapabilitiesMatch_of_child
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.allocationCapabilitiesMatch' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.Descendant.allocationCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Trace.functionAllocationCapabilitiesMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Trace.functionAllocationCapabilitiesMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.allocationPosition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.allocationPosition
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.empty' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.empty
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.empty' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.empty
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.rootsForCapabilities_setDead_perm' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.rootsForCapabilities_setDead_perm
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.rootsForCapabilities_owned_mem' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.rootsForCapabilities_owned_mem
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.focusOwned' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.focusOwned
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.PositionTrace.inputReg_of_owned_coordinateMatch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.PositionTrace.inputReg_of_owned_coordinateMatch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.OwnedInputRegisters.ofCoordinate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.OwnedInputRegisters.ofCoordinate
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.BorrowSupport.hasWorld' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.BorrowSupport.hasWorld
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.BorrowSupport.monoStore' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.BorrowSupport.monoStore
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.BorrowSupport.ofRestricts' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.BorrowSupport.ofRestricts
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.BorrowProvenance.hasWorld' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.BorrowProvenance.hasWorld
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.BorrowProvenance.ofRestricts' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.BorrowProvenance.ofRestricts
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.move' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.move
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.pure' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.pure
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CapabilityHolds.incRcStore' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CapabilityHolds.incRcStore
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.dup' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.dup
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.dup' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.dup
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.fetch' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.fetch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.fetch' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.fetch
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.CapabilityHolds.allocNode' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.CapabilityHolds.allocNode
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.allocationReadyOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.allocationReadyOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.alloc' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.alloc
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.alloc' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.alloc
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.papp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.papp
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.papp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.papp
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.drop' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.drop
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.dropU' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.dropU
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.free' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.free
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.drop' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.drop
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.dropU' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.dropU
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.free' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.free
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.RootOwnership_reworldHead' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.RootOwnership_reworldHead
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.callEntryInvariant' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.callEntryInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.callResultInvariant' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.callResultInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callEntry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callEntry
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callSelfEntry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callSelfEntry
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.tailCallEntry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.tailCallEntry
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.tailCallSelfEntry' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.tailCallSelfEntry
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.returnRoot' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.returnRoot
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callResult' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callResult
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callSelfResult' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipAt.callSelfResult
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.hasWorld_of_canConsume' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.hasWorld_of_canConsume
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.resolveAtom_hasWorld' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.resolveAtom_hasWorld
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.resolveAtoms_hasWorld' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.resolveAtoms_hasWorld
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_of_checked_allocation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_of_checked_allocation
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_of_checked_allocation_capabilities' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.StoreRel.fieldWorlds_of_checked_allocation_capabilities
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_alloc_checked_state' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_alloc_checked_state
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_alloc_checked_success_step' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.simulate_traced_alloc_checked_success_step
+
+/-! The continuation-passing whole-trace worker layer stays on the same
+audited attachment boundary.  Its finite-step algebra itself needs only
+propositional extensionality; attachment-facing cases additionally inherit
+the already fenced checked-hash and HPT dependencies. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.ReachesPost.refl' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.ReachesPost.refl
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.ReachesPost.prepend' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.ReachesPost.prepend
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.ReachesPost.step' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.ReachesPost.step
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.BudgetedReachesPost.prependPreserving' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.BudgetedReachesPost.prependPreserving
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.BudgetedReachesPost.prependFramed' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.BudgetedReachesPost.prependFramed
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.successfulTraceSimulationAt_zero' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.successfulTraceSimulationAt_zero
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.haltReturnHandler' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.haltReturnHandler
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_pure_move_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_pure_move_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dup_retain_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dup_retain_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_fetch_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_fetch_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_free_freeUnique_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_free_freeUnique_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_alloc_checked_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_alloc_checked_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_papp_fn_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_papp_fn_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_call_fn_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_call_fn_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_call_self_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_call_self_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_tail_call_fn_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_tail_call_fn_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_tail_call_self_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_tail_call_self_cps
+
+/-! Recursive dynamic application composes every return-time dispatcher shape
+through the smaller-fuel trace worker. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.functionTrace_of_source_declaration' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.functionTrace_of_source_declaration
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.applyMorePlan_of_applyGo' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.applyMorePlan_of_applyGo
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_ret_apply_more_pap_over_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_ret_apply_more_pap_over_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_apply_pap_over_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_apply_pap_over_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.applyMoreReturnHandler_of_plan' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.applyMoreReturnHandler_of_plan
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.applyMoreReturnHandler_of_applyGo' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.applyMoreReturnHandler_of_applyGo
+
+/-! The validated raw ownership contract crosses final readdressing for the
+exact heap image generated by compiled executions. Syntax reflection and the
+worker's `SourceStoreImage` invariant retain that image through every source
+operation and PAP-entry intermediate, so no arbitrary-final-heap contract is
+exposed by the end-to-end interface. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulationSourceContext_eq_addressedCtx' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulationSourceContext_eq_addressedCtx
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.sourceContextRenames' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.sourceContextRenames
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.rawApplyOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.rawApplyOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.applyGo_exactImage' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.applyGo_exactImage
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.sourceRebuildSemanticAudit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.sourceRebuildSemanticAudit
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.sourceCodeAddressImage' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.sourceCodeAddressImage
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.runOp_preservesSourceStoreImage' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.runOp_preservesSourceStoreImage
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+
+/-! Exact path-local HPT case facts are checked against emitted constructor
+targets and reconstruct the runtime switch selection inside the attachment. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.exactCaseTarget_of_switch_descendant' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.exactCaseTarget_of_switch_descendant
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.constructorSwitchSelection_of_exactHPT_nonempty' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.constructorSwitchSelection_of_exactHPT_nonempty
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.constructorSwitchSelection_of_exactHPT' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.constructorSwitchSelection_of_exactHPT
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.constructorSwitchSelection_of_exactHPT_runtime' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.constructorSwitchSelection_of_exactHPT_runtime
+
+/-! Recursive heap traversal is framed by the continuation's independently
+selected suffix budget. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_add_suffix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.releaseSharedWork_add_suffix
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.releaseShared_add_suffix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.releaseShared_add_suffix
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropUniqueWork_add_suffix' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropUniqueWork_add_suffix
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.dropUnique_add_suffix' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.dropUnique_add_suffix
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_drop_release_recursive_state_framed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_drop_release_recursive_state_framed
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dropU_dropUnique_recursive_state_framed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dropU_dropUnique_recursive_state_framed
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_drop_release_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_drop_release_cps
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_dropU_dropUnique_cps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_dropU_dropUnique_cps
+
+/-! The exhaustive attached worker and whole-main endpoint stay within the
+same explicit native-hash trust boundary as the checked attachment. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Sidecars.SourceConstructorsValid.runOp' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Sidecars.SourceConstructorsValid.runOp
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.runOp_preservesSourceStoreImage' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.runOp_preservesSourceStoreImage
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.constructorSwitchSelection_of_residual_nonempty' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.constructorSwitchSelection_of_residual_nonempty
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.constructorSwitchSelection_of_residual' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.constructorSwitchSelection_of_residual
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Artifact.mainTraceMember' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Artifact.mainTraceMember
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.simulate_traced_letOp_cps_of_run' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.simulate_traced_letOp_cps_of_run
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulTraceSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.successfulTraceSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.successfulMainSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.sourceContextNoReuse' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.sourceContextNoReuse
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.pappSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.pappSafe
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulSimulationContracts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.successfulSimulationContracts
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulCanonicalMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.successfulCanonicalMainSimulation
+
+/-! ## Checked block-local liveness
+
+The liveness checker retains its accepted coverage equation, and its public
+projections turn that equation into per-use coverage and a no-later-use fact.
+The executable fixture's proof wrapper must remain reflection-axiom free. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.CheckedBlock.coversAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.CheckedBlock.coversAt
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.CheckedBlock.no_use_after' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.CheckedBlock.no_use_after
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.Examples.registerTwoNoUseAfter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.Examples.registerTwoNoUseAfter
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.Examples.CheckedSuite.accepted' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.Examples.CheckedSuite.accepted
+
+/-! ## Validator-gated dynamic shared reuse insertion
+
+The first compiler-emitted reversal rewrite retains ordinary validation
+witnesses for both sides.  Its bounded benchmark checker packages the exact
+executed source/baseline/logical/physical Boolean without reflection axioms. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Placement.noUseAfter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Placement.noUseAfter
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.inferPlacementWith_sound' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.inferPlacementWith_sound
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.representation?_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.representation?_sound
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.reuseShape?_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.reuseShape?_sound
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.candidate?_sound' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.candidate?_sound
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.fits' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.fits
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.placementCoordinates' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.placementCoordinates
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noUseAfter' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noUseAfter
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.instructionCases' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.instructionCases
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noCall' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noCall
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noCallSelf' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noCallSelf
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noApply' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noApply
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noMove' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noMove
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noFreeUnique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noFreeUnique
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noPapp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noPapp
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noDropUnique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noDropUnique
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.noAllocUnique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.noAllocUnique
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.ne_resetBlock' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.ne_resetBlock
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.candidateCore' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.candidateCore
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.candidateVectors' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.candidateVectors
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.resetBlock_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.resetBlock_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.creditBlock_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.creditBlock_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.schemas' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.schemas
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.runtimeSchemas' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.runtimeSchemas
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.allocationArgumentsFound' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.allocationArgumentsFound
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Site.tailArgumentsFound' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Site.tailArgumentsFound
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Output.sourceValid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Output.sourceValid
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Output.targetValid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Output.targetValid
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.decisionAt' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.decisionAt
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.acceptedAt' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.acceptedAt
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.accepted_target_ne_source' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.accepted_target_ne_source
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.DeclarationDecisions.related' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.DeclarationDecisions.related
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.DeclarationsRel.find?_fn' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.DeclarationsRel.find?_fn
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Trace.context_fn' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Trace.context_fn
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Output.trace_target' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Output.trace_target
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Output.trace_report' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Output.trace_report
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.translateRegister?_range' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.translateRegister?_range
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.ValuesRel.pushResult' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.ValuesRel.pushResult
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.valuesRel_helperEntry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.valuesRel_helperEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.valuesRel_afterAllocation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.valuesRel_afterAllocation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.helperEntryValues_size' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.helperEntryValues_size
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.branchValues_resolve' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.branchValues_resolve
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.helperEdgeTransfer' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.helperEdgeTransfer
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAtom_translate' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAtom_translate
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAtoms_translate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAtoms_translate
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAllocationArguments' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAllocationArguments
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveTailArguments' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveTailArguments
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotLogicalControlPrefix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotLogicalControlPrefix
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPhysicalControlPrefix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPhysicalControlPrefix
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.coldControlPrefix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.coldControlPrefix
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.absentHelperControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.absentHelperControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.logicalPresentHelperControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.logicalPresentHelperControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.physicalPresentHelperControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.physicalPresentHelperControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotReuse_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotReuse_sound
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.coldPrefix_commutes' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.coldPrefix_commutes
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPrefix_contents' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPrefix_contents
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPrefixReuse_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPrefixReuse_sound
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.reuse_shared_sound_with_survivors' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.reuse_shared_sound_with_survivors
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.PlannerValueRelevant' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.PlannerValueRelevant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.PlannerAtomRelevant' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.PlannerAtomRelevant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.PlannerValueInRoots' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.PlannerValueInRoots
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.MappedValuesInRoots.selfRelated' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.MappedValuesInRoots.selfRelated
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.ValuesRel.toTranslatedValuesIso' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.ValuesRel.toTranslatedValuesIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.TranslatedValuesIso.pushResult' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.TranslatedValuesIso.pushResult
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAtom_translate_iso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAtom_translate_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAtoms_translate_iso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAtoms_translate_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAtom_iso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAtom_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAtoms_iso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAtoms_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveAllocationArguments_iso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveAllocationArguments_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.resolveTailArguments_iso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.resolveTailArguments_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.translatedValuesIso_helperEntry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.translatedValuesIso_helperEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.translatedValuesIso_afterAllocation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.translatedValuesIso_afterAllocation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.evalRuntimeSchemas' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.evalRuntimeSchemas
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.physicalPresentHelperControlIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.physicalPresentHelperControlIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPhysicalAcceptedControlIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPhysicalAcceptedControlIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.physicalPresentHelperControlTranslated' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.physicalPresentHelperControlTranslated
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPhysicalAcceptedControlTranslated' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPhysicalAcceptedControlTranslated
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotLogicalAcceptedControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotLogicalAcceptedControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.coldAcceptedControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.coldAcceptedControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.fetchPrefixControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.fetchPrefixControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.retainPrefixControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.retainPrefixControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.baselineAcceptedControl' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.baselineAcceptedControl
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotReuse_sound_with_survivors' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotReuse_sound_with_survivors
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPrefixReuse_sound_with_survivors' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPrefixReuse_sound_with_survivors
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPrefixReuse_sound_under_iso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPrefixReuse_sound_under_iso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotLogicalAcceptedPrefix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotLogicalAcceptedPrefix
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.coldAcceptedPrefix' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.coldAcceptedPrefix
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.hotPhysicalAcceptedPrefixIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.hotPhysicalAcceptedPrefixIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedHotLogicalSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedHotLogicalSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedColdSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedColdSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedHotPhysicalSimulationIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedHotPhysicalSimulationIso
+
+/-! The whole-program lift keeps its structural lookup, evaluator transport,
+heap congruence, and stable lockstep interfaces inside the ordinary logical
+axiom envelope. -/
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.RValIso.eq_of_location_eq' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.RValIso.eq_of_location_eq
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.RValsIso.refl' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.RValsIso.refl
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.RValsIso.eq_of_location_eq' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.RValsIso.eq_of_location_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.FieldWorlds.to_replicate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.FieldWorlds.to_replicate
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.FieldWorlds.congrStore' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.FieldWorlds.congrStore
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.FieldValuesWorldEq.length_eq' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.FieldValuesWorldEq.length_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.FieldWorlds.transport' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.FieldWorlds.transport
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ConstructorView.congrStore' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ConstructorView.congrStore
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ScalarOracleCall.congrOracle' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ScalarOracleCall.congrOracle
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.ScalarOracleCall.scalar' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.ScalarOracleCall.scalar
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditLookup.congrDefinition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditLookup.congrDefinition
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTake.congrDefinition' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTake.congrDefinition
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTake.target_eq' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTake.target_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTakeMany.definition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTakeMany.definition
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTakeMany.sequence' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTakeMany.sequence
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CreditTakeSequence.toMany' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CreditTakeSequence.toMany
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.EdgeTransfer.parts' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.EdgeTransfer.parts
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.EdgeTransfer.congrDefinition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.EdgeTransfer.congrDefinition
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.EdgeTransfer.targetBlock' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.EdgeTransfer.targetBlock
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.EdgeTransfer.definition' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.EdgeTransfer.definition
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.deterministic' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.deterministic
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Steps.cancelPrefixToHalted' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Steps.cancelPrefixToHalted
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.extern' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.extern
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Decision.replacement_valueParams' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Decision.replacement_valueParams
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Decision.replacement_creditParams' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Decision.replacement_creditParams
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.blockCase' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.blockCase
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.blockCaseOfLookup' depends on axioms: [propext, Classical.choice] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.blockCaseOfLookup
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.targetBlockAbi' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.targetBlockAbi
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.FunctionRewrite.definition_blocks_nonempty' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.FunctionRewrite.definition_blocks_nonempty
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Trace.context_extern' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Trace.context_extern
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.rvalHasWorld_eq' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.rvalHasWorld_eq
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.fieldWorlds' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.fieldWorlds
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.fieldWorlds_iff' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.fieldWorlds_iff
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.constructorView' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.constructorView
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.retainShared' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.retainShared
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.retainSharedMany' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.retainSharedMany
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.reserve' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.reserve
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.tickResetAttempt' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.tickResetAttempt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.tickHotReset' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.tickHotReset
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.tickColdReset' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.tickColdReset
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseReservation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseReservation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.reuseReservation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.reuseReservation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.heapIsoKillShared' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.heapIsoKillShared
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.heapIsoKillShared_rel' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.heapIsoKillShared_rel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.heapIso_rvalHasWorld_eq' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.heapIso_rvalHasWorld_eq
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.heapIso_fieldWorlds_of_replicate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.heapIso_fieldWorlds_of_replicate
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.FieldWorlds.avoidsMissing' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.FieldWorlds.avoidsMissing
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseShared' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseShared
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.releaseSharedWork_addFuel' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.releaseSharedWork_addFuel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.releaseSharedWork_remaining_le' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.releaseSharedWork_remaining_le
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseSharedWork_of_le' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseSharedWork_of_le
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.releaseShared_remaining_le' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.releaseShared_remaining_le
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.releaseShared_addFuel' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.releaseShared_addFuel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseShared_of_le' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.releaseShared_of_le
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.dropUniqueWork_contents_congr' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.dropUniqueWork_contents_congr
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.dropUnique' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.dropUnique
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.dropUniqueWork_addFuel' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.dropUniqueWork_addFuel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.dropUniqueWork_remaining_le' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.dropUniqueWork_remaining_le
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.dropUnique_addFuel' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.dropUnique_addFuel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.dropUnique_of_le' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.HeapContentsEq.dropUnique_of_le
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.entry' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.entry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.atPosition' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.atPosition
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.blockCase' depends on axioms: [propext, Classical.choice] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.blockCase
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advancePush' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advancePush
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.push' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.push
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advance' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advanceAppendCredit' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advanceAppendCredit
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.values_eq' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.values_eq
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.rewritten_eq' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.rewritten_eq
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advanceTake' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.advanceTake
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.edgeTransfer' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.edgeTransfer
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.takeIso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.takeIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.takeManyIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.takeManyIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.edgeTransferIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.edgeTransferIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameRel.entry' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameRel.entry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameRel.push' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameRel.push
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameIso.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableFrameRel.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableFrameRel.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableContinuationIso.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableContinuationIso.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableStackIso.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableStackIso.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableControlIso.recursiveCall' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableControlIso.recursiveCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMachineRel.contentsRecursiveCall' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMachineRel.contentsRecursiveCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMachineRel.isomorphicRecursiveCall' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMachineRel.isomorphicRecursiveCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableContinuationIso.applyMoreOrResume' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableContinuationIso.applyMoreOrResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedHotLogicalStableSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedHotLogicalStableSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedColdStableSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedColdStableSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedHotPhysicalStableSimulationIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedHotPhysicalStableSimulationIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferErased' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferErased
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferPapUnder' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferPapUnder
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferPapFn' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferPapFn
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferPapExtern' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransferPapExtern
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransfer' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyTransfer
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedApplyStepOfTrace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedApplyStepOfTrace
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedRetApplyMoreStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedRetApplyMoreStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedRetApplyMoreStepOfTrace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedRetApplyMoreStepOfTrace
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedMoveStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedMoveStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedFetchStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedFetchStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedFreeUniqueStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedFreeUniqueStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedAllocStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedAllocStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedAllocWithAbsentStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedAllocWithAbsentStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedAllocWithLogicalStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedAllocWithLogicalStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedAllocWithPhysicalStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedAllocWithPhysicalStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedDiscardCreditAbsentStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedDiscardCreditAbsentStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedDiscardCreditLogicalStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedDiscardCreditLogicalStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedDiscardCreditPhysicalStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedDiscardCreditPhysicalStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedTakeUniqueLogicalStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedTakeUniqueLogicalStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedTakeUniquePhysicalStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedTakeUniquePhysicalStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedResetSharedLogicalHotStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedResetSharedLogicalHotStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedResetSharedPhysicalHotStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedResetSharedPhysicalHotStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedResetSharedColdStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedResetSharedColdStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedCallSelfStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedCallSelfStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedCallFnStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedCallFnStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedPappFnStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedPappFnStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedPappExternStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedPappExternStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedExternStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedExternStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedTailCallSelfStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedTailCallSelfStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedTailCallFnStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedTailCallFnStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedRetResumeStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedRetResumeStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedRetHaltStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedRetHaltStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedJumpStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedJumpStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedSwitchCtorStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedSwitchCtorStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedSwitchNatZeroStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedSwitchNatZeroStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedSwitchNatSuccStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedSwitchNatSuccStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedBranchCreditPresentStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedBranchCreditPresentStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedBranchCreditAbsentStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedBranchCreditAbsentStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedRetainSharedStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedRetainSharedStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedReleaseSharedStep' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedReleaseSharedStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedDropUniqueStep' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedDropUniqueStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedInstructionStepOfTrace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedInstructionStepOfTrace
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedInstructionStepOfTraceIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedInstructionStepOfTraceIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedTerminatorStepOfTrace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedTerminatorStepOfTrace
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedTerminatorStepOfTraceIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedTerminatorStepOfTraceIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedStepOfTrace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedStepOfTrace
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.unchangedStepOfTraceIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.unchangedStepOfTraceIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMacroSimulation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMacroSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMacroSimulation.ofStepsOne' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMacroSimulation.ofStepsOne
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMachineRel.haltedParts' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMachineRel.haltedParts
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMacroInvariantStep' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMacroInvariantStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMacroInvariantStep.simulation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMacroInvariantStep.simulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableMacroSimulation.preserveInvariant' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableMacroSimulation.preserveInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedHotLogicalStableMacroSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedHotLogicalStableMacroSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedColdStableMacroSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedColdStableMacroSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedHotPhysicalStableMacroSimulationIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedHotPhysicalStableMacroSimulationIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.acceptedColdStableMacroSimulationIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.acceptedColdStableMacroSimulationIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.stableMacroStepOfTrace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.stableMacroStepOfTrace
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.stableMacroStepOfTraceIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.stableMacroStepOfTraceIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.stableMacroStepOfTraceRel' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.stableMacroStepOfTraceRel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.stableFiniteExecutionOfMacroInvariant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.stableFiniteExecutionOfMacroInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.stableRunMachineOfMacroInvariant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.stableRunMachineOfMacroInvariant
+
+/-! ## Liveness-indexed reuse/compiler attachment -/
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.instruction_reg_mem_blockUses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.instruction_reg_mem_blockUses
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.terminator_reg_mem_blockUses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.terminator_reg_mem_blockUses
+
+/-- info: 'Ix.Compiler.IxIR2.Liveness.mem_blockUses' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Liveness.mem_blockUses
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.callRemainingHolds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.callRemainingHolds
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.applyRemainingHolds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.applyRemainingHolds
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.applyInputOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Sim.SourceOwnershipInvariant.applyInputOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AtomLiveFrom.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AtomLiveFrom.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AtomLiveFrom.instruction' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AtomLiveFrom.instruction
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AtomLiveFrom.terminator' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AtomLiveFrom.terminator
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AtomsLiveFrom.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AtomsLiveFrom.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.plannerValueLiveAtAllocation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.plannerValueLiveAtAllocation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.plannerValueLiveAtEntry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.plannerValueLiveAtEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.entryLiveParameterCases' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.entryLiveParameterCases
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.ofRValsIso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.ofRValsIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.advance' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.advance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.push' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.push
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.append' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.append
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.resolveAtom' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.resolveAtom
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.resolveAtoms' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.resolveAtoms
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.ofStable' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.ofStable
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.advance' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.advance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.takeManyIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.takeManyIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.edgeTransferIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.edgeTransferIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationAvoids.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationAvoids.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackAvoids.transportRelation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackAvoids.transportRelation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableContinuationIso.toLive' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableContinuationIso.toLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableStackIso.toLive' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableStackIso.toLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AcceptedPrefixInstruction' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AcceptedPrefixInstruction
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AcceptedPrefixInstructionAt' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AcceptedPrefixInstructionAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.AcceptedEntry' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.AcceptedEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofPcZero' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofPcZero
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.halted' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.halted
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofSameBlock' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofSameBlock
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofSourceBlockExcluded' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofSourceBlockExcluded
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofCallResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofCallResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofCallSelfResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofCallSelfResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofApplyResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofApplyResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofMoveAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofMoveAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofFreeUniqueAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofFreeUniqueAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofPappAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofPappAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofDropUniqueAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofDropUniqueAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofAllocUniqueAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.ofAllocUniqueAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.valuesAtEntry' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveAcceptedEntry.valuesAtEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableMachineRel.toLive' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableMachineRel.toLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveControlIso.recursiveCall' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveControlIso.recursiveCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel.contentsRecursiveCall' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel.contentsRecursiveCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel.isomorphicRecursiveCall' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel.isomorphicRecursiveCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedMoveStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedMoveStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedFetchStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedFetchStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedFetchPrologueStepsLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedFetchPrologueStepsLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedCallSelfStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedCallSelfStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedCallFnStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedCallFnStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedJumpStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedJumpStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchNatZeroStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchNatZeroStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchNatSuccStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchNatSuccStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchCtorStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchCtorStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchCtorPrologueStepsLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedSwitchCtorPrologueStepsLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedBranchCreditPresentStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedBranchCreditPresentStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedBranchCreditAbsentStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedBranchCreditAbsentStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTailCallSelfStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTailCallSelfStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTailCallFnStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTailCallFnStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetResumeStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetResumeStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetHaltStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetHaltStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AtomsLiveFrom.instruction' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AtomsLiveFrom.instruction
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationIso.applyMoreOrResumeIso' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationIso.applyMoreOrResumeIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedFreeUniqueStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedFreeUniqueStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocWithAbsentStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocWithAbsentStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocWithLogicalStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocWithLogicalStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocWithPhysicalStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAllocWithPhysicalStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTakeUniqueLogicalStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTakeUniqueLogicalStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTakeUniquePhysicalStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTakeUniquePhysicalStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedResetSharedLogicalHotStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedResetSharedLogicalHotStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedResetSharedPhysicalHotStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedResetSharedPhysicalHotStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedResetSharedColdStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedResetSharedColdStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetainSharedStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetainSharedStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedReleaseSharedStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedReleaseSharedStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDropUniqueStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDropUniqueStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDiscardCreditAbsentStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDiscardCreditAbsentStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDiscardCreditLogicalStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDiscardCreditLogicalStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDiscardCreditPhysicalStepLiveIso' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedDiscardCreditPhysicalStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedPappFnStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedPappFnStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedPappExternStepLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedPappExternStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedExternStepLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedExternStepLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferErasedLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferErasedLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferPapUnderLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferPapUnderLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferPapFnLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferPapFnLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferPapExternLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferPapExternLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyTransferLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyStepOfTraceLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedApplyStepOfTraceLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetApplyMoreStepOfTraceLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedRetApplyMoreStepOfTraceLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedInstructionStepOfTraceLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedInstructionStepOfTraceLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAcceptedPrefixInstructionStepOfTraceLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedAcceptedPrefixInstructionStepOfTraceLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTerminatorStepOfTraceLiveIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedTerminatorStepOfTraceLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedStepOfTraceLiveIso' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedStepOfTraceLiveIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotLogicalStableLiveSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotLogicalStableLiveSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveSimulationIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveSimulationIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotLogicalStableLiveMacroSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotLogicalStableLiveMacroSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveMacroSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveMacroSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveMacroSimulationIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveMacroSimulationIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccounting' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccounting
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccountingAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccountingAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveMacroSimulationIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveMacroSimulationIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveMacroSimulationIsoAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedColdStableLiveMacroSimulationIsoAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveMacroStepOfTraceIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveMacroStepOfTraceIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulationAt' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulationAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulationAt.simulation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulationAt.simulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroInvariantStep' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroInvariantStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroInvariantStep.simulation' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroInvariantStep.simulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulation.preserveInvariant' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulation.preserveInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulation.ofStepsOne' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulation.ofStepsOne
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableMacroSimulation.toLive' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableMacroSimulation.toLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveFiniteExecutionOfMacroInvariant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveFiniteExecutionOfMacroInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveFiniteExecutionOfGuidedMacroInvariant' depends on axioms: [propext,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveFiniteExecutionOfGuidedMacroInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveRunMachineOfMacroInvariant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveRunMachineOfMacroInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveRunMachineOfGuidedMacroInvariant' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.stableLiveRunMachineOfGuidedMacroInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.retainSharedMany_of_rootOwnership' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.retainSharedMany_of_rootOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.retainCtorFields_of_rootOwnership' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.retainCtorFields_of_rootOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.balanceInertRoots' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.balanceInertRoots
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.addInertRoots' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.addInertRoots
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.fieldRootPartition' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.fieldRootPartition
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.hotPrefixFieldRootPartition' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.hotPrefixFieldRootPartition
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.hotPrefixFieldRootAccounting' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.hotPrefixFieldRootAccounting
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.RootsIso.permuteRight' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.RootsIso.permuteRight
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.HeapIso.rootOwnership' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.HeapIso.rootOwnership
+
+/-- info: 'Ix.Compiler.IxIR1.Sim.HeapIso.rootOwnershipPreimageAppend' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.Sim.HeapIso.rootOwnershipPreimageAppend
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.hotPrefixFieldRootAccountingIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.hotPrefixFieldRootAccountingIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.ValueSupportedByRoots.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.ValueSupportedByRoots.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.ValueSupportedByRoots.inBounds' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.ValueSupportedByRoots.inBounds
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.identityOfInBounds' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.identityOfInBounds
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.identityOfInBounds' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.identityOfInBounds
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationIso.identityOfSupported' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationIso.identityOfSupported
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackIso.identityOfSupported' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackIso.identityOfSupported
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.ValueSupportedByRoots.avoidsUnitShared' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.ValueSupportedByRoots.avoidsUnitShared
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameInputCoverage.ofCodeState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameInputCoverage.ofCodeState
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.ofNoBorrows' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.ofNoBorrows
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.ofCallSuspension' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.ofCallSuspension
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.ofCallSelfSuspension' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.ofCallSelfSuspension
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.applyPapEntry' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.applyPapEntry
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.mappedValuesInRoots' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.mappedValuesInRoots
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.mappedValuesAtPlannerAllocation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveFrameSupportedByRoots.mappedValuesAtPlannerAllocation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.MappedValuesInRoots.preimage' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.MappedValuesInRoots.preimage
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveContinuationSupportedByRoots.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveContinuationSupportedByRoots.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveStackSupportedByRoots.mono' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveStackSupportedByRoots.mono
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.toHeapIsoOfLive' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.toHeapIsoOfLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.toHeapIsoOfSupported' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.LiveValuesIso.toHeapIsoOfSupported
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.toHeapIsoOfSupported' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveFrameIso.toHeapIsoOfSupported
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationIso.toHeapIsoOfSupported' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveContinuationIso.toHeapIsoOfSupported
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackIso.toHeapIsoOfSupported' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackIso.toHeapIsoOfSupported
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackIso.avoidsOfSupportedUnit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveStackIso.avoidsOfSupportedUnit
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.optimizeAttachment' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.optimizeAttachment
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackState
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackReturn' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackReturn
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerApplyMoreReturn' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerApplyMoreReturn
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.ownedParameterRoot' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.ownedParameterRoot
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteSourceRoot' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteSourceRoot
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteSourceRootIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteSourceRootIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.coverage' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.coverage
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.activeFrameSupportedAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.activeFrameSupportedAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.mappedValuesAtPlannerAllocationOfNoBorrows' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.mappedValuesAtPlannerAllocationOfNoBorrows
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.withHeapFuel' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.withHeapFuel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.compilerStateOfStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.compilerStateOfStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixInstructionAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixInstructionAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepPure' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepPure
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepFetch' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepFetch
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepFreeUnique' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepFreeUnique
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepRetainScalar' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepRetainScalar
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepRetainShared' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepRetainShared
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.allocationReadyOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.allocationReadyOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.allocationFieldWorlds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.allocationFieldWorlds
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepAlloc' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepAlloc
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepPapp' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepPapp
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepDropUniqueScalar' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepDropUniqueScalar
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepDropUnique' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepDropUnique
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepReleaseScalar' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepReleaseScalar
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepReleaseShared' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepReleaseShared
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyErased' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyErased
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.externImpossible' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.externImpossible
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyPapUnder' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyPapUnder
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterApplyPapExact' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterApplyPapExact
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterApplyPapOver' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterApplyPapOver
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentApply' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentApply
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.applyInputOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.applyInputOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.applyPapPreparation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.applyPapPreparation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyErasedOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyErasedOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyPapUnderOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyPapUnderOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepApplyOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerInstructionCase.resolve' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerInstructionCase.resolve
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalInstructionCase' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalInstructionCase
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalInstructionAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalInstructionAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.edgeCapabilities?_size' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.edgeCapabilities?_size
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.constructorBranchSchemaArity' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.constructorBranchSchemaArity
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.CompilerSwitchCtorCase' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.CompilerSwitchCtorCase
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.CompilerSwitchCtorCase.compilerMacro' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.CompilerSwitchCtorCase.compilerMacro
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.switchCtorCaseOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.switchCtorCaseOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.switchCtorMacroOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.switchCtorMacroOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableSwitchCtorMacroOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableSwitchCtorMacroOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerTerminatorSyntax' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerTerminatorSyntax
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentTerminatorSyntax' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentTerminatorSyntax
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerTerminatorCase' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerTerminatorCase
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalTerminatorCase' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalTerminatorCase
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerTerminatorCase.resolve' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerTerminatorCase.resolve
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.entryLiveParameterBeforeRelease' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.entryLiveParameterBeforeRelease
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.fetchPrologueBound' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.fetchPrologueBound
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.fetchPrologueHead' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.Reuse.Site.fetchPrologueHead
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixCompilerMacroAtOfFetched' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixCompilerMacroAtOfFetched
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedParameterValueLive' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedParameterValueLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedCtorChildSource' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedCtorChildSource
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedHotPhysicalStableLiveMacroSimulationHistoryAtOfParameters' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedHotPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableLiveMacroSimulationHistoryAtOfParameters' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetched' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetched
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetchedExecution' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetchedExecution
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.acceptedCtorChildPhysicalMacroOfExecution' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.acceptedCtorChildPhysicalMacroOfExecution
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalSwitchCtorMacroOfCompilerState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalSwitchCtorMacroOfCompilerState
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalSwitchCtorMacroOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalSwitchCtorMacroOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalTerminatorAdvanceHistory' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalTerminatorAdvanceHistory
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterCall' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterCallSelf' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterCallSelf
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterTailCall' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterTailCall
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterTailCallSelf' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.enterTailCallSelf
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepSwitchNatZero' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepSwitchNatZero
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepSwitchNatSucc' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepSwitchNatSucc
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepsSwitchCtor' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stepsSwitchCtor
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.switchCtorMacro' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.switchCtorMacro
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnHalt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnHalt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnApplyMore' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnApplyMore
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.heap_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.heap_eq
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.heapClosed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.heapClosed
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteRetainedFields' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteRetainedFields
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteParameterCount' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteParameterCount
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.liveValueInBounds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.liveValueInBounds
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedEntryValueLive' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedEntryValueLive
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stackToHeapIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stackToHeapIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.historyOfContents' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.historyOfContents
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stackAvoidsOfSupportedUnit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.stackAvoidsOfSupportedUnit
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteStackAvoidsOfUnit' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteStackAvoidsOfUnit
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedHotPhysicalStableLiveMacroSimulationHistory' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedHotPhysicalStableLiveMacroSimulationHistory
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedHotPhysicalStableLiveMacroSimulationHistoryAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedHotPhysicalStableLiveMacroSimulationHistoryAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableLiveMacroSimulationHistory' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableLiveMacroSimulationHistory
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableLiveMacroSimulationHistoryAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableLiveMacroSimulationHistoryAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.initial' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.initial
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerState
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerMacroStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerMacroStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerAcceptedMacroStepAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerAcceptedMacroStepAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerAcceptedMacroStepAt.compilerMacro' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerAcceptedMacroStepAt.compilerMacro
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixCompilerMacroAt' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixCompilerMacroAt
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixCompilerMacro' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPrefixCompilerMacro
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.Steps.deterministic' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.Steps.deterministic
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableState
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.simulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.simulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerAcceptedMacroStepAt.attach' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerAcceptedMacroStepAt.attach
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistory' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistory
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.ofStepsOne' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.ofStepsOne
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.prependStepsOne' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.prependStepsOne
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.ofUnchangedSwitchCtorPrologue' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.ofUnchangedSwitchCtorPrologue
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.ofSwitchCtorChildBlockCase' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.ofSwitchCtorChildBlockCase
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableSwitchCtorMacroOfCompilerState' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableSwitchCtorMacroOfCompilerState
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.prefixStepOfLetOp' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.prefixStepOfLetOp
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfPcZero' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfPcZero
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfHalted' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfHalted
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfCallResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfCallResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfCallSelfResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfCallSelfResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfApplyResume' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedCompilerAdvance.stepOfApplyResume
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerMacroStep.attach' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerMacroStep.attach
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceIsoOfStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceIsoOfStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceIsoOfPrefixStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceIsoOfPrefixStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceIso' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceIso
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceRel' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableMacroStepOfTraceRel
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.invariantStep' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableMacroStep.invariantStep
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulation.preserveCompiler' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMacroSimulation.preserveCompiler
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableState.advanceInvariant' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.AttachedStableState.advanceInvariant
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableFiniteExecution' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableFiniteExecution
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableFiniteExecutionGuided' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableFiniteExecutionGuided
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableRunMachine' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableRunMachine
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableRunMachineGuided' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedStableRunMachineGuided
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.MappedValuesInRoots.transportOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.MappedValuesInRoots.transportOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteSourceFieldCount' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedSiteSourceFieldCount
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentTerminalAllocation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.currentTerminalAllocation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfExecution' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfExecution
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableMacroStepOfTraceRelGuided' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableMacroStepOfTraceRelGuided
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel.rewrittenRunning' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.StableLiveMachineRel.rewrittenRunning
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableMacroStepGuided' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableMacroStepGuided
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableFiniteExecution' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableFiniteExecution
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableRunMachine' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalStableRunMachine
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.initial' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.initial
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.Examples.leafHotReuseProducesRelatedHeaps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.Examples.leafHotReuseProducesRelatedHeaps
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.Examples.linkedHotPrefixProducesRelatedHeaps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.Examples.linkedHotPrefixProducesRelatedHeaps
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Examples.CheckedBenchmark.accepted' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Examples.CheckedBenchmark.accepted
+
+/-! ## Typed x86-64 v0 semantic skeleton
+
+The target AST's closed-fragment theorems must remain free of ISA or encoder
+assumptions.  The executable local step is likewise an ordinary Lean
+definition; its stability theorem stays inside the standard logical fence. -/
+
+/-- info: 'Ix.Compiler.X86.Instr.inV0' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Instr.inV0
+
+/-- info: 'Ix.Compiler.X86.Terminator.inV0' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Terminator.inV0
+
+/-- info: 'Ix.Compiler.X86.Program.inV0' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Program.inV0
+
+/-- info: 'Ix.Compiler.X86.Checked.inV0' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Checked.inV0
+
+/-- info: 'Ix.Compiler.X86.step_of_not_running' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.step_of_not_running
+
+/-- info: 'Ix.Compiler.X86.Core.applyIntrinsicResult_rsp' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Core.applyIntrinsicResult_rsp
+
+/-- info: 'Ix.Compiler.X86.Core.applyIntrinsicResult_calleeSaved' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Core.applyIntrinsicResult_calleeSaved
+
+/-! ## First IxIR₂ scalar selection refinement
+
+Successful selector outputs retain their source-validation witness.  The first
+physical IxIR₂ move/alias family then refines the System V `rax` leaf result
+without adding any ISA, encoder, native-reflection, or FFI axiom. -/
+
+/-- info: 'Ix.Compiler.X86.Select.Output.sourceValid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.Output.sourceValid
+
+/-- info: 'Ix.Compiler.X86.Select.select_scalarMoveProgram' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.select_scalarMoveProgram
+
+/-- info: 'Ix.Compiler.X86.Select.scalarMoveRefines' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.scalarMoveRefines
+
+/-- info: 'Ix.Compiler.X86.Select.selectScalarMoveRefines' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.selectScalarMoveRefines
+
+/-! Source execution history through suspended calls and tail transfers. -/
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.refl' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.refl
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.trans' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.trans
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.stepOp' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.stepOp
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.caseCtor' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.caseCtor
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.caseNatZero' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.caseNatZero
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.caseNatSucc' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.caseNatSucc
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.tailCall' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.tailCall
+
+/-- info: 'Ix.Compiler.IxIR1.ExecutionHistory.tailCallSelf' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.ExecutionHistory.tailCallSelf
+
+/-- info: 'Ix.Compiler.IxIR1.invoke_of_body_run' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.invoke_of_body_run
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_call_of_body_run' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_call_of_body_run
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_callSelf_of_body_run' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_callSelf_of_body_run
+
+/-- info: 'Ix.Compiler.IxIR1.applyGo_exact_of_invoke' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.applyGo_exact_of_invoke
+
+/-- info: 'Ix.Compiler.IxIR1.applyGo_over_of_invoke' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.applyGo_over_of_invoke
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_apply_exact_of_invoke' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_apply_exact_of_invoke
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_apply_over_of_invoke' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_apply_over_of_invoke
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_immediate_ctx_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_immediate_ctx_eq
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_apply_erased_ctx_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_apply_erased_ctx_eq
+
+/-- info: 'Ix.Compiler.IxIR1.runOp_apply_under_ctx_eq' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR1.runOp_apply_under_ctx_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.CodeTrace.tailCallResult_of_capabilities_match' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.CodeTrace.tailCallResult_of_capabilities_match
+
+/-- info: 'Ix.Compiler.IxIR2.Lower.Checked.tailCallResult' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Lower.Checked.tailCallResult
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.ApplyMorePlan.sourceRun' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.ApplyMorePlan.sourceRun
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackHistory.advance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackHistory.advance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackHistory.complete' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackHistory.complete
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackCompletion.ordinary' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerStackCompletion.ordinary
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.historyStepOp' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.historyStepOp
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.historyImmediateOp' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.historyImmediateOp
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnCompletion' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnCompletion
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnResumeOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnResumeOfTarget
+
+/-! Residual dispatch, whole-main physical reuse, and checked production selection. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runMachine_steps' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runMachine_steps
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.sourceValid_of_invalidTarget' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.sourceValid_of_invalidTarget
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.sourceRejected_of_invalidSource' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.sourceRejected_of_invalidSource
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.Selection.valid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.Selection.valid
+
+/-- info: 'Ix.Compiler.IxIR2.Reuse.selectCheckedWith' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Reuse.selectCheckedWith
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.selectAttachment' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.selectAttachment
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnApplyMoreTransfer' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnApplyMoreTransfer
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnApplyMoreOfTarget' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.CompilerRunningState.returnApplyMoreOfTarget
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalCompilerAdvance' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.attachedPhysicalCompilerAdvance
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.physicalMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.physicalMainSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.selectedPhysicalMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.selectedPhysicalMainSimulation
+
+/-! Baseline interpretation transport and validated source-to-scalar selection. -/
+
+/-- info: 'Ix.Compiler.IxIR2.CreditFree.instructionAt' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditFree.instructionAt
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runMain_creditFree' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runMain_creditFree
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runMain_success_unique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runMain_success_unique
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Steps.addHeapFuel' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Steps.addHeapFuel
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.mainInterpretation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.mainInterpretation
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.successfulPhysicalMainSimulation
+
+/-- info: 'Ix.Compiler.X86.Select.ScalarApply.runs' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.ScalarApply.runs
+
+/-- info: 'Ix.Compiler.X86.Select.sourceWord?_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.sourceWord?_sound
+
+/-- info: 'Ix.Compiler.X86.Select.Output.refinesSuccessfulRun' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.Output.refinesSuccessfulRun
+
+/-- info: 'Ix.Compiler.X86.Select.sourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.sourceRefines
+
+/-- info: 'Ix.Compiler.X86.Select.sourceScalarRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Select.sourceScalarRefines
+
+/-! Immediate-list source recursion recovery. The local evaluator theorem
+uses the ordinary Lean basis; the addressed wrappers retain the existing
+BLAKE3 hash assumption through the canonical derived declaration identity. -/
+
+/-- info: 'Ix.Compiler.IxIR0.Recursion.sourceTuple' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Recursion.sourceTuple
+
+/-- info: 'Ix.Compiler.IxIR0.Recursion.recursorForwardSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Recursion.recursorForwardSimulation
+
+/-- info: 'Ix.Compiler.IxIR0.Recursion.Recovered.forwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Recursion.Recovered.forwardSimulation
+
+/-- info: 'Ix.Compiler.IxIR0.Recursion.Selection.forwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Recursion.Selection.forwardSimulation
+
+/-- info: 'Ix.Compiler.Recursion.Compilation.sourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Compilation.sourceRefines
+
+/-! Common ownership lowering and source recursion through selected physical
+execution. These compose the existing addressed compiler and reuse proofs;
+the existing BLAKE3 assumption is unchanged. -/
+
+/-- info: 'Ix.Compiler.Pipeline.LoweredCompilation.exactCompilerContracts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.LoweredCompilation.exactCompilerContracts
+
+/-- info: 'Ix.Compiler.Pipeline.LoweredCompilation.addressedOwnedMain' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.LoweredCompilation.addressedOwnedMain
+
+/-- info: 'Ix.Compiler.IxIR0.Recursion.Recovered.projectionSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Recursion.Recovered.projectionSafe
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalMainSimulation
+
+/-- info: 'Ix.Compiler.Recursion.Lowered.physicalMainSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Lowered.physicalMainSimulation
+
+/-- info: 'Ix.Compiler.Recursion.Compilation.literalSourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Compilation.literalSourceRefines
+
+/-- info: 'Ix.Compiler.Recursion.Compilation.sourceRefinesSelected' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Compilation.sourceRefinesSelected
+
+/-! Physical allocation accounting and selected shared-result reclamation.
+The machine and heap-transport lemmas use the ordinary Lean basis; source
+composition retains exactly the existing addressed BLAKE3 assumption. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.allocationAccounting' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.allocationAccounting
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runMain_allocationAccounting' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runMain_allocationAccounting
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableHeapRel.sharedReclamation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableHeapRel.sharedReclamation
+
+/-- info: 'Ix.Compiler.Pipeline.LoweredCompilation.reclamation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.LoweredCompilation.reclamation
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.baselineSharedReclamation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.baselineSharedReclamation
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPhysicalMainResources' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPhysicalMainResources
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedSuccessfulSharedResources' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedSuccessfulSharedResources
+
+/-- info: 'Ix.Compiler.Recursion.Lowered.physicalMainResources' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Lowered.physicalMainResources
+
+/-- info: 'Ix.Compiler.Recursion.Compilation.sourceRefinesSelectedWithResources' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Compilation.sourceRefinesSelectedWithResources
+
+/-! Comparative allocation/free laws. Counters remain separate from the
+semantic relations; source composition retains the existing axiom basis. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.InstructionTransferCase.allocationEvents' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.InstructionTransferCase.allocationEvents
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedStep_allocationDelta' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedStep_allocationDelta
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableHeapRel.live_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableHeapRel.live_eq
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Result.AllocationLaws.of_accounting' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Result.AllocationLaws.of_accounting
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Result.AllocationLaws.reclaimed' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Result.AllocationLaws.reclaimed
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.physicalMainSimulationWithAllocationEvents' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.physicalMainSimulationWithAllocationEvents
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.selectedPhysicalMainSimulationWithAllocationEvents' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.selectedPhysicalMainSimulationWithAllocationEvents
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.baselineNoReuses' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.baselineNoReuses
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPhysicalMainAllocationLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPhysicalMainAllocationLaws
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalAllocationLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalAllocationLaws
+
+/-- info: 'Ix.Compiler.Recursion.Lowered.physicalMainAllocationLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Lowered.physicalMainAllocationLaws
+
+/-- info: 'Ix.Compiler.Recursion.Compilation.sourceRefinesSelectedWithAllocationLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Compilation.sourceRefinesSelectedWithAllocationLaws
+
+/-! Comparative RC and peak-live bounds, including every selected prefix and
+complete shared reclamation. The existing axiom basis is unchanged. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.releaseSharedWork_observations' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.releaseSharedWork_observations
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.InstructionTransferCase.rcCharge' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.InstructionTransferCase.rcCharge
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Step.peakRecords' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Step.peakRecords
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runMachine_prefix_costs' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runMachine_prefix_costs
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseSim.StableHeapRel.pendingRC_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseSim.StableHeapRel.pendingRC_eq
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.unchangedStep_costDelta' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.unchangedStep_costDelta
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CostDelta.hot' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CostDelta.hot
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.CostDelta.cold' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.CostDelta.cold
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Result.CostBounds.reclaimed' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Result.CostBounds.reclaimed
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.physicalMainSimulationWithCosts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.OptimizedAttachment.physicalMainSimulationWithCosts
+
+/-- info: 'Ix.Compiler.IxIR2.ReuseLiveSim.selectedPhysicalMainSimulationWithCosts' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.ReuseLiveSim.selectedPhysicalMainSimulationWithCosts
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalCostBounds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalCostBounds
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPrefixCostBounds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPrefixCostBounds
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPhysicalMainCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedPhysicalMainCostLaws
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulPhysicalCostLaws
+
+/-- info: 'Ix.Compiler.Recursion.Lowered.physicalMainCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Lowered.physicalMainCostLaws
+
+/-- info: 'Ix.Compiler.Recursion.Compilation.sourceRefinesSelectedWithCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Recursion.Compilation.sourceRefinesSelectedWithCostLaws
+
+/-! R5: direct-call credit suspension, reservation ownership, actual selected
+compiler execution, and closed source-map specialization. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.runMain_v0' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.runMain_v0
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.suspendCall_iff' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.suspendCall_iff
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.Step.reservationOwnership' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.Step.reservationOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.Steps.reservationOwnership' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.Steps.reservationOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.runMain_prefix_reservationOwnership' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.runMain_prefix_reservationOwnership
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.runMain_allocationAccounting' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.runMain_allocationAccounting
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.runMachine_prefix_costs' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.runMachine_prefix_costs
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.Policy.runMain_success_unique' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.Policy.runMain_success_unique
+
+/-- info: 'Ix.Compiler.IxIR2.CallReuse.Selection.valid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CallReuse.Selection.valid
+
+/-- info: 'Ix.Compiler.IxIR2.CallReuse.Sim.simulate_to_halt' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CallReuse.Sim.simulate_to_halt
+
+/-- info: 'Ix.Compiler.IxIR2.CallReuse.Output.mainSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CallReuse.Output.mainSimulation
+
+/-- info: 'Ix.Compiler.IxIR2.CallReuse.Selection.mainSimulation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CallReuse.Selection.mainSimulation
+
+/-- info: 'Ix.Compiler.Pipeline.LoweredCompilation.owned' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.LoweredCompilation.owned
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.baselineClosed' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.baselineClosed
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedCallPrefixCostBounds' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedCallPrefixCostBounds
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedCallPhysicalMainCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.selectedCallPhysicalMainCostLaws
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulCallPhysicalCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulCallPhysicalCostLaws
+
+/-- info: 'Ix.Compiler.CallReuse.Compilation.sourceRefinesWithCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.CallReuse.Compilation.sourceRefinesWithCostLaws
+
+/-- info: 'Ix.Compiler.IxIR0.MapRecovery.sourceMap' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MapRecovery.sourceMap
+
+/-- info: 'Ix.Compiler.IxIR0.MapRecovery.targetMap' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MapRecovery.targetMap
+
+/-- info: 'Ix.Compiler.IxIR0.MapRecovery.Recovered.forwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MapRecovery.Recovered.forwardSimulation
+
+/-- info: 'Ix.Compiler.IxIR0.MapRecovery.Selection.forwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MapRecovery.Selection.forwardSimulation
+
+/-- info: 'Ix.Compiler.IxIR0.MapRecovery.Recovered.projectionSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.MapRecovery.Recovered.projectionSafe
+
+/-- info: 'Ix.Compiler.CallReuse.MapLowered.physicalMainCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.CallReuse.MapLowered.physicalMainCostLaws
+
+/-- info: 'Ix.Compiler.CallReuse.MapCompilation.sourceRefinesWithCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.CallReuse.MapCompilation.sourceRefinesWithCostLaws
+
+/-! Static unique source reversal: saturated source modes, consuming emission,
+actual SSA execution, every physical prefix, exact costs, and full release. -/
+
+/-- info: 'Ix.Compiler.Pipeline.CertifiedErasure.sourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.CertifiedErasure.sourceRefines
+
+/-- info: 'Ix.Compiler.IxIR0.RecursorInstance.address_eq_iff_bytes_eq' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.RecursorInstance.address_eq_iff_bytes_eq
+
+/-- info: 'Ix.Compiler.IxIR0.UniqueReverse.Checked.sourceEvaluates' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.UniqueReverse.Checked.sourceEvaluates
+
+/-- info: 'Ix.Compiler.IxIR0.UniqueReverse.Recovered.forwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.UniqueReverse.Recovered.forwardSimulation
+
+/-- info: 'Ix.Compiler.UniqueReuse.CheckedSource.sourceValue' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.CheckedSource.sourceValue
+
+/-- info: 'Ix.Compiler.UniqueReuse.ListAt.hasWorld' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.ListAt.hasWorld
+
+/-- info: 'Ix.Compiler.UniqueReuse.ListAt.graph' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.ListAt.graph
+
+/-- info: 'Ix.Compiler.UniqueReuse.consumingLoop' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.consumingLoop
+
+/-- info: 'Ix.Compiler.UniqueReuse.mainExists' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.mainExists
+
+/-- info: 'Ix.Compiler.UniqueReuse.consumingMainResult' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.consumingMainResult
+
+/-- info: 'Ix.Compiler.UniqueReuse.release1' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.release1
+
+/-- info: 'Ix.Compiler.UniqueReuse.release2_complete' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.release2_complete
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.reserveReuse' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.reserveReuse
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.reuseAt_peak' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.reuseAt_peak
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.loopSteps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.loopSteps
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.mainSteps' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.mainSteps
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.mainRuns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.mainRuns
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.MainResult.reclaims' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.MainResult.reclaims
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.prefixResources' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.prefixResources
+
+/-- info: 'Ix.Compiler.UniqueReuse.Target.costLaws' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Target.costLaws
+
+/-- info: 'Ix.Compiler.IxIR2.UniqueLower.Translation.forwardSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.UniqueLower.Translation.forwardSimulation
+
+/-- info: 'Ix.Compiler.UniqueReuse.ownedSemantics' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.ownedSemantics
+
+/-- info: 'Ix.Compiler.UniqueReuse.backendSemantics' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.backendSemantics
+
+/-- info: 'Ix.Compiler.UniqueReuse.Compilation.sourceRefinesWithCostLaws' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Compilation.sourceRefinesWithCostLaws
+
+/-! Bounded native unique reversal: byte-memory realization, full emitted
+entry and release runs, and unchanged source-contract/axiom boundaries. -/
+
+/-- info: 'Ix.Compiler.X86.Memory.read64_write64' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Memory.read64_write64
+
+/-- info: 'Ix.Compiler.X86.UniqueExecution.mainAndRelease' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.UniqueExecution.mainAndRelease
+
+/-- info: 'Ix.Compiler.X86.UniqueExecution.NativeList.nodup' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.UniqueExecution.NativeList.nodup
+
+/-- info: 'Ix.Compiler.UniqueReuse.Native.Output.executes' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Native.Output.executes
+
+/-- info: 'Ix.Compiler.UniqueReuse.Native.Output.costsAgree' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Native.Output.costsAgree
+
+/-- info: 'Ix.Compiler.UniqueReuse.Native.Output.sourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Native.Output.sourceRefines
+
+/-- info: 'Ix.Compiler.UniqueReuse.Native.SourceNativeResult.witness' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Native.SourceNativeResult.witness
+
+/-- info: 'Ix.Compiler.UniqueReuse.Native.Execution.mainSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Native.Execution.mainSafe
+
+/-- info: 'Ix.Compiler.UniqueReuse.Native.Execution.releaseSafe' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Native.Execution.releaseSafe
+
+/-! General logical/physical credit refinement, both policies and the whole
+instruction language. These bridges add no native hashing or new axioms. -/
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.step_related' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.step_related
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.prefix_resources' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.prefix_resources
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.runMain_prefix_resources' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.runMain_prefix_resources
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.checked_runMain_refines' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.checked_runMain_refines
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.runMain_v0_refines' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.runMain_v0_refines
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.runMain_refines_independent' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.runMain_refines_independent
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.OutcomeRel.ownership' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.OutcomeRel.ownership
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.OutcomeRel.valueGraph' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.OutcomeRel.valueGraph
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.OutcomeRel.reclamation' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.OutcomeRel.reclamation
+
+/-- info: 'Ix.Compiler.IxIR2.CreditRefinement.checked_runMain_owned' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.CreditRefinement.checked_runMain_owned
+
+/-! Runtime source application and a single native reversal function. The
+native input, validation, execution, and rejection proofs add no semantic
+axiom; addressed compiler certificates retain the existing hash axiom. -/
+
+/-- info: 'Ix.Compiler.Sim.apply_sim_inlineSharing' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.apply_sim_inlineSharing
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Compilation.sourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Compilation.sourceRefines
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Compilation.targetRuns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Compilation.targetRuns
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Target.makeInput_valid' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Target.makeInput_valid
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.validationSteps' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.validationSteps
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.executes' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.executes
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.canonical_executes' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.canonical_executes
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.Execution.mainSafe' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.Execution.mainSafe
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.Execution.releaseSafe' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.Execution.releaseSafe
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.lengthRejects' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.lengthRejects
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.capacityRejects' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.capacityRejects
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.ArgumentRel.graph' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.ArgumentRel.graph
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.Output.sourceRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.Output.sourceRefines
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.costsAgree' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.costsAgree
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.ofNats_exact' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.ofNats_exact
+
+/-- info: 'Ix.Compiler.X86.RuntimeExecution.inputWordsStep_eq' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeExecution.inputWordsStep_eq
+
+/-! Adjacent reserve/reuse counter folding preserves final general-purpose
+registers, arena words, and the source-to-object contract without a new semantic axiom. -/
+
+/-- info: 'Ix.Compiler.X86.UniqueCounterFold.state_eq' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.UniqueCounterFold.state_eq
+
+/-- info: 'Ix.Compiler.X86.UniqueCounterFold.trace' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.UniqueCounterFold.trace
+
+/-- info: 'Ix.Compiler.X86.UniqueCounterFold.instruction_saving' does not depend on any axioms -/
+#guard_msgs in #print axioms Ix.Compiler.X86.UniqueCounterFold.instruction_saving
+
+/-- info: 'Ix.Compiler.X86.RuntimeTarget.controlCost_saving' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.RuntimeTarget.controlCost_saving
+
+/-! Borrowed ABI checking, finite closed-program execution certificates,
+source agreement, actual RC/peak laws, and checked baseline fallback. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Checked.valid' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Checked.valid
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Checked.exactRewrite' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Checked.exactRewrite
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Execution.steps' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Execution.steps
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Improved.preservation' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Improved.preservation
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Improved.resources' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Improved.resources
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Selection.fallbackExact' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Selection.fallbackExact
+
+/-- info: 'Ix.Compiler.Borrow.Improved.sourcePreservation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Improved.sourcePreservation
+
+/-- info: 'Ix.Compiler.Borrow.Improved.resources' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Improved.resources
+
+/-- info: 'Ix.Compiler.Borrow.Selection.valid' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Selection.valid
+
+/-- info: 'Ix.Compiler.Borrow.Selection.fallbackExact' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Selection.fallbackExact
+
+/-! Open borrowed functions: structurally derived calls and continuations,
+exact lender-store preservation, arbitrary owned input reclamation, and
+the actual source-to-runtime composition. No input replay selects a variant. -/
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.retain_release_cancel' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.retain_release_cancel
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.Entry.steps' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.Entry.steps
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.Entry.lenderLifetime' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.Entry.lenderLifetime
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.Entry.total' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.Entry.total
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.Certificate.strictImprovement' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.Certificate.strictImprovement
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.Certificate.controlCost' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.Certificate.controlCost
+
+/-- info: 'Ix.Compiler.IxIR2.Borrow.Open.Certificate.runFunctions' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Borrow.Open.Certificate.runFunctions
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Source.Shape.applies' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Source.Shape.applies
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Tree.counts' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Tree.counts
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Argument.input' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Argument.input
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Certified.sourcePreservation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Certified.sourcePreservation
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Certified.runtimePreservation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Certified.runtimePreservation
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Certified.sourceToRuntime' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Certified.sourceToRuntime
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Selection.valid' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Selection.valid
+
+/-- info: 'Ix.Compiler.Borrow.Runtime.Selection.fallbackExact' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Borrow.Runtime.Selection.fallbackExact
+
+/-! E1 consumes actual emitted bytes through an independent parser. All local
+encoding, flag, memory-fault and control laws use only the ordinary logical
+axioms; whole-stream layout and reference ISA agreement remain separate. -/
+
+/-- info: 'Ix.Compiler.X86.Encode.instruction_decodeAt' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.instruction_decodeAt
+
+/-- info: 'Ix.Compiler.X86.Encode.terminator_decode' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.terminator_decode
+
+/-- info: 'Ix.Compiler.X86.Encode.encoded_instruction_execution' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.encoded_instruction_execution
+
+/-- info: 'Ix.Compiler.X86.Encode.compare_execution' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.compare_execution
+
+/-- info: 'Ix.Compiler.X86.Encode.branch_bytes_execution' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.branch_bytes_execution
+
+/-- info: 'Ix.Compiler.X86.Encode.branch_patch' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.branch_patch
+
+/-- info: 'Ix.Compiler.X86.Encode.call_pair' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.call_pair
+
+/-- info: 'Ix.Compiler.X86.Encode.call_fault' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.call_fault
+
+/-- info: 'Ix.Compiler.X86.Encode.ret_pair' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.ret_pair
+
+/-- info: 'Ix.Compiler.X86.Encode.relative_resolves_base' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.relative_resolves_base
+
+/-- info: 'Ix.Compiler.X86.Encode.patchSigned32_splice' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.patchSigned32_splice
+
+/-- info: 'Ix.Compiler.X86.Encode.signed32_checked' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Encode.signed32_checked
+
+/-! E2 composes complete streams, explicit call-slot memory correspondence,
+independent ELF interpretation, PC32 relocation and the emitted N2 source
+endpoint. Only indexed source claims retain the existing native hash axiom. -/
+
+/-- info: 'Ix.Compiler.X86.Stream.pcOffset_injective' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.pcOffset_injective
+
+/-- info: 'Ix.Compiler.X86.Stream.check_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.check_sound
+
+/-- info: 'Ix.Compiler.X86.Stream.linear_step' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.linear_step
+
+/-- info: 'Ix.Compiler.X86.Stream.branch_at' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.branch_at
+
+/-- info: 'Ix.Compiler.X86.Stream.call_progress' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.call_progress
+
+/-- info: 'Ix.Compiler.X86.Stream.ret_progress' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.ret_progress
+
+/-- info: 'Ix.Compiler.X86.Stream.run_to_return' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.run_to_return
+
+/-- info: 'Ix.Compiler.X86.Stream.run_with_calls' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.run_with_calls
+
+/-- info: 'Ix.Compiler.X86.Stream.run_permissions' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Stream.run_permissions
+
+/-- info: 'Ix.Compiler.X86.StreamExamples.reused_safe' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.StreamExamples.reused_safe
+
+/-- info: 'Ix.Compiler.X86.StreamExamples.nested_safe' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.StreamExamples.nested_safe
+
+/-- info: 'Ix.Compiler.X86.ELF.check_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ELF.check_sound
+
+/-- info: 'Ix.Compiler.X86.ELF.Valid.text' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ELF.Valid.text
+
+/-- info: 'Ix.Compiler.X86.ELF.Valid.entry' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ELF.Valid.entry
+
+/-- info: 'Ix.Compiler.X86.ELFLink.pc32_call' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ELFLink.pc32_call
+
+/-- info: 'Ix.Compiler.X86.ELFLink.Applied.resolves' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ELFLink.Applied.resolves
+
+/-- info: 'Ix.Compiler.X86.ELFLink.runtime_call_transfer' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ELFLink.runtime_call_transfer
+
+/-- info: 'Ix.Compiler.X86.ObjectEval.run_from_typed' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ObjectEval.run_from_typed
+
+/-- info: 'Ix.Compiler.X86.ObjectEval.run_with_calls' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ObjectEval.run_with_calls
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.Output.emit_spec' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.Output.emit_spec
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.role_callFree' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.role_callFree
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.Object.provenance_parsed' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.Object.provenance_parsed
+
+/-- info: 'Ix.Compiler.UniqueReuse.Runtime.Native.Output.sourceRefinesObjects' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.UniqueReuse.Runtime.Native.Output.sourceRefinesObjects
+
+/-! C3 reuses only equal erased preimages. Closed Nat translation validation
+and explicit execution certificates compose with the original source bridge. -/
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.blockMembers_eq_of_compatibleBlocks' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.blockMembers_eq_of_compatibleBlocks
+
+/-- info: 'Ix.Compiler.IxIR0.Readdress.members_eq_of_compatibleBlocks' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.Readdress.members_eq_of_compatibleBlocks
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.Attached.sourcePhysical' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.Attached.sourcePhysical
+
+/-- info: 'Ix.Compiler.X86.NatCalls.Output.refinesSuccessfulRun' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.Output.refinesSuccessfulRun
+
+/-- info: 'Ix.Compiler.X86.NatCalls.Execution.objectReturns' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.Execution.objectReturns
+
+/-- info: 'Ix.Compiler.X86.NatCalls.sourceObjectRefines' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.sourceObjectRefines
+
+/-! C3's static Nat captures preserve exact initializer values and complete
+baseline reclamation under the existing closed translation-validation contract. -/
+
+/-- info: 'Ix.Compiler.X86.NatCalls.Expr.closed_evaluate' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.Expr.closed_evaluate
+
+/-- info: 'Ix.Compiler.X86.NatCalls.checkCapture' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.checkCapture
+
+/-- info: 'Ix.Compiler.X86.NatCalls.StaticCapture.evaluates' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.StaticCapture.evaluates
+
+/-- info: 'Ix.Compiler.X86.NatCalls.Output.reclaimsSuccessfulRun' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.Output.reclaimsSuccessfulRun
+
+/-- info: 'Ix.Compiler.X86.NatCalls.sourceObjectReclaims' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.NatCalls.sourceObjectReclaims
+
+/-! N3's first scalar slice uses universal source/body, frame, call and
+object contracts. Source-indexed theorems retain the existing hash boundary. -/
+
+/-- info: 'Ix.Compiler.X86.ExactNat.encode_some_iff' depends on axioms: [propext] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ExactNat.encode_some_iff
+
+/-- info: 'Ix.Compiler.X86.ExactNat.add_some_iff' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ExactNat.add_some_iff
+
+/-- info: 'Ix.Compiler.X86.ExactNat.sub_toNat' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ExactNat.sub_toNat
+
+/-- info: 'Ix.Compiler.IxIR0.NatArithmetic.body_applies' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.NatArithmetic.body_applies
+
+/-- info: 'Ix.Compiler.IxIR0.NatArithmetic.sub_applies' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR0.NatArithmetic.sub_applies
+
+/-- info: 'Ix.Compiler.X86.Scalar.Evaluates.native' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Evaluates.native
+
+/-- info: 'Ix.Compiler.X86.Scalar.Checked.function_total' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Checked.function_total
+
+/-- info: 'Ix.Compiler.X86.Scalar.Stack.rank_capacity' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Stack.rank_capacity
+
+/-- info: 'Ix.Compiler.X86.ObjectEval.run_safeSteps' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.ObjectEval.run_safeSteps
+
+/-- info: 'Ix.Compiler.X86.Scalar.RootRun.objectResult' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.RootRun.objectResult
+
+/-- info: 'Ix.Compiler.X86.Scalar.Source.programMatches_sound' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Source.programMatches_sound
+
+/-- info: 'Ix.Compiler.X86.Scalar.Source.raw_evaluates' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Source.raw_evaluates
+
+/-- info: 'Ix.Compiler.X86.Scalar.Source.Selected.sourceApplies' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Source.Selected.sourceApplies
+
+/-- info: 'Ix.Compiler.X86.Scalar.Source.Compiled.nativeReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Source.Compiled.nativeReturns
+
+/-- info: 'Ix.Compiler.X86.Scalar.Source.Compiled.sourceReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Source.Compiled.sourceReturns
+
+/-! Compositional selection of actual physical scalar CFGs. -/
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.atom_sound' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.atom_sound
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.edge_transfer' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.edge_transfer
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Runs.call' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Runs.call
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Code.simulate' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Code.simulate
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Selected.contract' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Selected.contract
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Runs.agrees' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Runs.agrees
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.ExportPath.runMain' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.ExportPath.runMain
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Compiled.nativeReturns' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Compiled.nativeReturns
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Compiled.physicalReturns' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Compiled.physicalReturns
+
+/-! Runtime source application through actual physical CFG selection.
+Source-indexed contracts retain the existing hash boundary. -/
+
+/-- info: 'Ix.Compiler.Sim.apply_sim_projectionSafe_with_members' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.apply_sim_projectionSafe_with_members
+
+/-- info: 'Ix.Compiler.Sim.applyMany_sim_projectionSafe_inlineSharing' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.Sim.applyMany_sim_projectionSafe_inlineSharing
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.runtimeApply' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.runtimeApply
+
+/-- info: 'Ix.Compiler.Pipeline.ValidatedCompilation.runtimeTraceRenames' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.Pipeline.ValidatedCompilation.runtimeTraceRenames
+
+/-- info: 'Ix.Compiler.IxIR2.Eval.runFunction_creditFree' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Eval.runFunction_creditFree
+
+/-- info: 'Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulFunctionSimulation' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.IxIR2.Pipeline.CompiledAttachment.successfulFunctionSimulation
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.closureStore.applied' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.closureStore.applied
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Exported.sourceFunction' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Exported.sourceFunction
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Exported.sourceRun' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Exported.sourceRun
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Exported.sourceReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Exported.sourceReturns
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Exported.sourceNatReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Exported.sourceNatReturns
+
+/-! Captured scalar exports: checked closed initialization, capture binding,
+complete reclamation, and universal source-to-object composition. -/
+
+/-- info: 'Ix.Compiler.X86.Scalar.Bound.evaluates' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.Scalar.Bound.evaluates
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Heap.owned' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Heap.owned
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Heap.spent_empty' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Heap.spent_empty
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Heap.applied' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Heap.applied
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.checkInitializer' depends on axioms: [propext, Classical.choice, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.checkInitializer
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Initialized.reclaimed' depends on axioms: [propext, Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Initialized.reclaimed
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.nativeReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.nativeReturns
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.physicalReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.physicalReturns
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceFunction' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceFunction
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceRun' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceRun
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceReturns
+
+/-- info: 'Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceNatReturns' depends on axioms: [propext,
+ Classical.choice,
+ Quot.sound,
+ Blake3.HasherOps.hash._native.native_decide.ax_1✝] -/
+#guard_msgs in #print axioms Ix.Compiler.X86.PhysicalScalar.Captured.Compiled.sourceNatReturns
diff --git a/Ix/Compiler/Fuel.lean b/Ix/Compiler/Fuel.lean
new file mode 100644
index 000000000..0c8844020
--- /dev/null
+++ b/Ix/Compiler/Fuel.lean
@@ -0,0 +1,22 @@
+namespace Ix.Compiler
+
+/-!
+# Fuel-order proof utilities
+
+Evaluator-specific proofs establish stability across one successor step.  This
+module contains the single order traversal that lifts such a step theorem
+across an arbitrary fuel increase.
+-/
+
+/-- A result preserved by every successor step is preserved by any increase in
+fuel. -/
+theorem fuel_mono_of_succ {α : Sort u} {run : Nat → α} {result : α}
+    {fuel larger : Nat}
+    (hsucc : ∀ current, run current = result → run (current + 1) = result)
+    (hle : fuel ≤ larger) (hrun : run fuel = result) :
+    run larger = result := by
+  induction hle with
+  | refl => exact hrun
+  | step _ ih => exact hsucc _ ih
+
+end Ix.Compiler
diff --git a/Ix/Compiler/IxIR/Decode.lean b/Ix/Compiler/IxIR/Decode.lean
new file mode 100644
index 000000000..a7c9a0a79
--- /dev/null
+++ b/Ix/Compiler/IxIR/Decode.lean
@@ -0,0 +1,470 @@
+import Ix.Compiler.IxIR.Encoding
+
+/-!
+# Strict readers for the addressed IxIR grammar
+
+These readers are the inverse-facing half of `IxIR.Encoding`. Recursive and
+counted inputs are fueled by the enclosing byte array, so malformed input
+cannot create a logical nontermination. The raw readers deliberately accept a
+slightly wider LEB128 language; declaration entry points call `runCanonical`,
+which re-encodes the parsed value and rejects every noncanonical spelling.
+-/
+
+namespace Ix.Compiler.IxIR.Decode
+
+open Ix.Compiler.Ixon
+open Ix.Compiler.Ixon (Address)
+
+/-- Decode one arbitrary-precision unsigned LEB128 value. The fuel is supplied
+by the enclosing byte array and decreases for every consumed chunk. -/
+def getNatFuel : Nat → GetM Nat
+  | 0 => throw "natural: recursion limit"
+  | fuel + 1 => do
+      let byte ← getU8
+      let low := byte.toNat % 128
+      if byte.toNat < 128 then
+        return low
+      return low + 128 * (← getNatFuel fuel)
+
+/-- Input-fueled arbitrary-precision unsigned LEB128 reader. -/
+def getNat : GetM Nat := do
+  let state ← get
+  getNatFuel (state.bytes.size + 1)
+
+/-- Decode a one-byte Boolean, rejecting every value other than zero or one. -/
+def getBool : GetM Bool :=
+  getDecodedU8 "boolean" boolOfByte?
+
+/-- Decode a length-prefixed byte string. -/
+def getBlob : GetM ByteArray := do
+  let size ← getNat
+  getBytes size
+
+/-- Decode canonical UTF-8 beneath the length-prefixed byte grammar. -/
+def getString : GetM String := do
+  let bytes ← getBlob
+  match String.fromUTF8? bytes with
+  | some value => return value
+  | none => throw "string: invalid UTF-8"
+
+/-- Decode one fixed-width content address. -/
+def getAddress : GetM Address :=
+  Serialize.get
+
+/-- Decode exactly `count` values. -/
+def getListN (getOne : GetM α) : Nat → GetM (List α)
+  | 0 => pure []
+  | count + 1 => do
+      let head ← getOne
+      return head :: (← getListN getOne count)
+
+/-- Decode a LEB128-counted list in source order. -/
+def getList (getOne : GetM α) : GetM (List α) := do
+  let count ← getNat
+  getListN getOne count
+
+/-- Decode a LEB128-counted array in source order. -/
+def getArray (getOne : GetM α) : GetM (Array α) := do
+  let count ← getNat
+  return (← getListN getOne count).toArray
+
+/-- Consume an exact fixed byte sequence. -/
+def expectBytes (expected : ByteArray) : GetM Unit := do
+  let actual ← getBytes expected.size
+  if actual = expected then
+    return ()
+  throw "unexpected framing bytes"
+
+/-- Strict top-level decoder wrapper. Besides full consumption from `runGet`,
+successful values must reproduce the complete input byte-for-byte. -/
+def runCanonical (getValue : GetM α) (encode : α → ByteArray)
+    (bytes : ByteArray) : Except String α := do
+  let value ← runGet getValue bytes
+  if encode value = bytes then
+    return value
+  throw "noncanonical encoding"
+
+/-! ## Generic proof layer -/
+
+theorem tag_eq_u8Bytes (value : UInt8) :
+    Encoding.tag value = u8Bytes value := by
+  apply ByteArray.ext
+  simp [Encoding.tag, u8Bytes]
+
+theorem getU8_tag_spec (value : UInt8) :
+    GetSpec getU8 (Encoding.tag value) value := by
+  rw [tag_eq_u8Bytes]
+  exact getU8_spec value
+
+@[simp] theorem tag_size (value : UInt8) :
+    (Encoding.tag value).size = 1 := by
+  rw [tag_eq_u8Bytes]
+  simp [u8Bytes]
+
+theorem nat_size_pos (value : Nat) : 0 < (Encoding.nat value).size := by
+  rw [Encoding.nat]
+  split
+  · simp
+  · simp only [ByteArray.size_append, tag_size]
+    omega
+
+theorem getNatFuel_spec (value fuel : Nat)
+    (hfuel : (Encoding.nat value).size < fuel) :
+    GetSpec (getNatFuel fuel) (Encoding.nat value) value := by
+  induction value using Nat.strongRecOn generalizing fuel with
+  | ind value ih =>
+      by_cases hsmall : value < 128
+      · rw [Encoding.nat, dif_pos hsmall] at hfuel ⊢
+        cases fuel with
+        | zero => simp at hfuel
+        | succ fuel =>
+            let byte := UInt8.ofNat value
+            let next : UInt8 → GetM Nat := fun decoded =>
+              let low := decoded.toNat % 128
+              if decoded.toNat < 128 then pure low
+              else do return low + 128 * (← getNatFuel fuel)
+            have hbyte : byte.toNat = value := by
+              exact UInt8.toNat_ofNat_of_lt'
+                (show value < 256 by omega)
+            have hnext : GetSpec (next byte) ByteArray.empty value := by
+              simp [next, byte, hbyte, hsmall, Nat.mod_eq_of_lt]
+              exact GetSpec.pure value
+            have htotal := GetSpec.bind (next := next)
+              (getU8_tag_spec byte) hnext
+            simpa [getNatFuel, byte, next] using htotal
+      · have hlarge : 128 ≤ value := Nat.le_of_not_gt hsmall
+        rw [Encoding.nat, dif_neg hsmall] at hfuel ⊢
+        cases fuel with
+        | zero => simp at hfuel
+        | succ fuel =>
+            let quotient := value / 128
+            let byte := UInt8.ofNat (128 + value % 128)
+            have hquotient : quotient < value := by
+              dsimp [quotient]
+              exact Nat.div_lt_self (by omega) (by omega)
+            have hchildFuel : (Encoding.nat quotient).size < fuel := by
+              dsimp [quotient]
+              simp only [ByteArray.size_append, tag_size] at hfuel
+              omega
+            have hrecursive := ih quotient hquotient fuel hchildFuel
+            have hbyte : byte.toNat = 128 + value % 128 := by
+              exact UInt8.toNat_ofNat_of_lt' (show
+                128 + value % 128 < 256 by
+                have := Nat.mod_lt value (by omega : 0 < 128)
+                omega)
+            let next : UInt8 → GetM Nat := fun decoded =>
+              let low := decoded.toNat % 128
+              if decoded.toNat < 128 then pure low
+              else do return low + 128 * (← getNatFuel fuel)
+            have hmapped :
+                GetSpec
+                  ((fun high => value % 128 + 128 * high) <$>
+                    getNatFuel fuel)
+                  (Encoding.nat quotient) value := by
+              have hmap := Ixon.ExprLaws.GetSpec.map hrecursive
+                (fun high => value % 128 + 128 * high)
+              have hdecompose : value % 128 + 128 * quotient = value := by
+                exact Nat.mod_add_div value 128
+              simpa [hdecompose] using hmap
+            have hnext :
+                GetSpec (next byte) (Encoding.nat quotient) value := by
+              have hnotSmall : ¬byte.toNat < 128 := by
+                rw [hbyte]
+                omega
+              have hlow : byte.toNat % 128 = value % 128 := by
+                rw [hbyte]
+                omega
+              simpa [next, hnotSmall, hlow] using hmapped
+            have htotal := GetSpec.bind (next := next)
+              (getU8_tag_spec byte) hnext
+            simpa [getNatFuel, byte, quotient, next] using htotal
+
+theorem getNat_spec (value : Nat) :
+    GetSpec getNat (Encoding.nat value) value := by
+  intro pre suffix
+  let fuel := (pre ++ Encoding.nat value ++ suffix).size + 1
+  have hfuel : (Encoding.nat value).size < fuel := by
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  have hspec := getNatFuel_spec value fuel hfuel pre suffix
+  simpa [getNat, fuel] using hspec
+
+theorem getBlob_spec (value : ByteArray) :
+    GetSpec getBlob (Encoding.blob value) value := by
+  have htotal := GetSpec.bind (next := getBytes)
+    (getNat_spec value.size) (getBytes_spec value)
+  simpa [getBlob, Encoding.blob] using htotal
+
+theorem string_fromUTF8_toUTF8 (value : String) :
+    String.fromUTF8? value.toUTF8 = some value := by
+  unfold String.fromUTF8?
+  have hvalid : value.toUTF8.IsValidUTF8 := by
+    simpa using value.isValidUTF8
+  rw [dif_pos hvalid]
+  congr
+
+theorem toUTF8_of_fromUTF8 {bytes : ByteArray} {value : String}
+    (hdecode : String.fromUTF8? bytes = some value) :
+    value.toUTF8 = bytes := by
+  unfold String.fromUTF8? at hdecode
+  split at hdecode
+  · cases hdecode
+    rfl
+  · contradiction
+
+theorem getString_spec (value : String) :
+    GetSpec getString (Encoding.string value) value := by
+  let finish : ByteArray → GetM String := fun bytes =>
+    match String.fromUTF8? bytes with
+    | some decoded => pure decoded
+    | none => throw "string: invalid UTF-8"
+  have hfinish : GetSpec (finish value.toUTF8) ByteArray.empty value := by
+    unfold finish
+    rw [string_fromUTF8_toUTF8]
+    exact GetSpec.pure value
+  have htotal := GetSpec.bind (next := finish)
+    (getBlob_spec value.toUTF8) hfinish
+  simpa [getString, Encoding.string, finish] using htotal
+
+theorem expectBytes_spec (expected : ByteArray) :
+    GetSpec (expectBytes expected) expected () := by
+  intro pre suffix
+  simp only [expectBytes, StateT.run_bind]
+  rw [getBytes_spec expected pre suffix]
+  simp only [bind, Except.bind]
+  simp
+  change (Except.ok ((),
+    (⟨pre ++ expected ++ suffix, pre.size + expected.size⟩ : GetState)) :
+      Except String (Unit × GetState)) = _
+  rfl
+
+theorem getBool_spec (value : Bool) :
+    GetSpec getBool (Encoding.bool value) value := by
+  cases value with
+  | false =>
+      simpa [getBool, Encoding.bool, tag_eq_u8Bytes, boolOfByte?] using
+        (Ixon.ConstLaws.getDecodedU8_spec "boolean" boolOfByte?
+          (fun value : Bool => if value then 1 else 0)
+          (by intro value; cases value <;> rfl) false)
+  | true =>
+      simpa [getBool, Encoding.bool, tag_eq_u8Bytes, boolOfByte?] using
+        (Ixon.ConstLaws.getDecodedU8_spec "boolean" boolOfByte?
+          (fun value : Bool => if value then 1 else 0)
+          (by intro value; cases value <;> rfl) true)
+
+theorem getAddress_spec (value : Address) :
+    GetSpec getAddress (Encoding.address value) value := by
+  simpa [getAddress, Encoding.address] using Address.get_spec value
+
+theorem getSpecMap {getValue : GetM α} {input : ByteArray} {value : α}
+    (hspec : GetSpec getValue input value) (map : α → β) :
+    GetSpec (map <$> getValue) input (map value) :=
+  Ixon.ExprLaws.GetSpec.map hspec map
+
+theorem getSpecMap2 {getLeft : GetM α} {getRight : GetM β}
+    {leftBytes rightBytes : ByteArray} {left : α} {right : β}
+    (hleft : GetSpec getLeft leftBytes left)
+    (hright : GetSpec getRight rightBytes right) (map : α → β → γ) :
+    GetSpec (do
+      let decodedLeft ← getLeft
+      let decodedRight ← getRight
+      return map decodedLeft decodedRight)
+      (leftBytes ++ rightBytes) (map left right) := by
+  let next : α → GetM γ := fun decodedLeft =>
+    map decodedLeft <$> getRight
+  have hnext := getSpecMap hright (map left)
+  have htotal := GetSpec.bind (next := next) hleft hnext
+  simpa [next] using htotal
+
+theorem getSpecMap3 {getFirst : GetM α} {getSecond : GetM β}
+    {getThird : GetM γ} {firstBytes secondBytes thirdBytes : ByteArray}
+    {first : α} {second : β} {third : γ}
+    (hfirst : GetSpec getFirst firstBytes first)
+    (hsecond : GetSpec getSecond secondBytes second)
+    (hthird : GetSpec getThird thirdBytes third)
+    (map : α → β → γ → δ) :
+    GetSpec (do
+      let decodedFirst ← getFirst
+      let decodedSecond ← getSecond
+      let decodedThird ← getThird
+      return map decodedFirst decodedSecond decodedThird)
+      (firstBytes ++ secondBytes ++ thirdBytes)
+      (map first second third) := by
+  let afterFirst : α → GetM δ := fun decodedFirst => do
+    let decodedSecond ← getSecond
+    let decodedThird ← getThird
+    return map decodedFirst decodedSecond decodedThird
+  have htail := getSpecMap2 hsecond hthird (map first)
+  have htotal := GetSpec.bind (next := afterFirst) hfirst htail
+  simpa [afterFirst, ByteArray.append_assoc] using htotal
+
+theorem getSpecMap4 {getFirst : GetM α} {getSecond : GetM β}
+    {getThird : GetM γ} {getFourth : GetM δ}
+    {firstBytes secondBytes thirdBytes fourthBytes : ByteArray}
+    {first : α} {second : β} {third : γ} {fourth : δ}
+    (hfirst : GetSpec getFirst firstBytes first)
+    (hsecond : GetSpec getSecond secondBytes second)
+    (hthird : GetSpec getThird thirdBytes third)
+    (hfourth : GetSpec getFourth fourthBytes fourth)
+    (map : α → β → γ → δ → ε) :
+    GetSpec (do
+      let decodedFirst ← getFirst
+      let decodedSecond ← getSecond
+      let decodedThird ← getThird
+      let decodedFourth ← getFourth
+      return map decodedFirst decodedSecond decodedThird decodedFourth)
+      (firstBytes ++ secondBytes ++ thirdBytes ++ fourthBytes)
+      (map first second third fourth) := by
+  let afterFirst : α → GetM ε := fun decodedFirst => do
+    let decodedSecond ← getSecond
+    let decodedThird ← getThird
+    let decodedFourth ← getFourth
+    return map decodedFirst decodedSecond decodedThird decodedFourth
+  have htail := getSpecMap3 hsecond hthird hfourth (map first)
+  have htotal := GetSpec.bind (next := afterFirst) hfirst htail
+  simpa [afterFirst, ByteArray.append_assoc] using htotal
+
+/-- Concatenated element payload beneath a counted sequence. -/
+def listBytes (encode : α → ByteArray) : List α → ByteArray
+  | [] => ByteArray.empty
+  | head :: tail => encode head ++ listBytes encode tail
+
+theorem foldl_append_eq (encode : α → ByteArray) (values : List α)
+    (initial : ByteArray) :
+    values.foldl (fun output value => output ++ encode value) initial =
+      initial ++ listBytes encode values := by
+  induction values generalizing initial with
+  | nil => simp [listBytes]
+  | cons head tail ih =>
+      simp only [List.foldl_cons, listBytes]
+      rw [ih]
+      simp [ByteArray.append_assoc]
+
+theorem listBytes_eq_foldl (encode : α → ByteArray) (values : List α) :
+    listBytes encode values =
+      values.foldl (fun output value => output ++ encode value)
+        ByteArray.empty := by
+  rw [foldl_append_eq]
+  simp
+
+theorem getListN_spec (getOne : GetM α) (encode : α → ByteArray)
+    (hone : ∀ value, GetSpec getOne (encode value) value)
+    (values : List α) :
+    GetSpec (getListN getOne values.length)
+      (listBytes encode values) values := by
+  induction values with
+  | nil => exact GetSpec.pure []
+  | cons head tail ih =>
+      have htail := Ixon.ExprLaws.GetSpec.map ih (head :: ·)
+      let next : α → GetM (List α) := fun decoded =>
+        (decoded :: ·) <$> getListN getOne tail.length
+      have htotal := GetSpec.bind (next := next) (hone head) htail
+      simpa [next, getListN, listBytes] using htotal
+
+theorem getListN_spec_of (getOne : GetM α) (encode : α → ByteArray)
+    (property : α → Prop)
+    (hone : ∀ value, property value → GetSpec getOne (encode value) value)
+    (values : List α) (hvalues : ∀ value ∈ values, property value) :
+    GetSpec (getListN getOne values.length)
+      (listBytes encode values) values := by
+  induction values with
+  | nil => exact GetSpec.pure []
+  | cons head tail ih =>
+      have hhead : property head := hvalues head (by simp)
+      have htailProperty : ∀ value ∈ tail, property value := by
+        intro value hvalue
+        exact hvalues value (by simp [hvalue])
+      have htail := Ixon.ExprLaws.GetSpec.map (ih htailProperty) (head :: ·)
+      let next : α → GetM (List α) := fun decoded =>
+        (decoded :: ·) <$> getListN getOne tail.length
+      have htotal := GetSpec.bind (next := next) (hone head hhead) htail
+      simpa [next, getListN, listBytes] using htotal
+
+theorem list_eq_counted (encode : α → ByteArray) (values : List α) :
+    Encoding.list encode values =
+      Encoding.nat values.length ++ listBytes encode values := by
+  simp only [Encoding.list]
+  rw [listBytes_eq_foldl]
+
+theorem getList_spec (getOne : GetM α) (encode : α → ByteArray)
+    (hone : ∀ value, GetSpec getOne (encode value) value)
+    (values : List α) :
+    GetSpec (getList getOne) (Encoding.list encode values) values := by
+  have hlist := getListN_spec getOne encode hone values
+  let next : Nat → GetM (List α) := fun count => getListN getOne count
+  have htotal := GetSpec.bind (next := next)
+    (getNat_spec values.length) hlist
+  simpa [getList, list_eq_counted, next] using htotal
+
+theorem getList_spec_of (getOne : GetM α) (encode : α → ByteArray)
+    (property : α → Prop)
+    (hone : ∀ value, property value → GetSpec getOne (encode value) value)
+    (values : List α) (hvalues : ∀ value ∈ values, property value) :
+    GetSpec (getList getOne) (Encoding.list encode values) values := by
+  have hlist := getListN_spec_of getOne encode property hone values hvalues
+  let next : Nat → GetM (List α) := fun count => getListN getOne count
+  have htotal := GetSpec.bind (next := next)
+    (getNat_spec values.length) hlist
+  simpa [getList, list_eq_counted, next] using htotal
+
+theorem array_eq_counted (encode : α → ByteArray) (values : Array α) :
+    Encoding.array encode values =
+      Encoding.nat values.size ++ listBytes encode values.toList := by
+  simp only [Encoding.array]
+  rw [listBytes_eq_foldl]
+  rw [Array.foldl_toList]
+
+theorem getArray_spec (getOne : GetM α) (encode : α → ByteArray)
+    (hone : ∀ value, GetSpec getOne (encode value) value)
+    (values : Array α) :
+    GetSpec (getArray getOne) (Encoding.array encode values) values := by
+  have hlist := getListN_spec getOne encode hone values.toList
+  have harray := Ixon.ExprLaws.GetSpec.map hlist List.toArray
+  let next : Nat → GetM (Array α) := fun count =>
+    List.toArray <$> getListN getOne count
+  have htotal := GetSpec.bind (next := next)
+    (getNat_spec values.size) harray
+  simpa [getArray, array_eq_counted, next] using htotal
+
+theorem getArray_spec_of (getOne : GetM α) (encode : α → ByteArray)
+    (property : α → Prop)
+    (hone : ∀ value, property value → GetSpec getOne (encode value) value)
+    (values : Array α)
+    (hvalues : ∀ value ∈ values.toList, property value) :
+    GetSpec (getArray getOne) (Encoding.array encode values) values := by
+  have hlist := getListN_spec_of getOne encode property hone values.toList hvalues
+  have harray := Ixon.ExprLaws.GetSpec.map hlist List.toArray
+  let next : Nat → GetM (Array α) := fun count =>
+    List.toArray <$> getListN getOne count
+  have htotal := GetSpec.bind (next := next)
+    (getNat_spec values.size) harray
+  simpa [getArray, array_eq_counted, next] using htotal
+
+theorem runCanonical_of_spec (getValue : GetM α) (encode : α → ByteArray)
+    (value : α) (hspec : GetSpec getValue (encode value) value) :
+    runCanonical getValue encode (encode value) = .ok value := by
+  unfold runCanonical
+  rw [runGet_eq_ok_of_spec hspec]
+  simp only [bind, Except.bind]
+  simp
+  change (Except.ok value : Except String α) = .ok value
+  rfl
+
+theorem runCanonical_canonical (getValue : GetM α)
+    (encode : α → ByteArray) {bytes : ByteArray} {value : α}
+    (hdecode : runCanonical getValue encode bytes = .ok value) :
+    encode value = bytes := by
+  simp only [runCanonical] at hdecode
+  cases hrun : runGet getValue bytes with
+  | error error => rw [hrun] at hdecode; contradiction
+  | ok decoded =>
+      rw [hrun] at hdecode
+      simp only [bind, Except.bind] at hdecode
+      split at hdecode
+      · rename_i heq
+        cases hdecode
+        exact heq
+      · contradiction
+
+end Ix.Compiler.IxIR.Decode
diff --git a/Ix/Compiler/IxIR/Encoding.lean b/Ix/Compiler/IxIR/Encoding.lean
new file mode 100644
index 000000000..1a3b96e48
--- /dev/null
+++ b/Ix/Compiler/IxIR/Encoding.lean
@@ -0,0 +1,78 @@
+import Ix.Compiler.Ixon.Hash
+
+/-!
+# Canonical byte primitives for addressed IR artifacts
+
+IxIR₀ and IxIR₁ use a small private grammar for hash preimages. It is not the
+Ixon wire format: domains are versioned independently so changing a backend IR
+cannot silently preserve an old artifact identity.
+
+Natural numbers use canonical unsigned LEB128 over arbitrary-precision Lean
+`Nat`; unlike a `Nat.toUInt64` shortcut, this is total and cannot truncate.
+Variable-length byte strings and arrays carry a LEB128 length, addresses are
+exactly 32 raw bytes, and every sum constructor has a one-byte tag. These
+rules make every concatenation boundary explicit.
+-/
+
+namespace Ix.Compiler.IxIR.Encoding
+
+/-- One tag byte. -/
+def tag (value : UInt8) : ByteArray :=
+  ByteArray.mk #[value]
+
+/-- Canonical unsigned LEB128 for an arbitrary natural number. -/
+def nat (value : Nat) : ByteArray :=
+  if _h : value < 128 then
+    tag (UInt8.ofNat value)
+  else
+    tag (UInt8.ofNat (128 + value % 128)) ++ nat (value / 128)
+termination_by value
+decreasing_by
+  apply Nat.div_lt_self
+  · omega
+  · omega
+
+/-- A Boolean as exactly one byte. -/
+def bool : Bool → ByteArray
+  | false => tag 0
+  | true => tag 1
+
+/-- Length-prefixed raw bytes. -/
+def blob (bytes : ByteArray) : ByteArray :=
+  nat bytes.size ++ bytes
+
+/-- Length-prefixed UTF-8. -/
+def string (value : String) : ByteArray :=
+  blob value.toUTF8
+
+/-- A content address in its fixed-width raw representation. -/
+def address (value : Ixon.Address) : ByteArray :=
+  value.hash
+
+/-- Length-prefixed array preserving source order. -/
+def array (encode : α → ByteArray) (values : Array α) : ByteArray :=
+  nat values.size ++
+    values.foldl (fun output value => output ++ encode value) ByteArray.empty
+
+/-- Length-prefixed list preserving source order. -/
+def list (encode : α → ByteArray) (values : List α) : ByteArray :=
+  nat values.length ++
+    values.foldl (fun output value => output ++ encode value) ByteArray.empty
+
+/-- A versioned ASCII domain prefix. Callers use a trailing NUL to keep the
+domain boundary visible to non-Lean implementations. -/
+def domain (name : String) : ByteArray :=
+  name.toUTF8
+
+/-! Frozen primitive spellings. -/
+
+#guard nat 0 == ByteArray.mk #[0]
+#guard nat 127 == ByteArray.mk #[127]
+#guard nat 128 == ByteArray.mk #[128, 1]
+#guard nat 255 == ByteArray.mk #[255, 1]
+#guard nat 16384 == ByteArray.mk #[128, 128, 1]
+#guard nat (2 ^ 64) ==
+  ByteArray.mk #[128, 128, 128, 128, 128, 128, 128, 128, 128, 2]
+#guard array nat #[1, 128] == ByteArray.mk #[2, 1, 128, 1]
+
+end Ix.Compiler.IxIR.Encoding
diff --git a/Ix/Compiler/IxIR0/Basic.lean b/Ix/Compiler/IxIR0/Basic.lean
new file mode 100644
index 000000000..0be933412
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Basic.lean
@@ -0,0 +1,187 @@
+import Ix.Compiler.Ixon.Uses
+import Ix.Compiler.AddressEnv
+
+/-!
+# IxIR₀: the erased core IR
+
+The first IR after erasure and the semantic anchor of the backend
+pipeline: every later stage (IxIR₀ˢ, IxIR₁, IxIR₂) refines IxIR₀'s
+big-step semantics (`Eval.lean`), and the first theorem target is the
+erasure simulation Ixon → IxIR₀.
+
+Shape: an untyped, pure, **curried** λ-calculus (environment
+semantics, no store — the heap appears at IxIR₁) with literals and
+content-addressed globals: definitions, constructors, recursors, and
+trusted externs. The IR boundaries are recorded in `docs/compiler/compiler-design.md`;
+the key choices encoded here are:
+
+- **Functional big-step + fuel** (CakeML-style): executable and
+  proof-ergonomic; relational wrappers are derived, and termination
+  claims are ∃-fuel statements.
+- **CBV, strict lets**; left-to-right application order.
+- **Curried** application mirroring Ixon; saturation/arity analysis
+  arrives at IxIR₁ (the `papp`/`apply` vocabulary).
+- **Recursor ι from day one**: recursors are declarations carrying
+  rules; see `RecRule` for the environment convention that replaces
+  self-reference.
+- **Externs as oracle**: an extern declaration is just an arity; its
+  semantics is a parametric oracle keyed by address — the
+  trusted-extern ledger's formal hook (`docs/compiler/trusted-extern-ledger.md`).
+- **No cost model here**: cost instrumentation attaches to IxIR₁
+  memory ops, never to IxIR₀ steps or fuel.
+
+## The erasure contract
+
+What the erasure pass Ixon → IxIR₀ (`Ix/Compiler/Erase.lean`) must
+produce; hand-written examples must obey the same discipline:
+
+- 0-mode (`Uses.erased`) binders and arguments are **dropped**, not
+  boxed. Sound because 0-positions must be kernel-total (gate decision
+  (a): references to opaque/`partial`/extern constants at mode 0 are
+  rejected upstream).
+- Types, sorts, Pi's, motives, and index arguments are erased. A
+  type-valued *occurrence* in a relevant position becomes
+  `Expr.erased` (Coq extraction's ◻); it absorbs application and
+  projection.
+- **Constructor values carry kept fields only** — never parameters.
+  Params are not projectable, so they need no runtime representation
+  (Lean's own object model agrees). A `Decl.ctor`'s arity is its
+  kept-field count; erasure drops param arguments at application
+  sites.
+- Quotients are compiled away (`Quot.mk r a ↦ a`, `Quot.lift f h q ↦
+  f q`) — no IxIR₀ support needed.
+- Binder modes (`Uses` on `lam`/`letE`) survive erasure with the
+  invariant uses ≠ erased. They are **semantically inert** at this
+  level — the interpreter ignores them — and exist so IxIR₁'s
+  mode-directed memory lowering never re-runs usage analysis. (Ixon
+  lets carry no mode; the erasure pass synthesizes it.)
+
+## Deliberately absent (recorded, not forgotten)
+
+- Mutual blocks / Ixon `rec_`: self-recursive recursors (`Nat.rec`,
+  `List.rec`) are covered by the `RecRule` environment convention;
+  *mutually-inductive* recursor families need block references and
+  arrive when real corpora do (via the ix merge — the standalone
+  importer is skipped, JCB 2026-08-12).
+- Literal↔constructor coherence beyond `natLit` major-peeling. The source
+  evaluator has opt-in, address-configured String constructor expansion, but
+  certified erasure disables it until this target has a representation-aware
+  counterpart. The GMP-extern vs unary-ctor story remains a separate gate.
+- K-like reduction, structure eta, and `False.rec`-style
+  unreachability (erasure will need an answer; candidates: `erased`,
+  or an explicit `unreachable` extern on the ledger).
+- Canonical declaration preimages and BLAKE3 address APIs live in
+  `IxIR0/Serialize.lean`; strict declaration decoding lives in `Decode.lean`,
+  and the cycle-safe symbolic block envelope plus final-key materializer live
+  in `MutualBlock.lean`. Threading that block map through erasure and its
+  simulations remains active before cached fixpoints can consume every key.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Uses Address Owned)
+
+/-- Scalar literals surviving erasure (Ixon `natl`/`strl`). Machine
+scalars (`UInt64`, …) appear only from IxIR₀ˢ on, as unboxings of
+these. -/
+inductive Literal where
+  | nat (n : Nat)
+  | str (s : String)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- IxIR₀ expressions: nameless (de Bruijn), erased, curried. -/
+inductive Expr where
+  /-- de Bruijn index into the evaluation environment. -/
+  | var (idx : Nat)
+  /-- Reference to a global declaration by content address. -/
+  | ref (adr : Address)
+  | app (fn arg : Expr)
+  /-- One binder; `uses ≠ erased` (erased binders are dropped by
+  erasure). The mode is semantically inert here. -/
+  | lam (uses : Uses) (body : Expr)
+  /-- Strict let. Not sugar for a β-redex because IxIR₁'s
+  let-normalized (GRIN-style) world wants it explicit. -/
+  | letE (uses : Uses) (val body : Expr)
+  /-- Projection of the `idx`-th **kept** field of a structure value. -/
+  | proj (idx : Nat) (struct : Expr)
+  | lit (l : Literal)
+  /-- ◻: an erased occurrence in a relevant position. Absorbs
+  application and projection. -/
+  | erased
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- One ι-rule of a recursor, selected by the major premise's
+constructor tag. `rhs` is an open term evaluated in the environment
+
+    fields.reverse ++ preMajor.reverse ++ [recursorValue]
+
+i.e. de Bruijn 0 is the **last** constructor field, then earlier
+fields, then the recursor's pre-major arguments last-to-first, and
+finally (deepest) the recursor itself as an unapplied value — the
+content-addressing-safe replacement for a self-`ref`, since a
+recursor's rules cannot address the recursor without a hash cycle.
+
+A kernel rule `fun params motives minors fields => …` erases to this
+shape by dropping motives (and erased params/fields) and mapping
+recursive occurrences of the recursor constant to the deepest
+variable. `fields` is the kept-field count of the matching
+constructor, checked at ι-time. -/
+structure RecRule where
+  fields : Nat
+  rhs : Expr
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Global declarations, keyed by content address in an `Env`. The
+inductive *type* itself has no declaration — types are erased; only
+its constructors and recursor survive. -/
+inductive Decl where
+  /-- A definition whose returned heap value lives in `result`;
+  scalars are ownership-polymorphic. `body` must be closed. Evaluated
+  at each `ref` (call-by-name at globals — spec-grade; the backend
+  compiles, it never interprets). -/
+  | defn (result : Owned) (body : Expr)
+  /-- A constructor: `tag` is its index in the inductive, `arity` its
+  kept-field count (params are never stored). -/
+  | ctor (tag arity : Nat)
+  /-- A recursor: `numArgs` kept arguments *before* the major premise
+  (post-erasure: kept params + minors; motives and indices are
+  erased), so the firing arity is `numArgs + 1`. `natLit` enables
+  Nat-literal peeling of the major (`0 ↦ tag 0 []`, `n+1 ↦ tag 1
+  [lit n]`) — set only on `Nat.rec` by the lowering; general
+  literal↔ctor coherence is a recorded gate. `rules` is indexed by
+  constructor tag. -/
+  | recursor (numArgs : Nat) (natLit : Bool) (rules : Array RecRule)
+  /-- A trusted extern of the given arity; semantics supplied by the
+  evaluation oracle (the ledger's formal hook). -/
+  | extern (arity : Nat)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The closed world: a Merkle-DAG of declarations as a partial map. The
+kernel-facing representation stays a proof-friendly function; its list
+constructor has a proved hash-index implementation for generated code. -/
+abbrev Env := Address → Option Decl
+
+def Env.empty : Env := fun _ => none
+
+def Env.ofList (l : List (Address × Decl)) : Env :=
+  fun a => (l.find? (fun p => p.1 == a)).map (·.2)
+
+namespace Env
+
+/-- The explicitly staged runtime representation of an environment. -/
+abbrev Index := AddressEnv.Index Decl
+
+def Index.ofList (l : List (Address × Decl)) : Index :=
+  AddressEnv.build l
+
+def Index.toEnv (index : Index) : Env :=
+  AddressEnv.lookup index
+
+/-- The runtime index implements the transparent first-binding-wins model. -/
+@[simp] theorem Index.toEnv_ofList (l : List (Address × Decl)) :
+    (Index.ofList l).toEnv = Env.ofList l := by
+  exact AddressEnv.lookup_build l
+
+end Env
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/Decode.lean b/Ix/Compiler/IxIR0/Decode.lean
new file mode 100644
index 000000000..3e5d26c1c
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Decode.lean
@@ -0,0 +1,357 @@
+import Ix.Compiler.IxIR.Decode
+import Ix.Compiler.IxIR0.Serialize
+
+/-!
+# Strict IxIR₀ declaration decoding
+
+The public entry point consumes the complete versioned declaration preimage,
+requires full input consumption, and re-encodes the result before accepting it.
+The raw recursive expression reader is input-fueled; the proofs below show the
+fuel is sufficient for every encoded declaration.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon
+open Ix.Compiler.IxIR
+open Ix.Compiler.IxIR.Decode
+
+def getLiteralTag : UInt8 → GetM Literal
+  | 0 => do return .nat (← Decode.getNat)
+  | 1 => do return .str (← Decode.getString)
+  | tag => throw s!"IxIR0 literal: invalid tag {tag}"
+
+def getLiteral : GetM Literal := do
+  getLiteralTag (← getU8)
+
+def getUses : GetM Uses :=
+  getDecodedU8 "IxIR0 uses" Uses.ofBits?
+
+def getOwned : GetM Owned :=
+  getDecodedU8 "IxIR0 ownership" Owned.ofBits?
+
+def getExprTag (recur : GetM Expr) : UInt8 → GetM Expr
+  | 0 => do return .var (← Decode.getNat)
+  | 1 => do return .ref (← Decode.getAddress)
+  | 2 => do return .app (← recur) (← recur)
+  | 3 => do return .lam (← getUses) (← recur)
+  | 4 => do
+      let uses ← getUses
+      let value ← recur
+      return .letE uses value (← recur)
+  | 5 => do return .proj (← Decode.getNat) (← recur)
+  | 6 => do return .lit (← getLiteral)
+  | 7 => pure .erased
+  | tag => throw s!"IxIR0 expression: invalid tag {tag}"
+
+def getExprFuel : Nat → GetM Expr
+  | 0 => throw "IxIR0 expression: recursion limit"
+  | fuel + 1 => do
+      getExprTag (getExprFuel fuel) (← getU8)
+
+def getExpr : GetM Expr := do
+  let state ← get
+  getExprFuel (state.bytes.size + 1)
+
+def getRecRule : GetM RecRule := do
+  return ⟨← Decode.getNat, ← getExpr⟩
+
+def getDeclTag : UInt8 → GetM Decl
+  | 0 => do return .defn (← getOwned) (← getExpr)
+  | 1 => do return .ctor (← Decode.getNat) (← Decode.getNat)
+  | 2 => do
+      let numArgs ← Decode.getNat
+      let natLit ← Decode.getBool
+      return .recursor numArgs natLit (← Decode.getArray getRecRule)
+  | 3 => do return .extern (← Decode.getNat)
+  | tag => throw s!"IxIR0 declaration: invalid tag {tag}"
+
+def getDeclPayload : GetM Decl := do
+  getDeclTag (← getU8)
+
+def getDeclPreimage : GetM Decl := do
+  Decode.expectBytes Decl.addressDomain
+  getDeclPayload
+
+/-- Decode one complete canonical IxIR₀ declaration preimage. -/
+def Decl.decodePreimage (bytes : ByteArray) : Except String Decl :=
+  Decode.runCanonical getDeclPreimage Decl.preimage bytes
+
+/-! ## Cursor-relative roundtrip proofs -/
+
+theorem getLiteral_spec : ∀ value : Literal,
+    GetSpec getLiteral value.bytes value
+  | .nat number => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec number) Literal.nat
+      have htotal := GetSpec.bind (next := getLiteralTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getLiteral, Literal.bytes] using htotal
+  | .str string => by
+      have hpayload := Decode.getSpecMap (Decode.getString_spec string) Literal.str
+      have htotal := GetSpec.bind (next := getLiteralTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getLiteral, Literal.bytes] using htotal
+
+theorem getUses_spec (value : Uses) :
+    GetSpec getUses (Encoding.tag value.toBits) value := by
+  rw [Decode.tag_eq_u8Bytes]
+  exact Ixon.ConstLaws.getDecodedU8_spec "IxIR0 uses" Uses.ofBits?
+    Uses.toBits Uses.ofBits?_toBits value
+
+theorem getOwned_spec (value : Owned) :
+    GetSpec getOwned (Encoding.tag value.toBits) value := by
+  rw [Decode.tag_eq_u8Bytes]
+  exact Ixon.ConstLaws.getDecodedU8_spec "IxIR0 ownership" Owned.ofBits?
+    Owned.toBits Owned.ofBits?_toBits value
+
+/-- Recursive parser depth; every encoded expression has at least this many
+constructor-tag bytes along its deepest branch. -/
+def Expr.decodeDepth : Expr → Nat
+  | .var _ | .ref _ | .lit _ | .erased => 1
+  | .app function argument =>
+      1 + Nat.max function.decodeDepth argument.decodeDepth
+  | .lam _ body => 1 + body.decodeDepth
+  | .letE _ value body =>
+      1 + Nat.max value.decodeDepth body.decodeDepth
+  | .proj _ target => 1 + target.decodeDepth
+
+theorem Expr.decodeDepth_pos (expression : Expr) :
+    0 < expression.decodeDepth := by
+  cases expression <;> simp only [Expr.decodeDepth] <;> omega
+
+theorem Expr.decodeDepth_le_bytes (expression : Expr) :
+    expression.decodeDepth ≤ expression.bytes.size := by
+  induction expression with
+  | var index => simp [Expr.decodeDepth, Expr.bytes]
+  | ref address => simp [Expr.decodeDepth, Expr.bytes]
+  | app function argument hfunction hargument =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      have hleft : function.decodeDepth ≤
+          function.bytes.size + argument.bytes.size := by omega
+      have hright : argument.decodeDepth ≤
+          function.bytes.size + argument.bytes.size := by omega
+      have hmax : Nat.max function.decodeDepth argument.decodeDepth ≤
+          function.bytes.size + argument.bytes.size :=
+        Nat.max_le.mpr ⟨hleft, hright⟩
+      omega
+  | lam uses body hbody =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      omega
+  | letE uses value body hvalue hbody =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      have hleft : value.decodeDepth ≤ value.bytes.size + body.bytes.size := by
+        omega
+      have hright : body.decodeDepth ≤ value.bytes.size + body.bytes.size := by
+        omega
+      have hmax : Nat.max value.decodeDepth body.decodeDepth ≤
+          value.bytes.size + body.bytes.size :=
+        Nat.max_le.mpr ⟨hleft, hright⟩
+      omega
+  | proj index target htarget =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      omega
+  | lit literal =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      omega
+  | erased => simp [Expr.decodeDepth, Expr.bytes]
+
+theorem getExprFuel_spec (expression : Expr) (fuel : Nat)
+    (hfuel : expression.decodeDepth < fuel) :
+    GetSpec (getExprFuel fuel) expression.bytes expression := by
+  induction expression generalizing fuel with
+  | var index =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload := Decode.getSpecMap (Decode.getNat_spec index) Expr.var
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 0) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | ref address =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload := Decode.getSpecMap
+            (Decode.getAddress_spec address) Expr.ref
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 1) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | app function argument hfunction hargument =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have hmax : Nat.max function.decodeDepth argument.decodeDepth < fuel := by
+            omega
+          have hfunctionFuel : function.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_left _ _) hmax
+          have hargumentFuel : argument.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_right _ _) hmax
+          have hpayload := Decode.getSpecMap2
+            (hfunction fuel hfunctionFuel) (hargument fuel hargumentFuel)
+            Expr.app
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 2) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | lam uses body hbody =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have hbodyFuel : body.decodeDepth < fuel := by omega
+          have hpayload := Decode.getSpecMap2 (getUses_spec uses)
+            (hbody fuel hbodyFuel) Expr.lam
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 3) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | letE uses value body hvalue hbody =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have hmax : Nat.max value.decodeDepth body.decodeDepth < fuel := by
+            omega
+          have hvalueFuel : value.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_left _ _) hmax
+          have hbodyFuel : body.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_right _ _) hmax
+          have hpayload := Decode.getSpecMap3 (getUses_spec uses)
+            (hvalue fuel hvalueFuel) (hbody fuel hbodyFuel) Expr.letE
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 4) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | proj index target htarget =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have htargetFuel : target.decodeDepth < fuel := by omega
+          have hpayload := Decode.getSpecMap2 (Decode.getNat_spec index)
+            (htarget fuel htargetFuel) Expr.proj
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 5) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | lit literal =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload := Decode.getSpecMap (getLiteral_spec literal) Expr.lit
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 6) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | erased =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload : GetSpec (getExprTag (getExprFuel fuel) 7)
+              ByteArray.empty Expr.erased := by
+            exact GetSpec.pure Expr.erased
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 7) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+
+theorem getExpr_spec (expression : Expr) :
+    GetSpec getExpr expression.bytes expression := by
+  intro pre suffix
+  let fuel := (pre ++ expression.bytes ++ suffix).size + 1
+  have hfuel : expression.decodeDepth < fuel := by
+    have hdepth := expression.decodeDepth_le_bytes
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  have hspec := getExprFuel_spec expression fuel hfuel pre suffix
+  simpa [getExpr, fuel] using hspec
+
+theorem getRecRule_spec (rule : RecRule) :
+    GetSpec getRecRule rule.bytes rule := by
+  have hspec := Decode.getSpecMap2 (Decode.getNat_spec rule.fields)
+    (getExpr_spec rule.rhs) RecRule.mk
+  simpa [getRecRule, RecRule.bytes] using hspec
+
+theorem getDeclPayload_spec : ∀ declaration : Decl,
+    GetSpec getDeclPayload declaration.payloadBytes declaration
+  | .defn result body => by
+      have hpayload := Decode.getSpecMap2 (getOwned_spec result)
+        (getExpr_spec body) Decl.defn
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getDeclPayload, Decl.payloadBytes,
+        ByteArray.append_assoc, ByteArray.append_empty] using htotal
+  | .ctor tag arity => by
+      have hpayload := Decode.getSpecMap2 (Decode.getNat_spec tag)
+        (Decode.getNat_spec arity) Decl.ctor
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getDeclPayload, Decl.payloadBytes,
+        ByteArray.append_assoc, ByteArray.append_empty] using htotal
+  | .recursor numArgs natLit rules => by
+      have hpayload := Decode.getSpecMap3 (Decode.getNat_spec numArgs)
+        (Decode.getBool_spec natLit)
+        (Decode.getArray_spec getRecRule RecRule.bytes getRecRule_spec rules)
+        Decl.recursor
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 2) hpayload
+      simpa only [getDeclPayload, Decl.payloadBytes,
+        ByteArray.append_assoc, ByteArray.append_empty] using htotal
+  | .extern arity => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec arity) Decl.extern
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 3) hpayload
+      simpa only [getDeclPayload, Decl.payloadBytes,
+        ByteArray.append_assoc, ByteArray.append_empty] using htotal
+
+theorem getDeclPreimage_spec (declaration : Decl) :
+    GetSpec getDeclPreimage declaration.preimage declaration := by
+  let next : Unit → GetM Decl := fun _ => getDeclPayload
+  have htotal := GetSpec.bind (next := next)
+    (Decode.expectBytes_spec Decl.addressDomain)
+    (getDeclPayload_spec declaration)
+  simpa [getDeclPreimage, Decl.preimage, next] using htotal
+
+/-! ## Strict top-level laws -/
+
+/-- Every declaration decodes from its canonical framed preimage. -/
+theorem Decl.decodePreimage_roundtrip (declaration : Decl) :
+    Decl.decodePreimage declaration.preimage = .ok declaration := by
+  exact Decode.runCanonical_of_spec getDeclPreimage Decl.preimage declaration
+    (getDeclPreimage_spec declaration)
+
+/-- Every accepted byte string is the canonical preimage of its result. -/
+theorem Decl.decodePreimage_canonical {bytes : ByteArray} {declaration : Decl}
+    (hdecode : Decl.decodePreimage bytes = .ok declaration) :
+    declaration.preimage = bytes := by
+  exact Decode.runCanonical_canonical getDeclPreimage Decl.preimage hdecode
+
+/-- Canonical declaration preimages are injective. -/
+theorem Decl.preimage_injective : Function.Injective Decl.preimage := by
+  intro left right hbytes
+  have hok : (Except.ok left : Except String Decl) = .ok right := by
+    calc
+      .ok left = Decl.decodePreimage left.preimage :=
+        (Decl.decodePreimage_roundtrip left).symm
+      _ = Decl.decodePreimage right.preimage := congrArg Decl.decodePreimage hbytes
+      _ = .ok right := Decl.decodePreimage_roundtrip right
+  exact Except.ok.inj hok
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/DynamicCost.lean b/Ix/Compiler/IxIR0/DynamicCost.lean
new file mode 100644
index 000000000..45737ccf8
--- /dev/null
+++ b/Ix/Compiler/IxIR0/DynamicCost.lean
@@ -0,0 +1,615 @@
+import Ix.Compiler.IxIR0.ProjectionSafe
+
+/-!
+# Dynamic IxIR₀ execution profiles
+
+Evaluator fuel is a totality index, not a cost.  This module instead records
+the semantic events that actually occur along a successful execution.  The
+profile is additive across expression subcomputations, application spines,
+closure entry, and recursor-rule entry, so recursion contributes once per
+dynamically selected rule rather than once per source syntax occurrence.
+
+The event vocabulary is intentionally source-facing.  A lowering proof may
+relate it to IxIR₁ allocation and reference-count counters without asserting
+that one source event is intrinsically one target instruction.
+-/
+
+namespace Ix.Compiler.IxIR0.DynamicCost
+
+/-- Source events retained by the dynamic cost model. -/
+inductive Event where
+  | evalVar
+  | evalLit
+  | evalErased
+  | evalLam
+  | evalLet
+  | evalApp
+  | evalProj
+  | evalRefDefn
+  | evalRefCtor
+  | evalRefRecursor
+  | evalRefExtern
+  | applyClosure
+  | applyPap
+  | applyErased
+  | saturatePending
+  | saturateFull
+  | fireConstructor
+  | fireExtern
+  | fireRecursor
+  deriving BEq, DecidableEq, Repr
+
+/-- A compact additive summary of one dynamic source trace. -/
+@[ext] structure Profile where
+  evals : Nat := 0
+  applies : Nat := 0
+  saturations : Nat := 0
+  constructorFires : Nat := 0
+  closureValues : Nat := 0
+  papValues : Nat := 0
+  recursorFires : Nat := 0
+  externFires : Nat := 0
+  projections : Nat := 0
+  /-- A conservative count of source-owned roots that lowering may have to
+  retain explicitly.  Unlike the event counters, this quantity carries the
+  dynamic width of closure environments, PAP prefixes, and recursor fields. -/
+  retains : Nat := 0
+  deriving BEq, DecidableEq, Repr
+
+instance : Zero Profile := ⟨{}⟩
+
+instance : Add Profile where
+  add left right :=
+    { evals := left.evals + right.evals
+      applies := left.applies + right.applies
+      saturations := left.saturations + right.saturations
+      constructorFires := left.constructorFires + right.constructorFires
+      closureValues := left.closureValues + right.closureValues
+      papValues := left.papValues + right.papValues
+      recursorFires := left.recursorFires + right.recursorFires
+      externFires := left.externFires + right.externFires
+      projections := left.projections + right.projections
+      retains := left.retains + right.retains }
+
+@[simp] theorem Profile.zero_evals : (0 : Profile).evals = 0 := rfl
+@[simp] theorem Profile.zero_applies : (0 : Profile).applies = 0 := rfl
+@[simp] theorem Profile.zero_saturations :
+    (0 : Profile).saturations = 0 := rfl
+@[simp] theorem Profile.zero_constructorFires :
+    (0 : Profile).constructorFires = 0 := rfl
+@[simp] theorem Profile.zero_closureValues :
+    (0 : Profile).closureValues = 0 := rfl
+@[simp] theorem Profile.zero_papValues :
+    (0 : Profile).papValues = 0 := rfl
+@[simp] theorem Profile.zero_recursorFires :
+    (0 : Profile).recursorFires = 0 := rfl
+@[simp] theorem Profile.zero_externFires :
+    (0 : Profile).externFires = 0 := rfl
+@[simp] theorem Profile.zero_projections :
+    (0 : Profile).projections = 0 := rfl
+@[simp] theorem Profile.zero_retains : (0 : Profile).retains = 0 := rfl
+
+@[simp] theorem Profile.add_evals (left right : Profile) :
+    (left + right).evals = left.evals + right.evals := rfl
+@[simp] theorem Profile.add_applies (left right : Profile) :
+    (left + right).applies = left.applies + right.applies := rfl
+@[simp] theorem Profile.add_saturations (left right : Profile) :
+    (left + right).saturations =
+      left.saturations + right.saturations := rfl
+@[simp] theorem Profile.add_constructorFires (left right : Profile) :
+    (left + right).constructorFires =
+      left.constructorFires + right.constructorFires := rfl
+@[simp] theorem Profile.add_closureValues (left right : Profile) :
+    (left + right).closureValues =
+      left.closureValues + right.closureValues := rfl
+@[simp] theorem Profile.add_papValues (left right : Profile) :
+    (left + right).papValues = left.papValues + right.papValues := rfl
+@[simp] theorem Profile.add_recursorFires (left right : Profile) :
+    (left + right).recursorFires =
+      left.recursorFires + right.recursorFires := rfl
+@[simp] theorem Profile.add_externFires (left right : Profile) :
+    (left + right).externFires =
+      left.externFires + right.externFires := rfl
+@[simp] theorem Profile.add_projections (left right : Profile) :
+    (left + right).projections =
+      left.projections + right.projections := rfl
+@[simp] theorem Profile.add_retains (left right : Profile) :
+    (left + right).retains = left.retains + right.retains := rfl
+
+theorem Profile.zero_add (profile : Profile) : 0 + profile = profile := by
+  ext <;> simp
+
+theorem Profile.add_zero (profile : Profile) : profile + 0 = profile := by
+  ext <;> simp
+
+theorem Profile.add_assoc (left middle right : Profile) :
+    left + middle + right = left + (middle + right) := by
+  ext <;> simp [Nat.add_assoc]
+
+theorem Profile.add_comm (left right : Profile) :
+    left + right = right + left := by
+  ext <;> simp [Nat.add_comm]
+
+/-- The one-event contribution to a dynamic profile. -/
+def tick : Event → Profile
+  | .evalVar | .evalLit | .evalErased | .evalLet | .evalApp |
+      .evalRefDefn | .evalRefCtor | .evalRefExtern =>
+      { evals := 1 }
+  | .evalLam =>
+      { evals := 1, closureValues := 1 }
+  | .evalProj =>
+      { evals := 1, projections := 1 }
+  | .evalRefRecursor =>
+      { evals := 1, papValues := 1 }
+  | .applyClosure | .applyPap | .applyErased =>
+      { applies := 1 }
+  | .saturatePending =>
+      { saturations := 1, papValues := 1 }
+  | .saturateFull =>
+      { saturations := 1 }
+  | .fireConstructor =>
+      { constructorFires := 1 }
+  | .fireExtern =>
+      { externFires := 1 }
+  | .fireRecursor =>
+      { recursorFires := 1 }
+
+/-- Dynamic-width contribution for operations that may become one target
+`dup` per retained source root.  Counting candidates is conservative:
+scalars and ownership moves may execute without an RC instruction. -/
+def retain (count : Nat) : Profile := { retains := count }
+
+/-! ## Costed call-aware traces -/
+
+mutual
+
+  /-- A projection-safe expression trace annotated with its additive dynamic
+  profile. -/
+  inductive Eval (ctx : Ctx) :
+      Nat → List Value → Expr → Value → Profile → Prop where
+    | var {fuel env index value} :
+        env[index]? = some value →
+        Eval ctx (fuel + 1) env (.var index) value
+          (tick .evalVar + retain 1)
+    | lit {fuel env literal} :
+        Eval ctx (fuel + 1) env (.lit literal) (.lit literal)
+          (tick .evalLit)
+    | erased {fuel env} :
+        Eval ctx (fuel + 1) env .erased .erased (tick .evalErased)
+    | lam {fuel env uses body} :
+        Eval ctx (fuel + 1) env (.lam uses body) (.clos uses env body)
+          (tick .evalLam + retain env.length)
+    | letE {fuel env uses value body bound result valueCost bodyCost} :
+        Eval ctx fuel env value bound valueCost →
+        Eval ctx fuel (bound :: env) body result bodyCost →
+        Eval ctx (fuel + 1) env (.letE uses value body) result
+          (valueCost + bodyCost + tick .evalLet)
+    | app {fuel env function argument functionValue argumentValue result
+        functionCost argumentCost applyCost} :
+        Eval ctx fuel env function functionValue functionCost →
+        Eval ctx fuel env argument argumentValue argumentCost →
+        Apply ctx fuel functionValue argumentValue result applyCost →
+        Eval ctx (fuel + 1) env (.app function argument) result
+          (functionCost + argumentCost + applyCost + tick .evalApp)
+    | proj {fuel env index source address tag fields result sourceCost} :
+        Eval ctx fuel env source (.ctor address tag fields) sourceCost →
+        fields[index]? = some result →
+        Eval ctx (fuel + 1) env (.proj index source) result
+          (sourceCost + tick .evalProj + retain 1)
+    | refDefn {fuel env address world body result bodyCost} :
+        ctx.env address = some (.defn world body) →
+        Eval ctx fuel [] body result bodyCost →
+        Eval ctx (fuel + 1) env (.ref address) result
+          (bodyCost + tick .evalRefDefn)
+    | refCtor {fuel env address tag arity result saturateCost} :
+        ctx.env address = some (.ctor tag arity) →
+        Saturate ctx fuel (.ctor address tag arity) [] result saturateCost →
+        Eval ctx (fuel + 1) env (.ref address) result
+          (saturateCost + tick .evalRefCtor)
+    | refRecursor {fuel env address numArgs natLit rules} :
+        ctx.env address = some (.recursor numArgs natLit rules) →
+        Eval ctx (fuel + 1) env (.ref address)
+          (.pap (.rec_ address (numArgs + 1)) []) (tick .evalRefRecursor)
+    | refExtern {fuel env address arity result saturateCost} :
+        ctx.env address = some (.extern arity) →
+        Saturate ctx fuel (.ext address arity) [] result saturateCost →
+        Eval ctx (fuel + 1) env (.ref address) result
+          (saturateCost + tick .evalRefExtern)
+
+  /-- One dynamically entered source application. -/
+  inductive Apply (ctx : Ctx) :
+      Nat → Value → Value → Value → Profile → Prop where
+    | clos {fuel uses env body argument result bodyCost} :
+        Eval ctx fuel (argument :: env) body result bodyCost →
+        Apply ctx (fuel + 1) (.clos uses env body) argument result
+          (bodyCost + tick .applyClosure + retain env.length)
+    | pap {fuel head captured argument result saturateCost} :
+        Saturate ctx fuel head (captured ++ [argument]) result
+          saturateCost →
+        Apply ctx (fuel + 1) (.pap head captured) argument result
+          (saturateCost + tick .applyPap + retain captured.length)
+    | erased {fuel argument} :
+        Apply ctx (fuel + 1) .erased argument .erased (tick .applyErased)
+
+  /-- One source saturation decision. -/
+  inductive Saturate (ctx : Ctx) :
+      Nat → Head → List Value → Value → Profile → Prop where
+    | pending {fuel head args} :
+        args.length ≠ head.arity →
+        Saturate ctx (fuel + 1) head args (.pap head args)
+          (tick .saturatePending)
+    | full {fuel head args result fireCost} :
+        args.length = head.arity →
+        Fire ctx fuel head args result fireCost →
+        Saturate ctx (fuel + 1) head args result
+          (fireCost + tick .saturateFull)
+
+  /-- A fired constructor, extern, or recursor head.  The recursor case
+  includes the complete profile of the selected rule body. -/
+  inductive Fire (ctx : Ctx) :
+      Nat → Head → List Value → Value → Profile → Prop where
+    | ctor {fuel address tag arity args} :
+        Fire ctx (fuel + 1) (.ctor address tag arity) args
+          (.ctor address tag args) (tick .fireConstructor)
+    | extern {fuel address arity args result} :
+        ctx.oracle address args = some result →
+        Fire ctx (fuel + 1) (.ext address arity) args result
+          (tick .fireExtern)
+    | recursor {fuel address arity numArgs natLit rules args major tag fields
+        rule result bodyCost} :
+        ctx.env address = some (.recursor numArgs natLit rules) →
+        args.getLast? = some major →
+        majorCtor natLit major = .ok (tag, fields) →
+        rules[tag]? = some rule →
+        fields.length = rule.fields →
+        Eval ctx fuel
+          (fields.reverse ++ args.dropLast.reverse ++
+            [.pap (.rec_ address arity) []])
+          rule.rhs result bodyCost →
+        Fire ctx (fuel + 1) (.rec_ address arity) args result
+          (bodyCost + tick .fireRecursor + retain fields.length)
+
+end
+
+mutual
+
+  /-- Every existing call-aware expression trace admits an additive dynamic
+  profile. -/
+  theorem Eval.ofTrace {ctx : Ctx} {fuel : Nat} {env : List Value}
+      {expr : Expr} {value : Value}
+      (htrace : ProjectionSafe.Eval ctx fuel env expr value) :
+      ∃ profile, Eval ctx fuel env expr value profile := by
+    cases htrace with
+    | var hlookup => exact ⟨tick .evalVar + retain 1, .var hlookup⟩
+    | lit => exact ⟨tick .evalLit, .lit⟩
+    | erased => exact ⟨tick .evalErased, .erased⟩
+    | lam => exact ⟨tick .evalLam + retain _, .lam⟩
+    | letE hvalue hbody =>
+        obtain ⟨valueCost, hvalueCost⟩ := Eval.ofTrace hvalue
+        obtain ⟨bodyCost, hbodyCost⟩ := Eval.ofTrace hbody
+        exact ⟨valueCost + bodyCost + tick .evalLet,
+          .letE hvalueCost hbodyCost⟩
+    | app hfunction hargument happly =>
+        obtain ⟨functionCost, hfunctionCost⟩ := Eval.ofTrace hfunction
+        obtain ⟨argumentCost, hargumentCost⟩ := Eval.ofTrace hargument
+        obtain ⟨applyCost, happlyCost⟩ := Apply.ofTrace happly
+        exact ⟨functionCost + argumentCost + applyCost + tick .evalApp,
+          .app hfunctionCost hargumentCost happlyCost⟩
+    | proj hsource hfield =>
+        obtain ⟨sourceCost, hsourceCost⟩ := Eval.ofTrace hsource
+        exact ⟨sourceCost + tick .evalProj + retain 1,
+          .proj hsourceCost hfield⟩
+    | refDefn hdecl hbody =>
+        obtain ⟨bodyCost, hbodyCost⟩ := Eval.ofTrace hbody
+        exact ⟨bodyCost + tick .evalRefDefn, .refDefn hdecl hbodyCost⟩
+    | refCtor hdecl hsaturate =>
+        obtain ⟨saturateCost, hsaturateCost⟩ :=
+          Saturate.ofTrace hsaturate
+        exact ⟨saturateCost + tick .evalRefCtor,
+          .refCtor hdecl hsaturateCost⟩
+    | refRecursor hdecl =>
+        exact ⟨tick .evalRefRecursor, .refRecursor hdecl⟩
+    | refExtern hdecl hsaturate =>
+        obtain ⟨saturateCost, hsaturateCost⟩ :=
+          Saturate.ofTrace hsaturate
+        exact ⟨saturateCost + tick .evalRefExtern,
+          .refExtern hdecl hsaturateCost⟩
+
+  theorem Apply.ofTrace {ctx : Ctx} {fuel : Nat}
+      {function argument result : Value}
+      (htrace : ProjectionSafe.Apply ctx fuel function argument result) :
+      ∃ profile, Apply ctx fuel function argument result profile := by
+    cases htrace with
+    | clos hbody =>
+        obtain ⟨bodyCost, hbodyCost⟩ := Eval.ofTrace hbody
+        exact ⟨bodyCost + tick .applyClosure + retain _, .clos hbodyCost⟩
+    | pap hsaturate =>
+        obtain ⟨saturateCost, hsaturateCost⟩ :=
+          Saturate.ofTrace hsaturate
+        exact ⟨saturateCost + tick .applyPap + retain _,
+          .pap hsaturateCost⟩
+    | erased => exact ⟨tick .applyErased, .erased⟩
+
+  theorem Saturate.ofTrace {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value}
+      (htrace : ProjectionSafe.Saturate ctx fuel head args result) :
+      ∃ profile, Saturate ctx fuel head args result profile := by
+    cases htrace with
+    | pending hlength =>
+        exact ⟨tick .saturatePending, .pending hlength⟩
+    | full hlength hfire =>
+        obtain ⟨fireCost, hfireCost⟩ := Fire.ofTrace hfire
+        exact ⟨fireCost + tick .saturateFull, .full hlength hfireCost⟩
+
+  theorem Fire.ofTrace {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value}
+      (htrace : ProjectionSafe.Fire ctx fuel head args result) :
+      ∃ profile, Fire ctx fuel head args result profile := by
+    cases htrace with
+    | ctor => exact ⟨tick .fireConstructor, .ctor⟩
+    | extern horacle => exact ⟨tick .fireExtern, .extern horacle⟩
+    | recursor hdecl hlast hmajor hrule hfields hbody =>
+        obtain ⟨bodyCost, hbodyCost⟩ := Eval.ofTrace hbody
+        exact ⟨bodyCost + tick .fireRecursor + retain _,
+          .recursor hdecl hlast hmajor hrule hfields hbodyCost⟩
+
+end
+
+/-! ## Forgetting and constructing profiles -/
+
+mutual
+
+  /-- Forget the cost annotation and recover the existing call-aware trace. -/
+  theorem Eval.toTrace {ctx : Ctx} {fuel : Nat} {env : List Value}
+      {expr : Expr} {value : Value} {profile : Profile}
+      (hcost : Eval ctx fuel env expr value profile) :
+      ProjectionSafe.Eval ctx fuel env expr value := by
+    cases hcost with
+    | var hlookup => exact .var hlookup
+    | lit => exact .lit
+    | erased => exact .erased
+    | lam => exact .lam
+    | letE hvalue hbody => exact .letE hvalue.toTrace hbody.toTrace
+    | app hfunction hargument happly =>
+        exact .app hfunction.toTrace hargument.toTrace happly.toTrace
+    | proj hsource hfield => exact .proj hsource.toTrace hfield
+    | refDefn hdecl hbody => exact .refDefn hdecl hbody.toTrace
+    | refCtor hdecl hsaturate => exact .refCtor hdecl hsaturate.toTrace
+    | refRecursor hdecl => exact .refRecursor hdecl
+    | refExtern hdecl hsaturate => exact .refExtern hdecl hsaturate.toTrace
+
+  theorem Apply.toTrace {ctx : Ctx} {fuel : Nat}
+      {function argument result : Value} {profile : Profile}
+      (hcost : Apply ctx fuel function argument result profile) :
+      ProjectionSafe.Apply ctx fuel function argument result := by
+    cases hcost with
+    | clos hbody => exact .clos hbody.toTrace
+    | pap hsaturate => exact .pap hsaturate.toTrace
+    | erased => exact .erased
+
+  theorem Saturate.toTrace {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value} {profile : Profile}
+      (hcost : Saturate ctx fuel head args result profile) :
+      ProjectionSafe.Saturate ctx fuel head args result := by
+    cases hcost with
+    | pending hlength => exact .pending hlength
+    | full hlength hfire => exact .full hlength hfire.toTrace
+
+  theorem Fire.toTrace {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value} {profile : Profile}
+      (hcost : Fire ctx fuel head args result profile) :
+      ProjectionSafe.Fire ctx fuel head args result := by
+    cases hcost with
+    | ctor => exact .ctor
+    | extern horacle => exact .extern horacle
+    | recursor hdecl hlast hmajor hrule hfields hbody =>
+        exact .recursor hdecl hlast hmajor hrule hfields hbody.toTrace
+
+end
+
+
+theorem Eval.run {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {expr : Expr} {value : Value} {profile : Profile}
+    (hcost : Eval ctx fuel env expr value profile) :
+    eval ctx fuel env expr = .ok value :=
+  hcost.toTrace.run
+
+theorem Apply.run {ctx : Ctx} {fuel : Nat}
+    {function argument result : Value} {profile : Profile}
+    (hcost : Apply ctx fuel function argument result profile) :
+    apply ctx fuel function argument = .ok result :=
+  hcost.toTrace.run
+
+theorem Saturate.run {ctx : Ctx} {fuel : Nat} {head : Head}
+    {args : List Value} {result : Value} {profile : Profile}
+    (hcost : Saturate ctx fuel head args result profile) :
+    saturate ctx fuel head args = .ok result :=
+  hcost.toTrace.run
+
+theorem Fire.run {ctx : Ctx} {fuel : Nat} {head : Head}
+    {args : List Value} {result : Value} {profile : Profile}
+    (hcost : Fire ctx fuel head args result profile) :
+    fire ctx fuel head args = .ok result :=
+  hcost.toTrace.run
+
+/-- Every expression execution contributes one `eval` event independently of
+the evaluator fuel used to justify termination. -/
+theorem Eval.evals_pos {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {expr : Expr} {value : Value} {profile : Profile}
+    (hcost : Eval ctx fuel env expr value profile) :
+    0 < profile.evals := by
+  cases hcost <;> simp [tick] <;> omega
+
+/-- Surface evaluator sites in an expression.  Lambda bodies and referenced
+declarations are counted when they are dynamically entered, rather than at
+the site that merely creates or names them. -/
+def surfaceEvals : Expr → Nat
+  | .var _ | .ref _ | .lit _ | .erased | .lam _ _ => 1
+  | .letE _ value body => surfaceEvals value + surfaceEvals body + 1
+  | .app function argument =>
+      surfaceEvals function + surfaceEvals argument + 1
+  | .proj _ source => surfaceEvals source + 1
+
+/-- A dynamic trace contains at least the surface evaluation sites of the
+expression it enters.  Called closure and recursor bodies can only add to
+this lower bound. -/
+theorem Eval.surfaceEvals_le {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {expr : Expr} {value : Value} {profile : Profile}
+    (hcost : Eval ctx fuel env expr value profile) :
+    surfaceEvals expr ≤ profile.evals := by
+  induction expr generalizing fuel env value profile with
+  | var index =>
+      cases hcost
+      simp [surfaceEvals, tick, retain]
+  | ref address =>
+      cases hcost <;> simp [surfaceEvals, tick]
+  | app function argument ihFunction ihArgument =>
+      cases hcost with
+      | app hfunction hargument happly =>
+          have hfunctionBound := ihFunction hfunction
+          have hargumentBound := ihArgument hargument
+          simp [surfaceEvals, tick] at *
+          omega
+  | lam uses body =>
+      cases hcost
+      simp [surfaceEvals, tick, retain]
+  | letE uses bound body ihBound ihBody =>
+      cases hcost with
+      | letE hbound hbody =>
+          have hboundBound := ihBound hbound
+          have hbodyBound := ihBody hbody
+          simp [surfaceEvals, tick] at *
+          omega
+  | proj index source ihSource =>
+      cases hcost with
+      | proj hsource hfield =>
+          have hsourceBound := ihSource hsource
+          simp [surfaceEvals, tick, retain] at *
+          omega
+  | lit literal =>
+      cases hcost
+      simp [surfaceEvals, tick]
+  | erased =>
+      cases hcost
+      simp [surfaceEvals, tick]
+
+/-- A closed source expression has `profile` when some exact call-aware
+successful trace has that annotation.  Fuel is existential and remains
+separate from the profile. -/
+def Profiled (ctx : Ctx) (expr : Expr) (value : Value)
+    (profile : Profile) : Prop :=
+  ∃ fuel, Eval ctx fuel [] expr value profile
+
+theorem Profiled.run {ctx : Ctx} {expr : Expr} {value : Value}
+    {profile : Profile} (hprofile : Profiled ctx expr value profile) :
+    ∃ fuel, eval ctx fuel [] expr = .ok value := by
+  obtain ⟨fuel, hcost⟩ := hprofile
+  exact ⟨fuel, hcost.run⟩
+
+theorem Profiled.evals_pos {ctx : Ctx} {expr : Expr} {value : Value}
+    {profile : Profile} (hprofile : Profiled ctx expr value profile) :
+    0 < profile.evals := by
+  obtain ⟨_, hcost⟩ := hprofile
+  exact hcost.evals_pos
+
+theorem Profiled.ofTrace {ctx : Ctx} {fuel : Nat} {expr : Expr}
+    {value : Value}
+    (htrace : ProjectionSafe.Eval ctx fuel [] expr value) :
+    ∃ profile, Profiled ctx expr value profile := by
+  obtain ⟨profile, hcost⟩ := Eval.ofTrace htrace
+  exact ⟨profile, fuel, hcost⟩
+
+/-! ## Additive application spines -/
+
+/-- A dynamically executed curried application spine.  Each entered body is
+represented by its `Apply` profile, and the spine profile is their sum. -/
+inductive Applies (ctx : Ctx) :
+    Value → List Value → Value → Profile → Prop where
+  | nil {value : Value} : Applies ctx value [] value 0
+  | cons {fuel : Nat} {function argument middle result : Value}
+      {arguments : List Value} {stepCost restCost : Profile} :
+      Apply ctx fuel function argument middle stepCost →
+      Applies ctx middle arguments result restCost →
+      Applies ctx function (argument :: arguments) result
+        (stepCost + restCost)
+
+/-- Dependent state-threaded traversal of a dynamically costed application
+spine. Clients receive the exact head application profile, the original
+profiled tail derivation, and the recursively produced result while the
+initial value, remaining arguments, final value, and additive profile stay
+synchronized. -/
+theorem Applies.traverse
+    {ctx : Ctx}
+    {Result : Value → List Value → Value → Profile → Prop}
+    (hnil : ∀ value, Result value [] value 0)
+    (hcons : ∀ {fuel : Nat} {function argument middle result : Value}
+        {arguments : List Value} {stepCost restCost : Profile},
+      Apply ctx fuel function argument middle stepCost →
+      Applies ctx middle arguments result restCost →
+      Result middle arguments result restCost →
+      Result function (argument :: arguments) result
+        (stepCost + restCost))
+    {function result : Value} {arguments : List Value} {cost : Profile}
+    (happly : Applies ctx function arguments result cost) :
+    Result function arguments result cost := by
+  induction happly with
+  | nil => exact hnil _
+  | cons hstep htail ih => exact hcons hstep htail ih
+
+/-- Application-spine concatenation is profile addition. -/
+theorem Applies.append {ctx : Ctx}
+    {function middle result : Value} {left right : List Value}
+    {leftCost rightCost : Profile}
+    (hleft : Applies ctx function left middle leftCost)
+    (hright : Applies ctx middle right result rightCost) :
+    Applies ctx function (left ++ right) result (leftCost + rightCost) := by
+  exact (Applies.traverse
+    (Result := fun currentFunction currentArguments currentMiddle currentCost =>
+      ∀ {currentResult : Value} {rightArguments : List Value}
+          {rightCost : Profile},
+        Applies ctx currentMiddle rightArguments currentResult rightCost →
+        Applies ctx currentFunction (currentArguments ++ rightArguments)
+          currentResult (currentCost + rightCost))
+    (hnil := by
+      intro value currentResult rightArguments currentCost hright
+      simpa [Profile.zero_add] using hright)
+    (hcons := by
+      intro fuel currentFunction argument currentMiddle currentResult
+        currentArguments stepCost restCost hstep htail ih finalResult
+        rightArguments rightCost hright
+      simpa only [List.cons_append, Profile.add_assoc] using
+        Applies.cons hstep (ih hright))
+    hleft) hright
+
+/-- One final application contributes exactly its own profile. -/
+theorem Applies.snoc {ctx : Ctx}
+    {function middle result argument : Value} {arguments : List Value}
+    {spineCost stepCost : Profile} {fuel : Nat}
+    (hspine : Applies ctx function arguments middle spineCost)
+    (hstep : Apply ctx fuel middle argument result stepCost) :
+    Applies ctx function (arguments ++ [argument]) result
+      (spineCost + stepCost) := by
+  apply hspine.append
+  simpa [Profile.add_zero] using (Applies.cons hstep Applies.nil)
+
+/-- Every bounded call-aware application trace receives an additive profile;
+the fuel bound remains only the termination measure. -/
+theorem Applies.ofTrace {ctx : Ctx} {limit : Nat}
+    {function result : Value} {arguments : List Value}
+    (htrace : ProjectionSafe.AppliesBelow ctx limit function arguments
+      result) :
+    ∃ profile, Applies ctx function arguments result profile := by
+  exact ProjectionSafe.AppliesBelow.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      ∃ profile,
+        Applies ctx currentFunction currentArguments currentResult profile)
+    (hnil := fun _ => ⟨0, .nil⟩)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hfuel hstep htail ih
+      obtain ⟨stepCost, hstepCost⟩ := Apply.ofTrace hstep
+      obtain ⟨restCost, hrestCost⟩ := ih
+      exact ⟨stepCost + restCost, .cons hstepCost hrestCost⟩)
+    htrace
+
+end Ix.Compiler.IxIR0.DynamicCost
diff --git a/Ix/Compiler/IxIR0/Eval.lean b/Ix/Compiler/IxIR0/Eval.lean
new file mode 100644
index 000000000..9fd2d9d50
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Eval.lean
@@ -0,0 +1,197 @@
+import Ix.Compiler.IxIR0.Basic
+
+/-!
+# IxIR₀ functional big-step interpreter
+
+`eval` is the definitional semantics of IxIR₀ — the anchor every
+backend pass is proved against. Fuel is a pure totality device,
+uniformly decremented at the entry of each of the four mutual
+functions (`eval`/`apply`/`saturate`/`fire`), which makes termination
+trivial and keeps the induction uniform. It is NOT a cost model —
+cost lands at IxIR₁. "`e` terminates with `v`" is
+`∃ fuel, eval ctx fuel ρ e = .ok v`; fuel-monotonicity is the first
+lemma of the erasure-simulation work.
+
+Error taxonomy: `Err.fuel` is the only non-answer (more fuel may
+succeed). `Err.stuck` is unreachable on well-typed, well-usaged
+inputs — a future theorem. `Err.oracleMissing` marks the
+trusted-extern boundary (the `docs/compiler/trusted-extern-ledger.md` ledger).
+`Err.unknownRef` is a hole in the closed world; the Merkle-DAG env of
+a real program is total over its reachable addresses by construction.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Uses Address)
+
+/-- A global awaiting saturation: values of the form
+`pap head [a₁, …, aₖ]` with `k < head.arity`. Carries the arity so
+application never re-consults the environment; recursor rules are
+looked up only at ι-time. -/
+inductive Head where
+  | ctor (adr : Address) (tag arity : Nat)
+  | rec_ (adr : Address) (arity : Nat)
+  | ext (adr : Address) (arity : Nat)
+  deriving BEq, Repr
+
+def Head.arity : Head → Nat
+  | .ctor _ _ a | .rec_ _ a | .ext _ a => a
+
+/-- Values. Constructor values hold **kept fields only** (never
+params); `args` lists are in application order. The `adr` on `ctor`
+distinguishes same-tag constructors of different inductives in output
+and in the future differential harness — ι matches on `tag` alone. -/
+inductive Value where
+  | clos (uses : Uses) (env : List Value) (body : Expr)
+  | pap (head : Head) (args : List Value)
+  | ctor (adr : Address) (tag : Nat) (args : List Value)
+  | lit (l : Literal)
+  | erased
+
+inductive Err where
+  | fuel
+  | stuck (msg : String)
+  | oracleMissing (adr : Address)
+  | unknownRef (adr : Address)
+  deriving BEq, Repr
+
+/-- The extern semantics: pure, partial, keyed by address. Each ledger
+entry axiomatizes one address's behavior. IO arrives later as
+state-token threading through this same interface. -/
+abbrev Oracle := Address → List Value → Option Value
+
+structure Ctx where
+  env : Env
+  oracle : Oracle := fun _ _ => none
+
+/-- View the major premise as a constructor application, peeling Nat
+literals when the recursor allows it. -/
+def majorCtor (natLit : Bool) : Value → Except Err (Nat × List Value)
+  | .ctor _ tag args => .ok (tag, args)
+  | .lit (.nat n) =>
+    if natLit then
+      match n with
+      | 0 => .ok (0, [])
+      | n + 1 => .ok (1, [.lit (.nat n)])
+    else .error (.stuck "literal major premise (natLit disabled)")
+  | _ => .error (.stuck "recursor major premise is not a constructor")
+
+mutual
+
+/-- Evaluate `e` under environment `ρ` (de Bruijn: `var i = ρ[i]`,
+binding conses). -/
+def eval (ctx : Ctx) (fuel : Nat) (ρ : List Value) (e : Expr) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match e with
+    | .var i =>
+      match ρ[i]? with
+      | some v => .ok v
+      | none => .error (.stuck s!"unbound de Bruijn index {i}")
+    | .lit l => .ok (.lit l)
+    | .erased => .ok .erased
+    | .lam u body => .ok (.clos u ρ body)
+    | .letE _ val body => do
+      let v ← eval ctx fuel ρ val
+      eval ctx fuel (v :: ρ) body
+    | .app fn arg => do
+      let f ← eval ctx fuel ρ fn
+      let a ← eval ctx fuel ρ arg
+      apply ctx fuel f a
+    | .proj i s => do
+      match ← eval ctx fuel ρ s with
+      | .ctor _ _ args =>
+        match args[i]? with
+        | some v => .ok v
+        | none => .error (.stuck s!"projection {i} out of bounds")
+      | .erased => .ok .erased
+      | _ => .error (.stuck "projection from a non-constructor value")
+    | .ref a =>
+      match ctx.env a with
+      | none => .error (.unknownRef a)
+      | some (.defn _ body) => eval ctx fuel [] body
+      | some (.ctor tag arity) => saturate ctx fuel (.ctor a tag arity) []
+      | some (.recursor numArgs _ _) => .ok (.pap (.rec_ a (numArgs + 1)) [])
+      | some (.extern arity) => saturate ctx fuel (.ext a arity) []
+  termination_by fuel
+
+def apply (ctx : Ctx) (fuel : Nat) (f a : Value) : Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match f with
+    | .clos _ ρ body => eval ctx fuel (a :: ρ) body
+    | .pap h args => saturate ctx fuel h (args ++ [a])
+    | .erased => .ok .erased
+    | _ => .error (.stuck "application of a non-function value")
+  termination_by fuel
+
+/-- Fire a head at arity, else fold into a partial application.
+Called with fresh heads (arity-0 ctors/externs fire at `ref`-time)
+and after every argument. -/
+def saturate (ctx : Ctx) (fuel : Nat) (h : Head) (args : List Value) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    if args.length == h.arity then fire ctx fuel h args
+    else .ok (.pap h args)
+  termination_by fuel
+
+def fire (ctx : Ctx) (fuel : Nat) (h : Head) (args : List Value) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match h with
+    | .ctor a tag _ => .ok (.ctor a tag args)
+    | .ext a _ =>
+      match ctx.oracle a args with
+      | some v => .ok v
+      | none => .error (.oracleMissing a)
+    | .rec_ a arity =>
+      match ctx.env a with
+      | some (.recursor _ natLit rules) =>
+        match args.getLast? with
+        | none => .error (.stuck "recursor fired with no arguments")
+        | some major => do
+          let (tag, fields) ← majorCtor natLit major
+          match rules[tag]? with
+          | none => .error (.stuck s!"no recursor rule for constructor tag {tag}")
+          | some rule =>
+            if fields.length != rule.fields then
+              .error (.stuck "constructor field count does not match recursor rule")
+            else
+              eval ctx fuel
+                (fields.reverse ++ args.dropLast.reverse
+                  ++ [.pap (.rec_ a arity) []])
+                rule.rhs
+      | _ => .error (.stuck "recursor head does not resolve to a recursor declaration")
+  termination_by fuel
+
+end
+
+/-- Evaluate a closed expression. -/
+def Ctx.run (ctx : Ctx) (e : Expr) (fuel : Nat := 100000) :
+    Except Err Value :=
+  eval ctx fuel [] e
+
+/-! Elaboration-time smoke tests (pure — no FFI, so `#guard` is fine
+here; contrast `Tests.lean`). The full example suite lives in
+`Examples.lean`. -/
+
+private def emptyCtx : Ctx := { env := Env.empty }
+
+#guard
+  match emptyCtx.run (.app (.lam .many (.var 0)) (.lit (.nat 7))) with
+  | .ok (.lit (.nat 7)) => true
+  | _ => false
+
+#guard
+  match emptyCtx.run (.app .erased (.lit (.nat 1))) with
+  | .ok .erased => true
+  | _ => false
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/Examples.lean b/Ix/Compiler/IxIR0/Examples.lean
new file mode 100644
index 000000000..b9013d567
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Examples.lean
@@ -0,0 +1,282 @@
+import Ix.Compiler.IxIR0.Eval
+
+/-!
+# Hand-written IxIR₀ environments
+
+The test corpus until real inputs arrive. The standalone ix-importer
+is **skipped** (JCB 2026-08-12): Ixon v2 merges into ix directly when
+we're ready for real corpora; until then these hand-written
+environments — built exactly as the erasure contract in `Basic.lean`
+prescribes — exercise the semantics. Everything here is pure (no
+FFI), so the tests are elaboration-time `#guard`s and run on every
+build.
+
+The encodings mirror what erasure produces from the kernel
+declarations: `Nat.rec`/`List.rec` with motives dropped and minors
+kept (`numArgs = 2`), constructors carrying kept fields only
+(`List.cons` has arity 2 — the `α` param is gone), and rule
+right-hand sides in the `RecRule` environment convention.
+-/
+
+namespace Ix.Compiler.IxIR0.Examples
+
+open Ix.Compiler.Ixon (Uses Address)
+
+private def addrOf (n : UInt8) : Address :=
+  Address.replicate n
+
+/-! ## Addresses (arbitrary — content addressing of IxIR₀ comes later) -/
+
+def natZero := addrOf 0x10
+def natSucc := addrOf 0x11
+def natRec := addrOf 0x12
+def natAddDef := addrOf 0x13
+def listNil := addrOf 0x20
+def listCons := addrOf 0x21
+def listRec := addrOf 0x22
+def appendDef := addrOf 0x23
+def lengthDef := addrOf 0x24
+def pairMk := addrOf 0x30
+def natAddExt := addrOf 0x40
+def dropFstDef := addrOf 0x50
+def dropSndDef := addrOf 0x51
+
+/-! ## Nat: zero/succ constructors, `Nat.rec`, addition -/
+
+/-- Zero rule. Rule env is `[s, z, rec]`: no fields, pre-major args
+`[z, s]` reversed, recursor deepest. `⊢ z`. -/
+private def natRecZero : RecRule := { fields := 0, rhs := .var 1 }
+
+/-- Succ rule. Rule env is `[n, s, z, rec]`. `⊢ s n (rec z s n)` —
+the kernel rule with the motive dropped and `Nat.rec` mapped to the
+deepest variable. -/
+private def natRecSucc : RecRule where
+  fields := 1
+  rhs := .app (.app (.var 1) (.var 0))
+    (.app (.app (.app (.var 3) (.var 2)) (.var 1)) (.var 0))
+
+/-- `fun m n => Nat.rec (z := m) (s := fun _ ih => succ ih) n` -/
+private def addBody : Expr :=
+  .lam .many (.lam .many
+    (.app
+      (.app (.app (.ref natRec) (.var 1))
+        (.lam .many (.lam .many (.app (.ref natSucc) (.var 0)))))
+      (.var 0)))
+
+/-! ## List: nil/cons, `List.rec`, append, length -/
+
+/-- Nil rule. Rule env `[c, n, rec]`. `⊢ n`. -/
+private def listRecNil : RecRule := { fields := 0, rhs := .var 1 }
+
+/-- Cons rule. Rule env `[t, h, c, n, rec]` (fields `[h, t]`
+reversed first). `⊢ c h t (rec n c t)`. -/
+private def listRecCons : RecRule where
+  fields := 2
+  rhs := .app
+    (.app (.app (.var 2) (.var 1)) (.var 0))
+    (.app (.app (.app (.var 4) (.var 3)) (.var 2)) (.var 0))
+
+/-- `fun xs ys => List.rec (n := ys) (c := fun h _ ih => cons h ih) xs` -/
+private def appendBody : Expr :=
+  .lam .many (.lam .many
+    (.app
+      (.app (.app (.ref listRec) (.var 0))
+        (.lam .many (.lam .many (.lam .many
+          (.app (.app (.ref listCons) (.var 2)) (.var 0))))))
+      (.var 1)))
+
+/-- `fun xs => List.rec (n := zero) (c := fun _ _ ih => succ ih) xs` -/
+private def lengthBody : Expr :=
+  .lam .many
+    (.app
+      (.app (.app (.ref listRec) (.ref natZero))
+        (.lam .many (.lam .many (.lam .many
+          (.app (.ref natSucc) (.var 0))))))
+      (.var 0))
+
+/-! ## Mixed-mode telescopes: affine and many binders in both orders.
+Modes are inert in this IR's semantics; the IxIR₁ lowering reads its
+per-parameter worlds off them, so the corpus must not be uniformly
+`many` (a reversed mode telescope is invisible on uniform modes). -/
+
+/-- `fun (x :ᵃ _) (y :ω _) => y` — drops its affine first argument. -/
+private def dropFstBody : Expr := .lam .affine (.lam .many (.var 0))
+
+/-- `fun (x :ω _) (y :ᵃ _) => x` — drops its affine second argument. -/
+private def dropSndBody : Expr := .lam .many (.lam .affine (.var 1))
+
+/-! ## The environment and oracle -/
+
+/-- The declarations as a list — the IxIR₀ → IxIR₁ lowering consumes
+this form (an `Env` function can't be enumerated). -/
+def declList : List (Address × Decl) := [
+  (natZero, .ctor 0 0),
+  (natSucc, .ctor 1 1),
+  (natRec, .recursor 2 true #[natRecZero, natRecSucc]),
+  (natAddDef, .defn .shared addBody),
+  (listNil, .ctor 0 0),
+  (listCons, .ctor 1 2),
+  (listRec, .recursor 2 false #[listRecNil, listRecCons]),
+  (appendDef, .defn .shared appendBody),
+  (lengthDef, .defn .shared lengthBody),
+  (pairMk, .ctor 0 2),
+  (dropFstDef, .defn .shared dropFstBody),
+  (dropSndDef, .defn .shared dropSndBody),
+  (natAddExt, .extern 2)
+]
+
+def env : Env := Env.ofList declList
+
+/-- Demo ledger entry: `natAddExt` is `Nat.add` on literals (the
+GMP-shaped extern), refusing anything else. -/
+def oracle : Oracle := fun a args =>
+  if a == natAddExt then
+    match args with
+    | [.lit (.nat m), .lit (.nat n)] => some (.lit (.nat (m + n)))
+    | _ => none
+  else none
+
+def ctx : Ctx := { env, oracle }
+
+/-! ## Expression and value helpers -/
+
+/-- Church-style numeral over the `Nat` constructors. -/
+def natE : Nat → Expr
+  | 0 => .ref natZero
+  | n + 1 => .app (.ref natSucc) (natE n)
+
+def listE (f : α → Expr) : List α → Expr
+  | [] => .ref listNil
+  | x :: xs => .app (.app (.ref listCons) (f x)) (listE f xs)
+
+/-- Read a `Nat` back out of a value, accepting literal tails so
+`natLit`-peeled results (`succ (succ (lit 3))`) decode too. Fueled
+only to keep the recursion structurally obvious. -/
+private def valNatGo : Nat → Value → Option Nat
+  | 0, _ => none
+  | _, .lit (.nat n) => some n
+  | _, .ctor _ 0 [] => some 0
+  | fuel + 1, .ctor _ 1 [v] => (valNatGo fuel v).map (· + 1)
+  | _, _ => none
+
+def valNat? (v : Value) : Option Nat := valNatGo 1000000 v
+
+private def valNatListGo : Nat → Value → Option (List Nat)
+  | 0, _ => none
+  | _, .ctor _ 0 [] => some []
+  | fuel + 1, .ctor _ 1 [h, t] => do
+    let n ← valNat? h
+    let rest ← valNatListGo fuel t
+    pure (n :: rest)
+  | _, _ => none
+
+def valNatList? (v : Value) : Option (List Nat) := valNatListGo 1000000 v
+
+def run (e : Expr) (fuel : Nat := 100000) : Except Err Value :=
+  eval ctx fuel [] e
+
+def runNat? (e : Expr) : Option Nat :=
+  match run e with
+  | .ok v => valNat? v
+  | .error _ => none
+
+def runNatList? (e : Expr) : Option (List Nat) :=
+  match run e with
+  | .ok v => valNatList? v
+  | .error _ => none
+
+/-! ## β, let, projection -/
+
+#guard runNat? (.app (.lam .many (.var 0)) (natE 4)) == some 4
+#guard runNat? (.letE .many (natE 2) (.app (.ref natSucc) (.var 0))) == some 3
+#guard runNat? (.proj 0 (.app (.app (.ref pairMk) (natE 1)) (natE 2))) == some 1
+#guard runNat? (.proj 1 (.app (.app (.ref pairMk) (natE 1)) (natE 2))) == some 2
+
+-- Under-applied constructors are first-class partial applications.
+#guard
+  match run (.app (.ref pairMk) (natE 1)) with
+  | .ok (.pap _ [_]) => true
+  | _ => false
+
+/-! ## Mixed-mode telescopes evaluate as plain curried functions -/
+
+#guard runNat? (.app (.app (.ref dropFstDef) (natE 1)) (natE 2)) == some 2
+#guard runNat? (.app (.app (.ref dropSndDef) (natE 2)) (natE 1)) == some 2
+
+/-! ## Recursor ι: addition via `Nat.rec`, on constructors and on
+peeled literals -/
+
+#guard runNat? (.app (.app (.ref natAddDef) (natE 2)) (natE 3)) == some 5
+#guard runNat? (.app (.app (.ref natAddDef) (natE 0)) (natE 0)) == some 0
+#guard runNat? (.app (.app (.ref natAddDef) (natE 7)) (natE 0)) == some 7
+#guard runNat? (.app (.app (.ref natAddDef) (.lit (.nat 2))) (.lit (.nat 3)))
+  == some 5
+#guard runNat? (.app (.app (.ref natAddDef) (natE 1)) (.lit (.nat 3)))
+  == some 4
+
+/-! ## `List.rec`: append and length -/
+
+#guard runNatList?
+    (.app (.app (.ref appendDef) (listE natE [1, 2])) (listE natE [3]))
+  == some [1, 2, 3]
+#guard runNatList? (.app (.app (.ref appendDef) (listE natE [])) (listE natE []))
+  == some []
+#guard runNat? (.app (.ref lengthDef) (listE natE [5, 6, 7])) == some 3
+
+/-! ## Externs and the oracle boundary -/
+
+#guard runNat? (.app (.app (.ref natAddExt) (.lit (.nat 20))) (.lit (.nat 22)))
+  == some 42
+
+-- The oracle refuses constructor-form arguments: the ledger entry is
+-- literals-only, and refusal is observable as `oracleMissing`.
+#guard
+  match run (.app (.app (.ref natAddExt) (natE 1)) (.lit (.nat 1))) with
+  | .error (.oracleMissing _) => true
+  | _ => false
+
+/-! ## ◻ absorption -/
+
+#guard
+  match run (.app .erased (natE 1)) with
+  | .ok .erased => true
+  | _ => false
+#guard
+  match run (.proj 0 .erased) with
+  | .ok .erased => true
+  | _ => false
+
+/-! ## Error taxonomy -/
+
+#guard
+  match run (.ref (addrOf 0xFF)) with
+  | .error (.unknownRef _) => true
+  | _ => false
+#guard
+  match run (.app (.lit (.nat 1)) (.lit (.nat 2))) with
+  | .error (.stuck _) => true
+  | _ => false
+#guard
+  match run (.proj 5 (.app (.app (.ref pairMk) (natE 1)) (natE 2))) with
+  | .error (.stuck _) => true
+  | _ => false
+
+/-! ## Fuel: divergence and monotonicity -/
+
+private def delta : Expr := .lam .many (.app (.var 0) (.var 0))
+
+-- Ω runs out of any finite fuel — the untyped IR expresses divergence
+-- even without fixpoints.
+#guard
+  match run (.app delta delta) with
+  | .error .fuel => true
+  | _ => false
+
+-- The same term that succeeds above fails as `.fuel` (not `.stuck`)
+-- when starved: fuel exhaustion is the only non-answer.
+#guard
+  match eval ctx 5 [] (.app (.app (.ref natAddDef) (natE 2)) (natE 3)) with
+  | .error .fuel => true
+  | _ => false
+
+end Ix.Compiler.IxIR0.Examples
diff --git a/Ix/Compiler/IxIR0/MapRecovery.lean b/Ix/Compiler/IxIR0/MapRecovery.lean
new file mode 100644
index 000000000..42e88f7f0
--- /dev/null
+++ b/Ix/Compiler/IxIR0/MapRecovery.lean
@@ -0,0 +1,217 @@
+import Ix.Compiler.IxIR0.Recursion
+
+/-!
+# Checked specialization of a closed source map
+
+The ordinary list recursor receives a nil minor and a step minor that calls a
+constant-valued worker before constructing the result cons. Specialization
+exposes that worker and the recursive call in one rule. Recognition checks
+every declaration and the complete entry; no replacement body is supplied by
+the caller. Constructor and worker identities remain those of the source.
+-/
+
+namespace Ix.Compiler.IxIR0.MapRecovery
+
+open Ix.Compiler.Ixon (Address)
+open Recursion (app2 ghost)
+
+def policyTag : String := "closed-map-specialize/1"
+
+structure Schema where
+  nil : Address
+  cons : Address
+  recursor : Address
+  alias : Address
+  base : Address
+  step : Address
+  worker : Address
+  replacement : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def workerExpr (s : Schema) : Expr := .lam .many (ghost (.lit (.nat s.replacement)))
+def baseExpr (s : Schema) : Expr := ghost (.ref s.nil)
+def stepExpr (s : Schema) : Expr :=
+  .lam .many (.lam .many (.lam .many
+    (app2 (.ref s.cons) (.app (.ref s.worker) (.var 2)) (.var 0))))
+
+def literalRecursor : Decl :=
+  .recursor 2 false #[
+    { fields := 0, rhs := .var 1 },
+    { fields := 2
+      rhs := .app (app2 (.var 2) (.var 1) (.var 0))
+        (.app (app2 (.var 4) (.var 3) (.var 2)) (.var 0)) }]
+
+def directRecursor (s : Schema) : Decl :=
+  .recursor 0 false #[
+    { fields := 0, rhs := .ref s.nil },
+    { fields := 2
+      rhs := app2 (.ref s.cons) (.app (.ref s.worker) (.var 1)) (.app (.var 2) (.var 0)) }]
+
+def listOnto (s : Schema) (literal : Bool) : List Nat → Expr → Expr
+  | [], tail => tail
+  | n :: ns, tail => app2 (.ref s.cons)
+      (if literal then ghost (.lit (.nat n)) else .lit (.nat n)) (listOnto s literal ns tail)
+
+def listExpr (s : Schema) (literal : Bool) (values : List Nat) : Expr :=
+  listOnto s literal values (if literal then ghost (.ref s.nil) else .ref s.nil)
+
+def literalCall (s : Schema) (major : Expr) : Expr :=
+  .app (app2 (.ref s.alias) (.ref s.base) (.ref s.step)) major
+
+structure Plan where
+  schema : Schema
+  values : List Nat
+  retainedAlias : Option Address := none
+  uniquePrefix : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Plan.main (p : Plan) (literal : Bool) (call : Expr → Expr) : Expr :=
+  match p.retainedAlias with
+  | none => call (listExpr p.schema literal p.values)
+  | some pair =>
+      .letE .many (listExpr p.schema literal (p.values.drop p.uniquePrefix))
+        (app2 (.ref pair)
+          (call (listOnto p.schema literal (p.values.take p.uniquePrefix) (.var 0))) (.var 0))
+
+def Plan.literalMain (p : Plan) : Expr := p.main true (literalCall p.schema)
+def Plan.directMain (p : Plan) (address : Address) : Expr := p.main false (.app (.ref address))
+
+structure SourceMatches (env : Env) (s : Schema) : Prop where
+  nil : env s.nil = some (.ctor 0 0)
+  cons : env s.cons = some (.ctor 1 2)
+  recursor : env s.recursor = some literalRecursor
+  alias : env s.alias = some (.defn .shared (.ref s.recursor))
+  base : env s.base = some (.defn .shared (baseExpr s))
+  step : env s.step = some (.defn .shared (stepExpr s))
+  worker : env s.worker = some (.defn .shared (workerExpr s))
+
+instance (env : Env) (s : Schema) : Decidable (SourceMatches env s) :=
+  decidable_of_iff
+    (env s.nil = some (.ctor 0 0) ∧ env s.cons = some (.ctor 1 2) ∧
+      env s.recursor = some literalRecursor ∧
+      env s.alias = some (.defn .shared (.ref s.recursor)) ∧
+      env s.base = some (.defn .shared (baseExpr s)) ∧
+      env s.step = some (.defn .shared (stepExpr s)) ∧
+      env s.worker = some (.defn .shared (workerExpr s)))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2.1, h.2.2.2.2.1, h.2.2.2.2.2.1, h.2.2.2.2.2.2⟩,
+      fun h => ⟨h.nil, h.cons, h.recursor, h.alias, h.base, h.step, h.worker⟩⟩
+
+def Plan.aliasMatches (p : Plan) (env : Env) : Prop :=
+  match p.retainedAlias with | none => True | some pair => env pair = some (.ctor 0 2)
+instance (p : Plan) (env : Env) : Decidable (p.aliasMatches env) := by
+  unfold Plan.aliasMatches
+  split <;> infer_instance
+
+structure Checked (declarations : List (Address × Decl)) (main : Expr) where
+  plan : Plan
+  root : Address
+  mainEq : main = .ref root
+  source : SourceMatches (Env.ofList declarations) plan.schema
+  entry : Env.ofList declarations root = some (.defn .shared plan.literalMain)
+  alias : plan.aliasMatches (Env.ofList declarations)
+
+def check (declarations : List (Address × Decl)) (main : Expr) (plan : Plan) :
+    Option (Checked declarations main) :=
+  match main with
+  | .ref root =>
+      if hs : SourceMatches (Env.ofList declarations) plan.schema then
+        if he : Env.ofList declarations root = some (.defn .shared plan.literalMain) then
+          if ha : plan.aliasMatches (Env.ofList declarations) then
+            some { plan, root, mainEq := rfl, source := hs, entry := he, alias := ha }
+          else none
+        else none
+      else none
+  | _ => none
+
+private def call? : Expr → Option (Address × Address × Address × Expr)
+  | .app (.app (.app (.ref alias) (.ref base)) (.ref step)) major => some (alias, base, step, major)
+  | _ => none
+
+private def listParts? (s : Schema) : Expr → Option (List Nat × Expr)
+  | .app (.app (.ref address) (.app (.lam .many (.lit (.nat n))) .erased)) tail => do
+      if address != s.cons then none else
+        let (ns, endExpr) ← listParts? s tail
+        return (n :: ns, endExpr)
+  | expr => some ([], expr)
+
+def propose (declarations : List (Address × Decl)) (main : Expr) : Option Plan := do
+  let .ref root := main | none
+  let env := Env.ofList declarations
+  let some (.defn .shared body) := env root | none
+  let (call, retainedAlias, suffix) ← match body with
+    | .letE .many suffix (.app (.app (.ref pair) call) (.var 0)) => pure (call, some pair, suffix)
+    | body => pure (body, none, .erased)
+  let (alias, base, step, major) ← call? call
+  let some (.defn .shared (.ref recursor)) := env alias | none
+  let some (.defn .shared (.app (.lam .many (.ref nil)) .erased)) := env base | none
+  let some (.defn .shared (.lam .many (.lam .many (.lam .many
+      (.app (.app (.ref cons) (.app (.ref worker) (.var 2))) (.var 0)))))) := env step | none
+  let some (.defn .shared (.lam .many (.app (.lam .many (.lit (.nat replacement))) .erased))) := env worker | none
+  let schema : Schema := { nil, cons, recursor, alias, base, step, worker, replacement }
+  match retainedAlias with
+  | none =>
+      let (values, endExpr) ← listParts? schema major
+      if endExpr != ghost (.ref nil) then none else return { schema, values }
+  | some pair =>
+      let (heads, .var 0) ← listParts? schema major | none
+      let (tail, endExpr) ← listParts? schema suffix
+      if endExpr != ghost (.ref nil) then none else
+        return { schema, values := heads ++ tail, retainedAlias := some pair, uniquePrefix := heads.length }
+
+def targetDeclarations (p : Plan) (address : Address) : List (Address × Decl) :=
+  [(p.schema.nil, .ctor 0 0), (p.schema.cons, .ctor 1 2),
+    (p.schema.worker, .defn .shared (workerExpr p.schema)), (address, directRecursor p.schema)] ++
+    p.retainedAlias.toList.map (fun pair => (pair, .ctor 0 2))
+
+structure TargetMatches (env : Env) (p : Plan) (address : Address) : Prop where
+  nil : env p.schema.nil = some (.ctor 0 0)
+  cons : env p.schema.cons = some (.ctor 1 2)
+  worker : env p.schema.worker = some (.defn .shared (workerExpr p.schema))
+  recursor : env address = some (directRecursor p.schema)
+  alias : p.aliasMatches env
+instance (env : Env) (p : Plan) (address : Address) : Decidable (TargetMatches env p address) :=
+  decidable_of_iff
+    (env p.schema.nil = some (.ctor 0 0) ∧ env p.schema.cons = some (.ctor 1 2) ∧
+      env p.schema.worker = some (.defn .shared (workerExpr p.schema)) ∧
+      env address = some (directRecursor p.schema) ∧ p.aliasMatches env)
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2.1, h.2.2.2.2⟩,
+      fun h => ⟨h.nil, h.cons, h.worker, h.recursor, h.alias⟩⟩
+
+structure Recovered (declarations : List (Address × Decl)) (main : Expr) where
+  checked : Checked declarations main
+  address : Address
+  addressed : address = (directRecursor checked.plan.schema).address
+  fresh : address ∉ declarations.map (·.1)
+  target : TargetMatches (Env.ofList (targetDeclarations checked.plan address)) checked.plan address
+
+inductive Selection (declarations : List (Address × Decl)) (main : Expr) where
+  | literal (reason : Recursion.Skip)
+  | recovered (result : Recovered declarations main)
+
+def Selection.declarations {declarations : List (Address × Decl)} {main : Expr} :
+    Selection declarations main → List (Address × Decl)
+  | .literal _ => declarations
+  | .recovered result => targetDeclarations result.checked.plan result.address
+def Selection.main {declarations : List (Address × Decl)} {main : Expr} : Selection declarations main → Expr
+  | .literal _ => main
+  | .recovered result => result.checked.plan.directMain result.address
+
+def selectWith (declarations : List (Address × Decl)) (main : Expr) (proposal : Option Plan) :
+    Selection declarations main :=
+  match proposal with
+  | none => .literal .unrecognized
+  | some plan =>
+      match check declarations main plan with
+      | none => .literal .rejectedProposal
+      | some checked =>
+          let address := (directRecursor checked.plan.schema).address
+          if hfresh : address ∉ declarations.map (·.1) then
+            if ht : TargetMatches (Env.ofList (targetDeclarations checked.plan address)) checked.plan address then
+              .recovered { checked, address, addressed := rfl, fresh := hfresh, target := ht }
+            else .literal .rejectedTarget
+          else .literal .addressConflict
+
+def select (declarations : List (Address × Decl)) (main : Expr) : Selection declarations main :=
+  selectWith declarations main (propose declarations main)
+
+end Ix.Compiler.IxIR0.MapRecovery
diff --git a/Ix/Compiler/IxIR0/MapRecoverySim.lean b/Ix/Compiler/IxIR0/MapRecoverySim.lean
new file mode 100644
index 000000000..66f46833f
--- /dev/null
+++ b/Ix/Compiler/IxIR0/MapRecoverySim.lean
@@ -0,0 +1,216 @@
+import Ix.Compiler.IxIR0.MapRecovery
+import Ix.Compiler.IxIR0.RecursionSim
+import Ix.Compiler.IxIR0.ProjectionFree
+
+/-! The actual eager source fold and its direct map both evaluate to the same
+list. Fuel witnesses termination; uniqueness transports any successful source
+run. The checked target also supplies projection-safe trace completeness. -/
+
+namespace Ix.Compiler.IxIR0.MapRecovery
+
+open Ix.Compiler.Ixon (Address)
+open Recursion
+
+def listOntoValue (s : Schema) : List Nat → Value → Value
+  | [], tail => tail
+  | n :: ns, tail => .ctor s.cons 1 [.lit (.nat n), listOntoValue s ns tail]
+def listValue (s : Schema) (ns : List Nat) : Value := listOntoValue s ns (.ctor s.nil 0 [])
+def mappedValue (s : Schema) (ns : List Nat) : Value := listValue s (ns.map (fun _ => s.replacement))
+def baseValue (s : Schema) : Value := .ctor s.nil 0 []
+def stepBody (s : Schema) : Expr := app2 (.ref s.cons) (.app (.ref s.worker) (.var 2)) (.var 0)
+def stepValue (s : Schema) : Value := .clos .many [] (.lam .many (.lam .many (stepBody s)))
+
+theorem workerRun {ctx : Ctx} {s : Schema} {env : List Value} {argument : Expr} {value : Value}
+    (worker : ctx.env s.worker = some (.defn .shared (workerExpr s)))
+    (arg : Evaluates ctx env argument value) :
+    Evaluates ctx env (.app (.ref s.worker) argument) (.lit (.nat s.replacement)) :=
+  evaluatesApp (evaluatesDef worker (evaluatesLam ..)) arg
+    (appliesClosure (evaluatesGhost (evaluatesLit ..)))
+
+theorem stepRun {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (head tail mapped : Value) :
+    Applies ctx (.clos .many [tail, head] (stepBody s)) mapped
+      (.ctor s.cons 1 [.lit (.nat s.replacement), mapped]) := by
+  apply appliesClosure
+  exact evaluatesCtor2 hs.cons (workerRun hs.worker (evaluatesVar (by rfl)))
+    (evaluatesVar (by rfl))
+
+theorem sourceMap {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s) (ns : List Nat) :
+    Applies ctx (.pap (.rec_ s.recursor 3) [baseValue s, stepValue s])
+      (listValue s ns) (mappedValue s ns) := by
+  induction ns with
+  | nil =>
+      apply appliesRecursor hs.recursor (by rfl) (by rfl) (by rfl)
+      exact evaluatesVar (by rfl)
+  | cons n ns ih =>
+      apply appliesRecursor hs.recursor (by rfl) (by rfl) (by rfl)
+      have recursive : Evaluates ctx
+          [listValue s ns, .lit (.nat n), stepValue s, baseValue s, .pap (.rec_ s.recursor 3) []]
+          (.app (app2 (.var 4) (.var 3) (.var 2)) (.var 0)) (mappedValue s ns) := evaluatesApp
+        (evaluatesApp
+          (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl))
+            (appliesTernaryFirst ctx s.recursor (baseValue s)))
+          (evaluatesVar (by rfl)) (appliesTernaryNext ctx s.recursor (baseValue s) (stepValue s)))
+        (evaluatesVar (by rfl)) ih
+      have first : Applies ctx (stepValue s) (.lit (.nat n))
+          (.clos .many [.lit (.nat n)] (.lam .many (stepBody s))) :=
+        appliesClosure (evaluatesLam ..)
+      have second : Applies ctx (.clos .many [.lit (.nat n)] (.lam .many (stepBody s)))
+          (listValue s ns) (.clos .many [listValue s ns, .lit (.nat n)] (stepBody s)) :=
+        appliesClosure (evaluatesLam ..)
+      exact evaluatesApp
+        (evaluatesApp (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl)) first)
+          (evaluatesVar (by rfl)) second)
+        recursive (stepRun hs _ _ _)
+
+theorem targetMap {ctx : Ctx} {p : Plan} {address : Address}
+    (hs : TargetMatches ctx.env p address) (ns : List Nat) :
+    Applies ctx (.pap (.rec_ address 1) []) (listValue p.schema ns) (mappedValue p.schema ns) := by
+  induction ns with
+  | nil =>
+      apply appliesRecursor hs.recursor (by rfl) (by rfl) (by rfl)
+      exact evaluatesNullary hs.nil
+  | cons n ns ih =>
+      apply appliesRecursor hs.recursor (by rfl) (by rfl) (by rfl)
+      exact evaluatesCtor2 hs.cons (workerRun hs.worker (evaluatesVar (by rfl)))
+        (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl)) ih)
+
+theorem literalCallRun {ctx : Ctx} {s : Schema} {env : List Value} {major : Expr} {ns : List Nat}
+    (hs : SourceMatches ctx.env s) (majorRun : Evaluates ctx env major (listValue s ns)) :
+    Evaluates ctx env (literalCall s major) (mappedValue s ns) :=
+  evaluatesApp
+    (evaluatesApp
+      (evaluatesApp (evaluatesDef hs.alias (evaluatesRecursor hs.recursor))
+        (evaluatesDef hs.base (evaluatesGhost (evaluatesNullary hs.nil)))
+        (appliesTernaryFirst ctx s.recursor (baseValue s)))
+      (evaluatesDef hs.step (evaluatesLam ..))
+      (appliesTernaryNext ctx s.recursor (baseValue s) (stepValue s))) majorRun (sourceMap hs ns)
+
+theorem directCallRun {ctx : Ctx} {p : Plan} {address : Address} {env : List Value}
+    {major : Expr} {ns : List Nat} (hs : TargetMatches ctx.env p address)
+    (majorRun : Evaluates ctx env major (listValue p.schema ns)) :
+    Evaluates ctx env (.app (.ref address) major) (mappedValue p.schema ns) :=
+  evaluatesApp (evaluatesRecursor hs.recursor) majorRun (targetMap hs ns)
+
+theorem listOntoRun {ctx : Ctx} {s : Schema} {env : List Value} {tail : Expr} {value : Value}
+    (cons : ctx.env s.cons = some (.ctor 1 2)) (literal : Bool) (ns : List Nat)
+    (tailRun : Evaluates ctx env tail value) :
+    Evaluates ctx env (listOnto s literal ns tail) (listOntoValue s ns value) := by
+  induction ns with
+  | nil => exact tailRun
+  | cons n ns ih =>
+      apply evaluatesCtor2 cons
+      · cases literal with
+        | false => exact evaluatesLit ..
+        | true => exact evaluatesGhost (evaluatesLit ..)
+      · exact ih
+
+theorem listRun {ctx : Ctx} {s : Schema} (nil : ctx.env s.nil = some (.ctor 0 0))
+    (cons : ctx.env s.cons = some (.ctor 1 2)) (literal : Bool) (ns : List Nat) (env : List Value) :
+    Evaluates ctx env (listExpr s literal ns) (listValue s ns) := by
+  apply listOntoRun cons literal ns
+  cases literal with
+  | false => exact evaluatesNullary nil
+  | true => exact evaluatesGhost (evaluatesNullary nil)
+
+theorem listOntoValue_append (s : Schema) (xs ys : List Nat) (tail : Value) :
+    listOntoValue s xs (listOntoValue s ys tail) = listOntoValue s (xs ++ ys) tail := by
+  induction xs with
+  | nil => rfl
+  | cons n ns ih => simp only [listOntoValue, List.cons_append, ih]
+
+def Plan.value (p : Plan) : Value :=
+  match p.retainedAlias with
+  | none => mappedValue p.schema p.values
+  | some pair => .ctor pair 0 [mappedValue p.schema p.values,
+      listValue p.schema (p.values.drop p.uniquePrefix)]
+
+theorem mainRun {ctx : Ctx} {p : Plan} (literal : Bool) (call : Expr → Expr)
+    (nil : ctx.env p.schema.nil = some (.ctor 0 0)) (cons : ctx.env p.schema.cons = some (.ctor 1 2))
+    (alias : p.aliasMatches ctx.env)
+    (callRun : ∀ {env major ns}, Evaluates ctx env major (listValue p.schema ns) →
+      Evaluates ctx env (call major) (mappedValue p.schema ns)) :
+    Evaluates ctx [] (p.main literal call) p.value := by
+  cases retained : p.retainedAlias with
+  | none =>
+      simp only [Plan.main, Plan.value, retained]
+      exact callRun (listRun nil cons literal p.values [])
+  | some pair =>
+      simp only [Plan.main, Plan.value, retained]
+      have pairAt : ctx.env pair = some (.ctor 0 2) := by
+        simpa only [Plan.aliasMatches, retained] using alias
+      apply evaluatesLet (listRun nil cons literal (p.values.drop p.uniquePrefix) [])
+      apply evaluatesCtor2 pairAt
+      · apply callRun
+        have parts := listOntoRun cons literal (p.values.take p.uniquePrefix)
+          (evaluatesVar (ctx := ctx)
+            (env := [listValue p.schema (p.values.drop p.uniquePrefix)]) (i := 0) (by rfl))
+        simpa only [listValue, listOntoValue_append, List.take_append_drop] using parts
+      · exact evaluatesVar (by rfl)
+
+theorem Checked.sourceEvaluates {declarations : List (Address × Decl)} {main : Expr}
+    (checked : Checked declarations main) :
+    Evaluates { env := Env.ofList declarations } [] main checked.plan.value := by
+  have body := mainRun (ctx := { env := Env.ofList declarations })
+    true (literalCall checked.plan.schema) checked.source.nil checked.source.cons checked.alias
+    (literalCallRun checked.source)
+  simpa only [checked.mainEq] using evaluatesDef (env := []) checked.entry body
+
+theorem Recovered.forwardSimulation {declarations : List (Address × Decl)} {main : Expr}
+    (recovered : Recovered declarations main) {fuel : Nat} {value : Value}
+    (run : eval { env := Env.ofList declarations } fuel [] main = .ok value) :
+    ∃ targetFuel, eval { env := Env.ofList (targetDeclarations recovered.checked.plan recovered.address) }
+      targetFuel [] (recovered.checked.plan.directMain recovered.address) = .ok value := by
+  have values := (recovered.checked.sourceEvaluates).unique ⟨fuel, run⟩
+  rw [← values]
+  exact mainRun false (.app (.ref recovered.address)) recovered.target.nil recovered.target.cons
+    recovered.target.alias (directCallRun recovered.target)
+
+theorem Selection.forwardSimulation {declarations : List (Address × Decl)} {main : Expr}
+    (selection : Selection declarations main) {fuel : Nat} {value : Value}
+    (run : eval { env := Env.ofList declarations } fuel [] main = .ok value) :
+    ∃ targetFuel, eval { env := Env.ofList selection.declarations } targetFuel [] selection.main = .ok value := by
+  cases selection with
+  | literal reason => exact ⟨fuel, run⟩
+  | recovered recovered => exact recovered.forwardSimulation run
+
+open ProjectionFree
+
+theorem listOntoSafe (s : Schema) (ns : List Nat) {tail : Expr} (safe : ExprSafe tail) :
+    ExprSafe (listOnto s false ns tail) := by
+  induction ns with
+  | nil => exact safe
+  | cons n ns ih => simpa only [ExprSafe, listOnto, Bool.false_eq_true, ite_false,
+      app2, syntaxSafe, Bool.true_and] using ih
+
+theorem Plan.directMainSafe (plan : Plan) (address : Address) : ExprSafe (plan.directMain address) := by
+  have lists : ∀ ns, ExprSafe (listExpr plan.schema false ns) :=
+    fun ns => listOntoSafe plan.schema ns (by rfl)
+  have heads := listOntoSafe plan.schema (plan.values.take plan.uniquePrefix) (tail := .var 0) (by rfl)
+  cases alias : plan.retainedAlias <;>
+    simp [ExprSafe, Plan.directMain, Plan.main, alias, app2, syntaxSafe, lists, heads]
+
+theorem Plan.targetContextSafe (plan : Plan) (address : Address) :
+    CtxSafe { env := Env.ofList (targetDeclarations plan address) } := by
+  constructor
+  · intro key declaration lookup
+    have rows : (targetDeclarations plan address).all (fun row => declSafe row.2) = true := by
+      cases alias : plan.retainedAlias <;>
+        simp [targetDeclarations, alias, directRecursor, workerExpr, ghost, app2, declSafe, syntaxSafe]
+    unfold Env.ofList at lookup
+    obtain ⟨row, found, value⟩ := Option.map_eq_some_iff.mp lookup
+    have safe := List.all_eq_true.mp rows row (List.mem_of_find?_eq_some found)
+    simpa only [value] using safe
+  · intro key arguments result _ oracle
+    cases oracle
+
+theorem Recovered.projectionSafe {declarations : List (Address × Decl)} {main : Expr}
+    (recovery : Recovered declarations main) {fuel : Nat} {value : Value}
+    (run : eval { env := Env.ofList (targetDeclarations recovery.checked.plan recovery.address) }
+      fuel [] (recovery.checked.plan.directMain recovery.address) = .ok value) :
+    ProjectionSafe.Eval { env := Env.ofList (targetDeclarations recovery.checked.plan recovery.address) }
+      fuel [] (recovery.checked.plan.directMain recovery.address) value :=
+  ProjectionFree.Eval.of_run (recovery.checked.plan.targetContextSafe recovery.address)
+    ValuesSafe.nil (recovery.checked.plan.directMainSafe recovery.address) run
+
+end Ix.Compiler.IxIR0.MapRecovery
diff --git a/Ix/Compiler/IxIR0/Mono.lean b/Ix/Compiler/IxIR0/Mono.lean
new file mode 100644
index 000000000..76957ce66
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Mono.lean
@@ -0,0 +1,166 @@
+import Ix.Compiler.Fuel
+import Ix.Compiler.IxIR0.Eval
+
+/-!
+# Fuel monotonicity for the IxIR₀ interpreter
+
+The workhorse lemma of the erasure-simulation work: a successful
+evaluation stays successful (with the same value) under more fuel.
+This is what lets a proof combine sub-derivations obtained at
+different fuels — lift everything to the max. Proved for all four
+mutual functions at once by induction on fuel; the uniform
+decrement-at-entry discipline keeps the induction shape trivial.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+/-- `Except`-bind reduction on a success (definitional; core has no
+named lemma for it). -/
+private theorem bindOk {α β : Type} (a : α) (f : α → Except Err β) :
+    (Except.ok a >>= f) = f a := rfl
+
+/-- `Except`-bind reduction on an error. -/
+private theorem bindErr {α β : Type} (e : Err) (f : α → Except Err β) :
+    ((Except.error e : Except Err α) >>= f) = Except.error e := rfl
+
+private def MonoAt (fuel : Nat) : Prop :=
+  (∀ ctx ρ e v, eval ctx fuel ρ e = .ok v → eval ctx (fuel + 1) ρ e = .ok v) ∧
+  (∀ ctx f a v, apply ctx fuel f a = .ok v → apply ctx (fuel + 1) f a = .ok v) ∧
+  (∀ ctx h args v, saturate ctx fuel h args = .ok v →
+    saturate ctx (fuel + 1) h args = .ok v) ∧
+  (∀ ctx h args v, fire ctx fuel h args = .ok v →
+    fire ctx (fuel + 1) h args = .ok v)
+
+private theorem monoAt : ∀ fuel, MonoAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx ρ e v h; rw [eval.eq_def] at h; simp at h
+    · intro ctx f a v h; rw [apply.eq_def] at h; simp at h
+    · intro ctx hd args v h; rw [saturate.eq_def] at h; simp at h
+    · intro ctx hd args v h; rw [fire.eq_def] at h; simp at h
+  | succ n ihn =>
+    obtain ⟨ihE, ihA, ihS, ihF⟩ := ihn
+    refine ⟨?_, ?_, ?_, ?_⟩
+    -- eval
+    · intro ctx ρ e v h
+      cases e with
+      | var i =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢; exact h
+      | lit l =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢; exact h
+      | erased =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢; exact h
+      | lam u body =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢; exact h
+      | letE u val body =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢
+        cases hval : eval ctx n ρ val with
+        | error err => rw [hval, bindErr] at h; simp at h
+        | ok w =>
+          rw [hval, bindOk] at h
+          rw [ihE _ _ _ _ hval, bindOk]
+          exact ihE _ _ _ _ h
+      | app fn arg =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢
+        cases hf : eval ctx n ρ fn with
+        | error err => rw [hf, bindErr] at h; simp at h
+        | ok fv =>
+          rw [hf, bindOk] at h
+          rw [ihE _ _ _ _ hf, bindOk]
+          cases ha : eval ctx n ρ arg with
+          | error err => rw [ha, bindErr] at h; simp at h
+          | ok av =>
+            rw [ha, bindOk] at h
+            rw [ihE _ _ _ _ ha, bindOk]
+            exact ihA _ _ _ _ h
+      | proj i s =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢
+        cases hs : eval ctx n ρ s with
+        | error err => rw [hs, bindErr] at h; simp at h
+        | ok w =>
+          rw [hs, bindOk] at h
+          rw [ihE _ _ _ _ hs, bindOk]
+          exact h
+      | ref a =>
+        rw [eval.eq_def] at h; rw [eval.eq_def]; dsimp only at h ⊢
+        split at h
+        · exact h
+        · exact ihE _ _ _ _ h
+        · exact ihS _ _ _ _ h
+        · exact h
+        · exact ihS _ _ _ _ h
+    -- apply
+    · intro ctx f a v h
+      cases f with
+      | clos u ρ body =>
+        rw [apply.eq_def] at h; rw [apply.eq_def]; dsimp only at h ⊢
+        exact ihE _ _ _ _ h
+      | pap hd args =>
+        rw [apply.eq_def] at h; rw [apply.eq_def]; dsimp only at h ⊢
+        exact ihS _ _ _ _ h
+      | erased =>
+        rw [apply.eq_def] at h; rw [apply.eq_def]; dsimp only at h ⊢; exact h
+      | ctor adr tag args =>
+        rw [apply.eq_def] at h; rw [apply.eq_def]; dsimp only at h ⊢; exact h
+      | lit l =>
+        rw [apply.eq_def] at h; rw [apply.eq_def]; dsimp only at h ⊢; exact h
+    -- saturate
+    · intro ctx hd args v h
+      rw [saturate.eq_def] at h; rw [saturate.eq_def]; dsimp only at h ⊢
+      cases hc : args.length == hd.arity
+      · simp only [hc] at h ⊢
+        simp at h ⊢
+        exact h
+      · simp only [hc] at h ⊢
+        simp at h ⊢
+        exact ihF _ _ _ _ h
+    -- fire
+    · intro ctx hd args v h
+      cases hd with
+      | ctor a tag ar =>
+        rw [fire.eq_def] at h; rw [fire.eq_def]; dsimp only at h ⊢; exact h
+      | ext a ar =>
+        rw [fire.eq_def] at h; rw [fire.eq_def]; dsimp only at h ⊢; exact h
+      | rec_ a ar =>
+        rw [fire.eq_def] at h; rw [fire.eq_def]; dsimp only at h ⊢
+        split at h
+        · rename_i natLit rules heq
+          split at h
+          · exact h
+          · rename_i major heq'
+            cases hmc : majorCtor natLit major with
+            | error err => rw [hmc, bindErr] at h; simp at h
+            | ok tf =>
+              obtain ⟨tag, fields⟩ := tf
+              rw [hmc, bindOk] at h
+              rw [bindOk]
+              dsimp only at h ⊢
+              split at h
+              · exact h
+              · rename_i rule heq''
+                split at h
+                · rename_i hc
+                  rw [if_pos hc]
+                  exact h
+                · rename_i hc
+                  rw [if_neg hc]
+                  exact ihE _ _ _ _ h
+        · exact h
+
+/-- Success is stable under raising fuel (`eval`). -/
+theorem eval_mono {ctx : Ctx} {fuel fuel' : Nat} {ρ : List Value} {e : Expr}
+    {v : Value} (hle : fuel ≤ fuel') (h : eval ctx fuel ρ e = .ok v) :
+    eval ctx fuel' ρ e = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).1 _ _ _ _ hrun) hle h
+
+/-- Success is stable under raising fuel (`apply`). -/
+theorem apply_mono {ctx : Ctx} {fuel fuel' : Nat} {f a v : Value}
+    (hle : fuel ≤ fuel') (h : apply ctx fuel f a = .ok v) :
+    apply ctx fuel' f a = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).2.1 _ _ _ _ hrun) hle h
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/MutualBlock.lean b/Ix/Compiler/IxIR0/MutualBlock.lean
new file mode 100644
index 000000000..d5a5a32e2
--- /dev/null
+++ b/Ix/Compiler/IxIR0/MutualBlock.lean
@@ -0,0 +1,986 @@
+import Ix.Compiler.IxIR0.Decode
+
+/-!
+# Cycle-safe IxIR₀ mutual-block identities
+
+An ordinary declaration preimage spells every global edge as a 32-byte
+address.  That representation cannot independently content-address two
+declarations which refer to each other.  This module supplies the artifact
+boundary for such a strongly connected component:
+
+* references inside the ordered block are represented by a local member
+  index;
+* references outside the block retain their full address;
+* the complete ordered symbolic block is hashed once; and
+* each executable environment key is derived, with a separate domain, from
+  the block hash and its member index.
+
+`runCertified` converts transiently keyed IxIR₀ declarations to this form,
+derives the final keys, materializes local edges, rejects every observed
+namespace/hash collision, and retains an erased executable audit relating the
+result to the input.  The hash calls are native, so successful runs belong at
+compiled artifact boundaries and in `Tests.lean`, not elaboration-time
+`#guard`s.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Address Owned Uses)
+open Ix.Compiler.IxIR
+
+namespace MutualBlock
+
+/-! ## Symbolic block syntax -/
+
+/-- A global edge in a mutual-block preimage. -/
+inductive Ref where
+  | local (index : Nat)
+  | external (address : Address)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- IxIR₀ expressions with block-local references made explicit. -/
+inductive Expr where
+  | var (index : Nat)
+  | ref (target : Ref)
+  | app (fn arg : Expr)
+  | lam (uses : Uses) (body : Expr)
+  | letE (uses : Uses) (value body : Expr)
+  | proj (index : Nat) (struct : Expr)
+  | lit (literal : IxIR0.Literal)
+  | erased
+  deriving BEq, ReflBEq, LawfulBEq, Repr, Inhabited
+
+/-- A recursor rule in a symbolic mutual block. -/
+structure RecRule where
+  fields : Nat
+  rhs : Expr
+  deriving BEq, ReflBEq, LawfulBEq, Repr, Inhabited
+
+/-- A declaration in a symbolic mutual block. -/
+inductive Decl where
+  | defn (result : Owned) (body : Expr)
+  | ctor (tag arity : Nat)
+  | recursor (numArgs : Nat) (natLit : Bool) (rules : Array RecRule)
+  | extern (arity : Nat)
+  deriving BEq, ReflBEq, LawfulBEq, Repr, Inhabited
+
+/-! ## Temporary-name abstraction -/
+
+/-- Return the first zero-based position of an address.  Successful block
+construction rejects duplicate keys, so the first position is the unique
+position at that boundary. -/
+def localIndex? (keys : List Address) (address : Address) : Option Nat :=
+  let rec loop : Nat → List Address → Option Nat
+    | _, [] => none
+    | index, key :: rest =>
+        if key == address then some index else loop (index + 1) rest
+  loop 0 keys
+
+namespace Ref
+
+/-- Classify one concrete address against the ordered temporary namespace. -/
+def abstract (keys : List Address) (address : Address) : Ref :=
+  match localIndex? keys address with
+  | some index => .local index
+  | none => .external address
+
+/-- Concrete external references carried by a symbolic edge. -/
+def externalReferences : Ref → List Address
+  | .local _ => []
+  | .external address => [address]
+
+/-- Whether every local edge lies within the block. -/
+def wellScoped (memberCount : Nat) : Ref → Bool
+  | .local index => index < memberCount
+  | .external _ => true
+
+/-- Resolve a symbolic edge against the final ordered member keys. -/
+def materialize (memberKeys : Array Address) : Ref → Except String Address
+  | .local index =>
+      match memberKeys[index]? with
+      | some address => .ok address
+      | none => .error s!"mutual-block local reference {index} is out of range"
+  | .external address => .ok address
+
+end Ref
+
+namespace Expr
+
+/-- Replace concrete references by local indices whenever they name a member
+of the same block. -/
+def abstract (keys : List Address) : IxIR0.Expr → Expr
+  | .var index => .var index
+  | .ref address => .ref (Ref.abstract keys address)
+  | .app fn arg => .app (abstract keys fn) (abstract keys arg)
+  | .lam uses body => .lam uses (abstract keys body)
+  | .letE uses value body =>
+      .letE uses (abstract keys value) (abstract keys body)
+  | .proj index struct => .proj index (abstract keys struct)
+  | .lit literal => .lit literal
+  | .erased => .erased
+
+/-- Materialize every local edge using the final member-key array. -/
+def materialize (memberKeys : Array Address) : Expr → Except String IxIR0.Expr
+  | .var index => .ok (.var index)
+  | .ref target => return .ref (← target.materialize memberKeys)
+  | .app fn arg =>
+      return .app (← materialize memberKeys fn)
+        (← materialize memberKeys arg)
+  | .lam uses body => return .lam uses (← materialize memberKeys body)
+  | .letE uses value body =>
+      return .letE uses (← materialize memberKeys value)
+        (← materialize memberKeys body)
+  | .proj index struct =>
+      return .proj index (← materialize memberKeys struct)
+  | .lit literal => .ok (.lit literal)
+  | .erased => .ok .erased
+
+/-- Concrete external references carried anywhere in a symbolic expression. -/
+def externalReferences : Expr → List Address
+  | .var _ => []
+  | .ref target => target.externalReferences
+  | .app fn arg => externalReferences fn ++ externalReferences arg
+  | .lam _ body => externalReferences body
+  | .letE _ value body =>
+      externalReferences value ++ externalReferences body
+  | .proj _ struct => externalReferences struct
+  | .lit _ | .erased => []
+
+/-- Executable local-scope check. -/
+def wellScoped (memberCount : Nat) : Expr → Bool
+  | .var _ => true
+  | .ref target => target.wellScoped memberCount
+  | .app fn arg => wellScoped memberCount fn && wellScoped memberCount arg
+  | .lam _ body => wellScoped memberCount body
+  | .letE _ value body =>
+      wellScoped memberCount value && wellScoped memberCount body
+  | .proj _ struct => wellScoped memberCount struct
+  | .lit _ | .erased => true
+
+end Expr
+
+namespace RecRule
+
+def abstract (keys : List Address) (rule : IxIR0.RecRule) : RecRule :=
+  { fields := rule.fields, rhs := Expr.abstract keys rule.rhs }
+
+def materialize (memberKeys : Array Address)
+    (rule : RecRule) : Except String IxIR0.RecRule :=
+  return { fields := rule.fields, rhs := ← rule.rhs.materialize memberKeys }
+
+def externalReferences (rule : RecRule) : List Address :=
+  rule.rhs.externalReferences
+
+def wellScoped (memberCount : Nat) (rule : RecRule) : Bool :=
+  rule.rhs.wellScoped memberCount
+
+end RecRule
+
+namespace Decl
+
+/-- Abstract one ordinary IxIR₀ declaration against an ordered member-key
+namespace. -/
+def abstract (keys : List Address) : IxIR0.Decl → Decl
+  | .defn result body => .defn result (Expr.abstract keys body)
+  | .ctor tag arity => .ctor tag arity
+  | .recursor numArgs natLit rules =>
+      .recursor numArgs natLit (rules.map (RecRule.abstract keys))
+  | .extern arity => .extern arity
+
+/-- Materialize one symbolic declaration using final member keys. -/
+def materialize (memberKeys : Array Address) : Decl → Except String IxIR0.Decl
+  | .defn result body => return .defn result (← body.materialize memberKeys)
+  | .ctor tag arity => .ok (.ctor tag arity)
+  | .recursor numArgs natLit rules =>
+      return .recursor numArgs natLit
+        (← rules.mapM (RecRule.materialize memberKeys))
+  | .extern arity => .ok (.extern arity)
+
+def externalReferences : Decl → List Address
+  | .defn _ body => body.externalReferences
+  | .ctor _ _ | .extern _ => []
+  | .recursor _ _ rules =>
+      rules.toList.flatMap RecRule.externalReferences
+
+def wellScoped (memberCount : Nat) : Decl → Bool
+  | .defn _ body => body.wellScoped memberCount
+  | .ctor _ _ | .extern _ => true
+  | .recursor _ _ rules =>
+      rules.all (RecRule.wellScoped memberCount)
+
+end Decl
+
+/-- Abstract the declarations of a transiently keyed ordered block.  Keys are
+not serialized; they are used only to recognize local edges. -/
+def abstractMembers (members : List (Address × IxIR0.Decl)) : List Decl :=
+  let keys := members.map (·.1)
+  members.map fun member => Decl.abstract keys member.2
+
+/-! ## Canonical bytes and cryptographic identities -/
+
+namespace Ref
+
+/-- Canonical reference payload.  The tag distinguishes local indices from
+full external addresses. -/
+def bytes : Ref → ByteArray
+  | .local index => Encoding.tag 0 ++ Encoding.nat index
+  | .external address => Encoding.tag 1 ++ Encoding.address address
+
+end Ref
+
+namespace Expr
+
+/-- Canonical symbolic expression payload. -/
+def bytes : Expr → ByteArray
+  | .var index => Encoding.tag 0 ++ Encoding.nat index
+  | .ref target => Encoding.tag 1 ++ target.bytes
+  | .app fn arg => Encoding.tag 2 ++ bytes fn ++ bytes arg
+  | .lam uses body =>
+      Encoding.tag 3 ++ Encoding.tag uses.toBits ++ bytes body
+  | .letE uses value body =>
+      Encoding.tag 4 ++ Encoding.tag uses.toBits ++
+        bytes value ++ bytes body
+  | .proj index struct =>
+      Encoding.tag 5 ++ Encoding.nat index ++ bytes struct
+  | .lit literal => Encoding.tag 6 ++ IxIR0.Literal.bytes literal
+  | .erased => Encoding.tag 7
+
+end Expr
+
+namespace RecRule
+
+def bytes (rule : RecRule) : ByteArray :=
+  Encoding.nat rule.fields ++ rule.rhs.bytes
+
+end RecRule
+
+namespace Decl
+
+/-- Canonical symbolic declaration payload. -/
+def bytes : Decl → ByteArray
+  | .defn result body =>
+      Encoding.tag 0 ++ Encoding.tag result.toBits ++ body.bytes
+  | .ctor tag arity =>
+      Encoding.tag 1 ++ Encoding.nat tag ++ Encoding.nat arity
+  | .recursor numArgs natLit rules =>
+      Encoding.tag 2 ++ Encoding.nat numArgs ++ Encoding.bool natLit ++
+        Encoding.array RecRule.bytes rules
+  | .extern arity => Encoding.tag 3 ++ Encoding.nat arity
+
+end Decl
+
+namespace Block
+
+/-- Versioned domain for a complete ordered IxIR₀ mutual block. -/
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir0/mutual-block/1" ++ Encoding.tag 0
+
+/-- Complete canonical mutual-block hash preimage. -/
+def preimage (members : List Decl) : ByteArray :=
+  addressDomain ++ Encoding.list Decl.bytes members
+
+/-- Content identity of a complete symbolic mutual block. -/
+def address (members : List Decl) : Address :=
+  Address.blake3 (preimage members)
+
+/-- Block-address equality exposes exact preimage equality under the one
+pairwise cryptographic premise actually needed. -/
+theorem address_eq_iff_preimage_eq (left right : List Decl)
+    (hcollision : Address.Blake3NoCollision (preimage left) (preimage right)) :
+    address left = address right ↔ preimage left = preimage right := by
+  constructor
+  · exact hcollision
+  · intro h
+    simp only [address]
+    rw [h]
+
+end Block
+
+namespace Member
+
+/-- Versioned domain for a member key derived from a mutual-block identity. -/
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir0/mutual-member/1" ++ Encoding.tag 0
+
+/-- Canonical member-key preimage. -/
+def preimage (block : Address) (index : Nat) : ByteArray :=
+  addressDomain ++ Encoding.address block ++ Encoding.nat index
+
+/-- Derive one executable declaration key from its block and local index. -/
+def address (block : Address) (index : Nat) : Address :=
+  Address.blake3 (preimage block index)
+
+/-- Member-address equality exposes exact preimage equality under the one
+pairwise cryptographic premise actually needed. -/
+theorem address_eq_iff_preimage_eq (leftBlock rightBlock : Address)
+    (leftIndex rightIndex : Nat)
+    (hcollision : Address.Blake3NoCollision
+      (preimage leftBlock leftIndex) (preimage rightBlock rightIndex)) :
+    address leftBlock leftIndex = address rightBlock rightIndex ↔
+      preimage leftBlock leftIndex = preimage rightBlock rightIndex := by
+  constructor
+  · exact hcollision
+  · intro h
+    simp only [address]
+    rw [h]
+
+end Member
+
+/-! ## Strict block-preimage decoder -/
+
+open Ix.Compiler.IxIR.Decode
+open Ix.Compiler.Ixon
+
+def getRefTag : UInt8 → GetM Ref
+  | 0 => do return .local (← Decode.getNat)
+  | 1 => do return .external (← Decode.getAddress)
+  | tag => throw s!"IxIR0 mutual-block reference: invalid tag {tag}"
+
+def getRef : GetM Ref := do
+  getRefTag (← getU8)
+
+def getExprTag (recur : GetM Expr) : UInt8 → GetM Expr
+  | 0 => do return .var (← Decode.getNat)
+  | 1 => do return .ref (← getRef)
+  | 2 => do return .app (← recur) (← recur)
+  | 3 => do return .lam (← IxIR0.getUses) (← recur)
+  | 4 => do
+      let uses ← IxIR0.getUses
+      let value ← recur
+      return .letE uses value (← recur)
+  | 5 => do return .proj (← Decode.getNat) (← recur)
+  | 6 => do return .lit (← IxIR0.getLiteral)
+  | 7 => pure .erased
+  | tag => throw s!"IxIR0 mutual-block expression: invalid tag {tag}"
+
+def getExprFuel : Nat → GetM Expr
+  | 0 => throw "IxIR0 mutual-block expression: recursion limit"
+  | fuel + 1 => do
+      getExprTag (getExprFuel fuel) (← getU8)
+
+def getExpr : GetM Expr := do
+  let state ← get
+  getExprFuel (state.bytes.size + 1)
+
+def getRecRule : GetM RecRule := do
+  return ⟨← Decode.getNat, ← getExpr⟩
+
+def getDeclTag : UInt8 → GetM Decl
+  | 0 => do return .defn (← IxIR0.getOwned) (← getExpr)
+  | 1 => do return .ctor (← Decode.getNat) (← Decode.getNat)
+  | 2 => do
+      let numArgs ← Decode.getNat
+      let natLit ← Decode.getBool
+      return .recursor numArgs natLit (← Decode.getArray getRecRule)
+  | 3 => do return .extern (← Decode.getNat)
+  | tag => throw s!"IxIR0 mutual-block declaration: invalid tag {tag}"
+
+def getDecl : GetM Decl := do
+  getDeclTag (← getU8)
+
+def getBlockPreimage : GetM (List Decl) := do
+  Decode.expectBytes Block.addressDomain
+  Decode.getList getDecl
+
+/-- Decode one complete canonical symbolic block preimage.  This is the codec
+layer and therefore accepts an empty list or a syntactically valid
+out-of-range local edge; `decodeArtifact` applies those semantic checks. -/
+def Block.decodePreimage (bytes : ByteArray) : Except String (List Decl) :=
+  Decode.runCanonical getBlockPreimage Block.preimage bytes
+
+/-- Decode and validate an artifact-shaped block. -/
+def Block.decodeArtifact (bytes : ByteArray) : Except String (List Decl) := do
+  let members ← Block.decodePreimage bytes
+  if members.isEmpty then
+    throw "mutual block must contain at least one member"
+  unless members.all (Decl.wellScoped members.length) do
+    throw "mutual block contains an out-of-range local reference"
+  return members
+
+/-! ### Cursor-relative decoder proofs -/
+
+theorem getRef_spec : ∀ target : Ref, GetSpec getRef target.bytes target
+  | .local index => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec index) Ref.local
+      have htotal := GetSpec.bind (next := getRefTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getRef, Ref.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .external address => by
+      have hpayload := Decode.getSpecMap
+        (Decode.getAddress_spec address) Ref.external
+      have htotal := GetSpec.bind (next := getRefTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getRef, Ref.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+/-- Recursive parser depth.  Every encoded symbolic expression has at least
+this many constructor-tag bytes along its deepest branch. -/
+def Expr.decodeDepth : Expr → Nat
+  | .var _ | .ref _ | .lit _ | .erased => 1
+  | .app function argument =>
+      1 + Nat.max function.decodeDepth argument.decodeDepth
+  | .lam _ body => 1 + body.decodeDepth
+  | .letE _ value body =>
+      1 + Nat.max value.decodeDepth body.decodeDepth
+  | .proj _ target => 1 + target.decodeDepth
+
+theorem Expr.decodeDepth_le_bytes (expression : Expr) :
+    expression.decodeDepth ≤ expression.bytes.size := by
+  induction expression with
+  | var index => simp [Expr.decodeDepth, Expr.bytes]
+  | ref target => simp [Expr.decodeDepth, Expr.bytes]
+  | app function argument hfunction hargument =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      have hleft : function.decodeDepth ≤
+          function.bytes.size + argument.bytes.size := by omega
+      have hright : argument.decodeDepth ≤
+          function.bytes.size + argument.bytes.size := by omega
+      have hmax : Nat.max function.decodeDepth argument.decodeDepth ≤
+          function.bytes.size + argument.bytes.size :=
+        Nat.max_le.mpr ⟨hleft, hright⟩
+      omega
+  | lam uses body hbody =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      omega
+  | letE uses value body hvalue hbody =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      have hleft : value.decodeDepth ≤ value.bytes.size + body.bytes.size := by
+        omega
+      have hright : body.decodeDepth ≤ value.bytes.size + body.bytes.size := by
+        omega
+      have hmax : Nat.max value.decodeDepth body.decodeDepth ≤
+          value.bytes.size + body.bytes.size :=
+        Nat.max_le.mpr ⟨hleft, hright⟩
+      omega
+  | proj index target htarget =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      omega
+  | lit literal =>
+      simp only [Expr.decodeDepth, Expr.bytes, ByteArray.size_append,
+        Decode.tag_size]
+      omega
+  | erased => simp [Expr.decodeDepth, Expr.bytes]
+
+theorem getExprFuel_spec (expression : Expr) (fuel : Nat)
+    (hfuel : expression.decodeDepth < fuel) :
+    GetSpec (getExprFuel fuel) expression.bytes expression := by
+  induction expression generalizing fuel with
+  | var index =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload := Decode.getSpecMap (Decode.getNat_spec index) Expr.var
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 0) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | ref target =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload := Decode.getSpecMap (getRef_spec target) Expr.ref
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 1) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | app function argument hfunction hargument =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have hmax : Nat.max function.decodeDepth argument.decodeDepth < fuel := by
+            omega
+          have hfunctionFuel : function.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_left _ _) hmax
+          have hargumentFuel : argument.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_right _ _) hmax
+          have hpayload := Decode.getSpecMap2
+            (hfunction fuel hfunctionFuel) (hargument fuel hargumentFuel)
+            Expr.app
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 2) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | lam uses body hbody =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have hbodyFuel : body.decodeDepth < fuel := by omega
+          have hpayload := Decode.getSpecMap2 (IxIR0.getUses_spec uses)
+            (hbody fuel hbodyFuel) Expr.lam
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 3) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | letE uses value body hvalue hbody =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have hmax : Nat.max value.decodeDepth body.decodeDepth < fuel := by
+            omega
+          have hvalueFuel : value.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_left _ _) hmax
+          have hbodyFuel : body.decodeDepth < fuel :=
+            Nat.lt_of_le_of_lt (Nat.le_max_right _ _) hmax
+          have hpayload := Decode.getSpecMap3 (IxIR0.getUses_spec uses)
+            (hvalue fuel hvalueFuel) (hbody fuel hbodyFuel) Expr.letE
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 4) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | proj index target htarget =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          simp only [Expr.decodeDepth] at hfuel
+          have htargetFuel : target.decodeDepth < fuel := by omega
+          have hpayload := Decode.getSpecMap2 (Decode.getNat_spec index)
+            (htarget fuel htargetFuel) Expr.proj
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 5) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | lit literal =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload := Decode.getSpecMap
+            (IxIR0.getLiteral_spec literal) Expr.lit
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 6) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+  | erased =>
+      cases fuel with
+      | zero => omega
+      | succ fuel =>
+          have hpayload : GetSpec (getExprTag (getExprFuel fuel) 7)
+              ByteArray.empty Expr.erased := GetSpec.pure Expr.erased
+          have htotal := GetSpec.bind
+            (next := getExprTag (getExprFuel fuel))
+            (Decode.getU8_tag_spec 7) hpayload
+          simpa only [getExprFuel, Expr.bytes, ByteArray.append_assoc,
+            ByteArray.append_empty] using htotal
+
+theorem getExpr_spec (expression : Expr) :
+    GetSpec getExpr expression.bytes expression := by
+  intro pre suffix
+  let fuel := (pre ++ expression.bytes ++ suffix).size + 1
+  have hfuel : expression.decodeDepth < fuel := by
+    have hdepth := expression.decodeDepth_le_bytes
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  have hspec := getExprFuel_spec expression fuel hfuel pre suffix
+  simpa [getExpr, fuel] using hspec
+
+theorem getRecRule_spec (rule : RecRule) :
+    GetSpec getRecRule rule.bytes rule := by
+  have hspec := Decode.getSpecMap2 (Decode.getNat_spec rule.fields)
+    (getExpr_spec rule.rhs) RecRule.mk
+  simpa [getRecRule, RecRule.bytes] using hspec
+
+theorem getDecl_spec : ∀ declaration : Decl,
+    GetSpec getDecl declaration.bytes declaration
+  | .defn result body => by
+      have hpayload := Decode.getSpecMap2 (IxIR0.getOwned_spec result)
+        (getExpr_spec body) Decl.defn
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getDecl, Decl.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .ctor tag arity => by
+      have hpayload := Decode.getSpecMap2 (Decode.getNat_spec tag)
+        (Decode.getNat_spec arity) Decl.ctor
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getDecl, Decl.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .recursor numArgs natLit rules => by
+      have hpayload := Decode.getSpecMap3 (Decode.getNat_spec numArgs)
+        (Decode.getBool_spec natLit)
+        (Decode.getArray_spec getRecRule RecRule.bytes getRecRule_spec rules)
+        Decl.recursor
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 2) hpayload
+      simpa only [getDecl, Decl.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .extern arity => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec arity) Decl.extern
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 3) hpayload
+      simpa only [getDecl, Decl.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+theorem getBlockPreimage_spec (members : List Decl) :
+    GetSpec getBlockPreimage (Block.preimage members) members := by
+  let next : Unit → GetM (List Decl) := fun _ => Decode.getList getDecl
+  have htotal := GetSpec.bind (next := next)
+    (Decode.expectBytes_spec Block.addressDomain)
+    (Decode.getList_spec getDecl Decl.bytes getDecl_spec members)
+  simpa [getBlockPreimage, Block.preimage, next] using htotal
+
+/-! ### Strict top-level codec laws -/
+
+/-- Every symbolic block decodes from its canonical framed preimage. -/
+theorem Block.decodePreimage_roundtrip (members : List Decl) :
+    Block.decodePreimage (Block.preimage members) = .ok members := by
+  exact Decode.runCanonical_of_spec getBlockPreimage Block.preimage members
+    (getBlockPreimage_spec members)
+
+/-- Every accepted byte string is the canonical preimage of its result. -/
+theorem Block.decodePreimage_canonical {bytes : ByteArray}
+    {members : List Decl}
+    (hdecode : Block.decodePreimage bytes = .ok members) :
+    Block.preimage members = bytes := by
+  exact Decode.runCanonical_canonical getBlockPreimage Block.preimage hdecode
+
+/-- Canonical symbolic block preimages are injective. -/
+theorem Block.preimage_injective : Function.Injective Block.preimage := by
+  intro left right hbytes
+  have hok : (Except.ok left : Except String (List Decl)) = .ok right := by
+    calc
+      .ok left = Block.decodePreimage (Block.preimage left) :=
+        (Block.decodePreimage_roundtrip left).symm
+      _ = Block.decodePreimage (Block.preimage right) :=
+        congrArg Block.decodePreimage hbytes
+      _ = .ok right := Block.decodePreimage_roundtrip right
+  exact Except.ok.inj hok
+
+/-! ## Materializing a transient block -/
+
+/-- Old transient member key to final derived member key. -/
+abbrev Renaming := List (Address × Address)
+
+namespace Renaming
+
+def lookup (mapping : Renaming) (address : Address) : Option Address :=
+  (mapping.find? fun entry => entry.1 == address).map (·.2)
+
+def apply (mapping : Renaming) (address : Address) : Address :=
+  (mapping.lookup address).getD address
+
+def contains (mapping : Renaming) (address : Address) : Bool :=
+  mapping.any fun entry => entry.1 == address
+
+end Renaming
+
+namespace Concrete
+
+namespace Expr
+
+/-- Rename every concrete global edge in an ordinary IxIR₀ expression. -/
+def mapAddresses (rename : Address → Address) : IxIR0.Expr → IxIR0.Expr
+  | .var index => .var index
+  | .ref address => .ref (rename address)
+  | .app fn arg => .app (mapAddresses rename fn) (mapAddresses rename arg)
+  | .lam uses body => .lam uses (mapAddresses rename body)
+  | .letE uses value body =>
+      .letE uses (mapAddresses rename value) (mapAddresses rename body)
+  | .proj index struct => .proj index (mapAddresses rename struct)
+  | .lit literal => .lit literal
+  | .erased => .erased
+
+def references : IxIR0.Expr → List Address
+  | .var _ => []
+  | .ref address => [address]
+  | .app fn arg => references fn ++ references arg
+  | .lam _ body => references body
+  | .letE _ value body => references value ++ references body
+  | .proj _ struct => references struct
+  | .lit _ | .erased => []
+
+end Expr
+
+namespace RecRule
+
+def mapAddresses (rename : Address → Address)
+    (rule : IxIR0.RecRule) : IxIR0.RecRule :=
+  { rule with rhs := Expr.mapAddresses rename rule.rhs }
+
+def references (rule : IxIR0.RecRule) : List Address :=
+  Expr.references rule.rhs
+
+end RecRule
+
+namespace Decl
+
+def mapAddresses (rename : Address → Address) : IxIR0.Decl → IxIR0.Decl
+  | .defn result body => .defn result (Expr.mapAddresses rename body)
+  | .ctor tag arity => .ctor tag arity
+  | .recursor numArgs natLit rules =>
+      .recursor numArgs natLit (rules.map (RecRule.mapAddresses rename))
+  | .extern arity => .extern arity
+
+def references : IxIR0.Decl → List Address
+  | .defn _ body => Expr.references body
+  | .ctor _ _ | .extern _ => []
+  | .recursor _ _ rules => rules.toList.flatMap RecRule.references
+
+end Decl
+
+end Concrete
+
+/-- A completely materialized mutual-block result. -/
+structure Result where
+  blockAddress : Address
+  blockMembers : List Decl
+  members : List (Address × IxIR0.Decl)
+  addressMap : Renaming
+
+namespace Result
+
+def transientAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.1)
+
+def derivedAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.2)
+
+/-- Every recorded destination is the domain-separated derivation at its
+position, and the emitted key list is exactly that destination list. -/
+def memberKeysDerived (result : Result) : Bool :=
+  let rec loop : Nat → Renaming → Bool
+    | _, [] => true
+    | index, entry :: rest =>
+        entry.2 == Member.address result.blockAddress index &&
+          loop (index + 1) rest
+  loop 0 result.addressMap &&
+    result.members.map (·.1) == result.derivedAddresses
+
+/-- Re-abstracting the final declarations recovers the exact canonical
+symbolic block. -/
+def blockStable (result : Result) : Bool :=
+  abstractMembers result.members == result.blockMembers
+
+def noTransientKeys (result : Result) : Bool :=
+  !(result.members.map (·.1)).any result.transientAddresses.contains
+
+def noTransientReferences (result : Result) : Bool :=
+  let references := result.members.flatMap fun member =>
+    Concrete.Decl.references member.2
+  !references.any result.transientAddresses.contains
+
+/-- Executable certificate that the materialized environment is exactly the
+address-renamed image of the transient environment and that the symbolic
+artifact remains stable after materialization. -/
+def semanticAudit (result : Result)
+    (raw : List (Address × IxIR0.Decl)) : Bool :=
+  let rename := Renaming.apply result.addressMap
+  let original := IxIR0.Env.ofList raw
+  let emitted := IxIR0.Env.ofList result.members
+  result.blockMembers == abstractMembers raw &&
+    result.blockAddress == Block.address result.blockMembers &&
+    result.memberKeysDerived && result.blockStable &&
+    result.noTransientKeys && result.noTransientReferences &&
+    raw.all (fun entry =>
+      match original entry.1, emitted (rename entry.1) with
+      | some before, some after =>
+          after == Concrete.Decl.mapAddresses rename before
+      | _, _ => false) &&
+    result.members.all (fun entry =>
+      match emitted entry.1 with
+      | some declaration =>
+          Concrete.Decl.mapAddresses rename declaration == declaration
+      | none => false)
+
+end Result
+
+/-- A successful block construction carries its runtime-erased audit. -/
+abbrev CertifiedResult (raw : List (Address × IxIR0.Decl)) :=
+  { result : Result // result.semanticAudit raw = true }
+
+private def firstDuplicate? : List Address → Option Address
+  | [] => none
+  | address :: rest =>
+      if rest.contains address then some address else firstDuplicate? rest
+
+private def firstOverlap? (left right : List Address) : Option Address :=
+  left.find? right.contains
+
+private def deriveMap (block : Address) :
+    Nat → List (Address × IxIR0.Decl) → Renaming
+  | _, [] => []
+  | index, member :: rest =>
+      (member.1, Member.address block index) :: deriveMap block (index + 1) rest
+
+/-- A decoded and materialized block artifact, independent of any transient
+producer namespace. -/
+structure Artifact where
+  blockAddress : Address
+  blockMembers : List Decl
+  members : List (Address × IxIR0.Decl)
+
+namespace Artifact
+
+def memberKeysDerived (artifact : Artifact) : Bool :=
+  let rec loop : Nat → List (Address × IxIR0.Decl) → Bool
+    | _, [] => true
+    | index, member :: rest =>
+        member.1 == Member.address artifact.blockAddress index &&
+          loop (index + 1) rest
+  loop 0 artifact.members
+
+def stable (artifact : Artifact) : Bool :=
+  abstractMembers artifact.members == artifact.blockMembers
+
+def audit (artifact : Artifact) : Bool :=
+  artifact.blockAddress == Block.address artifact.blockMembers &&
+    artifact.members.length == artifact.blockMembers.length &&
+    artifact.blockMembers.all
+      (Decl.wellScoped artifact.blockMembers.length) &&
+    artifact.memberKeysDerived && artifact.stable
+
+end Artifact
+
+private def deriveKeys (block : Address) : Nat → Nat → List Address
+  | _, 0 => []
+  | index, count + 1 =>
+      Member.address block index :: deriveKeys block (index + 1) count
+
+/-- Validate and materialize already-symbolic members, as used after decoding
+a stored block. -/
+def Block.materializeArtifact (reserved : List Address)
+    (blockMembers : List Decl) : Except String Artifact := do
+  if blockMembers.isEmpty then
+    throw "mutual block must contain at least one member"
+  unless blockMembers.all (Decl.wellScoped blockMembers.length) do
+    throw "mutual block contains an out-of-range local reference"
+  let blockAddress := Block.address blockMembers
+  if reserved.contains blockAddress then
+    throw s!"mutual-block identity collides with reserved identity {Address.toHex blockAddress}"
+  let external := blockMembers.flatMap Decl.externalReferences
+  if external.contains blockAddress then
+    throw s!"mutual-block identity collides with an external reference {Address.toHex blockAddress}"
+  let derived := deriveKeys blockAddress 0 blockMembers.length
+  if let some duplicate := firstDuplicate? derived then
+    throw s!"BLAKE3 collision between mutual-block member keys {Address.toHex duplicate}"
+  if derived.contains blockAddress then
+    throw s!"mutual-block member key collides with its block identity {Address.toHex blockAddress}"
+  if let some overlap := firstOverlap? derived reserved then
+    throw s!"mutual-block member key collides with reserved identity {Address.toHex overlap}"
+  if let some overlap := firstOverlap? derived external then
+    throw s!"mutual-block member key captures an external reference {Address.toHex overlap}"
+  let declarations ← blockMembers.mapM
+    (Decl.materialize derived.toArray)
+  let artifact : Artifact :=
+    { blockAddress, blockMembers, members := derived.zip declarations }
+  unless artifact.audit do
+    throw "internal: decoded mutual block failed materialization audit"
+  return artifact
+
+/-- Strictly decode, scope-check, collision-check, and materialize a stored
+mutual block. -/
+def Block.decodeMaterialized (reserved : List Address)
+    (bytes : ByteArray) : Except String Artifact := do
+  Block.materializeArtifact reserved (← Block.decodeArtifact bytes)
+
+private def certify (raw : List (Address × IxIR0.Decl))
+    (result : Result) : Except String (CertifiedResult raw) :=
+  if haudit : result.semanticAudit raw then .ok ⟨result, haudit⟩
+  else .error "internal: mutual-block materialization failed semantic audit"
+
+/-- Construct and certify a cycle-safe block while protecting all caller-owned
+address identities.  `reserved` should contain every non-member declaration
+or artifact key in the surrounding closed world.
+
+The function rejects empty blocks, duplicate/overlapping temporary keys,
+observed BLAKE3 collisions between derived members, and capture of any
+temporary, external, reserved, or block-artifact identity. -/
+def runCertified (reserved : List Address)
+    (raw : List (Address × IxIR0.Decl)) :
+    Except String (CertifiedResult raw) := do
+  if raw.isEmpty then
+    throw "mutual block must contain at least one member"
+  let transient := raw.map (·.1)
+  if let some duplicate := firstDuplicate? transient then
+    throw s!"duplicate mutual-block temporary address {Address.toHex duplicate}"
+  if let some overlap := firstOverlap? transient reserved then
+    throw s!"mutual-block temporary address overlaps reserved identity {Address.toHex overlap}"
+  let blockMembers := abstractMembers raw
+  unless blockMembers.all (Decl.wellScoped blockMembers.length) do
+    throw "internal: abstracted mutual block contains an out-of-range local reference"
+  let blockAddress := Block.address blockMembers
+  if transient.contains blockAddress then
+    throw s!"mutual-block identity overlaps temporary namespace {Address.toHex blockAddress}"
+  if reserved.contains blockAddress then
+    throw s!"mutual-block identity collides with reserved identity {Address.toHex blockAddress}"
+  let external := blockMembers.flatMap Decl.externalReferences
+  if external.contains blockAddress then
+    throw s!"mutual-block identity collides with an external reference {Address.toHex blockAddress}"
+  let addressMap := deriveMap blockAddress 0 raw
+  let derived := addressMap.map (·.2)
+  if let some duplicate := firstDuplicate? derived then
+    throw s!"BLAKE3 collision between mutual-block member keys {Address.toHex duplicate}"
+  if derived.contains blockAddress then
+    throw s!"mutual-block member key collides with its block identity {Address.toHex blockAddress}"
+  if let some overlap := firstOverlap? derived transient then
+    throw s!"mutual-block member key overlaps temporary namespace {Address.toHex overlap}"
+  if let some overlap := firstOverlap? derived reserved then
+    throw s!"mutual-block member key collides with reserved identity {Address.toHex overlap}"
+  if let some overlap := firstOverlap? derived external then
+    throw s!"mutual-block member key captures an external reference {Address.toHex overlap}"
+  let memberKeys := derived.toArray
+  let materialized ← blockMembers.mapM (Decl.materialize memberKeys)
+  let members := derived.zip materialized
+  let result : Result :=
+    { blockAddress, blockMembers, members, addressMap }
+  certify raw result
+
+/-- Artifact-facing projection of `runCertified`. -/
+def run (reserved : List Address)
+    (raw : List (Address × IxIR0.Decl)) : Except String Result := do
+  return (← runCertified reserved raw).1
+
+/-- Every successful artifact-facing run retains the erased semantic audit
+constructed by `runCertified`. -/
+theorem semanticAudit_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × IxIR0.Decl)}
+    {result : Result} (hrun : run reserved raw = .ok result) :
+    result.semanticAudit raw = true := by
+  unfold run at hrun
+  cases hcertified : runCertified reserved raw with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2
+
+/-! Pure structural format guards.  Digest and executable construction
+fixtures live in the compiled test executable. -/
+
+private def fixtureA : Address := Address.replicate 0xfa
+private def fixtureB : Address := Address.replicate 0xfb
+private def fixtureExternal : Address := Address.replicate 0xee
+
+#guard Ref.bytes (.local 128) == ByteArray.mk #[0, 128, 1]
+#guard (Ref.bytes (.external fixtureExternal)).size == 33
+#guard Expr.bytes (.ref (.local 1)) == ByteArray.mk #[1, 0, 1]
+#guard Decl.bytes (.defn .shared (.ref (.local 1))) ==
+  ByteArray.mk #[0, 1, 1, 0, 1]
+#guard
+  abstractMembers
+    [(fixtureA, .defn .shared (.ref fixtureB)),
+     (fixtureB, .defn .shared (.ref fixtureA))] ==
+    [.defn .shared (.ref (.local 1)),
+     .defn .shared (.ref (.local 0))]
+
+end MutualBlock
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/NatArithmetic.lean b/Ix/Compiler/IxIR0/NatArithmetic.lean
new file mode 100644
index 000000000..a45d6af3b
--- /dev/null
+++ b/Ix/Compiler/IxIR0/NatArithmetic.lean
@@ -0,0 +1,144 @@
+import Ix.Compiler.IxIR0.RecursionSim
+
+/-! A mathematical summary of the canonical Nat recursor used for addition.
+The summary is proved in the ordinary evaluator, including literal peeling;
+there is no arithmetic extern or replacement source oracle. -/
+
+namespace Ix.Compiler.IxIR0.NatArithmetic
+
+open Ix.Compiler.Ixon (Address)
+open Recursion
+
+structure Schema where
+  successor : Address
+  recursor : Address
+  alias : Address
+  deriving DecidableEq, Repr
+
+def rules : Array RecRule := #[
+  { fields := 0, rhs := .var 1 },
+  { fields := 1, rhs := .app (.app (.var 1) (.var 0))
+      (.app (.app (.app (.var 3) (.var 2)) (.var 1)) (.var 0)) }]
+
+def stepBody (schema : Schema) : Expr :=
+  .lam .many (.lam .many (.app (.ref schema.successor) (.var 0)))
+
+def body (schema : Schema) : Expr :=
+  .lam .many (.lam .many
+    (.app (.app (.app (.ref schema.alias) (.var 1)) (stepBody schema)) (.var 0)))
+
+structure Matches (ctx : Ctx) (schema : Schema) : Prop where
+  successor : ctx.env schema.successor = some (.ctor 1 1)
+  recursor : ctx.env schema.recursor = some (.recursor 2 true rules)
+  alias : ctx.env schema.alias = some (.defn .shared (.ref schema.recursor))
+
+instance (ctx : Ctx) (schema : Schema) : Decidable (Matches ctx schema) :=
+  decidable_of_iff
+    (ctx.env schema.successor = some (.ctor 1 1) ∧
+      ctx.env schema.recursor = some (.recursor 2 true rules) ∧
+      ctx.env schema.alias = some (.defn .shared (.ref schema.recursor)))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2⟩, fun h => ⟨h.successor, h.recursor, h.alias⟩⟩
+
+/-- Runtime arguments can be literals; previous source additions can also
+have constructed successor spines. Both denote the same unbounded Nat. -/
+inductive Represents (schema : Schema) : Value → Nat → Prop where
+  | literal (value : Nat) : Represents schema (.lit (.nat value)) value
+  | successor {value : Value} {number : Nat} (tail : Represents schema value number) :
+      Represents schema (.ctor schema.successor 1 [value]) (number + 1)
+
+theorem appliesRecursorView {ctx : Ctx} {address : Address}
+    {pre : List Value} {major : Value} {tag : Nat} {fields : List Value}
+    {recRules : Array RecRule} {rule : RecRule} {result : Value}
+    (declaration : ctx.env address = some (.recursor 2 true recRules))
+    (arity : pre.length = 2)
+    (view : majorCtor true major = .ok (tag, fields))
+    (found : recRules[tag]? = some rule) (fieldCount : fields.length = rule.fields)
+    (evaluated : Evaluates ctx
+      (fields.reverse ++ pre.reverse ++ [.pap (.rec_ address 3) []]) rule.rhs result) :
+    Applies ctx (.pap (.rec_ address 3) pre) major result := by
+  obtain ⟨fuel, evaluated⟩ := evaluated
+  refine ⟨fuel + 3, ?_⟩
+  rw [apply.eq_def]
+  dsimp only
+  rw [saturate.eq_def]
+  simp only [Head.arity, List.length_append, List.length_singleton, arity,
+    beq_self_eq_true, ite_true]
+  rw [fire.eq_def]
+  simpa [declaration, view, found, fieldCount] using evaluated
+
+theorem appliesRecursorFirst (ctx : Ctx) (address : Address) (value : Value) :
+    Applies ctx (.pap (.rec_ address 3) []) value (.pap (.rec_ address 3) [value]) := by
+  exact ⟨2, by simp [apply, saturate, Head.arity]⟩
+
+theorem appliesRecursorSecond (ctx : Ctx) (address : Address) (left right : Value) :
+    Applies ctx (.pap (.rec_ address 3) [left]) right (.pap (.rec_ address 3) [left, right]) := by
+  exact ⟨2, by simp [apply, saturate, Head.arity]⟩
+
+def stepValue (schema : Schema) (environment : List Value) : Value :=
+  .clos .many environment (.lam .many (.app (.ref schema.successor) (.var 0)))
+
+theorem step_applies {ctx : Ctx} {schema : Schema} (matched : Matches ctx schema)
+    (environment : List Value) (predecessor argument : Value) :
+    ∃ closure, Applies ctx (stepValue schema environment) predecessor closure ∧
+      Applies ctx closure argument (.ctor schema.successor 1 [argument]) := by
+  refine ⟨.clos .many (predecessor :: environment) (.app (.ref schema.successor) (.var 0)),
+    appliesClosure (evaluatesLam _ _ _ _), ?_⟩
+  apply appliesClosure
+  refine evaluatesApp (f := .pap (.ctor schema.successor 1 1) []) ?_ (evaluatesVar rfl) ?_
+  · exact ⟨2, by simp [eval, matched.successor, saturate, Head.arity]⟩
+  · exact ⟨3, by simp [apply, saturate, fire, Head.arity]⟩
+
+theorem recursor_add {ctx : Ctx} {schema : Schema} (matched : Matches ctx schema)
+    (environment : List Value) {left right : Value} {m n : Nat}
+    (leftValue : Represents schema left m) (rightValue : Represents schema right n) :
+    ∃ result, Applies ctx (.pap (.rec_ schema.recursor 3) [left, stepValue schema environment]) right result ∧
+      Represents schema result (m + n) := by
+  have zero : Applies ctx (.pap (.rec_ schema.recursor 3) [left, stepValue schema environment])
+      (.lit (.nat 0)) left := by
+    apply appliesRecursorView matched.recursor rfl (by rfl) (by rfl) (by rfl)
+    exact evaluatesVar rfl
+  have successor {major predecessor result : Value} {number : Nat}
+      (view : majorCtor true major = .ok (1, [predecessor]))
+      (recursive : Applies ctx (.pap (.rec_ schema.recursor 3)
+        [left, stepValue schema environment]) predecessor result)
+      (represented : Represents schema result (m + number)) :
+      ∃ result, Applies ctx (.pap (.rec_ schema.recursor 3) [left, stepValue schema environment])
+        major result ∧ Represents schema result (m + (number + 1)) := by
+    obtain ⟨closure, first, second⟩ := step_applies matched environment predecessor result
+    refine ⟨.ctor schema.successor 1 [result], ?_, ?_⟩
+    · apply appliesRecursorView matched.recursor rfl view (by rfl) (by rfl)
+      refine evaluatesApp (evaluatesApp (evaluatesVar rfl) (evaluatesVar rfl) first) ?_ second
+      exact evaluatesApp
+        (evaluatesApp
+          (evaluatesApp (evaluatesVar rfl) (evaluatesVar rfl) (appliesRecursorFirst _ _ _))
+          (evaluatesVar rfl) (appliesRecursorSecond _ _ _ _))
+        (evaluatesVar rfl) recursive
+    · simpa only [Nat.add_assoc] using Represents.successor represented
+  induction rightValue with
+  | literal n =>
+      induction n with
+      | zero => exact ⟨left, zero, by simpa using leftValue⟩
+      | succ n ih =>
+          obtain ⟨result, recursive, represented⟩ := ih
+          exact successor (by rfl) recursive represented
+  | successor tail ih =>
+      obtain ⟨result, recursive, represented⟩ := ih
+      exact successor (by rfl) recursive represented
+
+theorem body_applies {ctx : Ctx} {schema : Schema} (matched : Matches ctx schema)
+    {left right : Value} {m n : Nat}
+    (leftValue : Represents schema left m) (rightValue : Represents schema right n) :
+    ∃ closure result,
+      Applies ctx (.clos .many [] (match body schema with | .lam _ body => body | _ => .erased)) left closure ∧
+      Applies ctx closure right result ∧ Represents schema result (m + n) := by
+  obtain ⟨result, recursive, represented⟩ := recursor_add matched [right, left] leftValue rightValue
+  refine ⟨_, result, appliesClosure (evaluatesLam _ _ _ _), ?_, represented⟩
+  apply appliesClosure
+  refine evaluatesApp
+    (evaluatesApp
+      (evaluatesApp ?_ (evaluatesVar rfl) (appliesRecursorFirst _ _ _))
+      (evaluatesLam _ _ _ _) (appliesRecursorSecond _ _ _ _))
+    (evaluatesVar rfl) recursive
+  exact evaluatesDef matched.alias (evaluatesRecursor matched.recursor)
+
+end Ix.Compiler.IxIR0.NatArithmetic
diff --git a/Ix/Compiler/IxIR0/NatRecursors.lean b/Ix/Compiler/IxIR0/NatRecursors.lean
new file mode 100644
index 000000000..0a5bb6e1e
--- /dev/null
+++ b/Ix/Compiler/IxIR0/NatRecursors.lean
@@ -0,0 +1,150 @@
+import Ix.Compiler.IxIR0.NatArithmetic
+
+namespace Ix.Compiler.IxIR0.NatArithmetic
+open Ix.Compiler.Ixon (Address)
+open Recursion
+
+/-- The ordinary usage checker requires a shared literal producer at these
+shared call sites. Erasure retains this constant closure application. -/
+def sharedLiteral (number : Nat) : Expr := .app (.lam .many (.lit (.nat number))) .erased
+
+theorem sharedLiteral_evaluates (ctx : Ctx) (environment : List Value) (number : Nat) :
+    Evaluates ctx environment (sharedLiteral number) (.lit (.nat number)) :=
+  evaluatesApp (evaluatesLam _ _ _ _) (evaluatesErased _ _) (appliesClosure (evaluatesLit _ _ _))
+
+def fold (step : Nat → Nat → Nat) (initial : Nat) : Nat → Nat
+  | 0 => initial
+  | n + 1 => step n (fold step initial n)
+
+/-- A reusable mathematical contract for the canonical recursor. Its step
+is an ordinary source closure and may itself call other proved functions. -/
+theorem recursor_fold {ctx : Ctx} {schema : Schema} (matched : Matches ctx schema)
+    (step : Nat → Nat → Nat) (function : Value)
+    (stepApplies : ∀ predecessor argument m n, Represents schema predecessor m → Represents schema argument n →
+      ∃ closure result, Applies ctx function predecessor closure ∧ Applies ctx closure argument result ∧
+        Represents schema result (step m n))
+    {initial major : Value} {m n : Nat} (initialValue : Represents schema initial m) (majorValue : Represents schema major n) :
+    ∃ result, Applies ctx (.pap (.rec_ schema.recursor 3) [initial, function]) major result ∧
+      Represents schema result (fold step m n) := by
+  have zero : Applies ctx (.pap (.rec_ schema.recursor 3) [initial, function]) (.lit (.nat 0)) initial := by
+    apply appliesRecursorView matched.recursor rfl rfl rfl rfl
+    exact evaluatesVar rfl
+  have successor {major predecessor result : Value} {number : Nat}
+      (view : majorCtor true major = .ok (1, [predecessor])) (predecessorValue : Represents schema predecessor number)
+      (recursive : Applies ctx (.pap (.rec_ schema.recursor 3) [initial, function]) predecessor result)
+      (represented : Represents schema result (fold step m number)) :
+      ∃ result, Applies ctx (.pap (.rec_ schema.recursor 3) [initial, function]) major result ∧
+        Represents schema result (fold step m (number + 1)) := by
+    obtain ⟨closure, result, first, second, represented⟩ := stepApplies predecessor result number _ predecessorValue represented
+    refine ⟨result, ?_, represented⟩
+    apply appliesRecursorView matched.recursor rfl view rfl rfl
+    refine evaluatesApp (evaluatesApp (evaluatesVar rfl) (evaluatesVar rfl) first) ?_ second
+    exact evaluatesApp
+      (evaluatesApp (evaluatesApp (evaluatesVar rfl) (evaluatesVar rfl) (appliesRecursorFirst _ _ _))
+        (evaluatesVar rfl) (appliesRecursorSecond _ _ _ _))
+      (evaluatesVar rfl) recursive
+  induction majorValue with
+  | literal n =>
+      induction n with
+      | zero => exact ⟨initial, zero, initialValue⟩
+      | succ n ih =>
+          obtain ⟨result, recursive, represented⟩ := ih
+          exact successor rfl (.literal n) recursive represented
+  | successor predecessor ih =>
+      obtain ⟨result, recursive, represented⟩ := ih
+      exact successor rfl predecessor recursive represented
+
+def predStep : Expr := .lam .many (.lam .many (.var 1))
+def predExpression (schema : Schema) : Expr :=
+  .app (.app (.app (.ref schema.alias) (sharedLiteral 0)) predStep) (.var 0)
+def predBody (schema : Schema) : Expr := .lam .many (predExpression schema)
+def predValue (schema : Schema) : Value := .clos .many [] (predExpression schema)
+
+theorem fold_predecessor (value : Nat) : fold (fun predecessor _ => predecessor) 0 value = value - 1 := by
+  cases value <;> rfl
+
+theorem pred_applies {ctx : Ctx} {schema : Schema} (matched : Matches ctx schema)
+    {value : Value} {number : Nat} (represented : Represents schema value number) :
+    ∃ result, Applies ctx (predValue schema) value result ∧ Represents schema result (number - 1) := by
+  let stepFunction : Value := .clos .many [value] (.lam .many (.var 1))
+  have stepApplies : ∀ predecessor argument m n, Represents schema predecessor m → Represents schema argument n →
+      ∃ closure result, Applies ctx stepFunction predecessor closure ∧ Applies ctx closure argument result ∧ Represents schema result m := by
+    intro predecessor argument m n predRep argRep
+    exact ⟨_, predecessor, appliesClosure (evaluatesLam _ _ _ _), appliesClosure (evaluatesVar rfl), predRep⟩
+  obtain ⟨result, recursive, resultRep⟩ := recursor_fold matched (fun predecessor _ => predecessor) stepFunction
+    stepApplies (.literal 0) represented
+  refine ⟨result, ?_, by simpa only [fold_predecessor] using resultRep⟩
+  apply appliesClosure
+  exact evaluatesApp
+    (evaluatesApp (evaluatesApp (evaluatesDef matched.alias (evaluatesRecursor matched.recursor))
+      (sharedLiteral_evaluates _ _ _) (appliesRecursorFirst _ _ _))
+      (evaluatesLam _ _ _ _) (appliesRecursorSecond _ _ _ _))
+    (evaluatesVar rfl) recursive
+
+def subStep (predecessor : Address) : Expr := .lam .many (.lam .many (.app (.ref predecessor) (.var 0)))
+def subExpression (schema : Schema) (predecessor : Address) : Expr :=
+  .app (.app (.app (.ref schema.alias) (.var 1)) (subStep predecessor)) (.var 0)
+def subBody (schema : Schema) (predecessor : Address) : Expr := .lam .many (.lam .many (subExpression schema predecessor))
+def subValue (schema : Schema) (predecessor : Address) : Value := .clos .many [] (.lam .many (subExpression schema predecessor))
+
+theorem fold_subtract (left right : Nat) : fold (fun _ result => result - 1) left right = left - right := by
+  induction right with
+  | zero => rfl
+  | succ right ih => simp only [fold, ih, Nat.sub_sub]
+
+theorem sub_applies {ctx : Ctx} {schema : Schema} (matched : Matches ctx schema) {predecessor : Address}
+    (predDeclaration : ctx.env predecessor = some (.defn .shared (predBody schema)))
+    {left right : Value} {m n : Nat} (leftValue : Represents schema left m) (rightValue : Represents schema right n) :
+    ∃ closure result, Applies ctx (subValue schema predecessor) left closure ∧ Applies ctx closure right result ∧
+      Represents schema result (m - n) := by
+  let stepFunction : Value := .clos .many [right, left] (.lam .many (.app (.ref predecessor) (.var 0)))
+  have stepApplies : ∀ pred argument a b, Represents schema pred a → Represents schema argument b →
+      ∃ closure result, Applies ctx stepFunction pred closure ∧ Applies ctx closure argument result ∧
+        Represents schema result (b - 1) := by
+    intro pred argument a b predRep argRep
+    obtain ⟨result, applied, resultRep⟩ := pred_applies matched argRep
+    refine ⟨_, result, appliesClosure (evaluatesLam _ _ _ _), ?_, resultRep⟩
+    exact appliesClosure (evaluatesApp (evaluatesDef predDeclaration (evaluatesLam _ _ _ _)) (evaluatesVar rfl) applied)
+  obtain ⟨result, recursive, resultRep⟩ := recursor_fold matched (fun _ result => result - 1) stepFunction stepApplies leftValue rightValue
+  refine ⟨_, result, appliesClosure (evaluatesLam _ _ _ _), ?_, by simpa only [fold_subtract] using resultRep⟩
+  apply appliesClosure
+  exact evaluatesApp
+    (evaluatesApp (evaluatesApp (evaluatesDef matched.alias (evaluatesRecursor matched.recursor))
+      (evaluatesVar rfl) (appliesRecursorFirst _ _ _))
+      (evaluatesLam _ _ _ _) (appliesRecursorSecond _ _ _ _))
+    (evaluatesVar rfl) recursive
+
+theorem Represents.zero_view {schema : Schema} {value : Value} (represented : Represents schema value 0) :
+    majorCtor true value = .ok (0, []) := by
+  cases represented
+  rfl
+
+theorem Represents.successor_view {schema : Schema} {value : Value} {number : Nat}
+    (represented : Represents schema value number) (positive : number ≠ 0) :
+    ∃ predecessor, majorCtor true value = .ok (1, [predecessor]) ∧ Represents schema predecessor (number - 1) := by
+  cases represented with
+  | literal number =>
+      cases number with
+      | zero => contradiction
+      | succ number => exact ⟨.lit (.nat number), rfl, .literal _⟩
+  | successor tail => exact ⟨_, rfl, tail⟩
+
+def caseRules : Array RecRule := #[
+  { fields := 0, rhs := .app (.var 1) (sharedLiteral 0) },
+  { fields := 1, rhs := .app (.var 1) (.var 0) }]
+
+theorem case_zero {ctx : Ctx} {schema : Schema} {address : Address} {major zero successor result : Value}
+    (declaration : ctx.env address = some (.recursor 2 true caseRules))
+    (represented : Represents schema major 0) (selected : Applies ctx zero (.lit (.nat 0)) result) :
+    Applies ctx (.pap (.rec_ address 3) [zero, successor]) major result := by
+  apply appliesRecursorView declaration rfl represented.zero_view rfl rfl
+  exact evaluatesApp (evaluatesVar rfl) (sharedLiteral_evaluates _ _ _) selected
+
+theorem case_successor {ctx : Ctx} {address : Address} {major predecessor zero successor result : Value}
+    (declaration : ctx.env address = some (.recursor 2 true caseRules))
+    (view : majorCtor true major = .ok (1, [predecessor])) (selected : Applies ctx successor predecessor result) :
+    Applies ctx (.pap (.rec_ address 3) [zero, successor]) major result := by
+  apply appliesRecursorView declaration rfl view rfl rfl
+  exact evaluatesApp (evaluatesVar rfl) (evaluatesVar rfl) selected
+
+end Ix.Compiler.IxIR0.NatArithmetic
diff --git a/Ix/Compiler/IxIR0/ProjectionFree.lean b/Ix/Compiler/IxIR0/ProjectionFree.lean
new file mode 100644
index 000000000..ee3ef5889
--- /dev/null
+++ b/Ix/Compiler/IxIR0/ProjectionFree.lean
@@ -0,0 +1,429 @@
+import Ix.Compiler.IxIR0.ProjectionSafe
+
+/-!
+# Projection-free completeness for call-aware traces
+
+`ProjectionSafe.Eval` intentionally rejects the erased evaluator's absorbing
+`proj erased` case. This module supplies the complementary structural route:
+when every reachable expression is syntactically projection-free, every
+successful ordinary evaluation admits a call-aware trace. Closure bodies and
+recursor rules are covered through an explicit value/context invariant, so the
+result includes dynamically entered calls rather than only the surface term.
+-/
+
+namespace Ix.Compiler.IxIR0.ProjectionFree
+
+/-- Executable syntax check used by the structural completeness theorem. -/
+def syntaxSafe : IxIR0.Expr → Bool
+  | .var _ | .ref _ | .lit _ | .erased => true
+  | .app function argument => syntaxSafe function && syntaxSafe argument
+  | .lam _ body => syntaxSafe body
+  | .letE _ value body => syntaxSafe value && syntaxSafe body
+  | .proj _ _ => false
+
+/-- A source expression contains no projection node. -/
+abbrev ExprSafe (expr : IxIR0.Expr) : Prop := syntaxSafe expr = true
+
+/-- Every executable body stored by a declaration is projection-free. -/
+def declSafe : IxIR0.Decl → Bool
+  | .defn _ body => syntaxSafe body
+  | .ctor _ _ | .extern _ => true
+  | .recursor _ _ rules => rules.all fun rule => syntaxSafe rule.rhs
+
+/-- Runtime values retain the projection-free invariant on captured closure
+environments and bodies. Constructor and PAP arguments are checked
+recursively. -/
+inductive ValueSafe : IxIR0.Value → Prop where
+  | clos {uses env body} :
+      (∀ value ∈ env, ValueSafe value) →
+      ExprSafe body →
+      ValueSafe (.clos uses env body)
+  | pap {head args} :
+      (∀ value ∈ args, ValueSafe value) →
+      ValueSafe (.pap head args)
+  | ctor {address tag args} :
+      (∀ value ∈ args, ValueSafe value) →
+      ValueSafe (.ctor address tag args)
+  | lit {literal} : ValueSafe (.lit literal)
+  | erased : ValueSafe .erased
+
+/-- Pointwise projection-freedom for a runtime environment or argument list. -/
+def ValuesSafe (values : List IxIR0.Value) : Prop :=
+  ∀ value ∈ values, ValueSafe value
+
+namespace ValuesSafe
+
+theorem nil : ValuesSafe [] := by simp [ValuesSafe]
+
+theorem cons {value : IxIR0.Value} {values : List IxIR0.Value}
+    (hvalue : ValueSafe value) (hvalues : ValuesSafe values) :
+    ValuesSafe (value :: values) := by
+  intro candidate hmem
+  simp only [List.mem_cons] at hmem
+  rcases hmem with rfl | hmem
+  · exact hvalue
+  · exact hvalues candidate hmem
+
+theorem append {left right : List IxIR0.Value}
+    (hleft : ValuesSafe left) (hright : ValuesSafe right) :
+    ValuesSafe (left ++ right) := by
+  intro value hmem
+  rw [List.mem_append] at hmem
+  exact hmem.elim (hleft value) (hright value)
+
+theorem reverse {values : List IxIR0.Value} (hvalues : ValuesSafe values) :
+    ValuesSafe values.reverse := by
+  intro value hmem
+  exact hvalues value (List.mem_reverse.mp hmem)
+
+theorem drop {values : List IxIR0.Value} (hvalues : ValuesSafe values)
+    (count : Nat) : ValuesSafe (values.drop count) := by
+  intro value hmem
+  exact hvalues value (List.mem_of_mem_drop hmem)
+
+theorem dropLast {values : List IxIR0.Value}
+    (hvalues : ValuesSafe values) : ValuesSafe values.dropLast := by
+  intro value hmem
+  exact hvalues value (List.dropLast_subset values hmem)
+
+theorem getLast? {values : List IxIR0.Value} {value : IxIR0.Value}
+    (hvalues : ValuesSafe values) (hlast : values.getLast? = some value) :
+    ValueSafe value := by
+  obtain ⟨initial, heq⟩ := List.getLast?_eq_some_iff.mp hlast
+  apply hvalues value
+  rw [heq]
+  simp
+
+end ValuesSafe
+
+namespace ValueSafe
+
+/-- Constructor fields exposed by `majorCtor` inherit the runtime value
+invariant. Nat-literal peeling creates only another safe literal. -/
+theorem majorCtor {natLit : Bool} {major : IxIR0.Value} {tag : Nat}
+    {fields : List IxIR0.Value} (hvalue : ValueSafe major)
+    (hrun : IxIR0.majorCtor natLit major = .ok (tag, fields)) :
+    ValuesSafe fields := by
+  cases hvalue with
+  | clos _ _ => simp [IxIR0.majorCtor] at hrun
+  | pap _ => simp [IxIR0.majorCtor] at hrun
+  | ctor hargs =>
+      simp only [IxIR0.majorCtor] at hrun
+      cases Except.ok.inj hrun
+      exact hargs
+  | lit =>
+      rename_i literal
+      cases literal with
+      | str string => simp [IxIR0.majorCtor] at hrun
+      | nat number =>
+          cases number with
+          | zero =>
+              cases natLit with
+              | false => simp [IxIR0.majorCtor] at hrun
+              | true =>
+                  simp [IxIR0.majorCtor] at hrun
+                  rcases hrun with ⟨rfl, rfl⟩
+                  exact ValuesSafe.nil
+          | succ number =>
+              cases natLit with
+              | false => simp [IxIR0.majorCtor] at hrun
+              | true =>
+                  simp [IxIR0.majorCtor] at hrun
+                  rcases hrun with ⟨rfl, rfl⟩
+                  exact ValuesSafe.cons .lit ValuesSafe.nil
+  | erased => simp [IxIR0.majorCtor] at hrun
+
+end ValueSafe
+
+/-- Projection-free declarations and safe oracle results form the closed-world
+invariant needed to follow references, recursor rules, and extern calls. -/
+structure CtxSafe (ctx : IxIR0.Ctx) : Prop where
+  env : ∀ address declaration,
+    ctx.env address = some declaration → declSafe declaration = true
+  oracle : ∀ address args result,
+    ValuesSafe args →
+    ctx.oracle address args = some result →
+    ValueSafe result
+
+private def CompleteAt (ctx : IxIR0.Ctx) (fuel : Nat) : Prop :=
+  (∀ env expr result,
+    ValuesSafe env → ExprSafe expr →
+    IxIR0.eval ctx fuel env expr = .ok result →
+    IxIR0.ProjectionSafe.Eval ctx fuel env expr result ∧ ValueSafe result) ∧
+  (∀ function argument result,
+    ValueSafe function → ValueSafe argument →
+    IxIR0.apply ctx fuel function argument = .ok result →
+    IxIR0.ProjectionSafe.Apply ctx fuel function argument result ∧
+      ValueSafe result) ∧
+  (∀ head args result,
+    ValuesSafe args →
+    IxIR0.saturate ctx fuel head args = .ok result →
+    IxIR0.ProjectionSafe.Saturate ctx fuel head args result ∧
+      ValueSafe result) ∧
+  (∀ head args result,
+    ValuesSafe args →
+    IxIR0.fire ctx fuel head args = .ok result →
+    IxIR0.ProjectionSafe.Fire ctx fuel head args result ∧ ValueSafe result)
+
+private theorem bindOk {error alpha beta : Type} (value : alpha)
+    (next : alpha → Except error beta) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem completeAt {ctx : IxIR0.Ctx} (hctx : CtxSafe ctx) :
+    ∀ fuel, CompleteAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro env expr result henv hexpr hrun
+        simp [IxIR0.eval.eq_def] at hrun
+      · intro function argument result hfunction hargument hrun
+        simp [IxIR0.apply.eq_def] at hrun
+      · intro head args result hargs hrun
+        simp [IxIR0.saturate.eq_def] at hrun
+      · intro head args result hargs hrun
+        simp [IxIR0.fire.eq_def] at hrun
+  | succ fuel ih =>
+      obtain ⟨ihEval, ihApply, ihSaturate, ihFire⟩ := ih
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro env expr result henv hexpr hrun
+        cases expr with
+        | var index =>
+            rw [IxIR0.eval.eq_def] at hrun
+            dsimp only at hrun
+            cases hlookup : env[index]? with
+            | none => rw [hlookup] at hrun; contradiction
+            | some value =>
+                rw [hlookup] at hrun
+                injection hrun with hresult
+                subst result
+                obtain ⟨hindex, hget⟩ :=
+                  List.getElem?_eq_some_iff.mp hlookup
+                exact ⟨.var hlookup,
+                  henv value (List.mem_iff_getElem.mpr
+                    ⟨index, hindex, hget⟩)⟩
+        | lit literal =>
+            rw [IxIR0.eval.eq_def] at hrun
+            injection hrun with hresult
+            subst result
+            exact ⟨.lit, .lit⟩
+        | erased =>
+            rw [IxIR0.eval.eq_def] at hrun
+            injection hrun with hresult
+            subst result
+            exact ⟨.erased, .erased⟩
+        | lam uses body =>
+            rw [IxIR0.eval.eq_def] at hrun
+            injection hrun with hresult
+            subst result
+            exact ⟨.lam, .clos henv hexpr⟩
+        | letE uses value body =>
+            have hparts := Bool.and_eq_true_iff.mp hexpr
+            rw [IxIR0.eval.eq_def] at hrun
+            dsimp only at hrun
+            cases hvalueRun : IxIR0.eval ctx fuel env value with
+            | error error => rw [hvalueRun] at hrun; contradiction
+            | ok bound =>
+                rw [hvalueRun] at hrun
+                obtain ⟨hvalueTrace, hbound⟩ :=
+                  ihEval env value bound henv hparts.1 hvalueRun
+                obtain ⟨hbodyTrace, hresult⟩ :=
+                  ihEval (bound :: env) body result
+                    (ValuesSafe.cons hbound henv) hparts.2 hrun
+                exact ⟨.letE hvalueTrace hbodyTrace, hresult⟩
+        | app function argument =>
+            have hparts := Bool.and_eq_true_iff.mp hexpr
+            rw [IxIR0.eval.eq_def] at hrun
+            dsimp only at hrun
+            cases hfunctionRun : IxIR0.eval ctx fuel env function with
+            | error error => rw [hfunctionRun] at hrun; contradiction
+            | ok functionValue =>
+                rw [hfunctionRun] at hrun
+                cases hargumentRun : IxIR0.eval ctx fuel env argument with
+                | error error => rw [hargumentRun] at hrun; contradiction
+                | ok argumentValue =>
+                    rw [hargumentRun] at hrun
+                    obtain ⟨hfunctionTrace, hfunction⟩ :=
+                      ihEval env function functionValue henv hparts.1
+                        hfunctionRun
+                    obtain ⟨hargumentTrace, hargument⟩ :=
+                      ihEval env argument argumentValue henv hparts.2
+                        hargumentRun
+                    obtain ⟨happlyTrace, hresult⟩ :=
+                      ihApply functionValue argumentValue result hfunction
+                        hargument hrun
+                    exact ⟨.app hfunctionTrace hargumentTrace happlyTrace,
+                      hresult⟩
+        | proj index source => cases hexpr
+        | ref address =>
+            rw [IxIR0.eval.eq_def] at hrun
+            dsimp only at hrun
+            cases hlookup : ctx.env address with
+            | none => rw [hlookup] at hrun; contradiction
+            | some declaration =>
+                rw [hlookup] at hrun
+                have hdeclaration := hctx.env address declaration hlookup
+                cases declaration with
+                | defn world body =>
+                    obtain ⟨hbodyTrace, hresult⟩ :=
+                      ihEval [] body result ValuesSafe.nil hdeclaration hrun
+                    exact ⟨.refDefn hlookup hbodyTrace, hresult⟩
+                | ctor tag arity =>
+                    obtain ⟨hsaturateTrace, hresult⟩ :=
+                      ihSaturate (.ctor address tag arity) [] result
+                        ValuesSafe.nil hrun
+                    exact ⟨.refCtor hlookup hsaturateTrace, hresult⟩
+                | recursor numArgs natLit rules =>
+                    injection hrun with hresult
+                    subst result
+                    exact ⟨.refRecursor hlookup, .pap ValuesSafe.nil⟩
+                | extern arity =>
+                    obtain ⟨hsaturateTrace, hresult⟩ :=
+                      ihSaturate (.ext address arity) [] result
+                        ValuesSafe.nil hrun
+                    exact ⟨.refExtern hlookup hsaturateTrace, hresult⟩
+      · intro function argument result hfunction hargument hrun
+        cases hfunction with
+        | clos henv hbody =>
+            rw [IxIR0.apply.eq_def] at hrun
+            obtain ⟨hbodyTrace, hresult⟩ :=
+              ihEval _ _ _ (ValuesSafe.cons hargument henv) hbody hrun
+            exact ⟨.clos hbodyTrace, hresult⟩
+        | pap hargs =>
+            rw [IxIR0.apply.eq_def] at hrun
+            obtain ⟨hsaturateTrace, hresult⟩ :=
+              ihSaturate _ _ _
+                (ValuesSafe.append hargs
+                  (ValuesSafe.cons hargument ValuesSafe.nil)) hrun
+            exact ⟨.pap hsaturateTrace, hresult⟩
+        | ctor hargs =>
+            rw [IxIR0.apply.eq_def] at hrun
+            contradiction
+        | lit =>
+            rw [IxIR0.apply.eq_def] at hrun
+            contradiction
+        | erased =>
+            rw [IxIR0.apply.eq_def] at hrun
+            injection hrun with hresult
+            subst result
+            exact ⟨.erased, .erased⟩
+      · intro head args result hargs hrun
+        rw [IxIR0.saturate.eq_def] at hrun
+        dsimp only at hrun
+        by_cases hlength : args.length = head.arity
+        · simp only [beq_iff_eq.mpr hlength, if_true] at hrun
+          obtain ⟨hfireTrace, hresult⟩ := ihFire head args result hargs hrun
+          exact ⟨.full hlength hfireTrace, hresult⟩
+        · have hbeq : (args.length == head.arity) = false := by
+            exact Bool.eq_false_iff.mpr fun htrue =>
+              hlength (beq_iff_eq.mp htrue)
+          simp only [hbeq, Bool.false_eq_true, if_false] at hrun
+          injection hrun with hresult
+          subst result
+          exact ⟨.pending hlength, .pap hargs⟩
+      · intro head args result hargs hrun
+        cases head with
+        | ctor address tag arity =>
+            rw [IxIR0.fire.eq_def] at hrun
+            injection hrun with hresult
+            subst result
+            exact ⟨.ctor, .ctor hargs⟩
+        | ext address arity =>
+            rw [IxIR0.fire.eq_def] at hrun
+            dsimp only at hrun
+            cases horacle : ctx.oracle address args with
+            | none => rw [horacle] at hrun; contradiction
+            | some value =>
+                rw [horacle] at hrun
+                injection hrun with hresult
+                subst result
+                exact ⟨.extern horacle,
+                  hctx.oracle address args value hargs horacle⟩
+        | rec_ address arity =>
+            rw [IxIR0.fire.eq_def] at hrun
+            dsimp only at hrun
+            cases hlookup : ctx.env address with
+            | none => rw [hlookup] at hrun; contradiction
+            | some declaration =>
+                rw [hlookup] at hrun
+                have hdeclaration := hctx.env address declaration hlookup
+                cases declaration with
+                | defn world body => contradiction
+                | ctor tag ctorArity => contradiction
+                | extern externArity => contradiction
+                | recursor numArgs natLit rules =>
+                    dsimp only at hrun
+                    cases hlast : args.getLast? with
+                    | none => rw [hlast] at hrun; contradiction
+                    | some major =>
+                        rw [hlast] at hrun
+                        dsimp only at hrun
+                        cases hmajor : IxIR0.majorCtor natLit major with
+                        | error error =>
+                            rw [hmajor] at hrun
+                            contradiction
+                        | ok pair =>
+                            rcases pair with ⟨tag, fields⟩
+                            rw [hmajor, bindOk] at hrun
+                            dsimp only at hrun
+                            cases hrule : rules[tag]? with
+                            | none => rw [hrule] at hrun; contradiction
+                            | some rule =>
+                                rw [hrule] at hrun
+                                dsimp only at hrun
+                                by_cases hfields : fields.length = rule.fields
+                                · have hfieldBeq :
+                                      (fields.length != rule.fields) = false := by
+                                    simp [hfields]
+                                  rw [hfieldBeq] at hrun
+                                  obtain ⟨hruleIndex, hruleGet⟩ :=
+                                    Array.getElem?_eq_some_iff.mp hrule
+                                  have hruleSafe :=
+                                    (Array.all_eq_true.mp hdeclaration)
+                                      tag hruleIndex
+                                  rw [hruleGet] at hruleSafe
+                                  have hmajorSafe :=
+                                    ValuesSafe.getLast? hargs hlast
+                                  have hfieldsSafe :=
+                                    hmajorSafe.majorCtor hmajor
+                                  have hbodyEnv : ValuesSafe
+                                      (fields.reverse ++
+                                        args.dropLast.reverse ++
+                                        [.pap (.rec_ address arity) []]) :=
+                                    by
+                                      simpa only [List.append_assoc] using
+                                        ValuesSafe.append hfieldsSafe.reverse
+                                          (ValuesSafe.append
+                                            hargs.dropLast.reverse
+                                            (ValuesSafe.cons
+                                              (.pap ValuesSafe.nil)
+                                              ValuesSafe.nil))
+                                  obtain ⟨hbodyTrace, hresult⟩ :=
+                                    ihEval _ rule.rhs result hbodyEnv
+                                      hruleSafe hrun
+                                  exact ⟨.recursor hlookup hlast hmajor hrule
+                                    hfields hbodyTrace, hresult⟩
+                                · have hfieldBne :
+                                      (fields.length != rule.fields) = true := by
+                                    simp [hfields]
+                                  rw [hfieldBne] at hrun
+                                  contradiction
+
+/-- Every successful evaluation of a projection-free closed-world state has
+an exact call-aware trace at the same fuel. -/
+theorem Eval.of_run {ctx : IxIR0.Ctx} (hctx : CtxSafe ctx)
+    {fuel : Nat} {env : List IxIR0.Value} {expr : IxIR0.Expr}
+    {result : IxIR0.Value} (henv : ValuesSafe env) (hexpr : ExprSafe expr)
+    (hrun : IxIR0.eval ctx fuel env expr = .ok result) :
+    IxIR0.ProjectionSafe.Eval ctx fuel env expr result :=
+  (completeAt hctx fuel).1 env expr result henv hexpr hrun |>.1
+
+/-- The completeness construction also records that its result preserves the
+runtime projection-free invariant. -/
+theorem Eval.resultSafe {ctx : IxIR0.Ctx} (hctx : CtxSafe ctx)
+    {fuel : Nat} {env : List IxIR0.Value} {expr : IxIR0.Expr}
+    {result : IxIR0.Value} (henv : ValuesSafe env) (hexpr : ExprSafe expr)
+    (hrun : IxIR0.eval ctx fuel env expr = .ok result) : ValueSafe result :=
+  (completeAt hctx fuel).1 env expr result henv hexpr hrun |>.2
+
+end Ix.Compiler.IxIR0.ProjectionFree
diff --git a/Ix/Compiler/IxIR0/ProjectionSafe.lean b/Ix/Compiler/IxIR0/ProjectionSafe.lean
new file mode 100644
index 000000000..0febdaa0d
--- /dev/null
+++ b/Ix/Compiler/IxIR0/ProjectionSafe.lean
@@ -0,0 +1,642 @@
+import Ix.Compiler.IxIR0.Eval
+
+/-!
+# Call-aware projection-safe IxIR₀ execution
+
+`IxIR0.eval` deliberately maps projection from `erased` to `erased`. That is
+the right erasure semantics, but IxIR₁ lowers a runtime projection to a
+concrete fetch, where the same shape is ordinary stuckness. Successful target
+progress therefore needs more than an `IxIR0.eval = .ok` equation.
+
+The four mutually inductive traces below mirror the four mutually recursive
+IxIR₀ evaluator functions at their exact fuel. They retain every executed
+expression body, including closure bodies and recursor rules reached through
+`apply`/`saturate`/`fire`, and intentionally have no constructor for projection
+from `erased`. This makes source evaluator fuel available as the well-founded
+measure for total-correctness proofs whose target fuel is existential.
+-/
+
+namespace Ix.Compiler.IxIR0.ProjectionSafe
+
+open Ix.Compiler.Ixon (Address Uses)
+
+mutual
+
+  /-- A successful `eval` trace in which every dynamically reached projection
+  scrutinizes a constructor. -/
+  inductive Eval (ctx : Ctx) :
+      Nat → List Value → Expr → Value → Prop where
+    | var {fuel : Nat} {env : List Value} {index : Nat} {value : Value} :
+        env[index]? = some value →
+        Eval ctx (fuel + 1) env (.var index) value
+    | lit {fuel : Nat} {env : List Value} {literal : Literal} :
+        Eval ctx (fuel + 1) env (.lit literal) (.lit literal)
+    | erased {fuel : Nat} {env : List Value} :
+        Eval ctx (fuel + 1) env .erased .erased
+    | lam {fuel : Nat} {env : List Value} {uses : Uses} {body : Expr} :
+        Eval ctx (fuel + 1) env (.lam uses body) (.clos uses env body)
+    | letE {fuel : Nat} {env : List Value} {uses : Uses}
+        {value body : Expr} {bound result : Value} :
+        Eval ctx fuel env value bound →
+        Eval ctx fuel (bound :: env) body result →
+        Eval ctx (fuel + 1) env (.letE uses value body) result
+    | app {fuel : Nat} {env : List Value} {function argument : Expr}
+        {functionValue argumentValue result : Value} :
+        Eval ctx fuel env function functionValue →
+        Eval ctx fuel env argument argumentValue →
+        Apply ctx fuel functionValue argumentValue result →
+        Eval ctx (fuel + 1) env (.app function argument) result
+    | proj {fuel : Nat} {env : List Value} {index : Nat} {source : Expr}
+        {address : Address} {tag : Nat} {fields : List Value}
+        {result : Value} :
+        Eval ctx fuel env source (.ctor address tag fields) →
+        fields[index]? = some result →
+        Eval ctx (fuel + 1) env (.proj index source) result
+    | refDefn {fuel : Nat} {env : List Value} {address : Address}
+        {world : Ix.Compiler.Ixon.Owned} {body : Expr} {result : Value} :
+        ctx.env address = some (.defn world body) →
+        Eval ctx fuel [] body result →
+        Eval ctx (fuel + 1) env (.ref address) result
+    | refCtor {fuel : Nat} {env : List Value} {address : Address}
+        {tag arity : Nat} {result : Value} :
+        ctx.env address = some (.ctor tag arity) →
+        Saturate ctx fuel (.ctor address tag arity) [] result →
+        Eval ctx (fuel + 1) env (.ref address) result
+    | refRecursor {fuel : Nat} {env : List Value} {address : Address}
+        {numArgs : Nat} {natLit : Bool} {rules : Array RecRule} :
+        ctx.env address = some (.recursor numArgs natLit rules) →
+        Eval ctx (fuel + 1) env (.ref address)
+          (.pap (.rec_ address (numArgs + 1)) [])
+    | refExtern {fuel : Nat} {env : List Value} {address : Address}
+        {arity : Nat} {result : Value} :
+        ctx.env address = some (.extern arity) →
+        Saturate ctx fuel (.ext address arity) [] result →
+        Eval ctx (fuel + 1) env (.ref address) result
+
+  /-- A successful call-aware `apply` trace. Closure entry is where the
+  dynamically selected body re-enters `Eval`. -/
+  inductive Apply (ctx : Ctx) : Nat → Value → Value → Value → Prop where
+    | clos {fuel : Nat} {uses : Uses} {env : List Value} {body : Expr}
+        {argument result : Value} :
+        Eval ctx fuel (argument :: env) body result →
+        Apply ctx (fuel + 1) (.clos uses env body) argument result
+    | pap {fuel : Nat} {head : Head} {captured : List Value}
+        {argument result : Value} :
+        Saturate ctx fuel head (captured ++ [argument]) result →
+        Apply ctx (fuel + 1) (.pap head captured) argument result
+    | erased {fuel : Nat} {argument : Value} :
+        Apply ctx (fuel + 1) .erased argument .erased
+
+  /-- A successful `saturate` trace. -/
+  inductive Saturate (ctx : Ctx) :
+      Nat → Head → List Value → Value → Prop where
+    | pending {fuel : Nat} {head : Head} {args : List Value} :
+        args.length ≠ head.arity →
+        Saturate ctx (fuel + 1) head args (.pap head args)
+    | full {fuel : Nat} {head : Head} {args : List Value}
+        {result : Value} :
+        args.length = head.arity →
+        Fire ctx fuel head args result →
+        Saturate ctx (fuel + 1) head args result
+
+  /-- A successful `fire` trace. The recursor constructor retains the exact
+  selected rule-body execution and hence any projections reached inside it. -/
+  inductive Fire (ctx : Ctx) :
+      Nat → Head → List Value → Value → Prop where
+    | ctor {fuel : Nat} {address : Address} {tag arity : Nat}
+        {args : List Value} :
+        Fire ctx (fuel + 1) (.ctor address tag arity) args
+          (.ctor address tag args)
+    | extern {fuel : Nat} {address : Address} {arity : Nat}
+        {args : List Value} {result : Value} :
+        ctx.oracle address args = some result →
+        Fire ctx (fuel + 1) (.ext address arity) args result
+    | recursor {fuel : Nat} {address : Address} {arity numArgs : Nat}
+        {natLit : Bool} {rules : Array RecRule} {args : List Value}
+        {major : Value} {tag : Nat} {fields : List Value}
+        {rule : RecRule} {result : Value} :
+        ctx.env address = some (.recursor numArgs natLit rules) →
+        args.getLast? = some major →
+        majorCtor natLit major = .ok (tag, fields) →
+        rules[tag]? = some rule →
+        fields.length = rule.fields →
+        Eval ctx fuel
+          (fields.reverse ++ args.dropLast.reverse ++
+            [.pap (.rec_ address arity) []])
+          rule.rhs result →
+        Fire ctx (fuel + 1) (.rec_ address arity) args result
+
+end
+
+private theorem bindOk {error alpha beta : Type} (value : alpha)
+    (next : alpha → Except error beta) :
+    (Except.ok value >>= next) = next value := rfl
+
+mutual
+
+  /-- A safe evaluation trace executes successfully at its recorded fuel. -/
+  theorem Eval.run {ctx : Ctx} {fuel : Nat} {env : List Value}
+      {expr : Expr} {value : Value}
+      (htrace : Eval ctx fuel env expr value) :
+      eval ctx fuel env expr = .ok value := by
+    cases htrace with
+    | var hlookup =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hlookup]
+    | lit => rw [eval.eq_def]
+    | erased => rw [eval.eq_def]
+    | lam => rw [eval.eq_def]
+    | letE hvalue hbody =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hvalue.run, bindOk]
+        exact hbody.run
+    | app hfunction hargument happly =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hfunction.run, bindOk, hargument.run, bindOk]
+        exact happly.run
+    | proj hsource hfield =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hsource.run, bindOk]
+        simp only
+        rw [hfield]
+    | refDefn hdecl hbody =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hdecl]
+        exact hbody.run
+    | refCtor hdecl hsaturate =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hdecl]
+        exact hsaturate.run
+    | refRecursor hdecl =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hdecl]
+    | refExtern hdecl hsaturate =>
+        rw [eval.eq_def]
+        dsimp only
+        rw [hdecl]
+        exact hsaturate.run
+
+  /-- A safe application trace executes successfully at its recorded fuel. -/
+  theorem Apply.run {ctx : Ctx} {fuel : Nat} {function argument result : Value}
+      (htrace : Apply ctx fuel function argument result) :
+      apply ctx fuel function argument = .ok result := by
+    cases htrace with
+    | clos hbody =>
+        rw [apply.eq_def]
+        exact hbody.run
+    | pap hsaturate =>
+        rw [apply.eq_def]
+        exact hsaturate.run
+    | erased => rw [apply.eq_def]
+
+  /-- A safe saturation trace executes successfully at its recorded fuel. -/
+  theorem Saturate.run {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value}
+      (htrace : Saturate ctx fuel head args result) :
+      saturate ctx fuel head args = .ok result := by
+    cases htrace with
+    | pending hlength =>
+        rw [saturate.eq_def]
+        dsimp only
+        simp [hlength]
+    | full hlength hfire =>
+        rw [saturate.eq_def]
+        dsimp only
+        simp only [beq_iff_eq.mpr hlength, if_true]
+        exact hfire.run
+
+  /-- A safe firing trace executes successfully at its recorded fuel. -/
+  theorem Fire.run {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value}
+      (htrace : Fire ctx fuel head args result) :
+      fire ctx fuel head args = .ok result := by
+    cases htrace with
+    | ctor => rw [fire.eq_def]
+    | extern horacle =>
+        rw [fire.eq_def]
+        dsimp only
+        rw [horacle]
+    | recursor hdecl hlast hmajor hrule hfields hbody =>
+        rw [fire.eq_def]
+        dsimp only
+        rw [hdecl]
+        dsimp only
+        rw [hlast]
+        dsimp only
+        rw [hmajor, bindOk]
+        dsimp only
+        rw [hrule]
+        dsimp only
+        simp only [hfields, bne_self_eq_false]
+        exact hbody.run
+
+end
+
+/-- A reference trace is independent of the ambient local environment: every
+reference constructor evaluates its declaration from the closed environment. -/
+theorem Eval.ref_closed {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {address : Address} {value : Value}
+    (htrace : Eval ctx fuel env (.ref address) value) :
+    Eval ctx fuel [] (.ref address) value := by
+  cases htrace with
+  | refDefn hdecl hbody => exact .refDefn hdecl hbody
+  | refCtor hdecl hsaturate => exact .refCtor hdecl hsaturate
+  | refRecursor hdecl => exact .refRecursor hdecl
+  | refExtern hdecl hsaturate => exact .refExtern hdecl hsaturate
+
+mutual
+
+  /-- Projection-safe evaluation is monotone in fuel. -/
+  theorem Eval.mono {ctx : Ctx} {fuel : Nat} {env : List Value}
+      {expr : Expr} {value : Value}
+      (htrace : Eval ctx fuel env expr value) :
+      Eval ctx (fuel + 1) env expr value := by
+    cases htrace with
+    | var hlookup => exact .var hlookup
+    | lit => exact .lit
+    | erased => exact .erased
+    | lam => exact .lam
+    | letE hvalue hbody => exact .letE hvalue.mono hbody.mono
+    | app hfunction hargument happly =>
+        exact .app hfunction.mono hargument.mono happly.mono
+    | proj hsource hfield => exact .proj hsource.mono hfield
+    | refDefn hdecl hbody => exact .refDefn hdecl hbody.mono
+    | refCtor hdecl hsaturate => exact .refCtor hdecl hsaturate.mono
+    | refRecursor hdecl => exact .refRecursor hdecl
+    | refExtern hdecl hsaturate => exact .refExtern hdecl hsaturate.mono
+
+  /-- Projection-safe application is monotone in fuel. -/
+  theorem Apply.mono {ctx : Ctx} {fuel : Nat}
+      {function argument result : Value}
+      (htrace : Apply ctx fuel function argument result) :
+      Apply ctx (fuel + 1) function argument result := by
+    cases htrace with
+    | clos hbody => exact .clos hbody.mono
+    | pap hsaturate => exact .pap hsaturate.mono
+    | erased => exact .erased
+
+  /-- Projection-safe saturation is monotone in fuel. -/
+  theorem Saturate.mono {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value}
+      (htrace : Saturate ctx fuel head args result) :
+      Saturate ctx (fuel + 1) head args result := by
+    cases htrace with
+    | pending hlength => exact .pending hlength
+    | full hlength hfire => exact .full hlength hfire.mono
+
+  /-- Projection-safe firing is monotone in fuel. -/
+  theorem Fire.mono {ctx : Ctx} {fuel : Nat} {head : Head}
+      {args : List Value} {result : Value}
+      (htrace : Fire ctx fuel head args result) :
+      Fire ctx (fuel + 1) head args result := by
+    cases htrace with
+    | ctor => exact .ctor
+    | extern horacle => exact .extern horacle
+    | recursor hdecl hlast hmajor hrule hfields hbody =>
+        exact .recursor hdecl hlast hmajor hrule hfields hbody.mono
+
+end
+
+theorem Eval.mono_le {ctx : Ctx} {smaller larger : Nat}
+    {env : List Value} {expr : Expr} {value : Value}
+    (hbound : smaller ≤ larger) (htrace : Eval ctx smaller env expr value) :
+    Eval ctx larger env expr value := by
+  induction hbound with
+  | refl => exact htrace
+  | step hbound ih => exact ih.mono
+
+theorem Apply.mono_le {ctx : Ctx} {smaller larger : Nat}
+    {function argument result : Value}
+    (hbound : smaller ≤ larger)
+    (htrace : Apply ctx smaller function argument result) :
+    Apply ctx larger function argument result := by
+  induction hbound with
+  | refl => exact htrace
+  | step hbound ih => exact ih.mono
+
+theorem Saturate.mono_le {ctx : Ctx} {smaller larger : Nat}
+    {head : Head} {args : List Value} {result : Value}
+    (hbound : smaller ≤ larger)
+    (htrace : Saturate ctx smaller head args result) :
+    Saturate ctx larger head args result := by
+  induction hbound with
+  | refl => exact htrace
+  | step hbound ih => exact ih.mono
+
+theorem Fire.mono_le {ctx : Ctx} {smaller larger : Nat}
+    {head : Head} {args : List Value} {result : Value}
+    (hbound : smaller ≤ larger)
+    (htrace : Fire ctx smaller head args result) :
+    Fire ctx larger head args result := by
+  induction hbound with
+  | refl => exact htrace
+  | step hbound ih => exact ih.mono
+
+/-- A call-aware n-ary application spine whose every individual application
+executes strictly below one enclosing source-evaluator fuel.  The common
+bound is the well-founded index used by lowering progress: entering a closure
+or recursor rule exposes an `Eval` trace at a strictly smaller fuel. -/
+inductive AppliesBelow (ctx : Ctx) (limit : Nat) :
+    Value → List Value → Value → Prop where
+  | nil {value : Value} : AppliesBelow ctx limit value [] value
+  | cons {fuel : Nat} {function argument middle result : Value}
+      {arguments : List Value} :
+      fuel < limit →
+      Apply ctx fuel function argument middle →
+      AppliesBelow ctx limit middle arguments result →
+      AppliesBelow ctx limit function (argument :: arguments) result
+
+/-- Dependent traversal of a bounded application spine. Clients receive the
+exact head fuel bound and application trace, the original tail derivation,
+and the recursively produced result while the initial value, remaining
+arguments, and final value stay synchronized. -/
+theorem AppliesBelow.traverse {ctx : Ctx} {limit : Nat}
+    {Result : Value → List Value → Value → Prop}
+    (hnil : ∀ value, Result value [] value)
+    (hcons : ∀ {function argument middle result : Value}
+        {arguments : List Value} {fuel : Nat},
+      fuel < limit →
+      Apply ctx fuel function argument middle →
+      AppliesBelow ctx limit middle arguments result →
+      Result middle arguments result →
+      Result function (argument :: arguments) result)
+    {function result : Value} {arguments : List Value}
+    (hspine : AppliesBelow ctx limit function arguments result) :
+    Result function arguments result := by
+  induction hspine with
+  | nil => exact hnil _
+  | cons hfuel hstep htail ih => exact hcons hfuel hstep htail ih
+
+/-- Increasing the enclosing source-fuel bound preserves a safe spine. -/
+theorem AppliesBelow.mono_limit {ctx : Ctx} {smaller larger : Nat}
+    {function result : Value} {arguments : List Value}
+    (hspine : AppliesBelow ctx smaller function arguments result)
+    (hbound : smaller ≤ larger) :
+    AppliesBelow ctx larger function arguments result := by
+  exact AppliesBelow.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      AppliesBelow ctx larger currentFunction currentArguments currentResult)
+    (hnil := fun _ => .nil)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hfuel hstep htail ih
+      exact .cons (Nat.lt_of_lt_of_le hfuel hbound) hstep ih)
+    hspine
+
+/-- Applying one safe prefix and then another applies their concatenation. -/
+theorem AppliesBelow.append {ctx : Ctx} {limit : Nat}
+    {function middle result : Value} {left right : List Value}
+    (hleft : AppliesBelow ctx limit function left middle)
+    (hright : AppliesBelow ctx limit middle right result) :
+    AppliesBelow ctx limit function (left ++ right) result := by
+  exact (AppliesBelow.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      ∀ {remaining final},
+        AppliesBelow ctx limit currentResult remaining final →
+        AppliesBelow ctx limit currentFunction
+          (currentArguments ++ remaining) final)
+    (hnil := by
+      intro value remaining final hremaining
+      simpa using hremaining)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hfuel hstep htail ih remaining final hremaining
+      exact .cons hfuel hstep (ih hremaining))
+    hleft) hright
+
+/-- Add one final safe application to a completed spine. -/
+theorem AppliesBelow.snoc {ctx : Ctx} {limit fuel : Nat}
+    {function middle result argument : Value} {arguments : List Value}
+    (hspine : AppliesBelow ctx limit function arguments middle)
+    (hfuel : fuel < limit)
+    (hstep : Apply ctx fuel middle argument result) :
+    AppliesBelow ctx limit function (arguments ++ [argument]) result :=
+  hspine.append (.cons hfuel hstep .nil)
+
+/-- Split at the same numeric boundary used by `take`/`drop` call lowering. -/
+theorem AppliesBelow.splitAt {ctx : Ctx} {limit : Nat}
+    {function result : Value} {arguments : List Value}
+    (hspine : AppliesBelow ctx limit function arguments result)
+    (count : Nat) :
+    ∃ middle,
+      AppliesBelow ctx limit function (arguments.take count) middle ∧
+      AppliesBelow ctx limit middle (arguments.drop count) result := by
+  exact (AppliesBelow.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      ∀ currentCount,
+        ∃ middle,
+          AppliesBelow ctx limit currentFunction
+              (currentArguments.take currentCount) middle ∧
+            AppliesBelow ctx limit middle
+              (currentArguments.drop currentCount) currentResult)
+    (hnil := by
+      intro value currentCount
+      simp
+      exact ⟨value, .nil, .nil⟩)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hfuel hstep htail ih currentCount
+      cases currentCount with
+      | zero => exact ⟨currentFunction, .nil, .cons hfuel hstep htail⟩
+      | succ currentCount =>
+        obtain ⟨middle, hprefix, hsuffix⟩ := ih currentCount
+        exact ⟨middle, .cons hfuel hstep hprefix, hsuffix⟩)
+    hspine) count
+
+/-- Split a bounded safe application spine at an arbitrary list boundary. -/
+theorem AppliesBelow.split {ctx : Ctx} {limit : Nat}
+    {function result : Value} :
+    ∀ {left right : List Value},
+      AppliesBelow ctx limit function (left ++ right) result →
+      ∃ middle,
+        AppliesBelow ctx limit function left middle ∧
+        AppliesBelow ctx limit middle right result := by
+  intro left right hspine
+  simpa using AppliesBelow.splitAt hspine left.length
+
+/-- A single safe application below the enclosing fuel is a singleton
+application spine. -/
+theorem Apply.toAppliesBelow {ctx : Ctx} {limit fuel : Nat}
+    {function argument result : Value}
+    (htrace : Apply ctx fuel function argument result)
+    (hbound : fuel < limit) :
+    AppliesBelow ctx limit function [argument] result :=
+  .cons hbound htrace .nil
+
+/-- Pointwise argument evaluations below one enclosing expression fuel. -/
+inductive EvalsBelow (ctx : Ctx) (limit : Nat) (env : List Value) :
+    List Expr → List Value → Prop where
+  | nil : EvalsBelow ctx limit env [] []
+  | cons {fuel : Nat} {expr : Expr} {value : Value}
+      {expressions : List Expr} {values : List Value} :
+      fuel < limit →
+      Eval ctx fuel env expr value →
+      EvalsBelow ctx limit env expressions values →
+      EvalsBelow ctx limit env (expr :: expressions) (value :: values)
+
+/-- Dependent lockstep traversal of bounded projection-safe argument traces.
+Each callback receives the exact fuel bound, head trace, and original tail
+derivation together with the recursively produced result. -/
+theorem EvalsBelow.traverse {ctx : Ctx} {limit : Nat} {env : List Value}
+    {Result : List Expr → List Value → Prop}
+    (hnil : Result [] [])
+    (hcons : ∀ {fuel : Nat} {expr : Expr} {value : Value}
+        {expressions : List Expr} {values : List Value},
+      fuel < limit →
+      Eval ctx fuel env expr value →
+      EvalsBelow ctx limit env expressions values →
+      Result expressions values →
+      Result (expr :: expressions) (value :: values))
+    {expressions : List Expr} {values : List Value}
+    (hargs : EvalsBelow ctx limit env expressions values) :
+    Result expressions values := by
+  induction hargs with
+  | nil => exact hnil
+  | cons hfuel heval htail ih => exact hcons hfuel heval htail ih
+
+theorem EvalsBelow.mono_limit {ctx : Ctx} {smaller larger : Nat}
+    {env : List Value} {expressions : List Expr} {values : List Value}
+    (hargs : EvalsBelow ctx smaller env expressions values)
+    (hbound : smaller ≤ larger) :
+    EvalsBelow ctx larger env expressions values := by
+  exact EvalsBelow.traverse
+    (Result := fun currentExpressions currentValues =>
+      EvalsBelow ctx larger env currentExpressions currentValues)
+    (hnil := .nil)
+    (hcons := by
+      intro fuel expr value currentExpressions currentValues hfuel heval
+        htail ih
+      exact .cons (Nat.lt_of_lt_of_le hfuel hbound) heval ih)
+    hargs
+
+@[simp] theorem EvalsBelow.lengths {ctx : Ctx} {limit : Nat}
+    {env : List Value} {expressions : List Expr} {values : List Value}
+    (hargs : EvalsBelow ctx limit env expressions values) :
+    expressions.length = values.length := by
+  exact EvalsBelow.traverse
+    (Result := fun currentExpressions currentValues =>
+      currentExpressions.length = currentValues.length)
+    (hnil := rfl)
+    (hcons := by
+      intro fuel expr value currentExpressions currentValues hfuel heval
+        htail ih
+      simp [ih])
+    hargs
+
+/-- Exact-fuel argument safety is inherited by every prefix. -/
+theorem EvalsBelow.take {ctx : Ctx} {limit : Nat}
+    {env : List Value} {expressions : List Expr} {values : List Value}
+    (hargs : EvalsBelow ctx limit env expressions values) (count : Nat) :
+    EvalsBelow ctx limit env (expressions.take count) (values.take count) := by
+  exact (EvalsBelow.traverse
+    (Result := fun currentExpressions currentValues =>
+      ∀ currentCount,
+        EvalsBelow ctx limit env (currentExpressions.take currentCount)
+          (currentValues.take currentCount))
+    (hnil := by
+      intro currentCount
+      simp
+      exact .nil)
+    (hcons := by
+      intro fuel expr value currentExpressions currentValues hfuel heval
+        htail ih currentCount
+      cases currentCount with
+      | zero => exact .nil
+      | succ currentCount =>
+        simpa using EvalsBelow.cons hfuel heval (ih currentCount))
+    hargs) count
+
+/-- Exact-fuel argument safety is inherited by every suffix. -/
+theorem EvalsBelow.drop {ctx : Ctx} {limit : Nat}
+    {env : List Value} {expressions : List Expr} {values : List Value}
+    (hargs : EvalsBelow ctx limit env expressions values) (count : Nat) :
+    EvalsBelow ctx limit env (expressions.drop count) (values.drop count) := by
+  exact (EvalsBelow.traverse
+    (Result := fun currentExpressions currentValues =>
+      ∀ currentCount,
+        EvalsBelow ctx limit env (currentExpressions.drop currentCount)
+          (currentValues.drop currentCount))
+    (hnil := by
+      intro currentCount
+      simp
+      exact .nil)
+    (hcons := by
+      intro fuel expr value currentExpressions currentValues hfuel heval
+        htail ih currentCount
+      cases currentCount with
+      | zero => exact .cons hfuel heval htail
+      | succ currentCount => simpa using ih currentCount)
+    hargs) count
+
+/-- A flattened expression spine at one enclosing source-evaluator fuel.
+Every application and argument trace is strictly below `limit`; the head may
+itself use exactly `limit` when the spine is empty. -/
+inductive Spine (ctx : Ctx) (limit : Nat) (env : List Value) :
+    Expr → List Expr → Value → Prop where
+  | intro {headFuel : Nat} {headValue : Value}
+      {head : Expr} {arguments : List Expr} {result : Value}
+      {argumentValues : List Value} :
+      headFuel ≤ limit →
+      Eval ctx headFuel env head headValue →
+      EvalsBelow ctx limit env arguments argumentValues →
+      AppliesBelow ctx limit headValue argumentValues result →
+      Spine ctx limit env head arguments result
+
+/-- Invert a safe application expression without forgetting any predecessor
+trace or its exact one-step fuel equation. -/
+theorem Eval.app_inv {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {function argument : Expr} {result : Value}
+    (htrace : Eval ctx fuel env (.app function argument) result) :
+    ∃ previous functionValue argumentValue,
+      fuel = previous + 1 ∧
+      Eval ctx previous env function functionValue ∧
+      Eval ctx previous env argument argumentValue ∧
+      Apply ctx previous functionValue argumentValue result := by
+  cases htrace with
+  | app hfunction hargument happly =>
+      exact ⟨_, _, _, rfl, hfunction, hargument, happly⟩
+
+/-- Any safe expression is the empty-argument spine at its exact fuel. -/
+theorem Spine.of_eval_nil {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {expr : Expr} {value : Value}
+    (htrace : Eval ctx fuel env expr value) :
+    Spine ctx fuel env expr [] value :=
+  .intro (Nat.le_refl _) htrace .nil .nil
+
+/-- Flatten one more left-associated application while preserving the common
+source-fuel bound and the exact dynamically entered `Apply` trace. -/
+theorem Spine.flattenApp {ctx : Ctx} {limit : Nat} {env : List Value}
+    {function argument : Expr} {arguments : List Expr} {result : Value}
+    (hspine : Spine ctx limit env (.app function argument) arguments result) :
+    Spine ctx limit env function (argument :: arguments) result := by
+  cases hspine with
+  | @intro headFuel headValue _ _ _ argumentValues hheadBound hhead
+      harguments happlies =>
+      obtain ⟨previous, functionValue, argumentValue, hfuel, hfunction,
+        hargument, happly⟩ := hhead.app_inv
+      subst headFuel
+      exact .intro (by omega) hfunction
+        (.cons (by omega) hargument harguments)
+        (.cons (by omega) happly happlies)
+
+/-- Singleton specialization used by the expression-lowering application
+branch. -/
+theorem Spine.of_eval_app {ctx : Ctx} {fuel : Nat} {env : List Value}
+    {function argument : Expr} {result : Value}
+    (htrace : Eval ctx fuel env (.app function argument) result) :
+    Spine ctx fuel env function [argument] result :=
+  (Spine.of_eval_nil htrace).flattenApp
+
+/-- Fuel-free call-aware projection-safe termination. -/
+def Terminates (ctx : Ctx) (env : List Value) (expr : Expr)
+    (value : Value) : Prop :=
+  ∃ fuel, Eval ctx fuel env expr value
+
+end Ix.Compiler.IxIR0.ProjectionSafe
diff --git a/Ix/Compiler/IxIR0/Readdress.lean b/Ix/Compiler/IxIR0/Readdress.lean
new file mode 100644
index 000000000..24d600a7e
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Readdress.lean
@@ -0,0 +1,420 @@
+import Ix.Compiler.IxIR0.MutualBlock
+
+/-!
+# Whole-program IxIR₀ mutual-block readdressing
+
+`MutualBlock.run` handles one strongly connected declaration block.  This
+module lifts that operation to an entire erased program: stable declarations
+and the main expression are rewritten through the union of every block map,
+while cross-block temporary edges and all global namespace captures fail
+closed.
+
+The pass deliberately leaves the existing erasure theorem boundary intact.
+That boundary may continue to produce transient `memberAddr` keys; a later
+evaluator-renaming theorem can transport its result through the certified map
+returned here.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Address)
+
+namespace Readdress
+
+/-- One ordered erasure-output group. Stable groups retain their keys; mutual
+groups are addressed as a complete local-edge artifact. -/
+inductive Group where
+  | stable (entries : List (Address × Decl))
+  | mutual (entries : List (Address × Decl))
+  deriving Repr
+
+namespace Group
+
+def entries : Group → List (Address × Decl)
+  | .stable entries | .mutual entries => entries
+
+def mutualEntries? : Group → Option (List (Address × Decl))
+  | .stable _ => none
+  | .mutual entries => some entries
+
+end Group
+
+/-- Flatten groups in producer order. -/
+def rawDeclarations (groups : List Group) : List (Address × Decl) :=
+  groups.flatMap Group.entries
+
+/-- Ordered mutual-block inputs in producer order. -/
+def rawBlocks (groups : List Group) : List (List (Address × Decl)) :=
+  groups.filterMap Group.mutualEntries?
+
+/-- All stable environment keys. -/
+def stableKeys (groups : List Group) : List Address :=
+  groups.flatMap fun group =>
+    match group with
+    | .stable entries => entries.map (·.1)
+    | .mutual _ => []
+
+/-- Every transient mutual-member key. -/
+def transientKeys (groups : List Group) : List Address :=
+  groups.flatMap fun group =>
+    match group with
+    | .stable _ => []
+    | .mutual entries => entries.map (·.1)
+
+namespace Renaming
+
+/-- First source key whose recorded image is `address`.  Readdressing is not
+globally invertible; this operation is deliberately restricted to resolving a
+called final producer key back to its legacy name. -/
+def reverseLookup (mapping : MutualBlock.Renaming)
+    (address : Address) : Option Address :=
+  (List.find? (fun entry => entry.2 == address) mapping).map (·.1)
+
+/-- Reverse a recorded image key, leaving every other key unchanged. -/
+def reverseApply (mapping : MutualBlock.Renaming) (address : Address) : Address :=
+  (reverseLookup mapping address).getD address
+
+/-- An identity is absent from both the producer and image sides of a map.
+This is stronger than merely being a fixed point and is the namespace fact
+needed by a key-sensitive oracle adapter. -/
+def isolates (mapping : MutualBlock.Renaming) (address : Address) : Bool :=
+  mapping.all fun entry => entry.1 != address && entry.2 != address
+
+end Renaming
+
+/-- Concrete references in the raw program which are not transient member
+edges. Stable declarations may refer to transient members and are rewritten;
+inside a mutual block, own-member edges are local while another block's
+temporary key is rejected separately. -/
+def externalReferences (groups : List Group) (main : Expr) : List Address :=
+  let transient := transientKeys groups
+  ((rawDeclarations groups).flatMap (fun entry =>
+      MutualBlock.Concrete.Decl.references entry.2) ++
+    MutualBlock.Concrete.Expr.references main).filter fun address =>
+        !transient.contains address
+
+/-- Identities whose external meaning must not be captured by either side of
+the member-address map. -/
+def oracleIdentities (reserved : List Address) (groups : List Group)
+    (main : Expr) : List Address :=
+  reserved ++ stableKeys groups ++ externalReferences groups main
+
+/-- Result of addressing every mutual block and applying their combined map
+to the complete program. -/
+structure Result where
+  declarations : List (Address × Decl)
+  main : Expr
+  blocks : List MutualBlock.Result
+  addressMap : MutualBlock.Renaming
+
+namespace Result
+
+def transientAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.1)
+
+def derivedAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.2)
+
+def blockAddresses (result : Result) : List Address :=
+  result.blocks.map (·.blockAddress)
+
+def noTransientKeys (result : Result) : Bool :=
+  !(result.declarations.map (·.1)).any result.transientAddresses.contains
+
+def noTransientReferences (result : Result) : Bool :=
+  let declarationReferences := result.declarations.flatMap fun entry =>
+    MutualBlock.Concrete.Decl.references entry.2
+  !(declarationReferences ++
+      MutualBlock.Concrete.Expr.references result.main).any
+    result.transientAddresses.contains
+
+private def blockAudits :
+    List MutualBlock.Result → List (List (Address × Decl)) → Bool
+  | [], [] => true
+  | result :: results, raw :: raws =>
+      result.semanticAudit raw && blockAudits results raws
+  | _, _ => false
+
+/-- Every block result retains its own producer audit. -/
+def blocksAudited (result : Result) (groups : List Group) : Bool :=
+  blockAudits result.blocks (rawBlocks groups)
+
+/-- Every caller-protected identity is fixed by the completed map. -/
+def protects (result : Result) (reserved : List Address) : Bool :=
+  reserved.all fun address =>
+    MutualBlock.Renaming.apply result.addressMap address == address
+
+/-- Stable, caller-owned, and externally referenced identities occur on
+neither side of the member renaming.  In particular, reverse oracle dispatch
+cannot mistake a final member key for an opaque ABI key. -/
+def oracleIdentityAudit (result : Result) (reserved : List Address)
+    (groups : List Group) (main : Expr) : Bool :=
+  (oracleIdentities reserved groups main).all fun address =>
+    Renaming.isolates result.addressMap address
+
+/-- Exact list/main image under the completed address map. -/
+def imageAudit (result : Result) (groups : List Group)
+    (rawMain : Expr) : Bool :=
+  let rename := MutualBlock.Renaming.apply result.addressMap
+  result.declarations ==
+      (rawDeclarations groups).map (fun entry =>
+        (rename entry.1,
+          MutualBlock.Concrete.Decl.mapAddresses rename entry.2)) &&
+    result.main == MutualBlock.Concrete.Expr.mapAddresses rename rawMain
+
+/-- Every emitted declaration row is the row selected by the transparent
+first-binding-wins environment.  This makes producer-key collision freedom
+available to proof clients without re-running the private collision check. -/
+def declarationRowsSelected (result : Result) : Bool :=
+  result.declarations.all fun entry =>
+    match Env.ofList result.declarations entry.1 with
+    | some declaration => declaration == entry.2
+    | none => false
+
+/-- Global block, namespace, and fixed-point checks. -/
+def safetyAudit (result : Result) (reserved : List Address)
+    (groups : List Group) (rawMain : Expr) : Bool :=
+  let rename := MutualBlock.Renaming.apply result.addressMap
+  result.blocksAudited groups && result.protects reserved &&
+    result.noTransientKeys && result.noTransientReferences &&
+    result.declarations.all (fun entry =>
+      MutualBlock.Concrete.Decl.mapAddresses rename entry.2 == entry.2) &&
+    result.oracleIdentityAudit reserved groups rawMain &&
+    result.declarationRowsSelected
+
+/-- Exact forward environment lookup check. -/
+def lookupAudit (result : Result) (groups : List Group) : Bool :=
+  let rename := MutualBlock.Renaming.apply result.addressMap
+  let original := Env.ofList (rawDeclarations groups)
+  let emitted := Env.ofList result.declarations
+  (rawDeclarations groups).all (fun entry =>
+    match original entry.1, emitted (rename entry.1) with
+    | some before, some after =>
+        after == MutualBlock.Concrete.Decl.mapAddresses rename before
+    | _, _ => false)
+
+/-- Every successful emitted lookup is stable under the completed map. -/
+def stableLookupAudit (result : Result) : Bool :=
+  let rename := MutualBlock.Renaming.apply result.addressMap
+  let emitted := Env.ofList result.declarations
+  result.declarations.all (fun entry =>
+    match emitted entry.1 with
+    | some declaration =>
+        MutualBlock.Concrete.Decl.mapAddresses rename declaration ==
+          declaration
+    | none => false)
+
+/-- Exact structural audit for the whole address image. -/
+def semanticAudit (result : Result) (reserved : List Address)
+    (groups : List Group) (rawMain : Expr) : Bool :=
+  result.imageAudit groups rawMain &&
+    result.safetyAudit reserved groups rawMain &&
+    result.lookupAudit groups && result.stableLookupAudit
+
+/-- Extract the bidirectional oracle-identity namespace certificate from the
+whole-program audit. -/
+theorem oracleIdentityAudit_of_semanticAudit {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true) :
+    result.oracleIdentityAudit reserved groups main = true := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  have hsafety : result.safetyAudit reserved groups main = true :=
+    haudit.1.1.2
+  simp only [safetyAudit, Bool.and_eq_true] at hsafety
+  exact hsafety.1.2
+
+/-- Pointwise producer-key selection exposed by the whole-program audit. -/
+theorem declaration_lookup_of_mem_of_semanticAudit {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    {address : Address} {declaration : Decl}
+    (hmember : (address, declaration) ∈ result.declarations) :
+    Env.ofList result.declarations address = some declaration := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  have hsafety : result.safetyAudit reserved groups main = true :=
+    haudit.1.1.2
+  simp only [safetyAudit, Bool.and_eq_true] at hsafety
+  have hrows : result.declarationRowsSelected = true := hsafety.2
+  simp only [declarationRowsSelected] at hrows
+  have hrow := (List.all_eq_true.mp hrows)
+    (address, declaration) hmember
+  cases hlookup : Env.ofList result.declarations address with
+  | none => simp [hlookup] at hrow
+  | some selected =>
+      have hselected : selected = declaration :=
+        (beq_iff_eq).mp (by simpa [hlookup] using hrow)
+      simpa [hlookup, hselected]
+
+/-- Pointwise form consumed by concrete key-sensitive oracle proofs. -/
+theorem addressMap_isolates_of_semanticAudit {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    {address : Address}
+    (haddress : address ∈ oracleIdentities reserved groups main) :
+    Renaming.isolates result.addressMap address = true :=
+  (List.all_eq_true.mp
+    (result.oracleIdentityAudit_of_semanticAudit haudit)) address haddress
+
+end Result
+
+/-- A successful program readdressing carries its runtime-erased audit. -/
+abbrev CertifiedResult (reserved : List Address) (groups : List Group)
+    (main : Expr) :=
+  { result : Result // result.semanticAudit reserved groups main = true }
+
+private def firstDuplicate? : List Address → Option Address
+  | [] => none
+  | address :: rest =>
+      if rest.contains address then some address else firstDuplicate? rest
+
+private def firstOverlap? (left right : List Address) : Option Address :=
+  left.find? right.contains
+
+/-- Previously produced identities may be reused only by the same complete
+symbolic and materialized artifact. Producer names deliberately do not enter
+this comparison: each producer retains its independently audited map. A block
+identity can never stand for a member, and members of different blocks cannot
+alias even when their materialized declarations happen to agree. -/
+def compatibleBlocks (left right : MutualBlock.Result) : Bool :=
+  !left.derivedAddresses.contains right.blockAddress &&
+    !right.derivedAddresses.contains left.blockAddress &&
+    if left.blockAddress == right.blockAddress then
+      left.blockMembers == right.blockMembers &&
+        left.members == right.members &&
+        left.derivedAddresses == right.derivedAddresses
+    else
+      !left.derivedAddresses.any right.derivedAddresses.contains
+
+/-- Reusing a block identity requires equal symbolic preimages, without any
+assumption that the hash function is injective. -/
+theorem blockMembers_eq_of_compatibleBlocks
+    {left right : MutualBlock.Result}
+    (hcompatible : compatibleBlocks left right = true)
+    (haddress : left.blockAddress = right.blockAddress) :
+    left.blockMembers = right.blockMembers := by
+  simp only [compatibleBlocks, haddress, beq_self_eq_true, ite_true,
+    Bool.and_eq_true] at hcompatible
+  exact (beq_iff_eq).mp hcompatible.2.1.1
+
+/-- Reuse also preserves the complete ordered member environment. -/
+theorem members_eq_of_compatibleBlocks
+    {left right : MutualBlock.Result}
+    (hcompatible : compatibleBlocks left right = true)
+    (haddress : left.blockAddress = right.blockAddress) :
+    left.members = right.members := by
+  simp only [compatibleBlocks, haddress, beq_self_eq_true, ite_true,
+    Bool.and_eq_true] at hcompatible
+  exact (beq_iff_eq).mp hcompatible.2.1.2
+
+private structure BuildState where
+  blocks : List MutualBlock.Result := []
+  addressMap : MutualBlock.Renaming := []
+
+private def buildBlocks (baseProtected allTransient : List Address) :
+    List Group → BuildState → Except String BuildState
+  | [], state => .ok state
+  | .stable _ :: rest, state =>
+      buildBlocks baseProtected allTransient rest state
+  | .mutual raw :: rest, state => do
+      let ownTransient := raw.map (·.1)
+      let otherTransient := allTransient.filter fun address =>
+        !ownTransient.contains address
+      let protectedKeys := baseProtected ++ otherTransient
+      let result ← MutualBlock.run protectedKeys raw
+      unless state.blocks.all (compatibleBlocks · result) do
+        throw s!"conflicting generated mutual-block or member identity {Address.toHex result.blockAddress}"
+      buildBlocks baseProtected allTransient rest
+        { blocks := state.blocks ++ [result]
+          addressMap := state.addressMap ++ result.addressMap }
+
+private def crossBlockTemporary? (allTransient : List Address) :
+    List Group → Option Address
+  | [] => none
+  | .stable _ :: rest => crossBlockTemporary? allTransient rest
+  | .mutual raw :: rest =>
+      let external := (MutualBlock.abstractMembers raw).flatMap
+        MutualBlock.Decl.externalReferences
+      match external.find? allTransient.contains with
+      | some address => some address
+      | none => crossBlockTemporary? allTransient rest
+
+private def certify (reserved : List Address) (groups : List Group)
+    (main : Expr) (result : Result) :
+    Except String (CertifiedResult reserved groups main) :=
+  if haudit : result.semanticAudit reserved groups main then
+    .ok ⟨result, haudit⟩
+  else
+    .error "internal: whole-program IxIR0 readdressing failed semantic audit"
+
+/-- Address every mutual group, union the maps, and rewrite the complete
+program and main expression.
+
+`reserved` is the caller-owned namespace not represented by stable group
+keys—for erasure this includes every source constant address, notably the
+Ixon address of each mutual block itself. -/
+def runCertified (reserved : List Address) (groups : List Group)
+    (main : Expr) : Except String (CertifiedResult reserved groups main) := do
+  let declarations := rawDeclarations groups
+  let allKeys := declarations.map (·.1)
+  if let some duplicate := firstDuplicate? allKeys then
+    throw s!"duplicate raw IxIR0 declaration key {Address.toHex duplicate}"
+  let transient := transientKeys groups
+  let stable := stableKeys groups
+  let baseProtected := reserved ++ stable
+  if let some overlap := firstOverlap? transient baseProtected then
+    throw s!"mutual-block temporary address overlaps stable or reserved identity {Address.toHex overlap}"
+  if let some cross := crossBlockTemporary? transient groups then
+    throw s!"cross-block reference uses another mutual block's temporary address {Address.toHex cross}"
+  let state ← buildBlocks baseProtected transient groups {}
+  let derived := state.addressMap.map (·.2)
+  let blockAddresses := state.blocks.map (·.blockAddress)
+  let external := externalReferences groups main
+  if let some overlap := firstOverlap? derived external then
+    throw s!"derived mutual-member key captures a program external reference {Address.toHex overlap}"
+  if let some overlap := firstOverlap? blockAddresses external then
+    throw s!"mutual-block identity captures a program external reference {Address.toHex overlap}"
+  let rename := MutualBlock.Renaming.apply state.addressMap
+  let result : Result :=
+    { declarations := declarations.map fun entry =>
+        (rename entry.1,
+          MutualBlock.Concrete.Decl.mapAddresses rename entry.2)
+      main := MutualBlock.Concrete.Expr.mapAddresses rename main
+      blocks := state.blocks
+      addressMap := state.addressMap }
+  certify reserved groups main result
+
+/-- Artifact-facing projection of `runCertified`. -/
+def run (reserved : List Address) (groups : List Group)
+    (main : Expr) : Except String Result := do
+  return (← runCertified reserved groups main).1
+
+/-- Every successful artifact-facing run retains the whole-program audit. -/
+theorem semanticAudit_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result} (hrun : run reserved groups main = .ok result) :
+    result.semanticAudit reserved groups main = true := by
+  unfold run at hrun
+  cases hcertified : runCertified reserved groups main with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2
+
+/-- Every protected/stable/external identity is absent from both sides of the
+map returned by a successful pass. -/
+theorem isolates_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result} (hrun : run reserved groups main = .ok result)
+    {address : Address}
+    (haddress : address ∈ oracleIdentities reserved groups main) :
+    Renaming.isolates result.addressMap address = true :=
+  result.addressMap_isolates_of_semanticAudit
+    (semanticAudit_of_run_eq_ok hrun) haddress
+
+end Readdress
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/ReaddressOracle.lean b/Ix/Compiler/IxIR0/ReaddressOracle.lean
new file mode 100644
index 000000000..78d59562b
--- /dev/null
+++ b/Ix/Compiler/IxIR0/ReaddressOracle.lean
@@ -0,0 +1,263 @@
+import Ix.Compiler.IxIR0.ReaddressProjectionSafe
+
+/-!
+# Executable oracle adaptation for IxIR₀ readdressing
+
+The forward address action is intentionally not a global bijection: a newly
+derived member key is fixed, while the corresponding transient key maps to it.
+Consequently an addressed oracle must not pretend it can invert arbitrary
+runtime values.
+
+This module uses the narrower operation actually needed at the oracle
+boundary.  It reverse-resolves only the called declaration key, passes the
+already-addressed arguments to the legacy oracle, and maps any returned value
+forward.  `Oracle.Readdressable` is the exact coherence condition ensuring
+that this executable adapter commutes with the evaluator address action.
+-/
+
+namespace Ix.Compiler.IxIR0.Readdress
+
+open Ix.Compiler.Ixon (Address)
+
+namespace Renaming
+
+private theorem source_ne_of_isolates
+    {mapping : MutualBlock.Renaming} {identity : Address}
+    (hisolated : isolates mapping identity = true)
+    {entry : Address × Address} (hentry : entry ∈ mapping) :
+    entry.1 ≠ identity := by
+  have hpair := (List.all_eq_true.mp hisolated) entry hentry
+  simp only [Bool.and_eq_true] at hpair
+  exact bne_iff_ne.mp hpair.1
+
+private theorem target_ne_of_isolates
+    {mapping : MutualBlock.Renaming} {identity : Address}
+    (hisolated : isolates mapping identity = true)
+    {entry : Address × Address} (hentry : entry ∈ mapping) :
+    entry.2 ≠ identity := by
+  have hpair := (List.all_eq_true.mp hisolated) entry hentry
+  simp only [Bool.and_eq_true] at hpair
+  exact bne_iff_ne.mp hpair.2
+
+theorem lookup_eq_none_of_isolates
+    {mapping : MutualBlock.Renaming} {identity : Address}
+    (hisolated : isolates mapping identity = true) :
+    mapping.lookup identity = none := by
+  have hnone :
+      List.find? (fun entry => entry.1 == identity) mapping = none :=
+    List.find?_eq_none.mpr fun entry hentry hequal =>
+      source_ne_of_isolates hisolated hentry
+        (Address.eq_of_beq hequal)
+  simp [MutualBlock.Renaming.lookup, hnone]
+
+theorem reverseLookup_eq_none_of_isolates
+    {mapping : MutualBlock.Renaming} {identity : Address}
+    (hisolated : isolates mapping identity = true) :
+    reverseLookup mapping identity = none := by
+  have hnone :
+      List.find? (fun entry => entry.2 == identity) mapping = none :=
+    List.find?_eq_none.mpr fun entry hentry hequal =>
+      target_ne_of_isolates hisolated hentry
+        (Address.eq_of_beq hequal)
+  simp [reverseLookup, hnone]
+
+@[simp] theorem apply_eq_self_of_isolates
+    {mapping : MutualBlock.Renaming} {identity : Address}
+    (hisolated : isolates mapping identity = true) :
+    MutualBlock.Renaming.apply mapping identity = identity := by
+  simp [MutualBlock.Renaming.apply,
+    lookup_eq_none_of_isolates hisolated]
+
+@[simp] theorem reverseApply_eq_self_of_isolates
+    {mapping : MutualBlock.Renaming} {identity : Address}
+    (hisolated : isolates mapping identity = true) :
+    reverseApply mapping identity = identity := by
+  simp [reverseApply, reverseLookup_eq_none_of_isolates hisolated]
+
+theorem apply_ne_of_ne_of_isolates
+    {mapping : MutualBlock.Renaming} {identity address : Address}
+    (hisolated : isolates mapping identity = true)
+    (haddress : address ≠ identity) :
+    MutualBlock.Renaming.apply mapping address ≠ identity := by
+  unfold MutualBlock.Renaming.apply
+  cases hlookup : mapping.lookup address with
+  | none => simpa [hlookup] using haddress
+  | some target =>
+      obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+      have htarget : entry.2 = target := by simpa using hvalue
+      subst target
+      simpa [hlookup] using target_ne_of_isolates hisolated
+        (List.mem_of_find?_eq_some hfind)
+
+theorem reverseApply_ne_of_ne_of_isolates
+    {mapping : MutualBlock.Renaming} {identity address : Address}
+    (hisolated : isolates mapping identity = true)
+    (haddress : address ≠ identity) :
+    reverseApply mapping address ≠ identity := by
+  unfold reverseApply
+  cases hlookup : reverseLookup mapping address with
+  | none => simpa [hlookup] using haddress
+  | some source =>
+      unfold reverseLookup at hlookup
+      obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+      have hsource : entry.1 = source := by simpa using hvalue
+      subst source
+      simpa [hlookup] using source_ne_of_isolates hisolated
+        (List.mem_of_find?_eq_some hfind)
+
+end Renaming
+
+namespace Oracle
+
+/-- Executable addressed view of a legacy oracle. Arguments have already been
+renamed by evaluator transport; only the call key is reverse-resolved. Any
+result is mapped back into the addressed value universe. -/
+def readdress (mapping : MutualBlock.Renaming) (before : IxIR0.Oracle) :
+    IxIR0.Oracle :=
+  let rename := MutualBlock.Renaming.apply mapping
+  fun address arguments =>
+    (before (Renaming.reverseApply mapping address) arguments).map
+      (Value.mapAddresses rename)
+
+/-- Exact observable coherence required by `readdress`: after reverse-resolving
+the mapped call key, the legacy oracle's answer on addressed arguments must
+have the same forward image as its answer on the original call and arguments.
+This admits the scalar ABI and deliberately rejects an address-sensitive
+oracle unless it provides its own coherent implementation. -/
+def Readdressable (mapping : MutualBlock.Renaming)
+    (before : IxIR0.Oracle) : Prop :=
+  let rename := MutualBlock.Renaming.apply mapping
+  ∀ address arguments,
+    (before
+          (Renaming.reverseApply mapping (rename address))
+          (ValueList.mapAddresses rename arguments)).map
+        (Value.mapAddresses rename) =
+      (before address arguments).map (Value.mapAddresses rename)
+
+/-- The executable adapter satisfies the exact oracle equation consumed by
+evaluator and trace transport. -/
+theorem readdress_compatible {mapping : MutualBlock.Renaming}
+    {before : IxIR0.Oracle} (hbefore : Readdressable mapping before)
+    (address : Address) (arguments : List Value) :
+    readdress mapping before
+        (MutualBlock.Renaming.apply mapping address)
+        (ValueList.mapAddresses
+          (MutualBlock.Renaming.apply mapping) arguments) =
+      (before address arguments).map
+        (Value.mapAddresses (MutualBlock.Renaming.apply mapping)) := by
+  exact hbefore address arguments
+
+/-- The empty oracle is readdressable for every map. -/
+theorem Readdressable.empty (mapping : MutualBlock.Renaming) :
+    Readdressable mapping (fun _ _ => none) := by
+  intro address arguments
+  rfl
+
+/-- Split the coherence proof into independent key and argument conditions.
+This is convenient for scalar oracles: their argument condition usually
+follows from length preservation. -/
+theorem Readdressable.of_key_and_arguments
+    {mapping : MutualBlock.Renaming} {before : IxIR0.Oracle}
+    (hkey : ∀ address arguments,
+      before
+          (Renaming.reverseApply mapping
+            (MutualBlock.Renaming.apply mapping address))
+          arguments = before address arguments)
+    (harguments : ∀ address arguments,
+      before address
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply mapping) arguments) =
+        before address arguments) :
+    Readdressable mapping before := by
+  intro address arguments
+  rw [hkey, harguments]
+
+/-- A single-key oracle is coherent whenever the member map isolates that ABI
+identity and structurally renamed arguments do not change its answer. -/
+theorem Readdressable.of_isolated_key
+    {mapping : MutualBlock.Renaming} {before : IxIR0.Oracle}
+    {key : Address}
+    (hisolated : Renaming.isolates mapping key = true)
+    (hoffKey : ∀ address arguments, address ≠ key →
+      before address arguments = none)
+    (harguments : ∀ address arguments,
+      before address
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply mapping) arguments) =
+        before address arguments) :
+    Readdressable mapping before := by
+  apply Readdressable.of_key_and_arguments
+  · intro address arguments
+    by_cases haddress : address = key
+    · subst address
+      simp [Renaming.apply_eq_self_of_isolates hisolated,
+        Renaming.reverseApply_eq_self_of_isolates hisolated]
+    · have happly :
+          MutualBlock.Renaming.apply mapping address ≠ key :=
+        Renaming.apply_ne_of_ne_of_isolates hisolated haddress
+      have hreverse :
+          Renaming.reverseApply mapping
+              (MutualBlock.Renaming.apply mapping address) ≠ key :=
+        Renaming.reverseApply_ne_of_ne_of_isolates hisolated happly
+      rw [hoffKey _ _ hreverse, hoffKey _ _ haddress]
+  · exact harguments
+
+end Oracle
+
+namespace Result
+
+/-- The executable oracle adapter discharges the context-renaming premise
+from its compact coherence law. -/
+theorem renames_preAddressCtx_readdressOracle {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    (beforeOracle : IxIR0.Oracle)
+    (horacle : Oracle.Readdressable result.addressMap beforeOracle) :
+    Ctx.Renames (MutualBlock.Renaming.apply result.addressMap)
+      (result.preAddressCtx groups beforeOracle)
+      (result.addressedCtx
+        (Oracle.readdress result.addressMap beforeOracle)) :=
+  result.renames_preAddressCtx haudit beforeOracle
+    (Oracle.readdress result.addressMap beforeOracle)
+    (Oracle.readdress_compatible horacle)
+
+/-- Exact evaluator transport using the executable addressed oracle. -/
+theorem run_readdressOracle_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result}
+    (hrun : Readdress.run reserved groups main = .ok result)
+    (beforeOracle : IxIR0.Oracle)
+    (horacle : Oracle.Readdressable result.addressMap beforeOracle)
+    (fuel : Nat := 100000) :
+    (result.addressedCtx
+        (Oracle.readdress result.addressMap beforeOracle)).run
+        result.main fuel =
+      mapResult (MutualBlock.Renaming.apply result.addressMap)
+        ((result.preAddressCtx groups beforeOracle).run main fuel) :=
+  run_of_run_eq_ok hrun beforeOracle
+    (Oracle.readdress result.addressMap beforeOracle)
+    (Oracle.readdress_compatible horacle) fuel
+
+/-- Exact call-aware main-trace transport using the executable addressed
+oracle. -/
+theorem projectionSafeMain_readdressOracle_of_audit {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    (beforeOracle : IxIR0.Oracle)
+    (horacle : Oracle.Readdressable result.addressMap beforeOracle)
+    {traceFuel : Nat} {value : Value}
+    (trace : IxIR0.ProjectionSafe.Eval
+      (result.rawCtx groups beforeOracle) traceFuel [] main value) :
+    IxIR0.ProjectionSafe.Eval
+      (result.addressedCtx
+        (Oracle.readdress result.addressMap beforeOracle))
+      traceFuel [] result.main
+      (Value.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) value) :=
+  result.projectionSafeMain_of_audit haudit beforeOracle
+    (Oracle.readdress result.addressMap beforeOracle)
+    (Oracle.readdress_compatible horacle) trace
+
+end Result
+
+end Ix.Compiler.IxIR0.Readdress
diff --git a/Ix/Compiler/IxIR0/ReaddressOracleExamples.lean b/Ix/Compiler/IxIR0/ReaddressOracleExamples.lean
new file mode 100644
index 000000000..fa64984be
--- /dev/null
+++ b/Ix/Compiler/IxIR0/ReaddressOracleExamples.lean
@@ -0,0 +1,63 @@
+import Ix.Compiler.IxIR0.Examples
+import Ix.Compiler.IxIR0.ReaddressOracle
+
+/-!
+# Coherence for the modeled IxIR₀ Nat-add oracle
+
+The trusted-extern ledger records `IxIR0.Examples.oracle` as the concrete
+test-only scalar ABI at `Examples.natAddExt`.  This module discharges the
+generic readdressing adapter's coherence law for that exact implementation.
+The only namespace premise is the executable isolation certificate carried by
+successful whole-program readdressing.
+-/
+
+namespace Ix.Compiler.IxIR0.Readdress.Oracle
+
+open Ix.Compiler.Ixon (Address)
+
+private theorem examplesOracle_mapArguments
+    (mapping : MutualBlock.Renaming) (address : Address)
+    (arguments : List Value) :
+    Examples.oracle address
+        (ValueList.mapAddresses
+          (MutualBlock.Renaming.apply mapping) arguments) =
+      Examples.oracle address arguments := by
+  by_cases haddress : address = Examples.natAddExt
+  · subst address
+    simp only [Examples.oracle, BEq.rfl, if_true]
+    cases arguments with
+    | nil => simp
+    | cons first rest =>
+      cases rest with
+      | nil => simp
+      | cons second tail =>
+        cases tail with
+        | nil =>
+          cases first <;> cases second <;>
+            simp [Value.mapAddresses]
+        | cons _ _ => simp
+  · simp [Examples.oracle, haddress]
+
+/-- The concrete literal-Nat addition model is coherent with every member map
+that isolates its ledger identity. -/
+theorem Readdressable.examples_of_isolates
+    {mapping : MutualBlock.Renaming}
+    (hisolated : Renaming.isolates mapping Examples.natAddExt = true) :
+    Readdressable mapping Examples.oracle := by
+  apply Readdressable.of_isolated_key hisolated
+  · intro address arguments haddress
+    simp [Examples.oracle, haddress]
+  · exact examplesOracle_mapArguments mapping
+
+/-- Successful whole-program addressing supplies the isolation premise when
+the Nat-add ABI key is stable, reserved, or externally referenced. -/
+theorem Readdressable.examples_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result} (hrun : Readdress.run reserved groups main = .ok result)
+    (hidentity : Examples.natAddExt ∈
+      oracleIdentities reserved groups main) :
+    Readdressable result.addressMap Examples.oracle :=
+  Readdressable.examples_of_isolates
+    (Readdress.isolates_of_run_eq_ok hrun hidentity)
+
+end Ix.Compiler.IxIR0.Readdress.Oracle
diff --git a/Ix/Compiler/IxIR0/ReaddressProjectionSafe.lean b/Ix/Compiler/IxIR0/ReaddressProjectionSafe.lean
new file mode 100644
index 000000000..b35f7e61f
--- /dev/null
+++ b/Ix/Compiler/IxIR0/ReaddressProjectionSafe.lean
@@ -0,0 +1,397 @@
+import Ix.Compiler.IxIR0.ProjectionSafe
+import Ix.Compiler.IxIR0.ReaddressSim
+
+/-!
+# Projection-safe trace transport across IxIR₀ readdressing
+
+Evaluator equivariance transports the observable `Except` result of a run.
+The lowering progress proof consumes a stronger witness: the mutually
+inductive `ProjectionSafe.Eval`/`Apply`/`Saturate`/`Fire` trace retaining every
+dynamically entered body.  This module transports that witness structurally.
+
+Unlike full evaluator equivalence, a successful trace only observes successful
+declaration and oracle lookups.  `Ctx.TraceRenames` therefore states exactly
+that one-way requirement.  In particular it relates the validator's literal
+raw environment directly to the final addressed environment; no stable alias
+has to be inserted on the proof-facing side.
+-/
+
+namespace Ix.Compiler.IxIR0.Readdress
+
+open Ix.Compiler.Ixon (Address)
+
+namespace Ctx
+
+/-- One-way context compatibility sufficient to rename a successful
+projection-safe trace. -/
+structure TraceRenames (rename : Address → Address)
+    (before after : IxIR0.Ctx) : Prop where
+  env : ∀ {address declaration},
+    before.env address = some declaration →
+      after.env (rename address) =
+        some (MutualBlock.Concrete.Decl.mapAddresses rename declaration)
+  oracle : ∀ {address arguments result},
+    before.oracle address arguments = some result →
+      after.oracle (rename address)
+          (ValueList.mapAddresses rename arguments) =
+        some (Value.mapAddresses rename result)
+
+/-- Exact evaluator-context renaming entails the one-way trace relation. -/
+theorem Renames.toTraceRenames {rename : Address → Address}
+    {before after : IxIR0.Ctx}
+    (contexts : Renames rename before after) :
+    TraceRenames rename before after := by
+  constructor
+  · intro address declaration hlookup
+    rw [contexts.env address, hlookup]
+    rfl
+  · intro address arguments result horacle
+    rw [contexts.oracle address arguments, horacle]
+    rfl
+
+end Ctx
+
+namespace ProjectionSafe
+
+mutual
+
+  /-- Rename every address retained by an exact projection-safe evaluation
+  trace. -/
+  theorem Eval.mapAddresses {rename : Address → Address}
+      {before after : IxIR0.Ctx}
+      (contexts : Ctx.TraceRenames rename before after)
+      {fuel : Nat} {environment : List Value} {expression : Expr}
+      {result : Value}
+      (trace : IxIR0.ProjectionSafe.Eval before fuel environment expression
+        result) :
+      IxIR0.ProjectionSafe.Eval after fuel
+        (ValueList.mapAddresses rename environment)
+        (MutualBlock.Concrete.Expr.mapAddresses rename expression)
+        (Value.mapAddresses rename result) := by
+    cases trace with
+    | var hlookup =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        apply IxIR0.ProjectionSafe.Eval.var
+        simpa using congrArg (Option.map (Value.mapAddresses rename)) hlookup
+    | lit =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses,
+          Value.mapAddresses]
+        exact .lit
+    | erased =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses,
+          Value.mapAddresses]
+        exact .erased
+    | lam =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses,
+          Value.mapAddresses]
+        exact .lam
+    | letE hvalue hbody =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        exact .letE (Eval.mapAddresses contexts hvalue)
+          (by simpa using Eval.mapAddresses contexts hbody)
+    | app hfunction hargument happly =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        exact .app (Eval.mapAddresses contexts hfunction)
+          (Eval.mapAddresses contexts hargument)
+          (Apply.mapAddresses contexts happly)
+    | proj hsource hfield =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        have hsource' := Eval.mapAddresses contexts hsource
+        simp only [Value.mapAddresses] at hsource'
+        apply IxIR0.ProjectionSafe.Eval.proj hsource'
+        simpa using congrArg (Option.map (Value.mapAddresses rename)) hfield
+    | refDefn hlookup hbody =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        exact .refDefn
+          (by simpa [MutualBlock.Concrete.Decl.mapAddresses] using
+            contexts.env hlookup)
+          (by simpa using Eval.mapAddresses contexts hbody)
+    | refCtor hlookup hsaturate =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        exact .refCtor
+          (by simpa [MutualBlock.Concrete.Decl.mapAddresses] using
+            contexts.env hlookup)
+          (by simpa [Head.mapAddresses, ValueList.mapAddresses] using
+            Saturate.mapAddresses contexts hsaturate)
+    | refRecursor hlookup =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses,
+          Value.mapAddresses, Head.mapAddresses, ValueList.mapAddresses]
+        exact .refRecursor
+          (by simpa [MutualBlock.Concrete.Decl.mapAddresses] using
+            contexts.env hlookup)
+    | refExtern hlookup hsaturate =>
+        simp only [MutualBlock.Concrete.Expr.mapAddresses]
+        exact .refExtern
+          (by simpa [MutualBlock.Concrete.Decl.mapAddresses] using
+            contexts.env hlookup)
+          (by simpa [Head.mapAddresses, ValueList.mapAddresses] using
+            Saturate.mapAddresses contexts hsaturate)
+
+  /-- Rename every address retained by an exact projection-safe application
+  trace. -/
+  theorem Apply.mapAddresses {rename : Address → Address}
+      {before after : IxIR0.Ctx}
+      (contexts : Ctx.TraceRenames rename before after)
+      {fuel : Nat} {function argument result : Value}
+      (trace : IxIR0.ProjectionSafe.Apply before fuel function argument
+        result) :
+      IxIR0.ProjectionSafe.Apply after fuel
+        (Value.mapAddresses rename function)
+        (Value.mapAddresses rename argument)
+        (Value.mapAddresses rename result) := by
+    cases trace with
+    | clos hbody =>
+        simp only [Value.mapAddresses]
+        exact .clos (by simpa using Eval.mapAddresses contexts hbody)
+    | pap hsaturate =>
+        simp only [Value.mapAddresses]
+        exact .pap (by simpa using Saturate.mapAddresses contexts hsaturate)
+    | erased =>
+        simp only [Value.mapAddresses]
+        exact .erased
+
+  /-- Rename every address retained by an exact projection-safe saturation
+  trace. -/
+  theorem Saturate.mapAddresses {rename : Address → Address}
+      {before after : IxIR0.Ctx}
+      (contexts : Ctx.TraceRenames rename before after)
+      {fuel : Nat} {head : Head} {arguments : List Value} {result : Value}
+      (trace : IxIR0.ProjectionSafe.Saturate before fuel head arguments
+        result) :
+      IxIR0.ProjectionSafe.Saturate after fuel
+        (Head.mapAddresses rename head)
+        (ValueList.mapAddresses rename arguments)
+        (Value.mapAddresses rename result) := by
+    cases trace with
+    | pending hlength =>
+        simp only [Value.mapAddresses]
+        exact .pending (by simpa using hlength)
+    | full hlength hfire =>
+        exact .full (by simpa using hlength)
+          (Fire.mapAddresses contexts hfire)
+
+  /-- Rename every address retained by an exact projection-safe firing
+  trace. -/
+  theorem Fire.mapAddresses {rename : Address → Address}
+      {before after : IxIR0.Ctx}
+      (contexts : Ctx.TraceRenames rename before after)
+      {fuel : Nat} {head : Head} {arguments : List Value} {result : Value}
+      (trace : IxIR0.ProjectionSafe.Fire before fuel head arguments result) :
+      IxIR0.ProjectionSafe.Fire after fuel
+        (Head.mapAddresses rename head)
+        (ValueList.mapAddresses rename arguments)
+        (Value.mapAddresses rename result) := by
+    cases trace with
+    | ctor =>
+        simp only [Head.mapAddresses, Value.mapAddresses]
+        exact .ctor
+    | extern horacle => exact .extern (contexts.oracle horacle)
+    | @recursor fuel address arity numArgs natLit rules arguments major tag
+        fields rule result hlookup hlast hmajor hrule hfields hbody =>
+        apply IxIR0.ProjectionSafe.Fire.recursor (contexts.env hlookup)
+        · simpa using congrArg (Option.map (Value.mapAddresses rename)) hlast
+        · simpa [mapMajorResult] using
+            congrArg (mapMajorResult rename) hmajor
+        · simpa using congrArg
+            (Option.map (MutualBlock.Concrete.RecRule.mapAddresses rename))
+            hrule
+        · simpa [MutualBlock.Concrete.RecRule.mapAddresses] using hfields
+        · simpa [MutualBlock.Concrete.RecRule.mapAddresses,
+            Value.mapAddresses, Head.mapAddresses] using
+            Eval.mapAddresses contexts hbody
+
+end
+
+/-- Transport a bounded safe application spine pointwise. -/
+theorem AppliesBelow.mapAddresses {rename : Address → Address}
+    {before after : IxIR0.Ctx}
+    (contexts : Ctx.TraceRenames rename before after)
+    {limit : Nat} {function result : Value} {arguments : List Value}
+    (trace : IxIR0.ProjectionSafe.AppliesBelow before limit function
+      arguments result) :
+    IxIR0.ProjectionSafe.AppliesBelow after limit
+      (Value.mapAddresses rename function)
+      (ValueList.mapAddresses rename arguments)
+      (Value.mapAddresses rename result) := by
+  exact IxIR0.ProjectionSafe.AppliesBelow.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      IxIR0.ProjectionSafe.AppliesBelow after limit
+        (Value.mapAddresses rename currentFunction)
+        (ValueList.mapAddresses rename currentArguments)
+        (Value.mapAddresses rename currentResult))
+    (hnil := by
+      intro value
+      simp only [ValueList.mapAddresses]
+      exact .nil)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hfuel hstep htail ih
+      simpa only [ValueList.mapAddresses] using
+        IxIR0.ProjectionSafe.AppliesBelow.cons hfuel
+          (Apply.mapAddresses contexts hstep) ih)
+    trace
+
+/-- Transport pointwise bounded argument-evaluation traces. -/
+theorem EvalsBelow.mapAddresses {rename : Address → Address}
+    {before after : IxIR0.Ctx}
+    (contexts : Ctx.TraceRenames rename before after)
+    {limit : Nat} {environment : List Value}
+    {expressions : List Expr} {values : List Value}
+    (trace : IxIR0.ProjectionSafe.EvalsBelow before limit environment
+      expressions values) :
+    IxIR0.ProjectionSafe.EvalsBelow after limit
+      (ValueList.mapAddresses rename environment)
+      (expressions.map (MutualBlock.Concrete.Expr.mapAddresses rename))
+      (ValueList.mapAddresses rename values) := by
+  exact IxIR0.ProjectionSafe.EvalsBelow.traverse
+    (Result := fun currentExpressions currentValues =>
+      IxIR0.ProjectionSafe.EvalsBelow after limit
+        (ValueList.mapAddresses rename environment)
+        (currentExpressions.map
+          (MutualBlock.Concrete.Expr.mapAddresses rename))
+        (ValueList.mapAddresses rename currentValues))
+    (hnil := by
+      simp only [List.map, ValueList.mapAddresses]
+      exact .nil)
+    (hcons := by
+      intro fuel expr value currentExpressions currentValues hfuel heval
+        htail ih
+      simpa only [List.map, ValueList.mapAddresses] using
+        IxIR0.ProjectionSafe.EvalsBelow.cons hfuel
+          (Eval.mapAddresses contexts heval) ih)
+    trace
+
+/-- Transport a flattened call-aware expression spine. -/
+theorem Spine.mapAddresses {rename : Address → Address}
+    {before after : IxIR0.Ctx}
+    (contexts : Ctx.TraceRenames rename before after)
+    {limit : Nat} {environment : List Value}
+    {head : Expr} {arguments : List Expr} {result : Value}
+    (trace : IxIR0.ProjectionSafe.Spine before limit environment head
+      arguments result) :
+    IxIR0.ProjectionSafe.Spine after limit
+      (ValueList.mapAddresses rename environment)
+      (MutualBlock.Concrete.Expr.mapAddresses rename head)
+      (arguments.map (MutualBlock.Concrete.Expr.mapAddresses rename))
+      (Value.mapAddresses rename result) := by
+  cases trace with
+  | intro hbound hhead harguments happlies =>
+      exact .intro hbound (Eval.mapAddresses contexts hhead)
+        (EvalsBelow.mapAddresses contexts harguments)
+        (AppliesBelow.mapAddresses contexts happlies)
+
+/-- Fuel-free projection-safe termination is invariant under a trace
+renaming. -/
+theorem Terminates.mapAddresses {rename : Address → Address}
+    {before after : IxIR0.Ctx}
+    (contexts : Ctx.TraceRenames rename before after)
+    {environment : List Value} {expression : Expr} {result : Value}
+    (trace : IxIR0.ProjectionSafe.Terminates before environment expression
+      result) :
+    IxIR0.ProjectionSafe.Terminates after
+      (ValueList.mapAddresses rename environment)
+      (MutualBlock.Concrete.Expr.mapAddresses rename expression)
+      (Value.mapAddresses rename result) := by
+  obtain ⟨fuel, trace⟩ := trace
+  exact ⟨fuel, Eval.mapAddresses contexts trace⟩
+
+end ProjectionSafe
+
+namespace Result
+
+/-- Literal proof-facing context emitted by the legacy eraser, with no
+derived-key aliases. -/
+def rawCtx (_result : Result) (groups : List Group)
+    (oracle : Oracle := fun _ _ => none) : IxIR0.Ctx :=
+  { env := Env.ofList (rawDeclarations groups), oracle }
+
+/-- A successful whole-program audit relates the literal raw environment
+directly to the emitted addressed environment for every successful lookup. -/
+theorem traceRenames_rawCtx {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    (beforeOracle afterOracle : Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (MutualBlock.Renaming.apply result.addressMap address)
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (Value.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap))) :
+    Ctx.TraceRenames (MutualBlock.Renaming.apply result.addressMap)
+      (result.rawCtx groups beforeOracle)
+      (result.addressedCtx afterOracle) := by
+  constructor
+  · intro address declaration hlookup
+    change Env.ofList (rawDeclarations groups) address = some declaration at hlookup
+    change Env.ofList result.declarations
+      (MutualBlock.Renaming.apply result.addressMap address) = _
+    exact result.lookup_eq_mapAddresses haudit hlookup
+  · intro address arguments value hlookup
+    change beforeOracle address arguments = some value at hlookup
+    change afterOracle
+      (MutualBlock.Renaming.apply result.addressMap address)
+      (ValueList.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) arguments) = _
+    rw [horacle address arguments, hlookup]
+    rfl
+
+/-- The exact call-aware trace consumed by lowering progress survives a
+successful whole-program readdressing. -/
+theorem projectionSafeEval_of_audit {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    (beforeOracle afterOracle : Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (MutualBlock.Renaming.apply result.addressMap address)
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (Value.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap)))
+    {traceFuel : Nat} {environment : List Value} {expression : Expr}
+    {value : Value}
+    (trace : IxIR0.ProjectionSafe.Eval
+      (result.rawCtx groups beforeOracle) traceFuel environment expression
+      value) :
+    IxIR0.ProjectionSafe.Eval (result.addressedCtx afterOracle) traceFuel
+      (ValueList.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) environment)
+      (MutualBlock.Concrete.Expr.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) expression)
+      (Value.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) value) :=
+  ProjectionSafe.Eval.mapAddresses
+    (result.traceRenames_rawCtx haudit beforeOracle afterOracle horacle)
+    trace
+
+/-- Closed main specialization, rewriting the structural image to the exact
+main retained by the addressed result. -/
+theorem projectionSafeMain_of_audit {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    (beforeOracle afterOracle : Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (MutualBlock.Renaming.apply result.addressMap address)
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (Value.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap)))
+    {traceFuel : Nat} {value : Value}
+    (trace : IxIR0.ProjectionSafe.Eval
+      (result.rawCtx groups beforeOracle) traceFuel [] main value) :
+    IxIR0.ProjectionSafe.Eval (result.addressedCtx afterOracle) traceFuel []
+      result.main
+      (Value.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) value) := by
+  rw [result.main_eq_mapAddresses haudit]
+  simpa using result.projectionSafeEval_of_audit haudit beforeOracle
+    afterOracle horacle trace
+
+end Result
+
+end Ix.Compiler.IxIR0.Readdress
diff --git a/Ix/Compiler/IxIR0/ReaddressSim.lean b/Ix/Compiler/IxIR0/ReaddressSim.lean
new file mode 100644
index 000000000..b0735634c
--- /dev/null
+++ b/Ix/Compiler/IxIR0/ReaddressSim.lean
@@ -0,0 +1,676 @@
+import Ix.Compiler.IxIR0.Eval
+import Ix.Compiler.IxIR0.Readdress
+
+/-!
+# Semantic transport for IxIR₀ address renaming
+
+Cycle-safe mutual blocks replace transient declaration keys with keys derived
+from the canonical symbolic block.  IxIR₀ runtime values retain global
+addresses in constructors, partial applications, closures, and errors, so the
+semantic statement maps the entire evaluator state rather than only source
+expressions.
+
+`Ctx.Renames` isolates the two assumptions the evaluator needs: exact forward
+declaration lookup and an oracle that commutes with the same structural map.
+The concrete theorem at the end obtains the declaration half directly from a
+successful whole-program readdressing audit.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Address)
+
+namespace Readdress
+
+namespace Head
+
+/-- Rename every declaration identity retained by a global head. -/
+def mapAddresses (rename : Address → Address) : Head → Head
+  | .ctor address tag arity => .ctor (rename address) tag arity
+  | .rec_ address arity => .rec_ (rename address) arity
+  | .ext address arity => .ext (rename address) arity
+
+end Head
+
+/-! Values and value lists are mutually recursive because closures and
+constructor/PAP payloads contain further values. -/
+
+mutual
+
+/-- Structural address action on an IxIR₀ runtime value. -/
+def Value.mapAddresses (rename : Address → Address) (value : Value) : Value :=
+  match value with
+  | .clos uses environment body =>
+      .clos uses (ValueList.mapAddresses rename environment)
+        (MutualBlock.Concrete.Expr.mapAddresses rename body)
+  | .pap head arguments =>
+      .pap (Head.mapAddresses rename head)
+        (ValueList.mapAddresses rename arguments)
+  | .ctor address tag arguments =>
+      .ctor (rename address) tag (ValueList.mapAddresses rename arguments)
+  | .lit literal => .lit literal
+  | .erased => .erased
+termination_by sizeOf value
+
+/-- Structural address action on a runtime environment or argument list. -/
+def ValueList.mapAddresses (rename : Address → Address)
+    (values : List Value) : List Value :=
+  match values with
+  | [] => []
+  | value :: rest =>
+      Value.mapAddresses rename value :: ValueList.mapAddresses rename rest
+termination_by sizeOf values
+
+end
+
+namespace Err
+
+/-- Rename the address payload of evaluator failures. -/
+def mapAddresses (rename : Address → Address) : Err → Err
+  | .fuel => .fuel
+  | .stuck message => .stuck message
+  | .oracleMissing address => .oracleMissing (rename address)
+  | .unknownRef address => .unknownRef (rename address)
+
+end Err
+
+/-- Structural address action on an evaluator result. -/
+def mapResult (rename : Address → Address) :
+    Except Err Value → Except Err Value
+  | .ok value => .ok (Value.mapAddresses rename value)
+  | .error error => .error (Err.mapAddresses rename error)
+
+/-- Structural address action on the result of viewing a recursor major. -/
+def mapMajorResult (rename : Address → Address) :
+    Except Err (Nat × List Value) → Except Err (Nat × List Value)
+  | .ok (tag, fields) => .ok (tag, ValueList.mapAddresses rename fields)
+  | .error error => .error (Err.mapAddresses rename error)
+
+namespace Ctx
+
+/-- Exact evaluator-context compatibility for an address renaming. -/
+structure Renames (rename : Address → Address)
+    (before after : Ctx) : Prop where
+  env : ∀ address,
+    after.env (rename address) =
+      (before.env address).map
+        (MutualBlock.Concrete.Decl.mapAddresses rename)
+  oracle : ∀ address arguments,
+    after.oracle (rename address)
+        (ValueList.mapAddresses rename arguments) =
+      (before.oracle address arguments).map
+        (Value.mapAddresses rename)
+
+end Ctx
+
+/-! ## Structural laws used by evaluator transport -/
+
+@[simp] theorem Head.arity_mapAddresses (rename : Address → Address)
+    (head : Head) :
+    (Head.mapAddresses rename head).arity = head.arity := by
+  cases head <;> rfl
+
+@[simp] theorem ValueList.mapAddresses_nil (rename : Address → Address) :
+    ValueList.mapAddresses rename [] = [] := by
+  simp [ValueList.mapAddresses]
+
+@[simp] theorem ValueList.mapAddresses_cons (rename : Address → Address)
+    (value : Value) (rest : List Value) :
+    ValueList.mapAddresses rename (value :: rest) =
+      Value.mapAddresses rename value :: ValueList.mapAddresses rename rest :=
+  by simp [ValueList.mapAddresses]
+
+@[simp] theorem ValueList.mapAddresses_eq_map (rename : Address → Address)
+    (values : List Value) :
+    ValueList.mapAddresses rename values =
+      values.map (Value.mapAddresses rename) := by
+  induction values with
+  | nil => simp
+  | cons value rest ih => simp [ih]
+
+@[simp] theorem ValueList.length_mapAddresses (rename : Address → Address)
+    (values : List Value) :
+    (ValueList.mapAddresses rename values).length = values.length := by
+  simp [ValueList.mapAddresses_eq_map]
+
+@[simp] theorem ValueList.mapAddresses_append (rename : Address → Address)
+    (left right : List Value) :
+    ValueList.mapAddresses rename (left ++ right) =
+      ValueList.mapAddresses rename left ++
+        ValueList.mapAddresses rename right := by
+  simp [ValueList.mapAddresses_eq_map]
+
+@[simp] theorem ValueList.mapAddresses_reverse (rename : Address → Address)
+    (values : List Value) :
+    ValueList.mapAddresses rename values.reverse =
+      (ValueList.mapAddresses rename values).reverse := by
+  simp [ValueList.mapAddresses_eq_map]
+
+@[simp] theorem ValueList.mapAddresses_dropLast
+    (rename : Address → Address) (values : List Value) :
+    ValueList.mapAddresses rename values.dropLast =
+      (ValueList.mapAddresses rename values).dropLast := by
+  simp [ValueList.mapAddresses_eq_map]
+
+@[simp] theorem ValueList.getElem?_mapAddresses
+    (rename : Address → Address) (values : List Value) (index : Nat) :
+    (ValueList.mapAddresses rename values)[index]? =
+      (values[index]?).map (Value.mapAddresses rename) := by
+  simp [ValueList.mapAddresses_eq_map]
+
+@[simp] theorem ValueList.getLast?_mapAddresses
+    (rename : Address → Address) (values : List Value) :
+    (ValueList.mapAddresses rename values).getLast? =
+      values.getLast?.map (Value.mapAddresses rename) := by
+  induction values with
+  | nil => simp
+  | cons value rest ih =>
+      cases rest with
+      | nil => simp
+      | cons next tail => simpa using ih
+
+@[simp] theorem majorCtor_mapAddresses (rename : Address → Address)
+    (natLit : Bool) (value : Value) :
+    majorCtor natLit (Value.mapAddresses rename value) =
+      mapMajorResult rename (majorCtor natLit value) := by
+  cases value with
+  | clos uses environment body => simp [Value.mapAddresses, majorCtor,
+      mapMajorResult, Err.mapAddresses]
+  | pap head arguments => simp [Value.mapAddresses, majorCtor,
+      mapMajorResult, Err.mapAddresses]
+  | ctor address tag arguments =>
+      simp [Value.mapAddresses, majorCtor, mapMajorResult]
+  | lit literal =>
+      cases literal with
+      | str string => simp [Value.mapAddresses, majorCtor, mapMajorResult,
+          Err.mapAddresses]
+      | nat number =>
+          cases natLit <;> cases number <;>
+            simp [Value.mapAddresses, majorCtor, mapMajorResult,
+              Err.mapAddresses]
+  | erased => simp [Value.mapAddresses, majorCtor, mapMajorResult,
+      Err.mapAddresses]
+
+@[simp] theorem mapResult_ok (rename : Address → Address) (value : Value) :
+    mapResult rename (.ok value) = .ok (Value.mapAddresses rename value) := rfl
+
+@[simp] theorem mapResult_error (rename : Address → Address) (error : Err) :
+    mapResult rename (.error error) = .error (Err.mapAddresses rename error) :=
+  rfl
+
+@[simp] theorem Err.mapAddresses_fuel (rename : Address → Address) :
+    Err.mapAddresses rename .fuel = .fuel := rfl
+
+@[simp] theorem Err.mapAddresses_stuck (rename : Address → Address)
+    (message : String) :
+    Err.mapAddresses rename (.stuck message) = .stuck message := rfl
+
+@[simp] theorem Err.mapAddresses_oracleMissing
+    (rename : Address → Address) (address : Address) :
+    Err.mapAddresses rename (.oracleMissing address) =
+      .oracleMissing (rename address) := rfl
+
+@[simp] theorem Err.mapAddresses_unknownRef
+    (rename : Address → Address) (address : Address) :
+    Err.mapAddresses rename (.unknownRef address) =
+      .unknownRef (rename address) := rfl
+
+@[simp] private theorem except_ok_bind {Error Value Result : Type}
+    (value : Value) (next : Value → Except Error Result) :
+    (Except.ok value >>= next) = next value := rfl
+
+@[simp] private theorem except_error_bind {Error Value Result : Type}
+    (error : Error) (next : Value → Except Error Result) :
+    (Except.error error >>= next) = Except.error error := rfl
+
+/-! ## Fueled evaluator equivariance -/
+
+/-- All four mutually recursive evaluator entries commute with an address map
+at one common fuel index. -/
+structure EvalTransportAt (rename : Address → Address)
+    (before after : Ctx) (fuel : Nat) : Prop where
+  eval : ∀ (environment : List Value) (expression : Expr),
+    IxIR0.eval after fuel (ValueList.mapAddresses rename environment)
+        (MutualBlock.Concrete.Expr.mapAddresses rename expression) =
+      mapResult rename (IxIR0.eval before fuel environment expression)
+  applyValue : ∀ (function argument : Value),
+    IxIR0.apply after fuel (Value.mapAddresses rename function)
+        (Value.mapAddresses rename argument) =
+      mapResult rename (IxIR0.apply before fuel function argument)
+  saturate : ∀ (head : Head) (arguments : List Value),
+    IxIR0.saturate after fuel (Head.mapAddresses rename head)
+        (ValueList.mapAddresses rename arguments) =
+      mapResult rename (IxIR0.saturate before fuel head arguments)
+  fire : ∀ (head : Head) (arguments : List Value),
+    IxIR0.fire after fuel (Head.mapAddresses rename head)
+        (ValueList.mapAddresses rename arguments) =
+      mapResult rename (IxIR0.fire before fuel head arguments)
+
+/-- Exact evaluator equivariance at every fuel. -/
+theorem evalTransportAt {rename : Address → Address} {before after : Ctx}
+    (contexts : Ctx.Renames rename before after) :
+    ∀ fuel, EvalTransportAt rename before after fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [IxIR0.eval, IxIR0.apply, IxIR0.saturate, IxIR0.fire,
+          mapResult, Err.mapAddresses]
+  | succ fuel smaller =>
+      refine {
+        eval := ?_
+        applyValue := ?_
+        saturate := ?_
+        fire := ?_ }
+      · intro environment expression
+        cases expression with
+        | var index =>
+            cases hlookup : environment[index]? with
+            | none =>
+                simp [IxIR0.eval,
+                  MutualBlock.Concrete.Expr.mapAddresses, hlookup,
+                  mapResult, Err.mapAddresses]
+            | some value =>
+                simp [IxIR0.eval,
+                  MutualBlock.Concrete.Expr.mapAddresses, hlookup,
+                  mapResult]
+        | ref address =>
+            simp only [IxIR0.eval,
+              MutualBlock.Concrete.Expr.mapAddresses, contexts.env address]
+            cases hdeclaration : before.env address with
+            | none => simp [mapResult, Err.mapAddresses]
+            | some declaration =>
+                simp only [Option.map_some]
+                cases declaration with
+                | defn result body =>
+                    simpa [MutualBlock.Concrete.Decl.mapAddresses] using
+                      smaller.eval [] body
+                | ctor tag arity =>
+                    simpa [MutualBlock.Concrete.Decl.mapAddresses,
+                      Head.mapAddresses] using
+                      smaller.saturate (.ctor address tag arity) []
+                | recursor numArgs natLit rules =>
+                    simp [MutualBlock.Concrete.Decl.mapAddresses,
+                      Value.mapAddresses, Head.mapAddresses, mapResult]
+                | extern arity =>
+                    simpa [MutualBlock.Concrete.Decl.mapAddresses,
+                      Head.mapAddresses] using
+                      smaller.saturate (.ext address arity) []
+        | app function argument =>
+            simp only [IxIR0.eval,
+              MutualBlock.Concrete.Expr.mapAddresses]
+            rw [smaller.eval environment function]
+            cases hfunction : IxIR0.eval before fuel environment function with
+            | error error => simp [mapResult]
+            | ok functionValue =>
+                simp only [mapResult, except_ok_bind]
+                rw [smaller.eval environment argument]
+                cases hargument : IxIR0.eval before fuel environment argument with
+                | error error => simp [mapResult]
+                | ok argumentValue =>
+                    simp only [mapResult, except_ok_bind]
+                    exact smaller.applyValue functionValue argumentValue
+        | lam uses body =>
+            simp [IxIR0.eval, MutualBlock.Concrete.Expr.mapAddresses,
+              Value.mapAddresses, mapResult]
+        | letE uses value body =>
+            simp only [IxIR0.eval,
+              MutualBlock.Concrete.Expr.mapAddresses]
+            rw [smaller.eval environment value]
+            cases hvalue : IxIR0.eval before fuel environment value with
+            | error error => simp [mapResult]
+            | ok result =>
+                simp only [mapResult, except_ok_bind]
+                simpa only [ValueList.mapAddresses_cons, mapResult] using
+                  smaller.eval (result :: environment) body
+        | proj index struct =>
+            simp only [IxIR0.eval,
+              MutualBlock.Concrete.Expr.mapAddresses]
+            rw [smaller.eval environment struct]
+            cases hstruct : IxIR0.eval before fuel environment struct with
+            | error error => simp [mapResult]
+            | ok value =>
+                simp only [mapResult, except_ok_bind]
+                cases value with
+                | clos uses captured body =>
+                    simp [Value.mapAddresses, Err.mapAddresses]
+                | pap head arguments =>
+                    simp [Value.mapAddresses, Err.mapAddresses]
+                | ctor address tag arguments =>
+                    cases hfield : arguments[index]? with
+                    | none =>
+                        simp [Value.mapAddresses, hfield,
+                          Err.mapAddresses]
+                    | some field =>
+                        simp [Value.mapAddresses, hfield]
+                | lit literal =>
+                    simp [Value.mapAddresses, Err.mapAddresses]
+                | erased => simp [Value.mapAddresses]
+        | lit literal =>
+            simp [IxIR0.eval, MutualBlock.Concrete.Expr.mapAddresses,
+              Value.mapAddresses, mapResult]
+        | erased =>
+            simp [IxIR0.eval, MutualBlock.Concrete.Expr.mapAddresses,
+              Value.mapAddresses, mapResult]
+      · intro function argument
+        cases function with
+        | clos uses environment body =>
+            simpa [IxIR0.apply, Value.mapAddresses] using
+              smaller.eval (argument :: environment) body
+        | pap head arguments =>
+            simpa [IxIR0.apply, Value.mapAddresses] using
+              smaller.saturate head (arguments ++ [argument])
+        | ctor address tag arguments =>
+            simp [IxIR0.apply, Value.mapAddresses, mapResult,
+              Err.mapAddresses]
+        | lit literal =>
+            simp [IxIR0.apply, Value.mapAddresses, mapResult,
+              Err.mapAddresses]
+        | erased => simp [IxIR0.apply, Value.mapAddresses, mapResult]
+      · intro head arguments
+        simp only [IxIR0.saturate, Head.arity_mapAddresses,
+          ValueList.length_mapAddresses]
+        split
+        · exact smaller.fire head arguments
+        · simp [Value.mapAddresses, mapResult]
+      · intro head arguments
+        cases head with
+        | ctor address tag arity =>
+            simp [IxIR0.fire, Head.mapAddresses, Value.mapAddresses,
+              mapResult]
+        | ext address arity =>
+            simp only [IxIR0.fire, Head.mapAddresses,
+              contexts.oracle address arguments]
+            cases horacle : before.oracle address arguments with
+            | none => simp [mapResult, Err.mapAddresses]
+            | some value => simp [mapResult]
+        | rec_ address arity =>
+            simp only [IxIR0.fire, Head.mapAddresses, contexts.env address]
+            cases hdeclaration : before.env address with
+            | none => simp [mapResult, Err.mapAddresses]
+            | some declaration =>
+                simp only [Option.map_some]
+                cases declaration with
+                | defn result body =>
+                    simp [MutualBlock.Concrete.Decl.mapAddresses,
+                      mapResult, Err.mapAddresses]
+                | ctor tag declarationArity =>
+                    simp [MutualBlock.Concrete.Decl.mapAddresses,
+                      mapResult, Err.mapAddresses]
+                | extern declarationArity =>
+                    simp [MutualBlock.Concrete.Decl.mapAddresses,
+                      mapResult, Err.mapAddresses]
+                | recursor numArgs natLit rules =>
+                    simp only [MutualBlock.Concrete.Decl.mapAddresses,
+                      ValueList.getLast?_mapAddresses]
+                    cases hlast : arguments.getLast? with
+                    | none =>
+                        simp [mapResult, Err.mapAddresses]
+                    | some major =>
+                        simp only [Option.map_some]
+                        rw [majorCtor_mapAddresses]
+                        cases hmajor : majorCtor natLit major with
+                        | error error =>
+                            simp [mapMajorResult, mapResult]
+                        | ok taggedFields =>
+                            rcases taggedFields with ⟨tag, fields⟩
+                            simp only [mapMajorResult,
+                              except_ok_bind, Array.getElem?_map]
+                            cases hrule : rules[tag]? with
+                            | none =>
+                                simp [mapResult, Err.mapAddresses]
+                            | some rule =>
+                                simp only [Option.map_some,
+                                  MutualBlock.Concrete.RecRule.mapAddresses]
+                                by_cases hfields : fields.length != rule.fields
+                                · simp [hfields, mapResult, Err.mapAddresses]
+                                · have heq : fields.length = rule.fields := by
+                                    simpa using hfields
+                                  simp only [ValueList.length_mapAddresses]
+                                  simp only [heq, bne_self_eq_false,
+                                    Bool.false_eq_true, if_false]
+                                  have henvironment :
+                                      ValueList.mapAddresses rename
+                                          (fields.reverse ++
+                                            arguments.dropLast.reverse ++
+                                            [.pap (.rec_ address arity) []]) =
+                                        (ValueList.mapAddresses rename fields).reverse ++
+                                          (ValueList.mapAddresses rename arguments).dropLast.reverse ++
+                                          [.pap (.rec_ (rename address) arity) []] := by
+                                    simp [Value.mapAddresses,
+                                      Head.mapAddresses]
+                                  rw [← henvironment]
+                                  exact smaller.eval
+                                    (fields.reverse ++
+                                      arguments.dropLast.reverse ++
+                                      [.pap (.rec_ address arity) []])
+                                    rule.rhs
+
+/-! ## Public evaluator transport interface -/
+
+/-- Expression evaluation is equivariant under every compatible context
+renaming. -/
+theorem eval_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (fuel : Nat) (environment : List Value) (expression : Expr) :
+    IxIR0.eval after fuel (ValueList.mapAddresses rename environment)
+        (MutualBlock.Concrete.Expr.mapAddresses rename expression) =
+      mapResult rename (IxIR0.eval before fuel environment expression) :=
+  (evalTransportAt contexts fuel).eval environment expression
+
+/-- Closed evaluation is the structural address image of source evaluation. -/
+theorem Ctx.run_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (expression : Expr) (fuel : Nat := 100000) :
+    after.run (MutualBlock.Concrete.Expr.mapAddresses rename expression) fuel =
+      mapResult rename (before.run expression fuel) := by
+  simpa [Ctx.run] using eval_mapAddresses contexts fuel [] expression
+
+/-! ## Certified whole-program readdressing contexts -/
+
+private theorem envOfList_some_mem
+    {entries : List (Address × Decl)} {address : Address}
+    {declaration : Decl}
+    (hlookup : Env.ofList entries address = some declaration) :
+    (address, declaration) ∈ entries := by
+  unfold Env.ofList at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryDeclaration⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × Decl => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hdeclaration : entryDeclaration = declaration := by
+    simpa using hvalue
+  subst entryAddress
+  subst entryDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+/-- The audited main is exactly the address-map image of the raw main. -/
+theorem Result.main_eq_mapAddresses {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true) :
+    result.main =
+      MutualBlock.Concrete.Expr.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) main := by
+  simp only [Result.semanticAudit, Bool.and_eq_true] at haudit
+  have himage : result.imageAudit groups main = true := haudit.1.1.1
+  simp only [Result.imageAudit, Bool.and_eq_true] at himage
+  exact (beq_iff_eq).mp himage.2
+
+/-- Every successful raw environment lookup has the certified renamed lookup
+in the emitted environment. -/
+theorem Result.lookup_eq_mapAddresses {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList (rawDeclarations groups) address =
+      some declaration) :
+    Env.ofList result.declarations
+        (MutualBlock.Renaming.apply result.addressMap address) =
+      some (MutualBlock.Concrete.Decl.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) declaration) := by
+  simp only [Result.semanticAudit, Bool.and_eq_true] at haudit
+  have hmember : (address, declaration) ∈ rawDeclarations groups :=
+    envOfList_some_mem hlookup
+  have hlookupAudit : result.lookupAudit groups = true := haudit.1.2
+  simp only [Result.lookupAudit] at hlookupAudit
+  have hentry := (List.all_eq_true.mp hlookupAudit)
+    (address, declaration) hmember
+  cases hemitted : Env.ofList result.declarations
+      (MutualBlock.Renaming.apply result.addressMap address) with
+  | none => simp [hlookup, hemitted] at hentry
+  | some emitted =>
+      have hequal : emitted =
+          MutualBlock.Concrete.Decl.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) declaration :=
+        (beq_iff_eq).mp (by simpa [hlookup, hemitted] using hentry)
+      simp [hequal]
+
+/-- Every successful emitted lookup is already a fixed point of the completed
+address map. -/
+theorem Result.lookup_stable {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList result.declarations address = some declaration) :
+    MutualBlock.Concrete.Decl.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) declaration =
+      declaration := by
+  simp only [Result.semanticAudit, Bool.and_eq_true] at haudit
+  have hmember : (address, declaration) ∈ result.declarations :=
+    envOfList_some_mem hlookup
+  have hstableAudit : result.stableLookupAudit = true := haudit.2
+  simp only [Result.stableLookupAudit] at hstableAudit
+  have hentry := (List.all_eq_true.mp hstableAudit)
+    (address, declaration) hmember
+  exact (beq_iff_eq).mp (by simpa [hlookup] using hentry)
+
+/-- The theorem-facing source environment retains every raw lookup and adds
+only stable aliases for newly derived keys.  These aliases make the forward
+context relation total without changing any lookup the raw evaluator could
+already perform. -/
+def Result.preAddressEnv (result : Result) (groups : List Group) : Env :=
+  fun address =>
+    match Env.ofList (rawDeclarations groups) address with
+    | some declaration => some declaration
+    | none =>
+        Env.ofList result.declarations
+          (MutualBlock.Renaming.apply result.addressMap address)
+
+/-- Evaluator context for the emitted content-addressed declarations. -/
+def Result.addressedCtx (result : Result)
+    (oracle : Oracle := fun _ _ => none) : Ctx :=
+  { env := Env.ofList result.declarations, oracle }
+
+/-- Evaluator context for the raw declarations and their stable aliases. -/
+def Result.preAddressCtx (result : Result) (groups : List Group)
+    (oracle : Oracle := fun _ _ => none) : Ctx :=
+  { env := result.preAddressEnv groups, oracle }
+
+@[simp] theorem Result.preAddressCtx_env_of_lookup
+    (result : Result) (groups : List Group) (oracle : Oracle)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList (rawDeclarations groups) address =
+      some declaration) :
+    (result.preAddressCtx groups oracle).env address = some declaration := by
+  simp [Result.preAddressCtx, Result.preAddressEnv, hlookup]
+
+/-- A successful audit plus an oracle-equivariance premise constructs the
+complete context relation consumed by evaluator transport. -/
+theorem Result.renames_preAddressCtx {result : Result}
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    (haudit : result.semanticAudit reserved groups main = true)
+    (beforeOracle afterOracle : Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (MutualBlock.Renaming.apply result.addressMap address)
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (Value.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap))) :
+    Ctx.Renames (MutualBlock.Renaming.apply result.addressMap)
+      (result.preAddressCtx groups beforeOracle)
+      (result.addressedCtx afterOracle) := by
+  constructor
+  · intro address
+    simp only [Result.preAddressCtx, Result.addressedCtx,
+      Result.preAddressEnv]
+    cases hraw : Env.ofList (rawDeclarations groups) address with
+    | some declaration =>
+        simpa [hraw] using result.lookup_eq_mapAddresses haudit hraw
+    | none =>
+        simp only
+        cases hemitted : Env.ofList result.declarations
+            (MutualBlock.Renaming.apply result.addressMap address) with
+        | none => simp
+        | some declaration =>
+            have hstable := result.lookup_stable haudit hemitted
+            simp [hstable]
+  · exact horacle
+
+/-- A concrete successful readdressing preserves a closed run exactly. -/
+theorem run_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result}
+    (hrun : Readdress.run reserved groups main = .ok result)
+    (beforeOracle afterOracle : Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (MutualBlock.Renaming.apply result.addressMap address)
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (Value.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap)))
+    (fuel : Nat := 100000) :
+    (result.addressedCtx afterOracle).run result.main fuel =
+      mapResult (MutualBlock.Renaming.apply result.addressMap)
+        ((result.preAddressCtx groups beforeOracle).run main fuel) := by
+  have haudit := semanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_mapAddresses haudit]
+  exact Ctx.run_mapAddresses
+    (result.renames_preAddressCtx haudit beforeOracle afterOracle horacle)
+    main fuel
+
+/-- Closed programs with no extern oracle need no compatibility premise. -/
+theorem run_emptyOracle_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result}
+    (hrun : Readdress.run reserved groups main = .ok result)
+    (fuel : Nat := 100000) :
+    (result.addressedCtx).run result.main fuel =
+      mapResult (MutualBlock.Renaming.apply result.addressMap)
+        ((result.preAddressCtx groups).run main fuel) := by
+  apply run_of_run_eq_ok hrun (fun _ _ => none) (fun _ _ => none) _ fuel
+  intro address arguments
+  rfl
+
+/-- Successful raw execution therefore yields the structurally renamed value
+under the emitted declarations. -/
+theorem run_success_of_run_eq_ok
+    {reserved : List Address} {groups : List Group} {main : Expr}
+    {result : Result}
+    (hrun : Readdress.run reserved groups main = .ok result)
+    (beforeOracle afterOracle : Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (MutualBlock.Renaming.apply result.addressMap address)
+          (ValueList.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (Value.mapAddresses
+            (MutualBlock.Renaming.apply result.addressMap)))
+    {fuel : Nat} {value : Value}
+    (hsource :
+      (result.preAddressCtx groups beforeOracle).run main fuel = .ok value) :
+    (result.addressedCtx afterOracle).run result.main fuel =
+      .ok (Value.mapAddresses
+        (MutualBlock.Renaming.apply result.addressMap) value) := by
+  rw [run_of_run_eq_ok hrun beforeOracle afterOracle horacle fuel, hsource]
+  rfl
+
+end Readdress
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/Recursion.lean b/Ix/Compiler/IxIR0/Recursion.lean
new file mode 100644
index 000000000..4b280ec80
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Recursion.lean
@@ -0,0 +1,286 @@
+import Ix.Compiler.IxIR0.Serialize
+import Ix.Compiler.IxIR0.Eval
+
+/-!
+# Checked recovery of a list accumulator recursor
+
+The first recovery schema recognizes an eager, immediate-tail `below` fold.
+Each source step constructs a tuple containing a function and the recursively
+computed tuple. Only its function projection is used by the selected entry.
+The replacement absorbs the accumulator before the major premise and invokes
+the recursor value directly in the cons rule.
+
+Recognition is deliberately bounded to closed Nat-list entries, optionally
+retaining the input in a returned pair. The recursor simulation itself covers
+arbitrary list elements and accumulators. This is a first schema, not a generic
+`brecOn` specializer. Every declaration, binder, projection, and entry use is
+checked against the exact erased input; an unrecognized input is unchanged.
+-/
+
+namespace Ix.Compiler.IxIR0.Recursion
+
+open Ix.Compiler.Ixon (Address)
+
+structure Schema where
+  nil : Address
+  cons : Address
+  pack : Address
+  unit : Address
+  recursor : Address
+  alias : Address
+  base : Address
+  step : Address
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def app2 (f x y : Expr) : Expr := .app (.app f x) y
+
+/-- The source gate's erased-argument application. For an open `e`, indices
+must already include this binder. The templates below spell those indices out.
+-/
+def ghost (e : Expr) : Expr := .app (.lam .many e) .erased
+
+def consExpr (s : Schema) (head tail : Expr) : Expr :=
+  app2 (.ref s.cons) head tail
+
+def packExpr (s : Schema) (fn below : Expr) : Expr :=
+  app2 (.ref s.pack) fn below
+
+/-- Environment after applying the captured function:
+`accumulator, erased argument, below, tail, head`. -/
+def stepBody (s : Schema) : Expr :=
+  .app (.proj 0 (.var 2)) (consExpr s (.var 4) (.var 0))
+
+def baseExpr (s : Schema) : Expr :=
+  packExpr s (ghost (.lam .many (.var 0))) (ghost (.ref s.unit))
+
+def stepExpr (s : Schema) : Expr :=
+  .lam .many (.lam .many (.lam .many
+    (packExpr s (ghost (.lam .many (stepBody s))) (.var 0))))
+
+/-- Ordinary immediate-tail structural recursion, with base and step minors.
+The cons rule evaluates its recursive argument eagerly before the step.
+Its environment is `tail, head, step, base, recursive self`. -/
+def literalRecursor (_s : Schema) : Decl :=
+  .recursor 2 false #[
+    { fields := 0, rhs := .var 1 },
+    { fields := 2
+      rhs := .app (app2 (.var 2) (.var 1) (.var 0))
+        (.app (app2 (.var 4) (.var 3) (.var 2)) (.var 0)) }]
+
+/-- The accumulator precedes the major. The recursive call is saturated and
+in tail position, which the existing ownership and CFG lowerers preserve. -/
+def directRecursor (s : Schema) : Decl :=
+  .recursor 1 false #[
+    { fields := 0, rhs := .var 0 },
+    { fields := 2
+      rhs := app2 (.var 3) (consExpr s (.var 1) (.var 2)) (.var 0) }]
+
+def literalList (s : Schema) : List Nat → Expr
+  | [] => ghost (.ref s.nil)
+  | n :: ns => consExpr s (ghost (.lit (.nat n))) (literalList s ns)
+
+def directList (s : Schema) : List Nat → Expr
+  | [] => .ref s.nil
+  | n :: ns => consExpr s (.lit (.nat n)) (directList s ns)
+
+def literalCall (s : Schema) (major accumulator : Expr) : Expr :=
+  .app (.proj 0 (.app (app2 (.ref s.alias) (.ref s.base) (.ref s.step)) major)) accumulator
+
+def directCall (address : Address) (major accumulator : Expr) : Expr :=
+  app2 (.ref address) accumulator major
+
+structure Plan where
+  schema : Schema
+  values : List Nat
+  /-- A returned pair retains an alias to the input and makes every reset
+  cold. `none` returns just the reversed list. -/
+  retainedAlias : Option Address := none
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Plan.literalMain (p : Plan) : Expr :=
+  let s := p.schema
+  match p.retainedAlias with
+  | none => literalCall s (literalList s p.values) (ghost (.ref s.nil))
+  | some pair =>
+      .letE .many (literalList s p.values)
+        (app2 (.ref pair) (literalCall s (.var 0) (ghost (.ref s.nil))) (.var 0))
+
+def Plan.directMain (p : Plan) (address : Address) : Expr :=
+  let s := p.schema
+  match p.retainedAlias with
+  | none => directCall address (directList s p.values) (.ref s.nil)
+  | some pair =>
+      .letE .many (directList s p.values)
+        (app2 (.ref pair) (directCall address (.var 0) (.ref s.nil)) (.var 0))
+
+/-- All facts read by the recursor simulation, checked against first-binding
+wins lookup in the actual source environment. -/
+structure SourceMatches (env : Env) (s : Schema) : Prop where
+  nil : env s.nil = some (.ctor 0 0)
+  cons : env s.cons = some (.ctor 1 2)
+  pack : env s.pack = some (.ctor 0 2)
+  unit : env s.unit = some (.ctor 1 0)
+  recursor : env s.recursor = some (literalRecursor s)
+  alias : env s.alias = some (.defn .shared (.ref s.recursor))
+  base : env s.base = some (.defn .shared (baseExpr s))
+  step : env s.step = some (.defn .shared (stepExpr s))
+
+instance (env : Env) (s : Schema) : Decidable (SourceMatches env s) :=
+  decidable_of_iff
+    (env s.nil = some (.ctor 0 0) ∧ env s.cons = some (.ctor 1 2) ∧
+      env s.pack = some (.ctor 0 2) ∧ env s.unit = some (.ctor 1 0) ∧
+      env s.recursor = some (literalRecursor s) ∧
+      env s.alias = some (.defn .shared (.ref s.recursor)) ∧
+      env s.base = some (.defn .shared (baseExpr s)) ∧
+      env s.step = some (.defn .shared (stepExpr s)))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2.1, h.2.2.2.2.1,
+        h.2.2.2.2.2.1, h.2.2.2.2.2.2.1, h.2.2.2.2.2.2.2⟩,
+      fun h => ⟨h.nil, h.cons, h.pack, h.unit, h.recursor, h.alias, h.base, h.step⟩⟩
+
+def Plan.aliasMatches (p : Plan) (env : Env) : Prop :=
+  match p.retainedAlias with
+  | none => True
+  | some pair => env pair = some (.ctor 0 2)
+
+instance (p : Plan) (env : Env) : Decidable (p.aliasMatches env) := by
+  unfold Plan.aliasMatches
+  split <;> infer_instance
+
+/-- A proposal cannot supply a replacement body. Checking fixes both source
+and target to the proved schema. Proof fields erase from generated code. -/
+structure Checked (declarations : List (Address × Decl)) (main : Expr) where
+  plan : Plan
+  root : Address
+  mainEq : main = .ref root
+  source : SourceMatches (Env.ofList declarations) plan.schema
+  entry : Env.ofList declarations root = some (.defn .shared plan.literalMain)
+  alias : plan.aliasMatches (Env.ofList declarations)
+
+def check (declarations : List (Address × Decl)) (main : Expr)
+    (plan : Plan) : Option (Checked declarations main) :=
+  match main with
+  | .ref root =>
+      if hs : SourceMatches (Env.ofList declarations) plan.schema then
+        if he : Env.ofList declarations root = some (.defn .shared plan.literalMain) then
+          if ha : plan.aliasMatches (Env.ofList declarations) then
+            some { plan, root, mainEq := rfl, source := hs, entry := he, alias := ha }
+          else none
+        else none
+      else none
+  | _ => none
+
+private def ghostRef? : Expr → Option Address
+  | .app (.lam .many (.ref a)) .erased => some a
+  | _ => none
+
+private def literalList? (s : Schema) : Expr → Option (List Nat)
+  | .app (.lam .many (.ref a)) .erased =>
+      if a == s.nil then some [] else none
+  | .app (.app (.ref a) (.app (.lam .many (.lit (.nat n))) .erased)) tail =>
+      if a == s.cons then (n :: ·) <$> literalList? s tail else none
+  | _ => none
+
+private def call? : Expr → Option (Address × Address × Address × Expr × Address)
+  | .app (.proj 0 (.app (.app (.app (.ref alias) (.ref base)) (.ref step)) major)) acc => do
+      return (alias, base, step, major, ← ghostRef? acc)
+  | _ => none
+
+/-- The recognizer only proposes addresses and a parsed input. `check` then
+compares the complete rules and entry, including every use of `below`. -/
+def propose (declarations : List (Address × Decl)) (main : Expr) : Option Plan := do
+  let .ref root := main | none
+  let env := Env.ofList declarations
+  let some (.defn .shared body) := env root | none
+  let (alias, base, step, major, nil, retainedAlias) ← match body with
+    | .letE .many major (.app (.app (.ref pair) call) (.var 0)) => do
+        let (alias, base, step, .var 0, nil) ← call? call | none
+        pure (alias, base, step, major, nil, some pair)
+    | body => do
+        let (alias, base, step, major, nil) ← call? body
+        pure (alias, base, step, major, nil, none)
+  let some (.defn .shared (.ref recursor)) := env alias | none
+  let some (.recursor 2 false _) := env recursor | none
+  let some (.defn .shared (.app (.app (.ref pack) _) unitExpr)) := env base | none
+  let unit ← ghostRef? unitExpr
+  let some (.defn .shared (.lam .many (.lam .many (.lam .many
+    (.app (.app _ fn) _))))) := env step | none
+  let .app (.lam .many (.lam .many body)) .erased := fn | none
+  let .app _ (.app (.app (.ref cons) _) _) := body | none
+  let schema : Schema := { nil, cons, pack, unit, recursor, alias, base, step }
+  let values ← literalList? schema major
+  return { schema, values, retainedAlias }
+
+inductive Skip where
+  | unrecognized
+  | rejectedProposal
+  | addressConflict
+  | rejectedTarget
+  deriving BEq, Repr
+
+/-- The generated declaration has its own canonical IxIR₀ identity. Source
+constructor identities are stable; source recursor and entry keys are never
+reused for changed bodies. -/
+def targetDeclarations (p : Plan) (address : Address) : List (Address × Decl) :=
+  [(p.schema.nil, .ctor 0 0), (p.schema.cons, .ctor 1 2),
+    (address, directRecursor p.schema)] ++
+    p.retainedAlias.toList.map (fun pair => (pair, .ctor 0 2))
+
+structure TargetMatches (env : Env) (p : Plan) (address : Address) : Prop where
+  nil : env p.schema.nil = some (.ctor 0 0)
+  cons : env p.schema.cons = some (.ctor 1 2)
+  recursor : env address = some (directRecursor p.schema)
+  alias : p.aliasMatches env
+
+instance (env : Env) (p : Plan) (address : Address) :
+    Decidable (TargetMatches env p address) :=
+  decidable_of_iff
+    (env p.schema.nil = some (.ctor 0 0) ∧ env p.schema.cons = some (.ctor 1 2) ∧
+      env address = some (directRecursor p.schema) ∧ p.aliasMatches env)
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2⟩,
+      fun h => ⟨h.nil, h.cons, h.recursor, h.alias⟩⟩
+
+structure Recovered (declarations : List (Address × Decl)) (main : Expr) where
+  checked : Checked declarations main
+  address : Address
+  addressed : address = (directRecursor checked.plan.schema).address
+  fresh : address ∉ declarations.map (·.1)
+  target : TargetMatches (Env.ofList (targetDeclarations checked.plan address))
+    checked.plan address
+
+inductive Selection (declarations : List (Address × Decl)) (main : Expr) where
+  | literal (reason : Skip)
+  | recovered (result : Recovered declarations main)
+
+def Selection.declarations {declarations : List (Address × Decl)} {main : Expr} :
+    Selection declarations main → List (Address × Decl)
+  | .literal _ => declarations
+  | .recovered result => targetDeclarations result.checked.plan result.address
+
+def Selection.main {declarations : List (Address × Decl)} {main : Expr} :
+    Selection declarations main → Expr
+  | .literal _ => main
+  | .recovered result => result.checked.plan.directMain result.address
+
+/-- Untrusted proposals cross the exact checker; failures preserve the input
+literally. Canonical naming and target lookup are checked independently. -/
+def selectWith (declarations : List (Address × Decl)) (main : Expr)
+    (proposal : Option Plan) : Selection declarations main :=
+  match proposal with
+  | none => .literal .unrecognized
+  | some plan =>
+      match check declarations main plan with
+      | none => .literal .rejectedProposal
+      | some checked =>
+          let address := (directRecursor checked.plan.schema).address
+          if hfresh : address ∉ declarations.map (·.1) then
+            if ht : TargetMatches
+                (Env.ofList (targetDeclarations checked.plan address)) checked.plan address then
+              .recovered { checked, address, addressed := rfl, fresh := hfresh, target := ht }
+            else .literal .rejectedTarget
+          else .literal .addressConflict
+
+def select (declarations : List (Address × Decl)) (main : Expr) :
+    Selection declarations main :=
+  selectWith declarations main (propose declarations main)
+
+end Ix.Compiler.IxIR0.Recursion
diff --git a/Ix/Compiler/IxIR0/RecursionSim.lean b/Ix/Compiler/IxIR0/RecursionSim.lean
new file mode 100644
index 000000000..4ea570de7
--- /dev/null
+++ b/Ix/Compiler/IxIR0/RecursionSim.lean
@@ -0,0 +1,451 @@
+import Ix.Compiler.IxIR0.Recursion
+import Ix.Compiler.IxIR0.Mono
+
+/-!
+# Forward simulation for the first recovered recursor
+
+Fuel only witnesses termination. The proof constructs successful executions
+of the eager tuple fold and the derived accumulator recursor for every finite
+list, then uses determinism to transport any successful literal execution.
+No evaluator, cost counter, or ownership rule is changed by recovery.
+-/
+
+namespace Ix.Compiler.IxIR0.Recursion
+
+open Ix.Compiler.Ixon (Address Uses)
+
+def Evaluates (ctx : Ctx) (env : List Value) (expr : Expr) (value : Value) : Prop :=
+  ∃ fuel, eval ctx fuel env expr = .ok value
+
+def Applies (ctx : Ctx) (fn arg value : Value) : Prop :=
+  ∃ fuel, apply ctx fuel fn arg = .ok value
+
+@[simp] private theorem bindOk {α β : Type} (a : α) (f : α → Except Err β) :
+    (Except.ok a >>= f) = f a := rfl
+
+theorem Evaluates.unique {ctx : Ctx} {env : List Value} {expr : Expr} {v w : Value}
+    (hv : Evaluates ctx env expr v) (hw : Evaluates ctx env expr w) : v = w := by
+  obtain ⟨fv, hv⟩ := hv
+  obtain ⟨fw, hw⟩ := hw
+  have hv' := eval_mono (fuel' := fv + fw) (by omega) hv
+  have hw' := eval_mono (fuel' := fv + fw) (by omega) hw
+  exact Except.ok.inj (hv'.symm.trans hw')
+
+theorem evaluatesVar {ctx : Ctx} {env : List Value} {i : Nat} {v : Value}
+    (h : env[i]? = some v) : Evaluates ctx env (.var i) v := by
+  refine ⟨1, ?_⟩
+  simp [eval, h]
+
+theorem evaluatesLam (ctx : Ctx) (env : List Value) (u : Uses) (body : Expr) :
+    Evaluates ctx env (.lam u body) (.clos u env body) :=
+  ⟨1, by simp [eval]⟩
+
+theorem evaluatesErased (ctx : Ctx) (env : List Value) :
+    Evaluates ctx env .erased .erased := ⟨1, by simp [eval]⟩
+
+theorem evaluatesLit (ctx : Ctx) (env : List Value) (l : Literal) :
+    Evaluates ctx env (.lit l) (.lit l) := ⟨1, by simp [eval]⟩
+
+theorem evaluatesDef {ctx : Ctx} {env : List Value} {address : Address}
+    {world : Ixon.Owned} {body : Expr} {v : Value}
+    (hdecl : ctx.env address = some (.defn world body))
+    (hbody : Evaluates ctx [] body v) : Evaluates ctx env (.ref address) v := by
+  obtain ⟨fuel, hbody⟩ := hbody
+  refine ⟨fuel + 1, ?_⟩
+  rw [eval.eq_def]
+  simpa only [hdecl] using hbody
+
+theorem evaluatesRecursor {ctx : Ctx} {env : List Value} {address : Address}
+    {arity : Nat} {natLit : Bool} {rules : Array RecRule}
+    (hdecl : ctx.env address = some (.recursor arity natLit rules)) :
+    Evaluates ctx env (.ref address) (.pap (.rec_ address (arity + 1)) []) := by
+  refine ⟨1, ?_⟩
+  simp [eval, hdecl]
+
+theorem evaluatesNullary {ctx : Ctx} {env : List Value} {address : Address} {tag : Nat}
+    (hdecl : ctx.env address = some (.ctor tag 0)) :
+    Evaluates ctx env (.ref address) (.ctor address tag []) := by
+  refine ⟨4, ?_⟩
+  simp [eval, saturate, fire, Head.arity, hdecl]
+
+theorem evaluatesBinary {ctx : Ctx} {env : List Value} {address : Address} {tag : Nat}
+    (hdecl : ctx.env address = some (.ctor tag 2)) :
+    Evaluates ctx env (.ref address) (.pap (.ctor address tag 2) []) := by
+  refine ⟨2, ?_⟩
+  simp [eval, saturate, Head.arity, hdecl]
+
+theorem appliesBinaryFirst (ctx : Ctx) (address : Address) (tag : Nat) (v : Value) :
+    Applies ctx (.pap (.ctor address tag 2) []) v
+      (.pap (.ctor address tag 2) [v]) := by
+  refine ⟨2, ?_⟩
+  simp [apply, saturate, Head.arity]
+
+theorem appliesBinaryLast (ctx : Ctx) (address : Address) (tag : Nat) (v w : Value) :
+    Applies ctx (.pap (.ctor address tag 2) [v]) w (.ctor address tag [v, w]) := by
+  refine ⟨4, ?_⟩
+  simp [apply, saturate, fire, Head.arity]
+
+theorem appliesClosure {ctx : Ctx} {env : List Value} {u : Uses} {body : Expr}
+    {arg v : Value} (h : Evaluates ctx (arg :: env) body v) :
+    Applies ctx (.clos u env body) arg v := by
+  obtain ⟨fuel, h⟩ := h
+  refine ⟨fuel + 1, ?_⟩
+  rw [apply.eq_def]
+  exact h
+
+theorem evaluatesApp {ctx : Ctx} {env : List Value} {fn arg : Expr} {f a v : Value}
+    (hf : Evaluates ctx env fn f) (ha : Evaluates ctx env arg a)
+    (happly : Applies ctx f a v) : Evaluates ctx env (.app fn arg) v := by
+  obtain ⟨ff, hf⟩ := hf
+  obtain ⟨fa, ha⟩ := ha
+  obtain ⟨fp, happly⟩ := happly
+  have hf' := eval_mono (fuel' := ff + fa + fp) (by omega) hf
+  have ha' := eval_mono (fuel' := ff + fa + fp) (by omega) ha
+  have hp' := apply_mono (fuel' := ff + fa + fp) (by omega) happly
+  refine ⟨ff + fa + fp + 1, ?_⟩
+  rw [eval.eq_def]
+  simp only [hf', ha', hp', bindOk]
+
+theorem evaluatesLet {ctx : Ctx} {env : List Value} {u : Uses} {val body : Expr}
+    {w v : Value} (hv : Evaluates ctx env val w)
+    (hb : Evaluates ctx (w :: env) body v) : Evaluates ctx env (.letE u val body) v := by
+  obtain ⟨fv, hv⟩ := hv
+  obtain ⟨fb, hb⟩ := hb
+  have hv' := eval_mono (fuel' := fv + fb) (by omega) hv
+  have hb' := eval_mono (fuel' := fv + fb) (by omega) hb
+  refine ⟨fv + fb + 1, ?_⟩
+  rw [eval.eq_def]
+  simp only [hv', hb', bindOk]
+
+theorem evaluatesFirst {ctx : Ctx} {env : List Value} {expr : Expr}
+    {address : Address} {tag : Nat} {v w : Value}
+    (h : Evaluates ctx env expr (.ctor address tag [v, w])) :
+    Evaluates ctx env (.proj 0 expr) v := by
+  obtain ⟨fuel, h⟩ := h
+  refine ⟨fuel + 1, ?_⟩
+  rw [eval.eq_def]
+  simp only [h, bindOk, List.getElem?_cons_zero]
+
+theorem evaluatesGhost {ctx : Ctx} {env : List Value} {body : Expr} {v : Value}
+    (h : Evaluates ctx (.erased :: env) body v) :
+    Evaluates ctx env (ghost body) v :=
+  evaluatesApp (evaluatesLam ctx env .many body) (evaluatesErased ctx env)
+    (appliesClosure h)
+
+theorem evaluatesCtor2 {ctx : Ctx} {env : List Value} {address : Address}
+    {tag : Nat} {left right : Expr} {v w : Value}
+    (hdecl : ctx.env address = some (.ctor tag 2))
+    (hv : Evaluates ctx env left v) (hw : Evaluates ctx env right w) :
+    Evaluates ctx env (app2 (.ref address) left right) (.ctor address tag [v, w]) :=
+  evaluatesApp
+    (evaluatesApp (evaluatesBinary hdecl) hv (appliesBinaryFirst ctx address tag v))
+    hw (appliesBinaryLast ctx address tag v w)
+
+/-- One actual recursor dispatch, with the evaluator's field and pre-major
+environment order. This lemma does not assume any recursive progress. -/
+theorem appliesRecursor {ctx : Ctx} {address majorAddress : Address}
+    {numArgs tag : Nat} {rules : Array RecRule} {rule : RecRule}
+    {pre fields : List Value} {v : Value}
+    (hdecl : ctx.env address = some (.recursor numArgs false rules))
+    (hpre : pre.length = numArgs) (hrule : rules[tag]? = some rule)
+    (hfields : fields.length = rule.fields)
+    (hbody : Evaluates ctx
+      (fields.reverse ++ pre.reverse ++ [.pap (.rec_ address (numArgs + 1)) []]) rule.rhs v) :
+    Applies ctx (.pap (.rec_ address (numArgs + 1)) pre)
+      (.ctor majorAddress tag fields) v := by
+  obtain ⟨fuel, hbody⟩ := hbody
+  refine ⟨fuel + 3, ?_⟩
+  rw [apply.eq_def]
+  dsimp only
+  rw [saturate.eq_def]
+  simp only [Head.arity, List.length_append, List.length_singleton, hpre,
+    beq_self_eq_true, ite_true]
+  rw [fire.eq_def]
+  simpa [hdecl, majorCtor, hrule, hfields] using hbody
+
+theorem appliesAccumulator (ctx : Ctx) (address : Address) (v : Value) :
+    Applies ctx (.pap (.rec_ address 2) []) v (.pap (.rec_ address 2) [v]) := by
+  refine ⟨2, ?_⟩
+  simp [apply, saturate, Head.arity]
+
+def listValue (s : Schema) : List Value → Value
+  | [] => .ctor s.nil 0 []
+  | v :: vs => .ctor s.cons 1 [v, listValue s vs]
+
+def baseValue (s : Schema) : Value :=
+  .ctor s.pack 0 [.clos .many [.erased] (.var 0), .ctor s.unit 1 []]
+
+def stepValue (s : Schema) : Value :=
+  .clos .many [] (.lam .many (.lam .many
+    (packExpr s (ghost (.lam .many (stepBody s))) (.var 0))))
+
+/-- The literal evaluator retains every recursively built below tuple in
+the next tuple and in the function's closure environment. -/
+def belowValue (s : Schema) : List Value → Value
+  | [] => baseValue s
+  | v :: vs =>
+      let below := belowValue s vs
+      .ctor s.pack 0
+        [.clos .many [.erased, below, listValue s vs, v] (stepBody s), below]
+
+def belowFunction (s : Schema) : List Value → Value
+  | [] => .clos .many [.erased] (.var 0)
+  | v :: vs =>
+      .clos .many [.erased, belowValue s vs, listValue s vs, v] (stepBody s)
+
+def belowTail (s : Schema) : List Value → Value
+  | [] => .ctor s.unit 1 []
+  | _ :: vs => belowValue s vs
+
+theorem belowValue_eq (s : Schema) (vs : List Value) :
+    belowValue s vs = .ctor s.pack 0 [belowFunction s vs, belowTail s vs] := by
+  cases vs <;> rfl
+
+def reverseOnto (s : Schema) : List Value → Value → Value
+  | [], acc => acc
+  | v :: vs, acc => reverseOnto s vs (.ctor s.cons 1 [v, acc])
+
+theorem reverseOnto_listValue (s : Schema) (vs acc : List Value) :
+    reverseOnto s vs (listValue s acc) = listValue s (vs.reverse ++ acc) := by
+  induction vs generalizing acc with
+  | nil => rfl
+  | cons v vs ih =>
+      change reverseOnto s vs (listValue s (v :: acc)) = _
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+theorem evaluatesBase {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (env : List Value) : Evaluates ctx env (.ref s.base) (baseValue s) :=
+  evaluatesDef hs.base (evaluatesCtor2 hs.pack
+    (evaluatesGhost (evaluatesLam _ _ _ _)) (evaluatesGhost (evaluatesNullary hs.unit)))
+
+theorem evaluatesStep {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (env : List Value) : Evaluates ctx env (.ref s.step) (stepValue s) :=
+  evaluatesDef hs.step (evaluatesLam _ _ _ _)
+
+theorem appliesTernaryFirst (ctx : Ctx) (address : Address) (v : Value) :
+    Applies ctx (.pap (.rec_ address 3) []) v (.pap (.rec_ address 3) [v]) := by
+  refine ⟨2, ?_⟩
+  simp [apply, saturate, Head.arity]
+
+theorem appliesTernaryNext (ctx : Ctx) (address : Address) (v w : Value) :
+    Applies ctx (.pap (.rec_ address 3) [v]) w (.pap (.rec_ address 3) [v, w]) := by
+  refine ⟨2, ?_⟩
+  simp [apply, saturate, Head.arity]
+
+theorem appliesStepFirst (ctx : Ctx) (s : Schema) (head : Value) :
+    Applies ctx (stepValue s) head
+      (.clos .many [head] (.lam .many
+        (packExpr s (ghost (.lam .many (stepBody s))) (.var 0)))) :=
+  appliesClosure (evaluatesLam _ _ _ _)
+
+theorem appliesStepNext (ctx : Ctx) (s : Schema) (head tail : Value) :
+    Applies ctx (.clos .many [head] (.lam .many
+        (packExpr s (ghost (.lam .many (stepBody s))) (.var 0)))) tail
+      (.clos .many [tail, head] (packExpr s (ghost (.lam .many (stepBody s))) (.var 0))) :=
+  appliesClosure (evaluatesLam _ _ _ _)
+
+theorem appliesStepLast {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (head tail below : Value) :
+    Applies ctx (.clos .many [tail, head]
+        (packExpr s (ghost (.lam .many (stepBody s))) (.var 0))) below
+      (.ctor s.pack 0 [.clos .many [.erased, below, tail, head] (stepBody s), below]) :=
+  appliesClosure (evaluatesCtor2 hs.pack
+    (evaluatesGhost (evaluatesLam _ _ _ _)) (evaluatesVar (by rfl)))
+
+/-- The literal fold is total on finite constructor lists. Every recursive
+call in this proof is the evaluator's actual eager call on the tail. -/
+theorem sourceTuple {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (vs : List Value) :
+    Applies ctx (.pap (.rec_ s.recursor 3) [baseValue s, stepValue s])
+      (listValue s vs) (belowValue s vs) := by
+  induction vs with
+  | nil =>
+      apply appliesRecursor hs.recursor (pre := [baseValue s, stepValue s])
+        (tag := 0) (by rfl) (by rfl) (by rfl)
+      exact evaluatesVar (by rfl)
+  | cons v vs ih =>
+      apply appliesRecursor hs.recursor (pre := [baseValue s, stepValue s])
+        (tag := 1) (by rfl) (by rfl) (by rfl)
+      exact evaluatesApp
+        (evaluatesApp
+          (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl))
+            (appliesStepFirst ctx s v))
+          (evaluatesVar (by rfl)) (appliesStepNext ctx s v (listValue s vs)))
+        (evaluatesApp
+          (evaluatesApp
+            (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl))
+              (appliesTernaryFirst ctx s.recursor (baseValue s)))
+            (evaluatesVar (by rfl)) (appliesTernaryNext ctx s.recursor (baseValue s) (stepValue s)))
+          (evaluatesVar (by rfl)) ih)
+        (appliesStepLast hs v (listValue s vs) (belowValue s vs))
+
+/-- Applying the literal function demands only the immediate tail's function
+projection. Its other below data remains observationally irrelevant. -/
+theorem sourceFunction {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (vs : List Value) (acc : Value) :
+    Applies ctx (belowFunction s vs) acc (reverseOnto s vs acc) := by
+  induction vs generalizing acc with
+  | nil => exact appliesClosure (evaluatesVar (by rfl))
+  | cons v vs ih =>
+      apply appliesClosure
+      apply evaluatesApp
+        (evaluatesFirst (address := s.pack) (tag := 0) (w := belowTail s vs) ?_)
+        (evaluatesCtor2 hs.cons (evaluatesVar (by rfl)) (evaluatesVar (by rfl)))
+        (ih (.ctor s.cons 1 [v, acc]))
+      rw [← belowValue_eq]
+      exact evaluatesVar (by rfl)
+
+/-- The derived recursor computes the same accumulator fold by direct self
+application. No tuple or function value is allocated by its rules. -/
+theorem directLoop {ctx : Ctx} {s : Schema} {address : Address}
+    (hcons : ctx.env s.cons = some (.ctor 1 2))
+    (hrec : ctx.env address = some (directRecursor s))
+    (vs : List Value) (acc : Value) :
+    Applies ctx (.pap (.rec_ address 2) [acc]) (listValue s vs)
+      (reverseOnto s vs acc) := by
+  induction vs generalizing acc with
+  | nil =>
+      apply appliesRecursor hrec (pre := [acc]) (tag := 0) (by rfl) (by rfl) (by rfl)
+      exact evaluatesVar (by rfl)
+  | cons v vs ih =>
+      apply appliesRecursor hrec (pre := [acc]) (tag := 1) (by rfl) (by rfl) (by rfl)
+      exact evaluatesApp
+        (evaluatesApp (evaluatesVar (by rfl))
+          (evaluatesCtor2 hcons (evaluatesVar (by rfl)) (evaluatesVar (by rfl)))
+          (appliesAccumulator ctx address (.ctor s.cons 1 [v, acc])))
+        (evaluatesVar (by rfl)) (ih (.ctor s.cons 1 [v, acc]))
+
+theorem literalRun {ctx : Ctx} {s : Schema} {env : List Value}
+    {major accumulator : Expr} {vs : List Value} {acc : Value}
+    (hs : SourceMatches ctx.env s)
+    (hmajor : Evaluates ctx env major (listValue s vs))
+    (hacc : Evaluates ctx env accumulator acc) :
+    Evaluates ctx env (literalCall s major accumulator) (reverseOnto s vs acc) := by
+  have htuple := evaluatesApp
+    (evaluatesApp
+      (evaluatesApp (evaluatesDef hs.alias (evaluatesRecursor hs.recursor))
+        (evaluatesBase hs env) (appliesTernaryFirst ctx s.recursor (baseValue s)))
+      (evaluatesStep hs env) (appliesTernaryNext ctx s.recursor (baseValue s) (stepValue s)))
+    hmajor (sourceTuple hs vs)
+  rw [belowValue_eq] at htuple
+  exact evaluatesApp (evaluatesFirst htuple) hacc (sourceFunction hs vs acc)
+
+theorem directRun {ctx : Ctx} {s : Schema} {address : Address} {env : List Value}
+    {major accumulator : Expr} {vs : List Value} {acc : Value}
+    (hcons : ctx.env s.cons = some (.ctor 1 2))
+    (hrec : ctx.env address = some (directRecursor s))
+    (hmajor : Evaluates ctx env major (listValue s vs))
+    (hacc : Evaluates ctx env accumulator acc) :
+    Evaluates ctx env (directCall address major accumulator) (reverseOnto s vs acc) :=
+  evaluatesApp
+    (evaluatesApp (evaluatesRecursor hrec) hacc (appliesAccumulator ctx address acc))
+    hmajor (directLoop hcons hrec vs acc)
+
+/-- The schema theorem is independent of ground input syntax: it covers
+arbitrary element values, arbitrary accumulators, and every successful
+literal fuel. Source and target execute the actual IxIR₀ evaluator. -/
+theorem recursorForwardSimulation {source target : Ctx} {s : Schema} {address : Address}
+    (hs : SourceMatches source.env s)
+    (hcons : target.env s.cons = some (.ctor 1 2))
+    (hrec : target.env address = some (directRecursor s))
+    (vs : List Value) (acc : Value) {sourceFuel : Nat} {value : Value}
+    (hsource : eval source sourceFuel [acc, listValue s vs]
+      (literalCall s (.var 1) (.var 0)) = .ok value) :
+    ∃ targetFuel, eval target targetFuel [acc, listValue s vs]
+      (directCall address (.var 1) (.var 0)) = .ok value := by
+  have hliteral := literalRun hs (vs := vs) (acc := acc)
+    (evaluatesVar (env := [acc, listValue s vs]) (i := 1) (by rfl))
+    (evaluatesVar (i := 0) (by rfl))
+  have hvalue := Evaluates.unique ⟨sourceFuel, hsource⟩ hliteral
+  rw [hvalue]
+  exact directRun hcons hrec (evaluatesVar (by rfl)) (evaluatesVar (by rfl))
+
+def natValues (ns : List Nat) : List Value := ns.map (fun n => .lit (.nat n))
+
+theorem literalListRun {ctx : Ctx} {s : Schema} (hs : SourceMatches ctx.env s)
+    (env : List Value) (ns : List Nat) :
+    Evaluates ctx env (literalList s ns) (listValue s (natValues ns)) := by
+  induction ns with
+  | nil => exact evaluatesGhost (evaluatesNullary hs.nil)
+  | cons n ns ih =>
+      exact evaluatesCtor2 hs.cons (evaluatesGhost (evaluatesLit _ _ _)) ih
+
+theorem directListRun {ctx : Ctx} {s : Schema}
+    (hnil : ctx.env s.nil = some (.ctor 0 0))
+    (hcons : ctx.env s.cons = some (.ctor 1 2)) (env : List Value) (ns : List Nat) :
+    Evaluates ctx env (directList s ns) (listValue s (natValues ns)) := by
+  induction ns with
+  | nil => exact evaluatesNullary hnil
+  | cons n ns ih => exact evaluatesCtor2 hcons (evaluatesLit _ _ _) ih
+
+def Plan.value (p : Plan) : Value :=
+  let reversed := reverseOnto p.schema (natValues p.values) (.ctor p.schema.nil 0 [])
+  match p.retainedAlias with
+  | none => reversed
+  | some pair => .ctor pair 0 [reversed, listValue p.schema (natValues p.values)]
+
+theorem literalMainRun {ctx : Ctx} {p : Plan}
+    (hs : SourceMatches ctx.env p.schema) (ha : p.aliasMatches ctx.env) :
+    Evaluates ctx [] p.literalMain p.value := by
+  cases hpair : p.retainedAlias with
+  | none =>
+      simpa only [Plan.literalMain, Plan.value, hpair] using
+        literalRun hs (literalListRun hs [] p.values) (evaluatesGhost (evaluatesNullary hs.nil))
+  | some pair =>
+      have hp : ctx.env pair = some (.ctor 0 2) := by
+        simpa only [Plan.aliasMatches, hpair] using ha
+      simp only [Plan.literalMain, Plan.value, hpair]
+      exact evaluatesLet (literalListRun hs [] p.values)
+        (evaluatesCtor2 hp
+          (literalRun hs (evaluatesVar (by rfl)) (evaluatesGhost (evaluatesNullary hs.nil)))
+          (evaluatesVar (by rfl)))
+
+theorem directMainRun {ctx : Ctx} {p : Plan} {address : Address}
+    (ht : TargetMatches ctx.env p address) :
+    Evaluates ctx [] (p.directMain address) p.value := by
+  cases hpair : p.retainedAlias with
+  | none =>
+      simpa only [Plan.directMain, Plan.value, hpair] using
+        directRun ht.cons ht.recursor (directListRun ht.nil ht.cons [] p.values)
+          (evaluatesNullary ht.nil)
+  | some pair =>
+      have hp : ctx.env pair = some (.ctor 0 2) := by
+        simpa only [Plan.aliasMatches, hpair] using ht.alias
+      simp only [Plan.directMain, Plan.value, hpair]
+      exact evaluatesLet (directListRun ht.nil ht.cons [] p.values)
+        (evaluatesCtor2 hp
+          (directRun ht.cons ht.recursor (evaluatesVar (by rfl)) (evaluatesNullary ht.nil))
+          (evaluatesVar (by rfl)))
+
+theorem Checked.sourceEvaluates {declarations : List (Address × Decl)} {main : Expr}
+    (checked : Checked declarations main) :
+    Evaluates { env := Env.ofList declarations } [] main checked.plan.value := by
+  simpa only [checked.mainEq] using
+    evaluatesDef (env := []) checked.entry (literalMainRun checked.source checked.alias)
+
+/-- Exact checked whole-entry preservation, including removal of the
+source-only argument wrappers and optional retention of the input alias. -/
+theorem Recovered.forwardSimulation {declarations : List (Address × Decl)} {main : Expr}
+    (result : Recovered declarations main) {sourceFuel : Nat} {value : Value}
+    (hsource : eval { env := Env.ofList declarations } sourceFuel [] main = .ok value) :
+    ∃ targetFuel,
+      eval { env := Env.ofList (targetDeclarations result.checked.plan result.address) }
+        targetFuel [] (result.checked.plan.directMain result.address) = .ok value := by
+  have hvalue := Evaluates.unique ⟨sourceFuel, hsource⟩ result.checked.sourceEvaluates
+  rw [hvalue]
+  exact directMainRun result.target
+
+/-- Failed or unsupported proposals keep the literal execution; successful
+proposals use the exact checked replacement. Callers supply no rewrite facts.
+-/
+theorem Selection.forwardSimulation {declarations : List (Address × Decl)} {main : Expr}
+    (selection : Selection declarations main) {sourceFuel : Nat} {value : Value}
+    (hsource : eval { env := Env.ofList declarations } sourceFuel [] main = .ok value) :
+    ∃ targetFuel, eval { env := Env.ofList selection.declarations }
+      targetFuel [] selection.main = .ok value := by
+  cases selection with
+  | literal reason => exact ⟨sourceFuel, hsource⟩
+  | recovered result => exact result.forwardSimulation hsource
+
+end Ix.Compiler.IxIR0.Recursion
diff --git a/Ix/Compiler/IxIR0/RecursorModes.lean b/Ix/Compiler/IxIR0/RecursorModes.lean
new file mode 100644
index 000000000..1a6c3c582
--- /dev/null
+++ b/Ix/Compiler/IxIR0/RecursorModes.lean
@@ -0,0 +1,44 @@
+import Ix.Compiler.IxIR0.Serialize
+
+/-! Explicit recursor instantiation metadata. Ordinary IxIR₀ declarations
+retain their existing syntax and evaluator. The instantiation identity commits
+to both that declaration and every argument, field, and result world. -/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR
+
+structure RecursorInstance where
+  declaration : Decl
+  arguments : List Owned
+  fields : List (List Owned)
+  result : Owned
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def RecursorInstance.wellShaped (instantiation : RecursorInstance) : Bool :=
+  match instantiation.declaration with
+  | .recursor numArgs _ rules =>
+      instantiation.arguments.length == numArgs + 1 &&
+        instantiation.fields.length == rules.size &&
+        (instantiation.fields.zip rules.toList).all fun (worlds, rule) => worlds.length == rule.fields
+  | _ => false
+
+def RecursorInstance.bytes (instantiation : RecursorInstance) : ByteArray :=
+  Encoding.domain "compilatrix/ixir0/recursor-instance/1" ++ Encoding.tag 0 ++
+    Encoding.blob instantiation.declaration.preimage ++
+    Encoding.list (fun world => Encoding.tag world.toBits) instantiation.arguments ++
+    Encoding.list (Encoding.list fun world => Encoding.tag world.toBits) instantiation.fields ++
+    Encoding.tag instantiation.result.toBits
+
+def RecursorInstance.address (instantiation : RecursorInstance) : Address :=
+  Address.blake3 instantiation.bytes
+
+theorem RecursorInstance.address_eq_iff_bytes_eq (left right : RecursorInstance)
+    (hcollision : Address.Blake3NoCollision left.bytes right.bytes) :
+    left.address = right.address ↔ left.bytes = right.bytes := by
+  constructor
+  · exact hcollision
+  · intro h; simp only [address]; rw [h]
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/Serialize.lean b/Ix/Compiler/IxIR0/Serialize.lean
new file mode 100644
index 000000000..5f860ca54
--- /dev/null
+++ b/Ix/Compiler/IxIR0/Serialize.lean
@@ -0,0 +1,115 @@
+import Ix.Compiler.IxIR.Encoding
+import Ix.Compiler.IxIR0.Basic
+
+/-!
+# IxIR₀ canonical hash preimages
+
+Every constructor of the erased semantic IR has an explicit byte spelling.
+The top-level declaration preimage is domain-separated as
+`compilatrix/ixir0/decl/1`, followed by NUL and the declaration payload.
+References retain their exact 32-byte address; recursive recursor calls remain
+cycle-free because `RecRule.rhs` uses the rule environment's self binder.
+
+This module defines artifact identity, not an ingress decoder. A later store
+format may frame the same payloads, but changing these bytes requires an
+explicit address-version roll.
+-/
+
+namespace Ix.Compiler.IxIR0
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR
+
+namespace Literal
+
+/-- Canonical literal payload. -/
+def bytes : Literal → ByteArray
+  | .nat value => Encoding.tag 0 ++ Encoding.nat value
+  | .str value => Encoding.tag 1 ++ Encoding.string value
+
+end Literal
+
+namespace Expr
+
+/-- Canonical recursive expression payload. -/
+def bytes : Expr → ByteArray
+  | .var index => Encoding.tag 0 ++ Encoding.nat index
+  | .ref address => Encoding.tag 1 ++ Encoding.address address
+  | .app fn arg => Encoding.tag 2 ++ bytes fn ++ bytes arg
+  | .lam uses body =>
+      Encoding.tag 3 ++ Encoding.tag uses.toBits ++ bytes body
+  | .letE uses value body =>
+      Encoding.tag 4 ++ Encoding.tag uses.toBits ++ bytes value ++ bytes body
+  | .proj index struct => Encoding.tag 5 ++ Encoding.nat index ++ bytes struct
+  | .lit literal => Encoding.tag 6 ++ literal.bytes
+  | .erased => Encoding.tag 7
+
+end Expr
+
+namespace RecRule
+
+/-- Canonical recursor-rule payload. -/
+def bytes (rule : RecRule) : ByteArray :=
+  Encoding.nat rule.fields ++ rule.rhs.bytes
+
+end RecRule
+
+namespace Decl
+
+/-- The versioned domain prefix for IxIR₀ declaration identities. -/
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir0/decl/1" ++ Encoding.tag 0
+
+/-- Canonical declaration payload, without the address domain. -/
+def payloadBytes : Decl → ByteArray
+  | .defn result body =>
+      Encoding.tag 0 ++ Encoding.tag result.toBits ++ body.bytes
+  | .ctor tag arity =>
+      Encoding.tag 1 ++ Encoding.nat tag ++ Encoding.nat arity
+  | .recursor numArgs natLit rules =>
+      Encoding.tag 2 ++ Encoding.nat numArgs ++ Encoding.bool natLit ++
+        Encoding.array RecRule.bytes rules
+  | .extern arity => Encoding.tag 3 ++ Encoding.nat arity
+
+/-- Complete canonical hash preimage for one IxIR₀ declaration. -/
+def preimage (decl : Decl) : ByteArray :=
+  addressDomain ++ payloadBytes decl
+
+/-- BLAKE3 content address of an IxIR₀ declaration. -/
+def address (decl : Decl) : Address :=
+  Address.blake3 decl.preimage
+
+/-- Pair a declaration with its computed content address. -/
+def addressed (decl : Decl) : Address × Decl :=
+  (decl.address, decl)
+
+/-- Address equality exposes byte identity under exactly the pairwise
+collision premise for these two preimages. -/
+theorem address_eq_iff_preimage_eq (left right : Decl)
+    (hcollision : Address.Blake3NoCollision left.preimage right.preimage) :
+    left.address = right.address ↔ left.preimage = right.preimage := by
+  constructor
+  · exact hcollision
+  · intro h
+    simp only [address]
+    rw [h]
+
+@[simp] theorem addressed_fst (decl : Decl) : decl.addressed.1 = decl.address :=
+  rfl
+
+@[simp] theorem addressed_snd (decl : Decl) : decl.addressed.2 = decl :=
+  rfl
+
+end Decl
+
+/-! Small format-freezing structural vectors; BLAKE3 vectors live in the
+compiled test executable because the current hash implementation is FFI. -/
+
+#guard Literal.bytes (.nat 128) == ByteArray.mk #[0, 128, 1]
+#guard Expr.bytes (.lam .many (.var 0)) == ByteArray.mk #[3, 3, 0, 0]
+#guard Decl.payloadBytes (.defn .shared (.lam .many (.var 0))) ==
+  ByteArray.mk #[0, 1, 3, 3, 0, 0]
+#guard Decl.payloadBytes (.recursor 1 true #[⟨0, .erased⟩]) ==
+  ByteArray.mk #[2, 1, 1, 1, 0, 7]
+
+end Ix.Compiler.IxIR0
diff --git a/Ix/Compiler/IxIR0/UniqueReverse.lean b/Ix/Compiler/IxIR0/UniqueReverse.lean
new file mode 100644
index 000000000..90c6ed2ba
--- /dev/null
+++ b/Ix/Compiler/IxIR0/UniqueReverse.lean
@@ -0,0 +1,158 @@
+import Ix.Compiler.IxIR0.RecursorModes
+import Ix.Compiler.IxIR0.Recursion
+
+/-! Exact recognition of a closed unique-list accumulator recursor. The known
+constructor-building minor is specialized away only after its entire body and
+every recursor rule match. Ownership metadata is checked separately against
+the original Ixon declarations; erasure alone does not supply the worlds. -/
+
+namespace Ix.Compiler.IxIR0.UniqueReverse
+
+open Ix.Compiler.Ixon (Address)
+open Recursion (app2)
+
+def policyTag : String := "unique-reverse-specialize/1"
+
+structure Schema where
+  nil : Address
+  cons : Address
+  recursor : Address
+  alias : Address
+  builder : Address
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def builderExpr (s : Schema) : Expr :=
+  .lam .linear (.lam .linear (app2 (.ref s.cons) (.var 1) (.var 0)))
+
+def literalRecursor : Decl :=
+  .recursor 2 false #[
+    { fields := 0, rhs := .var 0 },
+    { fields := 2, rhs := .app (app2 (.var 4) (.var 3)
+        (app2 (.var 3) (.var 1) (.var 2))) (.var 0) }]
+
+def directRecursor (s : Schema) : Decl :=
+  .recursor 1 false #[
+    { fields := 0, rhs := .var 0 },
+    { fields := 2, rhs := app2 (.var 3)
+        (app2 (.ref s.cons) (.var 1) (.var 2)) (.var 0) }]
+
+def sourceInstance : RecursorInstance :=
+  { declaration := literalRecursor, arguments := [.shared, .unique, .unique]
+    fields := [[], [.unique, .unique]], result := .unique }
+
+def directInstance (s : Schema) : RecursorInstance :=
+  { declaration := directRecursor s, arguments := [.unique, .unique]
+    fields := [[], [.unique, .unique]], result := .unique }
+
+@[simp] theorem sourceInstance_wellShaped : sourceInstance.wellShaped = true := rfl
+@[simp] theorem directInstance_wellShaped (s : Schema) : (directInstance s).wellShaped = true := rfl
+
+def listExpr (s : Schema) : List Nat → Expr
+  | [] => .ref s.nil
+  | n :: ns => app2 (.ref s.cons) (.lit (.nat n)) (listExpr s ns)
+
+def literalCall (s : Schema) (major accumulator : Expr) : Expr :=
+  .app (app2 (.ref s.alias) (.ref s.builder) accumulator) major
+
+structure Plan where
+  schema : Schema
+  values : List Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Plan.literalBody (plan : Plan) : Expr :=
+  literalCall plan.schema (listExpr plan.schema plan.values) (.ref plan.schema.nil)
+
+def Plan.directMain (plan : Plan) (address : Address) : Expr :=
+  app2 (.ref address) (.ref plan.schema.nil) (listExpr plan.schema plan.values)
+
+structure SourceMatches (env : Env) (s : Schema) : Prop where
+  nil : env s.nil = some (.ctor 0 0)
+  cons : env s.cons = some (.ctor 1 2)
+  recursor : env s.recursor = some literalRecursor
+  alias : env s.alias = some (.defn .shared (.ref s.recursor))
+  builder : env s.builder = some (.defn .unique (builderExpr s))
+
+instance (env : Env) (s : Schema) : Decidable (SourceMatches env s) :=
+  decidable_of_iff
+    (env s.nil = some (.ctor 0 0) ∧ env s.cons = some (.ctor 1 2) ∧
+      env s.recursor = some literalRecursor ∧
+      env s.alias = some (.defn .shared (.ref s.recursor)) ∧
+      env s.builder = some (.defn .unique (builderExpr s)))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2.1, h.2.2.2.2⟩,
+      fun h => ⟨h.nil, h.cons, h.recursor, h.alias, h.builder⟩⟩
+
+structure Checked (declarations : List (Address × Decl)) (main : Expr) where
+  plan : Plan
+  root : Address
+  mainEq : main = .app (.ref root) .erased
+  source : SourceMatches (Env.ofList declarations) plan.schema
+  entry : Env.ofList declarations root = some (.defn .unique (.lam .many plan.literalBody))
+
+def check (declarations : List (Address × Decl)) (main : Expr) (plan : Plan) :
+    Option (Checked declarations main) :=
+  match main with
+  | .app (.ref root) .erased =>
+      if hs : SourceMatches (Env.ofList declarations) plan.schema then
+        if he : Env.ofList declarations root = some (.defn .unique (.lam .many plan.literalBody)) then
+          some { plan, root, mainEq := rfl, source := hs, entry := he }
+        else none
+      else none
+  | _ => none
+
+private def list? (s : Schema) : Expr → Option (List Nat)
+  | .ref address => if address == s.nil then some [] else none
+  | .app (.app (.ref address) (.lit (.nat n))) tail =>
+      if address == s.cons then (list? s tail).map (n :: ·) else none
+  | _ => none
+
+def propose (declarations : List (Address × Decl)) (main : Expr) : Option Plan := do
+  let .app (.ref root) .erased := main | none
+  let env := Env.ofList declarations
+  let some (.defn .unique (.lam .many
+      (.app (.app (.app (.ref alias) (.ref builder)) (.ref nil)) major))) := env root | none
+  let some (.defn .shared (.ref recursor)) := env alias | none
+  let some (.defn .unique (.lam .linear (.lam .linear
+      (.app (.app (.ref cons) (.var 1)) (.var 0))))) := env builder | none
+  let schema : Schema := { nil, cons, recursor, alias, builder }
+  let values ← list? schema major
+  return { schema, values }
+
+def recognize (declarations : List (Address × Decl)) (main : Expr) :
+    Option (Checked declarations main) := do
+  let plan ← propose declarations main
+  check declarations main plan
+
+def targetDeclarations (plan : Plan) (address : Address) : List (Address × Decl) :=
+  [(plan.schema.nil, .ctor 0 0), (plan.schema.cons, .ctor 1 2),
+    (address, directRecursor plan.schema)]
+
+structure TargetMatches (env : Env) (s : Schema) (address : Address) : Prop where
+  nil : env s.nil = some (.ctor 0 0)
+  cons : env s.cons = some (.ctor 1 2)
+  recursor : env address = some (directRecursor s)
+
+instance (env : Env) (s : Schema) (address : Address) : Decidable (TargetMatches env s address) :=
+  decidable_of_iff
+    (env s.nil = some (.ctor 0 0) ∧ env s.cons = some (.ctor 1 2) ∧
+      env address = some (directRecursor s))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2⟩, fun h => ⟨h.nil, h.cons, h.recursor⟩⟩
+
+structure Recovered (declarations : List (Address × Decl)) (main : Expr) where
+  checked : Checked declarations main
+  address : Address
+  addressed : address = (directInstance checked.plan.schema).address
+  fresh : address ∉ declarations.map (·.1)
+  target : TargetMatches (Env.ofList (targetDeclarations checked.plan address))
+    checked.plan.schema address
+
+def recover (declarations : List (Address × Decl)) (main : Expr) :
+    Option (Recovered declarations main) := do
+  let checked ← recognize declarations main
+  let address := (directInstance checked.plan.schema).address
+  if hf : address ∉ declarations.map (·.1) then
+    if ht : TargetMatches (Env.ofList (targetDeclarations checked.plan address)) checked.plan.schema address then
+      some { checked, address, addressed := rfl, fresh := hf, target := ht }
+    else none
+  else none
+
+end Ix.Compiler.IxIR0.UniqueReverse
diff --git a/Ix/Compiler/IxIR0/UniqueReverseSim.lean b/Ix/Compiler/IxIR0/UniqueReverseSim.lean
new file mode 100644
index 000000000..c7808dfa5
--- /dev/null
+++ b/Ix/Compiler/IxIR0/UniqueReverseSim.lean
@@ -0,0 +1,154 @@
+import Ix.Compiler.IxIR0.UniqueReverse
+import Ix.Compiler.IxIR0.RecursionSim
+
+/-! Exact evaluator simulation for every checked finite unique-list source.
+Both the literal builder-minor recursion and the direct instantiation evaluate
+to the same accumulator reversal. No ownership or heap premise is assumed. -/
+
+namespace Ix.Compiler.IxIR0.UniqueReverse
+
+open Ix.Compiler.Ixon (Address)
+open Recursion (Evaluates Applies evaluatesVar evaluatesLam evaluatesErased evaluatesLit
+  evaluatesDef evaluatesRecursor evaluatesNullary appliesClosure evaluatesApp evaluatesCtor2
+  appliesRecursor appliesTernaryFirst appliesTernaryNext appliesAccumulator)
+
+def listValue (schema : Schema) : List Nat → Value
+  | [] => .ctor schema.nil 0 []
+  | n :: ns => .ctor schema.cons 1 [.lit (.nat n), listValue schema ns]
+
+def reverseOnto (schema : Schema) : List Nat → Value → Value
+  | [], accumulator => accumulator
+  | n :: ns, accumulator => reverseOnto schema ns (.ctor schema.cons 1 [.lit (.nat n), accumulator])
+
+theorem reverseOnto_listValue (schema : Schema) (values accumulator : List Nat) :
+    reverseOnto schema values (listValue schema accumulator) =
+      listValue schema (values.reverse ++ accumulator) := by
+  induction values generalizing accumulator with
+  | nil => rfl
+  | cons n ns ih =>
+      change reverseOnto schema ns (listValue schema (n :: accumulator)) = _
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+theorem reverseOnto_nil (schema : Schema) (values : List Nat) :
+    reverseOnto schema values (.ctor schema.nil 0 []) = listValue schema values.reverse := by
+  simpa only [listValue, List.append_nil] using reverseOnto_listValue schema values []
+
+def builderValue (schema : Schema) : Value :=
+  .clos .linear [] (.lam .linear (Recursion.app2 (.ref schema.cons) (.var 1) (.var 0)))
+
+theorem evaluatesBuilder {ctx : Ctx} {schema : Schema}
+    (hs : SourceMatches ctx.env schema) (env : List Value) :
+    Evaluates ctx env (.ref schema.builder) (builderValue schema) :=
+  evaluatesDef hs.builder (evaluatesLam ctx [] .linear _)
+
+theorem appliesBuilderFirst (ctx : Ctx) (schema : Schema) (head : Value) :
+    Applies ctx (builderValue schema) head
+      (.clos .linear [head] (Recursion.app2 (.ref schema.cons) (.var 1) (.var 0))) :=
+  appliesClosure (evaluatesLam ctx [head] .linear _)
+
+theorem appliesBuilderLast {ctx : Ctx} {schema : Schema}
+    (hcons : ctx.env schema.cons = some (.ctor 1 2)) (head tail : Value) :
+    Applies ctx (.clos .linear [head] (Recursion.app2 (.ref schema.cons) (.var 1) (.var 0)))
+      tail (.ctor schema.cons 1 [head, tail]) :=
+  appliesClosure (evaluatesCtor2 hcons (evaluatesVar (by rfl)) (evaluatesVar (by rfl)))
+
+theorem literalLoop {ctx : Ctx} {schema : Schema} (hs : SourceMatches ctx.env schema)
+    (values : List Nat) (accumulator : Value) :
+    Applies ctx (.pap (.rec_ schema.recursor 3) [builderValue schema, accumulator])
+      (listValue schema values) (reverseOnto schema values accumulator) := by
+  induction values generalizing accumulator with
+  | nil =>
+      apply appliesRecursor hs.recursor (pre := [builderValue schema, accumulator])
+        (tag := 0) (by rfl) (by rfl) (by rfl)
+      exact evaluatesVar (by rfl)
+  | cons n ns ih =>
+      apply appliesRecursor hs.recursor (pre := [builderValue schema, accumulator])
+        (tag := 1) (by rfl) (by rfl) (by rfl)
+      exact evaluatesApp
+        (evaluatesApp
+          (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl))
+            (appliesTernaryFirst ctx schema.recursor (builderValue schema)))
+          (evaluatesApp
+            (evaluatesApp (evaluatesVar (by rfl)) (evaluatesVar (by rfl))
+              (appliesBuilderFirst ctx schema (.lit (.nat n))))
+            (evaluatesVar (by rfl)) (appliesBuilderLast hs.cons (.lit (.nat n)) accumulator))
+          (appliesTernaryNext ctx schema.recursor (builderValue schema)
+            (.ctor schema.cons 1 [.lit (.nat n), accumulator])))
+        (evaluatesVar (by rfl)) (ih (.ctor schema.cons 1 [.lit (.nat n), accumulator]))
+
+theorem directLoop {ctx : Ctx} {schema : Schema} {address : Address}
+    (hcons : ctx.env schema.cons = some (.ctor 1 2))
+    (hrec : ctx.env address = some (directRecursor schema))
+    (values : List Nat) (accumulator : Value) :
+    Applies ctx (.pap (.rec_ address 2) [accumulator]) (listValue schema values)
+      (reverseOnto schema values accumulator) := by
+  induction values generalizing accumulator with
+  | nil =>
+      apply appliesRecursor hrec (pre := [accumulator]) (tag := 0) (by rfl) (by rfl) (by rfl)
+      exact evaluatesVar (by rfl)
+  | cons n ns ih =>
+      apply appliesRecursor hrec (pre := [accumulator]) (tag := 1) (by rfl) (by rfl) (by rfl)
+      exact evaluatesApp
+        (evaluatesApp (evaluatesVar (by rfl))
+          (evaluatesCtor2 hcons (evaluatesVar (by rfl)) (evaluatesVar (by rfl)))
+          (appliesAccumulator ctx address (.ctor schema.cons 1 [.lit (.nat n), accumulator])))
+        (evaluatesVar (by rfl)) (ih (.ctor schema.cons 1 [.lit (.nat n), accumulator]))
+
+theorem evaluatesList {ctx : Ctx} {schema : Schema}
+    (hnil : ctx.env schema.nil = some (.ctor 0 0))
+    (hcons : ctx.env schema.cons = some (.ctor 1 2)) (env : List Value) (values : List Nat) :
+    Evaluates ctx env (listExpr schema values) (listValue schema values) := by
+  induction values with
+  | nil => exact evaluatesNullary hnil
+  | cons n ns ih => exact evaluatesCtor2 hcons (evaluatesLit ctx env _) ih
+
+theorem literalRun {ctx : Ctx} {schema : Schema} {env : List Value}
+    {major accumulator : Expr} {values : List Nat} {acc : Value}
+    (hs : SourceMatches ctx.env schema)
+    (hmajor : Evaluates ctx env major (listValue schema values))
+    (hacc : Evaluates ctx env accumulator acc) :
+    Evaluates ctx env (literalCall schema major accumulator) (reverseOnto schema values acc) :=
+  evaluatesApp
+    (evaluatesApp
+      (evaluatesApp (evaluatesDef hs.alias (evaluatesRecursor hs.recursor))
+        (evaluatesBuilder hs env) (appliesTernaryFirst ctx schema.recursor (builderValue schema)))
+      hacc (appliesTernaryNext ctx schema.recursor (builderValue schema) acc))
+    hmajor (literalLoop hs values acc)
+
+def Plan.value (plan : Plan) : Value := listValue plan.schema plan.values.reverse
+
+theorem literalBodyRun {ctx : Ctx} {plan : Plan}
+    (hs : SourceMatches ctx.env plan.schema) (env : List Value) :
+    Evaluates ctx env plan.literalBody plan.value := by
+  have h := literalRun hs (evaluatesList hs.nil hs.cons env plan.values) (evaluatesNullary hs.nil)
+  simpa only [Plan.literalBody, Plan.value, reverseOnto_nil] using h
+
+theorem directMainRun {ctx : Ctx} {plan : Plan} {address : Address}
+    (ht : TargetMatches ctx.env plan.schema address) :
+    Evaluates ctx [] (plan.directMain address) plan.value := by
+  have h := evaluatesApp
+    (evaluatesApp (evaluatesRecursor (env := []) ht.recursor) (evaluatesNullary ht.nil)
+      (appliesAccumulator ctx address (.ctor plan.schema.nil 0 [])))
+    (evaluatesList ht.nil ht.cons [] plan.values)
+    (directLoop ht.cons ht.recursor plan.values (.ctor plan.schema.nil 0 []))
+  simpa only [Plan.directMain, Plan.value, reverseOnto_nil, Recursion.app2] using h
+
+theorem Checked.sourceEvaluates {declarations : List (Address × Decl)} {main : Expr}
+    (checked : Checked declarations main) :
+    Evaluates { env := Env.ofList declarations } [] main checked.plan.value := by
+  simpa only [checked.mainEq] using evaluatesApp
+    (evaluatesDef checked.entry (evaluatesLam _ [] .many _)) (evaluatesErased _ [])
+    (appliesClosure (literalBodyRun checked.source [.erased]))
+
+theorem Recovered.forwardSimulation {declarations : List (Address × Decl)} {main : Expr}
+    (recovery : Recovered declarations main) {sourceFuel : Nat} {value : Value}
+    (hsource : eval { env := Env.ofList declarations } sourceFuel [] main = .ok value) :
+    ∃ targetFuel,
+      eval { env := Env.ofList (targetDeclarations recovery.checked.plan recovery.address) }
+        targetFuel [] (recovery.checked.plan.directMain recovery.address) = .ok value := by
+  have heq := Evaluates.unique ⟨sourceFuel, hsource⟩ recovery.checked.sourceEvaluates
+  rw [heq]
+  exact directMainRun recovery.target
+
+end Ix.Compiler.IxIR0.UniqueReverse
diff --git a/Ix/Compiler/IxIR1/Basic.lean b/Ix/Compiler/IxIR1/Basic.lean
new file mode 100644
index 000000000..b59abe603
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Basic.lean
@@ -0,0 +1,172 @@
+import Ix.Compiler.IxIR0.Basic
+
+/-!
+# IxIR₁: the first-order, store-based IR
+
+The level where memory becomes explicit and modes start paying rent
+(`docs/compiler/compiler-design.md`, architecture and proof boundaries). Shape, per
+the recorded gate decisions:
+
+- **Let-normalized and saturated** (gate C): code is a sequence of
+  primitive operations binding one variable each, ending in `ret` or a
+  `case`. Known calls carry exact arities; partial application is a
+  reified `pap` node; unknown calls go through `apply` — the GRIN
+  eval/apply vocabulary, with the interpreter as its semantic
+  specification (generated closed-world dispatchers must refine it).
+- **First-order**: no lambdas. Functions are top-level declarations;
+  recursors are *gone* — the IxIR₀ → IxIR₁ lowering compiles their ι
+  to `case` plus `callSelf` (content-addressing-safe self-reference,
+  the recSelf idea one level down). Mutual blocks are deferred exactly
+  as at IxIR₀.
+- **Explicit store** (gate A): values are scalars or locations; nodes
+  live in a heap. Every allocation, projection, in-place reuse,
+  deallocation, and refcount operation is an instruction.
+- **Mode-directed memory ops**: the unique world gets `reuse`/`free`
+  (moves are implicit — a location is just consumed); the shared
+  world gets `dup`/`drop` with Perceus-style deep drop at refcount
+  zero. `dup`/`drop` on unique values and `reuse`/`free` on shared
+  ones are *memory errors* — the interpreter is a dynamic checker for
+  the discipline the static judgment will later prove unnecessary.
+  Arena/locality ops arrive with the regions axis (frozen-deferred);
+  reuse-token *pairing* is IxIR₂'s optimization — the `reuse`
+  instruction itself is IxIR₁'s, since `reuse_sound` is an IxIR₁
+  statement.
+- **Cost lives here** (gate A): the store carries instruction-level
+  counters (allocations, reuses, frees, RC ops), so claims like
+  "reversal of a unique list allocates nothing" are `#guard`s in
+  `Examples.lean`, and the zk cost model has its hook.
+
+De Bruijn conventions: `letOp` binds one variable (index 0 in the
+rest); a `case` alternative pushes the scrutinee's fields in order
+(index 0 = *last* field, matching IxIR₀'s ι environment); a function
+body starts with its arguments pushed in order (index 0 = last
+argument).
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR0 (Literal)
+
+/-- Operands: everything is a variable, a scalar literal, or ◻.
+Locations are runtime values only — code never names a location. -/
+inductive Atom where
+  | var (idx : Nat)
+  | lit (l : Literal)
+  | erased
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Constructor identity: the inductive's block address + member
+index, and the constructor index — matching the source-side `ctorV`. -/
+structure CtorId where
+  block : Address
+  indIdx : Nat
+  cidx : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+mutual
+
+/-- One primitive operation; each binds exactly one variable. -/
+inductive Op where
+  /-- Rebind an atom (lowering convenience). -/
+  | pure (a : Atom)
+  /-- Allocate a constructor node in the given world. -/
+  | alloc (world : Owned) (cid : CtorId) (args : Array Atom)
+  /-- Overwrite a **live, unique** node in place: the FBIP payoff.
+  Returns the same location; counts as a reuse, not an allocation. -/
+  | reuse (target : Atom) (cid : CtorId) (args : Array Atom)
+  /-- Shallow-free a **live, unique** node. -/
+  | free (target : Atom)
+  /-- Increment a **shared** node's refcount (no-op on scalars). -/
+  | dup (target : Atom)
+  /-- Decrement a **shared** node's refcount; at zero, free and
+  recursively drop the fields (Perceus-style deep drop). -/
+  | drop (target : Atom)
+  /-- Deep-free a **live, unique** tree: kill the node and recurse
+  into its fields (which must be unique — whole-value modes, gate B).
+  The unique dual of `drop`'s rc-zero path, and the compilation of
+  affine death; no refcounts are touched. No-op on scalars. -/
+  | dropU (target : Atom)
+  /-- Project field `i` of a constructor node (non-consuming). -/
+  | fetch (target : Atom) (field : Nat)
+  /-- Saturated call of a known function (exact arity). -/
+  | call (f : Address) (args : Array Atom)
+  /-- Saturated self-call: recursion without an address cycle. -/
+  | callSelf (args : Array Atom)
+  /-- Build a partial-application node: known `f`, strictly fewer
+  arguments than its arity. -/
+  | papp (f : Address) (args : Array Atom)
+  /-- Apply an unknown function value (a `pap` node) to further
+  arguments; may saturate (call), under-fill (new `pap`), or
+  over-fill (call, then apply the rest to the result). Consumes the
+  function value: the pap's stored arguments are dup'd for their new
+  owner and the pap itself is dropped. -/
+  | apply (f : Atom) (args : Array Atom)
+  /-- Trusted extern. The v1 boundary is scalar-only in both directions:
+  heap locations are rejected before or after consulting the oracle. -/
+  | extern (f : Address) (args : Array Atom)
+
+/-- A case alternative: constructor index, its field count, and the
+continuation with the fields bound. -/
+inductive Alt where
+  | mk (cidx : Nat) (fields : Nat) (body : Code)
+
+/-- Code: a let-sequence ending in a return or a branch. -/
+inductive Code where
+  | ret (a : Atom)
+  | letOp (op : Op) (rest : Code)
+  /-- Branch on a constructor node's tag. `peelNat` additionally
+  accepts `Nat` literals (`0 ↦ cidx 0`, `n+1 ↦ cidx 1` binding
+  `lit n`) — the IxIR₀ `natLit` story at this level. Non-consuming:
+  frees and drops are explicit instructions. -/
+  | case (scrut : Atom) (peelNat : Bool) (alts : Array Alt)
+
+end
+
+/-- A saturated top-level function. -/
+structure FnDef where
+  arity : Nat
+  /-- Ownership world of a returned heap location. Scalars satisfy
+  either result world. -/
+  result : Owned
+  /-- Whether this declaration may be entered through a shared PAP. The
+  production lowerer sets this exactly when the result and every parameter
+  live in the shared world; saturated direct calls remain valid either way. -/
+  papSafe : Bool
+  body : Code
+
+/-- Top-level declarations. No constructor declarations (`alloc`
+carries identity; first-class constructor use is eta-expanded by the
+lowering) and no recursors (lowered to `case` + `callSelf`). -/
+inductive Decl where
+  | fn (d : FnDef)
+  | extern (arity : Nat)
+
+/-- The closed world of declarations. The transparent list model is retained
+for proofs and compiled through the proved hash-index implementation below. -/
+abbrev Env := Address → Option Decl
+
+def Env.empty : Env := fun _ => none
+
+def Env.ofList (l : List (Address × Decl)) : Env :=
+  fun a => (l.find? (fun p => p.1 == a)).map (·.2)
+
+namespace Env
+
+/-- The explicitly staged runtime representation of an environment. -/
+abbrev Index := AddressEnv.Index Decl
+
+def Index.ofList (l : List (Address × Decl)) : Index :=
+  AddressEnv.build l
+
+def Index.toEnv (index : Index) : Env :=
+  AddressEnv.lookup index
+
+/-- The runtime index implements the transparent first-binding-wins model. -/
+@[simp] theorem Index.toEnv_ofList (l : List (Address × Decl)) :
+    (Index.ofList l).toEnv = Env.ofList l := by
+  exact AddressEnv.lookup_build l
+
+end Env
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/CostInstance.lean b/Ix/Compiler/IxIR1/CostInstance.lean
new file mode 100644
index 000000000..a1257ca86
--- /dev/null
+++ b/Ix/Compiler/IxIR1/CostInstance.lean
@@ -0,0 +1,135 @@
+import Ix.Compiler.IxIR1.NoReuse
+
+/-!
+# Exact cost instance for a real IxIR₀ → IxIR₁ lowering
+
+This module pins one nondegenerate whole-pass cost observation.  A closed
+reference to a nullary constructor lowers to one shared allocation, and the
+resulting target run has exactly one allocation and no reuse, free, or
+reference-count operation.  `RunCostInvariant.of_witness` promotes the exact
+kernel-checked run to every successful fuel and then to `CostRefinement`.
+-/
+
+namespace Ix.Compiler.IxIR1.CostInstance
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.LowerSim
+
+/-- Stable source identity for the exact cost fixture. -/
+def constructor : Address := Address.replicate 0xc7
+
+/-- A single nullary constructor declaration. -/
+def sourceDeclarations : List (Address × IxIR0.Decl) :=
+  [(constructor, .ctor 0 0)]
+
+/-- The closed source program constructs that nullary value. -/
+def sourceMain : IxIR0.Expr := .ref constructor
+
+/-- The declaration environment used to execute the source fixture. -/
+def sourceCtx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList sourceDeclarations }
+
+/-- The pure value produced by the source fixture. -/
+def sourceValue : IxIR0.Value := .ctor constructor 0 []
+
+/-- The exact target code emitted by the whole-pass lowerer. -/
+def targetCode : Code :=
+  .letOp (.alloc .shared (ctorIdOf constructor 0) #[])
+    (.ret (.var 0))
+
+/-- Constructors do not need target declarations: their identity is carried
+by `Op.alloc`. -/
+def targetCtx : Ctx := { decls := Env.empty }
+
+/-- The target store after the fixture's sole allocation. -/
+def targetStore : Store :=
+  (({} : Store).allocNode .shared
+    (.ctorN (ctorIdOf constructor 0) #[])).1
+
+/-- The exact four-counter observation for the fixture. -/
+def exactCost : CostObservation :=
+  { allocs := 1, reuses := 0, frees := 0, rcops := 0 }
+
+@[simp] private theorem estateMapGet_run {error state result : Type}
+    (f : state → result) (initial : state) :
+    EStateM.run (f <$> (get : EStateM error state state)) initial =
+      .ok (f initial) initial := by
+  rfl
+
+/-- The executable whole-program lowerer emits exactly the fixture code and
+no declarations or generated state. -/
+theorem lowerAllAction_run :
+    (lowerAllAction sourceDeclarations sourceMain .shared 10).run {} =
+      .ok ([], targetCode) {} := by
+  simp [sourceDeclarations, sourceMain, targetCode, lowerAllAction,
+    lowerDecl, lowerFnBody, releaseSlots, lowerE, ctorIdOf,
+    AVal.toAtom, VEnv.rel, VEnv.bump, emitOp, IxIR0.Env.ofList,
+    constructor, List.filterMapM,
+    List.filterMapM.loop]
+
+/-- The source reference evaluates to the declared nullary constructor. -/
+theorem sourceEval_exact :
+    IxIR0.eval sourceCtx 3 [] sourceMain = .ok sourceValue := by
+  simp [sourceCtx, sourceDeclarations, sourceMain, sourceValue,
+    IxIR0.eval, IxIR0.saturate, IxIR0.fire, IxIR0.Env.ofList,
+    IxIR0.Head.arity, constructor]
+
+/-- Two evaluator ticks execute the allocation and final return. -/
+theorem runMain_exact :
+    runMain targetCtx targetCode 2 = .ok (targetStore, .loc 0) := by
+  unfold runMain targetCode
+  rw [runCode.eq_def]
+  dsimp only
+  rw [Sim.runOp_alloc (by rfl)]
+  simp only [bind, Except.bind]
+  rw [runCode.eq_def]
+  dsimp only
+  rfl
+
+/-- The exact run changes only the allocation counter. -/
+theorem targetStore_cost : costObservation targetStore = exactCost := by
+  rfl
+
+/-- The allocated target node realizes the exact source constructor value. -/
+theorem valueGraph_exact (funRel : Sim.FunctionRel) :
+    Sim.ValueGraph funRel targetStore sourceValue (.loc 0) := by
+  refine .ctor (by rfl) (by rfl) (by rfl) ?_
+  exact .nil
+
+/-- Every successful execution of the emitted target code has the same exact
+four-counter observation. -/
+theorem exactRunCost :
+    RunCostInvariant targetCtx targetCode (fun observation =>
+      observation = exactCost) := by
+  refine RunCostInvariant.of_witness
+    (spec := fun observation => observation = exactCost)
+    (witnessFuel := 2) (witnessStore := targetStore)
+    (witnessValue := .loc 0) runMain_exact ?_
+  exact targetStore_cost
+
+/-- The exact target observation is a semantic cost refinement for the source
+fixture, independently of the chosen function relation. -/
+theorem exactCostRefinement (funRel : Sim.FunctionRel) :
+    CostRefinement
+      sourceCtx
+      targetCtx sourceMain targetCode funRel
+      (fun _ observation => observation = exactCost) :=
+  exactRunCost.costRefinement
+
+/-- One theorem joins the real lowering result, successful source and target
+runs, their semantic value graph, and the exact counter refinement.  This is
+the nonvacuous executable witness for the generic cost interface. -/
+theorem loweringCostWitness (funRel : Sim.FunctionRel) :
+    (lowerAllAction sourceDeclarations sourceMain .shared 10).run {} =
+        .ok ([], targetCode) {} ∧
+      IxIR0.eval sourceCtx 3 [] sourceMain = .ok sourceValue ∧
+      runMain targetCtx targetCode 2 = .ok (targetStore, .loc 0) ∧
+      Sim.ValueGraph funRel targetStore sourceValue (.loc 0) ∧
+      costObservation targetStore = exactCost := by
+  refine ⟨lowerAllAction_run, sourceEval_exact, runMain_exact,
+    valueGraph_exact funRel, ?_⟩
+  exact (exactCostRefinement funRel) sourceEval_exact runMain_exact
+    (valueGraph_exact funRel)
+
+end Ix.Compiler.IxIR1.CostInstance
diff --git a/Ix/Compiler/IxIR1/CostModel.lean b/Ix/Compiler/IxIR1/CostModel.lean
new file mode 100644
index 000000000..50cf9d4f9
--- /dev/null
+++ b/Ix/Compiler/IxIR1/CostModel.lean
@@ -0,0 +1,336 @@
+import Ix.Compiler.IxIR1.CostInstance
+
+/-!
+# A source-sensitive constructor cost model
+
+IxIR₀ evaluator fuel remains only a totality witness.  This module instead
+attaches cost to the IxIR₁ operations emitted for a parametric family of
+closed source programs.  The source numeral `n` is a unary constructor tree;
+its actual whole-pass lowering performs exactly `n + 1` allocations and no
+reuse, free, or reference-count operation.
+
+This is deliberately a first proved fragment, not a global syntax bound:
+calls and recursion require a dynamic source trace or a compositional
+lowering certificate before the same statement can cover arbitrary programs.
+-/
+
+namespace Ix.Compiler.IxIR1.CostModel
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.LowerSim
+
+/-- Stable constructor identities for the unary source family. -/
+def zeroConstructor : Address := Address.replicate 0xc8
+
+def succConstructor : Address := Address.replicate 0xc9
+
+@[simp] theorem zeroConstructor_ne_succConstructor :
+    zeroConstructor ≠ succConstructor := by
+  intro heq
+  have hbyte := congrArg (fun address =>
+    address.get (⟨0, by omega⟩ : Fin 32)) heq
+  simp [zeroConstructor, succConstructor] at hbyte
+
+/-- The complete source declaration set for unary constructor values. -/
+def sourceDeclarations : List (Address × IxIR0.Decl) :=
+  [(zeroConstructor, .ctor 0 0), (succConstructor, .ctor 1 1)]
+
+def sourceCtx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList sourceDeclarations }
+
+@[simp] theorem sourceCtx_zero :
+    sourceCtx.env zeroConstructor = some (.ctor 0 0) := by
+  simp [sourceCtx, sourceDeclarations, IxIR0.Env.ofList]
+
+@[simp] theorem sourceCtx_succ :
+    sourceCtx.env succConstructor = some (.ctor 1 1) := by
+  simp [sourceCtx, sourceDeclarations, IxIR0.Env.ofList,
+    zeroConstructor_ne_succConstructor]
+
+/-- A closed unary numeral.  Its parameter is source structure, not fuel. -/
+def sourceNat : Nat → IxIR0.Expr
+  | 0 => .ref zeroConstructor
+  | n + 1 => .app (.ref succConstructor) (sourceNat n)
+
+/-- The pure unary value denoted by `sourceNat`. -/
+def sourceValue : Nat → IxIR0.Value
+  | 0 => .ctor zeroConstructor 0 []
+  | n + 1 => .ctor succConstructor 1 [sourceValue n]
+
+/-- Constructor occurrences in a pure source value.  This is the
+source-result component of the fragment's cost specification. -/
+def constructorNodes : IxIR0.Value → Nat
+  | .ctor _ _ fields => 1 + (fields.map constructorNodes).sum
+  | .clos .. | .pap .. | .lit .. | .erased => 0
+
+@[simp] theorem constructorNodes_sourceValue (n : Nat) :
+    constructorNodes (sourceValue n) = n + 1 := by
+  induction n with
+  | zero => simp [sourceValue, constructorNodes]
+  | succ n ih =>
+      simp [sourceValue, constructorNodes, ih]
+      omega
+
+/-- The target prefix emitted for a unary numeral. -/
+def targetEmit : Nat → Emit
+  | 0 => emitOp (.alloc .shared (ctorIdOf zeroConstructor 0) #[])
+  | n + 1 =>
+      targetEmit n ∘
+        emitOp (.alloc .shared (ctorIdOf succConstructor 1) #[.var 0])
+
+def targetCode (n : Nat) : Code :=
+  targetEmit n (.ret (.var 0))
+
+def targetCtx : Ctx := { decls := Env.empty }
+
+/-- The exact instruction-counter model for source numeral `n`. -/
+def exactCost (n : Nat) : CostObservation :=
+  { allocs := n + 1, reuses := 0, frees := 0, rcops := 0 }
+
+/-- The semantic cost relation: allocations equal the constructor size of
+the source result, and the remaining memory counters are zero. -/
+def SourceSensitiveCostSpec
+    (value : IxIR0.Value) (observation : CostObservation) : Prop :=
+  observation.allocs = constructorNodes value ∧
+    observation.reuses = 0 ∧ observation.frees = 0 ∧
+      observation.rcops = 0
+
+theorem sourceEval_exact (n : Nat) :
+    IxIR0.eval sourceCtx (n + 3) [] (sourceNat n) =
+      .ok (sourceValue n) := by
+  induction n with
+  | zero =>
+      simp [sourceNat, sourceValue, IxIR0.eval, IxIR0.saturate,
+        IxIR0.fire, IxIR0.Head.arity]
+  | succ n ih =>
+      simp [sourceNat, sourceValue, IxIR0.eval, IxIR0.saturate,
+        IxIR0.Head.arity, ih, Nat.add_assoc]
+      simp only [bind, Except.bind]
+      rw [IxIR0.apply.eq_def]
+      dsimp only
+      rw [IxIR0.saturate.eq_def]
+      dsimp only
+      simp [IxIR0.Head.arity, IxIR0.fire]
+
+/-! ## Exact target execution -/
+
+/-- The concrete heap built by the target allocation chain. -/
+def targetStore : Nat → Store
+  | 0 =>
+      (({} : Store).allocNode .shared
+        (.ctorN (ctorIdOf zeroConstructor 0) #[])).1
+  | n + 1 =>
+      ((targetStore n).allocNode .shared
+        (.ctorN (ctorIdOf succConstructor 1) #[.loc n])).1
+
+/-- Runtime binders after the chain, newest unary node first. -/
+def targetEnv : Nat → List RVal
+  | 0 => [.loc 0]
+  | n + 1 => .loc (n + 1) :: targetEnv n
+
+@[simp] theorem targetEnv_head (n : Nat) :
+    (targetEnv n)[0]? = some (.loc n) := by
+  cases n <;> rfl
+
+@[simp] theorem targetStore_nodes_size (n : Nat) :
+    (targetStore n).nodes.size = n + 1 := by
+  induction n with
+  | zero => simp [targetStore, Store.allocNode]
+  | succ n ih => simp [targetStore, Store.allocNode, ih, Nat.add_assoc]
+
+theorem targetStore_counters (n : Nat) :
+    (targetStore n).allocs = n + 1 ∧
+      (targetStore n).reuses = 0 ∧ (targetStore n).frees = 0 ∧
+        (targetStore n).rcops = 0 := by
+  induction n with
+  | zero => simp [targetStore, Store.allocNode]
+  | succ n ih =>
+      rcases ih with ⟨hallocs, hreuses, hfrees, hrcops⟩
+      simp [targetStore, Store.allocNode, hallocs, hreuses, hfrees,
+        hrcops]
+
+@[simp] theorem targetStore_cost (n : Nat) :
+    costObservation (targetStore n) = exactCost n := by
+  rcases targetStore_counters n with ⟨hallocs, hreuses, hfrees, hrcops⟩
+  simp only [costObservation, exactCost]
+  rw [hallocs, hreuses, hfrees, hrcops]
+
+/-- Executing the allocation prefix leaves exactly `targetStore n` and its
+newest-to-oldest runtime environment for an arbitrary continuation. -/
+theorem runCode_targetEmit (cur : FnDef) (n k : Nat) (rest : Code) :
+    runCode targetCtx (k + n + 2) cur {} [] (targetEmit n rest) =
+      runCode targetCtx (k + 1) cur (targetStore n) (targetEnv n) rest := by
+  induction n generalizing k rest with
+  | zero =>
+      rw [runCode.eq_def]
+      dsimp only [targetEmit, emitOp]
+      rw [Sim.runOp_alloc (by rfl)]
+      rfl
+  | succ n ih =>
+      rw [targetEmit]
+      simp only [Function.comp_apply, emitOp]
+      rw [show k + (n + 1) + 2 = (k + 1) + n + 2 by omega]
+      rw [ih (k + 1)]
+      rw [runCode.eq_def]
+      dsimp only
+      rw [Sim.runOp_alloc (values := [.loc n]) (by
+        unfold resolveAtoms
+        rw [← Array.foldlM_toList]
+        simp [resolveAtom]
+        rfl)]
+      simp only [bind, Except.bind]
+      simp [targetStore, targetEnv, Store.allocNode,
+        targetStore_nodes_size]
+
+/-- The exact successful target trace for every unary source size. -/
+theorem runMain_exact (n : Nat) :
+    runMain targetCtx (targetCode n) (n + 2) =
+      .ok (targetStore n, .loc n) := by
+  unfold runMain targetCode
+  have hprefix := runCode_targetEmit
+    { arity := 0, result := .shared, papSafe := false,
+      body := targetEmit n (.ret (.var 0)) }
+    n 0 (.ret (.var 0))
+  simp only [Nat.zero_add] at hprefix
+  rw [hprefix]
+  rw [runCode.eq_def]
+  simp [resolveAtom, bind, Except.bind]
+
+/-! ## Exact whole-pass lowering -/
+
+/-- The recursive lowering core emits precisely the unary allocation prefix.
+The compiler-fuel expression is only a sufficient termination witness. -/
+theorem lowerE_exact (n : Nat) (state : LowSt) :
+    (lowerE sourceCtx.env (4 * n + 1) ⟨[], 0⟩ .shared
+      (sourceNat n)).run state =
+        .ok (⟨[], n + 1⟩, targetEmit n, .slotA n) state := by
+  induction n generalizing state with
+  | zero =>
+      simp [sourceNat, lowerE, VEnv.bump, targetEmit]
+  | succ n ih =>
+      simp [sourceNat, lowerE, lowerSpine, knownCall, lowerArgs,
+        padWorlds, sourceCtx_succ, VEnv.bump, VEnv.rel, AVal.toAtom,
+        targetEmit, emitOp, Function.comp_def, Nat.mul_succ]
+      have hih := ih state
+      simp only [EStateM.run] at hih
+      simp only [Functor.map, EStateM.map, EStateM.run]
+      rw [hih]
+      simp
+
+theorem lowerFnBody_exact (n : Nat) (state : LowSt) :
+    (lowerFnBody sourceCtx.env (4 * n + 2) ⟨[], 0⟩ [] .shared
+      (sourceNat n)).run state = .ok (targetCode n) state := by
+  simp [lowerFnBody, releaseSlots]
+  have hlower := lowerE_exact n state
+  simp only [EStateM.run] at hlower
+  simp only [Functor.map, EStateM.map, EStateM.run]
+  rw [hlower]
+  simp [targetCode, VEnv.rel, AVal.toAtom]
+
+/-- The executable whole-pass lowering, including declaration traversal and
+generated-state observation, emits no declarations and exactly `targetCode`.
+-/
+theorem lowerAllAction_run (n : Nat) :
+    (lowerAllAction sourceDeclarations (sourceNat n) .shared
+      (4 * n + 2)).run {} = .ok ([], targetCode n) {} := by
+  simp [lowerAllAction, sourceDeclarations, lowerDecl, List.filterMapM,
+    List.filterMapM.loop]
+  have hmain := lowerFnBody_exact n ({} : LowSt)
+  simp only [sourceCtx, sourceDeclarations] at hmain
+  simp only [EStateM.run] at hmain
+  simp only [EStateM.run]
+  rw [hmain]
+
+/-! ## Source-sensitive cost refinement -/
+
+/-- The target heap realizes the complete unary source result at its newest
+allocation. -/
+theorem valueGraph_exact (funRel : Sim.FunctionRel) (n : Nat) :
+    Sim.ValueGraph funRel (targetStore n) (sourceValue n) (.loc n) := by
+  induction n with
+  | zero =>
+      refine .ctor (by rfl) (by rfl) (by rfl) ?_
+      exact .nil
+  | succ n ih =>
+      let node : Node :=
+        .ctorN (ctorIdOf succConstructor 1) #[.loc n]
+      have hextends : Sim.StoreGraphExtends (targetStore n)
+          ((targetStore n).allocNode .shared node).1 :=
+        Sim.StoreGraphExtends.allocNode (targetStore n) .shared node
+      have hfield : Sim.ValueGraph funRel
+          ((targetStore n).allocNode .shared node).1
+          (sourceValue n) (.loc n) :=
+        ih.monoStore hextends
+      have hget : (targetStore (n + 1)).get? (n + 1) =
+          some ⟨.shared, 1,
+            .ctorN (ctorIdOf succConstructor 1) #[.loc n]⟩ := by
+        have hnew :
+            ((targetStore n).allocNode .shared node).1.get? (n + 1) =
+              some ⟨.shared, 1, node⟩ := by
+          rw [← targetStore_nodes_size n]
+          exact Sim.HeapIso.get?_allocNode_new
+            (targetStore n) .shared node
+        simpa only [targetStore, node] using hnew
+      refine .ctor hget (by rfl) (by rfl) (.cons ?_ .nil)
+      simpa [targetStore, node] using hfield
+
+/-- Every successful execution of the emitted numeral code has the exact
+counter vector predicted by the source parameter. -/
+theorem exactRunCost (n : Nat) :
+    RunCostInvariant targetCtx (targetCode n)
+      (fun observation => observation = exactCost n) := by
+  refine RunCostInvariant.of_witness
+    (spec := fun observation => observation = exactCost n)
+    (witnessFuel := n + 2) (witnessStore := targetStore n)
+    (witnessValue := .loc n) (runMain_exact n) ?_
+  exact targetStore_cost n
+
+/-- Exact source-sensitive cost refinement for the unary constructor
+fragment.  In particular, allocation is bounded (indeed equal) by source
+result size, and RC traffic is bounded by zero. -/
+theorem sourceSensitiveCostRefinement (funRel : Sim.FunctionRel) (n : Nat) :
+    CostRefinement sourceCtx targetCtx (sourceNat n) (targetCode n) funRel
+      SourceSensitiveCostSpec := by
+  intro sourceFuel result targetFuel store runtimeValue hsource htarget
+    _hgraph
+  have hresult : result = sourceValue n :=
+    sourceEval_ok_unique hsource (sourceEval_exact n)
+  subst result
+  have hcost : costObservation store = exactCost n :=
+    exactRunCost n htarget
+  rw [hcost]
+  simp [SourceSensitiveCostSpec, exactCost]
+
+def SourceSensitiveBoundsSpec
+    (value : IxIR0.Value) (observation : CostObservation) : Prop :=
+  observation.allocs ≤ constructorNodes value ∧ observation.rcops ≤ 0
+
+/-- The exact model exposed in conventional upper-bound form. -/
+theorem sourceSensitiveBoundsCostRefinement
+    (funRel : Sim.FunctionRel) (n : Nat) :
+    CostRefinement sourceCtx targetCtx (sourceNat n) (targetCode n) funRel
+      SourceSensitiveBoundsSpec := by
+  intro sourceFuel result targetFuel store runtimeValue hsource htarget hgraph
+  have hexact := sourceSensitiveCostRefinement funRel n
+    hsource htarget hgraph
+  exact ⟨Nat.le_of_eq hexact.1, Nat.le_of_eq hexact.2.2.2⟩
+
+/-- One parametric theorem joins actual whole-pass output, both semantics,
+their value graph, and the source-sensitive instruction-cost relation. -/
+theorem loweringCostWitness (funRel : Sim.FunctionRel) (n : Nat) :
+    (lowerAllAction sourceDeclarations (sourceNat n) .shared
+        (4 * n + 2)).run {} = .ok ([], targetCode n) {} ∧
+      IxIR0.eval sourceCtx (n + 3) [] (sourceNat n) =
+        .ok (sourceValue n) ∧
+      runMain targetCtx (targetCode n) (n + 2) =
+        .ok (targetStore n, .loc n) ∧
+      Sim.ValueGraph funRel (targetStore n) (sourceValue n) (.loc n) ∧
+      SourceSensitiveCostSpec (sourceValue n)
+        (costObservation (targetStore n)) := by
+  refine ⟨lowerAllAction_run n, sourceEval_exact n, runMain_exact n,
+    valueGraph_exact funRel n, ?_⟩
+  exact (sourceSensitiveCostRefinement funRel n)
+    (sourceEval_exact n) (runMain_exact n) (valueGraph_exact funRel n)
+
+end Ix.Compiler.IxIR1.CostModel
diff --git a/Ix/Compiler/IxIR1/CostTrace.lean b/Ix/Compiler/IxIR1/CostTrace.lean
new file mode 100644
index 000000000..7e8f9c24c
--- /dev/null
+++ b/Ix/Compiler/IxIR1/CostTrace.lean
@@ -0,0 +1,26091 @@
+import Ix.Compiler.IxIR1.RcPotential
+import Ix.Compiler.IxIR0.DynamicCost
+import Ix.Compiler.IxIR1.LowerFullyAddressedSim
+import Ix.Compiler.IxIR1.LowerSim
+import Ix.Compiler.IxIR1.NoReuse
+
+/-!
+# Dynamic source profiles as IxIR₁ cost specifications
+
+This module is the bridge between the call-aware dynamic source profile and
+the four counters maintained by IxIR₁.  A `ProfileWeights` value is an
+explicit lowering cost model: each source event class receives a four-counter
+charge, and the resulting componentwise linear combination is a target
+budget.  The model is deliberately supplied by the lowering proof rather than
+baked into source semantics.  The source profile also records dynamic retain
+widths, since one closure or partial-application event may retain arbitrarily
+many values.  `ObservationGrowthLE` provides the compositional target-side
+counter algebra used to justify those charges operation by operation.
+-/
+
+namespace Ix.Compiler.IxIR1.CostTrace
+
+open Ix.Compiler.IxIR1.LowerSim
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.Reclamation
+abbrev SourceProfile := IxIR0.DynamicCost.Profile
+
+private theorem bindErr {error alpha beta : Type} (err : error)
+    (next : alpha → Except error beta) :
+    ((Except.error err : Except error alpha) >>= next) = .error err := rfl
+
+private theorem bindOk {error alpha beta : Type} (value : alpha)
+    (next : alpha → Except error beta) :
+    ((Except.ok value : Except error alpha) >>= next) = next value := rfl
+
+private theorem permExtractRoot (root : Sim.Root)
+    (before after rest : List Sim.Root) :
+    ((before ++ root :: after) ++ rest).Perm
+      (root :: (before ++ after) ++ rest) := by
+  induction before with
+  | nil => rfl
+  | cons head before ih =>
+      simp only [List.cons_append]
+      exact (ih.cons head).trans (List.Perm.swap root head _)
+
+theorem Sim.HasWorld.valueInBounds
+    {store : Store} {world : Ixon.Owned} {value : RVal}
+    (hworld : Sim.HasWorld store world value) :
+    ValueInBounds store value := by
+  cases value with
+  | loc location =>
+      obtain ⟨box, hget, _⟩ := hworld
+      exact RVal.inBounds_of_get? hget
+  | lit literal => trivial
+  | erased => trivial
+
+theorem rootOwnership_valueInBounds_of_mem
+    {store : Store} {roots : List Sim.Root} {root : Sim.Root}
+    (hown : Sim.RootOwnership store roots) (hmember : root ∈ roots) :
+    ValueInBounds store root.value :=
+  Sim.HasWorld.valueInBounds (hown.roots_world root hmember)
+
+private theorem stateBindRun {error state alpha beta : Type}
+    (action : EStateM error state alpha)
+    (next : alpha → EStateM error state beta) (initial : state) :
+    (action >>= next).run initial =
+      match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error err nextState => .error err nextState := rfl
+
+private theorem stateBindRun_ok_inv {error state alpha beta : Type}
+    {action : EStateM error state alpha}
+    {next : alpha → EStateM error state beta}
+    {initial final : state} {result : beta}
+    (hrun : (action >>= next).run initial = .ok result final) :
+    ∃ value middle,
+      action.run initial = .ok value middle ∧
+      (next value).run middle = .ok result final := by
+  rw [stateBindRun] at hrun
+  cases haction : action.run initial with
+  | ok value middle =>
+      rw [haction] at hrun
+      exact ⟨value, middle, rfl, hrun⟩
+  | error err middle =>
+      rw [haction] at hrun
+      contradiction
+
+private theorem stateThrowRun_not_ok {error state alpha : Type}
+    {err : error} {initial final : state} {value : alpha}
+    (hrun : (throw err : EStateM error state alpha).run initial =
+      .ok value final) : False := by
+  change EStateM.Result.error err initial = .ok value final at hrun
+  contradiction
+
+/-- Counterwise addition used by linear source-profile budgets. -/
+def observationAdd (left right : CostObservation) : CostObservation :=
+  { allocs := left.allocs + right.allocs
+    reuses := left.reuses + right.reuses
+    frees := left.frees + right.frees
+    rcops := left.rcops + right.rcops }
+
+/-- Scale one four-counter charge by an event count. -/
+def observationScale (count : Nat)
+    (observation : CostObservation) : CostObservation :=
+  { allocs := count * observation.allocs
+    reuses := count * observation.reuses
+    frees := count * observation.frees
+    rcops := count * observation.rcops }
+
+/-- Componentwise target-counter ordering. -/
+def ObservationLE (actual budget : CostObservation) : Prop :=
+  actual.allocs ≤ budget.allocs ∧
+    actual.reuses ≤ budget.reuses ∧
+      actual.frees ≤ budget.frees ∧ actual.rcops ≤ budget.rcops
+
+/-- Componentwise counter growth from an arbitrary input store.  Addition on
+the right avoids truncated subtraction and composes directly across emitted
+code segments and calls. -/
+def ObservationGrowthLE (before after allowance : CostObservation) : Prop :=
+  after.allocs ≤ before.allocs + allowance.allocs ∧
+    after.reuses ≤ before.reuses + allowance.reuses ∧
+      after.frees ≤ before.frees + allowance.frees ∧
+        after.rcops ≤ before.rcops + allowance.rcops
+
+theorem ObservationGrowthLE.refl (observation : CostObservation) :
+    ObservationGrowthLE observation observation ⟨0, 0, 0, 0⟩ := by
+  simp [ObservationGrowthLE]
+
+theorem ObservationGrowthLE.trans {first middle last left right}
+    (hleft : ObservationGrowthLE first middle left)
+    (hright : ObservationGrowthLE middle last right) :
+    ObservationGrowthLE first last (observationAdd left right) := by
+  rcases hleft with ⟨ha₁, hr₁, hf₁, hc₁⟩
+  rcases hright with ⟨ha₂, hr₂, hf₂, hc₂⟩
+  simp only [ObservationGrowthLE, observationAdd]
+  omega
+
+/-- Store-level spelling of counter growth. -/
+def StoreGrowthLE (before after : Store) (allowance : CostObservation) :
+    Prop :=
+  ObservationGrowthLE (costObservation before) (costObservation after)
+    allowance
+
+def rcAllowance (count : Nat) : CostObservation := ⟨0, 0, 0, count⟩
+
+def allocationAllowance (count : Nat) : CostObservation :=
+  ⟨count, 0, 0, 0⟩
+
+def freeAllowance (count : Nat) : CostObservation := ⟨0, 0, count, 0⟩
+
+theorem StoreGrowthLE.refl (store : Store) :
+    StoreGrowthLE store store ⟨0, 0, 0, 0⟩ :=
+  ObservationGrowthLE.refl _
+
+theorem StoreGrowthLE.trans {first middle last : Store} {left right}
+    (hleft : StoreGrowthLE first middle left)
+    (hright : StoreGrowthLE middle last right) :
+    StoreGrowthLE first last (observationAdd left right) :=
+  ObservationGrowthLE.trans hleft hright
+
+theorem StoreGrowthLE.allocNode (store : Store) (world : Ixon.Owned)
+    (node : Node) :
+    StoreGrowthLE store (store.allocNode world node).1
+      (allocationAllowance 1) := by
+  simp [StoreGrowthLE, ObservationGrowthLE, costObservation,
+    allocationAllowance, Store.allocNode]
+
+theorem StoreGrowthLE.setBox (store : Store) (location : Nat)
+    (box : NodeBox) :
+    StoreGrowthLE store (store.setBox location box) ⟨0, 0, 0, 0⟩ := by
+  simp [StoreGrowthLE, ObservationGrowthLE, costObservation, Store.setBox]
+
+theorem StoreGrowthLE.kill (store : Store) (location : Nat) :
+    StoreGrowthLE store (store.kill location) (freeAllowance 1) := by
+  simp [StoreGrowthLE, ObservationGrowthLE, costObservation,
+    freeAllowance, Store.kill]
+
+theorem StoreGrowthLE.rcTick (store : Store) :
+    StoreGrowthLE store store.rcTick (rcAllowance 1) := by
+  simp [StoreGrowthLE, ObservationGrowthLE, costObservation,
+    rcAllowance, Store.rcTick]
+
+/-- Retaining a PAP prefix performs at most one RC increment per supplied
+runtime value; scalar entries cost zero, so list length is a conservative
+bound.  This is the first runtime producer for the source profile's dynamic
+`retains` quantity. -/
+theorem dupVals_growth {store store' : Store} {values : List RVal}
+    (hrun : dupVals store values = .ok store') :
+    StoreGrowthLE store store' (rcAllowance values.length) := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except Err Store) = .ok store' at hrun
+      injection hrun with hstore
+      subst store'
+      simp [StoreGrowthLE, ObservationGrowthLE, costObservation,
+        rcAllowance]
+  | cons value rest ih =>
+      cases value with
+      | lit literal =>
+          simp only [dupVals, List.foldlM_cons] at hrun
+          have htail := ih hrun
+          simp [StoreGrowthLE, ObservationGrowthLE, costObservation,
+            rcAllowance] at htail ⊢
+          omega
+      | erased =>
+          simp only [dupVals, List.foldlM_cons] at hrun
+          have htail := ih hrun
+          simp [StoreGrowthLE, ObservationGrowthLE, costObservation,
+            rcAllowance] at htail ⊢
+          omega
+      | loc location =>
+          simp only [dupVals, List.foldlM_cons] at hrun
+          cases hget : store.get? location with
+          | none => simp [hget, bindErr] at hrun
+          | some box =>
+              cases box with
+              | mk world rc node =>
+                  cases world with
+                  | unique => simp [hget, bindErr] at hrun
+                  | shared =>
+                      simp only [hget] at hrun
+                      have htail := ih hrun
+                      simp [StoreGrowthLE, ObservationGrowthLE,
+                        costObservation, rcAllowance, Store.setBox,
+                        Store.rcTick] at htail ⊢
+                      omega
+
+/-- Retaining a list grows the amortized RC measure by at most two per
+runtime value: one instruction now and one unit of future-drop potential.
+Scalars use neither unit. -/
+theorem dupVals_rcPotential_growth {store store' : Store}
+    {values : List RVal} (hrun : dupVals store values = .ok store') :
+    RcPotentialGrowthLE store store' (2 * values.length) := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except Err Store) = .ok store' at hrun
+      injection hrun with hstore
+      subst store'
+      exact RcPotentialGrowthLE.refl store
+  | cons value rest ih =>
+      cases value with
+      | lit literal =>
+          simp only [dupVals, List.foldlM_cons] at hrun
+          have htail := ih hrun
+          simp [RcPotentialGrowthLE] at htail ⊢
+          omega
+      | erased =>
+          simp only [dupVals, List.foldlM_cons] at hrun
+          have htail := ih hrun
+          simp [RcPotentialGrowthLE] at htail ⊢
+          omega
+      | loc location =>
+          simp only [dupVals, List.foldlM_cons] at hrun
+          cases hget : store.get? location with
+          | none => simp [hget, bindErr] at hrun
+          | some box =>
+              cases box with
+              | mk world rc node =>
+                  cases world with
+                  | unique => simp [hget, bindErr] at hrun
+                  | shared =>
+                      simp only [hget] at hrun
+                      have hstep := amortizedRc_incRcStore hget
+                      have htail := ih hrun
+                      simp only [RcPotentialGrowthLE, List.length_cons]
+                        at htail ⊢
+                      simp only [Sim.incRcStore] at hstep
+                      omega
+
+private def DropAmortizedRcAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ store value store',
+    AllocationOrderInvariant store →
+    dropVal ctx fuel store value = .ok store' →
+      amortizedRc store' = amortizedRc store ∧
+        store'.allocs = store.allocs) ∧
+  (∀ store values store',
+    AllocationOrderInvariant store →
+    dropMany ctx fuel store values = .ok store' →
+      amortizedRc store' = amortizedRc store ∧
+        store'.allocs = store.allocs) ∧
+  (∀ store value store',
+    AllocationOrderInvariant store →
+    dropUVal ctx fuel store value = .ok store' →
+      amortizedRc store' = amortizedRc store ∧
+        store'.allocs = store.allocs) ∧
+  (∀ store values store',
+    AllocationOrderInvariant store →
+    dropManyU ctx fuel store values = .ok store' →
+      amortizedRc store' = amortizedRc store ∧
+        store'.allocs = store.allocs)
+
+/-- Shared and unique deep release conserve `rcops + sharedRcPotential` and
+never allocate.  The positivity premise rules out corrupt live slots with
+count zero; the append-only lowerer establishes it for every successful
+fresh run. -/
+private theorem dropAmortizedRcAt (ctx : Ctx) :
+    ∀ fuel, DropAmortizedRcAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro store value store' horder hrun
+        rw [dropVal.eq_def] at hrun
+        simp at hrun
+      · intro store values store' horder hrun
+        rw [dropMany.eq_def] at hrun
+        simp at hrun
+      · intro store value store' horder hrun
+        rw [dropUVal.eq_def] at hrun
+        simp at hrun
+      · intro store values store' horder hrun
+        rw [dropManyU.eq_def] at hrun
+        simp at hrun
+  | succ fuel ih =>
+      obtain ⟨ihVal, ihMany, ihUVal, ihManyU⟩ := ih
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro store value store' horder hrun
+        cases value with
+        | lit literal =>
+            rw [dropVal.eq_def] at hrun
+            dsimp only at hrun
+            injection hrun with hstore
+            subst store'
+            exact ⟨rfl, rfl⟩
+        | erased =>
+            rw [dropVal.eq_def] at hrun
+            dsimp only at hrun
+            injection hrun with hstore
+            subst store'
+            exact ⟨rfl, rfl⟩
+        | loc location =>
+            rw [dropVal.eq_def] at hrun
+            dsimp only at hrun
+            cases hget : store.get? location with
+            | none => simp [hget] at hrun
+            | some box =>
+                rw [hget] at hrun
+                cases box with
+                | mk world rc node =>
+                    cases world with
+                    | unique => simp at hrun
+                    | shared =>
+                        dsimp only at hrun
+                        by_cases hrc : rc = 1
+                        · subst rc
+                          have hbeq : ((1 : Nat) == 1) = true := by decide
+                          rw [hbeq] at hrun
+                          have hgetTick :
+                              store.rcTick.get? location =
+                                some ⟨.shared, 1, node⟩ := by
+                            simpa using hget
+                          have hprefixOrder :=
+                            horder.rcTick.kill hgetTick
+                          cases node with
+                          | ctorN cid fields =>
+                              constructor
+                              · calc
+                                  amortizedRc store' =
+                                      amortizedRc
+                                        (store.rcTick.kill location) :=
+                                    (ihMany _ _ _ hprefixOrder hrun).1
+                                  _ = amortizedRc store :=
+                                    amortizedRc_tickKillSharedOne hget
+                              · calc
+                                  store'.allocs =
+                                      (store.rcTick.kill location).allocs :=
+                                    (ihMany _ _ _ hprefixOrder hrun).2
+                                  _ = store.allocs := by rfl
+                          | papN address arity args =>
+                              constructor
+                              · calc
+                                  amortizedRc store' =
+                                      amortizedRc
+                                        (store.rcTick.kill location) :=
+                                    (ihMany _ _ _ hprefixOrder hrun).1
+                                  _ = amortizedRc store :=
+                                    amortizedRc_tickKillSharedOne hget
+                              · calc
+                                  store'.allocs =
+                                      (store.rcTick.kill location).allocs :=
+                                    (ihMany _ _ _ hprefixOrder hrun).2
+                                  _ = store.allocs := by rfl
+                        · have hpos : 0 < rc := horder.rc_pos hget
+                          have hmany : 1 < rc := by omega
+                          have hbeq : (rc == 1) = false := by simp [hrc]
+                          rw [hbeq] at hrun
+                          injection hrun with hstore
+                          subst store'
+                          constructor
+                          · simpa only [Sim.decRcStore] using
+                              amortizedRc_decRcStore hmany hget
+                          · rfl
+      · intro store values store' horder hrun
+        cases values with
+        | nil =>
+            rw [dropMany.eq_def] at hrun
+            dsimp only at hrun
+            injection hrun with hstore
+            subst store'
+            exact ⟨rfl, rfl⟩
+        | cons value values =>
+            rw [dropMany.eq_def] at hrun
+            dsimp only at hrun
+            cases hfirst : dropVal ctx fuel store value with
+            | error err => rw [hfirst, bindErr] at hrun; contradiction
+            | ok middle =>
+                rw [hfirst] at hrun
+                constructor
+                · calc
+                    amortizedRc store' = amortizedRc middle :=
+                      (ihMany _ _ _ (horder.dropVal hfirst) hrun).1
+                    _ = amortizedRc store :=
+                      (ihVal _ _ _ horder hfirst).1
+                · calc
+                    store'.allocs = middle.allocs :=
+                      (ihMany _ _ _ (horder.dropVal hfirst) hrun).2
+                    _ = store.allocs :=
+                      (ihVal _ _ _ horder hfirst).2
+      · intro store value store' horder hrun
+        cases value with
+        | lit literal =>
+            rw [dropUVal.eq_def] at hrun
+            dsimp only at hrun
+            injection hrun with hstore
+            subst store'
+            exact ⟨rfl, rfl⟩
+        | erased =>
+            rw [dropUVal.eq_def] at hrun
+            dsimp only at hrun
+            injection hrun with hstore
+            subst store'
+            exact ⟨rfl, rfl⟩
+        | loc location =>
+            rw [dropUVal.eq_def] at hrun
+            dsimp only at hrun
+            cases hget : store.get? location with
+            | none => simp [hget] at hrun
+            | some box =>
+                rw [hget] at hrun
+                cases box with
+                | mk world rc node =>
+                    cases world with
+                    | shared => simp at hrun
+                    | unique =>
+                        cases node with
+                        | ctorN cid fields =>
+                            constructor
+                            · calc
+                                amortizedRc store' =
+                                    amortizedRc (store.kill location) :=
+                                  (ihManyU _ _ _ (horder.kill hget) hrun).1
+                                _ = amortizedRc store :=
+                                  amortizedRc_killUnique hget
+                            · calc
+                                store'.allocs =
+                                    (store.kill location).allocs :=
+                                  (ihManyU _ _ _
+                                    (horder.kill hget) hrun).2
+                                _ = store.allocs := by rfl
+                        | papN address arity args => simp at hrun
+      · intro store values store' horder hrun
+        cases values with
+        | nil =>
+            rw [dropManyU.eq_def] at hrun
+            dsimp only at hrun
+            injection hrun with hstore
+            subst store'
+            exact ⟨rfl, rfl⟩
+        | cons value values =>
+            rw [dropManyU.eq_def] at hrun
+            dsimp only at hrun
+            cases hfirst : dropUVal ctx fuel store value with
+            | error err => rw [hfirst, bindErr] at hrun; contradiction
+            | ok middle =>
+                rw [hfirst] at hrun
+                constructor
+                · calc
+                    amortizedRc store' = amortizedRc middle :=
+                      (ihManyU _ _ _ (horder.dropUVal hfirst) hrun).1
+                    _ = amortizedRc store :=
+                      (ihUVal _ _ _ horder hfirst).1
+                · calc
+                    store'.allocs = middle.allocs :=
+                      (ihManyU _ _ _ (horder.dropUVal hfirst) hrun).2
+                    _ = store.allocs :=
+                      (ihUVal _ _ _ horder hfirst).2
+
+theorem dropVal_amortizedRc {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropVal ctx fuel store value = .ok store') :
+    amortizedRc store' = amortizedRc store :=
+  ((dropAmortizedRcAt ctx fuel).1 store value store' horder hrun).1
+
+theorem dropMany_amortizedRc {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropMany ctx fuel store values = .ok store') :
+    amortizedRc store' = amortizedRc store :=
+  ((dropAmortizedRcAt ctx fuel).2.1 store values store' horder hrun).1
+
+theorem dropUVal_amortizedRc {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropUVal ctx fuel store value = .ok store') :
+    amortizedRc store' = amortizedRc store :=
+  ((dropAmortizedRcAt ctx fuel).2.2.1 store value store' horder hrun).1
+
+theorem dropManyU_amortizedRc {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropManyU ctx fuel store values = .ok store') :
+    amortizedRc store' = amortizedRc store :=
+  ((dropAmortizedRcAt ctx fuel).2.2.2 store values store' horder hrun).1
+
+theorem dropVal_allocs {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropVal ctx fuel store value = .ok store') :
+    store'.allocs = store.allocs :=
+  ((dropAmortizedRcAt ctx fuel).1 store value store' horder hrun).2
+
+theorem dropMany_allocs {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropMany ctx fuel store values = .ok store') :
+    store'.allocs = store.allocs :=
+  ((dropAmortizedRcAt ctx fuel).2.1 store values store' horder hrun).2
+
+theorem dropUVal_allocs {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropUVal ctx fuel store value = .ok store') :
+    store'.allocs = store.allocs :=
+  ((dropAmortizedRcAt ctx fuel).2.2.1 store value store' horder hrun).2
+
+theorem dropManyU_allocs {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropManyU ctx fuel store values = .ok store') :
+    store'.allocs = store.allocs :=
+  ((dropAmortizedRcAt ctx fuel).2.2.2 store values store' horder hrun).2
+
+theorem dropVal_rcPotential_growth {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropVal ctx fuel store value = .ok store') :
+    RcPotentialGrowthLE store store' 0 := by
+  simp [RcPotentialGrowthLE, dropVal_amortizedRc horder hrun]
+
+theorem dropUVal_rcPotential_growth {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropUVal ctx fuel store value = .ok store') :
+    RcPotentialGrowthLE store store' 0 := by
+  simp [RcPotentialGrowthLE, dropUVal_amortizedRc horder hrun]
+
+/-! ## Primitive-operation potential contracts -/
+
+/-- Amortized RC allowance for every non-recursive operation emitted by the
+current append-only lowering.  `reuse` is excluded because it can invalidate
+allocation order; calls and `apply` require separate recursive contracts.
+Allocating a shared node creates one unit of pending RC potential, while a
+successful shared `dup` both executes an RC instruction and creates one unit
+of potential. -/
+def localOpRcAllowance : Op → Option Nat
+  | .pure _ => some 0
+  | .alloc _ _ _ => some 1
+  | .reuse _ _ _ => none
+  | .free _ => some 0
+  | .dup _ => some 2
+  | .drop _ => some 0
+  | .dropU _ => some 0
+  | .fetch _ _ => some 0
+  | .call _ _ => none
+  | .callSelf _ => none
+  | .papp _ _ => some 1
+  | .apply _ _ => none
+  | .extern _ _ => some 0
+
+/-- Heap-allocation allowance for a primitive operation.  Only constructor
+and PAP creation append a node; the RC classifier above excludes the
+recursive operations and `reuse` before this value is consumed. -/
+def localOpAllocationAllowance : Op → Nat
+  | .alloc _ _ _ | .papp _ _ => 1
+  | _ => 0
+
+/-- Every classified primitive stays within its allocation and amortized RC
+allowances and leaves the reuse counter unchanged.  Deep shared and unique
+release use the fuel-inductive theorem above, so both of their allowances are
+exactly zero regardless of the size of the released value. -/
+private theorem runOp_localOwnership_components
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store store' : Store}
+    {env : List RVal} {op : Op} {value : RVal} {allowance : Nat}
+    (hlocal : localOpRcAllowance op = some allowance)
+    (horder : AllocationOrderInvariant store)
+    (hrun : runOp ctx fuel cur store env op = .ok (store', value)) :
+    store'.allocs ≤ store.allocs + localOpAllocationAllowance op ∧
+      store'.reuses = store.reuses ∧
+        RcPotentialGrowthLE store store' allowance := by
+  cases fuel with
+  | zero =>
+      simp [runOp] at hrun
+  | succ fuel =>
+      cases op with
+      | pure atom =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases hresolve : resolveAtom env atom with
+          | error err => rw [hresolve, bindErr] at hrun; contradiction
+          | ok result =>
+              rw [hresolve, bindOk] at hrun
+              have hpair := Except.ok.inj hrun
+              cases hpair
+              exact ⟨by simp [localOpAllocationAllowance], rfl,
+                RcPotentialGrowthLE.refl store⟩
+      | alloc world cid atoms =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases hresolve : resolveAtoms env atoms with
+          | error err => rw [hresolve, bindErr] at hrun; contradiction
+          | ok values =>
+              rw [hresolve, bindOk] at hrun
+              have hpair := Except.ok.inj hrun
+              cases hpair
+              exact ⟨by simp [localOpAllocationAllowance, Store.allocNode],
+                by simp [Store.allocNode],
+                RcPotentialGrowthLE.allocNode store world
+                  (.ctorN cid values.toArray)⟩
+      | reuse target cid atoms =>
+          simp [localOpRcAllowance] at hlocal
+      | free target =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at hrun; contradiction
+          | ok targetValue =>
+              rw [htarget, bindOk] at hrun
+              cases targetValue with
+              | lit literal => simp at hrun
+              | erased => simp at hrun
+              | loc location =>
+                  cases hbox : store.get? location with
+                  | none => simp [hbox] at hrun
+                  | some box =>
+                      simp only [hbox] at hrun
+                      cases box with
+                      | mk world rc node =>
+                          cases world with
+                          | shared => simp at hrun
+                          | unique =>
+                              have hpair := Except.ok.inj hrun
+                              cases hpair
+                              exact ⟨by
+                                  simp [localOpAllocationAllowance,
+                                    Store.kill], rfl, by
+                                  simp [RcPotentialGrowthLE,
+                                    amortizedRc_killUnique hbox]⟩
+      | dup target =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at hrun; contradiction
+          | ok targetValue =>
+              rw [htarget, bindOk] at hrun
+              cases targetValue with
+              | lit literal =>
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl, by
+                    simp [RcPotentialGrowthLE]⟩
+              | erased =>
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl, by
+                    simp [RcPotentialGrowthLE]⟩
+              | loc location =>
+                  cases hbox : store.get? location with
+                  | none => simp [hbox] at hrun
+                  | some box =>
+                      simp only [hbox] at hrun
+                      cases box with
+                      | mk world rc node =>
+                          cases world with
+                          | unique => simp at hrun
+                          | shared =>
+                              have hpair := Except.ok.inj hrun
+                              cases hpair
+                              have hstep := amortizedRc_incRcStore hbox
+                              refine ⟨?_, rfl, ?_⟩
+                              · simp [localOpAllocationAllowance,
+                                  Store.setBox, Store.rcTick]
+                              · simp only [RcPotentialGrowthLE]
+                                simpa only [Sim.incRcStore] using
+                                  Nat.le_of_eq hstep
+      | drop target =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at hrun; contradiction
+          | ok targetValue =>
+              rw [htarget, bindOk] at hrun
+              cases targetValue with
+              | lit literal =>
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl,
+                    RcPotentialGrowthLE.refl store⟩
+              | erased =>
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl,
+                    RcPotentialGrowthLE.refl store⟩
+              | loc location =>
+                  dsimp only at hrun
+                  cases hdrop : dropVal ctx fuel store (.loc location) with
+                  | error err => rw [hdrop, bindErr] at hrun; contradiction
+                  | ok dropped =>
+                      rw [hdrop, bindOk] at hrun
+                      have hpair := Except.ok.inj hrun
+                      cases hpair
+                      exact ⟨by
+                          simpa [localOpAllocationAllowance] using
+                            Nat.le_of_eq (dropVal_allocs horder hdrop),
+                        NoReuse.dropVal_reuses hdrop,
+                        dropVal_rcPotential_growth horder hdrop⟩
+      | dropU target =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at hrun; contradiction
+          | ok targetValue =>
+              rw [htarget, bindOk] at hrun
+              cases targetValue with
+              | lit literal =>
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl,
+                    RcPotentialGrowthLE.refl store⟩
+              | erased =>
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl,
+                    RcPotentialGrowthLE.refl store⟩
+              | loc location =>
+                  dsimp only at hrun
+                  cases hdrop : dropUVal ctx fuel store (.loc location) with
+                  | error err => rw [hdrop, bindErr] at hrun; contradiction
+                  | ok dropped =>
+                      rw [hdrop, bindOk] at hrun
+                      have hpair := Except.ok.inj hrun
+                      cases hpair
+                      exact ⟨by
+                          simpa [localOpAllocationAllowance] using
+                            Nat.le_of_eq (dropUVal_allocs horder hdrop),
+                        NoReuse.dropUVal_reuses hdrop,
+                        dropUVal_rcPotential_growth horder hdrop⟩
+      | fetch target field =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at hrun; contradiction
+          | ok targetValue =>
+              rw [htarget, bindOk] at hrun
+              cases targetValue with
+              | lit literal => simp at hrun
+              | erased => simp at hrun
+              | loc location =>
+                  cases hbox : store.get? location with
+                  | none => simp [hbox] at hrun
+                  | some box =>
+                      simp only [hbox] at hrun
+                      cases box with
+                      | mk world rc node =>
+                          cases node with
+                          | papN address arity args => simp at hrun
+                          | ctorN cid fields =>
+                              cases hfield : fields[field]? with
+                              | none => simp [hfield] at hrun
+                              | some result =>
+                                  simp only [hfield] at hrun
+                                  have hpair := Except.ok.inj hrun
+                                  cases hpair
+                                  exact ⟨by
+                                      simp [localOpAllocationAllowance], rfl,
+                                    RcPotentialGrowthLE.refl store⟩
+      | call address atoms =>
+          simp [localOpRcAllowance] at hlocal
+      | callSelf atoms =>
+          simp [localOpRcAllowance] at hlocal
+      | papp address atoms =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases hresolve : resolveAtoms env atoms with
+          | error err => rw [hresolve, bindErr] at hrun; contradiction
+          | ok values =>
+              rw [hresolve, bindOk] at hrun
+              cases hdecl : ctx.decls address with
+              | none => simp [hdecl] at hrun
+              | some decl =>
+                  simp only [hdecl] at hrun
+                  by_cases hlen : values.length < declArity decl
+                  · simp only [hlen, if_true] at hrun
+                    have hpair := Except.ok.inj hrun
+                    cases hpair
+                    exact ⟨by
+                        simp [localOpAllocationAllowance, Store.allocNode],
+                      by simp [Store.allocNode],
+                      RcPotentialGrowthLE.allocNode store .shared
+                        (.papN address (declArity decl) values.toArray)⟩
+                  · simp [hlen] at hrun
+      | apply function atoms =>
+          simp [localOpRcAllowance] at hlocal
+      | extern address atoms =>
+          simp only [localOpRcAllowance, Option.some.injEq] at hlocal
+          subst allowance
+          rw [runOp.eq_def] at hrun
+          dsimp only at hrun
+          cases hresolve : resolveAtoms env atoms with
+          | error err => rw [hresolve, bindErr] at hrun; contradiction
+          | ok values =>
+              rw [hresolve, bindOk] at hrun
+              cases hcall : callScalarOracle ctx address values with
+              | error err => rw [hcall, bindErr] at hrun; contradiction
+              | ok result =>
+                  rw [hcall, bindOk] at hrun
+                  have hpair := Except.ok.inj hrun
+                  cases hpair
+                  exact ⟨by simp [localOpAllocationAllowance], rfl,
+                    RcPotentialGrowthLE.refl store⟩
+
+/-- RC-only projection retained for callers that do not yet need allocation
+accounting. -/
+theorem runOp_localRcPotential_growth
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store store' : Store}
+    {env : List RVal} {op : Op} {value : RVal} {allowance : Nat}
+    (hlocal : localOpRcAllowance op = some allowance)
+    (horder : AllocationOrderInvariant store)
+    (hrun : runOp ctx fuel cur store env op = .ok (store', value)) :
+    store'.reuses = store.reuses ∧
+      RcPotentialGrowthLE store store' allowance :=
+  (runOp_localOwnership_components hlocal horder hrun).2
+
+/-- The two resources needed by the retain-aware ownership tariff.  Keeping
+them paired prevents a lowering proof from composing an allocation estimate
+that came from a different primitive decomposition than its RC estimate. -/
+@[ext] structure OwnershipAllowance where
+  allocations : Nat
+  rcPotential : Nat
+  deriving BEq, DecidableEq, Repr
+
+/-- Componentwise addition of ownership allowances. -/
+def OwnershipAllowance.add (left right : OwnershipAllowance) :
+    OwnershipAllowance :=
+  { allocations := left.allocations + right.allocations
+    rcPotential := left.rcPotential + right.rcPotential }
+
+/-- Componentwise ordering of paired ownership allowances. -/
+def OwnershipAllowanceLE (actual budget : OwnershipAllowance) : Prop :=
+  actual.allocations ≤ budget.allocations ∧
+    actual.rcPotential ≤ budget.rcPotential
+
+theorem OwnershipAllowanceLE.refl (allowance : OwnershipAllowance) :
+    OwnershipAllowanceLE allowance allowance := by
+  simp [OwnershipAllowanceLE]
+
+theorem OwnershipAllowanceLE.trans {first middle last : OwnershipAllowance}
+    (hfirst : OwnershipAllowanceLE first middle)
+    (hsecond : OwnershipAllowanceLE middle last) :
+    OwnershipAllowanceLE first last := by
+  simp only [OwnershipAllowanceLE] at hfirst hsecond ⊢
+  omega
+
+theorem OwnershipAllowanceLE.add {leftActual leftBudget rightActual
+    rightBudget : OwnershipAllowance}
+    (hleft : OwnershipAllowanceLE leftActual leftBudget)
+    (hright : OwnershipAllowanceLE rightActual rightBudget) :
+    OwnershipAllowanceLE (leftActual.add rightActual)
+      (leftBudget.add rightBudget) := by
+  simp only [OwnershipAllowanceLE, OwnershipAllowance.add] at hleft hright ⊢
+  omega
+
+/-- Allocation and potential growth carried by one target transition.  Local
+operations preserve the reuse counter; this both excludes reuse-based heap
+mutation and supplies the allocation-order premise needed for sequencing. -/
+def OwnershipGrowthLE (before after : Store)
+    (allowance : OwnershipAllowance) : Prop :=
+  after.allocs ≤ before.allocs + allowance.allocations ∧
+    after.reuses = before.reuses ∧
+      RcPotentialGrowthLE before after allowance.rcPotential
+
+theorem OwnershipGrowthLE.refl (store : Store) :
+    OwnershipGrowthLE store store ⟨0, 0⟩ := by
+  exact ⟨by simp, rfl, RcPotentialGrowthLE.refl store⟩
+
+theorem OwnershipGrowthLE.trans {first middle last : Store}
+    {left right : OwnershipAllowance}
+    (hleft : OwnershipGrowthLE first middle left)
+    (hright : OwnershipGrowthLE middle last right) :
+    OwnershipGrowthLE first last (left.add right) := by
+  rcases hleft with ⟨hallocLeft, hreusesLeft, hrcLeft⟩
+  rcases hright with ⟨hallocRight, hreusesRight, hrcRight⟩
+  refine ⟨?_, hreusesRight.trans hreusesLeft, ?_⟩
+  · simp only [OwnershipAllowance.add]
+    omega
+  · exact hrcLeft.trans hrcRight
+
+theorem OwnershipGrowthLE.monoAllowance {before after : Store}
+    {smaller larger : OwnershipAllowance}
+    (hgrowth : OwnershipGrowthLE before after smaller)
+    (hle : OwnershipAllowanceLE smaller larger) :
+    OwnershipGrowthLE before after larger := by
+  rcases hgrowth with ⟨halloc, hreuses, hrc⟩
+  exact ⟨by
+      simp only [OwnershipAllowanceLE] at hle
+      omega,
+    hreuses, hrc.monoAllowance hle.2⟩
+
+/-- Amortized allowance for retaining a dynamic list of runtime values. -/
+def retainedOwnershipAllowance (count : Nat) : OwnershipAllowance :=
+  ⟨0, 2 * count⟩
+
+theorem OwnershipGrowthLE.allocNode (store : Store) (world : Ixon.Owned)
+    (node : Node) :
+    OwnershipGrowthLE store (store.allocNode world node).1 ⟨1, 1⟩ := by
+  exact ⟨by simp [Store.allocNode], by simp [Store.allocNode],
+    RcPotentialGrowthLE.allocNode store world node⟩
+
+/-- Retaining a runtime list changes no allocation/reuse counter and costs at
+most two amortized RC units per entry. -/
+theorem dupVals_ownership_growth {store store' : Store}
+    {values : List RVal} (hrun : dupVals store values = .ok store') :
+    OwnershipGrowthLE store store'
+      (retainedOwnershipAllowance values.length) := by
+  have hcounters := dupVals_growth hrun
+  simp only [StoreGrowthLE, ObservationGrowthLE, costObservation,
+    rcAllowance, Nat.add_zero] at hcounters
+  exact ⟨hcounters.1, NoReuse.dupVals_reuses hrun,
+    dupVals_rcPotential_growth hrun⟩
+
+theorem dropVal_ownership_growth {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropVal ctx fuel store value = .ok store') :
+    OwnershipGrowthLE store store' ⟨0, 0⟩ :=
+  ⟨by simpa using Nat.le_of_eq (dropVal_allocs horder hrun),
+    NoReuse.dropVal_reuses hrun, dropVal_rcPotential_growth horder hrun⟩
+
+theorem dropMany_ownership_growth {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropMany ctx fuel store values = .ok store') :
+    OwnershipGrowthLE store store' ⟨0, 0⟩ :=
+  ⟨by simpa using Nat.le_of_eq (dropMany_allocs horder hrun),
+    NoReuse.dropMany_reuses hrun, by
+      simp [RcPotentialGrowthLE, dropMany_amortizedRc horder hrun]⟩
+
+theorem dropUVal_ownership_growth {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropUVal ctx fuel store value = .ok store') :
+    OwnershipGrowthLE store store' ⟨0, 0⟩ :=
+  ⟨by simpa using Nat.le_of_eq (dropUVal_allocs horder hrun),
+    NoReuse.dropUVal_reuses hrun, dropUVal_rcPotential_growth horder hrun⟩
+
+theorem dropManyU_ownership_growth {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (horder : AllocationOrderInvariant store)
+    (hrun : dropManyU ctx fuel store values = .ok store') :
+    OwnershipGrowthLE store store' ⟨0, 0⟩ :=
+  ⟨by simpa using Nat.le_of_eq (dropManyU_allocs horder hrun),
+    NoReuse.dropManyU_reuses hrun, by
+      simp [RcPotentialGrowthLE, dropManyU_amortizedRc horder hrun]⟩
+
+/-- Complete paired allowance table for non-recursive primitive operations.
+Constructor and PAP allocation each append one shared node and create one
+unit of pending RC potential; a shared retain costs one RC instruction and
+creates one potential unit. -/
+def localOpOwnershipAllowance : Op → Option OwnershipAllowance
+  | .pure _ => some ⟨0, 0⟩
+  | .alloc _ _ _ => some ⟨1, 1⟩
+  | .reuse _ _ _ => none
+  | .free _ => some ⟨0, 0⟩
+  | .dup _ => some ⟨0, 2⟩
+  | .drop _ => some ⟨0, 0⟩
+  | .dropU _ => some ⟨0, 0⟩
+  | .fetch _ _ => some ⟨0, 0⟩
+  | .call _ _ => none
+  | .callSelf _ => none
+  | .papp _ _ => some ⟨1, 1⟩
+  | .apply _ _ => none
+  | .extern _ _ => some ⟨0, 0⟩
+
+private theorem localOpOwnershipAllowance_components
+    {op : Op} {allowance : OwnershipAllowance}
+    (hlocal : localOpOwnershipAllowance op = some allowance) :
+    localOpAllocationAllowance op = allowance.allocations ∧
+      localOpRcAllowance op = some allowance.rcPotential := by
+  cases op <;>
+    simp [localOpOwnershipAllowance, localOpAllocationAllowance,
+      localOpRcAllowance] at hlocal ⊢
+  all_goals cases hlocal
+  all_goals exact ⟨rfl, rfl⟩
+
+/-- A successful paired lookup is a proof-producing primitive cost contract.
+The evaluator induction is shared with the legacy RC-only projection above. -/
+theorem runOp_localOwnership_growth
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store store' : Store}
+    {env : List RVal} {op : Op} {value : RVal}
+    {allowance : OwnershipAllowance}
+    (hlocal : localOpOwnershipAllowance op = some allowance)
+    (horder : AllocationOrderInvariant store)
+    (hrun : runOp ctx fuel cur store env op = .ok (store', value)) :
+    OwnershipGrowthLE store store' allowance := by
+  obtain ⟨hallocAllowance, hrcAllowance⟩ :=
+    localOpOwnershipAllowance_components hlocal
+  obtain ⟨halloc, hreuses, hrc⟩ :=
+    runOp_localOwnership_components hrcAllowance horder hrun
+  exact ⟨by simpa only [hallocAllowance] using halloc, hreuses, hrc⟩
+
+/-- State-transformer contract for one operation.  Besides its amortized RC
+bound, the contract carries exactly the append-order and environment-bounds
+facts needed to sequence a following `Code.letOp`. -/
+def OpRcPotentialSound (ctx : Ctx) (cur : FnDef) (op : Op)
+    (allowance : Nat) : Prop :=
+  ∀ {fuel store env store' value},
+    AllocationOrderInvariant store →
+    ValuesInBounds store env →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+      AllocationOrderInvariant store' ∧
+        ValuesInBounds store' (value :: env) ∧
+          store'.reuses = store.reuses ∧
+            RcPotentialGrowthLE store store' allowance
+
+/-- The local allowance table is a complete proof-producing classifier: a
+successful lookup yields the full operation contract, not merely a numeric
+estimate. -/
+theorem OpRcPotentialSound.of_local
+    {ctx : Ctx} {cur : FnDef} {op : Op} {allowance : Nat}
+    (hlocal : localOpRcAllowance op = some allowance) :
+    OpRcPotentialSound ctx cur op allowance := by
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨hreuses, hgrowth⟩ :=
+    runOp_localRcPotential_growth hlocal horder hrun
+  obtain ⟨horder', hvalue⟩ :=
+    runOp_order_of_reuses_eq horder henv hreuses hrun
+  have henv' : ValuesInBounds store' env :=
+    henv.mono (runOp_footprint hrun).nodes_size
+  exact ⟨horder', henv'.cons hvalue, hreuses, hgrowth⟩
+
+/-- Whole-code counterpart of `OpRcPotentialSound`.  A code contract records
+its final value bound, unchanged reuse count, and total amortized RC growth.
+This is deliberately independent of source profiles, so compiler inductions
+can first compose target instructions and attach source-event charges later. -/
+def CodeRcPotentialSound (ctx : Ctx) (cur : FnDef) (code : Code)
+    (allowance : Nat) : Prop :=
+  ∀ {fuel store env store' value},
+    AllocationOrderInvariant store →
+    ValuesInBounds store env →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+      AllocationOrderInvariant store' ∧
+        ValueInBounds store' value ∧
+          store'.reuses = store.reuses ∧
+            RcPotentialGrowthLE store store' allowance
+
+theorem CodeRcPotentialSound.ret {ctx : Ctx} {cur : FnDef} (atom : Atom) :
+    CodeRcPotentialSound ctx cur (.ret atom) 0 := by
+  intro fuel store env store' value horder henv hrun
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only at hrun
+      cases hresolve : resolveAtom env atom with
+      | error err => rw [hresolve, bindErr] at hrun; contradiction
+      | ok result =>
+          rw [hresolve, bindOk] at hrun
+          have hpair := Except.ok.inj hrun
+          cases hpair
+          exact ⟨horder, resolveAtom_inBounds henv hresolve, rfl,
+            RcPotentialGrowthLE.refl store⟩
+
+/-- A difference-list emitter adds `allowance` in front of every already
+certified continuation.  Quantifying over the continuation budget makes the
+judgment close under ordinary emitter composition. -/
+def EmitRcPotentialSound (ctx : Ctx) (cur : FnDef) (emit : Emit)
+    (allowance : Nat) : Prop :=
+  ∀ {continuation : Code} {continuationAllowance : Nat},
+    CodeRcPotentialSound ctx cur continuation continuationAllowance →
+      CodeRcPotentialSound ctx cur (emit continuation)
+        (allowance + continuationAllowance)
+
+theorem EmitRcPotentialSound.id {ctx : Ctx} {cur : FnDef} :
+    EmitRcPotentialSound ctx cur (_root_.id : Emit) 0 := by
+  intro continuation continuationAllowance hcontinuation
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨horder', hvalue, hreuses, hgrowth⟩ :=
+    hcontinuation horder henv hrun
+  exact ⟨horder', hvalue, hreuses, by
+    simpa only [Nat.zero_add] using hgrowth⟩
+
+theorem EmitRcPotentialSound.comp {ctx : Ctx} {cur : FnDef}
+    {first second : Emit} {firstAllowance secondAllowance : Nat}
+    (hfirst : EmitRcPotentialSound ctx cur first firstAllowance)
+    (hsecond : EmitRcPotentialSound ctx cur second secondAllowance) :
+    EmitRcPotentialSound ctx cur (first ∘ second)
+      (firstAllowance + secondAllowance) := by
+  intro continuation continuationAllowance hcontinuation
+  have hsecondCode :
+      CodeRcPotentialSound ctx cur (second continuation)
+        (secondAllowance + continuationAllowance) :=
+    hsecond (continuation := continuation)
+      (continuationAllowance := continuationAllowance) hcontinuation
+  have hfirstCode :
+      CodeRcPotentialSound ctx cur (first (second continuation))
+      (firstAllowance + (secondAllowance + continuationAllowance)) :=
+    hfirst (continuation := second continuation)
+      (continuationAllowance := secondAllowance + continuationAllowance)
+      hsecondCode
+  intro fuel store env store' value horder henv hrun
+  change runCode ctx fuel cur store env (first (second continuation)) =
+    .ok (store', value) at hrun
+  obtain ⟨horder', hvalue, hreuses, hgrowth⟩ :=
+    hfirstCode horder henv hrun
+  exact ⟨horder', hvalue, hreuses, by
+    simpa only [Nat.add_assoc] using hgrowth⟩
+
+/-- Lift one operation contract through `Code.letOp`.  The operation result
+and old environment are precisely the continuation environment promised by
+`OpRcPotentialSound`; potential growth then composes transitively. -/
+theorem OpRcPotentialSound.emit {ctx : Ctx} {cur : FnDef} {op : Op}
+    {allowance : Nat} (hop : OpRcPotentialSound ctx cur op allowance) :
+    EmitRcPotentialSound ctx cur (emitOp op) allowance := by
+  intro continuation continuationAllowance hcontinuation
+  intro fuel store env finalStore finalValue horder henv hrun
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only [emitOp] at hrun
+      cases hopEval : runOp ctx fuel cur store env op with
+      | error err =>
+          rw [hopEval] at hrun
+          change (Except.error err : Except Err (Store × RVal)) =
+            .ok (finalStore, finalValue) at hrun
+          contradiction
+      | ok out =>
+          rcases out with ⟨middle, opValue⟩
+          rw [hopEval] at hrun
+          change runCode ctx fuel cur middle (opValue :: env) continuation =
+            .ok (finalStore, finalValue) at hrun
+          obtain ⟨hmiddleOrder, hmiddleEnv, hstepReuse, hstepGrowth⟩ :=
+            hop horder henv hopEval
+          obtain ⟨hfinalOrder, hfinalValue, hcontinuationReuse,
+              hcontinuationGrowth⟩ :=
+            hcontinuation hmiddleOrder hmiddleEnv hrun
+          exact ⟨hfinalOrder, hfinalValue,
+            hcontinuationReuse.trans hstepReuse,
+            hstepGrowth.trans hcontinuationGrowth⟩
+
+/-- Direct compiler-facing rule for one classified emitted operation. -/
+theorem EmitRcPotentialSound.localOp
+    {ctx : Ctx} {cur : FnDef} {op : Op} {allowance : Nat}
+    (hlocal : localOpRcAllowance op = some allowance) :
+    EmitRcPotentialSound ctx cur (emitOp op) allowance :=
+  OpRcPotentialSound.emit
+    (OpRcPotentialSound.of_local (ctx := ctx) (cur := cur) hlocal)
+
+/-- Seal a certified emitter with a return continuation. -/
+theorem EmitRcPotentialSound.closeRet {ctx : Ctx} {cur : FnDef}
+    {emit : Emit} {allowance : Nat}
+    (hemit : EmitRcPotentialSound ctx cur emit allowance) (atom : Atom) :
+    CodeRcPotentialSound ctx cur (emit (.ret atom)) allowance := by
+  have hcode : CodeRcPotentialSound ctx cur (emit (.ret atom))
+      (allowance + 0) :=
+    hemit (continuation := .ret atom) (continuationAllowance := 0)
+      (CodeRcPotentialSound.ret atom)
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨horder', hvalue, hreuses, hgrowth⟩ :=
+    hcode horder henv hrun
+  exact ⟨horder', hvalue, hreuses, by
+    simpa only [Nat.add_zero] using hgrowth⟩
+
+/-! ## Paired ownership-cost contracts -/
+
+/-- State-transformer contract for one operation, pairing append allocation
+with amortized RC potential.  This is the compiler-facing refinement of the
+RC-only contract above. -/
+def OpOwnershipCostSound (ctx : Ctx) (cur : FnDef) (op : Op)
+    (allowance : OwnershipAllowance) : Prop :=
+  ∀ {fuel store env store' value},
+    AllocationOrderInvariant store →
+    ValuesInBounds store env →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+      AllocationOrderInvariant store' ∧
+        ValuesInBounds store' (value :: env) ∧
+          OwnershipGrowthLE store store' allowance
+
+/-- Every successful lookup in the paired primitive table yields the full
+sequencing contract. -/
+theorem OpOwnershipCostSound.of_local
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    {allowance : OwnershipAllowance}
+    (hlocal : localOpOwnershipAllowance op = some allowance) :
+    OpOwnershipCostSound ctx cur op allowance := by
+  intro fuel store env store' value horder henv hrun
+  have hgrowth := runOp_localOwnership_growth hlocal horder hrun
+  obtain ⟨horder', hvalue⟩ :=
+    runOp_order_of_reuses_eq horder henv hgrowth.2.1 hrun
+  have henv' : ValuesInBounds store' env :=
+    henv.mono (runOp_footprint hrun).nodes_size
+  exact ⟨horder', henv'.cons hvalue, hgrowth⟩
+
+/-- Whole-code paired ownership contract. -/
+def CodeOwnershipCostSound (ctx : Ctx) (cur : FnDef) (code : Code)
+    (allowance : OwnershipAllowance) : Prop :=
+  ∀ {fuel store env store' value},
+    AllocationOrderInvariant store →
+    ValuesInBounds store env →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+      AllocationOrderInvariant store' ∧
+        ValueInBounds store' value ∧
+          OwnershipGrowthLE store store' allowance
+
+theorem CodeOwnershipCostSound.ret {ctx : Ctx} {cur : FnDef}
+    (atom : Atom) :
+    CodeOwnershipCostSound ctx cur (.ret atom) ⟨0, 0⟩ := by
+  intro fuel store env store' value horder henv hrun
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only at hrun
+      cases hresolve : resolveAtom env atom with
+      | error err => rw [hresolve, bindErr] at hrun; contradiction
+      | ok result =>
+          rw [hresolve, bindOk] at hrun
+          have hpair := Except.ok.inj hrun
+          cases hpair
+          exact ⟨horder, resolveAtom_inBounds henv hresolve,
+            OwnershipGrowthLE.refl store⟩
+
+/-- A difference-list emitter contributes one paired allowance in front of
+every certified continuation. -/
+def EmitOwnershipCostSound (ctx : Ctx) (cur : FnDef) (emit : Emit)
+    (allowance : OwnershipAllowance) : Prop :=
+  ∀ {continuation : Code}
+      {continuationAllowance : OwnershipAllowance},
+    CodeOwnershipCostSound ctx cur continuation continuationAllowance →
+      CodeOwnershipCostSound ctx cur (emit continuation)
+        (allowance.add continuationAllowance)
+
+theorem EmitOwnershipCostSound.id {ctx : Ctx} {cur : FnDef} :
+    EmitOwnershipCostSound ctx cur (_root_.id : Emit) ⟨0, 0⟩ := by
+  intro continuation continuationAllowance hcontinuation
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨horder', hvalue, hgrowth⟩ :=
+    hcontinuation horder henv hrun
+  exact ⟨horder', hvalue, by
+    simpa [OwnershipAllowance.add] using hgrowth⟩
+
+theorem EmitOwnershipCostSound.comp {ctx : Ctx} {cur : FnDef}
+    {first second : Emit}
+    {firstAllowance secondAllowance : OwnershipAllowance}
+    (hfirst : EmitOwnershipCostSound ctx cur first firstAllowance)
+    (hsecond : EmitOwnershipCostSound ctx cur second secondAllowance) :
+    EmitOwnershipCostSound ctx cur (first ∘ second)
+      (firstAllowance.add secondAllowance) := by
+  intro continuation continuationAllowance hcontinuation
+  have hsecondCode :
+      CodeOwnershipCostSound ctx cur (second continuation)
+        (secondAllowance.add continuationAllowance) :=
+    hsecond (continuation := continuation)
+      (continuationAllowance := continuationAllowance) hcontinuation
+  have hfirstCode :
+      CodeOwnershipCostSound ctx cur (first (second continuation))
+        (firstAllowance.add
+          (secondAllowance.add continuationAllowance)) :=
+    hfirst (continuation := second continuation)
+      (continuationAllowance :=
+        secondAllowance.add continuationAllowance) hsecondCode
+  intro fuel store env store' value horder henv hrun
+  change runCode ctx fuel cur store env (first (second continuation)) =
+    .ok (store', value) at hrun
+  obtain ⟨horder', hvalue, hgrowth⟩ :=
+    hfirstCode horder henv hrun
+  exact ⟨horder', hvalue, by
+    simpa [OwnershipAllowance.add, Nat.add_assoc] using hgrowth⟩
+
+/-- Lift one paired operation contract through `Code.letOp`. -/
+theorem OpOwnershipCostSound.emit {ctx : Ctx} {cur : FnDef} {op : Op}
+    {allowance : OwnershipAllowance}
+    (hop : OpOwnershipCostSound ctx cur op allowance) :
+    EmitOwnershipCostSound ctx cur (emitOp op) allowance := by
+  intro continuation continuationAllowance hcontinuation
+  intro fuel store env finalStore finalValue horder henv hrun
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only [emitOp] at hrun
+      cases hopEval : runOp ctx fuel cur store env op with
+      | error err =>
+          rw [hopEval] at hrun
+          change (Except.error err : Except Err (Store × RVal)) =
+            .ok (finalStore, finalValue) at hrun
+          contradiction
+      | ok out =>
+          rcases out with ⟨middle, opValue⟩
+          rw [hopEval] at hrun
+          change runCode ctx fuel cur middle (opValue :: env) continuation =
+            .ok (finalStore, finalValue) at hrun
+          obtain ⟨hmiddleOrder, hmiddleEnv, hstepGrowth⟩ :=
+            hop horder henv hopEval
+          obtain ⟨hfinalOrder, hfinalValue, hcontinuationGrowth⟩ :=
+            hcontinuation hmiddleOrder hmiddleEnv hrun
+          exact ⟨hfinalOrder, hfinalValue,
+            hstepGrowth.trans hcontinuationGrowth⟩
+
+/-- Direct compiler-facing rule for one classified emitted operation. -/
+theorem EmitOwnershipCostSound.localOp
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    {allowance : OwnershipAllowance}
+    (hlocal : localOpOwnershipAllowance op = some allowance) :
+    EmitOwnershipCostSound ctx cur (emitOp op) allowance :=
+  OpOwnershipCostSound.emit
+    (OpOwnershipCostSound.of_local (ctx := ctx) (cur := cur) hlocal)
+
+/-- Seal a paired-cost emitter with a return continuation. -/
+theorem EmitOwnershipCostSound.closeRet {ctx : Ctx} {cur : FnDef}
+    {emit : Emit} {allowance : OwnershipAllowance}
+    (hemit : EmitOwnershipCostSound ctx cur emit allowance) (atom : Atom) :
+    CodeOwnershipCostSound ctx cur (emit (.ret atom)) allowance := by
+  have hcode : CodeOwnershipCostSound ctx cur (emit (.ret atom))
+      (allowance.add ⟨0, 0⟩) :=
+    hemit (continuation := .ret atom)
+      (continuationAllowance := ⟨0, 0⟩)
+      (CodeOwnershipCostSound.ret atom)
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨horder', hvalue, hgrowth⟩ :=
+    hcode horder henv hrun
+  exact ⟨horder', hvalue, by
+    simpa [OwnershipAllowance.add] using hgrowth⟩
+
+/-- A paired code contract remains valid when its componentwise allowance is
+enlarged. -/
+theorem CodeOwnershipCostSound.monoAllowance
+    {ctx : Ctx} {cur : FnDef} {code : Code}
+    {smaller larger : OwnershipAllowance}
+    (hsound : CodeOwnershipCostSound ctx cur code smaller)
+    (hle : OwnershipAllowanceLE smaller larger) :
+    CodeOwnershipCostSound ctx cur code larger := by
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨horder', hvalue, hgrowth⟩ := hsound horder henv hrun
+  exact ⟨horder', hvalue, hgrowth.monoAllowance hle⟩
+
+/-- Difference-list emitter contracts are likewise monotone in their local
+allowance. -/
+theorem EmitOwnershipCostSound.monoAllowance
+    {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {smaller larger : OwnershipAllowance}
+    (hsound : EmitOwnershipCostSound ctx cur emit smaller)
+    (hle : OwnershipAllowanceLE smaller larger) :
+    EmitOwnershipCostSound ctx cur emit larger := by
+  intro continuation continuationAllowance hcontinuation
+  intro fuel store env store' value horder henv hrun
+  obtain ⟨horder', hvalue, hgrowth⟩ :=
+    hsound hcontinuation horder henv hrun
+  exact ⟨horder', hvalue, hgrowth.monoAllowance
+    (hle.add (OwnershipAllowanceLE.refl continuationAllowance))⟩
+
+/-- Every compiler-generated parameter-release plan has zero local paired
+cost: deep release is paid from the potential already stored in the heap. -/
+theorem ReleasePlan.ownershipCostSound
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit) :
+    EmitOwnershipCostSound ctx cur emit ⟨0, 0⟩ := by
+  apply ReleasePlan.traverse (hplan := hplan)
+  · intro Γ
+    exact EmitOwnershipCostSound.id
+  · intro Γ output i abs drops tailEmit hentry ih
+    have hhead : EmitOwnershipCostSound ctx cur
+        (emitOp (.drop (.var (Γ.rel abs)))) ⟨0, 0⟩ :=
+      EmitOwnershipCostSound.localOp (by
+        simp [localOpOwnershipAllowance])
+    intro continuation continuationAllowance hcontinuation
+    have htail : CodeOwnershipCostSound ctx cur (tailEmit continuation)
+        ((⟨0, 0⟩ : OwnershipAllowance).add continuationAllowance) :=
+      ih hcontinuation
+    have hcode : CodeOwnershipCostSound ctx cur
+        (emitOp (.drop (.var (Γ.rel abs))) (tailEmit continuation))
+        ((⟨0, 0⟩ : OwnershipAllowance).add
+          ((⟨0, 0⟩ : OwnershipAllowance).add
+            continuationAllowance)) :=
+      hhead htail
+    have hallowance :
+        (⟨0, 0⟩ : OwnershipAllowance).add continuationAllowance =
+          (⟨0, 0⟩ : OwnershipAllowance).add
+            ((⟨0, 0⟩ : OwnershipAllowance).add
+              continuationAllowance) := by
+      apply OwnershipAllowance.ext <;>
+        simp [OwnershipAllowance.add]
+    rw [hallowance]
+    change CodeOwnershipCostSound ctx cur
+      (emitOp (.drop (.var (Γ.rel abs))) (tailEmit continuation)) _
+    exact hcode
+  · intro Γ output i abs drops tailEmit hentry ih
+    have hhead : EmitOwnershipCostSound ctx cur
+        (emitOp (.dropU (.var (Γ.rel abs)))) ⟨0, 0⟩ :=
+      EmitOwnershipCostSound.localOp (by
+        simp [localOpOwnershipAllowance])
+    intro continuation continuationAllowance hcontinuation
+    have htail : CodeOwnershipCostSound ctx cur (tailEmit continuation)
+        ((⟨0, 0⟩ : OwnershipAllowance).add continuationAllowance) :=
+      ih hcontinuation
+    have hcode : CodeOwnershipCostSound ctx cur
+        (emitOp (.dropU (.var (Γ.rel abs))) (tailEmit continuation))
+        ((⟨0, 0⟩ : OwnershipAllowance).add
+          ((⟨0, 0⟩ : OwnershipAllowance).add
+            continuationAllowance)) :=
+      hhead htail
+    have hallowance :
+        (⟨0, 0⟩ : OwnershipAllowance).add continuationAllowance =
+          (⟨0, 0⟩ : OwnershipAllowance).add
+            ((⟨0, 0⟩ : OwnershipAllowance).add
+              continuationAllowance) := by
+      apply OwnershipAllowance.ext <;>
+        simp [OwnershipAllowance.add]
+    rw [hallowance]
+    change CodeOwnershipCostSound ctx cur
+      (emitOp (.dropU (.var (Γ.rel abs))) (tailEmit continuation)) _
+    exact hcode
+/-- The recursor field-retain plan consumes exactly one paired retain charge
+per emitted `dup`. -/
+theorem FieldRetainPlan.ownershipCostSound
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit) :
+    EmitOwnershipCostSound ctx cur emit
+      (retainedOwnershipAllowance retains.length) := by
+  apply FieldRetainPlan.traverse (hplan := hplan)
+  · intro Γ
+    change EmitOwnershipCostSound ctx cur (_root_.id : Emit) ⟨0, 0⟩
+    exact EmitOwnershipCostSound.id
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih
+    have hhead : EmitOwnershipCostSound ctx cur
+        (emitOp (.dup (.var (Γ.rel fieldAbs)))) ⟨0, 2⟩ :=
+      EmitOwnershipCostSound.localOp (by
+        simp [localOpOwnershipAllowance])
+    intro continuation continuationAllowance hcontinuation
+    have htail : CodeOwnershipCostSound ctx cur (tailEmit continuation)
+        ((retainedOwnershipAllowance retains.length).add
+          continuationAllowance) :=
+      ih hcontinuation
+    have hcode : CodeOwnershipCostSound ctx cur
+        (emitOp (.dup (.var (Γ.rel fieldAbs))) (tailEmit continuation))
+        ((⟨0, 2⟩ : OwnershipAllowance).add
+          ((retainedOwnershipAllowance retains.length).add
+            continuationAllowance)) :=
+      hhead htail
+    have hallowance :
+        (retainedOwnershipAllowance
+            (List.length (⟨i, fieldAbs, remaining⟩ :: retains))).add
+            continuationAllowance =
+          (⟨0, 2⟩ : OwnershipAllowance).add
+            ((retainedOwnershipAllowance retains.length).add
+              continuationAllowance) := by
+      apply OwnershipAllowance.ext <;>
+        simp [retainedOwnershipAllowance, OwnershipAllowance.add] <;>
+        omega
+    rw [hallowance]
+    change CodeOwnershipCostSound ctx cur
+      (emitOp (.dup (.var (Γ.rel fieldAbs))) (tailEmit continuation)) _
+    exact hcode
+/-- The erased-application cleanup helper emits only deep shared releases,
+so its complete difference-list emitter has zero local paired cost. -/
+theorem releaseAll_ownershipCostSound (ctx : Ctx) (cur : FnDef)
+    (input : VEnv) (values : List AVal) :
+    EmitOwnershipCostSound ctx cur (releaseAll input values).2 ⟨0, 0⟩ := by
+  apply releaseAll_traverse
+    (Result := fun _ _ _ emit =>
+      EmitOwnershipCostSound ctx cur emit ⟨0, 0⟩)
+  · intro Γ
+    exact EmitOwnershipCostSound.id
+  · intro Γ atom avs output emit ih
+    exact ih
+  · intro Γ abs avs output tailEmit ih
+    have hhead : EmitOwnershipCostSound ctx cur
+        (emitOp (.drop (.var (Γ.rel abs)))) ⟨0, 0⟩ :=
+      EmitOwnershipCostSound.localOp (by
+        simp [localOpOwnershipAllowance])
+    intro continuation continuationAllowance hcontinuation
+    have htailCode : CodeOwnershipCostSound ctx cur
+        (tailEmit continuation)
+        ((⟨0, 0⟩ : OwnershipAllowance).add
+          continuationAllowance) :=
+      ih hcontinuation
+    have hcode : CodeOwnershipCostSound ctx cur
+        (emitOp (.drop (.var (Γ.rel abs)))
+          (tailEmit continuation))
+        ((⟨0, 0⟩ : OwnershipAllowance).add
+          ((⟨0, 0⟩ : OwnershipAllowance).add
+            continuationAllowance)) :=
+      hhead htailCode
+    have hallowance :
+        (⟨0, 0⟩ : OwnershipAllowance).add continuationAllowance =
+          (⟨0, 0⟩ : OwnershipAllowance).add
+            ((⟨0, 0⟩ : OwnershipAllowance).add
+              continuationAllowance) := by
+      apply OwnershipAllowance.ext <;>
+        simp [OwnershipAllowance.add]
+    rw [hallowance]
+    change CodeOwnershipCostSound ctx cur
+      (emitOp (.drop (.var (Γ.rel abs)))
+        (tailEmit continuation)) _
+    exact hcode
+
+/-- One successful compiler capture emits either no instruction (ownership
+move) or one `dup`; one source retain candidate therefore funds the step. -/
+theorem lowerCapture_ownershipCostSound
+    {ctx : Ctx} {cur : FnDef} {expr : IxIR0.Expr}
+    {input output : VEnv} {index : Nat} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    EmitOwnershipCostSound ctx cur emit (retainedOwnershipAllowance 1) := by
+  intro continuation continuationAllowance hcontinuation
+  intro runFuel before runtimeEnv after result horder hbounds hcodeRun
+  cases hentry : input.entries[index]? with
+  | none =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+      cases entry with
+      | recSelf arity =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry] using hrun)).elim
+      | slot abs remaining uses held =>
+          cases held with
+          | false =>
+              exact (stateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry] using hrun)).elim
+          | true =>
+              by_cases hunique : worldOfUses uses = .unique
+              · have huuEq :
+                    (Ixon.Owned.unique == Ixon.Owned.unique) = true := by
+                  decide
+                exact (stateThrowRun_not_ok (by
+                  simpa [lowerCapture, hentry, hunique, huuEq]
+                    using hrun)).elim
+              · have huniqueEq :
+                    (worldOfUses uses == Ixon.Owned.unique) = false := by
+                  cases uses <;> simp_all [worldOfUses] <;> decide
+                by_cases hmore : remaining > countUses index expr
+                · let next := input.setEntry index
+                    (.slot abs (remaining - countUses index expr) uses true)
+                  have hpure :
+                      (next.bump,
+                        emitOp (.dup (.var (next.rel abs))),
+                        AVal.slotA next.depth) = (output, emit, value) ∧
+                        state = finalState := by
+                    simpa [lowerCapture, hentry, huniqueEq, hmore, next]
+                      using hrun
+                  obtain ⟨hresult, hstate⟩ := hpure
+                  cases hresult
+                  subst finalState
+                  have hlocal : EmitOwnershipCostSound ctx cur
+                      (emitOp (.dup (.var (next.rel abs)))) ⟨0, 2⟩ :=
+                    EmitOwnershipCostSound.localOp (by
+                      simp [localOpOwnershipAllowance])
+                  have hcode : CodeOwnershipCostSound ctx cur
+                      (emitOp (.dup (.var (next.rel abs))) continuation)
+                      ((⟨0, 2⟩ : OwnershipAllowance).add
+                        continuationAllowance) :=
+                    hlocal hcontinuation
+                  have hallowance :
+                      (retainedOwnershipAllowance 1).add
+                          continuationAllowance =
+                        (⟨0, 2⟩ : OwnershipAllowance).add
+                          continuationAllowance := by
+                    apply OwnershipAllowance.ext <;>
+                      simp [retainedOwnershipAllowance,
+                        OwnershipAllowance.add]
+                  rw [hallowance]
+                  exact hcode horder hbounds hcodeRun
+                · by_cases hequal : remaining = countUses index expr
+                  · let next := input.setEntry index
+                      (.slot abs 0 uses false)
+                    have hpure :
+                        (next, (_root_.id : Emit), AVal.slotA abs) =
+                            (output, emit, value) ∧ state = finalState := by
+                      simpa [lowerCapture, hentry, huniqueEq, hmore,
+                        hequal, next] using hrun
+                    obtain ⟨hresult, hstate⟩ := hpure
+                    have hemit : (_root_.id : Emit) = emit :=
+                      congrArg
+                        (fun result : VEnv × Emit × AVal => result.2.1)
+                        hresult
+                    subst emit
+                    subst finalState
+                    have hid : CodeOwnershipCostSound ctx cur continuation
+                        ((⟨0, 0⟩ : OwnershipAllowance).add
+                          continuationAllowance) :=
+                      EmitOwnershipCostSound.id hcontinuation
+                    have hle : OwnershipAllowanceLE
+                        ((⟨0, 0⟩ : OwnershipAllowance).add
+                          continuationAllowance)
+                        ((retainedOwnershipAllowance 1).add
+                          continuationAllowance) := by
+                      simp [OwnershipAllowanceLE,
+                        retainedOwnershipAllowance, OwnershipAllowance.add]
+                    exact (hid.monoAllowance hle) horder hbounds hcodeRun
+                  · exact (stateThrowRun_not_ok (by
+                      simpa [lowerCapture, hentry, huniqueEq, hmore,
+                        hequal] using hrun)).elim
+
+/-- The structurally recursive capture traversal consumes at most one source
+retain allowance per selected capture, in the same left-to-right order as
+its emitted `dup` prefix. -/
+theorem lowerCaptures_ownershipCostSound
+    {ctx : Ctx} {cur : FnDef} (expr : IxIR0.Expr) (captures : List Nat)
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState) :
+    EmitOwnershipCostSound ctx cur emit
+      (retainedOwnershipAllowance captures.length) := by
+  refine lowerCaptures_run_core
+    (Result := fun _ _ captures emit _ =>
+      EmitOwnershipCostSound ctx cur emit
+        (retainedOwnershipAllowance captures.length))
+    (e := expr) (hrun := hrun) ?_ ?_
+  · intro input
+    change EmitOwnershipCostSound ctx cur (_root_.id : Emit) ⟨0, 0⟩
+    exact EmitOwnershipCostSound.id
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail
+    have hhead : EmitOwnershipCostSound ctx cur headEmit
+        (retainedOwnershipAllowance 1) :=
+      lowerCapture_ownershipCostSound hheadRun
+    intro continuation continuationAllowance hcontinuation
+    intro targetFuel before runtimeEnv after result horder hbounds hcodeRun
+    have htailCode : CodeOwnershipCostSound ctx cur
+        (tailEmit continuation)
+        ((retainedOwnershipAllowance rest.length).add
+          continuationAllowance) :=
+      htail hcontinuation
+    have hfull : CodeOwnershipCostSound ctx cur
+        (headEmit (tailEmit continuation))
+        ((retainedOwnershipAllowance 1).add
+          ((retainedOwnershipAllowance rest.length).add
+            continuationAllowance)) :=
+      hhead htailCode
+    have hallowance :
+        (retainedOwnershipAllowance (List.length (index :: rest))).add
+            continuationAllowance =
+          (retainedOwnershipAllowance 1).add
+            ((retainedOwnershipAllowance rest.length).add
+              continuationAllowance) := by
+      apply OwnershipAllowance.ext <;>
+        simp [retainedOwnershipAllowance, OwnershipAllowance.add] <;>
+        omega
+    rw [hallowance]
+    exact hfull horder hbounds hcodeRun
+
+/-! ## Run-indexed recursive ownership costs -/
+
+/-- Cost certificate for one particular successful code execution.  Unlike
+`CodeOwnershipCostSound`, this judgment may carry the allowance of a dynamic
+source trace, so recursive executions are not forced into a finite static
+syntax bound. -/
+structure CodeOwnershipRunCost (ctx : Ctx) (fuel : Nat) (cur : FnDef)
+    (before : Store) (env : List RVal) (code : Code) (after : Store)
+    (value : RVal) (allowance : OwnershipAllowance) : Prop where
+  startOrder : AllocationOrderInvariant before
+  envBounds : ValuesInBounds before env
+  run : runCode ctx fuel cur before env code = .ok (after, value)
+  growth : OwnershipGrowthLE before after allowance
+
+/-- Run-indexed counterpart for one operation. -/
+structure OpOwnershipRunCost (ctx : Ctx) (fuel : Nat) (cur : FnDef)
+    (before : Store) (env : List RVal) (op : Op) (after : Store)
+    (value : RVal) (allowance : OwnershipAllowance) : Prop where
+  startOrder : AllocationOrderInvariant before
+  envBounds : ValuesInBounds before env
+  run : runOp ctx fuel cur before env op = .ok (after, value)
+  growth : OwnershipGrowthLE before after allowance
+
+/-- Run-indexed declared-call certificate. -/
+structure InvokeOwnershipRunCost (ctx : Ctx) (fuel : Nat)
+    (address : Ixon.Address) (args : List RVal) (before after : Store)
+    (value : RVal) (allowance : OwnershipAllowance) : Prop where
+  startOrder : AllocationOrderInvariant before
+  argsBounds : ValuesInBounds before args
+  run : invoke ctx fuel address args before = .ok (after, value)
+  growth : OwnershipGrowthLE before after allowance
+
+/-- Run-indexed higher-order application certificate. -/
+structure ApplyOwnershipRunCost (ctx : Ctx) (fuel : Nat)
+    (before : Store) (function : RVal) (args : List RVal) (after : Store)
+    (value : RVal) (allowance : OwnershipAllowance) : Prop where
+  startOrder : AllocationOrderInvariant before
+  functionBound : ValueInBounds before function
+  argsBounds : ValuesInBounds before args
+  run : applyGo ctx fuel before function args = .ok (after, value)
+  growth : OwnershipGrowthLE before after allowance
+
+theorem CodeOwnershipRunCost.finalOrderAndValue
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {code : Code} {value : RVal}
+    {allowance : OwnershipAllowance}
+    (hcost : CodeOwnershipRunCost ctx fuel cur before env code after value
+      allowance) :
+    AllocationOrderInvariant after ∧ ValueInBounds after value :=
+  runCode_order_of_reuses_eq hcost.startOrder hcost.envBounds
+    hcost.growth.2.1 hcost.run
+
+theorem OpOwnershipRunCost.finalOrderAndValue
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {op : Op} {value : RVal}
+    {allowance : OwnershipAllowance}
+    (hcost : OpOwnershipRunCost ctx fuel cur before env op after value
+      allowance) :
+    AllocationOrderInvariant after ∧ ValueInBounds after value :=
+  runOp_order_of_reuses_eq hcost.startOrder hcost.envBounds
+    hcost.growth.2.1 hcost.run
+
+theorem InvokeOwnershipRunCost.finalOrderAndValue
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address} {args : List RVal}
+    {before after : Store} {value : RVal}
+    {allowance : OwnershipAllowance}
+    (hcost : InvokeOwnershipRunCost ctx fuel address args before after value
+      allowance) :
+    AllocationOrderInvariant after ∧ ValueInBounds after value :=
+  invoke_order_of_reuses_eq hcost.startOrder hcost.argsBounds
+    hcost.growth.2.1 hcost.run
+
+theorem ApplyOwnershipRunCost.finalOrderAndValue
+    {ctx : Ctx} {fuel : Nat} {before after : Store} {function : RVal}
+    {args : List RVal} {value : RVal} {allowance : OwnershipAllowance}
+    (hcost : ApplyOwnershipRunCost ctx fuel before function args after value
+      allowance) :
+    AllocationOrderInvariant after ∧ ValueInBounds after value :=
+  applyGo_order_of_reuses_eq hcost.startOrder hcost.functionBound
+    hcost.argsBounds hcost.growth.2.1 hcost.run
+
+/-- A static whole-code contract can always certify a particular run. -/
+theorem CodeOwnershipCostSound.runCost
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {code : Code} {value : RVal}
+    {allowance : OwnershipAllowance}
+    (hsound : CodeOwnershipCostSound ctx cur code allowance)
+    (horder : AllocationOrderInvariant before)
+    (henv : ValuesInBounds before env)
+    (hrun : runCode ctx fuel cur before env code = .ok (after, value)) :
+    CodeOwnershipRunCost ctx fuel cur before env code after value allowance :=
+  ⟨horder, henv, hrun, (hsound horder henv hrun).2.2⟩
+
+/-- A classified local operation can certify its particular execution. -/
+theorem OpOwnershipRunCost.of_local
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {op : Op} {value : RVal}
+    {allowance : OwnershipAllowance}
+    (hlocal : localOpOwnershipAllowance op = some allowance)
+    (horder : AllocationOrderInvariant before)
+    (henv : ValuesInBounds before env)
+    (hrun : runOp ctx fuel cur before env op = .ok (after, value)) :
+    OpOwnershipRunCost ctx fuel cur before env op after value allowance :=
+  ⟨horder, henv, hrun, runOp_localOwnership_growth hlocal horder hrun⟩
+
+theorem CodeOwnershipRunCost.ret
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store : Store}
+    {env : List RVal} {atom : Atom} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (henv : ValuesInBounds store env)
+    (hresolve : resolveAtom env atom = .ok value) :
+    CodeOwnershipRunCost ctx (fuel + 1) cur store env (.ret atom) store value
+      ⟨0, 0⟩ := by
+  refine ⟨horder, henv, ?_, OwnershipGrowthLE.refl store⟩
+  rw [runCode.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+
+/-- Sequence one run-indexed operation with its exact continuation. -/
+theorem CodeOwnershipRunCost.letOp
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before middle after : Store}
+    {env : List RVal} {op : Op} {opValue value : RVal} {rest : Code}
+    {opAllowance restAllowance : OwnershipAllowance}
+    (hop : OpOwnershipRunCost ctx fuel cur before env op middle opValue
+      opAllowance)
+    (hrest : CodeOwnershipRunCost ctx fuel cur middle (opValue :: env) rest
+      after value restAllowance) :
+    CodeOwnershipRunCost ctx (fuel + 1) cur before env (.letOp op rest)
+      after value (opAllowance.add restAllowance) := by
+  refine ⟨hop.startOrder, hop.envBounds, ?_,
+    hop.growth.trans hrest.growth⟩
+  rw [runCode.eq_def]
+  dsimp only
+  rw [hop.run, bindOk]
+  exact hrest.run
+
+/-- A declared function invocation adds no cost beyond its executed body. -/
+theorem InvokeOwnershipRunCost.fn
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address} {args : List RVal}
+    {before after : Store} {value : RVal} {decl : FnDef}
+    {allowance : OwnershipAllowance}
+    (hdecl : ctx.decls address = some (.fn decl))
+    (harity : args.length = decl.arity)
+    (hbody : CodeOwnershipRunCost ctx fuel decl before args.reverse decl.body
+      after value allowance)
+    (hresult : checkResultWorld decl.result (after, value) =
+      .ok (after, value)) :
+    InvokeOwnershipRunCost ctx (fuel + 1) address args before after value
+      allowance := by
+  refine ⟨hbody.startOrder, ?_, ?_, hbody.growth⟩
+  · simpa using hbody.envBounds.reverse
+  · rw [invoke.eq_def]
+    dsimp only
+    simp only [hdecl]
+    have hbne : (args.length != decl.arity) = false := by
+      simp [harity]
+    rw [hbne]
+    simp only [Bool.false_eq_true, if_false]
+    rw [hbody.run, bindOk]
+    exact hresult
+
+/-- A scalar extern invocation leaves ownership cost unchanged. -/
+theorem InvokeOwnershipRunCost.extern
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address} {args : List RVal}
+    {store : Store} {value : RVal} {arity : Nat}
+    (horder : AllocationOrderInvariant store)
+    (hargs : ValuesInBounds store args)
+    (hdecl : ctx.decls address = some (.extern arity))
+    (harity : args.length = arity)
+    (hcall : callScalarOracle ctx address args = .ok value) :
+    InvokeOwnershipRunCost ctx (fuel + 1) address args store store value
+      ⟨0, 0⟩ := by
+  refine ⟨horder, hargs, ?_, OwnershipGrowthLE.refl store⟩
+  simp [invoke, hdecl, harity, hcall]
+
+/-- Direct calls consume the exact run-indexed callee certificate. -/
+theorem OpOwnershipRunCost.call
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {address : Ixon.Address} {atoms : Array Atom}
+    {args : List RVal} {value : RVal} {allowance : OwnershipAllowance}
+    (henv : ValuesInBounds before env)
+    (hresolve : resolveAtoms env atoms = .ok args)
+    (hinvoke : InvokeOwnershipRunCost ctx fuel address args before after value
+      allowance) :
+    OpOwnershipRunCost ctx (fuel + 1) cur before env (.call address atoms)
+      after value allowance := by
+  refine ⟨hinvoke.startOrder, henv, ?_, hinvoke.growth⟩
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  exact hinvoke.run
+
+/-- Recursive self calls consume the exact smaller-fuel body certificate. -/
+theorem OpOwnershipRunCost.callSelf
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {atoms : Array Atom} {args : List RVal}
+    {value : RVal} {allowance : OwnershipAllowance}
+    (henv : ValuesInBounds before env)
+    (hresolve : resolveAtoms env atoms = .ok args)
+    (harity : args.length = cur.arity)
+    (hbody : CodeOwnershipRunCost ctx fuel cur before args.reverse cur.body
+      after value allowance)
+    (hresult : checkResultWorld cur.result (after, value) =
+      .ok (after, value)) :
+    OpOwnershipRunCost ctx (fuel + 1) cur before env (.callSelf atoms)
+      after value allowance := by
+  refine ⟨hbody.startOrder, henv, ?_, hbody.growth⟩
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  have hbne : (args.length != cur.arity) = false := by
+    simp [harity]
+  rw [hbne]
+  simp only [Bool.false_eq_true, if_false]
+  rw [hbody.run, bindOk]
+  exact hresult
+
+/-- Higher-order application consumes the exact `applyGo` certificate. -/
+theorem OpOwnershipRunCost.apply
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {functionAtom : Atom} {function value : RVal}
+    {atoms : Array Atom} {args : List RVal}
+    {allowance : OwnershipAllowance}
+    (henv : ValuesInBounds before env)
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hargs : resolveAtoms env atoms = .ok args)
+    (happly : ApplyOwnershipRunCost ctx fuel before function args after value
+      allowance) :
+    OpOwnershipRunCost ctx (fuel + 1) cur before env
+      (.apply functionAtom atoms) after value allowance := by
+  refine ⟨happly.startOrder, henv, ?_, happly.growth⟩
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hfunction, bindOk, hargs, bindOk]
+  exact happly.run
+
+/-- Applying an erased function only releases its supplied arguments; deep
+release is free in the amortized ownership measure. -/
+theorem ApplyOwnershipRunCost.erased
+    {ctx : Ctx} {fuel : Nat} {before after : Store} {args : List RVal}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hdrop : dropMany ctx fuel before args = .ok after) :
+    ApplyOwnershipRunCost ctx (fuel + 1) before .erased args after .erased
+      ⟨0, 0⟩ := by
+  refine ⟨horder, by trivial, hargs, ?_,
+    dropMany_ownership_growth horder hdrop⟩
+  rw [applyGo.eq_def]
+  dsimp only
+  rw [hdrop, bindOk]
+
+/-- Under-applying a PAP retains its captured prefix, releases the consumed
+PAP, and allocates one successor PAP. -/
+theorem ApplyOwnershipRunCost.papUnder
+    {ctx : Ctx} {fuel : Nat} {before duplicated ready : Store}
+    {location arity rc : Nat} {address : Ixon.Address}
+    {world : Ixon.Owned}
+    {captured : Array RVal} {args : List RVal}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hbox : before.get? location =
+      some ⟨world, rc, .papN address arity captured⟩)
+    (hdup : dupVals before captured.toList = .ok duplicated)
+    (hdrop : dropVal ctx fuel duplicated (.loc location) = .ok ready)
+    (hunder : (captured.toList ++ args).length < arity) :
+    ApplyOwnershipRunCost ctx (fuel + 1) before (.loc location) args
+      (ready.allocNode .shared
+        (.papN address arity (captured.toList ++ args).toArray)).1
+      (.loc (ready.allocNode .shared
+        (.papN address arity (captured.toList ++ args).toArray)).2)
+      ((retainedOwnershipAllowance captured.toList.length).add ⟨1, 1⟩) := by
+  have hdupGrowth := dupVals_ownership_growth hdup
+  have hduplicatedOrder := horder.dupVals hdup
+  have hdropGrowth := dropVal_ownership_growth hduplicatedOrder hdrop
+  have hgrowth := (hdupGrowth.trans hdropGrowth).trans
+    (OwnershipGrowthLE.allocNode ready .shared
+      (.papN address arity (captured.toList ++ args).toArray))
+  refine ⟨horder, RVal.inBounds_of_get? hbox, hargs, ?_, ?_⟩
+  · rw [applyGo.eq_def]
+    dsimp only
+    rw [hbox]
+    dsimp only
+    rw [hdup, bindOk, hdrop, bindOk]
+    simp only [hunder, if_true]
+  · simpa [OwnershipAllowance.add] using hgrowth
+
+/-- Exact PAP saturation pays only for retaining the captured prefix; the
+callee's dynamic allowance is supplied by its run-indexed invocation
+certificate. -/
+theorem ApplyOwnershipRunCost.papExact
+    {ctx : Ctx} {fuel : Nat} {before duplicated ready after : Store}
+    {location arity rc : Nat} {address : Ixon.Address}
+    {world : Ixon.Owned} {captured : Array RVal} {args : List RVal}
+    {value : RVal} {invokeAllowance : OwnershipAllowance}
+    {declaration : Decl}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hbox : before.get? location =
+      some ⟨world, rc, .papN address arity captured⟩)
+    (hdup : dupVals before captured.toList = .ok duplicated)
+    (hdrop : dropVal ctx fuel duplicated (.loc location) = .ok ready)
+    (hexact : (captured.toList ++ args).length = arity)
+    (hdecl : ctx.decls address = some declaration)
+    (hpapsafe : declPapSafe declaration = true)
+    (hinvoke : InvokeOwnershipRunCost ctx fuel address
+      (captured.toList ++ args) ready after value invokeAllowance) :
+    ApplyOwnershipRunCost ctx (fuel + 1) before (.loc location) args after
+      value
+      ((retainedOwnershipAllowance captured.toList.length).add
+        invokeAllowance) := by
+  have hdupGrowth := dupVals_ownership_growth hdup
+  have hduplicatedOrder := horder.dupVals hdup
+  have hdropGrowth := dropVal_ownership_growth hduplicatedOrder hdrop
+  have hgrowth := (hdupGrowth.trans hdropGrowth).trans hinvoke.growth
+  refine ⟨horder, RVal.inBounds_of_get? hbox, hargs, ?_, ?_⟩
+  · rw [applyGo.eq_def]
+    dsimp only
+    rw [hbox]
+    dsimp only
+    rw [hdup, bindOk, hdrop, bindOk]
+    have hunder : ¬(captured.toList ++ args).length < arity := by
+      omega
+    simp only [hunder, if_false]
+    rw [hdecl]
+    simp only [hpapsafe, if_true]
+    simpa [hexact] using hinvoke.run
+  · simpa [OwnershipAllowance.add] using hgrowth
+
+/-- PAP over-application composes prefix retains, the saturated invocation,
+and the recursive application of the remaining arguments.  Both recursive
+certificates are at the evaluator's strictly smaller fuel. -/
+theorem ApplyOwnershipRunCost.papOver
+    {ctx : Ctx} {fuel : Nat}
+    {before duplicated ready called after : Store}
+    {location arity rc : Nat} {address : Ixon.Address}
+    {world : Ixon.Owned} {captured : Array RVal} {args : List RVal}
+    {calledValue value : RVal} {declaration : Decl}
+    {invokeAllowance applyAllowance : OwnershipAllowance}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hbox : before.get? location =
+      some ⟨world, rc, .papN address arity captured⟩)
+    (hdup : dupVals before captured.toList = .ok duplicated)
+    (hdrop : dropVal ctx fuel duplicated (.loc location) = .ok ready)
+    (hover : arity < (captured.toList ++ args).length)
+    (hdecl : ctx.decls address = some declaration)
+    (hpapsafe : declPapSafe declaration = true)
+    (hinvoke : InvokeOwnershipRunCost ctx fuel address
+      ((captured.toList ++ args).take arity) ready called calledValue
+      invokeAllowance)
+    (happly : ApplyOwnershipRunCost ctx fuel called calledValue
+      ((captured.toList ++ args).drop arity) after value applyAllowance) :
+    ApplyOwnershipRunCost ctx (fuel + 1) before (.loc location) args after
+      value
+      (((retainedOwnershipAllowance captured.toList.length).add
+        invokeAllowance).add applyAllowance) := by
+  have hdupGrowth := dupVals_ownership_growth hdup
+  have hduplicatedOrder := horder.dupVals hdup
+  have hdropGrowth := dropVal_ownership_growth hduplicatedOrder hdrop
+  have hgrowth := ((hdupGrowth.trans hdropGrowth).trans hinvoke.growth).trans
+    happly.growth
+  refine ⟨horder, RVal.inBounds_of_get? hbox, hargs, ?_, ?_⟩
+  · rw [applyGo.eq_def]
+    dsimp only
+    rw [hbox]
+    dsimp only
+    rw [hdup, bindOk, hdrop, bindOk]
+    have hunder : ¬(captured.toList ++ args).length < arity := by
+      omega
+    have hne : (captured.toList ++ args).length ≠ arity := by
+      omega
+    simp only [hunder, if_false]
+    simp only [hne, beq_iff_eq, if_false]
+    rw [hdecl]
+    simp only [hpapsafe, if_true]
+    rw [hinvoke.run, bindOk]
+    exact happly.run
+  · simpa [OwnershipAllowance.add] using hgrowth
+
+/-- Per-event target charges.  This is the explicit, reviewable seam at which
+a compiler proof chooses how source events pay for target instructions. -/
+structure ProfileWeights where
+  eval : CostObservation
+  apply : CostObservation
+  saturation : CostObservation
+  constructor : CostObservation
+  closure : CostObservation
+  pap : CostObservation
+  recursor : CostObservation
+  extern : CostObservation
+  projection : CostObservation
+  /-- Charge per dynamically retained ownership candidate.  This is separate
+  from event counts because closure and PAP widths are unbounded. -/
+  retain : CostObservation
+  deriving BEq, Repr
+
+/-- A non-calibrated ownership-amortized tariff for the current lowerer.
+One dynamic source evaluation funds at most one heap-value lifetime, while a
+retained root funds a target `dup` and its eventual matching `drop`.  The
+definition is the stable statement of the intended local tariff; proving it
+for every successful compiler output remains an explicit lowering theorem,
+not an assumption hidden in this value. -/
+def ownershipAmortizedWeights : ProfileWeights :=
+  { eval := ⟨1, 0, 1, 2⟩
+    apply := ⟨0, 0, 0, 0⟩
+    saturation := ⟨0, 0, 0, 0⟩
+    constructor := ⟨0, 0, 0, 0⟩
+    closure := ⟨0, 0, 0, 0⟩
+    pap := ⟨0, 0, 0, 0⟩
+    recursor := ⟨0, 0, 0, 0⟩
+    extern := ⟨0, 0, 0, 0⟩
+    projection := ⟨0, 0, 0, 0⟩
+    retain := ⟨0, 0, 0, 2⟩ }
+
+/-- Paired charge made available by one dynamic source evaluation. -/
+def evalOwnershipAllowance : OwnershipAllowance := ⟨1, 2⟩
+
+/-- Paired charge made available by one dynamically retained root. -/
+def retainOwnershipAllowance : OwnershipAllowance := ⟨0, 2⟩
+
+/-- Projection of the public retain-aware tariff onto the paired resources
+tracked by compiler emitters. -/
+def sourceProfileOwnershipAllowance
+    (profile : SourceProfile) : OwnershipAllowance :=
+  { allocations := profile.evals
+    rcPotential := profile.retains * 2 + profile.evals * 2 }
+
+/-- Source-profile allowance is additive, so a profiled evaluator induction
+can compose the target contracts of its subtraces without reassociating the
+tariff by hand. -/
+theorem sourceProfileOwnershipAllowance_add
+    (left right : SourceProfile) :
+    sourceProfileOwnershipAllowance (left + right) =
+      (sourceProfileOwnershipAllowance left).add
+        (sourceProfileOwnershipAllowance right) := by
+  apply OwnershipAllowance.ext <;>
+    simp [sourceProfileOwnershipAllowance, OwnershipAllowance.add] <;>
+    omega
+
+@[simp] theorem sourceProfileOwnershipAllowance_retain (count : Nat) :
+    sourceProfileOwnershipAllowance (IxIR0.DynamicCost.retain count) =
+      retainedOwnershipAllowance count := by
+  simp [sourceProfileOwnershipAllowance, IxIR0.DynamicCost.retain,
+    retainedOwnershipAllowance, Nat.mul_comm]
+
+/-- Every source event carrying one evaluation tick projects to the same
+paired tariff; the other profile coordinates are intentionally irrelevant to
+this ownership projection. -/
+theorem sourceProfileOwnershipAllowance_tick_of_evals_eq_one
+    (event : IxIR0.DynamicCost.Event)
+    (heval : (IxIR0.DynamicCost.tick event).evals = 1) :
+    sourceProfileOwnershipAllowance (IxIR0.DynamicCost.tick event) =
+      evalOwnershipAllowance := by
+  cases event <;>
+    simp [IxIR0.DynamicCost.tick, sourceProfileOwnershipAllowance,
+      evalOwnershipAllowance] at heval ⊢
+
+theorem zeroOwnershipAllowance_le_profile (profile : SourceProfile) :
+    OwnershipAllowanceLE ⟨0, 0⟩
+      (sourceProfileOwnershipAllowance profile) := by
+  simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance]
+
+/-- Any nonempty source evaluation profile can fund one fresh target node.
+The public tariff supplies one allocation and two units of RC potential per
+source evaluation. -/
+theorem allocatedNodeAllowance_le_profile_of_evals_pos
+    {profile : SourceProfile} (hpos : 0 < profile.evals) :
+    OwnershipAllowanceLE ⟨1, 1⟩
+      (sourceProfileOwnershipAllowance profile) := by
+  simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance]
+  omega
+
+/-- A compiler difference-list emitter together with a paired allowance paid
+by a source-profile fragment.  This is the non-recursive primitive judgment
+composed by the source-trace lowering induction. -/
+def ProfileFundedEmitOwnershipCostSound (ctx : Ctx) (cur : FnDef)
+    (emit : Emit) (profile : SourceProfile) : Prop :=
+  ∃ allowance,
+    EmitOwnershipCostSound ctx cur emit allowance ∧
+    OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)
+
+theorem ProfileFundedEmitOwnershipCostSound.of_profile_eq
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {left right : SourceProfile}
+    (hcost : ProfileFundedEmitOwnershipCostSound ctx cur emit left)
+    (hprofile : left = right) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit right := by
+  subst right
+  exact hcost
+
+/-- A compiler emitter funded by one source fragment remains funded by any
+source fragment whose paired ownership projection is larger.  This is the
+transport used when lowering retains only the live subset of a source
+closure environment. -/
+theorem ProfileFundedEmitOwnershipCostSound.monoProfile
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {smaller larger : SourceProfile}
+    (hcost : ProfileFundedEmitOwnershipCostSound ctx cur emit smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit larger := by
+  obtain ⟨allowance, hcost, hfunded⟩ := hcost
+  exact ⟨allowance, hcost, hfunded.trans hle⟩
+
+/-- Profile-funded emitters compose in the same order as source-profile
+addition. -/
+theorem ProfileFundedEmitOwnershipCostSound.comp
+    {ctx : Ctx} {cur : FnDef} {leftEmit rightEmit : Emit}
+    {leftProfile rightProfile : SourceProfile}
+    (hleft : ProfileFundedEmitOwnershipCostSound ctx cur leftEmit
+      leftProfile)
+    (hright : ProfileFundedEmitOwnershipCostSound ctx cur rightEmit
+      rightProfile) :
+    ProfileFundedEmitOwnershipCostSound ctx cur (leftEmit ∘ rightEmit)
+      (leftProfile + rightProfile) := by
+  obtain ⟨leftAllowance, hleftCost, hleftFunded⟩ := hleft
+  obtain ⟨rightAllowance, hrightCost, hrightFunded⟩ := hright
+  refine ⟨leftAllowance.add rightAllowance,
+    EmitOwnershipCostSound.comp hleftCost hrightCost, ?_⟩
+  rw [sourceProfileOwnershipAllowance_add]
+  exact hleftFunded.add hrightFunded
+
+/-- A zero-cost compiler emitter may be assigned to any enclosing source
+profile fragment. -/
+theorem ProfileFundedEmitOwnershipCostSound.of_zero
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {profile : SourceProfile}
+    (hcost : EmitOwnershipCostSound ctx cur emit ⟨0, 0⟩) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit profile :=
+  ⟨⟨0, 0⟩, hcost, zeroOwnershipAllowance_le_profile profile⟩
+
+theorem ReleasePlan.profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {drops : List SlotDrop} {emit : Emit} {profile : SourceProfile}
+    (hplan : ReleasePlan input drops output emit) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit profile :=
+  ProfileFundedEmitOwnershipCostSound.of_zero
+    (Ix.Compiler.IxIR1.CostTrace.ReleasePlan.ownershipCostSound hplan)
+
+theorem FieldRetainPlan.profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.retain retains.length) := by
+  refine ⟨retainedOwnershipAllowance retains.length,
+    Ix.Compiler.IxIR1.CostTrace.FieldRetainPlan.ownershipCostSound hplan,
+    ?_⟩
+  rw [sourceProfileOwnershipAllowance_retain]
+  exact OwnershipAllowanceLE.refl _
+
+theorem releaseAll_profileFundedOwnershipCostSound
+    (ctx : Ctx) (cur : FnDef) (input : VEnv) (values : List AVal)
+    (profile : SourceProfile) :
+    ProfileFundedEmitOwnershipCostSound ctx cur
+      (releaseAll input values).2 profile :=
+  ProfileFundedEmitOwnershipCostSound.of_zero
+    (releaseAll_ownershipCostSound ctx cur input values)
+
+theorem lowerCapture_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {expr : IxIR0.Expr}
+    {input output : VEnv} {index : Nat} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.retain 1) := by
+  refine ⟨retainedOwnershipAllowance 1,
+    lowerCapture_ownershipCostSound hrun, ?_⟩
+  rw [sourceProfileOwnershipAllowance_retain]
+  exact OwnershipAllowanceLE.refl _
+
+theorem lowerCaptures_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} (expr : IxIR0.Expr) (captures : List Nat)
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.retain captures.length) := by
+  refine ⟨retainedOwnershipAllowance captures.length,
+    lowerCaptures_ownershipCostSound expr captures hrun, ?_⟩
+  rw [sourceProfileOwnershipAllowance_retain]
+  exact OwnershipAllowanceLE.refl _
+
+/-- A particular target code run together with evidence that its dynamic
+allowance is funded by the matching source profile.  This is the judgment the
+source evaluator induction composes. -/
+def ProfileFundedCodeRun (ctx : Ctx) (fuel : Nat) (cur : FnDef)
+    (before : Store) (env : List RVal) (code : Code) (after : Store)
+    (value : RVal) (profile : SourceProfile) : Prop :=
+  ∃ allowance,
+    CodeOwnershipRunCost ctx fuel cur before env code after value allowance ∧
+    OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)
+
+def ProfileFundedOpRun (ctx : Ctx) (fuel : Nat) (cur : FnDef)
+    (before : Store) (env : List RVal) (op : Op) (after : Store)
+    (value : RVal) (profile : SourceProfile) : Prop :=
+  ∃ allowance,
+    OpOwnershipRunCost ctx fuel cur before env op after value allowance ∧
+    OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)
+
+def ProfileFundedInvokeRun (ctx : Ctx) (fuel : Nat)
+    (address : Ixon.Address) (args : List RVal) (before after : Store)
+    (value : RVal) (profile : SourceProfile) : Prop :=
+  ∃ allowance,
+    InvokeOwnershipRunCost ctx fuel address args before after value allowance ∧
+    OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)
+
+def ProfileFundedApplyRun (ctx : Ctx) (fuel : Nat)
+    (before : Store) (function : RVal) (args : List RVal) (after : Store)
+    (value : RVal) (profile : SourceProfile) : Prop :=
+  ∃ allowance,
+    ApplyOwnershipRunCost ctx fuel before function args after value allowance ∧
+    OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)
+
+/-- A saturated residual-function invocation separates the target PAP's
+stored-prefix duplication from the core declaration run. The enclosing
+source application profile funds their sum without assigning the same
+source retain twice. -/
+def RetainedProfileFundedInvokeRun (ctx : Ctx) (fuel : Nat)
+    (address : Ixon.Address) (args : List RVal) (before after : Store)
+    (value : RVal) (reserve : Nat) (profile : SourceProfile) : Prop :=
+  ∃ invokeProfile,
+    ProfileFundedInvokeRun ctx fuel address args before after value
+      invokeProfile ∧
+    OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve + invokeProfile))
+      (sourceProfileOwnershipAllowance profile)
+
+/-- Universal, but run-indexed, cost soundness for one target code fragment.
+Each successful run may choose the allowance induced by its particular
+recursive source trace; every such allowance must fit the fixed profile
+given to this judgment. -/
+def ProfileFundedCodeCostSound (ctx : Ctx) (cur : FnDef)
+    (code : Code) (profile : SourceProfile) : Prop :=
+  ∀ {fuel before env after value},
+    AllocationOrderInvariant before →
+    ValuesInBounds before env →
+    runCode ctx fuel cur before env code = .ok (after, value) →
+    ProfileFundedCodeRun ctx fuel cur before env code after value profile
+
+/-- A profile-funded run-indexed code judgment can be conservatively viewed
+as an ordinary static code contract by choosing the complete projected
+source allowance for every successful run. -/
+theorem ProfileFundedCodeCostSound.toOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {code : Code} {profile : SourceProfile}
+    (hsound : ProfileFundedCodeCostSound ctx cur code profile) :
+    CodeOwnershipCostSound ctx cur code
+      (sourceProfileOwnershipAllowance profile) := by
+  intro fuel before env after value horder henv hrun
+  obtain ⟨allowance, hcost, hfunded⟩ :=
+    hsound horder henv hrun
+  obtain ⟨hfinalOrder, hvalue⟩ := hcost.finalOrderAndValue
+  exact ⟨hfinalOrder, hvalue, hcost.growth.monoAllowance hfunded⟩
+
+/-- Any ordinary code contract whose allowance is profile-funded supplies
+the corresponding universal run-indexed judgment. -/
+theorem ProfileFundedCodeCostSound.of_static
+    {ctx : Ctx} {cur : FnDef} {code : Code}
+    {allowance : OwnershipAllowance} {profile : SourceProfile}
+    (hsound : CodeOwnershipCostSound ctx cur code allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)) :
+    ProfileFundedCodeCostSound ctx cur code profile := by
+  intro fuel before env after value horder henv hrun
+  exact ⟨allowance,
+    CodeOwnershipCostSound.runCost hsound horder henv hrun,
+    hfunded⟩
+
+theorem ProfileFundedCodeCostSound.of_profile_eq
+    {ctx : Ctx} {cur : FnDef} {code : Code}
+    {left right : SourceProfile}
+    (hsound : ProfileFundedCodeCostSound ctx cur code left)
+    (hprofile : left = right) :
+    ProfileFundedCodeCostSound ctx cur code right := by
+  subst right
+  exact hsound
+
+theorem ProfileFundedCodeCostSound.monoProfile
+    {ctx : Ctx} {cur : FnDef} {code : Code}
+    {smaller larger : SourceProfile}
+    (hsound : ProfileFundedCodeCostSound ctx cur code smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedCodeCostSound ctx cur code larger := by
+  intro fuel before env after value horder henv hrun
+  obtain ⟨allowance, hcost, hfunded⟩ :=
+    hsound horder henv hrun
+  exact ⟨allowance, hcost, hfunded.trans hle⟩
+
+/-- Return code is ownership-free and may therefore close any available
+source fragment. -/
+theorem ProfileFundedCodeCostSound.ret
+    {ctx : Ctx} {cur : FnDef} (atom : Atom) (profile : SourceProfile) :
+    ProfileFundedCodeCostSound ctx cur (.ret atom) profile :=
+  ProfileFundedCodeCostSound.of_static
+    (CodeOwnershipCostSound.ret atom)
+    (zeroOwnershipAllowance_le_profile profile)
+
+/-- Prepend a statically certified local emitter to a continuation whose
+cost is run-indexed.  The continuation can be converted to one conservative
+static allowance because its fixed source profile bounds every particular
+run; the local emitter contract can then be applied without losing the
+dynamic recursive boundary. -/
+theorem ProfileFundedEmitOwnershipCostSound.prepend
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {continuation : Code}
+    {emitProfile continuationProfile : SourceProfile}
+    (hemit : ProfileFundedEmitOwnershipCostSound ctx cur emit emitProfile)
+    (hcontinuation : ProfileFundedCodeCostSound ctx cur continuation
+      continuationProfile) :
+    ProfileFundedCodeCostSound ctx cur (emit continuation)
+      (emitProfile + continuationProfile) := by
+  obtain ⟨emitAllowance, hemitStatic, hemitFunded⟩ := hemit
+  have hcontinuationStatic : CodeOwnershipCostSound ctx cur continuation
+      (sourceProfileOwnershipAllowance continuationProfile) :=
+    ProfileFundedCodeCostSound.toOwnershipCostSound hcontinuation
+  have hcodeStatic : CodeOwnershipCostSound ctx cur (emit continuation)
+      (emitAllowance.add
+        (sourceProfileOwnershipAllowance continuationProfile)) :=
+    hemitStatic hcontinuationStatic
+  apply ProfileFundedCodeCostSound.of_static hcodeStatic
+  rw [sourceProfileOwnershipAllowance_add]
+  exact hemitFunded.add (OwnershipAllowanceLE.refl _)
+
+/-- Seal a profile-funded local emitter with a return. -/
+theorem ProfileFundedEmitOwnershipCostSound.closeRet
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {profile : SourceProfile}
+    (hemit : ProfileFundedEmitOwnershipCostSound ctx cur emit profile)
+    (atom : Atom) :
+    ProfileFundedCodeCostSound ctx cur (emit (.ret atom)) profile := by
+  exact ProfileFundedCodeCostSound.of_profile_eq
+    (hemit.prepend (ProfileFundedCodeCostSound.ret atom 0))
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+
+/-- Profile equality is a harmless transport for funded run certificates;
+this is useful because source profiles form a commutative additive summary
+while target execution is sequenced. -/
+theorem ProfileFundedCodeRun.of_profile_eq
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {code : Code} {value : RVal}
+    {left right : SourceProfile}
+    (hcost : ProfileFundedCodeRun ctx fuel cur before env code after value
+      left)
+    (hprofile : left = right) :
+    ProfileFundedCodeRun ctx fuel cur before env code after value right := by
+  subst right
+  exact hcost
+
+theorem ProfileFundedCodeRun.monoProfile
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {code : Code} {value : RVal}
+    {smaller larger : SourceProfile}
+    (hcost : ProfileFundedCodeRun ctx fuel cur before env code after value
+      smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedCodeRun ctx fuel cur before env code after value larger := by
+  obtain ⟨allowance, hrunCost, hfunded⟩ := hcost
+  exact ⟨allowance, hrunCost, hfunded.trans hle⟩
+
+/-- Source-profile counterpart of target `letOp` sequencing. -/
+theorem ProfileFundedCodeRun.letOp
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before middle after : Store}
+    {env : List RVal} {op : Op} {opValue value : RVal} {rest : Code}
+    {opProfile restProfile : SourceProfile}
+    (hop : ProfileFundedOpRun ctx fuel cur before env op middle opValue
+      opProfile)
+    (hrest : ProfileFundedCodeRun ctx fuel cur middle (opValue :: env) rest
+      after value restProfile) :
+    ProfileFundedCodeRun ctx (fuel + 1) cur before env (.letOp op rest)
+      after value (opProfile + restProfile) := by
+  obtain ⟨opAllowance, hopCost, hopFunded⟩ := hop
+  obtain ⟨restAllowance, hrestCost, hrestFunded⟩ := hrest
+  refine ⟨opAllowance.add restAllowance,
+    CodeOwnershipRunCost.letOp hopCost hrestCost, ?_⟩
+  rw [sourceProfileOwnershipAllowance_add]
+  exact hopFunded.add hrestFunded
+
+/-- Dynamic continuation transformer for a compiler difference-list
+emitter.  Unlike the uniform static emitter interface, the continuation
+certificate is requested only for the exact sub-run reached after executing
+this prefix.  Recursive calls may therefore carry the profile of that
+particular source trace. -/
+def ProfileFundedEmitRunSound (ctx : Ctx) (cur : FnDef)
+    (emit : Emit) (emitProfile : SourceProfile) : Prop :=
+  ∀ {continuation : Code} {continuationProfile : SourceProfile}
+      {fuel : Nat} {before after : Store} {env : List RVal}
+      {value : RVal},
+    AllocationOrderInvariant before →
+    ValuesInBounds before env →
+    runCode ctx fuel cur before env (emit continuation) =
+      .ok (after, value) →
+    (∀ {restFuel : Nat} {restBefore : Store} {restEnv : List RVal},
+      AllocationOrderInvariant restBefore →
+      ValuesInBounds restBefore restEnv →
+      runCode ctx restFuel cur restBefore restEnv continuation =
+        .ok (after, value) →
+      ProfileFundedCodeRun ctx restFuel cur restBefore restEnv continuation
+        after value continuationProfile) →
+    ProfileFundedCodeRun ctx fuel cur before env (emit continuation)
+      after value (emitProfile + continuationProfile)
+
+theorem ProfileFundedEmitRunSound.of_profile_eq
+    {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {left right : SourceProfile}
+    (hsound : ProfileFundedEmitRunSound ctx cur emit left)
+    (hprofile : left = right) :
+    ProfileFundedEmitRunSound ctx cur emit right := by
+  subst right
+  exact hsound
+
+theorem ProfileFundedEmitRunSound.id {ctx : Ctx} {cur : FnDef} :
+    ProfileFundedEmitRunSound ctx cur (_root_.id : Emit) 0 := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hrun hcontinuation
+  exact ProfileFundedCodeRun.of_profile_eq
+    (hcontinuation horder henv hrun)
+    (IxIR0.DynamicCost.Profile.zero_add continuationProfile).symm
+
+/-- Lift any run-indexed operation producer through the compiler's one-op
+difference-list emitter.  Recursive call and application producers use this
+rule; the local table is one specialization below. -/
+theorem ProfileFundedEmitRunSound.ofOp
+    {ctx : Ctx} {cur : FnDef} {op : Op} {profile : SourceProfile}
+    (hop : ∀ {fuel : Nat} {before after : Store} {env : List RVal}
+      {value : RVal},
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      runOp ctx fuel cur before env op = .ok (after, value) →
+      ProfileFundedOpRun ctx fuel cur before env op after value profile) :
+    ProfileFundedEmitRunSound ctx cur (emitOp op) profile := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hrun hcontinuation
+  cases fuel with
+  | zero =>
+      simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only [emitOp] at hrun
+      cases hopRun : runOp ctx fuel cur before env op with
+      | error err =>
+          rw [hopRun] at hrun
+          contradiction
+      | ok result =>
+          rcases result with ⟨middle, opValue⟩
+          rw [hopRun] at hrun
+          change runCode ctx fuel cur middle (opValue :: env) continuation =
+            .ok (after, value) at hrun
+          obtain ⟨opAllowance, hopRunCost, hopFunded⟩ :=
+            hop horder henv hopRun
+          obtain ⟨hmiddleOrder, hopValue⟩ :=
+            hopRunCost.finalOrderAndValue
+          have hmiddleEnv : ValuesInBounds middle (opValue :: env) :=
+            (henv.mono (runOp_footprint hopRun).nodes_size).cons hopValue
+          exact ProfileFundedCodeRun.letOp
+            ⟨opAllowance, hopRunCost, hopFunded⟩
+            (hcontinuation hmiddleOrder hmiddleEnv hrun)
+
+/-- One classified non-recursive operation is a dynamic emitter prefix.
+Its target run is inverted once, then the exact reached continuation run is
+passed to the recursive callback. -/
+theorem ProfileFundedEmitRunSound.localOp
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    {allowance : OwnershipAllowance} {profile : SourceProfile}
+    (hlocal : localOpOwnershipAllowance op = some allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)) :
+    ProfileFundedEmitRunSound ctx cur (emitOp op) profile := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hrun hcontinuation
+  cases fuel with
+  | zero =>
+      simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only [emitOp] at hrun
+      cases hopRun : runOp ctx fuel cur before env op with
+      | error err =>
+          rw [hopRun] at hrun
+          contradiction
+      | ok result =>
+          rcases result with ⟨middle, opValue⟩
+          rw [hopRun] at hrun
+          change runCode ctx fuel cur middle (opValue :: env) continuation =
+            .ok (after, value) at hrun
+          obtain ⟨hmiddleOrder, hmiddleEnv, hopGrowth⟩ :=
+            (OpOwnershipCostSound.of_local hlocal) horder henv hopRun
+          have hopCost : ProfileFundedOpRun ctx fuel cur before env op
+              middle opValue profile :=
+            ⟨allowance, ⟨horder, henv, hopRun, hopGrowth⟩, hfunded⟩
+          exact ProfileFundedCodeRun.letOp hopCost
+            (hcontinuation hmiddleOrder hmiddleEnv hrun)
+
+theorem ProfileFundedEmitRunSound.monoProfile
+    {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {smaller larger : SourceProfile}
+    (hsound : ProfileFundedEmitRunSound ctx cur emit smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedEmitRunSound ctx cur emit larger := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hrun hcontinuation
+  have hcost := hsound horder henv hrun hcontinuation
+  apply hcost.monoProfile
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_add]
+  exact hle.add (OwnershipAllowanceLE.refl _)
+
+/-- Dynamic emitter transformers compose without requiring a static bound
+for the recursively executed continuation. -/
+theorem ProfileFundedEmitRunSound.comp
+    {ctx : Ctx} {cur : FnDef} {first second : Emit}
+    {firstProfile secondProfile : SourceProfile}
+    (hfirst : ProfileFundedEmitRunSound ctx cur first firstProfile)
+    (hsecond : ProfileFundedEmitRunSound ctx cur second secondProfile) :
+    ProfileFundedEmitRunSound ctx cur (first ∘ second)
+      (firstProfile + secondProfile) := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hrun hcontinuation
+  have hcost := hfirst horder henv hrun (by
+    intro restFuel restBefore restEnv hrestOrder hrestEnv hrestRun
+    exact hsecond hrestOrder hrestEnv hrestRun hcontinuation)
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Close a dynamic emitter transformer with the ownership-free return
+continuation. -/
+theorem ProfileFundedEmitRunSound.closeRet
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {profile : SourceProfile}
+    (hemit : ProfileFundedEmitRunSound ctx cur emit profile)
+    (atom : Atom) {fuel : Nat} {before after : Store} {env : List RVal}
+    {value : RVal}
+    (horder : AllocationOrderInvariant before)
+    (henv : ValuesInBounds before env)
+    (hrun : runCode ctx fuel cur before env (emit (.ret atom)) =
+      .ok (after, value)) :
+    ProfileFundedCodeRun ctx fuel cur before env (emit (.ret atom)) after
+      value profile := by
+  have hcost := hemit horder henv hrun (by
+    intro restFuel restBefore restEnv hrestOrder hrestEnv hrestRun
+    exact ⟨⟨0, 0⟩,
+      CodeOwnershipCostSound.runCost (CodeOwnershipCostSound.ret atom)
+        hrestOrder hrestEnv hrestRun,
+      zeroOwnershipAllowance_le_profile 0⟩)
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+
+/-- State-indexed dynamic emitter transformer used by the source/target
+cost simulation.  The universal `ProfileFundedEmitRunSound` above is ideal
+for local prefixes, but a recursive operation can only be bounded by one
+particular source trace when its runtime state represents that source state.
+This judgment carries precisely that `pre`/`mid` relation through the exact
+continuation run reached by the prefix. -/
+def ProfileFundedEmitStateRunSound (ctx : Ctx) (cur : FnDef)
+    (emit : Emit) (pre mid : StatePred) (emitProfile : SourceProfile) :
+    Prop :=
+  ∀ {continuation : Code} {continuationProfile : SourceProfile}
+      {fuel : Nat} {before after : Store} {env : List RVal}
+      {value : RVal},
+    AllocationOrderInvariant before →
+    ValuesInBounds before env →
+    pre before env →
+    runCode ctx fuel cur before env (emit continuation) =
+      .ok (after, value) →
+    (∀ {restFuel : Nat} {restBefore : Store} {restEnv : List RVal},
+      AllocationOrderInvariant restBefore →
+      ValuesInBounds restBefore restEnv →
+      mid restBefore restEnv →
+      runCode ctx restFuel cur restBefore restEnv continuation =
+        .ok (after, value) →
+      ProfileFundedCodeRun ctx restFuel cur restBefore restEnv continuation
+        after value continuationProfile) →
+    ProfileFundedCodeRun ctx fuel cur before env (emit continuation)
+      after value (emitProfile + continuationProfile)
+
+theorem ProfileFundedEmitStateRunSound.of_profile_eq
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {pre mid : StatePred}
+    {left right : SourceProfile}
+    (hsound : ProfileFundedEmitStateRunSound ctx cur emit pre mid left)
+    (hprofile : left = right) :
+    ProfileFundedEmitStateRunSound ctx cur emit pre mid right := by
+  subst right
+  exact hsound
+
+/-- The identity prefix transports any state implication without spending
+source allowance. -/
+theorem ProfileFundedEmitStateRunSound.id
+    {ctx : Ctx} {cur : FnDef} {pre mid : StatePred}
+    (himp : ∀ {store env}, pre store env → mid store env) :
+    ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit) pre mid 0 := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact ProfileFundedCodeRun.of_profile_eq
+    (hcontinuation horder henv (himp hpre) hrun)
+    (IxIR0.DynamicCost.Profile.zero_add continuationProfile).symm
+
+/-- An impossible indexed precondition validates any emitter and profile.
+This is the exact-run counterpart of `EmitSound.ofFalse`. -/
+theorem ProfileFundedEmitStateRunSound.ofFalse
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {mid : StatePred}
+    {profile : SourceProfile} :
+    ProfileFundedEmitStateRunSound ctx cur emit (fun _ _ => False) mid
+      profile := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hfalse hrun hcontinuation
+  exact hfalse.elim
+
+theorem ProfileFundedEmitStateRunSound.monoProfile
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {pre mid : StatePred}
+    {smaller larger : SourceProfile}
+    (hsound : ProfileFundedEmitStateRunSound ctx cur emit pre mid smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedEmitStateRunSound ctx cur emit pre mid larger := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  have hcost := hsound horder henv hpre hrun hcontinuation
+  apply hcost.monoProfile
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_add]
+  exact hle.add (OwnershipAllowanceLE.refl _)
+
+/-- State-indexed dynamic emitter transformers compose, passing the exact
+intermediate state relation to the second transformer. -/
+theorem ProfileFundedEmitStateRunSound.comp
+    {ctx : Ctx} {cur : FnDef} {first second : Emit}
+    {pre middle post : StatePred}
+    {firstProfile secondProfile : SourceProfile}
+    (hfirst : ProfileFundedEmitStateRunSound ctx cur first pre middle
+      firstProfile)
+    (hsecond : ProfileFundedEmitStateRunSound ctx cur second middle post
+      secondProfile) :
+    ProfileFundedEmitStateRunSound ctx cur (first ∘ second) pre post
+      (firstProfile + secondProfile) := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  have hcost := hfirst horder henv hpre hrun (by
+    intro restFuel restBefore restEnv hrestOrder hrestEnv hmiddle hrestRun
+    exact hsecond hrestOrder hrestEnv hmiddle hrestRun hcontinuation)
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Lift an exact operation producer that establishes both the semantic
+midpoint and the source-funded paired operation cost. -/
+theorem ProfileFundedEmitStateRunSound.ofOp
+    {ctx : Ctx} {cur : FnDef} {op : Op} {pre mid : StatePred}
+    {profile : SourceProfile}
+    (hop : ∀ {fuel : Nat} {before after : Store} {env : List RVal}
+      {value : RVal},
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      pre before env →
+      runOp ctx fuel cur before env op = .ok (after, value) →
+      mid after (value :: env) ∧
+        ProfileFundedOpRun ctx fuel cur before env op after value profile) :
+    ProfileFundedEmitStateRunSound ctx cur (emitOp op) pre mid profile := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  cases fuel with
+  | zero =>
+      simp [runCode] at hrun
+  | succ fuel =>
+      rw [runCode.eq_def] at hrun
+      dsimp only [emitOp] at hrun
+      cases hopRun : runOp ctx fuel cur before env op with
+      | error err =>
+          rw [hopRun] at hrun
+          contradiction
+      | ok result =>
+          rcases result with ⟨middleStore, opValue⟩
+          rw [hopRun] at hrun
+          change runCode ctx fuel cur middleStore (opValue :: env)
+            continuation = .ok (after, value) at hrun
+          obtain ⟨hmiddle, opAllowance, hopRunCost, hopFunded⟩ :=
+            hop horder henv hpre hopRun
+          obtain ⟨hmiddleOrder, hopValue⟩ :=
+            hopRunCost.finalOrderAndValue
+          have hmiddleEnv : ValuesInBounds middleStore (opValue :: env) :=
+            (henv.mono (runOp_footprint hopRun).nodes_size).cons hopValue
+          exact ProfileFundedCodeRun.letOp
+            ⟨opAllowance, hopRunCost, hopFunded⟩
+            (hcontinuation hmiddleOrder hmiddleEnv hmiddle hrun)
+
+/-- Local primitive specialization of the state-indexed operation rule. -/
+theorem ProfileFundedEmitStateRunSound.localOp
+    {ctx : Ctx} {cur : FnDef} {op : Op} {pre mid : StatePred}
+    {allowance : OwnershipAllowance} {profile : SourceProfile}
+    (hsemantic : OpSound ctx cur op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)) :
+    ProfileFundedEmitStateRunSound ctx cur (emitOp op) pre mid profile := by
+  apply ProfileFundedEmitStateRunSound.ofOp
+  intro fuel before after env value horder henv hpre hrun
+  obtain ⟨_, _, hgrowth⟩ :=
+    (OpOwnershipCostSound.of_local hlocal) horder henv hrun
+  exact ⟨hsemantic hpre hrun, allowance,
+    ⟨horder, henv, hrun, hgrowth⟩, hfunded⟩
+
+/-- A semantically indexed zero-cost primitive may be funded by any source
+profile fragment. -/
+theorem ProfileFundedEmitStateRunSound.localZero
+    {ctx : Ctx} {cur : FnDef} {op : Op} {pre mid : StatePred}
+    {profile : SourceProfile}
+    (hsemantic : OpSound ctx cur op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitStateRunSound ctx cur (emitOp op) pre mid profile :=
+  ProfileFundedEmitStateRunSound.localOp hsemantic hlocal
+    (zeroOwnershipAllowance_le_profile profile)
+
+/-- A semantically indexed retain primitive consumes one source retain
+candidate. -/
+theorem ProfileFundedEmitStateRunSound.localRetain
+    {ctx : Ctx} {cur : FnDef} {op : Op} {pre mid : StatePred}
+    (hsemantic : OpSound ctx cur op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 2⟩) :
+    ProfileFundedEmitStateRunSound ctx cur (emitOp op) pre mid
+      (IxIR0.DynamicCost.retain 1) := by
+  apply ProfileFundedEmitStateRunSound.localOp hsemantic hlocal
+  rw [sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, retainedOwnershipAllowance]
+
+/-- Close a state-indexed emitter with the ownership-free return
+continuation. -/
+theorem ProfileFundedEmitStateRunSound.closeRet
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {pre mid : StatePred}
+    {profile : SourceProfile}
+    (hemit : ProfileFundedEmitStateRunSound ctx cur emit pre mid profile)
+    (atom : Atom) {fuel : Nat} {before after : Store} {env : List RVal}
+    {value : RVal}
+    (horder : AllocationOrderInvariant before)
+    (henv : ValuesInBounds before env)
+    (hpre : pre before env)
+    (hrun : runCode ctx fuel cur before env (emit (.ret atom)) =
+      .ok (after, value)) :
+    ProfileFundedCodeRun ctx fuel cur before env (emit (.ret atom)) after
+      value profile := by
+  have hcost := hemit horder henv hpre hrun (by
+    intro restFuel restBefore restEnv hrestOrder hrestEnv _ hrestRun
+    exact ⟨⟨0, 0⟩,
+      CodeOwnershipCostSound.runCost (CodeOwnershipCostSound.ret atom)
+        hrestOrder hrestEnv hrestRun,
+      zeroOwnershipAllowance_le_profile 0⟩)
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+
+/-! ### Fuel-bounded state-indexed profile transformers -/
+
+/-- Contractive counterpart of `ProfileFundedEmitStateRunSound`.  The
+complete emitted-code run and every continuation run are restricted to the
+same target evaluator bound.  Unfolding one `runCode` step therefore exposes
+an operation at a strictly smaller index, exactly matching
+`CompilerProfileContractsBelow`. -/
+def ProfileFundedEmitStateRunSoundBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (emit : Emit) (pre mid : StatePred)
+    (emitProfile : SourceProfile) : Prop :=
+  ∀ bound, bound ≤ limit →
+    ∀ {continuation : Code} {continuationProfile : SourceProfile}
+        {fuel : Nat} {before after : Store} {env : List RVal}
+        {value : RVal},
+      fuel ≤ bound →
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      pre before env →
+      runCode ctx fuel cur before env (emit continuation) =
+        .ok (after, value) →
+      (∀ {restFuel : Nat} {restBefore : Store} {restEnv : List RVal},
+        restFuel ≤ bound →
+        AllocationOrderInvariant restBefore →
+        ValuesInBounds restBefore restEnv →
+        mid restBefore restEnv →
+        runCode ctx restFuel cur restBefore restEnv continuation =
+          .ok (after, value) →
+        ProfileFundedCodeRun ctx restFuel cur restBefore restEnv continuation
+          after value continuationProfile) →
+      ProfileFundedCodeRun ctx fuel cur before env (emit continuation)
+        after value (emitProfile + continuationProfile)
+
+/-- Uniform bounded transformers recover the unbounded interface. -/
+theorem ProfileFundedEmitStateRunSound.of_below
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {pre mid : StatePred}
+    {profile : SourceProfile}
+    (hsound : ∀ limit,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit emit pre mid
+        profile) :
+    ProfileFundedEmitStateRunSound ctx cur emit pre mid profile := by
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact (hsound fuel) fuel (Nat.le_refl _) (Nat.le_refl _) horder henv hpre
+    hrun (by
+      intro restFuel restBefore restEnv _ hrestOrder hrestEnv hmid hrestRun
+      exact hcontinuation hrestOrder hrestEnv hmid hrestRun)
+
+theorem ProfileFundedEmitStateRunSoundBelow.mono
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {pre mid : StatePred}
+    {profile : SourceProfile} {smaller larger : Nat}
+    (hsound : ProfileFundedEmitStateRunSoundBelow ctx cur larger emit pre
+      mid profile)
+    (hbound : smaller ≤ larger) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur smaller emit pre mid
+      profile := by
+  intro bound hsmall continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  exact hsound bound (Nat.le_trans hsmall hbound) hfuel horder henv hpre
+    hrun hcontinuation
+
+theorem ProfileFundedEmitStateRunSoundBelow.of_profile_eq
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {emit : Emit}
+    {pre mid : StatePred} {left right : SourceProfile}
+    (hsound : ProfileFundedEmitStateRunSoundBelow ctx cur limit emit pre mid
+      left)
+    (hprofile : left = right) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit pre mid right := by
+  subst right
+  exact hsound
+
+theorem ProfileFundedEmitStateRunSoundBelow.monoProfile
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {emit : Emit}
+    {pre mid : StatePred} {smaller larger : SourceProfile}
+    (hsound : ProfileFundedEmitStateRunSoundBelow ctx cur limit emit pre mid
+      smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit pre mid larger :=
+  by
+    intro bound hbound continuation continuationProfile fuel before after
+      env value hfuel horder henv hpre hrun hcontinuation
+    have hcost := hsound bound hbound hfuel horder henv hpre hrun
+      hcontinuation
+    apply hcost.monoProfile
+    rw [sourceProfileOwnershipAllowance_add,
+      sourceProfileOwnershipAllowance_add]
+    exact hle.add (OwnershipAllowanceLE.refl _)
+
+/-- The identity prefix transports an indexed state implication at every
+bounded fuel. -/
+theorem ProfileFundedEmitStateRunSoundBelow.id
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {pre mid : StatePred}
+    (himp : ∀ {store env}, pre store env → mid store env) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+      pre mid 0 := by
+  intro bound _ continuation continuationProfile fuel before after env value
+    hfuel horder henv hpre hrun hcontinuation
+  exact ProfileFundedCodeRun.of_profile_eq
+    (hcontinuation hfuel horder henv (himp hpre) hrun)
+    (IxIR0.DynamicCost.Profile.zero_add continuationProfile).symm
+
+/-- An impossible indexed precondition validates every bounded prefix. -/
+theorem ProfileFundedEmitStateRunSoundBelow.ofFalse
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {emit : Emit}
+    {mid : StatePred} {profile : SourceProfile} :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+      (fun _ _ => False) mid profile := by
+  intro bound _ continuation continuationProfile fuel before after env value
+    hfuel horder henv hfalse hrun hcontinuation
+  exact hfalse.elim
+
+/-- Bounded state-indexed profile transformers compose at a common target
+fuel ceiling. -/
+theorem ProfileFundedEmitStateRunSoundBelow.comp
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {first second : Emit}
+    {pre middle post : StatePred}
+    {firstProfile secondProfile : SourceProfile}
+    (hfirst : ProfileFundedEmitStateRunSoundBelow ctx cur limit first pre
+      middle firstProfile)
+    (hsecond : ProfileFundedEmitStateRunSoundBelow ctx cur limit second
+      middle post secondProfile) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (first ∘ second) pre
+      post (firstProfile + secondProfile) := by
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  have hcost := hfirst bound hbound hfuel horder henv hpre hrun (by
+    intro restFuel restBefore restEnv hrestFuel hrestOrder hrestEnv hmiddle
+      hrestRun
+    exact hsecond bound hbound hrestFuel hrestOrder hrestEnv hmiddle
+      hrestRun hcontinuation)
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Bounded operation bridge.  A successful enclosing `letOp` run at or
+below `limit` executes its operation strictly below `limit`. -/
+theorem ProfileFundedEmitStateRunSoundBelow.ofOp
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred} {profile : SourceProfile}
+    (hop : ∀ {fuel : Nat} {before after : Store} {env : List RVal}
+      {value : RVal},
+      fuel < limit →
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      pre before env →
+      runOp ctx fuel cur before env op = .ok (after, value) →
+      mid after (value :: env) ∧
+        ProfileFundedOpRun ctx fuel cur before env op after value profile) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      profile := by
+  intro bound hbound continuation continuationProfile outerFuel before
+    after env value houter horder henv hpre hrun hcontinuation
+  cases outerFuel with
+  | zero =>
+      simp [runCode] at hrun
+  | succ fuel =>
+      have hfuelBound : fuel < bound := by omega
+      have hfuel : fuel < limit := Nat.lt_of_lt_of_le hfuelBound hbound
+      rw [runCode.eq_def] at hrun
+      dsimp only [emitOp] at hrun
+      cases hopRun : runOp ctx fuel cur before env op with
+      | error err =>
+          rw [hopRun] at hrun
+          contradiction
+      | ok result =>
+          rcases result with ⟨middleStore, opValue⟩
+          rw [hopRun] at hrun
+          change runCode ctx fuel cur middleStore (opValue :: env)
+            continuation = .ok (after, value) at hrun
+          obtain ⟨hmiddle, opAllowance, hopRunCost, hopFunded⟩ :=
+            hop hfuel horder henv hpre hopRun
+          obtain ⟨hmiddleOrder, hopValue⟩ :=
+            hopRunCost.finalOrderAndValue
+          have hmiddleEnv : ValuesInBounds middleStore (opValue :: env) :=
+            (henv.mono (runOp_footprint hopRun).nodes_size).cons hopValue
+          exact ProfileFundedCodeRun.letOp
+            ⟨opAllowance, hopRunCost, hopFunded⟩
+            (hcontinuation (Nat.le_of_lt hfuelBound) hmiddleOrder hmiddleEnv
+              hmiddle hrun)
+
+/-- A semantically indexed local operation lifts through the bounded
+profile transformer using the same primitive allowance table. -/
+theorem ProfileFundedEmitStateRunSoundBelow.localOp
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred} {allowance : OwnershipAllowance}
+    {profile : SourceProfile}
+    (hsemantic : OpSound ctx cur op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.ofOp
+  intro fuel before after env value _ horder henv hpre hrun
+  obtain ⟨_, _, hgrowth⟩ :=
+    (OpOwnershipCostSound.of_local hlocal) horder henv hrun
+  exact ⟨hsemantic hpre hrun, allowance,
+    ⟨horder, henv, hrun, hgrowth⟩, hfunded⟩
+
+/-- Attach a local paired charge to an operation whose semantic contract is
+itself available only below the current evaluator bound.  This is the
+contractive bridge used by generated recursor prefixes. -/
+theorem ProfileFundedEmitStateRunSoundBelow.localOpBelow
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred} {allowance : OwnershipAllowance}
+    {profile : SourceProfile}
+    (hsemantic : OpSoundBelow ctx cur limit op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.ofOp
+  intro fuel before after env value hbound horder henv hpre hrun
+  obtain ⟨_, _, hgrowth⟩ :=
+    (OpOwnershipCostSound.of_local hlocal) horder henv hrun
+  exact ⟨hsemantic hbound hpre hrun, allowance,
+    ⟨horder, henv, hrun, hgrowth⟩, hfunded⟩
+
+theorem ProfileFundedEmitStateRunSoundBelow.localZeroBelow
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred} {profile : SourceProfile}
+    (hsemantic : OpSoundBelow ctx cur limit op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      profile :=
+  ProfileFundedEmitStateRunSoundBelow.localOpBelow hsemantic hlocal
+    (zeroOwnershipAllowance_le_profile profile)
+
+theorem ProfileFundedEmitStateRunSoundBelow.localRetainBelow
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred}
+    (hsemantic : OpSoundBelow ctx cur limit op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 2⟩) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      (IxIR0.DynamicCost.retain 1) := by
+  apply ProfileFundedEmitStateRunSoundBelow.localOpBelow hsemantic hlocal
+  rw [sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, retainedOwnershipAllowance]
+
+theorem ProfileFundedEmitStateRunSoundBelow.localZero
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred} {profile : SourceProfile}
+    (hsemantic : OpSound ctx cur op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      profile :=
+  ProfileFundedEmitStateRunSoundBelow.localOp hsemantic hlocal
+    (zeroOwnershipAllowance_le_profile profile)
+
+theorem ProfileFundedEmitStateRunSoundBelow.localRetain
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op}
+    {pre mid : StatePred}
+    (hsemantic : OpSound ctx cur op pre mid)
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 2⟩) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op) pre mid
+      (IxIR0.DynamicCost.retain 1) := by
+  apply ProfileFundedEmitStateRunSoundBelow.localOp hsemantic hlocal
+  rw [sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, retainedOwnershipAllowance]
+
+/-- Close a bounded state transformer with the ownership-free return
+continuation. -/
+theorem ProfileFundedEmitStateRunSoundBelow.closeRet
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {emit : Emit}
+    {pre mid : StatePred} {profile : SourceProfile}
+    (hemit : ProfileFundedEmitStateRunSoundBelow ctx cur limit emit pre mid
+      profile)
+    (atom : Atom) {fuel : Nat} {before after : Store} {env : List RVal}
+    {value : RVal}
+    (hfuel : fuel ≤ limit)
+    (horder : AllocationOrderInvariant before)
+    (henv : ValuesInBounds before env)
+    (hpre : pre before env)
+    (hrun : runCode ctx fuel cur before env (emit (.ret atom)) =
+      .ok (after, value)) :
+    ProfileFundedCodeRun ctx fuel cur before env (emit (.ret atom)) after
+      value profile := by
+  have hcost := hemit limit (Nat.le_refl _) (by
+    exact hfuel) horder henv hpre hrun (by
+      intro restFuel restBefore restEnv _ hrestOrder hrestEnv _ hrestRun
+      exact ⟨⟨0, 0⟩,
+        CodeOwnershipCostSound.runCost (CodeOwnershipCostSound.ret atom)
+          hrestOrder hrestEnv hrestRun,
+        zeroOwnershipAllowance_le_profile 0⟩)
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+
+/-- Cost companion to `LowerResultValueSound`.  Its state predicates are
+the same graph-and-ownership boundary as the semantic theorem, preventing a
+single source trace from being applied to unrelated target inputs. -/
+structure LowerResultProfileSound
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (world : Ixon.Owned)
+    (emit : Emit) (av : AVal) (profile : SourceProfile) : Prop
+    extends LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest slots)
+      profile
+
+/-- State-indexed cost companion to `LowerBorrowValueSound`.  It records the
+same pending-owner convention as the semantic borrow judgment while funding
+the exact emitter prefix from the source expression profile. -/
+structure LowerBorrowProfileSound
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (emit : Emit) (av : AVal)
+    (release : Bool) (profile : SourceProfile) : Prop
+    extends LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue av release sourceRest rest slots)
+      profile
+
+theorem LowerBorrowProfileSound.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool} {left right : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue emit av release left)
+    (hprofile : left = right) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release right := by
+  subst right
+  exact hsound
+
+/-- State-indexed cost companion to semantic left-to-right argument
+lowering.  The single profile is the additive trace of the complete argument
+prefix. -/
+structure LowerArgsProfileSound
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (input output : VEnv)
+    (sourceInput sourceOutput sourceValues : List IxIR0.Value)
+    (worlds : List Ixon.Owned) (emit : Emit) (avs : List AVal)
+    (profile : SourceProfile) : Prop
+    extends LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues worlds avs sourceRest rest slots)
+      profile
+
+/-! ### Fuel-bounded semantic/profile lowering results -/
+
+/-- A semantic lowering result whose profile transformer is valid through
+one target evaluator bound.  The semantic component remains unbounded: value
+contracts are sealed independently before the cost-contract fixed point. -/
+structure LowerResultProfileSoundBelow
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (world : Ixon.Owned)
+    (emit : Emit) (av : AVal) (profile : SourceProfile) : Prop
+    extends LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest slots)
+      profile
+
+structure LowerBorrowProfileSoundBelow
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (emit : Emit) (av : AVal)
+    (release : Bool) (profile : SourceProfile) : Prop
+    extends LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue av release sourceRest rest slots)
+      profile
+
+structure LowerArgsProfileSoundBelow
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input output : VEnv)
+    (sourceInput sourceOutput sourceValues : List IxIR0.Value)
+    (worlds : List Ixon.Owned) (emit : Emit) (avs : List AVal)
+    (profile : SourceProfile) : Prop
+    extends LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues worlds avs sourceRest rest slots)
+      profile
+
+/-- Results proved at every target bound recover the public unbounded
+profile interface. -/
+theorem LowerResultProfileSound.of_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {profile : SourceProfile}
+    (hsound : ∀ limit,
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceInput sourceOutput sourceValue world emit av profile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av profile := by
+  refine
+    { toLowerResultValueSound := (hsound 0).toLowerResultValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.of_below fun limit =>
+    (hsound limit).profileEmits sourceRest rest slots
+
+theorem LowerBorrowProfileSound.of_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool} {profile : SourceProfile}
+    (hsound : ∀ limit,
+      LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceInput sourceOutput sourceValue emit av release profile) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release profile := by
+  refine
+    { toLowerBorrowValueSound := (hsound 0).toLowerBorrowValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.of_below fun limit =>
+    (hsound limit).profileEmits sourceRest rest slots
+
+theorem LowerArgsProfileSound.of_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {profile : SourceProfile}
+    (hsound : ∀ limit,
+      LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceInput sourceOutput sourceValues worlds emit avs
+        profile) :
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs profile := by
+  refine
+    { toLowerArgsValueSound := (hsound 0).toLowerArgsValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.of_below fun limit =>
+    (hsound limit).profileEmits sourceRest rest slots
+
+theorem LowerResultProfileSoundBelow.mono
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {smaller larger : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {profile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur larger
+      input output sourceInput sourceOutput sourceValue world emit av profile)
+    (hbound : smaller ≤ larger) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur smaller input
+      output sourceInput sourceOutput sourceValue world emit av profile := by
+  refine
+    { toLowerResultValueSound := hsound.toLowerResultValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact (hsound.profileEmits sourceRest rest slots).mono hbound
+
+theorem LowerBorrowProfileSoundBelow.mono
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {smaller larger : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool} {profile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur larger
+      input output sourceInput sourceOutput sourceValue emit av release
+      profile)
+    (hbound : smaller ≤ larger) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur smaller input
+      output sourceInput sourceOutput sourceValue emit av release profile := by
+  refine
+    { toLowerBorrowValueSound := hsound.toLowerBorrowValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact (hsound.profileEmits sourceRest rest slots).mono hbound
+
+theorem LowerArgsProfileSoundBelow.mono
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {smaller larger : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {profile : SourceProfile}
+    (hsound : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur larger
+      input output sourceInput sourceOutput sourceValues worlds emit avs
+      profile)
+    (hbound : smaller ≤ larger) :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur smaller input output
+      sourceInput sourceOutput sourceValues worlds emit avs profile := by
+  refine
+    { toLowerArgsValueSound := hsound.toLowerArgsValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact (hsound.profileEmits sourceRest rest slots).mono hbound
+
+theorem LowerResultProfileSoundBelow.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {left right : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue world emit av left)
+    (hprofile : left = right) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue world emit av right := by
+  subst right
+  exact hsound
+
+theorem LowerBorrowProfileSoundBelow.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool} {left right : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue emit av release left)
+    (hprofile : left = right) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue emit av release right := by
+  subst right
+  exact hsound
+
+theorem LowerArgsProfileSoundBelow.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {left right : SourceProfile}
+    (hsound : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues worlds emit avs left)
+    (hprofile : left = right) :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValues worlds emit avs right := by
+  subst right
+  exact hsound
+
+theorem LowerResultProfileSoundBelow.monoProfile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {smaller larger : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue world emit av smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue world emit av larger := by
+  refine
+    { toLowerResultValueSound := hsound.toLowerResultValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact (hsound.profileEmits sourceRest rest slots).monoProfile hle
+
+theorem LowerBorrowProfileSoundBelow.monoProfile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool} {smaller larger : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue emit av release
+      smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue emit av release larger := by
+  refine
+    { toLowerBorrowValueSound := hsound.toLowerBorrowValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact (hsound.profileEmits sourceRest rest slots).monoProfile hle
+
+theorem LowerArgsProfileSoundBelow.monoProfile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {smaller larger : SourceProfile}
+    (hsound : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues worlds emit avs
+      smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValues worlds emit avs larger := by
+  refine
+    { toLowerArgsValueSound := hsound.toLowerArgsValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact (hsound.profileEmits sourceRest rest slots).monoProfile hle
+
+theorem LowerResultProfileSoundBelow.addProfileLeft
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {profile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue world emit av profile)
+    (extra : SourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue world emit av (extra + profile) := by
+  apply hsound.monoProfile
+  rw [sourceProfileOwnershipAllowance_add]
+  simp [OwnershipAllowanceLE, OwnershipAllowance.add]
+
+/-- Close a bounded lowering prefix with its generated return and obtain the
+exact run-indexed target cost certificate. -/
+theorem LowerResultProfileSoundBelow.closeCost
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {profile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue world emit av profile)
+    (sourceRest : List (Ixon.Owned × IxIR0.Value))
+    (rest : List Sim.Root) {fuel : Nat} {before after : Store}
+    {env : List RVal} {value : RVal}
+    (hfuel : fuel ≤ limit)
+    (horder : AllocationOrderInvariant before)
+    (henv : ValuesInBounds before env)
+    (hpre : GraphOwnsVEnv funRel recSelfRel input sourceInput sourceRest
+      rest before env)
+    (hrun : runCode ctx fuel cur before env
+      (emit (.ret (av.toAtom output))) = .ok (after, value)) :
+    ProfileFundedCodeRun ctx fuel cur before env
+      (emit (.ret (av.toAtom output))) after value profile := by
+  exact (hsound.profileEmits sourceRest rest []).closeRet
+    (av.toAtom output) hfuel horder henv
+    ⟨hpre, SlotsRealize.nil⟩ hrun
+
+theorem LowerArgsProfileSound.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {left right : SourceProfile}
+    (hsound : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs left)
+    (hprofile : left = right) :
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs right := by
+  subst right
+  exact hsound
+
+theorem LowerArgsProfileSound.monoProfile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {smaller larger : SourceProfile}
+    (hsound : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs larger := by
+  refine
+    { toLowerArgsValueSound := hsound.toLowerArgsValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.monoProfile
+    (hsound.profileEmits sourceRest rest slots) hle
+
+/-- The empty argument prefix preserves the indexed source/target state and
+spends no source allowance. -/
+theorem lowerArgs_nil_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} :
+    LowerArgsProfileSound funRel recSelfRel ctx cur Γ Γ
+      sourceEnv sourceEnv [] [] (_root_.id : Emit) [] 0 := by
+  refine
+    { toLowerArgsValueSound := lowerArgs_nil_value_sound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.id
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, [], hΓ, .nil, .nil, hrestGraph,
+    by simpa [Sim.rootsForWorlds] using hown⟩, hslots⟩
+
+/-- Profiled left-to-right argument sequencing.  The head result is moved
+into the semantic root frame while the tail runs, then restored as the first
+argument result at the continuation boundary. -/
+theorem LowerResultProfileSound.consArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {sourceValues : List IxIR0.Value}
+    {world : Ixon.Owned} {worlds : List Ixon.Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    {headProfile tailProfile : SourceProfile}
+    (head : LowerResultProfileSound funRel recSelfRel ctx cur input middle
+      sourceInput sourceMiddle sourceValue world emitHead av headProfile)
+    (tail : LowerArgsProfileSound funRel recSelfRel ctx cur middle output
+      sourceMiddle sourceOutput sourceValues worlds emitTail avs tailProfile) :
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput (sourceValue :: sourceValues)
+      (world :: worlds) (emitHead ∘ emitTail) (av :: avs)
+      (headProfile + tailProfile) := by
+  refine
+    { toLowerArgsValueSound :=
+        head.toLowerResultValueSound.consArgs tail.toLowerArgsValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  have hcost : ProfileFundedCodeRun ctx fuel cur before env
+      ((emitHead ∘ emitTail) continuation) after value
+      (headProfile + (tailProfile + continuationProfile)) := by
+    exact (head.profileEmits sourceRest rest slots) horder henv hpre hrun (by
+      intro restFuel headStore headEnv hheadOrder hheadBounds hmid htailRun
+      obtain ⟨⟨envRoots, headValue, hmiddle, hav, hvalueGraph,
+          hrestGraph, hown⟩, hslots⟩ := hmid
+      let root : Sim.Root := ⟨world, headValue⟩
+      have hrootWorld : Sim.HasWorld headStore world headValue := by
+        apply hown.roots_world root
+        simp [root]
+      have hframeGraph : Sim.RootsGraph funRel headStore
+          ((world, sourceValue) :: sourceRest) (root :: rest) :=
+        .cons rfl hrootWorld hvalueGraph hrestGraph
+      have hprotect : SlotsRealize middle headEnv
+          (aValProtection av headValue) :=
+        head.stable.protection_realized hav
+      have htailOwn : Sim.RootOwnership headStore
+          (envRoots ++ root :: rest) := by
+        apply hown.perm
+        simpa [root] using
+          (permExtractRoot root envRoots [] rest).symm
+      have htailPre : GraphOwnsVEnvProtected funRel recSelfRel middle
+          sourceMiddle ((world, sourceValue) :: sourceRest) (root :: rest)
+          (aValProtection av headValue ++ slots) headStore headEnv :=
+        ⟨⟨envRoots, hmiddle, hframeGraph, htailOwn⟩,
+          hprotect.append hslots⟩
+      exact
+        (tail.profileEmits
+          ((world, sourceValue) :: sourceRest) (root :: rest)
+          (aValProtection av headValue ++ slots))
+          hheadOrder hheadBounds htailPre htailRun (by
+            intro finalFuel finalStore finalEnv hfinalOrder hfinalBounds
+              htailPost hcontRun
+            obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+                hframeGraphFinal, hownTail⟩, hslotsTail⟩ := htailPost
+            cases hframeGraphFinal with
+            | cons _ _ hheadGraph hrestGraphFinal =>
+              have havFinal : AValRealizes output finalEnv av headValue :=
+                head.stable.realize_of_protection hav
+                  hslotsTail.left_of_append
+              have hheadGraph' :
+                  Sim.ValueGraph funRel finalStore sourceValue headValue := by
+                simpa [root] using hheadGraph
+              have hownFinal : Sim.RootOwnership finalStore
+                  (Sim.rootsForWorlds (world :: worlds)
+                      (headValue :: values) ++ outRoots ++ rest) := by
+                apply hownTail.perm
+                simpa [root, List.append_assoc] using
+                  (permExtractRoot root
+                    (Sim.rootsForWorlds worlds values ++ outRoots) [] rest)
+              have hfinalPost : GraphOwnsArgsResultProtected funRel
+                  recSelfRel output sourceOutput
+                  (sourceValue :: sourceValues) (world :: worlds)
+                  (av :: avs) sourceRest rest slots finalStore finalEnv :=
+                ⟨⟨outRoots, headValue :: values, houtput,
+                  .cons havFinal havs, .cons hheadGraph' hvalueGraphs,
+                  hrestGraphFinal, hownFinal⟩,
+                  hslotsTail.right_of_append⟩
+              exact hcontinuation hfinalOrder hfinalBounds hfinalPost
+                hcontRun))
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_assoc
+      headProfile tailProfile continuationProfile).symm
+
+/-- Bounded empty argument prefix. -/
+theorem lowerArgs_nil_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv [] [] (_root_.id : Emit) [] 0 := by
+  refine
+    { toLowerArgsValueSound := lowerArgs_nil_value_sound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.id
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, [], hΓ, .nil, .nil, hrestGraph,
+    by simpa [Sim.rootsForWorlds] using hown⟩, hslots⟩
+
+/-- Fuel-bounded left-to-right argument sequencing. -/
+theorem LowerResultProfileSoundBelow.consArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {sourceValues : List IxIR0.Value}
+    {world : Ixon.Owned} {worlds : List Ixon.Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    {headProfile tailProfile : SourceProfile}
+    (head : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle sourceValue world emitHead av
+      headProfile)
+    (tail : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      middle output sourceMiddle sourceOutput sourceValues worlds emitTail
+      avs tailProfile) :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput (sourceValue :: sourceValues)
+      (world :: worlds) (emitHead ∘ emitTail) (av :: avs)
+      (headProfile + tailProfile) := by
+  refine
+    { toLowerArgsValueSound :=
+        head.toLowerResultValueSound.consArgs tail.toLowerArgsValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  have hcost : ProfileFundedCodeRun ctx fuel cur before env
+      ((emitHead ∘ emitTail) continuation) after value
+      (headProfile + (tailProfile + continuationProfile)) := by
+    exact (head.profileEmits sourceRest rest slots) bound hbound hfuel
+      horder henv hpre hrun (by
+        intro restFuel headStore headEnv hrestFuel hheadOrder hheadBounds
+          hmid htailRun
+        obtain ⟨⟨envRoots, headValue, hmiddle, hav, hvalueGraph,
+            hrestGraph, hown⟩, hslots⟩ := hmid
+        let root : Sim.Root := ⟨world, headValue⟩
+        have hrootWorld : Sim.HasWorld headStore world headValue := by
+          apply hown.roots_world root
+          simp [root]
+        have hframeGraph : Sim.RootsGraph funRel headStore
+            ((world, sourceValue) :: sourceRest) (root :: rest) :=
+          .cons rfl hrootWorld hvalueGraph hrestGraph
+        have hprotect : SlotsRealize middle headEnv
+            (aValProtection av headValue) :=
+          head.stable.protection_realized hav
+        have htailOwn : Sim.RootOwnership headStore
+            (envRoots ++ root :: rest) := by
+          apply hown.perm
+          simpa [root] using
+            (permExtractRoot root envRoots [] rest).symm
+        have htailPre : GraphOwnsVEnvProtected funRel recSelfRel middle
+            sourceMiddle ((world, sourceValue) :: sourceRest) (root :: rest)
+            (aValProtection av headValue ++ slots) headStore headEnv :=
+          ⟨⟨envRoots, hmiddle, hframeGraph, htailOwn⟩,
+            hprotect.append hslots⟩
+        exact
+          (tail.profileEmits
+            ((world, sourceValue) :: sourceRest) (root :: rest)
+            (aValProtection av headValue ++ slots))
+            bound hbound hrestFuel hheadOrder hheadBounds htailPre htailRun
+            (by
+              intro finalFuel finalStore finalEnv hfinalFuel hfinalOrder
+                hfinalBounds htailPost hcontRun
+              obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+                  hframeGraphFinal, hownTail⟩, hslotsTail⟩ := htailPost
+              cases hframeGraphFinal with
+              | cons _ _ hheadGraph hrestGraphFinal =>
+                have havFinal : AValRealizes output finalEnv av headValue :=
+                  head.stable.realize_of_protection hav
+                    hslotsTail.left_of_append
+                have hheadGraph' :
+                    Sim.ValueGraph funRel finalStore sourceValue
+                      headValue := by
+                  simpa [root] using hheadGraph
+                have hownFinal : Sim.RootOwnership finalStore
+                    (Sim.rootsForWorlds (world :: worlds)
+                        (headValue :: values) ++ outRoots ++ rest) := by
+                  apply hownTail.perm
+                  simpa [root, List.append_assoc] using
+                    (permExtractRoot root
+                      (Sim.rootsForWorlds worlds values ++ outRoots) []
+                      rest)
+                have hfinalPost : GraphOwnsArgsResultProtected funRel
+                    recSelfRel output sourceOutput
+                    (sourceValue :: sourceValues) (world :: worlds)
+                    (av :: avs) sourceRest rest slots finalStore finalEnv :=
+                  ⟨⟨outRoots, headValue :: values, houtput,
+                    .cons havFinal havs, .cons hheadGraph' hvalueGraphs,
+                    hrestGraphFinal, hownFinal⟩,
+                    hslotsTail.right_of_append⟩
+                exact hcontinuation hfinalFuel hfinalOrder hfinalBounds
+                  hfinalPost hcontRun))
+  exact ProfileFundedCodeRun.of_profile_eq hcost
+    (IxIR0.DynamicCost.Profile.add_assoc
+      headProfile tailProfile continuationProfile).symm
+
+/-- Cost-carrying left-to-right source argument evaluation.  Unlike the
+fuel-free semantic `SourceArgsEval`, this relation retains the exact additive
+profile needed by the target-cost induction. -/
+inductive SourceArgsProfile (sourceCtx : IxIR0.Ctx)
+    (sourceEnv : List IxIR0.Value) :
+    List IxIR0.Expr → List IxIR0.Value → SourceProfile → Prop where
+  | nil : SourceArgsProfile sourceCtx sourceEnv [] [] 0
+  | cons {expr : IxIR0.Expr} {sourceValue : IxIR0.Value}
+      {expressions : List IxIR0.Expr} {sourceValues : List IxIR0.Value}
+      {fuel : Nat} {headProfile tailProfile : SourceProfile} :
+      IxIR0.DynamicCost.Eval sourceCtx fuel sourceEnv expr sourceValue
+        headProfile →
+      SourceArgsProfile sourceCtx sourceEnv expressions sourceValues
+        tailProfile →
+      SourceArgsProfile sourceCtx sourceEnv (expr :: expressions)
+        (sourceValue :: sourceValues) (headProfile + tailProfile)
+
+/-- Dependent lockstep traversal of a profiled source argument vector.
+Clients receive the exact head evaluation profile, the original profiled
+tail derivation, and the recursively produced result while expressions,
+values, and their additive profile stay synchronized. -/
+theorem SourceArgsProfile.traverse
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {Result : List IxIR0.Expr → List IxIR0.Value → SourceProfile → Prop}
+    (hnil : Result [] [] 0)
+    (hcons : ∀ {expr : IxIR0.Expr} {sourceValue : IxIR0.Value}
+        {expressions : List IxIR0.Expr}
+        {sourceValues : List IxIR0.Value} {fuel : Nat}
+        {headProfile tailProfile : SourceProfile},
+      IxIR0.DynamicCost.Eval sourceCtx fuel sourceEnv expr sourceValue
+          headProfile →
+      SourceArgsProfile sourceCtx sourceEnv expressions sourceValues
+          tailProfile →
+      Result expressions sourceValues tailProfile →
+      Result (expr :: expressions) (sourceValue :: sourceValues)
+        (headProfile + tailProfile))
+    {expressions : List IxIR0.Expr} {sourceValues : List IxIR0.Value}
+    {profile : SourceProfile}
+    (hargs : SourceArgsProfile sourceCtx sourceEnv expressions sourceValues
+      profile) :
+    Result expressions sourceValues profile := by
+  induction hargs with
+  | nil => exact hnil
+  | cons hhead htail ih => exact hcons hhead htail ih
+
+theorem SourceArgsProfile.toSourceArgsEval
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expressions : List IxIR0.Expr} {sourceValues : List IxIR0.Value}
+    {profile : SourceProfile}
+    (hargs : SourceArgsProfile sourceCtx sourceEnv expressions sourceValues
+      profile) :
+    SourceArgsEval sourceCtx sourceEnv expressions sourceValues := by
+  exact SourceArgsProfile.traverse
+    (Result := fun currentExpressions currentValues _ =>
+      SourceArgsEval sourceCtx sourceEnv currentExpressions currentValues)
+    (hnil := .nil)
+    (hcons := by
+      intro expr sourceValue currentExpressions currentValues fuel
+        headProfile tailProfile hhead htail ih
+      exact .cons hhead.run ih)
+    hargs
+
+@[simp] theorem SourceArgsProfile.lengths
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expressions : List IxIR0.Expr} {sourceValues : List IxIR0.Value}
+    {profile : SourceProfile}
+    (hargs : SourceArgsProfile sourceCtx sourceEnv expressions sourceValues
+      profile) :
+    expressions.length = sourceValues.length := by
+  exact SourceArgsProfile.traverse
+    (Result := fun currentExpressions currentValues _ =>
+      currentExpressions.length = currentValues.length)
+    (hnil := rfl)
+    (hcons := by
+      intro expr sourceValue currentExpressions currentValues fuel
+        headProfile tailProfile hhead htail ih
+      simp [ih])
+    hargs
+
+/-- Split a costed argument vector at the compiler's `take`/`drop`
+boundary, retaining exact profiles for both pieces. -/
+theorem SourceArgsProfile.splitAt
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expressions : List IxIR0.Expr} {sourceValues : List IxIR0.Value}
+    {profile : SourceProfile}
+    (hargs : SourceArgsProfile sourceCtx sourceEnv expressions sourceValues
+      profile) (count : Nat) :
+    ∃ prefixProfile tailProfile,
+      SourceArgsProfile sourceCtx sourceEnv (expressions.take count)
+        (sourceValues.take count) prefixProfile ∧
+      SourceArgsProfile sourceCtx sourceEnv (expressions.drop count)
+        (sourceValues.drop count) tailProfile ∧
+      prefixProfile + tailProfile = profile := by
+  exact (SourceArgsProfile.traverse
+    (Result := fun currentExpressions currentValues currentProfile =>
+      ∀ currentCount,
+        ∃ prefixProfile tailProfile,
+          SourceArgsProfile sourceCtx sourceEnv
+              (currentExpressions.take currentCount)
+              (currentValues.take currentCount) prefixProfile ∧
+            SourceArgsProfile sourceCtx sourceEnv
+              (currentExpressions.drop currentCount)
+              (currentValues.drop currentCount) tailProfile ∧
+            prefixProfile + tailProfile = currentProfile)
+    (hnil := by
+      intro currentCount
+      simpa using
+        (show ∃ prefixProfile tailProfile,
+            SourceArgsProfile sourceCtx sourceEnv [] [] prefixProfile ∧
+            SourceArgsProfile sourceCtx sourceEnv [] [] tailProfile ∧
+            prefixProfile + tailProfile = 0 from
+          ⟨0, 0, .nil, .nil,
+            IxIR0.DynamicCost.Profile.zero_add 0⟩))
+    (hcons := by
+      intro expr sourceValue currentExpressions currentValues fuel
+        headProfile tailProfile hhead htail ih currentCount
+      cases currentCount with
+      | zero =>
+          exact ⟨0, headProfile + tailProfile, .nil, .cons hhead htail,
+            IxIR0.DynamicCost.Profile.zero_add _⟩
+      | succ currentCount =>
+          obtain ⟨prefixProfile, suffixProfile, hprefix, hsuffix,
+              hprofile⟩ := ih currentCount
+          refine ⟨headProfile + prefixProfile, suffixProfile, ?_, ?_, ?_⟩
+          · exact .cons hhead hprefix
+          · exact hsuffix
+          · calc
+              (headProfile + prefixProfile) + suffixProfile =
+                  headProfile + (prefixProfile + suffixProfile) :=
+                IxIR0.DynamicCost.Profile.add_assoc _ _ _
+              _ = headProfile + tailProfile :=
+                congrArg (headProfile + ·) hprofile)
+    hargs) count
+
+/-- Cost-carrying n-ary source application.  Each step includes the source
+`.app` evaluation event in addition to the entered `DynamicCost.Apply`
+profile, so a flattened spine retains the profile of the original nested
+application syntax. -/
+inductive SourceAppliesProfile (sourceCtx : IxIR0.Ctx) :
+    IxIR0.Value → List IxIR0.Value → IxIR0.Value → SourceProfile → Prop where
+  | nil {sourceValue : IxIR0.Value} :
+      SourceAppliesProfile sourceCtx sourceValue [] sourceValue 0
+  | cons {sourceFunction sourceArgument sourceMiddle sourceResult :
+        IxIR0.Value}
+      {sourceArguments : List IxIR0.Value} {fuel : Nat}
+      {stepProfile tailProfile : SourceProfile} :
+      IxIR0.DynamicCost.Apply sourceCtx fuel sourceFunction sourceArgument
+        sourceMiddle stepProfile →
+      SourceAppliesProfile sourceCtx sourceMiddle sourceArguments
+        sourceResult tailProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceArgument :: sourceArguments) sourceResult
+        ((stepProfile + IxIR0.DynamicCost.tick .evalApp) + tailProfile)
+
+/-- Dependent state-threaded traversal of a profiled source application
+spine. Clients receive the exact head application profile, the original
+profiled tail derivation, and the recursively produced result while the
+initial value, remaining arguments, final value, and additive profile stay
+synchronized. -/
+theorem SourceAppliesProfile.traverse
+    {sourceCtx : IxIR0.Ctx}
+    {Result : IxIR0.Value → List IxIR0.Value → IxIR0.Value →
+      SourceProfile → Prop}
+    (hnil : ∀ sourceValue, Result sourceValue [] sourceValue 0)
+    (hcons : ∀ {sourceFunction sourceArgument sourceMiddle sourceResult :
+          IxIR0.Value}
+        {sourceArguments : List IxIR0.Value} {fuel : Nat}
+        {stepProfile tailProfile : SourceProfile},
+      IxIR0.DynamicCost.Apply sourceCtx fuel sourceFunction sourceArgument
+          sourceMiddle stepProfile →
+      SourceAppliesProfile sourceCtx sourceMiddle sourceArguments
+          sourceResult tailProfile →
+      Result sourceMiddle sourceArguments sourceResult tailProfile →
+      Result sourceFunction (sourceArgument :: sourceArguments) sourceResult
+        ((stepProfile + IxIR0.DynamicCost.tick .evalApp) + tailProfile))
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArguments : List IxIR0.Value} {profile : SourceProfile}
+    (happly : SourceAppliesProfile sourceCtx sourceFunction sourceArguments
+      sourceResult profile) :
+    Result sourceFunction sourceArguments sourceResult profile := by
+  induction happly with
+  | nil => exact hnil _
+  | cons hstep htail ih => exact hcons hstep htail ih
+
+theorem SourceAppliesProfile.toSourceApplies
+    {sourceCtx : IxIR0.Ctx} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArguments : List IxIR0.Value} {profile : SourceProfile}
+    (happly : SourceAppliesProfile sourceCtx sourceFunction sourceArguments
+      sourceResult profile) :
+    SourceApplies sourceCtx sourceFunction sourceArguments sourceResult := by
+  exact SourceAppliesProfile.traverse
+    (Result := fun currentFunction currentArguments currentResult _ =>
+      SourceApplies sourceCtx currentFunction currentArguments currentResult)
+    (hnil := fun _ => .nil)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel stepProfile tailProfile hstep htail ih
+      exact .cons hstep.run ih)
+    happly
+
+/-- Costed counterpart of stripping a saturated leading-lambda telescope.
+The final body trace is funded by the initial expression trace together with
+the profiled application chain; administrative apply events only add slack. -/
+theorem dynamicEval_stripLams_of_appliesProfile
+    (sourceCtx : IxIR0.Ctx) :
+    ∀ {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+      {function result : IxIR0.Value} {args : List IxIR0.Value}
+      {evalFuel : Nat} {evalProfile applyProfile : SourceProfile},
+      IxIR0.DynamicCost.Eval sourceCtx evalFuel sourceEnv expr function
+        evalProfile →
+      args.length = lamArity expr →
+      SourceAppliesProfile sourceCtx function args result applyProfile →
+      ∃ bodyFuel bodyProfile,
+        IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+          (args.reverse ++ sourceEnv) (stripLams expr) result bodyProfile ∧
+        OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance bodyProfile)
+          (sourceProfileOwnershipAllowance (evalProfile + applyProfile)) := by
+  intro sourceEnv expr
+  induction expr generalizing sourceEnv with
+  | var index =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+
+  | ref address =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+  | app fn arg =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+  | lam uses body ih =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      cases heval with
+      | lam =>
+          cases args with
+          | nil => simp [lamArity] at hlength
+          | cons argument arguments =>
+              have htailLength : arguments.length = lamArity body := by
+                simpa [lamArity] using hlength
+              cases happlies with
+              | @cons _ _ middle _ _ _ stepProfile tailProfile hstep htail =>
+                  cases hstep with
+                  | clos hbody =>
+                      obtain ⟨finalFuel, finalProfile, hfinal, hfunded⟩ :=
+                        ih hbody htailLength htail
+                      refine ⟨finalFuel, finalProfile, ?_, ?_⟩
+                      · simpa [stripLams, List.reverse_cons,
+                          List.append_assoc] using hfinal
+                      · apply hfunded.trans
+                        simp [OwnershipAllowanceLE,
+                          sourceProfileOwnershipAllowance,
+                          IxIR0.DynamicCost.tick,
+                          IxIR0.DynamicCost.retain]
+                        omega
+  | letE uses value body =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+  | proj index value =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+  | lit literal =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+  | erased =>
+      intro function result args evalFuel evalProfile applyProfile heval
+        hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by
+          simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      refine ⟨evalFuel, evalProfile, by simpa [stripLams] using heval, ?_⟩
+      rw [IxIR0.DynamicCost.Profile.add_zero]
+      exact OwnershipAllowanceLE.refl _
+
+/-- Completing a residual lifted-closure prefix reserves an arbitrary
+subwidth of its closure environment for target PAP duplication. The final
+stripped body profile is funded by the remainder of the current, nonempty
+source application chain. -/
+theorem LambdaPrefix.saturateProfile
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expr : IxIR0.Expr} {supplied remaining : List IxIR0.Value}
+    {function result : IxIR0.Value} {profile : SourceProfile}
+    {reserve : Nat}
+    (hprefix : LambdaPrefix sourceEnv expr supplied function)
+    (hreserve : reserve ≤ sourceEnv.length + supplied.length)
+    (hlength : (supplied ++ remaining).length = lamArity expr)
+    (happlies : SourceAppliesProfile sourceCtx function remaining result
+      profile)
+    (hnonempty : remaining ≠ []) :
+    ∃ bodyFuel bodyProfile,
+      IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+        ((supplied ++ remaining).reverse ++ sourceEnv)
+        (stripLams expr) result bodyProfile ∧
+      OwnershipAllowanceLE
+        (sourceProfileOwnershipAllowance
+          (IxIR0.DynamicCost.retain reserve + bodyProfile))
+        (sourceProfileOwnershipAllowance profile) := by
+  exact (LambdaPrefix.traverse
+    (Result := fun currentEnv currentExpr currentSupplied currentFunction =>
+      reserve ≤ currentEnv.length + currentSupplied.length →
+      (currentSupplied ++ remaining).length = lamArity currentExpr →
+      SourceAppliesProfile sourceCtx currentFunction remaining result
+        profile →
+      remaining ≠ [] →
+      ∃ bodyFuel bodyProfile,
+        IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+          ((currentSupplied ++ remaining).reverse ++ currentEnv)
+          (stripLams currentExpr) result bodyProfile ∧
+        OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.retain reserve + bodyProfile))
+          (sourceProfileOwnershipAllowance profile))
+    (hnil := by
+      intro currentEnv uses body hreserve hlength happlies hnonempty
+      cases remaining with
+      | nil => exact (hnonempty rfl).elim
+      | cons argument arguments =>
+          have htailLength : arguments.length = lamArity body := by
+            simpa [lamArity] using hlength
+          cases happlies with
+          | @cons _ _ middle _ _ _ stepProfile tailProfile hstep htail =>
+              cases hstep with
+              | clos hbody =>
+                  obtain ⟨bodyFuel, bodyProfile, hbodyProfile, hfunded⟩ :=
+                    dynamicEval_stripLams_of_appliesProfile sourceCtx hbody
+                      htailLength htail
+                  refine ⟨bodyFuel, bodyProfile, ?_, ?_⟩
+                  · simpa [stripLams, List.reverse_cons,
+                      List.append_assoc] using hbodyProfile
+                  · simp only [List.length_nil, Nat.add_zero] at hreserve
+                    simp [OwnershipAllowanceLE,
+                      sourceProfileOwnershipAllowance,
+                      IxIR0.DynamicCost.tick,
+                      IxIR0.DynamicCost.retain] at hfunded ⊢
+                    omega)
+    (hcons := by
+      intro currentEnv uses body argument currentSupplied currentFunction
+        hinner ih hreserve hlength happlies hnonempty
+      have hreserve' : reserve ≤
+          (argument :: currentEnv).length + currentSupplied.length := by
+        simp only [List.length_cons]
+        simp only [List.length_cons] at hreserve
+        omega
+      have hlength' : (currentSupplied ++ remaining).length =
+          lamArity body := by
+        simpa [lamArity] using hlength
+      obtain ⟨bodyFuel, bodyProfile, hbodyProfile, hfunded⟩ :=
+        ih hreserve' hlength' happlies hnonempty
+      refine ⟨bodyFuel, bodyProfile, ?_, hfunded⟩
+      simpa [stripLams, List.reverse_cons, List.append_assoc] using
+        hbodyProfile)
+    (h := hprefix)) hreserve hlength happlies hnonempty
+
+/-- Any nonempty application of a residual closure funds duplication of a
+chosen subwidth of its current environment and the successor-PAP allocation.
+This is the under-application half of the no-double-spend split. -/
+theorem LambdaPrefix.underApplyProfileFunding
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expr : IxIR0.Expr} {supplied remaining : List IxIR0.Value}
+    {function result : IxIR0.Value} {profile : SourceProfile}
+    {reserve : Nat}
+    (hprefix : LambdaPrefix sourceEnv expr supplied function)
+    (hreserve : reserve ≤ sourceEnv.length + supplied.length)
+    (happlies : SourceAppliesProfile sourceCtx function remaining result
+      profile)
+    (hnonempty : remaining ≠ []) :
+    OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve +
+          IxIR0.DynamicCost.tick .evalApp))
+      (sourceProfileOwnershipAllowance profile) := by
+  exact (LambdaPrefix.traverse
+    (Result := fun currentEnv currentExpr currentSupplied currentFunction =>
+      reserve ≤ currentEnv.length + currentSupplied.length →
+      SourceAppliesProfile sourceCtx currentFunction remaining result
+        profile →
+      remaining ≠ [] →
+      OwnershipAllowanceLE
+        (sourceProfileOwnershipAllowance
+          (IxIR0.DynamicCost.retain reserve +
+            IxIR0.DynamicCost.tick .evalApp))
+        (sourceProfileOwnershipAllowance profile))
+    (hnil := by
+      intro currentEnv uses body hreserve happlies hnonempty
+      cases remaining with
+      | nil => exact (hnonempty rfl).elim
+      | cons argument arguments =>
+          cases happlies with
+          | @cons _ _ middle _ _ _ stepProfile tailProfile hstep htail =>
+              cases hstep with
+              | clos hbody =>
+                  simp only [List.length_nil, Nat.add_zero] at hreserve
+                  simp [OwnershipAllowanceLE,
+                    sourceProfileOwnershipAllowance,
+                    IxIR0.DynamicCost.tick,
+                    IxIR0.DynamicCost.retain]
+                  omega)
+    (hcons := by
+      intro currentEnv uses body argument currentSupplied currentFunction
+        hinner ih hreserve happlies hnonempty
+      have hreserve' : reserve ≤
+          (argument :: currentEnv).length + currentSupplied.length := by
+        simp only [List.length_cons]
+        simp only [List.length_cons] at hreserve
+        omega
+      exact ih hreserve' happlies hnonempty)
+    (h := hprefix)) hreserve happlies hnonempty
+
+/-- A nonempty application of a source PAP exposes its stored-prefix retain
+and one source `.app` evaluation, enough to fund the target successor PAP. -/
+theorem SourceAppliesProfile.papUnderFunding
+    {sourceCtx : IxIR0.Ctx} {head : IxIR0.Head}
+    {captured remaining : List IxIR0.Value}
+    {result : IxIR0.Value} {profile : SourceProfile} {reserve : Nat}
+    (hreserve : reserve ≤ captured.length)
+    (happlies : SourceAppliesProfile sourceCtx (.pap head captured)
+      remaining result profile)
+    (hnonempty : remaining ≠ []) :
+    OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve +
+          IxIR0.DynamicCost.tick .evalApp))
+      (sourceProfileOwnershipAllowance profile) := by
+  cases remaining with
+  | nil => exact (hnonempty rfl).elim
+  | cons argument arguments =>
+      cases happlies with
+      | @cons _ _ middle _ _ _ stepProfile tailProfile hstep htail =>
+          cases hstep with
+          | pap hsaturate =>
+              simp [OwnershipAllowanceLE,
+                sourceProfileOwnershipAllowance,
+                IxIR0.DynamicCost.tick,
+                IxIR0.DynamicCost.retain]
+              omega
+
+private theorem sourceRef_lambdaPrefix_nil
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {result : Ixon.Owned}
+    {body : IxIR0.Expr} {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.defn result body))
+    (hpositive : 0 < lamArity body)
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    LambdaPrefix [] body [] sourceFunction := by
+  cases body with
+  | lam uses body =>
+      obtain ⟨fuel, href⟩ := href
+      cases fuel with
+      | zero => simp [IxIR0.eval] at href
+      | succ fuel =>
+          cases fuel with
+          | zero => simp [IxIR0.eval, henv, hsrc] at href
+          | succ fuel =>
+              have hvalue : sourceFunction = .clos uses [] body := by
+                simpa [IxIR0.eval, henv, hsrc] using href.symm
+              subst sourceFunction
+              exact .nil
+  | var => simp [lamArity] at hpositive
+  | ref => simp [lamArity] at hpositive
+  | app => simp [lamArity] at hpositive
+  | letE => simp [lamArity] at hpositive
+  | proj => simp [lamArity] at hpositive
+  | lit => simp [lamArity] at hpositive
+  | erased => simp [lamArity] at hpositive
+
+private theorem sourceRef_ctorPap
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {tag arity : Nat}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.ctor tag arity))
+    (hpositive : 0 < arity)
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    sourceFunction = .pap (.ctor address tag arity) [] := by
+  obtain ⟨fuel, href⟩ := href
+  cases fuel with
+  | zero => simp [IxIR0.eval] at href
+  | succ fuel =>
+      cases fuel with
+      | zero => simp [IxIR0.eval, henv, hsrc, IxIR0.saturate] at href
+      | succ fuel =>
+          have hne : 0 ≠ arity := Nat.ne_of_lt hpositive
+          simpa [IxIR0.eval, henv, hsrc, IxIR0.saturate,
+            IxIR0.Head.arity, hne] using href.symm
+
+private theorem sourceRef_externPap
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {arity : Nat}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.extern arity))
+    (hpositive : 0 < arity)
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    sourceFunction = .pap (.ext address arity) [] := by
+  obtain ⟨fuel, href⟩ := href
+  cases fuel with
+  | zero => simp [IxIR0.eval] at href
+  | succ fuel =>
+      cases fuel with
+      | zero => simp [IxIR0.eval, henv, hsrc, IxIR0.saturate] at href
+      | succ fuel =>
+          have hne : 0 ≠ arity := Nat.ne_of_lt hpositive
+          simpa [IxIR0.eval, henv, hsrc, IxIR0.saturate,
+            IxIR0.Head.arity, hne] using href.symm
+
+/-- Every compiler-related residual function exposes enough of any current,
+nonempty source application profile to duplicate its stored target prefix
+and allocate an under-applied successor PAP. This is independent of target
+fuel and is shared by all five admitted PAP origins. -/
+theorem CompilerFunctionRel.underApplyProfileFunding
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {state : LowSt}
+    {function result : IxIR0.Value} {address : Ixon.Address}
+    {arity : Nat} {captures arguments : List IxIR0.Value}
+    {profile : SourceProfile}
+    (henv : sourceCtx.env = src)
+    (hrel : CompilerFunctionRel sourceCtx src state function address arity
+      captures)
+    (happlies : SourceAppliesProfile sourceCtx function arguments result
+      profile)
+    (hnonempty : arguments ≠ []) :
+    OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain captures.length +
+          IxIR0.DynamicCost.tick .evalApp))
+      (sourceProfileOwnershipAllowance profile) := by
+  cases hrel with
+  | @source value baseFunction targetAddress targetArity storedSources
+      source hsrc heligible harity href hprefix hunder =>
+      cases source with
+      | defn sourceResult body =>
+          have hpositive : 0 < lamArity body := by
+            simp only [sourceDeclArity] at harity
+            omega
+          have hstoredUnder : captures.length < lamArity body := by
+            simp only [sourceDeclArity] at harity
+            omega
+          have hinitial := sourceRef_lambdaPrefix_nil henv hsrc hpositive href
+          have hresidual : LambdaPrefix [] body captures function := by
+            simpa using hinitial.append_of_applies hprefix (by
+              simpa using hstoredUnder)
+          exact LambdaPrefix.underApplyProfileFunding hresidual (by simp)
+            happlies hnonempty
+      | ctor tag ctorArity => exact heligible.elim
+      | recursor numArgs natLit rules =>
+          have hlookup : sourceCtx.env address =
+              some (.recursor numArgs natLit rules) := by
+            rw [henv]
+            exact hsrc
+          have hbase := href.recursorValue hlookup
+          subst baseFunction
+          have hstoredUnder : captures.length < numArgs + 1 := by
+            simp only [sourceDeclArity] at harity
+            omega
+          have hcanonical : SourceApplies sourceCtx
+              (.pap (.rec_ address (numArgs + 1)) []) captures
+              (.pap (.rec_ address (numArgs + 1)) captures) :=
+            sourcePap_underfills (by
+              simpa [IxIR0.Head.arity] using hstoredUnder)
+          have hvalue : function =
+              .pap (.rec_ address (numArgs + 1)) captures :=
+            hprefix.deterministic hcanonical
+          subst function
+          exact happlies.papUnderFunding (Nat.le_refl _) hnonempty
+      | extern externArity =>
+          have hpositive : 0 < externArity := by
+            simp only [sourceDeclArity] at harity
+            omega
+          have hbase := sourceRef_externPap henv hsrc hpositive href
+          subst baseFunction
+          have hstoredUnder : captures.length < externArity := by
+            simp only [sourceDeclArity] at harity
+            omega
+          have hcanonical : SourceApplies sourceCtx
+              (.pap (.ext address externArity) []) captures
+              (.pap (.ext address externArity) captures) :=
+            sourcePap_underfills (by
+              simpa [IxIR0.Head.arity] using hstoredUnder)
+          have hvalue : function =
+              .pap (.ext address externArity) captures :=
+            hprefix.deterministic hcanonical
+          subst function
+          exact happlies.papUnderFunding (Nat.le_refl _) hnonempty
+  | @wrapper value baseFunction storedSources memo hmember hsrc href
+      hprefix hunder =>
+      have hpositive : 0 < memo.arity := by omega
+      have hbase := sourceRef_ctorPap henv hsrc hpositive href
+      subst baseFunction
+      have hcanonical : SourceApplies sourceCtx
+          (.pap (.ctor memo.source memo.tag memo.arity) []) captures
+          (.pap (.ctor memo.source memo.tag memo.arity) captures) :=
+        sourcePap_underfills (by
+          simpa [IxIR0.Head.arity] using hunder)
+      have hvalue : function =
+          .pap (.ctor memo.source memo.tag memo.arity) captures :=
+        hprefix.deterministic hcanonical
+      subst function
+      exact happlies.papUnderFunding (Nat.le_refl _) hnonempty
+  | lifted hlifted =>
+      obtain ⟨sourceEnv, expr, selected, supplied, hlift, hselected,
+          hcaptures, harity, hprefix⟩ := hlifted
+      subst captures
+      have hselectedLe : selected.length ≤ sourceEnv.length := by
+        rw [hselected.length]
+        simpa [liftCaptureIndices] using List.length_filter_le
+          (fun index => countUses index expr > 0)
+          (List.range sourceEnv.length)
+      have hreserve : (selected ++ supplied).length ≤
+          sourceEnv.length + supplied.length := by
+        simp only [List.length_append]
+        omega
+      exact LambdaPrefix.underApplyProfileFunding hprefix hreserve happlies
+        hnonempty
+
+/-- Split an exact profiled source application chain at an arbitrary
+argument boundary. -/
+theorem SourceAppliesProfile.splitAt
+    {sourceCtx : IxIR0.Ctx} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArguments : List IxIR0.Value} {profile : SourceProfile}
+    (happly : SourceAppliesProfile sourceCtx sourceFunction sourceArguments
+      sourceResult profile) (count : Nat) :
+    ∃ sourceMiddle prefixProfile tailProfile,
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceArguments.take count) sourceMiddle prefixProfile ∧
+      SourceAppliesProfile sourceCtx sourceMiddle
+        (sourceArguments.drop count) sourceResult tailProfile ∧
+      prefixProfile + tailProfile = profile := by
+  exact (SourceAppliesProfile.traverse
+    (Result := fun currentFunction currentArguments currentResult
+        currentProfile =>
+      ∀ currentCount,
+        ∃ sourceMiddle prefixProfile tailProfile,
+          SourceAppliesProfile sourceCtx currentFunction
+              (currentArguments.take currentCount) sourceMiddle
+              prefixProfile ∧
+            SourceAppliesProfile sourceCtx sourceMiddle
+              (currentArguments.drop currentCount) currentResult
+              tailProfile ∧
+            prefixProfile + tailProfile = currentProfile)
+    (hnil := by
+      intro sourceValue currentCount
+      simpa using
+        (show ∃ sourceMiddle prefixProfile tailProfile,
+            SourceAppliesProfile sourceCtx sourceValue [] sourceMiddle
+                prefixProfile ∧
+              SourceAppliesProfile sourceCtx sourceMiddle [] sourceValue
+                tailProfile ∧
+              prefixProfile + tailProfile = 0 from
+          ⟨sourceValue, 0, 0, .nil, .nil,
+            IxIR0.DynamicCost.Profile.zero_add 0⟩))
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel stepProfile tailProfile hstep htail ih
+        currentCount
+      cases currentCount with
+      | zero =>
+          exact ⟨currentFunction, 0,
+            (stepProfile + IxIR0.DynamicCost.tick .evalApp) + tailProfile,
+            .nil, .cons hstep htail,
+            IxIR0.DynamicCost.Profile.zero_add _⟩
+      | succ currentCount =>
+          obtain ⟨sourceMiddle, prefixProfile, suffixProfile, hprefix,
+              hsuffix, hprofile⟩ := ih currentCount
+          refine ⟨sourceMiddle,
+            (stepProfile + IxIR0.DynamicCost.tick .evalApp) + prefixProfile,
+            suffixProfile, ?_, ?_, ?_⟩
+          · exact .cons hstep hprefix
+          · exact hsuffix
+          · calc
+              ((stepProfile + IxIR0.DynamicCost.tick .evalApp) +
+                  prefixProfile) + suffixProfile =
+                  (stepProfile + IxIR0.DynamicCost.tick .evalApp) +
+                    (prefixProfile + suffixProfile) :=
+                IxIR0.DynamicCost.Profile.add_assoc _ _ _
+              _ = (stepProfile + IxIR0.DynamicCost.tick .evalApp) +
+                  tailProfile :=
+                congrArg
+                  ((stepProfile + IxIR0.DynamicCost.tick .evalApp) + ·)
+                  hprofile)
+    happly) count
+
+/-- The exact source reference fragment available at a static function-entry
+boundary.  Keeping the profile, rather than only `SourceRefValue`, is
+essential for nullary definitions: their body executes while evaluating the
+reference, before there is any source application step. -/
+def SourceRefProfile (sourceCtx : IxIR0.Ctx) (address : Ixon.Address)
+    (sourceFunction : IxIR0.Value) (profile : SourceProfile) : Prop :=
+  ∃ fuel sourceEnv,
+    IxIR0.DynamicCost.Eval sourceCtx fuel sourceEnv (.ref address)
+      sourceFunction profile
+
+/-- The source fragment that funds one entered target function body.
+Nonempty calls use the exact n-ary application profile.  A nullary call uses
+the exact closed-reference profile that already contains the source body
+evaluation. -/
+inductive SourceFnEntryProfile (sourceCtx : IxIR0.Ctx)
+    (address : Ixon.Address) (sourceFunction : IxIR0.Value) :
+    List IxIR0.Value → IxIR0.Value → SourceProfile → Prop where
+  | applied {sourceArgument : IxIR0.Value}
+      {sourceArguments : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {profile : SourceProfile} :
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceArgument :: sourceArguments) sourceResult profile →
+      SourceFnEntryProfile sourceCtx address sourceFunction
+        (sourceArgument :: sourceArguments) sourceResult profile
+  | nullary {profile : SourceProfile} :
+      SourceRefProfile sourceCtx address sourceFunction profile →
+      SourceFnEntryProfile sourceCtx address sourceFunction []
+        sourceFunction profile
+
+theorem SourceFnEntryProfile.toSourceApplies
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {profile : SourceProfile}
+    (hentry : SourceFnEntryProfile sourceCtx address sourceFunction
+      sourceArgs sourceResult profile) :
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult := by
+  cases hentry with
+  | applied happly => exact happly.toSourceApplies
+  | nullary _ => exact .nil
+
+theorem SourceAppliesProfile.toFnEntryProfile
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {profile : SourceProfile}
+    (happly : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult profile) (hne : sourceArgs ≠ []) :
+    SourceFnEntryProfile sourceCtx address sourceFunction sourceArgs
+      sourceResult profile := by
+  cases sourceArgs with
+  | nil => exact (hne rfl).elim
+  | cons sourceArgument sourceArguments =>
+      exact .applied happly
+
+/-- Exact target-fuel cost preservation for a compiled function body.  The
+source entry identifies both the entered source computation and the complete
+profile available to fund the target body. -/
+def FnProfilePreservesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx)
+    (address : Ixon.Address)
+    (d : FnDef) (argWorlds : List Ixon.Owned)
+    (sourceFunction : IxIR0.Value) (fuel : Nat) : Prop :=
+  ∀ {before after : Store} {args : List RVal} {value : RVal}
+      {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+      {rest : List Sim.Root} {profile : SourceProfile},
+    AllocationOrderInvariant before →
+    args.length = argWorlds.length →
+    sourceArgs.length = argWorlds.length →
+    Sim.ValuesGraph funRel before sourceArgs args →
+    SourceFnEntryProfile sourceCtx address sourceFunction sourceArgs
+      sourceResult profile →
+    Sim.RootsGraph funRel before sourceRest rest →
+    Sim.RootOwnership before (Sim.rootsForWorlds argWorlds args ++ rest) →
+    runCode ctx fuel d before args.reverse d.body = .ok (after, value) →
+    ProfileFundedCodeRun ctx fuel d before args.reverse d.body after value
+      profile
+
+/-- Whole-fuel exact-profile contract for one compiled function. -/
+structure FnProfileContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx)
+    (address : Ixon.Address) (d : FnDef) (argWorlds : List Ixon.Owned)
+    (sourceFunction : IxIR0.Value) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  preserves : ∀ {fuel : Nat},
+    FnProfilePreservesAt funRel sourceCtx ctx address d argWorlds
+      sourceFunction fuel
+
+/-- Function profile preservation below one target evaluator-fuel bound. -/
+structure FnProfileContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx)
+    (address : Ixon.Address) (d : FnDef) (argWorlds : List Ixon.Owned)
+    (sourceFunction : IxIR0.Value) (limit : Nat) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    FnProfilePreservesAt funRel sourceCtx ctx address d argWorlds
+      sourceFunction fuel
+
+theorem FnProfileContract.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {address : Ixon.Address} {d : FnDef}
+    {argWorlds : List Ixon.Owned} {sourceFunction : IxIR0.Value}
+    (hcontract : FnProfileContract funRel sourceCtx ctx address d argWorlds
+      sourceFunction)
+    (limit : Nat) :
+    FnProfileContractBelow funRel sourceCtx ctx address d argWorlds
+      sourceFunction limit :=
+  ⟨hcontract.arity_eq, fun _ => hcontract.preserves⟩
+
+theorem FnProfileContractBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {address : Ixon.Address} {d : FnDef}
+    {argWorlds : List Ixon.Owned} {sourceFunction : IxIR0.Value}
+    {smaller larger : Nat}
+    (hcontract : FnProfileContractBelow funRel sourceCtx ctx address d
+      argWorlds sourceFunction larger)
+    (hbound : smaller ≤ larger) :
+    FnProfileContractBelow funRel sourceCtx ctx address d argWorlds
+      sourceFunction smaller :=
+  ⟨hcontract.arity_eq,
+    fun hfuel => hcontract.preserves (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Exact target-fuel cost preservation for higher-order application.  The
+source relation carries the complete profile of the n-ary source apply
+chain; the target run may recurse through PAP saturation and over-application
+at the independently chosen target evaluator fuel. -/
+def ApplyProfilePreservesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (fuel : Nat) : Prop :=
+  ∀ {before after : Store} {function : RVal} {args : List RVal}
+      {value : RVal} {sourceFunction sourceResult : IxIR0.Value}
+      {sourceArgs : List IxIR0.Value}
+      {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+      {rest : List Sim.Root} {profile : SourceProfile},
+    AllocationOrderInvariant before →
+    Sim.ValueGraph funRel before sourceFunction function →
+    Sim.ValuesGraph funRel before sourceArgs args →
+    SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+      profile →
+    Sim.RootsGraph funRel before sourceRest rest →
+    Sim.RootOwnership before
+      (⟨.shared, function⟩ :: Sim.rootsFor .shared args ++ rest) →
+    sourceArgs ≠ [] →
+    applyGo ctx fuel before function args = .ok (after, value) →
+    ProfileFundedApplyRun ctx fuel before function args after value profile
+
+/-- Whole-context cost contract for higher-order application. -/
+structure ApplyProfileContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  preserves : ∀ {fuel : Nat},
+    ApplyProfilePreservesAt funRel sourceCtx ctx fuel
+
+/-- Higher-order cost preservation below one target evaluator-fuel bound. -/
+structure ApplyProfileContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (limit : Nat) : Prop where
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    ApplyProfilePreservesAt funRel sourceCtx ctx fuel
+
+theorem ApplyProfileContract.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    (hcontract : ApplyProfileContract funRel sourceCtx ctx) (limit : Nat) :
+    ApplyProfileContractBelow funRel sourceCtx ctx limit :=
+  ⟨fun _ => hcontract.preserves⟩
+
+theorem ApplyProfileContractBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontract : ApplyProfileContractBelow funRel sourceCtx ctx larger)
+    (hbound : smaller ≤ larger) :
+    ApplyProfileContractBelow funRel sourceCtx ctx smaller :=
+  ⟨fun hfuel => hcontract.preserves
+    (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Exact target-fuel profile preservation for invoking a function selected
+through `funRel` after its stored PAP prefix has been duplicated. The
+source profile starts at the residual source function, so the conclusion
+returns a core invocation profile and reserves the stored prefix exactly
+once. -/
+def ResidualFnProfilePreservesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (fuel : Nat) : Prop :=
+  ∀ {before after : Store} {sourceFunction sourceResult : IxIR0.Value}
+      {address : Ixon.Address} {arity : Nat}
+      {sourceCaptures sourceArgs : List IxIR0.Value}
+      {captures args : List RVal} {value : RVal}
+      {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+      {rest : List Sim.Root} {profile : SourceProfile},
+    AllocationOrderInvariant before →
+    funRel sourceFunction address arity sourceCaptures →
+    Sim.ValuesGraph funRel before sourceCaptures captures →
+    Sim.ValuesGraph funRel before sourceArgs args →
+    SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+      profile →
+    sourceArgs ≠ [] →
+    (sourceCaptures ++ sourceArgs).length = arity →
+    Sim.RootsGraph funRel before sourceRest rest →
+    Sim.RootOwnership before
+      (Sim.rootsFor .shared (captures ++ args) ++ rest) →
+    invoke ctx fuel address (captures ++ args) before = .ok (after, value) →
+    RetainedProfileFundedInvokeRun ctx fuel address (captures ++ args)
+      before after value sourceCaptures.length profile
+
+structure ResidualFnProfileContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  preserves : ∀ {fuel : Nat},
+    ResidualFnProfilePreservesAt funRel sourceCtx ctx fuel
+
+structure ResidualFnProfileContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (limit : Nat) : Prop where
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    ResidualFnProfilePreservesAt funRel sourceCtx ctx fuel
+
+theorem ResidualFnProfileContract.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    (hcontract : ResidualFnProfileContract funRel sourceCtx ctx)
+    (limit : Nat) :
+    ResidualFnProfileContractBelow funRel sourceCtx ctx limit :=
+  ⟨fun _ => hcontract.preserves⟩
+
+theorem ResidualFnProfileContractBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontract : ResidualFnProfileContractBelow funRel sourceCtx ctx larger)
+    (hbound : smaller ≤ larger) :
+    ResidualFnProfileContractBelow funRel sourceCtx ctx smaller :=
+  ⟨fun hfuel => hcontract.preserves
+    (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Pointwise exact-profile preservation for every source-backed target
+function at one evaluator-fuel index.  Source lookup and reference evaluation
+pin the body contract to the declaration from which it was compiled. -/
+def SourceFnProfilePreservesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) (ctx : Ctx) (fuel : Nat) : Prop :=
+  ∀ {address : Ixon.Address} {source : IxIR0.Decl}
+      {worlds : List Ixon.Owned} {result : Ixon.Owned} {d : FnDef}
+      {sourceFunction : IxIR0.Value},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    SourceRefValue sourceCtx address sourceFunction →
+    FnProfilePreservesAt funRel sourceCtx ctx address d worlds
+      sourceFunction fuel
+
+/-- Declaration profile contracts below one target evaluator-fuel bound. -/
+structure SourceDeclProfileContractsBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) (ctx : Ctx) (limit : Nat) : Prop where
+  fn_preserves : ∀ {fuel : Nat}, fuel < limit →
+    SourceFnProfilePreservesAt funRel sourceCtx src ctx fuel
+
+/-- Public exact-profile contracts for every source-backed target function. -/
+structure SourceDeclProfileContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  fn_preserves : ∀ {fuel : Nat},
+    SourceFnProfilePreservesAt funRel sourceCtx src ctx fuel
+
+/-- Select one unbounded function profile contract from the declaration
+environment once the static layout supplies its arity equality. -/
+theorem SourceDeclProfileContracts.fnContract
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclProfileContracts funRel sourceCtx src ctx)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Ixon.Owned} {result : Ixon.Owned} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (harity : worlds.length = d.arity) :
+    FnProfileContract funRel sourceCtx ctx address d worlds
+      sourceFunction := by
+  refine ⟨harity, ?_⟩
+  intro fuel
+  exact hcontracts.fn_preserves hsrc hsignature hdecl href
+
+/-- Bounded declaration-environment lookup for a function profile
+contract. -/
+theorem SourceDeclProfileContractsBelow.fnContract
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx} {limit : Nat}
+    (hcontracts : SourceDeclProfileContractsBelow funRel sourceCtx src ctx
+      limit)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Ixon.Owned} {result : Ixon.Owned} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (harity : worlds.length = d.arity) :
+    FnProfileContractBelow funRel sourceCtx ctx address d worlds
+      sourceFunction limit := by
+  refine ⟨harity, ?_⟩
+  intro fuel hfuel
+  exact hcontracts.fn_preserves hfuel hsrc hsignature hdecl href
+
+theorem SourceDeclProfileContracts.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclProfileContracts funRel sourceCtx src ctx)
+    (limit : Nat) :
+    SourceDeclProfileContractsBelow funRel sourceCtx src ctx limit :=
+  ⟨fun _ => hcontracts.fn_preserves⟩
+
+theorem SourceDeclProfileContractsBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontracts : SourceDeclProfileContractsBelow funRel sourceCtx src ctx
+      larger)
+    (hbound : smaller ≤ larger) :
+    SourceDeclProfileContractsBelow funRel sourceCtx src ctx smaller :=
+  ⟨fun hfuel => hcontracts.fn_preserves
+    (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Exact-profile contracts needed by source-aware lowering: direct
+declaration calls and higher-order application are sealed together because
+PAP saturation moves recursively between the two evaluator judgments. -/
+structure CompilerProfileContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  decls : SourceDeclProfileContracts funRel sourceCtx src ctx
+  residual : ResidualFnProfileContract funRel sourceCtx ctx
+  apply : ApplyProfileContract funRel sourceCtx ctx
+
+structure CompilerProfileContractsBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) : Prop where
+  decls : SourceDeclProfileContractsBelow funRel sourceCtx src ctx limit
+  residual : ResidualFnProfileContractBelow funRel sourceCtx ctx limit
+  apply : ApplyProfileContractBelow funRel sourceCtx ctx limit
+
+theorem CompilerProfileContracts.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : CompilerProfileContracts funRel sourceCtx src ctx)
+    (limit : Nat) :
+    CompilerProfileContractsBelow funRel sourceCtx src ctx limit :=
+  ⟨hcontracts.decls.below limit, hcontracts.residual.below limit,
+    hcontracts.apply.below limit⟩
+
+theorem CompilerProfileContractsBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx} {smaller larger : Nat}
+    (hcontracts : CompilerProfileContractsBelow funRel sourceCtx src ctx
+      larger)
+    (hbound : smaller ≤ larger) :
+    CompilerProfileContractsBelow funRel sourceCtx src ctx smaller :=
+  ⟨hcontracts.decls.mono hbound, hcontracts.residual.mono hbound,
+    hcontracts.apply.mono hbound⟩
+
+/-- Seal declaration-body and higher-order exact-profile contracts by strong
+induction on the target evaluator fuel. -/
+theorem compilerProfileContracts_of_below_step
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hstep : ∀ limit,
+      CompilerProfileContractsBelow funRel sourceCtx src ctx limit →
+      SourceFnProfilePreservesAt funRel sourceCtx src ctx limit ∧
+        ResidualFnProfilePreservesAt funRel sourceCtx ctx limit ∧
+          ApplyProfilePreservesAt funRel sourceCtx ctx limit) :
+    CompilerProfileContracts funRel sourceCtx src ctx := by
+  have hall : ∀ index,
+      SourceFnProfilePreservesAt funRel sourceCtx src ctx index ∧
+        ResidualFnProfilePreservesAt funRel sourceCtx ctx index ∧
+          ApplyProfilePreservesAt funRel sourceCtx ctx index := by
+    intro index
+    induction index using Nat.strongRecOn with
+    | ind index ih =>
+      apply hstep index
+      refine ⟨⟨?_⟩, ⟨?_⟩, ⟨?_⟩⟩
+      · intro prior hprior
+        exact (ih prior hprior).1
+      · intro prior hprior
+        exact (ih prior hprior).2.1
+      · intro prior hprior
+        exact (ih prior hprior).2.2
+  refine ⟨⟨?_⟩, ⟨?_⟩, ⟨?_⟩⟩
+  · intro fuel
+    exact (hall fuel).1
+  · intro fuel
+    exact (hall fuel).2.1
+  · intro fuel
+    exact (hall fuel).2.2
+
+/-- A direct-call operation simultaneously establishes its semantic graph
+midpoint and consumes the exact source application profile assigned to the
+callee body. -/
+theorem call_graph_profile_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {avs : List AVal} {f : Ixon.Address}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx f d worlds sourceFunction)
+    (hsource : SourceFnEntryProfile sourceCtx f sourceFunction sourceArgs
+      sourceResult profile) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult d.result (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSound.ofOp
+  intro opFuel before after env value horder henv hpre hrun
+  have hsemantic :=
+    call_graph_op hdecl hownership hvalue hsource.toSourceApplies hpre hrun
+  obtain ⟨⟨roots, values, hinput, havs, hvalueGraphs, hrestGraph,
+      hown⟩, _⟩ := hpre
+  have hvaluesWorlds : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  have hsourceWorlds : sourceArgs.length = worlds.length :=
+    hvalueGraphs.length.trans hvaluesWorlds
+  have hvaluesArity : values.length = d.arity :=
+    hvaluesWorlds.trans hcost.arity_eq
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ invokeFuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms, bindOk] at hrun
+    cases invokeFuel with
+    | zero => simp [invoke] at hrun
+    | succ bodyFuel =>
+      have hbne : (values.length != d.arity) = false := by
+        simp [hvaluesArity]
+      simp only [invoke, hdecl, hbne, Bool.false_eq_true, if_false] at hrun
+      cases hbodyRun : runCode ctx bodyFuel d before values.reverse d.body with
+      | error error =>
+          rw [hbodyRun] at hrun
+          contradiction
+      | ok out =>
+          rcases out with ⟨bodyAfter, bodyValue⟩
+          rw [hbodyRun] at hrun
+          have hpair : (bodyAfter, bodyValue) = (after, value) :=
+            (Sim.checkResultWorld_ok hrun).1.symm
+          cases hpair
+          obtain ⟨sourceRoots, hrootsGraph⟩ := hinput.rootsGraph
+          have hcallerGraph : Sim.RootsGraph funRel before
+              (sourceRoots ++ sourceRest) (roots ++ rest) :=
+            hrootsGraph.append hrestGraph
+          have hcallerOwn : Sim.RootOwnership before
+              (Sim.rootsForWorlds worlds values ++ (roots ++ rest)) := by
+            simpa [List.append_assoc] using hown
+          obtain ⟨allowance, hbodyCost, hfunded⟩ :=
+            hcost.preserves horder hvaluesWorlds hsourceWorlds hvalueGraphs
+              hsource hcallerGraph hcallerOwn hbodyRun
+          exact ⟨hsemantic,
+            ⟨allowance,
+              OpOwnershipRunCost.call henv havs.resolveAtoms
+                (InvokeOwnershipRunCost.fn hdecl hvaluesArity hbodyCost
+                  hrun),
+              hfunded⟩⟩
+
+/-- Recursive-self counterpart of `call_graph_profile_op`.  The successful
+operation exposes the strictly smaller current-body run certified by the
+same exact source application prefix. -/
+theorem callSelf_graph_profile_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceAddress : Ixon.Address}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {avs : List AVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hownership : Sim.FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx sourceAddress cur worlds
+      sourceFunction)
+    (hsource : SourceFnEntryProfile sourceCtx sourceAddress sourceFunction
+      sourceArgs sourceResult profile) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult cur.result (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSound.ofOp
+  intro opFuel before after env value horder henv hpre hrun
+  have hsemantic :=
+    callSelf_graph_op hownership hvalue hsource.toSourceApplies hpre hrun
+  obtain ⟨⟨roots, values, hinput, havs, hvalueGraphs, hrestGraph,
+      hown⟩, _⟩ := hpre
+  have hvaluesWorlds : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  have hsourceWorlds : sourceArgs.length = worlds.length :=
+    hvalueGraphs.length.trans hvaluesWorlds
+  have hvaluesArity : values.length = cur.arity :=
+    hvaluesWorlds.trans hcost.arity_eq
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ bodyFuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms, bindOk] at hrun
+    have hbne : (values.length != cur.arity) = false := by
+      simp [hvaluesArity]
+    rw [hbne] at hrun
+    simp only [Bool.false_eq_true, if_false] at hrun
+    cases hbodyRun : runCode ctx bodyFuel cur before values.reverse cur.body
+        with
+    | error error =>
+        rw [hbodyRun] at hrun
+        contradiction
+    | ok out =>
+        rcases out with ⟨bodyAfter, bodyValue⟩
+        rw [hbodyRun] at hrun
+        have hpair : (bodyAfter, bodyValue) = (after, value) :=
+          (Sim.checkResultWorld_ok hrun).1.symm
+        cases hpair
+        obtain ⟨sourceRoots, hrootsGraph⟩ := hinput.rootsGraph
+        have hcallerGraph : Sim.RootsGraph funRel before
+            (sourceRoots ++ sourceRest) (roots ++ rest) :=
+          hrootsGraph.append hrestGraph
+        have hcallerOwn : Sim.RootOwnership before
+            (Sim.rootsForWorlds worlds values ++ (roots ++ rest)) := by
+          simpa [List.append_assoc] using hown
+        obtain ⟨allowance, hbodyCost, hfunded⟩ :=
+          hcost.preserves horder hvaluesWorlds hsourceWorlds hvalueGraphs
+            hsource hcallerGraph hcallerOwn hbodyRun
+        exact ⟨hsemantic,
+          ⟨allowance,
+            OpOwnershipRunCost.callSelf henv havs.resolveAtoms
+              hvaluesArity hbodyCost hrun,
+            hfunded⟩⟩
+
+/-- Fuel-bounded direct-call operation.  The selected function-body run is
+strictly below the enclosing operation index. -/
+theorem call_graph_profile_op_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef} {limit : Nat}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {avs : List AVal} {f : Ixon.Address}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx f d worlds sourceFunction
+      limit)
+    (hsource : SourceFnEntryProfile sourceCtx f sourceFunction sourceArgs
+      sourceResult profile) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult d.result (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.ofOp
+  intro opFuel before after env value hopFuel horder henv hpre hrun
+  have hsemantic :=
+    call_graph_op hdecl hownership hvalue hsource.toSourceApplies hpre hrun
+  obtain ⟨⟨roots, values, hinput, havs, hvalueGraphs, hrestGraph,
+      hown⟩, _⟩ := hpre
+  have hvaluesWorlds : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  have hsourceWorlds : sourceArgs.length = worlds.length :=
+    hvalueGraphs.length.trans hvaluesWorlds
+  have hvaluesArity : values.length = d.arity :=
+    hvaluesWorlds.trans hcost.arity_eq
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ invokeFuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms, bindOk] at hrun
+    cases invokeFuel with
+    | zero => simp [invoke] at hrun
+    | succ bodyFuel =>
+      have hbodyFuel : bodyFuel < limit := by omega
+      have hbne : (values.length != d.arity) = false := by
+        simp [hvaluesArity]
+      simp only [invoke, hdecl, hbne, Bool.false_eq_true, if_false] at hrun
+      cases hbodyRun : runCode ctx bodyFuel d before values.reverse d.body
+          with
+      | error error =>
+          rw [hbodyRun] at hrun
+          contradiction
+      | ok out =>
+          rcases out with ⟨bodyAfter, bodyValue⟩
+          rw [hbodyRun] at hrun
+          have hpair : (bodyAfter, bodyValue) = (after, value) :=
+            (Sim.checkResultWorld_ok hrun).1.symm
+          cases hpair
+          obtain ⟨sourceRoots, hrootsGraph⟩ := hinput.rootsGraph
+          have hcallerGraph : Sim.RootsGraph funRel before
+              (sourceRoots ++ sourceRest) (roots ++ rest) :=
+            hrootsGraph.append hrestGraph
+          have hcallerOwn : Sim.RootOwnership before
+              (Sim.rootsForWorlds worlds values ++ (roots ++ rest)) := by
+            simpa [List.append_assoc] using hown
+          obtain ⟨allowance, hbodyCost, hfunded⟩ :=
+            hcost.preserves hbodyFuel horder hvaluesWorlds hsourceWorlds
+              hvalueGraphs hsource hcallerGraph hcallerOwn hbodyRun
+          exact ⟨hsemantic,
+            ⟨allowance,
+              OpOwnershipRunCost.call henv havs.resolveAtoms
+                (InvokeOwnershipRunCost.fn hdecl hvaluesArity hbodyCost
+                  hrun),
+              hfunded⟩⟩
+
+/-- Fuel-bounded recursive-self operation. -/
+theorem callSelf_graph_profile_op_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {sourceAddress : Ixon.Address}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {avs : List AVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hownership : Sim.FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur worlds
+      sourceFunction limit)
+    (hsource : SourceFnEntryProfile sourceCtx sourceAddress sourceFunction
+      sourceArgs sourceResult profile) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult cur.result (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.ofOp
+  intro opFuel before after env value hopFuel horder henv hpre hrun
+  have hsemantic :=
+    callSelf_graph_op hownership hvalue hsource.toSourceApplies hpre hrun
+  obtain ⟨⟨roots, values, hinput, havs, hvalueGraphs, hrestGraph,
+      hown⟩, _⟩ := hpre
+  have hvaluesWorlds : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  have hsourceWorlds : sourceArgs.length = worlds.length :=
+    hvalueGraphs.length.trans hvaluesWorlds
+  have hvaluesArity : values.length = cur.arity :=
+    hvaluesWorlds.trans hcost.arity_eq
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ bodyFuel =>
+    have hbodyFuel : bodyFuel < limit := by omega
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms, bindOk] at hrun
+    have hbne : (values.length != cur.arity) = false := by
+      simp [hvaluesArity]
+    rw [hbne] at hrun
+    simp only [Bool.false_eq_true, if_false] at hrun
+    cases hbodyRun : runCode ctx bodyFuel cur before values.reverse cur.body
+        with
+    | error error =>
+        rw [hbodyRun] at hrun
+        contradiction
+    | ok out =>
+        rcases out with ⟨bodyAfter, bodyValue⟩
+        rw [hbodyRun] at hrun
+        have hpair : (bodyAfter, bodyValue) = (after, value) :=
+          (Sim.checkResultWorld_ok hrun).1.symm
+        cases hpair
+        obtain ⟨sourceRoots, hrootsGraph⟩ := hinput.rootsGraph
+        have hcallerGraph : Sim.RootsGraph funRel before
+            (sourceRoots ++ sourceRest) (roots ++ rest) :=
+          hrootsGraph.append hrestGraph
+        have hcallerOwn : Sim.RootOwnership before
+            (Sim.rootsForWorlds worlds values ++ (roots ++ rest)) := by
+          simpa [List.append_assoc] using hown
+        obtain ⟨allowance, hbodyCost, hfunded⟩ :=
+          hcost.preserves hbodyFuel horder hvaluesWorlds hsourceWorlds
+            hvalueGraphs hsource hcallerGraph hcallerOwn hbodyRun
+        exact ⟨hsemantic,
+          ⟨allowance,
+            OpOwnershipRunCost.callSelf henv havs.resolveAtoms
+              hvaluesArity hbodyCost hrun,
+            hfunded⟩⟩
+
+/-- Profiled argument evaluation followed by one exact direct call. -/
+theorem LowerArgsProfileSound.call_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {argsProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceArgs worlds emit avs argsProfile)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx f d worlds sourceFunction)
+    (hsource : SourceFnEntryProfile sourceCtx f sourceFunction sourceArgs
+      sourceResult callProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + callProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.call_graph hdecl hownership hvalue
+          hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (call_graph_profile_op hdecl hownership hvalue hcost hsource)
+
+/-- Profiled argument evaluation followed by one exact recursive self call. -/
+theorem LowerArgsProfileSound.callSelf_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceAddress : Ixon.Address}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {argsProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceArgs worlds emit avs argsProfile)
+    (hownership : Sim.FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx sourceAddress cur worlds
+      sourceFunction)
+    (hsource : SourceFnEntryProfile sourceCtx sourceAddress sourceFunction
+      sourceArgs sourceResult callProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + callProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_graph hownership hvalue
+          hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (callSelf_graph_profile_op hownership hvalue hcost hsource)
+
+theorem LowerArgsProfileSoundBelow.call_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {argsProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs
+      argsProfile)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx f d worlds sourceFunction
+      limit)
+    (hsource : SourceFnEntryProfile sourceCtx f sourceFunction sourceArgs
+      sourceResult callProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + callProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.call_graph hdecl hownership hvalue
+          hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (call_graph_profile_op_below hdecl hownership hvalue hcost hsource)
+
+theorem LowerArgsProfileSoundBelow.callSelf_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {sourceAddress : Ixon.Address}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {argsProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs
+      argsProfile)
+    (hownership : Sim.FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur worlds
+      sourceFunction limit)
+    (hsource : SourceFnEntryProfile sourceCtx sourceAddress sourceFunction
+      sourceArgs sourceResult callProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + callProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_graph hownership hvalue
+          hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (callSelf_graph_profile_op_below hownership hvalue hcost hsource)
+
+theorem LowerResultProfileSound.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {left right : SourceProfile}
+    (hsound : LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av left)
+    (hprofile : left = right) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av right := by
+  subst right
+  exact hsound
+
+theorem LowerResultProfileSound.monoProfile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {smaller larger : SourceProfile}
+    (hsound : LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av larger := by
+  refine
+    { toLowerResultValueSound := hsound.toLowerResultValueSound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hrun : ProfileFundedEmitStateRunSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest slots)
+      smaller :=
+    hsound.profileEmits sourceRest rest slots
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hcodeRun hcontinuation
+  exact (ProfileFundedEmitStateRunSound.monoProfile hrun hle)
+    horder henv hpre hcodeRun hcontinuation
+
+/-- A semantically inert source-profile fragment may be added to the left
+of an already-funded result.  This accounts for source work that static
+lowering erases, such as evaluation of a statically known spine head. -/
+theorem LowerResultProfileSound.addProfileLeft
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Ixon.Owned}
+    {emit : Emit} {av : AVal} {profile : SourceProfile}
+    (hsound : LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av profile)
+    (extra : SourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av (extra + profile) := by
+  apply hsound.monoProfile
+  rw [sourceProfileOwnershipAllowance_add]
+  simp [OwnershipAllowanceLE, OwnershipAllowance.add]
+
+/-- A static direct call assigns the source head fragment to a nullary body
+and the source application fragment to a positive-arity body.  In both cases
+the resulting profile is the same canonical head/arguments/applications
+sum used by flattened spines. -/
+theorem LowerArgsProfileSound.call_graph_from_ref
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {argsProfile headProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceArgs worlds emit avs argsProfile)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx f d worlds sourceFunction)
+    (hhead : SourceRefProfile sourceCtx f sourceFunction headProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult callProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (headProfile + argsProfile + callProfile) := by
+  cases hsource with
+  | nil =>
+      have hcalled := hargs.call_graph hdecl hownership hvalue hcost
+        (SourceFnEntryProfile.nullary hhead)
+      apply LowerResultProfileSound.of_profile_eq hcalled
+      ext <;> simp [Nat.add_comm]
+  | cons hstep htail =>
+      have hcalled := hargs.call_graph hdecl hownership hvalue hcost
+        (SourceFnEntryProfile.applied
+          (SourceAppliesProfile.cons hstep htail))
+      apply LowerResultProfileSound.of_profile_eq
+        (hcalled.addProfileLeft headProfile)
+      exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Target-fuel-bounded counterpart of `call_graph_from_ref`. -/
+theorem LowerArgsProfileSoundBelow.call_graph_from_ref
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {argsProfile headProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs
+      argsProfile)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx f d worlds sourceFunction
+      limit)
+    (hhead : SourceRefProfile sourceCtx f sourceFunction headProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult callProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (headProfile + argsProfile + callProfile) := by
+  cases hsource with
+  | nil =>
+      have hcalled := hargs.call_graph hdecl hownership hvalue hcost
+        (SourceFnEntryProfile.nullary hhead)
+      apply LowerResultProfileSoundBelow.of_profile_eq hcalled
+      ext <;> simp [Nat.add_comm]
+  | cons hstep htail =>
+      have hcalled := hargs.call_graph hdecl hownership hvalue hcost
+        (SourceFnEntryProfile.applied
+          (SourceAppliesProfile.cons hstep htail))
+      apply LowerResultProfileSoundBelow.of_profile_eq
+        (hcalled.addProfileLeft headProfile)
+      exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Recursive-self call where the semantic and profile contracts are both
+selected by the synthetic `recSelf` witness stored in the input relation. -/
+theorem LowerArgsProfileSound.callSelf_entry_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {argsProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceArgs worlds emit avs argsProfile)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hownership : Sim.FnOwnershipContract ctx cur worlds)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hcost : recSelfRel sourceFunction arity →
+      ∃ sourceAddress,
+        FnProfileContract funRel sourceCtx ctx sourceAddress cur worlds
+          sourceFunction)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult callProfile)
+    (hnonempty : sourceArgs ≠ []) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + callProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_entry_graph hentry hhead
+          hownership hvalue hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  have hpreData := hpre
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpreData
+  obtain ⟨source, hsourceLookup, hself⟩ := hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  obtain ⟨sourceAddress, hcost⟩ := hcost hself
+  have hentryProfile : SourceFnEntryProfile sourceCtx sourceAddress
+      sourceFunction sourceArgs sourceResult callProfile :=
+    hsource.toFnEntryProfile hnonempty
+  have hcomposed : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult cur.result (.slotA output.depth) sourceRest rest slots)
+      (argsProfile + callProfile) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hargs.profileEmits sourceRest rest slots)
+      (callSelf_graph_profile_op hownership (hvalue hself) hcost
+        hentryProfile)
+  exact hcomposed horder henv hpre hrun hcontinuation
+
+/-- Fuel-bounded recursive-self call whose semantic and profile contracts
+are selected by the synthetic `recSelf` witness in the input relation. -/
+theorem LowerArgsProfileSoundBelow.callSelf_entry_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Ixon.Owned} {emit : Emit} {avs : List AVal}
+    {argsProfile callProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs
+      argsProfile)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hownership : Sim.FnOwnershipContract ctx cur worlds)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hcost : recSelfRel sourceFunction arity →
+      ∃ sourceAddress,
+        FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur worlds
+          sourceFunction limit)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult callProfile)
+    (hnonempty : sourceArgs ≠ []) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + callProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_entry_graph hentry hhead
+          hownership hvalue hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  have hpreData := hpre
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpreData
+  obtain ⟨source, hsourceLookup, hself⟩ := hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  obtain ⟨sourceAddress, hcost⟩ := hcost hself
+  have hentryProfile : SourceFnEntryProfile sourceCtx sourceAddress
+      sourceFunction sourceArgs sourceResult callProfile :=
+    hsource.toFnEntryProfile hnonempty
+  have hcomposed : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult cur.result (.slotA output.depth) sourceRest rest slots)
+      (argsProfile + callProfile) :=
+    ProfileFundedEmitStateRunSoundBelow.comp
+      (hargs.profileEmits sourceRest rest slots)
+      (callSelf_graph_profile_op_below hownership (hvalue hself)
+        hcost hentryProfile)
+  exact hcomposed bound hbound hfuel horder henv hpre hrun hcontinuation
+
+/-- A PAP allocation at the profiled operation midpoint.  Any profile with
+at least one source evaluation funds the single fresh shared node. -/
+theorem papp_graph_profile_op_of_evals_pos
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {output : VEnv} {sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d)
+    (hpos : 0 < profile.evals) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues (List.replicate avs.length .shared) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceValue .shared (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSound.localOp (allowance := ⟨1, 1⟩)
+    (papp_graph_op hdecl hfun hunder)
+  · simp [localOpOwnershipAllowance]
+  · exact allocatedNodeAllowance_le_profile_of_evals_pos hpos
+
+/-- Profiled shared arguments followed by PAP allocation, funded by any
+nonempty enclosing source-evaluation profile. -/
+theorem LowerArgsProfileSound.papp_graph_of_evals_pos
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    {argsProfile opProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs argsProfile)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d)
+    (hpos : 0 < opProfile.evals) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + opProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.papp_graph hdecl hfun hunder
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (papp_graph_profile_op_of_evals_pos hdecl hfun hunder hpos)
+
+/-- Fuel-bounded PAP allocation at the profiled operation midpoint. -/
+theorem papp_graph_profile_op_of_evals_pos_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {output : VEnv} {sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d)
+    (hpos : 0 < profile.evals) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues (List.replicate avs.length .shared) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceValue .shared (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.localOp
+    (allowance := ⟨1, 1⟩) (papp_graph_op hdecl hfun hunder)
+  · simp [localOpOwnershipAllowance]
+  · exact allocatedNodeAllowance_le_profile_of_evals_pos hpos
+
+/-- Fuel-bounded profiled shared arguments followed by PAP allocation. -/
+theorem LowerArgsProfileSoundBelow.papp_graph_of_evals_pos
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    {argsProfile opProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs argsProfile)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d)
+    (hpos : 0 < opProfile.evals) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + opProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.papp_graph hdecl hfun hunder
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (papp_graph_profile_op_of_evals_pos_below hdecl hfun hunder hpos)
+
+/-- Constructor allocation at the profiled operation midpoint. -/
+theorem alloc_graph_profile_op_of_evals_pos
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {output : VEnv}
+    {sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Ixon.Owned} {avs : List AVal} {cid : CtorId}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hpos : 0 < profile.evals) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues (List.replicate avs.length world) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        (.ctor sourceAddress sourceTag sourceValues) world
+        (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSound.localOp (allowance := ⟨1, 1⟩)
+    (alloc_graph_op haddress htag)
+  · simp [localOpOwnershipAllowance]
+  · exact allocatedNodeAllowance_le_profile_of_evals_pos hpos
+
+/-- Profiled arguments followed by constructor allocation. -/
+theorem LowerArgsProfileSound.alloc_graph_of_evals_pos
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Ixon.Owned} {emit : Emit} {avs : List AVal} {cid : CtorId}
+    {argsProfile opProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length world) emit avs argsProfile)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hpos : 0 < opProfile.evals) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput (.ctor sourceAddress sourceTag sourceValues)
+      world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + opProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.alloc_graph haddress htag
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (alloc_graph_profile_op_of_evals_pos haddress htag hpos)
+
+/-- Fuel-bounded constructor allocation at the profiled operation
+midpoint. -/
+theorem alloc_graph_profile_op_of_evals_pos_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {output : VEnv}
+    {sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Ixon.Owned} {avs : List AVal} {cid : CtorId}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hpos : 0 < profile.evals) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues (List.replicate avs.length world) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        (.ctor sourceAddress sourceTag sourceValues) world
+        (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.localOp
+    (allowance := ⟨1, 1⟩) (alloc_graph_op haddress htag)
+  · simp [localOpOwnershipAllowance]
+  · exact allocatedNodeAllowance_le_profile_of_evals_pos hpos
+
+/-- Fuel-bounded profiled arguments followed by constructor allocation. -/
+theorem LowerArgsProfileSoundBelow.alloc_graph_of_evals_pos
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Ixon.Owned} {emit : Emit} {avs : List AVal} {cid : CtorId}
+    {argsProfile opProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues
+      (List.replicate avs.length world) emit avs argsProfile)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hpos : 0 < opProfile.evals) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput
+      (.ctor sourceAddress sourceTag sourceValues) world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + opProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.alloc_graph haddress htag
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (alloc_graph_profile_op_of_evals_pos_below haddress htag hpos)
+
+/-- A scalar extern operation is ownership-free; its semantic result is
+paired with any exact source profile assigned to the saturated prefix. -/
+theorem extern_graph_profile_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {avs : List AVal} {f : Ixon.Address} {arity : Nat}
+    {resultWorld : Ixon.Owned}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult profile) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs (List.replicate avs.length .shared) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult resultWorld (.slotA output.depth) sourceRest rest
+        slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSound.localZero
+    (extern_graph_op hcontract hlookup href hlength hsource.toSourceApplies)
+  simp [localOpOwnershipAllowance]
+
+/-- Profiled arguments followed by a scalar extern operation. -/
+theorem LowerArgsProfileSound.extern_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {f : Ixon.Address}
+    {arity : Nat} {resultWorld : Ixon.Owned}
+    {argsProfile externProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs argsProfile)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult externProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + externProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.extern_graph hcontract hlookup href
+          hlength hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (extern_graph_profile_op hcontract hlookup href hlength hsource)
+
+/-- Fuel-bounded scalar extern operation. -/
+theorem extern_graph_profile_op_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {avs : List AVal} {f : Ixon.Address} {arity : Nat}
+    {resultWorld : Ixon.Owned}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    {profile : SourceProfile}
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult profile) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs (List.replicate avs.length .shared) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult resultWorld (.slotA output.depth) sourceRest rest
+        slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.localZero
+    (extern_graph_op hcontract hlookup href hlength hsource.toSourceApplies)
+  simp [localOpOwnershipAllowance]
+
+/-- Fuel-bounded profiled arguments followed by a scalar extern. -/
+theorem LowerArgsProfileSoundBelow.extern_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {f : Ixon.Address}
+    {arity : Nat} {resultWorld : Ixon.Owned}
+    {argsProfile externProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs argsProfile)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult externProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (argsProfile + externProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.extern_graph hcontract hlookup href
+          hlength hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hargs.profileEmits sourceRest rest slots)
+    (extern_graph_profile_op_below hcontract hlookup href hlength hsource)
+
+/-- The dynamic target `apply` primitive, indexed by the protected
+post-argument semantic state and funded by its exact source apply chain. -/
+theorem apply_graph_profile_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {functionInput output : VEnv} {functionEnv : List RVal}
+    {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {avs : List AVal} {function : AVal} {functionValue : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root}
+    {slots : List (Nat × RVal)} {profile : SourceProfile}
+    (hfunctionStable : AValStable function)
+    (hfunction : AValRealizes functionInput functionEnv function
+      functionValue)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult profile)
+    (hnonempty : sourceArgs ≠ []) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest)
+        (⟨.shared, functionValue⟩ :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSound.ofOp
+  intro opFuel before after env value horder henv hpre hrun
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hsemantic :=
+      apply_graph_op hfunctionStable hfunction hownership hvalue
+        hsource.toSourceApplies hpre hrun
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraph, hownArgs⟩, hslots⟩ := hpre
+    cases hframeGraph with
+    | cons _ _ hfunctionGraph hrestGraph =>
+      have hfunctionFinal :
+          AValRealizes output env function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslots.left_of_append
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          Sim.rootsForWorlds (List.replicate avs.length .shared) values =
+            Sim.rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : Sim.RootOwnership before
+          (⟨.shared, functionValue⟩ :: Sim.rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [hroots, List.append_assoc] using
+          (permExtractRoot ⟨.shared, functionValue⟩
+            (Sim.rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel before
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel before
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraph
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      rw [hfunctionFinal.resolveAtom, bindOk, havs.resolveAtoms, bindOk]
+        at hrun
+      obtain ⟨allowance, happlyCost, happlyFunded⟩ :=
+        hcost.preserves horder
+          (by simpa using hfunctionGraph) hvalueGraphs hsource
+          hcombinedFrame hownApply hnonempty hrun
+      exact ⟨hsemantic,
+        ⟨allowance,
+          OpOwnershipRunCost.apply henv hfunctionFinal.resolveAtom
+            havs.resolveAtoms happlyCost,
+          happlyFunded⟩⟩
+
+/-- Fuel-bounded dynamic application operation.  The selected `applyGo`
+run is strictly below the enclosing operation index. -/
+theorem apply_graph_profile_op_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {functionInput output : VEnv} {functionEnv : List RVal}
+    {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {avs : List AVal} {function : AVal} {functionValue : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root}
+    {slots : List (Nat × RVal)} {profile : SourceProfile}
+    (hfunctionStable : AValStable function)
+    (hfunction : AValRealizes functionInput functionEnv function
+      functionValue)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult profile)
+    (hnonempty : sourceArgs ≠ []) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest)
+        (⟨.shared, functionValue⟩ :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots)
+      profile := by
+  apply ProfileFundedEmitStateRunSoundBelow.ofOp
+  intro opFuel before after env value hopFuel horder henv hpre hrun
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hfuel : fuel < limit := by omega
+    have hsemantic :=
+      apply_graph_op hfunctionStable hfunction hownership hvalue
+        hsource.toSourceApplies hpre hrun
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraph, hownArgs⟩, hslots⟩ := hpre
+    cases hframeGraph with
+    | cons _ _ hfunctionGraph hrestGraph =>
+      have hfunctionFinal :
+          AValRealizes output env function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslots.left_of_append
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          Sim.rootsForWorlds (List.replicate avs.length .shared) values =
+            Sim.rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : Sim.RootOwnership before
+          (⟨.shared, functionValue⟩ :: Sim.rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [hroots, List.append_assoc] using
+          (permExtractRoot ⟨.shared, functionValue⟩
+            (Sim.rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel before
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel before
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraph
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      rw [hfunctionFinal.resolveAtom, bindOk, havs.resolveAtoms, bindOk]
+        at hrun
+      obtain ⟨allowance, happlyCost, happlyFunded⟩ :=
+        hcost.preserves hfuel horder
+          (by simpa using hfunctionGraph) hvalueGraphs hsource
+          hcombinedFrame hownApply hnonempty hrun
+      exact ⟨hsemantic,
+        ⟨allowance,
+          OpOwnershipRunCost.apply henv hfunctionFinal.resolveAtom
+            havs.resolveAtoms happlyCost,
+          happlyFunded⟩⟩
+
+/-- Profiled argument lowering while framing an already-produced function,
+followed by one exact source-funded higher-order application. -/
+theorem LowerArgsProfileSound.apply_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    {argsProfile applyProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs argsProfile)
+    (hfunctionStable : AValStable function)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult applyProfile)
+    (hnonempty : sourceArgs ≠ []) :
+    ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots)
+        (argsProfile + applyProfile) := by
+  intro sourceRest rest slots
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hpre
+  let functionRoot : Sim.Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : Sim.HasWorld before .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel before
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : Sim.RootOwnership before
+      (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (permExtractRoot functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) before env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happly : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots)
+      applyProfile := by
+    dsimp only [functionRoot]
+    exact apply_graph_profile_op
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      (functionInput := input) (output := output)
+      (functionEnv := env) (sourceOutput := sourceOutput)
+      (sourceArgs := sourceArgs) (sourceFunction := sourceFunction)
+      (sourceResult := sourceResult) (avs := avs)
+      (function := function) (functionValue := functionValue)
+      (sourceRest := sourceRest) (rest := rest) (slots := slots)
+      (profile := applyProfile) hfunctionStable hfunction hownership
+      hvalue hcost hsource hnonempty
+  have hrunCost : ProfileFundedCodeRun ctx fuel cur before env
+      ((emit ∘ emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray)) continuation)
+      after value (argsProfile + (applyProfile + continuationProfile)) := by
+    exact (hargs.profileEmits
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots))
+      horder henv hargsPre hrun (by
+        intro restFuel restBefore restEnv hrestOrder hrestBounds hargsPost
+          hrestRun
+        exact happly hrestOrder hrestBounds hargsPost hrestRun
+          hcontinuation)
+  exact ProfileFundedCodeRun.of_profile_eq hrunCost
+    (IxIR0.DynamicCost.Profile.add_assoc
+      argsProfile applyProfile continuationProfile).symm
+
+/-- Fuel-bounded profiled argument lowering while framing an
+already-produced function, followed by one exact source-funded dynamic
+application. -/
+theorem LowerArgsProfileSoundBelow.apply_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    {argsProfile applyProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs argsProfile)
+    (hfunctionStable : AValStable function)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult applyProfile)
+    (hnonempty : sourceArgs ≠ []) :
+    ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots)
+        (argsProfile + applyProfile) := by
+  intro sourceRest rest slots
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hpre
+  let functionRoot : Sim.Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : Sim.HasWorld before .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel before
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : Sim.RootOwnership before
+      (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (permExtractRoot functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) before env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happly : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots)
+      applyProfile := by
+    dsimp only [functionRoot]
+    exact apply_graph_profile_op_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      (limit := limit) (functionInput := input) (output := output)
+      (functionEnv := env) (sourceOutput := sourceOutput)
+      (sourceArgs := sourceArgs) (sourceFunction := sourceFunction)
+      (sourceResult := sourceResult) (avs := avs)
+      (function := function) (functionValue := functionValue)
+      (sourceRest := sourceRest) (rest := rest) (slots := slots)
+      (profile := applyProfile) hfunctionStable hfunction hownership
+      hvalue hcost hsource hnonempty
+  have hrunCost : ProfileFundedCodeRun ctx fuel cur before env
+      ((emit ∘ emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray)) continuation)
+      after value (argsProfile + (applyProfile + continuationProfile)) := by
+    exact (hargs.profileEmits
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots))
+      bound hbound hfuel horder henv hargsPre hrun (by
+        intro restFuel restBefore restEnv hrestFuel hrestOrder hrestBounds
+          hargsPost hrestRun
+        exact happly bound hbound hrestFuel hrestOrder hrestBounds hargsPost
+          hrestRun hcontinuation)
+  exact ProfileFundedCodeRun.of_profile_eq hrunCost
+    (IxIR0.DynamicCost.Profile.add_assoc
+      argsProfile applyProfile continuationProfile).symm
+
+/-- Full profiled non-erased application: produce the function, evaluate
+shared arguments left-to-right, and consume the exact profiled source apply
+chain through target `apply`. -/
+theorem LowerResultProfileSound.applyArgs_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    (hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function functionProfile)
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs argsProfile)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult applyProfile)
+    (hnonempty : sourceArgs ≠ []) :
+    LowerResultProfileSound funRel recSelfRel ctx cur
+      start output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth)
+      (functionProfile + argsProfile + applyProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.applyArgs_graph
+          hargs.toLowerArgsValueSound hownership hvalue
+            hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  have hcomposed : ProfileFundedEmitStateRunSound ctx cur
+      (emitFunction ∘ (emitArgs ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray)))
+      (GraphOwnsVEnvProtected funRel recSelfRel start sourceStart
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots)
+      (functionProfile + (argsProfile + applyProfile)) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hfunction.profileEmits sourceRest rest slots)
+      (hargs.apply_graph hfunction.stable hownership hvalue hcost hsource
+        hnonempty sourceRest rest slots)
+  have hcostRun := hcomposed horder henv hpre hrun hcontinuation
+  apply ProfileFundedCodeRun.of_profile_eq hcostRun
+  exact congrArg (fun profile => profile + continuationProfile)
+    (IxIR0.DynamicCost.Profile.add_assoc
+      functionProfile argsProfile applyProfile).symm
+
+/-- Fuel-bounded full non-erased application: function prefix, strict
+arguments, and the recursive target `apply` operation share one target-fuel
+ceiling. -/
+theorem LowerResultProfileSoundBelow.applyArgs_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    (hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur
+      limit start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function functionProfile)
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs argsProfile)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult applyProfile)
+    (hnonempty : sourceArgs ≠ []) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start
+      output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth)
+      (functionProfile + argsProfile + applyProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.applyArgs_graph
+          hargs.toLowerArgsValueSound hownership hvalue
+            hsource.toSourceApplies
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hcomposed : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitFunction ∘ (emitArgs ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray)))
+      (GraphOwnsVEnvProtected funRel recSelfRel start sourceStart
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots)
+      (functionProfile + (argsProfile + applyProfile)) :=
+    ProfileFundedEmitStateRunSoundBelow.comp
+      (hfunction.profileEmits sourceRest rest slots)
+      (hargs.apply_graph hfunction.stable hownership hvalue hcost hsource
+        hnonempty sourceRest rest slots)
+  exact ProfileFundedEmitStateRunSoundBelow.of_profile_eq hcomposed
+    (IxIR0.DynamicCost.Profile.add_assoc
+      functionProfile argsProfile applyProfile).symm
+
+/-- Forget an ownership-inert constant result at the exact semantic
+boundary.  The identity target prefix has zero paired ownership cost. -/
+theorem discard_const_result_profile_state
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Ixon.Owned} {atom : Atom}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hstable : AValStable (.constA atom)) :
+    ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+        sourceValue world (.constA atom) sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+        sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSound.id
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, _, hrestGraph, hown⟩,
+      hslots⟩ := hpre
+  exact ⟨⟨roots, hΓ, hrestGraph,
+    hown.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- Drop an inert constant from the front of an argument vector without a
+runtime operation or paired ownership charge. -/
+theorem discard_const_arg_profile_state
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {atom : Atom}
+    {worlds : List Ixon.Owned} {avs : List AVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hstable : AValStable (.constA atom)) :
+    ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+        (source :: sources) (.shared :: worlds) (.constA atom :: avs)
+        sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+        sources worlds avs sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSound.id
+  intro store env hpre
+  obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons _ _ _ _ value tailValues hav htail =>
+    cases hvalueGraphs with
+    | cons _ htailGraphs =>
+      have howned : Sim.RootOwnership store
+          (⟨.shared, value⟩ ::
+            (Sim.rootsForWorlds worlds tailValues ++ roots ++ rest)) := by
+        simpa [Sim.rootsForWorlds] using hown
+      exact ⟨⟨roots, tailValues, hΓ, htail, htailGraphs,
+        hrestGraph,
+        howned.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- One slot-backed argument release uses the semantic destructive-drop
+midpoint and the local zero allowance assigned to `drop`. -/
+theorem discard_slot_arg_profile_state
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Ixon.Owned} {avs : List AVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (htailStable : AValsStable avs) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.drop (.var (Γ.rel abs))))
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+        (source :: sources) (.shared :: worlds) (.slotA abs :: avs)
+        sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump sourceEnv
+        sources worlds avs sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSound.localZero
+  · exact discard_slot_arg_value_op htailStable
+  · simp [localOpOwnershipAllowance]
+
+/-- Re-introduce the erased scalar result after an absorbed application has
+released all temporary argument owners. -/
+theorem erased_result_profile_state
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Ixon.Owned}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)} :
+    ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit)
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv .erased
+        world (.constA .erased) sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSound.id
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, .erased, hΓ, .const rfl, .erased, hrestGraph,
+    hown.addNoLocation rfl⟩, hslots⟩
+
+/-- At a fixed target-fuel ceiling, forget an ownership-inert constant result at the exact semantic
+boundary.  The identity target prefix has zero paired ownership cost. -/
+theorem discard_const_result_profile_state_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Ixon.Owned} {atom : Atom}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hstable : AValStable (.constA atom)) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+        sourceValue world (.constA atom) sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+        sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSoundBelow.id
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, _, hrestGraph, hown⟩,
+      hslots⟩ := hpre
+  exact ⟨⟨roots, hΓ, hrestGraph,
+    hown.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- Drop an inert constant from the front of an argument vector without a
+runtime operation or paired ownership charge. -/
+theorem discard_const_arg_profile_state_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {atom : Atom}
+    {worlds : List Ixon.Owned} {avs : List AVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hstable : AValStable (.constA atom)) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+        (source :: sources) (.shared :: worlds) (.constA atom :: avs)
+        sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+        sources worlds avs sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSoundBelow.id
+  intro store env hpre
+  obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons _ _ _ _ value tailValues hav htail =>
+    cases hvalueGraphs with
+    | cons _ htailGraphs =>
+      have howned : Sim.RootOwnership store
+          (⟨.shared, value⟩ ::
+            (Sim.rootsForWorlds worlds tailValues ++ roots ++ rest)) := by
+        simpa [Sim.rootsForWorlds] using hown
+      exact ⟨⟨roots, tailValues, hΓ, htail, htailGraphs,
+        hrestGraph,
+        howned.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- One slot-backed argument release uses the semantic destructive-drop
+midpoint and the local zero allowance assigned to `drop`. -/
+theorem discard_slot_arg_profile_state_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Ixon.Owned} {avs : List AVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (htailStable : AValsStable avs) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.rel abs))))
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+        (source :: sources) (.shared :: worlds) (.slotA abs :: avs)
+        sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump sourceEnv
+        sources worlds avs sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSoundBelow.localZero
+  · exact discard_slot_arg_value_op htailStable
+  · simp [localOpOwnershipAllowance]
+
+/-- Single bounded induction for releasing a stable shared argument vector.
+Source-length inversion, slot/literal/erased dispatch, environment threading,
+and zero-profile emitter composition are independent of whether the caller
+needs an exact or target-fuel-bounded interface. -/
+private theorem releaseAll_profile_state_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length)
+    (profile : SourceProfile) :
+    ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (releaseAll Γ avs).2
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValues (List.replicate avs.length .shared) avs
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel (releaseAll Γ avs).1
+          sourceEnv sourceRest rest slots) profile := by
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+    (smaller := 0) (larger := profile)
+  · exact AValsStable.traverseAligned
+      (Result := fun current currentSources currentAvs =>
+        ProfileFundedEmitStateRunSoundBelow ctx cur limit
+          (releaseAll current currentAvs).2
+          (GraphOwnsArgsResultProtected funRel recSelfRel current sourceEnv
+            currentSources (List.replicate currentAvs.length .shared)
+            currentAvs sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel
+            (releaseAll current currentAvs).1 sourceEnv sourceRest rest slots)
+          0)
+      (hnil := by
+        intro current
+        change ProfileFundedEmitStateRunSoundBelow ctx cur limit
+          (_root_.id : Emit)
+          (GraphOwnsArgsResultProtected funRel recSelfRel current
+            sourceEnv [] [] [] sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel current sourceEnv
+            sourceRest rest slots) 0
+        apply ProfileFundedEmitStateRunSoundBelow.id
+        intro store env hpre
+        obtain ⟨⟨roots, values, hcurrent, havs, hgraphs,
+            hrestGraph, hown⟩, hslots⟩ := hpre
+        cases havs
+        cases hgraphs
+        exact ⟨⟨roots, hcurrent, hrestGraph,
+          by simpa [Sim.rootsForWorlds] using hown⟩, hslots⟩)
+      (hslot := by
+        intro current source sources abs currentAvs htail ih
+        change ProfileFundedEmitStateRunSoundBelow ctx cur limit
+          (emitOp (.drop (.var (current.rel abs))) ∘
+            (releaseAll current.bump currentAvs).2)
+          (GraphOwnsArgsResultProtected funRel recSelfRel current
+            sourceEnv (source :: sources)
+            (.shared :: List.replicate currentAvs.length .shared)
+            (.slotA abs :: currentAvs) sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel
+            (releaseAll current.bump currentAvs).1 sourceEnv sourceRest rest
+            slots) 0
+        apply ProfileFundedEmitStateRunSoundBelow.of_profile_eq
+          (ProfileFundedEmitStateRunSoundBelow.comp
+          (discard_slot_arg_profile_state_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := current)
+            (sourceEnv := sourceEnv) (source := source)
+            (sources := sources) (abs := abs)
+            (worlds := List.replicate currentAvs.length .shared)
+            (avs := currentAvs) (sourceRest := sourceRest) (rest := rest)
+            (slots := slots) htail)
+          ih)
+        exact IxIR0.DynamicCost.Profile.zero_add 0)
+      (hlit := by
+        intro current source sources literal currentAvs htail ih
+        change ProfileFundedEmitStateRunSoundBelow ctx cur limit
+          ((_root_.id : Emit) ∘ (releaseAll current currentAvs).2)
+          (GraphOwnsArgsResultProtected funRel recSelfRel current
+            sourceEnv (source :: sources)
+            (.shared :: List.replicate currentAvs.length .shared)
+            (.constA (.lit literal) :: currentAvs) sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel
+            (releaseAll current currentAvs).1 sourceEnv sourceRest rest slots)
+          0
+        apply ProfileFundedEmitStateRunSoundBelow.of_profile_eq
+          (ProfileFundedEmitStateRunSoundBelow.comp
+          (discard_const_arg_profile_state_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := current)
+            (sourceEnv := sourceEnv) (source := source)
+            (sources := sources) (atom := .lit literal)
+            (worlds := List.replicate currentAvs.length .shared)
+            (avs := currentAvs) (sourceRest := sourceRest) (rest := rest)
+            (slots := slots) .lit)
+          ih)
+        exact IxIR0.DynamicCost.Profile.zero_add 0)
+      (herased := by
+        intro current source sources currentAvs htail ih
+        change ProfileFundedEmitStateRunSoundBelow ctx cur limit
+          ((_root_.id : Emit) ∘ (releaseAll current currentAvs).2)
+          (GraphOwnsArgsResultProtected funRel recSelfRel current
+            sourceEnv (source :: sources)
+            (.shared :: List.replicate currentAvs.length .shared)
+            (.constA .erased :: currentAvs) sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel
+            (releaseAll current currentAvs).1 sourceEnv sourceRest rest slots)
+          0
+        apply ProfileFundedEmitStateRunSoundBelow.of_profile_eq
+          (ProfileFundedEmitStateRunSoundBelow.comp
+          (discard_const_arg_profile_state_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := current)
+            (sourceEnv := sourceEnv) (source := source)
+            (sources := sources) (atom := .erased)
+            (worlds := List.replicate currentAvs.length .shared)
+            (avs := currentAvs) (sourceRest := sourceRest) (rest := rest)
+            (slots := slots) .erased)
+          ih)
+        exact IxIR0.DynamicCost.Profile.zero_add 0)
+      (hstable := hstable) (hlength := hsourceLength)
+  · exact zeroOwnershipAllowance_le_profile profile
+
+/-- Releasing a complete shared argument vector preserves the semantic
+environment/frame boundary. Its destructive drops are amortized at zero, and
+the exact interface is recovered uniformly from the bounded induction. -/
+theorem releaseAll_profile_state_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length)
+    (profile : SourceProfile) :
+    ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur (releaseAll Γ avs).2
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValues (List.replicate avs.length .shared) avs
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel (releaseAll Γ avs).1
+          sourceEnv sourceRest rest slots) profile := by
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.of_below
+  intro limit
+  exact releaseAll_profile_state_sound_at
+    (limit := limit) hstable hsourceLength profile sourceRest rest slots
+
+/-- Target-fuel-bounded public interface for stable shared-argument release. -/
+theorem releaseAll_profile_state_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length)
+    (profile : SourceProfile) :
+    ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (releaseAll Γ avs).2
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValues (List.replicate avs.length .shared) avs
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel (releaseAll Γ avs).1
+          sourceEnv sourceRest rest slots) profile := by
+  exact releaseAll_profile_state_sound_at hstable hsourceLength profile
+
+/-- Re-introduce the erased scalar result after an absorbed application has
+released all temporary argument owners. -/
+theorem erased_result_profile_state_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Ixon.Owned}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)} :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv .erased
+        world (.constA .erased) sourceRest rest slots) 0 := by
+  apply ProfileFundedEmitStateRunSoundBelow.id
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, .erased, hΓ, .const rfl, .erased, hrestGraph,
+    hown.addNoLocation rfl⟩, hslots⟩
+
+/-- Profiled erased-function application.  Arguments remain strict, their
+temporary shared owners are released at zero amortized target cost, and the
+source apply-chain profile conservatively funds that release suffix. -/
+theorem LowerResultProfileSound.discardArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceValues :
+      List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emitArgs : Emit}
+    {avs : List AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    (hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased) functionProfile)
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceMiddle sourceOutput sourceValues
+      (List.replicate avs.length .shared) emitArgs avs argsProfile)
+    (hsourceLength : sourceValues.length = avs.length) :
+    LowerResultProfileSound funRel recSelfRel ctx cur start
+      (releaseAll output avs).1 sourceStart sourceOutput .erased
+      resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased)
+      (functionProfile + argsProfile + applyProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.discardArgs
+          hargs.toLowerArgsValueSound hsourceLength
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  have hall : ProfileFundedEmitStateRunSound ctx cur
+      (emitFunction ∘ ((_root_.id : Emit) ∘
+        (emitArgs ∘ ((releaseAll output avs).2 ∘
+          (_root_.id : Emit)))))
+      (GraphOwnsVEnvProtected funRel recSelfRel start sourceStart
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel
+        (releaseAll output avs).1 sourceOutput .erased resultWorld
+        (.constA .erased) sourceRest rest slots)
+      (functionProfile + (0 + (argsProfile + (applyProfile + 0)))) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hfunction.profileEmits sourceRest rest slots)
+      (ProfileFundedEmitStateRunSound.comp
+        (discard_const_result_profile_state
+          (funRel := funRel) (recSelfRel := recSelfRel)
+          (ctx := ctx) (cur := cur) (Γ := input)
+          (sourceEnv := sourceMiddle) (sourceValue := .erased)
+          (world := .shared) (atom := .erased)
+          (sourceRest := sourceRest) (rest := rest) (slots := slots)
+          .erased)
+        (ProfileFundedEmitStateRunSound.comp
+          (hargs.profileEmits sourceRest rest slots)
+          (ProfileFundedEmitStateRunSound.comp
+            (releaseAll_profile_state_sound hargs.stable hsourceLength
+              applyProfile sourceRest rest slots)
+            (erased_result_profile_state
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur)
+              (Γ := (releaseAll output avs).1)
+              (sourceEnv := sourceOutput) (world := resultWorld)
+              (sourceRest := sourceRest) (rest := rest)
+              (slots := slots)))))
+  have hcostRun := hall horder henv hpre (by
+    simpa [Function.comp_def] using hrun) hcontinuation
+  apply ProfileFundedCodeRun.of_profile_eq hcostRun
+  apply congrArg (fun profile => profile + continuationProfile)
+  ext <;> simp <;> omega
+
+/-- Fuel-bounded profiled erased-function application.  Arguments remain strict, their
+temporary shared owners are released at zero amortized target cost, and the
+source apply-chain profile conservatively funds that release suffix. -/
+theorem LowerResultProfileSoundBelow.discardArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceValues :
+      List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emitArgs : Emit}
+    {avs : List AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    (hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased) functionProfile)
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceMiddle sourceOutput sourceValues
+      (List.replicate avs.length .shared) emitArgs avs argsProfile)
+    (hsourceLength : sourceValues.length = avs.length) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start
+      (releaseAll output avs).1 sourceStart sourceOutput .erased
+      resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased)
+      (functionProfile + argsProfile + applyProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.discardArgs
+          hargs.toLowerArgsValueSound hsourceLength
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  have hall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitFunction ∘ ((_root_.id : Emit) ∘
+        (emitArgs ∘ ((releaseAll output avs).2 ∘
+          (_root_.id : Emit)))))
+      (GraphOwnsVEnvProtected funRel recSelfRel start sourceStart
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel
+        (releaseAll output avs).1 sourceOutput .erased resultWorld
+        (.constA .erased) sourceRest rest slots)
+      (functionProfile + (0 + (argsProfile + (applyProfile + 0)))) :=
+    ProfileFundedEmitStateRunSoundBelow.comp
+      (hfunction.profileEmits sourceRest rest slots)
+      (ProfileFundedEmitStateRunSoundBelow.comp
+        (discard_const_result_profile_state_below
+          (funRel := funRel) (recSelfRel := recSelfRel)
+          (ctx := ctx) (cur := cur) (Γ := input)
+          (sourceEnv := sourceMiddle) (sourceValue := .erased)
+          (world := .shared) (atom := .erased)
+          (sourceRest := sourceRest) (rest := rest) (slots := slots)
+          .erased)
+        (ProfileFundedEmitStateRunSoundBelow.comp
+          (hargs.profileEmits sourceRest rest slots)
+          (ProfileFundedEmitStateRunSoundBelow.comp
+            (releaseAll_profile_state_sound_below hargs.stable hsourceLength
+              applyProfile sourceRest rest slots)
+            (erased_result_profile_state_below
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur)
+              (Γ := (releaseAll output avs).1)
+              (sourceEnv := sourceOutput) (world := resultWorld)
+              (sourceRest := sourceRest) (rest := rest)
+              (slots := slots)))))
+  have hcostRun := hall bound hbound hfuel horder henv hpre (by
+    simpa [Function.comp_def] using hrun) hcontinuation
+  apply ProfileFundedCodeRun.of_profile_eq hcostRun
+  apply congrArg (fun profile => profile + continuationProfile)
+  ext <;> simp <;> omega
+
+/-- Canonical cost decomposition of a flattened source application spine:
+head evaluation, argument evaluations, then entered applications.  Profile
+addition is commutative, so this canonical compiler order is propositionally
+equal to the source evaluator's nested order.  The existential cost split is
+kept proof-irrelevant, just as in `SourceSpineEval`. -/
+inductive SourceSpineProfile (sourceCtx : IxIR0.Ctx)
+    (sourceEnv : List IxIR0.Value) (head : IxIR0.Expr)
+    (arguments : List IxIR0.Expr) (sourceResult : IxIR0.Value)
+    (profile : SourceProfile) : Prop where
+  | intro {headValue : IxIR0.Value}
+      {argumentValues : List IxIR0.Value}
+      {headProfile argumentProfile applyProfile : SourceProfile} :
+      (∃ fuel, IxIR0.DynamicCost.Eval sourceCtx fuel sourceEnv head
+        headValue headProfile) →
+      SourceArgsProfile sourceCtx sourceEnv arguments argumentValues
+        argumentProfile →
+      SourceAppliesProfile sourceCtx headValue argumentValues sourceResult
+        applyProfile →
+      headProfile + argumentProfile + applyProfile = profile →
+      SourceSpineProfile sourceCtx sourceEnv head arguments sourceResult
+        profile
+
+/-- Dependent eliminator for the canonical source-spine profile split.
+Clients receive the exact head value, argument values, three component
+profiles, and all constructor evidence while this theorem remains the sole
+destruction site for the indexed wrapper. -/
+theorem SourceSpineProfile.eliminate
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {head : IxIR0.Expr} {arguments : List IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {Result : Prop}
+    (hspine : SourceSpineProfile sourceCtx sourceEnv head arguments
+      sourceResult profile)
+    (hintro : ∀ {headValue : IxIR0.Value}
+        {argumentValues : List IxIR0.Value}
+        {headProfile argumentProfile applyProfile : SourceProfile},
+      (∃ fuel, IxIR0.DynamicCost.Eval sourceCtx fuel sourceEnv head
+        headValue headProfile) →
+      SourceArgsProfile sourceCtx sourceEnv arguments argumentValues
+        argumentProfile →
+      SourceAppliesProfile sourceCtx headValue argumentValues sourceResult
+        applyProfile →
+      headProfile + argumentProfile + applyProfile = profile →
+      Result) :
+    Result := by
+  cases hspine with
+  | intro hhead harguments happlies hprofile =>
+      exact hintro hhead harguments happlies hprofile
+
+theorem SourceSpineProfile.toSourceSpineEval
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {head : IxIR0.Expr} {arguments : List IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    (hspine : SourceSpineProfile sourceCtx sourceEnv head arguments
+      sourceResult profile) :
+    SourceSpineEval sourceCtx sourceEnv head arguments sourceResult := by
+  apply hspine.eliminate
+  · intro _ _ _ _ _ hhead harguments happlies _
+    obtain ⟨fuel, hcost⟩ := hhead
+    exact .intro ⟨fuel, hcost.run⟩
+      harguments.toSourceArgsEval happlies.toSourceApplies
+
+/-- Expose the exact canonical profile split of a reference-headed spine.
+Every source reference evaluation contributes one evaluation event, so the
+head fragment is nonempty and can fund a static PAP or constructor node. -/
+theorem SourceSpineProfile.refData
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {address : Ixon.Address} {arguments : List IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    (hspine : SourceSpineProfile sourceCtx sourceEnv (.ref address)
+      arguments sourceResult profile) :
+    ∃ sourceFunction sourceArguments headProfile argumentProfile
+        applyProfile,
+      SourceRefValue sourceCtx address sourceFunction ∧
+      SourceArgsProfile sourceCtx sourceEnv arguments sourceArguments
+        argumentProfile ∧
+      SourceAppliesProfile sourceCtx sourceFunction sourceArguments
+        sourceResult applyProfile ∧
+      headProfile + argumentProfile + applyProfile = profile ∧
+      0 < headProfile.evals := by
+  apply hspine.eliminate
+  · intro sourceFunction sourceArguments headProfile argumentProfile
+      applyProfile hhead harguments happlies hprofile
+    obtain ⟨fuel, hhead⟩ := hhead
+    refine ⟨sourceFunction, sourceArguments, headProfile, argumentProfile,
+      applyProfile, ⟨fuel, sourceEval_ref_closed hhead.run⟩, harguments,
+      happlies, hprofile, ?_⟩
+    exact hhead.evals_pos
+
+/-- Expose the exact reference evaluation as well as its closed semantic
+value.  Direct calls need the former to distinguish a nullary function body,
+which is evaluated by the source reference itself, from a positive-arity
+body funded by source application steps. -/
+theorem SourceSpineProfile.refProfileData
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {address : Ixon.Address} {arguments : List IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    (hspine : SourceSpineProfile sourceCtx sourceEnv (.ref address)
+      arguments sourceResult profile) :
+    ∃ sourceFunction sourceArguments headProfile argumentProfile
+        applyProfile,
+      SourceRefValue sourceCtx address sourceFunction ∧
+      SourceRefProfile sourceCtx address sourceFunction headProfile ∧
+      SourceArgsProfile sourceCtx sourceEnv arguments sourceArguments
+        argumentProfile ∧
+      SourceAppliesProfile sourceCtx sourceFunction sourceArguments
+        sourceResult applyProfile ∧
+      headProfile + argumentProfile + applyProfile = profile ∧
+      0 < headProfile.evals := by
+  apply hspine.eliminate
+  · intro sourceFunction sourceArguments headProfile argumentProfile
+      applyProfile hhead harguments happlies hprofile
+    obtain ⟨fuel, hhead⟩ := hhead
+    refine ⟨sourceFunction, sourceArguments, headProfile, argumentProfile,
+      applyProfile, ⟨fuel, sourceEval_ref_closed hhead.run⟩,
+      ⟨fuel, sourceEnv, hhead⟩, harguments, happlies, hprofile, ?_⟩
+    exact hhead.evals_pos
+
+/-- Any costed head evaluation is the corresponding empty flattened spine. -/
+theorem SourceSpineProfile.of_eval_nil
+    {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {head : IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    (hcost : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv head
+      sourceResult profile) :
+    SourceSpineProfile sourceCtx sourceEnv head [] sourceResult profile := by
+  refine .intro ⟨sourceFuel, hcost⟩ .nil .nil ?_
+  ext <;> simp
+
+/-- Flatten one additional syntactic application while retaining the exact
+source profile. -/
+theorem SourceSpineProfile.flattenApp
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {function argument : IxIR0.Expr} {arguments : List IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    (hspine : SourceSpineProfile sourceCtx sourceEnv
+      (.app function argument) arguments sourceResult profile) :
+    SourceSpineProfile sourceCtx sourceEnv function
+      (argument :: arguments) sourceResult profile := by
+  apply hspine.eliminate
+  · intro _ _ _ _ _ hhead harguments happlies hprofile
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    cases hhead with
+    | app hfunction hargument happly =>
+        refine .intro ⟨_, hfunction⟩ (.cons hargument harguments)
+          (.cons happly happlies) ?_
+        rw [← hprofile]
+        ext <;> simp [IxIR0.DynamicCost.tick] <;> omega
+
+/-- One costed source application is the singleton flattened spine consumed
+by the compiler's expression-level `.app` branch. -/
+theorem SourceSpineProfile.of_eval_app
+    {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {function argument : IxIR0.Expr}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    (hcost : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv
+      (.app function argument) sourceResult profile) :
+    SourceSpineProfile sourceCtx sourceEnv function [argument]
+      sourceResult profile :=
+  (SourceSpineProfile.of_eval_nil hcost).flattenApp
+
+/-- Successful expression lowering funded by the exact source trace supplied
+at the same compiler-fuel index. -/
+def LowerEProfilePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av sourceProfile
+
+/-- Successful borrowing-position lowering funded by the exact source
+expression profile at one compiler-fuel index. -/
+def LowerBorrowProfilePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal}
+      {release : Bool},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release sourceProfile
+
+/-- Successful argument lowering funded by the sum of its exact source
+argument traces. -/
+def LowerArgsProfilePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Ixon.Owned)}
+      {sourceProfile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsProfile sourceCtx sourceEnv (args.map Prod.fst) sourceValues
+      sourceProfile →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+      sourceProfile
+
+/-- No successful argument-lowering run exists at zero compiler fuel. -/
+theorem lowerArgsProfilePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur src 0 := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs _ hrun
+  simp only [lowerArgs] at hrun
+  exact (stateThrowRun_not_ok hrun).elim
+
+/-- Profile-source adapter for `lowerArgs_run_core`. Exact source-profile
+inversion is shared across ordinary, bounded, and reachable clients while the
+source-neutral core owns successful-run sequencing and output recovery. -/
+private theorem lowerArgs_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+    {args : List (IxIR0.Expr × Ixon.Owned)}
+    {sourceProfile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {avs : List AVal}
+    {Result : VEnv → List IxIR0.Value → List Ixon.Owned → Emit →
+      List AVal → SourceProfile → LowSt → Prop}
+    (hnil : Result input [] [] (_root_.id : Emit) [] 0 state)
+    (hcons : ∀ (expr : IxIR0.Expr) (world : Ixon.Owned)
+        (tail : List (IxIR0.Expr × Ixon.Owned))
+        {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+        {sourceTail : List IxIR0.Value}
+        {headProfile tailProfile : SourceProfile}
+        {middle actualOutput : VEnv} {emitHead emitTail : Emit}
+        {av : AVal} {tailAVals : List AVal}
+        {middleState tailState : LowSt},
+      IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+        headProfile →
+      SourceArgsProfile sourceCtx sourceEnv (tail.map Prod.fst) sourceTail
+        tailProfile →
+      (lowerE src fuel input world expr).run state =
+        .ok (middle, emitHead, av) middleState →
+      (lowerArgs src fuel middle tail).run middleState =
+        .ok (actualOutput, emitTail, tailAVals) tailState →
+      Result actualOutput (sourceValue :: sourceTail)
+        (world :: tail.map Prod.snd) (emitHead ∘ emitTail)
+        (av :: tailAVals) (headProfile + tailProfile) tailState)
+    (hsource : SourceArgsProfile sourceCtx sourceEnv (args.map Prod.fst)
+      sourceValues sourceProfile)
+    (hrun : (lowerArgs src (fuel + 1) input args).run state =
+      .ok (output, emit, avs) finalState) :
+    Result output sourceValues (args.map Prod.snd) emit avs sourceProfile
+      finalState := by
+  exact (lowerArgs_run_core
+    (Result := fun actualArgs actualOutput actualEmit actualAVals
+        actualState =>
+      ∀ {actualSourceValues : List IxIR0.Value}
+          {actualProfile : SourceProfile},
+        SourceArgsProfile sourceCtx sourceEnv (actualArgs.map Prod.fst)
+          actualSourceValues actualProfile →
+        Result actualOutput actualSourceValues (actualArgs.map Prod.snd)
+          actualEmit actualAVals actualProfile actualState)
+    (hnil := by
+      intro actualSourceValues actualProfile hactualSource
+      cases hactualSource
+      exact hnil)
+    (hcons := by
+      intro expr world tail middle actualOutput emitHead emitTail av
+        tailAVals middleState tailState hheadRun htailRun
+        actualSourceValues actualProfile hactualSource
+      change SourceArgsProfile sourceCtx sourceEnv
+        (expr :: tail.map Prod.fst) actualSourceValues actualProfile at hactualSource
+      cases hactualSource with
+      | cons hsourceHead hsourceTail =>
+        exact hcons expr world tail hsourceHead hsourceTail hheadRun htailRun)
+    hrun) hsource
+
+/-- Profiled argument induction step.  The source profile and executable
+lowerer split in the same list order; `consArgs` supplies both the semantic
+frame transport and additive exact-run cost composition. -/
+theorem lowerArgsProfilePreserves_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (htail : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel) :
+    LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1) := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs hsource hrun
+  exact lowerArgs_run_profile_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals actualProfile _ =>
+      LowerArgsProfileSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv actualSourceValues worlds actualEmit actualAVals
+        actualProfile)
+    (hnil := lowerArgs_nil_profile_sound)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead
+        hsourceTail hheadRun htailRun
+      exact (hexpr hsourceHead hheadRun).consArgs
+        (htail hsourceTail htailRun))
+    hsource hrun
+
+/-- Argument-profile preservation at arbitrary compiler fuel follows from
+all strictly smaller expression hypotheses. -/
+theorem lowerArgsProfilePreserves_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur src prior) :
+    LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur src
+      fuel :=
+  lowerArgsPreserves_of_expr_core
+    (Expr := LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur src)
+    (Args := LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src)
+    (hzero := lowerArgsProfilePreserves_zero src)
+    (hsucc := fun hexpr htail =>
+      lowerArgsProfilePreserves_succ hexpr htail)
+    fuel hexpr
+
+/-- Dropping a strict prefix from a genuinely longer list leaves at least
+one argument. This is the compiler-side reachability fact used by every
+over-application path. -/
+theorem drop_nonempty_of_lt_length {α : Type} {xs : List α} {count : Nat}
+    (hcount : count < xs.length) : xs.drop count ≠ [] := by
+  intro hnil
+  have hlength := congrArg List.length hnil
+  simp only [List.length_drop, List.length_nil] at hlength
+  omega
+
+/-- Profile preservation for the genuine non-erased `applyRest` branch.
+The already-produced function profile, strict argument profile, and source
+apply-chain profile are retained as the compiler's three execution phases. -/
+def ApplyRestNonErasedProfilePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {functionProfile argsProfile applyProfile : SourceProfile}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    args ≠ [] →
+    SourceArgsProfile sourceCtx sourceMiddle args sourceArgs argsProfile →
+    SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+      applyProfile →
+    LowerResultProfileSound funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction function
+      functionProfile →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    LowerResultProfileSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+      (functionProfile + argsProfile + applyProfile)
+
+/-- Profile-source adapter for `applyRest_nonErased_run_core`. Exact source
+profiling and source-argument nonemptiness are recovered once, while exact,
+bounded, and reachable clients retain only their argument and application
+composition judgments. -/
+private theorem applyRest_nonErased_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {pre emit : Emit} {function av : AVal}
+    {args : List IxIR0.Expr} {argsProfile : SourceProfile}
+    {state finalState : LowSt}
+    {Result : Ixon.Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hfinish : ∀ (argsOutput : VEnv) (emitArgs : Emit)
+        (avs : List AVal) (argsState : LowSt),
+      SourceArgsProfile sourceCtx sourceMiddle
+        ((args.map (fun arg => (arg, Ixon.Owned.shared))).map Prod.fst)
+        sourceArgs argsProfile →
+      sourceArgs ≠ [] →
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Ixon.Owned.shared)))).run state =
+          .ok (argsOutput, emitArgs, avs) argsState →
+      ((args.map (fun arg => (arg, Ixon.Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared →
+      Result .shared argsOutput.bump
+        ((pre ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom argsOutput)
+            (avs.map (·.toAtom argsOutput)).toArray))
+        (.slotA argsOutput.depth) argsState)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsNonempty : args ≠ [])
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld pre function
+      args).run state = .ok (output, emit, av) finalState) :
+    Result resultWorld output emit av finalState := by
+  exact applyRest_nonErased_run_core
+    (Result := Result)
+    (hfinish := fun argsOutput emitArgs avs argsState hargsRun
+        hworldsHomogeneous => by
+      have hsourcePaired : SourceArgsProfile sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Ixon.Owned.shared))).map Prod.fst)
+          sourceArgs argsProfile := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hsourceNonempty : sourceArgs ≠ [] := by
+        intro hnil
+        apply hargsNonempty
+        exact List.eq_nil_of_length_eq_zero (by
+          rw [hsourceArgs.lengths, hnil]
+          rfl)
+      exact hfinish argsOutput emitArgs avs argsState hsourcePaired
+        hsourceNonempty hargsRun hworldsHomogeneous)
+    hfunctionNe hrun
+
+/-- Exact inversion of a successful non-erased `applyRest` run, combining
+profiled argument lowering with the semantic, ownership, and cost contracts
+for dynamic application. -/
+theorem applyRest_nonErased_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+    {function av : AVal} {args : List IxIR0.Expr}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt}
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsNonempty : args ≠ [])
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult applyProfile)
+    (hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function functionProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      function args).run state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+      (functionProfile + argsProfile + applyProfile) := by
+  exact applyRest_nonErased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle sourceResult actualWorld actualEmit actualAv
+        (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired
+        hsourceNonempty hargsRun hworldsHomogeneous => by
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsProfileSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hcost
+          hsource hsourceNonempty)
+    hfunctionNe hargsNonempty hsourceArgs hrun
+
+/-- Profile-source adapter for `applyRest_erased_run_core`. Source-profile
+pairing and source/target argument-length agreement are recovered once while
+exact, bounded, and reachable clients retain only their argument-discard
+composition judgments. -/
+private theorem applyRest_erased_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {pre emit : Emit} {args : List IxIR0.Expr}
+    {argsProfile : SourceProfile} {state finalState : LowSt} {av : AVal}
+    {Result : Ixon.Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hfinish : ∀ (argsOutput : VEnv) (emitArgs : Emit)
+        (avs : List AVal) (argsState : LowSt),
+      SourceArgsProfile sourceCtx sourceMiddle
+        ((args.map (fun arg => (arg, Ixon.Owned.shared))).map Prod.fst)
+        sourceArgs argsProfile →
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Ixon.Owned.shared)))).run state =
+          .ok (argsOutput, emitArgs, avs) argsState →
+      ((args.map (fun arg => (arg, Ixon.Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared →
+      sourceArgs.length = avs.length →
+      Result resultWorld (releaseAll argsOutput avs).1
+        ((pre ∘ emitArgs) ∘ (releaseAll argsOutput avs).2)
+        (.constA .erased) argsState)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld pre
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState) :
+    Result resultWorld output emit av finalState := by
+  exact applyRest_erased_run_core
+    (Result := Result)
+    (hfinish := fun argsOutput emitArgs avs argsState hargsRun havsLength
+        hworldsHomogeneous => by
+      have hsourcePaired : SourceArgsProfile sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Ixon.Owned.shared))).map Prod.fst)
+          sourceArgs argsProfile := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hsourceLength : sourceArgs.length = avs.length := by
+        rw [← hsourceArgs.lengths, ← havsLength]
+      exact hfinish argsOutput emitArgs avs argsState hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength)
+    hrun
+
+/-- The erased `applyRest` branch is also fully profiled: strict arguments
+are lowered normally and their owners are discarded using the source
+application fragment as zero-cost funding. -/
+theorem applyRest_erased_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (_hsource : SourceAppliesProfile sourceCtx .erased sourceArgs .erased
+      applyProfile)
+    (hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased) functionProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av
+      (functionProfile + argsProfile + applyProfile) := by
+  exact applyRest_erased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle .erased actualWorld actualEmit actualAv
+        (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength => by
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsProfileSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs (applyProfile := applyProfile) hhomogeneous
+          hsourceLength)
+    hsourceArgs hrun
+
+/-- No successful non-erased `applyRest` run exists at zero compiler fuel. -/
+theorem applyRestNonErasedProfilePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    ApplyRestNonErasedProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    _ _ _ _ _ hrun
+  simp only [applyRest] at hrun
+  exact (stateThrowRun_not_ok hrun).elim
+
+/-- One non-erased `applyRest` compiler-fuel step follows from profiled
+argument lowering and the completed dynamic application contracts. -/
+theorem applyRestNonErasedProfilePreserves_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    hfunctionNe hargsNonempty hsourceArgs hsource hfunction hrun
+  exact applyRest_nonErased_run_profile_sound hargs hownership hvalue hcost
+    hfunctionNe hargsNonempty hsourceArgs hsource hfunction hrun
+
+/-- Close non-erased `applyRest` profile preservation from all strictly
+smaller expression-level profile hypotheses. -/
+theorem applyRestNonErasedProfilePreserves_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur src prior)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel :=
+  applyRestNonErasedPreserves_of_expr_core
+    (Expr := LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur src)
+    (Args := LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src)
+    (ApplyRest := ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src)
+    (hargsOfExpr := fun fuel hexpr =>
+      lowerArgsProfilePreserves_of_expr fuel hexpr)
+    (hzero := applyRestNonErasedProfilePreserves_zero src)
+    (hsucc := fun hargs =>
+      applyRestNonErasedProfilePreserves_succ hargs hownership hvalue hcost)
+    fuel hexpr
+
+/-- Successful flattened-spine lowering funded by the exact decomposed
+source profile at one compiler-fuel index. -/
+def LowerSpineProfilePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {profile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    args ≠ [] →
+    SourceSpineProfile sourceCtx sourceEnv head args sourceResult profile →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile
+
+/-! ### Target-fuel-bounded compiler profile interfaces -/
+
+/-- Expression profile preservation at one compiler-fuel index and one
+independent target evaluator-fuel ceiling. -/
+def LowerEProfilePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceValue world emit av sourceProfile
+
+def LowerBorrowProfilePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal}
+      {release : Bool},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceValue emit av release sourceProfile
+
+def LowerArgsProfilePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Ixon.Owned)}
+      {sourceProfile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsProfile sourceCtx sourceEnv (args.map Prod.fst) sourceValues
+      sourceProfile →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+      sourceProfile
+
+def ApplyRestNonErasedProfilePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {functionProfile argsProfile applyProfile : SourceProfile}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    args ≠ [] →
+    SourceArgsProfile sourceCtx sourceMiddle args sourceArgs argsProfile →
+    SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+      applyProfile →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction function
+      functionProfile →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+      (functionProfile + argsProfile + applyProfile)
+
+def LowerSpineProfilePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {profile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    args ≠ [] →
+    SourceSpineProfile sourceCtx sourceEnv head args sourceResult profile →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile
+
+theorem lowerEProfilePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue
+    sourceProfile state finalState emit av _ hrun
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowProfilePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerBorrowProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue sourceProfile
+    state finalState emit av release _ hrun
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerArgsProfilePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src 0 := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs _ hrun
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem applyRestNonErasedProfilePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    _ _ _ _ _ hrun
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction function
+    args hrun).elim
+
+theorem lowerSpineProfilePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerSpineProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src 0 := by
+  intro input output world head args sourceEnv sourceResult profile state
+    finalState emit av _ _ hrun
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpineProfilePreservesBelow_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerSpineProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src 1 := by
+  intro input output world head args sourceEnv sourceResult profile state
+    finalState emit av _ _ hrun
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+theorem lowerArgsProfilePreservesBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src fuel)
+    (htail : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel) :
+    LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src (fuel + 1) := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs hsource hrun
+  exact lowerArgs_run_profile_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals actualProfile _ =>
+      LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv actualSourceValues worlds actualEmit
+        actualAVals actualProfile)
+    (hnil := lowerArgs_nil_profile_sound_below)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead
+        hsourceTail hheadRun htailRun
+      exact (hexpr hsourceHead hheadRun).consArgs
+        (htail hsourceTail htailRun))
+    hsource hrun
+
+theorem lowerArgsProfilePreservesBelow_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+        src prior) :
+    LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel :=
+  lowerArgsPreserves_of_expr_core
+    (Expr := LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src)
+    (Args := LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src)
+    (hzero := lowerArgsProfilePreservesBelow_zero src)
+    (hsucc := fun hexpr htail =>
+      lowerArgsProfilePreservesBelow_succ hexpr htail)
+    fuel hexpr
+
+/-- Fuel-bounded inversion of a successful non-erased `applyRest` run. -/
+theorem applyRest_nonErased_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+    {function av : AVal} {args : List IxIR0.Expr}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt}
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsNonempty : args ≠ [])
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult applyProfile)
+    (hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur
+      limit start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function functionProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      function args).run state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+      (functionProfile + argsProfile + applyProfile) := by
+  exact applyRest_nonErased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle sourceResult actualWorld
+        actualEmit actualAv (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired
+        hsourceNonempty hargsRun hworldsHomogeneous => by
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsProfileSoundBelow funRel recSelfRel ctx
+          cur limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hcost
+          hsource hsourceNonempty)
+    hfunctionNe hargsNonempty hsourceArgs hrun
+
+theorem applyRestNonErasedProfilePreservesBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit) :
+    ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    hfunctionNe hargsNonempty hsourceArgs hsource hfunction hrun
+  exact applyRest_nonErased_run_profile_sound_below hargs hownership hvalue
+    hcost hfunctionNe hargsNonempty hsourceArgs hsource hfunction hrun
+
+theorem applyRestNonErasedProfilePreservesBelow_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+        src prior)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit) :
+    ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel :=
+  applyRestNonErasedPreserves_of_expr_core
+    (Expr := LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src)
+    (Args := LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src)
+    (ApplyRest := ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src)
+    (hargsOfExpr := fun fuel hexpr =>
+      lowerArgsProfilePreservesBelow_of_expr fuel hexpr)
+    (hzero := applyRestNonErasedProfilePreservesBelow_zero src)
+    (hsucc := fun hargs =>
+      applyRestNonErasedProfilePreservesBelow_succ hargs hownership hvalue
+        hcost)
+    fuel hexpr
+
+/-- The fuel-bounded erased `applyRest` branch is also fully profiled: strict arguments
+are lowered normally and their owners are discarded using the source
+application fragment as zero-cost funding. -/
+theorem applyRest_erased_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (_hsource : SourceAppliesProfile sourceCtx .erased sourceArgs .erased
+      applyProfile)
+    (hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased) functionProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle .erased resultWorld emit av
+      (functionProfile + argsProfile + applyProfile) := by
+  exact applyRest_erased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle .erased actualWorld actualEmit
+        actualAv (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength => by
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsProfileSoundBelow funRel recSelfRel ctx
+          cur limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs (applyProfile := applyProfile) hhomogeneous
+          hsourceLength)
+    hsourceArgs hrun
+
+/-- A flattened application head delegates to the predecessor-fuel spine
+proof with the same cost-preserving source flattening. -/
+theorem lowerSpine_app_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hspine : LowerSpineProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {function argument : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv
+      (.app function argument) args sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 1) input world
+      (.app function argument) args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hspine (by simp) hsource.flattenApp
+  simpa [lowerSpine] using hrun
+
+/-- The expression-level application constructor is a singleton profiled
+spine, so its branch is closed by the profiled spine induction hypothesis. -/
+theorem lowerE_app_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel sourceFuel : Nat}
+    (hspine : LowerSpineProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {function argument : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv
+      (.app function argument) sourceResult profile)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.app function argument)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hspine (by simp) (SourceSpineProfile.of_eval_app hsource)
+  simpa [lowerE] using hrun
+
+/-- Fuel-bounded flattened application-head delegation. -/
+theorem lowerSpine_app_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hspine : LowerSpineProfilePreservesBelow funRel recSelfRel sourceCtx
+      ctx cur limit src fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {function argument : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv
+      (.app function argument) args sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 1) input world
+      (.app function argument) args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hspine (by simp) hsource.flattenApp
+  simpa [lowerSpine] using hrun
+
+/-- Fuel-bounded expression-level singleton application spine. -/
+theorem lowerE_app_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel sourceFuel : Nat}
+    (hspine : LowerSpineProfilePreservesBelow funRel recSelfRel sourceCtx
+      ctx cur limit src fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {function argument : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv
+      (.app function argument) sourceResult profile)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.app function argument)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hspine (by simp) (SourceSpineProfile.of_eval_app hsource)
+  simpa [lowerE] using hrun
+
+/-- Compose a bounded profiled result with a bounded state-indexed result
+suffix. -/
+theorem LowerResultProfileSoundBelow.thenResult
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceMiddleValue sourceValue : IxIR0.Value}
+    {middleWorld world : Ixon.Owned}
+    {first second : Emit} {middleValue result : AVal}
+    {firstProfile secondProfile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle sourceMiddleValue middleWorld
+      first middleValue firstProfile)
+    (hvalue : LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world (first ∘ second) result)
+    (hsecond : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit second
+        (GraphOwnsResultProtected funRel recSelfRel middle sourceMiddle
+          sourceMiddleValue middleWorld middleValue sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue world result sourceRest rest slots)
+        secondProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue world (first ∘ second) result
+      (firstProfile + secondProfile) := by
+  refine
+    { toLowerResultValueSound := hvalue
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hsound.profileEmits sourceRest rest slots)
+    (hsecond sourceRest rest slots)
+
+/-- Compose a bounded profiled result with a bounded state-indexed borrow
+suffix. -/
+theorem LowerResultProfileSoundBelow.thenBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceMiddleValue sourceValue : IxIR0.Value}
+    {middleWorld : Ixon.Owned}
+    {first second : Emit} {middleValue result : AVal} {release : Bool}
+    {firstProfile secondProfile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle sourceMiddleValue middleWorld
+      first middleValue firstProfile)
+    (hvalue : LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue (first ∘ second) result release)
+    (hsecond : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit second
+        (GraphOwnsResultProtected funRel recSelfRel middle sourceMiddle
+          sourceMiddleValue middleWorld middleValue sourceRest rest slots)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+          sourceValue result release sourceRest rest slots)
+        secondProfile) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue (first ∘ second) result release
+      (firstProfile + secondProfile) := by
+  refine
+    { toLowerBorrowValueSound := hvalue
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hsound.profileEmits sourceRest rest slots)
+    (hsecond sourceRest rest slots)
+
+/-- Compose a bounded profiled borrow with a bounded state-indexed result
+suffix. -/
+theorem LowerBorrowProfileSoundBelow.thenResult
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {borrowEmit suffix : Emit} {borrowed result : AVal} {release : Bool}
+    {world : Ixon.Owned} {prefixProfile suffixProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle sourceTarget borrowEmit borrowed
+      release prefixProfile)
+    (hvalue : LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world (borrowEmit ∘ suffix)
+      result)
+    (hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit suffix
+        (GraphOwnsBorrowResultProtected funRel recSelfRel middle
+          sourceMiddle sourceTarget borrowed release sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue world result sourceRest rest slots)
+        suffixProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue world (borrowEmit ∘ suffix)
+      result (prefixProfile + suffixProfile) := by
+  refine
+    { toLowerResultValueSound := hvalue
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSoundBelow.comp
+    (hsound.profileEmits sourceRest rest slots)
+    (hsuffix sourceRest rest slots)
+
+/-- Compose a profiled borrowing prefix with a state-indexed suffix that
+turns the pending borrow into a complete semantic expression result. -/
+theorem LowerBorrowProfileSound.thenResult
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {borrowEmit suffix : Emit} {borrowed result : AVal} {release : Bool}
+    {world : Ixon.Owned} {prefixProfile suffixProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle sourceTarget borrowEmit borrowed
+      release prefixProfile)
+    (hvalue : LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world (borrowEmit ∘ suffix) result)
+    (hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur suffix
+        (GraphOwnsBorrowResultProtected funRel recSelfRel middle
+          sourceMiddle sourceTarget borrowed release sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue world result sourceRest rest slots)
+        suffixProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world (borrowEmit ∘ suffix) result
+      (prefixProfile + suffixProfile) := by
+  refine
+    { toLowerResultValueSound := hvalue
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  exact ProfileFundedEmitStateRunSound.comp
+    (hsound.profileEmits sourceRest rest slots)
+    (hsuffix sourceRest rest slots)
+
+/-- Cost companion to semantic let-binder installation.  As with expression
+results, the source profile and the graph transition are proved for the same
+exact runtime midpoint. -/
+structure InstallBinderProfileSound
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (input output : VEnv)
+    (sourceEnv : List IxIR0.Value) (boundSource : IxIR0.Value)
+    (boundWorld : Ixon.Owned) (boundValue : AVal)
+    (emit : Emit) (profile : SourceProfile) : Prop
+    extends InstallBinderValueSound funRel recSelfRel ctx cur input output
+      sourceEnv boundSource boundWorld boundValue emit where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSound ctx cur emit
+      (GraphOwnsResultProtected funRel recSelfRel input sourceEnv
+        boundSource boundWorld boundValue sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        (boundSource :: sourceEnv) sourceRest rest slots)
+      profile
+
+/-- Binder installation whose exact-profile transformer is valid through
+one target evaluator-fuel ceiling. -/
+structure InstallBinderProfileSoundBelow
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input output : VEnv)
+    (sourceEnv : List IxIR0.Value) (boundSource : IxIR0.Value)
+    (boundWorld : Ixon.Owned) (boundValue : AVal)
+    (emit : Emit) (profile : SourceProfile) : Prop
+    extends InstallBinderValueSound funRel recSelfRel ctx cur input output
+      sourceEnv boundSource boundWorld boundValue emit where
+  profileEmits : ∀ sourceRest rest slots,
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+      (GraphOwnsResultProtected funRel recSelfRel input sourceEnv
+        boundSource boundWorld boundValue sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        (boundSource :: sourceEnv) sourceRest rest slots)
+      profile
+
+theorem InstallBinderProfileSoundBelow.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {boundWorld : Ixon.Owned} {boundValue : AVal} {emit : Emit}
+    {left right : SourceProfile}
+    (hsound : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceEnv boundSource boundWorld boundValue emit left)
+    (hprofile : left = right) :
+    InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output sourceEnv boundSource boundWorld boundValue emit right := by
+  subst right
+  exact hsound
+
+theorem InstallBinderProfileSound.of_profile_eq
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {boundWorld : Ixon.Owned} {boundValue : AVal} {emit : Emit}
+    {left right : SourceProfile}
+    (hsound : InstallBinderProfileSound funRel recSelfRel ctx cur
+      input output sourceEnv boundSource boundWorld boundValue emit left)
+    (hprofile : left = right) :
+    InstallBinderProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv boundSource boundWorld boundValue emit right := by
+  subst right
+  exact hsound
+
+/-- Append an environment-to-environment prefix after binder installation.
+This is used by dead slot binders, whose alias installation is immediately
+followed by a release operation. -/
+theorem InstallBinderProfileSound.compVEnv
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input middle output : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {boundWorld : Ixon.Owned} {boundValue : AVal}
+    {first second : Emit} {firstProfile secondProfile : SourceProfile}
+    (hfirst : InstallBinderProfileSound funRel recSelfRel ctx cur
+      input middle sourceEnv boundSource boundWorld boundValue
+      first firstProfile)
+    (hsecondOwns : ∀ rest slots,
+      EmitSound ctx cur second
+        (OwnsVEnvProtected middle rest slots)
+        (OwnsVEnvProtected output rest slots))
+    (hsecondGraph : ∀ sourceRest rest slots,
+      EmitSound ctx cur second
+        (GraphOwnsVEnvProtected funRel recSelfRel middle
+          (boundSource :: sourceEnv) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel output
+          (boundSource :: sourceEnv) sourceRest rest slots))
+    (hsecondProfile : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur second
+        (GraphOwnsVEnvProtected funRel recSelfRel middle
+          (boundSource :: sourceEnv) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel output
+          (boundSource :: sourceEnv) sourceRest rest slots)
+        secondProfile) :
+    InstallBinderProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv boundSource boundWorld boundValue (first ∘ second)
+      (firstProfile + secondProfile) := by
+  refine
+    { toInstallBinderValueSound :=
+        { toInstallBinderSound := ?_
+          graphEmits := ?_ }
+      profileEmits := ?_ }
+  · intro rest slots
+    exact EmitSound.comp
+      (hfirst.toInstallBinderValueSound.toInstallBinderSound rest slots)
+      (hsecondOwns rest slots)
+  · intro sourceRest rest slots
+    exact EmitSound.comp
+      (hfirst.toInstallBinderValueSound.graphEmits sourceRest rest slots)
+      (hsecondGraph sourceRest rest slots)
+  · intro sourceRest rest slots
+    exact ProfileFundedEmitStateRunSound.comp
+      (hfirst.profileEmits sourceRest rest slots)
+      (hsecondProfile sourceRest rest slots)
+
+theorem InstallBinderProfileSoundBelow.compVEnv
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {boundWorld : Ixon.Owned} {boundValue : AVal}
+    {first second : Emit} {firstProfile secondProfile : SourceProfile}
+    (hfirst : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceEnv boundSource boundWorld boundValue
+      first firstProfile)
+    (hsecondOwns : ∀ rest slots,
+      EmitSound ctx cur second
+        (OwnsVEnvProtected middle rest slots)
+        (OwnsVEnvProtected output rest slots))
+    (hsecondGraph : ∀ sourceRest rest slots,
+      EmitSound ctx cur second
+        (GraphOwnsVEnvProtected funRel recSelfRel middle
+          (boundSource :: sourceEnv) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel output
+          (boundSource :: sourceEnv) sourceRest rest slots))
+    (hsecondProfile : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit second
+        (GraphOwnsVEnvProtected funRel recSelfRel middle
+          (boundSource :: sourceEnv) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel output
+          (boundSource :: sourceEnv) sourceRest rest slots)
+        secondProfile) :
+    InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output sourceEnv boundSource boundWorld boundValue (first ∘ second)
+      (firstProfile + secondProfile) := by
+  refine
+    { toInstallBinderValueSound :=
+        { toInstallBinderSound := ?_
+          graphEmits := ?_ }
+      profileEmits := ?_ }
+  · intro rest slots
+    exact EmitSound.comp
+      (hfirst.toInstallBinderValueSound.toInstallBinderSound rest slots)
+      (hsecondOwns rest slots)
+  · intro sourceRest rest slots
+    exact EmitSound.comp
+      (hfirst.toInstallBinderValueSound.graphEmits sourceRest rest slots)
+      (hsecondGraph sourceRest rest slots)
+  · intro sourceRest rest slots
+    exact ProfileFundedEmitStateRunSoundBelow.comp
+      (hfirst.profileEmits sourceRest rest slots)
+      (hsecondProfile sourceRest rest slots)
+
+/-- Profile-source adapter for every spine that lowers its head at the shared
+world and then delegates to `applyRest`. Source-profile inversion, executable
+head/rest recovery, erased reflection, erased-result forcing, canonical
+profile reconciliation, and erased/non-erased dispatch occur once; clients
+retain only their exact/bounded and ordinary/reachable judgments. -/
+private theorem lowerSpine_apply_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    {HeadSound : IxIR0.Value → SourceProfile → VEnv → Emit → AVal →
+      LowSt → Prop}
+    {Result : IxIR0.Value → SourceProfile → Prop}
+    (hheadSound : ∀ {sourceFuel : Nat}
+        {sourceFunction : IxIR0.Value} {headProfile : SourceProfile}
+        {functionOutput : VEnv} {emitFunction : Emit}
+        {function : AVal} {middleState : LowSt},
+      IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv head
+        sourceFunction headProfile →
+      (lowerE src (fuel + 1) input .shared head).run state =
+        .ok (functionOutput, emitFunction, function) middleState →
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState →
+      HeadSound sourceFunction headProfile functionOutput emitFunction
+        function middleState)
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (herasedFinish : ∀ {sourceArgs : List IxIR0.Value}
+        {headProfile argsProfile applyProfile : SourceProfile}
+        {functionOutput : VEnv} {emitFunction : Emit}
+        {middleState : LowSt},
+      SourceArgsProfile sourceCtx sourceEnv args sourceArgs argsProfile →
+      SourceAppliesProfile sourceCtx .erased sourceArgs .erased
+        applyProfile →
+      HeadSound .erased headProfile functionOutput emitFunction
+        (.constA .erased) middleState →
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        (.constA .erased) args).run middleState =
+          .ok (output, emit, av) finalState →
+      Result .erased (headProfile + argsProfile + applyProfile))
+    (hnonErasedFinish : ∀ {sourceFunction : IxIR0.Value}
+        {sourceArgs : List IxIR0.Value}
+        {headProfile argsProfile applyProfile : SourceProfile}
+        {functionOutput : VEnv} {emitFunction : Emit}
+        {function : AVal} {middleState : LowSt},
+      function ≠ .constA .erased →
+      SourceArgsProfile sourceCtx sourceEnv args sourceArgs argsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+        applyProfile →
+      HeadSound sourceFunction headProfile functionOutput emitFunction
+        function middleState →
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState →
+      Result sourceResult (headProfile + argsProfile + applyProfile))
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hinvert : ∃ functionOutput emitFunction function middleState,
+      (lowerE src (fuel + 1) input .shared head).run state =
+        .ok (functionOutput, emitFunction, function) middleState ∧
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState) :
+    Result sourceResult profile := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs headProfile argsProfile applyProfile
+      hhead hsourceArgs hsourceApply hprofile
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ := hinvert
+    have hfunctionSound := hheadSound hhead hfunctionRun hrestRun
+    rw [← hprofile]
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead.run hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.toSourceApplies.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact herasedFinish hsourceArgs hsourceApply hfunctionSound hrestRun
+    · exact hnonErasedFinish herased hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+
+/-- Complete profiled dynamic-head spine rule.  The canonical source profile
+splits into the head evaluation, strict arguments, and entered applications;
+the erased and genuine higher-order branches preserve that same split. -/
+theorem lowerSpine_dynamic_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input functionOutput
+        sourceEnv sourceEnv sourceFunction .shared emitFunction function
+        headProfile)
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ =>
+      hexpr hhead hfunctionRun)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hfunctionSound hrestRun =>
+      applyRest_erased_run_profile_sound hargs hsourceArgs hsourceApply
+        hfunctionSound hrestRun)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun =>
+      hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply hfunctionSound
+        hrestRun)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)
+
+/-- Profiled ordinary-variable spine.  Once the dedicated recursor-self
+descriptor is excluded, variable heads follow the same lower-then-apply
+profile split as all other dynamic heads. -/
+theorem lowerSpine_var_dynamic_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEProfilePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input functionOutput
+        sourceEnv sourceEnv sourceFunction .shared emitFunction function
+        headProfile)
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ =>
+      hexpr hhead hfunctionRun)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hfunctionSound hrestRun =>
+      applyRest_erased_run_profile_sound hargs hsourceArgs hsourceApply
+        hfunctionSound hrestRun)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun =>
+      hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply hfunctionSound
+        hrestRun)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)
+
+/-- Complete target-fuel-bounded profiled dynamic-head spine rule.  The canonical source profile
+splits into the head evaluation, strict arguments, and entered applications;
+the erased and genuine higher-order branches preserve that same split. -/
+theorem lowerSpine_dynamic_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit src
+      (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        functionOutput sourceEnv sourceEnv sourceFunction .shared emitFunction
+        function headProfile)
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ =>
+      hexpr hhead hfunctionRun)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hfunctionSound hrestRun =>
+      applyRest_erased_run_profile_sound_below hargs hsourceArgs hsourceApply
+        hfunctionSound hrestRun)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun =>
+      hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply hfunctionSound
+        hrestRun)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)
+
+/-- Target-fuel-bounded profiled ordinary-variable spine.  Once the dedicated recursor-self
+descriptor is excluded, variable heads follow the same lower-then-apply
+profile split as all other dynamic heads. -/
+theorem lowerSpine_var_dynamic_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit src
+      (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        functionOutput sourceEnv sourceEnv sourceFunction .shared emitFunction
+        function headProfile)
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ =>
+      hexpr hhead hfunctionRun)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hfunctionSound hrestRun =>
+      applyRest_erased_run_profile_sound_below hargs hsourceArgs hsourceApply
+        hfunctionSound hrestRun)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun =>
+      hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply hfunctionSound
+        hrestRun)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)
+
+/-- Shared profiled sequencing for `knownCall`. Prefix execution, source and
+profile splitting, terminal output recovery, and excess-tail dispatch are
+independent of the exact/bounded and ordinary/reachable judgment carried by
+the callbacks. -/
+private theorem knownCall_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Ixon.Owned}
+    {resultWorld : Ixon.Owned} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {Reach : LowSt → Prop}
+    {Result : VEnv → Emit → AVal → LowSt → Prop}
+    (hprefixBack : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {prefixState : LowSt},
+      (applyRest src fuel prefixOutput.bump resultWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) (args.drop count)).run prefixState =
+          .ok (output, emit, av) finalState →
+      Reach finalState → Reach prefixState)
+    (hterminal : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value}
+        {prefixArgsProfile prefixApplyProfile : SourceProfile}
+        {prefixState : LowSt},
+      args.length ≤ count →
+      SourceArgsProfile sourceCtx sourceEnv
+        (((args.take count).zip
+          (padWorlds argWorlds count)).map Prod.fst)
+        (sourceValues.take count) prefixArgsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceValues.take count) sourceBuilt prefixApplyProfile →
+      (lowerArgs src fuel input
+        ((args.take count).zip
+          (padWorlds argWorlds count))).run state =
+          .ok (prefixOutput, emitPrefix, prefixAVals) prefixState →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      sourceBuilt = sourceResult →
+      prefixArgsProfile = argsProfile →
+      prefixApplyProfile = applyProfile →
+      Reach prefixState →
+      Result prefixOutput.bump
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) prefixState)
+    (hoverFinish : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value}
+        {prefixArgsProfile tailArgsProfile prefixApplyProfile
+          tailApplyProfile : SourceProfile} {prefixState : LowSt},
+      count < args.length →
+      SourceArgsProfile sourceCtx sourceEnv
+        (((args.take count).zip
+          (padWorlds argWorlds count)).map Prod.fst)
+        (sourceValues.take count) prefixArgsProfile →
+      SourceArgsProfile sourceCtx sourceEnv (args.drop count)
+        (sourceValues.drop count) tailArgsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceValues.take count) sourceBuilt prefixApplyProfile →
+      SourceAppliesProfile sourceCtx sourceBuilt (sourceValues.drop count)
+        sourceResult tailApplyProfile →
+      prefixArgsProfile + tailArgsProfile = argsProfile →
+      prefixApplyProfile + tailApplyProfile = applyProfile →
+      (lowerArgs src fuel input
+        ((args.take count).zip
+          (padWorlds argWorlds count))).run state =
+          .ok (prefixOutput, emitPrefix, prefixAVals) prefixState →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      (applyRest src fuel prefixOutput.bump resultWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) (args.drop count)).run prefixState =
+          .ok (output, emit, av) finalState →
+      Reach prefixState → Reach finalState →
+      Result output emit av finalState)
+    (hfinalReach : Reach finalState)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    Result output emit av finalState := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    stateBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  obtain ⟨prefixArgsProfile, tailArgsProfile, hprefixArgs, htailArgs,
+      hargsProfile⟩ := hsourceArgs.splitAt count
+  obtain ⟨sourceBuilt, prefixApplyProfile, tailApplyProfile,
+      hprefixApply, htailApply, happlyProfile⟩ := hsource.splitAt count
+  have hprefixSource : SourceArgsProfile sourceCtx sourceEnv
+      (((args.take count).zip
+        (padWorlds argWorlds count)).map Prod.fst)
+      (sourceValues.take count) prefixArgsProfile := by
+    rw [knownCall_prefix_exprs_eq]
+    exact hprefixArgs
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hsourceLe : sourceValues.length ≤ count := by
+      simpa [← hsourceArgs.lengths] using hle
+    have hargsDrop : args.drop count = [] :=
+      List.drop_eq_nil_of_le hle
+    have hvaluesDrop : sourceValues.drop count = [] :=
+      List.drop_eq_nil_of_le hsourceLe
+    rw [hargsDrop, hvaluesDrop] at htailArgs
+    cases htailArgs
+    rw [hvaluesDrop] at htailApply
+    have hsourceBuiltEq : sourceBuilt = sourceResult := by
+      cases htailApply
+      rfl
+    cases htailApply
+    have hprefixArgsEq : prefixArgsProfile = argsProfile :=
+      (IxIR0.DynamicCost.Profile.add_zero _).symm.trans hargsProfile
+    have hprefixApplyEq : prefixApplyProfile = applyProfile :=
+      (IxIR0.DynamicCost.Profile.add_zero _).symm.trans happlyProfile
+    exact hterminal hle hprefixSource hprefixApply hprefixRun hprefixLength
+      hsourceBuiltEq hprefixArgsEq hprefixApplyEq hfinalReach
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixReach := hprefixBack hafterPrefix hfinalReach
+    exact hoverFinish hover hprefixSource htailArgs hprefixApply htailApply
+      hargsProfile happlyProfile hprefixRun hprefixLength hafterPrefix
+      hprefixReach hfinalReach
+
+/-- Profiled counterpart of the generic `knownCall` splitter.  Static head
+evaluation, prefix arguments, the built operation, excess arguments, and
+higher-order tail application are recombined into the exact canonical spine
+profile. -/
+theorem knownCall_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Ixon.Owned}
+    {resultWorld buildWorld : Ixon.Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value}
+        {prefixArgsProfile prefixApplyProfile : SourceProfile},
+      LowerArgsProfileSound funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals prefixArgsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceValues.take count) sourceBuilt prefixApplyProfile →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultProfileSound funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_core
+    (Reach := fun _ => True)
+    (Result := fun actualOutput actualEmit actualAV _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv sourceResult resultWorld actualEmit actualAV
+        (headProfile + argsProfile + applyProfile))
+    ?_ ?_ ?_ trivial hsourceArgs hsource hrun
+  · intro _ _ _ _ _ _
+    trivial
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile _ hle hprefixSource hprefixApply
+      hprefixRun hprefixLength hsourceBuiltEq hprefixArgsEq hprefixApplyEq _
+    cases hsourceBuiltEq
+    have hprefixSound := hargs hprefixSource hprefixRun
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    simpa [hterminalWorld hle, hprefixArgsEq, hprefixApplyEq] using hbuilt
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile tailArgsProfile prefixApplyProfile tailApplyProfile
+      _ hover _ htailArgs hprefixApply htailApply hargsProfile happlyProfile
+      hprefixRun hprefixLength hafterPrefix _ _
+    have hprefixSound := hargs (by assumption) hprefixRun
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    have hbuiltShared : LowerResultProfileSound funRel recSelfRel ctx cur
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile) := by
+      simpa [hoverWorld hover] using hbuilt
+    have htailSound := hrest (by simp) (drop_nonempty_of_lt_length hover)
+      htailArgs htailApply hbuiltShared hafterPrefix
+    apply LowerResultProfileSound.of_profile_eq htailSound
+    rw [← hargsProfile, ← happlyProfile]
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Direct-call specialization of profiled `knownCall`. -/
+theorem knownCall_call_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+    {f : Ixon.Address} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx f d argWorlds sourceFunction)
+    (hhead : SourceRefProfile sourceCtx f sourceFunction headProfile)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph_from_ref hdecl hownership hvalue hcost hhead
+    hprefixApply
+
+/-- Explicit-contract recursive-self specialization of profiled
+`knownCall`. -/
+theorem knownCall_callSelf_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceAddress : Ixon.Address}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hownership : Sim.FnOwnershipContract ctx cur argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx sourceAddress cur argWorlds
+      sourceFunction)
+    (hpositive : 0 < count)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hterminalWorld : args.length ≤ count → cur.result = resultWorld)
+    (hoverWorld : count < args.length → cur.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  have hsourceCount : count ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take count).length = count := by
+    simp [List.length_take, hsourceCount]
+  have hnonempty : sourceValues.take count ≠ [] := by
+    intro hempty
+    rw [hempty] at htakeLength
+    simp at htakeLength
+    omega
+  have hcalled := hprefix.callSelf_graph hownership hvalue hcost
+    (hprefixApply.toFnEntryProfile hnonempty)
+  apply LowerResultProfileSound.of_profile_eq
+    (hcalled.addProfileLeft headProfile)
+  exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Recursive-self `knownCall` whose value and cost contracts are selected
+from the synthetic self entry in the logical input environment. -/
+theorem knownCall_callSelf_entry_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hownership : Sim.FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hcost : recSelfRel sourceFunction count →
+      ∃ sourceAddress,
+        FnProfileContract funRel sourceCtx ctx sourceAddress cur
+          (List.replicate count .shared) sourceFunction)
+    (hpositive : 0 < count)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => by simpa [hresult]) (fun _ => by simpa [hresult]) hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals
+      prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  have hsourceCount : count ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take count).length = count := by
+    simp [List.length_take, hsourceCount]
+  have hnonempty : sourceValues.take count ≠ [] := by
+    intro hempty
+    rw [hempty] at htakeLength
+    simp at htakeLength
+    omega
+  have hcalled := hprefix.callSelf_entry_graph hentry hhead hownership
+    hvalue hcost hprefixApply hnonempty
+  apply LowerResultProfileSound.of_profile_eq
+    (hcalled.addProfileLeft headProfile)
+  exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Constructor-allocation specialization of profiled `knownCall`.
+Static evaluation of the constructor head funds the fresh constructor node;
+the saturated source prefix identifies the constructor fields exactly. -/
+theorem knownCall_alloc_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {world : Ixon.Owned}
+    {cid : CtorId} {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+      change 0 < headProfile.evals + prefixApplyProfile.evals
+      omega
+    have hallocated := hprefix.alloc_graph_of_evals_pos haddress htag hopPos
+    rw [hprefixApply.toSourceApplies.deterministic hctor]
+    apply LowerResultProfileSound.of_profile_eq hallocated
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Scalar-extern specialization of profiled `knownCall`.  The target
+extern operation is ownership-free, while the exact source prefix profile
+and statically erased head profile remain in the canonical spine total. -/
+theorem knownCall_extern_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {f : Ixon.Address}
+    {input output : VEnv} {resultWorld : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    have hextern := hprefix.extern_graph (resultWorld := resultWorld)
+      hcontract hlookup href htakeLength hprefixApply
+    apply LowerResultProfileSound.of_profile_eq
+      (hextern.addProfileLeft headProfile)
+    exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Partial-application specialization of profiled `knownCall`.  Static
+head evaluation funds the fresh PAP node; the application prefix remains
+available for the exact canonical spine profile. -/
+theorem knownCall_papp_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) (fun _ => rfl) hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared) emitPrefix prefixAVals
+      prefixArgsProfile := by
+    simpa only [hshape, havsLength] using hprefixSound
+  have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+    change 0 < headProfile.evals + prefixApplyProfile.evals
+    omega
+  have hpapp := hprefix.papp_graph_of_evals_pos hdecl
+    (hfun hprefixApply.toSourceApplies) (by simpa [havsLength] using hunder)
+    hopPos
+  apply LowerResultProfileSound.of_profile_eq hpapp
+  ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Same-address static PAP allocation under the canonical compiler function
+relation. -/
+theorem knownCall_papp_source_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound hargs hrest hcount hdecl hunder
+    hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+
+/-- Constructor-wrapper PAP allocation under the canonical compiler
+function relation. -/
+theorem knownCall_papp_wrapper_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ relationState.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound hargs hrest hcount hdecl hunder
+    hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+
+/-- Target-fuel-bounded counterpart of the generic `knownCall` splitter.  Static head
+evaluation, prefix arguments, the built operation, excess arguments, and
+higher-order tail application are recombined into the exact canonical spine
+profile. -/
+theorem knownCall_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Ixon.Owned}
+    {resultWorld buildWorld : Ixon.Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value}
+        {prefixArgsProfile prefixApplyProfile : SourceProfile},
+      LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals prefixArgsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceValues.take count) sourceBuilt prefixApplyProfile →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_core
+    (Reach := fun _ => True)
+    (Result := fun actualOutput actualEmit actualAV _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv sourceResult resultWorld actualEmit
+        actualAV (headProfile + argsProfile + applyProfile))
+    ?_ ?_ ?_ trivial hsourceArgs hsource hrun
+  · intro _ _ _ _ _ _
+    trivial
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile _ hle hprefixSource hprefixApply
+      hprefixRun hprefixLength hsourceBuiltEq hprefixArgsEq hprefixApplyEq _
+    cases hsourceBuiltEq
+    have hprefixSound := hargs hprefixSource hprefixRun
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    simpa [hterminalWorld hle, hprefixArgsEq, hprefixApplyEq] using hbuilt
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile tailArgsProfile prefixApplyProfile tailApplyProfile
+      _ hover _ htailArgs hprefixApply htailApply hargsProfile happlyProfile
+      hprefixRun hprefixLength hafterPrefix _ _
+    have hprefixSound := hargs (by assumption) hprefixRun
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    have hbuiltShared : LowerResultProfileSoundBelow funRel recSelfRel ctx cur
+        limit input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile) := by
+      simpa [hoverWorld hover] using hbuilt
+    have htailSound := hrest (by simp) (drop_nonempty_of_lt_length hover)
+      htailArgs htailApply hbuiltShared hafterPrefix
+    apply LowerResultProfileSoundBelow.of_profile_eq htailSound
+    rw [← hargsProfile, ← happlyProfile]
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Target-fuel-bounded direct-call specialization of profiled `knownCall`. -/
+theorem knownCall_call_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+    {f : Ixon.Address} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx f d argWorlds
+      sourceFunction limit)
+    (hhead : SourceRefProfile sourceCtx f sourceFunction headProfile)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_below hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph_from_ref hdecl hownership hvalue hcost hhead
+    hprefixApply
+
+/-- Target-fuel-bounded explicit-contract recursive-self specialization of profiled
+`knownCall`. -/
+theorem knownCall_callSelf_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {sourceAddress : Ixon.Address}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hownership : Sim.FnOwnershipContract ctx cur argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur argWorlds
+      sourceFunction limit)
+    (hpositive : 0 < count)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hterminalWorld : args.length ≤ count → cur.result = resultWorld)
+    (hoverWorld : count < args.length → cur.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_below hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  have hsourceCount : count ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take count).length = count := by
+    simp [List.length_take, hsourceCount]
+  have hnonempty : sourceValues.take count ≠ [] := by
+    intro hempty
+    rw [hempty] at htakeLength
+    simp at htakeLength
+    omega
+  have hcalled := hprefix.callSelf_graph hownership hvalue hcost
+    (hprefixApply.toFnEntryProfile hnonempty)
+  apply LowerResultProfileSoundBelow.of_profile_eq
+    (hcalled.addProfileLeft headProfile)
+  exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Target-fuel-bounded recursive-self `knownCall` whose value and cost contracts are selected
+from the synthetic self entry in the logical input environment. -/
+theorem knownCall_callSelf_entry_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hownership : Sim.FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hcost : recSelfRel sourceFunction count →
+      ∃ sourceAddress,
+        FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur
+          (List.replicate count .shared) sourceFunction limit)
+    (hpositive : 0 < count)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => by simpa [hresult]) (fun _ => by simpa [hresult]) hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals
+      prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  have hsourceCount : count ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take count).length = count := by
+    simp [List.length_take, hsourceCount]
+  have hnonempty : sourceValues.take count ≠ [] := by
+    intro hempty
+    rw [hempty] at htakeLength
+    simp at htakeLength
+    omega
+  have hcalled := hprefix.callSelf_entry_graph hentry hhead hownership
+    hvalue hcost hprefixApply hnonempty
+  apply LowerResultProfileSoundBelow.of_profile_eq
+    (hcalled.addProfileLeft headProfile)
+  exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+
+/-- Target-fuel-bounded constructor-allocation specialization of profiled `knownCall`.
+Static evaluation of the constructor head funds the fresh constructor node;
+the saturated source prefix identifies the constructor fields exactly. -/
+theorem knownCall_alloc_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel count : Nat} {world : Ixon.Owned}
+    {cid : CtorId} {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+      change 0 < headProfile.evals + prefixApplyProfile.evals
+      omega
+    have hallocated := hprefix.alloc_graph_of_evals_pos haddress htag hopPos
+    rw [hprefixApply.toSourceApplies.deterministic hctor]
+    apply LowerResultProfileSoundBelow.of_profile_eq hallocated
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Target-fuel-bounded scalar-extern specialization of profiled `knownCall`.  The target
+extern operation is ownership-free, while the exact source prefix profile
+and statically erased head profile remain in the canonical spine total. -/
+theorem knownCall_extern_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel count : Nat} {f : Ixon.Address}
+    {input output : VEnv} {resultWorld : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    have hextern := hprefix.extern_graph (resultWorld := resultWorld)
+      hcontract hlookup href htakeLength hprefixApply
+    apply LowerResultProfileSoundBelow.of_profile_eq
+      (hextern.addProfileLeft headProfile)
+    exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Target-fuel-bounded partial-application specialization of profiled `knownCall`.  Static
+head evaluation funds the fresh PAP node; the application prefix remains
+available for the exact canonical spine profile. -/
+theorem knownCall_papp_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel count : Nat} {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) (fun _ => rfl) hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared) emitPrefix prefixAVals
+      prefixArgsProfile := by
+    simpa only [hshape, havsLength] using hprefixSound
+  have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+    change 0 < headProfile.evals + prefixApplyProfile.evals
+    omega
+  have hpapp := hprefix.papp_graph_of_evals_pos hdecl
+    (hfun hprefixApply.toSourceApplies) (by simpa [havsLength] using hunder)
+    hopPos
+  apply LowerResultProfileSoundBelow.of_profile_eq hpapp
+  ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Target-fuel-bounded same-address static PAP allocation under the canonical compiler function
+relation. -/
+theorem knownCall_papp_source_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur limit
+      input output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound_below hargs hrest hcount hdecl hunder
+    hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+
+/-- Target-fuel-bounded constructor-wrapper PAP allocation under the canonical compiler
+function relation. -/
+theorem knownCall_papp_wrapper_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ relationState.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur limit
+      input output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound_below hargs hrest hcount hdecl hunder
+    hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+
+/-- Saturated and over-applied definition references use the paired value,
+ownership, and exact-profile declaration contracts selected at the source
+address. -/
+theorem lowerSpine_ref_defn_call_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx f d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound hargs hrest (by simp) hcount
+      hdecl hownership hvalue hcost hrefProfile hsourceArgs hsourceApply ?_ ?_
+      hknownRun
+    · intro hterminal
+      have heq : args.length = lamArity body :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro hover
+      have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+      simpa [hresult, hne] using hguard
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Under-applied definition references allocate a same-address PAP.  The
+nonempty static reference-head profile funds the node while the exact
+argument/application fragments remain in the canonical spine total. -/
+theorem lowerSpine_ref_defn_partial_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (stateThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (stateThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        have hknownSound : LowerResultProfileSound
+            (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+            ctx cur input output sourceEnv sourceEnv sourceResult .shared
+            emit av (headProfile + argsProfile + applyProfile) := by
+          apply knownCall_papp_source_run_profile_sound hargs hrest
+            (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+            (by simpa [sourceDeclArity, declArity] using harity.symm)
+            href hdecl (by simpa [declArity, harity] using hunder)
+            hheadPos hsourceArgs hsourceApply hknown
+        exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Saturated and over-applied recursor references use the generated direct
+function's value, ownership, and exact-profile contracts. -/
+theorem lowerSpine_ref_recursor_call_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx f d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound hargs hrest (by simp) hcount
+      hdecl hownership hvalue hcost hrefProfile hsourceArgs hsourceApply ?_ ?_
+      hknownRun
+    · intro hterminal
+      have heq : args.length = numArgs + 1 :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro _
+      simpa [hresult] using hguard
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Under-applied recursor references allocate ordinary same-address PAPs,
+funded by the nonempty static head profile. -/
+theorem lowerSpine_ref_recursor_partial_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    have hknownSound : LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+        ctx cur input output sourceEnv sourceEnv sourceResult .shared emit av
+        (headProfile + argsProfile + applyProfile) := by
+      apply knownCall_papp_source_run_profile_sound hargs hrest
+        (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+        (by simpa [sourceDeclArity, declArity] using harity.symm)
+        href hdecl (by simpa [declArity, harity] using hunder)
+        hheadPos hsourceArgs hsourceApply hknown
+    exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Saturated and over-applied constructor references allocate the target
+node for the exact source saturation prefix. -/
+theorem lowerSpine_ref_ctor_alloc_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_alloc_run_profile_sound hargs hrest hcount rfl rfl hheadPos
+      hsourceArgs hsourceApply hctor hknown
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Under-applied constructor references use their memoized eta wrapper;
+the final-state memo is transported to the ambient compiler relation before
+the PAP profile rule is applied. -/
+theorem lowerSpine_ref_ctor_partial_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      stateBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ relationState.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    have hknownSound : LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+        ctx cur input output sourceEnv sourceEnv sourceResult .shared emit av
+        (headProfile + argsProfile + applyProfile) := by
+      apply knownCall_papp_wrapper_run_profile_sound hargs hrest
+        (Nat.le_refl _) hmemo hsrc href hdecl
+        (by simp [memo, ctorWrapperDecl, declArity])
+        (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+        hheadPos hsourceArgs hsourceApply hknownRun
+    exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Saturated and over-applied extern references cross the explicit scalar
+oracle value boundary while preserving the exact source profile. -/
+theorem lowerSpine_ref_extern_call_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, _⟩ :=
+    hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_extern_run_profile_sound hargs hrest hcontract hcount
+      hlookup href hsourceArgs hsourceApply hknown
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Under-applied extern references are same-address PAPs funded by their
+nonempty reference-head evaluation profile. -/
+theorem lowerSpine_ref_extern_partial_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    have hknownSound : LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+        ctx cur input output sourceEnv sourceEnv sourceResult .shared emit av
+        (headProfile + argsProfile + applyProfile) := by
+      apply knownCall_papp_source_run_profile_sound hargs hrest
+        (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href
+        hdecl (by simpa [declArity] using hunder) hheadPos hsourceArgs
+        hsourceApply hknown
+    exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Complete profiled `.ref` dispatch for the canonical compiler function
+relation. -/
+theorem lowerSpine_ref_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceResult world emit av profile)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_profile_sound
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_profile_sound
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_profile_sound
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_profile_sound
+        hargs hrest hlookup hsrc hcount hsource hrun)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_profile_sound
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_profile_sound
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_profile_sound
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_profile_sound
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun)
+    hrun
+
+/-- Standalone profiled reference lowering is the empty flattened source
+and target spine. -/
+theorem lowerE_ref_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv
+      (.ref f) sourceResult profile)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  apply lowerSpine_ref_run_profile_sound henv hargs hrest hknownExtra
+    hcontracts hvalues hprofiles (SourceSpineProfile.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+
+/-- Profiled saturated/over-applied recursive-self spine.  The synthetic
+input entry selects both semantic and exact-cost contracts for the current
+function; under-application remains rejected by the executable lowerer. -/
+theorem lowerSpine_recSelf_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hownership : Sim.FnOwnershipContract ctx cur
+      (List.replicate arity .shared))
+    (hvalue : ∀ {sourceFunction : IxIR0.Value},
+      recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate arity .shared) sourceFunction)
+    (hcost : ∀ {sourceFunction : IxIR0.Value},
+      recSelfRel sourceFunction arity →
+      ∃ sourceAddress,
+        FnProfileContract funRel sourceCtx ctx sourceAddress cur
+          (List.replicate arity .shared) sourceFunction)
+    (hpositive : 0 < arity)
+    (hresult : cur.result = .shared)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues headProfile argsProfile applyProfile
+      hhead hsourceArgs hsourceApply hprofile
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead.run
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [stateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state =
+              .ok () state := by
+          rfl
+        rw [stateBindRun, hrequire] at hrun
+        simp only at hrun
+        have hknownSound : LowerResultProfileSound funRel recSelfRel ctx cur
+            input output sourceEnv sourceEnv sourceResult .shared emit av
+            (headProfile + argsProfile + applyProfile) :=
+          knownCall_callSelf_entry_run_profile_sound hargs hrest hcount
+            hentry hsourceHead hownership hvalue hcost hpositive hresult
+            hsourceArgs hsourceApply hrun
+        exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded saturated and over-applied definition references use the paired value,
+ownership, and exact-profile declaration contracts selected at the source
+address. -/
+theorem lowerSpine_ref_defn_call_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx
+      limit)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContractBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx f d
+      ((lamUses body).map worldOfUses) sourceFunction limit := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound_below hargs hrest (by simp) hcount
+      hdecl hownership hvalue hcost hrefProfile hsourceArgs hsourceApply ?_ ?_
+      hknownRun
+    · intro hterminal
+      have heq : args.length = lamArity body :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro hover
+      have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+      simpa [hresult, hne] using hguard
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded under-applied definition references allocate a same-address PAP.  The
+nonempty static reference-head profile funds the node while the exact
+argument/application fragments remain in the canonical spine total. -/
+theorem lowerSpine_ref_defn_partial_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (stateThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (stateThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        have hknownSound : LowerResultProfileSoundBelow
+            (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+            ctx cur limit input output sourceEnv sourceEnv sourceResult .shared
+            emit av (headProfile + argsProfile + applyProfile) := by
+          apply knownCall_papp_source_run_profile_sound_below hargs hrest
+            (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+            (by simpa [sourceDeclArity, declArity] using harity.symm)
+            href hdecl (by simpa [declArity, harity] using hunder)
+            hheadPos hsourceArgs hsourceApply hknown
+        exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded saturated and over-applied recursor references use the generated direct
+function's value, ownership, and exact-profile contracts. -/
+theorem lowerSpine_ref_recursor_call_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx
+      limit)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContractBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx f d
+      (List.replicate (numArgs + 1) .shared) sourceFunction limit := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound_below hargs hrest (by simp) hcount
+      hdecl hownership hvalue hcost hrefProfile hsourceArgs hsourceApply ?_ ?_
+      hknownRun
+    · intro hterminal
+      have heq : args.length = numArgs + 1 :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro _
+      simpa [hresult] using hguard
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded under-applied recursor references allocate ordinary same-address PAPs,
+funded by the nonempty static head profile. -/
+theorem lowerSpine_ref_recursor_partial_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    have hknownSound : LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+        ctx cur limit input output sourceEnv sourceEnv sourceResult .shared emit av
+        (headProfile + argsProfile + applyProfile) := by
+      apply knownCall_papp_source_run_profile_sound_below hargs hrest
+        (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+        (by simpa [sourceDeclArity, declArity] using harity.symm)
+        href hdecl (by simpa [declArity, harity] using hunder)
+        hheadPos hsourceArgs hsourceApply hknown
+    exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded saturated and over-applied constructor references allocate the target
+node for the exact source saturation prefix. -/
+theorem lowerSpine_ref_ctor_alloc_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_alloc_run_profile_sound_below hargs hrest hcount rfl rfl hheadPos
+      hsourceArgs hsourceApply hctor hknown
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded under-applied constructor references use their memoized eta wrapper;
+the final-state memo is transported to the ambient compiler relation before
+the PAP profile rule is applied. -/
+theorem lowerSpine_ref_ctor_partial_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      stateBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ relationState.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    have hknownSound : LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+        ctx cur limit input output sourceEnv sourceEnv sourceResult .shared emit av
+        (headProfile + argsProfile + applyProfile) := by
+      apply knownCall_papp_wrapper_run_profile_sound_below hargs hrest
+        (Nat.le_refl _) hmemo hsrc href hdecl
+        (by simp [memo, ctorWrapperDecl, declArity])
+        (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+        hheadPos hsourceArgs hsourceApply hknownRun
+    exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded saturated and over-applied extern references cross the explicit scalar
+oracle value boundary while preserving the exact source profile. -/
+theorem lowerSpine_ref_extern_call_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, _⟩ :=
+    hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_extern_run_profile_sound_below hargs hrest hcontract hcount
+      hlookup href hsourceArgs hsourceApply hknown
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Target-fuel-bounded under-applied extern references are same-address PAPs funded by their
+nonempty reference-head evaluation profile. -/
+theorem lowerSpine_ref_extern_partial_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    have hknownSound : LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+        ctx cur limit input output sourceEnv sourceEnv sourceResult .shared emit av
+        (headProfile + argsProfile + applyProfile) := by
+      apply knownCall_papp_source_run_profile_sound_below hargs hrest
+        (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href
+        hdecl (by simpa [declArity] using hunder) hheadPos hsourceArgs
+        hsourceApply hknown
+    exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Complete target-fuel-bounded profiled `.ref` dispatch for the canonical compiler function
+relation. -/
+theorem lowerSpine_ref_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+      limit input output sourceEnv sourceEnv sourceResult world emit av profile)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_profile_sound_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_profile_sound_below
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_profile_sound_below
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_profile_sound_below
+        hargs hrest hlookup hsrc hcount hsource hrun)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_profile_sound_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_profile_sound_below
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_profile_sound_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_profile_sound_below
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun)
+    hrun
+
+/-- Target-fuel-bounded standalone profiled reference lowering is the empty flattened source
+and target spine. -/
+theorem lowerE_ref_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv
+      (.ref f) sourceResult profile)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  apply lowerSpine_ref_run_profile_sound_below henv hargs hrest hknownExtra
+    hcontracts hvalues hprofiles (SourceSpineProfile.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+
+/-- Target-fuel-bounded profiled saturated/over-applied recursive-self spine.  The synthetic
+input entry selects both semantic and exact-cost contracts for the current
+function; under-application remains rejected by the executable lowerer. -/
+theorem lowerSpine_recSelf_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hownership : Sim.FnOwnershipContract ctx cur
+      (List.replicate arity .shared))
+    (hvalue : ∀ {sourceFunction : IxIR0.Value},
+      recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate arity .shared) sourceFunction)
+    (hcost : ∀ {sourceFunction : IxIR0.Value},
+      recSelfRel sourceFunction arity →
+      ∃ sourceAddress,
+        FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur
+          (List.replicate arity .shared) sourceFunction limit)
+    (hpositive : 0 < arity)
+    (hresult : cur.result = .shared)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues headProfile argsProfile applyProfile
+      hhead hsourceArgs hsourceApply hprofile
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead.run
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [stateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state =
+              .ok () state := by
+          rfl
+        rw [stateBindRun, hrequire] at hrun
+        simp only at hrun
+        have hknownSound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur
+            limit input output sourceEnv sourceEnv sourceResult .shared emit av
+            (headProfile + argsProfile + applyProfile) :=
+          knownCall_callSelf_entry_run_profile_sound_below hargs hrest hcount
+            hentry hsourceHead hownership hvalue hcost hpositive hresult
+            hsourceArgs hsourceApply hrun
+        exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Forget a released leading let binder while preserving the exact source
+profile.  The logical `VEnv.pop` changes only the state relation; it emits no
+target instruction and therefore contributes the zero profile. -/
+theorem LowerResultProfileSound.popFirstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {world : Ixon.Owned} {emit : Emit} {av : AVal}
+    {profile : SourceProfile}
+    (hsound : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output sourceInput (boundSource :: sourceOutput)
+      sourceValue world emit av profile)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceValue world emit av profile := by
+  refine
+    { toLowerResultValueSound :=
+        hsound.toLowerResultValueSound.popFirstReleased hfirst
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hpop : ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        (boundSource :: sourceOutput) sourceValue world av
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots)
+      0 := by
+    apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hvalueGraph,
+      hrestGraph, hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ (_root_.id : Emit))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots)
+      (profile + 0) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hsound.profileEmits sourceRest rest slots) hpop
+  have hnormalized : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ (_root_.id : Emit))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots)
+      profile :=
+    ProfileFundedEmitStateRunSound.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero profile)
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact hnormalized horder henv hpre hrun hcontinuation
+
+/-- Reclassify a shared slot result as a pending borrow owner without an
+additional target instruction or source charge. -/
+theorem LowerResultProfileSound.asBorrowSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {abs : Nat}
+    {profile : SourceProfile}
+    (hsound : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.slotA abs) profile) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit (.slotA abs) true
+      profile := by
+  refine
+    { toLowerBorrowValueSound :=
+        hsound.toLowerResultValueSound.asBorrowSlot
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : ProfileFundedEmitStateRunSound ctx cur
+      (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.slotA abs) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots)
+      0 := by
+    apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : Sim.HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ (_root_.id : Emit))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots)
+      (profile + 0) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hsound.profileEmits sourceRest rest slots) hconvert
+  have hnormalized : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ (_root_.id : Emit))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots)
+      profile :=
+    ProfileFundedEmitStateRunSound.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero profile)
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact hnormalized horder henv hpre hrun hcontinuation
+
+/-- Stable scalar results become non-releasing borrows.  Their distinguished
+ownership root is inert and can be forgotten at zero paired cost. -/
+theorem LowerResultProfileSound.asBorrowConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {atom : Atom}
+    {profile : SourceProfile}
+    (hsound : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA atom) profile) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit (.constA atom) false
+      profile := by
+  refine
+    { toLowerBorrowValueSound :=
+        hsound.toLowerResultValueSound.asBorrowConst
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : ProfileFundedEmitStateRunSound ctx cur
+      (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.constA atom) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots)
+      0 := by
+    apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : Sim.HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation
+        (hsound.toLowerResultValueSound.stable.const_noLocation hav)
+  have hcomposed : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ (_root_.id : Emit))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots)
+      (profile + 0) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hsound.profileEmits sourceRest rest slots) hconvert
+  have hnormalized : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ (_root_.id : Emit))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots)
+      profile :=
+    ProfileFundedEmitStateRunSound.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero profile)
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact hnormalized horder henv hpre hrun hcontinuation
+
+/-- Fuel-bounded forgetting of a released leading let binder. -/
+theorem LowerResultProfileSoundBelow.popFirstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {world : Ixon.Owned} {emit : Emit} {av : AVal}
+    {profile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput (boundSource :: sourceOutput)
+      sourceValue world emit av profile)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.pop sourceInput sourceOutput sourceValue world emit av
+      profile := by
+  have hvalue : LowerResultValueSound funRel recSelfRel ctx cur input
+      output.pop sourceInput sourceOutput sourceValue world
+      (emit ∘ (_root_.id : Emit)) av := by
+    simpa [Function.comp_def] using
+      hsound.toLowerResultValueSound.popFirstReleased hfirst
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel output
+          (boundSource :: sourceOutput) sourceValue world av
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.pop
+          sourceOutput sourceValue world av sourceRest rest slots)
+        0 := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hvalueGraph,
+      hrestGraph, hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcombined := hsound.thenResult hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+  simpa [Function.comp_def] using hnormalized
+
+/-- Fuel-bounded reclassification of a shared slot result as a pending
+borrow owner. -/
+theorem LowerResultProfileSoundBelow.asBorrowSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {abs : Nat}
+    {profile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.slotA abs) profile) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue emit (.slotA abs) true
+      profile := by
+  have hvalue : LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue (emit ∘ (_root_.id : Emit))
+      (.slotA abs) true := by
+    simpa [Function.comp_def] using
+      hsound.toLowerResultValueSound.asBorrowSlot
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue .shared (.slotA abs) sourceRest rest slots)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+          sourceValue (.slotA abs) true sourceRest rest slots)
+        0 := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : Sim.HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcombined := hsound.thenBorrow hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+  simpa [Function.comp_def] using hnormalized
+
+/-- Fuel-bounded conversion of a stable scalar result into a non-releasing
+borrow. -/
+theorem LowerResultProfileSoundBelow.asBorrowConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {atom : Atom}
+    {profile : SourceProfile}
+    (hsound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA atom) profile) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue emit (.constA atom) false
+      profile := by
+  have hvalue : LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue (emit ∘ (_root_.id : Emit))
+      (.constA atom) false := by
+    simpa [Function.comp_def] using
+      hsound.toLowerResultValueSound.asBorrowConst
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue .shared (.constA atom) sourceRest rest slots)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+          sourceValue (.constA atom) false sourceRest rest slots)
+        0 := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : Sim.HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation
+        (hsound.toLowerResultValueSound.stable.const_noLocation hav)
+  have hcombined := hsound.thenBorrow hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_zero profile)
+  simpa [Function.comp_def] using hnormalized
+
+/-- Source-profile let sequencing.  The bound expression, binder
+installation, and popped body share exact runtime midpoints.  The compiler's
+binder prefix is charged to the source `evalLet` event, and profile
+commutativity puts that event in the canonical source-trace order. -/
+theorem LowerResultProfileSound.installThen
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input middle installed output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {boundSource sourceResult : IxIR0.Value}
+    {boundWorld resultWorld : Ixon.Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    {boundProfile bodyProfile : SourceProfile}
+    (hbound : LowerResultProfileSound funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle boundSource boundWorld
+      boundEmit boundValue boundProfile)
+    (hinstall : InstallBinderProfileSound funRel recSelfRel ctx cur
+      middle installed sourceMiddle boundSource boundWorld boundValue
+      installEmit (IxIR0.DynamicCost.tick .evalLet))
+    (hbody : LowerResultProfileSound funRel recSelfRel ctx cur
+      installed output (boundSource :: sourceMiddle)
+      (boundSource :: sourceOutput) sourceResult resultWorld
+      bodyEmit result bodyProfile)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceResult resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result
+      (boundProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine
+    { toLowerResultValueSound :=
+        hbound.toLowerResultValueSound.installThen
+          hinstall.toInstallBinderValueSound
+          hbody.toLowerResultValueSound hreleased
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hboundInstall : ProfileFundedEmitStateRunSound ctx cur
+      (boundEmit ∘ installEmit)
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel installed
+        (boundSource :: sourceMiddle) sourceRest rest slots)
+      (boundProfile + IxIR0.DynamicCost.tick .evalLet) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hbound.profileEmits sourceRest rest slots)
+      (hinstall.profileEmits sourceRest rest slots)
+  have hall : ProfileFundedEmitStateRunSound ctx cur
+      ((boundEmit ∘ installEmit) ∘ bodyEmit)
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop sourceOutput
+        sourceResult resultWorld result sourceRest rest slots)
+      ((boundProfile + IxIR0.DynamicCost.tick .evalLet) + bodyProfile) :=
+    ProfileFundedEmitStateRunSound.comp hboundInstall
+      (hpopped.profileEmits sourceRest rest slots)
+  have hprofile :
+      (boundProfile + IxIR0.DynamicCost.tick .evalLet) + bodyProfile =
+        boundProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet := by
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+  have hnormalized : ProfileFundedEmitStateRunSound ctx cur
+      ((boundEmit ∘ installEmit) ∘ bodyEmit)
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop sourceOutput
+        sourceResult resultWorld result sourceRest rest slots)
+      (boundProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) :=
+    ProfileFundedEmitStateRunSound.of_profile_eq hall hprofile
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact hnormalized horder henv hpre hrun hcontinuation
+
+/-- Fuel-bounded source-profile let sequencing. -/
+theorem LowerResultProfileSoundBelow.installThen
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle installed output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {boundSource sourceResult : IxIR0.Value}
+    {boundWorld resultWorld : Ixon.Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    {boundProfile bodyProfile : SourceProfile}
+    (hbound : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle boundSource boundWorld
+      boundEmit boundValue boundProfile)
+    (hinstall : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur
+      limit middle installed sourceMiddle boundSource boundWorld boundValue
+      installEmit (IxIR0.DynamicCost.tick .evalLet))
+    (hbody : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      installed output (boundSource :: sourceMiddle)
+      (boundSource :: sourceOutput) sourceResult resultWorld
+      bodyEmit result bodyProfile)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.pop sourceInput sourceOutput sourceResult resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result
+      (boundProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine
+    { toLowerResultValueSound :=
+        hbound.toLowerResultValueSound.installThen
+          hinstall.toInstallBinderValueSound
+          hbody.toLowerResultValueSound hreleased
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hboundInstall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (boundEmit ∘ installEmit)
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel installed
+        (boundSource :: sourceMiddle) sourceRest rest slots)
+      (boundProfile + IxIR0.DynamicCost.tick .evalLet) :=
+    ProfileFundedEmitStateRunSoundBelow.comp
+      (hbound.profileEmits sourceRest rest slots)
+      (hinstall.profileEmits sourceRest rest slots)
+  have hall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      ((boundEmit ∘ installEmit) ∘ bodyEmit)
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop sourceOutput
+        sourceResult resultWorld result sourceRest rest slots)
+      ((boundProfile + IxIR0.DynamicCost.tick .evalLet) + bodyProfile) :=
+    ProfileFundedEmitStateRunSoundBelow.comp hboundInstall
+      (hpopped.profileEmits sourceRest rest slots)
+  have hprofile :
+      (boundProfile + IxIR0.DynamicCost.tick .evalLet) + bodyProfile =
+        boundProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet := by
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+  exact ProfileFundedEmitStateRunSoundBelow.of_profile_eq hall hprofile
+
+/-- Installing a live slot-backed binder aliases its existing physical slot.
+The target prefix is the identity, so the source let event has its entire
+paired allowance left unused. -/
+theorem installAliasBinder_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Ixon.Uses} :
+    InstallBinderProfileSound funRel recSelfRel ctx cur input
+      (installAliasBinder input abs remaining uses true)
+      sourceEnv boundSource (worldOfUses uses) (.slotA abs)
+      (_root_.id : Emit) (IxIR0.DynamicCost.tick .evalLet) := by
+  refine
+    { toInstallBinderValueSound :=
+        installAliasBinder_held_value_sound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.monoProfile
+  · apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, hinput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases hav with
+    | slot hbound hslot =>
+        let output := installAliasBinder input abs remaining uses true
+        have htail : EntriesValueGraph funRel recSelfRel store output env
+            input.entries sourceEnv roots :=
+          hinput.entries.of_depth_eq
+            (by simp [output, installAliasBinder])
+        have hvalueWorld : Sim.HasWorld store (worldOfUses uses) value :=
+          hown.roots_world ⟨worldOfUses uses, value⟩ (by simp)
+        have houtput : VEnvValueGraph funRel recSelfRel store output
+            (boundSource :: sourceEnv) env
+            (⟨worldOfUses uses, value⟩ :: roots) := by
+          refine ⟨by simpa [output, installAliasBinder] using
+            hinput.depth_eq, ?_⟩
+          exact EntriesValueGraph.held
+            (by simpa [output, installAliasBinder] using hbound)
+            (by simpa [output, installAliasBinder, VEnv.rel] using hslot)
+            hvalueWorld hvalueGraph htail
+        refine ⟨⟨⟨worldOfUses uses, value⟩ :: roots,
+          houtput, hrestGraph, ?_⟩, ?_⟩
+        · simpa using hown
+        · exact SlotsRealize.of_depth_eq
+            (by simp [output, installAliasBinder]) hslots
+  · exact zeroOwnershipAllowance_le_profile _
+
+theorem installAliasBinder_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Ixon.Uses} :
+    InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (installAliasBinder input abs remaining uses true)
+      sourceEnv boundSource (worldOfUses uses) (.slotA abs)
+      (_root_.id : Emit) (IxIR0.DynamicCost.tick .evalLet) := by
+  refine
+    { toInstallBinderValueSound :=
+        installAliasBinder_held_value_sound
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+  · apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, value, hinput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases hav with
+    | slot hbound hslot =>
+        let output := installAliasBinder input abs remaining uses true
+        have htail : EntriesValueGraph funRel recSelfRel store output env
+            input.entries sourceEnv roots :=
+          hinput.entries.of_depth_eq
+            (by simp [output, installAliasBinder])
+        have hvalueWorld : Sim.HasWorld store (worldOfUses uses) value :=
+          hown.roots_world ⟨worldOfUses uses, value⟩ (by simp)
+        have houtput : VEnvValueGraph funRel recSelfRel store output
+            (boundSource :: sourceEnv) env
+            (⟨worldOfUses uses, value⟩ :: roots) := by
+          refine ⟨by simpa [output, installAliasBinder] using
+            hinput.depth_eq, ?_⟩
+          exact EntriesValueGraph.held
+            (by simpa [output, installAliasBinder] using hbound)
+            (by simpa [output, installAliasBinder, VEnv.rel] using hslot)
+            hvalueWorld hvalueGraph htail
+        refine ⟨⟨⟨worldOfUses uses, value⟩ :: roots,
+          houtput, hrestGraph, ?_⟩, ?_⟩
+        · simpa using hown
+        · exact SlotsRealize.of_depth_eq
+            (by simp [output, installAliasBinder]) hslots
+  · exact zeroOwnershipAllowance_le_profile _
+
+/-- Materializing a stable scalar binder emits one ownership-free `pure`.
+The exact semantic push and the zero paired operation cost are certified at
+the same continuation boundary. -/
+theorem materializeConstBinder_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Ixon.Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    InstallBinderProfileSound funRel recSelfRel ctx cur input
+      (installPushedBinder input remaining uses held)
+      sourceEnv boundSource (worldOfUses uses) (.constA atom)
+      (emitOp (.pure atom)) (IxIR0.DynamicCost.tick .evalLet) := by
+  refine
+    { toInstallBinderValueSound :=
+        materializeConstBinder_value_sound hstable
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.localOp
+      (allowance := ⟨0, 0⟩)
+  · intro fuel store env store' result hpre hrun
+    obtain ⟨⟨roots, value, hinput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+        have hpure := Ix.Compiler.IxIR1.Sim.runOp_pure
+          (ctx := ctx) (cur := cur)
+          (fuel := fuel) (store := store) hav.resolveAtom
+        have hpair : (store, value) = (store', result) :=
+          Except.ok.inj (hpure.symm.trans hrun)
+        cases hpair
+        let output := installPushedBinder input remaining uses held
+        have htail : EntriesValueGraph funRel recSelfRel store output
+            (result :: env) input.entries sourceEnv roots :=
+          (hinput.entries.bump result).of_depth_eq
+            (by simp [output, installPushedBinder, VEnv.bump])
+        have hdepth : (result :: env).length = output.depth := by
+          simpa [output, installPushedBinder] using
+            congrArg Nat.succ hinput.depth_eq
+        cases held with
+        | false =>
+            have houtput : VEnvValueGraph funRel recSelfRel store output
+                (boundSource :: sourceEnv) (result :: env) roots := by
+              refine ⟨hdepth, ?_⟩
+              exact EntriesValueGraph.released
+                (by simp [output, installPushedBinder]) htail
+            refine ⟨⟨roots, houtput, hrestGraph, ?_⟩, ?_⟩
+            · exact hown.dropNoLocation
+                (hstable.const_noLocation hav)
+            · exact SlotsRealize.of_depth_eq
+                (by simp [output, installPushedBinder, VEnv.bump])
+                (hslots.bump result)
+        | true =>
+            have hvalueWorld : Sim.HasWorld store
+                (worldOfUses uses) result :=
+              hown.roots_world ⟨worldOfUses uses, result⟩ (by simp)
+            have houtput : VEnvValueGraph funRel recSelfRel store output
+                (boundSource :: sourceEnv) (result :: env)
+                (⟨worldOfUses uses, result⟩ :: roots) := by
+              refine ⟨hdepth, ?_⟩
+              exact EntriesValueGraph.held
+                (by simp [output, installPushedBinder])
+                (by simp [output, installPushedBinder, VEnv.rel])
+                hvalueWorld hvalueGraph htail
+            refine ⟨⟨⟨worldOfUses uses, result⟩ :: roots,
+              houtput, hrestGraph, ?_⟩, ?_⟩
+            · simpa using hown
+            · exact SlotsRealize.of_depth_eq
+                (by simp [output, installPushedBinder, VEnv.bump])
+                (hslots.bump result)
+  · simp [localOpOwnershipAllowance]
+  · exact zeroOwnershipAllowance_le_profile _
+
+theorem materializeConstBinder_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Ixon.Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (installPushedBinder input remaining uses held)
+      sourceEnv boundSource (worldOfUses uses) (.constA atom)
+      (emitOp (.pure atom)) (IxIR0.DynamicCost.tick .evalLet) := by
+  refine
+    { toInstallBinderValueSound :=
+        materializeConstBinder_value_sound hstable
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.localOp
+      (allowance := ⟨0, 0⟩)
+  · intro fuel store env store' result hpre hrun
+    obtain ⟨⟨roots, value, hinput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+        have hpure := Ix.Compiler.IxIR1.Sim.runOp_pure
+          (ctx := ctx) (cur := cur)
+          (fuel := fuel) (store := store) hav.resolveAtom
+        have hpair : (store, value) = (store', result) :=
+          Except.ok.inj (hpure.symm.trans hrun)
+        cases hpair
+        let output := installPushedBinder input remaining uses held
+        have htail : EntriesValueGraph funRel recSelfRel store output
+            (result :: env) input.entries sourceEnv roots :=
+          (hinput.entries.bump result).of_depth_eq
+            (by simp [output, installPushedBinder, VEnv.bump])
+        have hdepth : (result :: env).length = output.depth := by
+          simpa [output, installPushedBinder] using
+            congrArg Nat.succ hinput.depth_eq
+        cases held with
+        | false =>
+            have houtput : VEnvValueGraph funRel recSelfRel store output
+                (boundSource :: sourceEnv) (result :: env) roots := by
+              refine ⟨hdepth, ?_⟩
+              exact EntriesValueGraph.released
+                (by simp [output, installPushedBinder]) htail
+            refine ⟨⟨roots, houtput, hrestGraph, ?_⟩, ?_⟩
+            · exact hown.dropNoLocation
+                (hstable.const_noLocation hav)
+            · exact SlotsRealize.of_depth_eq
+                (by simp [output, installPushedBinder, VEnv.bump])
+                (hslots.bump result)
+        | true =>
+            have hvalueWorld : Sim.HasWorld store
+                (worldOfUses uses) result :=
+              hown.roots_world ⟨worldOfUses uses, result⟩ (by simp)
+            have houtput : VEnvValueGraph funRel recSelfRel store output
+                (boundSource :: sourceEnv) (result :: env)
+                (⟨worldOfUses uses, result⟩ :: roots) := by
+              refine ⟨hdepth, ?_⟩
+              exact EntriesValueGraph.held
+                (by simp [output, installPushedBinder])
+                (by simp [output, installPushedBinder, VEnv.rel])
+                hvalueWorld hvalueGraph htail
+            refine ⟨⟨⟨worldOfUses uses, result⟩ :: roots,
+              houtput, hrestGraph, ?_⟩, ?_⟩
+            · simpa using hown
+            · exact SlotsRealize.of_depth_eq
+                (by simp [output, installPushedBinder, VEnv.bump])
+                (hslots.bump result)
+  · simp [localOpOwnershipAllowance]
+  · exact zeroOwnershipAllowance_le_profile _
+
+/-- Exact state-indexed cost rule for releasing one held environment slot.
+The semantic callback abstracts over shared `drop` and affine `dropU`; both
+have zero paired allowance in the local ownership table. -/
+theorem releaseSlot_profileFundedStateRunSound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {i abs : Nat} {uses : Ixon.Uses} {world : Ixon.Owned}
+    {releaseOp : Op}
+    (hworld : worldOfUses uses = world)
+    (hentry : input.entries[i]? = some (.slot abs 0 uses true))
+    (hlocal : localOpOwnershipAllowance releaseOp = some ⟨0, 0⟩)
+    (hop : ∀ {fuel : Nat} {store store' : Store} {env : List RVal}
+      {value result : RVal} {tailRoots : List Sim.Root},
+      resolveAtom env (.var (input.rel abs)) = .ok value →
+      Sim.RootOwnership store (⟨world, value⟩ :: tailRoots) →
+      runOp ctx (fuel + 1) cur store env releaseOp =
+        .ok (store', result) →
+      result = .erased ∧ Sim.StoreGraphRestricts store store' ∧
+        Sim.RootOwnership store' tailRoots) :
+    ∀ sourceEnv sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur (emitOp releaseOp)
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((input.setEntry i (.slot abs 0 uses false)).bump)
+          sourceEnv sourceRest rest slots)
+        0 := by
+  intro sourceEnv sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.localOp
+      (allowance := ⟨0, 0⟩)
+  · intro fuel store env store' result hpre hrun
+    cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+        obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+        obtain ⟨_, value, beforeRoots, afterRoots, _, hbound, hslot,
+            _, _, hroots, hreleased⟩ :=
+          hinput.entries.releaseAt hentry
+        let released := input.setEntry i (.slot abs 0 uses false)
+        let tailRoots := beforeRoots ++ afterRoots ++ rest
+        have hreleasedGraph : VEnvValueGraph funRel recSelfRel store
+            released sourceEnv env (beforeRoots ++ afterRoots) :=
+          hinput.setEntry hreleased
+        have howned : Sim.RootOwnership store
+            (⟨world, value⟩ :: tailRoots) := by
+          rw [hroots] at hown
+          have hfront := hown.perm
+            (permExtractRoot ⟨worldOfUses uses, value⟩
+              beforeRoots afterRoots rest)
+          simpa [tailRoots, hworld] using hfront
+        have hresolve :
+            resolveAtom env (.var (input.rel abs)) = .ok value :=
+          (AValRealizes.slot hbound hslot).resolveAtom
+        obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+          hop hresolve howned hrun
+        have hinputAfter : VEnvValueGraph funRel recSelfRel store'
+            released sourceEnv env (beforeRoots ++ afterRoots) :=
+          hreleasedGraph.ofRestricts hrestrict hownAfter
+            (fun root hmember => by
+              simpa [tailRoots] using
+                List.mem_append_left rest hmember)
+        have hrestAfter : Sim.RootsGraph funRel store'
+            sourceRest rest :=
+          hrestGraph.ofRestrictsIn hrestrict hownAfter
+            (fun root hmember => by
+              simpa [tailRoots] using
+                List.mem_append_right (beforeRoots ++ afterRoots) hmember)
+        refine ⟨⟨beforeRoots ++ afterRoots,
+          hinputAfter.bump .erased, hrestAfter, ?_⟩,
+          (hslots.setEntry).bump .erased⟩
+        simpa [tailRoots] using hownAfter
+  · exact hlocal
+  · exact OwnershipAllowanceLE.refl ⟨0, 0⟩
+
+theorem releaseSlot_profileFundedStateRunSound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {i abs : Nat} {uses : Ixon.Uses} {world : Ixon.Owned}
+    {releaseOp : Op}
+    (hworld : worldOfUses uses = world)
+    (hentry : input.entries[i]? = some (.slot abs 0 uses true))
+    (hlocal : localOpOwnershipAllowance releaseOp = some ⟨0, 0⟩)
+    (hop : ∀ {fuel : Nat} {store store' : Store} {env : List RVal}
+      {value result : RVal} {tailRoots : List Sim.Root},
+      resolveAtom env (.var (input.rel abs)) = .ok value →
+      Sim.RootOwnership store (⟨world, value⟩ :: tailRoots) →
+      runOp ctx (fuel + 1) cur store env releaseOp =
+        .ok (store', result) →
+      result = .erased ∧ Sim.StoreGraphRestricts store store' ∧
+        Sim.RootOwnership store' tailRoots) :
+    ∀ sourceEnv sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp releaseOp)
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((input.setEntry i (.slot abs 0 uses false)).bump)
+          sourceEnv sourceRest rest slots)
+        0 := by
+  intro sourceEnv sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.localOp
+      (allowance := ⟨0, 0⟩)
+  · intro fuel store env store' result hpre hrun
+    cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+        obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+        obtain ⟨_, value, beforeRoots, afterRoots, _, hbound, hslot,
+            _, _, hroots, hreleased⟩ :=
+          hinput.entries.releaseAt hentry
+        let released := input.setEntry i (.slot abs 0 uses false)
+        let tailRoots := beforeRoots ++ afterRoots ++ rest
+        have hreleasedGraph : VEnvValueGraph funRel recSelfRel store
+            released sourceEnv env (beforeRoots ++ afterRoots) :=
+          hinput.setEntry hreleased
+        have howned : Sim.RootOwnership store
+            (⟨world, value⟩ :: tailRoots) := by
+          rw [hroots] at hown
+          have hfront := hown.perm
+            (permExtractRoot ⟨worldOfUses uses, value⟩
+              beforeRoots afterRoots rest)
+          simpa [tailRoots, hworld] using hfront
+        have hresolve :
+            resolveAtom env (.var (input.rel abs)) = .ok value :=
+          (AValRealizes.slot hbound hslot).resolveAtom
+        obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+          hop hresolve howned hrun
+        have hinputAfter : VEnvValueGraph funRel recSelfRel store'
+            released sourceEnv env (beforeRoots ++ afterRoots) :=
+          hreleasedGraph.ofRestricts hrestrict hownAfter
+            (fun root hmember => by
+              simpa [tailRoots] using
+                List.mem_append_left rest hmember)
+        have hrestAfter : Sim.RootsGraph funRel store'
+            sourceRest rest :=
+          hrestGraph.ofRestrictsIn hrestrict hownAfter
+            (fun root hmember => by
+              simpa [tailRoots] using
+                List.mem_append_right (beforeRoots ++ afterRoots) hmember)
+        refine ⟨⟨beforeRoots ++ afterRoots,
+          hinputAfter.bump .erased, hrestAfter, ?_⟩,
+          (hslots.setEntry).bump .erased⟩
+        simpa [tailRoots] using hownAfter
+  · exact hlocal
+  · exact OwnershipAllowanceLE.refl ⟨0, 0⟩
+
+theorem releaseSlotMany_profileFundedStateRunSound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv} {i abs : Nat}
+    (hentry : input.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.drop (.var (input.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((input.setEntry i (.slot abs 0 .many false)).bump)
+          sourceEnv sourceRest rest slots)
+        0 := by
+  apply releaseSlot_profileFundedStateRunSound rfl hentry
+  · simp [localOpOwnershipAllowance]
+  · exact Ix.Compiler.IxIR1.Sim.runOp_drop_value_owned_restricts
+
+theorem releaseSlotAffine_profileFundedStateRunSound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv} {i abs : Nat}
+    (hentry : input.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.dropU (.var (input.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((input.setEntry i (.slot abs 0 .affine false)).bump)
+          sourceEnv sourceRest rest slots)
+        0 := by
+  apply releaseSlot_profileFundedStateRunSound rfl hentry
+  · simp [localOpOwnershipAllowance]
+  · exact Ix.Compiler.IxIR1.Sim.runOp_dropU_value_owned_restricts
+
+theorem releaseSlotMany_profileFundedStateRunSound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv} {i abs : Nat}
+    (hentry : input.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.drop (.var (input.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((input.setEntry i (.slot abs 0 .many false)).bump)
+          sourceEnv sourceRest rest slots)
+        0 := by
+  apply releaseSlot_profileFundedStateRunSound_below rfl hentry
+  · simp [localOpOwnershipAllowance]
+  · exact Ix.Compiler.IxIR1.Sim.runOp_drop_value_owned_restricts
+
+theorem releaseSlotAffine_profileFundedStateRunSound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv} {i abs : Nat}
+    (hentry : input.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.dropU (.var (input.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((input.setEntry i (.slot abs 0 .affine false)).bump)
+          sourceEnv sourceRest rest slots)
+        0 := by
+  apply releaseSlot_profileFundedStateRunSound_below rfl hentry
+  · simp [localOpOwnershipAllowance]
+  · exact Ix.Compiler.IxIR1.Sim.runOp_dropU_value_owned_restricts
+
+/-- A dead affine slot binder aliases the bound result, immediately consumes
+its unique root, and exposes a released logical entry to the body. -/
+theorem installAliasBinder_releasedAffine_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs : Nat} :
+    InstallBinderProfileSound funRel recSelfRel ctx cur input
+      (((installAliasBinder input abs 0 .affine true).setEntry 0
+        (.slot abs 0 .affine false)).bump)
+      sourceEnv boundSource .unique (.slotA abs)
+      (emitOp (.dropU (.var (input.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) := by
+  let heldInput := installAliasBinder input abs 0 .affine true
+  have hentry : heldInput.entries[0]? =
+      some (.slot abs 0 .affine true) := by
+    simp [heldInput, installAliasBinder]
+  have halias : InstallBinderProfileSound funRel recSelfRel ctx cur input
+      heldInput sourceEnv boundSource .unique (.slotA abs)
+      (_root_.id : Emit) (IxIR0.DynamicCost.tick .evalLet) := by
+    simpa [heldInput, worldOfUses] using
+      (installAliasBinder_profile_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (input := input)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := 0) (uses := Ixon.Uses.affine))
+  have hcomposed : InstallBinderProfileSound funRel recSelfRel ctx cur
+      input ((heldInput.setEntry 0 (.slot abs 0 .affine false)).bump)
+      sourceEnv boundSource .unique (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.dropU (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet + 0) :=
+    halias.compVEnv
+      (release_slot_affine_owned hentry)
+      (release_slot_affine_value_sound hentry
+        (boundSource :: sourceEnv))
+      (releaseSlotAffine_profileFundedStateRunSound hentry
+        (boundSource :: sourceEnv))
+  have hnormalized : InstallBinderProfileSound funRel recSelfRel ctx cur
+      input ((heldInput.setEntry 0 (.slot abs 0 .affine false)).bump)
+      sourceEnv boundSource .unique (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.dropU (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) :=
+    InstallBinderProfileSound.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero _)
+  simpa [heldInput, installAliasBinder, VEnv.rel, Function.comp_def] using
+    hnormalized
+
+/-- Shared dead binders use the corresponding shallow `drop`; its amortized
+paired cost is likewise zero after consuming the owned root. -/
+theorem installAliasBinder_releasedMany_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs : Nat} :
+    InstallBinderProfileSound funRel recSelfRel ctx cur input
+      (((installAliasBinder input abs 0 .many true).setEntry 0
+        (.slot abs 0 .many false)).bump)
+      sourceEnv boundSource .shared (.slotA abs)
+      (emitOp (.drop (.var (input.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) := by
+  let heldInput := installAliasBinder input abs 0 .many true
+  have hentry : heldInput.entries[0]? =
+      some (.slot abs 0 .many true) := by
+    simp [heldInput, installAliasBinder]
+  have halias : InstallBinderProfileSound funRel recSelfRel ctx cur input
+      heldInput sourceEnv boundSource .shared (.slotA abs)
+      (_root_.id : Emit) (IxIR0.DynamicCost.tick .evalLet) := by
+    simpa [heldInput, worldOfUses] using
+      (installAliasBinder_profile_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (input := input)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := 0) (uses := Ixon.Uses.many))
+  have hcomposed : InstallBinderProfileSound funRel recSelfRel ctx cur
+      input ((heldInput.setEntry 0 (.slot abs 0 .many false)).bump)
+      sourceEnv boundSource .shared (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.drop (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet + 0) :=
+    halias.compVEnv
+      (release_slot_many_owned hentry)
+      (release_slot_many_value_sound hentry
+        (boundSource :: sourceEnv))
+      (releaseSlotMany_profileFundedStateRunSound hentry
+        (boundSource :: sourceEnv))
+  have hnormalized : InstallBinderProfileSound funRel recSelfRel ctx cur
+      input ((heldInput.setEntry 0 (.slot abs 0 .many false)).bump)
+      sourceEnv boundSource .shared (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.drop (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) :=
+    InstallBinderProfileSound.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero _)
+  simpa [heldInput, installAliasBinder, VEnv.rel, Function.comp_def] using
+    hnormalized
+
+theorem installAliasBinder_releasedAffine_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs : Nat} :
+    InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (((installAliasBinder input abs 0 .affine true).setEntry 0
+        (.slot abs 0 .affine false)).bump)
+      sourceEnv boundSource .unique (.slotA abs)
+      (emitOp (.dropU (.var (input.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) := by
+  let heldInput := installAliasBinder input abs 0 .affine true
+  have hentry : heldInput.entries[0]? =
+      some (.slot abs 0 .affine true) := by
+    simp [heldInput, installAliasBinder]
+  have halias : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur
+      limit input heldInput sourceEnv boundSource .unique (.slotA abs)
+      (_root_.id : Emit) (IxIR0.DynamicCost.tick .evalLet) := by
+    simpa [heldInput, worldOfUses] using
+      (installAliasBinder_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (input := input)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := 0) (uses := Ixon.Uses.affine))
+  have hcomposed : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur
+      limit input
+      ((heldInput.setEntry 0 (.slot abs 0 .affine false)).bump)
+      sourceEnv boundSource .unique (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.dropU (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet + 0) :=
+    halias.compVEnv
+      (release_slot_affine_owned hentry)
+      (release_slot_affine_value_sound hentry
+        (boundSource :: sourceEnv))
+      (releaseSlotAffine_profileFundedStateRunSound_below hentry
+        (boundSource :: sourceEnv))
+  have hnormalized : InstallBinderProfileSoundBelow funRel recSelfRel ctx
+      cur limit input
+      ((heldInput.setEntry 0 (.slot abs 0 .affine false)).bump)
+      sourceEnv boundSource .unique (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.dropU (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) :=
+    InstallBinderProfileSoundBelow.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero _)
+  simpa [heldInput, installAliasBinder, VEnv.rel, Function.comp_def] using
+    hnormalized
+
+theorem installAliasBinder_releasedMany_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs : Nat} :
+    InstallBinderProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (((installAliasBinder input abs 0 .many true).setEntry 0
+        (.slot abs 0 .many false)).bump)
+      sourceEnv boundSource .shared (.slotA abs)
+      (emitOp (.drop (.var (input.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) := by
+  let heldInput := installAliasBinder input abs 0 .many true
+  have hentry : heldInput.entries[0]? =
+      some (.slot abs 0 .many true) := by
+    simp [heldInput, installAliasBinder]
+  have halias : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur
+      limit input heldInput sourceEnv boundSource .shared (.slotA abs)
+      (_root_.id : Emit) (IxIR0.DynamicCost.tick .evalLet) := by
+    simpa [heldInput, worldOfUses] using
+      (installAliasBinder_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (input := input)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := 0) (uses := Ixon.Uses.many))
+  have hcomposed : InstallBinderProfileSoundBelow funRel recSelfRel ctx cur
+      limit input
+      ((heldInput.setEntry 0 (.slot abs 0 .many false)).bump)
+      sourceEnv boundSource .shared (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.drop (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet + 0) :=
+    halias.compVEnv
+      (release_slot_many_owned hentry)
+      (release_slot_many_value_sound hentry
+        (boundSource :: sourceEnv))
+      (releaseSlotMany_profileFundedStateRunSound_below hentry
+        (boundSource :: sourceEnv))
+  have hnormalized : InstallBinderProfileSoundBelow funRel recSelfRel ctx
+      cur limit input
+      ((heldInput.setEntry 0 (.slot abs 0 .many false)).bump)
+      sourceEnv boundSource .shared (.slotA abs)
+      ((_root_.id : Emit) ∘
+        emitOp (.drop (.var (heldInput.rel abs))))
+      (IxIR0.DynamicCost.tick .evalLet) :=
+    InstallBinderProfileSoundBelow.of_profile_eq hcomposed
+      (IxIR0.DynamicCost.Profile.add_zero _)
+  simpa [heldInput, installAliasBinder, VEnv.rel, Function.comp_def] using
+    hnormalized
+
+/-- Any environment-independent scalar result enriches the existing
+semantic lowering rule with a source-funded identity-prefix cost proof. -/
+theorem scalar_id_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Ixon.Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : Sim.rvalLocation? value = none)
+    (hvalue : ∀ store, Sim.ValueGraph funRel store sourceValue value)
+    (profile : SourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input input
+      sourceEnv sourceEnv sourceValue world (_root_.id : Emit)
+      (.constA atom) profile := by
+  refine
+    { toLowerResultValueSound :=
+        scalar_id_value_sound hstable hresolve hnone hvalue
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.monoProfile
+  · apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, hinput, hrestGraph, howned⟩, hslots⟩ := hpre
+    exact ⟨⟨roots, value, hinput, .const (hresolve env), hvalue store,
+      hrestGraph, howned.addNoLocation hnone⟩, hslots⟩
+  · exact zeroOwnershipAllowance_le_profile profile
+
+/-- Moving a final variable occurrence emits no target operation, so the
+same semantic transition can be assigned any enclosing source profile. -/
+theorem lower_held_move_profile_sound_of_profile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hentry : input.entries[index]? =
+      some (.slot abs remaining uses true)) (profile : SourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs)
+      profile := by
+  refine
+    { toLowerResultValueSound :=
+        lower_held_move_value_sound hsource hentry
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.monoProfile
+  · apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, hinput, hrestGraph, howned⟩, hslots⟩ := hpre
+    obtain ⟨foundSource, value, beforeRoots, afterRoots, hfoundSource,
+        hbound, hslot, _, hvalue, hroots, houtput⟩ :=
+      hinput.entries.releaseAt hentry
+    have hsourceEq : foundSource = sourceValue :=
+      Option.some.inj (hfoundSource.symm.trans hsource)
+    subst foundSource
+    refine ⟨⟨beforeRoots ++ afterRoots, value,
+      hinput.setEntry houtput, ?_, hvalue, hrestGraph, ?_⟩,
+      hslots.setEntry⟩
+    · apply AValRealizes.slot
+      · simpa [VEnv.setEntry] using hbound
+      · simpa [VEnv.setEntry, VEnv.rel] using hslot
+    · rw [hroots] at howned
+      exact howned.perm
+        (permExtractRoot ⟨worldOfUses uses, value⟩
+          beforeRoots afterRoots rest)
+  · exact zeroOwnershipAllowance_le_profile profile
+
+/-- Ordinary final variable use specializes the arbitrary held-entry move to
+remaining count one. -/
+theorem lower_var_move_profile_sound_of_profile
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hentry : input.entries[index]? =
+      some (.slot abs 1 uses true)) (profile : SourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) profile :=
+  lower_held_move_profile_sound_of_profile hsource hentry profile
+
+/-- Expression-variable specialization of the zero-cost final-use rule. -/
+theorem lower_var_move_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hentry : input.entries[index]? =
+      some (.slot abs 1 uses true)) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs)
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) :=
+  lower_var_move_profile_sound_of_profile hsource hentry _
+
+/-- A repeated shared variable use couples its semantic retain step with the
+paired `(0,2)` cost of `dup`, under any source profile that funds that pair. -/
+theorem lower_held_retain_profile_sound_of_funding
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining newRemaining : Nat} {uses : Ixon.Uses}
+    {profile : SourceProfile}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs remaining uses true))
+    (hfunded : OwnershipAllowanceLE ⟨0, 2⟩
+      (sourceProfileOwnershipAllowance profile)) :
+    let output := input.setEntry index
+      (.slot abs newRemaining uses true)
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (output.rel abs)))) (.slotA output.depth)
+      profile := by
+  dsimp only
+  let output := input.setEntry index
+    (.slot abs newRemaining uses true)
+  refine
+    { toLowerResultValueSound :=
+        lower_held_retain_value_sound hsource hworld hentry
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.ofOp
+  intro fuel store store' env result horder hbounds hpre hrun
+  have hlocal : localOpOwnershipAllowance
+      (.dup (.var (output.rel abs))) = some ⟨0, 2⟩ := by
+    simp [localOpOwnershipAllowance]
+  obtain ⟨_, _, hgrowth⟩ :=
+    (OpOwnershipCostSound.of_local hlocal) horder hbounds hrun
+  have hcost : ProfileFundedOpRun ctx fuel cur store env
+      (.dup (.var (output.rel abs))) store' result
+      profile :=
+    ⟨⟨0, 2⟩, ⟨horder, hbounds, hrun, hgrowth⟩, hfunded⟩
+  have hmid : GraphOwnsResultProtected funRel recSelfRel output.bump
+      sourceEnv sourceValue .shared (.slotA output.depth)
+      sourceRest rest slots store' (result :: env) := by
+    obtain ⟨⟨roots, hinput, hrestGraph, howned⟩, hslots⟩ := hpre
+    obtain ⟨foundSource, retained, hfoundSource, hbound, hslot,
+        hvalueWorld, hvalueGraph, _, hupdated⟩ :=
+      hinput.entries.updateHeldAt newRemaining hentry
+    have hsourceEq : foundSource = sourceValue :=
+      Option.some.inj (hfoundSource.symm.trans hsource)
+    subst foundSource
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        sourceEnv env roots := hinput.setEntry hupdated
+    have hav : AValRealizes output env (.slotA abs) retained := by
+      apply AValRealizes.slot
+      · simpa [output, VEnv.setEntry] using hbound
+      · simpa [output, VEnv.setEntry, VEnv.rel] using hslot
+    have hshared : Sim.HasWorld store .shared retained := by
+      simpa [hworld] using hvalueWorld
+    cases fuel with
+    | zero =>
+        simp [runOp] at hrun
+    | succ fuel =>
+        obtain ⟨middle, heval, hstore, hresultGraph, hmiddle⟩ :=
+          Ix.Compiler.IxIR1.Sim.runOp_retain_borrowed_valueGraph
+            (ctx := ctx) (cur := cur) (fuel := fuel)
+            hav.resolveAtom hshared hvalueGraph howned
+        have hpair : (middle, retained) = (store', result) :=
+          Except.ok.inj (heval.symm.trans hrun)
+        cases hpair
+        have houtputMiddle : VEnvValueGraph funRel recSelfRel store'
+            output sourceEnv env roots := houtput.monoStore hstore
+        have hrestMiddle : Sim.RootsGraph funRel store' sourceRest rest :=
+          hrestGraph.monoStore hstore
+        refine ⟨⟨roots, result, houtputMiddle.bump result, ?_,
+          hresultGraph, hrestMiddle, hmiddle⟩,
+          hslots.setEntry.bump result⟩
+        apply AValRealizes.slot
+        · simp [VEnv.bump]
+        · simp [VEnv.bump, VEnv.rel]
+  exact ⟨hmid, hcost⟩
+
+/-- Expression-variable specialization of the funded retain rule. -/
+theorem lower_held_retain_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining newRemaining : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs remaining uses true)) :
+    let output := input.setEntry index
+      (.slot abs newRemaining uses true)
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (output.rel abs)))) (.slotA output.depth)
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  apply lower_held_retain_profile_sound_of_funding hsource hworld hentry
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_tick_of_evals_eq_one .evalVar
+      (by rfl),
+    sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, evalOwnershipAllowance,
+    retainedOwnershipAllowance, OwnershipAllowance.add]
+
+/-- A final shared variable borrow moves the existing owner into the pending
+borrow position.  The expression profile is unchanged and no target RC
+operation is emitted. -/
+theorem lower_var_shared_move_borrow_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs 1 uses true)) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) true
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  have hmove := lower_var_move_profile_sound
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) hsource hentry
+  have hshared : LowerResultProfileSound funRel recSelfRel ctx cur input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue .shared (_root_.id : Emit)
+      (.slotA abs)
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+    simpa [hworld] using hmove
+  exact hshared.asBorrowSlot
+
+/-- Repeated shared borrowing decrements the static use count while retaining
+the same runtime owner.  Its identity target prefix is conservatively funded
+by the source variable profile. -/
+theorem lower_var_shared_borrow_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let output := input.setEntry index
+      (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) false
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  dsimp only
+  let output := input.setEntry index
+    (.slot abs (Nat.succ remaining) uses true)
+  refine
+    { toLowerBorrowValueSound :=
+        lower_var_shared_borrow_value_sound hsource hworld hentry
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.monoProfile
+  · apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+    obtain ⟨foundSource, value, hfoundSource, hbound, hslot,
+        hvalueWorld, hvalueGraph, _, hupdated⟩ :=
+      hinput.entries.updateHeldAt (Nat.succ remaining) hentry
+    have hsourceEq : foundSource = sourceValue :=
+      Option.some.inj (hfoundSource.symm.trans hsource)
+    subst foundSource
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        sourceEnv env roots := hinput.setEntry hupdated
+    have hav : AValRealizes output env (.slotA abs) value := by
+      apply AValRealizes.slot
+      · simpa [output, VEnv.setEntry] using hbound
+      · simpa [output, VEnv.setEntry, VEnv.rel] using hslot
+    have hshared : Sim.HasWorld store .shared value := by
+      simpa [hworld] using hvalueWorld
+    refine ⟨roots, value, houtput, hav, hshared, hvalueGraph,
+      hrestGraph, ?_, hslots.setEntry⟩
+    simpa [borrowResultRoots] using hown
+  · exact zeroOwnershipAllowance_le_profile _
+
+/-- At a fixed target-fuel ceiling, any environment-independent scalar result enriches the existing
+semantic lowering rule with a source-funded identity-prefix cost proof. -/
+theorem scalar_id_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Ixon.Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : Sim.rvalLocation? value = none)
+    (hvalue : ∀ store, Sim.ValueGraph funRel store sourceValue value)
+    (profile : SourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input input
+      sourceEnv sourceEnv sourceValue world (_root_.id : Emit)
+      (.constA atom) profile := by
+  refine
+    { toLowerResultValueSound :=
+        scalar_id_value_sound hstable hresolve hnone hvalue
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+  · apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, hinput, hrestGraph, howned⟩, hslots⟩ := hpre
+    exact ⟨⟨roots, value, hinput, .const (hresolve env), hvalue store,
+      hrestGraph, howned.addNoLocation hnone⟩, hslots⟩
+  · exact zeroOwnershipAllowance_le_profile profile
+
+/-- Moving a final variable occurrence emits no target operation, so the
+same semantic transition can be assigned any enclosing source profile. -/
+theorem lower_held_move_profile_sound_of_profile_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hentry : input.entries[index]? =
+      some (.slot abs remaining uses true)) (profile : SourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs)
+      profile := by
+  refine
+    { toLowerResultValueSound :=
+        lower_held_move_value_sound hsource hentry
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+  · apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, hinput, hrestGraph, howned⟩, hslots⟩ := hpre
+    obtain ⟨foundSource, value, beforeRoots, afterRoots, hfoundSource,
+        hbound, hslot, _, hvalue, hroots, houtput⟩ :=
+      hinput.entries.releaseAt hentry
+    have hsourceEq : foundSource = sourceValue :=
+      Option.some.inj (hfoundSource.symm.trans hsource)
+    subst foundSource
+    refine ⟨⟨beforeRoots ++ afterRoots, value,
+      hinput.setEntry houtput, ?_, hvalue, hrestGraph, ?_⟩,
+      hslots.setEntry⟩
+    · apply AValRealizes.slot
+      · simpa [VEnv.setEntry] using hbound
+      · simpa [VEnv.setEntry, VEnv.rel] using hslot
+    · rw [hroots] at howned
+      exact howned.perm
+        (permExtractRoot ⟨worldOfUses uses, value⟩
+          beforeRoots afterRoots rest)
+  · exact zeroOwnershipAllowance_le_profile profile
+
+/-- Ordinary final variable use specializes the arbitrary held-entry move to
+remaining count one. -/
+theorem lower_var_move_profile_sound_of_profile_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hentry : input.entries[index]? =
+      some (.slot abs 1 uses true)) (profile : SourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) profile :=
+  lower_held_move_profile_sound_of_profile_below hsource hentry profile
+
+/-- Expression-variable specialization of the zero-cost final-use rule. -/
+theorem lower_var_move_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hentry : input.entries[index]? =
+      some (.slot abs 1 uses true)) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs)
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) :=
+  lower_var_move_profile_sound_of_profile_below hsource hentry _
+
+/-- A repeated shared variable use couples its semantic retain step with the
+paired `(0,2)` cost of `dup`, under any source profile that funds that pair. -/
+theorem lower_held_retain_profile_sound_of_funding_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining newRemaining : Nat} {uses : Ixon.Uses}
+    {profile : SourceProfile}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs remaining uses true))
+    (hfunded : OwnershipAllowanceLE ⟨0, 2⟩
+      (sourceProfileOwnershipAllowance profile)) :
+    let output := input.setEntry index
+      (.slot abs newRemaining uses true)
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (output.rel abs)))) (.slotA output.depth)
+      profile := by
+  dsimp only
+  let output := input.setEntry index
+    (.slot abs newRemaining uses true)
+  refine
+    { toLowerResultValueSound :=
+        lower_held_retain_value_sound hsource hworld hentry
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.ofOp
+  intro fuel store store' env result _ horder hbounds hpre hrun
+  have hlocal : localOpOwnershipAllowance
+      (.dup (.var (output.rel abs))) = some ⟨0, 2⟩ := by
+    simp [localOpOwnershipAllowance]
+  obtain ⟨_, _, hgrowth⟩ :=
+    (OpOwnershipCostSound.of_local hlocal) horder hbounds hrun
+  have hcost : ProfileFundedOpRun ctx fuel cur store env
+      (.dup (.var (output.rel abs))) store' result
+      profile :=
+    ⟨⟨0, 2⟩, ⟨horder, hbounds, hrun, hgrowth⟩, hfunded⟩
+  have hmid : GraphOwnsResultProtected funRel recSelfRel output.bump
+      sourceEnv sourceValue .shared (.slotA output.depth)
+      sourceRest rest slots store' (result :: env) := by
+    obtain ⟨⟨roots, hinput, hrestGraph, howned⟩, hslots⟩ := hpre
+    obtain ⟨foundSource, retained, hfoundSource, hbound, hslot,
+        hvalueWorld, hvalueGraph, _, hupdated⟩ :=
+      hinput.entries.updateHeldAt newRemaining hentry
+    have hsourceEq : foundSource = sourceValue :=
+      Option.some.inj (hfoundSource.symm.trans hsource)
+    subst foundSource
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        sourceEnv env roots := hinput.setEntry hupdated
+    have hav : AValRealizes output env (.slotA abs) retained := by
+      apply AValRealizes.slot
+      · simpa [output, VEnv.setEntry] using hbound
+      · simpa [output, VEnv.setEntry, VEnv.rel] using hslot
+    have hshared : Sim.HasWorld store .shared retained := by
+      simpa [hworld] using hvalueWorld
+    cases fuel with
+    | zero =>
+        simp [runOp] at hrun
+    | succ fuel =>
+        obtain ⟨middle, heval, hstore, hresultGraph, hmiddle⟩ :=
+          Ix.Compiler.IxIR1.Sim.runOp_retain_borrowed_valueGraph
+            (ctx := ctx) (cur := cur) (fuel := fuel)
+            hav.resolveAtom hshared hvalueGraph howned
+        have hpair : (middle, retained) = (store', result) :=
+          Except.ok.inj (heval.symm.trans hrun)
+        cases hpair
+        have houtputMiddle : VEnvValueGraph funRel recSelfRel store'
+            output sourceEnv env roots := houtput.monoStore hstore
+        have hrestMiddle : Sim.RootsGraph funRel store' sourceRest rest :=
+          hrestGraph.monoStore hstore
+        refine ⟨⟨roots, result, houtputMiddle.bump result, ?_,
+          hresultGraph, hrestMiddle, hmiddle⟩,
+          hslots.setEntry.bump result⟩
+        apply AValRealizes.slot
+        · simp [VEnv.bump]
+        · simp [VEnv.bump, VEnv.rel]
+  exact ⟨hmid, hcost⟩
+
+/-- Expression-variable specialization of the funded retain rule. -/
+theorem lower_held_retain_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining newRemaining : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs remaining uses true)) :
+    let output := input.setEntry index
+      (.slot abs newRemaining uses true)
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (output.rel abs)))) (.slotA output.depth)
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  apply lower_held_retain_profile_sound_of_funding_below hsource hworld hentry
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_tick_of_evals_eq_one .evalVar
+      (by rfl),
+    sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, evalOwnershipAllowance,
+    retainedOwnershipAllowance, OwnershipAllowance.add]
+
+/-- A final shared variable borrow moves the existing owner into the pending
+borrow position.  The expression profile is unchanged and no target RC
+operation is emitted. -/
+theorem lower_var_shared_move_borrow_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs 1 uses true)) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) true
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  have hmove := lower_var_move_profile_sound_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) hsource hentry
+  have hshared : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      (input.setEntry index (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue .shared (_root_.id : Emit)
+      (.slotA abs)
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+    simpa [hworld] using hmove
+  exact hshared.asBorrowSlot
+
+/-- Repeated shared borrowing decrements the static use count while retaining
+the same runtime owner.  Its identity target prefix is conservatively funded
+by the source variable profile. -/
+theorem lower_var_shared_borrow_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {index abs remaining : Nat} {uses : Ixon.Uses}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : input.entries[index]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let output := input.setEntry index
+      (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) false
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  dsimp only
+  let output := input.setEntry index
+    (.slot abs (Nat.succ remaining) uses true)
+  refine
+    { toLowerBorrowValueSound :=
+        lower_var_shared_borrow_value_sound hsource hworld hentry
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+  · apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+    obtain ⟨foundSource, value, hfoundSource, hbound, hslot,
+        hvalueWorld, hvalueGraph, _, hupdated⟩ :=
+      hinput.entries.updateHeldAt (Nat.succ remaining) hentry
+    have hsourceEq : foundSource = sourceValue :=
+      Option.some.inj (hfoundSource.symm.trans hsource)
+    subst foundSource
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        sourceEnv env roots := hinput.setEntry hupdated
+    have hav : AValRealizes output env (.slotA abs) value := by
+      apply AValRealizes.slot
+      · simpa [output, VEnv.setEntry] using hbound
+      · simpa [output, VEnv.setEntry, VEnv.rel] using hslot
+    have hshared : Sim.HasWorld store .shared value := by
+      simpa [hworld] using hvalueWorld
+    refine ⟨roots, value, houtput, hav, hshared, hvalueGraph,
+      hrestGraph, ?_, hslots.setEntry⟩
+    simpa [borrowResultRoots] using hown
+  · exact zeroOwnershipAllowance_le_profile _
+
+theorem ProfileFundedInvokeRun.fn
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address} {args : List RVal}
+    {before after : Store} {value : RVal} {decl : FnDef}
+    {profile : SourceProfile}
+    (hdecl : ctx.decls address = some (.fn decl))
+    (harity : args.length = decl.arity)
+    (hbody : ProfileFundedCodeRun ctx fuel decl before args.reverse decl.body
+      after value profile)
+    (hresult : checkResultWorld decl.result (after, value) =
+      .ok (after, value)) :
+    ProfileFundedInvokeRun ctx (fuel + 1) address args before after value
+      profile := by
+  obtain ⟨allowance, hbodyCost, hbodyFunded⟩ := hbody
+  exact ⟨allowance,
+    InvokeOwnershipRunCost.fn hdecl harity hbodyCost hresult,
+    hbodyFunded⟩
+
+theorem ProfileFundedOpRun.call
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {address : Ixon.Address} {atoms : Array Atom}
+    {args : List RVal} {value : RVal} {profile : SourceProfile}
+    (henv : ValuesInBounds before env)
+    (hresolve : resolveAtoms env atoms = .ok args)
+    (hinvoke : ProfileFundedInvokeRun ctx fuel address args before after value
+      profile) :
+    ProfileFundedOpRun ctx (fuel + 1) cur before env (.call address atoms)
+      after value profile := by
+  obtain ⟨allowance, hinvokeCost, hinvokeFunded⟩ := hinvoke
+  exact ⟨allowance,
+    OpOwnershipRunCost.call henv hresolve hinvokeCost, hinvokeFunded⟩
+
+theorem ProfileFundedOpRun.callSelf
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {atoms : Array Atom} {args : List RVal}
+    {value : RVal} {profile : SourceProfile}
+    (henv : ValuesInBounds before env)
+    (hresolve : resolveAtoms env atoms = .ok args)
+    (harity : args.length = cur.arity)
+    (hbody : ProfileFundedCodeRun ctx fuel cur before args.reverse cur.body
+      after value profile)
+    (hresult : checkResultWorld cur.result (after, value) =
+      .ok (after, value)) :
+    ProfileFundedOpRun ctx (fuel + 1) cur before env (.callSelf atoms)
+      after value profile := by
+  obtain ⟨allowance, hbodyCost, hbodyFunded⟩ := hbody
+  exact ⟨allowance,
+    OpOwnershipRunCost.callSelf henv hresolve harity hbodyCost hresult,
+    hbodyFunded⟩
+
+theorem ProfileFundedOpRun.apply
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {before after : Store}
+    {env : List RVal} {functionAtom : Atom} {function value : RVal}
+    {atoms : Array Atom} {args : List RVal} {profile : SourceProfile}
+    (henv : ValuesInBounds before env)
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hargs : resolveAtoms env atoms = .ok args)
+    (happly : ProfileFundedApplyRun ctx fuel before function args after value
+      profile) :
+    ProfileFundedOpRun ctx (fuel + 1) cur before env
+      (.apply functionAtom atoms) after value profile := by
+  obtain ⟨allowance, happlyCost, happlyFunded⟩ := happly
+  exact ⟨allowance,
+    OpOwnershipRunCost.apply henv hfunction hargs happlyCost,
+    happlyFunded⟩
+
+/-- A direct call is an exact-run emitter prefix when the caller can fund
+the particular invocation exposed by the successful operation run. -/
+theorem ProfileFundedEmitRunSound.call
+    {ctx : Ctx} {cur : FnDef} {address : Ixon.Address}
+    {atoms : Array Atom} {profile : SourceProfile}
+    (hinvoke : ∀ {fuel : Nat} {before after : Store}
+      {env : List RVal} {args : List RVal} {value : RVal},
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      resolveAtoms env atoms = .ok args →
+      invoke ctx fuel address args before = .ok (after, value) →
+      ProfileFundedInvokeRun ctx fuel address args before after value
+        profile) :
+    ProfileFundedEmitRunSound ctx cur (emitOp (.call address atoms))
+      profile := by
+  apply ProfileFundedEmitRunSound.ofOp
+  intro opFuel before after env value horder henv hrun
+  cases opFuel with
+  | zero =>
+      simp [runOp] at hrun
+  | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      cases hresolve : resolveAtoms env atoms with
+      | error err =>
+          rw [hresolve] at hrun
+          contradiction
+      | ok args =>
+          rw [hresolve, bindOk] at hrun
+          exact ProfileFundedOpRun.call henv hresolve
+            (hinvoke horder henv hresolve hrun)
+
+/-- A self call is an exact-run emitter prefix.  The callback receives the
+strictly smaller body run selected by the successful operation. -/
+theorem ProfileFundedEmitRunSound.callSelf
+    {ctx : Ctx} {cur : FnDef} {atoms : Array Atom}
+    {profile : SourceProfile}
+    (hbody : ∀ {fuel : Nat} {before after : Store}
+      {env args : List RVal} {value : RVal},
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      resolveAtoms env atoms = .ok args →
+      args.length = cur.arity →
+      runCode ctx fuel cur before args.reverse cur.body =
+        .ok (after, value) →
+      checkResultWorld cur.result (after, value) = .ok (after, value) →
+      ProfileFundedCodeRun ctx fuel cur before args.reverse cur.body
+        after value profile) :
+    ProfileFundedEmitRunSound ctx cur (emitOp (.callSelf atoms))
+      profile := by
+  apply ProfileFundedEmitRunSound.ofOp
+  intro opFuel before after env value horder henv hrun
+  cases opFuel with
+  | zero =>
+      simp [runOp] at hrun
+  | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      cases hresolve : resolveAtoms env atoms with
+      | error err =>
+          rw [hresolve] at hrun
+          contradiction
+      | ok args =>
+          rw [hresolve, bindOk] at hrun
+          split at hrun
+          · contradiction
+          next hlength =>
+            have harity : args.length = cur.arity := by
+              simpa using hlength
+            cases hcode :
+                runCode ctx fuel cur before args.reverse cur.body with
+            | error err =>
+                rw [hcode] at hrun
+                change (.error err : Except Err (Store × RVal)) =
+                  .ok (after, value) at hrun
+                contradiction
+            | ok out =>
+                rw [hcode] at hrun
+                change checkResultWorld cur.result out =
+                  .ok (after, value) at hrun
+                obtain ⟨hpair, _⟩ :=
+                  Ix.Compiler.IxIR1.Sim.checkResultWorld_ok hrun
+                subst out
+                exact ProfileFundedOpRun.callSelf henv hresolve harity
+                  (hbody horder henv hresolve harity hcode hrun) hrun
+
+/-- Higher-order application is an exact-run emitter prefix when the
+particular `applyGo` recursion selected at run time is profile-funded. -/
+theorem ProfileFundedEmitRunSound.apply
+    {ctx : Ctx} {cur : FnDef} {functionAtom : Atom}
+    {atoms : Array Atom} {profile : SourceProfile}
+    (happly : ∀ {fuel : Nat} {before after : Store}
+      {env : List RVal} {function : RVal} {args : List RVal}
+      {value : RVal},
+      AllocationOrderInvariant before →
+      ValuesInBounds before env →
+      resolveAtom env functionAtom = .ok function →
+      resolveAtoms env atoms = .ok args →
+      applyGo ctx fuel before function args = .ok (after, value) →
+      ProfileFundedApplyRun ctx fuel before function args after value
+        profile) :
+    ProfileFundedEmitRunSound ctx cur
+      (emitOp (.apply functionAtom atoms)) profile := by
+  apply ProfileFundedEmitRunSound.ofOp
+  intro opFuel before after env value horder henv hrun
+  cases opFuel with
+  | zero =>
+      simp [runOp] at hrun
+  | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      cases hfunction : resolveAtom env functionAtom with
+      | error err =>
+          rw [hfunction] at hrun
+          contradiction
+      | ok function =>
+          rw [hfunction, bindOk] at hrun
+          cases hresolve : resolveAtoms env atoms with
+          | error err =>
+              rw [hresolve] at hrun
+              contradiction
+          | ok args =>
+              rw [hresolve, bindOk] at hrun
+              exact ProfileFundedOpRun.apply henv hfunction hresolve
+                (happly horder henv hfunction hresolve hrun)
+
+/-- Constructor/PAP creation fits inside one source-evaluation charge. -/
+theorem allocatedNodeAllowance_le_eval :
+    OwnershipAllowanceLE ⟨1, 1⟩ evalOwnershipAllowance := by
+  simp [OwnershipAllowanceLE, evalOwnershipAllowance]
+
+/-- A target retain exactly consumes one source-retain charge. -/
+theorem dupAllowance_le_retain :
+    OwnershipAllowanceLE ⟨0, 2⟩ retainOwnershipAllowance := by
+  simp [OwnershipAllowanceLE, retainOwnershipAllowance]
+
+/-- A zero-cost entry in the primitive table may be charged to any source
+profile fragment. -/
+theorem ProfileFundedEmitOwnershipCostSound.localZero
+    {ctx : Ctx} {cur : FnDef} {op : Op} {profile : SourceProfile}
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitOwnershipCostSound ctx cur (emitOp op) profile :=
+  ProfileFundedEmitOwnershipCostSound.of_zero
+    (EmitOwnershipCostSound.localOp hlocal)
+
+/-- A primitive classified as one `dup` consumes one source retain
+candidate. -/
+theorem ProfileFundedEmitOwnershipCostSound.localRetain
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 2⟩) :
+    ProfileFundedEmitOwnershipCostSound ctx cur (emitOp op)
+      (IxIR0.DynamicCost.retain 1) := by
+  refine ⟨⟨0, 2⟩, EmitOwnershipCostSound.localOp hlocal, ?_⟩
+  rw [sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, retainedOwnershipAllowance]
+
+/-- Constructor and PAP allocation primitives consume one source event whose
+evaluation coordinate is one. -/
+theorem ProfileFundedEmitOwnershipCostSound.localEval
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    (hlocal : localOpOwnershipAllowance op = some ⟨1, 1⟩)
+    (event : IxIR0.DynamicCost.Event)
+    (heval : (IxIR0.DynamicCost.tick event).evals = 1) :
+    ProfileFundedEmitOwnershipCostSound ctx cur (emitOp op)
+      (IxIR0.DynamicCost.tick event) := by
+  refine ⟨⟨1, 1⟩, EmitOwnershipCostSound.localOp hlocal, ?_⟩
+  rw [sourceProfileOwnershipAllowance_tick_of_evals_eq_one event heval]
+  exact allocatedNodeAllowance_le_eval
+
+theorem ProfileFundedEmitRunSound.localZero
+    {ctx : Ctx} {cur : FnDef} {op : Op} {profile : SourceProfile}
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitRunSound ctx cur (emitOp op) profile :=
+  ProfileFundedEmitRunSound.localOp hlocal
+    (zeroOwnershipAllowance_le_profile profile)
+
+theorem ProfileFundedEmitRunSound.localRetain
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 2⟩) :
+    ProfileFundedEmitRunSound ctx cur (emitOp op)
+      (IxIR0.DynamicCost.retain 1) := by
+  apply ProfileFundedEmitRunSound.localOp hlocal
+  rw [sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, retainedOwnershipAllowance]
+
+theorem ProfileFundedEmitRunSound.localEval
+    {ctx : Ctx} {cur : FnDef} {op : Op}
+    (hlocal : localOpOwnershipAllowance op = some ⟨1, 1⟩)
+    (event : IxIR0.DynamicCost.Event)
+    (heval : (IxIR0.DynamicCost.tick event).evals = 1) :
+    ProfileFundedEmitRunSound ctx cur (emitOp op)
+      (IxIR0.DynamicCost.tick event) := by
+  apply ProfileFundedEmitRunSound.localOp hlocal
+  rw [sourceProfileOwnershipAllowance_tick_of_evals_eq_one event heval]
+  exact allocatedNodeAllowance_le_eval
+
+/-- A dynamically zero-cost emitter prefix can be assigned to any enclosing
+source fragment. -/
+theorem ProfileFundedEmitRunSound.of_zero
+    {ctx : Ctx} {cur : FnDef} {emit : Emit} {profile : SourceProfile}
+    (hsound : ProfileFundedEmitRunSound ctx cur emit 0) :
+    ProfileFundedEmitRunSound ctx cur emit profile :=
+  hsound.monoProfile (zeroOwnershipAllowance_le_profile profile)
+
+theorem ReleasePlan.profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {drops : List SlotDrop} {emit : Emit} {profile : SourceProfile}
+    (hplan : ReleasePlan input drops output emit) :
+    ProfileFundedEmitRunSound ctx cur emit profile := by
+  apply ProfileFundedEmitRunSound.of_zero
+  apply ReleasePlan.traverse (hplan := hplan)
+  · intro Γ
+    exact ProfileFundedEmitRunSound.id
+  · intro Γ output index abs drops tailEmit hentry ih
+    exact ProfileFundedEmitRunSound.of_profile_eq
+      (ProfileFundedEmitRunSound.comp
+        (ProfileFundedEmitRunSound.localZero
+          (profile := 0)
+          (by simp [localOpOwnershipAllowance]))
+        ih)
+      (IxIR0.DynamicCost.Profile.zero_add 0)
+  · intro Γ output index abs drops tailEmit hentry ih
+    exact ProfileFundedEmitRunSound.of_profile_eq
+      (ProfileFundedEmitRunSound.comp
+        (ProfileFundedEmitRunSound.localZero
+          (profile := 0)
+          (by simp [localOpOwnershipAllowance]))
+        ih)
+      (IxIR0.DynamicCost.Profile.zero_add 0)
+theorem FieldRetainPlan.profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.retain retains.length) := by
+  apply FieldRetainPlan.traverse (hplan := hplan)
+  · intro Γ
+    change ProfileFundedEmitRunSound ctx cur (_root_.id : Emit) 0
+    exact ProfileFundedEmitRunSound.id
+  · intro Γ output index placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih
+    apply ProfileFundedEmitRunSound.of_profile_eq
+      (ProfileFundedEmitRunSound.comp
+        (ProfileFundedEmitRunSound.localRetain
+          (by simp [localOpOwnershipAllowance]))
+        ih)
+    ext <;> simp [IxIR0.DynamicCost.retain] <;> omega
+theorem releaseAll_profileFundedEmitRunSound
+    (ctx : Ctx) (cur : FnDef) (input : VEnv) (values : List AVal)
+    (profile : SourceProfile) :
+    ProfileFundedEmitRunSound ctx cur (releaseAll input values).2 profile := by
+  apply ProfileFundedEmitRunSound.of_zero
+  apply releaseAll_traverse
+    (Result := fun _ _ _ emit =>
+      ProfileFundedEmitRunSound ctx cur emit 0)
+  · intro Γ
+    exact ProfileFundedEmitRunSound.id
+  · intro Γ atom avs output emit ih
+    exact ih
+  · intro Γ abs avs output tailEmit ih
+    exact ProfileFundedEmitRunSound.of_profile_eq
+      (ProfileFundedEmitRunSound.comp
+        (ProfileFundedEmitRunSound.localZero
+          (profile := 0)
+          (by simp [localOpOwnershipAllowance]))
+        ih)
+      (IxIR0.DynamicCost.Profile.zero_add 0)
+
+theorem lowerCapture_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {expr : IxIR0.Expr}
+    {input output : VEnv} {index : Nat} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.retain 1) := by
+  cases hentry : input.entries[index]? with
+  | none =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+      cases entry with
+      | recSelf arity =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry] using hrun)).elim
+      | slot abs remaining uses held =>
+          cases held with
+          | false =>
+              exact (stateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry] using hrun)).elim
+          | true =>
+              by_cases hunique : worldOfUses uses = .unique
+              · have huuEq :
+                    (Ixon.Owned.unique == Ixon.Owned.unique) = true := by
+                  decide
+                exact (stateThrowRun_not_ok (by
+                  simpa [lowerCapture, hentry, hunique, huuEq]
+                    using hrun)).elim
+              · have huniqueEq :
+                    (worldOfUses uses == Ixon.Owned.unique) = false := by
+                  cases uses <;> simp_all [worldOfUses] <;> decide
+                by_cases hmore : remaining > countUses index expr
+                · let next := input.setEntry index
+                    (.slot abs (remaining - countUses index expr) uses true)
+                  have hpure :
+                      (next.bump,
+                        emitOp (.dup (.var (next.rel abs))),
+                        AVal.slotA next.depth) =
+                          (output, emit, value) ∧ state = finalState := by
+                    simpa [lowerCapture, hentry, huniqueEq, hmore, next]
+                      using hrun
+                  obtain ⟨hresult, hstate⟩ := hpure
+                  cases hresult
+                  subst finalState
+                  exact ProfileFundedEmitRunSound.localRetain
+                    (by simp [localOpOwnershipAllowance])
+                · by_cases hequal : remaining = countUses index expr
+                  · let next := input.setEntry index
+                      (.slot abs 0 uses false)
+                    have hpure :
+                        (next, (_root_.id : Emit), AVal.slotA abs) =
+                            (output, emit, value) ∧ state = finalState := by
+                      simpa [lowerCapture, hentry, huniqueEq, hmore,
+                        hequal, next] using hrun
+                    obtain ⟨hresult, hstate⟩ := hpure
+                    have hemit : (_root_.id : Emit) = emit :=
+                      congrArg
+                        (fun result : VEnv × Emit × AVal => result.2.1)
+                        hresult
+                    subst emit
+                    subst finalState
+                    exact ProfileFundedEmitRunSound.of_zero
+                      ProfileFundedEmitRunSound.id
+                  · exact (stateThrowRun_not_ok (by
+                      simpa [lowerCapture, hentry, huniqueEq, hmore,
+                        hequal] using hrun)).elim
+
+theorem lowerCaptures_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} (expr : IxIR0.Expr) (captures : List Nat)
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.retain captures.length) := by
+  refine lowerCaptures_run_core
+    (Result := fun _ _ captures emit _ =>
+      ProfileFundedEmitRunSound ctx cur emit
+        (IxIR0.DynamicCost.retain captures.length))
+    (e := expr) (hrun := hrun) ?_ ?_
+  · intro input
+    change ProfileFundedEmitRunSound ctx cur (_root_.id : Emit) 0
+    exact ProfileFundedEmitRunSound.id
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail
+    apply ProfileFundedEmitRunSound.of_profile_eq
+      (ProfileFundedEmitRunSound.comp
+        (lowerCapture_profileFundedEmitRunSound hheadRun)
+        htail)
+    ext <;> simp [IxIR0.DynamicCost.retain] <;> omega
+
+/-! The profile clients use the same successful-capture classifier as the
+ownership, graph, and progress clients.  Keeping the implementation bounded
+lets both the exact and target-fuel-bounded public interfaces share the one
+retain-versus-move adapter below. -/
+private theorem lowerCapture_run_profile_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {expr : IxIR0.Expr} {input output : VEnv} {index : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit value
+      (IxIR0.DynamicCost.retain 1) := by
+  apply lowerCapture_run_core
+    (Result := fun output emit value =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv sourceValue .shared emit value
+        (IxIR0.DynamicCost.retain 1))
+    (hrun := hrun)
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry index
+      (.slot abs (remaining - countUses index expr) uses true)
+    have hsound := lower_held_retain_profile_sound_of_funding_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit)
+      (newRemaining := remaining - countUses index expr)
+      (profile := IxIR0.DynamicCost.retain 1)
+      hsource hshared hentry (by
+        rw [sourceProfileOwnershipAllowance_retain]
+        exact dupAllowance_le_retain)
+    simpa [next] using hsound
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry index (.slot abs 0 uses false)
+    have hsound := lower_held_move_profile_sound_of_profile_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) hsource hentry
+      (IxIR0.DynamicCost.retain 1)
+    simpa [next, hshared] using hsound
+
+/-- State-indexed source/profile soundness for one successful closure
+capture.  A retained capture spends one retain event; a moved final capture
+uses the same event as a conservative zero-cost allowance. -/
+theorem lowerCapture_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {expr : IxIR0.Expr} {input output : VEnv} {index : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue .shared emit value
+      (IxIR0.DynamicCost.retain 1) := by
+  exact LowerResultProfileSound.of_below fun limit =>
+    lowerCapture_run_profile_sound_at (limit := limit) hsource hrun
+
+private theorem lowerCaptures_run_profile_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (expr : IxIR0.Expr) (captures : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv captures sourceValues)
+    (hrun : (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate captures.length .shared) emit values
+      (IxIR0.DynamicCost.retain captures.length) := by
+  apply ValuesAt.lowerCaptures_core
+    (e := expr) (hselected := hselected) (hrun := hrun)
+  · intro input
+    apply LowerArgsProfileSoundBelow.of_profile_eq
+      (lowerArgs_nil_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := input)
+        (sourceEnv := sourceEnv))
+    ext <;> rfl
+  · intro index sourceValue rest sourceValues input middle output
+      headEmit tailEmit headValue tailValues state middleState
+      hsource hheadRun htail
+    have hhead := lowerCapture_run_profile_sound_at
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) hsource hheadRun
+    have hcombined := hhead.consArgs htail
+    apply LowerArgsProfileSoundBelow.of_profile_eq
+      (by simpa [List.replicate_succ] using hcombined)
+    ext <;> simp [IxIR0.DynamicCost.retain] <;> omega
+
+/-- The full capture traversal is a profiled shared-argument prefix.  Its
+retain width is exactly the number of statically selected captures. -/
+theorem lowerCaptures_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    (expr : IxIR0.Expr) (captures : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv captures sourceValues)
+    (hrun : (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate captures.length .shared) emit values
+      (IxIR0.DynamicCost.retain captures.length) := by
+  exact LowerArgsProfileSound.of_below fun limit =>
+    lowerCaptures_run_profile_sound_at (limit := limit)
+      expr captures hselected hrun
+
+/-- Allocate a fresh closure pap after a profiled shared-argument prefix.
+The allocation is charged to the lambda-evaluation event. -/
+theorem LowerArgsProfileSound.papp_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl} {profile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs profile)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth)
+      (profile + IxIR0.DynamicCost.tick .evalLam) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.papp_graph hdecl hfun hunder
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  apply ProfileFundedEmitStateRunSound.comp
+    (hargs.profileEmits sourceRest rest slots)
+  apply ProfileFundedEmitStateRunSound.localOp (allowance := ⟨1, 1⟩)
+    (papp_graph_op hdecl hfun hunder)
+  · simp [localOpOwnershipAllowance]
+  · rw [sourceProfileOwnershipAllowance_tick_of_evals_eq_one .evalLam
+      (by rfl)]
+    exact allocatedNodeAllowance_le_eval
+
+/-- Target-fuel-bounded specialization of PAP allocation to the lambda
+evaluation event. -/
+theorem LowerArgsProfileSoundBelow.papp_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl} {profile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs profile)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth)
+      (profile + IxIR0.DynamicCost.tick .evalLam) :=
+  hargs.papp_graph_of_evals_pos hdecl hfun hunder
+    (by simp [IxIR0.DynamicCost.tick])
+
+/-- State-indexed semantic/profile soundness for local-lambda lowering.  The
+exact live-capture width funds capture retains and the lambda event funds the
+fresh partial-application node. -/
+theorem lowerLam_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv expr [] sourceValue)
+    (hinclude : ∀ source address arity captures,
+      CompilerLiftedFunctionRel src finalState source address arity captures →
+      funRel source address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue .shared emit value
+      (IxIR0.DynamicCost.retain
+          ((List.range input.entries.length).filter
+            (fun index => countUses index expr > 0)).length +
+        IxIR0.DynamicCost.tick .evalLam) := by
+  let captures := liftCaptureIndices input.entries.length expr
+  change LowerResultProfileSound funRel recSelfRel ctx cur input output
+    sourceEnv sourceEnv sourceValue .shared emit value
+    (IxIR0.DynamicCost.retain captures.length +
+      IxIR0.DynamicCost.tick .evalLam)
+  apply lowerLam_run_value_core
+    (ArgsResult := fun selected captureOutput captureEmit captureValues =>
+      LowerArgsProfileSound funRel recSelfRel ctx cur input captureOutput
+        sourceEnv sourceEnv selected
+        (List.replicate captureValues.length .shared)
+        captureEmit captureValues
+        (IxIR0.DynamicCost.retain captures.length))
+    (Result := fun _ output emit value =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv sourceValue .shared emit value
+        (IxIR0.DynamicCost.retain captures.length +
+          IxIR0.DynamicCost.tick .evalLam))
+    (hsourceLength := hsourceLength) (hprefix := hprefix)
+    (hinclude := hinclude) (hrepresented := hrepresented) (hrun := hrun)
+  · intro loweredCaptures selected captureOutput captureEmit captureValues
+      _captureState hcanonical hselected hcaptureRun hlength
+    have hcaptures := lowerCaptures_run_profile_sound
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) expr loweredCaptures
+      hselected hcaptureRun
+    have hcapturesLength : loweredCaptures.length = captures.length := by
+      simpa [captures] using congrArg List.length hcanonical
+    simpa [hlength, hcapturesLength] using hcaptures
+  · intro _loweredCaptures _selected _captureOutput _captureEmit
+      _captureValues _fnAddr _code _bodyState _hcanonical hargs hdecl
+      hfun hunder
+    apply hargs.papp_graph hdecl
+    · simpa only [declArity] using hfun
+    · simpa only [declArity] using hunder
+
+/-- Complete state-indexed lambda-expression branch.  The source profile
+conservatively offers one retain candidate per source-environment entry,
+which dominates the compiler's filtered live-capture prefix. -/
+theorem lowerE_lam_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {uses : Ixon.Uses} {body : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hinclude : ∀ source address arity captures,
+      CompilerLiftedFunctionRel src finalState source address arity captures →
+      funRel source address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.lam uses body)).run state =
+        .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit value
+      (IxIR0.DynamicCost.tick .evalLam +
+        IxIR0.DynamicCost.retain sourceEnv.length) := by
+  have huuEq :
+      (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq :
+      (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+  | shared =>
+      have hlam :
+          (lowerLam src fuel input (.lam uses body)).run state =
+            .ok (output, emit, value) finalState := by
+        simpa [lowerE, hsuEq] using hrun
+      let captures := (List.range input.entries.length).filter
+        (fun index => countUses index (.lam uses body) > 0)
+      have hcapturesLeInput : captures.length ≤ input.entries.length := by
+        simpa [captures] using List.length_filter_le
+          (fun index => countUses index (.lam uses body) > 0)
+          (List.range input.entries.length)
+      have hcapturesLeSource : captures.length ≤ sourceEnv.length := by
+        omega
+      have hlocal := lowerLam_run_profile_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) hsourceLength
+        (LambdaPrefix.nil (sourceEnv := sourceEnv) (uses := uses)
+          (body := body))
+        hinclude hrepresented hlam
+      have hprofileLe : OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.retain captures.length +
+              IxIR0.DynamicCost.tick .evalLam))
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.tick .evalLam +
+              IxIR0.DynamicCost.retain sourceEnv.length)) := by
+        simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+          IxIR0.DynamicCost.retain, IxIR0.DynamicCost.tick]
+        omega
+      apply LowerResultProfileSound.monoProfile
+        (by simpa [captures] using hlocal)
+      exact hprofileLe
+
+/-- Premise-free profiled lambda semantics at the expression boundary.
+A realizable graph input supplies the source/logical environment-length
+equality; when it does not, both semantic and profile graph transformers are
+vacuous. -/
+theorem lowerE_lam_run_profile_sound_any
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {uses : Ixon.Uses} {body : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hinclude : ∀ source address arity captures,
+      CompilerLiftedFunctionRel src finalState source address arity captures →
+      funRel source address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.lam uses body)).run state =
+        .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit value
+      (IxIR0.DynamicCost.tick .evalLam +
+        IxIR0.DynamicCost.retain sourceEnv.length) := by
+  by_cases hlength : sourceEnv.length = input.entries.length
+  · exact lowerE_lam_run_profile_sound hlength hinclude hrepresented hrun
+  · refine
+      { toLowerResultValueSound :=
+          lowerE_lam_run_value_sound_any hinclude hrepresented hrun
+        profileEmits := ?_ }
+    intro sourceRest rest slots continuation continuationProfile fuel
+      before after env result horder henv hpre hcodeRun hcontinuation
+    obtain ⟨⟨roots, hgraph, _, _⟩, _⟩ := hpre
+    exact (hlength hgraph.entries.source_length).elim
+
+/-- Target-fuel-bounded state-indexed source/profile soundness for one successful closure
+capture.  A retained capture spends one retain event; a moved final capture
+uses the same event as a conservative zero-cost allowance. -/
+theorem lowerCapture_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {expr : IxIR0.Expr} {input output : VEnv} {index : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit value
+      (IxIR0.DynamicCost.retain 1) := by
+  exact lowerCapture_run_profile_sound_at hsource hrun
+
+/-- The target-fuel-bounded full capture traversal is a profiled shared-argument prefix.  Its
+retain width is exactly the number of statically selected captures. -/
+theorem lowerCaptures_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (expr : IxIR0.Expr) (captures : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv captures sourceValues)
+    (hrun : (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate captures.length .shared) emit values
+      (IxIR0.DynamicCost.retain captures.length) := by
+  exact lowerCaptures_run_profile_sound_at expr captures hselected hrun
+
+/-- Target-fuel-bounded state-indexed semantic/profile soundness for local-lambda lowering.  The
+exact live-capture width funds capture retains and the lambda event funds the
+fresh partial-application node. -/
+theorem lowerLam_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv expr [] sourceValue)
+    (hinclude : ∀ source address arity captures,
+      CompilerLiftedFunctionRel src finalState source address arity captures →
+      funRel source address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit value
+      (IxIR0.DynamicCost.retain
+          ((List.range input.entries.length).filter
+            (fun index => countUses index expr > 0)).length +
+        IxIR0.DynamicCost.tick .evalLam) := by
+  let captures := liftCaptureIndices input.entries.length expr
+  change LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+    input output sourceEnv sourceEnv sourceValue .shared emit value
+    (IxIR0.DynamicCost.retain captures.length +
+      IxIR0.DynamicCost.tick .evalLam)
+  apply lowerLam_run_value_core
+    (ArgsResult := fun selected captureOutput captureEmit captureValues =>
+      LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+        input captureOutput sourceEnv sourceEnv selected
+        (List.replicate captureValues.length .shared)
+        captureEmit captureValues
+        (IxIR0.DynamicCost.retain captures.length))
+    (Result := fun _ output emit value =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv sourceValue .shared emit value
+        (IxIR0.DynamicCost.retain captures.length +
+          IxIR0.DynamicCost.tick .evalLam))
+    (hsourceLength := hsourceLength) (hprefix := hprefix)
+    (hinclude := hinclude) (hrepresented := hrepresented) (hrun := hrun)
+  · intro loweredCaptures selected captureOutput captureEmit captureValues
+      _captureState hcanonical hselected hcaptureRun hlength
+    have hcaptures := lowerCaptures_run_profile_sound_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) expr loweredCaptures
+      hselected hcaptureRun
+    have hcapturesLength : loweredCaptures.length = captures.length := by
+      simpa [captures] using congrArg List.length hcanonical
+    simpa [hlength, hcapturesLength] using hcaptures
+  · intro _loweredCaptures _selected _captureOutput _captureEmit
+      _captureValues _fnAddr _code _bodyState _hcanonical hargs hdecl
+      hfun hunder
+    apply hargs.papp_graph hdecl
+    · simpa only [declArity] using hfun
+    · simpa only [declArity] using hunder
+
+/-- Complete target-fuel-bounded state-indexed lambda-expression branch.  The source profile
+conservatively offers one retain candidate per source-environment entry,
+which dominates the compiler's filtered live-capture prefix. -/
+theorem lowerE_lam_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {uses : Ixon.Uses} {body : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hinclude : ∀ source address arity captures,
+      CompilerLiftedFunctionRel src finalState source address arity captures →
+      funRel source address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.lam uses body)).run state =
+        .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit value
+      (IxIR0.DynamicCost.tick .evalLam +
+        IxIR0.DynamicCost.retain sourceEnv.length) := by
+  have huuEq :
+      (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq :
+      (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+  | shared =>
+      have hlam :
+          (lowerLam src fuel input (.lam uses body)).run state =
+            .ok (output, emit, value) finalState := by
+        simpa [lowerE, hsuEq] using hrun
+      let captures := (List.range input.entries.length).filter
+        (fun index => countUses index (.lam uses body) > 0)
+      have hcapturesLeInput : captures.length ≤ input.entries.length := by
+        simpa [captures] using List.length_filter_le
+          (fun index => countUses index (.lam uses body) > 0)
+          (List.range input.entries.length)
+      have hcapturesLeSource : captures.length ≤ sourceEnv.length := by
+        omega
+      have hlocal := lowerLam_run_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) hsourceLength
+        (LambdaPrefix.nil (sourceEnv := sourceEnv) (uses := uses)
+          (body := body))
+        hinclude hrepresented hlam
+      have hprofileLe : OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.retain captures.length +
+              IxIR0.DynamicCost.tick .evalLam))
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.tick .evalLam +
+              IxIR0.DynamicCost.retain sourceEnv.length)) := by
+        simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+          IxIR0.DynamicCost.retain, IxIR0.DynamicCost.tick]
+        omega
+      apply LowerResultProfileSoundBelow.monoProfile
+        (by simpa [captures] using hlocal)
+      exact hprofileLe
+
+/-- Premise-free target-fuel-bounded profiled lambda semantics at the expression boundary.
+A realizable graph input supplies the source/logical environment-length
+equality; when it does not, both semantic and profile graph transformers are
+vacuous. -/
+theorem lowerE_lam_run_profile_sound_any_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {uses : Ixon.Uses} {body : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hinclude : ∀ source address arity captures,
+      CompilerLiftedFunctionRel src finalState source address arity captures →
+      funRel source address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.lam uses body)).run state =
+        .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit value
+      (IxIR0.DynamicCost.tick .evalLam +
+        IxIR0.DynamicCost.retain sourceEnv.length) := by
+  by_cases hlength : sourceEnv.length = input.entries.length
+  · exact lowerE_lam_run_profile_sound_below hlength hinclude hrepresented hrun
+  · refine
+      { toLowerResultValueSound :=
+          lowerE_lam_run_value_sound_any hinclude hrepresented hrun
+        profileEmits := ?_ }
+    intro sourceRest rest slots bound hbound continuation continuationProfile fuel
+      before after env result hfuel horder henv hpre hcodeRun hcontinuation
+    obtain ⟨⟨roots, hgraph, _, _⟩, _⟩ := hpre
+    exact (hlength hgraph.entries.source_length).elim
+
+/-- The literal compiler branch emits no ownership operation and is funded
+by its exact source evaluation event. -/
+theorem lowerE_lit_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalLit) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  exact ProfileFundedEmitOwnershipCostSound.of_zero
+    EmitOwnershipCostSound.id
+
+/-- Dynamic exact-run counterpart of literal lowering.  The compiler emits
+no target operation, so the source event can fund the identity prefix in
+front of an arbitrarily recursive continuation. -/
+theorem lowerE_lit_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalLit) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  apply ProfileFundedEmitRunSound.of_zero
+  exact ProfileFundedEmitRunSound.id
+
+/-- Literal lowering simultaneously preserves the semantic graph and funds
+the exact source literal profile at the same state boundary. -/
+theorem lowerE_lit_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {value : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.lit literal) world emit value
+      (IxIR0.DynamicCost.tick .evalLit) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  apply scalar_id_profile_sound (profile :=
+    IxIR0.DynamicCost.tick .evalLit) .lit
+  · intro env
+    rfl
+  · rfl
+  · intro store
+    exact .lit
+
+/-- The erased compiler branch is the corresponding zero-cost source event.
+-/
+theorem lowerE_erased_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalErased) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  exact ProfileFundedEmitOwnershipCostSound.of_zero
+    EmitOwnershipCostSound.id
+
+/-- Dynamic exact-run counterpart of erased-value lowering. -/
+theorem lowerE_erased_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalErased) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  apply ProfileFundedEmitRunSound.of_zero
+  exact ProfileFundedEmitRunSound.id
+
+/-- Erased-value lowering simultaneously preserves the semantic graph and
+funds its exact source event. -/
+theorem lowerE_erased_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv .erased world emit value
+      (IxIR0.DynamicCost.tick .evalErased) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  apply scalar_id_profile_sound (profile :=
+    IxIR0.DynamicCost.tick .evalErased) .erased
+  · intro env
+    rfl
+  · rfl
+  · intro store
+    exact .erased
+
+/-- Fuel-bounded literal-expression profile soundness. -/
+theorem lowerE_lit_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {value : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.lit literal) world emit value
+      (IxIR0.DynamicCost.tick .evalLit) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  apply scalar_id_profile_sound_below (limit := limit) (profile :=
+    IxIR0.DynamicCost.tick .evalLit) .lit
+  · intro env
+    rfl
+  · rfl
+  · intro store
+    exact .lit
+
+/-- Fuel-bounded erased-expression profile soundness. -/
+theorem lowerE_erased_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv .erased world emit value
+      (IxIR0.DynamicCost.tick .evalErased) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  apply scalar_id_profile_sound_below (limit := limit) (profile :=
+    IxIR0.DynamicCost.tick .evalErased) .erased
+  · intro env
+    rfl
+  · rfl
+  · intro store
+    exact .erased
+
+/-- Profile-source adapter for `lowerSpine_erased_run_core`. Erased-head
+evaluation, erased-result forcing, the canonical head/argument/application
+profile sum, and the reduction to erased `applyRest` are recovered once for
+ordinary and reachable exact/bounded profile clients. -/
+private theorem lowerSpine_erased_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {Result : IxIR0.Value → SourceProfile → Prop}
+    (hfinish : ∀ {argumentValues : List IxIR0.Value}
+        {argumentProfile applyProfile : SourceProfile},
+      SourceArgsProfile sourceCtx sourceEnv args argumentValues
+        argumentProfile →
+      SourceAppliesProfile sourceCtx .erased argumentValues .erased
+        applyProfile →
+      (applyRest src (fuel + 1) input world (_root_.id : Emit)
+        (.constA .erased) args).run state =
+          .ok (output, emit, av) finalState →
+      Result .erased
+        (IxIR0.DynamicCost.tick .evalErased + argumentProfile +
+          applyProfile))
+    (hsource : SourceSpineProfile sourceCtx sourceEnv .erased args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState) :
+    Result sourceResult profile := by
+  apply hsource.eliminate
+  · intro headValue argumentValues headProfile argumentProfile applyProfile
+      hhead harguments happlies hprofile
+    obtain ⟨_, hhead⟩ := hhead
+    cases hhead
+    have hresult : sourceResult = .erased :=
+      happlies.toSourceApplies.deterministic
+        (SourceApplies.erased sourceCtx argumentValues)
+    subst sourceResult
+    rw [← hprofile]
+    exact hfinish harguments happlies (lowerSpine_erased_run_core hrun)
+
+/-- Complete profiled erased-head spine.  The literal erased head consumes
+its own source event, while strict arguments retain their profiles before
+the target discards their owners and returns the erased scalar. -/
+theorem lowerSpine_erased_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv .erased args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_erased_run_profile_core
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hfinish := by
+      intro argumentValues argumentProfile applyProfile harguments happlies
+        hrestRun
+      have hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+        input input sourceEnv sourceEnv .erased .shared
+        (_root_.id : Emit) (.constA .erased)
+        (IxIR0.DynamicCost.tick .evalErased) := by
+        apply scalar_id_profile_sound (profile :=
+          IxIR0.DynamicCost.tick .evalErased) .erased
+        · intro env
+          rfl
+        · rfl
+        · intro store
+          exact .erased
+      exact applyRest_erased_run_profile_sound hargs harguments happlies
+        hfunction hrestRun)
+    hsource hrun
+
+/-- Complete fuel-bounded profiled erased-head spine.  The literal erased head consumes
+its own source event, while strict arguments retain their profiles before
+the target discards their owners and returns the erased scalar. -/
+theorem lowerSpine_erased_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv .erased args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_erased_run_profile_core
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hfinish := by
+      intro argumentValues argumentProfile applyProfile harguments happlies
+        hrestRun
+      have hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur
+          limit
+        input input sourceEnv sourceEnv .erased .shared
+        (_root_.id : Emit) (.constA .erased)
+        (IxIR0.DynamicCost.tick .evalErased) := by
+        apply scalar_id_profile_sound_below (limit := limit) (profile :=
+          IxIR0.DynamicCost.tick .evalErased) .erased
+        · intro env
+          rfl
+        · rfl
+        · intro store
+          exact .erased
+      exact applyRest_erased_run_profile_sound_below hargs harguments
+        happlies hfunction hrestRun)
+    hsource hrun
+
+/-- One complete exact-profile `lowerSpine` step.  Every executable head
+family is covered, including static declaration dispatch and synthetic
+recursive self calls. -/
+theorem lowerSpine_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hexpr : LowerEProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrestNext : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    (hselfOwnership : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      Sim.FnOwnershipContract ctx cur (List.replicate arity .shared))
+    (hselfValue : ∀ {index arity : Nat}
+        {sourceFunction : IxIR0.Value},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      recSelfRel sourceFunction arity →
+      FnValueContract
+        (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx cur
+        (List.replicate arity .shared) sourceFunction)
+    (hselfCost : ∀ {index arity : Nat}
+        {sourceFunction : IxIR0.Value},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      recSelfRel sourceFunction arity →
+      ∃ sourceAddress,
+        FnProfileContract (CompilerFunctionRel sourceCtx src relationState)
+          sourceCtx ctx sourceAddress cur
+          (List.replicate arity .shared) sourceFunction)
+    (hselfPositive : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) → 0 < arity)
+    (hselfResult : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      cur.result = .shared)
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineProfile sourceCtx sourceEnv actualHead args sourceResult
+          profile →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+        input output sourceEnv sourceEnv sourceResult world emit av profile)
+    (happ := by
+      intro _ _ hsource hrun
+      exact lowerSpine_app_run_profile_sound hspine hsource hrun)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_profile_sound hargs hsource hrun)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_profile_sound hexpr hreflect hargs
+        hrestNext hnotSelf hargsNonempty hsource hrun)
+    (hrecSelf := by
+      intro _ _ hentry hsource hrun
+      exact lowerSpine_recSelf_run_profile_sound hargs hrest hentry
+        (hselfOwnership hentry) (fun hrel => hselfValue hentry hrel)
+        (fun hrel => hselfCost hentry hrel) (hselfPositive hentry)
+        (hselfResult hentry) hsource hrun)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_profile_sound henv hargs hrest hknownExtra
+        hcontracts hvalues hprofiles hsource hrun hextends hrepresented)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_profile_sound hexpr hreflect hargs
+        hrestNext hshape hargsNonempty hsource hrun)
+    hsource hrun
+
+/-- One complete target-fuel-bounded exact-profile `lowerSpine` step.  Every executable head
+family is covered, including static declaration dispatch and synthetic
+recursive self calls. -/
+theorem lowerSpine_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hexpr : LowerEProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hrestNext : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    (hselfOwnership : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      Sim.FnOwnershipContract ctx cur (List.replicate arity .shared))
+    (hselfValue : ∀ {index arity : Nat}
+        {sourceFunction : IxIR0.Value},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      recSelfRel sourceFunction arity →
+      FnValueContract
+        (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx cur
+        (List.replicate arity .shared) sourceFunction)
+    (hselfCost : ∀ {index arity : Nat}
+        {sourceFunction : IxIR0.Value},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      recSelfRel sourceFunction arity →
+      ∃ sourceAddress,
+        FnProfileContractBelow
+          (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx
+          sourceAddress cur
+          (List.replicate arity .shared) sourceFunction limit)
+    (hselfPositive : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) → 0 < arity)
+    (hselfResult : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      cur.result = .shared)
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceResult world emit av
+      profile := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineProfile sourceCtx sourceEnv actualHead args sourceResult
+          profile →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+        limit input output sourceEnv sourceEnv sourceResult world emit av
+        profile)
+    (happ := by
+      intro _ _ hsource hrun
+      exact lowerSpine_app_run_profile_sound_below hspine hsource hrun)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_profile_sound_below hargs hsource hrun)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_profile_sound_below hexpr hreflect
+        hargs hrestNext hnotSelf hargsNonempty hsource hrun)
+    (hrecSelf := by
+      intro _ _ hentry hsource hrun
+      exact lowerSpine_recSelf_run_profile_sound_below hargs hrest hentry
+        (hselfOwnership hentry) (fun hrel => hselfValue hentry hrel)
+        (fun hrel => hselfCost hentry hrel) (hselfPositive hentry)
+        (hselfResult hentry) hsource hrun)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_profile_sound_below henv hargs hrest
+        hknownExtra hcontracts hvalues hprofiles hsource hrun hextends
+        hrepresented)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_profile_sound_below hexpr hreflect hargs
+        hrestNext hshape hargsNonempty hsource hrun)
+    hsource hrun
+
+/-- The repeated-variable target `dup` is paid by the retain coordinate of
+the exact source variable profile; its evaluation coordinate remains
+available to the enclosing compiler induction. -/
+theorem ProfileFundedEmitOwnershipCostSound.varDup
+    {ctx : Ctx} {cur : FnDef} (atom : Atom) :
+    ProfileFundedEmitOwnershipCostSound ctx cur (emitOp (.dup atom))
+      (IxIR0.DynamicCost.tick .evalVar + IxIR0.DynamicCost.retain 1) := by
+  refine ⟨⟨0, 2⟩, EmitOwnershipCostSound.localOp (by
+    simp [localOpOwnershipAllowance]), ?_⟩
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_tick_of_evals_eq_one .evalVar (by rfl),
+    sourceProfileOwnershipAllowance_retain]
+  simp [OwnershipAllowanceLE, evalOwnershipAllowance,
+    retainedOwnershipAllowance, OwnershipAllowance.add]
+
+/-- Dynamic exact-run variable duplication rule. -/
+theorem ProfileFundedEmitRunSound.varDup
+    {ctx : Ctx} {cur : FnDef} (atom : Atom) :
+    ProfileFundedEmitRunSound ctx cur (emitOp (.dup atom))
+      (IxIR0.DynamicCost.tick .evalVar + IxIR0.DynamicCost.retain 1) := by
+  exact ProfileFundedEmitRunSound.monoProfile
+    (ProfileFundedEmitRunSound.localRetain
+      (by simp [localOpOwnershipAllowance]))
+    (by
+      rw [sourceProfileOwnershipAllowance_add,
+        sourceProfileOwnershipAllowance_tick_of_evals_eq_one .evalVar
+          (by rfl),
+        sourceProfileOwnershipAllowance_retain]
+      simp [OwnershipAllowanceLE, evalOwnershipAllowance,
+        retainedOwnershipAllowance, OwnershipAllowance.add])
+
+/-- Every successful variable-lowering branch is funded by the exact source
+variable profile.  Final use moves for free; repeated shared use emits the
+single `dup` certified above. -/
+theorem lowerE_var_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalVar + IxIR0.DynamicCost.retain 1) := by
+  have hssNe :
+      (Ixon.Owned.shared != Ixon.Owned.shared) = false := by decide
+  have huuNe :
+      (Ixon.Owned.unique != Ixon.Owned.unique) = false := by decide
+  have hsuNe :
+      (Ixon.Owned.shared != Ixon.Owned.unique) = true := by decide
+  have husNe :
+      (Ixon.Owned.unique != Ixon.Owned.shared) = true := by decide
+  have hsuEq :
+      (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  have huuEq :
+      (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  cases hentry : input.entries[index]? with
+  | none =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+      cases entry with
+      | recSelf arity =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerE, hentry] using hrun)).elim
+      | slot abs remaining uses held =>
+          cases held with
+          | false =>
+              exact (stateThrowRun_not_ok (by
+                simpa [lowerE, hentry] using hrun)).elim
+          | true =>
+              by_cases hworld : worldOfUses uses = world
+              · subst world
+                have hsame :
+                    (worldOfUses uses != worldOfUses uses) = false := by
+                  cases uses <;> decide
+                cases remaining with
+                | zero =>
+                    exact (stateThrowRun_not_ok (by
+                      simpa [lowerE, hentry, hsame] using hrun)).elim
+                | succ remaining =>
+                    cases remaining with
+                    | zero =>
+                        have hpure :
+                            (input.setEntry index
+                                (.slot abs 0 uses false),
+                              (_root_.id : Emit), AVal.slotA abs) =
+                                (output, emit, value) ∧
+                              state = finalState := by
+                          simpa [lowerE, hentry, hsame] using hrun
+                        obtain ⟨hresult, hstate⟩ := hpure
+                        cases hresult
+                        subst finalState
+                        exact
+                          ProfileFundedEmitOwnershipCostSound.of_zero
+                            EmitOwnershipCostSound.id
+                    | succ remaining =>
+                        cases uses with
+                        | erased =>
+                            have heq :
+                                (Ixon.Owned.shared ==
+                                  Ixon.Owned.unique) = false := by
+                              decide
+                            let next := input.setEntry index
+                              (.slot abs (Nat.succ remaining) .erased true)
+                            have hpure :
+                                (next.bump,
+                                  emitOp (.dup (.var (next.rel abs))),
+                                  AVal.slotA next.depth) =
+                                    (output, emit, value) ∧
+                                  state = finalState := by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq, next] using hrun
+                            obtain ⟨hresult, hstate⟩ := hpure
+                            cases hresult
+                            subst finalState
+                            exact
+                              ProfileFundedEmitOwnershipCostSound.varDup _
+                        | linear =>
+                            have heq :
+                                (Ixon.Owned.unique ==
+                                  Ixon.Owned.unique) = true := by
+                              decide
+                            exact (stateThrowRun_not_ok (by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq] using hrun)).elim
+                        | affine =>
+                            have heq :
+                                (Ixon.Owned.unique ==
+                                  Ixon.Owned.unique) = true := by
+                              decide
+                            exact (stateThrowRun_not_ok (by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq] using hrun)).elim
+                        | many =>
+                            have heq :
+                                (Ixon.Owned.shared ==
+                                  Ixon.Owned.unique) = false := by
+                              decide
+                            let next := input.setEntry index
+                              (.slot abs (Nat.succ remaining) .many true)
+                            have hpure :
+                                (next.bump,
+                                  emitOp (.dup (.var (next.rel abs))),
+                                  AVal.slotA next.depth) =
+                                    (output, emit, value) ∧
+                                  state = finalState := by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq, next] using hrun
+                            obtain ⟨hresult, hstate⟩ := hpure
+                            cases hresult
+                            subst finalState
+                            exact
+                              ProfileFundedEmitOwnershipCostSound.varDup _
+              · have hdiff : (worldOfUses uses != world) = true := by
+                  cases uses <;> cases world <;>
+                    simp_all [worldOfUses] <;> decide
+                cases uses <;> cases world
+                all_goals
+                  try { exact (hworld (by rfl)).elim }
+                all_goals
+                  exact (stateThrowRun_not_ok (by
+                    simpa [lowerE, hentry, worldOfUses, hdiff, hssNe,
+                      huuNe, hsuNe, husNe, hsuEq, huuEq] using hrun)).elim
+
+/-- Dynamic exact-run counterpart of variable lowering.  Moving a final
+use leaves the continuation untouched; a repeated shared use executes the
+single certified `dup` before that exact continuation. -/
+theorem lowerE_var_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalVar + IxIR0.DynamicCost.retain 1) := by
+  intro continuation continuationProfile runFuel before after runtimeEnv
+    result horder hbounds hcodeRun hcontinuation
+  have hssNe :
+      (Ixon.Owned.shared != Ixon.Owned.shared) = false := by decide
+  have huuNe :
+      (Ixon.Owned.unique != Ixon.Owned.unique) = false := by decide
+  have hsuNe :
+      (Ixon.Owned.shared != Ixon.Owned.unique) = true := by decide
+  have husNe :
+      (Ixon.Owned.unique != Ixon.Owned.shared) = true := by decide
+  have hsuEq :
+      (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  have huuEq :
+      (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  cases hentry : input.entries[index]? with
+  | none =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+      cases entry with
+      | recSelf arity =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerE, hentry] using hrun)).elim
+      | slot abs remaining uses held =>
+          cases held with
+          | false =>
+              exact (stateThrowRun_not_ok (by
+                simpa [lowerE, hentry] using hrun)).elim
+          | true =>
+              by_cases hworld : worldOfUses uses = world
+              · subst world
+                have hsame :
+                    (worldOfUses uses != worldOfUses uses) = false := by
+                  cases uses <;> decide
+                cases remaining with
+                | zero =>
+                    exact (stateThrowRun_not_ok (by
+                      simpa [lowerE, hentry, hsame] using hrun)).elim
+                | succ remaining =>
+                    cases remaining with
+                    | zero =>
+                        have hpure :
+                            (input.setEntry index
+                                (.slot abs 0 uses false),
+                              (_root_.id : Emit), AVal.slotA abs) =
+                                (output, emit, value) ∧
+                              state = finalState := by
+                          simpa [lowerE, hentry, hsame] using hrun
+                        obtain ⟨hresult, hstate⟩ := hpure
+                        cases hresult
+                        subst finalState
+                        have hid : ProfileFundedEmitRunSound ctx cur
+                            (_root_.id : Emit)
+                            (IxIR0.DynamicCost.tick .evalVar +
+                              IxIR0.DynamicCost.retain 1) := by
+                          apply ProfileFundedEmitRunSound.of_zero
+                          exact ProfileFundedEmitRunSound.id
+                        exact hid horder hbounds hcodeRun hcontinuation
+                    | succ remaining =>
+                        cases uses with
+                        | erased =>
+                            have heq :
+                                (Ixon.Owned.shared ==
+                                  Ixon.Owned.unique) = false := by
+                              decide
+                            let next := input.setEntry index
+                              (.slot abs (Nat.succ remaining) .erased true)
+                            have hpure :
+                                (next.bump,
+                                  emitOp (.dup (.var (next.rel abs))),
+                                  AVal.slotA next.depth) =
+                                    (output, emit, value) ∧
+                                  state = finalState := by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq, next] using hrun
+                            obtain ⟨hresult, hstate⟩ := hpure
+                            cases hresult
+                            subst finalState
+                            exact (ProfileFundedEmitRunSound.varDup _)
+                              horder hbounds hcodeRun hcontinuation
+                        | linear =>
+                            have heq :
+                                (Ixon.Owned.unique ==
+                                  Ixon.Owned.unique) = true := by
+                              decide
+                            exact (stateThrowRun_not_ok (by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq] using hrun)).elim
+                        | affine =>
+                            have heq :
+                                (Ixon.Owned.unique ==
+                                  Ixon.Owned.unique) = true := by
+                              decide
+                            exact (stateThrowRun_not_ok (by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq] using hrun)).elim
+                        | many =>
+                            have heq :
+                                (Ixon.Owned.shared ==
+                                  Ixon.Owned.unique) = false := by
+                              decide
+                            let next := input.setEntry index
+                              (.slot abs (Nat.succ remaining) .many true)
+                            have hpure :
+                                (next.bump,
+                                  emitOp (.dup (.var (next.rel abs))),
+                                  AVal.slotA next.depth) =
+                                    (output, emit, value) ∧
+                                  state = finalState := by
+                              simpa [lowerE, hentry, worldOfUses, hsame,
+                                heq, hssNe, huuNe, hsuNe, husNe, hsuEq,
+                                huuEq, next] using hrun
+                            obtain ⟨hresult, hstate⟩ := hpure
+                            cases hresult
+                            subst finalState
+                            exact (ProfileFundedEmitRunSound.varDup _)
+                              horder hbounds hcodeRun hcontinuation
+              · have hdiff : (worldOfUses uses != world) = true := by
+                  cases uses <;> cases world <;>
+                    simp_all [worldOfUses] <;> decide
+                cases uses <;> cases world
+                all_goals
+                  try { exact (hworld (by rfl)).elim }
+                all_goals
+                  exact (stateThrowRun_not_ok (by
+                    simpa [lowerE, hentry, worldOfUses, hdiff, hssNe,
+                      huuNe, hsuNe, husNe, hsuEq, huuEq] using hrun)).elim
+
+/-- Complete semantic/profile variable branch.  The source lookup restricts
+the target state to the matching value graph, while the compiler run decides
+between a zero-cost move and the single funded shared retain. -/
+theorem lowerE_var_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit value
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  exact lowerE_var_run_sound_core
+    (Result := fun resultWorld resultOutput resultEmit resultValue _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input resultOutput
+        sourceEnv sourceEnv sourceValue resultWorld resultEmit resultValue
+        (IxIR0.DynamicCost.tick .evalVar +
+          IxIR0.DynamicCost.retain 1))
+    (hmove := fun hentry =>
+      lower_var_move_profile_sound hsource hentry)
+    (hdup := fun hworld hentry =>
+      lower_held_retain_profile_sound hsource hworld hentry)
+    hrun
+
+/-- Complete semantic/profile variable-borrow branch.  Both final-use owner
+transfer and repeated borrowing emit the identity prefix, while retaining
+the exact source variable profile for enclosing projection composition. -/
+theorem lowerBorrow_var_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {index : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var index)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  exact lowerBorrow_var_run_sound_core
+    (Result := fun resultOutput resultEmit resultAv resultRelease _ =>
+      LowerBorrowProfileSound funRel recSelfRel ctx cur input resultOutput
+        sourceEnv sourceEnv sourceValue resultEmit resultAv resultRelease
+        (IxIR0.DynamicCost.tick .evalVar +
+          IxIR0.DynamicCost.retain 1))
+    (hmove := fun hworld hentry =>
+      lower_var_shared_move_borrow_profile_sound
+        hsource hworld hentry)
+    (hrepeated := fun hworld hentry =>
+      lower_var_shared_borrow_profile_sound hsource hworld hentry)
+    hrun
+
+/-- Non-variable borrowing delegates to the ordinary shared-expression
+profile proof and changes only the pending-owner classification selected by
+the returned descriptor. -/
+theorem lowerBorrow_dynamic_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+      {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+        .ok (exprOutput, exprEmit, exprAv) exprState →
+      LowerResultProfileSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release profile := by
+  exact lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease _ =>
+      LowerBorrowProfileSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceValue borrowEmit borrowAv borrowRelease
+        profile)
+    (hexpr := fun hsubrun => hexpr hsubrun)
+    (hslot := fun hsound => hsound.asBorrowSlot)
+    (hconst := fun hsound => hsound.asBorrowConst)
+    hshape hrun
+
+/-- One complete borrowing-position compiler step.  A costed source trace
+supplies the variable lookup/profile directly; every other syntax form uses
+the ordinary shared-expression recursive proof at predecessor compiler fuel.
+-/
+theorem lowerBorrow_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel sourceFuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+      {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+        .ok (exprOutput, exprEmit, exprAv) exprState →
+      LowerResultProfileSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release profile := by
+  cases expr with
+  | var index =>
+      cases hsource with
+      | var hlookup =>
+          exact lowerBorrow_var_run_profile_sound hlookup hrun
+  | ref address =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr (.ref address) hrun
+  | app function argument =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr
+        (.app function argument) hrun
+  | lam uses body =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr (.lam uses body) hrun
+  | letE uses value body =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr
+        (.letE uses value body) hrun
+  | proj index value =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr
+        (.proj index value) hrun
+  | lit literal =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr (.lit literal) hrun
+  | erased =>
+      exact lowerBorrow_dynamic_run_profile_sound hexpr .erased hrun
+
+/-- Target-fuel-bounded complete semantic/profile variable branch.  The
+source lookup restricts the target state to the matching value graph, while
+the compiler run decides between a zero-cost move and the single funded
+shared retain. -/
+theorem lowerE_var_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit value
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  exact lowerE_var_run_sound_core
+    (Result := fun resultWorld resultOutput resultEmit resultValue _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        resultOutput sourceEnv sourceEnv sourceValue resultWorld resultEmit
+        resultValue (IxIR0.DynamicCost.tick .evalVar +
+          IxIR0.DynamicCost.retain 1))
+    (hmove := fun hentry =>
+      lower_var_move_profile_sound_below hsource hentry)
+    (hdup := fun hworld hentry =>
+      lower_held_retain_profile_sound_below hsource hworld hentry)
+    hrun
+
+/-- Target-fuel-bounded complete semantic/profile variable-borrow branch.
+Both final-use owner transfer and repeated borrowing emit the identity prefix,
+while retaining the exact source variable profile for enclosing projection
+composition. -/
+theorem lowerBorrow_var_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {index : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hsource : sourceEnv[index]? = some sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var index)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release
+      (IxIR0.DynamicCost.tick .evalVar +
+        IxIR0.DynamicCost.retain 1) := by
+  exact lowerBorrow_var_run_sound_core
+    (Result := fun resultOutput resultEmit resultAv resultRelease _ =>
+      LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+        resultOutput sourceEnv sourceEnv sourceValue resultEmit resultAv
+        resultRelease (IxIR0.DynamicCost.tick .evalVar +
+          IxIR0.DynamicCost.retain 1))
+    (hmove := fun hworld hentry =>
+      lower_var_shared_move_borrow_profile_sound_below
+        hsource hworld hentry)
+    (hrepeated := fun hworld hentry =>
+      lower_var_shared_borrow_profile_sound_below
+        hsource hworld hentry)
+    hrun
+
+/-- Target-fuel-bounded non-variable borrowing delegates to the ordinary shared-expression
+profile proof and changes only the pending-owner classification selected by
+the returned descriptor. -/
+theorem lowerBorrow_dynamic_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+      {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+        .ok (exprOutput, exprEmit, exprAv) exprState →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release profile := by
+  exact lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        exprOutput sourceEnv sourceEnv sourceValue .shared exprEmit exprAv
+        profile)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease _ =>
+      LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+        borrowOutput sourceEnv sourceEnv sourceValue borrowEmit borrowAv
+        borrowRelease profile)
+    (hexpr := fun hsubrun => hexpr hsubrun)
+    (hslot := fun hsound => hsound.asBorrowSlot)
+    (hconst := fun hsound => hsound.asBorrowConst)
+    hshape hrun
+
+/-- One target-fuel-bounded complete borrowing-position compiler step.  A costed source trace
+supplies the variable lookup/profile directly; every other syntax form uses
+the ordinary shared-expression recursive proof at predecessor compiler fuel.
+-/
+theorem lowerBorrow_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel sourceFuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+      {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+        .ok (exprOutput, exprEmit, exprAv) exprState →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release profile := by
+  cases expr with
+  | var index =>
+      cases hsource with
+      | var hlookup =>
+          exact lowerBorrow_var_run_profile_sound_below hlookup hrun
+  | ref address =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr (.ref address) hrun
+  | app function argument =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr
+        (.app function argument) hrun
+  | lam uses body =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr (.lam uses body) hrun
+  | letE uses value body =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr
+        (.letE uses value body) hrun
+  | proj index value =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr
+        (.proj index value) hrun
+  | lit literal =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr (.lit literal) hrun
+  | erased =>
+      exact lowerBorrow_dynamic_run_profile_sound_below hexpr .erased hrun
+
+/-- Complete semantic/profile let branch.  The recursive hypotheses fund the
+bound expression and body at their exact source profiles; binder installation
+is selected from the compiler result descriptor and charged to `evalLet`. -/
+theorem lowerE_let_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {valueProfile bodyProfile : SourceProfile}
+    (hrecursive : ∀ {middle bodyInput bodyOutput : VEnv}
+      {valueEmit bodyEmit : Emit} {boundValue resultValue : AVal}
+      {valueState bodyState bodyFinal : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+        .ok (middle, valueEmit, boundValue) valueState →
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, resultValue) bodyFinal →
+      bodyState = valueState →
+      ExtraExtends bodyFinal finalState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      LowerResultProfileSound funRel recSelfRel ctx cur input middle
+          sourceEnv sourceEnv boundSource (worldOfUses uses)
+          valueEmit boundValue valueProfile ∧
+        LowerResultProfileSound funRel recSelfRel ctx cur
+          bodyInput bodyOutput (boundSource :: sourceEnv)
+          (boundSource :: sourceEnv) sourceValue world
+          bodyEmit resultValue bodyProfile)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (valueProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) := by
+  exact (lowerE_let_run_sound_core
+    (Result := fun branchOutput branchEmit branchValue branchState =>
+      ExtraExtends branchState finalState →
+      LowerResultProfileSound funRel recSelfRel ctx cur input branchOutput
+        sourceEnv sourceEnv sourceValue world branchEmit branchValue
+        (valueProfile + bodyProfile +
+          IxIR0.DynamicCost.tick .evalLet))
+    (hslotAffine := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked _ hwithin
+      let heldInput := installAliasBinder middle abs 0 .affine true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderProfileSound funRel recSelfRel ctx cur
+          middle bodyInput sourceEnv boundSource .unique (.slotA abs)
+          (emitOp (.dropU (.var (middle.rel abs))))
+          (IxIR0.DynamicCost.tick .evalLet) := by
+        simpa [bodyInput, heldInput] using
+          (installAliasBinder_releasedAffine_profile_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (input := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs))
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotMany := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked _ hwithin
+      let heldInput := installAliasBinder middle abs 0 .many true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderProfileSound funRel recSelfRel ctx cur
+          middle bodyInput sourceEnv boundSource .shared (.slotA abs)
+          (emitOp (.drop (.var (middle.rel abs))))
+          (IxIR0.DynamicCost.tick .evalLet) := by
+        simpa [bodyInput, heldInput] using
+          (installAliasBinder_releasedMany_profile_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (input := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs))
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotUsed := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      let bodyInput := installAliasBinder middle abs
+        (countUses 0 body) uses true
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_profile_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (input := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := countUses 0 body) (uses := uses)
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [Function.comp_def] using hsound)
+    (hconstUnused := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      let bodyInput := installPushedBinder middle 0 uses false
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_profile_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (input := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := 0) (uses := uses) (held := false)
+        hvalueSound.stable
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hconstUsed := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      let bodyInput := installPushedBinder middle (countUses 0 body)
+        uses true
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_profile_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (input := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := countUses 0 body) (uses := uses)
+        (held := true) hvalueSound.stable
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    hrun) (ExtraExtends.refl _)
+theorem lowerE_let_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {valueProfile bodyProfile : SourceProfile}
+    (hrecursive : ∀ {middle bodyInput bodyOutput : VEnv}
+      {valueEmit bodyEmit : Emit} {boundValue resultValue : AVal}
+      {valueState bodyState bodyFinal : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+        .ok (middle, valueEmit, boundValue) valueState →
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, resultValue) bodyFinal →
+      bodyState = valueState →
+      ExtraExtends bodyFinal finalState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input middle
+          sourceEnv sourceEnv boundSource (worldOfUses uses)
+          valueEmit boundValue valueProfile ∧
+        LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+          bodyInput bodyOutput (boundSource :: sourceEnv)
+          (boundSource :: sourceEnv) sourceValue world
+          bodyEmit resultValue bodyProfile)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (valueProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) := by
+  exact (lowerE_let_run_sound_core
+    (Result := fun branchOutput branchEmit branchValue branchState =>
+      ExtraExtends branchState finalState →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        branchOutput sourceEnv sourceEnv sourceValue world branchEmit
+        branchValue (valueProfile + bodyProfile +
+          IxIR0.DynamicCost.tick .evalLet))
+    (hslotAffine := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked _ hwithin
+      let heldInput := installAliasBinder middle abs 0 .affine true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderProfileSoundBelow funRel recSelfRel
+          ctx cur limit middle bodyInput sourceEnv boundSource .unique
+          (.slotA abs) (emitOp (.dropU (.var (middle.rel abs))))
+          (IxIR0.DynamicCost.tick .evalLet) := by
+        simpa [bodyInput, heldInput] using
+          (installAliasBinder_releasedAffine_profile_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit) (input := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs))
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotMany := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked _ hwithin
+      let heldInput := installAliasBinder middle abs 0 .many true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderProfileSoundBelow funRel recSelfRel
+          ctx cur limit middle bodyInput sourceEnv boundSource .shared
+          (.slotA abs) (emitOp (.drop (.var (middle.rel abs))))
+          (IxIR0.DynamicCost.tick .evalLet) := by
+        simpa [bodyInput, heldInput] using
+          (installAliasBinder_releasedMany_profile_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit) (input := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs))
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotUsed := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      let bodyInput := installAliasBinder middle abs
+        (countUses 0 body) uses true
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (input := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := countUses 0 body) (uses := uses)
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [Function.comp_def] using hsound)
+    (hconstUnused := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      let bodyInput := installPushedBinder middle 0 uses false
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (input := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := 0) (uses := uses) (held := false)
+        hvalueSound.stable
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hconstUsed := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      let bodyInput := installPushedBinder middle (countUses 0 body)
+        uses true
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_profile_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (input := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := countUses 0 body) (uses := uses)
+        (held := true) hvalueSound.stable
+      have hsound :=
+        hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    hrun) (ExtraExtends.refl _)
+/-- Lambda lowering composes the exact live-capture retain budget with the
+single PAP allocation emitted at the closure site.  Fresh-address and lifted
+body construction mutate only compiler state, not the returned emitter. -/
+theorem lowerLam_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hrun : (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.retain
+          ((List.range input.entries.length).filter
+            (fun index => countUses index expr > 0)).length +
+        IxIR0.DynamicCost.tick .evalLam) := by
+  let captures := liftCaptureIndices input.entries.length expr
+  change ProfileFundedEmitOwnershipCostSound ctx cur emit
+    (IxIR0.DynamicCost.retain captures.length +
+      IxIR0.DynamicCost.tick .evalLam)
+  apply lowerLam_run_core
+    (Result := fun _ _ emit _ =>
+      ProfileFundedEmitOwnershipCostSound ctx cur emit
+        (IxIR0.DynamicCost.retain captures.length +
+          IxIR0.DynamicCost.tick .evalLam))
+    (hrun := hrun)
+  intro _bodyFuel captureOutput captureEmit captureValues _captureState
+    fnAddr _addressState _code _bodyState _hfuel _hp hcaptureRun
+    _hfreshRun _hbodyRun
+  have hcaptureCost :=
+    lowerCaptures_profileFundedOwnershipCostSound
+      (ctx := ctx) (cur := cur) expr captures
+      (by simpa [captures] using hcaptureRun)
+  have hpappCost :
+      ProfileFundedEmitOwnershipCostSound ctx cur
+        (emitOp (.papp fnAddr
+          (captureValues.map
+            (·.toAtom captureOutput)).toArray))
+        (IxIR0.DynamicCost.tick .evalLam) :=
+    ProfileFundedEmitOwnershipCostSound.localEval
+      (by simp [localOpOwnershipAllowance]) .evalLam rfl
+  exact ProfileFundedEmitOwnershipCostSound.comp hcaptureCost hpappCost
+
+theorem lowerLam_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hrun : (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.retain
+          ((List.range input.entries.length).filter
+            (fun index => countUses index expr > 0)).length +
+        IxIR0.DynamicCost.tick .evalLam) := by
+  let captures := liftCaptureIndices input.entries.length expr
+  change ProfileFundedEmitRunSound ctx cur emit
+    (IxIR0.DynamicCost.retain captures.length +
+      IxIR0.DynamicCost.tick .evalLam)
+  refine lowerLam_run_core
+    (Result := fun _ _ emit _ =>
+      ProfileFundedEmitRunSound ctx cur emit
+        (IxIR0.DynamicCost.retain captures.length +
+          IxIR0.DynamicCost.tick .evalLam))
+    ?_ hrun
+  intro _bodyFuel captureOutput captureEmit captureValues _captureState
+    fnAddr _addressState _code _bodyState _hfuel _hp hcaptureRun
+    _hfreshRun _hbodyRun
+  have hcaptureCost : ProfileFundedEmitRunSound ctx cur captureEmit
+      (IxIR0.DynamicCost.retain captures.length) :=
+    lowerCaptures_profileFundedEmitRunSound
+      (ctx := ctx) (cur := cur) expr captures
+      (by simpa [captures] using hcaptureRun)
+  have hpappCost :
+      ProfileFundedEmitRunSound ctx cur
+        (emitOp (.papp fnAddr
+          (captureValues.map
+            (·.toAtom captureOutput)).toArray))
+        (IxIR0.DynamicCost.tick .evalLam) :=
+    ProfileFundedEmitRunSound.localEval
+      (by simp [localOpOwnershipAllowance]) .evalLam rfl
+  intro continuation continuationProfile runFuel before after runtimeEnv
+    result horder hbounds hcodeRun hcontinuation
+  exact (ProfileFundedEmitRunSound.comp hcaptureCost hpappCost)
+    horder hbounds hcodeRun hcontinuation
+
+/-- The successful `lowerE` lambda branch is funded by the exact source
+lambda profile.  The source charges every environment entry conservatively;
+the compiler retains only the filtered live captures. -/
+theorem lowerE_lam_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.lam uses body)).run state =
+        .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalLam +
+        IxIR0.DynamicCost.retain sourceEnv.length) := by
+  have huuEq :
+      (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq :
+      (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+  | shared =>
+      have hlam :
+          (lowerLam src fuel input (.lam uses body)).run state =
+            .ok (output, emit, value) finalState := by
+        simpa [lowerE, hsuEq] using hrun
+      let captures := (List.range input.entries.length).filter
+        (fun index => countUses index (.lam uses body) > 0)
+      have hcaptureCost :=
+        lowerLam_profileFundedOwnershipCostSound
+          (ctx := ctx) (cur := cur) hlam
+      change ProfileFundedEmitOwnershipCostSound ctx cur emit
+        (IxIR0.DynamicCost.retain captures.length +
+          IxIR0.DynamicCost.tick .evalLam) at hcaptureCost
+      have hcapturesLeInput : captures.length ≤ input.entries.length := by
+        simpa [captures] using List.length_filter_le
+          (fun index => countUses index (.lam uses body) > 0)
+          (List.range input.entries.length)
+      have hcapturesLeSource : captures.length ≤ sourceEnv.length := by
+        omega
+      apply ProfileFundedEmitOwnershipCostSound.monoProfile hcaptureCost
+      simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+        IxIR0.DynamicCost.retain, IxIR0.DynamicCost.tick]
+      omega
+
+theorem lowerE_lam_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.lam uses body)).run state =
+        .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (IxIR0.DynamicCost.tick .evalLam +
+        IxIR0.DynamicCost.retain sourceEnv.length) := by
+  intro continuation continuationProfile runFuel before after runtimeEnv
+    result horder hbounds hcodeRun hcontinuation
+  have huuEq :
+      (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq :
+      (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+  | shared =>
+      have hlam :
+          (lowerLam src fuel input (.lam uses body)).run state =
+            .ok (output, emit, value) finalState := by
+        simpa [lowerE, hsuEq] using hrun
+      let captures := (List.range input.entries.length).filter
+        (fun index => countUses index (.lam uses body) > 0)
+      have hcapturesLeInput : captures.length ≤ input.entries.length := by
+        simpa [captures] using List.length_filter_le
+          (fun index => countUses index (.lam uses body) > 0)
+          (List.range input.entries.length)
+      have hcapturesLeSource : captures.length ≤ sourceEnv.length := by
+        omega
+      have hprofileLe : OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.retain captures.length +
+              IxIR0.DynamicCost.tick .evalLam))
+          (sourceProfileOwnershipAllowance
+            (IxIR0.DynamicCost.tick .evalLam +
+              IxIR0.DynamicCost.retain sourceEnv.length)) := by
+        simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+          IxIR0.DynamicCost.retain, IxIR0.DynamicCost.tick]
+        omega
+      have hlocalRun : ProfileFundedCodeRun ctx runFuel cur before
+          runtimeEnv (emit continuation) after result
+          ((IxIR0.DynamicCost.retain captures.length +
+              IxIR0.DynamicCost.tick .evalLam) + continuationProfile) := by
+        simpa only [captures] using
+          ((lowerLam_profileFundedEmitRunSound
+              (ctx := ctx) (cur := cur) hlam)
+            horder hbounds hcodeRun hcontinuation)
+      apply hlocalRun.monoProfile
+      simpa only [sourceProfileOwnershipAllowance_add] using
+        hprofileLe.add (OwnershipAllowanceLE.refl
+          (sourceProfileOwnershipAllowance continuationProfile))
+
+/-- A projection fetch known to be impossible closes any remaining suffix.
+The fetch itself is ownership-free; the unreachable tail may consume the
+source retain candidate without producing a target run. -/
+theorem falseAfterProjectionFetch_profileFundedEmitStateRunSound
+    {ctx : Ctx} {cur : FnDef} {op : Op} {tail : Emit}
+    {pre post : StatePred}
+    (hfalse : OpSound ctx cur op pre (fun _ _ => False))
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitStateRunSound ctx cur (emitOp op ∘ tail) pre post
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+  ProfileFundedEmitStateRunSound.comp
+    (ProfileFundedEmitStateRunSound.localZero
+      (profile := IxIR0.DynamicCost.tick .evalProj) hfalse hlocal)
+    (ProfileFundedEmitStateRunSound.ofFalse
+      (emit := tail) (profile := IxIR0.DynamicCost.retain 1))
+
+/-- Exact state-indexed fetch/retain suffix for a repeated-use projection
+target.  The final identity step exposes the retained field as the result. -/
+theorem projectionSlotKept_profileFundedEmitStateRunSound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (Γ.bump.rel Γ.depth))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hfetch : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) false
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj) :=
+    ProfileFundedEmitStateRunSound.localZero
+      (fetchBorrowSlot_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ) (sourceEnv := sourceEnv)
+        (address := address) (tag := tag) (targetAbs := targetAbs)
+        (index := index) (release := false) (sourceRest := sourceRest)
+        (rest := rest) (slots := slots) hsourceField)
+      (by simp [localOpOwnershipAllowance])
+  have hretain : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.dup (.var (Γ.bump.rel Γ.depth))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) false
+        sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) false
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSound.localRetain
+      (retainFetchedBorrow_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ.bump)
+        (sourceEnv := sourceEnv)
+        (sourceTarget := .ctor address tag sourceFields)
+        (sourceField := sourceField) (targetAbs := targetAbs)
+        (fieldAbs := Γ.depth) (release := false)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      (by simp [localOpOwnershipAllowance])
+  have hfinish : ProfileFundedEmitStateRunSound ctx cur
+      (_root_.id : Emit)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      0 := by
+    apply ProfileFundedEmitStateRunSound.id
+    intro store env hpre
+    obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+        htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+        hown, hslots⟩ := hpre
+    refine ⟨⟨roots, resultValue, hΓ, hresult, hresultGraph,
+      hrestGraph, ?_⟩, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hall : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          (_root_.id : Emit)))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        (IxIR0.DynamicCost.retain 1 + 0)) :=
+    ProfileFundedEmitStateRunSound.comp hfetch
+      (ProfileFundedEmitStateRunSound.comp hretain hfinish)
+  have hnormalized : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          (_root_.id : Emit)))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSound.of_profile_eq hall (by
+      ext <;> simp)
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact hnormalized horder henv hpre hrun hcontinuation
+
+/-- Exact state-indexed fetch/retain/drop suffix for a final-use projection
+target.  The destructive drop transports every surviving graph through the
+resulting store restriction. -/
+theorem projectionSlotReleased_profileFundedEmitStateRunSound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+        emitOp (.drop (.var (Γ.bump.bump.rel targetAbs))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hfetch : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) true
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj) :=
+    ProfileFundedEmitStateRunSound.localZero
+      (fetchBorrowSlot_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ) (sourceEnv := sourceEnv)
+        (address := address) (tag := tag) (targetAbs := targetAbs)
+        (index := index) (release := true) (sourceRest := sourceRest)
+        (rest := rest) (slots := slots) hsourceField)
+      (by simp [localOpOwnershipAllowance])
+  have hretain : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.dup (.var (Γ.bump.rel Γ.depth))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) true
+        sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) true
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSound.localRetain
+      (retainFetchedBorrow_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ.bump)
+        (sourceEnv := sourceEnv)
+        (sourceTarget := .ctor address tag sourceFields)
+        (sourceField := sourceField) (targetAbs := targetAbs)
+        (fieldAbs := Γ.depth) (release := true)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      (by simp [localOpOwnershipAllowance])
+  have hdrop : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.drop (.var (Γ.bump.bump.rel targetAbs))))
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      0 :=
+    ProfileFundedEmitStateRunSound.localZero
+      (releaseRetainedProjection_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ.bump.bump)
+        (sourceEnv := sourceEnv)
+        (sourceTarget := .ctor address tag sourceFields)
+        (sourceField := sourceField) (targetAbs := targetAbs)
+        (resultAbs := Γ.bump.depth) (sourceRest := sourceRest)
+        (rest := rest) (slots := slots))
+      (by simp [localOpOwnershipAllowance])
+  have hall : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          emitOp (.drop (.var (Γ.bump.bump.rel targetAbs)))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        (IxIR0.DynamicCost.retain 1 + 0)) :=
+    ProfileFundedEmitStateRunSound.comp hfetch
+      (ProfileFundedEmitStateRunSound.comp hretain hdrop)
+  have hnormalized : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          emitOp (.drop (.var (Γ.bump.bump.rel targetAbs)))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSound.of_profile_eq hall (by
+      ext <;> simp)
+  intro continuation continuationProfile fuel before after env value horder
+    henv hpre hrun hcontinuation
+  exact hnormalized horder henv hpre hrun hcontinuation
+
+/-- Profiled erased-borrow finish.  The target identity suffix is free, while
+the source projection event and conservative retain candidate remain in the
+trace. -/
+theorem LowerBorrowProfileSound.returnErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {emit : Emit} {release : Bool} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.constA .erased) release sourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput .erased .shared emit (.constA .erased)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased) := by
+    simpa [Function.comp_def] using
+      hsound.toLowerBorrowValueSound.returnErased
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput .erased (.constA .erased) release
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          .erased .shared (.constA .erased) sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSound.monoProfile
+    · apply ProfileFundedEmitStateRunSound.id
+      intro store env hpre
+      obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+          hrestGraph, hown, hslots⟩ := hpre
+      refine ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, ?_⟩, hslots⟩
+      cases release with
+      | false =>
+          simpa [borrowResultRoots] using
+            hown.addNoLocation
+              (hsound.stable.const_noLocation hav)
+      | true => simpa [borrowResultRoots] using hown
+    · exact zeroOwnershipAllowance_le_profile _
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+  simpa [Function.comp_def] using hnormalized
+
+/-- A constructor source value cannot realize the erased scalar descriptor.
+The profiled target identity branch is therefore vacuous at the exact state
+boundary. -/
+theorem LowerBorrowProfileSound.projectCtorErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {release : Bool} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA .erased) release
+      sourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue .shared emit (.constA .erased)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased) := by
+    simpa [Function.comp_def] using
+      hsound.toLowerBorrowValueSound.projectCtorErased
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur (_root_.id : Emit)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput (.ctor address tag sourceFields) (.constA .erased)
+          release sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue .shared (.constA .erased) sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSound.monoProfile
+    · apply ProfileFundedEmitStateRunSound.id
+      intro store env hpre
+      obtain ⟨roots, value, houtput, hav, hworld, htargetGraph,
+          hrestGraph, hown, hslots⟩ := hpre
+      cases hav with
+      | const hresolve =>
+          simp only [resolveAtom] at hresolve
+          have hvalue : RVal.erased = value := Except.ok.inj hresolve
+          subst value
+          cases htargetGraph
+    · exact zeroOwnershipAllowance_le_profile _
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+  simpa [Function.comp_def] using hnormalized
+
+/-- Profiled scalar-target projection. Stable literals and erased constants
+cannot satisfy `fetch`, so the exact state transformer closes by the exposed
+operation-level contradiction. -/
+theorem LowerBorrowProfileSound.projectConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {emit : Emit} {atom : Atom} {index : Nat} {release : Bool}
+    {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceTarget emit
+      (.constA atom) release sourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectConst
+    (sourceValue := sourceValue) (index := index)
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.fetch atom index))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput sourceTarget (.constA atom) release
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump
+          sourceOutput sourceValue .shared (.slotA output.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSound.localZero
+    · intro fuel store env store' result hpre hrun
+      exact (fetchStableConst_false_op hsound.stable hpre hrun).elim
+    · simp [localOpOwnershipAllowance]
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Profiled projection through a retained slot. -/
+theorem LowerBorrowProfileSound.projectSlotKept
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) false
+      sourceProfile)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotKept
+    hsourceField
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput (.ctor address tag sourceFields)
+          (.slotA targetAbs) false sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump
+          sourceOutput sourceField .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    exact projectionSlotKept_profileFundedEmitStateRunSound
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (Γ := output)
+      (sourceEnv := sourceOutput) (address := address) (tag := tag)
+      (targetAbs := targetAbs) (index := index)
+      (sourceRest := sourceRest) (rest := rest) (slots := slots)
+      hsourceField
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Profiled projection through a final-use slot. -/
+theorem LowerBorrowProfileSound.projectSlotReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) true
+      sourceProfile)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      output.bump.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotReleased
+    hsourceField
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput (.ctor address tag sourceFields)
+          (.slotA targetAbs) true sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump.bump
+          sourceOutput sourceField .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    exact projectionSlotReleased_profileFundedEmitStateRunSound
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (Γ := output)
+      (sourceEnv := sourceOutput) (address := address) (tag := tag)
+      (targetAbs := targetAbs) (index := index)
+      (sourceRest := sourceRest) (rest := rest) (slots := slots)
+      hsourceField
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceField
+      .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Profiled erased-source projection through a retained slot. The fetch
+cannot execute, so the exact-run suffix closes at its false midpoint. -/
+theorem LowerBorrowProfileSound.projectSlotKeptErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) false sourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotKeptErased
+    (sourceValue := sourceValue) (index := index)
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput .erased (.slotA targetAbs) false
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump
+          sourceOutput sourceValue .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply falseAfterProjectionFetch_profileFundedEmitStateRunSound
+    · exact fetchErasedSlot_false_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := output)
+        (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+        (index := index) (release := false)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    · simp [localOpOwnershipAllowance]
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Profiled erased-source projection through a final-use slot. -/
+theorem LowerBorrowProfileSound.projectSlotReleasedErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) true sourceProfile) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input
+      output.bump.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotReleasedErased
+    (sourceValue := sourceValue) (index := index)
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSound ctx cur
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput .erased (.slotA targetAbs) true
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump.bump
+          sourceOutput sourceValue .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply falseAfterProjectionFetch_profileFundedEmitStateRunSound
+    · exact fetchErasedSlot_false_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := output)
+        (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+        (index := index) (release := true)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    · simp [localOpOwnershipAllowance]
+  have hcombined : LowerResultProfileSound funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceValue
+      .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- A target-fuel-bounded projection fetch known to be impossible closes any remaining suffix.
+The fetch itself is ownership-free; the unreachable tail may consume the
+source retain candidate without producing a target run. -/
+theorem falseAfterProjectionFetch_profileFundedEmitStateRunSound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {op : Op} {tail : Emit}
+    {pre post : StatePred}
+    (hfalse : OpSound ctx cur op pre (fun _ _ => False))
+    (hlocal : localOpOwnershipAllowance op = some ⟨0, 0⟩) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit (emitOp op ∘ tail) pre post
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+  ProfileFundedEmitStateRunSoundBelow.comp
+    (ProfileFundedEmitStateRunSoundBelow.localZero
+      (profile := IxIR0.DynamicCost.tick .evalProj) hfalse hlocal)
+    (ProfileFundedEmitStateRunSoundBelow.ofFalse
+      (emit := tail) (profile := IxIR0.DynamicCost.retain 1))
+
+/-- Target-fuel-bounded exact state-indexed fetch/retain suffix for a repeated-use projection
+target.  The final identity step exposes the retained field as the result. -/
+theorem projectionSlotKept_profileFundedEmitStateRunSound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (Γ.bump.rel Γ.depth))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hfetch : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) false
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj) :=
+    ProfileFundedEmitStateRunSoundBelow.localZero
+      (fetchBorrowSlot_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ) (sourceEnv := sourceEnv)
+        (address := address) (tag := tag) (targetAbs := targetAbs)
+        (index := index) (release := false) (sourceRest := sourceRest)
+        (rest := rest) (slots := slots) hsourceField)
+      (by simp [localOpOwnershipAllowance])
+  have hretain : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.dup (.var (Γ.bump.rel Γ.depth))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) false
+        sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) false
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSoundBelow.localRetain
+      (retainFetchedBorrow_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ.bump)
+        (sourceEnv := sourceEnv)
+        (sourceTarget := .ctor address tag sourceFields)
+        (sourceField := sourceField) (targetAbs := targetAbs)
+        (fieldAbs := Γ.depth) (release := false)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      (by simp [localOpOwnershipAllowance])
+  have hfinish : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (_root_.id : Emit)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      0 := by
+    apply ProfileFundedEmitStateRunSoundBelow.id
+    intro store env hpre
+    obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+        htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+        hown, hslots⟩ := hpre
+    refine ⟨⟨roots, resultValue, hΓ, hresult, hresultGraph,
+      hrestGraph, ?_⟩, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          (_root_.id : Emit)))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        (IxIR0.DynamicCost.retain 1 + 0)) :=
+    ProfileFundedEmitStateRunSoundBelow.comp hfetch
+      (ProfileFundedEmitStateRunSoundBelow.comp hretain hfinish)
+  have hnormalized : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          (_root_.id : Emit)))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump sourceEnv
+        sourceField .shared (.slotA Γ.bump.depth) sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSoundBelow.of_profile_eq hall (by
+      ext <;> simp)
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  exact hnormalized bound hbound hfuel horder henv hpre hrun hcontinuation
+
+/-- Target-fuel-bounded exact state-indexed fetch/retain/drop suffix for a final-use projection
+target.  The destructive drop transports every surviving graph through the
+resulting store restriction. -/
+theorem projectionSlotReleased_profileFundedEmitStateRunSound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+        emitOp (.drop (.var (Γ.bump.bump.rel targetAbs))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hfetch : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) true
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj) :=
+    ProfileFundedEmitStateRunSoundBelow.localZero
+      (fetchBorrowSlot_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ) (sourceEnv := sourceEnv)
+        (address := address) (tag := tag) (targetAbs := targetAbs)
+        (index := index) (release := true) (sourceRest := sourceRest)
+        (rest := rest) (slots := slots) hsourceField)
+      (by simp [localOpOwnershipAllowance])
+  have hretain : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.dup (.var (Γ.bump.rel Γ.depth))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) true
+        sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) true
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSoundBelow.localRetain
+      (retainFetchedBorrow_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ.bump)
+        (sourceEnv := sourceEnv)
+        (sourceTarget := .ctor address tag sourceFields)
+        (sourceField := sourceField) (targetAbs := targetAbs)
+        (fieldAbs := Γ.depth) (release := true)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      (by simp [localOpOwnershipAllowance])
+  have hdrop : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.bump.bump.rel targetAbs))))
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel
+        Γ.bump.bump sourceEnv (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.bump.depth) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      0 :=
+    ProfileFundedEmitStateRunSoundBelow.localZero
+      (releaseRetainedProjection_value_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ.bump.bump)
+        (sourceEnv := sourceEnv)
+        (sourceTarget := .ctor address tag sourceFields)
+        (sourceField := sourceField) (targetAbs := targetAbs)
+        (resultAbs := Γ.bump.depth) (sourceRest := sourceRest)
+        (rest := rest) (slots := slots))
+      (by simp [localOpOwnershipAllowance])
+  have hall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          emitOp (.drop (.var (Γ.bump.bump.rel targetAbs)))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        (IxIR0.DynamicCost.retain 1 + 0)) :=
+    ProfileFundedEmitStateRunSoundBelow.comp hfetch
+      (ProfileFundedEmitStateRunSoundBelow.comp hretain hdrop)
+  have hnormalized : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index) ∘
+        (emitOp (.dup (.var (Γ.bump.rel Γ.depth))) ∘
+          emitOp (.drop (.var (Γ.bump.bump.rel targetAbs)))))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) true
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump.bump.bump
+        sourceEnv sourceField .shared (.slotA Γ.bump.depth)
+        sourceRest rest slots)
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitStateRunSoundBelow.of_profile_eq hall (by
+      ext <;> simp)
+  intro bound hbound continuation continuationProfile fuel before after env
+    value hfuel horder henv hpre hrun hcontinuation
+  exact hnormalized bound hbound hfuel horder henv hpre hrun hcontinuation
+
+/-- Target-fuel-bounded profiled erased-borrow finish.  The target identity suffix is free, while
+the source projection event and conservative retain candidate remain in the
+trace. -/
+theorem LowerBorrowProfileSoundBelow.returnErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {emit : Emit} {release : Bool} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased emit
+      (.constA .erased) release sourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput .erased .shared emit (.constA .erased)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased) := by
+    simpa [Function.comp_def] using
+      hsound.toLowerBorrowValueSound.returnErased
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput .erased (.constA .erased) release
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          .erased .shared (.constA .erased) sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+    · apply ProfileFundedEmitStateRunSoundBelow.id
+      intro store env hpre
+      obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+          hrestGraph, hown, hslots⟩ := hpre
+      refine ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, ?_⟩, hslots⟩
+      cases release with
+      | false =>
+          simpa [borrowResultRoots] using
+            hown.addNoLocation
+              (hsound.stable.const_noLocation hav)
+      | true => simpa [borrowResultRoots] using hown
+    · exact zeroOwnershipAllowance_le_profile _
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+  simpa [Function.comp_def] using hnormalized
+
+/-- At a target-fuel bound, a constructor source value cannot realize the erased scalar descriptor.
+The profiled target identity branch is therefore vacuous at the exact state
+boundary. -/
+theorem LowerBorrowProfileSoundBelow.projectCtorErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {release : Bool} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA .erased) release
+      sourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue .shared emit (.constA .erased)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased) := by
+    simpa [Function.comp_def] using
+      hsound.toLowerBorrowValueSound.projectCtorErased
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput (.ctor address tag sourceFields) (.constA .erased)
+          release sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+          sourceValue .shared (.constA .erased) sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSoundBelow.monoProfile
+    · apply ProfileFundedEmitStateRunSoundBelow.id
+      intro store env hpre
+      obtain ⟨roots, value, houtput, hav, hworld, htargetGraph,
+          hrestGraph, hown, hslots⟩ := hpre
+      cases hav with
+      | const hresolve =>
+          simp only [resolveAtom] at hresolve
+          have hvalue : RVal.erased = value := Except.ok.inj hresolve
+          subst value
+          cases htargetGraph
+    · exact zeroOwnershipAllowance_le_profile _
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue .shared
+      (emit ∘ (_root_.id : Emit)) (.constA .erased)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  have hnormalized := hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+  simpa [Function.comp_def] using hnormalized
+
+/-- Target-fuel-bounded profiled scalar-target projection. Stable literals and erased constants
+cannot satisfy `fetch`, so the exact state transformer closes by the exposed
+operation-level contradiction. -/
+theorem LowerBorrowProfileSoundBelow.projectConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {emit : Emit} {atom : Atom} {index : Nat} {release : Bool}
+    {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceTarget emit
+      (.constA atom) release sourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectConst
+    (sourceValue := sourceValue) (index := index)
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.fetch atom index))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput sourceTarget (.constA atom) release
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump
+          sourceOutput sourceValue .shared (.slotA output.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply ProfileFundedEmitStateRunSoundBelow.localZero
+    · intro fuel store env store' result hpre hrun
+      exact (fetchStableConst_false_op hsound.stable hpre hrun).elim
+    · simp [localOpOwnershipAllowance]
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Target-fuel-bounded profiled projection through a retained slot. -/
+theorem LowerBorrowProfileSoundBelow.projectSlotKept
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) false
+      sourceProfile)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotKept
+    hsourceField
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput (.ctor address tag sourceFields)
+          (.slotA targetAbs) false sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump
+          sourceOutput sourceField .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    exact projectionSlotKept_profileFundedEmitStateRunSound_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (Γ := output)
+      (sourceEnv := sourceOutput) (address := address) (tag := tag)
+      (targetAbs := targetAbs) (index := index)
+      (sourceRest := sourceRest) (rest := rest) (slots := slots)
+      hsourceField
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Target-fuel-bounded profiled projection through a final-use slot. -/
+theorem LowerBorrowProfileSoundBelow.projectSlotReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) true
+      sourceProfile)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotReleased
+    hsourceField
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput (.ctor address tag sourceFields)
+          (.slotA targetAbs) true sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump.bump
+          sourceOutput sourceField .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    exact projectionSlotReleased_profileFundedEmitStateRunSound_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (Γ := output)
+      (sourceEnv := sourceOutput) (address := address) (tag := tag)
+      (targetAbs := targetAbs) (index := index)
+      (sourceRest := sourceRest) (rest := rest) (slots := slots)
+      hsourceField
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump.bump.bump sourceInput sourceOutput sourceField
+      .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Target-fuel-bounded profiled erased-source projection through a retained slot. The fetch
+cannot execute, so the exact-run suffix closes at its false midpoint. -/
+theorem LowerBorrowProfileSoundBelow.projectSlotKeptErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) false sourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotKeptErased
+    (sourceValue := sourceValue) (index := index)
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput .erased (.slotA targetAbs) false
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump
+          sourceOutput sourceValue .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply falseAfterProjectionFetch_profileFundedEmitStateRunSound_below
+    · exact fetchErasedSlot_false_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := output)
+        (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+        (index := index) (release := false)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    · simp [localOpOwnershipAllowance]
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- Target-fuel-bounded profiled erased-source projection through a final-use slot. -/
+theorem LowerBorrowProfileSoundBelow.projectSlotReleasedErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat} {sourceProfile : SourceProfile}
+    (hsound : LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) true sourceProfile) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth)
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hvalue := hsound.toLowerBorrowValueSound.projectSlotReleasedErased
+    (sourceValue := sourceValue) (index := index)
+  have hsuffix : ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+        (GraphOwnsBorrowResultProtected funRel recSelfRel output
+          sourceOutput .erased (.slotA targetAbs) true
+          sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump.bump.bump
+          sourceOutput sourceValue .shared (.slotA output.bump.depth)
+          sourceRest rest slots)
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    intro sourceRest rest slots
+    apply falseAfterProjectionFetch_profileFundedEmitStateRunSound_below
+    · exact fetchErasedSlot_false_op
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := output)
+        (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+        (index := index) (release := true)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    · simp [localOpOwnershipAllowance]
+  have hcombined : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump.bump.bump sourceInput sourceOutput sourceValue
+      .shared
+      (emit ∘
+        (emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+          emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+          emitOp (.drop (.var (output.bump.bump.rel targetAbs)))))
+      (.slotA output.bump.depth)
+      (sourceProfile +
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :=
+    hsound.thenResult hvalue hsuffix
+  exact hcombined.of_profile_eq
+    (IxIR0.DynamicCost.Profile.add_assoc sourceProfile
+      (IxIR0.DynamicCost.tick .evalProj)
+      (IxIR0.DynamicCost.retain 1)).symm
+
+/-- A scalar projection emits only the zero-cost fetch.  The projection
+event and retain candidate are still kept in the source fragment so this
+contract has the same interface as the slot-producing branches. -/
+theorem projectionFetch_profileFundedOwnershipCostSound
+    (ctx : Ctx) (cur : FnDef) (atom : Atom) (index : Nat) :
+    ProfileFundedEmitOwnershipCostSound ctx cur
+      (emitOp (.fetch atom index))
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+  ProfileFundedEmitOwnershipCostSound.localZero
+    (by simp [localOpOwnershipAllowance])
+
+/-- Fetching a field and retaining its shared owner consumes precisely the
+local ownership-relevant part of a source projection profile. -/
+theorem projectionSlotKept_profileFundedOwnershipCostSound
+    (ctx : Ctx) (cur : FnDef) (target field : Atom) (index : Nat) :
+    ProfileFundedEmitOwnershipCostSound ctx cur
+      (emitOp (.fetch target index) ∘ emitOp (.dup field))
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  exact ProfileFundedEmitOwnershipCostSound.comp
+    (ProfileFundedEmitOwnershipCostSound.localZero
+      (profile := IxIR0.DynamicCost.tick .evalProj)
+      (by simp [localOpOwnershipAllowance]))
+    (ProfileFundedEmitOwnershipCostSound.localRetain
+      (by simp [localOpOwnershipAllowance]))
+
+/-- Releasing a final-use projection target adds a zero-cost deep drop after
+the fetch-and-retain suffix, so it needs no extra source charge. -/
+theorem projectionSlotReleased_profileFundedOwnershipCostSound
+    (ctx : Ctx) (cur : FnDef) (target field owner : Atom) (index : Nat) :
+    ProfileFundedEmitOwnershipCostSound ctx cur
+      (emitOp (.fetch target index) ∘ emitOp (.dup field) ∘
+        emitOp (.drop owner))
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hfetch : ProfileFundedEmitOwnershipCostSound ctx cur
+      (emitOp (.fetch target index))
+      (IxIR0.DynamicCost.tick .evalProj) :=
+    ProfileFundedEmitOwnershipCostSound.localZero
+      (by simp [localOpOwnershipAllowance])
+  have hdup : ProfileFundedEmitOwnershipCostSound ctx cur
+      (emitOp (.dup field)) (IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitOwnershipCostSound.localRetain
+      (by simp [localOpOwnershipAllowance])
+  have hdrop : ProfileFundedEmitOwnershipCostSound ctx cur
+      (emitOp (.drop owner)) 0 :=
+    ProfileFundedEmitOwnershipCostSound.of_zero
+      (EmitOwnershipCostSound.localOp
+        (by simp [localOpOwnershipAllowance]))
+  have htail := ProfileFundedEmitOwnershipCostSound.of_profile_eq
+    (ProfileFundedEmitOwnershipCostSound.comp hdup hdrop)
+    (IxIR0.DynamicCost.Profile.add_zero _)
+  exact ProfileFundedEmitOwnershipCostSound.comp hfetch htail
+
+/-- Dynamic exact-run scalar-projection suffix. -/
+theorem projectionFetch_profileFundedEmitRunSound
+    (ctx : Ctx) (cur : FnDef) (atom : Atom) (index : Nat) :
+    ProfileFundedEmitRunSound ctx cur
+      (emitOp (.fetch atom index))
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) :=
+  ProfileFundedEmitRunSound.localZero
+    (by simp [localOpOwnershipAllowance])
+
+/-- Dynamic exact-run retained-slot projection suffix. -/
+theorem projectionSlotKept_profileFundedEmitRunSound
+    (ctx : Ctx) (cur : FnDef) (target field : Atom) (index : Nat) :
+    ProfileFundedEmitRunSound ctx cur
+      (emitOp (.fetch target index) ∘ emitOp (.dup field))
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  exact ProfileFundedEmitRunSound.comp
+    (ProfileFundedEmitRunSound.localZero
+      (profile := IxIR0.DynamicCost.tick .evalProj)
+      (by simp [localOpOwnershipAllowance]))
+    (ProfileFundedEmitRunSound.localRetain
+      (by simp [localOpOwnershipAllowance]))
+
+/-- Dynamic exact-run released-slot projection suffix. -/
+theorem projectionSlotReleased_profileFundedEmitRunSound
+    (ctx : Ctx) (cur : FnDef) (target field owner : Atom) (index : Nat) :
+    ProfileFundedEmitRunSound ctx cur
+      (emitOp (.fetch target index) ∘ emitOp (.dup field) ∘
+        emitOp (.drop owner))
+      (IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have hfetch : ProfileFundedEmitRunSound ctx cur
+      (emitOp (.fetch target index))
+      (IxIR0.DynamicCost.tick .evalProj) :=
+    ProfileFundedEmitRunSound.localZero
+      (by simp [localOpOwnershipAllowance])
+  have hdup : ProfileFundedEmitRunSound ctx cur
+      (emitOp (.dup field)) (IxIR0.DynamicCost.retain 1) :=
+    ProfileFundedEmitRunSound.localRetain
+      (by simp [localOpOwnershipAllowance])
+  have hdrop : ProfileFundedEmitRunSound ctx cur
+      (emitOp (.drop owner)) 0 := by
+    apply ProfileFundedEmitRunSound.of_zero
+    exact ProfileFundedEmitRunSound.localZero
+      (by simp [localOpOwnershipAllowance])
+  have htail : ProfileFundedEmitRunSound ctx cur
+      (emitOp (.dup field) ∘ emitOp (.drop owner))
+      (IxIR0.DynamicCost.retain 1) := by
+    apply ProfileFundedEmitRunSound.of_profile_eq
+      (ProfileFundedEmitRunSound.comp hdup hdrop)
+    exact IxIR0.DynamicCost.Profile.add_zero _
+  intro continuation continuationProfile fuel before after env value horder
+    henv hrun hcontinuation
+  exact (ProfileFundedEmitRunSound.comp hfetch htail)
+    horder henv hrun hcontinuation
+
+/-- Projection lowering preserves an arbitrary recursively funded borrowing
+prefix and appends the exact local source projection fragment.  This mirrors
+the compiler induction boundary: the caller supplies the cost proof for the
+specific successful `lowerBorrow` sub-run. -/
+theorem lowerE_proj_profileFundedOwnershipCostSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {sourceProfile : SourceProfile}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hborrow : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+      {borrowed : AVal} {release : Bool} {middleState : LowSt},
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, borrowed, release) middleState →
+      ProfileFundedEmitOwnershipCostSound ctx cur borrowEmit sourceProfile)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, value) finalState) :
+    ProfileFundedEmitOwnershipCostSound ctx cur emit
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  have finish {borrowEmit suffix : Emit}
+      (hprefix : ProfileFundedEmitOwnershipCostSound ctx cur borrowEmit
+        sourceProfile)
+      (hsuffix : ProfileFundedEmitOwnershipCostSound ctx cur suffix
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1)) :
+      ProfileFundedEmitOwnershipCostSound ctx cur (borrowEmit ∘ suffix)
+        (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+    exact ProfileFundedEmitOwnershipCostSound.of_profile_eq
+      (ProfileFundedEmitOwnershipCostSound.comp hprefix hsuffix)
+      (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+  cases world with
+  | unique =>
+      have huuEq :
+          (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+      simp only [lowerE, huuEq, if_true] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+  | shared =>
+      have hsuEq :
+          (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+      simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+      obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+        stateBindRun_ok_inv hrun
+      rcases borrowResult with
+        ⟨borrowOutput, borrowEmit, borrowed, release⟩
+      have hprefix := hborrow hborrowRun
+      cases borrowed with
+      | constA atom =>
+          cases atom with
+          | var relative =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch (.var relative) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionFetch_profileFundedOwnershipCostSound
+                  ctx cur (.var relative) index)
+          | lit literal =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch (.lit literal) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionFetch_profileFundedOwnershipCostSound
+                  ctx cur (.lit literal) index)
+          | erased =>
+              have hpure :
+                  (borrowOutput, borrowEmit, AVal.constA .erased) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              have hid : ProfileFundedEmitOwnershipCostSound ctx cur
+                  (_root_.id : Emit)
+                  (IxIR0.DynamicCost.tick .evalProj +
+                    IxIR0.DynamicCost.retain 1) :=
+                ProfileFundedEmitOwnershipCostSound.of_zero
+                  EmitOwnershipCostSound.id
+              simpa [Function.comp_def] using finish hprefix hid
+      | slotA targetAbs =>
+          cases release with
+          | false =>
+              have hpure :
+                  (borrowOutput.bump.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch
+                        (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionSlotKept_profileFundedOwnershipCostSound
+                  ctx cur (.var (borrowOutput.rel targetAbs))
+                  (.var (borrowOutput.bump.rel borrowOutput.depth)) index)
+          | true =>
+              have hpure :
+                  (borrowOutput.bump.bump.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch
+                        (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                      emitOp (.drop (.var
+                        (borrowOutput.bump.bump.rel targetAbs))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionSlotReleased_profileFundedOwnershipCostSound
+                  ctx cur (.var (borrowOutput.rel targetAbs))
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))
+                  (.var (borrowOutput.bump.bump.rel targetAbs)) index)
+
+/-- Exact-run projection lowering composes the recursively funded borrow
+prefix with the local fetch/retain/drop suffix.  Only the continuation run
+actually reached by the generated prefix is required. -/
+theorem lowerE_proj_profileFundedEmitRunSound
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {sourceProfile : SourceProfile}
+    {emit : Emit} {value : AVal} {state finalState : LowSt}
+    (hborrow : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+      {borrowed : AVal} {release : Bool} {middleState : LowSt},
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, borrowed, release) middleState →
+      ProfileFundedEmitRunSound ctx cur borrowEmit sourceProfile)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, value) finalState) :
+    ProfileFundedEmitRunSound ctx cur emit
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  intro continuation continuationProfile runFuel before after runtimeEnv
+    result horder hbounds hcodeRun hcontinuation
+  have finish {borrowEmit suffix : Emit}
+      (hprefix : ProfileFundedEmitRunSound ctx cur borrowEmit sourceProfile)
+      (hsuffix : ProfileFundedEmitRunSound ctx cur suffix
+        (IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1))
+      (hcomposedRun : runCode ctx runFuel cur before runtimeEnv
+        ((borrowEmit ∘ suffix) continuation) = .ok (after, result)) :
+      ProfileFundedCodeRun ctx runFuel cur before runtimeEnv
+        ((borrowEmit ∘ suffix) continuation) after result
+        ((sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+            IxIR0.DynamicCost.retain 1) + continuationProfile) := by
+    have hcombined : ProfileFundedEmitRunSound ctx cur
+        (borrowEmit ∘ suffix)
+        (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1) := by
+      apply ProfileFundedEmitRunSound.of_profile_eq
+        (ProfileFundedEmitRunSound.comp hprefix hsuffix)
+      exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+    exact hcombined horder hbounds hcomposedRun hcontinuation
+  cases world with
+  | unique =>
+      have huuEq :
+          (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+      simp only [lowerE, huuEq, if_true] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+  | shared =>
+      have hsuEq :
+          (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+      simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+      obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+        stateBindRun_ok_inv hrun
+      rcases borrowResult with
+        ⟨borrowOutput, borrowEmit, borrowed, release⟩
+      have hprefix : ProfileFundedEmitRunSound ctx cur borrowEmit
+          sourceProfile :=
+        hborrow hborrowRun
+      cases borrowed with
+      | constA atom =>
+          cases atom with
+          | var relative =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch (.var relative) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionFetch_profileFundedEmitRunSound
+                  ctx cur (.var relative) index)
+                hcodeRun
+          | lit literal =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch (.lit literal) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionFetch_profileFundedEmitRunSound
+                  ctx cur (.lit literal) index)
+                hcodeRun
+          | erased =>
+              have hpure :
+                  (borrowOutput, borrowEmit, AVal.constA .erased) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              have hid : ProfileFundedEmitRunSound ctx cur
+                  (_root_.id : Emit)
+                  (IxIR0.DynamicCost.tick .evalProj +
+                    IxIR0.DynamicCost.retain 1) := by
+                apply ProfileFundedEmitRunSound.of_zero
+                exact ProfileFundedEmitRunSound.id
+              have hcomposedRun : runCode ctx runFuel cur before runtimeEnv
+                  ((emit ∘ (_root_.id : Emit)) continuation) =
+                    .ok (after, result) := by
+                simpa [Function.comp_def] using hcodeRun
+              simpa [Function.comp_def] using
+                (finish hprefix hid hcomposedRun)
+      | slotA targetAbs =>
+          cases release with
+          | false =>
+              have hpure :
+                  (borrowOutput.bump.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch
+                        (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionSlotKept_profileFundedEmitRunSound
+                  ctx cur (.var (borrowOutput.rel targetAbs))
+                  (.var (borrowOutput.bump.rel borrowOutput.depth)) index)
+                hcodeRun
+          | true =>
+              have hpure :
+                  (borrowOutput.bump.bump.bump,
+                    borrowEmit ∘
+                      emitOp (.fetch
+                        (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                      emitOp (.drop (.var
+                        (borrowOutput.bump.bump.rel targetAbs))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, value) ∧
+                    middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact finish hprefix
+                (projectionSlotReleased_profileFundedEmitRunSound
+                  ctx cur (.var (borrowOutput.rel targetAbs))
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))
+                  (.var (borrowOutput.bump.bump.rel targetAbs)) index)
+                hcodeRun
+
+/-- Complete semantic/profile projection branch of the executable lowerer.
+The recursive borrow premise and the source `SourceProject` witness are
+consumed together, so every successful compiler branch carries its exact
+state-indexed target cost. -/
+theorem lowerE_proj_run_profile_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {sourceProfile : SourceProfile}
+    (hborrow : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+      {borrowed : AVal} {release : Bool} {middleState : LowSt},
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, borrowed, release) middleState →
+      LowerBorrowProfileSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceTarget borrowEmit borrowed release
+        sourceProfile)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  exact lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release _ =>
+      LowerBorrowProfileSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceTarget borrowEmit borrowed release
+        sourceProfile)
+    (ProjectionResult := fun projectionWorld projectionOutput projectionEmit
+        projectionAv _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input projectionOutput
+        sourceEnv sourceEnv sourceValue projectionWorld projectionEmit
+        projectionAv (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1))
+    (hborrow := fun hsubrun => hborrow hsubrun)
+    (hvar := fun hsound => by cases hsound.stable)
+    (hlit := fun hsound => hsound.projectConst)
+    (herased := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectCtorErased
+      | erased => exact hsound.returnErased)
+    (hslotKept := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectSlotKept hfield
+      | erased => exact hsound.projectSlotKeptErased)
+    (hslotReleased := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectSlotReleased hfield
+      | erased => exact hsound.projectSlotReleasedErased)
+    hrun
+theorem lowerE_proj_run_profile_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {sourceProfile : SourceProfile}
+    (hborrow : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+      {borrowed : AVal} {release : Bool} {middleState : LowSt},
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, borrowed, release) middleState →
+      LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input borrowOutput
+        sourceEnv sourceEnv sourceTarget borrowEmit borrowed release
+        sourceProfile)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  exact lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release _ =>
+      LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+        borrowOutput sourceEnv sourceEnv sourceTarget borrowEmit borrowed
+        release sourceProfile)
+    (ProjectionResult := fun projectionWorld projectionOutput projectionEmit
+        projectionAv _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        projectionOutput sourceEnv sourceEnv sourceValue projectionWorld
+        projectionEmit projectionAv
+        (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1))
+    (hborrow := fun hsubrun => hborrow hsubrun)
+    (hvar := fun hsound => by cases hsound.stable)
+    (hlit := fun hsound => hsound.projectConst)
+    (herased := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectCtorErased
+      | erased => exact hsound.returnErased)
+    (hslotKept := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectSlotKept hfield
+      | erased => exact hsound.projectSlotKeptErased)
+    (hslotReleased := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectSlotReleased hfield
+      | erased => exact hsound.projectSlotReleasedErased)
+    hrun
+/-- Shared source/run dispatcher for complete profiled expression semantics.
+The dependent result family retains exact source profiles while variable,
+lambda, let, projection, literal, and erased inversion plus standalone-ref
+and application-to-spine conversion remain canonical. -/
+private theorem lowerE_run_profile_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {state finalState : LowSt} {input output : VEnv}
+    {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    {Result : IxIR0.Value → SourceProfile → Prop}
+    (hvar : ∀ (index : Nat) {result : IxIR0.Value},
+      sourceEnv[index]? = some result →
+      (lowerE src (fuel + 1) input world (.var index)).run state =
+        .ok (output, emit, av) finalState →
+      Result result
+        (IxIR0.DynamicCost.tick .evalVar + IxIR0.DynamicCost.retain 1))
+    (href : ∀ (address : Ixon.Address) {result : IxIR0.Value}
+        {sourceProfile : SourceProfile},
+      SourceSpineProfile sourceCtx sourceEnv (.ref address) [] result
+        sourceProfile →
+      (lowerSpine src (fuel + 3) input world (.ref address) []).run state =
+        .ok (output, emit, av) finalState →
+      Result result sourceProfile)
+    (happ : ∀ (function argument : IxIR0.Expr)
+        {result : IxIR0.Value} {sourceProfile : SourceProfile},
+      SourceSpineProfile sourceCtx sourceEnv function [argument] result
+        sourceProfile →
+      (lowerSpine src fuel input world function [argument]).run state =
+        .ok (output, emit, av) finalState →
+      Result result sourceProfile)
+    (hlam : ∀ (uses : Ixon.Uses) (body : IxIR0.Expr),
+      (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+        .ok (output, emit, av) finalState →
+      Result (.clos uses sourceEnv body)
+        (IxIR0.DynamicCost.tick .evalLam +
+          IxIR0.DynamicCost.retain sourceEnv.length))
+    (hlet : ∀ (uses : Ixon.Uses) (value body : IxIR0.Expr)
+        {sourceStep : Nat} {bound result : IxIR0.Value}
+        {valueProfile bodyProfile : SourceProfile},
+      IxIR0.DynamicCost.Eval sourceCtx sourceStep sourceEnv value bound
+        valueProfile →
+      IxIR0.DynamicCost.Eval sourceCtx sourceStep (bound :: sourceEnv) body
+        result bodyProfile →
+      (lowerE src (fuel + 1) input world (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState →
+      Result result
+        (valueProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet))
+    (hproj : ∀ (index : Nat) (source : IxIR0.Expr)
+        {sourceStep : Nat} {address : Ixon.Address} {tag : Nat}
+        {fields : List IxIR0.Value} {result : IxIR0.Value}
+        {sourceProfile : SourceProfile},
+      IxIR0.DynamicCost.Eval sourceCtx sourceStep sourceEnv source
+        (.ctor address tag fields) sourceProfile →
+      fields[index]? = some result →
+      (lowerE src (fuel + 1) input world (.proj index source)).run state =
+        .ok (output, emit, av) finalState →
+      Result result
+        (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+          IxIR0.DynamicCost.retain 1))
+    (hlit : ∀ (literal : IxIR0.Literal),
+      (lowerE src (fuel + 1) input world (.lit literal)).run state =
+        .ok (output, emit, av) finalState →
+      Result (.lit literal) (IxIR0.DynamicCost.tick .evalLit))
+    (herased :
+      (lowerE src (fuel + 1) input world .erased).run state =
+        .ok (output, emit, av) finalState →
+      Result .erased (IxIR0.DynamicCost.tick .evalErased))
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    Result sourceValue profile := by
+  cases expr with
+  | var index =>
+    cases hsource with
+    | var hlookup => exact hvar index hlookup hrun
+  | ref address =>
+    exact href address (SourceSpineProfile.of_eval_nil hsource)
+      (lowerE_ref_run_to_lowerSpine_nil hrun)
+  | app function argument =>
+    apply happ function argument (SourceSpineProfile.of_eval_app hsource)
+    simpa [lowerE] using hrun
+  | lam uses body =>
+    cases hsource with
+    | lam => exact hlam uses body hrun
+  | letE uses value body =>
+    cases hsource with
+    | letE hvalueSource hbodySource =>
+      exact hlet uses value body hvalueSource hbodySource hrun
+  | proj index source =>
+    cases hsource with
+    | proj htarget hfield =>
+      exact hproj index source htarget hfield hrun
+  | lit literal =>
+    cases hsource
+    exact hlit literal hrun
+  | erased =>
+    cases hsource
+    exact herased hrun
+
+/-- One complete exact-profile expression step.  Costed source-evaluator
+inversion supplies the recursive profiles for let and projection; application
+and reference delegate to the completed spine routes. -/
+theorem lowerE_run_profile_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hspine : LowerSpineProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hborrow : LowerBorrowProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hargsNext : LowerArgsProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hrestNext : ApplyRestNonErasedProfilePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceValue world emit av
+      profile := by
+  exact lowerE_run_profile_core
+    (Result := fun result sourceProfile =>
+      LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+        input output sourceEnv sourceEnv result world emit av sourceProfile)
+    (hvar := by
+      intro _ _ hlookup hbranchRun
+      exact lowerE_var_run_profile_sound hlookup hbranchRun)
+    (href := by
+      intro _ _ _ hsourceSpine hspineRun
+      exact lowerSpine_ref_run_profile_sound henv hargsNext hrestNext
+        hknownExtra hcontracts hvalues hprofiles hsourceSpine hspineRun
+        hextends hrepresented)
+    (happ := by
+      intro _ _ _ _ hsourceSpine hspineRun
+      exact hspine (by simp) hsourceSpine hspineRun)
+    (hlam := by
+      intro _ _ hbranchRun
+      exact lowerE_lam_run_profile_sound_any
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := by
+      intro _ _ body _ _ _ _ _ hvalueSource hbodySource hbranchRun
+      exact lowerE_let_run_profile_sound
+        (fun hvalueRun hbodyRun _ _ _ =>
+          ⟨hexpr hvalueSource hvalueRun,
+            hexpr hbodySource hbodyRun⟩)
+        (hreleases body) hbranchRun)
+    (hproj := by
+      intro _ _ _ _ _ _ _ _ htarget hfield hbranchRun
+      exact lowerE_proj_run_profile_sound
+        (fun hborrowRun => hborrow htarget hborrowRun)
+        (.ctor hfield) hbranchRun)
+    (hlit := by
+      intro _ hbranchRun
+      exact lowerE_lit_run_profile_sound hbranchRun)
+    (herased := by
+      intro hbranchRun
+      exact lowerE_erased_run_profile_sound hbranchRun)
+    hsource hrun
+
+/-- One complete target-fuel-bounded exact-profile expression step.  Costed source-evaluator
+inversion supplies the recursive profiles for let and projection; application
+and reference delegate to the completed spine routes. -/
+theorem lowerE_run_profile_sound_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hspine : LowerSpineProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hborrow : LowerBorrowProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src fuel)
+    (hargsNext : LowerArgsProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hrestNext : ApplyRestNonErasedProfilePreservesBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur limit src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx limit)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur limit input output sourceEnv sourceEnv sourceValue world emit av
+      profile := by
+  exact lowerE_run_profile_core
+    (Result := fun result sourceProfile =>
+      LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+        limit input output sourceEnv sourceEnv result world emit av
+        sourceProfile)
+    (hvar := by
+      intro _ _ hlookup hbranchRun
+      exact lowerE_var_run_profile_sound_below hlookup hbranchRun)
+    (href := by
+      intro _ _ _ hsourceSpine hspineRun
+      exact lowerSpine_ref_run_profile_sound_below henv hargsNext hrestNext
+        hknownExtra hcontracts hvalues hprofiles hsourceSpine hspineRun
+        hextends hrepresented)
+    (happ := by
+      intro _ _ _ _ hsourceSpine hspineRun
+      exact hspine (by simp) hsourceSpine hspineRun)
+    (hlam := by
+      intro _ _ hbranchRun
+      exact lowerE_lam_run_profile_sound_any_below
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := by
+      intro _ _ body _ _ _ _ _ hvalueSource hbodySource hbranchRun
+      exact lowerE_let_run_profile_sound_below
+        (fun hvalueRun hbodyRun _ _ _ =>
+          ⟨hexpr hvalueSource hvalueRun,
+            hexpr hbodySource hbodyRun⟩)
+        (hreleases body) hbranchRun)
+    (hproj := by
+      intro _ _ _ _ _ _ _ _ htarget hfield hbranchRun
+      exact lowerE_proj_run_profile_sound_below
+        (fun hborrowRun => hborrow htarget hborrowRun)
+        (.ctor hfield) hbranchRun)
+    (hlit := by
+      intro _ hbranchRun
+      exact lowerE_lit_run_profile_sound_below hbranchRun)
+    (herased := by
+      intro hbranchRun
+      exact lowerE_erased_run_profile_sound_below hbranchRun)
+    hsource hrun
+
+/-! ### Reachable-state exact-profile compiler interfaces -/
+
+/-- The synthetic current function carries the same ownership and value
+contract used by semantic lowering, together with an exact-profile contract
+for every source function represented by the recursive-self relation. -/
+structure CurrentSelfProfileContract (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) : Prop where
+  result : cur.result = .shared
+  positive : 0 < cur.arity
+  ownership : Sim.FnOwnershipContract ctx cur
+    (List.replicate cur.arity .shared)
+  value : ∀ {sourceFunction : IxIR0.Value},
+    recSelfRel sourceFunction cur.arity →
+    FnValueContract funRel sourceCtx ctx cur
+      (List.replicate cur.arity .shared) sourceFunction
+  profile : ∀ {sourceFunction : IxIR0.Value},
+    recSelfRel sourceFunction cur.arity →
+    ∃ sourceAddress,
+      FnProfileContract funRel sourceCtx ctx sourceAddress cur
+        (List.replicate cur.arity .shared) sourceFunction
+
+theorem CurrentSelfProfileContract.toValueContract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (hcontract : CurrentSelfProfileContract funRel recSelfRel sourceCtx ctx
+      cur) :
+    CurrentSelfValueContract funRel recSelfRel sourceCtx ctx cur :=
+  ⟨hcontract.result, hcontract.ownership, hcontract.value⟩
+
+/-- Exact-profile current-self evidence is substantive for a recursor-rule
+environment and vacuous for an ordinary environment with no self marker. -/
+def SelfProfileAvailable (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (input : VEnv) : Prop :=
+  CurrentSelfProfileContract funRel recSelfRel sourceCtx ctx cur ∨
+    NoRecSelf input
+
+theorem SelfProfileAvailable.of_contract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (hcontract : CurrentSelfProfileContract funRel recSelfRel sourceCtx ctx
+      cur) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input :=
+  Or.inl hcontract
+
+theorem SelfProfileAvailable.of_noRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (hno : NoRecSelf input) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input :=
+  Or.inr hno
+
+theorem SelfProfileAvailable.toSelfValueAvailable
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract.toValueContract
+  | inr hno => exact Or.inr hno
+
+theorem SelfProfileAvailable.mapNoRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfProfileAvailable.bump
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfProfileAvailable.pop
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input.pop :=
+  havailable.mapNoRecSelf NoRecSelf.pop
+
+theorem SelfProfileAvailable.setSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (changed abs remaining : Nat) (uses : Ixon.Uses) (held : Bool) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      (input.setEntry changed (.slot abs remaining uses held)) :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.setSlot changed abs remaining uses held)
+
+theorem SelfProfileAvailable.consSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (abs remaining : Nat) (uses : Ixon.Uses) (held : Bool) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      { input with
+        entries := .slot abs remaining uses held :: input.entries } :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.consSlot abs remaining uses held)
+
+theorem SelfProfileAvailable.lowerE
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfProfileAvailable.lowerBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal} {release : Bool}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfProfileAvailable.lowerArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {args : List (IxIR0.Expr × Ixon.Owned)}
+    {state finalState : LowSt} {emit : Emit} {avs : List AVal}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+theorem SelfProfileAvailable.applyRest
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {resultWorld : Ixon.Owned} {pre : Emit} {function : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok (output, emit, av) finalState) :
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).applyRest hrun hno)
+
+/-- At a target-fuel bound, the synthetic current function carries the same ownership and value
+contract used by semantic lowering, together with an exact-profile contract
+for every source function represented by the recursive-self relation. -/
+structure CurrentSelfProfileContractBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) : Prop where
+  result : cur.result = .shared
+  positive : 0 < cur.arity
+  ownership : Sim.FnOwnershipContract ctx cur
+    (List.replicate cur.arity .shared)
+  value : ∀ {sourceFunction : IxIR0.Value},
+    recSelfRel sourceFunction cur.arity →
+    FnValueContract funRel sourceCtx ctx cur
+      (List.replicate cur.arity .shared) sourceFunction
+  profile : ∀ {sourceFunction : IxIR0.Value},
+    recSelfRel sourceFunction cur.arity →
+    ∃ sourceAddress,
+      FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur
+        (List.replicate cur.arity .shared) sourceFunction limit
+
+theorem CurrentSelfProfileContractBelow.toValueContract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (hcontract : CurrentSelfProfileContractBelow funRel recSelfRel sourceCtx ctx
+      cur limit) :
+    CurrentSelfValueContract funRel recSelfRel sourceCtx ctx cur :=
+  ⟨hcontract.result, hcontract.ownership, hcontract.value⟩
+
+/-- Target-fuel-bounded exact-profile current-self evidence is substantive for a recursor-rule
+environment and vacuous for an ordinary environment with no self marker. -/
+def SelfProfileAvailableBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input : VEnv) : Prop :=
+  CurrentSelfProfileContractBelow funRel recSelfRel sourceCtx ctx cur limit ∨
+    NoRecSelf input
+
+theorem SelfProfileAvailableBelow.of_contract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (hcontract : CurrentSelfProfileContractBelow funRel recSelfRel sourceCtx ctx
+      cur limit) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input :=
+  Or.inl hcontract
+
+theorem SelfProfileAvailableBelow.of_noRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (hno : NoRecSelf input) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input :=
+  Or.inr hno
+
+theorem SelfProfileAvailableBelow.toSelfValueAvailable
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract.toValueContract
+  | inr hno => exact Or.inr hno
+
+theorem SelfProfileAvailableBelow.mapNoRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfProfileAvailableBelow.bump
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfProfileAvailableBelow.pop
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input.pop :=
+  havailable.mapNoRecSelf NoRecSelf.pop
+
+theorem SelfProfileAvailableBelow.setSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (changed abs remaining : Nat) (uses : Ixon.Uses) (held : Bool) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      (input.setEntry changed (.slot abs remaining uses held)) :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.setSlot changed abs remaining uses held)
+
+theorem SelfProfileAvailableBelow.consSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (abs remaining : Nat) (uses : Ixon.Uses) (held : Bool) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      { input with
+        entries := .slot abs remaining uses held :: input.entries } :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.consSlot abs remaining uses held)
+
+theorem SelfProfileAvailableBelow.lowerE
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfProfileAvailableBelow.lowerBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal} {release : Bool}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfProfileAvailableBelow.lowerArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {args : List (IxIR0.Expr × Ixon.Owned)}
+    {state finalState : LowSt} {emit : Emit} {avs : List AVal}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+theorem SelfProfileAvailableBelow.applyRest
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {resultWorld : Ixon.Owned} {pre : Emit} {function : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input)
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok (output, emit, av) finalState) :
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).applyRest hrun hno)
+
+/-- Reachable-state expression profile preservation. The exact source trace
+funds the result while the lowering subrun need only end inside the ambient
+whole-pass state used by the generated-function relation. -/
+def LowerEProfilePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av sourceProfile
+
+def LowerBorrowProfilePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal}
+      {release : Bool},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release sourceProfile
+
+def LowerArgsProfilePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Ixon.Owned)}
+      {sourceProfile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsProfile sourceCtx sourceEnv (args.map Prod.fst) sourceValues
+      sourceProfile →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+      sourceProfile
+
+def ApplyRestNonErasedProfilePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {functionProfile argsProfile applyProfile : SourceProfile}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    args ≠ [] →
+    SourceArgsProfile sourceCtx sourceMiddle args sourceArgs argsProfile →
+    SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+      applyProfile →
+    LowerResultProfileSound funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction function
+      functionProfile →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultProfileSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+      (functionProfile + argsProfile + applyProfile)
+
+def LowerSpineProfilePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {profile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    args ≠ [] →
+    SourceSpineProfile sourceCtx sourceEnv head args sourceResult profile →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile
+
+/-- Target-fuel-bounded reachable-state expression profile preservation. The exact source trace
+funds the result while the lowering subrun need only end inside the ambient
+whole-pass state used by the generated-function relation. -/
+def LowerEProfilePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av sourceProfile
+
+def LowerBorrowProfilePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {sourceProfile : SourceProfile}
+      {state finalState : LowSt} {emit : Emit} {av : AVal}
+      {release : Bool},
+    IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr sourceValue
+      sourceProfile →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release sourceProfile
+
+def LowerArgsProfilePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Ixon.Owned)}
+      {sourceProfile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsProfile sourceCtx sourceEnv (args.map Prod.fst) sourceValues
+      sourceProfile →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+      sourceProfile
+
+def ApplyRestNonErasedProfilePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {functionProfile argsProfile applyProfile : SourceProfile}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    args ≠ [] →
+    SourceArgsProfile sourceCtx sourceMiddle args sourceArgs argsProfile →
+    SourceAppliesProfile sourceCtx sourceFunction sourceArgs sourceResult
+      applyProfile →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction function
+      functionProfile →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+      (functionProfile + argsProfile + applyProfile)
+
+def LowerSpineProfilePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Ixon.Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {profile : SourceProfile} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    args ≠ [] →
+    SourceSpineProfile sourceCtx sourceEnv head args sourceResult profile →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile
+
+theorem lowerEProfilePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerEProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue
+    sourceProfile state finalState emit av _ hrun _ _
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowProfilePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerBorrowProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue sourceProfile
+    state finalState emit av release _ hrun _ _
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerArgsProfilePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs _ hrun _ _
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem applyRestNonErasedProfilePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    _ _ _ _ _ hrun _ _
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction function
+    args hrun).elim
+
+theorem lowerSpineProfilePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerSpineProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output world head args sourceEnv sourceResult profile state
+    finalState emit av _ _ hrun _ _
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpineProfilePreservesWithin_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerSpineProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 1 := by
+  intro input output world head args sourceEnv sourceResult profile state
+    finalState emit av _ _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+/-- Reachable-state exact-profile argument sequencing. The successful tail
+run places the head's intermediate state inside the ambient state, while
+synthetic-self availability is transported through the head run. -/
+theorem lowerArgsProfilePreservesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (htail : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel) :
+    LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs hsource hrun hextends havailable
+  exact (lowerArgs_run_profile_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals actualProfile actualState =>
+      ExtraExtends actualState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerArgsProfileSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv actualSourceValues worlds actualEmit actualAVals
+        actualProfile)
+    (hnil := by
+      intro _ _
+      exact lowerArgs_nil_profile_sound)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead
+        hsourceTail hheadRun htailRun hwithin hself
+      have hmiddleExtends :=
+        (lowerArgs_extraExtends htailRun).trans hwithin
+      have hheadSound :=
+        hexpr hsourceHead hheadRun hmiddleExtends hself
+      have htailSound := htail hsourceTail htailRun hwithin
+        (hself.lowerE hheadRun)
+      exact hheadSound.consArgs htailSound)
+    hsource hrun) hextends havailable
+
+/-- Reachable-state dynamic application uses the argument traversal ending
+at the same lowering state, then discharges the paired semantic, ownership,
+and exact-profile application contracts. -/
+theorem applyRestNonErasedProfilePreservesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    hfunctionNe hargsNonempty hsourceArgs hsource hfunction hrun hextends
+    havailable
+  exact (applyRest_nonErased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerResultProfileSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle sourceResult actualWorld actualEmit actualAv
+        (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired
+        hsourceNonempty hargsRun hworldsHomogeneous hwithin hself => by
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsProfileSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hcost
+          hsource hsourceNonempty)
+    hfunctionNe hargsNonempty hsourceArgs hrun) hextends havailable
+
+/-- Reachable-state erased application retains exact strict-argument costs
+while transporting both the ambient-state suffix and self availability to
+the argument traversal. -/
+theorem applyRest_erased_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (_hsource : SourceAppliesProfile sourceCtx .erased sourceArgs .erased
+      applyProfile)
+    (hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased) functionProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av
+      (functionProfile + argsProfile + applyProfile) := by
+  exact (applyRest_erased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerResultProfileSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle .erased actualWorld actualEmit actualAv
+        (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength hwithin hself => by
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsProfileSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs (applyProfile := applyProfile) hhomogeneous
+          hsourceLength)
+    hsourceArgs hrun) hextends havailable
+
+/-- Reachable-state profiled erased-head spine. -/
+theorem lowerSpine_erased_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv .erased args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_erased_run_profile_core
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hfinish := by
+      intro argumentValues argumentProfile applyProfile harguments happlies
+        hrestRun
+      have hfunction : LowerResultProfileSound funRel recSelfRel ctx cur
+        input input sourceEnv sourceEnv .erased .shared
+        (_root_.id : Emit) (.constA .erased)
+        (IxIR0.DynamicCost.tick .evalErased) := by
+        apply scalar_id_profile_sound (profile :=
+          IxIR0.DynamicCost.tick .evalErased) .erased
+        · intro env
+          rfl
+        · rfl
+        · intro store
+          exact .erased
+      exact applyRest_erased_run_profile_sound_within hargs harguments
+        happlies hfunction hrestRun hextends havailable)
+    hsource hrun
+
+/-- Reachable-state profiled dynamic-head spine. The tail run witnesses that
+the head's intermediate lowering state is represented by the ambient state. -/
+theorem lowerSpine_dynamic_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact (lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function middleState =>
+      ExtraExtends middleState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+        (LowerResultProfileSound funRel recSelfRel ctx cur input
+            functionOutput sourceEnv sourceEnv sourceFunction .shared
+            emitFunction function headProfile ∧
+          SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+            functionOutput))
+    (Result := fun actualResult actualProfile =>
+      ExtraExtends finalState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ hfunctionExtends hself =>
+      ⟨hexpr hhead hfunctionRun hfunctionExtends hself,
+        hself.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hheadData hrestRun
+        hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact applyRest_erased_run_profile_sound_within hargs hsourceArgs
+        hsourceApply hfunctionSound hrestRun hwithin hfunctionAvailable)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply hheadData
+        hrestRun hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply
+        hfunctionSound hrestRun hwithin hfunctionAvailable)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)) hextends havailable
+
+/-- Reachable-state profiled ordinary-variable spine. -/
+theorem lowerSpine_var_dynamic_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact (lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function middleState =>
+      ExtraExtends middleState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+        (LowerResultProfileSound funRel recSelfRel ctx cur input
+            functionOutput sourceEnv sourceEnv sourceFunction .shared
+            emitFunction function headProfile ∧
+          SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+            functionOutput))
+    (Result := fun actualResult actualProfile =>
+      ExtraExtends finalState ambient →
+      SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerResultProfileSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ hfunctionExtends hself =>
+      ⟨hexpr hhead hfunctionRun hfunctionExtends hself,
+        hself.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hheadData hrestRun
+        hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact applyRest_erased_run_profile_sound_within hargs hsourceArgs
+        hsourceApply hfunctionSound hrestRun hwithin hfunctionAvailable)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply hheadData
+        hrestRun hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply
+        hfunctionSound hrestRun hwithin hfunctionAvailable)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)) hextends
+      havailable
+
+/-- Reachable-state profiled `knownCall`. Prefix argument lowering is placed
+inside the ambient compiler state by either the terminal equality or the
+excess-tail `applyRest` run. -/
+theorem lowerEProfilePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerEProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur limit src
+      ambient 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue
+    sourceProfile state finalState emit av _ hrun _ _
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowProfilePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerBorrowProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue sourceProfile
+    state finalState emit av release _ hrun _ _
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerArgsProfilePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur limit src
+      ambient 0 := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs _ hrun _ _
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem applyRestNonErasedProfilePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    _ _ _ _ _ hrun _ _
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction function
+    args hrun).elim
+
+theorem lowerSpineProfilePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerSpineProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur limit src
+      ambient 0 := by
+  intro input output world head args sourceEnv sourceResult profile state
+    finalState emit av _ _ hrun _ _
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpineProfilePreservesWithinBelow_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerSpineProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur limit src
+      ambient 1 := by
+  intro input output world head args sourceEnv sourceResult profile state
+    finalState emit av _ _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+/-- Reachable-state exact-profile argument sequencing. The successful tail
+run places the head's intermediate state inside the ambient state, while
+synthetic-self availability is transported through the head run. -/
+theorem lowerArgsProfilePreservesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (htail : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel) :
+    LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur limit src
+      ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args sourceProfile state
+    finalState emit avs hsource hrun hextends havailable
+  exact (lowerArgs_run_profile_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals actualProfile actualState =>
+      ExtraExtends actualState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+        input →
+      LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv actualSourceValues worlds actualEmit
+        actualAVals actualProfile)
+    (hnil := by
+      intro _ _
+      exact lowerArgs_nil_profile_sound_below)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead
+        hsourceTail hheadRun htailRun hwithin hself
+      have hmiddleExtends :=
+        (lowerArgs_extraExtends htailRun).trans hwithin
+      have hheadSound :=
+        hexpr hsourceHead hheadRun hmiddleExtends hself
+      have htailSound := htail hsourceTail htailRun hwithin
+        (hself.lowerE hheadRun)
+      exact hheadSound.consArgs htailSound)
+    hsource hrun) hextends havailable
+
+/-- Reachable-state dynamic application uses the argument traversal ending
+at the same lowering state, then discharges the paired semantic, ownership,
+and exact-profile application contracts. -/
+theorem applyRestNonErasedProfilePreservesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hownership : Sim.ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hcost : ApplyProfileContractBelow funRel sourceCtx ctx limit) :
+    ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args functionProfile argsProfile applyProfile state finalState
+    hfunctionNe hargsNonempty hsourceArgs hsource hfunction hrun hextends
+    havailable
+  exact (applyRest_nonErased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+        input →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle sourceResult actualWorld
+        actualEmit actualAv (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired
+        hsourceNonempty hargsRun hworldsHomogeneous hwithin hself => by
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsProfileSoundBelow funRel recSelfRel ctx
+          cur limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hcost
+          hsource hsourceNonempty)
+    hfunctionNe hargsNonempty hsourceArgs hrun) hextends havailable
+
+/-- Reachable-state erased application retains exact strict-argument costs
+while transporting both the ambient-state suffix and self availability to
+the argument traversal. -/
+theorem applyRest_erased_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Ixon.Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {functionProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceMiddle args sourceArgs
+      argsProfile)
+    (_hsource : SourceAppliesProfile sourceCtx .erased sourceArgs .erased
+      applyProfile)
+    (hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased) functionProfile)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle .erased resultWorld emit av
+      (functionProfile + argsProfile + applyProfile) := by
+  exact (applyRest_erased_run_profile_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+        input →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle .erased actualWorld actualEmit
+        actualAv (functionProfile + argsProfile + applyProfile))
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength hwithin hself => by
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsProfileSoundBelow funRel recSelfRel ctx
+          cur limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs argsProfile := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs (applyProfile := applyProfile) hhomogeneous
+          hsourceLength)
+    hsourceArgs hrun) hextends havailable
+
+/-- Reachable-state profiled erased-head spine. -/
+theorem lowerSpine_erased_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv .erased args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_erased_run_profile_core
+    (Result := fun actualResult actualProfile =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hfinish := by
+      intro argumentValues argumentProfile applyProfile harguments happlies
+        hrestRun
+      have hfunction : LowerResultProfileSoundBelow funRel recSelfRel ctx cur
+          limit
+        input input sourceEnv sourceEnv .erased .shared
+        (_root_.id : Emit) (.constA .erased)
+        (IxIR0.DynamicCost.tick .evalErased) := by
+        apply scalar_id_profile_sound_below (limit := limit) (profile :=
+          IxIR0.DynamicCost.tick .evalErased) .erased
+        · intro env
+          rfl
+        · rfl
+        · intro store
+          exact .erased
+      exact applyRest_erased_run_profile_sound_within_below hargs harguments
+        happlies hfunction hrestRun hextends havailable)
+    hsource hrun
+
+/-- Reachable-state profiled dynamic-head spine. The tail run witnesses that
+the head's intermediate lowering state is represented by the ambient state. -/
+theorem lowerSpine_dynamic_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact (lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function middleState =>
+      ExtraExtends middleState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+        (LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+            functionOutput sourceEnv sourceEnv sourceFunction .shared
+            emitFunction function headProfile ∧
+          SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+            functionOutput))
+    (Result := fun actualResult actualProfile =>
+      ExtraExtends finalState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ hfunctionExtends hself =>
+      ⟨hexpr hhead hfunctionRun hfunctionExtends hself,
+        hself.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hheadData hrestRun
+        hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact applyRest_erased_run_profile_sound_within_below hargs hsourceArgs
+        hsourceApply hfunctionSound hrestRun hwithin hfunctionAvailable)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply hheadData
+        hrestRun hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply
+        hfunctionSound hrestRun hwithin hfunctionAvailable)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)) hextends havailable
+
+/-- Reachable-state profiled ordinary-variable spine. -/
+theorem lowerSpine_var_dynamic_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact (lowerSpine_apply_run_profile_core
+    (HeadSound := fun sourceFunction headProfile functionOutput
+        emitFunction function middleState =>
+      ExtraExtends middleState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+        (LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+            functionOutput sourceEnv sourceEnv sourceFunction .shared
+            emitFunction function headProfile ∧
+          SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+            functionOutput))
+    (Result := fun actualResult actualProfile =>
+      ExtraExtends finalState ambient →
+      SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av actualProfile)
+    (hheadSound := fun hhead hfunctionRun _ hfunctionExtends hself =>
+      ⟨hexpr hhead hfunctionRun hfunctionExtends hself,
+        hself.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := fun hsourceArgs hsourceApply hheadData hrestRun
+        hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact applyRest_erased_run_profile_sound_within_below hargs hsourceArgs
+        hsourceApply hfunctionSound hrestRun hwithin hfunctionAvailable)
+    (hnonErasedFinish := fun hfunctionNe hsourceArgs hsourceApply hheadData
+        hrestRun hwithin hself => by
+      obtain ⟨hfunctionSound, hfunctionAvailable⟩ :=
+        hheadData ((applyRest_extraExtends hrestRun).trans hwithin) hself
+      exact hrest hfunctionNe hargsNonempty hsourceArgs hsourceApply
+        hfunctionSound hrestRun hwithin hfunctionAvailable)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)) hextends
+      havailable
+
+/-- Reachable-state profiled `knownCall`. Prefix argument lowering is placed
+inside the ambient compiler state by either the terminal equality or the
+excess-tail `applyRest` run. -/
+
+theorem knownCall_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Ixon.Owned}
+    {resultWorld buildWorld : Ixon.Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value}
+        {prefixArgsProfile prefixApplyProfile : SourceProfile},
+      LowerArgsProfileSound funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals prefixArgsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceValues.take count) sourceBuilt prefixApplyProfile →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultProfileSound funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_core
+    (Reach := fun actualState => ExtraExtends actualState ambient)
+    (Result := fun actualOutput actualEmit actualAV _ =>
+      LowerResultProfileSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv sourceResult resultWorld actualEmit actualAV
+        (headProfile + argsProfile + applyProfile))
+    ?_ ?_ ?_ hextends hsourceArgs hsource hrun
+  · intro _ _ _ _ hafterPrefix hfinalExtends
+    exact (applyRest_extraExtends hafterPrefix).trans hfinalExtends
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile _ hle hprefixSource hprefixApply
+      hprefixRun hprefixLength hsourceBuiltEq hprefixArgsEq hprefixApplyEq
+      hprefixExtends
+    cases hsourceBuiltEq
+    have hprefixSound :=
+      hargs hprefixSource hprefixRun hprefixExtends havailable
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    simpa [hterminalWorld hle, hprefixArgsEq, hprefixApplyEq] using hbuilt
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile tailArgsProfile prefixApplyProfile tailApplyProfile
+      _ hover _ htailArgs hprefixApply htailApply hargsProfile happlyProfile
+      hprefixRun hprefixLength hafterPrefix hprefixExtends hfinalExtends
+    have hprefixSound :=
+      hargs (by assumption) hprefixRun hprefixExtends havailable
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    have hbuiltShared : LowerResultProfileSound funRel recSelfRel ctx cur
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile) := by
+      simpa [hoverWorld hover] using hbuilt
+    have htailSound := hrest (by simp) (drop_nonempty_of_lt_length hover)
+      htailArgs htailApply hbuiltShared hafterPrefix hfinalExtends
+      (havailable.lowerArgs hprefixRun).bump
+    apply LowerResultProfileSound.of_profile_eq htailSound
+    rw [← hargsProfile, ← happlyProfile]
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Reachable-state direct-call specialization of profiled `knownCall`. -/
+theorem knownCall_call_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+    {f : Ixon.Address} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hcost : FnProfileContract funRel sourceCtx ctx f d argWorlds sourceFunction)
+    (hhead : SourceRefProfile sourceCtx f sourceFunction headProfile)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph_from_ref hdecl hownership hvalue hcost hhead
+    hprefixApply
+
+/-- Reachable-state constructor-allocation specialization. -/
+theorem knownCall_alloc_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {world : Ixon.Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+      change 0 < headProfile.evals + prefixApplyProfile.evals
+      omega
+    have hallocated := hprefix.alloc_graph_of_evals_pos haddress htag hopPos
+    rw [hprefixApply.toSourceApplies.deterministic hctor]
+    apply LowerResultProfileSound.of_profile_eq hallocated
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Reachable-state scalar-extern specialization. -/
+theorem knownCall_extern_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {input output : VEnv}
+    {resultWorld : Ixon.Owned} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    have hextern := hprefix.extern_graph (resultWorld := resultWorld)
+      hcontract hlookup href htakeLength hprefixApply
+    apply LowerResultProfileSound.of_profile_eq
+      (hextern.addProfileLeft headProfile)
+    exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Reachable-state partial-application specialization. -/
+theorem knownCall_papp_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {d : Decl} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared) emitPrefix prefixAVals
+      prefixArgsProfile := by
+    simpa only [hshape, havsLength] using hprefixSound
+  have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+    change 0 < headProfile.evals + prefixApplyProfile.evals
+    omega
+  have hpapp := hprefix.papp_graph_of_evals_pos hdecl
+    (hfun hprefixApply.toSourceApplies) (by simpa [havsLength] using hunder)
+    hopPos
+  apply LowerResultProfileSound.of_profile_eq hpapp
+  ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Reachable-state same-address static PAP allocation. -/
+theorem knownCall_papp_source_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound_within hargs hrest hcount hdecl
+    hunder hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Reachable-state constructor-wrapper PAP allocation. -/
+theorem knownCall_papp_wrapper_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound_within hargs hrest hcount hdecl
+    hunder hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- A malformed recursive-self arity cannot execute its emitted call. The
+argument prefix keeps its exact profile and the unreachable operation may be
+assigned the remaining source fragments vacuously. -/
+theorem LowerArgsProfileSound.callSelf_arity_mismatch_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {worlds : List Ixon.Owned}
+    {emit : Emit} {avs : List AVal}
+    {argsProfile headProfile applyProfile : SourceProfile}
+    (hargs : LowerArgsProfileSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs argsProfile)
+    (harity : avs.length ≠ cur.arity) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth)
+      (headProfile + argsProfile + applyProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_arity_mismatch_graph harity
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hcall : ProfileFundedEmitStateRunSound ctx cur
+      (emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceValue cur.result (.slotA output.depth) sourceRest rest slots)
+      (headProfile + applyProfile) := by
+    apply ProfileFundedEmitStateRunSound.ofOp
+    intro fuel before after env value horder henv hpre hrun
+    obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+        rw [runOp.eq_def] at hrun
+        dsimp only at hrun
+        rw [havs.resolveAtoms] at hrun
+        have hvaluesLength : values.length = avs.length :=
+          havs.lengths.2.symm
+        have hne : values.length ≠ cur.arity := by
+          intro heq
+          exact harity (hvaluesLength.symm.trans heq)
+        change (if (values.length != cur.arity) = true then
+            .error (.stuck "callSelf arity mismatch")
+          else
+            (do
+              let out ← runCode ctx fuel cur before values.reverse cur.body
+              checkResultWorld cur.result out)) =
+            .ok (after, value) at hrun
+        have hbne : (values.length != cur.arity) = true := by
+          simp [hne]
+        rw [if_pos hbne] at hrun
+        contradiction
+  have hall : ProfileFundedEmitStateRunSound ctx cur
+      (emit ∘ emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceValue cur.result (.slotA output.depth) sourceRest rest slots)
+      (argsProfile + (headProfile + applyProfile)) :=
+    ProfileFundedEmitStateRunSound.comp
+      (hargs.profileEmits sourceRest rest slots) hcall
+  apply ProfileFundedEmitStateRunSound.of_profile_eq hall
+  ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Reachable-state profiled recursive-self spine. Matching arities select
+the current function's paired contracts; malformed arities use the stuck-call
+profile lemma above. -/
+theorem lowerSpine_recSelf_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfProfileContract funRel recSelfRel sourceCtx ctx cur)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues headProfile argsProfile applyProfile
+      hhead hsourceArgs hsourceApply hprofile
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead.run
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+          have hrequire :
+              (requireResultWorld .shared .unique).run state =
+                .error "call result is shared at unique demand" state := by
+            rfl
+          rw [stateBindRun, hrequire] at hrun
+          contradiction
+      | shared =>
+          have hrequire :
+              (requireResultWorld .shared .shared).run state =
+                .ok () state := by
+            rfl
+          rw [stateBindRun, hrequire] at hrun
+          simp only at hrun
+          have hknownSound : LowerResultProfileSound funRel recSelfRel ctx
+              cur input output sourceEnv sourceEnv sourceResult .shared emit
+              av (headProfile + argsProfile + applyProfile) := by
+            refine knownCall_run_profile_sound_within
+              (build := .callSelf) (count := arity)
+              (argWorlds := List.replicate arity .shared)
+              (resultWorld := .shared) (buildWorld := cur.result)
+              hargs hrest hsourceArgs hsourceApply ?_
+              (fun _ => by simpa [hself.result])
+              (fun _ => by simpa [hself.result]) hrun hextends havailable
+            intro prefixOutput emitPrefix prefixAVals sourceBuilt
+              prefixArgsProfile prefixApplyProfile hprefixSound
+              hprefixApply hprefixLength
+            have hshape := knownCall_prefix_worlds_eq args
+              (List.replicate arity .shared) arity (by simp) hcount
+            have hzipLength := knownCall_prefix_length_eq args
+              (List.replicate arity .shared) arity (by simp) hcount
+            have havsLength : prefixAVals.length = arity :=
+              hprefixLength.trans hzipLength
+            have hprefix : LowerArgsProfileSound funRel recSelfRel ctx cur
+                input prefixOutput sourceEnv sourceEnv
+                (sourceValues.take arity) (List.replicate arity .shared)
+                emitPrefix prefixAVals prefixArgsProfile := by
+              simpa only [hshape] using hprefixSound
+            by_cases harity : arity = cur.arity
+            · have hownership : Sim.FnOwnershipContract ctx cur
+                  (List.replicate arity .shared) := by
+                simpa [harity] using hself.ownership
+              have hvalue : recSelfRel sourceFunction arity →
+                  FnValueContract funRel sourceCtx ctx cur
+                    (List.replicate arity .shared) sourceFunction := by
+                intro hrel
+                simpa [harity] using
+                  hself.value (by simpa [harity] using hrel)
+              have hcost : recSelfRel sourceFunction arity →
+                  ∃ sourceAddress,
+                    FnProfileContract funRel sourceCtx ctx sourceAddress cur
+                      (List.replicate arity .shared) sourceFunction := by
+                intro hrel
+                simpa [harity] using
+                  hself.profile (by simpa [harity] using hrel)
+              have hsourceCount : arity ≤ sourceValues.length := by
+                simpa [← hsourceArgs.lengths] using hcount
+              have htakeLength : (sourceValues.take arity).length = arity := by
+                simp [List.length_take, hsourceCount]
+              have hnonempty : sourceValues.take arity ≠ [] := by
+                intro hempty
+                rw [hempty] at htakeLength
+                simp at htakeLength
+                have : 0 < arity := by simpa [harity] using hself.positive
+                omega
+              have hbuilt := hprefix.callSelf_entry_graph hentry
+                hsourceHead hownership hvalue hcost hprefixApply hnonempty
+              apply LowerResultProfileSound.of_profile_eq
+                (hbuilt.addProfileLeft headProfile)
+              exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+            · have hmismatch : prefixAVals.length ≠ cur.arity := by
+                intro heq
+                exact harity (havsLength.symm.trans heq)
+              simpa [hself.result] using
+                hprefix.callSelf_arity_mismatch_graph
+                  (sourceValue := sourceBuilt)
+                  (headProfile := headProfile)
+                  (applyProfile := prefixApplyProfile) hmismatch
+          exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state saturated/over-applied definition reference. -/
+theorem lowerSpine_ref_defn_call_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx f d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound_within hargs hrest (by simp)
+      hcount hdecl hownership hvalue hcost hrefProfile hsourceArgs
+      hsourceApply ?_ ?_
+      hknownRun hextends havailable
+    · intro hterminal
+      have heq : args.length = lamArity body :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro hover
+      have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+      simpa [hresult, hne] using hguard
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied definition reference. -/
+theorem lowerSpine_ref_defn_partial_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      cases result with
+      | unique =>
+          exact (stateThrowRun_not_ok
+            (by simpa [hsuEq, huuEq] using hrun)).elim
+      | shared =>
+          cases hp : papSafe body with
+          | false =>
+              exact (stateThrowRun_not_ok
+                (by simpa [hsuEq, hp] using hrun)).elim
+          | true =>
+              have hknown :
+                  (knownCall src (fuel + 1) input (.papp f ·) args.length
+                    (List.replicate args.length .shared) .shared args).run
+                    state = .ok (output, emit, av) finalState := by
+                simpa [hsuEq, hp] using hrun
+              have hknownSound : LowerResultProfileSound
+                  (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+                  cur input output sourceEnv sourceEnv sourceResult .shared
+                  emit av (headProfile + argsProfile + applyProfile) := by
+                apply knownCall_papp_source_run_profile_sound_within hargs
+                  hrest (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+                  (by simpa [sourceDeclArity, declArity] using harity.symm)
+                  href hdecl
+                  (by simpa [declArity, harity] using hunder)
+                  hheadPos hsourceArgs hsourceApply hknown hextends
+                  havailable
+              exact LowerResultProfileSound.of_profile_eq hknownSound
+                hprofile
+
+/-- Reachable-state saturated/over-applied recursor reference. -/
+theorem lowerSpine_ref_recursor_call_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx f d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound_within hargs hrest (by simp)
+      hcount hdecl hownership hvalue hcost hrefProfile hsourceArgs
+      hsourceApply ?_ ?_
+      hknownRun hextends havailable
+    · intro hterminal
+      have heq : args.length = numArgs + 1 :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro _
+      simpa [hresult] using hguard
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied recursor reference. -/
+theorem lowerSpine_ref_recursor_partial_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      have hknown :
+          (knownCall src (fuel + 1) input (.papp f ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [hsuEq] using hrun
+      have hknownSound : LowerResultProfileSound
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+          input output sourceEnv sourceEnv sourceResult .shared emit av
+          (headProfile + argsProfile + applyProfile) := by
+        apply knownCall_papp_source_run_profile_sound_within hargs hrest
+          (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hheadPos hsourceArgs hsourceApply hknown hextends havailable
+      exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state saturated/over-applied constructor reference. -/
+theorem lowerSpine_ref_ctor_alloc_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_alloc_run_profile_sound_within hargs hrest hcount rfl rfl
+      hheadPos hsourceArgs hsourceApply hctor hknown hextends havailable
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied constructor reference through its memoized
+eta wrapper. -/
+theorem lowerSpine_ref_ctor_partial_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      have hrun' :
+          ((wrapperFor f tag arity) >>= fun wrapper =>
+            knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [hsuEq] using hrun
+      obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+        stateBindRun_ok_inv hrun'
+      let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+      have hmemoFinal : memo ∈ finalState.wrappers :=
+        (hknownExtra input (.papp wrapper ·) args.length
+          (List.replicate args.length .shared) .shared args
+          hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+      have hmemo : memo ∈ ambient.wrappers :=
+        hextends.wrapper_mem hmemoFinal
+      have hdecl := hrepresented.wrapper hmemo
+      have hknownSound : LowerResultProfileSound
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+          input output sourceEnv sourceEnv sourceResult .shared emit av
+          (headProfile + argsProfile + applyProfile) := by
+        apply knownCall_papp_wrapper_run_profile_sound_within hargs hrest
+          (Nat.le_refl _) hmemo hsrc href hdecl
+          (by simp [memo, ctorWrapperDecl, declArity])
+          (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+          hheadPos hsourceArgs hsourceApply hknownRun hextends havailable
+      exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state saturated/over-applied extern reference. -/
+theorem lowerSpine_ref_extern_call_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, _⟩ :=
+    hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_extern_run_profile_sound_within hargs hrest hcontract hcount
+      hlookup href hsourceArgs hsourceApply hknown hextends havailable
+  exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied extern reference. -/
+theorem lowerSpine_ref_extern_partial_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      have hknown :
+          (knownCall src (fuel + 1) input (.papp f ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [hsuEq] using hrun
+      have hknownSound : LowerResultProfileSound
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+          input output sourceEnv sourceEnv sourceResult .shared emit av
+          (headProfile + argsProfile + applyProfile) := by
+        apply knownCall_papp_source_run_profile_sound_within hargs hrest
+          (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href
+          hdecl (by simpa [declArity] using hunder) hheadPos hsourceArgs
+          hsourceApply hknown hextends havailable
+      exact LowerResultProfileSound.of_profile_eq hknownSound hprofile
+
+/-- Complete reachable-state profiled static-reference dispatch. -/
+theorem lowerSpine_ref_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_profile_sound_within
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_profile_sound_within
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun hextends havailable)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_profile_sound_within
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented havailable)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_profile_sound_within
+        hargs hrest hlookup hsrc hcount hsource hrun hextends havailable)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_profile_sound_within
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_profile_sound_within
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun hextends havailable)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_profile_sound_within
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_profile_sound_within
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun hextends
+        havailable)
+    hrun
+
+/-- One complete reachable-state exact-profile spine step. Every recursive
+run is justified against the enclosing whole-pass state, and synthetic-self
+contracts are requested only when the logical input exposes the marker. -/
+theorem lowerSpine_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineProfile sourceCtx sourceEnv actualHead args sourceResult
+          profile →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+        output sourceEnv sourceEnv sourceResult world emit av profile)
+    (happ := by
+      intro _ _ hsource hrun
+      apply hspine (by simp) hsource.flattenApp
+      · simpa [lowerSpine] using hrun
+      · exact hextends
+      · exact havailable)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_profile_sound_within hargs hsource hrun
+        hextends havailable)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_profile_sound_within hexpr hreflect
+        hargs hrestNext hnotSelf hargsNonempty hsource hrun hextends
+        havailable)
+    (hrecSelf := by
+      intro index arity hentry hsource hrun
+      cases havailable with
+      | inl hself =>
+        exact lowerSpine_recSelf_run_profile_sound_within hargs hrest hentry
+          hself hsource hrun hextends
+          (SelfProfileAvailable.of_contract hself)
+      | inr hno => exact (hno index arity hentry).elim)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_profile_sound_within henv hargs hrest
+        hknownExtra hcontracts hvalues hprofiles hsource hrun hextends
+        hrepresented havailable)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_profile_sound_within hexpr hreflect hargs
+        hrestNext hshape hargsNonempty hsource hrun hextends havailable)
+    hsource hrun
+
+/-! ### Target-fuel-bounded reachable known-call and spine steps -/
+
+theorem knownCall_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Ixon.Owned}
+    {resultWorld buildWorld : Ixon.Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value}
+        {prefixArgsProfile prefixApplyProfile : SourceProfile},
+      LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals prefixArgsProfile →
+      SourceAppliesProfile sourceCtx sourceFunction
+        (sourceValues.take count) sourceBuilt prefixApplyProfile →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_core
+    (Reach := fun actualState => ExtraExtends actualState ambient)
+    (Result := fun actualOutput actualEmit actualAV _ =>
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv sourceResult resultWorld actualEmit
+        actualAV (headProfile + argsProfile + applyProfile))
+    ?_ ?_ ?_ hextends hsourceArgs hsource hrun
+  · intro _ _ _ _ hafterPrefix hfinalExtends
+    exact (applyRest_extraExtends hafterPrefix).trans hfinalExtends
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile _ hle hprefixSource hprefixApply
+      hprefixRun hprefixLength hsourceBuiltEq hprefixArgsEq hprefixApplyEq
+      hprefixExtends
+    cases hsourceBuiltEq
+    have hprefixSound :=
+      hargs hprefixSource hprefixRun hprefixExtends havailable
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    simpa [hterminalWorld hle, hprefixArgsEq, hprefixApplyEq] using hbuilt
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile tailArgsProfile prefixApplyProfile tailApplyProfile
+      _ hover _ htailArgs hprefixApply htailApply hargsProfile happlyProfile
+      hprefixRun hprefixLength hafterPrefix hprefixExtends hfinalExtends
+    have hprefixSound :=
+      hargs (by assumption) hprefixRun hprefixExtends havailable
+    have hbuilt := hbuild hprefixSound hprefixApply hprefixLength
+    have hbuiltShared : LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth)
+        (headProfile + prefixArgsProfile + prefixApplyProfile) := by
+      simpa [hoverWorld hover] using hbuilt
+    have htailSound := hrest (by simp) (drop_nonempty_of_lt_length hover)
+      htailArgs htailApply hbuiltShared hafterPrefix hfinalExtends
+      (havailable.lowerArgs hprefixRun).bump
+    apply LowerResultProfileSoundBelow.of_profile_eq htailSound
+    rw [← hargsProfile, ← happlyProfile]
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Reachable-state direct-call specialization of profiled `knownCall`. -/
+theorem knownCall_call_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+    {f : Ixon.Address} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : Sim.FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hcost : FnProfileContractBelow funRel sourceCtx ctx f d argWorlds
+      sourceFunction limit)
+    (hhead : SourceRefProfile sourceCtx f sourceFunction headProfile)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within_below hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals prefixArgsProfile := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph_from_ref hdecl hownership hvalue hcost hhead
+    hprefixApply
+
+/-- Reachable-state constructor-allocation specialization. -/
+theorem knownCall_alloc_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {world : Ixon.Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+      change 0 < headProfile.evals + prefixApplyProfile.evals
+      omega
+    have hallocated := hprefix.alloc_graph_of_evals_pos haddress htag hopPos
+    rw [hprefixApply.toSourceApplies.deterministic hctor]
+    apply LowerResultProfileSoundBelow.of_profile_eq hallocated
+    ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Reachable-state scalar-extern specialization. -/
+theorem knownCall_extern_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {input output : VEnv}
+    {resultWorld : Ixon.Owned} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt
+      prefixArgsProfile prefixApplyProfile hprefixSound hprefixApply
+      hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals prefixArgsProfile := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    have hextern := hprefix.extern_graph (resultWorld := resultWorld)
+      hcontract hlookup href htakeLength hprefixApply
+    apply LowerResultProfileSoundBelow.of_profile_eq
+      (hextern.addProfileLeft headProfile)
+    exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Reachable-state partial-application specialization. -/
+theorem knownCall_papp_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {d : Decl} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  refine knownCall_run_profile_sound_within_below hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt prefixArgsProfile
+    prefixApplyProfile hprefixSound hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared) emitPrefix prefixAVals
+      prefixArgsProfile := by
+    simpa only [hshape, havsLength] using hprefixSound
+  have hopPos : 0 < (headProfile + prefixApplyProfile).evals := by
+    change 0 < headProfile.evals + prefixApplyProfile.evals
+    omega
+  have hpapp := hprefix.papp_graph_of_evals_pos hdecl
+    (hfun hprefixApply.toSourceApplies) (by simpa [havsLength] using hunder)
+    hopPos
+  apply LowerResultProfileSoundBelow.of_profile_eq hpapp
+  ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Reachable-state same-address static PAP allocation. -/
+theorem knownCall_papp_source_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound_within_below hargs hrest hcount hdecl
+    hunder hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Reachable-state constructor-wrapper PAP allocation. -/
+theorem knownCall_papp_wrapper_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {headProfile argsProfile applyProfile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hheadPos : 0 < headProfile.evals)
+    (hsourceArgs : SourceArgsProfile sourceCtx sourceEnv args sourceValues
+      argsProfile)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceValues
+      sourceResult applyProfile)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult .shared emit av
+      (headProfile + argsProfile + applyProfile) := by
+  apply knownCall_papp_run_profile_sound_within_below hargs hrest hcount hdecl
+    hunder hheadPos hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- A malformed recursive-self arity cannot execute its emitted call. The
+argument prefix keeps its exact profile and the unreachable operation may be
+assigned the remaining source fragments vacuously. -/
+theorem LowerArgsProfileSoundBelow.callSelf_arity_mismatch_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {worlds : List Ixon.Owned}
+    {emit : Emit} {avs : List AVal}
+    {argsProfile headProfile applyProfile : SourceProfile}
+    (hargs : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValues worlds emit avs argsProfile)
+    (harity : avs.length ≠ cur.arity) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output.bump
+      sourceInput sourceOutput sourceValue cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth)
+      (headProfile + argsProfile + applyProfile) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_arity_mismatch_graph harity
+      profileEmits := ?_ }
+  intro sourceRest rest slots
+  have hcall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceValue cur.result (.slotA output.depth) sourceRest rest slots)
+      (headProfile + applyProfile) := by
+    apply ProfileFundedEmitStateRunSoundBelow.ofOp
+    intro fuel before after env value _ horder henv hpre hrun
+    obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+        rw [runOp.eq_def] at hrun
+        dsimp only at hrun
+        rw [havs.resolveAtoms] at hrun
+        have hvaluesLength : values.length = avs.length :=
+          havs.lengths.2.symm
+        have hne : values.length ≠ cur.arity := by
+          intro heq
+          exact harity (hvaluesLength.symm.trans heq)
+        change (if (values.length != cur.arity) = true then
+            .error (.stuck "callSelf arity mismatch")
+          else
+            (do
+              let out ← runCode ctx fuel cur before values.reverse cur.body
+              checkResultWorld cur.result out)) =
+            .ok (after, value) at hrun
+        have hbne : (values.length != cur.arity) = true := by
+          simp [hne]
+        rw [if_pos hbne] at hrun
+        contradiction
+  have hall : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emit ∘ emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceValue cur.result (.slotA output.depth) sourceRest rest slots)
+      (argsProfile + (headProfile + applyProfile)) :=
+    ProfileFundedEmitStateRunSoundBelow.comp
+      (hargs.profileEmits sourceRest rest slots) hcall
+  apply ProfileFundedEmitStateRunSoundBelow.of_profile_eq hall
+  ext <;> simp [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+
+/-- Reachable-state profiled recursive-self spine. Matching arities select
+the current function's paired contracts; malformed arities use the stuck-call
+profile lemma above. -/
+theorem lowerSpine_recSelf_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfProfileContractBelow funRel recSelfRel sourceCtx ctx cur limit)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.var index) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av profile := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues headProfile argsProfile applyProfile
+      hhead hsourceArgs hsourceApply hprofile
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead.run
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+          have hrequire :
+              (requireResultWorld .shared .unique).run state =
+                .error "call result is shared at unique demand" state := by
+            rfl
+          rw [stateBindRun, hrequire] at hrun
+          contradiction
+      | shared =>
+          have hrequire :
+              (requireResultWorld .shared .shared).run state =
+                .ok () state := by
+            rfl
+          rw [stateBindRun, hrequire] at hrun
+          simp only at hrun
+          have hknownSound : LowerResultProfileSoundBelow funRel recSelfRel ctx
+              cur limit input output sourceEnv sourceEnv sourceResult .shared emit
+              av (headProfile + argsProfile + applyProfile) := by
+            refine knownCall_run_profile_sound_within_below
+              (build := .callSelf) (count := arity)
+              (argWorlds := List.replicate arity .shared)
+              (resultWorld := .shared) (buildWorld := cur.result)
+              hargs hrest hsourceArgs hsourceApply ?_
+              (fun _ => by simpa [hself.result])
+              (fun _ => by simpa [hself.result]) hrun hextends havailable
+            intro prefixOutput emitPrefix prefixAVals sourceBuilt
+              prefixArgsProfile prefixApplyProfile hprefixSound
+              hprefixApply hprefixLength
+            have hshape := knownCall_prefix_worlds_eq args
+              (List.replicate arity .shared) arity (by simp) hcount
+            have hzipLength := knownCall_prefix_length_eq args
+              (List.replicate arity .shared) arity (by simp) hcount
+            have havsLength : prefixAVals.length = arity :=
+              hprefixLength.trans hzipLength
+            have hprefix : LowerArgsProfileSoundBelow funRel recSelfRel ctx cur limit
+                input prefixOutput sourceEnv sourceEnv
+                (sourceValues.take arity) (List.replicate arity .shared)
+                emitPrefix prefixAVals prefixArgsProfile := by
+              simpa only [hshape] using hprefixSound
+            by_cases harity : arity = cur.arity
+            · have hownership : Sim.FnOwnershipContract ctx cur
+                  (List.replicate arity .shared) := by
+                simpa [harity] using hself.ownership
+              have hvalue : recSelfRel sourceFunction arity →
+                  FnValueContract funRel sourceCtx ctx cur
+                    (List.replicate arity .shared) sourceFunction := by
+                intro hrel
+                simpa [harity] using
+                  hself.value (by simpa [harity] using hrel)
+              have hcost : recSelfRel sourceFunction arity →
+                  ∃ sourceAddress,
+                    FnProfileContractBelow funRel sourceCtx ctx sourceAddress cur
+                      (List.replicate arity .shared) sourceFunction limit := by
+                intro hrel
+                simpa [harity] using
+                  hself.profile (by simpa [harity] using hrel)
+              have hsourceCount : arity ≤ sourceValues.length := by
+                simpa [← hsourceArgs.lengths] using hcount
+              have htakeLength : (sourceValues.take arity).length = arity := by
+                simp [List.length_take, hsourceCount]
+              have hnonempty : sourceValues.take arity ≠ [] := by
+                intro hempty
+                rw [hempty] at htakeLength
+                simp at htakeLength
+                have : 0 < arity := by simpa [harity] using hself.positive
+                omega
+              have hbuilt := hprefix.callSelf_entry_graph hentry
+                hsourceHead hownership hvalue hcost hprefixApply hnonempty
+              apply LowerResultProfileSoundBelow.of_profile_eq
+                (hbuilt.addProfileLeft headProfile)
+              exact (IxIR0.DynamicCost.Profile.add_assoc _ _ _).symm
+            · have hmismatch : prefixAVals.length ≠ cur.arity := by
+                intro heq
+                exact harity (havsLength.symm.trans heq)
+              simpa [hself.result] using
+                hprefix.callSelf_arity_mismatch_graph
+                  (sourceValue := sourceBuilt)
+                  (headProfile := headProfile)
+                  (applyProfile := prefixApplyProfile) hmismatch
+          exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state saturated/over-applied definition reference. -/
+theorem lowerSpine_ref_defn_call_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx f d
+      ((lamUses body).map worldOfUses) sourceFunction limit := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound_within_below hargs hrest (by simp)
+      hcount hdecl hownership hvalue hcost hrefProfile hsourceArgs
+      hsourceApply ?_ ?_
+      hknownRun hextends havailable
+    · intro hterminal
+      have heq : args.length = lamArity body :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro hover
+      have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+      simpa [hresult, hne] using hguard
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied definition reference. -/
+theorem lowerSpine_ref_defn_partial_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Ixon.Owned}
+    {f : Ixon.Address} {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      cases result with
+      | unique =>
+          exact (stateThrowRun_not_ok
+            (by simpa [hsuEq, huuEq] using hrun)).elim
+      | shared =>
+          cases hp : papSafe body with
+          | false =>
+              exact (stateThrowRun_not_ok
+                (by simpa [hsuEq, hp] using hrun)).elim
+          | true =>
+              have hknown :
+                  (knownCall src (fuel + 1) input (.papp f ·) args.length
+                    (List.replicate args.length .shared) .shared args).run
+                    state = .ok (output, emit, av) finalState := by
+                simpa [hsuEq, hp] using hrun
+              have hknownSound : LowerResultProfileSoundBelow
+                  (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+                  cur limit input output sourceEnv sourceEnv sourceResult .shared
+                  emit av (headProfile + argsProfile + applyProfile) := by
+                apply knownCall_papp_source_run_profile_sound_within_below hargs
+                  hrest (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+                  (by simpa [sourceDeclArity, declArity] using harity.symm)
+                  href hdecl
+                  (by simpa [declArity, harity] using hunder)
+                  hheadPos hsourceArgs hsourceApply hknown hextends
+                  havailable
+              exact LowerResultProfileSoundBelow.of_profile_eq hknownSound
+                hprofile
+
+/-- Reachable-state saturated/over-applied recursor reference. -/
+theorem lowerSpine_ref_recursor_call_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : SourceDeclProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hrefProfile, hsourceArgs, hsourceApply, hprofile,
+      _⟩ := hsource.refProfileData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcost : FnProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx f d
+      (List.replicate (numArgs + 1) .shared) sourceFunction limit := by
+    apply hprofiles.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    stateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) := by
+    refine knownCall_call_run_profile_sound_within_below hargs hrest (by simp)
+      hcount hdecl hownership hvalue hcost hrefProfile hsourceArgs
+      hsourceApply ?_ ?_
+      hknownRun hextends havailable
+    · intro hterminal
+      have heq : args.length = numArgs + 1 :=
+        Nat.le_antisymm hterminal hcount
+      simpa [hresult, heq] using hguard
+    · intro _
+      simpa [hresult] using hguard
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied recursor reference. -/
+theorem lowerSpine_ref_recursor_partial_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      have hknown :
+          (knownCall src (fuel + 1) input (.papp f ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [hsuEq] using hrun
+      have hknownSound : LowerResultProfileSoundBelow
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+          input output sourceEnv sourceEnv sourceResult .shared emit av
+          (headProfile + argsProfile + applyProfile) := by
+        apply knownCall_papp_source_run_profile_sound_within_below hargs hrest
+          (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hheadPos hsourceArgs hsourceApply hknown hextends havailable
+      exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state saturated/over-applied constructor reference. -/
+theorem lowerSpine_ref_ctor_alloc_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_alloc_run_profile_sound_within_below hargs hrest hcount rfl rfl
+      hheadPos hsourceArgs hsourceApply hctor hknown hextends havailable
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied constructor reference through its memoized
+eta wrapper. -/
+theorem lowerSpine_ref_ctor_partial_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      have hrun' :
+          ((wrapperFor f tag arity) >>= fun wrapper =>
+            knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [hsuEq] using hrun
+      obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+        stateBindRun_ok_inv hrun'
+      let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+      have hmemoFinal : memo ∈ finalState.wrappers :=
+        (hknownExtra input (.papp wrapper ·) args.length
+          (List.replicate args.length .shared) .shared args
+          hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+      have hmemo : memo ∈ ambient.wrappers :=
+        hextends.wrapper_mem hmemoFinal
+      have hdecl := hrepresented.wrapper hmemo
+      have hknownSound : LowerResultProfileSoundBelow
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+          input output sourceEnv sourceEnv sourceResult .shared emit av
+          (headProfile + argsProfile + applyProfile) := by
+        apply knownCall_papp_wrapper_run_profile_sound_within_below hargs hrest
+          (Nat.le_refl _) hmemo hsrc href hdecl
+          (by simp [memo, ctorWrapperDecl, declArity])
+          (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+          hheadPos hsourceArgs hsourceApply hknownRun hextends havailable
+      exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state saturated/over-applied extern reference. -/
+theorem lowerSpine_ref_extern_call_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, _⟩ :=
+    hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  have hknownSound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av
+      (headProfile + argsProfile + applyProfile) :=
+    knownCall_extern_run_profile_sound_within_below hargs hrest hcontract hcount
+      hlookup href hsourceArgs hsourceApply hknown hextends havailable
+  exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Reachable-state under-applied extern reference. -/
+theorem lowerSpine_ref_extern_partial_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {profile : SourceProfile} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  obtain ⟨sourceFunction, sourceValues, headProfile, argsProfile,
+      applyProfile, href, hsourceArgs, hsourceApply, hprofile, hheadPos⟩ :=
+    hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+      exact (stateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+      have hknown :
+          (knownCall src (fuel + 1) input (.papp f ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [hsuEq] using hrun
+      have hknownSound : LowerResultProfileSoundBelow
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+          input output sourceEnv sourceEnv sourceResult .shared emit av
+          (headProfile + argsProfile + applyProfile) := by
+        apply knownCall_papp_source_run_profile_sound_within_below hargs hrest
+          (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href
+          hdecl (by simpa [declArity] using hunder) hheadPos hsourceArgs
+          hsourceApply hknown hextends havailable
+      exact LowerResultProfileSoundBelow.of_profile_eq hknownSound hprofile
+
+/-- Complete reachable-state profiled static-reference dispatch. -/
+theorem lowerSpine_ref_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Ixon.Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : SourceSpineProfile sourceCtx sourceEnv (.ref f) args
+      sourceResult profile)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+      input output sourceEnv sourceEnv sourceResult world emit av profile)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_profile_sound_within_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_profile_sound_within_below
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun hextends havailable)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_profile_sound_within_below
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented havailable)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_profile_sound_within_below
+        hargs hrest hlookup hsrc hcount hsource hrun hextends havailable)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_profile_sound_within_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_profile_sound_within_below
+        hargs hrest hcontracts.decls hvalues.decls hprofiles.decls hsrc
+        hcount hsource hrun hextends havailable)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_profile_sound_within_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_profile_sound_within_below
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun hextends
+        havailable)
+    hrun
+
+/-- One complete reachable-state exact-profile spine step. Every recursive
+run is justified against the enclosing whole-pass state, and synthetic-self
+contracts are requested only when the logical input exposes the marker. -/
+theorem lowerSpine_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hexpr : LowerEProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrestNext : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Ixon.Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hargsNonempty : args ≠ [])
+    (hsource : SourceSpineProfile sourceCtx sourceEnv head args sourceResult
+      profile)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceResult world emit av profile := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineProfile sourceCtx sourceEnv actualHead args sourceResult
+          profile →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv sourceResult world emit av profile)
+    (happ := by
+      intro _ _ hsource hrun
+      apply hspine (by simp) hsource.flattenApp
+      · simpa [lowerSpine] using hrun
+      · exact hextends
+      · exact havailable)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_profile_sound_within_below hargs hsource
+        hrun hextends havailable)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_profile_sound_within_below hexpr
+        hreflect hargs hrestNext hnotSelf hargsNonempty hsource hrun hextends
+        havailable)
+    (hrecSelf := by
+      intro index arity hentry hsource hrun
+      cases havailable with
+      | inl hself =>
+        exact lowerSpine_recSelf_run_profile_sound_within_below hargs hrest
+          hentry hself hsource hrun hextends
+          (SelfProfileAvailableBelow.of_contract hself)
+      | inr hno => exact (hno index arity hentry).elim)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_profile_sound_within_below henv hargs hrest
+        hknownExtra hcontracts hvalues hprofiles hsource hrun hextends
+        hrepresented havailable)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_profile_sound_within_below hexpr hreflect
+        hargs hrestNext hshape hargsNonempty hsource hrun hextends havailable)
+    hsource hrun
+
+
+/-- Reachable-state exact-profile let sequencing. The body suffix transports
+the earlier bound-value run, and the explicit no-self map rebuilds current
+self availability for the installed binder environment. -/
+theorem lowerE_let_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {valueFuel bodyFuel : Nat} {boundSource sourceValue : IxIR0.Value}
+    {valueProfile bodyProfile : SourceProfile}
+    (hvalueSource : IxIR0.DynamicCost.Eval sourceCtx valueFuel sourceEnv
+      value boundSource valueProfile)
+    (hbodySource : IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+      (boundSource :: sourceEnv) body sourceValue bodyProfile)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (valueProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) := by
+  apply lowerE_let_run_profile_sound
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- Reachable-state exact-profile projection. Its borrow subrun ends in the
+same compiler state as the pure fetch/retain/drop suffix. -/
+theorem lowerE_proj_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hborrow : LowerBorrowProfilePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceTarget sourceValue : IxIR0.Value}
+    {sourceProfile : SourceProfile}
+    (htarget : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv source
+      sourceTarget sourceProfile)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  cases world with
+  | unique =>
+      have huuEq :
+          (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+      simp only [lowerE, huuEq, if_true] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+  | shared =>
+      have hsuEq :
+          (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+      simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+      obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+        stateBindRun_ok_inv hrun
+      rcases borrowResult with
+        ⟨borrowOutput, borrowEmit, borrowed, release⟩
+      cases borrowed with
+      | constA atom =>
+          cases atom with
+          | var relative =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘ emitOp (.fetch (.var relative) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases (hborrow htarget hborrowRun hextends havailable).stable
+          | lit literal =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact (hborrow htarget hborrowRun hextends
+                havailable).projectConst
+          | erased =>
+              have hpure :
+                  (borrowOutput, borrowEmit, AVal.constA .erased) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases hproject with
+              | ctor hfield =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectCtorErased
+              | erased =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).returnErased
+      | slotA targetAbs =>
+          cases release with
+          | false =>
+              have hpure :
+                  (borrowOutput.bump.bump,
+                    borrowEmit ∘
+                      emitOp
+                        (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases hproject with
+              | ctor hfield =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotKept hfield
+              | erased =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotKeptErased
+          | true =>
+              have hpure :
+                  (borrowOutput.bump.bump.bump,
+                    borrowEmit ∘
+                      emitOp
+                        (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                      emitOp (.drop (.var
+                        (borrowOutput.bump.bump.rel targetAbs))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases hproject with
+              | ctor hfield =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotReleased hfield
+              | erased =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotReleasedErased
+
+/-- One complete reachable-state exact-profile expression step. -/
+theorem lowerE_run_profile_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hspine : LowerSpineProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hborrow : LowerBorrowProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hargsNext : LowerArgsProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedProfilePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceValue world emit av profile := by
+  exact lowerE_run_profile_core
+    (Result := fun result sourceProfile =>
+      LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+        output sourceEnv sourceEnv result world emit av sourceProfile)
+    (hvar := by
+      intro _ _ hlookup hbranchRun
+      exact lowerE_var_run_profile_sound hlookup hbranchRun)
+    (href := by
+      intro _ _ _ hsourceSpine hspineRun
+      exact lowerSpine_ref_run_profile_sound_within henv hargsNext
+        hrestNext hknownExtra hcontracts hvalues hprofiles hsourceSpine
+        hspineRun hextends hrepresented havailable)
+    (happ := by
+      intro _ _ _ _ hsourceSpine hspineRun
+      exact hspine (by simp) hsourceSpine hspineRun hextends havailable)
+    (hlam := by
+      intro _ _ hbranchRun
+      exact lowerE_lam_run_profile_sound_any
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := by
+      intro _ _ body _ _ _ _ _ hvalueSource hbodySource hbranchRun
+      exact lowerE_let_run_profile_sound_within hexpr hvalueSource
+        hbodySource (hreleases body) hbranchRun hextends havailable)
+    (hproj := by
+      intro _ _ _ _ _ _ _ _ htarget hfield hbranchRun
+      exact lowerE_proj_run_profile_sound_within hborrow htarget
+        (.ctor hfield) hbranchRun hextends havailable)
+    (hlit := by
+      intro _ hbranchRun
+      exact lowerE_lit_run_profile_sound hbranchRun)
+    (herased := by
+      intro hbranchRun
+      exact lowerE_erased_run_profile_sound hbranchRun)
+    hsource hrun
+
+/-- Reachable-state dynamic borrowing exposes the expression subrun's final
+state so its suffix proof can be threaded into the exact-profile result. -/
+theorem lowerBorrow_dynamic_run_profile_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {ambient : LowSt} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExtraExtends exprState ambient →
+      LowerResultProfileSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    LowerBorrowProfileSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release profile := by
+  exact (lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv exprState =>
+      ExtraExtends exprState ambient →
+      LowerResultProfileSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease
+        borrowState =>
+      ExtraExtends borrowState ambient →
+      LowerBorrowProfileSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceValue borrowEmit borrowAv borrowRelease
+        profile)
+    (hexpr := fun hsubrun hwithin => hexpr hsubrun hwithin)
+    (hslot := fun hsound hwithin =>
+      (hsound hwithin).asBorrowSlot)
+    (hconst := fun hsound hwithin =>
+      (hsound hwithin).asBorrowConst)
+    hshape hrun) hextends
+
+theorem lowerBorrowProfilePreservesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel) :
+    LowerBorrowProfilePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue sourceProfile
+    state finalState emit av release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+      cases hsource with
+      | var hlookup =>
+          exact lowerBorrow_var_run_profile_sound hlookup hrun
+  | ref address =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.ref address) hrun hextends
+  | app function argument =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.app function argument) hrun hextends
+  | lam uses body =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.lam uses body) hrun hextends
+  | letE uses value body =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.letE uses value body) hrun hextends
+  | proj index source =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.proj index source) hrun hextends
+  | lit literal =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.lit literal) hrun hextends
+  | erased =>
+      exact lowerBorrow_dynamic_run_profile_sound_within
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        .erased hrun hextends
+
+/-! ### Target-fuel-bounded reachable expression and borrow steps -/
+
+/-- Reachable-state exact-profile let sequencing. The body suffix transports
+the earlier bound-value run, and the explicit no-self map rebuilds current
+self availability for the installed binder environment. -/
+theorem lowerE_let_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {valueFuel bodyFuel : Nat} {boundSource sourceValue : IxIR0.Value}
+    {valueProfile bodyProfile : SourceProfile}
+    (hvalueSource : IxIR0.DynamicCost.Eval sourceCtx valueFuel sourceEnv
+      value boundSource valueProfile)
+    (hbodySource : IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+      (boundSource :: sourceEnv) body sourceValue bodyProfile)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (valueProfile + bodyProfile + IxIR0.DynamicCost.tick .evalLet) := by
+  apply lowerE_let_run_profile_sound_below
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- Reachable-state exact-profile projection. Its borrow subrun ends in the
+same compiler state as the pure fetch/retain/drop suffix. -/
+theorem lowerE_proj_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hborrow : LowerBorrowProfilePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceTarget sourceValue : IxIR0.Value}
+    {sourceProfile : SourceProfile}
+    (htarget : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv source
+      sourceTarget sourceProfile)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProfileAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input) :
+    LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av
+      (sourceProfile + IxIR0.DynamicCost.tick .evalProj +
+        IxIR0.DynamicCost.retain 1) := by
+  cases world with
+  | unique =>
+      have huuEq :
+          (Ixon.Owned.unique == Ixon.Owned.unique) = true := by decide
+      simp only [lowerE, huuEq, if_true] at hrun
+      exact (stateThrowRun_not_ok hrun).elim
+  | shared =>
+      have hsuEq :
+          (Ixon.Owned.shared == Ixon.Owned.unique) = false := by decide
+      simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+      obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+        stateBindRun_ok_inv hrun
+      rcases borrowResult with
+        ⟨borrowOutput, borrowEmit, borrowed, release⟩
+      cases borrowed with
+      | constA atom =>
+          cases atom with
+          | var relative =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘ emitOp (.fetch (.var relative) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases (hborrow htarget hborrowRun hextends havailable).stable
+          | lit literal =>
+              have hpure :
+                  (borrowOutput.bump,
+                    borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+                    AVal.slotA borrowOutput.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact (hborrow htarget hborrowRun hextends
+                havailable).projectConst
+          | erased =>
+              have hpure :
+                  (borrowOutput, borrowEmit, AVal.constA .erased) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases hproject with
+              | ctor hfield =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectCtorErased
+              | erased =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).returnErased
+      | slotA targetAbs =>
+          cases release with
+          | false =>
+              have hpure :
+                  (borrowOutput.bump.bump,
+                    borrowEmit ∘
+                      emitOp
+                        (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases hproject with
+              | ctor hfield =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotKept hfield
+              | erased =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotKeptErased
+          | true =>
+              have hpure :
+                  (borrowOutput.bump.bump.bump,
+                    borrowEmit ∘
+                      emitOp
+                        (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                      emitOp (.dup (.var
+                        (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                      emitOp (.drop (.var
+                        (borrowOutput.bump.bump.rel targetAbs))),
+                    AVal.slotA borrowOutput.bump.depth) =
+                      (output, emit, av) ∧ middleState = finalState := by
+                simpa using hafterBorrow
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              cases hproject with
+              | ctor hfield =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotReleased hfield
+              | erased =>
+                  exact (hborrow htarget hborrowRun hextends
+                    havailable).projectSlotReleasedErased
+
+/-- One complete reachable-state exact-profile expression step. -/
+theorem lowerE_run_profile_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hspine : LowerSpineProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hborrow : LowerBorrowProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hargsNext : LowerArgsProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedProfilePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProfileAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceValue world emit av profile := by
+  exact lowerE_run_profile_core
+    (Result := fun result sourceProfile =>
+      LowerResultProfileSoundBelow
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv result world emit av sourceProfile)
+    (hvar := by
+      intro _ _ hlookup hbranchRun
+      exact lowerE_var_run_profile_sound_below hlookup hbranchRun)
+    (href := by
+      intro _ _ _ hsourceSpine hspineRun
+      exact lowerSpine_ref_run_profile_sound_within_below henv hargsNext
+        hrestNext hknownExtra hcontracts hvalues hprofiles hsourceSpine
+        hspineRun hextends hrepresented havailable)
+    (happ := by
+      intro _ _ _ _ hsourceSpine hspineRun
+      exact hspine (by simp) hsourceSpine hspineRun hextends havailable)
+    (hlam := by
+      intro _ _ hbranchRun
+      exact lowerE_lam_run_profile_sound_any_below
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := by
+      intro _ _ body _ _ _ _ _ hvalueSource hbodySource hbranchRun
+      exact lowerE_let_run_profile_sound_within_below hexpr hvalueSource
+        hbodySource (hreleases body) hbranchRun hextends havailable)
+    (hproj := by
+      intro _ _ _ _ _ _ _ _ htarget hfield hbranchRun
+      exact lowerE_proj_run_profile_sound_within_below hborrow htarget
+        (.ctor hfield) hbranchRun hextends havailable)
+    (hlit := by
+      intro _ hbranchRun
+      exact lowerE_lit_run_profile_sound_below hbranchRun)
+    (herased := by
+      intro hbranchRun
+      exact lowerE_erased_run_profile_sound_below hbranchRun)
+    hsource hrun
+
+/-- Reachable-state dynamic borrowing exposes the expression subrun's final
+state so its suffix proof can be threaded into the exact-profile result. -/
+theorem lowerBorrow_dynamic_run_profile_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {ambient : LowSt} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExtraExtends exprState ambient →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv profile)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release profile := by
+  exact (lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv exprState =>
+      ExtraExtends exprState ambient →
+      LowerResultProfileSoundBelow funRel recSelfRel ctx cur limit input
+        exprOutput sourceEnv sourceEnv sourceValue .shared exprEmit exprAv
+        profile)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease
+        borrowState =>
+      ExtraExtends borrowState ambient →
+      LowerBorrowProfileSoundBelow funRel recSelfRel ctx cur limit input
+        borrowOutput sourceEnv sourceEnv sourceValue borrowEmit borrowAv
+        borrowRelease profile)
+    (hexpr := fun hsubrun hwithin => hexpr hsubrun hwithin)
+    (hslot := fun hsound hwithin =>
+      (hsound hwithin).asBorrowSlot)
+    (hconst := fun hsound hwithin =>
+      (hsound hwithin).asBorrowConst)
+    hshape hrun) hextends
+
+theorem lowerBorrowProfilePreservesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient fuel) :
+    LowerBorrowProfilePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue sourceProfile
+    state finalState emit av release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+      cases hsource with
+      | var hlookup =>
+          exact lowerBorrow_var_run_profile_sound_below hlookup hrun
+  | ref address =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.ref address) hrun hextends
+  | app function argument =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.app function argument) hrun hextends
+  | lam uses body =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.lam uses body) hrun hextends
+  | letE uses value body =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.letE uses value body) hrun hextends
+  | proj index source =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.proj index source) hrun hextends
+  | lit literal =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        (.lit literal) hrun hextends
+  | erased =>
+      exact lowerBorrow_dynamic_run_profile_sound_within_below
+        (fun hsubrun hwithin =>
+          hexpr hsource hsubrun hwithin havailable)
+        .erased hrun hextends
+
+
+/-! ### Closed reachable-state exact-profile induction -/
+
+/-- The complete exact-profile invariant for the mutually recursive lowering
+cluster at one compiler-fuel index. -/
+structure LowerProfileClusterWithin
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (fuel : Nat) : Prop where
+  expr : LowerEProfilePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  borrow : LowerBorrowProfilePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  spine : LowerSpineProfilePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  args : LowerArgsProfilePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  applyRest : ApplyRestNonErasedProfilePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+
+/-- Complete compiler-fuel induction for exact source-profile preservation,
+assuming paired declaration and higher-order application profile contracts
+for the final target context. -/
+theorem lowerProfileClusterWithin
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx) :
+    ∀ fuel,
+      LowerProfileClusterWithin sourceCtx src ambient recSelfRel ctx cur
+        fuel
+  | 0 => by
+      exact {
+        expr := lowerEProfilePreservesWithin_zero src ambient
+        borrow := lowerBorrowProfilePreservesWithin_zero src ambient
+        spine := lowerSpineProfilePreservesWithin_zero src ambient
+        args := lowerArgsProfilePreservesWithin_zero src ambient
+        applyRest :=
+          applyRestNonErasedProfilePreservesWithin_zero src ambient }
+  | fuel + 1 => by
+      have hprev := lowerProfileClusterWithin (recSelfRel := recSelfRel)
+        (cur := cur) henv hrepresented hcontracts hvalues hprofiles fuel
+      have hargs : LowerArgsProfilePreservesWithin
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx
+          ctx cur src ambient (fuel + 1) :=
+        lowerArgsProfilePreservesWithin_succ hprev.expr hprev.args
+      have hrest : ApplyRestNonErasedProfilePreservesWithin
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx
+          ctx cur src ambient (fuel + 1) :=
+        applyRestNonErasedProfilePreservesWithin_succ hprev.args
+          hcontracts.apply hvalues.apply hprofiles.apply
+      have hborrow : LowerBorrowProfilePreservesWithin
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx
+          ctx cur src ambient (fuel + 1) :=
+        lowerBorrowProfilePreservesWithin_succ hprev.expr
+      cases fuel with
+      | zero =>
+          have hspine : LowerSpineProfilePreservesWithin
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur src ambient 1 :=
+            lowerSpineProfilePreservesWithin_one src ambient
+          have hexpr : LowerEProfilePreservesWithin
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur src ambient 1 := by
+            intro input output world expr sourceEnv sourceFuel sourceValue
+              sourceProfile state finalState emit av hsource hrun hextends
+              havailable
+            exact lowerE_run_profile_sound_within (fuel := 0) henv
+              hprev.expr hprev.spine hprev.borrow hargs hrest
+              (lowerExtraMonotone src 2).knownCall hcontracts hvalues
+              hprofiles (fun body => lowerE_releasesTrackedFirst src 0 body)
+              hsource hrun hextends hrepresented havailable
+          exact {
+            expr := hexpr
+            borrow := hborrow
+            spine := hspine
+            args := hargs
+            applyRest := hrest }
+      | succ fuel =>
+          have hprior := lowerProfileClusterWithin
+            (recSelfRel := recSelfRel) (cur := cur) henv hrepresented
+            hcontracts hvalues hprofiles fuel
+          have hspine : LowerSpineProfilePreservesWithin
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur src ambient (fuel + 2) := by
+            intro input output world head args sourceEnv sourceResult
+              sourceProfile state finalState emit av hargsNonempty hsource hrun
+              hextends havailable
+            exact lowerSpine_run_profile_sound_within (fuel := fuel) henv
+              hprev.spine hprev.expr
+              (lowerE_reflectsErased sourceCtx src (fuel + 1)) hprior.args
+              hprior.applyRest hprev.applyRest
+              (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts
+              hvalues hprofiles hargsNonempty hsource hrun hextends
+              hrepresented havailable
+          have hexpr : LowerEProfilePreservesWithin
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur src ambient (fuel + 2) := by
+            intro input output world expr sourceEnv sourceFuel sourceValue
+              sourceProfile state finalState emit av hsource hrun hextends
+              havailable
+            exact lowerE_run_profile_sound_within (fuel := fuel + 1) henv
+              hprev.expr hprev.spine hprev.borrow hargs hrest
+              (lowerExtraMonotone src (fuel + 3)).knownCall hcontracts
+              hvalues hprofiles
+              (fun body => lowerE_releasesTrackedFirst src (fuel + 1) body)
+              hsource hrun hextends hrepresented havailable
+          exact {
+            expr := hexpr
+            borrow := hborrow
+            spine := hspine
+            args := hargs
+            applyRest := hrest }
+
+/-- Ordinary exact-profile expression lowering, with no synthetic recursive
+self entry in the logical input environment. -/
+theorem lowerE_run_profile_sound_within_noRecSelf
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hno : NoRecSelf input) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceValue world emit av profile :=
+  (lowerProfileClusterWithin (recSelfRel := recSelfRel) (cur := cur) henv
+    hrepresented hcontracts hvalues hprofiles fuel).expr hsource hrun
+      hextends (SelfProfileAvailable.of_noRecSelf hno)
+
+/-- Recursor-rule exact-profile expression lowering with the generated
+current function's paired value, ownership, and profile contract. -/
+theorem lowerE_run_profile_sound_within_currentSelf
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hself : CurrentSelfProfileContract
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur) :
+    LowerResultProfileSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceValue world emit av profile :=
+  (lowerProfileClusterWithin (recSelfRel := recSelfRel) (cur := cur) henv
+    hrepresented hcontracts hvalues hprofiles fuel).expr hsource hrun
+      hextends (SelfProfileAvailable.of_contract hself)
+
+/-! ### Target-fuel-bounded closed reachable profile induction -/
+
+/-- The complete exact-profile invariant for the mutually recursive lowering
+cluster at one compiler-fuel index. -/
+structure LowerProfileClusterWithinBelow
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit fuel : Nat) : Prop where
+  expr : LowerEProfilePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  borrow : LowerBorrowProfilePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  spine : LowerSpineProfilePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  args : LowerArgsProfilePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  applyRest : ApplyRestNonErasedProfilePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+
+/-- Complete compiler-fuel induction for exact source-profile preservation,
+assuming paired declaration and higher-order application profile contracts
+for the final target context. -/
+theorem lowerProfileClusterWithinBelow
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit) :
+    ∀ fuel,
+      LowerProfileClusterWithinBelow sourceCtx src ambient recSelfRel ctx cur limit
+        fuel
+  | 0 => by
+      exact {
+        expr := lowerEProfilePreservesWithinBelow_zero src ambient
+        borrow := lowerBorrowProfilePreservesWithinBelow_zero src ambient
+        spine := lowerSpineProfilePreservesWithinBelow_zero src ambient
+        args := lowerArgsProfilePreservesWithinBelow_zero src ambient
+        applyRest :=
+          applyRestNonErasedProfilePreservesWithinBelow_zero src ambient }
+  | fuel + 1 => by
+      have hprev := lowerProfileClusterWithinBelow (recSelfRel := recSelfRel)
+        (cur := cur) henv hrepresented hcontracts hvalues hprofiles fuel
+      have hargs : LowerArgsProfilePreservesWithinBelow
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx
+          ctx cur limit src ambient (fuel + 1) :=
+        lowerArgsProfilePreservesWithinBelow_succ hprev.expr hprev.args
+      have hrest : ApplyRestNonErasedProfilePreservesWithinBelow
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx
+          ctx cur limit src ambient (fuel + 1) :=
+        applyRestNonErasedProfilePreservesWithinBelow_succ hprev.args
+          hcontracts.apply hvalues.apply hprofiles.apply
+      have hborrow : LowerBorrowProfilePreservesWithinBelow
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx
+          ctx cur limit src ambient (fuel + 1) :=
+        lowerBorrowProfilePreservesWithinBelow_succ hprev.expr
+      cases fuel with
+      | zero =>
+          have hspine : LowerSpineProfilePreservesWithinBelow
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur limit src ambient 1 :=
+            lowerSpineProfilePreservesWithinBelow_one src ambient
+          have hexpr : LowerEProfilePreservesWithinBelow
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur limit src ambient 1 := by
+            intro input output world expr sourceEnv sourceFuel sourceValue
+              sourceProfile state finalState emit av hsource hrun hextends
+              havailable
+            exact lowerE_run_profile_sound_within_below (fuel := 0) henv
+              hprev.expr hprev.spine hprev.borrow hargs hrest
+              (lowerExtraMonotone src 2).knownCall hcontracts hvalues
+              hprofiles (fun body => lowerE_releasesTrackedFirst src 0 body)
+              hsource hrun hextends hrepresented havailable
+          exact {
+            expr := hexpr
+            borrow := hborrow
+            spine := hspine
+            args := hargs
+            applyRest := hrest }
+      | succ fuel =>
+          have hprior := lowerProfileClusterWithinBelow
+            (recSelfRel := recSelfRel) (cur := cur) henv hrepresented
+            hcontracts hvalues hprofiles fuel
+          have hspine : LowerSpineProfilePreservesWithinBelow
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur limit src ambient (fuel + 2) := by
+            intro input output world head args sourceEnv sourceResult
+              sourceProfile state finalState emit av hargsNonempty hsource hrun
+              hextends havailable
+            exact lowerSpine_run_profile_sound_within_below (fuel := fuel) henv
+              hprev.spine hprev.expr
+              (lowerE_reflectsErased sourceCtx src (fuel + 1)) hprior.args
+              hprior.applyRest hprev.applyRest
+              (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts
+              hvalues hprofiles hargsNonempty hsource hrun hextends
+              hrepresented havailable
+          have hexpr : LowerEProfilePreservesWithinBelow
+              (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+              sourceCtx ctx cur limit src ambient (fuel + 2) := by
+            intro input output world expr sourceEnv sourceFuel sourceValue
+              sourceProfile state finalState emit av hsource hrun hextends
+              havailable
+            exact lowerE_run_profile_sound_within_below (fuel := fuel + 1) henv
+              hprev.expr hprev.spine hprev.borrow hargs hrest
+              (lowerExtraMonotone src (fuel + 3)).knownCall hcontracts
+              hvalues hprofiles
+              (fun body => lowerE_releasesTrackedFirst src (fuel + 1) body)
+              hsource hrun hextends hrepresented havailable
+          exact {
+            expr := hexpr
+            borrow := hborrow
+            spine := hspine
+            args := hargs
+            applyRest := hrest }
+
+/-- Ordinary exact-profile expression lowering, with no synthetic recursive
+self entry in the logical input environment. -/
+theorem lowerE_run_profile_sound_within_noRecSelf_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hno : NoRecSelf input) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceValue world emit av profile :=
+  (lowerProfileClusterWithinBelow (recSelfRel := recSelfRel) (cur := cur) henv
+    hrepresented hcontracts hvalues hprofiles fuel).expr hsource hrun
+      hextends (SelfProfileAvailableBelow.of_noRecSelf hno)
+
+/-- Recursor-rule exact-profile expression lowering with the generated
+current function's paired value, ownership, and profile contract. -/
+theorem lowerE_run_profile_sound_within_currentSelf_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {fuel : Nat} {input output : VEnv} {world : Ixon.Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue profile)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hself : CurrentSelfProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit) :
+    LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit input
+      output sourceEnv sourceEnv sourceValue world emit av profile :=
+  (lowerProfileClusterWithinBelow (recSelfRel := recSelfRel) (cur := cur) henv
+    hrepresented hcontracts hvalues hprofiles fuel).expr hsource hrun
+      hextends (SelfProfileAvailableBelow.of_contract hself)
+
+/-- Profile equality transports a funded higher-order application run. -/
+theorem ProfileFundedApplyRun.of_profile_eq
+    {ctx : Ctx} {fuel : Nat} {before after : Store}
+    {function : RVal} {args : List RVal} {value : RVal}
+    {left right : SourceProfile}
+    (hcost : ProfileFundedApplyRun ctx fuel before function args after value
+      left)
+    (hprofile : left = right) :
+    ProfileFundedApplyRun ctx fuel before function args after value right := by
+  subst right
+  exact hcost
+
+/-- Any larger source ownership allowance also funds an application run. -/
+theorem ProfileFundedApplyRun.monoProfile
+    {ctx : Ctx} {fuel : Nat} {before after : Store}
+    {function : RVal} {args : List RVal} {value : RVal}
+    {smaller larger : SourceProfile}
+    (hcost : ProfileFundedApplyRun ctx fuel before function args after value
+      smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedApplyRun ctx fuel before function args after value larger := by
+  obtain ⟨allowance, hrunCost, hfunded⟩ := hcost
+  exact ⟨allowance, hrunCost, hfunded.trans hle⟩
+
+/-- Profile equality transports a funded declaration invocation run. -/
+theorem ProfileFundedInvokeRun.of_profile_eq
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address}
+    {args : List RVal} {before after : Store} {value : RVal}
+    {left right : SourceProfile}
+    (hcost : ProfileFundedInvokeRun ctx fuel address args before after value
+      left)
+    (hprofile : left = right) :
+    ProfileFundedInvokeRun ctx fuel address args before after value right := by
+  subst right
+  exact hcost
+
+/-- Any larger source ownership allowance also funds an invocation run. -/
+theorem ProfileFundedInvokeRun.monoProfile
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address}
+    {args : List RVal} {before after : Store} {value : RVal}
+    {smaller larger : SourceProfile}
+    (hcost : ProfileFundedInvokeRun ctx fuel address args before after value
+      smaller)
+    (hle : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance smaller)
+      (sourceProfileOwnershipAllowance larger)) :
+    ProfileFundedInvokeRun ctx fuel address args before after value larger := by
+  obtain ⟨allowance, hrunCost, hfunded⟩ := hcost
+  exact ⟨allowance, hrunCost, hfunded.trans hle⟩
+
+/-- Scalar extern invocation is ownership-free and therefore can be funded
+by any exact source fragment assigned to that fire. -/
+theorem ProfileFundedInvokeRun.extern
+    {ctx : Ctx} {fuel : Nat} {address : Ixon.Address}
+    {args : List RVal} {store : Store} {value : RVal} {arity : Nat}
+    {profile : SourceProfile}
+    (horder : AllocationOrderInvariant store)
+    (hargs : ValuesInBounds store args)
+    (hdecl : ctx.decls address = some (.extern arity))
+    (harity : args.length = arity)
+    (hcall : callScalarOracle ctx address args = .ok value) :
+    ProfileFundedInvokeRun ctx (fuel + 1) address args store store value
+      profile :=
+  ⟨⟨0, 0⟩, InvokeOwnershipRunCost.extern horder hargs hdecl harity hcall,
+    zeroOwnershipAllowance_le_profile profile⟩
+
+
+/-- Releasing arguments supplied to an erased function needs no ownership
+allowance, so any enclosing source profile can fund the branch. -/
+theorem ProfileFundedApplyRun.erased
+    {ctx : Ctx} {fuel : Nat} {before after : Store} {args : List RVal}
+    {profile : SourceProfile}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hdrop : dropMany ctx fuel before args = .ok after) :
+    ProfileFundedApplyRun ctx (fuel + 1) before .erased args after .erased
+      profile :=
+  ⟨⟨0, 0⟩, ApplyOwnershipRunCost.erased horder hargs hdrop,
+    zeroOwnershipAllowance_le_profile profile⟩
+
+/-- A PAP under-application spends its captured-root retains and the
+enclosing source application's evaluation charge on the successor PAP. -/
+theorem ProfileFundedApplyRun.papUnder
+    {ctx : Ctx} {fuel : Nat} {before duplicated ready : Store}
+    {location arity rc : Nat} {address : Ixon.Address}
+    {world : Ixon.Owned}
+    {captured : Array RVal} {args : List RVal}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hbox : before.get? location =
+      some ⟨world, rc, .papN address arity captured⟩)
+    (hdup : dupVals before captured.toList = .ok duplicated)
+    (hdrop : dropVal ctx fuel duplicated (.loc location) = .ok ready)
+    (hunder : (captured.toList ++ args).length < arity) :
+    ProfileFundedApplyRun ctx (fuel + 1) before (.loc location) args
+      (ready.allocNode .shared
+        (.papN address arity (captured.toList ++ args).toArray)).1
+      (.loc (ready.allocNode .shared
+        (.papN address arity (captured.toList ++ args).toArray)).2)
+      (IxIR0.DynamicCost.retain captured.toList.length +
+        IxIR0.DynamicCost.tick .evalApp) := by
+  refine ⟨(retainedOwnershipAllowance captured.toList.length).add ⟨1, 1⟩,
+    ApplyOwnershipRunCost.papUnder horder hargs hbox hdup hdrop hunder, ?_⟩
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_retain,
+    sourceProfileOwnershipAllowance_tick_of_evals_eq_one .evalApp (by rfl)]
+  exact (OwnershipAllowanceLE.refl _).add allocatedNodeAllowance_le_eval
+
+/-- Exact PAP saturation combines the captured-prefix retains with the
+profile-funded dynamic invocation. -/
+theorem ProfileFundedApplyRun.papExact
+    {ctx : Ctx} {fuel : Nat} {before duplicated ready after : Store}
+    {location arity rc : Nat} {address : Ixon.Address}
+    {world : Ixon.Owned} {captured : Array RVal} {args : List RVal}
+    {value : RVal} {invokeProfile : SourceProfile} {declaration : Decl}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hbox : before.get? location =
+      some ⟨world, rc, .papN address arity captured⟩)
+    (hdup : dupVals before captured.toList = .ok duplicated)
+    (hdrop : dropVal ctx fuel duplicated (.loc location) = .ok ready)
+    (hexact : (captured.toList ++ args).length = arity)
+    (hdecl : ctx.decls address = some declaration)
+    (hpapsafe : declPapSafe declaration = true)
+    (hinvoke : ProfileFundedInvokeRun ctx fuel address
+      (captured.toList ++ args) ready after value invokeProfile) :
+    ProfileFundedApplyRun ctx (fuel + 1) before (.loc location) args after
+      value
+      (IxIR0.DynamicCost.retain captured.toList.length + invokeProfile) := by
+  obtain ⟨invokeAllowance, hinvokeCost, hinvokeFunded⟩ := hinvoke
+  refine ⟨(retainedOwnershipAllowance captured.toList.length).add
+      invokeAllowance,
+    ApplyOwnershipRunCost.papExact horder hargs hbox hdup hdrop hexact
+      hdecl hpapsafe hinvokeCost, ?_⟩
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_retain]
+  exact (OwnershipAllowanceLE.refl _).add hinvokeFunded
+
+/-- PAP over-application composes the prefix retains, saturated invocation,
+and recursively profiled application of the remaining arguments. -/
+theorem ProfileFundedApplyRun.papOver
+    {ctx : Ctx} {fuel : Nat}
+    {before duplicated ready called after : Store}
+    {location arity rc : Nat} {address : Ixon.Address}
+    {world : Ixon.Owned} {captured : Array RVal} {args : List RVal}
+    {calledValue value : RVal} {declaration : Decl}
+    {invokeProfile applyProfile : SourceProfile}
+    (horder : AllocationOrderInvariant before)
+    (hargs : ValuesInBounds before args)
+    (hbox : before.get? location =
+      some ⟨world, rc, .papN address arity captured⟩)
+    (hdup : dupVals before captured.toList = .ok duplicated)
+    (hdrop : dropVal ctx fuel duplicated (.loc location) = .ok ready)
+    (hover : arity < (captured.toList ++ args).length)
+    (hdecl : ctx.decls address = some declaration)
+    (hpapsafe : declPapSafe declaration = true)
+    (hinvoke : ProfileFundedInvokeRun ctx fuel address
+      ((captured.toList ++ args).take arity) ready called calledValue
+      invokeProfile)
+    (happly : ProfileFundedApplyRun ctx fuel called calledValue
+      ((captured.toList ++ args).drop arity) after value applyProfile) :
+    ProfileFundedApplyRun ctx (fuel + 1) before (.loc location) args after
+      value
+      ((IxIR0.DynamicCost.retain captured.toList.length + invokeProfile) +
+        applyProfile) := by
+  obtain ⟨invokeAllowance, hinvokeCost, hinvokeFunded⟩ := hinvoke
+  obtain ⟨applyAllowance, happlyCost, happlyFunded⟩ := happly
+  refine ⟨((retainedOwnershipAllowance captured.toList.length).add
+      invokeAllowance).add applyAllowance,
+    ApplyOwnershipRunCost.papOver horder hargs hbox hdup hdrop hover
+      hdecl hpapsafe hinvokeCost happlyCost, ?_⟩
+  rw [sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_add,
+    sourceProfileOwnershipAllowance_retain]
+  exact ((OwnershipAllowanceLE.refl _).add hinvokeFunded).add happlyFunded
+
+/-- Exact profile preservation for `applyGo` at the current evaluator index.
+Residual saturation and recursive over-application are requested only
+strictly below this index.  The source/runtime graph and ownership hypotheses
+keep the profile split synchronized with the concrete PAP argument split. -/
+theorem applyProfilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit) :
+    ApplyProfilePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx limit := by
+  intro before after function args value sourceFunction sourceResult
+    sourceArgs sourceRest rest profile horder hfunction hargs hsource hframe
+    hown hnonempty hrun
+  have hargsBounds : ValuesInBounds before args := by
+    intro runtime hmember
+    have hroot : (⟨.shared, runtime⟩ : Sim.Root) ∈
+        ⟨.shared, function⟩ :: Sim.rootsFor .shared args ++ rest := by
+      apply List.mem_cons_of_mem
+      apply List.mem_append_left rest
+      simpa [Sim.rootsFor] using hmember
+    exact rootOwnership_valueInBounds_of_mem hown hroot
+  cases limit with
+  | zero => simp [applyGo] at hrun
+  | succ fuel =>
+    cases hfunction with
+    | lit => simp [applyGo] at hrun
+    | erased =>
+      have hsourceResult : sourceResult = .erased :=
+        hsource.toSourceApplies.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      simp only [applyGo] at hrun
+      cases hdrop : dropMany ctx fuel before args with
+      | error error =>
+        rw [hdrop, bindErr] at hrun
+        contradiction
+      | ok dropped =>
+        rw [hdrop, bindOk] at hrun
+        injection hrun with hpair
+        cases hpair
+        exact ProfileFundedApplyRun.erased horder hargsBounds hdrop
+    | @ctor sourceAddress sourceTag sourceFields loc boxWorld rc cid fields
+        hget haddress htag hfields =>
+      simp [applyGo, hget] at hrun
+    | @function relatedFunction address arity captures loc rc got hget hfun
+        hgot =>
+      simp only [applyGo] at hrun
+      rw [hget] at hrun
+      dsimp only at hrun
+      cases hdup : dupVals before got.toList with
+      | error error =>
+        rw [hdup, bindErr] at hrun
+        contradiction
+      | ok dupStore =>
+        rw [hdup, bindOk] at hrun
+        cases hdrop : dropVal ctx fuel dupStore (.loc loc) with
+        | error error =>
+          rw [hdrop, bindErr] at hrun
+          contradiction
+        | ok readyStore =>
+          rw [hdrop, bindOk] at hrun
+          let total := got.toList ++ args
+          obtain ⟨hgotReady, hargsReady, hframeReady, hready⟩ :=
+            applyGo_preparePap_valueGraphs hget hgot hargs hframe hown
+              hdup hdrop
+          have hreadyOrder : AllocationOrderInvariant readyStore :=
+            (horder.dupVals hdup).dropVal hdrop
+          split at hrun
+          next hunder =>
+            injection hrun with hpair
+            cases hpair
+            have hbase := ProfileFundedApplyRun.papUnder horder hargsBounds
+              hget hdup hdrop (by simpa [total] using hunder)
+            have hfunded :=
+              CompilerFunctionRel.underApplyProfileFunding henv hfun hsource
+                hnonempty
+            have haligned : OwnershipAllowanceLE
+                (sourceProfileOwnershipAllowance
+                  (IxIR0.DynamicCost.retain got.toList.length +
+                    IxIR0.DynamicCost.tick .evalApp))
+                (sourceProfileOwnershipAllowance profile) := by
+              rw [← hgotReady.length]
+              exact hfunded
+            simpa [total] using hbase.monoProfile haligned
+          next hnotUnder =>
+            split at hrun
+            next hexact =>
+              obtain ⟨declaration, hdeclaration, hpapsafe, hinvokeRun⟩ :
+                  ∃ declaration,
+                    ctx.decls address = some declaration ∧
+                    declPapSafe declaration = true ∧
+                    invoke ctx fuel address (got.toList ++ args) readyStore =
+                      .ok (after, value) := by
+                cases hdecl : ctx.decls address with
+                | none => simp [hdecl] at hrun
+                | some declaration =>
+                  cases hpapsafe : declPapSafe declaration with
+                  | false => simp [hdecl, hpapsafe] at hrun
+                  | true =>
+                    refine ⟨declaration, rfl, hpapsafe, ?_⟩
+                    simpa [hdecl, hpapsafe, total] using hrun
+              have hfullSourceLength :
+                  (captures ++ sourceArgs).length = arity := by
+                have htotalLength := (hgotReady.append hargsReady).length
+                have hexact' : (got.toList ++ args).length = arity := by
+                  simpa [total] using hexact
+                simp only [List.length_append] at htotalLength hexact' ⊢
+                omega
+              obtain ⟨invokeProfile, hinvokeCost, hfunded⟩ :=
+                hprofiles.residual.preserves (Nat.lt_succ_self fuel)
+                  hreadyOrder hfun hgotReady hargsReady hsource hnonempty
+                  hfullSourceLength hframeReady hready hinvokeRun
+              have hbase := ProfileFundedApplyRun.papExact horder hargsBounds
+                hget hdup hdrop (by simpa [total] using hexact)
+                hdeclaration hpapsafe hinvokeCost
+              have haligned : OwnershipAllowanceLE
+                  (sourceProfileOwnershipAllowance
+                    (IxIR0.DynamicCost.retain got.toList.length +
+                      invokeProfile))
+                  (sourceProfileOwnershipAllowance profile) := by
+                rw [← hgotReady.length]
+                exact hfunded
+              exact hbase.monoProfile haligned
+            next hover =>
+              have hfunUnder := hfun.underfilled
+              have hgotUnder : got.toList.length < arity := by
+                have hlength := hgotReady.length
+                omega
+              have hgotLe : got.toList.length ≤ arity :=
+                Nat.le_of_lt hgotUnder
+              have hoverLength : arity < total.length := by
+                have hnotExact : total.length ≠ arity := by
+                  intro heq
+                  apply hover
+                  simpa [total] using heq
+                have hle : arity ≤ total.length :=
+                  Nat.le_of_not_gt hnotUnder
+                omega
+              let missing := arity - got.toList.length
+              have hmissing : got.toList.length + missing = arity := by
+                exact Nat.add_sub_of_le hgotLe
+              have hmissingLe : missing ≤ args.length := by
+                simp only [total, List.length_append] at hoverLength
+                omega
+              have hmissingPos : 0 < missing := by omega
+              have hmissingLt : missing < args.length := by
+                simp only [total, List.length_append] at hoverLength
+                omega
+              have htakeTotal : total.take arity =
+                  got.toList ++ args.take missing := by
+                rw [List.take_append]
+                rw [List.take_of_length_le hgotLe]
+              have hdropTotal : total.drop arity = args.drop missing := by
+                rw [List.drop_append]
+                rw [List.drop_eq_nil_of_le hgotLe]
+                rfl
+              obtain ⟨middleSource, prefixProfile, tailProfile,
+                  hprefixApply, htailApply, hprofileEq⟩ :=
+                hsource.splitAt missing
+              have hsourceMissingLe : missing ≤ sourceArgs.length := by
+                have hlength := hargsReady.length
+                omega
+              have hsourceMissingLt : missing < sourceArgs.length := by
+                have hlength := hargsReady.length
+                omega
+              have hprefixLength :
+                  (sourceArgs.take missing).length = missing := by
+                simp [List.length_take, hsourceMissingLe]
+              have hprefixNonempty : sourceArgs.take missing ≠ [] := by
+                intro hempty
+                rw [hempty] at hprefixLength
+                simp only [List.length_nil] at hprefixLength
+                omega
+              have htailNonempty : sourceArgs.drop missing ≠ [] :=
+                drop_nonempty_of_lt_length hsourceMissingLt
+              have hfullPrefixLength :
+                  (captures ++ sourceArgs.take missing).length = arity := by
+                have hcaptureLength := hgotReady.length
+                simp only [List.length_append, hprefixLength]
+                omega
+              have hprefixGraph := hargsReady.take missing
+              have htailGraph := hargsReady.drop missing
+              have htailWorld : ∀ runtime,
+                  runtime ∈ args.drop missing →
+                  Sim.HasWorld readyStore .shared runtime := by
+                intro runtime hmember
+                apply hready.roots_world ⟨.shared, runtime⟩
+                apply List.mem_append_left rest
+                have hmemberArgs : runtime ∈ args :=
+                  List.mem_of_mem_drop hmember
+                have hmemberTotal : runtime ∈ total :=
+                  List.mem_append_right got.toList hmemberArgs
+                simpa [total, Sim.rootsFor] using hmemberTotal
+              let tailSourceRest : List (Ixon.Owned × IxIR0.Value) :=
+                (sourceArgs.drop missing).map
+                  (fun source => (.shared, source))
+              let tailRoots : List Sim.Root :=
+                Sim.rootsFor .shared (args.drop missing)
+              have htailFrame : Sim.RootsGraph
+                  (CompilerFunctionRel sourceCtx src ambient) readyStore
+                  tailSourceRest tailRoots := by
+                exact htailGraph.rootsGraph .shared htailWorld
+              have hcombinedFrame : Sim.RootsGraph
+                  (CompilerFunctionRel sourceCtx src ambient) readyStore
+                  (tailSourceRest ++ sourceRest) (tailRoots ++ rest) :=
+                htailFrame.append hframeReady
+              have hrootsSplit : Sim.rootsFor .shared total =
+                  Sim.rootsFor .shared (total.take arity) ++
+                    Sim.rootsFor .shared (total.drop arity) := by
+                unfold Sim.rootsFor
+                rw [← List.map_append]
+                exact congrArg _ (List.take_append_drop arity total).symm
+              have hpartition : Sim.RootOwnership readyStore
+                  (Sim.rootsFor .shared
+                    (got.toList ++ args.take missing) ++
+                    (tailRoots ++ rest)) := by
+                have hsplit := hready
+                rw [hrootsSplit] at hsplit
+                rw [htakeTotal, hdropTotal] at hsplit
+                simpa [tailRoots, List.append_assoc] using hsplit
+              obtain ⟨declaration, hdeclaration, hpapsafe, hguardRun⟩ :
+                  ∃ declaration,
+                    ctx.decls address = some declaration ∧
+                    declPapSafe declaration = true ∧
+                    (invoke ctx fuel address (total.take arity) readyStore >>=
+                      fun called => applyGo ctx fuel called.1 called.2
+                        (total.drop arity)) = .ok (after, value) := by
+                cases hdecl : ctx.decls address with
+                | none => simp [hdecl] at hrun
+                | some declaration =>
+                  cases hpapsafe : declPapSafe declaration with
+                  | false => simp [hdecl, hpapsafe] at hrun
+                  | true =>
+                    refine ⟨declaration, rfl, hpapsafe, ?_⟩
+                    simpa [hdecl, hpapsafe, total] using hrun
+              cases hinvoke : invoke ctx fuel address
+                  (total.take arity) readyStore with
+              | error error =>
+                  rw [hinvoke, bindErr] at hguardRun
+                  contradiction
+              | ok called =>
+                rcases called with ⟨calledStore, calledValue⟩
+                rw [hinvoke, bindOk] at hguardRun
+                have hinvokePrefix : invoke ctx fuel address
+                    (got.toList ++ args.take missing) readyStore =
+                    .ok (calledStore, calledValue) := by
+                  rw [← htakeTotal]
+                  exact hinvoke
+                obtain ⟨invokeProfile, hinvokeCost, hprefixFunded⟩ :=
+                  hprofiles.residual.preserves (Nat.lt_succ_self fuel)
+                    hreadyOrder hfun hgotReady hprefixGraph hprefixApply
+                    hprefixNonempty hfullPrefixLength hcombinedFrame
+                    hpartition hinvokePrefix
+                have hcalled := invoke_compilerFunction_value_owned_below
+                  henv hrepresented hcontracts hvalues
+                  (fun memo baseFunction hlookup href =>
+                    ctorWrapper_fnValueContract
+                      (funRel := CompilerFunctionRel sourceCtx src ambient)
+                      sourceCtx ctx memo.source memo.tag memo.arity
+                      baseFunction hlookup href)
+                  (fun memo => ctorWrapper_fnOwnershipContract ctx
+                    memo.source memo.tag memo.arity)
+                  hfun hgotReady hprefixGraph hprefixApply.toSourceApplies
+                  hcombinedFrame hpartition (Nat.le_succ fuel) hinvokePrefix
+                have htailLength : tailSourceRest.length = tailRoots.length := by
+                  simp [tailSourceRest, tailRoots, Sim.rootsFor,
+                    hargsReady.length]
+                obtain ⟨htailFrameAfter, hframeAfter⟩ :=
+                  hcalled.2.1.splitAppend htailLength
+                have htailGraphAfter : Sim.ValuesGraph
+                    (CompilerFunctionRel sourceCtx src ambient) calledStore
+                    (sourceArgs.drop missing) (args.drop missing) :=
+                  htailFrameAfter.valuesGraph
+                have hrecursiveRun : applyGo ctx fuel calledStore calledValue
+                    (args.drop missing) = .ok (after, value) := by
+                  rw [hdropTotal] at hguardRun
+                  exact hguardRun
+                have hcalledOrder : AllocationOrderInvariant calledStore := by
+                  obtain ⟨allowance, hinvokeRunCost, _⟩ := hinvokeCost
+                  exact hinvokeRunCost.finalOrderAndValue.1
+                have htailCost :=
+                  hprofiles.apply.preserves (Nat.lt_succ_self fuel)
+                    hcalledOrder hcalled.1 htailGraphAfter htailApply
+                    hframeAfter hcalled.2.2 htailNonempty hrecursiveRun
+                have hinvokeCostTotal : ProfileFundedInvokeRun ctx fuel
+                    address (total.take arity) readyStore calledStore
+                    calledValue invokeProfile := by
+                  rw [htakeTotal]
+                  exact hinvokeCost
+                have htailCostTotal : ProfileFundedApplyRun ctx fuel
+                    calledStore calledValue (total.drop arity) after value
+                    tailProfile := by
+                  rw [hdropTotal]
+                  exact htailCost
+                have hcomposed := ProfileFundedApplyRun.papOver horder
+                  hargsBounds hget hdup hdrop hoverLength hdeclaration
+                  hpapsafe hinvokeCostTotal htailCostTotal
+                have hprefixFundedAligned : OwnershipAllowanceLE
+                    (sourceProfileOwnershipAllowance
+                      (IxIR0.DynamicCost.retain got.toList.length +
+                        invokeProfile))
+                    (sourceProfileOwnershipAllowance prefixProfile) := by
+                  rw [← hgotReady.length]
+                  exact hprefixFunded
+                have hcombined : OwnershipAllowanceLE
+                    (sourceProfileOwnershipAllowance
+                      ((IxIR0.DynamicCost.retain got.toList.length +
+                          invokeProfile) + tailProfile))
+                    (sourceProfileOwnershipAllowance
+                      (prefixProfile + tailProfile)) := by
+                  simpa only [sourceProfileOwnershipAllowance_add] using
+                    hprefixFundedAligned.add (OwnershipAllowanceLE.refl
+                      (sourceProfileOwnershipAllowance tailProfile))
+                exact (hcomposed.monoProfile hcombined).of_profile_eq
+                  hprofileEq
+
+/-- A proof-relevant release plan is a zero-profile state transformer for
+the complete logical environment graph.  This is the paired-cost analogue
+of `ReleasePlan.valueSoundBelow`; every released root decreases ownership,
+so the prefix needs no positive source allowance. -/
+theorem releasePlan_profileFundedValueStateRunSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit)
+    (sourceEnv : List IxIR0.Value) :
+    ∀ sourceRest rest slots,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+        (GraphOwnsVEnvProtected funRel recSelfRel input sourceEnv
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel output sourceEnv
+          sourceRest rest slots)
+        0 := by
+  intro sourceRest rest slots
+  apply ReleasePlan.traverse (hplan := hplan)
+  · intro Γ
+    exact ProfileFundedEmitStateRunSoundBelow.id (fun hpre => hpre)
+  · intro Γ output i abs drops tailEmit hentry ih
+    exact ProfileFundedEmitStateRunSoundBelow.comp
+      (releaseSlotMany_profileFundedStateRunSound_below hentry sourceEnv
+        sourceRest rest slots)
+      ih
+  · intro Γ output i abs drops tailEmit hentry ih
+    exact ProfileFundedEmitStateRunSoundBelow.comp
+      (releaseSlotAffine_profileFundedStateRunSound_below hentry sourceEnv
+        sourceRest rest slots)
+      ih
+
+/-- The retained-field phase of a generated recursor branch carries its
+complete semantic graph while spending exactly one source retain candidate
+per selected field. -/
+theorem FieldRetainPlan.profileFundedValueStateRunSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit} (hplan : FieldRetainPlan input retains output emit) :
+    ∀ sourceEnv sourceRest rest extra slots borrowed,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit emit
+        (GraphOwnsVEnvRetains funRel recSelfRel input sourceEnv
+          sourceRest rest extra slots borrowed retains)
+        (GraphOwnsVEnvRetains funRel recSelfRel output sourceEnv
+          sourceRest rest extra slots borrowed [])
+        (IxIR0.DynamicCost.retain retains.length) := by
+  apply FieldRetainPlan.traverse (hplan := hplan)
+  · intro Γ sourceEnv sourceRest rest extra slots borrowed
+    change ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (_root_.id : Emit) _ _ 0
+    exact ProfileFundedEmitStateRunSoundBelow.id (fun hpre => hpre)
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih sourceEnv sourceRest rest extra slots borrowed
+    have hhead :=
+      ProfileFundedEmitStateRunSoundBelow.localRetainBelow
+        (retain_borrowed_into_entry_value_opSoundBelow
+          (funRel := funRel) (recSelfRel := recSelfRel)
+          (ctx := ctx) (cur := cur) (limit := limit)
+          (sourceEnv := sourceEnv) (sourceRest := sourceRest)
+          (rest := rest) (extra := extra) (slots := slots)
+          (borrowed := borrowed) (retains := retains)
+          (fieldAbs := fieldAbs) (remaining := remaining) hentry)
+        (by simp [localOpOwnershipAllowance])
+    have htail := ih sourceEnv sourceRest rest extra slots borrowed
+    apply ProfileFundedEmitStateRunSoundBelow.of_profile_eq
+      (ProfileFundedEmitStateRunSoundBelow.comp hhead htail)
+    ext <;> simp [IxIR0.DynamicCost.retain] <;> omega
+
+/-- Paired-cost composition of the three generated recursor-prefix phases:
+retain live fields, release the major, and release dead parameters. -/
+theorem recursorPrefixPlans_profileFundedValueStateRunSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    {fieldOutput rhsInput : VEnv} {fieldEmit parameterEmit : Emit}
+    (hfieldPlan : FieldRetainPlan
+      ⟨List.replicate nf (.slot 0 0 .many false),
+        (numArgs + 1) + nf⟩
+      (recursorFieldRetains (numArgs + 1) rhs nf)
+      fieldOutput fieldEmit)
+    (hparameterPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (nf + i) rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs)).map
+        (SlotDrop.offsetEntry nf))
+      rhsInput parameterEmit) :
+    ∀ sourceEnv sourceRest rest major fields,
+      ProfileFundedEmitStateRunSoundBelow ctx cur limit
+        (fieldEmit ∘
+          emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+          parameterEmit)
+        (GraphOwnsVEnvRetains funRel recSelfRel
+          (recursorInitialVEnv numArgs nf rhs) sourceEnv
+          sourceRest rest [⟨.shared, major⟩]
+          (recursorFieldSlots numArgs (major :: fields)) fields
+          (recursorFieldRetains (numArgs + 1) rhs nf))
+        (GraphOwnsVEnv funRel recSelfRel rhsInput sourceEnv
+          sourceRest rest)
+        (IxIR0.DynamicCost.retain
+          (recursorFieldRetains (numArgs + 1) rhs nf).length) := by
+  intro sourceEnv sourceRest rest major fields
+  let frame :=
+    parameterEntries 0 (List.replicate numArgs .many)
+        (fun i => countUses (nf + i) rhs) ++
+      [.recSelf (numArgs + 1)]
+  have hfieldFramed := hfieldPlan.frameEntries frame
+  have hfield :=
+    FieldRetainPlan.profileFundedValueStateRunSoundBelow hfieldFramed
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit)
+      sourceEnv sourceRest rest [⟨.shared, major⟩]
+      (recursorFieldSlots numArgs (major :: fields)) fields
+  have hfield' : ProfileFundedEmitStateRunSoundBelow ctx cur limit fieldEmit
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (recursorInitialVEnv numArgs nf rhs) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields
+        (recursorFieldRetains (numArgs + 1) rhs nf))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields [])
+      (IxIR0.DynamicCost.retain
+        (recursorFieldRetains (numArgs + 1) rhs nf).length) := by
+    simpa [frame, recursorInitialVEnv, frameVEnvEntries,
+      List.append_assoc] using hfield
+  have hmajor : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (emitOp (.drop (.var
+        ((frameVEnvEntries fieldOutput frame).rel numArgs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields [])
+      (GraphOwnsVEnvProtected funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame).bump sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      0 := by
+    apply ProfileFundedEmitStateRunSoundBelow.localZeroBelow
+      (profile := (0 : SourceProfile))
+    · exact drop_major_value_opSoundBelow
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit)
+        (Γ := frameVEnvEntries fieldOutput frame)
+        (sourceEnv := sourceEnv) (sourceRest := sourceRest)
+        (rest := rest)
+        (slots := recursorFieldSlots numArgs (major :: fields))
+        (borrowed := fields)
+        (majorAbs := numArgs) (major := major)
+        (by simp [recursorFieldSlots])
+    · simp [localOpOwnershipAllowance]
+  have hparameters :=
+    releasePlan_profileFundedValueStateRunSoundBelow hparameterPlan
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) sourceEnv
+      sourceRest rest (recursorFieldSlots numArgs (major :: fields))
+  have hparameters' : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      parameterEmit
+      (GraphOwnsVEnvProtected funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame).bump sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      (GraphOwnsVEnvProtected funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      0 := by
+    simpa [frameVEnvEntries, VEnv.bump, frame, List.append_assoc]
+      using hparameters
+  have hforget : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (_root_.id : Emit)
+      (GraphOwnsVEnvProtected funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest (recursorFieldSlots numArgs (major :: fields)))
+      (GraphOwnsVEnv funRel recSelfRel rhsInput sourceEnv sourceRest rest)
+      0 :=
+    ProfileFundedEmitStateRunSoundBelow.id (fun hpre => hpre.1)
+  have hcomposed := ProfileFundedEmitStateRunSoundBelow.comp hfield'
+    (ProfileFundedEmitStateRunSoundBelow.comp hmajor
+      (ProfileFundedEmitStateRunSoundBelow.comp hparameters' hforget))
+  simpa [frameVEnvEntries, VEnv.rel, Function.comp_def,
+    IxIR0.DynamicCost.Profile.add_zero,
+    IxIR0.DynamicCost.Profile.zero_add] using hcomposed
+
+/-- The compiler retains at most one entry for each constructor field. -/
+theorem recursorFieldRetains_length_le
+    (fieldAbs : Nat) (rhs : IxIR0.Expr) (fieldCount : Nat) :
+    (recursorFieldRetains fieldAbs rhs fieldCount).length ≤ fieldCount := by
+  exact recursorFieldRetains_traverse rhs
+    (Result := fun _ currentCount retains =>
+      retains.length ≤ currentCount)
+    (hnil := fun _ => Nat.le_refl 0)
+    (hskip := by
+      intro _ currentCount _ _ htail
+      exact Nat.le_trans htail (Nat.le_succ currentCount))
+    (hretain := by
+      intro _ _ _ _ htail
+      simpa using Nat.succ_le_succ htail)
+    fieldAbs fieldCount
+
+/-- Profiled inversion of a saturated source recursor reference.  Besides
+the selected source rule and exact RHS trace, the conclusion isolates the
+paired allowance contributed by that rule body and all of its fields. -/
+theorem sourceRecursorRef_saturatesProfile_inv
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {sourceFunction sourceResult major : IxIR0.Value}
+    {pre : List IxIR0.Value} {profile : SourceProfile}
+    (hlookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hpreLength : pre.length = numArgs)
+    (happlies : SourceAppliesProfile sourceCtx sourceFunction
+      (pre ++ [major]) sourceResult profile) :
+    ∃ tag fields rule bodyFuel bodyProfile,
+      IxIR0.majorCtor natLit major = .ok (tag, fields) ∧
+      rules[tag]? = some rule ∧
+      fields.length = rule.fields ∧
+      IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+        (fields.reverse ++ pre.reverse ++
+          [.pap (.rec_ address (numArgs + 1)) []])
+        rule.rhs sourceResult bodyProfile ∧
+      OwnershipAllowanceLE
+        (sourceProfileOwnershipAllowance
+          (IxIR0.DynamicCost.retain fields.length + bodyProfile))
+        (sourceProfileOwnershipAllowance profile) := by
+  have hfunction := href.recursorValue hlookup
+  subst sourceFunction
+  obtain ⟨middle, prefixProfile, tailProfile, hleft, hright, hprofile⟩ :=
+    happlies.splitAt pre.length
+  have htake : (pre ++ [major]).take pre.length = pre := by simp
+  have hdrop : (pre ++ [major]).drop pre.length = [major] := by simp
+  rw [htake] at hleft
+  rw [hdrop] at hright
+  have hunder : ([] ++ pre).length <
+      (IxIR0.Head.rec_ address (numArgs + 1)).arity := by
+    simp [IxIR0.Head.arity, hpreLength]
+  have hcanonical : SourceApplies sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) []) pre
+      (.pap (.rec_ address (numArgs + 1)) pre) :=
+    sourcePap_underfills hunder
+  have hmiddle : middle = .pap (.rec_ address (numArgs + 1)) pre :=
+    hleft.toSourceApplies.deterministic hcanonical
+  subst middle
+  cases hright with
+  | cons hstep htail =>
+      cases htail
+      cases hstep with
+      | pap hsaturate =>
+          cases hsaturate with
+          | pending hne =>
+              exact (hne (by simp [IxIR0.Head.arity, hpreLength])).elim
+          | full hlength hfire =>
+              cases hfire with
+              | recursor hlookup' hlast hmajor hrule hfields hbody =>
+                  rw [hlookup] at hlookup'
+                  cases hlookup'
+                  have hlast' : (pre ++ [major]).getLast? = some major := by
+                    simp
+                  rw [hlast'] at hlast
+                  cases hlast
+                  have hdropLast : (pre ++ [major]).dropLast = pre := by
+                    simp
+                  rw [hdropLast] at hbody
+                  refine ⟨_, _, _, _, _, hmajor, hrule, hfields, hbody, ?_⟩
+                  rw [← hprofile]
+                  simp [OwnershipAllowanceLE,
+                    sourceProfileOwnershipAllowance,
+                    IxIR0.DynamicCost.tick,
+                    IxIR0.DynamicCost.retain]
+                  omega
+
+/-- Execute one selected generated recursor branch with the exact profiled
+RHS trace.  The static retain plan consumes only the live-field subset; the
+source recursor fire funds all fields, so the difference is allowance slack. -/
+theorem lowerRecursorRule_branch_profile_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {fuel numArgs : Nat} {rule : IxIR0.RecRule}
+    {headState nextState : LowSt}
+    {fieldOutput rhsInput output : VEnv}
+    {fieldEmit parameterEmit bodyEmit : Emit} {av : AVal}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hself : CurrentSelfProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit)
+    (hfieldPlan : FieldRetainPlan
+      ⟨List.replicate rule.fields (.slot 0 0 .many false),
+        (numArgs + 1) + rule.fields⟩
+      (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields)
+      fieldOutput fieldEmit)
+    (hparameterPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (rule.fields + i) rule.rhs)).map
+        (SlotDrop.offsetEntry rule.fields))
+      rhsInput parameterEmit)
+    (hbodyRun : (lowerE src fuel rhsInput .shared rule.rhs).run headState =
+      .ok (output, bodyEmit, av) nextState)
+    (hextends : ExtraExtends nextState ambient)
+    {sourcePre : List IxIR0.Value} {pre : List RVal}
+    {sourceFields : List IxIR0.Value} {fields : List RVal}
+    {sourceSelf sourceValue : IxIR0.Value} {major : RVal}
+    {sourceFuel : Nat} {bodyProfile profile : SourceProfile}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      rule.rhs sourceValue bodyProfile)
+    (hprofileFunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain sourceFields.length + bodyProfile))
+      (sourceProfileOwnershipAllowance profile))
+    (hpreLength : pre.length = numArgs)
+    (hfieldsLength : fields.length = rule.fields)
+    {store store' : Store} {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root}
+    (hpreGraphs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourcePre pre)
+    (hfieldGraphs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceFields fields)
+    (hsourceSelf : recSelfRel sourceSelf (numArgs + 1))
+    (horder : AllocationOrderInvariant store)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceRest rest)
+    (hown : Sim.RootOwnership store
+      (Sim.rootsFor .shared (pre ++ [major]) ++ rest))
+    (hfieldWorld : ∀ field ∈ fields,
+      Sim.HasWorld store .shared field)
+    {branchFuel : Nat} (hbound : branchFuel ≤ limit)
+    (hbranchRun : runCode ctx branchFuel cur store
+      (fields.reverse ++ major :: pre.reverse)
+      (fieldEmit
+        (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+          (parameterEmit
+            (bodyEmit (.ret (av.toAtom output)))))) =
+        .ok (store', value)) :
+    ProfileFundedCodeRun ctx branchFuel cur store
+      (fields.reverse ++ major :: pre.reverse)
+      (fieldEmit
+        (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+          (parameterEmit
+            (bodyEmit (.ret (av.toAtom output))))))
+      store' value profile := by
+  have hentry := recursorAltEntry_value_state
+    (funRel := CompilerFunctionRel sourceCtx src ambient)
+    (recSelfRel := recSelfRel) numArgs rule.fields rule.rhs
+    hpreLength hfieldsLength hpreGraphs hfieldGraphs hsourceSelf hframe hown
+    hfieldWorld
+  have hprefix :=
+    recursorPrefixPlans_profileFundedValueStateRunSoundBelow
+      (funRel := CompilerFunctionRel sourceCtx src ambient)
+      (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+      (limit := limit) numArgs rule.fields rule.rhs hfieldPlan
+      hparameterPlan
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      sourceRest rest major fields
+  have hprotect : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (_root_.id : Emit)
+      (GraphOwnsVEnv
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel rhsInput
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceRest rest)
+      (GraphOwnsVEnvProtected
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel rhsInput
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceRest rest [])
+      0 :=
+    ProfileFundedEmitStateRunSoundBelow.id
+      (fun hpre => ⟨hpre, SlotsRealize.nil⟩)
+  have hbodySound := lowerE_run_profile_sound_within_currentSelf_below
+    henv hrepresented hcontracts hvalues hprofiles hsource hbodyRun
+    hextends hself
+  have hbodyCost := hbodySound.profileEmits sourceRest rest []
+  have hcombined := ProfileFundedEmitStateRunSoundBelow.comp hprefix
+    (ProfileFundedEmitStateRunSoundBelow.comp hprotect hbodyCost)
+  have hcombined' : ProfileFundedEmitStateRunSoundBelow ctx cur limit
+      (fieldEmit ∘
+        emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+        parameterEmit ∘ bodyEmit)
+      (GraphOwnsVEnvRetains
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+        (recursorInitialVEnv numArgs rule.fields rule.rhs)
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields))
+      (GraphOwnsResultProtected
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel output
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceValue .shared av sourceRest rest [])
+      (IxIR0.DynamicCost.retain
+          (recursorFieldRetains
+            (numArgs + 1) rule.rhs rule.fields).length + bodyProfile) := by
+    simpa [Function.comp_def, IxIR0.DynamicCost.Profile.add_zero,
+      IxIR0.DynamicCost.Profile.zero_add,
+      IxIR0.DynamicCost.Profile.add_assoc] using hcombined
+  have hargsBounds : ValuesInBounds store (pre ++ [major]) := by
+    intro runtime hmember
+    have hroot : (⟨.shared, runtime⟩ : Sim.Root) ∈
+        Sim.rootsFor .shared (pre ++ [major]) := by
+      simpa [Sim.rootsFor] using hmember
+    exact rootOwnership_valueInBounds_of_mem hown
+      (List.mem_append_left rest hroot)
+  have hfieldsBounds : ValuesInBounds store fields := by
+    intro field hmember
+    exact Sim.HasWorld.valueInBounds (hfieldWorld field hmember)
+  have hbranchBounds : ValuesInBounds store
+      (fields.reverse ++ major :: pre.reverse) := by
+    apply ValuesInBounds.append hfieldsBounds.reverse
+    simpa [List.reverse_append] using hargsBounds.reverse
+  have hcost := hcombined'.closeRet (av.toAtom output) hbound horder
+    hbranchBounds hentry (by
+      simpa [Function.comp_def] using hbranchRun)
+  apply hcost.monoProfile
+  have hlive :
+      (recursorFieldRetains
+        (numArgs + 1) rule.rhs rule.fields).length ≤ sourceFields.length := by
+    have hsourceFieldsLength : sourceFields.length = rule.fields := by
+      exact hfieldGraphs.length.trans hfieldsLength
+    rw [hsourceFieldsLength]
+    exact recursorFieldRetains_length_le _ _ _
+  have hsubset : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain
+            (recursorFieldRetains
+              (numArgs + 1) rule.rhs rule.fields).length + bodyProfile))
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain sourceFields.length + bodyProfile)) := by
+    simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+      IxIR0.DynamicCost.retain]
+    omega
+  exact hsubset.trans hprofileFunded
+
+private theorem costTraceExceptBindOk {error α β : Type}
+    (value : α) (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+/-- A generated recursor body preserves the exact source entry profile at
+the current target evaluator index.  Dispatch itself has no ownership
+growth; the selected branch carries the dynamically funded certificate. -/
+theorem lowerRecursor_profilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hrun : (lowerRecursor src compilerFuel numArgs natLit rules).run state =
+      .ok d finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address d
+      (List.replicate (numArgs + 1) .shared) sourceFunction limit := by
+  simp only [lowerRecursor] at hrun
+  obtain ⟨alts, rulesState, hrulesRun, hafterRules⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      (⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩ : FnDef) = d ∧
+        rulesState = finalState := by
+    simpa using hafterRules
+  obtain ⟨hd, hstate⟩ := hpure
+  subst d
+  subst rulesState
+  have hsourceLookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules) := by
+    rw [henv]
+    exact hsrc
+  have hsourceFunction := href.recursorValue hsourceLookup
+  subst sourceFunction
+  let recSelfRel : RecSelfRel := fun value arity =>
+    value = .pap (.rec_ address (numArgs + 1)) [] ∧
+      arity = numArgs + 1
+  obtain ⟨ownedD, hownedDecl, _, _, hownedContract⟩ :=
+    hcontracts.decls.recursor hsrc
+  have hownedD : ownedD =
+      (⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩ : FnDef) := by
+    have hsame : some (Decl.fn ownedD) = some
+        (.fn ⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩) :=
+      hownedDecl.symm.trans hdecl
+    exact Decl.fn.inj (Option.some.inj hsame)
+  subst ownedD
+  have hvalueContract : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared)
+      (.pap (.rec_ address (numArgs + 1)) []) := by
+    apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+    simp
+  have hprofileContract : FnProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared)
+      (.pap (.rec_ address (numArgs + 1)) []) limit := by
+    apply hprofiles.decls.fnContract hsrc (by rfl) hdecl href
+    simp
+  have hself : CurrentSelfProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit := by
+    refine ⟨rfl, by omega, hownedContract, ?_, ?_⟩
+    · intro candidate hcandidate
+      change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+        numArgs + 1 = numArgs + 1 at hcandidate
+      rcases hcandidate with ⟨rfl, _⟩
+      exact hvalueContract
+    · intro candidate hcandidate
+      change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+        numArgs + 1 = numArgs + 1 at hcandidate
+      rcases hcandidate with ⟨rfl, _⟩
+      exact ⟨address, hprofileContract⟩
+  have hfinalRepresented : ExtraRepresented ctx finalState :=
+    hrepresented.of_extends hextends
+  have hownershipSelf : CurrentSelfContractBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit := ⟨hself.result, hself.ownership.below limit⟩
+  have hplan : RecursorRulesPlanBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit src compilerFuel numArgs state rules.toList.zipIdx
+      finalState alts :=
+    recursorRulesPlanBelow_of_run (hcontracts.below limit).apply
+      (hcontracts.below limit).decls hownershipSelf rfl
+      compilerFuel numArgs hrulesRun hfinalRepresented
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    profile horder hruntimeLength hsourceLength hargs hentry hframe hown
+    htarget
+  have hsourceApply : SourceAppliesProfile sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) []) sourceArgs sourceResult
+      profile := by
+    cases hentry with
+    | applied happly => exact happly
+    | nullary _ =>
+      have : (0 : Nat) = numArgs + 1 := by
+        simpa using hsourceLength
+      omega
+  have hargsArity : args.length = numArgs + 1 := by
+    simpa using hruntimeLength
+  have hrootShape :
+      Sim.rootsForWorlds (List.replicate (numArgs + 1) .shared) args =
+        Sim.rootsFor .shared args :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hargsArity
+  rw [hrootShape] at hown
+  cases limit with
+  | zero => simp [runCode] at htarget
+  | succ branchFuel =>
+    cases hreverse : args.reverse with
+    | nil =>
+      have hargsNil : args = [] := by
+        have h := congrArg List.reverse hreverse
+        simpa using h
+      simp [hargsNil] at hargsArity
+    | cons major runtimePre =>
+      have hargsForm : args = runtimePre.reverse ++ [major] := by
+        have h := congrArg List.reverse hreverse
+        simpa [List.reverse_cons] using h
+      have hruntimePreLength : runtimePre.length = numArgs := by
+        rw [hargsForm] at hargsArity
+        simp only [List.length_append, List.length_reverse,
+          List.length_singleton] at hargsArity
+        omega
+      obtain ⟨sourcePre, sourceMajor, hsourceArgsForm,
+          hsourcePreLength, hpreGraphs, hmajorGraph⟩ :=
+        valuesGraph_splitLast hargs hargsForm hruntimePreLength
+      rw [hsourceArgsForm] at hsourceApply
+      obtain ⟨sourceTag, sourceFields, sourceRule, sourceFuel, bodyProfile,
+          hsourceMajor, hsourceRule, hsourceFieldsLength, hsourceEval,
+          hsourceFunded⟩ :=
+        sourceRecursorRef_saturatesProfile_inv hsourceLookup href
+          hsourcePreLength hsourceApply
+      have hmajorWorld : Sim.HasWorld store .shared major := by
+        apply hown.roots_world ⟨.shared, major⟩
+        apply List.mem_append_left rest
+        simp [Sim.rootsFor, hargsForm]
+      have hentryOwn : Sim.RootOwnership store
+          (Sim.rootsFor .shared (runtimePre.reverse ++ [major]) ++ rest) := by
+        simpa [hargsForm] using hown
+      rw [hreverse] at htarget
+      change runCode ctx (branchFuel + 1)
+          ⟨numArgs + 1, .shared, true,
+            .case (.var 0) natLit alts.toArray⟩
+          store (major :: runtimePre)
+          (.case (.var 0) natLit alts.toArray) =
+        .ok (store', value) at htarget
+      have hdispatch := htarget
+      rw [runCode.eq_def] at hdispatch
+      dsimp only at hdispatch
+      rw [show resolveAtom (major :: runtimePre) (.var 0) = .ok major
+        from rfl, costTraceExceptBindOk] at hdispatch
+      have finish {cidx selectedTag fieldCount : Nat} {body : Code}
+          (halt : alts.toArray.find? (fun alt => alt.cidx == cidx) =
+            some (.mk selectedTag fieldCount body))
+          (hcidx : cidx = sourceTag)
+          {targetFields : List RVal}
+          (hfieldGraphs : Sim.ValuesGraph
+            (CompilerFunctionRel sourceCtx src ambient) store
+            sourceFields targetFields)
+          (htargetFieldsLength : targetFields.length = fieldCount)
+          (hfieldWorld : ∀ field ∈ targetFields,
+            Sim.HasWorld store .shared field)
+          (hbranchRun : runCode ctx branchFuel
+            ⟨numArgs + 1, .shared, true,
+              .case (.var 0) natLit alts.toArray⟩
+            store (targetFields.reverse ++ major :: runtimePre) body =
+              .ok (store', value)) :
+          ProfileFundedCodeRun ctx (branchFuel + 1)
+            ⟨numArgs + 1, .shared, true,
+              .case (.var 0) natLit alts.toArray⟩
+            store (major :: runtimePre)
+            (.case (.var 0) natLit alts.toArray) store' value profile := by
+        obtain ⟨rule, headState, nextState, tailRules, tailAlts,
+            fieldOutput, fieldEmit, rhsInput, parameterEmit,
+            output, bodyEmit, av, hrule, _, hfieldCount,
+            hfieldPlan, hparameterPlan, hbodyRun, hbody, htailPlan⟩ :=
+          hplan.find?_run_plan_inv halt
+        have hsourceRuleAt : rules[cidx]? = some sourceRule := by
+          rw [hcidx]
+          exact hsourceRule
+        have hruleEq : rule = sourceRule :=
+          Option.some.inj (hrule.symm.trans hsourceRuleAt)
+        subst rule
+        have htargetRuleLength : targetFields.length = sourceRule.fields :=
+          htargetFieldsLength.trans hfieldCount
+        have htailExtends : ExtraExtends nextState finalState :=
+          (ExtraMonotone.listMapM
+            (lowerRecursorRule src compilerFuel numArgs)
+            (lowerRecursorRule_extraMonotone src compilerFuel numArgs)
+            tailRules) htailPlan.run
+        have hnextExtends : ExtraExtends nextState ambient :=
+          htailExtends.trans hextends
+        rw [hbody] at hbranchRun
+        obtain ⟨allowance, hbranchCost, hfunded⟩ :=
+          lowerRecursorRule_branch_profile_below
+            (recSelfRel := recSelfRel) (limit := branchFuel + 1)
+            (branchFuel := branchFuel)
+            henv hrepresented hcontracts hvalues hprofiles hself
+            hfieldPlan hparameterPlan hbodyRun hnextExtends
+            (sourcePre := sourcePre) (pre := runtimePre.reverse)
+            (sourceFields := sourceFields) (fields := targetFields)
+            (sourceSelf := .pap (.rec_ address (numArgs + 1)) [])
+            (sourceValue := sourceResult) (major := major)
+            hsourceEval hsourceFunded
+            (by simpa using hruntimePreLength)
+            htargetRuleLength hpreGraphs hfieldGraphs ⟨rfl, rfl⟩
+            horder hframe hentryOwn hfieldWorld (by omega)
+            (by simpa using hbranchRun)
+        refine ⟨allowance, ?_, hfunded⟩
+        refine
+          { startOrder := horder
+            envBounds := ?_
+            run := htarget
+            growth := hbranchCost.growth }
+        have hsuffix := hbranchCost.envBounds.drop targetFields.reverse.length
+        simpa using hsuffix
+      cases hmajorGraph with
+      | @lit literal =>
+        cases literal with
+        | str string => simp [IxIR0.majorCtor] at hsourceMajor
+        | nat n =>
+          cases hpeel : natLit with
+          | false => simp [IxIR0.majorCtor, hpeel] at hsourceMajor
+          | true =>
+              cases n with
+              | zero =>
+                have hmajorPair :
+                    0 = sourceTag ∧ sourceFields = [] := by
+                  simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                have htag : sourceTag = 0 := hmajorPair.1.symm
+                have hfields : sourceFields = [] := hmajorPair.2
+                subst sourceTag
+                subst sourceFields
+                cases halt : alts.toArray.find?
+                    (fun alt => alt.cidx == 0) with
+                | none => simp [hpeel, halt] at hdispatch
+                | some alt =>
+                  cases alt with
+                  | mk selectedTag fieldCount body =>
+                    cases fieldCount with
+                    | zero =>
+                      have hbranch := hdispatch
+                      simp [hpeel, halt] at hbranch
+                      simpa [hpeel] using
+                        (finish halt rfl Sim.ValuesGraph.nil rfl
+                          (by simp) (by simpa [hpeel] using hbranch))
+                    | succ fieldCount =>
+                      simp [hpeel, halt] at hdispatch
+              | succ n =>
+                have hmajorPair :
+                    1 = sourceTag ∧
+                      [.lit (.nat n)] = sourceFields := by
+                  simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                have htag : sourceTag = 1 := hmajorPair.1.symm
+                have hfields : sourceFields = [.lit (.nat n)] :=
+                  hmajorPair.2.symm
+                subst sourceTag
+                subst sourceFields
+                cases halt : alts.toArray.find?
+                    (fun alt => alt.cidx == 1) with
+                | none => simp [hpeel, halt] at hdispatch
+                | some alt =>
+                  cases alt with
+                  | mk selectedTag fieldCount body =>
+                    by_cases hfieldCount : fieldCount = 1
+                    · subst fieldCount
+                      have hbranch := hdispatch
+                      simp [hpeel, halt] at hbranch
+                      simpa [hpeel] using
+                        (finish halt rfl (.cons .lit .nil) rfl
+                          (by simp [Sim.HasWorld])
+                          (by simpa [hpeel] using hbranch))
+                    · simp [hpeel, halt, hfieldCount] at hdispatch
+      | erased => simp [IxIR0.majorCtor] at hsourceMajor
+      | @ctor sourceAddress sourceCtorTag sourceCtorFields loc
+          world rc cid targetFields hget haddress htag hfieldGraphs =>
+        have hmajorPair :
+            sourceCtorTag = sourceTag ∧
+              sourceCtorFields = sourceFields := by
+          simpa [IxIR0.majorCtor] using hsourceMajor
+        have hsourceTagEq : sourceTag = sourceCtorTag :=
+          hmajorPair.1.symm
+        have hsourceFieldsEq : sourceFields = sourceCtorFields :=
+          hmajorPair.2.symm
+        subst sourceTag
+        subst sourceFields
+        obtain ⟨ownedBox, hownedBox, hownedWorld⟩ := hmajorWorld
+        rw [hget] at hownedBox
+        have hboxEq :
+            (⟨world, rc, .ctorN cid targetFields⟩ : NodeBox) = ownedBox :=
+          Option.some.inj hownedBox
+        subst ownedBox
+        dsimp only [NodeBox.world] at hownedWorld
+        subst world
+        cases halt : alts.toArray.find?
+            (fun alt => alt.cidx == cid.cidx) with
+        | none => simp [hget, halt] at hdispatch
+        | some alt =>
+          cases alt with
+          | mk selectedTag fieldCount body =>
+            by_cases hsize : targetFields.size = fieldCount
+            · have hbranch := htarget
+              rw [Sim.runCode_case_ctor rfl hget halt hsize] at hbranch
+              rw [Array.foldl_cons_eq_reverse_append] at hbranch
+              exact finish halt htag (by simpa using hfieldGraphs)
+                (by simpa using hsize) (hown.caseFieldsBorrowed hget)
+                hbranch
+            · simp [hget, halt, hsize] at hdispatch
+      | function hget hfun hcaptures =>
+        simp [hget] at hdispatch
+
+/-- Declaration-facing adapter for the exact-profile recursor theorem. -/
+theorem lowerDecl_recursor_profilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hrun : (lowerDecl src compilerFuel
+      (address, .recursor numArgs natLit rules)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address d
+      (List.replicate (numArgs + 1) .shared) sourceFunction limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn actual) = some (address, Decl.fn d) ∧
+        recursorState = finalState := by
+    simpa using hafterRecursor
+  have hd : actual = d := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2
+  have hrecursorState : recursorState = finalState := hpure.2
+  subst actual
+  subst recursorState
+  intro before after args value sourceArgs sourceResult sourceRest rest
+    profile horder hruntimeLength hsourceLength hargs hentry hframe hown
+    hcodeRun
+  exact lowerRecursor_profilePreservesAt_within_below
+    henv hrepresented hcontracts hvalues hprofiles hsrc hdecl href
+    hrecursorRun hextends horder hruntimeLength hsourceLength hargs hentry
+    hframe hown hcodeRun
+
+/-- Contractive paired-cost adapter for a generated function body.  The
+source-entry callback may expose a smaller stripped-body profile; its
+allowance is transported to the complete call/reference profile after the
+zero-growth declaration-entry releases are composed. -/
+theorem lowerFnBody_parameterEntries_profileRun_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx}
+    {compilerFuel limit targetFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (modes : List Ixon.Uses) (world : Ixon.Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {bodyProfile profile : SourceProfile} {sourceFuel : Nat}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel
+      sourceArgs.reverse body sourceResult bodyProfile)
+    (hbodyFunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance bodyProfile)
+      (sourceProfileOwnershipAllowance profile))
+    {before after : Store} {args : List RVal} {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root}
+    (horder : AllocationOrderInvariant before)
+    (hruntimeLength : args.length = modes.length)
+    (hargs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) before sourceArgs args)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) before sourceRest rest)
+    (hown : Sim.RootOwnership before
+      (Sim.rootsForWorlds (modes.map worldOfUses) args ++ rest))
+    (htarget : targetFuel ≤ limit)
+    (hcodeRun : runCode ctx targetFuel
+      ⟨modes.length, world, papSafeFlag, code⟩ before args.reverse code =
+        .ok (after, value)) :
+    ProfileFundedCodeRun ctx targetFuel
+      ⟨modes.length, world, papSafeFlag, code⟩ before args.reverse code after value
+      profile := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun (by
+      simpa [input, remaining] using
+        parameterEntries_noRecSelf 0 modes remaining modes.length)
+  obtain ⟨plannedMiddle, plannedEmit, hplan, _⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hbodySound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit plannedMiddle output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world emit av
+      bodyProfile :=
+    lowerE_run_profile_sound_within_noRecSelf_below
+      (recSelfRel := recSelfRel)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hprofiles hsource hbodyRun
+      hextends hmiddleNo
+  have hbodySound' := hbodySound.monoProfile hbodyFunded
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+      sourceArgs.reverse sourceRest rest before args.reverse := by
+    refine ⟨(Sim.rootsForWorlds (modes.map worldOfUses) args).reverse,
+      ?_, hframe, ?_⟩
+    · simpa [input] using VEnvValueGraph.parameterEntries
+        (recSelfRel := recSelfRel) modes remaining hruntimeLength hargs hown
+    · exact hown.perm
+        ((List.reverse_perm
+          (Sim.rootsForWorlds (modes.map worldOfUses) args)).symm.append_right
+            rest)
+  have hargsBounds : ValuesInBounds before args := by
+    intro runtime hmember
+    obtain ⟨runtimeWorld, hroot⟩ :=
+      Sim.exists_root_mem_rootsForWorlds
+        (worlds := modes.map worldOfUses) (values := args)
+        (by simpa using hruntimeLength.symm) hmember
+    exact rootOwnership_valueInBounds_of_mem hown
+      (List.mem_append_left rest hroot)
+  have hreleaseCost :=
+    releasePlan_profileFundedValueStateRunSoundBelow hplan'
+      (funRel := CompilerFunctionRel sourceCtx src ambient)
+      (recSelfRel := recSelfRel) (ctx := ctx)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      (limit := limit) sourceArgs.reverse sourceRest rest []
+  have hbodyCost := hbodySound'.profileEmits sourceRest rest []
+  have hcombined := ProfileFundedEmitStateRunSoundBelow.comp
+    hreleaseCost hbodyCost
+  have hcombined' : ProfileFundedEmitStateRunSoundBelow ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit (plannedEmit ∘ emit)
+      (GraphOwnsVEnvProtected
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+        sourceArgs.reverse sourceRest rest [])
+      (GraphOwnsResultProtected
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel output
+        sourceArgs.reverse sourceResult world av sourceRest rest [])
+      profile :=
+    ProfileFundedEmitStateRunSoundBelow.of_profile_eq hcombined
+      (IxIR0.DynamicCost.Profile.zero_add profile)
+  have hcost := hcombined'.closeRet (av.toAtom output) htarget horder
+    hargsBounds.reverse ⟨hpre, SlotsRealize.nil⟩ (by
+      rw [hcode]
+      exact hcodeRun)
+  change plannedEmit (emit (.ret (av.toAtom output))) = code at hcode
+  simp only [Function.comp_apply] at hcost
+  rw [hcode] at hcost
+  exact hcost
+
+/-- Contractive paired-cost adapter for a generated function body.  The
+source-entry callback may expose a smaller stripped-body profile; its
+allowance is transported to the complete call/reference profile after the
+zero-growth declaration-entry releases are composed. -/
+theorem lowerFnBody_parameterEntries_profilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx}
+    {compilerFuel limit : Nat} {address : Ixon.Address}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (modes : List Ixon.Uses) (world : Ixon.Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceFunction : IxIR0.Value}
+    (hsaturates : ∀ {sourceArgs : List IxIR0.Value}
+        {sourceResult : IxIR0.Value} {profile : SourceProfile},
+      sourceArgs.length = modes.length →
+      SourceFnEntryProfile sourceCtx address sourceFunction sourceArgs
+        sourceResult profile →
+      ∃ sourceFuel bodyProfile,
+        IxIR0.DynamicCost.Eval sourceCtx sourceFuel sourceArgs.reverse body
+          sourceResult bodyProfile ∧
+        OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance bodyProfile)
+          (sourceProfileOwnershipAllowance profile)) :
+    FnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address
+      ⟨modes.length, world, papSafeFlag, code⟩ (modes.map worldOfUses)
+      sourceFunction limit := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun (by
+      simpa [input, remaining] using
+        parameterEntries_noRecSelf 0 modes remaining modes.length)
+  obtain ⟨plannedMiddle, plannedEmit, hplan, _⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  intro before after args value sourceArgs sourceResult sourceRest rest
+    profile horder hruntimeLength hsourceLength hargs hentry hframe hown
+    hcodeRun
+  obtain ⟨sourceFuel, bodyProfile, hsource, hbodyFunded⟩ :=
+    hsaturates (by simpa using hsourceLength) hentry
+  have hbodySound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit plannedMiddle output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world emit av
+      bodyProfile :=
+    lowerE_run_profile_sound_within_noRecSelf_below
+      (recSelfRel := recSelfRel)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hprofiles hsource hbodyRun
+      hextends hmiddleNo
+  have hbodySound' := hbodySound.monoProfile hbodyFunded
+  have hargsLength : args.length = modes.length := by
+    simpa using hruntimeLength
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+      sourceArgs.reverse sourceRest rest before args.reverse := by
+    refine ⟨(Sim.rootsForWorlds (modes.map worldOfUses) args).reverse,
+      ?_, hframe, ?_⟩
+    · simpa [input] using VEnvValueGraph.parameterEntries
+        (recSelfRel := recSelfRel) modes remaining hargsLength hargs hown
+    · exact hown.perm
+        ((List.reverse_perm
+          (Sim.rootsForWorlds (modes.map worldOfUses) args)).symm.append_right
+            rest)
+  have hargsBounds : ValuesInBounds before args := by
+    intro runtime hmember
+    obtain ⟨runtimeWorld, hroot⟩ :=
+      Sim.exists_root_mem_rootsForWorlds hruntimeLength.symm hmember
+    exact rootOwnership_valueInBounds_of_mem hown
+      (List.mem_append_left rest hroot)
+  have hreleaseCost :=
+    releasePlan_profileFundedValueStateRunSoundBelow hplan'
+      (funRel := CompilerFunctionRel sourceCtx src ambient)
+      (recSelfRel := recSelfRel) (ctx := ctx)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      (limit := limit) sourceArgs.reverse sourceRest rest []
+  have hbodyCost := hbodySound'.profileEmits sourceRest rest []
+  have hcombined := ProfileFundedEmitStateRunSoundBelow.comp
+    hreleaseCost hbodyCost
+  have hcombined' : ProfileFundedEmitStateRunSoundBelow ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit (plannedEmit ∘ emit)
+      (GraphOwnsVEnvProtected
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+        sourceArgs.reverse sourceRest rest [])
+      (GraphOwnsResultProtected
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel output
+        sourceArgs.reverse sourceResult world av sourceRest rest [])
+      profile :=
+    ProfileFundedEmitStateRunSoundBelow.of_profile_eq hcombined
+      (IxIR0.DynamicCost.Profile.zero_add profile)
+  have hrun' : runCode ctx limit
+      ⟨modes.length, world, papSafeFlag, code⟩ before args.reverse
+      ((plannedEmit ∘ emit) (.ret (av.toAtom output))) =
+        .ok (after, value) := by
+    rw [hcode]
+    exact hcodeRun
+  have hcost := hcombined'.closeRet (av.toAtom output)
+    (Nat.le_refl _) horder hargsBounds.reverse ⟨hpre, SlotsRealize.nil⟩
+    hrun'
+  change plannedEmit (emit (.ret (av.toAtom output))) = code at hcode
+  simp only [Function.comp_apply] at hcost
+  rw [hcode] at hcost
+  exact hcost
+
+/-- A profiled entry into an ordinary source definition exposes a stripped
+body trace funded by that entry.  Nonempty entries consume the residual
+lambda prefix; nullary entries recover the body trace already executed by
+the profiled source reference. -/
+theorem sourceDefn_entryProfile_stripLams
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {result : Ixon.Owned}
+    {body : IxIR0.Expr} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {profile : SourceProfile}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.defn result body))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : sourceArgs.length = (lamUses body).length)
+    (hentry : SourceFnEntryProfile sourceCtx address sourceFunction
+      sourceArgs sourceResult profile) :
+    ∃ bodyFuel bodyProfile,
+      IxIR0.DynamicCost.Eval sourceCtx bodyFuel sourceArgs.reverse
+        (stripLams body) sourceResult bodyProfile ∧
+      OwnershipAllowanceLE
+        (sourceProfileOwnershipAllowance bodyProfile)
+        (sourceProfileOwnershipAllowance profile) := by
+  cases hentry with
+  | @applied sourceArgument sourceArguments sourceResult profile happly =>
+      have hpositive : 0 < lamArity body := by
+        have hargPositive :
+            0 < (sourceArgument :: sourceArguments).length := by simp
+        rw [hlength, lamUses_length] at hargPositive
+        exact hargPositive
+      have hprefix := sourceRef_lambdaPrefix_nil henv hsrc hpositive href
+      have hfullLength :
+          (([] : List IxIR0.Value) ++
+            (sourceArgument :: sourceArguments)).length = lamArity body := by
+        simpa [lamUses_length] using hlength
+      obtain ⟨bodyFuel, bodyProfile, hbody, hfunded⟩ :=
+        LambdaPrefix.saturateProfile hprefix (reserve := 0) (by simp)
+          hfullLength happly (by simp)
+      refine ⟨bodyFuel, bodyProfile, ?_, ?_⟩
+      · simpa using hbody
+      · change OwnershipAllowanceLE
+          (sourceProfileOwnershipAllowance (0 + bodyProfile))
+          (sourceProfileOwnershipAllowance profile) at hfunded
+        rw [IxIR0.DynamicCost.Profile.zero_add] at hfunded
+        exact hfunded
+  | @nullary profile hrefProfile =>
+      obtain ⟨refFuel, sourceEnv, hrefEval⟩ := hrefProfile
+      cases hrefEval with
+      | @refDefn fuel env _ world declaredBody sourceValue bodyCost
+          hlookup hbody =>
+          rw [henv, hsrc] at hlookup
+          cases hlookup
+          have hzeroArity : ([] : List IxIR0.Value).length =
+              lamArity body := by
+            rw [← lamUses_length]
+            simpa using hlength
+          obtain ⟨bodyFuel, bodyProfile, hstripped, hfunded⟩ :=
+            dynamicEval_stripLams_of_appliesProfile sourceCtx hbody
+              hzeroArity (SourceAppliesProfile.nil)
+          refine ⟨bodyFuel, bodyProfile, by simpa using hstripped, ?_⟩
+          apply hfunded.trans
+          simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+            IxIR0.DynamicCost.tick] <;> omega
+      | @refCtor fuel env _ tag arity sourceValue saturateCost hlookup
+          hsaturate =>
+          rw [henv, hsrc] at hlookup
+          simp at hlookup
+      | @refRecursor fuel env _ numArgs natLit rules hlookup =>
+          rw [henv, hsrc] at hlookup
+          simp at hlookup
+      | @refExtern fuel env _ arity sourceValue saturateCost hlookup
+          hsaturate =>
+          rw [henv, hsrc] at hlookup
+          simp at hlookup
+
+/-- An ordinary definition emitted by a reachable lowering run satisfies
+its paired source-profile contract at the current evaluator index. -/
+theorem lowerDecl_defn_profilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {compilerFuel limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {address : Ixon.Address} {result : Ixon.Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some (.defn result body))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address d
+      ((lamUses body).map worldOfUses) sourceFunction limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result, result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧
+        bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result, result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hpreserves : FnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address
+      ⟨(lamUses body).length, result, result == .shared && papSafe body, code⟩
+      ((lamUses body).map worldOfUses) sourceFunction limit :=
+    lowerFnBody_parameterEntries_profilePreservesAt_within_below
+      (recSelfRel := fun _ _ => False)
+      (compilerFuel := compilerFuel) (limit := limit) (address := address)
+      henv hrepresented hcontracts hvalues hprofiles (lamUses body) result
+      (stripLams body) hadmissible (by simpa using hbodyRun) hextends
+      (by
+        intro sourceArgs sourceResult profile hlength hentry
+        exact sourceDefn_entryProfile_stripLams henv hsrc href hlength
+          hentry)
+  have hfn : (⟨(lamUses body).length, result, result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result, result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn]
+  intro before after args value sourceArgs sourceResult sourceRest rest
+    profile horder hruntimeLength hsourceLength hargs hentry hframe hown
+    hcodeRun
+  exact hpreserves horder hruntimeLength hsourceLength hargs hentry hframe
+    hown hcodeRun
+
+/-- Run-level ordinary-definition adapter for residual PAP saturation.  It
+uses the exact stripped-body trace exposed by the residual closure rather
+than rebuilding the already-consumed lambda-prefix profile. -/
+theorem lowerDecl_defn_profileRun_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {compilerFuel limit targetFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {address : Ixon.Address} {result : Ixon.Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {bodyProfile profile : SourceProfile} {sourceFuel : Nat}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel
+      sourceArgs.reverse (stripLams body) sourceResult bodyProfile)
+    (hbodyFunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance bodyProfile)
+      (sourceProfileOwnershipAllowance profile))
+    {before after : Store} {args : List RVal} {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root}
+    (horder : AllocationOrderInvariant before)
+    (hruntimeLength : args.length = (lamUses body).length)
+    (hargs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) before sourceArgs args)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) before sourceRest rest)
+    (hown : Sim.RootOwnership before
+      (Sim.rootsForWorlds ((lamUses body).map worldOfUses) args ++ rest))
+    (htarget : targetFuel ≤ limit)
+    (hcodeRun : runCode ctx targetFuel d before args.reverse d.body =
+      .ok (after, value)) :
+    ProfileFundedCodeRun ctx targetFuel d before args.reverse d.body after
+      value profile := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result, result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧
+        bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result, result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hfn : (⟨(lamUses body).length, result, result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result, result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn] at hcodeRun ⊢
+  exact lowerFnBody_parameterEntries_profileRun_below
+    (recSelfRel := fun _ _ => False)
+    (compilerFuel := compilerFuel) (limit := limit)
+    (targetFuel := targetFuel) henv hrepresented hcontracts hvalues
+    hprofiles (lamUses body) result (stripLams body) hadmissible
+    (by simpa using hbodyRun) hextends hsource hbodyFunded horder
+    hruntimeLength hargs hframe hown htarget hcodeRun
+
+/-! ### Whole-pass exact-profile contract sealing -/
+
+/-- At one target evaluator index, every callable source declaration emitted
+by an actual whole-pass run satisfies its exact-profile contract.  The proof
+uses only profile contracts strictly below the current index. -/
+theorem lowerAllAction_sourceFnProfilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel limit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit) :
+    SourceFnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit := by
+  intro address source worlds result d sourceFunction
+    hsrc hsignature hdecl href
+  obtain ⟨itemInitial, itemFinal, hrun, hextends⟩ :=
+    lowerAllAction_callable_decl_trace hlower htarget hsrc hsignature hdecl
+  cases source with
+  | defn sourceResult body =>
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    cases compilerFuel with
+    | zero =>
+      simp only [lowerDecl] at hrun
+      obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+        trackedBindRun_ok_inv hrun
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerFnBody] using hbodyRun)).elim
+    | succ bodyFuel =>
+      have hadmissible := lowerDecl_defn_parameterDropsAdmissible hrun
+      intro before after args value sourceArgs sourceValue sourceRest rest
+        profile horder hruntimeLength hsourceLength hargs hentry hframe hown
+        hcodeRun
+      exact lowerDecl_defn_profilePreservesAt_within_below
+        (compilerFuel := bodyFuel) (limit := limit)
+        henv hrepresented hcontracts hvalues hprofiles hsrc href hadmissible
+        (by simpa [Nat.succ_eq_add_one] using hrun) hextends
+        horder hruntimeLength hsourceLength hargs hentry hframe hown hcodeRun
+  | ctor tag arity =>
+    simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    intro before after args value sourceArgs sourceValue sourceRest rest
+      profile horder hruntimeLength hsourceLength hargs hentry hframe hown
+      hcodeRun
+    exact lowerDecl_recursor_profilePreservesAt_within_below
+      (compilerFuel := compilerFuel) (limit := limit)
+      henv hrepresented hcontracts hvalues hprofiles hsrc hdecl href hrun
+      hextends horder hruntimeLength hsourceLength hargs hentry hframe hown
+      hcodeRun
+  | extern arity =>
+    simp [sourceCallableSignature] at hsignature
+
+/-- Residual saturation of an ordinary source definition.  The source
+closure trace funds the stripped body and reserves exactly the already
+stored target prefix; the target `invoke` wrapper adds no further cost. -/
+theorem lowerAllAction_sourceDefnResidual_profile_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel limit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit)
+    {relatedFunction baseFunction sourceResult : IxIR0.Value}
+    {address : Ixon.Address} {arity : Nat}
+    {sourceCaptures sourceArgs : List IxIR0.Value}
+    {captures args : List RVal} {result : Ixon.Owned}
+    {body : IxIR0.Expr}
+    (hsrc : IxIR0.Env.ofList decls address = some (.defn result body))
+    (heligible : SourcePapEligible (.defn result body))
+    (harity : sourceDeclArity (.defn result body) = arity)
+    (href : SourceRefValue sourceCtx address baseFunction)
+    (hprefix : SourceApplies sourceCtx baseFunction sourceCaptures
+      relatedFunction)
+    (hunder : sourceCaptures.length < arity)
+    {before after : Store} {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {profile : SourceProfile}
+    (horder : AllocationOrderInvariant before)
+    (hcaptures : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      before sourceCaptures captures)
+    (hargs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      before sourceArgs args)
+    (hsource : SourceAppliesProfile sourceCtx relatedFunction sourceArgs
+      sourceResult profile)
+    (hnonempty : sourceArgs ≠ [])
+    (hfullLength : (sourceCaptures ++ sourceArgs).length = arity)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      before sourceRest rest)
+    (hown : Sim.RootOwnership before
+      (Sim.rootsFor .shared (captures ++ args) ++ rest))
+    (hinvoke : invoke ctx limit address (captures ++ args) before =
+      .ok (after, value)) :
+    RetainedProfileFundedInvokeRun ctx limit address (captures ++ args)
+      before after value sourceCaptures.length profile := by
+  obtain ⟨hresultShared, hsafe⟩ := heligible
+  subst result
+  obtain ⟨d, hdecl, harityDef, hresultDef, _⟩ :=
+    hcontracts.decls.defn hsrc
+  obtain ⟨itemInitial, itemFinal, hdeclRun, hextends⟩ :=
+    lowerAllAction_callable_decl_trace hlower htarget hsrc (by rfl) hdecl
+  have harity' : lamArity body = arity := by
+    simpa [sourceDeclArity] using harity
+  have hstoredUnder : sourceCaptures.length < lamArity body := by
+    rw [harity']
+    exact hunder
+  have hpositive : 0 < lamArity body := by omega
+  have hinitial := sourceRef_lambdaPrefix_nil henv hsrc hpositive href
+  have hresidual : LambdaPrefix [] body sourceCaptures relatedFunction := by
+    simpa using hinitial.append_of_applies hprefix (by
+      simpa using hstoredUnder)
+  have hfullLength' : (sourceCaptures ++ sourceArgs).length =
+      lamArity body := by
+    rw [harity']
+    exact hfullLength
+  obtain ⟨sourceFuel, bodyProfile, hbody, hfunded⟩ :=
+    LambdaPrefix.saturateProfile hresidual
+      (reserve := sourceCaptures.length)
+      (by simp) hfullLength' hsource hnonempty
+  have hfullGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      before (sourceCaptures ++ sourceArgs) (captures ++ args) :=
+    hcaptures.append hargs
+  have hmodes := papSafe_lamUses_eq_replicate hsafe
+  have hworlds : (lamUses body).map worldOfUses =
+      List.replicate (lamUses body).length .shared := by
+    rw [hmodes]
+    simp [worldOfUses]
+  have hruntimeLength : (captures ++ args).length =
+      (lamUses body).length := by
+    calc
+      (captures ++ args).length =
+          (sourceCaptures ++ sourceArgs).length := hfullGraph.length.symm
+      _ = lamArity body := hfullLength'
+      _ = (lamUses body).length := (lamUses_length body).symm
+  have hown' : Sim.RootOwnership before
+      (Sim.rootsForWorlds ((lamUses body).map worldOfUses)
+        (captures ++ args) ++ rest) := by
+    rw [hworlds]
+    rw [rootsForWorlds_replicate_eq_rootsFor .shared hruntimeLength]
+    exact hown
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerDecl] at hdeclRun
+    obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+      trackedBindRun_ok_inv hdeclRun
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerFnBody] using hbodyRun)).elim
+  | succ bodyCompilerFuel =>
+    have hadmissible := lowerDecl_defn_parameterDropsAdmissible hdeclRun
+    cases limit with
+    | zero => simp [invoke] at hinvoke
+    | succ innerFuel =>
+      simp only [invoke, hdecl] at hinvoke
+      split at hinvoke
+      · contradiction
+      next hlength =>
+        cases hcodeEval : runCode ctx innerFuel d before
+            (captures ++ args).reverse d.body with
+        | error error =>
+          rw [hcodeEval] at hinvoke
+          contradiction
+        | ok out =>
+          rw [hcodeEval] at hinvoke
+          change checkResultWorld d.result out = .ok (after, value) at hinvoke
+          obtain ⟨hpair, _⟩ := Sim.checkResultWorld_ok hinvoke
+          subst out
+          have hbody' : IxIR0.DynamicCost.Eval sourceCtx sourceFuel
+              (sourceCaptures ++ sourceArgs).reverse (stripLams body)
+              sourceResult bodyProfile := by
+            simpa using hbody
+          have hbodyCost := lowerDecl_defn_profileRun_below
+            (compilerFuel := bodyCompilerFuel) (limit := innerFuel)
+            (targetFuel := innerFuel) henv hrepresented hcontracts hvalues
+            (hprofiles.mono (by omega)) hadmissible
+            (by simpa [Nat.succ_eq_add_one] using hdeclRun) hextends
+            hbody' (OwnershipAllowanceLE.refl _)
+            horder hruntimeLength hfullGraph hframe hown' (Nat.le_refl _)
+            hcodeEval
+          have hinvokeCost : ProfileFundedInvokeRun ctx (innerFuel + 1)
+              address (captures ++ args) before after value bodyProfile :=
+            ProfileFundedInvokeRun.fn hdecl
+              (by simpa [declArity] using hlength) hbodyCost hinvoke
+          exact ⟨bodyProfile, hinvokeCost, hfunded⟩
+
+/-- A saturated extern PAP has a zero-cost invocation core.  The first
+source application still exposes the stored-prefix retain charge; its
+`evalApp` allocation allowance is harmless slack. -/
+theorem extern_retainedProfileFundedInvokeRun
+    {ctx : Ctx} {limit arity reserve : Nat} {address : Ixon.Address}
+    {args : List RVal} {before after : Store} {value : RVal}
+    {rest : List Sim.Root} {profile : SourceProfile}
+    (hdecl : ctx.decls address = some (.extern arity))
+    (harity : args.length = arity)
+    (horder : AllocationOrderInvariant before)
+    (hown : Sim.RootOwnership before
+      (Sim.rootsFor .shared args ++ rest))
+    (hinvoke : invoke ctx limit address args before = .ok (after, value))
+    (hfunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve +
+          IxIR0.DynamicCost.tick .evalApp))
+      (sourceProfileOwnershipAllowance profile)) :
+    RetainedProfileFundedInvokeRun ctx limit address args before after value
+      reserve profile := by
+  have hargsBounds : ValuesInBounds before args := by
+    intro runtime hmember
+    have hroot : (⟨.shared, runtime⟩ : Sim.Root) ∈
+        Sim.rootsFor .shared args ++ rest := by
+      apply List.mem_append_left rest
+      simpa [Sim.rootsFor] using hmember
+    exact rootOwnership_valueInBounds_of_mem hown hroot
+  have hprefixFunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve + 0))
+      (sourceProfileOwnershipAllowance profile) := by
+    apply (show OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve + 0))
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve +
+          IxIR0.DynamicCost.tick .evalApp)) by
+        simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+          IxIR0.DynamicCost.retain, IxIR0.DynamicCost.tick]).trans
+    exact hfunded
+  cases limit with
+  | zero => simp [invoke] at hinvoke
+  | succ innerFuel =>
+    simp only [invoke, hdecl] at hinvoke
+    split at hinvoke
+    · contradiction
+    next hlength =>
+      cases horacle : callScalarOracle ctx address args with
+      | error error =>
+        rw [horacle] at hinvoke
+        contradiction
+      | ok runtimeResult =>
+        rw [horacle] at hinvoke
+        have hpair : (before, runtimeResult) = (after, value) :=
+          Except.ok.inj hinvoke
+        cases hpair
+        exact ⟨0,
+          ProfileFundedInvokeRun.extern horder hargsBounds hdecl harity
+            horacle,
+          hprefixFunded⟩
+
+/-- Saturating a generated constructor wrapper spends exactly one fresh-node
+allowance in its declaration body.  That core charge is the source
+`evalApp` tick, while the enclosing retained certificate accounts for the
+already stored PAP prefix. -/
+theorem ctorWrapper_retainedProfileFundedInvokeRun
+    {ctx : Ctx} {limit tag arity reserve : Nat}
+    {source wrapper : Ixon.Address}
+    {args : List RVal} {before after : Store} {value : RVal}
+    {rest : List Sim.Root} {profile : SourceProfile}
+    (hdecl : ctx.decls wrapper = some (.fn
+      ⟨arity, .shared, true,
+        .letOp (.alloc .shared (ctorIdOf source tag)
+          (descendingVars arity).toArray) (.ret (.var 0))⟩))
+    (harity : args.length = arity)
+    (horder : AllocationOrderInvariant before)
+    (hown : Sim.RootOwnership before
+      (Sim.rootsFor .shared args ++ rest))
+    (hinvoke : invoke ctx limit wrapper args before = .ok (after, value))
+    (hfunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance
+        (IxIR0.DynamicCost.retain reserve +
+          IxIR0.DynamicCost.tick .evalApp))
+      (sourceProfileOwnershipAllowance profile)) :
+    RetainedProfileFundedInvokeRun ctx limit wrapper args before after value
+      reserve profile := by
+  let wrapperDef : FnDef :=
+    ⟨arity, .shared, true,
+      .letOp (.alloc .shared (ctorIdOf source tag)
+        (descendingVars arity).toArray) (.ret (.var 0))⟩
+  have hdecl' : ctx.decls wrapper = some (.fn wrapperDef) := by
+    simpa [wrapperDef] using hdecl
+  have hargsBounds : ValuesInBounds before args := by
+    intro runtime hmember
+    have hroot : (⟨.shared, runtime⟩ : Sim.Root) ∈
+        Sim.rootsFor .shared args ++ rest := by
+      apply List.mem_append_left rest
+      simpa [Sim.rootsFor] using hmember
+    exact rootOwnership_valueInBounds_of_mem hown hroot
+  cases limit with
+  | zero => simp [invoke] at hinvoke
+  | succ innerFuel =>
+    simp only [invoke, hdecl'] at hinvoke
+    split at hinvoke
+    · contradiction
+    next hlength =>
+      cases hcode : runCode ctx innerFuel wrapperDef before args.reverse
+          wrapperDef.body with
+      | error error =>
+        rw [hcode] at hinvoke
+        contradiction
+      | ok out =>
+        rw [hcode] at hinvoke
+        change checkResultWorld wrapperDef.result out =
+          .ok (after, value) at hinvoke
+        obtain ⟨hpair, _⟩ := Sim.checkResultWorld_ok hinvoke
+        subst out
+        have hbody : ProfileFundedCodeRun ctx innerFuel wrapperDef before
+            args.reverse wrapperDef.body after value
+            (IxIR0.DynamicCost.tick .evalApp) := by
+          exact ProfileFundedEmitRunSound.closeRet
+            (ProfileFundedEmitRunSound.localEval
+              (op := .alloc .shared (ctorIdOf source tag)
+                (descendingVars arity).toArray)
+              (by simp [localOpOwnershipAllowance]) .evalApp rfl)
+            (.var 0) horder hargsBounds.reverse (by
+              simpa [wrapperDef, emitOp] using hcode)
+        have hcore : ProfileFundedInvokeRun ctx (innerFuel + 1) wrapper args
+            before after value (IxIR0.DynamicCost.tick .evalApp) :=
+          ProfileFundedInvokeRun.fn hdecl'
+            (by simpa [wrapperDef] using harity) hbody hinvoke
+        exact ⟨IxIR0.DynamicCost.tick .evalApp, hcore, hfunded⟩
+
+/-- Run-level paired-cost adapter for a lifted lambda declaration.  Selected
+outer captures inhabit target argument slots but remain part of the source
+environment; only the supplied lambda parameters are prepended to that
+environment for the exact stripped-body trace. -/
+theorem lowerFnBody_liftedEntries_profileRun_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel targetFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (entryCount : Nat) (modes : List Ixon.Uses) (body : IxIR0.Expr)
+    (selected : Nat → Bool)
+    {state finalState : LowSt} {code : Code}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hselectDef : ∀ index, index < entryCount →
+      selected index = (countUses (modes.length + index) body != 0))
+    (hpositive : 0 < modes.length)
+    (hshared : modes.map worldOfUses =
+      List.replicate modes.length .shared)
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      (let captures := (List.range entryCount).filter selected
+       ⟨parameterEntries captures.length modes
+            (fun index => countUses index body) ++
+          selectedEntriesFrom selected
+            (fun index => countUses (modes.length + index) body)
+            (List.range entryCount) 0,
+        captures.length + modes.length⟩)
+      (let captures := (List.range entryCount).filter selected
+       parameterDrops captures.length modes
+          (fun index => countUses index body))
+      .shared body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceEnv selectedSources parameterSources : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {sourceFuel : Nat}
+    {bodyProfile profile : SourceProfile}
+    {store store' : Store} {captureArgs parameterArgs : List RVal}
+    {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root}
+    (hsourceLength : sourceEnv.length = entryCount)
+    (hselectedValues : ValuesAt sourceEnv
+      ((List.range entryCount).filter selected) selectedSources)
+    (hcaptureLength : captureArgs.length =
+      ((List.range entryCount).filter selected).length)
+    (hparameterLength : parameterArgs.length = modes.length)
+    (hcaptureGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store selectedSources
+      captureArgs)
+    (hparameterGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store parameterSources
+      parameterArgs)
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel
+      (parameterSources.reverse ++ sourceEnv) body sourceResult bodyProfile)
+    (hbodyFunded : OwnershipAllowanceLE
+      (sourceProfileOwnershipAllowance bodyProfile)
+      (sourceProfileOwnershipAllowance profile))
+    (horder : AllocationOrderInvariant store)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceRest rest)
+    (hown : Sim.RootOwnership store
+      (Sim.rootsFor .shared (captureArgs ++ parameterArgs) ++ rest))
+    (htarget : targetFuel ≤ limit)
+    (hcodeRun : runCode ctx targetFuel
+      ⟨((List.range entryCount).filter selected).length + modes.length,
+        .shared, true, code⟩ store (captureArgs ++ parameterArgs).reverse code =
+      .ok (store', value)) :
+    ProfileFundedCodeRun ctx targetFuel
+      ⟨((List.range entryCount).filter selected).length + modes.length,
+        .shared, true, code⟩ store (captureArgs ++ parameterArgs).reverse code
+      store' value profile := by
+  let captures := (List.range entryCount).filter selected
+  let parameterRemaining : Nat → Nat := fun index => countUses index body
+  let captureRemaining : Nat → Nat :=
+    fun index => countUses (modes.length + index) body
+  let outerEntries := selectedEntriesFrom selected captureRemaining
+    (List.range entryCount) 0
+  let input : VEnv :=
+    ⟨parameterEntries captures.length modes parameterRemaining ++ outerEntries,
+      captures.length + modes.length⟩
+  let drops := parameterDrops captures.length modes parameterRemaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops .shared body).run state =
+        .ok code finalState := by
+    simpa [input, drops, outerEntries, parameterRemaining, captureRemaining,
+      captures] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hinputNo : NoRecSelf input := by
+    apply NoRecSelf.appendEntries
+    · exact parameterEntries_noRecSelf captures.length modes
+        parameterRemaining (captures.length + modes.length)
+    · simpa [outerEntries] using
+        selectedEntriesFrom_noRecSelf selected captureRemaining
+          (List.range entryCount) 0 (captures.length + modes.length)
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun hinputNo
+  obtain ⟨parameterOutput, plannedEmit, hparameterPlan, _⟩ :=
+    parameterDrops_releasePlan_tracked_atDepth captures.length
+      (captures.length + modes.length) modes parameterRemaining
+      (by simpa [parameterRemaining] using hadmissible)
+  let plannedMiddle := frameVEnvEntries parameterOutput outerEntries
+  have hplan : ReleasePlan input drops plannedMiddle plannedEmit := by
+    have hframed := hparameterPlan.frameEntries outerEntries
+    simpa [input, drops, plannedMiddle, outerEntries, frameVEnvEntries]
+      using hframed
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hbodySound : LowerResultProfileSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩ limit plannedMiddle
+      output (parameterSources.reverse ++ sourceEnv)
+      (parameterSources.reverse ++ sourceEnv) sourceResult .shared emit av
+      bodyProfile :=
+    lowerE_run_profile_sound_within_noRecSelf_below
+      (recSelfRel := fun _ _ => False)
+      (cur := (⟨captures.length + modes.length, .shared, true, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hprofiles hsource hbodyRun
+      hextends hmiddleNo
+  have hbodySound' := hbodySound.monoProfile hbodyFunded
+  have hentryGraph : VEnvValueGraph
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) store
+      input (parameterSources.reverse ++ sourceEnv)
+      (captureArgs ++ parameterArgs).reverse
+      ((Sim.rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+        Sim.rootsFor .shared captureArgs) := by
+    simpa [input, outerEntries, parameterRemaining, captureRemaining,
+      captures] using
+      VEnvValueGraph.lifted (recSelfRel := fun _ _ => False)
+        entryCount modes parameterRemaining selected captureRemaining
+        hsourceLength hselectedValues hcaptureLength hparameterLength
+        hcaptureGraph hparameterGraph hpositive hshared hown
+  have hparameterRoots :
+      Sim.rootsForWorlds (modes.map worldOfUses) parameterArgs =
+        Sim.rootsFor .shared parameterArgs := by
+    rw [hshared]
+    exact rootsForWorlds_replicate_eq_rootsFor .shared hparameterLength
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) input
+      (parameterSources.reverse ++ sourceEnv) sourceRest rest store
+      (captureArgs ++ parameterArgs).reverse := by
+    refine ⟨(Sim.rootsForWorlds
+        (modes.map worldOfUses) parameterArgs).reverse ++
+          Sim.rootsFor .shared captureArgs, hentryGraph, hframe, ?_⟩
+    have hrootPerm :
+        (Sim.rootsFor .shared (captureArgs ++ parameterArgs) ++ rest).Perm
+          (((Sim.rootsForWorlds
+              (modes.map worldOfUses) parameterArgs).reverse ++
+              Sim.rootsFor .shared captureArgs) ++ rest) := by
+      rw [hparameterRoots]
+      simp only [Sim.rootsFor, List.map_append]
+      exact (List.perm_append_comm.trans
+        ((List.reverse_perm
+          (parameterArgs.map fun value =>
+            (⟨.shared, value⟩ : Sim.Root))).symm
+            |>.append_right (captureArgs.map fun value =>
+              (⟨.shared, value⟩ : Sim.Root)))).append_right rest
+    exact hown.perm hrootPerm
+  have hargsBounds : ValuesInBounds store
+      (captureArgs ++ parameterArgs) := by
+    intro runtime hmember
+    have hroot : (⟨.shared, runtime⟩ : Sim.Root) ∈
+        Sim.rootsFor .shared (captureArgs ++ parameterArgs) ++ rest := by
+      apply List.mem_append_left rest
+      simpa [Sim.rootsFor] using hmember
+    exact rootOwnership_valueInBounds_of_mem hown hroot
+  have hreleaseCost :=
+    releasePlan_profileFundedValueStateRunSoundBelow hplan
+      (funRel := CompilerFunctionRel sourceCtx src ambient)
+      (recSelfRel := fun _ _ => False) (ctx := ctx)
+      (cur := (⟨captures.length + modes.length, .shared, true, code⟩ : FnDef))
+      (limit := limit) (parameterSources.reverse ++ sourceEnv)
+      sourceRest rest []
+  have hbodyCost := hbodySound'.profileEmits sourceRest rest []
+  have hcombined := ProfileFundedEmitStateRunSoundBelow.comp
+    hreleaseCost hbodyCost
+  have hcombined' : ProfileFundedEmitStateRunSoundBelow ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩ limit
+      (plannedEmit ∘ emit)
+      (GraphOwnsVEnvProtected
+        (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) input
+        (parameterSources.reverse ++ sourceEnv) sourceRest rest [])
+      (GraphOwnsResultProtected
+        (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False)
+        output (parameterSources.reverse ++ sourceEnv) sourceResult .shared
+        av sourceRest rest []) profile :=
+    ProfileFundedEmitStateRunSoundBelow.of_profile_eq hcombined
+      (IxIR0.DynamicCost.Profile.zero_add profile)
+  have hcost := hcombined'.closeRet (av.toAtom output) htarget horder
+    hargsBounds.reverse ⟨hpre, SlotsRealize.nil⟩ (by
+      rw [hcode]
+      simpa [captures] using hcodeRun)
+  change plannedEmit (emit (.ret (av.toAtom output))) = code at hcode
+  simp only [Function.comp_apply] at hcost
+  rw [hcode] at hcost
+  simpa [captures] using hcost
+
+/-- Exact paired-cost certificate for saturating a compiler-provenanced
+lifted PAP.  Selected outer captures are split from stored lambda arguments;
+the residual source profile reserves both target portions and funds the
+stripped generated body. -/
+theorem invoke_lifted_retainedProfile_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {sourceFunction sourceResult : IxIR0.Value}
+    {address : Ixon.Address} {arity : Nat}
+    {captures sourceArgs : List IxIR0.Value}
+    {store store' : Store} {got args : List RVal} {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {profile : SourceProfile}
+    (hlifted : CompilerLiftedFunctionRel src ambient sourceFunction address
+      arity captures)
+    (hgot : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store captures got)
+    (hargs : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceArgs args)
+    (hsource : SourceAppliesProfile sourceCtx sourceFunction sourceArgs
+      sourceResult profile)
+    (hnonempty : sourceArgs ≠ [])
+    (hfullLength : (captures ++ sourceArgs).length = arity)
+    (horder : AllocationOrderInvariant store)
+    (hframe : Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceRest rest)
+    (hown : Sim.RootOwnership store
+      (Sim.rootsFor .shared (got ++ args) ++ rest))
+    (hinvoke : invoke ctx limit address (got ++ args) store =
+      .ok (store', value)) :
+    RetainedProfileFundedInvokeRun ctx limit address (got ++ args) store
+      store' value captures.length profile := by
+  obtain ⟨sourceEnv, expr, selectedSources, suppliedSources, hliftCode,
+      hselectedValues, hcaptures, harity, hprefix⟩ := hlifted
+  subst captures
+  subst arity
+  obtain ⟨bodyCompilerFuel, bodyInitial, bodyFinal, code, hsafe,
+      hbodyRun, hbodyExtends, hmember⟩ := hliftCode
+  have hselectedLength := hselectedValues.length
+  rw [← hselectedLength] at hmember
+  have hdecl : ctx.decls address = some (.fn
+      ⟨selectedSources.length + lamArity expr, .shared, true, code⟩) :=
+    hrepresented.decl hmember
+  have hmodes := papSafe_lamUses_eq_replicate hsafe
+  have hadmissible : ParameterDropsAdmissible (lamUses expr)
+      (fun index => countUses index (stripLams expr)) := by
+    rw [hmodes]
+    exact parameterDropsAdmissible_replicate_many _ _
+  have hselectDef : ∀ index, index < sourceEnv.length →
+      decide (0 < countUses index expr) =
+        (countUses ((lamUses expr).length + index) (stripLams expr) != 0) := by
+    intro index _
+    rw [lamUses_length]
+    rw [← countUses_eq_stripLams_shift expr index]
+    cases countUses index expr <;> rfl
+  have hshared : (lamUses expr).map worldOfUses =
+      List.replicate (lamUses expr).length .shared := by
+    rw [hmodes]
+    simp [worldOfUses]
+  have hpositive : 0 < (lamUses expr).length := by
+    have hunder := hprefix.length_lt_lamArity
+    rw [lamUses_length]
+    omega
+  have hselectedLe : selectedSources.length ≤ sourceEnv.length := by
+    rw [hselectedValues.length]
+    simpa [liftCaptureIndices] using List.length_filter_le
+      (fun index => countUses index expr > 0) (List.range sourceEnv.length)
+  have hreserve : (selectedSources ++ suppliedSources).length ≤
+      sourceEnv.length + suppliedSources.length := by
+    simp only [List.length_append]
+    omega
+  cases bodyCompilerFuel with
+  | zero =>
+    exact (trackedThrowRun_not_ok
+      (by simpa [lowerFnBody] using hbodyRun)).elim
+  | succ compilerFuel =>
+    let selectedArgs := got.take selectedSources.length
+    let suppliedArgs := got.drop selectedSources.length
+    have hgotSplit : selectedArgs ++ suppliedArgs = got :=
+      List.take_append_drop selectedSources.length got
+    have hselectedGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store selectedSources
+        selectedArgs := by
+      simpa [selectedArgs] using hgot.take selectedSources.length
+    have hsuppliedGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store suppliedSources
+        suppliedArgs := by
+      simpa [suppliedArgs] using hgot.drop selectedSources.length
+    have hparameterGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store
+        (suppliedSources ++ sourceArgs) (suppliedArgs ++ args) :=
+      hsuppliedGraph.append hargs
+    have hselectedArgsLength : selectedArgs.length =
+        (liftCaptureIndices sourceEnv.length expr).length := by
+      calc
+        selectedArgs.length = selectedSources.length := by
+          simpa [selectedArgs] using hselectedGraph.length.symm
+        _ = (liftCaptureIndices sourceEnv.length expr).length :=
+          hselectedValues.length
+    have htotalSplit : selectedArgs ++ (suppliedArgs ++ args) =
+        got ++ args := by
+      rw [← List.append_assoc, hgotSplit]
+    have hownSplit : Sim.RootOwnership store
+        (Sim.rootsFor .shared
+          (selectedArgs ++ (suppliedArgs ++ args)) ++ rest) := by
+      rw [htotalSplit]
+      exact hown
+    have hbodyRun' :
+        (lowerFnBody src (compilerFuel + 1)
+          (liftedBodyVEnv sourceEnv.length expr)
+          (liftedBodyDrops sourceEnv.length expr) .shared
+          (stripLams expr)).run bodyInitial = .ok code bodyFinal := by
+      simpa using hbodyRun
+    cases limit with
+    | zero => simp [invoke] at hinvoke
+    | succ innerFuel =>
+      simp only [invoke, hdecl] at hinvoke
+      split at hinvoke
+      · contradiction
+      next hlength =>
+        have htotalLength : (got ++ args).length =
+            selectedSources.length + lamArity expr := by
+          simpa using hlength
+        have hparameterLength : (suppliedArgs ++ args).length =
+            (lamUses expr).length := by
+          have hgotLength : got.length =
+              selectedSources.length + suppliedSources.length := by
+            simpa using hgot.length.symm
+          have hsuppliedLength : suppliedArgs.length =
+              suppliedSources.length := hsuppliedGraph.length.symm
+          simp only [List.length_append] at htotalLength ⊢
+          rw [lamUses_length]
+          omega
+        have hlambdaLength : (suppliedSources ++ sourceArgs).length =
+            lamArity expr := by
+          calc
+            (suppliedSources ++ sourceArgs).length =
+                (suppliedArgs ++ args).length := hparameterGraph.length
+            _ = (lamUses expr).length := hparameterLength
+            _ = lamArity expr := lamUses_length expr
+        obtain ⟨sourceFuel, bodyProfile, hsourceEval, hfunded⟩ :=
+          LambdaPrefix.saturateProfile hprefix
+            (reserve := (selectedSources ++ suppliedSources).length)
+            hreserve hlambdaLength hsource hnonempty
+        cases hcodeEval : runCode ctx innerFuel
+            ⟨selectedSources.length + lamArity expr, .shared, true, code⟩ store
+            (got ++ args).reverse code with
+        | error error =>
+          rw [hcodeEval] at hinvoke
+          contradiction
+        | ok out =>
+          rw [hcodeEval] at hinvoke
+          change checkResultWorld .shared out =
+            .ok (store', value) at hinvoke
+          obtain ⟨hpair, _⟩ := Sim.checkResultWorld_ok hinvoke
+          subst out
+          have hcodeEval' : runCode ctx innerFuel
+              ⟨(liftCaptureIndices sourceEnv.length expr).length +
+                  (lamUses expr).length,
+                .shared, true, code⟩ store
+              (selectedArgs ++ (suppliedArgs ++ args)).reverse code =
+              .ok (store', value) := by
+            rw [htotalSplit, ← hselectedLength, lamUses_length]
+            exact hcodeEval
+          have hbodyCost := lowerFnBody_liftedEntries_profileRun_below
+            (compilerFuel := compilerFuel) (limit := innerFuel)
+            (targetFuel := innerFuel) henv hrepresented hcontracts hvalues
+            (hprofiles.mono (by omega)) sourceEnv.length (lamUses expr)
+            (stripLams expr) (fun index => countUses index expr > 0)
+            hadmissible hselectDef hpositive hshared
+            (by simpa [liftedBodyVEnv, liftedBodyDrops,
+              liftCaptureIndices] using hbodyRun')
+            hbodyExtends (sourceEnv := sourceEnv)
+            (selectedSources := selectedSources)
+            (parameterSources := suppliedSources ++ sourceArgs)
+            (captureArgs := selectedArgs)
+            (parameterArgs := suppliedArgs ++ args)
+            (sourceResult := sourceResult) rfl
+            (by simpa [liftCaptureIndices] using hselectedValues)
+            (by simpa [liftCaptureIndices] using hselectedArgsLength)
+            hparameterLength hselectedGraph hparameterGraph
+            hsourceEval (OwnershipAllowanceLE.refl _) horder hframe
+            hownSplit (Nat.le_refl _) hcodeEval'
+          have hbodyCost' : ProfileFundedCodeRun ctx innerFuel
+              ⟨selectedSources.length + lamArity expr, .shared, true, code⟩ store
+              (got ++ args).reverse code store' value bodyProfile := by
+            rw [hselectedLength, ← lamUses_length, ← htotalSplit]
+            exact hbodyCost
+          have hcore : ProfileFundedInvokeRun ctx (innerFuel + 1) address
+              (got ++ args) store store' value bodyProfile :=
+            ProfileFundedInvokeRun.fn hdecl
+              (by simpa using hlength) hbodyCost' hinvoke
+          exact ⟨bodyProfile, hcore, by simpa using hfunded⟩
+
+/-- Profiled inversion of a residual recursor PAP at its final major
+argument.  Historical PAP arguments are not replayed: the current source
+profile itself funds one retain of the stored prefix plus the selected
+recursor rule's fields and exact RHS body. -/
+theorem sourceRecursorPap_saturatesProfile_inv
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {sourceResult major : IxIR0.Value}
+    {captured remainingPre : List IxIR0.Value}
+    {profile : SourceProfile}
+    (hlookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules))
+    (hpreLength : (captured ++ remainingPre).length = numArgs)
+    (happlies : SourceAppliesProfile sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) captured)
+      (remainingPre ++ [major]) sourceResult profile) :
+    ∃ tag fields rule bodyFuel bodyProfile,
+      IxIR0.majorCtor natLit major = .ok (tag, fields) ∧
+      rules[tag]? = some rule ∧
+      fields.length = rule.fields ∧
+      IxIR0.DynamicCost.Eval sourceCtx bodyFuel
+        (fields.reverse ++ (captured ++ remainingPre).reverse ++
+          [.pap (.rec_ address (numArgs + 1)) []])
+        rule.rhs sourceResult bodyProfile ∧
+      OwnershipAllowanceLE
+        (sourceProfileOwnershipAllowance
+          (IxIR0.DynamicCost.retain captured.length +
+            (IxIR0.DynamicCost.retain fields.length + bodyProfile)))
+        (sourceProfileOwnershipAllowance profile) := by
+  obtain ⟨middle, prefixProfile, tailProfile, hleft, hright, hprofile⟩ :=
+    happlies.splitAt remainingPre.length
+  have htake : (remainingPre ++ [major]).take remainingPre.length =
+      remainingPre := by simp
+  have hdrop : (remainingPre ++ [major]).drop remainingPre.length =
+      [major] := by simp
+  rw [htake] at hleft
+  rw [hdrop] at hright
+  have hunder : (captured ++ remainingPre).length <
+      (IxIR0.Head.rec_ address (numArgs + 1)).arity := by
+    simp [IxIR0.Head.arity, hpreLength]
+  have hcanonical : SourceApplies sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) captured) remainingPre
+      (.pap (.rec_ address (numArgs + 1))
+        (captured ++ remainingPre)) :=
+    sourcePap_underfills hunder
+  have hmiddle : middle = .pap (.rec_ address (numArgs + 1))
+      (captured ++ remainingPre) :=
+    hleft.toSourceApplies.deterministic hcanonical
+  subst middle
+  cases hright with
+  | cons hstep htail =>
+    cases htail
+    cases hstep with
+    | pap hsaturate =>
+      cases hsaturate with
+      | pending hne =>
+        exact (hne (by
+          simp only [List.length_append, List.length_singleton,
+            IxIR0.Head.arity]
+          simp only [List.length_append] at hpreLength
+          omega)).elim
+      | full hlength hfire =>
+        cases hfire with
+        | recursor hlookup' hlast hmajor hrule hfields hbody =>
+          rw [hlookup] at hlookup'
+          cases hlookup'
+          have hlast' :
+              ((captured ++ remainingPre) ++ [major]).getLast? =
+                some major := by simp
+          rw [hlast'] at hlast
+          cases hlast
+          have hdropLast :
+              ((captured ++ remainingPre) ++ [major]).dropLast =
+                captured ++ remainingPre := by simp
+          rw [hdropLast] at hbody
+          refine ⟨_, _, _, _, _, hmajor, hrule, hfields, hbody, ?_⟩
+          rw [← hprofile]
+          simp [OwnershipAllowanceLE, sourceProfileOwnershipAllowance,
+            IxIR0.DynamicCost.tick, IxIR0.DynamicCost.retain]
+          omega
+
+/-- Saturating a residual source recursor PAP executes the generated case
+dispatcher with a core profile consisting only of selected-field retains
+and the exact rule body.  The current application profile separately funds
+the already stored PAP prefix. -/
+theorem lowerRecursor_residual_profile_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hrun : (lowerRecursor src compilerFuel numArgs natLit rules).run state =
+      .ok d finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceCaptures sourceArgs : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {captures args : List RVal}
+    {store store' : Store} {value : RVal}
+    {sourceRest : List (Ixon.Owned × IxIR0.Value)}
+    {rest : List Sim.Root} {profile : SourceProfile}
+    (hcaptures : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceCaptures
+      captures)
+    (hargs : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceArgs args)
+    (hsource : SourceAppliesProfile sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) sourceCaptures)
+      sourceArgs sourceResult profile)
+    (hnonempty : sourceArgs ≠ [])
+    (hfullLength : (sourceCaptures ++ sourceArgs).length = numArgs + 1)
+    (horder : AllocationOrderInvariant store)
+    (hframe : Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceRest rest)
+    (hown : Sim.RootOwnership store
+      (Sim.rootsFor .shared (captures ++ args) ++ rest))
+    (hinvoke : invoke ctx limit address (captures ++ args) store =
+      .ok (store', value)) :
+    RetainedProfileFundedInvokeRun ctx limit address (captures ++ args)
+      store store' value sourceCaptures.length profile := by
+  simp only [lowerRecursor] at hrun
+  obtain ⟨alts, rulesState, hrulesRun, hafterRules⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      (⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩ : FnDef) = d ∧
+        rulesState = finalState := by
+    simpa using hafterRules
+  obtain ⟨hd, hstate⟩ := hpure
+  subst d
+  subst rulesState
+  have hsourceLookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules) := by
+    rw [henv]
+    exact hsrc
+  have hsourceFunction := href.recursorValue hsourceLookup
+  subst sourceFunction
+  let recSelfRel : RecSelfRel := fun candidate candidateArity =>
+    candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+      candidateArity = numArgs + 1
+  obtain ⟨ownedD, hownedDecl, _, _, hownedContract⟩ :=
+    hcontracts.decls.recursor hsrc
+  have hownedD : ownedD =
+      (⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩ : FnDef) := by
+    have hsame : some (Decl.fn ownedD) = some
+        (.fn ⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩) :=
+      hownedDecl.symm.trans hdecl
+    exact Decl.fn.inj (Option.some.inj hsame)
+  subst ownedD
+  have hvalueContract : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared)
+      (.pap (.rec_ address (numArgs + 1)) []) := by
+    apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+    simp
+  have hprofileContract : FnProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx address
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared)
+      (.pap (.rec_ address (numArgs + 1)) []) limit := by
+    apply hprofiles.decls.fnContract hsrc (by rfl) hdecl href
+    simp
+  have hself : CurrentSelfProfileContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit := by
+    refine ⟨rfl, by omega, hownedContract, ?_, ?_⟩
+    · intro candidate hcandidate
+      change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+        numArgs + 1 = numArgs + 1 at hcandidate
+      rcases hcandidate with ⟨rfl, _⟩
+      exact hvalueContract
+    · intro candidate hcandidate
+      change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+        numArgs + 1 = numArgs + 1 at hcandidate
+      rcases hcandidate with ⟨rfl, _⟩
+      exact ⟨address, hprofileContract⟩
+  have hfinalRepresented : ExtraRepresented ctx finalState :=
+    hrepresented.of_extends hextends
+  have hownershipSelf : CurrentSelfContractBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit := ⟨hself.result, hself.ownership.below limit⟩
+  have hplan : RecursorRulesPlanBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit src compilerFuel numArgs state rules.toList.zipIdx
+      finalState alts :=
+    recursorRulesPlanBelow_of_run (hcontracts.below limit).apply
+      (hcontracts.below limit).decls hownershipSelf rfl
+      compilerFuel numArgs hrulesRun hfinalRepresented
+  have hfullGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store
+      (sourceCaptures ++ sourceArgs) (captures ++ args) :=
+    hcaptures.append hargs
+  have hargsArity : (captures ++ args).length = numArgs + 1 :=
+    hfullGraph.length.symm.trans hfullLength
+  cases limit with
+  | zero => simp [invoke] at hinvoke
+  | succ branchFuel =>
+    simp only [invoke, hdecl] at hinvoke
+    split at hinvoke
+    · contradiction
+    next hlength =>
+      cases hcodeEval : runCode ctx branchFuel
+          ⟨numArgs + 1, .shared, true,
+            .case (.var 0) natLit alts.toArray⟩
+          store (captures ++ args).reverse
+          (.case (.var 0) natLit alts.toArray) with
+      | error error =>
+        rw [hcodeEval] at hinvoke
+        contradiction
+      | ok out =>
+        rw [hcodeEval] at hinvoke
+        change checkResultWorld .shared out =
+          .ok (store', value) at hinvoke
+        obtain ⟨hpair, _⟩ := Sim.checkResultWorld_ok hinvoke
+        subst out
+        cases hreverseArgs : args.reverse with
+        | nil =>
+          have hargsNil : args = [] := by
+            have h := congrArg List.reverse hreverseArgs
+            simpa using h
+          have hsourceArgsNil : sourceArgs = [] := by
+            have hlength := hargs.length
+            simpa [hargsNil] using hlength
+          exact (hnonempty hsourceArgsNil).elim
+        | cons major runtimeNewPre =>
+          have hargsForm : args = runtimeNewPre.reverse ++ [major] := by
+            have h := congrArg List.reverse hreverseArgs
+            simpa [List.reverse_cons] using h
+          obtain ⟨sourceRemainingPre, sourceMajor, hsourceArgsForm,
+              hsourceRemainingPreLength, hremainingGraphs,
+              hmajorGraph⟩ :=
+            valuesGraph_splitLast hargs hargsForm rfl
+          rw [hsourceArgsForm] at hsource
+          have hsourcePreLength :
+              (sourceCaptures ++ sourceRemainingPre).length = numArgs := by
+            rw [hsourceArgsForm] at hfullLength
+            simp only [List.length_append, List.length_singleton]
+              at hfullLength ⊢
+            omega
+          obtain ⟨sourceTag, sourceFields, sourceRule, sourceFuel,
+              bodyProfile, hsourceMajor, hsourceRule,
+              hsourceFieldsLength, hsourceEval, hsourceFunded⟩ :=
+            sourceRecursorPap_saturatesProfile_inv hsourceLookup
+              hsourcePreLength hsource
+          let runtimePre := runtimeNewPre ++ captures.reverse
+          have hfullArgsForm : captures ++ args =
+              runtimePre.reverse ++ [major] := by
+            simp [runtimePre, hargsForm, List.reverse_append]
+          have hpreGraphs : Sim.ValuesGraph
+              (CompilerFunctionRel sourceCtx src ambient) store
+              (sourceCaptures ++ sourceRemainingPre) runtimePre.reverse := by
+            simpa [runtimePre, List.reverse_append] using
+              hcaptures.append hremainingGraphs
+          have hruntimePreLength : runtimePre.length = numArgs := by
+            have hlength := hpreGraphs.length.symm.trans hsourcePreLength
+            simpa using hlength
+          have hmajorWorld : Sim.HasWorld store .shared major := by
+            apply hown.roots_world ⟨.shared, major⟩
+            apply List.mem_append_left rest
+            simp [Sim.rootsFor, hfullArgsForm]
+          have hentryOwn : Sim.RootOwnership store
+              (Sim.rootsFor .shared
+                (runtimePre.reverse ++ [major]) ++ rest) := by
+            simpa [hfullArgsForm] using hown
+          obtain ⟨caseFuel, rfl⟩ : ∃ caseFuel, branchFuel = caseFuel + 1 := by
+            cases branchFuel with
+            | zero => simp [runCode] at hcodeEval
+            | succ caseFuel => exact ⟨caseFuel, by omega⟩
+          have htarget : runCode ctx (caseFuel + 1)
+              ⟨numArgs + 1, .shared, true,
+                .case (.var 0) natLit alts.toArray⟩
+              store (major :: runtimePre)
+              (.case (.var 0) natLit alts.toArray) =
+              .ok (store', value) := by
+            have hcodeEval' := hcodeEval
+            rw [hfullArgsForm] at hcodeEval'
+            simpa using hcodeEval'
+          have hdispatch := htarget
+          rw [runCode.eq_def] at hdispatch
+          dsimp only at hdispatch
+          rw [show resolveAtom (major :: runtimePre) (.var 0) = .ok major
+            from rfl, costTraceExceptBindOk] at hdispatch
+          let coreProfile :=
+            IxIR0.DynamicCost.retain sourceFields.length + bodyProfile
+          have finish {cidx selectedTag fieldCount : Nat} {body : Code}
+              (halt : alts.toArray.find? (fun alt => alt.cidx == cidx) =
+                some (.mk selectedTag fieldCount body))
+              (hcidx : cidx = sourceTag)
+              {targetFields : List RVal}
+              (hfieldGraphs : Sim.ValuesGraph
+                (CompilerFunctionRel sourceCtx src ambient) store
+                sourceFields targetFields)
+              (htargetFieldsLength : targetFields.length = fieldCount)
+              (hfieldWorld : ∀ field ∈ targetFields,
+                Sim.HasWorld store .shared field)
+              (hbranchRun : runCode ctx caseFuel
+                ⟨numArgs + 1, .shared, true,
+                  .case (.var 0) natLit alts.toArray⟩
+                store (targetFields.reverse ++ major :: runtimePre) body =
+                  .ok (store', value)) :
+              ProfileFundedCodeRun ctx (caseFuel + 1)
+                ⟨numArgs + 1, .shared, true,
+                  .case (.var 0) natLit alts.toArray⟩
+                store (major :: runtimePre)
+                (.case (.var 0) natLit alts.toArray) store' value
+                coreProfile := by
+            obtain ⟨rule, headState, nextState, tailRules, tailAlts,
+                fieldOutput, fieldEmit, rhsInput, parameterEmit,
+                output, bodyEmit, av, hrule, _, hfieldCount,
+                hfieldPlan, hparameterPlan, hbodyRun, hbody,
+                htailPlan⟩ := hplan.find?_run_plan_inv halt
+            have hsourceRuleAt : rules[cidx]? = some sourceRule := by
+              rw [hcidx]
+              exact hsourceRule
+            have hruleEq : rule = sourceRule :=
+              Option.some.inj (hrule.symm.trans hsourceRuleAt)
+            subst rule
+            have htargetRuleLength : targetFields.length =
+                sourceRule.fields :=
+              htargetFieldsLength.trans hfieldCount
+            have htailExtends : ExtraExtends nextState finalState :=
+              (ExtraMonotone.listMapM
+                (lowerRecursorRule src compilerFuel numArgs)
+                (lowerRecursorRule_extraMonotone src compilerFuel numArgs)
+                tailRules) htailPlan.run
+            have hnextExtends : ExtraExtends nextState ambient :=
+              htailExtends.trans hextends
+            rw [hbody] at hbranchRun
+            obtain ⟨allowance, hbranchCost, hfunded⟩ :=
+              lowerRecursorRule_branch_profile_below
+                (recSelfRel := recSelfRel) (limit := (caseFuel + 1) + 1)
+                (branchFuel := caseFuel)
+                henv hrepresented hcontracts hvalues hprofiles hself
+                hfieldPlan hparameterPlan hbodyRun hnextExtends
+                (sourcePre := sourceCaptures ++ sourceRemainingPre)
+                (pre := runtimePre.reverse)
+                (sourceFields := sourceFields) (fields := targetFields)
+                (sourceSelf := .pap (.rec_ address (numArgs + 1)) [])
+                (sourceValue := sourceResult) (major := major)
+                (profile := coreProfile) hsourceEval
+                (OwnershipAllowanceLE.refl _)
+                (by simpa using hruntimePreLength)
+                htargetRuleLength hpreGraphs hfieldGraphs ⟨rfl, rfl⟩
+                horder hframe hentryOwn hfieldWorld (by omega)
+                (by simpa using hbranchRun)
+            refine ⟨allowance, ?_, hfunded⟩
+            refine
+              { startOrder := horder
+                envBounds := ?_
+                run := ?_
+                growth := hbranchCost.growth }
+            · have hsuffix :=
+                hbranchCost.envBounds.drop targetFields.reverse.length
+              simpa using hsuffix
+            · simpa using htarget
+          have hbodyCost : ProfileFundedCodeRun ctx (caseFuel + 1)
+              ⟨numArgs + 1, .shared, true,
+                .case (.var 0) natLit alts.toArray⟩
+              store (major :: runtimePre)
+              (.case (.var 0) natLit alts.toArray) store' value
+              coreProfile := by
+            cases hmajorGraph with
+            | @lit literal =>
+              cases literal with
+              | str string => simp [IxIR0.majorCtor] at hsourceMajor
+              | nat n =>
+                cases hpeel : natLit with
+                | false =>
+                  simp [IxIR0.majorCtor, hpeel] at hsourceMajor
+                | true =>
+                  cases n with
+                  | zero =>
+                    have hmajorPair :
+                        0 = sourceTag ∧ sourceFields = [] := by
+                      simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                    have htag : sourceTag = 0 := hmajorPair.1.symm
+                    have hfields : sourceFields = [] := hmajorPair.2
+                    subst sourceTag
+                    subst sourceFields
+                    cases halt : alts.toArray.find?
+                        (fun alt => alt.cidx == 0) with
+                    | none => simp [hpeel, halt] at hdispatch
+                    | some alt =>
+                      cases alt with
+                      | mk selectedTag fieldCount body =>
+                        cases fieldCount with
+                        | zero =>
+                          have hbranch := hdispatch
+                          simp [hpeel, halt] at hbranch
+                          simpa [hpeel] using
+                            (finish halt rfl Sim.ValuesGraph.nil rfl
+                              (by simp)
+                              (by simpa [hpeel] using hbranch))
+                        | succ fieldCount =>
+                          simp [hpeel, halt] at hdispatch
+                  | succ n =>
+                    have hmajorPair :
+                        1 = sourceTag ∧
+                          [.lit (.nat n)] = sourceFields := by
+                      simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                    have htag : sourceTag = 1 := hmajorPair.1.symm
+                    have hfields : sourceFields = [.lit (.nat n)] :=
+                      hmajorPair.2.symm
+                    subst sourceTag
+                    subst sourceFields
+                    cases halt : alts.toArray.find?
+                        (fun alt => alt.cidx == 1) with
+                    | none => simp [hpeel, halt] at hdispatch
+                    | some alt =>
+                      cases alt with
+                      | mk selectedTag fieldCount body =>
+                        by_cases hfieldCount : fieldCount = 1
+                        · subst fieldCount
+                          have hbranch := hdispatch
+                          simp [hpeel, halt] at hbranch
+                          simpa [hpeel] using
+                            (finish halt rfl (.cons .lit .nil) rfl
+                              (by simp [Sim.HasWorld])
+                              (by simpa [hpeel] using hbranch))
+                        · simp [hpeel, halt, hfieldCount] at hdispatch
+            | erased => simp [IxIR0.majorCtor] at hsourceMajor
+            | @ctor sourceAddress sourceCtorTag sourceCtorFields loc
+                world rc cid targetFields hget haddress htag hfieldGraphs =>
+              have hmajorPair :
+                  sourceCtorTag = sourceTag ∧
+                    sourceCtorFields = sourceFields := by
+                simpa [IxIR0.majorCtor] using hsourceMajor
+              have hsourceTagEq : sourceTag = sourceCtorTag :=
+                hmajorPair.1.symm
+              have hsourceFieldsEq : sourceFields = sourceCtorFields :=
+                hmajorPair.2.symm
+              subst sourceTag
+              subst sourceFields
+              obtain ⟨ownedBox, hownedBox, hownedWorld⟩ := hmajorWorld
+              rw [hget] at hownedBox
+              have hboxEq :
+                  (⟨world, rc, .ctorN cid targetFields⟩ : NodeBox) =
+                    ownedBox :=
+                Option.some.inj hownedBox
+              subst ownedBox
+              dsimp only [NodeBox.world] at hownedWorld
+              subst world
+              cases halt : alts.toArray.find?
+                  (fun alt => alt.cidx == cid.cidx) with
+              | none => simp [hget, halt] at hdispatch
+              | some alt =>
+                cases alt with
+                | mk selectedTag fieldCount body =>
+                  by_cases hsize : targetFields.size = fieldCount
+                  · have hbranch := htarget
+                    rw [Sim.runCode_case_ctor rfl hget halt hsize] at hbranch
+                    rw [Array.foldl_cons_eq_reverse_append] at hbranch
+                    exact finish halt htag (by simpa using hfieldGraphs)
+                      (by simpa using hsize) (hown.caseFieldsBorrowed hget)
+                      hbranch
+                  · simp [hget, halt, hsize] at hdispatch
+            | function hget hfun hcaptured =>
+              simp [hget] at hdispatch
+          have hcore : ProfileFundedInvokeRun ctx ((caseFuel + 1) + 1) address
+              (captures ++ args) store store' value coreProfile :=
+            ProfileFundedInvokeRun.fn hdecl (by simpa using hlength)
+              (by simpa [hfullArgsForm] using hbodyCost) hinvoke
+          exact ⟨coreProfile, hcore, by
+            simpa [coreProfile] using hsourceFunded⟩
+
+/-- At one evaluator index, every residual function represented by an
+actual whole-pass run preserves its exact source profile.  Static source
+PAPs, generated constructor wrappers, and lifted lambdas are discharged by
+their respective run-level adapters. -/
+theorem lowerAllAction_residualFnProfilePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel limit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprofiles : CompilerProfileContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit) :
+    ResidualFnProfilePreservesAt
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx limit := by
+  intro before after sourceFunction sourceResult address arity
+    sourceCaptures sourceArgs captures args value sourceRest rest profile
+    horder hrel hcaptures hargs hsource hnonempty hfullLength hframe hown
+    hinvoke
+  have hprefixFunded :=
+    CompilerFunctionRel.underApplyProfileFunding henv hrel hsource hnonempty
+  cases hrel with
+  | @source relatedFunction baseFunction sourceAddress targetArity
+      storedSources source hsrc heligible harity href hprefix hunder =>
+    cases source with
+    | defn result body =>
+      exact lowerAllAction_sourceDefnResidual_profile_below
+        henv hlower htarget hrepresented hcontracts hvalues hprofiles
+        hsrc heligible harity href hprefix hunder horder hcaptures hargs
+        hsource hnonempty hfullLength hframe hown hinvoke
+    | ctor tag ctorArity => exact heligible.elim
+    | recursor numArgs natLit rules =>
+      have hlookup : sourceCtx.env address =
+          some (.recursor numArgs natLit rules) := by
+        rw [henv]
+        exact hsrc
+      have hbase := href.recursorValue hlookup
+      subst baseFunction
+      have harity' : numArgs + 1 = arity := by
+        simpa [sourceDeclArity] using harity
+      have hstoredUnder : sourceCaptures.length < numArgs + 1 := by
+        omega
+      have hcanonical : SourceApplies sourceCtx
+          (.pap (.rec_ address (numArgs + 1)) []) sourceCaptures
+          (.pap (.rec_ address (numArgs + 1)) sourceCaptures) :=
+        sourcePap_underfills (by
+          simpa [IxIR0.Head.arity] using hstoredUnder)
+      have hrelated : sourceFunction =
+          .pap (.rec_ address (numArgs + 1)) sourceCaptures :=
+        hprefix.deterministic hcanonical
+      subst sourceFunction
+      obtain ⟨d, hdecl, _, _, _⟩ := hcontracts.decls.recursor hsrc
+      obtain ⟨itemInitial, itemFinal, hdeclRun, hextends⟩ :=
+        lowerAllAction_callable_decl_trace hlower htarget hsrc (by rfl)
+          hdecl
+      simp only [lowerDecl] at hdeclRun
+      obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+        trackedBindRun_ok_inv hdeclRun
+      have hpure :
+          some (address, Decl.fn actual) =
+              some (address, Decl.fn d) ∧
+            recursorState = itemFinal := by
+        simpa using hafterRecursor
+      have hd : actual = d := by
+        have hp := Option.some.inj hpure.1
+        exact Decl.fn.inj (Prod.mk.inj hp).2
+      have hrecursorState : recursorState = itemFinal := hpure.2
+      subst actual
+      subst recursorState
+      have hfullLength' :
+          (sourceCaptures ++ sourceArgs).length = numArgs + 1 := by
+        exact hfullLength.trans harity'.symm
+      exact lowerRecursor_residual_profile_below
+        henv hrepresented hcontracts hvalues hprofiles hsrc hdecl href
+        hrecursorRun hextends hcaptures hargs hsource hnonempty
+        hfullLength' horder hframe hown hinvoke
+    | extern externArity =>
+      have hdecl := hcontracts.decls.extern hsrc
+      have hruntimeLength : (captures ++ args).length = externArity := by
+        have hgraphLength := (hcaptures.append hargs).length
+        have harity' : arity = externArity := by
+          simpa [sourceDeclArity] using harity.symm
+        exact hgraphLength.symm.trans (hfullLength.trans harity')
+      exact extern_retainedProfileFundedInvokeRun hdecl hruntimeLength
+        horder hown hinvoke hprefixFunded
+  | @wrapper relatedFunction baseFunction storedSources memo hmember hsrc
+      href hprefix hunder =>
+    have hdecl : ctx.decls memo.wrapper = some (.fn
+        ⟨memo.arity, .shared, true,
+          .letOp (.alloc .shared (ctorIdOf memo.source memo.tag)
+            (descendingVars memo.arity).toArray) (.ret (.var 0))⟩) := by
+      simpa [ctorWrapperDecl] using hrepresented.wrapper hmember
+    have hruntimeLength : (captures ++ args).length = memo.arity :=
+      (hcaptures.append hargs).length.symm.trans hfullLength
+    exact ctorWrapper_retainedProfileFundedInvokeRun hdecl hruntimeLength
+      horder hown hinvoke hprefixFunded
+  | @lifted relatedFunction address arity storedSources hlifted =>
+    exact invoke_lifted_retainedProfile_below henv hrepresented hcontracts
+      hvalues hprofiles hlifted hcaptures hargs hsource hnonempty
+      hfullLength horder hframe hown hinvoke
+
+/-- Seal the exact-profile contracts generated by an actual whole-pass run.
+The three-way strong induction simultaneously closes direct declaration
+calls, residual PAP saturation, and higher-order application. -/
+theorem lowerAllAction_compilerProfileContracts
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx) :
+    CompilerProfileContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htarget hrepresented hcontracts hextern
+  apply compilerProfileContracts_of_below_step
+  intro limit hprofiles
+  refine ⟨?_, ?_, ?_⟩
+  · exact lowerAllAction_sourceFnProfilePreservesAt_within_below
+      henv hlower htarget hrepresented hcontracts hvalues hprofiles
+  · exact lowerAllAction_residualFnProfilePreservesAt_within_below
+      henv hlower htarget hrepresented hcontracts hvalues hprofiles
+  · exact applyProfilePreservesAt_within_below henv hrepresented
+      hcontracts (hvalues.below limit) hprofiles
+
+/-- A successful source-profile trace for the closed main funds the exact
+successful target execution produced by the same whole-pass run.  All
+recursive declaration and PAP obligations are supplied by the sealed
+compiler-profile environment above. -/
+theorem lowerAllAction_main_profileFundedCodeRun_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel targetFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {targetStore : Store} {targetValue : RVal}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel [] main
+      sourceValue profile)
+    (htarget : runMain ctx mainCode targetFuel =
+      .ok (targetStore, targetValue)) :
+    ProfileFundedCodeRun ctx targetFuel ⟨0, .shared, false, mainCode⟩
+      ({} : Store) [] mainCode targetStore targetValue profile := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  have hprofiles := lowerAllAction_compilerProfileContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  obtain ⟨mainInitial, hmain⟩ := lowerAllAction_main_trace hlower
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerFnBody] at hmain
+    exact (trackedThrowRun_not_ok hmain).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hmain
+    obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+      trackedBindRun_ok_inv hmain
+    rcases releaseResult with ⟨middle, releaseEmit⟩
+    obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+      trackedBindRun_ok_inv hafterRelease
+    rcases bodyResult with ⟨output, emit, av⟩
+    have hpure :
+        (releaseEmit ∘ emit) (.ret (av.toAtom output)) = mainCode ∧
+          bodyState = finalState := by
+      simpa using hafterBody
+    obtain ⟨hcode, hbodyState⟩ := hpure
+    subst bodyState
+    let input : VEnv := ⟨[], 0⟩
+    have hplan : ReleasePlan input [] input (_root_.id : Emit) := .nil
+    have hplanRun : (releaseSlots input []).run mainInitial =
+        .ok (input, (_root_.id : Emit)) mainInitial :=
+      hplan.run mainInitial
+    have heq :
+        (input, (_root_.id : Emit)) = (middle, releaseEmit) ∧
+          mainInitial = releaseState := by
+      simpa [input] using hplanRun.symm.trans hrelease
+    have hmiddle : input = middle := congrArg Prod.fst heq.1
+    have hemitting : (_root_.id : Emit) = releaseEmit :=
+      congrArg Prod.snd heq.1
+    subst middle
+    subst releaseEmit
+    cases heq.2
+    let cur : FnDef := ⟨0, .shared, false, mainCode⟩
+    have hbodySound : LowerResultProfileSound
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) ctx cur input output [] [] sourceValue
+        mainWorld emit av profile :=
+      lowerE_run_profile_sound_within_noRecSelf
+        (recSelfRel := fun _ _ => False) (cur := cur) henv hrepresented
+        hcontracts hvalues hprofiles hsource hbodyRun
+        (ExtraExtends.refl _)
+        (by intro index arity hentry; simp [input] at hentry)
+    have hpre : GraphOwnsVEnvProtected
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) input [] [] [] [] ({} : Store) [] := by
+      refine ⟨?_, SlotsRealize.nil⟩
+      refine ⟨[], ?_, Sim.RootsGraph.nil, Sim.RootOwnership.empty⟩
+      exact ⟨by simp [input], EntriesValueGraph.nil⟩
+    have htarget' : runCode ctx targetFuel cur ({} : Store) []
+        (emit (.ret (av.toAtom output))) =
+          .ok (targetStore, targetValue) := by
+      unfold runMain at htarget
+      change runCode ctx targetFuel cur ({} : Store) [] mainCode =
+        .ok (targetStore, targetValue) at htarget
+      rw [← hcode] at htarget
+      simpa using htarget
+    have hcost := ProfileFundedEmitStateRunSound.closeRet
+      (hbodySound.profileEmits [] [] []) (av.toAtom output)
+      AllocationOrderInvariant.empty (ValuesInBounds.nil ({} : Store))
+      hpre htarget'
+    have hcode' : emit (.ret (av.toAtom output)) = mainCode := by
+      simpa using hcode
+    rw [hcode'] at hcost
+    simpa [cur] using hcost
+
+/-- The linear four-counter budget induced by an executed source profile. -/
+def ProfileWeights.budget (weights : ProfileWeights)
+    (profile : SourceProfile) : CostObservation :=
+  observationAdd (observationScale profile.retains weights.retain)
+    (observationAdd (observationScale profile.evals weights.eval)
+    (observationAdd (observationScale profile.applies weights.apply)
+      (observationAdd
+        (observationScale profile.saturations weights.saturation)
+        (observationAdd
+          (observationScale profile.constructorFires weights.constructor)
+          (observationAdd
+            (observationScale profile.closureValues weights.closure)
+            (observationAdd
+              (observationScale profile.papValues weights.pap)
+              (observationAdd
+                (observationScale profile.recursorFires weights.recursor)
+                (observationAdd
+                  (observationScale profile.externFires weights.extern)
+                  (observationScale profile.projections
+                    weights.projection)))))))))
+
+/-- A target observation fits the budget predicted by the source profile. -/
+def WithinBudget (weights : ProfileWeights) (profile : SourceProfile)
+    (observation : CostObservation) : Prop :=
+  ObservationLE observation (weights.budget profile)
+
+/-- The concrete inequalities exposed by `ownershipAmortizedWeights`.
+This names the compiler proof obligation independently of the nested linear
+combination used to compute the budget. -/
+def OwnershipAmortizedSpec (profile : SourceProfile)
+    (observation : CostObservation) : Prop :=
+  observation.allocs ≤ profile.evals ∧
+    observation.reuses = 0 ∧
+      observation.frees ≤ profile.evals ∧
+        observation.rcops ≤ profile.retains * 2 + profile.evals * 2
+
+theorem withinBudget_ownershipAmortized_iff
+    (profile : SourceProfile) (observation : CostObservation) :
+    WithinBudget ownershipAmortizedWeights profile observation ↔
+      OwnershipAmortizedSpec profile observation := by
+  simp [WithinBudget, ObservationLE, ProfileWeights.budget,
+    observationAdd, observationScale, ownershipAmortizedWeights,
+    OwnershipAmortizedSpec]
+
+/-- The target-side certificate needed from the lowering proof for one
+successful profiled run.  Allocation and reuse are ordinary counters; RC
+traffic is stated in the potential-aware form so arbitrary deep drops cost
+zero locally. -/
+structure OwnershipAmortizedRunCertificate (profile : SourceProfile)
+    (store : Store) : Prop where
+  allocations : store.allocs ≤ profile.evals
+  reuses : store.reuses = 0
+  rcPotential : RcPotentialGrowthLE ({} : Store) store
+    (profile.retains * 2 + profile.evals * 2)
+
+/-- Close a fresh run-indexed code certificate against its source-profile
+allowance.  This is the recursive production seam: the allowance belongs to
+the particular dynamic trace rather than to the finite target syntax. -/
+theorem CodeOwnershipRunCost.runCertificate
+    {ctx : Ctx} {code : Code} {allowance : OwnershipAllowance}
+    {profile : SourceProfile} {fuel : Nat} {store : Store} {value : RVal}
+    (hcost : CodeOwnershipRunCost ctx fuel ⟨0, .shared, false, code⟩
+      ({} : Store) [] code store value allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile)) :
+    OwnershipAmortizedRunCertificate profile store := by
+  obtain ⟨halloc, hreuses, hrc⟩ := hcost.growth
+  simp only [OwnershipAllowanceLE, sourceProfileOwnershipAllowance]
+    at hfunded
+  refine ⟨?_, ?_, ?_⟩
+  · simp at halloc
+    exact Nat.le_trans halloc hfunded.1
+  · simpa using hreuses
+  · exact hrc.monoAllowance hfunded.2
+
+/-- A source-funded fresh code run directly exposes the public amortized
+certificate, including when its allowance was assembled recursively. -/
+theorem ProfileFundedCodeRun.runCertificate
+    {ctx : Ctx} {code : Code} {profile : SourceProfile} {fuel : Nat}
+    {store : Store} {value : RVal}
+    (hcost : ProfileFundedCodeRun ctx fuel ⟨0, .shared, false, code⟩
+      ({} : Store) [] code store value profile) :
+    OwnershipAmortizedRunCertificate profile store := by
+  obtain ⟨_allowance, hrunCost, hfunded⟩ := hcost
+  exact hrunCost.runCertificate hfunded
+
+/-- Public run-certificate corollary for an actual whole-pass output. -/
+theorem lowerAllAction_main_ownershipAmortizedCertificate_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel targetFuel : Nat}
+    {sourceValue : IxIR0.Value} {profile : SourceProfile}
+    {targetStore : Store} {targetValue : RVal}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel [] main
+      sourceValue profile)
+    (htarget : runMain ctx mainCode targetFuel =
+      .ok (targetStore, targetValue)) :
+    OwnershipAmortizedRunCertificate profile targetStore :=
+  (lowerAllAction_main_profileFundedCodeRun_sealed henv hlower
+    htargetDecls hrepresented hcontracts hextern hsource htarget)
+    |>.runCertificate
+
+/-- A universal run-indexed code proof closes a particular successful fresh
+main execution directly into the public certificate. -/
+theorem ProfileFundedCodeCostSound.runCertificate
+    {ctx : Ctx} {code : Code} {profile : SourceProfile} {fuel : Nat}
+    {store : Store} {value : RVal}
+    (hsound : ProfileFundedCodeCostSound ctx ⟨0, .shared, false, code⟩ code
+      profile)
+    (hrun : runMain ctx code fuel = .ok (store, value)) :
+    OwnershipAmortizedRunCertificate profile store := by
+  simp only [runMain] at hrun
+  exact (hsound AllocationOrderInvariant.empty
+    (ValuesInBounds.nil ({} : Store)) hrun).runCertificate
+
+/-- Close the compiler's paired code contract against a source-profile
+allowance.  This is the production seam for the forthcoming lowering
+induction: once emitted code is funded componentwise by its source trace, the
+public run certificate follows without another evaluator proof. -/
+theorem CodeOwnershipCostSound.runCertificate
+    {ctx : Ctx} {code : Code} {allowance : OwnershipAllowance}
+    {profile : SourceProfile} {fuel : Nat} {store : Store} {value : RVal}
+    (hsound : CodeOwnershipCostSound ctx ⟨0, .shared, false, code⟩ code allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile))
+    (hrun : runMain ctx code fuel = .ok (store, value)) :
+    OwnershipAmortizedRunCertificate profile store := by
+  simp only [runMain] at hrun
+  exact (hsound.runCost AllocationOrderInvariant.empty
+    (ValuesInBounds.nil ({} : Store)) hrun).runCertificate hfunded
+
+/-- The potential-aware compiler certificate implies the public four-counter
+specification.  Exact heap accounting supplies `frees ≤ allocs`; discarding
+the final nonnegative potential supplies the raw RC bound. -/
+theorem OwnershipAmortizedRunCertificate.spec
+    {profile : SourceProfile} {ctx : Ctx} {code : Code} {fuel : Nat}
+    {store : Store} {value : RVal}
+    (hcertificate : OwnershipAmortizedRunCertificate profile store)
+    (hrun : runMain ctx code fuel = .ok (store, value)) :
+    OwnershipAmortizedSpec profile (costObservation store) := by
+  simp only [OwnershipAmortizedSpec, costObservation]
+  refine ⟨hcertificate.allocations, hcertificate.reuses, ?_, ?_⟩
+  · exact Nat.le_trans
+      (Ix.Compiler.IxIR1.Reclamation.runMain_frees_le_allocs hrun)
+      hcertificate.allocations
+  · have hrc := hcertificate.rcPotential.rcops_of_initial_zero
+      (by rfl)
+    simpa using hrc
+
+theorem OwnershipAmortizedRunCertificate.withinBudget
+    {profile : SourceProfile} {ctx : Ctx} {code : Code} {fuel : Nat}
+    {store : Store} {value : RVal}
+    (hcertificate : OwnershipAmortizedRunCertificate profile store)
+    (hrun : runMain ctx code fuel = .ok (store, value)) :
+    WithinBudget ownershipAmortizedWeights profile
+      (costObservation store) :=
+  (withinBudget_ownershipAmortized_iff _ _).2
+    (hcertificate.spec hrun)
+
+/-- Direct public four-counter corollary of a closed paired code contract. -/
+theorem CodeOwnershipCostSound.withinBudget
+    {ctx : Ctx} {code : Code} {allowance : OwnershipAllowance}
+    {profile : SourceProfile} {fuel : Nat} {store : Store} {value : RVal}
+    (hsound : CodeOwnershipCostSound ctx ⟨0, .shared, false, code⟩ code allowance)
+    (hfunded : OwnershipAllowanceLE allowance
+      (sourceProfileOwnershipAllowance profile))
+    (hrun : runMain ctx code fuel = .ok (store, value)) :
+    WithinBudget ownershipAmortizedWeights profile
+      (costObservation store) :=
+  (hsound.runCertificate hfunded hrun).withinBudget hrun
+
+/-- Lift a source-profile/target-counter relation into the existing semantic
+`CostRefinement` interface. -/
+def ProfileCostSpec (sourceCtx : IxIR0.Ctx) (source : IxIR0.Expr)
+    (relation : IxIR0.Value → SourceProfile → CostObservation → Prop)
+    (value : IxIR0.Value) (observation : CostObservation) : Prop :=
+  ∃ profile,
+    IxIR0.DynamicCost.Profiled sourceCtx source value profile ∧
+      relation value profile observation
+
+def ProfileCostRefinement (sourceCtx : IxIR0.Ctx) (targetCtx : Ctx)
+    (source : IxIR0.Expr) (target : Code) (funRel : Sim.FunctionRel)
+    (relation : IxIR0.Value → SourceProfile → CostObservation → Prop) :
+    Prop :=
+  CostRefinement sourceCtx targetCtx source target funRel
+    (ProfileCostSpec sourceCtx source relation)
+
+/-- Generic lifting boundary for the retain-aware tariff.  A source-profile
+producer and a compiler proof of the target certificate suffice; semantic
+`ValueGraph` evidence remains available to stronger certificates but is not
+needed to extract the four counters. -/
+theorem ProfileCostRefinement.of_ownershipAmortizedCertificate
+    {sourceCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {source : IxIR0.Expr} {target : Code} {funRel : Sim.FunctionRel}
+    (hprofile : ∀ {sourceFuel sourceValue},
+      IxIR0.eval sourceCtx sourceFuel [] source = .ok sourceValue →
+        ∃ profile, IxIR0.DynamicCost.Profiled sourceCtx source
+          sourceValue profile)
+    (hcost : ∀ {sourceValue profile targetFuel targetStore targetValue},
+      IxIR0.DynamicCost.Profiled sourceCtx source sourceValue profile →
+      runMain targetCtx target targetFuel =
+        .ok (targetStore, targetValue) →
+      OwnershipAmortizedRunCertificate profile targetStore) :
+    ProfileCostRefinement sourceCtx targetCtx source target funRel
+      (fun _ profile observation =>
+        WithinBudget ownershipAmortizedWeights profile observation) := by
+  intro sourceFuel sourceValue targetFuel targetStore targetValue
+    hsource htarget _hgraph
+  obtain ⟨profile, hprofiled⟩ := hprofile hsource
+  exact ⟨profile, hprofiled,
+    (hcost hprofiled htarget).withinBudget htarget⟩
+
+/-- Production profile-sensitive cost refinement for a successful raw
+whole-pass output.  Source-profile completeness is kept explicit because
+ordinary IxIR₀ evaluation admits a call-aware profile only under the
+appropriate projection-safety hypothesis; every target cost obligation is
+constructed from the lowering run itself. -/
+theorem lowerAllAction_profileCostRefinement_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprofile : ∀ {sourceFuel sourceValue},
+      IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue →
+        ∃ profile, IxIR0.DynamicCost.Profiled sourceCtx main
+          sourceValue profile) :
+    ProfileCostRefinement sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      (fun _ profile observation =>
+        WithinBudget ownershipAmortizedWeights profile observation) := by
+  apply ProfileCostRefinement.of_ownershipAmortizedCertificate hprofile
+  intro sourceValue profile targetFuel targetStore targetValue hprofiled
+    htarget
+  obtain ⟨sourceFuel, hsource⟩ := hprofiled
+  exact lowerAllAction_main_ownershipAmortizedCertificate_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hsource htarget
+
+/-- The indexed, fully content-addressed production artifact preserves the
+same profile-sensitive budget.  Complete readdressing changes only stored
+addresses, so its exact evaluator transport preserves all four public cost
+counters. -/
+theorem lowerAllIndexedFullyAddressed_profileCostRefinement_sealed
+    {sourceCtx : IxIR0.Ctx} {funRel : Sim.FunctionRel}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (result.preAddressCtx raw oracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (result.preAddressCtx raw oracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls)
+      (result.preAddressCtx raw oracle))
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (result.preAddressCtx raw oracle))
+    (hprofile : ∀ {sourceFuel sourceValue},
+      IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue →
+        ∃ profile, IxIR0.DynamicCost.Profiled sourceCtx main
+          sourceValue profile) :
+    ProfileCostRefinement sourceCtx (result.addressedCtx oracle) main
+      result.main funRel
+      (fun _ profile observation =>
+        WithinBudget ownershipAmortizedWeights profile observation) := by
+  have hlowerRaw :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  intro sourceFuel sourceValue targetFuel addressedStore targetValue
+    hsource htarget _hgraph
+  obtain ⟨profile, hprofiled⟩ := hprofile hsource
+  obtain ⟨profileFuel, hsourceProfile⟩ := hprofiled
+  have htransport := lowerAllIndexedFullyAddressed_runMain
+    hlower haddressed oracle targetFuel
+  rw [htarget] at htransport
+  cases hraw : runMain (result.preAddressCtx raw oracle) mainCode targetFuel
+      with
+  | error error =>
+    rw [hraw] at htransport
+    cases error <;> simp at htransport
+  | ok output =>
+    rcases output with ⟨rawStore, rawValue⟩
+    rw [hraw] at htransport
+    have hresult :
+        (addressedStore, targetValue) =
+          (Readdress.Store.mapAddresses
+            (Readdress.Renaming.apply result.addressMap) rawStore,
+            rawValue) :=
+      Except.ok.inj htransport
+    have hstore := congrArg Prod.fst hresult
+    change addressedStore = Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) rawStore at hstore
+    have hcertificate :=
+      lowerAllAction_main_ownershipAmortizedCertificate_sealed
+        henv hlowerRaw htargetDecls hrepresented hcontracts hextern
+        hsourceProfile hraw
+    refine ⟨profile, ⟨profileFuel, hsourceProfile⟩, ?_⟩
+    rw [hstore]
+    rw [costObservation_mapAddresses]
+    exact hcertificate.withinBudget hraw
+
+/-- Alias-free production profile refinement. The lowering contracts and
+source profile are established in the literal raw declaration context, then
+the certified total rebuild renaming preserves the four target counters. -/
+theorem lowerAllIndexedFullyAddressed_profileCostRefinement_exact_sealed
+    {sourceCtx : IxIR0.Ctx} {funRel : Sim.FunctionRel}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (result.rebuildSourceCtx raw oracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (result.rebuildSourceCtx raw oracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls)
+      (result.rebuildSourceCtx raw oracle))
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (result.rebuildSourceCtx raw oracle))
+    (hprofile : ∀ {sourceFuel sourceValue},
+      IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue →
+        ∃ profile, IxIR0.DynamicCost.Profiled sourceCtx main
+          sourceValue profile) :
+    ProfileCostRefinement sourceCtx (result.addressedCtx oracle) main
+      result.main funRel
+      (fun _ profile observation =>
+        WithinBudget ownershipAmortizedWeights profile observation) := by
+  have hlowerRaw :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  intro sourceFuel sourceValue targetFuel addressedStore targetValue
+    hsource htarget _hgraph
+  obtain ⟨profile, hprofiled⟩ := hprofile hsource
+  obtain ⟨profileFuel, hsourceProfile⟩ := hprofiled
+  have htransport := lowerAllIndexedFullyAddressed_runMain_exact
+    hlower haddressed oracle targetFuel
+  rw [htarget] at htransport
+  cases hraw : runMain (result.rebuildSourceCtx raw oracle) mainCode targetFuel
+      with
+  | error error =>
+    rw [hraw] at htransport
+    cases error <;> simp at htransport
+  | ok output =>
+    rcases output with ⟨rawStore, rawValue⟩
+    rw [hraw] at htransport
+    have hresult :
+        (addressedStore, targetValue) =
+          (Readdress.Store.mapAddresses (result.rebuildRename raw) rawStore,
+            rawValue) :=
+      Except.ok.inj htransport
+    have hstore := congrArg Prod.fst hresult
+    change addressedStore =
+      Readdress.Store.mapAddresses (result.rebuildRename raw) rawStore at hstore
+    have hcertificate :=
+      lowerAllAction_main_ownershipAmortizedCertificate_sealed
+        henv hlowerRaw htargetDecls hrepresented hcontracts hextern
+        hsourceProfile hraw
+    refine ⟨profile, ⟨profileFuel, hsourceProfile⟩, ?_⟩
+    rw [hstore]
+    rw [costObservation_mapAddresses]
+    exact hcertificate.withinBudget hraw
+
+/-- One exact profiled source trace and one exact target run establish a
+profile-sensitive refinement for every successful source and target fuel.
+Determinism transports both results; evaluator fuel never enters the budget.
+-/
+theorem ProfileCostRefinement.of_witness
+    {sourceCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {source : IxIR0.Expr} {target : Code} {funRel : Sim.FunctionRel}
+    {relation : IxIR0.Value → SourceProfile → CostObservation → Prop}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {profile : SourceProfile} {targetFuel : Nat}
+    {targetStore : Store} {targetValue : RVal}
+    (hsource : IxIR0.DynamicCost.Eval sourceCtx sourceFuel [] source
+      sourceValue profile)
+    (htarget : runMain targetCtx target targetFuel =
+      .ok (targetStore, targetValue))
+    (hrelation : relation sourceValue profile
+      (costObservation targetStore)) :
+    ProfileCostRefinement sourceCtx targetCtx source target funRel
+      relation := by
+  intro otherSourceFuel otherSourceValue otherTargetFuel otherTargetStore
+    otherTargetValue hotherSource hotherTarget _hgraph
+  have hsourceValue : otherSourceValue = sourceValue :=
+    sourceEval_ok_unique hotherSource hsource.run
+  subst otherSourceValue
+  have htargetResult :
+      (otherTargetStore, otherTargetValue) = (targetStore, targetValue) :=
+    runMain_success_unique hotherTarget htarget
+  cases htargetResult
+  exact ⟨profile, ⟨sourceFuel, hsource⟩, hrelation⟩
+
+end Ix.Compiler.IxIR1.CostTrace
diff --git a/Ix/Compiler/IxIR1/Decode.lean b/Ix/Compiler/IxIR1/Decode.lean
new file mode 100644
index 000000000..2ae001a8d
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Decode.lean
@@ -0,0 +1,441 @@
+import Ix.Compiler.IxIR0.Decode
+import Ix.Compiler.IxIR1.Serialize
+
+/-!
+# Strict IxIR₁ declaration decoding
+
+The public reader consumes a complete versioned declaration preimage and
+accepts only bytes reproduced exactly by the canonical encoder. Recursive
+code bodies are input-fueled; case alternatives reuse the strictly smaller
+fuel supplied to their enclosing `case` node.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon
+open Ix.Compiler.IxIR
+open Ix.Compiler.IxIR.Decode
+
+def getAtomTag : UInt8 → GetM Atom
+  | 0 => do return .var (← Decode.getNat)
+  | 1 => do return .lit (← IxIR0.getLiteral)
+  | 2 => pure .erased
+  | tag => throw s!"IxIR1 atom: invalid tag {tag}"
+
+def getAtom : GetM Atom := do
+  getAtomTag (← getU8)
+
+def getCtorId : GetM CtorId := do
+  return ⟨← Decode.getAddress, ← Decode.getNat, ← Decode.getNat⟩
+
+def getOpTag : UInt8 → GetM Op
+  | 0 => do return .pure (← getAtom)
+  | 1 => do
+      let world ← IxIR0.getOwned
+      let cid ← getCtorId
+      return .alloc world cid (← Decode.getArray getAtom)
+  | 2 => do
+      let target ← getAtom
+      let cid ← getCtorId
+      return .reuse target cid (← Decode.getArray getAtom)
+  | 3 => do return .free (← getAtom)
+  | 4 => do return .dup (← getAtom)
+  | 5 => do return .drop (← getAtom)
+  | 6 => do return .dropU (← getAtom)
+  | 7 => do return .fetch (← getAtom) (← Decode.getNat)
+  | 8 => do
+      return .call (← Decode.getAddress) (← Decode.getArray getAtom)
+  | 9 => do return .callSelf (← Decode.getArray getAtom)
+  | 10 => do
+      return .papp (← Decode.getAddress) (← Decode.getArray getAtom)
+  | 11 => do return .apply (← getAtom) (← Decode.getArray getAtom)
+  | 12 => do
+      return .extern (← Decode.getAddress) (← Decode.getArray getAtom)
+  | tag => throw s!"IxIR1 operation: invalid tag {tag}"
+
+def getOp : GetM Op := do
+  getOpTag (← getU8)
+
+def getAlt (recur : GetM Code) : GetM Alt := do
+  return .mk (← Decode.getNat) (← Decode.getNat) (← recur)
+
+def getCodeTag (recur : GetM Code) : UInt8 → GetM Code
+  | 0 => do return .ret (← getAtom)
+  | 1 => do return .letOp (← getOp) (← recur)
+  | 2 => do
+      let scrut ← getAtom
+      let peelNat ← Decode.getBool
+      return .case scrut peelNat (← Decode.getArray (getAlt recur))
+  | tag => throw s!"IxIR1 code: invalid tag {tag}"
+
+def getCodeFuel : Nat → GetM Code
+  | 0 => throw "IxIR1 code: recursion limit"
+  | fuel + 1 => do
+      getCodeTag (getCodeFuel fuel) (← getU8)
+
+def getCode : GetM Code := do
+  let state ← get
+  getCodeFuel (state.bytes.size + 1)
+
+def getFnDef : GetM FnDef := do
+  return ⟨← Decode.getNat, ← IxIR0.getOwned, ← Decode.getBool,
+    ← getCode⟩
+
+def getDeclTag : UInt8 → GetM Decl
+  | 0 => do return .fn (← getFnDef)
+  | 1 => do return .extern (← Decode.getNat)
+  | tag => throw s!"IxIR1 declaration: invalid tag {tag}"
+
+def getDeclPayload : GetM Decl := do
+  getDeclTag (← getU8)
+
+def getDeclPreimage : GetM Decl := do
+  Decode.expectBytes Decl.addressDomain
+  getDeclPayload
+
+/-- Decode one complete canonical IxIR₁ declaration preimage. -/
+def Decl.decodePreimage (bytes : ByteArray) : Except String Decl :=
+  Decode.runCanonical getDeclPreimage Decl.preimage bytes
+
+/-! ## Nonrecursive cursor-relative specifications -/
+
+theorem getAtom_spec : ∀ atom : Atom, GetSpec getAtom atom.bytes atom
+  | .var index => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec index) Atom.var
+      have htotal := GetSpec.bind (next := getAtomTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getAtom, Atom.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .lit literal => by
+      have hpayload := Decode.getSpecMap
+        (IxIR0.getLiteral_spec literal) Atom.lit
+      have htotal := GetSpec.bind (next := getAtomTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getAtom, Atom.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .erased => by
+      have hpayload : GetSpec (getAtomTag 2) ByteArray.empty Atom.erased :=
+        GetSpec.pure Atom.erased
+      have htotal := GetSpec.bind (next := getAtomTag)
+        (Decode.getU8_tag_spec 2) hpayload
+      simpa only [getAtom, Atom.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+theorem getCtorId_spec (cid : CtorId) :
+    GetSpec getCtorId cid.bytes cid := by
+  have hspec := Decode.getSpecMap3 (Decode.getAddress_spec cid.block)
+    (Decode.getNat_spec cid.indIdx) (Decode.getNat_spec cid.cidx) CtorId.mk
+  simpa [getCtorId, CtorId.bytes] using hspec
+
+private theorem getAtomArray_spec (atoms : Array Atom) :
+    GetSpec (Decode.getArray getAtom) (Encoding.array Atom.bytes atoms) atoms :=
+  Decode.getArray_spec getAtom Atom.bytes getAtom_spec atoms
+
+theorem getOp_spec : ∀ operation : Op, GetSpec getOp operation.bytes operation
+  | .pure atom => by
+      have hpayload := Decode.getSpecMap (getAtom_spec atom) Op.pure
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .alloc world cid args => by
+      have hpayload := Decode.getSpecMap3 (IxIR0.getOwned_spec world)
+        (getCtorId_spec cid) (getAtomArray_spec args) Op.alloc
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .reuse target cid args => by
+      have hpayload := Decode.getSpecMap3 (getAtom_spec target)
+        (getCtorId_spec cid) (getAtomArray_spec args) Op.reuse
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 2) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .free target => by
+      have hpayload := Decode.getSpecMap (getAtom_spec target) Op.free
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 3) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .dup target => by
+      have hpayload := Decode.getSpecMap (getAtom_spec target) Op.dup
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 4) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .drop target => by
+      have hpayload := Decode.getSpecMap (getAtom_spec target) Op.drop
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 5) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .dropU target => by
+      have hpayload := Decode.getSpecMap (getAtom_spec target) Op.dropU
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 6) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .fetch target field => by
+      have hpayload := Decode.getSpecMap2 (getAtom_spec target)
+        (Decode.getNat_spec field) Op.fetch
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 7) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .call function args => by
+      have hpayload := Decode.getSpecMap2 (Decode.getAddress_spec function)
+        (getAtomArray_spec args) Op.call
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 8) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .callSelf args => by
+      have hpayload := Decode.getSpecMap (getAtomArray_spec args) Op.callSelf
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 9) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .papp function args => by
+      have hpayload := Decode.getSpecMap2 (Decode.getAddress_spec function)
+        (getAtomArray_spec args) Op.papp
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 10) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .apply function args => by
+      have hpayload := Decode.getSpecMap2 (getAtom_spec function)
+        (getAtomArray_spec args) Op.apply
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 11) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .extern function args => by
+      have hpayload := Decode.getSpecMap2 (Decode.getAddress_spec function)
+        (getAtomArray_spec args) Op.extern
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 12) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+theorem AltList.bytes_eq_listBytes (alternatives : List Alt) :
+    AltList.bytes alternatives = Decode.listBytes Alt.bytes alternatives := by
+  induction alternatives with
+  | nil => rfl
+  | cons head tail ih => simp [AltList.bytes, Decode.listBytes, ih]
+
+theorem AltList.member_size_le {alternative : Alt} {alternatives : List Alt}
+    (hmember : alternative ∈ alternatives) :
+    alternative.bytes.size ≤ (AltList.bytes alternatives).size := by
+  induction alternatives with
+  | nil => simp at hmember
+  | cons head tail ih =>
+      simp only [List.mem_cons] at hmember
+      simp only [AltList.bytes, ByteArray.size_append]
+      rcases hmember with rfl | hmember
+      · omega
+      · have htail := ih hmember
+        omega
+
+theorem Alt.body_size_lt_bytes (cidx fields : Nat) (body : Code) :
+    body.bytes.size < (Alt.mk cidx fields body).bytes.size := by
+  simp only [Alt.bytes, ByteArray.size_append]
+  have hcidx := Decode.nat_size_pos cidx
+  have hfields := Decode.nat_size_pos fields
+  omega
+
+/-- Structural induction for code that exposes hypotheses for every case body
+stored beneath an alternative array. -/
+theorem Code.nested_induction (property : Code → Prop)
+    (hret : ∀ atom, property (.ret atom))
+    (hlet : ∀ operation rest, property rest →
+      property (.letOp operation rest))
+    (hcase : ∀ scrut peelNat alternatives,
+      (∀ cidx fields body,
+        Alt.mk cidx fields body ∈ alternatives.toList → property body) →
+      property (.case scrut peelNat alternatives))
+    (code : Code) : property code := by
+  apply Code.rec
+    (motive_1 := fun _ => True)
+    (motive_2 := fun alternative => match alternative with
+      | .mk _ _ body => property body)
+    (motive_3 := property)
+    (motive_4 := fun alternatives => ∀ cidx fields body,
+      Alt.mk cidx fields body ∈ alternatives.toList → property body)
+    (motive_5 := fun alternatives => ∀ cidx fields body,
+      Alt.mk cidx fields body ∈ alternatives → property body)
+    (pure := by intros; trivial)
+    (alloc := by intros; trivial)
+    (reuse := by intros; trivial)
+    (free := by intros; trivial)
+    (dup := by intros; trivial)
+    (drop := by intros; trivial)
+    (dropU := by intros; trivial)
+    (fetch := by intros; trivial)
+    (call := by intros; trivial)
+    (callSelf := by intros; trivial)
+    (papp := by intros; trivial)
+    (apply := by intros; trivial)
+    (extern := by intros; trivial)
+    (mk := by intro cidx fields body hbody; exact hbody)
+    (ret := hret)
+    (letOp := by
+      intro operation rest _ hrest
+      exact hlet operation rest hrest)
+    (case := hcase)
+    (by intro alternatives halternatives; exact halternatives)
+    (by simp)
+    (by
+      intro head tail hhead htail cidx fields body hmember
+      simp only [List.mem_cons] at hmember
+      rcases hmember with hheadEq | htailMem
+      · cases hheadEq
+        exact hhead
+      · exact htail cidx fields body htailMem)
+
+/-! ## Input-fueled recursive code specification -/
+
+theorem getCodeFuel_spec (code : Code) (fuel : Nat)
+    (hfuel : code.bytes.size < fuel) :
+    GetSpec (getCodeFuel fuel) code.bytes code := by
+  apply Code.nested_induction
+    (property := fun code => ∀ fuel, code.bytes.size < fuel →
+      GetSpec (getCodeFuel fuel) code.bytes code)
+    (code := code)
+  · intro atom fuel hfuel
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+        have hpayload := Decode.getSpecMap (getAtom_spec atom) Code.ret
+        have htotal := GetSpec.bind
+          (next := getCodeTag (getCodeFuel fuel))
+          (Decode.getU8_tag_spec 0) hpayload
+        simpa only [getCodeFuel, Code.bytes, ByteArray.append_assoc,
+          ByteArray.append_empty] using htotal
+  · intro operation rest hrest fuel hfuel
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+        have hrestFuel : rest.bytes.size < fuel := by
+          simp only [Code.bytes, ByteArray.size_append,
+            Decode.tag_size] at hfuel
+          omega
+        have hpayload := Decode.getSpecMap2 (getOp_spec operation)
+          (hrest fuel hrestFuel) Code.letOp
+        have htotal := GetSpec.bind
+          (next := getCodeTag (getCodeFuel fuel))
+          (Decode.getU8_tag_spec 1) hpayload
+        simpa only [getCodeFuel, Code.bytes, ByteArray.append_assoc,
+          ByteArray.append_empty] using htotal
+  · intro scrut peelNat alternatives hchildren fuel hfuel
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+        let admissible : Alt → Prop := fun alternative =>
+          alternative ∈ alternatives.toList ∧
+            match alternative with
+            | .mk _ _ body => body.bytes.size < fuel
+        have hadmissible : ∀ alternative ∈ alternatives.toList,
+            admissible alternative := by
+          intro alternative hmember
+          cases alternative with
+          | mk cidx fields body =>
+              refine ⟨hmember, ?_⟩
+              have hbody := Alt.body_size_lt_bytes cidx fields body
+              have halternative := AltList.member_size_le hmember
+              simp only [Code.bytes, ByteArray.size_append,
+                Decode.tag_size] at hfuel
+              omega
+        have hone : ∀ alternative, admissible alternative →
+            GetSpec (getAlt (getCodeFuel fuel))
+              alternative.bytes alternative := by
+          intro alternative halternative
+          rcases halternative with ⟨hmember, hbodyFuel⟩
+          cases alternative with
+          | mk cidx fields body =>
+              have hspec := Decode.getSpecMap3
+                (Decode.getNat_spec cidx) (Decode.getNat_spec fields)
+                (hchildren cidx fields body hmember fuel hbodyFuel) Alt.mk
+              simpa [getAlt, Alt.bytes] using hspec
+        have harray := Decode.getArray_spec_of
+          (getAlt (getCodeFuel fuel)) Alt.bytes admissible hone
+          alternatives hadmissible
+        rw [Decode.array_eq_counted,
+          ← AltList.bytes_eq_listBytes alternatives.toList] at harray
+        have hpayload := Decode.getSpecMap3 (getAtom_spec scrut)
+          (Decode.getBool_spec peelNat) harray Code.case
+        have htotal := GetSpec.bind
+          (next := getCodeTag (getCodeFuel fuel))
+          (Decode.getU8_tag_spec 2) hpayload
+        simpa only [getCodeFuel, Code.bytes, ByteArray.append_assoc,
+          ByteArray.append_empty] using htotal
+  · exact hfuel
+
+theorem getCode_spec (code : Code) :
+    GetSpec getCode code.bytes code := by
+  intro pre suffix
+  let fuel := (pre ++ code.bytes ++ suffix).size + 1
+  have hfuel : code.bytes.size < fuel := by
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  have hspec := getCodeFuel_spec code fuel hfuel pre suffix
+  simpa [getCode, fuel] using hspec
+
+theorem getFnDef_spec (definition : FnDef) :
+    GetSpec getFnDef definition.bytes definition := by
+  have hspec := Decode.getSpecMap4 (Decode.getNat_spec definition.arity)
+    (IxIR0.getOwned_spec definition.result)
+    (Decode.getBool_spec definition.papSafe) (getCode_spec definition.body)
+    FnDef.mk
+  simpa [getFnDef, FnDef.bytes] using hspec
+
+theorem getDeclPayload_spec : ∀ declaration : Decl,
+    GetSpec getDeclPayload declaration.payloadBytes declaration
+  | .fn definition => by
+      have hpayload := Decode.getSpecMap (getFnDef_spec definition) Decl.fn
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getDeclPayload, Decl.payloadBytes,
+        ByteArray.append_assoc, ByteArray.append_empty] using htotal
+  | .extern arity => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec arity) Decl.extern
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getDeclPayload, Decl.payloadBytes,
+        ByteArray.append_assoc, ByteArray.append_empty] using htotal
+
+theorem getDeclPreimage_spec (declaration : Decl) :
+    GetSpec getDeclPreimage declaration.preimage declaration := by
+  let next : Unit → GetM Decl := fun _ => getDeclPayload
+  have htotal := GetSpec.bind (next := next)
+    (Decode.expectBytes_spec Decl.addressDomain)
+    (getDeclPayload_spec declaration)
+  simpa [getDeclPreimage, Decl.preimage, next] using htotal
+
+/-! ## Strict top-level laws -/
+
+/-- Every declaration decodes from its canonical framed preimage. -/
+theorem Decl.decodePreimage_roundtrip (declaration : Decl) :
+    Decl.decodePreimage declaration.preimage = .ok declaration := by
+  exact Decode.runCanonical_of_spec getDeclPreimage Decl.preimage declaration
+    (getDeclPreimage_spec declaration)
+
+/-- Every accepted byte string is the canonical preimage of its result. -/
+theorem Decl.decodePreimage_canonical {bytes : ByteArray} {declaration : Decl}
+    (hdecode : Decl.decodePreimage bytes = .ok declaration) :
+    declaration.preimage = bytes := by
+  exact Decode.runCanonical_canonical getDeclPreimage Decl.preimage hdecode
+
+/-- Canonical declaration preimages are injective. -/
+theorem Decl.preimage_injective : Function.Injective Decl.preimage := by
+  intro left right hbytes
+  have hok : (Except.ok left : Except String Decl) = .ok right := by
+    calc
+      .ok left = Decl.decodePreimage left.preimage :=
+        (Decl.decodePreimage_roundtrip left).symm
+      _ = Decl.decodePreimage right.preimage := congrArg Decl.decodePreimage hbytes
+      _ = .ok right := Decl.decodePreimage_roundtrip right
+  exact Except.ok.inj hok
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/Eval.lean b/Ix/Compiler/IxIR1/Eval.lean
new file mode 100644
index 000000000..58feab460
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Eval.lean
@@ -0,0 +1,1295 @@
+import Ix.Compiler.IxIR1.Basic
+
+/-!
+# The IxIR₁ store semantics
+
+Fueled big-step interpreter in the house style, now state-passing: a
+`Store` of nodes threads through everything. Two jobs at once:
+
+1. **Semantic anchor**: the specification `reuse_sound` and both
+   IxIR₀ → IxIR₁ lowerings (no-RC and RC-fallback) are proved
+   against. Fuel is the usual totality device.
+2. **Dynamic discipline checker**: the mode rules are enforced at
+   runtime — `dup`/`drop` demand a live *shared* node, `reuse`/`free`
+   a live *unique* one, every access demands liveness — with
+   violations reported as `Err.mem`, distinct from ordinary
+   stuckness. Well-moded lowered code never trips them; that
+   unstuckness claim is the future static well-formedness theorem.
+
+The store also counts: allocations, in-place reuses, frees (explicit
+and refcount-zero), and RC operations. Cost attaches to IxIR₁
+instructions (gate A), and the counters make memory-behavior claims
+checkable — see `Examples.lean` for "reversing a unique list
+allocates nothing" as a `#guard`.
+
+Conventions: `pap` nodes are allocated shared (function values are
+freely copyable; `dup`/`drop` manage them, `reuse`/`free` reject
+them). Deep drop expects shared children under shared nodes
+(whole-value modes — gate B); a unique child under a shared node is a
+memory error. Scalars (`lit`, `◻`) are inert everywhere.
+
+Ownership calling convention (what the lowering's RC insertion is
+built against): every heap-bearing argument position **consumes** one
+ownership of its value — `alloc`/`reuse` fields, `call`/`callSelf`/
+`papp` arguments, `ret`, and `pure` all take their operands' references
+with them. The v1 `extern` ABI is scalar-only in both directions, so no
+heap ownership crosses it; locations are rejected before or after the
+oracle call. `apply` consumes its function value *and* its
+arguments: `applyGo` first dups the pap's stored arguments (they gain
+a new owner — the successor pap or the callee) and then drops the
+applied pap itself, so under/over-fill chains reclaim intermediate
+paps without caller-side bookkeeping. The borrowing exceptions are
+`fetch` (project without consuming — dup the field to own it) and
+`case` scrutiny; `dup`/`drop` are the explicit ownership adjustments
+in the shared world, `free` (shallow) and `dropU` (deep, the affine
+death compilation) the reclamations in the unique one.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR0 (Literal)
+
+/-- Runtime values: scalars or locations. -/
+inductive RVal where
+  | loc (l : Nat)
+  | lit (l : Literal)
+  | erased
+  deriving BEq, Repr, Inhabited
+
+/-- The v1 extern ABI admits no heap ownership: literals and `◻` cross
+the boundary, locations do not. -/
+def RVal.isScalar : RVal → Bool
+  | .loc _ => false
+  | .lit _ | .erased => true
+
+inductive Node where
+  | ctorN (cid : CtorId) (fields : Array RVal)
+  | papN (f : Address) (arity : Nat) (args : Array RVal)
+  deriving BEq, Repr, Inhabited
+
+structure NodeBox where
+  world : Owned
+  rc : Nat
+  node : Node
+  deriving Repr
+
+structure Store where
+  nodes : Array (Option NodeBox) := #[]
+  allocs : Nat := 0
+  reuses : Nat := 0
+  frees : Nat := 0
+  rcops : Nat := 0
+  deriving Repr
+
+def Store.allocNode (s : Store) (world : Owned) (n : Node) : Store × Nat :=
+  ({ s with nodes := s.nodes.push (some ⟨world, 1, n⟩)
+            allocs := s.allocs + 1 },
+   s.nodes.size)
+
+def Store.get? (s : Store) (l : Nat) : Option NodeBox :=
+  (s.nodes[l]?).bind id
+
+def Store.setBox (s : Store) (l : Nat) (b : NodeBox) : Store :=
+  { s with nodes := s.nodes.set! l (some b) }
+
+def Store.kill (s : Store) (l : Nat) : Store :=
+  { s with nodes := s.nodes.set! l none, frees := s.frees + 1 }
+
+def Store.rcTick (s : Store) : Store := { s with rcops := s.rcops + 1 }
+
+/-- Number of live nodes — `0` at the end of a run is leak-freedom. -/
+def Store.live (s : Store) : Nat :=
+  s.nodes.foldl (fun n b => if b.isSome then n + 1 else n) 0
+
+inductive Err where
+  | fuel
+  | stuck (msg : String)
+  /-- A memory-discipline violation: the dynamic mode checker fired. -/
+  | mem (msg : String)
+  | unknownRef (adr : Address)
+  deriving BEq, Repr
+
+structure Ctx where
+  decls : Env
+  oracle : Address → List RVal → Option RVal := fun _ _ => none
+
+/-- Invoke the v1 scalar-only oracle. Rejecting locations on both sides makes
+the ownership convention explicit: no heap root is silently consumed or
+created by an extern call. -/
+def callScalarOracle (ctx : Ctx) (f : Address) (args : List RVal) :
+    Except Err RVal :=
+  if !args.all RVal.isScalar then
+    .error (.mem "extern heap arguments require an ownership policy")
+  else
+    match ctx.oracle f args with
+    | none => .error (.unknownRef f)
+    | some v =>
+      if v.isScalar then .ok v
+      else .error (.mem "extern heap results require an ownership policy")
+
+def resolveAtom (env : List RVal) : Atom → Except Err RVal
+  | .var i =>
+    match env[i]? with
+    | some v => .ok v
+    | none => .error (.stuck s!"unbound variable {i}")
+  | .lit l => .ok (.lit l)
+  | .erased => .ok .erased
+
+def resolveAtoms (env : List RVal) (as' : Array Atom) :
+    Except Err (List RVal) :=
+  as'.foldlM (fun acc a => do pure (acc ++ [← resolveAtom env a])) []
+
+private theorem List.resolveAtomsFrom_length (environment : List RVal) :
+    ∀ (atoms : List Atom) (accumulator output : List RVal),
+      atoms.foldlM
+        (fun values atom => do
+          pure (values ++ [← resolveAtom environment atom]))
+        accumulator = .ok output →
+      output.length = accumulator.length + atoms.length := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro accumulator output run
+      simp only [List.foldlM_nil] at run
+      cases run
+      simp
+  | cons atom atoms ih =>
+      intro accumulator output run
+      simp only [List.foldlM_cons] at run
+      cases resolved : resolveAtom environment atom with
+      | error error =>
+          rw [resolved] at run
+          simp only [bind, Except.bind] at run
+          contradiction
+      | ok value =>
+          rw [resolved] at run
+          simp only [bind, Except.bind] at run
+          have tail := ih (accumulator ++ [value]) output run
+          simp only [List.length_append, List.length_singleton] at tail
+          simp only [List.length_cons]
+          omega
+
+/-- Successful simultaneous operand resolution preserves vector length. -/
+theorem resolveAtoms_length {environment : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (run : resolveAtoms environment atoms = .ok values) :
+    values.length = atoms.size := by
+  unfold resolveAtoms at run
+  rw [← Array.foldlM_toList] at run
+  have length :=
+    List.resolveAtomsFrom_length environment atoms.toList [] values run
+  simpa using length
+
+def Alt.cidx : Alt → Nat
+  | .mk c _ _ => c
+
+/-- Add one owner to each value: the internal half of `applyGo`'s
+convention (the pap's stored arguments gain the successor pap or the
+callee as a new owner). Mirrors `Op.dup`: shared and live demanded,
+scalars inert. -/
+def dupVals (store : Store) (vs : List RVal) : Except Err Store :=
+  vs.foldlM (init := store) fun store v =>
+    match v with
+    | .loc l =>
+      match store.get? l with
+      | none => .error (.mem s!"dup of a dead location {l}")
+      | some box =>
+        match box.world with
+        | .unique => .error (.mem "dup of a unique node")
+        | .shared =>
+          .ok ((store.setBox l { box with rc := box.rc + 1 }).rcTick)
+    | _ => .ok store
+
+def declArity : Decl → Nat
+  | .fn d => d.arity
+  | .extern ar => ar
+
+/-- Dynamic PAP entry is valid for compiler functions explicitly marked safe
+and for scalar-only externs. Saturated direct calls do not consult this bit. -/
+def declPapSafe : Decl → Bool
+  | .fn d => d.papSafe
+  | .extern _ => true
+
+/-- Executable result-world check. Scalars are ownership-polymorphic;
+a returned location must be live in the function's declared world. -/
+def RVal.hasWorld (store : Store) (world : Owned) : RVal → Bool
+  | .loc l =>
+    match store.get? l with
+    | some box => box.world == world
+    | none => false
+  | .lit _ | .erased => true
+
+/-- Enforce a function declaration's result ownership at its dynamic
+boundary. This catches malformed hand-written IxIR₁ even though lowered
+programs establish the same fact statically. -/
+def checkResultWorld (world : Owned) (out : Store × RVal) :
+    Except Err (Store × RVal) :=
+  if out.2.hasWorld out.1 world then .ok out
+  else .error (.mem "function result ownership mismatch")
+
+mutual
+
+def runCode (ctx : Ctx) (fuel : Nat) (cur : FnDef) (store : Store)
+    (env : List RVal) (c : Code) : Except Err (Store × RVal) :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match c with
+    | .ret a => do
+      let v ← resolveAtom env a
+      .ok (store, v)
+    | .letOp op rest => do
+      let (store', v) ← runOp ctx fuel cur store env op
+      runCode ctx fuel cur store' (v :: env) rest
+    | .case scrut peelNat alts => do
+      match ← resolveAtom env scrut with
+      | .loc l =>
+        match store.get? l with
+        | none => .error (.mem s!"case on a dead location {l}")
+        | some box =>
+          match box.node with
+          | .ctorN cid fields =>
+            match alts.find? (fun alt => alt.cidx == cid.cidx) with
+            | none => .error (.stuck s!"no case alternative for tag {cid.cidx}")
+            | some (.mk _ nf body) =>
+              if fields.size != nf then
+                .error (.stuck "case field-count mismatch")
+              else
+                runCode ctx fuel cur store
+                  (fields.foldl (fun e f => f :: e) env) body
+          | .papN .. => .error (.stuck "case on a pap node")
+      | .lit (.nat n) =>
+        if peelNat then
+          match n with
+          | 0 =>
+            match alts.find? (fun alt => alt.cidx == 0) with
+            | some (.mk _ 0 body) => runCode ctx fuel cur store env body
+            | _ => .error (.stuck "nat-peel: missing nullary 0-alternative")
+          | n + 1 =>
+            match alts.find? (fun alt => alt.cidx == 1) with
+            | some (.mk _ 1 body) =>
+              runCode ctx fuel cur store (.lit (.nat n) :: env) body
+            | _ => .error (.stuck "nat-peel: missing unary 1-alternative")
+        else .error (.stuck "case on a literal (peelNat disabled)")
+      | _ => .error (.stuck "case on a non-node value")
+  termination_by fuel
+
+def runOp (ctx : Ctx) (fuel : Nat) (cur : FnDef) (store : Store)
+    (env : List RVal) (op : Op) : Except Err (Store × RVal) :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match op with
+    | .pure a => do
+      let v ← resolveAtom env a
+      .ok (store, v)
+    | .alloc world cid args => do
+      let vs ← resolveAtoms env args
+      let (store', l) := store.allocNode world (.ctorN cid vs.toArray)
+      .ok (store', .loc l)
+    | .reuse target cid args => do
+      let vs ← resolveAtoms env args
+      match ← resolveAtom env target with
+      | .loc l =>
+        match store.get? l with
+        | none => .error (.mem s!"reuse of a dead location {l}")
+        | some box =>
+          match box.world with
+          | .shared => .error (.mem "reuse of a shared node")
+          | .unique =>
+            let store' := store.setBox l ⟨.unique, 1, .ctorN cid vs.toArray⟩
+            .ok ({ store' with reuses := store'.reuses + 1 }, .loc l)
+      | _ => .error (.mem "reuse of a non-location")
+    | .free target => do
+      match ← resolveAtom env target with
+      | .loc l =>
+        match store.get? l with
+        | none => .error (.mem s!"free of a dead location {l}")
+        | some box =>
+          match box.world with
+          | .shared => .error (.mem "free of a shared node")
+          | .unique => .ok (store.kill l, .erased)
+      | _ => .error (.mem "free of a non-location")
+    | .dup target => do
+      match ← resolveAtom env target with
+      | .loc l =>
+        match store.get? l with
+        | none => .error (.mem s!"dup of a dead location {l}")
+        | some box =>
+          match box.world with
+          | .unique => .error (.mem "dup of a unique node")
+          | .shared =>
+            .ok ((store.setBox l { box with rc := box.rc + 1 }).rcTick,
+              .loc l)
+      | v => .ok (store, v)
+    | .drop target => do
+      match ← resolveAtom env target with
+      | v@(.loc _) => do
+        let store' ← dropVal ctx fuel store v
+        .ok (store', .erased)
+      | _ => .ok (store, .erased)
+    | .dropU target => do
+      match ← resolveAtom env target with
+      | v@(.loc _) => do
+        let store' ← dropUVal ctx fuel store v
+        .ok (store', .erased)
+      | _ => .ok (store, .erased)
+    | .fetch target i => do
+      match ← resolveAtom env target with
+      | .loc l =>
+        match store.get? l with
+        | none => .error (.mem s!"fetch from a dead location {l}")
+        | some box =>
+          match box.node with
+          | .ctorN _ fields =>
+            match fields[i]? with
+            | some v => .ok (store, v)
+            | none => .error (.stuck s!"fetch field {i} out of range")
+          | .papN .. => .error (.stuck "fetch from a pap node")
+      | _ => .error (.stuck "fetch from a non-location")
+    | .call f args => do
+      let vs ← resolveAtoms env args
+      invoke ctx fuel f vs store
+    | .callSelf args => do
+      let vs ← resolveAtoms env args
+      if vs.length != cur.arity then
+        .error (.stuck "callSelf arity mismatch")
+      else do
+        let out ← runCode ctx fuel cur store vs.reverse cur.body
+        checkResultWorld cur.result out
+    | .papp f args => do
+      let vs ← resolveAtoms env args
+      match ctx.decls f with
+      | none => .error (.unknownRef f)
+      | some d =>
+        if vs.length < declArity d then
+          let (store', l) :=
+            store.allocNode .shared (.papN f (declArity d) vs.toArray)
+          .ok (store', .loc l)
+        else .error (.stuck "papp with saturating arguments (use call)")
+    | .apply f args => do
+      let fv ← resolveAtom env f
+      let vs ← resolveAtoms env args
+      applyGo ctx fuel store fv vs
+    | .extern f args => do
+      let vs ← resolveAtoms env args
+      let v ← callScalarOracle ctx f vs
+      .ok (store, v)
+  termination_by fuel
+
+/-- Enter a known declaration with saturated arguments. -/
+def invoke (ctx : Ctx) (fuel : Nat) (f : Address) (args : List RVal)
+    (store : Store) : Except Err (Store × RVal) :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match ctx.decls f with
+    | none => .error (.unknownRef f)
+    | some (.fn d) =>
+      if args.length != d.arity then
+        .error (.stuck "call arity mismatch")
+      else do
+        let out ← runCode ctx fuel d store args.reverse d.body
+        checkResultWorld d.result out
+    | some (.extern ar) =>
+      if args.length != ar then
+        .error (.stuck "extern arity mismatch")
+      else
+        match callScalarOracle ctx f args with
+        | .ok v => .ok (store, v)
+        | .error e => .error e
+  termination_by fuel
+
+/-- The apply chain: under-fill builds a new pap, saturation calls,
+over-fill calls then applies the rest to the result. Consuming: the
+stored arguments are dup'd (their new owner is the successor pap or
+the callee) and the applied pap itself is dropped, so chains reclaim
+their intermediates. -/
+def applyGo (ctx : Ctx) (fuel : Nat) (store : Store) (fv : RVal)
+    (args : List RVal) : Except Err (Store × RVal) :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match fv with
+    | .loc l =>
+      match store.get? l with
+      | none => .error (.mem s!"apply of a dead location {l}")
+      | some box =>
+        match box.node with
+        | .papN f ar got => do
+          let store ← dupVals store got.toList
+          let store ← dropVal ctx fuel store (.loc l)
+          let total := got.toList ++ args
+          if total.length < ar then
+            let (store', l') :=
+              store.allocNode .shared (.papN f ar total.toArray)
+            .ok (store', .loc l')
+          else if total.length == ar then
+            match ctx.decls f with
+            | none => .error (.unknownRef f)
+            | some declaration =>
+              if declPapSafe declaration then
+                invoke ctx fuel f total store
+              else
+                .error (.stuck
+                  "shared pap targets a non-pap-safe declaration")
+          else do
+            match ctx.decls f with
+            | none => .error (.unknownRef f)
+            | some declaration =>
+              if declPapSafe declaration then
+                let (store', r) ← invoke ctx fuel f (total.take ar) store
+                applyGo ctx fuel store' r (total.drop ar)
+              else
+                .error (.stuck
+                  "shared pap targets a non-pap-safe declaration")
+        | .ctorN .. => .error (.stuck "apply of a constructor node")
+    | .erased => do
+      let store ← dropMany ctx fuel store args
+      .ok (store, .erased)
+    | .lit _ => .error (.stuck "apply of a non-node value")
+  termination_by fuel
+
+/-- Perceus-style deep drop of a shared value: decrement, and at zero
+free the node and drop its children. -/
+def dropVal (ctx : Ctx) (fuel : Nat) (store : Store) (v : RVal) :
+    Except Err Store :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match v with
+    | .lit _ => .ok store
+    | .erased => .ok store
+    | .loc l =>
+      match store.get? l with
+      | none => .error (.mem s!"drop of a dead location {l}")
+      | some box =>
+        match box.world with
+        | .unique => .error (.mem "drop of a unique node")
+        | .shared =>
+          let store := store.rcTick
+          if box.rc == 1 then
+            let store := store.kill l
+            match box.node with
+            | .ctorN _ fields => dropMany ctx fuel store fields.toList
+            | .papN _ _ args => dropMany ctx fuel store args.toList
+          else
+            .ok (store.setBox l { box with rc := box.rc - 1 })
+  termination_by fuel
+
+def dropMany (ctx : Ctx) (fuel : Nat) (store : Store) (vs : List RVal) :
+    Except Err Store :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match vs with
+    | [] => .ok store
+    | v :: rest => do
+      let store' ← dropVal ctx fuel store v
+      dropMany ctx fuel store' rest
+  termination_by fuel
+
+/-- Deep-free of a unique tree: kill the node, recurse into fields.
+Whole-value modes are enforced (a shared child under a unique node is
+a memory error, symmetric to deep drop's unique-under-shared); no
+refcounts are touched. Pap nodes are always shared, so a unique pap
+is corrupt by construction and faults. -/
+def dropUVal (ctx : Ctx) (fuel : Nat) (store : Store) (v : RVal) :
+    Except Err Store :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match v with
+    | .lit _ => .ok store
+    | .erased => .ok store
+    | .loc l =>
+      match store.get? l with
+      | none => .error (.mem s!"dropU of a dead location {l}")
+      | some box =>
+        match box.world with
+        | .shared => .error (.mem "dropU of a shared node")
+        | .unique =>
+          match box.node with
+          | .ctorN _ fields => dropManyU ctx fuel (store.kill l) fields.toList
+          | .papN .. => .error (.mem "dropU of a pap node")
+  termination_by fuel
+
+def dropManyU (ctx : Ctx) (fuel : Nat) (store : Store) (vs : List RVal) :
+    Except Err Store :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match vs with
+    | [] => .ok store
+    | v :: rest => do
+      let store' ← dropUVal ctx fuel store v
+      dropManyU ctx fuel store' rest
+  termination_by fuel
+
+end
+
+/-- A successful source return exposes the resolved value and confirms that
+the store is unchanged.  This is the terminal inversion rule used by later
+small-step simulations. -/
+theorem runCode_ret_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {atom : Atom}
+    {output : Store × RVal}
+    (run : runCode ctx (fuel + 1) cur store env (.ret atom) = .ok output) :
+    ∃ value,
+      resolveAtom env atom = .ok value ∧ output = (store, value) := by
+  rw [runCode.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env atom with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      exact ⟨value, rfl, (Except.ok.inj run).symm⟩
+
+/-- A successful source `letOp` splits at the exact evaluator boundary:
+first the operation succeeds, then the continuation succeeds at the same
+smaller fuel. -/
+theorem runCode_letOp_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {operation : Op} {rest : Code}
+    {output : Store × RVal}
+    (run : runCode ctx (fuel + 1) cur store env (.letOp operation rest) =
+      .ok output) :
+    ∃ middle value,
+      runOp ctx fuel cur store env operation = .ok (middle, value) ∧
+        runCode ctx fuel cur middle (value :: env) rest = .ok output := by
+  rw [runCode.eq_def] at run
+  dsimp only at run
+  cases operationRun : runOp ctx fuel cur store env operation with
+  | error error =>
+      rw [operationRun] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok operationOutput =>
+      obtain ⟨middle, value⟩ := operationOutput
+      rw [operationRun] at run
+      simp only [bind, Except.bind] at run
+      exact ⟨middle, value, rfl, run⟩
+
+/-- A successful `pure` operation is exactly atom resolution and cannot
+change the store. -/
+theorem runOp_pure_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {atom : Atom}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.pure atom) = .ok output) :
+    ∃ value,
+      resolveAtom env atom = .ok value ∧ output = (store, value) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env atom with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      exact ⟨value, rfl, (Except.ok.inj run).symm⟩
+
+/-- A successful ordinary allocation exposes its resolved field vector and
+the exact fresh-node result chosen by the source store. -/
+theorem runOp_alloc_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env
+      (.alloc world cid arguments) = .ok output) :
+    ∃ values,
+      resolveAtoms env arguments = .ok values ∧
+        output =
+          ((store.allocNode world (.ctorN cid values.toArray)).1,
+            .loc (store.allocNode world (.ctorN cid values.toArray)).2) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtoms env arguments with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok values =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      exact ⟨values, rfl, (Except.ok.inj run).symm⟩
+
+/-- A successful in-place reuse exposes all three dynamic checks and the
+exact rewritten unique node selected by the source store. -/
+theorem runOp_reuse_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {cid : CtorId}
+    {arguments : Array Atom} {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env
+      (.reuse target cid arguments) = .ok output) :
+    ∃ values location box,
+      resolveAtoms env arguments = .ok values ∧
+        resolveAtom env target = .ok (.loc location) ∧
+        store.get? location = some box ∧
+        box.world = .unique ∧
+        output =
+          ({ store.setBox location
+              ⟨.unique, 1, .ctorN cid values.toArray⟩ with
+            reuses :=
+              (store.setBox location
+                ⟨.unique, 1, .ctorN cid values.toArray⟩).reuses + 1 },
+            .loc location) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases argumentsResolved : resolveAtoms env arguments with
+  | error error =>
+      rw [argumentsResolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok values =>
+      rw [argumentsResolved] at run
+      simp only [bind, Except.bind] at run
+      cases targetResolved : resolveAtom env target with
+      | error error =>
+          rw [targetResolved] at run
+          contradiction
+      | ok value =>
+          rw [targetResolved] at run
+          cases value with
+          | lit literal => contradiction
+          | erased => contradiction
+          | loc location =>
+              simp only at run
+              cases found : store.get? location with
+              | none =>
+                  rw [found] at run
+                  contradiction
+              | some box =>
+                  rw [found] at run
+                  simp only at run
+                  cases worldEq : box.world with
+                  | shared =>
+                      rw [worldEq] at run
+                      contradiction
+                  | unique =>
+                      rw [worldEq] at run
+                      exact ⟨values, location, box, rfl, rfl, found,
+                        worldEq, (Except.ok.inj run).symm⟩
+
+/-- A successful shallow free exposes the live unique box selected by its
+operand and the exact killed-store result. -/
+theorem runOp_free_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.free target) = .ok output) :
+    ∃ location box,
+      resolveAtom env target = .ok (.loc location) ∧
+        store.get? location = some box ∧
+        box.world = .unique ∧
+        output = (store.kill location, .erased) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env target with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases value with
+      | lit literal => contradiction
+      | erased => contradiction
+      | loc location =>
+          simp only at run
+          cases found : store.get? location with
+          | none =>
+              rw [found] at run
+              contradiction
+          | some box =>
+              rw [found] at run
+              simp only at run
+              cases worldEq : box.world with
+              | shared =>
+                  rw [worldEq] at run
+                  contradiction
+              | unique =>
+                  rw [worldEq] at run
+                  exact ⟨location, box, rfl, found, worldEq,
+                    (Except.ok.inj run).symm⟩
+
+/-- A successful projection exposes the selected live constructor node and
+the exact field returned without changing the store. -/
+theorem runOp_fetch_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {field : Nat}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.fetch target field) =
+      .ok output) :
+    ∃ location box identity fields value,
+      resolveAtom env target = .ok (.loc location) ∧
+        store.get? location = some box ∧
+        box.node = .ctorN identity fields ∧
+        fields[field]? = some value ∧
+        output = (store, value) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env target with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok resolvedValue =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases resolvedValue with
+      | lit literal => contradiction
+      | erased => contradiction
+      | loc location =>
+          simp only at run
+          cases found : store.get? location with
+          | none =>
+              rw [found] at run
+              contradiction
+          | some box =>
+              rw [found] at run
+              simp only at run
+              cases nodeEq : box.node with
+              | papN function supplied =>
+                  rw [nodeEq] at run
+                  contradiction
+              | ctorN identity fields =>
+                  rw [nodeEq] at run
+                  simp only at run
+                  cases fieldEq : fields[field]? with
+                  | none =>
+                      rw [fieldEq] at run
+                      contradiction
+                  | some value =>
+                      rw [fieldEq] at run
+                      exact ⟨location, box, identity, fields, value,
+                        rfl, found, nodeEq, fieldEq,
+                        (Except.ok.inj run).symm⟩
+
+/-- A successful `dup` exposes either the live shared node whose reference
+count was incremented or the inert scalar that passed through unchanged. -/
+theorem runOp_dup_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.dup target) = .ok output) :
+    ∃ value,
+      resolveAtom env target = .ok value ∧
+        match value with
+        | .loc location =>
+          ∃ box,
+            store.get? location = some box ∧
+              box.world = .shared ∧
+              output =
+                ((store.setBox location { box with rc := box.rc + 1 }).rcTick,
+                  .loc location)
+        | .lit _ | .erased => output = (store, value) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env target with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases value with
+      | lit literal =>
+          exact ⟨.lit literal, rfl, (Except.ok.inj run).symm⟩
+      | erased =>
+          exact ⟨.erased, rfl, (Except.ok.inj run).symm⟩
+      | loc location =>
+          simp only at run
+          cases found : store.get? location with
+          | none =>
+              rw [found] at run
+              contradiction
+          | some box =>
+              rw [found] at run
+              simp only at run
+              cases worldEq : box.world with
+              | unique =>
+                  rw [worldEq] at run
+                  contradiction
+              | shared =>
+                  rw [worldEq] at run
+                  refine ⟨.loc location, rfl, box, found, worldEq, ?_⟩
+                  simpa [worldEq] using (Except.ok.inj run).symm
+
+/-- A successful shared drop either delegates the selected location to
+`dropVal` or leaves the store unchanged for an inert scalar. -/
+theorem runOp_drop_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.drop target) = .ok output) :
+    ∃ value,
+      resolveAtom env target = .ok value ∧
+        match value with
+        | .loc location =>
+          ∃ store',
+            dropVal ctx fuel store (.loc location) = .ok store' ∧
+              output = (store', .erased)
+        | .lit _ | .erased => output = (store, .erased) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env target with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases value with
+      | lit literal =>
+          exact ⟨.lit literal, rfl, (Except.ok.inj run).symm⟩
+      | erased =>
+          exact ⟨.erased, rfl, (Except.ok.inj run).symm⟩
+      | loc location =>
+          simp only at run
+          cases dropped : dropVal ctx fuel store (.loc location) with
+          | error error =>
+              rw [dropped] at run
+              contradiction
+          | ok store' =>
+              rw [dropped] at run
+              exact ⟨.loc location, rfl, store', dropped,
+                (Except.ok.inj run).symm⟩
+
+/-- A successful unique drop either delegates the selected location to
+`dropUVal` or leaves the store unchanged for an inert scalar. -/
+theorem runOp_dropU_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.dropU target) = .ok output) :
+    ∃ value,
+      resolveAtom env target = .ok value ∧
+        match value with
+        | .loc location =>
+          ∃ store',
+            dropUVal ctx fuel store (.loc location) = .ok store' ∧
+              output = (store', .erased)
+        | .lit _ | .erased => output = (store, .erased) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env target with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases value with
+      | lit literal =>
+          exact ⟨.lit literal, rfl, (Except.ok.inj run).symm⟩
+      | erased =>
+          exact ⟨.erased, rfl, (Except.ok.inj run).symm⟩
+      | loc location =>
+          simp only at run
+          cases dropped : dropUVal ctx fuel store (.loc location) with
+          | error error =>
+              rw [dropped] at run
+              contradiction
+          | ok store' =>
+              rw [dropped] at run
+              exact ⟨.loc location, rfl, store', dropped,
+                (Except.ok.inj run).symm⟩
+
+/-- A successful direct call exposes argument resolution and the exact
+`invoke` boundary used by the source evaluator. -/
+theorem runOp_call_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {function : Address}
+    {arguments : Array Atom} {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env
+      (.call function arguments) = .ok output) :
+    ∃ values,
+      resolveAtoms env arguments = .ok values ∧
+        invoke ctx fuel function values store = .ok output := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtoms env arguments with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok values =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      exact ⟨values, rfl, run⟩
+
+/-- A successful self call exposes the exact recursive body run and its
+result-world boundary check. -/
+theorem runOp_callSelf_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {arguments : Array Atom}
+    {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env (.callSelf arguments) =
+      .ok output) :
+    ∃ values bodyOutput,
+      resolveAtoms env arguments = .ok values ∧
+        values.length = cur.arity ∧
+        runCode ctx fuel cur store values.reverse cur.body = .ok bodyOutput ∧
+        checkResultWorld cur.result bodyOutput = .ok output := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtoms env arguments with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok values =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      by_cases arity : values.length = cur.arity
+      · simp [arity] at run
+        cases bodyRun : runCode ctx fuel cur store values.reverse cur.body with
+        | error error =>
+            rw [bodyRun] at run
+            contradiction
+        | ok bodyOutput =>
+            rw [bodyRun] at run
+            exact ⟨values, bodyOutput, rfl, arity, bodyRun, run⟩
+      · simp [arity] at run
+
+/-- A successful partial application exposes the retained declaration,
+strict under-saturation, and the exact allocated pap node. -/
+theorem runOp_papp_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {function : Address}
+    {arguments : Array Atom} {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env
+      (.papp function arguments) = .ok output) :
+    ∃ values declaration,
+      resolveAtoms env arguments = .ok values ∧
+        ctx.decls function = some declaration ∧
+        values.length < declArity declaration ∧
+        output =
+          ((store.allocNode .shared
+            (.papN function (declArity declaration) values.toArray)).1,
+            .loc (store.allocNode .shared
+              (.papN function (declArity declaration) values.toArray)).2) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtoms env arguments with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok values =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases found : ctx.decls function with
+      | none =>
+          rw [found] at run
+          contradiction
+      | some declaration =>
+          rw [found] at run
+          by_cases undersaturated : values.length < declArity declaration
+          · simp only [undersaturated, ↓reduceIte] at run
+            exact ⟨values, declaration, rfl, rfl, undersaturated,
+              (Except.ok.inj run).symm⟩
+          · simp only [undersaturated, ↓reduceIte] at run
+            contradiction
+
+/-- A successful dynamic application exposes both resolver boundaries and
+the exact `applyGo` computation delegated to by `runOp`. -/
+theorem runOp_apply_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {function : Atom}
+    {arguments : Array Atom} {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env
+      (.apply function arguments) = .ok output) :
+    ∃ functionValue values,
+      resolveAtom env function = .ok functionValue ∧
+        resolveAtoms env arguments = .ok values ∧
+        applyGo ctx fuel store functionValue values = .ok output := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases functionResolved : resolveAtom env function with
+  | error error =>
+      rw [functionResolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok functionValue =>
+      rw [functionResolved] at run
+      simp only [bind, Except.bind] at run
+      cases argumentsResolved : resolveAtoms env arguments with
+      | error error =>
+          rw [argumentsResolved] at run
+          contradiction
+      | ok values =>
+          rw [argumentsResolved] at run
+          exact ⟨functionValue, values, rfl, rfl, run⟩
+
+/-- A successful trusted extern call exposes scalar-oracle evaluation and
+confirms that the source store is unchanged. -/
+theorem runOp_extern_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {function : Address}
+    {arguments : Array Atom} {output : Store × RVal}
+    (run : runOp ctx (fuel + 1) cur store env
+      (.extern function arguments) = .ok output) :
+    ∃ values value,
+      resolveAtoms env arguments = .ok values ∧
+        callScalarOracle ctx function values = .ok value ∧
+        output = (store, value) := by
+  rw [runOp.eq_def] at run
+  dsimp only at run
+  cases argumentsResolved : resolveAtoms env arguments with
+  | error error =>
+      rw [argumentsResolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok values =>
+      rw [argumentsResolved] at run
+      simp only [bind, Except.bind] at run
+      cases oracleRun : callScalarOracle ctx function values with
+      | error error =>
+          rw [oracleRun] at run
+          contradiction
+      | ok value =>
+          rw [oracleRun] at run
+          exact ⟨values, value, rfl, oracleRun,
+            (Except.ok.inj run).symm⟩
+
+/-- The successful branches of a known-address source invocation, indexed by
+the smaller fuel used for a function body. -/
+inductive InvokeSuccess (ctx : Ctx) (fuel : Nat) (function : Address)
+    (arguments : List RVal) (store : Store) (output : Store × RVal) : Prop
+  | fn {definition : FnDef} {bodyOutput : Store × RVal}
+      (declaration : ctx.decls function = some (.fn definition))
+      (arity : arguments.length = definition.arity)
+      (bodyRun : runCode ctx fuel definition store arguments.reverse
+        definition.body = .ok bodyOutput)
+      (resultRun : checkResultWorld definition.result bodyOutput = .ok output)
+  | extern {arity : Nat} {value : RVal}
+      (declaration : ctx.decls function = some (.extern arity))
+      (argumentsArity : arguments.length = arity)
+      (oracleRun : callScalarOracle ctx function arguments = .ok value)
+      (outputEq : output = (store, value))
+
+/-- Every successful `invoke` has positive fuel and selects exactly one of
+the function-body or scalar-extern branches above. -/
+theorem invoke_success {ctx : Ctx} {fuel : Nat} {function : Address}
+    {arguments : List RVal} {store : Store} {output : Store × RVal}
+    (run : invoke ctx fuel function arguments store = .ok output) :
+    ∃ bodyFuel,
+      fuel = bodyFuel + 1 ∧
+        InvokeSuccess ctx bodyFuel function arguments store output := by
+  cases fuel with
+  | zero =>
+      rw [invoke.eq_def] at run
+      contradiction
+  | succ bodyFuel =>
+      rw [invoke.eq_def] at run
+      dsimp only at run
+      cases found : ctx.decls function with
+      | none =>
+          rw [found] at run
+          contradiction
+      | some declaration =>
+          rw [found] at run
+          cases declaration with
+          | fn definition =>
+              by_cases arity : arguments.length = definition.arity
+              · simp [arity] at run
+                cases bodyRun : runCode ctx bodyFuel definition store
+                    arguments.reverse definition.body with
+                | error error =>
+                    rw [bodyRun] at run
+                    simp only [bind, Except.bind] at run
+                    contradiction
+                | ok bodyOutput =>
+                    rw [bodyRun] at run
+                    simp only [bind, Except.bind] at run
+                    exact ⟨bodyFuel, rfl,
+                      .fn found arity bodyRun run⟩
+              · simp [arity] at run
+          | extern expectedArity =>
+              by_cases arity : arguments.length = expectedArity
+              · simp [arity] at run
+                cases oracleRun : callScalarOracle ctx function arguments with
+                | error error =>
+                    rw [oracleRun] at run
+                    contradiction
+                | ok value =>
+                    rw [oracleRun] at run
+                    exact ⟨bodyFuel, rfl,
+                      .extern found arity oracleRun
+                        (Except.ok.inj run).symm⟩
+              · simp [arity] at run
+
+/-- The three successful source-case shapes.  The relation retains the exact
+selected source alternative and the recursive branch run, while ruling out
+all stuck scrutinee, tag, and field-arity paths. -/
+inductive RunCodeCaseSuccess (ctx : Ctx) (fuel : Nat) (cur : FnDef)
+    (store : Store) (env : List RVal) (scrutinee : Atom) (peelNat : Bool)
+    (alternatives : Array Alt) (output : Store × RVal) : Prop
+  | ctorBranch {location : Nat} {box : NodeBox} {cid : CtorId}
+      {fields : Array RVal} {fieldCount : Nat} {body : Code}
+      (resolved : resolveAtom env scrutinee = .ok (.loc location))
+      (found : store.get? location = some box)
+      (node : box.node = .ctorN cid fields)
+      (selected : alternatives.find? (fun alternative =>
+        alternative.cidx == cid.cidx) =
+          some (.mk cid.cidx fieldCount body))
+      (fieldArity : fields.size = fieldCount)
+      (branchRun : runCode ctx fuel cur store
+        (fields.toList.reverse ++ env) body = .ok output)
+  | natZero {body : Code}
+      (peels : peelNat = true)
+      (resolved : resolveAtom env scrutinee = .ok (.lit (.nat 0)))
+      (selected : alternatives.find? (fun alternative =>
+        alternative.cidx == 0) = some (.mk 0 0 body))
+      (branchRun : runCode ctx fuel cur store env body = .ok output)
+  | natSucc {predecessor : Nat} {body : Code}
+      (peels : peelNat = true)
+      (resolved : resolveAtom env scrutinee =
+        .ok (.lit (.nat (predecessor + 1))))
+      (selected : alternatives.find? (fun alternative =>
+        alternative.cidx == 1) = some (.mk 1 1 body))
+      (branchRun : runCode ctx fuel cur store
+        (.lit (.nat predecessor) :: env) body = .ok output)
+
+/-- A successful source `case` determines one exact recursive branch at the
+same smaller fuel. -/
+theorem runCode_case_success {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {scrutinee : Atom} {peelNat : Bool}
+    {alternatives : Array Alt} {output : Store × RVal}
+    (run : runCode ctx (fuel + 1) cur store env
+      (.case scrutinee peelNat alternatives) = .ok output) :
+    RunCodeCaseSuccess ctx fuel cur store env scrutinee peelNat alternatives
+      output := by
+  rw [runCode.eq_def] at run
+  dsimp only at run
+  cases resolved : resolveAtom env scrutinee with
+  | error error =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok value =>
+      rw [resolved] at run
+      simp only [bind, Except.bind] at run
+      cases value with
+      | erased => contradiction
+      | loc location =>
+          simp only at run
+          cases found : store.get? location with
+          | none =>
+              rw [found] at run
+              contradiction
+          | some box =>
+              rw [found] at run
+              simp only at run
+              cases nodeEq : box.node with
+              | papN function arity captured =>
+                  rw [nodeEq] at run
+                  contradiction
+              | ctorN cid fields =>
+                  rw [nodeEq] at run
+                  simp only at run
+                  cases selected : alternatives.find? (fun alternative =>
+                      alternative.cidx == cid.cidx) with
+                  | none =>
+                      rw [selected] at run
+                      contradiction
+                  | some alternative =>
+                      rw [selected] at run
+                      cases alternative with
+                      | mk tag fieldCount body =>
+                          simp only at run
+                          by_cases fieldArity : fields.size = fieldCount
+                          · simp [fieldArity] at run
+                            have matched :
+                                ((.mk tag fieldCount body : Alt).cidx ==
+                                  cid.cidx) = true :=
+                              Array.find?_some
+                                (p := fun alternative : Alt =>
+                                  alternative.cidx == cid.cidx)
+                                (a := .mk tag fieldCount body)
+                                (xs := alternatives) selected
+                            have tagEq : tag = cid.cidx :=
+                              beq_iff_eq.mp matched
+                            subst tag
+                            exact .ctorBranch resolved found nodeEq selected
+                              fieldArity run
+                          · simp [fieldArity] at run
+      | lit literal =>
+          cases literal with
+          | str string => contradiction
+          | nat number =>
+              cases peelNat with
+              | false => contradiction
+              | true =>
+                  simp only at run
+                  cases number with
+                  | zero =>
+                      cases selected : alternatives.find? (fun alternative =>
+                          alternative.cidx == 0) with
+                      | none =>
+                          rw [selected] at run
+                          contradiction
+                      | some alternative =>
+                          rw [selected] at run
+                          cases alternative with
+                          | mk tag fieldCount body =>
+                              cases fieldCount with
+                              | zero =>
+                                  have matched :
+                                      ((.mk tag 0 body : Alt).cidx == 0) =
+                                        true :=
+                                    Array.find?_some
+                                      (p := fun alternative : Alt =>
+                                        alternative.cidx == 0)
+                                      (a := .mk tag 0 body)
+                                      (xs := alternatives) selected
+                                  have tagEq : tag = 0 :=
+                                    beq_iff_eq.mp matched
+                                  subst tag
+                                  exact .natZero rfl resolved selected run
+                              | succ fieldCount => contradiction
+                  | succ predecessor =>
+                      cases selected : alternatives.find? (fun alternative =>
+                          alternative.cidx == 1) with
+                      | none =>
+                          rw [selected] at run
+                          contradiction
+                      | some alternative =>
+                          rw [selected] at run
+                          cases alternative with
+                          | mk tag fieldCount body =>
+                              cases fieldCount with
+                              | zero => contradiction
+                              | succ remaining =>
+                                  cases remaining with
+                                  | zero =>
+                                      have matched :
+                                          ((.mk tag 1 body : Alt).cidx == 1) =
+                                            true :=
+                                        Array.find?_some
+                                          (p := fun alternative : Alt =>
+                                            alternative.cidx == 1)
+                                          (a := .mk tag 1 body)
+                                          (xs := alternatives) selected
+                                      have tagEq : tag = 1 :=
+                                        beq_iff_eq.mp matched
+                                      subst tag
+                                      exact .natSucc rfl resolved selected run
+                                  | succ remaining => contradiction
+
+/-- Run a top-level code sequence in a fresh store (the `cur` frame is
+the code itself, so `callSelf` at top level re-enters it). -/
+def runMain (ctx : Ctx) (c : Code) (fuel : Nat := 100000) :
+    Except Err (Store × RVal) :=
+  runCode ctx fuel ⟨0, .shared, false, c⟩ {} [] c
+
+/-- Run a closed top-level code sequence at its declared result world and
+check that world at the public boundary.  Unlike `runMain`, this form also
+installs the declared world in the synthetic current function, so a
+top-level `callSelf` observes the same result contract as the enclosing
+entry. -/
+def runOwnedMain (ctx : Ctx) (result : Owned) (c : Code)
+    (fuel : Nat := 100000) : Except Err (Store × RVal) := do
+  let out ← runCode ctx fuel ⟨0, result, false, c⟩ {} [] c
+  checkResultWorld result out
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/EvalHistory.lean b/Ix/Compiler/IxIR1/EvalHistory.lean
new file mode 100644
index 000000000..412abfe8d
--- /dev/null
+++ b/Ix/Compiler/IxIR1/EvalHistory.lean
@@ -0,0 +1,371 @@
+import Ix.Compiler.IxIR1.Mono
+import Ix.Compiler.IxIR1.EvalRewrite
+
+/-!
+# Composable source execution history
+
+A machine proof visits a callee before it knows the callee's eventual result.
+`ExecutionHistory` records enough source execution to reconstruct that result
+later. Its completion implication composes across ordinary operations, case
+selection, and tail calls, while keeping the result ownership check explicit.
+Fuel is existential: independent prefixes and suffixes are joined by raising
+their successful runs to a common bound.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Owned Address)
+
+/-- A source evaluator position, including its dynamic self-call frame. -/
+structure CodePoint where
+  current : FnDef
+  store : Store
+  environment : List RVal
+  code : Code
+
+/-- Successful completion at some finite evaluator fuel. -/
+def CodePoint.Runs (ctx : Ctx) (point : CodePoint) (out : Store × RVal) : Prop :=
+  ∃ fuel, runCode ctx fuel point.current point.store point.environment
+    point.code = .ok out
+
+/-- A completed suffix reconstructs the earlier source computation. Result
+ownership is preserved across frame replacement, including tail calls. -/
+structure ExecutionHistory (ctx : Ctx) (before after : CodePoint) : Prop where
+  resultWorld : before.current.result = after.current.result
+  complete : ∀ {out : Store × RVal}, after.Runs ctx out →
+    Sim.HasWorld out.1 after.current.result out.2 → before.Runs ctx out
+
+namespace ExecutionHistory
+
+theorem refl (ctx : Ctx) (point : CodePoint) :
+    ExecutionHistory ctx point point := ⟨rfl, fun run _ => run⟩
+
+theorem trans {ctx : Ctx} {before middle after : CodePoint}
+    (earlier : ExecutionHistory ctx before middle)
+    (suffix : ExecutionHistory ctx middle after) :
+    ExecutionHistory ctx before after := by
+  refine ⟨earlier.resultWorld.trans suffix.resultWorld, ?_⟩
+  intro out run world
+  exact earlier.complete (suffix.complete run world)
+    (suffix.resultWorld.symm ▸ world)
+
+/-- Consume one successful operation without fixing the suffix fuel. -/
+theorem stepOp {ctx : Ctx} {current : FnDef}
+    {store nextStore : Store} {environment : List RVal}
+    {operation : Op} {next : Code} {value : RVal} {fuel : Nat}
+    (run : runOp ctx fuel current store environment operation =
+      .ok (nextStore, value)) :
+    ExecutionHistory ctx ⟨current, store, environment, .letOp operation next⟩
+      ⟨current, nextStore, value :: environment, next⟩ := by
+  refine ⟨rfl, ?_⟩
+  rintro out ⟨suffixFuel, suffix⟩ _world
+  let bound := max fuel suffixFuel
+  have prefixRun := runOp_mono (Nat.le_max_left fuel suffixFuel) run
+  have suffixRun := runCode_mono (Nat.le_max_right fuel suffixFuel) suffix
+  exact ⟨bound + 1, by simpa [bind, Except.bind, runCode, bound, prefixRun] using suffixRun⟩
+
+theorem caseCtor {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {scrutinee : Atom} {peelNat : Bool}
+    {alternatives : Array Alt} {location : Nat} {box : NodeBox}
+    {identity : CtorId} {fields : Array RVal} {tag fieldCount : Nat}
+    {body : Code}
+    (resolved : resolveAtom environment scrutinee = .ok (.loc location))
+    (found : store.get? location = some box)
+    (node : box.node = .ctorN identity fields)
+    (selected : alternatives.find? (fun alt => alt.cidx == identity.cidx) =
+      some (.mk tag fieldCount body))
+    (count : fields.size = fieldCount) :
+    ExecutionHistory ctx
+      ⟨current, store, environment, .case scrutinee peelNat alternatives⟩
+      ⟨current, store, fields.foldl (fun env value => value :: env) environment,
+        body⟩ := by
+  refine ⟨rfl, ?_⟩
+  rintro out ⟨fuel, run⟩ _world
+  exact ⟨fuel + 1, by
+    simpa [bind, Except.bind, runCode, resolved, found, node, selected, count] using run⟩
+
+theorem caseNatZero {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {scrutinee : Atom} {alternatives : Array Alt}
+    {tag : Nat} {body : Code}
+    (resolved : resolveAtom environment scrutinee = .ok (.lit (.nat 0)))
+    (selected : alternatives.find? (fun alt => alt.cidx == 0) =
+      some (.mk tag 0 body)) :
+    ExecutionHistory ctx
+      ⟨current, store, environment, .case scrutinee true alternatives⟩
+      ⟨current, store, environment, body⟩ := by
+  refine ⟨rfl, ?_⟩
+  rintro out ⟨fuel, run⟩ _world
+  exact ⟨fuel + 1, by simpa [bind, Except.bind, runCode, resolved, selected] using run⟩
+
+theorem caseNatSucc {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {scrutinee : Atom} {alternatives : Array Alt}
+    {predecessor tag : Nat} {body : Code}
+    (resolved : resolveAtom environment scrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (selected : alternatives.find? (fun alt => alt.cidx == 1) =
+      some (.mk tag 1 body)) :
+    ExecutionHistory ctx
+      ⟨current, store, environment, .case scrutinee true alternatives⟩
+      ⟨current, store, .lit (.nat predecessor) :: environment, body⟩ := by
+  refine ⟨rfl, ?_⟩
+  rintro out ⟨fuel, run⟩ _world
+  exact ⟨fuel + 1, by simpa [bind, Except.bind, runCode, resolved, selected] using run⟩
+
+end ExecutionHistory
+
+/-- Reassemble a function invocation from its completed body and the checked
+result world. -/
+theorem invoke_of_body_run {ctx : Ctx} {address : Address}
+    {definition : FnDef} {store : Store} {arguments : List RVal}
+    {fuel : Nat} {out : Store × RVal}
+    (declaration : ctx.decls address = some (.fn definition))
+    (arity : arguments.length = definition.arity)
+    (run : runCode ctx fuel definition store arguments.reverse definition.body =
+      .ok out)
+    (world : Sim.HasWorld out.1 definition.result out.2) :
+    invoke ctx (fuel + 1) address arguments store = .ok out := by
+  have checked := Sim.rval_hasWorld_eq_true_iff.mpr world
+  simp [bind, Except.bind, invoke, declaration, arity, run, checkResultWorld, checked]
+
+theorem runOp_call_of_body_run {ctx : Ctx} {current definition : FnDef}
+    {store : Store} {environment arguments : List RVal} {address : Address}
+    {atoms : Array Atom} {fuel : Nat} {out : Store × RVal}
+    (resolved : resolveAtoms environment atoms = .ok arguments)
+    (declaration : ctx.decls address = some (.fn definition))
+    (arity : arguments.length = definition.arity)
+    (run : runCode ctx fuel definition store arguments.reverse definition.body =
+      .ok out)
+    (world : Sim.HasWorld out.1 definition.result out.2) :
+    runOp ctx (fuel + 2) current store environment (.call address atoms) =
+      .ok out := by
+  simpa [bind, Except.bind, runOp, resolved] using invoke_of_body_run declaration arity run world
+
+theorem runOp_callSelf_of_body_run {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment arguments : List RVal}
+    {atoms : Array Atom} {fuel : Nat} {out : Store × RVal}
+    (resolved : resolveAtoms environment atoms = .ok arguments)
+    (arity : arguments.length = current.arity)
+    (run : runCode ctx fuel current store arguments.reverse current.body =
+      .ok out)
+    (world : Sim.HasWorld out.1 current.result out.2) :
+    runOp ctx (fuel + 1) current store environment (.callSelf atoms) =
+      .ok out := by
+  have checked := Sim.rval_hasWorld_eq_true_iff.mpr world
+  simp [bind, Except.bind, runOp, resolved, arity, run, checkResultWorld, checked]
+
+namespace ExecutionHistory
+
+theorem tailCall {ctx : Ctx} {current definition : FnDef}
+    {store : Store} {environment arguments : List RVal} {address : Address}
+    {atoms : Array Atom}
+    (resolved : resolveAtoms environment atoms = .ok arguments)
+    (declaration : ctx.decls address = some (.fn definition))
+    (arity : arguments.length = definition.arity)
+    (resultWorld : current.result = definition.result) :
+    ExecutionHistory ctx
+      ⟨current, store, environment, .letOp (.call address atoms) (.ret (.var 0))⟩
+      ⟨definition, store, arguments.reverse, definition.body⟩ := by
+  refine ⟨resultWorld, ?_⟩
+  rintro out ⟨fuel, run⟩ world
+  have call := runOp_call_of_body_run (current := current) resolved declaration
+    arity run world
+  exact ⟨fuel + 3, by
+    simp [bind, Except.bind, runCode, call, resolveAtom]⟩
+
+theorem tailCallSelf {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment arguments : List RVal} {atoms : Array Atom}
+    (resolved : resolveAtoms environment atoms = .ok arguments)
+    (arity : arguments.length = current.arity) :
+    ExecutionHistory ctx
+      ⟨current, store, environment, .letOp (.callSelf atoms) (.ret (.var 0))⟩
+      ⟨current, store, arguments.reverse, current.body⟩ := by
+  refine ⟨rfl, ?_⟩
+  rintro out ⟨fuel, run⟩ world
+  have call := runOp_callSelf_of_body_run resolved arity run world
+  exact ⟨fuel + 2, by simp [bind, Except.bind, runCode, call, resolveAtom]⟩
+
+end ExecutionHistory
+
+/-- A saturated PAP prefix and its eventual invocation can use different
+fuel bounds. Retaining captures and consuming the PAP are replayed exactly. -/
+theorem applyGo_exact_of_invoke {ctx : Ctx}
+    {store retained released : Store} {arguments : List RVal}
+    {location : Nat} {box : NodeBox}
+    {address : Address} {arity : Nat} {captured : Array RVal}
+    {declaration : Decl} {releaseFuel invokeFuel : Nat} {out : Store × RVal}
+    (found : store.get? location = some box)
+    (node : box.node = .papN address arity captured)
+    (retain : dupVals store captured.toList = .ok retained)
+    (release : dropVal ctx releaseFuel retained (.loc location) = .ok released)
+    (exactCount : (captured.toList ++ arguments).length = arity)
+    (declared : ctx.decls address = some declaration)
+    (papSafe : declPapSafe declaration = true)
+    (called : invoke ctx invokeFuel address (captured.toList ++ arguments)
+      released = .ok out) :
+    ∃ fuel, applyGo ctx (fuel + 1) store (.loc location) arguments = .ok out := by
+  let bound := max releaseFuel invokeFuel
+  have releasedAtBound := dropVal_mono
+    (Nat.le_max_left releaseFuel invokeFuel) release
+  have calledAtBound := invoke_mono
+    (Nat.le_max_right releaseFuel invokeFuel) called
+  refine ⟨bound, ?_⟩
+  simp [applyGo, found, node,
+    retain, releasedAtBound, exactCount, declared, papSafe, calledAtBound,
+    bound, bind, Except.bind]
+
+/-- Reconstruct the suspended source operation after joining the PAP prefix
+with its successful application. -/
+theorem runOp_apply_exact_of_invoke {ctx : Ctx} {current : FnDef}
+    {store retained released : Store} {environment arguments : List RVal}
+    {function : Atom} {atoms : Array Atom} {location : Nat} {box : NodeBox}
+    {address : Address} {arity : Nat} {captured : Array RVal}
+    {declaration : Decl} {releaseFuel invokeFuel : Nat} {out : Store × RVal}
+    (functionResolved : resolveAtom environment function = .ok (.loc location))
+    (argumentsResolved : resolveAtoms environment atoms = .ok arguments)
+    (found : store.get? location = some box)
+    (node : box.node = .papN address arity captured)
+    (retain : dupVals store captured.toList = .ok retained)
+    (release : dropVal ctx releaseFuel retained (.loc location) = .ok released)
+    (exactCount : (captured.toList ++ arguments).length = arity)
+    (declared : ctx.decls address = some declaration)
+    (papSafe : declPapSafe declaration = true)
+    (called : invoke ctx invokeFuel address (captured.toList ++ arguments)
+      released = .ok out) :
+    ∃ fuel, runOp ctx (fuel + 2) current store environment
+      (.apply function atoms) = .ok out := by
+  obtain ⟨fuel, applied⟩ := applyGo_exact_of_invoke
+    found node retain release exactCount declared papSafe called
+  exact ⟨fuel, by simp [runOp, functionResolved, argumentsResolved,
+    applied, bind, Except.bind]⟩
+
+/-- An over-applied PAP prefix composes with the first callee and the whole
+residual application. Repeated use handles arbitrary over-application depth. -/
+theorem applyGo_over_of_invoke {ctx : Ctx}
+    {store retained released : Store} {arguments : List RVal}
+    {location : Nat} {box : NodeBox}
+    {address : Address} {arity : Nat} {captured : Array RVal}
+    {declaration : Decl} {releaseFuel invokeFuel residualFuel : Nat}
+    {middle out : Store × RVal}
+    (found : store.get? location = some box)
+    (node : box.node = .papN address arity captured)
+    (retain : dupVals store captured.toList = .ok retained)
+    (release : dropVal ctx releaseFuel retained (.loc location) = .ok released)
+    (overCount : arity < (captured.toList ++ arguments).length)
+    (declared : ctx.decls address = some declaration)
+    (papSafe : declPapSafe declaration = true)
+    (called : invoke ctx invokeFuel address
+      ((captured.toList ++ arguments).take arity) released = .ok middle)
+    (residual : applyGo ctx residualFuel middle.1 middle.2
+      ((captured.toList ++ arguments).drop arity) = .ok out) :
+    ∃ fuel, applyGo ctx (fuel + 1) store (.loc location) arguments = .ok out := by
+  let bound := max releaseFuel (max invokeFuel residualFuel)
+  have releasedAtBound := dropVal_mono
+    (Nat.le_max_left releaseFuel (max invokeFuel residualFuel)) release
+  have calledAtBound := invoke_mono (Nat.le_trans
+    (Nat.le_max_left invokeFuel residualFuel)
+    (Nat.le_max_right releaseFuel (max invokeFuel residualFuel))) called
+  have residualAtBound := applyGo_mono (Nat.le_trans
+    (Nat.le_max_right invokeFuel residualFuel)
+    (Nat.le_max_right releaseFuel (max invokeFuel residualFuel))) residual
+  have notUnder : ¬ captured.size + arguments.length < arity := by
+    simpa using Nat.not_lt.mpr (Nat.le_of_lt overCount)
+  have notExact : ¬ captured.size + arguments.length = arity := by
+    simpa using Nat.ne_of_gt overCount
+  refine ⟨bound, ?_⟩
+  simp [applyGo, found, node,
+    retain, releasedAtBound, notUnder, notExact, declared, papSafe,
+    calledAtBound, residualAtBound, bound, bind, Except.bind]
+
+/-- Reconstruct the suspended source operation after joining the PAP prefix
+with its successful application. -/
+theorem runOp_apply_over_of_invoke {ctx : Ctx} {current : FnDef}
+    {store retained released : Store} {environment arguments : List RVal}
+    {function : Atom} {atoms : Array Atom} {location : Nat} {box : NodeBox}
+    {address : Address} {arity : Nat} {captured : Array RVal}
+    {declaration : Decl} {releaseFuel invokeFuel residualFuel : Nat}
+    {middle out : Store × RVal}
+    (functionResolved : resolveAtom environment function = .ok (.loc location))
+    (argumentsResolved : resolveAtoms environment atoms = .ok arguments)
+    (found : store.get? location = some box)
+    (node : box.node = .papN address arity captured)
+    (retain : dupVals store captured.toList = .ok retained)
+    (release : dropVal ctx releaseFuel retained (.loc location) = .ok released)
+    (overCount : arity < (captured.toList ++ arguments).length)
+    (declared : ctx.decls address = some declaration)
+    (papSafe : declPapSafe declaration = true)
+    (called : invoke ctx invokeFuel address
+      ((captured.toList ++ arguments).take arity) released = .ok middle)
+    (residual : applyGo ctx residualFuel middle.1 middle.2
+      ((captured.toList ++ arguments).drop arity) = .ok out) :
+    ∃ fuel, runOp ctx (fuel + 2) current store environment
+      (.apply function atoms) = .ok out := by
+  obtain ⟨fuel, applied⟩ := applyGo_over_of_invoke
+    found node retain release overCount declared papSafe called residual
+  exact ⟨fuel, by simp [runOp, functionResolved, argumentsResolved,
+    applied, bind, Except.bind]⟩
+
+/-- Operations which cannot call source code or the scalar oracle. PAP
+allocation is included: it inspects declarations but does not enter them. -/
+def Op.isImmediate : Op → Bool
+  | .call .. | .callSelf .. | .apply .. | .extern .. => false
+  | _ => true
+
+/-- Immediate source steps can be recorded in the canonical compiler
+context, independently of the ambient oracle. -/
+theorem runOp_immediate_ctx_eq (before after : Ctx)
+    (declarations : after.decls = before.decls) (fuel : Nat)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (operation : Op) (immediate : operation.isImmediate = true) :
+    runOp after fuel current store environment operation =
+      runOp before fuel current store environment operation := by
+  cases fuel with
+  | zero => simp [runOp]
+  | succ fuel =>
+      cases operation <;> simp only [Op.isImmediate] at immediate
+      all_goals try contradiction
+      all_goals simp only [runOp]
+      all_goals try rfl
+      · simp only [Sim.dropVal_ctx_eq before after]
+      · simp only [Sim.dropUVal_ctx_eq before after]
+      · rw [declarations]
+
+/-- Erased application only consumes its arguments, so its oracle is inert. -/
+theorem runOp_apply_erased_ctx_eq (before after : Ctx) (fuel : Nat)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (function : Atom) (atoms : Array Atom)
+    (resolved : resolveAtom environment function = .ok .erased) :
+    runOp after fuel current store environment (.apply function atoms) =
+      runOp before fuel current store environment (.apply function atoms) := by
+  cases fuel with
+  | zero => simp [runOp]
+  | succ fuel =>
+      simp only [runOp, resolved, bind, Except.bind]
+      cases fuel with
+      | zero => simp [applyGo]
+      | succ fuel => simp only [applyGo, Sim.dropMany_ctx_eq before after]
+
+/-- Under-application only rebuilds a PAP after retaining and releasing its
+captures; declaration lookup and the oracle are both inert. -/
+theorem runOp_apply_under_ctx_eq (before after : Ctx) (fuel : Nat)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (function : Atom) (atoms : Array Atom)
+    {location : Nat} {box : NodeBox} {address : Address} {arity : Nat}
+    {captured : Array RVal} {arguments : List RVal}
+    (functionResolved : resolveAtom environment function = .ok (.loc location))
+    (argumentsResolved : resolveAtoms environment atoms = .ok arguments)
+    (found : store.get? location = some box)
+    (node : box.node = .papN address arity captured)
+    (under : (captured.toList ++ arguments).length < arity) :
+    runOp after fuel current store environment (.apply function atoms) =
+      runOp before fuel current store environment (.apply function atoms) := by
+  cases fuel with
+  | zero => simp [runOp]
+  | succ fuel =>
+      simp only [runOp, functionResolved, argumentsResolved, bind, Except.bind]
+      cases fuel with
+      | zero => simp [applyGo]
+      | succ fuel =>
+          simp only [applyGo, found, node, under, if_true,
+            Sim.dropVal_ctx_eq before after]
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/EvalIso.lean b/Ix/Compiler/IxIR1/EvalIso.lean
new file mode 100644
index 000000000..0e08edb68
--- /dev/null
+++ b/Ix/Compiler/IxIR1/EvalIso.lean
@@ -0,0 +1,2692 @@
+import Ix.Compiler.IxIR1.Mono
+import Ix.Compiler.IxIR1.Reclamation
+import Ix.Compiler.IxIR1.Sim
+
+/-!
+# IxIR₁ evaluation modulo allocation history
+
+Shrinking heap optimizations deliberately change cost counters, leave
+different dead holes, and consequently assign different numeric locations to
+later allocations.  Literal equality of `Store × RVal` is therefore too
+strong for those passes.
+
+`HeapHistoryIso` is the evaluator-facing relation for that boundary.  It is a
+finite partial bijection which covers every live location, may retain pairs of
+dead locations, and may omit unmatched dead holes.  Corresponding live boxes
+agree in world, reference count, node identity, and recursively in their
+children.  Cost counters are intentionally absent.
+
+Retaining dead/dead pairs is important: recursive destruction may kill a
+parent before traversing its saved children, and stale environment slots may
+still name a consumed value even though well-moded code never uses it again.
+The relation can preserve those historical names without pretending that a
+dead slot is live.
+-/
+
+namespace Ix.Compiler.IxIR1.Sim
+
+open Ix.Compiler.Ixon (Owned)
+
+/-- A location relation covering all live nodes and optionally remembering
+dead/dead location pairs.  Every related location is an already allocated
+slot, which makes extension by fresh allocations unambiguous. -/
+structure HeapHistoryIso (left right : Store) where
+  locRel : Nat → Nat → Prop
+  left_unique : ∀ {l r₁ r₂}, locRel l r₁ → locRel l r₂ → r₁ = r₂
+  right_unique : ∀ {l₁ l₂ r}, locRel l₁ r → locRel l₂ r → l₁ = l₂
+  left_bound : ∀ {l r}, locRel l r → l < left.nodes.size
+  right_bound : ∀ {l r}, locRel l r → r < right.nodes.size
+  left_total : ∀ {loc box}, left.get? loc = some box →
+    ∃ rightLoc, locRel loc rightLoc
+  right_total : ∀ {loc box}, right.get? loc = some box →
+    ∃ leftLoc, locRel leftLoc loc
+  related : ∀ {leftLoc rightLoc}, locRel leftLoc rightLoc →
+    (left.get? leftLoc = none ∧ right.get? rightLoc = none) ∨
+      ∃ leftBox rightBox,
+        left.get? leftLoc = some leftBox ∧
+        right.get? rightLoc = some rightBox ∧
+        NodeBoxIso locRel leftBox rightBox
+
+namespace HeapHistoryIso
+
+/-- Canonical self-history: every already allocated slot is paired with
+itself, including dead slots.  Closure supplies the corresponding relation
+for children of live nodes. -/
+def refl (store : Store) (closed : StoreClosed store) :
+    HeapHistoryIso store store where
+  locRel := fun left right => left = right ∧ left < store.nodes.size
+  left_unique := by
+    intro left right₁ right₂ h₁ h₂
+    exact h₁.1.symm.trans h₂.1
+  right_unique := by
+    intro left₁ left₂ right h₁ h₂
+    exact h₁.1.trans h₂.1.symm
+  left_bound := fun h => h.2
+  right_bound := by
+    intro left right h
+    simpa [h.1] using h.2
+  left_total := by
+    intro location box hget
+    have hbound : location < store.nodes.size := by
+      unfold Store.get? at hget
+      rw [Option.bind_eq_some_iff] at hget
+      obtain ⟨slot, hslot, _⟩ := hget
+      exact (Array.getElem?_eq_some_iff.mp hslot).1
+    exact ⟨location, rfl, hbound⟩
+  right_total := by
+    intro location box hget
+    have hbound : location < store.nodes.size := by
+      unfold Store.get? at hget
+      rw [Option.bind_eq_some_iff] at hget
+      obtain ⟨slot, hslot, _⟩ := hget
+      exact (Array.getElem?_eq_some_iff.mp hslot).1
+    exact ⟨location, rfl, hbound⟩
+  related := by
+    intro left right hrel
+    obtain ⟨rfl, hbound⟩ := hrel
+    cases hget : store.get? left with
+    | none => exact .inl ⟨rfl, rfl⟩
+    | some box =>
+        let live := HeapIso.refl store closed
+        have hlive : live.locRel left left := by
+          exact ⟨rfl, box, hget⟩
+        obtain ⟨leftBox, rightBox, hleft, hright, hbox⟩ :=
+          live.related_live hlive
+        have hleftBox : leftBox = box := Option.some.inj (hleft.symm.trans hget)
+        have hrightBox : rightBox = box :=
+          Option.some.inj (hright.symm.trans hget)
+        subst leftBox
+        subst rightBox
+        refine .inr ⟨box, box, rfl, rfl, hbox.mono ?_⟩
+        intro childLeft childRight hchild
+        obtain ⟨heq, childBox, hchildGet⟩ := hchild
+        subst childRight
+        have hchildBound : childLeft < store.nodes.size := by
+          unfold Store.get? at hchildGet
+          rw [Option.bind_eq_some_iff] at hchildGet
+          obtain ⟨slot, hslot, _⟩ := hchildGet
+          exact (Array.getElem?_eq_some_iff.mp hslot).1
+        exact ⟨rfl, hchildBound⟩
+
+private theorem get?_setBox_eq {store : Store} {loc other : Nat}
+    {old new : NodeBox} (hget : store.get? loc = some old) :
+    (store.setBox loc new).get? other =
+      if other = loc then some new else store.get? other := by
+  have hlt : loc < store.nodes.size := by
+    exact (Array.getElem?_eq_some_iff.mp (nodes_get?_of_get? hget)).1
+  by_cases hsame : other = loc
+  · subst other
+    simp [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds, hlt]
+  · have hne : loc ≠ other := Ne.symm hsame
+    simp [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds,
+      Array.getElem?_setIfInBounds, hlt, hne, hsame]
+
+private theorem get?_setBox_eq_of_bound {store : Store} {loc other : Nat}
+    {new : NodeBox} (hlt : loc < store.nodes.size) :
+    (store.setBox loc new).get? other =
+      if other = loc then some new else store.get? other := by
+  by_cases hsame : other = loc
+  · subst other
+    simp [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds, hlt]
+  · have hne : loc ≠ other := Ne.symm hsame
+    simp [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds,
+      Array.getElem?_setIfInBounds, hlt, hne, hsame]
+
+private theorem get?_kill_eq {store : Store} {loc other : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    (store.kill loc).get? other =
+      if other = loc then none else store.get? other := by
+  have hlt : loc < store.nodes.size := by
+    exact (Array.getElem?_eq_some_iff.mp (nodes_get?_of_get? hget)).1
+  by_cases hsame : other = loc
+  · subst other
+    simp [Store.kill, Store.get?, Array.set!_eq_setIfInBounds, hlt]
+  · have hne : loc ≠ other := Ne.symm hsame
+    simp [Store.kill, Store.get?, Array.set!_eq_setIfInBounds,
+      Array.getElem?_setIfInBounds, hlt, hne, hsame]
+
+private theorem get?_allocNode_eq (store : Store) (world : Owned)
+    (node : Node) (loc : Nat) :
+    (store.allocNode world node).1.get? loc =
+      if loc = store.nodes.size then some ⟨world, 1, node⟩
+      else store.get? loc := by
+  by_cases hsame : loc = store.nodes.size
+  · subst loc
+    simp [Store.allocNode, Store.get?]
+  · simp [Store.allocNode, Store.get?, Array.getElem?_push, hsame]
+
+/-- Corresponding live boxes can be recovered from a related live location. -/
+theorem boxes {left right : Store} (iso : HeapHistoryIso left right)
+    {leftLoc rightLoc : Nat} (hrel : iso.locRel leftLoc rightLoc)
+    {leftBox : NodeBox} (hleft : left.get? leftLoc = some leftBox) :
+    ∃ rightBox,
+      right.get? rightLoc = some rightBox ∧
+        NodeBoxIso iso.locRel leftBox rightBox := by
+  rcases iso.related hrel with hdead | hlive
+  · exact False.elim (Option.some_ne_none leftBox (hleft.symm.trans hdead.1))
+  · obtain ⟨foundLeft, rightBox, hfound, hright, hbox⟩ := hlive
+    have : foundLeft = leftBox := Option.some.inj (hfound.symm.trans hleft)
+    subst foundLeft
+    exact ⟨rightBox, hright, hbox⟩
+
+private def liveRel {left right : Store}
+    (iso : HeapHistoryIso left right) (leftLoc rightLoc : Nat) : Prop :=
+  iso.locRel leftLoc rightLoc ∧
+    ∃ leftBox, left.get? leftLoc = some leftBox
+
+private theorem RValsIso.liveMono {left right : Store}
+    (iso : HeapHistoryIso left right) :
+    ∀ {leftValues rightValues : List RVal},
+      RValsIso iso.locRel leftValues rightValues →
+      (∀ value ∈ leftValues, LiveRVal left value) →
+      RValsIso (liveRel iso) leftValues rightValues
+  | _, _, .nil, _ => .nil
+  | _, _, .cons head tail, live => by
+      refine .cons ?_ (RValsIso.liveMono iso tail fun value member =>
+        live value (by simp [member]))
+      cases head with
+      | @loc leftLoc rightLoc related =>
+          exact .loc ⟨related, live (.loc leftLoc) (by simp)⟩
+      | lit => exact .lit
+      | erased => exact .erased
+
+private theorem NodeIso.liveMono {left right : Store}
+    (iso : HeapHistoryIso left right) :
+    ∀ {leftNode rightNode : Node},
+      NodeIso iso.locRel leftNode rightNode →
+      (∀ value ∈ nodeChildren leftNode, LiveRVal left value) →
+      NodeIso (liveRel iso) leftNode rightNode
+  | _, _, .ctor fields, live =>
+      .ctor (RValsIso.liveMono iso fields fun value member =>
+        live value (by simpa [nodeChildren] using member))
+  | _, _, .pap arguments, live =>
+      .pap (RValsIso.liveMono iso arguments fun value member =>
+        live value (by simpa [nodeChildren] using member))
+
+private theorem NodeBoxIso.liveMono {left right : Store}
+    (iso : HeapHistoryIso left right) (closed : StoreClosed left)
+    {leftLoc : Nat} {leftBox rightBox : NodeBox}
+    (leftAt : left.get? leftLoc = some leftBox)
+    (boxes : NodeBoxIso iso.locRel leftBox rightBox) :
+    NodeBoxIso (liveRel iso) leftBox rightBox :=
+  ⟨boxes.world, boxes.rc,
+    NodeIso.liveMono iso boxes.node (closed leftAt)⟩
+
+/-- Forget historical dead/dead rows, retaining the exact bijection on live
+locations. Closure ensures every child relation of a live node also belongs
+to the restricted live relation. -/
+def toHeapIso {left right : Store} (iso : HeapHistoryIso left right)
+    (closed : StoreClosed left) : HeapIso left right where
+  locRel := liveRel iso
+  left_unique := fun first second => iso.left_unique first.1 second.1
+  right_unique := fun first second => iso.right_unique first.1 second.1
+  left_total := by
+    intro leftLoc leftBox leftAt
+    obtain ⟨rightLoc, related⟩ := iso.left_total leftAt
+    exact ⟨rightLoc, related, leftBox, leftAt⟩
+  right_total := by
+    intro rightLoc rightBox rightAt
+    obtain ⟨leftLoc, related⟩ := iso.right_total rightAt
+    rcases iso.related related with dead | live
+    · exact False.elim
+        (Option.some_ne_none rightBox (rightAt.symm.trans dead.2))
+    · obtain ⟨leftBox, _foundRight, leftAt, _foundRightAt, _boxes⟩ := live
+      exact ⟨leftLoc, related, leftBox, leftAt⟩
+  related_live := by
+    intro leftLoc rightLoc related
+    obtain ⟨historyRelated, leftBox, leftAt⟩ := related
+    obtain ⟨rightBox, rightAt, boxes⟩ := iso.boxes historyRelated leftAt
+    exact ⟨leftBox, rightBox, leftAt, rightAt,
+      NodeBoxIso.liveMono iso closed leftAt boxes⟩
+
+/-- A live historical pair is retained by `toHeapIso`. -/
+theorem toHeapIso_rel {left right : Store}
+    (iso : HeapHistoryIso left right) (closed : StoreClosed left)
+    {leftLoc rightLoc : Nat} (related : iso.locRel leftLoc rightLoc)
+    {leftBox : NodeBox} (leftAt : left.get? leftLoc = some leftBox) :
+    (iso.toHeapIso closed).locRel leftLoc rightLoc :=
+  ⟨related, leftBox, leftAt⟩
+
+/-- Restricting a history relation does not invent location pairs. -/
+theorem of_toHeapIso_rel {left right : Store}
+    (iso : HeapHistoryIso left right) (closed : StoreClosed left)
+    {leftLoc rightLoc : Nat}
+    (related : (iso.toHeapIso closed).locRel leftLoc rightLoc) :
+    iso.locRel leftLoc rightLoc :=
+  related.1
+
+/-- The symmetric evaluator relation. -/
+def symm {left right : Store} (iso : HeapHistoryIso left right) :
+    HeapHistoryIso right left where
+  locRel := fun r l => iso.locRel l r
+  left_unique := iso.right_unique
+  right_unique := iso.left_unique
+  left_bound := iso.right_bound
+  right_bound := iso.left_bound
+  left_total := iso.right_total
+  right_total := iso.left_total
+  related := by
+    intro rightLoc leftLoc hrel
+    rcases iso.related hrel with ⟨hl, hr⟩ | hlive
+    · exact .inl ⟨hr, hl⟩
+    · obtain ⟨leftBox, rightBox, hl, hr, hbox⟩ := hlive
+      exact .inr ⟨rightBox, leftBox, hr, hl, hbox.symm⟩
+
+/-- A heap-history isomorphism cannot introduce a live node on the right when
+the left heap has none.  Dead historical slots may differ, so this is stated
+through the public live-node observation rather than array equality. -/
+theorem right_live_eq_zero {left right : Store}
+    (iso : HeapHistoryIso left right) (hleft : left.live = 0) :
+    right.live = 0 := by
+  apply (Reclamation.Store.live_eq_zero_iff_no_live_slot right).2
+  intro rightBox hrightMember
+  obtain ⟨rightLoc, hrightSlot⟩ :=
+    (Array.mem_iff_getElem?).mp hrightMember
+  have hright : right.get? rightLoc = some rightBox := by
+    rw [Store.get?, hrightSlot]
+    rfl
+  obtain ⟨leftLoc, hrel⟩ := iso.right_total hright
+  rcases iso.related hrel with hdead | hlive
+  · exact Option.some_ne_none rightBox (hright.symm.trans hdead.2)
+  · obtain ⟨leftBox, foundRight, hleftGet, hrightGet, _⟩ := hlive
+    have hleftMember : some leftBox ∈ left.nodes := by
+      apply (Array.mem_iff_getElem?).2
+      exact ⟨leftLoc, nodes_get?_of_get? hleftGet⟩
+    exact (Reclamation.Store.live_eq_zero_iff_no_live_slot left).1 hleft
+      leftBox hleftMember
+
+/-- Symmetric empty-live transport. -/
+theorem left_live_eq_zero {left right : Store}
+    (iso : HeapHistoryIso left right) (hright : right.live = 0) :
+    left.live = 0 :=
+  iso.symm.right_live_eq_zero hright
+
+/-- Composition of allocation histories.  A dead/dead row composes only with
+another dead/dead row; a live middle location forces both sides to expose the
+same middle box, so node isomorphisms compose. -/
+def trans {left middle right : Store}
+    (first : HeapHistoryIso left middle)
+    (second : HeapHistoryIso middle right) : HeapHistoryIso left right where
+  locRel := fun leftLoc rightLoc =>
+    ∃ middleLoc, first.locRel leftLoc middleLoc ∧
+      second.locRel middleLoc rightLoc
+  left_unique := by
+    intro leftLoc right₁ right₂ h₁ h₂
+    obtain ⟨middle₁, hleft₁, hright₁⟩ := h₁
+    obtain ⟨middle₂, hleft₂, hright₂⟩ := h₂
+    have hmiddle : middle₁ = middle₂ :=
+      first.left_unique hleft₁ hleft₂
+    subst middle₂
+    exact second.left_unique hright₁ hright₂
+  right_unique := by
+    intro left₁ left₂ rightLoc h₁ h₂
+    obtain ⟨middle₁, hleft₁, hright₁⟩ := h₁
+    obtain ⟨middle₂, hleft₂, hright₂⟩ := h₂
+    have hmiddle : middle₁ = middle₂ :=
+      second.right_unique hright₁ hright₂
+    subst middle₂
+    exact first.right_unique hleft₁ hleft₂
+  left_bound := by
+    intro leftLoc rightLoc hrel
+    exact first.left_bound hrel.choose_spec.1
+  right_bound := by
+    intro leftLoc rightLoc hrel
+    exact second.right_bound hrel.choose_spec.2
+  left_total := by
+    intro leftLoc leftBox hleft
+    obtain ⟨middleLoc, hmiddleRel⟩ := first.left_total hleft
+    rcases first.related hmiddleRel with hdead | hlive
+    · exact False.elim
+        (Option.some_ne_none leftBox (hleft.symm.trans hdead.1))
+    · obtain ⟨foundLeft, middleBox, hfoundLeft, hmiddle, _⟩ := hlive
+      obtain ⟨rightLoc, hrightRel⟩ := second.left_total hmiddle
+      exact ⟨rightLoc, middleLoc, hmiddleRel, hrightRel⟩
+  right_total := by
+    intro rightLoc rightBox hright
+    obtain ⟨middleLoc, hmiddleRel⟩ := second.right_total hright
+    rcases second.related hmiddleRel with hdead | hlive
+    · exact False.elim
+        (Option.some_ne_none rightBox (hright.symm.trans hdead.2))
+    · obtain ⟨middleBox, foundRight, hmiddle, hfoundRight, _⟩ := hlive
+      obtain ⟨leftLoc, hleftRel⟩ := first.right_total hmiddle
+      exact ⟨leftLoc, middleLoc, hleftRel, hmiddleRel⟩
+  related := by
+    intro leftLoc rightLoc hrel
+    obtain ⟨middleLoc, hleftRel, hrightRel⟩ := hrel
+    rcases first.related hleftRel with hfirstDead | hfirstLive
+    · rcases second.related hrightRel with hsecondDead | hsecondLive
+      · exact .inl ⟨hfirstDead.1, hsecondDead.2⟩
+      · obtain ⟨middleBox, rightBox, hmiddle, _, _⟩ := hsecondLive
+        exact False.elim
+          (Option.some_ne_none middleBox (hmiddle.symm.trans hfirstDead.2))
+    · obtain ⟨leftBox, middleBox₁, hleft, hmiddle₁, hbox₁⟩ :=
+        hfirstLive
+      rcases second.related hrightRel with hsecondDead | hsecondLive
+      · exact False.elim
+          (Option.some_ne_none middleBox₁
+            (hmiddle₁.symm.trans hsecondDead.1))
+      · obtain ⟨middleBox₂, rightBox, hmiddle₂, hright, hbox₂⟩ :=
+          hsecondLive
+        have hmiddleBox : middleBox₁ = middleBox₂ :=
+          Option.some.inj (hmiddle₁.symm.trans hmiddle₂)
+        subst middleBox₂
+        exact .inr ⟨leftBox, rightBox, hleft, hright,
+          hbox₁.trans hbox₂⟩
+
+/-- Updating corresponding live boxes preserves allocation history. -/
+def setBox {left right : Store} (iso : HeapHistoryIso left right)
+    {leftLoc rightLoc : Nat} (hrel : iso.locRel leftLoc rightLoc)
+    {oldLeft oldRight newLeft newRight : NodeBox}
+    (hleft : left.get? leftLoc = some oldLeft)
+    (hright : right.get? rightLoc = some oldRight)
+    (hnew : NodeBoxIso iso.locRel newLeft newRight) :
+    HeapHistoryIso (left.setBox leftLoc newLeft)
+      (right.setBox rightLoc newRight) where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro l r hrel
+    simpa [Store.setBox] using iso.left_bound hrel
+  right_bound := by
+    intro l r hrel
+    simpa [Store.setBox] using iso.right_bound hrel
+  left_total := by
+    intro loc box hbox
+    rw [get?_setBox_eq hleft] at hbox
+    by_cases hsame : loc = leftLoc
+    · exact ⟨rightLoc, hsame ▸ hrel⟩
+    · simp only [hsame, if_false] at hbox
+      exact iso.left_total hbox
+  right_total := by
+    intro loc box hbox
+    rw [get?_setBox_eq hright] at hbox
+    by_cases hsame : loc = rightLoc
+    · exact ⟨leftLoc, hsame ▸ hrel⟩
+    · simp only [hsame, if_false] at hbox
+      exact iso.right_total hbox
+  related := by
+    intro l r hlr
+    have hlEq := get?_setBox_eq (new := newLeft) hleft (other := l)
+    have hrEq := get?_setBox_eq (new := newRight) hright (other := r)
+    by_cases hll : l = leftLoc
+    · have hrr : r = rightLoc := iso.left_unique hlr (hll ▸ hrel)
+      subst l
+      subst r
+      simp only [if_pos, hlEq, hrEq]
+      exact .inr ⟨newLeft, newRight, rfl, rfl, hnew⟩
+    · have hrr : r ≠ rightLoc := by
+        intro heq
+        have := iso.right_unique hlr (heq ▸ hrel)
+        exact hll this
+      simp only [hll, hrr, if_false, hlEq, hrEq]
+      exact iso.related hlr
+
+/-- Reviving corresponding dead historical slots preserves allocation
+history.  Physical reuse credits exercise this operation: the pair remains
+the same, but its observation changes from dead/dead to related live boxes. -/
+def revive {left right : Store} (iso : HeapHistoryIso left right)
+    {leftLoc rightLoc : Nat} (hrel : iso.locRel leftLoc rightLoc)
+    (hleft : left.get? leftLoc = none)
+    (hright : right.get? rightLoc = none)
+    {newLeft newRight : NodeBox}
+    (hnew : NodeBoxIso iso.locRel newLeft newRight) :
+    HeapHistoryIso (left.setBox leftLoc newLeft)
+      (right.setBox rightLoc newRight) where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro l r related
+    simpa [Store.setBox] using iso.left_bound related
+  right_bound := by
+    intro l r related
+    simpa [Store.setBox] using iso.right_bound related
+  left_total := by
+    intro loc box live
+    rw [get?_setBox_eq_of_bound (iso.left_bound hrel)] at live
+    by_cases same : loc = leftLoc
+    · exact ⟨rightLoc, same ▸ hrel⟩
+    · simp only [same, if_false] at live
+      exact iso.left_total live
+  right_total := by
+    intro loc box live
+    rw [get?_setBox_eq_of_bound (iso.right_bound hrel)] at live
+    by_cases same : loc = rightLoc
+    · exact ⟨leftLoc, same ▸ hrel⟩
+    · simp only [same, if_false] at live
+      exact iso.right_total live
+  related := by
+    intro l r related
+    have leftEq := get?_setBox_eq_of_bound
+      (new := newLeft) (iso.left_bound hrel) (other := l)
+    have rightEq := get?_setBox_eq_of_bound
+      (new := newRight) (iso.right_bound hrel) (other := r)
+    by_cases leftSame : l = leftLoc
+    · have rightSame : r = rightLoc :=
+        iso.left_unique related (leftSame ▸ hrel)
+      subst l
+      subst r
+      simp only [if_pos, leftEq, rightEq]
+      exact .inr ⟨newLeft, newRight, rfl, rfl, hnew⟩
+    · have rightDifferent : r ≠ rightLoc := by
+        intro same
+        have := iso.right_unique related (same ▸ hrel)
+        exact leftSame this
+      simp only [leftSame, rightDifferent, if_false, leftEq, rightEq]
+      exact iso.related related
+
+/-- Killing corresponding live locations retains their historical pair as a
+dead/dead row.  This is the operation for which live-only heap isomorphism is
+not compositional. -/
+def kill {left right : Store} (iso : HeapHistoryIso left right)
+    {leftLoc rightLoc : Nat} (hrel : iso.locRel leftLoc rightLoc)
+    {leftBox rightBox : NodeBox}
+    (hleft : left.get? leftLoc = some leftBox)
+    (hright : right.get? rightLoc = some rightBox) :
+    HeapHistoryIso (left.kill leftLoc) (right.kill rightLoc) where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro l r hrel
+    simpa [Store.kill] using iso.left_bound hrel
+  right_bound := by
+    intro l r hrel
+    simpa [Store.kill] using iso.right_bound hrel
+  left_total := by
+    intro loc box hbox
+    rw [get?_kill_eq hleft] at hbox
+    by_cases hsame : loc = leftLoc
+    · simp [hsame] at hbox
+    · simp only [hsame, if_false] at hbox
+      exact iso.left_total hbox
+  right_total := by
+    intro loc box hbox
+    rw [get?_kill_eq hright] at hbox
+    by_cases hsame : loc = rightLoc
+    · simp [hsame] at hbox
+    · simp only [hsame, if_false] at hbox
+      exact iso.right_total hbox
+  related := by
+    intro l r hlr
+    have hlEq := get?_kill_eq hleft (other := l)
+    have hrEq := get?_kill_eq hright (other := r)
+    by_cases hll : l = leftLoc
+    · have hrr : r = rightLoc := iso.left_unique hlr (hll ▸ hrel)
+      subst l
+      subst r
+      exact .inl ⟨get?_kill_same hleft, get?_kill_same hright⟩
+    · have hrr : r ≠ rightLoc := by
+        intro heq
+        have := iso.right_unique hlr (heq ▸ hrel)
+        exact hll this
+      simp only [hll, hrr, if_false, hlEq, hrEq]
+      exact iso.related hlr
+
+/-- Cost-counter ticks do not affect heap history. -/
+def rcTick {left right : Store} (iso : HeapHistoryIso left right) :
+    HeapHistoryIso left.rcTick right.rcTick where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro l r hrel
+    simpa [Store.rcTick] using iso.left_bound hrel
+  right_bound := by
+    intro l r hrel
+    simpa [Store.rcTick] using iso.right_bound hrel
+  left_total := by
+    intro loc box hget
+    exact iso.left_total (by simpa [Store.rcTick, Store.get?] using hget)
+  right_total := by
+    intro loc box hget
+    exact iso.right_total (by simpa [Store.rcTick, Store.get?] using hget)
+  related := by
+    intro l r hrel
+    simpa [Store.rcTick, Store.get?] using iso.related hrel
+
+/-- Any update which leaves the node arrays unchanged is invisible to heap
+history.  Evaluator cost counters use this boundary. -/
+def nodesEq {left right nextLeft nextRight : Store}
+    (iso : HeapHistoryIso left right)
+    (hleft : nextLeft.nodes = left.nodes)
+    (hright : nextRight.nodes = right.nodes) :
+    HeapHistoryIso nextLeft nextRight where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro l r hrel
+    simpa [hleft] using iso.left_bound hrel
+  right_bound := by
+    intro l r hrel
+    simpa [hright] using iso.right_bound hrel
+  left_total := by
+    intro loc box hget
+    apply iso.left_total
+    simpa [Store.get?, hleft] using hget
+  right_total := by
+    intro loc box hget
+    apply iso.right_total
+    simpa [Store.get?, hright] using hget
+  related := by
+    intro l r hrel
+    simpa [Store.get?, hleft, hright] using iso.related hrel
+
+/-- Corresponding fresh allocations extend the history bijection. -/
+def alloc {left right : Store} (iso : HeapHistoryIso left right)
+    {world : Owned} {leftNode rightNode : Node}
+    (hnode : NodeIso iso.locRel leftNode rightNode) :
+    HeapHistoryIso (left.allocNode world leftNode).1
+      (right.allocNode world rightNode).1 := by
+  let leftLoc := left.nodes.size
+  let rightLoc := right.nodes.size
+  let extended : Nat → Nat → Prop := fun l r =>
+    (l = leftLoc ∧ r = rightLoc) ∨ iso.locRel l r
+  have leftFresh : ∀ r, ¬ iso.locRel leftLoc r := by
+    intro r hrel
+    exact (Nat.lt_irrefl leftLoc) (iso.left_bound hrel)
+  have rightFresh : ∀ l, ¬ iso.locRel l rightLoc := by
+    intro l hrel
+    exact (Nat.lt_irrefl rightLoc) (iso.right_bound hrel)
+  refine
+    { locRel := extended
+      left_unique := ?_
+      right_unique := ?_
+      left_bound := ?_
+      right_bound := ?_
+      left_total := ?_
+      right_total := ?_
+      related := ?_ }
+  · intro l r₁ r₂ h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.2.trans h₂.2.symm
+    · rw [h₁.1] at h₂
+      exact False.elim (leftFresh r₂ h₂)
+    · rw [h₂.1] at h₁
+      exact False.elim (leftFresh r₁ h₁)
+    · exact iso.left_unique h₁ h₂
+  · intro l₁ l₂ r h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.1.trans h₂.1.symm
+    · rw [h₁.2] at h₂
+      exact False.elim (rightFresh l₂ h₂)
+    · rw [h₂.2] at h₁
+      exact False.elim (rightFresh l₁ h₁)
+    · exact iso.right_unique h₁ h₂
+  · intro l r hrel
+    rcases hrel with ⟨rfl, rfl⟩ | hold
+    · simp [leftLoc, Store.allocNode]
+    · exact Nat.lt_trans (iso.left_bound hold) (by simp [Store.allocNode])
+  · intro l r hrel
+    rcases hrel with ⟨rfl, rfl⟩ | hold
+    · simp [rightLoc, Store.allocNode]
+    · exact Nat.lt_trans (iso.right_bound hold) (by simp [Store.allocNode])
+  · intro loc box hbox
+    rw [get?_allocNode_eq] at hbox
+    by_cases hnew : loc = leftLoc
+    · exact ⟨rightLoc, .inl ⟨hnew, rfl⟩⟩
+    · simp only [leftLoc, hnew, if_false] at hbox
+      obtain ⟨r, hr⟩ := iso.left_total hbox
+      exact ⟨r, .inr hr⟩
+  · intro loc box hbox
+    rw [get?_allocNode_eq] at hbox
+    by_cases hnew : loc = rightLoc
+    · exact ⟨leftLoc, .inl ⟨rfl, hnew⟩⟩
+    · simp only [rightLoc, hnew, if_false] at hbox
+      obtain ⟨l, hl⟩ := iso.right_total hbox
+      exact ⟨l, .inr hl⟩
+  · intro l r hrel
+    rcases hrel with hnew | hold
+    · obtain ⟨rfl, rfl⟩ := hnew
+      refine .inr ⟨⟨world, 1, leftNode⟩, ⟨world, 1, rightNode⟩,
+        ?_, ?_, ?_⟩
+      · simp [leftLoc, get?_allocNode_eq]
+      · simp [rightLoc, get?_allocNode_eq]
+      · exact ⟨rfl, rfl, hnode.mono (fun h => .inr h)⟩
+    · have hleftOld := get?_allocNode_eq left world leftNode l
+      have hrightOld := get?_allocNode_eq right world rightNode r
+      have hln : l ≠ leftLoc := by
+        intro heq
+        exact leftFresh r (heq ▸ hold)
+      have hrn : r ≠ rightLoc := by
+        intro heq
+        exact rightFresh l (heq ▸ hold)
+      simp only [leftLoc, hln, if_false] at hleftOld
+      simp only [rightLoc, hrn, if_false] at hrightOld
+      rcases iso.related hold with hdead | hlive
+      · exact .inl ⟨hleftOld.trans hdead.1,
+          hrightOld.trans hdead.2⟩
+      · obtain ⟨leftBox, rightBox, hl, hr, hbox⟩ := hlive
+        exact .inr ⟨leftBox, rightBox, hleftOld.trans hl,
+          hrightOld.trans hr, hbox.mono (fun h => .inr h)⟩
+
+/-- The empty evaluator stores have the empty allocation history. -/
+def empty : HeapHistoryIso ({} : Store) ({} : Store) where
+  locRel := fun _ _ => False
+  left_unique h := False.elim h
+  right_unique h := False.elim h
+  left_bound h := False.elim h
+  right_bound h := False.elim h
+  left_total := by simp [Store.get?]
+  right_total := by simp [Store.get?]
+  related h := False.elim h
+
+/-- Allocate and immediately kill a node on the left only.  The fresh dead
+slot has no semantic counterpart, so the old history relation remains a
+complete relation between the resulting live heaps. -/
+def omitDeadAllocLeft {left right : Store}
+    (iso : HeapHistoryIso left right) (world : Owned) (node : Node) :
+    let allocated := left.allocNode world node
+    HeapHistoryIso (allocated.1.kill allocated.2) right := by
+  let allocated := left.allocNode world node
+  let fresh := allocated.2
+  have hfresh : allocated.1.get? fresh = some ⟨world, 1, node⟩ := by
+    exact HeapIso.get?_allocNode_new left world node
+  have hold (loc : Nat) (hne : loc ≠ fresh) :
+      (allocated.1.kill fresh).get? loc = left.get? loc := by
+    rw [get?_kill_eq hfresh]
+    simp only [hne, if_false]
+    rw [get?_allocNode_eq]
+    have hne' : loc ≠ left.nodes.size := by
+      simpa [fresh, allocated, Store.allocNode] using hne
+    simp [hne']
+  refine
+    { locRel := iso.locRel
+      left_unique := iso.left_unique
+      right_unique := iso.right_unique
+      left_bound := ?_
+      right_bound := iso.right_bound
+      left_total := ?_
+      right_total := iso.right_total
+      related := ?_ }
+  · intro l r hrel
+    have hlt := iso.left_bound hrel
+    have hstep : l < left.nodes.size + 1 := Nat.lt_succ_of_lt hlt
+    simpa [allocated, Store.allocNode, Store.kill] using hstep
+  · intro loc box hbox
+    by_cases hnew : loc = fresh
+    · subst loc
+      rw [get?_kill_eq hfresh] at hbox
+      simp at hbox
+    · exact iso.left_total ((hold loc hnew).symm.trans hbox)
+  · intro l r hrel
+    have hne : l ≠ fresh := by
+      intro heq
+      have hlt := iso.left_bound hrel
+      subst l
+      exact (Nat.lt_irrefl left.nodes.size) hlt
+    rw [hold l hne]
+    exact iso.related hrel
+
+end HeapHistoryIso
+
+namespace RValsIso
+
+/-- An in-bounds environment is related to itself by the canonical
+allocation-history relation. -/
+theorem refl_of_inBounds {store : Store} (closed : StoreClosed store) :
+    ∀ {values : List RVal},
+      Reclamation.ValuesInBounds store values →
+      RValsIso (HeapHistoryIso.refl store closed).locRel values values
+  | [], _ => .nil
+  | value :: values, hbounds => by
+      have htail : Reclamation.ValuesInBounds store values := by
+        intro found hfound
+        exact hbounds found (by simp [hfound])
+      cases value with
+      | loc location =>
+          have hlocation : location < store.nodes.size :=
+            hbounds (.loc location) (by simp)
+          exact .cons (.loc ⟨rfl, hlocation⟩)
+            (refl_of_inBounds closed htail)
+      | lit literal =>
+          exact .cons .lit (refl_of_inBounds closed htail)
+      | erased =>
+          exact .cons .erased (refl_of_inBounds closed htail)
+
+theorem mono {r₁ r₂ : Nat → Nat → Prop}
+    (hmono : ∀ {l r}, r₁ l r → r₂ l r) :
+    ∀ {left right : List RVal}, RValsIso r₁ left right →
+      RValsIso r₂ left right
+  | _, _, .nil => .nil
+  | _, _, .cons hhead htail =>
+      .cons (hhead.mono hmono) (mono hmono htail)
+
+theorem symm {r : Nat → Nat → Prop} :
+    ∀ {left right : List RVal}, RValsIso r left right →
+      RValsIso (fun rightLoc leftLoc => r leftLoc rightLoc) right left
+  | _, _, .nil => .nil
+  | _, _, .cons hhead htail => .cons hhead.symm htail.symm
+
+theorem trans {r₁ r₂ : Nat → Nat → Prop} :
+    ∀ {left middle right : List RVal},
+      RValsIso r₁ left middle → RValsIso r₂ middle right →
+      RValsIso (fun leftLoc rightLoc =>
+        ∃ middleLoc, r₁ leftLoc middleLoc ∧ r₂ middleLoc rightLoc)
+        left right
+  | _, _, _, .nil, .nil => .nil
+  | _, _, _, .cons hleft hlefts, .cons hright hrights =>
+      .cons (hleft.trans hright) (hlefts.trans hrights)
+
+@[simp] theorem lengths {r : Nat → Nat → Prop}
+    {left right : List RVal} (h : RValsIso r left right) :
+    left.length = right.length := by
+  induction h <;> simp_all
+
+theorem append {r : Nat → Nat → Prop}
+    {left₁ right₁ left₂ right₂ : List RVal}
+    (h₁ : RValsIso r left₁ right₁)
+    (h₂ : RValsIso r left₂ right₂) :
+    RValsIso r (left₁ ++ left₂) (right₁ ++ right₂) := by
+  induction h₁ with
+  | nil => exact h₂
+  | cons hhead _ ih => exact .cons hhead ih
+
+theorem reverse {r : Nat → Nat → Prop}
+    {left right : List RVal} (h : RValsIso r left right) :
+    RValsIso r left.reverse right.reverse := by
+  induction h with
+  | nil => exact .nil
+  | cons hhead _ ih =>
+      simpa only [List.reverse_cons] using
+        ih.append (.cons hhead .nil)
+
+theorem take {r : Nat → Nat → Prop}
+    {left right : List RVal} (h : RValsIso r left right) (count : Nat) :
+    RValsIso r (left.take count) (right.take count) := by
+  induction h generalizing count with
+  | nil => simpa using (RValsIso.nil (locRel := r))
+  | cons hhead htail ih =>
+      cases count with
+      | zero => exact .nil
+      | succ count => exact .cons hhead (ih count)
+
+theorem drop {r : Nat → Nat → Prop}
+    {left right : List RVal} (h : RValsIso r left right) (count : Nat) :
+    RValsIso r (left.drop count) (right.drop count) := by
+  induction h generalizing count with
+  | nil => simpa using (RValsIso.nil (locRel := r))
+  | cons hhead htail ih =>
+      cases count with
+      | zero => exact .cons hhead htail
+      | succ count => exact ih count
+
+theorem get? {r : Nat → Nat → Prop} {left right : List RVal}
+    (h : RValsIso r left right) {index : Nat} {value : RVal}
+    (hleft : left[index]? = some value) :
+    ∃ other, right[index]? = some other ∧ RValIso r value other := by
+  induction h generalizing index value with
+  | nil => simp at hleft
+  | cons hhead htail ih =>
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero] at hleft ⊢
+          injection hleft with heq
+          subst value
+          exact ⟨_, rfl, hhead⟩
+      | succ index =>
+          simp only [List.getElem?_cons_succ] at hleft ⊢
+          exact ih hleft
+
+/-- Pointwise related scalar lists are literally equal; locations are the
+only values whose spelling can differ. -/
+theorem eq_of_allScalar {r : Nat → Nat → Prop}
+    {left right : List RVal} (h : RValsIso r left right)
+    (hscalar : left.all RVal.isScalar = true) : left = right := by
+  induction h with
+  | nil => rfl
+  | @cons left right lefts rights hhead htail ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at hscalar
+      cases hhead with
+      | loc hrel => simp [RVal.isScalar] at hscalar
+      | lit => simp only [List.cons.injEq, true_and]
+               exact ih hscalar.2
+      | erased => simp only [List.cons.injEq, true_and]
+                  exact ih hscalar.2
+
+end RValsIso
+
+namespace RValIso
+
+/-- A scalar is related to itself under every location relation. -/
+theorem refl_of_scalar {r : Nat → Nat → Prop} {value : RVal}
+    (hscalar : value.isScalar = true) : RValIso r value value := by
+  cases value with
+  | loc location => simp [RVal.isScalar] at hscalar
+  | lit literal => exact .lit
+  | erased => exact .erased
+
+end RValIso
+
+namespace HeapHistoryIso
+
+/-- The output history retains every location pair known on entry. -/
+def Extends {left right nextLeft nextRight : Store}
+    (before : HeapHistoryIso left right)
+    (after : HeapHistoryIso nextLeft nextRight) : Prop :=
+  ∀ {l r}, before.locRel l r → after.locRel l r
+
+theorem Extends.refl {left right : Store}
+    {heap : HeapHistoryIso left right} : heap.Extends heap :=
+  fun h => h
+
+theorem Extends.trans {left right middleLeft middleRight nextLeft nextRight :
+      Store}
+    {first : HeapHistoryIso left right}
+    {middle : HeapHistoryIso middleLeft middleRight}
+    {last : HeapHistoryIso nextLeft nextRight}
+    (h₁ : first.Extends middle) (h₂ : middle.Extends last) :
+    first.Extends last :=
+  fun h => h₂ (h₁ h)
+
+theorem Extends.rval {left right nextLeft nextRight : Store}
+    {before : HeapHistoryIso left right}
+    {after : HeapHistoryIso nextLeft nextRight}
+    (h : before.Extends after) {leftValue rightValue : RVal}
+    (value : RValIso before.locRel leftValue rightValue) :
+    RValIso after.locRel leftValue rightValue :=
+  value.mono h
+
+theorem Extends.rvals {left right nextLeft nextRight : Store}
+    {before : HeapHistoryIso left right}
+    {after : HeapHistoryIso nextLeft nextRight}
+    (h : before.Extends after) {leftValues rightValues : List RVal}
+    (values : RValsIso before.locRel leftValues rightValues) :
+    RValsIso after.locRel leftValues rightValues :=
+  values.mono h
+
+end HeapHistoryIso
+
+/-- Successful evaluator results related modulo allocation history.  The
+extension field lets a caller keep using values from its older environment
+after a callee has allocated or reclaimed nodes. -/
+def RunHistoryIso {left right : Store}
+    (before : HeapHistoryIso left right)
+    (leftOut rightOut : Store × RVal) : Prop :=
+  ∃ heap : HeapHistoryIso leftOut.1 rightOut.1,
+    before.Extends heap ∧
+      RValIso heap.locRel leftOut.2 rightOut.2
+
+/-- Store-only counterpart used by recursive drop operations. -/
+def StoreHistoryIso {left right : Store}
+    (before : HeapHistoryIso left right)
+    (leftOut rightOut : Store) : Prop :=
+  ∃ heap : HeapHistoryIso leftOut rightOut, before.Extends heap
+
+namespace StoreHistoryIso
+
+/-- Store-only history refinement preserves the absence of live nodes. -/
+theorem right_live_eq_zero {left right leftOut rightOut : Store}
+    {before : HeapHistoryIso left right}
+    (hstores : StoreHistoryIso before leftOut rightOut)
+    (hleft : leftOut.live = 0) : rightOut.live = 0 := by
+  obtain ⟨after, _⟩ := hstores
+  exact after.right_live_eq_zero hleft
+
+end StoreHistoryIso
+
+namespace RunHistoryIso
+
+/-- A result relation proved from a later entry history is also valid from
+any earlier history whose location pairs the later history retains. -/
+theorem weaken {left right beforeLeft beforeRight : Store}
+    {earlier : HeapHistoryIso left right}
+    {before : HeapHistoryIso beforeLeft beforeRight}
+    {leftOut rightOut : Store × RVal}
+    (hextends : earlier.Extends before)
+    (hrun : RunHistoryIso before leftOut rightOut) :
+    RunHistoryIso earlier leftOut rightOut := by
+  obtain ⟨after, hbefore, hvalue⟩ := hrun
+  exact ⟨after, hextends.trans hbefore, hvalue⟩
+
+/-- Sequentially related executions compose their output heaps and values. -/
+theorem trans {left middle right : Store}
+    {first : HeapHistoryIso left middle}
+    {second : HeapHistoryIso middle right}
+    {leftOut middleOut rightOut : Store × RVal}
+    (hfirst : RunHistoryIso first leftOut middleOut)
+    (hsecond : RunHistoryIso second middleOut rightOut) :
+    RunHistoryIso (first.trans second) leftOut rightOut := by
+  obtain ⟨firstHeap, hfirstExtends, hfirstValue⟩ := hfirst
+  obtain ⟨secondHeap, hsecondExtends, hsecondValue⟩ := hsecond
+  exact ⟨firstHeap.trans secondHeap,
+    (fun hrel =>
+      ⟨hrel.choose, hfirstExtends hrel.choose_spec.1,
+        hsecondExtends hrel.choose_spec.2⟩),
+    hfirstValue.trans hsecondValue⟩
+
+end RunHistoryIso
+
+theorem resolveAtom_historyIso
+    {rel : Nat → Nat → Prop} {left right : List RVal}
+    (henv : RValsIso rel left right) {atom : Atom} {leftValue : RVal}
+    (hleft : resolveAtom left atom = .ok leftValue) :
+    ∃ rightValue, resolveAtom right atom = .ok rightValue ∧
+      RValIso rel leftValue rightValue := by
+  cases atom with
+  | var index =>
+      simp only [resolveAtom] at hleft ⊢
+      cases hget : left[index]? with
+      | none => simp [hget] at hleft
+      | some value =>
+          simp only [hget, Except.ok.injEq] at hleft
+          subst value
+          obtain ⟨other, hother, hiso⟩ := henv.get? hget
+          exact ⟨other, by simp [hother], hiso⟩
+  | lit literal =>
+      simp only [resolveAtom, Except.ok.injEq] at hleft ⊢
+      subst leftValue
+      exact ⟨.lit literal, rfl, .lit⟩
+  | erased =>
+      simp only [resolveAtom, Except.ok.injEq] at hleft ⊢
+      subst leftValue
+      exact ⟨.erased, rfl, .erased⟩
+
+private theorem List.resolveAtomsFrom_historyIso
+    {rel : Nat → Nat → Prop} {left right : List RVal}
+    (henv : RValsIso rel left right) :
+    ∀ (atoms : List Atom)
+      (leftAcc rightAcc leftOut : List RVal),
+      RValsIso rel leftAcc rightAcc →
+      atoms.foldlM
+          (fun acc atom => do pure (acc ++ [← resolveAtom left atom]))
+          leftAcc = .ok leftOut →
+      ∃ rightOut,
+        atoms.foldlM
+            (fun acc atom => do pure (acc ++ [← resolveAtom right atom]))
+            rightAcc = .ok rightOut ∧
+          RValsIso rel leftOut rightOut
+  | [], leftAcc, rightAcc, leftOut, hacc, hleft => by
+      change (Except.ok leftAcc : Except Err (List RVal)) = .ok leftOut at hleft
+      injection hleft with heq
+      subst leftOut
+      change ∃ rightOut,
+        (Except.ok rightAcc : Except Err (List RVal)) = .ok rightOut ∧
+          RValsIso rel leftAcc rightOut
+      exact ⟨rightAcc, rfl, hacc⟩
+  | atom :: atoms, leftAcc, rightAcc, leftOut, hacc, hleft => by
+      simp only [List.foldlM_cons] at hleft ⊢
+      cases hvalue : resolveAtom left atom with
+      | error error =>
+          rw [hvalue] at hleft
+          simp only [bind, Except.bind] at hleft
+          contradiction
+      | ok leftValue =>
+          simp only [hvalue, bind, Except.bind] at hleft
+          obtain ⟨rightValue, hrightValue, hvalueIso⟩ :=
+            resolveAtom_historyIso henv hvalue
+          rw [hrightValue]
+          simp only [bind, Except.bind]
+          exact List.resolveAtomsFrom_historyIso henv atoms
+            (leftAcc ++ [leftValue]) (rightAcc ++ [rightValue]) leftOut
+            (hacc.append (.cons hvalueIso .nil)) hleft
+
+theorem resolveAtoms_historyIso
+    {rel : Nat → Nat → Prop} {left right : List RVal}
+    (henv : RValsIso rel left right) {atoms : Array Atom}
+    {leftValues : List RVal}
+    (hleft : resolveAtoms left atoms = .ok leftValues) :
+    ∃ rightValues, resolveAtoms right atoms = .ok rightValues ∧
+      RValsIso rel leftValues rightValues := by
+  unfold resolveAtoms at hleft ⊢
+  rw [← Array.foldlM_toList] at hleft ⊢
+  exact List.resolveAtomsFrom_historyIso henv atoms.toList [] [] leftValues
+    .nil hleft
+
+private theorem RValIso.hasWorld_eq
+    {left right : Store} (iso : HeapHistoryIso left right)
+    {leftValue rightValue : RVal} (hvalue : RValIso iso.locRel
+      leftValue rightValue) (world : Owned) :
+    leftValue.hasWorld left world = rightValue.hasWorld right world := by
+  cases hvalue with
+  | lit => rfl
+  | erased => rfl
+  | @loc leftLoc rightLoc hrel =>
+      simp only [RVal.hasWorld]
+      rcases iso.related hrel with hdead | hlive
+      · rw [hdead.1, hdead.2]
+      · obtain ⟨leftBox, rightBox, hleft, hright, hbox⟩ := hlive
+        rw [hleft, hright]
+        exact congrArg (fun found => found == world) hbox.world
+
+theorem checkResultWorld_historyIso
+    {left right : Store} (iso : HeapHistoryIso left right)
+    {leftValue rightValue : RVal}
+    (hvalue : RValIso iso.locRel leftValue rightValue)
+    (world : Owned)
+    (hleft : checkResultWorld world (left, leftValue) =
+      .ok (left, leftValue)) :
+    checkResultWorld world (right, rightValue) =
+      .ok (right, rightValue) := by
+  have heq := RValIso.hasWorld_eq iso hvalue world
+  unfold checkResultWorld at hleft ⊢
+  by_cases hworld : leftValue.hasWorld left world = true
+  · have hright : rightValue.hasWorld right world = true := by
+      rw [← heq]
+      exact hworld
+    simp [hworld, hright]
+  · simp [hworld] at hleft
+
+theorem dupVals_historyIso
+    {left right : Store} (iso : HeapHistoryIso left right) :
+    ∀ {leftValues rightValues : List RVal},
+      RValsIso iso.locRel leftValues rightValues →
+      ∀ {leftOut : Store}, dupVals left leftValues = .ok leftOut →
+      ∃ rightOut, dupVals right rightValues = .ok rightOut ∧
+        StoreHistoryIso iso leftOut rightOut
+  | _, _, .nil, leftOut, hrun => by
+      change (Except.ok left : Except Err Store) = .ok leftOut at hrun
+      injection hrun with heq
+      subst leftOut
+      change ∃ rightOut,
+        (Except.ok right : Except Err Store) = .ok rightOut ∧
+          StoreHistoryIso iso left rightOut
+      exact ⟨right, rfl, ⟨iso, fun h => h⟩⟩
+  | leftHead :: leftTail, rightHead :: rightTail,
+      .cons hhead htail, leftOut, hrun => by
+      cases hhead with
+      | lit =>
+          change dupVals left _ = .ok leftOut at hrun
+          change ∃ rightOut, dupVals right _ = .ok rightOut ∧ _
+          exact dupVals_historyIso iso htail hrun
+      | erased =>
+          change dupVals left _ = .ok leftOut at hrun
+          change ∃ rightOut, dupVals right _ = .ok rightOut ∧ _
+          exact dupVals_historyIso iso htail hrun
+      | @loc leftLoc rightLoc hrel =>
+          cases hleft : left.get? leftLoc with
+          | none =>
+              simp [dupVals, hleft] at hrun
+              simp only [bind, Except.bind] at hrun
+              contradiction
+          | some leftBox =>
+              obtain ⟨rightBox, hright, hbox⟩ := iso.boxes hrel hleft
+              cases hworld : leftBox.world with
+              | unique =>
+                  simp [dupVals, hleft, hworld] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  contradiction
+              | shared =>
+                  have hrightWorld : rightBox.world = .shared := by
+                    rw [← hbox.world, hworld]
+                  let newLeft : NodeBox :=
+                    ⟨.shared, leftBox.rc + 1, leftBox.node⟩
+                  let newRight : NodeBox :=
+                    ⟨.shared, rightBox.rc + 1, rightBox.node⟩
+                  have hrun' : dupVals
+                      (left.setBox leftLoc newLeft).rcTick
+                      leftTail = .ok leftOut := by
+                    have htemp := hrun
+                    simp [dupVals, hleft, hworld] at htemp
+                    simp only [bind, Except.bind] at htemp
+                    simpa [newLeft, dupVals] using htemp
+                  let nextLeft :=
+                    (left.setBox leftLoc newLeft).rcTick
+                  let nextRight :=
+                    (right.setBox rightLoc newRight).rcTick
+                  have hnew : NodeBoxIso iso.locRel
+                      newLeft newRight := by
+                    exact ⟨rfl, congrArg (fun n => n + 1) hbox.rc,
+                      hbox.node⟩
+                  let nextIso : HeapHistoryIso nextLeft nextRight :=
+                    (iso.setBox hrel hleft hright hnew).rcTick
+                  obtain ⟨rightOut, hrightOut, outIso, hout⟩ :=
+                    dupVals_historyIso nextIso
+                      (htail.mono (fun h => h)) hrun'
+                  have hrightOut' : dupVals right
+                      (.loc rightLoc :: rightTail) = .ok rightOut := by
+                    simp [dupVals, hright, hrightWorld]
+                    simp only [bind, Except.bind]
+                    simpa [nextRight, newRight, dupVals] using hrightOut
+                  refine ⟨rightOut, hrightOut', outIso, ?_⟩
+                  exact fun h => hout h
+
+theorem callScalarOracle_historyIso
+    {ctx : Ctx} {function : Ix.Compiler.Ixon.Address}
+    {leftValues rightValues : List RVal}
+    {rel : Nat → Nat → Prop} (hvalues : RValsIso rel leftValues rightValues)
+    {leftValue : RVal}
+    (hleft : callScalarOracle ctx function leftValues = .ok leftValue) :
+    ∃ rightValue, callScalarOracle ctx function rightValues = .ok rightValue ∧
+      RValIso rel leftValue rightValue := by
+  by_cases hscalar : leftValues.all RVal.isScalar = true
+  · have heq := hvalues.eq_of_allScalar hscalar
+    subst rightValues
+    exact ⟨leftValue, hleft, by
+      unfold callScalarOracle at hleft
+      simp only [hscalar, Bool.not_true, Bool.false_eq_true, if_false] at hleft
+      cases horacle : ctx.oracle function leftValues with
+      | none => simp [horacle] at hleft
+      | some value =>
+          rw [horacle] at hleft
+          cases hvalue : value.isScalar with
+          | false => simp [hvalue] at hleft
+          | true =>
+              simp only [hvalue, if_true, Except.ok.injEq] at hleft
+              subst leftValue
+              exact RValIso.refl_of_scalar hvalue⟩
+  · unfold callScalarOracle at hleft
+    simp [hscalar] at hleft
+
+private theorem List.foldl_cons_eq_reverse_append
+    (values environment : List RVal) :
+    values.foldl (fun current value => value :: current) environment =
+      values.reverse ++ environment := by
+  induction values generalizing environment with
+  | nil => rfl
+  | cons value values ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+theorem Array.foldl_cons_historyIso
+    {rel : Nat → Nat → Prop} {left right : Array RVal}
+    (hvalues : RValsIso rel left.toList right.toList)
+    {leftEnvironment rightEnvironment : List RVal}
+    (henvironment : RValsIso rel leftEnvironment rightEnvironment) :
+    RValsIso rel
+      (left.foldl (fun current value => value :: current) leftEnvironment)
+      (right.foldl (fun current value => value :: current) rightEnvironment) := by
+  rw [← Array.foldl_toList, ← Array.foldl_toList,
+    List.foldl_cons_eq_reverse_append,
+    List.foldl_cons_eq_reverse_append]
+  exact hvalues.reverse.append henvironment
+
+/-- Successful evaluation is equivariant under allocation-history
+isomorphism at one common fuel index. -/
+private structure EvalHistoryIsoAt (fuel : Nat) : Prop where
+  runCode : ∀ (ctx : Ctx) (current : FnDef)
+      (left right : Store) (heap : HeapHistoryIso left right)
+      (leftEnvironment rightEnvironment : List RVal),
+    RValsIso heap.locRel leftEnvironment rightEnvironment →
+    ∀ (input : Code) (leftOut : Store × RVal),
+      IxIR1.runCode ctx fuel current left leftEnvironment input = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.runCode ctx fuel current right rightEnvironment input =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut
+  runOp : ∀ (ctx : Ctx) (current : FnDef)
+      (left right : Store) (heap : HeapHistoryIso left right)
+      (leftEnvironment rightEnvironment : List RVal),
+    RValsIso heap.locRel leftEnvironment rightEnvironment →
+    ∀ (operation : Op) (leftOut : Store × RVal),
+      IxIR1.runOp ctx fuel current left leftEnvironment operation = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.runOp ctx fuel current right rightEnvironment operation =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut
+  invoke : ∀ (ctx : Ctx) (function : Ix.Compiler.Ixon.Address)
+      (leftArguments rightArguments : List RVal)
+      (left right : Store) (heap : HeapHistoryIso left right),
+    RValsIso heap.locRel leftArguments rightArguments →
+    ∀ (leftOut : Store × RVal),
+      IxIR1.invoke ctx fuel function leftArguments left = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.invoke ctx fuel function rightArguments right = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut
+  applyGo : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right)
+      (leftFunction rightFunction : RVal)
+      (leftArguments rightArguments : List RVal),
+    RValIso heap.locRel leftFunction rightFunction →
+    RValsIso heap.locRel leftArguments rightArguments →
+    ∀ (leftOut : Store × RVal),
+      IxIR1.applyGo ctx fuel left leftFunction leftArguments = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.applyGo ctx fuel right rightFunction rightArguments =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut
+  dropVal : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right) (leftValue rightValue : RVal),
+    RValIso heap.locRel leftValue rightValue →
+    ∀ (leftOut : Store),
+      IxIR1.dropVal ctx fuel left leftValue = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropVal ctx fuel right rightValue = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+  dropMany : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right)
+      (leftValues rightValues : List RVal),
+    RValsIso heap.locRel leftValues rightValues →
+    ∀ (leftOut : Store),
+      IxIR1.dropMany ctx fuel left leftValues = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropMany ctx fuel right rightValues = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+  dropUVal : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right) (leftValue rightValue : RVal),
+    RValIso heap.locRel leftValue rightValue →
+    ∀ (leftOut : Store),
+      IxIR1.dropUVal ctx fuel left leftValue = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropUVal ctx fuel right rightValue = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+  dropManyU : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right)
+      (leftValues rightValues : List RVal),
+    RValsIso heap.locRel leftValues rightValues →
+    ∀ (leftOut : Store),
+      IxIR1.dropManyU ctx fuel left leftValues = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropManyU ctx fuel right rightValues = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+
+private structure DropHistoryIsoAt (fuel : Nat) : Prop where
+  dropVal : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right) (leftValue rightValue : RVal),
+    RValIso heap.locRel leftValue rightValue →
+    ∀ (leftOut : Store),
+      IxIR1.dropVal ctx fuel left leftValue = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropVal ctx fuel right rightValue = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+  dropMany : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right)
+      (leftValues rightValues : List RVal),
+    RValsIso heap.locRel leftValues rightValues →
+    ∀ (leftOut : Store),
+      IxIR1.dropMany ctx fuel left leftValues = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropMany ctx fuel right rightValues = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+  dropUVal : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right) (leftValue rightValue : RVal),
+    RValIso heap.locRel leftValue rightValue →
+    ∀ (leftOut : Store),
+      IxIR1.dropUVal ctx fuel left leftValue = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropUVal ctx fuel right rightValue = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+  dropManyU : ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right)
+      (leftValues rightValues : List RVal),
+    RValsIso heap.locRel leftValues rightValues →
+    ∀ (leftOut : Store),
+      IxIR1.dropManyU ctx fuel left leftValues = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.dropManyU ctx fuel right rightValues = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut
+
+private theorem dropHistoryIsoAt : ∀ fuel, DropHistoryIsoAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [IxIR1.dropVal, IxIR1.dropMany, IxIR1.dropUVal,
+          IxIR1.dropManyU] at *
+  | succ fuel smaller =>
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro ctx left right heap leftValue rightValue hvalue leftOut hrun
+        rw [IxIR1.dropVal.eq_def] at hrun ⊢
+        dsimp only at hrun ⊢
+        cases hvalue with
+        | lit =>
+            injection hrun with hout
+            subst leftOut
+            exact ⟨right, rfl, heap, HeapHistoryIso.Extends.refl⟩
+        | erased =>
+            injection hrun with hout
+            subst leftOut
+            exact ⟨right, rfl, heap, HeapHistoryIso.Extends.refl⟩
+        | @loc leftLoc rightLoc hrel =>
+            cases hleft : left.get? leftLoc with
+            | none => simp [hleft] at hrun
+            | some leftBox =>
+                obtain ⟨rightBox, hright, hbox⟩ := heap.boxes hrel hleft
+                rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+                rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+                rcases hbox with ⟨hworld, hrc, hnode⟩
+                change leftWorld = rightWorld at hworld
+                change leftRc = rightRc at hrc
+                change NodeIso heap.locRel leftNode rightNode at hnode
+                subst rightWorld
+                subst rightRc
+                simp only [hleft] at hrun
+                simp only [hright]
+                cases leftWorld with
+                | unique => simp at hrun
+                | shared =>
+                    simp only
+                    by_cases hone : leftRc == 1
+                    · simp only [hone, if_true] at hrun ⊢
+                      have hleftTick :
+                          left.rcTick.get? leftLoc =
+                            some ⟨.shared, leftRc, leftNode⟩ := by
+                        simpa [Store.rcTick, Store.get?] using hleft
+                      have hrightTick :
+                          right.rcTick.get? rightLoc =
+                            some ⟨.shared, leftRc, rightNode⟩ := by
+                        simpa [Store.rcTick, Store.get?] using hright
+                      let killed := (heap.rcTick).kill hrel
+                        hleftTick hrightTick
+                      cases hnode with
+                      | ctor hfields =>
+                          obtain ⟨rightOut, hrightOut, final,
+                              hext⟩ :=
+                            smaller.dropMany ctx
+                              (left.rcTick.kill leftLoc)
+                              (right.rcTick.kill rightLoc) killed
+                              _ _ hfields leftOut hrun
+                          exact ⟨rightOut, hrightOut, final,
+                            HeapHistoryIso.Extends.trans
+                              (fun h => h) hext⟩
+                      | pap harguments =>
+                          obtain ⟨rightOut, hrightOut, final,
+                              hext⟩ :=
+                            smaller.dropMany ctx
+                              (left.rcTick.kill leftLoc)
+                              (right.rcTick.kill rightLoc) killed
+                              _ _ harguments leftOut hrun
+                          exact ⟨rightOut, hrightOut, final,
+                            HeapHistoryIso.Extends.trans
+                              (fun h => h) hext⟩
+                    · simp only [hone, Bool.false_eq_true, if_false]
+                        at hrun ⊢
+                      injection hrun with hout
+                      subst leftOut
+                      have hleftTick :
+                          left.rcTick.get? leftLoc =
+                            some ⟨.shared, leftRc, leftNode⟩ := by
+                        simpa [Store.rcTick, Store.get?] using hleft
+                      have hrightTick :
+                          right.rcTick.get? rightLoc =
+                            some ⟨.shared, leftRc, rightNode⟩ := by
+                        simpa [Store.rcTick, Store.get?] using hright
+                      let next := (heap.rcTick).setBox hrel
+                        hleftTick hrightTick
+                        (⟨rfl, rfl, hnode⟩ : NodeBoxIso heap.locRel
+                          ⟨.shared, leftRc - 1, leftNode⟩
+                          ⟨.shared, leftRc - 1, rightNode⟩)
+                      exact ⟨_, rfl, next, fun h => h⟩
+      · intro ctx left right heap leftValues rightValues hvalues
+          leftOut hrun
+        rw [IxIR1.dropMany.eq_def] at hrun ⊢
+        dsimp only at hrun ⊢
+        cases hvalues with
+        | nil =>
+            injection hrun with hout
+            subst leftOut
+            exact ⟨right, rfl, heap, HeapHistoryIso.Extends.refl⟩
+        | @cons leftHead rightHead leftTail rightTail hhead htail =>
+            dsimp only at hrun ⊢
+            cases hfirst : IxIR1.dropVal ctx fuel left leftHead with
+            | error error =>
+                rw [hfirst] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok middle =>
+                rw [hfirst] at hrun
+                simp only [bind, Except.bind] at hrun
+                obtain ⟨rightMiddle, hrightFirst, middleHeap,
+                    hentryMiddle⟩ :=
+                  smaller.dropVal ctx left right heap leftHead rightHead
+                    hhead middle hfirst
+                obtain ⟨rightOut, hrightRest, finalHeap,
+                    hmiddleFinal⟩ :=
+                  smaller.dropMany ctx middle rightMiddle middleHeap _ _
+                    (hentryMiddle.rvals htail) leftOut hrun
+                refine ⟨rightOut, ?_, finalHeap,
+                  hentryMiddle.trans hmiddleFinal⟩
+                rw [hrightFirst]
+                simp only [bind, Except.bind]
+                exact hrightRest
+      · intro ctx left right heap leftValue rightValue hvalue leftOut hrun
+        rw [IxIR1.dropUVal.eq_def] at hrun ⊢
+        dsimp only at hrun ⊢
+        cases hvalue with
+        | lit =>
+            injection hrun with hout
+            subst leftOut
+            exact ⟨right, rfl, heap, HeapHistoryIso.Extends.refl⟩
+        | erased =>
+            injection hrun with hout
+            subst leftOut
+            exact ⟨right, rfl, heap, HeapHistoryIso.Extends.refl⟩
+        | @loc leftLoc rightLoc hrel =>
+            cases hleft : left.get? leftLoc with
+            | none => simp [hleft] at hrun
+            | some leftBox =>
+                obtain ⟨rightBox, hright, hbox⟩ := heap.boxes hrel hleft
+                rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+                rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+                rcases hbox with ⟨hworld, hrc, hnode⟩
+                change leftWorld = rightWorld at hworld
+                change leftRc = rightRc at hrc
+                change NodeIso heap.locRel leftNode rightNode at hnode
+                subst rightWorld
+                subst rightRc
+                simp only [hleft] at hrun
+                simp only [hright]
+                cases leftWorld with
+                | shared => simp at hrun
+                | unique =>
+                    simp only
+                    cases hnode with
+                    | pap harguments => simp at hrun
+                    | ctor hfields =>
+                        let killed := heap.kill hrel hleft hright
+                        obtain ⟨rightOut, hrightOut, final,
+                            hext⟩ :=
+                          smaller.dropManyU ctx (left.kill leftLoc)
+                            (right.kill rightLoc) killed _ _ hfields
+                            leftOut hrun
+                        exact ⟨rightOut, hrightOut, final,
+                          HeapHistoryIso.Extends.trans (fun h => h) hext⟩
+      · intro ctx left right heap leftValues rightValues hvalues
+          leftOut hrun
+        rw [IxIR1.dropManyU.eq_def] at hrun ⊢
+        dsimp only at hrun ⊢
+        cases hvalues with
+        | nil =>
+            injection hrun with hout
+            subst leftOut
+            exact ⟨right, rfl, heap, HeapHistoryIso.Extends.refl⟩
+        | @cons leftHead rightHead leftTail rightTail hhead htail =>
+            dsimp only at hrun ⊢
+            cases hfirst : IxIR1.dropUVal ctx fuel left leftHead with
+            | error error =>
+                rw [hfirst] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok middle =>
+                rw [hfirst] at hrun
+                simp only [bind, Except.bind] at hrun
+                obtain ⟨rightMiddle, hrightFirst, middleHeap,
+                    hentryMiddle⟩ :=
+                  smaller.dropUVal ctx left right heap leftHead rightHead
+                    hhead middle hfirst
+                obtain ⟨rightOut, hrightRest, finalHeap,
+                    hmiddleFinal⟩ :=
+                  smaller.dropManyU ctx middle rightMiddle middleHeap _ _
+                    (hentryMiddle.rvals htail) leftOut hrun
+                refine ⟨rightOut, ?_, finalHeap,
+                  hentryMiddle.trans hmiddleFinal⟩
+                rw [hrightFirst]
+                simp only [bind, Except.bind]
+                exact hrightRest
+
+private theorem runCode_case_historyIso
+    {fuel : Nat} (smaller : EvalHistoryIsoAt fuel)
+    (ctx : Ctx) (current : FnDef) (left right : Store)
+    (heap : HeapHistoryIso left right)
+    (leftEnvironment rightEnvironment : List RVal)
+    (henvironment : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt)
+    (leftOut : Store × RVal)
+    (hrun : IxIR1.runCode ctx (fuel + 1) current left leftEnvironment
+      (.case scrutinee peelNat alternatives) = .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.runCode ctx (fuel + 1) current right rightEnvironment
+          (.case scrutinee peelNat alternatives) = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  rw [IxIR1.runCode.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hleftResolve : resolveAtom leftEnvironment scrutinee with
+  | error error =>
+      rw [hleftResolve] at hrun
+      simp only [bind, Except.bind] at hrun
+      contradiction
+  | ok leftValue =>
+      obtain ⟨rightValue, hrightResolve, hvalue⟩ :=
+        resolveAtom_historyIso henvironment hleftResolve
+      rw [hleftResolve] at hrun
+      rw [hrightResolve]
+      simp only [bind, Except.bind] at hrun ⊢
+      cases hvalue with
+      | erased => simp at hrun
+      | @lit literal =>
+          cases literal with
+          | str value => simp at hrun
+          | nat value =>
+              cases peelNat with
+              | false => simp at hrun
+              | true =>
+                  cases value with
+                  | zero =>
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp [hfind] at hrun
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  simp only [hfind] at hrun ⊢
+                                  exact smaller.runCode ctx current
+                                    left right heap leftEnvironment
+                                    rightEnvironment henvironment body
+                                    leftOut hrun
+                              | succ fields => simp [hfind] at hrun
+                  | succ value =>
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp [hfind] at hrun
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => simp [hfind] at hrun
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      simp only [hfind] at hrun ⊢
+                                      exact smaller.runCode ctx current
+                                        left right heap
+                                        (.lit (.nat value) ::
+                                          leftEnvironment)
+                                        (.lit (.nat value) ::
+                                          rightEnvironment)
+                                        (.cons .lit henvironment) body
+                                        leftOut hrun
+                                  | succ fields => simp [hfind] at hrun
+      | @loc leftLoc rightLoc hrel =>
+          cases hleft : left.get? leftLoc with
+          | none => simp [hleft] at hrun
+          | some leftBox =>
+              obtain ⟨rightBox, hright, hbox⟩ := heap.boxes hrel hleft
+              rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+              rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+              rcases hbox with ⟨hworld, hrc, hnode⟩
+              change leftWorld = rightWorld at hworld
+              change leftRc = rightRc at hrc
+              change NodeIso heap.locRel leftNode rightNode at hnode
+              subst rightWorld
+              subst rightRc
+              simp only [hleft] at hrun
+              simp only [hright]
+              cases hnode with
+              | pap harguments => simp at hrun
+              | @ctor cid leftFields rightFields hfields =>
+                  simp only
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == cid.cidx) with
+                  | none => simp [hfind] at hrun
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          have hsizes : leftFields.size = rightFields.size := by
+                            simpa using hfields.lengths
+                          by_cases hcount : leftFields.size = fieldCount
+                          · have hrightCount :
+                                rightFields.size = fieldCount := by
+                              rw [← hsizes]
+                              exact hcount
+                            simp [hfind, hcount, hrightCount] at hrun ⊢
+                            obtain ⟨rightOut, hrightOut, hout⟩ :=
+                              smaller.runCode ctx current left right heap
+                                (leftFields.toList.reverse ++ leftEnvironment)
+                                (rightFields.toList.reverse ++ rightEnvironment)
+                                (hfields.reverse.append henvironment)
+                                body leftOut hrun
+                            rcases rightOut with ⟨rightStore, rightValue⟩
+                            exact ⟨rightStore, rightValue, hrightOut, hout⟩
+                          · have hrightCount :
+                                rightFields.size ≠ fieldCount := by
+                              intro heq
+                              exact hcount (hsizes.trans heq)
+                            simp [hfind, hcount, hrightCount] at hrun
+
+private theorem runCode_historyIsoStep {fuel : Nat}
+    (smaller : EvalHistoryIsoAt fuel) :
+    ∀ (ctx : Ctx) (current : FnDef)
+      (left right : Store) (heap : HeapHistoryIso left right)
+      (leftEnvironment rightEnvironment : List RVal),
+    RValsIso heap.locRel leftEnvironment rightEnvironment →
+    ∀ (input : Code) (leftOut : Store × RVal),
+      IxIR1.runCode ctx (fuel + 1) current left leftEnvironment input =
+        .ok leftOut →
+      ∃ rightOut,
+        IxIR1.runCode ctx (fuel + 1) current right rightEnvironment input =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  intro ctx current left right heap leftEnvironment rightEnvironment
+    henvironment input leftOut hrun
+  cases input with
+  | ret atom =>
+      rw [IxIR1.runCode.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment atom with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValue =>
+          obtain ⟨rightValue, hright, hvalue⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          simp only [bind, Except.bind, Except.ok.injEq] at hrun
+          subst leftOut
+          rw [hright]
+          exact ⟨(right, rightValue), rfl, heap,
+            HeapHistoryIso.Extends.refl, hvalue⟩
+  | letOp operation rest =>
+      rw [IxIR1.runCode.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hoperation : IxIR1.runOp ctx fuel current left leftEnvironment
+          operation with
+      | error error =>
+          rw [hoperation] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok operationOut =>
+          rcases operationOut with ⟨middle, leftValue⟩
+          rw [hoperation] at hrun
+          simp only [bind, Except.bind] at hrun
+          obtain ⟨rightOperationOut, hrightOperation,
+              operationHeap, hentryOperation, hvalue⟩ :=
+            smaller.runOp ctx current left right heap leftEnvironment
+              rightEnvironment henvironment operation (middle, leftValue)
+              hoperation
+          rcases rightOperationOut with ⟨rightMiddle, rightValue⟩
+          obtain ⟨rightOut, hrightRest, finalHeap,
+              hoperationFinal, hresult⟩ :=
+            smaller.runCode ctx current middle rightMiddle operationHeap
+              (leftValue :: leftEnvironment)
+              (rightValue :: rightEnvironment)
+              (.cons hvalue (hentryOperation.rvals henvironment)) rest
+              leftOut hrun
+          refine ⟨rightOut, ?_, finalHeap,
+            hentryOperation.trans hoperationFinal, hresult⟩
+          rw [hrightOperation]
+          simp only [bind, Except.bind]
+          exact hrightRest
+  | case scrutinee peelNat alternatives =>
+      exact runCode_case_historyIso smaller ctx current left right heap
+        leftEnvironment rightEnvironment henvironment scrutinee peelNat
+        alternatives leftOut hrun
+
+private theorem runOp_historyIsoStep {fuel : Nat}
+    (smaller : EvalHistoryIsoAt fuel) :
+    ∀ (ctx : Ctx) (current : FnDef)
+      (left right : Store) (heap : HeapHistoryIso left right)
+      (leftEnvironment rightEnvironment : List RVal),
+    RValsIso heap.locRel leftEnvironment rightEnvironment →
+    ∀ (operation : Op) (leftOut : Store × RVal),
+      IxIR1.runOp ctx (fuel + 1) current left leftEnvironment operation =
+        .ok leftOut →
+      ∃ rightOut,
+        IxIR1.runOp ctx (fuel + 1) current right rightEnvironment operation =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  intro ctx current left right heap leftEnvironment rightEnvironment
+    henvironment operation leftOut hrun
+  cases operation with
+  | pure atom =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment atom with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValue =>
+          obtain ⟨rightValue, hright, hvalue⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          simp only [bind, Except.bind, Except.ok.injEq] at hrun
+          subst leftOut
+          rw [hright]
+          exact ⟨(right, rightValue), rfl, heap,
+            HeapHistoryIso.Extends.refl, hvalue⟩
+  | alloc world identity arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtoms leftEnvironment arguments with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValues =>
+          obtain ⟨rightValues, hright, hvalues⟩ :=
+            resolveAtoms_historyIso henvironment hleft
+          rw [hleft] at hrun
+          simp only [bind, Except.bind, Except.ok.injEq] at hrun
+          subst leftOut
+          rw [hright]
+          let next := heap.alloc (world := world)
+            (leftNode := .ctorN identity leftValues.toArray)
+            (rightNode := .ctorN identity rightValues.toArray)
+            (.ctor (by simpa using hvalues))
+          exact ⟨_, rfl, next, (fun h => .inr h),
+            .loc (.inl ⟨rfl, rfl⟩)⟩
+  | reuse target identity arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleftArgs : resolveAtoms leftEnvironment arguments with
+      | error error =>
+          rw [hleftArgs] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValues =>
+          obtain ⟨rightValues, hrightArgs, hvalues⟩ :=
+            resolveAtoms_historyIso henvironment hleftArgs
+          rw [hleftArgs] at hrun
+          rw [hrightArgs]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases hleftTarget : resolveAtom leftEnvironment target with
+          | error error =>
+              rw [hleftTarget] at hrun
+              simp only [bind, Except.bind] at hrun
+              contradiction
+          | ok leftTarget =>
+              obtain ⟨rightTarget, hrightTarget, htarget⟩ :=
+                resolveAtom_historyIso henvironment hleftTarget
+              rw [hleftTarget] at hrun
+              rw [hrightTarget]
+              simp only [bind, Except.bind] at hrun ⊢
+              cases htarget with
+              | lit => simp at hrun
+              | erased => simp at hrun
+              | @loc leftLoc rightLoc hrel =>
+                  cases hleftBox : left.get? leftLoc with
+                  | none => simp [hleftBox] at hrun
+                  | some leftBox =>
+                      obtain ⟨rightBox, hrightBox, hbox⟩ :=
+                        heap.boxes hrel hleftBox
+                      rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+                      rcases rightBox with
+                        ⟨rightWorld, rightRc, rightNode⟩
+                      rcases hbox with ⟨hworld, hrc, hnode⟩
+                      change leftWorld = rightWorld at hworld
+                      change leftRc = rightRc at hrc
+                      change NodeIso heap.locRel leftNode rightNode at hnode
+                      subst rightWorld
+                      subst rightRc
+                      simp only [hleftBox] at hrun
+                      simp only [hrightBox]
+                      cases leftWorld with
+                      | shared => simp at hrun
+                      | unique =>
+                          simp only [Except.ok.injEq] at hrun
+                          subst leftOut
+                          let leftSet := left.setBox leftLoc
+                            ⟨.unique, 1, .ctorN identity
+                              leftValues.toArray⟩
+                          let rightSet := right.setBox rightLoc
+                            ⟨.unique, 1, .ctorN identity
+                              rightValues.toArray⟩
+                          let base := heap.setBox hrel hleftBox hrightBox
+                            (⟨rfl, rfl, .ctor (by simpa using hvalues)⟩ :
+                              NodeBoxIso heap.locRel
+                                ⟨.unique, 1,
+                                  .ctorN identity leftValues.toArray⟩
+                                ⟨.unique, 1,
+                                  .ctorN identity rightValues.toArray⟩)
+                          let next := base.nodesEq
+                            (nextLeft :=
+                              { leftSet with
+                                reuses := leftSet.reuses + 1 })
+                            (nextRight :=
+                              { rightSet with
+                                reuses := rightSet.reuses + 1 }) rfl rfl
+                          exact ⟨_, rfl, next, (fun h => h), .loc hrel⟩
+  | free target =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment target with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftTarget =>
+          obtain ⟨rightTarget, hright, htarget⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases htarget with
+          | lit => simp at hrun
+          | erased => simp at hrun
+          | @loc leftLoc rightLoc hrel =>
+              cases hleftBox : left.get? leftLoc with
+              | none => simp [hleftBox] at hrun
+              | some leftBox =>
+                  obtain ⟨rightBox, hrightBox, hbox⟩ :=
+                    heap.boxes hrel hleftBox
+                  have hworld := hbox.world
+                  simp only [hleftBox] at hrun
+                  simp only [hrightBox]
+                  cases hleftWorld : leftBox.world with
+                  | shared => simp [hleftWorld] at hrun
+                  | unique =>
+                      have hrightWorld : rightBox.world = .unique := by
+                        rw [← hworld, hleftWorld]
+                      simp only [hleftWorld, hrightWorld,
+                        Except.ok.injEq] at hrun ⊢
+                      subst leftOut
+                      let next := heap.kill hrel hleftBox hrightBox
+                      exact ⟨_, rfl, next, (fun h => h), .erased⟩
+  | dup target =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment target with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftTarget =>
+          obtain ⟨rightTarget, hright, htarget⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases htarget with
+          | lit =>
+              simp only [Except.ok.injEq] at hrun
+              subst leftOut
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, .lit⟩
+          | erased =>
+              simp only [Except.ok.injEq] at hrun
+              subst leftOut
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, .erased⟩
+          | @loc leftLoc rightLoc hrel =>
+              cases hleftBox : left.get? leftLoc with
+              | none => simp [hleftBox] at hrun
+              | some leftBox =>
+                  obtain ⟨rightBox, hrightBox, hbox⟩ :=
+                    heap.boxes hrel hleftBox
+                  rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+                  rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+                  rcases hbox with ⟨hworld, hrc, hnode⟩
+                  change leftWorld = rightWorld at hworld
+                  change leftRc = rightRc at hrc
+                  change NodeIso heap.locRel leftNode rightNode at hnode
+                  subst rightWorld
+                  subst rightRc
+                  simp only [hleftBox] at hrun
+                  simp only [hrightBox]
+                  cases leftWorld with
+                  | unique => simp at hrun
+                  | shared =>
+                      simp only [Except.ok.injEq] at hrun
+                      subst leftOut
+                      let next := (heap.setBox hrel hleftBox hrightBox
+                        (⟨rfl, rfl, hnode⟩ : NodeBoxIso heap.locRel
+                          ⟨.shared, leftRc + 1, leftNode⟩
+                          ⟨.shared, leftRc + 1, rightNode⟩)).rcTick
+                      exact ⟨_, rfl, next, (fun h => h), .loc hrel⟩
+  | drop target =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment target with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftTarget =>
+          obtain ⟨rightTarget, hright, htarget⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases htarget with
+          | lit =>
+              simp only [Except.ok.injEq] at hrun
+              subst leftOut
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, .erased⟩
+          | erased =>
+              simp only [Except.ok.injEq] at hrun
+              subst leftOut
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, .erased⟩
+          | @loc leftLoc rightLoc hrel =>
+              dsimp only at hrun ⊢
+              cases hdrop : IxIR1.dropVal ctx fuel left (.loc leftLoc) with
+              | error error =>
+                  rw [hdrop] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  contradiction
+              | ok nextLeft =>
+                  rw [hdrop] at hrun
+                  simp only [bind, Except.bind, Except.ok.injEq] at hrun
+                  subst leftOut
+                  obtain ⟨nextRight, hrightDrop, nextHeap, hext⟩ :=
+                    smaller.dropVal ctx left right heap _ _ (.loc hrel)
+                      nextLeft hdrop
+                  rw [hrightDrop]
+                  exact ⟨_, rfl, nextHeap, hext, .erased⟩
+  | dropU target =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment target with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftTarget =>
+          obtain ⟨rightTarget, hright, htarget⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases htarget with
+          | lit =>
+              simp only [Except.ok.injEq] at hrun
+              subst leftOut
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, .erased⟩
+          | erased =>
+              simp only [Except.ok.injEq] at hrun
+              subst leftOut
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, .erased⟩
+          | @loc leftLoc rightLoc hrel =>
+              dsimp only at hrun ⊢
+              cases hdrop : IxIR1.dropUVal ctx fuel left (.loc leftLoc) with
+              | error error =>
+                  rw [hdrop] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  contradiction
+              | ok nextLeft =>
+                  rw [hdrop] at hrun
+                  simp only [bind, Except.bind, Except.ok.injEq] at hrun
+                  subst leftOut
+                  obtain ⟨nextRight, hrightDrop, nextHeap, hext⟩ :=
+                    smaller.dropUVal ctx left right heap _ _ (.loc hrel)
+                      nextLeft hdrop
+                  rw [hrightDrop]
+                  exact ⟨_, rfl, nextHeap, hext, .erased⟩
+  | fetch target field =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtom leftEnvironment target with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftTarget =>
+          obtain ⟨rightTarget, hright, htarget⟩ :=
+            resolveAtom_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases htarget with
+          | lit => simp at hrun
+          | erased => simp at hrun
+          | @loc leftLoc rightLoc hrel =>
+              cases hleftBox : left.get? leftLoc with
+              | none => simp [hleftBox] at hrun
+              | some leftBox =>
+                  obtain ⟨rightBox, hrightBox, hbox⟩ :=
+                    heap.boxes hrel hleftBox
+                  rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+                  rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+                  rcases hbox with ⟨hworld, hrc, hnodeIso⟩
+                  change leftWorld = rightWorld at hworld
+                  change leftRc = rightRc at hrc
+                  change NodeIso heap.locRel leftNode rightNode at hnodeIso
+                  subst rightWorld
+                  subst rightRc
+                  simp only [hleftBox] at hrun
+                  simp only [hrightBox]
+                  cases hnodeIso with
+                  | pap harguments => simp at hrun
+                  | @ctor identity leftFields rightFields hfields =>
+                      simp only
+                      cases hfield : leftFields[field]? with
+                      | none => simp [hfield] at hrun
+                      | some leftValue =>
+                          obtain ⟨rightValue, hrightField, hvalue⟩ :=
+                            hfields.get? (by simpa using hfield)
+                          simp only [hfield, Except.ok.injEq] at hrun
+                          subst leftOut
+                          refine ⟨(right, rightValue), ?_, heap,
+                            HeapHistoryIso.Extends.refl, hvalue⟩
+                          have hrightFieldArray :
+                              rightFields[field]? = some rightValue := by
+                            simpa using hrightField
+                          simp [hrightFieldArray]
+  | call function arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtoms leftEnvironment arguments with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValues =>
+          obtain ⟨rightValues, hright, hvalues⟩ :=
+            resolveAtoms_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          exact smaller.invoke ctx function leftValues rightValues left right
+            heap hvalues leftOut hrun
+  | callSelf arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtoms leftEnvironment arguments with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValues =>
+          obtain ⟨rightValues, hright, hvalues⟩ :=
+            resolveAtoms_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          have hlength := hvalues.lengths
+          by_cases harity : leftValues.length = current.arity
+          · have hrightArity : rightValues.length = current.arity := by
+              rw [← hlength]
+              exact harity
+            simp [harity] at hrun
+            cases hbody : IxIR1.runCode ctx fuel current left
+                leftValues.reverse current.body with
+            | error error =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok bodyOut =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                have hout := (checkResultWorld_ok hrun).1
+                subst leftOut
+                obtain ⟨rightBodyOut, hrightBody, bodyHeap,
+                    hext, hvalue⟩ :=
+                  smaller.runCode ctx current left right heap
+                    leftValues.reverse rightValues.reverse hvalues.reverse
+                    current.body bodyOut hbody
+                rcases bodyOut with ⟨bodyStore, bodyValue⟩
+                rcases rightBodyOut with
+                  ⟨rightBodyStore, rightBodyValue⟩
+                have hrightWorld := checkResultWorld_historyIso bodyHeap
+                  hvalue current.result hrun
+                refine ⟨_, ?_, bodyHeap, hext, hvalue⟩
+                simp [hrightArity, hrightBody, hrightWorld]
+          · have hrightArity : rightValues.length ≠ current.arity := by
+              intro heq
+              exact harity (hlength.trans heq)
+            simp [harity, hrightArity] at hrun
+  | papp function arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtoms leftEnvironment arguments with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValues =>
+          obtain ⟨rightValues, hright, hvalues⟩ :=
+            resolveAtoms_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases hdecl : ctx.decls function with
+          | none => simp [hdecl] at hrun
+          | some declaration =>
+              simp only [hdecl] at hrun ⊢
+              by_cases hunder : leftValues.length < declArity declaration
+              · have hrightUnder :
+                    rightValues.length < declArity declaration := by
+                  rw [← hvalues.lengths]
+                  exact hunder
+                simp only [hunder, hrightUnder, if_true,
+                  Except.ok.injEq] at hrun ⊢
+                subst leftOut
+                let next := heap.alloc (world := .shared)
+                  (leftNode := .papN function (declArity declaration)
+                    leftValues.toArray)
+                  (rightNode := .papN function (declArity declaration)
+                    rightValues.toArray)
+                  (.pap (by simpa using hvalues))
+                exact ⟨_, rfl, next, (fun h => .inr h),
+                  .loc (.inl ⟨rfl, rfl⟩)⟩
+              · simp [hunder] at hrun
+  | apply function arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleftFunction : resolveAtom leftEnvironment function with
+      | error error =>
+          rw [hleftFunction] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftFunction =>
+          obtain ⟨rightFunction, hrightFunction, hfunction⟩ :=
+            resolveAtom_historyIso henvironment hleftFunction
+          rw [hleftFunction] at hrun
+          rw [hrightFunction]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases hleftArgs : resolveAtoms leftEnvironment arguments with
+          | error error =>
+              rw [hleftArgs] at hrun
+              simp only [bind, Except.bind] at hrun
+              contradiction
+          | ok leftValues =>
+              obtain ⟨rightValues, hrightArgs, hvalues⟩ :=
+                resolveAtoms_historyIso henvironment hleftArgs
+              rw [hleftArgs] at hrun
+              rw [hrightArgs]
+              simp only [bind, Except.bind] at hrun ⊢
+              exact smaller.applyGo ctx left right heap leftFunction
+                rightFunction leftValues rightValues hfunction hvalues
+                leftOut hrun
+  | extern function arguments =>
+      rw [IxIR1.runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hleft : resolveAtoms leftEnvironment arguments with
+      | error error =>
+          rw [hleft] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok leftValues =>
+          obtain ⟨rightValues, hright, hvalues⟩ :=
+            resolveAtoms_historyIso henvironment hleft
+          rw [hleft] at hrun
+          rw [hright]
+          simp only [bind, Except.bind] at hrun ⊢
+          cases horacle : callScalarOracle ctx function leftValues with
+          | error error =>
+              rw [horacle] at hrun
+              simp only [bind, Except.bind] at hrun
+              contradiction
+          | ok leftValue =>
+              rw [horacle] at hrun
+              simp only [bind, Except.bind, Except.ok.injEq] at hrun
+              subst leftOut
+              obtain ⟨rightValue, hrightOracle, hvalue⟩ :=
+                callScalarOracle_historyIso hvalues horacle
+              rw [hrightOracle]
+              exact ⟨_, rfl, heap, HeapHistoryIso.Extends.refl, hvalue⟩
+
+private theorem invoke_historyIsoStep {fuel : Nat}
+    (smaller : EvalHistoryIsoAt fuel) :
+    ∀ (ctx : Ctx) (function : Ix.Compiler.Ixon.Address)
+      (leftArguments rightArguments : List RVal)
+      (left right : Store) (heap : HeapHistoryIso left right),
+    RValsIso heap.locRel leftArguments rightArguments →
+    ∀ (leftOut : Store × RVal),
+      IxIR1.invoke ctx (fuel + 1) function leftArguments left = .ok leftOut →
+      ∃ rightOut,
+        IxIR1.invoke ctx (fuel + 1) function rightArguments right =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  intro ctx function leftArguments rightArguments left right heap
+    harguments leftOut hrun
+  rw [IxIR1.invoke.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hdecl : ctx.decls function with
+  | none => simp [hdecl] at hrun
+  | some declaration =>
+      simp only [hdecl] at hrun ⊢
+      cases declaration with
+      | extern arity =>
+          have hlength := harguments.lengths
+          by_cases hsame : leftArguments.length = arity
+          · have hrightSame : rightArguments.length = arity := by
+              rw [← hlength]
+              exact hsame
+            simp [hsame] at hrun
+            cases horacle : callScalarOracle ctx function leftArguments with
+            | error error =>
+                rw [horacle] at hrun
+                contradiction
+            | ok leftValue =>
+                rw [horacle] at hrun
+                injection hrun with hout
+                subst leftOut
+                obtain ⟨rightValue, hrightOracle, hvalue⟩ :=
+                  callScalarOracle_historyIso harguments horacle
+                refine ⟨(right, rightValue), ?_, heap,
+                  HeapHistoryIso.Extends.refl, hvalue⟩
+                simp [hrightSame, hrightOracle]
+          · have hrightSame : rightArguments.length ≠ arity := by
+              intro heq
+              exact hsame (hlength.trans heq)
+            simp [hsame] at hrun
+      | fn definition =>
+          have hlength := harguments.lengths
+          by_cases hsame : leftArguments.length = definition.arity
+          · have hrightSame :
+                rightArguments.length = definition.arity := by
+              rw [← hlength]
+              exact hsame
+            simp [hsame] at hrun
+            cases hbody : IxIR1.runCode ctx fuel definition left
+                leftArguments.reverse definition.body with
+            | error error =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok bodyOut =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                have hout := (checkResultWorld_ok hrun).1
+                subst leftOut
+                obtain ⟨rightBodyOut, hrightBody, bodyHeap,
+                    hext, hvalue⟩ :=
+                  smaller.runCode ctx definition left right heap
+                    leftArguments.reverse rightArguments.reverse
+                    harguments.reverse definition.body bodyOut hbody
+                rcases bodyOut with ⟨bodyStore, bodyValue⟩
+                rcases rightBodyOut with
+                  ⟨rightBodyStore, rightBodyValue⟩
+                have hrightWorld := checkResultWorld_historyIso bodyHeap
+                  hvalue definition.result hrun
+                refine ⟨_, ?_, bodyHeap, hext, hvalue⟩
+                simp [hrightSame, hrightBody]
+                simpa only [bind, Except.bind] using hrightWorld
+          · have hrightSame :
+                rightArguments.length ≠ definition.arity := by
+              intro heq
+              exact hsame (hlength.trans heq)
+            simp [hsame] at hrun
+
+private theorem applyGo_historyIsoStep {fuel : Nat}
+    (smaller : EvalHistoryIsoAt fuel) :
+    ∀ (ctx : Ctx) (left right : Store)
+      (heap : HeapHistoryIso left right)
+      (leftFunction rightFunction : RVal)
+      (leftArguments rightArguments : List RVal),
+    RValIso heap.locRel leftFunction rightFunction →
+    RValsIso heap.locRel leftArguments rightArguments →
+    ∀ (leftOut : Store × RVal),
+      IxIR1.applyGo ctx (fuel + 1) left leftFunction leftArguments =
+        .ok leftOut →
+      ∃ rightOut,
+        IxIR1.applyGo ctx (fuel + 1) right rightFunction rightArguments =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  intro ctx left right heap leftFunction rightFunction leftArguments
+    rightArguments hfunction harguments leftOut hrun
+  rw [IxIR1.applyGo.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hfunction with
+  | lit => simp at hrun
+  | erased =>
+      cases hdrop : IxIR1.dropMany ctx fuel left leftArguments with
+      | error error =>
+          rw [hdrop] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok nextLeft =>
+          rw [hdrop] at hrun
+          simp only [bind, Except.bind, Except.ok.injEq] at hrun
+          subst leftOut
+          obtain ⟨nextRight, hrightDrop, nextHeap, hext⟩ :=
+            smaller.dropMany ctx left right heap leftArguments rightArguments
+              harguments nextLeft hdrop
+          rw [hrightDrop]
+          exact ⟨_, rfl, nextHeap, hext, .erased⟩
+  | @loc leftLoc rightLoc hrel =>
+      cases hleftBox : left.get? leftLoc with
+      | none => simp [hleftBox] at hrun
+      | some leftBox =>
+          obtain ⟨rightBox, hrightBox, hbox⟩ :=
+            heap.boxes hrel hleftBox
+          rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+          rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+          rcases hbox with ⟨hworld, hrc, hnode⟩
+          change leftWorld = rightWorld at hworld
+          change leftRc = rightRc at hrc
+          change NodeIso heap.locRel leftNode rightNode at hnode
+          subst rightWorld
+          subst rightRc
+          simp only [hleftBox] at hrun
+          simp only [hrightBox]
+          cases hnode with
+          | ctor hfields => simp at hrun
+          | @pap function arity leftCaptured rightCaptured hcaptured =>
+              dsimp only at hrun ⊢
+              cases hdup : dupVals left leftCaptured.toList with
+              | error error =>
+                  rw [hdup] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  contradiction
+              | ok duplicatedLeft =>
+                  rw [hdup] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  obtain ⟨duplicatedRight, hrightDup, duplicateHeap,
+                      hentryDuplicate⟩ :=
+                    dupVals_historyIso heap hcaptured hdup
+                  cases hdrop : IxIR1.dropVal ctx fuel duplicatedLeft
+                      (.loc leftLoc) with
+                  | error error =>
+                      rw [hdrop] at hrun
+                      simp only [bind, Except.bind] at hrun
+                      contradiction
+                  | ok readyLeft =>
+                      rw [hdrop] at hrun
+                      simp only [bind, Except.bind] at hrun
+                      obtain ⟨readyRight, hrightDrop, readyHeap,
+                          hduplicateReady⟩ :=
+                        smaller.dropVal ctx duplicatedLeft duplicatedRight
+                          duplicateHeap (.loc leftLoc) (.loc rightLoc)
+                          (hentryDuplicate.rval (.loc hrel)) readyLeft hdrop
+                      let hentryReady : heap.Extends readyHeap :=
+                        HeapHistoryIso.Extends.trans hentryDuplicate
+                          hduplicateReady
+                      let leftTotal := leftCaptured.toList ++ leftArguments
+                      let rightTotal := rightCaptured.toList ++ rightArguments
+                      let htotal : RValsIso readyHeap.locRel
+                          leftTotal rightTotal :=
+                        (hentryReady.rvals hcaptured).append
+                          (hentryReady.rvals harguments)
+                      have hlength : leftTotal.length = rightTotal.length :=
+                        htotal.lengths
+                      by_cases hunder : leftTotal.length < arity
+                      · have hrightUnder : rightTotal.length < arity := by
+                          rw [← hlength]
+                          exact hunder
+                        have hunderRaw :
+                            (leftCaptured.toList ++ leftArguments).length <
+                              arity := by
+                          simpa [leftTotal] using hunder
+                        have hunderSize :
+                            leftCaptured.size + leftArguments.length <
+                              arity := by
+                          simpa [leftTotal] using hunder
+                        have hrightUnderRaw :
+                            (rightCaptured.toList ++ rightArguments).length <
+                              arity := by
+                          simpa [rightTotal] using hrightUnder
+                        have hrightUnderSize :
+                            rightCaptured.size + rightArguments.length <
+                              arity := by
+                          simpa [rightTotal] using hrightUnder
+                        simp only [hunderRaw, if_true,
+                          Except.ok.injEq] at hrun
+                        subst leftOut
+                        let next := readyHeap.alloc (world := .shared)
+                          (leftNode := .papN function arity
+                            leftTotal.toArray)
+                          (rightNode := .papN function arity
+                            rightTotal.toArray)
+                          (.pap (by simpa using htotal))
+                        have hreadyNext : readyHeap.Extends next := by
+                          intro l r hknown
+                          change (l = readyLeft.nodes.size ∧
+                            r = readyRight.nodes.size) ∨
+                              readyHeap.locRel l r
+                          exact .inr hknown
+                        have hfresh : RValIso next.locRel
+                            (.loc readyLeft.nodes.size)
+                            (.loc readyRight.nodes.size) := by
+                          apply RValIso.loc
+                          change (readyLeft.nodes.size = readyLeft.nodes.size ∧
+                            readyRight.nodes.size = readyRight.nodes.size) ∨
+                              readyHeap.locRel _ _
+                          exact .inl ⟨rfl, rfl⟩
+                        let rightAllocated := readyRight.allocNode .shared
+                          (.papN function arity rightTotal.toArray)
+                        refine ⟨(rightAllocated.1,
+                          .loc rightAllocated.2), ?_, next,
+                          hentryReady.trans hreadyNext, ?_⟩
+                        · rw [hrightDup]
+                          simp only [bind, Except.bind]
+                          rw [hrightDrop]
+                          simp only [bind, Except.bind]
+                          simp [rightTotal, rightAllocated,
+                            hrightUnderSize]
+                        · simpa [leftTotal, rightTotal, rightAllocated,
+                            Store.allocNode] using hfresh
+                      · have hrightUnder : ¬ rightTotal.length < arity := by
+                          intro hlt
+                          exact hunder (lt_of_eq_of_lt hlength hlt)
+                        by_cases hexact : leftTotal.length = arity
+                        · have hrightExact : rightTotal.length = arity := by
+                            rw [← hlength]
+                            exact hexact
+                          have hunderRaw :
+                              ¬ (leftCaptured.toList ++
+                                leftArguments).length < arity := by
+                            simpa [leftTotal] using hunder
+                          have hexactRaw :
+                              (leftCaptured.toList ++
+                                leftArguments).length = arity := by
+                            simpa [leftTotal] using hexact
+                          have hrightUnderRaw :
+                              ¬ (rightCaptured.toList ++
+                                rightArguments).length < arity := by
+                            simpa [rightTotal] using hrightUnder
+                          have hrightExactRaw :
+                              (rightCaptured.toList ++
+                                rightArguments).length = arity := by
+                            simpa [rightTotal] using hrightExact
+                          have hunderSize :
+                              ¬ leftCaptured.size + leftArguments.length <
+                                arity := by
+                            simpa [leftTotal] using hunder
+                          have hexactSize :
+                              leftCaptured.size + leftArguments.length =
+                                arity := by
+                            simpa [leftTotal] using hexact
+                          have hrightUnderSize :
+                              ¬ rightCaptured.size + rightArguments.length <
+                                arity := by
+                            simpa [rightTotal] using hrightUnder
+                          have hrightExactSize :
+                              rightCaptured.size + rightArguments.length =
+                                arity := by
+                            simpa [rightTotal] using hrightExact
+                          obtain ⟨definition, hdecl, hpapsafe⟩ :
+                              ∃ definition,
+                                ctx.decls function = some definition ∧
+                                  declPapSafe definition = true := by
+                            cases hdecl : ctx.decls function with
+                            | none =>
+                                simp [hunderSize, hexactSize, hdecl] at hrun
+                            | some definition =>
+                                cases hpapsafe : declPapSafe definition with
+                                | false =>
+                                    simp [hunderSize, hexactSize, hdecl,
+                                      hpapsafe] at hrun
+                                | true => exact ⟨definition, rfl, hpapsafe⟩
+                          simp [hunderSize, hexactSize, hdecl,
+                            hpapsafe] at hrun
+                          have hrunInvoke : IxIR1.invoke ctx fuel function
+                              leftTotal readyLeft = .ok leftOut := by
+                            simpa [leftTotal] using hrun
+                          obtain ⟨rightOut, hrightInvoke, finalHeap,
+                              hreadyFinal, hvalue⟩ :=
+                            smaller.invoke ctx function leftTotal rightTotal
+                              readyLeft readyRight readyHeap htotal leftOut
+                              hrunInvoke
+                          refine ⟨rightOut, ?_, finalHeap,
+                            hentryReady.trans hreadyFinal, hvalue⟩
+                          rw [hrightDup]
+                          simp only [bind, Except.bind]
+                          rw [hrightDrop]
+                          simp only [bind, Except.bind]
+                          simpa [rightTotal, hrightUnderSize,
+                            hrightExactSize, hdecl, hpapsafe] using hrightInvoke
+                        · have hrightExact : rightTotal.length ≠ arity := by
+                            intro heq
+                            exact hexact (hlength.trans heq)
+                          have hunderRaw :
+                              ¬ (leftCaptured.toList ++
+                                leftArguments).length < arity := by
+                            simpa [leftTotal] using hunder
+                          have hexactRaw :
+                              (leftCaptured.toList ++
+                                leftArguments).length ≠ arity := by
+                            simpa [leftTotal] using hexact
+                          have hrightUnderRaw :
+                              ¬ (rightCaptured.toList ++
+                                rightArguments).length < arity := by
+                            simpa [rightTotal] using hrightUnder
+                          have hrightExactRaw :
+                              (rightCaptured.toList ++
+                                rightArguments).length ≠ arity := by
+                            simpa [rightTotal] using hrightExact
+                          have hunderSize :
+                              ¬ leftCaptured.size + leftArguments.length <
+                                arity := by
+                            simpa [leftTotal] using hunder
+                          have hexactSize :
+                              leftCaptured.size + leftArguments.length ≠
+                                arity := by
+                            simpa [leftTotal] using hexact
+                          have hrightUnderSize :
+                              ¬ rightCaptured.size + rightArguments.length <
+                                arity := by
+                            simpa [rightTotal] using hrightUnder
+                          have hrightExactSize :
+                              rightCaptured.size + rightArguments.length ≠
+                                arity := by
+                            simpa [rightTotal] using hrightExact
+                          obtain ⟨definition, hdecl, hpapsafe⟩ :
+                              ∃ definition,
+                                ctx.decls function = some definition ∧
+                                  declPapSafe definition = true := by
+                            cases hdecl : ctx.decls function with
+                            | none =>
+                                simp [hunderSize, hexactSize, hdecl] at hrun
+                            | some definition =>
+                                cases hpapsafe : declPapSafe definition with
+                                | false =>
+                                    simp [hunderSize, hexactSize, hdecl,
+                                      hpapsafe] at hrun
+                                | true => exact ⟨definition, rfl, hpapsafe⟩
+                          simp [hunderSize, hexactSize, hdecl,
+                            hpapsafe] at hrun
+                          cases hinvoke : IxIR1.invoke ctx fuel function
+                              (leftTotal.take arity) readyLeft with
+                          | error error =>
+                              rw [hinvoke] at hrun
+                              simp only [bind, Except.bind] at hrun
+                              contradiction
+                          | ok calledLeft =>
+                              rw [hinvoke] at hrun
+                              simp only [bind, Except.bind] at hrun
+                              obtain ⟨calledRight, hrightInvoke, calledHeap,
+                                  hreadyCalled, hcalledValue⟩ :=
+                                smaller.invoke ctx function
+                                  (leftTotal.take arity)
+                                  (rightTotal.take arity) readyLeft readyRight
+                                  readyHeap (htotal.take arity) calledLeft
+                                  hinvoke
+                              rcases calledLeft with
+                                ⟨calledLeftStore, calledLeftValue⟩
+                              rcases calledRight with
+                                ⟨calledRightStore, calledRightValue⟩
+                              have hrunApply : IxIR1.applyGo ctx fuel
+                                  calledLeftStore calledLeftValue
+                                  (leftTotal.drop arity) = .ok leftOut := by
+                                simpa [leftTotal] using hrun
+                              obtain ⟨rightOut, hrightApply, finalHeap,
+                                  hcalledFinal, hresult⟩ :=
+                                smaller.applyGo ctx calledLeftStore
+                                  calledRightStore calledHeap calledLeftValue
+                                  calledRightValue (leftTotal.drop arity)
+                                  (rightTotal.drop arity) hcalledValue
+                                  (hreadyCalled.rvals (htotal.drop arity))
+                                  leftOut hrunApply
+                              refine ⟨rightOut, ?_, finalHeap,
+                                hentryReady.trans
+                                  (hreadyCalled.trans hcalledFinal), hresult⟩
+                              rw [hrightDup]
+                              simp only [bind, Except.bind]
+                              rw [hrightDrop]
+                              simp only [bind, Except.bind]
+                              simp [hrightUnderSize, hrightExactSize, hdecl,
+                                hpapsafe]
+                              rw [hrightInvoke]
+                              simp only [bind, Except.bind]
+                              exact hrightApply
+
+private theorem evalHistoryIsoAt : ∀ fuel, EvalHistoryIsoAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [IxIR1.runCode, IxIR1.runOp, IxIR1.invoke, IxIR1.applyGo,
+          IxIR1.dropVal, IxIR1.dropMany, IxIR1.dropUVal,
+          IxIR1.dropManyU] at *
+  | succ fuel smaller =>
+      let drops := dropHistoryIsoAt (fuel + 1)
+      exact ⟨runCode_historyIsoStep smaller,
+        runOp_historyIsoStep smaller,
+        invoke_historyIsoStep smaller,
+        applyGo_historyIsoStep smaller,
+        drops.dropVal, drops.dropMany, drops.dropUVal, drops.dropManyU⟩
+
+/-- Successful code evaluation commutes with a heap-history isomorphism.
+Concrete allocation indices and cost counters may differ, while every live
+result and every older related root remains paired. -/
+theorem runCode_historyIso {ctx : Ctx} {fuel : Nat} {current : FnDef}
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftEnvironment rightEnvironment : List RVal}
+    (henvironment : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    {input : Code} {leftOut : Store × RVal}
+    (hrun : IxIR1.runCode ctx fuel current left leftEnvironment input =
+      .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.runCode ctx fuel current right rightEnvironment input =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut :=
+  (evalHistoryIsoAt fuel).runCode ctx current left right heap leftEnvironment
+    rightEnvironment henvironment input leftOut hrun
+
+theorem runOp_historyIso {ctx : Ctx} {fuel : Nat} {current : FnDef}
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftEnvironment rightEnvironment : List RVal}
+    (henvironment : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    {operation : Op} {leftOut : Store × RVal}
+    (hrun : IxIR1.runOp ctx fuel current left leftEnvironment operation =
+      .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.runOp ctx fuel current right rightEnvironment operation =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut :=
+  (evalHistoryIsoAt fuel).runOp ctx current left right heap leftEnvironment
+    rightEnvironment henvironment operation leftOut hrun
+
+theorem invoke_historyIso {ctx : Ctx} {fuel : Nat}
+    {function : Ix.Compiler.Ixon.Address}
+    {leftArguments rightArguments : List RVal}
+    {left right : Store} (heap : HeapHistoryIso left right)
+    (harguments : RValsIso heap.locRel leftArguments rightArguments)
+    {leftOut : Store × RVal}
+    (hrun : IxIR1.invoke ctx fuel function leftArguments left = .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.invoke ctx fuel function rightArguments right = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut :=
+  (evalHistoryIsoAt fuel).invoke ctx function leftArguments rightArguments
+    left right heap harguments leftOut hrun
+
+theorem applyGo_historyIso {ctx : Ctx} {fuel : Nat}
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftFunction rightFunction : RVal}
+    {leftArguments rightArguments : List RVal}
+    (hfunction : RValIso heap.locRel leftFunction rightFunction)
+    (harguments : RValsIso heap.locRel leftArguments rightArguments)
+    {leftOut : Store × RVal}
+    (hrun : IxIR1.applyGo ctx fuel left leftFunction leftArguments =
+      .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.applyGo ctx fuel right rightFunction rightArguments =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut :=
+  (evalHistoryIsoAt fuel).applyGo ctx left right heap leftFunction
+    rightFunction leftArguments rightArguments hfunction harguments leftOut
+    hrun
+
+theorem dropVal_historyIso {ctx : Ctx} {fuel : Nat}
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftValue rightValue : RVal}
+    (hvalue : RValIso heap.locRel leftValue rightValue)
+    {leftOut : Store}
+    (hrun : IxIR1.dropVal ctx fuel left leftValue = .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.dropVal ctx fuel right rightValue = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut :=
+  (dropHistoryIsoAt fuel).dropVal ctx left right heap leftValue rightValue
+    hvalue leftOut hrun
+
+/-- Unique deep destruction commutes with allocation-history isomorphism. -/
+theorem dropUVal_historyIso {ctx : Ctx} {fuel : Nat}
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftValue rightValue : RVal}
+    (hvalue : RValIso heap.locRel leftValue rightValue)
+    {leftOut : Store}
+    (hrun : IxIR1.dropUVal ctx fuel left leftValue = .ok leftOut) :
+    ∃ rightOut,
+      IxIR1.dropUVal ctx fuel right rightValue = .ok rightOut ∧
+        StoreHistoryIso heap leftOut rightOut :=
+  (dropHistoryIsoAt fuel).dropUVal ctx left right heap leftValue rightValue
+    hvalue leftOut hrun
+end Ix.Compiler.IxIR1.Sim
diff --git a/Ix/Compiler/IxIR1/EvalRewrite.lean b/Ix/Compiler/IxIR1/EvalRewrite.lean
new file mode 100644
index 000000000..d7652f726
--- /dev/null
+++ b/Ix/Compiler/IxIR1/EvalRewrite.lean
@@ -0,0 +1,1857 @@
+import Ix.Compiler.IxIR1.EvalIso
+
+/-!
+# Evaluator refinement under an abstract declaration environment
+
+An owner-sensitive optimization changes stored function bodies while leaving
+the calling convention stable.  This module isolates the recursive evaluator
+argument needed to lift such a local body theorem through direct calls,
+`callSelf`, PAP application, and arbitrary surrounding code.
+
+The abstraction is deliberately semantic.  It does not require a particular
+declaration map implementation or a syntactic rewrite function: each source
+function lookup supplies a target function with the same arity, result world,
+and PAP-entry policy, plus a local successful-run refinement in the source
+context.  The
+common fuel induction below is therefore reusable by every body optimizer and
+by the old-keyed logical environment that precedes content readdressing.
+-/
+
+namespace Ix.Compiler.IxIR1.Sim
+
+open Ix.Compiler.Ixon (Address)
+
+/-- Local semantic obligation for one rewritten function body.  Both runs use
+the source declaration context; the general evaluator traversal is responsible
+for replacing recursive callees afterward. -/
+def FunctionBodyRefines (ctx : Ctx) (source target : FnDef) : Prop :=
+  ∀ {fuel : Nat} {store : Store} {environment : List RVal}
+      {sourceOut : Store × RVal}
+      (base : HeapHistoryIso store store),
+    environment.length = source.arity →
+    RValsIso base.locRel environment environment →
+    runCode ctx fuel source store environment source.body = .ok sourceOut →
+    ∃ targetOut,
+      runCode ctx fuel target store environment target.body = .ok targetOut ∧
+        RunHistoryIso base sourceOut targetOut
+
+/-- The non-recursive obligation supplied by a body optimizer.  The rewritten
+body still runs under the source current frame; `FunctionBodyRefines.ofStatic`
+below closes the recursive `callSelf` fixed point and installs `target` as the
+dynamic frame. -/
+def StaticFunctionBodyRefines (ctx : Ctx) (source target : FnDef) : Prop :=
+  ∀ {fuel : Nat} {store : Store} {environment : List RVal}
+      {sourceOut : Store × RVal}
+      (base : HeapHistoryIso store store),
+    environment.length = source.arity →
+    RValsIso base.locRel environment environment →
+    runCode ctx fuel source store environment source.body = .ok sourceOut →
+    ∃ targetOut,
+      runCode ctx fuel source store environment target.body = .ok targetOut ∧
+        RunHistoryIso base sourceOut targetOut
+
+/-- One-way logical relation between evaluator declaration environments.
+Extra target declarations are harmless: only successful source lookups need a
+matching target. -/
+structure AbstractEnvironment (before after : Ctx) : Prop where
+  oracle_eq : after.oracle = before.oracle
+  extern : ∀ {address : Address} {arity : Nat},
+    before.decls address = some (.extern arity) →
+      after.decls address = some (.extern arity)
+  function : ∀ {address : Address} {source : FnDef},
+    before.decls address = some (.fn source) →
+      ∃ target : FnDef,
+        after.decls address = some (.fn target) ∧
+          target.arity = source.arity ∧
+          target.result = source.result ∧
+          target.papSafe = source.papSafe ∧
+          FunctionBodyRefines before source target
+
+/-- Strong body obligation for rewrites which preserve the complete evaluator
+result, including errors, stores, counters, and allocation identities. -/
+def FunctionBodyEq (ctx : Ctx) (source target : FnDef) : Prop :=
+  ∀ {fuel : Nat} {store : Store} {environment : List RVal},
+    environment.length = source.arity →
+      runCode ctx fuel target store environment target.body =
+        runCode ctx fuel source store environment source.body
+
+/-- Exact declaration-environment replacement.  Source misses remain misses;
+externs are unchanged; and every source function maps to a calling-convention
+compatible target whose body is exactly equivalent in the source context. -/
+structure ExactEnvironment (before after : Ctx) : Prop where
+  oracle_eq : after.oracle = before.oracle
+  missing : ∀ {address : Address}, before.decls address = none →
+    after.decls address = none
+  extern : ∀ {address : Address} {arity : Nat},
+    before.decls address = some (.extern arity) →
+      after.decls address = some (.extern arity)
+  function : ∀ {address : Address} {source : FnDef},
+    before.decls address = some (.fn source) →
+      ∃ target : FnDef,
+        after.decls address = some (.fn target) ∧
+          target.arity = source.arity ∧
+          target.result = source.result ∧
+          target.papSafe = source.papSafe ∧
+          FunctionBodyEq before source target
+
+namespace AbstractEnvironment
+
+theorem declaration {before after : Ctx}
+    (environment : AbstractEnvironment before after)
+    {address : Address} {source : Decl}
+    (hsource : before.decls address = some source) :
+    ∃ target,
+      after.decls address = some target ∧
+        declArity target = declArity source ∧
+        declPapSafe target = declPapSafe source := by
+  cases source with
+  | extern arity =>
+      exact ⟨.extern arity, environment.extern hsource, rfl, rfl⟩
+  | fn source =>
+      obtain ⟨target, htarget, harity, _, hpapsafe, _⟩ :=
+        environment.function hsource
+      exact ⟨.fn target, htarget, harity, hpapsafe⟩
+
+end AbstractEnvironment
+
+private structure DropCtxEqAt (before after : Ctx) (fuel : Nat) : Prop where
+  dropVal : ∀ (store : Store) (value : RVal),
+    dropVal after fuel store value = dropVal before fuel store value
+  dropMany : ∀ (store : Store) (values : List RVal),
+    dropMany after fuel store values = dropMany before fuel store values
+  dropUVal : ∀ (store : Store) (value : RVal),
+    dropUVal after fuel store value = dropUVal before fuel store value
+  dropManyU : ∀ (store : Store) (values : List RVal),
+    dropManyU after fuel store values = dropManyU before fuel store values
+
+private theorem dropCtxEqAt (before after : Ctx) :
+    ∀ fuel, DropCtxEqAt before after fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [dropVal, dropMany, dropUVal, dropManyU]
+  | succ fuel smaller =>
+      constructor
+      · intro store value
+        cases value with
+        | lit literal => simp [dropVal]
+        | erased => simp [dropVal]
+        | loc location =>
+            simp only [dropVal]
+            cases hbox : store.get? location with
+            | none => simp
+            | some box =>
+                simp only
+                cases hworld : box.world with
+                | unique => simp
+                | shared =>
+                    simp only
+                    by_cases hone : box.rc == 1
+                    · simp only [hone, if_true]
+                      cases hnode : box.node with
+                      | ctorN identity fields =>
+                          simpa [hnode] using smaller.dropMany
+                            (store.rcTick.kill location) fields.toList
+                      | papN function arity arguments =>
+                          simpa [hnode] using smaller.dropMany
+                            (store.rcTick.kill location) arguments.toList
+                    · simp [hone]
+      · intro store values
+        cases values with
+        | nil => simp [dropMany]
+        | cons value rest =>
+            simp only [dropMany]
+            rw [smaller.dropVal store value]
+            cases hdrop : dropVal before fuel store value with
+            | error error => rfl
+            | ok next => exact smaller.dropMany next rest
+      · intro store value
+        cases value with
+        | lit literal => simp [dropUVal]
+        | erased => simp [dropUVal]
+        | loc location =>
+            simp only [dropUVal]
+            cases hbox : store.get? location with
+            | none => simp
+            | some box =>
+                simp only
+                cases hworld : box.world with
+                | shared => simp
+                | unique =>
+                    simp only
+                    cases hnode : box.node with
+                    | ctorN identity fields =>
+                        simpa [hnode] using smaller.dropManyU
+                          (store.kill location) fields.toList
+                    | papN function arity arguments => simp
+      · intro store values
+        cases values with
+        | nil => simp [dropManyU]
+        | cons value rest =>
+            simp only [dropManyU]
+            rw [smaller.dropUVal store value]
+            cases hdrop : dropUVal before fuel store value with
+            | error error => rfl
+            | ok next => exact smaller.dropManyU next rest
+
+/-- Deep shared destruction is independent of the declaration environment and
+oracle stored in the evaluator context. -/
+theorem dropVal_ctx_eq (before after : Ctx) (fuel : Nat)
+    (store : Store) (value : RVal) :
+    dropVal after fuel store value = dropVal before fuel store value :=
+  (dropCtxEqAt before after fuel).dropVal store value
+
+/-- Pointwise shared destruction is independent of the evaluator context. -/
+theorem dropMany_ctx_eq (before after : Ctx) (fuel : Nat)
+    (store : Store) (values : List RVal) :
+    dropMany after fuel store values = dropMany before fuel store values :=
+  (dropCtxEqAt before after fuel).dropMany store values
+
+/-- Deep unique destruction is independent of the declaration environment and
+oracle stored in the evaluator context. -/
+theorem dropUVal_ctx_eq (before after : Ctx) (fuel : Nat)
+    (store : Store) (value : RVal) :
+    dropUVal after fuel store value = dropUVal before fuel store value :=
+  (dropCtxEqAt before after fuel).dropUVal store value
+
+/-- Pointwise unique destruction is independent of the evaluator context. -/
+theorem dropManyU_ctx_eq (before after : Ctx) (fuel : Nat)
+    (store : Store) (values : List RVal) :
+    dropManyU after fuel store values = dropManyU before fuel store values :=
+  (dropCtxEqAt before after fuel).dropManyU store values
+
+/-- The context-changing part of the evaluator theorem.  Entry stores and
+values are literally shared; `base` supplies the self-history needed when a
+body rewrite removes allocations and later locations drift. -/
+private structure EvalRewriteAt (before after : Ctx) (fuel : Nat) : Prop where
+  runCode : ∀ (current : FnDef) (store : Store)
+      (base : HeapHistoryIso store store) (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (input : Code) (sourceOut : Store × RVal),
+      runCode before fuel current store environment input = .ok sourceOut →
+      ∃ targetOut,
+        runCode after fuel current store environment input = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut
+  runOp : ∀ (current : FnDef) (store : Store)
+      (base : HeapHistoryIso store store) (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (operation : Op) (sourceOut : Store × RVal),
+      runOp before fuel current store environment operation = .ok sourceOut →
+      ∃ targetOut,
+        runOp after fuel current store environment operation = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut
+  invoke : ∀ (function : Address) (arguments : List RVal) (store : Store)
+      (base : HeapHistoryIso store store),
+    RValsIso base.locRel arguments arguments →
+    ∀ (sourceOut : Store × RVal),
+      IxIR1.invoke before fuel function arguments store = .ok sourceOut →
+      ∃ targetOut,
+        IxIR1.invoke after fuel function arguments store = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut
+  applyGo : ∀ (store : Store) (base : HeapHistoryIso store store)
+      (function : RVal) (arguments : List RVal),
+    RValIso base.locRel function function →
+    RValsIso base.locRel arguments arguments →
+    ∀ (sourceOut : Store × RVal),
+      IxIR1.applyGo before fuel store function arguments = .ok sourceOut →
+      ∃ targetOut,
+        IxIR1.applyGo after fuel store function arguments = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut
+
+private theorem selfRight_extends_compose
+    {left right : Store} (heap : HeapHistoryIso left right) :
+    heap.Extends (heap.trans (heap.symm.trans heap)) := by
+  intro leftLoc rightLoc hrel
+  exact ⟨rightLoc, hrel, leftLoc, hrel, hrel⟩
+
+private theorem selfLeft_compose_extends
+    {store : Store} (base : HeapHistoryIso store store) :
+    base.Extends ((base.trans base.symm).trans base) := by
+  intro leftLoc rightLoc hrel
+  exact ⟨leftLoc, ⟨rightLoc, hrel, hrel⟩, hrel⟩
+
+private theorem runCode_crossOfSame
+    {before after : Ctx} {fuel : Nat}
+    (same : EvalRewriteAt before after fuel)
+    {current : FnDef} {left right : Store}
+    (heap : HeapHistoryIso left right)
+    {leftEnvironment rightEnvironment : List RVal}
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    {input : Code} {sourceOut : Store × RVal}
+    (hrun : runCode before fuel current left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode after fuel current right rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut := by
+  obtain ⟨middleOut, hmiddle, hsourceMiddle⟩ :=
+    runCode_historyIso heap henvironments hrun
+  let self := heap.symm.trans heap
+  have hselfEnvironment : RValsIso self.locRel
+      rightEnvironment rightEnvironment := by
+    exact henvironments.symm.trans henvironments
+  obtain ⟨targetOut, htarget, hmiddleTarget⟩ :=
+    same.runCode current right self rightEnvironment hselfEnvironment input
+      middleOut hmiddle
+  exact ⟨targetOut, htarget,
+    RunHistoryIso.weaken (selfRight_extends_compose heap)
+      (hsourceMiddle.trans hmiddleTarget)⟩
+
+private theorem applyGo_crossOfSame
+    {before after : Ctx} {fuel : Nat}
+    (same : EvalRewriteAt before after fuel)
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftFunction rightFunction : RVal}
+    {leftArguments rightArguments : List RVal}
+    (hfunction : RValIso heap.locRel leftFunction rightFunction)
+    (harguments : RValsIso heap.locRel leftArguments rightArguments)
+    {sourceOut : Store × RVal}
+    (hrun : IxIR1.applyGo before fuel left leftFunction leftArguments =
+      .ok sourceOut) :
+    ∃ targetOut,
+      IxIR1.applyGo after fuel right rightFunction rightArguments =
+          .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut := by
+  obtain ⟨middleOut, hmiddle, hsourceMiddle⟩ :=
+    applyGo_historyIso heap hfunction harguments hrun
+  let self := heap.symm.trans heap
+  have hselfFunction : RValIso self.locRel rightFunction rightFunction :=
+    hfunction.symm.trans hfunction
+  have hselfArguments : RValsIso self.locRel
+      rightArguments rightArguments := harguments.symm.trans harguments
+  obtain ⟨targetOut, htarget, hmiddleTarget⟩ :=
+    same.applyGo right self rightFunction rightArguments hselfFunction
+      hselfArguments middleOut hmiddle
+  exact ⟨targetOut, htarget,
+    RunHistoryIso.weaken (selfRight_extends_compose heap)
+      (hsourceMiddle.trans hmiddleTarget)⟩
+
+private theorem resolveAtom_selfIso
+    {rel : Nat → Nat → Prop} {environment : List RVal}
+    (henvironment : RValsIso rel environment environment)
+    {atom : Atom} {value : RVal}
+    (hresolve : resolveAtom environment atom = .ok value) :
+    RValIso rel value value := by
+  obtain ⟨rightValue, hright, hvalue⟩ :=
+    resolveAtom_historyIso henvironment hresolve
+  have heq : rightValue = value := Except.ok.inj (hright.symm.trans hresolve)
+  subst rightValue
+  exact hvalue
+
+private theorem resolveAtoms_selfIso
+    {rel : Nat → Nat → Prop} {environment : List RVal}
+    (henvironment : RValsIso rel environment environment)
+    {atoms : Array Atom} {values : List RVal}
+    (hresolve : resolveAtoms environment atoms = .ok values) :
+    RValsIso rel values values := by
+  obtain ⟨rightValues, hright, hvalues⟩ :=
+    resolveAtoms_historyIso henvironment hresolve
+  have heq : rightValues = values := Except.ok.inj (hright.symm.trans hresolve)
+  subst rightValues
+  exact hvalues
+
+/-! ## Closing a rewritten current-frame fixed point -/
+
+private structure CurrentFrameRefinesAt (ctx : Ctx)
+    (source target : FnDef) (fuel : Nat) : Prop where
+  runCode : ∀ (store : Store) (base : HeapHistoryIso store store)
+      (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (input : Code) (sourceOut : Store × RVal),
+      runCode ctx fuel source store environment input = .ok sourceOut →
+      ∃ targetOut,
+        runCode ctx fuel target store environment input = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut
+  runOp : ∀ (store : Store) (base : HeapHistoryIso store store)
+      (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (operation : Op) (sourceOut : Store × RVal),
+      runOp ctx fuel source store environment operation = .ok sourceOut →
+      ∃ targetOut,
+        runOp ctx fuel target store environment operation = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut
+
+private theorem runCode_currentFrameCrossOfSame
+    {ctx : Ctx} {source target : FnDef} {fuel : Nat}
+    (same : CurrentFrameRefinesAt ctx source target fuel)
+    {left right : Store} (heap : HeapHistoryIso left right)
+    {leftEnvironment rightEnvironment : List RVal}
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    {input : Code} {sourceOut : Store × RVal}
+    (hrun : runCode ctx fuel source left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode ctx fuel target right rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut := by
+  obtain ⟨middleOut, hmiddle, hsourceMiddle⟩ :=
+    runCode_historyIso heap henvironments hrun
+  let self := heap.symm.trans heap
+  have hselfEnvironment : RValsIso self.locRel
+      rightEnvironment rightEnvironment :=
+    henvironments.symm.trans henvironments
+  obtain ⟨targetOut, htarget, hmiddleTarget⟩ :=
+    same.runCode right self rightEnvironment hselfEnvironment input middleOut
+      hmiddle
+  exact ⟨targetOut, htarget,
+    RunHistoryIso.weaken (selfRight_extends_compose heap)
+      (hsourceMiddle.trans hmiddleTarget)⟩
+
+private theorem runCode_currentFrameCaseStep
+    {ctx : Ctx} {source target : FnDef} {fuel : Nat}
+    (smaller : CurrentFrameRefinesAt ctx source target fuel)
+    (store : Store) (base : HeapHistoryIso store store)
+    (environment : List RVal)
+    (henvironment : RValsIso base.locRel environment environment)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt)
+    (sourceOut : Store × RVal)
+    (hrun : runCode ctx (fuel + 1) source store environment
+      (.case scrutinee peelNat alternatives) = .ok sourceOut) :
+    ∃ targetOut,
+      runCode ctx (fuel + 1) target store environment
+          (.case scrutinee peelNat alternatives) = .ok targetOut ∧
+        RunHistoryIso base sourceOut targetOut := by
+  rw [runCode.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error =>
+      rw [hscrutinee] at hrun
+      simp only [bind, Except.bind] at hrun
+      contradiction
+  | ok value =>
+      rw [hscrutinee] at hrun
+      simp only [bind, Except.bind] at hrun ⊢
+      have hvalue : RValIso base.locRel value value :=
+        resolveAtom_selfIso henvironment hscrutinee
+      cases value with
+      | erased => simp at hrun
+      | lit literal =>
+          cases literal with
+          | str value => simp at hrun
+          | nat value =>
+              cases peelNat with
+              | false => simp at hrun
+              | true =>
+                  cases value with
+                  | zero =>
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp [hfind] at hrun
+                      | some alternative =>
+                          simp only [hfind] at hrun ⊢
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  exact smaller.runCode store base environment
+                                    henvironment body sourceOut hrun
+                              | succ fields => simp at hrun
+                  | succ value =>
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp [hfind] at hrun
+                      | some alternative =>
+                          simp only [hfind] at hrun ⊢
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => simp at hrun
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      exact smaller.runCode store base
+                                        (.lit (.nat value) :: environment)
+                                        (.cons .lit henvironment) body
+                                        sourceOut hrun
+                                  | succ fields => simp at hrun
+      | loc location =>
+          cases hbox : store.get? location with
+          | none => simp [hbox] at hrun
+          | some box =>
+              simp only [hbox] at hrun ⊢
+              cases hnode : box.node with
+              | papN function arity arguments => simp [hnode] at hrun
+              | ctorN identity fields =>
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == identity.cidx) with
+                  | none => simp [hnode, hfind] at hrun
+                  | some alternative =>
+                      simp only [hfind] at hrun ⊢
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          by_cases hcount : fields.size = fieldCount
+                          · simp [hnode, hfind, hcount] at hrun ⊢
+                            cases hvalue with
+                            | @loc _ _ hrel =>
+                                obtain ⟨rightBox, hrightBox, hboxIso⟩ :=
+                                  base.boxes hrel hbox
+                                have hrightBoxEq : rightBox = box := by
+                                  exact Option.some.inj
+                                    (hrightBox.symm.trans hbox)
+                                subst rightBox
+                                have hfields : RValsIso base.locRel
+                                    fields.toList fields.toList := by
+                                  have hnodeIso : NodeIso base.locRel
+                                      box.node box.node := hboxIso.node
+                                  rw [hnode] at hnodeIso
+                                  cases hnodeIso with
+                                  | ctor hfields => exact hfields
+                                have hbranch : RValsIso base.locRel
+                                    (fields.toList.reverse ++ environment)
+                                    (fields.toList.reverse ++ environment) :=
+                                  hfields.reverse.append henvironment
+                                obtain ⟨targetOut, htarget, hiso⟩ :=
+                                  smaller.runCode store base
+                                    (fields.toList.reverse ++ environment)
+                                    hbranch body sourceOut hrun
+                                rcases targetOut with
+                                  ⟨targetStore, targetValue⟩
+                                exact ⟨targetStore, targetValue,
+                                  htarget, hiso⟩
+                          · simp [hnode, hfind, hcount] at hrun
+
+private theorem runCode_currentFrameStep
+    {ctx : Ctx} {source target : FnDef} {fuel : Nat}
+    (smaller : CurrentFrameRefinesAt ctx source target fuel) :
+    ∀ (store : Store) (base : HeapHistoryIso store store)
+      (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (input : Code) (sourceOut : Store × RVal),
+      runCode ctx (fuel + 1) source store environment input = .ok sourceOut →
+      ∃ targetOut,
+        runCode ctx (fuel + 1) target store environment input = .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut := by
+  intro store base environment henvironment input sourceOut hrun
+  cases input with
+  | ret atom =>
+      simpa [runCode] using
+        (runCode_historyIso base henvironment hrun)
+  | case scrutinee peelNat alternatives =>
+      exact runCode_currentFrameCaseStep smaller store base environment
+        henvironment scrutinee peelNat alternatives sourceOut hrun
+  | letOp operation rest =>
+      rw [runCode.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hoperation : runOp ctx fuel source store environment operation with
+      | error error =>
+          rw [hoperation] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok operationOut =>
+          rcases operationOut with ⟨middle, sourceValue⟩
+          rw [hoperation] at hrun
+          simp only [bind, Except.bind] at hrun
+          obtain ⟨targetOperationOut, htargetOperation,
+              operationHeap, hbaseOperation, hvalue⟩ :=
+            smaller.runOp store base environment henvironment operation
+              (middle, sourceValue) hoperation
+          rcases targetOperationOut with ⟨targetMiddle, targetValue⟩
+          have hrestEnvironment : RValsIso operationHeap.locRel
+              (sourceValue :: environment) (targetValue :: environment) :=
+            .cons hvalue (hbaseOperation.rvals henvironment)
+          obtain ⟨targetOut, htargetRest, hrestIso⟩ :=
+            runCode_currentFrameCrossOfSame smaller operationHeap
+              hrestEnvironment hrun
+          refine ⟨targetOut, ?_,
+            RunHistoryIso.weaken hbaseOperation hrestIso⟩
+          rw [htargetOperation]
+          simp only [bind, Except.bind]
+          exact htargetRest
+
+private theorem runOp_currentFrameStep
+    {ctx : Ctx} {source target : FnDef}
+    (bodyRewrite : StaticFunctionBodyRefines ctx source target)
+    (harity : target.arity = source.arity)
+    (hresult : target.result = source.result)
+    {fuel : Nat} (smaller : CurrentFrameRefinesAt ctx source target fuel) :
+    ∀ (store : Store) (base : HeapHistoryIso store store)
+      (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (operation : Op) (sourceOut : Store × RVal),
+      runOp ctx (fuel + 1) source store environment operation = .ok sourceOut →
+      ∃ targetOut,
+        runOp ctx (fuel + 1) target store environment operation =
+            .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut := by
+  intro store base environment henvironment operation sourceOut hrun
+  cases operation with
+  | pure atom =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | alloc world identity arguments =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | reuse targetAtom identity arguments =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | free targetAtom =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | dup targetAtom =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | drop targetAtom =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | dropU targetAtom =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | fetch targetAtom field =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | call function arguments =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | papp function arguments =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | apply function arguments =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | extern function arguments =>
+      simpa [runOp] using (runOp_historyIso base henvironment hrun)
+  | callSelf arguments =>
+      rw [runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases harguments : resolveAtoms environment arguments with
+      | error error =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok argumentValues =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun ⊢
+          have hargumentValues : RValsIso base.locRel
+              argumentValues argumentValues :=
+            resolveAtoms_selfIso henvironment harguments
+          by_cases hsourceArity : argumentValues.length = source.arity
+          · have htargetArity : argumentValues.length = target.arity := by
+              rw [harity]
+              exact hsourceArity
+            simp [hsourceArity] at hrun
+            cases hbody : runCode ctx fuel source store
+                argumentValues.reverse source.body with
+            | error error =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok bodyOut =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                have hout := (checkResultWorld_ok hrun).1
+                subst sourceOut
+                let self := base.trans base.symm
+                have hselfArguments : RValsIso self.locRel
+                    argumentValues.reverse argumentValues.reverse :=
+                  (hargumentValues.trans hargumentValues.symm).reverse
+                obtain ⟨localOut, hlocalRun, hlocalIso⟩ :=
+                  bodyRewrite self (by simpa using hsourceArity)
+                    hselfArguments hbody
+                obtain ⟨targetOut, htargetBody, hframeIso⟩ :=
+                  smaller.runCode store base argumentValues.reverse
+                    hargumentValues.reverse target.body localOut hlocalRun
+                have hbodyIso : RunHistoryIso base bodyOut targetOut :=
+                  RunHistoryIso.weaken (selfLeft_compose_extends base)
+                    (hlocalIso.trans hframeIso)
+                rcases bodyOut with ⟨bodyStore, bodyValue⟩
+                rcases targetOut with ⟨targetStore, targetValue⟩
+                obtain ⟨finalHeap, hbaseFinal, hvalue⟩ := hbodyIso
+                have htargetWorld := checkResultWorld_historyIso finalHeap
+                  hvalue source.result hrun
+                refine ⟨(targetStore, targetValue), ?_, finalHeap,
+                  hbaseFinal, hvalue⟩
+                simp [htargetArity, htargetBody, hresult]
+                simpa only [bind, Except.bind] using htargetWorld
+          · have htargetDifferent : argumentValues.length ≠ target.arity := by
+              intro heq
+              exact hsourceArity (heq.trans harity)
+            simp [hsourceArity, htargetDifferent] at hrun
+
+private theorem currentFrameRefinesAt
+    {ctx : Ctx} {source target : FnDef}
+    (bodyRewrite : StaticFunctionBodyRefines ctx source target)
+    (harity : target.arity = source.arity)
+    (hresult : target.result = source.result) :
+    ∀ fuel, CurrentFrameRefinesAt ctx source target fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [runCode, runOp] at *
+  | succ fuel smaller =>
+      exact ⟨runCode_currentFrameStep smaller,
+        runOp_currentFrameStep bodyRewrite harity hresult smaller⟩
+
+/-- A pass-local body rewrite closes to a genuine function refinement once
+the calling convention is stable. -/
+theorem FunctionBodyRefines.ofStatic
+    {ctx : Ctx} {source target : FnDef}
+    (bodyRewrite : StaticFunctionBodyRefines ctx source target)
+    (harity : target.arity = source.arity)
+    (hresult : target.result = source.result) :
+    FunctionBodyRefines ctx source target := by
+  intro fuel store environment sourceOut base hlength henvironment hrun
+  let self := base.trans base.symm
+  have hselfEnvironment : RValsIso self.locRel environment environment :=
+    henvironment.trans henvironment.symm
+  obtain ⟨localOut, hlocalRun, hlocalIso⟩ :=
+    bodyRewrite self hlength hselfEnvironment hrun
+  obtain ⟨targetOut, htargetRun, hframeIso⟩ :=
+    (currentFrameRefinesAt bodyRewrite harity hresult fuel).runCode store base
+      environment henvironment target.body localOut hlocalRun
+  exact ⟨targetOut, htargetRun,
+    RunHistoryIso.weaken (selfLeft_compose_extends base)
+      (hlocalIso.trans hframeIso)⟩
+
+/-- The same fixed-point closure lifted through arbitrary related entry heaps
+and environments. -/
+theorem runCode_currentFrame_refines
+    {ctx : Ctx} {source target : FnDef}
+    (bodyRewrite : StaticFunctionBodyRefines ctx source target)
+    (harity : target.arity = source.arity)
+    (hresult : target.result = source.result)
+    {left right : Store} {fuel : Nat}
+    {leftEnvironment rightEnvironment : List RVal}
+    {input : Code} {sourceOut : Store × RVal}
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (hrun : runCode ctx fuel source left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode ctx fuel target right rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut :=
+  runCode_currentFrameCrossOfSame
+    (currentFrameRefinesAt bodyRewrite harity hresult fuel) heap henvironments
+      hrun
+
+private theorem runCode_caseRewriteAt
+    {before after : Ctx} {fuel : Nat}
+    (smaller : EvalRewriteAt before after fuel)
+    (current : FnDef) (store : Store)
+    (base : HeapHistoryIso store store) (environment : List RVal)
+    (henvironment : RValsIso base.locRel environment environment)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt)
+    (sourceOut : Store × RVal)
+    (hrun : runCode before (fuel + 1) current store environment
+      (.case scrutinee peelNat alternatives) = .ok sourceOut) :
+    ∃ targetOut,
+      runCode after (fuel + 1) current store environment
+          (.case scrutinee peelNat alternatives) = .ok targetOut ∧
+        RunHistoryIso base sourceOut targetOut := by
+  rw [runCode.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error =>
+      rw [hscrutinee] at hrun
+      simp only [bind, Except.bind] at hrun
+      contradiction
+  | ok value =>
+      rw [hscrutinee] at hrun
+      simp only [bind, Except.bind] at hrun ⊢
+      have hvalue := resolveAtom_selfIso henvironment hscrutinee
+      cases value with
+      | erased => simp at hrun
+      | lit literal =>
+          cases literal with
+          | str value => simp at hrun
+          | nat value =>
+              cases peelNat with
+              | false => simp at hrun
+              | true =>
+                  cases value with
+                  | zero =>
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp [hfind] at hrun
+                      | some alternative =>
+                          simp only [hfind] at hrun ⊢
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  exact smaller.runCode current store base
+                                    environment henvironment body sourceOut
+                                    hrun
+                              | succ fields => simp at hrun
+                  | succ value =>
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp [hfind] at hrun
+                      | some alternative =>
+                          simp only [hfind] at hrun ⊢
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => simp at hrun
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      exact smaller.runCode current store base
+                                        (.lit (.nat value) :: environment)
+                                        (.cons .lit henvironment) body
+                                        sourceOut hrun
+                                  | succ fields => simp at hrun
+      | loc location =>
+          cases hbox : store.get? location with
+          | none => simp [hbox] at hrun
+          | some box =>
+              simp only [hbox] at hrun ⊢
+              cases hnode : box.node with
+              | papN function arity arguments =>
+                  simp [hnode] at hrun
+              | ctorN identity fields =>
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == identity.cidx) with
+                  | none => simp [hnode, hfind] at hrun
+                  | some alternative =>
+                      simp only [hfind] at hrun ⊢
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          by_cases hcount : fields.size = fieldCount
+                          · simp [hnode, hfind, hcount] at hrun ⊢
+                            cases hvalue with
+                            | @loc _ _ hrel =>
+                                obtain ⟨rightBox, hrightBox, hboxIso⟩ :=
+                                  base.boxes hrel hbox
+                                have hrightBoxEq : rightBox = box := by
+                                  exact Option.some.inj
+                                    (hrightBox.symm.trans hbox)
+                                subst rightBox
+                                have hfields : RValsIso base.locRel
+                                    fields.toList fields.toList := by
+                                  have hnodeIso : NodeIso base.locRel
+                                      box.node box.node := hboxIso.node
+                                  rw [hnode] at hnodeIso
+                                  cases hnodeIso with
+                                  | ctor hfields => exact hfields
+                                have hfold : RValsIso base.locRel
+                                    (fields.toList.reverse ++ environment)
+                                    (fields.toList.reverse ++ environment) :=
+                                  hfields.reverse.append henvironment
+                                obtain ⟨targetOut, htarget, hiso⟩ :=
+                                  smaller.runCode current store base
+                                    (fields.toList.reverse ++ environment)
+                                    hfold body sourceOut hrun
+                                rcases targetOut with
+                                  ⟨targetStore, targetValue⟩
+                                exact ⟨targetStore, targetValue,
+                                  htarget, hiso⟩
+                          · simp [hnode, hfind, hcount] at hrun
+
+private theorem runCode_rewriteStep
+    {before after : Ctx} {fuel : Nat}
+    (smaller : EvalRewriteAt before after fuel) :
+    ∀ (current : FnDef) (store : Store)
+      (base : HeapHistoryIso store store) (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (input : Code) (sourceOut : Store × RVal),
+      runCode before (fuel + 1) current store environment input =
+          .ok sourceOut →
+      ∃ targetOut,
+        runCode after (fuel + 1) current store environment input =
+            .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut := by
+  intro current store base environment henvironment input sourceOut hrun
+  cases input with
+  | ret atom =>
+      simpa [runCode] using
+        (runCode_historyIso base henvironment hrun)
+  | case scrutinee peelNat alternatives =>
+      exact runCode_caseRewriteAt smaller current store base environment
+        henvironment scrutinee peelNat alternatives sourceOut hrun
+  | letOp operation rest =>
+      rw [runCode.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hoperation : runOp before fuel current store environment
+          operation with
+      | error error =>
+          rw [hoperation] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok operationOut =>
+          rcases operationOut with ⟨middle, sourceValue⟩
+          rw [hoperation] at hrun
+          simp only [bind, Except.bind] at hrun
+          obtain ⟨targetOperationOut, htargetOperation,
+              operationHeap, hbaseOperation, hvalue⟩ :=
+            smaller.runOp current store base environment henvironment
+              operation (middle, sourceValue) hoperation
+          rcases targetOperationOut with ⟨targetMiddle, targetValue⟩
+          have hrestEnvironment : RValsIso operationHeap.locRel
+              (sourceValue :: environment) (targetValue :: environment) :=
+            .cons hvalue (hbaseOperation.rvals henvironment)
+          obtain ⟨targetOut, htargetRest, hrestIso⟩ :=
+            runCode_crossOfSame smaller operationHeap hrestEnvironment hrun
+          refine ⟨targetOut, ?_,
+            RunHistoryIso.weaken hbaseOperation hrestIso⟩
+          rw [htargetOperation]
+          simp only [bind, Except.bind]
+          exact htargetRest
+
+private theorem runOp_rewriteStep
+    {before after : Ctx} (abstract : AbstractEnvironment before after)
+    {fuel : Nat} (smaller : EvalRewriteAt before after fuel) :
+    ∀ (current : FnDef) (store : Store)
+      (base : HeapHistoryIso store store) (environment : List RVal),
+    RValsIso base.locRel environment environment →
+    ∀ (operation : Op) (sourceOut : Store × RVal),
+      runOp before (fuel + 1) current store environment operation =
+          .ok sourceOut →
+      ∃ targetOut,
+        runOp after (fuel + 1) current store environment operation =
+            .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut := by
+  intro current store base values hvalues operation sourceOut hrun
+  have hsourceRun := hrun
+  let drops := dropCtxEqAt before after fuel
+  cases operation with
+  | pure atom =>
+      simpa [runOp] using (runOp_historyIso base hvalues hrun)
+  | alloc world identity arguments =>
+      simpa [runOp] using (runOp_historyIso base hvalues hrun)
+  | reuse target identity arguments =>
+      simpa [runOp] using (runOp_historyIso base hvalues hrun)
+  | free target =>
+      simpa [runOp] using (runOp_historyIso base hvalues hrun)
+  | dup target =>
+      simpa [runOp] using (runOp_historyIso base hvalues hrun)
+  | drop target =>
+      simpa [runOp, drops.dropVal] using
+        (runOp_historyIso base hvalues hrun)
+  | dropU target =>
+      simpa [runOp, drops.dropUVal] using
+        (runOp_historyIso base hvalues hrun)
+  | fetch target field =>
+      simpa [runOp] using (runOp_historyIso base hvalues hrun)
+  | call function arguments =>
+      rw [runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases harguments : resolveAtoms values arguments with
+      | error error =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok arguments =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun ⊢
+          exact smaller.invoke function arguments store base
+            (resolveAtoms_selfIso hvalues harguments) sourceOut hrun
+  | callSelf arguments =>
+      rw [runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases harguments : resolveAtoms values arguments with
+      | error error =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok arguments =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun ⊢
+          have hargumentValues := resolveAtoms_selfIso hvalues harguments
+          by_cases harity : arguments.length = current.arity
+          · simp [harity] at hrun
+            cases hbody : runCode before fuel current store arguments.reverse
+                current.body with
+            | error error =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok bodyOut =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                have hout := (checkResultWorld_ok hrun).1
+                subst sourceOut
+                obtain ⟨targetBodyOut, htargetBody, bodyHeap,
+                    hbaseBody, hbodyValue⟩ :=
+                  smaller.runCode current store base arguments.reverse
+                    hargumentValues.reverse current.body bodyOut hbody
+                rcases bodyOut with ⟨bodyStore, bodyValue⟩
+                rcases targetBodyOut with
+                  ⟨targetBodyStore, targetBodyValue⟩
+                have htargetWorld := checkResultWorld_historyIso bodyHeap
+                  hbodyValue current.result hrun
+                refine ⟨(targetBodyStore, targetBodyValue), ?_, bodyHeap,
+                  hbaseBody, hbodyValue⟩
+                simp [harity, htargetBody]
+                simpa only [bind, Except.bind] using htargetWorld
+          · have harityBool : (arguments.length != current.arity) = true := by
+              simpa using harity
+            simp [harityBool] at hrun
+  | papp function atoms =>
+      rw [runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases harguments : resolveAtoms values atoms with
+      | error error =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok arguments =>
+          rw [harguments] at hrun
+          simp only [bind, Except.bind] at hrun ⊢
+          cases hdeclaration : before.decls function with
+          | none => simp [hdeclaration] at hrun
+          | some declaration =>
+              obtain ⟨targetDeclaration, htargetDeclaration, harity, _⟩ :=
+                abstract.declaration hdeclaration
+              simp only [hdeclaration] at hrun
+              simp only [htargetDeclaration]
+              by_cases hless : arguments.length < declArity declaration
+              · have htargetLess :
+                    arguments.length < declArity targetDeclaration := by
+                  rw [harity]
+                  exact hless
+                obtain ⟨selfOut, hselfRun, hiso⟩ :=
+                  runOp_historyIso base hvalues hsourceRun
+                have hout : selfOut = sourceOut :=
+                  Except.ok.inj (hselfRun.symm.trans hsourceRun)
+                subst selfOut
+                refine ⟨sourceOut, ?_, hiso⟩
+                simp only [hless, if_true, Except.ok.injEq] at hrun
+                simpa [harity, hless] using
+                  congrArg (fun output =>
+                    (Except.ok output : Except Err (Store × RVal))) hrun
+              · simp [hless] at hrun
+  | apply function arguments =>
+      rw [runOp.eq_def] at hrun ⊢
+      dsimp only at hrun ⊢
+      cases hfunction : resolveAtom values function with
+      | error error =>
+          rw [hfunction] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok functionValue =>
+          rw [hfunction] at hrun
+          simp only [bind, Except.bind] at hrun ⊢
+          cases harguments : resolveAtoms values arguments with
+          | error error =>
+              rw [harguments] at hrun
+              simp only [bind, Except.bind] at hrun
+              contradiction
+          | ok argumentValues =>
+              rw [harguments] at hrun
+              simp only [bind, Except.bind] at hrun ⊢
+              exact smaller.applyGo store base functionValue argumentValues
+                (resolveAtom_selfIso hvalues hfunction)
+                (resolveAtoms_selfIso hvalues harguments) sourceOut hrun
+  | extern function arguments =>
+      simpa [runOp, callScalarOracle, abstract.oracle_eq] using
+        (runOp_historyIso base hvalues hrun)
+
+private theorem invoke_rewriteStep
+    {before after : Ctx} (abstract : AbstractEnvironment before after)
+    {fuel : Nat} (smaller : EvalRewriteAt before after fuel) :
+    ∀ (function : Address) (arguments : List RVal) (store : Store)
+      (base : HeapHistoryIso store store),
+    RValsIso base.locRel arguments arguments →
+    ∀ (sourceOut : Store × RVal),
+      IxIR1.invoke before (fuel + 1) function arguments store =
+          .ok sourceOut →
+      ∃ targetOut,
+        IxIR1.invoke after (fuel + 1) function arguments store =
+            .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut := by
+  intro function arguments store base harguments sourceOut hrun
+  have hsourceRun := hrun
+  rw [IxIR1.invoke.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hdeclaration : before.decls function with
+  | none => simp [hdeclaration] at hrun
+  | some declaration =>
+      cases declaration with
+      | extern arity =>
+          have htargetDeclaration := abstract.extern hdeclaration
+          simp only [hdeclaration] at hrun
+          simp only [htargetDeclaration]
+          obtain ⟨selfOut, hselfRun, hiso⟩ :=
+            invoke_historyIso base harguments hsourceRun
+          have hout : selfOut = sourceOut :=
+            Except.ok.inj (hselfRun.symm.trans hsourceRun)
+          subst selfOut
+          refine ⟨sourceOut, ?_, hiso⟩
+          simpa [callScalarOracle, abstract.oracle_eq] using hrun
+      | fn source =>
+          obtain ⟨target, htargetDeclaration, harity, hresult, _,
+              hbodyRefines⟩ := abstract.function hdeclaration
+          simp only [hdeclaration] at hrun
+          simp only [htargetDeclaration]
+          by_cases hsame : arguments.length = source.arity
+          · have htargetSame : arguments.length = target.arity := by
+              rw [harity]
+              exact hsame
+            simp [hsame] at hrun
+            cases hbody : runCode before fuel source store arguments.reverse
+                source.body with
+            | error error =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                contradiction
+            | ok bodyOut =>
+                rw [hbody] at hrun
+                simp only [bind, Except.bind] at hrun
+                have hout := (checkResultWorld_ok hrun).1
+                subst sourceOut
+                let self := base.trans base.symm
+                have hselfArguments : RValsIso self.locRel
+                    arguments.reverse arguments.reverse := by
+                  exact (harguments.trans harguments.symm).reverse
+                obtain ⟨localOut, hlocalRun, hlocalIso⟩ :=
+                  hbodyRefines self (by simpa using hsame)
+                    hselfArguments hbody
+                obtain ⟨targetOut, htargetBody, hctxIso⟩ :=
+                  smaller.runCode target store base arguments.reverse
+                    harguments.reverse target.body localOut hlocalRun
+                have hbodyIso : RunHistoryIso base bodyOut targetOut :=
+                  RunHistoryIso.weaken (selfLeft_compose_extends base)
+                    (hlocalIso.trans hctxIso)
+                rcases bodyOut with ⟨bodyStore, bodyValue⟩
+                rcases targetOut with ⟨targetStore, targetValue⟩
+                obtain ⟨finalHeap, hbaseFinal, hvalue⟩ := hbodyIso
+                have htargetWorld := checkResultWorld_historyIso finalHeap
+                  hvalue source.result hrun
+                refine ⟨(targetStore, targetValue), ?_, finalHeap,
+                  hbaseFinal, hvalue⟩
+                simp [htargetSame, htargetBody, hresult]
+                simpa only [bind, Except.bind] using htargetWorld
+          · have htargetDifferent : arguments.length ≠ target.arity := by
+              intro heq
+              exact hsame (heq.trans harity)
+            simp [hsame] at hrun
+
+private theorem applyGo_rewriteStep
+    {before after : Ctx} {fuel : Nat}
+    (abstract : AbstractEnvironment before after)
+    (smaller : EvalRewriteAt before after fuel) :
+    ∀ (store : Store) (base : HeapHistoryIso store store)
+      (function : RVal) (arguments : List RVal),
+    RValIso base.locRel function function →
+    RValsIso base.locRel arguments arguments →
+    ∀ (sourceOut : Store × RVal),
+      IxIR1.applyGo before (fuel + 1) store function arguments =
+          .ok sourceOut →
+      ∃ targetOut,
+        IxIR1.applyGo after (fuel + 1) store function arguments =
+            .ok targetOut ∧
+          RunHistoryIso base sourceOut targetOut := by
+  intro store base function arguments hfunction harguments sourceOut hrun
+  have hsourceRun := hrun
+  let drops := dropCtxEqAt before after fuel
+  rw [IxIR1.applyGo.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases function with
+  | lit literal => simp at hrun
+  | erased =>
+      cases hdrop : dropMany before fuel store arguments with
+      | error error =>
+          rw [hdrop] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok next =>
+          rw [hdrop] at hrun
+          simp only [bind, Except.bind, Except.ok.injEq] at hrun
+          subst sourceOut
+          rw [drops.dropMany store arguments, hdrop]
+          obtain ⟨selfOut, hselfRun, hiso⟩ :=
+            applyGo_historyIso base hfunction harguments hsourceRun
+          have hselfOut : selfOut = (next, .erased) :=
+            Except.ok.inj (hselfRun.symm.trans hsourceRun)
+          subst selfOut
+          exact ⟨(next, .erased), rfl, hiso⟩
+  | loc location =>
+      cases hbox : store.get? location with
+      | none => simp [hbox] at hrun
+      | some box =>
+          simp only [hbox] at hrun ⊢
+          cases hnode : box.node with
+          | ctorN identity fields => simp [hnode] at hrun
+          | papN called arity captured =>
+              rw [hnode] at hrun
+              dsimp only at hrun ⊢
+              cases hfunction with
+              | @loc _ _ hrel =>
+                  obtain ⟨rightBox, hrightBox, hboxIso⟩ :=
+                    base.boxes hrel hbox
+                  have hrightBoxEq : rightBox = box := by
+                    exact Option.some.inj (hrightBox.symm.trans hbox)
+                  subst rightBox
+                  have hcaptured : RValsIso base.locRel
+                      captured.toList captured.toList := by
+                    have hnodeIso : NodeIso base.locRel box.node box.node :=
+                      hboxIso.node
+                    rw [hnode] at hnodeIso
+                    cases hnodeIso with
+                    | pap hcaptured => exact hcaptured
+                  cases hdup : dupVals store captured.toList with
+                  | error error =>
+                      rw [hdup] at hrun
+                      simp only [bind, Except.bind] at hrun
+                      contradiction
+                  | ok duplicated =>
+                      rw [hdup] at hrun
+                      simp only [bind, Except.bind] at hrun ⊢
+                      obtain ⟨duplicatedRight, hrightDup, duplicateHeap,
+                          hbaseDuplicate⟩ :=
+                        dupVals_historyIso base hcaptured hdup
+                      have hduplicated : duplicatedRight = duplicated :=
+                        Except.ok.inj (hrightDup.symm.trans hdup)
+                      subst duplicatedRight
+                      rw [drops.dropVal duplicated (.loc location)]
+                      cases hdrop : dropVal before fuel duplicated
+                          (.loc location) with
+                      | error error =>
+                          rw [hdrop] at hrun
+                          simp only [bind, Except.bind] at hrun
+                          contradiction
+                      | ok ready =>
+                          rw [hdrop] at hrun
+                          simp only [bind, Except.bind] at hrun ⊢
+                          obtain ⟨readyRight, hrightDrop, readyHeap,
+                              hduplicateReady⟩ :=
+                            dropVal_historyIso duplicateHeap
+                              (hbaseDuplicate.rval (.loc hrel)) hdrop
+                          have hready : readyRight = ready :=
+                            Except.ok.inj (hrightDrop.symm.trans hdrop)
+                          subst readyRight
+                          let hbaseReady : base.Extends readyHeap :=
+                            hbaseDuplicate.trans hduplicateReady
+                          let total := captured.toList ++ arguments
+                          have htotal : RValsIso readyHeap.locRel total total :=
+                            (hbaseReady.rvals hcaptured).append
+                              (hbaseReady.rvals harguments)
+                          by_cases hunder : total.length < arity
+                          · have hunderRaw :
+                                (captured.toList ++ arguments).length <
+                                  arity := by
+                              simpa [total] using hunder
+                            have hunderSize :
+                                captured.size + arguments.length < arity := by
+                              simpa [total] using hunder
+                            simp only [hunderRaw, if_true,
+                              Except.ok.injEq] at hrun
+                            subst sourceOut
+                            let next := readyHeap.alloc (world := .shared)
+                              (leftNode := .papN called arity total.toArray)
+                              (rightNode := .papN called arity total.toArray)
+                              (.pap (by simpa [total] using htotal))
+                            have hreadyNext : readyHeap.Extends next := by
+                              intro leftLoc rightLoc hknown
+                              exact .inr hknown
+                            have hfresh : RValIso next.locRel
+                                (.loc ready.nodes.size)
+                                (.loc ready.nodes.size) := by
+                              exact .loc (.inl ⟨rfl, rfl⟩)
+                            let allocated := ready.allocNode .shared
+                              (.papN called arity total.toArray)
+                            refine ⟨(allocated.1, .loc allocated.2), ?_, next,
+                              hbaseReady.trans hreadyNext, ?_⟩
+                            · simpa [total, allocated, hunderSize]
+                            · simpa [allocated, Store.allocNode] using hfresh
+                          · by_cases hexact : total.length = arity
+                            · have hunderRaw :
+                                  ¬(captured.toList ++ arguments).length <
+                                    arity := by
+                                simpa [total] using hunder
+                              have hexactRaw :
+                                  (captured.toList ++ arguments).length =
+                                    arity := by
+                                simpa [total] using hexact
+                              obtain ⟨sourceDeclaration, targetDeclaration,
+                                  hsourceDeclaration, htargetDeclaration,
+                                  hpapsafe, hsourceSafe⟩ :
+                                  ∃ sourceDeclaration targetDeclaration,
+                                    before.decls called = some sourceDeclaration ∧
+                                      after.decls called = some targetDeclaration ∧
+                                      declPapSafe targetDeclaration =
+                                        declPapSafe sourceDeclaration ∧
+                                      declPapSafe sourceDeclaration = true := by
+                                cases hsourceDeclaration : before.decls called with
+                                | none =>
+                                    simp [hunderRaw, hexactRaw,
+                                      hsourceDeclaration] at hrun
+                                | some sourceDeclaration =>
+                                    obtain ⟨targetDeclaration,
+                                        htargetDeclaration, _, hpapsafe⟩ :=
+                                      abstract.declaration hsourceDeclaration
+                                    cases hsourceSafe :
+                                        declPapSafe sourceDeclaration with
+                                    | false =>
+                                        simp [hunderRaw, hexactRaw,
+                                          hsourceDeclaration, hsourceSafe]
+                                          at hrun
+                                    | true =>
+                                        exact ⟨sourceDeclaration,
+                                          targetDeclaration, rfl,
+                                          htargetDeclaration, hpapsafe,
+                                          hsourceSafe⟩
+                              have htargetSafe :
+                                  declPapSafe targetDeclaration = true :=
+                                hpapsafe.trans hsourceSafe
+                              simp [hunderRaw, hexactRaw, hsourceDeclaration,
+                                hsourceSafe] at hrun
+                              obtain ⟨targetOut, htargetInvoke, hiso⟩ :=
+                                smaller.invoke called total ready readyHeap
+                                  htotal sourceOut (by simpa [total] using hrun)
+                              refine ⟨targetOut, ?_,
+                                RunHistoryIso.weaken hbaseReady hiso⟩
+                              simpa [total, hunderRaw, hexactRaw,
+                                htargetDeclaration, htargetSafe] using htargetInvoke
+                            · have hunderRaw :
+                                  ¬(captured.toList ++ arguments).length <
+                                    arity := by
+                                simpa [total] using hunder
+                              have hexactRaw :
+                                  (captured.toList ++ arguments).length ≠
+                                    arity := by
+                                simpa [total] using hexact
+                              have hunderSize :
+                                  ¬captured.size + arguments.length <
+                                    arity := by
+                                simpa [total] using hunder
+                              have hexactSize :
+                                  captured.size + arguments.length ≠
+                                    arity := by
+                                simpa [total] using hexact
+                              obtain ⟨sourceDeclaration, targetDeclaration,
+                                  hsourceDeclaration, htargetDeclaration,
+                                  hpapsafe, hsourceSafe⟩ :
+                                  ∃ sourceDeclaration targetDeclaration,
+                                    before.decls called = some sourceDeclaration ∧
+                                      after.decls called = some targetDeclaration ∧
+                                      declPapSafe targetDeclaration =
+                                        declPapSafe sourceDeclaration ∧
+                                      declPapSafe sourceDeclaration = true := by
+                                cases hsourceDeclaration : before.decls called with
+                                | none =>
+                                    simp [hunderSize, hexactSize,
+                                      hsourceDeclaration] at hrun
+                                | some sourceDeclaration =>
+                                    obtain ⟨targetDeclaration,
+                                        htargetDeclaration, _, hpapsafe⟩ :=
+                                      abstract.declaration hsourceDeclaration
+                                    cases hsourceSafe :
+                                        declPapSafe sourceDeclaration with
+                                    | false =>
+                                        simp [hunderSize, hexactSize,
+                                          hsourceDeclaration, hsourceSafe]
+                                          at hrun
+                                    | true =>
+                                        exact ⟨sourceDeclaration,
+                                          targetDeclaration, rfl,
+                                          htargetDeclaration, hpapsafe,
+                                          hsourceSafe⟩
+                              have htargetSafe :
+                                  declPapSafe targetDeclaration = true :=
+                                hpapsafe.trans hsourceSafe
+                              simp [hunderSize, hexactSize, hsourceDeclaration,
+                                hsourceSafe] at hrun
+                              cases hinvoke : IxIR1.invoke before fuel called
+                                  (total.take arity) ready with
+                              | error error =>
+                                  rw [hinvoke] at hrun
+                                  simp only [bind, Except.bind] at hrun
+                                  contradiction
+                              | ok calledOut =>
+                                  rcases calledOut with
+                                    ⟨calledStore, calledValue⟩
+                                  rw [hinvoke] at hrun
+                                  simp only [bind, Except.bind] at hrun
+                                  obtain ⟨targetCalledOut, htargetInvoke,
+                                      callHeap, hreadyCall, hcalledValue⟩ :=
+                                    smaller.invoke called (total.take arity)
+                                      ready readyHeap (htotal.take arity)
+                                      (calledStore, calledValue) hinvoke
+                                  rcases targetCalledOut with
+                                    ⟨targetCalledStore, targetCalledValue⟩
+                                  obtain ⟨targetOut, htargetApply, hiso⟩ :=
+                                    applyGo_crossOfSame smaller callHeap
+                                      hcalledValue
+                                      (hreadyCall.rvals (htotal.drop arity))
+                                      (by simpa [total] using hrun)
+                                  refine ⟨targetOut, ?_,
+                                    RunHistoryIso.weaken
+                                      (hbaseReady.trans hreadyCall) hiso⟩
+                                  simp [hunderSize, hexactSize,
+                                    htargetDeclaration, htargetSafe]
+                                  rw [htargetInvoke]
+                                  simp only [bind, Except.bind]
+                                  exact htargetApply
+
+private theorem evalRewriteAt {before after : Ctx}
+    (abstract : AbstractEnvironment before after) :
+    ∀ fuel, EvalRewriteAt before after fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [runCode, runOp, IxIR1.invoke, IxIR1.applyGo] at *
+  | succ fuel smaller =>
+      exact ⟨runCode_rewriteStep smaller,
+        runOp_rewriteStep abstract smaller,
+        invoke_rewriteStep abstract smaller,
+        applyGo_rewriteStep abstract smaller⟩
+
+/-- A successful run in the source context is reproduced in any abstractly
+related target environment.  The theorem accepts arbitrary related entry
+stores and environments; no closure or canonical-location assumption is
+required. -/
+theorem runCode_abstractEnvironment
+    {before after : Ctx} (abstract : AbstractEnvironment before after)
+    {fuel : Nat} {current : FnDef} {left right : Store}
+    (heap : HeapHistoryIso left right)
+    {leftEnvironment rightEnvironment : List RVal}
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    {input : Code} {sourceOut : Store × RVal}
+    (hrun : runCode before fuel current left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode after fuel current right rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut :=
+  runCode_crossOfSame (evalRewriteAt abstract fuel) heap henvironments hrun
+
+/-- Dynamic application form of `runCode_abstractEnvironment`. -/
+theorem applyGo_abstractEnvironment
+    {before after : Ctx} (abstract : AbstractEnvironment before after)
+    {fuel : Nat} {left right : Store}
+    (heap : HeapHistoryIso left right)
+    {leftFunction rightFunction : RVal}
+    {leftArguments rightArguments : List RVal}
+    (hfunction : RValIso heap.locRel leftFunction rightFunction)
+    (harguments : RValsIso heap.locRel leftArguments rightArguments)
+    {sourceOut : Store × RVal}
+    (hrun : IxIR1.applyGo before fuel left leftFunction leftArguments =
+      .ok sourceOut) :
+    ∃ targetOut,
+      IxIR1.applyGo after fuel right rightFunction rightArguments =
+          .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut :=
+  applyGo_crossOfSame (evalRewriteAt abstract fuel) heap hfunction harguments
+    hrun
+
+/-! ## Exact declaration-environment replacement -/
+
+private theorem runCode_case_exactEnvironment_eq
+    {before after : Ctx} {fuel : Nat}
+    (ih : ∀ (current : FnDef) (store : Store)
+      (environment : List RVal) (input : Code),
+      runCode after fuel current store environment input =
+        runCode before fuel current store environment input)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt) :
+    runCode after (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) =
+      runCode before (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  simp only [runCode]
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error => simp [bind, Except.bind]
+  | ok value =>
+      simp only [bind, Except.bind]
+      cases value with
+      | erased => simp
+      | lit literal =>
+          cases literal with
+          | str value => simp
+          | nat value =>
+              simp only
+              cases peelNat with
+              | false => simp
+              | true =>
+                  simp only
+                  cases value with
+                  | zero =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  simpa using
+                                    ih current store environment body
+                              | succ fields => simp
+                  | succ value =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => simp
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      simpa using ih current store
+                                        (.lit (.nat value) :: environment)
+                                        body
+                                  | succ fields => simp
+      | loc location =>
+          simp only
+          cases hget : store.get? location with
+          | none => simp
+          | some box =>
+              simp only
+              cases hnode : box.node with
+              | papN function arity arguments => simp
+              | ctorN identity fields =>
+                  simp only
+                  cases hfind : alternatives.find?
+                      (fun alternative =>
+                        alternative.cidx == identity.cidx) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          by_cases hfields : fields.size = fieldCount
+                          · simpa [hfields] using
+                              ih current store
+                                (fields.foldl
+                                  (fun result field => field :: result)
+                                  environment) body
+                          · simp [hfields]
+
+private structure ExactRewriteAt (before after : Ctx) (fuel : Nat) : Prop where
+  runCode : ∀ (current : FnDef) (store : Store)
+      (environment : List RVal) (input : Code),
+    runCode after fuel current store environment input =
+      runCode before fuel current store environment input
+  runOp : ∀ (current : FnDef) (store : Store)
+      (environment : List RVal) (operation : Op),
+    runOp after fuel current store environment operation =
+      runOp before fuel current store environment operation
+  invoke : ∀ (function : Address) (arguments : List RVal) (store : Store),
+    IxIR1.invoke after fuel function arguments store =
+      IxIR1.invoke before fuel function arguments store
+  applyGo : ∀ (store : Store) (function : RVal) (arguments : List RVal),
+    IxIR1.applyGo after fuel store function arguments =
+      IxIR1.applyGo before fuel store function arguments
+  dropVal : ∀ (store : Store) (value : RVal),
+    IxIR1.dropVal after fuel store value =
+      IxIR1.dropVal before fuel store value
+  dropMany : ∀ (store : Store) (values : List RVal),
+    IxIR1.dropMany after fuel store values =
+      IxIR1.dropMany before fuel store values
+  dropUVal : ∀ (store : Store) (value : RVal),
+    IxIR1.dropUVal after fuel store value =
+      IxIR1.dropUVal before fuel store value
+  dropManyU : ∀ (store : Store) (values : List RVal),
+    IxIR1.dropManyU after fuel store values =
+      IxIR1.dropManyU before fuel store values
+
+private theorem exactRewriteAt {before after : Ctx}
+    (exact : ExactEnvironment before after) :
+    ∀ fuel, ExactRewriteAt before after fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [runCode, runOp, IxIR1.invoke, IxIR1.applyGo,
+          IxIR1.dropVal, IxIR1.dropMany, IxIR1.dropUVal,
+          IxIR1.dropManyU]
+  | succ fuel smaller =>
+      refine {
+        runCode := ?_
+        runOp := ?_
+        invoke := ?_
+        applyGo := ?_
+        dropVal := ?_
+        dropMany := ?_
+        dropUVal := ?_
+        dropManyU := ?_ }
+      · intro current store environment input
+        cases input with
+        | ret atom => simp [runCode]
+        | letOp operation rest =>
+            simp only [runCode]
+            rw [smaller.runOp current store environment operation]
+            cases hoperation : runOp before fuel current store environment
+                operation with
+            | error error => rfl
+            | ok output =>
+                rcases output with ⟨next, value⟩
+                exact smaller.runCode current next (value :: environment) rest
+        | case scrutinee peelNat alternatives =>
+            exact runCode_case_exactEnvironment_eq smaller.runCode current
+              store environment scrutinee peelNat alternatives
+      · intro current store environment operation
+        cases operation with
+        | pure atom => simp [runOp]
+        | alloc world identity arguments => simp [runOp]
+        | reuse target identity arguments => simp [runOp]
+        | free target => simp [runOp]
+        | dup target => simp [runOp]
+        | drop target =>
+            simp only [runOp]
+            cases htarget : resolveAtom environment target with
+            | error error => simp [bind, Except.bind]
+            | ok value =>
+                simp only [bind, Except.bind]
+                cases value with
+                | lit literal => rfl
+                | erased => rfl
+                | loc location =>
+                    change (do
+                        let next ← IxIR1.dropVal after fuel store
+                          (.loc location)
+                        .ok (next, RVal.erased)) =
+                      (do
+                        let next ← IxIR1.dropVal before fuel store
+                          (.loc location)
+                        .ok (next, RVal.erased))
+                    rw [smaller.dropVal store (.loc location)]
+        | dropU target =>
+            simp only [runOp]
+            cases htarget : resolveAtom environment target with
+            | error error => simp [bind, Except.bind]
+            | ok value =>
+                simp only [bind, Except.bind]
+                cases value with
+                | lit literal => rfl
+                | erased => rfl
+                | loc location =>
+                    change (do
+                        let next ← IxIR1.dropUVal after fuel store
+                          (.loc location)
+                        .ok (next, RVal.erased)) =
+                      (do
+                        let next ← IxIR1.dropUVal before fuel store
+                          (.loc location)
+                        .ok (next, RVal.erased))
+                    rw [smaller.dropUVal store (.loc location)]
+        | fetch target field => simp [runOp]
+        | call function atoms =>
+            simp only [runOp]
+            cases harguments : resolveAtoms environment atoms with
+            | error error => rfl
+            | ok arguments => exact smaller.invoke function arguments store
+        | callSelf atoms =>
+            simp only [runOp]
+            cases harguments : resolveAtoms environment atoms with
+            | error error => simp [bind, Except.bind]
+            | ok arguments =>
+                simp only [bind, Except.bind]
+                by_cases harity : arguments.length = current.arity
+                · simp only [harity]
+                  rw [smaller.runCode current store arguments.reverse
+                    current.body]
+                · simp [harity]
+        | papp function atoms =>
+            simp only [runOp]
+            cases harguments : resolveAtoms environment atoms with
+            | error error => simp [bind, Except.bind]
+            | ok arguments =>
+                simp only [bind, Except.bind]
+                cases hsource : before.decls function with
+                | none =>
+                    have htarget := exact.missing hsource
+                    simp [htarget]
+                | some declaration =>
+                    cases declaration with
+                    | extern arity =>
+                        have htarget := exact.extern hsource
+                        simp [htarget]
+                    | fn source =>
+                        obtain ⟨target, htarget, harity, _, _, _⟩ :=
+                          exact.function hsource
+                        rw [htarget]
+                        simp only [declArity]
+                        simp [harity]
+                        rfl
+        | apply function atoms =>
+            simp only [runOp]
+            cases hfunction : resolveAtom environment function with
+            | error error => rfl
+            | ok value =>
+                cases harguments : resolveAtoms environment atoms with
+                | error error => rfl
+                | ok arguments => exact smaller.applyGo store value arguments
+        | extern function atoms =>
+            simp [runOp, callScalarOracle, exact.oracle_eq]
+      · intro function arguments store
+        simp only [IxIR1.invoke]
+        cases hsource : before.decls function with
+        | none =>
+            have htarget := exact.missing hsource
+            simp [htarget]
+        | some declaration =>
+            cases declaration with
+            | extern arity =>
+                have htarget := exact.extern hsource
+                simp [htarget, callScalarOracle, exact.oracle_eq]
+            | fn source =>
+                obtain ⟨target, htarget, harity, hresult, _, hbody⟩ :=
+                  exact.function hsource
+                by_cases hsourceArity : arguments.length = source.arity
+                · have htargetArity : arguments.length = target.arity := by
+                    rw [harity]
+                    exact hsourceArity
+                  have hsourceArityBool :
+                      (arguments.length != source.arity) = false := by
+                    simp [hsourceArity]
+                  have htargetArityBool :
+                      (arguments.length != target.arity) = false := by
+                    simp [htargetArity]
+                  have hcombined :
+                      runCode after fuel target store arguments.reverse
+                          target.body =
+                        runCode before fuel source store arguments.reverse
+                          source.body :=
+                    (smaller.runCode target store arguments.reverse
+                      target.body).trans
+                        (hbody (by simpa using hsourceArity))
+                  have hchecked := congrArg
+                    (fun output => output >>= checkResultWorld source.result)
+                    hcombined
+                  simpa only [hsource, htarget, hsourceArityBool,
+                    htargetArityBool, Bool.false_eq_true, if_false, hresult]
+                    using hchecked
+                · have htargetArity :
+                      arguments.length ≠ target.arity := by
+                    rwa [harity]
+                  simp [htarget, hsourceArity, htargetArity]
+      · intro store function arguments
+        cases function with
+        | lit literal => simp [IxIR1.applyGo]
+        | erased =>
+            simp only [IxIR1.applyGo]
+            rw [smaller.dropMany store arguments]
+        | loc location =>
+            simp only [IxIR1.applyGo]
+            cases hbox : store.get? location with
+            | none => simp
+            | some box =>
+                simp only
+                cases hnode : box.node with
+                | ctorN identity fields => simp
+                | papN called arity captured =>
+                    simp only
+                    cases hdup : dupVals store captured.toList with
+                    | error error => simp [bind, Except.bind]
+                    | ok duplicated =>
+                        simp only [bind, Except.bind]
+                        rw [smaller.dropVal duplicated (.loc location)]
+                        cases hdrop : IxIR1.dropVal before fuel duplicated
+                            (.loc location) with
+                        | error error => rfl
+                        | ok dropped =>
+                            let total := captured.toList ++ arguments
+                            by_cases hless : total.length < arity
+                            · have hlessSize :
+                                  captured.size + arguments.length < arity := by
+                                simpa [total] using hless
+                              simp [hlessSize]
+                            · by_cases hequal : total.length = arity
+                              · have hunderSize :
+                                    ¬captured.size + arguments.length < arity := by
+                                  simpa [total] using hless
+                                have hequalSize :
+                                    captured.size + arguments.length = arity := by
+                                  simpa [total] using hequal
+                                cases hsource : before.decls called with
+                                | none =>
+                                    have htarget := exact.missing hsource
+                                    simp [hunderSize, hequalSize, hsource, htarget]
+                                | some declaration =>
+                                    cases declaration with
+                                    | extern declarationArity =>
+                                        have htarget := exact.extern hsource
+                                        simp [hunderSize, hequalSize, hsource,
+                                          htarget, smaller.invoke]
+                                    | fn source =>
+                                        obtain ⟨target, htarget, _, _, hpapsafe,
+                                            _⟩ := exact.function hsource
+                                        simp [hunderSize, hequalSize, hsource,
+                                          htarget, declPapSafe, hpapsafe,
+                                          smaller.invoke]
+                                        rfl
+                              · have hunderSize :
+                                    ¬captured.size + arguments.length < arity := by
+                                  simpa [total] using hless
+                                have hnequalSize :
+                                    captured.size + arguments.length ≠ arity := by
+                                  simpa [total] using hequal
+                                cases hsource : before.decls called with
+                                | none =>
+                                    have htarget := exact.missing hsource
+                                    simp [hunderSize, hnequalSize, hsource,
+                                      htarget]
+                                | some declaration =>
+                                    cases declaration with
+                                    | extern declarationArity =>
+                                        have htarget := exact.extern hsource
+                                        simp [hunderSize, hnequalSize, hsource,
+                                          htarget, smaller.invoke, smaller.applyGo]
+                                    | fn source =>
+                                        obtain ⟨target, htarget, _, _, hpapsafe,
+                                            _⟩ := exact.function hsource
+                                        simp [hunderSize, hnequalSize, hsource,
+                                          htarget, declPapSafe, hpapsafe,
+                                          smaller.invoke, smaller.applyGo]
+                                        rfl
+      · intro store value
+        cases value with
+        | lit literal => simp [IxIR1.dropVal]
+        | erased => simp [IxIR1.dropVal]
+        | loc location =>
+            simp only [IxIR1.dropVal]
+            cases hbox : store.get? location with
+            | none => simp
+            | some box =>
+                simp only
+                cases hworld : box.world with
+                | unique => simp
+                | shared =>
+                    simp only
+                    by_cases hone : box.rc == 1
+                    · simp only [hone, ↓reduceIte]
+                      cases hnode : box.node with
+                      | ctorN identity fields =>
+                          simpa [hnode] using smaller.dropMany
+                            (store.rcTick.kill location) fields.toList
+                      | papN function arity arguments =>
+                          simpa [hnode] using smaller.dropMany
+                            (store.rcTick.kill location) arguments.toList
+                    · simp [hone]
+      · intro store values
+        cases values with
+        | nil => simp [IxIR1.dropMany]
+        | cons value rest =>
+            simp only [IxIR1.dropMany]
+            rw [smaller.dropVal store value]
+            cases hdrop : IxIR1.dropVal before fuel store value with
+            | error error => rfl
+            | ok next => exact smaller.dropMany next rest
+      · intro store value
+        cases value with
+        | lit literal => simp [IxIR1.dropUVal]
+        | erased => simp [IxIR1.dropUVal]
+        | loc location =>
+            simp only [IxIR1.dropUVal]
+            cases hbox : store.get? location with
+            | none => simp
+            | some box =>
+                simp only
+                cases hworld : box.world with
+                | shared => simp
+                | unique =>
+                    simp only
+                    cases hnode : box.node with
+                    | ctorN identity fields =>
+                        simpa [hnode] using smaller.dropManyU
+                          (store.kill location) fields.toList
+                    | papN function arity arguments => simp
+      · intro store values
+        cases values with
+        | nil => simp [IxIR1.dropManyU]
+        | cons value rest =>
+            simp only [IxIR1.dropManyU]
+            rw [smaller.dropUVal store value]
+            cases hdrop : IxIR1.dropUVal before fuel store value with
+            | error error => rfl
+            | ok next => exact smaller.dropManyU next rest
+
+/-- Exact declaration replacement preserves the complete evaluator result for
+arbitrary surrounding code and dynamic current frames. -/
+theorem runCode_exactEnvironment_eq
+    {before after : Ctx} (exact : ExactEnvironment before after)
+    {fuel : Nat} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} :
+    runCode after fuel current store environment input =
+      runCode before fuel current store environment input :=
+  (exactRewriteAt exact fuel).runCode current store environment input
+
+end Ix.Compiler.IxIR1.Sim
diff --git a/Ix/Compiler/IxIR1/Examples.lean b/Ix/Compiler/IxIR1/Examples.lean
new file mode 100644
index 000000000..0e2a831e3
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Examples.lean
@@ -0,0 +1,375 @@
+import Ix.Compiler.IxIR1.Eval
+
+/-!
+# Hand-written IxIR₁ programs
+
+The lowering targets, written by hand ahead of the lowering — exactly
+the discipline that worked for IxIR₀. Everything is pure, so the
+suite runs as elaboration-time `#guard`s, and the store counters turn
+the memory claims into checked facts:
+
+- **FBIP reversal**: reversing a unique 3-list performs 3 in-place
+  reuses, 1 free (the input's nil), and **zero allocations** beyond
+  building the inputs.
+- **Unique addition**: unary `add` consumes its recursion argument by
+  reuse — again no allocation beyond the inputs.
+- **Shared world**: Perceus-style deep drop reclaims a shared list to
+  `live = 0` (leak-freedom as a `#guard`); `dup` defers reclamation
+  exactly one drop.
+- **eval/apply**: pap under-fill, saturation, and over-fill chains.
+- **The dynamic discipline**: `dup`/`drop` on unique, `free` on
+  shared, and use-after-free all fault as `Err.mem`.
+-/
+
+namespace Ix.Compiler.IxIR1.Examples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR0 (Literal)
+
+private def addrOf (n : UInt8) : Address :=
+  Address.replicate n
+
+private def aListBlock := addrOf 0x60
+private def aNatBlock := addrOf 0x61
+private def aRev := addrOf 0x62
+private def aAdd := addrOf 0x63
+private def aAddLit := addrOf 0x64
+private def aIsZero := addrOf 0x65
+private def aKonstAdd := addrOf 0x66
+private def aNatAdd := addrOf 0x67
+private def aDirectOnly := addrOf 0x69
+
+private def nilId : CtorId := ⟨aListBlock, 0, 0⟩
+private def consId : CtorId := ⟨aListBlock, 0, 1⟩
+private def zeroId : CtorId := ⟨aNatBlock, 0, 0⟩
+private def succId : CtorId := ⟨aNatBlock, 0, 1⟩
+
+private def lets : List Op → Code → Code
+  | [], c => c
+  | op :: rest, c => .letOp op (lets rest c)
+
+/-- `rev (acc, xs)`: in-place list reversal. Entry env `[xs, acc]`. -/
+private def revBody : Code :=
+  .case (.var 0) false #[
+    -- nil: free the terminator, return acc
+    .mk 0 0 (lets [.free (.var 0)] (.ret (.var 2))),
+    -- cons(h, t): env [t, h, xs, acc]; reuse xs as cons(h, acc)
+    .mk 1 2 (lets
+      [ .reuse (.var 2) consId #[.var 1, .var 3],
+        .callSelf #[.var 0, .var 1] ]
+      (.ret (.var 0)))]
+
+/-- `add (m, n)`: unary addition, recursing and reusing on `n`.
+Entry env `[n, m]`. -/
+private def addBody : Code :=
+  .case (.var 0) false #[
+    -- zero: free it, return m
+    .mk 0 0 (lets [.free (.var 0)] (.ret (.var 2))),
+    -- succ(p): env [p, n, m]; r := add(m, p); reuse n as succ(r)
+    .mk 1 1 (lets
+      [ .callSelf #[.var 2, .var 0],
+        .reuse (.var 2) succId #[.var 0] ]
+      (.ret (.var 0)))]
+
+/-- `addLit (a, b)`: scalar addition through the extern oracle.
+Entry env `[b, a]`. -/
+private def addLitBody : Code :=
+  lets [.extern aNatAdd #[.var 1, .var 0]] (.ret (.var 0))
+
+/-- `isZero (x)`: nat-literal peeling. Entry env `[x]`. -/
+private def isZeroBody : Code :=
+  .case (.var 0) true #[
+    .mk 0 0 (.ret (.lit (.nat 1))),
+    .mk 1 1 (.ret (.lit (.nat 0)))]
+
+/-- `konstAdd (a)`: returns a pap — over-fill test material. -/
+private def konstAddBody : Code :=
+  lets [.papp aAddLit #[.var 0]] (.ret (.var 0))
+
+private def decls : List (Address × Decl) :=
+  [(aRev, .fn ⟨2, .unique, false, revBody⟩),
+   (aAdd, .fn ⟨2, .unique, false, addBody⟩),
+   (aAddLit, .fn ⟨2, .shared, true, addLitBody⟩),
+   (aIsZero, .fn ⟨1, .shared, true, isZeroBody⟩),
+   (aKonstAdd, .fn ⟨1, .shared, true, konstAddBody⟩),
+   (aDirectOnly, .fn ⟨1, .shared, false, .ret (.var 0)⟩),
+   (aNatAdd, .extern 2)]
+
+private def oracle : Address → List RVal → Option RVal := fun a args =>
+  if a == aNatAdd then
+    match args with
+    | [.lit (.nat m), .lit (.nat n)] => some (.lit (.nat (m + n)))
+    | _ => none
+  else none
+
+private def ctx : Ctx := { decls := Env.ofList decls, oracle }
+
+private def heapResultCtx : Ctx :=
+  { decls := Env.ofList decls, oracle := fun _ _ => some (.loc 0) }
+
+private def run (c : Code) : Except Err (Store × RVal) := runMain ctx c
+
+/-! ## Decoders and guard helpers -/
+
+private def natOf? (s : Store) : Nat → RVal → Option Nat
+  | 0, _ => none
+  | _, .lit (.nat n) => some n
+  | f + 1, .loc l =>
+    match s.get? l with
+    | some box =>
+      match box.node with
+      | .ctorN cid fields =>
+        match cid.cidx, fields.toList with
+        | 0, [] => some 0
+        | 1, [v] => (natOf? s f v).map (· + 1)
+        | _, _ => none
+      | _ => none
+    | none => none
+  | _, _ => none
+
+private def natsOf? (s : Store) : Nat → RVal → Option (List Nat)
+  | 0, _ => none
+  | f + 1, .loc l =>
+    match s.get? l with
+    | some box =>
+      match box.node with
+      | .ctorN cid fields =>
+        match cid.cidx, fields.toList with
+        | 0, [] => some []
+        | 1, [h, t] => do
+          let n ← natOf? s f h
+          let rest ← natsOf? s f t
+          pure (n :: rest)
+        | _, _ => none
+      | _ => none
+    | none => none
+  | _, _ => none
+
+private def checkRun (r : Except Err (Store × RVal))
+    (p : Store → RVal → Bool) : Bool :=
+  match r with
+  | .ok (s, v) => p s v
+  | .error _ => false
+
+private def errMem : Except Err (Store × RVal) → Bool
+  | .error (.mem _) => true
+  | _ => false
+
+private def errStuck : Except Err (Store × RVal) → Bool
+  | .error (.stuck _) => true
+  | _ => false
+
+/-! ## FBIP: reversal of a unique list allocates nothing -/
+
+private def revDemo : Code := lets
+  [ .alloc .unique nilId #[],
+    .alloc .unique consId #[.lit (.nat 3), .var 0],
+    .alloc .unique consId #[.lit (.nat 2), .var 0],
+    .alloc .unique consId #[.lit (.nat 1), .var 0],
+    .alloc .unique nilId #[],
+    .call aRev #[.var 0, .var 1] ]
+  (.ret (.var 0))
+
+#guard checkRun (run revDemo) fun s v =>
+  natsOf? s 1000 v == some [3, 2, 1]
+  && s.allocs == 5    -- 4 building the input + 1 accumulator nil
+  && s.reuses == 3    -- every cons flipped in place
+  && s.frees == 1     -- the input's nil terminator
+  && s.live == 4      -- exactly the result list
+
+/-! ## Unique unary addition: reuse along the recursion spine -/
+
+private def addDemo : Code := lets
+  [ .alloc .unique zeroId #[],
+    .alloc .unique succId #[.var 0],
+    .alloc .unique succId #[.var 0],          -- m = 2̂
+    .alloc .unique zeroId #[],
+    .alloc .unique succId #[.var 0],
+    .alloc .unique succId #[.var 0],
+    .alloc .unique succId #[.var 0],          -- n = 3̂
+    .call aAdd #[.var 4, .var 0] ]
+  (.ret (.var 0))
+
+#guard checkRun (run addDemo) fun s v =>
+  natOf? s 1000 v == some 5
+  && s.allocs == 7 && s.reuses == 3 && s.frees == 1 && s.live == 6
+
+/-! ## Shared world: deep drop is leak-free; dup defers it -/
+
+private def sharedDrop : Code := lets
+  [ .alloc .shared nilId #[],
+    .alloc .shared consId #[.lit (.nat 2), .var 0],
+    .alloc .shared consId #[.lit (.nat 1), .var 0],
+    .drop (.var 0) ]
+  (.ret .erased)
+
+#guard checkRun (run sharedDrop) fun s _ =>
+  s.live == 0 && s.frees == 3 && s.rcops == 3
+
+private def sharedDupDrop : Code := lets
+  [ .alloc .shared nilId #[],
+    .alloc .shared consId #[.lit (.nat 2), .var 0],
+    .alloc .shared consId #[.lit (.nat 1), .var 0],
+    .dup (.var 0),
+    .drop (.var 0),                            -- rc 2 → 1: still live
+    .drop (.var 1) ]                           -- rc 1 → 0: deep free
+  (.ret .erased)
+
+#guard checkRun (run sharedDupDrop) fun s _ =>
+  s.live == 0 && s.frees == 3 && s.rcops == 5
+
+-- After only the first drop, everything must still be live.
+private def sharedDupHold : Code := lets
+  [ .alloc .shared nilId #[],
+    .alloc .shared consId #[.lit (.nat 2), .var 0],
+    .alloc .shared consId #[.lit (.nat 1), .var 0],
+    .dup (.var 0),
+    .drop (.var 0) ]
+  (.ret (.var 1))
+
+#guard checkRun (run sharedDupHold) fun s v =>
+  s.live == 3 && natsOf? s 1000 v == some [1, 2]
+
+/-! ## eval/apply: under-fill, saturation, over-fill -/
+
+private def papDemo : Code := lets
+  [ .papp aAddLit #[.lit (.nat 20)],
+    .apply (.var 0) #[.lit (.nat 22)] ]
+  (.ret (.var 0))
+
+#guard checkRun (run papDemo) fun _ v => v == .lit (.nat 42)
+
+private def papChain : Code := lets
+  [ .papp aAddLit #[],
+    .apply (.var 0) #[.lit (.nat 20)],         -- under-fill: new pap
+    .apply (.var 0) #[.lit (.nat 22)] ]        -- saturates
+  (.ret (.var 0))
+
+#guard checkRun (run papChain) fun s v =>
+  v == .lit (.nat 42) && s.allocs == 2
+
+private def papOverfill : Code := lets
+  [ .papp aKonstAdd #[],
+    .apply (.var 0) #[.lit (.nat 20), .lit (.nat 22)] ]
+  (.ret (.var 0))
+
+#guard checkRun (run papOverfill) fun _ v => v == .lit (.nat 42)
+
+-- Direct entry remains available for declarations that do not opt into the
+-- shared PAP calling convention.
+#guard checkRun (run (lets
+  [.call aDirectOnly #[.lit (.nat 42)]] (.ret (.var 0)))) fun _ v =>
+    v == .lit (.nat 42)
+
+-- The same declaration cannot be entered through a saturated PAP.
+#guard
+  match run (lets
+      [.papp aDirectOnly #[], .apply (.var 0) #[.lit (.nat 42)]]
+      (.ret (.var 0))) with
+  | .error (.stuck "shared pap targets a non-pap-safe declaration") => true
+  | _ => false
+
+-- `apply` consumes its pap: the chain's intermediates are reclaimed
+-- without caller-side drops…
+#guard checkRun (run papChain) fun s _ => s.frees == 2 && s.live == 0
+
+-- …so re-applying a consumed pap is a memory fault…
+#guard errMem (run (lets
+  [ .papp aAddLit #[.lit (.nat 1)],
+    .apply (.var 0) #[.lit (.nat 2)],
+    .apply (.var 1) #[.lit (.nat 3)] ]
+  (.ret (.var 0))))
+
+-- …and `dup` is how a pap survives one application: rc 2 → 1 at the
+-- first apply, consumed for real at the second, leak-free overall.
+#guard checkRun (run (lets
+  [ .papp aAddLit #[.lit (.nat 1)],
+    .dup (.var 0),
+    .apply (.var 0) #[.lit (.nat 2)],
+    .apply (.var 2) #[.lit (.nat 3)] ]
+  (.ret (.var 0)))) fun s v => v == .lit (.nat 4) && s.live == 0
+
+/-! ## Nat-literal peeling -/
+
+#guard checkRun (run (lets [.call aIsZero #[.lit (.nat 0)]]
+  (.ret (.var 0)))) fun _ v => v == .lit (.nat 1)
+#guard checkRun (run (lets [.call aIsZero #[.lit (.nat 7)]]
+  (.ret (.var 0)))) fun _ v => v == .lit (.nat 0)
+#guard errStuck (run (.case (.lit (.nat 3)) false #[]))
+
+/-! ## `dropU`: deep free of a unique tree -/
+
+-- Three unique nodes reclaimed with zero refcount traffic.
+#guard checkRun (run (lets
+  [ .alloc .unique nilId #[],
+    .alloc .unique consId #[.lit (.nat 2), .var 0],
+    .alloc .unique consId #[.lit (.nat 1), .var 0],
+    .dropU (.var 0) ]
+  (.ret .erased))) fun s _ =>
+  s.live == 0 && s.frees == 3 && s.rcops == 0
+
+-- dropU demands the unique world…
+#guard errMem (run (lets
+  [.alloc .shared nilId #[], .dropU (.var 0)] (.ret .erased)))
+
+-- …and whole-value modes: a shared child under a unique node faults
+-- (symmetric to deep drop's unique-under-shared check).
+#guard errMem (run (lets
+  [ .alloc .shared nilId #[],
+    .alloc .unique consId #[.lit (.nat 1), .var 0],
+    .dropU (.var 0) ]
+  (.ret .erased)))
+
+/-! ## The dynamic memory discipline -/
+
+#guard errMem (run (lets
+  [.alloc .unique nilId #[], .dup (.var 0)] (.ret .erased)))
+#guard errMem (run (lets
+  [.alloc .unique nilId #[], .drop (.var 0)] (.ret .erased)))
+#guard errMem (run (lets
+  [.alloc .shared nilId #[], .free (.var 0)] (.ret .erased)))
+#guard errMem (run (lets
+  [.alloc .shared nilId #[], .reuse (.var 0) nilId #[]] (.ret .erased)))
+#guard errMem (run (lets
+  [.alloc .unique nilId #[], .free (.var 0), .fetch (.var 1) 0]
+  (.ret .erased)))
+#guard errMem (run (lets
+  [.alloc .unique nilId #[], .free (.var 0), .free (.var 1)]
+  (.ret .erased)))
+
+-- Function result signatures are checked at the dynamic call boundary too:
+-- malformed hand-written code cannot return a unique node as `.shared`.
+private def aBadResult := addrOf 0x68
+private def badResultCtx : Ctx :=
+  { decls := Env.ofList [(aBadResult, .fn ⟨0, .shared, false,
+      lets [.alloc .unique nilId #[]] (.ret (.var 0))⟩)] }
+
+#guard
+  match invoke badResultCtx 10 aBadResult [] {} with
+  | .error (.mem "function result ownership mismatch") => true
+  | _ => false
+
+-- Structural stuckness stays distinct from memory faults.
+#guard errStuck (run (.case .erased false #[]))
+#guard errStuck (run (lets
+  [.papp aAddLit #[.lit (.nat 1), .lit (.nat 2)]] (.ret .erased)))
+
+/-! Externs are a scalar-only ownership boundary in v1. A location may
+neither be passed to an oracle nor be manufactured by one. -/
+
+#guard errMem (run (lets
+  [ .alloc .shared nilId #[],
+    .extern aNatAdd #[.var 0, .lit (.nat 1)] ]
+  (.ret .erased)))
+
+#guard errMem (runMain heapResultCtx (lets
+  [ .alloc .shared nilId #[],
+    .extern aNatAdd #[.lit (.nat 1), .lit (.nat 2)] ]
+  (.ret .erased)))
+
+-- Fuel: self-application-free divergence via callSelf at top level.
+#guard (match runMain ctx (lets [.callSelf #[]] (.ret (.var 0))) 100 with
+  | .error .fuel => true
+  | _ => false)
+
+end Ix.Compiler.IxIR1.Examples
diff --git a/Ix/Compiler/IxIR1/HPT.lean b/Ix/Compiler/IxIR1/HPT.lean
new file mode 100644
index 000000000..842e6406f
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPT.lean
@@ -0,0 +1,1735 @@
+import Ix.Compiler.IxIR1.ReaddressAll
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.Ixon.Merkle
+
+/-!
+# Cached heap-points-to summary certificates for IxIR₁
+
+This module introduces the first analysis-certificate boundary over the
+content-addressed IxIR₁ program.  The untrusted input is a finite result-shape
+summary for every declaration.  The checker interprets each function once
+against the complete candidate environment and accepts only a post-fixpoint:
+the locally inferred result shapes must be contained in the claimed summary.
+
+The abstract domain distinguishes scalar results, constructor identities, and
+partial applications with an exact target and supplied-argument count.
+Constructor results may additionally carry finite recursive field facts:
+allocation records argument facts, fetch re-roots a selected subtree, and
+case alternatives recover the same refined binder facts. Function parameters
+begin at `top`, so accepted summaries are valid without a caller-specific
+precondition. Unknown dynamic heap values and identity-only constructor facts
+still widen on fetch. Explicit depth and total-payload limits keep untrusted
+trees finite before normalization, interpretation, or hashing.
+
+Checked summaries are materialized at the same SCC granularity as
+`ReaddressAll.Artifact`.  An ordinary summary cache key commits to the
+declaration address and the already-checked dependency-summary addresses; all
+members of a recursive SCC share one cache key committed to the mutual-block
+address.  Thus recursive analysis facts have a finite spelling, while changes
+outside a dependency cone do not perturb an unrelated cache key.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR
+
+/-! ## Abstract result and constructor-field shapes -/
+
+private def compareNat (left right : Nat) : Ordering :=
+  compare left right
+
+private def compareBool : Bool → Bool → Ordering
+  | false, false | true, true => .eq
+  | false, true => .lt
+  | true, false => .gt
+
+private def compareCtor (left right : CtorId) : Ordering :=
+  match Ixon.Merkle.compareAddress left.block right.block with
+  | .lt => .lt
+  | .gt => .gt
+  | .eq =>
+      match compareNat left.indIdx right.indIdx with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => compareNat left.cidx right.cidx
+
+private def compareList (compare : α → α → Ordering) :
+    List α → List α → Ordering
+  | [], [] => .eq
+  | [], _ :: _ => .lt
+  | _ :: _, [] => .gt
+  | left :: lefts, right :: rights =>
+      match compare left right with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => compareList compare lefts rights
+
+/- A recursively refined heap shape retained inside a constructor field.
+`none` keeps only a constructor identity; `some fields` describes the exact
+field vector and may itself contain further refined constructor shapes.  The
+certificate preflight and cache decoder bound recursion depth and total
+payload before normalization or interpretation. -/
+mutual
+
+inductive FieldShape where
+  | ctor (identity : CtorId) (fields : Option (List FieldFact))
+  | pap (function : Address) (supplied : Nat)
+  deriving Repr, Inhabited
+
+/-- A finite recursive fact for one constructor field. -/
+structure FieldFact where
+  mayScalar : Bool
+  unknownHeap : Bool
+  shapes : List FieldShape
+  deriving Repr, Inhabited
+
+end
+
+
+/-! `deriving LawfulBEq` does not support mutually recursive inductives.  Keep
+the executable equality explicit and prove its reflection below, so recursive
+facts remain usable by canonicalization without introducing an axiom. -/
+
+mutual
+
+def FieldShape.compare : FieldShape → FieldShape → Ordering
+  | .ctor left leftFields, .ctor right rightFields =>
+      match compareCtor left right with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => FieldFact.compareOptions leftFields rightFields
+  | .ctor _ _, .pap _ _ => .lt
+  | .pap _ _, .ctor _ _ => .gt
+  | .pap leftFunction leftSupplied, .pap rightFunction rightSupplied =>
+      match Ixon.Merkle.compareAddress leftFunction rightFunction with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => compareNat leftSupplied rightSupplied
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.compare (left right : FieldFact) : Ordering :=
+  match compareBool left.mayScalar right.mayScalar with
+  | .lt => .lt
+  | .gt => .gt
+  | .eq =>
+      match compareBool left.unknownHeap right.unknownHeap with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => FieldShape.compareLists left.shapes right.shapes
+termination_by sizeOf left + sizeOf right
+decreasing_by
+  cases left
+  cases right
+  simp_wf
+  omega
+
+def FieldShape.compareLists : List FieldShape → List FieldShape → Ordering
+  | [], [] => .eq
+  | [], _ :: _ => .lt
+  | _ :: _, [] => .gt
+  | left :: lefts, right :: rights =>
+      match left.compare right with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => FieldShape.compareLists lefts rights
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.compareLists : List FieldFact → List FieldFact → Ordering
+  | [], [] => .eq
+  | [], _ :: _ => .lt
+  | _ :: _, [] => .gt
+  | left :: lefts, right :: rights =>
+      match left.compare right with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => FieldFact.compareLists lefts rights
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.compareOptions : Option (List FieldFact) →
+    Option (List FieldFact) → Ordering
+  | none, none => .eq
+  | none, some _ => .lt
+  | some _, none => .gt
+  | some left, some right => FieldFact.compareLists left right
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+
+mutual
+
+def FieldShape.beq : FieldShape → FieldShape → Bool
+  | .ctor left leftFields, .ctor right rightFields =>
+      left == right && FieldFact.beqOptions leftFields rightFields
+  | .pap leftFunction leftSupplied, .pap rightFunction rightSupplied =>
+      leftFunction == rightFunction && leftSupplied == rightSupplied
+  | _, _ => false
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.beq (left right : FieldFact) : Bool :=
+  left.mayScalar == right.mayScalar &&
+    left.unknownHeap == right.unknownHeap &&
+      FieldShape.beqLists left.shapes right.shapes
+termination_by sizeOf left + sizeOf right
+decreasing_by
+  cases left
+  cases right
+  simp_wf
+  omega
+
+def FieldShape.beqLists : List FieldShape → List FieldShape → Bool
+  | [], [] => true
+  | left :: lefts, right :: rights =>
+      left.beq right && FieldShape.beqLists lefts rights
+  | _, _ => false
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.beqLists : List FieldFact → List FieldFact → Bool
+  | [], [] => true
+  | left :: lefts, right :: rights =>
+      left.beq right && FieldFact.beqLists lefts rights
+  | _, _ => false
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.beqOptions : Option (List FieldFact) →
+    Option (List FieldFact) → Bool
+  | none, none => true
+  | some left, some right => FieldFact.beqLists left right
+  | _, _ => false
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+
+mutual
+
+theorem FieldShape.eq_of_beq {left right : FieldShape}
+    (h : left.beq right = true) : left = right :=
+  match left, right with
+  | .ctor identity fields, .ctor identity' fields' => by
+      simp only [FieldShape.beq, Bool.and_eq_true] at h
+      have hidentity : identity = identity' := beq_iff_eq.mp h.1
+      have hfields : fields = fields' := FieldFact.options_eq_of_beq h.2
+      subst identity'
+      subst fields'
+      rfl
+  | .pap function supplied, .pap function' supplied' => by
+      simp only [FieldShape.beq, Bool.and_eq_true] at h
+      have hfunction : function = function' := beq_iff_eq.mp h.1
+      have hsupplied : supplied = supplied' := beq_iff_eq.mp h.2
+      subst function'
+      subst supplied'
+      rfl
+  | .ctor _ _, .pap _ _ | .pap _ _, .ctor _ _ => by
+      simp [FieldShape.beq] at h
+termination_by sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldFact.eq_of_beq {left right : FieldFact}
+    (h : left.beq right = true) : left = right :=
+  match left, right with
+  | ⟨leftScalar, leftUnknown, leftShapes⟩,
+      ⟨rightScalar, rightUnknown, rightShapes⟩ => by
+      simp only [FieldFact.beq, Bool.and_eq_true] at h
+      have hscalar : leftScalar = rightScalar := beq_iff_eq.mp h.1.1
+      have hunknown : leftUnknown = rightUnknown := beq_iff_eq.mp h.1.2
+      have hshapes : leftShapes = rightShapes :=
+        FieldShape.lists_eq_of_beq h.2
+      subst rightScalar
+      subst rightUnknown
+      subst rightShapes
+      rfl
+termination_by sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldShape.lists_eq_of_beq {left right : List FieldShape}
+    (h : FieldShape.beqLists left right = true) : left = right :=
+  match left, right with
+  | [], [] => rfl
+  | left :: lefts, right :: rights => by
+      simp only [FieldShape.beqLists, Bool.and_eq_true] at h
+      have hhead := FieldShape.eq_of_beq h.1
+      have htail := FieldShape.lists_eq_of_beq h.2
+      subst right
+      subst rights
+      rfl
+  | [], _ :: _ | _ :: _, [] => by simp [FieldShape.beqLists] at h
+termination_by sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldFact.lists_eq_of_beq {left right : List FieldFact}
+    (h : FieldFact.beqLists left right = true) : left = right :=
+  match left, right with
+  | [], [] => rfl
+  | left :: lefts, right :: rights => by
+      simp only [FieldFact.beqLists, Bool.and_eq_true] at h
+      have hhead := FieldFact.eq_of_beq h.1
+      have htail := FieldFact.lists_eq_of_beq h.2
+      subst right
+      subst rights
+      rfl
+  | [], _ :: _ | _ :: _, [] => by simp [FieldFact.beqLists] at h
+termination_by sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldFact.options_eq_of_beq
+    {left right : Option (List FieldFact)}
+    (h : FieldFact.beqOptions left right = true) : left = right :=
+  match left, right with
+  | none, none => rfl
+  | some left, some right =>
+      congrArg some (FieldFact.lists_eq_of_beq
+        (by simpa [FieldFact.beqOptions] using h))
+  | none, some _ | some _, none => by simp [FieldFact.beqOptions] at h
+termination_by sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+
+mutual
+
+theorem FieldShape.beq_refl (shape : FieldShape) : shape.beq shape = true := by
+  cases shape with
+  | ctor identity fields =>
+      simp only [FieldShape.beq, beq_iff_eq.mpr rfl]
+      exact FieldFact.beqOptions_refl fields
+  | pap function supplied => simp [FieldShape.beq]
+termination_by sizeOf shape
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldFact.beq_refl (fact : FieldFact) : fact.beq fact = true := by
+  cases fact with
+  | mk mayScalar unknownHeap shapes =>
+      simp only [FieldFact.beq, beq_iff_eq.mpr rfl]
+      exact FieldShape.beqLists_refl shapes
+termination_by sizeOf fact
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldShape.beqLists_refl (shapes : List FieldShape) :
+    FieldShape.beqLists shapes shapes = true := by
+  cases shapes with
+  | nil => simp [FieldShape.beqLists]
+  | cons head tail =>
+      simp [FieldShape.beqLists, FieldShape.beq_refl head,
+        FieldShape.beqLists_refl tail]
+termination_by sizeOf shapes
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldFact.beqLists_refl (facts : List FieldFact) :
+    FieldFact.beqLists facts facts = true := by
+  cases facts with
+  | nil => simp [FieldFact.beqLists]
+  | cons head tail =>
+      simp [FieldFact.beqLists, FieldFact.beq_refl head,
+        FieldFact.beqLists_refl tail]
+termination_by sizeOf facts
+decreasing_by all_goals simp_wf <;> omega
+
+theorem FieldFact.beqOptions_refl (facts : Option (List FieldFact)) :
+    FieldFact.beqOptions facts facts = true := by
+  cases facts with
+  | none => simp [FieldFact.beqOptions]
+  | some facts => simpa [FieldFact.beqOptions] using
+      FieldFact.beqLists_refl facts
+termination_by sizeOf facts
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+
+instance : BEq FieldShape := ⟨FieldShape.beq⟩
+
+instance : ReflBEq FieldShape where
+  rfl := by intro shape; exact FieldShape.beq_refl shape
+
+instance : LawfulBEq FieldShape := ⟨FieldShape.eq_of_beq⟩
+
+instance : DecidableEq FieldShape := instDecidableEqOfLawfulBEq
+
+instance : BEq FieldFact := ⟨FieldFact.beq⟩
+
+instance : ReflBEq FieldFact where
+  rfl := by intro fact; exact FieldFact.beq_refl fact
+
+instance : LawfulBEq FieldFact := ⟨FieldFact.eq_of_beq⟩
+
+instance : DecidableEq FieldFact := instDecidableEqOfLawfulBEq
+
+namespace FieldShape
+
+private def insert (shape : FieldShape) : List FieldShape → List FieldShape
+  | [] => [shape]
+  | head :: tail =>
+      match compare shape head with
+      | .lt => shape :: head :: tail
+      | .eq =>
+          if shape == head then head :: tail
+          else shape :: head :: tail
+      | .gt => head :: insert shape tail
+
+def normalize (shapes : List FieldShape) : List FieldShape :=
+  shapes.foldr insert []
+
+private theorem mem_insert_of_mem {needle shape : FieldShape}
+    {shapes : List FieldShape} (h : needle ∈ shapes) :
+    needle ∈ insert shape shapes := by
+  induction shapes with
+  | nil => contradiction
+  | cons head tail ih =>
+      cases hcompare : compare shape head with
+      | lt =>
+          rw [insert, hcompare]
+          exact List.mem_cons.mpr (Or.inr h)
+      | eq =>
+          by_cases heq : shape = head
+          · rw [insert, hcompare, if_pos ((beq_iff_eq).mpr heq)]
+            exact h
+          · rw [insert, hcompare, if_neg (by simpa using heq)]
+            exact List.mem_cons.mpr (Or.inr h)
+      | gt =>
+          rw [insert, hcompare]
+          rcases List.mem_cons.mp h with hhead | htail
+          · exact List.mem_cons.mpr (Or.inl hhead)
+          · exact List.mem_cons.mpr (Or.inr (ih htail))
+
+private theorem mem_insert_self (shape : FieldShape)
+    (shapes : List FieldShape) : shape ∈ insert shape shapes := by
+  induction shapes with
+  | nil => simp [insert]
+  | cons head tail ih =>
+      cases hcompare : compare shape head with
+      | lt =>
+          rw [insert, hcompare]
+          exact List.mem_cons.mpr (Or.inl rfl)
+      | eq =>
+          by_cases heq : shape = head
+          · rw [insert, hcompare, if_pos ((beq_iff_eq).mpr heq)]
+            exact List.mem_cons.mpr (Or.inl heq)
+          · rw [insert, hcompare, if_neg (by simpa using heq)]
+            exact List.mem_cons.mpr (Or.inl rfl)
+      | gt =>
+          rw [insert, hcompare]
+          exact List.mem_cons.mpr (Or.inr ih)
+
+theorem mem_normalize_of_mem {shape : FieldShape} {shapes : List FieldShape}
+    (h : shape ∈ shapes) : shape ∈ normalize shapes := by
+  unfold normalize
+  induction shapes with
+  | nil => contradiction
+  | cons head tail ih =>
+      simp only [List.foldr_cons]
+      rcases List.mem_cons.mp h with hhead | htail
+      · subst head
+        exact mem_insert_self shape _
+      · exact mem_insert_of_mem (ih htail)
+
+end FieldShape
+
+namespace FieldFact
+
+def bottom : FieldFact := ⟨false, false, []⟩
+def scalar : FieldFact := ⟨true, false, []⟩
+def heap (shape : FieldShape) : FieldFact := ⟨false, false, [shape]⟩
+def top : FieldFact := ⟨true, true, []⟩
+
+def normalize (fact : FieldFact) : FieldFact :=
+  if fact.unknownHeap then
+    { fact with shapes := [] }
+  else
+    { fact with shapes := FieldShape.normalize fact.shapes }
+
+end FieldFact
+
+mutual
+
+def FieldShape.canonical : FieldShape → Bool
+  | .ctor _ none | .pap _ _ => true
+  | .ctor _ (some fields) => FieldFact.allCanonical fields
+termination_by shape => sizeOf shape
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.canonical (fact : FieldFact) : Bool :=
+  fact == fact.normalize && FieldShape.allCanonical fact.shapes
+termination_by sizeOf fact
+decreasing_by
+  cases fact
+  simp_wf
+
+def FieldShape.allCanonical : List FieldShape → Bool
+  | [] => true
+  | shape :: shapes => shape.canonical && FieldShape.allCanonical shapes
+termination_by shapes => sizeOf shapes
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.allCanonical : List FieldFact → Bool
+  | [] => true
+  | fact :: facts => fact.canonical && FieldFact.allCanonical facts
+termination_by facts => sizeOf facts
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+mutual
+
+def FieldShape.le : FieldShape → FieldShape → Bool
+  | .ctor left leftFields, .ctor right rightFields =>
+      left == right &&
+        match rightFields with
+        | none => true
+        | some rightFacts =>
+            match leftFields with
+            | none => false
+            | some leftFacts => FieldFact.listLe leftFacts rightFacts
+  | .pap leftFunction leftSupplied, .pap rightFunction rightSupplied =>
+      leftFunction == rightFunction && leftSupplied == rightSupplied
+  | _, _ => false
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.le (left right : FieldFact) : Bool :=
+  (!left.mayScalar || right.mayScalar) &&
+    (right.unknownHeap ||
+      (!left.unknownHeap && FieldShape.allLe left.shapes right.shapes))
+termination_by sizeOf left + sizeOf right
+decreasing_by
+  cases left
+  cases right
+  simp_wf
+  omega
+
+def FieldShape.allLe : List FieldShape → List FieldShape → Bool
+  | [], _ => true
+  | left :: lefts, rights =>
+      FieldShape.anyLe left rights && FieldShape.allLe lefts rights
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldShape.anyLe (left : FieldShape) : List FieldShape → Bool
+  | [] => false
+  | right :: rights => left.le right || FieldShape.anyLe left rights
+termination_by rights => sizeOf left + sizeOf rights
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.listLe : List FieldFact → List FieldFact → Bool
+  | [], [] => true
+  | left :: lefts, right :: rights =>
+      left.le right && FieldFact.listLe lefts rights
+  | _, _ => false
+termination_by left right => sizeOf left + sizeOf right
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+namespace FieldFact
+
+def join (left right : FieldFact) : FieldFact :=
+  normalize
+    { mayScalar := left.mayScalar || right.mayScalar
+      unknownHeap := left.unknownHeap || right.unknownHeap
+      shapes := left.shapes ++ right.shapes }
+
+def forgetHeap (fact : FieldFact) : FieldFact :=
+  if fact.unknownHeap || !fact.shapes.isEmpty then
+    { mayScalar := fact.mayScalar, unknownHeap := true, shapes := [] }
+  else
+    fact
+
+end FieldFact
+
+mutual
+
+def FieldShape.bytes : FieldShape → ByteArray
+  | .ctor identity fields => Encoding.tag 0 ++
+      Encoding.address identity.block ++ Encoding.nat identity.indIdx ++
+        Encoding.nat identity.cidx ++ FieldFact.optionBytes fields
+  | .pap function supplied => Encoding.tag 1 ++
+      Encoding.address function ++ Encoding.nat supplied
+termination_by shape => sizeOf shape
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.bytes (fact : FieldFact) : ByteArray :=
+  Encoding.bool fact.mayScalar ++ Encoding.bool fact.unknownHeap ++
+    Encoding.nat fact.shapes.length ++ FieldShape.payloadBytes fact.shapes
+termination_by sizeOf fact
+decreasing_by
+  cases fact
+  simp_wf
+
+def FieldShape.payloadBytes : List FieldShape → ByteArray
+  | [] => ByteArray.empty
+  | shape :: shapes => shape.bytes ++ FieldShape.payloadBytes shapes
+termination_by shapes => sizeOf shapes
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.payloadBytes : List FieldFact → ByteArray
+  | [] => ByteArray.empty
+  | fact :: facts => fact.bytes ++ FieldFact.payloadBytes facts
+termination_by facts => sizeOf facts
+decreasing_by all_goals simp_wf <;> omega
+
+def FieldFact.optionBytes : Option (List FieldFact) → ByteArray
+  | none => Encoding.tag 0
+  | some facts => Encoding.tag 1 ++ Encoding.nat facts.length ++
+      FieldFact.payloadBytes facts
+termination_by facts => sizeOf facts
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+/-- One result heap shape. A constructor may carry exact recursively refined
+field facts; `none` retains only its identity and deliberately means unknown
+contents. -/
+inductive HeapShape where
+  | ctor (identity : CtorId) (fields : Option (List FieldFact))
+  | pap (function : Address) (supplied : Nat)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+namespace HeapShape
+
+private def compareFields : Option (List FieldFact) →
+    Option (List FieldFact) → Ordering
+  | none, none => .eq
+  | none, some _ => .lt
+  | some _, none => .gt
+  | some left, some right => compareList FieldFact.compare left right
+
+def compare : HeapShape → HeapShape → Ordering
+  | .ctor left leftFields, .ctor right rightFields =>
+      match compareCtor left right with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => compareFields leftFields rightFields
+  | .ctor _ _, .pap _ _ => .lt
+  | .pap _ _, .ctor _ _ => .gt
+  | .pap leftFunction leftSupplied, .pap rightFunction rightSupplied =>
+      match Ixon.Merkle.compareAddress leftFunction rightFunction with
+      | .lt => .lt
+      | .gt => .gt
+      | .eq => compareNat leftSupplied rightSupplied
+
+private def insert (shape : HeapShape) : List HeapShape → List HeapShape
+  | [] => [shape]
+  | head :: tail =>
+      match compare shape head with
+      | .lt => shape :: head :: tail
+      | .eq =>
+          if shape == head then head :: tail
+          else shape :: head :: tail
+      | .gt => head :: insert shape tail
+
+def normalize (shapes : List HeapShape) : List HeapShape :=
+  shapes.foldr insert []
+
+private theorem mem_insert_of_mem {needle shape : HeapShape}
+    {shapes : List HeapShape} (h : needle ∈ shapes) :
+    needle ∈ insert shape shapes := by
+  induction shapes with
+  | nil => contradiction
+  | cons head tail ih =>
+      cases hcompare : compare shape head with
+      | lt =>
+          rw [insert, hcompare]
+          exact List.mem_cons.mpr (Or.inr h)
+      | eq =>
+          by_cases heq : shape = head
+          · rw [insert, hcompare, if_pos ((beq_iff_eq).mpr heq)]
+            exact h
+          · rw [insert, hcompare, if_neg (by simpa using heq)]
+            exact List.mem_cons.mpr (Or.inr h)
+      | gt =>
+          rw [insert, hcompare]
+          rcases List.mem_cons.mp h with hhead | htail
+          · exact List.mem_cons.mpr (Or.inl hhead)
+          · exact List.mem_cons.mpr (Or.inr (ih htail))
+
+private theorem mem_insert_self (shape : HeapShape)
+    (shapes : List HeapShape) : shape ∈ insert shape shapes := by
+  induction shapes with
+  | nil => simp [insert]
+  | cons head tail ih =>
+      cases hcompare : compare shape head with
+      | lt =>
+          rw [insert, hcompare]
+          exact List.mem_cons.mpr (Or.inl rfl)
+      | eq =>
+          by_cases heq : shape = head
+          · rw [insert, hcompare, if_pos ((beq_iff_eq).mpr heq)]
+            exact List.mem_cons.mpr (Or.inl heq)
+          · rw [insert, hcompare, if_neg (by simpa using heq)]
+            exact List.mem_cons.mpr (Or.inl rfl)
+      | gt =>
+          rw [insert, hcompare]
+          exact List.mem_cons.mpr (Or.inr ih)
+
+theorem mem_normalize_of_mem {shape : HeapShape} {shapes : List HeapShape}
+    (h : shape ∈ shapes) : shape ∈ normalize shapes := by
+  unfold normalize
+  induction shapes with
+  | nil => contradiction
+  | cons head tail ih =>
+      simp only [List.foldr_cons]
+      rcases List.mem_cons.mp h with hhead | htail
+      · subst head
+        exact mem_insert_self shape _
+      · exact mem_insert_of_mem (ih htail)
+
+def fieldFactsLe : List FieldFact → List FieldFact → Bool
+  | [], [] => true
+  | left :: lefts, right :: rights =>
+      left.le right && fieldFactsLe lefts rights
+  | _, _ => false
+
+/-- One detailed constructor shape is below an identity-only shape; detailed
+shapes compare field facts pointwise. -/
+def le : HeapShape → HeapShape → Bool
+  | .ctor left leftFields, .ctor right rightFields =>
+      left == right &&
+        match rightFields with
+        | none => true
+        | some rightFacts =>
+            match leftFields with
+            | none => false
+            | some leftFacts => fieldFactsLe leftFacts rightFacts
+  | .pap leftFunction leftSupplied, .pap rightFunction rightSupplied =>
+      leftFunction == rightFunction && leftSupplied == rightSupplied
+  | _, _ => false
+
+def canonical : HeapShape → Bool
+  | .ctor _ none | .pap _ _ => true
+  | .ctor _ (some fields) => fields.all FieldFact.canonical
+
+def bytes : HeapShape → ByteArray
+  | .ctor identity fields => Encoding.tag 0 ++
+      Encoding.address identity.block ++ Encoding.nat identity.indIdx ++
+        Encoding.nat identity.cidx ++
+          match fields with
+          | none => Encoding.tag 0
+          | some facts => Encoding.tag 1 ++ Encoding.list FieldFact.bytes facts
+  | .pap function supplied => Encoding.tag 1 ++
+      Encoding.address function ++ Encoding.nat supplied
+
+def toFieldShape : HeapShape → FieldShape
+  | .ctor identity fields => .ctor identity fields
+  | .pap function supplied => .pap function supplied
+
+end HeapShape
+
+/-- A finite result-shape fact. `unknownHeap` means every constructor/PAP
+shape is possible; canonical facts omit the then-redundant explicit list. -/
+structure Fact where
+  mayScalar : Bool
+  unknownHeap : Bool
+  shapes : List HeapShape
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+namespace Fact
+
+def bottom : Fact := ⟨false, false, []⟩
+def scalar : Fact := ⟨true, false, []⟩
+def heap (shape : HeapShape) : Fact := ⟨false, false, [shape]⟩
+def top : Fact := ⟨true, true, []⟩
+
+/-- Recover a constructor identity only when the fact excludes scalars,
+unknown heap values, PAPs, and every competing heap shape.  Field detail is
+irrelevant to identity provenance, so both identity-only and recursively
+refined constructor shapes qualify. -/
+def exactConstructor? : Fact → Option CtorId
+  | ⟨false, false, [.ctor identity _]⟩ => some identity
+  | _ => none
+
+theorem exactConstructor?_eq_some {fact : Fact} {identity : CtorId}
+    (h : fact.exactConstructor? = some identity) :
+    ∃ fields,
+      fact = ⟨false, false, [.ctor identity fields]⟩ := by
+  unfold exactConstructor? at h
+  split at h <;> simp_all
+
+def normalize (fact : Fact) : Fact :=
+  if fact.unknownHeap then
+    { fact with shapes := [] }
+  else
+    { fact with shapes := HeapShape.normalize fact.shapes }
+
+def canonical (fact : Fact) : Bool :=
+  fact == fact.normalize && fact.shapes.all HeapShape.canonical
+
+/-- Executable subset on the abstract domain. -/
+def le (left right : Fact) : Bool :=
+  (!left.mayScalar || right.mayScalar) &&
+    (right.unknownHeap ||
+      (!left.unknownHeap &&
+        left.shapes.all fun leftShape =>
+          right.shapes.any (HeapShape.le leftShape)))
+
+def join (left right : Fact) : Fact :=
+  normalize
+    { mayScalar := left.mayScalar || right.mayScalar
+      unknownHeap := left.unknownHeap || right.unknownHeap
+      shapes := left.shapes ++ right.shapes }
+
+def joins : List Fact → Fact
+  | [] => bottom
+  | fact :: facts => fact.join (joins facts)
+
+/-- Forget the current identity of any heap result while preserving exact
+scalar-only information. Primitive operations may mutate or consume a
+location still named by an older environment slot; without a separate alias
+domain, retaining that slot's finite constructor/PAP set is unsound. -/
+def forgetHeap (fact : Fact) : Fact :=
+  if fact.unknownHeap || !fact.shapes.isEmpty then
+    { mayScalar := fact.mayScalar, unknownHeap := true, shapes := [] }
+  else
+    fact
+
+def bytes (fact : Fact) : ByteArray :=
+  Encoding.bool fact.mayScalar ++ Encoding.bool fact.unknownHeap ++
+    Encoding.list HeapShape.bytes fact.shapes
+
+end Fact
+
+namespace FieldFact
+
+/-- Preserve a result fact as one recursively refined constructor field. -/
+def ofFact (fact : Fact) : FieldFact :=
+  normalize
+    { mayScalar := fact.mayScalar
+      unknownHeap := fact.unknownHeap
+      shapes := fact.shapes.map HeapShape.toFieldShape }
+
+end FieldFact
+
+namespace FieldShape
+
+def toHeapShape : FieldShape → HeapShape
+  | .ctor identity fields => .ctor identity fields
+  | .pap function supplied => .pap function supplied
+
+end FieldShape
+
+namespace FieldFact
+
+/-- Re-root a fetched field, preserving every bounded nested refinement. -/
+def toFact (fact : FieldFact) : Fact :=
+  Fact.normalize
+    { mayScalar := fact.mayScalar
+      unknownHeap := fact.unknownHeap
+      shapes := fact.shapes.map FieldShape.toHeapShape }
+
+end FieldFact
+
+namespace HeapShape
+
+/-- Result fact for a successful fetch from this possible shape.  Missing
+detail widens; a known out-of-range field and PAP nodes cannot produce a
+successful concrete fetch. -/
+def fetch (field : Nat) : HeapShape → Fact
+  | .ctor _ none => Fact.top
+  | .ctor _ (some fields) =>
+      match fields[field]? with
+      | some fact => fact.toFact
+      | none => Fact.bottom
+  | .pap _ _ => Fact.bottom
+
+end HeapShape
+
+namespace Fact
+
+/-- Field-sensitive transfer for non-consuming constructor projection. -/
+def fetch (fact : Fact) (field : Nat) : Fact :=
+  if fact.unknownHeap then top
+  else joins (fact.shapes.map (HeapShape.fetch field))
+
+/-! ### Case-binder field recovery -/
+
+end Fact
+
+namespace HeapShape
+
+/-- Abstract field vector contributed by one possible heap shape to a case
+alternative.  Constructor tags are filtered before their fields participate;
+identity-only shapes retain no field information, and detailed vectors with a
+different arity cannot reach a successful execution of this alternative.  The
+result is already reversed into the evaluator's de Bruijn binding order. -/
+def caseFields (cidx fieldCount : Nat) : HeapShape → List Fact
+  | .ctor identity none =>
+      if identity.cidx == cidx then
+        List.replicate fieldCount Fact.top
+      else
+        List.replicate fieldCount Fact.bottom
+  | .ctor identity (some fields) =>
+      if identity.cidx == cidx && fields.length == fieldCount then
+        (fields.map FieldFact.toFact).reverse
+      else
+        List.replicate fieldCount Fact.bottom
+  | .pap _ _ => List.replicate fieldCount Fact.bottom
+
+end HeapShape
+
+namespace Fact
+
+/-- Heads of the nonempty vectors in a candidate family. -/
+def vectorHeads : List (List Fact) → List Fact
+  | [] => []
+  | [] :: vectors => vectorHeads vectors
+  | (fact :: _) :: vectors => fact :: vectorHeads vectors
+
+/-- Tails of the nonempty vectors in a candidate family. -/
+def vectorTails : List (List Fact) → List (List Fact)
+  | [] => []
+  | [] :: vectors => vectorTails vectors
+  | (_ :: facts) :: vectors => facts :: vectorTails vectors
+
+/-- Pointwise join of equally sized case-field candidates.  The explicit
+length keeps the result arity exact even when the branch is abstractly
+unreachable and the candidate family is empty. -/
+def joinFieldVectors : Nat → List (List Fact) → List Fact
+  | 0, _ => []
+  | fieldCount + 1, vectors =>
+      Fact.joins (vectorHeads vectors) ::
+        joinFieldVectors fieldCount (vectorTails vectors)
+
+/-- Scalar contribution to one case alternative.  Only unary tag `1` can bind
+a value through Nat peeling, and that predecessor is exactly scalar. -/
+def scalarCaseFields (peelNat : Bool) (cidx fieldCount : Nat) : List Fact :=
+  if peelNat && cidx == 1 && fieldCount == 1 then
+    [Fact.scalar]
+  else
+    List.replicate fieldCount Fact.bottom
+
+/-- Facts installed for an alternative's field binders.  Finite constructor
+shapes contribute only when their tag and detailed arity match; multiple
+possible shapes join pointwise.  An identity-only matching constructor or an
+unknown heap widens every binder, while a possible peeled successor joins its
+precise scalar predecessor. -/
+def caseFields (fact : Fact) (peelNat : Bool)
+    (cidx fieldCount : Nat) : List Fact :=
+  if fact.unknownHeap then
+    List.replicate fieldCount Fact.top
+  else
+    let heapCandidates :=
+      fact.shapes.map (HeapShape.caseFields cidx fieldCount)
+    let candidates :=
+      if fact.mayScalar then
+        scalarCaseFields peelNat cidx fieldCount :: heapCandidates
+      else
+        heapCandidates
+    joinFieldVectors fieldCount candidates
+
+#guard (heap (.pap (Address.replicate 0x11) 1)).canonical
+#guard (join scalar
+  (heap (.ctor ⟨Address.replicate 0x22, 0, 1⟩ none))).canonical
+#guard (join top (heap (.pap (Address.replicate 0x33) 2))) == top
+#guard (heap (.pap (Address.replicate 0x44) 1)).le top
+#guard !top.le scalar
+#guard (heap (.ctor ⟨Address.replicate 0x55, 0, 0⟩
+  (some [FieldFact.scalar]))).fetch 0 == scalar
+#guard (heap (.ctor ⟨Address.replicate 0x55, 0, 0⟩ none)).fetch 0 == top
+#guard (heap (.ctor ⟨Address.replicate 0x55, 0, 0⟩ none)).forgetHeap ==
+  ⟨false, true, []⟩
+#guard scalar.forgetHeap == scalar
+#guard (heap (.ctor ⟨Address.replicate 0x56, 0, 3⟩
+  (some [FieldFact.scalar]))).caseFields false 3 1 == [scalar]
+#guard (heap (.ctor ⟨Address.replicate 0x56, 0, 3⟩
+  (some [FieldFact.scalar]))).caseFields false 4 1 == [bottom]
+#guard (heap (.ctor ⟨Address.replicate 0x56, 0, 3⟩ none)).caseFields
+  false 3 2 == [top, top]
+#guard scalar.caseFields true 1 1 == [scalar]
+#guard scalar.caseFields false 1 1 == [bottom]
+
+end Fact
+
+/-! ## Untrusted certificate format -/
+
+/-- Candidate facts for one stable/ordinary/mutual program artifact. Member
+order is part of the certificate and must exactly match the program artifact. -/
+structure CandidateArtifact where
+  programIdentity : Address
+  members : List (Address × Fact)
+  deriving BEq, Repr, Inhabited
+
+/-- The complete untrusted post-fixpoint claim. -/
+structure Certificate where
+  artifacts : List CandidateArtifact
+  deriving BEq, Repr, Inhabited
+
+/-- Deterministic admission limits for the already-addressed graph and the
+untrusted fact claim. Per-fact shape limits apply independently to result and
+recursive field facts because canonicalization currently sorts finite shape
+sets by insertion. Depth, total-shape, and total-field limits bound later
+interpretation and content-addressing work. -/
+structure Limits where
+  maxProgramArtifacts : Nat := 32 * 1024
+  maxProgramMembers : Nat := 32 * 1024
+  maxCertificateArtifacts : Nat := 32 * 1024
+  maxCertificateMembers : Nat := 32 * 1024
+  maxShapesPerFact : Nat := 256
+  maxShapes : Nat := 64 * 1024
+  maxFieldsPerShape : Nat := 256
+  maxFields : Nat := 64 * 1024
+  maxFieldDepth : Nat := 64
+  /-- Inclusive bound on constructor coordinates and PAP fill counts.  The
+  default includes the canonical-encoding fixture at `2^64` while preventing
+  a candidate from forcing an effectively unbounded numeral encoding. -/
+  maxShapeIndex : Nat := 2 ^ 64
+  deriving BEq, Repr
+
+def defaultLimits : Limits := {}
+
+/-- Exact structural counts returned by successful HPT preflight. -/
+structure Stats where
+  programArtifacts : Nat := 0
+  programMembers : Nat := 0
+  certificateArtifacts : Nat := 0
+  certificateMembers : Nat := 0
+  shapes : Nat := 0
+  fields : Nat := 0
+  fieldDepth : Nat := 0
+  deriving BEq, Repr
+
+namespace Certificate
+
+def summaries (certificate : Certificate) : List (Address × Fact) :=
+  certificate.artifacts.flatMap fun artifact => artifact.members
+
+end Certificate
+
+/-! ## Abstract interpreter -/
+
+abbrev DeclEnv := Address → Option Decl
+abbrev SummaryEnv := Address → Option Fact
+
+def resolveAtomFact (environment : List Fact) : Atom → Except String Fact
+  | .var index =>
+      match environment[index]? with
+      | some fact => .ok fact
+      | none => .error s!"HPT unbound variable {index}"
+  | .lit _ | .erased => .ok Fact.scalar
+
+def resolveAtomFacts (environment : List Fact)
+    (atoms : Array Atom) : Except String (List Fact) :=
+  atoms.foldlM (fun accumulated atom => do
+    pure (accumulated ++ [← resolveAtomFact environment atom])) []
+
+def callableResult (declarations : DeclEnv)
+    (summaries : SummaryEnv) (function : Address) : Except String Fact :=
+  match declarations function with
+  | none => .error s!"HPT call target is absent: {Address.toHex function}"
+  | some (.extern _) => .ok Fact.scalar
+  | some (.fn _) =>
+      match summaries function with
+      | some fact => .ok fact
+      | none => .error s!"HPT function summary is absent: {Address.toHex function}"
+
+/-- Transfer one possible callable shape.  `recur` is the preceding-fuel
+instance of `applyFact`; separating it makes the finite-shape fold transparent
+to the semantic proof without changing the executable domain. -/
+def applyShapeFact (declarations : DeclEnv) (summaries : SummaryEnv)
+    (recur : Fact → Nat → Except String Fact) (argumentCount : Nat) :
+    HeapShape → Except String Fact
+  | .ctor _ _ => .ok Fact.bottom
+  | .pap function supplied =>
+      match declarations function with
+      | none =>
+          .error s!"HPT pap target is absent: {Address.toHex function}"
+      | some declaration => do
+          let arity := declArity declaration
+          if supplied < arity then
+            let total := supplied + argumentCount
+            if total < arity then
+              return Fact.heap (.pap function total)
+            else
+              let returned ← callableResult declarations summaries function
+              if total == arity then
+                return returned
+              else
+                recur returned (total - arity)
+          else
+            return Fact.bottom
+
+/-- Join the transfers of a finite shape set. -/
+def applyShapeFacts
+    (step : HeapShape → Except String Fact) :
+    List HeapShape → Except String Fact
+  | [] => .ok Fact.bottom
+  | shape :: shapes => do
+      let head ← step shape
+      let tail ← applyShapeFacts step shapes
+      return head.join tail
+
+/-- Conservative abstract execution of `applyGo`. Exact PAP fill counts make
+under/exact/over-application finite; fuel is a fail-safe for junk over-approximate
+facts and widens to `top` rather than rejecting a sound certificate. -/
+def applyFact (declarations : DeclEnv) (summaries : SummaryEnv) :
+    Nat → Fact → Nat → Except String Fact
+  | 0, _, _ => .ok Fact.top
+  | fuel + 1, functionFact, argumentCount => do
+      if functionFact.unknownHeap then
+        return Fact.top
+      let scalar :=
+        if functionFact.mayScalar then Fact.scalar else Fact.bottom
+      let heap ← applyShapeFacts
+        (applyShapeFact declarations summaries
+          (applyFact declarations summaries fuel) argumentCount)
+        functionFact.shapes
+      return scalar.join heap
+
+mutual
+
+def analyzeCode (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) (environment : List Fact) :
+    Code → Except String Fact
+  | .ret atom => resolveAtomFact environment atom
+  | .letOp operation rest => do
+      let bound ← analyzeOp declarations summaries owner current environment
+        operation
+      analyzeCode declarations summaries owner current
+        (bound :: environment.map Fact.forgetHeap) rest
+  | .case scrutinee peelNat alternatives => do
+      let scrutineeFact ← resolveAtomFact environment scrutinee
+      analyzeAlternatives declarations summaries owner current scrutineeFact
+        peelNat environment alternatives.toList
+
+def analyzeAlternatives (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Address) (current : FnDef)
+    (scrutinee : Fact) (peelNat : Bool)
+    (environment : List Fact) : List Alt → Except String Fact
+  | [] => .ok Fact.bottom
+  | .mk cidx fields body :: rest => do
+      let branch ← analyzeCode declarations summaries owner current
+        (scrutinee.caseFields peelNat cidx fields ++ environment) body
+      let remaining ← analyzeAlternatives declarations summaries owner current
+        scrutinee peelNat environment rest
+      return branch.join remaining
+
+def analyzeOp (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) (environment : List Fact) :
+    Op → Except String Fact
+  | .pure atom => resolveAtomFact environment atom
+  | .alloc _ identity arguments => do
+      let fields ← resolveAtomFacts environment arguments
+      return Fact.heap (.ctor identity (some (fields.map FieldFact.ofFact)))
+  | .reuse target identity arguments => do
+      let fields ← resolveAtomFacts environment arguments
+      let _ ← resolveAtomFact environment target
+      return Fact.heap (.ctor identity
+        (some (fields.map fun fact => FieldFact.ofFact fact.forgetHeap)))
+  | .free target | .drop target | .dropU target => do
+      let _ ← resolveAtomFact environment target
+      return Fact.scalar
+  | .dup target => do
+      let _ ← resolveAtomFact environment target
+      return Fact.top
+  | .fetch target field => do
+      let fact ← resolveAtomFact environment target
+      return fact.fetch field
+  | .call function arguments => do
+      let _ ← resolveAtomFacts environment arguments
+      match declarations function with
+      | none => throw s!"HPT call target is absent: {Address.toHex function}"
+      | some declaration =>
+          if arguments.size != declArity declaration then
+            throw s!"HPT call arity mismatch at {Address.toHex function}"
+          callableResult declarations summaries function
+  | .callSelf arguments => do
+      let _ ← resolveAtomFacts environment arguments
+      if arguments.size != current.arity then
+        throw s!"HPT callSelf arity mismatch at {Address.toHex owner}"
+      match summaries owner with
+      | some fact => return fact
+      | none => throw s!"HPT self summary is absent: {Address.toHex owner}"
+  | .papp function arguments => do
+      let _ ← resolveAtomFacts environment arguments
+      match declarations function with
+      | none => throw s!"HPT pap target is absent: {Address.toHex function}"
+      | some declaration =>
+          if arguments.size < declArity declaration then
+            return Fact.heap (.pap function arguments.size)
+          throw s!"HPT saturating papp at {Address.toHex function}"
+  | .apply function arguments => do
+      let functionFact ← resolveAtomFact environment function
+      let _ ← resolveAtomFacts environment arguments
+      applyFact declarations summaries (arguments.size + 1) functionFact
+        arguments.size
+  | .extern _ arguments => do
+      let _ ← resolveAtomFacts environment arguments
+      return Fact.scalar
+
+end
+
+def inferFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (function : FnDef) : Except String Fact :=
+  analyzeCode declarations summaries owner function
+    (List.replicate function.arity Fact.top) function.body
+
+/-! ## Executable post-fixpoint checker -/
+
+private def allUnique (addresses : List Address) : Bool :=
+  ((AddressEnv.build (addresses.map fun address => (address, ()))).size ==
+    addresses.length)
+
+def programIdentity : ReaddressAll.Artifact → Address
+  | .stable address _ | .ordinary address _ => address
+  | .mutual block => block.blockAddress
+
+def programMembers (artifact : ReaddressAll.Artifact) :
+    List (Address × Decl) :=
+  artifact.declarations
+
+/-- Flattened declaration rows used by both the checker and its semantic
+interface. -/
+def declarationEntries (program : List ReaddressAll.Artifact) :
+    List (Address × Decl) :=
+  program.flatMap programMembers
+
+/-- Runtime declaration environment committed to by an addressed program. -/
+def programDeclEnv (program : List ReaddressAll.Artifact) : DeclEnv :=
+  AddressEnv.lookup (AddressEnv.build (declarationEntries program))
+
+/-- Lookup form of the untrusted summary rows.  It becomes trusted only under
+`Certificate.postFixpoint`. -/
+def Certificate.summaryEnv (certificate : Certificate) : SummaryEnv :=
+  AddressEnv.lookup (AddressEnv.build certificate.summaries)
+
+private def enforce (label : String) (actual limit : Nat) :
+    Except String Unit :=
+  if actual ≤ limit then .ok ()
+  else .error s!"HPT {label} budget exceeded: {actual} > {limit}"
+
+private def enforceShapeIndex (label : String) (actual limit : Nat) :
+    Except String Unit :=
+  if actual ≤ limit then .ok ()
+  else .error s!"HPT {label} exceeds the configured shape-index limit {limit}"
+
+structure PayloadStats where
+  shapes : Nat := 0
+  fields : Nat := 0
+  fieldDepth : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+mutual
+
+private def scanFieldFact (limits : Limits) (depth : Nat)
+    (fact : FieldFact) (state : PayloadStats) : Except String PayloadStats := do
+  enforce "field-depth" depth limits.maxFieldDepth
+  let state := { state with fieldDepth := max state.fieldDepth depth }
+  scanFieldShapes limits depth fact.shapes 0 state
+termination_by sizeOf fact
+decreasing_by
+  cases fact
+  simp_wf
+
+private def scanFieldShapes (limits : Limits) (depth : Nat) :
+    List FieldShape → Nat → PayloadStats → Except String PayloadStats
+  | [], _, state => .ok state
+  | shape :: shapes, localShapes, state => do
+      let localShapes := localShapes + 1
+      enforce "shapes-per-field-fact" localShapes limits.maxShapesPerFact
+      let state := { state with shapes := state.shapes + 1 }
+      enforce "total-shape" state.shapes limits.maxShapes
+      let state ← scanFieldShape limits depth shape state
+      scanFieldShapes limits depth shapes localShapes state
+termination_by shapes _ _ => sizeOf shapes
+decreasing_by all_goals simp_wf <;> omega
+
+private def scanFieldShape (limits : Limits) (depth : Nat) :
+    FieldShape → PayloadStats → Except String PayloadStats
+  | .ctor identity fields, state => do
+      enforceShapeIndex "field constructor inductive index" identity.indIdx
+        limits.maxShapeIndex
+      enforceShapeIndex "field constructor index" identity.cidx
+        limits.maxShapeIndex
+      match fields with
+      | none => pure state
+      | some fields => scanFieldVector limits (depth + 1) fields 0 state
+  | .pap _ supplied, state => do
+      enforceShapeIndex "field PAP supplied-argument count" supplied
+        limits.maxShapeIndex
+      pure state
+termination_by shape _ => sizeOf shape
+decreasing_by all_goals simp_wf <;> omega
+
+private def scanFieldVector (limits : Limits) (depth : Nat) :
+    List FieldFact → Nat → PayloadStats → Except String PayloadStats
+  | [], _, state => .ok state
+  | fact :: facts, localFields, state => do
+      let localFields := localFields + 1
+      enforce "fields-per-constructor-shape" localFields
+        limits.maxFieldsPerShape
+      let state := { state with fields := state.fields + 1 }
+      enforce "total-constructor-field" state.fields limits.maxFields
+      let state ← scanFieldFact limits depth fact state
+      scanFieldVector limits depth facts localFields state
+termination_by facts _ _ => sizeOf facts
+decreasing_by all_goals simp_wf <;> omega
+
+end
+
+
+/-- Check and count one recursive result-fact payload independently of graph
+coverage. The deterministic producer reuses this exact gate before accepting a
+round, so producer widening and untrusted checker admission share one domain
+boundary. -/
+def checkFactPayload (limits : Limits) (fact : Fact) :
+    Except String PayloadStats := do
+  let mut state : PayloadStats := {}
+  let mut factShapes := 0
+  for shape in fact.shapes do
+    factShapes := factShapes + 1
+    enforce "shapes-per-fact" factShapes limits.maxShapesPerFact
+    state := { state with shapes := state.shapes + 1 }
+    enforce "total-shape" state.shapes limits.maxShapes
+    match shape with
+    | .ctor identity fieldFacts =>
+        enforceShapeIndex "constructor inductive index" identity.indIdx
+          limits.maxShapeIndex
+        enforceShapeIndex "constructor index" identity.cidx
+          limits.maxShapeIndex
+        match fieldFacts with
+        | none => pure ()
+        | some fieldFacts =>
+            state ← scanFieldVector limits 1 fieldFacts 0 state
+    | .pap _ supplied =>
+        enforceShapeIndex "PAP supplied-argument count" supplied
+          limits.maxShapeIndex
+  return state
+
+/-- Linear, early-exit admission scan.  It runs before canonicalization,
+post-fixpoint interpretation, uniqueness checks, or hashing. -/
+def preflight (limits : Limits) (program : List ReaddressAll.Artifact)
+    (certificate : Certificate) : Except String Stats := do
+  let mut programArtifacts := 0
+  let mut programMemberCount := 0
+  for artifact in program do
+    programArtifacts := programArtifacts + 1
+    enforce "program-artifact" programArtifacts limits.maxProgramArtifacts
+    for _ in programMembers artifact do
+      programMemberCount := programMemberCount + 1
+      enforce "program-member" programMemberCount limits.maxProgramMembers
+  let mut certificateArtifacts := 0
+  let mut certificateMembers := 0
+  let mut shapes := 0
+  let mut fields := 0
+  let mut fieldDepth := 0
+  for artifact in certificate.artifacts do
+    certificateArtifacts := certificateArtifacts + 1
+    enforce "certificate-artifact" certificateArtifacts
+      limits.maxCertificateArtifacts
+    for member in artifact.members do
+      certificateMembers := certificateMembers + 1
+      enforce "certificate-member" certificateMembers
+        limits.maxCertificateMembers
+      let payload ← checkFactPayload limits member.2
+      shapes := shapes + payload.shapes
+      fields := fields + payload.fields
+      fieldDepth := max fieldDepth payload.fieldDepth
+      enforce "total-shape" shapes limits.maxShapes
+      enforce "total-constructor-field" fields limits.maxFields
+  return { programArtifacts
+           programMembers := programMemberCount
+           certificateArtifacts
+           certificateMembers
+           shapes
+           fields
+           fieldDepth }
+
+/-- Universal conservative candidate. It is useful as a fail-safe producer
+and as a baseline for measuring whether an external analysis adds precision;
+the ordinary checker still validates code well-formedness and coverage. -/
+def Certificate.top (program : List ReaddressAll.Artifact) : Certificate :=
+  ⟨program.map fun artifact =>
+    { programIdentity := programIdentity artifact
+      members := (programMembers artifact).map fun member =>
+        (member.1, match member.2 with
+          | .extern _ => Fact.scalar
+          | .fn _ => Fact.top) }⟩
+
+def checkMember (declarations : DeclEnv) (summaries : SummaryEnv) :
+    (Address × Decl) → (Address × Fact) → Bool
+  | (address, declaration), (claimedAddress, claimed) =>
+      address == claimedAddress && claimed.canonical &&
+        match declaration with
+        | .extern _ => claimed == Fact.scalar
+        | .fn function =>
+            match inferFunction declarations summaries address function with
+            | .ok inferred => inferred.le claimed
+            | .error _ => false
+
+private def checkMembers (declarations : DeclEnv) (summaries : SummaryEnv) :
+    List (Address × Decl) → List (Address × Fact) → Bool
+  | [], [] => true
+  | declaration :: declarations', summary :: summaries' =>
+      checkMember declarations summaries declaration summary &&
+        checkMembers declarations summaries declarations' summaries'
+  | _, _ => false
+
+private def checkArtifacts (declarations : DeclEnv) (summaries : SummaryEnv) :
+    List ReaddressAll.Artifact → List CandidateArtifact → Bool
+  | [], [] => true
+  | program :: programs, candidate :: candidates =>
+      candidate.programIdentity == programIdentity program &&
+        checkMembers declarations summaries (programMembers program)
+          candidate.members &&
+        checkArtifacts declarations summaries programs candidates
+  | _, _ => false
+
+namespace CandidateArtifact
+
+/-- Artifact-local post-fixpoint check against a summary environment that
+already contains this candidate's own rows and all prior dependencies. This is
+the cache-ingress primitive; the whole-program checker remains the final
+authority for global uniqueness, ordering, and coverage. -/
+def localPostFixpoint (declarations : DeclEnv) (summaries : SummaryEnv)
+    (program : ReaddressAll.Artifact) (candidate : CandidateArtifact) : Bool :=
+  candidate.programIdentity == Ix.Compiler.IxIR1.HPT.programIdentity program &&
+    checkMembers declarations summaries (programMembers program)
+      candidate.members
+
+end CandidateArtifact
+
+/-- Redundant pointwise spelling of the local checks.  Artifact alignment is
+still checked separately; this row-indexed form gives the semantic theorem a
+direct elimination principle for any successful environment lookup. -/
+def checkLocalRows (declarations : DeclEnv) (summaries : SummaryEnv) :
+    List (Address × Decl) → Bool
+  | [] => true
+  | (address, declaration) :: entries =>
+      (match summaries address with
+      | none => false
+      | some claimed =>
+          checkMember declarations summaries (address, declaration)
+            (address, claimed)) &&
+        checkLocalRows declarations summaries entries
+
+/-- The complete executable certificate condition. Besides the local
+post-fixpoint inclusions it requires exact artifact/member coverage, canonical
+facts, and globally unique producer and summary keys. -/
+def Certificate.postFixpoint (program : List ReaddressAll.Artifact)
+    (certificate : Certificate) : Bool :=
+  let declarationsList := declarationEntries program
+  let summariesList := certificate.summaries
+  let declarations := programDeclEnv program
+  let summaries := certificate.summaryEnv
+  program.all ReaddressAll.Artifact.contentAddressed &&
+    allUnique (program.map programIdentity) &&
+    allUnique (declarationsList.map (·.1)) &&
+    allUnique (summariesList.map (·.1)) &&
+    checkLocalRows declarations summaries declarationsList &&
+    checkArtifacts declarations summaries program certificate.artifacts
+
+/-! ## Content-addressed checked summaries -/
+
+inductive ArtifactKind where
+  | stable
+  | ordinary
+  | mutual
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+namespace ArtifactKind
+
+def tag : ArtifactKind → UInt8
+  | .stable => 0
+  | .ordinary => 1
+  | .mutual => 2
+
+def ofProgram : ReaddressAll.Artifact → ArtifactKind
+  | .stable _ _ => .stable
+  | .ordinary _ _ => .ordinary
+  | .mutual _ => .mutual
+
+end ArtifactKind
+
+def normalizeAddresses (addresses : List Address) : List Address :=
+  Ixon.Merkle.dedupSorted
+    (Ixon.Merkle.sortAddresses addresses.toArray) |>.toList
+
+/-- One checked, cache-addressed SCC summary. -/
+structure Artifact where
+  kind : ArtifactKind
+  programIdentity : Address
+  members : List (Address × Fact)
+  /-- Sorted, deduplicated checked summary-artifact dependencies. -/
+  dependencies : List Address
+  cacheKey : Address
+  address : Address
+  deriving BEq, Repr, Inhabited
+
+namespace Artifact
+
+def cacheKeyDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/hpt-cache-key/3" ++ Encoding.tag 0
+
+def summaryDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/hpt-summary/3" ++ Encoding.tag 0
+
+private def memberBytes (member : Address × Fact) : ByteArray :=
+  Encoding.address member.1 ++ member.2.bytes
+
+def cacheKeyPreimage (kind : ArtifactKind) (programIdentity : Address)
+    (dependencies : List Address) : ByteArray :=
+  cacheKeyDomain ++ Encoding.tag kind.tag ++
+    Encoding.address programIdentity ++
+    Encoding.list Encoding.address dependencies
+
+def summaryPreimage (cacheKey : Address)
+    (members : List (Address × Fact)) : ByteArray :=
+  summaryDomain ++ Encoding.address cacheKey ++
+    Encoding.list memberBytes members
+
+def expectedCacheKey (artifact : Artifact) : Address :=
+  Address.blake3
+    (cacheKeyPreimage artifact.kind artifact.programIdentity
+      artifact.dependencies)
+
+def expectedAddress (artifact : Artifact) : Address :=
+  Address.blake3 (summaryPreimage artifact.cacheKey artifact.members)
+
+def graphShapeAudit (artifact : Artifact) : Bool :=
+  match artifact.kind, artifact.members with
+  | .stable, [(address, _)] | .ordinary, [(address, _)] =>
+      address == artifact.programIdentity
+  | .mutual, _ =>
+      !artifact.members.isEmpty &&
+        !artifact.members.any fun member =>
+          member.1 == artifact.programIdentity
+  | _, _ => false
+
+def semanticAudit (artifact : Artifact) : Bool :=
+  artifact.graphShapeAudit &&
+    artifact.dependencies == normalizeAddresses artifact.dependencies &&
+    artifact.members.all (fun member => member.2.canonical) &&
+    artifact.cacheKey == artifact.expectedCacheKey &&
+    artifact.address == artifact.expectedAddress
+
+end Artifact
+
+/-- Cache query determined solely by one program artifact and the checked
+addresses of its already available dependency summaries. -/
+structure Query where
+  kind : ArtifactKind
+  programIdentity : Address
+  dependencies : List Address
+  cacheKey : Address
+  deriving BEq, Repr, Inhabited
+
+namespace Query
+
+def agreesWith (query : Query) (artifact : Artifact) : Bool :=
+  artifact.kind == query.kind &&
+    artifact.programIdentity == query.programIdentity &&
+    artifact.dependencies == query.dependencies &&
+    artifact.cacheKey == query.cacheKey
+
+end Query
+
+namespace Artifact
+
+/-- Materialize candidate members under an already-derived cache query. -/
+def ofQuery (query : Query) (members : List (Address × Fact)) : Artifact :=
+  { kind := query.kind
+    programIdentity := query.programIdentity
+    members
+    dependencies := query.dependencies
+    cacheKey := query.cacheKey
+    address := Address.blake3 (summaryPreimage query.cacheKey members) }
+
+end Artifact
+
+/-- Checked summaries in dependency order. -/
+structure Result where
+  artifacts : List Artifact
+  deriving BEq, Repr, Inhabited
+
+namespace Result
+
+def summaries (result : Result) : List (Address × Fact) :=
+  result.artifacts.flatMap fun artifact => artifact.members
+
+def cacheKeys (result : Result) : List Address :=
+  result.artifacts.map (·.cacheKey)
+
+def addresses (result : Result) : List Address :=
+  result.artifacts.map (·.address)
+
+private def dependencyOrderAudit : List Artifact → List Address → Bool
+  | [], _ => true
+  | artifact :: artifacts, available =>
+      artifact.dependencies.all available.contains &&
+        dependencyOrderAudit artifacts (artifact.address :: available)
+
+def semanticAudit (result : Result) : Bool :=
+  result.artifacts.all Artifact.semanticAudit &&
+    allUnique (result.artifacts.map (·.programIdentity)) &&
+    allUnique (result.summaries.map (·.1)) &&
+    allUnique result.cacheKeys && allUnique result.addresses &&
+    dependencyOrderAudit result.artifacts []
+
+end Result
+
+private def lookupOwner (owners : List (Address × Address))
+    (address : Address) : Option Address :=
+  (owners.find? fun entry => entry.1 == address).map (·.2)
+
+def dependencyAddresses (declarations : DeclEnv)
+    (owners : List (Address × Address))
+    (members : List (Address × Decl)) : Except String (List Address) := do
+  let localKeys := members.map (·.1)
+  let references := members.flatMap fun member =>
+    Readdress.Decl.references member.2
+  let mut dependencies : List Address := []
+  for reference in references do
+    if !localKeys.contains reference then
+      match declarations reference with
+      | none => pure ()
+      | some _ =>
+          match lookupOwner owners reference with
+          | some summary => dependencies := summary :: dependencies
+          | none =>
+              throw s!"HPT dependency summary is unavailable: {Address.toHex reference}"
+  return normalizeAddresses dependencies
+
+/-- Derive the exact persistent-cache lookup key for the next dependency-
+ordered program artifact. `owners` maps already checked member identities to
+their enclosing summary artifact address. -/
+def Query.ofProgram (declarations : DeclEnv)
+    (owners : List (Address × Address))
+    (program : ReaddressAll.Artifact) : Except String Query := do
+  let dependencies ← dependencyAddresses declarations owners
+    (programMembers program)
+  let kind := ArtifactKind.ofProgram program
+  let identity := Ix.Compiler.IxIR1.HPT.programIdentity program
+  pure (Query.mk kind identity dependencies
+    (Address.blake3
+      (Artifact.cacheKeyPreimage kind identity dependencies)))
+
+private def sameCachePreimage (left right : Artifact) : Bool :=
+  Artifact.cacheKeyPreimage left.kind left.programIdentity left.dependencies ==
+    Artifact.cacheKeyPreimage right.kind right.programIdentity right.dependencies
+
+private def sameSummaryPreimage (left right : Artifact) : Bool :=
+  Artifact.summaryPreimage left.cacheKey left.members ==
+    Artifact.summaryPreimage right.cacheKey right.members
+
+def rejectCollision (built : List Artifact)
+    (candidate : Artifact) : Except String Unit := do
+  match built.find? fun artifact => artifact.cacheKey == candidate.cacheKey with
+  | some existing =>
+      unless sameCachePreimage existing candidate do
+        throw s!"BLAKE3 collision between HPT cache keys {Address.toHex candidate.cacheKey}"
+  | none => pure ()
+  match built.find? fun artifact => artifact.address == candidate.address with
+  | some existing =>
+      unless sameSummaryPreimage existing candidate do
+        throw s!"BLAKE3 collision between HPT summaries {Address.toHex candidate.address}"
+  | none => pure ()
+
+private structure BuildState where
+  artifacts : List Artifact := []
+  /-- Program member to checked summary-artifact address. -/
+  owners : List (Address × Address) := []
+
+private def materializeOne (declarations : DeclEnv) (state : BuildState)
+    (program : ReaddressAll.Artifact) (candidate : CandidateArtifact) :
+    Except String BuildState := do
+  let query ← Query.ofProgram declarations state.owners program
+  let artifact := Artifact.ofQuery query candidate.members
+  let _ ← rejectCollision state.artifacts artifact
+  return { artifacts := state.artifacts ++ [artifact]
+           owners := state.owners ++ candidate.members.map (fun member =>
+             (member.1, artifact.address)) }
+
+private def materialize (declarations : DeclEnv) :
+    List ReaddressAll.Artifact → List CandidateArtifact → BuildState →
+      Except String BuildState
+  | [], [], state => .ok state
+  | program :: programs, candidate :: candidates, state => do
+      let state ← materializeOne declarations state program candidate
+      materialize declarations programs candidates state
+  | _, _, _ => .error "internal: HPT certificate/program artifact arity drift"
+
+/-- Check an untrusted whole-program result-shape post-fixpoint, then assign
+granular cache and summary identities in dependency order. This is the
+resource-configurable form of `run`. -/
+def runWith (limits : Limits) (program : List ReaddressAll.Artifact)
+    (certificate : Certificate) : Except String Result := do
+  let _ ← preflight limits program certificate
+  unless certificate.postFixpoint program do
+    throw "HPT certificate is not a canonical whole-program post-fixpoint"
+  let declarations := programDeclEnv program
+  let state ← materialize declarations program certificate.artifacts {}
+  let result : Result := ⟨state.artifacts⟩
+  unless result.semanticAudit do
+    throw "internal: checked HPT summaries failed their content-address audit"
+  return result
+
+/-- Check with the documented default structural limits. -/
+def run (program : List ReaddressAll.Artifact)
+    (certificate : Certificate) : Except String Result :=
+  runWith defaultLimits program certificate
+
+/-- Successful configurable materialization exposes the exact post-fixpoint
+condition that gated it; no trust is placed in the producer of the candidate
+facts. -/
+theorem postFixpoint_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    (hrun : runWith limits program certificate = .ok result) :
+    certificate.postFixpoint program = true := by
+  unfold runWith at hrun
+  simp only [bind, Except.bind] at hrun
+  split at hrun
+  · contradiction
+  split at hrun
+  · assumption
+  · contradiction
+
+/-- Every cache artifact returned under configurable limits passes the exact
+content-address and dependency-order audit. -/
+theorem semanticAudit_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    (hrun : runWith limits program certificate = .ok result) :
+    result.semanticAudit = true := by
+  unfold runWith at hrun
+  simp only [bind, Except.bind] at hrun
+  split at hrun
+  · contradiction
+  · split at hrun
+    · next hpost =>
+      split at hrun
+      · contradiction
+      · next state hmaterialize =>
+        split at hrun
+        · next haudit =>
+          injection hrun with hresult
+          subst result
+          exact haudit
+        · contradiction
+    · contradiction
+
+/-- Default-limit specialization of `postFixpoint_of_runWith_eq_ok`. -/
+theorem postFixpoint_of_run_eq_ok
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {result : Result} (hrun : run program certificate = .ok result) :
+    certificate.postFixpoint program = true := by
+  apply postFixpoint_of_runWith_eq_ok (limits := defaultLimits)
+  simpa [run] using hrun
+
+/-- Default-limit specialization of `semanticAudit_of_runWith_eq_ok`. -/
+theorem semanticAudit_of_run_eq_ok
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {result : Result} (hrun : run program certificate = .ok result) :
+    result.semanticAudit = true := by
+  apply semanticAudit_of_runWith_eq_ok (limits := defaultLimits)
+  simpa [run] using hrun
+
+end Ix.Compiler.IxIR1.HPT
diff --git a/Ix/Compiler/IxIR1/HPTCache.lean b/Ix/Compiler/IxIR1/HPTCache.lean
new file mode 100644
index 000000000..1b7d0106f
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTCache.lean
@@ -0,0 +1,543 @@
+import Ix.Compiler.IxIR1.HPTProduce
+import Ix.Compiler.IxIR.Decode
+
+/-!
+# Persistent checked HPT cache ingress
+
+Cache bytes are untrusted. Each dependency-ordered lookup is keyed by the
+current program artifact and the addresses of summaries already accepted in
+this run. A hit must decode canonically, reproduce that exact query, pass its
+content-address audit, fit the producer/checker resource envelope, and satisfy
+the artifact-local post-fixpoint against the current summary environment.
+
+Missing or invalid records rebuild only that artifact with the canonical
+producer. Downstream queries then see the accepted/rebuilt summary address, so
+the existing dependency cone determines subsequent hits naturally. The final
+assembled certificate crosses the ordinary whole-program `runWith` checker;
+cache scheduling is not a new trust boundary.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.Cache
+
+open Ix.Compiler.Ixon
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR
+
+/-- Versioned persistent record framing, independent of summary hash domains. -/
+def recordDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/hpt-cache-record/2" ++ Encoding.tag 0
+
+/-- Versioned framing for a deterministic collection of keyed records. -/
+def storeDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/hpt-cache-store/1" ++ Encoding.tag 0
+
+private def memberBytes (member : Address × Fact) : ByteArray :=
+  Encoding.address member.1 ++ member.2.bytes
+
+/-- Canonical persistent spelling of one checked summary artifact. -/
+def encodeArtifact (artifact : Artifact) : ByteArray :=
+  recordDomain ++ Encoding.tag artifact.kind.tag ++
+    Encoding.address artifact.programIdentity ++
+    Encoding.list Encoding.address artifact.dependencies ++
+    Encoding.address artifact.cacheKey ++
+    Encoding.list memberBytes artifact.members ++
+    Encoding.address artifact.address
+
+/-- Cache-specific byte and entry controls around the producer/checker limits.
+Oversized records in an already constructed in-memory store are invalid hits;
+persistent ingress and publication reject them before allocation/output. The
+aggregate input cap is a hard admission boundary before indexing. -/
+structure Limits where
+  producer : ProducerLimits := {}
+  maxEntries : Nat := 32 * 1024
+  maxEntryBytes : Nat := 4 * 1024 * 1024
+  maxBytes : Nat := 64 * 1024 * 1024
+  maxWriteBytes : Nat := 64 * 1024 * 1024
+  /-- Complete framed store-file bytes, including keys and length prefixes. -/
+  maxStoreBytes : Nat := 72 * 1024 * 1024
+  deriving BEq, Repr
+
+def defaultLimits : Limits := {}
+
+/-- Address-keyed persistent records. Extra stale keys are permitted; duplicate
+keys are rejected before lookup so list order cannot choose a winner. -/
+structure Store where
+  entries : List (Address × ByteArray)
+  deriving BEq, Inhabited
+
+private def storeEntryBytes (entry : Address × ByteArray) : ByteArray :=
+  Encoding.address entry.1 ++ Encoding.blob entry.2
+
+private def storeEntrySize (entry : Address × ByteArray) : Nat :=
+  (Encoding.address entry.1).size +
+    (Encoding.nat entry.2.size).size + entry.2.size
+
+/-- Sort lookup keys lexicographically without changing their record bytes.
+This makes snapshots independent of insertion and rebuild history. -/
+def Store.canonicalize (store : Store) : Store :=
+  ⟨(store.entries.toArray.qsort fun left right =>
+      Ixon.Merkle.compareAddress left.1 right.1 == .lt).toList⟩
+
+/-- Canonical deterministic spelling of a complete persistent store. -/
+def encodeStore (store : Store) : ByteArray :=
+  storeDomain ++ Encoding.list storeEntryBytes store.canonicalize.entries
+
+/-- Exact size of the canonical complete-store spelling, computed without
+materializing that spelling. Sorting does not affect this sum. Filesystem
+adapters use it to enforce the complete-file budget before opening a staging
+file. -/
+def Store.framedSize (store : Store) : Nat :=
+  storeDomain.size + (Encoding.nat store.entries.length).size +
+    store.entries.foldl (fun total entry => total + storeEntrySize entry) 0
+
+structure IngressStats where
+  entries : Nat := 0
+  bytes : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+/-- Result of an untrusted cache lookup. Storage adapters may distinguish an
+absent key from a present chunk whose outer framing could not be admitted, so
+the latter is reported as a local rejection and rebuilt instead of aborting an
+otherwise usable cache. -/
+inductive LookupResult where
+  | missing
+  | found (bytes : ByteArray)
+  | rejected (reason : String)
+  deriving BEq
+
+private def enforce (label : String) (actual limit : Nat) :
+    Except String Unit :=
+  if actual ≤ limit then .ok ()
+  else .error s!"HPT cache {label} budget exceeded: {actual} > {limit}"
+
+/-- Linear aggregate admission scan and duplicate-key rejection. -/
+def Store.preflight (limits : Limits) (store : Store) :
+    Except String IngressStats := do
+  let mut entries := 0
+  let mut bytes := 0
+  for entry in store.entries do
+    entries := entries + 1
+    enforce "entry" entries limits.maxEntries
+    bytes := bytes + entry.2.size
+    enforce "input-byte" bytes limits.maxBytes
+  let index := AddressEnv.build (store.entries.map fun entry => (entry.1, ()))
+  if index.size != entries then
+    throw "HPT cache contains duplicate lookup keys"
+  return { entries, bytes }
+
+/-- Validate individual and aggregate payload policy, canonicalize lookup
+order, and enforce the exact complete-file budget without constructing the
+complete byte array. -/
+def prepareStoreWith (limits : Limits) (store : Store) :
+    Except String Store := do
+  let _ ← store.preflight limits
+  for entry in store.entries do
+    enforce "record-byte" entry.2.size limits.maxEntryBytes
+  let canonical := store.canonicalize
+  enforce "store-byte" canonical.framedSize limits.maxStoreBytes
+  return canonical
+
+/-- Validate individual/aggregate payload policy and produce the canonical
+framed store. -/
+def encodeStoreWith (limits : Limits) (store : Store) :
+    Except String ByteArray := do
+  let canonical ← prepareStoreWith limits store
+  return storeDomain ++ Encoding.list storeEntryBytes canonical.entries
+
+private def Store.index (store : Store) : AddressEnv.Index ByteArray :=
+  AddressEnv.build store.entries
+
+private def getNatBoundedFuel (label : String) : Nat → Nat → GetM Nat
+  | _, 0 => throw s!"HPT cache {label} numeral exceeds its bounded width"
+  | limit, fuel + 1 => do
+      let byte ← getU8
+      let low := byte.toNat % 128
+      if byte.toNat < 128 then
+        if low ≤ limit then return low
+        throw s!"HPT cache {label} value exceeds {limit}"
+      let high ← getNatBoundedFuel label (limit / 128) fuel
+      let value := low + 128 * high
+      if value ≤ limit then return value
+      throw s!"HPT cache {label} value exceeds {limit}"
+
+/-- Read no more chunks than the largest canonical numeral permitted by the
+policy. Recursive quotients are capped before multiplication, so hostile LEB
+input cannot first construct an effectively unbounded `Nat`. -/
+private def getNatBounded (label : String) (limit : Nat) : GetM Nat :=
+  getNatBoundedFuel label limit (Encoding.nat limit).size
+
+private def getCount (label : String) (limit : Nat) : GetM Nat := do
+  getNatBounded s!"{label} count" limit
+
+private def getList (label : String) (limit : Nat) (getOne : GetM α) :
+    GetM (List α) := do
+  let count ← getCount label limit
+  let mut values : Array α := #[]
+  for _ in [:count] do
+    values := values.push (← getOne)
+  return values.toList
+
+private def getCtorId (limits : Limits) : GetM CtorId := do
+  let block ← Decode.getAddress
+  let indIdx ← getNatBounded "constructor inductive-index"
+    limits.producer.checker.maxShapeIndex
+  let cidx ← getNatBounded "constructor index"
+    limits.producer.checker.maxShapeIndex
+  return ⟨block, indIdx, cidx⟩
+
+mutual
+
+private def getFieldShape (limits : Limits) (remainingDepth : Nat) :
+    GetM FieldShape := do
+  match (← getU8).toNat with
+  | 0 =>
+      let identity ← getCtorId limits
+      match (← getU8).toNat with
+      | 0 => return .ctor identity none
+      | 1 =>
+          let fields ← getList "nested-constructor-field"
+            limits.producer.checker.maxFieldsPerShape
+            (getFieldFact limits remainingDepth)
+          return .ctor identity (some fields)
+      | tag => throw s!"HPT cache nested-constructor-field option tag {tag}"
+  | 1 =>
+      let function ← Decode.getAddress
+      let filled ← getNatBounded "PAP fill"
+        limits.producer.checker.maxShapeIndex
+      return .pap function filled
+  | tag => throw s!"HPT cache field-shape tag {tag}"
+termination_by 2 * remainingDepth + 1
+decreasing_by omega
+
+private def getFieldFact (limits : Limits) : Nat → GetM FieldFact
+  | 0 => throw "HPT cache recursive field depth exceeds configured limit"
+  | remainingDepth + 1 => do
+      let mayScalar ← Decode.getBool
+      let unknownHeap ← Decode.getBool
+      let shapes ← getList "field-shape"
+        limits.producer.checker.maxShapesPerFact
+        (getFieldShape limits remainingDepth)
+      return ⟨mayScalar, unknownHeap, shapes⟩
+termination_by remainingDepth => 2 * remainingDepth
+decreasing_by omega
+
+end
+
+private def getHeapShape (limits : Limits) : GetM HeapShape := do
+  match (← getU8).toNat with
+  | 0 =>
+      let identity ← getCtorId limits
+      match (← getU8).toNat with
+      | 0 => return .ctor identity none
+      | 1 =>
+          let fields ← getList "constructor-field"
+            limits.producer.checker.maxFieldsPerShape
+            (getFieldFact limits limits.producer.checker.maxFieldDepth)
+          return .ctor identity (some fields)
+      | tag => throw s!"HPT cache constructor-field option tag {tag}"
+  | 1 =>
+      let function ← Decode.getAddress
+      let filled ← getNatBounded "PAP fill"
+        limits.producer.checker.maxShapeIndex
+      return .pap function filled
+  | tag => throw s!"HPT cache heap-shape tag {tag}"
+
+private def getFact (limits : Limits) : GetM Fact := do
+  let mayScalar ← Decode.getBool
+  let unknownHeap ← Decode.getBool
+  let shapes ← getList "result-shape"
+    limits.producer.checker.maxShapesPerFact (getHeapShape limits)
+  return ⟨mayScalar, unknownHeap, shapes⟩
+
+private def getKind : GetM ArtifactKind := do
+  match (← getU8).toNat with
+  | 0 => return .stable
+  | 1 => return .ordinary
+  | 2 => return .mutual
+  | tag => throw s!"HPT cache artifact-kind tag {tag}"
+
+private def getMember (limits : Limits) : GetM (Address × Fact) := do
+  return (← Decode.getAddress, ← getFact limits)
+
+private def getArtifact (limits : Limits) : GetM Artifact := do
+  Decode.expectBytes recordDomain
+  let kind ← getKind
+  let programIdentity ← Decode.getAddress
+  let dependencies ← getList "dependency"
+    limits.producer.checker.maxProgramArtifacts Decode.getAddress
+  let cacheKey ← Decode.getAddress
+  let members ← getList "member"
+    limits.producer.checker.maxCertificateMembers (getMember limits)
+  let address ← Decode.getAddress
+  return ⟨kind, programIdentity, members, dependencies, cacheKey, address⟩
+
+private def getStore (limits : Limits) : GetM Store := do
+  Decode.expectBytes storeDomain
+  let count ← getCount "store-entry" limits.maxEntries
+  let mut entries : Array (Address × ByteArray) := #[]
+  let mut totalBytes := 0
+  for _ in [:count] do
+    let key ← Decode.getAddress
+    let size ← getNatBounded "record-byte count" limits.maxEntryBytes
+    totalBytes := totalBytes + size
+    if totalBytes > limits.maxBytes then
+      throw s!"HPT cache input-byte count exceeds {limits.maxBytes}"
+    let bytes ← getBytes size
+    entries := entries.push (key, bytes)
+  return ⟨entries.toList⟩
+
+/-- Strict full-consumption, byte-for-byte canonical record decoder. -/
+def decodeArtifactWith (limits : Limits) (bytes : ByteArray) :
+    Except String Artifact := do
+  enforce "record-byte" bytes.size limits.maxEntryBytes
+  Decode.runCanonical (getArtifact limits) encodeArtifact bytes
+
+def decodeArtifact (bytes : ByteArray) : Except String Artifact :=
+  decodeArtifactWith defaultLimits bytes
+
+/-- Strict, resource-bounded, canonical decoder for a complete store file.
+The outer size gate runs before parsing; record lengths and their aggregate are
+checked before the corresponding byte arrays are copied. -/
+def decodeStoreWith (limits : Limits) (bytes : ByteArray) :
+    Except String Store := do
+  enforce "store-byte" bytes.size limits.maxStoreBytes
+  let store ← Decode.runCanonical (getStore limits) encodeStore bytes
+  let _ ← store.preflight limits
+  return store
+
+def decodeStore (bytes : ByteArray) : Except String Store :=
+  decodeStoreWith defaultLimits bytes
+
+/-- A complete store spelling for a checked result. -/
+def Store.ofResult (result : Result) : Store :=
+  ⟨result.artifacts.map fun artifact =>
+    (artifact.cacheKey, encodeArtifact artifact)⟩
+
+/-- Replace or add rebuilt records. Keys not mentioned by the current program
+remain available for other program versions sharing the same store. -/
+def Store.applyWrites (store : Store) (writes : List (Address × ByteArray)) :
+    Store :=
+  let keys := writes.map (·.1)
+  ⟨store.entries.filter (fun entry => !keys.contains entry.1) ++ writes⟩
+
+structure Rejection where
+  cacheKey : Address
+  reason : String
+  deriving BEq, Repr
+
+structure Stats where
+  ingressEntries : Nat := 0
+  ingressBytes : Nat := 0
+  hits : Nat := 0
+  misses : Nat := 0
+  rejected : Nat := 0
+  rounds : Nat := 0
+  widenedArtifacts : Nat := 0
+  writes : Nat := 0
+  writeBytes : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+/-- Proof-carrying cache schedule result. `writes` contains only missing or
+rejected records; `completeStore` can be used for a compact exact snapshot. -/
+structure Production (limits : Limits)
+    (program : List ReaddressAll.Artifact) where
+  certificate : Certificate
+  result : Result
+  stats : Stats
+  rejections : List Rejection
+  writes : List (Address × ByteArray)
+  checked : runWith limits.producer.checker program certificate = .ok result
+
+namespace Production
+
+def completeStore {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program) : Store :=
+  Store.ofResult production.result
+
+theorem postFixpoint {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program) :
+    production.certificate.postFixpoint program = true :=
+  postFixpoint_of_runWith_eq_ok production.checked
+
+theorem semanticAudit {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program) :
+    production.result.semanticAudit = true :=
+  semanticAudit_of_runWith_eq_ok production.checked
+
+theorem functionSummary_sound
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program)
+    {ctx : Ctx} {address : Address} {function : FnDef} {claimed : Fact}
+    {arguments : List RVal}
+    {store outputStore : Ix.Compiler.IxIR1.Store}
+    {outputValue : RVal} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program)
+    (hdeclaration : programDeclEnv program address = some (.fn function))
+    (hsummary : production.certificate.summaryEnv address = some claimed)
+    (hinvoke : invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds (programDeclEnv program) outputStore outputValue := by
+  exact functionSummary_sound_of_runWith_eq_ok production.checked hctx
+    hdeclaration hsummary hinvoke
+
+end Production
+
+private structure AcceptedHit where
+  candidate : CandidateArtifact
+  artifact : Artifact
+  summaries : AddressEnv.Index Fact
+  totalShapes : Nat
+  totalFields : Nat
+
+private structure ScheduleState where
+  candidatesRev : List CandidateArtifact := []
+  artifactsRev : List Artifact := []
+  owners : List (Address × Address) := []
+  summaries : AddressEnv.Index Fact := AddressEnv.build []
+  totalShapes : Nat := 0
+  totalFields : Nat := 0
+  rounds : Nat := 0
+  remainingRounds : Nat := 0
+  widenedArtifacts : Nat := 0
+  hits : Nat := 0
+  misses : Nat := 0
+  rejected : Nat := 0
+  rejectionsRev : List Rejection := []
+  writesRev : List (Address × ByteArray) := []
+  writeBytes : Nat := 0
+
+private def ownersFor (artifact : Artifact) : List (Address × Address) :=
+  artifact.members.map fun member => (member.1, artifact.address)
+
+private def validateHit (limits : Limits) (declarations : DeclEnv)
+    (state : ScheduleState) (program : ReaddressAll.Artifact)
+    (query : Query) (bytes : ByteArray) : Except String AcceptedHit := do
+  let artifact ← decodeArtifactWith limits bytes
+  unless query.agreesWith artifact do
+    throw "record does not match the current cache query"
+  unless artifact.semanticAudit do
+    throw "record failed its content-address or canonicality audit"
+  let candidate : CandidateArtifact :=
+    { programIdentity := artifact.programIdentity
+      members := artifact.members }
+  let summaries := Producer.extendSummaries state.summaries candidate.members
+  unless candidate.localPostFixpoint declarations
+      (AddressEnv.lookup summaries) program do
+    throw "record is not an artifact-local post-fixpoint"
+  let (totalShapes, totalFields) ← Producer.validatePayload
+    limits.producer.checker state.totalShapes state.totalFields candidate.members
+  return ⟨candidate, artifact, summaries, totalShapes, totalFields⟩
+
+private def acceptHit (state : ScheduleState) (hit : AcceptedHit) :
+    ScheduleState :=
+  { state with
+    candidatesRev := hit.candidate :: state.candidatesRev
+    artifactsRev := hit.artifact :: state.artifactsRev
+    owners := ownersFor hit.artifact ++ state.owners
+    summaries := hit.summaries
+    totalShapes := hit.totalShapes
+    totalFields := hit.totalFields
+    hits := state.hits + 1 }
+
+private def rebuild (limits : Limits) (declarations : DeclEnv)
+    (state : ScheduleState) (program : ReaddressAll.Artifact)
+    (query : Query) (rejection : Option String) : Except String ScheduleState := do
+  let produced ← Producer.produceArtifactWith limits.producer declarations
+    state.summaries program state.totalShapes state.totalFields
+    state.remainingRounds
+  let artifact := Artifact.ofQuery query produced.candidate.members
+  unless artifact.semanticAudit do
+    throw "internal: rebuilt HPT cache artifact failed its semantic audit"
+  rejectCollision state.artifactsRev artifact
+  let bytes := encodeArtifact artifact
+  enforce "record-byte" bytes.size limits.maxEntryBytes
+  let writeBytes := state.writeBytes + bytes.size
+  enforce "output-byte" writeBytes limits.maxWriteBytes
+  let rejected := state.rejected + if rejection.isSome then 1 else 0
+  let rejectionsRev := match rejection with
+    | some reason => Rejection.mk query.cacheKey reason :: state.rejectionsRev
+    | none => state.rejectionsRev
+  pure ({ state with
+      candidatesRev := produced.candidate :: state.candidatesRev
+      artifactsRev := artifact :: state.artifactsRev
+      owners := ownersFor artifact ++ state.owners
+      summaries := produced.summaries
+      totalShapes := produced.totalShapes
+      totalFields := produced.totalFields
+      rounds := state.rounds + produced.rounds
+      remainingRounds := produced.remainingRounds
+      widenedArtifacts := state.widenedArtifacts +
+        (if produced.widened then 1 else 0)
+      misses := state.misses + 1
+      rejected := rejected
+      rejectionsRev := rejectionsRev
+      writesRev := (query.cacheKey, bytes) :: state.writesRev
+      writeBytes := writeBytes } : ScheduleState)
+
+/-- Validate effectfully supplied cache hits and rebuild misses one dependency
+artifact at a time, then submit the assembled candidate to the ordinary
+whole-program checker. The lookup is untrusted: every returned record crosses
+the same canonical decoder, exact-query audit, local post-fixpoint check, and
+final checker as an in-memory store. -/
+def runLookupWithM {m : Type → Type} [Monad m] [MonadExceptOf String m]
+    (limits : Limits) (program : List ReaddressAll.Artifact)
+    (ingress : IngressStats) (lookup : Address → m LookupResult) :
+    m (Production limits program) := do
+  let _ ← ofExcept <|
+    preflight limits.producer.checker program (Certificate.top program)
+  let declarations := programDeclEnv program
+  let mut state : ScheduleState :=
+    { remainingRounds := limits.producer.maxRounds }
+  for programArtifact in program do
+    let query ← ofExcept <|
+      Query.ofProgram declarations state.owners programArtifact
+    match ← lookup query.cacheKey with
+    | .missing =>
+        state ← ofExcept <|
+          rebuild limits declarations state programArtifact query none
+    | .rejected reason =>
+        state ← ofExcept <|
+          rebuild limits declarations state programArtifact query (some reason)
+    | .found bytes =>
+        match validateHit limits declarations state programArtifact query bytes with
+        | .error reason =>
+            state ← ofExcept <| rebuild limits declarations state programArtifact
+              query (some reason)
+        | .ok hit =>
+            let _ ← ofExcept <| rejectCollision state.artifactsRev hit.artifact
+            state := acceptHit state hit
+  let certificate : Certificate := ⟨state.candidatesRev.reverse⟩
+  match hrun : HPT.runWith limits.producer.checker program certificate with
+  | .error error => throw error
+  | .ok result =>
+      if result.artifacts != state.artifactsRev.reverse then
+        throw "internal: cache schedule and final materialization diverged"
+      let stats : Stats :=
+        { ingressEntries := ingress.entries
+          ingressBytes := ingress.bytes
+          hits := state.hits
+          misses := state.misses
+          rejected := state.rejected
+          rounds := state.rounds
+          widenedArtifacts := state.widenedArtifacts
+          writes := state.writesRev.length
+          writeBytes := state.writeBytes }
+      pure (⟨certificate, result, stats, state.rejectionsRev.reverse,
+        state.writesRev.reverse, hrun⟩ : Production limits program)
+
+/-- In-memory specialization of `runLookupWithM`. Its aggregate admission
+statistics cover the complete supplied store, including stale records. -/
+def runWith (limits : Limits) (program : List ReaddressAll.Artifact)
+    (store : Store) : Except String (Production limits program) := do
+  let ingress ← store.preflight limits
+  let index := store.index
+  runLookupWithM limits program ingress fun key =>
+    pure <| match index.get? key with
+      | none => .missing
+      | some bytes => .found bytes
+
+def run (program : List ReaddressAll.Artifact) (store : Store) :
+    Except String (Production defaultLimits program) :=
+  runWith defaultLimits program store
+
+end Ix.Compiler.IxIR1.HPT.Cache
diff --git a/Ix/Compiler/IxIR1/HPTCacheDirIO.lean b/Ix/Compiler/IxIR1/HPTCacheDirIO.lean
new file mode 100644
index 000000000..32139dfb1
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTCacheDirIO.lean
@@ -0,0 +1,262 @@
+import Ix.Compiler.IxIR1.HPTCacheIO
+
+/-!
+# Indexed chunk-directory adapter for checked HPT caches
+
+The single-file adapter streams framing but ultimately returns one in-memory
+`Cache.Store`. This adapter uses the filesystem namespace as a content-key
+index: each lookup key names one canonical singleton-store file. Directory
+ingress retains only key, length, and rejection metadata, while the cache
+scheduler opens at most the records selected by the current dependency chain.
+
+Every selected payload remains untrusted and crosses `Cache.runLookupWithM`'s
+ordinary record decoder, exact-query/content audits, local post-fixpoint check,
+and final whole-program checker. Missing or malformed chunks are rebuilt and
+published independently through `CacheIO.saveFileWith`, so a partial update is
+safe and each successful replacement inherits the ledgered stable-storage
+protocol. Recognizable orphan transaction directories are ignored.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.CacheDirIO
+
+open System (FilePath)
+open Ix.Compiler.IxIR
+open Ix.Compiler.Ixon (Address)
+
+/-- Independent controls for metadata-scale indexing and per-run lazy reads.
+The embedded cache limits still bound every record, producer/checker work, and
+new-record output. `maxIndexBytes` counts complete framed chunk files without
+loading their payloads; `maxReadBytes` counts payloads selected in one run. -/
+structure Limits where
+  cache : Cache.Limits := {}
+  maxIndexEntries : Nat := 1024 * 1024
+  maxIndexBytes : Nat := 256 * 1024 * 1024 * 1024
+  maxReadBytes : Nat := 64 * 1024 * 1024
+  deriving BEq, Repr
+
+def defaultLimits : Limits := {}
+
+def recordFileSuffix : String := ".hpt"
+
+def recordFileName (key : Address) : String :=
+  key.toHex ++ recordFileSuffix
+
+private def hexNibble? (byte : UInt8) : Option Nat :=
+  let value := byte.toNat
+  if 48 ≤ value && value ≤ 57 then some (value - 48)
+  else if 97 ≤ value && value ≤ 102 then some (value - 87)
+  else none
+
+/-- Inverse of `recordFileName`; only the canonical lowercase 64-hex spelling
+with the exact suffix is accepted. -/
+def recordAddress? (name : String) : Option Address := do
+  let input := name.toUTF8
+  let suffix := recordFileSuffix.toUTF8
+  if input.size != 64 + suffix.size then none
+  else if input.extract 64 input.size != suffix then none
+  else
+    let mut output := ByteArray.empty
+    for index in [:32] do
+      let high ← hexNibble? input[2 * index]!
+      let low ← hexNibble? input[2 * index + 1]!
+      output := output.push (UInt8.ofNat (16 * high + low))
+    Address.ofBytes? output
+
+/-- An admitted header or a locally repairable malformed chunk. Complete file
+bytes are retained for directory-budget accounting without retaining payloads. -/
+inductive RecordMeta where
+  | admitted (payloadBytes framedBytes : Nat)
+  | rejected (reason : String) (framedBytes : Nat)
+  deriving BEq, Repr
+
+def RecordMeta.framedBytes : RecordMeta → Nat
+  | .admitted _ bytes => bytes
+  | .rejected _ bytes => bytes
+
+/-- Metadata-only directory index. `ingress.bytes` is framed on-disk bytes for
+this adapter (the in-memory adapter reports raw record payload bytes). -/
+structure Index where
+  directory : FilePath
+  records : AddressEnv.Index RecordMeta
+  ingress : Cache.IngressStats
+
+private def enforce (label : String) (actual limit : Nat) :
+    Except CacheIO.Error Unit :=
+  if actual ≤ limit then .ok ()
+  else .error (.cache s!"indexed HPT cache {label} budget exceeded: \
+    {actual} > {limit}")
+
+/-- Scan a cache directory into bounded metadata without retaining any record
+payload. Malformed canonical-name chunks stay in the index as local
+rejections; unknown names and non-regular record paths fail closed. -/
+def indexDirectoryWith (limits : Limits) (directory : FilePath) :
+    IO (Except CacheIO.Error Index) := do
+  try
+    let rootMetadata ← directory.symlinkMetadata
+    if rootMetadata.type != .dir then
+      return .error (.notDirectory directory.toString rootMetadata.type)
+    let entries ← directory.readDir
+    let mut records : Array (Address × RecordMeta) := #[]
+    let mut count := 0
+    let mut bytes := 0
+    for entry in entries do
+      let path := entry.path
+      let metadata ← path.symlinkMetadata
+      if CacheIO.isTransactionDirectoryName entry.fileName then
+        if metadata.type != .dir then
+          return .error (.notDirectory path.toString metadata.type)
+      else
+        let key ← match recordAddress? entry.fileName with
+          | some key => pure key
+          | none =>
+              return .error (.cache s!"unexpected indexed HPT cache entry: \
+                {path}")
+        if metadata.type != .file then
+          return .error (.notRegularFile path.toString metadata.type)
+        count := count + 1
+        match enforce "entry" count limits.maxIndexEntries with
+        | .error error => return .error error
+        | .ok () => pure ()
+        let framedBytes := metadata.byteSize.toNat
+        bytes := bytes + framedBytes
+        match enforce "framed-byte" bytes limits.maxIndexBytes with
+        | .error error => return .error error
+        | .ok () => pure ()
+        let recordMeta ← match ← CacheIO.inspectSingletonFileWith
+            limits.cache path with
+          | .error error => pure (.rejected error.describe framedBytes)
+          | .ok header =>
+              if header.key != key then
+                pure (.rejected
+                  "chunk header key does not match its canonical filename"
+                  framedBytes)
+              else
+                pure (.admitted header.payloadBytes framedBytes)
+        records := records.push (key, recordMeta)
+    let index := AddressEnv.build records.toList
+    if index.size != count then
+      return .error (.cache "indexed HPT cache contains duplicate keys")
+    return .ok ⟨directory, index, ⟨count, bytes⟩⟩
+  catch error =>
+    return .error (.io "index cache directory" directory.toString
+      error.toString)
+
+def indexDirectory (directory : FilePath) :
+    IO (Except CacheIO.Error Index) :=
+  indexDirectoryWith defaultLimits directory
+
+private def transactionParent (path : FilePath) : FilePath :=
+  path.parent.getD ("." : FilePath)
+
+private def syncDirectory (path : FilePath) : IO (Except CacheIO.Error Unit) := do
+  try
+    Ix.Compiler.DurableSync.directory path
+    return .ok ()
+  catch error =>
+    return .error (.io "durably sync directory" path.toString error.toString)
+
+/-- Create exactly the requested cache directory under an existing parent and
+persist its own metadata plus the new parent entry. -/
+private def ensureDirectory (directory : FilePath) :
+    IO (Except CacheIO.Error Unit) := do
+  match ← directory.symlinkMetadata.toBaseIO with
+  | .ok metadata =>
+      if metadata.type == .dir then return .ok ()
+      return .error (.notDirectory directory.toString metadata.type)
+  | .error (.noFileOrDirectory ..) =>
+      try
+        IO.FS.createDir directory
+      catch error =>
+        return .error (.io "create cache directory" directory.toString
+          error.toString)
+      match ← syncDirectory directory with
+      | .error error => return .error error
+      | .ok () => syncDirectory (transactionParent directory)
+  | .error error =>
+      return .error (.io "inspect cache directory" directory.toString
+        error.toString)
+
+private def chargeRead (limits : Limits) (readBytes : IO.Ref Nat)
+    (bytes : Nat) : ExceptT String IO Unit := do
+  let prior ← readBytes.get
+  if prior > limits.maxReadBytes || bytes > limits.maxReadBytes - prior then
+    throw s!"indexed HPT cache read-byte budget exceeded: \
+      {prior + bytes} > {limits.maxReadBytes}"
+  readBytes.set (prior + bytes)
+
+private def lookupRecord (limits : Limits) (index : Index)
+    (readBytes : IO.Ref Nat) (key : Address) :
+    ExceptT String IO Cache.LookupResult := do
+  match index.records.get? key with
+  | none => return .missing
+  | some (.rejected reason _) => return .rejected reason
+  | some (.admitted expectedBytes _) =>
+      chargeRead limits readBytes expectedBytes
+      let path := index.directory / recordFileName key
+      match ← CacheIO.loadFileWith limits.cache path with
+      | .error error => return .rejected error.describe
+      | .ok store =>
+          match store.entries with
+          | [(storedKey, bytes)] =>
+              if storedKey != key then
+                return .rejected
+                  "chunk payload key does not match its canonical filename"
+              if bytes.size != expectedBytes then
+                return .rejected
+                  "chunk payload size changed after directory indexing"
+              return .found bytes
+          | entries =>
+              return .rejected s!"indexed HPT cache chunk contains \
+                {entries.length} records; expected 1"
+
+private def projectedIndexWithinLimits (limits : Limits) (index : Index)
+    (writes : List (Address × ByteArray)) : Except CacheIO.Error Unit := do
+  let mut records := index.records
+  let mut count := index.ingress.entries
+  let mut bytes := index.ingress.bytes
+  for write in writes do
+    let framedBytes := (Cache.Store.mk [write]).framedSize
+    match records.get? write.1 with
+    | none => count := count + 1
+    | some old => bytes := bytes - old.framedBytes
+    bytes := bytes + framedBytes
+    enforce "entry" count limits.maxIndexEntries
+    enforce "framed-byte" bytes limits.maxIndexBytes
+    records := records.insert write.1 (.admitted write.2.size framedBytes)
+
+/-- Lazily schedule the current program against a metadata-only directory
+index, then durably publish only rebuilt records. Independent per-key commits
+make an interrupted multi-record refresh a safe mixture of old and new cache
+entries; dependency-addressed queries and the final checker determine reuse. -/
+def refreshDirectoryWith (limits : Limits)
+    (program : List ReaddressAll.Artifact) (directory : FilePath) :
+    IO (Except CacheIO.Error (Cache.Production limits.cache program)) := do
+  match ← ensureDirectory directory with
+  | .error error => return .error error
+  | .ok () => pure ()
+  let index ← match ← indexDirectoryWith limits directory with
+    | .error error => return .error error
+    | .ok index => pure index
+  let readBytes ← IO.mkRef 0
+  let scheduled ← (Cache.runLookupWithM limits.cache program index.ingress
+    (lookupRecord limits index readBytes)).run
+  let production ← match scheduled with
+    | .error message => return .error (.cache message)
+    | .ok production => pure production
+  match projectedIndexWithinLimits limits index production.writes with
+  | .error error => return .error error
+  | .ok () => pure ()
+  for write in production.writes do
+    let path := directory / recordFileName write.1
+    match ← CacheIO.saveFileWith limits.cache path ⟨[write]⟩ with
+    | .error error => return .error error
+    | .ok () => pure ()
+  return .ok production
+
+def refreshDirectory (program : List ReaddressAll.Artifact)
+    (directory : FilePath) :
+    IO (Except CacheIO.Error
+      (Cache.Production defaultLimits.cache program)) :=
+  refreshDirectoryWith defaultLimits program directory
+
+end Ix.Compiler.IxIR1.HPT.CacheDirIO
diff --git a/Ix/Compiler/IxIR1/HPTCacheIO.lean b/Ix/Compiler/IxIR1/HPTCacheIO.lean
new file mode 100644
index 000000000..06eedd401
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTCacheIO.lean
@@ -0,0 +1,471 @@
+import Ix.Compiler.IxIR1.HPTCache
+import Ix.Compiler.DurableSync
+
+/-!
+# Filesystem adapter for checked HPT caches
+
+The analysis/cache scheduler remains pure. This module persists its `Store` as
+one versioned, canonically ordered file. Reads reject symlinks and non-regular
+files, gate the observed byte count before allocation, and stream the strict
+outer grammar one bounded record at a time. A missing file is an empty cache
+only through the explicitly named `loadFileOrEmptyWith` entry.
+
+Writes validate the aggregate store policy and canonicalize its outer framing
+before touching the filesystem; record blobs deliberately remain untrusted
+until a query consumes them. The adapter refuses an existing non-regular
+destination, streams and verifies a fresh sibling staging file, flushes its
+runtime buffer, requests stable storage for the staged file and transaction
+directory, and commits with the runtime's POSIX-style atomic `rename`. It then
+syncs both directories affected by that cross-directory rename. An interruption
+before rename leaves the old cache intact; an orphan staging directory is never
+considered by ingress. On the ledger's supported filesystem baseline, a
+successful return makes the complete replacement power-loss durable. The small
+native sync boundary and the storage device's reported guarantees remain
+explicit trust assumptions.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.CacheIO
+
+open System (FilePath)
+open Ix.Compiler.IxIR
+
+/-- Sibling transaction directories are deliberately recognizable so callers
+can inspect crash leftovers without treating them as cache inputs. The adapter
+removes only the directory created by its own invocation. -/
+def transactionDirectoryPrefix : String := ".compilatrix-hpt-"
+
+def transactionDirectorySuffix : String := ".txn"
+
+def isTransactionDirectoryName (name : String) : Bool :=
+  name.startsWith transactionDirectoryPrefix &&
+    name.endsWith transactionDirectorySuffix
+
+inductive Error where
+  | io (operation path message : String)
+  | notRegularFile (path : String) (actual : IO.FS.FileType)
+  | notDirectory (path : String) (actual : IO.FS.FileType)
+  | fileBytes (actual limit : Nat)
+  | cache (message : String)
+  deriving Repr
+
+private abbrev ReadM := StateT Nat (ExceptT Error IO)
+
+private partial def readExactLoop (handle : IO.FS.Handle) (label : String)
+    (remaining : Nat) (acc : ByteArray) : ReadM ByteArray := do
+  if remaining == 0 then
+    return acc
+  let request := min remaining 65536
+  let chunk ← liftM (handle.read request.toUSize)
+  if chunk.isEmpty then
+    throw (.cache s!"truncated HPT cache {label}")
+  let consumed ← get
+  set (consumed + chunk.size)
+  readExactLoop handle label (remaining - chunk.size) (acc ++ chunk)
+
+/-- Read exactly one bounded grammar component. The caller's state is the
+number of file bytes consumed, so a file that changes after the metadata gate
+still cannot make this adapter allocate beyond `maxStoreBytes`. -/
+private def readExact (handle : IO.FS.Handle) (limit : Nat) (label : String)
+    (size : Nat) : ReadM ByteArray := do
+  let consumed ← get
+  if consumed > limit || size > limit - consumed then
+    throw (.fileBytes (consumed + size) limit)
+  readExactLoop handle label size .empty
+
+private def expectBytes (handle : IO.FS.Handle) (limit : Nat)
+    (label : String) (expected : ByteArray) : ReadM Unit := do
+  let actual ← readExact handle limit label expected.size
+  if actual != expected then
+    throw (.cache s!"unexpected HPT cache {label}")
+
+/-- Incremental canonical unsigned-LEB reader. Its width comes from the
+largest policy value, and every contribution is checked before multiplication
+can construct a value above that policy. -/
+private def readNatBounded (handle : IO.FS.Handle) (storeLimit : Nat)
+    (label : String) (limit : Nat) : ReadM Nat := do
+  let width := (Encoding.nat limit).size
+  let mut value := 0
+  let mut multiplier := 1
+  let mut spelling := ByteArray.empty
+  for _ in [:width] do
+    let bytes ← readExact handle storeLimit label 1
+    let byte := bytes[0]!
+    spelling := spelling ++ bytes
+    let low := byte.toNat % 128
+    if low > (limit - value) / multiplier then
+      throw (.cache s!"HPT cache {label} value exceeds {limit}")
+    value := value + low * multiplier
+    if byte.toNat < 128 then
+      if spelling != Encoding.nat value then
+        throw (.cache s!"noncanonical HPT cache {label}")
+      return value
+    multiplier := multiplier * 128
+  throw (.cache s!"HPT cache {label} numeral exceeds its bounded width")
+
+private def readAddress (handle : IO.FS.Handle) (limit : Nat)
+    (label : String) : ReadM Ixon.Address := do
+  let bytes ← readExact handle limit label 32
+  match Ixon.Address.ofBytes? bytes with
+  | some address => return address
+  | none => throw (.cache "internal: streamed address did not contain 32 bytes")
+
+private def finishRead (handle : IO.FS.Handle) (path : FilePath)
+    (observed limit : Nat) : ReadM Unit := do
+  let extra ← liftM (handle.read 1)
+  if !extra.isEmpty then
+    let consumed ← get
+    let actual := consumed + extra.size
+    set actual
+    if actual > limit then
+      throw (.fileBytes actual limit)
+    throw (.cache "trailing bytes after canonical HPT cache store")
+  let consumed ← get
+  if consumed != observed then
+    throw (.io "read" path.toString
+      s!"file size changed during ingress: observed {observed}, consumed {consumed}")
+
+private def readStore (limits : Cache.Limits) (path : FilePath)
+    (observed : Nat) (handle : IO.FS.Handle) : ReadM Cache.Store := do
+  expectBytes handle limits.maxStoreBytes "store domain" Cache.storeDomain
+  let count ← readNatBounded handle limits.maxStoreBytes
+    "store-entry count" limits.maxEntries
+  let mut entries : Array (Ixon.Address × ByteArray) := #[]
+  let mut previous : Option Ixon.Address := none
+  let mut totalBytes := 0
+  for _ in [:count] do
+    let key ← readAddress handle limits.maxStoreBytes "lookup key"
+    match previous with
+    | some prior =>
+        if Ixon.Merkle.compareAddress prior key != .lt then
+          throw (.cache "noncanonical HPT cache lookup-key order")
+    | none => pure ()
+    let size ← readNatBounded handle limits.maxStoreBytes
+      "record-byte count" limits.maxEntryBytes
+    totalBytes := totalBytes + size
+    if totalBytes > limits.maxBytes then
+      throw (.cache s!"HPT cache input-byte count exceeds {limits.maxBytes}")
+    let bytes ← readExact handle limits.maxStoreBytes "record payload" size
+    entries := entries.push (key, bytes)
+    previous := some key
+  finishRead handle path observed limits.maxStoreBytes
+  let store : Cache.Store := ⟨entries.toList⟩
+  match store.preflight limits with
+  | .ok _ => return store
+  | .error message => throw (.cache message)
+
+/-- Metadata retained by the chunk-directory index. Inspecting a singleton
+store reads only its fixed framing and bounded length numeral; the record
+payload remains on disk until the checked scheduler asks for that key. -/
+structure SingletonHeader where
+  key : Ixon.Address
+  payloadBytes : Nat
+  deriving BEq, Repr
+
+private def readSingletonHeader (limits : Cache.Limits) (_path : FilePath)
+    (observed : Nat) (handle : IO.FS.Handle) : ReadM SingletonHeader := do
+  expectBytes handle limits.maxStoreBytes "store domain" Cache.storeDomain
+  let count ← readNatBounded handle limits.maxStoreBytes
+    "store-entry count" limits.maxEntries
+  if count != 1 then
+    throw (.cache s!"indexed HPT cache chunk contains {count} records; expected 1")
+  let key ← readAddress handle limits.maxStoreBytes "lookup key"
+  let size ← readNatBounded handle limits.maxStoreBytes
+    "record-byte count" limits.maxEntryBytes
+  let consumed ← get
+  if consumed + size != observed then
+    throw (.cache s!"indexed HPT cache chunk declares {size} payload bytes, but \
+      its framed file has {observed} bytes")
+  return ⟨key, size⟩
+
+private def readKnownFileWith (limits : Cache.Limits) (path : FilePath)
+    (metadata : IO.FS.Metadata) : IO (Except Error Cache.Store) := do
+  if metadata.type != .file then
+    return .error (.notRegularFile path.toString metadata.type)
+  let observed := metadata.byteSize.toNat
+  if observed > limits.maxStoreBytes then
+    return .error (.fileBytes observed limits.maxStoreBytes)
+  try
+    let handle ← IO.FS.Handle.mk path .read
+    let result ← ((readStore limits path observed handle).run 0).run
+    return result.map Prod.fst
+  catch error =>
+    return .error (.io "read" path.toString error.toString)
+
+/-- Read one existing cache file through metadata, byte, framing, aggregate,
+and duplicate-key gates. Missing files are errors at this entry point. -/
+def loadFileWith (limits : Cache.Limits) (path : FilePath) :
+    IO (Except Error Cache.Store) := do
+  try
+    let metadata ← path.symlinkMetadata
+    readKnownFileWith limits path metadata
+  catch error =>
+    return .error (.io "inspect" path.toString error.toString)
+
+def loadFile (path : FilePath) : IO (Except Error Cache.Store) :=
+  loadFileWith Cache.defaultLimits path
+
+/-- Inspect a canonical one-record store without reading its record payload.
+The full file is re-opened and validated if the lazy scheduler later selects
+the key, so a concurrent change cannot make this header an acceptance proof. -/
+def inspectSingletonFileWith (limits : Cache.Limits) (path : FilePath) :
+    IO (Except Error SingletonHeader) := do
+  try
+    let metadata ← path.symlinkMetadata
+    if metadata.type != .file then
+      return .error (.notRegularFile path.toString metadata.type)
+    let observed := metadata.byteSize.toNat
+    if observed > limits.maxStoreBytes then
+      return .error (.fileBytes observed limits.maxStoreBytes)
+    let handle ← IO.FS.Handle.mk path .read
+    let result ← ((readSingletonHeader limits path observed handle).run 0).run
+    return result.map Prod.fst
+  catch error =>
+    return .error (.io "inspect indexed chunk" path.toString error.toString)
+
+def inspectSingletonFile (path : FilePath) :
+    IO (Except Error SingletonHeader) :=
+  inspectSingletonFileWith Cache.defaultLimits path
+
+/-- Cold-start entry: only an absent path denotes an empty store. Existing
+malformed, oversized, duplicate-key, symlink, and non-file inputs still fail. -/
+def loadFileOrEmptyWith (limits : Cache.Limits) (path : FilePath) :
+    IO (Except Error Cache.Store) := do
+  match ← path.symlinkMetadata.toBaseIO with
+  | .ok metadata => readKnownFileWith limits path metadata
+  | .error (.noFileOrDirectory ..) => return .ok ⟨[]⟩
+  | .error error =>
+      return .error (.io "inspect" path.toString error.toString)
+
+def loadFileOrEmpty (path : FilePath) : IO (Except Error Cache.Store) :=
+  loadFileOrEmptyWith Cache.defaultLimits path
+
+private def validateWriteTarget (path : FilePath) : IO (Except Error Unit) := do
+  match ← path.symlinkMetadata.toBaseIO with
+  | .ok metadata =>
+      if metadata.type == .file then
+        return .ok ()
+      return .error (.notRegularFile path.toString metadata.type)
+  | .error (.noFileOrDirectory ..) => return .ok ()
+  | .error error =>
+      return .error (.io "inspect output" path.toString error.toString)
+
+def Error.describe : Error → String
+  | .io operation path message => s!"{operation} {path}: {message}"
+  | .notRegularFile path actual =>
+      s!"{path} is not a regular file ({repr actual})"
+  | .notDirectory path actual =>
+      s!"{path} is not a directory ({repr actual})"
+  | .fileBytes actual limit =>
+      s!"HPT cache store-byte budget exceeded: {actual} > {limit}"
+  | .cache message => message
+
+private def verifyExpectedStore (limits : Cache.Limits) (path : FilePath)
+    (observed : Nat) (handle : IO.FS.Handle)
+    (expected : Cache.Store) : ReadM Unit := do
+  expectBytes handle limits.maxStoreBytes "store domain" Cache.storeDomain
+  let count ← readNatBounded handle limits.maxStoreBytes
+    "store-entry count" limits.maxEntries
+  if count != expected.entries.length then
+    throw (.cache s!"staged store has {count} entries; expected \
+      {expected.entries.length}")
+  for entry in expected.entries do
+    let key ← readAddress handle limits.maxStoreBytes "lookup key"
+    if key != entry.1 then
+      throw (.cache "staged HPT cache lookup key differs from canonical store")
+    let size ← readNatBounded handle limits.maxStoreBytes
+      "record-byte count" limits.maxEntryBytes
+    if size != entry.2.size then
+      throw (.cache s!"staged HPT cache record has {size} bytes; expected \
+        {entry.2.size}")
+    let bytes ← readExact handle limits.maxStoreBytes "record payload" size
+    if bytes != entry.2 then
+      throw (.cache "staged HPT cache record differs from canonical store")
+  finishRead handle path observed limits.maxStoreBytes
+
+/-- Verify the staging file against the expected canonical store while
+retaining at most one newly read record payload. -/
+private def verifyStreamedFile (limits : Cache.Limits) (operation : String)
+    (path : FilePath) (expectedSize : Nat) (expected : Cache.Store) :
+    IO (Except Error Unit) := do
+  try
+    let metadata ← path.symlinkMetadata
+    if metadata.type != .file then
+      return .error (.notRegularFile path.toString metadata.type)
+    let observed := metadata.byteSize.toNat
+    if observed != expectedSize then
+      return .error (.io operation path.toString
+        s!"observed {observed} bytes, expected {expectedSize}")
+    if observed > limits.maxStoreBytes then
+      return .error (.fileBytes observed limits.maxStoreBytes)
+    let handle ← IO.FS.Handle.mk path .read
+    match ← ((verifyExpectedStore limits path observed handle expected).run 0).run with
+    | .ok _ => return .ok ()
+    | .error error =>
+        return .error (.io operation path.toString error.describe)
+  catch error =>
+    return .error (.io operation path.toString error.toString)
+
+private def writeChunk (handle : IO.FS.Handle) (limit : Nat)
+    (emitted : IO.Ref Nat) (bytes : ByteArray) : IO Unit := do
+  let count ← emitted.get
+  if count > limit || bytes.size > limit - count then
+    throw <| IO.userError
+      s!"HPT cache store-byte budget exceeded while writing: \
+        {count + bytes.size} > {limit}"
+  handle.write bytes
+  emitted.set (count + bytes.size)
+
+/-- Write the canonical outer grammar without constructing its concatenated
+byte array. Record payloads already belong to the in-memory `Store`; adapter
+scratch space is limited to the small framing chunks. -/
+private def writeStore (limits : Cache.Limits) (handle : IO.FS.Handle)
+    (store : Cache.Store) : IO Nat := do
+  let emitted ← IO.mkRef 0
+  writeChunk handle limits.maxStoreBytes emitted Cache.storeDomain
+  writeChunk handle limits.maxStoreBytes emitted
+    (Encoding.nat store.entries.length)
+  for entry in store.entries do
+    writeChunk handle limits.maxStoreBytes emitted entry.1.hash
+    writeChunk handle limits.maxStoreBytes emitted (Encoding.nat entry.2.size)
+    writeChunk handle limits.maxStoreBytes emitted entry.2
+  let actual ← emitted.get
+  let expected := store.framedSize
+  if actual != expected then
+    throw <| IO.userError
+      s!"internal HPT cache framed-size mismatch: wrote {actual}, expected {expected}"
+  return actual
+
+private def transactionParent (path : FilePath) : FilePath :=
+  path.parent.getD ("." : FilePath)
+
+private def createTransactionDirectory (path : FilePath) :
+    IO (Except Error FilePath) := do
+  let parent := transactionParent path
+  let rec loop : Nat → IO (Except Error FilePath)
+    | 0 =>
+        pure (.error (.io "create transaction directory" parent.toString
+          "exhausted 32 collision-resistant sibling names"))
+    | attempts + 1 => do
+        let nonce ← IO.rand 0 (2 ^ 64 - 1)
+        let candidate := parent /
+          s!"{transactionDirectoryPrefix}{nonce}{transactionDirectorySuffix}"
+        match ← (IO.FS.createDir candidate).toBaseIO with
+        | .ok () => return .ok candidate
+        | .error (.alreadyExists ..) => loop attempts
+        | .error error =>
+            return .error (.io "create transaction directory"
+              candidate.toString error.toString)
+  loop 32
+
+private def cleanupTransaction (directory staged : FilePath) : IO Unit := do
+  try IO.FS.removeFile staged catch _ => pure ()
+  try IO.FS.removeDir directory catch _ => pure ()
+
+private def syncFile (path : FilePath) : IO (Except Error Unit) := do
+  try
+    Ix.Compiler.DurableSync.file path
+    return .ok ()
+  catch error =>
+    return .error (.io "durably sync file" path.toString error.toString)
+
+private def syncDirectory (path : FilePath) : IO (Except Error Unit) := do
+  try
+    Ix.Compiler.DurableSync.directory path
+    return .ok ()
+  catch error =>
+    return .error (.io "durably sync directory" path.toString error.toString)
+
+private def replaceFileAtomically (limits : Cache.Limits) (path : FilePath)
+    (store : Cache.Store) (expectedSize : Nat) : IO (Except Error Unit) := do
+  let directory ← match ← createTransactionDirectory path with
+    | .ok directory => pure directory
+    | .error error => return .error error
+  let staged := directory / "store"
+  let result ← try
+    let handle ← IO.FS.Handle.mk staged .write
+    let actualSize ← writeStore limits handle store
+    handle.flush
+    if actualSize != expectedSize then
+      pure (.error (.io "stage canonical store" staged.toString
+        s!"wrote {actualSize} bytes, expected {expectedSize}"))
+    else
+      match ← (verifyStreamedFile limits "verify staged write" staged
+          expectedSize store) with
+      | .error error => pure (.error error)
+      | .ok () =>
+          match ← syncFile staged with
+          | .error error => pure (.error error)
+          | .ok () =>
+              match ← syncDirectory directory with
+              | .error error => pure (.error error)
+              | .ok () =>
+                  match ← validateWriteTarget path with
+                  | .error error => pure (.error error)
+                  | .ok () =>
+                      IO.FS.rename staged path
+                      let parent := transactionParent path
+                      match ← syncDirectory parent with
+                      | .error error => pure (.error error)
+                      | .ok () => syncDirectory directory
+  catch error =>
+    pure (.error (.io "atomic replace" path.toString error.toString))
+  match result with
+  | .error error =>
+      cleanupTransaction directory staged
+      return .error error
+  | .ok () =>
+      -- A successful return guarantees both cleanup and persistence of that
+      -- final parent-directory change. Failed attempts still leave only a
+      -- recognizable orphan that cache ingress ignores.
+      try
+        IO.FS.removeDir directory
+      catch error =>
+        return .error (.io "remove committed transaction directory"
+          directory.toString error.toString)
+      syncDirectory (transactionParent path)
+
+/-- Canonicalize and persist a complete store after its individual and
+aggregate resource checks. Artifact records are checked on lookup, not blessed
+by this writer.
+The destination's parent directory must already exist. The commit is an atomic
+rename within one filesystem: before it the prior destination remains intact,
+and after it the complete staged bytes occupy the destination. A successful
+return also includes the staged-file and affected-directory stable-storage
+barriers required by the ledger's power-loss durability contract. -/
+def saveFileWith (limits : Cache.Limits) (path : FilePath)
+    (store : Cache.Store) : IO (Except Error Unit) := do
+  let canonical ← match Cache.prepareStoreWith limits store with
+    | .ok canonical => pure canonical
+    | .error message => return .error (.cache message)
+  let expectedSize := canonical.framedSize
+  match ← validateWriteTarget path with
+  | .error error => return .error error
+  | .ok () => pure ()
+  replaceFileAtomically limits path canonical expectedSize
+
+def saveFile (path : FilePath) (store : Cache.Store) :
+    IO (Except Error Unit) :=
+  saveFileWith Cache.defaultLimits path store
+
+/-- Load (or cold-start), validate/rebuild against the current program, merge
+only the emitted writes, and persist the resulting store. The returned
+`Production` still carries the ordinary whole-program checker equality. -/
+def refreshFileWith (limits : Cache.Limits)
+    (program : List ReaddressAll.Artifact) (path : FilePath) :
+    IO (Except Error (Cache.Production limits program)) := do
+  let store ← match ← loadFileOrEmptyWith limits path with
+    | .ok store => pure store
+    | .error error => return .error error
+  let production ← match Cache.runWith limits program store with
+    | .ok production => pure production
+    | .error message => return .error (.cache message)
+  let updated := store.applyWrites production.writes
+  match ← saveFileWith limits path updated with
+  | .ok () => return .ok production
+  | .error error => return .error error
+
+def refreshFile (program : List ReaddressAll.Artifact) (path : FilePath) :
+    IO (Except Error (Cache.Production Cache.defaultLimits program)) :=
+  refreshFileWith Cache.defaultLimits program path
+
+end Ix.Compiler.IxIR1.HPT.CacheIO
diff --git a/Ix/Compiler/IxIR1/HPTCasePrune.lean b/Ix/Compiler/IxIR1/HPTCasePrune.lean
new file mode 100644
index 000000000..557f75af6
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTCasePrune.lean
@@ -0,0 +1,1807 @@
+import Ix.Compiler.IxIR1.HPTSound
+
+/-!
+# Checked HPT consumer: fact-driven case simplification
+
+This is the first transformation that consumes accepted HPT facts.  Its
+compatibility entry point `run` has the deliberately small rewrite window
+
+```text
+let x := call f(args); case x of alternatives
+```
+
+When `f` has a finite heap-only result fact, alternatives whose constructor
+index is absent from that fact are removed.  If the accepted fact describes
+exactly one unary constructor and filtering leaves exactly its unary branch,
+the case is replaced by one checked `fetch`; this preserves both the branch
+environment and exact evaluator fuel.  Scalar, unknown-heap, identity-only,
+and non-unary rows retain the conservative pruning behavior.  The semantic
+theorem below treats the summary as untrusted until it is backed by the same
+local post-fixpoint used by the HPT checker.
+
+`runWithFacts` instead mirrors HPT transfer through a complete function body.
+It propagates primitive results, forgets older heap identities at the same
+mutation boundary as the analyzer, refines case binders, and simplifies every
+case from the fact available at that program point.  The function owner is
+explicit because `callSelf` transfer is owner-sensitive.
+
+`runRecursive` remains the fixed-environment traversal for supplied fragments
+such as a top-level main, which has no declaration owner.  Stored declarations
+use `runFunction` and `rewriteDeclarationAt`; changed bodies still require the
+separate content-address rebuild stage.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.CasePrune
+
+/-- Only a finite, heap-only row can exclude a case alternative. -/
+def preciseHeapOnly (fact : Fact) : Bool :=
+  !fact.mayScalar && !fact.unknownHeap
+
+/-- Whether a finite result row contains a constructor with this runtime case
+index.  Case dispatch observes `cidx`, not the constructor's block identity. -/
+def hasCtorIndex (fact : Fact) (index : Nat) : Bool :=
+  fact.shapes.any fun
+    | .ctor identity _ => identity.cidx == index
+    | .pap _ _ => false
+
+def pruneAlternatives (fact : Fact) (alternatives : Array Alt) : Array Alt :=
+  alternatives.filter fun alternative => hasCtorIndex fact alternative.cidx
+
+/-- The detailed singleton constructor fact required for exact unary case
+collapse.  Identity-only constructor facts deliberately return `none`: they
+do not certify that field zero exists or that the branch arity is one. -/
+def exactUnaryConstructor? (fact : Fact) : Option CtorId :=
+  match fact.shapes with
+  | [.ctor identity (some [_])] => some identity
+  | _ => none
+
+/-- Select the sole unary branch body when its dispatch index agrees with the
+sole detailed unary constructor fact. -/
+def exactUnaryBody? (fact : Fact) (alternatives : Array Alt) : Option Code :=
+  match exactUnaryConstructor? fact, alternatives.toList with
+  | some identity, [.mk cidx 1 body] =>
+      if cidx == identity.cidx then some body else none
+  | _, _ => none
+
+private theorem exactUnaryConstructor?_eq_some
+    {fact : Fact} {identity : CtorId}
+    (h : exactUnaryConstructor? fact = some identity) :
+    ∃ fieldFact,
+      fact.shapes = [.ctor identity (some [fieldFact])] := by
+  unfold exactUnaryConstructor? at h
+  split at h <;> simp_all
+
+private theorem exactUnaryBody?_eq_some
+    {fact : Fact} {alternatives : Array Alt} {body : Code}
+    (h : exactUnaryBody? fact alternatives = some body) :
+    ∃ identity fieldFact,
+      fact.shapes = [.ctor identity (some [fieldFact])] ∧
+        alternatives = #[.mk identity.cidx 1 body] := by
+  unfold exactUnaryBody? at h
+  split at h <;> simp_all
+  obtain ⟨fieldFact, hshapes⟩ :=
+    exactUnaryConstructor?_eq_some (by assumption)
+  refine ⟨_, ⟨fieldFact, hshapes⟩, Array.toList_inj.mp ?_⟩
+  simpa using (by assumption)
+
+/-- Observable output of the one-redex consumer. -/
+structure Outcome where
+  code : Code
+  removedAlternatives : Nat
+  collapsedCases : Nat
+  materializedFetches : Nat
+
+/-- Pass-attributed counters without the rewritten syntax payload. -/
+structure Changes where
+  removedAlternatives : Nat := 0
+  collapsedCases : Nat := 0
+  materializedFetches : Nat := 0
+
+def Changes.add (left right : Changes) : Changes :=
+  { removedAlternatives :=
+      left.removedAlternatives + right.removedAlternatives
+    collapsedCases := left.collapsedCases + right.collapsedCases
+    materializedFetches :=
+      left.materializedFetches + right.materializedFetches }
+
+def Outcome.changes (outcome : Outcome) : Changes :=
+  { removedAlternatives := outcome.removedAlternatives
+    collapsedCases := outcome.collapsedCases
+    materializedFetches := outcome.materializedFetches }
+
+/-- Simplify one root `call`→`case` redex.  Every other shape is returned
+byte-for-byte at the inductive syntax level. -/
+def run (declarations : DeclEnv) (summaries : SummaryEnv)
+    (input : Code) : Outcome :=
+  match input with
+  | .letOp (.call function arguments)
+      (.case (.var 0) peelNat alternatives) =>
+      match declarations function, summaries function with
+      | some (.fn _), some fact =>
+          if preciseHeapOnly fact then
+            let kept := pruneAlternatives fact alternatives
+            match exactUnaryBody? fact kept with
+            | some body =>
+                ⟨.letOp (.call function arguments)
+                    (.letOp (.fetch (.var 0) 0) body),
+                  alternatives.size - kept.size, 1, 1⟩
+            | none =>
+                ⟨.letOp (.call function arguments)
+                    (.case (.var 0) peelNat kept),
+                  alternatives.size - kept.size, 0, 0⟩
+          else
+            ⟨input, 0, 0, 0⟩
+      | _, _ => ⟨input, 0, 0, 0⟩
+  | _ => ⟨input, 0, 0, 0⟩
+
+/-- Internal result for recursively rewriting an alternative body while
+retaining its dispatch metadata. -/
+structure AlternativeOutcome where
+  alternative : Alt
+  removedAlternatives : Nat
+  collapsedCases : Nat
+  materializedFetches : Nat
+
+mutual
+
+/-- Recursively apply the one-redex consumer throughout one supplied code
+fragment.  This still does not rewrite declaration bodies or the evaluator's
+current-function frame. -/
+def runRecursive (declarations : DeclEnv) (summaries : SummaryEnv) :
+    Code → Outcome
+  | .ret atom => ⟨.ret atom, 0, 0, 0⟩
+  | .letOp operation rest =>
+      let nested := runRecursive declarations summaries rest
+      let root := run declarations summaries (.letOp operation nested.code)
+      ⟨root.code,
+        nested.removedAlternatives + root.removedAlternatives,
+        nested.collapsedCases + root.collapsedCases,
+        nested.materializedFetches + root.materializedFetches⟩
+  | .case scrutinee peelNat alternatives =>
+      let nested := alternatives.map
+        (runAlternativeRecursive declarations summaries)
+      ⟨.case scrutinee peelNat (nested.map (fun result => result.alternative)),
+        nested.foldl
+          (fun total result => total + result.removedAlternatives) 0,
+        nested.foldl
+          (fun total result => total + result.collapsedCases) 0,
+        nested.foldl
+          (fun total result => total + result.materializedFetches) 0⟩
+
+def runAlternativeRecursive (declarations : DeclEnv)
+    (summaries : SummaryEnv) : Alt → AlternativeOutcome
+  | .mk cidx fields body =>
+      let nested := runRecursive declarations summaries body
+      ⟨.mk cidx fields nested.code, nested.removedAlternatives,
+        nested.collapsedCases, nested.materializedFetches⟩
+
+end
+
+/-! ## Owner-sensitive whole-code fact propagation -/
+
+/-- Simplify one case whose scrutinee fact has already been established by
+the ambient HPT environment.  Unlike `run`, this root does not require a
+syntactically adjacent call and may fetch from any resolved scrutinee atom. -/
+def runKnownCase (fact : Fact) (scrutinee : Atom) (peelNat : Bool)
+    (alternatives : Array Alt) : Outcome :=
+  let input := Code.case scrutinee peelNat alternatives
+  if preciseHeapOnly fact then
+    let kept := pruneAlternatives fact alternatives
+    match exactUnaryBody? fact kept with
+    | some body =>
+        ⟨.letOp (.fetch scrutinee 0) body,
+          alternatives.size - kept.size, 1, 1⟩
+    | none =>
+        ⟨.case scrutinee peelNat kept,
+          alternatives.size - kept.size, 0, 0⟩
+  else
+    ⟨input, 0, 0, 0⟩
+
+mutual
+
+/-- Mirror `analyzeCode` while simplifying every case from the fact available
+at that exact program point.  Transfer failures are fail-soft: the affected
+subtree is returned byte-for-byte with zero attributed changes. -/
+def runWithFacts (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef)
+    (facts : List Fact) : Code → Outcome
+  | .ret atom => ⟨.ret atom, 0, 0, 0⟩
+  | input@(.letOp operation rest) =>
+      match analyzeOp declarations summaries owner current facts operation with
+      | .error _ => ⟨input, 0, 0, 0⟩
+      | .ok bound =>
+          let nested := runWithFacts declarations summaries owner current
+            (bound :: facts.map Fact.forgetHeap) rest
+          ⟨.letOp operation nested.code,
+            nested.removedAlternatives, nested.collapsedCases,
+            nested.materializedFetches⟩
+  | input@(.case scrutinee peelNat alternatives) =>
+      match resolveAtomFact facts scrutinee with
+      | .error _ => ⟨input, 0, 0, 0⟩
+      | .ok fact =>
+          let nested := alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              fact peelNat facts)
+          let rewritten := nested.map (fun result => result.alternative)
+          let root := runKnownCase fact scrutinee peelNat rewritten
+          ⟨root.code,
+            nested.foldl
+                (fun total result => total + result.removedAlternatives) 0 +
+              root.removedAlternatives,
+            nested.foldl
+                (fun total result => total + result.collapsedCases) 0 +
+              root.collapsedCases,
+            nested.foldl
+                (fun total result => total + result.materializedFetches) 0 +
+              root.materializedFetches⟩
+
+/-- Rewrite one alternative under the exact HPT binder environment used by
+`analyzeAlternatives`. -/
+def runAlternativeWithFacts (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Ix.Compiler.Ixon.Address)
+    (current : FnDef) (scrutineeFact : Fact) (peelNat : Bool)
+    (facts : List Fact) : Alt → AlternativeOutcome
+  | .mk cidx fields body =>
+      let nested := runWithFacts declarations summaries owner current
+        (scrutineeFact.caseFields peelNat cidx fields ++ facts) body
+      ⟨.mk cidx fields nested.code, nested.removedAlternatives,
+        nested.collapsedCases, nested.materializedFetches⟩
+
+end
+
+/-- Analyze and simplify a complete function from HPT's universal parameter
+environment. -/
+def runFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef) : Outcome :=
+  runWithFacts declarations summaries owner current
+    (List.replicate current.arity Fact.top) current.body
+
+/-- Owner-sensitive function rewrite used for stored declarations. -/
+def rewriteCurrentAt (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef) : FnDef :=
+  { current with body :=
+      (runFunction declarations summaries owner current).code }
+
+/-- Owner-sensitive declaration rewrite.  The address is semantically
+relevant to `callSelf` transfer. -/
+def rewriteDeclarationAt (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) : Decl → Decl
+  | .fn function => .fn (rewriteCurrentAt declarations summaries owner function)
+  | .extern arity => .extern arity
+
+/-- Rewrite a current-function body while retaining the dynamic arity and
+result-world contract used by `callSelf`. -/
+def rewriteCurrent (declarations : DeclEnv) (summaries : SummaryEnv)
+    (current : FnDef) : FnDef :=
+  { current with body :=
+      (runRecursive declarations summaries current.body).code }
+
+/-- Rewrite one declaration body without changing its calling convention.
+Extern declarations are retained exactly. -/
+def rewriteDeclaration (declarations : DeclEnv) (summaries : SummaryEnv) :
+    Decl → Decl
+  | .fn function => .fn (rewriteCurrent declarations summaries function)
+  | .extern arity => .extern arity
+
+/-- Logical declaration environment obtained by rewriting every function
+body under its existing key.  This is an intermediate semantic object: a
+stored artifact must subsequently readdress the changed declarations. -/
+def rewriteDeclEnv (declarations : DeclEnv) (summaries : SummaryEnv) :
+    DeclEnv :=
+  fun address => (declarations address).map
+    (rewriteDeclarationAt declarations summaries address)
+
+/-- Retain a context's oracle while replacing its declaration environment by
+the logical body-rewritten environment. -/
+def rewriteCtx (declarations : DeclEnv) (summaries : SummaryEnv)
+    (ctx : Ctx) : Ctx :=
+  { ctx with decls := rewriteDeclEnv declarations summaries }
+
+/-- List form consumed by the content-address rebuild stage. -/
+def rewriteEntries (declarations : DeclEnv) (summaries : SummaryEnv)
+    (entries : List (Ix.Compiler.Ixon.Address × Decl)) :
+    List (Ix.Compiler.Ixon.Address × Decl) :=
+  entries.map fun entry =>
+    (entry.1,
+      rewriteDeclarationAt declarations summaries entry.1 entry.2)
+
+@[simp] theorem declArity_rewriteDeclaration
+    (declarations : DeclEnv) (summaries : SummaryEnv) (declaration : Decl) :
+    declArity (rewriteDeclaration declarations summaries declaration) =
+      declArity declaration := by
+  cases declaration <;> rfl
+
+@[simp] theorem declArity_rewriteDeclarationAt
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (declaration : Decl) :
+    declArity
+        (rewriteDeclarationAt declarations summaries owner declaration) =
+      declArity declaration := by
+  cases declaration <;> rfl
+
+/-! ## Semantic support -/
+
+/-- A finite fact covering a live constructor necessarily retains its runtime
+case index.  Detailed field payloads do not affect dispatch. -/
+theorem hasCtorIndex_of_holds_ctor
+    {declarations : DeclEnv} {store : Store} {fact : Fact}
+    {location : Nat} {box : NodeBox} {identity : CtorId}
+    {fields : Array RVal}
+    (hfinite : fact.unknownHeap = false)
+    (hholds : fact.Holds declarations store (.loc location))
+    (hget : store.get? location = some box)
+    (hnode : box.node = .ctorN identity fields) :
+    hasCtorIndex fact identity.cidx = true := by
+  simp only [Fact.Holds] at hholds
+  rcases hholds with hunknown | ⟨shape, hmember, hshape⟩
+  · rw [hfinite] at hunknown
+    contradiction
+  · apply List.any_eq_true.mpr
+    refine ⟨shape, hmember, ?_⟩
+    cases shape with
+    | ctor shapeIdentity fieldFacts =>
+        simp only [HeapShape.Holds] at hshape
+        rcases hshape with
+          ⟨shapeBox, shapeFields, hshapeGet, hshapeNode, _⟩
+        rw [hget] at hshapeGet
+        injection hshapeGet with hbox
+        subst shapeBox
+        rw [hnode] at hshapeNode
+        injection hshapeNode with hidentity
+        subst shapeIdentity
+        simp
+    | pap function supplied =>
+        simp only [HeapShape.Holds] at hshape
+        rcases hshape with
+          ⟨shapeBox, arguments, declaration, hshapeGet, _, hshapeNode, _, _⟩
+        rw [hget] at hshapeGet
+        injection hshapeGet with hbox
+        subst shapeBox
+        rw [hnode] at hshapeNode
+        contradiction
+
+/-- Filtering by the finite fact preserves the evaluator's first-match lookup
+for every constructor index admitted by that fact. -/
+theorem find?_pruneAlternatives {fact : Fact} {alternatives : Array Alt}
+    {index : Nat} (hindex : hasCtorIndex fact index = true) :
+    (pruneAlternatives fact alternatives).find?
+        (fun alternative => alternative.cidx == index) =
+      alternatives.find? (fun alternative => alternative.cidx == index) := by
+  simp only [pruneAlternatives, Array.find?_filter]
+  apply congrArg (fun predicate => alternatives.find? predicate)
+  funext alternative
+  by_cases hsame : alternative.cidx = index
+  · subst index
+    simp [hindex]
+  · simp [hsame]
+
+private theorem mayScalar_eq_false_of_preciseHeapOnly {fact : Fact}
+    (hprecise : preciseHeapOnly fact = true) : fact.mayScalar = false := by
+  simp [preciseHeapOnly] at hprecise
+  exact hprecise.1
+
+private theorem unknownHeap_eq_false_of_preciseHeapOnly {fact : Fact}
+    (hprecise : preciseHeapOnly fact = true) : fact.unknownHeap = false := by
+  simp [preciseHeapOnly] at hprecise
+  exact hprecise.2
+
+/-- A detailed singleton unary result fact exposes one concrete constructor
+field.  This is the semantic fact that makes the replacement `fetch` total. -/
+private theorem exists_of_exactUnary_holds
+    {declarations : DeclEnv} {store : Store} {value : RVal}
+    {identity : CtorId} {fieldFact : FieldFact}
+    (hholds : (⟨false, false,
+      [.ctor identity (some [fieldFact])]⟩ : Fact).Holds
+        declarations store value) :
+    ∃ location box field,
+      value = .loc location ∧
+        store.get? location = some box ∧
+        box.node = .ctorN identity #[field] := by
+  cases value with
+  | lit literal =>
+      change false = true at hholds
+      contradiction
+  | erased =>
+      change false = true at hholds
+      contradiction
+  | loc location =>
+      simp only [Fact.Holds] at hholds
+      rcases hholds with hunknown | ⟨shape, hmember, hshape⟩
+      · contradiction
+      · simp only [List.mem_singleton] at hmember
+        subst shape
+        simp only [HeapShape.Holds] at hshape
+        rcases hshape with ⟨box, fields, hget, hnode, hfields⟩
+        have hlength : fields.toList.length = 1 := by
+          simpa using (FieldFactsHold.length_eq hfields).symm
+        cases hlist : fields.toList with
+        | nil => simp [hlist] at hlength
+        | cons field tail =>
+            cases tail with
+            | nil =>
+                have harray : fields = #[field] := by
+                  apply Array.toList_inj.mp
+                  simpa using hlist
+                refine ⟨location, box, field, rfl, hget, ?_⟩
+                simpa [harray] using hnode
+            | cons next tail => simp [hlist] at hlength
+
+/-- For a certified unary constructor, one checked fetch installs exactly the
+environment that the matching case branch would have received, at the same
+code fuel. -/
+private theorem runCode_fetch_eq_exactUnaryCase_of_holds
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment : List RVal} {value : RVal}
+    {identity : CtorId} {fieldFact : FieldFact} {body : Code}
+    {peelNat : Bool} {fuel : Nat}
+    (hholds : (⟨false, false,
+      [.ctor identity (some [fieldFact])]⟩ : Fact).Holds
+        declarations store value) :
+    runCode ctx fuel current store (value :: environment)
+        (.letOp (.fetch (.var 0) 0) body) =
+      runCode ctx fuel current store (value :: environment)
+        (.case (.var 0) peelNat #[.mk identity.cidx 1 body]) := by
+  obtain ⟨location, box, field, hvalue, hget, hnode⟩ :=
+    exists_of_exactUnary_holds hholds
+  subst value
+  cases fuel with
+  | zero => simp [runCode]
+  | succ fuel =>
+      cases fuel with
+      | zero =>
+          simp [runCode, runOp, resolveAtom, Alt.cidx, bind, Except.bind,
+            hget, hnode]
+      | succ fuel =>
+          simp [runCode, runOp, resolveAtom, Alt.cidx, bind, Except.bind,
+            hget, hnode]
+
+/-- Successful executable collapse selection supplies exactly the fact and
+branch shape required by the concrete unary-fetch theorem. -/
+private theorem runCode_fetch_eq_of_exactUnaryBody
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment : List RVal} {value : RVal}
+    {fact : Fact} {alternatives : Array Alt} {body : Code}
+    {peelNat : Bool} {fuel : Nat}
+    (hprecise : preciseHeapOnly fact = true)
+    (hbody : exactUnaryBody? fact alternatives = some body)
+    (hholds : fact.Holds declarations store value) :
+    runCode ctx fuel current store (value :: environment)
+        (.letOp (.fetch (.var 0) 0) body) =
+      runCode ctx fuel current store (value :: environment)
+        (.case (.var 0) peelNat alternatives) := by
+  obtain ⟨identity, fieldFact, hshapes, halternatives⟩ :=
+    exactUnaryBody?_eq_some hbody
+  have hscalar := mayScalar_eq_false_of_preciseHeapOnly hprecise
+  have hunknown := unknownHeap_eq_false_of_preciseHeapOnly hprecise
+  cases fact with
+  | mk mayScalar unknownHeap shapes =>
+      change mayScalar = false at hscalar
+      change unknownHeap = false at hunknown
+      change shapes = [.ctor identity (some [fieldFact])] at hshapes
+      subst mayScalar
+      subst unknownHeap
+      subst shapes
+      subst alternatives
+      exact runCode_fetch_eq_exactUnaryCase_of_holds hholds
+
+/-- Once a concrete call result satisfies a finite heap-only row, pruning does
+not change evaluation of the immediately following case. -/
+private theorem runCode_case_pruned_eq_of_holds
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment : List RVal} {value : RVal}
+    {fact : Fact} {peelNat : Bool} {alternatives : Array Alt} {fuel : Nat}
+    (hprecise : preciseHeapOnly fact = true)
+    (hholds : fact.Holds declarations store value) :
+    runCode ctx fuel current store (value :: environment)
+        (.case (.var 0) peelNat (pruneAlternatives fact alternatives)) =
+      runCode ctx fuel current store (value :: environment)
+        (.case (.var 0) peelNat alternatives) := by
+  cases fuel with
+  | zero => simp [runCode]
+  | succ fuel =>
+      cases value with
+      | lit literal =>
+          change fact.mayScalar = true at hholds
+          rw [mayScalar_eq_false_of_preciseHeapOnly hprecise] at hholds
+          contradiction
+      | erased =>
+          change fact.mayScalar = true at hholds
+          rw [mayScalar_eq_false_of_preciseHeapOnly hprecise] at hholds
+          contradiction
+      | loc location =>
+          cases hget : store.get? location with
+          | none =>
+              simp [runCode, resolveAtom, bind, Except.bind, hget]
+          | some box =>
+              cases hnode : box.node with
+              | papN function arity arguments =>
+                  simp [runCode, resolveAtom, bind, Except.bind, hget, hnode]
+              | ctorN identity fields =>
+                  have hfind := find?_pruneAlternatives
+                    (fact := fact) (alternatives := alternatives)
+                    (hasCtorIndex_of_holds_ctor
+                      (unknownHeap_eq_false_of_preciseHeapOnly hprecise)
+                      hholds hget hnode)
+                  simp [runCode, resolveAtom, bind, Except.bind, hget, hnode,
+                    hfind]
+
+/-- A successful concrete `.call` operation is covered by the row selected by
+the same declaration and summary environments. -/
+private theorem holds_of_runOp_call
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current currentFunction : FnDef}
+    {store outputStore : Store}
+    {environment : List RVal} {function : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {fact : Fact} {outputValue : RVal} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hdeclaration : declarations function = some (.fn currentFunction))
+    (hsummary : summaries function = some fact)
+    (hcall : runOp ctx fuel current store environment
+      (.call function arguments) = .ok (outputStore, outputValue)) :
+    fact.Holds declarations outputStore outputValue := by
+  cases fuel with
+  | zero => simp [runOp] at hcall
+  | succ fuel =>
+      simp only [runOp] at hcall
+      cases harguments : resolveAtoms environment arguments with
+      | error error =>
+          rw [harguments] at hcall
+          simp only [bind, Except.bind] at hcall
+          contradiction
+      | ok values =>
+          have hinvoke : invoke ctx fuel function values store =
+              .ok (outputStore, outputValue) := by
+            rw [harguments] at hcall
+            simpa only [bind, Except.bind] using hcall
+          exact invoke_sound hpost hctx
+            (by simp [callableResult, hdeclaration, hsummary]) hinvoke
+
+/-- Exact evaluator equality for the single rewritten redex.  The call itself
+is untouched; on success, HPT soundness ensures the concrete constructor's
+first matching branch survived the filter. -/
+private theorem runCode_prunedRedex_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current currentFunction : FnDef} {store : Store}
+    {environment : List RVal} {function : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {fact : Fact} {peelNat : Bool}
+    {alternatives : Array Alt} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hdeclaration : declarations function = some (.fn currentFunction))
+    (hsummary : summaries function = some fact)
+    (hprecise : preciseHeapOnly fact = true) :
+    runCode ctx fuel current store environment
+        (.letOp (.call function arguments)
+          (.case (.var 0) peelNat (pruneAlternatives fact alternatives))) =
+      runCode ctx fuel current store environment
+        (.letOp (.call function arguments)
+          (.case (.var 0) peelNat alternatives)) := by
+  cases fuel with
+  | zero => simp [runCode]
+  | succ fuel =>
+      simp only [runCode]
+      cases hcall : runOp ctx fuel current store environment
+          (.call function arguments) with
+      | error error =>
+          simp [bind, Except.bind]
+      | ok output =>
+          rcases output with ⟨outputStore, outputValue⟩
+          simp only [bind, Except.bind]
+          exact runCode_case_pruned_eq_of_holds hprecise
+            (holds_of_runOp_call hpost hctx hdeclaration hsummary hcall)
+
+/-- Exact evaluator equality between a selected unary-fetch collapse and its
+already-pruned singleton case. -/
+private theorem runCode_collapsedRedex_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current currentFunction : FnDef} {store : Store}
+    {environment : List RVal} {function : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {fact : Fact} {peelNat : Bool}
+    {alternatives : Array Alt} {body : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hdeclaration : declarations function = some (.fn currentFunction))
+    (hsummary : summaries function = some fact)
+    (hprecise : preciseHeapOnly fact = true)
+    (hcollapse : exactUnaryBody? fact alternatives = some body) :
+    runCode ctx fuel current store environment
+        (.letOp (.call function arguments)
+          (.letOp (.fetch (.var 0) 0) body)) =
+      runCode ctx fuel current store environment
+        (.letOp (.call function arguments)
+          (.case (.var 0) peelNat alternatives)) := by
+  cases fuel with
+  | zero => simp [runCode]
+  | succ fuel =>
+      simp only [runCode]
+      cases hcall : runOp ctx fuel current store environment
+          (.call function arguments) with
+      | error error =>
+          simp [bind, Except.bind]
+      | ok output =>
+          rcases output with ⟨outputStore, outputValue⟩
+          simp only [bind, Except.bind]
+          exact runCode_fetch_eq_of_exactUnaryBody hprecise hcollapse
+            (holds_of_runOp_call hpost hctx hdeclaration hsummary hcall)
+
+/-- The executable consumer preserves the exact evaluator result for every
+fuel, store, environment, and current function whenever its summary
+environment is a local post-fixpoint for the runtime declaration environment.
+This includes every error result, not only successful executions. -/
+theorem runCode_run_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runCode ctx fuel current store environment
+        (run declarations summaries input).code =
+      runCode ctx fuel current store environment input := by
+  cases input with
+  | ret atom => rfl
+  | case scrutinee peelNat alternatives => rfl
+  | letOp operation rest =>
+      cases operation <;> try rfl
+      case call function arguments =>
+        cases rest with
+        | ret atom => rfl
+        | letOp operation rest => rfl
+        | case scrutinee peelNat alternatives =>
+            cases scrutinee with
+            | lit literal => rfl
+            | erased => rfl
+            | var index =>
+                cases index with
+                | succ index => rfl
+                | zero =>
+                    cases hdeclaration : declarations function with
+                    | none => simp [run, hdeclaration]
+                    | some declaration =>
+                        cases declaration with
+                        | extern arity => simp [run, hdeclaration]
+                        | fn currentFunction =>
+                            cases hsummary : summaries function with
+                            | none => simp [run, hdeclaration, hsummary]
+                            | some fact =>
+                                cases hprecise : preciseHeapOnly fact with
+                                | false =>
+                                    simp [run, hdeclaration, hsummary, hprecise]
+                                | true =>
+                                    cases hcollapse : exactUnaryBody? fact
+                                        (pruneAlternatives fact alternatives) with
+                                    | none =>
+                                        simpa [run, hdeclaration, hsummary,
+                                          hprecise, hcollapse] using
+                                          runCode_prunedRedex_eq hpost hctx
+                                            hdeclaration hsummary hprecise
+                                    | some body =>
+                                        calc
+                                          runCode ctx fuel current store
+                                              environment
+                                              (run declarations summaries
+                                                (.letOp
+                                                  (.call function arguments)
+                                                  (.case (.var 0) peelNat
+                                                    alternatives))).code =
+                                            runCode ctx fuel current store
+                                              environment
+                                              (.letOp
+                                                (.call function arguments)
+                                                (.letOp
+                                                  (.fetch (.var 0) 0) body)) := by
+                                                    simp [run, hdeclaration,
+                                                      hsummary, hprecise,
+                                                      hcollapse]
+                                          _ = runCode ctx fuel current store
+                                                environment
+                                                (.letOp
+                                                  (.call function arguments)
+                                                  (.case (.var 0) peelNat
+                                                    (pruneAlternatives fact
+                                                      alternatives))) :=
+                                            runCode_collapsedRedex_eq hpost hctx
+                                              hdeclaration hsummary hprecise
+                                              hcollapse
+                                          _ = runCode ctx fuel current store
+                                                environment
+                                                (.letOp
+                                                  (.call function arguments)
+                                                  (.case (.var 0) peelNat
+                                                    alternatives)) :=
+                                          runCode_prunedRedex_eq hpost hctx
+                                              hdeclaration hsummary hprecise
+
+/-! ## Semantic support for propagated cases -/
+
+/-- A checked fetch from an arbitrary resolved atom installs exactly the
+environment of its matching detailed-unary case branch. -/
+private theorem runCode_fetchAtom_eq_exactUnaryCase_of_holds
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment : List RVal} {scrutinee : Atom}
+    {value : RVal} {identity : CtorId} {fieldFact : FieldFact}
+    {body : Code} {peelNat : Bool} {fuel : Nat}
+    (hresolve : resolveAtom environment scrutinee = .ok value)
+    (hholds : (⟨false, false,
+      [.ctor identity (some [fieldFact])]⟩ : Fact).Holds
+        declarations store value) :
+    runCode ctx fuel current store environment
+        (.letOp (.fetch scrutinee 0) body) =
+      runCode ctx fuel current store environment
+        (.case scrutinee peelNat #[.mk identity.cidx 1 body]) := by
+  obtain ⟨location, box, field, hvalue, hget, hnode⟩ :=
+    exists_of_exactUnary_holds hholds
+  subst value
+  cases fuel with
+  | zero => simp [runCode]
+  | succ fuel =>
+      cases fuel with
+      | zero =>
+          simp [runCode, runOp, hresolve, Alt.cidx, bind, Except.bind,
+            hget, hnode]
+      | succ fuel =>
+          simp [runCode, runOp, hresolve, Alt.cidx, bind, Except.bind,
+            hget, hnode]
+
+private theorem runCode_fetchAtom_eq_of_exactUnaryBody
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment : List RVal} {scrutinee : Atom}
+    {value : RVal} {fact : Fact} {alternatives : Array Alt} {body : Code}
+    {peelNat : Bool} {fuel : Nat}
+    (hresolve : resolveAtom environment scrutinee = .ok value)
+    (hprecise : preciseHeapOnly fact = true)
+    (hbody : exactUnaryBody? fact alternatives = some body)
+    (hholds : fact.Holds declarations store value) :
+    runCode ctx fuel current store environment
+        (.letOp (.fetch scrutinee 0) body) =
+      runCode ctx fuel current store environment
+        (.case scrutinee peelNat alternatives) := by
+  obtain ⟨identity, fieldFact, hshapes, halternatives⟩ :=
+    exactUnaryBody?_eq_some hbody
+  have hscalar := mayScalar_eq_false_of_preciseHeapOnly hprecise
+  have hunknown := unknownHeap_eq_false_of_preciseHeapOnly hprecise
+  cases fact with
+  | mk mayScalar unknownHeap shapes =>
+      change mayScalar = false at hscalar
+      change unknownHeap = false at hunknown
+      change shapes = [.ctor identity (some [fieldFact])] at hshapes
+      subst mayScalar
+      subst unknownHeap
+      subst shapes
+      subst alternatives
+      exact runCode_fetchAtom_eq_exactUnaryCase_of_holds hresolve hholds
+
+/-- Pruning from a fact resolved at an arbitrary program point preserves the
+case evaluator, including its first-match behavior and all errors. -/
+private theorem runCode_caseAtom_pruned_eq_of_holds
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {environment : List RVal} {scrutinee : Atom}
+    {value : RVal} {fact : Fact} {peelNat : Bool}
+    {alternatives : Array Alt} {fuel : Nat}
+    (hresolve : resolveAtom environment scrutinee = .ok value)
+    (hprecise : preciseHeapOnly fact = true)
+    (hholds : fact.Holds declarations store value) :
+    runCode ctx fuel current store environment
+        (.case scrutinee peelNat (pruneAlternatives fact alternatives)) =
+      runCode ctx fuel current store environment
+        (.case scrutinee peelNat alternatives) := by
+  cases fuel with
+  | zero => simp [runCode]
+  | succ fuel =>
+      simp only [runCode]
+      rw [hresolve]
+      simp only [bind, Except.bind]
+      cases value with
+      | lit literal =>
+          change fact.mayScalar = true at hholds
+          rw [mayScalar_eq_false_of_preciseHeapOnly hprecise] at hholds
+          contradiction
+      | erased =>
+          change fact.mayScalar = true at hholds
+          rw [mayScalar_eq_false_of_preciseHeapOnly hprecise] at hholds
+      | loc location =>
+          cases hget : store.get? location with
+          | none => simp [hget]
+          | some box =>
+              cases hnode : box.node with
+              | papN function arity arguments => simp [hget, hnode]
+              | ctorN identity fields =>
+                  have hfind := find?_pruneAlternatives
+                    (fact := fact) (alternatives := alternatives)
+                    (hasCtorIndex_of_holds_ctor
+                      (unknownHeap_eq_false_of_preciseHeapOnly hprecise)
+                      hholds hget hnode)
+                  simp [hget, hnode, hfind]
+
+/-- The environment-driven case root is exact whenever its abstract
+scrutinee resolution is backed by the concrete HPT environment. -/
+private theorem runCode_runKnownCase_eq
+    {declarations : DeclEnv} {ctx : Ctx} {current : FnDef}
+    {store : Store} {facts : List Fact} {environment : List RVal}
+    {fact : Fact} {scrutinee : Atom} {peelNat : Bool}
+    {alternatives : Array Alt} {fuel : Nat}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (habstract : resolveAtomFact facts scrutinee = .ok fact) :
+    runCode ctx fuel current store environment
+        (runKnownCase fact scrutinee peelNat alternatives).code =
+      runCode ctx fuel current store environment
+        (.case scrutinee peelNat alternatives) := by
+  obtain ⟨value, hresolve⟩ := resolveAtom_complete henvironment habstract
+  have hholds := resolveAtom_sound henvironment habstract hresolve
+  cases hprecise : preciseHeapOnly fact with
+  | false => simp [runKnownCase, hprecise]
+  | true =>
+      cases hcollapse : exactUnaryBody? fact
+          (pruneAlternatives fact alternatives) with
+      | none =>
+          simpa [runKnownCase, hprecise, hcollapse] using
+            (runCode_caseAtom_pruned_eq_of_holds hresolve hprecise hholds)
+      | some body =>
+          calc
+            runCode ctx fuel current store environment
+                (runKnownCase fact scrutinee peelNat alternatives).code =
+              runCode ctx fuel current store environment
+                (.letOp (.fetch scrutinee 0) body) := by
+                  simp [runKnownCase, hprecise, hcollapse]
+            _ = runCode ctx fuel current store environment
+                  (.case scrutinee peelNat
+                    (pruneAlternatives fact alternatives)) :=
+              runCode_fetchAtom_eq_of_exactUnaryBody hresolve hprecise
+                hcollapse hholds
+            _ = runCode ctx fuel current store environment
+                  (.case scrutinee peelNat alternatives) :=
+              runCode_caseAtom_pruned_eq_of_holds hresolve hprecise hholds
+
+@[simp] private theorem runAlternativeWithFacts_cidx
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternative : Alt) :
+    (runAlternativeWithFacts declarations summaries owner current
+      scrutineeFact peelNat facts alternative).alternative.cidx =
+        alternative.cidx := by
+  cases alternative
+  simp [runAlternativeWithFacts, Alt.cidx]
+
+private theorem runAlternativeWithFacts_predicate
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (index : Nat) :
+    ((fun alternative : Alt => alternative.cidx == index) ∘
+        (fun result : AlternativeOutcome => result.alternative) ∘
+        runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts) =
+      (fun alternative => alternative.cidx == index) := by
+  funext alternative
+  cases alternative
+  simp [Function.comp_def, runAlternativeWithFacts, Alt.cidx]
+
+private theorem find?_runAlternativeWithFacts
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternatives : Array Alt) (index : Nat) :
+    ((alternatives.map
+        (runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts)).map
+        (fun result => result.alternative)).find?
+          (fun alternative => alternative.cidx == index) =
+      (alternatives.find? (fun alternative => alternative.cidx == index)).map
+        (fun alternative =>
+          (runAlternativeWithFacts declarations summaries owner current
+            scrutineeFact peelNat facts alternative).alternative) := by
+  rw [Array.map_map, Array.find?_map,
+    runAlternativeWithFacts_predicate declarations summaries owner current
+      scrutineeFact peelNat facts index]
+  simp [Function.comp_def]
+
+private theorem Array.foldl_cons_eq_reverse_append'
+    (fields : Array RVal) (environment : List RVal) :
+    fields.foldl (fun current field => field :: current) environment =
+      fields.toList.reverse ++ environment := by
+  rw [← Array.foldl_toList]
+  induction fields.toList generalizing environment with
+  | nil => rfl
+  | cons field fields ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+/-- The alternative-body half of propagated case rewriting.  HPT's branch
+facts are installed only after the concrete evaluator has selected a matching
+alternative with the expected field count. -/
+private theorem runCode_caseWithFactsBodies_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    {owner : Ix.Compiler.Ixon.Address} {current : FnDef}
+    {ctx : Ctx} {store : Store} {facts : List Fact}
+    {environment : List RVal} {scrutinee : Atom} {peelNat : Bool}
+    {alternatives : Array Alt} {scrutineeFact : Fact} {fuel : Nat}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (habstract : resolveAtomFact facts scrutinee = .ok scrutineeFact)
+    (ih : ∀ {store : Store} {facts : List Fact}
+      {environment : List RVal} {input : Code},
+      EnvironmentHolds declarations store facts environment →
+      runCode ctx fuel current store environment
+          (runWithFacts declarations summaries owner current facts input).code =
+        runCode ctx fuel current store environment input) :
+    runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat
+          ((alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              scrutineeFact peelNat facts)).map
+                (fun result => result.alternative))) =
+      runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  obtain ⟨scrutineeValue, hresolve⟩ :=
+    resolveAtom_complete henvironment habstract
+  have hscrutineeHolds :=
+    resolveAtom_sound henvironment habstract hresolve
+  simp only [runCode]
+  rw [hresolve]
+  simp only [bind, Except.bind]
+  cases scrutineeValue with
+  | erased => rfl
+  | lit literal =>
+      cases literal with
+      | str value => rfl
+      | nat value =>
+          simp only
+          cases peelNat with
+          | false => rfl
+          | true =>
+              simp only
+              cases value with
+              | zero =>
+                  simp only
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 0) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero =>
+                              have hzero :
+                                  scrutineeFact.caseFields true cidx 0 = [] := by
+                                unfold Fact.caseFields
+                                split <;> rfl
+                              simpa [runAlternativeWithFacts, hzero] using
+                                (ih (input := body) henvironment)
+                          | succ fields => simp [runAlternativeWithFacts]
+              | succ value =>
+                  simp only
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 1) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero => simp [runAlternativeWithFacts]
+                          | succ fields =>
+                              cases fields with
+                              | zero =>
+                                  have hcidx : cidx = 1 := by
+                                    have hmatch := Array.find?_some
+                                      (p := fun alternative : Alt =>
+                                        alternative.cidx == 1)
+                                      (a := .mk cidx 1 body)
+                                      (xs := alternatives) hfind
+                                    exact beq_iff_eq.mp hmatch
+                                  have hbinders :
+                                      EnvironmentHolds declarations store
+                                        (scrutineeFact.caseFields true cidx 1)
+                                        [.lit (.nat value)] := by
+                                    simpa [hcidx] using
+                                      (Fact.caseFields_natSucc_holds
+                                        hscrutineeHolds)
+                                  simpa [runAlternativeWithFacts] using
+                                    (ih (input := body)
+                                      (hbinders.append henvironment))
+                              | succ fields =>
+                                  simp [runAlternativeWithFacts]
+  | loc location =>
+      simp only
+      cases hget : store.get? location with
+      | none => simp
+      | some box =>
+          simp only
+          cases hnode : box.node with
+          | papN function arity arguments => simp
+          | ctorN identity fields =>
+              simp only
+              rw [find?_runAlternativeWithFacts]
+              cases hfind : alternatives.find?
+                  (fun alternative => alternative.cidx == identity.cidx) with
+              | none => simp
+              | some alternative =>
+                  cases alternative with
+                  | mk cidx fieldCount body =>
+                      by_cases hfields : fields.size = fieldCount
+                      · have hcidx : identity.cidx = cidx := by
+                          have hmatch := Array.find?_some
+                            (p := fun alternative : Alt =>
+                              alternative.cidx == identity.cidx)
+                            (a := .mk cidx fieldCount body)
+                            (xs := alternatives) hfind
+                          exact (beq_iff_eq.mp hmatch).symm
+                        have hbinders := Fact.caseFields_ctor_holds
+                          peelNat cidx fieldCount hscrutineeHolds hget hnode
+                          hcidx hfields
+                        rw [Array.foldl_cons_eq_reverse_append']
+                        simpa [hfields, runAlternativeWithFacts] using
+                          (ih (input := body)
+                            (hbinders.append henvironment))
+                      · simp [hfields, runAlternativeWithFacts]
+
+/-- Exact evaluator equality for the owner-sensitive HPT traversal.  This is
+the reusable semantic boundary for subsequent fact-driven local consumers. -/
+theorem runCode_runWithFacts_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Ix.Compiler.Ixon.Address} {current : FnDef}
+    {store : Store} {facts : List Fact} {environment : List RVal}
+    {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (henvironment : EnvironmentHolds declarations store facts environment) :
+    runCode ctx fuel current store environment
+        (runWithFacts declarations summaries owner current facts input).code =
+      runCode ctx fuel current store environment input := by
+  induction fuel generalizing store facts environment input with
+  | zero => simp [runCode]
+  | succ fuel ih =>
+      cases input with
+      | ret atom => simp [runWithFacts, runCode]
+      | letOp operation rest =>
+          cases habstract : analyzeOp declarations summaries owner current
+              facts operation with
+          | error error => simp [runWithFacts, habstract]
+          | ok bound =>
+              simp only [runWithFacts, habstract, runCode]
+              cases hoperation : runOp ctx fuel current store environment
+                  operation with
+              | error error => simp [bind, Except.bind]
+              | ok output =>
+                  rcases output with ⟨outputStore, outputValue⟩
+                  simp only [bind, Except.bind]
+                  have hbound := analyzeOp_sound hpost hctx hcurrent
+                    henvironment habstract hoperation
+                  have hold := EnvironmentHolds.forgetHeap
+                    (after := outputStore) henvironment
+                  exact ih (store := outputStore)
+                    (facts := bound :: facts.map Fact.forgetHeap)
+                    (environment := outputValue :: environment)
+                    (input := rest) (.cons hbound hold)
+      | case scrutinee peelNat alternatives =>
+          cases habstract : resolveAtomFact facts scrutinee with
+          | error error => simp [runWithFacts, habstract]
+          | ok scrutineeFact =>
+              simp only [runWithFacts, habstract]
+              calc
+                runCode ctx (fuel + 1) current store environment
+                    (runKnownCase scrutineeFact scrutinee peelNat
+                      ((alternatives.map
+                        (runAlternativeWithFacts declarations summaries owner
+                          current scrutineeFact peelNat facts)).map
+                            (fun result => result.alternative))).code =
+                  runCode ctx (fuel + 1) current store environment
+                    (.case scrutinee peelNat
+                      ((alternatives.map
+                        (runAlternativeWithFacts declarations summaries owner
+                          current scrutineeFact peelNat facts)).map
+                            (fun result => result.alternative))) :=
+                  runCode_runKnownCase_eq henvironment habstract
+                _ = runCode ctx (fuel + 1) current store environment
+                      (.case scrutinee peelNat alternatives) :=
+                  runCode_caseWithFactsBodies_eq henvironment habstract
+                    (fun henv => ih henv)
+
+/-- Changing one owner-sensitive current body preserves a case step whenever
+the two current frames agree at the smaller fuel. -/
+private theorem runCode_case_rewriteCurrentAt_eq
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ix.Compiler.Ixon.Address) (current : FnDef)
+    {ctx : Ctx} {fuel : Nat}
+    (ih : ∀ {store : Store} {environment : List RVal} {input : Code},
+      runCode ctx fuel
+          (rewriteCurrentAt declarations summaries owner current)
+          store environment input =
+        runCode ctx fuel current store environment input)
+    (store : Store) (environment : List RVal)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt) :
+    runCode ctx (fuel + 1)
+        (rewriteCurrentAt declarations summaries owner current)
+        store environment (.case scrutinee peelNat alternatives) =
+      runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  simp only [runCode]
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error => simp [bind, Except.bind]
+  | ok value =>
+      simp only [bind, Except.bind]
+      cases value with
+      | erased => rfl
+      | lit literal =>
+          cases literal with
+          | str value => rfl
+          | nat value =>
+              simp only
+              cases peelNat with
+              | false => rfl
+              | true =>
+                  simp only
+                  cases value with
+                  | zero =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => exact ih
+                              | succ fields => simp
+                  | succ value =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => simp
+                              | succ fields =>
+                                  cases fields with
+                                  | zero => exact ih
+                                  | succ fields => simp
+      | loc location =>
+          simp only
+          cases hget : store.get? location with
+          | none => simp
+          | some box =>
+              simp only
+              cases hnode : box.node with
+              | papN function arity arguments => simp
+              | ctorN identity fields =>
+                  simp only
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == identity.cidx) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          by_cases hfields : fields.size = fieldCount
+                          · simpa [hfields] using
+                              ih (store := store)
+                                (environment := fields.foldl
+                                  (fun result field => field :: result)
+                                  environment)
+                                (input := body)
+                          · simp [hfields]
+
+/-- At one positive operation fuel, changing the owner-sensitive current body
+is invisible.  `callSelf` uses both the smaller-fuel frame hypothesis and the
+proved HPT traversal equality for the rewritten recursive body. -/
+private theorem runOp_rewriteCurrentAt_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Ix.Compiler.Ixon.Address} {current : FnDef}
+    {fuel : Nat}
+    (ih : ∀ {store : Store} {environment : List RVal} {input : Code},
+      runCode ctx fuel
+          (rewriteCurrentAt declarations summaries owner current)
+          store environment input =
+        runCode ctx fuel current store environment input)
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (store : Store) (environment : List RVal) (operation : Op) :
+    runOp ctx (fuel + 1)
+        (rewriteCurrentAt declarations summaries owner current)
+        store environment operation =
+      runOp ctx (fuel + 1) current store environment operation := by
+  cases operation <;> try simp [runOp, rewriteCurrentAt]
+  case callSelf arguments =>
+    cases harguments : resolveAtoms environment arguments with
+    | error error => simp [bind, Except.bind]
+    | ok values =>
+        by_cases harity : values.length = current.arity
+        · have henvironment : EnvironmentHolds declarations store
+              (List.replicate current.arity Fact.top) values.reverse := by
+            simpa [harity] using
+              (EnvironmentHolds.top_replicate declarations store
+                values.reverse)
+          have hbody :
+              runCode ctx fuel
+                  (rewriteCurrentAt declarations summaries owner current)
+                  store values.reverse
+                  (rewriteCurrentAt declarations summaries owner current).body =
+                runCode ctx fuel current store values.reverse current.body := by
+            calc
+              runCode ctx fuel
+                  (rewriteCurrentAt declarations summaries owner current)
+                  store values.reverse
+                  (rewriteCurrentAt declarations summaries owner current).body =
+                runCode ctx fuel current store values.reverse
+                  (rewriteCurrentAt declarations summaries owner current).body :=
+                ih
+              _ = runCode ctx fuel current store values.reverse current.body := by
+                simpa [rewriteCurrentAt, runFunction] using
+                  (runCode_runWithFacts_eq hpost hctx hcurrent henvironment)
+          simp only [rewriteCurrentAt] at hbody
+          simp [harity, bind, Except.bind]
+          rw [hbody]
+        · simp [harity, bind, Except.bind]
+
+/-- Rewriting a stored function from its owner-aware HPT environment is
+observationally irrelevant to arbitrary code executed under that current
+frame. -/
+theorem runCode_rewriteCurrentAt_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Ix.Compiler.Ixon.Address} {current : FnDef}
+    {store : Store} {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current)) :
+    runCode ctx fuel (rewriteCurrentAt declarations summaries owner current)
+        store environment input =
+      runCode ctx fuel current store environment input := by
+  induction fuel using Nat.strongRecOn generalizing store environment input with
+  | ind fuel ih =>
+      cases fuel with
+      | zero => simp [runCode]
+      | succ fuel =>
+          have hsmaller : ∀ {store : Store} {environment : List RVal}
+              {input : Code},
+              runCode ctx fuel
+                  (rewriteCurrentAt declarations summaries owner current)
+                  store environment input =
+                runCode ctx fuel current store environment input :=
+            ih fuel (Nat.lt_succ_self fuel)
+          cases input with
+          | ret atom => simp [runCode]
+          | case scrutinee peelNat alternatives =>
+              exact runCode_case_rewriteCurrentAt_eq declarations summaries
+                owner current hsmaller store environment scrutinee peelNat
+                alternatives
+          | letOp operation rest =>
+              cases fuel with
+              | zero => simp [runCode, runOp]
+              | succ smaller =>
+                  simp only [runCode]
+                  rw [runOp_rewriteCurrentAt_eq hpost
+                    (ih smaller (by omega)) hctx hcurrent]
+                  cases hoperation : runOp ctx (smaller + 1) current store
+                      environment operation with
+                  | error error => simp [bind, Except.bind]
+                  | ok output =>
+                      rcases output with ⟨outputStore, outputValue⟩
+                      simp only [bind, Except.bind]
+                      exact ih (smaller + 1) (by omega)
+                        (store := outputStore)
+                        (environment := outputValue :: environment)
+                        (input := rest)
+
+/-- Combined body-and-current equality used when invocation enters a rewritten
+stored function. -/
+theorem runCode_rewriteCurrentAt_body_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Ix.Compiler.Ixon.Address} {current : FnDef}
+    {store : Store} {environment : List RVal} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (henvironment : EnvironmentHolds declarations store
+      (List.replicate current.arity Fact.top) environment) :
+    runCode ctx fuel (rewriteCurrentAt declarations summaries owner current)
+        store environment
+        (rewriteCurrentAt declarations summaries owner current).body =
+      runCode ctx fuel current store environment current.body := by
+  calc
+    runCode ctx fuel (rewriteCurrentAt declarations summaries owner current)
+        store environment
+        (rewriteCurrentAt declarations summaries owner current).body =
+      runCode ctx fuel current store environment
+        (rewriteCurrentAt declarations summaries owner current).body :=
+      runCode_rewriteCurrentAt_eq hpost hctx hcurrent
+    _ = runCode ctx fuel current store environment current.body := by
+      simpa [rewriteCurrentAt, runFunction] using
+        (runCode_runWithFacts_eq hpost hctx hcurrent henvironment)
+
+@[simp] private theorem runAlternativeRecursive_cidx
+    (declarations : DeclEnv) (summaries : SummaryEnv) (alternative : Alt) :
+    (runAlternativeRecursive declarations summaries
+      alternative).alternative.cidx = alternative.cidx := by
+  cases alternative
+  simp [runAlternativeRecursive, Alt.cidx]
+
+/-- Recursive body rewriting leaves the case-dispatch predicate unchanged. -/
+private theorem runAlternativeRecursive_predicate
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (index : Nat) :
+    ((fun alternative : Alt => alternative.cidx == index) ∘
+        (fun result : AlternativeOutcome => result.alternative) ∘
+        runAlternativeRecursive declarations summaries) =
+      (fun alternative => alternative.cidx == index) := by
+  funext alternative
+  cases alternative
+  simp [Function.comp_def, runAlternativeRecursive, Alt.cidx]
+
+/-- Recursive body rewriting preserves first-match dispatch and returns the
+rewritten version of the originally selected alternative. -/
+private theorem find?_runAlternativeRecursive
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (alternatives : Array Alt) (index : Nat) :
+    ((alternatives.map (runAlternativeRecursive declarations summaries)).map
+        (fun result => result.alternative)).find?
+          (fun alternative => alternative.cidx == index) =
+      (alternatives.find? (fun alternative => alternative.cidx == index)).map
+        (fun alternative =>
+          (runAlternativeRecursive declarations summaries
+            alternative).alternative) := by
+  rw [Array.map_map, Array.find?_map,
+    runAlternativeRecursive_predicate declarations summaries index]
+  simp [Function.comp_def]
+
+/-- If every recursively rewritten body is equivalent at the smaller fuel,
+then a case whose alternative bodies were all rewritten is equivalent at the
+successor fuel. -/
+private theorem runCode_recursiveCase_eq
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    {ctx : Ctx} {fuel : Nat}
+    (ih : ∀ {current : FnDef} {store : Store} {environment : List RVal}
+      {input : Code},
+      runCode ctx fuel current store environment
+          (runRecursive declarations summaries input).code =
+        runCode ctx fuel current store environment input)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt) :
+    runCode ctx (fuel + 1) current store environment
+        (runRecursive declarations summaries
+          (.case scrutinee peelNat alternatives)).code =
+      runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  simp only [runRecursive, runCode]
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error =>
+      simp [bind, Except.bind]
+  | ok value =>
+      simp only [bind, Except.bind]
+      cases value with
+      | erased => rfl
+      | lit literal =>
+          cases literal with
+          | str value => rfl
+          | nat value =>
+              simp only
+              cases peelNat with
+              | false => rfl
+              | true =>
+                  simp only
+                  cases value with
+                  | zero =>
+                      simp only
+                      rw [find?_runAlternativeRecursive]
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none =>
+                          simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  simpa [runAlternativeRecursive] using
+                                    ih (current := current) (store := store)
+                                      (environment := environment) (input := body)
+                              | succ fields =>
+                                  simp [runAlternativeRecursive]
+                  | succ value =>
+                      simp only
+                      rw [find?_runAlternativeRecursive]
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none =>
+                          simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  simp [runAlternativeRecursive]
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      simpa [runAlternativeRecursive] using
+                                        ih (current := current) (store := store)
+                                          (environment :=
+                                            .lit (.nat value) :: environment)
+                                          (input := body)
+                                  | succ fields =>
+                                      simp [runAlternativeRecursive]
+      | loc location =>
+          simp only
+          cases hget : store.get? location with
+          | none => simp
+          | some box =>
+              simp only
+              cases hnode : box.node with
+              | papN function arity arguments => simp
+              | ctorN identity fields =>
+                  simp only
+                  rw [find?_runAlternativeRecursive]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == identity.cidx) with
+                  | none =>
+                      simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          by_cases hfields : fields.size = fieldCount
+                          · simpa [hfields, runAlternativeRecursive] using
+                              ih (current := current) (store := store)
+                                (environment := fields.foldl
+                                  (fun result field => field :: result)
+                                  environment)
+                                (input := body)
+                          · simp [hfields, runAlternativeRecursive]
+
+/-- Recursive traversal preserves the exact evaluator result for every code
+fragment under the same local post-fixpoint premise as the one-root pass. -/
+theorem runCode_runRecursive_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runCode ctx fuel current store environment
+        (runRecursive declarations summaries input).code =
+      runCode ctx fuel current store environment input := by
+  induction fuel generalizing current store environment input with
+  | zero => simp [runCode]
+  | succ fuel ih =>
+      cases input with
+      | ret atom => simp [runRecursive]
+      | case scrutinee peelNat alternatives =>
+          exact runCode_recursiveCase_eq declarations summaries ih current
+            store environment scrutinee peelNat alternatives
+      | letOp operation rest =>
+          let nested := runRecursive declarations summaries rest
+          calc
+            runCode ctx (fuel + 1) current store environment
+                (runRecursive declarations summaries
+                  (.letOp operation rest)).code =
+              runCode ctx (fuel + 1) current store environment
+                (.letOp operation nested.code) := by
+                  simpa only [runRecursive, nested] using
+                    runCode_run_eq hpost (fuel := fuel + 1) hctx
+                      (input := .letOp operation nested.code)
+            _ = runCode ctx (fuel + 1) current store environment
+                (.letOp operation rest) := by
+                  simp only [runCode]
+                  cases hoperation : runOp ctx fuel current store environment
+                      operation with
+                  | error error => simp [bind, Except.bind]
+                  | ok output =>
+                      rcases output with ⟨outputStore, outputValue⟩
+                      simp only [bind, Except.bind]
+                      exact ih (current := current) (store := outputStore)
+                        (environment := outputValue :: environment)
+                        (input := rest)
+
+/-- Changing only the current body preserves a case step whenever evaluation
+under the two current frames agrees at the smaller fuel. -/
+private theorem runCode_case_rewriteCurrent_eq
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    {ctx : Ctx} {fuel : Nat}
+    (ih : ∀ {current : FnDef} {store : Store} {environment : List RVal}
+      {input : Code},
+      runCode ctx fuel (rewriteCurrent declarations summaries current)
+          store environment input =
+        runCode ctx fuel current store environment input)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt) :
+    runCode ctx (fuel + 1) (rewriteCurrent declarations summaries current)
+        store environment (.case scrutinee peelNat alternatives) =
+      runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  simp only [runCode]
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error => simp [bind, Except.bind]
+  | ok value =>
+      simp only [bind, Except.bind]
+      cases value with
+      | erased => rfl
+      | lit literal =>
+          cases literal with
+          | str value => rfl
+          | nat value =>
+              simp only
+              cases peelNat with
+              | false => rfl
+              | true =>
+                  simp only
+                  cases value with
+                  | zero =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero =>
+                                  exact ih (current := current) (store := store)
+                                    (environment := environment) (input := body)
+                              | succ fields => simp
+                  | succ value =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp
+                      | some alternative =>
+                          cases alternative with
+                          | mk cidx fields body =>
+                              cases fields with
+                              | zero => simp
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      exact ih (current := current)
+                                        (store := store)
+                                        (environment :=
+                                          .lit (.nat value) :: environment)
+                                        (input := body)
+                                  | succ fields => simp
+      | loc location =>
+          simp only
+          cases hget : store.get? location with
+          | none => simp
+          | some box =>
+              simp only
+              cases hnode : box.node with
+              | papN function arity arguments => simp
+              | ctorN identity fields =>
+                  simp only
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == identity.cidx) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          by_cases hfields : fields.size = fieldCount
+                          · simpa [hfields] using
+                              ih (current := current) (store := store)
+                                (environment := fields.foldl
+                                  (fun result field => field :: result)
+                                  environment)
+                                (input := body)
+                          · simp [hfields]
+
+/-- At one positive operation fuel, rewriting the current body is invisible.
+The only non-definitional case is `callSelf`, whose recursive body execution
+is discharged by the smaller-fuel current-frame hypothesis. -/
+private theorem runOp_rewriteCurrent_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {fuel : Nat}
+    (ih : ∀ {current : FnDef} {store : Store} {environment : List RVal}
+      {input : Code},
+      runCode ctx fuel (rewriteCurrent declarations summaries current)
+          store environment input =
+        runCode ctx fuel current store environment input)
+    (hctx : ctx.decls = declarations)
+    (current : FnDef) (store : Store) (environment : List RVal)
+    (operation : Op) :
+    runOp ctx (fuel + 1) (rewriteCurrent declarations summaries current)
+        store environment operation =
+      runOp ctx (fuel + 1) current store environment operation := by
+  cases operation <;> try simp [runOp]
+  case callSelf arguments =>
+    cases harguments : resolveAtoms environment arguments with
+    | error error =>
+        simp [bind, Except.bind]
+    | ok values =>
+        by_cases harity : values.length = current.arity
+        · have hbody :
+              runCode ctx fuel
+                  (rewriteCurrent declarations summaries current) store
+                  values.reverse
+                  (rewriteCurrent declarations summaries current).body =
+                runCode ctx fuel current store values.reverse current.body := by
+            calc
+              runCode ctx fuel
+                  (rewriteCurrent declarations summaries current) store
+                  values.reverse
+                  (rewriteCurrent declarations summaries current).body =
+                runCode ctx fuel
+                  (rewriteCurrent declarations summaries current) store
+                  values.reverse current.body := by
+                    simpa only [rewriteCurrent] using
+                      runCode_runRecursive_eq hpost (fuel := fuel) hctx
+                        (current := rewriteCurrent declarations summaries current)
+                        (store := store) (environment := values.reverse)
+                        (input := current.body)
+              _ = runCode ctx fuel current store values.reverse current.body :=
+                ih (current := current) (store := store)
+                  (environment := values.reverse) (input := current.body)
+          simp only [rewriteCurrent] at hbody
+          simp [rewriteCurrent, harity, bind, Except.bind]
+          rw [hbody]
+        · simp [rewriteCurrent, harity, bind, Except.bind]
+
+/-- Rewriting a current-function body is observationally irrelevant when the
+same current frame is used by `callSelf`.  Strong induction supplies the
+strictly smaller recursive self-call. -/
+theorem runCode_rewriteCurrent_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runCode ctx fuel (rewriteCurrent declarations summaries current)
+        store environment input =
+      runCode ctx fuel current store environment input := by
+  induction fuel using Nat.strongRecOn generalizing current store
+      environment input with
+  | ind fuel ih =>
+      cases fuel with
+      | zero => simp [runCode]
+      | succ fuel =>
+          have hsmaller : ∀ {current : FnDef} {store : Store}
+              {environment : List RVal} {input : Code},
+              runCode ctx fuel
+                  (rewriteCurrent declarations summaries current)
+                  store environment input =
+                runCode ctx fuel current store environment input :=
+            ih fuel (Nat.lt_succ_self fuel)
+          cases input with
+          | ret atom => simp [runCode]
+          | case scrutinee peelNat alternatives =>
+              exact runCode_case_rewriteCurrent_eq declarations summaries
+                hsmaller current store environment scrutinee peelNat
+                alternatives
+          | letOp operation rest =>
+              cases fuel with
+              | zero => simp [runCode, runOp]
+              | succ smaller =>
+                  simp only [runCode]
+                  rw [runOp_rewriteCurrent_eq hpost
+                    (ih smaller (by omega)) hctx]
+                  cases hoperation : runOp ctx (smaller + 1) current store
+                      environment operation with
+                  | error error => simp [bind, Except.bind]
+                  | ok output =>
+                      rcases output with ⟨outputStore, outputValue⟩
+                      simp only [bind, Except.bind]
+                      exact ih (smaller + 1) (by omega)
+                        (current := current) (store := outputStore)
+                        (environment := outputValue :: environment)
+                        (input := rest)
+
+/-- Recursive pruning can update both a supplied fragment and the current
+frame that `callSelf` re-enters. -/
+theorem runCode_runRecursive_rewriteCurrent_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runCode ctx fuel (rewriteCurrent declarations summaries current)
+        store environment (runRecursive declarations summaries input).code =
+      runCode ctx fuel current store environment input := by
+  calc
+    runCode ctx fuel (rewriteCurrent declarations summaries current)
+        store environment (runRecursive declarations summaries input).code =
+      runCode ctx fuel (rewriteCurrent declarations summaries current)
+        store environment input := runCode_runRecursive_eq hpost hctx
+    _ = runCode ctx fuel current store environment input :=
+      runCode_rewriteCurrent_eq hpost hctx
+
+/-- Recursive pruning of a top-level main is exact even when `callSelf`
+re-enters that main. -/
+theorem runMain_runRecursive_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runMain ctx (runRecursive declarations summaries input).code fuel =
+      runMain ctx input fuel := by
+  simpa [runMain, rewriteCurrent] using
+    (runCode_runRecursive_rewriteCurrent_eq hpost
+      (current := ⟨0, .shared, false, input⟩) (store := {}) (environment := [])
+      (input := input) (fuel := fuel) hctx)
+
+/-- Whole-program certificate specialization of `runCode_run_eq`. -/
+theorem runCode_run_eq_of_postFixpoint
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    (hcertificate : certificate.postFixpoint program = true)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runCode ctx fuel current store environment
+        (run (programDeclEnv program) certificate.summaryEnv input).code =
+      runCode ctx fuel current store environment input := by
+  exact runCode_run_eq
+    (localPostFixpoint_of_postFixpoint hcertificate) hctx
+
+/-- A successful configurable HPT check is sufficient authority for the
+consumer.  The returned materialized summary identities are not trusted as a
+substitute for the checked candidate's post-fixpoint evidence. -/
+theorem runCode_run_eq_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    (hcheck : HPT.runWith limits program certificate = .ok result)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runCode ctx fuel current store environment
+        (run (programDeclEnv program) certificate.summaryEnv input).code =
+      runCode ctx fuel current store environment input := by
+  exact runCode_run_eq_of_postFixpoint
+    (postFixpoint_of_runWith_eq_ok hcheck) hctx
+
+/-- Whole-program certificate specialization of `runCode_runRecursive_eq`. -/
+theorem runCode_runRecursive_eq_of_postFixpoint
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    (hcertificate : certificate.postFixpoint program = true)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runCode ctx fuel current store environment
+        (runRecursive (programDeclEnv program) certificate.summaryEnv input).code =
+      runCode ctx fuel current store environment input := by
+  exact runCode_runRecursive_eq
+    (localPostFixpoint_of_postFixpoint hcertificate) hctx
+
+/-- A successful configurable HPT check is sufficient authority for recursive
+pruning throughout the supplied code fragment. -/
+theorem runCode_runRecursive_eq_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    (hcheck : HPT.runWith limits program certificate = .ok result)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runCode ctx fuel current store environment
+        (runRecursive (programDeclEnv program) certificate.summaryEnv input).code =
+      runCode ctx fuel current store environment input := by
+  exact runCode_runRecursive_eq_of_postFixpoint
+    (postFixpoint_of_runWith_eq_ok hcheck) hctx
+
+/-- Whole-program certificate specialization of the self-call-aware main
+theorem.  The declaration environment remains the checked addressed graph. -/
+theorem runMain_runRecursive_eq_of_postFixpoint
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    (hcertificate : certificate.postFixpoint program = true)
+    {ctx : Ctx} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runMain ctx
+        (runRecursive (programDeclEnv program) certificate.summaryEnv
+          input).code fuel =
+      runMain ctx input fuel := by
+  exact runMain_runRecursive_eq
+    (localPostFixpoint_of_postFixpoint hcertificate) hctx
+
+/-- Successful configurable checking authorizes recursive main pruning,
+including every dynamic re-entry through `callSelf`. -/
+theorem runMain_runRecursive_eq_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    (hcheck : HPT.runWith limits program certificate = .ok result)
+    {ctx : Ctx} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runMain ctx
+        (runRecursive (programDeclEnv program) certificate.summaryEnv
+          input).code fuel =
+      runMain ctx input fuel := by
+  exact runMain_runRecursive_eq_of_postFixpoint
+    (postFixpoint_of_runWith_eq_ok hcheck) hctx
+
+end Ix.Compiler.IxIR1.HPT.CasePrune
diff --git a/Ix/Compiler/IxIR1/HPTCasePruneProgram.lean b/Ix/Compiler/IxIR1/HPTCasePruneProgram.lean
new file mode 100644
index 000000000..f641f343a
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTCasePruneProgram.lean
@@ -0,0 +1,360 @@
+import Ix.Compiler.IxIR1.HPTCasePrune
+import Ix.Compiler.IxIR1.EvalRewrite
+import Ix.Compiler.IxIR1.ReaddressAllSim
+
+/-!
+# Whole-program semantic support for HPT case simplification
+
+`HPTCasePrune` proves supplied fragments equivalent in a fixed environment and
+proves each owner-sensitive, fact-propagated function rewrite equivalent in
+its original frame.  Rewriting every stored function changes the environment
+itself: direct calls and PAP application subsequently enter the rewritten
+definitions.  This module discharges the generic exact-environment contract;
+`EvalRewrite` closes that recursive seam once by a common fuel induction over
+every evaluator entry point.
+
+The result is still a logical, old-keyed environment.  A production artifact
+must readdress `rewriteEntries`; that content-address rebuild is kept separate
+so no theorem silently treats changed declaration bytes as retaining their old
+identity.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.CasePrune
+
+/-- The logical case-pruned declaration environment preserves misses, externs,
+calling conventions, and exact source-context behavior for every function. -/
+theorem exactEnvironment_rewriteCtx
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} (hctx : ctx.decls = declarations) :
+    Sim.ExactEnvironment ctx (rewriteCtx declarations summaries ctx) := by
+  constructor
+  · rfl
+  · intro address hsource
+    have hdeclaration : declarations address = none := by
+      rw [← hctx]
+      exact hsource
+    simp [rewriteCtx, rewriteDeclEnv, hdeclaration]
+  · intro address arity hsource
+    have hdeclaration : declarations address = some (.extern arity) := by
+      rw [← hctx]
+      exact hsource
+    simp [rewriteCtx, rewriteDeclEnv, hdeclaration, rewriteDeclarationAt]
+  · intro address source hsource
+    have hdeclaration : declarations address = some (.fn source) := by
+      rw [← hctx]
+      exact hsource
+    refine ⟨rewriteCurrentAt declarations summaries address source, ?_,
+      rfl, rfl, rfl, ?_⟩
+    · simp [rewriteCtx, rewriteDeclEnv, hdeclaration, rewriteDeclarationAt]
+    · intro fuel store environment hlength
+      have henvironment : EnvironmentHolds declarations store
+          (List.replicate source.arity Fact.top) environment := by
+        simpa [hlength] using
+          (EnvironmentHolds.top_replicate declarations store environment)
+      exact runCode_rewriteCurrentAt_body_eq hpost hctx hdeclaration
+        henvironment
+
+/-- Replacing every declaration body under the existing keys is evaluator
+equivalent for arbitrary code and dynamic current frames. -/
+theorem runCode_rewriteCtx_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {store : Store}
+    {environment : List RVal} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runCode (rewriteCtx declarations summaries ctx) fuel current store
+        environment input =
+      runCode ctx fuel current store environment input :=
+  Sim.runCode_exactEnvironment_eq (exactEnvironment_rewriteCtx hpost hctx)
+
+/-- Logical whole-program rewrite: declaration bodies and the main/current
+frame are pruned together, with exact equality of successes and every error. -/
+theorem runMain_rewriteProgram_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations) :
+    runMain (rewriteCtx declarations summaries ctx)
+        (runRecursive declarations summaries input).code fuel =
+      runMain ctx input fuel := by
+  calc
+    runMain (rewriteCtx declarations summaries ctx)
+        (runRecursive declarations summaries input).code fuel =
+      runMain ctx (runRecursive declarations summaries input).code fuel := by
+        simpa [runMain] using
+          (runCode_rewriteCtx_eq hpost
+            (current := ⟨0, .shared, false,
+              (runRecursive declarations summaries input).code⟩)
+            (store := {}) (environment := [])
+            (input := (runRecursive declarations summaries input).code)
+            (fuel := fuel) hctx)
+    _ = runMain ctx input fuel := runMain_runRecursive_eq hpost hctx
+
+private theorem find?_rewriteEntries
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (address : Ix.Compiler.Ixon.Address) :
+    ∀ entries : List (Ix.Compiler.Ixon.Address × Decl),
+      (rewriteEntries declarations summaries entries).find?
+          (fun entry => entry.1 == address) =
+        (entries.find? (fun entry => entry.1 == address)).map
+          (fun entry =>
+            (entry.1,
+              rewriteDeclarationAt declarations summaries entry.1
+                entry.2)) := by
+  intro entries
+  induction entries with
+  | nil => rfl
+  | cons entry rest ih =>
+      rcases entry with ⟨entryAddress, declaration⟩
+      simp only [rewriteEntries, List.map_cons, List.find?_cons]
+      by_cases hsame : entryAddress == address
+      · simp [hsame]
+      · simp only [hsame]
+        exact ih
+
+/-- Mapping the declarations in a concrete list realizes exactly the logical
+environment transformer used by the semantic theorem. -/
+theorem envOfList_rewriteEntries
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (entries : List (Ix.Compiler.Ixon.Address × Decl)) :
+    Env.ofList (rewriteEntries declarations summaries entries) =
+      fun address =>
+        (Env.ofList entries address).map
+          (rewriteDeclarationAt declarations summaries address) := by
+  funext address
+  unfold Env.ofList
+  rw [find?_rewriteEntries]
+  cases hentry : entries.find? (fun entry => entry.1 == address) with
+  | none => rfl
+  | some entry =>
+      rcases entry with ⟨entryAddress, declaration⟩
+      have hsame := List.find?_some hentry
+      have haddress : entryAddress = address := beq_iff_eq.mp hsame
+      subst entryAddress
+      rfl
+
+/-! ## Content-addressed program rebuild -/
+
+/-- Collect all pass-attributed counters from one stored declaration with its
+owner-sensitive fact traversal. -/
+def declarationChanges (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Ix.Compiler.Ixon.Address) :
+    Decl → Changes
+  | .fn function =>
+      (runFunction declarations summaries owner function).changes
+  | .extern _ => {}
+
+/-- Sum declaration-body changes in original row order. -/
+def declarationsChanges (declarations : DeclEnv)
+    (summaries : SummaryEnv)
+    (entries : List (Ix.Compiler.Ixon.Address × Decl)) : Changes :=
+  entries.foldl (fun total entry =>
+    total.add
+      (declarationChanges declarations summaries entry.1 entry.2)) {}
+
+/-- Observable result of simplifying every function body and the main, then
+rebuilding the complete content-addressed declaration graph. -/
+structure ProgramOutcome where
+  result : ReaddressAll.Result
+  removedAlternatives : Nat
+  collapsedCases : Nat
+  materializedFetches : Nat
+
+/-- Readdress a complete already-addressed program after recursive HPT case
+simplification.  This low-level operation consumes supplied summaries; checked
+pipeline entry points first validate those summaries against `program`. -/
+def rebuildProgram (reserved : List Ix.Compiler.Ixon.Address)
+    (program : List ReaddressAll.Artifact) (summaries : SummaryEnv)
+    (main : Code) : Except String ProgramOutcome := do
+  let declarations := programDeclEnv program
+  let entries := declarationEntries program
+  let rewritten := rewriteEntries declarations summaries entries
+  let rewrittenMain := runRecursive declarations summaries main
+  let declarationChanges := declarationsChanges declarations summaries entries
+  let result ← ReaddressAll.rebuild reserved rewritten rewrittenMain.code
+  return ⟨result, rewrittenMain.removedAlternatives +
+      declarationChanges.removedAlternatives,
+    rewrittenMain.collapsedCases +
+      declarationChanges.collapsedCases,
+    rewrittenMain.materializedFetches +
+      declarationChanges.materializedFetches⟩
+
+theorem rebuild_of_rebuildProgram_eq_ok
+    {reserved : List Ix.Compiler.Ixon.Address}
+    {program : List ReaddressAll.Artifact} {summaries : SummaryEnv}
+    {main : Code} {outcome : ProgramOutcome}
+    (hrun : rebuildProgram reserved program summaries main = .ok outcome) :
+    ReaddressAll.rebuild reserved
+        (rewriteEntries (programDeclEnv program) summaries
+          (declarationEntries program))
+        (runRecursive (programDeclEnv program) summaries main).code =
+      .ok outcome.result := by
+  unfold rebuildProgram at hrun
+  simp only [bind, Except.bind] at hrun
+  cases hrebuild : ReaddressAll.rebuild reserved
+      (rewriteEntries (programDeclEnv program) summaries
+        (declarationEntries program))
+      (runRecursive (programDeclEnv program) summaries main).code with
+  | error message =>
+      rw [hrebuild] at hrun
+      contradiction
+  | ok result =>
+      rw [hrebuild] at hrun
+      have houtcome :
+          (⟨result,
+            (runRecursive (programDeclEnv program) summaries main).removedAlternatives +
+              (declarationsChanges (programDeclEnv program) summaries
+                (declarationEntries program)).removedAlternatives,
+            (runRecursive (programDeclEnv program) summaries main).collapsedCases +
+              (declarationsChanges (programDeclEnv program) summaries
+                (declarationEntries program)).collapsedCases,
+            (runRecursive (programDeclEnv program) summaries main).materializedFetches +
+              (declarationsChanges (programDeclEnv program) summaries
+                (declarationEntries program)).materializedFetches⟩ :
+              ProgramOutcome) =
+            outcome := by
+        injection hrun
+      have hresult : result = outcome.result :=
+        congrArg ProgramOutcome.result houtcome
+      exact congrArg Except.ok hresult
+
+/-- The HPT program environment is the transparent first-binding-wins lookup
+of the same declaration rows passed to the rebuild. -/
+theorem envOfList_declarationEntries
+    (program : List ReaddressAll.Artifact) :
+    Env.ofList (declarationEntries program) = programDeclEnv program := by
+  exact (AddressEnv.lookup_build (declarationEntries program)).symm
+
+/-- Old-keyed context paired with the oracle pullback of an exact rebuild.
+Its declaration environment is the unmodified program environment. -/
+def rebuildOriginalCtx (result : ReaddressAll.Result)
+    (rewritten : List (Ix.Compiler.Ixon.Address × Decl))
+    (declarations : DeclEnv)
+    (oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal) : Ctx :=
+  { decls := declarations
+    oracle := (result.rebuildSourceCtx rewritten oracle).oracle }
+
+/-- Rebuilding the logically rewritten graph transports the complete
+evaluator result from the exact old-keyed program context. -/
+theorem runMain_rebuild_rewriteProgram
+    {reserved : List Ix.Compiler.Ixon.Address}
+    {entries : List (Ix.Compiler.Ixon.Address × Decl)}
+    {declarations : DeclEnv} {summaries : SummaryEnv} {main : Code}
+    {result : ReaddressAll.Result}
+    (hentries : Env.ofList entries = declarations)
+    (hpost : LocalPostFixpoint declarations summaries)
+    (hrebuild : ReaddressAll.rebuild reserved
+      (rewriteEntries declarations summaries entries)
+      (runRecursive declarations summaries main).code = .ok result)
+    (oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal :=
+      fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      Readdress.mapRunResult
+        (result.rebuildRename
+          (rewriteEntries declarations summaries entries))
+        (runMain
+          (rebuildOriginalCtx result
+            (rewriteEntries declarations summaries entries)
+            declarations oracle)
+          main fuel) := by
+  let rewritten := rewriteEntries declarations summaries entries
+  let before := rebuildOriginalCtx result rewritten declarations oracle
+  have hbefore : before.decls = declarations := rfl
+  have hctx : rewriteCtx declarations summaries before =
+      result.rebuildSourceCtx rewritten oracle := by
+    simp [rewriteCtx, before, rewritten, rebuildOriginalCtx,
+      ReaddressAll.Result.rebuildSourceCtx,
+      envOfList_rewriteEntries, hentries]
+    funext address
+    rfl
+  rw [ReaddressAll.runMain_exact_of_rebuild_eq_ok hrebuild oracle fuel]
+  apply congrArg (Readdress.mapRunResult
+    (result.rebuildRename rewritten))
+  rw [← hctx]
+  exact runMain_rewriteProgram_eq hpost hbefore
+
+/-- Successful HPT checking plus successful graph rebuilding authorizes the
+exact whole-program evaluator transport theorem. -/
+theorem runMain_rebuildProgram_of_runWith_eq_ok
+    {limits : Limits} {reserved : List Ix.Compiler.Ixon.Address}
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {analysis : HPT.Result} {main : Code} {outcome : ProgramOutcome}
+    (hcheck : HPT.runWith limits program certificate = .ok analysis)
+    (hrebuild : rebuildProgram reserved program certificate.summaryEnv main =
+      .ok outcome)
+    (oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal :=
+      fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (outcome.result.addressedCtx oracle) outcome.result.main fuel =
+      Readdress.mapRunResult
+        (outcome.result.rebuildRename
+          (rewriteEntries (programDeclEnv program) certificate.summaryEnv
+            (declarationEntries program)))
+        (runMain
+          (rebuildOriginalCtx outcome.result
+            (rewriteEntries (programDeclEnv program) certificate.summaryEnv
+              (declarationEntries program))
+            (programDeclEnv program) oracle)
+          main fuel) := by
+  apply runMain_rebuild_rewriteProgram
+  · exact envOfList_declarationEntries program
+  · exact localPostFixpoint_of_postFixpoint
+      (postFixpoint_of_runWith_eq_ok hcheck)
+  · exact rebuild_of_rebuildProgram_eq_ok hrebuild
+
+/-- With the closed default oracle, the source side is exactly the ordinary
+old addressed program context. -/
+theorem runMain_rebuildProgram_of_runWith_eq_ok_defaultOracle
+    {limits : Limits} {reserved : List Ix.Compiler.Ixon.Address}
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {analysis : HPT.Result} {main : Code} {outcome : ProgramOutcome}
+    (hcheck : HPT.runWith limits program certificate = .ok analysis)
+    (hrebuild : rebuildProgram reserved program certificate.summaryEnv main =
+      .ok outcome)
+    (fuel : Nat := 100000) :
+    runMain (outcome.result.addressedCtx (fun _ _ => none))
+        outcome.result.main fuel =
+      Readdress.mapRunResult
+        (outcome.result.rebuildRename
+          (rewriteEntries (programDeclEnv program) certificate.summaryEnv
+            (declarationEntries program)))
+        (runMain { decls := programDeclEnv program } main fuel) := by
+  simpa [rebuildOriginalCtx, ReaddressAll.Result.rebuildSourceCtx] using
+    (runMain_rebuildProgram_of_runWith_eq_ok hcheck hrebuild
+      (fun _ _ => none) fuel)
+
+/-- Checked whole-program specialization.  The result is the exact logical
+semantics of the old-keyed declaration list and pruned main, immediately
+before content-address rebuilding. -/
+theorem runMain_rewriteProgram_eq_of_postFixpoint
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    (hcertificate : certificate.postFixpoint program = true)
+    {ctx : Ctx} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runMain
+        (rewriteCtx (programDeclEnv program) certificate.summaryEnv ctx)
+        (runRecursive (programDeclEnv program) certificate.summaryEnv
+          input).code fuel =
+      runMain ctx input fuel := by
+  exact runMain_rewriteProgram_eq
+    (localPostFixpoint_of_postFixpoint hcertificate) hctx
+
+/-- Successful configurable checking authorizes simultaneous rewriting of
+the complete logical declaration environment and main/current frame. -/
+theorem runMain_rewriteProgram_eq_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    (hcheck : HPT.runWith limits program certificate = .ok result)
+    {ctx : Ctx} {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program) :
+    runMain
+        (rewriteCtx (programDeclEnv program) certificate.summaryEnv ctx)
+        (runRecursive (programDeclEnv program) certificate.summaryEnv
+          input).code fuel =
+      runMain ctx input fuel := by
+  exact runMain_rewriteProgram_eq_of_postFixpoint
+    (postFixpoint_of_runWith_eq_ok hcheck) hctx
+
+end Ix.Compiler.IxIR1.HPT.CasePrune
diff --git a/Ix/Compiler/IxIR1/HPTDestroy.lean b/Ix/Compiler/IxIR1/HPTDestroy.lean
new file mode 100644
index 000000000..15a22bb63
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTDestroy.lean
@@ -0,0 +1,903 @@
+import Ix.Compiler.IxIR1.HPTFetchForward
+
+/-!
+# Checked shape-specialized destruction
+
+This consumer specializes destruction only where the current HPT domain gives
+enough ownership-neutral evidence:
+
+* a proven scalar `drop` or `dropU` becomes `pure erased`;
+* a `dropU` of one exact constructor whose complete field vector is scalar
+  becomes a shallow `free`.
+
+The second rewrite is the first useful known-shape destructor.  It preserves
+the root free while removing the generic node dispatch and recursive field
+walk.  Heap-valued, widened, identity-only, multi-shape, and shared-root facts
+remain on the generic path.  The fuel-boundary guard below records why deeper
+destruction needs a fuel-neutral primitive rather than an expansion in the
+current `Code` language.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.Destroy
+
+open Ix.Compiler.IxIR1.Sim
+
+/-- A recursive field fact which can describe only scalar run-time values.
+Bottom is admitted: it cannot justify a concrete successful path. -/
+def fieldScalarOnly (fact : FieldFact) : Bool :=
+  !fact.unknownHeap && fact.shapes.isEmpty
+
+/-- The exact constructor payload retained by an accepted leaf decision. -/
+structure LeafShape where
+  identity : CtorId
+  fields : List FieldFact
+  deriving BEq, Repr
+
+/-- Recognize one exact, non-scalar constructor shape with a complete
+scalar-only field vector. -/
+def exactLeaf? (fact : Fact) : Option LeafShape :=
+  if fact.mayScalar || fact.unknownHeap then
+    none
+  else
+    match fact.shapes with
+    | [.ctor identity (some fields)] =>
+        if fields.all fieldScalarOnly then some ⟨identity, fields⟩ else none
+    | _ => none
+
+inductive Kind where
+  | sharedScalar
+  | uniqueScalar
+  | uniqueLeaf
+  deriving BEq, Repr
+
+/-- One accepted replacement operation.  Every replacement keeps the single
+let binder and returns `erased`, exactly like the source destructor. -/
+structure Specialization where
+  operation : Op
+  kind : Kind
+
+def specialize? (facts : List Fact) : Op → Option Specialization
+  | .drop target =>
+      match resolveAtomFact facts target with
+      | .error _ => none
+      | .ok fact =>
+          if FetchForward.scalarOnly fact then
+            some ⟨.pure .erased, .sharedScalar⟩
+          else
+            none
+  | .dropU target =>
+      match resolveAtomFact facts target with
+      | .error _ => none
+      | .ok fact =>
+          if FetchForward.scalarOnly fact then
+            some ⟨.pure .erased, .uniqueScalar⟩
+          else if (exactLeaf? fact).isSome then
+            some ⟨.free target, .uniqueLeaf⟩
+          else
+            none
+  | _ => none
+
+/-! The executable boundary is deliberately pinned independently of the
+recursive traversal.  Exact scalar leaves are admitted; any evidence that
+could hide a heap child, another root shape, or an unresolved variable stays
+on the generic destructor. -/
+
+private def guardIdentity : CtorId :=
+  { block := Ixon.Address.replicate 0xd1, indIdx := 0, cidx := 0 }
+
+private def guardChildIdentity : CtorId :=
+  { block := Ixon.Address.replicate 0xd2, indIdx := 0, cidx := 1 }
+
+private def guardLeafFact : Fact :=
+  .heap (.ctor guardIdentity (some [FieldFact.scalar]))
+
+private def guardHeapFieldFact : Fact :=
+  .heap (.ctor guardIdentity
+    (some [.heap (.ctor guardChildIdentity (some []))]))
+
+private def guardIdentityOnlyFact : Fact :=
+  .heap (.ctor guardIdentity none)
+
+private def guardMultiShapeFact : Fact :=
+  { mayScalar := false
+    unknownHeap := false
+    shapes :=
+      [.ctor guardIdentity (some [FieldFact.scalar]),
+       .ctor guardChildIdentity (some [])] }
+
+private def isPureErased (kind : Kind) : Option Specialization → Bool
+  | some ⟨.pure .erased, actualKind⟩ => actualKind == kind
+  | none => false
+  | _ => false
+
+private def isFreeVar (index : Nat) (kind : Kind) :
+    Option Specialization → Bool
+  | some ⟨.free (.var actualIndex), actualKind⟩ =>
+      actualIndex == index && actualKind == kind
+  | none => false
+  | _ => false
+
+private def decisionBoundary : Bool :=
+  isPureErased .sharedScalar
+      (specialize? [Fact.scalar] (.drop (.var 0))) &&
+    isPureErased .uniqueScalar
+      (specialize? [Fact.scalar] (.dropU (.var 0))) &&
+    isFreeVar 0 .uniqueLeaf
+      (specialize? [guardLeafFact] (.dropU (.var 0))) &&
+    (specialize? [guardLeafFact] (.drop (.var 0))).isNone &&
+    (specialize? [guardHeapFieldFact] (.dropU (.var 0))).isNone &&
+    (specialize? [guardIdentityOnlyFact] (.dropU (.var 0))).isNone &&
+    (specialize? [guardMultiShapeFact] (.dropU (.var 0))).isNone &&
+    (specialize? [Fact.top] (.dropU (.var 0))).isNone &&
+    (specialize? [] (.dropU (.var 0))).isNone &&
+    (specialize? [guardLeafFact] (.free (.var 0))).isNone
+
+#guard decisionBoundary
+
+/-! ## Why recursive expansion is not an IxIR₁ `Code` rewrite
+
+The evaluator exposes `Code` nesting through fuel.  Expanding one `dropU`
+inline consumes extra continuation fuel; putting the same expansion behind a
+call preserves continuation fuel but adds call/invoke fuel at the destructor's
+minimum successful boundary.  The two executable witnesses below pin both
+failures on the smallest recursive unique tree (a unary root over a nullary
+child).  This is an IR constraint, independent of HPT precision or
+owner-sensitive declaration rewriting.
+-/
+
+private def fuelChildIdentity : CtorId :=
+  { block := Ixon.Address.replicate 0xd3, indIdx := 0, cidx := 0 }
+
+private def fuelRootIdentity : CtorId :=
+  { block := Ixon.Address.replicate 0xd4, indIdx := 0, cidx := 0 }
+
+private def fuelHelperAddress : Ixon.Address :=
+  Ixon.Address.replicate 0xd5
+
+/-- Fetch the unary child, shallow-free the root, then shallow-free the
+nullary child.  Semantically this is the obvious exact recursive destructor. -/
+private def fuelHelperBody : Code :=
+  .letOp (.fetch (.var 0) 0)
+    (.letOp (.free (.var 1))
+      (.letOp (.free (.var 1))
+        (.ret .erased)))
+
+private def fuelHelper : FnDef :=
+  { arity := 1, result := .shared, papSafe := false, body := fuelHelperBody }
+
+private def fuelCtx : Ctx :=
+  { decls := Env.ofList [(fuelHelperAddress, .fn fuelHelper)] }
+
+private def fuelInput : Store × RVal :=
+  let (withChild, child) := ({} : Store).allocNode .unique
+    (.ctorN fuelChildIdentity #[])
+  let (withRoot, root) := withChild.allocNode .unique
+    (.ctorN fuelRootIdentity #[.loc child])
+  (withRoot, .loc root)
+
+private def pureContinuation : Nat → Code
+  | 0 => .ret .erased
+  | fuel + 1 => .letOp (.pure .erased) (pureContinuation fuel)
+
+private def genericRecursiveDrop (rest : Code) : Code :=
+  .letOp (.dropU (.var 0)) rest
+
+private def inlineRecursiveDrop (rest : Code) : Code :=
+  .letOp (.fetch (.var 0) 0)
+    (.letOp (.free (.var 1))
+      (.letOp (.free (.var 1)) rest))
+
+private def helperRecursiveDrop (rest : Code) : Code :=
+  .letOp (.call fuelHelperAddress #[.var 0]) rest
+
+private def fuelCurrent : FnDef :=
+  { arity := 1, result := .shared, papSafe := false, body := .ret .erased }
+
+private def recursiveExpansionFuelBoundary : Bool :=
+  let (store, root) := fuelInput
+  let short := .ret .erased
+  let long := pureContinuation 5
+  match
+      runCode fuelCtx 6 fuelCurrent store [root]
+        (genericRecursiveDrop short),
+      runCode fuelCtx 6 fuelCurrent store [root]
+        (helperRecursiveDrop short),
+      runCode fuelCtx 7 fuelCurrent store [root]
+        (genericRecursiveDrop long),
+      runCode fuelCtx 7 fuelCurrent store [root]
+        (inlineRecursiveDrop long) with
+  | .ok (shortStore, .erased), .error .fuel,
+      .ok (longStore, .erased), .error .fuel =>
+      shortStore.live == 0 && longStore.live == 0
+  | _, _, _, _ => false
+
+#guard recursiveExpansionFuelBoundary
+
+/-- Proof-facing view of an accepted executable decision. -/
+inductive Spec (facts : List Fact) : Op → Specialization → Prop where
+  | sharedScalar {target fact}
+      (hfact : resolveAtomFact facts target = .ok fact)
+      (hscalar : FetchForward.scalarOnly fact = true) :
+      Spec facts (.drop target) ⟨.pure .erased, .sharedScalar⟩
+  | uniqueScalar {target fact}
+      (hfact : resolveAtomFact facts target = .ok fact)
+      (hscalar : FetchForward.scalarOnly fact = true) :
+      Spec facts (.dropU target) ⟨.pure .erased, .uniqueScalar⟩
+  | uniqueLeaf {target fact leaf}
+      (hfact : resolveAtomFact facts target = .ok fact)
+      (hleaf : exactLeaf? fact = some leaf) :
+      Spec facts (.dropU target) ⟨.free target, .uniqueLeaf⟩
+
+theorem spec_of_specialize?_eq_some
+    {facts : List Fact} {operation : Op} {specialization : Specialization}
+    (hspecialize : specialize? facts operation = some specialization) :
+    Spec facts operation specialization := by
+  cases operation with
+  | pure atom => simp [specialize?] at hspecialize
+  | alloc world identity fields => simp [specialize?] at hspecialize
+  | reuse location identity fields => simp [specialize?] at hspecialize
+  | free target => simp [specialize?] at hspecialize
+  | dup target => simp [specialize?] at hspecialize
+  | drop target =>
+      simp only [specialize?] at hspecialize
+      cases hfact : resolveAtomFact facts target with
+      | error error => simp [hfact] at hspecialize
+      | ok fact =>
+          rw [hfact] at hspecialize
+          by_cases hscalar : FetchForward.scalarOnly fact = true
+          · simp only [hscalar, if_true, Option.some.injEq] at hspecialize
+            rw [← hspecialize]
+            exact .sharedScalar hfact hscalar
+          · simp [hscalar] at hspecialize
+  | dropU target =>
+      simp only [specialize?] at hspecialize
+      cases hfact : resolveAtomFact facts target with
+      | error error => simp [hfact] at hspecialize
+      | ok fact =>
+          rw [hfact] at hspecialize
+          by_cases hscalar : FetchForward.scalarOnly fact = true
+          · simp only [hscalar, if_true, Option.some.injEq] at hspecialize
+            rw [← hspecialize]
+            exact .uniqueScalar hfact hscalar
+          · simp only [hscalar] at hspecialize
+            by_cases hleafSome : (exactLeaf? fact).isSome = true
+            · simp only [hleafSome, if_true] at hspecialize
+              cases hleaf : exactLeaf? fact with
+              | none => simp [hleaf] at hleafSome
+              | some leaf =>
+                  simp at hspecialize
+                  rw [← hspecialize]
+                  exact .uniqueLeaf hfact hleaf
+            · simp [hleafSome] at hspecialize
+  | fetch target field => simp [specialize?] at hspecialize
+  | call function arguments => simp [specialize?] at hspecialize
+  | callSelf arguments => simp [specialize?] at hspecialize
+  | papp function arguments => simp [specialize?] at hspecialize
+  | apply function arguments => simp [specialize?] at hspecialize
+  | extern name arguments => simp [specialize?] at hspecialize
+
+structure Changes where
+  elidedScalarDrops : Nat := 0
+  specializedUniqueDrops : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+def Changes.add (left right : Changes) : Changes :=
+  { elidedScalarDrops :=
+      left.elidedScalarDrops + right.elidedScalarDrops
+    specializedUniqueDrops :=
+      left.specializedUniqueDrops + right.specializedUniqueDrops }
+
+def Changes.ofKind : Kind → Changes
+  | .sharedScalar | .uniqueScalar => { elidedScalarDrops := 1 }
+  | .uniqueLeaf => { specializedUniqueDrops := 1 }
+
+structure Outcome where
+  code : Code
+  changes : Changes := {}
+
+structure AlternativeOutcome where
+  alternative : Alt
+  changes : Changes := {}
+
+mutual
+
+/-- Mirror HPT transfer through the whole owner-sensitive code tree, replacing
+only one-binder destructor operations. -/
+def runWithFacts (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ixon.Address) (current : FnDef) (facts : List Fact) :
+    Code → Outcome
+  | input@(.ret _) => ⟨input, {}⟩
+  | input@(.letOp operation rest) =>
+      match analyzeOp declarations summaries owner current facts operation with
+      | .error _ => ⟨input, {}⟩
+      | .ok bound =>
+          let nested := runWithFacts declarations summaries owner current
+            (bound :: facts.map Fact.forgetHeap) rest
+          match specialize? facts operation with
+          | none => ⟨.letOp operation nested.code, nested.changes⟩
+          | some specialization =>
+              ⟨.letOp specialization.operation nested.code,
+                nested.changes.add (.ofKind specialization.kind)⟩
+  | input@(.case scrutinee peelNat alternatives) =>
+      match resolveAtomFact facts scrutinee with
+      | .error _ => ⟨input, {}⟩
+      | .ok fact =>
+          let nested := alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              fact peelNat facts)
+          ⟨.case scrutinee peelNat
+              (nested.map fun result => result.alternative),
+            nested.foldl
+              (fun total result => total.add result.changes) {}⟩
+
+def runAlternativeWithFacts (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact) :
+    Alt → AlternativeOutcome
+  | .mk cidx fields body =>
+      let nested := runWithFacts declarations summaries owner current
+        (scrutineeFact.caseFields peelNat cidx fields ++ facts) body
+      ⟨.mk cidx fields nested.code, nested.changes⟩
+
+end
+
+def runFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ixon.Address) (current : FnDef) : Outcome :=
+  runWithFacts declarations summaries owner current
+    (List.replicate current.arity Fact.top) current.body
+
+def rewriteFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ixon.Address) (current : FnDef) : FnDef :=
+  { current with body := (runFunction declarations summaries owner current).code }
+
+/-! ## Semantic support for accepted decisions -/
+
+theorem isScalar_of_fieldScalarOnly_holds
+    {declarations : DeclEnv} {store : Store} {fact : FieldFact}
+    {value : RVal}
+    (honly : fieldScalarOnly fact = true)
+    (hholds : fact.Holds declarations store value) :
+    value.isScalar = true := by
+  unfold fieldScalarOnly at honly
+  simp only [Bool.and_eq_true] at honly
+  cases hholds with
+  | lit hscalar => rfl
+  | erased hscalar => rfl
+  | unknown hunknown =>
+      have hfalse : fact.unknownHeap = false := by simpa using honly.1
+      rw [hfalse] at hunknown
+      contradiction
+  | heap hmember hshape =>
+      have hempty : fact.shapes = [] := List.isEmpty_iff.mp honly.2
+      rw [hempty] at hmember
+      contradiction
+
+theorem FieldFactsHold.all_isScalar
+    {declarations : DeclEnv} {store : Store} {facts : List FieldFact}
+    {values : List RVal}
+    (honly : facts.all fieldScalarOnly = true)
+    (hholds : FieldFactsHold declarations store facts values) :
+    values.all RVal.isScalar = true := by
+  cases hholds with
+  | nil => rfl
+  | @cons fact value facts values hhead htail =>
+      simp only [List.all_cons, Bool.and_eq_true] at honly ⊢
+      exact ⟨isScalar_of_fieldScalarOnly_holds honly.1 hhead,
+        FieldFactsHold.all_isScalar honly.2 htail⟩
+termination_by sizeOf facts
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+/-- An accepted exact-leaf decision determines the concrete constructor and
+proves that every stored field is a scalar. -/
+theorem exactLeaf?_holds
+    {declarations : DeclEnv} {store : Store} {fact : Fact}
+    {value : RVal} {leaf : LeafShape}
+    (hleaf : exactLeaf? fact = some leaf)
+    (hholds : fact.Holds declarations store value) :
+    ∃ location box fields,
+      value = .loc location ∧
+      store.get? location = some box ∧
+      box.node = .ctorN leaf.identity fields ∧
+      fields.toList.all RVal.isScalar = true := by
+  cases fact with
+  | mk mayScalar unknownHeap shapes =>
+      unfold exactLeaf? at hleaf
+      cases hmay : mayScalar with
+      | true => simp [hmay] at hleaf
+      | false =>
+          cases hunknown : unknownHeap with
+          | true => simp [hmay, hunknown] at hleaf
+          | false =>
+              simp only [hmay, hunknown, Bool.false_or] at hleaf
+              cases shapes with
+              | nil => simp at hleaf
+              | cons shape tail =>
+                  cases tail with
+                  | cons next tail => simp at hleaf
+                  | nil =>
+                      cases shape with
+                      | pap function supplied => simp at hleaf
+                      | ctor identity fieldFacts =>
+                          cases fieldFacts with
+                          | none => simp at hleaf
+                          | some facts =>
+                              by_cases honly :
+                                  facts.all fieldScalarOnly = true
+                              · simp only [honly, if_true] at hleaf
+                                simp at hleaf
+                                rw [← hleaf]
+                                cases value with
+                                | lit literal =>
+                                    change mayScalar = true at hholds
+                                    rw [hmay] at hholds
+                                    contradiction
+                                | erased =>
+                                    change mayScalar = true at hholds
+                                    rw [hmay] at hholds
+                                    contradiction
+                                | loc location =>
+                                    simp only [Fact.Holds, hunknown,
+                                      Bool.false_eq_true, false_or] at hholds
+                                    rcases hholds with
+                                      ⟨heldShape, hmember, hshape⟩
+                                    have hshapeEq : heldShape =
+                                        .ctor identity (some facts) := by
+                                      simpa using hmember
+                                    subst heldShape
+                                    rcases hshape with
+                                      ⟨box, fields, hget, hnode, hfields⟩
+                                    exact ⟨location, box, fields, rfl, hget,
+                                      hnode,
+                                      FieldFactsHold.all_isScalar honly
+                                        hfields⟩
+                              · simp [honly] at hleaf
+
+private theorem dropUVal_eq_store_of_isScalar_success
+    {ctx : Ctx} {fuel : Nat} {store result : Store} {value : RVal}
+    (hscalar : value.isScalar = true)
+    (hrun : dropUVal ctx fuel store value = .ok result) :
+    result = store := by
+  cases fuel with
+  | zero => simp [dropUVal] at hrun
+  | succ fuel =>
+      cases value with
+      | lit literal =>
+          simp only [dropUVal] at hrun
+          exact (Except.ok.inj hrun).symm
+      | erased =>
+          simp only [dropUVal] at hrun
+          exact (Except.ok.inj hrun).symm
+      | loc location => simp [RVal.isScalar] at hscalar
+
+private theorem dropManyU_eq_store_of_all_isScalar_success
+    {ctx : Ctx} {fuel : Nat} {store result : Store} {values : List RVal}
+    (hscalar : values.all RVal.isScalar = true)
+    (hrun : dropManyU ctx fuel store values = .ok result) :
+    result = store := by
+  induction fuel generalizing store result values with
+  | zero => simp [dropManyU] at hrun
+  | succ fuel ih =>
+      cases values with
+      | nil =>
+          simp only [dropManyU] at hrun
+          exact (Except.ok.inj hrun).symm
+      | cons value values =>
+          simp only [List.all_cons, Bool.and_eq_true] at hscalar
+          rw [dropManyU.eq_def] at hrun
+          dsimp only at hrun
+          cases hfirst : dropUVal ctx fuel store value with
+          | error error => simp [hfirst, bind, Except.bind] at hrun
+          | ok middle =>
+              simp only [hfirst, bind, Except.bind] at hrun
+              have hmiddle :=
+                dropUVal_eq_store_of_isScalar_success hscalar.1 hfirst
+              subst middle
+              exact ih hscalar.2 hrun
+
+private theorem dropUVal_eq_kill_of_ctor_all_isScalar_success
+    {ctx : Ctx} {fuel : Nat} {store result : Store} {value : RVal}
+    {location : Nat} {box : NodeBox} {identity : CtorId}
+    {fields : Array RVal}
+    (hvalue : value = .loc location)
+    (hget : store.get? location = some box)
+    (hnode : box.node = .ctorN identity fields)
+    (hscalar : fields.toList.all RVal.isScalar = true)
+    (hrun : dropUVal ctx fuel store value = .ok result) :
+    box.world = .unique ∧ result = store.kill location := by
+  subst value
+  cases fuel with
+  | zero => simp [dropUVal] at hrun
+  | succ fuel =>
+      rw [dropUVal.eq_def] at hrun
+      dsimp only at hrun
+      rw [hget] at hrun
+      cases hworld : box.world with
+      | shared => simp [hworld] at hrun
+      | unique =>
+          refine ⟨rfl, ?_⟩
+          simp only at hrun
+          rw [hworld, hnode] at hrun
+          exact dropManyU_eq_store_of_all_isScalar_success hscalar hrun
+
+/-- Every accepted local specialization preserves a successful operation
+result exactly.  The implication is intentionally one-way: a shallow free
+can need less fuel than the generic deep-drop interpreter. -/
+theorem runOp_specialize?_success
+    {declarations : DeclEnv} {facts : List Fact} {operation : Op}
+    {specialization : Specialization} {ctx : Ctx} {fuel : Nat}
+    {current : FnDef} {store : Store} {environment : List RVal}
+    {output : Store × RVal}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hspecialize : specialize? facts operation = some specialization)
+    (hrun : runOp ctx fuel current store environment operation = .ok output) :
+    runOp ctx fuel current store environment specialization.operation =
+      .ok output := by
+  have hspec := spec_of_specialize?_eq_some hspecialize
+  cases hspec with
+  | @sharedScalar target fact hfact hscalar =>
+      cases fuel with
+      | zero => simp [runOp] at hrun
+      | succ fuel =>
+          rw [runOp.eq_def] at hrun ⊢
+          dsimp only at hrun ⊢
+          cases hresolve : resolveAtom environment target with
+          | error error => simp [hresolve, bind, Except.bind] at hrun
+          | ok value =>
+              have hholds := resolveAtom_sound henvironment hfact hresolve
+              have hvalue :=
+                FetchForward.scalar_of_scalarOnly_holds hscalar hholds
+              rw [hresolve] at hrun
+              simp only [bind, Except.bind] at hrun
+              cases value with
+              | lit literal =>
+                  dsimp only at hrun
+                  change Except.ok (store, .erased) = .ok output
+                  exact hrun
+              | erased =>
+                  dsimp only at hrun
+                  change Except.ok (store, .erased) = .ok output
+                  exact hrun
+              | loc location => simp [RVal.isScalar] at hvalue
+  | @uniqueScalar target fact hfact hscalar =>
+      cases fuel with
+      | zero => simp [runOp] at hrun
+      | succ fuel =>
+          rw [runOp.eq_def] at hrun ⊢
+          dsimp only at hrun ⊢
+          cases hresolve : resolveAtom environment target with
+          | error error => simp [hresolve, bind, Except.bind] at hrun
+          | ok value =>
+              have hholds := resolveAtom_sound henvironment hfact hresolve
+              have hvalue :=
+                FetchForward.scalar_of_scalarOnly_holds hscalar hholds
+              rw [hresolve] at hrun
+              simp only [bind, Except.bind] at hrun
+              cases value with
+              | lit literal =>
+                  dsimp only at hrun
+                  change Except.ok (store, .erased) = .ok output
+                  exact hrun
+              | erased =>
+                  dsimp only at hrun
+                  change Except.ok (store, .erased) = .ok output
+                  exact hrun
+              | loc location => simp [RVal.isScalar] at hvalue
+  | @uniqueLeaf target fact leaf hfact hleaf =>
+      cases fuel with
+      | zero => simp [runOp] at hrun
+      | succ fuel =>
+          rw [runOp.eq_def] at hrun ⊢
+          dsimp only at hrun ⊢
+          cases hresolve : resolveAtom environment target with
+          | error error => simp [hresolve, bind, Except.bind] at hrun
+          | ok value =>
+              have hholds := resolveAtom_sound henvironment hfact hresolve
+              obtain ⟨location, box, fields, hvalue, hget, hnode, hscalar⟩ :=
+                exactLeaf?_holds hleaf hholds
+              subst value
+              simp only [hresolve] at hrun ⊢
+              simp only [bind, Except.bind] at hrun ⊢
+              cases hdrop : dropUVal ctx fuel store (.loc location) with
+              | error error => simp [hdrop] at hrun
+              | ok dropped =>
+                  rw [hdrop] at hrun
+                  obtain ⟨hworld, hkilled⟩ :=
+                    dropUVal_eq_kill_of_ctor_all_isScalar_success rfl hget
+                      hnode hscalar hdrop
+                  subst dropped
+                  rw [hget]
+                  simp only
+                  rw [hworld]
+                  simpa using hrun
+
+/-! ## Successful recursive traversal -/
+
+@[simp] private theorem runAlternativeWithFacts_cidx
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternative : Alt) :
+    (runAlternativeWithFacts declarations summaries owner current
+      scrutineeFact peelNat facts alternative).alternative.cidx =
+        alternative.cidx := by
+  cases alternative
+  simp [runAlternativeWithFacts, Alt.cidx]
+
+private theorem runAlternativeWithFacts_predicate
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (index : Nat) :
+    ((fun alternative : Alt => alternative.cidx == index) ∘
+        (fun result : AlternativeOutcome => result.alternative) ∘
+        runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts) =
+      (fun alternative => alternative.cidx == index) := by
+  funext alternative
+  cases alternative
+  simp [Function.comp_def, runAlternativeWithFacts, Alt.cidx]
+
+private theorem find?_runAlternativeWithFacts
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Ixon.Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternatives : Array Alt) (index : Nat) :
+    ((alternatives.map
+        (runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts)).map
+        (fun result => result.alternative)).find?
+          (fun alternative => alternative.cidx == index) =
+      (alternatives.find? (fun alternative => alternative.cidx == index)).map
+        (fun alternative =>
+          (runAlternativeWithFacts declarations summaries owner current
+            scrutineeFact peelNat facts alternative).alternative) := by
+  rw [Array.map_map, Array.find?_map,
+    runAlternativeWithFacts_predicate declarations summaries owner current
+      scrutineeFact peelNat facts index]
+  simp [Function.comp_def]
+
+private theorem Array.foldl_cons_eq_reverse_append
+    (fields : Array RVal) (environment : List RVal) :
+    fields.foldl (fun current field => field :: current) environment =
+      fields.toList.reverse ++ environment := by
+  rw [← Array.foldl_toList]
+  induction fields.toList generalizing environment with
+  | nil => rfl
+  | cons field fields ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+/-- Case traversal preserves a successful selected branch once its HPT
+binders have been justified against the concrete scrutinee. -/
+private theorem runCode_caseWithFactsBodies_success
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    {owner : Ixon.Address} {current : FnDef}
+    {ctx : Ctx} {store : Store} {facts : List Fact}
+    {environment : List RVal} {scrutinee : Atom} {peelNat : Bool}
+    {alternatives : Array Alt} {scrutineeFact : Fact} {fuel : Nat}
+    {output : Store × RVal}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (habstract : resolveAtomFact facts scrutinee = .ok scrutineeFact)
+    (ih : ∀ {store : Store} {facts : List Fact}
+      {environment : List RVal} {input : Code} {output : Store × RVal},
+      EnvironmentHolds declarations store facts environment →
+      runCode ctx fuel current store environment input = .ok output →
+      runCode ctx fuel current store environment
+          (runWithFacts declarations summaries owner current facts input).code =
+        .ok output)
+    (hrun : runCode ctx (fuel + 1) current store environment
+      (.case scrutinee peelNat alternatives) = .ok output) :
+    runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat
+          ((alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              scrutineeFact peelNat facts)).map
+                (fun result => result.alternative))) =
+      .ok output := by
+  obtain ⟨scrutineeValue, hresolve⟩ :=
+    resolveAtom_complete henvironment habstract
+  have hscrutineeHolds :=
+    resolveAtom_sound henvironment habstract hresolve
+  simp only [runCode] at hrun ⊢
+  rw [hresolve] at hrun ⊢
+  simp only [bind, Except.bind] at hrun ⊢
+  cases scrutineeValue with
+  | erased => contradiction
+  | lit literal =>
+      cases literal with
+      | str value => contradiction
+      | nat value =>
+          simp only at hrun ⊢
+          cases peelNat with
+          | false => contradiction
+          | true =>
+              simp only at hrun ⊢
+              cases value with
+              | zero =>
+                  simp only at hrun ⊢
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 0) with
+                  | none => simp [hfind] at hrun
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero =>
+                              have hzero :
+                                  scrutineeFact.caseFields true cidx 0 = [] := by
+                                unfold Fact.caseFields
+                                split <;> rfl
+                              have hbody :
+                                  runCode ctx fuel current store environment
+                                    body = .ok output := by
+                                simpa [hfind] using hrun
+                              simpa [runAlternativeWithFacts, hzero]
+                                using (ih henvironment hbody)
+                          | succ fields => simp [hfind] at hrun
+              | succ value =>
+                  simp only at hrun ⊢
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 1) with
+                  | none => simp [hfind] at hrun
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero => simp [hfind] at hrun
+                          | succ fields =>
+                              cases fields with
+                              | zero =>
+                                  have hcidx : cidx = 1 := by
+                                    have hmatch := Array.find?_some
+                                      (p := fun alternative : Alt =>
+                                        alternative.cidx == 1)
+                                      (a := .mk cidx 1 body)
+                                      (xs := alternatives) hfind
+                                    exact beq_iff_eq.mp hmatch
+                                  have hbinders :
+                                      EnvironmentHolds declarations store
+                                        (scrutineeFact.caseFields true cidx 1)
+                                        [.lit (.nat value)] := by
+                                    simpa [hcidx] using
+                                      (Fact.caseFields_natSucc_holds
+                                        hscrutineeHolds)
+                                  have hbody :
+                                      runCode ctx fuel current store
+                                        (.lit (.nat value) :: environment)
+                                        body = .ok output := by
+                                    simpa [hfind] using hrun
+                                  simpa [runAlternativeWithFacts] using
+                                    (ih (hbinders.append henvironment) hbody)
+                              | succ fields => simp [hfind] at hrun
+  | loc location =>
+      simp only at hrun ⊢
+      cases hget : store.get? location with
+      | none => simp [hget] at hrun
+      | some box =>
+          simp only at hrun ⊢
+          cases hnode : box.node with
+          | papN function arity arguments => simp [hget, hnode] at hrun
+          | ctorN identity fields =>
+              simp only at hrun ⊢
+              rw [find?_runAlternativeWithFacts]
+              cases hfind : alternatives.find?
+                  (fun alternative => alternative.cidx == identity.cidx) with
+              | none => simp [hget, hnode, hfind] at hrun
+              | some alternative =>
+                  cases alternative with
+                  | mk cidx fieldCount body =>
+                      by_cases hfields : fields.size = fieldCount
+                      · have hcidx : identity.cidx = cidx := by
+                          have hmatch := Array.find?_some
+                            (p := fun alternative : Alt =>
+                              alternative.cidx == identity.cidx)
+                            (a := .mk cidx fieldCount body)
+                            (xs := alternatives) hfind
+                          exact (beq_iff_eq.mp hmatch).symm
+                        have hbinders := Fact.caseFields_ctor_holds
+                          peelNat cidx fieldCount hscrutineeHolds hget hnode
+                          hcidx hfields
+                        have hbody :
+                            runCode ctx fuel current store
+                              (fields.foldl
+                                (fun current field => field :: current)
+                                environment) body = .ok output := by
+                          simpa [hget, hnode, hfind, hfields] using hrun
+                        rw [Array.foldl_cons_eq_reverse_append]
+                        simpa [hfields, runAlternativeWithFacts] using
+                            (ih (hbinders.append henvironment) (by
+                              rw [← Array.foldl_cons_eq_reverse_append]
+                              exact hbody))
+                      · simp [hget, hnode, hfind, hfields] at hrun
+
+/-- Successful evaluator refinement for the complete owner-sensitive
+destruction traversal. -/
+theorem runCode_runWithFacts_success_ownerCompatible
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Ixon.Address} {current : FnDef}
+    {store : Store} {facts : List Fact} {environment : List RVal}
+    {input : Code} {fuel : Nat} {output : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hrun : runCode ctx fuel current store environment input = .ok output) :
+    runCode ctx fuel current store environment
+        (runWithFacts declarations summaries owner current facts input).code =
+      .ok output := by
+  induction fuel generalizing store facts environment input output with
+  | zero => simp [runCode] at hrun
+  | succ fuel ih =>
+      cases input with
+      | ret atom => simpa [runWithFacts] using hrun
+      | letOp operation rest =>
+          cases habstract : analyzeOp declarations summaries owner current
+              facts operation with
+          | error error =>
+              simpa [runWithFacts, habstract] using hrun
+          | ok bound =>
+              let nested := runWithFacts declarations summaries owner current
+                (bound :: facts.map Fact.forgetHeap) rest
+              simp only [runCode] at hrun
+              cases hoperation : runOp ctx fuel current store environment
+                  operation with
+              | error error => simp [hoperation, bind, Except.bind] at hrun
+              | ok operationOutput =>
+                  rcases operationOutput with ⟨outputStore, outputValue⟩
+                  rw [hoperation] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  have hbound := analyzeOp_sound_ownerCompatible hpost hctx
+                    howner henvironment habstract hoperation
+                  have hold := EnvironmentHolds.forgetHeap
+                    (after := outputStore) henvironment
+                  have hnested :
+                      runCode ctx fuel current outputStore
+                          (outputValue :: environment) nested.code =
+                        .ok output := by
+                    simpa [nested] using
+                      (ih (store := outputStore)
+                        (facts := bound :: facts.map Fact.forgetHeap)
+                        (environment := outputValue :: environment)
+                        (input := rest) (.cons hbound hold) hrun)
+                  cases hspecialize : specialize? facts operation with
+                  | none =>
+                      simp only [runWithFacts, habstract, hspecialize, runCode]
+                      rw [hoperation]
+                      simp only [bind, Except.bind]
+                      exact hnested
+                  | some specialization =>
+                      have hspecialized := runOp_specialize?_success
+                        henvironment hspecialize hoperation
+                      simp only [runWithFacts, habstract, hspecialize, runCode]
+                      rw [hspecialized]
+                      simp only [bind, Except.bind]
+                      exact hnested
+      | case scrutinee peelNat alternatives =>
+          cases habstract : resolveAtomFact facts scrutinee with
+          | error error => simpa [runWithFacts, habstract] using hrun
+          | ok scrutineeFact =>
+              simpa [runWithFacts, habstract] using
+                (runCode_caseWithFactsBodies_success henvironment habstract
+                  (fun henv hsuccess => ih henv hsuccess) hrun)
+
+/-- Stored-function specialization of successful destruction refinement. -/
+theorem runCode_runWithFacts_success
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Ixon.Address} {current : FnDef}
+    {store : Store} {facts : List Fact} {environment : List RVal}
+    {input : Code} {fuel : Nat} {output : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hrun : runCode ctx fuel current store environment input = .ok output) :
+    runCode ctx fuel current store environment
+        (runWithFacts declarations summaries owner current facts input).code =
+      .ok output :=
+  runCode_runWithFacts_success_ownerCompatible hpost hctx (.inl hcurrent)
+    henvironment hrun
+
+end Ix.Compiler.IxIR1.HPT.Destroy
diff --git a/Ix/Compiler/IxIR1/HPTFetchForward.lean b/Ix/Compiler/IxIR1/HPTFetchForward.lean
new file mode 100644
index 000000000..be9333e88
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTFetchForward.lean
@@ -0,0 +1,816 @@
+import Ix.Compiler.IxIR1.HPTPAPFuse
+
+/-!
+# Checked scalar fetch forwarding
+
+This consumer recognizes an immediately projected constructor field:
+
+```text
+let node := alloc/reuse constructor fields
+let field := fetch node i
+rest
+```
+
+When the selected source atom is HPT-proven scalar, the projection is replaced
+by `pure` of that atom lifted across the node binder.  Both binders and the
+constructor operation remain in place, so the rewrite preserves evaluator
+fuel, stores, allocation identities, and every continuation index exactly.
+
+The scalar restriction is the ownership boundary.  Reusing a heap-valued
+source atom after it was installed in a node could duplicate or revive an
+owner in the validated syntax; scalars carry no heap ownership.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.FetchForward
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1.Sim
+
+/-- Lift an atom across the constructor result binder retained by the rewrite. -/
+def liftAtom : Atom → Atom
+  | .var index => .var (index + 1)
+  | .lit literal => .lit literal
+  | .erased => .erased
+
+theorem resolveAtom_liftAtom_of_eq_ok {head : RVal}
+    {environment : List RVal} {atom : Atom} {value : RVal}
+    (hresolve : resolveAtom environment atom = .ok value) :
+    resolveAtom (head :: environment) (liftAtom atom) = .ok value := by
+  cases atom with
+  | lit literal => simpa [liftAtom, resolveAtom] using hresolve
+  | erased => simpa [liftAtom, resolveAtom] using hresolve
+  | var index =>
+      simp only [resolveAtom] at hresolve ⊢
+      cases hget : environment[index]? with
+      | none => simp [hget] at hresolve
+      | some found => simpa [liftAtom, hget] using hresolve
+
+/-- A fact which admits no heap value.  Bottom is accepted because its
+concrete interpretation cannot authorize a successful non-scalar execution. -/
+def scalarOnly (fact : Fact) : Bool :=
+  !fact.unknownHeap && fact.shapes.isEmpty
+
+private def selectedScalarAtom? (facts : List Fact) (arguments : Array Atom)
+    (field : Nat) : Option Atom :=
+  match arguments[field]? with
+  | none => none
+  | some atom =>
+      match resolveAtomFact facts atom with
+      | .error _ => none
+      | .ok fact => if scalarOnly fact then some atom else none
+
+inductive Kind where
+  | allocation
+  | reuse
+  deriving BEq, Repr
+
+/-- One accepted forwarding decision and its source-side operand. -/
+structure Forwarding where
+  code : Code
+  source : Atom
+  kind : Kind
+
+/-- Try to replace the head fetch of an already recursively rewritten
+continuation.  Only the constructor-producing operation immediately outside
+that continuation is considered. -/
+def forwardHead? (facts : List Fact) (operation : Op)
+    (continuation : Code) : Option Forwarding :=
+  match continuation with
+  | .letOp (.fetch (.var 0) field) rest =>
+      match operation with
+      | .alloc world identity arguments => do
+          let atom ← selectedScalarAtom? facts arguments field
+          return ⟨.letOp (.alloc world identity arguments)
+              (.letOp (.pure (liftAtom atom)) rest), atom, .allocation⟩
+      | .reuse target identity arguments => do
+          let atom ← selectedScalarAtom? facts arguments field
+          return ⟨.letOp (.reuse target identity arguments)
+              (.letOp (.pure (liftAtom atom)) rest), atom, .reuse⟩
+      | _ => none
+  | _ => none
+
+/-- Proof-facing view of an accepted executable decision. -/
+inductive ForwardSpec (facts : List Fact) : Op → Code → Forwarding → Prop where
+  | allocation {world identity arguments field rest atom fact}
+      (hfield : arguments[field]? = some atom)
+      (hfact : resolveAtomFact facts atom = .ok fact)
+      (hscalar : scalarOnly fact = true) :
+      ForwardSpec facts (.alloc world identity arguments)
+        (.letOp (.fetch (.var 0) field) rest)
+        ⟨.letOp (.alloc world identity arguments)
+            (.letOp (.pure (liftAtom atom)) rest), atom, .allocation⟩
+  | reuse {target identity arguments field rest atom fact}
+      (hfield : arguments[field]? = some atom)
+      (hfact : resolveAtomFact facts atom = .ok fact)
+      (hscalar : scalarOnly fact = true) :
+      ForwardSpec facts (.reuse target identity arguments)
+        (.letOp (.fetch (.var 0) field) rest)
+        ⟨.letOp (.reuse target identity arguments)
+            (.letOp (.pure (liftAtom atom)) rest), atom, .reuse⟩
+
+theorem forwardSpec_of_forwardHead?_eq_some
+    {facts : List Fact} {operation : Op} {continuation : Code}
+    {forwarding : Forwarding}
+    (hforward : forwardHead? facts operation continuation = some forwarding) :
+    ForwardSpec facts operation continuation forwarding := by
+  cases continuation with
+  | ret atom => simp [forwardHead?] at hforward
+  | case scrutinee peelNat alternatives => simp [forwardHead?] at hforward
+  | letOp next rest =>
+      cases next with
+      | fetch target field =>
+          cases target with
+          | var index =>
+              cases index with
+              | zero =>
+                  cases operation with
+                  | alloc world identity arguments =>
+                    simp only [forwardHead?, selectedScalarAtom?] at hforward
+                    split at hforward
+                    · simp at hforward
+                    · rename_i atom hfield
+                      split at hforward
+                      · simp at hforward
+                      · rename_i fact hfact
+                        split at hforward
+                        · rename_i hscalar
+                          injection hforward with hforwarding
+                          subst forwarding
+                          exact .allocation hfield hfact hscalar
+                        · simp at hforward
+                  | reuse target identity arguments =>
+                    simp only [forwardHead?, selectedScalarAtom?] at hforward
+                    split at hforward
+                    · simp at hforward
+                    · rename_i atom hfield
+                      split at hforward
+                      · simp at hforward
+                      · rename_i fact hfact
+                        split at hforward
+                        · rename_i hscalar
+                          injection hforward with hforwarding
+                          subst forwarding
+                          exact .reuse hfield hfact hscalar
+                        · simp at hforward
+                  | pure atom => simp [forwardHead?] at hforward
+                  | free target => simp [forwardHead?] at hforward
+                  | dup target => simp [forwardHead?] at hforward
+                  | drop target => simp [forwardHead?] at hforward
+                  | dropU target => simp [forwardHead?] at hforward
+                  | fetch target field => simp [forwardHead?] at hforward
+                  | call function arguments => simp [forwardHead?] at hforward
+                  | callSelf arguments => simp [forwardHead?] at hforward
+                  | papp function arguments => simp [forwardHead?] at hforward
+                  | apply function arguments => simp [forwardHead?] at hforward
+                  | extern function arguments => simp [forwardHead?] at hforward
+              | succ index => simp [forwardHead?] at hforward
+          | lit literal => simp [forwardHead?] at hforward
+          | erased => simp [forwardHead?] at hforward
+      | pure atom => simp [forwardHead?] at hforward
+      | alloc world identity arguments => simp [forwardHead?] at hforward
+      | reuse target identity arguments => simp [forwardHead?] at hforward
+      | free target => simp [forwardHead?] at hforward
+      | dup target => simp [forwardHead?] at hforward
+      | drop target => simp [forwardHead?] at hforward
+      | dropU target => simp [forwardHead?] at hforward
+      | call function arguments => simp [forwardHead?] at hforward
+      | callSelf arguments => simp [forwardHead?] at hforward
+      | papp function arguments => simp [forwardHead?] at hforward
+      | apply function arguments => simp [forwardHead?] at hforward
+      | extern function arguments => simp [forwardHead?] at hforward
+
+structure Changes where
+  forwardedFetches : Nat := 0
+  afterAllocations : Nat := 0
+  afterReuses : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+def Changes.add (left right : Changes) : Changes :=
+  { forwardedFetches := left.forwardedFetches + right.forwardedFetches
+    afterAllocations := left.afterAllocations + right.afterAllocations
+    afterReuses := left.afterReuses + right.afterReuses }
+
+def Changes.ofKind : Kind → Changes
+  | .allocation => { forwardedFetches := 1, afterAllocations := 1 }
+  | .reuse => { forwardedFetches := 1, afterReuses := 1 }
+
+structure Outcome where
+  code : Code
+  changes : Changes := {}
+
+structure AlternativeOutcome where
+  alternative : Alt
+  changes : Changes := {}
+
+mutual
+
+/-- Mirror HPT transfer, recursively rewrite each continuation, and then
+forward a scalar fetch at the current let boundary when possible. -/
+def runWithFacts (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) (facts : List Fact) : Code → Outcome
+  | input@(.ret _) => ⟨input, {}⟩
+  | input@(.letOp operation rest) =>
+      match analyzeOp declarations summaries owner current facts operation with
+      | .error _ => ⟨input, {}⟩
+      | .ok bound =>
+          let nested := runWithFacts declarations summaries owner current
+            (bound :: facts.map Fact.forgetHeap) rest
+          match forwardHead? facts operation nested.code with
+          | some forwarding =>
+              ⟨forwarding.code,
+                nested.changes.add (.ofKind forwarding.kind)⟩
+          | none => ⟨.letOp operation nested.code, nested.changes⟩
+  | input@(.case scrutinee peelNat alternatives) =>
+      match resolveAtomFact facts scrutinee with
+      | .error _ => ⟨input, {}⟩
+      | .ok fact =>
+          let nested := alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              fact peelNat facts)
+          ⟨.case scrutinee peelNat
+              (nested.map fun result => result.alternative),
+            nested.foldl
+              (fun total result => total.add result.changes) {}⟩
+
+def runAlternativeWithFacts (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact) :
+    Alt → AlternativeOutcome
+  | .mk cidx fields body =>
+      let nested := runWithFacts declarations summaries owner current
+        (scrutineeFact.caseFields peelNat cidx fields ++ facts) body
+      ⟨.mk cidx fields nested.code, nested.changes⟩
+
+end
+
+def runFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) : Outcome :=
+  runWithFacts declarations summaries owner current
+    (List.replicate current.arity Fact.top) current.body
+
+def rewriteFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) : FnDef :=
+  { current with body := (runFunction declarations summaries owner current).code }
+
+/-! ## Semantic support for one forwarded field -/
+
+theorem scalar_of_scalarOnly_holds
+    {declarations : DeclEnv} {store : Store} {fact : Fact} {value : RVal}
+    (honly : scalarOnly fact = true)
+    (hholds : fact.Holds declarations store value) :
+    value.isScalar = true := by
+  unfold scalarOnly at honly
+  simp only [Bool.and_eq_true] at honly
+  cases value with
+  | lit literal => rfl
+  | erased => rfl
+  | loc location =>
+      simp only [Fact.Holds] at hholds
+      rcases hholds with hunknown | ⟨shape, hmember, _⟩
+      · have hfalse : fact.unknownHeap = false := by
+          simpa using honly.1
+        rw [hfalse] at hunknown
+        contradiction
+      · have hempty : fact.shapes = [] := List.isEmpty_iff.mp honly.2
+        rw [hempty] at hmember
+        contradiction
+
+private def resolveStep (environment : List RVal)
+    (values : List RVal) (atom : Atom) : Except Err (List RVal) := do
+  pure (values ++ [← resolveAtom environment atom])
+
+private inductive AtomsResolve (environment : List RVal) :
+    List Atom → List RVal → Prop where
+  | nil : AtomsResolve environment [] []
+  | cons (hhead : resolveAtom environment atom = .ok value)
+      (htail : AtomsResolve environment atoms values) :
+      AtomsResolve environment (atom :: atoms) (value :: values)
+
+namespace AtomsResolve
+
+private theorem foldlM {environment : List RVal} :
+    ∀ {atoms values}, AtomsResolve environment atoms values →
+      ∀ accumulator,
+        atoms.foldlM (resolveStep environment) accumulator =
+          .ok (accumulator ++ values)
+  | [], [], .nil, accumulator => by
+      simp only [List.foldlM_nil, pure, Except.pure, List.append_nil]
+  | atom :: atoms, value :: values, .cons hhead htail, accumulator => by
+      have hstep : resolveStep environment accumulator atom =
+          .ok (accumulator ++ [value]) := by
+        simp [resolveStep, hhead, bind, Except.bind, pure, Except.pure]
+      rw [List.foldlM_cons, hstep]
+      simp only [bind, Except.bind]
+      rw [htail.foldlM (accumulator ++ [value])]
+      simp [List.append_assoc]
+
+private theorem ofFoldlM {environment : List RVal} :
+    ∀ atoms accumulator output,
+      atoms.foldlM (resolveStep environment) accumulator = .ok output →
+      ∃ values, AtomsResolve environment atoms values ∧
+        output = accumulator ++ values := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro accumulator output hrun
+      simp only [List.foldlM_nil, pure, Except.pure] at hrun
+      injection hrun with houtput
+      subst output
+      exact ⟨[], .nil, by simp⟩
+  | cons atom atoms ih =>
+      intro accumulator output hrun
+      simp only [List.foldlM_cons] at hrun
+      cases hhead : resolveAtom environment atom with
+      | error error =>
+          have hstep : resolveStep environment accumulator atom =
+              .error error := by
+            simp [resolveStep, hhead, bind, Except.bind]
+          rw [hstep] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok value =>
+          have hstep : resolveStep environment accumulator atom =
+              .ok (accumulator ++ [value]) := by
+            simp [resolveStep, hhead, bind, Except.bind, pure, Except.pure]
+          rw [hstep] at hrun
+          simp only [bind, Except.bind] at hrun
+          obtain ⟨values, hvalues, houtput⟩ :=
+            ih (accumulator ++ [value]) output hrun
+          refine ⟨value :: values, .cons hhead hvalues, ?_⟩
+          rw [houtput]
+          simp [List.append_assoc]
+
+private theorem getElem? {environment : List RVal} :
+    ∀ {atoms values}, AtomsResolve environment atoms values →
+      ∀ {field : Nat} {atom : Atom}, atoms[field]? = some atom →
+        ∃ value, values[field]? = some value ∧
+          resolveAtom environment atom = .ok value := by
+  intro atoms values hresolve
+  induction hresolve with
+  | nil => intro field atom hfield; simp at hfield
+  | @cons atom value atoms values hhead htail ih =>
+      intro field selected hfield
+      cases field with
+      | zero =>
+          simp only [List.getElem?_cons_zero] at hfield
+          injection hfield with hselected
+          subst selected
+          exact ⟨value, rfl, hhead⟩
+      | succ field =>
+          simp only [List.getElem?_cons_succ] at hfield
+          obtain ⟨selectedValue, hvalue, hatom⟩ := ih hfield
+          exact ⟨selectedValue, by simpa using hvalue, hatom⟩
+
+end AtomsResolve
+
+private theorem atomsResolve_of_resolveAtoms {environment : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (hrun : resolveAtoms environment atoms = .ok values) :
+    AtomsResolve environment atoms.toList values := by
+  unfold resolveAtoms at hrun
+  rw [← Array.foldlM_toList] at hrun
+  change atoms.toList.foldlM (resolveStep environment) [] = .ok values at hrun
+  obtain ⟨found, hfound, hvalues⟩ :=
+    AtomsResolve.ofFoldlM atoms.toList [] values hrun
+  simp only [List.nil_append] at hvalues
+  subst found
+  exact hfound
+
+private theorem selectedAtom_resolves
+    {environment : List RVal} {arguments : Array Atom} {values : List RVal}
+    {field : Nat} {atom : Atom}
+    (harguments : resolveAtoms environment arguments = .ok values)
+    (hfield : arguments[field]? = some atom) :
+    ∃ value, resolveAtom environment atom = .ok value ∧
+      values.toArray[field]? = some value := by
+  have hfieldList : arguments.toList[field]? = some atom := by
+    simpa using hfield
+  obtain ⟨value, hvalue, hresolve⟩ :=
+    AtomsResolve.getElem? (atomsResolve_of_resolveAtoms harguments) hfieldList
+  exact ⟨value, hresolve, by simpa using hvalue⟩
+
+/-- Once a constructor-producing operation has installed the selected field,
+the retained-binder `pure` resolves to exactly the value that `fetch` returns. -/
+private theorem runOp_pure_eq_fetch_ctor
+    {ctx : Ctx} {fuel : Nat} {current : FnDef} {store : Store}
+    {environment : List RVal} {location : Nat} {world : Ixon.Owned}
+    {rc : Nat} {identity : CtorId} {arguments : Array Atom}
+    {values : List RVal} {field : Nat} {atom : Atom}
+    (hget : store.get? location =
+      some ⟨world, rc, .ctorN identity values.toArray⟩)
+    (harguments : resolveAtoms environment arguments = .ok values)
+    (hfield : arguments[field]? = some atom) :
+    runOp ctx fuel current store (.loc location :: environment)
+        (.pure (liftAtom atom)) =
+      runOp ctx fuel current store (.loc location :: environment)
+        (.fetch (.var 0) field) := by
+  cases fuel with
+  | zero => rw [runOp.eq_def, runOp.eq_def]
+  | succ fuel =>
+      obtain ⟨value, hresolve, hvalue⟩ :=
+        selectedAtom_resolves harguments hfield
+      simp only [runOp]
+      rw [resolveAtom_liftAtom_of_eq_ok hresolve]
+      simp only [bind, Except.bind, resolveAtom, List.getElem?_cons_zero]
+      rw [hget]
+      simp only
+      rw [hvalue]
+
+/-- Every accepted local decision preserves the complete evaluator result,
+including errors, fuel behavior, stores, and instruction counters. -/
+theorem runCode_forwardHead?_eq
+    {facts : List Fact} {operation : Op} {continuation : Code}
+    {forwarding : Forwarding} {ctx : Ctx} {fuel : Nat}
+    {current : FnDef} {store : Store} {environment : List RVal}
+    (hforward : forwardHead? facts operation continuation = some forwarding) :
+    runCode ctx fuel current store environment forwarding.code =
+      runCode ctx fuel current store environment
+        (.letOp operation continuation) := by
+  have hspec := forwardSpec_of_forwardHead?_eq_some hforward
+  cases hspec with
+  | @allocation world identity arguments field rest atom fact hfield hfact
+      hscalar =>
+      cases fuel with
+      | zero => rw [runCode.eq_def, runCode.eq_def]
+      | succ outerFuel =>
+          cases outerFuel with
+          | zero => simp [runCode, runOp]
+          | succ operationFuel =>
+              cases harguments : resolveAtoms environment arguments with
+              | error error =>
+                  simp [runCode, runOp, harguments, bind, Except.bind]
+              | ok values =>
+                  let allocated :=
+                    store.allocNode world (.ctorN identity values.toArray)
+                  have hoperation :
+                      runOp ctx (operationFuel + 1) current store environment
+                          (.alloc world identity arguments) =
+                        .ok (allocated.1, .loc allocated.2) := by
+                    simp [runOp, harguments, allocated, bind, Except.bind]
+                  have hget : allocated.1.get? allocated.2 =
+                      some ⟨world, 1, .ctorN identity values.toArray⟩ := by
+                    simp [allocated, Sim.HeapIso.get?_allocNode_new]
+                  simp only [runCode]
+                  rw [hoperation]
+                  simp only [bind, Except.bind]
+                  rw [runOp_pure_eq_fetch_ctor hget harguments hfield]
+  | @reuse target identity arguments field rest atom fact hfield hfact
+      hscalar =>
+      cases fuel with
+      | zero => rw [runCode.eq_def, runCode.eq_def]
+      | succ outerFuel =>
+          cases outerFuel with
+          | zero => simp [runCode, runOp]
+          | succ operationFuel =>
+              cases harguments : resolveAtoms environment arguments with
+              | error error =>
+                  simp [runCode, runOp, harguments, bind, Except.bind]
+              | ok values =>
+                  cases htarget : resolveAtom environment target with
+                  | error error =>
+                      simp [runCode, runOp, harguments, htarget, bind,
+                        Except.bind]
+                  | ok targetValue =>
+                      cases targetValue with
+                      | lit literal =>
+                          simp [runCode, runOp, harguments, htarget, bind,
+                            Except.bind]
+                      | erased =>
+                          simp [runCode, runOp, harguments, htarget, bind,
+                            Except.bind]
+                      | loc location =>
+                          cases hbox : store.get? location with
+                          | none =>
+                              simp [runCode, runOp, harguments, htarget, hbox,
+                                bind, Except.bind]
+                          | some box =>
+                              cases hworld : box.world with
+                              | shared =>
+                                  simp [runCode, runOp, harguments, htarget,
+                                    hbox, hworld, bind, Except.bind]
+                              | unique =>
+                                  let replacement : NodeBox :=
+                                    ⟨.unique, 1,
+                                      .ctorN identity values.toArray⟩
+                                  let updated := store.setBox location replacement
+                                  let next : Store :=
+                                    { updated with reuses := updated.reuses + 1 }
+                                  have hoperation :
+                                      runOp ctx (operationFuel + 1) current
+                                          store environment
+                                          (.reuse target identity arguments) =
+                                        .ok (next, .loc location) := by
+                                    simp [runOp, harguments, htarget, hbox,
+                                      hworld, replacement, updated, next, bind,
+                                      Except.bind]
+                                  have hset :
+                                      (store.setBox location replacement).get?
+                                          location = some replacement :=
+                                    Sim.get?_setBox_same hbox
+                                  have hget : next.get? location =
+                                      some ⟨.unique, 1,
+                                        .ctorN identity values.toArray⟩ := by
+                                    simpa [next, updated, replacement,
+                                      Store.get?] using hset
+                                  simp only [runCode]
+                                  rw [hoperation]
+                                  simp only [bind, Except.bind]
+                                  rw [runOp_pure_eq_fetch_ctor hget harguments
+                                    hfield]
+
+/-- The executable side condition proves that the reused source operand is a
+runtime scalar whenever the checked HPT environment and concrete resolution
+agree.  This is the ownership justification beyond evaluator equality. -/
+theorem source_isScalar_of_forwardHead?_eq_some
+    {declarations : DeclEnv} {store : Store} {facts : List Fact}
+    {environment : List RVal} {operation : Op} {continuation : Code}
+    {forwarding : Forwarding} {value : RVal}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hforward : forwardHead? facts operation continuation = some forwarding)
+    (hresolve : resolveAtom environment forwarding.source = .ok value) :
+    value.isScalar = true := by
+  have hspec := forwardSpec_of_forwardHead?_eq_some hforward
+  cases hspec with
+  | allocation hfield hfact hscalar =>
+      exact scalar_of_scalarOnly_holds hscalar
+        (resolveAtom_sound henvironment hfact hresolve)
+  | reuse hfield hfact hscalar =>
+      exact scalar_of_scalarOnly_holds hscalar
+        (resolveAtom_sound henvironment hfact hresolve)
+
+/-! ## Exact recursive traversal -/
+
+@[simp] private theorem runAlternativeWithFacts_cidx
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternative : Alt) :
+    (runAlternativeWithFacts declarations summaries owner current
+      scrutineeFact peelNat facts alternative).alternative.cidx =
+        alternative.cidx := by
+  cases alternative
+  simp [runAlternativeWithFacts, Alt.cidx]
+
+private theorem runAlternativeWithFacts_predicate
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (index : Nat) :
+    ((fun alternative : Alt => alternative.cidx == index) ∘
+        (fun result : AlternativeOutcome => result.alternative) ∘
+        runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts) =
+      (fun alternative => alternative.cidx == index) := by
+  funext alternative
+  cases alternative
+  simp [Function.comp_def, runAlternativeWithFacts, Alt.cidx]
+
+private theorem find?_runAlternativeWithFacts
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternatives : Array Alt) (index : Nat) :
+    ((alternatives.map
+        (runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts)).map
+        (fun result => result.alternative)).find?
+          (fun alternative => alternative.cidx == index) =
+      (alternatives.find? (fun alternative => alternative.cidx == index)).map
+        (fun alternative =>
+          (runAlternativeWithFacts declarations summaries owner current
+            scrutineeFact peelNat facts alternative).alternative) := by
+  rw [Array.map_map, Array.find?_map,
+    runAlternativeWithFacts_predicate declarations summaries owner current
+      scrutineeFact peelNat facts index]
+  simp [Function.comp_def]
+
+private theorem Array.foldl_cons_eq_reverse_append
+    (fields : Array RVal) (environment : List RVal) :
+    fields.foldl (fun current field => field :: current) environment =
+      fields.toList.reverse ++ environment := by
+  rw [← Array.foldl_toList]
+  induction fields.toList generalizing environment with
+  | nil => rfl
+  | cons field fields ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+/-- The branch-body half of fetch forwarding.  HPT case binders are installed
+only after the concrete evaluator selects a matching alternative and arity. -/
+private theorem runCode_caseWithFactsBodies_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    {owner : Address} {current : FnDef}
+    {ctx : Ctx} {store : Store} {facts : List Fact}
+    {environment : List RVal} {scrutinee : Atom} {peelNat : Bool}
+    {alternatives : Array Alt} {scrutineeFact : Fact} {fuel : Nat}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (habstract : resolveAtomFact facts scrutinee = .ok scrutineeFact)
+    (ih : ∀ {store : Store} {facts : List Fact}
+      {environment : List RVal} {input : Code},
+      EnvironmentHolds declarations store facts environment →
+      runCode ctx fuel current store environment
+          (runWithFacts declarations summaries owner current facts input).code =
+        runCode ctx fuel current store environment input) :
+    runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat
+          ((alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              scrutineeFact peelNat facts)).map
+                (fun result => result.alternative))) =
+      runCode ctx (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  obtain ⟨scrutineeValue, hresolve⟩ :=
+    resolveAtom_complete henvironment habstract
+  have hscrutineeHolds :=
+    resolveAtom_sound henvironment habstract hresolve
+  simp only [runCode]
+  rw [hresolve]
+  simp only [bind, Except.bind]
+  cases scrutineeValue with
+  | erased => rfl
+  | lit literal =>
+      cases literal with
+      | str value => rfl
+      | nat value =>
+          simp only
+          cases peelNat with
+          | false => rfl
+          | true =>
+              simp only
+              cases value with
+              | zero =>
+                  simp only
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 0) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero =>
+                              have hzero :
+                                  scrutineeFact.caseFields true cidx 0 = [] := by
+                                unfold Fact.caseFields
+                                split <;> rfl
+                              simpa [runAlternativeWithFacts, hzero] using
+                                (ih (input := body) henvironment)
+                          | succ fields => simp [runAlternativeWithFacts]
+              | succ value =>
+                  simp only
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 1) with
+                  | none => simp
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero => simp [runAlternativeWithFacts]
+                          | succ fields =>
+                              cases fields with
+                              | zero =>
+                                  have hcidx : cidx = 1 := by
+                                    have hmatch := Array.find?_some
+                                      (p := fun alternative : Alt =>
+                                        alternative.cidx == 1)
+                                      (a := .mk cidx 1 body)
+                                      (xs := alternatives) hfind
+                                    exact beq_iff_eq.mp hmatch
+                                  have hbinders :
+                                      EnvironmentHolds declarations store
+                                        (scrutineeFact.caseFields true cidx 1)
+                                        [.lit (.nat value)] := by
+                                    simpa [hcidx] using
+                                      (Fact.caseFields_natSucc_holds
+                                        hscrutineeHolds)
+                                  simpa [runAlternativeWithFacts] using
+                                    (ih (input := body)
+                                      (hbinders.append henvironment))
+                              | succ fields =>
+                                  simp [runAlternativeWithFacts]
+  | loc location =>
+      simp only
+      cases hget : store.get? location with
+      | none => simp
+      | some box =>
+          simp only
+          cases hnode : box.node with
+          | papN function arity arguments => simp
+          | ctorN identity fields =>
+              simp only
+              rw [find?_runAlternativeWithFacts]
+              cases hfind : alternatives.find?
+                  (fun alternative => alternative.cidx == identity.cidx) with
+              | none => simp
+              | some alternative =>
+                  cases alternative with
+                  | mk cidx fieldCount body =>
+                      by_cases hfields : fields.size = fieldCount
+                      · have hcidx : identity.cidx = cidx := by
+                          have hmatch := Array.find?_some
+                            (p := fun alternative : Alt =>
+                              alternative.cidx == identity.cidx)
+                            (a := .mk cidx fieldCount body)
+                            (xs := alternatives) hfind
+                          exact (beq_iff_eq.mp hmatch).symm
+                        have hbinders := Fact.caseFields_ctor_holds
+                          peelNat cidx fieldCount hscrutineeHolds hget hnode
+                          hcidx hfields
+                        rw [Array.foldl_cons_eq_reverse_append]
+                        simpa [hfields, runAlternativeWithFacts] using
+                          (ih (input := body)
+                            (hbinders.append henvironment))
+                      · simp [hfields, runAlternativeWithFacts]
+
+/-- Exact evaluator equality for the owner-sensitive forwarding traversal.
+The owner may name the current stored function or be absent from the summary,
+which is the fail-closed top-level-main convention. -/
+theorem runCode_runWithFacts_eq_ownerCompatible
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    {store : Store} {facts : List Fact} {environment : List RVal}
+    {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    (henvironment : EnvironmentHolds declarations store facts environment) :
+    runCode ctx fuel current store environment
+        (runWithFacts declarations summaries owner current facts input).code =
+      runCode ctx fuel current store environment input := by
+  induction fuel generalizing store facts environment input with
+  | zero => simp [runCode]
+  | succ fuel ih =>
+      cases input with
+      | ret atom => simp [runWithFacts, runCode]
+      | letOp operation rest =>
+          cases habstract : analyzeOp declarations summaries owner current
+              facts operation with
+          | error error => simp [runWithFacts, habstract]
+          | ok bound =>
+              let nested := runWithFacts declarations summaries owner current
+                (bound :: facts.map Fact.forgetHeap) rest
+              have hordinary :
+                  runCode ctx (fuel + 1) current store environment
+                      (.letOp operation nested.code) =
+                    runCode ctx (fuel + 1) current store environment
+                      (.letOp operation rest) := by
+                simp only [runCode]
+                cases hoperation : runOp ctx fuel current store environment
+                    operation with
+                | error error => simp [bind, Except.bind]
+                | ok output =>
+                    rcases output with ⟨outputStore, outputValue⟩
+                    simp only [bind, Except.bind]
+                    have hbound := analyzeOp_sound_ownerCompatible hpost hctx
+                      howner henvironment habstract hoperation
+                    have hold := EnvironmentHolds.forgetHeap
+                      (after := outputStore) henvironment
+                    simpa [nested] using
+                      (ih (store := outputStore)
+                        (facts := bound :: facts.map Fact.forgetHeap)
+                        (environment := outputValue :: environment)
+                        (input := rest) (.cons hbound hold))
+              cases hforward : forwardHead? facts operation nested.code with
+              | none =>
+                  simpa [runWithFacts, habstract, nested, hforward] using
+                    hordinary
+              | some forwarding =>
+                  calc
+                    runCode ctx (fuel + 1) current store environment
+                        (runWithFacts declarations summaries owner current facts
+                          (.letOp operation rest)).code =
+                      runCode ctx (fuel + 1) current store environment
+                        forwarding.code := by
+                          simp [runWithFacts, habstract, nested, hforward]
+                    _ = runCode ctx (fuel + 1) current store environment
+                          (.letOp operation nested.code) :=
+                      runCode_forwardHead?_eq hforward
+                    _ = runCode ctx (fuel + 1) current store environment
+                          (.letOp operation rest) := hordinary
+      | case scrutinee peelNat alternatives =>
+          cases habstract : resolveAtomFact facts scrutinee with
+          | error error => simp [runWithFacts, habstract]
+          | ok scrutineeFact =>
+              simpa [runWithFacts, habstract] using
+                (runCode_caseWithFactsBodies_eq henvironment habstract
+                  (fun henv => ih henv))
+
+/-- Stored-function specialization of exact recursive fetch forwarding. -/
+theorem runCode_runWithFacts_eq
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    {store : Store} {facts : List Fact} {environment : List RVal}
+    {input : Code} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (henvironment : EnvironmentHolds declarations store facts environment) :
+    runCode ctx fuel current store environment
+        (runWithFacts declarations summaries owner current facts input).code =
+      runCode ctx fuel current store environment input :=
+  runCode_runWithFacts_eq_ownerCompatible hpost hctx (.inl hcurrent)
+    henvironment
+
+end Ix.Compiler.IxIR1.HPT.FetchForward
diff --git a/Ix/Compiler/IxIR1/HPTPAPFuse.lean b/Ix/Compiler/IxIR1/HPTPAPFuse.lean
new file mode 100644
index 000000000..521f62084
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTPAPFuse.lean
@@ -0,0 +1,2770 @@
+import Ix.Compiler.IxIR1.EvalRewrite
+import Ix.Compiler.IxIR1.HPTSound
+
+/-!
+# Checked local PAP/application fusion
+
+The first PAP consumer is deliberately allocation-site local.  It recognizes
+two adjacent binders
+
+```text
+let p := papp f captured
+let y := apply p supplied
+rest
+```
+
+and replaces them with a larger `papp`, a direct `call`, or a direct `call`
+followed by the residual `apply`.  Both binder slots are retained, so no
+general de Bruijn substitution is needed.  The checker establishes:
+
+- the target declaration and its arity;
+- exact argument order across under-, exact-, and over-saturation;
+- that supplied arguments do not refer to the consumed PAP;
+- that the old PAP binder is absent from the continuation; and
+- that every captured runtime value is scalar according to checked HPT facts.
+
+The scalar restriction is substantive rather than cosmetic.  IxIR₁ function
+definitions retain result ownership but no longer carry parameter modes, and
+HPT does not infer heap worlds.  A local checker can therefore prove that a
+capture needs no retain/release traffic when it is scalar, but cannot certify
+an arbitrary heap capture as shared.  A later borrow/ownership artifact can
+broaden this same rewrite without changing its syntax contract.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.PAPFuse
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1.Sim
+
+/-- A fact which admits scalars and no heap value.  Bottom also satisfies the
+test; its concrete interpretation is empty, so it cannot authorize a
+successful non-scalar capture. -/
+def scalarOnly (fact : Fact) : Bool :=
+  !fact.unknownHeap && fact.shapes.isEmpty
+
+/-- Lower one operand across removal of the immediately preceding PAP binder.
+`none` is exactly a use of that consumed binder. -/
+def lowerAtom? : Atom → Option Atom
+  | .var 0 => none
+  | .var (index + 1) => some (.var index)
+  | .lit literal => some (.lit literal)
+  | .erased => some .erased
+
+def lowerAtoms? (atoms : Array Atom) : Option (Array Atom) :=
+  (atoms.toList.mapM lowerAtom?).map List.toArray
+
+def atomUsesVar (needle : Nat) : Atom → Bool
+  | .var index => index == needle
+  | .lit _ | .erased => false
+
+def atomsUseVar (needle : Nat) (atoms : Array Atom) : Bool :=
+  atoms.any (atomUsesVar needle)
+
+def opUsesVar (needle : Nat) : Op → Bool
+  | .pure atom => atomUsesVar needle atom
+  | .alloc _ _ atoms | .call _ atoms | .papp _ atoms |
+      .extern _ atoms | .callSelf atoms => atomsUseVar needle atoms
+  | .reuse target _ atoms =>
+      atomUsesVar needle target || atomsUseVar needle atoms
+  | .free target | .dup target | .drop target | .dropU target =>
+      atomUsesVar needle target
+  | .fetch target _ => atomUsesVar needle target
+  | .apply function atoms =>
+      atomUsesVar needle function || atomsUseVar needle atoms
+
+mutual
+
+private def codeUsesVarFuel : Nat → Code → Nat → Bool
+  | 0, _, _ => true
+  | _ + 1, .ret atom, needle => atomUsesVar needle atom
+  | fuel + 1, .letOp operation rest, needle =>
+      opUsesVar needle operation ||
+        codeUsesVarFuel fuel rest (needle + 1)
+  | fuel + 1, .case scrutinee _ alternatives, needle =>
+      atomUsesVar needle scrutinee ||
+        alternatives.any
+          (fun alternative => altUsesVarFuel fuel alternative needle)
+
+private def altUsesVarFuel : Nat → Alt → Nat → Bool
+  | 0, _, _ => true
+  | fuel + 1, .mk _ fields body, needle =>
+      codeUsesVarFuel fuel body (needle + fields)
+
+end
+
+/-- Capture-aware occurrence check.  `needle` is expressed in the entry
+environment; let and case binders shift it on recursive descent.  Fuel is the
+syntax size and exhaustion conservatively reports a use. -/
+def codeUsesVar (input : Code) (needle : Nat) : Bool :=
+  codeUsesVarFuel (input.bytes.size + 1) input needle
+
+/-! The executable occurrence check has a proof-oriented counterpart.  A
+false fuel result is enough to construct this evidence: exhaustion returns
+`true`, so accepted code necessarily carries evidence down every path. -/
+
+mutual
+
+inductive CodeNoUse : Nat → Code → Prop where
+  | ret {needle atom} (hnot : atomUsesVar needle atom = false) :
+      CodeNoUse needle (.ret atom)
+  | letOp {needle operation rest}
+      (hop : opUsesVar needle operation = false)
+      (hrest : CodeNoUse (needle + 1) rest) :
+      CodeNoUse needle (.letOp operation rest)
+  | case {needle scrutinee peelNat alternatives}
+      (hscrutinee : atomUsesVar needle scrutinee = false)
+      (halternatives : ∀ alternative, alternative ∈ alternatives →
+        AltNoUse needle alternative) :
+      CodeNoUse needle (.case scrutinee peelNat alternatives)
+
+inductive AltNoUse : Nat → Alt → Prop where
+  | mk {needle cidx fields body}
+      (hbody : CodeNoUse (needle + fields) body) :
+      AltNoUse needle (.mk cidx fields body)
+
+end
+
+mutual
+
+private theorem codeNoUse_of_fuel_false : ∀ fuel input needle,
+    codeUsesVarFuel fuel input needle = false → CodeNoUse needle input := by
+  intro fuel input needle hcheck
+  cases fuel with
+  | zero => simp [codeUsesVarFuel] at hcheck
+  | succ fuel =>
+      cases input with
+      | ret atom => exact .ret hcheck
+      | letOp operation rest =>
+          simp only [codeUsesVarFuel, Bool.or_eq_false_iff] at hcheck
+          exact .letOp hcheck.1
+            (codeNoUse_of_fuel_false fuel rest (needle + 1) hcheck.2)
+      | case scrutinee peelNat alternatives =>
+          simp only [codeUsesVarFuel, Bool.or_eq_false_iff] at hcheck
+          refine .case hcheck.1 ?_
+          intro alternative halternative
+          apply altNoUse_of_fuel_false fuel alternative needle
+          have hnotTrue :
+              ¬ altUsesVarFuel fuel alternative needle = true :=
+            (Array.any_eq_false'.mp hcheck.2) alternative halternative
+          exact Bool.eq_false_iff.mpr hnotTrue
+
+private theorem altNoUse_of_fuel_false : ∀ fuel alternative needle,
+    altUsesVarFuel fuel alternative needle = false →
+      AltNoUse needle alternative := by
+  intro fuel alternative needle hcheck
+  cases fuel with
+  | zero => simp [altUsesVarFuel] at hcheck
+  | succ fuel =>
+      cases alternative with
+      | mk cidx fields body =>
+          exact .mk
+            (codeNoUse_of_fuel_false fuel body (needle + fields) hcheck)
+
+end
+
+
+theorem codeNoUse_of_codeUsesVar_eq_false {input : Code} {needle : Nat}
+    (hcheck : codeUsesVar input needle = false) :
+    CodeNoUse needle input :=
+  codeNoUse_of_fuel_false (input.bytes.size + 1) input needle hcheck
+
+/-! ## Environment irrelevance
+
+The relation deliberately permits the distinguished slots to contain
+arbitrary values.  It is stable when an operation result or constructor
+fields are pushed in front of both environments. -/
+
+def EnvsAgreeExcept (needle : Nat) (left right : List RVal) : Prop :=
+  ∀ index, index ≠ needle → left[index]? = right[index]?
+
+namespace EnvsAgreeExcept
+
+theorem cons {needle : Nat} {left right : List RVal}
+    (h : EnvsAgreeExcept needle left right) (value : RVal) :
+    EnvsAgreeExcept (needle + 1) (value :: left) (value :: right) := by
+  intro index hindex
+  cases index with
+  | zero => rfl
+  | succ index =>
+      simp only [List.getElem?_cons_succ]
+      apply h index
+      omega
+
+theorem prepend {needle : Nat} {left right : List RVal}
+    (h : EnvsAgreeExcept needle left right) (values : List RVal) :
+    EnvsAgreeExcept (needle + values.length)
+      (values ++ left) (values ++ right) := by
+  induction values with
+  | nil => simpa using h
+  | cons value values ih =>
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+        ih.cons value
+
+theorem second (head leftValue rightValue : RVal) (tail : List RVal) :
+    EnvsAgreeExcept 1
+      (head :: leftValue :: tail) (head :: rightValue :: tail) := by
+  intro index hindex
+  cases index with
+  | zero => rfl
+  | succ index =>
+      cases index with
+      | zero => omega
+      | succ index => rfl
+
+end EnvsAgreeExcept
+
+private theorem resolveAtom_env_eq {needle : Nat} {left right : List RVal}
+    (henvironment : EnvsAgreeExcept needle left right) {atom : Atom}
+    (hnot : atomUsesVar needle atom = false) :
+    resolveAtom left atom = resolveAtom right atom := by
+  cases atom with
+  | var index =>
+      have hindex : index ≠ needle := by
+        simpa [atomUsesVar] using hnot
+      simp only [resolveAtom]
+      rw [henvironment index hindex]
+  | lit literal => rfl
+  | erased => rfl
+
+private theorem List.resolveAtomsFrom_env_eq {needle : Nat}
+    {left right : List RVal} (henvironment : EnvsAgreeExcept needle left right) :
+    ∀ (atoms : List Atom) (accumulator : List RVal),
+      (∀ atom, atom ∈ atoms → atomUsesVar needle atom = false) →
+      atoms.foldlM
+          (fun accumulated atom => do
+            pure (accumulated ++ [← resolveAtom left atom])) accumulator =
+        atoms.foldlM
+          (fun accumulated atom => do
+            pure (accumulated ++ [← resolveAtom right atom])) accumulator := by
+  intro atoms
+  induction atoms with
+  | nil => intro accumulator _; rfl
+  | cons atom atoms ih =>
+      intro accumulator hnot
+      simp only [List.foldlM_cons]
+      rw [resolveAtom_env_eq henvironment (hnot atom (by simp))]
+      cases resolveAtom right atom with
+      | error error => rfl
+      | ok value =>
+          simp only [bind, Except.bind]
+          apply ih
+          intro tail htail
+          exact hnot tail (by simp [htail])
+
+private theorem resolveAtoms_env_eq {needle : Nat} {left right : List RVal}
+    (henvironment : EnvsAgreeExcept needle left right) {atoms : Array Atom}
+    (hnot : atomsUseVar needle atoms = false) :
+    resolveAtoms left atoms = resolveAtoms right atoms := by
+  unfold resolveAtoms
+  rw [← Array.foldlM_toList, ← Array.foldlM_toList]
+  apply List.resolveAtomsFrom_env_eq henvironment
+  intro atom hatom
+  have hnotTrue : ¬ atomUsesVar needle atom = true :=
+    (Array.any_eq_false'.mp hnot) atom (by simpa using hatom)
+  exact Bool.eq_false_iff.mpr hnotTrue
+
+/-- An operation which does not mention the distinguished slot has exactly
+the same behavior in environments which differ only there. -/
+theorem runOp_env_eq_of_noUse {ctx : Ctx} {fuel : Nat} {current : FnDef}
+    {store : Store} {needle : Nat} {left right : List RVal}
+    (henvironment : EnvsAgreeExcept needle left right) {operation : Op}
+    (hnot : opUsesVar needle operation = false) :
+    runOp ctx fuel current store left operation =
+      runOp ctx fuel current store right operation := by
+  cases fuel with
+  | zero => rw [runOp.eq_def, runOp.eq_def]
+  | succ fuel =>
+      cases operation with
+      | pure atom =>
+          simp only [runOp]
+          rw [resolveAtom_env_eq henvironment hnot]
+      | alloc world cidx atoms =>
+          simp only [runOp]
+          rw [resolveAtoms_env_eq henvironment hnot]
+      | reuse target cidx atoms =>
+          simp only [runOp]
+          simp only [opUsesVar, Bool.or_eq_false_iff] at hnot
+          rw [resolveAtoms_env_eq henvironment hnot.2,
+            resolveAtom_env_eq henvironment hnot.1]
+      | free target | dup target | drop target | dropU target | fetch target _ =>
+          simp only [runOp]
+          rw [resolveAtom_env_eq henvironment hnot]
+      | call function atoms =>
+          simp only [runOp]
+          rw [resolveAtoms_env_eq henvironment hnot]
+      | callSelf atoms =>
+          simp only [runOp]
+          rw [resolveAtoms_env_eq henvironment hnot]
+      | papp function atoms =>
+          simp only [runOp]
+          rw [resolveAtoms_env_eq henvironment hnot]
+      | extern function atoms =>
+          simp only [runOp]
+          rw [resolveAtoms_env_eq henvironment hnot]
+      | apply function atoms =>
+          simp only [runOp]
+          simp only [opUsesVar, Bool.or_eq_false_iff] at hnot
+          rw [resolveAtom_env_eq henvironment hnot.1,
+            resolveAtoms_env_eq henvironment hnot.2]
+
+private theorem List.foldl_cons_eq_reverse_append
+    (values environment : List RVal) :
+    values.foldl (fun accumulated value => value :: accumulated) environment =
+      values.reverse ++ environment := by
+  induction values generalizing environment with
+  | nil => rfl
+  | cons value values ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+private theorem Array.foldl_cons_eq_reverse_append
+    (values : Array RVal) (environment : List RVal) :
+    values.foldl (fun accumulated value => value :: accumulated) environment =
+      values.toList.reverse ++ environment := by
+  rw [← Array.foldl_toList]
+  exact List.foldl_cons_eq_reverse_append values.toList environment
+
+/-- Code certified not to use one slot is completely insensitive to that
+slot, including errors and fuel behavior. -/
+theorem runCode_env_eq_of_noUse {ctx : Ctx} :
+    ∀ fuel current store needle left right input,
+      EnvsAgreeExcept needle left right →
+      CodeNoUse needle input →
+      runCode ctx fuel current store left input =
+        runCode ctx fuel current store right input := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro current store needle left right input henvironment hnot
+      rw [runCode.eq_def, runCode.eq_def]
+  | succ fuel smaller =>
+      intro current store needle left right input henvironment hnot
+      cases hnot with
+      | ret hatom =>
+          simp only [runCode]
+          rw [resolveAtom_env_eq henvironment hatom]
+      | @letOp _ operation rest hop hrest =>
+          simp only [runCode]
+          rw [runOp_env_eq_of_noUse henvironment hop]
+          cases hoperation : runOp ctx fuel current store right operation with
+          | error error => rfl
+          | ok output =>
+              rcases output with ⟨next, value⟩
+              simp only [hoperation, bind, Except.bind]
+              exact smaller current next (needle + 1)
+                (value :: left) (value :: right) rest
+                (henvironment.cons value) hrest
+      | @case _ scrutinee peelNat alternatives hscrutinee halternatives =>
+          rw [runCode.eq_def, runCode.eq_def]
+          dsimp only
+          rw [resolveAtom_env_eq henvironment hscrutinee]
+          cases hresolve : resolveAtom right scrutinee with
+          | error error => rfl
+          | ok scrutineeValue =>
+              simp only [hresolve, bind, Except.bind]
+              cases scrutineeValue with
+              | erased => rfl
+              | loc location =>
+                  cases hbox : store.get? location with
+                  | none => simp [hbox]
+                  | some box =>
+                      simp only [hbox]
+                      cases box.node with
+                      | papN function arity captured => rfl
+                      | ctorN identity fields =>
+                          dsimp only
+                          cases halt : alternatives.find?
+                              (fun alternative =>
+                                alternative.cidx == identity.cidx) with
+                          | none => simp [halt]
+                          | some alternative =>
+                              have haltNo := halternatives alternative
+                                (Array.mem_of_find?_eq_some halt)
+                              cases alternative with
+                              | mk cidx fieldCount body =>
+                                  cases haltNo with
+                                  | mk hbody =>
+                                      cases hsize : fields.size != fieldCount
+                                      · simp only [halt, hsize,
+                                          Bool.false_eq_true, if_false]
+                                        rw [
+                                          Array.foldl_cons_eq_reverse_append,
+                                          Array.foldl_cons_eq_reverse_append]
+                                        apply smaller current store
+                                          (needle + fieldCount)
+                                          (fields.toList.reverse ++ left)
+                                          (fields.toList.reverse ++ right)
+                                          body
+                                        · have hprefix := henvironment.prepend
+                                            fields.toList.reverse
+                                          have hfieldCount :
+                                              fields.size = fieldCount := by
+                                            simpa using hsize
+                                          simpa [hfieldCount] using hprefix
+                                        · exact hbody
+                                      · simp [halt, hsize]
+              | lit literal =>
+                  cases literal with
+                  | str string => rfl
+                  | nat value =>
+                      cases hpeel : peelNat with
+                      | false => simp [hpeel]
+                      | true =>
+                          cases value with
+                          | zero =>
+                              cases halt : alternatives.find?
+                                  (fun alternative =>
+                                    alternative.cidx == 0) with
+                              | none => simp [hpeel, halt]
+                              | some alternative =>
+                                  have haltNo := halternatives alternative
+                                    (Array.mem_of_find?_eq_some halt)
+                                  cases alternative with
+                                  | mk cidx fieldCount body =>
+                                      cases haltNo with
+                                      | mk hbody =>
+                                          cases fieldCount with
+                                          | zero =>
+                                              simp only [hpeel, halt]
+                                              exact smaller current store
+                                                needle left right body
+                                                henvironment (by simpa using hbody)
+                                          | succ fieldCount =>
+                                              simp [hpeel, halt]
+                          | succ value =>
+                              cases halt : alternatives.find?
+                                  (fun alternative =>
+                                    alternative.cidx == 1) with
+                              | none => simp [hpeel, halt]
+                              | some alternative =>
+                                  have haltNo := halternatives alternative
+                                    (Array.mem_of_find?_eq_some halt)
+                                  cases alternative with
+                                  | mk cidx fieldCount body =>
+                                      cases haltNo with
+                                      | mk hbody =>
+                                          cases fieldCount with
+                                          | zero => simp [hpeel, halt]
+                                          | succ fieldCount =>
+                                              cases fieldCount with
+                                              | zero =>
+                                                  simp only [hpeel, halt]
+                                                  exact smaller current store
+                                                    (needle + 1)
+                                                    (.lit (.nat value) :: left)
+                                                    (.lit (.nat value) :: right)
+                                                    body
+                                                    (henvironment.cons
+                                                      (.lit (.nat value)))
+                                                    (by simpa using hbody)
+                                              | succ fieldCount =>
+                                                  simp [hpeel, halt]
+
+private def scalarCaptures (facts : List Fact)
+    (captured : Array Atom) : Bool :=
+  match resolveAtomFacts facts captured with
+  | .error _ => false
+  | .ok captureFacts => captureFacts.all scalarOnly
+
+inductive Kind where
+  | under
+  | exact
+  | over
+  deriving BEq, Repr
+
+/-- One accepted local replacement, classified for deterministic reporting. -/
+structure Fusion where
+  code : Code
+  kind : Kind
+
+/-- Check and construct one adjacent PAP/application fusion. -/
+def fusePair? (declarations : DeclEnv) (facts : List Fact)
+    (function : Address) (captured supplied : Array Atom)
+    (rest : Code) : Option Fusion := do
+  let declaration ← declarations function
+  let arity := declArity declaration
+  if captured.size >= arity then none
+  else if !scalarCaptures facts captured then none
+  else if codeUsesVar rest 1 then none
+  else
+    let loweredSupplied ← lowerAtoms? supplied
+    let combined := captured.toList ++ loweredSupplied.toList
+    if combined.length < arity then
+      some ⟨.letOp (.papp function combined.toArray)
+          (.letOp (.pure (.var 0)) rest), .under⟩
+    else if combined.length == arity then
+      some ⟨.letOp (.call function combined.toArray)
+          (.letOp (.pure (.var 0)) rest), .exact⟩
+    else
+      let consumedSupplied := arity - captured.size
+      let first := combined.take arity |>.toArray
+      let remaining := supplied.toList.drop consumedSupplied |>.toArray
+      some ⟨.letOp (.call function first)
+          (.letOp (.apply (.var 0) remaining) rest), .over⟩
+
+/-! A proof-facing view of an accepted executable decision. -/
+
+inductive FuseSpec (declarations : DeclEnv) (facts : List Fact)
+    (function : Address) (captured supplied : Array Atom) (rest : Code) :
+    Fusion → Prop where
+  | under {declaration : Decl} {lowered : Array Atom}
+      (hdeclaration : declarations function = some declaration)
+      (hcaptureArity : captured.size < declArity declaration)
+      (hscalar : scalarCaptures facts captured = true)
+      (hrest : codeUsesVar rest 1 = false)
+      (hlowered : lowerAtoms? supplied = some lowered)
+      (hunder : (captured.toList ++ lowered.toList).length <
+        declArity declaration) :
+      FuseSpec declarations facts function captured supplied rest
+        ⟨.letOp
+          (.papp function (captured.toList ++ lowered.toList).toArray)
+          (.letOp (.pure (.var 0)) rest), .under⟩
+  | exact {declaration : Decl} {lowered : Array Atom}
+      (hdeclaration : declarations function = some declaration)
+      (hcaptureArity : captured.size < declArity declaration)
+      (hscalar : scalarCaptures facts captured = true)
+      (hrest : codeUsesVar rest 1 = false)
+      (hlowered : lowerAtoms? supplied = some lowered)
+      (hexact : (captured.toList ++ lowered.toList).length =
+        declArity declaration) :
+      FuseSpec declarations facts function captured supplied rest
+        ⟨.letOp
+          (.call function (captured.toList ++ lowered.toList).toArray)
+          (.letOp (.pure (.var 0)) rest), .exact⟩
+  | over {declaration : Decl} {lowered : Array Atom}
+      (hdeclaration : declarations function = some declaration)
+      (hcaptureArity : captured.size < declArity declaration)
+      (hscalar : scalarCaptures facts captured = true)
+      (hrest : codeUsesVar rest 1 = false)
+      (hlowered : lowerAtoms? supplied = some lowered)
+      (hover : declArity declaration <
+        (captured.toList ++ lowered.toList).length) :
+      FuseSpec declarations facts function captured supplied rest
+        ⟨.letOp
+          (.call function
+            ((captured.toList ++ lowered.toList).take
+              (declArity declaration)).toArray)
+          (.letOp
+            (.apply (.var 0)
+              (supplied.toList.drop
+                (declArity declaration - captured.size)).toArray)
+            rest), .over⟩
+
+theorem fuseSpec_of_fusePair?_eq_some
+    {declarations : DeclEnv} {facts : List Fact} {function : Address}
+    {captured supplied : Array Atom} {rest : Code} {fusion : Fusion}
+    (hfusion : fusePair? declarations facts function captured supplied rest =
+      some fusion) :
+    FuseSpec declarations facts function captured supplied rest fusion := by
+  cases hdeclaration : declarations function with
+  | none => simp [fusePair?, hdeclaration] at hfusion
+  | some declaration =>
+      by_cases hcapture : captured.size >= declArity declaration
+      · simp [fusePair?, hdeclaration, hcapture] at hfusion
+      · have hcapture' : captured.size < declArity declaration := by omega
+        by_cases hscalar : scalarCaptures facts captured = true
+        · by_cases hrest : codeUsesVar rest 1 = false
+          · cases hlowered : lowerAtoms? supplied with
+            | none =>
+                simp [fusePair?, hdeclaration, hcapture, hscalar, hrest,
+                  hlowered] at hfusion
+            | some lowered =>
+                by_cases hunder :
+                    (captured.toList ++ lowered.toList).length <
+                      declArity declaration
+                · have heq :
+                      (⟨.letOp
+                          (.papp function
+                            (captured.toList ++ lowered.toList).toArray)
+                          (.letOp (.pure (.var 0)) rest), .under⟩ : Fusion) =
+                        fusion := by
+                      have hunderSize :
+                          captured.size + lowered.size <
+                            declArity declaration := by simpa using hunder
+                      simpa [fusePair?, hdeclaration, hcapture, hscalar,
+                        hrest, hlowered, hunderSize] using hfusion
+                  subst fusion
+                  exact .under hdeclaration hcapture' hscalar hrest hlowered
+                    hunder
+                · by_cases hexact :
+                    (captured.toList ++ lowered.toList).length =
+                      declArity declaration
+                  · have heq :
+                        (⟨.letOp
+                            (.call function
+                              (captured.toList ++ lowered.toList).toArray)
+                            (.letOp (.pure (.var 0)) rest), .exact⟩ : Fusion) =
+                          fusion := by
+                        have hnotUnderSize :
+                            ¬ captured.size + lowered.size <
+                              declArity declaration := by simpa using hunder
+                        have hexactSize : captured.size + lowered.size =
+                            declArity declaration := by simpa using hexact
+                        simpa [fusePair?, hdeclaration, hcapture, hscalar,
+                          hrest, hlowered, hnotUnderSize, hexactSize] using
+                            hfusion
+                    subst fusion
+                    exact .exact hdeclaration hcapture' hscalar hrest hlowered
+                      hexact
+                  · have hover : declArity declaration <
+                        (captured.toList ++ lowered.toList).length := by omega
+                    have heq :
+                        (⟨.letOp
+                            (.call function
+                              ((captured.toList ++ lowered.toList).take
+                                (declArity declaration)).toArray)
+                            (.letOp
+                              (.apply (.var 0)
+                                (supplied.toList.drop
+                                  (declArity declaration - captured.size)).toArray)
+                              rest), .over⟩ : Fusion) = fusion := by
+                        have hnotUnderSize :
+                            ¬ captured.size + lowered.size <
+                              declArity declaration := by simpa using hunder
+                        have hnotExactSize :
+                            captured.size + lowered.size ≠
+                              declArity declaration := by simpa using hexact
+                        simpa [fusePair?, hdeclaration, hcapture, hscalar,
+                          hrest, hlowered, hnotUnderSize, hnotExactSize] using
+                            hfusion
+                    subst fusion
+                    exact .over hdeclaration hcapture' hscalar hrest hlowered
+                      hover
+          · simp [fusePair?, hdeclaration, hcapture, hscalar, hrest] at hfusion
+        · simp [fusePair?, hdeclaration, hcapture, hscalar] at hfusion
+
+structure Changes where
+  fusedPaps : Nat := 0
+  underSaturated : Nat := 0
+  exactlySaturated : Nat := 0
+  overSaturated : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+def Changes.add (left right : Changes) : Changes :=
+  { fusedPaps := left.fusedPaps + right.fusedPaps
+    underSaturated := left.underSaturated + right.underSaturated
+    exactlySaturated := left.exactlySaturated + right.exactlySaturated
+    overSaturated := left.overSaturated + right.overSaturated }
+
+def Changes.ofKind : Kind → Changes
+  | .under => { fusedPaps := 1, underSaturated := 1 }
+  | .exact => { fusedPaps := 1, exactlySaturated := 1 }
+  | .over => { fusedPaps := 1, overSaturated := 1 }
+
+structure Outcome where
+  code : Code
+  changes : Changes := {}
+
+structure AlternativeOutcome where
+  alternative : Alt
+  changes : Changes := {}
+
+mutual
+
+/-- Mirror HPT transfer while fusing checked adjacent allocation sites.
+Transfer failure is fail-soft for the affected subtree. -/
+def runWithFacts (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) (facts : List Fact) :
+    Code → Outcome
+  | input@(.ret _) => ⟨input, {}⟩
+  | input@(.letOp (.papp function captured)
+      (.letOp (.apply (.var 0) supplied) rest)) =>
+      let pap := Op.papp function captured
+      let apply := Op.apply (.var 0) supplied
+      match analyzeOp declarations summaries owner current facts pap with
+      | .error _ => ⟨input, {}⟩
+      | .ok papFact =>
+          let afterPap := papFact :: facts.map Fact.forgetHeap
+          match analyzeOp declarations summaries owner current afterPap apply with
+          | .error _ => ⟨input, {}⟩
+          | .ok resultFact =>
+              let afterApply := resultFact :: afterPap.map Fact.forgetHeap
+              let nested := runWithFacts declarations summaries owner current
+                afterApply rest
+              match fusePair? declarations facts function captured supplied
+                  nested.code with
+              | some fusion =>
+                  ⟨fusion.code, nested.changes.add (.ofKind fusion.kind)⟩
+              | none =>
+                  ⟨.letOp pap (.letOp apply nested.code), nested.changes⟩
+  | input@(.letOp operation rest) =>
+      match analyzeOp declarations summaries owner current facts operation with
+      | .error _ => ⟨input, {}⟩
+      | .ok bound =>
+          let nested := runWithFacts declarations summaries owner current
+            (bound :: facts.map Fact.forgetHeap) rest
+          ⟨.letOp operation nested.code, nested.changes⟩
+  | input@(.case scrutinee peelNat alternatives) =>
+      match resolveAtomFact facts scrutinee with
+      | .error _ => ⟨input, {}⟩
+      | .ok fact =>
+          let nested := alternatives.map
+            (runAlternativeWithFacts declarations summaries owner current
+              fact peelNat facts)
+          ⟨.case scrutinee peelNat
+              (nested.map fun result => result.alternative),
+            nested.foldl
+              (fun total result => total.add result.changes) {}⟩
+
+def runAlternativeWithFacts (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact) :
+    Alt → AlternativeOutcome
+  | .mk cidx fields body =>
+      let nested := runWithFacts declarations summaries owner current
+        (scrutineeFact.caseFields peelNat cidx fields ++ facts) body
+      ⟨.mk cidx fields nested.code, nested.changes⟩
+
+end
+
+def runFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) : Outcome :=
+  runWithFacts declarations summaries owner current
+    (List.replicate current.arity Fact.top) current.body
+
+def rewriteFunction (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) : FnDef :=
+  { current with body := (runFunction declarations summaries owner current).code }
+
+def rewriteDeclaration (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) : Decl → Decl
+  | .fn function => .fn (rewriteFunction declarations summaries owner function)
+  | declaration@(.extern _) => declaration
+
+@[simp] private theorem runAlternativeWithFacts_cidx
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternative : Alt) :
+    (runAlternativeWithFacts declarations summaries owner current
+      scrutineeFact peelNat facts alternative).alternative.cidx =
+        alternative.cidx := by
+  cases alternative
+  simp [runAlternativeWithFacts, Alt.cidx]
+
+private theorem runAlternativeWithFacts_predicate
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (index : Nat) :
+    ((fun alternative : Alt => alternative.cidx == index) ∘
+        (fun result : AlternativeOutcome => result.alternative) ∘
+        runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts) =
+      (fun alternative => alternative.cidx == index) := by
+  funext alternative
+  cases alternative
+  simp [Function.comp_def, runAlternativeWithFacts, Alt.cidx]
+
+private theorem find?_runAlternativeWithFacts
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef)
+    (scrutineeFact : Fact) (peelNat : Bool) (facts : List Fact)
+    (alternatives : Array Alt) (index : Nat) :
+    ((alternatives.map
+        (runAlternativeWithFacts declarations summaries owner current
+          scrutineeFact peelNat facts)).map
+        (fun result => result.alternative)).find?
+          (fun alternative => alternative.cidx == index) =
+      (alternatives.find? (fun alternative => alternative.cidx == index)).map
+        (fun alternative =>
+          (runAlternativeWithFacts declarations summaries owner current
+            scrutineeFact peelNat facts alternative).alternative) := by
+  rw [Array.map_map, Array.find?_map,
+    runAlternativeWithFacts_predicate declarations summaries owner current
+      scrutineeFact peelNat facts index]
+  simp [Function.comp_def]
+
+@[simp] theorem declArity_rewriteDeclaration
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (declaration : Decl) :
+    declArity (rewriteDeclaration declarations summaries owner declaration) =
+      declArity declaration := by
+  cases declaration <;> rfl
+
+/-! ## Checker facts used by the semantic layer -/
+
+theorem scalar_of_scalarOnly_holds
+    {declarations : DeclEnv} {store : Store} {fact : Fact} {value : RVal}
+    (honly : scalarOnly fact = true)
+    (hholds : fact.Holds declarations store value) :
+    value.isScalar = true := by
+  unfold scalarOnly at honly
+  simp only [Bool.and_eq_true] at honly
+  cases value with
+  | lit literal => rfl
+  | erased => rfl
+  | loc location =>
+      simp only [Fact.Holds] at hholds
+      rcases hholds with hunknown | ⟨shape, hmember, _⟩
+      · have hfalse : fact.unknownHeap = false := by
+          simpa using honly.1
+        rw [hfalse] at hunknown
+        contradiction
+      · have hempty : fact.shapes = [] := List.isEmpty_iff.mp honly.2
+        rw [hempty] at hmember
+        contradiction
+
+private theorem environment_allScalar_of_all_scalarOnly
+    {declarations : DeclEnv} {store : Store} :
+    ∀ {facts : List Fact} {values : List RVal},
+      EnvironmentHolds declarations store facts values →
+      facts.all scalarOnly = true → values.all RVal.isScalar = true
+  | [], [], .nil, _ => rfl
+  | fact :: facts, value :: values, .cons hhead htail, hall => by
+      simp only [List.all_cons, Bool.and_eq_true] at hall ⊢
+      exact ⟨scalar_of_scalarOnly_holds hall.1 hhead,
+        environment_allScalar_of_all_scalarOnly htail hall.2⟩
+
+private theorem allScalar_of_scalarCaptures
+    {declarations : DeclEnv} {store : Store} {facts : List Fact}
+    {environment : List RVal} {captured : Array Atom}
+    {values : List RVal}
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hcheck : scalarCaptures facts captured = true)
+    (hresolve : resolveAtoms environment captured = .ok values) :
+    values.all RVal.isScalar = true := by
+  unfold scalarCaptures at hcheck
+  cases habstract : resolveAtomFacts facts captured with
+  | error error => simp [habstract] at hcheck
+  | ok captureFacts =>
+      simp only [habstract] at hcheck
+      have hholds := resolveAtomFacts_sound henvironment habstract hresolve
+      exact environment_allScalar_of_all_scalarOnly hholds hcheck
+
+private theorem continue_historyIso {ctx : Ctx} {fuel : Nat}
+    {current : FnDef} {left right : Store}
+    (heap : HeapHistoryIso left right)
+    {leftValue rightValue retired alias : RVal}
+    {leftEnvironment rightEnvironment : List RVal}
+    (hvalue : RValIso heap.locRel leftValue rightValue)
+    (henvironment : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    {rest : Code} (hrest : CodeNoUse 1 rest)
+    {leftOut : Store × RVal}
+    (hrun : runCode ctx fuel current left
+      (leftValue :: retired :: leftEnvironment) rest = .ok leftOut) :
+    ∃ rightOut,
+      runCode ctx fuel current right
+          (rightValue :: alias :: rightEnvironment) rest = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  have hleftAgree := EnvsAgreeExcept.second leftValue retired .erased
+    leftEnvironment
+  have hleftScrubbed : runCode ctx fuel current left
+      (leftValue :: .erased :: leftEnvironment) rest = .ok leftOut := by
+    rw [← runCode_env_eq_of_noUse fuel current left 1
+      (leftValue :: retired :: leftEnvironment)
+      (leftValue :: .erased :: leftEnvironment) rest hleftAgree hrest]
+    exact hrun
+  have hscrubbedEnvironment : RValsIso heap.locRel
+      (leftValue :: .erased :: leftEnvironment)
+      (rightValue :: .erased :: rightEnvironment) :=
+    .cons hvalue (.cons .erased henvironment)
+  obtain ⟨rightOut, hrightScrubbed, hresult⟩ :=
+    runCode_historyIso heap hscrubbedEnvironment hleftScrubbed
+  have hrightAgree := EnvsAgreeExcept.second rightValue .erased alias
+    rightEnvironment
+  have hright : runCode ctx fuel current right
+      (rightValue :: alias :: rightEnvironment) rest = .ok rightOut := by
+    rw [← runCode_env_eq_of_noUse fuel current right 1
+      (rightValue :: .erased :: rightEnvironment)
+      (rightValue :: alias :: rightEnvironment) rest hrightAgree hrest]
+    exact hrightScrubbed
+  exact ⟨rightOut, hright, hresult⟩
+
+private theorem lowerAtom?_resolveAtom {head : RVal} {environment : List RVal}
+    {source target : Atom} {value : RVal}
+    (hlower : lowerAtom? source = some target)
+    (hresolve : resolveAtom (head :: environment) source = .ok value) :
+    resolveAtom environment target = .ok value := by
+  cases source with
+  | lit literal =>
+      simp only [lowerAtom?, Option.some.injEq] at hlower
+      subst target
+      simpa [resolveAtom] using hresolve
+  | erased =>
+      simp only [lowerAtom?, Option.some.injEq] at hlower
+      subst target
+      simpa [resolveAtom] using hresolve
+  | var index =>
+      cases index with
+      | zero => simp [lowerAtom?] at hlower
+      | succ index =>
+          simp only [lowerAtom?, Option.some.injEq] at hlower
+          subst target
+          simp only [resolveAtom] at hresolve ⊢
+          cases hget : environment[index]? with
+          | none => simp [hget] at hresolve
+          | some found => simpa [hget] using hresolve
+
+private theorem List.resolveLoweredFrom_eq (head : RVal)
+    (environment : List RVal) :
+    ∀ (source target : List Atom) (accumulator output : List RVal),
+      source.mapM lowerAtom? = some target →
+      source.foldlM
+          (fun values atom => do
+            pure (values ++ [← resolveAtom (head :: environment) atom]))
+          accumulator = .ok output →
+        target.foldlM
+          (fun values atom => do
+            pure (values ++ [← resolveAtom environment atom]))
+          accumulator = .ok output := by
+  intro source
+  induction source with
+  | nil =>
+      intro target accumulator output hlower hresolve
+      change some [] = some target at hlower
+      injection hlower with htarget
+      subst target
+      exact hresolve
+  | cons atom source ih =>
+      intro target accumulator output hlower hresolve
+      simp only [List.mapM_cons] at hlower
+      cases hatom : lowerAtom? atom with
+      | none => simp [hatom] at hlower
+      | some lowered =>
+          rw [hatom] at hlower
+          simp only [bind, Option.bind] at hlower
+          cases htail : source.mapM lowerAtom? with
+          | none => simp [htail] at hlower
+          | some loweredTail =>
+              rw [htail] at hlower
+              change some (lowered :: loweredTail) = some target at hlower
+              injection hlower with htarget
+              subst target
+              simp only [List.foldlM_cons] at hresolve ⊢
+              cases hsource : resolveAtom (head :: environment) atom with
+              | error error =>
+                  rw [hsource] at hresolve
+                  simp only [bind, Except.bind] at hresolve
+                  contradiction
+              | ok value =>
+                  rw [hsource] at hresolve
+                  simp only [bind, Except.bind] at hresolve
+                  have htargetResolve := lowerAtom?_resolveAtom hatom hsource
+                  rw [htargetResolve]
+                  simp only [bind, Except.bind]
+                  exact ih loweredTail (accumulator ++ [value]) output htail
+                    hresolve
+
+theorem lowerAtoms?_resolveAtoms {head : RVal} {environment : List RVal}
+    {source target : Array Atom} {values : List RVal}
+    (hlower : lowerAtoms? source = some target)
+    (hresolve : resolveAtoms (head :: environment) source = .ok values) :
+    resolveAtoms environment target = .ok values := by
+  unfold lowerAtoms? at hlower
+  cases hmap : source.toList.mapM lowerAtom? with
+  | none => simp [hmap] at hlower
+  | some lowered =>
+      simp only [hmap, Option.map_some, Option.some.injEq] at hlower
+      subst target
+      unfold resolveAtoms at hresolve ⊢
+      rw [← Array.foldlM_toList] at hresolve
+      rw [← Array.foldlM_toList]
+      simp only
+      exact List.resolveLoweredFrom_eq head environment source.toList lowered
+        [] values hmap hresolve
+
+private theorem lowerAtom?_notUseZero {source target : Atom}
+    (hlower : lowerAtom? source = some target) :
+    atomUsesVar 0 source = false := by
+  cases source with
+  | lit literal => rfl
+  | erased => rfl
+  | var index =>
+      cases index with
+      | zero => simp [lowerAtom?] at hlower
+      | succ index => simp [atomUsesVar]
+
+private theorem List.all_notUseZero_of_mapM_lower :
+    ∀ {source target : List Atom}, source.mapM lowerAtom? = some target →
+      source.all (fun atom => !atomUsesVar 0 atom) = true := by
+  intro source
+  induction source with
+  | nil => intro target hlower; rfl
+  | cons atom source ih =>
+      intro target hlower
+      simp only [List.mapM_cons] at hlower
+      cases hatom : lowerAtom? atom with
+      | none => simp [hatom] at hlower
+      | some lowered =>
+          rw [hatom] at hlower
+          simp only [bind, Option.bind] at hlower
+          cases htail : source.mapM lowerAtom? with
+          | none => simp [htail] at hlower
+          | some loweredTail =>
+              have hhead := lowerAtom?_notUseZero hatom
+              simp only [List.all_cons, Bool.and_eq_true]
+              exact ⟨by simp [hhead], ih htail⟩
+
+theorem lowerAtoms?_notUseZero {source target : Array Atom}
+    (hlower : lowerAtoms? source = some target) :
+    atomsUseVar 0 source = false := by
+  unfold lowerAtoms? at hlower
+  cases hmap : source.toList.mapM lowerAtom? with
+  | none => simp [hmap] at hlower
+  | some lowered =>
+      have hall := List.all_notUseZero_of_mapM_lower hmap
+      unfold atomsUseVar
+      rw [Array.any_eq_false']
+      intro atom hatom huses
+      have hnot := List.all_eq_true.mp hall atom (by simpa using hatom)
+      simp [huses] at hnot
+
+private def resolveStep (environment : List RVal)
+    (values : List RVal) (atom : Atom) : Except Err (List RVal) := do
+  pure (values ++ [← resolveAtom environment atom])
+
+private inductive AtomsResolve (environment : List RVal) :
+    List Atom → List RVal → Prop where
+  | nil : AtomsResolve environment [] []
+  | cons (hhead : resolveAtom environment atom = .ok value)
+      (htail : AtomsResolve environment atoms values) :
+      AtomsResolve environment (atom :: atoms) (value :: values)
+
+namespace AtomsResolve
+
+private theorem foldlM {environment : List RVal} :
+    ∀ {atoms values}, AtomsResolve environment atoms values →
+      ∀ accumulator,
+        atoms.foldlM (resolveStep environment) accumulator =
+          .ok (accumulator ++ values)
+  | [], [], .nil, accumulator => by
+      simp only [List.foldlM_nil, pure, Except.pure, List.append_nil]
+  | atom :: atoms, value :: values, .cons hhead htail, accumulator => by
+      have hstep : resolveStep environment accumulator atom =
+          .ok (accumulator ++ [value]) := by
+        simp [resolveStep, hhead, bind, Except.bind, pure, Except.pure]
+      rw [List.foldlM_cons, hstep]
+      simp only [bind, Except.bind]
+      rw [htail.foldlM (accumulator ++ [value])]
+      simp [List.append_assoc]
+
+private theorem ofFoldlM {environment : List RVal} :
+  ∀ atoms accumulator output,
+      atoms.foldlM (resolveStep environment) accumulator = .ok output →
+      ∃ values, AtomsResolve environment atoms values ∧
+        output = accumulator ++ values := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro accumulator output hrun
+      simp only [List.foldlM_nil, pure, Except.pure] at hrun
+      injection hrun with houtput
+      subst output
+      exact ⟨[], .nil, by simp⟩
+  | cons atom atoms ih =>
+      intro accumulator output hrun
+      simp only [List.foldlM_cons] at hrun
+      cases hhead : resolveAtom environment atom with
+      | error error =>
+          have hstep : resolveStep environment accumulator atom =
+              .error error := by
+            simp [resolveStep, hhead, bind, Except.bind]
+          rw [hstep] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok value =>
+          have hstep : resolveStep environment accumulator atom =
+              .ok (accumulator ++ [value]) := by
+            simp [resolveStep, hhead, bind, Except.bind, pure, Except.pure]
+          rw [hstep] at hrun
+          simp only [bind, Except.bind] at hrun
+          obtain ⟨values, hvalues, houtput⟩ :=
+            ih (accumulator ++ [value]) output hrun
+          refine ⟨value :: values, .cons hhead hvalues, ?_⟩
+          rw [houtput]
+          simp [List.append_assoc]
+
+theorem length {environment : List RVal} {atoms : List Atom}
+    {values : List RVal} (h : AtomsResolve environment atoms values) :
+    values.length = atoms.length := by
+  induction h <;> simp_all
+
+theorem append {environment : List RVal}
+    {leftAtoms rightAtoms : List Atom} {leftValues rightValues : List RVal}
+    (left : AtomsResolve environment leftAtoms leftValues)
+    (right : AtomsResolve environment rightAtoms rightValues) :
+    AtomsResolve environment (leftAtoms ++ rightAtoms)
+      (leftValues ++ rightValues) := by
+  induction left with
+  | nil => exact right
+  | cons hhead htail ih => exact .cons hhead ih
+
+theorem take {environment : List RVal} {atoms : List Atom}
+    {values : List RVal} (h : AtomsResolve environment atoms values)
+    (count : Nat) :
+    AtomsResolve environment (atoms.take count) (values.take count) := by
+  induction h generalizing count with
+  | nil => simpa using (AtomsResolve.nil (environment := environment))
+  | cons hhead htail ih =>
+      cases count with
+      | zero => exact .nil
+      | succ count => exact .cons hhead (ih count)
+
+theorem drop {environment : List RVal} {atoms : List Atom}
+    {values : List RVal} (h : AtomsResolve environment atoms values)
+    (count : Nat) :
+    AtomsResolve environment (atoms.drop count) (values.drop count) := by
+  induction h generalizing count with
+  | nil => simpa using (AtomsResolve.nil (environment := environment))
+  | cons hhead htail ih =>
+      cases count with
+      | zero => exact .cons hhead htail
+      | succ count => exact ih count
+
+end AtomsResolve
+
+private theorem atomsResolve_of_resolveAtoms {environment : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (hrun : resolveAtoms environment atoms = .ok values) :
+    AtomsResolve environment atoms.toList values := by
+  unfold resolveAtoms at hrun
+  rw [← Array.foldlM_toList] at hrun
+  change atoms.toList.foldlM (resolveStep environment) [] =
+    .ok values at hrun
+  obtain ⟨found, hfound, hvalues⟩ :=
+    AtomsResolve.ofFoldlM atoms.toList [] values hrun
+  simp only [List.nil_append] at hvalues
+  subst found
+  exact hfound
+
+private theorem resolveAtoms_of_atomsResolve {environment : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (h : AtomsResolve environment atoms.toList values) :
+    resolveAtoms environment atoms = .ok values := by
+  unfold resolveAtoms
+  rw [← Array.foldlM_toList]
+  change atoms.toList.foldlM (resolveStep environment) [] = .ok values
+  simpa using h.foldlM []
+
+private theorem resolveAtoms_length {environment : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (hrun : resolveAtoms environment atoms = .ok values) :
+    values.length = atoms.size := by
+  simpa using (atomsResolve_of_resolveAtoms hrun).length
+
+private theorem resolveAtoms_take {environment : List RVal}
+    {atoms : List Atom} {values : List RVal}
+    (hrun : resolveAtoms environment atoms.toArray = .ok values)
+    (count : Nat) :
+    resolveAtoms environment (atoms.take count).toArray =
+      .ok (values.take count) := by
+  apply resolveAtoms_of_atomsResolve
+  simpa using (atomsResolve_of_resolveAtoms hrun).take count
+
+private theorem resolveAtoms_drop {environment : List RVal}
+    {atoms : List Atom} {values : List RVal}
+    (hrun : resolveAtoms environment atoms.toArray = .ok values)
+    (count : Nat) :
+    resolveAtoms environment (atoms.drop count).toArray =
+      .ok (values.drop count) := by
+  apply resolveAtoms_of_atomsResolve
+  simpa using (atomsResolve_of_resolveAtoms hrun).drop count
+
+private theorem resolveAtoms_append {environment : List RVal}
+    {left right : List Atom} {leftValues rightValues : List RVal}
+    (hleft : resolveAtoms environment left.toArray = .ok leftValues)
+    (hright : resolveAtoms environment right.toArray = .ok rightValues) :
+    resolveAtoms environment (left ++ right).toArray =
+      .ok (leftValues ++ rightValues) := by
+  apply resolveAtoms_of_atomsResolve
+  simpa using (atomsResolve_of_resolveAtoms hleft).append
+    (atomsResolve_of_resolveAtoms hright)
+
+private theorem resolveAtom_selfIso {rel : Nat → Nat → Prop}
+    {environment : List RVal} (henvironment : RValsIso rel environment environment)
+    {atom : Atom} {value : RVal}
+    (hresolve : resolveAtom environment atom = .ok value) :
+    RValIso rel value value := by
+  cases atom with
+  | lit literal =>
+      simp only [resolveAtom, Except.ok.injEq] at hresolve
+      subst value
+      exact .lit
+  | erased =>
+      simp only [resolveAtom, Except.ok.injEq] at hresolve
+      subst value
+      exact .erased
+  | var index =>
+      simp only [resolveAtom] at hresolve
+      cases hget : environment[index]? with
+      | none => simp [hget] at hresolve
+      | some found =>
+          simp only [hget, Except.ok.injEq] at hresolve
+          subst value
+          obtain ⟨other, hother, hiso⟩ := henvironment.get? hget
+          have hsame : other = found := Option.some.inj (hother.symm.trans hget)
+          subst other
+          exact hiso
+
+private theorem AtomsResolve.selfIso {rel : Nat → Nat → Prop}
+    {environment : List RVal} (henvironment : RValsIso rel environment environment) :
+    ∀ {atoms values}, AtomsResolve environment atoms values →
+      RValsIso rel values values
+  | [], [], .nil => .nil
+  | _ :: _, _ :: _, .cons hhead htail =>
+      .cons (resolveAtom_selfIso henvironment hhead)
+        (selfIso henvironment htail)
+
+private theorem runHistoryIso_weaken
+    {earlierLeft earlierRight left right : Store}
+    {earlier : HeapHistoryIso earlierLeft earlierRight}
+    {before : HeapHistoryIso left right}
+    (hearlier : earlier.Extends before)
+    {leftOut rightOut : Store × RVal}
+    (hrun : RunHistoryIso before leftOut rightOut) :
+    RunHistoryIso earlier leftOut rightOut := by
+  obtain ⟨heap, hextends, hvalue⟩ := hrun
+  exact ⟨heap, hearlier.trans hextends, hvalue⟩
+
+private structure PairRunAt (ctx : Ctx) (fuel : Nat) (current : FnDef)
+    (store : Store) (environment : List RVal) (function : Address)
+    (declaration : Decl) (captured supplied : Array Atom) (rest : Code)
+    (out : Store × RVal) where
+  capturedValues : List RVal
+  suppliedValues : List RVal
+  resultStore : Store
+  resultValue : RVal
+  capturedResolve : resolveAtoms environment captured = .ok capturedValues
+  suppliedResolve :
+    let allocated := store.allocNode .shared
+      (.papN function (declArity declaration) capturedValues.toArray)
+    resolveAtoms (.loc allocated.2 :: environment) supplied =
+      .ok suppliedValues
+  applyRun :
+    let allocated := store.allocNode .shared
+      (.papN function (declArity declaration) capturedValues.toArray)
+    applyGo ctx (fuel + 1) allocated.1 (.loc allocated.2) suppliedValues =
+      .ok (resultStore, resultValue)
+  restRun :
+    let allocated := store.allocNode .shared
+      (.papN function (declArity declaration) capturedValues.toArray)
+    runCode ctx (fuel + 2) current resultStore
+      (resultValue :: .loc allocated.2 :: environment) rest = .ok out
+
+private def pairRunAt_of_run
+    {ctx : Ctx} {fuel : Nat} {current : FnDef} {store : Store}
+    {environment : List RVal} {function : Address}
+    {captured supplied : Array Atom} {rest : Code}
+    {declaration : Decl} {out : Store × RVal}
+    (hdeclaration : ctx.decls function = some declaration)
+    (hcapture : captured.size < declArity declaration)
+    (hrun : runCode ctx (fuel + 4) current store environment
+      (.letOp (.papp function captured)
+        (.letOp (.apply (.var 0) supplied) rest)) = .ok out) :
+    PairRunAt ctx fuel current store environment function declaration captured
+      supplied rest out := by
+  rw [runCode.eq_def] at hrun
+  dsimp only at hrun
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  cases hcaptured : resolveAtoms environment captured with
+  | error error =>
+      rw [hcaptured] at hrun
+      simp only [bind, Except.bind] at hrun
+      contradiction
+  | ok capturedValues =>
+      rw [hcaptured] at hrun
+      simp only [bind, Except.bind] at hrun
+      rw [hdeclaration] at hrun
+      have hcapturedLength := resolveAtoms_length hcaptured
+      have hproper : capturedValues.length < declArity declaration := by
+        omega
+      simp only [hproper, if_true, bind, Except.bind] at hrun
+      rw [runCode.eq_def] at hrun
+      dsimp only at hrun
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      simp only [resolveAtom, List.getElem?_cons_zero, bind, Except.bind] at hrun
+      let allocated := store.allocNode .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      cases hsupplied : resolveAtoms (.loc allocated.2 :: environment) supplied with
+      | error error =>
+          rw [hsupplied] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | ok suppliedValues =>
+          rw [hsupplied] at hrun
+          simp only [bind, Except.bind] at hrun
+          cases happly : applyGo ctx (fuel + 1) allocated.1
+              (.loc allocated.2) suppliedValues with
+          | error error =>
+              rw [happly] at hrun
+              simp only [bind, Except.bind] at hrun
+              contradiction
+          | ok result =>
+              rcases result with ⟨resultStore, resultValue⟩
+              rw [happly] at hrun
+              simp only [bind, Except.bind] at hrun
+              refine
+                { capturedValues := capturedValues
+                  suppliedValues := suppliedValues
+                  resultStore := resultStore
+                  resultValue := resultValue
+                  capturedResolve := hcaptured
+                  suppliedResolve := ?_
+                  applyRun := ?_
+                  restRun := ?_ }
+              · simpa [allocated] using hsupplied
+              · simpa [allocated] using happly
+              · simpa [allocated] using hrun
+
+private theorem dupVals_eq_of_all_scalar {store : Store} :
+    ∀ {values : List RVal}, values.all RVal.isScalar = true →
+      dupVals store values = .ok store
+  | [], _ => rfl
+  | value :: values, hscalar => by
+      simp only [List.all_cons, Bool.and_eq_true] at hscalar
+      cases value with
+      | loc location => simp [RVal.isScalar] at hscalar
+      | lit literal =>
+          simp only [dupVals, List.foldlM_cons]
+          exact dupVals_eq_of_all_scalar hscalar.2
+      | erased =>
+          simp only [dupVals, List.foldlM_cons]
+          exact dupVals_eq_of_all_scalar hscalar.2
+
+private theorem dropMany_eq_of_all_scalar {ctx : Ctx} :
+    ∀ fuel store values out,
+      values.all RVal.isScalar = true →
+      dropMany ctx fuel store values = .ok out → out = store := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro store values out hscalar hrun
+      simp [dropMany] at hrun
+  | succ fuel smaller =>
+      intro store values out hscalar hrun
+      cases values with
+      | nil =>
+          simp only [dropMany, Except.ok.injEq] at hrun
+          exact hrun.symm
+      | cons value values =>
+          simp only [List.all_cons, Bool.and_eq_true] at hscalar
+          cases value with
+          | loc location => simp [RVal.isScalar] at hscalar
+          | lit literal =>
+              cases fuel with
+              | zero =>
+                  simp only [dropMany, dropVal, bind, Except.bind] at hrun
+                  contradiction
+              | succ fuel =>
+                  simp only [dropMany, dropVal, bind, Except.bind] at hrun
+                  exact smaller store values out hscalar.2 hrun
+          | erased =>
+              cases fuel with
+              | zero =>
+                  simp only [dropMany, dropVal, bind, Except.bind] at hrun
+                  contradiction
+              | succ fuel =>
+                  simp only [dropMany, dropVal, bind, Except.bind] at hrun
+                  exact smaller store values out hscalar.2 hrun
+
+private theorem dropFreshPap_nodes {ctx : Ctx} {fuel : Nat} {store out : Store}
+    {function : Address} {arity : Nat} {arguments : List RVal}
+    (hscalar : arguments.all RVal.isScalar = true)
+    (hrun :
+      let allocated := store.allocNode .shared
+        (.papN function arity arguments.toArray)
+      dropVal ctx fuel allocated.1 (.loc allocated.2) = .ok out) :
+    out.nodes =
+      (let allocated := store.allocNode .shared
+        (.papN function arity arguments.toArray)
+       allocated.1.kill allocated.2).nodes := by
+  cases fuel with
+  | zero => simp [dropVal] at hrun
+  | succ fuel =>
+      simp only [dropVal] at hrun
+      simp [Store.allocNode, Store.get?] at hrun
+      have hout := dropMany_eq_of_all_scalar fuel
+        ((store.allocNode .shared
+          (.papN function arity arguments.toArray)).1.rcTick.kill
+            (store.allocNode .shared
+              (.papN function arity arguments.toArray)).2)
+        arguments out hscalar hrun
+      subst out
+      rfl
+
+private structure FreshApplyReady (ctx : Ctx) (fuel : Nat)
+    (store : Store) (function : Address) (arity : Nat)
+    (capturedValues suppliedValues : List RVal)
+    (out : Store × RVal) where
+  ready : Store
+  dropRun :
+    let allocated := store.allocNode .shared
+      (.papN function arity capturedValues.toArray)
+    dropVal ctx fuel allocated.1 (.loc allocated.2) = .ok ready
+  readyNodes :
+    let allocated := store.allocNode .shared
+      (.papN function arity capturedValues.toArray)
+    ready.nodes = (allocated.1.kill allocated.2).nodes
+  remainderRun :
+    (let total := capturedValues ++ suppliedValues
+     if total.length < arity then
+       let (next, location) := ready.allocNode .shared
+         (.papN function arity total.toArray)
+       Except.ok (next, .loc location)
+     else if total.length == arity then
+       match ctx.decls function with
+       | none => Except.error (Err.unknownRef function)
+       | some declaration =>
+         if declPapSafe declaration then
+           invoke ctx fuel function total ready
+         else Except.error (.stuck "shared pap targets a non-pap-safe declaration")
+     else
+       match ctx.decls function with
+       | none => Except.error (Err.unknownRef function)
+       | some declaration =>
+         if declPapSafe declaration then do
+           let (called, value) ← invoke ctx fuel function (total.take arity) ready
+           applyGo ctx fuel called value (total.drop arity)
+         else Except.error (.stuck "shared pap targets a non-pap-safe declaration")) =
+      Except.ok out
+
+private def freshApplyReady_of_run
+    {ctx : Ctx} {fuel : Nat} {store : Store} {function : Address}
+    {arity : Nat} {capturedValues suppliedValues : List RVal}
+    {out : Store × RVal}
+    (hscalar : capturedValues.all RVal.isScalar = true)
+    (hrun :
+      let allocated := store.allocNode .shared
+        (.papN function arity capturedValues.toArray)
+      applyGo ctx (fuel + 1) allocated.1 (.loc allocated.2) suppliedValues =
+        .ok out) :
+    FreshApplyReady ctx fuel store function arity capturedValues suppliedValues
+      out := by
+  let allocated := store.allocNode .shared
+    (.papN function arity capturedValues.toArray)
+  change applyGo ctx (fuel + 1) allocated.1 (.loc allocated.2)
+    suppliedValues = .ok out at hrun
+  rw [applyGo.eq_def] at hrun
+  dsimp only at hrun
+  have hget : allocated.1.get? allocated.2 =
+      some ⟨.shared, 1, .papN function arity capturedValues.toArray⟩ := by
+    simp [allocated, Store.allocNode, Store.get?]
+  rw [hget] at hrun
+  dsimp only at hrun
+  rw [dupVals_eq_of_all_scalar hscalar] at hrun
+  simp only [bind, Except.bind] at hrun
+  cases hdrop : dropVal ctx fuel allocated.1 (.loc allocated.2) with
+  | error error =>
+      rw [hdrop] at hrun
+      simp only [bind, Except.bind] at hrun
+      contradiction
+  | ok ready =>
+      rw [hdrop] at hrun
+      simp only [bind, Except.bind] at hrun
+      exact
+        { ready := ready
+          dropRun := by simpa [allocated] using hdrop
+          readyNodes := by
+            exact dropFreshPap_nodes hscalar (by simpa [allocated] using hdrop)
+          remainderRun := hrun }
+
+private theorem List.drop_append_after_prefix :
+    ∀ (front suffix : List α) (count : Nat), front.length ≤ count →
+      (front ++ suffix).drop count = suffix.drop (count - front.length) := by
+  intro front
+  induction front with
+  | nil => intro suffix count hle; simp
+  | cons head tail ih =>
+      intro suffix count hle
+      cases count with
+      | zero => simp at hle
+      | succ count =>
+          have htail : tail.length ≤ count := by
+            simpa using hle
+          simp only [List.cons_append, List.drop_succ_cons, List.length_cons,
+            Nat.succ_sub_succ_eq_sub]
+          exact ih suffix count htail
+
+/-! ## Local semantic refinement
+
+The source and replacement use the same outer fuel.  The source's retired
+PAP allocation is omitted from the right-hand heap history; subsequent
+allocations and calls are related by the evaluator congruence theorem. -/
+
+private theorem fuseSpec_refinesAt
+    {ctx : Ctx} {fuel : Nat} {current : FnDef} {store : Store}
+    {environment : List RVal} {declarations : DeclEnv} {facts : List Fact}
+    {function : Address} {captured supplied : Array Atom} {rest : Code}
+    {fusion : Fusion} {out : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (base : HeapHistoryIso store store)
+    (henvIso : RValsIso base.locRel environment environment)
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hspec : FuseSpec declarations facts function captured supplied rest
+      fusion)
+    (hrun : runCode ctx (fuel + 4) current store environment
+      (.letOp (.papp function captured)
+        (.letOp (.apply (.var 0) supplied) rest)) = .ok out) :
+    ∃ targetOut,
+      runCode ctx (fuel + 4) current store environment fusion.code =
+          .ok targetOut ∧
+        RunHistoryIso base out targetOut := by
+  cases hspec with
+  | @under declaration lowered hdeclaration hcaptureArity hscalar hrest
+      hlowered hunder =>
+      have hctxDeclaration : ctx.decls function = some declaration := by
+        simpa [hctx] using hdeclaration
+      obtain ⟨capturedValues, suppliedValues, resultStore, resultValue,
+          hcaptured, hsupplied, happly, hrestRun⟩ :=
+        pairRunAt_of_run hctxDeclaration hcaptureArity hrun
+      have hscalarValues :=
+        allScalar_of_scalarCaptures henvironment hscalar hcaptured
+      obtain ⟨ready, hdrop, hreadyNodes, hremainder⟩ :=
+        freshApplyReady_of_run hscalarValues happly
+      let allocated := store.allocNode .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      have hsupplied' : resolveAtoms (.loc allocated.2 :: environment)
+          supplied = .ok suppliedValues := by
+        simpa [allocated] using hsupplied
+      have hloweredResolve : resolveAtoms environment lowered =
+          .ok suppliedValues :=
+        lowerAtoms?_resolveAtoms hlowered hsupplied'
+      have hcombinedResolve :
+          resolveAtoms environment
+              (captured.toList ++ lowered.toList).toArray =
+            .ok (capturedValues ++ suppliedValues) := by
+        exact resolveAtoms_append (by simpa using hcaptured)
+          (by simpa using hloweredResolve)
+      have hcapturedLength : capturedValues.length = captured.size :=
+        resolveAtoms_length hcaptured
+      have hloweredLength : suppliedValues.length = lowered.size :=
+        resolveAtoms_length hloweredResolve
+      have htotalUnder :
+          (capturedValues ++ suppliedValues).length <
+            declArity declaration := by
+        simpa [List.length_append, hcapturedLength, hloweredLength] using hunder
+      have htotalUnder' : capturedValues.length + suppliedValues.length <
+          declArity declaration := by
+        simpa using htotalUnder
+      let sourceAllocated := ready.allocNode .shared
+        (.papN function (declArity declaration)
+          (capturedValues ++ suppliedValues).toArray)
+      have hremainder' :
+          (.ok (sourceAllocated.1, .loc sourceAllocated.2) :
+              Except Err (Store × RVal)) =
+            .ok (resultStore, resultValue) := by
+        simpa [sourceAllocated, htotalUnder'] using hremainder
+      have hresultPair :
+          (sourceAllocated.1, .loc sourceAllocated.2) =
+            (resultStore, resultValue) := Except.ok.inj hremainder'
+      have hresultStore : resultStore = sourceAllocated.1 := by
+        exact (congrArg Prod.fst hresultPair).symm
+      have hresultValue : resultValue = .loc sourceAllocated.2 := by
+        exact (congrArg Prod.snd hresultPair).symm
+      subst resultStore
+      subst resultValue
+      let omitted := base.omitDeadAllocLeft .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      let readyHeap : HeapHistoryIso ready store :=
+        omitted.nodesEq hreadyNodes rfl
+      have henvReady : RValsIso readyHeap.locRel environment environment := by
+        change RValsIso base.locRel environment environment
+        exact henvIso
+      have hcapturedIso : RValsIso readyHeap.locRel
+          capturedValues capturedValues := by
+        change RValsIso base.locRel capturedValues capturedValues
+        exact (atomsResolve_of_resolveAtoms hcaptured).selfIso henvIso
+      have hloweredIso : RValsIso readyHeap.locRel
+          suppliedValues suppliedValues := by
+        change RValsIso base.locRel suppliedValues suppliedValues
+        exact (atomsResolve_of_resolveAtoms hloweredResolve).selfIso henvIso
+      have htotalIso : RValsIso readyHeap.locRel
+          (capturedValues ++ suppliedValues)
+          (capturedValues ++ suppliedValues) :=
+        hcapturedIso.append hloweredIso
+      let targetAllocated := store.allocNode .shared
+        (.papN function (declArity declaration)
+          (capturedValues ++ suppliedValues).toArray)
+      let finalHeap : HeapHistoryIso sourceAllocated.1 targetAllocated.1 :=
+        readyHeap.alloc (.pap (by simpa using htotalIso))
+      have hvalueIso : RValIso finalHeap.locRel
+          (.loc sourceAllocated.2) (.loc targetAllocated.2) := by
+        exact .loc (.inl ⟨rfl, rfl⟩)
+      have henvFinal : RValsIso finalHeap.locRel
+          environment environment :=
+        henvReady.mono (fun h => .inr h)
+      obtain ⟨targetOut, htargetRest, hrestIso⟩ :=
+        continue_historyIso finalHeap hvalueIso henvFinal
+          (codeNoUse_of_codeUsesVar_eq_false hrest) hrestRun
+      have htargetOuter : runOp ctx (fuel + 3) current store environment
+          (.papp function
+            (captured.toList ++ lowered.toList).toArray) =
+          .ok (targetAllocated.1, .loc targetAllocated.2) := by
+        rw [runOp.eq_def]
+        dsimp only
+        rw [hcombinedResolve]
+        simp only [bind, Except.bind]
+        rw [hctxDeclaration]
+        simp only [htotalUnder, if_true]
+        rfl
+      have htargetInner : runOp ctx (fuel + 2) current targetAllocated.1
+          (.loc targetAllocated.2 :: environment) (.pure (.var 0)) =
+          .ok (targetAllocated.1, .loc targetAllocated.2) := by
+        rw [runOp.eq_def]
+        rfl
+      have htargetRun : runCode ctx (fuel + 4) current store environment
+          (.letOp
+            (.papp function
+              (captured.toList ++ lowered.toList).toArray)
+            (.letOp (.pure (.var 0)) rest)) = .ok targetOut := by
+        rw [runCode.eq_def]
+        dsimp only
+        rw [htargetOuter]
+        simp only [bind, Except.bind]
+        rw [runCode.eq_def]
+        dsimp only
+        rw [htargetInner]
+        simp only [bind, Except.bind]
+        exact htargetRest
+      refine ⟨targetOut, htargetRun, ?_⟩
+      change RunHistoryIso base out targetOut
+      apply runHistoryIso_weaken (earlier := base) (before := finalHeap)
+        (hrun := hrestIso)
+      intro left right hrel
+      exact .inr hrel
+  | @exact declaration lowered hdeclaration hcaptureArity hscalar hrest
+      hlowered hexact =>
+      have hctxDeclaration : ctx.decls function = some declaration := by
+        simpa [hctx] using hdeclaration
+      obtain ⟨capturedValues, suppliedValues, resultStore, resultValue,
+          hcaptured, hsupplied, happly, hrestRun⟩ :=
+        pairRunAt_of_run hctxDeclaration hcaptureArity hrun
+      have hscalarValues :=
+        allScalar_of_scalarCaptures henvironment hscalar hcaptured
+      obtain ⟨ready, hdrop, hreadyNodes, hremainder⟩ :=
+        freshApplyReady_of_run hscalarValues happly
+      let allocated := store.allocNode .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      have hsupplied' : resolveAtoms (.loc allocated.2 :: environment)
+          supplied = .ok suppliedValues := by
+        simpa [allocated] using hsupplied
+      have hloweredResolve : resolveAtoms environment lowered =
+          .ok suppliedValues :=
+        lowerAtoms?_resolveAtoms hlowered hsupplied'
+      have hcombinedResolve :
+          resolveAtoms environment
+              (captured.toList ++ lowered.toList).toArray =
+            .ok (capturedValues ++ suppliedValues) := by
+        exact resolveAtoms_append (by simpa using hcaptured)
+          (by simpa using hloweredResolve)
+      have hcapturedLength : capturedValues.length = captured.size :=
+        resolveAtoms_length hcaptured
+      have hloweredLength : suppliedValues.length = lowered.size :=
+        resolveAtoms_length hloweredResolve
+      have htotalExact :
+          (capturedValues ++ suppliedValues).length =
+            declArity declaration := by
+        simpa [List.length_append, hcapturedLength, hloweredLength] using hexact
+      have htotalExact' : capturedValues.length + suppliedValues.length =
+          declArity declaration := by
+        simpa using htotalExact
+      have hpapsafe : declPapSafe declaration = true := by
+        cases hpapsafe : declPapSafe declaration with
+        | false =>
+            simp [htotalExact', hctxDeclaration, hpapsafe] at hremainder
+        | true => rfl
+      have hremainder' : invoke ctx fuel function
+          (capturedValues ++ suppliedValues) ready =
+            .ok (resultStore, resultValue) := by
+        simpa [htotalExact', hctxDeclaration, hpapsafe] using hremainder
+      let omitted := base.omitDeadAllocLeft .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      let readyHeap : HeapHistoryIso ready store :=
+        omitted.nodesEq hreadyNodes rfl
+      have henvReady : RValsIso readyHeap.locRel environment environment := by
+        change RValsIso base.locRel environment environment
+        exact henvIso
+      have hcapturedIso : RValsIso readyHeap.locRel
+          capturedValues capturedValues := by
+        change RValsIso base.locRel capturedValues capturedValues
+        exact (atomsResolve_of_resolveAtoms hcaptured).selfIso henvIso
+      have hloweredIso : RValsIso readyHeap.locRel
+          suppliedValues suppliedValues := by
+        change RValsIso base.locRel suppliedValues suppliedValues
+        exact (atomsResolve_of_resolveAtoms hloweredResolve).selfIso henvIso
+      have htotalIso : RValsIso readyHeap.locRel
+          (capturedValues ++ suppliedValues)
+          (capturedValues ++ suppliedValues) :=
+        hcapturedIso.append hloweredIso
+      obtain ⟨targetCallOut, htargetInvokeAt, hcallIso⟩ :=
+        invoke_historyIso readyHeap htotalIso hremainder'
+      rcases targetCallOut with ⟨targetStore, targetValue⟩
+      obtain ⟨callHeap, hreadyCall, hvalueIso⟩ := hcallIso
+      have htargetInvoke : invoke ctx (fuel + 2) function
+          (capturedValues ++ suppliedValues) store =
+            .ok (targetStore, targetValue) :=
+        invoke_mono (by omega) htargetInvokeAt
+      have henvCall : RValsIso callHeap.locRel environment environment :=
+        hreadyCall.rvals henvReady
+      obtain ⟨targetOut, htargetRest, hrestIso⟩ :=
+        continue_historyIso callHeap hvalueIso henvCall
+          (codeNoUse_of_codeUsesVar_eq_false hrest) hrestRun
+      have htargetOuter : runOp ctx (fuel + 3) current store environment
+          (.call function
+            (captured.toList ++ lowered.toList).toArray) =
+          .ok (targetStore, targetValue) := by
+        rw [runOp.eq_def]
+        dsimp only
+        rw [hcombinedResolve]
+        simp only [bind, Except.bind]
+        exact htargetInvoke
+      have htargetInner : runOp ctx (fuel + 2) current targetStore
+          (targetValue :: environment) (.pure (.var 0)) =
+          .ok (targetStore, targetValue) := by
+        rw [runOp.eq_def]
+        rfl
+      have htargetRun : runCode ctx (fuel + 4) current store environment
+          (.letOp
+            (.call function
+              (captured.toList ++ lowered.toList).toArray)
+            (.letOp (.pure (.var 0)) rest)) = .ok targetOut := by
+        rw [runCode.eq_def]
+        dsimp only
+        rw [htargetOuter]
+        simp only [bind, Except.bind]
+        rw [runCode.eq_def]
+        dsimp only
+        rw [htargetInner]
+        simp only [bind, Except.bind]
+        exact htargetRest
+      refine ⟨targetOut, htargetRun, ?_⟩
+      change RunHistoryIso base out targetOut
+      apply runHistoryIso_weaken (earlier := base) (before := callHeap)
+        (hrun := hrestIso)
+      exact (fun h => hreadyCall h)
+  | @over declaration lowered hdeclaration hcaptureArity hscalar hrest
+      hlowered hover =>
+      have hctxDeclaration : ctx.decls function = some declaration := by
+        simpa [hctx] using hdeclaration
+      obtain ⟨capturedValues, suppliedValues, resultStore, resultValue,
+          hcaptured, hsupplied, happly, hrestRun⟩ :=
+        pairRunAt_of_run hctxDeclaration hcaptureArity hrun
+      have hscalarValues :=
+        allScalar_of_scalarCaptures henvironment hscalar hcaptured
+      obtain ⟨ready, hdrop, hreadyNodes, hremainder⟩ :=
+        freshApplyReady_of_run hscalarValues happly
+      let allocated := store.allocNode .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      have hsupplied' : resolveAtoms (.loc allocated.2 :: environment)
+          supplied = .ok suppliedValues := by
+        simpa [allocated] using hsupplied
+      have hloweredResolve : resolveAtoms environment lowered =
+          .ok suppliedValues :=
+        lowerAtoms?_resolveAtoms hlowered hsupplied'
+      have hcombinedResolve :
+          resolveAtoms environment
+              (captured.toList ++ lowered.toList).toArray =
+            .ok (capturedValues ++ suppliedValues) := by
+        exact resolveAtoms_append (by simpa using hcaptured)
+          (by simpa using hloweredResolve)
+      have hcapturedLength : capturedValues.length = captured.size :=
+        resolveAtoms_length hcaptured
+      have hloweredLength : suppliedValues.length = lowered.size :=
+        resolveAtoms_length hloweredResolve
+      have htotalOver : declArity declaration <
+          (capturedValues ++ suppliedValues).length := by
+        simpa [List.length_append, hcapturedLength, hloweredLength] using hover
+      have htotalOver' : declArity declaration <
+          capturedValues.length + suppliedValues.length := by
+        simpa using htotalOver
+      have hnotUnder : ¬ capturedValues.length + suppliedValues.length <
+          declArity declaration := by
+        omega
+      have hnotExact : capturedValues.length + suppliedValues.length ≠
+          declArity declaration := by
+        omega
+      have hpapsafe : declPapSafe declaration = true := by
+        cases hpapsafe : declPapSafe declaration with
+        | false =>
+            simp [hnotUnder, hnotExact, hctxDeclaration, hpapsafe]
+              at hremainder
+        | true => rfl
+      have hremainder' :
+          (do
+            let (called, value) ← invoke ctx fuel function
+              ((capturedValues ++ suppliedValues).take
+                (declArity declaration)) ready
+            applyGo ctx fuel called value
+              ((capturedValues ++ suppliedValues).drop
+                (declArity declaration))) = .ok (resultStore, resultValue) := by
+        simpa [hnotUnder, hnotExact, hctxDeclaration, hpapsafe] using hremainder
+      let omitted := base.omitDeadAllocLeft .shared
+        (.papN function (declArity declaration) capturedValues.toArray)
+      let readyHeap : HeapHistoryIso ready store :=
+        omitted.nodesEq hreadyNodes rfl
+      have henvReady : RValsIso readyHeap.locRel environment environment := by
+        change RValsIso base.locRel environment environment
+        exact henvIso
+      have hcapturedIso : RValsIso readyHeap.locRel
+          capturedValues capturedValues := by
+        change RValsIso base.locRel capturedValues capturedValues
+        exact (atomsResolve_of_resolveAtoms hcaptured).selfIso henvIso
+      have hloweredIso : RValsIso readyHeap.locRel
+          suppliedValues suppliedValues := by
+        change RValsIso base.locRel suppliedValues suppliedValues
+        exact (atomsResolve_of_resolveAtoms hloweredResolve).selfIso henvIso
+      have htotalIso : RValsIso readyHeap.locRel
+          (capturedValues ++ suppliedValues)
+          (capturedValues ++ suppliedValues) :=
+        hcapturedIso.append hloweredIso
+      have hfirstResolve : resolveAtoms environment
+          ((captured.toList ++ lowered.toList).take
+            (declArity declaration)).toArray =
+          .ok ((capturedValues ++ suppliedValues).take
+            (declArity declaration)) :=
+        resolveAtoms_take hcombinedResolve (declArity declaration)
+      have hprefixLe : capturedValues.length ≤ declArity declaration := by
+        omega
+      have hdropIdentity :
+          (capturedValues ++ suppliedValues).drop (declArity declaration) =
+            suppliedValues.drop
+              (declArity declaration - captured.size) := by
+        simpa [hcapturedLength] using
+          List.drop_append_after_prefix capturedValues suppliedValues
+            (declArity declaration) hprefixLe
+      cases hsourceInvoke : invoke ctx fuel function
+          ((capturedValues ++ suppliedValues).take
+            (declArity declaration)) ready with
+      | error error =>
+          rw [hsourceInvoke] at hremainder'
+          simp only [bind, Except.bind] at hremainder'
+          contradiction
+      | ok sourceCallOut =>
+          rcases sourceCallOut with ⟨sourceCallStore, sourceCallValue⟩
+          rw [hsourceInvoke] at hremainder'
+          simp only [bind, Except.bind] at hremainder'
+          obtain ⟨targetCallOut, htargetInvokeAt, hcallIso⟩ :=
+            invoke_historyIso readyHeap
+              (htotalIso.take (declArity declaration)) hsourceInvoke
+          rcases targetCallOut with ⟨targetCallStore, targetCallValue⟩
+          obtain ⟨callHeap, hreadyCall, hcallValueIso⟩ := hcallIso
+          have htargetInvoke : invoke ctx (fuel + 2) function
+              ((capturedValues ++ suppliedValues).take
+                (declArity declaration)) store =
+              .ok (targetCallStore, targetCallValue) :=
+            invoke_mono (by omega) htargetInvokeAt
+          have hheads : EnvsAgreeExcept 0
+              (.loc allocated.2 :: environment)
+              (targetCallValue :: environment) := by
+            intro index hindex
+            cases index with
+            | zero => exact False.elim (hindex rfl)
+            | succ index => rfl
+          have hsuppliedTarget :
+              resolveAtoms (targetCallValue :: environment) supplied =
+                .ok suppliedValues := by
+            rw [← resolveAtoms_env_eq hheads
+              (lowerAtoms?_notUseZero hlowered)]
+            exact hsupplied'
+          have hremainingResolve :
+              resolveAtoms (targetCallValue :: environment)
+                  (supplied.toList.drop
+                    (declArity declaration - captured.size)).toArray =
+                .ok (suppliedValues.drop
+                  (declArity declaration - captured.size)) :=
+            resolveAtoms_drop (by simpa using hsuppliedTarget)
+              (declArity declaration - captured.size)
+          have hresidualIso : RValsIso callHeap.locRel
+              ((capturedValues ++ suppliedValues).drop
+                (declArity declaration))
+              (suppliedValues.drop
+                (declArity declaration - captured.size)) := by
+            rw [← hdropIdentity]
+            exact hreadyCall.rvals
+              (htotalIso.drop (declArity declaration))
+          obtain ⟨targetApplyOut, htargetApplyAt, happlyIso⟩ :=
+            applyGo_historyIso callHeap hcallValueIso hresidualIso hremainder'
+          rcases targetApplyOut with ⟨targetStore, targetValue⟩
+          obtain ⟨applyHeap, hcallApply, hvalueIso⟩ := happlyIso
+          have htargetApply : applyGo ctx (fuel + 1) targetCallStore
+              targetCallValue
+              (suppliedValues.drop
+                (declArity declaration - captured.size)) =
+              .ok (targetStore, targetValue) :=
+            applyGo_mono (by omega) htargetApplyAt
+          have henvApply : RValsIso applyHeap.locRel
+              environment environment :=
+            hcallApply.rvals (hreadyCall.rvals henvReady)
+          obtain ⟨targetOut, htargetRest, hrestIso⟩ :=
+            continue_historyIso applyHeap hvalueIso henvApply
+              (codeNoUse_of_codeUsesVar_eq_false hrest) hrestRun
+          have htargetOuter : runOp ctx (fuel + 3) current store environment
+              (.call function
+                ((captured.toList ++ lowered.toList).take
+                  (declArity declaration)).toArray) =
+              .ok (targetCallStore, targetCallValue) := by
+            rw [runOp.eq_def]
+            dsimp only
+            rw [hfirstResolve]
+            simp only [bind, Except.bind]
+            exact htargetInvoke
+          have htargetInner : runOp ctx (fuel + 2) current targetCallStore
+              (targetCallValue :: environment)
+              (.apply (.var 0)
+                (supplied.toList.drop
+                  (declArity declaration - captured.size)).toArray) =
+              .ok (targetStore, targetValue) := by
+            rw [runOp.eq_def]
+            dsimp only
+            rw [hremainingResolve]
+            simp only [bind, Except.bind]
+            exact htargetApply
+          have htargetRun : runCode ctx (fuel + 4) current store environment
+              (.letOp
+                (.call function
+                  ((captured.toList ++ lowered.toList).take
+                    (declArity declaration)).toArray)
+                (.letOp
+                  (.apply (.var 0)
+                    (supplied.toList.drop
+                      (declArity declaration - captured.size)).toArray)
+                  rest)) = .ok targetOut := by
+            rw [runCode.eq_def]
+            dsimp only
+            rw [htargetOuter]
+            simp only [bind, Except.bind]
+            rw [runCode.eq_def]
+            dsimp only
+            rw [htargetInner]
+            simp only [bind, Except.bind]
+            exact htargetRest
+          refine ⟨targetOut, htargetRun, ?_⟩
+          change RunHistoryIso base out targetOut
+          apply runHistoryIso_weaken (earlier := base) (before := applyHeap)
+            (hrun := hrestIso)
+          exact fun h => hcallApply (hreadyCall h)
+
+/-! The arbitrary-fuel adapter for an already supplied self-history.  The two
+source binders force four units before success is possible. -/
+private theorem fusePair?_refines_selfHistory
+    {ctx : Ctx} {fuel : Nat} {current : FnDef} {store : Store}
+    {environment : List RVal} {declarations : DeclEnv} {facts : List Fact}
+    {function : Address} {captured supplied : Array Atom} {rest : Code}
+    {fusion : Fusion} {out : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (base : HeapHistoryIso store store)
+    (henvIso : RValsIso base.locRel environment environment)
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hfusion : fusePair? declarations facts function captured supplied rest =
+      some fusion)
+    (hrun : runCode ctx fuel current store environment
+      (.letOp (.papp function captured)
+        (.letOp (.apply (.var 0) supplied) rest)) = .ok out) :
+    ∃ targetOut,
+      runCode ctx fuel current store environment fusion.code = .ok targetOut ∧
+        RunHistoryIso base out targetOut := by
+  have hspec := fuseSpec_of_fusePair?_eq_some hfusion
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+      cases fuel with
+      | zero =>
+          rw [runCode.eq_def] at hrun
+          dsimp only at hrun
+          rw [runOp.eq_def] at hrun
+          simp only [bind, Except.bind] at hrun
+          contradiction
+      | succ fuel =>
+          cases fuel with
+          | zero =>
+              rw [runCode.eq_def] at hrun
+              dsimp only at hrun
+              cases houter : runOp ctx 1 current store environment
+                  (.papp function captured) with
+              | error error =>
+                  rw [houter] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  contradiction
+              | ok outerOut =>
+                  rcases outerOut with ⟨middle, value⟩
+                  rw [houter] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  rw [runCode.eq_def] at hrun
+                  dsimp only at hrun
+                  rw [runOp.eq_def] at hrun
+                  simp only [bind, Except.bind] at hrun
+                  contradiction
+          | succ fuel =>
+              cases fuel with
+              | zero =>
+                  rw [runCode.eq_def] at hrun
+                  dsimp only at hrun
+                  cases houter : runOp ctx 2 current store environment
+                      (.papp function captured) with
+                  | error error =>
+                      rw [houter] at hrun
+                      simp only [bind, Except.bind] at hrun
+                      contradiction
+                  | ok outerOut =>
+                      rcases outerOut with ⟨middle, value⟩
+                      rw [houter] at hrun
+                      simp only [bind, Except.bind] at hrun
+                      rw [runCode.eq_def] at hrun
+                      dsimp only at hrun
+                      rw [runOp.eq_def] at hrun
+                      dsimp only at hrun
+                      simp only [resolveAtom, List.getElem?_cons_zero, bind,
+                        Except.bind] at hrun
+                      cases hargs : resolveAtoms (value :: environment)
+                          supplied with
+                      | error error =>
+                          rw [hargs] at hrun
+                          simp only [bind, Except.bind] at hrun
+                          contradiction
+                      | ok arguments =>
+                          rw [hargs] at hrun
+                          simp only [bind, Except.bind] at hrun
+                          rw [applyGo.eq_def] at hrun
+                          simp only [bind, Except.bind] at hrun
+                          contradiction
+              | succ fuel =>
+                  exact fuseSpec_refinesAt hctx base henvIso henvironment
+                    hspec hrun
+
+/-- Every accepted fusion commutes with an arbitrary incoming allocation
+history.  Facts need hold only for the source environment: evaluator
+congruence transports the fused execution to the related target heap. -/
+theorem fusePair?_refines_historyIso
+    {ctx : Ctx} {fuel : Nat} {current : FnDef} {left right : Store}
+    {leftEnvironment rightEnvironment : List RVal}
+    {declarations : DeclEnv} {facts : List Fact}
+    {function : Address} {captured supplied : Array Atom} {rest : Code}
+    {fusion : Fusion} {leftOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (henvironment : EnvironmentHolds declarations left facts leftEnvironment)
+    (hfusion : fusePair? declarations facts function captured supplied rest =
+      some fusion)
+    (hrun : runCode ctx fuel current left leftEnvironment
+      (.letOp (.papp function captured)
+        (.letOp (.apply (.var 0) supplied) rest)) = .ok leftOut) :
+    ∃ rightOut,
+      runCode ctx fuel current right rightEnvironment fusion.code =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  let self := heap.trans heap.symm
+  have hselfEnvironment : RValsIso self.locRel
+      leftEnvironment leftEnvironment := by
+    change RValsIso
+      (fun leftLoc rightLoc =>
+        ∃ middleLoc, heap.locRel leftLoc middleLoc ∧
+          heap.locRel rightLoc middleLoc)
+      leftEnvironment leftEnvironment
+    exact henvironments.trans henvironments.symm
+  obtain ⟨middleOut, hmiddleRun, hlocal⟩ :=
+    fusePair?_refines_selfHistory hctx self hselfEnvironment henvironment
+      hfusion hrun
+  obtain ⟨rightOut, hrightRun, htransport⟩ :=
+    runCode_historyIso heap henvironments hmiddleRun
+  refine ⟨rightOut, hrightRun, ?_⟩
+  apply runHistoryIso_weaken (earlier := heap)
+    (before := self.trans heap) (hrun := hlocal.trans htransport)
+  intro leftLoc rightLoc hrel
+  exact ⟨leftLoc, ⟨rightLoc, hrel, hrel⟩, hrel⟩
+
+/-! ## Recursive traversal refinement -/
+
+/-- One unchanged primitive followed by a recursively rewritten
+continuation.  Operation congruence produces the history used by both HPT's
+forget-heap transfer and the recursive hypothesis. -/
+private theorem runCode_letOpWithFacts_refines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    {left right : Store} {facts : List Fact}
+    {leftEnvironment rightEnvironment : List RVal}
+    {operation : Op} {rest : Code} {bound : Fact}
+    {fuel : Nat} {leftOut : Store × RVal}
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (henvironment : EnvironmentHolds declarations left facts leftEnvironment)
+    (habstract : analyzeOp declarations summaries owner current facts operation =
+      .ok bound)
+    (hrun : runCode ctx (fuel + 1) current left leftEnvironment
+      (.letOp operation rest) = .ok leftOut)
+    (ih : ∀ {left right : Store} {facts : List Fact}
+      {leftEnvironment rightEnvironment : List RVal}
+      {input : Code} {leftOut : Store × RVal},
+      (heap : HeapHistoryIso left right) →
+      RValsIso heap.locRel leftEnvironment rightEnvironment →
+      EnvironmentHolds declarations left facts leftEnvironment →
+      runCode ctx fuel current left leftEnvironment input = .ok leftOut →
+      ∃ rightOut,
+        runCode ctx fuel current right rightEnvironment
+            (runWithFacts declarations summaries owner current facts input).code =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut) :
+    ∃ rightOut,
+      runCode ctx (fuel + 1) current right rightEnvironment
+          (.letOp operation
+            (runWithFacts declarations summaries owner current
+              (bound :: facts.map Fact.forgetHeap) rest).code) = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  rw [runCode.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  cases hleftOperation : runOp ctx fuel current left leftEnvironment operation with
+  | error error =>
+      rw [hleftOperation] at hrun
+      simp only [bind, Except.bind] at hrun
+      contradiction
+  | ok leftOperationOut =>
+      rcases leftOperationOut with ⟨leftNext, leftValue⟩
+      rw [hleftOperation] at hrun
+      simp only [bind, Except.bind] at hrun
+      have hbound := analyzeOp_sound_ownerCompatible hpost hctx howner
+        henvironment
+        habstract hleftOperation
+      have hold := EnvironmentHolds.forgetHeap
+        (after := leftNext) henvironment
+      obtain ⟨rightOperationOut, hrightOperation, hoperationIso⟩ :=
+        runOp_historyIso heap henvironments hleftOperation
+      rcases rightOperationOut with ⟨rightNext, rightValue⟩
+      obtain ⟨nextHeap, hentryNext, hvalue⟩ := hoperationIso
+      rw [hrightOperation]
+      simp only [bind, Except.bind]
+      obtain ⟨rightOut, hrightRest, hrestIso⟩ :=
+        ih nextHeap (.cons hvalue (hentryNext.rvals henvironments))
+          (.cons hbound hold) hrun
+      exact ⟨rightOut, hrightRest,
+        runHistoryIso_weaken hentryNext hrestIso⟩
+
+/-- Package the ordinary `let` equation so the main proof only has to
+separate the one adjacent PAP/apply shape handled specially by the pass. -/
+private theorem runCode_ordinaryLetWithFacts_refines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    {left right : Store} {facts : List Fact}
+    {leftEnvironment rightEnvironment : List RVal}
+    {operation : Op} {rest : Code} {fuel : Nat}
+    {leftOut : Store × RVal}
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (henvironment : EnvironmentHolds declarations left facts leftEnvironment)
+    (hrun : runCode ctx (fuel + 1) current left leftEnvironment
+      (.letOp operation rest) = .ok leftOut)
+    (ih : ∀ {left right : Store} {facts : List Fact}
+      {leftEnvironment rightEnvironment : List RVal}
+      {input : Code} {leftOut : Store × RVal},
+      (heap : HeapHistoryIso left right) →
+      RValsIso heap.locRel leftEnvironment rightEnvironment →
+      EnvironmentHolds declarations left facts leftEnvironment →
+      runCode ctx fuel current left leftEnvironment input = .ok leftOut →
+      ∃ rightOut,
+        runCode ctx fuel current right rightEnvironment
+            (runWithFacts declarations summaries owner current facts input).code =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut)
+    (hordinary :
+      (runWithFacts declarations summaries owner current facts
+        (.letOp operation rest)).code =
+      match analyzeOp declarations summaries owner current facts operation with
+      | .error _ => .letOp operation rest
+      | .ok bound =>
+          .letOp operation
+            (runWithFacts declarations summaries owner current
+              (bound :: facts.map Fact.forgetHeap) rest).code) :
+    ∃ rightOut,
+      runCode ctx (fuel + 1) current right rightEnvironment
+          (runWithFacts declarations summaries owner current facts
+            (.letOp operation rest)).code = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  cases habstract : analyzeOp declarations summaries owner current facts
+      operation with
+  | error error =>
+      rw [hordinary, habstract]
+      exact runCode_historyIso heap henvironments hrun
+  | ok bound =>
+      rw [hordinary, habstract]
+      exact runCode_letOpWithFacts_refines hpost hctx howner heap
+        henvironments henvironment habstract hrun ih
+
+/-- The branch-body half of recursive fusion.  The source-side HPT facts are
+installed only after the concrete evaluator has selected a matching branch;
+the heap-history relation transports the selected fields to the target. -/
+private theorem runCode_caseWithFactsBodies_refines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    {owner : Address} {current : FnDef} {ctx : Ctx}
+    {left right : Store} {facts : List Fact}
+    {leftEnvironment rightEnvironment : List RVal}
+    {scrutinee : Atom} {peelNat : Bool} {alternatives : Array Alt}
+    {scrutineeFact : Fact} {fuel : Nat} {leftOut : Store × RVal}
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (henvironment : EnvironmentHolds declarations left facts leftEnvironment)
+    (habstract : resolveAtomFact facts scrutinee = .ok scrutineeFact)
+    (hrun : runCode ctx (fuel + 1) current left leftEnvironment
+      (.case scrutinee peelNat alternatives) = .ok leftOut)
+    (ih : ∀ {left right : Store} {facts : List Fact}
+      {leftEnvironment rightEnvironment : List RVal}
+      {input : Code} {leftOut : Store × RVal},
+      (heap : HeapHistoryIso left right) →
+      RValsIso heap.locRel leftEnvironment rightEnvironment →
+      EnvironmentHolds declarations left facts leftEnvironment →
+      runCode ctx fuel current left leftEnvironment input = .ok leftOut →
+      ∃ rightOut,
+        runCode ctx fuel current right rightEnvironment
+            (runWithFacts declarations summaries owner current facts input).code =
+          .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut) :
+    ∃ rightOut,
+      runCode ctx (fuel + 1) current right rightEnvironment
+          (.case scrutinee peelNat
+            ((alternatives.map
+              (runAlternativeWithFacts declarations summaries owner current
+                scrutineeFact peelNat facts)).map
+                  (fun result => result.alternative))) = .ok rightOut ∧
+        RunHistoryIso heap leftOut rightOut := by
+  obtain ⟨leftValue, hleftResolve⟩ :=
+    resolveAtom_complete henvironment habstract
+  have hscrutineeHolds :=
+    resolveAtom_sound henvironment habstract hleftResolve
+  obtain ⟨rightValue, hrightResolve, hvalue⟩ :=
+    resolveAtom_historyIso henvironments hleftResolve
+  rw [runCode.eq_def] at hrun ⊢
+  dsimp only at hrun ⊢
+  rw [hleftResolve] at hrun
+  rw [hrightResolve]
+  simp only [bind, Except.bind] at hrun ⊢
+  cases hvalue with
+  | erased => simp at hrun
+  | @lit literal =>
+      cases literal with
+      | str value => simp at hrun
+      | nat value =>
+          cases peelNat with
+          | false => simp at hrun
+          | true =>
+              cases value with
+              | zero =>
+                  simp only
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 0) with
+                  | none => simp [hfind] at hrun
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero =>
+                              have hzero :
+                                  scrutineeFact.caseFields true cidx 0 = [] := by
+                                unfold Fact.caseFields
+                                split <;> rfl
+                              simp [hfind] at hrun
+                              simp only [Option.map_some]
+                              obtain ⟨rightOut, hrightRun, hout⟩ :=
+                                ih heap henvironments henvironment hrun
+                              exact ⟨rightOut, by
+                                simpa [runAlternativeWithFacts, hzero]
+                                  using hrightRun, hout⟩
+                          | succ fields =>
+                              simp [hfind, runAlternativeWithFacts] at hrun
+              | succ value =>
+                  simp only
+                  rw [find?_runAlternativeWithFacts]
+                  cases hfind : alternatives.find?
+                      (fun alternative => alternative.cidx == 1) with
+                  | none => simp [hfind] at hrun
+                  | some alternative =>
+                      cases alternative with
+                      | mk cidx fields body =>
+                          cases fields with
+                          | zero =>
+                              simp [hfind, runAlternativeWithFacts] at hrun
+                          | succ fields =>
+                              cases fields with
+                              | zero =>
+                                  have hcidx : cidx = 1 := by
+                                    have hmatch := Array.find?_some
+                                      (p := fun alternative : Alt =>
+                                        alternative.cidx == 1)
+                                      (a := .mk cidx 1 body)
+                                      (xs := alternatives) hfind
+                                    exact beq_iff_eq.mp hmatch
+                                  have hbinders :
+                                      EnvironmentHolds declarations left
+                                        (scrutineeFact.caseFields true cidx 1)
+                                        [.lit (.nat value)] := by
+                                    simpa [hcidx] using
+                                      (Fact.caseFields_natSucc_holds
+                                        hscrutineeHolds)
+                                  simp [hfind] at hrun
+                                  simp only [Option.map_some]
+                                  obtain ⟨rightOut, hrightRun, hout⟩ :=
+                                    ih heap (.cons .lit henvironments)
+                                      (hbinders.append henvironment) hrun
+                                  exact ⟨rightOut, by
+                                    simpa [runAlternativeWithFacts]
+                                      using hrightRun, hout⟩
+                              | succ fields =>
+                                  simp [hfind, runAlternativeWithFacts] at hrun
+  | @loc leftLoc rightLoc hrel =>
+      cases hleft : left.get? leftLoc with
+      | none => simp [hleft] at hrun
+      | some leftBox =>
+          obtain ⟨rightBox, hright, hbox⟩ := heap.boxes hrel hleft
+          rcases leftBox with ⟨leftWorld, leftRc, leftNode⟩
+          rcases rightBox with ⟨rightWorld, rightRc, rightNode⟩
+          rcases hbox with ⟨hworld, hrc, hnode⟩
+          change leftWorld = rightWorld at hworld
+          change leftRc = rightRc at hrc
+          change NodeIso heap.locRel leftNode rightNode at hnode
+          subst rightWorld
+          subst rightRc
+          simp only [hleft] at hrun
+          simp only [hright]
+          cases hnode with
+          | pap harguments => simp at hrun
+          | @ctor identity leftFields rightFields hfields =>
+              simp only
+              rw [find?_runAlternativeWithFacts]
+              cases hfind : alternatives.find?
+                  (fun alternative => alternative.cidx == identity.cidx) with
+              | none => simp [hfind] at hrun
+              | some alternative =>
+                  cases alternative with
+                  | mk cidx fieldCount body =>
+                      have hsizes : leftFields.size = rightFields.size := by
+                        simpa using hfields.lengths
+                      by_cases hcount : leftFields.size = fieldCount
+                      · have hrightCount :
+                            rightFields.size = fieldCount := by
+                          rw [← hsizes]
+                          exact hcount
+                        have hcidx : identity.cidx = cidx := by
+                          have hmatch := Array.find?_some
+                            (p := fun alternative : Alt =>
+                              alternative.cidx == identity.cidx)
+                            (a := .mk cidx fieldCount body)
+                            (xs := alternatives) hfind
+                          exact (beq_iff_eq.mp hmatch).symm
+                        have hbinders := Fact.caseFields_ctor_holds
+                          peelNat cidx fieldCount hscrutineeHolds hleft rfl
+                          hcidx hcount
+                        simp [hfind, hcount] at hrun
+                        simp only [Option.map_some]
+                        rw [Array.foldl_cons_eq_reverse_append]
+                        obtain ⟨rightOut, hrightRun, hout⟩ :=
+                          ih heap (hfields.reverse.append henvironments)
+                            (hbinders.append henvironment) hrun
+                        exact ⟨rightOut, by
+                          simpa [hrightCount, runAlternativeWithFacts]
+                            using hrightRun, hout⟩
+                      · have hrightCount :
+                            rightFields.size ≠ fieldCount := by
+                          intro heq
+                          exact hcount (hsizes.trans heq)
+                        simp [hfind, hcount, hrightCount,
+                          runAlternativeWithFacts] at hrun
+
+/-- Recursive HPT-guided PAP fusion preserves every successful run modulo
+allocation history.  The theorem is deliberately stated over an arbitrary
+incoming heap relation, so it can be used beneath calls and inside another
+owner-sensitive declaration rewrite. -/
+theorem runCode_runWithFacts_refines_ownerCompatible
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    {left right : Store} {facts : List Fact}
+    {leftEnvironment rightEnvironment : List RVal}
+    {input : Code} {fuel : Nat} {leftOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (henvironment : EnvironmentHolds declarations left facts leftEnvironment)
+    (hrun : runCode ctx fuel current left leftEnvironment input = .ok leftOut) :
+    ∃ rightOut,
+      runCode ctx fuel current right rightEnvironment
+          (runWithFacts declarations summaries owner current facts input).code =
+        .ok rightOut ∧
+      RunHistoryIso heap leftOut rightOut := by
+  induction fuel generalizing left right facts leftEnvironment
+      rightEnvironment input leftOut with
+  | zero => simp [runCode] at hrun
+  | succ fuel ih =>
+      cases input with
+      | ret atom =>
+          simpa [runWithFacts] using
+            (runCode_historyIso heap henvironments hrun)
+      | case scrutinee peelNat alternatives =>
+          cases habstract : resolveAtomFact facts scrutinee with
+          | error error =>
+              simpa [runWithFacts, habstract] using
+                (runCode_historyIso heap henvironments hrun)
+          | ok scrutineeFact =>
+              simpa [runWithFacts, habstract] using
+                (runCode_caseWithFactsBodies_refines heap henvironments
+                  henvironment habstract hrun
+                  (fun nextHeap nextEnvironments nextFacts nextRun =>
+                    ih nextHeap nextEnvironments nextFacts nextRun))
+      | letOp operation rest =>
+          have ordinary {operation : Op} {rest : Code}
+              (hordinaryRun : runCode ctx (fuel + 1) current left
+                leftEnvironment (.letOp operation rest) = .ok leftOut)
+              (hordinary :
+                (runWithFacts declarations summaries owner current facts
+                  (.letOp operation rest)).code =
+                match analyzeOp declarations summaries owner current facts
+                    operation with
+                | .error _ => .letOp operation rest
+                | .ok bound =>
+                    .letOp operation
+                      (runWithFacts declarations summaries owner current
+                        (bound :: facts.map Fact.forgetHeap) rest).code) :=
+              runCode_ordinaryLetWithFacts_refines hpost hctx howner heap
+                henvironments henvironment hordinaryRun
+                (fun nextHeap nextEnvironments nextFacts nextRun =>
+                  ih nextHeap nextEnvironments nextFacts nextRun)
+                hordinary
+          by_cases hpair : ∃ function captured supplied tail,
+              operation = .papp function captured ∧
+                rest = .letOp (.apply (.var 0) supplied) tail
+          · obtain ⟨function, captured, supplied, tail, rfl, rfl⟩ := hpair
+            let pap := Op.papp function captured
+            let applyOperation := Op.apply (.var 0) supplied
+            cases hpap : analyzeOp declarations summaries owner current facts
+                pap with
+            | error error =>
+                simpa [runWithFacts, pap, applyOperation, hpap] using
+                  (runCode_historyIso heap henvironments hrun)
+            | ok papFact =>
+                let afterPap := papFact :: facts.map Fact.forgetHeap
+                cases happly : analyzeOp declarations summaries owner current
+                    afterPap applyOperation with
+                | error error =>
+                    simpa [runWithFacts, pap, applyOperation, afterPap, hpap,
+                      happly] using
+                        (runCode_historyIso heap henvironments hrun)
+                | ok resultFact =>
+                    let afterApply :=
+                      resultFact :: afterPap.map Fact.forgetHeap
+                    let nested := runWithFacts declarations summaries owner
+                      current afterApply tail
+                    have hpapConcrete : analyzeOp declarations summaries owner
+                        current facts (.papp function captured) =
+                          .ok papFact := by
+                      simpa [pap] using hpap
+                    have happlyConcrete : analyzeOp declarations summaries
+                        owner current (papFact :: facts.map Fact.forgetHeap)
+                        (.apply (.var 0) supplied) = .ok resultFact := by
+                      simpa [afterPap, applyOperation] using happly
+                    cases hfusion : fusePair? declarations facts function
+                        captured supplied nested.code with
+                    | none =>
+                        apply ordinary hrun
+                        simp only [runWithFacts, hpapConcrete,
+                          happlyConcrete]
+                        rw [hfusion]
+                    | some fusion =>
+                        rw [runCode.eq_def] at hrun
+                        dsimp only at hrun
+                        cases hleftPap : runOp ctx fuel current left
+                            leftEnvironment pap with
+                        | error error =>
+                            rw [hleftPap] at hrun
+                            simp only [bind, Except.bind] at hrun
+                            contradiction
+                        | ok leftPapOut =>
+                            rcases leftPapOut with ⟨leftNext, leftValue⟩
+                            rw [hleftPap] at hrun
+                            simp only [bind, Except.bind] at hrun
+                            have hpapFact := analyzeOp_sound_ownerCompatible
+                              hpost hctx howner henvironment hpap hleftPap
+                            have hold := EnvironmentHolds.forgetHeap
+                              (after := leftNext) henvironment
+                            have hafterPap : EnvironmentHolds declarations
+                                leftNext afterPap
+                                (leftValue :: leftEnvironment) := by
+                              exact .cons hpapFact hold
+                            obtain ⟨rightPapOut, hrightPap, hpapIso⟩ :=
+                              runOp_historyIso heap henvironments hleftPap
+                            rcases rightPapOut with ⟨rightNext, rightValue⟩
+                            obtain ⟨nextHeap, hentryNext, hvalue⟩ := hpapIso
+                            have hnextEnvironments : RValsIso nextHeap.locRel
+                                (leftValue :: leftEnvironment)
+                                (rightValue :: rightEnvironment) :=
+                              .cons hvalue (hentryNext.rvals henvironments)
+                            let self := nextHeap.trans nextHeap.symm
+                            have hselfEnvironment : RValsIso self.locRel
+                                (leftValue :: leftEnvironment)
+                                (leftValue :: leftEnvironment) := by
+                              change RValsIso
+                                (fun leftLoc rightLoc =>
+                                  ∃ middleLoc,
+                                    nextHeap.locRel leftLoc middleLoc ∧
+                                    nextHeap.locRel rightLoc middleLoc)
+                                (leftValue :: leftEnvironment)
+                                (leftValue :: leftEnvironment)
+                              exact hnextEnvironments.trans
+                                hnextEnvironments.symm
+                            obtain ⟨middleOut, hmiddleRun, hrewrite⟩ :=
+                              ih self hselfEnvironment hafterPap hrun
+                            have hmiddleRun' : runCode ctx fuel current leftNext
+                                (leftValue :: leftEnvironment)
+                                (.letOp applyOperation nested.code) =
+                                  .ok middleOut := by
+                              simpa [runWithFacts, applyOperation, afterPap,
+                                afterApply, nested, happly] using hmiddleRun
+                            have hsourceNested : runCode ctx (fuel + 1) current
+                                left leftEnvironment
+                                (.letOp pap
+                                  (.letOp applyOperation nested.code)) =
+                                    .ok middleOut := by
+                              rw [runCode.eq_def]
+                              dsimp only
+                              rw [hleftPap]
+                              simp only [bind, Except.bind]
+                              exact hmiddleRun'
+                            obtain ⟨rightOut, hrightRun, hfused⟩ :=
+                              fusePair?_refines_historyIso hctx heap
+                                henvironments henvironment hfusion hsourceNested
+                            obtain ⟨rewriteHeap, hselfRewrite,
+                              hrewriteValue⟩ := hrewrite
+                            obtain ⟨fusedHeap, hheapFused, hfusedValue⟩ :=
+                              hfused
+                            refine ⟨rightOut, ?_, rewriteHeap.trans fusedHeap,
+                              ?_, hrewriteValue.trans hfusedValue⟩
+                            · simp only [runWithFacts, hpapConcrete,
+                                happlyConcrete]
+                              rw [hfusion]
+                              exact hrightRun
+                            · intro leftLoc rightLoc hrel
+                              refine ⟨leftLoc, hselfRewrite ?_,
+                                hheapFused hrel⟩
+                              exact ⟨rightLoc, hentryNext hrel,
+                                hentryNext hrel⟩
+          · apply ordinary hrun
+            by_cases hpapp : ∃ function captured,
+                operation = .papp function captured
+            · obtain ⟨function, captured, rfl⟩ := hpapp
+              cases rest with
+              | ret atom =>
+                  simp only [runWithFacts]
+                  split <;> rfl
+              | case scrutinee peelNat alternatives =>
+                  simp only [runWithFacts]
+                  split <;> rfl
+              | letOp nextOperation tail =>
+                  by_cases happlyShape : ∃ applied supplied,
+                      nextOperation = .apply applied supplied
+                  · obtain ⟨applied, supplied, rfl⟩ := happlyShape
+                    by_cases hvarZero : applied = .var 0
+                    · subst applied
+                      exact False.elim
+                        (hpair ⟨function, captured, supplied, tail, rfl, rfl⟩)
+                    · cases applied with
+                      | var index =>
+                          cases index with
+                          | zero => exact False.elim (hvarZero rfl)
+                          | succ index =>
+                              simp only [runWithFacts]
+                              split <;> rfl
+                      | lit literal =>
+                          simp only [runWithFacts]
+                          split <;> rfl
+                      | erased =>
+                          simp only [runWithFacts]
+                          split <;> rfl
+                  · cases nextOperation <;>
+                      try { simp only [runWithFacts]; split <;> rfl }
+                    rename_i applied supplied
+                    exact False.elim
+                      (happlyShape ⟨applied, supplied, rfl⟩)
+            · cases operation <;>
+                try { simp only [runWithFacts]; split <;> rfl }
+              rename_i function captured
+              exact False.elim (hpapp ⟨function, captured, rfl⟩)
+
+/-- Exact declaration ownership is the common stored-function specialization
+of the owner-compatible recursive refinement theorem. -/
+theorem runCode_runWithFacts_refines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    {left right : Store} {facts : List Fact}
+    {leftEnvironment rightEnvironment : List RVal}
+    {input : Code} {fuel : Nat} {leftOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (henvironment : EnvironmentHolds declarations left facts leftEnvironment)
+    (hrun : runCode ctx fuel current left leftEnvironment input = .ok leftOut) :
+    ∃ rightOut,
+      runCode ctx fuel current right rightEnvironment
+          (runWithFacts declarations summaries owner current facts input).code =
+        .ok rightOut ∧
+      RunHistoryIso heap leftOut rightOut :=
+  runCode_runWithFacts_refines_ownerCompatible hpost hctx (.inl hcurrent)
+    heap henvironments henvironment hrun
+
+/-- The owner-local traversal rewrites a body soundly while retaining the
+source current frame.  The generic evaluator fixed-point theorem is
+responsible for installing the rewritten frame around recursive self-calls. -/
+theorem rewriteFunction_staticBodyRefines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current)) :
+    StaticFunctionBodyRefines ctx current
+      (rewriteFunction declarations summaries owner current) := by
+  intro fuel store environment sourceOut base hlength henvironment hrun
+  have htop : EnvironmentHolds declarations store
+      (List.replicate current.arity Fact.top) environment := by
+    simpa [hlength] using
+      (EnvironmentHolds.top_replicate declarations store environment)
+  obtain ⟨targetOut, htargetRun, hiso⟩ :=
+    runCode_runWithFacts_refines hpost hctx hcurrent base henvironment htop hrun
+  exact ⟨targetOut, by
+    simpa [rewriteFunction, runFunction] using htargetRun, hiso⟩
+
+/-- Rewriting the current frame preserves arbitrary surrounding code,
+including recursive `callSelf` entries into its rewritten body. -/
+theorem runCode_rewriteFunction_refines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    {left right : Store} {fuel : Nat}
+    {leftEnvironment rightEnvironment : List RVal}
+    {input : Code} {sourceOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (hrun : runCode ctx fuel current left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode ctx fuel
+          (rewriteFunction declarations summaries owner current)
+          right rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut :=
+  runCode_currentFrame_refines
+    (rewriteFunction_staticBodyRefines hpost hctx hcurrent)
+    rfl rfl heap henvironments hrun
+
+/-- The checked owner-local PAP traversal supplies the semantic function-body
+obligation consumed by `AbstractEnvironment`. -/
+theorem rewriteFunction_bodyRefines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current)) :
+    FunctionBodyRefines ctx current
+      (rewriteFunction declarations summaries owner current) :=
+  FunctionBodyRefines.ofStatic
+    (rewriteFunction_staticBodyRefines hpost hctx hcurrent) rfl rfl
+
+/-! ## Logical declaration environment
+
+The semantic traversal remains keyed by the source addresses.  Artifact
+readdressing is a later, separate transport step. -/
+
+/-- Rewrite every stored function under its source owner while retaining the
+old lookup keys. -/
+def rewriteDeclEnv (declarations : DeclEnv) (summaries : SummaryEnv) :
+    DeclEnv :=
+  fun owner => (declarations owner).map
+    (rewriteDeclaration declarations summaries owner)
+
+/-- Retain the scalar oracle and replace only the declaration environment. -/
+def rewriteCtx (declarations : DeclEnv) (summaries : SummaryEnv)
+    (ctx : Ctx) : Ctx :=
+  { ctx with decls := rewriteDeclEnv declarations summaries }
+
+/-- List form consumed by a subsequent content-address rebuild. -/
+def rewriteEntries (declarations : DeclEnv) (summaries : SummaryEnv)
+    (entries : List (Address × Decl)) : List (Address × Decl) :=
+  entries.map fun entry =>
+    (entry.1, rewriteDeclaration declarations summaries entry.1 entry.2)
+
+/-- PAP fusion's owner-local body theorem instantiates the generic declaration
+environment interface for every successful source lookup. -/
+theorem abstractEnvironment_rewriteCtx
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} (hctx : ctx.decls = declarations) :
+    AbstractEnvironment ctx (rewriteCtx declarations summaries ctx) := by
+  constructor
+  · rfl
+  · intro address arity hsource
+    have hdeclaration : declarations address = some (.extern arity) := by
+      rw [← hctx]
+      exact hsource
+    simp [rewriteCtx, rewriteDeclEnv, hdeclaration, rewriteDeclaration]
+  · intro address source hsource
+    have hdeclaration : declarations address = some (.fn source) := by
+      rw [← hctx]
+      exact hsource
+    refine ⟨rewriteFunction declarations summaries address source, ?_,
+      rfl, rfl, rfl, ?_⟩
+    · simp [rewriteCtx, rewriteDeclEnv, hdeclaration,
+        rewriteDeclaration]
+    · exact rewriteFunction_bodyRefines hpost hctx hdeclaration
+
+/-- Successful evaluation is preserved after logically replacing every
+stored function by its owner-sensitive PAP-fused body. -/
+theorem runCode_rewriteCtx_refines
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {left right : Store} {fuel : Nat}
+    {leftEnvironment rightEnvironment : List RVal}
+    {input : Code} {sourceOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (hrun : runCode ctx fuel current left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode (rewriteCtx declarations summaries ctx) fuel current right
+          rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut :=
+  runCode_abstractEnvironment
+    (abstractEnvironment_rewriteCtx hpost hctx) heap henvironments hrun
+
+/-- Closed self-heap specialization of the general history theorem. -/
+theorem fusePair?_refines
+    {ctx : Ctx} {fuel : Nat} {current : FnDef} {store : Store}
+    {environment : List RVal} {declarations : DeclEnv} {facts : List Fact}
+    {function : Address} {captured supplied : Array Atom} {rest : Code}
+    {fusion : Fusion} {out : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (hclosed : StoreClosed store)
+    (hbounds : Reclamation.ValuesInBounds store environment)
+    (henvironment : EnvironmentHolds declarations store facts environment)
+    (hfusion : fusePair? declarations facts function captured supplied rest =
+      some fusion)
+    (hrun : runCode ctx fuel current store environment
+      (.letOp (.papp function captured)
+        (.letOp (.apply (.var 0) supplied) rest)) = .ok out) :
+    ∃ targetOut,
+      runCode ctx fuel current store environment fusion.code = .ok targetOut ∧
+        RunHistoryIso (HeapHistoryIso.refl store hclosed) out targetOut := by
+  let base := HeapHistoryIso.refl store hclosed
+  have henvIso : RValsIso base.locRel environment environment := by
+    simpa [base] using RValsIso.refl_of_inBounds hclosed hbounds
+  simpa [base] using
+    fusePair?_refines_selfHistory hctx base henvIso henvironment hfusion hrun
+
+end Ix.Compiler.IxIR1.HPT.PAPFuse
diff --git a/Ix/Compiler/IxIR1/HPTPAPFuseProgram.lean b/Ix/Compiler/IxIR1/HPTPAPFuseProgram.lean
new file mode 100644
index 000000000..521771897
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTPAPFuseProgram.lean
@@ -0,0 +1,781 @@
+import Ix.Compiler.IxIR1.HPTCasePruneProgram
+import Ix.Compiler.IxIR1.HPTDestroy
+import Ix.Compiler.IxIR1.Reachability
+
+/-!
+# One-rebuild composition of checked HPT consumers
+
+Case simplification, scalar fetch forwarding, shape-specialized destruction,
+and local PAP fusion all consume the same old-keyed HPT certificate.
+Readdressing between them would invalidate those keys.  This module therefore
+composes their logical declaration/main rewrites first and performs one
+complete content-address rebuild.
+
+Case simplification runs first.  Its unary collapse retains binder depth by
+materializing a fetch.  Fetch forwarding then replaces only certified scalar
+allocation/reuse projections, destruction removes certified scalar work and
+specializes exact unique leaves, and PAP fusion analyzes the resulting code
+with the same owner, arity, and entry fact environment.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT.OptimizeProgram
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1.Sim
+
+structure Passes where
+  casePrune : Bool := true
+  fetchForward : Bool := true
+  destroy : Bool := true
+  papFuse : Bool := true
+  reachability : Bool := true
+  roots : List Address := []
+  deriving BEq, Repr
+
+structure Changes where
+  casePrune : CasePrune.Changes := {}
+  fetchForward : FetchForward.Changes := {}
+  destroy : Destroy.Changes := {}
+  papFuse : PAPFuse.Changes := {}
+  removedDeclarations : Nat := 0
+
+def Changes.add (left right : Changes) : Changes :=
+  { casePrune := left.casePrune.add right.casePrune
+    fetchForward := left.fetchForward.add right.fetchForward
+    destroy := left.destroy.add right.destroy
+    papFuse := left.papFuse.add right.papFuse
+    removedDeclarations :=
+      left.removedDeclarations + right.removedDeclarations }
+
+structure CodeOutcome where
+  code : Code
+  changes : Changes := {}
+
+def rewriteCode (passes : Passes) (declarations : DeclEnv)
+    (summaries : SummaryEnv) (owner : Address) (current : FnDef)
+    (facts : List Fact) (input : Code) : CodeOutcome :=
+  let pruned : CasePrune.Outcome :=
+    if passes.casePrune then
+      CasePrune.runWithFacts declarations summaries owner current facts input
+    else
+      { code := input, removedAlternatives := 0, collapsedCases := 0,
+        materializedFetches := 0 }
+  let forwarded : FetchForward.Outcome :=
+    if passes.fetchForward then
+      FetchForward.runWithFacts declarations summaries owner current facts
+        pruned.code
+    else
+      { code := pruned.code, changes := {} }
+  let destroyed : Destroy.Outcome :=
+    if passes.destroy then
+      Destroy.runWithFacts declarations summaries owner current facts
+        forwarded.code
+    else
+      { code := forwarded.code, changes := {} }
+  let fused : PAPFuse.Outcome :=
+    if passes.papFuse then
+      PAPFuse.runWithFacts declarations summaries owner current facts
+        destroyed.code
+    else
+      { code := destroyed.code, changes := {} }
+  { code := fused.code
+    changes :=
+      { casePrune := pruned.changes
+        fetchForward := forwarded.changes
+        destroy := destroyed.changes
+        papFuse := fused.changes } }
+
+def rewriteDeclaration (passes : Passes)
+    (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) : Decl → Decl × Changes
+  | .extern arity => (.extern arity, {})
+  | .fn function =>
+      let rewritten := rewriteCode passes declarations summaries owner function
+        (List.replicate function.arity Fact.top) function.body
+      (.fn { function with body := rewritten.code }, rewritten.changes)
+
+/-- Logical old-keyed declaration environment for the composed consumers. -/
+def rewriteDeclEnv (passes : Passes) (declarations : DeclEnv)
+    (summaries : SummaryEnv) : DeclEnv :=
+  fun owner => (declarations owner).map fun declaration =>
+    (rewriteDeclaration passes declarations summaries owner declaration).1
+
+/-- Retain the oracle while installing the composed logical environment. -/
+def rewriteCtx (passes : Passes) (declarations : DeclEnv)
+    (summaries : SummaryEnv) (ctx : Ctx) : Ctx :=
+  { ctx with decls := rewriteDeclEnv passes declarations summaries }
+
+@[simp] theorem declArity_rewriteDeclaration
+    (passes : Passes) (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (declaration : Decl) :
+    declArity
+        (rewriteDeclaration passes declarations summaries owner declaration).1 =
+      declArity declaration := by
+  cases declaration <;> rfl
+
+/-- All checked consumers compose under the original owner/current analysis
+frame.  Case pruning and fetch forwarding are exact; destruction preserves
+successful outcomes and PAP fusion may change allocation history. -/
+theorem rewriteCode_staticBodyRefines
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current)) :
+    StaticFunctionBodyRefines ctx current
+      { current with body :=
+          (rewriteCode passes declarations summaries owner current
+            (List.replicate current.arity Fact.top) current.body).code } := by
+  intro fuel store environment sourceOut base hlength henvironment hrun
+  let facts := List.replicate current.arity Fact.top
+  let pruned : CasePrune.Outcome :=
+    if passes.casePrune then
+      CasePrune.runWithFacts declarations summaries owner current facts
+        current.body
+    else
+      { code := current.body, removedAlternatives := 0, collapsedCases := 0,
+        materializedFetches := 0 }
+  have htop : EnvironmentHolds declarations store facts environment := by
+    simpa [facts, hlength] using
+      (EnvironmentHolds.top_replicate declarations store environment)
+  have hpruned : runCode ctx fuel current store environment pruned.code =
+      .ok sourceOut := by
+    cases hcase : passes.casePrune with
+    | false => simpa [pruned, hcase] using hrun
+    | true =>
+        have heq := CasePrune.runCode_runWithFacts_eq hpost hctx hcurrent htop
+          (input := current.body) (fuel := fuel)
+        simpa [pruned, hcase] using heq.trans hrun
+  let forwarded : FetchForward.Outcome :=
+    if passes.fetchForward then
+      FetchForward.runWithFacts declarations summaries owner current facts
+        pruned.code
+    else
+      { code := pruned.code, changes := {} }
+  have hforwarded :
+      runCode ctx fuel current store environment forwarded.code =
+        .ok sourceOut := by
+    cases hfetch : passes.fetchForward with
+    | false => simpa [forwarded, hfetch] using hpruned
+    | true =>
+        have heq := FetchForward.runCode_runWithFacts_eq hpost hctx hcurrent
+          htop (input := pruned.code) (fuel := fuel)
+        simpa [forwarded, hfetch] using heq.trans hpruned
+  let destroyed : Destroy.Outcome :=
+    if passes.destroy then
+      Destroy.runWithFacts declarations summaries owner current facts
+        forwarded.code
+    else
+      { code := forwarded.code, changes := {} }
+  have hdestroyed :
+      runCode ctx fuel current store environment destroyed.code =
+        .ok sourceOut := by
+    cases hdestroy : passes.destroy with
+    | false => simpa [destroyed, hdestroy] using hforwarded
+    | true =>
+        have hrefines := Destroy.runCode_runWithFacts_success hpost hctx
+          hcurrent htop hforwarded
+        simpa [destroyed, hdestroy] using hrefines
+  cases hpap : passes.papFuse with
+  | false =>
+      obtain ⟨targetOut, htargetRun, hiso⟩ :=
+        runCode_historyIso base henvironment hdestroyed
+      exact ⟨targetOut, by
+        simpa [rewriteCode, facts, pruned, forwarded, destroyed, hpap]
+          using htargetRun, hiso⟩
+  | true =>
+      obtain ⟨targetOut, htargetRun, hiso⟩ :=
+        PAPFuse.runCode_runWithFacts_refines hpost hctx hcurrent base
+          henvironment htop hdestroyed
+      exact ⟨targetOut, by
+        simpa [rewriteCode, facts, pruned, forwarded, destroyed, hpap]
+          using htargetRun, hiso⟩
+
+/-- Closing the rewritten current-frame fixed point turns the composed local
+rewrite into the function obligation required by `AbstractEnvironment`. -/
+theorem rewriteCode_bodyRefines
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current)) :
+    FunctionBodyRefines ctx current
+      { current with body :=
+          (rewriteCode passes declarations summaries owner current
+            (List.replicate current.arity Fact.top) current.body).code } :=
+  FunctionBodyRefines.ofStatic
+    (rewriteCode_staticBodyRefines hpost hctx hcurrent) rfl rfl
+
+/-- Every old-keyed declaration lookup is preserved by the composed logical
+environment, with rewritten functions related by their local body theorem. -/
+theorem abstractEnvironment_rewriteCtx
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} (hctx : ctx.decls = declarations) :
+    AbstractEnvironment ctx (rewriteCtx passes declarations summaries ctx) := by
+  constructor
+  · rfl
+  · intro address arity hsource
+    have hdeclaration : declarations address = some (.extern arity) := by
+      rw [← hctx]
+      exact hsource
+    simp [rewriteCtx, rewriteDeclEnv, hdeclaration, rewriteDeclaration]
+  · intro address source hsource
+    have hdeclaration : declarations address = some (.fn source) := by
+      rw [← hctx]
+      exact hsource
+    let target : FnDef :=
+      { source with body :=
+          (rewriteCode passes declarations summaries address source
+            (List.replicate source.arity Fact.top) source.body).code }
+    refine ⟨target, ?_, rfl, rfl, rfl, ?_⟩
+    · simp [rewriteCtx, rewriteDeclEnv, hdeclaration,
+        rewriteDeclaration, target]
+    · exact rewriteCode_bodyRefines hpost hctx hdeclaration
+
+/-- Successful evaluation is preserved after logically replacing every
+stored function by the composed owner-sensitive rewrite. -/
+theorem runCode_rewriteCtx_refines
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {current : FnDef} {left right : Store} {fuel : Nat}
+    {leftEnvironment rightEnvironment : List RVal}
+    {input : Code} {sourceOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (heap : HeapHistoryIso left right)
+    (henvironments : RValsIso heap.locRel
+      leftEnvironment rightEnvironment)
+    (hrun : runCode ctx fuel current left leftEnvironment input =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runCode (rewriteCtx passes declarations summaries ctx) fuel current right
+          rightEnvironment input = .ok targetOut ∧
+        RunHistoryIso heap sourceOut targetOut :=
+  runCode_abstractEnvironment
+    (abstractEnvironment_rewriteCtx hpost hctx) heap henvironments hrun
+
+def rewriteEntries (passes : Passes) (declarations : DeclEnv)
+    (summaries : SummaryEnv) (entries : List (Address × Decl)) :
+    List (Address × Decl) :=
+  entries.map fun entry =>
+    (entry.1,
+      (rewriteDeclaration passes declarations summaries entry.1 entry.2).1)
+
+def declarationsChanges (passes : Passes) (declarations : DeclEnv)
+    (summaries : SummaryEnv) (entries : List (Address × Decl)) : Changes :=
+  entries.foldl
+    (fun total entry =>
+      total.add
+        (rewriteDeclaration passes declarations summaries entry.1 entry.2).2)
+    {}
+
+private theorem find?_rewriteEntries
+    (passes : Passes) (declarations : DeclEnv) (summaries : SummaryEnv)
+    (address : Address) :
+    ∀ entries : List (Address × Decl),
+      (rewriteEntries passes declarations summaries entries).find?
+          (fun entry => entry.1 == address) =
+        (entries.find? (fun entry => entry.1 == address)).map
+          (fun entry =>
+            (entry.1,
+              (rewriteDeclaration passes declarations summaries address
+                entry.2).1)) := by
+  intro entries
+  induction entries with
+  | nil => rfl
+  | cons entry rest ih =>
+      rcases entry with ⟨entryAddress, declaration⟩
+      simp only [rewriteEntries, List.map_cons, List.find?_cons]
+      by_cases hsame : entryAddress == address
+      · have haddress : entryAddress = address := beq_iff_eq.mp hsame
+        subst entryAddress
+        simp
+      · simp only [hsame]
+        exact ih
+
+/-- Mapping a concrete declaration list realizes the composed logical
+old-keyed environment. -/
+theorem envOfList_rewriteEntries
+    (passes : Passes) (declarations : DeclEnv) (summaries : SummaryEnv)
+    (entries : List (Address × Decl)) :
+    Env.ofList (rewriteEntries passes declarations summaries entries) =
+      fun address =>
+        (Env.ofList entries address).map
+          (fun declaration =>
+            (rewriteDeclaration passes declarations summaries address
+              declaration).1) := by
+  funext address
+  unfold Env.ofList
+  rw [find?_rewriteEntries]
+  cases hentry : entries.find? (fun entry => entry.1 == address) with
+  | none => rfl
+  | some entry =>
+      rcases entry with ⟨entryAddress, declaration⟩
+      have hsame := List.find?_some hentry
+      have haddress : entryAddress = address := beq_iff_eq.mp hsame
+      subst entryAddress
+      rfl
+
+/-- Main code has no stored declaration owner.  Case pruning retains its
+fixed-environment compatibility traversal.  Fetch forwarding, destruction,
+and PAP fusion use the all-zero address only as the fail-soft `callSelf`
+analysis owner; ordinary heap operations, direct calls, PAPs, and applies are
+unaffected by that placeholder. -/
+def rewriteMain (passes : Passes) (declarations : DeclEnv)
+    (summaries : SummaryEnv) (main : Code) : CodeOutcome :=
+  let pruned : CasePrune.Outcome :=
+    if passes.casePrune then
+      CasePrune.runRecursive declarations summaries main
+    else
+      { code := main
+        removedAlternatives := 0
+        collapsedCases := 0
+        materializedFetches := 0 }
+  let current : FnDef := ⟨0, .shared, false, pruned.code⟩
+  let forwarded : FetchForward.Outcome :=
+    if passes.fetchForward && (summaries default).isNone then
+      FetchForward.runWithFacts declarations summaries default current []
+        pruned.code
+    else
+      { code := pruned.code, changes := {} }
+  let destroyed : Destroy.Outcome :=
+    if passes.destroy && (summaries default).isNone then
+      Destroy.runWithFacts declarations summaries default current []
+        forwarded.code
+    else
+      { code := forwarded.code, changes := {} }
+  let fused : PAPFuse.Outcome :=
+    if passes.papFuse && (summaries default).isNone then
+      PAPFuse.runWithFacts declarations summaries default current []
+        destroyed.code
+    else
+      { code := destroyed.code, changes := {} }
+  { code := fused.code
+    changes :=
+      { casePrune := pruned.changes
+        fetchForward := forwarded.changes
+        destroy := destroyed.changes
+        papFuse := fused.changes } }
+
+/-- The canonical entry history for a fresh top-level execution. -/
+def emptyHistoryIso : HeapHistoryIso ({} : Store) {} :=
+  HeapHistoryIso.refl {} (by
+    intro location box hbox
+    simp [Store.get?] at hbox)
+
+/-- After recursive case pruning, the guarded owner-sensitive phases are
+static rewrites of the zero-arity main frame.  If the sentinel owner has a
+summary, all three phases are skipped; otherwise successful self analysis is
+impossible and their general owner-compatible theorems apply. -/
+theorem rewriteMain_staticBodyRefines
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {main : Code}
+    (hctx : ctx.decls = declarations) :
+    let pruned : CasePrune.Outcome :=
+      if passes.casePrune then
+        CasePrune.runRecursive declarations summaries main
+      else
+        { code := main
+          removedAlternatives := 0
+          collapsedCases := 0
+          materializedFetches := 0 }
+    let source : FnDef := ⟨0, .shared, false, pruned.code⟩
+    StaticFunctionBodyRefines ctx source
+      { source with body :=
+          (rewriteMain passes declarations summaries main).code } := by
+  let pruned : CasePrune.Outcome :=
+    if passes.casePrune then
+      CasePrune.runRecursive declarations summaries main
+    else
+      { code := main
+        removedAlternatives := 0
+        collapsedCases := 0
+        materializedFetches := 0 }
+  let source : FnDef := ⟨0, .shared, false, pruned.code⟩
+  change StaticFunctionBodyRefines ctx source
+    { source with body :=
+        (rewriteMain passes declarations summaries main).code }
+  intro fuel store environment sourceOut base hlength henvironment hrun
+  have hempty : environment = [] := by
+    cases environment with
+    | nil => rfl
+    | cons value rest => simp at hlength
+  subst environment
+  cases hsummary : summaries default with
+  | some summary =>
+      obtain ⟨targetOut, htargetRun, hiso⟩ :=
+        runCode_historyIso base henvironment hrun
+      exact ⟨targetOut, by
+        simpa [rewriteMain, source, pruned, hsummary] using htargetRun, hiso⟩
+  | none =>
+      let forwarded : FetchForward.Outcome :=
+        if passes.fetchForward then
+          FetchForward.runWithFacts declarations summaries default source []
+            pruned.code
+        else
+          { code := pruned.code, changes := {} }
+      have hforwarded :
+          runCode ctx fuel source store [] forwarded.code = .ok sourceOut := by
+        cases hfetch : passes.fetchForward with
+        | false => simpa [forwarded, hfetch] using hrun
+        | true =>
+            have heq :=
+              FetchForward.runCode_runWithFacts_eq_ownerCompatible hpost hctx
+                (.inr hsummary) EnvironmentHolds.nil
+                (current := source) (store := store)
+                (input := pruned.code) (fuel := fuel)
+            simpa [forwarded, hfetch] using heq.trans hrun
+      let destroyed : Destroy.Outcome :=
+        if passes.destroy then
+          Destroy.runWithFacts declarations summaries default source []
+            forwarded.code
+        else
+          { code := forwarded.code, changes := {} }
+      have hdestroyed :
+          runCode ctx fuel source store [] destroyed.code = .ok sourceOut := by
+        cases hdestroy : passes.destroy with
+        | false => simpa [destroyed, hdestroy] using hforwarded
+        | true =>
+            have hrefines :=
+              Destroy.runCode_runWithFacts_success_ownerCompatible hpost hctx
+                (.inr hsummary) EnvironmentHolds.nil hforwarded
+            simpa [destroyed, hdestroy] using hrefines
+      cases hpap : passes.papFuse with
+      | false =>
+          obtain ⟨targetOut, htargetRun, hiso⟩ :=
+            runCode_historyIso base henvironment hdestroyed
+          exact ⟨targetOut, by
+            simpa [rewriteMain, source, pruned, forwarded, destroyed, hpap,
+              hsummary] using htargetRun, hiso⟩
+      | true =>
+          obtain ⟨targetOut, htargetRun, hiso⟩ :=
+            PAPFuse.runCode_runWithFacts_refines_ownerCompatible hpost hctx
+              (.inr hsummary) base henvironment EnvironmentHolds.nil
+              hdestroyed
+          exact ⟨targetOut, by
+            simpa [rewriteMain, source, pruned, forwarded, destroyed, hpap,
+              hsummary] using htargetRun, hiso⟩
+
+/-- Rewriting top-level main preserves every successful fresh execution,
+including dynamic re-entry through `callSelf`. -/
+theorem runMain_rewriteMain_refines
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {main : Code} {fuel : Nat} {sourceOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (hrun : runMain ctx main fuel = .ok sourceOut) :
+    ∃ targetOut,
+      runMain ctx (rewriteMain passes declarations summaries main).code fuel =
+          .ok targetOut ∧
+        RunHistoryIso emptyHistoryIso sourceOut targetOut := by
+  let pruned : CasePrune.Outcome :=
+    if passes.casePrune then
+      CasePrune.runRecursive declarations summaries main
+    else
+      { code := main
+        removedAlternatives := 0
+        collapsedCases := 0
+        materializedFetches := 0 }
+  have hpruned : runMain ctx pruned.code fuel = .ok sourceOut := by
+    cases hcase : passes.casePrune with
+    | false => simpa [pruned, hcase] using hrun
+    | true =>
+        have heq := CasePrune.runMain_runRecursive_eq hpost
+          (input := main) (fuel := fuel) hctx
+        simpa [pruned, hcase] using heq.trans hrun
+  let source : FnDef := ⟨0, .shared, false, pruned.code⟩
+  let target : FnDef :=
+    { source with body :=
+        (rewriteMain passes declarations summaries main).code }
+  have hstatic : StaticFunctionBodyRefines ctx source target := by
+    change StaticFunctionBodyRefines ctx source target
+    exact rewriteMain_staticBodyRefines (passes := passes) hpost
+      (main := main) hctx
+  have hbody : FunctionBodyRefines ctx source target :=
+    FunctionBodyRefines.ofStatic hstatic rfl rfl
+  obtain ⟨targetOut, htargetRun, hiso⟩ :=
+    hbody emptyHistoryIso rfl RValsIso.nil
+      (by simpa [runMain, source] using hpruned)
+  exact ⟨targetOut, by
+    simpa [runMain, target] using htargetRun, hiso⟩
+
+private theorem emptyHistoryIso_compose_extends :
+    emptyHistoryIso.Extends (emptyHistoryIso.trans emptyHistoryIso) := by
+  intro left right hrel
+  have hbound := emptyHistoryIso.left_bound hrel
+  simp at hbound
+
+/-- Logical whole-program refinement before content readdressing.  Main and
+all stored declarations are rewritten together; successful results are
+preserved modulo allocation history. -/
+theorem runMain_rewriteProgram_refines
+    {passes : Passes} {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {main : Code} {fuel : Nat} {sourceOut : Store × RVal}
+    (hctx : ctx.decls = declarations)
+    (hrun : runMain ctx main fuel = .ok sourceOut) :
+    ∃ targetOut,
+      runMain (rewriteCtx passes declarations summaries ctx)
+          (rewriteMain passes declarations summaries main).code fuel =
+        .ok targetOut ∧
+      RunHistoryIso emptyHistoryIso sourceOut targetOut := by
+  obtain ⟨middleOut, hmiddleRun, hmainIso⟩ :=
+    runMain_rewriteMain_refines (passes := passes) hpost hctx hrun
+  obtain ⟨targetOut, htargetRun, hctxIso⟩ :=
+    runCode_rewriteCtx_refines (passes := passes) hpost hctx emptyHistoryIso
+      RValsIso.nil (by simpa [runMain] using hmiddleRun)
+  refine ⟨targetOut, by simpa [runMain] using htargetRun, ?_⟩
+  exact RunHistoryIso.weaken emptyHistoryIso_compose_extends
+    (hmainIso.trans hctxIso)
+
+structure Outcome where
+  result : ReaddressAll.Result
+  changes : Changes
+
+/-- Apply checked rooted reachability after all body rewrites but before the
+single content-address rebuild.  A disabled pass retains every row. -/
+def selectReachable (passes : Passes) (entries : List (Address × Decl))
+    (main : Code) : Reachability.Outcome :=
+  if passes.reachability then
+    Reachability.run passes.roots entries main
+  else
+    { entries
+      certificate := Reachability.produce entries main passes.roots
+      accepted := false
+      removedDeclarations := 0 }
+
+/-- Checked reachability preserves the complete logical-program result; the
+disabled branch is literal equality. -/
+theorem runMain_selectReachable_eq (passes : Passes)
+    (entries : List (Address × Decl)) (main : Code)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain
+        { decls := Env.ofList (selectReachable passes entries main).entries
+          oracle }
+        main fuel =
+      runMain { decls := Env.ofList entries, oracle } main fuel := by
+  cases hreach : passes.reachability with
+  | false => simp [selectReachable, hreach]
+  | true =>
+      simpa [selectReachable, hreach] using
+        Reachability.runMain_run_eq passes.roots entries main oracle fuel
+
+/-- Compose enabled checked consumers and rebuild the addressed graph once. -/
+def rebuildProgram (passes : Passes) (reserved : List Address)
+    (program : List ReaddressAll.Artifact) (summaries : SummaryEnv)
+    (main : Code) : Except String Outcome := do
+  let declarations := declarationEntries program
+  let environment := programDeclEnv program
+  let rewritten := rewriteEntries passes environment summaries declarations
+  let declarationDelta :=
+    declarationsChanges passes environment summaries declarations
+  let rewrittenMain := rewriteMain passes environment summaries main
+  let reachable := selectReachable passes rewritten rewrittenMain.code
+  let result ← ReaddressAll.rebuild reserved reachable.entries
+    rewrittenMain.code
+  return ⟨result,
+    (declarationDelta.add rewrittenMain.changes).add
+      { removedDeclarations := reachable.removedDeclarations }⟩
+
+/-- Project the exact graph-rebuild equation from a successful composed pass. -/
+theorem rebuild_of_rebuildProgram_eq_ok
+    {passes : Passes} {reserved : List Address}
+    {program : List ReaddressAll.Artifact} {summaries : SummaryEnv}
+    {main : Code} {outcome : Outcome}
+    (hrun : rebuildProgram passes reserved program summaries main =
+      .ok outcome) :
+    ReaddressAll.rebuild reserved
+        (selectReachable passes
+          (rewriteEntries passes (programDeclEnv program) summaries
+            (declarationEntries program))
+          (rewriteMain passes (programDeclEnv program) summaries main).code).entries
+        (rewriteMain passes (programDeclEnv program) summaries main).code =
+      .ok outcome.result := by
+  unfold rebuildProgram at hrun
+  simp only [bind, Except.bind] at hrun
+  cases hrebuild : ReaddressAll.rebuild reserved
+      (selectReachable passes
+        (rewriteEntries passes (programDeclEnv program) summaries
+          (declarationEntries program))
+        (rewriteMain passes (programDeclEnv program) summaries main).code).entries
+      (rewriteMain passes (programDeclEnv program) summaries main).code with
+  | error message =>
+      rw [hrebuild] at hrun
+      contradiction
+  | ok result =>
+      rw [hrebuild] at hrun
+      have houtcome :
+          (⟨result,
+            ((declarationsChanges passes (programDeclEnv program) summaries
+              (declarationEntries program)).add
+              (rewriteMain passes (programDeclEnv program) summaries
+                main).changes).add
+              { removedDeclarations :=
+                  (selectReachable passes
+                    (rewriteEntries passes (programDeclEnv program) summaries
+                      (declarationEntries program))
+                    (rewriteMain passes (programDeclEnv program) summaries
+                      main).code).removedDeclarations }⟩ : Outcome) = outcome := by
+        injection hrun
+      have hresult : result = outcome.result :=
+        congrArg Outcome.result houtcome
+      exact congrArg Except.ok hresult
+
+/-- The concrete declaration rows used by rebuilding implement the HPT
+program environment. -/
+theorem envOfList_declarationEntries
+    (program : List ReaddressAll.Artifact) :
+    Env.ofList (declarationEntries program) = programDeclEnv program :=
+  CasePrune.envOfList_declarationEntries program
+
+/-- Old-keyed source context paired with the oracle pullback of an exact
+rebuild. -/
+def rebuildOriginalCtx (result : ReaddressAll.Result)
+    (rewritten : List (Address × Decl)) (declarations : DeclEnv)
+    (oracle : Address → List RVal → Option RVal) : Ctx :=
+  { decls := declarations
+    oracle := (result.rebuildSourceCtx rewritten oracle).oracle }
+
+/-- One successful logical rewrite followed by one exact content-address
+rebuild preserves the source result modulo heap allocation history and maps
+the rewritten store's embedded declaration addresses into the rebuilt graph. -/
+theorem runMain_rebuild_rewriteProgram
+    {passes : Passes} {reserved : List Address}
+    {entries : List (Address × Decl)}
+    {declarations : DeclEnv} {summaries : SummaryEnv} {main : Code}
+    {result : ReaddressAll.Result} {sourceOut : Store × RVal}
+    (hentries : Env.ofList entries = declarations)
+    (hpost : LocalPostFixpoint declarations summaries)
+    (hrebuild : ReaddressAll.rebuild reserved
+      (selectReachable passes
+        (rewriteEntries passes declarations summaries entries)
+        (rewriteMain passes declarations summaries main).code).entries
+      (rewriteMain passes declarations summaries main).code = .ok result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000)
+    (hrun : runMain
+      (rebuildOriginalCtx result
+        (selectReachable passes
+          (rewriteEntries passes declarations summaries entries)
+          (rewriteMain passes declarations summaries main).code).entries
+        declarations oracle)
+      main fuel = .ok sourceOut) :
+    ∃ targetOut,
+      runMain (result.addressedCtx oracle) result.main fuel =
+          .ok
+            (Readdress.Store.mapAddresses
+              (result.rebuildRename
+                (selectReachable passes
+                  (rewriteEntries passes declarations summaries entries)
+                  (rewriteMain passes declarations summaries main).code).entries)
+              targetOut.1,
+            targetOut.2) ∧
+        RunHistoryIso emptyHistoryIso sourceOut targetOut := by
+  let rewritten := rewriteEntries passes declarations summaries entries
+  let rewrittenMain := rewriteMain passes declarations summaries main
+  let reachable := selectReachable passes rewritten rewrittenMain.code
+  let before := rebuildOriginalCtx result reachable.entries declarations oracle
+  have hbefore : before.decls = declarations := rfl
+  have hctx : rewriteCtx passes declarations summaries before =
+      { decls := Env.ofList rewritten, oracle := before.oracle } := by
+    simp [rewriteCtx, before, rewritten, rebuildOriginalCtx,
+      envOfList_rewriteEntries, hentries]
+    funext address
+    rfl
+  obtain ⟨targetOut, htargetRun, hiso⟩ :=
+    runMain_rewriteProgram_refines (passes := passes) hpost hbefore hrun
+  have hfullSource :
+      runMain { decls := Env.ofList rewritten, oracle := before.oracle }
+          rewrittenMain.code fuel = .ok targetOut := by
+    rw [← hctx]
+    simpa [rewrittenMain] using htargetRun
+  have hfilteredSource :
+      runMain
+          { decls := Env.ofList reachable.entries, oracle := before.oracle }
+          rewrittenMain.code fuel = .ok targetOut := by
+    exact (runMain_selectReachable_eq passes rewritten rewrittenMain.code
+      before.oracle fuel).trans hfullSource
+  have htargetSource :
+      runMain (result.rebuildSourceCtx reachable.entries oracle)
+          rewrittenMain.code fuel = .ok targetOut := by
+    simpa [before, reachable, rebuildOriginalCtx,
+      ReaddressAll.Result.rebuildSourceCtx] using hfilteredSource
+  refine ⟨targetOut, ?_, hiso⟩
+  exact ReaddressAll.runMain_exact_success_of_rebuild_eq_ok hrebuild oracle
+    htargetSource
+
+/-- A successful HPT check and successful composed rebuild authorize the
+whole-program refinement theorem exposed by the optimizer pipeline. -/
+theorem runMain_rebuildProgram_of_runWith_eq_ok
+    {passes : Passes} {limits : Limits} {reserved : List Address}
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {analysis : HPT.Result} {main : Code} {outcome : Outcome}
+    {sourceOut : Store × RVal}
+    (hcheck : HPT.runWith limits program certificate = .ok analysis)
+    (hrebuild : rebuildProgram passes reserved program certificate.summaryEnv
+      main = .ok outcome)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000)
+    (hrun : runMain
+      (rebuildOriginalCtx outcome.result
+        (selectReachable passes
+          (rewriteEntries passes (programDeclEnv program)
+            certificate.summaryEnv (declarationEntries program))
+          (rewriteMain passes (programDeclEnv program)
+            certificate.summaryEnv main).code).entries
+        (programDeclEnv program) oracle)
+      main fuel = .ok sourceOut) :
+    ∃ targetOut,
+      runMain (outcome.result.addressedCtx oracle) outcome.result.main fuel =
+          .ok
+            (Readdress.Store.mapAddresses
+              (outcome.result.rebuildRename
+                (selectReachable passes
+                  (rewriteEntries passes (programDeclEnv program)
+                    certificate.summaryEnv (declarationEntries program))
+                  (rewriteMain passes (programDeclEnv program)
+                    certificate.summaryEnv main).code).entries)
+              targetOut.1,
+            targetOut.2) ∧
+        RunHistoryIso emptyHistoryIso sourceOut targetOut := by
+  apply runMain_rebuild_rewriteProgram
+  · exact envOfList_declarationEntries program
+  · exact localPostFixpoint_of_postFixpoint
+      (postFixpoint_of_runWith_eq_ok hcheck)
+  · exact rebuild_of_rebuildProgram_eq_ok hrebuild
+  · exact hrun
+
+/-- Closed-oracle specialization: the source is the ordinary old addressed
+program context. -/
+theorem runMain_rebuildProgram_of_runWith_eq_ok_defaultOracle
+    {passes : Passes} {limits : Limits} {reserved : List Address}
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {analysis : HPT.Result} {main : Code} {outcome : Outcome}
+    {sourceOut : Store × RVal}
+    (hcheck : HPT.runWith limits program certificate = .ok analysis)
+    (hrebuild : rebuildProgram passes reserved program certificate.summaryEnv
+      main = .ok outcome)
+    (fuel : Nat := 100000)
+    (hrun : runMain { decls := programDeclEnv program } main fuel =
+      .ok sourceOut) :
+    ∃ targetOut,
+      runMain (outcome.result.addressedCtx (fun _ _ => none))
+          outcome.result.main fuel =
+        .ok
+          (Readdress.Store.mapAddresses
+            (outcome.result.rebuildRename
+              (selectReachable passes
+                (rewriteEntries passes (programDeclEnv program)
+                  certificate.summaryEnv (declarationEntries program))
+                (rewriteMain passes (programDeclEnv program)
+                  certificate.summaryEnv main).code).entries)
+            targetOut.1,
+          targetOut.2) ∧
+      RunHistoryIso emptyHistoryIso sourceOut targetOut := by
+  simpa [rebuildOriginalCtx, ReaddressAll.Result.rebuildSourceCtx] using
+    (runMain_rebuildProgram_of_runWith_eq_ok hcheck hrebuild
+      (fun _ _ => none) fuel hrun)
+
+end Ix.Compiler.IxIR1.HPT.OptimizeProgram
diff --git a/Ix/Compiler/IxIR1/HPTProduce.lean b/Ix/Compiler/IxIR1/HPTProduce.lean
new file mode 100644
index 000000000..346ce5d69
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTProduce.lean
@@ -0,0 +1,334 @@
+import Ix.Compiler.IxIR1.HPTSound
+
+/-!
+# Deterministic bounded HPT certificate production
+
+The checker deliberately trusts no producer.  This module supplies a canonical
+in-process producer for callers that do not have an external analysis result.
+It follows the dependency order already committed to by `ReaddressAll`: each
+ordinary declaration or mutual SCC is solved from bottom against final prior
+summaries, using synchronous inflationary rounds inside the artifact.
+
+Both local and whole-schedule round counts are explicit resources. Exhausting
+either round budget, or exceeding a finite-shape, field-vector, or coordinate
+budget during iteration, widens only the current artifact's function rows to
+`top`. The finished certificate still crosses the ordinary untrusted `runWith`
+checker, so the schedule and its fallback are outside the trusted proof
+boundary.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT
+
+open Ix.Compiler.Ixon (Address)
+
+/-- Independent resource controls for deterministic production and final
+checking.  `maxRounds` bounds the sum of transfer rounds across all artifacts;
+`maxRoundsPerArtifact` prevents one recursive SCC from consuming it all. -/
+structure ProducerLimits where
+  checker : Limits := {}
+  maxRoundsPerArtifact : Nat := 256
+  maxRounds : Nat := 64 * 1024
+  deriving BEq, Repr
+
+def defaultProducerLimits : ProducerLimits := {}
+
+/-- Observable deterministic schedule statistics. `widenedArtifacts` counts
+artifacts forced to their conservative function facts by a round, shape, field,
+or coordinate budget; it does not count a naturally inferred `top`. -/
+structure ProducerStats where
+  rounds : Nat := 0
+  widenedArtifacts : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+/-- A generated certificate together with the checked materialization and the
+kernel equality witnessing that it crossed the same untrusted boundary as an
+external candidate.  The equality is erased at runtime. -/
+structure Production (limits : Limits)
+    (program : List ReaddressAll.Artifact) where
+  certificate : Certificate
+  result : Result
+  stats : ProducerStats
+  checked : runWith limits program certificate = .ok result
+
+private def seedFact : Decl → Fact
+  | .extern _ => Fact.scalar
+  | .fn _ => Fact.bottom
+
+private def fallbackFact : Decl → Fact
+  | .extern _ => Fact.scalar
+  | .fn _ => Fact.top
+
+private def seedMembers (members : List (Address × Decl)) :
+    List (Address × Fact) :=
+  members.map fun member => (member.1, seedFact member.2)
+
+private def fallbackMembers (members : List (Address × Decl)) :
+    List (Address × Fact) :=
+  members.map fun member => (member.1, fallbackFact member.2)
+
+private def hasFunction (members : List (Address × Decl)) : Bool :=
+  members.any fun member =>
+    match member.2 with
+    | .fn _ => true
+    | .extern _ => false
+
+private def insertMembers (index : AddressEnv.Index Fact)
+    (members : List (Address × Fact)) : AddressEnv.Index Fact :=
+  members.foldl (fun current member =>
+    current.insert member.1 member.2) index
+
+private def producerEnforce (label : String) (actual limit : Nat) :
+    Except String Unit :=
+  if actual ≤ limit then .ok ()
+  else .error s!"HPT producer {label} budget exceeded: {actual} > {limit}"
+
+private structure ProducedPayload where
+  shapes : Nat := 0
+  fields : Nat := 0
+
+private def checkProducedFact (limits : Limits) (fact : Fact) :
+    Except String ProducedPayload := do
+  let payload ← checkFactPayload limits fact
+  return { shapes := payload.shapes, fields := payload.fields }
+
+/-- Validate only the changing fact payload.  Full program/certificate counts
+are checked once before scheduling; rescanning the entire graph per round would
+turn an SCC-local solver back into a whole-program quadratic loop. -/
+private def checkProducedMembers (limits : Limits) (priorShapes priorFields : Nat)
+    (members : List (Address × Fact)) : Except String ProducedPayload := do
+  let mut shapes := priorShapes
+  let mut fields := priorFields
+  for member in members do
+    let payload ← checkProducedFact limits member.2
+    shapes := shapes + payload.shapes
+    fields := fields + payload.fields
+    producerEnforce "total-shape" shapes limits.maxShapes
+    producerEnforce "total-constructor-field" fields limits.maxFields
+  return { shapes, fields }
+
+private def stepMembers (declarations : DeclEnv) (summaries : SummaryEnv) :
+    List (Address × Decl) → List (Address × Fact) →
+      Except String (List (Address × Fact))
+  | [], [] => .ok []
+  | (address, declaration) :: declarations',
+      (claimedAddress, previous) :: previous' => do
+      if address != claimedAddress then
+        throw "internal: HPT producer member alignment drift"
+      let next ← match declaration with
+        | .extern _ => pure Fact.scalar
+        | .fn function => do
+            let inferred ← inferFunction declarations summaries address function
+            pure (previous.join inferred)
+      let rest ← stepMembers declarations summaries declarations' previous'
+      return (address, next) :: rest
+  | _, _ => .error "internal: HPT producer member arity drift"
+
+private structure ArtifactSolution where
+  members : List (Address × Fact)
+  summaries : AddressEnv.Index Fact
+  totalShapes : Nat
+  totalFields : Nat
+  rounds : Nat
+  remainingRounds : Nat
+  widened : Bool
+
+private def fallbackSolution (baseIndex : AddressEnv.Index Fact)
+    (members : List (Address × Decl)) (priorShapes priorFields rounds remaining : Nat) :
+    ArtifactSolution :=
+  let facts := fallbackMembers members
+  { members := facts
+    summaries := insertMembers baseIndex facts
+    totalShapes := priorShapes
+    totalFields := priorFields
+    rounds
+    remainingRounds := remaining
+    widened := true }
+
+private def solveArtifactAux (limits : ProducerLimits)
+    (declarations : DeclEnv) (baseIndex : AddressEnv.Index Fact)
+    (declarationMembers : List (Address × Decl))
+    (priorShapes priorFields : Nat) :
+    Nat → Nat → List (Address × Fact) → Nat →
+      Except String ArtifactSolution
+  | 0, remaining, _, rounds =>
+      .ok (fallbackSolution baseIndex declarationMembers priorShapes priorFields rounds
+        remaining)
+  | _ + 1, 0, _, rounds =>
+      .ok (fallbackSolution baseIndex declarationMembers priorShapes priorFields rounds 0)
+  | localRemaining + 1, totalRemaining + 1, current, rounds => do
+      let currentIndex := insertMembers baseIndex current
+      let next ← stepMembers declarations (AddressEnv.lookup currentIndex)
+        declarationMembers current
+      let rounds := rounds + 1
+      match checkProducedMembers limits.checker priorShapes priorFields next with
+      | .error _ =>
+          return fallbackSolution baseIndex declarationMembers priorShapes
+            priorFields rounds totalRemaining
+      | .ok payload =>
+          if next == current then
+            return { members := next
+                     summaries := insertMembers baseIndex next
+                     totalShapes := payload.shapes
+                     totalFields := payload.fields
+                     rounds
+                     remainingRounds := totalRemaining
+                     widened := false }
+          else
+            solveArtifactAux limits declarations baseIndex declarationMembers
+              priorShapes priorFields localRemaining totalRemaining next rounds
+
+private def solveArtifact (limits : ProducerLimits)
+    (declarations : DeclEnv) (baseIndex : AddressEnv.Index Fact)
+    (members : List (Address × Decl)) (priorShapes priorFields remainingRounds : Nat) :
+    Except String ArtifactSolution :=
+  let seed := seedMembers members
+  if hasFunction members then
+    solveArtifactAux limits declarations baseIndex members priorShapes priorFields
+      limits.maxRoundsPerArtifact remainingRounds seed 0
+  else
+    .ok
+      { members := seed
+        summaries := insertMembers baseIndex seed
+        totalShapes := priorShapes
+        totalFields := priorFields
+        rounds := 0
+        remainingRounds
+        widened := false }
+
+namespace Producer
+
+/-- Artifact-local producer output used by the persistent cache scheduler.
+The summary index already contains the returned rows. -/
+structure ArtifactResult where
+  candidate : CandidateArtifact
+  summaries : AddressEnv.Index Fact
+  totalShapes : Nat
+  totalFields : Nat
+  rounds : Nat
+  remainingRounds : Nat
+  widened : Bool
+
+/-- Extend an already-built summary index with one exact artifact row set. -/
+def extendSummaries (summaries : AddressEnv.Index Fact)
+    (members : List (Address × Fact)) : AddressEnv.Index Fact :=
+  insertMembers summaries members
+
+/-- Apply the producer's finite-payload gates to a cache hit while retaining
+the totals accumulated by earlier dependency artifacts. -/
+def validatePayload (limits : Limits) (priorShapes priorFields : Nat)
+    (members : List (Address × Fact)) : Except String (Nat × Nat) := do
+  let payload ← checkProducedMembers limits priorShapes priorFields members
+  return (payload.shapes, payload.fields)
+
+/-- Produce exactly one dependency-ordered program artifact against fixed
+prior summaries. This is the same solver used by whole-program production; it
+is exposed so cache misses can rebuild locally instead of discarding unrelated
+hits. -/
+def produceArtifactWith (limits : ProducerLimits) (declarations : DeclEnv)
+    (summaries : AddressEnv.Index Fact) (program : ReaddressAll.Artifact)
+    (priorShapes priorFields remainingRounds : Nat) :
+    Except String ArtifactResult := do
+  let solved ← solveArtifact limits declarations summaries
+    (programMembers program) priorShapes priorFields remainingRounds
+  let candidate : CandidateArtifact :=
+    { programIdentity := Ix.Compiler.IxIR1.HPT.programIdentity program
+      members := solved.members }
+  pure ⟨candidate, solved.summaries, solved.totalShapes, solved.totalFields,
+    solved.rounds, solved.remainingRounds, solved.widened⟩
+
+end Producer
+
+private structure ScheduleState where
+  artifactsRev : List CandidateArtifact := []
+  summaries : AddressEnv.Index Fact := AddressEnv.build []
+  totalShapes : Nat := 0
+  totalFields : Nat := 0
+  rounds : Nat := 0
+  remainingRounds : Nat := 0
+  widenedArtifacts : Nat := 0
+
+private def solveArtifacts (limits : ProducerLimits)
+    (declarations : DeclEnv) :
+    List ReaddressAll.Artifact → ScheduleState → Except String ScheduleState
+  | [], state => .ok state
+  | artifact :: artifacts, state => do
+      let members := programMembers artifact
+      let solved ← solveArtifact limits declarations state.summaries members
+        state.totalShapes state.totalFields state.remainingRounds
+      let candidate : CandidateArtifact :=
+        { programIdentity := programIdentity artifact
+          members := solved.members }
+      solveArtifacts limits declarations artifacts
+        { artifactsRev := candidate :: state.artifactsRev
+          summaries := solved.summaries
+          totalShapes := solved.totalShapes
+          totalFields := solved.totalFields
+          rounds := state.rounds + solved.rounds
+          remainingRounds := solved.remainingRounds
+          widenedArtifacts := state.widenedArtifacts +
+            (if solved.widened then 1 else 0) }
+
+/-- Produce the deterministic candidate and its schedule statistics.  The
+result has exact program/artifact/member layout but has not yet been assigned
+cache identities; use `produceWith` at an external boundary. -/
+def produceCertificateWith (limits : ProducerLimits)
+    (program : List ReaddressAll.Artifact) :
+    Except String (Certificate × ProducerStats) := do
+  let _ ← preflight limits.checker program (Certificate.top program)
+  let declarations := programDeclEnv program
+  let state ← solveArtifacts limits declarations program
+    { remainingRounds := limits.maxRounds }
+  return (⟨state.artifactsRev.reverse⟩,
+    { rounds := state.rounds
+      widenedArtifacts := state.widenedArtifacts })
+
+def produceCertificate (program : List ReaddressAll.Artifact) :
+    Except String (Certificate × ProducerStats) :=
+  produceCertificateWith defaultProducerLimits program
+
+/-- Produce, validate, and content-address one deterministic HPT result. -/
+def produceWith (limits : ProducerLimits)
+    (program : List ReaddressAll.Artifact) :
+    Except String (Production limits.checker program) := do
+  let (certificate, stats) ← produceCertificateWith limits program
+  match hrun : runWith limits.checker program certificate with
+  | .error error => .error error
+  | .ok result =>
+      .ok { certificate, result, stats, checked := hrun }
+
+def produce (program : List ReaddressAll.Artifact) :
+    Except String (Production defaultProducerLimits.checker program) :=
+  produceWith defaultProducerLimits program
+
+namespace Production
+
+theorem postFixpoint {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program) :
+    production.certificate.postFixpoint program = true :=
+  postFixpoint_of_runWith_eq_ok production.checked
+
+theorem semanticAudit {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program) :
+    production.result.semanticAudit = true :=
+  semanticAudit_of_runWith_eq_ok production.checked
+
+/-- Every generated function row has the same concrete evaluator guarantee as
+an externally supplied accepted certificate. -/
+theorem functionSummary_sound
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    (production : Production limits program)
+    {ctx : Ctx} {address : Address} {function : FnDef} {claimed : Fact}
+    {arguments : List RVal} {store outputStore : Store}
+    {outputValue : RVal} {fuel : Nat}
+    (hctx : ctx.decls = programDeclEnv program)
+    (hdeclaration : programDeclEnv program address = some (.fn function))
+    (hsummary : production.certificate.summaryEnv address = some claimed)
+    (hinvoke : invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds (programDeclEnv program) outputStore outputValue := by
+  exact functionSummary_sound_of_runWith_eq_ok production.checked hctx
+    hdeclaration hsummary hinvoke
+
+end Production
+
+end Ix.Compiler.IxIR1.HPT
diff --git a/Ix/Compiler/IxIR1/HPTSound.lean b/Ix/Compiler/IxIR1/HPTSound.lean
new file mode 100644
index 000000000..0d9fbd092
--- /dev/null
+++ b/Ix/Compiler/IxIR1/HPTSound.lean
@@ -0,0 +1,2989 @@
+import Ix.Compiler.IxIR1.HPT
+
+/-!
+# Semantic soundness of IxIR₁ heap-points-to facts
+
+This module gives the executable HPT domain a concrete meaning over the
+IxIR₁ evaluator's stores and runtime values. A finite constructor/PAP fact
+describes a live node exactly; a detailed constructor additionally describes
+its exact field vector recursively. `unknownHeap` deliberately accepts every
+location, including a stale alias: primitive transfer forgets old finite heap
+identities before interpreting the continuation, so store mutation cannot
+invalidate an environment invariant.
+-/
+
+namespace Ix.Compiler.IxIR1.HPT
+
+open Ix.Compiler.Ixon (Address)
+
+mutual
+
+/-- Recursive concrete interpretation of one field heap shape. -/
+inductive FieldShape.Holds (declarations : DeclEnv) (store : Store) :
+    FieldShape → RVal → Prop where
+  | ctorIdentity
+      (hget : store.get? location = some box)
+      (hnode : box.node = .ctorN identity fields) :
+      FieldShape.Holds declarations store (.ctor identity none) (.loc location)
+  | ctorDetailed
+      (hget : store.get? location = some box)
+      (hnode : box.node = .ctorN identity fields)
+      (hfields : FieldFactsHold declarations store facts fields.toList) :
+      FieldShape.Holds declarations store
+        (.ctor identity (some facts)) (.loc location)
+  | pap
+      (hget : store.get? location = some box)
+      (hdeclaration : declarations function = some declaration)
+      (hnode : box.node =
+        .papN function (declArity declaration) arguments)
+      (hsize : arguments.size = supplied)
+      (hproper : supplied < declArity declaration) :
+      FieldShape.Holds declarations store
+        (.pap function supplied) (.loc location)
+
+/-- Recursive fact interpretation. Scalar and unknown cases remain explicit;
+finite heap evidence points to one recursively interpreted shape. -/
+inductive FieldFact.Holds (declarations : DeclEnv) (store : Store) :
+    FieldFact → RVal → Prop where
+  | lit (hscalar : fact.mayScalar = true) :
+      FieldFact.Holds declarations store fact (.lit literal)
+  | erased (hscalar : fact.mayScalar = true) :
+      FieldFact.Holds declarations store fact .erased
+  | unknown (hunknown : fact.unknownHeap = true) :
+      FieldFact.Holds declarations store fact (.loc location)
+  | heap (hmember : shape ∈ fact.shapes)
+      (hshape : FieldShape.Holds declarations store shape (.loc location)) :
+      FieldFact.Holds declarations store fact (.loc location)
+
+/-- Pointwise interpretation of an exact recursive field vector. -/
+inductive FieldFactsHold (declarations : DeclEnv) (store : Store) :
+    List FieldFact → List RVal → Prop where
+  | nil : FieldFactsHold declarations store [] []
+  | cons : fact.Holds declarations store value →
+      FieldFactsHold declarations store facts values →
+      FieldFactsHold declarations store (fact :: facts) (value :: values)
+
+end
+
+private theorem FieldFact.shape_size_lt {fact : FieldFact}
+    {shape : FieldShape} (h : shape ∈ fact.shapes) :
+    sizeOf shape < sizeOf fact := by
+  have hlist := List.sizeOf_lt_of_mem h
+  cases fact with
+  | mk mayScalar unknownHeap shapes =>
+      exact Nat.lt_trans (by simpa using hlist) (by simp_wf)
+
+private theorem FieldShape.exists_le_of_anyLe {left : FieldShape}
+    {rights : List FieldShape} (h : FieldShape.anyLe left rights = true) :
+    ∃ right ∈ rights, left.le right = true := by
+  induction rights with
+  | nil => simp [FieldShape.anyLe] at h
+  | cons right rights ih =>
+      simp only [FieldShape.anyLe, Bool.or_eq_true] at h
+      rcases h with hhead | htail
+      · exact ⟨right, by simp, hhead⟩
+      · obtain ⟨found, hmember, hle⟩ := ih htail
+        exact ⟨found, by simp [hmember], hle⟩
+
+private theorem FieldShape.exists_le_of_allLe
+    {lefts rights : List FieldShape} {left : FieldShape}
+    (hall : FieldShape.allLe lefts rights = true) (hleft : left ∈ lefts) :
+    ∃ right ∈ rights, left.le right = true := by
+  induction lefts with
+  | nil => contradiction
+  | cons head tail ih =>
+      simp only [FieldShape.allLe, Bool.and_eq_true] at hall
+      rcases List.mem_cons.mp hleft with rfl | htail
+      · exact FieldShape.exists_le_of_anyLe hall.1
+      · exact ih hall.2 htail
+
+mutual
+
+/-- Recursive field-shape subset preserves its full concrete tree. -/
+theorem FieldShape.holds_of_le {declarations : DeclEnv} {store : Store}
+    {left right : FieldShape} {value : RVal}
+    (hle : left.le right = true)
+    (hleft : left.Holds declarations store value) :
+    right.Holds declarations store value := by
+  cases hleft with
+  | @ctorIdentity location box identity fields hget hnode =>
+      cases right with
+      | ctor rightIdentity rightFields =>
+          cases rightFields with
+          | none =>
+              have hidentity : identity = rightIdentity := by
+                simpa [FieldShape.le.eq_1] using hle
+              subst rightIdentity
+              exact .ctorIdentity hget hnode
+          | some rightFacts =>
+              simp [FieldShape.le.eq_2] at hle
+      | pap _ _ => simp [FieldShape.le] at hle
+  | @ctorDetailed location box identity fields facts hget hnode hfields =>
+      cases right with
+      | ctor rightIdentity rightFields =>
+          cases rightFields with
+          | none =>
+              have hidentity : identity = rightIdentity := by
+                simpa [FieldShape.le.eq_1] using hle
+              subst rightIdentity
+              exact .ctorIdentity hget hnode
+          | some rightFacts =>
+              simp only [FieldShape.le.eq_3, Bool.and_eq_true] at hle
+              have hidentity : identity = rightIdentity :=
+                beq_iff_eq.mp hle.1
+              subst rightIdentity
+              exact .ctorDetailed hget hnode
+                (FieldFactsHold.holds_of_listLe hle.2 hfields)
+      | pap _ _ => simp [FieldShape.le] at hle
+  | @pap location box function declaration arguments supplied hget hdecl hnode
+      hsize hproper =>
+      cases right with
+      | ctor _ _ => simp [FieldShape.le] at hle
+      | pap rightFunction rightSupplied =>
+          simp only [FieldShape.le, Bool.and_eq_true] at hle
+          have hfunction : function = rightFunction := beq_iff_eq.mp hle.1
+          have hsupplied : supplied = rightSupplied := beq_iff_eq.mp hle.2
+          subst rightFunction
+          subst rightSupplied
+          exact .pap hget hdecl hnode hsize hproper
+termination_by sizeOf left
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+/-- Recursive field-fact subset preserves scalar, unknown, and finite-shape
+evidence. -/
+theorem FieldFact.holds_of_le {declarations : DeclEnv} {store : Store}
+    {left right : FieldFact} {value : RVal}
+    (hle : left.le right = true)
+    (hleft : left.Holds declarations store value) :
+    right.Holds declarations store value := by
+  cases hleft with
+  | lit hscalar =>
+      simp [FieldFact.le, hscalar] at hle
+      exact .lit hle.1
+  | erased hscalar =>
+      simp [FieldFact.le, hscalar] at hle
+      exact .erased hle.1
+  | unknown hunknown =>
+      simp [FieldFact.le, hunknown] at hle
+      exact .unknown hle.2
+  | heap hmember hshape =>
+      simp only [FieldFact.le, Bool.and_eq_true] at hle
+      by_cases hunknown : right.unknownHeap = true
+      · exact .unknown hunknown
+      · have hall : FieldShape.allLe left.shapes right.shapes = true := by
+          have hbranch : left.unknownHeap = false ∧
+              FieldShape.allLe left.shapes right.shapes = true := by
+            simpa [hunknown] using hle.2
+          exact hbranch.2
+        obtain ⟨rightShape, hright, hshapeLe⟩ :=
+          FieldShape.exists_le_of_allLe hall hmember
+        exact .heap hright (FieldShape.holds_of_le hshapeLe hshape)
+termination_by sizeOf left
+decreasing_by
+  all_goals subst_vars
+  exact FieldFact.shape_size_lt hmember
+
+/-- Pointwise recursive field-vector subset. -/
+theorem FieldFactsHold.holds_of_listLe {declarations : DeclEnv} {store : Store}
+    {left right : List FieldFact} {values : List RVal}
+    (hle : FieldFact.listLe left right = true)
+    (hleft : FieldFactsHold declarations store left values) :
+    FieldFactsHold declarations store right values := by
+  cases hleft with
+  | nil =>
+      cases right with
+      | nil => exact .nil
+      | cons _ _ => simp [FieldFact.listLe] at hle
+  | @cons leftFact value leftFacts values hhead htail =>
+      cases right with
+      | nil => simp [FieldFact.listLe] at hle
+      | cons rightFact rightFacts =>
+          simp only [FieldFact.listLe, Bool.and_eq_true] at hle
+          exact .cons (FieldFact.holds_of_le hle.1 hhead)
+            (FieldFactsHold.holds_of_listLe hle.2 htail)
+termination_by sizeOf left
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+end
+
+namespace FieldFactsHold
+
+theorem length_eq {declarations : DeclEnv} {store : Store}
+    {facts : List FieldFact} {values : List RVal}
+    (h : FieldFactsHold declarations store facts values) :
+    facts.length = values.length := by
+  cases h with
+  | nil => rfl
+  | cons _ htail => simp [FieldFactsHold.length_eq htail]
+termination_by sizeOf facts
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+theorem holds_of_le {declarations : DeclEnv} {store : Store}
+    {left right : List FieldFact} {values : List RVal}
+    (hle : HeapShape.fieldFactsLe left right = true)
+    (hleft : FieldFactsHold declarations store left values) :
+    FieldFactsHold declarations store right values := by
+  cases hleft with
+  | nil =>
+      cases right with
+      | nil => exact .nil
+      | cons _ _ => simp [HeapShape.fieldFactsLe] at hle
+  | @cons leftFact value leftFacts values hhead htail =>
+      cases right with
+      | nil => simp [HeapShape.fieldFactsLe] at hle
+      | cons rightFact rightFacts =>
+          simp only [HeapShape.fieldFactsLe, Bool.and_eq_true] at hle
+          exact .cons (FieldFact.holds_of_le hle.1 hhead)
+            (FieldFactsHold.holds_of_le hle.2 htail)
+termination_by sizeOf left
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+theorem getOfValue {declarations : DeclEnv} {store : Store}
+    {facts : List FieldFact} {values : List RVal}
+    (h : FieldFactsHold declarations store facts values)
+    {index : Nat} {value : RVal} (hvalue : values[index]? = some value) :
+    ∃ fact, facts[index]? = some fact ∧ fact.Holds declarations store value := by
+  cases h with
+  | nil => simp at hvalue
+  | @cons tailFacts tailValues headFact headValue hhead htail =>
+      cases index with
+      | zero =>
+          simp at hvalue
+          subst value
+          exact ⟨headFact, by simp, hhead⟩
+      | succ index =>
+          simp at hvalue
+          obtain ⟨fact, hfact, hholds⟩ :=
+            FieldFactsHold.getOfValue htail hvalue
+          exact ⟨fact, by simpa, hholds⟩
+termination_by sizeOf facts
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+end FieldFactsHold
+
+namespace HeapShape
+
+/-- Concrete interpretation of one result heap shape. Detailed constructor
+facts additionally validate every stored field in source order. PAP facts bind
+the saturation arity to the declaration environment. -/
+def Holds (declarations : DeclEnv) (store : Store) (value : RVal) :
+    HeapShape → Prop
+  | .ctor identity fieldFacts =>
+      match value with
+      | .loc location =>
+          ∃ box fields,
+            store.get? location = some box ∧
+              box.node = .ctorN identity fields ∧
+              match fieldFacts with
+              | none => True
+              | some facts =>
+                  FieldFactsHold declarations store facts fields.toList
+      | _ => False
+  | .pap function supplied =>
+      match value with
+      | .loc location =>
+          ∃ box arguments declaration,
+            store.get? location = some box ∧
+              declarations function = some declaration ∧
+              box.node = .papN function (declArity declaration) arguments ∧
+              arguments.size = supplied ∧
+              supplied < declArity declaration
+      | _ => False
+
+/-- Shape-level subset preserves the detailed concrete interpretation. -/
+theorem holds_of_le {declarations : DeclEnv} {store : Store}
+    {left right : HeapShape} {value : RVal}
+    (hle : left.le right = true)
+    (hleft : left.Holds declarations store value) :
+    right.Holds declarations store value := by
+  cases left <;> cases right <;> cases value <;>
+    simp only [HeapShape.Holds] at hleft ⊢
+  case ctor.ctor.loc leftIdentity leftFields rightIdentity rightFields location =>
+    simp only [HeapShape.le, Bool.and_eq_true] at hle
+    have hidentity : leftIdentity = rightIdentity := (beq_iff_eq).mp hle.1
+    subst rightIdentity
+    rcases hleft with ⟨box, values, hget, hnode, hfields⟩
+    refine ⟨box, values, hget, hnode, ?_⟩
+    cases rightFields with
+    | none => trivial
+    | some rightFacts =>
+        cases leftFields with
+        | none => simp at hle
+        | some leftFacts =>
+            exact FieldFactsHold.holds_of_le hle.2 hfields
+  case pap.pap.loc leftFunction leftSupplied rightFunction rightSupplied
+      location =>
+    simp only [HeapShape.le, Bool.and_eq_true] at hle
+    have hfunction : leftFunction = rightFunction := (beq_iff_eq).mp hle.1
+    have hsupplied : leftSupplied = rightSupplied := (beq_iff_eq).mp hle.2
+    subst rightFunction
+    subst rightSupplied
+    exact hleft
+  all_goals simp [HeapShape.le] at hle
+
+end HeapShape
+
+namespace Fact
+
+/-- Concrete interpretation of a result-shape fact.  Scalars are literals or
+`erased`; a finite heap fact requires a matching live node. -/
+def Holds (declarations : DeclEnv) (store : Store)
+    (fact : Fact) (value : RVal) : Prop :=
+  match value with
+  | .loc _ =>
+      fact.unknownHeap = true ∨
+        ∃ shape ∈ fact.shapes, shape.Holds declarations store value
+  | .lit _ | .erased => fact.mayScalar = true
+
+@[simp] theorem top_holds (declarations : DeclEnv) (store : Store)
+    (value : RVal) : Fact.top.Holds declarations store value := by
+  cases value <;> simp [Fact.Holds, Fact.top]
+
+@[simp] theorem scalar_holds_iff (declarations : DeclEnv) (store : Store)
+    (value : RVal) :
+    Fact.scalar.Holds declarations store value ↔ value.isScalar = true := by
+  cases value <;> simp [Fact.Holds, Fact.scalar, RVal.isScalar]
+
+theorem heap_holds {declarations : DeclEnv} {store : Store}
+    {shape : HeapShape} {value : RVal}
+    (h : shape.Holds declarations store value) :
+    (Fact.heap shape).Holds declarations store value := by
+  cases value with
+  | loc location =>
+      exact Or.inr ⟨shape, by simp [Fact.heap], h⟩
+  | lit literal => cases shape <;> contradiction
+  | erased => cases shape <;> contradiction
+
+/-- An exact-constructor fact identifies the concrete constructor stored at
+the held location.  This is the small provenance bridge used by consumers
+whose emitted IxIR₂ instruction carries a concrete constructor identity. -/
+theorem exactConstructor?_holds_loc {declarations : DeclEnv} {store : Store}
+    {fact : Fact} {identity : CtorId} {location : Nat}
+    (hexact : fact.exactConstructor? = some identity)
+    (hholds : fact.Holds declarations store (.loc location)) :
+    ∃ box fields,
+      store.get? location = some box ∧
+        box.node = .ctorN identity fields := by
+  obtain ⟨fieldFacts, rfl⟩ := Fact.exactConstructor?_eq_some hexact
+  simp only [Fact.Holds, Bool.false_eq_true, false_or] at hholds
+  obtain ⟨shape, hshape, hholds⟩ := hholds
+  simp only [List.mem_singleton] at hshape
+  subst shape
+  simp only [HeapShape.Holds] at hholds
+  obtain ⟨box, fields, hget, hnode, _⟩ := hholds
+  exact ⟨box, fields, hget, hnode⟩
+
+/-- Executable subset is sound for the concrete interpretation. -/
+theorem holds_of_le {declarations : DeclEnv} {store : Store}
+    {left right : Fact} {value : RVal}
+    (hle : left.le right = true)
+    (hleft : left.Holds declarations store value) :
+    right.Holds declarations store value := by
+  cases value with
+  | lit literal =>
+      simp [Fact.Holds] at hleft ⊢
+      simp [Fact.le] at hle
+      exact hle.1.resolve_left (by simpa [hleft])
+  | erased =>
+      simp [Fact.Holds] at hleft ⊢
+      simp [Fact.le] at hle
+      exact hle.1.resolve_left (by simpa [hleft])
+  | loc location =>
+      simp only [Fact.Holds] at hleft ⊢
+      simp [Fact.le] at hle
+      rcases hleft with hunknown | ⟨shape, hshape, hholds⟩
+      · exact Or.inl (hle.2.resolve_right (by simpa [hunknown]))
+      · rcases hle.2 with hright | ⟨_, hall⟩
+        · exact Or.inl hright
+        · obtain ⟨rightShape, hrightShape, hshapeLe⟩ := hall shape hshape
+          exact Or.inr ⟨rightShape, hrightShape,
+            HeapShape.holds_of_le hshapeLe hholds⟩
+
+private theorem holds_join_left {declarations : DeclEnv} {store : Store}
+    {left right : Fact} {value : RVal}
+    (hleft : left.Holds declarations store value) :
+    (left.join right).Holds declarations store value := by
+  cases value with
+  | lit literal =>
+      change left.mayScalar = true at hleft
+      change (left.join right).mayScalar = true
+      unfold Fact.join Fact.normalize
+      split <;> simp [hleft]
+  | erased =>
+      change left.mayScalar = true at hleft
+      change (left.join right).mayScalar = true
+      unfold Fact.join Fact.normalize
+      split <;> simp [hleft]
+  | loc location =>
+      simp only [Fact.Holds] at hleft ⊢
+      cases hleftUnknown : left.unknownHeap with
+      | true => simp [Fact.join, Fact.normalize, hleftUnknown]
+      | false =>
+          cases hrightUnknown : right.unknownHeap with
+          | true => simp [Fact.join, Fact.normalize, hrightUnknown]
+          | false =>
+              rcases hleft with hunknown | ⟨shape, hmem, hholds⟩
+              · simp [hleftUnknown] at hunknown
+              · refine Or.inr ⟨shape, ?_, hholds⟩
+                simpa [Fact.join, Fact.normalize, hleftUnknown,
+                  hrightUnknown] using
+                    HeapShape.mem_normalize_of_mem
+                      (List.mem_append_left right.shapes hmem)
+
+private theorem holds_join_right {declarations : DeclEnv} {store : Store}
+    {left right : Fact} {value : RVal}
+    (hright : right.Holds declarations store value) :
+    (left.join right).Holds declarations store value := by
+  cases value with
+  | lit literal =>
+      change right.mayScalar = true at hright
+      change (left.join right).mayScalar = true
+      unfold Fact.join Fact.normalize
+      split <;> simp [hright]
+  | erased =>
+      change right.mayScalar = true at hright
+      change (left.join right).mayScalar = true
+      unfold Fact.join Fact.normalize
+      split <;> simp [hright]
+  | loc location =>
+      simp only [Fact.Holds] at hright ⊢
+      cases hleftUnknown : left.unknownHeap with
+      | true => simp [Fact.join, Fact.normalize, hleftUnknown]
+      | false =>
+          cases hrightUnknown : right.unknownHeap with
+          | true => simp [Fact.join, Fact.normalize, hrightUnknown]
+          | false =>
+              rcases hright with hunknown | ⟨shape, hmem, hholds⟩
+              · simp [hrightUnknown] at hunknown
+              · refine Or.inr ⟨shape, ?_, hholds⟩
+                simpa [Fact.join, Fact.normalize, hleftUnknown,
+                  hrightUnknown] using
+                    HeapShape.mem_normalize_of_mem
+                      (List.mem_append_right left.shapes hmem)
+
+theorem holds_join {declarations : DeclEnv} {store : Store}
+    {left right : Fact} {value : RVal} :
+    left.Holds declarations store value ∨
+      right.Holds declarations store value →
+    (left.join right).Holds declarations store value
+  | Or.inl h => holds_join_left h
+  | Or.inr h => holds_join_right h
+
+theorem holds_joins_of_mem {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {fact : Fact} {value : RVal}
+    (hmember : fact ∈ facts)
+    (hholds : fact.Holds declarations store value) :
+    (Fact.joins facts).Holds declarations store value := by
+  induction facts with
+  | nil => contradiction
+  | cons head tail ih =>
+      simp only [Fact.joins]
+      rcases List.mem_cons.mp hmember with hsame | hmember
+      · subst head
+        exact Fact.holds_join (Or.inl hholds)
+      · exact Fact.holds_join (Or.inr (ih hmember))
+
+/-- Forgetting heap identities transports a fact across an arbitrary store
+change.  This is the key alias-safety lemma for primitive operations. -/
+theorem forgetHeap_holds {declarations : DeclEnv} {before after : Store}
+    {fact : Fact} {value : RVal}
+    (h : fact.Holds declarations before value) :
+    fact.forgetHeap.Holds declarations after value := by
+  cases value with
+  | lit literal =>
+      change fact.mayScalar = true at h
+      change fact.forgetHeap.mayScalar = true
+      unfold Fact.forgetHeap
+      split <;> simp [h]
+  | erased =>
+      change fact.mayScalar = true at h
+      change fact.forgetHeap.mayScalar = true
+      unfold Fact.forgetHeap
+      split <;> simp [h]
+  | loc location =>
+      cases fact with
+      | mk mayScalar unknownHeap shapes =>
+          cases unknownHeap with
+          | true => simp [Fact.Holds, Fact.forgetHeap]
+          | false =>
+              simp only [Fact.Holds, Bool.false_eq_true, false_or] at h
+              rcases h with ⟨shape, hmem, hholds⟩
+              cases shapes with
+              | nil => contradiction
+              | cons head tail => simp [Fact.Holds, Fact.forgetHeap]
+
+end Fact
+
+namespace HeapShape
+
+/-- Converting a result heap shape into a field shape preserves every
+recursive constructor refinement. -/
+theorem toFieldShape_holds {declarations : DeclEnv} {store : Store}
+    {shape : HeapShape} {value : RVal}
+    (h : shape.Holds declarations store value) :
+    shape.toFieldShape.Holds declarations store value := by
+  cases shape with
+  | ctor identity facts =>
+      cases value with
+      | loc location =>
+          rcases h with ⟨box, fields, hget, hnode, hfields⟩
+          cases facts with
+          | none => exact .ctorIdentity hget hnode
+          | some facts => exact .ctorDetailed hget hnode hfields
+      | lit _ => contradiction
+      | erased => contradiction
+  | pap function supplied =>
+      cases value with
+      | loc location =>
+          rcases h with
+            ⟨box, arguments, declaration, hget, hdecl, hnode, hsize, hproper⟩
+          exact .pap hget hdecl hnode hsize hproper
+      | lit _ => contradiction
+      | erased => contradiction
+
+end HeapShape
+
+namespace FieldShape
+
+theorem toHeapShape_holds {declarations : DeclEnv} {store : Store}
+    {shape : FieldShape} {value : RVal}
+    (h : shape.Holds declarations store value) :
+    shape.toHeapShape.Holds declarations store value := by
+  cases h with
+  | @ctorIdentity location box identity fields hget hnode =>
+      exact ⟨box, fields, hget, hnode, trivial⟩
+  | @ctorDetailed location box identity fields facts hget hnode hfields =>
+      exact ⟨box, fields, hget, hnode, hfields⟩
+  | @pap location box function declaration arguments supplied hget hdecl
+      hnode hsize hproper =>
+      exact ⟨box, arguments, declaration, hget, hdecl, hnode, hsize, hproper⟩
+
+end FieldShape
+
+namespace FieldFact
+
+/-- Storing a result in one constructor field preserves every bounded nested
+refinement. -/
+theorem ofFact_holds {declarations : DeclEnv} {store : Store}
+    {fact : Fact} {value : RVal}
+    (h : fact.Holds declarations store value) :
+    (FieldFact.ofFact fact).Holds declarations store value := by
+  cases value with
+  | lit literal =>
+      change fact.mayScalar = true at h
+      apply FieldFact.Holds.lit
+      cases hunknown : fact.unknownHeap <;>
+        simp [FieldFact.ofFact, FieldFact.normalize, h, hunknown]
+  | erased =>
+      change fact.mayScalar = true at h
+      apply FieldFact.Holds.erased
+      cases hunknown : fact.unknownHeap <;>
+        simp [FieldFact.ofFact, FieldFact.normalize, h, hunknown]
+  | loc location =>
+      simp only [Fact.Holds] at h
+      rcases h with hunknown | ⟨shape, hshape, hholds⟩
+      · apply FieldFact.Holds.unknown
+        simp [FieldFact.ofFact, FieldFact.normalize, hunknown]
+      · cases hunknown : fact.unknownHeap with
+        | true =>
+            apply FieldFact.Holds.unknown
+            simp [FieldFact.ofFact, FieldFact.normalize, hunknown]
+        | false =>
+            apply FieldFact.Holds.heap
+                (shape := shape.toFieldShape)
+            · have hmapped : shape.toFieldShape ∈
+                  fact.shapes.map HeapShape.toFieldShape :=
+                List.mem_map.mpr ⟨shape, hshape, rfl⟩
+              simpa [FieldFact.ofFact, FieldFact.normalize, hunknown] using
+                FieldShape.mem_normalize_of_mem hmapped
+            · exact HeapShape.toFieldShape_holds hholds
+
+/-- A fetched field fact soundly re-roots its value while preserving every
+bounded nested constructor refinement. -/
+theorem toFact_holds {declarations : DeclEnv} {store : Store}
+    {fact : FieldFact} {value : RVal}
+    (h : fact.Holds declarations store value) :
+    fact.toFact.Holds declarations store value := by
+  cases h with
+  | lit hscalar =>
+      change fact.toFact.mayScalar = true
+      cases hunknown : fact.unknownHeap <;>
+        simp [FieldFact.toFact, Fact.normalize, hscalar, hunknown]
+  | erased hscalar =>
+      change fact.toFact.mayScalar = true
+      cases hunknown : fact.unknownHeap <;>
+        simp [FieldFact.toFact, Fact.normalize, hscalar, hunknown]
+  | unknown hunknown =>
+      simp only [Fact.Holds]
+      left
+      simp [FieldFact.toFact, Fact.normalize, hunknown]
+  | heap hmember hshape =>
+      simp only [Fact.Holds]
+      cases hunknown : fact.unknownHeap with
+      | true =>
+          left
+          simp [FieldFact.toFact, Fact.normalize, hunknown]
+      | false =>
+          right
+          refine ⟨_, ?_, FieldShape.toHeapShape_holds hshape⟩
+          simpa [FieldFact.toFact, Fact.normalize, hunknown] using
+            HeapShape.mem_normalize_of_mem
+              (List.mem_map.mpr ⟨_, hmember, rfl⟩)
+
+end FieldFact
+
+namespace Fact
+
+/-- A successful concrete constructor projection is covered by the executable
+recursive-field fetch transfer. -/
+theorem fetch_holds {declarations : DeclEnv} {store : Store}
+    {fact : Fact} {location field : Nat} {box : NodeBox}
+    {identity : CtorId} {fields : Array RVal} {value : RVal}
+    (hfact : fact.Holds declarations store (.loc location))
+    (hget : store.get? location = some box)
+    (hnode : box.node = .ctorN identity fields)
+    (hfield : fields[field]? = some value) :
+    (fact.fetch field).Holds declarations store value := by
+  cases hunknown : fact.unknownHeap with
+  | true =>
+      simp [Fact.fetch, hunknown]
+  | false =>
+      simp only [Fact.Holds, hunknown, Bool.false_eq_true, false_or] at hfact
+      obtain ⟨shape, hmember, hshape⟩ := hfact
+      have hmapped : shape.fetch field ∈
+          fact.shapes.map (HeapShape.fetch field) :=
+        List.mem_map.mpr ⟨shape, hmember, rfl⟩
+      simp only [Fact.fetch, hunknown, Bool.false_eq_true, if_false]
+      apply Fact.holds_joins_of_mem hmapped
+      cases shape with
+      | pap function supplied =>
+          rcases hshape with
+            ⟨shapeBox, arguments, declaration, hshapeGet, _, hshapeNode, _⟩
+          have hboxEq : shapeBox = box := by
+            exact Option.some.inj (hshapeGet.symm.trans hget)
+          subst shapeBox
+          rw [hnode] at hshapeNode
+          contradiction
+      | ctor shapeIdentity fieldFacts =>
+          rcases hshape with
+            ⟨shapeBox, shapeFields, hshapeGet, hshapeNode, hfields⟩
+          have hboxEq : shapeBox = box := by
+            exact Option.some.inj (hshapeGet.symm.trans hget)
+          subst shapeBox
+          rw [hnode] at hshapeNode
+          injection hshapeNode with hidentity hshapeFields
+          subst shapeIdentity
+          subst shapeFields
+          cases fieldFacts with
+          | none => exact Fact.top_holds declarations store value
+          | some fieldFacts =>
+              have hfieldList : fields.toList[field]? = some value := by
+                simpa using hfield
+              obtain ⟨fieldFact, hfieldFact, hfieldHolds⟩ :=
+                FieldFactsHold.getOfValue hfields hfieldList
+              simp only [HeapShape.fetch, hfieldFact]
+              exact FieldFact.toFact_holds hfieldHolds
+
+end Fact
+
+/-! ## Abstract/concrete environments -/
+
+/-- Pointwise interpretation of an abstract de Bruijn environment. -/
+inductive EnvironmentHolds (declarations : DeclEnv) (store : Store) :
+    List Fact → List RVal → Prop where
+  | nil : EnvironmentHolds declarations store [] []
+  | cons : fact.Holds declarations store value →
+      EnvironmentHolds declarations store facts values →
+      EnvironmentHolds declarations store (fact :: facts) (value :: values)
+
+namespace EnvironmentHolds
+
+theorem top_replicate (declarations : DeclEnv) (store : Store)
+    (values : List RVal) :
+    EnvironmentHolds declarations store
+      (List.replicate values.length Fact.top) values := by
+  induction values with
+  | nil => exact .nil
+  | cons value values ih =>
+      simpa [List.replicate_succ] using EnvironmentHolds.cons
+        (Fact.top_holds declarations store value) ih
+
+theorem forgetHeap {declarations : DeclEnv} {before after : Store}
+    {facts : List Fact} {values : List RVal}
+    (h : EnvironmentHolds declarations before facts values) :
+    EnvironmentHolds declarations after (facts.map Fact.forgetHeap) values := by
+  induction h with
+  | nil => exact .nil
+  | cons hhead htail ih =>
+      exact .cons (Fact.forgetHeap_holds hhead) ih
+
+theorem get? {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal}
+    (h : EnvironmentHolds declarations store facts values)
+    {index : Nat} {fact : Fact} {value : RVal}
+    (hfact : facts[index]? = some fact)
+    (hvalue : values[index]? = some value) :
+    fact.Holds declarations store value := by
+  induction h generalizing index fact value with
+  | nil => simp at hfact
+  | @cons headFact headValue tailFacts tailValues hhead htail ih =>
+      cases index with
+      | zero =>
+          simp at hfact hvalue
+          subst fact
+          subst value
+          exact hhead
+      | succ index =>
+          simp at hfact hvalue
+          exact ih hfact hvalue
+
+theorem append_top {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal}
+    (front : List RVal)
+    (h : EnvironmentHolds declarations store facts values) :
+    EnvironmentHolds declarations store
+      (List.replicate front.length Fact.top ++ facts)
+      (front ++ values) := by
+  induction front with
+  | nil => simpa using h
+  | cons value tail ih =>
+      change EnvironmentHolds declarations store
+        (Fact.top :: (List.replicate tail.length Fact.top ++ facts))
+        (value :: (tail ++ values))
+      exact EnvironmentHolds.cons
+        (Fact.top_holds declarations store value) ih
+
+theorem append {declarations : DeclEnv} {store : Store}
+    {leftFacts rightFacts : List Fact} {leftValues rightValues : List RVal}
+    (left : EnvironmentHolds declarations store leftFacts leftValues)
+    (right : EnvironmentHolds declarations store rightFacts rightValues) :
+    EnvironmentHolds declarations store (leftFacts ++ rightFacts)
+      (leftValues ++ rightValues) := by
+  induction left with
+  | nil => simpa using right
+  | cons hhead htail ih =>
+      exact .cons hhead ih
+
+theorem length_eq {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal}
+    (h : EnvironmentHolds declarations store facts values) :
+    facts.length = values.length := by
+  induction h with
+  | nil => rfl
+  | cons _ _ ih => simp [ih]
+
+/-- Reversing both sides preserves the pointwise environment relation. -/
+theorem reverse {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal}
+    (h : EnvironmentHolds declarations store facts values) :
+    EnvironmentHolds declarations store facts.reverse values.reverse := by
+  induction h with
+  | nil => exact .nil
+  | cons hhead htail ih =>
+      simp only [List.reverse_cons]
+      exact ih.append (.cons hhead .nil)
+
+end EnvironmentHolds
+
+namespace FieldFactsHold
+
+/-- Re-root a detailed constructor's source-order field facts as ordinary
+facts suitable for case binders. -/
+theorem toEnvironment {declarations : DeclEnv} {store : Store}
+    {facts : List FieldFact} {values : List RVal}
+    (h : FieldFactsHold declarations store facts values) :
+    EnvironmentHolds declarations store
+      (facts.map FieldFact.toFact) values := by
+  cases h with
+  | nil => exact .nil
+  | cons hhead htail =>
+      exact .cons (FieldFact.toFact_holds hhead)
+        (FieldFactsHold.toEnvironment htail)
+termination_by sizeOf facts
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+end FieldFactsHold
+
+namespace Fact
+
+private theorem mem_vectorHeads {vectors : List (List Fact)}
+    {fact : Fact} {facts : List Fact}
+    (h : fact :: facts ∈ vectors) : fact ∈ vectorHeads vectors := by
+  induction vectors with
+  | nil => contradiction
+  | cons vector vectors ih =>
+      rcases List.mem_cons.mp h with hsame | htail
+      · subst vector
+        simp [vectorHeads]
+      · cases vector with
+        | nil => simpa [vectorHeads] using ih htail
+        | cons head tail =>
+            exact List.mem_cons.mpr (Or.inr (ih htail))
+
+private theorem mem_vectorTails {vectors : List (List Fact)}
+    {fact : Fact} {facts : List Fact}
+    (h : fact :: facts ∈ vectors) : facts ∈ vectorTails vectors := by
+  induction vectors with
+  | nil => contradiction
+  | cons vector vectors ih =>
+      rcases List.mem_cons.mp h with hsame | htail
+      · subst vector
+        simp [vectorTails]
+      · cases vector with
+        | nil => simpa [vectorTails] using ih htail
+        | cons head tail =>
+            exact List.mem_cons.mpr (Or.inr (ih htail))
+
+end Fact
+
+namespace EnvironmentHolds
+
+/-- Any concrete candidate vector is covered by the executable pointwise join
+of its equally sized candidate family. -/
+theorem joinFieldVectors_of_mem {declarations : DeclEnv} {store : Store}
+    {fieldCount : Nat} {vectors : List (List Fact)}
+    {facts : List Fact} {values : List RVal}
+    (hmember : facts ∈ vectors) (hlength : facts.length = fieldCount)
+    (hholds : EnvironmentHolds declarations store facts values) :
+    EnvironmentHolds declarations store
+      (Fact.joinFieldVectors fieldCount vectors) values := by
+  induction hholds generalizing fieldCount vectors with
+  | nil =>
+      cases fieldCount with
+      | zero => exact .nil
+      | succ fieldCount => simp at hlength
+  | @cons fact value facts values hhead htail ih =>
+      cases fieldCount with
+      | zero => simp at hlength
+      | succ fieldCount =>
+          simp only [List.length_cons, Nat.succ.injEq] at hlength
+          exact .cons
+            (Fact.holds_joins_of_mem (Fact.mem_vectorHeads hmember) hhead)
+            (ih (Fact.mem_vectorTails hmember) hlength)
+
+end EnvironmentHolds
+
+namespace Fact
+
+/-- A successful constructor case receives the joined facts computed for its
+actual field vector, in the evaluator's reversed binding order. -/
+theorem caseFields_ctor_holds {declarations : DeclEnv} {store : Store}
+    {fact : Fact} {location : Nat} {box : NodeBox}
+    {identity : CtorId} {fields : Array RVal}
+    (peelNat : Bool) (cidx fieldCount : Nat)
+    (hfact : fact.Holds declarations store (.loc location))
+    (hget : store.get? location = some box)
+    (hnode : box.node = .ctorN identity fields)
+    (hcidx : identity.cidx = cidx)
+    (hfieldCount : fields.size = fieldCount) :
+    EnvironmentHolds declarations store
+      (fact.caseFields peelNat cidx fieldCount) fields.toList.reverse := by
+  cases hunknown : fact.unknownHeap with
+  | true =>
+      have htop := EnvironmentHolds.top_replicate declarations store
+        fields.toList.reverse
+      have hlength : fields.toList.reverse.length = fieldCount := by
+        simpa using hfieldCount
+      simpa [Fact.caseFields, hunknown, hlength] using htop
+  | false =>
+      simp only [Fact.Holds, hunknown, Bool.false_eq_true, false_or] at hfact
+      obtain ⟨shape, hshapeMember, hshapeHolds⟩ := hfact
+      let vector := shape.caseFields cidx fieldCount
+      have hvectorHolds : EnvironmentHolds declarations store vector
+          fields.toList.reverse := by
+        cases shape with
+        | pap function supplied =>
+            rcases hshapeHolds with
+              ⟨shapeBox, arguments, declaration, hshapeGet, _, hshapeNode, _⟩
+            have hboxEq : shapeBox = box :=
+              Option.some.inj (hshapeGet.symm.trans hget)
+            subst shapeBox
+            rw [hnode] at hshapeNode
+            contradiction
+        | ctor shapeIdentity shapeFieldFacts =>
+            rcases hshapeHolds with
+              ⟨shapeBox, shapeFields, hshapeGet, hshapeNode, hshapeFacts⟩
+            have hboxEq : shapeBox = box :=
+              Option.some.inj (hshapeGet.symm.trans hget)
+            subst shapeBox
+            rw [hnode] at hshapeNode
+            injection hshapeNode with hidentity hshapeFields
+            subst shapeIdentity
+            subst shapeFields
+            have hcidxBool : identity.cidx == cidx :=
+              (beq_iff_eq).mpr hcidx
+            cases shapeFieldFacts with
+            | none =>
+                have htop := EnvironmentHolds.top_replicate declarations
+                  store fields.toList.reverse
+                have hlength : fields.toList.reverse.length = fieldCount := by
+                  simpa using hfieldCount
+                simpa [vector, HeapShape.caseFields, hcidxBool, hlength]
+                  using htop
+            | some fieldFacts =>
+                have hfieldsLength : fields.toList.length = fieldCount := by
+                  simpa using hfieldCount
+                have hfactLength : fieldFacts.length = fieldCount :=
+                  hshapeFacts.length_eq.trans hfieldsLength
+                have hfieldsEnvironment := hshapeFacts.toEnvironment.reverse
+                simpa [vector, HeapShape.caseFields, hcidxBool, hfactLength]
+                  using hfieldsEnvironment
+      let heapCandidates :=
+        fact.shapes.map (HeapShape.caseFields cidx fieldCount)
+      let candidates :=
+        if fact.mayScalar then
+          scalarCaseFields peelNat cidx fieldCount :: heapCandidates
+        else
+          heapCandidates
+      have hheapMember : vector ∈ heapCandidates :=
+        List.mem_map.mpr ⟨shape, hshapeMember, rfl⟩
+      have hcandidate : vector ∈ candidates := by
+        dsimp [candidates]
+        split
+        · exact List.mem_cons.mpr (Or.inr hheapMember)
+        · exact hheapMember
+      have hlength : vector.length = fieldCount := by
+        rw [hvectorHolds.length_eq]
+        simpa using hfieldCount
+      have hjoined := EnvironmentHolds.joinFieldVectors_of_mem
+        hcandidate hlength hvectorHolds
+      simpa [Fact.caseFields, hunknown, heapCandidates, candidates]
+        using hjoined
+
+/-- A successfully peeled successor binds its predecessor as an exact scalar
+even when heap shapes are also possible. -/
+theorem caseFields_natSucc_holds {declarations : DeclEnv} {store : Store}
+    {fact : Fact} {value : Nat}
+    (hfact : fact.Holds declarations store (.lit (.nat (value + 1)))) :
+    EnvironmentHolds declarations store
+      (fact.caseFields true 1 1) [.lit (.nat value)] := by
+  change fact.mayScalar = true at hfact
+  cases hunknown : fact.unknownHeap with
+  | true =>
+      simpa [Fact.caseFields, hunknown] using
+        (EnvironmentHolds.cons
+          (Fact.top_holds declarations store (.lit (.nat value)))
+          EnvironmentHolds.nil)
+  | false =>
+      have hscalar : EnvironmentHolds declarations store
+          [Fact.scalar] [.lit (.nat value)] :=
+        .cons (by simp [Fact.Holds, Fact.scalar]) .nil
+      have hjoined := EnvironmentHolds.joinFieldVectors_of_mem
+        (vectors := [Fact.scalar] ::
+          fact.shapes.map (HeapShape.caseFields 1 1))
+        (fieldCount := 1) (facts := [Fact.scalar])
+        (by simp) (by simp) hscalar
+      simpa [Fact.caseFields, hunknown, hfact, scalarCaseFields] using hjoined
+
+end Fact
+
+/-! ## Resolution and store primitives -/
+
+theorem resolveAtom_sound {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal} {atom : Atom}
+    {fact : Fact} {value : RVal}
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : resolveAtomFact facts atom = .ok fact)
+    (hconcrete : resolveAtom values atom = .ok value) :
+    fact.Holds declarations store value := by
+  cases atom with
+  | var index =>
+      unfold resolveAtomFact at habstract
+      unfold resolveAtom at hconcrete
+      cases hfact : facts[index]? with
+      | none => simp [hfact] at habstract
+      | some resolvedFact =>
+          simp only [hfact] at habstract
+          cases hvalue : values[index]? with
+          | none => simp [hvalue] at hconcrete
+          | some resolvedValue =>
+              simp only [hvalue] at hconcrete
+              injection habstract with hfactEq
+              injection hconcrete with hvalueEq
+              subst fact
+              subst value
+              exact henvironment.get? hfact hvalue
+  | lit literal =>
+      simp only [resolveAtomFact, Except.ok.injEq] at habstract
+      simp only [resolveAtom, Except.ok.injEq] at hconcrete
+      subst fact
+      subst value
+      simp [Fact.Holds, Fact.scalar]
+  | erased =>
+      simp only [resolveAtomFact, Except.ok.injEq] at habstract
+      simp only [resolveAtom, Except.ok.injEq] at hconcrete
+      subst fact
+      subst value
+      simp [Fact.Holds, Fact.scalar]
+
+/-- A well-formed abstract environment cannot resolve an atom that the
+pointwise concrete environment fails to resolve. -/
+theorem resolveAtom_complete {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal} {atom : Atom} {fact : Fact}
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : resolveAtomFact facts atom = .ok fact) :
+    ∃ value, resolveAtom values atom = .ok value := by
+  cases atom with
+  | lit literal => exact ⟨.lit literal, rfl⟩
+  | erased => exact ⟨.erased, rfl⟩
+  | var index =>
+      induction henvironment generalizing index fact with
+      | nil => simp [resolveAtomFact] at habstract
+      | @cons tailFacts tailValues headFact headValue hhead htail ih =>
+          cases index with
+          | zero => exact ⟨headValue, by simp [resolveAtom]⟩
+          | succ index =>
+              cases hfact : tailFacts[index]? with
+              | none => simp [resolveAtomFact, hfact] at habstract
+              | some resolved =>
+                  obtain ⟨value, hvalue⟩ := ih (fact := resolved)
+                    (index := index) (by simp [resolveAtomFact, hfact])
+                  unfold resolveAtom at hvalue ⊢
+                  cases hconcrete : tailValues[index]? with
+                  | none => simp [hconcrete] at hvalue
+                  | some resolvedValue =>
+                      simp only [hconcrete, Except.ok.injEq] at hvalue
+                      subst resolvedValue
+                      exact ⟨value, by simp [hconcrete]⟩
+
+private theorem List.resolveAtomFactsFrom_sound
+    {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal}
+    (henvironment : EnvironmentHolds declarations store facts values) :
+    ∀ (atoms : List Atom) (factAccumulator : List Fact)
+      (valueAccumulator : List RVal) (outputFacts : List Fact)
+      (outputValues : List RVal),
+      EnvironmentHolds declarations store factAccumulator valueAccumulator →
+      atoms.foldlM
+        (fun accumulated atom => do
+          pure (accumulated ++ [← resolveAtomFact facts atom]))
+        factAccumulator = .ok outputFacts →
+      atoms.foldlM
+        (fun accumulated atom => do
+          pure (accumulated ++ [← resolveAtom values atom]))
+        valueAccumulator = .ok outputValues →
+      EnvironmentHolds declarations store outputFacts outputValues := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro factAccumulator valueAccumulator outputFacts outputValues
+        haccumulator habstract hconcrete
+      simp only [List.foldlM_nil] at habstract hconcrete
+      injection habstract with hfacts
+      injection hconcrete with hvalues
+      subst outputFacts
+      subst outputValues
+      exact haccumulator
+  | cons atom atoms ih =>
+      intro factAccumulator valueAccumulator outputFacts outputValues
+        haccumulator habstract hconcrete
+      simp only [List.foldlM_cons] at habstract hconcrete
+      cases hafact : resolveAtomFact facts atom with
+      | error error =>
+          rw [hafact] at habstract
+          simp only [bind, Except.bind] at habstract
+          contradiction
+      | ok atomFact =>
+          rw [hafact] at habstract
+          simp only [bind, Except.bind] at habstract
+          cases havalue : resolveAtom values atom with
+          | error error =>
+              rw [havalue] at hconcrete
+              simp only [bind, Except.bind] at hconcrete
+              contradiction
+          | ok atomValue =>
+              rw [havalue] at hconcrete
+              simp only [bind, Except.bind] at hconcrete
+              apply ih (factAccumulator ++ [atomFact])
+                (valueAccumulator ++ [atomValue]) outputFacts outputValues
+              · exact haccumulator.append (.cons
+                  (resolveAtom_sound henvironment hafact havalue) .nil)
+              · exact habstract
+              · exact hconcrete
+
+theorem resolveAtomFacts_sound
+    {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal} {atoms : Array Atom}
+    {argumentFacts : List Fact} {argumentValues : List RVal}
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : resolveAtomFacts facts atoms = .ok argumentFacts)
+    (hconcrete : resolveAtoms values atoms = .ok argumentValues) :
+    EnvironmentHolds declarations store argumentFacts argumentValues := by
+  unfold resolveAtomFacts at habstract
+  unfold resolveAtoms at hconcrete
+  rw [← Array.foldlM_toList] at habstract hconcrete
+  exact List.resolveAtomFactsFrom_sound henvironment atoms.toList [] []
+    argumentFacts argumentValues .nil habstract hconcrete
+
+private theorem List.resolveAtomsFrom_length (environment : List RVal) :
+    ∀ (atoms : List Atom) (accumulator output : List RVal),
+      atoms.foldlM
+        (fun accumulated atom => do
+          pure (accumulated ++ [← resolveAtom environment atom]))
+        accumulator = .ok output →
+      output.length = accumulator.length + atoms.length := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro accumulator output h
+      simp only [List.foldlM_nil] at h
+      change Except.ok accumulator = Except.ok output at h
+      injection h with houtput
+      subst output
+      simp
+  | cons atom atoms ih =>
+      intro accumulator output h
+      simp only [List.foldlM_cons] at h
+      cases hatom : resolveAtom environment atom with
+      | error error =>
+          rw [hatom] at h
+          simp only [bind, Except.bind] at h
+          contradiction
+      | ok value =>
+          rw [hatom] at h
+          simp only [bind, Except.bind] at h
+          have htail := ih (accumulator ++ [value]) output h
+          simp only [List.length_append, List.length_singleton] at htail
+          simp only [List.length_cons]
+          omega
+
+private theorem resolveAtoms_length {environment : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (h : resolveAtoms environment atoms = .ok values) :
+    values.length = atoms.size := by
+  unfold resolveAtoms at h
+  rw [← Array.foldlM_toList] at h
+  have := List.resolveAtomsFrom_length environment atoms.toList [] values h
+  simpa using this
+
+private theorem get?_allocNode_new (store : Store)
+    (world : Ixon.Owned) (node : Node) :
+    (store.allocNode world node).1.get? (store.allocNode world node).2 =
+      some ⟨world, 1, node⟩ := by
+  simp [Store.allocNode, Store.get?]
+
+private theorem get?_allocNode_old {store : Store} {world : Ixon.Owned}
+    {node : Node} {location : Nat} {box : NodeBox}
+    (h : store.get? location = some box) :
+    (store.allocNode world node).1.get? location = some box := by
+  have hne : location ≠ store.nodes.size := by
+    intro heq
+    subst location
+    simp [Store.get?] at h
+  simpa [Store.allocNode, Store.get?, Array.getElem?_push, hne] using h
+
+mutual
+
+theorem FieldShape.holds_allocNode {declarations : DeclEnv} {store : Store}
+    {shape : FieldShape} {value : RVal} {world : Ixon.Owned} {node : Node}
+    (h : shape.Holds declarations store value) :
+    shape.Holds declarations (store.allocNode world node).1 value := by
+  cases h with
+  | ctorIdentity hget hnode =>
+      exact .ctorIdentity (get?_allocNode_old hget) hnode
+  | ctorDetailed hget hnode hfields =>
+      exact .ctorDetailed (get?_allocNode_old hget) hnode
+        (FieldFactsHold.allocNode hfields)
+  | pap hget hdecl hnode hsize hproper =>
+      exact .pap (get?_allocNode_old hget) hdecl hnode hsize hproper
+termination_by sizeOf shape
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+theorem FieldFact.holds_allocNode {declarations : DeclEnv} {store : Store}
+    {fact : FieldFact} {value : RVal} {world : Ixon.Owned} {node : Node}
+    (h : fact.Holds declarations store value) :
+    fact.Holds declarations (store.allocNode world node).1 value := by
+  cases h with
+  | lit hscalar => exact .lit hscalar
+  | erased hscalar => exact .erased hscalar
+  | unknown hunknown => exact .unknown hunknown
+  | heap hmember hshape =>
+      exact .heap hmember (FieldShape.holds_allocNode hshape)
+termination_by sizeOf fact
+decreasing_by
+  all_goals subst_vars
+  exact FieldFact.shape_size_lt hmember
+
+theorem FieldFactsHold.allocNode {declarations : DeclEnv} {store : Store}
+    {facts : List FieldFact} {values : List RVal}
+    {world : Ixon.Owned} {node : Node}
+    (h : FieldFactsHold declarations store facts values) :
+    FieldFactsHold declarations (store.allocNode world node).1 facts values := by
+  cases h with
+  | nil => exact .nil
+  | cons hhead htail =>
+      exact .cons (FieldFact.holds_allocNode hhead)
+        (FieldFactsHold.allocNode htail)
+termination_by sizeOf facts
+decreasing_by all_goals subst_vars <;> simp_wf <;> omega
+
+end
+
+namespace EnvironmentHolds
+
+theorem toFieldFactsAllocNode {declarations : DeclEnv} {store : Store}
+    {facts : List Fact} {values : List RVal}
+    {world : Ixon.Owned} {node : Node}
+    (h : EnvironmentHolds declarations store facts values) :
+    FieldFactsHold declarations (store.allocNode world node).1
+      (facts.map FieldFact.ofFact) values := by
+  induction h with
+  | nil => exact .nil
+  | cons hhead htail ih =>
+      exact .cons (FieldFact.holds_allocNode (FieldFact.ofFact_holds hhead)) ih
+
+theorem toFieldFactsForget {declarations : DeclEnv} {before after : Store}
+    {facts : List Fact} {values : List RVal}
+    (h : EnvironmentHolds declarations before facts values) :
+    FieldFactsHold declarations after
+      (facts.map fun fact => FieldFact.ofFact fact.forgetHeap) values := by
+  induction h with
+  | nil => exact .nil
+  | cons hhead htail ih =>
+      exact .cons
+        (FieldFact.ofFact_holds (Fact.forgetHeap_holds (after := after) hhead))
+        ih
+
+end EnvironmentHolds
+
+private theorem nodes_get?_of_get? {store : Store} {location : Nat}
+    {box : NodeBox} (h : store.get? location = some box) :
+    store.nodes[location]? = some (some box) := by
+  rw [Store.get?, Option.bind_eq_some_iff] at h
+  obtain ⟨slot, hslot, hid⟩ := h
+  change slot = some box at hid
+  subst slot
+  exact hslot
+
+private theorem get?_setBox_same {store : Store} {location : Nat}
+    {old new : NodeBox} (h : store.get? location = some old) :
+    (store.setBox location new).get? location = some new := by
+  have hnodes := nodes_get?_of_get? h
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simp [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds, hlt]
+
+private theorem scalar_of_callScalarOracle_eq_ok {ctx : Ctx} {function : Address}
+    {arguments : List RVal} {value : RVal}
+    (h : callScalarOracle ctx function arguments = .ok value) :
+    value.isScalar = true := by
+  unfold callScalarOracle at h
+  split at h
+  · contradiction
+  · split at h
+    · contradiction
+    · split at h
+      · injection h
+        subst value
+        assumption
+      · contradiction
+
+private theorem eq_of_checkResultWorld_eq_ok {world : Ixon.Owned}
+    {input output : Store × RVal}
+    (h : checkResultWorld world input = .ok output) : input = output := by
+  unfold checkResultWorld at h
+  split at h
+  · injection h
+  · contradiction
+
+private theorem List.foldl_cons_eq_reverse_append
+    (values environment : List RVal) :
+    values.foldl (fun current value => value :: current) environment =
+      values.reverse ++ environment := by
+  induction values generalizing environment with
+  | nil => rfl
+  | cons value values ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp [List.reverse_cons, List.append_assoc]
+
+private theorem Array.foldl_cons_eq_reverse_append
+    (fields : Array RVal) (environment : List RVal) :
+    fields.foldl (fun current field => field :: current) environment =
+      fields.toList.reverse ++ environment := by
+  rw [← Array.foldl_toList]
+  exact List.foldl_cons_eq_reverse_append fields.toList environment
+
+/-! ## Local certificate assumption -/
+
+/-- Propositional reading of the function rows in a post-fixpoint.  Every
+claimed function summary contains the result inferred with the same complete
+summary environment. -/
+def LocalPostFixpoint (declarations : DeclEnv) (summaries : SummaryEnv) : Prop :=
+  ∀ address function claimed,
+    declarations address = some (.fn function) →
+    summaries address = some claimed →
+    ∃ inferred,
+      inferFunction declarations summaries address function = .ok inferred ∧
+        inferred.le claimed = true
+
+/-- An analysis owner is semantically usable either when it names the exact
+dynamic current function, or when it has no summary and every attempted
+`callSelf` transfer therefore fails closed.  The second form is the natural
+contract for a top-level main, which has a current frame but no declaration
+row. -/
+def AnalysisOwnerCompatible (declarations : DeclEnv) (summaries : SummaryEnv)
+    (owner : Address) (current : FnDef) : Prop :=
+  declarations owner = some (.fn current) ∨ summaries owner = none
+
+/-! ## Finite shape-fold coverage -/
+
+theorem holds_of_applyShapeFacts_member
+    {declarations : DeclEnv} {store : Store}
+    {step : HeapShape → Except String Fact} {shapes : List HeapShape}
+    {shape : HeapShape} {shapeFact result : Fact} {value : RVal}
+    (hmember : shape ∈ shapes)
+    (hshape : step shape = .ok shapeFact)
+    (hresult : applyShapeFacts step shapes = .ok result)
+    (hholds : shapeFact.Holds declarations store value) :
+    result.Holds declarations store value := by
+  induction shapes generalizing result with
+  | nil => contradiction
+  | cons head tail ih =>
+      simp only [applyShapeFacts, bind, Except.bind] at hresult
+      cases hhead : step head with
+      | error error => simp [hhead, Except.map] at hresult
+      | ok headFact =>
+          cases htail : applyShapeFacts step tail with
+          | error error => simp [hhead, htail, Except.map] at hresult
+          | ok tailFact =>
+              simp [hhead, htail, Except.map] at hresult
+              change Except.ok (headFact.join tailFact) =
+                Except.ok result at hresult
+              injection hresult with hresultEq
+              subst result
+              rcases List.mem_cons.mp hmember with hsame | hmember
+              · subst head
+                have : headFact = shapeFact := by
+                  rw [hhead] at hshape
+                  injection hshape
+                subst headFact
+                exact Fact.holds_join (Or.inl hholds)
+              · exact Fact.holds_join (Or.inr
+                  (ih hmember htail))
+
+theorem applyShapeFacts_ne_ok_of_member_error
+    {step : HeapShape → Except String Fact} {shapes : List HeapShape}
+    {shape : HeapShape} {error : String} {result : Fact}
+    (hmember : shape ∈ shapes)
+    (hshape : step shape = .error error)
+    (hresult : applyShapeFacts step shapes = .ok result) : False := by
+  induction shapes generalizing result with
+  | nil => contradiction
+  | cons head tail ih =>
+      simp only [applyShapeFacts, bind, Except.bind] at hresult
+      cases hhead : step head with
+      | error headError => simp [hhead] at hresult
+      | ok headFact =>
+          rw [hhead] at hresult
+          simp only [bind, Except.bind] at hresult
+          rcases List.mem_cons.mp hmember with hsame | hmember
+          · subst head
+            rw [hhead] at hshape
+            contradiction
+          · cases htail : applyShapeFacts step tail with
+            | error tailError => simp [htail] at hresult
+            | ok tailFact => exact ih hmember htail
+
+/-! ## Fuel-indexed semantic theorem -/
+
+private def CodeSoundAt (declarations : DeclEnv) (summaries : SummaryEnv)
+    (fuel : Nat) : Prop :=
+  ∀ ctx owner current store facts values code outputStore outputValue inferred,
+    ctx.decls = declarations →
+    AnalysisOwnerCompatible declarations summaries owner current →
+    EnvironmentHolds declarations store facts values →
+    analyzeCode declarations summaries owner current facts code = .ok inferred →
+    runCode ctx fuel current store values code =
+      .ok (outputStore, outputValue) →
+    inferred.Holds declarations outputStore outputValue
+
+private theorem analyzeAlternatives_sound
+    {declarations : DeclEnv} {summaries : SummaryEnv} {fuel : Nat}
+    (hcode : CodeSoundAt declarations summaries fuel)
+    {ctx : Ctx} {owner : Address} {current : FnDef} {store : Store}
+    {scrutineeFact : Fact} {peelNat : Bool}
+    {facts : List Fact} {values : List RVal} {alternatives : List Alt}
+    {cidx fieldCount : Nat} {body : Code} {fieldValues : List RVal}
+    {outputStore : Store} {outputValue : RVal} {inferred : Fact}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : AnalysisOwnerCompatible declarations summaries owner current)
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (hmember : Alt.mk cidx fieldCount body ∈ alternatives)
+    (hbinders : EnvironmentHolds declarations store
+      (scrutineeFact.caseFields peelNat cidx fieldCount) fieldValues)
+    (habstract : analyzeAlternatives declarations summaries owner current
+      scrutineeFact peelNat facts alternatives = .ok inferred)
+    (hconcrete : runCode ctx fuel current store (fieldValues ++ values) body =
+      .ok (outputStore, outputValue)) :
+    inferred.Holds declarations outputStore outputValue := by
+  induction alternatives generalizing inferred with
+  | nil => contradiction
+  | cons head tail ih =>
+      cases head with
+      | mk headCidx headFields headBody =>
+          simp only [analyzeAlternatives, bind, Except.bind] at habstract
+          cases hhead : analyzeCode declarations summaries owner current
+              (scrutineeFact.caseFields peelNat headCidx headFields ++ facts)
+              headBody with
+          | error error => simp [hhead] at habstract
+          | ok headFact =>
+              rw [hhead] at habstract
+              simp only [bind, Except.bind] at habstract
+              cases htail : analyzeAlternatives declarations summaries owner
+                  current scrutineeFact peelNat facts tail with
+              | error error => simp [htail] at habstract
+              | ok tailFact =>
+                  rw [htail] at habstract
+                  change Except.ok (headFact.join tailFact) =
+                    Except.ok inferred at habstract
+                  injection habstract with hinferred
+                  subst inferred
+                  rcases List.mem_cons.mp hmember with hsame | hmember
+                  · injection hsame with hcidx hfields hbody
+                    subst headCidx
+                    subst headFields
+                    subst headBody
+                    have hfront := hbinders.append henvironment
+                    exact Fact.holds_join (Or.inl
+                      (hcode ctx owner current store
+                        (scrutineeFact.caseFields peelNat cidx fieldCount ++ facts)
+                        (fieldValues ++ values) body outputStore outputValue
+                        headFact hctx hcurrent hfront hhead hconcrete))
+                  · exact Fact.holds_join (Or.inr
+                      (ih hmember htail))
+
+private def SoundAt (declarations : DeclEnv) (summaries : SummaryEnv)
+  (fuel : Nat) : Prop :=
+  CodeSoundAt declarations summaries fuel ∧
+  (∀ ctx owner current store facts values operation outputStore outputValue inferred,
+    ctx.decls = declarations →
+    AnalysisOwnerCompatible declarations summaries owner current →
+    EnvironmentHolds declarations store facts values →
+    analyzeOp declarations summaries owner current facts operation = .ok inferred →
+    runOp ctx fuel current store values operation =
+      .ok (outputStore, outputValue) →
+    inferred.Holds declarations outputStore outputValue) ∧
+  (∀ ctx address arguments store outputStore outputValue fact,
+    ctx.decls = declarations →
+    callableResult declarations summaries address = .ok fact →
+    invoke ctx fuel address arguments store = .ok (outputStore, outputValue) →
+    fact.Holds declarations outputStore outputValue) ∧
+  (∀ ctx store function arguments outputStore outputValue functionFact
+      resultFact abstractFuel,
+    ctx.decls = declarations →
+    functionFact.Holds declarations store function →
+    applyFact declarations summaries abstractFuel functionFact
+      arguments.length = .ok resultFact →
+    applyGo ctx fuel store function arguments = .ok (outputStore, outputValue) →
+    resultFact.Holds declarations outputStore outputValue)
+
+private theorem soundAt {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries) :
+    ∀ fuel, SoundAt declarations summaries fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro ctx owner current store facts values code outputStore outputValue
+          inferred hctx hcurrent henvironment habstract hconcrete
+        rw [runCode.eq_def] at hconcrete
+        simp at hconcrete
+      · intro ctx owner current store facts values operation outputStore
+          outputValue inferred hctx hcurrent henvironment habstract hconcrete
+        rw [runOp.eq_def] at hconcrete
+        simp at hconcrete
+      · intro ctx address arguments store outputStore outputValue fact hctx
+          habstract hconcrete
+        rw [invoke.eq_def] at hconcrete
+        simp at hconcrete
+      · intro ctx store function arguments outputStore outputValue functionFact
+          resultFact abstractFuel hctx hfunction habstract hconcrete
+        rw [applyGo.eq_def] at hconcrete
+        simp at hconcrete
+  | succ fuel ih =>
+      obtain ⟨ihCode, ihOp, ihInvoke, ihApply⟩ := ih
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · intro ctx owner current store facts values code outputStore outputValue
+          inferred hctx hcurrent henvironment habstract hconcrete
+        cases code with
+        | ret atom =>
+            have habstract' : resolveAtomFact facts atom = .ok inferred := by
+              simpa only [analyzeCode] using habstract
+            rw [runCode.eq_def] at hconcrete
+            dsimp only at hconcrete
+            cases hresolve : resolveAtom values atom with
+            | error error =>
+                rw [hresolve] at hconcrete
+                simp only [bind, Except.bind] at hconcrete
+                contradiction
+            | ok value =>
+                rw [hresolve] at hconcrete
+                simp only [bind, Except.bind] at hconcrete
+                change Except.ok (store, value) =
+                  Except.ok (outputStore, outputValue) at hconcrete
+                injection hconcrete with houtput
+                cases houtput
+                exact resolveAtom_sound henvironment habstract' hresolve
+        | letOp operation rest =>
+            simp only [analyzeCode, bind, Except.bind] at habstract
+            cases haop : analyzeOp declarations summaries owner current facts
+                operation with
+            | error error =>
+                rw [haop] at habstract
+                contradiction
+            | ok bound =>
+                rw [haop] at habstract
+                simp only [bind, Except.bind] at habstract
+                rw [runCode.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases hop : runOp ctx fuel current store values operation with
+                | error error =>
+                    rw [hop] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok operationOutput =>
+                    rcases operationOutput with ⟨middleStore, middleValue⟩
+                    rw [hop] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    have hbound := ihOp ctx owner current store facts values
+                      operation middleStore middleValue bound hctx hcurrent
+                      henvironment haop hop
+                    have hold := EnvironmentHolds.forgetHeap
+                      (after := middleStore) henvironment
+                    exact ihCode ctx owner current middleStore
+                      (bound :: facts.map Fact.forgetHeap)
+                      (middleValue :: values) rest outputStore outputValue
+                      inferred hctx hcurrent (.cons hbound hold) habstract
+                      hconcrete
+        | case scrutinee peelNat alternatives =>
+            simp only [analyzeCode, bind, Except.bind] at habstract
+            cases hascrut : resolveAtomFact facts scrutinee with
+            | error error =>
+                rw [hascrut] at habstract
+                contradiction
+            | ok scrutineeFact =>
+                rw [hascrut] at habstract
+                simp only [bind, Except.bind] at habstract
+                rw [runCode.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases hscrut : resolveAtom values scrutinee with
+                | error error =>
+                    rw [hscrut] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok scrutineeValue =>
+                    rw [hscrut] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    have hscrutineeHolds : scrutineeFact.Holds declarations
+                        store scrutineeValue :=
+                      resolveAtom_sound henvironment hascrut hscrut
+                    cases scrutineeValue with
+                    | loc location =>
+                        dsimp only at hconcrete
+                        cases hbox : store.get? location with
+                        | none => simp [hbox] at hconcrete
+                        | some box =>
+                            simp only [hbox] at hconcrete
+                            cases box with
+                            | mk world rc node =>
+                                cases node with
+                                | papN function arity captured =>
+                                    simp at hconcrete
+                                | ctorN identity fields =>
+                                    cases halt : alternatives.find?
+                                        (fun alternative =>
+                                          alternative.cidx == identity.cidx) with
+                                    | none => simp [halt] at hconcrete
+                                    | some alternative =>
+                                        cases alternative with
+                                        | mk cidx fieldCount body =>
+                                            cases hsize : fields.size != fieldCount
+                                            · simp only [halt, hsize,
+                                                Bool.false_eq_true, if_false]
+                                                at hconcrete
+                                              rw [Array.foldl_cons_eq_reverse_append]
+                                                at hconcrete
+                                              have hmember : Alt.mk cidx fieldCount body ∈
+                                                  alternatives.toList := by
+                                                simpa using
+                                                  Array.mem_of_find?_eq_some halt
+                                              have hcidx : identity.cidx = cidx := by
+                                                have hmatch := Array.find?_some
+                                                  (p := fun alternative : Alt =>
+                                                    alternative.cidx ==
+                                                      identity.cidx)
+                                                  (a := .mk cidx fieldCount body)
+                                                  (xs := alternatives) halt
+                                                exact (beq_iff_eq.mp hmatch).symm
+                                              have hfieldCount :
+                                                  fields.size = fieldCount := by
+                                                simpa using hsize
+                                              have hbinders :=
+                                                Fact.caseFields_ctor_holds
+                                                  peelNat cidx fieldCount
+                                                  hscrutineeHolds hbox rfl hcidx
+                                                  hfieldCount
+                                              exact analyzeAlternatives_sound ihCode
+                                                hctx hcurrent henvironment hmember
+                                                hbinders habstract hconcrete
+                                            · simp [halt, hsize] at hconcrete
+                    | lit literal =>
+                        cases literal with
+                        | str string => simp at hconcrete
+                        | nat value =>
+                            cases hpeel : peelNat with
+                            | false => simp [hpeel] at hconcrete
+                            | true =>
+                                cases value with
+                                | zero =>
+                                    cases halt : alternatives.find?
+                                        (fun alternative =>
+                                          alternative.cidx == 0) with
+                                    | none => simp [hpeel, halt] at hconcrete
+                                    | some alternative =>
+                                        cases alternative with
+                                        | mk cidx fieldCount body =>
+                                            cases fieldCount with
+                                            | zero =>
+                                                simp only [hpeel, halt]
+                                                  at hconcrete
+                                                have hmember : Alt.mk cidx 0 body ∈
+                                                    alternatives.toList := by
+                                                  simpa using
+                                                    Array.mem_of_find?_eq_some halt
+                                                have hbinders :
+                                                    EnvironmentHolds declarations
+                                                      store
+                                                      (scrutineeFact.caseFields
+                                                        peelNat cidx 0) [] := by
+                                                  simpa [Fact.caseFields,
+                                                    Fact.joinFieldVectors] using
+                                                    (EnvironmentHolds.nil :
+                                                      EnvironmentHolds
+                                                        declarations store [] [])
+                                                exact analyzeAlternatives_sound ihCode
+                                                  hctx hcurrent henvironment
+                                                  (fieldValues := []) hmember
+                                                  hbinders
+                                                  habstract (by
+                                                    simpa using hconcrete)
+                                            | succ fieldCount =>
+                                                simp [hpeel, halt] at hconcrete
+                                | succ value =>
+                                    cases halt : alternatives.find?
+                                        (fun alternative =>
+                                          alternative.cidx == 1) with
+                                    | none => simp [hpeel, halt] at hconcrete
+                                    | some alternative =>
+                                        cases alternative with
+                                        | mk cidx fieldCount body =>
+                                            cases fieldCount with
+                                            | zero =>
+                                                simp [hpeel, halt] at hconcrete
+                                            | succ fieldCount =>
+                                                cases fieldCount with
+                                                | zero =>
+                                                    simp only [hpeel, halt]
+                                                      at hconcrete
+                                                    have hmember :
+                                                        Alt.mk cidx 1 body ∈
+                                                          alternatives.toList := by
+                                                      simpa using
+                                                        Array.mem_of_find?_eq_some halt
+                                                    have hcidx : cidx = 1 := by
+                                                      have hmatch := Array.find?_some
+                                                        (p := fun alternative : Alt =>
+                                                          alternative.cidx == 1)
+                                                        (a := .mk cidx 1 body)
+                                                        (xs := alternatives) halt
+                                                      exact beq_iff_eq.mp hmatch
+                                                    have hbinders :
+                                                        EnvironmentHolds declarations
+                                                          store
+                                                          (scrutineeFact.caseFields
+                                                            peelNat cidx 1)
+                                                          [.lit (.nat value)] := by
+                                                      simpa [hpeel, hcidx] using
+                                                        (Fact.caseFields_natSucc_holds
+                                                          hscrutineeHolds)
+                                                    exact
+                                                      analyzeAlternatives_sound ihCode
+                                                        hctx hcurrent henvironment
+                                                        (fieldValues :=
+                                                          [.lit (.nat value)])
+                                                        hmember hbinders habstract (by
+                                                          simpa using hconcrete)
+                                                | succ fieldCount =>
+                                                    simp [hpeel, halt] at hconcrete
+                    | erased => simp at hconcrete
+      · intro ctx owner current store facts values operation outputStore
+          outputValue inferred hctx hcurrent henvironment habstract hconcrete
+        cases operation with
+        | pure atom =>
+            have habstract' : resolveAtomFact facts atom = .ok inferred := by
+              simpa only [analyzeOp] using habstract
+            rw [runOp.eq_def] at hconcrete
+            dsimp only at hconcrete
+            cases hresolve : resolveAtom values atom with
+            | error error =>
+                rw [hresolve] at hconcrete
+                simp only [bind, Except.bind] at hconcrete
+                contradiction
+            | ok value =>
+                rw [hresolve] at hconcrete
+                simp only [bind, Except.bind] at hconcrete
+                change Except.ok (store, value) =
+                  Except.ok (outputStore, outputValue) at hconcrete
+                injection hconcrete with houtput
+                cases houtput
+                exact resolveAtom_sound henvironment habstract' hresolve
+        | alloc world identity arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFacts facts arguments with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok argumentFacts =>
+                rw [hvalid] at habstract
+                change Except.ok (Fact.heap (.ctor identity
+                  (some (argumentFacts.map FieldFact.ofFact)))) =
+                  Except.ok inferred at habstract
+                injection habstract with hinferred
+                subst inferred
+                rw [runOp.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases harguments : resolveAtoms values arguments with
+                | error error =>
+                    rw [harguments] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok resolved =>
+                    rw [harguments] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    change Except.ok
+                        ((store.allocNode world
+                          (.ctorN identity resolved.toArray)).1,
+                          .loc (store.allocNode world
+                            (.ctorN identity resolved.toArray)).2) =
+                      Except.ok (outputStore, outputValue) at hconcrete
+                    injection hconcrete with houtput
+                    cases houtput
+                    have hfields := resolveAtomFacts_sound henvironment hvalid
+                      harguments
+                    apply Fact.heap_holds
+                    exact ⟨⟨world, 1, .ctorN identity resolved.toArray⟩,
+                      resolved.toArray,
+                      get?_allocNode_new store world
+                        (.ctorN identity resolved.toArray), rfl,
+                      by simpa using
+                        hfields.toFieldFactsAllocNode
+                          (world := world)
+                          (node := .ctorN identity resolved.toArray)⟩
+        | reuse target identity arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFacts facts arguments with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok argumentFacts =>
+                rw [hvalid] at habstract
+                cases htargetFact : resolveAtomFact facts target with
+                | error error =>
+                    rw [htargetFact] at habstract
+                    contradiction
+                | ok targetFact =>
+                    rw [htargetFact] at habstract
+                    change Except.ok (Fact.heap (.ctor identity
+                      (some (argumentFacts.map fun fact =>
+                        FieldFact.ofFact fact.forgetHeap)))) =
+                      Except.ok inferred at habstract
+                    injection habstract with hinferred
+                    subst inferred
+                    rw [runOp.eq_def] at hconcrete
+                    dsimp only at hconcrete
+                    cases harguments : resolveAtoms values arguments with
+                    | error error =>
+                        rw [harguments] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        contradiction
+                    | ok resolved =>
+                        rw [harguments] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        cases htarget : resolveAtom values target with
+                        | error error =>
+                            rw [htarget] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok targetValue =>
+                            rw [htarget] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            cases targetValue with
+                            | lit literal => simp at hconcrete
+                            | erased => simp at hconcrete
+                            | loc location =>
+                                cases hbox : store.get? location with
+                                | none => simp [hbox] at hconcrete
+                                | some box =>
+                                    simp only [hbox] at hconcrete
+                                    cases box with
+                                    | mk boxWorld rc node =>
+                                        cases boxWorld with
+                                        | shared => simp at hconcrete
+                                        | unique =>
+                                            change Except.ok
+                                                ({ store.setBox location
+                                                    ⟨.unique, 1,
+                                                      .ctorN identity
+                                                        resolved.toArray⟩ with
+                                                  reuses :=
+                                                    (store.setBox location
+                                                      ⟨.unique, 1,
+                                                        .ctorN identity
+                                                          resolved.toArray⟩).reuses + 1 },
+                                                  .loc location) =
+                                              Except.ok
+                                                (outputStore, outputValue)
+                                              at hconcrete
+                                            injection hconcrete with houtput
+                                            cases houtput
+                                            have hfields :=
+                                              resolveAtomFacts_sound henvironment
+                                                hvalid harguments
+                                            apply Fact.heap_holds
+                                            refine ⟨⟨.unique, 1,
+                                                .ctorN identity resolved.toArray⟩,
+                                              resolved.toArray, ?_, rfl, ?_⟩
+                                            · simpa [Store.get?] using
+                                                (get?_setBox_same
+                                                  (new := ⟨.unique, 1,
+                                                    .ctorN identity
+                                                      resolved.toArray⟩)
+                                                  hbox)
+                                            · simpa using hfields.toFieldFactsForget
+                                                (after :=
+                                                  { store.setBox location
+                                                      ⟨.unique, 1,
+                                                        .ctorN identity
+                                                          resolved.toArray⟩ with
+                                                    reuses :=
+                                                      (store.setBox location
+                                                        ⟨.unique, 1,
+                                                          .ctorN identity
+                                                            resolved.toArray⟩).reuses + 1 })
+        | free target =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFact facts target with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok fact =>
+                rw [hvalid] at habstract
+                change Except.ok Fact.scalar = Except.ok inferred at habstract
+                injection habstract with hinferred
+                subst inferred
+                rw [runOp.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases htarget : resolveAtom values target with
+                | error error =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok targetValue =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    cases targetValue with
+                    | lit literal => simp at hconcrete
+                    | erased => simp at hconcrete
+                    | loc location =>
+                        cases hbox : store.get? location with
+                        | none => simp [hbox] at hconcrete
+                        | some box =>
+                            simp only [hbox] at hconcrete
+                            cases box with
+                            | mk boxWorld rc node =>
+                                cases boxWorld with
+                                | shared => simp at hconcrete
+                                | unique =>
+                                    injection hconcrete with houtput
+                                    cases houtput
+                                    simp [Fact.Holds, Fact.scalar]
+        | dup target =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFact facts target with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok fact =>
+                rw [hvalid] at habstract
+                change Except.ok Fact.top = Except.ok inferred at habstract
+                injection habstract with hinferred
+                subst inferred
+                exact Fact.top_holds declarations outputStore outputValue
+        | drop target =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFact facts target with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok fact =>
+                rw [hvalid] at habstract
+                change Except.ok Fact.scalar = Except.ok inferred at habstract
+                injection habstract with hinferred
+                subst inferred
+                rw [runOp.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases htarget : resolveAtom values target with
+                | error error =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok targetValue =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    cases targetValue with
+                    | lit literal =>
+                        injection hconcrete with houtput
+                        cases houtput
+                        simp [Fact.Holds, Fact.scalar]
+                    | erased =>
+                        injection hconcrete with houtput
+                        cases houtput
+                        simp [Fact.Holds, Fact.scalar]
+                    | loc location =>
+                        dsimp only at hconcrete
+                        cases hdrop : dropVal ctx fuel store (.loc location) with
+                        | error error =>
+                            rw [hdrop] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok dropped =>
+                            rw [hdrop] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            injection hconcrete with houtput
+                            cases houtput
+                            simp [Fact.Holds, Fact.scalar]
+        | dropU target =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFact facts target with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok fact =>
+                rw [hvalid] at habstract
+                change Except.ok Fact.scalar = Except.ok inferred at habstract
+                injection habstract with hinferred
+                subst inferred
+                rw [runOp.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases htarget : resolveAtom values target with
+                | error error =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok targetValue =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    cases targetValue with
+                    | lit literal =>
+                        injection hconcrete with houtput
+                        cases houtput
+                        simp [Fact.Holds, Fact.scalar]
+                    | erased =>
+                        injection hconcrete with houtput
+                        cases houtput
+                        simp [Fact.Holds, Fact.scalar]
+                    | loc location =>
+                        dsimp only at hconcrete
+                        cases hdrop : dropUVal ctx fuel store (.loc location) with
+                        | error error =>
+                            rw [hdrop] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok dropped =>
+                            rw [hdrop] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            injection hconcrete with houtput
+                            cases houtput
+                            simp [Fact.Holds, Fact.scalar]
+        | fetch target field =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFact facts target with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok fact =>
+                rw [hvalid] at habstract
+                change Except.ok (fact.fetch field) = Except.ok inferred
+                  at habstract
+                injection habstract with hinferred
+                subst inferred
+                rw [runOp.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases htarget : resolveAtom values target with
+                | error error =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok targetValue =>
+                    rw [htarget] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    cases targetValue with
+                    | lit literal => simp at hconcrete
+                    | erased => simp at hconcrete
+                    | loc location =>
+                        cases hbox : store.get? location with
+                        | none => simp [hbox] at hconcrete
+                        | some box =>
+                            simp only [hbox] at hconcrete
+                            cases box with
+                            | mk world rc node =>
+                                cases node with
+                                | papN function arity captured =>
+                                    simp at hconcrete
+                                | ctorN identity fields =>
+                                    cases hfield : fields[field]? with
+                                    | none => simp [hfield] at hconcrete
+                                    | some value =>
+                                        simp only [hfield] at hconcrete
+                                        injection hconcrete with houtput
+                                        cases houtput
+                                        exact Fact.fetch_holds
+                                          (resolveAtom_sound henvironment hvalid
+                                            htarget)
+                                          hbox rfl hfield
+        | call address arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFacts facts arguments with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok unit =>
+                rw [hvalid] at habstract
+                simp only [bind, Except.bind] at habstract
+                cases hdecl : declarations address with
+                | none => simp [hdecl] at habstract
+                | some declaration =>
+                    simp only [hdecl] at habstract
+                    cases harity : arguments.size != declArity declaration
+                    ·
+                        simp only [harity, Bool.false_eq_true, if_false]
+                          at habstract
+                        rw [runOp.eq_def] at hconcrete
+                        dsimp only at hconcrete
+                        cases harguments : resolveAtoms values arguments with
+                        | error error =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok resolved =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            exact ihInvoke ctx address resolved store outputStore
+                              outputValue inferred hctx habstract hconcrete
+                    · simp [harity] at habstract
+        | callSelf arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFacts facts arguments with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok unit =>
+                rw [hvalid] at habstract
+                simp only [bind, Except.bind] at habstract
+                cases habstractArity : arguments.size != current.arity
+                ·
+                    simp only [habstractArity, Bool.false_eq_true, if_false]
+                      at habstract
+                    cases hsummary : summaries owner with
+                    | none => simp [hsummary] at habstract
+                    | some claimed =>
+                        rw [hsummary] at habstract
+                        change Except.ok claimed = Except.ok inferred at habstract
+                        injection habstract with hinferred
+                        subst inferred
+                        have hcurrentDecl :
+                            declarations owner = some (.fn current) := by
+                          rcases hcurrent with hcurrent | hmissing
+                          · exact hcurrent
+                          · rw [hsummary] at hmissing
+                            contradiction
+                        obtain ⟨localFact, hlocal, hle⟩ :=
+                          hpost owner current claimed hcurrentDecl hsummary
+                        rw [runOp.eq_def] at hconcrete
+                        dsimp only at hconcrete
+                        cases harguments : resolveAtoms values arguments with
+                        | error error =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok resolved =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            cases hconcreteArity : resolved.length != current.arity
+                            ·
+                                simp only [hconcreteArity, Bool.false_eq_true,
+                                  if_false] at hconcrete
+                                cases hbody : runCode ctx fuel current store
+                                    resolved.reverse current.body with
+                                | error error =>
+                                    rw [hbody] at hconcrete
+                                    simp only [bind, Except.bind] at hconcrete
+                                    contradiction
+                                | ok bodyOutput =>
+                                    rw [hbody] at hconcrete
+                                    simp only [bind, Except.bind] at hconcrete
+                                    have houtput :=
+                                      eq_of_checkResultWorld_eq_ok hconcrete
+                                    rcases bodyOutput with
+                                      ⟨bodyStore, bodyValue⟩
+                                    cases houtput
+                                    have hlength : resolved.length =
+                                        current.arity := by
+                                      simpa using hconcreteArity
+                                    have henv :=
+                                      EnvironmentHolds.top_replicate
+                                        declarations store resolved.reverse
+                                    rw [List.length_reverse, hlength] at henv
+                                    have hbodySound := ihCode ctx owner current
+                                      store
+                                      (List.replicate current.arity Fact.top)
+                                      resolved.reverse current.body outputStore
+                                      outputValue localFact hctx hcurrent henv
+                                      (by simpa [inferFunction] using hlocal)
+                                      hbody
+                                    exact Fact.holds_of_le hle hbodySound
+                            · simp [hconcreteArity] at hconcrete
+                · simp [habstractArity] at habstract
+        | papp address arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFacts facts arguments with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok unit =>
+                rw [hvalid] at habstract
+                simp only [bind, Except.bind] at habstract
+                cases hdecl : declarations address with
+                | none => simp [hdecl] at habstract
+                | some declaration =>
+                    simp only [hdecl] at habstract
+                    by_cases hless : arguments.size < declArity declaration
+                    ·
+                        simp only [hless, if_true] at habstract
+                        change Except.ok
+                            (Fact.heap (.pap address arguments.size)) =
+                          Except.ok inferred at habstract
+                        injection habstract with hinferred
+                        subst inferred
+                        rw [runOp.eq_def] at hconcrete
+                        dsimp only at hconcrete
+                        cases harguments : resolveAtoms values arguments with
+                        | error error =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok resolved =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            have hdeclConcrete : ctx.decls address =
+                                some declaration := by
+                              rw [hctx]
+                              exact hdecl
+                            simp only [hdeclConcrete] at hconcrete
+                            have hlength := resolveAtoms_length harguments
+                            have hlessConcrete : resolved.length <
+                                declArity declaration := by
+                              simpa [hlength] using hless
+                            simp only [hlessConcrete, if_true] at hconcrete
+                            change Except.ok
+                                ((store.allocNode .shared
+                                  (.papN address (declArity declaration)
+                                    resolved.toArray)).1,
+                                  .loc (store.allocNode .shared
+                                    (.papN address (declArity declaration)
+                                      resolved.toArray)).2) =
+                              Except.ok (outputStore, outputValue) at hconcrete
+                            injection hconcrete with houtput
+                            cases houtput
+                            apply Fact.heap_holds
+                            refine ⟨⟨.shared, 1,
+                                .papN address (declArity declaration)
+                                  resolved.toArray⟩,
+                              resolved.toArray, declaration,
+                              get?_allocNode_new store .shared
+                                (.papN address (declArity declaration)
+                                  resolved.toArray), hdecl, rfl, ?_, ?_⟩
+                            · simpa [hlength]
+                            · exact hless
+                    · simp [hless] at habstract
+        | apply function arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hfunctionAbstract : resolveAtomFact facts function with
+            | error error =>
+                rw [hfunctionAbstract] at habstract
+                contradiction
+            | ok functionFact =>
+                rw [hfunctionAbstract] at habstract
+                simp only [bind, Except.bind] at habstract
+                cases hvalid : resolveAtomFacts facts arguments with
+                | error error =>
+                    rw [hvalid] at habstract
+                    contradiction
+                | ok unit =>
+                    rw [hvalid] at habstract
+                    simp only [bind, Except.bind] at habstract
+                    rw [runOp.eq_def] at hconcrete
+                    dsimp only at hconcrete
+                    cases hfunctionConcrete : resolveAtom values function with
+                    | error error =>
+                        rw [hfunctionConcrete] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        contradiction
+                    | ok functionValue =>
+                        rw [hfunctionConcrete] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        cases harguments : resolveAtoms values arguments with
+                        | error error =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok resolved =>
+                            rw [harguments] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            have hlength := resolveAtoms_length harguments
+                            have hfunctionHolds := resolveAtom_sound henvironment
+                              hfunctionAbstract hfunctionConcrete
+                            exact ihApply ctx store functionValue resolved
+                              outputStore outputValue functionFact inferred
+                              (arguments.size + 1) hctx hfunctionHolds
+                              (by simpa [hlength] using habstract) hconcrete
+        | extern address arguments =>
+            simp only [analyzeOp, bind, Except.bind] at habstract
+            cases hvalid : resolveAtomFacts facts arguments with
+            | error error =>
+                rw [hvalid] at habstract
+                contradiction
+            | ok unit =>
+                rw [hvalid] at habstract
+                change Except.ok Fact.scalar = Except.ok inferred at habstract
+                injection habstract with hinferred
+                subst inferred
+                rw [runOp.eq_def] at hconcrete
+                dsimp only at hconcrete
+                cases harguments : resolveAtoms values arguments with
+                | error error =>
+                    rw [harguments] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    contradiction
+                | ok resolved =>
+                    rw [harguments] at hconcrete
+                    simp only [bind, Except.bind] at hconcrete
+                    cases horacle : callScalarOracle ctx address resolved with
+                    | error error =>
+                        rw [horacle] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        contradiction
+                    | ok value =>
+                        rw [horacle] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        change Except.ok (store, value) =
+                          Except.ok (outputStore, outputValue) at hconcrete
+                        injection hconcrete with houtput
+                        cases houtput
+                        rw [Fact.scalar_holds_iff]
+                        exact scalar_of_callScalarOracle_eq_ok horacle
+      · intro ctx address arguments store outputStore outputValue fact hctx
+          habstract hconcrete
+        rw [invoke.eq_def] at hconcrete
+        dsimp only at hconcrete
+        cases hdeclConcrete : ctx.decls address with
+        | none => simp [hdeclConcrete] at hconcrete
+        | some declaration =>
+            simp only [hdeclConcrete] at hconcrete
+            have hdecl : declarations address = some declaration := by
+              rw [← hctx]
+              exact hdeclConcrete
+            cases declaration with
+            | extern arity =>
+                cases harity : arguments.length != arity
+                ·
+                    simp only [harity, Bool.false_eq_true, if_false]
+                      at hconcrete
+                    cases horacle : callScalarOracle ctx address arguments with
+                    | error error => simp [horacle] at hconcrete
+                    | ok value =>
+                        simp only [horacle] at hconcrete
+                        injection hconcrete with houtput
+                        cases houtput
+                        have hfact : fact = Fact.scalar := by
+                          simpa [callableResult, hdecl] using habstract.symm
+                        subst fact
+                        rw [Fact.scalar_holds_iff]
+                        exact scalar_of_callScalarOracle_eq_ok horacle
+                · simp [harity] at hconcrete
+            | fn function =>
+                cases harity : arguments.length != function.arity
+                ·
+                    simp only [harity, Bool.false_eq_true, if_false]
+                      at hconcrete
+                    cases hbody : runCode ctx fuel function store
+                        arguments.reverse function.body with
+                    | error error =>
+                        rw [hbody] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        contradiction
+                    | ok bodyOutput =>
+                        rw [hbody] at hconcrete
+                        simp only [bind, Except.bind] at hconcrete
+                        have houtput := eq_of_checkResultWorld_eq_ok hconcrete
+                        rcases bodyOutput with ⟨bodyStore, bodyValue⟩
+                        cases houtput
+                        cases hsummary : summaries address with
+                        | none => simp [callableResult, hdecl, hsummary]
+                            at habstract
+                        | some claimed =>
+                            have hfact : claimed = fact := by
+                              simpa [callableResult, hdecl, hsummary] using
+                                habstract
+                            subst fact
+                            obtain ⟨localFact, hlocal, hle⟩ :=
+                              hpost address function claimed hdecl hsummary
+                            have hlength : arguments.length = function.arity := by
+                              simpa using harity
+                            have henvironment :=
+                              EnvironmentHolds.top_replicate declarations store
+                                arguments.reverse
+                            rw [List.length_reverse, hlength] at henvironment
+                            have hbodySound := ihCode ctx address function store
+                              (List.replicate function.arity Fact.top)
+                              arguments.reverse function.body outputStore
+                              outputValue
+                              localFact hctx (.inl hdecl) henvironment
+                              (by simpa [inferFunction] using hlocal) hbody
+                            exact Fact.holds_of_le hle hbodySound
+                · simp [harity] at hconcrete
+      · intro ctx store function arguments outputStore outputValue functionFact
+          resultFact abstractFuel hctx hfunction habstract hconcrete
+        cases abstractFuel with
+        | zero =>
+            simp only [applyFact, Except.ok.injEq] at habstract
+            subst resultFact
+            exact Fact.top_holds declarations outputStore outputValue
+        | succ abstractFuel =>
+            rw [applyFact] at habstract
+            dsimp only at habstract
+            cases hunknown : functionFact.unknownHeap with
+            | true =>
+                simp only [hunknown, if_true] at habstract
+                change Except.ok Fact.top = Except.ok resultFact at habstract
+                injection habstract with hresult
+                subst resultFact
+                exact Fact.top_holds declarations outputStore outputValue
+            | false =>
+                simp only [hunknown, Bool.false_eq_true, if_false]
+                  at habstract
+                cases hheap : applyShapeFacts
+                    (applyShapeFact declarations summaries
+                      (applyFact declarations summaries abstractFuel)
+                      arguments.length) functionFact.shapes with
+                | error error =>
+                    rw [hheap] at habstract
+                    simp only [bind, Except.bind] at habstract
+                    contradiction
+                | ok heapFact =>
+                    rw [hheap] at habstract
+                    change Except.ok
+                        ((if functionFact.mayScalar then Fact.scalar
+                          else Fact.bottom).join heapFact) =
+                      Except.ok resultFact at habstract
+                    injection habstract with hresult
+                    subst resultFact
+                    rw [applyGo.eq_def] at hconcrete
+                    dsimp only at hconcrete
+                    cases function with
+                    | lit literal => simp at hconcrete
+                    | erased =>
+                        cases hdrop : dropMany ctx fuel store arguments with
+                        | error error =>
+                            rw [hdrop] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            contradiction
+                        | ok dropped =>
+                            rw [hdrop] at hconcrete
+                            simp only [bind, Except.bind] at hconcrete
+                            change Except.ok (dropped, RVal.erased) =
+                              Except.ok (outputStore, outputValue) at hconcrete
+                            injection hconcrete with houtput
+                            cases houtput
+                            change functionFact.mayScalar = true at hfunction
+                            apply Fact.holds_join
+                            apply Or.inl
+                            simp [hfunction, Fact.Holds, Fact.scalar]
+                    | loc location =>
+                        cases hbox : store.get? location with
+                        | none => simp [hbox] at hconcrete
+                        | some box =>
+                            simp only [hbox] at hconcrete
+                            cases box with
+                            | mk world rc node =>
+                                cases node with
+                                | ctorN identity fields => simp at hconcrete
+                                | papN address arity captured =>
+                                    simp only at hconcrete
+                                    simp only [Fact.Holds] at hfunction
+                                    rcases hfunction with hunknown' |
+                                      ⟨shape, hmember, hshape⟩
+                                    · simp [hunknown] at hunknown'
+                                    · cases shape with
+                                      | ctor shapeIdentity shapeFacts =>
+                                          simp only [HeapShape.Holds] at hshape
+                                          obtain ⟨shapeBox, shapeFields,
+                                            hshapeBox, hshapeNode, _⟩ := hshape
+                                          have : shapeBox =
+                                              ⟨world, rc,
+                                                .papN address arity captured⟩ := by
+                                            injection hshapeBox.symm.trans hbox
+                                          subst shapeBox
+                                          simp at hshapeNode
+                                      | pap shapeAddress supplied =>
+                                          simp only [HeapShape.Holds] at hshape
+                                          obtain ⟨shapeBox, shapeArguments,
+                                            declaration, hshapeBox, hdecl,
+                                            hshapeNode, hsupplied, hproper⟩ :=
+                                            hshape
+                                          have hboxEq : shapeBox =
+                                              ⟨world, rc,
+                                                .papN address arity captured⟩ := by
+                                            injection hshapeBox.symm.trans hbox
+                                          subst shapeBox
+                                          simp only [NodeBox.node] at hshapeNode
+                                          injection hshapeNode with haddress
+                                            harity hcaptured
+                                          subst shapeAddress
+                                          subst arity
+                                          subst shapeArguments
+                                          cases hdup : dupVals store captured.toList with
+                                          | error error =>
+                                              rw [hdup] at hconcrete
+                                              simp only [bind, Except.bind]
+                                                at hconcrete
+                                              contradiction
+                                          | ok duplicated =>
+                                              rw [hdup] at hconcrete
+                                              simp only [bind, Except.bind]
+                                                at hconcrete
+                                              cases hdrop : dropVal ctx fuel
+                                                  duplicated (.loc location) with
+                                              | error error =>
+                                                  rw [hdrop] at hconcrete
+                                                  simp only [bind, Except.bind]
+                                                    at hconcrete
+                                                  contradiction
+                                              | ok ready =>
+                                                  rw [hdrop] at hconcrete
+                                                  simp only [bind, Except.bind]
+                                                    at hconcrete
+                                                  have hcapturedLength :
+                                                      captured.toList.length =
+                                                        supplied := by
+                                                    simpa using hsupplied
+                                                  have htotalLength :
+                                                      (captured.toList ++ arguments).length =
+                                                        supplied + arguments.length := by
+                                                    simp [hcapturedLength]
+                                                  by_cases hunder :
+                                                      (captured.toList ++
+                                                        arguments).length <
+                                                          declArity declaration
+                                                  ·
+                                                      simp only [hunder, if_true]
+                                                        at hconcrete
+                                                      change Except.ok
+                                                          ((ready.allocNode .shared
+                                                            (.papN address
+                                                              (declArity declaration)
+                                                              ((captured.toList ++
+                                                                arguments).toArray))).1,
+                                                            .loc
+                                                              (ready.allocNode .shared
+                                                                (.papN address
+                                                                  (declArity declaration)
+                                                                  ((captured.toList ++
+                                                                    arguments).toArray))).2) =
+                                                        Except.ok
+                                                          (outputStore, outputValue)
+                                                        at hconcrete
+                                                      injection hconcrete with
+                                                        houtput
+                                                      cases houtput
+                                                      have hunderAbstract :
+                                                          supplied + arguments.length <
+                                                            declArity declaration := by
+                                                        simpa [htotalLength] using hunder
+                                                      let shapeFact := Fact.heap
+                                                        (.pap address
+                                                          (supplied + arguments.length))
+                                                      have hstep :
+                                                          applyShapeFact declarations
+                                                            summaries
+                                                            (applyFact declarations summaries
+                                                              abstractFuel)
+                                                            arguments.length
+                                                            (.pap address supplied) =
+                                                              .ok shapeFact := by
+                                                        simp [applyShapeFact, hdecl,
+                                                          hproper, hunderAbstract,
+                                                          shapeFact]
+                                                        change Except.ok
+                                                            (Fact.heap (.pap address
+                                                              (supplied + arguments.length))) =
+                                                          Except.ok
+                                                            (Fact.heap (.pap address
+                                                              (supplied + arguments.length)))
+                                                        rfl
+                                                      have hshapeFact :
+                                                          shapeFact.Holds declarations
+                                                            (ready.allocNode .shared
+                                                              (.papN address
+                                                                (declArity declaration)
+                                                                ((captured.toList ++
+                                                                  arguments).toArray))).1
+                                                            (.loc
+                                                              (ready.allocNode .shared
+                                                                (.papN address
+                                                                  (declArity declaration)
+                                                                  ((captured.toList ++
+                                                                    arguments).toArray))).2) := by
+                                                        apply Fact.heap_holds
+                                                        refine ⟨⟨.shared, 1,
+                                                            .papN address
+                                                              (declArity declaration)
+                                                              ((captured.toList ++
+                                                                arguments).toArray)⟩,
+                                                          (captured.toList ++
+                                                            arguments).toArray,
+                                                          declaration,
+                                                          get?_allocNode_new ready .shared
+                                                            (.papN address
+                                                              (declArity declaration)
+                                                              ((captured.toList ++
+                                                                arguments).toArray)),
+                                                          hdecl, rfl, ?_,
+                                                          hunderAbstract⟩
+                                                        simpa [htotalLength]
+                                                      apply Fact.holds_join
+                                                      exact Or.inr
+                                                        (holds_of_applyShapeFacts_member
+                                                          hmember hstep hheap hshapeFact)
+                                                  ·
+                                                      simp only [hunder,
+                                                        if_false]
+                                                        at hconcrete
+                                                      have hpapsafe :
+                                                          declPapSafe declaration = true := by
+                                                        cases hsafety :
+                                                            declPapSafe declaration with
+                                                        | false =>
+                                                            simp [hctx, hdecl, hsafety]
+                                                              at hconcrete
+                                                        | true => rfl
+                                                      simp only [hctx, hdecl, hpapsafe,
+                                                        if_true] at hconcrete
+                                                      by_cases hexactEq :
+                                                          (((captured.toList ++
+                                                            arguments).length ==
+                                                              declArity declaration) = true)
+                                                      · have hexact :
+                                                            ((captured.toList ++
+                                                              arguments).length ==
+                                                                declArity declaration) = true :=
+                                                          hexactEq
+                                                        simp only [hexact, if_true]
+                                                          at hconcrete
+                                                        have hexactAbstract :
+                                                              supplied + arguments.length =
+                                                                declArity declaration := by
+                                                            have := beq_iff_eq.mp hexact
+                                                            omega
+                                                        cases hreturned :
+                                                              callableResult declarations
+                                                                summaries address with
+                                                          | error error =>
+                                                              have hstepError :
+                                                                  applyShapeFact declarations
+                                                                    summaries
+                                                                    (applyFact declarations
+                                                                      summaries abstractFuel)
+                                                                    arguments.length
+                                                                    (.pap address supplied) =
+                                                                      .error error := by
+                                                                simp [applyShapeFact, hdecl,
+                                                                  hproper, hexactAbstract,
+                                                                  hreturned]
+                                                              exact False.elim
+                                                                (applyShapeFacts_ne_ok_of_member_error
+                                                                  hmember hstepError hheap)
+                                                          | ok returned =>
+                                                              have hstep :
+                                                                  applyShapeFact declarations
+                                                                    summaries
+                                                                    (applyFact declarations
+                                                                      summaries abstractFuel)
+                                                                    arguments.length
+                                                                    (.pap address supplied) =
+                                                                      .ok returned := by
+                                                                simp [applyShapeFact, hdecl,
+                                                                  hproper, hexactAbstract,
+                                                                  hreturned]
+                                                              have hreturnedHolds := ihInvoke
+                                                                ctx address
+                                                                (captured.toList ++ arguments)
+                                                                ready outputStore outputValue
+                                                                returned hctx hreturned hconcrete
+                                                              apply Fact.holds_join
+                                                              exact Or.inr
+                                                                (holds_of_applyShapeFacts_member
+                                                                  hmember hstep hheap
+                                                                  hreturnedHolds)
+                                                      · have hexact :
+                                                            ((captured.toList ++
+                                                              arguments).length ==
+                                                                declArity declaration) = false := by
+                                                          simpa using hexactEq
+                                                        simp only [hexact,
+                                                          Bool.false_eq_true, if_false]
+                                                          at hconcrete
+                                                        have hoverAbstract :
+                                                              declArity declaration <
+                                                                supplied + arguments.length := by
+                                                            have hnunder : ¬
+                                                                supplied + arguments.length <
+                                                                  declArity declaration := by
+                                                              simpa [htotalLength] using hunder
+                                                            have hneConcrete :
+                                                                (captured.toList ++
+                                                                  arguments).length ≠
+                                                                    declArity declaration := by
+                                                              intro heq
+                                                              apply hexactEq
+                                                              simpa [heq]
+                                                            omega
+                                                        have hnunderAbstract : ¬
+                                                            supplied + arguments.length <
+                                                              declArity declaration := by
+                                                          omega
+                                                        have hneAbstract :
+                                                            supplied + arguments.length ≠
+                                                              declArity declaration := by
+                                                          omega
+                                                        cases hreturned :
+                                                              callableResult declarations
+                                                                summaries address with
+                                                          | error error =>
+                                                              have hstepError :
+                                                                  applyShapeFact declarations
+                                                                    summaries
+                                                                    (applyFact declarations
+                                                                      summaries abstractFuel)
+                                                                    arguments.length
+                                                                    (.pap address supplied) =
+                                                                      .error error := by
+                                                                simp [applyShapeFact, hdecl,
+                                                                  hproper, hnunderAbstract,
+                                                                  hneAbstract,
+                                                                  hreturned]
+                                                                simp only [bind, Except.bind]
+                                                              exact False.elim
+                                                                (applyShapeFacts_ne_ok_of_member_error
+                                                                  hmember hstepError hheap)
+                                                          | ok returned =>
+                                                              cases happlied :
+                                                                  applyFact declarations summaries
+                                                                    abstractFuel returned
+                                                                    (supplied + arguments.length -
+                                                                      declArity declaration) with
+                                                              | error error =>
+                                                                  have hstepError :
+                                                                      applyShapeFact declarations
+                                                                        summaries
+                                                                        (applyFact declarations
+                                                                          summaries abstractFuel)
+                                                                        arguments.length
+                                                                        (.pap address supplied) =
+                                                                          .error error := by
+                                                                    simp [applyShapeFact, hdecl,
+                                                                      hproper, hnunderAbstract,
+                                                                      hneAbstract,
+                                                                      hreturned, happlied]
+                                                                    simpa only [bind, Except.bind]
+                                                                      using happlied
+                                                                  exact False.elim
+                                                                    (applyShapeFacts_ne_ok_of_member_error
+                                                                      hmember hstepError hheap)
+                                                              | ok applied =>
+                                                                  have hstep :
+                                                                      applyShapeFact declarations
+                                                                        summaries
+                                                                        (applyFact declarations
+                                                                          summaries abstractFuel)
+                                                                        arguments.length
+                                                                        (.pap address supplied) =
+                                                                          .ok applied := by
+                                                                    simp [applyShapeFact, hdecl,
+                                                                      hproper, hnunderAbstract,
+                                                                      hneAbstract,
+                                                                      hreturned, happlied]
+                                                                    simpa only [bind, Except.bind]
+                                                                      using happlied
+                                                                  cases hinvoke : invoke ctx fuel
+                                                                      address
+                                                                      ((captured.toList ++ arguments).take
+                                                                        (declArity declaration))
+                                                                      ready with
+                                                                  | error error =>
+                                                                      rw [hinvoke] at hconcrete
+                                                                      simp only [bind, Except.bind]
+                                                                        at hconcrete
+                                                                      contradiction
+                                                                  | ok called =>
+                                                                      rcases called with
+                                                                        ⟨calledStore, calledValue⟩
+                                                                      rw [hinvoke] at hconcrete
+                                                                      simp only [bind, Except.bind]
+                                                                        at hconcrete
+                                                                      have hreturnedHolds := ihInvoke
+                                                                        ctx address
+                                                                        ((captured.toList ++
+                                                                          arguments).take
+                                                                            (declArity declaration))
+                                                                        ready calledStore calledValue
+                                                                        returned hctx hreturned hinvoke
+                                                                      have hdropLength :
+                                                                          ((captured.toList ++
+                                                                            arguments).drop
+                                                                              (declArity declaration)).length =
+                                                                            supplied + arguments.length -
+                                                                              declArity declaration := by
+                                                                        simp [List.length_drop,
+                                                                          htotalLength]
+                                                                      have happliedHolds := ihApply ctx
+                                                                        calledStore calledValue
+                                                                        ((captured.toList ++ arguments).drop
+                                                                          (declArity declaration))
+                                                                        outputStore outputValue returned
+                                                                        applied abstractFuel hctx
+                                                                        hreturnedHolds
+                                                                        (by simpa [hdropLength] using
+                                                                          happlied)
+                                                                        hconcrete
+                                                                      apply Fact.holds_join
+                                                                      exact Or.inr
+                                                                        (holds_of_applyShapeFacts_member
+                                                                          hmember hstep hheap
+                                                                          happliedHolds)
+
+/-! ## Public semantic interface -/
+
+/-- Successful concrete execution of analyzed code is covered when the owner
+is exact or self-analysis is forced to fail closed. -/
+theorem analyzeCode_sound_ownerCompatible
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef} {store outputStore : Store}
+    {facts : List Fact} {values : List RVal} {code : Code}
+    {outputValue : RVal} {inferred : Fact} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : analyzeCode declarations summaries owner current facts code =
+      .ok inferred)
+    (hconcrete : runCode ctx fuel current store values code =
+      .ok (outputStore, outputValue)) :
+    inferred.Holds declarations outputStore outputValue :=
+  (soundAt hpost fuel).1 ctx owner current store facts values code outputStore
+    outputValue inferred hctx howner henvironment habstract hconcrete
+
+/-- Exact stored-owner specialization of
+`analyzeCode_sound_ownerCompatible`. -/
+theorem analyzeCode_sound {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef} {store outputStore : Store}
+    {facts : List Fact} {values : List RVal} {code : Code}
+    {outputValue : RVal} {inferred : Fact} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : analyzeCode declarations summaries owner current facts code =
+      .ok inferred)
+    (hconcrete : runCode ctx fuel current store values code =
+      .ok (outputStore, outputValue)) :
+    inferred.Holds declarations outputStore outputValue :=
+  analyzeCode_sound_ownerCompatible hpost hctx (.inl hcurrent) henvironment
+    habstract hconcrete
+
+/-- Operation-level form of `analyzeCode_sound_ownerCompatible`. -/
+theorem analyzeOp_sound_ownerCompatible
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef} {store outputStore : Store}
+    {facts : List Fact} {values : List RVal} {operation : Op}
+    {outputValue : RVal} {inferred : Fact} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (howner : AnalysisOwnerCompatible declarations summaries owner current)
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : analyzeOp declarations summaries owner current facts operation =
+      .ok inferred)
+    (hconcrete : runOp ctx fuel current store values operation =
+      .ok (outputStore, outputValue)) :
+    inferred.Holds declarations outputStore outputValue :=
+  (soundAt hpost fuel).2.1 ctx owner current store facts values operation
+    outputStore outputValue inferred hctx howner henvironment habstract
+    hconcrete
+
+/-- Exact stored-owner specialization used by ordinary HPT consumers. -/
+theorem analyzeOp_sound {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {owner : Address} {current : FnDef} {store outputStore : Store}
+    {facts : List Fact} {values : List RVal} {operation : Op}
+    {outputValue : RVal} {inferred : Fact} {fuel : Nat}
+    (hctx : ctx.decls = declarations)
+    (hcurrent : declarations owner = some (.fn current))
+    (henvironment : EnvironmentHolds declarations store facts values)
+    (habstract : analyzeOp declarations summaries owner current facts operation =
+      .ok inferred)
+    (hconcrete : runOp ctx fuel current store values operation =
+      .ok (outputStore, outputValue)) :
+    inferred.Holds declarations outputStore outputValue :=
+  analyzeOp_sound_ownerCompatible hpost hctx (.inl hcurrent) henvironment
+    habstract hconcrete
+
+/-- Known invocation respects `callableResult` under a local post-fixpoint. -/
+theorem invoke_sound {declarations : DeclEnv} {summaries : SummaryEnv}
+    (hpost : LocalPostFixpoint declarations summaries)
+    {ctx : Ctx} {address : Address} {arguments : List RVal}
+    {store outputStore : Store} {outputValue : RVal} {fact : Fact}
+    {fuel : Nat} (hctx : ctx.decls = declarations)
+    (habstract : callableResult declarations summaries address = .ok fact)
+    (hconcrete : invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    fact.Holds declarations outputStore outputValue :=
+  (soundAt hpost fuel).2.2.1 ctx address arguments store outputStore
+    outputValue fact hctx habstract hconcrete
+
+private theorem lookup_build_some_mem {α : Type}
+    {entries : List (Address × α)} {address : Address} {value : α}
+    (hlookup : AddressEnv.lookup (AddressEnv.build entries) address =
+      some value) : (address, value) ∈ entries := by
+  rw [AddressEnv.lookup_build_apply] at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryValue⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × α => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hentryValue : entryValue = value := by simpa using hvalue
+  subst entryAddress
+  subst entryValue
+  exact List.mem_of_find?_eq_some hfind
+
+private theorem checked_of_checkLocalRows
+    {declarations : DeclEnv} {summaries : SummaryEnv}
+    {entries : List (Address × Decl)} {address : Address}
+    {declaration : Decl} {claimed : Fact}
+    (hrows : checkLocalRows declarations summaries entries = true)
+    (hmember : (address, declaration) ∈ entries)
+    (hsummary : summaries address = some claimed) :
+    checkMember declarations summaries (address, declaration)
+      (address, claimed) = true := by
+  induction entries with
+  | nil => contradiction
+  | cons entry entries ih =>
+      rcases entry with ⟨entryAddress, entryDeclaration⟩
+      simp only [checkLocalRows, Bool.and_eq_true] at hrows
+      rcases List.mem_cons.mp hmember with hsame | hmember
+      · injection hsame with haddress hdeclaration
+        subst entryAddress
+        subst entryDeclaration
+        simpa [hsummary] using hrows.1
+      · exact ih hrows.2 hmember
+
+/-- The executable whole-program condition implies the propositional local
+post-fixpoint used by the evaluator proof. -/
+theorem localPostFixpoint_of_postFixpoint
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    (hcertificate : certificate.postFixpoint program = true) :
+    LocalPostFixpoint (programDeclEnv program) certificate.summaryEnv := by
+  intro address function claimed hdeclaration hsummary
+  have hrows : checkLocalRows (programDeclEnv program) certificate.summaryEnv
+      (declarationEntries program) = true := by
+    unfold Certificate.postFixpoint at hcertificate
+    simp only [Bool.and_eq_true] at hcertificate
+    exact hcertificate.1.2
+  have hmember : (address, Decl.fn function) ∈ declarationEntries program := by
+    apply lookup_build_some_mem
+    simpa [programDeclEnv] using hdeclaration
+  have hchecked := checked_of_checkLocalRows hrows hmember hsummary
+  cases hinferred : inferFunction (programDeclEnv program)
+      certificate.summaryEnv address function with
+  | error error =>
+      simp [checkMember, hinferred] at hchecked
+  | ok inferred =>
+      refine ⟨inferred, rfl, ?_⟩
+      have hparts : claimed.canonical = true ∧ inferred.le claimed = true := by
+        simpa [checkMember, hinferred] using hchecked
+      exact hparts.2
+
+/-- A function row in any accepted certificate covers every successful
+runtime invocation, for arbitrary arguments and fuel. -/
+theorem functionSummary_sound_of_postFixpoint
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {ctx : Ctx} {address : Address} {function : FnDef} {claimed : Fact}
+    {arguments : List RVal} {store outputStore : Store}
+    {outputValue : RVal} {fuel : Nat}
+    (hcertificate : certificate.postFixpoint program = true)
+    (hctx : ctx.decls = programDeclEnv program)
+    (hdeclaration : programDeclEnv program address = some (.fn function))
+    (hsummary : certificate.summaryEnv address = some claimed)
+    (hinvoke : invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds (programDeclEnv program) outputStore outputValue := by
+  apply invoke_sound (localPostFixpoint_of_postFixpoint hcertificate) hctx
+    (hconcrete := hinvoke)
+  simp [callableResult, hdeclaration, hsummary]
+
+/-- Configurable checker success supplies the semantic certificate premise. -/
+theorem functionSummary_sound_of_runWith_eq_ok
+    {limits : Limits} {program : List ReaddressAll.Artifact}
+    {certificate : Certificate} {result : Result}
+    {ctx : Ctx} {address : Address} {function : FnDef} {claimed : Fact}
+    {arguments : List RVal} {store outputStore : Store}
+    {outputValue : RVal} {fuel : Nat}
+    (hcheck : runWith limits program certificate = .ok result)
+    (hctx : ctx.decls = programDeclEnv program)
+    (hdeclaration : programDeclEnv program address = some (.fn function))
+    (hsummary : certificate.summaryEnv address = some claimed)
+    (hinvoke : invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds (programDeclEnv program) outputStore outputValue := by
+  exact functionSummary_sound_of_postFixpoint
+    (postFixpoint_of_runWith_eq_ok hcheck) hctx hdeclaration hsummary hinvoke
+
+/-- Default-limit specialization of
+`functionSummary_sound_of_runWith_eq_ok`. -/
+theorem functionSummary_sound_of_run_eq_ok
+    {program : List ReaddressAll.Artifact} {certificate : Certificate}
+    {result : Result} {ctx : Ctx} {address : Address} {function : FnDef}
+    {claimed : Fact} {arguments : List RVal} {store outputStore : Store}
+    {outputValue : RVal} {fuel : Nat}
+    (hcheck : run program certificate = .ok result)
+    (hctx : ctx.decls = programDeclEnv program)
+    (hdeclaration : programDeclEnv program address = some (.fn function))
+    (hsummary : certificate.summaryEnv address = some claimed)
+    (hinvoke : invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds (programDeclEnv program) outputStore outputValue := by
+  exact functionSummary_sound_of_runWith_eq_ok
+    (limits := defaultLimits) (by simpa [run] using hcheck) hctx hdeclaration
+    hsummary hinvoke
+
+end Ix.Compiler.IxIR1.HPT
diff --git a/Ix/Compiler/IxIR1/Lower.lean b/Ix/Compiler/IxIR1/Lower.lean
new file mode 100644
index 000000000..71540668d
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Lower.lean
@@ -0,0 +1,1589 @@
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.IxIR0.Examples
+
+/-!
+# The IxIR₀ → IxIR₁ lowering (stage 2: mode-directed)
+
+The two RC strategies of the plan, in one pass. Binder modes (`Uses`
+on IxIR₀ `lam`/`letE`, inert until now) direct the memory lowering:
+
+- **`many` → the shared world** (the v1 path): `alloc .shared`,
+  Perceus dup/drop from source-occurrence counting.
+- **`linear`/`affine` → the unique world**: `alloc .unique`,
+  move-only discipline — a unique variable used more than once is a
+  *lowering* error (the operational linear check), a dead `linear`
+  binding is an error, a dead `affine` binding deep-frees via
+  `dropU`. Unique values induce **zero refcount operations** — the
+  no-RC strategy, pinned by counter guards.
+
+Worlds flow as top-down **demands**: a let demands its binder-mode
+world of the bound value; a saturated known call demands each
+argument's world from the callee's lam modes; a constructor
+application allocates in the demanded world and demands the same of
+its fields (whole-value modes, gate B). Static mode errors at the
+boundary: a shared variable at unique demand is dereliction; a unique
+variable at shared demand would need a deep freeze. The v0 contract
+rejects both directions in `UsageCheck` and retains these lowering
+checks as backstops; the planned freeze lift and its wake conditions
+are recorded in `docs/compiler/lowering-restrictions.md`.
+
+Function values (paps) and their captures are deliberately shared in
+this slice. Since `apply` consequently supplies shared arguments, only
+all-`many` telescopes may become function values or partial
+applications; a non-`many` function is accepted only as a saturated
+known call, otherwise lowering rejects it. Also deliberately shared:
+recursor calls entirely (the Lean fragment is all-`many`;
+mode-polymorphic recursors arrive with usage polymorphism/IxIR₀ˢ),
+projection results (unique destructuring needs a real `case`). Definition
+result worlds are carried by both IRs and checked at every statically known
+call; unknown `apply` remains shared-only until paps carry a richer callable
+type. Extern calls use the evaluator's enforced scalar-only
+ABI; a future heap-valued extern needs an explicit ownership policy.
+Reuse *pairing* (free+alloc → `reuse`) stays
+IxIR₂'s optimization as planned: recursor-compiled code allocates
+inside its minors, out of reach of alt-local pairing.
+
+## Stage 1 recap (unchanged mechanics)
+
+ANF over absolute compile-time slots; spine saturation against known
+heads (exact `call`/`alloc`/`extern`, sound under-fill `papp`, over-fill
+call-then-`apply`); recursors to `case`(+`peelNat`)/`callSelf` with
+v1's self-saturation requirement; lambda lifting (a closure is a
+`papp` of its captures) and eta wrappers for first-class ctors;
+`apply` consumes its pap per the `Eval.lean` convention; case
+alternatives dup their fields *before* dropping the scrutinee.
+
+Recorded corners: runtime-◻ into `apply`/`fetch` through a variable
+is stuck here, absorbed at IxIR₀ (erasure never produces it);
+closures compare opaquely against
+paps; synthetic addresses are placeholder bytes; `CtorId.block`
+carries the source constructor address.
+
+The differential harness runs the corpus through both semantics
+(modes are inert at IxIR₀, so source values are unaffected): readback
+trees must agree and every successful run must be leak-free — unique
+results released by deep free, shared ones by drop. Error runs agree
+only through the deliberate `errAgree` mapping (exact kinds,
+addresses, and pinned message pairs — never any-error-vs-any-error).
+-/
+
+namespace Ix.Compiler.IxIR1.Lower
+
+open Ix.Compiler.Ixon (Address Owned Uses)
+open Ix.Compiler.IxIR0 (Literal)
+
+/-! ## Source-side analyses -/
+
+/-- Occurrences of de Bruijn variable `i` in `e`, any position. -/
+def countUses (i : Nat) : IxIR0.Expr → Nat
+  | .var j => if j == i then 1 else 0
+  | .ref _ | .lit _ | .erased => 0
+  | .app f a => countUses i f + countUses i a
+  | .lam _ b => countUses (i + 1) b
+  | .letE _ v b => countUses i v + countUses (i + 1) b
+  | .proj _ s => countUses i s
+
+/-- Length of the leading `lam` run. -/
+def lamArity : IxIR0.Expr → Nat
+  | .lam _ b => lamArity b + 1
+  | _ => 0
+
+/-- Strip the leading `lam` run. -/
+def stripLams : IxIR0.Expr → IxIR0.Expr
+  | .lam _ b => stripLams b
+  | e => e
+
+/-- The binder modes of the leading `lam` run — a known callee's
+argument-world signature. -/
+def lamUses : IxIR0.Expr → List Uses
+  | .lam u b => u :: lamUses b
+  | _ => []
+
+@[simp] theorem lamUses_length (e : IxIR0.Expr) :
+    (lamUses e).length = lamArity e := by
+  induction e <;> simp [lamUses, lamArity, *]
+
+/-- Shared paps can soundly accept only shared (`many`) parameters.
+Non-`many` functions must remain visible as saturated known calls. -/
+def papSafe (e : IxIR0.Expr) : Bool :=
+  (lamUses e).all fun u => u == .many
+
+/-- Stable diagnostic for the v0 no-freeze policy.  Kept public so the
+executable restriction corpus cannot drift from the lowerer. -/
+def freezeNeededMsg : String :=
+  "freeze not in v0: unique value at non-unique sink (see docs/compiler/lowering-restrictions.md)"
+
+/-- Stable diagnostic for first-class functions whose telescope is not
+all-`many`. -/
+def nonManyPapMsg : String :=
+  "non-many function values require saturated known calls (one-shot paps deferred)"
+
+/-- Stable diagnostic for consuming projection from a unique source. -/
+def uniqueDestructuringMsg : String :=
+  "projection from a unique value (unique destructuring deferred)"
+
+/-- Stable diagnostic for a unique value captured by a shared closure. -/
+def uniqueCaptureMsg : String :=
+  "a lambda captures a unique value (deferred)"
+
+/-- Stable diagnostic for a recursive-self value used below saturation. -/
+def underAppliedRecSelfMsg : String :=
+  "under-applied recSelf (v1 requires saturated self-calls)"
+
+/-- The complete policy inventory for the current IxIR₀ → IxIR₁ lowerer.
+Each entry has an exact executable rejection witness in `Guards`; the design
+ledger and wake conditions live in `docs/compiler/lowering-restrictions.md`. -/
+inductive RestrictionKind where
+  | freeze
+  | uniqueDestructuring
+  | sharedFunctionValues
+  | uniqueCapture
+  | modeMonomorphicRecursors
+  | saturatedRecSelf
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+namespace RestrictionKind
+
+def all : Array RestrictionKind := #[
+  .freeze,
+  .uniqueDestructuring,
+  .sharedFunctionValues,
+  .uniqueCapture,
+  .modeMonomorphicRecursors,
+  .saturatedRecSelf
+]
+
+/-- The diagnostic pinned by the representative witness for each policy.
+Mode-monomorphic recursors reject a unique major through the already-decided
+no-freeze boundary, so those two categories deliberately share a message. -/
+def diagnostic : RestrictionKind → String
+  | .freeze | .modeMonomorphicRecursors => freezeNeededMsg
+  | .uniqueDestructuring => uniqueDestructuringMsg
+  | .sharedFunctionValues => nonManyPapMsg
+  | .uniqueCapture => uniqueCaptureMsg
+  | .saturatedRecSelf => underAppliedRecSelfMsg
+
+end RestrictionKind
+
+#guard RestrictionKind.all.size == 6
+#guard RestrictionKind.all.toList.eraseDups.length == 6
+
+/-- The world a binder mode assigns (gate B whole-value scoping):
+linear/affine values are unique, everything else shared. -/
+def worldOfUses : Uses → Owned
+  | .linear | .affine => .unique
+  | _ => .shared
+
+/-- Truncate/pad an argument-world list to length `k` (missing
+positions — beyond a callee's telescope — demand shared). -/
+def padWorlds (ws : List Owned) (k : Nat) : List Owned :=
+  ws.take k ++ List.replicate (k - ws.length) .shared
+
+/-! ## The lowering monad -/
+
+/-- Placeholder synthetic address (lifted functions, constructor
+wrappers): marker byte + counter, disjoint from the hand-written
+corpus space. IxIR₁ content addressing replaces this. -/
+def synthAddr (n : Nat) : Address :=
+  Address.ofFn fun i =>
+    if i.val == 0 then 0xFE
+    else if i.val ≤ 8 then UInt8.ofNat ((n >>> (8 * (i.val - 1))) % 256)
+    else 0xEE
+
+structure WrapperMemo where
+  source : Address
+  tag : Nat
+  arity : Nat
+  wrapper : Address
+  deriving BEq
+
+def WrapperMemo.matches (memo : WrapperMemo) (source : Address)
+    (tag arity : Nat) : Bool :=
+  memo.source == source && memo.tag == tag && memo.arity == arity
+
+structure LowSt where
+  /-- Lifted lambdas and constructor wrappers, accumulated. -/
+  extra : List (Address × Decl) := []
+  /-- Constructor-wrapper memo, including the source shape used to build
+  the wrapper. Recording the shape makes cache consistency explicit and
+  prevents an inconsistent internal caller from reusing the wrong eta
+  expansion for the same address. -/
+  wrappers : List WrapperMemo := []
+  fresh : Nat := 0
+
+abbrev LowerM := EStateM String LowSt
+
+def freshAddr : LowerM Address := do
+  let st ← get
+  set { st with fresh := st.fresh + 1 }
+  pure (synthAddr st.fresh)
+
+def pushExtra (d : Address × Decl) : LowerM Unit :=
+  modify fun st => { st with extra := d :: st.extra }
+
+/-- v1 constructor identity: the constructor's own IxIR₀ address as
+the block, its tag as `cidx`. -/
+def ctorIdOf (adr : Address) (tag : Nat) : CtorId := ⟨adr, 0, tag⟩
+
+/-- The declaration installed for one first-class constructor wrapper. -/
+def descendingVars : Nat → List Atom
+  | 0 => []
+  | arity + 1 => .var arity :: descendingVars arity
+
+@[simp] theorem descendingVars_length (arity : Nat) :
+    (descendingVars arity).length = arity := by
+  induction arity with
+  | zero => rfl
+  | succ arity ih => simp [descendingVars, ih]
+
+def ctorWrapperDecl (source : Address) (tag arity : Nat) : Decl :=
+  let atoms := (descendingVars arity).toArray
+  .fn ⟨arity, .shared, true,
+    .letOp (.alloc .shared (ctorIdOf source tag) atoms)
+      (.ret (.var 0))⟩
+
+/-- Eta-expanding wrapper for a first-class constructor use:
+`fun a₁ … aₙ => alloc cid a₁ … aₙ`, memoized per address. Wrappers
+allocate shared (partial constructor applications live behind shared
+paps this slice). -/
+def wrapperFor (a : Address) (tag ar : Nat) : LowerM Address := do
+  let st ← get
+  match st.wrappers.find? (·.matches a tag ar) with
+  | some memo => pure memo.wrapper
+  | none =>
+    let w := synthAddr st.fresh
+    set { st with
+      fresh := st.fresh + 1,
+      wrappers := ⟨a, tag, ar, w⟩ :: st.wrappers,
+      extra := (w, ctorWrapperDecl a tag ar) :: st.extra }
+    pure w
+
+/-! ## Compile-time environment
+
+Runtime positions are tracked as **absolute** slots (distance from the
+bottom of the runtime env), immune to later bindings; relative de
+Bruijn indices are materialized only at the op that mentions them.
+Entries carry their binder mode: `remaining` counts source occurrences
+not yet emitted; in the shared world a use that leaves
+`remaining > 0` dups and the last use moves, while a unique entry is
+move-only (a second use is a lowering error); `held` records whether
+the slot's ownership is still with it. -/
+
+inductive VEntry where
+  | slot (abs remaining : Nat) (uses : Uses) (held : Bool)
+  /-- The rule-environment recursor slot: only a saturated spine head
+  (compiled to `callSelf`) is supported in v1. -/
+  | recSelf (arity : Nat)
+
+structure VEnv where
+  entries : List VEntry := []
+  depth : Nat := 0
+
+def VEnv.rel (Γ : VEnv) (abs : Nat) : Nat := Γ.depth - 1 - abs
+
+def VEnv.bump (Γ : VEnv) : VEnv := { Γ with depth := Γ.depth + 1 }
+
+def VEnv.pop (Γ : VEnv) : VEnv := { Γ with entries := Γ.entries.tail }
+
+def VEnv.setEntry (Γ : VEnv) (i : Nat) (e : VEntry) : VEnv :=
+  { Γ with entries := Γ.entries.set i e }
+
+/-- Canonical parameter entries, listed in source-variable order
+(innermost first). `base` is the number of older absolute slots below the
+parameter telescope; `remaining i` is the occurrence count of source
+de-Bruijn variable `i`. -/
+def parameterEntries (base : Nat) :
+    List Uses → (Nat → Nat) → List VEntry
+  | [], _ => []
+  | uses :: tail, remaining =>
+    parameterEntries (base + 1) tail remaining ++
+      [.slot base (remaining tail.length) uses true]
+
+/-- Dependent traversal for the canonical parameter-entry builder.  Tail
+layout, absolute-slot advancement, and outer-slot construction recurse once;
+clients provide only empty and appended-slot result constructors. -/
+theorem parameterEntries_traverse
+    (remaining : Nat → Nat)
+    {Result : Nat → List Uses → List VEntry → Prop}
+    (hnil : ∀ base, Result base [] [])
+    (hcons : ∀ {base : Nat} {mode : Uses} {modes : List Uses}
+        {tail : List VEntry},
+      Result (base + 1) modes tail →
+      Result base (mode :: modes)
+        (tail ++ [.slot base (remaining modes.length) mode true])) :
+    ∀ (base : Nat) (modes : List Uses),
+      Result base modes (parameterEntries base modes remaining) := by
+  intro base modes
+  induction modes generalizing base with
+  | nil => exact hnil base
+  | cons mode modes ih =>
+    simpa [parameterEntries] using hcons (ih (base + 1))
+
+/-- Logical entries for an ordered subset of older slots captured by a lifted
+lambda. Selected entries receive consecutive absolute capture slots; entries
+outside the subset remain as released proof-side placeholders so source
+de-Bruijn indices are preserved. -/
+def selectedEntriesFrom (selected : Nat → Bool) (remaining : Nat → Nat) :
+    List Nat → Nat → List VEntry
+  | [], _ => []
+  | index :: rest, next =>
+      if selected index then
+        .slot next (remaining index) .many true ::
+          selectedEntriesFrom selected remaining rest (next + 1)
+      else
+        .slot 0 0 .many false ::
+          selectedEntriesFrom selected remaining rest next
+
+/-- Dependent traversal for the selected-entry builder.  Selection dispatch,
+absolute-slot advancement, and released/held entry construction recurse once;
+clients provide only empty, unselected, and selected result constructors. -/
+theorem selectedEntriesFrom_traverse
+    (selected : Nat → Bool) (remaining : Nat → Nat)
+    {Result : List Nat → Nat → List VEntry → Prop}
+    (hnil : ∀ next, Result [] next [])
+    (hfalse : ∀ {index : Nat} {rest : List Nat} {next : Nat}
+        {tail : List VEntry},
+      selected index = false →
+      Result rest next tail →
+      Result (index :: rest) next
+        (.slot 0 0 .many false :: tail))
+    (htrue : ∀ {index : Nat} {rest : List Nat} {next : Nat}
+        {tail : List VEntry},
+      selected index = true →
+      Result rest (next + 1) tail →
+      Result (index :: rest) next
+        (.slot next (remaining index) .many true :: tail)) :
+    ∀ (indices : List Nat) (next : Nat),
+      Result indices next
+        (selectedEntriesFrom selected remaining indices next) := by
+  intro indices
+  induction indices with
+  | nil => exact hnil
+  | cons index rest ih =>
+    intro next
+    cases hselected : selected index with
+    | false =>
+      simpa [selectedEntriesFrom, hselected] using
+        hfalse hselected (ih next)
+    | true =>
+      simpa [selectedEntriesFrom, hselected] using
+        htrue hselected (ih (next + 1))
+
+@[simp] theorem selectedEntriesFrom_length (selected : Nat → Bool)
+    (remaining : Nat → Nat) (indices : List Nat) (next : Nat) :
+    (selectedEntriesFrom selected remaining indices next).length =
+      indices.length := by
+  exact selectedEntriesFrom_traverse selected remaining
+    (Result := fun sourceIndices _ entries =>
+      entries.length = sourceIndices.length)
+    (hnil := fun _ => rfl)
+    (hfalse := by
+      intro index rest current tail hselected htail
+      simpa using congrArg Nat.succ htail)
+    (htrue := by
+      intro index rest current tail hselected htail
+      simpa using congrArg Nat.succ htail)
+    indices next
+
+@[simp] theorem parameterEntries_length (base : Nat) (modes : List Uses)
+    (remaining : Nat → Nat) :
+    (parameterEntries base modes remaining).length = modes.length := by
+  exact parameterEntries_traverse remaining
+    (Result := fun _ sourceModes entries =>
+      entries.length = sourceModes.length)
+    (hnil := fun _ => rfl)
+    (hcons := by
+      intro current mode rest tail htail
+      simpa using congrArg Nat.succ htail)
+    base modes
+
+/-- One dead parameter to release at function entry. Recording both its
+source-entry index and absolute runtime slot lets the emitted operation and
+the proof-side ownership environment advance together. -/
+structure SlotDrop where
+  entry : Nat
+  abs : Nat
+  uses : Uses
+
+/-- Shift a release descriptor past a leading block of unrelated `VEnv`
+entries. Absolute runtime positions are unchanged. -/
+def SlotDrop.offsetEntry (offset : Nat) (drop : SlotDrop) : SlotDrop :=
+  { drop with entry := offset + drop.entry }
+
+/-- The canonical inner-to-outer release plan for parameters with no body
+occurrences. -/
+def parameterDrops (base : Nat) :
+    List Uses → (Nat → Nat) → List SlotDrop
+  | [], _ => []
+  | uses :: tail, remaining =>
+    parameterDrops (base + 1) tail remaining ++
+      if remaining tail.length == 0 then
+        [⟨tail.length, base, uses⟩]
+      else []
+
+/-- A lowered value: an owned runtime slot or an inert scalar atom. -/
+inductive AVal where
+  | slotA (abs : Nat)
+  | constA (a : Atom)
+
+def AVal.toAtom (Γ : VEnv) : AVal → Atom
+  | .slotA abs => .var (Γ.rel abs)
+  | .constA a => a
+
+/-! ## Emission -/
+
+abbrev Emit := Code → Code
+
+def emitOp (op : Op) : Emit := fun c => .letOp op c
+
+/-- Release owned slots at a binder boundary, by mode: `many` drops,
+`affine` deep-frees, a dead `linear` binding is an error. -/
+def releaseSlots (Γ : VEnv) : List SlotDrop → LowerM (VEnv × Emit)
+  | [] => pure (Γ, id)
+  | drop :: rest => do
+    let em ← match drop.uses with
+      | .many => pure (emitOp (.drop (.var (Γ.rel drop.abs))))
+      | .affine => pure (emitOp (.dropU (.var (Γ.rel drop.abs))))
+      | .linear => throw "unused linear binding"
+      | .erased => throw "internal: erased binder mode survived erasure"
+    let Γ := Γ.setEntry drop.entry
+      (.slot drop.abs 0 drop.uses false)
+    let (Γ', em') ← releaseSlots Γ.bump rest
+    pure (Γ', em ∘ em')
+
+/-- One borrowed constructor field that a recursor alternative retains before
+dropping its major. `entry` is the rule-source variable slot, `fieldAbs` is
+the borrowed field's original absolute runtime position, and `remaining` is
+its body occurrence count. -/
+structure RecursorFieldRetain where
+  entry : Nat
+  fieldAbs : Nat
+  remaining : Nat
+
+/-- Canonical constructor-order retain list. Rule source variables list fields
+in the opposite order, so entry indices count down while physical field
+positions count up. -/
+def recursorFieldRetains (fieldAbs : Nat) (rhs : IxIR0.Expr) :
+    Nat → List RecursorFieldRetain
+  | 0 => []
+  | fieldCount + 1 =>
+    let uses := countUses fieldCount rhs
+    (if uses == 0 then [] else [⟨fieldCount, fieldAbs, uses⟩]) ++
+      recursorFieldRetains (fieldAbs + 1) rhs fieldCount
+
+/-- Dependent traversal for the canonical recursor-field retain builder.
+Descending source-entry indices, ascending absolute field slots, and the
+zero-use retain omission recurse once; clients provide only empty, skipped,
+and retained-field result constructors. -/
+theorem recursorFieldRetains_traverse
+    (rhs : IxIR0.Expr)
+    {Result : Nat → Nat → List RecursorFieldRetain → Prop}
+    (hnil : ∀ fieldAbs, Result fieldAbs 0 [])
+    (hskip : ∀ {fieldAbs fieldCount : Nat}
+        {tail : List RecursorFieldRetain},
+      countUses fieldCount rhs = 0 →
+      Result (fieldAbs + 1) fieldCount tail →
+      Result fieldAbs (fieldCount + 1) tail)
+    (hretain : ∀ {fieldAbs fieldCount : Nat}
+        {tail : List RecursorFieldRetain},
+      countUses fieldCount rhs ≠ 0 →
+      Result (fieldAbs + 1) fieldCount tail →
+      Result fieldAbs (fieldCount + 1)
+        (⟨fieldCount, fieldAbs, countUses fieldCount rhs⟩ :: tail)) :
+    ∀ (fieldAbs fieldCount : Nat),
+      Result fieldAbs fieldCount
+        (recursorFieldRetains fieldAbs rhs fieldCount) := by
+  intro fieldAbs fieldCount
+  induction fieldCount generalizing fieldAbs with
+  | zero => exact hnil fieldAbs
+  | succ fieldCount ih =>
+    by_cases hzero : countUses fieldCount rhs = 0
+    · simpa [recursorFieldRetains, hzero] using
+        hskip hzero (ih (fieldAbs + 1))
+    · simpa [recursorFieldRetains, hzero] using
+        hretain hzero (ih (fieldAbs + 1))
+
+/-- Execute a canonical field-retain list, updating the field-entry block and
+building the exact `dup` emitter used by a recursor alternative. -/
+def applyRecursorFieldRetains (Γ : VEnv) :
+    List RecursorFieldRetain → VEnv × Emit
+  | [] => (Γ, id)
+  | retain :: rest =>
+    let em := emitOp (.dup (.var (Γ.rel retain.fieldAbs)))
+    let Γ :=
+      (Γ.setEntry retain.entry
+        (.slot Γ.depth retain.remaining .many true)).bump
+    let (Γ', em') := applyRecursorFieldRetains Γ rest
+    (Γ', em ∘ em')
+
+/-- Release owned shared values whose result is discarded
+(◻ absorption; arguments there are demanded shared). -/
+def releaseAll (Γ : VEnv) : List AVal → VEnv × Emit
+  | [] => (Γ, id)
+  | .constA _ :: rest => releaseAll Γ rest
+  | .slotA abs :: rest =>
+    let em := emitOp (.drop (.var (Γ.rel abs)))
+    let (Γ', em') := releaseAll Γ.bump rest
+    (Γ', em ∘ em')
+
+/-- Check a statically known heap-result world against its consuming
+demand. Scalars satisfy either world dynamically, but without a scalar
+result type the lowering must conservatively respect the declaration. -/
+def requireResultWorld (actual demand : Owned) : LowerM Unit := do
+  if actual == demand then pure ()
+  else if actual == .unique then
+    throw freezeNeededMsg
+  else
+    throw "call result is shared at unique demand"
+
+private def fuelMsg : String := "lowering fuel exhausted"
+
+mutual
+
+/-- Lower `e` in a consuming position at demanded world `w`: the
+returned value carries one ownership, which the caller must consume
+exactly once. Static producers and declared call results are checked
+against that demand. -/
+def lowerE (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (w : Owned)
+    (e : IxIR0.Expr) : LowerM (VEnv × Emit × AVal) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 =>
+    match e with
+    | .var i =>
+      match Γ.entries[i]? with
+      | none => throw s!"unbound source variable {i}"
+      | some (.recSelf _) =>
+        throw "recSelf escapes: v1 supports only saturated self-calls"
+      | some (.slot abs remaining uses held) =>
+        if !held then throw s!"internal: variable {i} used after release"
+        else if worldOfUses uses != w then
+          if worldOfUses uses == .unique then
+            throw freezeNeededMsg
+          else
+            throw "dereliction: shared value at unique demand"
+        else if remaining ≥ 2 then
+          if worldOfUses uses == .unique then
+            throw "unique variable used more than once"
+          else
+            let Γ := Γ.setEntry i (.slot abs (remaining - 1) uses true)
+            let dupAbs := Γ.depth
+            pure (Γ.bump, emitOp (.dup (.var (Γ.rel abs))), .slotA dupAbs)
+        else if remaining == 1 then
+          let Γ := Γ.setEntry i (.slot abs 0 uses false)
+          pure (Γ, id, .slotA abs)
+        else throw s!"internal: variable {i} overcounted"
+    | .lit l => pure (Γ, id, .constA (.lit l))
+    | .erased => pure (Γ, id, .constA .erased)
+    | .lam _ _ =>
+      if w == .unique then
+        throw "function values live in the shared world (one-shot closures deferred)"
+      else lowerLam src fuel Γ e
+    | .letE u val body => do
+      let (Γ, em1, av) ← lowerE src fuel Γ (worldOfUses u) val
+      let n := countUses 0 body
+      match av with
+      | .slotA abs =>
+        if n == 0 then
+          let em2 ← match u with
+            | .many => pure (emitOp (.drop (.var (Γ.rel abs))))
+            | .affine => pure (emitOp (.dropU (.var (Γ.rel abs))))
+            | .linear => throw "unused linear binding"
+            | .erased => throw "internal: erased binder mode survived erasure"
+          let Γ := { Γ with entries := .slot abs 0 u false :: Γ.entries,
+                            depth := Γ.depth + 1 }
+          let (Γ, em3, r) ← lowerE src fuel Γ w body
+          pure (Γ.pop, em1 ∘ em2 ∘ em3, r)
+        else
+          let Γ := { Γ with entries := .slot abs n u true :: Γ.entries }
+          let (Γ, em3, r) ← lowerE src fuel Γ w body
+          pure (Γ.pop, em1 ∘ em3, r)
+      | .constA a =>
+        let slotAbs := Γ.depth
+        let em2 := emitOp (.pure a)
+        let ent : VEntry := if n == 0 then .slot slotAbs 0 u false
+                            else .slot slotAbs n u true
+        let Γ := { Γ with entries := ent :: Γ.entries,
+                          depth := Γ.depth + 1 }
+        let (Γ, em3, r) ← lowerE src fuel Γ w body
+        pure (Γ.pop, em1 ∘ em2 ∘ em3, r)
+    | .app f a => lowerSpine src fuel Γ w f [a]
+    | .proj i s => do
+      if w == .unique then
+        throw "projection produces a shared field (unique destructuring deferred)"
+      let (Γ, em1, sv, release) ← lowerBorrow src fuel Γ s
+      match sv with
+      | .constA .erased => pure (Γ, em1, .constA .erased)  -- ◻ absorbs
+      | .constA a =>
+        -- scalar struct: runtime-stuck on both sides, emit faithfully
+        let em2 := emitOp (.fetch a i)
+        pure (Γ.bump, em1 ∘ em2, .slotA Γ.depth)
+      | .slotA abs =>
+        let em2 := emitOp (.fetch (.var (Γ.rel abs)) i)
+        let fAbs := Γ.depth
+        let Γ := Γ.bump
+        let em3 := emitOp (.dup (.var (Γ.rel fAbs)))  -- own the field
+        let dAbs := Γ.depth
+        let Γ := Γ.bump
+        if release then
+          let em4 := emitOp (.drop (.var (Γ.rel abs)))
+          pure (Γ.bump, em1 ∘ em2 ∘ em3 ∘ em4, .slotA dAbs)
+        else
+          pure (Γ, em1 ∘ em2 ∘ em3, .slotA dAbs)
+    | .ref a =>
+      match src a with
+      | none => throw "unknown source reference"
+      | some (.defn result body) =>
+        let n := lamArity body
+        if n == 0 then do
+          -- computed global: evaluate now (IxIR₀ evaluates at `ref`)
+          requireResultWorld result w
+          pure (Γ.bump, emitOp (.call a #[]), .slotA Γ.depth)
+        else if w == .unique then
+          throw "function values live in the shared world (one-shot closures deferred)"
+        else if result == .unique then
+          throw "partial applications of unique-result definitions are deferred"
+        else if !papSafe body then
+          throw nonManyPapMsg
+        else
+          pure (Γ.bump, emitOp (.papp a #[]), .slotA Γ.depth)
+      | some (.ctor tag ar) =>
+        if ar == 0 then
+          pure (Γ.bump, emitOp (.alloc w (ctorIdOf a tag) #[]),
+            .slotA Γ.depth)
+        else if w == .unique then
+          throw "partial constructor applications are shared (deferred)"
+        else do
+          let w' ← wrapperFor a tag ar
+          pure (Γ.bump, emitOp (.papp w' #[]), .slotA Γ.depth)
+      | some (.recursor _ _ _) =>
+        if w == .unique then
+          throw "function values live in the shared world (one-shot closures deferred)"
+        else
+          pure (Γ.bump, emitOp (.papp a #[]), .slotA Γ.depth)
+      | some (.extern ar) =>
+        if ar == 0 then
+          pure (Γ.bump, emitOp (.extern a #[]), .slotA Γ.depth)
+        else if w == .unique then
+          throw "function values live in the shared world (one-shot closures deferred)"
+        else
+          pure (Γ.bump, emitOp (.papp a #[]), .slotA Γ.depth)
+  termination_by fuel
+
+/-- Lower `e` in a borrowing position (`fetch` target — shared only:
+unique destructuring is deferred with real `case`). The returned flag
+says whether the caller must release the value (emit `drop`) right
+after the borrowing op: true for temporaries and for a variable's
+last occurrence. -/
+def lowerBorrow (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (e : IxIR0.Expr) : LowerM (VEnv × Emit × AVal × Bool) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 =>
+    match e with
+    | .var i =>
+      match Γ.entries[i]? with
+      | none => throw s!"unbound source variable {i}"
+      | some (.recSelf _) => throw "recSelf in a borrowing position"
+      | some (.slot abs remaining uses held) =>
+        if !held then throw s!"internal: variable {i} borrowed after release"
+        else if worldOfUses uses == .unique then
+          throw uniqueDestructuringMsg
+        else if remaining == 1 then
+          let Γ := Γ.setEntry i (.slot abs 0 uses false)
+          pure (Γ, id, .slotA abs, true)   -- last occurrence: release after
+        else if remaining ≥ 2 then
+          let Γ := Γ.setEntry i (.slot abs (remaining - 1) uses true)
+          pure (Γ, id, .slotA abs, false)
+        else throw s!"internal: variable {i} overcounted"
+    | _ => do
+      let (Γ, em, av) ← lowerE src fuel Γ .shared e
+      let release := match av with | .slotA _ => true | .constA _ => false
+      pure (Γ, em, av, release)
+  termination_by fuel
+
+/-- Flatten and dispatch an application spine; `w` is the demanded
+world of the spine's result. Allocations use it and known calls check
+their declared result against it. -/
+def lowerSpine (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (w : Owned)
+    (h : IxIR0.Expr) (args : List IxIR0.Expr) :
+    LowerM (VEnv × Emit × AVal) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 =>
+    match h with
+    | .app f a => lowerSpine src fuel Γ w f (a :: args)
+    | .erased =>
+      -- ◻ head: arguments are still evaluated (then discarded), the
+      -- application is absorbed statically
+      applyRest src fuel Γ w id (.constA .erased) args
+    | .var i =>
+      match Γ.entries[i]? with
+      | some (.recSelf arity) =>
+        if args.length < arity then
+          throw underAppliedRecSelfMsg
+        else do
+          requireResultWorld .shared w
+          knownCall src fuel Γ (.callSelf ·) arity
+            (List.replicate arity .shared) w args
+      | _ => do
+        let (Γ, em1, f) ← lowerE src fuel Γ .shared h
+        applyRest src fuel Γ w em1 f args
+    | .ref a =>
+      match src a with
+      | none => throw "unknown source reference"
+      | some (.defn result body) =>
+        let n := lamArity body
+        if args.length < n then
+          if w == .unique then
+            throw "function values live in the shared world (one-shot closures deferred)"
+          else if result == .unique then
+            throw "partial applications of unique-result definitions are deferred"
+          else if !papSafe body then
+            throw nonManyPapMsg
+          else
+            -- partial application: all parameters and pap storage are shared
+            knownCall src fuel Γ (.papp a ·) args.length
+              (List.replicate args.length .shared) w args
+        else do
+          requireResultWorld result (if args.length == n then w else .shared)
+          knownCall src fuel Γ (.call a ·) n
+            ((lamUses body).map worldOfUses) w args
+      | some (.ctor tag ar) =>
+        if args.length < ar then
+          if w == .unique then
+            throw "partial constructor applications are shared (deferred)"
+          else do
+            let w' ← wrapperFor a tag ar
+            knownCall src fuel Γ (.papp w' ·) args.length
+              (List.replicate args.length .shared) w args
+        else
+          -- whole-value modes: fields are demanded the node's world
+          knownCall src fuel Γ (.alloc w (ctorIdOf a tag) ·) ar
+            (List.replicate ar w) w args
+      | some (.recursor numArgs _ _) =>
+        -- recursors are the all-`many` fragment this slice
+        let arity := numArgs + 1
+        if args.length < arity then
+          if w == .unique then
+            throw "function values live in the shared world (one-shot closures deferred)"
+          else
+            knownCall src fuel Γ (.papp a ·) args.length
+              (List.replicate args.length .shared) w args
+        else do
+          requireResultWorld .shared w
+          knownCall src fuel Γ (.call a ·) arity
+            (List.replicate arity .shared) w args
+      | some (.extern ar) =>
+        if args.length < ar then
+          if w == .unique then
+            throw "function values live in the shared world (one-shot closures deferred)"
+          else
+            knownCall src fuel Γ (.papp a ·) args.length
+              (List.replicate args.length .shared) w args
+        else
+          knownCall src fuel Γ (.extern a ·) ar
+            (List.replicate ar .shared) w args
+    | _ => do
+      let (Γ, em1, f) ← lowerE src fuel Γ .shared h
+      applyRest src fuel Γ w em1 f args
+  termination_by fuel
+
+/-- Lower the first `n` spine arguments at the given per-argument
+worlds, emit `build` over them, and feed any remaining arguments
+through `apply`. -/
+def knownCall (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (build : Array Atom → Op) (n : Nat) (argWs : List Owned)
+    (resultW : Owned) (args : List IxIR0.Expr) :
+    LowerM (VEnv × Emit × AVal) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 => do
+    let (Γ, em1, avs) ← lowerArgs src fuel Γ
+      ((args.take n).zip (padWorlds argWs n))
+    let atoms := (avs.map (·.toAtom Γ)).toArray
+    let res := Γ.depth
+    let Γ := Γ.bump
+    let em := em1 ∘ emitOp (build atoms)
+    if args.length ≤ n then pure (Γ, em, .slotA res)
+    else applyRest src fuel Γ resultW em (.slotA res) (args.drop n)
+  termination_by fuel
+
+/-- Left-to-right argument lowering (matching IxIR₀'s evaluation
+order), each at its demanded world; atoms are materialized by the
+caller at the consuming op. -/
+def lowerArgs (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (args : List (IxIR0.Expr × Owned)) :
+    LowerM (VEnv × Emit × List AVal) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 =>
+    match args with
+    | [] => pure (Γ, id, [])
+    | (a, aw) :: rest => do
+      let (Γ, em1, av) ← lowerE src fuel Γ aw a
+      let (Γ, em2, avs) ← lowerArgs src fuel Γ rest
+      pure (Γ, em1 ∘ em2, av :: avs)
+  termination_by fuel
+
+/-- Apply a function value to further arguments (`apply` consumes the
+function per the `Eval.lean` convention); unknown callees demand
+shared arguments. A syntactic ◻ function is absorbed statically —
+arguments are lowered and released. -/
+def applyRest (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (resultW : Owned)
+    (pre : Emit) (f : AVal) (args : List IxIR0.Expr) :
+    LowerM (VEnv × Emit × AVal) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 =>
+    match f with
+    | .constA .erased => do
+      let (Γ, em, avs) ← lowerArgs src fuel Γ
+        (args.map (fun a => (a, Owned.shared)))
+      let (Γ, em2) := releaseAll Γ avs
+      pure (Γ, pre ∘ em ∘ em2, .constA .erased)
+    | _ => do
+      requireResultWorld .shared resultW
+      let (Γ, em, avs) ← lowerArgs src fuel Γ
+        (args.map (fun a => (a, Owned.shared)))
+      let fAtom := f.toAtom Γ
+      let atoms := (avs.map (·.toAtom Γ)).toArray
+      let res := Γ.depth
+      pure (Γ.bump, pre ∘ em ∘ emitOp (.apply fAtom atoms), .slotA res)
+  termination_by fuel
+
+/-- Consume one shared outer value into a lifted lambda's capture prefix.
+The source occurrence count inside the lambda is discharged all at once:
+retain when later source uses remain, otherwise move the existing owner. -/
+def lowerCapture (e : IxIR0.Expr) (Γ : VEnv) (i : Nat) :
+    LowerM (VEnv × Emit × AVal) := do
+  match Γ.entries[i]? with
+  | some (.slot abs r uses held) =>
+    if !held then throw "internal: capture of a released variable"
+    else if worldOfUses uses == .unique then
+      throw uniqueCaptureMsg
+    else
+      let inLam := countUses i e
+      if r > inLam then
+        let Γ := Γ.setEntry i (.slot abs (r - inLam) uses true)
+        let dupAbs := Γ.depth
+        pure (Γ.bump, emitOp (.dup (.var (Γ.rel abs))), .slotA dupAbs)
+      else if r == inLam then
+        let Γ := Γ.setEntry i (.slot abs 0 uses false)
+        pure (Γ, id, .slotA abs)
+      else throw "internal: capture overcount"
+  | some (.recSelf _) =>
+    throw "recSelf captured by a lambda (v1 unsupported)"
+  | none => throw "internal: capture out of range"
+
+/-- Structurally recursive capture traversal. Factoring this out of
+`lowerLam` exposes the exact induction boundary while preserving the old
+left-to-right `foldlM` order and output vector. -/
+def lowerCaptures (e : IxIR0.Expr) :
+    VEnv → List Nat → LowerM (VEnv × Emit × List AVal)
+  | Γ, [] => pure (Γ, id, [])
+  | Γ, i :: rest => do
+    let (Γ, emitHead, value) ← lowerCapture e Γ i
+    let (Γ, emitTail, values) ← lowerCaptures e Γ rest
+    pure (Γ, emitHead ∘ emitTail, value :: values)
+
+/-- Lift an all-`many` `lam` run to a fresh top-level function over
+captures ++ parameters (captures must be shared — paps are shared
+nodes); the site value is a `papp` of the captures. Non-`many` local
+lambdas would require a one-shot pap representation and are rejected. -/
+def lowerLam (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (e : IxIR0.Expr) : LowerM (VEnv × Emit × AVal) :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 => do
+    let nParams := lamArity e
+    let us := lamUses e
+    unless papSafe e do
+      throw nonManyPapMsg
+    let body := stripLams e
+    let caps := (List.range Γ.entries.length).filter
+      (fun i => countUses i e > 0)
+    -- consume one ownership per capture at the site
+    let (Γ, emC, capVals) ← lowerCaptures e Γ caps
+    let fnAddr ← freshAddr
+    let k := caps.length
+    let fnArity := k + nParams
+    -- lifted body venv: runtime env = params.reverse ++ caps.reverse,
+    -- so capture j sits at abs j, parameter i (source var i, innermost
+    -- first) at abs (k + nParams - 1 - i); parameters keep their
+    -- binder modes (a linear parameter is a unique value in the body),
+    -- and `us` is outermost-first, so var i's mode sits at nParams-1-i
+    let paramEnts := parameterEntries k us fun i => countUses i body
+    let outerEnts := selectedEntriesFrom
+      (fun m => countUses m e > 0)
+      (fun m => countUses (nParams + m) body)
+      (List.range Γ.entries.length) 0
+    let paramDrops := parameterDrops k us fun i => countUses i body
+    let code ← lowerFnBody src fuel
+      ⟨paramEnts ++ outerEnts, fnArity⟩ paramDrops .shared body
+    pushExtra (fnAddr, .fn ⟨fnArity, .shared, true, code⟩)
+    let capAtoms := (capVals.map (·.toAtom Γ)).toArray
+    let res := Γ.depth
+    pure (Γ.bump, emC ∘ emitOp (.papp fnAddr capAtoms), .slotA res)
+  termination_by fuel
+
+/-- Lower a function body at result demand `w`: mode-directed entry
+releases for dead parameters, then the body, closed with `ret`. -/
+def lowerFnBody (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (drops : List SlotDrop) (w : Owned) (body : IxIR0.Expr) :
+    LowerM Code :=
+  match fuel with
+  | 0 => throw fuelMsg
+  | fuel + 1 => do
+    let (Γ, em0) ← releaseSlots Γ drops
+    let (Γ, em, av) ← lowerE src fuel Γ w body
+    pure (em0 (em (.ret (av.toAtom Γ))))
+  termination_by fuel
+
+end
+
+/-! ## Declaration lowering -/
+
+/-- Lower one indexed recursor rule. Factoring this out of the array traversal
+keeps the generated-alternative proof aligned with the executable compiler. -/
+def lowerRecursorRule (src : IxIR0.Env) (fuel : Nat) (numArgs : Nat) :
+    IxIR0.RecRule × Nat → LowerM Alt
+  | (rule, tag) => do
+  let arity := numArgs + 1
+  let dead : VEntry := .slot 0 0 .many false
+  let nf := rule.fields
+  let d0 := arity + nf
+  -- entry runtime env (bottom-up): pre₁ … pre_numArgs, major,
+  -- field₁ … field_nf; field j (1-based) ↔ source var (nf - j)
+  let fieldRetains :=
+    recursorFieldRetains (numArgs + 1) rule.rhs nf
+  let (Γ0, emDups) :=
+    applyRecursorFieldRetains
+      ⟨List.replicate nf dead, d0⟩ fieldRetains
+  -- the rules never see the major: release it (after the field dups)
+  let emMaj := emitOp (.drop (.var (Γ0.rel numArgs)))
+  let Γ1 := Γ0.bump
+  -- Pre-major parameters reuse the canonical declaration layout/release
+  -- path. Their entries sit after the field block, so only proof-side entry
+  -- indices are offset; absolute runtime positions stay `0 .. numArgs-1`.
+  let paramModes := List.replicate numArgs .many
+  let paramRemaining : Nat → Nat :=
+    fun i => countUses (nf + i) rule.rhs
+  let paramEnts := parameterEntries 0 paramModes paramRemaining
+  let paramDrops :=
+    (parameterDrops 0 paramModes paramRemaining).map
+      (SlotDrop.offsetEntry nf)
+  let Γparams : VEnv :=
+    ⟨Γ0.entries ++ paramEnts ++ [.recSelf arity], Γ1.depth⟩
+  let (Γrhs, emPar) ← releaseSlots Γparams paramDrops
+  let (Γ3, emR, av) ← lowerE src fuel Γrhs .shared rule.rhs
+  let code := emDups (emMaj (emPar (emR (.ret (av.toAtom Γ3)))))
+  pure (Alt.mk tag nf code)
+
+/-- Compile a recursor to a function: one `case` on the major premise
+(last argument), alternatives from the rules. Per alternative: dup the
+fields the rule uses (they are borrowed from the scrutinee), *then*
+drop the major, then drop parameters dead in this branch, then the
+lowered rule rhs. The rule-environment convention
+`fields.reverse ++ preMajor.reverse ++ [recSelf]` maps onto case-field
+and parameter slots; the recSelf slot compiles to `callSelf`.
+Recursors are the all-`many` fragment this slice — everything shared. -/
+def lowerRecursor (src : IxIR0.Env) (fuel : Nat) (numArgs : Nat)
+    (natLit : Bool) (rules : Array IxIR0.RecRule) : LowerM FnDef := do
+  let arity := numArgs + 1
+  let altsL ← rules.toList.zipIdx.mapM
+    (lowerRecursorRule src fuel numArgs)
+  pure ⟨arity, .shared, true, .case (.var 0) natLit altsL.toArray⟩
+
+/-- Lower one declaration. Constructors get no declaration of their
+own (saturated sites `alloc`; first-class sites go through wrappers,
+which land in the accumulated extras). Definition parameters keep
+their binder modes, while the declared result world directs body
+lowering and is preserved in `FnDef`. -/
+def lowerDecl (src : IxIR0.Env) (fuel : Nat) :
+    Address × IxIR0.Decl → LowerM (Option (Address × Decl))
+  | (a, .defn result body) => do
+    let n := lamArity body
+    let us := lamUses body
+    let b := stripLams body
+    let entries := parameterEntries 0 us fun i => countUses i b
+    let drops := parameterDrops 0 us fun i => countUses i b
+    let code ← lowerFnBody src fuel ⟨entries, n⟩ drops result b
+    pure (some (a, .fn
+      ⟨n, result, result == .shared && papSafe body, code⟩))
+  | (_, .ctor _ _) => pure none
+  | (a, .recursor numArgs natLit rules) => do
+    pure (some (a, .fn (← lowerRecursor src fuel numArgs natLit rules)))
+  | (a, .extern ar) => pure (some (a, .extern ar))
+
+/-- The stateful whole-program action. Factoring it from `lowerAll` exposes
+the final generated-declaration and wrapper-cache state to proofs while the
+transient lowering API returns only declarations and main code. Production
+artifacts cross `LowerAddressed.lowerAllAddressed`, which consumes this final
+state and replaces generated names with declaration content addresses. -/
+def lowerAllAction (decls : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainW : Owned) (fuel : Nat) :
+    LowerM (List (Address × Decl) × Code) := do
+  let src := IxIR0.Env.ofList decls
+  let base ← decls.filterMapM (lowerDecl src fuel)
+  let mainC ← lowerFnBody src fuel ⟨[], 0⟩ [] mainW main
+  let st ← get
+  pure (base ++ st.extra, mainC)
+
+/-- Lower a whole program plus a closed main expression, at the given result
+world for the main expression. This theorem-facing result still contains
+transient generated names; use `lowerAllAddressed` for an emitted artifact. -/
+def lowerAll (decls : List (Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainW : Owned := .shared) (fuel : Nat := 10000) :
+    Except String (List (Address × Decl) × Code) :=
+  match (lowerAllAction decls main mainW fuel).run {} with
+  | .ok v _ => .ok v
+  | .error e _ => .error e
+
+/-- The indexed form of the stateful whole-program action.  Keeping the final
+state observable lets the compiled artifact boundary distinguish generated
+declarations from source-backed declarations without recognizing the
+temporary address spelling. -/
+def lowerAllIndexedAction (decls : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainW : Owned) (fuel : Nat) :
+    LowerM (List (Address × Decl) × Code) :=
+  let sourceIndex := IxIR0.Env.Index.ofList decls
+  let src := sourceIndex.toEnv
+  do
+    let base ← decls.filterMapM (lowerDecl src fuel)
+    let mainC ← lowerFnBody src fuel ⟨[], 0⟩ [] mainW main
+    let st ← get
+    pure (base ++ st.extra, mainC)
+
+/-- The indexed action is propositionally the transparent action: its
+captured index implements exactly `Env.ofList` lookup semantics. -/
+theorem lowerAllIndexedAction_eq_lowerAllAction
+    (decls : List (Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainW : Owned) (fuel : Nat) :
+    lowerAllIndexedAction decls main mainW fuel =
+      lowerAllAction decls main mainW fuel := by
+  simp only [lowerAllIndexedAction, lowerAllAction,
+    IxIR0.Env.Index.toEnv_ofList]
+
+/-- Corpus-scale transient entry point. It constructs the source address index
+once, then runs the same declaration/main lowering action against the captured
+lookup closure. `lowerAllIndexed_eq_lowerAll` keeps the transparent list
+environment as the proof specification; emitted artifacts use
+`lowerAllIndexedAddressed`. -/
+def lowerAllIndexed (decls : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainW : Owned := .shared) (fuel : Nat := 10000) :
+    Except String (List (Address × Decl) × Code) :=
+  match (lowerAllIndexedAction decls main mainW fuel).run {} with
+  | .ok value _ => .ok value
+  | .error error _ => .error error
+
+theorem lowerAllIndexed_eq_lowerAll
+    (decls : List (Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainW : Owned) (fuel : Nat) :
+    lowerAllIndexed decls main mainW fuel = lowerAll decls main mainW fuel := by
+  simp only [lowerAllIndexed, lowerAllIndexedAction, lowerAll, lowerAllAction,
+    IxIR0.Env.Index.toEnv_ofList]
+
+/-! ## Readback and the differential harness
+
+Both semantics read back to first-order trees. Constructor identity
+compares by the source address (which v1 threads through
+`CtorId.block`); pap nodes compare by missing-arity and stored
+arguments (their function addresses differ by construction — wrappers
+and lifts are synthetic); IxIR₀ closures are opaque and match any
+function-shaped tree. -/
+
+inductive Tree where
+  | ctorT (adr : Address) (tag : Nat) (args : List Tree)
+  | litT (l : Literal)
+  | erasedT
+  | papT (missing : Nat) (args : List Tree)
+  | funT
+
+mutual
+
+def Tree.agree : Tree → Tree → Bool
+  | .ctorT a t as, .ctorT a' t' as' => a == a' && t == t' && agreeList as as'
+  | .litT l, .litT l' => l == l'
+  | .erasedT, .erasedT => true
+  | .papT m as, .papT m' as' => m == m' && agreeList as as'
+  | .funT, .papT _ _ => true
+  | .papT _ _, .funT => true
+  | .funT, .funT => true
+  | _, _ => false
+
+def Tree.agreeList : List Tree → List Tree → Bool
+  | [], [] => true
+  | x :: xs, y :: ys => Tree.agree x y && Tree.agreeList xs ys
+  | _, _ => false
+
+end
+
+mutual
+
+def treeOfVal (fuel : Nat) (v : IxIR0.Value) : Option Tree :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    match v with
+    | .lit l => some (.litT l)
+    | .erased => some .erasedT
+    | .clos _ _ _ => some .funT
+    | .pap h args => (treeOfVals fuel args).map
+        (.papT (h.arity - args.length) ·)
+    | .ctor a t args => (treeOfVals fuel args).map (.ctorT a t ·)
+  termination_by fuel
+
+def treeOfVals (fuel : Nat) (vs : List IxIR0.Value) :
+    Option (List Tree) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    match vs with
+    | [] => some []
+    | v :: rest => do
+      let t ← treeOfVal fuel v
+      let ts ← treeOfVals fuel rest
+      pure (t :: ts)
+  termination_by fuel
+
+end
+
+mutual
+
+def treeOfR (s : Store) (fuel : Nat) (v : RVal) : Option Tree :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    match v with
+    | .lit l => some (.litT l)
+    | .erased => some .erasedT
+    | .loc l =>
+      match s.get? l with
+      | none => none
+      | some box =>
+        match box.node with
+        | .ctorN cid fields =>
+          (treeOfRs s fuel fields.toList).map (.ctorT cid.block cid.cidx ·)
+        | .papN _ ar got =>
+          (treeOfRs s fuel got.toList).map (.papT (ar - got.size) ·)
+  termination_by fuel
+
+def treeOfRs (s : Store) (fuel : Nat) (vs : List RVal) :
+    Option (List Tree) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    match vs with
+    | [] => some []
+    | v :: rest => do
+      let t ← treeOfR s fuel v
+      let ts ← treeOfRs s fuel rest
+      pure (t :: ts)
+  termination_by fuel
+
+end
+
+/-- Nat decoding on trees (accepting literal tails, as at IxIR₀). -/
+def natT? : Tree → Option Nat
+  | .ctorT _ 0 [] => some 0
+  | .ctorT _ 1 [t] => (natT? t).map (· + 1)
+  | .litT (.nat n) => some n
+  | _ => none
+
+/-- Target-side oracle mirroring the corpus ledger entry. -/
+def tgtOracle : Address → List RVal → Option RVal := fun a args =>
+  if a == IxIR0.Examples.natAddExt then
+    match args with
+    | [.lit (.nat m), .lit (.nat n)] => some (.lit (.nat (m + n)))
+    | _ => none
+  else none
+
+/-- Release a run's result by its world: unique trees deep-free,
+shared ones drop, scalars are inert. -/
+def releaseResult (ctx : Ctx) (fuel : Nat) (store : Store) (v : RVal) :
+    Except Err Store :=
+  match v with
+  | .loc l =>
+    match store.get? l with
+    | none => .error (.mem s!"release of a dead location {l}")
+    | some box =>
+      match box.world with
+      | .unique => dropUVal ctx fuel store v
+      | .shared => dropVal ctx fuel store v
+  | _ => .ok store
+
+/-- Pinned cross-IR stuck-message pairs (source, target) — every stuck
+agreement the corpus exercises, by exact text. An unlisted pair counts
+as divergence: extend the table deliberately when a new fixture
+legitimately sticks on both sides. -/
+def stuckPairs : List (String × String) :=
+  [("application of a non-function value", "apply of a non-node value"),
+   ("projection 5 out of bounds", "fetch field 5 out of range")]
+
+/-- Deliberate error-agreement mapping between the two semantics
+(`lowersErr`'s exactness, extended across IRs):
+
+- `fuel` pairs only with `fuel` (a stuck side against a diverging side
+  is a divergence, not agreement);
+- unknown references pair by exact address;
+- the IxIR₀ `oracleMissing` boundary pairs with the two ways IxIR₁
+  refuses the *same* extern call: a `none` oracle answer on scalar
+  arguments (surfaced as `unknownRef`, matched by address) or the
+  scalar-only ABI's `mem` rejection of heap arguments (which the
+  literals-only source oracle observes as a domain miss) — pinned to
+  that exact ABI message;
+- stuck messages pair only through `stuckPairs`;
+- everything else — including IxIR₁ `mem` discipline faults, which
+  have no source counterpart — disagrees. -/
+def errAgree : IxIR0.Err → Err → Bool
+  | .fuel, .fuel => true
+  | .unknownRef a, .unknownRef b => a == b
+  | .oracleMissing a, .unknownRef b => a == b
+  | .oracleMissing _, .mem msg =>
+    msg == "extern heap arguments require an ownership policy"
+  | .stuck msg, .stuck msg' => stuckPairs.contains (msg, msg')
+  | _, _ => false
+
+/-- The differential check: lower the corpus + `e` (main at world
+`mainW`), run both semantics; on success the readback trees must
+agree AND releasing the result must leave the store empty
+(leak-freedom of the inserted memory ops); on failure both sides must
+fail with errors related by the `errAgree` mapping. No leak check runs
+on error runs: the evaluator's `Except Err` aborts without returning a
+store, so the state at an error is unobservable at this API (a
+transactional evaluator would make it checkable; today only successful
+runs carry a store to audit). -/
+def diffExpr (e : IxIR0.Expr) (mainW : Owned := .shared)
+    (runFuel : Nat := 100000) : Bool :=
+  match lowerAllIndexed IxIR0.Examples.declList e mainW with
+  | .error _ => false
+  | .ok (ds, mainC) =>
+    let targetIndex := Env.Index.ofList ds
+    let tctx : Ctx := { decls := targetIndex.toEnv, oracle := tgtOracle }
+    match IxIR0.Examples.ctx.run e runFuel, runMain tctx mainC runFuel with
+    | .ok v, .ok (store, r) =>
+      (match treeOfVal 1000 v, treeOfR store 1000 r with
+       | some a, some b => Tree.agree a b
+       | _, _ => false)
+      && (match releaseResult tctx runFuel store r with
+          | .ok s => s.live == 0
+          | .error _ => false)
+    | .error source, .error target => errAgree source target
+    | _, _ => false
+
+/-- Target-only run for counter guards. -/
+def checkLowered (e : IxIR0.Expr) (mainW : Owned)
+    (p : Store → RVal → Bool) : Bool :=
+  match lowerAllIndexed IxIR0.Examples.declList e mainW with
+  | .error _ => false
+  | .ok (ds, mainC) =>
+    let targetIndex := Env.Index.ofList ds
+    match runMain { decls := targetIndex.toEnv, oracle := tgtOracle } mainC with
+    | .ok (store, r) => p store r
+    | .error _ => false
+
+/-- The lowering statically rejects `e` at the given main world with
+the expected diagnostic. Keeping the message in the assertion stops
+one mode error from accidentally satisfying a guard for another. -/
+def lowersErr (e : IxIR0.Expr) (mainW : Owned) (expected : String) : Bool :=
+  match lowerAllIndexed IxIR0.Examples.declList e mainW with
+  | .error msg => msg == expected
+  | .ok _ => false
+
+section Guards
+
+open Ix.Compiler.IxIR0.Examples
+
+/-! β, let, dup (a variable consumed twice), projection -/
+
+#guard diffExpr (.app (.lam .many (.var 0)) (natE 4))
+#guard diffExpr (.letE .many (natE 2) (.app (.ref natSucc) (.var 0)))
+#guard diffExpr (.letE .many (natE 2)
+  (.app (.app (.ref pairMk) (.var 0)) (.var 0)))
+#guard diffExpr (.proj 0 (.app (.app (.ref pairMk) (natE 1)) (natE 2)))
+#guard diffExpr (.proj 1 (.app (.app (.ref pairMk) (natE 1)) (natE 2)))
+#guard diffExpr (.proj 5 (.app (.app (.ref pairMk) (natE 1)) (natE 2)))
+#guard diffExpr (.app (.ref pairMk) (natE 1))   -- first-class ctor pap
+
+-- dead binding: the inserted drop reclaims the unused 1̂
+#guard diffExpr (.letE .many (natE 1) (natE 2))
+
+-- a struct borrowed twice: released only after its last projection
+#guard diffExpr (.letE .many (.app (.app (.ref pairMk) (natE 1)) (natE 2))
+  (.app (.app (.ref natAddDef) (.proj 0 (.var 0))) (.proj 1 (.var 0))))
+
+/-! Recursor ι: `case` + `callSelf`, constructor and peeled-literal
+majors -/
+
+#guard diffExpr (.app (.app (.ref natAddDef) (natE 2)) (natE 3))
+#guard diffExpr (.app (.app (.ref natAddDef) (natE 0)) (natE 0))
+#guard diffExpr (.app (.app (.ref natAddDef) (natE 7)) (natE 0))
+#guard diffExpr (.app (.app (.ref natAddDef) (.lit (.nat 2))) (.lit (.nat 3)))
+#guard diffExpr (.app (.app (.ref natAddDef) (natE 1)) (.lit (.nat 3)))
+
+/-! List recursion, including a shared (dup'd) list argument -/
+
+#guard diffExpr
+  (.app (.app (.ref appendDef) (listE natE [1, 2])) (listE natE [3]))
+#guard diffExpr
+  (.app (.app (.ref appendDef) (listE natE [])) (listE natE []))
+#guard diffExpr (.app (.ref lengthDef) (listE natE [5, 6, 7]))
+#guard diffExpr (.letE .many (listE natE [1])
+  (.app (.app (.ref appendDef) (.var 0)) (.var 0)))
+
+/-! Externs (success and both-sides refusal) -/
+
+#guard diffExpr
+  (.app (.app (.ref natAddExt) (.lit (.nat 20))) (.lit (.nat 22)))
+#guard diffExpr (.app (.app (.ref natAddExt) (natE 1)) (.lit (.nat 1)))
+
+/-! ◻ absorption (arguments still lowered, then released), stuckness -/
+
+#guard diffExpr (.app .erased (natE 1))
+#guard diffExpr (.proj 0 .erased)
+#guard diffExpr (.app (.lit (.nat 1)) (.lit (.nat 2)))
+
+/-! Lambda lifting with a capture:
+`(fun x => (fun y => add x y) 2̂) 3̂` -/
+
+#guard diffExpr (.app (.lam .many (.app (.lam .many
+  (.app (.app (.ref natAddDef) (.var 1)) (.var 0))) (natE 2))) (natE 3))
+
+/-! Divergence: Ω exhausts fuel on both sides -/
+
+#guard diffExpr
+  (.app (.lam .many (.app (.var 0) (.var 0)))
+    (.lam .many (.app (.var 0) (.var 0))))
+  (runFuel := 300)
+
+/-! The lowering rejects unknown references at compile time -/
+
+#guard
+  match lowerAll IxIR0.Examples.declList (.ref (synthAddr 999)) with
+  | .error _ => true
+  | .ok _ => false
+
+/-! Target-side readback: lowered 2+3 really is 5̂ -/
+
+#guard
+  match lowerAll IxIR0.Examples.declList
+      (.app (.app (.ref natAddDef) (natE 2)) (natE 3)) with
+  | .ok (ds, c) =>
+    (match runMain { decls := Env.ofList ds, oracle := tgtOracle } c with
+     | .ok (s, v) => ((treeOfR s 1000 v).bind natT?) == some 5
+     | _ => false)
+  | _ => false
+
+/-! ## Stage 2: the unique world
+
+The same corpus expressions flip worlds by demand: `natE`/`pairMk`
+spines at unique demand allocate unique. Linear/affine programs run
+with **zero refcount operations** — the no-RC strategy, as counter
+`#guard`s — and unique results release by deep free in the harness. -/
+
+-- linear pair of linear nats: values agree with IxIR₀, leak-free
+private def linPair : IxIR0.Expr :=
+  .letE .linear (natE 2) (.letE .linear (natE 3)
+    (.app (.app (.ref pairMk) (.var 1)) (.var 0)))
+
+#guard diffExpr linPair (mainW := .unique)
+
+-- …and with zero RC traffic: 8 unique allocations, nothing else
+#guard checkLowered linPair .unique fun s _ =>
+  s.allocs == 8 && s.rcops == 0 && s.frees == 0 && s.live == 8
+
+-- a whole unique tree without lets
+#guard diffExpr (.app (.app (.ref pairMk) (natE 1)) (natE 2))
+  (mainW := .unique)
+#guard checkLowered (.app (.app (.ref pairMk) (natE 1)) (natE 2))
+  .unique fun s _ => s.allocs == 6 && s.rcops == 0 && s.live == 6
+
+-- dead affine: dropU deep-frees the unused 2̂ (3 nodes), no RC ops
+private def affDead : IxIR0.Expr := .letE .affine (natE 2) (natE 1)
+
+#guard diffExpr affDead (mainW := .unique)
+#guard checkLowered affDead .unique fun s _ =>
+  s.allocs == 5 && s.frees == 3 && s.rcops == 0 && s.live == 2
+
+/-! Static mode errors: the lowering is the operational usage check -/
+
+-- a dead linear binding
+#guard lowersErr (.letE .linear (natE 1) (natE 2)) .shared
+  "unused linear binding"
+
+-- a unique variable used twice
+#guard lowersErr (.letE .linear (natE 1)
+  (.app (.app (.ref pairMk) (.var 0)) (.var 0))) .unique
+  "unique variable used more than once"
+
+-- dereliction: a shared value at unique demand
+#guard lowersErr (.letE .many (natE 1) (.app (.ref natSucc) (.var 0)))
+  .unique "dereliction: shared value at unique demand"
+
+-- freeze needed: a unique value at shared demand
+#guard lowersErr (.letE .linear (natE 1) (.app (.ref natSucc) (.var 0)))
+  .shared freezeNeededMsg
+
+-- a unique value into a recursor (the all-`many` fragment)
+#guard lowersErr (.letE .linear (natE 1)
+  (.app (.app (.ref natAddDef) (.var 0)) (natE 1))) .shared
+  freezeNeededMsg
+
+-- function values live in the shared world
+#guard lowersErr (.letE .linear (.lam .many (.var 0)) (.var 0)) .shared
+  "function values live in the shared world (one-shot closures deferred)"
+
+-- projection from a unique value
+#guard lowersErr
+  (.letE .linear (.app (.app (.ref pairMk) (natE 1)) (natE 2))
+    (.proj 0 (.var 0))) .shared
+  uniqueDestructuringMsg
+
+-- shared paps cannot own a captured unique value
+private def uniqueCaptureRestriction : IxIR0.Expr :=
+  .letE .linear (natE 1) (.lam .many (.var 1))
+
+#guard lowersErr uniqueCaptureRestriction .shared uniqueCaptureMsg
+
+-- a direct recursor call demands every argument in the shared world
+private def modeMonomorphicRecursorRestriction : IxIR0.Expr :=
+  .letE .linear (natE 1)
+    (.app
+      (.app
+        (.app (.ref natRec) (natE 0))
+        (.lam .many (.lam .many (.app (.ref natSucc) (.var 0)))))
+      (.var 0))
+
+#guard lowersErr modeMonomorphicRecursorRestriction .shared freezeNeededMsg
+
+-- `recSelf` exists only in recursor-rule environments.  A one-parameter
+-- recursor has self arity two, so this one-argument rule call witnesses the
+-- exact saturation restriction while the declaration itself is lowered.
+private def underAppliedRecSelfAddr : Address := synthAddr 92
+
+private def underAppliedRecSelfRule : IxIR0.RecRule :=
+  { fields := 0, rhs := .app (.var 1) (.var 0) }
+
+private def underAppliedRecSelfRejected : Bool :=
+  match lowerAll
+      (IxIR0.Examples.declList ++
+        [(underAppliedRecSelfAddr,
+          .recursor 1 false #[underAppliedRecSelfRule])])
+      (natE 0) with
+  | .error message => message == underAppliedRecSelfMsg
+  | .ok _ => false
+
+#guard underAppliedRecSelfRejected
+
+/-- Executable coverage for the complete six-entry policy inventory.  The
+individual guards above retain readable failure locations; this aggregate
+guard prevents a newly listed restriction from landing without a witness. -/
+private def restrictionWitness : RestrictionKind → Bool
+  | kind@(.freeze) =>
+    lowersErr (.letE .linear (natE 1) (.app (.ref natSucc) (.var 0)))
+      .shared kind.diagnostic
+  | kind@(.uniqueDestructuring) =>
+    lowersErr
+      (.letE .linear (.app (.app (.ref pairMk) (natE 1)) (natE 2))
+        (.proj 0 (.var 0)))
+      .shared kind.diagnostic
+  | kind@(.sharedFunctionValues) =>
+    lowersErr (.app (.lam .affine (.lit (.nat 7))) (natE 3))
+      .shared kind.diagnostic
+  | kind@(.uniqueCapture) =>
+    lowersErr uniqueCaptureRestriction .shared kind.diagnostic
+  | kind@(.modeMonomorphicRecursors) =>
+    lowersErr modeMonomorphicRecursorRestriction .shared kind.diagnostic
+  | .saturatedRecSelf => underAppliedRecSelfRejected
+
+#guard RestrictionKind.all.all restrictionWitness
+
+/-! Non-`many` function values are rejected before they can reach the
+all-shared `apply` path: direct lambdas, bare known references, and
+under-applied known definitions all pin the same exact diagnostic.
+All-`many` partial applications remain supported. -/
+
+#guard lowersErr
+  (.app (.lam .affine (.lit (.nat 7))) (natE 3)) .shared
+  nonManyPapMsg
+
+#guard lowersErr (.ref dropFstDef) .shared nonManyPapMsg
+
+#guard lowersErr (.app (.ref dropFstDef) (natE 1)) .shared nonManyPapMsg
+
+#guard diffExpr (.app (.ref natAddDef) (natE 2))
+
+/-! Declared result worlds close the old call seam: a shared result at
+unique demand is rejected statically, before a mismatched `dropU` can
+reach the evaluator. -/
+
+#guard lowersErr
+  (.letE .affine
+    (.app (.app (.ref natAddDef) (natE 1)) (natE 1))
+    (natE 0)) .shared
+  "call result is shared at unique demand"
+
+private def uniqueResultDef : Address := synthAddr 91
+
+private def uniqueResultDecls : List (Address × IxIR0.Decl) :=
+  IxIR0.Examples.declList ++
+    [(uniqueResultDef, .defn .unique (natE 1))]
+
+/-! A declared unique computed global is lowered in the unique world,
+its signature survives in `FnDef`, and an unused affine caller can
+deep-free the returned tree with no RC traffic. -/
+
+#guard
+  match lowerAll uniqueResultDecls
+      (.letE .affine (.ref uniqueResultDef) (natE 0)) with
+  | .ok (ds, c) =>
+    match (Env.ofList ds) uniqueResultDef,
+        runMain { decls := Env.ofList ds, oracle := tgtOracle } c with
+    | some (.fn d), .ok (s, _) =>
+      d.result == .unique && s.allocs == 3 && s.frees == 2 &&
+        s.rcops == 0 && s.live == 1
+    | _, _ => false
+  | .error _ => false
+
+#guard
+  match lowerAll uniqueResultDecls (.ref uniqueResultDef) .shared with
+  | .error msg =>
+    msg == freezeNeededMsg
+  | .ok _ => false
+
+/-! Mixed-mode telescopes: the binder-mode signature is
+outermost-first while de Bruijn vars count innermost-first, so
+entries, entry drops, and `knownCall` argument worlds must agree
+per-parameter. Both orders exercise declaration lowering and saturated
+known calls; first-class mixed-mode lambdas are rejected above. -/
+
+#guard diffExpr (.app (.app (.ref dropFstDef) (natE 1)) (natE 2))
+#guard diffExpr (.app (.app (.ref dropSndDef) (natE 2)) (natE 1))
+
+-- the dead affine argument (2 unique nodes) deep-frees at entry with
+-- zero RC traffic; the shared result (3 nodes) survives
+#guard checkLowered (.app (.app (.ref dropFstDef) (natE 1)) (natE 2))
+  .shared fun s _ =>
+    s.allocs == 5 && s.frees == 2 && s.rcops == 0 && s.live == 3
+#guard checkLowered (.app (.app (.ref dropSndDef) (natE 2)) (natE 1))
+  .shared fun s _ =>
+    s.allocs == 5 && s.frees == 2 && s.rcops == 0 && s.live == 3
+
+-- A mixed-mode lambda cannot escape into the all-shared papp/apply path.
+#guard lowersErr (.lam .affine (.lam .many (.var 0))) .shared
+  nonManyPapMsg
+
+-- a dead linear binder in a mixed telescope is rejected *as such*
+-- (not as a freeze error on the wrong binder)
+#guard
+  match lowerAll (IxIR0.Examples.declList ++
+      [(synthAddr 90,
+        .defn .shared (.lam .linear (.lam .many (.var 0))))])
+      (natE 0) with
+  | .error "unused linear binding" => true
+  | _ => false
+
+end Guards
+
+end Ix.Compiler.IxIR1.Lower
diff --git a/Ix/Compiler/IxIR1/LowerAddressed.lean b/Ix/Compiler/IxIR1/LowerAddressed.lean
new file mode 100644
index 000000000..41f5e0ff5
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerAddressed.lean
@@ -0,0 +1,103 @@
+import Ix.Compiler.IxIR1.Lower
+import Ix.Compiler.IxIR1.Readdress
+
+/-!
+# Content-addressed IxIR₁ lowering boundary
+
+`Lower.lowerAllAction` remains the theorem-facing compiler action: generated
+lambdas and constructor wrappers carry fresh transient names while their
+bodies are being assembled.  This module consumes its final state and runs
+`Readdress.run`, so no transient generated name escapes through the production
+artifact boundary.
+
+Keeping the boundary separate is also operationally necessary while BLAKE3 is
+native: the extensive pure lowering `#guard` corpus can continue to elaborate,
+whereas this post-pass runs in the compiled pipeline and test executable.
+-/
+
+namespace Ix.Compiler.IxIR1.Lower
+
+/-- Recover the source-backed prefix from the raw whole-program result and
+the final generated-declaration suffix.  Successful lowering results have
+exactly this suffix; exposing the helper lets the semantic companion state
+the post-pass call without unfolding the production wrapper. -/
+def sourcePrefix
+    (raw generated : List (Ixon.Address × Decl)) :
+    List (Ixon.Address × Decl) :=
+  raw.take (raw.length - generated.length)
+
+@[simp] theorem sourcePrefix_append
+    (source generated : List (Ixon.Address × Decl)) :
+    sourcePrefix (source ++ generated) generated = source := by
+  simp [sourcePrefix]
+
+private def finishAddressing
+    (reserved : List Ixon.Address)
+    (run : EStateM.Result String LowSt
+      (List (Ixon.Address × Decl) × Code)) :
+    Except String Readdress.Result :=
+  match run with
+  | .error message _ => .error message
+  | .ok (raw, main) state =>
+      Readdress.runProtected reserved
+        (sourcePrefix raw state.extra) state.extra main
+
+/-- Lower with the transparent source environment, then replace every
+generated temporary name by the content address of its finished declaration.
+The result retains the complete old-to-new provenance map. -/
+def lowerAllAddressed (decls : List (Ixon.Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainW : Ixon.Owned := .shared)
+    (fuel : Nat := 10000) : Except String Readdress.Result :=
+  finishAddressing (decls.map Prod.fst)
+    ((lowerAllAction decls main mainW fuel).run {})
+
+/-- Invert a successful production boundary once the theorem-facing raw
+compiler run is known.  This is the exact `Readdress.run` invocation hidden
+by `lowerAllAddressed`; no evaluator or hashing property is assumed here. -/
+theorem readdress_run_of_lowerAllAddressed_eq_ok
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainW : Ixon.Owned} {fuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower : (lowerAllAction decls main mainW fuel).run {} =
+      .ok (raw, mainCode) finalState)
+    (hresult : lowerAllAddressed decls main mainW fuel = .ok result) :
+    Readdress.runProtected (decls.map Prod.fst)
+        (sourcePrefix raw finalState.extra) finalState.extra mainCode =
+      .ok result := by
+  simpa only [lowerAllAddressed, finishAddressing, hlower] using hresult
+
+/-- Indexed-source variant used by the production pipeline. -/
+def lowerAllIndexedAddressed
+    (decls : List (Ixon.Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainW : Ixon.Owned := .shared)
+    (fuel : Nat := 10000) : Except String Readdress.Result :=
+  finishAddressing (decls.map Prod.fst)
+    ((lowerAllIndexedAction decls main mainW fuel).run {})
+
+/-- Building the lookup index changes neither the transparent compiler action
+nor the content-addressed production result. -/
+theorem lowerAllIndexedAddressed_eq_lowerAllAddressed
+    (decls : List (Ixon.Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainW : Ixon.Owned) (fuel : Nat) :
+    lowerAllIndexedAddressed decls main mainW fuel =
+      lowerAllAddressed decls main mainW fuel := by
+  simp only [lowerAllIndexedAddressed, lowerAllAddressed,
+    lowerAllIndexedAction, lowerAllAction, IxIR0.Env.Index.toEnv_ofList]
+
+/-- Indexed analogue of `readdress_run_of_lowerAllAddressed_eq_ok`. -/
+theorem readdress_run_of_lowerAllIndexedAddressed_eq_ok
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainW : Ixon.Owned} {fuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower : (lowerAllIndexedAction decls main mainW fuel).run {} =
+      .ok (raw, mainCode) finalState)
+    (hresult : lowerAllIndexedAddressed decls main mainW fuel = .ok result) :
+    Readdress.runProtected (decls.map Prod.fst)
+        (sourcePrefix raw finalState.extra) finalState.extra mainCode =
+      .ok result := by
+  simpa only [lowerAllIndexedAddressed, finishAddressing, hlower] using
+    hresult
+
+end Ix.Compiler.IxIR1.Lower
diff --git a/Ix/Compiler/IxIR1/LowerAddressedSim.lean b/Ix/Compiler/IxIR1/LowerAddressedSim.lean
new file mode 100644
index 000000000..240574a6f
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerAddressedSim.lean
@@ -0,0 +1,580 @@
+import Ix.Compiler.IxIR1.LowerAddressed
+import Ix.Compiler.IxIR1.LowerSim
+import Ix.Compiler.IxIR1.ReaddressSim
+
+/-!
+# Semantic boundary for content-addressed IxIR₁ lowering
+
+The theorem-facing lowerer returns source-backed declarations followed by
+the final generated-declaration suffix.  The production boundary rekeys that
+suffix and all references into it.  This module connects those two successful
+runs and transports exact evaluator results, the three public dynamic-error
+exclusion properties, and instruction-level cost observations.
+
+The raw side deliberately uses `Readdress.Result.preAddressCtx`.  It agrees
+with every successful lookup in the raw list and supplies stable aliases at
+new content keys, which is the total context required by evaluator
+equivariance after deduplication.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Lower
+
+/-- A source value is realized by an addressed heap when that heap is the
+address image of some raw heap carrying the existing `ValueGraph` witness.
+This keeps locations, values, and graph structure exact while recording the
+only representation change introduced by the post-pass. -/
+def AddressedValueGraph (rename : Ixon.Address → Ixon.Address)
+    (funRel : Sim.FunctionRel) (store : Store)
+    (sourceValue : IxIR0.Value) (targetValue : RVal) : Prop :=
+  ∃ rawStore,
+    store = Readdress.Store.mapAddresses rename rawStore ∧
+      Sim.ValueGraph funRel rawStore sourceValue targetValue
+
+/-- Forward simulation whose target heap is compared modulo the declared
+address image.  Unlike the ordinary `SemanticForwardSimulation`, this
+relation does not silently require generated function keys or constructor
+identities to remain textually unchanged. -/
+def AddressedSemanticForwardSimulation
+    (sourceCtx : IxIR0.Ctx) (targetCtx : Ctx)
+    (source : IxIR0.Expr) (target : Code)
+    (rename : Ixon.Address → Ixon.Address)
+    (funRel : Sim.FunctionRel) : Prop :=
+  ∀ {sourceFuel sourceValue},
+    IxIR0.eval sourceCtx sourceFuel [] source = .ok sourceValue →
+    ∃ targetFuel targetStore targetValue,
+      runMain targetCtx target targetFuel = .ok (targetStore, targetValue) ∧
+        AddressedValueGraph rename funRel targetStore sourceValue targetValue
+
+private theorem estateBindRun_ok_inv_addressed
+    {error state alpha beta : Type}
+    {action : EStateM error state alpha}
+    {next : alpha → EStateM error state beta}
+    {initial finalState : state} {result : beta}
+    (hrun : (action >>= next).run initial = .ok result finalState) :
+    ∃ value middle,
+      action.run initial = .ok value middle ∧
+      (next value).run middle = .ok result finalState := by
+  change
+    (match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error error nextState => .error error nextState) =
+        .ok result finalState at hrun
+  cases haction : action.run initial with
+  | ok value middle =>
+      rw [haction] at hrun
+      exact ⟨value, middle, rfl, hrun⟩
+  | error error middle =>
+      rw [haction] at hrun
+      contradiction
+
+private theorem lowerAllAction_run_of_indexed
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState) :
+    (lowerAllAction decls main mainWorld compilerFuel).run {} =
+      .ok (raw, mainCode) finalState := by
+  simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+
+private theorem lowerAllAddressed_eq_ok_of_indexed
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {result : Readdress.Result}
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result) :
+    lowerAllAddressed decls main mainWorld compilerFuel = .ok result := by
+  rw [lowerAllIndexedAddressed_eq_lowerAllAddressed] at haddressed
+  exact haddressed
+
+/-- A successful whole-program action returns some source-backed prefix
+followed by exactly the generated declarations stored in its final state. -/
+theorem lowerAllAction_result_split
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (raw, mainCode) finalState) :
+    ∃ source, raw = source ++ finalState.extra := by
+  simp only [lowerAllAction] at hlower
+  obtain ⟨base, baseState, _hbase, hafterBase⟩ :=
+    estateBindRun_ok_inv_addressed hlower
+  obtain ⟨compiledMain, mainState, _hmain, hafterMain⟩ :=
+    estateBindRun_ok_inv_addressed hafterBase
+  obtain ⟨observed, getState, hget, hpure⟩ :=
+    estateBindRun_ok_inv_addressed hafterMain
+  have hget' : mainState = observed ∧ mainState = getState := by
+    simpa using hget
+  obtain ⟨hobserved, hgetState⟩ := hget'
+  subst observed
+  subst getState
+  have hpure' :
+      (base ++ mainState.extra, compiledMain) = (raw, mainCode) ∧
+        mainState = finalState := by
+    simpa using hpure
+  obtain ⟨hresult, hstate⟩ := hpure'
+  subst finalState
+  exact ⟨base, (congrArg Prod.fst hresult).symm⟩
+
+/-- A successful addressed result and its successful raw compiler run expose
+one exact, certified readdressing call over the raw result split. -/
+theorem lowerAllAddressed_readdress_run
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result) :
+    ∃ source,
+      raw = source ++ finalState.extra ∧
+      Readdress.run source finalState.extra mainCode = .ok result := by
+  obtain ⟨source, hraw⟩ := lowerAllAction_result_split hlower
+  refine ⟨source, hraw, ?_⟩
+  have hprotected :=
+    readdress_run_of_lowerAllAddressed_eq_ok hlower haddressed
+  have hprotected' :
+      Readdress.runProtected (decls.map Prod.fst) source
+          finalState.extra mainCode = .ok result := by
+    simpa only [hraw, sourcePrefix_append] using hprotected
+  exact (Readdress.run_and_protects_of_runProtected_eq_ok hprotected').1
+
+/-- Production lowering fixes every original IxIR₀ declaration identity,
+including constructor keys omitted from the raw IxIR₁ environment. -/
+theorem lowerAllAddressed_protectsSourceAddresses
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result) :
+    result.protects (decls.map Prod.fst) = true :=
+  (Readdress.run_and_protects_of_runProtected_eq_ok
+    (readdress_run_of_lowerAllAddressed_eq_ok hlower haddressed)).2
+
+/-- Pointwise form of `lowerAllAddressed_protectsSourceAddresses`. -/
+theorem lowerAllAddressed_apply_source_address
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    {address : Ixon.Address} {sourceDecl : IxIR0.Decl}
+    (hmember : (address, sourceDecl) ∈ decls) :
+    Readdress.Renaming.apply result.addressMap address = address := by
+  apply result.apply_eq_of_protects
+    (lowerAllAddressed_protectsSourceAddresses hlower haddressed)
+  exact List.mem_map.mpr ⟨(address, sourceDecl), hmember, rfl⟩
+
+/-- Indexed production entry points carry the same source-identity
+protection certificate. -/
+theorem lowerAllIndexedAddressed_protectsSourceAddresses
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result) :
+    result.protects (decls.map Prod.fst) = true :=
+  lowerAllAddressed_protectsSourceAddresses
+    (lowerAllAction_run_of_indexed hlower)
+    (lowerAllAddressed_eq_ok_of_indexed haddressed)
+
+/-- The compiled main before and after the production address pass has one
+exact evaluator result at every fuel.  Values and heap locations are
+unchanged; declaration identities retained in heap nodes are rekeyed. -/
+theorem lowerAllAddressed_runMain
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (runFuel : Nat) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      Readdress.mapRunResult
+        (Readdress.Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx raw oracle) mainCode runFuel) := by
+  obtain ⟨source, hraw, hrun⟩ :=
+    lowerAllAddressed_readdress_run hlower haddressed
+  subst raw
+  exact Readdress.runMain_of_run_eq_ok hrun oracle runFuel
+
+/-- Production indexed-entry analogue of `lowerAllAddressed_runMain`. -/
+theorem lowerAllIndexedAddressed_runMain
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (runFuel : Nat) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      Readdress.mapRunResult
+        (Readdress.Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx raw oracle) mainCode runFuel) := by
+  have hlower' :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have haddressed' :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result := by
+    rw [lowerAllIndexedAddressed_eq_lowerAllAddressed] at haddressed
+    exact haddressed
+  exact lowerAllAddressed_runMain hlower' haddressed' oracle runFuel
+
+/-- Successful raw execution gives the exact addressed heap, the same
+runtime value, and therefore the same observable result. -/
+theorem lowerAllAddressed_runMain_success
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      .ok
+        (Readdress.Store.mapAddresses
+          (Readdress.Renaming.apply result.addressMap) store,
+        value) := by
+  rw [lowerAllAddressed_runMain hlower haddressed oracle runFuel, hsource]
+  rfl
+
+/-- Successful-run form for the indexed production entry point. -/
+theorem lowerAllIndexedAddressed_runMain_success
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      .ok
+        (Readdress.Store.mapAddresses
+          (Readdress.Renaming.apply result.addressMap) store,
+        value) := by
+  rw [lowerAllIndexedAddressed_runMain hlower haddressed oracle runFuel,
+    hsource]
+  rfl
+
+/-- Every existing raw whole-program forward simulation composes with the
+production address pass.  The resulting graph records the exact raw heap
+witness whose address image is returned by the addressed evaluator. -/
+theorem lowerAllAddressed_semanticForwardSimulation
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    {funRel : Sim.FunctionRel}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : SemanticForwardSimulation sourceCtx
+      (result.preAddressCtx raw oracle) main mainCode funRel) :
+    AddressedSemanticForwardSimulation sourceCtx
+      (result.addressedCtx oracle) main result.main
+      (Readdress.Renaming.apply result.addressMap) funRel := by
+  intro sourceFuel sourceValue hsource
+  obtain ⟨targetFuel, rawStore, targetValue, htarget, hgraph⟩ :=
+    hraw hsource
+  refine ⟨targetFuel,
+    Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) rawStore,
+    targetValue, ?_, rawStore, rfl, hgraph⟩
+  exact lowerAllAddressed_runMain_success hlower haddressed oracle htarget
+
+/-- Direct composition theorem for the indexed production entry point. -/
+theorem lowerAllIndexedAddressed_semanticForwardSimulation
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    {funRel : Sim.FunctionRel}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : SemanticForwardSimulation sourceCtx
+      (result.preAddressCtx raw oracle) main mainCode funRel) :
+    AddressedSemanticForwardSimulation sourceCtx
+      (result.addressedCtx oracle) main result.main
+      (Readdress.Renaming.apply result.addressMap) funRel := by
+  intro sourceFuel sourceValue hsource
+  obtain ⟨targetFuel, rawStore, targetValue, htarget, hgraph⟩ :=
+    hraw hsource
+  refine ⟨targetFuel,
+    Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) rawStore,
+    targetValue, ?_, rawStore, rfl, hgraph⟩
+  exact lowerAllIndexedAddressed_runMain_success hlower haddressed oracle
+    htarget
+
+/-- Address rekeying cannot introduce a memory-discipline error. -/
+theorem lowerAllAddressed_memoryErrorUnreachable
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw :
+      MemoryErrorUnreachable (result.preAddressCtx raw oracle) mainCode) :
+    MemoryErrorUnreachable (result.addressedCtx oracle) result.main := by
+  intro runFuel message htarget
+  have htransport :=
+    lowerAllAddressed_runMain hlower haddressed oracle runFuel
+  rw [htarget] at htransport
+  cases hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel with
+  | ok output =>
+      rcases output with ⟨store, value⟩
+      simp [hsource] at htransport
+  | error error =>
+      cases error with
+      | fuel => simp [hsource] at htransport
+      | stuck sourceMessage => simp [hsource] at htransport
+      | mem sourceMessage => exact hraw runFuel sourceMessage hsource
+      | unknownRef address => simp [hsource] at htransport
+
+/-- Address rekeying cannot introduce an ordinary stuck result. -/
+theorem lowerAllAddressed_ordinaryStuckUnreachable
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw :
+      OrdinaryStuckUnreachable (result.preAddressCtx raw oracle) mainCode) :
+    OrdinaryStuckUnreachable (result.addressedCtx oracle) result.main := by
+  intro runFuel message htarget
+  have htransport :=
+    lowerAllAddressed_runMain hlower haddressed oracle runFuel
+  rw [htarget] at htransport
+  cases hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel with
+  | ok output =>
+      rcases output with ⟨store, value⟩
+      simp [hsource] at htransport
+  | error error =>
+      cases error with
+      | fuel => simp [hsource] at htransport
+      | stuck sourceMessage => exact hraw runFuel sourceMessage hsource
+      | mem sourceMessage => simp [hsource] at htransport
+      | unknownRef address => simp [hsource] at htransport
+
+/-- Address rekeying cannot introduce a closed-world lookup failure. -/
+theorem lowerAllAddressed_unknownRefUnreachable
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw :
+      UnknownRefUnreachable (result.preAddressCtx raw oracle) mainCode) :
+    UnknownRefUnreachable (result.addressedCtx oracle) result.main := by
+  intro runFuel address htarget
+  have htransport :=
+    lowerAllAddressed_runMain hlower haddressed oracle runFuel
+  rw [htarget] at htransport
+  cases hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel with
+  | ok output =>
+      rcases output with ⟨store, value⟩
+      simp [hsource] at htransport
+  | error error =>
+      cases error with
+      | fuel => simp [hsource] at htransport
+      | stuck sourceMessage => simp [hsource] at htransport
+      | mem sourceMessage => simp [hsource] at htransport
+      | unknownRef sourceAddress =>
+          exact hraw runFuel sourceAddress hsource
+
+/-- Indexed production transport of memory-error exclusion. -/
+theorem lowerAllIndexedAddressed_memoryErrorUnreachable
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw :
+      MemoryErrorUnreachable (result.preAddressCtx raw oracle) mainCode) :
+    MemoryErrorUnreachable (result.addressedCtx oracle) result.main :=
+  lowerAllAddressed_memoryErrorUnreachable
+    (lowerAllAction_run_of_indexed hlower)
+    (lowerAllAddressed_eq_ok_of_indexed haddressed) oracle hraw
+
+/-- Indexed production transport of ordinary-stuck exclusion. -/
+theorem lowerAllIndexedAddressed_ordinaryStuckUnreachable
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : OrdinaryStuckUnreachable
+      (result.preAddressCtx raw oracle) mainCode) :
+    OrdinaryStuckUnreachable (result.addressedCtx oracle) result.main :=
+  lowerAllAddressed_ordinaryStuckUnreachable
+    (lowerAllAction_run_of_indexed hlower)
+    (lowerAllAddressed_eq_ok_of_indexed haddressed) oracle hraw
+
+/-- Indexed production transport of closed-world lookup safety. -/
+theorem lowerAllIndexedAddressed_unknownRefUnreachable
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw :
+      UnknownRefUnreachable (result.preAddressCtx raw oracle) mainCode) :
+    UnknownRefUnreachable (result.addressedCtx oracle) result.main :=
+  lowerAllAddressed_unknownRefUnreachable
+    (lowerAllAction_run_of_indexed hlower)
+    (lowerAllAddressed_eq_ok_of_indexed haddressed) oracle hraw
+
+@[simp] theorem costObservation_mapAddresses
+    (rename : Ixon.Address → Ixon.Address) (store : Store) :
+    costObservation (Readdress.Store.mapAddresses rename store) =
+      costObservation store := by
+  rfl
+
+/-- The address pass preserves all four instruction-level counters on every
+successful whole-main run. -/
+theorem lowerAllAddressed_runMain_cost
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    ∃ addressedStore,
+      runMain (result.addressedCtx oracle) result.main runFuel =
+          .ok (addressedStore, value) ∧
+        costObservation addressedStore = costObservation store := by
+  refine ⟨Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) store, ?_, ?_⟩
+  · exact lowerAllAddressed_runMain_success hlower haddressed oracle hsource
+  · exact costObservation_mapAddresses _ _
+
+/-- Indexed production entry point preserves the same cost observation. -/
+theorem lowerAllIndexedAddressed_runMain_cost
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : Readdress.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    ∃ addressedStore,
+      runMain (result.addressedCtx oracle) result.main runFuel =
+          .ok (addressedStore, value) ∧
+        costObservation addressedStore = costObservation store := by
+  refine ⟨Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) store, ?_, ?_⟩
+  · exact lowerAllIndexedAddressed_runMain_success hlower haddressed oracle
+      hsource
+  · exact costObservation_mapAddresses _ _
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/LowerFullyAddressed.lean b/Ix/Compiler/IxIR1/LowerFullyAddressed.lean
new file mode 100644
index 000000000..66e147885
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerFullyAddressed.lean
@@ -0,0 +1,129 @@
+import Ix.Compiler.IxIR1.Lower
+import Ix.Compiler.IxIR1.ReaddressAll
+
+/-!
+# Fully content-addressed IxIR₁ lowering boundary
+
+The existing `LowerAddressed` boundary rekeys generated declarations while
+retaining source function keys for its established proof interface.  This
+companion consumes the same raw whole-pass output and applies
+`ReaddressAll` across source and generated functions together.  Constructor
+keys, which have no IxIR₁ declaration entry, are explicitly reserved;
+extern declarations are retained as stable ABI artifacts by `ReaddressAll`.
+-/
+
+namespace Ix.Compiler.IxIR1.Lower
+
+open Ix.Compiler.Ixon (Address Owned)
+
+/-- Source identities used by constructor nodes but absent from the target
+declaration environment. -/
+def constructorIdentities
+    (decls : List (Address × IxIR0.Decl)) : List Address :=
+  decls.filterMap fun
+    | (address, .ctor _ _) => some address
+    | _ => none
+
+private def finishFullAddressing
+    (reserved : List Address)
+    (lowered : EStateM.Result String LowSt
+      (List (Address × Decl) × Code)) :
+    Except String ReaddressAll.Result :=
+  match lowered with
+  | .error message _ => .error message
+  | .ok (raw, main) _ => ReaddressAll.run reserved raw main
+
+/-- Transparent-environment whole-program lowering followed by SCC-aware
+source/generated function readdressing. -/
+def lowerAllFullyAddressed
+    (decls : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainWorld : Owned := .shared)
+    (fuel : Nat := 10000) : Except String ReaddressAll.Result :=
+  finishFullAddressing (constructorIdentities decls)
+    ((lowerAllAction decls main mainWorld fuel).run {})
+
+/-- Indexed production analogue. -/
+def lowerAllIndexedFullyAddressed
+    (decls : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainWorld : Owned := .shared)
+    (fuel : Nat := 10000) : Except String ReaddressAll.Result :=
+  finishFullAddressing (constructorIdentities decls)
+    ((lowerAllIndexedAction decls main mainWorld fuel).run {})
+
+/-- Proof-facing execution record for the production lowering boundary.
+`lowerAllIndexedFullyAddressed` deliberately returns only the emitted graph;
+this companion retains the exact raw declarations, main code, and final
+compiler state consumed by the semantic theorems without running the lowerer
+twice.  Proof fields are erased by code generation. -/
+structure FullyAddressedTrace
+    (decls : List (Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainWorld : Owned) (fuel : Nat) where
+  raw : List (Address × Decl)
+  mainCode : Code
+  finalState : LowSt
+  result : ReaddressAll.Result
+  lowerRun :
+    (lowerAllIndexedAction decls main mainWorld fuel).run {} =
+      .ok (raw, mainCode) finalState
+  addressedRun :
+    lowerAllIndexedFullyAddressed decls main mainWorld fuel = .ok result
+
+/-- Execute indexed lowering and full SCC addressing once while preserving
+the stateful run equation needed by whole-pass proofs. -/
+def lowerAllIndexedFullyAddressedWithTrace
+    (decls : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (mainWorld : Owned := .shared)
+    (fuel : Nat := 10000) :
+    Except String (FullyAddressedTrace decls main mainWorld fuel) :=
+  match hlower : (lowerAllIndexedAction decls main mainWorld fuel).run {} with
+  | .error message _ => .error message
+  | .ok (raw, mainCode) finalState =>
+    match haddressed : ReaddressAll.run (constructorIdentities decls)
+        raw mainCode with
+    | .error message => .error message
+    | .ok result =>
+      .ok
+        { raw, mainCode, finalState, result
+          lowerRun := hlower
+          addressedRun := by
+            simp only [lowerAllIndexedFullyAddressed,
+              finishFullAddressing, hlower, haddressed] }
+
+theorem lowerAllIndexedFullyAddressed_eq_lowerAllFullyAddressed
+    (decls : List (Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainWorld : Owned) (fuel : Nat) :
+    lowerAllIndexedFullyAddressed decls main mainWorld fuel =
+      lowerAllFullyAddressed decls main mainWorld fuel := by
+  simp only [lowerAllIndexedFullyAddressed, lowerAllFullyAddressed,
+    lowerAllIndexedAction, lowerAllAction, IxIR0.Env.Index.toEnv_ofList]
+
+/-- Expose the exact SCC pass hidden behind a successful raw compiler run. -/
+theorem readdressAll_run_of_lowerAllFullyAddressed_eq_ok
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower : (lowerAllAction decls main mainWorld fuel).run {} =
+      .ok (raw, mainCode) finalState)
+    (hresult : lowerAllFullyAddressed decls main mainWorld fuel =
+      .ok result) :
+    ReaddressAll.run (constructorIdentities decls) raw mainCode =
+      .ok result := by
+  simpa only [lowerAllFullyAddressed, finishFullAddressing, hlower] using
+    hresult
+
+theorem readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower : (lowerAllIndexedAction decls main mainWorld fuel).run {} =
+      .ok (raw, mainCode) finalState)
+    (hresult : lowerAllIndexedFullyAddressed decls main mainWorld fuel =
+      .ok result) :
+    ReaddressAll.run (constructorIdentities decls) raw mainCode =
+      .ok result := by
+  simpa only [lowerAllIndexedFullyAddressed, finishFullAddressing, hlower]
+    using hresult
+
+end Ix.Compiler.IxIR1.Lower
diff --git a/Ix/Compiler/IxIR1/LowerFullyAddressedSim.lean b/Ix/Compiler/IxIR1/LowerFullyAddressedSim.lean
new file mode 100644
index 000000000..a17e8f485
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerFullyAddressedSim.lean
@@ -0,0 +1,343 @@
+import Ix.Compiler.IxIR1.LowerAddressedSim
+import Ix.Compiler.IxIR1.LowerFullyAddressed
+import Ix.Compiler.IxIR1.ReaddressAllSim
+
+/-!
+# Semantic boundary for fully content-addressed IxIR₁ lowering
+
+The raw whole-pass compiler still uses transient producer labels internally.
+`LowerFullyAddressed` sends the complete raw declaration graph through the
+SCC-aware pass, rekeying source and generated functions together while fixing
+constructor identities and stable extern ABI keys.  This module composes that
+exact successful call with evaluator equivariance and the existing raw
+lowering relations.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR1.Lower
+
+/-- Exact evaluator-result transport for the transparent lowerer. -/
+theorem lowerAllFullyAddressed_runMain
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllFullyAddressed decls main mainWorld compilerFuel = .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (runFuel : Nat) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      Readdress.mapRunResult
+        (Readdress.Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx raw oracle) mainCode runFuel) := by
+  exact ReaddressAll.runMain_of_run_eq_ok
+    (readdressAll_run_of_lowerAllFullyAddressed_eq_ok hlower haddressed)
+    oracle runFuel
+
+/-- Exact evaluator-result transport for the indexed production lowerer. -/
+theorem lowerAllIndexedFullyAddressed_runMain
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (runFuel : Nat) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      Readdress.mapRunResult
+        (Readdress.Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx raw oracle) mainCode runFuel) := by
+  exact ReaddressAll.runMain_of_run_eq_ok
+    (readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      hlower haddressed) oracle runFuel
+
+/-- Alias-free evaluator-result transport for the indexed production
+lowerer. The raw source context is literally `Env.ofList raw`; the certified
+rebuild renaming supplies the total address action needed by the final graph. -/
+theorem lowerAllIndexedFullyAddressed_runMain_exact
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (runFuel : Nat) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      Readdress.mapRunResult (result.rebuildRename raw)
+        (runMain (result.rebuildSourceCtx raw oracle) mainCode runFuel) := by
+  exact ReaddressAll.runMain_exact_of_run_eq_ok
+    (readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      hlower haddressed) oracle runFuel
+
+/-- Successful raw execution gives the exact fully addressed heap image and
+the same scalar/location result. -/
+theorem lowerAllIndexedFullyAddressed_runMain_success
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      .ok (Readdress.Store.mapAddresses
+        (Readdress.Renaming.apply result.addressMap) store, value) := by
+  rw [lowerAllIndexedFullyAddressed_runMain
+    hlower haddressed oracle runFuel, hsource]
+  rfl
+
+/-- Successful execution in the exact raw context gives the corresponding
+fully addressed heap under the certified rebuild renaming. -/
+theorem lowerAllIndexedFullyAddressed_runMain_exact_success
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.rebuildSourceCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main runFuel =
+      .ok (Readdress.Store.mapAddresses
+        (result.rebuildRename raw) store, value) := by
+  rw [lowerAllIndexedFullyAddressed_runMain_exact
+    hlower haddressed oracle runFuel, hsource]
+  rfl
+
+/-- Every original constructor identity is fixed by the complete target map.
+Unlike the old generated-only boundary, source function identities are not
+claimed fixed: they are deliberately content-addressed. -/
+theorem lowerAllIndexedFullyAddressed_apply_constructorIdentity
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    {address : Address}
+    (haddress : address ∈ constructorIdentities decls) :
+    Readdress.Renaming.apply result.addressMap address = address := by
+  have hrun := readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+    hlower haddressed
+  have haudit := ReaddressAll.semanticAudit_of_run_eq_ok hrun
+  apply result.apply_reserved haudit
+  rw [ReaddressAll.reserved_of_run_eq_ok hrun]
+  exact haddress
+
+/-- Any raw IxIR₀→IxIR₁ forward simulation composes with complete
+source/generated readdressing. -/
+theorem lowerAllIndexedFullyAddressed_semanticForwardSimulation
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    {funRel : Sim.FunctionRel}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hraw : SemanticForwardSimulation sourceCtx
+      (result.preAddressCtx raw oracle) main mainCode funRel) :
+    AddressedSemanticForwardSimulation sourceCtx
+      (result.addressedCtx oracle) main result.main
+      (Readdress.Renaming.apply result.addressMap) funRel := by
+  intro sourceFuel sourceValue hsource
+  obtain ⟨targetFuel, rawStore, targetValue, htarget, hgraph⟩ :=
+    hraw hsource
+  refine ⟨targetFuel,
+    Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) rawStore,
+    targetValue, ?_, rawStore, rfl, hgraph⟩
+  exact lowerAllIndexedFullyAddressed_runMain_success
+    hlower haddressed oracle htarget
+
+/-- Exact-source form of complete readdressing. Unlike the generic transport,
+this theorem needs no alias-completed raw context and records the certified
+`rebuildRename` heap image in the addressed value graph. -/
+theorem lowerAllIndexedFullyAddressed_semanticForwardSimulation_exact
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    {funRel : Sim.FunctionRel}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hraw : SemanticForwardSimulation sourceCtx
+      (result.rebuildSourceCtx raw oracle) main mainCode funRel) :
+    AddressedSemanticForwardSimulation sourceCtx
+      (result.addressedCtx oracle) main result.main
+      (result.rebuildRename raw) funRel := by
+  intro sourceFuel sourceValue hsource
+  obtain ⟨targetFuel, rawStore, targetValue, htarget, hgraph⟩ :=
+    hraw hsource
+  refine ⟨targetFuel,
+    Readdress.Store.mapAddresses (result.rebuildRename raw) rawStore,
+    targetValue, ?_, rawStore, rfl, hgraph⟩
+  exact lowerAllIndexedFullyAddressed_runMain_exact_success
+    hlower haddressed oracle htarget
+
+/-- Complete readdressing cannot introduce a memory-discipline error. -/
+theorem lowerAllIndexedFullyAddressed_memoryErrorUnreachable
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hraw : MemoryErrorUnreachable
+      (result.preAddressCtx raw oracle) mainCode) :
+    MemoryErrorUnreachable (result.addressedCtx oracle) result.main := by
+  intro runFuel message htarget
+  have htransport := lowerAllIndexedFullyAddressed_runMain
+    hlower haddressed oracle runFuel
+  rw [htarget] at htransport
+  cases hsource : runMain (result.preAddressCtx raw oracle) mainCode runFuel with
+  | ok output =>
+      rcases output with ⟨store, value⟩
+      simp [hsource] at htransport
+  | error error =>
+      cases error with
+      | fuel => simp [hsource] at htransport
+      | stuck sourceMessage => simp [hsource] at htransport
+      | mem sourceMessage => exact hraw runFuel sourceMessage hsource
+      | unknownRef address => simp [hsource] at htransport
+
+/-- Complete readdressing cannot introduce ordinary stuckness. -/
+theorem lowerAllIndexedFullyAddressed_ordinaryStuckUnreachable
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hraw : OrdinaryStuckUnreachable
+      (result.preAddressCtx raw oracle) mainCode) :
+    OrdinaryStuckUnreachable (result.addressedCtx oracle) result.main := by
+  intro runFuel message htarget
+  have htransport := lowerAllIndexedFullyAddressed_runMain
+    hlower haddressed oracle runFuel
+  rw [htarget] at htransport
+  cases hsource : runMain (result.preAddressCtx raw oracle) mainCode runFuel with
+  | ok output =>
+      rcases output with ⟨store, value⟩
+      simp [hsource] at htransport
+  | error error =>
+      cases error with
+      | fuel => simp [hsource] at htransport
+      | stuck sourceMessage => exact hraw runFuel sourceMessage hsource
+      | mem sourceMessage => simp [hsource] at htransport
+      | unknownRef address => simp [hsource] at htransport
+
+/-- Complete readdressing cannot introduce a closed-world lookup failure. -/
+theorem lowerAllIndexedFullyAddressed_unknownRefUnreachable
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hraw : UnknownRefUnreachable
+      (result.preAddressCtx raw oracle) mainCode) :
+    UnknownRefUnreachable (result.addressedCtx oracle) result.main := by
+  intro runFuel address htarget
+  have htransport := lowerAllIndexedFullyAddressed_runMain
+    hlower haddressed oracle runFuel
+  rw [htarget] at htransport
+  cases hsource : runMain (result.preAddressCtx raw oracle) mainCode runFuel with
+  | ok output =>
+      rcases output with ⟨store, value⟩
+      simp [hsource] at htransport
+  | error error =>
+      cases error with
+      | fuel => simp [hsource] at htransport
+      | stuck sourceMessage => simp [hsource] at htransport
+      | mem sourceMessage => simp [hsource] at htransport
+      | unknownRef sourceAddress => exact hraw runFuel sourceAddress hsource
+
+/-- All four instruction-level store counters survive complete readdressing. -/
+theorem lowerAllIndexedFullyAddressed_runMain_cost
+    {decls : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel runFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {result : ReaddressAll.Result}
+    {store : Store} {value : RVal}
+    (hlower :
+      (lowerAllIndexedAction decls main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed decls main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    (hsource :
+      runMain (result.preAddressCtx raw oracle) mainCode runFuel =
+        .ok (store, value)) :
+    ∃ addressedStore,
+      runMain (result.addressedCtx oracle) result.main runFuel =
+          .ok (addressedStore, value) ∧
+        costObservation addressedStore = costObservation store := by
+  refine ⟨Readdress.Store.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) store, ?_, ?_⟩
+  · exact lowerAllIndexedFullyAddressed_runMain_success
+      hlower haddressed oracle hsource
+  · exact costObservation_mapAddresses _ _
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/LowerMutualAddressedProgress.lean b/Ix/Compiler/IxIR1/LowerMutualAddressedProgress.lean
new file mode 100644
index 000000000..cd1edecf6
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerMutualAddressedProgress.lean
@@ -0,0 +1,942 @@
+import Ix.Compiler.EraseAddressedSim
+import Ix.Compiler.IxIR1.LowerAddressedSim
+import Ix.Compiler.IxIR1.LowerMutualAddressedSim
+import Ix.Compiler.IxIR1.LowerProgress
+
+/-!
+# Certified progress through both production address passes
+
+The executable erasure validator certifies the literal legacy IxIR₀
+environment.  Production first replaces mutual-member keys in that environment
+and then replaces generated IxIR₁ keys after lowering.  The trace transport
+in `IxIR0.ReaddressProjectionSafe` lets the validator's exact call-aware trace
+feed the sealed lowering-progress theorem at the first addressed image; the
+existing IxIR₁ evaluator transport then carries the successful target run
+through the second image.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Address Constant Owned)
+open Ix.Compiler.IxIR1.Lower
+
+/-- Preserve the source-value relation carried by a raw erasure certificate
+while exposing the structurally renamed IxIR₀ value used by production. -/
+def MutualAddressedInlinedValRel (ectx : Ixon.Eval.EvalCtx)
+    (rawCtx : IxIR0.Ctx) (rename : Address → Address)
+    (sourceValue : Ixon.Eval.Value) (addressedValue : IxIR0.Value)
+    [scope : Ix.Compiler.Sim.MemberScope] : Prop :=
+  ∃ rawValue,
+    Ix.Compiler.Sim.InlinedValRel ectx rawCtx sourceValue rawValue ∧
+      addressedValue = IxIR0.Readdress.Value.mapAddresses rename rawValue
+
+namespace CallAwareProjectionSafe
+
+/-- A validator certificate over the exact legacy environment yields the
+exact call-aware trace of the addressed IxIR₀ main.  The accompanying value
+relation retains the raw witness instead of pretending that `ValRel` itself is
+address-invariant. -/
+theorem of_certifiedSharedClosed_addressed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (hstrict : ectx.Strict)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hrenameOracle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval
+          (erased.addressed.addressedCtx afterOracle) targetFuel []
+          erased.main targetValue ∧
+        MutualAddressedInlinedValRel ectx
+          (erased.rawCtx beforeOracle)
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+          sourceValue targetValue := by
+  obtain ⟨targetFuel, rawValue, htrace, hrel⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed cert hstrict horacles hctx
+      hframe hbelow hsource
+  let rename := IxIR0.MutualBlock.Renaming.apply erased.addressMap
+  refine ⟨targetFuel, IxIR0.Readdress.Value.mapAddresses rename rawValue,
+    ?_, rawValue, hrel, rfl⟩
+  exact EraseAddressed.run_projectionSafeMain_of_run_eq_ok herase
+    beforeOracle afterOracle hrenameOracle htrace
+
+/-- Member-scoped certificate transport through production IxIR₀
+readdressing.  This is the cyclic/indexed counterpart of the empty-scope
+compatibility theorem above. -/
+theorem of_certifiedSharedClosed_addressed_with_members
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing
+      (erased.rawCtx beforeOracle) scope.plan)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hrenameOracle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval
+          (erased.addressed.addressedCtx afterOracle) targetFuel []
+          erased.main targetValue ∧
+        MutualAddressedInlinedValRel ectx
+          (erased.rawCtx beforeOracle)
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+          sourceValue targetValue := by
+  obtain ⟨targetFuel, rawValue, htrace, hrel⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed_with_members hmembers cert
+      horacles hctx hframe hbelow hsource
+  let rename := IxIR0.MutualBlock.Renaming.apply erased.addressMap
+  refine ⟨targetFuel, IxIR0.Readdress.Value.mapAddresses rename rawValue,
+    ?_, rawValue, hrel, rfl⟩
+  exact EraseAddressed.run_projectionSafeMain_of_run_eq_ok herase
+    beforeOracle afterOracle hrenameOracle htrace
+
+end CallAwareProjectionSafe
+
+/-- The raw IxIR₁ target produced from a certified addressed IxIR₀ main
+has a successful run.  All callable value and trace contracts are rebuilt
+from the actual compiler output; only the two explicit extern contracts
+remain premises. -/
+theorem lowerAllIndexedAction_main_progress_of_addressed_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (hstrict : ectx.Strict)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hrenameOracle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {targetCtx : Ctx}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      targetCtx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented targetCtx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      targetCtx)
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx afterOracle)
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx afterOracle)
+      targetCtx)
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx afterOracle)
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx afterOracle)
+      targetCtx) :
+    ∃ targetFuel store value,
+      runMain targetCtx mainCode targetFuel = .ok (store, value) := by
+  obtain ⟨traceFuel, _, htrace, _⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed_addressed
+      beforeOracle afterOracle cert hstrict herase hrenameOracle horacles hctx
+      hframe hbelow hsource
+  have hlower' :
+      (lowerAllAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have henv : (erased.addressed.addressedCtx afterOracle).env =
+      IxIR0.Env.ofList erased.declarations := rfl
+  exact lowerAllAction_main_progress_of_trace_sealed henv hlower' htarget
+    hrepresented hcontracts hexternValue hexternProgress htrace
+
+/-- Member-scoped form of raw addressed target progress.  Simultaneous member
+coverage replaces the empty-scope strictness route while all lowering and
+extern contracts remain identical. -/
+theorem
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_with_members_sealed
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing
+      (erased.rawCtx beforeOracle) scope.plan)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hrenameOracle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {targetCtx : Ctx}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      targetCtx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented targetCtx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      targetCtx)
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx afterOracle)
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx afterOracle)
+      targetCtx)
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx afterOracle)
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx afterOracle)
+      targetCtx) :
+    ∃ targetFuel store value,
+      runMain targetCtx mainCode targetFuel = .ok (store, value) := by
+  obtain ⟨traceFuel, _, htrace, _⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members
+      beforeOracle afterOracle hmembers cert herase hrenameOracle horacles hctx
+      hframe hbelow hsource
+  have hlower' :
+      (lowerAllAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have henv : (erased.addressed.addressedCtx afterOracle).env =
+      IxIR0.Env.ofList erased.declarations := rfl
+  exact lowerAllAction_main_progress_of_trace_sealed henv hlower' htarget
+    hrepresented hcontracts hexternValue hexternProgress htrace
+
+/-- The successful raw target run survives the generated-code address pass,
+so the exact production artifact has a successful execution. -/
+theorem lowerAllIndexedAddressed_main_progress_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (hstrict : ectx.Strict)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.preAddressCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.preAddressCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle)) :
+    ∃ targetFuel store value,
+      runMain (lowered.addressedCtx targetOracle) lowered.main targetFuel =
+        .ok (store, value) := by
+  obtain ⟨targetFuel, rawStore, targetValue, hraw⟩ :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_sealed
+      (targetCtx := lowered.preAddressCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      cert hstrict herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe
+      hbelow hsource hlower htarget hrepresented hcontracts hexternValue
+      hexternProgress
+  refine ⟨targetFuel,
+    IxIR1.Readdress.Store.mapAddresses
+      (IxIR1.Readdress.Renaming.apply lowered.addressMap) rawStore,
+    targetValue, ?_⟩
+  exact lowerAllIndexedAddressed_runMain_success hlower haddressed
+    targetOracle hraw
+
+/-- Full certificate-sealed production simulation.  The validator's raw
+call-aware trace establishes target progress after IxIR₀ readdressing;
+whole-pass value contracts establish raw lowering agreement; and both address
+maps are then composed by their evaluator transports. -/
+theorem
+    lowerAllIndexedAddressed_semanticForwardSimulation_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (hstrict : ectx.Strict)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.preAddressCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.preAddressCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle)) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle) cert.target lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (IxIR1.Readdress.Renaming.apply lowered.addressMap)
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+  have hlower' :
+      (lowerAllAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have henv : (erased.addressed.addressedCtx
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)).env =
+      IxIR0.Env.ofList erased.declarations := rfl
+  have hfixedProgress :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_sealed
+      (targetCtx := lowered.preAddressCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      cert hstrict herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe
+      hbelow hsource hlower htarget hrepresented hcontracts hexternValue
+      hexternProgress
+  have hrawSimulation : SemanticForwardSimulation
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle) erased.main mainCode
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed
+      henv hlower' htarget hrepresented hcontracts hexternValue
+    intro _ _ _
+    exact hfixedProgress
+  intro legacyFuel legacyValue hlegacy
+  exact lowerAllIndexedAddressed_after_addressedErasure herase
+    beforeOracle
+    (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+    (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+    hlower haddressed targetOracle
+    hrawSimulation hlegacy
+
+/-! ## SCC-aware production endpoint -/
+
+/-- The certificate-sealed raw target run survives complete source/generated
+SCC readdressing, yielding progress for the exact pipeline artifact. -/
+theorem lowerAllIndexedFullyAddressed_main_progress_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (hstrict : ectx.Strict)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.preAddressCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.preAddressCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle)) :
+    ∃ targetFuel store value,
+      runMain (lowered.addressedCtx targetOracle) lowered.main targetFuel =
+        .ok (store, value) := by
+  obtain ⟨targetFuel, rawStore, targetValue, hraw⟩ :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_sealed
+      (targetCtx := lowered.preAddressCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      cert hstrict herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe hbelow hsource hlower htarget hrepresented
+      hcontracts hexternValue hexternProgress
+  refine ⟨targetFuel,
+    IxIR1.Readdress.Store.mapAddresses
+      (IxIR1.Readdress.Renaming.apply lowered.addressMap) rawStore,
+    targetValue, ?_⟩
+  exact lowerAllIndexedFullyAddressed_runMain_success hlower haddressed
+    targetOracle hraw
+
+/-- Final certificate-sealed production simulation through cycle-safe IxIR₀
+member addressing and complete cycle-safe IxIR₁ content addressing. -/
+theorem
+    lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (hstrict : ectx.Strict)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.preAddressCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.preAddressCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle)) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle) cert.target lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (IxIR1.Readdress.Renaming.apply lowered.addressMap)
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+  have hlower' :
+      (lowerAllAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have henv : (erased.addressed.addressedCtx
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)).env =
+      IxIR0.Env.ofList erased.declarations := rfl
+  have hfixedProgress :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_sealed
+      (targetCtx := lowered.preAddressCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      cert hstrict herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe hbelow hsource hlower htarget hrepresented
+      hcontracts hexternValue hexternProgress
+  have hrawSimulation : SemanticForwardSimulation
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle) erased.main mainCode
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed
+      henv hlower' htarget hrepresented hcontracts hexternValue
+    intro _ _ _
+    exact hfixedProgress
+  intro legacyFuel legacyValue hlegacy
+  exact lowerAllIndexedFullyAddressed_after_addressedErasure herase
+    beforeOracle
+    (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+    (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+    hlower haddressed targetOracle hrawSimulation hlegacy
+
+/-- Member-scoped production simulation used by validator-gated compilation.
+The executable erasure certificate, simultaneous member coverage, and both
+address-pass traces are exact; the ordinary compiler/extern contracts remain
+the explicit semantic boundary. -/
+theorem
+    lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_sealed
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing
+      (erased.rawCtx beforeOracle) scope.plan)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.preAddressCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.preAddressCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle)) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle) cert.target lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (IxIR1.Readdress.Renaming.apply lowered.addressMap)
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+  have hlower' :
+      (lowerAllAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have henv : (erased.addressed.addressedCtx
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)).env =
+      IxIR0.Env.ofList erased.declarations := rfl
+  have hfixedProgress :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_with_members_sealed
+      (targetCtx := lowered.preAddressCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      hmembers cert herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe hbelow hsource hlower htarget hrepresented
+      hcontracts hexternValue hexternProgress
+  have hrawSimulation : SemanticForwardSimulation
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.preAddressCtx raw targetOracle) erased.main mainCode
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed
+      henv hlower' htarget hrepresented hcontracts hexternValue
+    intro _ _ _
+    exact hfixedProgress
+  intro legacyFuel legacyValue hlegacy
+  exact lowerAllIndexedFullyAddressed_after_addressedErasure herase
+    beforeOracle
+    (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+    (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+    hlower haddressed targetOracle hrawSimulation hlegacy
+
+/-- Alias-free member-scoped progress for the exact production artifact.
+The validator supplies progress in the literal raw declaration context, and
+the certified rebuild map transports that successful run through complete
+source/generated content addressing. -/
+theorem
+    lowerAllIndexedFullyAddressed_main_progress_of_addressed_certificate_with_members_exact_sealed
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing
+      (erased.rawCtx beforeOracle) scope.plan)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.rebuildSourceCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.rebuildSourceCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.rebuildSourceCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.rebuildSourceCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.rebuildSourceCtx raw targetOracle)) :
+    ∃ targetFuel store value,
+      runMain (lowered.addressedCtx targetOracle) lowered.main targetFuel =
+        .ok (store, value) := by
+  obtain ⟨targetFuel, rawStore, targetValue, hraw⟩ :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_with_members_sealed
+      (targetCtx := lowered.rebuildSourceCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      hmembers cert herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe hbelow hsource hlower htarget hrepresented
+      hcontracts hexternValue hexternProgress
+  refine ⟨targetFuel,
+    IxIR1.Readdress.Store.mapAddresses (lowered.rebuildRename raw) rawStore,
+    targetValue, ?_⟩
+  exact lowerAllIndexedFullyAddressed_runMain_exact_success
+    hlower haddressed targetOracle hraw
+
+/-- Alias-free member-scoped production simulation. All raw lowering
+obligations are stated against the literal declaration environment, while the
+certified rebuild map transports the successful evaluator run to the emitted
+content-addressed graph. -/
+theorem
+    lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_exact_sealed
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel certFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {programEraseFuel : Nat}
+    {erased : EraseAddressed.Result}
+    (beforeOracle : IxIR0.Oracle)
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing
+      (erased.rawCtx beforeOracle) scope.plan)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx
+      (erased.rawCtx beforeOracle) none
+      (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] certFuel source)
+    (herase : EraseAddressed.run eraseCtx constants cert.target
+      programEraseFuel = .ok erased)
+    (hreaddressable : IxIR0.Readdress.Oracle.Readdressable
+      erased.addressMap beforeOracle)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing
+      (erased.rawCtx beforeOracle))
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : IxIR1.ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ raw →
+      (lowered.rebuildSourceCtx raw targetOracle).decls targetAddress =
+        some targetDecl)
+    (hrepresented : ExtraRepresented
+      (lowered.rebuildSourceCtx raw targetOracle) finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList erased.declarations)
+      (lowered.rebuildSourceCtx raw targetOracle))
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.rebuildSourceCtx raw targetOracle))
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState)
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.rebuildSourceCtx raw targetOracle)) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle) cert.target lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (lowered.rebuildRename raw)
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+  have hlower' :
+      (lowerAllAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have henv : (erased.addressed.addressedCtx
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)).env =
+      IxIR0.Env.ofList erased.declarations := rfl
+  have hfixedProgress :=
+    lowerAllIndexedAction_main_progress_of_addressed_certificate_with_members_sealed
+      (targetCtx := lowered.rebuildSourceCtx raw targetOracle)
+      beforeOracle
+      (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+      hmembers cert herase
+      (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+      horacles hctx hframe hbelow hsource hlower htarget hrepresented
+      hcontracts hexternValue hexternProgress
+  have hrawSimulation : SemanticForwardSimulation
+      (erased.addressed.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+      (lowered.rebuildSourceCtx raw targetOracle) erased.main mainCode
+      (CompilerFunctionRel
+        (erased.addressed.addressedCtx
+          (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle))
+        (IxIR0.Env.ofList erased.declarations) finalState) := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed
+      henv hlower' htarget hrepresented hcontracts hexternValue
+    intro _ _ _
+    exact hfixedProgress
+  intro legacyFuel legacyValue hlegacy
+  exact lowerAllIndexedFullyAddressed_exact_after_addressedErasure herase
+    beforeOracle
+    (IxIR0.Readdress.Oracle.readdress erased.addressMap beforeOracle)
+    (IxIR0.Readdress.Oracle.readdress_compatible hreaddressable)
+    hlower haddressed targetOracle hrawSimulation hlegacy
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/LowerMutualAddressedSim.lean b/Ix/Compiler/IxIR1/LowerMutualAddressedSim.lean
new file mode 100644
index 000000000..5de478b72
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerMutualAddressedSim.lean
@@ -0,0 +1,271 @@
+import Ix.Compiler.EraseAddressedSim
+import Ix.Compiler.IxIR1.LowerAddressedSim
+import Ix.Compiler.IxIR1.LowerFullyAddressedSim
+
+/-!
+# Composing IxIR₀ mutual-block and IxIR₁ generated-code addressing
+
+The production pipeline now crosses two independent address maps:
+
+1. cycle-safe IxIR₀ mutual blocks replace legacy member keys and map every
+   address retained in source values; and
+2. IxIR₁ lowering preserves those source-backed keys while content-addressing
+   generated functions and mapping identities retained in the target heap.
+
+This module composes the two existing evaluator transports.  It deliberately
+keeps the maps separate: their domains and runtime actions differ, and
+collapsing them into an untyped provenance list would obscure which value or
+heap layer each map acts on.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Address Constant Owned)
+open Ix.Compiler.IxIR1.Lower
+
+/-- A final target heap realizes the IxIR₀ address image of a legacy source
+value, modulo the independent IxIR₁ generated-declaration address image. -/
+def MutualAddressedValueGraph
+    (sourceRename targetRename : Address → Address)
+    (funRel : Sim.FunctionRel) (store : Store)
+    (legacyValue : IxIR0.Value) (targetValue : RVal) : Prop :=
+  AddressedValueGraph targetRename funRel store
+    (IxIR0.Readdress.Value.mapAddresses sourceRename legacyValue)
+    targetValue
+
+/-- Forward simulation spanning both production address maps. -/
+def MutualAddressedSemanticForwardSimulation
+    (legacyCtx : IxIR0.Ctx) (targetCtx : Ctx)
+    (legacyMain : IxIR0.Expr) (targetMain : Code)
+    (sourceRename targetRename : Address → Address)
+    (funRel : Sim.FunctionRel) : Prop :=
+  ∀ {sourceFuel sourceValue},
+    IxIR0.eval legacyCtx sourceFuel [] legacyMain = .ok sourceValue →
+    ∃ targetFuel targetStore targetValue,
+      runMain targetCtx targetMain targetFuel =
+          .ok (targetStore, targetValue) ∧
+        MutualAddressedValueGraph sourceRename targetRename funRel
+          targetStore sourceValue targetValue
+
+/-- Precompose an addressed IxIR₀→IxIR₁ simulation with the generic IxIR₀
+evaluator-renaming theorem. -/
+theorem AddressedSemanticForwardSimulation.precomposeIxIR0
+    {sourceRename targetRename : Address → Address}
+    {legacyCtx addressedCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {legacyMain addressedMain : IxIR0.Expr} {targetMain : Code}
+    {funRel : Sim.FunctionRel}
+    (contexts : IxIR0.Readdress.Ctx.Renames sourceRename
+      legacyCtx addressedCtx)
+    (hmain : addressedMain =
+      IxIR0.MutualBlock.Concrete.Expr.mapAddresses sourceRename legacyMain)
+    (hsim : AddressedSemanticForwardSimulation addressedCtx targetCtx
+      addressedMain targetMain targetRename funRel) :
+    MutualAddressedSemanticForwardSimulation legacyCtx targetCtx
+      legacyMain targetMain sourceRename targetRename funRel := by
+  intro sourceFuel sourceValue hsource
+  have htransport := IxIR0.Readdress.eval_mapAddresses contexts
+    sourceFuel [] legacyMain
+  rw [hsource] at htransport
+  simp only [IxIR0.Readdress.mapResult] at htransport
+  rw [← hmain] at htransport
+  have htransport' :
+      IxIR0.eval addressedCtx sourceFuel [] addressedMain =
+        .ok (IxIR0.Readdress.Value.mapAddresses sourceRename sourceValue) := by
+    simpa only [IxIR0.Readdress.ValueList.mapAddresses_nil] using htransport
+  obtain ⟨targetFuel, targetStore, targetValue, htarget, hgraph⟩ :=
+    hsim htransport'
+  exact ⟨targetFuel, targetStore, targetValue, htarget, hgraph⟩
+
+/-- A successful addressed erasure supplies the concrete precomposition data
+for any downstream addressed IxIR₀→IxIR₁ simulation. -/
+theorem AddressedSemanticForwardSimulation.precomposeAddressedErasure
+    {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {legacyMain : IxIR0.Expr}
+    {eraseFuel : Nat} {erased : EraseAddressed.Result}
+    (herase : EraseAddressed.run eraseCtx constants legacyMain eraseFuel =
+      .ok erased)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    {targetRename : Address → Address} {targetCtx : Ctx}
+    {targetMain : Code} {funRel : Sim.FunctionRel}
+    (hsim : AddressedSemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle) targetCtx
+      erased.main targetMain targetRename funRel) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      targetCtx legacyMain targetMain
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      targetRename funRel := by
+  have haudit := EraseAddressed.semanticAudit_of_run_eq_ok herase
+  have haddressed := erased.addressed_audit haudit
+  have hmain := erased.addressed.main_eq_mapAddresses haddressed
+  apply AddressedSemanticForwardSimulation.precomposeIxIR0
+    (erased.addressed.renames_preAddressCtx haddressed
+      beforeOracle afterOracle horacle)
+  · simpa only [EraseAddressed.Result.main] using hmain
+  · exact hsim
+
+/-- Full production composition: a successful cycle-safe erasure, a
+successful indexed lowerer/readdresser, and the existing raw lowering
+simulation yield one forward simulation across both address maps. -/
+theorem lowerAllIndexedAddressed_after_addressedErasure
+    {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {legacyMain : IxIR0.Expr}
+    {eraseFuel : Nat} {erased : EraseAddressed.Result}
+    (herase : EraseAddressed.run eraseCtx constants legacyMain eraseFuel =
+      .ok erased)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : Readdress.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    {funRel : Sim.FunctionRel}
+    (hlowering : SemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle)
+      (lowered.preAddressCtx raw targetOracle)
+      erased.main mainCode funRel) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle)
+      legacyMain lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (Readdress.Renaming.apply lowered.addressMap) funRel := by
+  have hsim : AddressedSemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle)
+      (lowered.addressedCtx targetOracle) erased.main lowered.main
+      (Readdress.Renaming.apply lowered.addressMap) funRel :=
+    lowerAllIndexedAddressed_semanticForwardSimulation
+      hlower haddressed targetOracle hlowering
+  intro sourceFuel sourceValue hsource
+  exact AddressedSemanticForwardSimulation.precomposeAddressedErasure
+    (targetRename := Readdress.Renaming.apply lowered.addressMap)
+    (targetCtx := lowered.addressedCtx targetOracle)
+    (targetMain := lowered.main) (funRel := funRel)
+    herase beforeOracle afterOracle horacle hsim hsource
+
+/-- Full production composition for the SCC-aware target boundary.  The
+second map is now complete: it rekeys source and generated IxIR₁ functions,
+while its audited reserved set fixes constructor identities. -/
+theorem lowerAllIndexedFullyAddressed_after_addressedErasure
+    {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {legacyMain : IxIR0.Expr}
+    {eraseFuel : Nat} {erased : EraseAddressed.Result}
+    (herase : EraseAddressed.run eraseCtx constants legacyMain eraseFuel =
+      .ok erased)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    {funRel : Sim.FunctionRel}
+    (hlowering : SemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle)
+      (lowered.preAddressCtx raw targetOracle)
+      erased.main mainCode funRel) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle)
+      legacyMain lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (Readdress.Renaming.apply lowered.addressMap) funRel := by
+  have hsim : AddressedSemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle)
+      (lowered.addressedCtx targetOracle) erased.main lowered.main
+      (Readdress.Renaming.apply lowered.addressMap) funRel :=
+    lowerAllIndexedFullyAddressed_semanticForwardSimulation
+      hlower haddressed targetOracle hlowering
+  intro sourceFuel sourceValue hsource
+  exact AddressedSemanticForwardSimulation.precomposeAddressedErasure
+    (targetRename := Readdress.Renaming.apply lowered.addressMap)
+    (targetCtx := lowered.addressedCtx targetOracle)
+    (targetMain := lowered.main) (funRel := funRel)
+    herase beforeOracle afterOracle horacle hsim hsource
+
+/-- Alias-free production composition. The raw IxIR₁ simulation runs in
+the literal lowering environment, and the final heap is related through the
+certified exact-source `rebuildRename` rather than an alias-bearing adapter. -/
+theorem lowerAllIndexedFullyAddressed_exact_after_addressedErasure
+    {eraseCtx : Erase.EraseCtx}
+    {constants : List (Address × Constant)} {legacyMain : IxIR0.Expr}
+    {eraseFuel : Nat} {erased : EraseAddressed.Result}
+    (herase : EraseAddressed.run eraseCtx constants legacyMain eraseFuel =
+      .ok erased)
+    (beforeOracle afterOracle : IxIR0.Oracle)
+    (horacle : ∀ address arguments,
+      afterOracle
+          (IxIR0.MutualBlock.Renaming.apply erased.addressMap address)
+          (IxIR0.Readdress.ValueList.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap) arguments) =
+        (beforeOracle address arguments).map
+          (IxIR0.Readdress.Value.mapAddresses
+            (IxIR0.MutualBlock.Renaming.apply erased.addressMap)))
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {raw : List (Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {lowered : ReaddressAll.Result}
+    (hlower :
+      (lowerAllIndexedAction erased.declarations erased.main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      lowerAllIndexedFullyAddressed erased.declarations erased.main mainWorld
+        compilerFuel = .ok lowered)
+    (targetOracle : Address → List RVal → Option RVal)
+    {funRel : Sim.FunctionRel}
+    (hlowering : SemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle)
+      (lowered.rebuildSourceCtx raw targetOracle)
+      erased.main mainCode funRel) :
+    MutualAddressedSemanticForwardSimulation
+      (erased.addressed.preAddressCtx erased.groups beforeOracle)
+      (lowered.addressedCtx targetOracle)
+      legacyMain lowered.main
+      (IxIR0.MutualBlock.Renaming.apply erased.addressMap)
+      (lowered.rebuildRename raw) funRel := by
+  have hsim : AddressedSemanticForwardSimulation
+      (erased.addressed.addressedCtx afterOracle)
+      (lowered.addressedCtx targetOracle) erased.main lowered.main
+      (lowered.rebuildRename raw) funRel :=
+    lowerAllIndexedFullyAddressed_semanticForwardSimulation_exact
+      hlower haddressed targetOracle hlowering
+  intro sourceFuel sourceValue hsource
+  exact AddressedSemanticForwardSimulation.precomposeAddressedErasure
+    (targetRename := lowered.rebuildRename raw)
+    (targetCtx := lowered.addressedCtx targetOracle)
+    (targetMain := lowered.main) (funRel := funRel)
+    herase beforeOracle afterOracle horacle hsim hsource
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/LowerProgress.lean b/Ix/Compiler/IxIR1/LowerProgress.lean
new file mode 100644
index 000000000..dae61597b
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerProgress.lean
@@ -0,0 +1,20940 @@
+import Ix.Compiler.IxIR1.LowerStateSim
+import Ix.Compiler.IxIR1.Progress
+import Ix.Compiler.IxIR0.ProjectionSafe
+import Ix.Compiler.Sim
+import Ix.Compiler.EraseValidator
+
+/-!
+# Total-correctness interface for the IxIR₀ → IxIR₁ lowering
+
+`LowerSim` deliberately phrases ownership and value correspondence as
+partial correctness. This companion interface records both successful
+target-run existence and the weaker non-memory settlement needed by raw
+lowering branches that may legitimately stop with ordinary stuckness. Its
+continuation forms match `EmitSound`, while existential fuel is composed with
+the target evaluator monotonicity theorems.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Owned Uses)
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.Sim
+
+private theorem bindOk {error alpha beta : Type} (value : alpha)
+    (next : alpha → Except error beta) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem bindErr {error alpha beta : Type} (err : error)
+    (next : alpha → Except error beta) :
+    ((Except.error err : Except error alpha) >>= next) = .error err := rfl
+
+private theorem estateBindRun {error state alpha beta : Type}
+    (action : EStateM error state alpha)
+    (next : alpha → EStateM error state beta) (initial : state) :
+    (action >>= next).run initial =
+      match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error err nextState => .error err nextState := rfl
+
+private theorem permExtractRoot (root : Root)
+    (before after rest : List Root) :
+    ((before ++ root :: after) ++ rest).Perm
+      (root :: (before ++ after) ++ rest) := by
+  induction before with
+  | nil => rfl
+  | cons head before ih =>
+    simp only [List.cons_append]
+    exact (ih.cons head).trans (List.Perm.swap root head _)
+
+/-- Successful execution exists from every state satisfying `pre`. -/
+def CodeProgress (ctx : Ctx) (cur : FnDef) (pre : StatePred)
+    (code : Code) : Prop :=
+  ∀ {store env}, pre store env →
+    ∃ fuel store' value,
+      runCode ctx fuel cur store env code = .ok (store', value)
+
+/-- One operation has some successful fuel and establishes `post` after
+its result is pushed into the runtime environment. -/
+def OpProgress (ctx : Ctx) (cur : FnDef) (op : Op)
+    (pre post : StatePred) : Prop :=
+  ∀ {store env}, pre store env →
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env op = .ok (store', value) ∧
+        post store' (value :: env)
+
+/-- A code fragment reaches success or ordinary stuckness at some finite
+fuel, without pretending that a terminal stuck branch is successful.  Both
+memory faults and closed-world lookup failures are excluded. -/
+def CodeSettlement (ctx : Ctx) (cur : FnDef) (pre : StatePred)
+    (code : Code) : Prop :=
+  ∀ {store env}, pre store env →
+    ∃ fuel, SettlesWithoutMemory (runCode ctx fuel cur store env code)
+
+/-- Continuation transformer for non-memory settlement. -/
+def EmitSettlement (ctx : Ctx) (cur : FnDef) (emit : Emit)
+    (pre mid : StatePred) : Prop :=
+  ∀ code, CodeSettlement ctx cur mid code →
+    CodeSettlement ctx cur pre (emit code)
+
+/-- An emitted prefix itself reaches a non-memory terminal outcome, without
+requiring anything of the continuation placed after it. -/
+def EmitStop (ctx : Ctx) (cur : FnDef) (emit : Emit)
+    (pre : StatePred) : Prop :=
+  ∀ code, CodeSettlement ctx cur pre (emit code)
+
+theorem EmitStop.settlement {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {pre mid : StatePred} (hstop : EmitStop ctx cur emit pre) :
+    EmitSettlement ctx cur emit pre mid := by
+  intro code hcode
+  exact hstop code
+
+theorem EmitStop.postcompose {ctx : Ctx} {cur : FnDef}
+    {emit suffix : Emit} {pre : StatePred}
+    (hstop : EmitStop ctx cur emit pre) :
+    EmitStop ctx cur (emit ∘ suffix) pre := by
+  intro code
+  exact hstop (suffix code)
+
+theorem EmitSettlement.thenStop {ctx : Ctx} {cur : FnDef}
+    {emit stop : Emit} {pre mid : StatePred}
+    (hprefix : EmitSettlement ctx cur emit pre mid)
+    (hstop : EmitStop ctx cur stop mid) :
+    EmitStop ctx cur (emit ∘ stop) pre := by
+  intro code
+  exact hprefix (stop code) (hstop code)
+
+/-- Successful continuation progress for an emitted prefix, paired with the
+weaker settlement transformer needed when a later continuation stops with an
+ordinary non-memory error.  Keeping both laws in one package makes every
+successful lowering combinator automatically usable by the memory-safety
+cluster. -/
+structure EmitProgress (ctx : Ctx) (cur : FnDef) (emit : Emit)
+    (pre mid : StatePred) : Prop where
+  progresses : ∀ code, CodeProgress ctx cur mid code →
+    CodeProgress ctx cur pre (emit code)
+  settles : EmitSettlement ctx cur emit pre mid
+
+instance {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {pre mid : StatePred} :
+    CoeFun (EmitProgress ctx cur emit pre mid)
+      (fun _ => ∀ code, CodeProgress ctx cur mid code →
+        CodeProgress ctx cur pre (emit code)) where
+  coe h := h.progresses
+
+theorem CodeProgress.settlement {ctx : Ctx} {cur : FnDef}
+    {pre : StatePred} {code : Code}
+    (hprogress : CodeProgress ctx cur pre code) :
+    CodeSettlement ctx cur pre code := by
+  intro store env hpre
+  obtain ⟨fuel, store', value, hrun⟩ := hprogress hpre
+  exact ⟨fuel, .success (store', value) hrun⟩
+
+theorem settlesWithoutMemory_runCode_mono
+    {ctx : Ctx} {cur : FnDef} {store : Store} {env : List RVal}
+    {code : Code} {fuel larger : Nat}
+    (hsettles : SettlesWithoutMemory
+      (runCode ctx fuel cur store env code))
+    (hle : fuel ≤ larger) :
+    SettlesWithoutMemory (runCode ctx larger cur store env code) := by
+  cases hsettles with
+  | success value hrun =>
+    exact .success value
+      (Ix.Compiler.IxIR1.runCode_mono hle hrun)
+  | stuck message hrun =>
+    exact .stuck message
+      (Ix.Compiler.IxIR1.runCode_error_mono hle (by simp) hrun)
+
+theorem EmitSettlement.id {ctx : Ctx} {cur : FnDef}
+    {pre : StatePred} :
+    EmitSettlement ctx cur (_root_.id : Emit) pre pre := by
+  intro code hcode
+  exact hcode
+
+theorem EmitSettlement.strengthen {ctx : Ctx} {cur : FnDef}
+    {pre mid : StatePred}
+    (himp : ∀ {store env}, pre store env → mid store env) :
+    EmitSettlement ctx cur (_root_.id : Emit) pre mid := by
+  intro code hcode store env hpre
+  exact hcode (himp hpre)
+
+theorem EmitSettlement.comp {ctx : Ctx} {cur : FnDef}
+    {emit₁ emit₂ : Emit} {pre mid post : StatePred}
+    (h₁ : EmitSettlement ctx cur emit₁ pre mid)
+    (h₂ : EmitSettlement ctx cur emit₂ mid post) :
+    EmitSettlement ctx cur (emit₁ ∘ emit₂) pre post := by
+  intro code hcode
+  exact h₁ (emit₂ code) (h₂ code hcode)
+
+theorem EmitSettlement.of_pointwise {ctx : Ctx} {cur : FnDef}
+    {emit : Emit} {pre post : StatePred}
+    (hpoint : ∀ {store env}, pre store env →
+      ∃ localPre : StatePred, localPre store env ∧
+        EmitSettlement ctx cur emit localPre post) :
+    EmitSettlement ctx cur emit pre post := by
+  intro code hcode store env hpre
+  obtain ⟨localPre, hlocal, hsettles⟩ := hpoint hpre
+  exact hsettles code hcode hlocal
+
+/-- A successfully progressing operation also preserves non-memory
+settlement of an arbitrary continuation. -/
+theorem OpProgress.emitSettlement {ctx : Ctx} {cur : FnDef} {op : Op}
+    {pre post : StatePred} (hop : OpProgress ctx cur op pre post) :
+    EmitSettlement ctx cur (emitOp op) pre post := by
+  intro code hcode store env hpre
+  obtain ⟨opFuel, middleStore, opValue, hopRun, hpost⟩ := hop hpre
+  obtain ⟨codeFuel, hcodeSettles⟩ := hcode hpost
+  let common := max opFuel codeFuel
+  have hopRun' : runOp ctx common cur store env op =
+      .ok (middleStore, opValue) :=
+    runOp_mono (Nat.le_max_left _ _) hopRun
+  have hcodeSettles' : SettlesWithoutMemory
+      (runCode ctx common cur middleStore (opValue :: env) code) :=
+    settlesWithoutMemory_runCode_mono hcodeSettles
+      (Nat.le_max_right _ _)
+  refine ⟨common + 1, ?_⟩
+  cases hcodeSettles' with
+  | success value hrun =>
+    apply SettlesWithoutMemory.success value
+    rw [runCode.eq_def]
+    dsimp only [emitOp]
+    rw [hopRun', bindOk]
+    exact hrun
+  | stuck message hrun =>
+    apply SettlesWithoutMemory.stuck message
+    rw [runCode.eq_def]
+    dsimp only [emitOp]
+    rw [hopRun', bindOk]
+    exact hrun
+
+theorem EmitProgress.id {ctx : Ctx} {cur : FnDef} {pre : StatePred} :
+    EmitProgress ctx cur (_root_.id : Emit) pre pre := by
+  exact
+    { progresses := by
+        intro code hcode
+        exact hcode
+      settles := EmitSettlement.id }
+
+theorem EmitProgress.strengthen {ctx : Ctx} {cur : FnDef}
+    {pre mid : StatePred}
+    (himp : ∀ {store env}, pre store env → mid store env) :
+    EmitProgress ctx cur (_root_.id : Emit) pre mid := by
+  exact
+    { progresses := by
+        intro code hcode store env hpre
+        exact hcode (himp hpre)
+      settles := EmitSettlement.strengthen himp }
+
+/-- Build a uniform progress/settlement transformer from a proof selected at
+each inhabited input state.  This is useful when a semantic witness stored in
+the precondition chooses a callable contract, while the emitted code and
+public predicates remain fixed. -/
+theorem EmitProgress.of_pointwise {ctx : Ctx} {cur : FnDef}
+    {emit : Emit} {pre post : StatePred}
+    (hpoint : ∀ {store env}, pre store env →
+      ∃ localPre : StatePred, localPre store env ∧
+        EmitProgress ctx cur emit localPre post) :
+    EmitProgress ctx cur emit pre post := by
+  exact
+    { progresses := by
+        intro code hcode store env hpre
+        obtain ⟨localPre, hlocal, hprogress⟩ := hpoint hpre
+        exact hprogress code hcode hlocal
+      settles := by
+        intro code hcode store env hpre
+        obtain ⟨localPre, hlocal, hprogress⟩ := hpoint hpre
+        exact hprogress.settles code hcode hlocal }
+
+theorem EmitProgress.comp {ctx : Ctx} {cur : FnDef}
+    {emit₁ emit₂ : Emit} {pre mid post : StatePred}
+    (h₁ : EmitProgress ctx cur emit₁ pre mid)
+    (h₂ : EmitProgress ctx cur emit₂ mid post) :
+    EmitProgress ctx cur (emit₁ ∘ emit₂) pre post := by
+  exact
+    { progresses := by
+        intro code hcode
+        exact h₁ (emit₂ code) (h₂ code hcode)
+      settles := EmitSettlement.comp h₁.settles h₂.settles }
+
+/-- One successful operation and one successful continuation can be raised
+to a common predecessor fuel and joined by `Code.letOp`. -/
+theorem OpProgress.emit {ctx : Ctx} {cur : FnDef} {op : Op}
+    {pre post : StatePred} (hop : OpProgress ctx cur op pre post) :
+    EmitProgress ctx cur (emitOp op) pre post := by
+  refine
+    { progresses := ?_
+      settles := hop.emitSettlement }
+  intro code hcode store env hpre
+  obtain ⟨opFuel, middleStore, opValue, hopRun, hpost⟩ := hop hpre
+  obtain ⟨codeFuel, finalStore, finalValue, hcodeRun⟩ := hcode hpost
+  let common := max opFuel codeFuel
+  have hopRun' : runOp ctx common cur store env op =
+      .ok (middleStore, opValue) :=
+    runOp_mono (Nat.le_max_left _ _) hopRun
+  have hcodeRun' : runCode ctx common cur middleStore (opValue :: env)
+      code = .ok (finalStore, finalValue) :=
+    runCode_mono (Nat.le_max_right _ _) hcodeRun
+  refine ⟨common + 1, finalStore, finalValue, ?_⟩
+  rw [runCode.eq_def]
+  dsimp only [emitOp]
+  rw [hopRun', bindOk]
+  exact hcodeRun'
+
+/-- A resolved return atom closes progress immediately. -/
+theorem codeProgress_ret {ctx : Ctx} {cur : FnDef}
+    {pre : StatePred} {atom : Atom}
+    (hresolve : ∀ {store env}, pre store env →
+      ∃ value, resolveAtom env atom = .ok value) :
+    CodeProgress ctx cur pre (.ret atom) := by
+  intro store env hpre
+  obtain ⟨value, hvalue⟩ := hresolve hpre
+  refine ⟨1, store, value, ?_⟩
+  rw [runCode.eq_def]
+  dsimp only
+  rw [hvalue, bindOk]
+
+/-! ## Progress refinements of lowering results -/
+
+/-- A semantic lowering result together with successful execution of its
+emitted prefix from every graph-owned input state. -/
+structure LowerResultValueProgress (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (world : Owned)
+    (emit : Emit) (av : AVal) : Prop
+    extends LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av where
+  graphProgress : ∀ sourceRest rest slots,
+    EmitProgress ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput sourceValue world av sourceRest rest slots)
+
+/-- Progress refinement for a completed left-to-right argument vector. -/
+structure LowerArgsValueProgress (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput sourceValues : List IxIR0.Value)
+    (worlds : List Owned) (emit : Emit) (avs : List AVal) : Prop
+    extends LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs where
+  graphProgress : ∀ sourceRest rest slots,
+    EmitProgress ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs sourceRest rest slots)
+
+/-- Progress refinement for a borrowing-position lowering result. -/
+structure LowerBorrowValueProgress (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (emit : Emit) (av : AVal)
+    (release : Bool) : Prop
+    extends LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release where
+  graphProgress : ∀ sourceRest rest slots,
+    EmitProgress ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput sourceValue av release sourceRest rest slots)
+
+/-- Semantic lowering plus the weaker non-memory settlement transformer.
+This is the uniform result used by the memory-safety induction: successful
+branches preserve their full graph postcondition, while an ordinary-stuck
+branch may terminate before reaching it. -/
+structure LowerResultValueSettlement (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (world : Owned)
+    (emit : Emit) (av : AVal) : Prop
+    extends LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av where
+  graphSettlement : ∀ sourceRest rest slots,
+    EmitSettlement ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput sourceValue world av sourceRest rest slots)
+
+structure LowerArgsValueSettlement (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput sourceValues : List IxIR0.Value)
+    (worlds : List Owned) (emit : Emit) (avs : List AVal) : Prop
+    extends LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs where
+  graphSettlement : ∀ sourceRest rest slots,
+    EmitSettlement ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs sourceRest rest slots)
+
+structure LowerBorrowValueSettlement (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (emit : Emit) (av : AVal)
+    (release : Bool) : Prop
+    extends LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release where
+  graphSettlement : ∀ sourceRest rest slots,
+    EmitSettlement ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput sourceValue av release sourceRest rest slots)
+
+theorem LowerResultValueProgress.settlement
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hprogress : LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue world emit av) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue world emit av :=
+  { toLowerResultValueSound := hprogress.toLowerResultValueSound
+    graphSettlement := fun sourceRest rest slots =>
+      (hprogress.graphProgress sourceRest rest slots).settles }
+
+theorem LowerArgsValueProgress.settlement
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hprogress : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValues worlds emit avs) :
+    LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValues worlds emit avs :=
+  { toLowerArgsValueSound := hprogress.toLowerArgsValueSound
+    graphSettlement := fun sourceRest rest slots =>
+      (hprogress.graphProgress sourceRest rest slots).settles }
+
+theorem LowerBorrowValueProgress.settlement
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue emit av release) :
+    LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue emit av release :=
+  { toLowerBorrowValueSound := hprogress.toLowerBorrowValueSound
+    graphSettlement := fun sourceRest rest slots =>
+      (hprogress.graphProgress sourceRest rest slots).settles }
+
+/-- If the source and logical compiler environments have different lengths,
+the graph-owned input state is uninhabited.  Any ownership-sound emitter is
+therefore also a (vacuous) value-progress emitter for that malformed input. -/
+theorem LowerResultSound.valueProgress_of_sourceLength_ne
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSound ctx cur input output world emit av)
+    (hlength : sourceInput.length ≠ input.entries.length) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultValueSound :=
+        hsound.valueSound_of_sourceLength_ne hlength
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.of_pointwise
+  intro store env hpre
+  obtain ⟨⟨roots, hgraph, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact (hlength hgraph.entries.source_length).elim
+
+/-- A residual lambda prefix is always closure-shaped, never erased. -/
+theorem LambdaPrefix.value_ne_erased
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {arguments : List IxIR0.Value} {value : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr arguments value) :
+    value ≠ .erased := by
+  apply LambdaPrefix.traverse
+    (Result := fun _ _ _ currentValue => currentValue ≠ .erased)
+    (h := hprefix)
+  · intro currentEnv uses body
+    simp
+  · intro currentEnv uses body argument currentArguments currentValue
+      hinner ih
+    exact ih
+
+/-- A residual lambda prefix still denotes a closure. -/
+theorem LambdaPrefix.value_is_closure
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {arguments : List IxIR0.Value} {value : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr arguments value) :
+    ∃ uses closureEnv body,
+      value = .clos uses closureEnv body := by
+  apply LambdaPrefix.traverse
+    (Result := fun _ _ _ currentValue =>
+      ∃ uses closureEnv body,
+        currentValue = .clos uses closureEnv body)
+    (h := hprefix)
+  · intro currentEnv uses body
+    exact ⟨uses, currentEnv, body, rfl⟩
+  · intro currentEnv uses body argument currentArguments currentValue
+      hinner ih
+    exact ih
+
+/-- A positive-arity source definition reference denotes the initial
+closure in its leading lambda prefix. -/
+theorem SourceRefValue.lambdaPrefix_nil
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.defn result body))
+    (hpositive : 0 < lamArity body)
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    LambdaPrefix [] body [] sourceFunction := by
+  cases body with
+  | lam uses body =>
+    obtain ⟨fuel, href⟩ := href
+    cases fuel with
+    | zero => simp [IxIR0.eval] at href
+    | succ fuel =>
+      cases fuel with
+      | zero => simp [IxIR0.eval, henv, hsrc] at href
+      | succ fuel =>
+        have hvalue : sourceFunction = .clos uses [] body := by
+          simpa [IxIR0.eval, henv, hsrc] using href.symm
+        subst sourceFunction
+        exact .nil
+  | var => simp [lamArity] at hpositive
+  | ref => simp [lamArity] at hpositive
+  | app => simp [lamArity] at hpositive
+  | letE => simp [lamArity] at hpositive
+  | proj => simp [lamArity] at hpositive
+  | lit => simp [lamArity] at hpositive
+  | erased => simp [lamArity] at hpositive
+
+/-- A positive-arity constructor reference denotes its empty source pap. -/
+theorem SourceRefValue.ctorPap
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {tag arity : Nat}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.ctor tag arity))
+    (hpositive : 0 < arity)
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    sourceFunction = .pap (.ctor address tag arity) [] := by
+  obtain ⟨fuel, href⟩ := href
+  cases fuel with
+  | zero => simp [IxIR0.eval] at href
+  | succ fuel =>
+    cases fuel with
+    | zero => simp [IxIR0.eval, henv, hsrc, IxIR0.saturate] at href
+    | succ fuel =>
+      have hne : 0 ≠ arity := Nat.ne_of_lt hpositive
+      simpa [IxIR0.eval, henv, hsrc, IxIR0.saturate,
+        IxIR0.Head.arity, hne] using href.symm
+
+/-- A positive-arity extern reference denotes its empty source pap. -/
+theorem SourceRefValue.externPap
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {address : Ixon.Address} {arity : Nat}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.extern arity))
+    (hpositive : 0 < arity)
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    sourceFunction = .pap (.ext address arity) [] := by
+  obtain ⟨fuel, href⟩ := href
+  cases fuel with
+  | zero => simp [IxIR0.eval] at href
+  | succ fuel =>
+    cases fuel with
+    | zero => simp [IxIR0.eval, henv, hsrc, IxIR0.saturate] at href
+    | succ fuel =>
+      have hne : 0 ≠ arity := Nat.ne_of_lt hpositive
+      simpa [IxIR0.eval, henv, hsrc, IxIR0.saturate,
+        IxIR0.Head.arity, hne] using href.symm
+
+/-- The canonical whole-pass function relation cannot disguise the erased
+source scalar as a target pap.  Every related value is a residual lambda or
+a strictly under-filled source pap of the same provenance. -/
+theorem CompilerFunctionRel.value_ne_erased
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {state : LowSt}
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hrel : CompilerFunctionRel sourceCtx src state value address arity
+      captures) :
+    value ≠ .erased := by
+  intro hvalue
+  subst value
+  cases hrel with
+  | source hsrc heligible harity href happlies hunder =>
+    rename_i sourceFunction source
+    cases source with
+    | defn result body =>
+      have hpositive : 0 < lamArity body := by
+        simp only [sourceDeclArity] at harity
+        omega
+      have hinitial := href.lambdaPrefix_nil henv hsrc hpositive
+      have hunderBody : ([] ++ captures).length < lamArity body := by
+        simp only [sourceDeclArity] at harity
+        simpa [harity] using hunder
+      have hprefix := hinitial.append_of_applies happlies hunderBody
+      exact hprefix.value_ne_erased rfl
+    | ctor tag sourceArity =>
+      simp [SourcePapEligible] at heligible
+    | recursor numArgs natLit rules =>
+      have hsourceLookup : sourceCtx.env address =
+          some (.recursor numArgs natLit rules) := by
+        simpa [henv] using hsrc
+      have hfunction := href.recursorValue hsourceLookup
+      subst sourceFunction
+      have hcanonical : SourceApplies sourceCtx
+          (.pap (.rec_ address (numArgs + 1)) []) captures
+          (.pap (.rec_ address (numArgs + 1)) captures) := by
+        apply sourcePap_underfills
+        simp only [sourceDeclArity] at harity
+        simpa [IxIR0.Head.arity, harity] using hunder
+      have himpossible := happlies.deterministic hcanonical
+      cases himpossible
+    | extern sourceArity =>
+      have hpositive : 0 < sourceArity := by
+        simp only [sourceDeclArity] at harity
+        omega
+      have hfunction := href.externPap henv hsrc hpositive
+      subst sourceFunction
+      have hcanonical : SourceApplies sourceCtx
+          (.pap (.ext address sourceArity) []) captures
+          (.pap (.ext address sourceArity) captures) := by
+        apply sourcePap_underfills
+        simp only [sourceDeclArity] at harity
+        simpa [IxIR0.Head.arity, harity] using hunder
+      have himpossible := happlies.deterministic hcanonical
+      cases himpossible
+  | wrapper hmember hsrc href happlies hunder =>
+    rename_i sourceFunction memo
+    have hpositive : 0 < memo.arity := by omega
+    have hfunction := href.ctorPap henv hsrc hpositive
+    subst sourceFunction
+    have hcanonical : SourceApplies sourceCtx
+        (.pap (.ctor memo.source memo.tag memo.arity) []) captures
+        (.pap (.ctor memo.source memo.tag memo.arity) captures) := by
+      apply sourcePap_underfills
+      simpa [IxIR0.Head.arity] using hunder
+    have himpossible := happlies.deterministic hcanonical
+    cases himpossible
+  | lifted hlifted =>
+    obtain ⟨sourceEnv, expr, selected, supplied, hlift, hselected,
+      hcaptures, harity, hprefix⟩ := hlifted
+    exact hprefix.value_ne_erased rfl
+
+/-- Every value represented by the canonical target-pap relation is
+function-shaped on the source side.  This rules out the otherwise permitted
+abstract `ValueGraph.function` realization of constructor data. -/
+theorem CompilerFunctionRel.value_is_function
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {state : LowSt}
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hrel : CompilerFunctionRel sourceCtx src state value address arity
+      captures) :
+    (∃ uses closureEnv body,
+      value = .clos uses closureEnv body) ∨
+    (∃ head arguments, value = .pap head arguments) := by
+  cases hrel with
+  | source hsrc heligible harity href happlies hunder =>
+    rename_i sourceFunction source
+    cases source with
+    | defn result body =>
+      have hpositive : 0 < lamArity body := by
+        simp only [sourceDeclArity] at harity
+        omega
+      have hinitial := href.lambdaPrefix_nil henv hsrc hpositive
+      have hunderBody : ([] ++ captures).length < lamArity body := by
+        simp only [sourceDeclArity] at harity
+        simpa [harity] using hunder
+      exact Or.inl
+        (hinitial.append_of_applies happlies hunderBody).value_is_closure
+    | ctor tag sourceArity =>
+      simp [SourcePapEligible] at heligible
+    | recursor numArgs natLit rules =>
+      have hsourceLookup : sourceCtx.env address =
+          some (.recursor numArgs natLit rules) := by
+        simpa [henv] using hsrc
+      have hfunction := href.recursorValue hsourceLookup
+      subst sourceFunction
+      have hcanonical : SourceApplies sourceCtx
+          (.pap (.rec_ address (numArgs + 1)) []) captures
+          (.pap (.rec_ address (numArgs + 1)) captures) := by
+        apply sourcePap_underfills
+        simp only [sourceDeclArity] at harity
+        simpa [IxIR0.Head.arity, harity] using hunder
+      have hvalue := happlies.deterministic hcanonical
+      subst value
+      exact Or.inr ⟨_, _, rfl⟩
+    | extern sourceArity =>
+      have hpositive : 0 < sourceArity := by
+        simp only [sourceDeclArity] at harity
+        omega
+      have hfunction := href.externPap henv hsrc hpositive
+      subst sourceFunction
+      have hcanonical : SourceApplies sourceCtx
+          (.pap (.ext address sourceArity) []) captures
+          (.pap (.ext address sourceArity) captures) := by
+        apply sourcePap_underfills
+        simp only [sourceDeclArity] at harity
+        simpa [IxIR0.Head.arity, harity] using hunder
+      have hvalue := happlies.deterministic hcanonical
+      subst value
+      exact Or.inr ⟨_, _, rfl⟩
+  | wrapper hmember hsrc href happlies hunder =>
+    rename_i sourceFunction memo
+    have hpositive : 0 < memo.arity := by omega
+    have hfunction := href.ctorPap henv hsrc hpositive
+    subst sourceFunction
+    have hcanonical : SourceApplies sourceCtx
+        (.pap (.ctor memo.source memo.tag memo.arity) []) captures
+        (.pap (.ctor memo.source memo.tag memo.arity) captures) := by
+      apply sourcePap_underfills
+      simpa [IxIR0.Head.arity] using hunder
+    have hvalue := happlies.deterministic hcanonical
+    subst value
+    exact Or.inr ⟨_, _, rfl⟩
+  | lifted hlifted =>
+    obtain ⟨sourceEnv, expr, selected, supplied, hlift, hselected,
+      hcaptures, harity, hprefix⟩ := hlifted
+    exact Or.inl hprefix.value_is_closure
+
+theorem CompilerFunctionRel.value_ne_ctor
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {state : LowSt}
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value} {ctorAddress : Ixon.Address}
+    {tag : Nat} {fields : List IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hrel : CompilerFunctionRel sourceCtx src state value address arity
+      captures) :
+    value ≠ .ctor ctorAddress tag fields := by
+  obtain ⟨uses, closureEnv, body, hvalue⟩ |
+      ⟨head, arguments, hvalue⟩ := hrel.value_is_function henv
+  · simp [hvalue]
+  · simp [hvalue]
+
+/-- Reclassify a progressing shared slot result as a pending borrow owner. -/
+theorem LowerResultValueProgress.asBorrowSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {abs : Nat}
+    (hsound : LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.slotA abs)) :
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit (.slotA abs) true := by
+  refine
+    { toLowerBorrowValueSound :=
+        hsound.toLowerResultValueSound.asBorrowSlot
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.slotA abs) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots) := by
+    apply EmitProgress.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed := EmitProgress.comp
+    (hsound.graphProgress sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Scalar results are ownership-inert and can progress as non-owning
+borrows after discarding their distinguished logical root. -/
+theorem LowerResultValueProgress.asBorrowConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {atom : Atom}
+    (hsound : LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA atom)) :
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit (.constA atom) false := by
+  refine
+    { toLowerBorrowValueSound :=
+        hsound.toLowerResultValueSound.asBorrowConst
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.constA atom) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots) := by
+    apply EmitProgress.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation
+        (hsound.stable.const_noLocation hav)
+  have hcomposed := EmitProgress.comp
+    (hsound.graphProgress sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerResultValueSettlement.asBorrowSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {abs : Nat}
+    (hsettles : LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.slotA abs)) :
+    LowerBorrowValueSettlement funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit (.slotA abs) true := by
+  refine
+    { toLowerBorrowValueSound :=
+        hsettles.toLowerResultValueSound.asBorrowSlot
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSettlement ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.slotA abs) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots) := by
+    apply EmitSettlement.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerResultValueSettlement.asBorrowConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {atom : Atom}
+    (hsettles : LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA atom)) :
+    LowerBorrowValueSettlement funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit (.constA atom) false := by
+  refine
+    { toLowerBorrowValueSound :=
+        hsettles.toLowerResultValueSound.asBorrowConst
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSettlement ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.constA atom) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots) := by
+    apply EmitSettlement.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation
+        (hsettles.stable.const_noLocation hav)
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Empty argument lowering is an identity progress transformer. -/
+theorem lowerArgs_nil_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} :
+    LowerArgsValueProgress funRel recSelfRel ctx cur input input
+      sourceEnv sourceEnv [] [] (_root_.id : Emit) [] := by
+  refine
+    { toLowerArgsValueSound := lowerArgs_nil_value_sound
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, [], hinput, .nil, .nil, hrestGraph,
+    by simpa [rootsForWorlds] using hown⟩, hslots⟩
+
+/-- Literal lowering has no emitted operation and immediately establishes
+its scalar result graph and ownership-inert distinguished root. -/
+theorem lower_lit_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Owned}
+    {literal : IxIR0.Literal} :
+    LowerResultValueProgress funRel recSelfRel ctx cur input input
+      sourceEnv sourceEnv (.lit literal) world (_root_.id : Emit)
+      (.constA (.lit literal)) := by
+  refine
+    { toLowerResultValueSound := lower_lit_value_sound
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, .lit literal, hinput, .const rfl, .lit,
+    hrestGraph, hown.addNoLocation rfl⟩, hslots⟩
+
+/-- Erased lowering is the analogous ownership-inert identity case. -/
+theorem lower_erased_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Owned} :
+    LowerResultValueProgress funRel recSelfRel ctx cur input input
+      sourceEnv sourceEnv .erased world (_root_.id : Emit)
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound := lower_erased_value_sound
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, .erased, hinput, .const rfl, .erased,
+    hrestGraph, hown.addNoLocation rfl⟩, hslots⟩
+
+/-- Moving an arbitrary held entry emits no target operation, so its
+semantic ownership transformation is also an immediate progress
+transformation. -/
+theorem lower_held_move_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultValueProgress funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  refine
+    { toLowerResultValueSound := lower_held_move_value_sound hsource hentry
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨foundSource, value, before, after, hfoundSource, hbound,
+      hslot, _, hvalue, hroots, hout⟩ :=
+    hΓ.entries.releaseAt hentry
+  have hsourceEq : foundSource = sourceValue :=
+    Option.some.inj (hfoundSource.symm.trans hsource)
+  subst foundSource
+  refine ⟨⟨before ++ after, value, hΓ.setEntry hout, ?_, hvalue,
+    hrestGraph, ?_⟩, hslots.setEntry⟩
+  · apply AValRealizes.slot
+    · simpa [VEnv.setEntry] using hbound
+    · simpa [VEnv.setEntry, VEnv.rel] using hslot
+  · rw [hroots] at hown
+    exact hown.perm
+      (permExtractRoot ⟨worldOfUses uses, value⟩ before after rest)
+
+/-- Ordinary final variable use specializes held-entry progress to the
+single remaining source occurrence. -/
+theorem lower_var_move_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerResultValueProgress funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) :=
+  lower_held_move_value_progress hsource hentry
+
+/-- Retaining a held shared entry always has a one-step target execution.
+The refcount-only store extension transports the complete semantic
+environment and caller frame. -/
+theorem lower_held_retain_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining newRemaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultValueProgress funRel recSelfRel ctx cur Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  dsimp only
+  refine
+    { toLowerResultValueSound :=
+        lower_held_retain_value_sound hsource hworldOfUses hentry
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨foundSource, value, hfoundSource, hbound, hslot,
+      hvalueWorld, hvalue, _, hupdated⟩ :=
+    hΓ.entries.updateHeldAt newRemaining hentry
+  have hsourceEq : foundSource = sourceValue :=
+    Option.some.inj (hfoundSource.symm.trans hsource)
+  subst foundSource
+  let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+  have hΓ' : VEnvValueGraph funRel recSelfRel store Γ'
+      sourceEnv env roots := hΓ.setEntry hupdated
+  have hav : AValRealizes Γ' env (.slotA abs) value := by
+    apply AValRealizes.slot
+    · simpa [Γ', VEnv.setEntry] using hbound
+    · simpa [Γ', VEnv.setEntry, VEnv.rel] using hslot
+  have hshared : HasWorld store .shared value := by
+    simpa [hworldOfUses] using hvalueWorld
+  obtain ⟨middle, heval, hstore, hresultGraph, hmiddle⟩ :=
+    runOp_retain_borrowed_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      hav.resolveAtom hshared hvalue hown
+  have hΓmiddle : VEnvValueGraph funRel recSelfRel middle Γ'
+      sourceEnv env roots := hΓ'.monoStore hstore
+  have hrestGraph' : Sim.RootsGraph funRel middle sourceRest rest :=
+    hrestGraph.monoStore hstore
+  refine ⟨1, middle, value, heval, ?_⟩
+  refine ⟨⟨roots, value, hΓmiddle.bump value, ?_, hresultGraph,
+    hrestGraph', hmiddle⟩, hslots.setEntry.bump value⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Non-final shared variable use decrements the static occurrence count and
+executes the progressing retain rule. -/
+theorem lower_var_shared_dup_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i
+      (.slot abs (Nat.succ remaining) uses true)
+    LowerResultValueProgress funRel recSelfRel ctx cur Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) :=
+  lower_held_retain_value_progress hsource hworldOfUses hentry
+
+/-- Successful literal lowering selects the identity-emitter progress rule. -/
+theorem lowerE_lit_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.lit literal) world emit av := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, av) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  exact lower_lit_value_progress
+
+/-- Successful erased lowering likewise has immediate target progress. -/
+theorem lowerE_erased_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv .erased world emit av := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, av) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  exact lower_erased_value_progress
+
+/-- Progress counterpart of the complete variable dispatch. Final uses move
+an existing owner without an operation; repeated shared uses execute one
+`dup`. Every other successful-lowering case is contradictory. -/
+theorem lowerE_var_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world (.var i)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  have hssNe : (Owned.shared != Owned.shared) = false := by decide
+  have huuNe : (Owned.unique != Owned.unique) = false := by decide
+  have hsuNe : (Owned.shared != Owned.unique) = true := by decide
+  have husNe : (Owned.unique != Owned.shared) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[i]? with
+  | none =>
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerE, hentry] using hrun)).elim
+      | true =>
+        by_cases hworld : worldOfUses uses = world
+        · subst world
+          have hsame :
+              (worldOfUses uses != worldOfUses uses) = false := by
+            cases uses <;> decide
+          cases remaining with
+          | zero =>
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerE, hentry, hsame] using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry i (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, av) ∧ state = finalState := by
+                simpa [lowerE, hentry, hsame] using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact lower_var_move_value_progress hsource hentry
+            | succ remaining =>
+              cases uses with
+              | erased =>
+                have heq :
+                    (Owned.shared == Owned.unique) = false := by decide
+                have hpure :
+                    let input' := input.setEntry i
+                      (.slot abs (Nat.succ remaining) .erased true)
+                    (input'.bump,
+                      emitOp (.dup (.var (input'.rel abs))),
+                      AVal.slotA input'.depth) = (output, emit, av) ∧
+                      state = finalState := by
+                  simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                    using hrun
+                dsimp only at hpure
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact lower_held_retain_value_progress hsource (by rfl)
+                  hentry
+              | linear =>
+                have heq :
+                    (Owned.unique == Owned.unique) = true := by decide
+                exact (trackedThrowRun_not_ok (by
+                  simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                    using hrun)).elim
+              | affine =>
+                have heq :
+                    (Owned.unique == Owned.unique) = true := by decide
+                exact (trackedThrowRun_not_ok (by
+                  simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                    using hrun)).elim
+              | many =>
+                have heq :
+                    (Owned.shared == Owned.unique) = false := by decide
+                have hpure :
+                    let input' := input.setEntry i
+                      (.slot abs (Nat.succ remaining) .many true)
+                    (input'.bump,
+                      emitOp (.dup (.var (input'.rel abs))),
+                      AVal.slotA input'.depth) = (output, emit, av) ∧
+                      state = finalState := by
+                  simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                    using hrun
+                dsimp only at hpure
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact lower_held_retain_value_progress hsource (by rfl)
+                  hentry
+        · have hdiff : (worldOfUses uses != world) = true := by
+            cases uses <;> cases world <;>
+              simp_all [worldOfUses] <;> decide
+          cases uses <;> cases world
+          all_goals
+            try { exact (hworld (by rfl)).elim }
+          all_goals
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerE, hentry, worldOfUses, hdiff, hssNe, huuNe,
+                hsuNe, husNe, hsuEq, huuEq] using hrun)).elim
+
+/-- A final shared variable in borrowing position transfers its owner to the
+projection caller without executing an operation. -/
+theorem lower_var_shared_move_borrow_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerBorrowValueProgress funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) true := by
+  have hmove := lower_var_move_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) hsource hentry
+  have hshared : LowerResultValueProgress funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue .shared
+      (_root_.id : Emit) (.slotA abs) := by
+    simpa [hworld] using hmove
+  exact hshared.asBorrowSlot
+
+/-- Repeated shared borrowing only updates the compiler-side use count; the
+runtime environment is already a valid borrowing post-state. -/
+theorem lower_var_shared_borrow_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowValueProgress funRel recSelfRel ctx cur Γ Γ'
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) false := by
+  dsimp only
+  refine
+    { toLowerBorrowValueSound :=
+        lower_var_shared_borrow_value_sound hsource hworld hentry
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨foundSource, value, hfoundSource, hbound, hslot,
+      hvalueWorld, hvalueGraph, _, hupdated⟩ :=
+    hΓ.entries.updateHeldAt (Nat.succ remaining) hentry
+  have hsourceEq : foundSource = sourceValue :=
+    Option.some.inj (hfoundSource.symm.trans hsource)
+  subst foundSource
+  let Γ' := Γ.setEntry i
+    (.slot abs (Nat.succ remaining) uses true)
+  have hΓ' : VEnvValueGraph funRel recSelfRel store Γ'
+      sourceEnv env roots := hΓ.setEntry hupdated
+  have hav : AValRealizes Γ' env (.slotA abs) value := by
+    apply AValRealizes.slot
+    · simpa [Γ', VEnv.setEntry] using hbound
+    · simpa [Γ', VEnv.setEntry, VEnv.rel] using hslot
+  have hshared : HasWorld store .shared value := by
+    simpa [hworld] using hvalueWorld
+  refine ⟨roots, value, hΓ', hav, hshared, hvalueGraph,
+    hrestGraph, ?_, hslots.setEntry⟩
+  simpa [borrowResultRoots] using hown
+
+/-- Complete progressing variable-borrow dispatch. -/
+theorem lowerBorrow_var_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release := by
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[i]? with
+  | none =>
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerBorrow, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerBorrow, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry] using hrun)).elim
+      | true =>
+        cases uses with
+        | erased =>
+          cases remaining with
+          | zero =>
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry i (.slot abs 0 .erased false),
+                    (_root_.id : Emit), AVal.slotA abs, true) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                  using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact lower_var_shared_move_borrow_value_progress
+                hsource (by rfl) hentry
+            | succ remaining =>
+              have hpure :
+                  (input.setEntry i
+                      (.slot abs (Nat.succ remaining) .erased true),
+                    (_root_.id : Emit), AVal.slotA abs, false) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                  using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact lower_var_shared_borrow_value_progress
+                hsource (by rfl) hentry
+
+        | linear =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+              using hrun)).elim
+        | affine =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+              using hrun)).elim
+        | many =>
+          cases remaining with
+          | zero =>
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry i (.slot abs 0 .many false),
+                    (_root_.id : Emit), AVal.slotA abs, true) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                  using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact lower_var_shared_move_borrow_value_progress
+                hsource (by rfl) hentry
+            | succ remaining =>
+              have hpure :
+                  (input.setEntry i
+                      (.slot abs (Nat.succ remaining) .many true),
+                    (_root_.id : Emit), AVal.slotA abs, false) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                  using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact lower_var_shared_borrow_value_progress
+                hsource (by rfl) hentry
+
+/-- Non-variable borrowing reuses progressing shared-expression lowering and
+adapts the resulting descriptor without another target operation. -/
+theorem lowerBorrow_dynamic_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel : Nat} {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExtraExtends exprState ambient →
+      LowerResultValueProgress funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release := by
+  cases hshape <;> simp only [lowerBorrow] at hrun
+  all_goals
+    obtain ⟨exprResult, exprState, hexprRun, hafterExpr⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases exprResult with ⟨exprOutput, exprEmit, exprValue⟩
+    cases exprValue with
+    | slotA abs =>
+      have hpure :
+          (exprOutput, exprEmit, AVal.slotA abs, true) =
+              (output, emit, av, release) ∧
+            exprState = finalState := by
+        simpa using hafterExpr
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      exact (hexpr hexprRun hextends).asBorrowSlot
+    | constA atom =>
+      have hpure :
+          (exprOutput, exprEmit, AVal.constA atom, false) =
+              (output, emit, av, release) ∧
+            exprState = finalState := by
+        simpa using hafterExpr
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      exact (hexpr hexprRun hextends).asBorrowConst
+
+/-- Settlement counterpart of dynamic borrowing. If shared expression
+lowering stops safely, the adapter stops with it; if it reaches its graph
+postcondition, the descriptor is reclassified without another operation. -/
+theorem lowerBorrow_dynamic_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel : Nat} {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExtraExtends exprState ambient →
+      LowerResultValueSettlement funRel recSelfRel ctx cur
+        input exprOutput sourceEnv sourceEnv sourceValue .shared
+        exprEmit exprAv)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    LowerBorrowValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release := by
+  cases hshape <;> simp only [lowerBorrow] at hrun
+  all_goals
+    obtain ⟨exprResult, exprState, hexprRun, hafterExpr⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases exprResult with ⟨exprOutput, exprEmit, exprValue⟩
+    cases exprValue with
+    | slotA abs =>
+      have hpure :
+          (exprOutput, exprEmit, AVal.slotA abs, true) =
+              (output, emit, av, release) ∧
+            exprState = finalState := by
+        simpa using hafterExpr
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      exact (hexpr hexprRun hextends).asBorrowSlot
+    | constA atom =>
+      have hpure :
+          (exprOutput, exprEmit, AVal.constA atom, false) =
+              (output, emit, av, release) ∧
+            exprState = finalState := by
+        simpa using hafterExpr
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      exact (hexpr hexprRun hextends).asBorrowConst
+
+/-- Progress-preserving left-to-right argument sequencing.  The head result
+is protected as a framed root while the tail runs, then moved back into the
+argument prefix without executing another target operation. -/
+theorem LowerResultValueProgress.consArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {sourceValues : List IxIR0.Value}
+    {world : Owned} {worlds : List Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    (head : LowerResultValueProgress funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle sourceValue world emitHead av)
+    (tail : LowerArgsValueProgress funRel recSelfRel ctx cur
+      middle output sourceMiddle sourceOutput sourceValues worlds
+      emitTail avs) :
+    LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput (sourceValue :: sourceValues)
+      (world :: worlds) (emitHead ∘ emitTail) (av :: avs) := by
+  refine
+    { toLowerArgsValueSound :=
+        head.toLowerResultValueSound.consArgs tail.toLowerArgsValueSound
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (head.graphProgress sourceRest rest slots)
+  apply EmitProgress.of_pointwise
+  intro store env hmid
+  obtain ⟨⟨envRoots, value, hmiddle, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hmid
+  let root : Root := ⟨world, value⟩
+  have hrootWorld : HasWorld store world value := by
+    apply hown.roots_world root
+    simp [root]
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((world, sourceValue) :: sourceRest) (root :: rest) :=
+    .cons rfl hrootWorld hvalueGraph hrestGraph
+  have hprotect : SlotsRealize middle env (aValProtection av value) :=
+    head.stable.protection_realized hav
+  have htailOwn : RootOwnership store (envRoots ++ root :: rest) := by
+    apply hown.perm
+    simpa [root] using
+      (permExtractRoot root envRoots [] rest).symm
+  have htailPre : GraphOwnsVEnvProtected funRel recSelfRel middle
+      sourceMiddle ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots) store env :=
+    ⟨⟨envRoots, hmiddle, hframeGraph, htailOwn⟩,
+      hprotect.append hslots⟩
+  have hconvert : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs
+        ((world, sourceValue) :: sourceRest) (root :: rest)
+        (aValProtection av value ++ slots))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput (sourceValue :: sourceValues) (world :: worlds)
+        (av :: avs) sourceRest rest slots) := by
+    apply EmitProgress.strengthen
+    intro innerStore innerEnv htailPost
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownTail⟩, hslotsTail⟩ := htailPost
+    cases hframeGraphFinal with
+    | cons _ _ hheadGraph hrestGraphFinal =>
+      have havFinal : AValRealizes output innerEnv av value :=
+        head.stable.realize_of_protection hav
+          hslotsTail.left_of_append
+      have hheadGraph' :
+          Sim.ValueGraph funRel innerStore sourceValue value := by
+        simpa [root] using hheadGraph
+      have hownFinal : RootOwnership innerStore
+          (rootsForWorlds (world :: worlds) (value :: values) ++
+            outRoots ++ rest) := by
+        apply hownTail.perm
+        simpa [root, List.append_assoc] using
+          (permExtractRoot root
+            (rootsForWorlds worlds values ++ outRoots) [] rest)
+      exact ⟨⟨outRoots, value :: values, houtput,
+        .cons havFinal havs, .cons hheadGraph' hvalueGraphs,
+        hrestGraphFinal, hownFinal⟩, hslotsTail.right_of_append⟩
+  have htailThenConvert := EmitProgress.comp
+    (tail.graphProgress ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots)) hconvert
+  exact ⟨_, htailPre, htailThenConvert⟩
+
+/-- Settlement-preserving argument sequencing. If the head stops, the whole
+sequence stops; if it succeeds, its protected graph result frames the tail's
+settlement exactly as in successful argument progress. -/
+theorem LowerResultValueSettlement.consArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {sourceValues : List IxIR0.Value}
+    {world : Owned} {worlds : List Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    (head : LowerResultValueSettlement funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle sourceValue world emitHead av)
+    (tail : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      middle output sourceMiddle sourceOutput sourceValues worlds
+      emitTail avs) :
+    LowerArgsValueSettlement funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput (sourceValue :: sourceValues)
+      (world :: worlds) (emitHead ∘ emitTail) (av :: avs) := by
+  refine
+    { toLowerArgsValueSound :=
+        head.toLowerResultValueSound.consArgs tail.toLowerArgsValueSound
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.comp
+    (head.graphSettlement sourceRest rest slots)
+  apply EmitSettlement.of_pointwise
+  intro store env hmid
+  obtain ⟨⟨envRoots, value, hmiddle, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hmid
+  let root : Root := ⟨world, value⟩
+  have hrootWorld : HasWorld store world value := by
+    apply hown.roots_world root
+    simp [root]
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((world, sourceValue) :: sourceRest) (root :: rest) :=
+    .cons rfl hrootWorld hvalueGraph hrestGraph
+  have hprotect : SlotsRealize middle env (aValProtection av value) :=
+    head.stable.protection_realized hav
+  have htailOwn : RootOwnership store (envRoots ++ root :: rest) := by
+    apply hown.perm
+    simpa [root] using
+      (permExtractRoot root envRoots [] rest).symm
+  have htailPre : GraphOwnsVEnvProtected funRel recSelfRel middle
+      sourceMiddle ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots) store env :=
+    ⟨⟨envRoots, hmiddle, hframeGraph, htailOwn⟩,
+      hprotect.append hslots⟩
+  have hconvert : EmitSettlement ctx cur (_root_.id : Emit)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs
+        ((world, sourceValue) :: sourceRest) (root :: rest)
+        (aValProtection av value ++ slots))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput (sourceValue :: sourceValues) (world :: worlds)
+        (av :: avs) sourceRest rest slots) := by
+    apply EmitSettlement.strengthen
+    intro innerStore innerEnv htailPost
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownTail⟩, hslotsTail⟩ := htailPost
+    cases hframeGraphFinal with
+    | cons _ _ hheadGraph hrestGraphFinal =>
+      have havFinal : AValRealizes output innerEnv av value :=
+        head.stable.realize_of_protection hav
+          hslotsTail.left_of_append
+      have hheadGraph' :
+          Sim.ValueGraph funRel innerStore sourceValue value := by
+        simpa [root] using hheadGraph
+      have hownFinal : RootOwnership innerStore
+          (rootsForWorlds (world :: worlds) (value :: values) ++
+            outRoots ++ rest) := by
+        apply hownTail.perm
+        simpa [root, List.append_assoc] using
+          (permExtractRoot root
+            (rootsForWorlds worlds values ++ outRoots) [] rest)
+      exact ⟨⟨outRoots, value :: values, houtput,
+        .cons havFinal havs, .cons hheadGraph' hvalueGraphs,
+        hrestGraphFinal, hownFinal⟩, hslotsTail.right_of_append⟩
+  have htailThenConvert := EmitSettlement.comp
+    (tail.graphSettlement ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots)) hconvert
+  exact ⟨_, htailPre, htailThenConvert⟩
+
+/-- Progressing constructor allocation turns the progressing argument vector
+into a fresh graph-related constructor node. -/
+theorem LowerArgsValueProgress.alloc_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Owned} {emit : Emit} {avs : List AVal} {cid : CtorId}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length world) emit avs)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput (.ctor sourceAddress sourceTag sourceValues)
+      world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.alloc_graph haddress htag
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length world) values =
+        rootsFor world values :=
+    rootsForWorlds_replicate_eq_rootsFor world hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor world values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+    runOp_alloc_owned_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      havs.resolveAtoms haddress htag hvalueGraphs hown'
+  let allocated := store.allocNode world (.ctorN cid values.toArray)
+  let ctorValue : RVal := .loc allocated.2
+  have houtput' : VEnvValueGraph funRel recSelfRel allocated.1 output
+      sourceOutput env envRoots := by
+    simpa [allocated] using houtput.monoStore hstore
+  have hrestGraph' : Sim.RootsGraph funRel allocated.1 sourceRest rest := by
+    simpa [allocated] using hrestGraph.monoStore hstore
+  refine ⟨1, allocated.1, ctorValue, ?_, ?_⟩
+  · simpa [allocated, ctorValue] using heval
+  · refine ⟨⟨envRoots, ctorValue, houtput'.bump ctorValue, ?_, ?_,
+      hrestGraph', ?_⟩, hslots.bump ctorValue⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [ctorValue, VEnv.bump, VEnv.rel]
+    · simpa [allocated, ctorValue] using hresultGraph
+    · simpa [allocated, ctorValue] using hresultOwn
+
+/-- Progressing pap allocation stores a related shared argument prefix in a
+fresh function node. -/
+theorem LowerArgsValueProgress.papp_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.papp_graph hdecl hfun hunder
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hunderValues : values.length < declArity d := by
+    simpa [hvaluesLength] using hunder
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+    runOp_papp_owned_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      havs.resolveAtoms hdecl hunderValues hfun hvalueGraphs hown'
+  let allocated := store.allocNode .shared
+    (.papN f (declArity d) values.toArray)
+  let papValue : RVal := .loc allocated.2
+  have houtput' : VEnvValueGraph funRel recSelfRel allocated.1 output
+      sourceOutput env envRoots := by
+    simpa [allocated] using houtput.monoStore hstore
+  have hrestGraph' : Sim.RootsGraph funRel allocated.1 sourceRest rest := by
+    simpa [allocated] using hrestGraph.monoStore hstore
+  refine ⟨1, allocated.1, papValue, ?_, ?_⟩
+  · simpa [allocated, papValue] using heval
+  · refine ⟨⟨envRoots, papValue, houtput'.bump papValue, ?_, ?_,
+      hrestGraph', ?_⟩, hslots.bump papValue⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [papValue, VEnv.bump, VEnv.rel]
+    · simpa [allocated, papValue] using hresultGraph
+    · simpa [allocated, papValue] using hresultOwn
+
+/-- Progressing constructor allocation turns the progressing argument vector
+into a fresh graph-related constructor node. -/
+theorem LowerArgsValueSettlement.alloc_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Owned} {emit : Emit} {avs : List AVal} {cid : CtorId}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length world) emit avs)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput (.ctor sourceAddress sourceTag sourceValues)
+      world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.alloc_graph haddress htag
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.comp (hargs.graphSettlement sourceRest rest slots)
+  apply OpProgress.emitSettlement
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length world) values =
+        rootsFor world values :=
+    rootsForWorlds_replicate_eq_rootsFor world hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor world values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+    runOp_alloc_owned_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      havs.resolveAtoms haddress htag hvalueGraphs hown'
+  let allocated := store.allocNode world (.ctorN cid values.toArray)
+  let ctorValue : RVal := .loc allocated.2
+  have houtput' : VEnvValueGraph funRel recSelfRel allocated.1 output
+      sourceOutput env envRoots := by
+    simpa [allocated] using houtput.monoStore hstore
+  have hrestGraph' : Sim.RootsGraph funRel allocated.1 sourceRest rest := by
+    simpa [allocated] using hrestGraph.monoStore hstore
+  refine ⟨1, allocated.1, ctorValue, ?_, ?_⟩
+  · simpa [allocated, ctorValue] using heval
+  · refine ⟨⟨envRoots, ctorValue, houtput'.bump ctorValue, ?_, ?_,
+      hrestGraph', ?_⟩, hslots.bump ctorValue⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [ctorValue, VEnv.bump, VEnv.rel]
+    · simpa [allocated, ctorValue] using hresultGraph
+    · simpa [allocated, ctorValue] using hresultOwn
+
+/-- Progressing pap allocation stores a related shared argument prefix in a
+fresh function node. -/
+theorem LowerArgsValueSettlement.papp_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.papp_graph hdecl hfun hunder
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.comp (hargs.graphSettlement sourceRest rest slots)
+  apply OpProgress.emitSettlement
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hunderValues : values.length < declArity d := by
+    simpa [hvaluesLength] using hunder
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+    runOp_papp_owned_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      havs.resolveAtoms hdecl hunderValues hfun hvalueGraphs hown'
+  let allocated := store.allocNode .shared
+    (.papN f (declArity d) values.toArray)
+  let papValue : RVal := .loc allocated.2
+  have houtput' : VEnvValueGraph funRel recSelfRel allocated.1 output
+      sourceOutput env envRoots := by
+    simpa [allocated] using houtput.monoStore hstore
+  have hrestGraph' : Sim.RootsGraph funRel allocated.1 sourceRest rest := by
+    simpa [allocated] using hrestGraph.monoStore hstore
+  refine ⟨1, allocated.1, papValue, ?_, ?_⟩
+  · simpa [allocated, papValue] using heval
+  · refine ⟨⟨envRoots, papValue, houtput'.bump papValue, ?_, ?_,
+      hrestGraph', ?_⟩, hslots.bump papValue⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [papValue, VEnv.bump, VEnv.rel]
+    · simpa [allocated, papValue] using hresultGraph
+    · simpa [allocated, papValue] using hresultOwn
+
+/-! ## Source-guided callable progress -/
+
+/-- The source-side call witness used by total progress.  Unlike the older
+fuel-free `SourceApplies`, it retains each dynamically entered IxIR₀
+`Apply` trace and bounds every step by one enclosing source-evaluator fuel. -/
+abbrev SourceAppliesSafelyBelow (sourceCtx : IxIR0.Ctx) (limit : Nat) :=
+  IxIR0.ProjectionSafe.AppliesBelow sourceCtx limit
+
+/-- Forget call-aware safety evidence and recover the semantic application
+spine used by value correspondence. -/
+theorem SourceAppliesSafelyBelow.sourceApplies
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    (hspine : SourceAppliesSafelyBelow sourceCtx limit sourceFunction
+      sourceArgs sourceResult) :
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult := by
+  exact IxIR0.ProjectionSafe.AppliesBelow.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      SourceApplies sourceCtx currentFunction currentArguments currentResult)
+    (hnil := fun _ => .nil)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hfuel hstep htail ih
+      exact .cons hstep.run ih)
+    hspine
+
+/-- Function-body termination for application traces below one exact source
+fuel.  This is the contractive unit used by the source-fuel induction. -/
+def FnValueTraceProgressesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (sourceFunction : IxIR0.Value)
+    (sourceLimit : Nat) : Prop :=
+  ∀ {store : Store} {args : List RVal}
+      {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+    args.length = argWorlds.length →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction sourceArgs
+      sourceResult →
+    Sim.RootsGraph funRel store sourceRest rest →
+    RootOwnership store (rootsForWorlds argWorlds args ++ rest) →
+    ∃ fuel store' value,
+      runCode ctx fuel d store args.reverse d.body = .ok (store', value)
+
+/-- Unbounded callable progress assembled pointwise over source fuel. -/
+structure FnValueTraceProgressContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (sourceFunction : IxIR0.Value) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  progresses : ∀ sourceLimit,
+    FnValueTraceProgressesAt funRel sourceCtx ctx d argWorlds sourceFunction
+      sourceLimit
+
+/-- One callable contract restricted to source-fuel indices below `limit`. -/
+structure FnValueTraceProgressContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (sourceFunction : IxIR0.Value)
+    (limit : Nat) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  progresses : ∀ {sourceLimit}, sourceLimit < limit →
+    FnValueTraceProgressesAt funRel sourceCtx ctx d argWorlds sourceFunction
+      sourceLimit
+
+theorem FnValueTraceProgressContract.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {d : FnDef} {argWorlds : List Owned}
+    {sourceFunction : IxIR0.Value}
+    (hcontract : FnValueTraceProgressContract funRel sourceCtx ctx d
+      argWorlds sourceFunction) (limit : Nat) :
+    FnValueTraceProgressContractBelow funRel sourceCtx ctx d argWorlds
+      sourceFunction limit :=
+  ⟨hcontract.arity_eq, fun _ => hcontract.progresses _⟩
+
+theorem FnValueTraceProgressContractBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {d : FnDef} {argWorlds : List Owned}
+    {sourceFunction : IxIR0.Value} {smaller larger : Nat}
+    (hcontract : FnValueTraceProgressContractBelow funRel sourceCtx ctx d
+      argWorlds sourceFunction larger) (hbound : smaller ≤ larger) :
+    FnValueTraceProgressContractBelow funRel sourceCtx ctx d argWorlds
+      sourceFunction smaller :=
+  ⟨hcontract.arity_eq,
+    fun hsource => hcontract.progresses
+      (Nat.lt_of_lt_of_le hsource hbound)⟩
+
+/-- Higher-order target application termination at one exact enclosing
+source-fuel index. -/
+def ApplyValueTraceProgressesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (sourceLimit : Nat) : Prop :=
+  ∀ {store : Store} {function : RVal} {args : List RVal}
+      {sourceFunction : IxIR0.Value} {sourceArgs : List IxIR0.Value}
+      {sourceResult : IxIR0.Value}
+      {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+    Sim.ValueGraph funRel store sourceFunction function →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction sourceArgs
+      sourceResult →
+    sourceArgs ≠ [] →
+    Sim.RootsGraph funRel store sourceRest rest →
+    RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+    ∃ fuel store' value,
+      applyGo ctx fuel store function args = .ok (store', value)
+
+structure ApplyValueTraceProgressContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  progresses : ∀ sourceLimit,
+    ApplyValueTraceProgressesAt funRel sourceCtx ctx sourceLimit
+
+structure ApplyValueTraceProgressContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (limit : Nat) : Prop where
+  progresses : ∀ {sourceLimit}, sourceLimit < limit →
+    ApplyValueTraceProgressesAt funRel sourceCtx ctx sourceLimit
+
+theorem ApplyValueTraceProgressContract.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    (hcontract : ApplyValueTraceProgressContract funRel sourceCtx ctx)
+    (limit : Nat) :
+    ApplyValueTraceProgressContractBelow funRel sourceCtx ctx limit :=
+  ⟨fun _ => hcontract.progresses _⟩
+
+theorem ApplyValueTraceProgressContractBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontract : ApplyValueTraceProgressContractBelow funRel sourceCtx ctx
+      larger) (hbound : smaller ≤ larger) :
+    ApplyValueTraceProgressContractBelow funRel sourceCtx ctx smaller :=
+  ⟨fun hsource => hcontract.progresses
+    (Nat.lt_of_lt_of_le hsource hbound)⟩
+
+/-- The exact closed reference evaluation retained at a declaration-call
+boundary.  In particular, a nullary definition's body execution remains
+available even though its application spine is empty. -/
+abbrev SourceRefTraceAt (sourceCtx : IxIR0.Ctx) (sourceLimit : Nat)
+    (address : Ixon.Address) (sourceFunction : IxIR0.Value) : Prop :=
+  IxIR0.ProjectionSafe.Eval sourceCtx sourceLimit [] (.ref address)
+    sourceFunction
+
+/-- Pointwise source-backed declaration progress at one source-fuel index. -/
+def SourceFnTraceProgressesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (sourceLimit : Nat) : Prop :=
+  ∀ {address : Ixon.Address} {source : IxIR0.Decl}
+      {worlds : List Owned} {result : Owned} {d : FnDef}
+      {sourceFunction : IxIR0.Value},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    SourceRefTraceAt sourceCtx sourceLimit address sourceFunction →
+    FnValueTraceProgressesAt funRel sourceCtx ctx d worlds sourceFunction
+      sourceLimit
+
+structure SourceDeclTraceProgressContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  fn_progresses : ∀ sourceLimit,
+    SourceFnTraceProgressesAt funRel sourceCtx src ctx sourceLimit
+
+structure SourceDeclTraceProgressContractsBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) : Prop where
+  fn_progresses : ∀ {sourceLimit}, sourceLimit < limit →
+    SourceFnTraceProgressesAt funRel sourceCtx src ctx sourceLimit
+
+theorem SourceDeclTraceProgressContracts.fnContract
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclTraceProgressContracts funRel sourceCtx src ctx)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Owned} {result : Owned} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefTraceAt sourceCtx sourceLimit address sourceFunction) :
+    FnValueTraceProgressesAt funRel sourceCtx ctx d worlds sourceFunction
+      sourceLimit :=
+  hcontracts.fn_progresses sourceLimit hsrc hsignature hdecl href
+
+/-- Scalar-oracle termination restricted to a validated source application
+trace.  Oracle compatibility remains an explicit external boundary. -/
+structure ExternTraceProgressContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  progresses : ∀ {sourceLimit : Nat} {store : Store}
+      {address : Ixon.Address} {arity : Nat}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {sourceArgs : List IxIR0.Value} {args : List RVal},
+    sourceCtx.env address = some (.extern arity) →
+    SourceRefValue sourceCtx address sourceFunction →
+    sourceArgs.length = arity →
+    SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction sourceArgs
+      sourceResult →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    ∃ result, callScalarOracle ctx address args = .ok result
+
+/-- Source-fuel-indexed whole-context progress boundary.  Unlike
+`CompilerProgressContracts`, it asks for target termination only along the
+call-aware traces furnished by validated erasure. -/
+structure CompilerTraceProgressContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  decls : SourceDeclTraceProgressContracts funRel sourceCtx src ctx
+  apply : ApplyValueTraceProgressContract funRel sourceCtx ctx
+  extern : ExternTraceProgressContract funRel sourceCtx ctx
+
+structure CompilerTraceProgressContractsBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) : Prop where
+  decls : SourceDeclTraceProgressContractsBelow funRel sourceCtx src ctx
+    limit
+  apply : ApplyValueTraceProgressContractBelow funRel sourceCtx ctx limit
+  extern : ExternTraceProgressContract funRel sourceCtx ctx
+
+theorem CompilerTraceProgressContracts.below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : CompilerTraceProgressContracts funRel sourceCtx src ctx)
+    (limit : Nat) :
+    CompilerTraceProgressContractsBelow funRel sourceCtx src ctx limit :=
+  ⟨⟨fun _ => hcontracts.decls.fn_progresses _⟩,
+    hcontracts.apply.below limit, hcontracts.extern⟩
+
+theorem CompilerTraceProgressContractsBelow.mono
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx} {smaller larger : Nat}
+    (hcontracts : CompilerTraceProgressContractsBelow funRel sourceCtx src
+      ctx larger) (hbound : smaller ≤ larger) :
+    CompilerTraceProgressContractsBelow funRel sourceCtx src ctx smaller :=
+  ⟨⟨fun hsource => hcontracts.decls.fn_progresses
+      (Nat.lt_of_lt_of_le hsource hbound)⟩,
+    hcontracts.apply.mono hbound, hcontracts.extern⟩
+
+/-- Simultaneous source-fuel seal for declaration and higher-order progress.
+The step at `limit` may use both callable families only at strictly smaller
+source indices. -/
+theorem compilerTraceProgressContracts_of_below_step
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hextern : ExternTraceProgressContract funRel sourceCtx ctx)
+    (hstep : ∀ limit,
+      CompilerTraceProgressContractsBelow funRel sourceCtx src ctx limit →
+      SourceFnTraceProgressesAt funRel sourceCtx src ctx limit ∧
+        ApplyValueTraceProgressesAt funRel sourceCtx ctx limit) :
+    CompilerTraceProgressContracts funRel sourceCtx src ctx := by
+  have hall : ∀ limit,
+      SourceFnTraceProgressesAt funRel sourceCtx src ctx limit ∧
+        ApplyValueTraceProgressesAt funRel sourceCtx ctx limit := by
+    intro limit
+    induction limit using Nat.strongRecOn with
+    | ind limit ih =>
+        apply hstep limit
+        refine ⟨⟨?_⟩, ⟨?_⟩, hextern⟩
+        · intro prior hprior
+          exact (ih prior hprior).1
+        · intro prior hprior
+          exact (ih prior hprior).2
+  exact ⟨⟨fun limit => (hall limit).1⟩,
+    ⟨fun limit => (hall limit).2⟩, hextern⟩
+
+/-- Current-self progress available strictly below one enclosing source
+fuel.  Its ownership and value components are the already sealed semantic
+contracts; only termination is source-fuel bounded. -/
+structure CurrentSelfTraceProgressContractBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) : Prop
+    extends CurrentSelfValueContract funRel recSelfRel sourceCtx ctx cur where
+  progress : ∀ {sourceFunction : IxIR0.Value} {arity : Nat},
+    recSelfRel sourceFunction arity →
+    FnValueTraceProgressContractBelow funRel sourceCtx ctx cur
+      (List.replicate arity .shared) sourceFunction limit
+
+/-- During exact-trace lowering, a bounded current-self contract is needed
+only when the compiler environment actually contains a synthetic `recSelf`
+entry. -/
+def SelfTraceProgressAvailableBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input : VEnv) : Prop :=
+  CurrentSelfTraceProgressContractBelow funRel recSelfRel sourceCtx ctx cur
+      limit ∨
+    NoRecSelf input
+
+theorem SelfTraceProgressAvailableBelow.valueAvailable
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract.toCurrentSelfValueContract
+  | inr hno => exact Or.inr hno
+
+theorem SelfTraceProgressAvailableBelow.of_contract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (hcontract : CurrentSelfTraceProgressContractBelow funRel recSelfRel
+      sourceCtx ctx cur limit) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input :=
+  Or.inl hcontract
+
+theorem SelfTraceProgressAvailableBelow.of_noRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (hno : NoRecSelf input) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input :=
+  Or.inr hno
+
+theorem SelfTraceProgressAvailableBelow.mapNoRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv}
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfTraceProgressAvailableBelow.bump
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfTraceProgressAvailableBelow.lowerE
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfTraceProgressAvailableBelow.lowerBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal} {release : Bool}
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfTraceProgressAvailableBelow.lowerArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+    {emit : Emit} {avs : List AVal}
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState) :
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+/-- Total-correctness companion of `FnValueContract`.  Termination is
+conditioned on a successful source application spine, which is essential for
+recursive declarations that need not terminate on arbitrary arguments. -/
+structure FnValueProgressContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (sourceFunction : IxIR0.Value) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  progresses : ∀ {store : Store} {args : List RVal}
+      {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+    args.length = argWorlds.length →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    Sim.RootsGraph funRel store sourceRest rest →
+    RootOwnership store (rootsForWorlds argWorlds args ++ rest) →
+    ∃ fuel store' value,
+      runCode ctx fuel d store args.reverse d.body = .ok (store', value)
+
+/-- Total-correctness companion of `ApplyValueContract`. -/
+structure ApplyValueProgressContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  progresses : ∀ {store : Store} {function : RVal} {args : List RVal}
+      {sourceFunction : IxIR0.Value} {sourceArgs : List IxIR0.Value}
+      {sourceResult : IxIR0.Value}
+      {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+    Sim.ValueGraph funRel store sourceFunction function →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    Sim.RootsGraph funRel store sourceRest rest →
+    RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+    ∃ fuel store' value,
+      applyGo ctx fuel store function args = .ok (store', value)
+
+/-- Total-correctness companion of `ExternValueContract`.  The source
+application witness selects a terminating oracle application; this contract
+states that the target scalar oracle is defined on the related arguments. -/
+structure ExternProgressContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  progresses : ∀ {store : Store} {address : Ixon.Address} {arity : Nat}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {sourceArgs : List IxIR0.Value} {args : List RVal},
+    sourceCtx.env address = some (.extern arity) →
+    SourceRefValue sourceCtx address sourceFunction →
+    sourceArgs.length = arity →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    ∃ result, callScalarOracle ctx address args = .ok result
+
+/-- The existing oracle-totality boundary is strong enough for the
+trace-indexed interface; the latter merely restricts its call witnesses. -/
+theorem ExternProgressContract.toTrace
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    (hcontract : ExternProgressContract funRel sourceCtx ctx) :
+    ExternTraceProgressContract funRel sourceCtx ctx := by
+  refine ⟨?_⟩
+  intro sourceLimit store address arity sourceFunction sourceResult
+    sourceArgs args hdecl href hlength hsource hargs
+  exact hcontract.progresses hdecl href hlength hsource.sourceApplies hargs
+
+/-- Pointwise progress of every source-backed target declaration.  Source
+identity is pinned by the same layout and reference premises as the semantic
+declaration contracts. -/
+def SourceFnProgresses (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop :=
+  ∀ {address : Ixon.Address} {source : IxIR0.Decl}
+      {worlds : List Owned} {result : Owned} {d : FnDef}
+      {sourceFunction : IxIR0.Value},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    SourceRefValue sourceCtx address sourceFunction →
+    FnValueProgressContract funRel sourceCtx ctx d worlds sourceFunction
+
+/-- Declaration-level package for source-guided target termination. -/
+structure SourceDeclProgressContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  fn_progresses : SourceFnProgresses funRel sourceCtx src ctx
+
+theorem SourceDeclProgressContracts.fnContract
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclProgressContracts funRel sourceCtx src ctx)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Owned} {result : Owned} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    FnValueProgressContract funRel sourceCtx ctx d worlds sourceFunction :=
+  hcontracts.fn_progresses hsrc hsignature hdecl href
+
+/-- Whole-context source-guided progress boundary.  It deliberately stays
+parallel to `CompilerContracts` and `CompilerValueContracts`: termination,
+ownership, and value correspondence can then be constructed and audited as
+three independent obligations. -/
+structure CompilerProgressContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  decls : SourceDeclProgressContracts funRel sourceCtx src ctx
+  apply : ApplyValueProgressContract funRel sourceCtx ctx
+  extern : ExternProgressContract funRel sourceCtx ctx
+
+/-- Current-self package used by progressing recursor-rule environments.
+It refines the existing ownership/value package with termination for each
+source application represented by the synthetic self entry. -/
+structure CurrentSelfProgressContract (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) : Prop
+    extends CurrentSelfValueContract funRel recSelfRel sourceCtx ctx cur where
+  progress : ∀ {sourceFunction : IxIR0.Value} {arity : Nat},
+    recSelfRel sourceFunction arity →
+    FnValueProgressContract funRel sourceCtx ctx cur
+      (List.replicate arity .shared) sourceFunction
+
+/-- Current-self progress is substantive in recursor environments and
+irrelevant in ordinary environments that contain no synthetic self entry. -/
+def SelfProgressAvailable (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (input : VEnv) : Prop :=
+  CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur ∨
+    NoRecSelf input
+
+theorem SelfProgressAvailable.valueAvailable
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract.toCurrentSelfValueContract
+  | inr hno => exact Or.inr hno
+
+theorem SelfProgressAvailable.of_contract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (hcontract : CurrentSelfProgressContract funRel recSelfRel sourceCtx
+      ctx cur) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input :=
+  Or.inl hcontract
+
+theorem SelfProgressAvailable.of_noRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (hno : NoRecSelf input) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input :=
+  Or.inr hno
+
+theorem SelfProgressAvailable.mapNoRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfProgressAvailable.bump
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfProgressAvailable.lowerE
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfProgressAvailable.lowerBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal} {release : Bool}
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfProgressAvailable.lowerArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+    {emit : Emit} {avs : List AVal}
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState) :
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+/-! ## Projection-safe source evaluation witnesses -/
+
+/-- A successful IxIR₀ expression evaluation whose syntactically executed
+projections all scrutinize constructors.  Calls are intentionally left behind
+`SourceApplies`: their bodies are governed by the callable progress contracts
+rather than by the caller's syntax tree.  In particular, there is no
+constructor for IxIR₀'s `.proj`-over-`.erased` absorber. -/
+inductive ProjectionSafeEval (sourceCtx : IxIR0.Ctx) :
+    List IxIR0.Value → IxIR0.Expr → IxIR0.Value → Prop where
+  | var {sourceEnv : List IxIR0.Value} {index : Nat}
+      {value : IxIR0.Value} :
+      sourceEnv[index]? = some value →
+      ProjectionSafeEval sourceCtx sourceEnv (.var index) value
+  | ref {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+      {value : IxIR0.Value} :
+      (∃ fuel, IxIR0.eval sourceCtx fuel sourceEnv (.ref address) =
+        .ok value) →
+      ProjectionSafeEval sourceCtx sourceEnv (.ref address) value
+  | lit {sourceEnv : List IxIR0.Value} {literal : IxIR0.Literal} :
+      ProjectionSafeEval sourceCtx sourceEnv (.lit literal) (.lit literal)
+  | erased {sourceEnv : List IxIR0.Value} :
+      ProjectionSafeEval sourceCtx sourceEnv .erased .erased
+  | lam {sourceEnv : List IxIR0.Value} {uses : Uses}
+      {body : IxIR0.Expr} :
+      ProjectionSafeEval sourceCtx sourceEnv (.lam uses body)
+        (.clos uses sourceEnv body)
+  | letE {sourceEnv : List IxIR0.Value} {uses : Uses}
+      {value body : IxIR0.Expr} {bound result : IxIR0.Value} :
+      ProjectionSafeEval sourceCtx sourceEnv value bound →
+      ProjectionSafeEval sourceCtx (bound :: sourceEnv) body result →
+      ProjectionSafeEval sourceCtx sourceEnv (.letE uses value body) result
+  | app {sourceEnv : List IxIR0.Value} {function argument : IxIR0.Expr}
+      {sourceFunction sourceArgument result : IxIR0.Value} :
+      ProjectionSafeEval sourceCtx sourceEnv function sourceFunction →
+      ProjectionSafeEval sourceCtx sourceEnv argument sourceArgument →
+      (∃ fuel, IxIR0.apply sourceCtx fuel sourceFunction sourceArgument =
+        .ok result) →
+      ProjectionSafeEval sourceCtx sourceEnv (.app function argument) result
+  | proj {sourceEnv : List IxIR0.Value} {index : Nat}
+      {source : IxIR0.Expr} {address : Ixon.Address} {tag : Nat}
+      {fields : List IxIR0.Value} {result : IxIR0.Value} :
+      ProjectionSafeEval sourceCtx sourceEnv source
+        (.ctor address tag fields) →
+      fields[index]? = some result →
+      ProjectionSafeEval sourceCtx sourceEnv (.proj index source) result
+
+/-- Forget the exact call-aware evaluator trace while retaining the shallow
+expression witness consumed by the existing lowering progress induction. -/
+theorem ProjectionSafeEval.of_trace
+    {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Expr}
+    {sourceValue : IxIR0.Value}
+    (htrace : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceEnv
+      source sourceValue) :
+    ProjectionSafeEval sourceCtx sourceEnv source sourceValue := by
+  induction sourceFuel using Nat.strongRecOn generalizing sourceEnv source
+      sourceValue with
+  | ind sourceFuel ih =>
+    have hrun := htrace.run
+    cases htrace with
+    | var hlookup => exact .var hlookup
+    | lit => exact .lit
+    | erased => exact .erased
+    | lam => exact .lam
+    | letE hvalue hbody =>
+        exact .letE (ih _ (by omega) hvalue) (ih _ (by omega) hbody)
+    | app hfunction hargument happly =>
+        exact .app (ih _ (by omega) hfunction)
+          (ih _ (by omega) hargument) ⟨_, happly.run⟩
+    | proj hsource hfield => exact .proj (ih _ (by omega) hsource) hfield
+    | refDefn hdecl hbody =>
+        exact .ref ⟨_,
+          (IxIR0.ProjectionSafe.Eval.refDefn hdecl hbody).run⟩
+    | refCtor hdecl hsaturate =>
+        exact .ref ⟨_,
+          (IxIR0.ProjectionSafe.Eval.refCtor hdecl hsaturate).run⟩
+    | refRecursor hdecl =>
+        exact .ref ⟨_, hrun⟩
+    | refExtern hdecl hsaturate =>
+        exact .ref ⟨_,
+          (IxIR0.ProjectionSafe.Eval.refExtern hdecl hsaturate).run⟩
+
+/-- Fuel-free call-aware termination implies the existing projection-safe
+expression predicate. -/
+theorem ProjectionSafeEval.of_terminates
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {source : IxIR0.Expr} {sourceValue : IxIR0.Value}
+    (htrace : IxIR0.ProjectionSafe.Terminates sourceCtx sourceEnv source
+      sourceValue) :
+    ProjectionSafeEval sourceCtx sourceEnv source sourceValue := by
+  obtain ⟨sourceFuel, htrace⟩ := htrace
+  exact ProjectionSafeEval.of_trace htrace
+
+/-- A projection-safe witness contains an ordinary successful evaluation at
+some sufficient fuel. -/
+theorem ProjectionSafeEval.eval {sourceCtx : IxIR0.Ctx} :
+    ∀ {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+      {value : IxIR0.Value},
+      ProjectionSafeEval sourceCtx sourceEnv expr value →
+      ∃ fuel, IxIR0.eval sourceCtx fuel sourceEnv expr = .ok value
+  | _, _, _, .var hlookup => by
+      refine ⟨1, ?_⟩
+      simp [IxIR0.eval, hlookup]
+  | _, _, _, .ref heval => heval
+  | _, _, _, .lit => ⟨1, by simp [IxIR0.eval]⟩
+  | _, _, _, .erased => ⟨1, by simp [IxIR0.eval]⟩
+  | _, _, _, .lam => ⟨1, by simp [IxIR0.eval]⟩
+  | _, _, _, .letE hvalue hbody => by
+      obtain ⟨valueFuel, hvalueRun⟩ := hvalue.eval
+      obtain ⟨bodyFuel, hbodyRun⟩ := hbody.eval
+      let common := max valueFuel bodyFuel
+      refine ⟨common + 1, ?_⟩
+      rw [IxIR0.eval.eq_def]
+      dsimp only
+      rw [IxIR0.eval_mono (Nat.le_max_left _ _) hvalueRun, bindOk]
+      exact IxIR0.eval_mono (Nat.le_max_right _ _) hbodyRun
+  | _, _, _, .app hfunction hargument happly => by
+      obtain ⟨functionFuel, hfunctionRun⟩ := hfunction.eval
+      obtain ⟨argumentFuel, hargumentRun⟩ := hargument.eval
+      obtain ⟨applyFuel, happlyRun⟩ := happly
+      let common := max functionFuel (max argumentFuel applyFuel)
+      have hfunctionLe : functionFuel ≤ common := Nat.le_max_left _ _
+      have hargumentLe : argumentFuel ≤ common :=
+        Nat.le_trans (Nat.le_max_left _ _) (Nat.le_max_right _ _)
+      have happlyLe : applyFuel ≤ common :=
+        Nat.le_trans (Nat.le_max_right _ _) (Nat.le_max_right _ _)
+      refine ⟨common + 1, ?_⟩
+      rw [IxIR0.eval.eq_def]
+      dsimp only
+      rw [IxIR0.eval_mono hfunctionLe hfunctionRun, bindOk]
+      rw [IxIR0.eval_mono hargumentLe hargumentRun, bindOk]
+      exact IxIR0.apply_mono happlyLe happlyRun
+  | _, _, _, .proj hsource hfield => by
+      obtain ⟨sourceFuel, hsourceRun⟩ := hsource.eval
+      refine ⟨sourceFuel + 1, ?_⟩
+      rw [IxIR0.eval.eq_def]
+      dsimp only
+      rw [hsourceRun, bindOk]
+      dsimp only
+      rw [hfield]
+
+/-- Pointwise projection-safe evaluation of an argument list. -/
+inductive ProjectionSafeArgs (sourceCtx : IxIR0.Ctx)
+    (sourceEnv : List IxIR0.Value) :
+    List IxIR0.Expr → List IxIR0.Value → Prop where
+  | nil : ProjectionSafeArgs sourceCtx sourceEnv [] []
+  | cons {expr : IxIR0.Expr} {value : IxIR0.Value}
+      {expressions : List IxIR0.Expr} {values : List IxIR0.Value} :
+      ProjectionSafeEval sourceCtx sourceEnv expr value →
+      ProjectionSafeArgs sourceCtx sourceEnv expressions values →
+      ProjectionSafeArgs sourceCtx sourceEnv
+        (expr :: expressions) (value :: values)
+
+/-- Dependent lockstep traversal of projection-safe source arguments and
+their values.  Each callback receives the exact head safety witness and the
+original tail derivation together with the recursively produced result. -/
+theorem ProjectionSafeArgs.traverse {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value}
+    {Result : List IxIR0.Expr → List IxIR0.Value → Prop}
+    (hnil : Result [] [])
+    (hcons : ∀ {expr : IxIR0.Expr} {value : IxIR0.Value}
+        {expressions : List IxIR0.Expr} {values : List IxIR0.Value},
+      ProjectionSafeEval sourceCtx sourceEnv expr value →
+      ProjectionSafeArgs sourceCtx sourceEnv expressions values →
+      Result expressions values →
+      Result (expr :: expressions) (value :: values))
+    {expressions : List IxIR0.Expr} {values : List IxIR0.Value}
+    (hargs : ProjectionSafeArgs sourceCtx sourceEnv expressions values) :
+    Result expressions values := by
+  induction hargs with
+  | nil => exact hnil
+  | cons hhead htail ih => exact hcons hhead htail ih
+
+@[simp] theorem ProjectionSafeArgs.lengths {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : ProjectionSafeArgs sourceCtx sourceEnv expressions values) :
+    expressions.length = values.length := by
+  exact ProjectionSafeArgs.traverse
+    (Result := fun currentExpressions currentValues =>
+      currentExpressions.length = currentValues.length)
+    (hnil := rfl)
+    (hcons := by
+      intro expr value currentExpressions currentValues hhead htail ih
+      simp [ih])
+    hargs
+
+/-- Forget projection evidence and retain the ordinary argument-evaluation
+relation consumed by the semantic lowering lemmas. -/
+theorem ProjectionSafeArgs.evals {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : ProjectionSafeArgs sourceCtx sourceEnv expressions values) :
+    SourceArgsEval sourceCtx sourceEnv expressions values := by
+  exact ProjectionSafeArgs.traverse
+    (Result := fun currentExpressions currentValues =>
+      SourceArgsEval sourceCtx sourceEnv currentExpressions currentValues)
+    (hnil := .nil)
+    (hcons := by
+      intro expr value currentExpressions currentValues hhead htail ih
+      obtain ⟨fuel, hrun⟩ := hhead.eval
+      exact .cons hrun ih)
+    hargs
+
+/-- Projection safety is inherited by every argument prefix. -/
+theorem ProjectionSafeArgs.take {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : ProjectionSafeArgs sourceCtx sourceEnv expressions values)
+    (count : Nat) :
+    ProjectionSafeArgs sourceCtx sourceEnv (expressions.take count)
+      (values.take count) := by
+  exact (ProjectionSafeArgs.traverse
+    (Result := fun currentExpressions currentValues =>
+      ∀ currentCount,
+        ProjectionSafeArgs sourceCtx sourceEnv
+          (currentExpressions.take currentCount)
+          (currentValues.take currentCount))
+    (hnil := by
+      intro currentCount
+      simp
+      exact .nil)
+    (hcons := by
+      intro expr value currentExpressions currentValues hhead htail ih
+        currentCount
+      cases currentCount with
+      | zero => exact .nil
+      | succ currentCount =>
+        simpa using ProjectionSafeArgs.cons hhead (ih currentCount))
+    hargs) count
+
+/-- Projection safety is inherited by every argument suffix. -/
+theorem ProjectionSafeArgs.drop {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : ProjectionSafeArgs sourceCtx sourceEnv expressions values)
+    (count : Nat) :
+    ProjectionSafeArgs sourceCtx sourceEnv (expressions.drop count)
+      (values.drop count) := by
+  exact (ProjectionSafeArgs.traverse
+    (Result := fun currentExpressions currentValues =>
+      ∀ currentCount,
+        ProjectionSafeArgs sourceCtx sourceEnv
+          (currentExpressions.drop currentCount)
+          (currentValues.drop currentCount))
+    (hnil := by
+      intro currentCount
+      simp
+      exact .nil)
+    (hcons := by
+      intro expr value currentExpressions currentValues hhead htail ih
+        currentCount
+      cases currentCount with
+      | zero => exact .cons hhead htail
+      | succ currentCount => simpa using ih currentCount)
+    hargs) count
+
+/-- Projection-safe semantic evaluation of a flattened application spine. -/
+inductive ProjectionSafeSpine (sourceCtx : IxIR0.Ctx)
+    (sourceEnv : List IxIR0.Value) (head : IxIR0.Expr)
+    (arguments : List IxIR0.Expr) (result : IxIR0.Value) : Prop where
+  | intro {headValue : IxIR0.Value}
+      {argumentValues : List IxIR0.Value} :
+      ProjectionSafeEval sourceCtx sourceEnv head headValue →
+      ProjectionSafeArgs sourceCtx sourceEnv arguments argumentValues →
+      SourceApplies sourceCtx headValue argumentValues result →
+      ProjectionSafeSpine sourceCtx sourceEnv head arguments result
+
+/-- Dependent eliminator for projection-safe source-spine semantics. The
+wrapper's hidden head and argument values are exposed in one constructor-local
+place while clients retain the indexed safety and application evidence. -/
+theorem ProjectionSafeSpine.eliminate
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {head : IxIR0.Expr} {arguments : List IxIR0.Expr}
+    {result : IxIR0.Value} {Result : Prop}
+    (hspine : ProjectionSafeSpine sourceCtx sourceEnv head arguments result)
+    (hintro : ∀ {headValue : IxIR0.Value}
+        {argumentValues : List IxIR0.Value},
+      ProjectionSafeEval sourceCtx sourceEnv head headValue →
+      ProjectionSafeArgs sourceCtx sourceEnv arguments argumentValues →
+      SourceApplies sourceCtx headValue argumentValues result →
+      Result) :
+    Result := by
+  cases hspine with
+  | intro hhead harguments happlies =>
+      exact hintro hhead harguments happlies
+
+/-- Forget projection evidence and retain the existing source-spine
+evaluation relation. -/
+theorem ProjectionSafeSpine.spineEval {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {head : IxIR0.Expr}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : ProjectionSafeSpine sourceCtx sourceEnv head arguments result) :
+    SourceSpineEval sourceCtx sourceEnv head arguments result := by
+  apply hspine.eliminate
+  · intro _ _ hhead hargs happlies
+    exact .intro hhead.eval hargs.evals happlies
+
+/-- A projection-safe head evaluation is the empty-argument safe spine. -/
+theorem ProjectionSafeSpine.of_eval_nil {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {head : IxIR0.Expr}
+    {result : IxIR0.Value}
+    (heval : ProjectionSafeEval sourceCtx sourceEnv head result) :
+    ProjectionSafeSpine sourceCtx sourceEnv head [] result :=
+  .intro heval .nil .nil
+
+/-- One projection-safe application evaluation becomes the singleton
+flattened spine used by the lowering's application branch. -/
+theorem ProjectionSafeSpine.of_eval_app {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {function argument : IxIR0.Expr}
+    {result : IxIR0.Value}
+    (heval : ProjectionSafeEval sourceCtx sourceEnv
+      (.app function argument) result) :
+    ProjectionSafeSpine sourceCtx sourceEnv function [argument] result := by
+  cases heval with
+  | app hfunction hargument happly =>
+    exact .intro hfunction (.cons hargument .nil) (.cons happly.choose_spec .nil)
+
+/-- Flatten one more syntactic application while preserving all projection
+evidence for its function and argument. -/
+theorem ProjectionSafeSpine.flattenApp {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {function argument : IxIR0.Expr}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : ProjectionSafeSpine sourceCtx sourceEnv
+      (.app function argument) arguments result) :
+    ProjectionSafeSpine sourceCtx sourceEnv function
+      (argument :: arguments) result := by
+  apply hspine.eliminate
+  · intro _ _ hhead harguments happlies
+    cases hhead with
+    | app hfunction hargument happly =>
+      exact .intro hfunction (.cons hargument harguments)
+        (.cons happly.choose_spec happlies)
+
+/-- Expose the closed source reference identity while retaining the
+projection-safe argument trace. -/
+theorem ProjectionSafeSpine.refData {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : ProjectionSafeSpine sourceCtx sourceEnv (.ref address)
+      arguments result) :
+    ∃ sourceFunction sourceArguments,
+      SourceRefValue sourceCtx address sourceFunction ∧
+      ProjectionSafeArgs sourceCtx sourceEnv arguments sourceArguments ∧
+      SourceApplies sourceCtx sourceFunction sourceArguments result := by
+  apply hspine.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨fuel, hheadRun⟩ := hhead.eval
+    exact ⟨headValue, argumentValues,
+      ⟨fuel, sourceEval_ref_closed hheadRun⟩, harguments, happlies⟩
+
+/-! ### Call-aware source spines -/
+
+/-- Convert exact fuel-indexed argument traces to the shallow argument
+invariant used by the established non-call lowering rules. -/
+theorem projectionSafeArgs_of_traces
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceEnv : List IxIR0.Value} {arguments : List IxIR0.Expr}
+    {argumentValues : List IxIR0.Value}
+    (hargs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx limit sourceEnv
+      arguments argumentValues) :
+    ProjectionSafeArgs sourceCtx sourceEnv arguments argumentValues := by
+  exact IxIR0.ProjectionSafe.EvalsBelow.traverse
+    (Result := fun currentArguments currentValues =>
+      ProjectionSafeArgs sourceCtx sourceEnv currentArguments currentValues)
+    (hnil := .nil)
+    (hcons := by
+      intro fuel expr value currentArguments currentValues hfuel htrace
+        htail ih
+      exact .cons (ProjectionSafeEval.of_trace htrace) ih)
+    hargs
+
+/-- Forget exact fuels while retaining the existing projection-safe flattened
+spine. -/
+theorem projectionSafeSpine_of_trace
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceEnv : List IxIR0.Value} {head : IxIR0.Expr}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : IxIR0.ProjectionSafe.Spine sourceCtx limit sourceEnv head
+      arguments result) :
+    ProjectionSafeSpine sourceCtx sourceEnv head arguments result := by
+  cases hspine with
+  | intro _ hhead hargs happlies =>
+      exact .intro (ProjectionSafeEval.of_trace hhead)
+        (projectionSafeArgs_of_traces hargs)
+        (SourceAppliesSafelyBelow.sourceApplies happlies)
+
+/-- Expose a reference-headed call while retaining its bounded call trace.
+This is the direct-call input to source-fuel-indexed declaration progress. -/
+theorem callAwareProjectionSafeSpine_refData
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : IxIR0.ProjectionSafe.Spine sourceCtx limit sourceEnv
+      (.ref address) arguments result) :
+    ∃ sourceFunction sourceArguments,
+      SourceRefValue sourceCtx address sourceFunction ∧
+      SourceRefTraceAt sourceCtx limit address sourceFunction ∧
+      IxIR0.ProjectionSafe.EvalsBelow sourceCtx limit sourceEnv arguments
+        sourceArguments ∧
+      SourceAppliesSafelyBelow sourceCtx limit sourceFunction sourceArguments
+        result := by
+  cases hspine with
+  | @intro headFuel sourceFunction _ _ _ sourceArguments hheadBound hhead
+      harguments happlies =>
+      exact ⟨sourceFunction, sourceArguments,
+        ⟨headFuel, sourceEval_ref_closed hhead.run⟩,
+        (hhead.ref_closed.mono_le hheadBound), harguments, happlies⟩
+
+/-! ### Exact source saturation -/
+
+/-- Every non-erased exact application needs at least two source-evaluator
+fuel units: one for `apply` itself and one for the selected closure or
+saturation constructor. -/
+theorem projectionSafeApply_two_le_of_function_ne_erased
+    {sourceCtx : IxIR0.Ctx} {fuel : Nat}
+    {function argument result : IxIR0.Value}
+    (htrace : IxIR0.ProjectionSafe.Apply sourceCtx fuel function argument
+      result)
+    (hne : function ≠ .erased) :
+    2 ≤ fuel := by
+  cases htrace with
+  | clos hbody => cases hbody <;> omega
+  | pap hsaturate => cases hsaturate <;> omega
+  | erased => exact (hne rfl).elim
+
+/-- A nonempty bounded application spine from a non-erased function forces
+the common source bound above the canonical two-fuel replay threshold. -/
+theorem SourceAppliesSafelyBelow.two_lt_limit_of_nonempty
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {function result : IxIR0.Value} {arguments : List IxIR0.Value}
+    (hspine : SourceAppliesSafelyBelow sourceCtx limit function arguments
+      result)
+    (hne : function ≠ .erased) (hnonempty : arguments ≠ []) :
+    2 < limit := by
+  cases hspine with
+  | nil => exact (hnonempty rfl).elim
+  | cons hfuel hstep _ =>
+      exact Nat.lt_of_le_of_lt
+        (projectionSafeApply_two_le_of_function_ne_erased hstep hne) hfuel
+
+/-- Replay a residual leading-lambda prefix with canonical exact traces.
+Each under-saturated closure step evaluates only the next lambda, so fuel
+two suffices independently of how the prefix was originally reached. -/
+theorem LambdaPrefix.toAppliesBelow
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {arguments : List IxIR0.Value} {value : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr arguments value)
+    (hbound : 2 < limit) :
+    ∃ uses body, expr = .lam uses body ∧
+      SourceAppliesSafelyBelow sourceCtx limit
+        (.clos uses sourceEnv body) arguments value := by
+  apply LambdaPrefix.traverse
+    (Result := fun currentEnv currentExpr currentArguments currentValue =>
+      ∃ uses body, currentExpr = .lam uses body ∧
+        SourceAppliesSafelyBelow sourceCtx limit
+          (.clos uses currentEnv body) currentArguments currentValue)
+    (h := hprefix)
+  · intro currentEnv uses body
+    exact ⟨uses, body, rfl, .nil⟩
+  · intro currentEnv uses body argument currentArguments currentValue
+      hinner ih
+    obtain ⟨nextUses, nextBody, hbody, htail⟩ := ih
+    subst body
+    refine ⟨uses, .lam nextUses nextBody, rfl,
+      .cons hbound ?_ htail⟩
+    exact .clos (.lam (fuel := 0))
+
+/-- Replay a residual lambda prefix from a separately identified initial
+closure.  The empty prefix pins the canonical closure produced by
+`toAppliesBelow` to the declaration-reference value used by callers. -/
+theorem LambdaPrefix.toAppliesBelow_from_initial
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {arguments : List IxIR0.Value}
+    {initial value : IxIR0.Value}
+    (hinitial : LambdaPrefix sourceEnv expr [] initial)
+    (hprefix : LambdaPrefix sourceEnv expr arguments value)
+    (hbound : 2 < limit) :
+    SourceAppliesSafelyBelow sourceCtx limit initial arguments value := by
+  obtain ⟨uses, body, hexpr, hcanonical⟩ :=
+    hprefix.toAppliesBelow hbound
+  subst expr
+  cases hinitial
+  exact hcanonical
+
+/-- Replay any still-underfilled source PAP prefix at canonical fuel two. -/
+theorem projectionSafePap_underfills
+    {sourceCtx : IxIR0.Ctx} {limit : Nat} {head : IxIR0.Head}
+    {captures arguments : List IxIR0.Value}
+    (hbound : 2 < limit)
+    (hunder : (captures ++ arguments).length < head.arity) :
+    SourceAppliesSafelyBelow sourceCtx limit (.pap head captures) arguments
+      (.pap head (captures ++ arguments)) := by
+  induction arguments generalizing captures with
+  | nil => simpa using
+      (IxIR0.ProjectionSafe.AppliesBelow.nil
+        (ctx := sourceCtx) (limit := limit)
+        (value := IxIR0.Value.pap head captures))
+  | cons argument arguments ih =>
+      have honeUnder : (captures ++ [argument]).length < head.arity := by
+        simp only [List.length_append, List.length_cons, List.length_nil]
+          at hunder ⊢
+        omega
+      have hnotLength : (captures ++ [argument]).length ≠ head.arity :=
+        Nat.ne_of_lt honeUnder
+      have htailUnder :
+          ((captures ++ [argument]) ++ arguments).length < head.arity := by
+        simpa [List.append_assoc] using hunder
+      refine .cons hbound (.pap (.pending hnotLength)) ?_
+      simpa [List.append_assoc] using
+        (ih (captures := captures ++ [argument]) htailUnder)
+
+/-- A positive-arity definition reference has a canonical exact reference
+trace at every source bound of at least two. -/
+theorem SourceRefValue.defnTraceAt_of_positive
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {sourceLimit : Nat}
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.defn result body))
+    (hpositive : 0 < lamArity body)
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hbound : 2 ≤ sourceLimit) :
+    SourceRefTraceAt sourceCtx sourceLimit address sourceFunction := by
+  cases body with
+  | lam uses body =>
+      obtain ⟨refFuel, hrefRun⟩ := href
+      have hlookup : sourceCtx.env address =
+          some (.defn result (.lam uses body)) := by
+        rw [henv]
+        exact hsrc
+      have hcanonical : IxIR0.ProjectionSafe.Eval sourceCtx 2 []
+          (.ref address) (.clos uses [] body) :=
+        .refDefn hlookup (.lam (fuel := 0))
+      have hfunction : sourceFunction = .clos uses [] body :=
+        sourceEval_ok_unique hrefRun hcanonical.run
+      subst sourceFunction
+      exact hcanonical.mono_le hbound
+  | var => simp [lamArity] at hpositive
+  | ref => simp [lamArity] at hpositive
+  | app => simp [lamArity] at hpositive
+  | letE => simp [lamArity] at hpositive
+  | proj => simp [lamArity] at hpositive
+  | lit => simp [lamArity] at hpositive
+  | erased => simp [lamArity] at hpositive
+
+/-- A positive-arity extern reference likewise has a canonical exact pending
+PAP trace at every source bound of at least two. -/
+theorem SourceRefValue.externTraceAt_of_positive
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {sourceLimit : Nat}
+    {address : Ixon.Address} {arity : Nat}
+    {sourceFunction : IxIR0.Value}
+    (henv : sourceCtx.env = src)
+    (hsrc : src address = some (.extern arity))
+    (hpositive : 0 < arity)
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hbound : 2 ≤ sourceLimit) :
+    SourceRefTraceAt sourceCtx sourceLimit address sourceFunction := by
+  have hfunction := href.externPap henv hsrc hpositive
+  subst sourceFunction
+  have hlookup : sourceCtx.env address = some (.extern arity) := by
+    rw [henv]
+    exact hsrc
+  have hcanonical : IxIR0.ProjectionSafe.Eval sourceCtx 2 []
+      (.ref address) (.pap (.ext address arity) []) := by
+    exact .refExtern hlookup (.pending (by
+      simpa [IxIR0.Head.arity] using Nat.ne_of_lt hpositive))
+  exact hcanonical.mono_le hbound
+
+/-- A recursor reference is canonical without executing a declaration body. -/
+theorem SourceRefValue.recursorTraceAt
+    {sourceCtx : IxIR0.Ctx} {sourceLimit : Nat}
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule} {sourceFunction : IxIR0.Value}
+    (hlookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hbound : 1 ≤ sourceLimit) :
+    SourceRefTraceAt sourceCtx sourceLimit address sourceFunction := by
+  have hfunction := href.recursorValue hlookup
+  subst sourceFunction
+  exact (IxIR0.ProjectionSafe.Eval.refRecursor
+    (fuel := 0) (env := []) hlookup).mono_le hbound
+
+/-- Evaluating an expression safely and then supplying exactly its leading
+lambda telescope exposes a safe execution of `stripLams`.  Both the initial
+evaluation and every application lie below the common enclosing fuel, so the
+selected body does as well. -/
+theorem projectionSafeEval_stripLams_of_applies
+    (sourceCtx : IxIR0.Ctx) :
+    ∀ {limit : Nat} {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+      {function result : IxIR0.Value} {args : List IxIR0.Value}
+      {evalFuel : Nat},
+      IxIR0.ProjectionSafe.Eval sourceCtx evalFuel sourceEnv expr function →
+      evalFuel < limit →
+      args.length = lamArity expr →
+      SourceAppliesSafelyBelow sourceCtx limit function args result →
+      ∃ bodyFuel, bodyFuel < limit ∧
+        IxIR0.ProjectionSafe.Eval sourceCtx bodyFuel
+          (args.reverse ++ sourceEnv) (stripLams expr) result := by
+  intro limit sourceEnv expr
+  induction expr generalizing sourceEnv with
+  | var index =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+  | ref address =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+  | app fn arg =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+  | lam uses body ih =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      cases heval with
+      | lam =>
+          cases args with
+          | nil => simp [lamArity] at hlength
+          | cons argument arguments =>
+              have htailLength : arguments.length = lamArity body := by
+                simpa [lamArity] using hlength
+              cases happlies with
+              | @cons applyFuel _ _ middle _ _ happlyBound hstep htail =>
+                  cases hstep with
+                  | clos hbody =>
+                      obtain ⟨bodyFuel, hbodyBound, hresult⟩ :=
+                        ih hbody (by omega) htailLength htail
+                      refine ⟨bodyFuel, hbodyBound, ?_⟩
+                      simpa [stripLams, List.reverse_cons,
+                        List.append_assoc] using hresult
+  | letE uses value body =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+  | proj index value =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+  | lit literal =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+  | erased =>
+      intro function result args evalFuel heval hevalBound hlength happlies
+      have hnil : args = [] :=
+        List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+      subst args
+      cases happlies
+      exact ⟨evalFuel, hevalBound, by simpa [stripLams] using heval⟩
+
+/-- Completing a residual lambda prefix with an exact remaining application
+spine exposes the exact stripped-body trace selected by that saturation. -/
+theorem LambdaPrefix.saturateTrace
+    {sourceCtx : IxIR0.Ctx} {limit : Nat}
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {supplied remaining : List IxIR0.Value}
+    {function result : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr supplied function)
+    (hbound : 2 < limit)
+    (hlength : (supplied ++ remaining).length = lamArity expr)
+    (happlies : SourceAppliesSafelyBelow sourceCtx limit function remaining
+      result) :
+    ∃ bodyFuel, bodyFuel < limit ∧
+      IxIR0.ProjectionSafe.Eval sourceCtx bodyFuel
+        ((supplied ++ remaining).reverse ++ sourceEnv)
+        (stripLams expr) result := by
+  obtain ⟨uses, body, hexpr, hcanonicalPrefix⟩ :=
+    hprefix.toAppliesBelow hbound
+  subst expr
+  have hall := hcanonicalPrefix.append happlies
+  exact projectionSafeEval_stripLams_of_applies sourceCtx
+    (IxIR0.ProjectionSafe.Eval.lam (fuel := 0)) (by omega)
+    hlength hall
+
+/-- The exact reference trace for a definition retains its closed body trace
+at a strictly smaller source-fuel index. -/
+theorem SourceRefTraceAt.defnBody
+    {sourceCtx : IxIR0.Ctx} {sourceLimit : Nat}
+    {address : Ixon.Address} {world : Owned} {body : IxIR0.Expr}
+    {function : IxIR0.Value}
+    (href : SourceRefTraceAt sourceCtx sourceLimit address function)
+    (hlookup : sourceCtx.env address = some (.defn world body)) :
+    ∃ bodyFuel, bodyFuel < sourceLimit ∧
+      IxIR0.ProjectionSafe.Eval sourceCtx bodyFuel [] body function := by
+  cases href with
+  | refDefn hdecl hbody =>
+      rw [hlookup] at hdecl
+      cases hdecl
+      exact ⟨_, by omega, hbody⟩
+  | refCtor hdecl _ => simp [hlookup] at hdecl
+  | refRecursor hdecl => simp [hlookup] at hdecl
+  | refExtern hdecl _ => simp [hlookup] at hdecl
+
+/-- Saturating an exact definition-reference trace reaches its stripped body
+under the reversed source argument vector, still strictly below the enclosing
+reference fuel. -/
+theorem SourceRefTraceAt.defnSaturate
+    {sourceCtx : IxIR0.Ctx} {sourceLimit : Nat}
+    {address : Ixon.Address} {world : Owned} {body : IxIR0.Expr}
+    {function result : IxIR0.Value} {args : List IxIR0.Value}
+    (href : SourceRefTraceAt sourceCtx sourceLimit address function)
+    (hlookup : sourceCtx.env address = some (.defn world body))
+    (hlength : args.length = lamArity body)
+    (happlies : SourceAppliesSafelyBelow sourceCtx sourceLimit function args
+      result) :
+    ∃ bodyFuel, bodyFuel < sourceLimit ∧
+      IxIR0.ProjectionSafe.Eval sourceCtx bodyFuel args.reverse
+        (stripLams body) result := by
+  obtain ⟨evalFuel, hevalBound, heval⟩ := href.defnBody hlookup
+  simpa using projectionSafeEval_stripLams_of_applies sourceCtx heval
+    hevalBound hlength happlies
+
+/-- Invert a fully saturated exact recursor-reference trace at its final
+major argument.  The selected rule-body evaluation is structurally nested
+inside `Apply`/`Saturate`/`Fire`, hence its fuel is strictly below the common
+application bound. -/
+theorem sourceRecursorRef_saturates_trace_inv
+    {sourceCtx : IxIR0.Ctx} {sourceLimit : Nat}
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule}
+    {sourceFunction sourceResult major : IxIR0.Value}
+    {pre : List IxIR0.Value}
+    (hlookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules))
+    (href : SourceRefTraceAt sourceCtx sourceLimit address sourceFunction)
+    (hpreLength : pre.length = numArgs)
+    (happlies : SourceAppliesSafelyBelow sourceCtx sourceLimit
+      sourceFunction (pre ++ [major]) sourceResult) :
+    ∃ tag fields rule bodyFuel,
+      bodyFuel < sourceLimit ∧
+      IxIR0.majorCtor natLit major = .ok (tag, fields) ∧
+      rules[tag]? = some rule ∧
+      fields.length = rule.fields ∧
+      IxIR0.ProjectionSafe.Eval sourceCtx bodyFuel
+        (fields.reverse ++ pre.reverse ++
+          [.pap (.rec_ address (numArgs + 1)) []])
+        rule.rhs sourceResult := by
+  have hrefValue : SourceRefValue sourceCtx address sourceFunction :=
+    ⟨sourceLimit, href.run⟩
+  have hfunction := hrefValue.recursorValue hlookup
+  subst sourceFunction
+  obtain ⟨middle, hleft, hright⟩ :=
+    happlies.split (left := pre) (right := [major])
+  have hunder : ([] ++ pre).length <
+      (IxIR0.Head.rec_ address (numArgs + 1)).arity := by
+    simp [IxIR0.Head.arity, hpreLength]
+  have hprefix : SourceApplies sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) []) pre
+      (.pap (.rec_ address (numArgs + 1)) pre) :=
+    sourcePap_underfills hunder
+  have hmiddle : middle = .pap (.rec_ address (numArgs + 1)) pre :=
+    (SourceAppliesSafelyBelow.sourceApplies hleft).deterministic hprefix
+  subst middle
+  cases hright with
+  | @cons applyFuel _ _ middle _ arguments happlyBound hstep htail =>
+      cases htail
+      cases hstep with
+      | pap hsaturate =>
+          cases hsaturate with
+          | pending hlength =>
+              exfalso
+              apply hlength
+              simp [IxIR0.Head.arity, hpreLength]
+          | full hlength hfire =>
+              cases hfire with
+              | @recursor bodyFuel _ _ _ _ _ _ _ _ _ _ _
+                  hdecl hlast hmajor hrule hfields hbody =>
+                  rw [hlookup] at hdecl
+                  cases hdecl
+                  have hlastExpected : (pre ++ [major]).getLast? =
+                      some major := by simp
+                  rw [hlastExpected] at hlast
+                  cases hlast
+                  exact ⟨_, _, _, bodyFuel, by omega, hmajor, hrule, hfields,
+                    by simpa using hbody⟩
+
+/-! ### Projection-safe erasure inversion -/
+
+/-- Invert a successful Ixon application into its predecessor-fuel
+function, argument, and application computations. -/
+private theorem ixonEval_app_inv
+    {sourceCtx : Ixon.Eval.EvalCtx} {fuel : Nat}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {function argument : Ixon.Expr} {result : Ixon.Eval.Value}
+    (hrun : Ixon.Eval.eval sourceCtx fuel frame sourceEnv
+      (.app function argument) = .ok result) :
+    ∃ previous functionValue argumentValue,
+      previous < fuel ∧
+      Ixon.Eval.eval sourceCtx previous frame sourceEnv function =
+        .ok functionValue ∧
+      Ixon.Eval.eval sourceCtx previous frame sourceEnv argument =
+        .ok argumentValue ∧
+      Ixon.Eval.apply sourceCtx previous functionValue argumentValue =
+        .ok result := by
+  cases fuel with
+  | zero =>
+    rw [Ixon.Eval.eval.eq_def] at hrun
+    simp at hrun
+  | succ fuel =>
+    rw [Ixon.Eval.eval.eq_def] at hrun
+    dsimp only at hrun
+    cases hfunction :
+        Ixon.Eval.eval sourceCtx fuel frame sourceEnv function with
+    | error error =>
+      rw [hfunction] at hrun
+      contradiction
+    | ok functionValue =>
+      rw [hfunction, bindOk] at hrun
+      cases hargument :
+          Ixon.Eval.eval sourceCtx fuel frame sourceEnv argument with
+      | error error =>
+        rw [hargument] at hrun
+        contradiction
+      | ok argumentValue =>
+        rw [hargument, bindOk] at hrun
+        exact ⟨fuel, functionValue, argumentValue, Nat.lt_succ_self _,
+          hfunction, hargument, hrun⟩
+
+/-- Invert a successful Ixon let into its predecessor-fuel value and body
+computations. -/
+private theorem ixonEval_let_inv
+    {sourceCtx : Ixon.Eval.EvalCtx} {fuel : Nat}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {nondep : Bool} {type value body : Ixon.Expr}
+    {result : Ixon.Eval.Value}
+    (hrun : Ixon.Eval.eval sourceCtx fuel frame sourceEnv
+      (.letE nondep type value body) = .ok result) :
+    ∃ previous bound,
+      previous < fuel ∧
+      Ixon.Eval.eval sourceCtx previous frame sourceEnv value = .ok bound ∧
+      Ixon.Eval.eval sourceCtx previous frame (bound :: sourceEnv) body =
+        .ok result := by
+  cases fuel with
+  | zero =>
+    rw [Ixon.Eval.eval.eq_def] at hrun
+    simp at hrun
+  | succ fuel =>
+    rw [Ixon.Eval.eval.eq_def] at hrun
+    dsimp only at hrun
+    cases hvalue : Ixon.Eval.eval sourceCtx fuel frame sourceEnv value with
+    | error error =>
+      rw [hvalue] at hrun
+      contradiction
+    | ok bound =>
+      rw [hvalue, bindOk] at hrun
+      exact ⟨fuel, bound, Nat.lt_succ_self _, hvalue, hrun⟩
+
+/-- A successful Ixon projection necessarily evaluated its operand at the
+predecessor fuel. -/
+private theorem ixonEval_proj_target_inv
+    {sourceCtx : Ixon.Eval.EvalCtx} {fuel : Nat}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {typeRef field : UInt64} {source : Ixon.Expr}
+    {result : Ixon.Eval.Value}
+    (hrun : Ixon.Eval.eval sourceCtx fuel frame sourceEnv
+      (.prj typeRef field source) = .ok result) :
+    ∃ previous target,
+      previous < fuel ∧
+      Ixon.Eval.eval sourceCtx previous frame sourceEnv source =
+        .ok target := by
+  cases fuel with
+  | zero =>
+    rw [Ixon.Eval.eval.eq_def] at hrun
+    simp at hrun
+  | succ fuel =>
+    rw [Ixon.Eval.eval.eq_def] at hrun
+    dsimp only at hrun
+    cases htarget : Ixon.Eval.eval sourceCtx fuel frame sourceEnv source with
+    | error error =>
+      rw [htarget] at hrun
+      contradiction
+    | ok target => exact ⟨fuel, target, Nat.lt_succ_self _, htarget⟩
+
+/-- Pin the value relation produced by erasure simulation to any independently
+obtained evaluation of the same erased expression. -/
+private theorem erasure_valRel_of_target_eval
+    {sourceFuel targetFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetValue : IxIR0.Value} {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask source target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask sourceEnv targetEnv)
+    (htarget : IxIR0.eval targetCtx targetFuel targetEnv target =
+      .ok targetValue) :
+    Ix.Compiler.Sim.ValRel ectx targetCtx sourceValue targetValue := by
+  obtain ⟨witnessFuel, witnessValue, hwitness, hrel⟩ :=
+    Ix.Compiler.Sim.erasure_sim hstrict horacles hsource herases henv
+  let common := max witnessFuel targetFuel
+  have hwitness' : IxIR0.eval targetCtx common targetEnv target =
+      .ok witnessValue :=
+    IxIR0.eval_mono (Nat.le_max_left _ _) hwitness
+  have htarget' : IxIR0.eval targetCtx common targetEnv target =
+      .ok targetValue :=
+    IxIR0.eval_mono (Nat.le_max_right _ _) htarget
+  rw [hwitness'] at htarget'
+  injection htarget' with hvalue
+  subst targetValue
+  exact hrel
+
+/-- The exact-target form used by the fuel induction: a successful Ixon run,
+its erasure derivation, and a successful evaluation of that exact erased term
+produce a constructor-only projection trace for the exact target value. -/
+private def ProjectionSafeErasureAt (fuel : Nat) : Prop :=
+  ∀ {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {sourceEnv : List Ixon.Eval.Value} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value} {self : Option (Ixon.Address × Nat)}
+    {mask : List Bool} {targetEnv : List IxIR0.Value}
+    {target : IxIR0.Expr} {targetCtx : IxIR0.Ctx}
+    {targetFuel : Nat} {targetValue : IxIR0.Value},
+    ectx.Strict →
+    Ix.Compiler.Sim.OracleRel ectx targetCtx →
+    Ixon.Eval.eval ectx fuel frame sourceEnv source = .ok sourceValue →
+    Ix.Compiler.Sim.PErase ectx targetCtx self frame.refs frame.selfMuts
+      frame.selfAddr mask source target →
+    Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs frame.selfMuts
+      frame.selfAddr mask sourceEnv targetEnv →
+    IxIR0.eval targetCtx targetFuel targetEnv target = .ok targetValue →
+    ProjectionSafeEval targetCtx targetEnv target targetValue
+
+/-- The visible indexed-recursor spine has the same projection-safety
+property as ordinary erasure. Kept arguments use the main smaller-fuel
+hypothesis; ghost arguments erase to a trivially safe value; dropped
+arguments do not occur in the target syntax. -/
+private theorem recEraseSpine_projectionSafe
+    {bound : Nat}
+    (safe : ∀ previous, previous < bound →
+      ProjectionSafeErasureAt previous)
+    {ectx : Ixon.Eval.EvalCtx} {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    {self : Option (Ixon.Address × Nat)} {frame : Ixon.Eval.Frame}
+    {mask : List Bool} {source : Ixon.Expr} {target : IxIR0.Expr}
+    {recursor : Ix.Compiler.Ixon.Recursor}
+    {rest : List Ix.Compiler.Erase.ArgPolicy}
+    (hspine : Ix.Compiler.Sim.RecEraseSpine ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask source target recursor rest) :
+    ∀ {fuel : Nat} {sourceEnv : List Ixon.Eval.Value}
+      {sourceValue : Ixon.Eval.Value} {targetEnv : List IxIR0.Value}
+      {targetFuel : Nat} {targetValue : IxIR0.Value},
+      fuel ≤ bound →
+      Ixon.Eval.eval ectx fuel frame sourceEnv source = .ok sourceValue →
+      Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs frame.selfMuts
+        frame.selfAddr mask sourceEnv targetEnv →
+      IxIR0.eval targetCtx targetFuel targetEnv target = .ok targetValue →
+      ProjectionSafeEval targetCtx targetEnv target targetValue := by
+  induction source generalizing target recursor rest with
+  | ref refIdx univIdxs =>
+    cases hspine with
+    | head href hresolve hinfo hmut hindices htargetDecl hmember =>
+      intro fuel sourceEnv sourceValue targetEnv targetFuel targetValue
+        hbound hsource henv htarget
+      exact .ref ⟨targetFuel, htarget⟩
+  | app function argument ihFunction ihArgument =>
+    cases hspine with
+    | keep hfunction hargument =>
+      intro fuel sourceEnv sourceValue targetEnv targetFuel targetValue
+        hbound hsource henv htarget
+      obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+          hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+        ixonEval_app_inv hsource
+      obtain ⟨targetPrevious, targetFunction, targetArgument,
+          htargetFunction, htargetArgument, htargetApply⟩ :=
+        sourceEval_app_inv htarget
+      exact .app
+        (ihFunction hfunction (fuel := previous)
+          (sourceValue := sourceFunction) (targetFuel := targetPrevious)
+          (targetValue := targetFunction)
+          (Nat.le_trans (Nat.le_of_lt hprevious) hbound) hsourceFunction
+          henv htargetFunction)
+        (safe previous (Nat.lt_of_lt_of_le hprevious hbound)
+          hstrict horacles hsourceArgument hargument henv htargetArgument)
+        ⟨targetPrevious, htargetApply⟩
+    | ghost hfunction =>
+      intro fuel sourceEnv sourceValue targetEnv targetFuel targetValue
+        hbound hsource henv htarget
+      obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+          hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+        ixonEval_app_inv hsource
+      obtain ⟨targetPrevious, targetFunction, targetArgument,
+          htargetFunction, htargetArgument, htargetApply⟩ :=
+        sourceEval_app_inv htarget
+      have htargetErased := sourceEval_erased_inv htargetArgument
+      subst targetArgument
+      exact .app
+        (ihFunction hfunction (fuel := previous)
+          (sourceValue := sourceFunction) (targetFuel := targetPrevious)
+          (targetValue := targetFunction)
+          (Nat.le_trans (Nat.le_of_lt hprevious) hbound) hsourceFunction
+          henv htargetFunction)
+        .erased ⟨targetPrevious, htargetApply⟩
+    | drop hfunction =>
+      intro fuel sourceEnv sourceValue targetEnv targetFuel targetValue
+        hbound hsource henv htarget
+      obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+          hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+        ixonEval_app_inv hsource
+      exact ihFunction hfunction (fuel := previous)
+        (sourceValue := sourceFunction) (targetFuel := targetFuel)
+        (targetValue := targetValue)
+        (Nat.le_trans (Nat.le_of_lt hprevious) hbound) hsourceFunction henv
+        htarget
+  | sort index => cases hspine
+  | var index => cases hspine
+  | recur index univs =>
+    cases hspine with
+    | selfHead hself hblock hindex hresolve hrefs hlookup hindices =>
+      intro fuel sourceEnv sourceValue targetEnv targetFuel targetValue
+        hbound hsource henv htarget
+      exact .var (sourceEval_var_inv htarget)
+    | memberHead hblock hresolve hrefs hmuts hindices hplan =>
+      intro fuel sourceEnv sourceValue targetEnv targetFuel targetValue
+        hbound hsource henv htarget
+      exact .ref ⟨targetFuel, htarget⟩
+  | prj typeRef field source ih => cases hspine
+  | str index => cases hspine
+  | nat index => cases hspine
+  | lam uses type body ihType ihBody => cases hspine
+  | all uses owned domain codomain ihDomain ihCodomain => cases hspine
+  | letE nondep type value body ihType ihValue ihBody => cases hspine
+  | share index => cases hspine
+
+private theorem strongNatProjectionSafe {predicate : Nat → Prop}
+    (step : ∀ fuel, (∀ previous, previous < fuel → predicate previous) →
+      predicate fuel) :
+    ∀ fuel, predicate fuel := by
+  have aux : ∀ bound fuel, fuel < bound → predicate fuel := by
+    intro bound
+    induction bound with
+    | zero => intro fuel hlt; exact absurd hlt (Nat.not_lt_zero fuel)
+    | succ bound ih =>
+      intro fuel hlt
+      exact step fuel fun previous hprevious =>
+        ih previous (Nat.lt_of_lt_of_le hprevious (Nat.lt_succ_iff.mp hlt))
+  exact fun fuel => aux (fuel + 1) fuel (Nat.lt_succ_self fuel)
+
+/-- Every successful proof-producing erasure evaluation is projection-safe
+when pinned to an independently obtained evaluation of the erased term. -/
+private theorem projectionSafeErasureAt_all :
+    ∀ fuel, ProjectionSafeErasureAt fuel := by
+  intro fuel
+  induction fuel using strongNatProjectionSafe
+  rename_i fuel ih
+  intro ectx frame sourceEnv source sourceValue self mask targetEnv target
+    targetCtx targetFuel targetValue hstrict horacles hsource herases henv
+    htarget
+  cases herases with
+  | var hmask =>
+    exact .var (sourceEval_var_inv htarget)
+  | sortE =>
+    have hvalue := sourceEval_erased_inv htarget
+    subst targetValue
+    exact .erased
+  | allE =>
+    have hvalue := sourceEval_erased_inv htarget
+    subst targetValue
+    exact .erased
+  | lamK hd hbody =>
+    have hvalue := sourceEval_lam_inv htarget
+    subst targetValue
+    exact .lam
+  | lamD hd hbody =>
+    have hvalue := sourceEval_lam_inv htarget
+    subst targetValue
+    exact .lam
+  | app hfunctionErase hargumentErase =>
+    obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+        hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+      ixonEval_app_inv hsource
+    obtain ⟨targetPrevious, targetFunction, targetArgument,
+        htargetFunction, htargetArgument, htargetApply⟩ :=
+      sourceEval_app_inv htarget
+    exact .app
+      (ih previous hprevious hstrict horacles hsourceFunction hfunctionErase henv
+        htargetFunction)
+      (ih previous hprevious hstrict horacles hsourceArgument hargumentErase henv
+        htargetArgument)
+      ⟨targetPrevious, htargetApply⟩
+  | appE hd hfunctionErase =>
+    obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+        hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+      ixonEval_app_inv hsource
+    obtain ⟨targetPrevious, targetFunction, targetArgument,
+        htargetFunction, htargetArgument, htargetApply⟩ :=
+      sourceEval_app_inv htarget
+    have htargetErased := sourceEval_erased_inv htargetArgument
+    subst targetArgument
+    exact .app
+      (ih previous hprevious hstrict horacles hsourceFunction hfunctionErase henv
+        htargetFunction)
+      .erased ⟨targetPrevious, htargetApply⟩
+  | appG hspine hghost hfunctionErase =>
+    obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+        hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+      ixonEval_app_inv hsource
+    obtain ⟨targetPrevious, targetFunction, targetArgument,
+        htargetFunction, htargetArgument, htargetApply⟩ :=
+      sourceEval_app_inv htarget
+    have htargetErased := sourceEval_erased_inv htargetArgument
+    subst targetArgument
+    exact .app
+      (ih previous hprevious hstrict horacles hsourceFunction hfunctionErase henv
+        htargetFunction)
+      .erased ⟨targetPrevious, htargetApply⟩
+  | appDG hspine hghost hfunctionErase =>
+    obtain ⟨previous, sourceFunction, sourceArgument, hprevious,
+        hsourceFunction, hsourceArgument, hsourceApply⟩ :=
+      ixonEval_app_inv hsource
+    obtain ⟨targetPrevious, targetFunction, targetArgument,
+        htargetFunction, htargetArgument, htargetApply⟩ :=
+      sourceEval_app_inv htarget
+    have htargetErased := sourceEval_erased_inv htargetArgument
+    subst targetArgument
+    exact .app
+      (ih previous hprevious hstrict horacles hsourceFunction hfunctionErase henv
+        htargetFunction)
+      .erased ⟨targetPrevious, htargetApply⟩
+  | recP hspine =>
+    exact recEraseSpine_projectionSafe ih hstrict horacles hspine
+      (Nat.le_refl fuel)
+      hsource henv htarget
+  | recW hspine hremaining =>
+    rename_i target recursor remaining
+    cases remaining with
+    | zero => omega
+    | succ remaining =>
+      obtain ⟨targetPrevious, targetBound, htargetValue, htargetBody⟩ :=
+        sourceEval_let_inv (by
+          simpa [Ix.Compiler.Erase.captureThenIgnoreN] using htarget)
+      have hvalue := sourceEval_lam_inv (by
+        simpa [Ix.Compiler.Erase.lamManyN] using htargetBody)
+      subst targetValue
+      exact .letE
+        (recEraseSpine_projectionSafe ih hstrict horacles hspine
+          (Nat.le_refl fuel) hsource henv htargetValue)
+        .lam
+  | letE hvalueErase hbodyErase =>
+    obtain ⟨previous, sourceBound, hprevious, hsourceValue,
+        hsourceBody⟩ := ixonEval_let_inv hsource
+    obtain ⟨targetPrevious, targetBound, htargetValue, htargetBody⟩ :=
+      sourceEval_let_inv htarget
+    have hboundRel := erasure_valRel_of_target_eval hstrict horacles hsourceValue
+      hvalueErase henv htargetValue
+    exact .letE
+      (ih previous hprevious hstrict horacles hsourceValue hvalueErase henv
+        htargetValue)
+      (ih previous hprevious hstrict horacles hsourceBody hbodyErase
+        (Ix.Compiler.Sim.EnvRel.keep hboundRel henv) htargetBody)
+  | ctorP hparams hspine hdecl =>
+    exact .ref ⟨targetFuel, htarget⟩
+  | ctorW hspine hparams hdecl =>
+    have hvalue := sourceEval_lam_inv htarget
+    subst targetValue
+    exact .lam
+  | ref href hcovered =>
+    exact .ref ⟨targetFuel, htarget⟩
+  | recurS hindex hrecur =>
+    exact .var (sourceEval_var_inv htarget)
+  | recurI hblock hresolve hrefs hlookup hdecl =>
+    exact .ref ⟨targetFuel, htarget⟩
+  | recurD hblock hresolve hrefs hmuts hunfold hplan =>
+    exact .ref ⟨targetFuel, htarget⟩
+  | recurO hblock hresolve hrefs hmuts hunfold hconfigured hplan =>
+    exact .ref ⟨targetFuel, htarget⟩
+  | recurR hblock hresolve hrefs hmuts hindices hplan =>
+    exact .ref ⟨targetFuel, htarget⟩
+  | natE href hblob =>
+    have hvalue := sourceEval_lit_inv htarget
+    subst targetValue
+    exact .lit
+  | strE href hblob =>
+    have hvalue := sourceEval_lit_inv htarget
+    subst targetValue
+    exact .lit
+  | prjE hsourceErase =>
+    obtain ⟨previous, sourceTarget, hprevious, hsourceTarget⟩ :=
+      ixonEval_proj_target_inv hsource
+    obtain ⟨targetPrevious, targetTarget, htargetTarget, hproject⟩ :=
+      sourceEval_proj_inv htarget
+    obtain ⟨address, tag, fields, projected, hshape, hfield, hrel⟩ :=
+      Ix.Compiler.Sim.erasure_proj_target_ctor hstrict horacles hsource
+        (Ix.Compiler.Sim.PErase.prjE hsourceErase) henv htargetTarget
+    subst targetTarget
+    cases hproject with
+    | ctor htargetField =>
+      exact .proj
+        (ih previous hprevious hstrict horacles hsourceTarget hsourceErase henv
+          htargetTarget)
+        htargetField
+
+/-- Successful source evaluation plus proof-producing erasure constructs the
+projection-safe IxIR₀ trace consumed by strong lowering progress. -/
+theorem ProjectionSafeEval.of_erasure_with_members
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx targetCtx scope.plan)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask source target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask sourceEnv targetEnv) :
+    ∃ targetValue,
+      ProjectionSafeEval targetCtx targetEnv target targetValue ∧
+      Ix.Compiler.Sim.ValRel ectx targetCtx sourceValue targetValue := by
+  obtain ⟨targetFuel, targetValue, htrace, hrel⟩ :=
+    Ix.Compiler.Sim.erasure_sim_projectionSafe_with_members hmembers
+      horacles hsource herases henv
+  exact ⟨targetValue, ProjectionSafeEval.of_trace htrace, hrel⟩
+
+/-- Empty-member-scope compatibility specialization of
+`ProjectionSafeEval.of_erasure_with_members`. -/
+theorem ProjectionSafeEval.of_erasure
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask source target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask sourceEnv targetEnv) :
+    ∃ targetValue,
+      ProjectionSafeEval targetCtx targetEnv target targetValue ∧
+      Ix.Compiler.Sim.ValRel ectx targetCtx sourceValue targetValue := by
+  obtain ⟨targetFuel, targetValue, htarget, hrel⟩ :=
+    Ix.Compiler.Sim.erasure_sim hstrict horacles hsource herases henv
+  exact ⟨targetValue,
+    projectionSafeErasureAt_all sourceFuel hstrict horacles hsource herases henv
+      htarget,
+    hrel⟩
+
+/-- Closed-term specialization of projection-safe erasure. -/
+theorem ProjectionSafeEval.of_erasure_closed
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx targetCtx none frame.refs
+      frame.selfMuts frame.selfAddr [] source target) :
+    ∃ targetValue,
+      ProjectionSafeEval targetCtx [] target targetValue ∧
+      Ix.Compiler.Sim.ValRel ectx targetCtx sourceValue targetValue :=
+  ProjectionSafeEval.of_erasure hstrict horacles hsource herases .nil
+
+/-- Sharing-aware projection-safe erasure. Evaluation is transported through
+the same semantic inlining theorem used by the erasure simulation before the
+share-free safety induction is applied. -/
+theorem ProjectionSafeEval.of_erasure_inlineSharing
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF sourceEnv)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing targetCtx self
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr mask
+      (Ixon.Sharing.inlineExpr frame.sharing source) target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx.inlineSharing targetCtx self
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing sourceEnv) targetEnv) :
+    ∃ targetValue,
+      ProjectionSafeEval targetCtx targetEnv target targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue := by
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx hframe henvWF hbelow
+    hsource
+  have hinlineEval : Ixon.Eval.eval ectx.inlineSharing sourceFuel
+      frame.inlineSharing (Ixon.Eval.valuesInlineSharing sourceEnv)
+      (Ixon.Sharing.inlineExpr frame.sharing source) =
+        .ok sourceValue.inlineSharing := by
+    simpa using hinlined.1
+  exact ProjectionSafeEval.of_erasure hstrict.inlineSharing horacles
+    hinlineEval herases henv
+
+/-- Closed-term sharing-aware specialization. -/
+theorem ProjectionSafeEval.of_erasure_inlineSharing_closed
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing targetCtx none
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr frame.sharing source) target) :
+    ∃ targetValue,
+      ProjectionSafeEval targetCtx [] target targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue := by
+  apply ProjectionSafeEval.of_erasure_inlineSharing hstrict horacles hctx
+    hframe .nil hbelow hsource herases
+  simpa [Ixon.Eval.valuesInlineSharing] using
+    (Ix.Compiler.Sim.EnvRel.nil (ectx := ectx.inlineSharing)
+      (ictx := targetCtx) (refs := frame.inlineSharing.refs)
+      (muts := frame.inlineSharing.selfMuts)
+      (sa := frame.inlineSharing.selfAddr))
+
+/-- The executable sharing-aware validator's closed certificate supplies the
+exact `PErase` witness required by projection-safe progress.  The conclusion
+is indexed by `cert.target`, so no separately reconstructed erased expression
+can be substituted at this boundary. -/
+theorem ProjectionSafeEval.of_certifiedSharedClosed
+    {sourceFuel eraseFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value} {targetCtx : IxIR0.Ctx}
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx targetCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue) :
+    ∃ targetValue,
+      ProjectionSafeEval targetCtx [] cert.target targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue := by
+  apply ProjectionSafeEval.of_erasure_inlineSharing_closed hstrict horacles
+    hctx hframe hbelow hsource
+  have hrelated := cert.related
+  rw [Ix.Compiler.EraseValidator.inlineTables_tablesOfFrame] at hrelated
+  exact hrelated
+
+/-! ### Call-aware certified erasure traces -/
+
+namespace CallAwareProjectionSafe
+
+/-- Successful proof-producing erasure returns the exact fuel-indexed trace
+used by callable progress, not only the shallow expression invariant. -/
+theorem of_erasure_with_members
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx targetCtx scope.plan)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask source target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask sourceEnv targetEnv) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval targetCtx targetFuel targetEnv target
+        targetValue ∧
+      Ix.Compiler.Sim.ValRel ectx targetCtx sourceValue targetValue :=
+  Ix.Compiler.Sim.erasure_sim_projectionSafe_with_members hmembers
+    horacles hsource herases henv
+
+/-- Empty-member-scope compatibility specialization of
+`CallAwareProjectionSafe.of_erasure_with_members`. -/
+theorem of_erasure
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx targetCtx)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask source target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx targetCtx self frame.refs
+      frame.selfMuts frame.selfAddr mask sourceEnv targetEnv) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval targetCtx targetFuel targetEnv target
+        targetValue ∧
+      Ix.Compiler.Sim.ValRel ectx targetCtx sourceValue targetValue :=
+  Ix.Compiler.Sim.erasure_sim_projectionSafe hstrict horacles hsource herases
+    henv
+
+/-- Sharing-aware call-aware erasure trace. -/
+theorem of_erasure_inlineSharing
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF sourceEnv)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing targetCtx self
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr mask
+      (Ixon.Sharing.inlineExpr frame.sharing source) target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx.inlineSharing targetCtx self
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing sourceEnv) targetEnv) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval targetCtx targetFuel targetEnv target
+        targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue :=
+  Ix.Compiler.Sim.erasure_sim_projectionSafe_inlineSharing
+    hstrict horacles hctx hframe henvWF hbelow hsource herases henv
+
+/-- Sharing-aware call-aware erasure under a simultaneous member certificate.
+Unlike the empty-scope compatibility theorem above, cyclic definition and
+recursor calls are discharged by `hmembers`. -/
+theorem of_erasure_inlineSharing_with_members
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {sourceFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {sourceEnv : List Ixon.Eval.Value}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {self : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {targetEnv : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetCtx : IxIR0.Ctx}
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing targetCtx
+      scope.plan)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF sourceEnv)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame sourceEnv source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing targetCtx self
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr mask
+      (Ixon.Sharing.inlineExpr frame.sharing source) target)
+    (henv : Ix.Compiler.Sim.EnvRel ectx.inlineSharing targetCtx self
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing sourceEnv) targetEnv) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval targetCtx targetFuel targetEnv target
+        targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue := by
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx hframe henvWF hbelow
+    hsource
+  simpa only [Ix.Compiler.Sim.InlinedValRel] using
+    (CallAwareProjectionSafe.of_erasure_with_members hmembers horacles
+      hinlined.1 herases henv)
+
+/-- The executable validator's exact erased target carries the full trace,
+including every dynamically entered closure and recursor-rule body. -/
+theorem of_certifiedSharedClosed
+    {sourceFuel eraseFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value} {targetCtx : IxIR0.Ctx}
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx targetCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval targetCtx targetFuel [] cert.target
+        targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue := by
+  apply Ix.Compiler.Sim.erasure_sim_projectionSafe_inlineSharing_closed
+    hstrict horacles hctx hframe hbelow hsource
+  have hrelated := cert.related
+  rw [Ix.Compiler.EraseValidator.inlineTables_tablesOfFrame] at hrelated
+  exact hrelated
+
+/-- Member-scoped analogue of `of_certifiedSharedClosed`.  The certificate
+and simultaneous member proof share the same scope, so recursive projection
+heads retain the full call-aware trace needed by lowering progress. -/
+theorem of_certifiedSharedClosed_with_members
+    [scope : Ix.Compiler.Sim.MemberScope]
+    {sourceFuel eraseFuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {frame : Ixon.Eval.Frame} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value} {targetCtx : IxIR0.Ctx}
+    (hmembers : Ix.Compiler.Sim.MemberCoverage ectx.inlineSharing targetCtx
+      scope.plan)
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx targetCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing targetCtx)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.ProjectionSafe.Eval targetCtx targetFuel [] cert.target
+        targetValue ∧
+      Ix.Compiler.Sim.InlinedValRel ectx targetCtx sourceValue targetValue := by
+  apply CallAwareProjectionSafe.of_erasure_inlineSharing_with_members
+    hmembers horacles hctx hframe .nil hbelow hsource
+  · have hrelated := cert.related
+    rw [Ix.Compiler.EraseValidator.inlineTables_tablesOfFrame] at hrelated
+    exact hrelated
+  · simpa [Ixon.Eval.valuesInlineSharing] using
+      (Ix.Compiler.Sim.EnvRel.nil (ectx := ectx.inlineSharing)
+        (ictx := targetCtx) (refs := frame.inlineSharing.refs)
+        (muts := frame.inlineSharing.selfMuts)
+        (sa := frame.inlineSharing.selfAddr))
+
+end CallAwareProjectionSafe
+
+/-! ## Recursive lowering progress interfaces -/
+
+def LowerEValueProgressesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+def LowerBorrowValueProgressesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+def LowerArgsValueProgressesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+def ApplyRestNonErasedValueProgressesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    SourceArgsEval sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueProgress funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueProgress funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+def LowerSpineValueProgressesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+/-- Strong expression progress restricted to executions carrying an explicit
+constructor-only projection trace. -/
+def LowerEValueProgressesSafelyWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    ProjectionSafeEval sourceCtx sourceEnv expr sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+def LowerBorrowValueProgressesSafelyWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal}
+      {release : Bool},
+    ProjectionSafeEval sourceCtx sourceEnv expr sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+def LowerArgsValueProgressesSafelyWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    ProjectionSafeArgs sourceCtx sourceEnv (args.map Prod.fst)
+      sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+def ApplyRestNonErasedValueProgressesSafelyWithin
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (cur : FnDef)
+    (src : IxIR0.Env) (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    ProjectionSafeArgs sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueProgress funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueProgress funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+def LowerSpineValueProgressesSafelyWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    ProjectionSafeSpine sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+/-! ### Exact-trace lowering interfaces
+
+These judgments retain the source evaluator's numeric fuel instead of
+collapsing it to `ProjectionSafeEval`.  `limit` is the outer strong-induction
+index used while sealing callable progress; every source execution consumed
+by the lowering is strictly below it. -/
+
+def LowerEValueTraceProgressesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceFuel : Nat} {sourceEnv : List IxIR0.Value}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    sourceFuel < limit →
+    IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input →
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+def LowerBorrowValueTraceProgressesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr} {sourceFuel : Nat}
+      {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal}
+      {release : Bool},
+    sourceFuel < limit →
+    IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceEnv expr
+      sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input →
+    LowerBorrowValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+def LowerArgsValueTraceProgressesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceLimit : Nat}
+      {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    sourceLimit < limit →
+    IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit sourceEnv
+      (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input →
+    LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+def ApplyRestNonErasedValueTraceProgressesWithinBelow
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv} {sourceLimit : Nat}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    sourceLimit < limit →
+    function ≠ .constA .erased →
+    IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit sourceMiddle args
+      sourceArgs →
+    SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction sourceArgs
+      sourceResult →
+    sourceArgs ≠ [] →
+    LowerResultValueProgress funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input →
+    LowerResultValueProgress funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+def LowerSpineValueTraceProgressesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {sourceLimit : Nat}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    sourceLimit < limit →
+    IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv head args
+      sourceResult →
+    (args ≠ [] ∨ ∃ address, head = .ref address) →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfTraceProgressAvailableBelow funRel recSelfRel sourceCtx ctx cur
+      limit input →
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+/-- Weaker recursive expression interface used by the generic memory-safety
+cluster. It differs from successful progress only in the emitted-prefix
+judgment; semantic partial correctness is retained unchanged. -/
+def LowerEValueSettlesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+def LowerBorrowValueSettlesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerBorrowValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+def LowerArgsValueSettlesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerArgsValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+def ApplyRestNonErasedValueSettlesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    SourceArgsEval sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueSettlement funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueSettlement funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+def LowerSpineValueSettlesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+theorem LowerEValueProgressesWithin.settles
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hprogress : LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel) :
+    LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src ambient
+      fuel := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av hsource hrun hextends havailable
+  exact (hprogress hsource hrun hextends havailable).settlement
+
+theorem LowerBorrowValueProgressesWithin.settles
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hprogress : LowerBorrowValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel) :
+    LowerBorrowValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient fuel := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun hextends havailable
+  exact (hprogress hsource hrun hextends havailable).settlement
+
+theorem LowerArgsValueProgressesWithin.settles
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hprogress : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel) :
+    LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient fuel := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun hextends havailable
+  exact (hprogress hsource hrun hextends havailable).settlement
+
+theorem LowerSpineValueProgressesWithin.settles
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hprogress : LowerSpineValueProgressesWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel) :
+    LowerSpineValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient fuel := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av hsource hrun hextends havailable
+  exact (hprogress hsource hrun hextends havailable).settlement
+
+theorem lowerEValueProgressesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av _ hrun _ _
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowValueProgressesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerBorrowValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release _ hrun _ _
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerSpineValueProgressesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpineValueProgressesWithin_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 1 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+theorem lowerArgsValueProgressesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    _ hrun _ _
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem applyRestNonErasedValueProgressesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    ApplyRestNonErasedValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun _ _
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction
+    function args hrun).elim
+
+/-- Reachable-state argument progress. The head's progressing emitter frames
+its result while the recursively progressing tail is compiled and executed. -/
+theorem lowerArgsValueProgressesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel)
+    (htail : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel) :
+    LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun hextends havailable
+  cases args with
+  | nil =>
+    cases hsource
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact lowerArgs_nil_value_progress
+  | cons arg args =>
+    rcases arg with ⟨expr, world⟩
+    change SourceArgsEval sourceCtx sourceEnv
+      (expr :: args.map Prod.fst) sourceValues at hsource
+    cases hsource with
+    | cons hsourceHead hsourceTail =>
+      simp only [lowerArgs] at hrun
+      obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+        trackedBindRun_ok_inv hrun
+      rcases headResult with ⟨middle, emitHead, av⟩
+      dsimp only at hafterHead
+      obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hafterHead
+      rcases tailResult with ⟨actualOutput, emitTail, tailAVals⟩
+      have hpure :
+          (actualOutput, emitHead ∘ emitTail, av :: tailAVals) =
+              (output, emit, avs) ∧ tailState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hmiddleExtends : ExtraExtends middleState ambient :=
+        (lowerArgs_extraExtends htailRun).trans hextends
+      have hheadProgress :=
+        hexpr hsourceHead hheadRun hmiddleExtends havailable
+      have htailProgress := htail hsourceTail htailRun hextends
+        (havailable.lowerE hheadRun)
+      exact hheadProgress.consArgs htailProgress
+
+/-- Complete borrowing-position progress step: variables use the direct
+borrow rules, while every other head delegates to predecessor expression
+progress and a pure descriptor adapter. -/
+theorem lowerBorrowValueProgressesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel) :
+    LowerBorrowValueProgressesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+    exact lowerBorrow_var_run_value_progress (sourceEval_var_inv hsource)
+      hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.ref address) hrun hextends
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.app function argument) hrun hextends
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.lam uses body) hrun hextends
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.letE uses value body) hrun hextends
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.proj index source) hrun hextends
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.lit literal) hrun hextends
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      .erased hrun hextends
+
+theorem lowerEValueProgressesSafelyWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerEValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient 0 := by
+  intro input output world expr sourceEnv sourceValue state finalState emit
+    av _ hrun _ _
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowValueProgressesSafelyWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerBorrowValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient 0 := by
+  intro input output expr sourceEnv sourceValue state finalState emit av
+    release _ hrun _ _
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerArgsValueProgressesSafelyWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient 0 := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    _ hrun _ _
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem lowerSpineValueProgressesSafelyWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpineValueProgressesSafelyWithin_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient 1 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+theorem applyRestNonErasedValueProgressesSafelyWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun _ _
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction
+    function args hrun).elim
+
+/-- Projection-safe left-to-right argument progress. -/
+theorem lowerArgsValueProgressesSafelyWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesSafelyWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel)
+    (htail : LowerArgsValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel) :
+    LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun hextends havailable
+  cases args with
+  | nil =>
+    cases hsource
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact lowerArgs_nil_value_progress
+  | cons arg args =>
+    rcases arg with ⟨expr, world⟩
+    change ProjectionSafeArgs sourceCtx sourceEnv
+      (expr :: args.map Prod.fst) sourceValues at hsource
+    cases hsource with
+    | cons hsourceHead hsourceTail =>
+      simp only [lowerArgs] at hrun
+      obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+        trackedBindRun_ok_inv hrun
+      rcases headResult with ⟨middle, emitHead, av⟩
+      dsimp only at hafterHead
+      obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hafterHead
+      rcases tailResult with ⟨actualOutput, emitTail, tailAVals⟩
+      have hpure :
+          (actualOutput, emitHead ∘ emitTail, av :: tailAVals) =
+              (output, emit, avs) ∧ tailState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hmiddleExtends : ExtraExtends middleState ambient :=
+        (lowerArgs_extraExtends htailRun).trans hextends
+      have hheadProgress :=
+        hexpr hsourceHead hheadRun hmiddleExtends havailable
+      have htailProgress := htail hsourceTail htailRun hextends
+        (havailable.lowerE hheadRun)
+      exact hheadProgress.consArgs htailProgress
+
+/-- Projection-safe borrowing-position progress. -/
+theorem lowerBorrowValueProgressesSafelyWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesSafelyWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel) :
+    LowerBorrowValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceValue state finalState emit av
+    release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+    cases hsource with
+    | var hlookup => exact lowerBorrow_var_run_value_progress hlookup hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.ref address) hrun hextends
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.app function argument) hrun hextends
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.lam uses body) hrun hextends
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.letE uses value body) hrun hextends
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.proj index source) hrun hextends
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.lit literal) hrun hextends
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      .erased hrun hextends
+
+theorem lowerEValueTraceProgressesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerEValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient 0 := by
+  intro input output world expr sourceFuel sourceEnv sourceValue state
+    finalState emit av _ _ hrun _ _
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowValueTraceProgressesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerBorrowValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient 0 := by
+  intro input output expr sourceFuel sourceEnv sourceValue state finalState
+    emit av release _ _ hrun _ _
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerArgsValueTraceProgressesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient 0 := by
+  intro input output sourceLimit sourceEnv sourceValues args state
+    finalState emit avs _ _ hrun _ _
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem lowerSpineValueTraceProgressesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient 0 := by
+  intro input output world sourceLimit head args sourceEnv sourceResult state
+    finalState emit av _ _ _ hrun _ _
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpineValueTraceProgressesWithinBelow_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient 1 := by
+  intro input output world sourceLimit head args sourceEnv sourceResult state
+    finalState emit av _ _ _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+theorem applyRestNonErasedValueTraceProgressesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    ApplyRestNonErasedValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient 0 := by
+  intro start input output sourceLimit sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ _ _ hrun _ _
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction
+    function args hrun).elim
+
+/-- Exact-trace left-to-right argument progress.  Each element's evaluator
+fuel is strictly below the list's common bound and hence below the outer
+callable-sealing index. -/
+theorem lowerArgsValueTraceProgressesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (htail : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel) :
+    LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1) := by
+  intro input output sourceLimit sourceEnv sourceValues args state finalState
+    emit avs hlimit hsource hrun hextends havailable
+  cases args with
+  | nil =>
+    cases hsource
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact lowerArgs_nil_value_progress
+  | cons arg args =>
+    rcases arg with ⟨expr, world⟩
+    change IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit sourceEnv
+      (expr :: args.map Prod.fst) sourceValues at hsource
+    cases hsource with
+    | cons hheadFuel hsourceHead hsourceTail =>
+      simp only [lowerArgs] at hrun
+      obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+        trackedBindRun_ok_inv hrun
+      rcases headResult with ⟨middle, emitHead, av⟩
+      dsimp only at hafterHead
+      obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hafterHead
+      rcases tailResult with ⟨actualOutput, emitTail, tailAVals⟩
+      have hpure :
+          (actualOutput, emitHead ∘ emitTail, av :: tailAVals) =
+              (output, emit, avs) ∧ tailState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hmiddleExtends : ExtraExtends middleState ambient :=
+        (lowerArgs_extraExtends htailRun).trans hextends
+      have hheadProgress :=
+        hexpr (Nat.lt_trans hheadFuel hlimit) hsourceHead hheadRun
+          hmiddleExtends havailable
+      have htailProgress := htail hlimit hsourceTail htailRun hextends
+        (havailable.lowerE hheadRun)
+      exact hheadProgress.consArgs htailProgress
+
+/-- Exact-trace borrowing-position progress. -/
+theorem lowerBorrowValueTraceProgressesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel) :
+    LowerBorrowValueTraceProgressesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient (fuel + 1) := by
+  intro input output expr sourceFuel sourceEnv sourceValue state finalState
+    emit av release hlimit hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+    cases hsource with
+    | var hlookup => exact lowerBorrow_var_run_value_progress hlookup hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      (.ref address) hrun hextends
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      (.app function argument) hrun hextends
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      (.lam uses body) hrun hextends
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      (.letE uses value body) hrun hextends
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      (.proj index source) hrun hextends
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      (.lit literal) hrun hextends
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_progress_within
+      (fun hsubrun hwithin =>
+        hexpr hlimit hsource hsubrun hwithin havailable)
+      .erased hrun hextends
+
+theorem lowerEValueSettlesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src ambient
+      0 :=
+  lowerEValueProgressesWithin_zero.settles
+
+theorem lowerBorrowValueSettlesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerBorrowValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 :=
+  lowerBorrowValueProgressesWithin_zero.settles
+
+theorem lowerArgsValueSettlesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 :=
+  lowerArgsValueProgressesWithin_zero.settles
+
+theorem lowerSpineValueSettlesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 :=
+  lowerSpineValueProgressesWithin_zero.settles
+
+theorem lowerSpineValueSettlesWithin_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 1 :=
+  lowerSpineValueProgressesWithin_one.settles
+
+theorem applyRestNonErasedValueSettlesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    ApplyRestNonErasedValueSettlesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun _ _
+  exact (applyRest_noSuccess_zero src input resultWorld emitFunction
+    function args hrun).elim
+
+/-- Left-to-right argument settlement propagates a terminal head without
+requiring the tail, and otherwise continues through the protected head root. -/
+theorem lowerArgsValueSettlesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel)
+    (htail : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel) :
+    LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun hextends havailable
+  cases args with
+  | nil =>
+    cases hsource
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact lowerArgs_nil_value_progress.settlement
+  | cons arg args =>
+    rcases arg with ⟨expr, world⟩
+    change SourceArgsEval sourceCtx sourceEnv
+      (expr :: args.map Prod.fst) sourceValues at hsource
+    cases hsource with
+    | cons hsourceHead hsourceTail =>
+      simp only [lowerArgs] at hrun
+      obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+        trackedBindRun_ok_inv hrun
+      rcases headResult with ⟨middle, emitHead, av⟩
+      dsimp only at hafterHead
+      obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hafterHead
+      rcases tailResult with ⟨actualOutput, emitTail, tailAVals⟩
+      have hpure :
+          (actualOutput, emitHead ∘ emitTail, av :: tailAVals) =
+              (output, emit, avs) ∧ tailState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hmiddleExtends : ExtraExtends middleState ambient :=
+        (lowerArgs_extraExtends htailRun).trans hextends
+      have hheadSettles :=
+        hexpr hsourceHead hheadRun hmiddleExtends havailable
+      have htailSettles := htail hsourceTail htailRun hextends
+        (havailable.lowerE hheadRun)
+      exact hheadSettles.consArgs htailSettles
+
+/-- Borrow settlement closes recursively even when predecessor expression
+lowering may stop before producing a descriptor. -/
+theorem lowerBorrowValueSettlesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel) :
+    LowerBorrowValueSettlesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+    exact (lowerBorrow_var_run_value_progress
+      (sourceEval_var_inv hsource) hrun).settlement
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.ref address) hrun hextends
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.app function argument) hrun hextends
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.lam uses body) hrun hextends
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.letE uses value body) hrun hextends
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.proj index source) hrun hextends
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      (.lit literal) hrun hextends
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_settlement_within
+      (fun hsubrun hwithin =>
+        hexpr hsource hsubrun hwithin havailable)
+      .erased hrun hextends
+
+/-- Source-guided function-body progress constructs a successful `invoke`;
+the established ownership and value contracts recover all three post-state
+invariants and discharge `checkResultWorld`. -/
+theorem invoke_fn_value_trace_progress_at
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {address : Ixon.Address} {d : FnDef}
+    {argWorlds : List Owned} {sourceFunction : IxIR0.Value}
+    {store : Store} {args : List RVal}
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hdecl : ctx.decls address = some (.fn d))
+    (harity : argWorlds.length = d.arity)
+    (hprogress : FnValueTraceProgressesAt funRel sourceCtx ctx d
+      argWorlds sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      invoke ctx fuel address args store = .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  obtain ⟨bodyFuel, store', value, hbody⟩ :=
+    hprogress hlength hargs hsource hframe hown
+  have hown' : RootOwnership store' (⟨d.result, value⟩ :: rest) :=
+    hownership.preserves hlength hown hbody
+  have hsemantic := hvalue.preserves hlength hargs hsource.sourceApplies
+    hframe hown hbody
+  have hworld : HasWorld store' d.result value :=
+    hown'.roots_world ⟨d.result, value⟩ (by simp)
+  have hcheck : checkResultWorld d.result (store', value) =
+      .ok (store', value) := by
+    simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+  have htargetArity : args.length = d.arity := hlength.trans harity
+  have hinvoke : invoke ctx (bodyFuel + 1) address args store =
+      .ok (store', value) := by
+    rw [invoke.eq_def]
+    dsimp only
+    rw [hdecl]
+    dsimp only
+    simp only [htargetArity]
+    simp
+    rw [hbody, bindOk]
+    exact hcheck
+  exact ⟨bodyFuel + 1, store', value, hinvoke,
+    hsemantic.1, hsemantic.2, hown'⟩
+
+/-- Pointwise wrapper around `invoke_fn_value_trace_progress_at`.  Keeping
+the exact-bound lemma separate is what lets the whole-pass seal consume a
+`CompilerTraceProgressContractsBelow` package during strong source-fuel
+induction. -/
+theorem invoke_fn_value_trace_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {address : Ixon.Address} {d : FnDef}
+    {argWorlds : List Owned} {sourceFunction : IxIR0.Value}
+    {store : Store} {args : List RVal}
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnValueTraceProgressContract funRel sourceCtx ctx d
+      argWorlds sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      invoke ctx fuel address args store = .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  exact invoke_fn_value_trace_progress_at hdecl hprogress.arity_eq
+    (hprogress.progresses sourceLimit) hownership hvalue hlength hargs
+    hsource hframe hown
+
+/-- Legacy fuel-free callable adapter.  New sealed progress uses
+`invoke_fn_value_trace_progress`; this theorem remains for callers that
+explicitly provide the stronger monolithic contract. -/
+theorem invoke_fn_value_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {address : Ixon.Address} {d : FnDef} {argWorlds : List Owned}
+    {sourceFunction : IxIR0.Value} {store : Store} {args : List RVal}
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      invoke ctx fuel address args store = .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  obtain ⟨bodyFuel, store', value, hbody⟩ :=
+    hprogress.progresses hlength hargs hsource hframe hown
+  have hown' : RootOwnership store' (⟨d.result, value⟩ :: rest) :=
+    hownership.preserves hlength hown hbody
+  have hsemantic := hvalue.preserves hlength hargs hsource hframe hown hbody
+  have hworld : HasWorld store' d.result value :=
+    hown'.roots_world ⟨d.result, value⟩ (by simp)
+  have hcheck : checkResultWorld d.result (store', value) =
+      .ok (store', value) := by
+    simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+  have harity : args.length = d.arity :=
+    hlength.trans hprogress.arity_eq
+  have hinvoke : invoke ctx (bodyFuel + 1) address args store =
+      .ok (store', value) := by
+    rw [invoke.eq_def]
+    dsimp only
+    rw [hdecl]
+    dsimp only
+    simp only [harity]
+    simp
+    rw [hbody, bindOk]
+    exact hcheck
+  exact ⟨bodyFuel + 1, store', value, hinvoke,
+    hsemantic.1, hsemantic.2, hown'⟩
+
+/-- Source-guided higher-order progress, bundled with the semantic and
+ownership postconditions supplied by the existing partial contracts. -/
+theorem apply_value_trace_progress_at
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {store : Store} {function : RVal}
+    {args : List RVal} {sourceFunction : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hprogress : ApplyValueTraceProgressesAt funRel sourceCtx ctx sourceLimit)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hfunction : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hsourceArgsNonempty : sourceArgs ≠ [])
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ fuel store' value,
+      applyGo ctx fuel store function args = .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨fuel, store', value, hrun⟩ :=
+    hprogress hfunction hargs hsource hsourceArgsNonempty hframe hown
+  have hsemantic := hvalue.preserves hfunction hargs hsource.sourceApplies
+    hframe hown hrun
+  exact ⟨fuel, store', value, hrun, hsemantic.1, hsemantic.2,
+    hownership.preserves hown hrun⟩
+
+theorem apply_value_trace_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {store : Store} {function : RVal}
+    {args : List RVal} {sourceFunction : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hprogress : ApplyValueTraceProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hfunction : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hsourceArgsNonempty : sourceArgs ≠ [])
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ fuel store' value,
+      applyGo ctx fuel store function args = .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  exact apply_value_trace_progress_at
+    (hprogress.progresses sourceLimit) hownership hvalue hfunction hargs
+    hsource hsourceArgsNonempty hframe hown
+
+/-- Retaining a finite vector of live shared values cannot fail.  This is
+the fuel-free first half of `applyGo`'s PAP-consumption prefix. -/
+theorem dupVals_progress_of_hasWorld
+    {store : Store} {values : List RVal}
+    (hworld : ∀ value ∈ values, HasWorld store .shared value) :
+    ∃ store', dupVals store values = .ok store' := by
+  induction values generalizing store with
+  | nil => exact ⟨store, rfl⟩
+  | cons head tail ih =>
+      have htailWorld : ∀ value ∈ tail, HasWorld store .shared value := by
+        intro value hvalue
+        exact hworld value (by simp [hvalue])
+      cases head with
+      | lit literal =>
+          obtain ⟨store', htail⟩ := ih htailWorld
+          refine ⟨store', ?_⟩
+          unfold dupVals at htail ⊢
+          simp only [List.foldlM_cons]
+          simpa only [bindOk] using htail
+      | erased =>
+          obtain ⟨store', htail⟩ := ih htailWorld
+          refine ⟨store', ?_⟩
+          unfold dupVals at htail ⊢
+          simp only [List.foldlM_cons]
+          simpa only [bindOk] using htail
+      | loc loc =>
+          obtain ⟨box, hget, hboxWorld⟩ := hworld (.loc loc) (by simp)
+          cases box with
+          | mk world rc node =>
+              change world = .shared at hboxWorld
+              subst world
+              let middle := incRcStore store loc ⟨.shared, rc, node⟩
+              have htailWorld' : ∀ value ∈ tail,
+                  HasWorld middle .shared value := by
+                intro value hvalue
+                exact HasWorld.incRcStore hget (htailWorld value hvalue)
+              obtain ⟨store', htail⟩ := ih htailWorld'
+              refine ⟨store', ?_⟩
+              unfold dupVals at htail ⊢
+              simp only [List.foldlM_cons]
+              rw [hget]
+              dsimp only
+              simpa only [middle, incRcStore, bindOk] using htail
+
+/-- Construct the complete PAP preparation prefix: duplicate every stored
+capture, release the consumed PAP root with sufficient fuel, and retain all
+source graphs and the exact post-prefix ownership partition. -/
+theorem applyGo_preparePap_valueGraphs_progress
+    {funRel : Sim.FunctionRel} {ctx : Ctx}
+    {store : Store} {loc rc : Nat}
+    {address : Ixon.Address} {arity : Nat} {got : Array RVal}
+    {args : List RVal} {captures sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hget : store.get? loc = some
+      ⟨.shared, rc, .papN address arity got⟩)
+    (hcaptures : Sim.ValuesGraph funRel store captures got.toList)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, .loc loc⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ dropFuel dupStore readyStore,
+      dupVals store got.toList = .ok dupStore ∧
+      dropVal ctx dropFuel dupStore (.loc loc) = .ok readyStore ∧
+      Sim.ValuesGraph funRel readyStore captures got.toList ∧
+      Sim.ValuesGraph funRel readyStore sourceArgs args ∧
+      Sim.RootsGraph funRel readyStore sourceRest rest ∧
+      RootOwnership readyStore
+        (rootsFor .shared (got.toList ++ args) ++ rest) := by
+  have hgotWorld : ∀ value ∈ got.toList,
+      HasWorld store .shared value := by
+    intro value hvalue
+    exact hown.edges_world hget value (by
+      simpa [nodeChildren] using hvalue)
+  obtain ⟨dupStore, hdup⟩ := dupVals_progress_of_hasWorld hgotWorld
+  have hduped : RootOwnership dupStore
+      (rootsFor .shared got.toList ++
+        ⟨.shared, .loc loc⟩ :: rootsFor .shared args ++ rest) := by
+    simpa [List.append_assoc] using
+      dupVals_borrowedMany_preserves hown hgotWorld hdup
+  have hpapFirst : RootOwnership dupStore
+      (⟨.shared, .loc loc⟩ ::
+        rootsFor .shared got.toList ++ rootsFor .shared args ++ rest) := by
+    apply hduped.perm
+    simpa [List.append_assoc] using
+      (List.perm_append_comm
+        (l₁ := rootsFor .shared got.toList)
+        (l₂ := [(⟨.shared, .loc loc⟩ : Root)])).append_right
+          (rootsFor .shared args ++ rest)
+  obtain ⟨dropFuel, readyStore, hdrop, _⟩ :=
+    dropVal_progress (ctx := ctx) hpapFirst
+  obtain ⟨hcapturesReady, hargsReady, hframeReady, hready⟩ :=
+    applyGo_preparePap_valueGraphs hget hcaptures hargs hframe hown
+      hdup hdrop
+  exact ⟨dropFuel, dupStore, readyStore, hdup, hdrop,
+    hcapturesReady, hargsReady, hframeReady, hready⟩
+
+theorem apply_value_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {store : Store} {function : RVal} {args : List RVal}
+    {sourceFunction : IxIR0.Value} {sourceArgs : List IxIR0.Value}
+    {sourceResult : IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hfunction : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ fuel store' value,
+      applyGo ctx fuel store function args = .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨fuel, store', value, hrun⟩ :=
+    hprogress.progresses hfunction hargs hsource hframe hown
+  have hsemantic := hvalue.preserves hfunction hargs hsource hframe hown hrun
+  exact ⟨fuel, store', value, hrun, hsemantic.1, hsemantic.2,
+    hownership.preserves hown hrun⟩
+
+/-! ## Source-guided operation progress -/
+
+/-- A source-backed direct call has a successful target operation run and
+establishes the same semantic frame and exact ownership postconditions used
+by the partial-correctness lowering proof. -/
+theorem runOp_call_value_trace_progress_at
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur d : FnDef} {address : Ixon.Address}
+    {atoms : Array Atom} {store : Store} {env : List RVal}
+    {args : List RVal} {argWorlds : List Owned}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls address = some (.fn d))
+    (harity : argWorlds.length = d.arity)
+    (hprogress : FnValueTraceProgressesAt funRel sourceCtx ctx d
+      argWorlds sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.call address atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  obtain ⟨invokeFuel, store', value, hinvoke, hresult, hframe', hown'⟩ :=
+    invoke_fn_value_trace_progress_at hdecl harity hprogress hownership
+      hvalue hlength hargs hsource hframe hown
+  refine ⟨invokeFuel + 1, store', value, ?_, hresult, hframe', hown'⟩
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hatoms, bindOk]
+  exact hinvoke
+
+theorem runOp_call_value_trace_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur d : FnDef} {address : Ixon.Address}
+    {atoms : Array Atom} {store : Store} {env : List RVal}
+    {args : List RVal} {argWorlds : List Owned}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnValueTraceProgressContract funRel sourceCtx ctx d
+      argWorlds sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.call address atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  exact runOp_call_value_trace_progress_at hatoms hdecl
+    hprogress.arity_eq (hprogress.progresses sourceLimit) hownership hvalue
+    hlength hargs hsource hframe hown
+
+theorem runOp_call_value_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {cur d : FnDef} {address : Ixon.Address} {atoms : Array Atom}
+    {store : Store} {env : List RVal} {args : List RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.call address atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  obtain ⟨invokeFuel, store', value, hinvoke, hresult, hframe', hown'⟩ :=
+    invoke_fn_value_progress hdecl hprogress hownership hvalue hlength
+      hargs hsource hframe hown
+  have hrun : runOp ctx (invokeFuel + 1) cur store env
+      (.call address atoms) = .ok (store', value) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hatoms, bindOk]
+    exact hinvoke
+  exact ⟨invokeFuel + 1, store', value, hrun, hresult, hframe', hown'⟩
+
+/-- Source-guided recursive-self progress.  Unlike `FnProgressContract`, the
+body need only terminate for the particular source argument spine at hand. -/
+theorem runOp_callSelf_value_trace_progress_at
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur : FnDef} {atoms : Array Atom}
+    {store : Store} {env : List RVal} {args : List RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (harity : argWorlds.length = cur.arity)
+    (hprogress : FnValueTraceProgressesAt funRel sourceCtx ctx cur
+      argWorlds sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx cur argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.callSelf atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  obtain ⟨bodyFuel, store', value, hbody⟩ :=
+    hprogress hlength hargs hsource hframe hown
+  have hown' : RootOwnership store' (⟨cur.result, value⟩ :: rest) :=
+    hownership.preserves hlength hown hbody
+  have hsemantic := hvalue.preserves hlength hargs hsource.sourceApplies
+    hframe hown hbody
+  have hworld : HasWorld store' cur.result value :=
+    hown'.roots_world ⟨cur.result, value⟩ (by simp)
+  have hcheck : checkResultWorld cur.result (store', value) =
+      .ok (store', value) := by
+    simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+  have htargetArity : args.length = cur.arity := hlength.trans harity
+  refine ⟨bodyFuel + 1, store', value, ?_, hsemantic.1,
+    hsemantic.2, hown'⟩
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hatoms, bindOk]
+  simp only [htargetArity]
+  simp
+  rw [hbody, bindOk]
+  exact hcheck
+
+theorem runOp_callSelf_value_trace_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur : FnDef} {atoms : Array Atom}
+    {store : Store} {env : List RVal} {args : List RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : FnValueTraceProgressContract funRel sourceCtx ctx cur
+      argWorlds sourceFunction)
+    (hownership : FnOwnershipContract ctx cur argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.callSelf atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  exact runOp_callSelf_value_trace_progress_at hatoms hprogress.arity_eq
+    (hprogress.progresses sourceLimit) hownership hvalue hlength hargs
+    hsource hframe hown
+
+theorem runOp_callSelf_value_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {cur : FnDef} {atoms : Array Atom} {store : Store}
+    {env : List RVal} {args : List RVal} {argWorlds : List Owned}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx cur argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hlength : args.length = argWorlds.length)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.callSelf atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  obtain ⟨bodyFuel, store', value, hbody⟩ :=
+    hprogress.progresses hlength hargs hsource hframe hown
+  have hown' : RootOwnership store'
+      (⟨cur.result, value⟩ :: rest) :=
+    hownership.preserves hlength hown hbody
+  have hsemantic :=
+    hvalue.preserves hlength hargs hsource hframe hown hbody
+  have hworld : HasWorld store' cur.result value :=
+    hown'.roots_world ⟨cur.result, value⟩ (by simp)
+  have hcheck : checkResultWorld cur.result (store', value) =
+      .ok (store', value) := by
+    simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+  have harity : args.length = cur.arity :=
+    hlength.trans hprogress.arity_eq
+  have hrun : runOp ctx (bodyFuel + 1) cur store env
+      (.callSelf atoms) = .ok (store', value) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hatoms, bindOk]
+    simp only [harity]
+    simp
+    rw [hbody, bindOk]
+    exact hcheck
+  exact ⟨bodyFuel + 1, store', value, hrun, hsemantic.1,
+    hsemantic.2, hown'⟩
+
+/-- Source-guided higher-order application progress at the operation level. -/
+theorem runOp_apply_value_trace_progress_at
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur : FnDef} {store : Store}
+    {env : List RVal} {functionAtom : Atom} {function : RVal}
+    {atoms : Array Atom} {args : List RVal}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : ApplyValueTraceProgressesAt funRel sourceCtx ctx sourceLimit)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hfunctionGraph : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hsourceArgsNonempty : sourceArgs ≠ [])
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.apply functionAtom atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨applyFuel, store', value, happly, hresult, hframe', hown'⟩ :=
+    apply_value_trace_progress_at hprogress hownership hvalue hfunctionGraph
+      hargs hsource hsourceArgsNonempty hframe hown
+  refine ⟨applyFuel + 1, store', value, ?_, hresult, hframe', hown'⟩
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hfunction, bindOk, hatoms, bindOk]
+  exact happly
+
+theorem runOp_apply_value_trace_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur : FnDef} {store : Store}
+    {env : List RVal} {functionAtom : Atom} {function : RVal}
+    {atoms : Array Atom} {args : List RVal}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : ApplyValueTraceProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hfunctionGraph : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hsourceArgsNonempty : sourceArgs ≠ [])
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.apply functionAtom atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  exact runOp_apply_value_trace_progress_at hfunction hatoms
+    (hprogress.progresses sourceLimit) hownership hvalue hfunctionGraph
+    hargs hsource hsourceArgsNonempty hframe hown
+
+theorem runOp_apply_value_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {cur : FnDef} {store : Store} {env : List RVal}
+    {functionAtom : Atom} {function : RVal} {atoms : Array Atom}
+    {args : List RVal} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hfunctionGraph : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.apply functionAtom atoms) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨applyFuel, store', value, happly, hresult, hframe', hown'⟩ :=
+    apply_value_progress hprogress hownership hvalue hfunctionGraph hargs
+      hsource hframe hown
+  have hrun : runOp ctx (applyFuel + 1) cur store env
+      (.apply functionAtom atoms) = .ok (store', value) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hfunction, bindOk, hatoms, bindOk]
+    exact happly
+  exact ⟨applyFuel + 1, store', value, hrun, hresult, hframe', hown'⟩
+
+/-- A source-backed extern call progresses when its explicit target-oracle
+totality contract supplies a result. -/
+theorem runOp_extern_value_trace_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} {cur : FnDef} {store : Store}
+    {env : List RVal} {address : Ixon.Address} {atoms : Array Atom}
+    {args : List RVal} {arity : Nat} {resultWorld : Owned}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : ExternTraceProgressContract funRel sourceCtx ctx)
+    (hvalue : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env address = some (.extern arity))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hown : RootOwnership store (rootsFor .shared args ++ rest)) :
+    ∃ fuel result,
+      runOp ctx fuel cur store env (.extern address atoms) =
+          .ok (store, result) ∧
+      Sim.ValueGraph funRel store sourceResult result ∧
+      RootOwnership store (⟨resultWorld, result⟩ :: rest) := by
+  obtain ⟨result, horacle⟩ :=
+    hprogress.progresses hlookup href hlength hsource hargs
+  have hrun : runOp ctx 1 cur store env (.extern address atoms) =
+      .ok (store, result) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hatoms, bindOk, horacle, bindOk]
+  have hresultGraph : Sim.ValueGraph funRel store sourceResult result :=
+    hvalue.preserves hlookup href hlength hsource.sourceApplies hargs horacle
+  have hown' : RootOwnership store
+      (⟨resultWorld, result⟩ :: rest) :=
+    runOp_extern_owned (ctx := ctx) (cur := cur) (fuel := 0)
+      hatoms hown hrun
+  exact ⟨1, result, hrun, hresultGraph, hown'⟩
+
+theorem runOp_extern_value_progress
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {cur : FnDef} {store : Store} {env : List RVal}
+    {address : Ixon.Address} {atoms : Array Atom} {args : List RVal}
+    {arity : Nat} {resultWorld : Owned}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hprogress : ExternProgressContract funRel sourceCtx ctx)
+    (hvalue : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env address = some (.extern arity))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hown : RootOwnership store (rootsFor .shared args ++ rest)) :
+    ∃ fuel result,
+      runOp ctx fuel cur store env (.extern address atoms) =
+          .ok (store, result) ∧
+      Sim.ValueGraph funRel store sourceResult result ∧
+      RootOwnership store (⟨resultWorld, result⟩ :: rest) := by
+  obtain ⟨result, horacle⟩ :=
+    hprogress.progresses hlookup href hlength hsource hargs
+  have hrun : runOp ctx 1 cur store env (.extern address atoms) =
+      .ok (store, result) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hatoms, bindOk, horacle, bindOk]
+  have hresultGraph : Sim.ValueGraph funRel store sourceResult result :=
+    hvalue.preserves hlookup href hlength hsource hargs horacle
+  have hown' : RootOwnership store
+      (⟨resultWorld, result⟩ :: rest) :=
+    runOp_extern_owned (ctx := ctx) (cur := cur) (fuel := 0)
+      hatoms hown hrun
+  exact ⟨1, result, hrun, hresultGraph, hown'⟩
+
+/-! ## Source-guided lowering consumers -/
+
+/-- Consume a progressing semantic argument vector through a source-backed
+direct call.  The callee's preserved root graph reconstructs the caller's
+logical environment after the store-changing operation. -/
+theorem LowerArgsValueProgress.call_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    {address : Ixon.Address}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d worlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp
+        (.call address (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.call_graph hdecl hownership hvalue
+          hsource
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  have hlength : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+      hownAfter⟩ :=
+    runOp_call_value_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      havs.resolveAtoms hdecl hprogress hownership hvalue hlength
+      hvalueGraphs hsource hcombinedFrame hownCall
+  obtain ⟨henvAfter, hrestAfter⟩ :=
+    hcombinedAfter.splitAppend henvFrame.lengths
+  have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+      output sourceOutput env envRoots :=
+    houtput.ofRootsGraph henvAfter
+  refine ⟨fuel, store', result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+    hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self counterpart of `LowerArgsValueProgress.call_graph`. -/
+theorem LowerArgsValueProgress.callSelf_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx cur worlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds
+      sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_graph hownership hvalue hsource
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  have hlength : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+      hownAfter⟩ :=
+    runOp_callSelf_value_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      havs.resolveAtoms hprogress hownership hvalue hlength hvalueGraphs
+      hsource hcombinedFrame hownCall
+  obtain ⟨henvAfter, hrestAfter⟩ :=
+    hcombinedAfter.splitAppend henvFrame.lengths
+  have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+      output sourceOutput env envRoots :=
+    houtput.ofRootsGraph henvAfter
+  refine ⟨fuel, store', result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+    hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self progress where the source function identity is recovered
+from the synthetic input entry. -/
+theorem LowerArgsValueProgress.callSelf_entry_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hprogress : recSelfRel sourceFunction arity →
+      FnValueProgressContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_entry_graph hentry hhead
+          hownership hvalue hsource
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.of_pointwise
+  intro store env hpre
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨source, hsourceLookup, hself⟩ := hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  have hsound := hargs.callSelf_graph (hprogress hself) hownership
+    (hvalue hself) hsource
+  exact ⟨_, ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩,
+    hsound.graphProgress sourceRest rest slots⟩
+
+/-- Recursive-self call progress from the whole current-function contract.
+The advertised marker arity is checked semantically: a realizable marker
+supplies a progress contract whose arity equation rules out the target's
+stuck arity branch. -/
+theorem LowerArgsValueProgress.callSelf_current_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate arity .shared) emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx
+      cur)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult)
+    (havsLength : avs.length = arity) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  by_cases harity : arity = cur.arity
+  · have hprogress : recSelfRel sourceFunction arity →
+        FnValueProgressContract funRel sourceCtx ctx cur
+          (List.replicate arity .shared) sourceFunction := by
+      intro hrel
+      exact hself.progress hrel
+    have hownership : FnOwnershipContract ctx cur
+        (List.replicate arity .shared) := by
+      simpa [harity] using hself.ownership
+    have hvalue : recSelfRel sourceFunction arity →
+        FnValueContract funRel sourceCtx ctx cur
+          (List.replicate arity .shared) sourceFunction := by
+      intro hrel
+      simpa [harity] using hself.value (by simpa [harity] using hrel)
+    exact hargs.callSelf_entry_graph hentry hhead hprogress hownership
+      hvalue hsource
+  · refine
+      { toLowerResultValueSound :=
+          hargs.toLowerArgsValueSound.callSelf_arity_mismatch_graph
+            (fun heq => harity (havsLength.symm.trans heq))
+        graphProgress := ?_ }
+    intro sourceRest rest slots
+    apply EmitProgress.of_pointwise
+    intro store env hpre
+    obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+    obtain ⟨source, hsourceLookup, hrel⟩ := hinput.getRecSelf hentry
+    have hsourceEq : source = sourceFunction := by
+      rw [hhead] at hsourceLookup
+      exact (Option.some.inj hsourceLookup).symm
+    subst source
+    have hcontract := hself.progress hrel
+    have heq : arity = cur.arity := by
+      simpa using hcontract.arity_eq
+    exact (harity heq).elim
+
+/-- Consume a progressing homogeneous shared argument prefix through the
+scalar extern ABI.  The explicit progress contract supplies oracle
+definedness; the value contract supplies source-result correspondence. -/
+theorem LowerArgsValueProgress.extern_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {address : Ixon.Address}
+    {arity : Nat} {resultWorld : Owned}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hprogress : ExternProgressContract funRel sourceCtx ctx)
+    (hvalue : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env address = some (.extern arity))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp
+        (.extern address (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.extern_graph hvalue hlookup href hlength
+          hsource
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hownExtern : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨fuel, result, hrun, hresultGraph, hownAfter⟩ :=
+    runOp_extern_value_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      (resultWorld := resultWorld) havs.resolveAtoms hprogress hvalue
+      hlookup href hlength hsource hvalueGraphs hownExtern
+  refine ⟨fuel, store, result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtput.bump result, ?_,
+    hresultGraph, hrestGraph, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Direct-call graph progress at one exact source-spine bound. -/
+theorem LowerArgsValueProgress.call_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {sourceLimit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    {address : Ixon.Address}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hdecl : ctx.decls address = some (.fn d))
+    (harity : worlds.length = d.arity)
+    (hprogress : FnValueTraceProgressesAt funRel sourceCtx ctx d worlds
+      sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp
+        (.call address (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.call_graph hdecl hownership hvalue
+          hsource.sourceApplies
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  have hlength : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+      hownAfter⟩ :=
+    runOp_call_value_trace_progress_at
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      havs.resolveAtoms hdecl harity hprogress hownership hvalue hlength
+      hvalueGraphs hsource hcombinedFrame hownCall
+  obtain ⟨henvAfter, hrestAfter⟩ :=
+    hcombinedAfter.splitAppend henvFrame.lengths
+  have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+      output sourceOutput env envRoots :=
+    houtput.ofRootsGraph henvAfter
+  refine ⟨fuel, store', result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+    hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self graph progress at one exact source-spine bound. -/
+theorem LowerArgsValueProgress.callSelf_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceLimit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (harity : worlds.length = cur.arity)
+    (hprogress : FnValueTraceProgressesAt funRel sourceCtx ctx cur worlds
+      sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds
+      sourceFunction)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_graph hownership hvalue
+          hsource.sourceApplies
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  have hlength : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+      hownAfter⟩ :=
+    runOp_callSelf_value_trace_progress_at
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      havs.resolveAtoms harity hprogress hownership hvalue hlength
+      hvalueGraphs hsource hcombinedFrame hownCall
+  obtain ⟨henvAfter, hrestAfter⟩ :=
+    hcombinedAfter.splitAppend henvFrame.lengths
+  have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+      output sourceOutput env envRoots :=
+    houtput.ofRootsGraph henvAfter
+  refine ⟨fuel, store', result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+    hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Exact-bound recursive-self progress where the source function identity
+is recovered from the synthetic input entry. -/
+theorem LowerArgsValueProgress.callSelf_entry_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceLimit : Nat} {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (harity : worlds.length = cur.arity)
+    (hprogress : recSelfRel sourceFunction arity →
+      FnValueTraceProgressesAt funRel sourceCtx ctx cur worlds
+        sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_entry_graph hentry hhead
+          hownership hvalue hsource.sourceApplies
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.of_pointwise
+  intro store env hpre
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨source, hsourceLookup, hself⟩ := hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  have hsound := hargs.callSelf_graph_trace harity (hprogress hself)
+    hownership (hvalue hself) hsource
+  exact ⟨_, ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩,
+    hsound.graphProgress sourceRest rest slots⟩
+
+/-- Recursive-self call progress recovered from the bounded current-function
+package and the synthetic input entry. -/
+theorem LowerArgsValueProgress.callSelf_current_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate arity .shared) emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hself : CurrentSelfTraceProgressContractBelow funRel recSelfRel
+      sourceCtx ctx cur limit)
+    (hsourceBound : sourceLimit < limit)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (havsLength : avs.length = arity) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  by_cases harity : arity = cur.arity
+  · have hprogress : recSelfRel sourceFunction arity →
+        FnValueTraceProgressesAt funRel sourceCtx ctx cur
+          (List.replicate arity .shared) sourceFunction sourceLimit := by
+      intro hrel
+      exact (hself.progress hrel).progresses hsourceBound
+    have hownership : FnOwnershipContract ctx cur
+        (List.replicate arity .shared) := by
+      simpa [harity] using hself.ownership
+    have hvalue : recSelfRel sourceFunction arity →
+        FnValueContract funRel sourceCtx ctx cur
+          (List.replicate arity .shared) sourceFunction := by
+      intro hrel
+      simpa [harity] using hself.value (by simpa [harity] using hrel)
+    exact hargs.callSelf_entry_graph_trace hentry hhead (by simp [harity])
+      hprogress hownership hvalue hsource
+  · refine
+      { toLowerResultValueSound :=
+          hargs.toLowerArgsValueSound.callSelf_arity_mismatch_graph
+            (fun heq => harity (havsLength.symm.trans heq))
+        graphProgress := ?_ }
+    intro sourceRest rest slots
+    apply EmitProgress.of_pointwise
+    intro store env hpre
+    obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+    obtain ⟨source, hsourceLookup, hrel⟩ := hinput.getRecSelf hentry
+    have hsourceEq : source = sourceFunction := by
+      rw [hhead] at hsourceLookup
+      exact (Option.some.inj hsourceLookup).symm
+    subst source
+    have heq : arity = cur.arity := by
+      simpa using (hself.progress hrel).arity_eq
+    exact (harity heq).elim
+
+/-- Scalar-extern graph progress at one exact source-spine bound. -/
+theorem LowerArgsValueProgress.extern_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceLimit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {address : Ixon.Address}
+    {arity : Nat} {resultWorld : Owned}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hprogress : ExternTraceProgressContract funRel sourceCtx ctx)
+    (hvalue : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env address = some (.extern arity))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp
+        (.extern address (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.extern_graph hvalue hlookup href hlength
+          hsource.sourceApplies
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hownExtern : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨fuel, result, hrun, hresultGraph, hownAfter⟩ :=
+    runOp_extern_value_trace_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      (resultWorld := resultWorld) havs.resolveAtoms hprogress hvalue
+      hlookup href hlength hsource hvalueGraphs hownExtern
+  refine ⟨fuel, store, result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtput.bump result, ?_,
+    hresultGraph, hrestGraph, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Lower shared arguments while framing an already-produced function, then
+consume both through source-guided higher-order application progress. -/
+theorem LowerArgsValueProgress.apply_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitProgress.of_pointwise
+  intro store env hfunctionPre
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : HasWorld store .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (permExtractRoot functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happlyProgress : EmitProgress ctx cur
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpProgress.emit
+    intro argsStore argsEnv hargsPost
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownArgs⟩, hslotsOut⟩ := hargsPost
+    cases hframeGraphFinal with
+    | cons _ hfunctionWorldFinal hfunctionGraphFinal hrestGraphFinal =>
+      have hfunctionFinal :
+          AValRealizes output argsEnv function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslotsOut.left_of_append
+      have hfunctionGraph' : Sim.ValueGraph funRel argsStore
+          sourceFunction functionValue := by
+        simpa [functionRoot] using hfunctionGraphFinal
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          rootsForWorlds (List.replicate avs.length .shared) values =
+            rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : RootOwnership argsStore
+          (functionRoot :: rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [functionRoot, hroots, List.append_assoc] using
+          (permExtractRoot functionRoot
+            (rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraphFinal
+      obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+          hownAfter⟩ :=
+        runOp_apply_value_progress
+          (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+          hfunctionFinal.resolveAtom havs.resolveAtoms hprogress hownership
+          hvalue hfunctionGraph' hvalueGraphs hsource hcombinedFrame
+          hownApply
+      obtain ⟨henvAfter, hrestAfter⟩ :=
+        hcombinedAfter.splitAppend henvFrame.lengths
+      have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+          output sourceOutput argsEnv outRoots :=
+        houtput.ofRootsGraph henvAfter
+      refine ⟨fuel, store', result, hrun, ?_⟩
+      refine ⟨⟨outRoots, result, houtputAfter.bump result, ?_,
+        hresultGraph, hrestAfter, hownAfter⟩,
+        hslotsOut.right_of_append.bump result⟩
+      apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+  have hargsThenApply := EmitProgress.comp
+    (hargs.graphProgress ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots))
+    happlyProgress
+  exact ⟨_, hargsPre, hargsThenApply⟩
+
+/-- Exact-source-fuel counterpart of `LowerArgsValueProgress.apply_graph`.
+Only the target-termination component changes; semantic correspondence still
+uses the forgotten `SourceApplies` spine. -/
+theorem LowerArgsValueProgress.apply_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceLimit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hprogress : ApplyValueTraceProgressesAt funRel sourceCtx ctx sourceLimit)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hsourceArgsNonempty : sourceArgs ≠ []) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitProgress.of_pointwise
+  intro store env hfunctionPre
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : HasWorld store .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (permExtractRoot functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happlyProgress : EmitProgress ctx cur
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpProgress.emit
+    intro argsStore argsEnv hargsPost
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownArgs⟩, hslotsOut⟩ := hargsPost
+    cases hframeGraphFinal with
+    | cons _ hfunctionWorldFinal hfunctionGraphFinal hrestGraphFinal =>
+      have hfunctionFinal :
+          AValRealizes output argsEnv function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslotsOut.left_of_append
+      have hfunctionGraph' : Sim.ValueGraph funRel argsStore
+          sourceFunction functionValue := by
+        simpa [functionRoot] using hfunctionGraphFinal
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          rootsForWorlds (List.replicate avs.length .shared) values =
+            rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : RootOwnership argsStore
+          (functionRoot :: rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [functionRoot, hroots, List.append_assoc] using
+          (permExtractRoot functionRoot
+            (rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraphFinal
+      obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+          hownAfter⟩ :=
+        runOp_apply_value_trace_progress_at
+          (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+          hfunctionFinal.resolveAtom havs.resolveAtoms hprogress hownership
+          hvalue hfunctionGraph' hvalueGraphs hsource hsourceArgsNonempty
+          hcombinedFrame hownApply
+      obtain ⟨henvAfter, hrestAfter⟩ :=
+        hcombinedAfter.splitAppend henvFrame.lengths
+      have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+          output sourceOutput argsEnv outRoots :=
+        houtput.ofRootsGraph henvAfter
+      refine ⟨fuel, store', result, hrun, ?_⟩
+      refine ⟨⟨outRoots, result, houtputAfter.bump result, ?_,
+        hresultGraph, hrestAfter, hownAfter⟩,
+        hslotsOut.right_of_append.bump result⟩
+      apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+  have hargsThenApply := EmitProgress.comp
+    (hargs.graphProgress ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots))
+    happlyProgress
+  exact ⟨_, hargsPre, hargsThenApply⟩
+
+/-- Full higher-order progress composition: produce the function, evaluate
+the argument vector, and perform the source-guided target application. -/
+theorem LowerResultValueProgress.applyArgs_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultValueProgress funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      start output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.applyArgs_graph
+          hargs.toLowerArgsValueSound hownership hvalue hsource
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitProgress.comp
+    (hfunction.graphProgress sourceRest rest slots)
+    (hargs.apply_graph hfunction.stable hprogress hownership hvalue hsource
+      sourceRest rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-- Full higher-order progress at one exact source-spine bound. -/
+theorem LowerResultValueProgress.applyArgs_graph_trace
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {sourceLimit : Nat} {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultValueProgress funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hprogress : ApplyValueTraceProgressesAt funRel sourceCtx ctx sourceLimit)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceArgs sourceResult)
+    (hsourceArgsNonempty : sourceArgs ≠ []) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      start output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.applyArgs_graph
+          hargs.toLowerArgsValueSound hownership hvalue
+          hsource.sourceApplies
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitProgress.comp
+    (hfunction.graphProgress sourceRest rest slots)
+    (hargs.apply_graph_trace hfunction.stable hprogress hownership hvalue
+      hsource hsourceArgsNonempty sourceRest rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-- Consume a progressing semantic argument vector through a source-backed
+direct call.  The callee's preserved root graph reconstructs the caller's
+logical environment after the store-changing operation. -/
+theorem LowerArgsValueSettlement.call_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    {address : Ixon.Address}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d worlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp
+        (.call address (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.call_graph hdecl hownership hvalue
+          hsource
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.comp (hargs.graphSettlement sourceRest rest slots)
+  apply OpProgress.emitSettlement
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  have hlength : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+      hownAfter⟩ :=
+    runOp_call_value_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      havs.resolveAtoms hdecl hprogress hownership hvalue hlength
+      hvalueGraphs hsource hcombinedFrame hownCall
+  obtain ⟨henvAfter, hrestAfter⟩ :=
+    hcombinedAfter.splitAppend henvFrame.lengths
+  have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+      output sourceOutput env envRoots :=
+    houtput.ofRootsGraph henvAfter
+  refine ⟨fuel, store', result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+    hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self counterpart of `LowerArgsValueSettlement.call_graph`. -/
+theorem LowerArgsValueSettlement.callSelf_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx cur worlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds
+      sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_graph hownership hvalue hsource
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.comp (hargs.graphSettlement sourceRest rest slots)
+  apply OpProgress.emitSettlement
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  have hlength : values.length = worlds.length :=
+    havs.lengths.2.symm.trans havs.lengths.1.symm
+  obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+      hownAfter⟩ :=
+    runOp_callSelf_value_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      havs.resolveAtoms hprogress hownership hvalue hlength hvalueGraphs
+      hsource hcombinedFrame hownCall
+  obtain ⟨henvAfter, hrestAfter⟩ :=
+    hcombinedAfter.splitAppend henvFrame.lengths
+  have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+      output sourceOutput env envRoots :=
+    houtput.ofRootsGraph henvAfter
+  refine ⟨fuel, store', result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+    hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self progress where the source function identity is recovered
+from the synthetic input entry. -/
+theorem LowerArgsValueSettlement.callSelf_entry_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hprogress : recSelfRel sourceFunction arity →
+      FnValueProgressContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.callSelf_entry_graph hentry hhead
+          hownership hvalue hsource
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.of_pointwise
+  intro store env hpre
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨source, hsourceLookup, hself⟩ := hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  have hsound := hargs.callSelf_graph (hprogress hself) hownership
+    (hvalue hself) hsource
+  exact ⟨_, ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩,
+    hsound.graphSettlement sourceRest rest slots⟩
+
+/-- Recursive-self call progress from the whole current-function contract.
+The advertised marker arity is checked semantically: a realizable marker
+supplies a progress contract whose arity equation rules out the target's
+stuck arity branch. -/
+theorem LowerArgsValueSettlement.callSelf_current_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate arity .shared) emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx
+      cur)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult)
+    (havsLength : avs.length = arity) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  by_cases harity : arity = cur.arity
+  · have hprogress : recSelfRel sourceFunction arity →
+        FnValueProgressContract funRel sourceCtx ctx cur
+          (List.replicate arity .shared) sourceFunction := by
+      intro hrel
+      exact hself.progress hrel
+    have hownership : FnOwnershipContract ctx cur
+        (List.replicate arity .shared) := by
+      simpa [harity] using hself.ownership
+    have hvalue : recSelfRel sourceFunction arity →
+        FnValueContract funRel sourceCtx ctx cur
+          (List.replicate arity .shared) sourceFunction := by
+      intro hrel
+      simpa [harity] using hself.value (by simpa [harity] using hrel)
+    exact hargs.callSelf_entry_graph hentry hhead hprogress hownership
+      hvalue hsource
+  · refine
+      { toLowerResultValueSound :=
+          hargs.toLowerArgsValueSound.callSelf_arity_mismatch_graph
+            (fun heq => harity (havsLength.symm.trans heq))
+        graphSettlement := ?_ }
+    intro sourceRest rest slots
+    apply EmitSettlement.of_pointwise
+    intro store env hpre
+    obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+    obtain ⟨source, hsourceLookup, hrel⟩ := hinput.getRecSelf hentry
+    have hsourceEq : source = sourceFunction := by
+      rw [hhead] at hsourceLookup
+      exact (Option.some.inj hsourceLookup).symm
+    subst source
+    have hcontract := hself.progress hrel
+    have heq : arity = cur.arity := by
+      simpa using hcontract.arity_eq
+    exact (harity heq).elim
+
+/-- Consume a progressing homogeneous shared argument prefix through the
+scalar extern ABI.  The explicit progress contract supplies oracle
+definedness; the value contract supplies source-result correspondence. -/
+theorem LowerArgsValueSettlement.extern_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {address : Ixon.Address}
+    {arity : Nat} {resultWorld : Owned}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hprogress : ExternProgressContract funRel sourceCtx ctx)
+    (hvalue : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env address = some (.extern arity))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp
+        (.extern address (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hargs.toLowerArgsValueSound.extern_graph hvalue hlookup href hlength
+          hsource
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  apply EmitSettlement.comp (hargs.graphSettlement sourceRest rest slots)
+  apply OpProgress.emitSettlement
+  intro store env hpre
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hownExtern : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  obtain ⟨fuel, result, hrun, hresultGraph, hownAfter⟩ :=
+    runOp_extern_value_progress
+      (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+      (resultWorld := resultWorld) havs.resolveAtoms hprogress hvalue
+      hlookup href hlength hsource hvalueGraphs hownExtern
+  refine ⟨fuel, store, result, hrun, ?_⟩
+  refine ⟨⟨envRoots, result, houtput.bump result, ?_,
+    hresultGraph, hrestGraph, hownAfter⟩, hslots.bump result⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Lower shared arguments while framing an already-produced function, then
+consume both through source-guided higher-order application progress. -/
+theorem LowerArgsValueSettlement.apply_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    ∀ sourceRest rest slots,
+      EmitSettlement ctx cur
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSettlement.of_pointwise
+  intro store env hfunctionPre
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : HasWorld store .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (permExtractRoot functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happlyProgress : EmitSettlement ctx cur
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpProgress.emitSettlement
+    intro argsStore argsEnv hargsPost
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownArgs⟩, hslotsOut⟩ := hargsPost
+    cases hframeGraphFinal with
+    | cons _ hfunctionWorldFinal hfunctionGraphFinal hrestGraphFinal =>
+      have hfunctionFinal :
+          AValRealizes output argsEnv function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslotsOut.left_of_append
+      have hfunctionGraph' : Sim.ValueGraph funRel argsStore
+          sourceFunction functionValue := by
+        simpa [functionRoot] using hfunctionGraphFinal
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          rootsForWorlds (List.replicate avs.length .shared) values =
+            rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : RootOwnership argsStore
+          (functionRoot :: rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [functionRoot, hroots, List.append_assoc] using
+          (permExtractRoot functionRoot
+            (rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraphFinal
+      obtain ⟨fuel, store', result, hrun, hresultGraph, hcombinedAfter,
+          hownAfter⟩ :=
+        runOp_apply_value_progress
+          (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+          hfunctionFinal.resolveAtom havs.resolveAtoms hprogress hownership
+          hvalue hfunctionGraph' hvalueGraphs hsource hcombinedFrame
+          hownApply
+      obtain ⟨henvAfter, hrestAfter⟩ :=
+        hcombinedAfter.splitAppend henvFrame.lengths
+      have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+          output sourceOutput argsEnv outRoots :=
+        houtput.ofRootsGraph henvAfter
+      refine ⟨fuel, store', result, hrun, ?_⟩
+      refine ⟨⟨outRoots, result, houtputAfter.bump result, ?_,
+        hresultGraph, hrestAfter, hownAfter⟩,
+        hslotsOut.right_of_append.bump result⟩
+      apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+  have hargsThenApply := EmitSettlement.comp
+    (hargs.graphSettlement ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots))
+    happlyProgress
+  exact ⟨_, hargsPre, hargsThenApply⟩
+
+/-- Full higher-order progress composition: produce the function, evaluate
+the argument vector, and perform the source-guided target application. -/
+theorem LowerResultValueSettlement.applyArgs_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultValueSettlement funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      start output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.applyArgs_graph
+          hargs.toLowerArgsValueSound hownership hvalue hsource
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSettlement.comp
+    (hfunction.graphSettlement sourceRest rest slots)
+    (hargs.apply_graph hfunction.stable hprogress hownership hvalue hsource
+      sourceRest rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-- Reachable-state non-erased higher-order application progress. Its
+recursive work is exactly the progressing shared-argument traversal. -/
+theorem applyRestNonErasedValueProgressesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+    hextends havailable
+  simp only [applyRest] at hrun
+  cases resultWorld with
+  | unique =>
+    have hrequire :
+        (requireResultWorld .shared .unique).run state =
+          .error "call result is shared at unique demand" state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    contradiction
+  | shared =>
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    simp only at hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    have hpure :
+        (argsOutput.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom argsOutput)
+              (avs.map (·.toAtom argsOutput)).toArray),
+          AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa [Function.comp_def] using hpureRun
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+        sourceArgs := by
+      simpa [Function.comp_def] using hsourceArgs
+    have hargsProgress :=
+      hargs hsourcePaired hargsRun hextends havailable
+    have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsValueProgress funRel recSelfRel ctx cur
+        input argsOutput sourceMiddle sourceMiddle sourceArgs
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsProgress
+    simpa [Function.comp_def] using
+      hfunction.applyArgs_graph hhomogeneous hprogress hownership hvalue
+        hsource
+
+/-- Projection-safe counterpart of non-erased higher-order application. -/
+theorem applyRestNonErasedValueProgressesSafelyWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+    hextends havailable
+  simp only [applyRest] at hrun
+  cases resultWorld with
+  | unique =>
+    have hrequire :
+        (requireResultWorld .shared .unique).run state =
+          .error "call result is shared at unique demand" state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    contradiction
+  | shared =>
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    simp only at hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    have hpure :
+        (argsOutput.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom argsOutput)
+              (avs.map (·.toAtom argsOutput)).toArray),
+          AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa [Function.comp_def] using hpureRun
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hsourcePaired : ProjectionSafeArgs sourceCtx sourceMiddle
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+        sourceArgs := by
+      simpa [Function.comp_def] using hsourceArgs
+    have hargsProgress :=
+      hargs hsourcePaired hargsRun hextends havailable
+    have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsValueProgress funRel recSelfRel ctx cur
+        input argsOutput sourceMiddle sourceMiddle sourceArgs
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsProgress
+    simpa [Function.comp_def] using
+      hfunction.applyArgs_graph hhomogeneous hprogress hownership hvalue
+        hsource
+
+/-- Exact-trace non-erased higher-order application.  The operation contract
+is selected at the spine's source bound, which is strictly below the outer
+callable-sealing index. -/
+theorem applyRestNonErasedValueTraceProgressesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hprogress : ApplyValueTraceProgressContractBelow funRel sourceCtx ctx
+      limit)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1) := by
+  intro start input output sourceLimit sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hlimit hfunctionNe hsourceArgs hsource
+    hsourceArgsNonempty hfunction hrun hextends havailable
+  simp only [applyRest] at hrun
+  cases resultWorld with
+  | unique =>
+    have hrequire :
+        (requireResultWorld .shared .unique).run state =
+          .error "call result is shared at unique demand" state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    contradiction
+  | shared =>
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    simp only at hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    have hpure :
+        (argsOutput.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom argsOutput)
+              (avs.map (·.toAtom argsOutput)).toArray),
+          AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa [Function.comp_def] using hpureRun
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hsourcePaired : IxIR0.ProjectionSafe.EvalsBelow sourceCtx
+        sourceLimit sourceMiddle
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+        sourceArgs := by
+      simpa [Function.comp_def] using hsourceArgs
+    have hargsProgress :=
+      hargs hlimit hsourcePaired hargsRun hextends havailable
+    have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsValueProgress funRel recSelfRel ctx cur
+        input argsOutput sourceMiddle sourceMiddle sourceArgs
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsProgress
+    simpa [Function.comp_def] using
+      hfunction.applyArgs_graph_trace hhomogeneous
+        (hprogress.progresses hlimit) hownership hvalue hsource
+        hsourceArgsNonempty
+
+/-- Reachable-state non-erased higher-order application progress. Its
+recursive work is exactly the progressing shared-argument traversal. -/
+theorem applyRestNonErasedValueSettlesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hprogress : ApplyValueProgressContract funRel sourceCtx ctx)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+    hextends havailable
+  simp only [applyRest] at hrun
+  cases resultWorld with
+  | unique =>
+    have hrequire :
+        (requireResultWorld .shared .unique).run state =
+          .error "call result is shared at unique demand" state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    contradiction
+  | shared =>
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    simp only at hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    have hpure :
+        (argsOutput.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom argsOutput)
+              (avs.map (·.toAtom argsOutput)).toArray),
+          AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa [Function.comp_def] using hpureRun
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+        sourceArgs := by
+      simpa [Function.comp_def] using hsourceArgs
+    have hargsProgress :=
+      hargs hsourcePaired hargsRun hextends havailable
+    have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsValueSettlement funRel recSelfRel ctx cur
+        input argsOutput sourceMiddle sourceMiddle sourceArgs
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsProgress
+    simpa [Function.comp_def] using
+      hfunction.applyArgs_graph hhomogeneous hprogress hownership hvalue
+        hsource
+
+/-- Reachable-state progressing `knownCall`. The prefix argument traversal
+and the optional over-application tail retain the same ambient-state
+threading as the semantic partial-correctness induction. -/
+theorem knownCall_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Owned}
+    {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueProgress funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueProgress funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  have hprefixSource : SourceArgsEval sourceCtx sourceEnv
+      (((args.take count).zip
+        (padWorlds argWorlds count)).map Prod.fst)
+      (sourceValues.take count) := by
+    rw [knownCall_prefix_exprs_eq]
+    exact hsourceArgs.take count
+  obtain ⟨sourceBuilt, hprefixApply, htailApply⟩ :=
+    hsource.splitAt count
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hprefixProgress := hargs hprefixSource hprefixRun hextends
+      havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hsourceLe : sourceValues.length ≤ count := by
+      simpa [← hsourceArgs.lengths] using hle
+    rw [List.drop_eq_nil_of_le hsourceLe] at htailApply
+    cases htailApply
+    simpa [hterminalWorld hle] using hbuilt
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixExtends : ExtraExtends prefixState ambient :=
+      (applyRest_extraExtends hafterPrefix).trans hextends
+    have hprefixProgress := hargs hprefixSource hprefixRun hprefixExtends
+      havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hbuiltShared : LowerResultValueProgress funRel recSelfRel ctx cur
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) := by
+      simpa [hoverWorld hover] using hbuilt
+    exact hrest (by simp) (hsourceArgs.drop count) htailApply
+      hbuiltShared hafterPrefix hextends
+      (havailable.lowerArgs hprefixRun).bump
+
+/-- Direct-call specialization of progressing `knownCall`. -/
+theorem knownCall_call_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {argWorlds : List Owned} {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_progress_within hargs hrest hsourceArgs
+    hsource ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  exact hprefix.call_graph hdecl hprogress hownership hvalue hprefixApply
+
+/-- Recursive-self `knownCall` specialization using the synthetic input
+entry to recover both value correspondence and source-guided termination. -/
+theorem knownCall_callSelf_entry_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hprogress : recSelfRel sourceFunction count →
+      FnValueProgressContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hownership : FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_progress_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => by simpa [hresult])
+      (fun _ => by simpa [hresult]) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_entry_graph hentry hhead hprogress
+    hownership hvalue hprefixApply
+  simpa [hresult] using hbuilt
+
+/-- Recursive-self `knownCall` specialization discharged directly by the
+whole current-function progress package. -/
+theorem knownCall_callSelf_current_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_progress_within
+    (build := .callSelf) (count := count)
+    (argWorlds := List.replicate count .shared)
+    (resultWorld := .shared) (buildWorld := .shared)
+    hargs hrest hsourceArgs hsource ?_ (fun _ => rfl)
+      (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_current_graph hentry hhead hself
+    hprefixApply havsLength
+  simpa [hself.result] using hbuilt
+
+/-- Constructor-allocation specialization of progressing `knownCall`. -/
+theorem knownCall_alloc_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {world : Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_progress_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Scalar-extern specialization of progressing `knownCall`. -/
+theorem knownCall_extern_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {input output : VEnv} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hprogress : ExternProgressContract funRel sourceCtx ctx)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_progress_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph hprogress hcontract hlookup href htakeLength
+      hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Partial-application specialization of progressing `knownCall`. -/
+theorem knownCall_papp_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_progress_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixProgress
+  apply hprefix.papp_graph hdecl (hfun hprefixApply)
+  simpa [havsLength] using hunder
+
+/-- Static source-address pap allocation under the whole-pass function
+relation. -/
+theorem knownCall_papp_source_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {fuel count : Nat} {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_progress_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Memoized constructor-wrapper pap allocation under the whole-pass
+function relation. -/
+theorem knownCall_papp_wrapper_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {fuel count : Nat} {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_progress_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Reachable-state progressing `knownCall`. The prefix argument traversal
+and the optional over-application tail retain the same ambient-state
+threading as the semantic partial-correctness induction. -/
+theorem knownCall_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Owned}
+    {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueProgress funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueProgress funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  have hprefixSource : ProjectionSafeArgs sourceCtx sourceEnv
+      (((args.take count).zip
+        (padWorlds argWorlds count)).map Prod.fst)
+      (sourceValues.take count) := by
+    rw [knownCall_prefix_exprs_eq]
+    exact hsourceArgs.take count
+  obtain ⟨sourceBuilt, hprefixApply, htailApply⟩ :=
+    hsource.splitAt count
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hprefixProgress := hargs hprefixSource hprefixRun hextends
+      havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hsourceLe : sourceValues.length ≤ count := by
+      simpa [← hsourceArgs.lengths] using hle
+    rw [List.drop_eq_nil_of_le hsourceLe] at htailApply
+    cases htailApply
+    simpa [hterminalWorld hle] using hbuilt
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixExtends : ExtraExtends prefixState ambient :=
+      (applyRest_extraExtends hafterPrefix).trans hextends
+    have hprefixProgress := hargs hprefixSource hprefixRun hprefixExtends
+      havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hbuiltShared : LowerResultValueProgress funRel recSelfRel ctx cur
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) := by
+      simpa [hoverWorld hover] using hbuilt
+    exact hrest (by simp) (hsourceArgs.drop count) htailApply
+      hbuiltShared hafterPrefix hextends
+      (havailable.lowerArgs hprefixRun).bump
+
+/-- Exact-trace `knownCall` composition.  Prefix and over-application
+spines retain their common source bound through `take`/`drop` and
+`AppliesBelow.splitAt`. -/
+theorem knownCall_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {build : Array Atom → Op}
+    {argWorlds : List Owned} {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueProgress funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+        (sourceValues.take count) sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueProgress funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  have hprefixSource : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv
+      (((args.take count).zip
+        (padWorlds argWorlds count)).map Prod.fst)
+      (sourceValues.take count) := by
+    rw [knownCall_prefix_exprs_eq]
+    exact hsourceArgs.take count
+  obtain ⟨sourceBuilt, hprefixApply, htailApply⟩ :=
+    hsource.splitAt count
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hprefixProgress := hargs hsourceBound hprefixSource hprefixRun
+      hextends havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hsourceLe : sourceValues.length ≤ count := by
+      simpa [← hsourceArgs.lengths] using hle
+    rw [List.drop_eq_nil_of_le hsourceLe] at htailApply
+    cases htailApply
+    simpa [hterminalWorld hle] using hbuilt
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixExtends : ExtraExtends prefixState ambient :=
+      (applyRest_extraExtends hafterPrefix).trans hextends
+    have hprefixProgress := hargs hsourceBound hprefixSource hprefixRun
+      hprefixExtends havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hbuiltShared : LowerResultValueProgress funRel recSelfRel ctx cur
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) := by
+      simpa [hoverWorld hover] using hbuilt
+    have htailNonempty : sourceValues.drop count ≠ [] := by
+      intro hnil
+      have hzero : sourceValues.length - count = 0 := by
+        simpa using congrArg List.length hnil
+      have hlengths := hsourceArgs.lengths
+      omega
+    exact hrest hsourceBound (by simp) (hsourceArgs.drop count)
+      htailApply htailNonempty hbuiltShared hafterPrefix hextends
+      (havailable.lowerArgs hprefixRun).bump
+
+/-- Direct-call specialization of progressing `knownCall`. -/
+theorem knownCall_call_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {argWorlds : List Owned} {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_progress_safely_within hargs hrest hsourceArgs
+    hsource ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  exact hprefix.call_graph hdecl hprogress hownership hvalue hprefixApply
+
+/-- Recursive-self `knownCall` specialization using the synthetic input
+entry to recover both value correspondence and source-guided termination. -/
+theorem knownCall_callSelf_entry_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hprogress : recSelfRel sourceFunction count →
+      FnValueProgressContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hownership : FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_progress_safely_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => by simpa [hresult])
+      (fun _ => by simpa [hresult]) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_entry_graph hentry hhead hprogress
+    hownership hvalue hprefixApply
+  simpa [hresult] using hbuilt
+
+/-- Recursive-self `knownCall` specialization discharged directly by the
+whole current-function progress package. -/
+theorem knownCall_callSelf_current_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_progress_safely_within
+    (build := .callSelf) (count := count)
+    (argWorlds := List.replicate count .shared)
+    (resultWorld := .shared) (buildWorld := .shared)
+    hargs hrest hsourceArgs hsource ?_ (fun _ => rfl)
+      (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_current_graph hentry hhead hself
+    hprefixApply havsLength
+  simpa [hself.result] using hbuilt
+
+/-- Constructor-allocation specialization of progressing `knownCall`. -/
+theorem knownCall_alloc_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {world : Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_progress_safely_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Scalar-extern specialization of progressing `knownCall`. -/
+theorem knownCall_extern_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {input output : VEnv} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hprogress : ExternProgressContract funRel sourceCtx ctx)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_progress_safely_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph hprogress hcontract hlookup href htakeLength
+      hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Partial-application specialization of progressing `knownCall`. -/
+theorem knownCall_papp_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_progress_safely_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixProgress
+  apply hprefix.papp_graph hdecl (hfun hprefixApply)
+  simpa [havsLength] using hunder
+
+/-- Static source-address pap allocation under the whole-pass function
+relation. -/
+theorem knownCall_papp_source_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {fuel count : Nat} {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_progress_safely_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Memoized constructor-wrapper pap allocation under the whole-pass
+function relation. -/
+theorem knownCall_papp_wrapper_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {fuel count : Nat} {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_progress_safely_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-! Exact-trace `knownCall` specializations. -/
+
+theorem knownCall_call_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {argWorlds : List Owned}
+    {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (harity : argWorlds.length = d.arity)
+    (hprogress : FnValueTraceProgressesAt funRel sourceCtx ctx d argWorlds
+      sourceFunction sourceLimit)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hsourceArgs hsource ?_ hterminalWorld hoverWorld hrun
+    hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  exact hprefix.call_graph_trace hdecl harity hprogress hownership hvalue
+    hprefixApply
+
+theorem knownCall_callSelf_current_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count index : Nat} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hself : CurrentSelfTraceProgressContractBelow funRel recSelfRel
+      sourceCtx ctx cur limit)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_trace_progress_within_below
+    (build := .callSelf) (count := count)
+    (argWorlds := List.replicate count .shared)
+    (resultWorld := .shared) (buildWorld := .shared)
+    hargs hrest hsourceBound hsourceArgs hsource ?_ (fun _ => rfl)
+      (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_current_graph_trace hentry hhead hself
+    hsourceBound hprefixApply havsLength
+  simpa [hself.result] using hbuilt
+
+theorem knownCall_alloc_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {world : Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hsourceArgs hsource ?_ (fun _ => rfl) ?_ hrun hextends
+    havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.sourceApplies.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+theorem knownCall_extern_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {f : Ixon.Address} {input output : VEnv}
+    {resultWorld : Owned} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hprogress : ExternTraceProgressContract funRel sourceCtx ctx)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hsourceArgs hsource ?_ (fun _ => rfl) ?_ hrun hextends
+    havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph_trace hprogress hcontract hlookup href
+      htakeLength hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+theorem knownCall_papp_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hsourceArgs hsource ?_ (fun _ => rfl) (fun _ => rfl)
+    hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueProgress funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixProgress
+  apply hprefix.papp_graph hdecl (hfun hprefixApply.sourceApplies)
+  simpa [havsLength] using hunder
+
+theorem knownCall_papp_source_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel count : Nat} {f : Ixon.Address}
+    {source : IxIR0.Decl} {d : Decl} {input output : VEnv}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hcount hdecl hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+theorem knownCall_papp_wrapper_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel count : Nat} {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hsourceBound : sourceLimit < limit)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceEnv args sourceValues)
+    (hsource : SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+      sourceValues sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hcount hdecl hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Saturated/over-applied definition-reference spine progress. -/
+theorem lowerSpine_ref_defn_call_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hprogress.fnContract hsrc (by rfl) hdecl href
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_progress_within hargs hrest (by simp)
+    hcount hdecl hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+/-- Under-applied definition references progress by allocating a pap after
+the compiler's existing world and pap-safety guards succeed. -/
+theorem lowerSpine_ref_defn_partial_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (trackedThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_progress_within hargs hrest
+          (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied recursor-reference spine progress. -/
+theorem lowerSpine_ref_recursor_call_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hprogress.fnContract hsrc (by rfl) hdecl href
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_progress_within hargs hrest (by simp)
+    hcount hdecl hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+/-- Under-applied recursor references progress by allocating a pap. -/
+theorem lowerSpine_ref_recursor_partial_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_progress_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied constructor references progress by allocating the
+constructor node and then applying any remaining arguments. -/
+theorem lowerSpine_ref_ctor_alloc_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_progress_within hargs hrest hcount rfl rfl
+    hsourceArgs hsourceApply hctor hknown hextends havailable
+
+/-- Under-applied constructor references progress through wrapper synthesis
+and partial-application allocation. -/
+theorem lowerSpine_ref_ctor_partial_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      trackedBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ ambient.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_progress_within hargs hrest
+      (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun hextends havailable
+
+/-- Saturated/over-applied extern references progress when the target oracle
+is defined on every source-guided argument tuple. -/
+theorem lowerSpine_ref_extern_call_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hprogress : ExternProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_progress_within hargs hrest hprogress
+    hcontract hcount hlookup href hsourceArgs hsourceApply hknown hextends
+    havailable
+
+/-- Under-applied extern references progress by allocating a pap. -/
+theorem lowerSpine_ref_extern_partial_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_progress_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Complete source-guided progress for static-reference spines. -/
+theorem lowerSpine_ref_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases hsrc : src f with
+  | none =>
+    exact (trackedThrowRun_not_ok
+      (by simpa [lowerSpine, hsrc] using hrun)).elim
+  | some source =>
+    cases source with
+    | defn result body =>
+      by_cases hunder : args.length < lamArity body
+      · exact lowerSpine_ref_defn_partial_run_value_progress_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_defn_call_run_value_progress_within
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+    | ctor tag arity =>
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact lowerSpine_ref_ctor_partial_run_value_progress_within
+          hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+          hrepresented havailable
+      · exact lowerSpine_ref_ctor_alloc_run_value_progress_within
+          hargs hrest hlookup hsrc (Nat.le_of_not_gt hunder) hsource hrun
+          hextends havailable
+    | recursor numArgs natLit rules =>
+      by_cases hunder : args.length < numArgs + 1
+      · exact lowerSpine_ref_recursor_partial_run_value_progress_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_recursor_call_run_value_progress_within
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+    | extern arity =>
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact lowerSpine_ref_extern_partial_run_value_progress_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_extern_call_run_value_progress_within
+          hargs hrest hprogress.extern hvalues.extern hlookup hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+
+/-- Saturated/over-applied definition-reference spine progress. -/
+theorem lowerSpine_ref_defn_call_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hprogress.fnContract hsrc (by rfl) hdecl href
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_progress_safely_within hargs hrest (by simp)
+    hcount hdecl hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+/-- Under-applied definition references progress by allocating a pap after
+the compiler's existing world and pap-safety guards succeed. -/
+theorem lowerSpine_ref_defn_partial_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (trackedThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_progress_safely_within hargs hrest
+          (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied recursor-reference spine progress. -/
+theorem lowerSpine_ref_recursor_call_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hprogress.fnContract hsrc (by rfl) hdecl href
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_progress_safely_within hargs hrest (by simp)
+    hcount hdecl hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+/-- Under-applied recursor references progress by allocating a pap. -/
+theorem lowerSpine_ref_recursor_partial_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_progress_safely_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied constructor references progress by allocating the
+constructor node and then applying any remaining arguments. -/
+theorem lowerSpine_ref_ctor_alloc_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_progress_safely_within hargs hrest hcount rfl rfl
+    hsourceArgs hsourceApply hctor hknown hextends havailable
+
+/-- Under-applied constructor references progress through wrapper synthesis
+and partial-application allocation. -/
+theorem lowerSpine_ref_ctor_partial_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      trackedBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ ambient.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_progress_safely_within hargs hrest
+      (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun hextends havailable
+
+/-- Saturated/over-applied extern references progress when the target oracle
+is defined on every source-guided argument tuple. -/
+theorem lowerSpine_ref_extern_call_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hprogress : ExternProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_progress_safely_within hargs hrest hprogress
+    hcontract hcount hlookup href hsourceArgs hsourceApply hknown hextends
+    havailable
+
+/-- Under-applied extern references progress by allocating a pap. -/
+theorem lowerSpine_ref_extern_partial_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_progress_safely_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Complete source-guided progress for static-reference spines. -/
+theorem lowerSpine_ref_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases hsrc : src f with
+  | none =>
+    exact (trackedThrowRun_not_ok
+      (by simpa [lowerSpine, hsrc] using hrun)).elim
+  | some source =>
+    cases source with
+    | defn result body =>
+      by_cases hunder : args.length < lamArity body
+      · exact lowerSpine_ref_defn_partial_run_value_progress_safely_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_defn_call_run_value_progress_safely_within
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+    | ctor tag arity =>
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact lowerSpine_ref_ctor_partial_run_value_progress_safely_within
+          hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+          hrepresented havailable
+      · exact lowerSpine_ref_ctor_alloc_run_value_progress_safely_within
+          hargs hrest hlookup hsrc (Nat.le_of_not_gt hunder) hsource hrun
+          hextends havailable
+    | recursor numArgs natLit rules =>
+      by_cases hunder : args.length < numArgs + 1
+      · exact lowerSpine_ref_recursor_partial_run_value_progress_safely_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_recursor_call_run_value_progress_safely_within
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+    | extern arity =>
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact lowerSpine_ref_extern_partial_run_value_progress_safely_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_extern_call_run_value_progress_safely_within
+          hargs hrest hprogress.extern hvalues.extern hlookup hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+
+/-! Exact-trace static-reference spine progress. -/
+
+/-- Saturated/over-applied definition references preserve the exact source
+trace used to justify the target call. -/
+theorem lowerSpine_ref_defn_call_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hrefTrace, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction sourceLimit := by
+    exact hprogress.fn_progresses hsourceBound hsrc (by rfl) hdecl hrefTrace
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_trace_progress_within_below hargs hrest
+    hsourceBound (by simp) hcount hdecl (by simpa using harity.symm)
+    hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_ hknownRun
+    hextends havailable
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+/-- Under-applied definition references allocate a pap without forgetting the
+source trace that will justify any remaining application. -/
+theorem lowerSpine_ref_defn_partial_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, _, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (trackedThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_trace_progress_within_below
+          hargs hrest hsourceBound (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied recursor references preserve the exact source call
+trace at the declaration boundary. -/
+theorem lowerSpine_ref_recursor_call_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hrefTrace, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction sourceLimit := by
+    exact hprogress.fn_progresses hsourceBound hsrc (by rfl) hdecl hrefTrace
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_trace_progress_within_below hargs hrest
+    hsourceBound (by simp) hcount hdecl (by simpa using harity.symm)
+    hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_ hknownRun
+    hextends havailable
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+/-- Under-applied recursor references preserve their exact source trace while
+allocating a pap. -/
+theorem lowerSpine_ref_recursor_partial_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, _, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_trace_progress_within_below
+      hargs hrest hsourceBound (Nat.le_refl _) hsrc
+      (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied constructor references allocate their node while
+retaining the exact source application trace. -/
+theorem lowerSpine_ref_ctor_alloc_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, _, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hcount rfl rfl hsourceArgs hsourceApply hctor hknown
+    hextends havailable
+
+/-- Under-applied constructor references preserve their exact source trace
+through wrapper synthesis and pap allocation. -/
+theorem lowerSpine_ref_ctor_partial_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat} {state finalState : LowSt}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsourceBound : sourceLimit < limit)
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, _, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      trackedBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ ambient.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_trace_progress_within_below
+      hargs hrest hsourceBound (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun hextends havailable
+
+/-- Saturated/over-applied extern references preserve the exact source trace
+used at the scalar-oracle boundary. -/
+theorem lowerSpine_ref_extern_call_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hprogress : ExternTraceProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, _, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_trace_progress_within_below hargs hrest
+    hsourceBound hprogress hcontract hcount hlookup href hsourceArgs
+    hsourceApply hknown hextends havailable
+
+/-- Under-applied extern references preserve their exact source trace while
+allocating a pap. -/
+theorem lowerSpine_ref_extern_partial_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, _, hsourceArgs,
+      hsourceApply⟩ := callAwareProjectionSafeSpine_refData hsource
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_trace_progress_within_below
+      hargs hrest hsourceBound (Nat.le_refl _) hsrc
+      (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Complete exact-trace progress for static-reference spines. -/
+theorem lowerSpine_ref_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat} {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsourceBound : sourceLimit < limit)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.ref f) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases hsrc : src f with
+  | none =>
+    exact (trackedThrowRun_not_ok
+      (by simpa [lowerSpine, hsrc] using hrun)).elim
+  | some source =>
+    cases source with
+    | defn result body =>
+      by_cases hunder : args.length < lamArity body
+      · exact
+          lowerSpine_ref_defn_partial_run_value_trace_progress_within_below
+            hargs hrest hcontracts.decls hsourceBound hsrc hunder hsource
+            hrun hextends havailable
+      · exact lowerSpine_ref_defn_call_run_value_trace_progress_within_below
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls
+          hsourceBound hsrc (Nat.le_of_not_gt hunder) hsource hrun hextends
+          havailable
+    | ctor tag arity =>
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact
+          lowerSpine_ref_ctor_partial_run_value_trace_progress_within_below
+            hargs hrest hknownExtra hsourceBound hsrc hunder hsource hrun
+            hextends hrepresented havailable
+      · exact
+          lowerSpine_ref_ctor_alloc_run_value_trace_progress_within_below
+            hargs hrest hsourceBound hlookup hsrc (Nat.le_of_not_gt hunder)
+            hsource hrun hextends havailable
+    | recursor numArgs natLit rules =>
+      by_cases hunder : args.length < numArgs + 1
+      · exact
+          lowerSpine_ref_recursor_partial_run_value_trace_progress_within_below
+            hargs hrest hcontracts.decls hsourceBound hsrc hunder hsource
+            hrun hextends havailable
+      · exact
+          lowerSpine_ref_recursor_call_run_value_trace_progress_within_below
+            hargs hrest hcontracts.decls hvalues.decls hprogress.decls
+            hsourceBound hsrc (Nat.le_of_not_gt hunder) hsource hrun hextends
+            havailable
+    | extern arity =>
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact
+          lowerSpine_ref_extern_partial_run_value_trace_progress_within_below
+            hargs hrest hcontracts.decls hsourceBound hsrc hunder hsource
+            hrun hextends havailable
+      · exact
+          lowerSpine_ref_extern_call_run_value_trace_progress_within_below
+            hargs hrest hprogress.extern hvalues.extern hsourceBound hlookup
+            hsrc (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+
+/-- Reachable-state progressing `knownCall`. The prefix argument traversal
+and the optional over-application tail retain the same ambient-state
+threading as the semantic partial-correctness induction. -/
+theorem knownCall_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Owned}
+    {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueSettlement funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueSettlement funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  have hprefixSource : SourceArgsEval sourceCtx sourceEnv
+      (((args.take count).zip
+        (padWorlds argWorlds count)).map Prod.fst)
+      (sourceValues.take count) := by
+    rw [knownCall_prefix_exprs_eq]
+    exact hsourceArgs.take count
+  obtain ⟨sourceBuilt, hprefixApply, htailApply⟩ :=
+    hsource.splitAt count
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hprefixProgress := hargs hprefixSource hprefixRun hextends
+      havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hsourceLe : sourceValues.length ≤ count := by
+      simpa [← hsourceArgs.lengths] using hle
+    rw [List.drop_eq_nil_of_le hsourceLe] at htailApply
+    cases htailApply
+    simpa [hterminalWorld hle] using hbuilt
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixExtends : ExtraExtends prefixState ambient :=
+      (applyRest_extraExtends hafterPrefix).trans hextends
+    have hprefixProgress := hargs hprefixSource hprefixRun hprefixExtends
+      havailable
+    have hbuilt := hbuild hprefixProgress hprefixApply hprefixLength
+    have hbuiltShared : LowerResultValueSettlement funRel recSelfRel ctx cur
+        input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) := by
+      simpa [hoverWorld hover] using hbuilt
+    exact hrest (by simp) (hsourceArgs.drop count) htailApply
+      hbuiltShared hafterPrefix hextends
+      (havailable.lowerArgs hprefixRun).bump
+
+/-- Direct-call specialization of progressing `knownCall`. -/
+theorem knownCall_call_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {argWorlds : List Owned} {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hprogress : FnValueProgressContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_settlement_within hargs hrest hsourceArgs
+    hsource ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueSettlement funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  exact hprefix.call_graph hdecl hprogress hownership hvalue hprefixApply
+
+/-- Recursive-self `knownCall` specialization using the synthetic input
+entry to recover both value correspondence and source-guided termination. -/
+theorem knownCall_callSelf_entry_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hprogress : recSelfRel sourceFunction count →
+      FnValueProgressContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hownership : FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_settlement_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => by simpa [hresult])
+      (fun _ => by simpa [hresult]) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsValueSettlement funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_entry_graph hentry hhead hprogress
+    hownership hvalue hprefixApply
+  simpa [hresult] using hbuilt
+
+/-- Recursive-self `knownCall` specialization discharged directly by the
+whole current-function progress package. -/
+theorem knownCall_callSelf_current_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_settlement_within
+    (build := .callSelf) (count := count)
+    (argWorlds := List.replicate count .shared)
+    (resultWorld := .shared) (buildWorld := .shared)
+    hargs hrest hsourceArgs hsource ?_ (fun _ => rfl)
+      (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueSettlement funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixProgress
+  have hbuilt := hprefix.callSelf_current_graph hentry hhead hself
+    hprefixApply havsLength
+  simpa [hself.result] using hbuilt
+
+/-- Constructor-allocation specialization of progressing `knownCall`. -/
+theorem knownCall_alloc_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {world : Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_settlement_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSettlement funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Scalar-extern specialization of progressing `knownCall`. -/
+theorem knownCall_extern_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {input output : VEnv} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hprogress : ExternProgressContract funRel sourceCtx ctx)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_settlement_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSettlement funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixProgress
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph hprogress hcontract hlookup href htakeLength
+      hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Partial-application specialization of progressing `knownCall`. -/
+theorem knownCall_papp_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_settlement_within hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixProgress
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueSettlement funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixProgress
+  apply hprefix.papp_graph hdecl (hfun hprefixApply)
+  simpa [havsLength] using hunder
+
+/-- Static source-address pap allocation under the whole-pass function
+relation. -/
+theorem knownCall_papp_source_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {fuel count : Nat} {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_settlement_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Memoized constructor-wrapper pap allocation under the whole-pass
+function relation. -/
+theorem knownCall_papp_wrapper_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {fuel count : Nat} {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_settlement_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+/-- Saturated/over-applied definition-reference spine progress. -/
+theorem lowerSpine_ref_defn_call_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hprogress.fnContract hsrc (by rfl) hdecl href
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_settlement_within hargs hrest (by simp)
+    hcount hdecl hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+/-- Under-applied definition references progress by allocating a pap after
+the compiler's existing world and pap-safety guards succeed. -/
+theorem lowerSpine_ref_defn_partial_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (trackedThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_settlement_within hargs hrest
+          (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied recursor-reference spine progress. -/
+theorem lowerSpine_ref_recursor_call_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : SourceDeclProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  have hcallee : FnValueProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hprogress.fnContract hsrc (by rfl) hdecl href
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_settlement_within hargs hrest (by simp)
+    hcount hdecl hcallee hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+/-- Under-applied recursor references progress by allocating a pap. -/
+theorem lowerSpine_ref_recursor_partial_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_settlement_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Saturated/over-applied constructor references progress by allocating the
+constructor node and then applying any remaining arguments. -/
+theorem lowerSpine_ref_ctor_alloc_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_settlement_within hargs hrest hcount rfl rfl
+    hsourceArgs hsourceApply hctor hknown hextends havailable
+
+/-- Under-applied constructor references progress through wrapper synthesis
+and partial-application allocation. -/
+theorem lowerSpine_ref_ctor_partial_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      trackedBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ ambient.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_settlement_within hargs hrest
+      (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun hextends havailable
+
+/-- Saturated/over-applied extern references progress when the target oracle
+is defined on every source-guided argument tuple. -/
+theorem lowerSpine_ref_extern_call_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hprogress : ExternProgressContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_settlement_within hargs hrest hprogress
+    hcontract hcount hlookup href hsourceArgs hsourceApply hknown hextends
+    havailable
+
+/-- Under-applied extern references progress by allocating a pap. -/
+theorem lowerSpine_ref_extern_partial_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_settlement_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Complete source-guided progress for static-reference spines. -/
+theorem lowerSpine_ref_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases hsrc : src f with
+  | none =>
+    exact (trackedThrowRun_not_ok
+      (by simpa [lowerSpine, hsrc] using hrun)).elim
+  | some source =>
+    cases source with
+    | defn result body =>
+      by_cases hunder : args.length < lamArity body
+      · exact lowerSpine_ref_defn_partial_run_value_settlement_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_defn_call_run_value_settlement_within
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+    | ctor tag arity =>
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact lowerSpine_ref_ctor_partial_run_value_settlement_within
+          hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+          hrepresented havailable
+      · exact lowerSpine_ref_ctor_alloc_run_value_settlement_within
+          hargs hrest hlookup hsrc (Nat.le_of_not_gt hunder) hsource hrun
+          hextends havailable
+    | recursor numArgs natLit rules =>
+      by_cases hunder : args.length < numArgs + 1
+      · exact lowerSpine_ref_recursor_partial_run_value_settlement_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_recursor_call_run_value_settlement_within
+          hargs hrest hcontracts.decls hvalues.decls hprogress.decls hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+    | extern arity =>
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      by_cases hunder : args.length < arity
+      · exact lowerSpine_ref_extern_partial_run_value_settlement_within
+          hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+          havailable
+      · exact lowerSpine_ref_extern_call_run_value_settlement_within
+          hargs hrest hprogress.extern hvalues.extern hlookup hsrc
+          (Nat.le_of_not_gt hunder) hsource hrun hextends havailable
+
+/-- Close a progressing semantic expression with its generated return.  The
+stable result descriptor supplies a resolvable atom, so no additional target
+progress premise is needed at function exit. -/
+theorem LowerResultValueProgress.closeProgress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue world emit av)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root) :
+    CodeProgress ctx cur
+      (GraphOwnsVEnv funRel recSelfRel input sourceInput sourceRest rest)
+      (emit (.ret (av.toAtom output))) := by
+  have hret : CodeProgress ctx cur
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest [])
+      (.ret (av.toAtom output)) := by
+    apply codeProgress_ret
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+    exact ⟨value, hav.resolveAtom⟩
+  have hemitted : CodeProgress ctx cur
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest [])
+      (emit (.ret (av.toAtom output))) :=
+    hsound.graphProgress sourceRest rest [] (.ret (av.toAtom output)) hret
+  intro store env hpre
+  exact hemitted ⟨hpre, SlotsRealize.nil⟩
+
+/-- Closing progress and partial correctness together constructs a target
+run whose returned value realizes the source result and whose caller frame
+is preserved. -/
+theorem LowerResultValueProgress.closeGraphProgress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue world emit av)
+    (hreleased : EntriesReleased output.entries)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root)
+    {store : Store} {env : List RVal}
+    (hpre : GraphOwnsVEnv funRel recSelfRel input sourceInput
+      sourceRest rest store env) :
+    ∃ fuel store' value,
+      runCode ctx fuel cur store env (emit (.ret (av.toAtom output))) =
+          .ok (store', value) ∧
+      Sim.ValueGraph funRel store' sourceValue value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  obtain ⟨fuel, store', value, hrun⟩ :=
+    hsound.closeProgress sourceRest rest hpre
+  have hgraphs := hsound.toLowerResultValueSound.closeGraph
+    hreleased sourceRest rest hpre hrun
+  exact ⟨fuel, store', value, hrun, hgraphs.1, hgraphs.2⟩
+
+/-- Close a semantic settlement result with the generated return. A prefix
+that reaches its graph postcondition returns successfully; a prefix that
+stops earlier preserves that ordinary terminal observation. -/
+theorem LowerResultValueSettlement.closeSettlement
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsettles : LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue world emit av)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root) :
+    CodeSettlement ctx cur
+      (GraphOwnsVEnv funRel recSelfRel input sourceInput sourceRest rest)
+      (emit (.ret (av.toAtom output))) := by
+  have hretProgress : CodeProgress ctx cur
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest [])
+      (.ret (av.toAtom output)) := by
+    apply codeProgress_ret
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+    exact ⟨value, hav.resolveAtom⟩
+  have hemitted : CodeSettlement ctx cur
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        sourceRest rest [])
+      (emit (.ret (av.toAtom output))) :=
+    hsettles.graphSettlement sourceRest rest []
+      (.ret (av.toAtom output)) hretProgress.settlement
+  intro store env hpre
+  exact hemitted ⟨hpre, SlotsRealize.nil⟩
+
+/-! ## Call-free primitive progress rules -/
+
+theorem emit_pure_scalar_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {atom : Atom} {value : RVal}
+    {world : Owned} {rest : List Root}
+    (hnone : rvalLocation? value = none) :
+    EmitProgress ctx cur (emitOp (.pure atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        RootOwnership store rest)
+      (OwnsPushedRoot frame world rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  have hop := runOp_pure_scalar_owned (ctx := ctx) (cur := cur)
+    (fuel := 0) (world := world) (roots := rest) hresolve hnone hown
+  exact ⟨1, store, value, hop.1,
+    ⟨value, env, rfl, hframe, hop.2⟩⟩
+
+theorem emit_alloc_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {world : Owned} {cid : CtorId}
+    {atoms : Array Atom} {values : List RVal} {rest : List Root} :
+    EmitProgress ctx cur (emitOp (.alloc world cid atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor world values ++ rest))
+      (OwnsPushedRoot frame world rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  have hop := runOp_alloc_owned (ctx := ctx) (cur := cur) (fuel := 0)
+    (cid := cid) (args := atoms) (values := values) (rest := rest)
+    hresolve hown
+  let allocated := store.allocNode world (.ctorN cid values.toArray)
+  refine ⟨1, allocated.1, .loc allocated.2, ?_, ?_⟩
+  · simpa [allocated] using hop.1
+  · exact ⟨.loc allocated.2, env, rfl, hframe, by
+      simpa [allocated] using hop.2⟩
+
+theorem emit_papp_progress {ctx : Ctx} {cur : FnDef}
+    {f : Ixon.Address} {d : Decl} {frame : List RVal → Prop}
+    {atoms : Array Atom} {values : List RVal} {rest : List Root}
+    (hdecl : ctx.decls f = some d)
+    (hunder : values.length < declArity d) :
+    EmitProgress ctx cur (emitOp (.papp f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor .shared values ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  have hop := runOp_papp_owned (ctx := ctx) (cur := cur) (fuel := 0)
+    hresolve hdecl hunder hown
+  let allocated := store.allocNode .shared
+    (.papN f (declArity d) values.toArray)
+  refine ⟨1, allocated.1, .loc allocated.2, ?_, ?_⟩
+  · simpa [allocated] using hop.1
+  · exact ⟨.loc allocated.2, env, rfl, hframe, by
+      simpa [allocated] using hop.2⟩
+
+theorem emit_retain_borrowed_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {atom : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitProgress ctx cur (emitOp (.dup atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        HasWorld store .shared value ∧ RootOwnership store rest)
+      (OwnsPushedRoot frame .shared rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hworld, hown⟩ := hpre
+  obtain ⟨store', hrun, hown'⟩ :=
+    runOp_retain_borrowed (ctx := ctx) (cur := cur) (fuel := 0)
+      hresolve hworld hown
+  exact ⟨1, store', value, hrun,
+    ⟨value, env, rfl, hframe, hown'⟩⟩
+
+theorem emit_call_progress {ctx : Ctx} {cur d : FnDef}
+    {address : Ixon.Address} {frame : List RVal → Prop}
+    {atoms : Array Atom} {args : List RVal} {argWorlds : List Owned}
+    {rest : List Root}
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnProgressContract ctx d argWorlds)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hlength : args.length = argWorlds.length) :
+    EmitProgress ctx cur (emitOp (.call address atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame d.result rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hargs, hown⟩ := hpre
+  obtain ⟨fuel, store', value, hrun, hown'⟩ :=
+    runOp_call_progress hargs hdecl hprogress hownership hlength hown
+  exact ⟨fuel, store', value, hrun,
+    ⟨value, env, rfl, hframe, hown'⟩⟩
+
+theorem emit_callSelf_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {atoms : Array Atom}
+    {args : List RVal} {argWorlds : List Owned} {rest : List Root}
+    (hprogress : FnProgressContract ctx cur argWorlds)
+    (hownership : FnOwnershipContract ctx cur argWorlds)
+    (hlength : args.length = argWorlds.length) :
+    EmitProgress ctx cur (emitOp (.callSelf atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame cur.result rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hargs, hown⟩ := hpre
+  obtain ⟨fuel, store', value, hrun, hown'⟩ :=
+    runOp_callSelf_progress hargs hprogress hownership hlength hown
+  exact ⟨fuel, store', value, hrun,
+    ⟨value, env, rfl, hframe, hown'⟩⟩
+
+theorem emit_drop_value_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitProgress ctx cur (emitOp (.drop target))
+      (fun store env => frame env ∧ resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.shared, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases value with
+  | lit literal =>
+    have hrun : runOp ctx 1 cur store env (.drop target) =
+        .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, .erased, hrun,
+      ⟨.erased, env, rfl, hframe, hown.dropNoLocation rfl⟩⟩
+  | erased =>
+    have hrun : runOp ctx 1 cur store env (.drop target) =
+        .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, .erased, hrun,
+      ⟨.erased, env, rfl, hframe, hown.dropNoLocation rfl⟩⟩
+  | loc loc =>
+    obtain ⟨fuel, store', hdrop, hown'⟩ := dropVal_progress hown
+    have hrun := runOp_drop (ctx := ctx) (cur := cur) (fuel := fuel)
+      hresolve hdrop
+    exact ⟨fuel + 1, store', .erased, hrun,
+      ⟨.erased, env, rfl, hframe, hown'⟩⟩
+
+/-! ## Erased-result argument-release progress -/
+
+/-- Skipping a stable scalar argument is an identity progress
+transformation on the remaining semantic argument vector. -/
+theorem discard_const_arg_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {atom : Atom}
+    {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur (_root_.id : Emit)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.constA atom :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons headWorld tailWorlds headAV tailAVs value tailValues hav htail =>
+    cases hvalueGraphs with
+    | cons hvalueGraph htailGraphs =>
+      have howned : RootOwnership store
+          (⟨.shared, value⟩ ::
+            (rootsForWorlds worlds tailValues ++ roots ++ rest)) := by
+        simpa [rootsForWorlds] using hown
+      exact ⟨⟨roots, tailValues, hΓ, htail, htailGraphs,
+        hrestGraph,
+        howned.dropNoLocation (hstable.const_noLocation hav)⟩,
+        hslots⟩
+
+/-- Forgetting an ownership-inert scalar result also progresses by an
+identity transformation. -/
+theorem discard_const_result_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValue world (.constA atom) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+          sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, _, hrestGraph, hown⟩,
+      hslots⟩ := hpre
+  exact ⟨⟨roots, hΓ, hrestGraph,
+    hown.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- A slot-backed shared argument has a terminating deep release. The
+restriction theorem for that successful drop transports all surviving value
+graphs to the resulting store. -/
+theorem discard_slot_arg_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    (htailStable : AValsStable avs) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur (emitOp (.drop (.var (Γ.rel abs))))
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.slotA abs :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons headWorld tailWorlds headAV tailAVs value tailValues hav htail =>
+    cases hvalueGraphs with
+    | cons hvalueGraph htailGraphs =>
+      let remainingRoots :=
+        rootsForWorlds worlds tailValues ++ roots ++ rest
+      have howned : RootOwnership store
+          (⟨.shared, value⟩ :: remainingRoots) := by
+        simpa [remainingRoots, rootsForWorlds] using hown
+      have hresolve : resolveAtom env (.var (Γ.rel abs)) = .ok value := by
+        exact hav.resolveAtom
+      cases value with
+      | lit literal =>
+        have hrun : runOp ctx 1 cur store env
+            (.drop (.var (Γ.rel abs))) = .ok (store, .erased) := by
+          rw [runOp.eq_def]
+          dsimp only
+          rw [hresolve, bindOk]
+        exact ⟨1, store, .erased, hrun,
+          ⟨⟨roots, tailValues, hΓ.bump .erased,
+            htailStable.realize_bump htail .erased,
+            htailGraphs, hrestGraph, howned.dropNoLocation rfl⟩,
+            hslots.bump .erased⟩⟩
+      | erased =>
+        have hrun : runOp ctx 1 cur store env
+            (.drop (.var (Γ.rel abs))) = .ok (store, .erased) := by
+          rw [runOp.eq_def]
+          dsimp only
+          rw [hresolve, bindOk]
+        exact ⟨1, store, .erased, hrun,
+          ⟨⟨roots, tailValues, hΓ.bump .erased,
+            htailStable.realize_bump htail .erased,
+            htailGraphs, hrestGraph, howned.dropNoLocation rfl⟩,
+            hslots.bump .erased⟩⟩
+      | loc loc =>
+        obtain ⟨fuel, store', hdrop, _⟩ := dropVal_progress howned
+        have hrun := runOp_drop (ctx := ctx) (cur := cur) (fuel := fuel)
+          hresolve hdrop
+        obtain ⟨_, hrestrict, hownAfter⟩ :=
+          runOp_drop_value_owned_restricts hresolve howned hrun
+        have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+            Γ sourceEnv env roots :=
+          hΓ.ofRestricts hrestrict hownAfter
+            (fun root hmember => by
+              simp [remainingRoots, hmember])
+        have hlength : worlds.length = tailValues.length :=
+          htail.lengths.1.trans htail.lengths.2
+        have htailGraphsAfter :
+            Sim.ValuesGraph funRel store' sources tailValues :=
+          htailGraphs.ofRestrictsIn hrestrict hownAfter
+            (fun runtime hmember => by
+              obtain ⟨runtimeWorld, hroot⟩ :=
+                exists_root_mem_rootsForWorlds hlength hmember
+              exact ⟨runtimeWorld, by
+                simp [remainingRoots, hroot]⟩)
+        have hrestAfter : Sim.RootsGraph funRel store'
+            sourceRest rest :=
+          hrestGraph.ofRestrictsIn hrestrict hownAfter
+            (fun root hmember => by
+              simp [remainingRoots, hmember])
+        refine ⟨fuel + 1, store', .erased, hrun, ?_⟩
+        exact ⟨⟨roots, tailValues, hΓAfter.bump .erased,
+          htailStable.realize_bump htail .erased,
+          htailGraphsAfter, hrestAfter, hownAfter⟩,
+          hslots.bump .erased⟩
+
+/-- Stable argument descriptors determine a terminating `releaseAll`
+emitter that consumes every shared temporary owner. -/
+theorem releaseAll_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur (releaseAll Γ avs).2
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv sourceValues (List.replicate avs.length .shared)
+          avs sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          (releaseAll Γ avs).1 sourceEnv sourceRest rest slots) := by
+  apply AValsStable.traverseAligned
+    (Result := fun Γ sourceValues avs =>
+      ∀ sourceRest rest slots,
+        EmitProgress ctx cur (releaseAll Γ avs).2
+          (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+            sourceEnv sourceValues (List.replicate avs.length .shared)
+            avs sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel
+            (releaseAll Γ avs).1 sourceEnv sourceRest rest slots))
+    (hstable := hstable) (hlength := hsourceLength)
+  · intro Γ sourceRest rest slots
+    apply EmitProgress.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases havs
+    cases hvalueGraphs
+    exact ⟨⟨roots, hΓ, hrestGraph,
+      by simpa [rootsForWorlds] using hown⟩, hslots⟩
+  · intro Γ source sources abs avs htail ih sourceRest rest slots
+    have hcomposed := EmitProgress.comp
+      (discard_slot_arg_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ)
+        (sourceEnv := sourceEnv) (source := source)
+        (sources := sources) (abs := abs)
+        (worlds := List.replicate avs.length .shared)
+        (avs := avs) htail sourceRest rest slots)
+      (ih sourceRest rest slots)
+    simpa [releaseAll, List.replicate_succ] using hcomposed
+  · intro Γ source sources literal avs htail ih sourceRest rest slots
+    have hcomposed := EmitProgress.comp
+      (discard_const_arg_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ)
+        (sourceEnv := sourceEnv) (source := source)
+        (sources := sources) (atom := .lit literal)
+        (worlds := List.replicate avs.length .shared)
+        (avs := avs) AValStable.lit sourceRest rest slots)
+      (ih sourceRest rest slots)
+    simpa [releaseAll, List.replicate_succ, Function.comp_def] using
+      hcomposed
+  · intro Γ source sources avs htail ih sourceRest rest slots
+    have hcomposed := EmitProgress.comp
+      (discard_const_arg_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := Γ)
+        (sourceEnv := sourceEnv) (source := source)
+        (sources := sources) (atom := .erased)
+        (worlds := List.replicate avs.length .shared)
+        (avs := avs) AValStable.erased sourceRest rest slots)
+      (ih sourceRest rest slots)
+    simpa [releaseAll, List.replicate_succ, Function.comp_def] using
+      hcomposed
+
+/-- Progressing erased-function and argument emitters compose with total
+argument release and the ownership-inert erased result. -/
+theorem LowerResultValueProgress.discardArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceValues :
+      List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emitArgs : Emit}
+    {avs : List AVal}
+    (hfunction : LowerResultValueProgress funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased))
+    (hargs : LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceMiddle sourceOutput sourceValues
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    LowerResultValueProgress funRel recSelfRel ctx cur start
+      (releaseAll output avs).1 sourceStart sourceOutput .erased resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.discardArgs
+          hargs.toLowerArgsValueSound hsourceLength
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitProgress.comp
+    (hfunction.graphProgress sourceRest rest slots)
+    (EmitProgress.comp
+      (discard_const_result_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := input)
+        (sourceEnv := sourceMiddle) (sourceValue := IxIR0.Value.erased)
+        AValStable.erased sourceRest rest slots)
+      (EmitProgress.comp (hargs.graphProgress sourceRest rest slots)
+        (EmitProgress.comp
+          (releaseAll_value_progress
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := output)
+            (sourceEnv := sourceOutput) hargs.stable hsourceLength
+            sourceRest rest slots)
+          ((lower_erased_value_progress
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur)
+            (input := (releaseAll output avs).1)
+            (sourceEnv := sourceOutput) (world := resultWorld)).graphProgress
+              sourceRest rest slots))))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Settlement counterpart of erased-function application.  Every
+successfully reached phase preserves the same graph invariant, while an
+ordinary-stuck prefix closes the composed emitter immediately. -/
+theorem LowerResultValueSettlement.discardArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceValues :
+      List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emitArgs : Emit}
+    {avs : List AVal}
+    (hfunction : LowerResultValueSettlement funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased))
+    (hargs : LowerArgsValueSettlement funRel recSelfRel ctx cur input output
+      sourceMiddle sourceOutput sourceValues
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur start
+      (releaseAll output avs).1 sourceStart sourceOutput .erased resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound :=
+        hfunction.toLowerResultValueSound.discardArgs
+          hargs.toLowerArgsValueSound hsourceLength
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSettlement.comp
+    (hfunction.graphSettlement sourceRest rest slots)
+    (EmitSettlement.comp
+      (discard_const_result_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := input)
+        (sourceEnv := sourceMiddle) (sourceValue := IxIR0.Value.erased)
+        AValStable.erased sourceRest rest slots).settles
+      (EmitSettlement.comp (hargs.graphSettlement sourceRest rest slots)
+        (EmitSettlement.comp
+          (releaseAll_value_progress
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := output)
+            (sourceEnv := sourceOutput) hargs.stable hsourceLength
+            sourceRest rest slots).settles
+          ((lower_erased_value_progress
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur)
+            (input := (releaseAll output avs).1)
+            (sourceEnv := sourceOutput) (world := resultWorld)).graphProgress
+              sourceRest rest slots).settles)))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Reachable-state erased application progress. Every argument is evaluated
+and its shared temporary owner is then released before returning erased. -/
+theorem applyRest_erased_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueProgress funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  simp only [applyRest] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+  have hpure :
+      ((releaseAll argsOutput avs).1,
+        (emitFunction ∘ emitArgs) ∘ (releaseAll argsOutput avs).2,
+        AVal.constA .erased) = (output, emit, av) ∧
+        argsState = finalState := by
+    simpa [Function.comp_def] using hpureRun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+      sourceArgs := by
+    simpa [Function.comp_def] using hsourceArgs
+  have hargsProgress := hargs hsourcePaired hargsRun hextends havailable
+  have havsLength : avs.length = args.length := by
+    simpa using lowerArgs_success_length src hargsRun
+  have hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared := by
+    simpa [havsLength] using map_shared_arg_worlds args
+  have hhomogeneous : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input argsOutput sourceMiddle sourceMiddle sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs := by
+    simpa [hworldsHomogeneous] using hargsProgress
+  have hsourceLength : sourceArgs.length = avs.length := by
+    rw [← hsourceArgs.lengths, ← havsLength]
+  simpa [Function.comp_def] using
+    hfunction.discardArgs hhomogeneous hsourceLength
+
+/-- Projection-safe erased application still evaluates and releases every
+argument; the only change from the generic helper is the stronger recursive
+argument witness. -/
+theorem applyRest_erased_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceArgs : ProjectionSafeArgs sourceCtx sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueProgress funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  simp only [applyRest] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+  have hpure :
+      ((releaseAll argsOutput avs).1,
+        (emitFunction ∘ emitArgs) ∘ (releaseAll argsOutput avs).2,
+        AVal.constA .erased) = (output, emit, av) ∧
+        argsState = finalState := by
+    simpa [Function.comp_def] using hpureRun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  have hsourcePaired : ProjectionSafeArgs sourceCtx sourceMiddle
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+      sourceArgs := by
+    simpa [Function.comp_def] using hsourceArgs
+  have hargsProgress := hargs hsourcePaired hargsRun hextends havailable
+  have havsLength : avs.length = args.length := by
+    simpa using lowerArgs_success_length src hargsRun
+  have hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared := by
+    simpa [havsLength] using map_shared_arg_worlds args
+  have hhomogeneous : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input argsOutput sourceMiddle sourceMiddle sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs := by
+    simpa [hworldsHomogeneous] using hargsProgress
+  have hsourceLength : sourceArgs.length = avs.length := by
+    rw [← hsourceArgs.lengths, ← havsLength]
+  simpa [Function.comp_def] using
+    hfunction.discardArgs hhomogeneous hsourceLength
+
+/-- An erased spine head progresses through argument evaluation and total
+temporary release. -/
+theorem lowerSpine_erased_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨_, hhead⟩ := hhead
+    have herasedEval : IxIR0.eval sourceCtx 1 sourceEnv .erased =
+        .ok .erased := by
+      simp [IxIR0.eval]
+    have hheadValue : headValue = .erased :=
+      sourceEval_ok_unique hhead herasedEval
+    subst headValue
+    have hresult : sourceResult = .erased :=
+      happlies.deterministic (SourceApplies.erased sourceCtx argumentValues)
+    subst sourceResult
+    apply applyRest_erased_run_value_progress_within hargs harguments
+      (lower_erased_value_progress (funRel := funRel)
+        (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+        (sourceEnv := sourceEnv) (world := .shared))
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+
+/-- Reachable-state recursive-self spine progress. Realizable self markers
+cannot advertise a mismatched target arity because their source-guided body
+progress contract carries the current function's arity equation. -/
+theorem lowerSpine_recSelf_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (trackedThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state = .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        exact knownCall_callSelf_current_run_value_progress_within
+          hargs hrest hcount hentry hsourceHead hself hsourceArgs
+          hsourceApply hrun hextends havailable
+
+/-- Dynamic spine progress lowers the function expression, reflects the
+erased descriptor when necessary, and otherwise consumes higher-order apply
+progress for the argument tail. -/
+theorem lowerSpine_dynamic_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_dynamic_run_inv hshape hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hfunctionProgress :=
+      hexpr hhead hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_progress_within hargs hsourceArgs
+        hfunctionProgress hrestRun hextends hfunctionAvailable
+    · exact hrest herased hsourceArgs hsourceApply hfunctionProgress
+        hrestRun hextends hfunctionAvailable
+
+/-- Variable dynamic heads use the dedicated inversion that excludes the
+synthetic recursive-self lowering branch. -/
+theorem lowerSpine_var_dynamic_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_var_dynamic_run_inv hnotSelf hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hfunctionProgress :=
+      hexpr hhead hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_progress_within hargs hsourceArgs
+        hfunctionProgress hrestRun hextends hfunctionAvailable
+    · exact hrest herased hsourceArgs hsourceApply hfunctionProgress
+        hrestRun hextends hfunctionAvailable
+
+/-- One complete reachable-state spine progress step. All recursive calls
+are constrained to the ambient whole-pass state, matching the partial
+correctness cluster's fuel decomposition. -/
+theorem lowerSpine_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases head with
+  | app function argument =>
+    apply hspine hsource.flattenApp
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+  | erased =>
+    exact lowerSpine_erased_run_value_progress_within hargs hsource hrun
+      hextends havailable
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none =>
+      exact lowerSpine_var_dynamic_run_value_progress_within hexpr hreflect
+        hargs hrestNext (fun arity => by simp [hentry]) hsource hrun
+        hextends havailable
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        cases havailable with
+        | inl hself =>
+          exact lowerSpine_recSelf_run_value_progress_within hargs hrest
+            hentry hself hsource hrun hextends
+            (SelfProgressAvailable.of_contract hself)
+        | inr hno => exact (hno index arity hentry).elim
+      | slot abs remaining uses held =>
+        exact lowerSpine_var_dynamic_run_value_progress_within hexpr
+          hreflect hargs hrestNext (fun arity => by simp [hentry])
+          hsource hrun hextends havailable
+  | ref address =>
+    exact lowerSpine_ref_run_value_progress_within henv hargs hrest
+      hknownExtra hcontracts hvalues hprogress hsource hrun hextends
+      hrepresented havailable
+  | lam uses body =>
+    exact lowerSpine_dynamic_run_value_progress_within hexpr hreflect hargs
+      hrestNext (.lam uses body) hsource hrun hextends havailable
+  | letE uses value body =>
+    exact lowerSpine_dynamic_run_value_progress_within hexpr hreflect hargs
+      hrestNext (.letE uses value body) hsource hrun hextends havailable
+  | proj index value =>
+    exact lowerSpine_dynamic_run_value_progress_within hexpr hreflect hargs
+      hrestNext (.proj index value) hsource hrun hextends havailable
+  | lit literal =>
+    exact lowerSpine_dynamic_run_value_progress_within hexpr hreflect hargs
+      hrestNext (.lit literal) hsource hrun hextends havailable
+
+/-- Reachable-state erased application progress. Every argument is evaluated
+and its shared temporary owner is then released before returning erased. -/
+theorem lowerSpine_erased_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨_, hhead⟩ := hhead.eval
+    have herasedEval : IxIR0.eval sourceCtx 1 sourceEnv .erased =
+        .ok .erased := by
+      simp [IxIR0.eval]
+    have hheadValue : headValue = .erased :=
+      sourceEval_ok_unique hhead herasedEval
+    subst headValue
+    have hresult : sourceResult = .erased :=
+      happlies.deterministic (SourceApplies.erased sourceCtx argumentValues)
+    subst sourceResult
+    apply applyRest_erased_run_value_progress_safely_within hargs harguments
+      (lower_erased_value_progress (funRel := funRel)
+        (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+        (sourceEnv := sourceEnv) (world := .shared))
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+
+/-- Reachable-state recursive-self spine progress. Realizable self markers
+cannot advertise a mismatched target arity because their source-guided body
+progress contract carries the current function's arity equation. -/
+theorem lowerSpine_recSelf_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead.eval
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (trackedThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state = .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        exact knownCall_callSelf_current_run_value_progress_safely_within
+          hargs hrest hcount hentry hsourceHead hself hsourceArgs
+          hsourceApply hrun hextends havailable
+
+/-- Dynamic spine progress lowers the function expression, reflects the
+erased descriptor when necessary, and otherwise consumes higher-order apply
+progress for the argument tail. -/
+theorem lowerSpine_dynamic_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hheadSafe hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hheadSafe.eval
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_dynamic_run_inv hshape hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hfunctionProgress :=
+      hexpr hheadSafe hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_progress_safely_within hargs hsourceArgs
+        hfunctionProgress hrestRun hextends hfunctionAvailable
+    · exact hrest herased hsourceArgs hsourceApply hfunctionProgress
+        hrestRun hextends hfunctionAvailable
+
+/-- Variable dynamic heads use the dedicated inversion that excludes the
+synthetic recursive-self lowering branch. -/
+theorem lowerSpine_var_dynamic_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesSafelyWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hheadSafe hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hheadSafe.eval
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_var_dynamic_run_inv hnotSelf hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hfunctionProgress :=
+      hexpr hheadSafe hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_progress_safely_within hargs hsourceArgs
+        hfunctionProgress hrestRun hextends hfunctionAvailable
+    · exact hrest herased hsourceArgs hsourceApply hfunctionProgress
+        hrestRun hextends hfunctionAvailable
+
+/-- One complete reachable-state spine progress step. All recursive calls
+are constrained to the ambient whole-pass state, matching the partial
+correctness cluster's fuel decomposition. -/
+theorem lowerSpine_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : ProjectionSafeSpine sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases head with
+  | app function argument =>
+    apply hspine hsource.flattenApp
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+  | erased =>
+    exact lowerSpine_erased_run_value_progress_safely_within hargs hsource hrun
+      hextends havailable
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none =>
+      exact lowerSpine_var_dynamic_run_value_progress_safely_within hexpr hreflect
+        hargs hrestNext (fun arity => by simp [hentry]) hsource hrun
+        hextends havailable
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        cases havailable with
+        | inl hself =>
+          exact lowerSpine_recSelf_run_value_progress_safely_within hargs hrest
+            hentry hself hsource hrun hextends
+            (SelfProgressAvailable.of_contract hself)
+        | inr hno => exact (hno index arity hentry).elim
+      | slot abs remaining uses held =>
+        exact lowerSpine_var_dynamic_run_value_progress_safely_within hexpr
+          hreflect hargs hrestNext (fun arity => by simp [hentry])
+          hsource hrun hextends havailable
+  | ref address =>
+    exact lowerSpine_ref_run_value_progress_safely_within henv hargs hrest
+      hknownExtra hcontracts hvalues hprogress hsource hrun hextends
+      hrepresented havailable
+  | lam uses body =>
+    exact lowerSpine_dynamic_run_value_progress_safely_within hexpr hreflect hargs
+      hrestNext (.lam uses body) hsource hrun hextends havailable
+  | letE uses value body =>
+    exact lowerSpine_dynamic_run_value_progress_safely_within hexpr hreflect hargs
+      hrestNext (.letE uses value body) hsource hrun hextends havailable
+  | proj index value =>
+    exact lowerSpine_dynamic_run_value_progress_safely_within hexpr hreflect hargs
+      hrestNext (.proj index value) hsource hrun hextends havailable
+  | lit literal =>
+    exact lowerSpine_dynamic_run_value_progress_safely_within hexpr hreflect hargs
+      hrestNext (.lit literal) hsource hrun hextends havailable
+
+/-! Exact-trace complete spine progress. -/
+
+/-- Exact-trace erased application still evaluates and releases every
+argument while preserving their common source bound. -/
+theorem applyRest_erased_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel sourceLimit : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceBound : sourceLimit < limit)
+    (hsourceArgs : IxIR0.ProjectionSafe.EvalsBelow sourceCtx sourceLimit
+      sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueProgress funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  simp only [applyRest] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+  have hpure :
+      ((releaseAll argsOutput avs).1,
+        (emitFunction ∘ emitArgs) ∘ (releaseAll argsOutput avs).2,
+        AVal.constA .erased) = (output, emit, av) ∧
+        argsState = finalState := by
+    simpa [Function.comp_def] using hpureRun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  have hsourcePaired : IxIR0.ProjectionSafe.EvalsBelow sourceCtx
+      sourceLimit sourceMiddle
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+      sourceArgs := by
+    simpa [Function.comp_def] using hsourceArgs
+  have hargsProgress := hargs hsourceBound hsourcePaired hargsRun hextends
+    havailable
+  have havsLength : avs.length = args.length := by
+    simpa using lowerArgs_success_length src hargsRun
+  have hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared := by
+    simpa [havsLength] using map_shared_arg_worlds args
+  have hhomogeneous : LowerArgsValueProgress funRel recSelfRel ctx cur
+      input argsOutput sourceMiddle sourceMiddle sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs := by
+    simpa [hworldsHomogeneous] using hargsProgress
+  have hsourceLength : sourceArgs.length = avs.length := by
+    rw [← hsourceArgs.lengths, ← havsLength]
+  simpa [Function.comp_def] using
+    hfunction.discardArgs hhomogeneous hsourceLength
+
+/-- An erased exact-trace spine progresses through argument evaluation and
+total temporary release. -/
+theorem lowerSpine_erased_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsourceBound : sourceLimit < limit)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      .erased args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  cases hsource with
+  | @intro headFuel headValue _ _ _ argumentValues hheadBound hhead
+      harguments happlies =>
+    have herasedEval : IxIR0.eval sourceCtx 1 sourceEnv .erased =
+        .ok .erased := by
+      simp [IxIR0.eval]
+    have hheadValue : headValue = .erased :=
+      sourceEval_ok_unique hhead.run herasedEval
+    subst headValue
+    have hresult : sourceResult = .erased :=
+      (SourceAppliesSafelyBelow.sourceApplies happlies).deterministic
+        (SourceApplies.erased sourceCtx argumentValues)
+    subst sourceResult
+    apply applyRest_erased_run_value_trace_progress_within_below hargs
+      hsourceBound harguments
+      (lower_erased_value_progress (funRel := funRel)
+        (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+        (sourceEnv := sourceEnv) (world := .shared))
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+
+/-- Exact-trace recursive-self spine progress. -/
+theorem lowerSpine_recSelf_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit fuel : Nat}
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hsourceBound : sourceLimit < limit)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfTraceProgressContractBelow funRel recSelfRel
+      sourceCtx ctx cur limit)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.var index) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  cases hsource with
+  | @intro headFuel sourceFunction _ _ _ sourceValues hheadBound hhead
+      hsourceArgs hsourceApply =>
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead.run
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (trackedThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state = .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        exact knownCall_callSelf_current_run_value_trace_progress_within_below
+          hargs hrest hsourceBound hcount hentry hsourceHead hself
+          hsourceArgs hsourceApply hrun hextends havailable
+
+/-- Dynamic exact-trace spine progress lowers the function expression and
+then consumes the bounded higher-order application trace. -/
+theorem lowerSpine_dynamic_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel : Nat}
+    (hexpr : LowerEValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hargsNonempty : args ≠ [])
+    (hsourceBound : sourceLimit < limit)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  cases hsource with
+  | @intro headFuel sourceFunction _ _ _ sourceArgs hheadBound hhead
+      hsourceArgs hsourceApply =>
+    have hsourceArgsNonempty : sourceArgs ≠ [] := by
+      intro hnil
+      have hargsLengthZero : args.length = 0 := by
+        simpa [hnil] using hsourceArgs.lengths
+      exact hargsNonempty (List.eq_nil_of_length_eq_zero hargsLengthZero)
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_dynamic_run_inv hshape hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hheadOuter : headFuel < limit :=
+      Nat.lt_of_le_of_lt hheadBound hsourceBound
+    have hfunctionProgress :=
+      hexpr hheadOuter hhead hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead.run hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        (SourceAppliesSafelyBelow.sourceApplies hsourceApply).deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_trace_progress_within_below hargs
+        hsourceBound hsourceArgs hfunctionProgress hrestRun hextends
+        hfunctionAvailable
+    · exact hrest hsourceBound herased hsourceArgs hsourceApply
+        hsourceArgsNonempty hfunctionProgress hrestRun hextends
+        hfunctionAvailable
+
+/-- Variable dynamic heads use exact source traces while excluding the
+synthetic recursive-self lowering branch. -/
+theorem lowerSpine_var_dynamic_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceLimit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel : Nat}
+    (hexpr : LowerEValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow funRel
+      recSelfRel sourceCtx ctx cur limit src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hargsNonempty : args ≠ [])
+    (hsourceBound : sourceLimit < limit)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      (.var index) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  cases hsource with
+  | @intro headFuel sourceFunction _ _ _ sourceArgs hheadBound hhead
+      hsourceArgs hsourceApply =>
+    have hsourceArgsNonempty : sourceArgs ≠ [] := by
+      intro hnil
+      have hargsLengthZero : args.length = 0 := by
+        simpa [hnil] using hsourceArgs.lengths
+      exact hargsNonempty (List.eq_nil_of_length_eq_zero hargsLengthZero)
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_var_dynamic_run_inv hnotSelf hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hheadOuter : headFuel < limit :=
+      Nat.lt_of_le_of_lt hheadBound hsourceBound
+    have hfunctionProgress :=
+      hexpr hheadOuter hhead hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead.run hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        (SourceAppliesSafelyBelow.sourceApplies hsourceApply).deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_trace_progress_within_below hargs
+        hsourceBound hsourceArgs hfunctionProgress hrestRun hextends
+        hfunctionAvailable
+    · exact hrest hsourceBound herased hsourceArgs hsourceApply
+        hsourceArgsNonempty hfunctionProgress hrestRun hextends
+        hfunctionAvailable
+
+/-- One complete exact-trace reachable-state spine progress step. -/
+theorem lowerSpine_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hexpr : LowerEValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {sourceLimit : Nat}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsourceBound : sourceLimit < limit)
+    (hsource : IxIR0.ProjectionSafe.Spine sourceCtx sourceLimit sourceEnv
+      head args sourceResult)
+    (hcallable : args ≠ [] ∨ ∃ targetAddress,
+      head = .ref targetAddress)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  have hargsNonempty (hnotRef : ¬ ∃ targetAddress,
+      head = IxIR0.Expr.ref targetAddress) : args ≠ [] :=
+    Or.resolve_right hcallable hnotRef
+  cases head with
+  | app function argument =>
+    apply hspine hsourceBound hsource.flattenApp
+    · exact Or.inl (by simp)
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+  | erased =>
+    exact lowerSpine_erased_run_value_trace_progress_within_below hargs
+      hsourceBound hsource hrun hextends havailable
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none =>
+      exact lowerSpine_var_dynamic_run_value_trace_progress_within_below
+        hexpr hreflect hargs hrestNext (fun arity => by simp [hentry])
+        (hargsNonempty (by simp)) hsourceBound hsource hrun hextends
+        havailable
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        cases havailable with
+        | inl hself =>
+          exact lowerSpine_recSelf_run_value_trace_progress_within_below
+            hargs hrest hsourceBound hentry hself hsource hrun hextends
+            (SelfTraceProgressAvailableBelow.of_contract hself)
+        | inr hno => exact (hno index arity hentry).elim
+      | slot abs remaining uses held =>
+        exact lowerSpine_var_dynamic_run_value_trace_progress_within_below
+          hexpr hreflect hargs hrestNext (fun arity => by simp [hentry])
+          (hargsNonempty (by simp)) hsourceBound hsource hrun hextends
+          havailable
+  | ref address =>
+    exact lowerSpine_ref_run_value_trace_progress_within_below henv hargs
+      hrest hknownExtra hcontracts hvalues hprogress hsourceBound hsource
+      hrun hextends hrepresented havailable
+  | lam uses body =>
+    exact lowerSpine_dynamic_run_value_trace_progress_within_below hexpr
+      hreflect hargs hrestNext (.lam uses body) (hargsNonempty (by simp))
+      hsourceBound hsource hrun hextends havailable
+  | letE uses value body =>
+    exact lowerSpine_dynamic_run_value_trace_progress_within_below hexpr
+      hreflect hargs hrestNext (.letE uses value body)
+      (hargsNonempty (by simp)) hsourceBound hsource hrun hextends havailable
+  | proj index value =>
+    exact lowerSpine_dynamic_run_value_trace_progress_within_below hexpr
+      hreflect hargs hrestNext (.proj index value) (hargsNonempty (by simp))
+      hsourceBound hsource hrun hextends havailable
+  | lit literal =>
+    exact lowerSpine_dynamic_run_value_trace_progress_within_below hexpr
+      hreflect hargs hrestNext (.lit literal) (hargsNonempty (by simp))
+      hsourceBound hsource hrun hextends havailable
+
+/-- Reachable-state erased application progress. Every argument is evaluated
+and its shared temporary owner is then released before returning erased. -/
+
+theorem applyRest_erased_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueSettlement funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  simp only [applyRest] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+  have hpure :
+      ((releaseAll argsOutput avs).1,
+        (emitFunction ∘ emitArgs) ∘ (releaseAll argsOutput avs).2,
+        AVal.constA .erased) = (output, emit, av) ∧
+        argsState = finalState := by
+    simpa [Function.comp_def] using hpureRun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+      sourceArgs := by
+    simpa [Function.comp_def] using hsourceArgs
+  have hargsProgress := hargs hsourcePaired hargsRun hextends havailable
+  have havsLength : avs.length = args.length := by
+    simpa using lowerArgs_success_length src hargsRun
+  have hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared := by
+    simpa [havsLength] using map_shared_arg_worlds args
+  have hhomogeneous : LowerArgsValueSettlement funRel recSelfRel ctx cur
+      input argsOutput sourceMiddle sourceMiddle sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs := by
+    simpa [hworldsHomogeneous] using hargsProgress
+  have hsourceLength : sourceArgs.length = avs.length := by
+    rw [← hsourceArgs.lengths, ← havsLength]
+  simpa [Function.comp_def] using
+    hfunction.discardArgs hhomogeneous hsourceLength
+
+/-- An erased spine head progresses through argument evaluation and total
+temporary release. -/
+theorem lowerSpine_erased_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨_, hhead⟩ := hhead
+    have herasedEval : IxIR0.eval sourceCtx 1 sourceEnv .erased =
+        .ok .erased := by
+      simp [IxIR0.eval]
+    have hheadValue : headValue = .erased :=
+      sourceEval_ok_unique hhead herasedEval
+    subst headValue
+    have hresult : sourceResult = .erased :=
+      happlies.deterministic (SourceApplies.erased sourceCtx argumentValues)
+    subst sourceResult
+    apply applyRest_erased_run_value_settlement_within hargs harguments
+      (lower_erased_value_progress (funRel := funRel)
+        (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+        (sourceEnv := sourceEnv) (world := .shared)).settlement
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+
+/-- Reachable-state recursive-self spine progress. Realizable self markers
+cannot advertise a mismatched target arity because their source-guided body
+progress contract carries the current function's arity equation. -/
+theorem lowerSpine_recSelf_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfProgressContract funRel recSelfRel sourceCtx ctx cur)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (trackedThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state = .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        exact knownCall_callSelf_current_run_value_settlement_within
+          hargs hrest hcount hentry hsourceHead hself hsourceArgs
+          hsourceApply hrun hextends havailable
+
+/-- Dynamic spine progress lowers the function expression, reflects the
+erased descriptor when necessary, and otherwise consumes higher-order apply
+progress for the argument tail. -/
+theorem lowerSpine_dynamic_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_dynamic_run_inv hshape hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hfunctionProgress :=
+      hexpr hhead hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_settlement_within hargs hsourceArgs
+        hfunctionProgress hrestRun hextends hfunctionAvailable
+    · exact hrest herased hsourceArgs hsourceApply hfunctionProgress
+        hrestRun hextends hfunctionAvailable
+
+/-- Variable dynamic heads use the dedicated inversion that excludes the
+synthetic recursive-self lowering branch. -/
+theorem lowerSpine_var_dynamic_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueSettlesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ :=
+      lowerSpine_var_dynamic_run_inv hnotSelf hrun
+    have hfunctionExtends : ExtraExtends middleState ambient :=
+      (applyRest_extraExtends hrestRun).trans hextends
+    have hfunctionProgress :=
+      hexpr hhead hfunctionRun hfunctionExtends havailable
+    have hfunctionAvailable := havailable.lowerE hfunctionRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact applyRest_erased_run_value_settlement_within hargs hsourceArgs
+        hfunctionProgress hrestRun hextends hfunctionAvailable
+    · exact hrest herased hsourceArgs hsourceApply hfunctionProgress
+        hrestRun hextends hfunctionAvailable
+
+/-- One complete reachable-state spine progress step. All recursive calls
+are constrained to the ambient whole-pass state, matching the partial
+correctness cluster's fuel decomposition. -/
+theorem lowerSpine_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  cases head with
+  | app function argument =>
+    apply hspine hsource.flattenApp
+    · simpa [lowerSpine] using hrun
+    · exact hextends
+    · exact havailable
+  | erased =>
+    exact lowerSpine_erased_run_value_settlement_within hargs hsource hrun
+      hextends havailable
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none =>
+      exact lowerSpine_var_dynamic_run_value_settlement_within hexpr hreflect
+        hargs hrestNext (fun arity => by simp [hentry]) hsource hrun
+        hextends havailable
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        cases havailable with
+        | inl hself =>
+          exact lowerSpine_recSelf_run_value_settlement_within hargs hrest
+            hentry hself hsource hrun hextends
+            (SelfProgressAvailable.of_contract hself)
+        | inr hno => exact (hno index arity hentry).elim
+      | slot abs remaining uses held =>
+        exact lowerSpine_var_dynamic_run_value_settlement_within hexpr
+          hreflect hargs hrestNext (fun arity => by simp [hentry])
+          hsource hrun hextends havailable
+  | ref address =>
+    exact lowerSpine_ref_run_value_settlement_within henv hargs hrest
+      hknownExtra hcontracts hvalues hprogress hsource hrun hextends
+      hrepresented havailable
+  | lam uses body =>
+    exact lowerSpine_dynamic_run_value_settlement_within hexpr hreflect hargs
+      hrestNext (.lam uses body) hsource hrun hextends havailable
+  | letE uses value body =>
+    exact lowerSpine_dynamic_run_value_settlement_within hexpr hreflect hargs
+      hrestNext (.letE uses value body) hsource hrun hextends havailable
+  | proj index value =>
+    exact lowerSpine_dynamic_run_value_settlement_within hexpr hreflect hargs
+      hrestNext (.proj index value) hsource hrun hextends havailable
+  | lit literal =>
+    exact lowerSpine_dynamic_run_value_settlement_within hexpr hreflect hargs
+      hrestNext (.lit literal) hsource hrun hextends havailable
+
+/-- Package the complete spine rule as the two-step recursive-interface
+constructor dictated by `lowerSpine`'s compiler-fuel accounting. -/
+theorem lowerSpineValueProgressesWithin_succ_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hrepresented : ExtraRepresented ctx ambient) :
+    LowerSpineValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 2) := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av hsource hrun hextends havailable
+  exact lowerSpine_run_value_progress_within henv hspine hexpr hreflect
+    hargs hrest hrestNext hknownExtra hcontracts hvalues hprogress hsource
+    hrun hextends hrepresented havailable
+
+/-- Package the complete spine rule as the two-step recursive-interface
+constructor dictated by `lowerSpine`'s compiler-fuel accounting. -/
+theorem lowerSpineValueProgressesSafelyWithin_succ_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hrepresented : ExtraRepresented ctx ambient) :
+    LowerSpineValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 2) := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av hsource hrun hextends havailable
+  exact lowerSpine_run_value_progress_safely_within henv hspine hexpr hreflect
+    hargs hrest hrestNext hknownExtra hcontracts hvalues hprogress hsource
+    hrun hextends hrepresented havailable
+
+/-- Package the complete spine rule as the two-step recursive-interface
+constructor dictated by `lowerSpine`'s compiler-fuel accounting. -/
+
+theorem lowerSpineValueSettlesWithin_succ_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hrepresented : ExtraRepresented ctx ambient) :
+    LowerSpineValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 2) := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av hsource hrun hextends havailable
+  exact lowerSpine_run_value_settlement_within henv hspine hexpr hreflect
+    hargs hrest hrestNext hknownExtra hcontracts hvalues hprogress hsource
+    hrun hextends hrepresented havailable
+
+/-- Standalone source references inherit static-spine progress through the
+empty-argument lowering correspondence. -/
+theorem lowerE_ref_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrest : ApplyRestNonErasedValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref f) =
+      .ok sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  apply lowerSpine_ref_run_value_progress_within henv hargs hrest
+    hknownExtra hcontracts hvalues hprogress
+      (SourceSpineEval.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+  · exact havailable
+
+/-- Projection-safe standalone references inherit static-spine progress
+through the empty-argument lowering correspondence. -/
+theorem lowerE_ref_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrest : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsource : ProjectionSafeEval sourceCtx sourceEnv (.ref f)
+      sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  apply lowerSpine_ref_run_value_progress_safely_within henv hargs hrest
+    hknownExtra hcontracts hvalues hprogress
+      (ProjectionSafeSpine.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+  · exact havailable
+
+/-- Standalone source references inherit static-spine progress through the
+empty-argument lowering correspondence. -/
+theorem lowerE_ref_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrest : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref f) =
+      .ok sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  apply lowerSpine_ref_run_value_settlement_within henv hargs hrest
+    hknownExtra hcontracts hvalues hprogress
+      (SourceSpineEval.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+  · exact havailable
+
+/-- A successful lambda-capture step has target progress.  The compiler can
+only move the final shared occurrence or retain a shared occurrence that is
+needed again after the lifted lambda has consumed its uses. -/
+theorem lowerCapture_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {e : IxIR0.Expr} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerCapture e input i).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  apply lowerCapture_run_core
+    (Result := fun output emit av =>
+      LowerResultValueProgress funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv sourceValue .shared emit av)
+    (hrun := hrun)
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry i
+      (.slot abs (remaining - countUses i e) uses true)
+    have hprogress := lower_held_retain_value_progress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur)
+      (newRemaining := remaining - countUses i e)
+      hsource hshared hentry
+    simpa [next] using hprogress
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry i (.slot abs 0 uses false)
+    have hprogress := lower_held_move_value_progress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) hsource hentry
+    simpa [next, hshared] using hprogress
+/-- The recursive capture traversal progresses through its homogeneous
+shared argument prefix in source-selection order. -/
+theorem lowerCaptures_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    (e : IxIR0.Expr) (caps : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv caps sourceValues)
+    (hrun : (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate caps.length .shared) emit values := by
+  apply ValuesAt.lowerCaptures_core
+    (e := e) (hselected := hselected) (hrun := hrun)
+  · intro input
+    exact lowerArgs_nil_value_progress
+  · intro index sourceValue rest sourceValues input middle output
+      headEmit tailEmit headValue tailValues state middleState
+      hsource hheadRun htail
+    have hhead := lowerCapture_run_value_progress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) hsource hheadRun
+    simpa [List.replicate_succ] using hhead.consArgs htail
+
+/-- Successful local-lambda lowering progresses through capture sequencing
+and the fresh partial-application allocation.  The generated body run records
+compiler provenance; it does not execute at the lambda site. -/
+theorem lowerLam_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {e : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv e [] sourceValue)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  apply lowerLam_run_value_core
+    (ArgsResult := fun selected captureOutput captureEmit captureValues =>
+      LowerArgsValueProgress funRel recSelfRel ctx cur
+        input captureOutput sourceEnv sourceEnv selected
+        (List.replicate captureValues.length .shared)
+        captureEmit captureValues)
+    (Result := fun _ output emit av =>
+      LowerResultValueProgress funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv sourceValue .shared emit av)
+    (hsourceLength := hsourceLength) (hprefix := hprefix)
+    (hinclude := hinclude) (hrepresented := hrepresented) (hrun := hrun)
+  · intro caps selected captureOutput captureEmit captureValues
+      _captureState _hcanonical hselected hcaptureRun hlength
+    have hcaptures := lowerCaptures_run_value_progress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) e caps hselected hcaptureRun
+    simpa [hlength] using hcaptures
+  · intro _caps _selected _captureOutput _captureEmit _captureValues
+      _fnAddr _code _bodyState _hcanonical hargs hdecl hfun hunder
+    apply hargs.papp_graph hdecl
+    · simpa only [declArity] using hfun
+    · simpa only [declArity] using hunder
+
+/-- The lambda branch of expression lowering progresses whenever its source
+environment has the logical length needed for capture selection. -/
+theorem lowerE_lam_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerE, huuEq] using hrun)).elim
+  | shared =>
+    have hlam : (lowerLam src fuel input (.lam uses body)).run state =
+        .ok (output, emit, av) finalState := by
+      simpa [lowerE, hsuEq] using hrun
+    exact lowerLam_run_value_progress hsourceLength .nil hinclude
+      hrepresented hlam
+
+/-- Premise-free lambda progress at the expression interface.  A realizable
+input supplies the capture-selection length equality; malformed inputs have
+an empty graph-owned precondition. -/
+theorem lowerE_lam_run_value_progress_any
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  by_cases hlength : sourceEnv.length = input.entries.length
+  · exact lowerE_lam_run_value_progress hlength hinclude hrepresented hrun
+  · have hsound : LowerResultSound ctx cur input output world emit av :=
+      LowerResultSound.of_below (fun limit =>
+        lowerE_lam_run_sound_below (limit := limit) hrepresented hrun)
+    exact hsound.valueProgress_of_sourceLength_ne hlength
+
+theorem emit_dropU_value_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitProgress ctx cur (emitOp (.dropU target))
+      (fun store env => frame env ∧ resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.unique, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases value with
+  | lit literal =>
+    have hrun : runOp ctx 1 cur store env (.dropU target) =
+        .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, .erased, hrun,
+      ⟨.erased, env, rfl, hframe, hown.dropNoLocation rfl⟩⟩
+  | erased =>
+    have hrun : runOp ctx 1 cur store env (.dropU target) =
+        .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, .erased, hrun,
+      ⟨.erased, env, rfl, hframe, hown.dropNoLocation rfl⟩⟩
+  | loc loc =>
+    obtain ⟨fuel, store', hdrop, hown'⟩ := dropUVal_progress hown
+    have hrun := runOp_dropU (ctx := ctx) (cur := cur) (fuel := fuel)
+      hresolve hdrop
+    exact ⟨fuel + 1, store', .erased, hrun,
+      ⟨.erased, env, rfl, hframe, hown'⟩⟩
+
+theorem emit_free_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {loc : Nat}
+    {node : Node} {rest : List Root} :
+    EmitProgress ctx cur (emitOp (.free target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        store.get? loc = some ⟨.unique, 1, node⟩ ∧
+        RootOwnership store (⟨.unique, .loc loc⟩ :: rest))
+      (OwnsAfterPush frame (rootsFor .unique (nodeChildren node) ++ rest)) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hbox, hown⟩ := hpre
+  have hop := runOp_free_owned (ctx := ctx) (cur := cur) (fuel := 0)
+    hresolve hbox hown
+  exact ⟨1, store.kill loc, .erased, hop.1,
+    ⟨.erased, env, rfl, hframe, hop.2⟩⟩
+
+theorem emit_fetch_borrowed_progress {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {loc rc i : Nat}
+    {cid : CtorId} {fields : Array RVal} {value : RVal}
+    {roots : List Root} (hfield : fields[i]? = some value) :
+    EmitProgress ctx cur (emitOp (.fetch target i))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        store.get? loc = some ⟨.shared, rc, .ctorN cid fields⟩ ∧
+        RootOwnership store roots)
+      (BorrowsPushed frame .shared roots) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hresolve, hbox, hown⟩ := hpre
+  have hop := runOp_fetch_borrowed (ctx := ctx) (cur := cur) (fuel := 0)
+    hresolve hbox hfield hown
+  exact ⟨1, store, value, hop.1,
+    ⟨value, env, rfl, hframe, hop.2, hown⟩⟩
+
+/-- Extern progress needs an explicit successful target oracle witness; the
+partial-correctness extern rule cannot manufacture one. -/
+theorem emit_extern_progress {ctx : Ctx} {cur : FnDef}
+    {f : Ixon.Address} {frame : List RVal → Prop}
+    {atoms : Array Atom} {args : List RVal} {result : RVal}
+    {resultWorld : Owned} {rest : List Root} :
+    EmitProgress ctx cur (emitOp (.extern f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        callScalarOracle ctx f args = .ok result ∧
+        RootOwnership store (rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame resultWorld rest) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨hframe, hargs, horacle, hown⟩ := hpre
+  have hrun : runOp ctx 1 cur store env (.extern f atoms) =
+      .ok (store, result) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hargs, bindOk, horacle, bindOk]
+  have hresult := runOp_extern_owned (ctx := ctx) (cur := cur)
+    (fuel := 0) (resultWorld := resultWorld) hargs hown hrun
+  exact ⟨1, store, result, hrun,
+    ⟨result, env, rfl, hframe, hresult⟩⟩
+
+/-! ## Constructor-projection progress -/
+
+/-- A graph-related constructor slot has a total in-bounds `fetch`, provided
+the function relation cannot also classify that constructor as a pap. -/
+theorem fetchBorrowSlot_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    (hnotFunction : ∀ f arity captures,
+      ¬ funRel (.ctor address tag sourceFields) f arity captures)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    EmitProgress ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) release
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) release
+        sourceRest rest slots) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨roots, targetValue, hΓ, htarget, htargetWorld,
+      htargetGraph, hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases htargetGraph with
+  | @ctor _ _ _ loc boxWorld rc cid fields hget hblock htag hfieldsGraph =>
+    obtain ⟨box, hworldGet, hboxWorld⟩ := htargetWorld
+    have hboxEq :
+        (⟨boxWorld, rc, .ctorN cid fields⟩ : NodeBox) = box :=
+      Option.some.inj (hget.symm.trans hworldGet)
+    subst box
+    dsimp only [NodeBox.world] at hboxWorld
+    subst boxWorld
+    obtain ⟨fieldValue, hfieldList, hfieldGraph⟩ :=
+      hfieldsGraph.get? hsourceField
+    have hfield : fields[index]? = some fieldValue := by
+      simpa using hfieldList
+    have hop := runOp_fetch_borrowed
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      hresolve hget hfield hown
+    refine ⟨1, store, fieldValue, hop.1, roots, .loc loc, fieldValue,
+      hΓ.bump fieldValue,
+      AValStable.slot.realize_bump htarget fieldValue, ?_,
+      ⟨⟨.shared, rc, .ctorN cid fields⟩, hget, rfl⟩, hop.2,
+      ?_, hfieldGraph,
+      hrestGraph, hown, hslots.bump fieldValue⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+    · exact .ctor hget hblock htag hfieldsGraph
+  | @function _ f arity captures loc rc args hget hrel hcaptures =>
+    exact (hnotFunction f arity captures hrel).elim
+
+/-- Retaining a fetched field is total because the borrow graph supplies its
+shared-world witness; the RC-only update preserves every graph in the frame. -/
+theorem retainFetchedBorrow_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs fieldAbs : Nat} {release : Bool}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitProgress ctx cur
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ sourceEnv
+        sourceTarget sourceField (.slotA targetAbs) (.slotA fieldAbs)
+        release sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA Γ.depth) release sourceRest rest slots) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨roots, targetValue, fieldValue, hΓ, htarget, hfield,
+      htargetWorld, hfieldWorld, htargetGraph, hfieldGraph,
+      hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok fieldValue := by
+    simpa [AVal.toAtom] using hfield.resolveAtom
+  obtain ⟨nextStore, hrun, hstore, hfieldGraphNext, hownNext⟩ :=
+    runOp_retain_borrowed_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      hresolve hfieldWorld hfieldGraph hown
+  refine ⟨1, nextStore, fieldValue, hrun, roots, targetValue,
+    fieldValue, (hΓ.monoStore hstore).bump fieldValue,
+    AValStable.slot.realize_bump htarget fieldValue, ?_,
+    htargetWorld.monoStore hstore, htargetGraph.monoStore hstore,
+    hfieldGraphNext, hrestGraph.monoStore hstore,
+    hownNext, hslots.bump fieldValue⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- A retained field whose target remains live is already a complete shared
+projection result. -/
+theorem retainedProjection_kept_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {target result : AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField target result false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ
+        sourceEnv sourceField .shared result sourceRest rest slots) := by
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+      htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+      hown, hslots⟩ := hpre
+  refine ⟨⟨roots, resultValue, hΓ, hresult, hresultGraph,
+    hrestGraph, ?_⟩, hslots⟩
+  simpa [borrowResultRoots] using hown
+
+/-- After retaining a final-use field, the target's shared owner can always
+be dropped; reverse graph restriction preserves the result and caller frame. -/
+theorem releaseRetainedProjection_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs resultAbs : Nat}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitProgress ctx cur
+      (emitOp (.drop (.var (Γ.rel targetAbs))))
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA resultAbs) true sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceField .shared (.slotA resultAbs)
+        sourceRest rest slots) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+      htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+      hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  let remainingRoots :=
+    ⟨Owned.shared, resultValue⟩ :: roots ++ rest
+  have howned : RootOwnership store
+      (⟨.shared, targetValue⟩ :: remainingRoots) := by
+    apply hown.perm
+    simpa [remainingRoots, borrowResultRoots] using
+      (List.Perm.swap ⟨Owned.shared, targetValue⟩
+        ⟨Owned.shared, resultValue⟩ (roots ++ rest))
+  have hfinish {store' : Store}
+      (hrestrict : Sim.StoreGraphRestricts store store')
+      (hownAfter : RootOwnership store' remainingRoots) :
+      GraphOwnsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceField .shared (.slotA resultAbs)
+        sourceRest rest slots store' (.erased :: env) := by
+    have hresultWorld : HasWorld store' .shared resultValue :=
+      hownAfter.roots_world ⟨.shared, resultValue⟩
+        (by simp [remainingRoots])
+    have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+        Γ sourceEnv env roots :=
+      hΓ.ofRestricts hrestrict hownAfter
+        (fun root hmember => by
+          simp [remainingRoots, hmember])
+    have hresultAfter : Sim.ValueGraph funRel store'
+        sourceField resultValue :=
+      hresultGraph.ofRestricts hrestrict hownAfter hresultWorld
+    have hrestAfter : Sim.RootsGraph funRel store'
+        sourceRest rest :=
+      hrestGraph.ofRestrictsIn hrestrict hownAfter
+        (fun root hmember => by
+          simp [remainingRoots, hmember])
+    refine ⟨⟨roots, resultValue, hΓAfter.bump .erased,
+      AValStable.slot.realize_bump hresult .erased,
+      hresultAfter, hrestAfter, ?_⟩, hslots.bump .erased⟩
+    simpa [remainingRoots] using hownAfter
+  cases targetValue with
+  | lit literal =>
+    have hrun : runOp ctx 1 cur store env
+        (.drop (.var (Γ.rel targetAbs))) = .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, .erased, hrun,
+      hfinish (Sim.StoreGraphRestricts.refl store)
+        (howned.dropNoLocation rfl)⟩
+  | erased =>
+    have hrun : runOp ctx 1 cur store env
+        (.drop (.var (Γ.rel targetAbs))) = .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, .erased, hrun,
+      hfinish (Sim.StoreGraphRestricts.refl store)
+        (howned.dropNoLocation rfl)⟩
+  | loc loc =>
+    obtain ⟨fuel, store', hdrop, hownAfter⟩ := dropVal_progress howned
+    have hrun := runOp_drop (ctx := ctx) (cur := cur) (fuel := fuel)
+      hresolve hdrop
+    exact ⟨fuel + 1, store', .erased, hrun,
+      hfinish (Sim.dropVal_restricts hdrop) hownAfter⟩
+
+/-- Progressing projection through a retained constructor slot. -/
+theorem LowerBorrowValueProgress.projectSlotKept
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) false)
+    (hnotFunction : ∀ f arity captures,
+      ¬ funRel (.ctor address tag sourceFields) f arity captures)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerBorrowValueSound.projectSlotKept hsourceField
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hnotFunction hsourceField
+  have hretain := retainFetchedBorrow_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := retainedProjection_kept_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (target := .slotA targetAbs)
+    (result := .slotA output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots)
+    (EmitProgress.comp hfetch (EmitProgress.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Progressing projection through a final-use constructor slot. -/
+theorem LowerBorrowValueProgress.projectSlotReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) true)
+    (hnotFunction : ∀ f arity captures,
+      ¬ funRel (.ctor address tag sourceFields) f arity captures)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerBorrowValueSound.projectSlotReleased hsourceField
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hnotFunction hsourceField
+  have hretain := retainFetchedBorrow_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := releaseRetainedProjection_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (resultAbs := output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots)
+    (EmitProgress.comp hfetch (EmitProgress.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerBorrowValueSettlement.projectSlotKept
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) false)
+    (hnotFunction : ∀ f arity captures,
+      ¬ funRel (.ctor address tag sourceFields) f arity captures)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectSlotKept hsourceField
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hnotFunction hsourceField
+  have hretain := retainFetchedBorrow_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := retainedProjection_kept_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (target := .slotA targetAbs)
+    (result := .slotA output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots)
+    (EmitSettlement.comp hfetch.settles
+      (EmitSettlement.comp hretain.settles hfinish.settles))
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerBorrowValueSettlement.projectSlotReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) true)
+    (hnotFunction : ∀ f arity captures,
+      ¬ funRel (.ctor address tag sourceFields) f arity captures)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectSlotReleased hsourceField
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hnotFunction hsourceField
+  have hretain := retainFetchedBorrow_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := releaseRetainedProjection_value_progress
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (resultAbs := output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots)
+    (EmitSettlement.comp hfetch.settles
+      (EmitSettlement.comp hretain.settles hfinish.settles))
+  simpa [Function.comp_def] using hcomposed
+
+/-- The erased scalar borrow is already a total shared expression result. -/
+theorem LowerBorrowValueProgress.returnErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.constA .erased) release) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerBorrowValueSound.returnErased
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput .erased (.constA .erased) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput .erased .shared (.constA .erased)
+        sourceRest rest slots) := by
+    apply EmitProgress.strengthen
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput, hav, hvalueGraph,
+      hrestGraph, ?_⟩, hslots⟩
+    cases release with
+    | false =>
+      simpa [borrowResultRoots] using
+        hown.addNoLocation (hprogress.stable.const_noLocation hav)
+    | true => simpa [borrowResultRoots] using hown
+  have hcomposed := EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- A constructor target cannot reach the erased descriptor midpoint.  The
+borrow prefix therefore progresses only from an empty input precondition. -/
+theorem LowerBorrowValueProgress.projectCtorErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA .erased) release) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerBorrowValueSound.projectCtorErased
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have himpossible : ∀ {store env},
+      GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput (.ctor address tag sourceFields) (.constA .erased)
+        release sourceRest rest slots store env → False := by
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    cases hav with
+    | const hresolve =>
+      simp only [resolveAtom] at hresolve
+      have hvalue : RVal.erased = value := Except.ok.inj hresolve
+      subst value
+      cases hvalueGraph
+  have hconvert : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput (.ctor address tag sourceFields) (.constA .erased)
+        release sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput sourceValue .shared (.constA .erased)
+        sourceRest rest slots) :=
+    EmitProgress.strengthen (fun hpre => (himpossible hpre).elim)
+  have hcomposed := EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- A constructor source cannot be realized by a stable literal descriptor;
+the following faithfully emitted scalar fetch is therefore vacuously total. -/
+theorem LowerBorrowValueProgress.projectCtorLiteral
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {literal : IxIR0.Literal} {index : Nat}
+    {release : Bool}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA (.lit literal))
+      release) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.lit literal) index))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerBorrowValueSound.projectConst
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hsuffix : EmitProgress ctx cur
+      (emitOp (.fetch (.lit literal) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput (.ctor address tag sourceFields)
+        (.constA (.lit literal)) release sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply EmitProgress.of_pointwise
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    cases hav with
+    | const hresolve =>
+      simp only [resolveAtom] at hresolve
+      have hvalue : RVal.lit literal = value := Except.ok.inj hresolve
+      subst value
+      cases hvalueGraph
+  exact EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots) hsuffix
+
+/-- An erased source target likewise cannot be realized by a literal
+descriptor.  This vacuous successful rule lets the settlement dispatcher
+cover every stable descriptor even though only the slot case genuinely
+stops. -/
+theorem LowerBorrowValueProgress.projectErasedLiteral
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit}
+    {literal : IxIR0.Literal} {index : Nat} {release : Bool}
+    (hprogress : LowerBorrowValueProgress funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.constA (.lit literal)) release) :
+    LowerResultValueProgress funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.lit literal) index))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerBorrowValueSound.projectConst
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hsuffix : EmitProgress ctx cur
+      (emitOp (.fetch (.lit literal) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput .erased (.constA (.lit literal)) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply EmitProgress.of_pointwise
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    cases hav with
+    | const hresolve =>
+      simp only [resolveAtom] at hresolve
+      have hvalue : RVal.lit literal = value := Except.ok.inj hresolve
+      subst value
+      cases hvalueGraph
+  exact EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots) hsuffix
+
+theorem LowerBorrowValueSettlement.returnErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.constA .erased) release) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.returnErased
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSettlement ctx cur (_root_.id : Emit)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput .erased (.constA .erased) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput .erased .shared (.constA .erased)
+        sourceRest rest slots) := by
+    apply EmitSettlement.strengthen
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput, hav, hvalueGraph,
+      hrestGraph, ?_⟩, hslots⟩
+    cases release with
+    | false =>
+      simpa [borrowResultRoots] using
+        hown.addNoLocation (hsettles.stable.const_noLocation hav)
+    | true => simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerBorrowValueSettlement.projectCtorErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA .erased) release) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectCtorErased
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSettlement ctx cur (_root_.id : Emit)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput (.ctor address tag sourceFields) (.constA .erased)
+        release sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput sourceValue .shared (.constA .erased)
+        sourceRest rest slots) := by
+    apply EmitSettlement.strengthen
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    cases hav with
+    | const hresolve =>
+      simp only [resolveAtom] at hresolve
+      have hvalue : RVal.erased = value := Except.ok.inj hresolve
+      subst value
+      cases hvalueGraph
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerBorrowValueSettlement.projectCtorLiteral
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {literal : IxIR0.Literal} {index : Nat}
+    {release : Bool}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA (.lit literal))
+      release) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.lit literal) index))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectConst
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hsuffix : EmitSettlement ctx cur
+      (emitOp (.fetch (.lit literal) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput (.ctor address tag sourceFields)
+        (.constA (.lit literal)) release sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    intro code hcode store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    cases hav with
+    | const hresolve =>
+      simp only [resolveAtom] at hresolve
+      have hvalue : RVal.lit literal = value := Except.ok.inj hresolve
+      subst value
+      cases hvalueGraph
+  exact EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hsuffix
+
+theorem LowerBorrowValueSettlement.projectErasedLiteral
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit}
+    {literal : IxIR0.Literal} {index : Nat} {release : Bool}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.constA (.lit literal)) release) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.lit literal) index))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectConst
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hsuffix : EmitSettlement ctx cur
+      (emitOp (.fetch (.lit literal) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput .erased (.constA (.lit literal)) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    intro code hcode store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    cases hav with
+    | const hresolve =>
+      simp only [resolveAtom] at hresolve
+      have hvalue : RVal.lit literal = value := Except.ok.inj hresolve
+      subst value
+      cases hvalueGraph
+  exact EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hsuffix
+
+/-- The erased-through-slot branch is not merely missing a proof: whenever
+its graph precondition is inhabited, the emitted `fetch` cannot satisfy the
+successful-execution progress interface. -/
+theorem fetchErasedSlot_not_progress_of_inhabited
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)} {mid : StatePred}
+    (hinhabited : ∃ store env,
+      GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots store env) :
+    ¬ EmitProgress ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots)
+      mid := by
+  intro hprogress
+  obtain ⟨store, env, hpre⟩ := hinhabited
+  have hret : CodeProgress ctx cur mid (.ret .erased) := by
+    apply codeProgress_ret
+    intro nextStore nextEnv hmid
+    exact ⟨.erased, rfl⟩
+  obtain ⟨fuel, store', value, hrun⟩ :=
+    hprogress (.ret .erased) hret hpre
+  have hfalse := fetchErasedSlot_false
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := Γ) (sourceEnv := sourceEnv)
+    (targetAbs := targetAbs) (index := index) (release := release)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfalseCode : CodeOwns ctx cur (fun _ _ => False)
+      (fun _ _ => False) (.ret .erased) := by
+    intro nextFuel nextStore nextEnv finalStore finalValue himpossible
+      hnextRun
+    exact himpossible.elim
+  exact hfalse (fun _ _ => False) (.ret .erased) hfalseCode hpre hrun
+
+/-- The erased-through-slot branch does have the weaker property needed for
+memory safety: its emitted fetch reaches ordinary stuckness at finite fuel,
+independently of the continuation.  An abstract function realization is a
+live pap and therefore stops with the pap-specific fetch error; the canonical
+erased realization stops as a non-location. -/
+theorem fetchErasedSlot_stop
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitStop ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots) := by
+  intro code store env hpre
+  obtain ⟨roots, targetValue, hΓ, htarget, htargetWorld,
+      htargetGraph, hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases htargetGraph with
+  | erased =>
+    refine ⟨2, .stuck "fetch from a non-location" ?_⟩
+    rw [runCode.eq_def]
+    dsimp only [emitOp]
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk, bindErr]
+  | function hget hrel hcaptures =>
+    refine ⟨2, .stuck "fetch from a pap node" ?_⟩
+    rw [runCode.eq_def]
+    dsimp only [emitOp]
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+    simp only [hget, bindErr]
+
+theorem fetchErasedSlot_settlement
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)} {mid : StatePred} :
+    EmitSettlement ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots)
+      mid :=
+  (fetchErasedSlot_stop (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := Γ) (sourceEnv := sourceEnv)
+    (targetAbs := targetAbs) (index := index) (release := release)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)).settlement
+
+/-- An erased source target projected through a retained logical slot is a
+valid non-memory settlement result.  The borrow prefix may itself settle;
+when it succeeds, the following fetch is a terminal ordinary-stuck prefix,
+so the unreachable duplicate never needs a progress proof. -/
+theorem LowerBorrowValueSettlement.projectSlotKeptErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {targetAbs index : Nat}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) false) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectSlotKeptErased
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchErasedSlot_stop
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+    (index := index) (release := false) (sourceRest := sourceRest)
+    (rest := rest) (slots := slots)
+  have hfetchThenDup := EmitStop.postcompose
+    (suffix := emitOp (.dup (.var (output.bump.rel output.depth))))
+    hfetch
+  have hstop := (hsettles.graphSettlement sourceRest rest slots).thenStop
+    hfetchThenDup
+  simpa [Function.comp_def] using hstop.settlement
+
+/-- Final-use erased-slot projection has the same safe stop; both the
+duplicate and the target drop lie after the failing fetch. -/
+theorem LowerBorrowValueSettlement.projectSlotReleasedErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {targetAbs index : Nat}
+    (hsettles : LowerBorrowValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) true) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceValue
+      .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerBorrowValueSound.projectSlotReleasedErased
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchErasedSlot_stop
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+    (index := index) (release := true) (sourceRest := sourceRest)
+    (rest := rest) (slots := slots)
+  have hfetchThenSuffix := EmitStop.postcompose
+    (suffix := emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+      emitOp (.drop (.var (output.bump.bump.rel targetAbs)))) hfetch
+  have hstop := (hsettles.graphSettlement sourceRest rest slots).thenStop
+    hfetchThenSuffix
+  simpa [Function.comp_def] using hstop.settlement
+
+/-- A released logical slot containing the erased scalar is a concrete
+inhabitant of the obstructing projection precondition. -/
+theorem erasedReleasedSlot_borrow_pre_inhabited
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel) :
+    ∃ store env,
+      GraphOwnsBorrowResultProtected funRel recSelfRel
+        ⟨[.slot 0 0 .many false], 1⟩ [.erased]
+        .erased (.slotA 0) true [] [] [] store env := by
+  refine ⟨{}, [.erased], [], .erased, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · refine ⟨by simp, ?_⟩
+    exact EntriesValueGraph.released (by simp) EntriesValueGraph.nil
+  · apply AValRealizes.slot
+    · simp
+    · simp [VEnv.rel]
+  · trivial
+  · exact .erased
+  · exact .nil
+  · simpa [borrowResultRoots] using
+      (RootOwnership.empty.addNoLocation (world := .shared) (by rfl))
+  · exact SlotsRealize.nil
+
+/-- Consequently, even the canonical scalar realization gives a direct
+counterexample to unconditional successful progress for erased-slot fetch. -/
+theorem erasedReleasedSlot_fetch_not_progress
+    {ctx : Ctx} {cur : FnDef} (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (index : Nat) (mid : StatePred) :
+    ¬ EmitProgress ctx cur
+      (emitOp (.fetch (.var
+        ((⟨[.slot 0 0 .many false], 1⟩ : VEnv).rel 0)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel
+        ⟨[.slot 0 0 .many false], 1⟩ [.erased]
+        .erased (.slotA 0) true [] [] [])
+      mid :=
+  fetchErasedSlot_not_progress_of_inhabited
+    (erasedReleasedSlot_borrow_pre_inhabited funRel recSelfRel)
+
+/-- Reachable projection progress for the constructor outcome of the source
+evaluator.  The canonical function relation rules out pap-shaped disguises,
+so both retained and final-use slot descriptors execute `fetch`/`dup`
+(and the optional target release) successfully. -/
+theorem lowerE_proj_ctor_run_value_progress_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hborrow : LowerBorrowValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {address : Ixon.Address} {tag : Nat}
+    {fields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (htarget : IxIR0.eval sourceCtx sourceFuel sourceEnv source =
+      .ok (.ctor address tag fields))
+    (hfield : fields[index]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceValue world emit av := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp only [lowerE, huuEq, if_true] at hrun
+    exact (trackedThrowRun_not_ok hrun).elim
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hnotFunction : ∀ f arity captures,
+        ¬ CompilerFunctionRel sourceCtx src ambient
+          (.ctor address tag fields) f arity captures := by
+      intro f arity captures hrel
+      exact hrel.value_ne_ctor henv rfl
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.var relative) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        cases (hborrow htarget hborrowRun hextends havailable).stable
+      | lit literal =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectCtorLiteral
+      | erased =>
+        have hpure :
+            (borrowOutput, borrowEmit, AVal.constA .erased) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectCtorErased
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure :
+            (borrowOutput.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectSlotKept hnotFunction hfield
+      | true =>
+        have hpure :
+            (borrowOutput.bump.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                emitOp (.drop
+                  (.var (borrowOutput.bump.bump.rel targetAbs))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectSlotReleased hnotFunction hfield
+
+/-- A successful Ixon projection related by proof-producing erasure enters
+only the constructor branch of the IxIR₀ projection dispatcher.  Composing
+that erasure inversion with the existing constructor projection theorem
+eliminates the raw erased-slot counterexample at this source boundary. -/
+theorem lowerE_proj_ctor_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hborrow : LowerBorrowValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {fields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (htarget : ProjectionSafeEval sourceCtx sourceEnv source
+      (.ctor address tag fields))
+    (hfield : fields[index]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceValue world emit av := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp only [lowerE, huuEq, if_true] at hrun
+    exact (trackedThrowRun_not_ok hrun).elim
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hnotFunction : ∀ f arity captures,
+        ¬ CompilerFunctionRel sourceCtx src ambient
+          (.ctor address tag fields) f arity captures := by
+      intro f arity captures hrel
+      exact hrel.value_ne_ctor henv rfl
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.var relative) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        cases (hborrow htarget hborrowRun hextends havailable).stable
+      | lit literal =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectCtorLiteral
+      | erased =>
+        have hpure :
+            (borrowOutput, borrowEmit, AVal.constA .erased) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectCtorErased
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure :
+            (borrowOutput.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectSlotKept hnotFunction hfield
+      | true =>
+        have hpure :
+            (borrowOutput.bump.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                emitOp (.drop
+                  (.var (borrowOutput.bump.bump.rel targetAbs))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow htarget hborrowRun hextends
+          havailable).projectSlotReleased hnotFunction hfield
+
+/-- A successful Ixon projection related by proof-producing erasure enters
+only the constructor branch of the IxIR₀ projection dispatcher.  Composing
+that erasure inversion with the existing constructor projection theorem
+eliminates the raw erased-slot counterexample at this source boundary. -/
+
+theorem lowerE_proj_erasure_run_value_progress_within
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {sourceRuntimeEnv : List Ixon.Eval.Value}
+    {tyRef fieldIdx : UInt64} {ixonSource : Ixon.Expr}
+    {ixonValue : Ixon.Eval.Value}
+    {selfCtx : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {source : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {ixonFuel compilerFuel : Nat}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx sourceCtx)
+    (hixon : Ixon.Eval.eval ectx ixonFuel F sourceRuntimeEnv
+      (.prj tyRef fieldIdx ixonSource) = .ok ixonValue)
+    (herases : Ix.Compiler.Sim.PErase ectx sourceCtx selfCtx F.refs
+      F.selfMuts F.selfAddr mask (.prj tyRef fieldIdx ixonSource)
+      (.proj fieldIdx.toNat source))
+    (herasedEnv : Ix.Compiler.Sim.EnvRel ectx sourceCtx selfCtx F.refs
+      F.selfMuts F.selfAddr mask sourceRuntimeEnv sourceEnv)
+    (henv : sourceCtx.env = src)
+    (hborrow : LowerBorrowValueProgressesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient compilerFuel)
+    {input output : VEnv} {world : Owned} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceFuel : Nat}
+    {sourceTarget : IxIR0.Value}
+    (htarget : IxIR0.eval sourceCtx sourceFuel sourceEnv source =
+      .ok sourceTarget)
+    (hrun : (lowerE src (compilerFuel + 1) input world
+      (.proj fieldIdx.toNat source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    ∃ address tag fields sourceValue,
+      sourceTarget = .ctor address tag fields ∧
+        Ix.Compiler.Sim.ValRel ectx sourceCtx ixonValue sourceValue ∧
+        LowerResultValueProgress
+          (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+          input output sourceEnv sourceEnv sourceValue world emit av := by
+  obtain ⟨address, tag, fields, sourceValue, hsourceTarget, hfield,
+      hvalueRel⟩ := Ix.Compiler.Sim.erasure_proj_target_ctor
+        hstrict horacles hixon herases herasedEnv htarget
+  subst sourceTarget
+  refine ⟨address, tag, fields, sourceValue, rfl, hvalueRel, ?_⟩
+  exact lowerE_proj_ctor_run_value_progress_within henv hborrow htarget
+    hfield hrun hextends havailable
+
+/-- Complete reachable projection settlement. Constructor targets retain the
+strong successful result above. An erased target with a stable scalar
+descriptor is vacuous or returns erased; an erased target carried by a slot
+settles at the emitted fetch with ordinary stuckness. -/
+theorem lowerE_proj_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hborrow : LowerBorrowValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceTarget sourceValue : IxIR0.Value}
+    (htarget : IxIR0.eval sourceCtx sourceFuel sourceEnv source =
+      .ok sourceTarget)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceValue world emit av := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp only [lowerE, huuEq, if_true] at hrun
+    exact (trackedThrowRun_not_ok hrun).elim
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.var relative) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        cases (hborrow htarget hborrowRun hextends havailable).stable
+      | lit literal =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        have hborrowSettles :=
+          hborrow htarget hborrowRun hextends havailable
+        cases hproject with
+        | ctor hfield =>
+          exact hborrowSettles.projectCtorLiteral
+        | erased =>
+          exact hborrowSettles.projectErasedLiteral
+      | erased =>
+        have hpure :
+            (borrowOutput, borrowEmit, AVal.constA .erased) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        have hborrowSettles :=
+          hborrow htarget hborrowRun hextends havailable
+        cases hproject with
+        | ctor hfield =>
+          exact hborrowSettles.projectCtorErased
+        | erased => exact hborrowSettles.returnErased
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure :
+            (borrowOutput.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        have hborrowSettles :=
+          hborrow htarget hborrowRun hextends havailable
+        cases hproject with
+        | @ctor address tag fields value hfield =>
+          have hnotFunction : ∀ f arity captures,
+              ¬ CompilerFunctionRel sourceCtx src ambient
+                (.ctor address tag fields) f arity captures := by
+            intro f arity captures hrel
+            exact hrel.value_ne_ctor henv rfl
+          exact hborrowSettles.projectSlotKept hnotFunction hfield
+        | erased =>
+          exact hborrowSettles.projectSlotKeptErased
+      | true =>
+        have hpure :
+            (borrowOutput.bump.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                emitOp (.drop
+                  (.var (borrowOutput.bump.bump.rel targetAbs))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        have hborrowSettles :=
+          hborrow htarget hborrowRun hextends havailable
+        cases hproject with
+        | @ctor address tag fields value hfield =>
+          have hnotFunction : ∀ f arity captures,
+              ¬ CompilerFunctionRel sourceCtx src ambient
+                (.ctor address tag fields) f arity captures := by
+            intro f arity captures hrel
+            exact hrel.value_ne_ctor henv rfl
+          exact hborrowSettles.projectSlotReleased hnotFunction hfield
+        | erased =>
+          exact hborrowSettles.projectSlotReleasedErased
+
+/-! ## Let-binder progress -/
+
+/-- Progress refinement for the semantic installation of one let binder. -/
+structure InstallBinderValueProgress (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (sourceEnv : List IxIR0.Value)
+    (boundSource : IxIR0.Value) (boundWorld : Owned)
+    (boundValue : AVal) (emit : Emit) : Prop
+    extends InstallBinderValueSound funRel recSelfRel ctx cur input output
+      sourceEnv boundSource boundWorld boundValue emit where
+  graphProgress : ∀ sourceRest rest slots,
+    EmitProgress ctx cur emit
+      (GraphOwnsResultProtected funRel recSelfRel input sourceEnv
+        boundSource boundWorld boundValue sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        (boundSource :: sourceEnv) sourceRest rest slots)
+
+/-- Installing a slot-backed binder is an ownership-and-graph rearrangement
+with no target operation. -/
+theorem installAliasBinder_held_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Uses} :
+    InstallBinderValueProgress funRel recSelfRel ctx cur Γ
+      (installAliasBinder Γ abs remaining uses true)
+      sourceEnv boundSource (worldOfUses uses) (.slotA abs)
+      (_root_.id : Emit) := by
+  refine
+    { toInstallBinderValueSound := installAliasBinder_held_value_sound
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply EmitProgress.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases hav with
+  | slot hbound hslot =>
+    let output := installAliasBinder Γ abs remaining uses true
+    have htail : EntriesValueGraph funRel recSelfRel store output env
+        Γ.entries sourceEnv roots :=
+      hΓ.entries.of_depth_eq (by simp [output, installAliasBinder])
+    have hvalueWorld : HasWorld store (worldOfUses uses) value :=
+      hown.roots_world ⟨worldOfUses uses, value⟩ (by simp)
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        (boundSource :: sourceEnv) env
+        (⟨worldOfUses uses, value⟩ :: roots) := by
+      refine ⟨by simpa [output, installAliasBinder] using hΓ.depth_eq, ?_⟩
+      exact EntriesValueGraph.held
+        (by simpa [output, installAliasBinder] using hbound)
+        (by simpa [output, installAliasBinder, VEnv.rel] using hslot)
+        hvalueWorld hvalueGraph htail
+    refine ⟨⟨⟨worldOfUses uses, value⟩ :: roots,
+      houtput, hrestGraph, ?_⟩, ?_⟩
+    · simpa using hown
+    · exact SlotsRealize.of_depth_eq
+        (by simp [output, installAliasBinder]) hslots
+
+/-- Materializing a stable scalar binder always executes one `pure`
+operation and installs the pushed value in the logical environment. -/
+theorem materializeConstBinder_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    InstallBinderValueProgress funRel recSelfRel ctx cur Γ
+      (installPushedBinder Γ remaining uses held) sourceEnv boundSource
+      (worldOfUses uses) (.constA atom) (emitOp (.pure atom)) := by
+  refine
+    { toInstallBinderValueSound :=
+        materializeConstBinder_value_sound hstable
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hpure := runOp_pure (ctx := ctx) (cur := cur) (fuel := 0)
+    (store := store) hav.resolveAtom
+  let output := installPushedBinder Γ remaining uses held
+  have htail : EntriesValueGraph funRel recSelfRel store output
+      (value :: env) Γ.entries sourceEnv roots :=
+    (hΓ.entries.bump value).of_depth_eq
+      (by simp [output, installPushedBinder, VEnv.bump])
+  have hdepth : (value :: env).length = output.depth := by
+    simpa [output, installPushedBinder] using
+      congrArg Nat.succ hΓ.depth_eq
+  cases held with
+  | false =>
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        (boundSource :: sourceEnv) (value :: env) roots := by
+      refine ⟨hdepth, ?_⟩
+      exact EntriesValueGraph.released
+        (by simp [output, installPushedBinder]) htail
+    refine ⟨1, store, value, hpure, ⟨⟨roots, houtput, hrestGraph, ?_⟩,
+      ?_⟩⟩
+    · exact hown.dropNoLocation (hstable.const_noLocation hav)
+    · exact SlotsRealize.of_depth_eq
+        (by simp [output, installPushedBinder, VEnv.bump])
+        (hslots.bump value)
+  | true =>
+    have hvalueWorld : HasWorld store (worldOfUses uses) value :=
+      hown.roots_world ⟨worldOfUses uses, value⟩ (by simp)
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        (boundSource :: sourceEnv) (value :: env)
+        (⟨worldOfUses uses, value⟩ :: roots) := by
+      refine ⟨hdepth, ?_⟩
+      exact EntriesValueGraph.held
+        (by simp [output, installPushedBinder])
+        (by simp [output, installPushedBinder, VEnv.rel])
+        hvalueWorld hvalueGraph htail
+    refine ⟨1, store, value, hpure,
+      ⟨⟨⟨worldOfUses uses, value⟩ :: roots,
+        houtput, hrestGraph, ?_⟩, ?_⟩⟩
+    · simpa using hown
+    · exact SlotsRealize.of_depth_eq
+        (by simp [output, installPushedBinder, VEnv.bump])
+        (hslots.bump value)
+
+/-- Common progressing release of one held logical entry.  The selected root
+is consumed by a total drop operation, and its reverse shape inclusion
+rebuilds all surviving environment and caller graphs. -/
+private theorem release_slot_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs : Nat} {uses : Uses} {world : Owned} {releaseOp : Op}
+    (hworld : worldOfUses uses = world)
+    (hentry : Γ.entries[i]? = some (.slot abs 0 uses true))
+    (hop : ∀ {store : Store} {env : List RVal} {value : RVal}
+        {tailRoots : List Root},
+      resolveAtom env (.var (Γ.rel abs)) = .ok value →
+      RootOwnership store (⟨world, value⟩ :: tailRoots) →
+      ∃ fuel store',
+        runOp ctx fuel cur store env releaseOp = .ok (store', .erased) ∧
+        Sim.StoreGraphRestricts store store' ∧
+        RootOwnership store' tailRoots) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitProgress ctx cur (emitOp releaseOp)
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 uses false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  intro sourceEnv sourceRest rest slots
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨_, value, before, after, _, hbound, hslot, _, _,
+      hroots, hreleased⟩ := hΓ.entries.releaseAt hentry
+  let Γreleased := Γ.setEntry i (.slot abs 0 uses false)
+  let tailRoots := before ++ after ++ rest
+  have hΓreleased : VEnvValueGraph funRel recSelfRel store
+      Γreleased sourceEnv env (before ++ after) :=
+    hΓ.setEntry hreleased
+  have howned : RootOwnership store (⟨world, value⟩ :: tailRoots) := by
+    rw [hroots] at hown
+    have hfront := hown.perm
+      (permExtractRoot ⟨worldOfUses uses, value⟩ before after rest)
+    simpa [tailRoots, hworld] using hfront
+  have hresolve :
+      resolveAtom env (.var (Γ.rel abs)) = .ok value :=
+    (AValRealizes.slot hbound hslot).resolveAtom
+  obtain ⟨fuel, store', hrun, hrestrict, hownAfter⟩ :=
+    hop hresolve howned
+  have hΓafter : VEnvValueGraph funRel recSelfRel store'
+      Γreleased sourceEnv env (before ++ after) :=
+    hΓreleased.ofRestricts hrestrict hownAfter
+      (fun root hmember => by
+        simpa [tailRoots] using List.mem_append_left rest hmember)
+  have hrestAfter : Sim.RootsGraph funRel store' sourceRest rest :=
+    hrestGraph.ofRestrictsIn hrestrict hownAfter
+      (fun root hmember => by
+        simpa [tailRoots] using
+          List.mem_append_right (before ++ after) hmember)
+  refine ⟨fuel, store', .erased, hrun,
+    ⟨⟨before ++ after, hΓafter.bump .erased, hrestAfter, ?_⟩,
+      (hslots.setEntry).bump .erased⟩⟩
+  simpa [tailRoots] using hownAfter
+
+/-- Total shared release for a dead let alias. -/
+theorem release_slot_many_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv} {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitProgress ctx cur (emitOp (.drop (.var (Γ.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  apply release_slot_value_progress (world := .shared) rfl hentry
+  intro store env value tailRoots hresolve hown
+  cases value with
+  | lit literal =>
+    have hrun : runOp ctx 1 cur store env
+        (.drop (.var (Γ.rel abs))) = .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, hrun, Sim.StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | erased =>
+    have hrun : runOp ctx 1 cur store env
+        (.drop (.var (Γ.rel abs))) = .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, hrun, Sim.StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | loc loc =>
+    obtain ⟨fuel, store', hdrop, hownAfter⟩ :=
+      dropVal_progress (ctx := ctx) hown
+    have hrun := runOp_drop (ctx := ctx) (cur := cur) (fuel := fuel)
+      hresolve hdrop
+    exact ⟨fuel + 1, store', hrun, Sim.dropVal_restricts hdrop,
+      hownAfter⟩
+
+/-- Total unique release for a dead affine let alias. -/
+theorem release_slot_affine_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv} {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitProgress ctx cur (emitOp (.dropU (.var (Γ.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  apply release_slot_value_progress (world := .unique) rfl hentry
+  intro store env value tailRoots hresolve hown
+  cases value with
+  | lit literal =>
+    have hrun : runOp ctx 1 cur store env
+        (.dropU (.var (Γ.rel abs))) = .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, hrun, Sim.StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | erased =>
+    have hrun : runOp ctx 1 cur store env
+        (.dropU (.var (Γ.rel abs))) = .ok (store, .erased) := by
+      rw [runOp.eq_def]
+      dsimp only
+      rw [hresolve, bindOk]
+    exact ⟨1, store, hrun, Sim.StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | loc loc =>
+    obtain ⟨fuel, store', hdrop, hownAfter⟩ :=
+      dropUVal_progress (ctx := ctx) hown
+    have hrun := runOp_dropU (ctx := ctx) (cur := cur) (fuel := fuel)
+      hresolve hdrop
+    exact ⟨fuel + 1, store', hrun, Sim.dropUVal_restricts hdrop,
+      hownAfter⟩
+
+/-- Total graph-preserving form of one generated borrowed-field retain. -/
+theorem retain_borrowed_into_entry_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i placeholderAbs fieldAbs remaining : Nat}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)}
+    {rest extra : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal} {retains : List RecursorFieldRetain}
+    (hentry : Γ.entries[i]? =
+      some (.slot placeholderAbs 0 .many false)) :
+    EmitProgress ctx cur (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel Γ sourceEnv
+        sourceRest rest extra slots borrowed
+        (⟨i, fieldAbs, remaining⟩ :: retains))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        sourceEnv sourceRest rest extra slots borrowed retains) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨roots, hΓ, hframe, hown, hslots, hborrowed,
+      hgraphs⟩ := hpre
+  obtain ⟨source, value, hsource, hslotMem, hborrowMem, hvalue⟩ :=
+    hgraphs ⟨i, fieldAbs, remaining⟩ (by simp)
+  obtain ⟨hfieldBound, hfieldSlot⟩ :=
+    hslots fieldAbs value hslotMem
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok value :=
+    (AValRealizes.slot hfieldBound hfieldSlot).resolveAtom
+  have hworld : HasWorld store .shared value :=
+    hborrowed value hborrowMem
+  obtain ⟨nextStore, heval, hextends, hvalueNext, hownNext⟩ :=
+    runOp_retain_borrowed_valueGraph
+      (ctx := ctx) (cur := cur) (fuel := 0)
+      hresolve hworld hvalue
+      (show RootOwnership store (roots ++ extra ++ rest) from hown)
+  have hΓbump : VEnvValueGraph funRel recSelfRel nextStore
+      Γ.bump sourceEnv (value :: env) roots :=
+    (hΓ.monoStore hextends).bump value
+  have hentryBump : Γ.bump.entries[i]? =
+      some (.slot placeholderAbs 0 .many false) := by
+    simpa [VEnv.bump] using hentry
+  have hnewBound : Γ.depth < Γ.bump.depth := by simp [VEnv.bump]
+  have hnewSlot :
+      (value :: env)[Γ.bump.rel Γ.depth]? = some value := by
+    simp [VEnv.bump, VEnv.rel]
+  have hworldNext : HasWorld nextStore .shared value :=
+    hworld.monoStore hextends
+  obtain ⟨before, after, hroots, hentries⟩ :=
+    hΓbump.entries.holdAt hentryBump hsource hnewBound hnewSlot
+      hworldNext hvalueNext
+  have hset : VEnvValueGraph funRel recSelfRel nextStore
+      (Γ.bump.setEntry i (.slot Γ.depth remaining .many true))
+      sourceEnv (value :: env)
+      (before ++ ⟨.shared, value⟩ :: after) :=
+    hΓbump.setEntry hentries
+  have henvEq :
+      Γ.bump.setEntry i (.slot Γ.depth remaining .many true) =
+      ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump) := by
+    cases Γ
+    rfl
+  rw [henvEq] at hset
+  have howned : RootOwnership nextStore
+      ((before ++ ⟨.shared, value⟩ :: after) ++ extra ++ rest) := by
+    rw [hroots] at hownNext
+    have hfront : RootOwnership nextStore
+        (⟨.shared, value⟩ :: (before ++ after) ++ (extra ++ rest)) := by
+      simpa [List.append_assoc] using hownNext
+    have hreordered := hfront.perm
+      (permExtractRoot ⟨.shared, value⟩ before after
+        (extra ++ rest)).symm
+    simpa [List.append_assoc] using hreordered
+  have htailBefore : RetainsValueGraphs funRel store sourceEnv slots
+      borrowed retains := by
+    intro retain hmember
+    exact hgraphs retain (by simp [hmember])
+  refine ⟨1, nextStore, value, heval,
+    before ++ ⟨.shared, value⟩ :: after, hset,
+    hframe.monoStore hextends, howned, (hslots.setEntry).bump value,
+    ?_, htailBefore.monoStore hextends⟩
+  intro candidate hmember
+  exact (hborrowed candidate hmember).monoStore hextends
+
+/-- A complete static field-retain plan is target-progressing and consumes
+its pending source/target retain witnesses one descriptor at a time. -/
+theorem FieldRetainPlan.valueProgress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit} (hplan : FieldRetainPlan input retains output emit) :
+    ∀ sourceEnv sourceRest rest extra slots borrowed,
+      EmitProgress ctx cur emit
+        (GraphOwnsVEnvRetains funRel recSelfRel input sourceEnv
+          sourceRest rest extra slots borrowed retains)
+        (GraphOwnsVEnvRetains funRel recSelfRel output sourceEnv
+          sourceRest rest extra slots borrowed []) := by
+  apply FieldRetainPlan.traverse (hplan := hplan)
+  · intro Γ sourceEnv sourceRest rest extra slots borrowed
+    exact EmitProgress.id
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih sourceEnv sourceRest rest extra slots borrowed
+    exact EmitProgress.comp
+      (retain_borrowed_into_entry_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (sourceEnv := sourceEnv) (sourceRest := sourceRest)
+        (rest := rest) (extra := extra) (slots := slots)
+        (borrowed := borrowed) (retains := retains) hentry)
+      (ih sourceEnv sourceRest rest extra slots borrowed)
+
+/-- Total graph-preserving release of the selected recursor major after all
+needed fields have been retained. -/
+theorem drop_major_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)}
+    {majorAbs : Nat} {major : RVal} {rest : List Root}
+    {slots : List (Nat × RVal)} {borrowed : List RVal}
+    (hmajor : (majorAbs, major) ∈ slots) :
+    EmitProgress ctx cur (emitOp (.drop (.var (Γ.rel majorAbs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel Γ sourceEnv
+        sourceRest rest [⟨.shared, major⟩] slots borrowed [])
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ.bump sourceEnv
+        sourceRest rest slots) := by
+  apply OpProgress.emit
+  intro store env hpre
+  obtain ⟨roots, hΓ, hrestGraph, hown, hslots, _, _⟩ := hpre
+  obtain ⟨hmajorBound, hmajorSlot⟩ :=
+    hslots majorAbs major hmajor
+  have hresolve :
+      resolveAtom env (.var (Γ.rel majorAbs)) = .ok major :=
+    (AValRealizes.slot hmajorBound hmajorSlot).resolveAtom
+  have howned : RootOwnership store
+      (⟨.shared, major⟩ :: roots ++ rest) := by
+    have hcanonical : RootOwnership store
+        (roots ++ ⟨.shared, major⟩ :: rest) := by
+      simpa [List.append_assoc] using hown
+    exact hcanonical.perm (by
+      simpa using
+        (permExtractRoot ⟨.shared, major⟩ roots [] rest))
+  have hdrop : ∃ fuel store',
+      runOp ctx fuel cur store env (.drop (.var (Γ.rel majorAbs))) =
+          .ok (store', .erased) ∧
+      Sim.StoreGraphRestricts store store' ∧
+      RootOwnership store' (roots ++ rest) := by
+    cases major with
+    | lit literal =>
+        have hrun : runOp ctx 1 cur store env
+            (.drop (.var (Γ.rel majorAbs))) = .ok (store, .erased) := by
+          rw [runOp.eq_def]
+          dsimp only
+          rw [hresolve, bindOk]
+        exact ⟨1, store, hrun, Sim.StoreGraphRestricts.refl store,
+          howned.dropNoLocation rfl⟩
+    | erased =>
+        have hrun : runOp ctx 1 cur store env
+            (.drop (.var (Γ.rel majorAbs))) = .ok (store, .erased) := by
+          rw [runOp.eq_def]
+          dsimp only
+          rw [hresolve, bindOk]
+        exact ⟨1, store, hrun, Sim.StoreGraphRestricts.refl store,
+          howned.dropNoLocation rfl⟩
+    | loc loc =>
+        obtain ⟨fuel, store', hrun, hownAfter⟩ :=
+          dropVal_progress (ctx := ctx) howned
+        exact ⟨fuel + 1, store', runOp_drop hresolve hrun,
+          Sim.dropVal_restricts hrun, hownAfter⟩
+  obtain ⟨fuel, store', hrun, hrestrict, hownAfter⟩ := hdrop
+  have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+      Γ sourceEnv env roots :=
+    hΓ.ofRestricts hrestrict hownAfter
+      (fun root hmember => List.mem_append_left rest hmember)
+  have hrestAfter : Sim.RootsGraph funRel store' sourceRest rest :=
+    hrestGraph.ofRestrictsIn hrestrict hownAfter
+      (fun root hmember => List.mem_append_right roots hmember)
+  exact ⟨fuel, store', .erased, hrun,
+    ⟨⟨roots, hΓAfter.bump .erased, hrestAfter, hownAfter⟩,
+      hslots.bump .erased⟩⟩
+
+/-- Every proof-relevant release plan executes successfully while preserving
+the complete source-value graph and arbitrary protected caller frame. -/
+theorem ReleasePlan.valueProgress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit)
+    (sourceEnv : List IxIR0.Value) :
+    ∀ sourceRest rest slots,
+      EmitProgress ctx cur emit
+        (GraphOwnsVEnvProtected funRel recSelfRel input
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel output
+          sourceEnv sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply ReleasePlan.traverse (hplan := hplan)
+  · intro Γ
+    exact EmitProgress.id
+  · intro Γ output i abs drops tailEmit hentry ih
+    exact EmitProgress.comp
+      (release_slot_many_value_progress hentry
+        sourceEnv sourceRest rest slots)
+      ih
+  · intro Γ output i abs drops tailEmit hentry ih
+    exact EmitProgress.comp
+      (release_slot_affine_value_progress hentry
+        sourceEnv sourceRest rest slots)
+      ih
+
+/-- Total-progress composition for the generated recursor prefix.  The
+field-retain plan protects every rule field needed by the RHS, the selected
+major is then released, and the parameter-release plan brings the target
+environment to the rule body's input layout. -/
+theorem recursorPrefixPlans_valueProgress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    {fieldOutput rhsInput : VEnv} {fieldEmit parameterEmit : Emit}
+    (hfieldPlan : FieldRetainPlan
+      ⟨List.replicate nf (.slot 0 0 .many false),
+        (numArgs + 1) + nf⟩
+      (recursorFieldRetains (numArgs + 1) rhs nf)
+      fieldOutput fieldEmit)
+    (hparameterPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (nf + i) rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs)).map
+        (SlotDrop.offsetEntry nf))
+      rhsInput parameterEmit) :
+    ∀ sourceEnv sourceRest rest major fields,
+      EmitProgress ctx cur
+        (fieldEmit ∘
+          emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+          parameterEmit)
+        (GraphOwnsVEnvRetains funRel recSelfRel
+          (recursorInitialVEnv numArgs nf rhs) sourceEnv
+          sourceRest rest [⟨.shared, major⟩]
+          (recursorFieldSlots numArgs (major :: fields)) fields
+          (recursorFieldRetains (numArgs + 1) rhs nf))
+        (GraphOwnsVEnv funRel recSelfRel rhsInput sourceEnv
+          sourceRest rest) := by
+  intro sourceEnv sourceRest rest major fields
+  let frame :=
+    parameterEntries 0 (List.replicate numArgs .many)
+        (fun i => countUses (nf + i) rhs) ++
+      [.recSelf (numArgs + 1)]
+  have hfieldFramed := hfieldPlan.frameEntries frame
+  have hfield : EmitProgress ctx cur fieldEmit
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (recursorInitialVEnv numArgs nf rhs) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields
+        (recursorFieldRetains (numArgs + 1) rhs nf))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields []) := by
+    have hprogress := hfieldFramed.valueProgress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur)
+      sourceEnv sourceRest rest [⟨.shared, major⟩]
+      (recursorFieldSlots numArgs (major :: fields)) fields
+    simpa [frame, recursorInitialVEnv, frameVEnvEntries,
+      List.append_assoc] using hprogress
+  have hmajor : EmitProgress ctx cur
+      (emitOp (.drop (.var
+        ((frameVEnvEntries fieldOutput frame).rel numArgs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields [])
+      (GraphOwnsVEnvProtected funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame).bump sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields))) :=
+    drop_major_value_progress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur)
+      (by simp [recursorFieldSlots])
+  have hparameters : EmitProgress ctx cur parameterEmit
+      (GraphOwnsVEnvProtected funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame).bump sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      (GraphOwnsVEnvProtected funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields))) := by
+    have hprogress := hparameterPlan.valueProgress
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) sourceEnv sourceRest rest
+      (recursorFieldSlots numArgs (major :: fields))
+    simpa [frameVEnvEntries, VEnv.bump, frame, List.append_assoc]
+      using hprogress
+  have hforget : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsVEnvProtected funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      (GraphOwnsVEnv funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest) :=
+    EmitProgress.strengthen (fun h => h.1)
+  have hcomposed := EmitProgress.comp hfield
+    (EmitProgress.comp hmajor
+      (EmitProgress.comp hparameters hforget))
+  simpa [frameVEnvEntries, VEnv.rel, Function.comp_def] using hcomposed
+
+/-- Prefixing a progressing expression with a generated release plan
+preserves both partial correctness and existential target termination. -/
+theorem LowerResultValueProgress.afterRelease
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input middle output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {releaseEmit emit : Emit}
+    {world : Owned} {av : AVal} {drops : List SlotDrop}
+    (hbody : LowerResultValueProgress funRel recSelfRel ctx cur
+      middle output sourceInput sourceOutput sourceValue world emit av)
+    (hrelease : ReleasePlan input drops middle releaseEmit) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world (releaseEmit ∘ emit) av := by
+  refine
+    { toLowerResultValueSound :=
+        hbody.toLowerResultValueSound.afterRelease
+          (hrelease.valueSound sourceInput)
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  exact EmitProgress.comp
+    (hrelease.valueProgress sourceInput sourceRest rest slots)
+    (hbody.graphProgress sourceRest rest slots)
+
+/-- Forget a released first logical binder from a progressing result. -/
+theorem LowerResultValueProgress.popFirstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {world : Owned} {emit : Emit} {av : AVal}
+    (hprogress : LowerResultValueProgress funRel recSelfRel ctx cur
+      input output sourceInput (boundSource :: sourceOutput)
+      sourceValue world emit av)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultValueSound :=
+        hprogress.toLowerResultValueSound.popFirstReleased hfirst
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hpop : EmitProgress ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        (boundSource :: sourceOutput) sourceValue world av
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots) := by
+    apply EmitProgress.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hvalueGraph,
+      hrestGraph, hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed := EmitProgress.comp
+    (hprogress.graphProgress sourceRest rest slots) hpop
+  simpa [Function.comp_def] using hcomposed
+
+/-- Sequence a progressing bound value, binder installation, and body, then
+remove the released logical binder. -/
+theorem LowerResultValueProgress.installThen
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input middle installed output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {boundSource sourceResult : IxIR0.Value}
+    {boundWorld resultWorld : Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    (hbound : LowerResultValueProgress funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle boundSource boundWorld
+      boundEmit boundValue)
+    (hinstall : InstallBinderValueProgress funRel recSelfRel ctx cur
+      middle installed sourceMiddle boundSource boundWorld boundValue
+      installEmit)
+    (hbody : LowerResultValueProgress funRel recSelfRel ctx cur
+      installed output (boundSource :: sourceMiddle)
+      (boundSource :: sourceOutput) sourceResult resultWorld
+      bodyEmit result)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceResult resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine
+    { toLowerResultValueSound :=
+        hbound.toLowerResultValueSound.installThen
+          hinstall.toInstallBinderValueSound hbody.toLowerResultValueSound
+          hreleased
+      graphProgress := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitProgress.comp
+    (hbound.graphProgress sourceRest rest slots)
+    (EmitProgress.comp (hinstall.graphProgress sourceRest rest slots)
+      (hpopped.graphProgress sourceRest rest slots))
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerResultValueSettlement.popFirstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {world : Owned} {emit : Emit} {av : AVal}
+    (hsettles : LowerResultValueSettlement funRel recSelfRel ctx cur
+      input output sourceInput (boundSource :: sourceOutput)
+      sourceValue world emit av)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultValueSound :=
+        hsettles.toLowerResultValueSound.popFirstReleased hfirst
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hpop : EmitSettlement ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        (boundSource :: sourceOutput) sourceValue world av
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots) := by
+    apply EmitSettlement.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hvalueGraph,
+      hrestGraph, hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed := EmitSettlement.comp
+    (hsettles.graphSettlement sourceRest rest slots) hpop
+  simpa [Function.comp_def] using hcomposed
+
+/-- Sequence a settling bound value, total binder installation, and a
+settling body, then remove the released logical binder. -/
+theorem LowerResultValueSettlement.installThen
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input middle installed output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {boundSource sourceResult : IxIR0.Value}
+    {boundWorld resultWorld : Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    (hbound : LowerResultValueSettlement funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle boundSource boundWorld
+      boundEmit boundValue)
+    (hinstall : InstallBinderValueProgress funRel recSelfRel ctx cur
+      middle installed sourceMiddle boundSource boundWorld boundValue
+      installEmit)
+    (hbody : LowerResultValueSettlement funRel recSelfRel ctx cur
+      installed output (boundSource :: sourceMiddle)
+      (boundSource :: sourceOutput) sourceResult resultWorld
+      bodyEmit result)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceResult resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine
+    { toLowerResultValueSound :=
+        hbound.toLowerResultValueSound.installThen
+          hinstall.toInstallBinderValueSound hbody.toLowerResultValueSound
+          hreleased
+      graphSettlement := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSettlement.comp
+    (hbound.graphSettlement sourceRest rest slots)
+    (EmitSettlement.comp
+      (hinstall.graphProgress sourceRest rest slots).settles
+      (hpopped.graphSettlement sourceRest rest slots))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Progressing semantic let branch of `lowerE`.  The value emitter, binder
+installation (including any eager release), and body emitter are all total on
+the graph-owned states established by the preceding stage. -/
+theorem lowerE_let_run_value_progress
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    (hrecursive : ∀ {middle bodyInput bodyOutput : VEnv}
+      {valueEmit bodyEmit : Emit} {boundValue resultValue : AVal}
+      {valueState bodyState bodyFinal : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+        .ok (middle, valueEmit, boundValue) valueState →
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, resultValue) bodyFinal →
+      bodyState = valueState →
+      ExtraExtends bodyFinal finalState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      LowerResultValueProgress funRel recSelfRel ctx cur input middle
+          sourceEnv sourceEnv boundSource (worldOfUses uses)
+          valueEmit boundValue ∧
+        LowerResultValueProgress funRel recSelfRel ctx cur bodyInput bodyOutput
+          (boundSource :: sourceEnv) (boundSource :: sourceEnv)
+          sourceValue world bodyEmit resultValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  simp only [lowerE] at hrun
+  obtain ⟨valueResult, valueState, hvalueRun, hafterValue⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases uses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := trackedBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (trackedThrowRun_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := trackedBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (trackedThrowRun_not_ok hthrow).elim
+      | affine =>
+        let heldInput :=
+          installAliasBinder middle abs 0 Uses.affine true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+          trackedBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hafterBody
+        obtain ⟨hresult, hstate⟩ := hpure
+        cases hresult
+        subst finalState
+        obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+          hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+            intro hno
+            have hinstalled :=
+              (hno.consSlot abs 0 .affine true).setSlot
+                0 abs 0 .affine false
+            simpa [bodyInput, heldInput, installAliasBinder] using
+              hinstalled.bump)
+        have htracked : FirstEntryTracks bodyInput .affine
+            (countUses 0 body) := by
+          refine ⟨abs, middle.entries, ?_⟩
+          simp [bodyInput, heldInput,
+            installAliasBinder, VEnv.setEntry, VEnv.bump, hzero]
+        have hreleased := hreleases htracked hbodyRun
+        have hentry : heldInput.entries[0]? =
+            some (.slot abs 0 Uses.affine true) := by
+          simp [heldInput, installAliasBinder]
+        have hinstall : InstallBinderValueProgress funRel recSelfRel ctx cur
+            middle bodyInput sourceEnv boundSource .unique (.slotA abs)
+            (emitOp (.dropU (.var (middle.rel abs)))) := by
+          refine { toInstallBinderValueSound := ?_, graphProgress := ?_ }
+          · refine { toInstallBinderSound := ?_, graphEmits := ?_ }
+            · intro rest slots
+              have halias := installAliasBinder_held
+                (ctx := ctx) (cur := cur) (Γ := middle) (abs := abs)
+                (remaining := 0) (uses := Uses.affine) rest slots
+              have hdrop := release_slot_affine_owned
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry rest slots
+              have hcomposed := EmitSound.comp halias hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+            · intro sourceRest rest slots
+              have halias := installAliasBinder_held_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := middle)
+                (sourceEnv := sourceEnv) (boundSource := boundSource)
+                (abs := abs) (remaining := 0) (uses := Uses.affine)
+              have hdrop := release_slot_affine_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry
+                (boundSource :: sourceEnv) sourceRest rest slots
+              have hcomposed := EmitSound.comp
+                (halias.graphEmits sourceRest rest slots) hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+          · intro sourceRest rest slots
+            have halias := installAliasBinder_held_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := middle)
+              (sourceEnv := sourceEnv) (boundSource := boundSource)
+              (abs := abs) (remaining := 0) (uses := Uses.affine)
+            have hdrop := release_slot_affine_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+              (abs := abs) hentry
+              (boundSource :: sourceEnv) sourceRest rest slots
+            have hcomposed := EmitProgress.comp
+              (halias.graphProgress sourceRest rest slots) hdrop
+            simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+              worldOfUses, Function.comp_def] using hcomposed
+        have hprogress :=
+          hvalueProgress.installThen hinstall hbodyProgress hreleased
+        simpa [worldOfUses, Function.comp_def] using hprogress
+      | many =>
+        let heldInput := installAliasBinder middle abs 0 Uses.many true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+          trackedBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hafterBody
+        obtain ⟨hresult, hstate⟩ := hpure
+        cases hresult
+        subst finalState
+        obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+          hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+            intro hno
+            have hinstalled :=
+              (hno.consSlot abs 0 .many true).setSlot
+                0 abs 0 .many false
+            simpa [bodyInput, heldInput, installAliasBinder] using
+              hinstalled.bump)
+        have htracked : FirstEntryTracks bodyInput .many
+            (countUses 0 body) := by
+          refine ⟨abs, middle.entries, ?_⟩
+          simp [bodyInput, heldInput,
+            installAliasBinder, VEnv.setEntry, VEnv.bump, hzero]
+        have hreleased := hreleases htracked hbodyRun
+        have hentry : heldInput.entries[0]? =
+            some (.slot abs 0 Uses.many true) := by
+          simp [heldInput, installAliasBinder]
+        have hinstall : InstallBinderValueProgress funRel recSelfRel ctx cur
+            middle bodyInput sourceEnv boundSource .shared (.slotA abs)
+            (emitOp (.drop (.var (middle.rel abs)))) := by
+          refine { toInstallBinderValueSound := ?_, graphProgress := ?_ }
+          · refine { toInstallBinderSound := ?_, graphEmits := ?_ }
+            · intro rest slots
+              have halias := installAliasBinder_held
+                (ctx := ctx) (cur := cur) (Γ := middle) (abs := abs)
+                (remaining := 0) (uses := Uses.many) rest slots
+              have hdrop := release_slot_many_owned
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry rest slots
+              have hcomposed := EmitSound.comp halias hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+            · intro sourceRest rest slots
+              have halias := installAliasBinder_held_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := middle)
+                (sourceEnv := sourceEnv) (boundSource := boundSource)
+                (abs := abs) (remaining := 0) (uses := Uses.many)
+              have hdrop := release_slot_many_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry
+                (boundSource :: sourceEnv) sourceRest rest slots
+              have hcomposed := EmitSound.comp
+                (halias.graphEmits sourceRest rest slots) hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+          · intro sourceRest rest slots
+            have halias := installAliasBinder_held_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := middle)
+              (sourceEnv := sourceEnv) (boundSource := boundSource)
+              (abs := abs) (remaining := 0) (uses := Uses.many)
+            have hdrop := release_slot_many_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+              (abs := abs) hentry
+              (boundSource :: sourceEnv) sourceRest rest slots
+            have hcomposed := EmitProgress.comp
+              (halias.graphProgress sourceRest rest slots) hdrop
+            simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+              worldOfUses, Function.comp_def] using hcomposed
+        have hprogress :=
+          hvalueProgress.installThen hinstall hbodyProgress hreleased
+        simpa [worldOfUses, Function.comp_def] using hprogress
+    · let bodyInput := installAliasBinder middle abs
+          (countUses 0 body) uses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue)).run
+            valueState = .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installAliasBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue) =
+              (output, emit, av) ∧ bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+        hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+          intro hno
+          simpa [bodyInput, installAliasBinder] using
+            hno.consSlot abs (countUses 0 body) uses true)
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨abs, middle.entries, ?_⟩
+        simp [bodyInput, installAliasBinder, hzero]
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_held_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := countUses 0 body) (uses := uses)
+      have hprogress :=
+        hvalueProgress.installThen hinstall hbodyProgress hreleased
+      simpa [Function.comp_def] using hprogress
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput := installPushedBinder middle 0 uses false
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+        hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+          intro hno
+          simpa [bodyInput, installPushedBinder, VEnv.bump] using
+            (hno.consSlot middle.depth 0 uses false).bump)
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨middle.depth, middle.entries, ?_⟩
+        simp [bodyInput, installPushedBinder, hzero]
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := 0)
+        (uses := uses) (held := false) hvalueProgress.stable
+      have hprogress :=
+        hvalueProgress.installThen hinstall hbodyProgress hreleased
+      simpa [worldOfUses, Function.comp_def] using hprogress
+    · let bodyInput := installPushedBinder middle (countUses 0 body)
+          uses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+        hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+          intro hno
+          simpa [bodyInput, installPushedBinder, VEnv.bump] using
+            (hno.consSlot middle.depth (countUses 0 body) uses true).bump)
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨middle.depth, middle.entries, ?_⟩
+        simp [bodyInput, installPushedBinder, hzero]
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := countUses 0 body)
+        (uses := uses) (held := true) hvalueProgress.stable
+      have hprogress :=
+        hvalueProgress.installThen hinstall hbodyProgress hreleased
+      simpa [worldOfUses, Function.comp_def] using hprogress
+
+/-- Reachable-state let progress.  The suffix relation from the body to the
+ambient compiler state also makes the earlier value run reachable, while the
+no-self transport rebuilds progress availability for the installed binder. -/
+theorem lowerE_let_run_value_progress_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {valueFuel bodyFuel : Nat}
+    {boundSource sourceValue : IxIR0.Value}
+    (hvalueSource : IxIR0.eval sourceCtx valueFuel sourceEnv value =
+      .ok boundSource)
+    (hbodySource : IxIR0.eval sourceCtx bodyFuel
+      (boundSource :: sourceEnv) body = .ok sourceValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  apply lowerE_let_run_value_progress
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- Projection-safe reachable-state let progress.  Safety is threaded
+separately through the bound expression and the body under its new source
+binder. -/
+theorem lowerE_let_run_value_progress_safely_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueProgressesSafelyWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    (hvalueSource : ProjectionSafeEval sourceCtx sourceEnv value
+      boundSource)
+    (hbodySource : ProjectionSafeEval sourceCtx (boundSource :: sourceEnv)
+      body sourceValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  apply lowerE_let_run_value_progress
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- Settling semantic let branch of `lowerE`.  The value emitter, binder
+installation (including any eager release), and body emitter are all total on
+the graph-owned states established by the preceding stage. -/
+theorem lowerE_let_run_value_settlement
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    (hrecursive : ∀ {middle bodyInput bodyOutput : VEnv}
+      {valueEmit bodyEmit : Emit} {boundValue resultValue : AVal}
+      {valueState bodyState bodyFinal : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+        .ok (middle, valueEmit, boundValue) valueState →
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, resultValue) bodyFinal →
+      bodyState = valueState →
+      ExtraExtends bodyFinal finalState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      LowerResultValueSettlement funRel recSelfRel ctx cur input middle
+          sourceEnv sourceEnv boundSource (worldOfUses uses)
+          valueEmit boundValue ∧
+        LowerResultValueSettlement funRel recSelfRel ctx cur bodyInput bodyOutput
+          (boundSource :: sourceEnv) (boundSource :: sourceEnv)
+          sourceValue world bodyEmit resultValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  simp only [lowerE] at hrun
+  obtain ⟨valueResult, valueState, hvalueRun, hafterValue⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases uses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := trackedBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (trackedThrowRun_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := trackedBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (trackedThrowRun_not_ok hthrow).elim
+      | affine =>
+        let heldInput :=
+          installAliasBinder middle abs 0 Uses.affine true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+          trackedBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hafterBody
+        obtain ⟨hresult, hstate⟩ := hpure
+        cases hresult
+        subst finalState
+        obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+          hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+            intro hno
+            have hinstalled :=
+              (hno.consSlot abs 0 .affine true).setSlot
+                0 abs 0 .affine false
+            simpa [bodyInput, heldInput, installAliasBinder] using
+              hinstalled.bump)
+        have htracked : FirstEntryTracks bodyInput .affine
+            (countUses 0 body) := by
+          refine ⟨abs, middle.entries, ?_⟩
+          simp [bodyInput, heldInput,
+            installAliasBinder, VEnv.setEntry, VEnv.bump, hzero]
+        have hreleased := hreleases htracked hbodyRun
+        have hentry : heldInput.entries[0]? =
+            some (.slot abs 0 Uses.affine true) := by
+          simp [heldInput, installAliasBinder]
+        have hinstall : InstallBinderValueProgress funRel recSelfRel ctx cur
+            middle bodyInput sourceEnv boundSource .unique (.slotA abs)
+            (emitOp (.dropU (.var (middle.rel abs)))) := by
+          refine { toInstallBinderValueSound := ?_, graphProgress := ?_ }
+          · refine { toInstallBinderSound := ?_, graphEmits := ?_ }
+            · intro rest slots
+              have halias := installAliasBinder_held
+                (ctx := ctx) (cur := cur) (Γ := middle) (abs := abs)
+                (remaining := 0) (uses := Uses.affine) rest slots
+              have hdrop := release_slot_affine_owned
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry rest slots
+              have hcomposed := EmitSound.comp halias hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+            · intro sourceRest rest slots
+              have halias := installAliasBinder_held_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := middle)
+                (sourceEnv := sourceEnv) (boundSource := boundSource)
+                (abs := abs) (remaining := 0) (uses := Uses.affine)
+              have hdrop := release_slot_affine_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry
+                (boundSource :: sourceEnv) sourceRest rest slots
+              have hcomposed := EmitSound.comp
+                (halias.graphEmits sourceRest rest slots) hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+          · intro sourceRest rest slots
+            have halias := installAliasBinder_held_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := middle)
+              (sourceEnv := sourceEnv) (boundSource := boundSource)
+              (abs := abs) (remaining := 0) (uses := Uses.affine)
+            have hdrop := release_slot_affine_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+              (abs := abs) hentry
+              (boundSource :: sourceEnv) sourceRest rest slots
+            have hcomposed := EmitProgress.comp
+              (halias.graphProgress sourceRest rest slots) hdrop
+            simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+              worldOfUses, Function.comp_def] using hcomposed
+        have hprogress :=
+          hvalueProgress.installThen hinstall hbodyProgress hreleased
+        simpa [worldOfUses, Function.comp_def] using hprogress
+      | many =>
+        let heldInput := installAliasBinder middle abs 0 Uses.many true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+          trackedBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hafterBody
+        obtain ⟨hresult, hstate⟩ := hpure
+        cases hresult
+        subst finalState
+        obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+          hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+            intro hno
+            have hinstalled :=
+              (hno.consSlot abs 0 .many true).setSlot
+                0 abs 0 .many false
+            simpa [bodyInput, heldInput, installAliasBinder] using
+              hinstalled.bump)
+        have htracked : FirstEntryTracks bodyInput .many
+            (countUses 0 body) := by
+          refine ⟨abs, middle.entries, ?_⟩
+          simp [bodyInput, heldInput,
+            installAliasBinder, VEnv.setEntry, VEnv.bump, hzero]
+        have hreleased := hreleases htracked hbodyRun
+        have hentry : heldInput.entries[0]? =
+            some (.slot abs 0 Uses.many true) := by
+          simp [heldInput, installAliasBinder]
+        have hinstall : InstallBinderValueProgress funRel recSelfRel ctx cur
+            middle bodyInput sourceEnv boundSource .shared (.slotA abs)
+            (emitOp (.drop (.var (middle.rel abs)))) := by
+          refine { toInstallBinderValueSound := ?_, graphProgress := ?_ }
+          · refine { toInstallBinderSound := ?_, graphEmits := ?_ }
+            · intro rest slots
+              have halias := installAliasBinder_held
+                (ctx := ctx) (cur := cur) (Γ := middle) (abs := abs)
+                (remaining := 0) (uses := Uses.many) rest slots
+              have hdrop := release_slot_many_owned
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry rest slots
+              have hcomposed := EmitSound.comp halias hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+            · intro sourceRest rest slots
+              have halias := installAliasBinder_held_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := middle)
+                (sourceEnv := sourceEnv) (boundSource := boundSource)
+                (abs := abs) (remaining := 0) (uses := Uses.many)
+              have hdrop := release_slot_many_value_sound
+                (funRel := funRel) (recSelfRel := recSelfRel)
+                (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+                (abs := abs) hentry
+                (boundSource :: sourceEnv) sourceRest rest slots
+              have hcomposed := EmitSound.comp
+                (halias.graphEmits sourceRest rest slots) hdrop
+              simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+                worldOfUses, Function.comp_def] using hcomposed
+          · intro sourceRest rest slots
+            have halias := installAliasBinder_held_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := middle)
+              (sourceEnv := sourceEnv) (boundSource := boundSource)
+              (abs := abs) (remaining := 0) (uses := Uses.many)
+            have hdrop := release_slot_many_value_progress
+              (funRel := funRel) (recSelfRel := recSelfRel)
+              (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+              (abs := abs) hentry
+              (boundSource :: sourceEnv) sourceRest rest slots
+            have hcomposed := EmitProgress.comp
+              (halias.graphProgress sourceRest rest slots) hdrop
+            simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+              worldOfUses, Function.comp_def] using hcomposed
+        have hprogress :=
+          hvalueProgress.installThen hinstall hbodyProgress hreleased
+        simpa [worldOfUses, Function.comp_def] using hprogress
+    · let bodyInput := installAliasBinder middle abs
+          (countUses 0 body) uses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue)).run
+            valueState = .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installAliasBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue) =
+              (output, emit, av) ∧ bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+        hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+          intro hno
+          simpa [bodyInput, installAliasBinder] using
+            hno.consSlot abs (countUses 0 body) uses true)
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨abs, middle.entries, ?_⟩
+        simp [bodyInput, installAliasBinder, hzero]
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_held_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := countUses 0 body) (uses := uses)
+      have hprogress :=
+        hvalueProgress.installThen hinstall hbodyProgress hreleased
+      simpa [Function.comp_def] using hprogress
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput := installPushedBinder middle 0 uses false
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+        hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+          intro hno
+          simpa [bodyInput, installPushedBinder, VEnv.bump] using
+            (hno.consSlot middle.depth 0 uses false).bump)
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨middle.depth, middle.entries, ?_⟩
+        simp [bodyInput, installPushedBinder, hzero]
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := 0)
+        (uses := uses) (held := false) hvalueProgress.stable
+      have hprogress :=
+        hvalueProgress.installThen hinstall hbodyProgress hreleased
+      simpa [worldOfUses, Function.comp_def] using hprogress
+    · let bodyInput := installPushedBinder middle (countUses 0 body)
+          uses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      obtain ⟨hvalueProgress, hbodyProgress⟩ :=
+        hrecursive hvalueRun hbodyRun rfl (ExtraExtends.refl _) (by
+          intro hno
+          simpa [bodyInput, installPushedBinder, VEnv.bump] using
+            (hno.consSlot middle.depth (countUses 0 body) uses true).bump)
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨middle.depth, middle.entries, ?_⟩
+        simp [bodyInput, installPushedBinder, hzero]
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_progress
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := countUses 0 body)
+        (uses := uses) (held := true) hvalueProgress.stable
+      have hprogress :=
+        hvalueProgress.installThen hinstall hbodyProgress hreleased
+      simpa [worldOfUses, Function.comp_def] using hprogress
+
+/-- Reachable-state let settlement.  The suffix relation from the body to the
+ambient compiler state also makes the earlier value run reachable, while the
+no-self transport rebuilds progress availability for the installed binder. -/
+theorem lowerE_let_run_value_settlement_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValueSettlesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {valueFuel bodyFuel : Nat}
+    {boundSource sourceValue : IxIR0.Value}
+    (hvalueSource : IxIR0.eval sourceCtx valueFuel sourceEnv value =
+      .ok boundSource)
+    (hbodySource : IxIR0.eval sourceCtx bodyFuel
+      (boundSource :: sourceEnv) body = .ok sourceValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfProgressAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSettlement funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  apply lowerE_let_run_value_settlement
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- One complete projection-safe expression progress step.  The source
+trace rules out the erased-projection absorber, so every successful lowering
+branch reaches a value rather than merely settling. -/
+theorem lowerE_run_value_progress_safely_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hspine : LowerSpineValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hborrow : LowerBorrowValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hargsNext : LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsource : ProjectionSafeEval sourceCtx sourceEnv expr sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceValue
+      world emit av := by
+  cases hsource with
+  | var hlookup =>
+    exact lowerE_var_run_value_progress hlookup hrun
+  | ref href =>
+    exact lowerE_ref_run_value_progress_safely_within henv hargsNext
+      hrestNext hknownExtra hcontracts hvalues hprogress (.ref href) hrun
+      hextends hrepresented havailable
+  | app hfunction hargument happly =>
+    apply hspine
+      (ProjectionSafeSpine.of_eval_app (.app hfunction hargument happly))
+    · simpa [lowerE] using hrun
+    · exact hextends
+    · exact havailable
+  | lam =>
+    exact lowerE_lam_run_value_progress_any
+      (fun value address arity captures hlifted =>
+        CompilerFunctionRel.lifted (hlifted.monoState hextends))
+      (hrepresented.of_extends hextends) hrun
+  | letE hvalue hbody =>
+    exact lowerE_let_run_value_progress_safely_within hexpr hvalue hbody
+      (hreleases _) hrun hextends havailable
+  | proj htarget hfield =>
+    exact lowerE_proj_ctor_run_value_progress_safely_within henv hborrow
+      htarget hfield hrun hextends havailable
+  | lit =>
+    exact lowerE_lit_run_value_progress hrun
+  | erased =>
+    exact lowerE_erased_run_value_progress hrun
+
+/-! Exact-trace expression progress. -/
+
+/-- Package the complete exact-trace spine rule using `lowerSpine`'s
+two-step compiler-fuel accounting. -/
+theorem lowerSpineValueTraceProgressesWithinBelow_succ_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hexpr : LowerEValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hrepresented : ExtraRepresented ctx ambient) :
+    LowerSpineValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 2) := by
+  intro input output world sourceLimit head args sourceEnv sourceResult state
+    finalState emit av hsourceBound hsource hcallable hrun hextends
+    havailable
+  exact lowerSpine_run_value_trace_progress_within_below henv hspine hexpr
+    hreflect hargs hrest hrestNext hknownExtra hcontracts hvalues hprogress
+    hsourceBound hsource hcallable hrun hextends hrepresented havailable
+
+/-- Standalone exact-trace references inherit static-spine progress through
+the empty-argument correspondence. -/
+theorem lowerE_ref_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit sourceFuel fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hrest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsourceBound : sourceFuel < limit)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceEnv
+      (.ref f) sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  apply lowerSpine_ref_run_value_trace_progress_within_below henv hargs
+    hrest hknownExtra hcontracts hvalues hprogress hsourceBound
+      (IxIR0.ProjectionSafe.Spine.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+  · exact havailable
+
+/-- Constructor projection progress specialized to an exact source trace. -/
+theorem lowerE_proj_ctor_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit sourceFuel fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hborrow : LowerBorrowValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {fields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsourceBound : sourceFuel < limit)
+    (htarget : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceEnv
+      source (.ctor address tag fields))
+    (hfield : fields[index]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceValue world emit av := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp only [lowerE, huuEq, if_true] at hrun
+    exact (trackedThrowRun_not_ok hrun).elim
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hnotFunction : ∀ f arity captures,
+        ¬ CompilerFunctionRel sourceCtx src ambient
+          (.ctor address tag fields) f arity captures := by
+      intro f arity captures hrel
+      exact hrel.value_ne_ctor henv rfl
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.var relative) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        cases (hborrow hsourceBound htarget hborrowRun hextends
+          havailable).stable
+      | lit literal =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow hsourceBound htarget hborrowRun hextends
+          havailable).projectCtorLiteral
+      | erased =>
+        have hpure :
+            (borrowOutput, borrowEmit, AVal.constA .erased) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow hsourceBound htarget hborrowRun hextends
+          havailable).projectCtorErased
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure :
+            (borrowOutput.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow hsourceBound htarget hborrowRun hextends
+          havailable).projectSlotKept hnotFunction hfield
+      | true =>
+        have hpure :
+            (borrowOutput.bump.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                emitOp (.drop
+                  (.var (borrowOutput.bump.bump.rel targetAbs))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact (hborrow hsourceBound htarget hborrowRun hextends
+          havailable).projectSlotReleased hnotFunction hfield
+
+/-- Exact-trace reachable-state let progress threads the predecessor source
+fuel through both recursive expressions. -/
+theorem lowerE_let_run_value_trace_progress_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit sourceFuel : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel : Nat}
+    (hexpr : LowerEValueTraceProgressesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    (hsourceBound : sourceFuel < limit)
+    (hvalueSource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel
+      sourceEnv value boundSource)
+    (hbodySource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel
+      (boundSource :: sourceEnv) body sourceValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfTraceProgressAvailableBelow funRel recSelfRel
+      sourceCtx ctx cur limit input) :
+    LowerResultValueProgress funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  apply lowerE_let_run_value_progress
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hsourceBound hvalueSource hvalueRun hvalueExtends
+        havailable,
+      hexpr hsourceBound hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- One complete exact-trace expression progress step. -/
+theorem lowerE_run_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hspine : LowerSpineValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hborrow : LowerBorrowValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hargsNext : LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {sourceFuel : Nat} {sourceEnv : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsourceBound : sourceFuel < limit)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceEnv
+      expr sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfTraceProgressAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueProgress (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceValue
+      world emit av := by
+  cases hsource with
+  | var hlookup =>
+    exact lowerE_var_run_value_progress hlookup hrun
+  | refDefn hdecl hbody =>
+    exact lowerE_ref_run_value_trace_progress_within_below henv hargsNext
+      hrestNext hknownExtra hcontracts hvalues hprogress hsourceBound
+      (.refDefn hdecl hbody) hrun hextends hrepresented havailable
+  | refCtor hdecl hsaturate =>
+    exact lowerE_ref_run_value_trace_progress_within_below henv hargsNext
+      hrestNext hknownExtra hcontracts hvalues hprogress hsourceBound
+      (.refCtor hdecl hsaturate) hrun hextends hrepresented havailable
+  | refRecursor hdecl =>
+    exact lowerE_ref_run_value_trace_progress_within_below henv hargsNext
+      hrestNext hknownExtra hcontracts hvalues hprogress hsourceBound
+      (.refRecursor hdecl) hrun hextends hrepresented havailable
+  | refExtern hdecl hsaturate =>
+    exact lowerE_ref_run_value_trace_progress_within_below henv hargsNext
+      hrestNext hknownExtra hcontracts hvalues hprogress hsourceBound
+      (.refExtern hdecl hsaturate) hrun hextends hrepresented havailable
+  | app hfunction hargument happly =>
+    apply hspine hsourceBound
+      (IxIR0.ProjectionSafe.Spine.of_eval_app
+        (.app hfunction hargument happly))
+    · exact Or.inl (by simp)
+    · simpa [lowerE] using hrun
+    · exact hextends
+    · exact havailable
+  | lam =>
+    exact lowerE_lam_run_value_progress_any
+      (fun value address arity captures hlifted =>
+        CompilerFunctionRel.lifted (hlifted.monoState hextends))
+      (hrepresented.of_extends hextends) hrun
+  | letE hvalue hbody =>
+    exact lowerE_let_run_value_trace_progress_within_below hexpr
+      (by omega) hvalue hbody (hreleases _) hrun hextends havailable
+  | proj htarget hfield =>
+    exact lowerE_proj_ctor_run_value_trace_progress_within_below henv
+      hborrow (by omega) htarget hfield hrun hextends havailable
+  | lit =>
+    exact lowerE_lit_run_value_progress hrun
+  | erased =>
+    exact lowerE_erased_run_value_progress hrun
+
+/-- One complete reachable-state expression settlement step.  Static and
+higher-order calls use their source-guided progress contracts; projection
+and sequencing retain only the weaker non-memory terminal guarantee. -/
+theorem lowerE_run_value_settlement_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hspine : LowerSpineValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hborrow : LowerBorrowValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hargsNext : LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfProgressAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSettlement (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceValue
+      world emit av := by
+  cases expr with
+  | var index =>
+    exact (lowerE_var_run_value_progress
+      (sourceEval_var_inv hsource) hrun).settlement
+  | ref address =>
+    exact lowerE_ref_run_value_settlement_within henv hargsNext hrestNext
+      hknownExtra hcontracts hvalues hprogress hsource hrun hextends
+      hrepresented havailable
+  | app function argument =>
+    apply hspine (SourceSpineEval.of_eval_app hsource)
+    · simpa [lowerE] using hrun
+    · exact hextends
+    · exact havailable
+  | lam uses body =>
+    have hvalue := sourceEval_lam_inv hsource
+    subst sourceValue
+    exact (lowerE_lam_run_value_progress_any
+      (fun value address arity captures hlifted =>
+        CompilerFunctionRel.lifted (hlifted.monoState hextends))
+      (hrepresented.of_extends hextends) hrun).settlement
+  | letE uses value body =>
+    obtain ⟨sourceStep, boundSource, hvalueSource, hbodySource⟩ :=
+      sourceEval_let_inv hsource
+    exact lowerE_let_run_value_settlement_within hexpr hvalueSource
+      hbodySource (hreleases body) hrun hextends havailable
+  | proj index source =>
+    obtain ⟨sourceStep, sourceTarget, htarget, hproject⟩ :=
+      sourceEval_proj_inv hsource
+    exact lowerE_proj_run_value_settlement_within henv hborrow htarget
+      hproject hrun hextends havailable
+  | lit literal =>
+    have hvalue := sourceEval_lit_inv hsource
+    subst sourceValue
+    exact (lowerE_lit_run_value_progress hrun).settlement
+  | erased =>
+    have hvalue := sourceEval_erased_inv hsource
+    subst sourceValue
+    exact (lowerE_erased_run_value_progress hrun).settlement
+
+/-- The mutually recursive settling invariant at one compiler-fuel index. -/
+structure LowerValueSettlementClusterWithin
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (fuel : Nat) : Prop where
+  expr : LowerEValueSettlesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  borrow : LowerBorrowValueSettlesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  spine : LowerSpineValueSettlesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  args : LowerArgsValueSettlesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  applyRest : ApplyRestNonErasedValueSettlesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+
+/-- Complete compiler-fuel induction for non-memory settlement.  Unlike the
+strong progress induction, this remains valid across the formally exposed
+erased-projection stuck branch. -/
+theorem lowerValueSettlementClusterWithin
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx) :
+    ∀ fuel,
+      LowerValueSettlementClusterWithin sourceCtx src ambient recSelfRel ctx
+        cur fuel :=
+  lowerValueClusterWithin_core
+    (Expr := LowerEValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Borrow := LowerBorrowValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Spine := LowerSpineValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Args := LowerArgsValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (ApplyRest := ApplyRestNonErasedValueSettlesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Cluster := LowerValueSettlementClusterWithin sourceCtx src ambient
+      recSelfRel ctx cur)
+    (hzero := {
+      expr := lowerEValueSettlesWithin_zero
+      borrow := lowerBorrowValueSettlesWithin_zero
+      spine := lowerSpineValueSettlesWithin_zero
+      args := lowerArgsValueSettlesWithin_zero
+      applyRest := applyRestNonErasedValueSettlesWithin_zero })
+    (hclusterExpr := fun hcluster => hcluster.expr)
+    (hclusterBorrow := fun hcluster => hcluster.borrow)
+    (hclusterSpine := fun hcluster => hcluster.spine)
+    (hclusterArgs := fun hcluster => hcluster.args)
+    (hclusterApplyRest := fun hcluster => hcluster.applyRest)
+    (hmake := fun hexpr hborrow hspine hargs hrest => {
+      expr := hexpr
+      borrow := hborrow
+      spine := hspine
+      args := hargs
+      applyRest := hrest })
+    (hargsSucc := fun hexpr hargs =>
+      lowerArgsValueSettlesWithin_succ hexpr hargs)
+    (happlyRestSucc := fun hargs =>
+      applyRestNonErasedValueSettlesWithin_succ hargs
+        hprogress.apply hcontracts.apply hvalues.apply)
+    (hborrowSucc := fun hexpr =>
+      lowerBorrowValueSettlesWithin_succ hexpr)
+    (hspineOne := lowerSpineValueSettlesWithin_one)
+    (hspineSucc := by
+      intro fuel hprevSpine hprevExpr hpriorArgs hpriorRest hprevRest
+      exact lowerSpineValueSettlesWithin_succ_succ henv hprevSpine
+        hprevExpr (lowerE_reflectsErased sourceCtx src (fuel + 1))
+        hpriorArgs hpriorRest hprevRest
+        (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts
+        hvalues hprogress hrepresented)
+    (hexprSucc := by
+      intro fuel hprevExpr hprevSpine hprevBorrow hargs hrest
+      intro input output world expr sourceEnv sourceFuel sourceValue state
+        finalState emit av hsource hrun hextends havailable
+      exact lowerE_run_value_settlement_within (fuel := fuel) henv
+        hprevExpr hprevSpine hprevBorrow hargs hrest
+        (lowerExtraMonotone src (fuel + 2)).knownCall hcontracts hvalues
+        hprogress (fun body => lowerE_releasesTrackedFirst src fuel body)
+        hsource hrun hextends hrepresented havailable)
+/-- The mutually recursive projection-safe value-progress invariant at one
+compiler-fuel index. -/
+structure LowerValueProgressSafeClusterWithin
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (fuel : Nat) : Prop where
+  expr : LowerEValueProgressesSafelyWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  borrow : LowerBorrowValueProgressesSafelyWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  spine : LowerSpineValueProgressesSafelyWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  args : LowerArgsValueProgressesSafelyWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  applyRest : ApplyRestNonErasedValueProgressesSafelyWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+
+/-- Complete compiler-fuel induction for value progress on projection-safe
+source executions. -/
+theorem lowerValueProgressSafeClusterWithin
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx) :
+    ∀ fuel,
+      LowerValueProgressSafeClusterWithin sourceCtx src ambient recSelfRel ctx
+        cur fuel :=
+  lowerValueClusterWithin_core
+    (Expr := LowerEValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Borrow := LowerBorrowValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Spine := LowerSpineValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Args := LowerArgsValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (ApplyRest := ApplyRestNonErasedValueProgressesSafelyWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Cluster := LowerValueProgressSafeClusterWithin sourceCtx src ambient
+      recSelfRel ctx cur)
+    (hzero := {
+      expr := lowerEValueProgressesSafelyWithin_zero
+      borrow := lowerBorrowValueProgressesSafelyWithin_zero
+      spine := lowerSpineValueProgressesSafelyWithin_zero
+      args := lowerArgsValueProgressesSafelyWithin_zero
+      applyRest := applyRestNonErasedValueProgressesSafelyWithin_zero })
+    (hclusterExpr := fun hcluster => hcluster.expr)
+    (hclusterBorrow := fun hcluster => hcluster.borrow)
+    (hclusterSpine := fun hcluster => hcluster.spine)
+    (hclusterArgs := fun hcluster => hcluster.args)
+    (hclusterApplyRest := fun hcluster => hcluster.applyRest)
+    (hmake := fun hexpr hborrow hspine hargs hrest => {
+      expr := hexpr
+      borrow := hborrow
+      spine := hspine
+      args := hargs
+      applyRest := hrest })
+    (hargsSucc := fun hexpr hargs =>
+      lowerArgsValueProgressesSafelyWithin_succ hexpr hargs)
+    (happlyRestSucc := fun hargs =>
+      applyRestNonErasedValueProgressesSafelyWithin_succ hargs
+        hprogress.apply hcontracts.apply hvalues.apply)
+    (hborrowSucc := fun hexpr =>
+      lowerBorrowValueProgressesSafelyWithin_succ hexpr)
+    (hspineOne := lowerSpineValueProgressesSafelyWithin_one)
+    (hspineSucc := by
+      intro fuel hprevSpine hprevExpr hpriorArgs hpriorRest hprevRest
+      exact lowerSpineValueProgressesSafelyWithin_succ_succ henv
+        hprevSpine hprevExpr
+        (lowerE_reflectsErased sourceCtx src (fuel + 1)) hpriorArgs
+        hpriorRest hprevRest
+        (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts
+        hvalues hprogress hrepresented)
+    (hexprSucc := by
+      intro fuel hprevExpr hprevSpine hprevBorrow hargs hrest
+      intro input output world expr sourceEnv sourceValue state finalState
+        emit av hsource hrun hextends havailable
+      exact lowerE_run_value_progress_safely_within (fuel := fuel) henv
+        hprevExpr hprevSpine hprevBorrow hargs hrest
+        (lowerExtraMonotone src (fuel + 2)).knownCall hcontracts hvalues
+        hprogress (fun body => lowerE_releasesTrackedFirst src fuel body)
+        hsource hrun hextends hrepresented havailable)
+/-- The mutually recursive exact-trace progress invariant at one compiler
+fuel and one outer source-fuel induction bound. -/
+structure LowerValueTraceProgressClusterWithinBelow
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit fuel : Nat) : Prop where
+  expr : LowerEValueTraceProgressesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  borrow : LowerBorrowValueTraceProgressesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  spine : LowerSpineValueTraceProgressesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  args : LowerArgsValueTraceProgressesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  applyRest : ApplyRestNonErasedValueTraceProgressesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+
+/-- Complete compiler-fuel induction for exact source traces strictly below
+one outer source-fuel bound. -/
+theorem lowerValueTraceProgressClusterWithinBelow
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit) :
+    ∀ fuel,
+      LowerValueTraceProgressClusterWithinBelow sourceCtx src ambient
+        recSelfRel ctx cur limit fuel :=
+  lowerValueClusterWithin_core
+    (Expr := LowerEValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Borrow := LowerBorrowValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Spine := LowerSpineValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Args := LowerArgsValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (ApplyRest := ApplyRestNonErasedValueTraceProgressesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Cluster := LowerValueTraceProgressClusterWithinBelow sourceCtx src
+      ambient recSelfRel ctx cur limit)
+    (hzero := {
+      expr := lowerEValueTraceProgressesWithinBelow_zero
+      borrow := lowerBorrowValueTraceProgressesWithinBelow_zero
+      spine := lowerSpineValueTraceProgressesWithinBelow_zero
+      args := lowerArgsValueTraceProgressesWithinBelow_zero
+      applyRest := applyRestNonErasedValueTraceProgressesWithinBelow_zero })
+    (hclusterExpr := fun hcluster => hcluster.expr)
+    (hclusterBorrow := fun hcluster => hcluster.borrow)
+    (hclusterSpine := fun hcluster => hcluster.spine)
+    (hclusterArgs := fun hcluster => hcluster.args)
+    (hclusterApplyRest := fun hcluster => hcluster.applyRest)
+    (hmake := fun hexpr hborrow hspine hargs hrest => {
+      expr := hexpr
+      borrow := hborrow
+      spine := hspine
+      args := hargs
+      applyRest := hrest })
+    (hargsSucc := fun hexpr hargs =>
+      lowerArgsValueTraceProgressesWithinBelow_succ hexpr hargs)
+    (happlyRestSucc := fun hargs =>
+      applyRestNonErasedValueTraceProgressesWithinBelow_succ hargs
+        hprogress.apply hcontracts.apply hvalues.apply)
+    (hborrowSucc := fun hexpr =>
+      lowerBorrowValueTraceProgressesWithinBelow_succ hexpr)
+    (hspineOne := lowerSpineValueTraceProgressesWithinBelow_one)
+    (hspineSucc := by
+      intro fuel hprevSpine hprevExpr hpriorArgs hpriorRest hprevRest
+      exact lowerSpineValueTraceProgressesWithinBelow_succ_succ henv
+        hprevSpine hprevExpr
+        (lowerE_reflectsErased sourceCtx src (fuel + 1)) hpriorArgs
+        hpriorRest hprevRest
+        (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts
+        hvalues hprogress hrepresented)
+    (hexprSucc := by
+      intro fuel hprevExpr hprevSpine hprevBorrow hargs hrest
+      intro input output world expr sourceFuel sourceEnv sourceValue state
+        finalState emit av hsourceBound hsource hrun hextends havailable
+      exact lowerE_run_value_trace_progress_within_below (fuel := fuel)
+        henv hprevExpr hprevSpine hprevBorrow hargs hrest
+        (lowerExtraMonotone src (fuel + 2)).knownCall hcontracts hvalues
+        hprogress (fun body => lowerE_releasesTrackedFirst src fuel body)
+        hsourceBound hsource hrun hextends hrepresented havailable)
+/-- Exact-trace progress for a generated lifted-function body.  Selected
+outer captures occupy the framed suffix of the logical environment, while
+the complete supplied lambda telescope occupies its ordinary parameter
+prefix. -/
+theorem lowerFnBody_liftedEntries_valueTraceProgress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {sourceLimit compilerFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    (entryCount : Nat) (modes : List Uses) (body : IxIR0.Expr)
+    (selected : Nat → Bool)
+    {state finalState : LowSt} {code : Code}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hselectDef : ∀ index, index < entryCount →
+      selected index = (countUses (modes.length + index) body != 0))
+    (hpositive : 0 < modes.length)
+    (hshared : modes.map worldOfUses =
+      List.replicate modes.length .shared)
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      (let captures := (List.range entryCount).filter selected
+       ⟨parameterEntries captures.length modes
+            (fun index => countUses index body) ++
+          selectedEntriesFrom selected
+            (fun index => countUses (modes.length + index) body)
+            (List.range entryCount) 0,
+        captures.length + modes.length⟩)
+      (let captures := (List.range entryCount).filter selected
+       parameterDrops captures.length modes
+          (fun index => countUses index body))
+      .shared body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceEnv selectedSources parameterSources : List IxIR0.Value}
+    {sourceResult : IxIR0.Value}
+    {store : Store} {captureArgs parameterArgs : List RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hsourceLength : sourceEnv.length = entryCount)
+    (hselectedValues : ValuesAt sourceEnv
+      ((List.range entryCount).filter selected) selectedSources)
+    (hcaptureLength : captureArgs.length =
+      ((List.range entryCount).filter selected).length)
+    (hparameterLength : parameterArgs.length = modes.length)
+    (hcaptureGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store selectedSources
+      captureArgs)
+    (hparameterGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store parameterSources
+      parameterArgs)
+    {sourceFuel : Nat}
+    (hsourceBound : sourceFuel < sourceLimit)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel
+      (parameterSources.reverse ++ sourceEnv) body sourceResult)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (captureArgs ++ parameterArgs) ++ rest)) :
+    ∃ targetFuel store' value,
+      runCode ctx targetFuel
+        ⟨((List.range entryCount).filter selected).length + modes.length,
+          .shared, true, code⟩ store
+        (captureArgs ++ parameterArgs).reverse code = .ok (store', value) ∧
+      RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  let captures := (List.range entryCount).filter selected
+  let parameterRemaining : Nat → Nat := fun index => countUses index body
+  let captureRemaining : Nat → Nat :=
+    fun index => countUses (modes.length + index) body
+  let outerEntries := selectedEntriesFrom selected captureRemaining
+    (List.range entryCount) 0
+  let input : VEnv :=
+    ⟨parameterEntries captures.length modes parameterRemaining ++ outerEntries,
+      captures.length + modes.length⟩
+  let drops := parameterDrops captures.length modes parameterRemaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops .shared body).run state =
+        .ok code finalState := by
+    simpa [input, drops, outerEntries, parameterRemaining, captureRemaining,
+      captures] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hinputNo : NoRecSelf input := by
+    apply NoRecSelf.appendEntries
+    · exact parameterEntries_noRecSelf captures.length modes
+        parameterRemaining (captures.length + modes.length)
+    · simpa [outerEntries] using
+        selectedEntriesFrom_noRecSelf selected captureRemaining
+          (List.range entryCount) 0 (captures.length + modes.length)
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun hinputNo
+  obtain ⟨parameterOutput, plannedEmit, hparameterPlan, _⟩ :=
+    parameterDrops_releasePlan_tracked_atDepth captures.length
+      (captures.length + modes.length) modes parameterRemaining
+      (by simpa [parameterRemaining] using hadmissible)
+  let plannedMiddle := frameVEnvEntries parameterOutput outerEntries
+  have hplan : ReleasePlan input drops plannedMiddle plannedEmit := by
+    have hframed := hparameterPlan.frameEntries outerEntries
+    simpa [input, drops, plannedMiddle, outerEntries, frameVEnvEntries]
+      using hframed
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hbodyProgress : LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩
+        plannedMiddle output
+      (parameterSources.reverse ++ sourceEnv)
+      (parameterSources.reverse ++ sourceEnv) sourceResult .shared emit av :=
+    (lowerValueTraceProgressClusterWithinBelow
+      (recSelfRel := fun _ _ => False)
+      (cur :=
+        (⟨captures.length + modes.length, .shared, true, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hprogress compilerFuel).expr
+        hsourceBound hsource hbodyRun hextends
+        (SelfTraceProgressAvailableBelow.of_noRecSelf hmiddleNo)
+  have hfull : LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩ input output
+      (parameterSources.reverse ++ sourceEnv)
+      (parameterSources.reverse ++ sourceEnv) sourceResult .shared
+      (plannedEmit ∘ emit) av :=
+    hbodyProgress.afterRelease hplan
+  have hentryGraph : VEnvValueGraph
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) store
+      input (parameterSources.reverse ++ sourceEnv)
+      (captureArgs ++ parameterArgs).reverse
+      ((rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+        rootsFor .shared captureArgs) := by
+    simpa [input, outerEntries, parameterRemaining, captureRemaining,
+      captures] using
+      VEnvValueGraph.lifted (recSelfRel := fun _ _ => False)
+        entryCount modes parameterRemaining selected captureRemaining
+        hsourceLength hselectedValues hcaptureLength hparameterLength
+        hcaptureGraph hparameterGraph hpositive hshared hown
+  have hparameterRoots :
+      rootsForWorlds (modes.map worldOfUses) parameterArgs =
+        rootsFor .shared parameterArgs := by
+    rw [hshared]
+    exact rootsForWorlds_replicate_eq_rootsFor .shared hparameterLength
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) input
+      (parameterSources.reverse ++ sourceEnv) sourceRest rest store
+      (captureArgs ++ parameterArgs).reverse := by
+    refine ⟨(rootsForWorlds
+        (modes.map worldOfUses) parameterArgs).reverse ++
+          rootsFor .shared captureArgs, hentryGraph, hframe, ?_⟩
+    have hrootPerm :
+        (rootsFor .shared (captureArgs ++ parameterArgs) ++ rest).Perm
+          (((rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+              rootsFor .shared captureArgs) ++ rest) := by
+      rw [hparameterRoots]
+      simp only [rootsFor, List.map_append]
+      exact (List.perm_append_comm.trans
+        ((List.reverse_perm
+          (parameterArgs.map fun value => (⟨.shared, value⟩ : Root))).symm
+            |>.append_right (captureArgs.map fun value =>
+              (⟨.shared, value⟩ : Root)))).append_right rest
+    exact hown.perm hrootPerm
+  obtain ⟨targetFuel, store', value, htarget⟩ :=
+    hfull.closeProgress sourceRest rest hpre
+  have htarget' : runCode ctx targetFuel
+      ⟨captures.length + modes.length, .shared, true, code⟩ store
+      (captureArgs ++ parameterArgs).reverse code = .ok (store', value) := by
+    simpa only [hcode] using htarget
+  have hfinalRepresented : ExtraRepresented ctx finalState :=
+    hrepresented.of_extends hextends
+  have hownershipAt : FnOwnershipPreservesAt ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩
+      (List.replicate (captures.length + modes.length) .shared)
+      targetFuel := by
+    intro ownStore ownStore' ownArgs ownValue ownRest
+      hownLength hownInput hownRun
+    exact (lowerFnBody_liftedEntries_preservesAt
+        (limit := targetFuel) (fuel := compilerFuel)
+        (hcontracts.apply.below targetFuel)
+        (hcontracts.decls.below targetFuel) entryCount modes body selected
+        hadmissible hselectDef hpositive hshared hrun hfinalRepresented)
+      (by simpa [captures] using hownLength)
+      (by simpa [captures] using hownInput)
+      (by simpa [captures] using hownRun)
+  have hargsLength : (captureArgs ++ parameterArgs).length =
+      captures.length + modes.length := by
+    simp [captures, hcaptureLength, hparameterLength]
+  have hroots : rootsForWorlds
+      (List.replicate (captures.length + modes.length) .shared)
+      (captureArgs ++ parameterArgs) =
+        rootsFor .shared (captureArgs ++ parameterArgs) :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hargsLength
+  have hownPublic : RootOwnership store
+      (rootsForWorlds
+        (List.replicate (captures.length + modes.length) .shared)
+        (captureArgs ++ parameterArgs) ++ rest) := by
+    rwa [hroots]
+  have hownAfter : RootOwnership store'
+      (⟨.shared, value⟩ :: rest) := by
+    exact hownershipAt (by simpa using hargsLength) hownPublic htarget'
+  exact ⟨targetFuel, store', value, by simpa [captures] using htarget',
+    hownAfter⟩
+
+/-- Saturating a compiler-provenanced lifted PAP constructs its generated
+target invocation from the exact residual closure trace. -/
+theorem invoke_lifted_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {sourceLimit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    {sourceFunction sourceResult : IxIR0.Value}
+    {address : Ixon.Address} {arity : Nat}
+    {captures sourceArgs : List IxIR0.Value}
+    {store : Store} {got args : List RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hlifted : CompilerLiftedFunctionRel src ambient sourceFunction address
+      arity captures)
+    (hgot : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store captures got)
+    (hargs : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceArgs args)
+    (happlies : SourceAppliesSafelyBelow sourceCtx sourceLimit
+      sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (got ++ args) ++ rest))
+    (htotalLength : (got ++ args).length = arity) :
+    ∃ fuel store' value,
+      invoke ctx fuel address (got ++ args) store = .ok (store', value) := by
+  obtain ⟨sourceEnv, expr, selectedSources, suppliedSources, hliftCode,
+      hselectedValues, hcaptures, harity, hprefix⟩ := hlifted
+  subst captures
+  rw [harity] at htotalLength
+  obtain ⟨bodyCompilerFuel, bodyInitial, bodyFinal, code, hsafe,
+      hbodyRun, hbodyExtends, hmember⟩ := hliftCode
+  have hselectedLength := hselectedValues.length
+  rw [← hselectedLength] at hmember
+  have hdecl : ctx.decls address = some (.fn
+      ⟨selectedSources.length + lamArity expr, .shared, true, code⟩) :=
+    hrepresented.decl hmember
+  have hmodes := papSafe_lamUses_eq_replicate hsafe
+  have hadmissible : ParameterDropsAdmissible (lamUses expr)
+      (fun index => countUses index (stripLams expr)) := by
+    rw [hmodes]
+    exact parameterDropsAdmissible_replicate_many _ _
+  have hselectDef : ∀ index, index < sourceEnv.length →
+      decide (0 < countUses index expr) =
+        (countUses ((lamUses expr).length + index) (stripLams expr) != 0) := by
+    intro index _
+    rw [lamUses_length]
+    rw [← countUses_eq_stripLams_shift expr index]
+    cases countUses index expr <;> rfl
+  have hshared : (lamUses expr).map worldOfUses =
+      List.replicate (lamUses expr).length .shared := by
+    rw [hmodes]
+    simp [worldOfUses]
+  have hpositive : 0 < (lamUses expr).length := by
+    have hunder := hprefix.length_lt_lamArity
+    rw [lamUses_length]
+    omega
+  cases bodyCompilerFuel with
+  | zero =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [lowerFnBody] using hbodyRun)).elim
+  | succ compilerFuel =>
+    let selectedArgs := got.take selectedSources.length
+    let suppliedArgs := got.drop selectedSources.length
+    have hgotSplit : selectedArgs ++ suppliedArgs = got :=
+      List.take_append_drop selectedSources.length got
+    have hselectedGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store selectedSources
+        selectedArgs := by
+      simpa [selectedArgs] using hgot.take selectedSources.length
+    have hsuppliedGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store suppliedSources
+        suppliedArgs := by
+      simpa [suppliedArgs] using hgot.drop selectedSources.length
+    have hparameterGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store
+        (suppliedSources ++ sourceArgs) (suppliedArgs ++ args) :=
+      hsuppliedGraph.append hargs
+    have hselectedArgsLength : selectedArgs.length =
+        (liftCaptureIndices sourceEnv.length expr).length := by
+      calc
+        selectedArgs.length = selectedSources.length := by
+          simpa [selectedArgs] using hselectedGraph.length.symm
+        _ = (liftCaptureIndices sourceEnv.length expr).length :=
+          hselectedValues.length
+    have htotalSplit : selectedArgs ++ (suppliedArgs ++ args) =
+        got ++ args := by
+      rw [← List.append_assoc, hgotSplit]
+    have hownSplit : RootOwnership store
+        (rootsFor .shared (selectedArgs ++ (suppliedArgs ++ args)) ++
+          rest) := by
+      rw [htotalSplit]
+      exact hown
+    have hparameterLength : (suppliedArgs ++ args).length =
+        (lamUses expr).length := by
+      have hgotLength : got.length =
+          selectedSources.length + suppliedSources.length := by
+        simpa using hgot.length.symm
+      have hsuppliedLength : suppliedArgs.length = suppliedSources.length :=
+        hsuppliedGraph.length.symm
+      simp only [List.length_append] at htotalLength ⊢
+      rw [lamUses_length]
+      omega
+    have hlambdaLength : (suppliedSources ++ sourceArgs).length =
+        lamArity expr := by
+      calc
+        (suppliedSources ++ sourceArgs).length =
+            (suppliedArgs ++ args).length := hparameterGraph.length
+        _ = (lamUses expr).length := hparameterLength
+        _ = lamArity expr := lamUses_length expr
+    have hsourceArgsNonempty : sourceArgs ≠ [] := by
+      intro hnil
+      subst sourceArgs
+      have hunder := hprefix.length_lt_lamArity
+      simp only [List.append_nil, List.length_append] at hlambdaLength
+      omega
+    have htwo : 2 < sourceLimit :=
+      happlies.two_lt_limit_of_nonempty hprefix.value_ne_erased
+        hsourceArgsNonempty
+    obtain ⟨sourceFuel, hsourceBound, hsourceTrace⟩ :=
+      hprefix.saturateTrace htwo hlambdaLength happlies
+    have hbodyRun' :
+        (lowerFnBody src (compilerFuel + 1)
+          (liftedBodyVEnv sourceEnv.length expr)
+          (liftedBodyDrops sourceEnv.length expr) .shared
+          (stripLams expr)).run bodyInitial = .ok code bodyFinal := by
+      simpa using hbodyRun
+    obtain ⟨targetFuel, store', value, htarget, hownAfter⟩ :=
+      lowerFnBody_liftedEntries_valueTraceProgress_within_below
+        henv hrepresented hcontracts hvalues hprogress sourceEnv.length
+        (lamUses expr) (stripLams expr)
+        (fun index => countUses index expr > 0)
+        hadmissible hselectDef hpositive hshared
+        (by simpa [liftedBodyVEnv, liftedBodyDrops, liftCaptureIndices]
+          using hbodyRun')
+        hbodyExtends (sourceEnv := sourceEnv)
+        (selectedSources := selectedSources)
+        (parameterSources := suppliedSources ++ sourceArgs)
+        (captureArgs := selectedArgs)
+        (parameterArgs := suppliedArgs ++ args)
+        rfl (by simpa [liftCaptureIndices] using hselectedValues)
+        (by simpa [liftCaptureIndices] using hselectedArgsLength)
+        hparameterLength hselectedGraph hparameterGraph hsourceBound
+        (by simpa using hsourceTrace) hframe hownSplit
+    have htarget' : runCode ctx targetFuel
+        ⟨selectedSources.length + lamArity expr, .shared, true, code⟩
+        store
+        (got ++ args).reverse code = .ok (store', value) := by
+      simpa [liftCaptureIndices, hselectedLength, lamUses_length,
+        htotalSplit] using htarget
+    have hworld : HasWorld store' .shared value :=
+      hownAfter.roots_world ⟨.shared, value⟩ (by simp)
+    have hcheck : checkResultWorld .shared (store', value) =
+        .ok (store', value) := by
+      simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+    have hinvoke : invoke ctx (targetFuel + 1) address (got ++ args) store =
+        .ok (store', value) := by
+      rw [invoke.eq_def]
+      dsimp only
+      rw [hdecl]
+      dsimp only
+      simp only [htotalLength]
+      simp
+      have hreverse : args.reverse ++ got.reverse =
+          (got ++ args).reverse := by
+        simp
+      rw [hreverse, htarget', bindOk]
+      exact hcheck
+    exact ⟨targetFuel + 1, store', value, hinvoke⟩
+
+/-- Execute one selected generated recursor branch from an exact source RHS
+trace.  Progress constructs the target run without a target-fuel premise;
+the ordinary semantic branch theorem is then instantiated at the produced
+fuel to recover the result and caller-frame graphs. -/
+theorem lowerRecursorRule_branch_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {sourceLimit fuel numArgs : Nat} {rule : IxIR0.RecRule}
+    {headState nextState : LowSt}
+    {fieldOutput rhsInput output : VEnv}
+    {fieldEmit parameterEmit bodyEmit : Emit} {av : AVal}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    (hself : CurrentSelfTraceProgressContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur sourceLimit)
+    (hfieldPlan : FieldRetainPlan
+      ⟨List.replicate rule.fields (.slot 0 0 .many false),
+        (numArgs + 1) + rule.fields⟩
+      (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields)
+      fieldOutput fieldEmit)
+    (hparameterPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (rule.fields + i) rule.rhs)).map
+        (SlotDrop.offsetEntry rule.fields))
+      rhsInput parameterEmit)
+    (hbodyRun : (lowerE src fuel rhsInput .shared rule.rhs).run headState =
+      .ok (output, bodyEmit, av) nextState)
+    (hextends : ExtraExtends nextState ambient)
+    {sourcePre : List IxIR0.Value} {pre : List RVal}
+    {sourceFields : List IxIR0.Value} {fields : List RVal}
+    {sourceSelf sourceValue : IxIR0.Value} {major : RVal}
+    {sourceFuel : Nat}
+    (hsourceBound : sourceFuel < sourceLimit)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      rule.rhs sourceValue)
+    (hpreLength : pre.length = numArgs)
+    (hfieldsLength : fields.length = rule.fields)
+    {store : Store}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hpreGraphs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourcePre pre)
+    (hfieldGraphs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceFields fields)
+    (hsourceSelf : recSelfRel sourceSelf (numArgs + 1))
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (pre ++ [major]) ++ rest))
+    (hfieldWorld : ∀ field ∈ fields, HasWorld store .shared field) :
+    ∃ branchFuel store' value,
+      runCode ctx branchFuel cur store
+        (fields.reverse ++ major :: pre.reverse)
+        (fieldEmit
+          (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+            (parameterEmit
+              (bodyEmit (.ret (av.toAtom output)))))) =
+          .ok (store', value) ∧
+      Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient) store'
+          sourceValue value ∧
+        Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient) store'
+          sourceRest rest := by
+  have hentry := recursorAltEntry_value_state
+    (funRel := CompilerFunctionRel sourceCtx src ambient)
+    (recSelfRel := recSelfRel) numArgs rule.fields rule.rhs
+    hpreLength hfieldsLength hpreGraphs hfieldGraphs hsourceSelf hframe hown
+    hfieldWorld
+  have hprefix := recursorPrefixPlans_valueProgress
+    (funRel := CompilerFunctionRel sourceCtx src ambient)
+    (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+    numArgs rule.fields rule.rhs hfieldPlan hparameterPlan
+    (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+    sourceRest rest major fields
+  have hbodyProgress : LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur
+      rhsInput output
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      sourceValue .shared bodyEmit av :=
+    (lowerValueTraceProgressClusterWithinBelow
+      (recSelfRel := recSelfRel) (cur := cur)
+      henv hrepresented hcontracts hvalues hprogress fuel).expr
+        hsourceBound hsource hbodyRun hextends
+        (SelfTraceProgressAvailableBelow.of_contract hself)
+  have hbodyCode : CodeProgress ctx cur
+      (GraphOwnsVEnv (CompilerFunctionRel sourceCtx src ambient)
+        recSelfRel rhsInput
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceRest rest)
+      (bodyEmit (.ret (av.toAtom output))) :=
+    hbodyProgress.closeProgress sourceRest rest
+  have hfull : CodeProgress ctx cur
+      (GraphOwnsVEnvRetains
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel
+        (recursorInitialVEnv numArgs rule.fields rule.rhs)
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields))
+      (fieldEmit
+        (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+          (parameterEmit
+            (bodyEmit (.ret (av.toAtom output)))))) := by
+    exact hprefix.progresses
+      (bodyEmit (.ret (av.toAtom output))) hbodyCode
+  obtain ⟨branchFuel, store', value, hbranchRun⟩ :=
+    hfull (store := store)
+      (env := fields.reverse ++ major :: pre.reverse) hentry
+  have hgraphs := lowerRecursorRule_branch_value_below
+    (limit := branchFuel) henv hrepresented hcontracts
+    (hvalues.below branchFuel)
+    (hself.toCurrentSelfValueContract.below branchFuel)
+    hfieldPlan hparameterPlan hbodyRun hextends hsource.run
+    hpreLength hfieldsLength hpreGraphs hfieldGraphs hsourceSelf hframe hown
+    hfieldWorld (Nat.le_refl branchFuel) hbranchRun
+  exact ⟨branchFuel, store', value, hbranchRun, hgraphs.1, hgraphs.2⟩
+
+/-- Every indexed source rule represented by a completed lowering plan has
+a selectable target alternative with the same case index. -/
+theorem RecursorRulesPlanBelow.find?_exists_of_mem
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel numArgs : Nat} {state finalState : LowSt}
+    {rules : List (IxIR0.RecRule × Nat)} {alts : List Alt}
+    (hplan : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state rules finalState alts)
+    {rule : IxIR0.RecRule} {cidx : Nat}
+    (hmember : (rule, cidx) ∈ rules) :
+    ∃ selectedTag fieldCount body,
+      alts.toArray.find? (fun alt => alt.cidx == cidx) =
+        some (.mk selectedTag fieldCount body) := by
+  have hexists : ∃ alt ∈ alts, alt.cidx = cidx := by
+    exact (RecursorRulesPlanWith.traverse
+      (Result := fun _ currentRules _ currentAlts =>
+        ∀ selectedRule selectedCidx,
+          (selectedRule, selectedCidx) ∈ currentRules →
+          ∃ alt ∈ currentAlts, alt.cidx = selectedCidx)
+      (hnil := by
+        intro current selectedRule selectedCidx hselected
+        simp at hselected)
+      (hcons := by
+        intro state middleState finalState headRule tag tailRules alt tailAlts
+          hhead hcontract tail ih selectedRule selectedCidx hselected
+        simp only [List.mem_cons] at hselected
+        rcases hselected with hheadMember | htailMember
+        · cases hheadMember
+          obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+              output, bodyEmit, av, hfieldPlan, hparameterPlan,
+              hbodyRun, halt⟩ :=
+            lowerRecursorRule_run_plan_inv hhead
+          refine ⟨alt, by simp, ?_⟩
+          rw [halt]
+          simp [Alt.cidx]
+        · obtain ⟨selected, hselectedMem, hselectedTag⟩ :=
+            ih selectedRule selectedCidx htailMember
+          exact ⟨selected, by simp [hselectedMem], hselectedTag⟩)
+      (hplan := hplan)) rule cidx hmember
+  obtain ⟨candidate, hcandidateMem, hcandidateTag⟩ := hexists
+  have hisSome :
+      (alts.toArray.find? (fun alt => alt.cidx == cidx)).isSome := by
+    apply Array.find?_isSome.mpr
+    exact ⟨candidate, by simpa using hcandidateMem,
+      by simp [hcandidateTag]⟩
+  cases hfind : alts.toArray.find? (fun alt => alt.cidx == cidx) with
+  | none => simp [hfind] at hisSome
+  | some selected =>
+      cases selected with
+      | mk selectedTag fieldCount body =>
+          exact ⟨selectedTag, fieldCount, body, rfl⟩
+
+/-- Contractive function-entry adapter for exact source traces.  The source
+definition saturation witness selects a body trace strictly below
+`sourceLimit`; the compiler-fuel cluster then supplies target progress using
+only declaration/application contracts below that same bound. -/
+theorem lowerFnBody_parameterEntries_valueTraceProgressesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx}
+    {compilerFuel sourceLimit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    (modes : List Uses) (world : Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceFunction : IxIR0.Value}
+    (hsaturates : ∀ {sourceArgs : List IxIR0.Value}
+        {sourceResult : IxIR0.Value},
+      sourceArgs.length = modes.length →
+      SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+        sourceArgs sourceResult →
+      ∃ sourceFuel, sourceFuel < sourceLimit ∧
+        IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel sourceArgs.reverse
+          body sourceResult) :
+    FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ (modes.map worldOfUses)
+      sourceFunction sourceLimit := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun (by
+      simpa [input, remaining] using
+        parameterEntries_noRecSelf 0 modes remaining modes.length)
+  obtain ⟨plannedMiddle, plannedEmit, hplan, _⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  intro store args sourceArgs sourceResult sourceRest rest hlength hargs
+    happlies hframe hown
+  have hargsLength : args.length = modes.length := by
+    simpa using hlength
+  have hsourceArgsLength : sourceArgs.length = args.length := by
+    simpa using hargs.length
+  obtain ⟨sourceFuel, hsourceBound, hsource⟩ := hsaturates
+    (hsourceArgsLength.trans hargsLength) happlies
+  have hbodyProgress : LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ plannedMiddle output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world emit av :=
+    (lowerValueTraceProgressClusterWithinBelow
+      (recSelfRel := recSelfRel)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hprogress compilerFuel).expr
+        hsourceBound hsource hbodyRun hextends
+        (SelfTraceProgressAvailableBelow.of_noRecSelf hmiddleNo)
+  have hfull : LowerResultValueProgress
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ input output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world
+      (plannedEmit ∘ emit) av :=
+    hbodyProgress.afterRelease hplan'
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+      sourceArgs.reverse sourceRest rest store args.reverse := by
+    refine ⟨(rootsForWorlds (modes.map worldOfUses) args).reverse,
+      ?_, hframe, ?_⟩
+    · simpa [input] using VEnvValueGraph.parameterEntries
+        (recSelfRel := recSelfRel) modes remaining hargsLength hargs hown
+    · exact hown.perm
+        ((List.reverse_perm
+          (rootsForWorlds (modes.map worldOfUses) args)).symm.append_right
+            rest)
+  obtain ⟨targetFuel, store', value, htarget⟩ :=
+    hfull.closeProgress sourceRest rest hpre
+  exact ⟨targetFuel, store', value, by simpa only [hcode] using htarget⟩
+
+/-- A reachable ordinary declaration proves its exact current-fuel callable
+progress from the retained definition-reference trace and only
+strictly-smaller compiler trace contracts. -/
+theorem lowerDecl_defn_valueTraceProgressesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {compilerFuel sourceLimit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some (.defn result body))
+    (href : SourceRefTraceAt sourceCtx sourceLimit address sourceFunction)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction sourceLimit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧
+        bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hlookup : sourceCtx.env address = some (.defn result body) := by
+    rw [henv]
+    exact hsrc
+  have hprogresses : FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨(lamUses body).length, result,
+        result == .shared && papSafe body, code⟩
+      ((lamUses body).map worldOfUses) sourceFunction sourceLimit :=
+    lowerFnBody_parameterEntries_valueTraceProgressesAt_within_below
+      (recSelfRel := fun _ _ => False)
+      (compilerFuel := compilerFuel) (sourceLimit := sourceLimit)
+      henv hrepresented hcontracts hvalues hprogress (lamUses body) result
+      (stripLams body) hadmissible (by simpa using hbodyRun) hextends
+      (by
+        intro sourceArgs sourceResult hlength happlies
+        exact href.defnSaturate hlookup (by simpa using hlength) happlies)
+  have hfn : (⟨(lamUses body).length, result,
+      result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn]
+  intro store args sourceArgs sourceResult sourceRest rest hlength hargs
+    happlies hframe hown
+  exact hprogresses hlength hargs happlies hframe hown
+
+/-- Exact source-trace progress for a generated recursor function.  Source
+saturation selects the indexed rule and its smaller RHS trace; the completed
+lowering plan supplies the matching target alternative, whose prefix and RHS
+then execute by the recursor-branch progress theorem. -/
+theorem lowerRecursor_valueTraceProgressesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {sourceLimit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefTraceAt sourceCtx sourceLimit address sourceFunction)
+    (hrun : (lowerRecursor src compilerFuel numArgs natLit rules).run state =
+      .ok d finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction
+      sourceLimit := by
+  simp only [lowerRecursor] at hrun
+  obtain ⟨alts, rulesState, hrulesRun, hafterRules⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      (⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩ : FnDef) = d ∧
+        rulesState = finalState := by
+    simpa using hafterRules
+  obtain ⟨hd, hstate⟩ := hpure
+  subst d
+  subst rulesState
+  have hsourceLookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules) := by
+    rw [henv]
+    exact hsrc
+  have hrefValue : SourceRefValue sourceCtx address sourceFunction :=
+    ⟨sourceLimit, href.run⟩
+  have hsourceFunction := hrefValue.recursorValue hsourceLookup
+  subst sourceFunction
+  let recSelfRel : RecSelfRel := fun value arity =>
+    value = .pap (.rec_ address (numArgs + 1)) [] ∧
+      arity = numArgs + 1
+  obtain ⟨ownedD, hownedDecl, _, _, hownedContract⟩ :=
+    hcontracts.decls.recursor hsrc
+  have hownedD : ownedD =
+      (⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩ : FnDef) := by
+    have hsame : some (Decl.fn ownedD) = some
+        (.fn ⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩) :=
+      hownedDecl.symm.trans hdecl
+    exact Decl.fn.inj (Option.some.inj hsame)
+  subst ownedD
+  have hvalueContract : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared)
+      (.pap (.rec_ address (numArgs + 1)) []) := by
+    apply hvalues.decls.fnContract hsrc (by rfl) hdecl hrefValue
+    simp
+  have hself : CurrentSelfTraceProgressContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      sourceLimit := by
+    refine
+      { toCurrentSelfValueContract := ?_
+        progress := ?_ }
+    · refine ⟨rfl, ?_, ?_⟩
+      · simpa using hownedContract
+      · intro candidate hcandidate
+        change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+          numArgs + 1 = numArgs + 1 at hcandidate
+        rcases hcandidate with ⟨rfl, _⟩
+        exact hvalueContract
+    · intro candidate arity hcandidate
+      change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+        arity = numArgs + 1 at hcandidate
+      rcases hcandidate with ⟨rfl, rfl⟩
+      refine ⟨by simp, ?_⟩
+      intro prior hprior
+      cases prior with
+      | zero =>
+          intro store args sourceArgs sourceResult sourceRest rest
+            hargsLength hargs happlies hframe hown
+          have hsourceArgsLength : sourceArgs.length = numArgs + 1 := by
+            calc
+              sourceArgs.length = args.length := hargs.length
+              _ = numArgs + 1 := by simpa using hargsLength
+          cases happlies with
+          | nil => simp at hsourceArgsLength
+          | cons hbound hstep htail => omega
+      | succ prior =>
+          exact hprogress.decls.fn_progresses hprior hsrc (by rfl) hdecl
+            (IxIR0.ProjectionSafe.Eval.refRecursor
+              (fuel := prior) (env := []) hsourceLookup)
+  have hfinalRepresented : ExtraRepresented ctx finalState :=
+    hrepresented.of_extends hextends
+  have hownershipSelf : CurrentSelfContractBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      sourceLimit :=
+    ⟨hself.result, hself.ownership.below sourceLimit⟩
+  have hplan : RecursorRulesPlanBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      sourceLimit src compilerFuel numArgs state rules.toList.zipIdx
+      finalState alts :=
+    recursorRulesPlanBelow_of_run (hcontracts.below sourceLimit).apply
+      (hcontracts.below sourceLimit).decls hownershipSelf rfl
+      compilerFuel numArgs hrulesRun hfinalRepresented
+  intro store args sourceArgs sourceResult sourceRest rest
+    hargsLength hargs happlies hframe hown
+  have hargsArity : args.length = numArgs + 1 := by
+    simpa using hargsLength
+  have hrootShape :
+      rootsForWorlds (List.replicate (numArgs + 1) .shared) args =
+        rootsFor .shared args :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hargsArity
+  rw [hrootShape] at hown
+  cases hreverse : args.reverse with
+  | nil =>
+      have hargsNil : args = [] := by
+        have h := congrArg List.reverse hreverse
+        simpa using h
+      simp [hargsNil] at hargsArity
+  | cons major runtimePre =>
+      have hargsForm : args = runtimePre.reverse ++ [major] := by
+        have h := congrArg List.reverse hreverse
+        simpa [List.reverse_cons] using h
+      have hruntimePreLength : runtimePre.length = numArgs := by
+        rw [hargsForm] at hargsArity
+        simp only [List.length_append, List.length_reverse,
+          List.length_singleton] at hargsArity
+        omega
+      obtain ⟨sourcePre, sourceMajor, hsourceArgsForm,
+          hsourcePreLength, hpreGraphs, hmajorGraph⟩ :=
+        valuesGraph_splitLast hargs hargsForm hruntimePreLength
+      rw [hsourceArgsForm] at happlies
+      obtain ⟨sourceTag, sourceFields, sourceRule, bodyFuel,
+          hbodyFuelBound, hsourceMajor, hsourceRule,
+          hsourceFieldsLength, hsourceEval⟩ :=
+        sourceRecursorRef_saturates_trace_inv hsourceLookup href
+          hsourcePreLength happlies
+      have hmajorWorld : HasWorld store .shared major := by
+        apply hown.roots_world ⟨.shared, major⟩
+        apply List.mem_append_left rest
+        simp [rootsFor, hargsForm]
+      have hentryOwn : RootOwnership store
+          (rootsFor .shared (runtimePre.reverse ++ [major]) ++ rest) := by
+        simpa [hargsForm] using hown
+      have hsourceRuleList :
+          rules.toList[sourceTag]? = some sourceRule := by
+        rw [Array.getElem?_toList]
+        exact hsourceRule
+      have hsourceMember :
+          (sourceRule, sourceTag) ∈ rules.toList.zipIdx :=
+        List.mk_mem_zipIdx_iff_getElem?.2 hsourceRuleList
+      obtain ⟨selectedTag, fieldCount, body, halt⟩ :=
+        hplan.find?_exists_of_mem hsourceMember
+      obtain ⟨rule, headState, nextState, tailRules, tailAlts,
+          fieldOutput, fieldEmit, rhsInput, parameterEmit,
+          output, bodyEmit, av, hrule, _, hfieldCount,
+          hfieldPlan, hparameterPlan, hbodyRun, hbody, htailPlan⟩ :=
+        hplan.find?_run_plan_inv halt
+      have hruleEq : rule = sourceRule :=
+        Option.some.inj (hrule.symm.trans hsourceRule)
+      subst rule
+      have htailExtends : ExtraExtends nextState finalState :=
+        (ExtraMonotone.listMapM
+          (lowerRecursorRule src compilerFuel numArgs)
+          (lowerRecursorRule_extraMonotone src compilerFuel numArgs)
+          tailRules) htailPlan.run
+      have hnextExtends : ExtraExtends nextState ambient :=
+        htailExtends.trans hextends
+      have finish {targetFields : List RVal}
+          (hfieldGraphs : Sim.ValuesGraph
+            (CompilerFunctionRel sourceCtx src ambient) store
+            sourceFields targetFields)
+          (htargetFieldsLength : targetFields.length = fieldCount)
+          (hfieldWorld : ∀ field ∈ targetFields,
+            HasWorld store .shared field) :
+          ∃ branchFuel store' value,
+            runCode ctx branchFuel
+              ⟨numArgs + 1, .shared, true,
+                .case (.var 0) natLit alts.toArray⟩
+              store (targetFields.reverse ++ major :: runtimePre) body =
+                .ok (store', value) ∧
+            Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient)
+                store' sourceResult value ∧
+              Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+                store' sourceRest rest := by
+        rw [hbody]
+        simpa using
+          (lowerRecursorRule_branch_value_trace_progress_within_below
+            (recSelfRel := recSelfRel) (sourceLimit := sourceLimit)
+            henv hrepresented hcontracts hvalues hprogress hself
+            hfieldPlan hparameterPlan hbodyRun hnextExtends
+            (sourcePre := sourcePre) (pre := runtimePre.reverse)
+            (sourceFields := sourceFields) (fields := targetFields)
+            (sourceSelf := .pap (.rec_ address (numArgs + 1)) [])
+            (sourceValue := sourceResult) (major := major)
+            hbodyFuelBound hsourceEval (by simpa using hruntimePreLength)
+            (htargetFieldsLength.trans hfieldCount)
+            hpreGraphs hfieldGraphs ⟨rfl, rfl⟩ hframe hentryOwn hfieldWorld)
+      cases hmajorGraph with
+      | @lit literal =>
+          cases literal with
+          | str string => simp [IxIR0.majorCtor] at hsourceMajor
+          | nat n =>
+              cases hpeel : natLit with
+              | false => simp [IxIR0.majorCtor, hpeel] at hsourceMajor
+              | true =>
+                  cases n with
+                  | zero =>
+                      have hmajorPair :
+                          0 = sourceTag ∧ sourceFields = [] := by
+                        simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                      have htag : sourceTag = 0 := hmajorPair.1.symm
+                      have hfields : sourceFields = [] := hmajorPair.2
+                      subst sourceTag
+                      subst sourceFields
+                      have hfieldCountZero : fieldCount = 0 :=
+                        hfieldCount.trans hsourceFieldsLength.symm
+                      have haltZero : alts.toArray.find?
+                          (fun alt => alt.cidx == 0) =
+                            some (.mk selectedTag 0 body) := by
+                        simpa [htag, hfieldCountZero] using halt
+                      obtain ⟨branchFuel, store', value, hbranchRun,
+                          hvalueGraph, hframeAfter⟩ :=
+                        finish Sim.ValuesGraph.nil
+                          (by simpa using hfieldCountZero.symm) (by simp)
+                      refine ⟨branchFuel + 1, store', value, ?_⟩
+                      rw [runCode_case_nat_zero rfl haltZero]
+                      simpa [hpeel] using hbranchRun
+                  | succ n =>
+                      have hmajorPair :
+                          1 = sourceTag ∧
+                            [.lit (.nat n)] = sourceFields := by
+                        simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                      have htag : sourceTag = 1 := hmajorPair.1.symm
+                      have hfields : sourceFields = [.lit (.nat n)] :=
+                        hmajorPair.2.symm
+                      subst sourceTag
+                      subst sourceFields
+                      have hfieldCountOne : fieldCount = 1 := by
+                        rw [hfieldCount]
+                        simpa using hsourceFieldsLength.symm
+                      have haltOne : alts.toArray.find?
+                          (fun alt => alt.cidx == 1) =
+                            some (.mk selectedTag 1 body) := by
+                        simpa [htag, hfieldCountOne] using halt
+                      obtain ⟨branchFuel, store', value, hbranchRun,
+                          hvalueGraph, hframeAfter⟩ :=
+                        finish (.cons .lit .nil)
+                          (by simpa using hfieldCountOne.symm)
+                          (by simp [HasWorld])
+                      refine ⟨branchFuel + 1, store', value, ?_⟩
+                      rw [runCode_case_nat_succ (n := n) rfl haltOne]
+                      simpa [hpeel] using hbranchRun
+      | erased => simp [IxIR0.majorCtor] at hsourceMajor
+      | @ctor sourceAddress sourceCtorTag sourceCtorFields loc
+          world rc cid targetFields hget haddress htag hfieldGraphs =>
+          have hmajorPair :
+              sourceCtorTag = sourceTag ∧
+                sourceCtorFields = sourceFields := by
+            simpa [IxIR0.majorCtor] using hsourceMajor
+          have hsourceTagEq : sourceTag = sourceCtorTag :=
+            hmajorPair.1.symm
+          have hsourceFieldsEq : sourceFields = sourceCtorFields :=
+            hmajorPair.2.symm
+          subst sourceTag
+          subst sourceFields
+          obtain ⟨ownedBox, hownedBox, hownedWorld⟩ := hmajorWorld
+          rw [hget] at hownedBox
+          have hboxEq :
+              (⟨world, rc, .ctorN cid targetFields⟩ : NodeBox) =
+                ownedBox := Option.some.inj hownedBox
+          subst ownedBox
+          dsimp only [NodeBox.world] at hownedWorld
+          subst world
+          have halt' : alts.toArray.find?
+              (fun alt => alt.cidx == cid.cidx) =
+                some (.mk selectedTag fieldCount body) := by
+            simpa [htag, hsourceTagEq] using halt
+          have hsize : targetFields.size = fieldCount := by
+            have hgraphLength := hfieldGraphs.length
+            simp only [Array.length_toList] at hgraphLength
+            omega
+          obtain ⟨branchFuel, store', value, hbranchRun,
+              hvalueGraph, hframeAfter⟩ :=
+            finish (by simpa using hfieldGraphs) (by simpa using hsize)
+              (hown.caseFieldsBorrowed hget)
+          refine ⟨branchFuel + 1, store', value, ?_⟩
+          rw [runCode_case_ctor rfl hget halt' hsize]
+          rw [Array.foldl_cons_eq_reverse_append]
+          exact hbranchRun
+      | function hget hfun hcaptures =>
+          obtain ⟨uses, closureEnv, closureBody, hsourceMajorEq⟩ |
+              ⟨head, captures, hsourceMajorEq⟩ :=
+            hfun.value_is_function henv
+          · subst sourceMajor
+            simp [IxIR0.majorCtor] at hsourceMajor
+          · subst sourceMajor
+            simp [IxIR0.majorCtor] at hsourceMajor
+
+/-- Declaration-facing adapter for exact recursor progress.  `lowerDecl`
+adds no runtime code; it only exposes the generated recursor and the compiler
+state in which its proof-relevant rule plan was built. -/
+theorem lowerDecl_recursor_valueTraceProgressesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {sourceLimit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx
+      sourceLimit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefTraceAt sourceCtx sourceLimit address sourceFunction)
+    (hrun :
+      (lowerDecl src compilerFuel
+        (address, .recursor numArgs natLit rules)).run state =
+          .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction
+      sourceLimit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn actual) = some (address, Decl.fn d) ∧
+        recursorState = finalState := by
+    simpa using hafterRecursor
+  have hd : actual = d := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2
+  have hrecursorState : recursorState = finalState := hpure.2
+  subst actual
+  subst recursorState
+  intro store args sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown
+  exact lowerRecursor_valueTraceProgressesAt_within_below
+    henv hrepresented hcontracts hvalues hprogress hsrc hdecl href
+    hrecursorRun hextends hlength hargs happlies hframe hown
+
+/-- At one exact source-evaluator index, every source-backed callable emitted
+by an actual whole-pass run makes progress using only declaration and
+higher-order progress contracts at strictly smaller source indices. -/
+theorem lowerAllAction_sourceFnTraceProgressesAt_within_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel sourceLimit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx sourceLimit) :
+    SourceFnTraceProgressesAt
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx sourceLimit := by
+  intro address source worlds result d sourceFunction
+    hsrc hsignature hdecl href
+  obtain ⟨itemInitial, itemFinal, hrun, hextends⟩ :=
+    lowerAllAction_callable_decl_trace hlower htarget hsrc hsignature hdecl
+  cases source with
+  | defn sourceResult body =>
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    cases compilerFuel with
+    | zero =>
+      simp only [lowerDecl] at hrun
+      obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+        trackedBindRun_ok_inv hrun
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerFnBody] using hbodyRun)).elim
+    | succ bodyFuel =>
+      have hadmissible := lowerDecl_defn_parameterDropsAdmissible hrun
+      intro store args sourceArgs sourceValue sourceRest rest
+        hlength hargs happlies hframe hown
+      exact lowerDecl_defn_valueTraceProgressesAt_within_below
+        (compilerFuel := bodyFuel) (sourceLimit := sourceLimit)
+        henv hrepresented hcontracts hvalues hprogress hsrc href
+        hadmissible (by simpa [Nat.succ_eq_add_one] using hrun) hextends
+        hlength hargs happlies hframe hown
+  | ctor tag arity =>
+    simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    intro store args sourceArgs sourceValue sourceRest rest
+      hlength hargs happlies hframe hown
+    exact lowerDecl_recursor_valueTraceProgressesAt_within_below
+      (compilerFuel := compilerFuel) (sourceLimit := sourceLimit)
+      henv hrepresented hcontracts hvalues hprogress hsrc hdecl href
+      hrun hextends hlength hargs happlies hframe hown
+  | extern arity =>
+    simp [sourceCallableSignature] at hsignature
+
+/-- The generated constructor eta-wrapper has a fixed two-step body run.
+Its trace-progress proof is independent of the source application trace;
+that trace is consumed by the semantic contract when the invocation is
+closed. -/
+theorem ctorWrapper_fnValueTraceProgressesAt
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    {sourceLimit : Nat} (source : Ixon.Address) (tag arity : Nat)
+    (sourceFunction : IxIR0.Value) :
+    FnValueTraceProgressesAt funRel sourceCtx ctx
+      ⟨arity, .shared, true,
+        .letOp (.alloc .shared (ctorIdOf source tag)
+          (descendingVars arity).toArray) (.ret (.var 0))⟩
+      (List.replicate arity .shared) sourceFunction sourceLimit := by
+  intro store args sourceArgs sourceResult sourceRest rest
+    hlength _ _ _ _
+  have hargsLength : args.length = arity := by
+    simpa using hlength
+  have hresolve : resolveAtoms args.reverse
+      (descendingVars arity).toArray = .ok args := by
+    rw [← hargsLength]
+    exact descendingVars_resolveAtoms args
+  let allocated := store.allocNode .shared
+    (.ctorN (ctorIdOf source tag) args.toArray)
+  refine ⟨2, allocated.1, .loc allocated.2, ?_⟩
+  simp only [runCode, runOp]
+  rw [hresolve]
+  simp [resolveAtom, allocated]
+  rfl
+
+/-- Exact source-trace progress for saturating every callable origin in the
+whole-pass function relation.  Same-address source declarations are tied
+back to the concrete `lowerDecl` run selected by `lowerAllAction`; generated
+wrappers and lifted closures use their retained compiler provenance. -/
+theorem invoke_compilerFunction_value_trace_progress_within_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel sourceLimit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx sourceLimit)
+    {sourceFunction sourceResult : IxIR0.Value}
+    {address : Ixon.Address} {arity : Nat}
+    {captures sourceArgs : List IxIR0.Value}
+    {store : Store} {got args : List RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hrel : CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+      finalState sourceFunction address arity captures)
+    (hcaptures : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      store captures got)
+    (hargs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      store sourceArgs args)
+    (happlies : SourceAppliesSafelyBelow sourceCtx sourceLimit
+      sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (got ++ args) ++ rest))
+    (htotalLength : (got ++ args).length = arity) :
+    ∃ fuel store' value,
+      invoke ctx fuel address (got ++ args) store = .ok (store', value) ∧
+      Sim.ValueGraph
+          (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+          store' sourceResult value ∧
+        Sim.RootsGraph
+            (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+            store' sourceRest rest ∧
+          RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  have hsourceArgsNonempty : sourceArgs ≠ [] := by
+    intro hnil
+    subst sourceArgs
+    have hargsNil : args = [] := by
+      apply List.eq_nil_of_length_eq_zero
+      simpa using hargs.length.symm
+    have hgotLength : got.length = arity := by
+      simpa [hargsNil] using htotalLength
+    have hcapturesLength : captures.length = got.length :=
+      hcaptures.length
+    have hunder := hrel.underfilled
+    omega
+  have htwo : 2 < sourceLimit :=
+    happlies.two_lt_limit_of_nonempty (hrel.value_ne_erased henv)
+      hsourceArgsNonempty
+  cases hrel with
+  | @source relatedFunction baseFunction targetAddress targetArity
+      storedSources source hsrc heligible harity href hprefix hunder =>
+    have hfullGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        store (captures ++ sourceArgs) (got ++ args) :=
+      hcaptures.append hargs
+    cases source with
+    | defn result body =>
+      obtain ⟨hresultShared, hsafe⟩ := heligible
+      subst result
+      have hpositive : 0 < lamArity body := by
+        simp only [sourceDeclArity] at harity
+        omega
+      have hinitial := href.lambdaPrefix_nil henv hsrc hpositive
+      have hstoredUnder : ([] ++ captures).length < lamArity body := by
+        simp only [sourceDeclArity] at harity
+        simpa [harity] using hunder
+      have hlambdaPrefix :=
+        hinitial.append_of_applies hprefix hstoredUnder
+      have hstoredTrace : SourceAppliesSafelyBelow sourceCtx sourceLimit
+          baseFunction captures sourceFunction :=
+        hinitial.toAppliesBelow_from_initial hlambdaPrefix htwo
+      have hfullTrace := hstoredTrace.append happlies
+      have hrefTrace : SourceRefTraceAt sourceCtx sourceLimit address
+          baseFunction :=
+        href.defnTraceAt_of_positive henv hsrc hpositive
+          (Nat.le_of_lt htwo)
+      obtain ⟨d, hdecl, harityDef, hresultDef, hownership⟩ :=
+        hcontracts.decls.defn hsrc
+      obtain ⟨itemInitial, itemFinal, hrun, hextends⟩ :=
+        lowerAllAction_callable_decl_trace hlower htarget hsrc (by rfl)
+          hdecl
+      cases compilerFuel with
+      | zero =>
+        simp only [lowerDecl] at hrun
+        obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+          trackedBindRun_ok_inv hrun
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerFnBody] using hbodyRun)).elim
+      | succ bodyFuel =>
+        have hadmissible := lowerDecl_defn_parameterDropsAdmissible hrun
+        have hbodyProgress : FnValueTraceProgressesAt
+            (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+              finalState) sourceCtx ctx d
+            ((lamUses body).map worldOfUses) baseFunction sourceLimit :=
+          lowerDecl_defn_valueTraceProgressesAt_within_below
+            (compilerFuel := bodyFuel) (sourceLimit := sourceLimit)
+            henv hrepresented hcontracts hvalues hprogress hsrc hrefTrace
+            hadmissible (by simpa [Nat.succ_eq_add_one] using hrun)
+            hextends
+        have hvalueContract : FnValueContract
+            (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+              finalState) sourceCtx ctx d
+            ((lamUses body).map worldOfUses) baseFunction := by
+          apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+          simpa using harityDef.symm
+        have hmodes := papSafe_lamUses_eq_replicate hsafe
+        have hworlds : (lamUses body).map worldOfUses =
+            List.replicate (lamUses body).length .shared := by
+          rw [hmodes]
+          simp [worldOfUses]
+        have hlength : (got ++ args).length =
+            ((lamUses body).map worldOfUses).length := by
+          simpa [sourceDeclArity, lamUses_length] using
+            htotalLength.trans harity.symm
+        have hroots : rootsForWorlds
+            ((lamUses body).map worldOfUses) (got ++ args) =
+              rootsFor .shared (got ++ args) := by
+          rw [hworlds]
+          exact rootsForWorlds_replicate_eq_rootsFor .shared (by
+            simpa [hworlds] using hlength)
+        have hown' : RootOwnership store
+            (rootsForWorlds ((lamUses body).map worldOfUses)
+              (got ++ args) ++ rest) := by
+          rwa [hroots]
+        obtain ⟨fuel, store', value, hinvoke, hresult, hframe', hown'⟩ :=
+          invoke_fn_value_trace_progress_at hdecl hvalueContract.arity_eq
+            hbodyProgress hownership hvalueContract hlength hfullGraph
+            hfullTrace hframe hown'
+        rw [hresultDef] at hown'
+        exact ⟨fuel, store', value, hinvoke, hresult, hframe', hown'⟩
+    | ctor tag ctorArity =>
+      exact heligible.elim
+    | recursor numArgs natLit rules =>
+      have hlookup : sourceCtx.env address =
+          some (.recursor numArgs natLit rules) := by
+        rw [henv]
+        exact hsrc
+      have hbase := href.recursorValue hlookup
+      subst baseFunction
+      have hstoredUnder :
+          ([] ++ captures).length <
+            (IxIR0.Head.rec_ address (numArgs + 1)).arity := by
+        simp only [sourceDeclArity] at harity
+        simpa [IxIR0.Head.arity, harity] using hunder
+      have hstoredTrace :=
+        projectionSafePap_underfills (sourceCtx := sourceCtx) htwo
+          hstoredUnder
+      have hrelated : sourceFunction =
+          .pap (.rec_ address (numArgs + 1)) captures :=
+        hprefix.deterministic hstoredTrace.sourceApplies
+      subst sourceFunction
+      have hfullTrace := hstoredTrace.append happlies
+      have hrefTrace : SourceRefTraceAt sourceCtx sourceLimit address
+          (.pap (.rec_ address (numArgs + 1)) []) :=
+        href.recursorTraceAt hlookup (by omega)
+      obtain ⟨d, hdecl, harityRec, hresultRec, hownership⟩ :=
+        hcontracts.decls.recursor hsrc
+      obtain ⟨itemInitial, itemFinal, hrun, hextends⟩ :=
+        lowerAllAction_callable_decl_trace hlower htarget hsrc (by rfl)
+          hdecl
+      have hbodyProgress : FnValueTraceProgressesAt
+          (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+            finalState) sourceCtx ctx d
+          (List.replicate (numArgs + 1) .shared)
+          (.pap (.rec_ address (numArgs + 1)) []) sourceLimit :=
+        lowerDecl_recursor_valueTraceProgressesAt_within_below
+          (compilerFuel := compilerFuel) (sourceLimit := sourceLimit)
+          henv hrepresented hcontracts hvalues hprogress hsrc hdecl
+          hrefTrace hrun hextends
+      have hvalueContract : FnValueContract
+          (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+            finalState) sourceCtx ctx d
+          (List.replicate (numArgs + 1) .shared)
+          (.pap (.rec_ address (numArgs + 1)) []) := by
+        apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+        simpa using harityRec.symm
+      have hlength : (got ++ args).length =
+          (List.replicate (numArgs + 1) Owned.shared).length := by
+        simpa [sourceDeclArity] using htotalLength.trans harity.symm
+      have hroots : rootsForWorlds
+          (List.replicate (numArgs + 1) .shared) (got ++ args) =
+            rootsFor .shared (got ++ args) :=
+        rootsForWorlds_replicate_eq_rootsFor .shared (by
+          simpa using hlength)
+      have hown' : RootOwnership store
+          (rootsForWorlds (List.replicate (numArgs + 1) .shared)
+            (got ++ args) ++ rest) := by
+        rwa [hroots]
+      obtain ⟨fuel, store', value, hinvoke, hresult, hframe', hown'⟩ :=
+        invoke_fn_value_trace_progress_at hdecl hvalueContract.arity_eq
+          hbodyProgress hownership hvalueContract hlength hfullGraph
+          hfullTrace hframe hown'
+      rw [hresultRec] at hown'
+      exact ⟨fuel, store', value, hinvoke, hresult, hframe', hown'⟩
+    | extern externArity =>
+      have hpositive : 0 < externArity := by
+        simp only [sourceDeclArity] at harity
+        omega
+      have hbase := href.externPap henv hsrc hpositive
+      subst baseFunction
+      have hstoredUnder :
+          ([] ++ captures).length <
+            (IxIR0.Head.ext address externArity).arity := by
+        simp only [sourceDeclArity] at harity
+        simpa [IxIR0.Head.arity, harity] using hunder
+      have hstoredTrace :=
+        projectionSafePap_underfills (sourceCtx := sourceCtx) htwo
+          hstoredUnder
+      have hrelated : sourceFunction =
+          .pap (.ext address externArity) captures :=
+        hprefix.deterministic hstoredTrace.sourceApplies
+      subst sourceFunction
+      have hfullTrace := hstoredTrace.append happlies
+      have hlookup : sourceCtx.env address =
+          some (.extern externArity) := by
+        rw [henv]
+        exact hsrc
+      have hsourceLength : (captures ++ sourceArgs).length =
+          externArity := by
+        calc
+          (captures ++ sourceArgs).length = (got ++ args).length :=
+            hfullGraph.length
+          _ = arity := htotalLength
+          _ = externArity := by
+            simpa [sourceDeclArity] using harity.symm
+      obtain ⟨runtimeResult, horacle⟩ :=
+        hprogress.extern.progresses hlookup href hsourceLength hfullTrace
+          hfullGraph
+      have hdecl := hcontracts.decls.extern hsrc
+      have htargetArity : arity = externArity := by
+        simpa [sourceDeclArity] using harity.symm
+      have hruntimeLength : (got ++ args).length = externArity :=
+        htotalLength.trans htargetArity
+      have hinvoke : invoke ctx 1 address (got ++ args) store =
+          .ok (store, runtimeResult) := by
+        simp [invoke, hdecl, hruntimeLength, horacle]
+      have hresult := hvalues.extern.preserves hlookup href hsourceLength
+        (SourceAppliesSafelyBelow.sourceApplies hfullTrace) hfullGraph
+        horacle
+      have hscalar := callScalarOracle_ok horacle
+      have hown' : RootOwnership store
+          (⟨.shared, runtimeResult⟩ :: rest) :=
+        (hown.dropScalars hscalar.1).addNoLocation
+          (RVal.rvalLocation?_eq_none_of_isScalar hscalar.2)
+      exact ⟨1, store, runtimeResult, hinvoke, hresult, hframe, hown'⟩
+  | @wrapper relatedFunction baseFunction storedSources memo hmember hsrc
+      href hprefix hunder =>
+    have hfullGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        store (captures ++ sourceArgs) (got ++ args) :=
+      hcaptures.append hargs
+    have hlookup : sourceCtx.env memo.source =
+        some (.ctor memo.tag memo.arity) := by
+      rw [henv]
+      exact hsrc
+    have hpositive : 0 < memo.arity := by omega
+    have hbase := href.ctorPap henv hsrc hpositive
+    subst baseFunction
+    have hstoredUnder :
+        ([] ++ captures).length <
+          (IxIR0.Head.ctor memo.source memo.tag memo.arity).arity := by
+      simpa [IxIR0.Head.arity] using hunder
+    have hstoredTrace :=
+      projectionSafePap_underfills (sourceCtx := sourceCtx) htwo
+        hstoredUnder
+    have hrelated : sourceFunction =
+        .pap (.ctor memo.source memo.tag memo.arity) captures :=
+      hprefix.deterministic hstoredTrace.sourceApplies
+    subst sourceFunction
+    have hfullTrace := hstoredTrace.append happlies
+    let wrapperDef : FnDef :=
+      ⟨memo.arity, .shared, true,
+        .letOp (.alloc .shared (ctorIdOf memo.source memo.tag)
+          (descendingVars memo.arity).toArray) (.ret (.var 0))⟩
+    have hdecl : ctx.decls memo.wrapper = some (.fn wrapperDef) := by
+      simpa [wrapperDef, ctorWrapperDecl] using
+        hrepresented.wrapper hmember
+    have hbodyProgress : FnValueTraceProgressesAt
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        sourceCtx ctx wrapperDef (List.replicate memo.arity .shared)
+        (.pap (.ctor memo.source memo.tag memo.arity) []) sourceLimit := by
+      dsimp only [wrapperDef]
+      exact ctorWrapper_fnValueTraceProgressesAt
+        (funRel := CompilerFunctionRel sourceCtx
+          (IxIR0.Env.ofList decls) finalState)
+        (sourceCtx := sourceCtx) (ctx := ctx)
+        (sourceLimit := sourceLimit) memo.source memo.tag memo.arity
+        (.pap (.ctor memo.source memo.tag memo.arity) [])
+    have hvalueContract := ctorWrapper_fnValueContract
+      (funRel := CompilerFunctionRel sourceCtx
+        (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx memo.source memo.tag memo.arity
+      (.pap (.ctor memo.source memo.tag memo.arity) []) hlookup href
+    have hownership :=
+      ctorWrapper_fnOwnershipContract ctx memo.source memo.tag memo.arity
+    have hlength : (got ++ args).length =
+        (List.replicate memo.arity Owned.shared).length := by
+      simpa using htotalLength
+    have hroots : rootsForWorlds
+        (List.replicate memo.arity .shared) (got ++ args) =
+          rootsFor .shared (got ++ args) :=
+      rootsForWorlds_replicate_eq_rootsFor .shared (by
+        simpa using hlength)
+    have hown' : RootOwnership store
+        (rootsForWorlds (List.replicate memo.arity .shared)
+          (got ++ args) ++ rest) := by
+      rwa [hroots]
+    exact invoke_fn_value_trace_progress_at hdecl hvalueContract.arity_eq
+      hbodyProgress hownership hvalueContract hlength hfullGraph
+      hfullTrace hframe hown'
+  | lifted hlifted =>
+    obtain ⟨fuel, store', value, hinvoke⟩ :=
+      invoke_lifted_value_trace_progress_within_below henv hrepresented
+        hcontracts hvalues hprogress hlifted hcaptures hargs happlies
+        hframe hown htotalLength
+    have hsemantic := invoke_lifted_value_below henv hrepresented
+      hcontracts (hvalues.below fuel) hlifted hcaptures hargs
+      happlies.sourceApplies hframe hown (Nat.le_refl fuel) hinvoke
+    have howned := invoke_lifted_owned_below hrepresented hcontracts
+      hlifted hown hinvoke
+    exact ⟨fuel, store', value, hinvoke, hsemantic.1, hsemantic.2,
+      howned⟩
+
+/-- Exact source-trace progress for higher-order application of every
+whole-pass compiler function.  The only recursive target branch is
+over-application; its remaining argument suffix is strictly shorter, so
+the proof is independent of the source-fuel induction used to construct
+callable-body progress. -/
+theorem lowerAllAction_applyValueTraceProgressesAt_within_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel sourceLimit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx sourceLimit) :
+    ApplyValueTraceProgressesAt
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx sourceLimit := by
+  have go : ∀ argLength,
+      ∀ {store : Store} {function : RVal} {args : List RVal}
+        {sourceFunction : IxIR0.Value}
+        {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+        {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+      args.length = argLength →
+      Sim.ValueGraph
+          (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+          store sourceFunction function →
+      Sim.ValuesGraph
+          (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+          store sourceArgs args →
+      SourceAppliesSafelyBelow sourceCtx sourceLimit sourceFunction
+          sourceArgs sourceResult →
+      sourceArgs ≠ [] →
+      Sim.RootsGraph
+          (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+          store sourceRest rest →
+      RootOwnership store
+          (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+      ∃ fuel store' value,
+        applyGo ctx fuel store function args = .ok (store', value) := by
+    intro argLength
+    induction argLength using Nat.strongRecOn with
+    | ind argLength ih =>
+      intro store function args sourceFunction sourceArgs sourceResult
+        sourceRest rest hargsLength hfunction hargs happlies
+        hsourceArgsNonempty hframe hown
+      cases hfunction with
+      | lit =>
+        cases sourceArgs with
+        | nil => exact (hsourceArgsNonempty rfl).elim
+        | cons sourceArgument sourceArgs =>
+          cases happlies with
+          | cons _ hstep _ => cases hstep
+      | erased =>
+        have hargsOwn : RootOwnership store
+            (rootsFor .shared args ++ rest) :=
+          hown.dropNoLocation rfl
+        obtain ⟨dropFuel, store', hdrop, _⟩ :=
+          dropMany_progress (ctx := ctx) hargsOwn
+        refine ⟨dropFuel + 1, store', .erased, ?_⟩
+        rw [applyGo.eq_def]
+        dsimp only
+        rw [hdrop, bindOk]
+      | @ctor sourceAddress sourceTag sourceFields loc world rc cid fields
+          hget haddress htag hfields =>
+        cases sourceArgs with
+        | nil => exact (hsourceArgsNonempty rfl).elim
+        | cons sourceArgument sourceArgs =>
+          cases happlies with
+          | cons _ hstep _ => cases hstep
+      | @function relatedFunction address arity captures loc rc got hget
+          hrel hcaptures =>
+        obtain ⟨declaration, hdeclaration, hpapsafe⟩ :=
+          lowerAllAction_compilerFunction_declPapSafe hlower htarget
+            hrepresented hcontracts hrel
+        obtain ⟨dropFuel, dupStore, readyStore, hdup, hdrop,
+            hcapturesReady, hargsReady, hframeReady, hready⟩ :=
+          applyGo_preparePap_valueGraphs_progress
+            (ctx := ctx) hget hcaptures hargs hframe hown
+        let total := got.toList ++ args
+        by_cases hunder : total.length < arity
+        · let allocated := readyStore.allocNode .shared
+            (.papN address arity total.toArray)
+          have hunder' : (got.toList ++ args).length < arity := by
+            simpa [total] using hunder
+          refine ⟨dropFuel + 1, allocated.1, .loc allocated.2, ?_⟩
+          rw [applyGo.eq_def]
+          dsimp only
+          rw [hget]
+          dsimp only
+          rw [hdup, bindOk, hdrop, bindOk]
+          rw [if_pos hunder']
+        · by_cases hexact : total.length = arity
+          · obtain ⟨invokeFuel, store', value, hinvoke, _, _, _⟩ :=
+              invoke_compilerFunction_value_trace_progress_within_below
+                henv hlower htarget hrepresented hcontracts hvalues
+                hprogress hrel hcapturesReady hargsReady happlies
+                hframeReady hready (by simpa [total] using hexact)
+            let commonFuel := max dropFuel invokeFuel
+            have hdrop' : dropVal ctx commonFuel dupStore (.loc loc) =
+                .ok readyStore :=
+              dropVal_mono (by
+                exact Nat.le_max_left dropFuel invokeFuel) hdrop
+            have hinvokeBase : invoke ctx invokeFuel address total readyStore =
+                .ok (store', value) := by
+              simpa [total] using hinvoke
+            have hinvoke' : invoke ctx commonFuel address total readyStore =
+                .ok (store', value) :=
+              invoke_mono (by
+                exact Nat.le_max_right dropFuel invokeFuel) hinvokeBase
+            have hunder' : ¬(got.toList ++ args).length < arity := by
+              simpa [total] using hunder
+            have hexact' : (got.toList ++ args).length = arity := by
+              simpa [total] using hexact
+            refine ⟨commonFuel + 1, store', value, ?_⟩
+            rw [applyGo.eq_def]
+            dsimp only
+            rw [hget]
+            dsimp only
+            rw [hdup, bindOk, hdrop', bindOk]
+            rw [if_neg hunder']
+            have hbeq : ((got.toList ++ args).length == arity) = true := by
+              simp [hexact']
+            rw [hbeq]
+            rw [hdeclaration]
+            simp only [hpapsafe, ↓reduceIte]
+            simpa using hinvoke'
+          · have hcapturesUnder : captures.length < arity :=
+              hrel.underfilled
+            have hgotUnder : got.toList.length < arity := by
+              rw [← hcapturesReady.length]
+              exact hcapturesUnder
+            have hgotLe : got.toList.length ≤ arity :=
+              Nat.le_of_lt hgotUnder
+            have hoverLength : arity < total.length := by omega
+            let missing := arity - got.toList.length
+            have hmissingPositive : 0 < missing := by
+              simp only [missing]
+              omega
+            have hmissingLe : missing ≤ args.length := by
+              simp only [total, List.length_append] at hoverLength
+              simp only [missing]
+              omega
+            have htakeTotal : total.take arity =
+                got.toList ++ args.take missing := by
+              rw [List.take_append]
+              rw [List.take_of_length_le hgotLe]
+            have hdropTotal : total.drop arity = args.drop missing := by
+              rw [List.drop_append]
+              rw [List.drop_eq_nil_of_le hgotLe]
+              rfl
+            have htotalPrefix :
+                (got.toList ++ args.take missing).length = arity := by
+              rw [← htakeTotal]
+              simp [List.length_take, Nat.min_eq_left
+                (Nat.le_of_lt hoverLength)]
+            obtain ⟨middleSource, hprefixApply, htailApply⟩ :=
+              happlies.splitAt missing
+            have hprefixGraph := hargsReady.take missing
+            have htailGraph := hargsReady.drop missing
+            have htailRuntimeNonempty : args.drop missing ≠ [] := by
+              intro hnil
+              have hzero := congrArg List.length hnil
+              simp only [List.length_drop, List.length_nil] at hzero
+              simp only [total, List.length_append] at hoverLength
+              omega
+            have htailSourceNonempty : sourceArgs.drop missing ≠ [] := by
+              intro hnil
+              apply htailRuntimeNonempty
+              apply List.eq_nil_of_length_eq_zero
+              simpa [hnil] using htailGraph.length.symm
+            let tailSourceRest : List (Owned × IxIR0.Value) :=
+              (sourceArgs.drop missing).map
+                (fun source => (.shared, source))
+            let tailRoots : List Root :=
+              rootsFor .shared (args.drop missing)
+            have htailWorld : ∀ runtime,
+                runtime ∈ args.drop missing →
+                HasWorld readyStore .shared runtime := by
+              intro runtime hmember
+              apply hready.roots_world ⟨.shared, runtime⟩
+              apply List.mem_append_left rest
+              have hmemberArgs : runtime ∈ args :=
+                List.mem_of_mem_drop hmember
+              have hmemberTotal : runtime ∈ total := by
+                exact List.mem_append_right got.toList hmemberArgs
+              simpa [total, rootsFor] using hmemberTotal
+            have htailFrame : Sim.RootsGraph
+                (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+                  finalState)
+                readyStore tailSourceRest tailRoots := by
+              exact htailGraph.rootsGraph .shared htailWorld
+            have hcombinedFrame : Sim.RootsGraph
+                (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+                  finalState)
+                readyStore (tailSourceRest ++ sourceRest)
+                  (tailRoots ++ rest) :=
+              htailFrame.append hframeReady
+            have hrootsSplit : rootsFor .shared total =
+                rootsFor .shared (total.take arity) ++
+                  rootsFor .shared (total.drop arity) := by
+              unfold rootsFor
+              rw [← List.map_append]
+              exact congrArg _ (List.take_append_drop arity total).symm
+            have hpartition : RootOwnership readyStore
+                (rootsFor .shared (got.toList ++ args.take missing) ++
+                  (tailRoots ++ rest)) := by
+              have hsplit := hready
+              rw [hrootsSplit] at hsplit
+              rw [htakeTotal, hdropTotal] at hsplit
+              simpa [tailRoots, List.append_assoc] using hsplit
+            obtain ⟨invokeFuel, calledStore, calledValue, hinvoke,
+                hcalledGraph, hcombinedAfter, hcalledOwn⟩ :=
+              invoke_compilerFunction_value_trace_progress_within_below
+                henv hlower htarget hrepresented hcontracts hvalues
+                hprogress hrel hcapturesReady hprefixGraph hprefixApply
+                hcombinedFrame hpartition htotalPrefix
+            have htailLength : tailSourceRest.length = tailRoots.length := by
+              simp [tailSourceRest, tailRoots, rootsFor, hargsReady.length]
+            obtain ⟨htailFrameAfter, hframeAfter⟩ :=
+              hcombinedAfter.splitAppend htailLength
+            have htailGraphAfter : Sim.ValuesGraph
+                (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+                  finalState)
+                calledStore (sourceArgs.drop missing)
+                  (args.drop missing) :=
+              htailFrameAfter.valuesGraph
+            have htailLengthLt : (args.drop missing).length < argLength := by
+              rw [← hargsLength]
+              simp only [List.length_drop]
+              omega
+            obtain ⟨recursiveFuel, store', value, hrecursive⟩ :=
+              ih (args.drop missing).length htailLengthLt rfl
+                hcalledGraph htailGraphAfter htailApply
+                htailSourceNonempty hframeAfter hcalledOwn
+            let commonFuel := max dropFuel (max invokeFuel recursiveFuel)
+            have hdrop' : dropVal ctx commonFuel dupStore (.loc loc) =
+                .ok readyStore :=
+              dropVal_mono (by
+                exact Nat.le_max_left dropFuel (max invokeFuel recursiveFuel))
+                hdrop
+            have hinvokeBase : invoke ctx invokeFuel address
+                (total.take arity) readyStore =
+                .ok (calledStore, calledValue) := by
+              rw [htakeTotal]
+              exact hinvoke
+            have hinvoke' : invoke ctx commonFuel address
+                (total.take arity) readyStore =
+                .ok (calledStore, calledValue) :=
+              invoke_mono (by
+                exact Nat.le_trans
+                  (Nat.le_max_left invokeFuel recursiveFuel)
+                  (Nat.le_max_right dropFuel
+                    (max invokeFuel recursiveFuel))) hinvokeBase
+            have hrecursiveBase : applyGo ctx recursiveFuel calledStore
+                calledValue (total.drop arity) = .ok (store', value) := by
+              rw [hdropTotal]
+              exact hrecursive
+            have hrecursive' : applyGo ctx commonFuel calledStore calledValue
+                (total.drop arity) = .ok (store', value) :=
+              applyGo_mono (by
+                exact Nat.le_trans
+                  (Nat.le_max_right invokeFuel recursiveFuel)
+                  (Nat.le_max_right dropFuel
+                    (max invokeFuel recursiveFuel))) hrecursiveBase
+            have hunder' : ¬(got.toList ++ args).length < arity := by
+              simpa [total] using hunder
+            have hexact' : (got.toList ++ args).length ≠ arity := by
+              simpa [total] using hexact
+            refine ⟨commonFuel + 1, store', value, ?_⟩
+            rw [applyGo.eq_def]
+            dsimp only
+            rw [hget]
+            dsimp only
+            rw [hdup, bindOk, hdrop', bindOk]
+            rw [if_neg hunder']
+            have hbeq : ((got.toList ++ args).length == arity) = false := by
+              rw [beq_eq_false_iff_ne]
+              exact hexact'
+            rw [hbeq]
+            simp only [Bool.false_eq_true, if_false]
+            rw [hdeclaration]
+            simp only [hpapsafe, ↓reduceIte]
+            rw [hinvoke', bindOk]
+            exact hrecursive'
+  intro store function args sourceFunction sourceArgs sourceResult
+    sourceRest rest hfunction hargs happlies hsourceArgsNonempty hframe hown
+  exact go args.length rfl hfunction hargs happlies hsourceArgsNonempty
+    hframe hown
+
+/-- The exact whole-pass output supplies both mutually recursive callable
+progress families.  The strong source-fuel fixed point is closed from
+strictly smaller declaration/application contracts; scalar-oracle
+termination remains the explicit external boundary. -/
+theorem lowerAllAction_compilerTraceProgressContracts
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternTraceProgressContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx) :
+    CompilerTraceProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx := by
+  apply compilerTraceProgressContracts_of_below_step hextern
+  intro sourceLimit hbelow
+  exact ⟨
+    lowerAllAction_sourceFnTraceProgressesAt_within_below
+      henv hlower htarget hrepresented hcontracts hvalues hbelow,
+    lowerAllAction_applyValueTraceProgressesAt_within_below
+      henv hlower htarget hrepresented hcontracts hvalues hbelow⟩
+
+/-- A successfully compiled and source-terminating whole main reaches a
+non-memory terminal target observation.  Declaration/application progress is
+kept as an explicit semantic boundary; ownership and value contracts supply
+the graph invariant used by the settling compiler induction. -/
+theorem lowerAllAction_main_settlement
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue) :
+    ∃ targetFuel,
+      SettlesWithoutMemory (runMain ctx mainCode targetFuel) := by
+  obtain ⟨mainInitial, hmain⟩ := lowerAllAction_main_trace hlower
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerFnBody] at hmain
+    exact (trackedThrowRun_not_ok hmain).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hmain
+    obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+      trackedBindRun_ok_inv hmain
+    rcases releaseResult with ⟨middle, releaseEmit⟩
+    obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+      trackedBindRun_ok_inv hafterRelease
+    rcases bodyResult with ⟨output, emit, av⟩
+    have hpure :
+        (releaseEmit ∘ emit) (.ret (av.toAtom output)) = mainCode ∧
+          bodyState = finalState := by
+      simpa using hafterBody
+    obtain ⟨hcode, hbodyState⟩ := hpure
+    subst bodyState
+    let input : VEnv := ⟨[], 0⟩
+    have hplan : ReleasePlan input [] input (_root_.id : Emit) := .nil
+    have hplanRun : (releaseSlots input []).run mainInitial =
+        .ok (input, (_root_.id : Emit)) mainInitial :=
+      hplan.run mainInitial
+    have heq :
+        (input, (_root_.id : Emit)) = (middle, releaseEmit) ∧
+          mainInitial = releaseState := by
+      simpa [input] using hplanRun.symm.trans hrelease
+    have hmiddle : input = middle := congrArg Prod.fst heq.1
+    have hemitting : (_root_.id : Emit) = releaseEmit :=
+      congrArg Prod.snd heq.1
+    subst middle
+    subst releaseEmit
+    cases heq.2
+    let cur : FnDef := ⟨0, .shared, false, mainCode⟩
+    have hbodySettles : LowerResultValueSettlement
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) ctx cur input output [] [] sourceValue
+        mainWorld emit av :=
+      (lowerValueSettlementClusterWithin
+        (recSelfRel := fun _ _ => False) (cur := cur) henv hrepresented
+        hcontracts hvalues hprogress bodyFuel).expr hsource hbodyRun
+        (ExtraExtends.refl _)
+        (SelfProgressAvailable.of_noRecSelf (by
+          intro index arity hentry
+          simp [input] at hentry))
+    have hpre : GraphOwnsVEnv
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) input [] [] [] ({} : Store) [] := by
+      refine ⟨[], ?_, Sim.RootsGraph.nil, RootOwnership.empty⟩
+      exact ⟨by simp [input], EntriesValueGraph.nil⟩
+    obtain ⟨targetFuel, htarget⟩ :=
+      hbodySettles.closeSettlement [] [] hpre
+    refine ⟨targetFuel, ?_⟩
+    unfold runMain
+    change SettlesWithoutMemory
+      (runCode ctx targetFuel cur ({} : Store) [] mainCode)
+    rw [← hcode]
+    simpa [Function.comp_def] using htarget
+
+/-- A successfully compiled projection-safe whole main reaches a concrete
+target value. -/
+theorem lowerAllAction_main_progress_of_projectionSafe
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : ProjectionSafeEval sourceCtx [] main sourceValue) :
+    ∃ targetFuel store value,
+      runMain ctx mainCode targetFuel = .ok (store, value) := by
+  obtain ⟨mainInitial, hmain⟩ := lowerAllAction_main_trace hlower
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerFnBody] at hmain
+    exact (trackedThrowRun_not_ok hmain).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hmain
+    obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+      trackedBindRun_ok_inv hmain
+    rcases releaseResult with ⟨middle, releaseEmit⟩
+    obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+      trackedBindRun_ok_inv hafterRelease
+    rcases bodyResult with ⟨output, emit, av⟩
+    have hpure :
+        (releaseEmit ∘ emit) (.ret (av.toAtom output)) = mainCode ∧
+          bodyState = finalState := by
+      simpa using hafterBody
+    obtain ⟨hcode, hbodyState⟩ := hpure
+    subst bodyState
+    let input : VEnv := ⟨[], 0⟩
+    have hplan : ReleasePlan input [] input (_root_.id : Emit) := .nil
+    have hplanRun : (releaseSlots input []).run mainInitial =
+        .ok (input, (_root_.id : Emit)) mainInitial :=
+      hplan.run mainInitial
+    have heq :
+        (input, (_root_.id : Emit)) = (middle, releaseEmit) ∧
+          mainInitial = releaseState := by
+      simpa [input] using hplanRun.symm.trans hrelease
+    have hmiddle : input = middle := congrArg Prod.fst heq.1
+    have hemitting : (_root_.id : Emit) = releaseEmit :=
+      congrArg Prod.snd heq.1
+    subst middle
+    subst releaseEmit
+    cases heq.2
+    let cur : FnDef := ⟨0, .shared, false, mainCode⟩
+    have hbodyProgress : LowerResultValueProgress
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) ctx cur input output [] [] sourceValue
+        mainWorld emit av :=
+      (lowerValueProgressSafeClusterWithin
+        (recSelfRel := fun _ _ => False) (cur := cur) henv hrepresented
+        hcontracts hvalues hprogress bodyFuel).expr hsource hbodyRun
+        (ExtraExtends.refl _)
+        (SelfProgressAvailable.of_noRecSelf (by
+          intro index arity hentry
+          simp [input] at hentry))
+    have hpre : GraphOwnsVEnv
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) input [] [] [] ({} : Store) [] := by
+      refine ⟨[], ?_, Sim.RootsGraph.nil, RootOwnership.empty⟩
+      exact ⟨by simp [input], EntriesValueGraph.nil⟩
+    obtain ⟨targetFuel, store, value, htarget⟩ :=
+      hbodyProgress.closeProgress [] [] hpre
+    refine ⟨targetFuel, store, value, ?_⟩
+    unfold runMain
+    change runCode ctx targetFuel cur ({} : Store) [] mainCode =
+      .ok (store, value)
+    rw [← hcode]
+    simpa [Function.comp_def] using htarget
+
+/-- A successfully compiled main with an exact source trace below `limit`
+reaches a concrete target value using only trace-progress contracts below
+that same limit. -/
+theorem lowerAllAction_main_progress_of_trace_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel limit sourceFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerTraceProgressContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit)
+    (hsourceBound : sourceFuel < limit)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel [] main
+      sourceValue) :
+    ∃ targetFuel store value,
+      runMain ctx mainCode targetFuel = .ok (store, value) := by
+  obtain ⟨mainInitial, hmain⟩ := lowerAllAction_main_trace hlower
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerFnBody] at hmain
+    exact (trackedThrowRun_not_ok hmain).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hmain
+    obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+      trackedBindRun_ok_inv hmain
+    rcases releaseResult with ⟨middle, releaseEmit⟩
+    obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+      trackedBindRun_ok_inv hafterRelease
+    rcases bodyResult with ⟨output, emit, av⟩
+    have hpure :
+        (releaseEmit ∘ emit) (.ret (av.toAtom output)) = mainCode ∧
+          bodyState = finalState := by
+      simpa using hafterBody
+    obtain ⟨hcode, hbodyState⟩ := hpure
+    subst bodyState
+    let input : VEnv := ⟨[], 0⟩
+    have hplan : ReleasePlan input [] input (_root_.id : Emit) := .nil
+    have hplanRun : (releaseSlots input []).run mainInitial =
+        .ok (input, (_root_.id : Emit)) mainInitial :=
+      hplan.run mainInitial
+    have heq :
+        (input, (_root_.id : Emit)) = (middle, releaseEmit) ∧
+          mainInitial = releaseState := by
+      simpa [input] using hplanRun.symm.trans hrelease
+    have hmiddle : input = middle := congrArg Prod.fst heq.1
+    have hemitting : (_root_.id : Emit) = releaseEmit :=
+      congrArg Prod.snd heq.1
+    subst middle
+    subst releaseEmit
+    cases heq.2
+    let cur : FnDef := ⟨0, .shared, false, mainCode⟩
+    have hbodyProgress : LowerResultValueProgress
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) ctx cur input output [] [] sourceValue
+        mainWorld emit av :=
+      (lowerValueTraceProgressClusterWithinBelow
+        (recSelfRel := fun _ _ => False) (cur := cur) henv hrepresented
+        hcontracts hvalues hprogress bodyFuel).expr hsourceBound hsource
+        hbodyRun (ExtraExtends.refl _)
+        (SelfTraceProgressAvailableBelow.of_noRecSelf (by
+          intro index arity hentry
+          simp [input] at hentry))
+    have hpre : GraphOwnsVEnv
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) input [] [] [] ({} : Store) [] := by
+      refine ⟨[], ?_, Sim.RootsGraph.nil, RootOwnership.empty⟩
+      exact ⟨by simp [input], EntriesValueGraph.nil⟩
+    obtain ⟨targetFuel, store, value, htarget⟩ :=
+      hbodyProgress.closeProgress [] [] hpre
+    refine ⟨targetFuel, store, value, ?_⟩
+    unfold runMain
+    change runCode ctx targetFuel cur ({} : Store) [] mainCode =
+      .ok (store, value)
+    rw [← hcode]
+    simpa [Function.comp_def] using htarget
+
+/-- Unbounded exact-trace whole-main progress assembled pointwise from a
+full trace-progress contract. -/
+theorem lowerAllAction_main_progress_of_trace
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel sourceFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerTraceProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel [] main
+      sourceValue) :
+    ∃ targetFuel store value,
+      runMain ctx mainCode targetFuel = .ok (store, value) :=
+  lowerAllAction_main_progress_of_trace_below (limit := sourceFuel + 1)
+    henv hlower hrepresented hcontracts hvalues
+    (hprogress.below (sourceFuel + 1)) (Nat.lt_succ_self sourceFuel) hsource
+
+/-- Whole-main progress with every internal semantic and trace-progress
+contract reconstructed from the exact compiler output.  Only the two scalar
+extern boundaries remain explicit: value compatibility and termination. -/
+theorem lowerAllAction_main_progress_of_trace_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel sourceFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hsource : IxIR0.ProjectionSafe.Eval sourceCtx sourceFuel [] main
+      sourceValue) :
+    ∃ targetFuel store value,
+      runMain ctx mainCode targetFuel = .ok (store, value) := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htarget hrepresented hcontracts hexternValue
+  have hprogress := lowerAllAction_compilerTraceProgressContracts
+    henv hlower htarget hrepresented hcontracts hvalues hexternProgress
+  exact lowerAllAction_main_progress_of_trace henv hlower hrepresented
+    hcontracts hvalues hprogress hsource
+
+/-- End-to-end target progress for the executable validator's exact erased
+main.  Callable progress is derived from the full call-aware certificate and
+the concrete whole-pass provenance, rather than accepted as a monolithic
+compiler-progress premise. -/
+theorem lowerAllAction_main_progress_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel eraseFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx sourceCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (hlower :
+      (lowerAllAction decls cert.target mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx) :
+    ∃ targetFuel store value,
+      runMain ctx mainCode targetFuel = .ok (store, value) := by
+  obtain ⟨targetFuel, targetValue, htrace, _⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed cert hstrict horacles hctx
+      hframe hbelow hsource
+  exact lowerAllAction_main_progress_of_trace_sealed henv hlower htarget
+    hrepresented hcontracts hexternValue hexternProgress htrace
+
+/-- One successful top-level run excludes ordinary stuckness at every fuel:
+success and non-fuel errors both persist upward, so either fuel ordering gives
+a contradiction. -/
+theorem ordinaryStuckUnreachable_of_progress
+    {ctx : Ctx} {code : Code}
+    (hprogress : ∃ fuel store value,
+      runMain ctx code fuel = .ok (store, value)) :
+    OrdinaryStuckUnreachable ctx code := by
+  obtain ⟨successFuel, store, value, hsuccess⟩ := hprogress
+  intro fuel message hstuck
+  by_cases hle : successFuel ≤ fuel
+  · have hsuccess' := runMain_mono hle hsuccess
+    rw [hstuck] at hsuccess'
+    contradiction
+  · have hsmall : fuel ≤ successFuel :=
+      Nat.le_of_lt (Nat.lt_of_not_ge hle)
+    have hstuck' := runMain_stuck_mono hsmall hstuck
+    rw [hsuccess] at hstuck'
+    contradiction
+
+/-- Projection-safe source evaluation discharges the whole target's
+ordinary-stuck exclusion, not merely the witnessed run. -/
+theorem lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : ProjectionSafeEval sourceCtx [] main sourceValue) :
+    OrdinaryStuckUnreachable ctx mainCode :=
+  ordinaryStuckUnreachable_of_progress
+    (lowerAllAction_main_progress_of_projectionSafe henv hlower
+      hrepresented hcontracts hvalues hprogress hsource)
+
+/-- Proof-producing erasure turns a successful closed Ixon evaluation into
+the projection-safe witness required to exclude ordinary stuckness after
+lowering. -/
+theorem lowerAllAction_ordinaryStuckUnreachable_of_erasure
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx sourceCtx none frame.refs
+      frame.selfMuts frame.selfAddr [] source main)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    OrdinaryStuckUnreachable ctx mainCode := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_erasure_closed hstrict horacles hsource herases
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe henv
+    hlower hrepresented hcontracts hvalues hprogress hsafe
+
+/-- Sharing-aware proof-producing erasure excludes ordinary stuckness for
+the exact erased main compiled by the lowering pass. -/
+theorem lowerAllAction_ordinaryStuckUnreachable_of_erasure_inlineSharing
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing sourceCtx none
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr frame.sharing source) main)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    OrdinaryStuckUnreachable ctx mainCode := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_erasure_inlineSharing_closed hstrict horacles hctx
+      hframe hbelow hsource herases
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe henv
+    hlower hrepresented hcontracts hvalues hprogress hsafe
+
+
+/-! ## Public target-safety closure -/
+
+/-- Fuel-or-success safety excludes every concrete non-fuel evaluator
+error. -/
+theorem succeedsOrFuel_ne_error {alpha : Type} {result : Except Err alpha}
+    (hsafe : SucceedsOrFuel result) {error : Err}
+    (hne : error ≠ .fuel) : result ≠ .error error := by
+  intro herror
+  cases hsafe with
+  | inl hfuel =>
+    rw [herror] at hfuel
+    exact hne (Except.error.inj hfuel)
+  | inr hsuccess =>
+    obtain ⟨value, hvalue⟩ := hsuccess
+    rw [herror] at hvalue
+    contradiction
+
+/-- The roadmap's public memory-safety proposition follows immediately once
+the whole compiled main has fuel-or-success safety at every approximation. -/
+theorem memoryErrorUnreachable_of_succeedsOrFuel
+    {ctx : Ctx} {code : Code}
+    (hsafe : ∀ fuel, SucceedsOrFuel (runMain ctx code fuel)) :
+    MemoryErrorUnreachable ctx code := by
+  intro fuel message
+  exact succeedsOrFuel_ne_error (hsafe fuel) (by simp)
+
+/-- One closed non-memory terminal observation excludes dynamic memory
+errors at every fuel.  At greater fuel the observation persists; at lesser
+fuel a hypothetical memory error would persist up to the terminal
+observation. -/
+theorem memoryErrorUnreachable_of_settlement
+    {ctx : Ctx} {code : Code}
+    (hsettles : ∃ fuel, SettlesWithoutMemory (runMain ctx code fuel)) :
+    MemoryErrorUnreachable ctx code := by
+  intro fuel message hmemory
+  obtain ⟨terminalFuel, hterminal⟩ := hsettles
+  by_cases hle : terminalFuel ≤ fuel
+  · cases hterminal with
+    | success value hsuccess =>
+      have hsuccess' := runMain_mono hle hsuccess
+      rw [hmemory] at hsuccess'
+      cases hsuccess'
+    | stuck stuckMessage hstuck =>
+      have hstuck' := runMain_stuck_mono hle hstuck
+      rw [hmemory] at hstuck'
+      cases hstuck'
+  · have hsmall : fuel ≤ terminalFuel :=
+      Nat.le_of_lt (Nat.lt_of_not_ge hle)
+    have hmemory' := runMain_mem_mono hsmall hmemory
+    cases hterminal with
+    | success value hsuccess =>
+      rw [hsuccess] at hmemory'
+      cases hmemory'
+    | stuck stuckMessage hstuck =>
+      rw [hstuck] at hmemory'
+      cases hmemory'
+
+/-- One closed non-memory terminal observation also excludes unresolved
+declaration or oracle lookups at every fuel.  This extracts the closed-world
+content already present in the source-guided call and extern contracts. -/
+theorem unknownRefUnreachable_of_settlement
+    {ctx : Ctx} {code : Code}
+    (hsettles : ∃ fuel, SettlesWithoutMemory (runMain ctx code fuel)) :
+    UnknownRefUnreachable ctx code := by
+  intro fuel address hunknown
+  obtain ⟨terminalFuel, hterminal⟩ := hsettles
+  by_cases hle : terminalFuel ≤ fuel
+  · cases hterminal with
+    | success value hsuccess =>
+      have hsuccess' := runMain_mono hle hsuccess
+      rw [hunknown] at hsuccess'
+      cases hsuccess'
+    | stuck message hstuck =>
+      have hstuck' := runMain_stuck_mono hle hstuck
+      rw [hunknown] at hstuck'
+      cases hstuck'
+  · have hsmall : fuel ≤ terminalFuel :=
+      Nat.le_of_lt (Nat.lt_of_not_ge hle)
+    have hunknown' := runMain_unknownRef_mono hsmall hunknown
+    cases hterminal with
+    | success value hsuccess =>
+      rw [hsuccess] at hunknown'
+      cases hunknown'
+    | stuck message hstuck =>
+      rw [hstuck] at hunknown'
+      cases hunknown'
+
+/-- Settlement becomes genuine target progress exactly when its one admitted
+non-success terminal class, ordinary stuckness, is excluded.  Closed-world
+lookup failure has already been ruled out by the settlement construction. -/
+theorem targetProgress_of_settlement
+    {ctx : Ctx} {code : Code}
+    (hsettles : ∃ fuel, SettlesWithoutMemory (runMain ctx code fuel))
+    (hstuck : OrdinaryStuckUnreachable ctx code) :
+    ∃ fuel store value,
+      runMain ctx code fuel = .ok (store, value) := by
+  obtain ⟨fuel, hterminal⟩ := hsettles
+  cases hterminal with
+  | success result hrun =>
+    exact ⟨fuel, result.1, result.2, hrun⟩
+  | stuck message hrun =>
+    exact (hstuck fuel message hrun).elim
+
+/-- The three independent error-exclusion contracts recover the stronger
+all-fuel progress classification without conflating their proofs. -/
+theorem succeedsOrFuel_of_error_exclusions
+    {ctx : Ctx} {code : Code}
+    (hmemory : MemoryErrorUnreachable ctx code)
+    (hstuck : OrdinaryStuckUnreachable ctx code)
+    (hunknown : UnknownRefUnreachable ctx code) :
+    ∀ fuel, SucceedsOrFuel (runMain ctx code fuel) := by
+  intro fuel
+  cases hrun : runMain ctx code fuel with
+  | ok result => exact Or.inr ⟨result, rfl⟩
+  | error error =>
+    cases error with
+    | fuel => exact Or.inl rfl
+    | stuck message => exact (hstuck fuel message hrun).elim
+    | mem message => exact (hmemory fuel message hrun).elim
+    | unknownRef address => exact (hunknown fuel address hrun).elim
+
+/-- Generic whole-pass memory safety from the independent ownership, value,
+and source-guided progress contract packages. -/
+theorem lowerAllAction_memoryErrorUnreachable
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue) :
+    MemoryErrorUnreachable ctx mainCode :=
+  memoryErrorUnreachable_of_settlement
+    (lowerAllAction_main_settlement henv hlower hrepresented hcontracts
+      hvalues hprogress hsource)
+
+/-- Generic whole-pass closed-world safety from the same independently
+auditable ownership, value, and source-guided progress contracts. -/
+theorem lowerAllAction_unknownRefUnreachable
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue) :
+    UnknownRefUnreachable ctx mainCode :=
+  unknownRefUnreachable_of_settlement
+    (lowerAllAction_main_settlement henv hlower hrepresented hcontracts
+      hvalues hprogress hsource)
+
+/-- Whole-pass memory safety with semantic value contracts reconstructed
+from the actual compiler output.  Only the explicit extern-value boundary
+and source-guided target-progress package remain semantic premises. -/
+theorem lowerAllAction_memoryErrorUnreachable_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue) :
+    MemoryErrorUnreachable ctx mainCode := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  exact lowerAllAction_memoryErrorUnreachable henv hlower hrepresented
+    hcontracts hvalues hprogress hsource
+
+/-- Whole-pass closed-world safety with semantic value contracts reconstructed
+from the actual compiler output.  As for memory safety, the remaining
+semantic premises are the extern-value and source-guided progress packages. -/
+theorem lowerAllAction_unknownRefUnreachable_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue) :
+    UnknownRefUnreachable ctx mainCode := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  exact lowerAllAction_unknownRefUnreachable henv hlower hrepresented
+    hcontracts hvalues hprogress hsource
+
+/-- Whole-pass ordinary-stuck exclusion with semantic value contracts
+reconstructed from the actual compiler output. -/
+theorem lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : ProjectionSafeEval sourceCtx [] main sourceValue) :
+    OrdinaryStuckUnreachable ctx mainCode := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe henv
+    hlower hrepresented hcontracts hvalues hprogress hsource
+
+/-- Sealed proof-producing-erasure route to ordinary-stuck exclusion. -/
+theorem lowerAllAction_ordinaryStuckUnreachable_of_erasure_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx sourceCtx none frame.refs
+      frame.selfMuts frame.selfAddr [] source main)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    OrdinaryStuckUnreachable ctx mainCode := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_erasure_closed hstrict horacles hsource herases
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress hsafe
+
+/-- Sealed sharing-aware proof-producing-erasure route to ordinary-stuck
+exclusion. -/
+theorem
+    lowerAllAction_ordinaryStuckUnreachable_of_erasure_inlineSharing_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing sourceCtx none
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr frame.sharing source) main)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    OrdinaryStuckUnreachable ctx mainCode := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_erasure_inlineSharing_closed hstrict horacles hctx
+      hframe hbelow hsource herases
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress hsafe
+
+/-- Public semantic forward simulation from settlement and the remaining
+ordinary-stuck admissibility boundary.  Memory and closed-world failures are
+already excluded by settlement and remain available as separate whole-pass
+theorems above. -/
+theorem lowerAllAction_semanticForwardSimulation_of_admissibility_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hstuck : OrdinaryStuckUnreachable ctx mainCode) :
+    SemanticForwardSimulation sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  apply lowerAllAction_semanticForwardSimulation_of_targetProgress
+    henv hlower hrepresented hcontracts hvalues
+  intro sourceFuel sourceValue hsource
+  obtain ⟨fuel, store, value, hrun⟩ := targetProgress_of_settlement
+    (lowerAllAction_main_settlement henv hlower hrepresented hcontracts
+      hvalues hprogress hsource)
+    hstuck
+  exact ⟨fuel, store, value, hrun⟩
+
+/-- Projection-safe source execution removes the final admissibility premise
+from the sealed semantic forward-simulation theorem. -/
+theorem lowerAllAction_semanticForwardSimulation_of_projectionSafe_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceValue : IxIR0.Value}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : ProjectionSafeEval sourceCtx [] main sourceValue) :
+    SemanticForwardSimulation sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  apply lowerAllAction_semanticForwardSimulation_of_admissibility_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress
+      hsource
+
+/-- Proof-producing erasure removes the ordinary-stuck premise from sealed
+semantic forward simulation. -/
+theorem lowerAllAction_semanticForwardSimulation_of_erasure_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx sourceCtx none frame.refs
+      frame.selfMuts frame.selfAddr [] source main)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    SemanticForwardSimulation sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_erasure_closed hstrict horacles hsource herases
+  exact lowerAllAction_semanticForwardSimulation_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress hsafe
+
+/-- Sharing-aware proof-producing erasure removes the ordinary-stuck premise
+from sealed semantic forward simulation. -/
+theorem
+    lowerAllAction_semanticForwardSimulation_of_erasure_inlineSharing_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (herases : Ix.Compiler.Sim.PErase ectx.inlineSharing sourceCtx none
+      frame.inlineSharing.refs frame.inlineSharing.selfMuts
+      frame.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr frame.sharing source) main)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    SemanticForwardSimulation sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_erasure_inlineSharing_closed hstrict horacles hctx
+      hframe hbelow hsource herases
+  exact lowerAllAction_semanticForwardSimulation_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress hsafe
+
+/-- The executable validator's exact closed target excludes ordinary
+stuckness after whole-pass lowering.  This certificate-level boundary prevents
+the erasure proof and the expression passed to `lowerAllAction` from drifting
+apart. -/
+theorem
+    lowerAllAction_ordinaryStuckUnreachable_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel eraseFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx sourceCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (hlower :
+      (lowerAllAction decls cert.target mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    OrdinaryStuckUnreachable ctx mainCode := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_certifiedSharedClosed cert hstrict horacles hctx
+      hframe hbelow hsource
+  exact lowerAllAction_ordinaryStuckUnreachable_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress hsafe
+
+/-- End-to-end semantic forward simulation for the exact expression returned
+by the executable sharing-aware erasure validator. -/
+theorem
+    lowerAllAction_semanticForwardSimulation_of_certificate_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel eraseFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx sourceCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (hlower :
+      (lowerAllAction decls cert.target mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : CompilerProgressContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx) :
+    SemanticForwardSimulation sourceCtx ctx cert.target mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  obtain ⟨targetValue, hsafe, hrel⟩ :=
+    ProjectionSafeEval.of_certifiedSharedClosed cert hstrict horacles hctx
+      hframe hbelow hsource
+  exact lowerAllAction_semanticForwardSimulation_of_projectionSafe_sealed
+    henv hlower htargetDecls hrepresented hcontracts hextern hprogress hsafe
+
+/-- Certificate-indexed forward simulation with callable progress rebuilt
+from exact source traces and whole-pass provenance.  This is the call-aware
+replacement for the compatibility theorem above: it has no
+`CompilerProgressContracts` premise. -/
+theorem
+    lowerAllAction_semanticForwardSimulation_of_certificate_trace_sealed
+    {ectx : Ixon.Eval.EvalCtx} {frame : Ixon.Eval.Frame}
+    {source : Ixon.Expr} {sourceFuel eraseFuel : Nat}
+    {sourceValue : Ixon.Eval.Value} {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (cert : Ix.Compiler.EraseValidator.CertifiedSharedExpr ectx sourceCtx
+      none (Ix.Compiler.EraseValidator.tablesOfFrame frame)
+      frame.selfAddr [] eraseFuel source)
+    (hstrict : ectx.Strict)
+    (horacles : Ix.Compiler.Sim.OracleRel ectx.inlineSharing sourceCtx)
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hctx : ectx.SharingWF) (hframe : frame.SharingWF)
+    (hbelow : Ixon.Sharing.sharesBelow frame.sharing.size source = true)
+    (hsource : Ixon.Eval.eval ectx sourceFuel frame [] source =
+      .ok sourceValue)
+    (hlower :
+      (lowerAllAction decls cert.target mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hexternValue : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hexternProgress : ExternTraceProgressContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx) :
+    SemanticForwardSimulation sourceCtx ctx cert.target mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  have htargetProgress := lowerAllAction_main_progress_of_certificate_sealed
+    cert hstrict horacles henv hctx hframe hbelow hsource hlower htarget
+    hrepresented hcontracts hexternValue hexternProgress
+  apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed
+    henv hlower htarget hrepresented hcontracts hexternValue
+  intro targetSourceFuel targetSourceValue htargetSource
+  exact htargetProgress
+
+/-- Hoare-style settlement of a closed main yields the public all-fuel
+memory-safety proposition. -/
+theorem memoryErrorUnreachable_of_codeSettlement
+    {ctx : Ctx} {code : Code} {pre : StatePred}
+    (hsettles : CodeSettlement ctx ⟨0, .shared, false, code⟩ pre code)
+    (hpre : pre {} []) :
+    MemoryErrorUnreachable ctx code := by
+  apply memoryErrorUnreachable_of_settlement
+  obtain ⟨fuel, hterminal⟩ := hsettles hpre
+  exact ⟨fuel, by simpa [runMain] using hterminal⟩
+
+/-- One successful top-level run is enough to exclude dynamic memory errors
+at every fuel.  Above the successful fuel, success is monotone; below it, a
+memory error would persist up to the successful fuel. -/
+theorem memoryErrorUnreachable_of_progress
+    {ctx : Ctx} {code : Code}
+    (hprogress : ∃ fuel store value,
+      runMain ctx code fuel = .ok (store, value)) :
+    MemoryErrorUnreachable ctx code := by
+  obtain ⟨successFuel, store, value, hsuccess⟩ := hprogress
+  exact memoryErrorUnreachable_of_settlement
+    ⟨successFuel, .success (store, value) hsuccess⟩
+
+/-- Any established semantic forward simulation yields the public all-fuel
+memory-safety claim as soon as the source program has one successful run. -/
+theorem SemanticForwardSimulation.memoryErrorUnreachable
+    {sourceCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {source : IxIR0.Expr} {target : Code} {funRel : Sim.FunctionRel}
+    (hsim : SemanticForwardSimulation sourceCtx targetCtx source target
+      funRel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] source =
+      .ok sourceValue) :
+    MemoryErrorUnreachable targetCtx target := by
+  obtain ⟨targetFuel, targetStore, targetValue, htarget, _⟩ :=
+    hsim hsource
+  exact memoryErrorUnreachable_of_progress
+    ⟨targetFuel, targetStore, targetValue, htarget⟩
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/LowerSim.lean b/Ix/Compiler/IxIR1/LowerSim.lean
new file mode 100644
index 000000000..be0a332b0
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerSim.lean
@@ -0,0 +1,34095 @@
+import Ix.Compiler.IxIR1.LowerStateBase
+import Ix.Compiler.IxIR1.Sim
+import Ix.Compiler.IxIR1.Mono
+import Ix.Compiler.IxIR1.Reclamation
+import Ix.Compiler.IxIR0.Mono
+
+/-!
+# Proof interface for the IxIR₀ → IxIR₁ lowering
+
+This file begins the compiler induction proper. `IxIR1.Sim` proves exact
+ownership interfaces for evaluator operations; here those interfaces are
+lifted to the continuation-building shape used by `Lower.Emit` and tied to
+the lowerer's absolute-slot environment.
+
+The central judgment is `EmitSound`: an emitter transforms any continuation
+valid under its output state predicate into code valid under its input state
+predicate. This is a weakest-precondition presentation of the existing
+`Code → Code` difference-list representation, so emitter composition becomes
+the compiler induction's sequencing rule.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Owned Uses)
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.Sim
+
+/-! ## Runtime realization of the compile-time environment -/
+
+/-- Realize the held entries of a compile-time `VEnv` as an ordered root
+list. Released slots and the synthetic recursor-self entry own no runtime
+root. Absolute slots are interpreted with the same `VEnv.rel` calculation
+used by code emission. -/
+inductive EntriesRealize (Γ : VEnv) (env : List RVal) :
+    List VEntry → List Root → Prop where
+  | nil : EntriesRealize Γ env [] []
+  | released {abs remaining uses entries roots} :
+      abs < Γ.depth →
+      EntriesRealize Γ env entries roots →
+      EntriesRealize Γ env
+        (.slot abs remaining uses false :: entries) roots
+  | held {abs remaining uses entries roots value} :
+      abs < Γ.depth →
+      env[Γ.rel abs]? = some value →
+      EntriesRealize Γ env entries roots →
+      EntriesRealize Γ env
+        (.slot abs remaining uses true :: entries)
+        (⟨worldOfUses uses, value⟩ :: roots)
+  | recSelf {arity entries roots} :
+      EntriesRealize Γ env entries roots →
+      EntriesRealize Γ env (.recSelf arity :: entries) roots
+
+/-- Dependent traversal of an ownership environment graph. Entry/root
+threading and released/held/recursive-self dispatch recurse once; callbacks
+receive both the original tail witness and the recursively produced result. -/
+theorem EntriesRealize.traverse
+    {Γ : VEnv} {env : List RVal}
+    {Result : List VEntry → List Root → Prop}
+    (hnil : Result [] [])
+    (hreleased : ∀ {abs remaining : Nat} {uses : Uses}
+        {entries : List VEntry} {roots : List Root},
+      abs < Γ.depth →
+      EntriesRealize Γ env entries roots →
+      Result entries roots →
+      Result (.slot abs remaining uses false :: entries) roots)
+    (hheld : ∀ {abs remaining : Nat} {uses : Uses}
+        {entries : List VEntry} {roots : List Root} {value : RVal},
+      abs < Γ.depth →
+      env[Γ.rel abs]? = some value →
+      EntriesRealize Γ env entries roots →
+      Result entries roots →
+      Result (.slot abs remaining uses true :: entries)
+        (⟨worldOfUses uses, value⟩ :: roots))
+    (hrecSelf : ∀ {arity : Nat} {entries : List VEntry}
+        {roots : List Root},
+      EntriesRealize Γ env entries roots →
+      Result entries roots →
+      Result (.recSelf arity :: entries) roots)
+    {entries : List VEntry} {roots : List Root}
+    (h : EntriesRealize Γ env entries roots) :
+    Result entries roots := by
+  induction h with
+  | nil => exact hnil
+  | released hbound htail ih => exact hreleased hbound htail ih
+  | held hbound hslot htail ih => exact hheld hbound hslot htail ih
+  | recSelf htail ih => exact hrecSelf htail ih
+
+theorem EntriesRealize.append {Γ : VEnv} {env : List RVal}
+    {left right : List VEntry} {leftRoots rightRoots : List Root}
+    (hleft : EntriesRealize Γ env left leftRoots)
+    (hright : EntriesRealize Γ env right rightRoots) :
+    EntriesRealize Γ env (left ++ right) (leftRoots ++ rightRoots) := by
+  apply EntriesRealize.traverse
+    (Result := fun current currentRoots =>
+      EntriesRealize Γ env (current ++ right)
+        (currentRoots ++ rightRoots))
+    (h := hleft)
+  · simpa using hright
+  · intro abs remaining uses entries roots hbound htail ih
+    simpa using EntriesRealize.released hbound ih
+  · intro abs remaining uses entries roots value hbound hslot htail ih
+    simpa using EntriesRealize.held hbound hslot ih
+  · intro arity entries roots htail ih
+    simpa using EntriesRealize.recSelf ih
+
+/-- A runtime environment realizes a `VEnv` when its physical depth agrees
+and its held entries realize exactly the listed logical roots. -/
+structure VEnvRealizes (Γ : VEnv) (env : List RVal)
+    (roots : List Root) : Prop where
+  depth_eq : env.length = Γ.depth
+  entries : EntriesRealize Γ env Γ.entries roots
+
+/-! ## Companion source-environment graph
+
+The ownership induction above deliberately forgets source values. The
+semantic induction instead layers the following graph over the same `VEnv`
+and exact root order. Held entries relate their source value to the runtime
+slot through `ValueGraph`; released entries retain only the source-list
+shape; and the synthetic recursor-self entry is described by a separate
+static relation because it emits `callSelf` without occupying a runtime
+slot. -/
+
+/-- Correspondence for the synthetic source recursor value represented by a
+`VEntry.recSelf`. The enclosing recursor theorem will instantiate the source
+address as well as the shared target function contract. -/
+abbrev RecSelfRel := IxIR0.Value → Nat → Prop
+
+/-! ## Lifted closures and their stored pap prefixes -/
+
+/-- The outer de Bruijn entries captured by lambda lifting, in the exact
+order used by `lowerLam`. -/
+def liftCaptureIndices (entryCount : Nat) (expr : IxIR0.Expr) : List Nat :=
+  (List.range entryCount).filter (fun index => countUses index expr > 0)
+
+/-- `values` are the source-environment values at `indices`, in order.
+Making lookup success proof-relevant avoids a default source value and gives
+the capture-lowering induction exactly the relation it has to construct. -/
+inductive ValuesAt (sourceEnv : List IxIR0.Value) :
+    List Nat → List IxIR0.Value → Prop where
+  | nil : ValuesAt sourceEnv [] []
+  | cons {index : Nat} {value : IxIR0.Value}
+      {indices : List Nat} {values : List IxIR0.Value} :
+      sourceEnv[index]? = some value →
+      ValuesAt sourceEnv indices values →
+      ValuesAt sourceEnv (index :: indices) (value :: values)
+
+@[simp] theorem ValuesAt.length {sourceEnv : List IxIR0.Value}
+    {indices : List Nat} {values : List IxIR0.Value}
+    (h : ValuesAt sourceEnv indices values) :
+    values.length = indices.length := by
+  induction h <;> simp_all
+
+theorem ValuesAt.exists_of_forall_lt
+    (sourceEnv : List IxIR0.Value) (indices : List Nat)
+    (hbound : ∀ index, index ∈ indices → index < sourceEnv.length) :
+    ∃ values, ValuesAt sourceEnv indices values := by
+  induction indices with
+  | nil => exact ⟨[], .nil⟩
+  | cons index rest ih =>
+    have hindex : index < sourceEnv.length :=
+      hbound index (by simp)
+    obtain ⟨values, hvalues⟩ := ih (fun candidate hmember =>
+      hbound candidate (by simp [hmember]))
+    let value := sourceEnv[index]
+    refine ⟨value :: values, .cons ?_ hvalues⟩
+    exact List.getElem?_eq_some_iff.mpr ⟨hindex, rfl⟩
+
+/-- Every compiler-selected capture index is valid when the source and
+lowering environments have the same logical length. -/
+theorem ValuesAt.exists_liftCaptureIndices
+    (sourceEnv : List IxIR0.Value) (entryCount : Nat)
+    (expr : IxIR0.Expr) (hlength : sourceEnv.length = entryCount) :
+    ∃ values,
+      ValuesAt sourceEnv (liftCaptureIndices entryCount expr) values := by
+  apply ValuesAt.exists_of_forall_lt
+  intro index hmember
+  obtain ⟨hrange, _⟩ := List.mem_filter.mp hmember
+  have hindex := List.mem_range.mp hrange
+  omega
+
+/-- A source closure after zero or more applications from the leading lambda
+run. Arguments are stored in application order, while the evaluator closure
+environment grows in reverse order. Requiring the residual expression to be
+a lambda makes every represented prefix strictly under-saturated. -/
+inductive LambdaPrefix :
+    List IxIR0.Value → IxIR0.Expr →
+    List IxIR0.Value → IxIR0.Value → Prop where
+  | nil {sourceEnv : List IxIR0.Value} {uses : Uses}
+      {body : IxIR0.Expr} :
+      LambdaPrefix sourceEnv (.lam uses body) []
+        (.clos uses sourceEnv body)
+  | cons {sourceEnv : List IxIR0.Value} {uses : Uses}
+      {body : IxIR0.Expr} {argument : IxIR0.Value}
+      {arguments : List IxIR0.Value} {value : IxIR0.Value} :
+      LambdaPrefix (argument :: sourceEnv) body arguments value →
+      LambdaPrefix sourceEnv (.lam uses body)
+        (argument :: arguments) value
+
+/-- Dependent traversal of a residual lifted-closure prefix. Source
+environment growth, lambda peeling, supplied arguments, and the residual
+source value recurse once; callbacks retain the original inner-prefix witness
+alongside its recursively produced result. -/
+theorem LambdaPrefix.traverse
+    {Result : List IxIR0.Value → IxIR0.Expr →
+      List IxIR0.Value → IxIR0.Value → Prop}
+    (hnil : ∀ {sourceEnv : List IxIR0.Value} {uses : Uses}
+        {body : IxIR0.Expr},
+      Result sourceEnv (.lam uses body) []
+        (.clos uses sourceEnv body))
+    (hcons : ∀ {sourceEnv : List IxIR0.Value} {uses : Uses}
+        {body : IxIR0.Expr} {argument : IxIR0.Value}
+        {arguments : List IxIR0.Value} {value : IxIR0.Value},
+      LambdaPrefix (argument :: sourceEnv) body arguments value →
+      Result (argument :: sourceEnv) body arguments value →
+      Result sourceEnv (.lam uses body) (argument :: arguments) value)
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {arguments : List IxIR0.Value} {value : IxIR0.Value}
+    (h : LambdaPrefix sourceEnv expr arguments value) :
+    Result sourceEnv expr arguments value := by
+  induction h with
+  | nil => exact hnil
+  | cons hinner ih => exact hcons hinner ih
+
+/-- A represented closure prefix contains fewer supplied parameters than the
+leading lambda arity, matching the target evaluator's pap invariant. -/
+theorem LambdaPrefix.length_lt_lamArity
+    {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+    {arguments : List IxIR0.Value} {value : IxIR0.Value}
+    (h : LambdaPrefix sourceEnv expr arguments value) :
+    arguments.length < lamArity expr := by
+  apply LambdaPrefix.traverse
+    (Result := fun _ currentExpr currentArguments _ =>
+      currentArguments.length < lamArity currentExpr)
+    (h := h)
+  · intro currentEnv uses body
+    simp [lamArity]
+  · intro currentEnv uses body argument currentArguments currentValue
+      hinner ih
+    simpa [lamArity] using Nat.succ_lt_succ ih
+
+/-- Provenance boundary for one generated lifted declaration. The concrete
+compiler relation below supplies this from an exact `lowerFnBody` run and a
+declaration in the accumulated lowering state. -/
+abbrev LiftCodeRel :=
+  Ixon.Address → Nat → IxIR0.Expr → Prop
+
+/-- Function correspondence for lifted paps. The pap stores selected outer
+captures followed by already supplied parameters; the related source value
+is precisely the residual closure after that parameter prefix. -/
+def LiftedFunctionRel (liftRel : LiftCodeRel) : Sim.FunctionRel :=
+  fun value address arity captures =>
+    ∃ sourceEnv expr selected supplied,
+      liftRel address sourceEnv.length expr ∧
+      ValuesAt sourceEnv (liftCaptureIndices sourceEnv.length expr) selected ∧
+      captures = selected ++ supplied ∧
+      arity = selected.length + lamArity expr ∧
+      LambdaPrefix sourceEnv expr supplied value
+
+theorem LiftedFunctionRel.initial {liftRel : LiftCodeRel}
+    {sourceEnv : List IxIR0.Value} {uses : Uses} {body : IxIR0.Expr}
+    {selected : List IxIR0.Value} {address : Ixon.Address}
+    (hlift : liftRel address sourceEnv.length (.lam uses body))
+    (hselected : ValuesAt sourceEnv
+      (liftCaptureIndices sourceEnv.length (.lam uses body)) selected) :
+    LiftedFunctionRel liftRel (.clos uses sourceEnv body) address
+      (selected.length + lamArity (.lam uses body)) selected := by
+  refine ⟨sourceEnv, .lam uses body, selected, [], hlift, hselected,
+    ?_, rfl, .nil⟩
+  simp
+
+theorem LiftedFunctionRel.underfilled {liftRel : LiftCodeRel}
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (h : LiftedFunctionRel liftRel value address arity captures) :
+    captures.length < arity := by
+  obtain ⟨sourceEnv, expr, selected, supplied, _, _, rfl, rfl,
+    hprefix⟩ := h
+  have hunder := hprefix.length_lt_lamArity
+  simp only [List.length_append]
+  omega
+
+/-- Lifted function correspondence is monotone in its declaration-provenance
+relation. This lets a local lowering result be transported to the final
+whole-program accumulation. -/
+theorem LiftedFunctionRel.mono {before after : LiftCodeRel}
+    (hmono : ∀ address entryCount expr,
+      before address entryCount expr → after address entryCount expr)
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (h : LiftedFunctionRel before value address arity captures) :
+    LiftedFunctionRel after value address arity captures := by
+  obtain ⟨sourceEnv, expr, selected, supplied, hlift, hselected,
+    hcaptures, harity, hprefix⟩ := h
+  exact ⟨sourceEnv, expr, selected, supplied,
+    hmono address sourceEnv.length expr hlift,
+    hselected, hcaptures, harity, hprefix⟩
+
+/-- Pointwise semantic realization of a source evaluator environment by a
+lowering environment and its runtime stack. The root list has exactly the
+same order as `EntriesRealize`, so it can be consumed directly by
+`RootsGraph` and `RootOwnership`. -/
+inductive EntriesValueGraph (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (store : Store) (Γ : VEnv)
+    (env : List RVal) :
+    List VEntry → List IxIR0.Value → List Root → Prop where
+  | nil : EntriesValueGraph funRel recSelfRel store Γ env [] [] []
+  | released {abs remaining : Nat} {uses : Uses}
+      {entries : List VEntry} {source : IxIR0.Value}
+      {sources : List IxIR0.Value} {roots : List Root} :
+      abs < Γ.depth →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        entries sources roots →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (.slot abs remaining uses false :: entries)
+        (source :: sources) roots
+  | held {abs remaining : Nat} {uses : Uses}
+      {entries : List VEntry} {source : IxIR0.Value}
+      {sources : List IxIR0.Value} {value : RVal}
+      {roots : List Root} :
+      abs < Γ.depth →
+      env[Γ.rel abs]? = some value →
+      HasWorld store (worldOfUses uses) value →
+      Sim.ValueGraph funRel store source value →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        entries sources roots →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (.slot abs remaining uses true :: entries)
+        (source :: sources)
+        (⟨worldOfUses uses, value⟩ :: roots)
+  | recSelf {arity : Nat} {entries : List VEntry}
+      {source : IxIR0.Value} {sources : List IxIR0.Value}
+      {roots : List Root} :
+      recSelfRel source arity →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        entries sources roots →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (.recSelf arity :: entries) (source :: sources) roots
+
+/-- Dependent traversal of a semantic environment graph. Entry/source/root
+threading and released/held/recursive-self dispatch recurse once; callbacks
+receive both the original tail witness and the recursively produced result. -/
+theorem EntriesValueGraph.traverse
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {store : Store} {Γ : VEnv} {env : List RVal}
+    {Result : List VEntry → List IxIR0.Value → List Root → Prop}
+    (hnil : Result [] [] [])
+    (hreleased : ∀ {abs remaining : Nat} {uses : Uses}
+        {entries : List VEntry} {source : IxIR0.Value}
+        {sources : List IxIR0.Value} {roots : List Root},
+      abs < Γ.depth →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        entries sources roots →
+      Result entries sources roots →
+      Result (.slot abs remaining uses false :: entries)
+        (source :: sources) roots)
+    (hheld : ∀ {abs remaining : Nat} {uses : Uses}
+        {entries : List VEntry} {source : IxIR0.Value}
+        {sources : List IxIR0.Value} {value : RVal}
+        {roots : List Root},
+      abs < Γ.depth →
+      env[Γ.rel abs]? = some value →
+      HasWorld store (worldOfUses uses) value →
+      Sim.ValueGraph funRel store source value →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        entries sources roots →
+      Result entries sources roots →
+      Result (.slot abs remaining uses true :: entries)
+        (source :: sources) (⟨worldOfUses uses, value⟩ :: roots))
+    (hrecSelf : ∀ {arity : Nat} {entries : List VEntry}
+        {source : IxIR0.Value} {sources : List IxIR0.Value}
+        {roots : List Root},
+      recSelfRel source arity →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        entries sources roots →
+      Result entries sources roots →
+      Result (.recSelf arity :: entries) (source :: sources) roots)
+    {entries : List VEntry} {sourceEnv : List IxIR0.Value}
+    {roots : List Root}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    Result entries sourceEnv roots := by
+  induction h with
+  | nil => exact hnil
+  | released hbound htail ih => exact hreleased hbound htail ih
+  | held hbound hslot hworld hvalue htail ih =>
+      exact hheld hbound hslot hworld hvalue htail ih
+  | recSelf hself htail ih => exact hrecSelf hself htail ih
+
+/-- Semantic entry graphs compose in the same logical-entry and root order
+as their ownership-only companions. -/
+theorem EntriesValueGraph.append {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {left right : List VEntry}
+    {leftSources rightSources : List IxIR0.Value}
+    {leftRoots rightRoots : List Root}
+    (hleft : EntriesValueGraph funRel recSelfRel store Γ env
+      left leftSources leftRoots)
+    (hright : EntriesValueGraph funRel recSelfRel store Γ env
+      right rightSources rightRoots) :
+    EntriesValueGraph funRel recSelfRel store Γ env
+      (left ++ right) (leftSources ++ rightSources)
+      (leftRoots ++ rightRoots) := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources currentRoots =>
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (current ++ right) (currentSources ++ rightSources)
+        (currentRoots ++ rightRoots))
+    (h := hleft)
+  · simpa using hright
+  · intro abs remaining uses entries source sources roots hbound htail ih
+    simpa using EntriesValueGraph.released hbound ih
+  · intro abs remaining uses entries source sources value roots hbound
+      hslot hworld hvalue htail ih
+    simpa using EntriesValueGraph.held hbound hslot hworld hvalue ih
+  · intro arity entries source sources roots hself htail ih
+    simpa using EntriesValueGraph.recSelf hself ih
+
+/-- A complete source environment realized by a lowering environment. -/
+structure VEnvValueGraph (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (store : Store) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value) (env : List RVal)
+    (roots : List Root) : Prop where
+  depth_eq : env.length = Γ.depth
+  entries : EntriesValueGraph funRel recSelfRel store Γ env
+    Γ.entries sourceEnv roots
+
+/-- The companion graph forgets to the existing target-stack realization. -/
+theorem EntriesValueGraph.entriesRealize {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    EntriesRealize Γ env entries roots := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current _ currentRoots =>
+      EntriesRealize Γ env current currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+    exact .released hbound ih
+  · intro abs remaining uses tail source sources value tailRoots hbound
+      hslot hworld hvalue htail ih
+    exact .held hbound hslot ih
+  · intro arity tail source sources tailRoots hself htail ih
+    exact .recSelf ih
+
+/-- The source-side root frame determined solely by entry structure. Held
+entries contribute their source value at the entry's world; released and
+synthetic recursive-self entries contribute no runtime owner. This list is
+store-independent, which makes it the stable name for an environment frame
+across a callee that may both allocate and free. -/
+def entrySourceRoots : List VEntry → List IxIR0.Value →
+    List (Owned × IxIR0.Value)
+  | .slot _ _ uses held :: entries, source :: sources =>
+      if held then
+        (worldOfUses uses, source) :: entrySourceRoots entries sources
+      else
+        entrySourceRoots entries sources
+  | .recSelf _ :: entries, _ :: sources =>
+      entrySourceRoots entries sources
+  | _, _ => []
+
+/-- An environment graph realizes its canonical, store-independent source
+root frame exactly. -/
+theorem EntriesValueGraph.rootsGraphExact {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    Sim.RootsGraph funRel store (entrySourceRoots entries sourceEnv)
+      roots := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources currentRoots =>
+      Sim.RootsGraph funRel store
+        (entrySourceRoots current currentSources) currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+    exact ih
+  · intro abs remaining uses tail source sources value tailRoots hbound
+      hslot hworld hvalue htail ih
+    exact .cons rfl hworld hvalue ih
+  · intro arity tail source sources tailRoots hself htail ih
+    exact ih
+
+/-- The exact root order carried by the environment graph is a semantic
+`RootsGraph`; this is the bridge from logical compiler slots to pure source
+values. -/
+theorem EntriesValueGraph.rootsGraph {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    ∃ sourceRoots : List (Owned × IxIR0.Value),
+      Sim.RootsGraph funRel store sourceRoots roots :=
+  ⟨entrySourceRoots entries sourceEnv, h.rootsGraphExact⟩
+
+/-- Rebuild an entry graph in an arbitrary post-store from preservation of
+its canonical source-root frame. Entry bounds, slot lookups, released state,
+and recursive-self evidence are store-independent; the supplied
+`RootsGraph` replaces exactly the held entries' world and value witnesses. -/
+theorem EntriesValueGraph.ofRootsGraph {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {before after : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (h : EntriesValueGraph funRel recSelfRel before Γ env
+      entries sourceEnv roots)
+    (hroots : Sim.RootsGraph funRel after
+      (entrySourceRoots entries sourceEnv) roots) :
+    EntriesValueGraph funRel recSelfRel after Γ env
+      entries sourceEnv roots := by
+  revert hroots
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources currentRoots =>
+      Sim.RootsGraph funRel after
+          (entrySourceRoots current currentSources) currentRoots →
+        EntriesValueGraph funRel recSelfRel after Γ env
+          current currentSources currentRoots)
+    (h := h)
+  · intro hroots
+    exact .nil
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+      hroots
+    exact .released hbound (ih hroots)
+  · intro abs remaining uses tail source sources value tailRoots hbound
+      hslot hworld hvalue htail ih hroots
+    change Sim.RootsGraph funRel after
+      ((worldOfUses uses, source) :: entrySourceRoots tail sources)
+      (⟨worldOfUses uses, value⟩ :: tailRoots) at hroots
+    cases hroots with
+    | cons _ hworld hvalue htail =>
+      exact .held hbound hslot hworld hvalue (ih htail)
+  · intro arity tail source sources tailRoots hself htail ih hroots
+    exact .recSelf hself (ih hroots)
+
+@[simp] theorem EntriesValueGraph.source_length {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    sourceEnv.length = entries.length := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources _ =>
+      currentSources.length = current.length)
+    (h := h)
+  · rfl
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+    simp [ih]
+  · intro abs remaining uses tail source sources value tailRoots hbound
+      hslot hworld hvalue htail ih
+    simp [ih]
+  · intro arity tail source sources tailRoots hself htail ih
+    simp [ih]
+
+/-- Looking up a held compiler entry recovers the related source and target
+values needed by the variable case of the semantic induction. -/
+theorem EntriesValueGraph.getHeld {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    {i abs remaining : Nat} {uses : Uses}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots)
+    (hentry : entries[i]? = some (.slot abs remaining uses true)) :
+    ∃ source value,
+      sourceEnv[i]? = some source ∧
+      env[Γ.rel abs]? = some value ∧
+      HasWorld store (worldOfUses uses) value ∧
+      Sim.ValueGraph funRel store source value := by
+  have hlookup :
+      ∀ {index : Nat},
+        entries[index]? = some (.slot abs remaining uses true) →
+        ∃ source value,
+          sourceEnv[index]? = some source ∧
+          env[Γ.rel abs]? = some value ∧
+          HasWorld store (worldOfUses uses) value ∧
+          Sim.ValueGraph funRel store source value := by
+    exact EntriesValueGraph.traverse
+      (Result := fun current currentSources _ =>
+        ∀ {index : Nat},
+          current[index]? = some (.slot abs remaining uses true) →
+          ∃ source value,
+            currentSources[index]? = some source ∧
+            env[Γ.rel abs]? = some value ∧
+            HasWorld store (worldOfUses uses) value ∧
+            Sim.ValueGraph funRel store source value)
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail source sources tailRoots
+          hbound htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, hsource, hslot, hworld, hvalue⟩ :=
+            ih hentry
+          exact ⟨source, value, by simpa using hsource,
+            hslot, hworld, hvalue⟩)
+      (hheld := by
+        intro curAbs curRemaining curUses tail source sources value tailRoots
+          hbound hslot hworld hvalue htail ih index hentry
+        cases index with
+        | zero =>
+          rw [List.getElem?_cons_zero] at hentry
+          have heqs : curAbs = abs ∧ curRemaining = remaining ∧
+              curUses = uses := by simpa using hentry
+          obtain ⟨rfl, rfl, rfl⟩ := heqs
+          exact ⟨source, value, rfl, hslot, hworld, hvalue⟩
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨foundSource, foundValue, hsource, hfoundSlot,
+              hfoundWorld, hfoundValue⟩ := ih hentry
+          exact ⟨foundSource, foundValue, by simpa using hsource,
+            hfoundSlot, hfoundWorld, hfoundValue⟩)
+      (hrecSelf := by
+        intro arity tail source sources tailRoots hself htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, hsource, hslot, hworld, hvalue⟩ :=
+            ih hentry
+          exact ⟨source, value, by simpa using hsource,
+            hslot, hworld, hvalue⟩)
+      (h := h)
+  exact hlookup hentry
+
+/-- Looking up the synthetic self entry recovers the statically related
+source recursor value; it intentionally has no target runtime slot. -/
+theorem EntriesValueGraph.getRecSelf {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    {i arity : Nat}
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots)
+    (hentry : entries[i]? = some (.recSelf arity)) :
+    ∃ source,
+      sourceEnv[i]? = some source ∧ recSelfRel source arity := by
+  have hlookup :
+      ∀ {index : Nat},
+        entries[index]? = some (.recSelf arity) →
+        ∃ source,
+          sourceEnv[index]? = some source ∧ recSelfRel source arity := by
+    exact EntriesValueGraph.traverse
+      (Result := fun current currentSources _ =>
+        ∀ {index : Nat},
+          current[index]? = some (.recSelf arity) →
+          ∃ source,
+            currentSources[index]? = some source ∧ recSelfRel source arity)
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro abs remaining uses tail source sources tailRoots hbound htail ih
+          index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, hsource, hself⟩ := ih hentry
+          exact ⟨source, by simpa using hsource, hself⟩)
+      (hheld := by
+        intro abs remaining uses tail source sources value tailRoots hbound
+          hslot hworld hvalue htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, hsource, hself⟩ := ih hentry
+          exact ⟨source, by simpa using hsource, hself⟩)
+      (hrecSelf := by
+        intro currentArity tail source sources tailRoots hself htail ih
+          index hentry
+        cases index with
+        | zero =>
+          rw [List.getElem?_cons_zero] at hentry
+          have harity : currentArity = arity := by simpa using hentry
+          subst arity
+          exact ⟨source, rfl, hself⟩
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨found, hsource, hfound⟩ := ih hentry
+          exact ⟨found, by simpa using hsource, hfound⟩)
+      (h := h)
+  exact hlookup hentry
+
+theorem VEnvValueGraph.vEnvRealizes {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root}
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots) :
+    VEnvRealizes Γ env roots :=
+  ⟨h.depth_eq, h.entries.entriesRealize⟩
+
+theorem VEnvValueGraph.rootsGraph {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root}
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots) :
+    ∃ sourceRoots : List (Owned × IxIR0.Value),
+      Sim.RootsGraph funRel store sourceRoots roots :=
+  h.entries.rootsGraph
+
+/-- Rebuild the complete semantic environment after an arbitrary callee
+transition, provided the callee preserves the canonical environment frame.
+No global extension/restriction relation between the stores is required. -/
+theorem VEnvValueGraph.ofRootsGraph {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {before after : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root}
+    (h : VEnvValueGraph funRel recSelfRel before Γ sourceEnv env roots)
+    (hroots : Sim.RootsGraph funRel after
+      (entrySourceRoots Γ.entries sourceEnv) roots) :
+    VEnvValueGraph funRel recSelfRel after Γ sourceEnv env roots :=
+  ⟨h.depth_eq, h.entries.ofRootsGraph hroots⟩
+
+theorem VEnvValueGraph.getHeld {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root} {i abs remaining : Nat} {uses : Uses}
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    ∃ source value,
+      sourceEnv[i]? = some source ∧
+      env[Γ.rel abs]? = some value ∧
+      HasWorld store (worldOfUses uses) value ∧
+      Sim.ValueGraph funRel store source value :=
+  h.entries.getHeld hentry
+
+theorem VEnvValueGraph.getRecSelf {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root} {i arity : Nat}
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots)
+    (hentry : Γ.entries[i]? = some (.recSelf arity)) :
+    ∃ source,
+      sourceEnv[i]? = some source ∧ recSelfRel source arity :=
+  h.entries.getRecSelf hentry
+
+/-- Runtime realization of the lowerer's returned value descriptor. -/
+inductive AValRealizes (Γ : VEnv) (env : List RVal) :
+    AVal → RVal → Prop where
+  | slot {abs value} :
+      abs < Γ.depth →
+      env[Γ.rel abs]? = some value →
+      AValRealizes Γ env (.slotA abs) value
+  | const {atom value} :
+      resolveAtom env atom = .ok value →
+      AValRealizes Γ env (.constA atom) value
+
+theorem AValRealizes.resolveAtom {Γ : VEnv} {env : List RVal}
+    {av : AVal} {value : RVal} (h : AValRealizes Γ env av value) :
+    resolveAtom env (av.toAtom Γ) = .ok value := by
+  cases h with
+  | slot _ hslot =>
+    change (match env[Γ.rel _]? with
+      | some found => (Except.ok found : Except Err RVal)
+      | none => Except.error (.stuck s!"unbound variable {Γ.rel _}")) =
+        Except.ok value
+    rw [hslot]
+  | const hconst => simpa [AVal.toAtom] using hconst
+
+/-- Returned descriptors depend on a compile-time environment only through
+its runtime depth. This is the transport used when a released logical binder
+is popped without changing the physical runtime stack. -/
+theorem AValRealizes.of_depth_eq {Γ Δ : VEnv} {env : List RVal}
+    {av : AVal} {value : RVal} (hdepth : Γ.depth = Δ.depth)
+    (h : AValRealizes Γ env av value) :
+    AValRealizes Δ env av value := by
+  cases h with
+  | slot hbound hslot =>
+    apply AValRealizes.slot
+    · simpa [hdepth] using hbound
+    · simpa [VEnv.rel, hdepth] using hslot
+  | const hresolve => exact AValRealizes.const hresolve
+
+/-- Returned `AVal`s are either absolute slots or environment-independent
+scalar atoms. The lowerer never stores a relative variable in `constA`; this
+fact is what lets argument results survive later runtime pushes. -/
+inductive AValStable : AVal → Prop where
+  | slot {abs : Nat} : AValStable (.slotA abs)
+  | lit {literal : IxIR0.Literal} : AValStable (.constA (.lit literal))
+  | erased : AValStable (.constA .erased)
+
+/-- Absolute slots whose values must remain resolvable while a later
+lowering derivation pushes additional runtime results. -/
+def SlotsRealize (Γ : VEnv) (env : List RVal)
+    (slots : List (Nat × RVal)) : Prop :=
+  ∀ abs value, (abs, value) ∈ slots →
+    abs < Γ.depth ∧ env[Γ.rel abs]? = some value
+
+theorem SlotsRealize.nil {Γ : VEnv} {env : List RVal} :
+    SlotsRealize Γ env [] := by
+  simp [SlotsRealize]
+
+theorem SlotsRealize.mono {Γ : VEnv} {env : List RVal}
+    {left right : List (Nat × RVal)} (hsub : ∀ item, item ∈ left → item ∈ right)
+    (h : SlotsRealize Γ env right) : SlotsRealize Γ env left := by
+  intro abs value hmem
+  exact h abs value (hsub _ hmem)
+
+theorem SlotsRealize.append {Γ : VEnv} {env : List RVal}
+    {left right : List (Nat × RVal)}
+    (hleft : SlotsRealize Γ env left)
+    (hright : SlotsRealize Γ env right) :
+    SlotsRealize Γ env (left ++ right) := by
+  intro abs value hmem
+  rcases List.mem_append.mp hmem with hmem | hmem
+  · exact hleft abs value hmem
+  · exact hright abs value hmem
+
+theorem SlotsRealize.left_of_append {Γ : VEnv} {env : List RVal}
+    {left right : List (Nat × RVal)}
+    (h : SlotsRealize Γ env (left ++ right)) : SlotsRealize Γ env left :=
+  h.mono (fun _ hmem => List.mem_append_left right hmem)
+
+theorem SlotsRealize.right_of_append {Γ : VEnv} {env : List RVal}
+    {left right : List (Nat × RVal)}
+    (h : SlotsRealize Γ env (left ++ right)) : SlotsRealize Γ env right :=
+  h.mono (fun _ hmem => List.mem_append_right left hmem)
+
+theorem SlotsRealize.bump {Γ : VEnv} {env : List RVal}
+    {slots : List (Nat × RVal)} (pushed : RVal)
+    (h : SlotsRealize Γ env slots) :
+    SlotsRealize Γ.bump (pushed :: env) slots := by
+  intro abs value hmem
+  obtain ⟨hbound, hslot⟩ := h abs value hmem
+  constructor
+  · simpa [VEnv.bump] using Nat.lt_succ_of_lt hbound
+  · have hrel : Γ.bump.rel abs = Γ.rel abs + 1 := by
+      simp only [VEnv.bump, VEnv.rel]
+      omega
+    rw [hrel]
+    simpa using hslot
+
+theorem SlotsRealize.setEntry {Γ : VEnv} {env : List RVal}
+    {slots : List (Nat × RVal)} {i : Nat} {entry : VEntry}
+    (h : SlotsRealize Γ env slots) :
+    SlotsRealize (Γ.setEntry i entry) env slots := by
+  intro abs value hmem
+  simpa [VEnv.setEntry, VEnv.rel] using h abs value hmem
+
+/-- Protected absolute slots depend only on the runtime depth, not on the
+logical entries tracked alongside it. -/
+theorem SlotsRealize.of_depth_eq {Γ Δ : VEnv} {env : List RVal}
+    {slots : List (Nat × RVal)} (hdepth : Γ.depth = Δ.depth)
+    (h : SlotsRealize Γ env slots) : SlotsRealize Δ env slots := by
+  intro abs value hmem
+  simpa [VEnv.rel, hdepth] using h abs value hmem
+
+/-- The one absolute slot needed to preserve a returned slot value; stable
+constants need no protected runtime position. -/
+def aValProtection : AVal → RVal → List (Nat × RVal)
+  | .slotA abs, value => [(abs, value)]
+  | .constA _, _ => []
+
+theorem AValStable.protection_realized {Γ : VEnv} {env : List RVal}
+    {av : AVal} {value : RVal} (stable : AValStable av)
+    (h : AValRealizes Γ env av value) :
+    SlotsRealize Γ env (aValProtection av value) := by
+  cases stable with
+  | slot =>
+    cases h with
+    | slot hbound hslot =>
+      intro abs found hmem
+      simp only [aValProtection, List.mem_singleton, Prod.mk.injEq] at hmem
+      obtain ⟨rfl, rfl⟩ := hmem
+      exact ⟨hbound, hslot⟩
+  | lit => exact SlotsRealize.nil
+  | erased => exact SlotsRealize.nil
+
+theorem AValStable.realize_of_protection {Γ Δ : VEnv}
+    {env env' : List RVal} {av : AVal} {value : RVal}
+    (stable : AValStable av) (h : AValRealizes Γ env av value)
+    (hslots : SlotsRealize Δ env' (aValProtection av value)) :
+    AValRealizes Δ env' av value := by
+  cases stable with
+  | @slot abs =>
+    cases h with
+    | slot _ _ =>
+      obtain ⟨hbound, hslot⟩ :=
+        hslots abs value (by simp [aValProtection])
+      exact .slot hbound hslot
+  | lit =>
+    cases h with
+    | const hresolve =>
+      simp only [resolveAtom, Except.ok.injEq] at hresolve
+      subst value
+      exact .const rfl
+  | erased =>
+    cases h with
+    | const hresolve =>
+      simp only [resolveAtom, Except.ok.injEq] at hresolve
+      subst value
+      exact .const rfl
+
+/-- Stable descriptors remain realized after an unrelated runtime push. -/
+theorem AValStable.realize_bump {Γ : VEnv} {env : List RVal}
+    {av : AVal} {value : RVal} (stable : AValStable av)
+    (h : AValRealizes Γ env av value) (pushed : RVal) :
+    AValRealizes Γ.bump (pushed :: env) av value := by
+  exact stable.realize_of_protection h
+    ((stable.protection_realized h).bump pushed)
+
+/-- A stable constant descriptor can realize only an ownership-inert scalar.
+This excludes the unstable `.constA (.var _)` shape by construction. -/
+theorem AValStable.const_noLocation {Γ : VEnv} {env : List RVal}
+    {atom : Atom} {value : RVal}
+    (stable : AValStable (.constA atom))
+    (h : AValRealizes Γ env (.constA atom) value) :
+    rvalLocation? value = none := by
+  cases stable with
+  | lit =>
+    cases h with
+    | const hresolve =>
+      simp only [resolveAtom, Except.ok.injEq] at hresolve
+      subst value
+      rfl
+  | erased =>
+    cases h with
+    | const hresolve =>
+      simp only [resolveAtom, Except.ok.injEq] at hresolve
+      subst value
+      rfl
+
+theorem VEnv.rel_bump {Γ : VEnv} {abs : Nat} (habs : abs < Γ.depth) :
+    Γ.bump.rel abs = Γ.rel abs + 1 := by
+  simp only [VEnv.bump, VEnv.rel]
+  omega
+
+/-- Pushing one runtime result preserves realization of every older absolute
+slot. The explicit slot bound is what rules out a malformed absolute address
+from aliasing the newly pushed head. -/
+theorem EntriesRealize.bump {Γ : VEnv} {env : List RVal}
+    {entries : List VEntry} {roots : List Root} (value : RVal)
+    (h : EntriesRealize Γ env entries roots) :
+    EntriesRealize Γ.bump (value :: env) entries roots := by
+  apply EntriesRealize.traverse
+    (Result := fun current currentRoots =>
+      EntriesRealize Γ.bump (value :: env) current currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail tailRoots habs htail ih
+    apply EntriesRealize.released
+    · simpa [VEnv.bump] using Nat.lt_succ_of_lt habs
+    · exact ih
+  · intro abs remaining uses tail tailRoots currentValue habs hslot htail ih
+    apply EntriesRealize.held
+    · simpa [VEnv.bump] using Nat.lt_succ_of_lt habs
+    · rw [VEnv.rel_bump habs]
+      simpa using hslot
+    · exact ih
+  · intro arity tail tailRoots htail ih
+    exact .recSelf ih
+
+theorem VEnvRealizes.bump {Γ : VEnv} {env : List RVal}
+    {roots : List Root} (value : RVal) (h : VEnvRealizes Γ env roots) :
+    VEnvRealizes Γ.bump (value :: env) roots := by
+  constructor
+  · simpa [VEnv.bump] using h.depth_eq
+  · exact h.entries.bump value
+
+/-- A runtime push preserves the companion source graph for all older
+logical entries. The source evaluator environment is unchanged. -/
+theorem EntriesValueGraph.bump {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (value : RVal)
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    EntriesValueGraph funRel recSelfRel store Γ.bump (value :: env)
+      entries sourceEnv roots := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources currentRoots =>
+      EntriesValueGraph funRel recSelfRel store Γ.bump (value :: env)
+        current currentSources currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+    apply EntriesValueGraph.released
+    · simpa [VEnv.bump] using Nat.lt_succ_of_lt hbound
+    · exact ih
+  · intro abs remaining uses tail source sources currentValue tailRoots
+      hbound hslot hworld hvalue htail ih
+    apply EntriesValueGraph.held
+    · simpa [VEnv.bump] using Nat.lt_succ_of_lt hbound
+    · rw [VEnv.rel_bump hbound]
+      simpa using hslot
+    · exact hworld
+    · exact hvalue
+    · exact ih
+  · intro arity tail source sources tailRoots hself htail ih
+    exact .recSelf hself ih
+
+theorem VEnvValueGraph.bump {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root} (value : RVal)
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots) :
+    VEnvValueGraph funRel recSelfRel store Γ.bump sourceEnv
+      (value :: env) roots := by
+  constructor
+  · simpa [VEnv.bump] using h.depth_eq
+  · exact h.entries.bump value
+
+/-- The semantic entry graph, like `EntriesRealize`, observes the enclosing
+`VEnv` only through its physical depth. -/
+theorem EntriesValueGraph.of_depth_eq {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ Δ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (hdepth : Γ.depth = Δ.depth)
+    (h : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots) :
+    EntriesValueGraph funRel recSelfRel store Δ env
+      entries sourceEnv roots := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources currentRoots =>
+      EntriesValueGraph funRel recSelfRel store Δ env
+        current currentSources currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+    apply EntriesValueGraph.released
+    · simpa [hdepth] using hbound
+    · exact ih
+  · intro abs remaining uses tail source sources value tailRoots hbound
+      hslot hworld hvalue htail ih
+    apply EntriesValueGraph.held
+    · simpa [hdepth] using hbound
+    · simpa [VEnv.rel, hdepth] using hslot
+    · exact hworld
+    · exact hvalue
+    · exact ih
+  · intro arity tail source sources tailRoots hself htail ih
+    exact .recSelf hself ih
+
+/-- Transport the source-environment graph through a store update that keeps
+all existing live node shapes. Runtime slots and logical roots are unchanged. -/
+theorem EntriesValueGraph.monoStore {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {before after : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    (hstore : Sim.StoreGraphExtends before after)
+    (h : EntriesValueGraph funRel recSelfRel before Γ env
+      entries sourceEnv roots) :
+    EntriesValueGraph funRel recSelfRel after Γ env
+      entries sourceEnv roots := by
+  apply EntriesValueGraph.traverse
+    (Result := fun current currentSources currentRoots =>
+      EntriesValueGraph funRel recSelfRel after Γ env
+        current currentSources currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail source sources tailRoots hbound htail ih
+    exact .released hbound ih
+  · intro abs remaining uses tail source sources value tailRoots hbound
+      hslot hworld hvalue htail ih
+    exact .held hbound hslot (hworld.monoStore hstore)
+      (hvalue.monoStore hstore) ih
+  · intro arity tail source sources tailRoots hself htail ih
+    exact .recSelf hself ih
+
+theorem VEnvValueGraph.monoStore {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {before after : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root}
+    (hstore : Sim.StoreGraphExtends before after)
+    (h : VEnvValueGraph funRel recSelfRel before Γ sourceEnv env roots) :
+    VEnvValueGraph funRel recSelfRel after Γ sourceEnv env roots :=
+  ⟨h.depth_eq, h.entries.monoStore hstore⟩
+
+/-- Destructive store restriction preserves every held environment graph
+whose logical root survives in the post-state ownership set. -/
+theorem EntriesValueGraph.ofRestricts {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {before after : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots allRoots : List Root}
+    (hstore : Sim.StoreGraphRestricts before after)
+    (hown : RootOwnership after allRoots)
+    (hsubset : ∀ root, root ∈ roots → root ∈ allRoots)
+    (h : EntriesValueGraph funRel recSelfRel before Γ env
+      entries sourceEnv roots) :
+    EntriesValueGraph funRel recSelfRel after Γ env
+      entries sourceEnv roots := by
+  have hrestrict :
+      (∀ root, root ∈ roots → root ∈ allRoots) →
+      EntriesValueGraph funRel recSelfRel after Γ env
+        entries sourceEnv roots := by
+    exact EntriesValueGraph.traverse
+      (Result := fun current currentSources currentRoots =>
+        (∀ root, root ∈ currentRoots → root ∈ allRoots) →
+        EntriesValueGraph funRel recSelfRel after Γ env
+          current currentSources currentRoots)
+      (hnil := by
+        intro hsubset
+        exact .nil)
+      (hreleased := by
+        intro abs remaining uses tail source sources tailRoots hbound htail ih
+          hsubset
+        exact .released hbound (ih hsubset))
+      (hheld := by
+        intro abs remaining uses tail source sources value tailRoots hbound
+          hslot hworld hvalue htail ih hsubset
+        have hrootLive : HasWorld after (worldOfUses uses) value := by
+          apply hown.roots_world ⟨worldOfUses uses, value⟩
+          exact hsubset _ (by simp)
+        apply EntriesValueGraph.held hbound hslot hrootLive
+        · exact hvalue.ofRestricts hstore hown hrootLive
+        · exact ih (fun root hmember =>
+            hsubset root (by simp [hmember])))
+      (hrecSelf := by
+        intro arity tail source sources tailRoots hself htail ih hsubset
+        exact .recSelf hself (ih hsubset))
+      (h := h)
+  exact hrestrict hsubset
+
+theorem VEnvValueGraph.ofRestricts {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {before after : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots allRoots : List Root}
+    (hstore : Sim.StoreGraphRestricts before after)
+    (hown : RootOwnership after allRoots)
+    (hsubset : ∀ root, root ∈ roots → root ∈ allRoots)
+    (h : VEnvValueGraph funRel recSelfRel before Γ sourceEnv env roots) :
+    VEnvValueGraph funRel recSelfRel after Γ sourceEnv env roots :=
+  ⟨h.depth_eq, h.entries.ofRestricts hstore hown hsubset⟩
+
+/-- Rebuild the enclosing semantic environment after changing one logical
+entry while leaving the runtime stack and source environment fixed. -/
+theorem VEnvValueGraph.setEntry {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots roots' : List Root} {i : Nat} {entry : VEntry}
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots)
+    (hentries : EntriesValueGraph funRel recSelfRel store Γ env
+      (Γ.entries.set i entry) sourceEnv roots') :
+    VEnvValueGraph funRel recSelfRel store (Γ.setEntry i entry)
+      sourceEnv env roots' := by
+  constructor
+  · simpa [VEnv.setEntry] using h.depth_eq
+  · exact hentries.of_depth_eq (by simp [VEnv.setEntry])
+
+/-- Increase only the physical runtime depth of a compile-time environment. -/
+def addVEnvDepth (Γ : VEnv) (count : Nat) : VEnv :=
+  { Γ with depth := Γ.depth + count }
+
+/-- Repeated runtime pushes preserve all existing logical entries and roots. -/
+theorem VEnvRealizes.bumpList {Γ : VEnv} {env : List RVal}
+    {roots : List Root} (values : List RVal)
+    (h : VEnvRealizes Γ env roots) :
+    VEnvRealizes (addVEnvDepth Γ values.length)
+      (values.reverse ++ env) roots := by
+  induction values generalizing Γ env with
+  | nil => simpa [addVEnvDepth] using h
+  | cons value values ih =>
+    have htail := ih (h.bump value)
+    simpa [addVEnvDepth, VEnv.bump, List.reverse_cons,
+      List.append_assoc, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm] using htail
+
+/-- Repeated runtime pushes preserve the complete source-environment graph.
+The pushed values are physical case bindings and do not become logical
+source entries until the recursor prefix explicitly retains them. -/
+theorem VEnvValueGraph.bumpList {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root} (values : List RVal)
+    (h : VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots) :
+    VEnvValueGraph funRel recSelfRel store
+      (addVEnvDepth Γ values.length) sourceEnv
+      (values.reverse ++ env) roots := by
+  induction values generalizing Γ env with
+  | nil => simpa [addVEnvDepth] using h
+  | cons value values ih =>
+    have htail := ih (h.bump value)
+    simpa [addVEnvDepth, VEnv.bump, List.reverse_cons,
+      List.append_assoc, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm] using htail
+
+/-- A block of released placeholder slots contributes no logical roots. -/
+theorem EntriesRealize.replicateReleased {Γ : VEnv} {env : List RVal}
+    (count : Nat) (hbound : 0 < Γ.depth) :
+    EntriesRealize Γ env
+      (List.replicate count (.slot 0 0 .many false)) [] := by
+  induction count with
+  | zero => exact EntriesRealize.nil
+  | succ count ih =>
+    simpa [List.replicate_succ] using
+      EntriesRealize.released hbound ih
+
+/-- A released placeholder block retains the corresponding pure source-list
+shape while contributing no semantic roots. -/
+theorem EntriesValueGraph.replicateReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {store : Store} {Γ : VEnv} {env : List RVal}
+    {sources : List IxIR0.Value} {count : Nat}
+    (hlength : sources.length = count) (hbound : 0 < Γ.depth) :
+    EntriesValueGraph funRel recSelfRel store Γ env
+      (List.replicate count (.slot 0 0 .many false)) sources [] := by
+  induction count generalizing sources with
+  | zero =>
+    have hsources : sources = [] :=
+      List.eq_nil_of_length_eq_zero hlength
+    subst sources
+    exact EntriesValueGraph.nil
+  | succ count ih =>
+    cases sources with
+    | nil => simp at hlength
+    | cons source sources =>
+      have htail : sources.length = count := by simpa using hlength
+      simpa [List.replicate_succ] using
+        EntriesValueGraph.released hbound (ih htail)
+
+/-- `EntriesRealize` observes only a `VEnv`'s depth (through `rel`), so it
+transports between compile-time environments with the same runtime depth. -/
+theorem EntriesRealize.of_depth_eq {Γ Δ : VEnv} {env : List RVal}
+    {entries : List VEntry} {roots : List Root} (hdepth : Γ.depth = Δ.depth)
+    (h : EntriesRealize Γ env entries roots) :
+    EntriesRealize Δ env entries roots := by
+  apply EntriesRealize.traverse
+    (Result := fun current currentRoots =>
+      EntriesRealize Δ env current currentRoots)
+    (h := h)
+  · exact .nil
+  · intro abs remaining uses tail tailRoots habs htail ih
+    apply EntriesRealize.released
+    · simpa [hdepth] using habs
+    · exact ih
+  · intro abs remaining uses tail tailRoots value habs hslot htail ih
+    apply EntriesRealize.held
+    · simpa [hdepth] using habs
+    · simpa [VEnv.rel, hdepth] using hslot
+    · exact ih
+  · intro arity tail tailRoots htail ih
+    exact .recSelf ih
+
+/-- Rebuild a realized `VEnv` after changing one source-entry descriptor.
+The caller supplies the corresponding entry-list realization. -/
+theorem VEnvRealizes.setEntry {Γ : VEnv} {env : List RVal}
+    {roots roots' : List Root} {i : Nat} {entry : VEntry}
+    (h : VEnvRealizes Γ env roots)
+    (hentries : EntriesRealize Γ env (Γ.entries.set i entry) roots') :
+    VEnvRealizes (Γ.setEntry i entry) env roots' := by
+  constructor
+  · simpa [VEnv.setEntry] using h.depth_eq
+  · exact hentries.of_depth_eq (by simp [VEnv.setEntry])
+
+/-- Locate a held entry in its exact logical-root list and release it. This
+is the proof-relevant state transition for a variable's final (moving) use. -/
+theorem EntriesRealize.releaseAt {Γ : VEnv} {env : List RVal}
+    {entries : List VEntry} {roots : List Root} {i abs remaining : Nat}
+    {uses : Uses} (hreal : EntriesRealize Γ env entries roots)
+    (hentry : entries[i]? = some (.slot abs remaining uses true)) :
+    ∃ value before after,
+      abs < Γ.depth ∧
+      env[Γ.rel abs]? = some value ∧
+      roots = before ++ ⟨worldOfUses uses, value⟩ :: after ∧
+      EntriesRealize Γ env
+        (entries.set i (.slot abs 0 uses false)) (before ++ after) := by
+  have hrelease :
+      ∀ {index : Nat},
+        entries[index]? = some (.slot abs remaining uses true) →
+        ∃ value before after,
+          abs < Γ.depth ∧
+          env[Γ.rel abs]? = some value ∧
+          roots = before ++ ⟨worldOfUses uses, value⟩ :: after ∧
+          EntriesRealize Γ env
+            (entries.set index (.slot abs 0 uses false))
+            (before ++ after) := by
+    exact EntriesRealize.traverse
+      (Result := fun current currentRoots =>
+        ∀ {index : Nat},
+          current[index]? = some (.slot abs remaining uses true) →
+          ∃ value before after,
+            abs < Γ.depth ∧
+            env[Γ.rel abs]? = some value ∧
+            currentRoots =
+              before ++ ⟨worldOfUses uses, value⟩ :: after ∧
+            EntriesRealize Γ env
+              (current.set index (.slot abs 0 uses false))
+              (before ++ after))
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail tailRoots habs htail ih
+          index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨value, before, after, hbound, hslot, hroots, hout⟩ :=
+            ih hentry
+          refine ⟨value, before, after, hbound, hslot, hroots, ?_⟩
+          simpa using EntriesRealize.released habs hout)
+      (hheld := by
+        intro curAbs curRemaining curUses tail tailRoots current
+          habs hslot htail ih index hentry
+        cases index with
+        | zero =>
+          rw [List.getElem?_cons_zero] at hentry
+          have heqs : curAbs = abs ∧ curRemaining = remaining ∧
+              curUses = uses := by simpa using hentry
+          obtain ⟨rfl, rfl, rfl⟩ := heqs
+          refine ⟨current, [], tailRoots, habs, hslot, rfl, ?_⟩
+          simpa using EntriesRealize.released habs htail
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨value, before, after, hbound, hselected, hroots, hout⟩ :=
+            ih hentry
+          refine ⟨value, ⟨worldOfUses curUses, current⟩ :: before, after,
+            hbound, hselected, ?_, ?_⟩
+          · simp [hroots]
+          · simpa using EntriesRealize.held habs hslot hout)
+      (hrecSelf := by
+        intro arity tail tailRoots htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨value, before, after, hbound, hslot, hroots, hout⟩ :=
+            ih hentry
+          refine ⟨value, before, after, hbound, hslot, hroots, ?_⟩
+          simpa using EntriesRealize.recSelf hout)
+      (h := hreal)
+  exact hrelease hentry
+
+/-- Semantic counterpart of `EntriesRealize.releaseAt`. Besides transferring
+the exact target root, it preserves the full source environment and exposes
+the `ValueGraph` witness for the moved result. -/
+theorem EntriesValueGraph.releaseAt {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    {i abs remaining : Nat} {uses : Uses}
+    (hreal : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots)
+    (hentry : entries[i]? = some (.slot abs remaining uses true)) :
+    ∃ source value before after,
+      sourceEnv[i]? = some source ∧
+      abs < Γ.depth ∧
+      env[Γ.rel abs]? = some value ∧
+      HasWorld store (worldOfUses uses) value ∧
+      Sim.ValueGraph funRel store source value ∧
+      roots = before ++ ⟨worldOfUses uses, value⟩ :: after ∧
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (entries.set i (.slot abs 0 uses false)) sourceEnv
+        (before ++ after) := by
+  have hrelease :
+      ∀ {index : Nat},
+        entries[index]? = some (.slot abs remaining uses true) →
+        ∃ source value before after,
+          sourceEnv[index]? = some source ∧
+          abs < Γ.depth ∧
+          env[Γ.rel abs]? = some value ∧
+          HasWorld store (worldOfUses uses) value ∧
+          Sim.ValueGraph funRel store source value ∧
+          roots = before ++ ⟨worldOfUses uses, value⟩ :: after ∧
+          EntriesValueGraph funRel recSelfRel store Γ env
+            (entries.set index (.slot abs 0 uses false)) sourceEnv
+            (before ++ after) := by
+    exact EntriesValueGraph.traverse
+      (Result := fun current currentSources currentRoots =>
+        ∀ {index : Nat},
+          current[index]? = some (.slot abs remaining uses true) →
+          ∃ source value before after,
+            currentSources[index]? = some source ∧
+            abs < Γ.depth ∧
+            env[Γ.rel abs]? = some value ∧
+            HasWorld store (worldOfUses uses) value ∧
+            Sim.ValueGraph funRel store source value ∧
+            currentRoots =
+              before ++ ⟨worldOfUses uses, value⟩ :: after ∧
+            EntriesValueGraph funRel recSelfRel store Γ env
+              (current.set index (.slot abs 0 uses false)) currentSources
+              (before ++ after))
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail currentSource sources
+          tailRoots hbound htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, before, after, hsource, habs, hslot,
+              hworld, hvalue, hroots, hout⟩ := ih hentry
+          refine ⟨source, value, before, after, by simpa using hsource,
+            habs, hslot, hworld, hvalue, hroots, ?_⟩
+          simpa using EntriesValueGraph.released hbound hout)
+      (hheld := by
+        intro curAbs curRemaining curUses tail currentSource sources
+          currentValue tailRoots hbound hslot hworld hvalue htail ih
+          index hentry
+        cases index with
+        | zero =>
+          rw [List.getElem?_cons_zero] at hentry
+          have heqs : curAbs = abs ∧ curRemaining = remaining ∧
+              curUses = uses := by simpa using hentry
+          obtain ⟨rfl, rfl, rfl⟩ := heqs
+          exact ⟨currentSource, currentValue, [], tailRoots, rfl,
+            hbound, hslot, hworld, hvalue, rfl,
+            by simpa using EntriesValueGraph.released hbound htail⟩
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, before, after, hsource, habs,
+              hselected, hfoundWorld, hfoundValue, hroots, hout⟩ :=
+            ih hentry
+          refine ⟨source, value,
+            ⟨worldOfUses curUses, currentValue⟩ :: before, after,
+            by simpa using hsource, habs, hselected, hfoundWorld,
+            hfoundValue, ?_, ?_⟩
+          · simp [hroots]
+          · simpa using
+              EntriesValueGraph.held hbound hslot hworld hvalue hout)
+      (hrecSelf := by
+        intro arity tail currentSource sources tailRoots hself htail ih
+          index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, before, after, hsource, habs, hslot,
+              hworld, hvalue, hroots, hout⟩ := ih hentry
+          refine ⟨source, value, before, after, by simpa using hsource,
+            habs, hslot, hworld, hvalue, hroots, ?_⟩
+          simpa using EntriesValueGraph.recSelf hself hout)
+      (h := hreal)
+  exact hrelease hentry
+
+/-- Activate a released entry at a newly available absolute slot. The new
+owner is inserted at the entry's structural position in the exact root list;
+this is the proof-side transition for retaining a borrowed case field. -/
+theorem EntriesRealize.holdAt {Γ : VEnv} {env : List RVal}
+    {entries : List VEntry} {roots : List Root}
+    {i oldAbs oldRemaining newAbs newRemaining : Nat} {uses : Uses}
+    {value : RVal}
+    (hreal : EntriesRealize Γ env entries roots)
+    (hentry : entries[i]? =
+      some (.slot oldAbs oldRemaining uses false))
+    (hbound : newAbs < Γ.depth)
+    (hslot : env[Γ.rel newAbs]? = some value) :
+    ∃ before after,
+      roots = before ++ after ∧
+      EntriesRealize Γ env
+        (entries.set i (.slot newAbs newRemaining uses true))
+        (before ++ ⟨worldOfUses uses, value⟩ :: after) := by
+  have hhold :
+      ∀ {index : Nat},
+        entries[index]? =
+          some (.slot oldAbs oldRemaining uses false) →
+        ∃ before after,
+          roots = before ++ after ∧
+          EntriesRealize Γ env
+            (entries.set index (.slot newAbs newRemaining uses true))
+            (before ++ ⟨worldOfUses uses, value⟩ :: after) := by
+    exact EntriesRealize.traverse
+      (Result := fun current currentRoots =>
+        ∀ {index : Nat},
+          current[index]? =
+            some (.slot oldAbs oldRemaining uses false) →
+          ∃ before after,
+            currentRoots = before ++ after ∧
+            EntriesRealize Γ env
+              (current.set index (.slot newAbs newRemaining uses true))
+              (before ++ ⟨worldOfUses uses, value⟩ :: after))
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail tailRoots habs htail ih
+          index hentry
+        cases index with
+        | zero =>
+          refine ⟨[], tailRoots, rfl, ?_⟩
+          simpa using EntriesRealize.held hbound hslot htail
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨before, after, hroots, hout⟩ := ih hentry
+          refine ⟨before, after, hroots, ?_⟩
+          simpa using EntriesRealize.released habs hout)
+      (hheld := by
+        intro curAbs curRemaining curUses tail tailRoots current
+          habs hcurrent htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨before, after, hroots, hout⟩ := ih hentry
+          refine ⟨⟨worldOfUses curUses, current⟩ :: before, after, ?_, ?_⟩
+          · simp [hroots]
+          · simpa using EntriesRealize.held habs hcurrent hout)
+      (hrecSelf := by
+        intro arity tail tailRoots htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨before, after, hroots, hout⟩ := ih hentry
+          refine ⟨before, after, hroots, ?_⟩
+          simpa using EntriesRealize.recSelf hout)
+      (h := hreal)
+  exact hhold hentry
+
+/-- Semantic counterpart of `EntriesRealize.holdAt`. Activating a released
+entry records the source value realized by the newly retained runtime owner
+at the entry's exact structural root position. -/
+theorem EntriesValueGraph.holdAt {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    {i oldAbs oldRemaining newAbs newRemaining : Nat} {uses : Uses}
+    {source : IxIR0.Value} {value : RVal}
+    (hreal : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots)
+    (hentry : entries[i]? =
+      some (.slot oldAbs oldRemaining uses false))
+    (hsource : sourceEnv[i]? = some source)
+    (hbound : newAbs < Γ.depth)
+    (hslot : env[Γ.rel newAbs]? = some value)
+    (hworld : HasWorld store (worldOfUses uses) value)
+    (hvalue : Sim.ValueGraph funRel store source value) :
+    ∃ before after,
+      roots = before ++ after ∧
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (entries.set i (.slot newAbs newRemaining uses true))
+        sourceEnv
+        (before ++ ⟨worldOfUses uses, value⟩ :: after) := by
+  have hhold :
+      ∀ {index : Nat},
+        entries[index]? =
+          some (.slot oldAbs oldRemaining uses false) →
+        sourceEnv[index]? = some source →
+        ∃ before after,
+          roots = before ++ after ∧
+          EntriesValueGraph funRel recSelfRel store Γ env
+            (entries.set index (.slot newAbs newRemaining uses true))
+            sourceEnv
+            (before ++ ⟨worldOfUses uses, value⟩ :: after) := by
+    exact EntriesValueGraph.traverse
+      (Result := fun current currentSources currentRoots =>
+        ∀ {index : Nat},
+          current[index]? =
+            some (.slot oldAbs oldRemaining uses false) →
+          currentSources[index]? = some source →
+          ∃ before after,
+            currentRoots = before ++ after ∧
+            EntriesValueGraph funRel recSelfRel store Γ env
+              (current.set index (.slot newAbs newRemaining uses true))
+              currentSources
+              (before ++ ⟨worldOfUses uses, value⟩ :: after))
+      (hnil := by
+        intro index hentry hsource
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail currentSource sources
+          tailRoots hcurBound htail ih index hentry hsource
+        cases index with
+        | zero =>
+          simp only [List.getElem?_cons_zero, Option.some.injEq] at hsource
+          subst currentSource
+          refine ⟨[], tailRoots, rfl, ?_⟩
+          simpa using
+            EntriesValueGraph.held hbound hslot hworld hvalue htail
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry hsource
+          obtain ⟨before, after, hroots, hout⟩ := ih hentry hsource
+          refine ⟨before, after, hroots, ?_⟩
+          simpa using EntriesValueGraph.released hcurBound hout)
+      (hheld := by
+        intro curAbs curRemaining curUses tail currentSource sources
+          currentValue tailRoots hcurBound hcurSlot hcurWorld hcurValue
+          htail ih index hentry hsource
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry hsource
+          obtain ⟨before, after, hroots, hout⟩ := ih hentry hsource
+          refine ⟨⟨worldOfUses curUses, currentValue⟩ :: before,
+            after, ?_, ?_⟩
+          · simp [hroots]
+          · simpa using EntriesValueGraph.held hcurBound hcurSlot
+              hcurWorld hcurValue hout)
+      (hrecSelf := by
+        intro arity tail currentSource sources tailRoots hself htail ih
+          index hentry hsource
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry hsource
+          obtain ⟨before, after, hroots, hout⟩ := ih hentry hsource
+          refine ⟨before, after, hroots, ?_⟩
+          simpa using EntriesValueGraph.recSelf hself hout)
+      (h := hreal)
+  exact hhold hentry hsource
+
+/-- Update the remaining-use counter of a held entry without changing its
+existing root. The selected value and its root membership are exposed for
+the following shared retain operation. -/
+theorem EntriesRealize.updateHeldAt {Γ : VEnv} {env : List RVal}
+    {entries : List VEntry} {roots : List Root} {i abs remaining : Nat}
+    {uses : Uses} (newRemaining : Nat)
+    (hreal : EntriesRealize Γ env entries roots)
+    (hentry : entries[i]? = some (.slot abs remaining uses true)) :
+    ∃ value,
+      abs < Γ.depth ∧
+      env[Γ.rel abs]? = some value ∧
+      ⟨worldOfUses uses, value⟩ ∈ roots ∧
+      EntriesRealize Γ env
+        (entries.set i (.slot abs newRemaining uses true)) roots := by
+  have hupdate :
+      ∀ {index : Nat},
+        entries[index]? = some (.slot abs remaining uses true) →
+        ∃ value,
+          abs < Γ.depth ∧
+          env[Γ.rel abs]? = some value ∧
+          ⟨worldOfUses uses, value⟩ ∈ roots ∧
+          EntriesRealize Γ env
+            (entries.set index (.slot abs newRemaining uses true))
+            roots := by
+    exact EntriesRealize.traverse
+      (Result := fun current currentRoots =>
+        ∀ {index : Nat},
+          current[index]? = some (.slot abs remaining uses true) →
+          ∃ value,
+            abs < Γ.depth ∧
+            env[Γ.rel abs]? = some value ∧
+            ⟨worldOfUses uses, value⟩ ∈ currentRoots ∧
+            EntriesRealize Γ env
+              (current.set index (.slot abs newRemaining uses true))
+              currentRoots)
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail tailRoots habs htail ih
+          index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨value, hbound, hslot, hmem, hout⟩ := ih hentry
+          refine ⟨value, hbound, hslot, hmem, ?_⟩
+          simpa using EntriesRealize.released habs hout)
+      (hheld := by
+        intro curAbs curRemaining curUses tail tailRoots current
+          habs hslot htail ih index hentry
+        cases index with
+        | zero =>
+          rw [List.getElem?_cons_zero] at hentry
+          have heqs : curAbs = abs ∧ curRemaining = remaining ∧
+              curUses = uses := by simpa using hentry
+          obtain ⟨rfl, rfl, rfl⟩ := heqs
+          refine ⟨current, habs, hslot, by simp, ?_⟩
+          simpa using EntriesRealize.held habs hslot htail
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨value, hbound, hselected, hmem, hout⟩ := ih hentry
+          refine ⟨value, hbound, hselected,
+            List.mem_cons_of_mem _ hmem, ?_⟩
+          simpa using EntriesRealize.held habs hslot hout)
+      (hrecSelf := by
+        intro arity tail tailRoots htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨value, hbound, hslot, hmem, hout⟩ := ih hentry
+          refine ⟨value, hbound, hslot, hmem, ?_⟩
+          simpa using EntriesRealize.recSelf hout)
+      (h := hreal)
+  exact hupdate hentry
+
+/-- Semantic held-entry update. The target root stays in place while the
+compiler-side use counter changes, and the selected source/value graph is
+exposed for a following retain. -/
+theorem EntriesValueGraph.updateHeldAt {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {store : Store} {Γ : VEnv}
+    {env : List RVal} {entries : List VEntry}
+    {sourceEnv : List IxIR0.Value} {roots : List Root}
+    {i abs remaining : Nat} {uses : Uses} (newRemaining : Nat)
+    (hreal : EntriesValueGraph funRel recSelfRel store Γ env
+      entries sourceEnv roots)
+    (hentry : entries[i]? = some (.slot abs remaining uses true)) :
+    ∃ source value,
+      sourceEnv[i]? = some source ∧
+      abs < Γ.depth ∧
+      env[Γ.rel abs]? = some value ∧
+      HasWorld store (worldOfUses uses) value ∧
+      Sim.ValueGraph funRel store source value ∧
+      ⟨worldOfUses uses, value⟩ ∈ roots ∧
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (entries.set i (.slot abs newRemaining uses true))
+        sourceEnv roots := by
+  have hupdate :
+      ∀ {index : Nat},
+        entries[index]? = some (.slot abs remaining uses true) →
+        ∃ source value,
+          sourceEnv[index]? = some source ∧
+          abs < Γ.depth ∧
+          env[Γ.rel abs]? = some value ∧
+          HasWorld store (worldOfUses uses) value ∧
+          Sim.ValueGraph funRel store source value ∧
+          ⟨worldOfUses uses, value⟩ ∈ roots ∧
+          EntriesValueGraph funRel recSelfRel store Γ env
+            (entries.set index (.slot abs newRemaining uses true))
+            sourceEnv roots := by
+    exact EntriesValueGraph.traverse
+      (Result := fun current currentSources currentRoots =>
+        ∀ {index : Nat},
+          current[index]? = some (.slot abs remaining uses true) →
+          ∃ source value,
+            currentSources[index]? = some source ∧
+            abs < Γ.depth ∧
+            env[Γ.rel abs]? = some value ∧
+            HasWorld store (worldOfUses uses) value ∧
+            Sim.ValueGraph funRel store source value ∧
+            ⟨worldOfUses uses, value⟩ ∈ currentRoots ∧
+            EntriesValueGraph funRel recSelfRel store Γ env
+              (current.set index (.slot abs newRemaining uses true))
+              currentSources currentRoots)
+      (hnil := by
+        intro index hentry
+        simp at hentry)
+      (hreleased := by
+        intro curAbs curRemaining curUses tail currentSource sources
+          tailRoots hbound htail ih index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, hsource, habs, hslot, hworld, hvalue,
+              hmem, hout⟩ := ih hentry
+          refine ⟨source, value, by simpa using hsource, habs, hslot,
+            hworld, hvalue, hmem, ?_⟩
+          simpa using EntriesValueGraph.released hbound hout)
+      (hheld := by
+        intro curAbs curRemaining curUses tail currentSource sources
+          currentValue tailRoots hbound hslot hworld hvalue htail ih
+          index hentry
+        cases index with
+        | zero =>
+          rw [List.getElem?_cons_zero] at hentry
+          have heqs : curAbs = abs ∧ curRemaining = remaining ∧
+              curUses = uses := by simpa using hentry
+          obtain ⟨rfl, rfl, rfl⟩ := heqs
+          exact ⟨currentSource, currentValue, rfl, hbound, hslot,
+            hworld, hvalue, by simp,
+            (by
+              simpa using
+                (EntriesValueGraph.held hbound hslot hworld hvalue htail))⟩
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, hsource, habs, hselected, hfoundWorld,
+              hfoundValue, hmem, hout⟩ := ih hentry
+          refine ⟨source, value, by simpa using hsource, habs, hselected,
+            hfoundWorld, hfoundValue, List.mem_cons_of_mem _ hmem, ?_⟩
+          simpa using
+            EntriesValueGraph.held hbound hslot hworld hvalue hout)
+      (hrecSelf := by
+        intro arity tail currentSource sources tailRoots hself htail ih
+          index hentry
+        cases index with
+        | zero => simp at hentry
+        | succ index =>
+          rw [List.getElem?_cons_succ] at hentry
+          obtain ⟨source, value, hsource, habs, hslot, hworld, hvalue,
+              hmem, hout⟩ := ih hentry
+          refine ⟨source, value, by simpa using hsource, habs, hslot,
+            hworld, hvalue, hmem, ?_⟩
+          simpa using EntriesValueGraph.recSelf hself hout)
+      (h := hreal)
+  exact hupdate hentry
+
+private theorem perm_extract_root (root : Root) (before after rest : List Root) :
+    ((before ++ root :: after) ++ rest).Perm
+      (root :: (before ++ after) ++ rest) := by
+  induction before with
+  | nil => rfl
+  | cons head before ih =>
+    simp only [List.cons_append]
+    exact (ih.cons head).trans (List.Perm.swap root head _)
+
+private theorem perm_extract_root_front
+    (root : Root) (before rest : List Root) :
+    (before ++ root :: rest).Perm (root :: before ++ rest) := by
+  induction before with
+  | nil => rfl
+  | cons head before ih =>
+    simp only [List.cons_append]
+    exact (ih.cons head).trans (List.Perm.swap root head _)
+
+/-- Compile-time environments in which no source slot still owns a value.
+This is the condition needed when a function closes its emitter with `ret`. -/
+inductive EntriesReleased : List VEntry → Prop where
+  | nil : EntriesReleased []
+  | slot {abs remaining uses entries} :
+      EntriesReleased entries →
+      EntriesReleased (.slot abs remaining uses false :: entries)
+  | recSelf {arity entries} :
+      EntriesReleased entries →
+      EntriesReleased (.recSelf arity :: entries)
+
+/-- The structural fact needed at a let boundary: the installed source
+binder is still the first logical entry and no longer owns its slot. -/
+def FirstEntryReleased (Γ : VEnv) : Prop :=
+  ∃ abs remaining uses tail,
+    Γ.entries = .slot abs remaining uses false :: tail
+
+/-- Reachable let-body entry shape: the first logical entry carries exactly
+the syntactic use count of the body and is held precisely when that count is
+nonzero. This is the compile-state fact needed to justify the lowerer's
+post-body `VEnv.pop`. -/
+def FirstEntryTracks (Γ : VEnv) (uses : Uses) (remaining : Nat) : Prop :=
+  ∃ abs tail,
+    Γ.entries =
+      .slot abs remaining uses (remaining != 0) :: tail
+
+/-- Removing a released first logical entry preserves the exact environment
+roots. `VEnv.pop` changes no runtime depth or physical stack position. -/
+theorem VEnvRealizes.pop_firstReleased {Γ : VEnv} {env : List RVal}
+    {roots : List Root} (hfirst : FirstEntryReleased Γ)
+    (h : VEnvRealizes Γ env roots) :
+    VEnvRealizes Γ.pop env roots := by
+  obtain ⟨abs, remaining, uses, tail, hentries⟩ := hfirst
+  refine ⟨by simpa [VEnv.pop] using h.depth_eq, ?_⟩
+  have hreal := h.entries
+  rw [hentries] at hreal
+  cases hreal with
+  | released _ htail =>
+    have htransport := htail.of_depth_eq (Γ := Γ) (Δ := Γ.pop)
+      (by simp [VEnv.pop])
+    simpa [VEnv.pop, hentries] using htransport
+
+/-- Semantic let-pop counterpart: removing the released leading logical
+binder removes exactly the leading source-environment value. Runtime slots,
+roots, and all remaining value graphs are unchanged. -/
+theorem VEnvValueGraph.pop_firstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {store : Store} {Γ : VEnv} {source : IxIR0.Value}
+    {sourceEnv : List IxIR0.Value} {env : List RVal}
+    {roots : List Root} (hfirst : FirstEntryReleased Γ)
+    (h : VEnvValueGraph funRel recSelfRel store Γ
+      (source :: sourceEnv) env roots) :
+    VEnvValueGraph funRel recSelfRel store Γ.pop sourceEnv env roots := by
+  obtain ⟨abs, remaining, uses, tail, hentries⟩ := hfirst
+  refine ⟨by simpa [VEnv.pop] using h.depth_eq, ?_⟩
+  have hreal := h.entries
+  rw [hentries] at hreal
+  cases hreal with
+  | released _ htail =>
+    have htransport := htail.of_depth_eq (Γ := Γ) (Δ := Γ.pop)
+      (by simp [VEnv.pop])
+    simpa [VEnv.pop, hentries] using htransport
+
+theorem EntriesRealize.eq_nil_of_released {Γ : VEnv} {env : List RVal} :
+    ∀ {entries roots}, EntriesReleased entries →
+      EntriesRealize Γ env entries roots → roots = [] := by
+  intro entries roots hreleased hrealize
+  induction hreleased with
+  | nil => cases hrealize; rfl
+  | slot _ ih =>
+    cases hrealize with
+    | released _ htail => exact ih htail
+  | recSelf _ ih =>
+    cases hrealize with
+    | recSelf htail => exact ih htail
+
+/-! ## Hoare-style continuation semantics -/
+
+abbrev StatePred := Store → List RVal → Prop
+abbrev ResultPred := Store → RVal → Prop
+
+/-- Partial-correctness judgment for an IxIR₁ code sequence. -/
+def CodeOwns (ctx : Ctx) (cur : FnDef) (pre : StatePred)
+    (post : ResultPred) (code : Code) : Prop :=
+  ∀ {fuel store env store' value}, pre store env →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+    post store' value
+
+/-- An emitter is sound from `pre` to `mid` when it transports every
+ownership-valid continuation under `mid` back to one under `pre`. -/
+def EmitSound (ctx : Ctx) (cur : FnDef) (emit : Emit)
+    (pre mid : StatePred) : Prop :=
+  ∀ (post : ResultPred) (code : Code),
+    CodeOwns ctx cur mid post code →
+    CodeOwns ctx cur pre post (emit code)
+
+/-- One operation's state-transformer judgment. The operation result is
+prepended to the runtime environment exactly as `Code.letOp` specifies. -/
+def OpSound (ctx : Ctx) (cur : FnDef) (op : Op)
+    (pre post : StatePred) : Prop :=
+  ∀ {fuel store env store' value}, pre store env →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+    post store' (value :: env)
+
+/-- `CodeOwns` restricted to evaluator indices through `limit`. The outer
+`runCode` step lowers every operation and continuation to a strictly smaller
+index, so this judgment can cover the exact index being sealed while consuming
+only operation/callee contracts below it. -/
+def CodeOwnsBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (pre : StatePred) (post : ResultPred) (code : Code) : Prop :=
+  ∀ {fuel store env store' value}, fuel ≤ limit → pre store env →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+    post store' value
+
+/-- Fuel-bounded emitter soundness. Keeping the same
+continuation-transformer shape as `EmitSound` preserves composition. -/
+def EmitSoundBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (emit : Emit) (pre mid : StatePred) : Prop :=
+  ∀ bound, bound ≤ limit → ∀ (post : ResultPred) (code : Code),
+    CodeOwnsBelow ctx cur bound mid post code →
+    CodeOwnsBelow ctx cur bound pre post (emit code)
+
+/-- One operation's state-transformer judgment below a fuel bound. -/
+def OpSoundBelow (ctx : Ctx) (cur : FnDef) (limit : Nat) (op : Op)
+    (pre post : StatePred) : Prop :=
+  ∀ {fuel store env store' value}, fuel < limit → pre store env →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+    post store' (value :: env)
+
+private theorem bindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem estateBindRun {error state α β : Type}
+    (action : EStateM error state α) (next : α → EStateM error state β)
+    (initial : state) :
+    (action >>= next).run initial =
+      match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error err nextState => .error err nextState := rfl
+
+private theorem estatePureRun {error state α : Type}
+    (value : α) (initial : state) :
+    (pure value : EStateM error state α).run initial =
+      .ok value initial := rfl
+
+private theorem estateThrowRun_not_ok {error state α : Type}
+    {err : error} {initial final : state} {value : α}
+    (h : (throw err : EStateM error state α).run initial =
+      .ok value final) : False := by
+  change EStateM.Result.error err initial = .ok value final at h
+  contradiction
+
+/-- A successful declared-result world check certifies exact agreement and
+leaves the lowering state unchanged. -/
+theorem requireResultWorld_run_ok_inv
+    {actual demand : Owned} {initial final : LowSt}
+    (hrun : (requireResultWorld actual demand).run initial =
+      .ok () final) : actual = demand ∧ initial = final := by
+  have hssEq : (Owned.shared == Owned.shared) = true := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have husEq : (Owned.unique == Owned.shared) = false := by decide
+  cases actual <;> cases demand <;>
+    simp [requireResultWorld, hssEq, huuEq, hsuEq, husEq] at hrun ⊢
+  all_goals assumption
+
+/-- Successful state-monad bind inversion, used to recover the two recursive
+compiler runs from a successful `do` block. -/
+private theorem estateBindRun_ok_inv {error state α β : Type}
+    {action : EStateM error state α} {next : α → EStateM error state β}
+    {initial final : state} {result : β}
+    (h : (action >>= next).run initial = .ok result final) :
+    ∃ value middle,
+      action.run initial = .ok value middle ∧
+      (next value).run middle = .ok result final := by
+  rw [estateBindRun] at h
+  cases haction : action.run initial with
+  | ok value middle =>
+    rw [haction] at h
+    exact ⟨value, middle, rfl, h⟩
+  | error err middle =>
+    rw [haction] at h
+    contradiction
+
+theorem EmitSound.id {ctx : Ctx} {cur : FnDef} {pre : StatePred} :
+    EmitSound ctx cur (_root_.id : Emit) pre pre := by
+  intro post code hcode fuel store env store' value hpre hrun
+  exact hcode hpre hrun
+
+theorem EmitSound.strengthen {ctx : Ctx} {cur : FnDef}
+    {pre mid : StatePred}
+    (himp : ∀ {store env}, pre store env → mid store env) :
+    EmitSound ctx cur (_root_.id : Emit) pre mid := by
+  intro post code hcode fuel store env store' value hpre hrun
+  exact hcode (himp hpre) hrun
+
+theorem EmitSound.comp {ctx : Ctx} {cur : FnDef} {emit₁ emit₂ : Emit}
+    {pre mid post : StatePred}
+    (h₁ : EmitSound ctx cur emit₁ pre mid)
+    (h₂ : EmitSound ctx cur emit₂ mid post) :
+    EmitSound ctx cur (emit₁ ∘ emit₂) pre post := by
+  intro result code hcode
+  exact h₁ result (emit₂ code) (h₂ result code hcode)
+
+/-- An emitter whose precondition no execution can satisfy transports every
+postcondition. Vacuous compiler branches use this to skip the remainder of
+their emitted sequence once one operation is known to fail. -/
+theorem EmitSound.ofFalse {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {mid : StatePred} :
+    EmitSound ctx cur emit (fun _ _ => False) mid := by
+  intro post code hcode fuel store env store' value hpre hrun
+  exact hpre.elim
+
+/-- An emitter proved to reach an unsatisfiable midpoint reaches any
+midpoint. This is the terminal step of a vacuous branch, where the emitted
+code is exactly the prefix already shown to fail. -/
+theorem EmitSound.ofFalseMid {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {pre mid : StatePred}
+    (hfalse : EmitSound ctx cur emit pre (fun _ _ => False)) :
+    EmitSound ctx cur emit pre mid := by
+  intro post code _
+  exact hfalse post code (fun hpre _ => hpre.elim)
+
+/-- Unbounded code ownership restricts to any fuel prefix. -/
+theorem CodeOwns.below {ctx : Ctx} {cur : FnDef} {pre : StatePred}
+    {post : ResultPred} {code : Code}
+    (hcode : CodeOwns ctx cur pre post code) (limit : Nat) :
+    CodeOwnsBelow ctx cur limit pre post code := by
+  intro fuel store env store' value _ hpre hrun
+  exact hcode hpre hrun
+
+/-- Unbounded operation soundness restricts to any fuel prefix. -/
+theorem OpSound.below {ctx : Ctx} {cur : FnDef} {op : Op}
+    {pre post : StatePred}
+    (hop : OpSound ctx cur op pre post) (limit : Nat) :
+    OpSoundBelow ctx cur limit op pre post := by
+  intro fuel store env store' value _ hpre hrun
+  exact hop hpre hrun
+
+theorem EmitSoundBelow.id {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {pre : StatePred} :
+    EmitSoundBelow ctx cur limit (_root_.id : Emit) pre pre := by
+  intro bound _ post code hcode
+  exact hcode
+
+theorem EmitSoundBelow.strengthen {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {pre mid : StatePred}
+    (himp : ∀ {store env}, pre store env → mid store env) :
+    EmitSoundBelow ctx cur limit (_root_.id : Emit) pre mid := by
+  intro bound _ post code hcode fuel store env store' value hfuel hpre hrun
+  exact hcode hfuel (himp hpre) hrun
+
+theorem EmitSoundBelow.comp {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {emit₁ emit₂ : Emit} {pre mid post : StatePred}
+    (h₁ : EmitSoundBelow ctx cur limit emit₁ pre mid)
+    (h₂ : EmitSoundBelow ctx cur limit emit₂ mid post) :
+    EmitSoundBelow ctx cur limit (emit₁ ∘ emit₂) pre post := by
+  intro bound hbound result code hcode
+  exact h₁ bound hbound result (emit₂ code)
+    (h₂ bound hbound result code hcode)
+
+theorem EmitSoundBelow.ofFalse {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {emit : Emit} {mid : StatePred} :
+    EmitSoundBelow ctx cur limit emit (fun _ _ => False) mid := by
+  intro bound hbound post code hcode fuel store env store' value hfuel
+    hpre hrun
+  exact hpre.elim
+
+theorem EmitSoundBelow.ofFalseMid {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {emit : Emit} {pre mid : StatePred}
+    (hfalse : EmitSoundBelow ctx cur limit emit pre (fun _ _ => False)) :
+    EmitSoundBelow ctx cur limit emit pre mid := by
+  intro bound hbound post code hcode
+  exact hfalse bound hbound post code (by
+    intro fuel store env store' value hfuel hpre hrun
+    exact hpre.elim)
+
+/-- Closing a bounded emitter proof at every evaluator limit recovers the
+unbounded judgment. This is the bridge used to keep one bounded compiler
+induction and expose the legacy exact interface only at its boundary. -/
+theorem EmitSound.of_below {ctx : Ctx} {cur : FnDef} {emit : Emit}
+    {pre mid : StatePred}
+    (hsound : ∀ limit, EmitSoundBelow ctx cur limit emit pre mid) :
+    EmitSound ctx cur emit pre mid := by
+  intro post code hcode fuel store env store' value hpre hrun
+  have hbounded : CodeOwnsBelow ctx cur fuel mid post code :=
+    hcode.below fuel
+  exact hsound fuel fuel (Nat.le_refl fuel) post code hbounded
+    (Nat.le_refl fuel) hpre hrun
+
+/-- Closing bounded operation soundness at every evaluator limit recovers the
+unbounded operation judgment. -/
+theorem OpSound.of_below {ctx : Ctx} {cur : FnDef} {op : Op}
+    {pre post : StatePred}
+    (hsound : ∀ limit, OpSoundBelow ctx cur limit op pre post) :
+    OpSound ctx cur op pre post := by
+  intro fuel store env store' value hpre hrun
+  exact hsound fuel.succ (Nat.lt_succ_self fuel) hpre hrun
+
+/-- Lift one bounded operation through `Code.letOp`. Both the operation and
+its continuation run at the predecessor of the enclosing code fuel, hence
+remain below the same bound. -/
+theorem OpSoundBelow.emit {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {op : Op} {pre post : StatePred}
+    (hop : OpSoundBelow ctx cur limit op pre post) :
+    EmitSoundBelow ctx cur limit (emitOp op) pre post := by
+  intro bound hbound result code hcode fuel store env finalStore finalValue
+    hfuel hpre hrun
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+    have hinner : fuel < bound :=
+      Nat.lt_of_lt_of_le (Nat.lt_succ_self fuel) hfuel
+    have hinnerLimit : fuel < limit := Nat.lt_of_lt_of_le hinner hbound
+    rw [runCode.eq_def] at hrun
+    dsimp only [emitOp] at hrun
+    cases hopEval : runOp ctx fuel cur store env op with
+    | error err =>
+      rw [hopEval] at hrun
+      change (Except.error err : Except Err (Store × RVal)) =
+        .ok (finalStore, finalValue) at hrun
+      contradiction
+    | ok out =>
+      rcases out with ⟨store', value⟩
+      rw [hopEval] at hrun
+      change runCode ctx fuel cur store' (value :: env) code =
+        .ok (finalStore, finalValue) at hrun
+      exact hcode (Nat.le_of_lt hinner) (hop hinnerLimit hpre hopEval) hrun
+
+theorem OpSound.emit {ctx : Ctx} {cur : FnDef} {op : Op}
+    {pre post : StatePred} (hop : OpSound ctx cur op pre post) :
+    EmitSound ctx cur (emitOp op) pre post := by
+  intro result code hcode fuel store env finalStore finalValue hpre hrun
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+    rw [runCode.eq_def] at hrun
+    dsimp only [emitOp] at hrun
+    cases hopEval : runOp ctx fuel cur store env op with
+    | error err =>
+      rw [hopEval] at hrun
+      change (Except.error err : Except Err (Store × RVal)) =
+        .ok (finalStore, finalValue) at hrun
+      contradiction
+    | ok out =>
+      rcases out with ⟨store', value⟩
+      rw [hopEval] at hrun
+      change runCode ctx fuel cur store' (value :: env) code =
+        .ok (finalStore, finalValue) at hrun
+      exact hcode (hop hpre hopEval) hrun
+
+/-! ## Emitter rules backed by the exact evaluator interfaces -/
+
+/-- A state after one operation has pushed a physical environment slot while
+leaving the stated logical roots. The pushed value itself is ownership-inert
+or has already been accounted for elsewhere. -/
+def OwnsAfterPush (frame : List RVal → Prop) (roots : List Root) : StatePred :=
+  fun store env' => ∃ value env,
+    env' = value :: env ∧ frame env ∧ RootOwnership store roots
+
+/-- A stronger pushed-state predicate in which the new value is exactly one
+owned root. -/
+def OwnsPushedRoot (frame : List RVal → Prop) (world : Owned)
+    (rest : List Root) : StatePred :=
+  fun store env' => ∃ value env,
+    env' = value :: env ∧ frame env ∧
+    RootOwnership store (⟨world, value⟩ :: rest)
+
+/-- The pushed operation result is a borrow, not a new owner. -/
+def BorrowsPushed (frame : List RVal → Prop) (world : Owned)
+    (roots : List Root) : StatePred :=
+  fun store env' => ∃ value env,
+    env' = value :: env ∧ frame env ∧ HasWorld store world value ∧
+    RootOwnership store roots
+
+private theorem emit_pure_scalar_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {atom : Atom}
+    {value : RVal} {world : Owned} {rest : List Root}
+    (hnone : rvalLocation? value = none) :
+    EmitSoundBelow ctx cur limit (emitOp (.pure atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        RootOwnership store rest)
+      (OwnsPushedRoot frame world rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hop := runOp_pure_scalar_owned (ctx := ctx) (cur := cur)
+      (fuel := fuel) (world := world) (roots := rest)
+      hresolve hnone hown
+    have hpair : (store, value) = (store', result) :=
+      Except.ok.inj (hop.1.symm.trans hrun)
+    cases hpair
+    exact ⟨value, env, rfl, hframe, hop.2⟩
+
+theorem emit_pure_scalar_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {atom : Atom} {value : RVal}
+    {world : Owned} {rest : List Root}
+    (hnone : rvalLocation? value = none) :
+    EmitSound ctx cur (emitOp (.pure atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        RootOwnership store rest)
+      (OwnsPushedRoot frame world rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_pure_scalar_owned_at (limit := limit) hnone
+
+/-- Fuel-bounded scalar materialization. -/
+theorem emit_pure_scalar_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {atom : Atom}
+    {value : RVal} {world : Owned} {rest : List Root}
+    (hnone : rvalLocation? value = none) :
+    EmitSoundBelow ctx cur limit (emitOp (.pure atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        RootOwnership store rest)
+      (OwnsPushedRoot frame world rest) := by
+  exact emit_pure_scalar_owned_at hnone
+
+private theorem emit_alloc_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {world : Owned}
+    {cid : CtorId} {atoms : Array Atom} {values : List RVal}
+    {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.alloc world cid atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor world values ++ rest))
+      (OwnsPushedRoot frame world rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hop := runOp_alloc_owned (ctx := ctx) (cur := cur)
+      (fuel := fuel) (cid := cid) (args := atoms) (values := values)
+      (rest := rest) hresolve hown
+    have hpair :
+        ((store.allocNode world (.ctorN cid values.toArray)).1,
+          .loc (store.allocNode world (.ctorN cid values.toArray)).2) =
+        (store', result) := by
+      exact Except.ok.inj (hop.1.symm.trans hrun)
+    have hstore := congrArg Prod.fst hpair
+    have hresult := congrArg Prod.snd hpair
+    dsimp only at hstore hresult
+    subst store'
+    subst result
+    exact ⟨.loc (store.allocNode world (.ctorN cid values.toArray)).2,
+      env, rfl, hframe, hop.2⟩
+
+theorem emit_alloc_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {world : Owned} {cid : CtorId}
+    {atoms : Array Atom} {values : List RVal} {rest : List Root} :
+    EmitSound ctx cur (emitOp (.alloc world cid atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor world values ++ rest))
+      (OwnsPushedRoot frame world rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_alloc_owned_at (limit := limit)
+
+/-- Fuel-bounded constructor allocation. -/
+theorem emit_alloc_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {world : Owned}
+    {cid : CtorId} {atoms : Array Atom} {values : List RVal}
+    {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.alloc world cid atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor world values ++ rest))
+      (OwnsPushedRoot frame world rest) := by
+  exact emit_alloc_owned_at
+
+/-- Partial application packages a shared argument prefix into one fresh
+shared pap root. -/
+private theorem emit_papp_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {f : Ixon.Address} {d : Decl}
+    {frame : List RVal → Prop} {atoms : Array Atom}
+    {values : List RVal} {rest : List Root}
+    (hdecl : ctx.decls f = some d)
+    (hunder : values.length < declArity d) :
+    EmitSoundBelow ctx cur limit (emitOp (.papp f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor .shared values ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hop := runOp_papp_owned (ctx := ctx) (cur := cur)
+      (fuel := fuel) hresolve hdecl hunder hown
+    have hpair :
+        ((store.allocNode .shared
+          (.papN f (declArity d) values.toArray)).1,
+          .loc (store.allocNode .shared
+            (.papN f (declArity d) values.toArray)).2) =
+        (store', result) := Except.ok.inj (hop.1.symm.trans hrun)
+    cases hpair
+    exact ⟨.loc (store.allocNode .shared
+      (.papN f (declArity d) values.toArray)).2,
+      env, rfl, hframe, hop.2⟩
+
+theorem emit_papp_owned {ctx : Ctx} {cur : FnDef} {f : Ixon.Address}
+    {d : Decl} {frame : List RVal → Prop} {atoms : Array Atom}
+    {values : List RVal} {rest : List Root}
+    (hdecl : ctx.decls f = some d)
+    (hunder : values.length < declArity d) :
+    EmitSound ctx cur (emitOp (.papp f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor .shared values ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_papp_owned_at (limit := limit) hdecl hunder
+
+/-- Fuel-bounded partial-application allocation. -/
+theorem emit_papp_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {f : Ixon.Address} {d : Decl}
+    {frame : List RVal → Prop} {atoms : Array Atom}
+    {values : List RVal} {rest : List Root}
+    (hdecl : ctx.decls f = some d)
+    (hunder : values.length < declArity d) :
+    EmitSoundBelow ctx cur limit (emitOp (.papp f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok values ∧
+        RootOwnership store (rootsFor .shared values ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  exact emit_papp_owned_at hdecl hunder
+
+private theorem emit_retain_borrowed_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {atom : Atom}
+    {value : RVal} {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.dup atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        HasWorld store .shared value ∧ RootOwnership store rest)
+      (OwnsPushedRoot frame .shared rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hworld, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨middle, heval, hmiddle⟩ :=
+      runOp_retain_borrowed (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hworld hown
+    have hpair : (middle, value) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    exact ⟨value, env, rfl, hframe, hmiddle⟩
+
+theorem emit_retain_borrowed {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {atom : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitSound ctx cur (emitOp (.dup atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        HasWorld store .shared value ∧ RootOwnership store rest)
+      (OwnsPushedRoot frame .shared rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_retain_borrowed_at (limit := limit)
+
+/-- Fuel-bounded counterpart of `emit_retain_borrowed`. Retain itself is
+call-free, so the only fuel obligation is the enclosing operation bound. -/
+theorem emit_retain_borrowed_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {atom : Atom}
+    {value : RVal} {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.dup atom))
+      (fun store env => frame env ∧ resolveAtom env atom = .ok value ∧
+        HasWorld store .shared value ∧ RootOwnership store rest)
+      (OwnsPushedRoot frame .shared rest) := by
+  exact emit_retain_borrowed_at
+
+/-- A known direct call plugs the declaration contract into the emitter
+induction: argument roots disappear, the declared result root is pushed, and
+the caller's continuation roots remain exact. -/
+private theorem emit_call_owned_at {ctx : Ctx} {cur d : FnDef}
+    {limit : Nat} {f : Ixon.Address} {frame : List RVal → Prop}
+    {atoms : Array Atom} {args : List RVal} {argWorlds : List Owned}
+    {rest : List Root}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContractBelow ctx d argWorlds limit) :
+    EmitSoundBelow ctx cur limit (emitOp (.call f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame d.result rest) := by
+  apply OpSoundBelow.emit
+  intro opFuel store env store' result hopFuel hpre hrun
+  obtain ⟨hframe, hargs, hown⟩ := hpre
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hcallee : FnOwnershipContractBelow ctx d argWorlds fuel :=
+      hcontract.mono (by omega)
+    have hresult := runOp_call_owned_below (ctx := ctx) (cur := cur)
+      (fuel := fuel) hargs hdecl hcallee hown hrun
+    exact ⟨result, env, rfl, hframe, hresult⟩
+
+theorem emit_call_owned {ctx : Ctx} {cur d : FnDef} {f : Ixon.Address}
+    {frame : List RVal → Prop} {atoms : Array Atom} {args : List RVal}
+    {argWorlds : List Owned} {rest : List Root}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d argWorlds) :
+    EmitSound ctx cur (emitOp (.call f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame d.result rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_call_owned_at hdecl (hcontract.below limit)
+
+/-- Recursive self-call counterpart of `emit_call_owned`. The current
+function's contract consumes the argument prefix and supplies one root in
+its declared result world. -/
+private theorem emit_callSelf_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {atoms : Array Atom}
+    {args : List RVal} {argWorlds : List Owned} {rest : List Root}
+    (hcontract : FnOwnershipContractBelow ctx cur argWorlds limit) :
+    EmitSoundBelow ctx cur limit (emitOp (.callSelf atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame cur.result rest) := by
+  apply OpSoundBelow.emit
+  intro opFuel store env store' result hopFuel hpre hrun
+  obtain ⟨hframe, hargs, hown⟩ := hpre
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hself : FnOwnershipContractBelow ctx cur argWorlds (fuel + 1) :=
+      hcontract.mono (Nat.le_of_lt hopFuel)
+    have hresult := runOp_callSelf_owned_below (ctx := ctx) (cur := cur)
+      (fuel := fuel) hargs hself hown hrun
+    exact ⟨result, env, rfl, hframe, hresult⟩
+
+theorem emit_callSelf_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {atoms : Array Atom} {args : List RVal}
+    {argWorlds : List Owned} {rest : List Root}
+    (hcontract : FnOwnershipContract ctx cur argWorlds) :
+    EmitSound ctx cur (emitOp (.callSelf atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame cur.result rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_callSelf_owned_at (hcontract.below limit)
+
+/-- Successful scalar-only extern calls consume their inert shared argument
+roots and push one scalar result root at the caller's demanded world. -/
+private theorem emit_extern_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {f : Ixon.Address} {frame : List RVal → Prop}
+    {atoms : Array Atom} {args : List RVal} {resultWorld : Owned}
+    {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.extern f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame resultWorld rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hargs, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hresult := runOp_extern_owned (ctx := ctx) (cur := cur)
+      (fuel := fuel) (resultWorld := resultWorld) hargs hown hrun
+    exact ⟨result, env, rfl, hframe, hresult⟩
+
+theorem emit_extern_owned {ctx : Ctx} {cur : FnDef} {f : Ixon.Address}
+    {frame : List RVal → Prop} {atoms : Array Atom} {args : List RVal}
+    {resultWorld : Owned} {rest : List Root} :
+    EmitSound ctx cur (emitOp (.extern f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame resultWorld rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_extern_owned_at (limit := limit)
+
+/-- Fuel-bounded scalar-only extern operation. -/
+theorem emit_extern_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {f : Ixon.Address} {frame : List RVal → Prop}
+    {atoms : Array Atom} {args : List RVal} {resultWorld : Owned}
+    {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.extern f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame resultWorld rest) := by
+  exact emit_extern_owned_at
+
+/-- Unknown application consumes the shared pap/function root together with
+all supplied shared argument roots. Pap saturation and recursive
+over-application are encapsulated by the context's callable contract. -/
+private theorem emit_apply_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop}
+    {functionAtom : Atom} {function : RVal} {atoms : Array Atom}
+    {args : List RVal} {rest : List Root}
+    (hcontract : ApplyOwnershipContractBelow ctx limit) :
+    EmitSoundBelow ctx cur limit (emitOp (.apply functionAtom atoms))
+      (fun store env => frame env ∧
+        resolveAtom env functionAtom = .ok function ∧
+        resolveAtoms env atoms = .ok args ∧
+        RootOwnership store
+          (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  apply OpSoundBelow.emit
+  intro opFuel store env store' result hopFuel hpre hrun
+  obtain ⟨hframe, hfunction, hargs, hown⟩ := hpre
+  cases opFuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have happly : ApplyOwnershipContractBelow ctx (fuel + 1) :=
+      hcontract.mono (Nat.le_of_lt hopFuel)
+    have hresult := runOp_apply_owned_below (ctx := ctx) (cur := cur)
+      (fuel := fuel) hfunction hargs happly hown hrun
+    exact ⟨result, env, rfl, hframe, hresult⟩
+
+theorem emit_apply_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {functionAtom : Atom} {function : RVal}
+    {atoms : Array Atom} {args : List RVal} {rest : List Root}
+    (hcontract : ApplyOwnershipContract ctx) :
+    EmitSound ctx cur (emitOp (.apply functionAtom atoms))
+      (fun store env => frame env ∧
+        resolveAtom env functionAtom = .ok function ∧
+        resolveAtoms env atoms = .ok args ∧
+        RootOwnership store
+          (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_apply_owned_at (hcontract.below limit)
+
+/-- Bounded direct-call emitter rule for the mutual compiler induction. -/
+theorem emit_call_owned_below {ctx : Ctx} {cur d : FnDef}
+    {limit : Nat} {f : Ixon.Address} {frame : List RVal → Prop}
+    {atoms : Array Atom} {args : List RVal} {argWorlds : List Owned}
+    {rest : List Root}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContractBelow ctx d argWorlds limit) :
+    EmitSoundBelow ctx cur limit (emitOp (.call f atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame d.result rest) := by
+  exact emit_call_owned_at hdecl hcontract
+
+/-- Bounded recursive-self emitter rule. Only the strictly smaller body
+contract exposed by the enclosing fuel prefix is consumed. -/
+theorem emit_callSelf_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {atoms : Array Atom}
+    {args : List RVal} {argWorlds : List Owned} {rest : List Root}
+    (hcontract : FnOwnershipContractBelow ctx cur argWorlds limit) :
+    EmitSoundBelow ctx cur limit (emitOp (.callSelf atoms))
+      (fun store env => frame env ∧ resolveAtoms env atoms = .ok args ∧
+        RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+      (OwnsPushedRoot frame cur.result rest) := by
+  exact emit_callSelf_owned_at hcontract
+
+/-- Bounded unknown-application emitter rule. Saturation and
+over-application recurse only through the smaller application prefix. -/
+theorem emit_apply_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop}
+    {functionAtom : Atom} {function : RVal} {atoms : Array Atom}
+    {args : List RVal} {rest : List Root}
+    (hcontract : ApplyOwnershipContractBelow ctx limit) :
+    EmitSoundBelow ctx cur limit (emitOp (.apply functionAtom atoms))
+      (fun store env => frame env ∧
+        resolveAtom env functionAtom = .ok function ∧
+        resolveAtoms env atoms = .ok args ∧
+        RootOwnership store
+          (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+      (OwnsPushedRoot frame .shared rest) := by
+  exact emit_apply_owned_at hcontract
+
+/-- Dropping a shared value consumes its logical root whether the resolved
+value is a location or an ownership-inert scalar. This is the generic rule
+needed by `releaseAll`, whose slot descriptors may hold either kind. -/
+private theorem emit_drop_value_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {target : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.drop target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.shared, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases value with
+    | lit literal =>
+      change (Except.ok (store, RVal.erased) :
+        Except Err (Store × RVal)) = .ok (store', result) at hrun
+      have hpair : (store, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨.erased, env, rfl, hframe,
+        hown.dropNoLocation (by rfl)⟩
+    | erased =>
+      change (Except.ok (store, RVal.erased) :
+        Except Err (Store × RVal)) = .ok (store', result) at hrun
+      have hpair : (store, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨.erased, env, rfl, hframe,
+        hown.dropNoLocation (by rfl)⟩
+    | loc loc =>
+      dsimp only at hrun
+      cases hdrop : dropVal ctx fuel store (.loc loc) with
+      | error err =>
+        rw [hdrop] at hrun
+        change (Except.error err : Except Err (Store × RVal)) =
+          .ok (store', result) at hrun
+        contradiction
+      | ok dropped =>
+        rw [hdrop] at hrun
+        change (Except.ok (dropped, RVal.erased) :
+          Except Err (Store × RVal)) = .ok (store', result) at hrun
+        have hpair : (dropped, RVal.erased) = (store', result) :=
+          Except.ok.inj hrun
+        cases hpair
+        exact ⟨.erased, env, rfl, hframe,
+          dropVal_preserves hown hdrop⟩
+
+theorem emit_drop_value_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitSound ctx cur (emitOp (.drop target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.shared, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_drop_value_owned_at (limit := limit)
+
+/-- Fuel-bounded shared release for a value of arbitrary runtime shape. -/
+theorem emit_drop_value_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {target : Atom}
+    {value : RVal} {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.drop target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.shared, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  exact emit_drop_value_owned_at
+
+theorem emit_drop_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {loc : Nat}
+    {rest : List Root} :
+    EmitSound ctx cur (emitOp (.drop target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        RootOwnership store (⟨.shared, .loc loc⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    dsimp only at hrun
+    cases hdrop : dropVal ctx fuel store (.loc loc) with
+    | error err =>
+      rw [hdrop] at hrun
+      change (Except.error err : Except Err (Store × RVal)) =
+        .ok (store', result) at hrun
+      contradiction
+    | ok dropped =>
+      rw [hdrop] at hrun
+      change (Except.ok (dropped, .erased) : Except Err (Store × RVal)) =
+        .ok (store', result) at hrun
+      have hpair : (dropped, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨.erased, env, rfl, hframe,
+        dropVal_preserves hown hdrop⟩
+
+theorem emit_dropU_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {loc : Nat}
+    {rest : List Root} :
+    EmitSound ctx cur (emitOp (.dropU target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        RootOwnership store (⟨.unique, .loc loc⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    dsimp only at hrun
+    cases hdrop : dropUVal ctx fuel store (.loc loc) with
+    | error err =>
+      rw [hdrop] at hrun
+      change (Except.error err : Except Err (Store × RVal)) =
+        .ok (store', result) at hrun
+      contradiction
+    | ok dropped =>
+      rw [hdrop] at hrun
+      change (Except.ok (dropped, .erased) : Except Err (Store × RVal)) =
+        .ok (store', result) at hrun
+      have hpair : (dropped, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨.erased, env, rfl, hframe,
+        dropUVal_preserves hown hdrop⟩
+
+/-- Generic affine release, including ownership-inert scalar values. -/
+private theorem emit_dropU_value_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {target : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.dropU target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.unique, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases value with
+    | lit literal =>
+      change (Except.ok (store, RVal.erased) :
+        Except Err (Store × RVal)) = .ok (store', result) at hrun
+      have hpair : (store, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨.erased, env, rfl, hframe,
+        hown.dropNoLocation (by rfl)⟩
+    | erased =>
+      change (Except.ok (store, RVal.erased) :
+        Except Err (Store × RVal)) = .ok (store', result) at hrun
+      have hpair : (store, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨.erased, env, rfl, hframe,
+        hown.dropNoLocation (by rfl)⟩
+    | loc loc =>
+      dsimp only at hrun
+      cases hdrop : dropUVal ctx fuel store (.loc loc) with
+      | error err =>
+        rw [hdrop] at hrun
+        change (Except.error err : Except Err (Store × RVal)) =
+          .ok (store', result) at hrun
+        contradiction
+      | ok dropped =>
+        rw [hdrop] at hrun
+        change (Except.ok (dropped, RVal.erased) :
+          Except Err (Store × RVal)) = .ok (store', result) at hrun
+        have hpair : (dropped, RVal.erased) = (store', result) :=
+          Except.ok.inj hrun
+        cases hpair
+        exact ⟨.erased, env, rfl, hframe,
+          dropUVal_preserves hown hdrop⟩
+
+theorem emit_dropU_value_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {value : RVal}
+    {rest : List Root} :
+    EmitSound ctx cur (emitOp (.dropU target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.unique, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  exact EmitSound.of_below fun limit =>
+    emit_dropU_value_owned_at (limit := limit)
+
+/-- Fuel-bounded affine release for a value of arbitrary runtime shape. -/
+theorem emit_dropU_value_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {target : Atom}
+    {value : RVal} {rest : List Root} :
+    EmitSoundBelow ctx cur limit (emitOp (.dropU target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok value ∧
+        RootOwnership store (⟨.unique, value⟩ :: rest))
+      (OwnsAfterPush frame rest) := by
+  exact emit_dropU_value_owned_at
+
+theorem emit_free_owned {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {loc : Nat}
+    {node : Node} {rest : List Root} :
+    EmitSound ctx cur (emitOp (.free target))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        store.get? loc = some ⟨.unique, 1, node⟩ ∧
+        RootOwnership store (⟨.unique, .loc loc⟩ :: rest))
+      (OwnsAfterPush frame (rootsFor .unique (nodeChildren node) ++ rest)) := by
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨hframe, hresolve, hbox, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hop := runOp_free_owned (ctx := ctx) (cur := cur)
+      (fuel := fuel) hresolve hbox hown
+    have hpair : (store.kill loc, RVal.erased) = (store', result) :=
+      Except.ok.inj (hop.1.symm.trans hrun)
+    cases hpair
+    exact ⟨.erased, env, rfl, hframe, hop.2⟩
+
+private theorem emit_fetch_borrowed_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {target : Atom} {loc rc i : Nat}
+    {cid : CtorId} {fields : Array RVal}
+    {value : RVal} {roots : List Root}
+    (hfield : fields[i]? = some value) :
+    EmitSoundBelow ctx cur limit (emitOp (.fetch target i))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        store.get? loc = some ⟨.shared, rc, .ctorN cid fields⟩ ∧
+        RootOwnership store roots)
+      (BorrowsPushed frame .shared roots) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨hframe, hresolve, hbox, hown⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hop := runOp_fetch_borrowed (ctx := ctx) (cur := cur)
+      (fuel := fuel) hresolve hbox hfield hown
+    have hpair : (store, value) = (store', result) :=
+      Except.ok.inj (hop.1.symm.trans hrun)
+    cases hpair
+    exact ⟨value, env, rfl, hframe, hop.2, hown⟩
+
+theorem emit_fetch_borrowed {ctx : Ctx} {cur : FnDef}
+    {frame : List RVal → Prop} {target : Atom} {loc rc i : Nat}
+    {cid : CtorId} {fields : Array RVal}
+    {value : RVal} {roots : List Root}
+    (hfield : fields[i]? = some value) :
+    EmitSound ctx cur (emitOp (.fetch target i))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        store.get? loc = some ⟨.shared, rc, .ctorN cid fields⟩ ∧
+        RootOwnership store roots)
+      (BorrowsPushed frame .shared roots) := by
+  exact EmitSound.of_below fun limit =>
+    emit_fetch_borrowed_at (limit := limit) hfield
+
+/-- Fuel-bounded borrowed-field fetch. The operation pushes only a borrow;
+the parent's root and the complete root multiset remain unchanged. -/
+theorem emit_fetch_borrowed_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {frame : List RVal → Prop} {target : Atom}
+    {loc rc i : Nat} {cid : CtorId} {fields : Array RVal}
+    {value : RVal} {roots : List Root}
+    (hfield : fields[i]? = some value) :
+    EmitSoundBelow ctx cur limit (emitOp (.fetch target i))
+      (fun store env => frame env ∧
+        resolveAtom env target = .ok (.loc loc) ∧
+        store.get? loc = some ⟨.shared, rc, .ctorN cid fields⟩ ∧
+        RootOwnership store roots)
+      (BorrowsPushed frame .shared roots) := by
+  exact emit_fetch_borrowed_at hfield
+
+/-! ## Exact-root predicates used by expression lowering -/
+
+/-- The held source slots plus an arbitrary caller continuation own the
+entire input heap. -/
+def OwnsVEnv (Γ : VEnv) (rest : List Root) : StatePred :=
+  fun store env => ∃ roots,
+    VEnvRealizes Γ env roots ∧
+    RootOwnership store (roots ++ rest)
+
+/-- The lowered result owns one root in `world`, alongside the roots still
+held by the output `VEnv` and the caller continuation. -/
+def OwnsResult (Γ : VEnv) (world : Owned) (av : AVal)
+    (rest : List Root) : StatePred :=
+  fun store env => ∃ roots value,
+    VEnvRealizes Γ env roots ∧
+    AValRealizes Γ env av value ∧
+    RootOwnership store (⟨world, value⟩ :: roots ++ rest)
+
+/-- Semantic companion of `OwnsVEnv`: each held logical root additionally
+realizes the corresponding source evaluator value, and the caller's framed
+roots carry their own source correspondence. The latter is essential when an
+earlier argument is framed across the lowering of later arguments. -/
+def GraphOwnsVEnv (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value)
+    (sourceRest : List (Owned × IxIR0.Value))
+    (rest : List Root) : StatePred :=
+  fun store env => ∃ roots,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store (roots ++ rest)
+
+/-- Semantic companion of `OwnsResult`: the returned `AVal` realizes both
+the target root and the successful pure source result. -/
+def GraphOwnsResult (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value) (sourceValue : IxIR0.Value)
+    (world : Owned) (av : AVal)
+    (sourceRest : List (Owned × IxIR0.Value))
+    (rest : List Root) : StatePred :=
+  fun store env => ∃ roots value,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    AValRealizes Γ env av value ∧
+    Sim.ValueGraph funRel store sourceValue value ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store (⟨world, value⟩ :: roots ++ rest)
+
+/-- Forgetting source values recovers the ownership precondition used by the
+existing lowering proof. -/
+theorem GraphOwnsVEnv.toOwnsVEnv {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {store : Store} {env : List RVal}
+    (h : GraphOwnsVEnv funRel recSelfRel Γ sourceEnv
+      sourceRest rest store env) :
+    OwnsVEnv Γ rest store env := by
+  obtain ⟨roots, hgraph, _, hown⟩ := h
+  exact ⟨roots, hgraph.vEnvRealizes, hown⟩
+
+/-- Forgetting the result graph recovers the ownership postcondition. -/
+theorem GraphOwnsResult.toOwnsResult {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {av : AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {store : Store} {env : List RVal}
+    (h : GraphOwnsResult funRel recSelfRel Γ sourceEnv sourceValue
+      world av sourceRest rest store env) :
+    OwnsResult Γ world av rest store env := by
+  obtain ⟨roots, value, hgraph, hav, _, _, hown⟩ := h
+  exact ⟨roots, value, hgraph.vEnvRealizes, hav, hown⟩
+
+/-- Input ownership plus an arbitrary frame of older absolute slots that a
+later argument/result must not invalidate. -/
+def OwnsVEnvProtected (Γ : VEnv) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => OwnsVEnv Γ rest store env ∧
+    SlotsRealize Γ env slots
+
+/-- A protected lowering environment together with shared-world facts for
+borrowed case fields that later prefix steps may retain. -/
+def OwnsVEnvBorrowed (Γ : VEnv) (rest : List Root)
+    (slots : List (Nat × RVal)) (borrowed : List RVal) : StatePred :=
+  fun store env => OwnsVEnvProtected Γ rest slots store env ∧
+    ∀ value ∈ borrowed, HasWorld store .shared value
+
+/-- Result ownership while preserving every protected absolute slot. -/
+def OwnsResultProtected (Γ : VEnv) (world : Owned) (av : AVal)
+    (rest : List Root) (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => OwnsResult Γ world av rest store env ∧
+    SlotsRealize Γ env slots
+
+def GraphOwnsVEnvProtected (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env =>
+    GraphOwnsVEnv funRel recSelfRel Γ sourceEnv sourceRest rest store env ∧
+    SlotsRealize Γ env slots
+
+/-- Dynamic graph coverage for the borrowed fields that a remaining
+recursor-retain plan may activate.  The source lookup is at the logical
+entry selected by the retain descriptor; the target lookup is carried by
+the protected absolute-slot relation. -/
+def RetainsValueGraphs (funRel : Sim.FunctionRel) (store : Store)
+    (sourceEnv : List IxIR0.Value) (slots : List (Nat × RVal))
+    (borrowed : List RVal) (retains : List RecursorFieldRetain) : Prop :=
+  ∀ retain, retain ∈ retains →
+    ∃ source value,
+      sourceEnv[retain.entry]? = some source ∧
+      (retain.fieldAbs, value) ∈ slots ∧
+      value ∈ borrowed ∧
+      Sim.ValueGraph funRel store source value
+
+/-- Semantic recursor-prefix state.  `extra` contains owned roots (notably
+the major premise) that are intentionally outside the logical source
+environment and will be consumed by a later fixed prefix step. -/
+def GraphOwnsVEnvRetains (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest extra : List Root)
+    (slots : List (Nat × RVal)) (borrowed : List RVal)
+    (retains : List RecursorFieldRetain) : StatePred :=
+  fun store env => ∃ roots,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store (roots ++ extra ++ rest) ∧
+    SlotsRealize Γ env slots ∧
+    (∀ value ∈ borrowed, HasWorld store .shared value) ∧
+    RetainsValueGraphs funRel store sourceEnv slots borrowed retains
+
+theorem RetainsValueGraphs.monoStore {funRel : Sim.FunctionRel}
+    {before after : Store} {sourceEnv : List IxIR0.Value}
+    {slots : List (Nat × RVal)} {borrowed : List RVal}
+    {retains : List RecursorFieldRetain}
+    (hstore : Sim.StoreGraphExtends before after)
+    (hgraphs : RetainsValueGraphs funRel before sourceEnv slots borrowed
+      retains) :
+    RetainsValueGraphs funRel after sourceEnv slots borrowed retains := by
+  intro retain hmember
+  obtain ⟨source, value, hsource, hslot, hborrowed, hvalue⟩ :=
+    hgraphs retain hmember
+  exact ⟨source, value, hsource, hslot, hborrowed,
+    hvalue.monoStore hstore⟩
+
+def GraphOwnsResultProtected (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value) (sourceValue : IxIR0.Value)
+    (world : Owned) (av : AVal)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env =>
+    GraphOwnsResult funRel recSelfRel Γ sourceEnv sourceValue
+      world av sourceRest rest store env ∧
+    SlotsRealize Γ env slots
+
+/-- The soundness proposition attached to one successful `lowerE` result.
+Besides exact ownership it records that the returned descriptor is stable and
+preserves any older absolute slots. The latter is the frame rule required by
+left-to-right `lowerArgs` sequencing. -/
+structure LowerResultSound (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (world : Owned) (emit : Emit) (av : AVal) : Prop where
+  stable : AValStable av
+  emits : ∀ rest slots,
+    EmitSound ctx cur emit (OwnsVEnvProtected input rest slots)
+      (OwnsResultProtected output world av rest slots)
+
+/-- Companion semantic refinement for one expression result. It retains the
+complete ownership theorem as a parent field and separately transports a
+source-environment graph to a graph-related source result. Keeping the two
+transformers separate prevents source values from entering primitive RC and
+frame lemmas. -/
+structure LowerResultValueSound (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (world : Owned)
+    (emit : Emit) (av : AVal) : Prop
+    extends LowerResultSound ctx cur input output world emit av where
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput sourceValue world av sourceRest rest slots)
+
+/-- A mismatched source/logical environment length makes the semantic
+precondition uninhabited. This is the deliberately vacuous branch used by
+rules such as lambda lifting: well-formed callers recover the length equality
+from `VEnvValueGraph`, while the public transformer need not carry it as a
+separate premise. -/
+theorem LowerResultSound.valueSound_of_sourceLength_ne
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSound ctx cur input output world emit av)
+    (hlength : sourceInput.length ≠ input.entries.length) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine { toLowerResultSound := hsound, graphEmits := ?_ }
+  intro sourceRest rest slots post code hcode fuel store env store' value
+    hpre hrun
+  obtain ⟨⟨roots, hgraph, _, _⟩, _⟩ := hpre
+  exact (hlength hgraph.entries.source_length).elim
+
+/-- Fuel-bounded expression-lowering soundness used before recursive
+context contracts have been sealed. -/
+structure LowerResultSoundBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv) (world : Owned)
+    (emit : Emit) (av : AVal) : Prop where
+  stable : AValStable av
+  emits : ∀ rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (OwnsVEnvProtected input rest slots)
+      (OwnsResultProtected output world av rest slots)
+
+/-- Fuel-bounded semantic expression result. Both the ownership transformer
+and its source graph refinement are restricted to the same target evaluator
+bound, which is the contractive interface needed while declaration and apply
+contracts are still being constructed. -/
+structure LowerResultValueSoundBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (world : Owned)
+    (emit : Emit) (av : AVal) : Prop
+    extends LowerResultSoundBelow ctx cur limit input output world emit av where
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput sourceValue world av sourceRest rest slots)
+
+/-- As in the unbounded interface, a source/logical environment length
+mismatch makes the bounded semantic precondition unreachable. -/
+theorem LowerResultSoundBelow.valueSound_of_sourceLength_ne
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSoundBelow ctx cur limit input output world emit av)
+    (hlength : sourceInput.length ≠ input.entries.length) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine { toLowerResultSoundBelow := hsound, graphEmits := ?_ }
+  intro sourceRest rest slots bound hbound post code hcode fuel store env
+    store' value hfuel hpre hrun
+  obtain ⟨⟨roots, hgraph, _, _⟩, _⟩ := hpre
+  exact (hlength hgraph.entries.source_length).elim
+
+/-- An expression result proved uniformly at every fuel bound satisfies the
+unbounded ownership interface. The stable descriptor is fuel-independent;
+only its continuation transformer needs closure through `EmitSound.of_below`.
+-/
+theorem LowerResultSound.of_below {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {world : Owned} {emit : Emit} {av : AVal}
+    (hsound : ∀ limit,
+      LowerResultSoundBelow ctx cur limit input output world emit av) :
+    LowerResultSound ctx cur input output world emit av := by
+  refine ⟨(hsound 0).stable, ?_⟩
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    (hsound limit).emits rest slots
+
+/-- Uniform bounded semantic results close to the existing unbounded
+semantic interface. -/
+theorem LowerResultValueSound.of_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : ∀ limit,
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceInput sourceOutput sourceValue world emit av) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultSound := LowerResultSound.of_below
+        (fun limit => (hsound limit).toLowerResultSoundBelow)
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.of_below fun limit =>
+    (hsound limit).graphEmits sourceRest rest slots
+
+/-- Bounded semantic expression results are contravariant in their target
+evaluator bound. -/
+theorem LowerResultValueSoundBelow.mono
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {smaller larger : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueSoundBelow funRel recSelfRel ctx cur larger
+      input output sourceInput sourceOutput sourceValue world emit av)
+    (hbound : smaller ≤ larger) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur smaller
+      input output sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultSoundBelow :=
+        { stable := hsound.stable
+          emits := by
+            intro rest slots bound hsmall
+            exact hsound.emits rest slots bound
+              (Nat.le_trans hsmall hbound) }
+      graphEmits := ?_ }
+  intro sourceRest rest slots bound hsmall
+  exact hsound.graphEmits sourceRest rest slots bound
+    (Nat.le_trans hsmall hbound)
+
+/-- Logical roots supplied by a borrowing result. A temporary or final-use
+slot still owns one shared root that the projection must release; a repeated
+variable borrow is already owned by the returned `VEnv`. -/
+def borrowResultRoots (release : Bool) (value : RVal) : List Root :=
+  if release then [⟨.shared, value⟩] else []
+
+/-- Successful `lowerBorrow` output: the descriptor resolves to a shared
+borrow, and `release` states whether its owner sits outside the output
+environment and must be consumed by the caller. -/
+def OwnsBorrowResult (Γ : VEnv) (av : AVal) (release : Bool)
+    (rest : List Root) : StatePred :=
+  fun store env => ∃ roots value,
+    VEnvRealizes Γ env roots ∧
+    AValRealizes Γ env av value ∧
+    HasWorld store .shared value ∧
+    RootOwnership store
+      (borrowResultRoots release value ++ roots ++ rest)
+
+def OwnsBorrowResultProtected (Γ : VEnv) (av : AVal)
+    (release : Bool) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => OwnsBorrowResult Γ av release rest store env ∧
+    SlotsRealize Γ env slots
+
+/-- State after `fetch`: the original target and newly pushed field are both
+shared borrows, and no root multiplicity has changed. -/
+def OwnsFetchedBorrowProtected (Γ : VEnv) (target field : AVal)
+    (release : Bool) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => ∃ roots targetValue fieldValue,
+    VEnvRealizes Γ env roots ∧
+    AValRealizes Γ env target targetValue ∧
+    AValRealizes Γ env field fieldValue ∧
+    HasWorld store .shared targetValue ∧
+    HasWorld store .shared fieldValue ∧
+    RootOwnership store
+      (borrowResultRoots release targetValue ++ roots ++ rest) ∧
+    SlotsRealize Γ env slots
+
+/-- State after retaining the fetched field: the field is now the distinct
+owned result root, while a final-use target owner remains pending exactly
+when `release` is true. -/
+def OwnsRetainedProjectionProtected (Γ : VEnv) (target result : AVal)
+    (release : Bool) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => ∃ roots targetValue resultValue,
+    VEnvRealizes Γ env roots ∧
+    AValRealizes Γ env target targetValue ∧
+    AValRealizes Γ env result resultValue ∧
+    HasWorld store .shared targetValue ∧
+    RootOwnership store
+      (⟨.shared, resultValue⟩ ::
+        borrowResultRoots release targetValue ++ roots ++ rest) ∧
+    SlotsRealize Γ env slots
+
+/-- Semantic borrowing result: the borrowed runtime value still realizes the
+source value, while the source environment and caller frame keep their graph
+witnesses. -/
+def GraphOwnsBorrowResultProtected (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value) (sourceValue : IxIR0.Value)
+    (av : AVal) (release : Bool)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => ∃ roots value,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    AValRealizes Γ env av value ∧
+    HasWorld store .shared value ∧
+    Sim.ValueGraph funRel store sourceValue value ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store
+      (borrowResultRoots release value ++ roots ++ rest) ∧
+    SlotsRealize Γ env slots
+
+/-- Semantic state after `fetch`: both the constructor target and selected
+field retain their source graphs, while the field remains only a borrow. -/
+def GraphOwnsFetchedBorrowProtected (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value)
+    (sourceTarget sourceField : IxIR0.Value)
+    (target field : AVal) (release : Bool)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => ∃ roots targetValue fieldValue,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    AValRealizes Γ env target targetValue ∧
+    AValRealizes Γ env field fieldValue ∧
+    HasWorld store .shared targetValue ∧
+    HasWorld store .shared fieldValue ∧
+    Sim.ValueGraph funRel store sourceTarget targetValue ∧
+    Sim.ValueGraph funRel store sourceField fieldValue ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store
+      (borrowResultRoots release targetValue ++ roots ++ rest) ∧
+    SlotsRealize Γ env slots
+
+/-- Semantic state after retaining the fetched field as the owned result. -/
+def GraphOwnsRetainedProjectionProtected (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv : List IxIR0.Value)
+    (sourceTarget sourceField : IxIR0.Value)
+    (target result : AVal) (release : Bool)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => ∃ roots targetValue resultValue,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    AValRealizes Γ env target targetValue ∧
+    AValRealizes Γ env result resultValue ∧
+    HasWorld store .shared targetValue ∧
+    Sim.ValueGraph funRel store sourceTarget targetValue ∧
+    Sim.ValueGraph funRel store sourceField resultValue ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store
+      (⟨.shared, resultValue⟩ ::
+        borrowResultRoots release targetValue ++ roots ++ rest) ∧
+    SlotsRealize Γ env slots
+
+/-- Fuel-bounded soundness package for one successful borrowing-position
+lowering run. -/
+structure LowerBorrowSoundBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv) (emit : Emit) (av : AVal)
+    (release : Bool) : Prop where
+  stable : AValStable av
+  emits : ∀ rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (OwnsVEnvProtected input rest slots)
+      (OwnsBorrowResultProtected output av release rest slots)
+
+/-- Unbounded ownership interface for borrowing-position lowering. -/
+structure LowerBorrowSound (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (emit : Emit) (av : AVal)
+    (release : Bool) : Prop where
+  stable : AValStable av
+  emits : ∀ rest slots,
+    EmitSound ctx cur emit
+      (OwnsVEnvProtected input rest slots)
+      (OwnsBorrowResultProtected output av release rest slots)
+
+theorem LowerBorrowSound.of_below {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {av : AVal} {release : Bool}
+    (hsound : ∀ limit,
+      LowerBorrowSoundBelow ctx cur limit input output emit av release) :
+    LowerBorrowSound ctx cur input output emit av release := by
+  refine ⟨(hsound 0).stable, ?_⟩
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    (hsound limit).emits rest slots
+
+/-- Companion semantic refinement for a borrowing-position result. -/
+structure LowerBorrowValueSound (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (emit : Emit) (av : AVal)
+    (release : Bool) : Prop
+    extends LowerBorrowSound ctx cur input output emit av release where
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput sourceValue av release sourceRest rest slots)
+
+/-- Fuel-bounded semantic borrowing result. -/
+structure LowerBorrowValueSoundBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv)
+    (sourceInput sourceOutput : List IxIR0.Value)
+    (sourceValue : IxIR0.Value) (emit : Emit) (av : AVal)
+    (release : Bool) : Prop
+    extends LowerBorrowSoundBelow ctx cur limit input output emit av release where
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput sourceValue av release sourceRest rest slots)
+
+theorem LowerBorrowValueSound.of_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool}
+    (hsound : ∀ limit,
+      LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceInput sourceOutput sourceValue emit av release) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue emit av release := by
+  refine
+    { toLowerBorrowSound := LowerBorrowSound.of_below
+        (fun limit => (hsound limit).toLowerBorrowSoundBelow)
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.of_below fun limit =>
+    (hsound limit).graphEmits sourceRest rest slots
+
+theorem LowerBorrowValueSoundBelow.mono
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {smaller larger : Nat}
+    {input output : VEnv} {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur larger
+      input output sourceInput sourceOutput sourceValue emit av release)
+    (hbound : smaller ≤ larger) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur smaller
+      input output sourceInput sourceOutput sourceValue emit av release := by
+  refine
+    { toLowerBorrowSoundBelow :=
+        { stable := hsound.stable
+          emits := by
+            intro rest slots bound hsmall
+            exact hsound.emits rest slots bound
+              (Nat.le_trans hsmall hbound) }
+      graphEmits := ?_ }
+  intro sourceRest rest slots bound hsmall
+  exact hsound.graphEmits sourceRest rest slots bound
+    (Nat.le_trans hsmall hbound)
+
+/-- Bounded expression proofs are contravariant in their fuel bound. -/
+theorem LowerResultSoundBelow.mono {ctx : Ctx} {cur : FnDef}
+    {smaller larger : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSoundBelow ctx cur larger input output world emit av)
+    (hbound : smaller ≤ larger) :
+    LowerResultSoundBelow ctx cur smaller input output world emit av := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots bound hsmall
+  exact hsound.emits rest slots bound (Nat.le_trans hsmall hbound)
+
+/-- Forget a released first logical binder from a bounded expression result.
+The physical stack and absolute-slot interpretation are unchanged. -/
+theorem LowerResultSoundBelow.popFirstReleased
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {world : Owned} {emit : Emit} {av : AVal}
+    (hsound : LowerResultSoundBelow ctx cur limit input output world emit av)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultSoundBelow ctx cur limit input output.pop world emit av := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots
+  have hpop : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsResultProtected output world av rest slots)
+      (OwnsResultProtected output.pop world av rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots) hpop
+  simpa [Function.comp_def] using hcomposed
+
+/-- Forget a released first logical binder from an unbounded expression
+result. This is the continuation-level counterpart of `VEnv.pop`. -/
+theorem LowerResultSound.popFirstReleased
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {world : Owned} {emit : Emit} {av : AVal}
+    (hsound : LowerResultSound ctx cur input output world emit av)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultSound ctx cur input output.pop world emit av := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots
+  have hpop : EmitSound ctx cur (_root_.id : Emit)
+      (OwnsResultProtected output world av rest slots)
+      (OwnsResultProtected output.pop world av rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed := EmitSound.comp (hsound.emits rest slots) hpop
+  simpa [Function.comp_def] using hcomposed
+
+/-- The semantic companion removes the corresponding leading source value
+when a let body's released first logical entry is popped. -/
+theorem LowerResultValueSound.popFirstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {world : Owned} {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput (boundSource :: sourceOutput)
+      sourceValue world emit av)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultSound :=
+        hsound.toLowerResultSound.popFirstReleased hfirst
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hpop : EmitSound ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        (boundSource :: sourceOutput) sourceValue world av
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hvalueGraph,
+      hrestGraph, hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots) hpop
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic counterpart of popping a released leading let
+binder. -/
+theorem LowerResultValueSoundBelow.popFirstReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    {world : Owned} {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput (boundSource :: sourceOutput)
+      sourceValue world emit av)
+    (hfirst : FirstEntryReleased output) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.pop sourceInput sourceOutput sourceValue world emit av := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerResultSoundBelow.popFirstReleased hfirst
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hpop : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        (boundSource :: sourceOutput) sourceValue world av
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.pop
+        sourceOutput sourceValue world av sourceRest rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput.pop_firstReleased hfirst,
+      hav.of_depth_eq (by simp [VEnv.pop]), hvalueGraph,
+      hrestGraph, hown⟩, ?_⟩
+    exact SlotsRealize.of_depth_eq (by simp [VEnv.pop]) hslots
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots) hpop
+  simpa [Function.comp_def] using hcomposed
+
+/-- Bounded borrow proofs are contravariant in their evaluator bound. -/
+theorem LowerBorrowSoundBelow.mono {ctx : Ctx} {cur : FnDef}
+    {smaller larger : Nat} {input output : VEnv} {emit : Emit}
+    {av : AVal} {release : Bool}
+    (hsound : LowerBorrowSoundBelow ctx cur larger input output emit av
+      release)
+    (hbound : smaller ≤ larger) :
+    LowerBorrowSoundBelow ctx cur smaller input output emit av release := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots bound hsmall
+  exact hsound.emits rest slots bound (Nat.le_trans hsmall hbound)
+
+/-- Reinterpret an owned shared slot result as a borrowing result whose
+separate owner must be released by the projection caller. -/
+theorem LowerResultSoundBelow.asBorrowSlot
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {abs : Nat}
+    (hsound : LowerResultSoundBelow ctx cur limit input output .shared emit
+      (.slotA abs)) :
+    LowerBorrowSoundBelow ctx cur limit input output emit (.slotA abs)
+      true := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots
+  have hconvert : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsResultProtected output .shared (.slotA abs) rest slots)
+      (OwnsBorrowResultProtected output (.slotA abs) true rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨⟨roots, value, houtput, hav, hworld, ?_⟩, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Stable scalar results carry no heap owner, so their logical result root
+can be forgotten and the value exposed as a non-releasing shared borrow. -/
+theorem LowerResultSoundBelow.asBorrowConst
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {atom : Atom}
+    (hsound : LowerResultSoundBelow ctx cur limit input output .shared emit
+      (.constA atom)) :
+    LowerBorrowSoundBelow ctx cur limit input output emit (.constA atom)
+      false := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots
+  have hconvert : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsResultProtected output .shared (.constA atom) rest slots)
+      (OwnsBorrowResultProtected output (.constA atom) false rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨⟨roots, value, houtput, hav, hworld, ?_⟩, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation (hsound.stable.const_noLocation hav)
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Unbounded counterpart of `asBorrowSlot`: the expression result's shared
+owner becomes the explicit owner that a borrowing caller must eventually
+release. -/
+theorem LowerResultSound.asBorrowSlot
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {abs : Nat}
+    (hsound : LowerResultSound ctx cur input output .shared emit
+      (.slotA abs)) :
+    LowerBorrowSound ctx cur input output emit (.slotA abs) true := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots
+  have hconvert : EmitSound ctx cur (_root_.id : Emit)
+      (OwnsResultProtected output .shared (.slotA abs) rest slots)
+      (OwnsBorrowResultProtected output (.slotA abs) true rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨⟨roots, value, houtput, hav, hworld, ?_⟩, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSound.comp (hsound.emits rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Unbounded scalar adapter. A stable constant has no heap location, so its
+distinguished logical result owner can be forgotten. -/
+theorem LowerResultSound.asBorrowConst
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {atom : Atom}
+    (hsound : LowerResultSound ctx cur input output .shared emit
+      (.constA atom)) :
+    LowerBorrowSound ctx cur input output emit (.constA atom) false := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots
+  have hconvert : EmitSound ctx cur (_root_.id : Emit)
+      (OwnsResultProtected output .shared (.constA atom) rest slots)
+      (OwnsBorrowResultProtected output (.constA atom) false rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨⟨roots, value, houtput, hav, hworld, ?_⟩, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation (hsound.stable.const_noLocation hav)
+  have hcomposed := EmitSound.comp (hsound.emits rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic slot adapter: the result graph is preserved while its shared
+root is reclassified as the borrowing caller's pending owner. -/
+theorem LowerResultValueSound.asBorrowSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {abs : Nat}
+    (hsound : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.slotA abs)) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue emit
+      (.slotA abs) true := by
+  refine
+    { toLowerBorrowSound :=
+        hsound.toLowerResultSound.asBorrowSlot
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSound ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.slotA abs) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic scalar adapter: dropping the ownership-inert result root leaves
+the source/result graph and caller-frame graph unchanged. -/
+theorem LowerResultValueSound.asBorrowConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {atom : Atom}
+    (hsound : LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA atom)) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue emit
+      (.constA atom) false := by
+  refine
+    { toLowerBorrowSound :=
+        hsound.toLowerResultSound.asBorrowConst
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSound ctx cur (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.constA atom) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation (hsound.stable.const_noLocation hav)
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerResultValueSoundBelow.asBorrowSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {abs : Nat}
+    (hsound : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.slotA abs)) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue emit
+      (.slotA abs) true := by
+  refine
+    { toLowerBorrowSoundBelow :=
+        hsound.toLowerResultSoundBelow.asBorrowSlot
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.slotA abs) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.slotA abs) true sourceRest rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerResultValueSoundBelow.asBorrowConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {atom : Atom}
+    (hsound : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA atom)) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue emit
+      (.constA atom) false := by
+  refine
+    { toLowerBorrowSoundBelow :=
+        hsound.toLowerResultSoundBelow.asBorrowConst
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue .shared (.constA atom) sourceRest rest slots)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output sourceOutput
+        sourceValue (.constA atom) false sourceRest rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, hvalueGraph,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    have hworld : HasWorld store .shared value :=
+      hown.roots_world ⟨.shared, value⟩ (by simp)
+    refine ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+      hrestGraph, ?_, hslots⟩
+    simpa [borrowResultRoots] using
+      hown.dropNoLocation (hsound.stable.const_noLocation hav)
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fetch a field through a slot-backed shared borrow. Successful execution
+itself identifies a live shared constructor and in-bounds field; the pushed
+field is tracked as a borrow while every root remains unchanged. -/
+theorem fetchBorrowSlot_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {targetAbs index : Nat} {release : Bool}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (OwnsBorrowResultProtected Γ (.slotA targetAbs) release rest slots)
+      (OwnsFetchedBorrowProtected Γ.bump (.slotA targetAbs)
+        (.slotA Γ.depth) release rest slots) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨roots, targetValue, hΓ, htarget, htargetWorld, hown⟩,
+    hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases targetValue with
+    | lit literal => contradiction
+    | erased => contradiction
+    | loc loc =>
+      obtain ⟨box, hget, hboxWorld⟩ := htargetWorld
+      cases box with
+      | mk boxWorld rc node =>
+        dsimp only [NodeBox.world] at hboxWorld
+        subst boxWorld
+        dsimp only at hrun
+        rw [hget] at hrun
+        dsimp only at hrun
+        cases node with
+        | papN f arity args => contradiction
+        | ctorN cid fields =>
+          dsimp only at hrun
+          cases hfield : fields[index]? with
+          | none =>
+            rw [hfield] at hrun
+            contradiction
+          | some fieldValue =>
+            rw [hfield] at hrun
+            have hpair : (store, fieldValue) = (store', result) :=
+              Except.ok.inj hrun
+            cases hpair
+            refine ⟨roots, .loc loc, result, hΓ.bump result,
+              AValStable.slot.realize_bump htarget result, ?_,
+              ⟨⟨.shared, rc, .ctorN cid fields⟩, hget, rfl⟩,
+              hown.fetchBorrowed hget hfield, hown, hslots.bump result⟩
+            apply AValRealizes.slot
+            · simp [VEnv.bump]
+            · simp [VEnv.bump, VEnv.rel]
+
+theorem fetchBorrowSlot
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {targetAbs index : Nat} {release : Bool}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (OwnsBorrowResultProtected Γ (.slotA targetAbs) release rest slots)
+      (OwnsFetchedBorrowProtected Γ.bump (.slotA targetAbs)
+        (.slotA Γ.depth) release rest slots) :=
+  EmitSound.of_below fun limit =>
+    fetchBorrowSlot_below (ctx := ctx) (cur := cur) (limit := limit)
+
+/-- Semantic fetch selects the runtime field graph at the same index as the
+successful source constructor projection. -/
+theorem fetchBorrowSlot_value_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    OpSound ctx cur (.fetch (.var (Γ.rel targetAbs)) index)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) release
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) release
+        sourceRest rest slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨roots, targetValue, hΓ, htarget, htargetWorld,
+      htargetGraph, hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases targetValue with
+    | lit literal => contradiction
+    | erased => contradiction
+    | loc loc =>
+      obtain ⟨box, hget, hboxWorld⟩ := htargetWorld
+      cases box with
+      | mk boxWorld rc node =>
+        dsimp only [NodeBox.world] at hboxWorld
+        subst boxWorld
+        dsimp only at hrun
+        rw [hget] at hrun
+        dsimp only at hrun
+        cases node with
+        | papN f arity args => contradiction
+        | ctorN cid fields =>
+          dsimp only at hrun
+          cases hfield : fields[index]? with
+          | none =>
+            rw [hfield] at hrun
+            contradiction
+          | some fieldValue =>
+            rw [hfield] at hrun
+            have hpair : (store, fieldValue) = (store', result) :=
+              Except.ok.inj hrun
+            cases hpair
+            obtain ⟨_, _, hfieldsGraph⟩ :=
+              htargetGraph.ctor_fields_of_get hget
+            obtain ⟨relatedField, hrelatedSlot, hfieldGraph⟩ :=
+              hfieldsGraph.get? hsourceField
+            have hrelatedArray :
+                fields[index]? = some relatedField := by
+              simpa using hrelatedSlot
+            have hfieldEq : relatedField = result :=
+              Option.some.inj (hrelatedArray.symm.trans hfield)
+            subst relatedField
+            refine ⟨roots, .loc loc, result, hΓ.bump result,
+              AValStable.slot.realize_bump htarget result, ?_,
+              ⟨⟨.shared, rc, .ctorN cid fields⟩, hget, rfl⟩,
+              hown.fetchBorrowed hget hfield, htargetGraph,
+              hfieldGraph, hrestGraph, hown, hslots.bump result⟩
+            apply AValRealizes.slot
+            · simp [VEnv.bump]
+            · simp [VEnv.bump, VEnv.rel]
+
+theorem fetchBorrowSlot_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    EmitSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) release
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) release
+        sourceRest rest slots) :=
+  OpSound.emit (fetchBorrowSlot_value_op hsourceField)
+
+/-- Fuel-bounded semantic fetch. -/
+theorem fetchBorrowSlot_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {tag : Nat} {sourceFields : List IxIR0.Value}
+    {sourceField : IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        (.ctor address tag sourceFields) (.slotA targetAbs) release
+        sourceRest rest slots)
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ.bump sourceEnv
+        (.ctor address tag sourceFields) sourceField
+        (.slotA targetAbs) (.slotA Γ.depth) release
+        sourceRest rest slots) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, targetValue, hΓ, htarget, htargetWorld,
+      htargetGraph, hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases targetValue with
+    | lit literal => contradiction
+    | erased => contradiction
+    | loc loc =>
+      obtain ⟨box, hget, hboxWorld⟩ := htargetWorld
+      cases box with
+      | mk boxWorld rc node =>
+        dsimp only [NodeBox.world] at hboxWorld
+        subst boxWorld
+        dsimp only at hrun
+        rw [hget] at hrun
+        dsimp only at hrun
+        cases node with
+        | papN f arity args => contradiction
+        | ctorN cid fields =>
+          dsimp only at hrun
+          cases hfield : fields[index]? with
+          | none =>
+            rw [hfield] at hrun
+            contradiction
+          | some fieldValue =>
+            rw [hfield] at hrun
+            have hpair : (store, fieldValue) = (store', result) :=
+              Except.ok.inj hrun
+            cases hpair
+            obtain ⟨_, _, hfieldsGraph⟩ :=
+              htargetGraph.ctor_fields_of_get hget
+            obtain ⟨relatedField, hrelatedSlot, hfieldGraph⟩ :=
+              hfieldsGraph.get? hsourceField
+            have hrelatedArray :
+                fields[index]? = some relatedField := by
+              simpa using hrelatedSlot
+            have hfieldEq : relatedField = result :=
+              Option.some.inj (hrelatedArray.symm.trans hfield)
+            subst relatedField
+            refine ⟨roots, .loc loc, result, hΓ.bump result,
+              AValStable.slot.realize_bump htarget result, ?_,
+              ⟨⟨.shared, rc, .ctorN cid fields⟩, hget, rfl⟩,
+              hown.fetchBorrowed hget hfield, htargetGraph,
+              hfieldGraph, hrestGraph, hown, hslots.bump result⟩
+            apply AValRealizes.slot
+            · simp [VEnv.bump]
+            · simp [VEnv.bump, VEnv.rel]
+
+/-- Retain the fetched field into a fresh owned result slot while preserving
+the original target borrow across the refcount update. -/
+theorem retainFetchedBorrow_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {targetAbs fieldAbs : Nat} {release : Bool}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (OwnsFetchedBorrowProtected Γ (.slotA targetAbs)
+        (.slotA fieldAbs) release rest slots)
+      (OwnsRetainedProjectionProtected Γ.bump (.slotA targetAbs)
+        (.slotA Γ.depth) release rest slots) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, targetValue, fieldValue, hΓ, htarget, hfield,
+    htargetWorld, hfieldWorld, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok fieldValue := by
+    simpa [AVal.toAtom] using hfield.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨nextStore, heval, hownNext, hborrowedNext⟩ :=
+      runOp_retain_borrowed_preserves_hasWorlds
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hfieldWorld hown (borrowed := [targetValue])
+        (by
+          intro candidate hmem
+          simp only [List.mem_singleton] at hmem
+          subst candidate
+          exact htargetWorld)
+    have hpair : (nextStore, fieldValue) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    refine ⟨roots, targetValue, result, hΓ.bump result,
+      AValStable.slot.realize_bump htarget result, ?_,
+      hborrowedNext targetValue (by simp), hownNext,
+      hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+theorem retainFetchedBorrow
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {targetAbs fieldAbs : Nat} {release : Bool}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitSound ctx cur
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (OwnsFetchedBorrowProtected Γ (.slotA targetAbs)
+        (.slotA fieldAbs) release rest slots)
+      (OwnsRetainedProjectionProtected Γ.bump (.slotA targetAbs)
+        (.slotA Γ.depth) release rest slots) :=
+  EmitSound.of_below fun limit =>
+    retainFetchedBorrow_below (ctx := ctx) (cur := cur) (limit := limit)
+
+/-- Semantic retain turns the fetched field graph into a separately owned
+result graph and transports all other witnesses through the RC-only update. -/
+theorem retainFetchedBorrow_value_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs fieldAbs : Nat} {release : Bool}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    OpSound ctx cur (.dup (.var (Γ.rel fieldAbs)))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ sourceEnv
+        sourceTarget sourceField (.slotA targetAbs) (.slotA fieldAbs)
+        release sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA Γ.depth) release sourceRest rest slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨roots, targetValue, fieldValue, hΓ, htarget, hfield,
+      htargetWorld, hfieldWorld, htargetGraph, hfieldGraph,
+      hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok fieldValue := by
+    simpa [AVal.toAtom] using hfield.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨nextStore, heval, hstore, hfieldGraphNext, hownNext⟩ :=
+      runOp_retain_borrowed_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hfieldWorld hfieldGraph hown
+    have hpair : (nextStore, fieldValue) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    refine ⟨roots, targetValue, result,
+      (hΓ.monoStore hstore).bump result,
+      AValStable.slot.realize_bump htarget result, ?_,
+      htargetWorld.monoStore hstore, htargetGraph.monoStore hstore,
+      hfieldGraphNext, hrestGraph.monoStore hstore,
+      hownNext, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+theorem retainFetchedBorrow_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs fieldAbs : Nat} {release : Bool}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSound ctx cur
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ sourceEnv
+        sourceTarget sourceField (.slotA targetAbs) (.slotA fieldAbs)
+        release sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA Γ.depth) release sourceRest rest slots) :=
+  OpSound.emit retainFetchedBorrow_value_op
+
+/-- Fuel-bounded semantic retain of a fetched field. -/
+theorem retainFetchedBorrow_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs fieldAbs : Nat} {release : Bool}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (GraphOwnsFetchedBorrowProtected funRel recSelfRel Γ sourceEnv
+        sourceTarget sourceField (.slotA targetAbs) (.slotA fieldAbs)
+        release sourceRest rest slots)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA Γ.depth) release sourceRest rest slots) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, targetValue, fieldValue, hΓ, htarget, hfield,
+      htargetWorld, hfieldWorld, htargetGraph, hfieldGraph,
+      hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok fieldValue := by
+    simpa [AVal.toAtom] using hfield.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨nextStore, heval, hstore, hfieldGraphNext, hownNext⟩ :=
+      runOp_retain_borrowed_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hfieldWorld hfieldGraph hown
+    have hpair : (nextStore, fieldValue) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    refine ⟨roots, targetValue, result,
+      (hΓ.monoStore hstore).bump result,
+      AValStable.slot.realize_bump htarget result, ?_,
+      htargetWorld.monoStore hstore, htargetGraph.monoStore hstore,
+      hfieldGraphNext, hrestGraph.monoStore hstore,
+      hownNext, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- When the projection target remains owned by the output environment, the
+retained field is already the complete expression result. -/
+theorem retainedProjection_kept_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {target result : AVal} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsRetainedProjectionProtected Γ target result false rest slots)
+      (OwnsResultProtected Γ .shared result rest slots) := by
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+    htargetWorld, hown, hslots⟩ := hpre
+  refine ⟨⟨roots, resultValue, hΓ, hresult, ?_⟩, hslots⟩
+  simpa [borrowResultRoots] using hown
+
+theorem retainedProjection_kept
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {target result : AVal} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSound ctx cur (_root_.id : Emit)
+      (OwnsRetainedProjectionProtected Γ target result false rest slots)
+      (OwnsResultProtected Γ .shared result rest slots) :=
+  EmitSound.of_below fun limit =>
+    retainedProjection_kept_below
+      (ctx := ctx) (cur := cur) (limit := limit)
+
+/-- Semantic kept-target finish: the separately retained field already has
+the graph and exact owner required for the source projection result. -/
+theorem retainedProjection_kept_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {target result : AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSound ctx cur (_root_.id : Emit)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField target result false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ
+        sourceEnv sourceField .shared result sourceRest rest slots) := by
+  apply EmitSound.strengthen
+  intro store env hpre
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+      htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+      hown, hslots⟩ := hpre
+  refine ⟨⟨roots, resultValue, hΓ, hresult, hresultGraph,
+    hrestGraph, ?_⟩, hslots⟩
+  simpa [borrowResultRoots] using hown
+
+/-- Fuel-bounded semantic kept-target finish. -/
+theorem retainedProjection_kept_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {target result : AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField target result false
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ
+        sourceEnv sourceField .shared result sourceRest rest slots) := by
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+      htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+      hown, hslots⟩ := hpre
+  refine ⟨⟨roots, resultValue, hΓ, hresult, hresultGraph,
+    hrestGraph, ?_⟩, hslots⟩
+  simpa [borrowResultRoots] using hown
+
+/-- Release a final-use projection target after retaining its field. The
+inert drop result pushes one slot, while the retained field root and result
+descriptor survive as the expression output. -/
+theorem releaseRetainedProjection_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {targetAbs resultAbs : Nat} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.rel targetAbs))))
+      (OwnsRetainedProjectionProtected Γ (.slotA targetAbs)
+        (.slotA resultAbs) true rest slots)
+      (OwnsResultProtected Γ.bump .shared (.slotA resultAbs) rest slots) := by
+  intro bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hpre hrun
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+    htargetWorld, hown, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes Γ oldEnv roots ∧
+      AValRealizes Γ oldEnv (.slotA resultAbs) resultValue ∧
+      SlotsRealize Γ oldEnv slots
+  let remainingRoots := ⟨Owned.shared, resultValue⟩ :: roots ++ rest
+  have howned : RootOwnership store
+      (⟨.shared, targetValue⟩ :: remainingRoots) := by
+    apply hown.perm
+    simpa [remainingRoots, borrowResultRoots] using
+      (List.Perm.swap ⟨Owned.shared, targetValue⟩
+        ⟨Owned.shared, resultValue⟩ (roots ++ rest))
+  have hnext : CodeOwnsBelow ctx cur bound
+      (OwnsAfterPush frame remainingRoots) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue' hnextFuel
+      hpushed hcodeRun
+    obtain ⟨pushed, oldEnv, rfl, ⟨hΓOld, hresultOld, hslotsOld⟩,
+      hownRest⟩ := hpushed
+    apply hcode hnextFuel
+    · refine ⟨⟨roots, resultValue, hΓOld.bump pushed,
+        AValStable.slot.realize_bump hresultOld pushed, ?_⟩,
+        hslotsOld.bump pushed⟩
+      simpa [remainingRoots] using hownRest
+    · exact hcodeRun
+  have hdrop : CodeOwnsBelow ctx cur bound
+      (fun dropStore dropEnv =>
+        frame dropEnv ∧
+          resolveAtom dropEnv (.var (Γ.rel targetAbs)) =
+            .ok targetValue ∧
+          RootOwnership dropStore
+            (⟨.shared, targetValue⟩ :: remainingRoots))
+      post (emitOp (.drop (.var (Γ.rel targetAbs))) code) :=
+    (emit_drop_value_owned_below (ctx := ctx) (cur := cur)
+      (limit := limit) (target := .var (Γ.rel targetAbs))
+      (value := targetValue) (rest := remainingRoots) (frame := frame))
+      bound hbound post code hnext
+  apply hdrop hfuel
+  · refine ⟨⟨hΓ, hresult, hslots⟩, ?_, howned⟩
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  · exact hrun
+
+theorem releaseRetainedProjection
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {targetAbs resultAbs : Nat} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSound ctx cur
+      (emitOp (.drop (.var (Γ.rel targetAbs))))
+      (OwnsRetainedProjectionProtected Γ (.slotA targetAbs)
+        (.slotA resultAbs) true rest slots)
+      (OwnsResultProtected Γ.bump .shared (.slotA resultAbs) rest slots) :=
+  EmitSound.of_below fun limit =>
+    releaseRetainedProjection_below
+      (ctx := ctx) (cur := cur) (limit := limit)
+
+/-- Semantic final-use finish: after retaining the projected field, dropping
+the target restricts the heap without changing surviving node shapes. The
+result, environment, and caller-frame graphs therefore transport to the
+post-state. -/
+theorem releaseRetainedProjection_value_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs resultAbs : Nat}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    OpSound ctx cur (.drop (.var (Γ.rel targetAbs)))
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA resultAbs) true sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceField .shared (.slotA resultAbs)
+        sourceRest rest slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+      htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+      hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    let remainingRoots :=
+      ⟨Owned.shared, resultValue⟩ :: roots ++ rest
+    have howned : RootOwnership store
+        (⟨.shared, targetValue⟩ :: remainingRoots) := by
+      apply hown.perm
+      simpa [remainingRoots, borrowResultRoots] using
+        (List.Perm.swap ⟨Owned.shared, targetValue⟩
+          ⟨Owned.shared, resultValue⟩ (roots ++ rest))
+    obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+      runOp_drop_value_owned_restricts hresolve howned hrun
+    have hresultWorld : HasWorld store' .shared resultValue :=
+      hownAfter.roots_world ⟨.shared, resultValue⟩
+        (by simp [remainingRoots])
+    have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+        Γ sourceEnv env roots :=
+      hΓ.ofRestricts hrestrict hownAfter
+        (fun root hmember => by
+          simp [remainingRoots, hmember])
+    have hresultAfter : Sim.ValueGraph funRel store'
+        sourceField resultValue :=
+      hresultGraph.ofRestricts hrestrict hownAfter hresultWorld
+    have hrestAfter : Sim.RootsGraph funRel store'
+        sourceRest rest :=
+      hrestGraph.ofRestrictsIn hrestrict hownAfter
+        (fun root hmember => by
+          simp [remainingRoots, hmember])
+    refine ⟨⟨roots, resultValue, hΓAfter.bump .erased,
+      AValStable.slot.realize_bump hresult .erased,
+      hresultAfter, hrestAfter, ?_⟩, hslots.bump .erased⟩
+    simpa [remainingRoots] using hownAfter
+
+theorem releaseRetainedProjection_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs resultAbs : Nat}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSound ctx cur
+      (emitOp (.drop (.var (Γ.rel targetAbs))))
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA resultAbs) true sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceField .shared (.slotA resultAbs)
+        sourceRest rest slots) :=
+  OpSound.emit releaseRetainedProjection_value_op
+
+/-- Fuel-bounded semantic final-use projection finish. -/
+theorem releaseRetainedProjection_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceField : IxIR0.Value}
+    {targetAbs resultAbs : Nat}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.rel targetAbs))))
+      (GraphOwnsRetainedProjectionProtected funRel recSelfRel Γ
+        sourceEnv sourceTarget sourceField (.slotA targetAbs)
+        (.slotA resultAbs) true sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sourceField .shared (.slotA resultAbs)
+        sourceRest rest slots) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, targetValue, resultValue, hΓ, htarget, hresult,
+      htargetWorld, htargetGraph, hresultGraph, hrestGraph,
+      hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    let remainingRoots :=
+      ⟨Owned.shared, resultValue⟩ :: roots ++ rest
+    have howned : RootOwnership store
+        (⟨.shared, targetValue⟩ :: remainingRoots) := by
+      apply hown.perm
+      simpa [remainingRoots, borrowResultRoots] using
+        (List.Perm.swap ⟨.shared, targetValue⟩
+          ⟨.shared, resultValue⟩ (roots ++ rest))
+    obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+      runOp_drop_value_owned_restricts hresolve howned hrun
+    have hresultWorld : HasWorld store' .shared resultValue :=
+      hownAfter.roots_world ⟨.shared, resultValue⟩
+        (by simp [remainingRoots])
+    have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+        Γ sourceEnv env roots :=
+      hΓ.ofRestricts hrestrict hownAfter
+        (fun root hmember => by
+          simp [remainingRoots, hmember])
+    have hresultAfter : Sim.ValueGraph funRel store'
+        sourceField resultValue :=
+      hresultGraph.ofRestricts hrestrict hownAfter hresultWorld
+    have hrestAfter : Sim.RootsGraph funRel store'
+        sourceRest rest :=
+      hrestGraph.ofRestrictsIn hrestrict hownAfter
+        (fun root hmember => by
+          simp [remainingRoots, hmember])
+    refine ⟨⟨roots, resultValue, hΓAfter.bump .erased,
+      AValStable.slot.realize_bump hresult .erased,
+      hresultAfter, hrestAfter, ?_⟩, hslots.bump .erased⟩
+    simpa [remainingRoots] using hownAfter
+
+/-- Finish an erased borrowing result as an ordinary shared expression
+result. Erased values have no heap location, so adding the distinguished
+result root does not change the ownership accounting. -/
+theorem LowerBorrowSoundBelow.returnErased
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {release : Bool}
+    (hsound : LowerBorrowSoundBelow ctx cur limit input output emit
+      (.constA .erased) release) :
+    LowerResultSoundBelow ctx cur limit input output .shared emit
+      (.constA .erased) := by
+  refine ⟨.erased, ?_⟩
+  intro rest slots
+  have hconvert : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsBorrowResultProtected output (.constA .erased) release rest slots)
+      (OwnsResultProtected output .shared (.constA .erased) rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, _, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput, hav, ?_⟩, hslots⟩
+    cases release with
+    | false =>
+      simpa [borrowResultRoots] using
+        hown.addNoLocation (hsound.stable.const_noLocation hav)
+    | true => simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Unbounded erased-borrow finish. Whether or not the borrowing result
+carried a pending logical owner, erased has no heap location and can be
+returned at shared world without changing the store. -/
+theorem LowerBorrowSound.returnErased
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {release : Bool}
+    (hsound : LowerBorrowSound ctx cur input output emit
+      (.constA .erased) release) :
+    LowerResultSound ctx cur input output .shared emit
+      (.constA .erased) := by
+  refine ⟨.erased, ?_⟩
+  intro rest slots
+  have hconvert : EmitSound ctx cur (_root_.id : Emit)
+      (OwnsBorrowResultProtected output (.constA .erased) release rest slots)
+      (OwnsResultProtected output .shared (.constA .erased) rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, value, houtput, hav, _, hown⟩, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput, hav, ?_⟩, hslots⟩
+    cases release with
+    | false =>
+      simpa [borrowResultRoots] using
+        hown.addNoLocation (hsound.stable.const_noLocation hav)
+    | true => simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSound.comp (hsound.emits rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic erased-borrow finish. The erased value graph and all framed
+graphs are preserved while the ownership-inert result root is exposed. -/
+theorem LowerBorrowValueSound.returnErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.constA .erased) release) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultSound :=
+        hsound.toLowerBorrowSound.returnErased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSound ctx cur (_root_.id : Emit)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput .erased (.constA .erased) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput .erased .shared (.constA .erased)
+        sourceRest rest slots) := by
+    apply EmitSound.strengthen
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput, hav, hvalueGraph,
+      hrestGraph, ?_⟩, hslots⟩
+    cases release with
+    | false =>
+      simpa [borrowResultRoots] using
+        hown.addNoLocation (hsound.stable.const_noLocation hav)
+    | true => simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic erased-borrow finish. -/
+theorem LowerBorrowValueSoundBelow.returnErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased emit
+      (.constA .erased) release) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput .erased .shared emit (.constA .erased) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.returnErased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hconvert : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput .erased (.constA .erased) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output
+        sourceOutput .erased .shared (.constA .erased)
+        sourceRest rest slots) := by
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨roots, value, houtput, hav, hworld, hvalueGraph,
+        hrestGraph, hown, hslots⟩ := hpre
+    refine ⟨⟨roots, value, houtput, hav, hvalueGraph,
+      hrestGraph, ?_⟩, hslots⟩
+    cases release with
+    | false =>
+      simpa [borrowResultRoots] using
+        hown.addNoLocation (hsound.stable.const_noLocation hav)
+    | true => simpa [borrowResultRoots] using hown
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots) hconvert
+  simpa [Function.comp_def] using hcomposed
+
+/-- Project through a retained slot borrow while keeping its original owner
+in the output environment. Fetch adds a borrow and `dup` turns that field
+into the owned shared expression result. -/
+theorem LowerBorrowSoundBelow.projectSlotKept
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowSoundBelow ctx cur limit input output emit
+      (.slotA targetAbs) false) :
+    LowerResultSoundBelow ctx cur limit input output.bump.bump .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hfetch := fetchBorrowSlot_below
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+    (targetAbs := targetAbs) (index := index) (release := false)
+    (rest := rest) (slots := slots)
+  have hretain := retainFetchedBorrow_below
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output.bump)
+    (targetAbs := targetAbs) (fieldAbs := output.depth)
+    (release := false) (rest := rest) (slots := slots)
+  have hfinish := retainedProjection_kept_below
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output.bump.bump)
+    (target := .slotA targetAbs) (result := .slotA output.bump.depth)
+    (rest := rest) (slots := slots)
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots)
+    (EmitSoundBelow.comp hfetch (EmitSoundBelow.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Project through a final-use slot borrow, retaining the field before
+dropping the now-consumed target owner. -/
+theorem LowerBorrowSoundBelow.projectSlotReleased
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowSoundBelow ctx cur limit input output emit
+      (.slotA targetAbs) true) :
+    LowerResultSoundBelow ctx cur limit input output.bump.bump.bump .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hfetch := fetchBorrowSlot_below
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+    (targetAbs := targetAbs) (index := index) (release := true)
+    (rest := rest) (slots := slots)
+  have hretain := retainFetchedBorrow_below
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output.bump)
+    (targetAbs := targetAbs) (fieldAbs := output.depth)
+    (release := true) (rest := rest) (slots := slots)
+  have hfinish := releaseRetainedProjection_below
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output.bump.bump)
+    (targetAbs := targetAbs) (resultAbs := output.bump.depth)
+    (rest := rest) (slots := slots)
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots)
+    (EmitSoundBelow.comp hfetch (EmitSoundBelow.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerBorrowSound.projectSlotKept
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowSound ctx cur input output emit
+      (.slotA targetAbs) false) :
+    LowerResultSound ctx cur input output.bump.bump .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hfetch := fetchBorrowSlot
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (targetAbs := targetAbs) (index := index) (release := false)
+    (rest := rest) (slots := slots)
+  have hretain := retainFetchedBorrow
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (targetAbs := targetAbs) (fieldAbs := output.depth)
+    (release := false) (rest := rest) (slots := slots)
+  have hfinish := retainedProjection_kept
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (target := .slotA targetAbs) (result := .slotA output.bump.depth)
+    (rest := rest) (slots := slots)
+  have hcomposed := EmitSound.comp (hsound.emits rest slots)
+    (EmitSound.comp hfetch (EmitSound.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+theorem LowerBorrowSound.projectSlotReleased
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowSound ctx cur input output emit
+      (.slotA targetAbs) true) :
+    LowerResultSound ctx cur input output.bump.bump.bump .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hfetch := fetchBorrowSlot
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (targetAbs := targetAbs) (index := index) (release := true)
+    (rest := rest) (slots := slots)
+  have hretain := retainFetchedBorrow
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (targetAbs := targetAbs) (fieldAbs := output.depth)
+    (release := true) (rest := rest) (slots := slots)
+  have hfinish := releaseRetainedProjection
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (targetAbs := targetAbs) (resultAbs := output.bump.depth)
+    (rest := rest) (slots := slots)
+  have hcomposed := EmitSound.comp (hsound.emits rest slots)
+    (EmitSound.comp hfetch (EmitSound.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-! ### The source evaluator's projection outcomes
+
+Target-side projection is one syntactic form with four descriptor branches,
+while the source evaluator distinguishes only constructor data and the
+erased absorber. `SourceProject` names that source-side dichotomy so a
+single dispatch theorem covers both, and `of_eval` pins it to the real
+evaluator rather than to a hand-written reading of it. -/
+
+/-- The two successful outcomes of `IxIR0.eval`'s `.proj` arm: select a
+constructor field, or absorb into `◻`. -/
+inductive SourceProject (index : Nat) : IxIR0.Value → IxIR0.Value → Prop where
+  | ctor {address : Ixon.Address} {tag : Nat}
+      {fields : List IxIR0.Value} {value : IxIR0.Value} :
+      fields[index]? = some value →
+      SourceProject index (.ctor address tag fields) value
+  | erased : SourceProject index .erased .erased
+
+/-- Every successful source projection over a successful target evaluation
+is one of the two `SourceProject` outcomes. -/
+theorem SourceProject.of_eval {srcCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {index : Nat} {source : IxIR0.Expr}
+    {sourceTarget sourceValue : IxIR0.Value}
+    (htarget : IxIR0.eval srcCtx sourceFuel sourceEnv source =
+      .ok sourceTarget)
+    (hproject : IxIR0.eval srcCtx (sourceFuel + 1) sourceEnv
+      (.proj index source) = .ok sourceValue) :
+    SourceProject index sourceTarget sourceValue := by
+  rw [IxIR0.eval.eq_def] at hproject
+  dsimp only at hproject
+  rw [htarget, bindOk] at hproject
+  cases sourceTarget with
+  | clos uses env body => exact absurd hproject (by simp)
+  | pap head args => exact absurd hproject (by simp)
+  | lit literal => exact absurd hproject (by simp)
+  | erased =>
+    dsimp only at hproject
+    have hvalue : IxIR0.Value.erased = sourceValue :=
+      Except.ok.inj hproject
+    subst hvalue
+    exact .erased
+  | ctor address tag fields =>
+    dsimp only at hproject
+    cases hfield : fields[index]? with
+    | none =>
+      rw [hfield] at hproject
+      exact absurd hproject (by simp)
+    | some field =>
+      rw [hfield] at hproject
+      have hvalue : field = sourceValue := Except.ok.inj hproject
+      subst hvalue
+      exact .ctor hfield
+
+/-- Semantic projection through a retained slot. The source constructor-field
+lookup selects the same field graph that `fetch` returns, and `dup` gives it
+the distinguished shared result owner. -/
+theorem LowerBorrowValueSound.projectSlotKept
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) false)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSound :=
+        hsound.toLowerBorrowSound.projectSlotKept
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hsourceField
+  have hretain := retainFetchedBorrow_value
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := retainedProjection_kept_value
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (target := .slotA targetAbs)
+    (result := .slotA output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots)
+    (EmitSound.comp hfetch (EmitSound.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic projection through a final-use slot. The retained field remains
+graph-related after the target's destructive release because the release
+proof transports every surviving root through the resulting store
+restriction. -/
+theorem LowerBorrowValueSound.projectSlotReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) true)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSound :=
+        hsound.toLowerBorrowSound.projectSlotReleased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hsourceField
+  have hretain := retainFetchedBorrow_value
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := releaseRetainedProjection_value
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output.bump.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (resultAbs := output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots)
+    (EmitSound.comp hfetch (EmitSound.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic projection through a retained slot. -/
+theorem LowerBorrowValueSoundBelow.projectSlotKept
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) false)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.projectSlotKept
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hsourceField
+  have hretain := retainFetchedBorrow_value_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := false)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := retainedProjection_kept_value_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit)
+    (Γ := output.bump.bump) (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (target := .slotA targetAbs)
+    (result := .slotA output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots)
+    (EmitSoundBelow.comp hfetch (EmitSoundBelow.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic projection through a final-use slot. -/
+theorem LowerBorrowValueSoundBelow.projectSlotReleased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceField : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.slotA targetAbs) true)
+    (hsourceField : sourceFields[index]? = some sourceField) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump.bump sourceInput sourceOutput sourceField .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.projectSlotReleased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hfetch := fetchBorrowSlot_value_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+    (sourceEnv := sourceOutput) (address := address) (tag := tag)
+    (targetAbs := targetAbs) (index := index) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+    hsourceField
+  have hretain := retainFetchedBorrow_value_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output.bump)
+    (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (fieldAbs := output.depth) (release := true)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hfinish := releaseRetainedProjection_value_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit)
+    (Γ := output.bump.bump) (sourceEnv := sourceOutput)
+    (sourceTarget := .ctor address tag sourceFields)
+    (sourceField := sourceField) (targetAbs := targetAbs)
+    (resultAbs := output.bump.depth)
+    (sourceRest := sourceRest) (rest := rest) (slots := slots)
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots)
+    (EmitSoundBelow.comp hfetch (EmitSoundBelow.comp hretain hfinish))
+  simpa [Function.comp_def] using hcomposed
+
+/-! ### Projection branches unreachable at their source shape
+
+The compiler chooses a projection branch from the borrow *descriptor*, which
+is independent of the source target's shape. The two mismatched pairings
+below are therefore genuine proof obligations rather than syntactic
+impossibilities, and both are discharged by showing that no execution
+reaches them. -/
+
+/-- Fetching a field from an erased source target can never succeed. The
+borrowed runtime value is either the erased scalar itself or — through the
+abstract function relation — a pap node, and `fetch` rejects both. -/
+theorem fetchErasedSlot_false_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    OpSound ctx cur (.fetch (.var (Γ.rel targetAbs)) index)
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots)
+      (fun _ _ => False) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨roots, targetValue, hΓ, htarget, htargetWorld,
+      htargetGraph, hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases htargetGraph with
+    | erased => contradiction
+    | function hget _ _ =>
+      dsimp only at hrun
+      rw [hget] at hrun
+      dsimp only at hrun
+      contradiction
+
+theorem fetchErasedSlot_false
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitSound ctx cur
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots)
+      (fun _ _ => False) :=
+  OpSound.emit fetchErasedSlot_false_op
+
+/-- Fuel-bounded unreachable fetch from an erased source value. -/
+theorem fetchErasedSlot_false_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {targetAbs index : Nat}
+    {release : Bool} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root} {slots : List (Nat × RVal)} :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.fetch (.var (Γ.rel targetAbs)) index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel Γ sourceEnv
+        .erased (.slotA targetAbs) release sourceRest rest slots)
+      (fun _ _ => False) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, targetValue, hΓ, htarget, htargetWorld,
+      htargetGraph, hrestGraph, hown, hslots⟩ := hpre
+  have hresolve :
+      resolveAtom env (.var (Γ.rel targetAbs)) = .ok targetValue := by
+    simpa [AVal.toAtom] using htarget.resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [hresolve, bindOk] at hrun
+    cases htargetGraph with
+    | erased => contradiction
+    | function hget _ _ =>
+      dsimp only at hrun
+      rw [hget] at hrun
+      dsimp only at hrun
+      contradiction
+
+/-- A constructor-shaped source target is never realized by the erased
+scalar, so the descriptor-absorbing branch is unreachable with constructor
+data. The ownership half is the ordinary erased finish. -/
+theorem LowerBorrowValueSound.projectCtorErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA .erased) release) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceValue .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultSound := hsound.toLowerBorrowSound.returnErased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.ofFalseMid
+  apply EmitSound.comp (hsound.graphEmits sourceRest rest slots)
+  apply EmitSound.strengthen
+  intro store env hpre
+  obtain ⟨roots, value, _, hav, _, hgraph, _, _, _⟩ := hpre
+  cases hav with
+  | const hresolve =>
+    simp only [resolveAtom] at hresolve
+    have hvalue : RVal.erased = value := Except.ok.inj hresolve
+    subst hvalue
+    cases hgraph
+
+/-- Erased-target projection through a retained slot. The emitted `fetch`
+cannot succeed, so the branch transports the source projection result
+whatever it is. -/
+theorem LowerBorrowValueSound.projectSlotKeptErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) false) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSound :=
+        hsound.toLowerBorrowSound.projectSlotKept
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.comp (hsound.graphEmits sourceRest rest slots)
+    (EmitSound.comp
+      (fetchErasedSlot_false (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := output) (sourceEnv := sourceOutput)
+        (targetAbs := targetAbs) (index := index) (release := false)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      EmitSound.ofFalse)
+
+/-- Erased-target projection through a final-use slot: the same unreachable
+`fetch`, one emitted `drop` further along. -/
+theorem LowerBorrowValueSound.projectSlotReleasedErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) true) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump.bump.bump sourceInput sourceOutput sourceValue
+      .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSound :=
+        hsound.toLowerBorrowSound.projectSlotReleased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.comp (hsound.graphEmits sourceRest rest slots)
+    (EmitSound.comp
+      (fetchErasedSlot_false (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := output) (sourceEnv := sourceOutput)
+        (targetAbs := targetAbs) (index := index) (release := true)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      EmitSound.ofFalse)
+
+/-- Fuel-bounded constructor/erased descriptor mismatch. -/
+theorem LowerBorrowValueSoundBelow.projectCtorErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {address : Ixon.Address} {tag : Nat}
+    {sourceFields : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {release : Bool}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput
+      (.ctor address tag sourceFields) emit (.constA .erased) release) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput sourceValue .shared emit
+      (.constA .erased) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.returnErased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.ofFalseMid
+  apply EmitSoundBelow.comp (hsound.graphEmits sourceRest rest slots)
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨roots, value, _, hav, _, hgraph, _, _, _⟩ := hpre
+  cases hav with
+  | const hresolve =>
+    simp only [resolveAtom] at hresolve
+    have hvalue : RVal.erased = value := Except.ok.inj hresolve
+    subst hvalue
+    cases hgraph
+
+/-- Fuel-bounded erased-target projection through a retained slot. -/
+theorem LowerBorrowValueSoundBelow.projectSlotKeptErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) false) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.projectSlotKept
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSoundBelow.comp (hsound.graphEmits sourceRest rest slots)
+    (EmitSoundBelow.comp
+      (fetchErasedSlot_false_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+        (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+        (index := index) (release := false)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      EmitSoundBelow.ofFalse)
+
+/-- Fuel-bounded erased-target projection through a final-use slot. -/
+theorem LowerBorrowValueSoundBelow.projectSlotReleasedErased
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value}
+    {emit : Emit} {targetAbs index : Nat}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput .erased emit
+      (.slotA targetAbs) true) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump.bump.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch (.var (output.rel targetAbs)) index) ∘
+        emitOp (.dup (.var (output.bump.rel output.depth))) ∘
+        emitOp (.drop (.var (output.bump.bump.rel targetAbs))))
+      (.slotA output.bump.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.projectSlotReleased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSoundBelow.comp (hsound.graphEmits sourceRest rest slots)
+    (EmitSoundBelow.comp
+      (fetchErasedSlot_false_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+        (sourceEnv := sourceOutput) (targetAbs := targetAbs)
+        (index := index) (release := true)
+        (sourceRest := sourceRest) (rest := rest) (slots := slots))
+      EmitSoundBelow.ofFalse)
+
+/-- A stable constant can never be the heap node expected by `fetch`.
+Exposing the operation-level contradiction lets later exact-run refinements
+share the same impossible midpoint as the CPS ownership proof. -/
+theorem fetchStableConst_false_op
+    {ctx : Ctx} {cur : FnDef} {atom : Atom} {index : Nat}
+    {pre : StatePred}
+    (hstable : AValStable (.constA atom)) :
+    OpSound ctx cur (.fetch atom index) pre (fun _ _ => False) := by
+  intro fuel store env store' result _ hrun
+  cases hstable <;> cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      simp [resolveAtom, bindOk] at hrun
+
+/-- A stable constant cannot successfully act as a constructor target.
+Consequently the faithfully emitted scalar `fetch` branch is sound by
+vacuity for every successful target execution. -/
+theorem LowerBorrowSoundBelow.projectConst
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {atom : Atom} {index : Nat}
+    {release : Bool}
+    (hsound : LowerBorrowSoundBelow ctx cur limit input output emit
+      (.constA atom) release) :
+    LowerResultSoundBelow ctx cur limit input output.bump .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hfetch : EmitSoundBelow ctx cur limit
+      (emitOp (.fetch atom index))
+      (OwnsBorrowResultProtected output (.constA atom) release rest slots)
+      (OwnsResultProtected output.bump .shared (.slotA output.depth)
+        rest slots) := by
+    apply OpSoundBelow.emit
+    intro fuel store env store' result _ _ hrun
+    cases hsound.stable <;> cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      simp [resolveAtom, bindOk] at hrun
+  have hcomposed := EmitSoundBelow.comp (hsound.emits rest slots) hfetch
+  simpa [Function.comp_def] using hcomposed
+
+/-- Unbounded scalar-target projection. -/
+theorem LowerBorrowSound.projectConst
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {atom : Atom} {index : Nat}
+    {release : Bool}
+    (hsound : LowerBorrowSound ctx cur input output emit
+      (.constA atom) release) :
+    LowerResultSound ctx cur input output.bump .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hfetch : EmitSound ctx cur (emitOp (.fetch atom index))
+      (OwnsBorrowResultProtected output (.constA atom) release rest slots)
+      (OwnsResultProtected output.bump .shared (.slotA output.depth)
+        rest slots) := by
+    apply OpSound.emit
+    intro fuel store env store' result _ hrun
+    cases hsound.stable <;> cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      simp [resolveAtom, bindOk] at hrun
+  have hcomposed := EmitSound.comp (hsound.emits rest slots) hfetch
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic scalar-target projection. Vacuity is independent of the source
+side, so the branch transports whatever the source evaluator produced. -/
+theorem LowerBorrowValueSound.projectConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {emit : Emit} {atom : Atom} {index : Nat} {release : Bool}
+    (hsound : LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceTarget emit
+      (.constA atom) release) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth) := by
+  refine
+    { toLowerResultSound := hsound.toLowerBorrowSound.projectConst
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hfetch : EmitSound ctx cur (emitOp (.fetch atom index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput sourceTarget (.constA atom) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpSound.emit
+    intro fuel store env store' result _ hrun
+    cases hsound.stable <;> cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      simp [resolveAtom, bindOk] at hrun
+  have hcomposed := EmitSound.comp
+    (hsound.graphEmits sourceRest rest slots) hfetch
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic scalar-target projection. -/
+theorem LowerBorrowValueSoundBelow.projectConst
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    {emit : Emit} {atom : Atom} {index : Nat} {release : Bool}
+    (hsound : LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceTarget emit
+      (.constA atom) release) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.fetch atom index)) (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hsound.toLowerBorrowSoundBelow.projectConst
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hfetch : EmitSoundBelow ctx cur limit (emitOp (.fetch atom index))
+      (GraphOwnsBorrowResultProtected funRel recSelfRel output
+        sourceOutput sourceTarget (.constA atom) release
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpSoundBelow.emit
+    intro fuel store env store' result _ _ hrun
+    cases hsound.stable <;> cases fuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      simp [resolveAtom, bindOk] at hrun
+  have hcomposed := EmitSoundBelow.comp
+    (hsound.graphEmits sourceRest rest slots) hfetch
+  simpa [Function.comp_def] using hcomposed
+
+/-! ## Left-to-right argument sequencing -/
+
+/-- Pointwise realization of lowered arguments. The world list is carried in
+lockstep so `rootsForWorlds` is exact rather than truncating. -/
+inductive AValsRealize (Γ : VEnv) (env : List RVal) :
+    List Owned → List AVal → List RVal → Prop where
+  | nil : AValsRealize Γ env [] [] []
+  | cons {world : Owned} {worlds : List Owned} {av : AVal}
+      {avs : List AVal} {value : RVal} {values : List RVal} :
+      AValRealizes Γ env av value →
+      AValsRealize Γ env worlds avs values →
+      AValsRealize Γ env (world :: worlds) (av :: avs) (value :: values)
+
+/-- Dependent lockstep traversal of realized argument worlds, descriptors,
+and runtime values.  The one-descriptor realization and original tail witness
+are preserved for clients alongside the recursively produced result. -/
+theorem AValsRealize.traverse {Γ : VEnv} {env : List RVal}
+    {Result : List Owned → List AVal → List RVal → Prop}
+    (hnil : Result [] [] [])
+    (hcons : ∀ {world : Owned} {worlds : List Owned} {av : AVal}
+        {avs : List AVal} {value : RVal} {values : List RVal},
+      AValRealizes Γ env av value →
+      AValsRealize Γ env worlds avs values →
+      Result worlds avs values →
+      Result (world :: worlds) (av :: avs) (value :: values))
+    {worlds : List Owned} {avs : List AVal} {values : List RVal}
+    (hreal : AValsRealize Γ env worlds avs values) :
+    Result worlds avs values := by
+  induction hreal with
+  | nil => exact hnil
+  | cons hav htail ih => exact hcons hav htail ih
+
+theorem AValsRealize.lengths {Γ : VEnv} {env : List RVal} :
+    ∀ {worlds : List Owned} {avs : List AVal} {values : List RVal},
+      AValsRealize Γ env worlds avs values →
+      worlds.length = avs.length ∧ avs.length = values.length := by
+  intro worlds avs values h
+  exact AValsRealize.traverse
+    (Result := fun currentWorlds currentAvs currentValues =>
+      currentWorlds.length = currentAvs.length ∧
+        currentAvs.length = currentValues.length)
+    (hnil := ⟨rfl, rfl⟩)
+    (hcons := by
+      intro world currentWorlds av currentAvs value currentValues
+        hav htail ih
+      exact ⟨by simp [ih.1], by simp [ih.2]⟩)
+    h
+
+private theorem AValsRealize.resolveAtomsFrom {Γ : VEnv} {env : List RVal} :
+    ∀ {worlds : List Owned} {avs : List AVal} {values : List RVal},
+      AValsRealize Γ env worlds avs values →
+      ∀ accum,
+        (avs.map (·.toAtom Γ)).toArray.foldlM
+          (fun acc atom => do pure (acc ++ [← resolveAtom env atom])) accum =
+        .ok (accum ++ values) := by
+  intro worlds avs values h
+  exact AValsRealize.traverse
+    (Result := fun _ currentAvs currentValues =>
+      ∀ accum,
+        (currentAvs.map (·.toAtom Γ)).toArray.foldlM
+          (fun acc atom => do pure (acc ++ [← resolveAtom env atom]))
+          accum = .ok (accum ++ currentValues))
+    (hnil := by
+      intro accum
+      simp only [List.map_nil, List.foldlM_toArray, List.foldlM_nil,
+        List.append_nil]
+      rfl)
+    (hcons := by
+      intro world currentWorlds av currentAvs value currentValues
+        hav htail ih accum
+      simp only [List.map_cons, List.foldlM_toArray, List.foldlM_cons]
+      rw [hav.resolveAtom]
+      simp only [bindOk]
+      simpa [List.append_assoc] using ih (accum ++ [value]))
+    h
+
+/-- The atom array emitted by `knownCall` resolves to exactly the values
+tracked by `AValsRealize`, in source argument order. -/
+theorem AValsRealize.resolveAtoms {Γ : VEnv} {env : List RVal}
+    {worlds : List Owned} {avs : List AVal} {values : List RVal}
+    (h : AValsRealize Γ env worlds avs values) :
+    resolveAtoms env (avs.map (·.toAtom Γ)).toArray = .ok values := by
+  unfold Ix.Compiler.IxIR1.resolveAtoms
+  simpa using h.resolveAtomsFrom []
+
+theorem rootsForWorlds_replicate_eq_rootsFor (world : Owned) :
+    ∀ {values : List RVal} {count : Nat}, values.length = count →
+      rootsForWorlds (List.replicate count world) values =
+        rootsFor world values := by
+  intro values count hlength
+  induction values generalizing count with
+  | nil =>
+    cases count <;> simp_all [rootsFor, rootsForWorlds]
+  | cons value values ih =>
+    cases count with
+    | zero => simp at hlength
+    | succ count =>
+      simp only [List.length_cons, Nat.succ.injEq] at hlength
+      simp [List.replicate_succ, rootsFor, ih hlength]
+
+/-- Exact state after lowering an argument list: argument roots precede the
+still-held source-environment roots, ready for allocation or a known call. -/
+def OwnsArgsResult (Γ : VEnv) (worlds : List Owned) (avs : List AVal)
+    (rest : List Root) : StatePred :=
+  fun store env => ∃ roots values,
+    VEnvRealizes Γ env roots ∧
+    AValsRealize Γ env worlds avs values ∧
+    RootOwnership store (rootsForWorlds worlds values ++ roots ++ rest)
+
+def OwnsArgsResultProtected (Γ : VEnv) (worlds : List Owned)
+    (avs : List AVal) (rest : List Root)
+    (slots : List (Nat × RVal)) : StatePred :=
+  fun store env => OwnsArgsResult Γ worlds avs rest store env ∧
+    SlotsRealize Γ env slots
+
+/-- Semantic argument-list postcondition. It relates each lowered argument
+to its pure source value and keeps the caller's semantic root frame intact. -/
+def GraphOwnsArgsResult (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv sourceValues : List IxIR0.Value)
+    (worlds : List Owned) (avs : List AVal)
+    (sourceRest : List (Owned × IxIR0.Value))
+    (rest : List Root) : StatePred :=
+  fun store env => ∃ roots values,
+    VEnvValueGraph funRel recSelfRel store Γ sourceEnv env roots ∧
+    AValsRealize Γ env worlds avs values ∧
+    Sim.ValuesGraph funRel store sourceValues values ∧
+    Sim.RootsGraph funRel store sourceRest rest ∧
+    RootOwnership store (rootsForWorlds worlds values ++ roots ++ rest)
+
+def GraphOwnsArgsResultProtected (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (Γ : VEnv)
+    (sourceEnv sourceValues : List IxIR0.Value)
+    (worlds : List Owned) (avs : List AVal)
+    (sourceRest : List (Owned × IxIR0.Value))
+    (rest : List Root) (slots : List (Nat × RVal)) : StatePred :=
+  fun store env =>
+    GraphOwnsArgsResult funRel recSelfRel Γ sourceEnv sourceValues
+      worlds avs sourceRest rest store env ∧
+    SlotsRealize Γ env slots
+
+inductive AValsStable : List AVal → Prop where
+  | nil : AValsStable []
+  | cons {av : AVal} {avs : List AVal} :
+      AValStable av → AValsStable avs → AValsStable (av :: avs)
+
+/-- Source-neutral dependent traversal of stable argument descriptors.
+Absolute-slot descriptors advance the threaded runtime environment; literal
+and erased constants leave it unchanged.  Clients receive the original tail
+stability witness together with the recursively produced result. -/
+theorem AValsStable.traverse
+    {Result : VEnv → List AVal → Prop}
+    (hnil : ∀ Γ, Result Γ [])
+    (hslot : ∀ {Γ : VEnv} {abs : Nat} {avs : List AVal},
+      AValsStable avs → Result Γ.bump avs →
+      Result Γ (.slotA abs :: avs))
+    (hlit : ∀ {Γ : VEnv} {literal : IxIR0.Literal} {avs : List AVal},
+      AValsStable avs → Result Γ avs →
+      Result Γ (.constA (.lit literal) :: avs))
+    (herased : ∀ {Γ : VEnv} {avs : List AVal},
+      AValsStable avs → Result Γ avs →
+      Result Γ (.constA .erased :: avs))
+    {Γ : VEnv} {avs : List AVal} (hstable : AValsStable avs) :
+    Result Γ avs := by
+  induction hstable generalizing Γ with
+  | nil => exact hnil Γ
+  | cons hhead htail ih =>
+    cases hhead with
+    | @slot abs => exact hslot htail (ih (Γ := Γ.bump))
+    | @lit literal => exact hlit htail (ih (Γ := Γ))
+    | erased => exact herased htail (ih (Γ := Γ))
+
+/-- Traverse the raw argument descriptors consumed by `releaseAll` while
+recovering its exact output environment and emitter.  Empty-list,
+constant, and slot normalization happen once; clients provide only their
+result judgment for those three operational cases. -/
+theorem releaseAll_traverse
+    {Result : VEnv → List AVal → VEnv → Emit → Prop}
+    (hnil : ∀ Γ, Result Γ [] Γ (_root_.id : Emit))
+    (hconst : ∀ {Γ : VEnv} {atom : Atom} {avs : List AVal}
+        {output : VEnv} {emit : Emit},
+      Result Γ avs output emit →
+      Result Γ (.constA atom :: avs) output emit)
+    (hslot : ∀ {Γ : VEnv} {abs : Nat} {avs : List AVal}
+        {output : VEnv} {tailEmit : Emit},
+      Result Γ.bump avs output tailEmit →
+      Result Γ (.slotA abs :: avs) output
+        (emitOp (.drop (.var (Γ.rel abs))) ∘ tailEmit))
+    (input : VEnv) (values : List AVal) :
+    Result input values (releaseAll input values).1
+      (releaseAll input values).2 := by
+  exact releaseAll_traverse_core hnil hconst hslot input values
+
+/-- Traverse stable argument descriptors together with an equally sized
+logical source list.  Source-list normalization and the slot/literal/erased
+descriptor split happen once; clients provide only their result judgment at
+the empty and three cons cases. -/
+theorem AValsStable.traverseAligned
+    {α : Type} {Result : VEnv → List α → List AVal → Prop}
+    (hnil : ∀ Γ, Result Γ [] [])
+    (hslot : ∀ {Γ : VEnv} {source : α} {sources : List α}
+        {abs : Nat} {avs : List AVal},
+      AValsStable avs → Result Γ.bump sources avs →
+      Result Γ (source :: sources) (.slotA abs :: avs))
+    (hlit : ∀ {Γ : VEnv} {source : α} {sources : List α}
+        {literal : IxIR0.Literal} {avs : List AVal},
+      AValsStable avs → Result Γ sources avs →
+      Result Γ (source :: sources) (.constA (.lit literal) :: avs))
+    (herased : ∀ {Γ : VEnv} {source : α} {sources : List α}
+        {avs : List AVal},
+      AValsStable avs → Result Γ sources avs →
+      Result Γ (source :: sources) (.constA .erased :: avs))
+    {Γ : VEnv} {sources : List α} {avs : List AVal}
+    (hstable : AValsStable avs) (hlength : sources.length = avs.length) :
+    Result Γ sources avs := by
+  exact (AValsStable.traverse
+    (Result := fun current currentAvs =>
+      ∀ currentSources, currentSources.length = currentAvs.length →
+        Result current currentSources currentAvs)
+    (hnil := by
+      intro current currentSources hcurrentLength
+      cases currentSources with
+      | nil => exact hnil current
+      | cons source sources => simp at hcurrentLength)
+    (hslot := by
+      intro current abs currentAvs htail ih currentSources hcurrentLength
+      cases currentSources with
+      | nil => simp at hcurrentLength
+      | cons source sources =>
+        have htailLength : sources.length = currentAvs.length := by
+          simpa using hcurrentLength
+        exact hslot htail (ih sources htailLength))
+    (hlit := by
+      intro current literal currentAvs htail ih currentSources
+        hcurrentLength
+      cases currentSources with
+      | nil => simp at hcurrentLength
+      | cons source sources =>
+        have htailLength : sources.length = currentAvs.length := by
+          simpa using hcurrentLength
+        exact hlit htail (ih sources htailLength))
+    (herased := by
+      intro current currentAvs htail ih currentSources hcurrentLength
+      cases currentSources with
+      | nil => simp at hcurrentLength
+      | cons source sources =>
+        have htailLength : sources.length = currentAvs.length := by
+          simpa using hcurrentLength
+        exact herased htail (ih sources htailLength))
+    (hstable := hstable)) sources hlength
+
+/-- Stable argument descriptors remain valid after an unrelated operation
+pushes one runtime value. Absolute slots are re-indexed through the bumped
+`VEnv`; constants are environment-independent. -/
+theorem AValsStable.realize_bump {Γ : VEnv} {env : List RVal} :
+    ∀ {worlds : List Owned} {avs : List AVal} {values : List RVal},
+      AValsStable avs →
+      AValsRealize Γ env worlds avs values →
+      ∀ pushed, AValsRealize Γ.bump (pushed :: env) worlds avs values := by
+  intro worlds avs values hstable hreal pushed
+  exact (AValsStable.traverse
+    (Result := fun _ currentAvs =>
+      ∀ {current : VEnv} {currentWorlds : List Owned}
+          {currentValues : List RVal},
+        AValsRealize current env currentWorlds currentAvs currentValues →
+        ∀ pushed,
+          AValsRealize current.bump (pushed :: env)
+            currentWorlds currentAvs currentValues)
+    (hnil := by
+      intro current currentΓ currentWorlds currentValues hcurrent pushed
+      cases hcurrent
+      exact .nil)
+    (hslot := by
+      intro current abs currentAvs htail ih currentΓ currentWorlds
+        currentValues hcurrent pushed
+      cases hcurrent with
+      | cons hav havs =>
+        exact .cons (AValStable.realize_bump .slot hav pushed)
+          (ih havs pushed))
+    (hlit := by
+      intro current literal currentAvs htail ih currentΓ currentWorlds
+        currentValues hcurrent pushed
+      cases hcurrent with
+      | cons hav havs =>
+        exact .cons (AValStable.realize_bump .lit hav pushed)
+          (ih havs pushed))
+    (herased := by
+      intro current currentAvs htail ih currentΓ currentWorlds
+        currentValues hcurrent pushed
+      cases hcurrent with
+      | cons hav havs =>
+        exact .cons (AValStable.realize_bump .erased hav pushed)
+          (ih havs pushed))
+    (Γ := Γ) (hstable := hstable)) hreal pushed
+
+/-- Soundness package for one successful `lowerArgs` result. -/
+structure LowerArgsSound (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (worlds : List Owned)
+    (emit : Emit) (avs : List AVal) : Prop where
+  stable : AValsStable avs
+  emits : ∀ rest slots,
+    EmitSound ctx cur emit (OwnsVEnvProtected input rest slots)
+      (OwnsArgsResultProtected output worlds avs rest slots)
+
+/-- Companion semantic refinement for left-to-right argument lowering. -/
+structure LowerArgsValueSound (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv)
+    (sourceInput sourceOutput sourceValues : List IxIR0.Value)
+    (worlds : List Owned) (emit : Emit) (avs : List AVal) : Prop
+    extends LowerArgsSound ctx cur input output worlds emit avs where
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs sourceRest rest slots)
+
+/-- Fuel-bounded left-to-right argument-lowering soundness. -/
+structure LowerArgsSoundBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv) (worlds : List Owned)
+    (emit : Emit) (avs : List AVal) : Prop where
+  stable : AValsStable avs
+  emits : ∀ rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (OwnsVEnvProtected input rest slots)
+      (OwnsArgsResultProtected output worlds avs rest slots)
+
+/-- Fuel-bounded semantic argument-list result. -/
+structure LowerArgsValueSoundBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv)
+    (sourceInput sourceOutput sourceValues : List IxIR0.Value)
+    (worlds : List Owned) (emit : Emit) (avs : List AVal) : Prop
+    extends LowerArgsSoundBelow ctx cur limit input output worlds emit avs where
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceInput sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs sourceRest rest slots)
+
+/-- Uniform bounded argument soundness closes to the unbounded interface. -/
+theorem LowerArgsSound.of_below {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal}
+    (hsound : ∀ limit,
+      LowerArgsSoundBelow ctx cur limit input output worlds emit avs) :
+    LowerArgsSound ctx cur input output worlds emit avs := by
+  refine ⟨(hsound 0).stable, ?_⟩
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    (hsound limit).emits rest slots
+
+theorem LowerArgsValueSound.of_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hsound : ∀ limit,
+      LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceInput sourceOutput sourceValues worlds emit avs) :
+    LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues worlds emit avs := by
+  refine
+    { toLowerArgsSound := LowerArgsSound.of_below
+        (fun limit => (hsound limit).toLowerArgsSoundBelow)
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.of_below fun limit =>
+    (hsound limit).graphEmits sourceRest rest slots
+
+/-- Bounded argument proofs are contravariant in their fuel bound. -/
+theorem LowerArgsSoundBelow.mono {ctx : Ctx} {cur : FnDef}
+    {smaller larger : Nat} {input output : VEnv}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hsound : LowerArgsSoundBelow ctx cur larger input output worlds emit avs)
+    (hbound : smaller ≤ larger) :
+    LowerArgsSoundBelow ctx cur smaller input output worlds emit avs := by
+  refine ⟨hsound.stable, ?_⟩
+  intro rest slots bound hsmall
+  exact hsound.emits rest slots bound (Nat.le_trans hsmall hbound)
+
+theorem LowerArgsValueSoundBelow.mono
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {smaller larger : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hsound : LowerArgsValueSoundBelow funRel recSelfRel ctx cur larger
+      input output sourceInput sourceOutput sourceValues worlds emit avs)
+    (hbound : smaller ≤ larger) :
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur smaller
+      input output sourceInput sourceOutput sourceValues worlds emit avs := by
+  refine
+    { toLowerArgsSoundBelow :=
+        hsound.toLowerArgsSoundBelow.mono hbound
+      graphEmits := ?_ }
+  intro sourceRest rest slots bound hsmall
+  exact hsound.graphEmits sourceRest rest slots bound
+    (Nat.le_trans hsmall hbound)
+
+/-- Every compiler-generated declaration and every memoized constructor
+wrapper accumulated in a lowering state is present verbatim in the target
+evaluator context. The wrapper clause is deliberately indexed by the shape
+stored in `WrapperMemo`: it is the layout fact needed by partial constructor
+applications, while callable body contracts remain a separate obligation. -/
+structure ExtraRepresented (ctx : Ctx) (state : LowSt) : Prop where
+  decl : ∀ {address decl}, (address, decl) ∈ state.extra →
+    ctx.decls address = some decl
+  wrapper : ∀ {memo : WrapperMemo}, memo ∈ state.wrappers →
+    ctx.decls memo.wrapper =
+      some (ctorWrapperDecl memo.source memo.tag memo.arity)
+
+/-- Exact evaluator contract required only when a logical environment can
+actually expose the synthetic recursor-self entry. -/
+def CurrentSelfContractBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) : Prop :=
+  cur.result = .shared ∧
+    FnOwnershipContractBelow ctx cur
+      (List.replicate cur.arity .shared) limit
+
+/-- The current-function contract is available either substantively, for a
+recursor-rule environment, or vacuously because the logical environment has
+no `recSelf` entry. This is the boundary used by ordinary generated bodies. -/
+def SelfAvailableBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (input : VEnv) : Prop :=
+  CurrentSelfContractBelow ctx cur limit ∨ NoRecSelf input
+
+theorem SelfAvailableBelow.of_contract {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (hcontract : CurrentSelfContractBelow ctx cur limit) :
+    SelfAvailableBelow ctx cur limit input :=
+  Or.inl hcontract
+
+theorem SelfAvailableBelow.of_noRecSelf {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv} (hno : NoRecSelf input) :
+    SelfAvailableBelow ctx cur limit input :=
+  Or.inr hno
+
+/-- Transport self availability through any state-only transformation known
+not to synthesize a recursor-self entry. -/
+theorem SelfAvailableBelow.mapNoRecSelf
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfAvailableBelow ctx cur limit output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfAvailableBelow.bump
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    SelfAvailableBelow ctx cur limit input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfAvailableBelow.pop
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    SelfAvailableBelow ctx cur limit input.pop :=
+  havailable.mapNoRecSelf NoRecSelf.pop
+
+theorem SelfAvailableBelow.setSlot
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (changed abs remaining : Nat) (uses : Uses) (held : Bool) :
+    SelfAvailableBelow ctx cur limit
+      (input.setEntry changed (.slot abs remaining uses held)) :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.setSlot changed abs remaining uses held)
+
+theorem SelfAvailableBelow.consSlot
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input : VEnv}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (abs remaining : Nat) (uses : Uses) (held : Bool) :
+    SelfAvailableBelow ctx cur limit
+      { input with
+        entries := .slot abs remaining uses held :: input.entries } :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.consSlot abs remaining uses held)
+
+theorem SelfAvailableBelow.lowerE
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState) :
+    SelfAvailableBelow ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfAvailableBelow.lowerBorrow
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {release : Bool}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, value, release) finalState) :
+    SelfAvailableBelow ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfAvailableBelow.lowerArgs
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv}
+    {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+    {emit : Emit} {values : List AVal}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, values) finalState) :
+    SelfAvailableBelow ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+theorem SelfAvailableBelow.applyRest
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {resultWorld : Owned}
+    {pre : Emit} {function : AVal} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (havailable : SelfAvailableBelow ctx cur limit input)
+    (hrun : (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, value) finalState) :
+    SelfAvailableBelow ctx cur limit output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).applyRest hrun hno)
+
+/-- Lowering only prepends generated declarations and wrapper memos. Besides
+the two exact suffix equations, the relation records that every newly cached
+memo was installed together with its exact eta-wrapper declaration. This
+turns wrapper-cache reachability into a compositional compiler-state fact. -/
+def ExtraExtends (initial final : LowSt) : Prop :=
+  ∃ (addedExtra : List (Ixon.Address × Decl))
+      (addedWrappers : List WrapperMemo),
+    final.extra = addedExtra ++ initial.extra ∧
+    final.wrappers = addedWrappers ++ initial.wrappers ∧
+    ∀ memo, memo ∈ addedWrappers →
+      (memo.wrapper,
+        ctorWrapperDecl memo.source memo.tag memo.arity) ∈ final.extra
+
+theorem ExtraExtends.refl (state : LowSt) : ExtraExtends state state := by
+  refine ⟨[], [], by simp, by simp, ?_⟩
+  simp
+
+theorem ExtraExtends.trans {first middle final : LowSt}
+    (hfirst : ExtraExtends first middle)
+    (hsecond : ExtraExtends middle final) :
+    ExtraExtends first final := by
+  obtain ⟨leftExtra, leftWrappers, hleftExtra, hleftWrappers,
+    hleftSound⟩ := hfirst
+  obtain ⟨rightExtra, rightWrappers, hrightExtra, hrightWrappers,
+    hrightSound⟩ := hsecond
+  refine ⟨rightExtra ++ leftExtra, rightWrappers ++ leftWrappers,
+    ?_, ?_, ?_⟩
+  · simp [hrightExtra, hleftExtra, List.append_assoc]
+  · simp [hrightWrappers, hleftWrappers, List.append_assoc]
+  · intro memo hmember
+    rw [List.mem_append] at hmember
+    cases hmember with
+    | inl hright => exact hrightSound memo hright
+    | inr hleft =>
+      rw [hrightExtra]
+      exact List.mem_append_right _ (hleftSound memo hleft)
+
+/-- Wrapper memos, like generated declarations, are never removed. -/
+theorem ExtraExtends.wrapper_mem {initial final : LowSt}
+    (hextends : ExtraExtends initial final) {memo : WrapperMemo}
+    (hmember : memo ∈ initial.wrappers) : memo ∈ final.wrappers := by
+  obtain ⟨_, addedWrappers, _, hwrappers, _⟩ := hextends
+  rw [hwrappers]
+  exact List.mem_append_right addedWrappers hmember
+
+/-- Generated declarations, like wrapper memos, are never removed. -/
+theorem ExtraExtends.extra_mem {initial final : LowSt}
+    (hextends : ExtraExtends initial final)
+    {item : Ixon.Address × Decl}
+    (hmember : item ∈ initial.extra) : item ∈ final.extra := by
+  obtain ⟨addedExtra, _, hextra, _, _⟩ := hextends
+  rw [hextra]
+  exact List.mem_append_right addedExtra hmember
+
+/-- A final generated-declaration layout also represents every earlier
+state whose extras are a suffix of that final accumulation. -/
+theorem ExtraRepresented.of_extends {ctx : Ctx} {initial final : LowSt}
+    (hfinal : ExtraRepresented ctx final)
+    (hextends : ExtraExtends initial final) :
+    ExtraRepresented ctx initial := by
+  obtain ⟨addedExtra, addedWrappers, hextra, hwrappers, _⟩ := hextends
+  constructor
+  · intro address decl hmember
+    apply hfinal.decl
+    rw [hextra]
+    exact List.mem_append_right addedExtra hmember
+  · intro memo hmember
+    apply hfinal.wrapper
+    rw [hwrappers]
+    exact List.mem_append_right addedWrappers hmember
+
+/-- A run beginning at the empty compiler state automatically satisfies the
+wrapper half of `ExtraRepresented`: every final memo belongs to the added
+prefix and `ExtraExtends.wrapper_extra` supplies its declaration. -/
+theorem ExtraExtends.represented_of_empty {ctx : Ctx} {final : LowSt}
+    (hextends : ExtraExtends ({} : LowSt) final)
+    (hdecls : ∀ {address decl}, (address, decl) ∈ final.extra →
+      ctx.decls address = some decl) :
+    ExtraRepresented ctx final := by
+  obtain ⟨addedExtra, addedWrappers, _, hwrappers, hwrapperExtra⟩ :=
+    hextends
+  constructor
+  · exact hdecls
+  · intro memo hmember
+    have hwrappers' : final.wrappers = addedWrappers := by
+      simpa using hwrappers
+    have hadded : memo ∈ addedWrappers := by
+      rw [hwrappers'] at hmember
+      exact hmember
+    exact hdecls (hwrapperExtra memo hadded)
+
+/-- Every represented successful expression-lowering run at one compiler
+fuel produces a bounded ownership transformer. Requiring representation only
+for the run's final state keeps the induction valid for the reachable prefix
+of one whole-program lowering trajectory without quantifying over unrelated
+synthetic-address histories. -/
+def LowerEPreservesBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit} {av : AVal},
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerResultSoundBelow ctx cur limit input output world emit av
+
+/-- `freshAddr` changes only the counter. -/
+theorem freshAddr_extraExtends {initial final : LowSt}
+    {address : Ixon.Address}
+    (hrun : freshAddr.run initial = .ok address final) :
+    ExtraExtends initial final := by
+  change EStateM.Result.ok (synthAddr initial.fresh)
+      { initial with fresh := initial.fresh + 1 } =
+    .ok address final at hrun
+  have hstate : { initial with fresh := initial.fresh + 1 } = final :=
+    congrArg
+      (fun result : EStateM.Result String LowSt Ixon.Address =>
+        match result with
+        | .ok _ state | .error _ state => state)
+      hrun
+  subst final
+  refine ⟨[], [], by simp, by simp, ?_⟩
+  simp
+
+/-- Installing one generated declaration prepends exactly one extra. -/
+theorem pushExtra_extraExtends {initial final : LowSt}
+    {item : Ixon.Address × Decl}
+    (hrun : (pushExtra item).run initial = .ok () final) :
+    ExtraExtends initial final := by
+  simp [pushExtra] at hrun
+  subst final
+  refine ⟨[item], [], by simp, by simp, ?_⟩
+  simp
+
+/-- Constructor-wrapper lookup either preserves the extra list (cache hit)
+or prepends the freshly synthesized wrapper declaration (cache miss). -/
+theorem wrapperFor_extraExtends {initial final : LowSt}
+    {source wrapper : Ixon.Address} {tag arity : Nat}
+    (hrun : (wrapperFor source tag arity).run initial =
+      .ok wrapper final) :
+    ExtraExtends initial final := by
+  cases hcached : initial.wrappers.find?
+      (·.matches source tag arity) with
+  | none =>
+    simp [wrapperFor, hcached] at hrun
+    have hstate :
+        { initial with
+            fresh := initial.fresh + 1
+            wrappers :=
+              ⟨source, tag, arity, synthAddr initial.fresh⟩ ::
+                initial.wrappers
+            extra :=
+              (synthAddr initial.fresh,
+                ctorWrapperDecl source tag arity) ::
+                initial.extra } = final := by
+      exact congrArg
+        (fun result : EStateM.Result String LowSt Ixon.Address =>
+          match result with
+          | .ok _ state | .error _ state => state)
+        hrun
+    subst final
+    refine ⟨[(synthAddr initial.fresh,
+        ctorWrapperDecl source tag arity)],
+      [⟨source, tag, arity, synthAddr initial.fresh⟩], rfl, rfl, ?_⟩
+    simp
+  | some memo =>
+    simp [wrapperFor, hcached] at hrun
+    obtain ⟨_, hstate⟩ := hrun
+    subst final
+    exact ExtraExtends.refl _
+
+/-- Every successful wrapper lookup returns the exact shape-indexed memo in
+its output state, on both cache hits and misses. -/
+theorem wrapperFor_memo_mem {initial final : LowSt}
+    {source wrapper : Ixon.Address} {tag arity : Nat}
+    (hrun : (wrapperFor source tag arity).run initial =
+      .ok wrapper final) :
+    (⟨source, tag, arity, wrapper⟩ : WrapperMemo) ∈ final.wrappers := by
+  cases hcached : initial.wrappers.find?
+      (·.matches source tag arity) with
+  | none =>
+    dsimp [wrapperFor] at hrun
+    rw [hcached] at hrun
+    dsimp at hrun
+    injection hrun with _ hstate
+    subst wrapper
+    subst final
+    simp
+  | some memo =>
+    have hmember := List.mem_of_find?_eq_some hcached
+    have hmatch := List.find?_some hcached
+    dsimp [wrapperFor] at hrun
+    rw [hcached] at hrun
+    dsimp at hrun
+    injection hrun with _ hstate
+    subst wrapper
+    subst final
+    rw [WrapperMemo.matches, Bool.and_eq_true, Bool.and_eq_true] at hmatch
+    have hsource := Ixon.Address.eq_of_beq hmatch.1.1
+    have htag : memo.tag = tag := by simpa using hmatch.1.2
+    have harity : memo.arity = arity := by simpa using hmatch.2
+    cases memo
+    simp_all
+
+/-- A lowering-monad action is monotone in the generated-declaration list
+when every successful run only prepends extras. -/
+def ExtraMonotone {α : Type} (action : LowerM α) : Prop :=
+  ∀ {initial final result}, action.run initial = .ok result final →
+    ExtraExtends initial final
+
+theorem ExtraMonotone.pure {α : Type} (value : α) :
+    ExtraMonotone (pure value : LowerM α) := by
+  intro initial final result hrun
+  have hpure : value = result ∧ initial = final := by
+    simpa using hrun
+  obtain ⟨_, hstate⟩ := hpure
+  subst final
+  exact ExtraExtends.refl _
+
+theorem ExtraMonotone.throw {α : Type} (message : String) :
+    ExtraMonotone (throw message : LowerM α) := by
+  intro initial final result hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem ExtraMonotone.throwBind {α β : Type} (message : String)
+    (next : α → LowerM β) :
+    ExtraMonotone ((EStateM.throw message : LowerM α) >>= next) := by
+  intro initial final result hrun
+  change EStateM.Result.error message initial = .ok result final at hrun
+  contradiction
+
+theorem ExtraMonotone.get :
+    ExtraMonotone (get : LowerM LowSt) := by
+  intro initial final result hrun
+  change EStateM.Result.ok initial initial = .ok result final at hrun
+  injection hrun with _ hstate
+  subst final
+  exact ExtraExtends.refl _
+
+theorem ExtraMonotone.bind {α β : Type}
+    {action : LowerM α} {next : α → LowerM β}
+    (haction : ExtraMonotone action)
+    (hnext : ∀ value, ExtraMonotone (next value)) :
+    ExtraMonotone (action >>= next) := by
+  intro initial final result hrun
+  obtain ⟨value, middle, hfirst, hsecond⟩ :=
+    estateBindRun_ok_inv hrun
+  exact (haction hfirst).trans (hnext value hsecond)
+
+theorem ExtraMonotone.map {α β : Type} {action : LowerM α}
+    (haction : ExtraMonotone action) (f : α → β) :
+    ExtraMonotone (f <$> action) := by
+  have hbind : ExtraMonotone
+      (action >>= fun value => (Pure.pure (f value) : LowerM β)) :=
+    ExtraMonotone.bind (action := action)
+      (next := fun value => (Pure.pure (f value) : LowerM β)) haction
+      (fun value => ExtraMonotone.pure (f value))
+  intro initial final result hrun
+  apply hbind
+  simpa only [bind_pure_comp] using hrun
+
+/-- Left-to-right monadic traversal preserves generated-state extension
+when every element action does. -/
+theorem ExtraMonotone.listMapM {α β : Type} (f : α → LowerM β)
+    (hf : ∀ value, ExtraMonotone (f value)) :
+    ∀ values : List α, ExtraMonotone (values.mapM f)
+  | [] => by
+      simpa using (ExtraMonotone.pure ([] : List β))
+  | value :: rest => by
+      rw [List.mapM_cons]
+      apply ExtraMonotone.bind (hf value)
+      intro head
+      apply ExtraMonotone.bind (ExtraMonotone.listMapM f hf rest)
+      intro tail
+      exact ExtraMonotone.pure (head :: tail)
+
+/-- Filtering monadic traversal has the same extension law; discarding a
+`none` result does not affect the threaded compiler state. -/
+theorem ExtraMonotone.listFilterMapM {α β : Type}
+    (f : α → LowerM (Option β))
+    (hf : ∀ value, ExtraMonotone (f value)) :
+    ∀ values : List α, ExtraMonotone (values.filterMapM f)
+  | [] => by
+      simpa using (ExtraMonotone.pure ([] : List β))
+  | value :: rest => by
+      rw [List.filterMapM_cons]
+      apply ExtraMonotone.bind (hf value)
+      intro head
+      cases head with
+      | none => exact ExtraMonotone.listFilterMapM f hf rest
+      | some head =>
+        apply ExtraMonotone.bind
+          (ExtraMonotone.listFilterMapM f hf rest)
+        intro tail
+        exact ExtraMonotone.pure (head :: tail)
+
+/-- Recover the exact element action corresponding to any input member of a
+successful filtering traversal. The suffix extension and optional output
+membership are retained for declaration-level contract proofs. -/
+theorem listFilterMapM_trace {α β : Type}
+    (f : α → LowerM (Option β))
+    (hmono : ∀ item, ExtraMonotone (f item)) :
+    ∀ (items : List α) {initial final : LowSt} {results : List β},
+      (items.filterMapM f).run initial = .ok results final →
+      ∀ {item}, item ∈ items →
+      ∃ itemInitial itemFinal output,
+        (f item).run itemInitial = .ok output itemFinal ∧
+        ExtraExtends itemFinal final ∧
+        ∀ value, output = some value → value ∈ results := by
+  intro items
+  induction items with
+  | nil =>
+    intro initial final results hrun item hmember
+    simp at hmember
+  | cons head tail ih =>
+    intro initial final results hrun item hmember
+    rw [List.filterMapM_cons] at hrun
+    obtain ⟨headOutput, middle, hheadRun, hafterHead⟩ :=
+      estateBindRun_ok_inv hrun
+    cases headOutput with
+    | none =>
+      simp only at hafterHead
+      rw [List.mem_cons] at hmember
+      cases hmember with
+      | inl hitem =>
+        subst item
+        refine ⟨initial, middle, none, hheadRun,
+          ExtraMonotone.listFilterMapM f hmono tail hafterHead, ?_⟩
+        intro value hnone
+        contradiction
+      | inr htail =>
+        exact ih hafterHead htail
+    | some headValue =>
+      obtain ⟨tailResults, tailState, htailRun, hpureRun⟩ :=
+        estateBindRun_ok_inv hafterHead
+      have hpure : headValue :: tailResults = results ∧
+          tailState = final := by
+        simpa [Function.comp_def] using hpureRun
+      obtain ⟨hresults, hstate⟩ := hpure
+      subst results
+      subst final
+      rw [List.mem_cons] at hmember
+      cases hmember with
+      | inl hitem =>
+        subst item
+        refine ⟨initial, middle, some headValue, hheadRun,
+          ExtraMonotone.listFilterMapM f hmono tail htailRun, ?_⟩
+        intro value hvalue
+        have : value = headValue := Option.some.inj hvalue.symm
+        subst value
+        simp
+      | inr htail =>
+        obtain ⟨itemInitial, itemFinal, output, hitemRun, hextends,
+            houtput⟩ := ih htailRun htail
+        refine ⟨itemInitial, itemFinal, output, hitemRun, hextends, ?_⟩
+        intro value hvalue
+        exact List.mem_cons_of_mem _ (houtput value hvalue)
+
+/-- Reverse the filtering traversal for one returned member.  The witness is
+the exact input element action that produced that `some`; state generated by
+earlier and later elements is deliberately left existential. -/
+theorem listFilterMapM_result_trace {α β : Type}
+    (f : α → LowerM (Option β)) :
+    ∀ (items : List α) {initial final : LowSt} {results : List β},
+      (items.filterMapM f).run initial = .ok results final →
+      ∀ {value}, value ∈ results →
+      ∃ item itemInitial itemFinal,
+        item ∈ items ∧
+        (f item).run itemInitial = .ok (some value) itemFinal := by
+  intro items
+  induction items with
+  | nil =>
+      intro initial final results hrun value hmember
+      have hresults : results = [] := by
+        simpa using congrArg
+          (fun result : EStateM.Result String LowSt (List β) =>
+            match result with
+            | .ok values _ => values
+            | .error _ _ => []) hrun.symm
+      subst results
+      simp at hmember
+  | cons head tail ih =>
+      intro initial final results hrun value hmember
+      rw [List.filterMapM_cons] at hrun
+      obtain ⟨headOutput, middle, hheadRun, hafterHead⟩ :=
+        estateBindRun_ok_inv hrun
+      cases headOutput with
+      | none =>
+          obtain ⟨item, itemInitial, itemFinal, hitem, hitemRun⟩ :=
+            ih hafterHead hmember
+          exact ⟨item, itemInitial, itemFinal,
+            List.mem_cons_of_mem head hitem, hitemRun⟩
+      | some headValue =>
+          obtain ⟨tailResults, tailState, htailRun, hpureRun⟩ :=
+            estateBindRun_ok_inv hafterHead
+          have hpure : headValue :: tailResults = results ∧
+              tailState = final := by
+            simpa [Function.comp_def] using hpureRun
+          obtain ⟨hresults, hstate⟩ := hpure
+          subst results
+          subst final
+          rw [List.mem_cons] at hmember
+          cases hmember with
+          | inl hvalue =>
+              subst value
+              exact ⟨head, initial, middle, by simp, hheadRun⟩
+          | inr htail =>
+              obtain ⟨item, itemInitial, itemFinal, hitem, hitemRun⟩ :=
+                ih htailRun htail
+              exact ⟨item, itemInitial, itemFinal,
+                List.mem_cons_of_mem head hitem, hitemRun⟩
+
+theorem freshAddr_extraMonotone : ExtraMonotone freshAddr :=
+  fun hrun => freshAddr_extraExtends hrun
+
+theorem pushExtra_extraMonotone (item : Ixon.Address × Decl) :
+    ExtraMonotone (pushExtra item) :=
+  fun hrun => pushExtra_extraExtends hrun
+
+theorem wrapperFor_extraMonotone (source : Ixon.Address)
+    (tag arity : Nat) : ExtraMonotone (wrapperFor source tag arity) :=
+  fun hrun => wrapperFor_extraExtends hrun
+
+/-- Entry cleanup emits code and rewrites `VEnv`, but cannot add generated
+declarations. -/
+theorem releaseSlots_extraMonotone (input : VEnv) :
+    ∀ drops : List SlotDrop, ExtraMonotone (releaseSlots input drops) := by
+  exact releaseSlots_action_core
+    (ActionProperty := fun {α : Type} (action : LowerM α) =>
+      ExtraMonotone action)
+    (hpure := fun value => ExtraMonotone.pure value)
+    (hbind := fun haction hnext => ExtraMonotone.bind haction hnext)
+    (hthrowBind := fun message next =>
+      ExtraMonotone.throwBind message next)
+    input
+
+/-- Generated-declaration monotonicity for every expression action at one
+compiler-fuel index. This is intentionally independent of evaluator
+ownership soundness. -/
+def LowerEExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input world expr, ExtraMonotone (lowerE src fuel input world expr)
+
+/-- Generated-declaration monotonicity for every closed-body action at one
+compiler-fuel index. -/
+def LowerFnBodyExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input drops world body,
+    ExtraMonotone (lowerFnBody src fuel input drops world body)
+
+def LowerLamExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input expr, ExtraMonotone (lowerLam src fuel input expr)
+
+def LowerBorrowExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input expr, ExtraMonotone (lowerBorrow src fuel input expr)
+
+def LowerSpineExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input world head args,
+    ExtraMonotone (lowerSpine src fuel input world head args)
+
+def KnownCallExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input build count argWorlds resultWorld args,
+    ExtraMonotone
+      (knownCall src fuel input build count argWorlds resultWorld args)
+
+def LowerArgsExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input args, ExtraMonotone (lowerArgs src fuel input args)
+
+def ApplyRestExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input resultWorld pre function args,
+    ExtraMonotone
+      (applyRest src fuel input resultWorld pre function args)
+
+/-- The complete state-only invariant for the mutually recursive lowering
+cluster at one compiler-fuel index. -/
+structure LowerExtraMonotone (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEExtraMonotone src fuel
+  borrow : LowerBorrowExtraMonotone src fuel
+  spine : LowerSpineExtraMonotone src fuel
+  knownCall : KnownCallExtraMonotone src fuel
+  args : LowerArgsExtraMonotone src fuel
+  applyRest : ApplyRestExtraMonotone src fuel
+  lam : LowerLamExtraMonotone src fuel
+  fnBody : LowerFnBodyExtraMonotone src fuel
+
+/-- Result-world checks inspect no compiler state. -/
+theorem requireResultWorld_extraMonotone (actual demand : Owned) :
+    ExtraMonotone (requireResultWorld actual demand) := by
+  cases actual <;> cases demand <;>
+    simp [requireResultWorld] <;>
+    first | exact ExtraMonotone.pure _ | exact ExtraMonotone.throw _
+
+theorem lowerFnBodyExtraMonotone_zero (src : IxIR0.Env) :
+    LowerFnBodyExtraMonotone src 0 := by
+  intro input drops world body
+  simp only [lowerFnBody]
+  exact ExtraMonotone.throw _
+
+/-- A body action only sequences entry cleanup, predecessor-fuel expression
+lowering, and a pure `ret` closure. -/
+theorem lowerFnBodyExtraMonotone_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel) :
+    LowerFnBodyExtraMonotone src (fuel + 1) := by
+  intro input drops world body
+  simp only [lowerFnBody]
+  apply ExtraMonotone.bind (releaseSlots_extraMonotone input drops)
+  intro releaseResult
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  apply ExtraMonotone.bind (hexpr middle world body)
+  intro bodyResult
+  rcases bodyResult with ⟨output, bodyEmit, value⟩
+  exact ExtraMonotone.pure
+    (releaseEmit (bodyEmit (.ret (value.toAtom output))))
+
+theorem lowerExtraMonotone_zero (src : IxIR0.Env) :
+    LowerExtraMonotone src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr
+    simp only [lowerE]
+    exact ExtraMonotone.throw _
+  · intro input expr
+    simp only [lowerBorrow]
+    exact ExtraMonotone.throw _
+  · intro input world head args
+    simp only [lowerSpine]
+    exact ExtraMonotone.throw _
+  · intro input build count argWorlds resultWorld args
+    simp only [knownCall]
+    exact ExtraMonotone.throw _
+  · intro input args
+    simp only [lowerArgs]
+    exact ExtraMonotone.throw _
+  · intro input resultWorld pre function args
+    simp only [applyRest]
+    exact ExtraMonotone.throw _
+  · intro input expr
+    simp only [lowerLam]
+    exact ExtraMonotone.throw _
+  · exact lowerFnBodyExtraMonotone_zero src
+
+/-- Compile-state companion to semantic expression preservation. A body
+started with a correctly counted first binder releases that binder on every
+successful lowering run. Keeping this obligation separate avoids weakening
+`LowerResultSoundBelow` with compiler-internal entry arithmetic. -/
+def LowerEReleasesTrackedFirst (src : IxIR0.Env) (fuel : Nat)
+    (expr : IxIR0.Expr) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {uses : Uses} {state finalState : LowSt} {emit : Emit} {av : AVal},
+    FirstEntryTracks input uses (countUses 0 expr) →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    FirstEntryReleased output
+
+/-- Every successful borrowing-position run at one compiler fuel produces a
+shared borrowed descriptor and records whether its owner must be released. -/
+def LowerBorrowPreservesBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit}
+      {av : AVal} {release : Bool},
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerBorrowSoundBelow ctx cur limit input output emit av release
+
+/-- Every successful argument-lowering run at one compiler fuel produces the
+bounded left-to-right argument transformer. -/
+def LowerArgsPreservesBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {args : List (IxIR0.Expr × Owned)}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {avs : List AVal},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerArgsSoundBelow ctx cur limit input output
+      (args.map Prod.snd) emit avs
+
+/-- Successful `applyRest` runs preserve a previously produced shared
+function result. This premise-parametric form composes both syntactic erased
+absorption and genuine higher-order application. -/
+def ApplyRestPreservesBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {start input : VEnv} {resultWorld : Owned} {pre : Emit}
+      {function : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {av : AVal},
+    LowerResultSoundBelow ctx cur limit start input .shared pre function →
+    (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerResultSoundBelow ctx cur limit start output resultWorld emit av
+
+/-- Successful `knownCall` runs preserve ownership for one fixed operation
+builder and argument telescope. Operation-specific dispatch supplies the
+builder's result-world rule. -/
+def KnownCallPreservesBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) (build : Array Atom → Op)
+    (count : Nat) (argWorlds : List Owned) (resultWorld : Owned) : Prop :=
+  ∀ {input : VEnv} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {av : AVal},
+    (knownCall src fuel input build count argWorlds resultWorld args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerResultSoundBelow ctx cur limit input output resultWorld emit av
+
+/-- Successful application-spine lowering at one compiler fuel. -/
+def LowerSpinePreservesBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {head : IxIR0.Expr}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {av : AVal},
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerResultSoundBelow ctx cur limit input output world emit av
+
+private theorem lowerArgs_nil_sound_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} :
+    LowerArgsSoundBelow ctx cur limit Γ Γ [] (_root_.id : Emit) [] := by
+  refine ⟨AValsStable.nil, ?_⟩
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, [], hΓ, .nil, by simpa [rootsForWorlds] using hown⟩,
+    hslots⟩
+
+theorem lowerArgs_nil_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv} :
+    LowerArgsSound ctx cur Γ Γ [] (_root_.id : Emit) [] := by
+  apply LowerArgsSound.of_below
+  intro limit
+  exact lowerArgs_nil_sound_at (limit := limit)
+
+theorem lowerArgs_nil_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} :
+    LowerArgsValueSound funRel recSelfRel ctx cur Γ Γ
+      sourceEnv sourceEnv [] [] (_root_.id : Emit) [] := by
+  refine
+    { toLowerArgsSound := lowerArgs_nil_sound
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, [], hΓ, .nil, .nil, hrestGraph,
+    by simpa [rootsForWorlds] using hown⟩, hslots⟩
+
+/-- Bounded base case for left-to-right argument lowering. -/
+theorem lowerArgs_nil_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} :
+    LowerArgsSoundBelow ctx cur limit Γ Γ [] (_root_.id : Emit) [] := by
+  exact lowerArgs_nil_sound_at
+
+theorem lowerArgs_nil_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} :
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv [] [] (_root_.id : Emit) [] := by
+  refine
+    { toLowerArgsSoundBelow := lowerArgs_nil_sound_below
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, [], hΓ, .nil, .nil, hrestGraph,
+    by simpa [rootsForWorlds] using hown⟩, hslots⟩
+
+/-- The central `lowerArgs` cons rule. The head result becomes a protected
+absolute slot while the tail is emitted; on completion it is realized again
+and moved from the tail continuation into the argument-root prefix. -/
+theorem LowerResultSound.consArgs {ctx : Ctx} {cur : FnDef}
+    {input middle output : VEnv} {world : Owned} {worlds : List Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    (head : LowerResultSound ctx cur input middle world emitHead av)
+    (tail : LowerArgsSound ctx cur middle output worlds emitTail avs) :
+    LowerArgsSound ctx cur input output (world :: worlds)
+      (emitHead ∘ emitTail) (av :: avs) := by
+  refine ⟨AValsStable.cons head.stable tail.stable, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (head.emits rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hmid hrun
+  obtain ⟨⟨envRoots, value, hmiddle, hav, hown⟩, hslots⟩ := hmid
+  let root : Root := ⟨world, value⟩
+  have hprotect : SlotsRealize middle env (aValProtection av value) :=
+    head.stable.protection_realized hav
+  have htailOwn : RootOwnership store (envRoots ++ root :: rest) := by
+    apply hown.perm
+    simpa [root] using
+      (perm_extract_root root envRoots [] rest).symm
+  have htailPre : OwnsVEnvProtected middle (root :: rest)
+      (aValProtection av value ++ slots) store env :=
+    ⟨⟨envRoots, hmiddle, htailOwn⟩, hprotect.append hslots⟩
+  have htailCont : CodeOwns ctx cur
+      (OwnsArgsResultProtected output worlds avs (root :: rest)
+        (aValProtection av value ++ slots)) post code := by
+    intro innerFuel innerStore innerEnv resultStore resultValue htailPost hcodeRun
+    obtain ⟨⟨outRoots, values, houtput, havs, hownTail⟩,
+      hslotsTail⟩ := htailPost
+    have havFinal : AValRealizes output innerEnv av value :=
+      head.stable.realize_of_protection hav hslotsTail.left_of_append
+    have hownFinal : RootOwnership innerStore
+        (rootsForWorlds (world :: worlds) (value :: values) ++
+          outRoots ++ rest) := by
+      apply hownTail.perm
+      simpa [root, List.append_assoc] using
+        (perm_extract_root root
+          (rootsForWorlds worlds values ++ outRoots) [] rest)
+    apply hcode
+    · exact ⟨⟨outRoots, value :: values, houtput,
+        .cons havFinal havs, hownFinal⟩, hslotsTail.right_of_append⟩
+    · exact hcodeRun
+  have htailCode : CodeOwns ctx cur
+      (OwnsVEnvProtected middle (root :: rest)
+        (aValProtection av value ++ slots)) post (emitTail code) :=
+    tail.emits (root :: rest) (aValProtection av value ++ slots)
+      post code htailCont
+  exact htailCode htailPre hrun
+
+/-- Semantic argument sequencing. The head result is framed for the tail as
+one related source/target root; the tail postcondition returns that
+`RootsGraph`, so the head `ValueGraph` remains available in the final store. -/
+theorem LowerResultValueSound.consArgs {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {sourceValues : List IxIR0.Value}
+    {world : Owned} {worlds : List Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    (head : LowerResultValueSound funRel recSelfRel ctx cur input middle
+      sourceInput sourceMiddle sourceValue world emitHead av)
+    (tail : LowerArgsValueSound funRel recSelfRel ctx cur middle output
+      sourceMiddle sourceOutput sourceValues worlds emitTail avs) :
+    LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput (sourceValue :: sourceValues)
+      (world :: worlds) (emitHead ∘ emitTail) (av :: avs) := by
+  refine
+    { toLowerArgsSound := head.toLowerResultSound.consArgs
+        tail.toLowerArgsSound
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (head.graphEmits sourceRest rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hmid hrun
+  obtain ⟨⟨envRoots, value, hmiddle, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hmid
+  let root : Root := ⟨world, value⟩
+  have hrootWorld : HasWorld store world value := by
+    apply hown.roots_world root
+    simp [root]
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((world, sourceValue) :: sourceRest) (root :: rest) :=
+    .cons rfl hrootWorld hvalueGraph hrestGraph
+  have hprotect : SlotsRealize middle env (aValProtection av value) :=
+    head.stable.protection_realized hav
+  have htailOwn : RootOwnership store (envRoots ++ root :: rest) := by
+    apply hown.perm
+    simpa [root] using
+      (perm_extract_root root envRoots [] rest).symm
+  have htailPre : GraphOwnsVEnvProtected funRel recSelfRel middle
+      sourceMiddle ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots) store env :=
+    ⟨⟨envRoots, hmiddle, hframeGraph, htailOwn⟩,
+      hprotect.append hslots⟩
+  have htailCont : CodeOwns ctx cur
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs
+        ((world, sourceValue) :: sourceRest) (root :: rest)
+        (aValProtection av value ++ slots)) post code := by
+    intro innerFuel innerStore innerEnv resultStore resultValue
+      htailPost hcodeRun
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownTail⟩, hslotsTail⟩ := htailPost
+    cases hframeGraphFinal with
+    | cons _ _ hheadGraph hrestGraphFinal =>
+      have havFinal : AValRealizes output innerEnv av value :=
+        head.stable.realize_of_protection hav
+          hslotsTail.left_of_append
+      have hheadGraph' :
+          Sim.ValueGraph funRel innerStore sourceValue value := by
+        simpa [root] using hheadGraph
+      have hownFinal : RootOwnership innerStore
+          (rootsForWorlds (world :: worlds) (value :: values) ++
+            outRoots ++ rest) := by
+        apply hownTail.perm
+        simpa [root, List.append_assoc] using
+          (perm_extract_root root
+            (rootsForWorlds worlds values ++ outRoots) [] rest)
+      apply hcode
+      · exact ⟨⟨outRoots, value :: values, houtput,
+          .cons havFinal havs, .cons hheadGraph' hvalueGraphs,
+          hrestGraphFinal, hownFinal⟩,
+          hslotsTail.right_of_append⟩
+      · exact hcodeRun
+  have htailCode : CodeOwns ctx cur
+      (GraphOwnsVEnvProtected funRel recSelfRel middle sourceMiddle
+        ((world, sourceValue) :: sourceRest) (root :: rest)
+        (aValProtection av value ++ slots)) post (emitTail code) :=
+    tail.graphEmits ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots) post code htailCont
+  exact htailCode htailPre hrun
+
+/-- Fuel-bounded argument sequencing. The hereditary emitter bound lets the
+head protect its result slot across the recursively emitted tail exactly as
+in `LowerResultSound.consArgs`. -/
+theorem LowerResultSoundBelow.consArgs {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input middle output : VEnv}
+    {world : Owned} {worlds : List Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    (head : LowerResultSoundBelow ctx cur limit input middle world
+      emitHead av)
+    (tail : LowerArgsSoundBelow ctx cur limit middle output worlds
+      emitTail avs) :
+    LowerArgsSoundBelow ctx cur limit input output (world :: worlds)
+      (emitHead ∘ emitTail) (av :: avs) := by
+  refine ⟨AValsStable.cons head.stable tail.stable, ?_⟩
+  intro rest slots
+  apply EmitSoundBelow.comp (head.emits rest slots)
+  intro bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hmid hrun
+  obtain ⟨⟨envRoots, value, hmiddle, hav, hown⟩, hslots⟩ := hmid
+  let root : Root := ⟨world, value⟩
+  have hprotect : SlotsRealize middle env (aValProtection av value) :=
+    head.stable.protection_realized hav
+  have htailOwn : RootOwnership store (envRoots ++ root :: rest) := by
+    apply hown.perm
+    simpa [root] using
+      (perm_extract_root root envRoots [] rest).symm
+  have htailPre : OwnsVEnvProtected middle (root :: rest)
+      (aValProtection av value ++ slots) store env :=
+    ⟨⟨envRoots, hmiddle, htailOwn⟩, hprotect.append hslots⟩
+  have htailCont : CodeOwnsBelow ctx cur bound
+      (OwnsArgsResultProtected output worlds avs (root :: rest)
+        (aValProtection av value ++ slots)) post code := by
+    intro innerFuel innerStore innerEnv resultStore resultValue hinnerFuel
+      htailPost hcodeRun
+    obtain ⟨⟨outRoots, values, houtput, havs, hownTail⟩,
+      hslotsTail⟩ := htailPost
+    have havFinal : AValRealizes output innerEnv av value :=
+      head.stable.realize_of_protection hav hslotsTail.left_of_append
+    have hownFinal : RootOwnership innerStore
+        (rootsForWorlds (world :: worlds) (value :: values) ++
+          outRoots ++ rest) := by
+      apply hownTail.perm
+      simpa [root, List.append_assoc] using
+        (perm_extract_root root
+          (rootsForWorlds worlds values ++ outRoots) [] rest)
+    apply hcode hinnerFuel
+    · exact ⟨⟨outRoots, value :: values, houtput,
+        .cons havFinal havs, hownFinal⟩, hslotsTail.right_of_append⟩
+    · exact hcodeRun
+  have htailCode : CodeOwnsBelow ctx cur bound
+      (OwnsVEnvProtected middle (root :: rest)
+        (aValProtection av value ++ slots)) post (emitTail code) :=
+    tail.emits (root :: rest) (aValProtection av value ++ slots)
+      bound hbound post code htailCont
+  exact htailCode hfuel htailPre hrun
+
+/-- Fuel-bounded semantic argument sequencing. -/
+theorem LowerResultValueSoundBelow.consArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {sourceValues : List IxIR0.Value}
+    {world : Owned} {worlds : List Owned}
+    {emitHead emitTail : Emit} {av : AVal} {avs : List AVal}
+    (head : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle sourceValue world emitHead av)
+    (tail : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      middle output sourceMiddle sourceOutput sourceValues worlds
+      emitTail avs) :
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceInput sourceOutput (sourceValue :: sourceValues)
+      (world :: worlds) (emitHead ∘ emitTail) (av :: avs) := by
+  refine
+    { toLowerArgsSoundBelow := head.toLowerResultSoundBelow.consArgs
+        tail.toLowerArgsSoundBelow
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (head.graphEmits sourceRest rest slots)
+  intro bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hmid hrun
+  obtain ⟨⟨envRoots, value, hmiddle, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hmid
+  let root : Root := ⟨world, value⟩
+  have hrootWorld : HasWorld store world value := by
+    apply hown.roots_world root
+    simp [root]
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((world, sourceValue) :: sourceRest) (root :: rest) :=
+    .cons rfl hrootWorld hvalueGraph hrestGraph
+  have hprotect : SlotsRealize middle env (aValProtection av value) :=
+    head.stable.protection_realized hav
+  have htailOwn : RootOwnership store (envRoots ++ root :: rest) := by
+    apply hown.perm
+    simpa [root] using
+      (perm_extract_root root envRoots [] rest).symm
+  have htailPre : GraphOwnsVEnvProtected funRel recSelfRel middle
+      sourceMiddle ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots) store env :=
+    ⟨⟨envRoots, hmiddle, hframeGraph, htailOwn⟩,
+      hprotect.append hslots⟩
+  have htailCont : CodeOwnsBelow ctx cur bound
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues worlds avs
+        ((world, sourceValue) :: sourceRest) (root :: rest)
+        (aValProtection av value ++ slots)) post code := by
+    intro innerFuel innerStore innerEnv resultStore resultValue hinnerFuel
+      htailPost hcodeRun
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownTail⟩, hslotsTail⟩ := htailPost
+    cases hframeGraphFinal with
+    | cons _ _ hheadGraph hrestGraphFinal =>
+      have havFinal : AValRealizes output innerEnv av value :=
+        head.stable.realize_of_protection hav
+          hslotsTail.left_of_append
+      have hheadGraph' :
+          Sim.ValueGraph funRel innerStore sourceValue value := by
+        simpa [root] using hheadGraph
+      have hownFinal : RootOwnership innerStore
+          (rootsForWorlds (world :: worlds) (value :: values) ++
+            outRoots ++ rest) := by
+        apply hownTail.perm
+        simpa [root, List.append_assoc] using
+          (perm_extract_root root
+            (rootsForWorlds worlds values ++ outRoots) [] rest)
+      apply hcode hinnerFuel
+      · exact ⟨⟨outRoots, value :: values, houtput,
+          .cons havFinal havs, .cons hheadGraph' hvalueGraphs,
+          hrestGraphFinal, hownFinal⟩,
+          hslotsTail.right_of_append⟩
+      · exact hcodeRun
+  have htailCode : CodeOwnsBelow ctx cur bound
+      (GraphOwnsVEnvProtected funRel recSelfRel middle sourceMiddle
+        ((world, sourceValue) :: sourceRest) (root :: rest)
+        (aValProtection av value ++ slots)) post (emitTail code) :=
+    tail.graphEmits ((world, sourceValue) :: sourceRest) (root :: rest)
+      (aValProtection av value ++ slots) bound hbound post code htailCont
+  exact htailCode hfuel htailPre hrun
+
+/-- One compiler-fuel step of the `lowerArgs` induction. Both recursive
+calls use the predecessor fuel, so this theorem is the exact bridge consumed
+by the eventual joint strong induction over the lowering cluster. -/
+theorem lowerArgsPreservesBelow_succ
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hargsExtra : LowerArgsExtraMonotone src fuel) :
+    LowerArgsPreservesBelow ctx cur limit src (fuel + 1) := by
+  intro input args state finalState output emit avs hrun hrepresented
+    havailable
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact lowerArgs_nil_sound_below
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases headResult with ⟨middle, emitHead, av⟩
+    dsimp only at hafterHead
+    obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+      estateBindRun_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, emitTail, tailAvs⟩
+    have hpure :
+        (actualOutput, emitHead ∘ emitTail, av :: tailAvs) =
+            (output, emit, avs) ∧
+          tailState = finalState := by
+      simpa using hpureRun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    have hmiddleRepresented : ExtraRepresented ctx middleState :=
+      hrepresented.of_extends
+      (hargsExtra middle rest htailRun)
+    have hmiddleAvailable := havailable.lowerE hheadRun
+    exact (hexpr hheadRun hmiddleRepresented havailable).consArgs
+      (hargs htailRun hrepresented hmiddleAvailable)
+
+/-- `lowerArgs` is not an independent mutual-induction obligation: at fuel
+`n` it follows from expression soundness at every strictly smaller compiler
+fuel. The tail recursion is discharged internally by ordinary induction. -/
+theorem lowerArgsPreservesBelow_of_expr
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEPreservesBelow ctx cur limit src prior)
+    (hextra : ∀ prior, prior < fuel →
+      LowerArgsExtraMonotone src prior) :
+    LowerArgsPreservesBelow ctx cur limit src fuel := by
+  induction fuel with
+  | zero =>
+    intro input args state finalState output emit avs hrun hrepresented _
+    simp only [lowerArgs] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ fuel ih =>
+    apply lowerArgsPreservesBelow_succ
+    · exact hexpr fuel (Nat.lt_succ_self fuel)
+    · apply ih
+      intro prior hprior
+      exact hexpr prior (Nat.lt_trans hprior (Nat.lt_succ_self fuel))
+      intro prior hprior
+      exact hextra prior (Nat.lt_trans hprior (Nat.lt_succ_self fuel))
+    · exact hextra fuel (Nat.lt_succ_self fuel)
+
+/-- Successful argument lowering preserves list length independently of its
+semantic proof. This supplies the homogeneous-world equalities needed by
+`applyRest` and `knownCall`. -/
+theorem lowerArgs_success_length (src : IxIR0.Env) :
+    ∀ {fuel : Nat} {input : VEnv}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {avs : List AVal},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    avs.length = args.length := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    intro input args state finalState output emit avs hrun
+    simp only [lowerArgs] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ fuel ih =>
+    intro input args state finalState output emit avs hrun
+    cases args with
+    | nil =>
+      have hpure :
+          (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+            state = finalState := by
+        simpa [lowerArgs] using hrun
+      obtain ⟨hvalue, _⟩ := hpure
+      cases hvalue
+      rfl
+    | cons head rest =>
+      rcases head with ⟨expr, world⟩
+      simp only [lowerArgs] at hrun
+      obtain ⟨headResult, middleState, _, hafterHead⟩ :=
+        estateBindRun_ok_inv hrun
+      rcases headResult with ⟨middle, emitHead, av⟩
+      dsimp only at hafterHead
+      obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+        estateBindRun_ok_inv hafterHead
+      rcases tailResult with ⟨actualOutput, emitTail, tailAvs⟩
+      have hpure :
+          (actualOutput, emitHead ∘ emitTail, av :: tailAvs) =
+              (output, emit, avs) ∧
+            tailState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, _⟩ := hpure
+      cases hvalue
+      simp [ih htailRun]
+
+theorem map_shared_arg_worlds (args : List IxIR0.Expr) :
+    (args.map (fun arg => (arg, Owned.shared))).map Prod.snd =
+      List.replicate args.length .shared := by
+  induction args with
+  | nil => rfl
+  | cons arg args ih =>
+    simp [List.replicate_succ, ih]
+
+/-- Zipping a known-call prefix with `padWorlds` never truncates the
+expression prefix: `padWorlds` has exactly the requested length, while
+`take count` has at most that length. -/
+theorem knownCall_prefix_exprs_eq (args : List IxIR0.Expr)
+    (worlds : List Owned) (count : Nat) :
+    (((args.take count).zip (padWorlds worlds count)).map Prod.fst) =
+      args.take count := by
+  apply List.map_fst_zip
+  simp [padWorlds]
+  omega
+
+/-- Once a known call has enough source arguments for its requested prefix,
+zipping with a complete world telescope preserves that telescope exactly. -/
+theorem knownCall_prefix_worlds_eq (args : List IxIR0.Expr)
+    (worlds : List Owned) (count : Nat)
+    (hworlds : worlds.length = count) (hcount : count ≤ args.length) :
+    (((args.take count).zip (padWorlds worlds count)).map Prod.snd) =
+      worlds := by
+  rw [show padWorlds worlds count = worlds by
+    simp [padWorlds, ← hworlds]]
+  apply List.map_snd_zip
+  simp [hworlds, hcount]
+
+/-- The corresponding executable prefix has exactly the requested length. -/
+theorem knownCall_prefix_length_eq (args : List IxIR0.Expr)
+    (worlds : List Owned) (count : Nat)
+    (hworlds : worlds.length = count) (hcount : count ≤ args.length) :
+    ((args.take count).zip (padWorlds worlds count)).length = count := by
+  have hshape := knownCall_prefix_worlds_eq args worlds count hworlds hcount
+  simpa [hworlds] using congrArg List.length hshape
+
+/-- Repackage the common output of a result-producing operation as the
+lowerer's fresh absolute result slot while preserving its `VEnv` and slot
+frame. -/
+theorem ownsPushedRoot_result {Γ : VEnv} {envRoots rest : List Root}
+    {slots : List (Nat × RVal)} {world : Owned} :
+    ∀ {store env},
+      OwnsPushedRoot
+        (fun oldEnv => VEnvRealizes Γ oldEnv envRoots ∧
+          SlotsRealize Γ oldEnv slots)
+        world (envRoots ++ rest) store env →
+      OwnsResultProtected Γ.bump world (.slotA Γ.depth)
+        rest slots store env := by
+  intro store env hpush
+  obtain ⟨value, oldEnv, rfl, hΓ, hown⟩ := hpush
+  refine ⟨⟨envRoots, value, hΓ.1.bump value, ?_, hown⟩,
+    hΓ.2.bump value⟩
+  apply AValRealizes.slot
+  · simp [VEnv.bump]
+  · simp [VEnv.bump, VEnv.rel]
+
+/-- Generic bounded consumer for a lowered argument list followed by one
+operation that consumes its roots and pushes a result. The operation-specific
+rules supply only their expected root shape. -/
+theorem LowerArgsSoundBelow.finishPushed
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal} {op : Op}
+    {resultWorld : Owned} {opRoots : List RVal → List Root}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output worlds emit avs)
+    (hrootShape : ∀ {values : List RVal}, values.length = avs.length →
+      rootsForWorlds worlds values = opRoots values)
+    (hop : ∀ {frame : List RVal → Prop} {values : List RVal}
+        {tailRoots : List Root},
+      values.length = avs.length →
+      EmitSoundBelow ctx cur limit (emitOp op)
+        (fun store env => frame env ∧
+          resolveAtoms env (avs.map (·.toAtom output)).toArray = .ok values ∧
+          RootOwnership store (opRoots values ++ tailRoots))
+        (OwnsPushedRoot frame resultWorld tailRoots)) :
+    LowerResultSoundBelow ctx cur limit input output.bump resultWorld
+      (emit ∘ emitOp op) (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSoundBelow.comp (hargs.emits rest slots)
+  intro bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes output oldEnv envRoots ∧ SlotsRealize output oldEnv slots
+  have hnext : CodeOwnsBelow ctx cur bound
+      (OwnsPushedRoot frame resultWorld (envRoots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hnextFuel
+      hpushed hcodeRun
+    apply hcode hnextFuel
+    · exact ownsPushedRoot_result hpushed
+    · exact hcodeRun
+  have hvaluesLength : values.length = avs.length := havs.lengths.2.symm
+  have hopCode : CodeOwnsBelow ctx cur bound
+      (fun opStore opEnv => frame opEnv ∧
+        resolveAtoms opEnv (avs.map (·.toAtom output)).toArray = .ok values ∧
+        RootOwnership opStore (opRoots values ++ (envRoots ++ rest)))
+      post (emitOp op code) :=
+    (hop hvaluesLength) bound hbound post code hnext
+  apply hopCode hfuel
+  · refine ⟨⟨houtput, hslots⟩, havs.resolveAtoms, ?_⟩
+    simpa [hrootShape hvaluesLength, List.append_assoc] using hown
+  · exact hrun
+
+/-- Bounded direct-call consumer for a heterogeneous argument telescope. -/
+theorem LowerArgsSoundBelow.call_owned {ctx : Ctx} {cur d : FnDef}
+    {limit : Nat} {input output : VEnv} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal} {f : Ixon.Address}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output worlds emit avs)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContractBelow ctx d worlds limit) :
+    LowerResultSoundBelow ctx cur limit input output.bump d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  apply hargs.finishPushed (opRoots := rootsForWorlds worlds)
+  · intro values _
+    rfl
+  · intro frame values tailRoots _
+    exact emit_call_owned_below hdecl hcontract
+
+/-- Bounded recursive-self-call consumer. -/
+theorem LowerArgsSoundBelow.callSelf_owned
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output worlds emit avs)
+    (hcontract : FnOwnershipContractBelow ctx cur worlds limit) :
+    LowerResultSoundBelow ctx cur limit input output.bump cur.result
+      (emit ∘ emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  apply hargs.finishPushed (opRoots := rootsForWorlds worlds)
+  · intro values _
+    rfl
+  · intro frame values tailRoots _
+    exact emit_callSelf_owned_below hcontract
+
+/-- A malformed compiler environment may advertise the wrong recursive-self
+arity. The emitted operation is nevertheless ownership-safe because the
+target evaluator rejects that call before entering the current body. This
+lets the compiler proof require a contract only at `cur.arity`; reachable
+environments later rule out the malformed case altogether. -/
+theorem LowerArgsSoundBelow.callSelf_arity_mismatch
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output worlds emit avs)
+    (harity : avs.length ≠ cur.arity) :
+    LowerResultSoundBelow ctx cur limit input output.bump cur.result
+      (emit ∘ emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  apply hargs.finishPushed (opRoots := rootsForWorlds worlds)
+  · intro values _
+    rfl
+  · intro frame values tailRoots hvaluesLength
+    apply OpSoundBelow.emit
+    intro opFuel store env store' result hopFuel hpre hrun
+    obtain ⟨hframe, hresolve, hown⟩ := hpre
+    cases opFuel with
+    | zero => simp [runOp] at hrun
+    | succ fuel =>
+      rw [runOp.eq_def] at hrun
+      dsimp only at hrun
+      rw [hresolve] at hrun
+      have hne : values.length ≠ cur.arity := by
+        intro heq
+        exact harity (hvaluesLength.symm.trans heq)
+      change (if (values.length != cur.arity) = true then
+          .error (.stuck "callSelf arity mismatch")
+        else
+          (do
+            let out ← runCode ctx fuel cur store values.reverse cur.body
+            checkResultWorld cur.result out)) =
+          .ok (store', result) at hrun
+      have hbne : (values.length != cur.arity) = true := by
+        simp [hne]
+      rw [if_pos hbne] at hrun
+      contradiction
+
+/-- Bounded homogeneous constructor allocation. -/
+theorem LowerArgsSoundBelow.alloc_owned
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {world : Owned} {emit : Emit}
+    {avs : List AVal} {cid : CtorId}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate avs.length world) emit avs) :
+    LowerResultSoundBelow ctx cur limit input output.bump world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  apply hargs.finishPushed (opRoots := rootsFor world)
+  · intro values hlength
+    exact rootsForWorlds_replicate_eq_rootsFor world hlength
+  · intro frame values tailRoots _
+    exact emit_alloc_owned_below
+
+/-- Bounded homogeneous partial-application allocation. -/
+theorem LowerArgsSoundBelow.papp_owned
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate avs.length .shared) emit avs)
+    (hdecl : ctx.decls f = some d)
+    (hunder : avs.length < declArity d) :
+    LowerResultSoundBelow ctx cur limit input output.bump .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  apply hargs.finishPushed (opRoots := rootsFor .shared)
+  · intro values hlength
+    exact rootsForWorlds_replicate_eq_rootsFor .shared hlength
+  · intro frame values tailRoots hlength
+    apply emit_papp_owned_below hdecl
+    simpa [hlength] using hunder
+
+/-- Bounded scalar-only extern consumer. -/
+theorem LowerArgsSoundBelow.extern_owned
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {resultWorld : Owned}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate avs.length .shared) emit avs) :
+    LowerResultSoundBelow ctx cur limit input output.bump resultWorld
+      (emit ∘ emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  apply hargs.finishPushed (opRoots := rootsFor .shared)
+  · intro values hlength
+    exact rootsForWorlds_replicate_eq_rootsFor .shared hlength
+  · intro frame values tailRoots _
+    exact emit_extern_owned_below
+
+/-- Consume a proved heterogeneous argument prefix with a direct call. The
+callee contract removes every argument owner and produces one root in the
+declaration's result world. -/
+theorem LowerArgsSound.call_owned {ctx : Ctx} {cur d : FnDef}
+    {input output : VEnv} {worlds : List Owned} {emit : Emit}
+    {avs : List AVal} {f : Ixon.Address}
+    (hargs : LowerArgsSound ctx cur input output worlds emit avs)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d worlds) :
+    LowerResultSound ctx cur input output.bump d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (hargs.emits rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes output oldEnv envRoots ∧ SlotsRealize output oldEnv slots
+  have hnext : CodeOwns ctx cur
+      (OwnsPushedRoot frame d.result (envRoots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hpushed hcodeRun
+    apply hcode
+    · exact ownsPushedRoot_result hpushed
+    · exact hcodeRun
+  have hcall : CodeOwns ctx cur
+      (fun callStore callEnv =>
+        frame callEnv ∧
+        resolveAtoms callEnv (avs.map (·.toAtom output)).toArray =
+          .ok values ∧
+        RootOwnership callStore
+          (rootsForWorlds worlds values ++ (envRoots ++ rest)))
+      post (emitOp (.call f (avs.map (·.toAtom output)).toArray) code) :=
+    (emit_call_owned hdecl hcontract) post code hnext
+  apply hcall
+  · exact ⟨⟨houtput, hslots⟩, havs.resolveAtoms,
+      by simpa [List.append_assoc] using hown⟩
+  · exact hrun
+
+/-- Consume a proved heterogeneous argument prefix with a recursive call to
+the current function. -/
+theorem LowerArgsSound.callSelf_owned {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {worlds : List Owned} {emit : Emit}
+    {avs : List AVal}
+    (hargs : LowerArgsSound ctx cur input output worlds emit avs)
+    (hcontract : FnOwnershipContract ctx cur worlds) :
+    LowerResultSound ctx cur input output.bump cur.result
+      (emit ∘ emitOp (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (hargs.emits rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes output oldEnv envRoots ∧ SlotsRealize output oldEnv slots
+  have hnext : CodeOwns ctx cur
+      (OwnsPushedRoot frame cur.result (envRoots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hpushed hcodeRun
+    apply hcode
+    · exact ownsPushedRoot_result hpushed
+    · exact hcodeRun
+  have hcall : CodeOwns ctx cur
+      (fun callStore callEnv =>
+        frame callEnv ∧
+        resolveAtoms callEnv (avs.map (·.toAtom output)).toArray =
+          .ok values ∧
+        RootOwnership callStore
+          (rootsForWorlds worlds values ++ (envRoots ++ rest)))
+      post
+      (emitOp (.callSelf (avs.map (·.toAtom output)).toArray) code) :=
+    emit_callSelf_owned hcontract post code hnext
+  apply hcall
+  · exact ⟨⟨houtput, hslots⟩, havs.resolveAtoms,
+      by simpa [List.append_assoc] using hown⟩
+  · exact hrun
+
+/-- Consume a homogeneous argument prefix as the fields of a fresh
+constructor. This is the whole-value ownership rule used by saturated
+constructor spines in `knownCall`. -/
+theorem LowerArgsSound.alloc_owned {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {world : Owned} {emit : Emit}
+    {avs : List AVal} {cid : CtorId}
+    (hargs : LowerArgsSound ctx cur input output
+      (List.replicate avs.length world) emit avs) :
+    LowerResultSound ctx cur input output.bump world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (hargs.emits rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes output oldEnv envRoots ∧ SlotsRealize output oldEnv slots
+  have hnext : CodeOwns ctx cur
+      (OwnsPushedRoot frame world (envRoots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hpushed hcodeRun
+    apply hcode
+    · exact ownsPushedRoot_result hpushed
+    · exact hcodeRun
+  have halloc : CodeOwns ctx cur
+      (fun allocStore allocEnv =>
+        frame allocEnv ∧
+        resolveAtoms allocEnv (avs.map (·.toAtom output)).toArray =
+          .ok values ∧
+        RootOwnership allocStore
+          (rootsFor world values ++ (envRoots ++ rest)))
+      post
+      (emitOp (.alloc world cid (avs.map (·.toAtom output)).toArray)
+        code) :=
+    emit_alloc_owned post code hnext
+  have hvaluesLength : values.length = avs.length := havs.lengths.2.symm
+  have hroots : rootsForWorlds (List.replicate avs.length world) values =
+      rootsFor world values :=
+    rootsForWorlds_replicate_eq_rootsFor world hvaluesLength
+  apply halloc
+  · exact ⟨⟨houtput, hslots⟩, havs.resolveAtoms,
+      by simpa [hroots, List.append_assoc] using hown⟩
+  · exact hrun
+
+/-- Operation-level semantic constructor allocation. -/
+theorem alloc_graph_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {output : VEnv}
+    {sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Owned} {avs : List AVal} {cid : CtorId}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag) :
+    OpSound ctx cur
+      (.alloc world cid (avs.map (·.toAtom output)).toArray)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceValues (List.replicate avs.length world) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        (.ctor sourceAddress sourceTag sourceValues) world
+        (.slotA output.depth) sourceRest rest slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length world) values =
+        rootsFor world values :=
+    rootsForWorlds_replicate_eq_rootsFor world hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor world values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+      runOp_alloc_owned_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        havs.resolveAtoms haddress htag hvalueGraphs hown'
+    have hpair :
+        ((store.allocNode world (.ctorN cid values.toArray)).1,
+          .loc (store.allocNode world (.ctorN cid values.toArray)).2) =
+            (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have houtput' := houtput.monoStore hstore
+    have hrestGraph' := hrestGraph.monoStore hstore
+    let ctorValue : RVal := .loc
+      (store.allocNode world (.ctorN cid values.toArray)).2
+    refine ⟨⟨envRoots, ctorValue, houtput'.bump ctorValue, ?_,
+      hresultGraph, hrestGraph', hresultOwn⟩, hslots.bump ctorValue⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [ctorValue, VEnv.bump, VEnv.rel]
+
+/-- Semantic constructor allocation. The related source arguments become
+the fields of the fresh constructor graph, while the output environment and
+caller frame transport through the allocation unchanged. -/
+theorem LowerArgsValueSound.alloc_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Owned} {emit : Emit} {avs : List AVal} {cid : CtorId}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length world) emit avs)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput (.ctor sourceAddress sourceTag sourceValues)
+      world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound := hargs.toLowerArgsSound.alloc_owned
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length world) values =
+        rootsFor world values :=
+    rootsForWorlds_replicate_eq_rootsFor world hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor world values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+      runOp_alloc_owned_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        havs.resolveAtoms haddress htag hvalueGraphs hown'
+    have hpair :
+        ((store.allocNode world (.ctorN cid values.toArray)).1,
+          .loc (store.allocNode world (.ctorN cid values.toArray)).2) =
+            (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have houtput' := houtput.monoStore hstore
+    have hrestGraph' := hrestGraph.monoStore hstore
+    let ctorValue : RVal := .loc
+      (store.allocNode world (.ctorN cid values.toArray)).2
+    refine ⟨⟨envRoots, ctorValue, houtput'.bump ctorValue, ?_,
+      hresultGraph, hrestGraph', hresultOwn⟩, hslots.bump ctorValue⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [ctorValue, VEnv.bump, VEnv.rel]
+
+theorem LowerArgsValueSoundBelow.alloc_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {world : Owned} {emit : Emit} {avs : List AVal} {cid : CtorId}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues
+      (List.replicate avs.length world) emit avs)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput
+      (.ctor sourceAddress sourceTag sourceValues) world
+      (emit ∘ emitOp
+        (.alloc world cid (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hargs.toLowerArgsSoundBelow.alloc_owned
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length world) values =
+        rootsFor world values :=
+    rootsForWorlds_replicate_eq_rootsFor world hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor world values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+      runOp_alloc_owned_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        havs.resolveAtoms haddress htag hvalueGraphs hown'
+    have hpair :
+        ((store.allocNode world (.ctorN cid values.toArray)).1,
+          .loc (store.allocNode world (.ctorN cid values.toArray)).2) =
+            (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have houtput' := houtput.monoStore hstore
+    have hrestGraph' := hrestGraph.monoStore hstore
+    let ctorValue : RVal := .loc
+      (store.allocNode world (.ctorN cid values.toArray)).2
+    refine ⟨⟨envRoots, ctorValue, houtput'.bump ctorValue, ?_,
+      hresultGraph, hrestGraph', hresultOwn⟩, hslots.bump ctorValue⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [ctorValue, VEnv.bump, VEnv.rel]
+
+/-- Fold a homogeneous shared argument prefix into a fresh partial-
+application node. -/
+theorem LowerArgsSound.papp_owned {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    (hargs : LowerArgsSound ctx cur input output
+      (List.replicate avs.length .shared) emit avs)
+    (hdecl : ctx.decls f = some d)
+    (hunder : avs.length < declArity d) :
+    LowerResultSound ctx cur input output.bump .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (hargs.emits rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes output oldEnv envRoots ∧ SlotsRealize output oldEnv slots
+  have hnext : CodeOwns ctx cur
+      (OwnsPushedRoot frame .shared (envRoots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hpushed hcodeRun
+    apply hcode
+    · exact ownsPushedRoot_result hpushed
+    · exact hcodeRun
+  have hvaluesLength : values.length = avs.length := havs.lengths.2.symm
+  have hunderValues : values.length < declArity d := by
+    simpa [hvaluesLength] using hunder
+  have hpapp : CodeOwns ctx cur
+      (fun pappStore pappEnv =>
+        frame pappEnv ∧
+        resolveAtoms pappEnv (avs.map (·.toAtom output)).toArray =
+          .ok values ∧
+        RootOwnership pappStore
+          (rootsFor .shared values ++ (envRoots ++ rest)))
+      post
+      (emitOp (.papp f (avs.map (·.toAtom output)).toArray) code) :=
+    emit_papp_owned hdecl hunderValues post code hnext
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  apply hpapp
+  · exact ⟨⟨houtput, hslots⟩, havs.resolveAtoms,
+      by simpa [hroots, List.append_assoc] using hown⟩
+  · exact hrun
+
+/-- Operation-level semantic pap allocation. Besides conserving roots, the
+fresh shared node realizes a source function value whose complete stored
+prefix is the related source argument vector. -/
+theorem papp_graph_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {output : VEnv} {sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    OpSound ctx cur (.papp f (avs.map (·.toAtom output)).toArray)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceValues (List.replicate avs.length .shared) avs
+        sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump
+        sourceOutput sourceValue .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hunderValues : values.length < declArity d := by
+    simpa [hvaluesLength] using hunder
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+      runOp_papp_owned_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        havs.resolveAtoms hdecl hunderValues hfun hvalueGraphs hown'
+    have hpair :
+        ((store.allocNode .shared
+            (.papN f (declArity d) values.toArray)).1,
+          .loc (store.allocNode .shared
+            (.papN f (declArity d) values.toArray)).2) =
+            (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have houtput' := houtput.monoStore hstore
+    have hrestGraph' := hrestGraph.monoStore hstore
+    let papValue : RVal := .loc (store.allocNode .shared
+      (.papN f (declArity d) values.toArray)).2
+    refine ⟨⟨envRoots, papValue, houtput'.bump papValue, ?_,
+      hresultGraph, hrestGraph', hresultOwn⟩, hslots.bump papValue⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [papValue, VEnv.bump, VEnv.rel]
+
+/-- Semantic pap allocation lifted across an already verified argument
+prefix. -/
+theorem LowerArgsValueSound.papp_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound :=
+        hargs.toLowerArgsSound.papp_owned hdecl hunder
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+  exact OpSound.emit (papp_graph_op hdecl hfun hunder)
+
+theorem LowerArgsValueSoundBelow.papp_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceValues : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {d : Decl}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValues
+      (List.replicate avs.length .shared) emit avs)
+    (hdecl : ctx.decls f = some d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hunder : avs.length < declArity d) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceValue .shared
+      (emit ∘ emitOp (.papp f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hargs.toLowerArgsSoundBelow.papp_owned hdecl hunder
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hunderValues : values.length < declArity d := by
+    simpa [hvaluesLength] using hunder
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hown' : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨heval, hstore, hresultGraph, hresultOwn⟩ :=
+      runOp_papp_owned_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        havs.resolveAtoms hdecl hunderValues hfun hvalueGraphs hown'
+    have hpair :
+        ((store.allocNode .shared
+            (.papN f (declArity d) values.toArray)).1,
+          .loc (store.allocNode .shared
+            (.papN f (declArity d) values.toArray)).2) =
+            (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have houtput' := houtput.monoStore hstore
+    have hrestGraph' := hrestGraph.monoStore hstore
+    let papValue : RVal := .loc (store.allocNode .shared
+      (.papN f (declArity d) values.toArray)).2
+    refine ⟨⟨envRoots, papValue, houtput'.bump papValue, ?_,
+      hresultGraph, hrestGraph', hresultOwn⟩, hslots.bump papValue⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [papValue, VEnv.bump, VEnv.rel]
+
+/-- Consume a homogeneous shared argument prefix through the scalar-only
+extern ABI and package its scalar result at the demanded world. -/
+theorem LowerArgsSound.extern_owned {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address} {resultWorld : Owned}
+    (hargs : LowerArgsSound ctx cur input output
+      (List.replicate avs.length .shared) emit avs) :
+    LowerResultSound ctx cur input output.bump resultWorld
+      (emit ∘ emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (hargs.emits rest slots)
+  intro post code hcode
+  intro fuel store env finalStore finalValue hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes output oldEnv envRoots ∧ SlotsRealize output oldEnv slots
+  have hnext : CodeOwns ctx cur
+      (OwnsPushedRoot frame resultWorld (envRoots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hpushed hcodeRun
+    apply hcode
+    · exact ownsPushedRoot_result hpushed
+    · exact hcodeRun
+  have hextern : CodeOwns ctx cur
+      (fun externStore externEnv =>
+        frame externEnv ∧
+        resolveAtoms externEnv (avs.map (·.toAtom output)).toArray =
+          .ok values ∧
+        RootOwnership externStore
+          (rootsFor .shared values ++ (envRoots ++ rest)))
+      post
+      (emitOp (.extern f (avs.map (·.toAtom output)).toArray) code) :=
+    emit_extern_owned post code hnext
+  have hvaluesLength : values.length = avs.length := havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  apply hextern
+  · exact ⟨⟨houtput, hslots⟩, havs.resolveAtoms,
+      by simpa [hroots, List.append_assoc] using hown⟩
+  · exact hrun
+
+/-- Lower shared arguments while protecting an already-produced function
+descriptor, then consume the function root and argument prefix together via
+the context's higher-order apply contract. -/
+theorem LowerArgsSound.apply_owned {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {emit : Emit} {avs : List AVal}
+    {function : AVal}
+    (hargs : LowerArgsSound ctx cur input output
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hcontract : ApplyOwnershipContract ctx) :
+    ∀ rest slots,
+      EmitSound ctx cur
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (OwnsResultProtected input .shared function rest slots)
+        (OwnsResultProtected output.bump .shared (.slotA output.depth)
+          rest slots) := by
+  intro rest slots post code hcode
+  intro fuel store env finalStore finalValue hfunctionPre hrun
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction, hownFunction⟩,
+    hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (perm_extract_root functionRoot envRoots [] rest).symm
+  have hargsPre : OwnsVEnvProtected input (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hargsOwn⟩, hfunctionProtection.append hslots⟩
+  have hargsCont : CodeOwns ctx cur
+      (OwnsArgsResultProtected output
+        (List.replicate avs.length .shared) avs (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      post
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code) := by
+    intro argsFuel argsStore argsEnv resultStore resultValue hargsPost happlyRun
+    obtain ⟨⟨outRoots, values, houtput, havs, hownArgs⟩,
+      hslotsOut⟩ := hargsPost
+    have hfunctionFinal : AValRealizes output argsEnv function functionValue :=
+      hfunctionStable.realize_of_protection hfunction
+        hslotsOut.left_of_append
+    have hvaluesLength : values.length = avs.length := havs.lengths.2.symm
+    have hroots :
+        rootsForWorlds (List.replicate avs.length .shared) values =
+          rootsFor .shared values :=
+      rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+    have hownApply : RootOwnership argsStore
+        (functionRoot :: rootsFor .shared values ++ (outRoots ++ rest)) := by
+      apply hownArgs.perm
+      simpa [functionRoot, hroots, List.append_assoc] using
+        (perm_extract_root functionRoot
+          (rootsForWorlds (List.replicate avs.length .shared) values ++
+            outRoots) [] rest)
+    let frame : List RVal → Prop := fun oldEnv =>
+      VEnvRealizes output oldEnv outRoots ∧
+        SlotsRealize output oldEnv slots
+    have hnext : CodeOwns ctx cur
+        (OwnsPushedRoot frame .shared (outRoots ++ rest)) post code := by
+      intro nextFuel nextStore nextEnv endStore endValue hpushed hcodeRun
+      apply hcode
+      · exact ownsPushedRoot_result hpushed
+      · exact hcodeRun
+    have happly : CodeOwns ctx cur
+        (fun applyStore applyEnv =>
+          frame applyEnv ∧
+          resolveAtom applyEnv (function.toAtom output) =
+            .ok functionValue ∧
+          resolveAtoms applyEnv (avs.map (·.toAtom output)).toArray =
+            .ok values ∧
+          RootOwnership applyStore
+            (functionRoot :: rootsFor .shared values ++ (outRoots ++ rest)))
+        post
+        (emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray) code) :=
+      emit_apply_owned hcontract post code hnext
+    apply happly
+    · exact ⟨⟨houtput, hslotsOut.right_of_append⟩,
+        hfunctionFinal.resolveAtom, havs.resolveAtoms, hownApply⟩
+    · exact happlyRun
+  have hargsCode : CodeOwns ctx cur
+      (OwnsVEnvProtected input (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots)) post
+      (emit (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code)) :=
+    hargs.emits (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots)
+      post _ hargsCont
+  exact hargsCode hargsPre hrun
+
+/-- Full non-erased `applyRest` semantic composition, abstracting only the
+executable recursive calls: first produce a shared function, lower all
+supplied shared arguments, then apply under the context contract. -/
+theorem LowerResultSound.applyArgs {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv} {emitFunction emitArgs : Emit}
+    {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultSound ctx cur start input .shared
+      emitFunction function)
+    (hargs : LowerArgsSound ctx cur input output
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hcontract : ApplyOwnershipContract ctx) :
+    LowerResultSound ctx cur start output.bump .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hcomposed := EmitSound.comp (hfunction.emits rest slots)
+    (hargs.apply_owned hfunction.stable hcontract rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-- Bounded higher-order application after shared argument lowering. -/
+theorem LowerArgsSoundBelow.apply_owned
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {emit : Emit} {avs : List AVal}
+    {function : AVal}
+    (hargs : LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hcontract : ApplyOwnershipContractBelow ctx limit) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (OwnsResultProtected input .shared function rest slots)
+        (OwnsResultProtected output.bump .shared (.slotA output.depth)
+          rest slots) := by
+  intro rest slots bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hfunctionPre hrun
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction, hownFunction⟩,
+    hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (perm_extract_root functionRoot envRoots [] rest).symm
+  have hargsPre : OwnsVEnvProtected input (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hargsOwn⟩, hfunctionProtection.append hslots⟩
+  have hargsCont : CodeOwnsBelow ctx cur bound
+      (OwnsArgsResultProtected output
+        (List.replicate avs.length .shared) avs (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      post
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code) := by
+    intro argsFuel argsStore argsEnv resultStore resultValue hargsFuel
+      hargsPost happlyRun
+    obtain ⟨⟨outRoots, values, houtput, havs, hownArgs⟩,
+      hslotsOut⟩ := hargsPost
+    have hfunctionFinal : AValRealizes output argsEnv function functionValue :=
+      hfunctionStable.realize_of_protection hfunction
+        hslotsOut.left_of_append
+    have hvaluesLength : values.length = avs.length := havs.lengths.2.symm
+    have hroots :
+        rootsForWorlds (List.replicate avs.length .shared) values =
+          rootsFor .shared values :=
+      rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+    have hownApply : RootOwnership argsStore
+        (functionRoot :: rootsFor .shared values ++ (outRoots ++ rest)) := by
+      apply hownArgs.perm
+      simpa [functionRoot, hroots, List.append_assoc] using
+        (perm_extract_root functionRoot
+          (rootsForWorlds (List.replicate avs.length .shared) values ++
+            outRoots) [] rest)
+    let frame : List RVal → Prop := fun oldEnv =>
+      VEnvRealizes output oldEnv outRoots ∧
+        SlotsRealize output oldEnv slots
+    have hnext : CodeOwnsBelow ctx cur bound
+        (OwnsPushedRoot frame .shared (outRoots ++ rest)) post code := by
+      intro nextFuel nextStore nextEnv endStore endValue hnextFuel
+        hpushed hcodeRun
+      apply hcode hnextFuel
+      · exact ownsPushedRoot_result hpushed
+      · exact hcodeRun
+    have happly : CodeOwnsBelow ctx cur bound
+        (fun applyStore applyEnv =>
+          frame applyEnv ∧
+          resolveAtom applyEnv (function.toAtom output) =
+            .ok functionValue ∧
+          resolveAtoms applyEnv (avs.map (·.toAtom output)).toArray =
+            .ok values ∧
+          RootOwnership applyStore
+            (functionRoot :: rootsFor .shared values ++ (outRoots ++ rest)))
+        post
+        (emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray) code) :=
+      (emit_apply_owned_below hcontract) bound hbound post code hnext
+    apply happly hargsFuel
+    · exact ⟨⟨houtput, hslotsOut.right_of_append⟩,
+        hfunctionFinal.resolveAtom, havs.resolveAtoms, hownApply⟩
+    · exact happlyRun
+  have hargsCode : CodeOwnsBelow ctx cur bound
+      (OwnsVEnvProtected input (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots)) post
+      (emit (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code)) :=
+    hargs.emits (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots)
+      bound hbound post _ hargsCont
+  exact hargsCode hfuel hargsPre hrun
+
+/-- Bounded semantic composition for the non-erased `applyRest` path. -/
+theorem LowerResultSoundBelow.applyArgs
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {start input output : VEnv} {emitFunction emitArgs : Emit}
+    {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultSoundBelow ctx cur limit start input .shared
+      emitFunction function)
+    (hargs : LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hcontract : ApplyOwnershipContractBelow ctx limit) :
+    LowerResultSoundBelow ctx cur limit start output.bump .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  have hcomposed := EmitSoundBelow.comp (hfunction.emits rest slots)
+    (hargs.apply_owned hfunction.stable hcontract rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-! ## Erased-result argument release -/
+
+private theorem discard_const_arg_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {atom : Atom}
+    {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (OwnsArgsResultProtected Γ (.shared :: worlds)
+          (.constA atom :: avs) rest slots)
+        (OwnsArgsResultProtected Γ worlds avs rest slots) := by
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, values, hΓ, havs, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons headWorld tailWorlds headAV tailAVs value tailValues hav htail =>
+    have howned : RootOwnership store
+        (⟨.shared, value⟩ ::
+          (rootsForWorlds worlds tailValues ++ roots ++ rest)) := by
+      simpa [rootsForWorlds] using hown
+    exact ⟨⟨roots, tailValues, hΓ, htail,
+      howned.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- Skipping a stable constant argument consumes its scalar logical root
+without changing the store or runtime environment. -/
+theorem discard_const_arg {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {atom : Atom} {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSound ctx cur (_root_.id : Emit)
+        (OwnsArgsResultProtected Γ (.shared :: worlds)
+          (.constA atom :: avs) rest slots)
+        (OwnsArgsResultProtected Γ worlds avs rest slots) := by
+  intro rest slots
+  apply EmitSound.of_below
+  intro limit
+  exact discard_const_arg_at (limit := limit) hstable rest slots
+
+private theorem discard_const_arg_value_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {atom : Atom}
+    {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.constA atom :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons headWorld tailWorlds headAV tailAVs value tailValues hav htail =>
+    cases hvalueGraphs with
+    | cons hvalueGraph htailGraphs =>
+      have howned : RootOwnership store
+          (⟨.shared, value⟩ ::
+            (rootsForWorlds worlds tailValues ++ roots ++ rest)) := by
+        simpa [rootsForWorlds] using hown
+      exact ⟨⟨roots, tailValues, hΓ, htail, htailGraphs,
+        hrestGraph,
+        howned.dropNoLocation (hstable.const_noLocation hav)⟩,
+        hslots⟩
+
+/-- Semantic constant discard removes the inert head argument and its source
+value while leaving every remaining graph and the store unchanged. -/
+theorem discard_const_arg_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {atom : Atom}
+    {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSound ctx cur (_root_.id : Emit)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.constA atom :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSound.of_below
+  intro limit
+  exact discard_const_arg_value_at (limit := limit) hstable
+    sourceRest rest slots
+
+theorem discard_const_arg_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {atom : Atom}
+    {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (OwnsArgsResultProtected Γ (.shared :: worlds)
+          (.constA atom :: avs) rest slots)
+        (OwnsArgsResultProtected Γ worlds avs rest slots) := by
+  exact discard_const_arg_at hstable
+
+theorem discard_const_arg_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {atom : Atom}
+    {worlds : List Owned} {avs : List AVal}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.constA atom :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  exact discard_const_arg_value_at hstable
+
+private theorem discard_const_result_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv}
+    {world : Owned} {atom : Atom} (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (OwnsResultProtected Γ world (.constA atom) rest slots)
+        (OwnsVEnvProtected Γ rest slots) := by
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, hΓ,
+    hown.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- Forget an ownership-inert constant result before continuing with a
+consumer that needs only the surrounding source environment. -/
+theorem discard_const_result {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {world : Owned} {atom : Atom} (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSound ctx cur (_root_.id : Emit)
+        (OwnsResultProtected Γ world (.constA atom) rest slots)
+        (OwnsVEnvProtected Γ rest slots) := by
+  intro rest slots
+  apply EmitSound.of_below
+  intro limit
+  exact discard_const_result_at (limit := limit) hstable rest slots
+
+private theorem discard_const_result_value_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValue world (.constA atom) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+          sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, _, hrestGraph, hown⟩,
+      hslots⟩ := hpre
+  exact ⟨⟨roots, hΓ, hrestGraph,
+    hown.dropNoLocation (hstable.const_noLocation hav)⟩, hslots⟩
+
+/-- Semantic constant-result discard removes an ownership-inert result root
+before a continuation that needs only the related source environment. -/
+theorem discard_const_result_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSound ctx cur (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValue world (.constA atom) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+          sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSound.of_below
+  intro limit
+  exact discard_const_result_value_at (limit := limit) hstable
+    sourceRest rest slots
+
+theorem discard_const_result_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {world : Owned} {atom : Atom}
+    (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (OwnsResultProtected Γ world (.constA atom) rest slots)
+        (OwnsVEnvProtected Γ rest slots) := by
+  exact discard_const_result_at hstable
+
+theorem discard_const_result_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          sourceValue world (.constA atom) sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ sourceEnv
+          sourceRest rest slots) := by
+  exact discard_const_result_value_at hstable
+
+/-! ## Let-binder installation -/
+
+/-- Install a logical binder that aliases an already existing absolute slot;
+no runtime value is pushed. -/
+def installAliasBinder (Γ : VEnv) (abs remaining : Nat)
+    (uses : Uses) (held : Bool) : VEnv :=
+  { Γ with entries := .slot abs remaining uses held :: Γ.entries }
+
+/-- Install a logical binder for the result of a runtime operation that has
+just pushed a fresh slot. -/
+def installPushedBinder (Γ : VEnv) (remaining : Nat)
+    (uses : Uses) (held : Bool) : VEnv :=
+  { entries := .slot Γ.depth remaining uses held :: Γ.entries,
+    depth := Γ.depth + 1 }
+
+/-- Ownership interface shared by alias and materialized let-binder
+installation. -/
+def InstallBinderSound (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (boundWorld : Owned)
+    (boundValue : AVal) (emit : Emit) : Prop :=
+  ∀ rest slots,
+    EmitSound ctx cur emit
+      (OwnsResultProtected input boundWorld boundValue rest slots)
+      (OwnsVEnvProtected output rest slots)
+
+/-- Semantic binder installation moves the source result into the leading
+source-environment entry consumed by the let body. -/
+structure InstallBinderValueSound (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (sourceEnv : List IxIR0.Value)
+    (boundSource : IxIR0.Value) (boundWorld : Owned)
+    (boundValue : AVal) (emit : Emit) : Prop where
+  toInstallBinderSound : InstallBinderSound ctx cur input output
+    boundWorld boundValue emit
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSound ctx cur emit
+      (GraphOwnsResultProtected funRel recSelfRel input sourceEnv
+        boundSource boundWorld boundValue sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        (boundSource :: sourceEnv) sourceRest rest slots)
+
+/-- Fuel-bounded semantic binder installation. -/
+structure InstallBinderValueSoundBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv)
+    (sourceEnv : List IxIR0.Value) (boundSource : IxIR0.Value)
+    (boundWorld : Owned) (boundValue : AVal) (emit : Emit) : Prop where
+  toInstallBinderSoundBelow : ∀ rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (OwnsResultProtected input boundWorld boundValue rest slots)
+      (OwnsVEnvProtected output rest slots)
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (GraphOwnsResultProtected funRel recSelfRel input sourceEnv
+        boundSource boundWorld boundValue sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        (boundSource :: sourceEnv) sourceRest rest slots)
+
+/-- Move a slot-backed expression result into a live let binder without an
+operation. The distinguished result root becomes the binder's environment
+root at the same physical slot. -/
+theorem installAliasBinder_held_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {abs remaining : Nat} {uses : Uses} :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (OwnsResultProtected Γ (worldOfUses uses) (.slotA abs) rest slots)
+        (OwnsVEnvProtected
+          (installAliasBinder Γ abs remaining uses true) rest slots) := by
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, hown⟩, hslots⟩ := hpre
+  cases hav with
+  | slot hbound hslot =>
+    let output := installAliasBinder Γ abs remaining uses true
+    have htail : EntriesRealize output env Γ.entries roots :=
+      hΓ.entries.of_depth_eq (by simp [output, installAliasBinder])
+    have houtput : VEnvRealizes output env
+        (⟨worldOfUses uses, value⟩ :: roots) := by
+      refine ⟨by simpa [output, installAliasBinder] using hΓ.depth_eq, ?_⟩
+      exact EntriesRealize.held
+        (by simpa [output, installAliasBinder] using hbound)
+        (by simpa [output, installAliasBinder, VEnv.rel] using hslot)
+        htail
+    refine ⟨⟨⟨worldOfUses uses, value⟩ :: roots, houtput, ?_⟩, ?_⟩
+    · simpa using hown
+    · exact SlotsRealize.of_depth_eq
+        (by simp [output, installAliasBinder]) hslots
+
+theorem installAliasBinder_held
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {abs remaining : Nat} {uses : Uses} :
+    ∀ rest slots,
+      EmitSound ctx cur (_root_.id : Emit)
+        (OwnsResultProtected Γ (worldOfUses uses) (.slotA abs) rest slots)
+        (OwnsVEnvProtected
+          (installAliasBinder Γ abs remaining uses true) rest slots) := by
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    installAliasBinder_held_below
+      (ctx := ctx) (cur := cur) (limit := limit)
+      (Γ := Γ) (abs := abs) (remaining := remaining) (uses := uses)
+      rest slots
+
+/-- Semantic alias installation moves the bound result graph into a new
+leading held environment entry without changing the runtime stack. -/
+theorem installAliasBinder_held_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Uses} :
+    ∀ sourceRest rest slots,
+      EmitSound ctx cur (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          boundSource (worldOfUses uses) (.slotA abs)
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          (installAliasBinder Γ abs remaining uses true)
+          (boundSource :: sourceEnv) sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSound.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases hav with
+  | slot hbound hslot =>
+    let output := installAliasBinder Γ abs remaining uses true
+    have htail : EntriesValueGraph funRel recSelfRel store output env
+        Γ.entries sourceEnv roots :=
+      hΓ.entries.of_depth_eq (by simp [output, installAliasBinder])
+    have hvalueWorld : HasWorld store (worldOfUses uses) value :=
+      hown.roots_world ⟨worldOfUses uses, value⟩ (by simp)
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        (boundSource :: sourceEnv) env
+        (⟨worldOfUses uses, value⟩ :: roots) := by
+      refine ⟨by simpa [output, installAliasBinder] using hΓ.depth_eq, ?_⟩
+      exact EntriesValueGraph.held
+        (by simpa [output, installAliasBinder] using hbound)
+        (by simpa [output, installAliasBinder, VEnv.rel] using hslot)
+        hvalueWorld hvalueGraph htail
+    refine ⟨⟨⟨worldOfUses uses, value⟩ :: roots,
+      houtput, hrestGraph, ?_⟩, ?_⟩
+    · simpa using hown
+    · exact SlotsRealize.of_depth_eq
+        (by simp [output, installAliasBinder]) hslots
+
+/-- Fuel-bounded semantic alias installation. -/
+theorem installAliasBinder_held_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Uses} :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          boundSource (worldOfUses uses) (.slotA abs)
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          (installAliasBinder Γ abs remaining uses true)
+          (boundSource :: sourceEnv) sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, value, hΓ, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases hav with
+  | slot hbound hslot =>
+    let output := installAliasBinder Γ abs remaining uses true
+    have htail : EntriesValueGraph funRel recSelfRel store output env
+        Γ.entries sourceEnv roots :=
+      hΓ.entries.of_depth_eq (by simp [output, installAliasBinder])
+    have hvalueWorld : HasWorld store (worldOfUses uses) value :=
+      hown.roots_world ⟨worldOfUses uses, value⟩ (by simp)
+    have houtput : VEnvValueGraph funRel recSelfRel store output
+        (boundSource :: sourceEnv) env
+        (⟨worldOfUses uses, value⟩ :: roots) := by
+      refine ⟨by simpa [output, installAliasBinder] using hΓ.depth_eq, ?_⟩
+      exact EntriesValueGraph.held
+        (by simpa [output, installAliasBinder] using hbound)
+        (by simpa [output, installAliasBinder, VEnv.rel] using hslot)
+        hvalueWorld hvalueGraph htail
+    refine ⟨⟨⟨worldOfUses uses, value⟩ :: roots,
+      houtput, hrestGraph, ?_⟩, ?_⟩
+    · simpa using hown
+    · exact SlotsRealize.of_depth_eq
+        (by simp [output, installAliasBinder]) hslots
+
+theorem installAliasBinder_held_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Uses} :
+    InstallBinderValueSound funRel recSelfRel ctx cur Γ
+      (installAliasBinder Γ abs remaining uses true)
+      sourceEnv boundSource (worldOfUses uses) (.slotA abs)
+      (_root_.id : Emit) :=
+  { toInstallBinderSound := installAliasBinder_held
+    graphEmits := installAliasBinder_held_value }
+
+theorem installAliasBinder_held_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {abs remaining : Nat} {uses : Uses} :
+    InstallBinderValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (installAliasBinder Γ abs remaining uses true)
+      sourceEnv boundSource (worldOfUses uses) (.slotA abs)
+      (_root_.id : Emit) :=
+  { toInstallBinderSoundBelow := installAliasBinder_held_below
+    graphEmits := installAliasBinder_held_value_below }
+
+/-- Materialize a stable constant into the fresh physical slot used by a let
+binder. A live binder owns the scalar root; a dead binder records only the
+released entry, since scalar roots are ownership-inert. -/
+theorem materializeConstBinder_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit (emitOp (.pure atom))
+        (OwnsResultProtected Γ (worldOfUses uses) (.constA atom) rest slots)
+        (OwnsVEnvProtected
+          (installPushedBinder Γ remaining uses held) rest slots) := by
+  intro rest slots
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨roots, value, hΓ, hav, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hpure := runOp_pure (ctx := ctx) (cur := cur) (fuel := fuel)
+      (store := store) hav.resolveAtom
+    have hpair : (store, value) = (store', result) :=
+      Except.ok.inj (hpure.symm.trans hrun)
+    cases hpair
+    let output := installPushedBinder Γ remaining uses held
+    have htail : EntriesRealize output (result :: env) Γ.entries roots :=
+      (hΓ.entries.bump result).of_depth_eq
+        (by simp [output, installPushedBinder, VEnv.bump])
+    have hdepth : (result :: env).length = output.depth := by
+      simpa [output, installPushedBinder] using congrArg Nat.succ hΓ.depth_eq
+    cases held with
+    | false =>
+      have houtput : VEnvRealizes output (result :: env) roots := by
+        refine ⟨hdepth, ?_⟩
+        exact EntriesRealize.released
+          (by simp [output, installPushedBinder]) htail
+      refine ⟨⟨roots, houtput, ?_⟩, ?_⟩
+      · exact hown.dropNoLocation (hstable.const_noLocation hav)
+      · exact SlotsRealize.of_depth_eq
+          (by simp [output, installPushedBinder, VEnv.bump])
+          (hslots.bump result)
+
+    | true =>
+      have houtput : VEnvRealizes output (result :: env)
+          (⟨worldOfUses uses, result⟩ :: roots) := by
+        refine ⟨hdepth, ?_⟩
+        exact EntriesRealize.held
+          (by simp [output, installPushedBinder])
+          (by simp [output, installPushedBinder, VEnv.rel]) htail
+      refine ⟨⟨⟨worldOfUses uses, result⟩ :: roots, houtput, ?_⟩, ?_⟩
+      · simpa using hown
+      · exact SlotsRealize.of_depth_eq
+          (by simp [output, installPushedBinder, VEnv.bump])
+          (hslots.bump result)
+
+theorem materializeConstBinder
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    ∀ rest slots,
+      EmitSound ctx cur (emitOp (.pure atom))
+        (OwnsResultProtected Γ (worldOfUses uses) (.constA atom) rest slots)
+        (OwnsVEnvProtected
+          (installPushedBinder Γ remaining uses held) rest slots) := by
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    materializeConstBinder_below
+      (ctx := ctx) (cur := cur) (limit := limit)
+      (Γ := Γ) (atom := atom) (remaining := remaining)
+      (uses := uses) (held := held) hstable rest slots
+
+/-- Semantic constant materialization installs the bound source value as a
+leading held or released entry, matching the compile-time `held` flag. -/
+theorem materializeConstBinder_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSound ctx cur (emitOp (.pure atom))
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          boundSource (worldOfUses uses) (.constA atom)
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          (installPushedBinder Γ remaining uses held)
+          (boundSource :: sourceEnv) sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨roots, value, hΓ, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hpure := runOp_pure (ctx := ctx) (cur := cur) (fuel := fuel)
+      (store := store) hav.resolveAtom
+    have hpair : (store, value) = (store', result) :=
+      Except.ok.inj (hpure.symm.trans hrun)
+    cases hpair
+    let output := installPushedBinder Γ remaining uses held
+    have htail : EntriesValueGraph funRel recSelfRel store output
+        (result :: env) Γ.entries sourceEnv roots :=
+      (hΓ.entries.bump result).of_depth_eq
+        (by simp [output, installPushedBinder, VEnv.bump])
+    have hdepth : (result :: env).length = output.depth := by
+      simpa [output, installPushedBinder] using
+        congrArg Nat.succ hΓ.depth_eq
+    cases held with
+    | false =>
+      have houtput : VEnvValueGraph funRel recSelfRel store output
+          (boundSource :: sourceEnv) (result :: env) roots := by
+        refine ⟨hdepth, ?_⟩
+        exact EntriesValueGraph.released
+          (by simp [output, installPushedBinder]) htail
+      refine ⟨⟨roots, houtput, hrestGraph, ?_⟩, ?_⟩
+      · exact hown.dropNoLocation (hstable.const_noLocation hav)
+      · exact SlotsRealize.of_depth_eq
+          (by simp [output, installPushedBinder, VEnv.bump])
+          (hslots.bump result)
+    | true =>
+      have hvalueWorld : HasWorld store (worldOfUses uses) result :=
+        hown.roots_world ⟨worldOfUses uses, result⟩ (by simp)
+      have houtput : VEnvValueGraph funRel recSelfRel store output
+          (boundSource :: sourceEnv) (result :: env)
+          (⟨worldOfUses uses, result⟩ :: roots) := by
+        refine ⟨hdepth, ?_⟩
+        exact EntriesValueGraph.held
+          (by simp [output, installPushedBinder])
+          (by simp [output, installPushedBinder, VEnv.rel])
+          hvalueWorld hvalueGraph htail
+      refine ⟨⟨⟨worldOfUses uses, result⟩ :: roots,
+        houtput, hrestGraph, ?_⟩, ?_⟩
+      · simpa using hown
+      · exact SlotsRealize.of_depth_eq
+          (by simp [output, installPushedBinder, VEnv.bump])
+          (hslots.bump result)
+
+/-- Fuel-bounded semantic constant materialization. -/
+theorem materializeConstBinder_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (emitOp (.pure atom))
+        (GraphOwnsResultProtected funRel recSelfRel Γ sourceEnv
+          boundSource (worldOfUses uses) (.constA atom)
+          sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          (installPushedBinder Γ remaining uses held)
+          (boundSource :: sourceEnv) sourceRest rest slots) := by
+  intro sourceRest rest slots
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨roots, value, hΓ, hav, hvalueGraph,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hpure := runOp_pure (ctx := ctx) (cur := cur) (fuel := fuel)
+      (store := store) hav.resolveAtom
+    have hpair : (store, value) = (store', result) :=
+      Except.ok.inj (hpure.symm.trans hrun)
+    cases hpair
+    let output := installPushedBinder Γ remaining uses held
+    have htail : EntriesValueGraph funRel recSelfRel store output
+        (result :: env) Γ.entries sourceEnv roots :=
+      (hΓ.entries.bump result).of_depth_eq
+        (by simp [output, installPushedBinder, VEnv.bump])
+    have hdepth : (result :: env).length = output.depth := by
+      simpa [output, installPushedBinder] using
+        congrArg Nat.succ hΓ.depth_eq
+    cases held with
+    | false =>
+      have houtput : VEnvValueGraph funRel recSelfRel store output
+          (boundSource :: sourceEnv) (result :: env) roots := by
+        refine ⟨hdepth, ?_⟩
+        exact EntriesValueGraph.released
+          (by simp [output, installPushedBinder]) htail
+      refine ⟨⟨roots, houtput, hrestGraph, ?_⟩, ?_⟩
+      · exact hown.dropNoLocation (hstable.const_noLocation hav)
+      · exact SlotsRealize.of_depth_eq
+          (by simp [output, installPushedBinder, VEnv.bump])
+          (hslots.bump result)
+    | true =>
+      have hvalueWorld : HasWorld store (worldOfUses uses) result :=
+        hown.roots_world ⟨worldOfUses uses, result⟩ (by simp)
+      have houtput : VEnvValueGraph funRel recSelfRel store output
+          (boundSource :: sourceEnv) (result :: env)
+          (⟨worldOfUses uses, result⟩ :: roots) := by
+        refine ⟨hdepth, ?_⟩
+        exact EntriesValueGraph.held
+          (by simp [output, installPushedBinder])
+          (by simp [output, installPushedBinder, VEnv.rel])
+          hvalueWorld hvalueGraph htail
+      refine ⟨⟨⟨worldOfUses uses, result⟩ :: roots,
+        houtput, hrestGraph, ?_⟩, ?_⟩
+      · simpa using hown
+      · exact SlotsRealize.of_depth_eq
+          (by simp [output, installPushedBinder, VEnv.bump])
+          (hslots.bump result)
+theorem materializeConstBinder_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    InstallBinderValueSound funRel recSelfRel ctx cur Γ
+      (installPushedBinder Γ remaining uses held) sourceEnv boundSource
+      (worldOfUses uses) (.constA atom) (emitOp (.pure atom)) :=
+  { toInstallBinderSound := materializeConstBinder hstable
+    graphEmits := materializeConstBinder_value hstable }
+
+theorem materializeConstBinder_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {boundSource : IxIR0.Value}
+    {atom : Atom} {remaining : Nat} {uses : Uses} {held : Bool}
+    (hstable : AValStable (.constA atom)) :
+    InstallBinderValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (installPushedBinder Γ remaining uses held) sourceEnv boundSource
+      (worldOfUses uses) (.constA atom) (emitOp (.pure atom)) :=
+  { toInstallBinderSoundBelow := materializeConstBinder_below hstable
+    graphEmits := materializeConstBinder_value_below hstable }
+
+/-- Unbounded let sequencing through binder installation and the final
+logical pop. -/
+theorem LowerResultSound.installThen
+    {ctx : Ctx} {cur : FnDef}
+    {input middle installed output : VEnv}
+    {boundWorld resultWorld : Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    (hbound : LowerResultSound ctx cur input middle boundWorld
+      boundEmit boundValue)
+    (hinstall : InstallBinderSound ctx cur middle installed
+      boundWorld boundValue installEmit)
+    (hbody : LowerResultSound ctx cur installed output resultWorld
+      bodyEmit result)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultSound ctx cur input output.pop resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine ⟨hpopped.stable, ?_⟩
+  intro rest slots
+  have hcomposed := EmitSound.comp (hbound.emits rest slots)
+    (EmitSound.comp (hinstall rest slots) (hpopped.emits rest slots))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic let sequencing. The bound result becomes the leading source
+environment value for the body; after the body releases that entry, `pop`
+returns to the body's tail source environment. -/
+theorem LowerResultValueSound.installThen
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input middle installed output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {boundSource sourceResult : IxIR0.Value}
+    {boundWorld resultWorld : Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    (hbound : LowerResultValueSound funRel recSelfRel ctx cur
+      input middle sourceInput sourceMiddle boundSource boundWorld
+      boundEmit boundValue)
+    (hinstall : InstallBinderValueSound funRel recSelfRel ctx cur
+      middle installed sourceMiddle boundSource boundWorld boundValue
+      installEmit)
+    (hbody : LowerResultValueSound funRel recSelfRel ctx cur
+      installed output (boundSource :: sourceMiddle)
+      (boundSource :: sourceOutput) sourceResult resultWorld
+      bodyEmit result)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output.pop
+      sourceInput sourceOutput sourceResult resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine
+    { toLowerResultSound := hbound.toLowerResultSound.installThen
+        hinstall.toInstallBinderSound hbody.toLowerResultSound hreleased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSound.comp
+    (hbound.graphEmits sourceRest rest slots)
+    (EmitSound.comp (hinstall.graphEmits sourceRest rest slots)
+      (hpopped.graphEmits sourceRest rest slots))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Sequence an already proved bound value, its binder-installation emitter,
+and a body that has consumed the installed first entry. The final logical
+`pop` is justified by `FirstEntryReleased`; no runtime slot is removed. -/
+theorem LowerResultSoundBelow.installThen
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle installed output : VEnv}
+    {boundWorld resultWorld : Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    (hbound : LowerResultSoundBelow ctx cur limit input middle boundWorld
+      boundEmit boundValue)
+    (hinstall : ∀ rest slots,
+      EmitSoundBelow ctx cur limit installEmit
+        (OwnsResultProtected middle boundWorld boundValue rest slots)
+        (OwnsVEnvProtected installed rest slots))
+    (hbody : LowerResultSoundBelow ctx cur limit installed output resultWorld
+      bodyEmit result)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultSoundBelow ctx cur limit input output.pop resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine ⟨hpopped.stable, ?_⟩
+  intro rest slots
+  have hcomposed := EmitSoundBelow.comp (hbound.emits rest slots)
+    (EmitSoundBelow.comp (hinstall rest slots) (hpopped.emits rest slots))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic let sequencing. -/
+theorem LowerResultValueSoundBelow.installThen
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle installed output : VEnv}
+    {sourceInput sourceMiddle sourceOutput : List IxIR0.Value}
+    {boundSource sourceResult : IxIR0.Value}
+    {boundWorld resultWorld : Owned}
+    {boundEmit installEmit bodyEmit : Emit}
+    {boundValue result : AVal}
+    (hbound : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput sourceMiddle boundSource boundWorld
+      boundEmit boundValue)
+    (hinstall : InstallBinderValueSoundBelow funRel recSelfRel ctx cur
+      limit middle installed sourceMiddle boundSource boundWorld boundValue
+      installEmit)
+    (hbody : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      installed output (boundSource :: sourceMiddle)
+      (boundSource :: sourceOutput) sourceResult resultWorld
+      bodyEmit result)
+    (hreleased : FirstEntryReleased output) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.pop sourceInput sourceOutput sourceResult resultWorld
+      ((boundEmit ∘ installEmit) ∘ bodyEmit) result := by
+  have hpopped := hbody.popFirstReleased hreleased
+  refine
+    { toLowerResultSoundBelow :=
+        hbound.toLowerResultSoundBelow.installThen
+          hinstall.toInstallBinderSoundBelow
+          hbody.toLowerResultSoundBelow hreleased
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSoundBelow.comp
+    (hbound.graphEmits sourceRest rest slots)
+    (EmitSoundBelow.comp (hinstall.graphEmits sourceRest rest slots)
+      (hpopped.graphEmits sourceRest rest slots))
+  simpa [Function.comp_def] using hcomposed
+
+private theorem discard_slot_arg_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    (htailStable : AValsStable avs) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.drop (.var (Γ.rel abs))))
+        (OwnsArgsResultProtected Γ (.shared :: worlds)
+          (.slotA abs :: avs) rest slots)
+        (OwnsArgsResultProtected Γ.bump worlds avs rest slots) := by
+  intro rest slots bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hpre hrun
+  obtain ⟨⟨roots, values, hΓ, havs, hown⟩, hslots⟩ := hpre
+  cases havs with
+  | @cons headWorld tailWorlds headAV tailAVs value tailValues hav htail =>
+    let frame : List RVal → Prop := fun oldEnv =>
+      VEnvRealizes Γ oldEnv roots ∧
+        AValsRealize Γ oldEnv worlds avs tailValues ∧
+        SlotsRealize Γ oldEnv slots
+    let remainingRoots := rootsForWorlds worlds tailValues ++ roots ++ rest
+    have howned : RootOwnership store
+        (⟨.shared, value⟩ :: remainingRoots) := by
+      simpa [remainingRoots, rootsForWorlds] using hown
+    have hnext : CodeOwnsBelow ctx cur bound
+        (OwnsAfterPush frame remainingRoots) post code := by
+      intro nextFuel nextStore nextEnv resultStore resultValue hnextFuel
+        hpushed hcodeRun
+      obtain ⟨pushed, oldEnv, rfl, ⟨hΓOld, htailOld, hslotsOld⟩,
+        hownRest⟩ := hpushed
+      apply hcode hnextFuel
+      · exact ⟨⟨roots, tailValues, hΓOld.bump pushed,
+          htailStable.realize_bump htailOld pushed, hownRest⟩,
+          hslotsOld.bump pushed⟩
+      · exact hcodeRun
+    have hdrop : CodeOwnsBelow ctx cur bound
+        (fun dropStore dropEnv =>
+          frame dropEnv ∧
+          resolveAtom dropEnv (.var (Γ.rel abs)) = .ok value ∧
+          RootOwnership dropStore (⟨.shared, value⟩ :: remainingRoots))
+        post (emitOp (.drop (.var (Γ.rel abs))) code) :=
+      emit_drop_value_owned_below bound hbound post code hnext
+    apply hdrop hfuel
+    · exact ⟨⟨hΓ, htail, hslots⟩, hav.resolveAtom, howned⟩
+    · exact hrun
+
+/-- Releasing a slot-backed shared argument emits one `drop`. Its inert
+result slot bumps the `VEnv`, all remaining stable argument descriptors, and
+the protected-slot frame while consuming exactly the head argument root. -/
+theorem discard_slot_arg {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {abs : Nat} {worlds : List Owned} {avs : List AVal}
+    (htailStable : AValsStable avs) :
+    ∀ rest slots,
+      EmitSound ctx cur (emitOp (.drop (.var (Γ.rel abs))))
+        (OwnsArgsResultProtected Γ (.shared :: worlds)
+          (.slotA abs :: avs) rest slots)
+        (OwnsArgsResultProtected Γ.bump worlds avs rest slots) := by
+  intro rest slots
+  apply EmitSound.of_below
+  intro limit
+  exact discard_slot_arg_at (limit := limit) htailStable rest slots
+
+private theorem discard_slot_arg_value_op_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (htailStable : AValsStable avs) :
+    OpSoundBelow ctx cur limit (.drop (.var (Γ.rel abs)))
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+        sourceEnv (source :: sources) (.shared :: worlds)
+        (.slotA abs :: avs) sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro fuel store env store' result _ hpre hrun
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases havs with
+    | @cons headWorld tailWorlds headAV tailAVs value tailValues hav htail =>
+      cases hvalueGraphs with
+      | cons hvalueGraph htailGraphs =>
+        let remainingRoots :=
+          rootsForWorlds worlds tailValues ++ roots ++ rest
+        have howned : RootOwnership store
+            (⟨.shared, value⟩ :: remainingRoots) := by
+          simpa [remainingRoots, rootsForWorlds] using hown
+        obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+          runOp_drop_value_owned_restricts hav.resolveAtom howned hrun
+        have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+            Γ sourceEnv env roots :=
+          hΓ.ofRestricts hrestrict hownAfter
+            (fun root hmember => by
+              simp [remainingRoots, hmember])
+        have hlength : worlds.length = tailValues.length :=
+          htail.lengths.1.trans htail.lengths.2
+        have htailGraphsAfter :
+            Sim.ValuesGraph funRel store' sources tailValues :=
+          htailGraphs.ofRestrictsIn hrestrict hownAfter
+            (fun runtime hmember => by
+              obtain ⟨runtimeWorld, hroot⟩ :=
+                exists_root_mem_rootsForWorlds hlength hmember
+              exact ⟨runtimeWorld, by
+                simp [remainingRoots, hroot]⟩)
+        have hrestAfter : Sim.RootsGraph funRel store'
+            sourceRest rest :=
+          hrestGraph.ofRestrictsIn hrestrict hownAfter
+            (fun root hmember => by
+              simp [remainingRoots, hmember])
+        exact ⟨⟨roots, tailValues, hΓAfter.bump .erased,
+          htailStable.realize_bump htail .erased,
+          htailGraphsAfter, hrestAfter, hownAfter⟩,
+          hslots.bump .erased⟩
+
+/-- Operation-level semantic slot discard.  Exposing the exact midpoint lets
+the cost simulation attach the zero local ownership charge to the same
+destructive drop run. -/
+theorem discard_slot_arg_value_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (htailStable : AValsStable avs) :
+    OpSound ctx cur (.drop (.var (Γ.rel abs)))
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+        sourceEnv (source :: sources) (.shared :: worlds)
+        (.slotA abs :: avs) sourceRest rest slots)
+      (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump
+        sourceEnv sources worlds avs sourceRest rest slots) := by
+  apply OpSound.of_below
+  intro limit
+  exact discard_slot_arg_value_op_at (limit := limit) htailStable
+
+/-- Semantic slot discard transports the environment, remaining argument
+vector, and caller frame through the destructive shared drop. -/
+theorem discard_slot_arg_value
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    (htailStable : AValsStable avs) :
+    ∀ sourceRest rest slots,
+      EmitSound ctx cur (emitOp (.drop (.var (Γ.rel abs))))
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.slotA abs :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro sourceRest rest slots
+  exact OpSound.emit (discard_slot_arg_value_op htailStable)
+
+theorem discard_slot_arg_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    (htailStable : AValsStable avs) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.drop (.var (Γ.rel abs))))
+        (OwnsArgsResultProtected Γ (.shared :: worlds)
+          (.slotA abs :: avs) rest slots)
+        (OwnsArgsResultProtected Γ.bump worlds avs rest slots) := by
+  exact discard_slot_arg_at htailStable
+
+theorem discard_slot_arg_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {source : IxIR0.Value}
+    {sources : List IxIR0.Value} {abs : Nat}
+    {worlds : List Owned} {avs : List AVal}
+    (htailStable : AValsStable avs) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.drop (.var (Γ.rel abs))))
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+          sourceEnv (source :: sources) (.shared :: worlds)
+          (.slotA abs :: avs) sourceRest rest slots)
+        (GraphOwnsArgsResultProtected funRel recSelfRel Γ.bump
+          sourceEnv sources worlds avs sourceRest rest slots) := by
+  intro sourceRest rest slots
+  exact OpSoundBelow.emit
+    (discard_slot_arg_value_op_at htailStable)
+
+/-- Semantic result of `releaseAll`: every shared argument owner is consumed,
+the source-environment roots and protected slots survive, and the returned
+`VEnv` records exactly the inert slots pushed by slot-backed drops. -/
+def ReleaseAllSound (ctx : Ctx) (cur : FnDef) (input output : VEnv)
+    (emit : Emit) (avs : List AVal) : Prop :=
+  ∀ rest slots,
+    EmitSound ctx cur emit
+      (OwnsArgsResultProtected input
+        (List.replicate avs.length .shared) avs rest slots)
+      (OwnsVEnvProtected output rest slots)
+
+/-- Semantic refinement of `releaseAll`. Its argument source values are
+consumed together with their temporary roots, while the source environment
+and arbitrary caller frame remain graph-related. -/
+structure ReleaseAllValueSound (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (sourceEnv sourceValues : List IxIR0.Value)
+    (emit : Emit) (avs : List AVal) : Prop where
+  toReleaseAllSound : ReleaseAllSound ctx cur input output emit avs
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSound ctx cur emit
+      (GraphOwnsArgsResultProtected funRel recSelfRel input
+        sourceEnv sourceValues (List.replicate avs.length .shared)
+        avs sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        sourceEnv sourceRest rest slots)
+
+def ReleaseAllSoundBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (input output : VEnv) (emit : Emit) (avs : List AVal) : Prop :=
+  ∀ rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (OwnsArgsResultProtected input
+        (List.replicate avs.length .shared) avs rest slots)
+      (OwnsVEnvProtected output rest slots)
+
+structure ReleaseAllValueSoundBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (input output : VEnv) (sourceEnv sourceValues : List IxIR0.Value)
+    (emit : Emit) (avs : List AVal) : Prop where
+  toReleaseAllSoundBelow : ReleaseAllSoundBelow ctx cur limit input output
+    emit avs
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (GraphOwnsArgsResultProtected funRel recSelfRel input
+        sourceEnv sourceValues (List.replicate avs.length .shared)
+        avs sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        sourceEnv sourceRest rest slots)
+
+/-- Single bounded induction body for releasing a list of argument owners. -/
+private theorem releaseAll_sound_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {avs : List AVal}
+    (hstable : AValsStable avs) :
+    ReleaseAllSoundBelow ctx cur limit Γ (releaseAll Γ avs).1
+      (releaseAll Γ avs).2 avs := by
+  exact AValsStable.traverse
+    (Result := fun current currentAvs =>
+      ReleaseAllSoundBelow ctx cur limit current
+        (releaseAll current currentAvs).1
+        (releaseAll current currentAvs).2 currentAvs)
+    (hnil := by
+      intro current rest slots
+      apply EmitSoundBelow.strengthen
+      intro store env hpre
+      obtain ⟨⟨roots, values, hcurrent, havs, hown⟩, hslots⟩ := hpre
+      cases havs
+      exact ⟨⟨roots, hcurrent,
+        by simpa [rootsForWorlds] using hown⟩, hslots⟩)
+    (hslot := by
+      intro current abs currentAvs htail ih rest slots
+      have hcomposed := EmitSoundBelow.comp
+        (discard_slot_arg_below (ctx := ctx) (cur := cur)
+          (limit := limit) (Γ := current)
+          (abs := abs)
+          (worlds := List.replicate currentAvs.length .shared)
+          (avs := currentAvs) htail rest slots)
+        (ih rest slots)
+      simpa [releaseAll, List.replicate_succ] using hcomposed)
+    (hlit := by
+      intro current literal currentAvs htail ih rest slots
+      have hcomposed := EmitSoundBelow.comp
+        (discard_const_arg_below (ctx := ctx) (cur := cur)
+          (limit := limit) (Γ := current)
+          (atom := .lit literal)
+          (worlds := List.replicate currentAvs.length .shared)
+          (avs := currentAvs) AValStable.lit rest slots)
+        (ih rest slots)
+      simpa [releaseAll, List.replicate_succ, Function.comp_def] using
+        hcomposed)
+    (herased := by
+      intro current currentAvs htail ih rest slots
+      have hcomposed := EmitSoundBelow.comp
+        (discard_const_arg_below (ctx := ctx) (cur := cur)
+          (limit := limit) (Γ := current)
+          (atom := .erased)
+          (worlds := List.replicate currentAvs.length .shared)
+          (avs := currentAvs) AValStable.erased rest slots)
+        (ih rest slots)
+      simpa [releaseAll, List.replicate_succ, Function.comp_def] using
+        hcomposed)
+    (hstable := hstable)
+
+/-- Bounded graph adapter over the shared aligned stable-value traversal. -/
+private theorem releaseAll_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    ReleaseAllValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (releaseAll Γ avs).1 sourceEnv sourceValues
+      (releaseAll Γ avs).2 avs := by
+  refine
+    { toReleaseAllSoundBelow := releaseAll_sound_at hstable
+      graphEmits := ?_ }
+  apply AValsStable.traverseAligned
+    (Result := fun Γ sourceValues avs =>
+      ∀ sourceRest rest slots,
+        EmitSoundBelow ctx cur limit (releaseAll Γ avs).2
+          (GraphOwnsArgsResultProtected funRel recSelfRel Γ
+            sourceEnv sourceValues (List.replicate avs.length .shared)
+            avs sourceRest rest slots)
+          (GraphOwnsVEnvProtected funRel recSelfRel
+            (releaseAll Γ avs).1 sourceEnv sourceRest rest slots))
+    (hstable := hstable) (hlength := hsourceLength)
+  · intro Γ sourceRest rest slots
+    apply EmitSoundBelow.strengthen
+    intro store env hpre
+    obtain ⟨⟨roots, values, hΓ, havs, hvalueGraphs,
+        hrestGraph, hown⟩, hslots⟩ := hpre
+    cases havs
+    cases hvalueGraphs
+    exact ⟨⟨roots, hΓ, hrestGraph,
+      by simpa [rootsForWorlds] using hown⟩, hslots⟩
+  · intro Γ source sources abs avs htail ih sourceRest rest slots
+    have hcomposed := EmitSoundBelow.comp
+      (discard_slot_arg_value_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := Γ)
+        (sourceEnv := sourceEnv) (source := source)
+        (sources := sources) (abs := abs)
+        (worlds := List.replicate avs.length .shared)
+        (avs := avs) htail sourceRest rest slots)
+      (ih sourceRest rest slots)
+    simpa [releaseAll, List.replicate_succ] using hcomposed
+  · intro Γ source sources literal avs htail ih sourceRest rest slots
+    have hcomposed := EmitSoundBelow.comp
+      (discard_const_arg_value_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := Γ)
+        (sourceEnv := sourceEnv) (source := source)
+        (sources := sources) (atom := .lit literal)
+        (worlds := List.replicate avs.length .shared)
+        (avs := avs) AValStable.lit sourceRest rest slots)
+      (ih sourceRest rest slots)
+    simpa [releaseAll, List.replicate_succ, Function.comp_def] using
+      hcomposed
+  · intro Γ source sources avs htail ih sourceRest rest slots
+    have hcomposed := EmitSoundBelow.comp
+      (discard_const_arg_value_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := Γ)
+        (sourceEnv := sourceEnv) (source := source)
+        (sources := sources) (atom := .erased)
+        (worlds := List.replicate avs.length .shared)
+        (avs := avs) AValStable.erased sourceRest rest slots)
+      (ih sourceRest rest slots)
+    simpa [releaseAll, List.replicate_succ, Function.comp_def] using
+      hcomposed
+
+/-- Stable argument descriptors determine the exact `releaseAll` ownership
+transformer by closing the single bounded induction body. -/
+theorem releaseAll_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {avs : List AVal} (hstable : AValsStable avs) :
+    ReleaseAllSound ctx cur Γ (releaseAll Γ avs).1
+      (releaseAll Γ avs).2 avs := by
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    releaseAll_sound_at (limit := limit) hstable rest slots
+
+/-- Stable argument descriptors and an equally sized source vector determine
+the exact semantic `releaseAll` transformer. -/
+theorem releaseAll_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    ReleaseAllValueSound funRel recSelfRel ctx cur Γ
+      (releaseAll Γ avs).1 sourceEnv sourceValues
+      (releaseAll Γ avs).2 avs := by
+  refine
+    { toReleaseAllSound := releaseAll_sound hstable
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.of_below fun limit =>
+    (releaseAll_value_sound_at (limit := limit) hstable
+      hsourceLength).graphEmits sourceRest rest slots
+
+theorem releaseAll_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {avs : List AVal}
+    (hstable : AValsStable avs) :
+    ReleaseAllSoundBelow ctx cur limit Γ (releaseAll Γ avs).1
+      (releaseAll Γ avs).2 avs := by
+  exact releaseAll_sound_at hstable
+
+theorem releaseAll_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv sourceValues : List IxIR0.Value} {avs : List AVal}
+    (hstable : AValsStable avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    ReleaseAllValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (releaseAll Γ avs).1 sourceEnv sourceValues
+      (releaseAll Γ avs).2 avs := by
+  exact releaseAll_value_sound_at hstable hsourceLength
+
+/-! ## Source-variable transitions -/
+
+/-- Retain one protected borrowed field into a previously released entry.
+The exact `dup` result occupies the old `VEnv.depth`, the entry becomes held,
+and all original field slots plus all borrow facts survive for the remaining
+field-fold iterations. -/
+theorem retain_borrowed_into_entry_owned
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i placeholderAbs fieldAbs remaining : Nat} {value : RVal}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal}
+    (hentry : Γ.entries[i]? =
+      some (.slot placeholderAbs 0 .many false))
+    (hslotMem : (fieldAbs, value) ∈ slots)
+    (hborrowMem : value ∈ borrowed) :
+    EmitSound ctx cur (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (OwnsVEnvBorrowed Γ rest slots borrowed)
+      (OwnsVEnvBorrowed
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        rest slots borrowed) := by
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨⟨roots, hΓ, hown⟩, hslots⟩, hborrowed⟩ := hpre
+  obtain ⟨hfieldBound, hfieldSlot⟩ :=
+    hslots fieldAbs value hslotMem
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok value :=
+    (AValRealizes.slot hfieldBound hfieldSlot).resolveAtom
+  have hworld : HasWorld store .shared value :=
+    hborrowed value hborrowMem
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨nextStore, heval, hownNext, hborrowedNext⟩ :=
+      runOp_retain_borrowed_preserves_hasWorlds
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hworld (show RootOwnership store (roots ++ rest) from hown)
+        hborrowed
+    have hpair : (nextStore, value) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    have hstoreEq : nextStore = store' := congrArg Prod.fst hpair
+    have hresultEq : value = result := congrArg Prod.snd hpair
+    subst nextStore
+    subst result
+    have hΓbump : VEnvRealizes Γ.bump (value :: env) roots :=
+      hΓ.bump value
+    have hentryBump : Γ.bump.entries[i]? =
+        some (.slot placeholderAbs 0 .many false) := by
+      simpa [VEnv.bump] using hentry
+    have hnewBound : Γ.depth < Γ.bump.depth := by simp [VEnv.bump]
+    have hnewSlot :
+        (value :: env)[Γ.bump.rel Γ.depth]? = some value := by
+      simp [VEnv.bump, VEnv.rel]
+    obtain ⟨before, after, hroots, hentries⟩ :=
+      hΓbump.entries.holdAt hentryBump hnewBound hnewSlot
+    have hset : VEnvRealizes
+        (Γ.bump.setEntry i (.slot Γ.depth remaining .many true))
+        (value :: env)
+        (before ++ ⟨.shared, value⟩ :: after) :=
+      hΓbump.setEntry hentries
+    have henvEq :
+        Γ.bump.setEntry i (.slot Γ.depth remaining .many true) =
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump) := by
+      cases Γ
+      rfl
+    rw [henvEq] at hset
+    have howned : RootOwnership store'
+        ((before ++ ⟨.shared, value⟩ :: after) ++ rest) := by
+      rw [hroots] at hownNext
+      exact hownNext.perm
+        (perm_extract_root ⟨.shared, value⟩ before after rest).symm
+    refine ⟨⟨⟨before ++ ⟨.shared, value⟩ :: after,
+      hset, howned⟩, ?_⟩, hborrowedNext⟩
+    exact (hslots.setEntry).bump value
+
+/-- Fuel-bounded retained-field transition used by the recursive compiler
+induction. The transition is call-free and preserves the same protected
+slots and borrow facts as its unbounded counterpart. -/
+theorem retain_borrowed_into_entry_owned_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i placeholderAbs fieldAbs remaining : Nat} {value : RVal}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal}
+    (hentry : Γ.entries[i]? =
+      some (.slot placeholderAbs 0 .many false))
+    (hslotMem : (fieldAbs, value) ∈ slots)
+    (hborrowMem : value ∈ borrowed) :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (OwnsVEnvBorrowed Γ rest slots borrowed)
+      (OwnsVEnvBorrowed
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        rest slots borrowed) := by
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨⟨roots, hΓ, hown⟩, hslots⟩, hborrowed⟩ := hpre
+  obtain ⟨hfieldBound, hfieldSlot⟩ :=
+    hslots fieldAbs value hslotMem
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok value :=
+    (AValRealizes.slot hfieldBound hfieldSlot).resolveAtom
+  have hworld : HasWorld store .shared value :=
+    hborrowed value hborrowMem
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨nextStore, heval, hownNext, hborrowedNext⟩ :=
+      runOp_retain_borrowed_preserves_hasWorlds
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hworld (show RootOwnership store (roots ++ rest) from hown)
+        hborrowed
+    have hpair : (nextStore, value) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have hΓbump : VEnvRealizes Γ.bump (value :: env) roots :=
+      hΓ.bump value
+    have hentryBump : Γ.bump.entries[i]? =
+        some (.slot placeholderAbs 0 .many false) := by
+      simpa [VEnv.bump] using hentry
+    have hnewBound : Γ.depth < Γ.bump.depth := by simp [VEnv.bump]
+    have hnewSlot :
+        (value :: env)[Γ.bump.rel Γ.depth]? = some value := by
+      simp [VEnv.bump, VEnv.rel]
+    obtain ⟨before, after, hroots, hentries⟩ :=
+      hΓbump.entries.holdAt hentryBump hnewBound hnewSlot
+    have hset : VEnvRealizes
+        (Γ.bump.setEntry i (.slot Γ.depth remaining .many true))
+        (value :: env)
+        (before ++ ⟨.shared, value⟩ :: after) :=
+      hΓbump.setEntry hentries
+    have henvEq :
+        Γ.bump.setEntry i (.slot Γ.depth remaining .many true) =
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump) := by
+      cases Γ
+      rfl
+    rw [henvEq] at hset
+    have howned : RootOwnership store'
+        ((before ++ ⟨.shared, value⟩ :: after) ++ rest) := by
+      rw [hroots] at hownNext
+      exact hownNext.perm
+        (perm_extract_root ⟨.shared, value⟩ before after rest).symm
+    refine ⟨⟨⟨before ++ ⟨.shared, value⟩ :: after,
+      hset, howned⟩, ?_⟩, hborrowedNext⟩
+    exact (hslots.setEntry).bump value
+
+/-- Semantic retained-field transition. Besides the ownership update, the
+newly held entry receives the source graph named by its logical index, and
+all still-pending borrowed-field graphs survive the refcount-only update. -/
+theorem retain_borrowed_into_entry_value_opSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i placeholderAbs fieldAbs remaining : Nat}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)}
+    {rest extra : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal} {retains : List RecursorFieldRetain}
+    (hentry : Γ.entries[i]? =
+      some (.slot placeholderAbs 0 .many false)) :
+    OpSoundBelow ctx cur limit (.dup (.var (Γ.rel fieldAbs)))
+      (GraphOwnsVEnvRetains funRel recSelfRel Γ sourceEnv
+        sourceRest rest extra slots borrowed
+        (⟨i, fieldAbs, remaining⟩ :: retains))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        sourceEnv sourceRest rest extra slots borrowed retains) := by
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, hΓ, hframe, hown, hslots, hborrowed,
+      hgraphs⟩ := hpre
+  obtain ⟨source, value, hsource, hslotMem, hborrowMem, hvalue⟩ :=
+    hgraphs ⟨i, fieldAbs, remaining⟩ (by simp)
+  obtain ⟨hfieldBound, hfieldSlot⟩ :=
+    hslots fieldAbs value hslotMem
+  have hresolve :
+      resolveAtom env (.var (Γ.rel fieldAbs)) = .ok value :=
+    (AValRealizes.slot hfieldBound hfieldSlot).resolveAtom
+  have hworld : HasWorld store .shared value :=
+    hborrowed value hborrowMem
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨nextStore, heval, hextends, hvalueNext, hownNext⟩ :=
+      runOp_retain_borrowed_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hresolve hworld hvalue
+        (show RootOwnership store (roots ++ extra ++ rest) from hown)
+    have hpair : (nextStore, value) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    have hstoreEq : nextStore = store' := congrArg Prod.fst hpair
+    have hresultEq : value = result := congrArg Prod.snd hpair
+    subst nextStore
+    subst result
+    have hΓbump : VEnvValueGraph funRel recSelfRel store'
+        Γ.bump sourceEnv (value :: env) roots :=
+      (hΓ.monoStore hextends).bump value
+    have hentryBump : Γ.bump.entries[i]? =
+        some (.slot placeholderAbs 0 .many false) := by
+      simpa [VEnv.bump] using hentry
+    have hnewBound : Γ.depth < Γ.bump.depth := by simp [VEnv.bump]
+    have hnewSlot :
+        (value :: env)[Γ.bump.rel Γ.depth]? = some value := by
+      simp [VEnv.bump, VEnv.rel]
+    have hworldNext : HasWorld store' .shared value :=
+      hworld.monoStore hextends
+    obtain ⟨before, after, hroots, hentries⟩ :=
+      hΓbump.entries.holdAt hentryBump hsource hnewBound hnewSlot
+        hworldNext hvalueNext
+    have hset : VEnvValueGraph funRel recSelfRel store'
+        (Γ.bump.setEntry i (.slot Γ.depth remaining .many true))
+        sourceEnv (value :: env)
+        (before ++ ⟨.shared, value⟩ :: after) :=
+      hΓbump.setEntry hentries
+    have henvEq :
+        Γ.bump.setEntry i (.slot Γ.depth remaining .many true) =
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump) := by
+      cases Γ
+      rfl
+    rw [henvEq] at hset
+    have howned : RootOwnership store'
+        ((before ++ ⟨.shared, value⟩ :: after) ++ extra ++ rest) := by
+      rw [hroots] at hownNext
+      have hfront : RootOwnership store'
+          (⟨.shared, value⟩ :: (before ++ after) ++ (extra ++ rest)) := by
+        simpa [List.append_assoc] using hownNext
+      have hreordered := hfront.perm
+        (perm_extract_root ⟨.shared, value⟩ before after
+          (extra ++ rest)).symm
+      simpa [List.append_assoc] using hreordered
+    have htailBefore : RetainsValueGraphs funRel store sourceEnv slots
+        borrowed retains := by
+      intro retain hmember
+      exact hgraphs retain (by simp [hmember])
+    refine ⟨before ++ ⟨.shared, value⟩ :: after, hset,
+      hframe.monoStore hextends, howned, (hslots.setEntry).bump value,
+      ?_, htailBefore.monoStore hextends⟩
+    intro candidate hmember
+    exact (hborrowed candidate hmember).monoStore hextends
+
+/-- Fuel-bounded emitter form of the semantic retained-field transition. -/
+theorem retain_borrowed_into_entry_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i placeholderAbs fieldAbs remaining : Nat}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)}
+    {rest extra : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal} {retains : List RecursorFieldRetain}
+    (hentry : Γ.entries[i]? =
+      some (.slot placeholderAbs 0 .many false)) :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.dup (.var (Γ.rel fieldAbs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel Γ sourceEnv
+        sourceRest rest extra slots borrowed
+        (⟨i, fieldAbs, remaining⟩ :: retains))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        sourceEnv sourceRest rest extra slots borrowed retains) :=
+  OpSoundBelow.emit
+    (retain_borrowed_into_entry_value_opSoundBelow hentry)
+
+private theorem drop_major_owned_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {majorAbs : Nat} {major : RVal}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal}
+    (hmajor : (majorAbs, major) ∈ slots) :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.rel majorAbs))))
+      (OwnsVEnvBorrowed Γ (⟨.shared, major⟩ :: rest) slots borrowed)
+      (OwnsVEnvProtected Γ.bump rest slots) := by
+  intro bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hpre hrun
+  obtain ⟨⟨⟨roots, hΓ, hown⟩, hslots⟩, _⟩ := hpre
+  obtain ⟨hmajorBound, hmajorSlot⟩ :=
+    hslots majorAbs major hmajor
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes Γ oldEnv roots ∧ SlotsRealize Γ oldEnv slots
+  have hnext : CodeOwnsBelow ctx cur bound
+      (OwnsAfterPush frame (roots ++ rest)) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hnextFuel
+      hpushed hcodeRun
+    obtain ⟨pushed, oldEnv, rfl, ⟨hrealize, hslotsOld⟩,
+      hownRest⟩ := hpushed
+    apply hcode hnextFuel
+    · exact ⟨⟨roots, hrealize.bump pushed, hownRest⟩,
+        hslotsOld.bump pushed⟩
+    · exact hcodeRun
+  apply (emit_drop_value_owned_below (ctx := ctx) (cur := cur)
+    (limit := limit) (frame := frame)
+    (target := .var (Γ.rel majorAbs)) (value := major)
+    (rest := roots ++ rest)) bound hbound post code hnext hfuel
+  · refine ⟨⟨hΓ, hslots⟩,
+      (AValRealizes.slot hmajorBound hmajorSlot).resolveAtom, ?_⟩
+    exact hown.perm
+      (perm_extract_root_front ⟨.shared, major⟩ roots rest)
+  · exact hrun
+
+/-- Drop the recursor major after every needed constructor field has been
+retained. The major is the first external root, while retained fields and
+pre-major parameters are represented by `VEnv` roots. Borrow facts are no
+longer promised after destroying the scrutinee. -/
+theorem drop_major_owned {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {majorAbs : Nat} {major : RVal} {rest : List Root}
+    {slots : List (Nat × RVal)} {borrowed : List RVal}
+    (hmajor : (majorAbs, major) ∈ slots) :
+    EmitSound ctx cur (emitOp (.drop (.var (Γ.rel majorAbs))))
+      (OwnsVEnvBorrowed Γ (⟨.shared, major⟩ :: rest) slots borrowed)
+      (OwnsVEnvProtected Γ.bump rest slots) := by
+  apply EmitSound.of_below
+  intro limit
+  exact drop_major_owned_at (limit := limit) hmajor
+
+/-- Fuel-bounded major release. This is the middle transition of the
+generated recursor prefix. -/
+theorem drop_major_owned_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {majorAbs : Nat} {major : RVal}
+    {rest : List Root} {slots : List (Nat × RVal)}
+    {borrowed : List RVal}
+    (hmajor : (majorAbs, major) ∈ slots) :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.rel majorAbs))))
+      (OwnsVEnvBorrowed Γ (⟨.shared, major⟩ :: rest) slots borrowed)
+      (OwnsVEnvProtected Γ.bump rest slots) := by
+  exact drop_major_owned_at hmajor
+
+/-- Semantic fuel-bounded major release.  Once the retain list is empty the
+borrow-only witnesses may be discarded; every logical environment root and
+caller-frame root survives the destructive release and its graph transports
+through the resulting store restriction. -/
+theorem drop_major_value_opSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)}
+    {majorAbs : Nat} {major : RVal} {rest : List Root}
+    {slots : List (Nat × RVal)} {borrowed : List RVal}
+    (hmajor : (majorAbs, major) ∈ slots) :
+    OpSoundBelow ctx cur limit (.drop (.var (Γ.rel majorAbs)))
+      (GraphOwnsVEnvRetains funRel recSelfRel Γ sourceEnv
+        sourceRest rest [⟨.shared, major⟩] slots borrowed [])
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ.bump sourceEnv
+        sourceRest rest slots) := by
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨roots, hΓ, hrestGraph, hown, hslots, _, _⟩ := hpre
+  obtain ⟨hmajorBound, hmajorSlot⟩ :=
+    hslots majorAbs major hmajor
+  have hresolve :
+      resolveAtom env (.var (Γ.rel majorAbs)) = .ok major :=
+    (AValRealizes.slot hmajorBound hmajorSlot).resolveAtom
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have howned : RootOwnership store
+        (⟨.shared, major⟩ :: roots ++ rest) := by
+      have hcanonical : RootOwnership store
+          (roots ++ ⟨.shared, major⟩ :: rest) := by
+        simpa [List.append_assoc] using hown
+      have hreordered := hcanonical.perm
+        (perm_extract_root_front ⟨.shared, major⟩ roots rest)
+      exact hreordered
+    obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+      runOp_drop_value_owned_restricts hresolve howned hrun
+    have hΓAfter : VEnvValueGraph funRel recSelfRel store'
+        Γ sourceEnv env roots :=
+      hΓ.ofRestricts hrestrict hownAfter
+        (fun root hmember =>
+          List.mem_append_left rest hmember)
+    have hrestAfter : Sim.RootsGraph funRel store' sourceRest rest :=
+      hrestGraph.ofRestrictsIn hrestrict hownAfter
+        (fun root hmember =>
+          List.mem_append_right roots hmember)
+    refine ⟨⟨roots, hΓAfter.bump .erased, hrestAfter, ?_⟩,
+      hslots.bump .erased⟩
+    exact hownAfter
+
+/-- Fuel-bounded emitter form of the semantic recursor-major release. -/
+theorem drop_major_value_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)}
+    {majorAbs : Nat} {major : RVal} {rest : List Root}
+    {slots : List (Nat × RVal)} {borrowed : List RVal}
+    (hmajor : (majorAbs, major) ∈ slots) :
+    EmitSoundBelow ctx cur limit
+      (emitOp (.drop (.var (Γ.rel majorAbs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel Γ sourceEnv
+        sourceRest rest [⟨.shared, major⟩] slots borrowed [])
+      (GraphOwnsVEnvProtected funRel recSelfRel Γ.bump sourceEnv
+        sourceRest rest slots) :=
+  OpSoundBelow.emit (drop_major_value_opSoundBelow hmajor)
+
+/-- Single bounded common proof for releasing one held entry, abstracted over
+shared versus affine destruction. -/
+private theorem release_slot_owned_at
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat} {uses : Uses} {world : Owned} {releaseEmit : Emit}
+    (hworld : worldOfUses uses = world)
+    (hentry : Γ.entries[i]? = some (.slot abs 0 uses true))
+    (hop : ∀ {frame : List RVal → Prop} {value : RVal}
+        {tailRoots : List Root},
+      EmitSoundBelow ctx cur limit releaseEmit
+        (fun store env => frame env ∧
+          resolveAtom env (.var (Γ.rel abs)) = .ok value ∧
+          RootOwnership store (⟨world, value⟩ :: tailRoots))
+        (OwnsAfterPush frame tailRoots)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit releaseEmit
+        (OwnsVEnvProtected Γ rest slots)
+        (OwnsVEnvProtected
+          ((Γ.setEntry i (.slot abs 0 uses false)).bump) rest slots) := by
+  intro rest slots bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hpre hrun
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  obtain ⟨value, before, after, hboundSlot, hslot, hroots, hreleased⟩ :=
+    hΓ.entries.releaseAt hentry
+  let Γreleased := Γ.setEntry i (.slot abs 0 uses false)
+  let tailRoots := before ++ after ++ rest
+  let frame : List RVal → Prop := fun oldEnv =>
+    VEnvRealizes Γreleased oldEnv (before ++ after) ∧
+      SlotsRealize Γreleased oldEnv slots
+  have hΓreleased : VEnvRealizes Γreleased env (before ++ after) :=
+    hΓ.setEntry hreleased
+  have howned : RootOwnership store (⟨world, value⟩ :: tailRoots) := by
+    rw [hroots] at hown
+    have hfront := hown.perm
+      (perm_extract_root ⟨worldOfUses uses, value⟩ before after rest)
+    simpa [tailRoots, hworld] using hfront
+  have hnext : CodeOwnsBelow ctx cur bound
+      (OwnsAfterPush frame tailRoots) post code := by
+    intro nextFuel nextStore nextEnv resultStore resultValue hnextFuel
+      hpushed hcodeRun
+    obtain ⟨pushed, oldEnv, rfl, ⟨hrealize, hslotsOld⟩,
+      hownRest⟩ := hpushed
+    apply hcode hnextFuel
+    · refine ⟨⟨before ++ after, hrealize.bump pushed, ?_⟩,
+        hslotsOld.bump pushed⟩
+      simpa [tailRoots, List.append_assoc] using hownRest
+    · exact hcodeRun
+  apply hop bound hbound post code hnext hfuel
+  · refine ⟨⟨hΓreleased, hslots.setEntry⟩, ?_, howned⟩
+    exact (AValRealizes.slot hboundSlot hslot).resolveAtom
+  · exact hrun
+
+/-- Single bounded semantic proof for releasing one slot. The selected root is
+consumed while reverse shape inclusion rebuilds every surviving graph. -/
+private theorem release_slot_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat} {uses : Uses} {world : Owned} {releaseOp : Op}
+    (hworld : worldOfUses uses = world)
+    (hentry : Γ.entries[i]? = some (.slot abs 0 uses true))
+    (hop : ∀ {fuel : Nat} {store store' : Store} {env : List RVal}
+        {value result : RVal} {tailRoots : List Root},
+      resolveAtom env (.var (Γ.rel abs)) = .ok value →
+      RootOwnership store (⟨world, value⟩ :: tailRoots) →
+      runOp ctx (fuel + 1) cur store env releaseOp =
+        .ok (store', result) →
+      result = .erased ∧ Sim.StoreGraphRestricts store store' ∧
+        RootOwnership store' tailRoots) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitSoundBelow ctx cur limit (emitOp releaseOp)
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 uses false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  intro sourceEnv sourceRest rest slots
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+    obtain ⟨_, value, before, after, _, hbound, hslot, _, _,
+        hroots, hreleased⟩ := hΓ.entries.releaseAt hentry
+    let Γreleased := Γ.setEntry i (.slot abs 0 uses false)
+    let tailRoots := before ++ after ++ rest
+    have hΓreleased : VEnvValueGraph funRel recSelfRel store
+        Γreleased sourceEnv env (before ++ after) :=
+      hΓ.setEntry hreleased
+    have howned : RootOwnership store
+        (⟨world, value⟩ :: tailRoots) := by
+      rw [hroots] at hown
+      have hfront := hown.perm
+        (perm_extract_root
+          ⟨worldOfUses uses, value⟩ before after rest)
+      simpa [tailRoots, hworld] using hfront
+    have hresolve :
+        resolveAtom env (.var (Γ.rel abs)) = .ok value :=
+      (AValRealizes.slot hbound hslot).resolveAtom
+    obtain ⟨rfl, hrestrict, hownAfter⟩ :=
+      hop hresolve howned hrun
+    have hΓafter : VEnvValueGraph funRel recSelfRel store'
+        Γreleased sourceEnv env (before ++ after) :=
+      hΓreleased.ofRestricts hrestrict hownAfter
+        (fun root hmember => by
+          simpa [tailRoots] using
+            List.mem_append_left rest hmember)
+    have hrestAfter : Sim.RootsGraph funRel store' sourceRest rest :=
+      hrestGraph.ofRestrictsIn hrestrict hownAfter
+        (fun root hmember => by
+          simpa [tailRoots] using
+            List.mem_append_right (before ++ after) hmember)
+    refine ⟨⟨before ++ after, ?_, hrestAfter, ?_⟩, ?_⟩
+    · exact hΓafter.bump .erased
+    · simpa [tailRoots] using hownAfter
+    · exact (hslots.setEntry).bump .erased
+
+theorem release_slot_many_owned {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ rest slots,
+      EmitSound ctx cur (emitOp (.drop (.var (Γ.rel abs))))
+        (OwnsVEnvProtected Γ rest slots)
+        (OwnsVEnvProtected
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump) rest slots) := by
+  intro rest slots
+  apply EmitSound.of_below
+  intro limit
+  apply release_slot_owned_at (limit := limit) (world := .shared) rfl hentry
+  exact emit_drop_value_owned_below
+
+theorem release_slot_affine_owned {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ rest slots,
+      EmitSound ctx cur (emitOp (.dropU (.var (Γ.rel abs))))
+        (OwnsVEnvProtected Γ rest slots)
+        (OwnsVEnvProtected
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump) rest slots) := by
+  intro rest slots
+  apply EmitSound.of_below
+  intro limit
+  apply release_slot_owned_at (limit := limit) (world := .unique) rfl hentry
+  exact emit_dropU_value_owned_below
+
+/-- Releasing a dead shared entry preserves the source graph of every other
+logical entry and every caller-framed root. -/
+theorem release_slot_many_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv} {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitSound ctx cur (emitOp (.drop (.var (Γ.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  intro sourceEnv sourceRest rest slots
+  apply EmitSound.of_below
+  intro limit
+  apply release_slot_value_sound_at (limit := limit)
+    (world := .shared) rfl hentry
+  exact runOp_drop_value_owned_restricts
+
+/-- Releasing a dead affine entry has the same graph-preserving interface,
+using unique deep destruction underneath. -/
+theorem release_slot_affine_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv} {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitSound ctx cur (emitOp (.dropU (.var (Γ.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  intro sourceEnv sourceRest rest slots
+  apply EmitSound.of_below
+  intro limit
+  apply release_slot_value_sound_at (limit := limit)
+    (world := .unique) rfl hentry
+  exact runOp_dropU_value_owned_restricts
+
+theorem release_slot_many_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.drop (.var (Γ.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  apply release_slot_value_sound_at (world := .shared) rfl hentry
+  exact runOp_drop_value_owned_restricts
+
+theorem release_slot_affine_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ sourceEnv sourceRest rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.dropU (.var (Γ.rel abs))))
+        (GraphOwnsVEnvProtected funRel recSelfRel Γ
+          sourceEnv sourceRest rest slots)
+        (GraphOwnsVEnvProtected funRel recSelfRel
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump)
+          sourceEnv sourceRest rest slots) := by
+  apply release_slot_value_sound_at (world := .unique) rfl hentry
+  exact runOp_dropU_value_owned_restricts
+
+theorem release_slot_many_owned_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .many true)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.drop (.var (Γ.rel abs))))
+        (OwnsVEnvProtected Γ rest slots)
+        (OwnsVEnvProtected
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump) rest slots) := by
+  apply release_slot_owned_at (world := .shared) rfl hentry
+  exact emit_drop_value_owned_below
+
+theorem release_slot_affine_owned_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat}
+    (hentry : Γ.entries[i]? = some (.slot abs 0 .affine true)) :
+    ∀ rest slots,
+      EmitSoundBelow ctx cur limit
+        (emitOp (.dropU (.var (Γ.rel abs))))
+        (OwnsVEnvProtected Γ rest slots)
+        (OwnsVEnvProtected
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump) rest slots) := by
+  apply release_slot_owned_at (world := .unique) rfl hentry
+  exact emit_dropU_value_owned_below
+
+/-- Proof-relevant successful execution plan for `releaseSlots`. Linear and
+erased dead parameters have no constructor because the executable lowerer
+rejects them. -/
+inductive ReleasePlan : VEnv → List SlotDrop → VEnv → Emit → Prop where
+  | nil {Γ : VEnv} :
+      ReleasePlan Γ [] Γ (_root_.id : Emit)
+  | many {Γ output : VEnv} {i abs : Nat} {drops : List SlotDrop}
+      {tailEmit : Emit}
+      (hentry : Γ.entries[i]? = some (.slot abs 0 .many true))
+      (tail : ReleasePlan
+        ((Γ.setEntry i (.slot abs 0 .many false)).bump)
+        drops output tailEmit) :
+      ReleasePlan Γ (⟨i, abs, .many⟩ :: drops) output
+        (emitOp (.drop (.var (Γ.rel abs))) ∘ tailEmit)
+  | affine {Γ output : VEnv} {i abs : Nat} {drops : List SlotDrop}
+      {tailEmit : Emit}
+      (hentry : Γ.entries[i]? = some (.slot abs 0 .affine true))
+      (tail : ReleasePlan
+        ((Γ.setEntry i (.slot abs 0 .affine false)).bump)
+        drops output tailEmit) :
+      ReleasePlan Γ (⟨i, abs, .affine⟩ :: drops) output
+        (emitOp (.dropU (.var (Γ.rel abs))) ∘ tailEmit)
+
+/-- Dependent traversal of a release plan.  The lowering-state transition,
+descriptor consumption, and emitter composition are exposed once here, while
+clients supply only the judgment-specific identity, shared-drop, and
+affine-drop steps. -/
+theorem ReleasePlan.traverse
+    {Result : VEnv → List SlotDrop → VEnv → Emit → Prop}
+    (hnil : ∀ Γ, Result Γ [] Γ (_root_.id : Emit))
+    (hmany : ∀ {Γ output : VEnv} {i abs : Nat}
+        {drops : List SlotDrop} {tailEmit : Emit},
+      Γ.entries[i]? = some (.slot abs 0 .many true) →
+      Result
+        ((Γ.setEntry i (.slot abs 0 .many false)).bump)
+        drops output tailEmit →
+      Result Γ (⟨i, abs, .many⟩ :: drops) output
+        (emitOp (.drop (.var (Γ.rel abs))) ∘ tailEmit))
+    (haffine : ∀ {Γ output : VEnv} {i abs : Nat}
+        {drops : List SlotDrop} {tailEmit : Emit},
+      Γ.entries[i]? = some (.slot abs 0 .affine true) →
+      Result
+        ((Γ.setEntry i (.slot abs 0 .affine false)).bump)
+        drops output tailEmit →
+      Result Γ (⟨i, abs, .affine⟩ :: drops) output
+        (emitOp (.dropU (.var (Γ.rel abs))) ∘ tailEmit))
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit) :
+    Result input drops output emit := by
+  induction hplan with
+  | nil => exact hnil _
+  | many hentry tail ih => exact hmany hentry ih
+  | affine hentry tail ih => exact haffine hentry ih
+
+/-- Append untouched logical entries without changing runtime depth. This is
+the frame needed to prove parameter releases inside lifted-function
+environments that also contain capture/source entries. -/
+def frameVEnvEntries (Γ : VEnv) (frame : List VEntry) : VEnv :=
+  { Γ with entries := Γ.entries ++ frame }
+
+/-- Prepend unrelated logical entries without changing runtime depth. Release
+descriptor indices must be shifted by the prefix length. -/
+def prependVEnvEntries (leading : List VEntry) (Γ : VEnv) : VEnv :=
+  { Γ with entries := leading ++ Γ.entries }
+
+theorem ReleasePlan.entries_length {input output : VEnv}
+    {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit) :
+    output.entries.length = input.entries.length := by
+  apply ReleasePlan.traverse
+    (Result := fun current _ final _ =>
+      final.entries.length = current.entries.length)
+    (hplan := hplan)
+  · intro Γ
+    rfl
+  · intro Γ output i abs drops tailEmit hentry ih
+    simpa [VEnv.setEntry, VEnv.bump] using ih
+  · intro Γ output i abs drops tailEmit hentry ih
+    simpa [VEnv.setEntry, VEnv.bump] using ih
+
+/-- Release plans preserve an appended suffix of entries. All generated drop
+indices point into the original prefix, and entry updates commute with this
+frame. -/
+theorem ReleasePlan.frameEntries {input output : VEnv}
+    {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit) (frame : List VEntry) :
+    ReleasePlan (frameVEnvEntries input frame) drops
+      (frameVEnvEntries output frame) emit := by
+  apply ReleasePlan.traverse
+    (Result := fun current drops final emit =>
+      ReleasePlan (frameVEnvEntries current frame) drops
+        (frameVEnvEntries final frame) emit)
+    (hplan := hplan)
+  · intro Γ
+    exact ReleasePlan.nil
+  · intro Γ output i abs drops tailEmit hentry ih
+    obtain ⟨hi, _⟩ := List.getElem?_eq_some_iff.mp hentry
+    have hentryFrame : (frameVEnvEntries Γ frame).entries[i]? =
+        some (.slot abs 0 .many true) := by
+      simpa [frameVEnvEntries,
+        List.getElem?_append_left hi] using hentry
+    have hnext :
+        ((frameVEnvEntries Γ frame).setEntry i
+          (.slot abs 0 .many false)).bump =
+        (frameVEnvEntries
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump) frame) := by
+      cases Γ
+      simp [frameVEnvEntries, VEnv.setEntry, VEnv.bump,
+        List.set_append_left _ _ hi]
+    apply ReleasePlan.many hentryFrame
+    rw [hnext]
+    simpa [frameVEnvEntries, VEnv.rel] using ih
+  · intro Γ output i abs drops tailEmit hentry ih
+    obtain ⟨hi, _⟩ := List.getElem?_eq_some_iff.mp hentry
+    have hentryFrame : (frameVEnvEntries Γ frame).entries[i]? =
+        some (.slot abs 0 .affine true) := by
+      simpa [frameVEnvEntries,
+        List.getElem?_append_left hi] using hentry
+    have hnext :
+        ((frameVEnvEntries Γ frame).setEntry i
+          (.slot abs 0 .affine false)).bump =
+        (frameVEnvEntries
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump) frame) := by
+      cases Γ
+      simp [frameVEnvEntries, VEnv.setEntry, VEnv.bump,
+        List.set_append_left _ _ hi]
+    apply ReleasePlan.affine hentryFrame
+    rw [hnext]
+    simpa [frameVEnvEntries, VEnv.rel] using ih
+
+/-- A leading logical-entry frame preserves a release plan after shifting
+every descriptor's entry index. Absolute runtime slots and emitted relative
+indices are unchanged because the frame does not alter runtime depth. -/
+theorem ReleasePlan.prependEntries {input output : VEnv}
+    {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit)
+    (leading : List VEntry) :
+    ReleasePlan (prependVEnvEntries leading input)
+      (drops.map (SlotDrop.offsetEntry leading.length))
+      (prependVEnvEntries leading output) emit := by
+  apply ReleasePlan.traverse
+    (Result := fun current drops final emit =>
+      ReleasePlan (prependVEnvEntries leading current)
+        (drops.map (SlotDrop.offsetEntry leading.length))
+        (prependVEnvEntries leading final) emit)
+    (hplan := hplan)
+  · intro Γ
+    exact ReleasePlan.nil
+  · intro Γ output i abs drops tailEmit hentry ih
+    have hentryPrefix :
+        (prependVEnvEntries leading Γ).entries[leading.length + i]? =
+          some (.slot abs 0 .many true) := by
+      rw [show (prependVEnvEntries leading Γ).entries =
+          leading ++ Γ.entries by rfl]
+      rw [List.getElem?_append_right (Nat.le_add_right _ _)]
+      simpa using hentry
+    have hnext :
+        ((prependVEnvEntries leading Γ).setEntry (leading.length + i)
+          (.slot abs 0 .many false)).bump =
+        prependVEnvEntries leading
+          ((Γ.setEntry i (.slot abs 0 .many false)).bump) := by
+      cases Γ
+      simp [prependVEnvEntries, VEnv.setEntry, VEnv.bump,
+        List.set_append_right]
+    apply ReleasePlan.many hentryPrefix
+    rw [hnext]
+    simpa [SlotDrop.offsetEntry] using ih
+  · intro Γ output i abs drops tailEmit hentry ih
+    have hentryPrefix :
+        (prependVEnvEntries leading Γ).entries[leading.length + i]? =
+          some (.slot abs 0 .affine true) := by
+      rw [show (prependVEnvEntries leading Γ).entries =
+          leading ++ Γ.entries by rfl]
+      rw [List.getElem?_append_right (Nat.le_add_right _ _)]
+      simpa using hentry
+    have hnext :
+        ((prependVEnvEntries leading Γ).setEntry (leading.length + i)
+          (.slot abs 0 .affine false)).bump =
+        prependVEnvEntries leading
+          ((Γ.setEntry i (.slot abs 0 .affine false)).bump) := by
+      cases Γ
+      simp [prependVEnvEntries, VEnv.setEntry, VEnv.bump,
+        List.set_append_right]
+    apply ReleasePlan.affine hentryPrefix
+    rw [hnext]
+    simpa [SlotDrop.offsetEntry] using ih
+
+/-- Proof-relevant execution plan for the recursor's canonical borrowed-field
+retain list. Each step activates one released field entry at the fresh slot
+pushed by `dup`. -/
+inductive FieldRetainPlan :
+    VEnv → List RecursorFieldRetain → VEnv → Emit → Prop where
+  | nil {Γ : VEnv} :
+      FieldRetainPlan Γ [] Γ (_root_.id : Emit)
+  | retain {Γ output : VEnv} {i placeholderAbs fieldAbs remaining : Nat}
+      {retains : List RecursorFieldRetain} {tailEmit : Emit}
+      (hentry : Γ.entries[i]? =
+        some (.slot placeholderAbs 0 .many false))
+      (tail : FieldRetainPlan
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        retains output tailEmit) :
+      FieldRetainPlan Γ
+        (⟨i, fieldAbs, remaining⟩ :: retains) output
+        (emitOp (.dup (.var (Γ.rel fieldAbs))) ∘ tailEmit)
+
+/-- Dependent traversal of a field-retain plan.  Descriptor consumption,
+environment threading, and emitter composition are shared by every logical
+consumer; the caller supplies only its identity and one-retain judgments. -/
+theorem FieldRetainPlan.traverse
+    {Result : VEnv → List RecursorFieldRetain → VEnv → Emit → Prop}
+    (hnil : ∀ Γ, Result Γ [] Γ (_root_.id : Emit))
+    (hretain : ∀ {Γ output : VEnv}
+        {i placeholderAbs fieldAbs remaining : Nat}
+        {retains : List RecursorFieldRetain} {tailEmit : Emit},
+      Γ.entries[i]? = some (.slot placeholderAbs 0 .many false) →
+      Result
+        ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+        retains output tailEmit →
+      Result Γ (⟨i, fieldAbs, remaining⟩ :: retains) output
+        (emitOp (.dup (.var (Γ.rel fieldAbs))) ∘ tailEmit))
+    {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit} (hplan : FieldRetainPlan input retains output emit) :
+    Result input retains output emit := by
+  induction hplan with
+  | nil => exact hnil _
+  | retain hentry tail ih => exact hretain hentry ih
+
+/-- Later field retains address only the original field-entry block, so an
+appended logical frame commutes with the whole plan. -/
+theorem FieldRetainPlan.frameEntries {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit)
+    (frame : List VEntry) :
+    FieldRetainPlan (frameVEnvEntries input frame) retains
+      (frameVEnvEntries output frame) emit := by
+  apply FieldRetainPlan.traverse
+    (Result := fun current retains final emit =>
+      FieldRetainPlan (frameVEnvEntries current frame) retains
+        (frameVEnvEntries final frame) emit)
+    (hplan := hplan)
+  · intro Γ
+    exact FieldRetainPlan.nil
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih
+    obtain ⟨hi, _⟩ := List.getElem?_eq_some_iff.mp hentry
+    have hentryFrame : (frameVEnvEntries Γ frame).entries[i]? =
+        some (.slot placeholderAbs 0 .many false) := by
+      simpa [frameVEnvEntries, List.getElem?_append_left hi] using hentry
+    have hnext :
+        ((frameVEnvEntries Γ frame).setEntry i
+          (.slot Γ.depth remaining .many true)).bump =
+        frameVEnvEntries
+          ((Γ.setEntry i (.slot Γ.depth remaining .many true)).bump)
+          frame := by
+      cases Γ
+      simp [frameVEnvEntries, VEnv.setEntry, VEnv.bump,
+        List.set_append_left _ _ hi]
+    apply FieldRetainPlan.retain hentryFrame
+    rw [show (frameVEnvEntries Γ frame).depth = Γ.depth by rfl]
+    rw [hnext]
+    simpa [frameVEnvEntries, VEnv.rel] using ih
+
+/-- Field-retain plans update entries in place and therefore preserve the
+logical environment length. -/
+theorem FieldRetainPlan.entries_length {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit) :
+    output.entries.length = input.entries.length := by
+  apply FieldRetainPlan.traverse
+    (Result := fun current _ final _ =>
+      final.entries.length = current.entries.length)
+    (hplan := hplan)
+  · intro Γ
+    rfl
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih
+    simpa [VEnv.setEntry, VEnv.bump] using ih
+
+/-- A field-retain plan computes the exact pure interpreter result. -/
+theorem FieldRetainPlan.run {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit) :
+    applyRecursorFieldRetains input retains = (output, emit) := by
+  apply FieldRetainPlan.traverse
+    (Result := fun current pending final pendingEmit =>
+      applyRecursorFieldRetains current pending = (final, pendingEmit))
+    (hplan := hplan)
+  · intro Γ
+    rfl
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih
+    simp only [applyRecursorFieldRetains]
+    rw [ih]
+
+/-- Build the concrete retain plan while carrying an arbitrary invariant of
+its output environment. Released placeholders, live-slot activation, depth
+advancement, and emitter composition are shared by all plan clients. -/
+theorem recursorFieldRetains_plan_traverse
+    (rhs : IxIR0.Expr)
+    {Result : Nat → Nat → Nat → VEnv → Prop}
+    (hnilResult : ∀ fieldAbs depth,
+      Result fieldAbs depth 0 ⟨[], depth⟩)
+    (hskipResult : ∀ {fieldAbs depth fieldCount : Nat}
+        {tailOutput : VEnv},
+      Result (fieldAbs + 1) depth fieldCount tailOutput →
+      tailOutput.entries.length = fieldCount →
+      countUses fieldCount rhs = 0 →
+      Result fieldAbs depth (fieldCount + 1)
+        (frameVEnvEntries tailOutput [.slot 0 0 .many false]))
+    (hretainResult : ∀ {fieldAbs depth fieldCount : Nat}
+        {tailOutput : VEnv},
+      Result (fieldAbs + 1) (depth + 1) fieldCount tailOutput →
+      tailOutput.entries.length = fieldCount →
+      countUses fieldCount rhs ≠ 0 →
+      Result fieldAbs depth (fieldCount + 1)
+        (frameVEnvEntries tailOutput
+          [.slot depth (countUses fieldCount rhs) .many true])) :
+    ∀ (fieldAbs depth fieldCount : Nat),
+      ∃ output emit,
+        FieldRetainPlan
+          ⟨List.replicate fieldCount (.slot 0 0 .many false), depth⟩
+          (recursorFieldRetains fieldAbs rhs fieldCount)
+          output emit ∧
+        Result fieldAbs depth fieldCount output := by
+  intro fieldAbs depth fieldCount
+  exact recursorFieldRetains_traverse rhs
+    (Result := fun currentAbs currentCount retains =>
+      ∀ currentDepth,
+        ∃ output emit,
+          FieldRetainPlan
+            ⟨List.replicate currentCount (.slot 0 0 .many false),
+              currentDepth⟩
+            retains output emit ∧
+          Result currentAbs currentDepth currentCount output)
+    (hnil := by
+      intro currentAbs currentDepth
+      exact ⟨⟨[], currentDepth⟩, (_root_.id : Emit),
+        FieldRetainPlan.nil, hnilResult currentAbs currentDepth⟩)
+    (hskip := by
+      intro currentAbs currentCount tail hzero ih currentDepth
+      obtain ⟨tailOutput, tailEmit, htail, htailResult⟩ := ih currentDepth
+      let dead : VEntry := .slot 0 0 .many false
+      have hrep : List.replicate (currentCount + 1) dead =
+          List.replicate currentCount dead ++ [dead] := by
+        symm
+        simpa using (List.replicate_append_replicate
+          (n := currentCount) (m := 1) (a := dead))
+      have hframed := htail.frameEntries [dead]
+      have hlength : tailOutput.entries.length = currentCount := by
+        calc
+          tailOutput.entries.length =
+              (List.replicate currentCount dead).length :=
+            htail.entries_length
+          _ = currentCount := by simp
+      refine ⟨frameVEnvEntries tailOutput [dead], tailEmit, ?_, ?_⟩
+      · rw [hrep]
+        simpa [dead, frameVEnvEntries] using hframed
+      · simpa [dead] using
+          hskipResult htailResult hlength hzero)
+    (hretain := by
+      intro currentAbs currentCount tail hnonzero ih currentDepth
+      obtain ⟨tailOutput, tailEmit, htail, htailResult⟩ :=
+        ih (currentDepth + 1)
+      let dead : VEntry := .slot 0 0 .many false
+      let uses := countUses currentCount rhs
+      let held : VEntry := .slot currentDepth uses .many true
+      have hrep : List.replicate (currentCount + 1) dead =
+          List.replicate currentCount dead ++ [dead] := by
+        symm
+        simpa using (List.replicate_append_replicate
+          (n := currentCount) (m := 1) (a := dead))
+      let input : VEnv :=
+        ⟨List.replicate (currentCount + 1) dead, currentDepth⟩
+      have hentry : input.entries[currentCount]? = some dead := by
+        simp [input, dead]
+      have hnext :
+          ((input.setEntry currentCount held).bump) =
+            frameVEnvEntries
+              ⟨List.replicate currentCount dead, currentDepth + 1⟩
+              [held] := by
+        simp only [input, VEnv.setEntry, VEnv.bump]
+        rw [hrep]
+        simp [held, dead, frameVEnvEntries, List.set_append_right]
+      have hframed := htail.frameEntries [held]
+      have htailFull : FieldRetainPlan
+          ((input.setEntry currentCount held).bump) tail
+          (frameVEnvEntries tailOutput [held]) tailEmit := by
+        rw [hnext]
+        exact hframed
+      have hfirst := FieldRetainPlan.retain
+        (fieldAbs := currentAbs) hentry htailFull
+      have hlength : tailOutput.entries.length = currentCount := by
+        calc
+          tailOutput.entries.length =
+              (List.replicate currentCount dead).length :=
+            htail.entries_length
+          _ = currentCount := by simp
+      refine ⟨frameVEnvEntries tailOutput [held],
+        emitOp (.dup (.var (input.rel currentAbs))) ∘ tailEmit, ?_, ?_⟩
+      · simpa [input, dead, held, uses] using hfirst
+      · simpa [held, uses] using
+          hretainResult htailResult hlength hnonzero)
+    fieldAbs fieldCount depth
+
+/-- The compiler-generated retain list always has a concrete plan from its
+all-released field-entry block, at any ambient runtime depth. -/
+theorem recursorFieldRetains_plan
+    (fieldAbs depth fieldCount : Nat) (rhs : IxIR0.Expr) :
+    let dead : VEntry := .slot 0 0 .many false
+    ∃ output emit,
+      FieldRetainPlan
+        ⟨List.replicate fieldCount dead, depth⟩
+        (recursorFieldRetains fieldAbs rhs fieldCount)
+        output emit := by
+  dsimp only
+  obtain ⟨output, emit, hplan, _⟩ :=
+    recursorFieldRetains_plan_traverse rhs
+      (Result := fun _ _ _ _ => True)
+      (hnilResult := by simp)
+      (hskipResult := by simp)
+      (hretainResult := by simp)
+      fieldAbs depth fieldCount
+  exact ⟨output, emit, hplan⟩
+
+/-- Original borrowed field slots in constructor order. The first field is at
+`fieldAbs`; each following field occupies the next older absolute position. -/
+def recursorFieldSlots : Nat → List RVal → List (Nat × RVal)
+  | _, [] => []
+  | fieldAbs, value :: values =>
+    (fieldAbs, value) :: recursorFieldSlots (fieldAbs + 1) values
+
+private theorem List.foldl_cons_eq_reverse_append (values env : List RVal) :
+    values.foldl (fun current value => value :: current) env =
+      values.reverse ++ env := by
+  induction values generalizing env with
+  | nil => rfl
+  | cons value values ih =>
+    simp only [List.foldl_cons]
+    rw [ih]
+    simp [List.reverse_cons, List.append_assoc]
+
+theorem Array.foldl_cons_eq_reverse_append
+    (fields : Array RVal) (env : List RVal) :
+    fields.foldl (fun current field => field :: current) env =
+      fields.toList.reverse ++ env := by
+  rw [← Array.foldl_toList]
+  exact List.foldl_cons_eq_reverse_append fields.toList env
+
+/-- Constructor fields pushed from left to right occupy consecutive absolute
+slots, starting immediately outside the pre-major argument prefix. -/
+theorem recursorFieldSlots_realize_list (env values : List RVal) :
+    SlotsRealize ⟨[], env.length + values.length⟩
+      (values.reverse ++ env)
+      (recursorFieldSlots env.length values) := by
+  induction values generalizing env with
+  | nil => exact SlotsRealize.nil
+  | cons value values ih =>
+    intro abs found hmem
+    simp only [recursorFieldSlots, List.mem_cons] at hmem
+    rcases hmem with hpair | htail
+    · obtain ⟨rfl, rfl⟩ := Prod.mk.inj hpair
+      constructor
+      · simp
+      · simp [VEnv.rel, List.reverse_cons, List.append_assoc]
+    · have hrest := ih (value :: env) abs found htail
+      simpa [VEnv.rel, List.reverse_cons, List.append_assoc,
+        Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using hrest
+
+/-- Every static retain descriptor resolves to one protected borrowed value. -/
+def FieldRetainsCovered (retains : List RecursorFieldRetain)
+    (slots : List (Nat × RVal)) (borrowed : List RVal) : Prop :=
+  ∀ retain ∈ retains, ∃ value,
+    (retain.fieldAbs, value) ∈ slots ∧ value ∈ borrowed
+
+/-- Fuel-bounded ownership adapter for an arbitrary field-retain plan.  The
+shared traversal consumes descriptors; this callback supplies coverage for
+each `dup` while preserving protected slots and borrow facts. -/
+private theorem FieldRetainPlan.soundAt {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit} (hplan : FieldRetainPlan input retains output emit)
+    (slots : List (Nat × RVal)) (borrowed : List RVal)
+    (hcovered : FieldRetainsCovered retains slots borrowed) :
+    ∀ rest,
+      EmitSoundBelow ctx cur limit emit
+        (OwnsVEnvBorrowed input rest slots borrowed)
+        (OwnsVEnvBorrowed output rest slots borrowed) := by
+  revert hcovered
+  apply FieldRetainPlan.traverse (hplan := hplan)
+  · intro Γ hcovered rest
+    exact EmitSoundBelow.id
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih hcovered rest
+    obtain ⟨value, hslot, hborrow⟩ :=
+      hcovered ⟨i, fieldAbs, remaining⟩ (by simp)
+    have htailCovered : FieldRetainsCovered retains slots borrowed := by
+      intro retain hmem
+      exact hcovered retain (by simp [hmem])
+    exact EmitSoundBelow.comp
+      (retain_borrowed_into_entry_owned_below hentry hslot hborrow)
+      (ih htailCovered rest)
+
+/-- Semantic induction for an arbitrary field-retain plan, closed from its
+uniformly bounded proof body. -/
+theorem FieldRetainPlan.sound {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit} (hplan : FieldRetainPlan input retains output emit)
+    (slots : List (Nat × RVal)) (borrowed : List RVal)
+    (hcovered : FieldRetainsCovered retains slots borrowed) :
+    ∀ rest,
+      EmitSound ctx cur emit
+        (OwnsVEnvBorrowed input rest slots borrowed)
+        (OwnsVEnvBorrowed output rest slots borrowed) := by
+  intro rest
+  exact EmitSound.of_below fun limit =>
+    hplan.soundAt (limit := limit) slots borrowed hcovered rest
+
+/-- Fuel-bounded semantic induction for a field-retain plan. -/
+theorem FieldRetainPlan.soundBelow {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv}
+    {retains : List RecursorFieldRetain} {emit : Emit}
+    (hplan : FieldRetainPlan input retains output emit)
+    (slots : List (Nat × RVal)) (borrowed : List RVal)
+    (hcovered : FieldRetainsCovered retains slots borrowed) :
+    ∀ rest,
+      EmitSoundBelow ctx cur limit emit
+        (OwnsVEnvBorrowed input rest slots borrowed)
+        (OwnsVEnvBorrowed output rest slots borrowed) := by
+  exact hplan.soundAt slots borrowed hcovered
+
+/-- Semantic fuel-bounded induction for a field-retain plan.  In contrast
+to `FieldRetainPlan.soundBelow`, the pending retain list itself supplies the
+source/target graph witness for each `dup`, so consuming the plan consumes
+that list one descriptor at a time. -/
+theorem FieldRetainPlan.valueSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit} (hplan : FieldRetainPlan input retains output emit) :
+    ∀ sourceEnv sourceRest rest extra slots borrowed,
+      EmitSoundBelow ctx cur limit emit
+        (GraphOwnsVEnvRetains funRel recSelfRel input sourceEnv
+          sourceRest rest extra slots borrowed retains)
+        (GraphOwnsVEnvRetains funRel recSelfRel output sourceEnv
+          sourceRest rest extra slots borrowed []) := by
+  apply FieldRetainPlan.traverse (hplan := hplan)
+  · intro Γ sourceEnv sourceRest rest extra slots borrowed
+    exact EmitSoundBelow.id
+  · intro Γ output i placeholderAbs fieldAbs remaining retains tailEmit
+      hentry ih sourceEnv sourceRest rest extra slots borrowed
+    exact EmitSoundBelow.comp
+      (retain_borrowed_into_entry_value_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (sourceEnv := sourceEnv) (sourceRest := sourceRest)
+        (rest := rest) (extra := extra) (slots := slots)
+        (borrowed := borrowed) (retains := retains) hentry)
+      (ih sourceEnv sourceRest rest extra slots borrowed)
+
+/-- The canonical retain generator is covered by constructor-order runtime
+field values of the declared width. -/
+theorem recursorFieldRetains_covered
+    (fieldAbs fieldCount : Nat) (rhs : IxIR0.Expr) (values : List RVal)
+    (hlength : values.length = fieldCount) :
+    FieldRetainsCovered
+      (recursorFieldRetains fieldAbs rhs fieldCount)
+      (recursorFieldSlots fieldAbs values) values := by
+  exact recursorFieldRetains_traverse rhs
+    (Result := fun currentAbs currentCount retains =>
+      ∀ runtimeValues : List RVal,
+        runtimeValues.length = currentCount →
+        FieldRetainsCovered retains
+          (recursorFieldSlots currentAbs runtimeValues) runtimeValues)
+    (hnil := by
+      intro currentAbs runtimeValues hlength
+      cases runtimeValues with
+      | nil =>
+        intro retain hmem
+        simp at hmem
+      | cons value values => simp at hlength)
+    (hskip := by
+      intro currentAbs currentCount tail _ ih runtimeValues hlength
+      cases runtimeValues with
+      | nil => simp at hlength
+      | cons value values =>
+        have htailLength : values.length = currentCount := by
+          simpa using hlength
+        have htail := ih values htailLength
+        intro retain hmem
+        obtain ⟨found, hslot, hborrow⟩ := htail retain hmem
+        exact ⟨found, by simp [recursorFieldSlots, hslot],
+          by simp [hborrow]⟩)
+    (hretain := by
+      intro currentAbs currentCount tail _ ih runtimeValues hlength
+      cases runtimeValues with
+      | nil => simp at hlength
+      | cons value values =>
+        have htailLength : values.length = currentCount := by
+          simpa using hlength
+        have htail := ih values htailLength
+        intro retain hmem
+        rcases List.mem_cons.mp hmem with rfl | hmemTail
+        · exact ⟨value, by simp [recursorFieldSlots], by simp⟩
+        · obtain ⟨found, hslot, hborrow⟩ := htail retain hmemTail
+          exact ⟨found, by simp [recursorFieldSlots, hslot],
+            by simp [hborrow]⟩)
+    fieldAbs fieldCount values hlength
+
+/-- The canonical retain descriptors select pointwise-related source and
+target constructor fields.  Constructor fields arrive in constructor order,
+whereas the rule environment exposes them in reverse order; the descending
+`entry` component of `recursorFieldRetains` is exactly that reversal. -/
+theorem recursorFieldRetains_valueGraphs
+    {funRel : Sim.FunctionRel} {store : Store}
+    (fieldAbs fieldCount : Nat) (rhs : IxIR0.Expr)
+    {sourceValues : List IxIR0.Value} {values : List RVal}
+    (suffix : List IxIR0.Value)
+    (hgraphs : Sim.ValuesGraph funRel store sourceValues values)
+    (hlength : values.length = fieldCount) :
+    RetainsValueGraphs funRel store
+      (sourceValues.reverse ++ suffix)
+      (recursorFieldSlots fieldAbs values) values
+      (recursorFieldRetains fieldAbs rhs fieldCount) := by
+  exact recursorFieldRetains_traverse rhs
+    (Result := fun currentAbs currentCount retains =>
+      ∀ {currentSources : List IxIR0.Value}
+          {runtimeValues : List RVal} (sourceSuffix : List IxIR0.Value),
+        Sim.ValuesGraph funRel store currentSources runtimeValues →
+        runtimeValues.length = currentCount →
+        RetainsValueGraphs funRel store
+          (currentSources.reverse ++ sourceSuffix)
+          (recursorFieldSlots currentAbs runtimeValues) runtimeValues retains)
+    (hnil := by
+      intro currentAbs currentSources runtimeValues sourceSuffix hgraphs
+        hlength
+      have hvalues : runtimeValues = [] :=
+        List.eq_nil_of_length_eq_zero hlength
+      subst runtimeValues
+      cases hgraphs
+      intro retain hmember
+      simp at hmember)
+    (hskip := by
+      intro currentAbs currentCount tail _ ih currentSources runtimeValues
+        sourceSuffix hgraphs hlength
+      cases runtimeValues with
+      | nil => simp at hlength
+      | cons value values =>
+        cases hgraphs with
+        | @cons source value sources values hhead htailGraphs =>
+          have htailLength : values.length = currentCount := by
+            simpa using hlength
+          have htail := ih (currentSources := sources)
+            (runtimeValues := values) (source :: sourceSuffix) htailGraphs
+            htailLength
+          intro retain hmember
+          obtain ⟨foundSource, foundValue, hsource, hslot,
+              hborrowed, hvalue⟩ := htail retain hmember
+          exact ⟨foundSource, foundValue,
+            by simpa [List.reverse_cons, List.append_assoc] using hsource,
+            by simp [recursorFieldSlots, hslot], by simp [hborrowed], hvalue⟩)
+    (hretain := by
+      intro currentAbs currentCount tail _ ih currentSources runtimeValues
+        sourceSuffix hgraphs hlength
+      cases runtimeValues with
+      | nil => simp at hlength
+      | cons value values =>
+        cases hgraphs with
+        | @cons source value sources values hhead htailGraphs =>
+          have htailLength : values.length = currentCount := by
+            simpa using hlength
+          have hsourcesLength : sources.length = currentCount :=
+            htailGraphs.length.trans htailLength
+          have htail := ih (currentSources := sources)
+            (runtimeValues := values) (source :: sourceSuffix) htailGraphs
+            htailLength
+          intro retain hmember
+          rcases List.mem_cons.mp hmember with rfl | hmemberTail
+          · exact ⟨source, value,
+              by simp [List.reverse_cons, ← hsourcesLength],
+              by simp [recursorFieldSlots], by simp, hhead⟩
+          · obtain ⟨foundSource, foundValue, hsource, hslot,
+                hborrowed, hvalue⟩ := htail _ hmemberTail
+            exact ⟨foundSource, foundValue,
+              by simpa [List.reverse_cons, List.append_assoc] using hsource,
+              by simp [recursorFieldSlots, hslot], by simp [hborrowed],
+              hvalue⟩)
+    fieldAbs fieldCount suffix hgraphs hlength
+
+/-- End-to-end executable/semantic certificate for the arbitrary borrowed-
+field fold used by `lowerRecursor`, before the major and parameter releases. -/
+theorem recursorFieldRetains_verified {ctx : Ctx} {cur : FnDef}
+    (fieldAbs depth fieldCount : Nat) (rhs : IxIR0.Expr)
+    (values : List RVal) (hlength : values.length = fieldCount) :
+    let dead : VEntry := .slot 0 0 .many false
+    let input : VEnv := ⟨List.replicate fieldCount dead, depth⟩
+    ∃ output emit,
+      applyRecursorFieldRetains input
+          (recursorFieldRetains fieldAbs rhs fieldCount) =
+        (output, emit) ∧
+      ∀ rest,
+        EmitSound ctx cur emit
+          (OwnsVEnvBorrowed input rest
+            (recursorFieldSlots fieldAbs values) values)
+          (OwnsVEnvBorrowed output rest
+            (recursorFieldSlots fieldAbs values) values) := by
+  dsimp only
+  obtain ⟨output, emit, hplan⟩ :=
+    recursorFieldRetains_plan fieldAbs depth fieldCount rhs
+  have hcovered :=
+    recursorFieldRetains_covered fieldAbs fieldCount rhs values hlength
+  exact ⟨output, emit, hplan.run, hplan.sound _ _ hcovered⟩
+
+/-- Sequential release plans compose, matching list append and emitter
+composition. -/
+theorem ReleasePlan.comp {input middle output : VEnv}
+    {firstDrops secondDrops : List SlotDrop} {firstEmit secondEmit : Emit}
+    (hfirst : ReleasePlan input firstDrops middle firstEmit)
+    (hsecond : ReleasePlan middle secondDrops output secondEmit) :
+    ReleasePlan input (firstDrops ++ secondDrops) output
+      (firstEmit ∘ secondEmit) := by
+  apply ReleasePlan.traverse
+    (Result := fun current initialDrops intermediate initialEmit =>
+      ReleasePlan intermediate secondDrops output secondEmit →
+      ReleasePlan current (initialDrops ++ secondDrops) output
+        (initialEmit ∘ secondEmit))
+    (hnil := by
+      intro Γ htail
+      simpa [Function.comp_def] using htail)
+    (hmany := by
+      intro Γ intermediate i abs initialDrops initialEmit hentry ih
+        htail
+      simpa [Function.comp_def] using
+        ReleasePlan.many hentry (ih htail))
+    (haffine := by
+      intro Γ intermediate i abs initialDrops initialEmit hentry ih
+        htail
+      simpa [Function.comp_def] using
+        ReleasePlan.affine hentry (ih htail))
+    (hplan := hfirst)
+  exact hsecond
+
+/-- Exactly the mode-side condition under which `parameterDrops` can
+succeed. Live parameters need no release restriction; a dead parameter must
+be shared (`many`) or affine. -/
+def ParameterDropsAdmissible : List Uses → (Nat → Nat) → Prop
+  | [], _ => True
+  | mode :: modes, remaining =>
+    ParameterDropsAdmissible modes remaining ∧
+      (remaining modes.length = 0 → mode = .many ∨ mode = .affine)
+
+private theorem frameVEnvEntries_parameterEntries_cons
+    (base depth : Nat) (mode : Uses) (modes : List Uses)
+    (remaining : Nat → Nat) :
+    frameVEnvEntries
+        ⟨parameterEntries (base + 1) modes remaining, depth⟩
+        [.slot base (remaining modes.length) mode true] =
+      ⟨parameterEntries base (mode :: modes) remaining, depth⟩ := by
+  simp [frameVEnvEntries, parameterEntries]
+
+/-- Result-polymorphic traversal for canonical parameter release plans.
+Admissibility splitting, tail framing, entry lookup, shared/affine release,
+environment advancement, and emitter composition recurse once; clients add
+only an invariant of each constructed output environment. -/
+theorem parameterDrops_releasePlan_traverse
+    (remaining : Nat → Nat)
+    {Result : Nat → Nat → List Uses → VEnv → Prop}
+    (hnil : ∀ base depth, Result base depth [] ⟨[], depth⟩)
+    (hlive : ∀ {base depth : Nat} {mode : Uses} {modes : List Uses}
+        {innerOutput : VEnv},
+      Result (base + 1) depth modes innerOutput →
+      innerOutput.entries.length = modes.length →
+      remaining modes.length ≠ 0 →
+      Result base depth (mode :: modes)
+        (frameVEnvEntries innerOutput
+          [.slot base (remaining modes.length) mode true]))
+    (hmany : ∀ {base depth : Nat} {modes : List Uses}
+        {innerOutput : VEnv},
+      Result (base + 1) depth modes innerOutput →
+      innerOutput.entries.length = modes.length →
+      remaining modes.length = 0 →
+      Result base depth (.many :: modes)
+        (((frameVEnvEntries innerOutput [.slot base 0 .many true]).setEntry
+          modes.length (.slot base 0 .many false)).bump))
+    (haffine : ∀ {base depth : Nat} {modes : List Uses}
+        {innerOutput : VEnv},
+      Result (base + 1) depth modes innerOutput →
+      innerOutput.entries.length = modes.length →
+      remaining modes.length = 0 →
+      Result base depth (.affine :: modes)
+        (((frameVEnvEntries innerOutput [.slot base 0 .affine true]).setEntry
+          modes.length (.slot base 0 .affine false)).bump)) :
+    ∀ (base depth : Nat) (modes : List Uses),
+      ParameterDropsAdmissible modes remaining →
+      ∃ output emit,
+        ReleasePlan
+          ⟨parameterEntries base modes remaining, depth⟩
+          (parameterDrops base modes remaining) output emit ∧
+        Result base depth modes output := by
+  intro base depth modes hadmissible
+  induction modes generalizing base depth with
+  | nil =>
+    exact ⟨⟨[], depth⟩, (_root_.id : Emit), ReleasePlan.nil,
+      hnil base depth⟩
+  | cons mode modes ih =>
+    obtain ⟨htail, hmode⟩ := hadmissible
+    obtain ⟨innerOutput, innerEmit, hinner, hinnerResult⟩ :=
+      ih (base + 1) depth htail
+    let outerEntry : VEntry :=
+      .slot base (remaining modes.length) mode true
+    let framedOutput := frameVEnvEntries innerOutput [outerEntry]
+    have hinnerFull : ReleasePlan
+        ⟨parameterEntries base (mode :: modes) remaining, depth⟩
+        (parameterDrops (base + 1) modes remaining)
+        framedOutput innerEmit := by
+      have hframed := hinner.frameEntries [outerEntry]
+      rw [frameVEnvEntries_parameterEntries_cons] at hframed
+      simpa [framedOutput, outerEntry] using hframed
+    have hlength : innerOutput.entries.length = modes.length := by
+      calc
+        innerOutput.entries.length =
+            (parameterEntries (base + 1) modes remaining).length :=
+          hinner.entries_length
+        _ = modes.length := parameterEntries_length _ _ _
+    by_cases hzero : remaining modes.length = 0
+    · rcases hmode hzero with rfl | rfl
+      · have hentry : framedOutput.entries[modes.length]? =
+            some (.slot base 0 .many true) := by
+          simp [framedOutput, frameVEnvEntries, outerEntry, hlength, hzero]
+        let finalOutput :=
+          (framedOutput.setEntry modes.length
+            (.slot base 0 .many false)).bump
+        have houter : ReleasePlan framedOutput
+            [⟨modes.length, base, .many⟩] finalOutput
+            (emitOp (.drop (.var (framedOutput.rel base))) ∘
+              (_root_.id : Emit)) := by
+          exact ReleasePlan.many hentry ReleasePlan.nil
+        refine ⟨finalOutput, innerEmit ∘
+          (emitOp (.drop (.var (framedOutput.rel base))) ∘
+            (_root_.id : Emit)), ?_, ?_⟩
+        · simpa [parameterDrops, hzero] using hinnerFull.comp houter
+        · simpa [finalOutput, framedOutput, outerEntry, hzero] using
+            hmany hinnerResult hlength hzero
+      · have hentry : framedOutput.entries[modes.length]? =
+            some (.slot base 0 .affine true) := by
+          simp [framedOutput, frameVEnvEntries, outerEntry, hlength, hzero]
+        let finalOutput :=
+          (framedOutput.setEntry modes.length
+            (.slot base 0 .affine false)).bump
+        have houter : ReleasePlan framedOutput
+            [⟨modes.length, base, .affine⟩] finalOutput
+            (emitOp (.dropU (.var (framedOutput.rel base))) ∘
+              (_root_.id : Emit)) := by
+          exact ReleasePlan.affine hentry ReleasePlan.nil
+        refine ⟨finalOutput, innerEmit ∘
+          (emitOp (.dropU (.var (framedOutput.rel base))) ∘
+            (_root_.id : Emit)), ?_, ?_⟩
+        · simpa [parameterDrops, hzero] using hinnerFull.comp houter
+        · simpa [finalOutput, framedOutput, outerEntry, hzero] using
+            haffine hinnerResult hlength hzero
+    · refine ⟨framedOutput, innerEmit, ?_, ?_⟩
+      · simpa [parameterDrops, hzero] using hinnerFull
+      · simpa [framedOutput, outerEntry] using
+          hlive hinnerResult hlength hzero
+
+/-- Canonical parameter entries and drops generate a concrete release plan at
+any ambient runtime depth whenever their dead modes are admissible. This is
+the form needed after a recursor has pushed field retains and the major-drop
+result before releasing its parameters. -/
+theorem parameterDrops_releasePlan_atDepth (base depth : Nat)
+    (modes : List Uses)
+    (remaining : Nat → Nat)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨parameterEntries base modes remaining, depth⟩
+        (parameterDrops base modes remaining) output emit := by
+  obtain ⟨output, emit, hplan, _⟩ :=
+    parameterDrops_releasePlan_traverse remaining
+      (Result := fun _ _ _ _ => True)
+      (hnil := by simp)
+      (hlive := by simp)
+      (hmany := by simp)
+      (haffine := by simp)
+      base depth modes hadmissible
+  exact ⟨output, emit, hplan⟩
+
+/-- Declaration-entry specialization of
+`parameterDrops_releasePlan_atDepth` at the canonical telescope depth. -/
+theorem parameterDrops_releasePlan (base : Nat) (modes : List Uses)
+    (remaining : Nat → Nat)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨parameterEntries base modes remaining, base + modes.length⟩
+        (parameterDrops base modes remaining) output emit :=
+  parameterDrops_releasePlan_atDepth base (base + modes.length)
+    modes remaining hadmissible
+
+/-- The generated release certificate is stable under the trailing entries
+used for a lambda-lifted function's capture environment. The runtime depth is
+already accounted for by `base`; framing adds only proof-side entries. -/
+theorem parameterDrops_releasePlan_framed (base : Nat) (modes : List Uses)
+    (remaining : Nat → Nat) (frame : List VEntry)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨parameterEntries base modes remaining ++ frame,
+          base + modes.length⟩
+        (parameterDrops base modes remaining) output emit := by
+  obtain ⟨output, emit, hplan⟩ :=
+    parameterDrops_releasePlan base modes remaining hadmissible
+  exact ⟨frameVEnvEntries output frame, emit,
+    by simpa [frameVEnvEntries] using hplan.frameEntries frame⟩
+
+/-- Generated parameter releases remain valid when the parameter telescope
+sits between unrelated leading and trailing entries. Leading entries shift
+only `SlotDrop.entry`; trailing entries require no descriptor change. -/
+theorem parameterDrops_releasePlan_between
+    (base depth : Nat) (modes : List Uses) (remaining : Nat → Nat)
+    (leading trailing : List VEntry)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨leading ++ parameterEntries base modes remaining ++ trailing,
+          depth⟩
+        ((parameterDrops base modes remaining).map
+          (SlotDrop.offsetEntry leading.length))
+        output emit := by
+  obtain ⟨output, emit, hplan⟩ :=
+    parameterDrops_releasePlan_atDepth base depth modes remaining hadmissible
+  have hframed := hplan.frameEntries trailing
+  have hbetween := hframed.prependEntries leading
+  exact ⟨prependVEnvEntries leading (frameVEnvEntries output trailing),
+    emit, by
+      simpa [prependVEnvEntries, frameVEnvEntries, List.append_assoc]
+        using hbetween⟩
+
+@[simp] theorem parameterDropsAdmissible_replicate_many
+    (count : Nat) (remaining : Nat → Nat) :
+    ParameterDropsAdmissible (List.replicate count .many) remaining := by
+  induction count with
+  | zero => simp [ParameterDropsAdmissible]
+  | succ count ih =>
+    simp [List.replicate_succ, ParameterDropsAdmissible, ih]
+
+/-- The exact arbitrary pre-major release shape used by `lowerRecursor`:
+field entries lead, the canonical all-shared parameter telescope occupies the
+middle, and `recSelf` trails. -/
+theorem recursorParameterDrops_releasePlan
+    (numArgs nf depth : Nat) (rhs : IxIR0.Expr)
+    (fieldEntries : List VEntry) (hfields : fieldEntries.length = nf) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨fieldEntries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (nf + i) rhs) ++
+            [.recSelf (numArgs + 1)],
+          depth⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (nf + i) rhs)).map
+          (SlotDrop.offsetEntry nf))
+        output emit := by
+  have hplan := parameterDrops_releasePlan_between
+    0 depth (List.replicate numArgs .many)
+    (fun i => countUses (nf + i) rhs)
+    fieldEntries [.recSelf (numArgs + 1)]
+    (parameterDropsAdmissible_replicate_many numArgs _)
+  simpa [hfields] using hplan
+
+/-- A release plan computes the exact successful `releaseSlots` result and
+does not mutate the lowering monad state. -/
+theorem ReleasePlan.run {input output : VEnv} {drops : List SlotDrop}
+    {emit : Emit} (hplan : ReleasePlan input drops output emit)
+    (state : LowSt) :
+    (releaseSlots input drops).run state = .ok (output, emit) state := by
+  apply ReleasePlan.traverse
+    (Result := fun current pending final pendingEmit =>
+      (releaseSlots current pending).run state =
+        .ok (final, pendingEmit) state)
+    (hplan := hplan)
+  · intro Γ
+    simp [releaseSlots]
+  · intro Γ output i abs drops tailEmit hentry ih
+    simp only [releaseSlots]
+    rw [estateBindRun]
+    rw [estatePureRun]
+    simp only
+    rw [estateBindRun, ih]
+    rfl
+  · intro Γ output i abs drops tailEmit hentry ih
+    simp only [releaseSlots]
+    rw [estateBindRun]
+    rw [estatePureRun]
+    simp only
+    rw [estateBindRun, ih]
+    rfl
+
+/-- Semantic half of a release plan: every dead parameter root is consumed,
+all unrelated roots/protected slots survive, and the returned `VEnv` exactly
+tracks the pushed inert results. -/
+def ReleaseSlotsSound (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (emit : Emit) : Prop :=
+  ∀ rest slots,
+    EmitSound ctx cur emit
+      (OwnsVEnvProtected input rest slots)
+      (OwnsVEnvProtected output rest slots)
+
+/-- Semantic refinement of a successful release sequence. The logical source
+environment is unchanged even though its dead target entries become released;
+all still-held values and every caller-framed root retain their `ValueGraph`.
+-/
+structure ReleaseSlotsValueSound (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (input output : VEnv) (sourceEnv : List IxIR0.Value)
+    (emit : Emit) : Prop where
+  toReleaseSlotsSound : ReleaseSlotsSound ctx cur input output emit
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSound ctx cur emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceEnv sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        sourceEnv sourceRest rest slots)
+
+/-- Fuel-bounded semantic result of `releaseSlots`. -/
+def ReleaseSlotsSoundBelow (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (input output : VEnv) (emit : Emit) : Prop :=
+  ∀ rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (OwnsVEnvProtected input rest slots)
+      (OwnsVEnvProtected output rest slots)
+
+/-- Fuel-bounded semantic refinement of a successful release sequence. -/
+structure ReleaseSlotsValueSoundBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (input output : VEnv)
+    (sourceEnv : List IxIR0.Value) (emit : Emit) : Prop where
+  toReleaseSlotsSoundBelow :
+    ReleaseSlotsSoundBelow ctx cur limit input output emit
+  graphEmits : ∀ sourceRest rest slots,
+    EmitSoundBelow ctx cur limit emit
+      (GraphOwnsVEnvProtected funRel recSelfRel input
+        sourceEnv sourceRest rest slots)
+      (GraphOwnsVEnvProtected funRel recSelfRel output
+        sourceEnv sourceRest rest slots)
+
+/-- Bounded ownership adapter over the shared release-plan traversal. -/
+private theorem ReleasePlan.soundAt {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv} {drops : List SlotDrop}
+    {emit : Emit} (hplan : ReleasePlan input drops output emit) :
+    ReleaseSlotsSoundBelow ctx cur limit input output emit := by
+  apply ReleasePlan.traverse (hplan := hplan)
+  · intro Γ rest slots
+    exact EmitSoundBelow.id
+  · intro Γ output i abs drops tailEmit hentry ih rest slots
+    exact EmitSoundBelow.comp
+      (release_slot_many_owned_below hentry rest slots)
+      (ih rest slots)
+  · intro Γ output i abs drops tailEmit hentry ih rest slots
+    exact EmitSoundBelow.comp
+      (release_slot_affine_owned_below hentry rest slots)
+      (ih rest slots)
+
+/-- Bounded graph adapter over the shared release-plan traversal. -/
+private theorem ReleasePlan.valueSoundAt {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv} {drops : List SlotDrop}
+    {emit : Emit}
+    (hplan : ReleasePlan input drops output emit)
+    (sourceEnv : List IxIR0.Value) :
+    ReleaseSlotsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceEnv emit := by
+  refine { toReleaseSlotsSoundBelow := hplan.soundAt, graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply ReleasePlan.traverse (hplan := hplan)
+  · intro Γ
+    exact EmitSoundBelow.id
+  · intro Γ output i abs drops tailEmit hentry ih
+    exact EmitSoundBelow.comp
+      (release_slot_many_value_sound_below hentry
+        sourceEnv sourceRest rest slots)
+      ih
+  · intro Γ output i abs drops tailEmit hentry ih
+    exact EmitSoundBelow.comp
+      (release_slot_affine_value_sound_below hentry
+        sourceEnv sourceRest rest slots)
+      ih
+
+/-- The exact ownership transformer is closed from the uniformly bounded
+release-plan proof. -/
+theorem ReleasePlan.sound {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit) :
+    ReleaseSlotsSound ctx cur input output emit := by
+  intro rest slots
+  exact EmitSound.of_below fun limit =>
+    hplan.soundAt (limit := limit) rest slots
+
+/-- Every proof-relevant release plan preserves the complete semantic graph
+of its unchanged source environment and of the arbitrary caller frame. The
+exact interface is closed from the single bounded induction body. -/
+theorem ReleasePlan.valueSound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit)
+    (sourceEnv : List IxIR0.Value) :
+    ReleaseSlotsValueSound funRel recSelfRel ctx cur
+      input output sourceEnv emit := by
+  refine { toReleaseSlotsSound := hplan.sound, graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.of_below fun limit =>
+    (hplan.valueSoundAt (limit := limit) sourceEnv).graphEmits
+      sourceRest rest slots
+
+/-- Fuel-bounded semantic half of a release plan. -/
+theorem ReleasePlan.soundBelow {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv} {drops : List SlotDrop}
+    {emit : Emit} (hplan : ReleasePlan input drops output emit) :
+    ReleaseSlotsSoundBelow ctx cur limit input output emit := by
+  exact hplan.soundAt
+
+/-- The semantic release transformer is contractive at every evaluator
+bound; release operations themselves require no function contracts. -/
+theorem ReleasePlan.valueSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : ReleasePlan input drops output emit)
+    (sourceEnv : List IxIR0.Value) :
+    ReleaseSlotsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceEnv emit := by
+  exact hplan.valueSoundAt sourceEnv
+
+/-- The canonical declaration-entry releases execute successfully and carry
+their ownership transformer without any caller-supplied `ReleasePlan`. -/
+theorem parameterDrops_verified {ctx : Ctx} {cur : FnDef}
+    (base : Nat) (modes : List Uses) (remaining : Nat → Nat)
+    (state : LowSt)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      (releaseSlots
+        ⟨parameterEntries base modes remaining, base + modes.length⟩
+        (parameterDrops base modes remaining)).run state =
+          .ok (output, emit) state ∧
+      ReleaseSlotsSound ctx cur
+        ⟨parameterEntries base modes remaining, base + modes.length⟩
+        output emit := by
+  obtain ⟨output, emit, hplan⟩ :=
+    parameterDrops_releasePlan base modes remaining hadmissible
+  exact ⟨output, emit, hplan.run state, hplan.sound⟩
+
+/-- Executable/sound generated releases also cover the trailing entry frame
+of a lifted local function. -/
+theorem parameterDrops_framed_verified {ctx : Ctx} {cur : FnDef}
+    (base : Nat) (modes : List Uses) (remaining : Nat → Nat)
+    (frame : List VEntry) (state : LowSt)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      (releaseSlots
+        ⟨parameterEntries base modes remaining ++ frame,
+          base + modes.length⟩
+        (parameterDrops base modes remaining)).run state =
+          .ok (output, emit) state ∧
+      ReleaseSlotsSound ctx cur
+        ⟨parameterEntries base modes remaining ++ frame,
+          base + modes.length⟩
+        output emit := by
+  obtain ⟨output, emit, hplan⟩ :=
+    parameterDrops_releasePlan_framed base modes remaining frame hadmissible
+  exact ⟨output, emit, hplan.run state, hplan.sound⟩
+
+/-- Arbitrary pre-major cleanup in the refactored recursor executes through
+the real `releaseSlots` definition and preserves the exact ownership state.
+The only structural premise is that the preceding field-entry block has the
+constructor's declared width. -/
+theorem recursorParameterDrops_verified {ctx : Ctx} {cur : FnDef}
+    (numArgs nf depth : Nat) (rhs : IxIR0.Expr)
+    (fieldEntries : List VEntry) (hfields : fieldEntries.length = nf)
+    (state : LowSt) :
+    ∃ output emit,
+      (releaseSlots
+        ⟨fieldEntries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (nf + i) rhs) ++
+            [.recSelf (numArgs + 1)],
+          depth⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (nf + i) rhs)).map
+          (SlotDrop.offsetEntry nf))).run state =
+          .ok (output, emit) state ∧
+      ReleaseSlotsSound ctx cur
+        ⟨fieldEntries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (nf + i) rhs) ++
+            [.recSelf (numArgs + 1)],
+          depth⟩
+        output emit := by
+  obtain ⟨output, emit, hplan⟩ :=
+    recursorParameterDrops_releasePlan numArgs nf depth rhs
+      fieldEntries hfields
+  exact ⟨output, emit, hplan.run state, hplan.sound⟩
+
+/-- Prefix a lowered expression proof with a verified dead-parameter release
+plan. -/
+theorem LowerResultSound.afterRelease {ctx : Ctx} {cur : FnDef}
+    {input middle output : VEnv} {releaseEmit emit : Emit}
+    {world : Owned} {av : AVal}
+    (hbody : LowerResultSound ctx cur middle output world emit av)
+    (hrelease : ReleaseSlotsSound ctx cur input middle releaseEmit) :
+    LowerResultSound ctx cur input output world (releaseEmit ∘ emit) av := by
+  refine ⟨hbody.stable, ?_⟩
+  intro rest slots
+  exact EmitSound.comp (hrelease rest slots) (hbody.emits rest slots)
+
+/-- Semantic release-prefix composition. Because release plans leave the
+logical source environment intact, their graph transformer feeds directly
+into the companion judgment for the following expression. -/
+theorem LowerResultValueSound.afterRelease
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input middle output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {releaseEmit emit : Emit}
+    {world : Owned} {av : AVal}
+    (hbody : LowerResultValueSound funRel recSelfRel ctx cur
+      middle output sourceInput sourceOutput sourceValue world emit av)
+    (hrelease : ReleaseSlotsValueSound funRel recSelfRel ctx cur
+      input middle sourceInput releaseEmit) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world
+      (releaseEmit ∘ emit) av := by
+  refine
+    { toLowerResultSound := hbody.toLowerResultSound.afterRelease
+        hrelease.toReleaseSlotsSound
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSound.comp (hrelease.graphEmits sourceRest rest slots)
+    (hbody.graphEmits sourceRest rest slots)
+
+/-- Fuel-bounded release-prefix composition. -/
+theorem LowerResultSoundBelow.afterRelease {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input middle output : VEnv}
+    {releaseEmit emit : Emit} {world : Owned} {av : AVal}
+    (hbody : LowerResultSoundBelow ctx cur limit middle output world emit av)
+    (hrelease : ReleaseSlotsSoundBelow ctx cur limit
+      input middle releaseEmit) :
+    LowerResultSoundBelow ctx cur limit input output world
+      (releaseEmit ∘ emit) av := by
+  refine ⟨hbody.stable, ?_⟩
+  intro rest slots
+  exact EmitSoundBelow.comp (hrelease rest slots) (hbody.emits rest slots)
+
+/-- Fuel-bounded semantic release-prefix composition. -/
+theorem LowerResultValueSoundBelow.afterRelease
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input middle output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {releaseEmit emit : Emit}
+    {world : Owned} {av : AVal}
+    (hbody : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      middle output sourceInput sourceOutput sourceValue world emit av)
+    (hrelease : ReleaseSlotsValueSoundBelow funRel recSelfRel ctx cur limit
+      input middle sourceInput releaseEmit) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue world
+      (releaseEmit ∘ emit) av := by
+  refine
+    { toLowerResultSoundBelow :=
+        hbody.toLowerResultSoundBelow.afterRelease
+          hrelease.toReleaseSlotsSoundBelow
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  exact EmitSoundBelow.comp
+    (hrelease.graphEmits sourceRest rest slots)
+    (hbody.graphEmits sourceRest rest slots)
+
+/-- Generic executable/proof rule for `lowerFnBody`: first execute a
+`ReleasePlan`, then reuse an already verified `lowerE` result, and finally
+close with the exact `ret` emitted by the lowerer. -/
+theorem lowerFnBody_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input middle output : VEnv) (drops : List SlotDrop)
+    (world : Owned) (body : IxIR0.Expr)
+    (releaseEmit emit : Emit) (av : AVal)
+    (state finalState : LowSt)
+    (hplan : ReleasePlan input drops middle releaseEmit)
+    (hbodyRun : (lowerE src fuel middle world body).run state =
+      .ok (output, emit, av) finalState)
+    (hbody : LowerResultSound ctx cur middle output world emit av) :
+    (lowerFnBody src (Nat.succ fuel) input drops world body).run state =
+        .ok ((releaseEmit ∘ emit) (.ret (av.toAtom output))) finalState ∧
+      LowerResultSound ctx cur input output world (releaseEmit ∘ emit) av := by
+  constructor
+  · simp only [lowerFnBody]
+    rw [estateBindRun, hplan.run state]
+    simp only
+    rw [estateBindRun, hbodyRun]
+    rfl
+  · exact hbody.afterRelease hplan.sound
+
+private theorem lower_held_move_sound_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs remaining : Nat} {uses : Uses}
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultSoundBelow ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  obtain ⟨value, before, after, hbound, hslot, hroots, hout⟩ :=
+    hΓ.entries.releaseAt hentry
+  refine ⟨⟨before ++ after, value, hΓ.setEntry hout, ?_, ?_⟩,
+    hslots.setEntry⟩
+  · apply AValRealizes.slot
+    · simpa [VEnv.setEntry] using hbound
+    · simpa [VEnv.setEntry, VEnv.rel] using hslot
+  · rw [hroots] at hown
+    exact hown.perm
+      (perm_extract_root ⟨worldOfUses uses, value⟩ before after rest)
+
+private theorem lower_held_move_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  refine
+    { toLowerResultSoundBelow := lower_held_move_sound_at hentry
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨foundSource, value, before, after, hfoundSource, hbound,
+      hslot, _, hvalue, hroots, hout⟩ :=
+    hΓ.entries.releaseAt hentry
+  have hsourceEq : foundSource = sourceValue :=
+    Option.some.inj (hfoundSource.symm.trans hsource)
+  subst foundSource
+  refine ⟨⟨before ++ after, value, hΓ.setEntry hout, ?_, hvalue,
+    hrestGraph, ?_⟩, hslots.setEntry⟩
+  · apply AValRealizes.slot
+    · simpa [VEnv.setEntry] using hbound
+    · simpa [VEnv.setEntry, VEnv.rel] using hslot
+  · rw [hroots] at hown
+    exact hown.perm
+      (perm_extract_root ⟨worldOfUses uses, value⟩ before after rest)
+
+/-- A final variable occurrence moves its existing owner from an arbitrary
+held `VEnv` entry to the distinguished expression-result root. This one rule
+covers shared, affine, and linear moves; no target operation is emitted. -/
+theorem lower_var_move_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs : Nat} {uses : Uses}
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerResultSound ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  apply LowerResultSound.of_below
+  intro limit
+  exact lower_held_move_sound_at (limit := limit) hentry
+
+/-- Semantic final-use variable rule. The source evaluator lookup and the
+held target slot identify the same value through `ValueGraph`, while the
+existing ownership theorem remains the parent refinement. -/
+theorem lower_var_move_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerResultValueSound funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  apply LowerResultValueSound.of_below
+  intro limit
+  exact lower_held_move_value_sound_at (limit := limit) hsource hentry
+
+/-- Fuel-bounded move of a held entry. The compiler-side remaining counter is
+irrelevant to the ownership transfer; local-lambda capture uses this generic
+form to discharge several syntactic occurrences at once. -/
+theorem lower_held_move_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs remaining : Nat} {uses : Uses}
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultSoundBelow ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  exact lower_held_move_sound_at hentry
+
+/-- Unbounded ownership interface for moving an arbitrary held entry. -/
+theorem lower_held_move_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs remaining : Nat} {uses : Uses}
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultSound ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  apply LowerResultSound.of_below
+  intro limit
+  exact lower_held_move_sound_below (limit := limit) hentry
+
+/-- Semantic counterpart of an arbitrary held-entry move. This is the
+capture case in which all remaining source occurrences move into the pap. -/
+theorem lower_held_move_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultValueSound funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  apply LowerResultValueSound.of_below
+  intro limit
+  exact lower_held_move_value_sound_at (limit := limit) hsource hentry
+
+theorem lower_held_move_value_sound_below {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) := by
+  exact lower_held_move_value_sound_at hsource hentry
+
+/-- Ordinary final variable use specializes the generic held-entry move to
+remaining count one. -/
+theorem lower_var_move_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs : Nat} {uses : Uses}
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerResultSoundBelow ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+      (_root_.id : Emit) (.slotA abs) :=
+  lower_held_move_sound_below hentry
+
+/-- A final shared variable occurrence in borrowing position moves its owner
+out of the environment and records that the projection caller must release
+that owner after fetching the field. -/
+theorem lower_var_shared_move_borrow_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs : Nat} {uses : Uses}
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerBorrowSoundBelow ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (_root_.id : Emit)
+      (.slotA abs) true := by
+  have hmove := lower_var_move_sound_below
+    (ctx := ctx) (cur := cur) (limit := limit) hentry
+  have hshared : LowerResultSoundBelow ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) .shared
+      (_root_.id : Emit) (.slotA abs) := by
+    simpa [hworld] using hmove
+  exact hshared.asBorrowSlot
+
+/-- Unbounded ownership interface for a final shared variable borrow. -/
+theorem lower_var_shared_move_borrow_sound
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs : Nat} {uses : Uses}
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerBorrowSound ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false)) (_root_.id : Emit)
+      (.slotA abs) true := by
+  apply LowerBorrowSound.of_below
+  intro limit
+  exact lower_var_shared_move_borrow_sound_below
+    (limit := limit) hworld hentry
+
+private theorem lower_var_shared_move_borrow_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) true := by
+  have hmove := lower_held_move_value_sound_at
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) hsource hentry
+  have hshared : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      Γ (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue .shared
+      (_root_.id : Emit) (.slotA abs) := by
+    simpa [hworld] using hmove
+  exact hshared.asBorrowSlot
+
+/-- Semantic final shared-variable borrow. The moved result graph becomes the
+pending borrow owner consumed by the projection caller. -/
+theorem lower_var_shared_move_borrow_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) true := by
+  apply LowerBorrowValueSound.of_below
+  intro limit
+  exact lower_var_shared_move_borrow_value_sound_at
+    (limit := limit) hsource hworld hentry
+
+theorem lower_var_shared_move_borrow_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit Γ
+      (Γ.setEntry i (.slot abs 0 uses false))
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) true := by
+  exact lower_var_shared_move_borrow_value_sound_at hsource hworld hentry
+
+/-- A repeated shared variable borrow decrements its remaining-use counter
+without duplicating the owner. The owner remains in the output `VEnv`, while
+the returned descriptor carries only a shared borrow. -/
+theorem lower_var_shared_borrow_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {i abs remaining : Nat} {uses : Uses}
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowSoundBelow ctx cur limit Γ Γ' (_root_.id : Emit)
+      (.slotA abs) false := by
+  dsimp only
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  obtain ⟨value, hbound, hslot, hmem, hupdated⟩ :=
+    hΓ.entries.updateHeldAt (Nat.succ remaining) hentry
+  let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+  have hΓ' : VEnvRealizes Γ' env roots := hΓ.setEntry hupdated
+  have hav : AValRealizes Γ' env (.slotA abs) value := by
+    apply AValRealizes.slot
+    · simpa [Γ', VEnv.setEntry] using hbound
+    · simpa [Γ', VEnv.setEntry, VEnv.rel] using hslot
+  have hvalueWorld : HasWorld store .shared value := by
+    apply hown.roots_world ⟨.shared, value⟩
+    exact List.mem_append_left rest (by simpa [hworld] using hmem)
+  refine ⟨⟨roots, value, hΓ', hav, hvalueWorld, ?_⟩,
+    hslots.setEntry⟩
+  simpa [borrowResultRoots] using hown
+
+/-- Unbounded ownership interface for a repeated shared variable borrow. -/
+theorem lower_var_shared_borrow_sound
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs remaining : Nat} {uses : Uses}
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowSound ctx cur Γ Γ' (_root_.id : Emit)
+      (.slotA abs) false := by
+  apply LowerBorrowSound.of_below
+  intro limit
+  exact lower_var_shared_borrow_sound_below
+    (limit := limit) hworld hentry
+
+private theorem lower_var_shared_borrow_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ'
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) false := by
+  dsimp only
+  refine
+    { toLowerBorrowSoundBelow :=
+        lower_var_shared_borrow_sound_below hworld hentry
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨foundSource, value, hfoundSource, hbound, hslot,
+      hvalueWorld, hvalueGraph, _, hupdated⟩ :=
+    hΓ.entries.updateHeldAt (Nat.succ remaining) hentry
+  have hsourceEq : foundSource = sourceValue :=
+    Option.some.inj (hfoundSource.symm.trans hsource)
+  subst foundSource
+  let Γ' := Γ.setEntry i
+    (.slot abs (Nat.succ remaining) uses true)
+  have hΓ' : VEnvValueGraph funRel recSelfRel store Γ'
+      sourceEnv env roots := hΓ.setEntry hupdated
+  have hav : AValRealizes Γ' env (.slotA abs) value := by
+    apply AValRealizes.slot
+    · simpa [Γ', VEnv.setEntry] using hbound
+    · simpa [Γ', VEnv.setEntry, VEnv.rel] using hslot
+  have hshared : HasWorld store .shared value := by
+    simpa [hworld] using hvalueWorld
+  refine ⟨roots, value, hΓ', hav, hshared, hvalueGraph,
+    hrestGraph, ?_, hslots.setEntry⟩
+  simpa [borrowResultRoots] using hown
+
+/-- Semantic repeated shared-variable borrow. Updating the static use count
+leaves the runtime owner in the environment, and the returned descriptor
+reuses its existing source graph without an RC operation. -/
+theorem lower_var_shared_borrow_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowValueSound funRel recSelfRel ctx cur Γ Γ'
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) false := by
+  apply LowerBorrowValueSound.of_below
+  intro limit
+  exact lower_var_shared_borrow_value_sound_at
+    (limit := limit) hsource hworld hentry
+
+theorem lower_var_shared_borrow_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworld : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ'
+      sourceEnv sourceEnv sourceValue (_root_.id : Emit)
+      (.slotA abs) false := by
+  exact lower_var_shared_borrow_value_sound_at hsource hworld hentry
+
+private theorem lower_held_retain_sound_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs remaining newRemaining : Nat}
+    {uses : Uses}
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultSoundBelow ctx cur limit Γ Γ'.bump .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  dsimp only
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  obtain ⟨value, hbound, hslot, hmem, hupdated⟩ :=
+    hΓ.entries.updateHeldAt newRemaining hentry
+  let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+  have hΓ' : VEnvRealizes Γ' env roots := hΓ.setEntry hupdated
+  have hav : AValRealizes Γ' env (.slotA abs) value := by
+    apply AValRealizes.slot
+    · simpa [Γ', VEnv.setEntry] using hbound
+    · simpa [Γ', VEnv.setEntry, VEnv.rel] using hslot
+  have hworld : HasWorld store .shared value := by
+    have hroot := hown.roots_world ⟨Owned.shared, value⟩
+      (List.mem_append_left _ (by simpa [hworldOfUses] using hmem))
+    exact hroot
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨middle, heval, hmiddle⟩ :=
+      runOp_retain_borrowed (ctx := ctx) (cur := cur) (fuel := fuel)
+        hav.resolveAtom hworld hown
+    have hpair : (middle, value) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    refine ⟨⟨roots, result, hΓ'.bump result, ?_, hmiddle⟩,
+      hslots.setEntry.bump result⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+
+private theorem lower_held_retain_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining newRemaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  dsimp only
+  refine
+    { toLowerResultSoundBelow :=
+        lower_held_retain_sound_at hworldOfUses hentry
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨foundSource, value, hfoundSource, hbound, hslot,
+      hvalueWorld, hvalue, _, hupdated⟩ :=
+    hΓ.entries.updateHeldAt newRemaining hentry
+  have hsourceEq : foundSource = sourceValue :=
+    Option.some.inj (hfoundSource.symm.trans hsource)
+  subst foundSource
+  let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+  have hΓ' : VEnvValueGraph funRel recSelfRel store Γ'
+      sourceEnv env roots := hΓ.setEntry hupdated
+  have hav : AValRealizes Γ' env (.slotA abs) value := by
+    apply AValRealizes.slot
+    · simpa [Γ', VEnv.setEntry] using hbound
+    · simpa [Γ', VEnv.setEntry, VEnv.rel] using hslot
+  have hshared : HasWorld store .shared value := by
+    simpa [hworldOfUses] using hvalueWorld
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨middle, heval, hstore, hresultGraph, hmiddle⟩ :=
+      runOp_retain_borrowed_valueGraph
+        (ctx := ctx) (cur := cur) (fuel := fuel)
+        hav.resolveAtom hshared hvalue hown
+    have hpair : (middle, value) = (store', result) :=
+      Except.ok.inj (heval.symm.trans hrun)
+    cases hpair
+    have hΓmiddle : VEnvValueGraph funRel recSelfRel store' Γ'
+        sourceEnv env roots := hΓ'.monoStore hstore
+    have hrestGraph' : Sim.RootsGraph funRel store' sourceRest rest :=
+      hrestGraph.monoStore hstore
+    refine ⟨⟨roots, result, hΓmiddle.bump result, ?_, hresultGraph,
+      hrestGraph', hmiddle⟩, hslots.setEntry.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- A non-final `many` occurrence retains the selected shared owner, pushes
+the duplicate into a fresh absolute slot, and leaves the original entry held
+with one fewer remaining source use. -/
+theorem lower_var_many_dup_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs remaining : Nat}
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) .many true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) .many true)
+    LowerResultSound ctx cur Γ Γ'.bump .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  apply LowerResultSound.of_below
+  intro limit
+  exact lower_held_retain_sound_at (limit := limit) (by rfl) hentry
+
+/-- Semantic non-final shared-variable rule. `dup` changes only one
+reference count, so `StoreGraphExtends` transports every older environment
+graph while the returned owner realizes the same source variable. -/
+theorem lower_var_many_dup_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) .many true)) :
+    let Γ' := Γ.setEntry i
+      (.slot abs (Nat.succ remaining) .many true)
+    LowerResultValueSound funRel recSelfRel ctx cur Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  apply LowerResultValueSound.of_below
+  intro limit
+  exact lower_held_retain_value_sound_at
+    (limit := limit) hsource (by rfl) hentry
+
+/-- Retain a held shared entry while replacing its compiler-side remaining
+counter by an arbitrary smaller count. Ordinary variable duplication lowers
+it by one; lambda capture lowers it by the whole captured occurrence count. -/
+theorem lower_held_retain_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs remaining newRemaining : Nat}
+    {uses : Uses}
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultSoundBelow ctx cur limit Γ Γ'.bump .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  exact lower_held_retain_sound_at hworldOfUses hentry
+
+/-- Unbounded ownership interface for retaining a held shared entry while
+installing an arbitrary residual source-use count. -/
+theorem lower_held_retain_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {i abs remaining newRemaining : Nat} {uses : Uses}
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultSound ctx cur Γ Γ'.bump .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  apply LowerResultSound.of_below
+  intro limit
+  exact lower_held_retain_sound_below
+    (limit := limit) hworldOfUses hentry
+
+/-- Semantic arbitrary-count retain. Allocation and all older value graphs
+survive the single RC increment through `StoreGraphExtends`. -/
+theorem lower_held_retain_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining newRemaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultValueSound funRel recSelfRel ctx cur Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  apply LowerResultValueSound.of_below
+  intro limit
+  exact lower_held_retain_value_sound_at
+    (limit := limit) hsource hworldOfUses hentry
+
+/-- Fuel-bounded semantic arbitrary-count retain. The graph proof is local
+to the emitted `dup`, so it does not require any recursive compiler value
+contract at the surrounding evaluator bound. -/
+theorem lower_held_retain_value_sound_below {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining newRemaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? = some (.slot abs remaining uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs newRemaining uses true)
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  exact lower_held_retain_value_sound_at hsource hworldOfUses hentry
+
+/-- Fuel-bounded semantic non-final variable use. -/
+theorem lower_var_shared_dup_value_sound_below {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {i abs remaining : Nat} {uses : Uses}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ'.bump
+      sourceEnv sourceEnv sourceValue .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  exact lower_held_retain_value_sound_below hsource hworldOfUses hentry
+
+/-- Fuel-bounded non-final use in the shared world. This also covers an
+erased-use entry should one appear in an arbitrary input `VEnv`; generated
+environments normally eliminate those entries before lowering. -/
+theorem lower_var_shared_dup_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs remaining : Nat} {uses : Uses}
+    (hworldOfUses : worldOfUses uses = .shared)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) uses true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) uses true)
+    LowerResultSoundBelow ctx cur limit Γ Γ'.bump .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  exact lower_held_retain_sound_below hworldOfUses hentry
+
+/-- The ordinary `.many` specialization of shared duplication. -/
+theorem lower_var_many_dup_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {i abs remaining : Nat}
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) .many true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) .many true)
+    LowerResultSoundBelow ctx cur limit Γ Γ'.bump .shared
+      (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  exact lower_var_shared_dup_sound_below (by rfl) hentry
+
+/-! ## Lambda-capture lowering -/
+
+/-- Canonical entry environment of a generated lifted function, factored
+from `lowerLam` so compiler provenance can name the exact body-lowering run. -/
+def liftedBodyVEnv (entryCount : Nat) (expr : IxIR0.Expr) : VEnv :=
+  let parameterCount := lamArity expr
+  let modes := lamUses expr
+  let body := stripLams expr
+  let captures := liftCaptureIndices entryCount expr
+  ⟨parameterEntries captures.length modes (fun index =>
+      countUses index body) ++
+    selectedEntriesFrom
+      (fun index => countUses index expr > 0)
+      (fun index => countUses (parameterCount + index) body)
+      (List.range entryCount) 0,
+    captures.length + parameterCount⟩
+
+/-- Canonical dead-parameter release plan paired with `liftedBodyVEnv`. -/
+def liftedBodyDrops (entryCount : Nat) (expr : IxIR0.Expr) :
+    List SlotDrop :=
+  let body := stripLams expr
+  let captures := liftCaptureIndices entryCount expr
+  parameterDrops captures.length (lamUses expr)
+    (fun index => countUses index body)
+
+/-- Concrete provenance of a lifted declaration in an accumulated compiler
+state. Its code must be the exact result of lowering the canonical stripped
+lambda body, and the matching declaration must occur in `state.extra`. -/
+def CompilerLiftCodeRel (src : IxIR0.Env) (state : LowSt) : LiftCodeRel :=
+  fun address entryCount expr =>
+    ∃ fuel initial generated code,
+      papSafe expr = true ∧
+      (lowerFnBody src fuel (liftedBodyVEnv entryCount expr)
+          (liftedBodyDrops entryCount expr) .shared (stripLams expr)).run
+          initial = .ok code generated ∧
+      ExtraExtends generated state ∧
+      (address, .fn
+        ⟨(liftCaptureIndices entryCount expr).length + lamArity expr,
+          .shared, true, code⟩) ∈ state.extra
+
+/-- The lowering-specific function oracle for generated lifted paps in one
+final compiler state. -/
+abbrev CompilerLiftedFunctionRel (src : IxIR0.Env) (state : LowSt) :
+    Sim.FunctionRel :=
+  LiftedFunctionRel (CompilerLiftCodeRel src state)
+
+/-- Exact lifted-body provenance survives later declaration generation. -/
+theorem CompilerLiftCodeRel.monoState {src : IxIR0.Env}
+    {initial final : LowSt} (hextends : ExtraExtends initial final)
+    {address : Ixon.Address} {entryCount : Nat} {expr : IxIR0.Expr}
+    (h : CompilerLiftCodeRel src initial address entryCount expr) :
+    CompilerLiftCodeRel src final address entryCount expr := by
+  obtain ⟨fuel, bodyInitial, generated, code, hsafe, hrun, hgenerated,
+      hmember⟩ := h
+  exact ⟨fuel, bodyInitial, generated, code, hsafe, hrun,
+    hgenerated.trans hextends,
+    hextends.extra_mem hmember⟩
+
+theorem CompilerLiftedFunctionRel.monoState {src : IxIR0.Env}
+    {initial final : LowSt} (hextends : ExtraExtends initial final)
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (h : CompilerLiftedFunctionRel src initial value address arity captures) :
+    CompilerLiftedFunctionRel src final value address arity captures := by
+  apply h.mono
+  intro generatedAddress entryCount expr hlift
+  exact hlift.monoState hextends
+
+/-! ### Generated-declaration provenance -/
+
+/-- Operational origin of one declaration accumulated by the lowerer.  Eta
+wrappers are identified by their exact declaration shape.  Lifted functions
+retain the successful canonical body-lowering run that produced their code;
+the positive-arity witness records that this run came from an actual `.lam`
+branch rather than an arbitrary direct call to the internal `lowerLam`
+helper. -/
+def GeneratedDeclProvenance (src : IxIR0.Env) (state : LowSt)
+    (item : Ixon.Address × Decl) : Prop :=
+  (∃ address source tag arity,
+      item = (address, ctorWrapperDecl source tag arity)) ∨
+    ∃ address entryCount expr fuel initial generated code,
+      item = (address, .fn
+        ⟨(liftCaptureIndices entryCount expr).length + lamArity expr,
+          .shared, true, code⟩) ∧
+      0 < lamArity expr ∧
+      papSafe expr = true ∧
+      (lowerFnBody src fuel (liftedBodyVEnv entryCount expr)
+          (liftedBodyDrops entryCount expr) .shared
+          (stripLams expr)).run initial = .ok code generated ∧
+      ExtraExtends generated state ∧
+      (address, .fn
+        ⟨(liftCaptureIndices entryCount expr).length + lamArity expr,
+          .shared, true, code⟩) ∈ state.extra
+
+/-- Generated-declaration provenance survives every later lowering-state
+extension. -/
+theorem GeneratedDeclProvenance.monoState
+    {src : IxIR0.Env} {initial final : LowSt}
+    (hextends : ExtraExtends initial final)
+    {item : Ixon.Address × Decl}
+    (hprovenance : GeneratedDeclProvenance src initial item) :
+    GeneratedDeclProvenance src final item := by
+  cases hprovenance with
+  | inl hwrapper => exact Or.inl hwrapper
+  | inr hlifted =>
+    obtain ⟨address, entryCount, expr, fuel, bodyInitial, generated, code,
+      hitem, hpositive, hsafe, hrun, hgenerated, hmember⟩ := hlifted
+    exact Or.inr ⟨address, entryCount, expr, fuel, bodyInitial, generated,
+      code, hitem, hpositive, hsafe, hrun, hgenerated.trans hextends,
+      hextends.extra_mem hmember⟩
+
+/-- A lowering-state extension whose newly reachable declarations all carry
+compiler provenance.  Membership is phrased as an old-row/new-origin
+partition so it composes without choosing a particular prefix witness from
+`ExtraExtends`. -/
+structure ExtraProvenanceExtends (src : IxIR0.Env)
+    (initial final : LowSt) : Prop where
+  toExtraExtends : ExtraExtends initial final
+  provenance : ∀ {item}, item ∈ final.extra →
+    item ∈ initial.extra ∨ GeneratedDeclProvenance src final item
+
+theorem ExtraProvenanceExtends.refl (src : IxIR0.Env) (state : LowSt) :
+    ExtraProvenanceExtends src state state := by
+  refine ⟨ExtraExtends.refl state, ?_⟩
+  intro item hmember
+  exact Or.inl hmember
+
+theorem ExtraProvenanceExtends.trans
+    {src : IxIR0.Env} {first middle final : LowSt}
+    (hfirst : ExtraProvenanceExtends src first middle)
+    (hsecond : ExtraProvenanceExtends src middle final) :
+    ExtraProvenanceExtends src first final := by
+  refine ⟨hfirst.toExtraExtends.trans hsecond.toExtraExtends, ?_⟩
+  intro item hmember
+  cases hsecond.provenance hmember with
+  | inr hfinal => exact Or.inr hfinal
+  | inl hmiddle =>
+    cases hfirst.provenance hmiddle with
+    | inl hfirst => exact Or.inl hfirst
+    | inr hprovenance =>
+      exact Or.inr (hprovenance.monoState hsecond.toExtraExtends)
+
+/-- From an empty input state, the old-row side of the provenance partition
+is impossible. -/
+theorem ExtraProvenanceExtends.provenance_of_empty
+    {src : IxIR0.Env} {final : LowSt}
+    (hextends : ExtraProvenanceExtends src ({} : LowSt) final)
+    {item : Ixon.Address × Decl} (hmember : item ∈ final.extra) :
+    GeneratedDeclProvenance src final item := by
+  cases hextends.provenance hmember with
+  | inl hold => simp at hold
+  | inr hprovenance => exact hprovenance
+
+/-- Monad action law corresponding to `ExtraProvenanceExtends`. -/
+def ExtraProvenanceMonotone {α : Type} (src : IxIR0.Env)
+    (action : LowerM α) : Prop :=
+  ∀ {initial final result}, action.run initial = .ok result final →
+    ExtraProvenanceExtends src initial final
+
+theorem ExtraProvenanceMonotone.pure {α : Type} (src : IxIR0.Env)
+    (value : α) :
+    ExtraProvenanceMonotone src (pure value : LowerM α) := by
+  intro initial final result hrun
+  have hpure : value = result ∧ initial = final := by
+    simpa using hrun
+  obtain ⟨_, hstate⟩ := hpure
+  subst final
+  exact ExtraProvenanceExtends.refl src initial
+
+theorem ExtraProvenanceMonotone.throw {α : Type} (src : IxIR0.Env)
+    (message : String) :
+    ExtraProvenanceMonotone src (throw message : LowerM α) := by
+  intro initial final result hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem ExtraProvenanceMonotone.throwBind {α β : Type}
+    (src : IxIR0.Env) (message : String) (next : α → LowerM β) :
+    ExtraProvenanceMonotone src
+      ((EStateM.throw message : LowerM α) >>= next) := by
+  intro initial final result hrun
+  change EStateM.Result.error message initial = .ok result final at hrun
+  contradiction
+
+theorem ExtraProvenanceMonotone.get (src : IxIR0.Env) :
+    ExtraProvenanceMonotone src (get : LowerM LowSt) := by
+  intro initial final result hrun
+  change EStateM.Result.ok initial initial = .ok result final at hrun
+  injection hrun with _ hstate
+  subst final
+  exact ExtraProvenanceExtends.refl src initial
+
+theorem ExtraProvenanceMonotone.bind {α β : Type} {src : IxIR0.Env}
+    {action : LowerM α} {next : α → LowerM β}
+    (haction : ExtraProvenanceMonotone src action)
+    (hnext : ∀ value, ExtraProvenanceMonotone src (next value)) :
+    ExtraProvenanceMonotone src (action >>= next) := by
+  intro initial final result hrun
+  obtain ⟨value, middle, hfirst, hsecond⟩ :=
+    estateBindRun_ok_inv hrun
+  exact (haction hfirst).trans (hnext value hsecond)
+
+theorem ExtraProvenanceMonotone.map {α β : Type} {src : IxIR0.Env}
+    {action : LowerM α} (haction : ExtraProvenanceMonotone src action)
+    (f : α → β) : ExtraProvenanceMonotone src (f <$> action) := by
+  have hbind : ExtraProvenanceMonotone src
+      (action >>= fun value => (Pure.pure (f value) : LowerM β)) :=
+    ExtraProvenanceMonotone.bind haction
+      (fun value => ExtraProvenanceMonotone.pure src (f value))
+  intro initial final result hrun
+  apply hbind
+  simpa only [bind_pure_comp] using hrun
+
+theorem ExtraProvenanceMonotone.listMapM {α β : Type}
+    (src : IxIR0.Env) (f : α → LowerM β)
+    (hf : ∀ value, ExtraProvenanceMonotone src (f value)) :
+    ∀ values : List α, ExtraProvenanceMonotone src (values.mapM f)
+  | [] => by
+      simpa using (ExtraProvenanceMonotone.pure src ([] : List β))
+  | value :: rest => by
+      rw [List.mapM_cons]
+      apply ExtraProvenanceMonotone.bind (hf value)
+      intro head
+      apply ExtraProvenanceMonotone.bind
+        (ExtraProvenanceMonotone.listMapM src f hf rest)
+      intro tail
+      exact ExtraProvenanceMonotone.pure src (head :: tail)
+
+theorem ExtraProvenanceMonotone.listFilterMapM {α β : Type}
+    (src : IxIR0.Env) (f : α → LowerM (Option β))
+    (hf : ∀ value, ExtraProvenanceMonotone src (f value)) :
+    ∀ values : List α, ExtraProvenanceMonotone src (values.filterMapM f)
+  | [] => by
+      simpa using (ExtraProvenanceMonotone.pure src ([] : List β))
+  | value :: rest => by
+      rw [List.filterMapM_cons]
+      apply ExtraProvenanceMonotone.bind (hf value)
+      intro head
+      cases head with
+      | none =>
+        exact ExtraProvenanceMonotone.listFilterMapM src f hf rest
+      | some head =>
+        apply ExtraProvenanceMonotone.bind
+          (ExtraProvenanceMonotone.listFilterMapM src f hf rest)
+        intro tail
+        exact ExtraProvenanceMonotone.pure src (head :: tail)
+
+theorem freshAddr_extraProvenance (src : IxIR0.Env) :
+    ExtraProvenanceMonotone src freshAddr := by
+  intro initial final address hrun
+  refine ⟨freshAddr_extraExtends hrun, ?_⟩
+  intro item hmember
+  change EStateM.Result.ok (synthAddr initial.fresh)
+      { initial with fresh := initial.fresh + 1 } =
+    .ok address final at hrun
+  have hstate : { initial with fresh := initial.fresh + 1 } = final :=
+    congrArg
+      (fun result : EStateM.Result String LowSt Ixon.Address =>
+        match result with
+        | .ok _ state | .error _ state => state)
+      hrun
+  subst final
+  exact Or.inl hmember
+
+/-- Wrapper lookup either adds one declaration with explicit wrapper
+provenance or leaves the compiler state unchanged on a cache hit. -/
+theorem wrapperFor_extraProvenance (src : IxIR0.Env)
+    (source : Ixon.Address) (tag arity : Nat) :
+    ExtraProvenanceMonotone src (wrapperFor source tag arity) := by
+  intro initial final wrapper hrun
+  refine ⟨wrapperFor_extraExtends hrun, ?_⟩
+  intro item hmember
+  cases hcached : initial.wrappers.find?
+      (·.matches source tag arity) with
+  | none =>
+    have hstate :
+        { initial with
+            fresh := initial.fresh + 1
+            wrappers :=
+              ⟨source, tag, arity, synthAddr initial.fresh⟩ ::
+                initial.wrappers
+            extra :=
+              (synthAddr initial.fresh,
+                ctorWrapperDecl source tag arity) ::
+                initial.extra } = final := by
+      dsimp [wrapperFor] at hrun
+      rw [hcached] at hrun
+      exact congrArg
+        (fun result : EStateM.Result String LowSt Ixon.Address =>
+          match result with
+          | .ok _ state | .error _ state => state)
+        hrun
+    subst final
+    simp only [List.mem_cons] at hmember
+    cases hmember with
+    | inl hnew =>
+      exact Or.inr (Or.inl
+        ⟨synthAddr initial.fresh, source, tag, arity, hnew⟩)
+    | inr hold => exact Or.inl hold
+  | some memo =>
+    dsimp [wrapperFor] at hrun
+    rw [hcached] at hrun
+    dsimp at hrun
+    injection hrun with _ hstate
+    subst final
+    exact Or.inl hmember
+
+/-- Entry cleanup uses only pure compiler-state actions. -/
+theorem releaseSlots_extraProvenance (src : IxIR0.Env) (input : VEnv) :
+    ∀ drops : List SlotDrop,
+      ExtraProvenanceMonotone src (releaseSlots input drops) := by
+  exact releaseSlots_action_core
+    (ActionProperty := fun {α : Type} (action : LowerM α) =>
+      ExtraProvenanceMonotone src action)
+    (hpure := fun value => ExtraProvenanceMonotone.pure src value)
+    (hbind := fun haction hnext =>
+      ExtraProvenanceMonotone.bind haction hnext)
+    (hthrowBind := fun message next =>
+      ExtraProvenanceMonotone.throwBind src message next)
+    input
+
+/-- Result-world checks inspect no compiler state. -/
+theorem requireResultWorld_extraProvenance (src : IxIR0.Env)
+    (actual demand : Owned) :
+    ExtraProvenanceMonotone src (requireResultWorld actual demand) := by
+  cases actual <;> cases demand <;>
+    simp [requireResultWorld] <;>
+    first
+    | exact ExtraProvenanceMonotone.pure src _
+    | exact ExtraProvenanceMonotone.throw src _
+
+/-- Provenance-preserving expression actions at one compiler-fuel index. -/
+def LowerEExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input world expr,
+    ExtraProvenanceMonotone src (lowerE src fuel input world expr)
+
+def LowerBorrowExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input expr,
+    ExtraProvenanceMonotone src (lowerBorrow src fuel input expr)
+
+def LowerSpineExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input world head args,
+    ExtraProvenanceMonotone src
+      (lowerSpine src fuel input world head args)
+
+def KnownCallExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input build count argWorlds resultWorld args,
+    ExtraProvenanceMonotone src
+      (knownCall src fuel input build count argWorlds resultWorld args)
+
+def LowerArgsExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input args,
+    ExtraProvenanceMonotone src (lowerArgs src fuel input args)
+
+def ApplyRestExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input resultWorld pre function args,
+    ExtraProvenanceMonotone src
+      (applyRest src fuel input resultWorld pre function args)
+
+/-- `lowerLam` is internal; only positive-arity calls made by the `.lam`
+expression branch are admitted to the generated-declaration invariant. -/
+def LowerLamExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input expr, 0 < lamArity expr →
+    ExtraProvenanceMonotone src (lowerLam src fuel input expr)
+
+def LowerFnBodyExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input drops world body,
+    ExtraProvenanceMonotone src
+      (lowerFnBody src fuel input drops world body)
+
+structure LowerExtraProvenance (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEExtraProvenance src fuel
+  borrow : LowerBorrowExtraProvenance src fuel
+  spine : LowerSpineExtraProvenance src fuel
+  knownCall : KnownCallExtraProvenance src fuel
+  args : LowerArgsExtraProvenance src fuel
+  applyRest : ApplyRestExtraProvenance src fuel
+  lam : LowerLamExtraProvenance src fuel
+  fnBody : LowerFnBodyExtraProvenance src fuel
+
+theorem lowerFnBodyExtraProvenance_zero (src : IxIR0.Env) :
+    LowerFnBodyExtraProvenance src 0 := by
+  intro input drops world body
+  simp only [lowerFnBody]
+  exact ExtraProvenanceMonotone.throw src _
+
+theorem lowerFnBodyExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel) :
+    LowerFnBodyExtraProvenance src (fuel + 1) := by
+  intro input drops world body
+  simp only [lowerFnBody]
+  apply ExtraProvenanceMonotone.bind
+    (releaseSlots_extraProvenance src input drops)
+  intro releaseResult
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  apply ExtraProvenanceMonotone.bind (hexpr middle world body)
+  intro bodyResult
+  rcases bodyResult with ⟨output, bodyEmit, value⟩
+  exact ExtraProvenanceMonotone.pure src
+    (releaseEmit (bodyEmit (.ret (value.toAtom output))))
+
+theorem lowerExtraProvenance_zero (src : IxIR0.Env) :
+    LowerExtraProvenance src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr
+    simp only [lowerE]
+    exact ExtraProvenanceMonotone.throw src _
+  · intro input expr
+    simp only [lowerBorrow]
+    exact ExtraProvenanceMonotone.throw src _
+  · intro input world head args
+    simp only [lowerSpine]
+    exact ExtraProvenanceMonotone.throw src _
+  · intro input build count argWorlds resultWorld args
+    simp only [knownCall]
+    exact ExtraProvenanceMonotone.throw src _
+  · intro input args
+    simp only [lowerArgs]
+    exact ExtraProvenanceMonotone.throw src _
+  · intro input resultWorld pre function args
+    simp only [applyRest]
+    exact ExtraProvenanceMonotone.throw src _
+  · intro input expr _
+    simp only [lowerLam]
+    exact ExtraProvenanceMonotone.throw src _
+  · exact lowerFnBodyExtraProvenance_zero src
+
+/-- Capture bookkeeping never changes `LowSt`; it only rewrites the logical
+`VEnv` and emitter returned as the action's value. -/
+theorem lowerCapture_extraMonotone (e : IxIR0.Expr) (input : VEnv)
+    (index : Nat) : ExtraMonotone (lowerCapture e input index) := by
+  intro state finalState result hrun
+  cases hentry : input.entries[index]? with
+  | none =>
+    exact (estateThrowRun_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (estateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (estateThrowRun_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          exact (estateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses index e
+          · have hpure : state = finalState := by
+              have hresult :
+                  (input.setEntry index
+                      (.slot abs (remaining - countUses index e) uses true)).bump =
+                      result.1 ∧
+                    state = finalState := by
+                have hfull :
+                    ((input.setEntry index
+                        (.slot abs (remaining - countUses index e) uses true)).bump,
+                      emitOp (.dup (.var
+                        ((input.setEntry index
+                          (.slot abs (remaining - countUses index e) uses true)).rel abs))),
+                      AVal.slotA
+                        (input.setEntry index
+                          (.slot abs (remaining - countUses index e) uses true)).depth) =
+                        result ∧ state = finalState := by
+                  simpa [lowerCapture, hentry, huniqueEq, hmore] using hrun
+                exact ⟨congrArg (fun value : VEnv × Emit × AVal => value.1)
+                  hfull.1, hfull.2⟩
+              exact hresult.2
+            subst finalState
+            exact ExtraExtends.refl _
+          · by_cases hequal : remaining = countUses index e
+            · have hpure : state = finalState := by
+                have hfull :
+                    (input.setEntry index (.slot abs 0 uses false),
+                      (_root_.id : Emit), AVal.slotA abs) = result ∧
+                      state = finalState := by
+                  simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                    using hrun
+                exact hfull.2
+              subst finalState
+              exact ExtraExtends.refl _
+            · exact (estateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+/-- A whole capture traversal likewise preserves `LowSt.extra`. The generic
+bind rule records this structurally rather than relying on an opaque fold. -/
+theorem lowerCaptures_extraMonotone (e : IxIR0.Expr) :
+    ∀ (input : VEnv) (caps : List Nat),
+      ExtraMonotone (lowerCaptures e input caps) := by
+  exact lowerCaptures_action_core
+    (e := e)
+    (ActionProperty := fun {α : Type} (action : LowerM α) =>
+      ExtraMonotone action)
+    (hpure := fun value => ExtraMonotone.pure value)
+    (hbind := fun haction hnext => ExtraMonotone.bind haction hnext)
+    (hcapture := lowerCapture_extraMonotone e)
+
+theorem lowerLam_extraMonotone_zero (src : IxIR0.Env)
+    (input : VEnv) (e : IxIR0.Expr) :
+    ExtraMonotone (lowerLam src 0 input e) := by
+  simp only [lowerLam]
+  exact ExtraMonotone.throw _
+
+/-- Lambda lifting composes the state-preserving capture traversal, counter-
+only fresh allocation, recursively monotone body lowering, and one explicit
+extra-list prepend. -/
+theorem lowerLam_extraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hfn : LowerFnBodyExtraMonotone src fuel)
+    (input : VEnv) (e : IxIR0.Expr) :
+    ExtraMonotone (lowerLam src (fuel + 1) input e) := by
+  simp only [lowerLam]
+  cases hp : papSafe e with
+  | false =>
+    simp only [Bool.false_eq_true, if_false]
+    exact ExtraMonotone.throwBind _ _
+  | true =>
+    simp only [↓reduceIte, bind_pure_comp]
+    let caps := (List.range input.entries.length).filter
+      (fun i => countUses i e > 0)
+    have hcaps : caps = (List.range input.entries.length).filter
+        (fun i => countUses i e > 0) := rfl
+    rw [← hcaps]
+    apply ExtraMonotone.bind (lowerCaptures_extraMonotone e input caps)
+    intro captureResult
+    rcases captureResult with ⟨captureOutput, captureEmit, captureValues⟩
+    apply ExtraMonotone.bind freshAddr_extraMonotone
+    intro fnAddr
+    apply ExtraMonotone.bind (hfn _ _ _ _)
+    intro code
+    exact ExtraMonotone.map (pushExtra_extraMonotone _)
+      (fun _ => (captureOutput.bump,
+        captureEmit ∘ emitOp (.papp fnAddr
+          (captureValues.map (·.toAtom captureOutput)).toArray),
+        AVal.slotA captureOutput.depth))
+
+/-- Capture bookkeeping preserves generated provenance because it leaves the
+lowering state unchanged on every successful branch. -/
+theorem lowerCapture_extraProvenance (src : IxIR0.Env)
+    (e : IxIR0.Expr) (input : VEnv) (index : Nat) :
+    ExtraProvenanceMonotone src (lowerCapture e input index) := by
+  intro state finalState result hrun
+  cases hentry : input.entries[index]? with
+  | none =>
+    exact (estateThrowRun_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (estateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (estateThrowRun_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          exact (estateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses index e
+          · have hpure : state = finalState := by
+              have hresult :
+                  (input.setEntry index
+                      (.slot abs (remaining - countUses index e) uses true)).bump =
+                      result.1 ∧
+                    state = finalState := by
+                have hfull :
+                    ((input.setEntry index
+                        (.slot abs (remaining - countUses index e) uses true)).bump,
+                      emitOp (.dup (.var
+                        ((input.setEntry index
+                          (.slot abs (remaining - countUses index e) uses true)).rel abs))),
+                      AVal.slotA
+                        (input.setEntry index
+                          (.slot abs (remaining - countUses index e) uses true)).depth) =
+                        result ∧ state = finalState := by
+                  simpa [lowerCapture, hentry, huniqueEq, hmore] using hrun
+                exact ⟨congrArg (fun value : VEnv × Emit × AVal => value.1)
+                  hfull.1, hfull.2⟩
+              exact hresult.2
+            subst finalState
+            exact ExtraProvenanceExtends.refl src state
+          · by_cases hequal : remaining = countUses index e
+            · have hpure : state = finalState := by
+                have hfull :
+                    (input.setEntry index (.slot abs 0 uses false),
+                      (_root_.id : Emit), AVal.slotA abs) = result ∧
+                      state = finalState := by
+                  simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                    using hrun
+                exact hfull.2
+              subst finalState
+              exact ExtraProvenanceExtends.refl src state
+            · exact (estateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_extraProvenance (src : IxIR0.Env)
+    (e : IxIR0.Expr) :
+    ∀ (input : VEnv) (caps : List Nat),
+      ExtraProvenanceMonotone src (lowerCaptures e input caps) := by
+  exact lowerCaptures_action_core
+    (e := e)
+    (ActionProperty := fun {α : Type} (action : LowerM α) =>
+      ExtraProvenanceMonotone src action)
+    (hpure := fun value => ExtraProvenanceMonotone.pure src value)
+    (hbind := fun haction hnext =>
+      ExtraProvenanceMonotone.bind haction hnext)
+    (hcapture := lowerCapture_extraProvenance src e)
+
+theorem lowerLam_extraProvenance_zero (src : IxIR0.Env)
+    (input : VEnv) (e : IxIR0.Expr) :
+    ExtraProvenanceMonotone src (lowerLam src 0 input e) := by
+  simp only [lowerLam]
+  exact ExtraProvenanceMonotone.throw src _
+
+theorem lowerArgsExtraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    (hargs : LowerArgsExtraMonotone src fuel) :
+    LowerArgsExtraMonotone src (fuel + 1) := by
+  intro input args
+  cases args with
+  | nil =>
+    simp only [lowerArgs]
+    exact ExtraMonotone.pure _
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs]
+    apply ExtraMonotone.bind (hexpr input world expr)
+    intro headResult
+    rcases headResult with ⟨middle, headEmit, value⟩
+    apply ExtraMonotone.bind (hargs middle rest)
+    intro tailResult
+    rcases tailResult with ⟨output, tailEmit, values⟩
+    exact ExtraMonotone.pure
+      (output, headEmit ∘ tailEmit, value :: values)
+
+theorem applyRestExtraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsExtraMonotone src fuel) :
+    ApplyRestExtraMonotone src (fuel + 1) := by
+  intro input resultWorld pre function args
+  cases function with
+  | slotA abs =>
+    simp only [applyRest]
+    apply ExtraMonotone.bind
+      (requireResultWorld_extraMonotone .shared resultWorld)
+    intro unitValue
+    cases unitValue
+    apply ExtraMonotone.bind
+      (hargs input (args.map (fun arg => (arg, Owned.shared))))
+    intro argsResult
+    rcases argsResult with ⟨output, argsEmit, values⟩
+    exact ExtraMonotone.pure
+      (output.bump,
+        pre ∘ argsEmit ∘ emitOp (.apply
+          ((AVal.slotA abs).toAtom output)
+          (values.map (·.toAtom output)).toArray),
+        AVal.slotA output.depth)
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest]
+      apply ExtraMonotone.bind
+        (hargs input (args.map (fun arg => (arg, Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact ExtraMonotone.pure
+        ((releaseAll output values).1,
+          pre ∘ argsEmit ∘ (releaseAll output values).2,
+          AVal.constA .erased)
+    | var relative =>
+      simp only [applyRest]
+      apply ExtraMonotone.bind
+        (requireResultWorld_extraMonotone .shared resultWorld)
+      intro unitValue
+      cases unitValue
+      apply ExtraMonotone.bind
+        (hargs input (args.map (fun arg => (arg, Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact ExtraMonotone.pure
+        (output.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.constA (.var relative)).toAtom output)
+            (values.map (·.toAtom output)).toArray),
+          AVal.slotA output.depth)
+    | lit literal =>
+      simp only [applyRest]
+      apply ExtraMonotone.bind
+        (requireResultWorld_extraMonotone .shared resultWorld)
+      intro unitValue
+      cases unitValue
+      apply ExtraMonotone.bind
+        (hargs input (args.map (fun arg => (arg, Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact ExtraMonotone.pure
+        (output.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.constA (.lit literal)).toAtom output)
+            (values.map (·.toAtom output)).toArray),
+          AVal.slotA output.depth)
+
+theorem knownCallExtraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsExtraMonotone src fuel)
+    (hrest : ApplyRestExtraMonotone src fuel) :
+    KnownCallExtraMonotone src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args
+  simp only [knownCall]
+  apply ExtraMonotone.bind
+    (hargs input ((args.take count).zip (padWorlds argWorlds count)))
+  intro argsResult
+  rcases argsResult with ⟨output, argsEmit, values⟩
+  by_cases hterminal : args.length ≤ count
+  · simp only [if_pos hterminal]
+    exact ExtraMonotone.pure
+      (output.bump,
+        argsEmit ∘ emitOp
+          (build (values.map (·.toAtom output)).toArray),
+        AVal.slotA output.depth)
+  · simp only [if_neg hterminal]
+    exact hrest output.bump resultWorld
+      (argsEmit ∘ emitOp
+        (build (values.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (args.drop count)
+
+theorem lowerArgsExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    (hargs : LowerArgsExtraProvenance src fuel) :
+    LowerArgsExtraProvenance src (fuel + 1) := by
+  intro input args
+  cases args with
+  | nil =>
+    simp only [lowerArgs]
+    exact ExtraProvenanceMonotone.pure src _
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs]
+    apply ExtraProvenanceMonotone.bind (hexpr input world expr)
+    intro headResult
+    rcases headResult with ⟨middle, headEmit, value⟩
+    apply ExtraProvenanceMonotone.bind (hargs middle rest)
+    intro tailResult
+    rcases tailResult with ⟨output, tailEmit, values⟩
+    exact ExtraProvenanceMonotone.pure src
+      (output, headEmit ∘ tailEmit, value :: values)
+
+theorem applyRestExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsExtraProvenance src fuel) :
+    ApplyRestExtraProvenance src (fuel + 1) := by
+  intro input resultWorld pre function args
+  cases function with
+  | slotA abs =>
+    simp only [applyRest]
+    apply ExtraProvenanceMonotone.bind
+      (requireResultWorld_extraProvenance src .shared resultWorld)
+    intro unitValue
+    cases unitValue
+    apply ExtraProvenanceMonotone.bind
+      (hargs input (args.map (fun arg => (arg, Owned.shared))))
+    intro argsResult
+    rcases argsResult with ⟨output, argsEmit, values⟩
+    exact ExtraProvenanceMonotone.pure src
+      (output.bump,
+        pre ∘ argsEmit ∘ emitOp (.apply
+          ((AVal.slotA abs).toAtom output)
+          (values.map (·.toAtom output)).toArray),
+        AVal.slotA output.depth)
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest]
+      apply ExtraProvenanceMonotone.bind
+        (hargs input (args.map (fun arg => (arg, Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact ExtraProvenanceMonotone.pure src
+        ((releaseAll output values).1,
+          pre ∘ argsEmit ∘ (releaseAll output values).2,
+          AVal.constA .erased)
+    | var relative =>
+      simp only [applyRest]
+      apply ExtraProvenanceMonotone.bind
+        (requireResultWorld_extraProvenance src .shared resultWorld)
+      intro unitValue
+      cases unitValue
+      apply ExtraProvenanceMonotone.bind
+        (hargs input (args.map (fun arg => (arg, Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact ExtraProvenanceMonotone.pure src
+        (output.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.constA (.var relative)).toAtom output)
+            (values.map (·.toAtom output)).toArray),
+          AVal.slotA output.depth)
+    | lit literal =>
+      simp only [applyRest]
+      apply ExtraProvenanceMonotone.bind
+        (requireResultWorld_extraProvenance src .shared resultWorld)
+      intro unitValue
+      cases unitValue
+      apply ExtraProvenanceMonotone.bind
+        (hargs input (args.map (fun arg => (arg, Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact ExtraProvenanceMonotone.pure src
+        (output.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.constA (.lit literal)).toAtom output)
+            (values.map (·.toAtom output)).toArray),
+          AVal.slotA output.depth)
+
+theorem knownCallExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsExtraProvenance src fuel)
+    (hrest : ApplyRestExtraProvenance src fuel) :
+    KnownCallExtraProvenance src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args
+  simp only [knownCall]
+  apply ExtraProvenanceMonotone.bind
+    (hargs input ((args.take count).zip (padWorlds argWorlds count)))
+  intro argsResult
+  rcases argsResult with ⟨output, argsEmit, values⟩
+  by_cases hterminal : args.length ≤ count
+  · simp only [if_pos hterminal]
+    exact ExtraProvenanceMonotone.pure src
+      (output.bump,
+        argsEmit ∘ emitOp
+          (build (values.map (·.toAtom output)).toArray),
+        AVal.slotA output.depth)
+  · simp only [if_neg hterminal]
+    exact hrest output.bump resultWorld
+      (argsEmit ∘ emitOp
+        (build (values.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (args.drop count)
+
+/-- Variable borrowing never touches the generated-declaration state. The
+case split mirrors the executable rejection/move/borrow branches. -/
+theorem lowerBorrow_var_extraMonotone
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv) (index : Nat) :
+    ExtraMonotone
+      (lowerBorrow src (fuel + 1) input (.var index)) := by
+  simp only [lowerBorrow]
+  cases hentry : input.entries[index]? with
+  | none => exact ExtraMonotone.throw _
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact ExtraMonotone.throw _
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact ExtraMonotone.throw _
+      | true =>
+        cases uses with
+        | linear => exact ExtraMonotone.throw _
+        | affine => exact ExtraMonotone.throw _
+        | erased =>
+          cases remaining with
+          | zero => exact ExtraMonotone.throw _
+          | succ remaining =>
+            cases remaining with
+            | zero => exact ExtraMonotone.pure _
+            | succ remaining => exact ExtraMonotone.pure _
+        | many =>
+          cases remaining with
+          | zero => exact ExtraMonotone.throw _
+          | succ remaining =>
+            cases remaining with
+            | zero => exact ExtraMonotone.pure _
+            | succ remaining => exact ExtraMonotone.pure _
+
+theorem lowerBorrow_var_extraProvenance
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv) (index : Nat) :
+    ExtraProvenanceMonotone src
+      (lowerBorrow src (fuel + 1) input (.var index)) := by
+  simp only [lowerBorrow]
+  cases hentry : input.entries[index]? with
+  | none => exact ExtraProvenanceMonotone.throw src _
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact ExtraProvenanceMonotone.throw src _
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact ExtraProvenanceMonotone.throw src _
+      | true =>
+        cases uses with
+        | linear => exact ExtraProvenanceMonotone.throw src _
+        | affine => exact ExtraProvenanceMonotone.throw src _
+        | erased =>
+          cases remaining with
+          | zero => exact ExtraProvenanceMonotone.throw src _
+          | succ remaining =>
+            cases remaining with
+            | zero => exact ExtraProvenanceMonotone.pure src _
+            | succ remaining => exact ExtraProvenanceMonotone.pure src _
+        | many =>
+          cases remaining with
+          | zero => exact ExtraProvenanceMonotone.throw src _
+          | succ remaining =>
+            cases remaining with
+            | zero => exact ExtraProvenanceMonotone.pure src _
+            | succ remaining => exact ExtraProvenanceMonotone.pure src _
+
+/-- Variable consumption is state-only trivial even though its ownership
+branching distinguishes demand, binder mode, and remaining-use count. -/
+theorem lowerE_var_extraMonotone
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv)
+    (world : Owned) (index : Nat) :
+    ExtraMonotone (lowerE src (fuel + 1) input world (.var index)) := by
+  simp only [lowerE]
+  cases hentry : input.entries[index]? with
+  | none => exact ExtraMonotone.throw _
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact ExtraMonotone.throw _
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact ExtraMonotone.throw _
+      | true =>
+        cases remaining with
+        | zero =>
+          cases uses <;> cases world <;>
+            first
+            | exact ExtraMonotone.pure _
+            | exact ExtraMonotone.throw _
+        | succ remaining =>
+          cases remaining with
+          | zero =>
+            cases uses <;> cases world <;>
+              first
+              | exact ExtraMonotone.pure _
+              | exact ExtraMonotone.throw _
+          | succ remaining =>
+            cases uses <;> cases world <;>
+              first
+              | exact ExtraMonotone.pure _
+              | exact ExtraMonotone.throw _
+
+theorem lowerE_var_extraProvenance
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv)
+    (world : Owned) (index : Nat) :
+    ExtraProvenanceMonotone src
+      (lowerE src (fuel + 1) input world (.var index)) := by
+  simp only [lowerE]
+  cases hentry : input.entries[index]? with
+  | none => exact ExtraProvenanceMonotone.throw src _
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact ExtraProvenanceMonotone.throw src _
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact ExtraProvenanceMonotone.throw src _
+      | true =>
+        cases remaining with
+        | zero =>
+          cases uses <;> cases world <;>
+            first
+            | exact ExtraProvenanceMonotone.pure src _
+            | exact ExtraProvenanceMonotone.throw src _
+        | succ remaining =>
+          cases remaining with
+          | zero =>
+            cases uses <;> cases world <;>
+              first
+              | exact ExtraProvenanceMonotone.pure src _
+              | exact ExtraProvenanceMonotone.throw src _
+          | succ remaining =>
+            cases uses <;> cases world <;>
+              first
+              | exact ExtraProvenanceMonotone.pure src _
+              | exact ExtraProvenanceMonotone.throw src _
+
+theorem lowerE_ref_extraMonotone
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv)
+    (world : Owned) (address : Ixon.Address) :
+    ExtraMonotone (lowerE src (fuel + 1) input world (.ref address)) := by
+  simp only [lowerE]
+  cases hsource : src address with
+  | none =>
+    simp only
+    exact ExtraMonotone.throw _
+  | some decl =>
+    cases decl with
+    | defn result body =>
+      simp only
+      cases harity : lamArity body with
+      | zero =>
+        apply ExtraMonotone.bind
+          (requireResultWorld_extraMonotone result world)
+        intro unitValue
+        cases unitValue
+        exact ExtraMonotone.pure _
+      | succ arity =>
+        cases result <;> cases world <;> cases hp : papSafe body <;>
+          first
+          | exact ExtraMonotone.pure _
+          | exact ExtraMonotone.throw _
+    | ctor tag arity =>
+      simp only
+      cases arity with
+      | zero => exact ExtraMonotone.pure _
+      | succ arity =>
+        cases world with
+        | unique => exact ExtraMonotone.throw _
+        | shared =>
+          apply ExtraMonotone.bind
+            (wrapperFor_extraMonotone address tag (arity + 1))
+          intro wrapper
+          exact ExtraMonotone.pure _
+    | recursor numArgs natLit rules =>
+      simp only
+      cases world <;> first
+        | exact ExtraMonotone.pure _
+        | exact ExtraMonotone.throw _
+    | extern arity =>
+      simp only
+      cases arity with
+      | zero => exact ExtraMonotone.pure _
+      | succ arity =>
+        cases world <;> first
+          | exact ExtraMonotone.pure _
+          | exact ExtraMonotone.throw _
+
+theorem lowerE_ref_extraProvenance
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv)
+    (world : Owned) (address : Ixon.Address) :
+    ExtraProvenanceMonotone src
+      (lowerE src (fuel + 1) input world (.ref address)) := by
+  simp only [lowerE]
+  cases hsource : src address with
+  | none =>
+    simp only
+    exact ExtraProvenanceMonotone.throw src _
+  | some decl =>
+    cases decl with
+    | defn result body =>
+      simp only
+      cases harity : lamArity body with
+      | zero =>
+        apply ExtraProvenanceMonotone.bind
+          (requireResultWorld_extraProvenance src result world)
+        intro unitValue
+        cases unitValue
+        exact ExtraProvenanceMonotone.pure src _
+      | succ arity =>
+        cases result <;> cases world <;> cases hp : papSafe body <;>
+          first
+          | exact ExtraProvenanceMonotone.pure src _
+          | exact ExtraProvenanceMonotone.throw src _
+    | ctor tag arity =>
+      simp only
+      cases arity with
+      | zero => exact ExtraProvenanceMonotone.pure src _
+      | succ arity =>
+        cases world with
+        | unique => exact ExtraProvenanceMonotone.throw src _
+        | shared =>
+          apply ExtraProvenanceMonotone.bind
+            (wrapperFor_extraProvenance src address tag (arity + 1))
+          intro wrapper
+          exact ExtraProvenanceMonotone.pure src _
+    | recursor numArgs natLit rules =>
+      simp only
+      cases world <;> first
+        | exact ExtraProvenanceMonotone.pure src _
+        | exact ExtraProvenanceMonotone.throw src _
+    | extern arity =>
+      simp only
+      cases arity with
+      | zero => exact ExtraProvenanceMonotone.pure src _
+      | succ arity =>
+        cases world <;> first
+          | exact ExtraProvenanceMonotone.pure src _
+          | exact ExtraProvenanceMonotone.throw src _
+
+theorem lowerE_lam_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hlam : LowerLamExtraMonotone src fuel)
+    (input : VEnv) (world : Owned) (uses : Uses)
+    (body : IxIR0.Expr) :
+    ExtraMonotone
+      (lowerE src (fuel + 1) input world (.lam uses body)) := by
+  cases world with
+  | unique =>
+    simp only [lowerE]
+    exact ExtraMonotone.throw _
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    intro initial final result hrun
+    apply hlam input (.lam uses body)
+    simpa only [lowerE, hsuEq, Bool.false_eq_true, if_false] using hrun
+
+theorem lowerE_lam_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hlam : LowerLamExtraProvenance src fuel)
+    (input : VEnv) (world : Owned) (uses : Uses)
+    (body : IxIR0.Expr) :
+    ExtraProvenanceMonotone src
+      (lowerE src (fuel + 1) input world (.lam uses body)) := by
+  cases world with
+  | unique =>
+    simp only [lowerE]
+    exact ExtraProvenanceMonotone.throw src _
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    intro initial final result hrun
+    apply hlam input (.lam uses body) (by simp [lamArity])
+    simpa only [lowerE, hsuEq, Bool.false_eq_true, if_false] using hrun
+
+theorem lowerE_proj_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowExtraMonotone src fuel)
+    (input : VEnv) (world : Owned) (index : Nat)
+    (source : IxIR0.Expr) :
+    ExtraMonotone
+      (lowerE src (fuel + 1) input world (.proj index source)) := by
+  cases world with
+  | unique =>
+    simp only [lowerE]
+    exact ExtraMonotone.throw _
+  | shared =>
+    simp only [lowerE]
+    apply ExtraMonotone.bind (hborrow input source)
+    intro borrowResult
+    rcases borrowResult with ⟨output, emit, value, release⟩
+    cases value with
+    | slotA abs => cases release <;> exact ExtraMonotone.pure _
+    | constA atom => cases atom <;> exact ExtraMonotone.pure _
+
+theorem lowerE_proj_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowExtraProvenance src fuel)
+    (input : VEnv) (world : Owned) (index : Nat)
+    (source : IxIR0.Expr) :
+    ExtraProvenanceMonotone src
+      (lowerE src (fuel + 1) input world (.proj index source)) := by
+  cases world with
+  | unique =>
+    simp only [lowerE]
+    exact ExtraProvenanceMonotone.throw src _
+  | shared =>
+    simp only [lowerE]
+    apply ExtraProvenanceMonotone.bind (hborrow input source)
+    intro borrowResult
+    rcases borrowResult with ⟨output, emit, value, release⟩
+    cases value with
+    | slotA abs =>
+      cases release <;> exact ExtraProvenanceMonotone.pure src _
+    | constA atom =>
+      cases atom <;> exact ExtraProvenanceMonotone.pure src _
+
+theorem lowerE_let_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    (input : VEnv) (world : Owned) (uses : Uses)
+    (value body : IxIR0.Expr) :
+    ExtraMonotone
+      (lowerE src (fuel + 1) input world (.letE uses value body)) := by
+  simp only [lowerE]
+  apply ExtraMonotone.bind (hexpr input (worldOfUses uses) value)
+  intro valueResult
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · simp only [hzero, beq_self_eq_true, if_true]
+      cases uses with
+      | erased => exact ExtraMonotone.throwBind _ _
+      | linear => exact ExtraMonotone.throwBind _ _
+      | affine =>
+        apply ExtraMonotone.bind (ExtraMonotone.pure _)
+        intro releaseEmit
+        apply ExtraMonotone.bind (hexpr _ world body)
+        intro bodyResult
+        rcases bodyResult with ⟨output, bodyEmit, result⟩
+        exact ExtraMonotone.pure
+          (output.pop, valueEmit ∘ releaseEmit ∘ bodyEmit, result)
+      | many =>
+        apply ExtraMonotone.bind (ExtraMonotone.pure _)
+        intro releaseEmit
+        apply ExtraMonotone.bind (hexpr _ world body)
+        intro bodyResult
+        rcases bodyResult with ⟨output, bodyEmit, result⟩
+        exact ExtraMonotone.pure
+          (output.pop, valueEmit ∘ releaseEmit ∘ bodyEmit, result)
+    · simp [hzero]
+      apply ExtraMonotone.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact ExtraMonotone.pure
+        (output.pop, valueEmit ∘ bodyEmit, result)
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · simp only [hzero, beq_self_eq_true, if_true]
+      apply ExtraMonotone.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact ExtraMonotone.pure
+        (output.pop,
+          valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit, result)
+    · simp [hzero]
+      apply ExtraMonotone.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact ExtraMonotone.pure
+        (output.pop,
+          valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit, result)
+
+theorem lowerE_let_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    (input : VEnv) (world : Owned) (uses : Uses)
+    (value body : IxIR0.Expr) :
+    ExtraProvenanceMonotone src
+      (lowerE src (fuel + 1) input world (.letE uses value body)) := by
+  simp only [lowerE]
+  apply ExtraProvenanceMonotone.bind (hexpr input (worldOfUses uses) value)
+  intro valueResult
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · simp only [hzero, beq_self_eq_true, if_true]
+      cases uses with
+      | erased => exact ExtraProvenanceMonotone.throwBind src _ _
+      | linear => exact ExtraProvenanceMonotone.throwBind src _ _
+      | affine =>
+        apply ExtraProvenanceMonotone.bind
+          (ExtraProvenanceMonotone.pure src _)
+        intro releaseEmit
+        apply ExtraProvenanceMonotone.bind (hexpr _ world body)
+        intro bodyResult
+        rcases bodyResult with ⟨output, bodyEmit, result⟩
+        exact ExtraProvenanceMonotone.pure src
+          (output.pop, valueEmit ∘ releaseEmit ∘ bodyEmit, result)
+      | many =>
+        apply ExtraProvenanceMonotone.bind
+          (ExtraProvenanceMonotone.pure src _)
+        intro releaseEmit
+        apply ExtraProvenanceMonotone.bind (hexpr _ world body)
+        intro bodyResult
+        rcases bodyResult with ⟨output, bodyEmit, result⟩
+        exact ExtraProvenanceMonotone.pure src
+          (output.pop, valueEmit ∘ releaseEmit ∘ bodyEmit, result)
+    · simp [hzero]
+      apply ExtraProvenanceMonotone.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact ExtraProvenanceMonotone.pure src
+        (output.pop, valueEmit ∘ bodyEmit, result)
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · simp only [hzero, beq_self_eq_true, if_true]
+      apply ExtraProvenanceMonotone.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact ExtraProvenanceMonotone.pure src
+        (output.pop,
+          valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit, result)
+    · simp [hzero]
+      apply ExtraProvenanceMonotone.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact ExtraProvenanceMonotone.pure src
+        (output.pop,
+          valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit, result)
+
+theorem lowerEExtraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    (hspine : LowerSpineExtraMonotone src fuel)
+    (hborrow : LowerBorrowExtraMonotone src fuel)
+    (hlam : LowerLamExtraMonotone src fuel) :
+    LowerEExtraMonotone src (fuel + 1) := by
+  intro input world expr
+  cases expr with
+  | var index => exact (lowerE_var_extraMonotone
+      src fuel input world index)
+  | ref address => exact (lowerE_ref_extraMonotone
+      src fuel input world address)
+  | lit literal =>
+    simp only [lowerE]
+    exact ExtraMonotone.pure _
+  | erased =>
+    simp only [lowerE]
+    exact ExtraMonotone.pure _
+  | lam uses body => exact (lowerE_lam_extraMonotone
+      hlam input world uses body)
+  | letE uses value body => exact (lowerE_let_extraMonotone
+      hexpr input world uses value body)
+  | app function argument =>
+    simp only [lowerE]
+    exact hspine input world function [argument]
+  | proj index source => exact (lowerE_proj_extraMonotone
+      hborrow input world index source)
+
+theorem lowerEExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    (hspine : LowerSpineExtraProvenance src fuel)
+    (hborrow : LowerBorrowExtraProvenance src fuel)
+    (hlam : LowerLamExtraProvenance src fuel) :
+    LowerEExtraProvenance src (fuel + 1) := by
+  intro input world expr
+  cases expr with
+  | var index => exact (lowerE_var_extraProvenance
+      src fuel input world index)
+  | ref address => exact (lowerE_ref_extraProvenance
+      src fuel input world address)
+  | lit literal =>
+    simp only [lowerE]
+    exact ExtraProvenanceMonotone.pure src _
+  | erased =>
+    simp only [lowerE]
+    exact ExtraProvenanceMonotone.pure src _
+  | lam uses body => exact (lowerE_lam_extraProvenance
+      hlam input world uses body)
+  | letE uses value body => exact (lowerE_let_extraProvenance
+      hexpr input world uses value body)
+  | app function argument =>
+    simp only [lowerE]
+    exact hspine input world function [argument]
+  | proj index source => exact (lowerE_proj_extraProvenance
+      hborrow input world index source)
+
+theorem lowerSpine_dynamic_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    (hrest : ApplyRestExtraMonotone src fuel)
+    (input : VEnv) (world : Owned) (head : IxIR0.Expr)
+    (args : List IxIR0.Expr) :
+    ExtraMonotone (do
+      let (output, emit, function) ← lowerE src fuel input .shared head
+      applyRest src fuel output world emit function args) := by
+  apply ExtraMonotone.bind (hexpr input .shared head)
+  intro headResult
+  rcases headResult with ⟨output, emit, function⟩
+  exact hrest output world emit function args
+
+theorem lowerSpine_var_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    (hknown : KnownCallExtraMonotone src fuel)
+    (hrest : ApplyRestExtraMonotone src fuel)
+    (input : VEnv) (world : Owned) (index : Nat)
+    (args : List IxIR0.Expr) :
+    ExtraMonotone
+      (lowerSpine src (fuel + 1) input world (.var index) args) := by
+  simp only [lowerSpine]
+  cases hentry : input.entries[index]? with
+  | none =>
+    simp only
+    exact lowerSpine_dynamic_extraMonotone
+      hexpr hrest input world (.var index) args
+  | some entry =>
+    cases entry with
+    | slot abs remaining uses held =>
+      simp only
+      exact lowerSpine_dynamic_extraMonotone
+        hexpr hrest input world (.var index) args
+    | recSelf arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        exact ExtraMonotone.throw _
+      · simp only [if_neg hunder]
+        apply ExtraMonotone.bind
+          (requireResultWorld_extraMonotone .shared world)
+        intro unitValue
+        cases unitValue
+        exact hknown input (.callSelf ·) arity
+          (List.replicate arity .shared) world args
+
+theorem lowerSpine_ref_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hknown : KnownCallExtraMonotone src fuel)
+    (input : VEnv) (world : Owned) (address : Ixon.Address)
+    (args : List IxIR0.Expr) :
+    ExtraMonotone
+      (lowerSpine src (fuel + 1) input world (.ref address) args) := by
+  simp only [lowerSpine]
+  cases hsource : src address with
+  | none =>
+    simp only
+    exact ExtraMonotone.throw _
+  | some decl =>
+    cases decl with
+    | defn result body =>
+      simp only
+      by_cases hunder : args.length < lamArity body
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraMonotone.throw _
+        | shared =>
+          cases result with
+          | unique => exact ExtraMonotone.throw _
+          | shared =>
+            cases hp : papSafe body with
+            | false => exact ExtraMonotone.throw _
+            | true =>
+              exact hknown input (.papp address ·) args.length
+                (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        apply ExtraMonotone.bind
+          (requireResultWorld_extraMonotone result
+            (if args.length == lamArity body then world else .shared))
+        intro unitValue
+        cases unitValue
+        exact hknown input (.call address ·) (lamArity body)
+          ((lamUses body).map worldOfUses) world args
+    | ctor tag arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraMonotone.throw _
+        | shared =>
+          apply ExtraMonotone.bind
+            (wrapperFor_extraMonotone address tag arity)
+          intro wrapper
+          exact hknown input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        exact hknown input (.alloc world (ctorIdOf address tag) ·) arity
+          (List.replicate arity world) world args
+    | recursor numArgs natLit rules =>
+      simp only
+      by_cases hunder : args.length < numArgs + 1
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraMonotone.throw _
+        | shared =>
+          exact hknown input (.papp address ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        apply ExtraMonotone.bind
+          (requireResultWorld_extraMonotone .shared world)
+        intro unitValue
+        cases unitValue
+        exact hknown input (.call address ·) (numArgs + 1)
+          (List.replicate (numArgs + 1) .shared) world args
+    | extern arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraMonotone.throw _
+        | shared =>
+          exact hknown input (.papp address ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        exact hknown input (.extern address ·) arity
+          (List.replicate arity .shared) world args
+
+theorem lowerSpineExtraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    (hspine : LowerSpineExtraMonotone src fuel)
+    (hknown : KnownCallExtraMonotone src fuel)
+    (hrest : ApplyRestExtraMonotone src fuel) :
+    LowerSpineExtraMonotone src (fuel + 1) := by
+  intro input world head args
+  cases head with
+  | app function argument =>
+    simp only [lowerSpine]
+    exact hspine input world function (argument :: args)
+  | erased =>
+    simp only [lowerSpine]
+    exact hrest input world (_root_.id : Emit) (.constA .erased) args
+  | var index => exact (lowerSpine_var_extraMonotone
+      hexpr hknown hrest input world index args)
+  | ref address => exact (lowerSpine_ref_extraMonotone
+      hknown input world address args)
+  | lam uses body =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraMonotone
+      hexpr hrest input world (.lam uses body) args
+  | letE uses value body =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraMonotone
+      hexpr hrest input world (.letE uses value body) args
+  | proj index source =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraMonotone
+      hexpr hrest input world (.proj index source) args
+  | lit literal =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraMonotone
+      hexpr hrest input world (.lit literal) args
+
+theorem lowerSpine_dynamic_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    (hrest : ApplyRestExtraProvenance src fuel)
+    (input : VEnv) (world : Owned) (head : IxIR0.Expr)
+    (args : List IxIR0.Expr) :
+    ExtraProvenanceMonotone src (do
+      let (output, emit, function) ← lowerE src fuel input .shared head
+      applyRest src fuel output world emit function args) := by
+  apply ExtraProvenanceMonotone.bind (hexpr input .shared head)
+  intro headResult
+  rcases headResult with ⟨output, emit, function⟩
+  exact hrest output world emit function args
+
+theorem lowerSpine_var_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    (hknown : KnownCallExtraProvenance src fuel)
+    (hrest : ApplyRestExtraProvenance src fuel)
+    (input : VEnv) (world : Owned) (index : Nat)
+    (args : List IxIR0.Expr) :
+    ExtraProvenanceMonotone src
+      (lowerSpine src (fuel + 1) input world (.var index) args) := by
+  simp only [lowerSpine]
+  cases hentry : input.entries[index]? with
+  | none =>
+    simp only
+    exact lowerSpine_dynamic_extraProvenance
+      hexpr hrest input world (.var index) args
+  | some entry =>
+    cases entry with
+    | slot abs remaining uses held =>
+      simp only
+      exact lowerSpine_dynamic_extraProvenance
+        hexpr hrest input world (.var index) args
+    | recSelf arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        exact ExtraProvenanceMonotone.throw src _
+      · simp only [if_neg hunder]
+        apply ExtraProvenanceMonotone.bind
+          (requireResultWorld_extraProvenance src .shared world)
+        intro unitValue
+        cases unitValue
+        exact hknown input (.callSelf ·) arity
+          (List.replicate arity .shared) world args
+
+theorem lowerSpine_ref_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hknown : KnownCallExtraProvenance src fuel)
+    (input : VEnv) (world : Owned) (address : Ixon.Address)
+    (args : List IxIR0.Expr) :
+    ExtraProvenanceMonotone src
+      (lowerSpine src (fuel + 1) input world (.ref address) args) := by
+  simp only [lowerSpine]
+  cases hsource : src address with
+  | none =>
+    simp only
+    exact ExtraProvenanceMonotone.throw src _
+  | some decl =>
+    cases decl with
+    | defn result body =>
+      simp only
+      by_cases hunder : args.length < lamArity body
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraProvenanceMonotone.throw src _
+        | shared =>
+          cases result with
+          | unique => exact ExtraProvenanceMonotone.throw src _
+          | shared =>
+            cases hp : papSafe body with
+            | false => exact ExtraProvenanceMonotone.throw src _
+            | true =>
+              exact hknown input (.papp address ·) args.length
+                (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        apply ExtraProvenanceMonotone.bind
+          (requireResultWorld_extraProvenance src result
+            (if args.length == lamArity body then world else .shared))
+        intro unitValue
+        cases unitValue
+        exact hknown input (.call address ·) (lamArity body)
+          ((lamUses body).map worldOfUses) world args
+    | ctor tag arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraProvenanceMonotone.throw src _
+        | shared =>
+          apply ExtraProvenanceMonotone.bind
+            (wrapperFor_extraProvenance src address tag arity)
+          intro wrapper
+          exact hknown input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        exact hknown input (.alloc world (ctorIdOf address tag) ·) arity
+          (List.replicate arity world) world args
+    | recursor numArgs natLit rules =>
+      simp only
+      by_cases hunder : args.length < numArgs + 1
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraProvenanceMonotone.throw src _
+        | shared =>
+          exact hknown input (.papp address ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        apply ExtraProvenanceMonotone.bind
+          (requireResultWorld_extraProvenance src .shared world)
+        intro unitValue
+        cases unitValue
+        exact hknown input (.call address ·) (numArgs + 1)
+          (List.replicate (numArgs + 1) .shared) world args
+    | extern arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact ExtraProvenanceMonotone.throw src _
+        | shared =>
+          exact hknown input (.papp address ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        exact hknown input (.extern address ·) arity
+          (List.replicate arity .shared) world args
+
+theorem lowerSpineExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    (hspine : LowerSpineExtraProvenance src fuel)
+    (hknown : KnownCallExtraProvenance src fuel)
+    (hrest : ApplyRestExtraProvenance src fuel) :
+    LowerSpineExtraProvenance src (fuel + 1) := by
+  intro input world head args
+  cases head with
+  | app function argument =>
+    simp only [lowerSpine]
+    exact hspine input world function (argument :: args)
+  | erased =>
+    simp only [lowerSpine]
+    exact hrest input world (_root_.id : Emit) (.constA .erased) args
+  | var index => exact (lowerSpine_var_extraProvenance
+      hexpr hknown hrest input world index args)
+  | ref address => exact (lowerSpine_ref_extraProvenance
+      hknown input world address args)
+  | lam uses body =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraProvenance
+      hexpr hrest input world (.lam uses body) args
+  | letE uses value body =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraProvenance
+      hexpr hrest input world (.letE uses value body) args
+  | proj index source =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraProvenance
+      hexpr hrest input world (.proj index source) args
+  | lit literal =>
+    simp only [lowerSpine]
+    exact lowerSpine_dynamic_extraProvenance
+      hexpr hrest input world (.lit literal) args
+
+/-- Result-polymorphic operational classification of one successful lambda
+capture.  Missing, recursive, released, and unique entries plus capture
+overcounts are rejected once here; shared retain/move output reconstruction
+is exposed to judgment-specific callbacks. -/
+theorem lowerCapture_run_core
+    {e : IxIR0.Expr} {input output : VEnv} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {Result : VEnv → Emit → AVal → Prop}
+    (hretain : ∀ {abs remaining : Nat} {uses : Uses},
+      worldOfUses uses = .shared →
+      input.entries[i]? = some (.slot abs remaining uses true) →
+      let next := input.setEntry i
+        (.slot abs (remaining - countUses i e) uses true)
+      Result next.bump (emitOp (.dup (.var (next.rel abs))))
+        (.slotA next.depth))
+    (hmove : ∀ {abs remaining : Nat} {uses : Uses},
+      worldOfUses uses = .shared →
+      input.entries[i]? = some (.slot abs remaining uses true) →
+      let next := input.setEntry i (.slot abs 0 uses false)
+      Result next (_root_.id : Emit) (.slotA abs))
+    (hrun : (lowerCapture e input i).run state =
+      .ok (output, emit, av) finalState) :
+    Result output emit av := by
+  cases hentry : input.entries[i]? with
+  | none =>
+    exact (estateThrowRun_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (estateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (estateThrowRun_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          exact (estateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have hshared : worldOfUses uses = .shared := by
+            cases uses <;> simp_all [worldOfUses]
+          have huniqueEq :
+              (worldOfUses uses == Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses i e
+          · let next := input.setEntry i
+                (.slot abs (remaining - countUses i e) uses true)
+            have hpure :
+                (next.bump, emitOp (.dup (.var (next.rel abs))),
+                    AVal.slotA next.depth) = (output, emit, av) ∧
+                  state = finalState := by
+              simpa [lowerCapture, hentry, huniqueEq, hmore, next]
+                using hrun
+            obtain ⟨hresult, hstate⟩ := hpure
+            cases hresult
+            subst finalState
+            exact hretain hshared hentry
+          · by_cases hequal : remaining = countUses i e
+            · let next := input.setEntry i (.slot abs 0 uses false)
+              have hpure :
+                  (next, (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, av) ∧ state = finalState := by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal,
+                  next] using hrun
+              obtain ⟨hresult, hstate⟩ := hpure
+              have houtput : next = output :=
+                congrArg (fun p : VEnv × Emit × AVal => p.1) hresult
+              have hemit : (_root_.id : Emit) = emit :=
+                congrArg (fun p : VEnv × Emit × AVal => p.2.1) hresult
+              have hvalue : AVal.slotA abs = av :=
+                congrArg (fun p : VEnv × Emit × AVal => p.2.2) hresult
+              subst output
+              subst emit
+              subst av
+              subst finalState
+              exact hmove hshared hentry
+            · exact (estateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+/-- Every successful one-capture compiler step transfers one shared owner:
+it retains into a fresh slot when later source uses remain, and otherwise
+moves the existing slot owner. Unique/released/recursive entries and capture
+overcounts cannot produce a successful run. -/
+theorem lowerCapture_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {e : IxIR0.Expr} {input output : VEnv} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerCapture e input i).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultSoundBelow ctx cur limit input output .shared emit av := by
+  apply lowerCapture_run_core
+    (Result := fun output emit av =>
+      LowerResultSoundBelow ctx cur limit input output .shared emit av)
+    (hrun := hrun)
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry i
+      (.slot abs (remaining - countUses i e) uses true)
+    have hsound := lower_held_retain_sound_below
+      (ctx := ctx) (cur := cur) (limit := limit)
+      (newRemaining := remaining - countUses i e) hshared hentry
+    simpa [next] using hsound
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry i (.slot abs 0 uses false)
+    have hsound := lower_held_move_sound_below
+      (ctx := ctx) (cur := cur) (limit := limit) hentry
+    simpa [next, hshared] using hsound
+private theorem lowerCapture_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {e : IxIR0.Expr} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerCapture e input i).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  apply lowerCapture_run_core
+    (Result := fun output emit av =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv sourceValue .shared emit av)
+    (hrun := hrun)
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry i
+      (.slot abs (remaining - countUses i e) uses true)
+    have hsound := lower_held_retain_value_sound_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit)
+      (newRemaining := remaining - countUses i e)
+      hsource hshared hentry
+    simpa [next] using hsound
+  · intro abs remaining uses hshared hentry
+    let next := input.setEntry i (.slot abs 0 uses false)
+    have hsound := lower_held_move_value_sound_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) hsource hentry
+    simpa [next, hshared] using hsound
+/-- Semantic one-capture compiler step. A successful capture selects the
+source value at the same de Bruijn index and either moves or retains its
+related shared root according to the compiler's remaining-use test. -/
+theorem lowerCapture_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {e : IxIR0.Expr} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerCapture e input i).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerCapture_run_value_sound_at (limit := limit) hsource hrun
+
+/-- Fuel-bounded semantic one-capture step. -/
+theorem lowerCapture_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {e : IxIR0.Expr} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerCapture e input i).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  exact lowerCapture_run_value_sound_at hsource hrun
+
+/-- The structurally recursive capture traversal is a homogeneous shared
+argument prefix. This is exactly the input expected by the existing verified
+`papp` allocation rule. -/
+theorem lowerCaptures_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (e : IxIR0.Expr) (caps : List Nat)
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate caps.length .shared) emit values := by
+  apply lowerCaptures_run_core
+    (Result := fun input output caps emit values =>
+      LowerArgsSoundBelow ctx cur limit input output
+        (List.replicate caps.length .shared) emit values)
+    (e := e) (hrun := hrun)
+  · intro input
+    exact lowerArgs_nil_sound_below
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail
+    have hhead := lowerCapture_run_sound_below
+      (ctx := ctx) (cur := cur) (limit := limit) hheadRun
+    simpa [List.replicate_succ] using hhead.consArgs htail
+
+/-- Source-aligned adapter over the source-neutral successful-capture
+traversal.  It consumes the `ValuesAt` witness in lockstep with the raw
+capture indices; clients supply only the empty judgment and semantic
+composition for one successful `lowerCapture`. -/
+theorem ValuesAt.lowerCaptures_core
+    (e : IxIR0.Expr) {sourceEnv : List IxIR0.Value}
+    {Result : VEnv → VEnv → List Nat → List IxIR0.Value →
+      Emit → List AVal → Prop}
+    (hnil : ∀ input, Result input input [] [] (_root_.id : Emit) [])
+    (hcons : ∀ {index : Nat} {sourceValue : IxIR0.Value}
+        {rest : List Nat} {sourceValues : List IxIR0.Value}
+        {input middle output : VEnv} {headEmit tailEmit : Emit}
+        {headValue : AVal} {tailValues : List AVal}
+        {state middleState : LowSt},
+      sourceEnv[index]? = some sourceValue →
+      (lowerCapture e input index).run state =
+        .ok (middle, headEmit, headValue) middleState →
+      Result middle output rest sourceValues tailEmit tailValues →
+      Result input output (index :: rest) (sourceValue :: sourceValues)
+        (headEmit ∘ tailEmit) (headValue :: tailValues))
+    {caps : List Nat} {sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv caps sourceValues)
+    (hrun : (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState) :
+    Result input output caps sourceValues emit values := by
+  refine (lowerCaptures_run_core
+    (Result := fun input output caps emit values =>
+      ∀ {selected}, ValuesAt sourceEnv caps selected →
+        Result input output caps selected emit values)
+    (e := e) (hrun := hrun) ?_ ?_) hselected
+  · intro input selected hselected
+    cases hselected
+    exact hnil input
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail selected hselected
+    cases hselected with
+    | cons hsource htailSelected =>
+        exact hcons hsource hheadRun (htail htailSelected)
+
+private theorem lowerCaptures_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (e : IxIR0.Expr) (caps : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv caps sourceValues)
+    (hrun : (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate caps.length .shared) emit values := by
+  apply ValuesAt.lowerCaptures_core
+    (e := e) (hselected := hselected) (hrun := hrun)
+  · intro input
+    exact lowerArgs_nil_value_sound_below
+  · intro index sourceValue rest sourceValues input middle output
+      headEmit tailEmit headValue tailValues state middleState
+      hsource hheadRun htail
+    have hhead := lowerCapture_run_value_sound_at
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) hsource hheadRun
+    simpa [List.replicate_succ] using hhead.consArgs htail
+
+/-- Semantic capture traversal. The returned pap arguments realize exactly
+the selected source-environment values, in the compiler's capture order. -/
+theorem lowerCaptures_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    (e : IxIR0.Expr) (caps : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv caps sourceValues)
+    (hrun : (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate caps.length .shared) emit values := by
+  exact LowerArgsValueSound.of_below fun limit =>
+    lowerCaptures_run_value_sound_at (limit := limit)
+      e caps hselected hrun
+
+/-- Fuel-bounded semantic capture traversal. -/
+theorem lowerCaptures_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (e : IxIR0.Expr) (caps : List Nat)
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {input output : VEnv} {emit : Emit} {values : List AVal}
+    {state finalState : LowSt}
+    (hselected : ValuesAt sourceEnv caps sourceValues)
+    (hrun : (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState) :
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues
+      (List.replicate caps.length .shared) emit values := by
+  exact lowerCaptures_run_value_sound_at e caps hselected hrun
+
+/-- Successful capture lowering preserves the statically selected capture
+count. Besides documenting the shape of `lowerCaptures`, this lets the
+ownership proof index its homogeneous shared prefix by the returned values,
+as required by the verified `papp` rule. -/
+theorem lowerCaptures_success_length (e : IxIR0.Expr) :
+    ∀ {caps : List Nat} {input output : VEnv} {emit : Emit}
+      {values : List AVal} {state finalState : LowSt},
+    (lowerCaptures e input caps).run state =
+      .ok (output, emit, values) finalState →
+    values.length = caps.length := by
+  intro caps input output emit values state finalState hrun
+  apply lowerCaptures_run_core
+    (Result := fun _ _ caps _ values =>
+      values.length = caps.length)
+    (e := e) (hrun := hrun)
+  · intro input
+    rfl
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail
+    simpa using congrArg Nat.succ htail
+
+/-- Result-polymorphic operational inversion for successful local-lambda
+lowering. Fuel and pap-safety rejection, capture/fresh/body bind inversion,
+the generated-declaration push, and final pap-result reconstruction are
+performed once; ownership and graph judgments consume the canonical runs
+and exact predecessor-fuel equality through `hsuccess`. -/
+theorem lowerLam_run_core
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {e : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    {Result : LowSt → VEnv → Emit → AVal → Prop}
+    (hsuccess : ∀ {bodyFuel : Nat}
+        {captureOutput : VEnv} {captureEmit : Emit}
+        {captureValues : List AVal} {captureState : LowSt}
+        {fnAddr : Ixon.Address} {addressState : LowSt}
+        {code : Code} {bodyState : LowSt},
+      bodyFuel + 1 = fuel →
+      papSafe e = true →
+      (lowerCaptures e input
+          (liftCaptureIndices input.entries.length e)).run state =
+        .ok (captureOutput, captureEmit, captureValues) captureState →
+      freshAddr.run captureState = .ok fnAddr addressState →
+      (lowerFnBody src bodyFuel
+          (liftedBodyVEnv input.entries.length e)
+          (liftedBodyDrops input.entries.length e) .shared
+          (stripLams e)).run addressState = .ok code bodyState →
+      Result
+        { bodyState with
+          extra := (fnAddr, .fn
+            ⟨(liftCaptureIndices input.entries.length e).length +
+                lamArity e,
+              .shared, true, code⟩) :: bodyState.extra }
+        captureOutput.bump
+        (captureEmit ∘ emitOp (.papp fnAddr
+          (captureValues.map (·.toAtom captureOutput)).toArray))
+        (.slotA captureOutput.depth))
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    Result finalState output emit av := by
+  cases fuel with
+  | zero =>
+    simp [lowerLam] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ bodyFuel =>
+    cases hp : papSafe e with
+    | false =>
+      simp [lowerLam, hp] at hrun
+    | true =>
+      simp only [lowerLam] at hrun
+      simp only [hp, ↓reduceIte, bind_pure_comp] at hrun
+      let caps := liftCaptureIndices input.entries.length e
+      have hcaps : caps = (List.range input.entries.length).filter
+          (fun index => countUses index e > 0) := by
+        rfl
+      rw [← hcaps] at hrun
+      obtain ⟨captureResult, captureState, hcaptureRun, hafterCapture⟩ :=
+        estateBindRun_ok_inv hrun
+      rcases captureResult with ⟨captureOutput, captureEmit, captureValues⟩
+      dsimp only at hafterCapture
+      obtain ⟨fnAddr, addressState, hfreshRun, hafterFresh⟩ :=
+        estateBindRun_ok_inv hafterCapture
+      obtain ⟨code, bodyState, hbodyRun, hafterBody⟩ :=
+        estateBindRun_ok_inv hafterFresh
+      change
+        (pushExtra
+            (fnAddr, .fn
+              ⟨caps.length + lamArity e, .shared, true, code⟩) >>= fun _ =>
+          pure (captureOutput.bump,
+            captureEmit ∘ emitOp (.papp fnAddr
+              (captureValues.map (·.toAtom captureOutput)).toArray),
+            .slotA captureOutput.depth)).run bodyState =
+          .ok (output, emit, av) finalState at hafterBody
+      obtain ⟨unitValue, pushedState, hpushRun, hpureRun⟩ :=
+        estateBindRun_ok_inv hafterBody
+      cases unitValue
+      have hpure :
+          (captureOutput.bump,
+              captureEmit ∘ emitOp (.papp fnAddr
+                (captureValues.map (·.toAtom captureOutput)).toArray),
+              AVal.slotA captureOutput.depth) =
+              (output, emit, av) ∧
+            pushedState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hresult, hstate⟩ := hpure
+      have hentryCount : captureOutput.entries.length =
+          input.entries.length :=
+        lowerCaptures_preservesEntryCount e hcaptureRun
+      have hbodyRun' := hbodyRun
+      rw [hentryCount] at hbodyRun'
+      have hcanonicalBody :
+          (lowerFnBody src bodyFuel
+              (liftedBodyVEnv input.entries.length e)
+              (liftedBodyDrops input.entries.length e) .shared
+              (stripLams e)).run addressState = .ok code bodyState := by
+        simpa [liftedBodyVEnv, liftedBodyDrops, liftCaptureIndices,
+          caps] using hbodyRun'
+      cases hresult
+      subst finalState
+      simp [pushExtra] at hpushRun
+      subst pushedState
+      simpa [caps] using
+        (hsuccess (by simp) hp (by simpa [caps] using hcaptureRun)
+          hfreshRun hcanonicalBody)
+
+/-- A successful positive-arity lambda run preserves nested provenance from
+its body and records the exact body-lowering witness for its own prepend. -/
+theorem lowerLam_extraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hfn : LowerFnBodyExtraProvenance src fuel)
+    (input : VEnv) (e : IxIR0.Expr) (hpositive : 0 < lamArity e) :
+    ExtraProvenanceMonotone src (lowerLam src (fuel + 1) input e) := by
+  intro state finalState result hrun
+  rcases result with ⟨output, emit, value⟩
+  apply lowerLam_run_core
+    (Result := fun finalState _ _ _ =>
+      ExtraProvenanceExtends src state finalState)
+    (hrun := hrun)
+  intro bodyFuel captureOutput captureEmit captureValues captureState
+    fnAddr addressState code bodyState hfuel hsafe hcaptureRun hfreshRun
+    hbodyRun
+  have hbodyFuel : bodyFuel = fuel := by omega
+  subst bodyFuel
+  have hcaptures := lowerCaptures_extraProvenance src e input
+    (liftCaptureIndices input.entries.length e) hcaptureRun
+  have hfresh := freshAddr_extraProvenance src hfreshRun
+  have hbody := hfn
+    (liftedBodyVEnv input.entries.length e)
+    (liftedBodyDrops input.entries.length e) .shared (stripLams e) hbodyRun
+  let d : FnDef :=
+    ⟨(liftCaptureIndices input.entries.length e).length + lamArity e,
+      .shared, true, code⟩
+  let pushed : LowSt :=
+    { bodyState with extra := (fnAddr, .fn d) :: bodyState.extra }
+  have hextends : ExtraExtends bodyState pushed := by
+    refine ⟨[(fnAddr, .fn d)], [], ?_, ?_, ?_⟩
+    · simp [pushed]
+    · simp [pushed]
+    · simp
+  have hpushed : ExtraProvenanceExtends src bodyState pushed := by
+    refine ⟨hextends, ?_⟩
+    intro item hmember
+    change item ∈ (fnAddr, .fn d) :: bodyState.extra at hmember
+    rw [List.mem_cons] at hmember
+    cases hmember with
+    | inr hold => exact Or.inl hold
+    | inl hnew =>
+      subst item
+      exact Or.inr (Or.inr
+        ⟨fnAddr, input.entries.length, e, fuel, addressState,
+          bodyState, code, rfl, hpositive, hsafe, hbodyRun, hextends,
+          by simp [pushed, d]⟩)
+  simpa [pushed, d] using
+    ((hcaptures.trans hfresh).trans hbody).trans hpushed
+
+/-- Judgment-polymorphic semantic assembly for successful local-lambda
+lowering. Canonical capture identity, lifted-code provenance, selected source
+captures, represented-declaration recovery, function relation construction,
+and the strict pap-prefix bound are established once. Callbacks supply only
+the capture-argument judgment and its pap closure, allowing soundness,
+progress, and profile proofs to share the same semantic spine. -/
+theorem lowerLam_run_value_core
+    {funRel : Sim.FunctionRel} {ctx : Ctx} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {e : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {ArgsResult : List IxIR0.Value → VEnv → Emit → List AVal → Prop}
+    {Result : LowSt → VEnv → Emit → AVal → Prop}
+    (hcapture : ∀ {caps : List Nat} {selected : List IxIR0.Value}
+        {captureOutput : VEnv} {captureEmit : Emit}
+        {captureValues : List AVal} {captureState : LowSt},
+      caps = liftCaptureIndices input.entries.length e →
+      ValuesAt sourceEnv caps selected →
+      (lowerCaptures e input caps).run state =
+        .ok (captureOutput, captureEmit, captureValues) captureState →
+      captureValues.length = caps.length →
+      ArgsResult selected captureOutput captureEmit captureValues)
+    (hpapp : ∀ {caps : List Nat} {selected : List IxIR0.Value}
+        {captureOutput : VEnv} {captureEmit : Emit}
+        {captureValues : List AVal} {fnAddr : Ixon.Address}
+        {code : Code} {bodyState : LowSt},
+      caps = liftCaptureIndices input.entries.length e →
+      ArgsResult selected captureOutput captureEmit captureValues →
+      ctx.decls fnAddr = some (.fn
+        ⟨caps.length + lamArity e, .shared, true, code⟩) →
+      funRel sourceValue fnAddr
+        (caps.length + lamArity e) selected →
+      captureValues.length < caps.length + lamArity e →
+      Result
+        { bodyState with
+          extra := (fnAddr, .fn
+            ⟨caps.length + lamArity e, .shared, true, code⟩) ::
+              bodyState.extra }
+        captureOutput.bump
+        (captureEmit ∘ emitOp (.papp fnAddr
+          (captureValues.map (·.toAtom captureOutput)).toArray))
+        (.slotA captureOutput.depth))
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv e [] sourceValue)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    Result finalState output emit av := by
+  have hpositive : 0 < lamArity e := by
+    have hunder := hprefix.length_lt_lamArity
+    simpa using hunder
+  refine lowerLam_run_core
+    (Result := fun finalState output emit av =>
+      (∀ value address arity captures,
+        CompilerLiftedFunctionRel src finalState value address arity captures →
+        funRel value address arity captures) →
+      ExtraRepresented ctx finalState →
+      Result finalState output emit av)
+    ?_ hrun hinclude hrepresented
+  intro bodyFuel captureOutput captureEmit captureValues _captureState
+    fnAddr addressState code bodyState _hfuel hp hcaptureRun _hfreshRun hbodyRun
+    hinclude hrepresented
+  let caps := liftCaptureIndices input.entries.length e
+  let ambient : LowSt :=
+    { bodyState with
+      extra := (fnAddr, .fn
+        ⟨caps.length + lamArity e, .shared, true, code⟩) :: bodyState.extra }
+  change (lowerCaptures e input caps).run state =
+    .ok (captureOutput, captureEmit, captureValues) _ at hcaptureRun
+  change (∀ value address arity captures,
+    CompilerLiftedFunctionRel src ambient value address arity captures →
+    funRel value address arity captures) at hinclude
+  change ExtraRepresented ctx ambient at hrepresented
+  have hdecl : ctx.decls fnAddr = some (.fn
+      ⟨caps.length + lamArity e, .shared, true, code⟩) := by
+    apply hrepresented.decl
+    simp [ambient]
+  have hliftCode : CompilerLiftCodeRel src ambient fnAddr
+      input.entries.length e := by
+    refine ⟨bodyFuel, addressState, bodyState, code, hp, hbodyRun, ?_, ?_⟩
+    · refine ⟨[(fnAddr, .fn
+          ⟨caps.length + lamArity e, .shared, true, code⟩)], [], ?_, ?_, ?_⟩
+      · simp [ambient]
+      · simp [ambient]
+      · simp
+    · simp [ambient, caps]
+  obtain ⟨selected, hselected⟩ :=
+    ValuesAt.exists_liftCaptureIndices sourceEnv
+      input.entries.length e hsourceLength
+  have hselectedCaps : ValuesAt sourceEnv caps selected := by
+    simpa [caps] using hselected
+  have hselectedLength : selected.length = caps.length :=
+    hselectedCaps.length
+  have hlength := lowerCaptures_success_length e hcaptureRun
+  have hargs := hcapture rfl hselectedCaps hcaptureRun hlength
+  have hlifted : CompilerLiftedFunctionRel src ambient sourceValue
+      fnAddr (caps.length + lamArity e) selected := by
+    refine ⟨sourceEnv, e, selected, [], ?_, ?_, ?_, ?_, hprefix⟩
+    · simpa [hsourceLength] using hliftCode
+    · simpa [hsourceLength] using hselected
+    · simp
+    · simp [hselectedLength]
+  have hfun : funRel sourceValue fnAddr
+      (caps.length + lamArity e) selected :=
+    hinclude sourceValue fnAddr _ selected hlifted
+  have hunder : captureValues.length < caps.length + lamArity e := by
+    omega
+  change Result ambient captureOutput.bump
+    (captureEmit ∘ emitOp (.papp fnAddr
+      (captureValues.map (·.toAtom captureOutput)).toArray))
+    (.slotA captureOutput.depth)
+  exact hpapp rfl hargs hdecl hfun hunder
+
+/-- A successful local-lambda lowering consumes its captures as shared
+arguments and installs them in a fresh partial-application node. The nested
+lifted body may itself extend `LowSt`; only the final declaration-layout fact
+is needed for ownership of the allocation performed at the lambda site. -/
+theorem lowerLam_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {e : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hpositive : 0 < lamArity e)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultSoundBelow ctx cur limit input output .shared emit av := by
+  refine lowerLam_run_core
+    (Result := fun finalState output emit av =>
+      ExtraRepresented ctx finalState →
+      LowerResultSoundBelow ctx cur limit input output .shared emit av)
+    ?_ hrun hrepresented
+  intro _bodyFuel captureOutput captureEmit captureValues _captureState
+    fnAddr _addressState code _bodyState _hfuel _hp hcaptureRun _hfreshRun
+    _hbodyRun hrepresented
+  let caps := liftCaptureIndices input.entries.length e
+  change (lowerCaptures e input caps).run state =
+    .ok (captureOutput, captureEmit, captureValues) _ at hcaptureRun
+  have hdecl : ctx.decls fnAddr = some (.fn
+      ⟨caps.length + lamArity e, .shared, true, code⟩) := by
+    apply hrepresented.decl
+    simp [caps]
+  have hlength := lowerCaptures_success_length e hcaptureRun
+  have hcaptures := lowerCaptures_run_sound_below
+    (ctx := ctx) (cur := cur) (limit := limit) e caps hcaptureRun
+  have hargs : LowerArgsSoundBelow ctx cur limit input captureOutput
+      (List.replicate captureValues.length .shared)
+      captureEmit captureValues := by
+    simpa [hlength] using hcaptures
+  apply hargs.papp_owned hdecl
+  simp only [declArity]
+  omega
+
+private theorem lowerLam_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {e : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv e [] sourceValue)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  apply lowerLam_run_value_core
+    (ArgsResult := fun selected captureOutput captureEmit captureValues =>
+      LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+        input captureOutput sourceEnv sourceEnv selected
+        (List.replicate captureValues.length .shared)
+        captureEmit captureValues)
+    (Result := fun _ output emit av =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv sourceValue .shared emit av)
+    (hsourceLength := hsourceLength) (hprefix := hprefix)
+    (hinclude := hinclude) (hrepresented := hrepresented) (hrun := hrun)
+  · intro caps selected captureOutput captureEmit captureValues
+      _captureState _hcanonical hselected hcaptureRun hlength
+    have hcaptures := lowerCaptures_run_value_sound_at
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit)
+      e caps hselected hcaptureRun
+    simpa [hlength] using hcaptures
+  · intro _caps _selected _captureOutput _captureEmit _captureValues
+      _fnAddr _code _bodyState _hcanonical hargs hdecl hfun hunder
+    apply hargs.papp_graph hdecl
+    · simpa only [declArity] using hfun
+    · simpa only [declArity] using hunder
+
+/-- Semantic local-lambda lowering. The capture traversal constructs the
+selected source-value prefix, the exact generated body run establishes
+compiler provenance for the fresh address, and pap allocation yields a
+`ValueGraph` for the source closure. `hinclude` embeds this lifted-only
+relation into the whole-program function relation used by surrounding code. -/
+theorem lowerLam_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {e : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv e [] sourceValue)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerLam_run_value_sound_at (limit := limit) hsourceLength hprefix
+      hinclude hrepresented hrun
+
+/-- Fuel-bounded semantic local-lambda lowering. Generated-function
+provenance is fuel-independent; only capture sequencing and pap allocation
+use the bounded emitter interface. -/
+theorem lowerLam_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {e : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hprefix : LambdaPrefix sourceEnv e [] sourceValue)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue .shared emit av := by
+  exact lowerLam_run_value_sound_at hsourceLength hprefix hinclude
+    hrepresented hrun
+
+/-- Independently of semantic provenance, a successful `lowerLam` run ends
+by allocating a pap result in a fresh runtime slot. -/
+theorem lowerLam_run_result_slot
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {e : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerLam src fuel input e).run state =
+      .ok (output, emit, av) finalState) :
+    ∃ abs, av = .slotA abs := by
+  apply lowerLam_run_core
+    (Result := fun _ _ _ av => ∃ abs, av = .slotA abs)
+    (hrun := hrun)
+  intro _bodyFuel captureOutput _captureEmit _captureValues _captureState
+    _fnAddr _addressState _code _bodyState _hfuel _hp _hcaptureRun _hfreshRun
+    _hbodyRun
+  exact ⟨captureOutput.depth, rfl⟩
+
+theorem lowerE_lam_run_ne_constErased
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {uses : Uses} {body : IxIR0.Expr}
+    {emit : Emit} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, .constA .erased) finalState) :
+    False := by
+  cases world with
+  | unique =>
+    exact estateThrowRun_not_ok (by simpa [lowerE] using hrun)
+  | shared =>
+    have hlam : (lowerLam src fuel input (.lam uses body)).run state =
+        .ok (output, emit, .constA .erased) finalState := by
+      simpa [lowerE] using hrun
+    obtain ⟨abs, hav⟩ := lowerLam_run_result_slot hlam
+    contradiction
+
+/-- The lambda branch of `lowerE`: unique demand cannot succeed, while a
+shared demand delegates to the verified capture-and-`papp` lowering above. -/
+theorem lowerE_lam_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [lowerE, huuEq] using hrun
+  | shared =>
+    have hlam : (lowerLam src fuel input (.lam uses body)).run state =
+        .ok (output, emit, av) finalState := by
+      simpa [lowerE, hsuEq] using hrun
+    exact lowerLam_run_sound_below (by simp [lamArity])
+      hrepresented hlam
+
+private theorem lowerE_lam_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by
+      simpa [lowerE, huuEq] using hrun)).elim
+  | shared =>
+    have hlam : (lowerLam src fuel input (.lam uses body)).run state =
+        .ok (output, emit, av) finalState := by
+      simpa [lowerE, hsuEq] using hrun
+    exact lowerLam_run_value_sound_at (limit := limit)
+      hsourceLength .nil hinclude
+      hrepresented hlam
+
+/-- Semantic lambda branch of `lowerE`. The source evaluator returns its
+closure immediately; successful shared lowering realizes that closure by the
+fresh compiler-provenanced pap constructed above. -/
+theorem lowerE_lam_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerE_lam_run_value_sound_at (limit := limit) hsourceLength hinclude
+      hrepresented hrun
+
+private theorem lowerE_lam_run_value_sound_any_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  by_cases hlength : sourceEnv.length = input.entries.length
+  · exact lowerE_lam_run_value_sound_at hlength hinclude hrepresented hrun
+  · exact (lowerE_lam_run_sound_below (limit := limit) hrepresented hrun)
+      |>.valueSound_of_sourceLength_ne hlength
+
+/-- Premise-free lambda semantics at the expression interface. A realizable
+semantic input necessarily has the source/logical length required by capture
+selection; if the indices are malformed, the graph transformer is vacuous
+while the already-proved ownership transformer remains substantive. -/
+theorem lowerE_lam_run_value_sound_any
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerE_lam_run_value_sound_any_at (limit := limit) hinclude
+      hrepresented hrun
+
+/-- Fuel-bounded semantic lambda branch with an explicit environment-length
+witness. -/
+theorem lowerE_lam_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsourceLength : sourceEnv.length = input.entries.length)
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  exact lowerE_lam_run_value_sound_at hsourceLength hinclude hrepresented hrun
+
+/-- Premise-free bounded lambda semantics. A graph-realizable input supplies
+the required source/logical length; otherwise the graph transformer is
+vacuous while the bounded ownership proof remains meaningful. -/
+theorem lowerE_lam_run_value_sound_any_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {uses : Uses}
+    {body : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hinclude : ∀ value address arity captures,
+      CompilerLiftedFunctionRel src finalState value address arity captures →
+      funRel value address arity captures)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.clos uses sourceEnv body) world emit av := by
+  exact lowerE_lam_run_value_sound_any_at hinclude hrepresented hrun
+
+/-- Returning a lowered value is ownership-correct once every source entry
+has been released or moved. -/
+theorem ret_owns {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {world : Owned} {av : AVal} {rest : List Root}
+    (hreleased : EntriesReleased Γ.entries) :
+    CodeOwns ctx cur (OwnsResult Γ world av rest)
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (.ret (av.toAtom Γ)) := by
+  intro fuel store runtimeEnv store' value hpre hrun
+  obtain ⟨roots, result, hΓ, hav, hown⟩ := hpre
+  have hroots : roots = [] :=
+    EntriesRealize.eq_nil_of_released hreleased hΓ.entries
+  subst roots
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ fuel =>
+    rw [Nat.add_one] at hrun
+    rw [runCode.eq_def] at hrun
+    dsimp only at hrun
+    rw [hav.resolveAtom] at hrun
+    change (Except.ok (store, result) : Except Err (Store × RVal)) =
+      .ok (store', value) at hrun
+    have hpair : (store, result) = (store', value) := Except.ok.inj hrun
+    cases hpair
+    simpa using hown
+
+/-- Close a sound expression emitter with the actual `ret` used by
+`lowerFnBody`. This is the base shape of the eventual function-contract
+construction. -/
+theorem LowerResultSound.close {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {world : Owned} {emit : Emit} {av : AVal}
+    (hsound : LowerResultSound ctx cur input output world emit av)
+    (hreleased : EntriesReleased output.entries) (rest : List Root) :
+    CodeOwns ctx cur (OwnsVEnv input rest)
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (emit (.ret (av.toAtom output))) := by
+  intro fuel store env store' value hpre hrun
+  have hret : CodeOwns ctx cur
+      (OwnsResultProtected output world av rest [])
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (.ret (av.toAtom output)) := by
+    intro innerFuel innerStore innerEnv finalStore finalValue hprotected hretRun
+    exact ret_owns hreleased hprotected.1 hretRun
+  have hcode : CodeOwns ctx cur (OwnsVEnvProtected input rest [])
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (emit (.ret (av.toAtom output))) :=
+    hsound.emits rest [] _ _ hret
+  exact hcode ⟨hpre, SlotsRealize.nil⟩ hrun
+
+/-- Fuel-bounded counterpart of `LowerResultSound.close`. -/
+theorem LowerResultSoundBelow.close {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSoundBelow ctx cur limit input output world emit av)
+    (hreleased : EntriesReleased output.entries) (rest : List Root) :
+    CodeOwnsBelow ctx cur limit (OwnsVEnv input rest)
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (emit (.ret (av.toAtom output))) := by
+  have hret : CodeOwnsBelow ctx cur limit
+      (OwnsResultProtected output world av rest [])
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (.ret (av.toAtom output)) := by
+    intro fuel store env store' value _ hprotected hrun
+    exact ret_owns hreleased hprotected.1 hrun
+  have hcode : CodeOwnsBelow ctx cur limit
+      (OwnsVEnvProtected input rest [])
+      (fun store value => RootOwnership store (⟨world, value⟩ :: rest))
+      (emit (.ret (av.toAtom output))) :=
+    hsound.emits rest [] limit (Nat.le_refl _) _ _ hret
+  intro fuel store env store' value hfuel hpre hrun
+  exact hcode hfuel ⟨hpre, SlotsRealize.nil⟩ hrun
+
+/-! ## Function-entry contracts -/
+
+/-- Relate a lowerer's absolute-slot environment to the source-order
+argument telescope of a function contract. `runCode` enters a function with
+`args.reverse`, while `EntriesRealize` follows the lowerer's source-variable
+order, so the realized roots need only be a permutation of the public
+source-order roots. -/
+def FnEntryRealizes (input : VEnv) (argWorlds : List Owned) : Prop :=
+  ∀ {args : List RVal}, args.length = argWorlds.length →
+    ∃ roots,
+      VEnvRealizes input args.reverse roots ∧
+      roots.Perm (rootsForWorlds argWorlds args)
+
+theorem FnEntryRealizes.empty :
+    FnEntryRealizes ⟨[], 0⟩ [] := by
+  intro args hlength
+  cases args with
+  | nil => exact ⟨[], ⟨rfl, EntriesRealize.nil⟩, List.Perm.refl []⟩
+  | cons arg tail => simp at hlength
+
+/-- The canonical one-parameter entry layout used by `lowerDecl`. The
+remaining-use count is irrelevant at entry; it affects only subsequent
+lowering transitions. -/
+theorem FnEntryRealizes.singleton (uses : Uses) (remaining : Nat) :
+    FnEntryRealizes
+      ⟨[.slot 0 remaining uses true], 1⟩
+      [worldOfUses uses] := by
+  intro args hlength
+  cases args with
+  | nil => simp at hlength
+  | cons arg tail =>
+    cases tail with
+    | nil =>
+      refine ⟨[⟨worldOfUses uses, arg⟩], ?_, List.Perm.refl _⟩
+      constructor
+      · rfl
+      · exact EntriesRealize.held (by simp) rfl EntriesRealize.nil
+    | cons next tail => simp at hlength
+
+/-- Canonical parameter entries realize the reversed runtime argument stack
+even in the presence of `base` older slots below the telescope. The extra
+`suffix` is precisely those older slots. -/
+theorem parameterEntries_entriesRealize (remaining : Nat → Nat) :
+    ∀ (base : Nat) (modes : List Uses) {args suffix : List RVal},
+      args.length = modes.length → suffix.length = base →
+        let Γ : VEnv :=
+          ⟨parameterEntries base modes remaining, base + modes.length⟩
+        EntriesRealize Γ (args.reverse ++ suffix) Γ.entries
+          (rootsForWorlds (modes.map worldOfUses) args).reverse := by
+  intro base modes
+  exact parameterEntries_traverse remaining
+    (Result := fun current sourceModes entries =>
+      ∀ {runtimeArgs suffix : List RVal},
+        runtimeArgs.length = sourceModes.length →
+        suffix.length = current →
+          let Γ : VEnv := ⟨entries, current + sourceModes.length⟩
+          EntriesRealize Γ (runtimeArgs.reverse ++ suffix) entries
+            (rootsForWorlds (sourceModes.map worldOfUses)
+              runtimeArgs).reverse)
+    (hnil := by
+      intro current runtimeArgs suffix hargs hsuffix
+      cases runtimeArgs with
+      | nil => exact EntriesRealize.nil
+      | cons arg tail => simp at hargs)
+    (hcons := by
+      intro current mode rest innerEntries ih runtimeArgs suffix hargs
+        hsuffix
+      cases runtimeArgs with
+      | nil => simp at hargs
+      | cons arg args =>
+        have htail : args.length = rest.length := by simpa using hargs
+        let Γ : VEnv :=
+          ⟨innerEntries ++
+              [.slot current (remaining rest.length) mode true],
+            current + (mode :: rest).length⟩
+        let Δ : VEnv :=
+          ⟨innerEntries, (current + 1) + rest.length⟩
+        have hinner₀ := ih (runtimeArgs := args)
+          (suffix := arg :: suffix) htail (by simp [hsuffix])
+        have hdepth : Δ.depth = Γ.depth := by
+          simp [Δ, Γ]
+          omega
+        have hinner : EntriesRealize Γ
+            ((arg :: args).reverse ++ suffix) innerEntries
+            (rootsForWorlds (rest.map worldOfUses) args).reverse := by
+          have htransport := hinner₀.of_depth_eq hdepth
+          simpa [List.reverse_cons, List.append_assoc, Δ, Γ] using
+            htransport
+        have houter : EntriesRealize Γ
+            ((arg :: args).reverse ++ suffix)
+            [.slot current (remaining rest.length) mode true]
+            [⟨worldOfUses mode, arg⟩] := by
+          apply EntriesRealize.held
+          · simp [Γ]
+          · simp [Γ, VEnv.rel, List.reverse_cons, htail]
+          · exact EntriesRealize.nil
+        simpa [Γ, List.reverse_cons] using hinner.append houter)
+    base modes
+
+/-- Canonical parameter entries also realize the source argument vector
+pointwise. The generalized `base`/`suffix` form is what makes the recursive
+tail layout line up with absolute slots. -/
+theorem parameterEntries_entriesValueGraph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel} {store : Store}
+    (remaining : Nat → Nat) :
+    ∀ (base : Nat) (modes : List Uses)
+      {sourceArgs : List IxIR0.Value} {args suffix : List RVal},
+      args.length = modes.length → suffix.length = base →
+      Sim.ValuesGraph funRel store sourceArgs args →
+      (∀ root, root ∈ rootsForWorlds (modes.map worldOfUses) args →
+        HasWorld store root.world root.value) →
+      let Γ : VEnv :=
+        ⟨parameterEntries base modes remaining, base + modes.length⟩
+      EntriesValueGraph funRel recSelfRel store Γ
+        (args.reverse ++ suffix) Γ.entries sourceArgs.reverse
+        (rootsForWorlds (modes.map worldOfUses) args).reverse := by
+  intro base modes
+  exact parameterEntries_traverse remaining
+    (Result := fun current sourceModes entries =>
+      ∀ {sourceArgs : List IxIR0.Value} {runtimeArgs suffix : List RVal},
+        runtimeArgs.length = sourceModes.length →
+        suffix.length = current →
+        Sim.ValuesGraph funRel store sourceArgs runtimeArgs →
+        (∀ root,
+          root ∈ rootsForWorlds (sourceModes.map worldOfUses) runtimeArgs →
+          HasWorld store root.world root.value) →
+          let Γ : VEnv := ⟨entries, current + sourceModes.length⟩
+          EntriesValueGraph funRel recSelfRel store Γ
+            (runtimeArgs.reverse ++ suffix) entries sourceArgs.reverse
+            (rootsForWorlds (sourceModes.map worldOfUses)
+              runtimeArgs).reverse)
+    (hnil := by
+      intro current sourceArgs runtimeArgs suffix hargs hsuffix hgraphs
+        hworlds
+      cases runtimeArgs with
+      | nil =>
+        cases hgraphs
+        exact EntriesValueGraph.nil
+      | cons arg tail => simp at hargs)
+    (hcons := by
+      intro current mode rest innerEntries ih sourceArgs runtimeArgs suffix
+        hargs hsuffix hgraphs hworlds
+      cases runtimeArgs with
+      | nil => simp at hargs
+      | cons arg args =>
+        cases hgraphs with
+        | @cons source arg sources args hvalue htailGraphs =>
+          have htail : args.length = rest.length := by
+            simpa using hargs
+          let Γ : VEnv :=
+            ⟨innerEntries ++
+                [.slot current (remaining rest.length) mode true],
+              current + (mode :: rest).length⟩
+          let Δ : VEnv :=
+            ⟨innerEntries, (current + 1) + rest.length⟩
+          have hinner₀ := ih (sourceArgs := sources) (runtimeArgs := args)
+            (suffix := arg :: suffix) htail (by simp [hsuffix]) htailGraphs
+            (by
+              intro root hroot
+              exact hworlds root (by simp [hroot]))
+          have hdepth : Δ.depth = Γ.depth := by
+            simp [Δ, Γ]
+            omega
+          have hinner : EntriesValueGraph funRel recSelfRel store Γ
+              ((arg :: args).reverse ++ suffix) innerEntries sources.reverse
+              (rootsForWorlds (rest.map worldOfUses) args).reverse := by
+            have htransport := hinner₀.of_depth_eq hdepth
+            simpa [List.reverse_cons, List.append_assoc, Δ, Γ] using
+              htransport
+          have houter : EntriesValueGraph funRel recSelfRel store Γ
+              ((arg :: args).reverse ++ suffix)
+              [.slot current (remaining rest.length) mode true]
+              [source] [⟨worldOfUses mode, arg⟩] := by
+            apply EntriesValueGraph.held
+            · simp [Γ]
+            · simp [Γ, VEnv.rel, List.reverse_cons, htail]
+            · exact hworlds ⟨worldOfUses mode, arg⟩ (by simp)
+            · exact hvalue
+            · exact EntriesValueGraph.nil
+          simpa [Γ, List.reverse_cons] using hinner.append houter)
+    base modes
+
+/-- At a public function entry, pointwise-related source/runtime arguments
+form the complete semantic graph for the canonical parameter environment.
+Ownership may include an arbitrary caller frame; only the parameter-prefix
+world facts are used here. -/
+theorem VEnvValueGraph.parameterEntries
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel} {store : Store}
+    (modes : List Uses) (remaining : Nat → Nat)
+    {sourceArgs : List IxIR0.Value} {args : List RVal}
+    {rest : List Root}
+    (hlength : args.length = modes.length)
+    (hgraphs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hown : RootOwnership store
+      (rootsForWorlds (modes.map worldOfUses) args ++ rest)) :
+    VEnvValueGraph funRel recSelfRel store
+      ⟨parameterEntries 0 modes remaining, modes.length⟩
+      sourceArgs.reverse args.reverse
+      (rootsForWorlds (modes.map worldOfUses) args).reverse := by
+  constructor
+  · simpa using hlength
+  · simpa using parameterEntries_entriesValueGraph
+      (funRel := funRel) (recSelfRel := recSelfRel) (store := store)
+      remaining 0 modes (sourceArgs := sourceArgs) (args := args)
+      (suffix := []) hlength rfl hgraphs (by
+        intro root hroot
+        exact hown.roots_world root (List.mem_append_left _ hroot))
+
+/-- Every canonical direct-function parameter layout realizes the public
+source-order argument telescope. -/
+theorem FnEntryRealizes.parameterEntries (modes : List Uses)
+    (remaining : Nat → Nat) :
+    FnEntryRealizes
+      ⟨parameterEntries 0 modes remaining, modes.length⟩
+      (modes.map worldOfUses) := by
+  intro args hlength
+  have hmodes : args.length = modes.length := by simpa using hlength
+  refine ⟨(rootsForWorlds (modes.map worldOfUses) args).reverse, ?_,
+    List.reverse_perm _⟩
+  constructor
+  · simpa using hmodes
+  · simpa using parameterEntries_entriesRealize remaining 0 modes
+      (args := args) (suffix := []) hmodes rfl
+
+/-- A bounded closed-body emitter yields ownership preservation at the exact
+evaluator index forming its bound. This is the declaration-level step used by
+the mutual source-context contract induction. -/
+theorem LowerResultSoundBelow.fnOwnershipPreservesAt
+    {ctx : Ctx} {d : FnDef} {limit : Nat}
+    {input output : VEnv} {argWorlds : List Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSoundBelow ctx d limit input output d.result emit av)
+    (hentry : FnEntryRealizes input argWorlds)
+    (harity : argWorlds.length = d.arity)
+    (hreleased : EntriesReleased output.entries)
+    (hbody : d.body = emit (.ret (av.toAtom output))) :
+    FnOwnershipPreservesAt ctx d argWorlds limit := by
+  intro store store' args value rest hlength hown hrun
+  obtain ⟨roots, hinput, hperm⟩ := hentry hlength
+  have hcode : CodeOwnsBelow ctx d limit (OwnsVEnv input rest)
+      (fun finalStore finalValue =>
+        RootOwnership finalStore (⟨d.result, finalValue⟩ :: rest))
+      (emit (.ret (av.toAtom output))) :=
+    hsound.close hreleased rest
+  rw [hbody] at hrun
+  apply hcode (Nat.le_refl limit)
+  · refine ⟨roots, hinput, ?_⟩
+    exact hown.perm (hperm.symm.append_right rest)
+  · exact hrun
+
+/-- Body-level ownership invariant used to construct a callable function
+contract. It separates the mechanical entry-layout proof from the compiler
+induction that proves the emitted body code. -/
+structure FnBodySound (ctx : Ctx) (d : FnDef) (input : VEnv)
+    (argWorlds : List Owned) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  entry_realizes : FnEntryRealizes input argWorlds
+  body_owns : ∀ rest,
+    CodeOwns ctx d (OwnsVEnv input rest)
+      (fun store value =>
+        RootOwnership store (⟨d.result, value⟩ :: rest))
+      d.body
+
+/-- A body proof whose entry slots realize the source argument telescope is
+exactly the externally callable `FnOwnershipContract`. -/
+theorem FnBodySound.contract {ctx : Ctx} {d : FnDef} {input : VEnv}
+    {argWorlds : List Owned}
+    (h : FnBodySound ctx d input argWorlds) :
+    FnOwnershipContract ctx d argWorlds := by
+  refine ⟨h.arity_eq, ?_⟩
+  intro fuel store store' args value rest hlength hown hrun
+  obtain ⟨roots, hinput, hperm⟩ := h.entry_realizes hlength
+  apply h.body_owns rest
+  · refine ⟨roots, hinput, ?_⟩
+    exact hown.perm (hperm.symm.append_right rest)
+  · exact hrun
+
+/-- Package a closed expression-lowering derivation as a body invariant for
+the actual emitted `FnDef`. This is the reusable bridge from the compiler
+induction to declaration contracts. -/
+theorem LowerResultSound.fnBodySound {ctx : Ctx} {d : FnDef}
+    {input output : VEnv} {argWorlds : List Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSound ctx d input output d.result emit av)
+    (hentry : FnEntryRealizes input argWorlds)
+    (harity : argWorlds.length = d.arity)
+    (hreleased : EntriesReleased output.entries)
+    (hbody : d.body = emit (.ret (av.toAtom output))) :
+    FnBodySound ctx d input argWorlds := by
+  refine ⟨harity, hentry, ?_⟩
+  intro rest
+  rw [hbody]
+  exact hsound.close hreleased rest
+
+/-- Direct constructor for the contract of a successfully lowered and
+closed function body. -/
+theorem LowerResultSound.fnOwnershipContract {ctx : Ctx} {d : FnDef}
+    {input output : VEnv} {argWorlds : List Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultSound ctx d input output d.result emit av)
+    (hentry : FnEntryRealizes input argWorlds)
+    (harity : argWorlds.length = d.arity)
+    (hreleased : EntriesReleased output.entries)
+    (hbody : d.body = emit (.ret (av.toAtom output))) :
+    FnOwnershipContract ctx d argWorlds :=
+  (hsound.fnBodySound hentry harity hreleased hbody).contract
+
+/-- Verified `.defn` declaration rule. The mutual compiler induction supplies
+the concrete release plan and recursive body proof; this theorem runs the
+actual `lowerDecl` branch and packages its emitted function as a callable
+ownership contract. -/
+theorem lowerDecl_defn_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (address : Ixon.Address)
+    (result : Owned) (body : IxIR0.Expr)
+    (middle output : VEnv) (releaseEmit emit : Emit) (av : AVal)
+    (state finalState : LowSt) (d : FnDef)
+    (hplan : ReleasePlan
+      ⟨parameterEntries 0 (lamUses body)
+          (fun i => countUses i (stripLams body)), lamArity body⟩
+      (parameterDrops 0 (lamUses body)
+        (fun i => countUses i (stripLams body)))
+      middle releaseEmit)
+    (hbodyRun : (lowerE src fuel middle result (stripLams body)).run state =
+      .ok (output, emit, av) finalState)
+    (hd : d =
+      ⟨lamArity body, result, result == .shared && papSafe body,
+        (releaseEmit ∘ emit) (.ret (av.toAtom output))⟩)
+    (hbody : LowerResultSound ctx d middle output result emit av)
+    (hreleased : EntriesReleased output.entries) :
+    (lowerDecl src (Nat.succ fuel) (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState ∧
+      FnOwnershipContract ctx d ((lamUses body).map worldOfUses) := by
+  subst d
+  let remaining : Nat → Nat := fun i => countUses i (stripLams body)
+  let input : VEnv :=
+    ⟨parameterEntries 0 (lamUses body) remaining, lamArity body⟩
+  let drops := parameterDrops 0 (lamUses body) remaining
+  have hfn := lowerFnBody_verified (ctx := ctx)
+    (cur := ⟨lamArity body, result, result == .shared && papSafe body,
+      (releaseEmit ∘ emit) (.ret (av.toAtom output))⟩)
+    src fuel input middle output drops result (stripLams body)
+    releaseEmit emit av state finalState (by simpa [input, drops, remaining]
+      using hplan) hbodyRun hbody
+  constructor
+  · simp only [lowerDecl]
+    rw [estateBindRun]
+    have hrun := hfn.1
+    simp only [input, drops, remaining] at hrun
+    rw [hrun]
+    rfl
+  · have hentry : FnEntryRealizes input
+        ((lamUses body).map worldOfUses) := by
+      have hinput : input =
+          ⟨parameterEntries 0 (lamUses body) remaining,
+            (lamUses body).length⟩ := by
+        simp [input]
+      rw [hinput]
+      intro args hlength
+      exact (FnEntryRealizes.parameterEntries (lamUses body) remaining)
+        hlength
+    apply hfn.2.fnOwnershipContract hentry
+    · simp
+    · exact hreleased
+    · rfl
+
+/-- Definition-level rule with compiler-generated parameter releases. The
+caller proves only the mode admissibility condition and continues from the
+actual successful `releaseSlots` result; the indexed `ReleasePlan` is
+constructed internally. This is the interface expected by the eventual
+mutual lowering proof. -/
+theorem lowerDecl_defn_generated_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (address : Ixon.Address)
+    (result : Owned) (body : IxIR0.Expr) (state : LowSt)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun i => countUses i (stripLams body)))
+    (hbody : ∀ middle releaseEmit,
+      (releaseSlots
+        ⟨parameterEntries 0 (lamUses body)
+            (fun i => countUses i (stripLams body)), lamArity body⟩
+        (parameterDrops 0 (lamUses body)
+          (fun i => countUses i (stripLams body)))).run state =
+          .ok (middle, releaseEmit) state →
+      ∃ output emit av finalState,
+        (lowerE src fuel middle result (stripLams body)).run state =
+          .ok (output, emit, av) finalState ∧
+        LowerResultSound ctx
+          ⟨lamArity body, result, result == .shared && papSafe body,
+            (releaseEmit ∘ emit) (.ret (av.toAtom output))⟩
+          middle output result emit av ∧
+        EntriesReleased output.entries) :
+    ∃ finalState d,
+      (lowerDecl src (Nat.succ fuel) (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState ∧
+      FnOwnershipContract ctx d ((lamUses body).map worldOfUses) := by
+  let remaining : Nat → Nat := fun i => countUses i (stripLams body)
+  let input : VEnv :=
+    ⟨parameterEntries 0 (lamUses body) remaining, lamArity body⟩
+  let drops := parameterDrops 0 (lamUses body) remaining
+  obtain ⟨middle, releaseEmit, rawPlan⟩ :=
+    parameterDrops_releasePlan 0 (lamUses body) remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan : ReleasePlan input drops middle releaseEmit := by
+    simpa [input, drops, remaining] using rawPlan
+  obtain ⟨output, emit, av, finalState, hbodyRun, hsound, hreleased⟩ :=
+    hbody middle releaseEmit
+      (by simpa [input, drops, remaining] using hplan.run state)
+  let d : FnDef :=
+    ⟨lamArity body, result, result == .shared && papSafe body,
+      (releaseEmit ∘ emit) (.ret (av.toAtom output))⟩
+  refine ⟨finalState, d, ?_⟩
+  have hdecl := lowerDecl_defn_verified (ctx := ctx)
+    src fuel address result body middle output releaseEmit emit av
+    state finalState d hplan hbodyRun rfl hsound hreleased
+  simpa [d] using hdecl
+
+/-! ## Case-alternative contracts -/
+
+/-- Runtime shape of a recursor alternative before the dispatcher pushes its
+constructor fields. `pre` is in source argument order; the function runtime
+environment is reversed and headed by the major premise. -/
+def RecursorEntryValid (numArgs : Nat)
+    (env : List RVal) (_fields : Array RVal) : Prop :=
+  ∃ (pre : List RVal) (major : RVal),
+    pre.length = numArgs ∧ env = major :: pre.reverse
+
+/-- Public function-argument roots consumed by a recursor alternative. The
+runtime environment is reversed, so reversing it recovers source order. -/
+def recursorEntryRoots
+    (env : List RVal) (_fields : Array RVal) : List Root :=
+  rootsFor .shared env.reverse
+
+/-- Canonical logical entry layout at the start of a recursor alternative:
+released field placeholders, all-shared pre-major parameters, and synthetic
+recursive self. -/
+def recursorInitialVEnv (numArgs nf : Nat) (rhs : IxIR0.Expr) : VEnv :=
+  let dead : VEntry := .slot 0 0 .many false
+  ⟨List.replicate nf dead ++
+      parameterEntries 0 (List.replicate numArgs .many)
+        (fun i => countUses (nf + i) rhs) ++
+      [.recSelf (numArgs + 1)],
+    (numArgs + 1) + nf⟩
+
+/-- Protected major and constructor-field positions at alternative entry.
+The major lies immediately above the `numArgs` older parameters; fields
+then occupy consecutive absolute positions in constructor order. -/
+def recursorEntrySlots (numArgs : Nat) (major : RVal)
+    (fields : Array RVal) : List (Nat × RVal) :=
+  recursorFieldSlots numArgs (major :: fields.toList)
+
+/-- Relate a selected alternative's physical entry environment to the roots
+owned by that branch. `entryValid` carries arity/layout side conditions;
+borrowed field evidence remains separate because fields are not roots until
+the emitted prefix explicitly retains them. -/
+def AltEntryRealizes (input : VEnv) (fieldCount : Nat)
+    (entryValid : List RVal → Array RVal → Prop)
+    (entryRoots : List RVal → Array RVal → List Root) : Prop :=
+  ∀ {env : List RVal} {fields : Array RVal},
+    fields.size = fieldCount → entryValid env fields →
+      ∃ roots,
+        VEnvRealizes input
+          (fields.foldl (fun branchEnv field => field :: branchEnv) env)
+          roots ∧
+        roots.Perm (entryRoots env fields)
+
+/-- State at the start of a selected case alternative: its physical field
+bindings, exact owned roots, and the non-owning field-world facts exposed by
+the dispatcher. -/
+def OwnsAltEntry (fieldWorld : Owned)
+    (entryRoots : List RVal → Array RVal → List Root)
+    (env : List RVal) (fields : Array RVal) (rest : List Root) : StatePred :=
+  fun store branchEnv =>
+    branchEnv =
+        fields.foldl (fun current field => field :: current) env ∧
+      RootOwnership store (entryRoots env fields ++ rest) ∧
+      ∀ field ∈ fields.toList, HasWorld store fieldWorld field
+
+/-- Convert the public recursor alternative entry state into the exact
+logical split expected by the generated field-retain fold. Pre-major
+parameters are owned by the `VEnv`; the major remains the first external
+root; fields remain borrowed, with every original absolute slot protected. -/
+theorem recursorAltEntry_borrowed_state
+    (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    (pre : List RVal) (major : RVal) (fields : Array RVal)
+    (hpreLength : pre.length = numArgs) (hfields : fields.size = nf)
+    (rest : List Root) :
+    ∀ {store branchEnv},
+      OwnsAltEntry .shared recursorEntryRoots
+          (major :: pre.reverse) fields rest store branchEnv →
+      OwnsVEnvBorrowed (recursorInitialVEnv numArgs nf rhs)
+        (⟨.shared, major⟩ :: rest)
+        (recursorEntrySlots numArgs major fields) fields.toList
+        store branchEnv := by
+  intro store branchEnv hentry
+  obtain ⟨hbranch, hown, hborrowed⟩ := hentry
+  rw [Array.foldl_cons_eq_reverse_append] at hbranch
+  subst branchEnv
+  let modes := List.replicate numArgs Uses.many
+  let remaining : Nat → Nat := fun i => countUses (nf + i) rhs
+  have hargs : pre.length = (modes.map worldOfUses).length := by
+    simp [modes, hpreLength]
+  obtain ⟨preRoots, hpreRealize, hprePerm⟩ :=
+    (FnEntryRealizes.parameterEntries modes remaining) hargs
+  have hpushed := hpreRealize.bumpList (major :: fields.toList)
+  let input := recursorInitialVEnv numArgs nf rhs
+  have hfieldsLength : fields.toList.length = nf := by
+    simpa using hfields
+  have hpushedDepth :
+      (addVEnvDepth
+        ⟨parameterEntries 0 modes remaining, modes.length⟩
+        (major :: fields.toList).length).depth = input.depth := by
+    simp [addVEnvDepth, input, recursorInitialVEnv, modes,
+      hfieldsLength]
+    omega
+  have hparams : EntriesRealize input
+      (fields.toList.reverse ++ major :: pre.reverse)
+      (parameterEntries 0 modes remaining) preRoots := by
+    have htransport := hpushed.entries.of_depth_eq hpushedDepth
+    simpa [addVEnvDepth, List.reverse_cons, List.append_assoc]
+      using htransport
+  let dead : VEntry := .slot 0 0 .many false
+  have hdead : EntriesRealize input
+      (fields.toList.reverse ++ major :: pre.reverse)
+      (List.replicate nf dead) [] := by
+    apply EntriesRealize.replicateReleased
+    simp [input, recursorInitialVEnv]
+    omega
+  have hentries : EntriesRealize input
+      (fields.toList.reverse ++ major :: pre.reverse)
+      input.entries preRoots := by
+    have hself : EntriesRealize input
+        (fields.toList.reverse ++ major :: pre.reverse)
+        [.recSelf (numArgs + 1)] [] :=
+      EntriesRealize.recSelf EntriesRealize.nil
+    have hall := hdead.append (hparams.append hself)
+    simpa [input, recursorInitialVEnv, modes, remaining, dead,
+      List.append_assoc] using hall
+  have hdepth :
+      (fields.toList.reverse ++ major :: pre.reverse).length =
+        input.depth := by
+    simp [input, recursorInitialVEnv, hfieldsLength, hpreLength]
+    omega
+  have hslotDepth :
+      (⟨[], pre.reverse.length + (major :: fields.toList).length⟩ :
+          VEnv).depth = input.depth := by
+    simp [input, recursorInitialVEnv, hfieldsLength, hpreLength]
+    omega
+  have hslots : SlotsRealize input
+      (fields.toList.reverse ++ major :: pre.reverse)
+      (recursorEntrySlots numArgs major fields) := by
+    have hraw := recursorFieldSlots_realize_list
+      pre.reverse (major :: fields.toList)
+    have htransport := hraw.of_depth_eq hslotDepth
+    simpa [recursorEntrySlots, hpreLength, List.reverse_cons,
+      List.append_assoc] using htransport
+  have hworlds :
+      rootsForWorlds (modes.map worldOfUses) pre =
+        rootsFor .shared pre := by
+    have hrep : modes.map worldOfUses =
+        List.replicate numArgs Owned.shared := by
+      simp [modes, worldOfUses]
+    rw [hrep]
+    exact rootsForWorlds_replicate_eq_rootsFor .shared hpreLength
+  rw [hworlds] at hprePerm
+  have howned : RootOwnership store
+      (preRoots ++ ⟨.shared, major⟩ :: rest) := by
+    apply hown.perm
+    simpa [recursorEntryRoots, rootsFor, List.reverse_cons,
+      List.append_assoc] using
+      hprePerm.symm.append_right (⟨.shared, major⟩ :: rest)
+  exact ⟨⟨⟨preRoots, ⟨hdepth, hentries⟩, howned⟩, hslots⟩,
+    hborrowed⟩
+
+/-- Semantic branch-entry conversion for a selected recursor rule.  It
+reconstructs the exact rule evaluator environment—reversed fields, reversed
+pre-major arguments, then synthetic recursive self—while keeping the major
+as the one external root consumed by the generated prefix. -/
+theorem recursorAltEntry_value_state
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel} {store : Store}
+    (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    {sourcePre : List IxIR0.Value} {pre : List RVal}
+    {sourceFields : List IxIR0.Value} {fields : List RVal}
+    {sourceSelf : IxIR0.Value} {major : RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hpreLength : pre.length = numArgs)
+    (hfieldsLength : fields.length = nf)
+    (hpreGraphs : Sim.ValuesGraph funRel store sourcePre pre)
+    (hfieldGraphs : Sim.ValuesGraph funRel store sourceFields fields)
+    (hself : recSelfRel sourceSelf (numArgs + 1))
+    (hrestGraph : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (pre ++ [major]) ++ rest))
+    (hfieldWorld : ∀ field ∈ fields, HasWorld store .shared field) :
+    GraphOwnsVEnvRetains funRel recSelfRel
+      (recursorInitialVEnv numArgs nf rhs)
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      sourceRest rest [⟨.shared, major⟩]
+      (recursorFieldSlots numArgs (major :: fields)) fields
+      (recursorFieldRetains (numArgs + 1) rhs nf)
+      store (fields.reverse ++ major :: pre.reverse) := by
+  let modes := List.replicate numArgs Uses.many
+  let remaining : Nat → Nat := fun i => countUses (nf + i) rhs
+  have hmodes : pre.length = modes.length := by
+    simp [modes, hpreLength]
+  have hworldLayout : modes.map worldOfUses =
+      List.replicate numArgs Owned.shared := by
+    simp [modes, worldOfUses]
+  have hparameterOwn : RootOwnership store
+      (rootsForWorlds (modes.map worldOfUses) pre ++
+        (⟨.shared, major⟩ :: rest)) := by
+    rw [hworldLayout]
+    rw [rootsForWorlds_replicate_eq_rootsFor .shared hpreLength]
+    simpa [rootsFor, List.append_assoc] using hown
+  have hparameters₀ := VEnvValueGraph.parameterEntries
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    modes remaining hmodes hpreGraphs hparameterOwn
+  have hpushed := hparameters₀.bumpList (major :: fields)
+  let input := recursorInitialVEnv numArgs nf rhs
+  have hpushedDepth :
+      (addVEnvDepth
+        ⟨parameterEntries 0 modes remaining, modes.length⟩
+        (major :: fields).length).depth = input.depth := by
+    simp [addVEnvDepth, input, recursorInitialVEnv, modes,
+      hfieldsLength]
+    omega
+  let preRoots :=
+    (rootsForWorlds (modes.map worldOfUses) pre).reverse
+  have hparameters : EntriesValueGraph funRel recSelfRel store input
+      (fields.reverse ++ major :: pre.reverse)
+      (parameterEntries 0 modes remaining) sourcePre.reverse preRoots := by
+    have htransport := hpushed.entries.of_depth_eq hpushedDepth
+    simpa [addVEnvDepth, List.reverse_cons, List.append_assoc, preRoots]
+      using htransport
+  let dead : VEntry := .slot 0 0 .many false
+  have hsourceFieldsLength : sourceFields.reverse.length = nf := by
+    simpa [hfieldsLength] using hfieldGraphs.length
+  have hdead : EntriesValueGraph funRel recSelfRel store input
+      (fields.reverse ++ major :: pre.reverse)
+      (List.replicate nf dead) sourceFields.reverse [] := by
+    apply EntriesValueGraph.replicateReleased
+    · exact hsourceFieldsLength
+    · simp [input, recursorInitialVEnv]
+      omega
+  have hselfEntry : EntriesValueGraph funRel recSelfRel store input
+      (fields.reverse ++ major :: pre.reverse)
+      [.recSelf (numArgs + 1)] [sourceSelf] [] :=
+    EntriesValueGraph.recSelf hself EntriesValueGraph.nil
+  have hentries : EntriesValueGraph funRel recSelfRel store input
+      (fields.reverse ++ major :: pre.reverse) input.entries
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      preRoots := by
+    have hall := hdead.append (hparameters.append hselfEntry)
+    simpa [input, recursorInitialVEnv, modes, remaining, dead,
+      List.append_assoc] using hall
+  have hdepth :
+      (fields.reverse ++ major :: pre.reverse).length = input.depth := by
+    simp [input, recursorInitialVEnv, hfieldsLength, hpreLength]
+    omega
+  have hslotDepth :
+      (⟨[], pre.reverse.length + (major :: fields).length⟩ : VEnv).depth =
+        input.depth := by
+    simp [input, recursorInitialVEnv, hfieldsLength, hpreLength]
+    omega
+  have hslots : SlotsRealize input
+      (fields.reverse ++ major :: pre.reverse)
+      (recursorFieldSlots numArgs (major :: fields)) := by
+    have hraw := recursorFieldSlots_realize_list pre.reverse
+      (major :: fields)
+    have htransport := hraw.of_depth_eq hslotDepth
+    simpa [hpreLength, List.reverse_cons, List.append_assoc]
+      using htransport
+  have howned : RootOwnership store
+      (preRoots ++ ⟨.shared, major⟩ :: rest) := by
+    have hnormal : RootOwnership store
+        (rootsFor .shared pre ++ ⟨.shared, major⟩ :: rest) := by
+      simpa [rootsFor, List.append_assoc] using hown
+    have hreverse :
+        (rootsForWorlds (modes.map worldOfUses) pre).reverse.Perm
+          (rootsFor .shared pre) := by
+      rw [hworldLayout]
+      rw [rootsForWorlds_replicate_eq_rootsFor .shared hpreLength]
+      exact List.reverse_perm _
+    exact hnormal.perm (hreverse.symm.append_right
+      (⟨.shared, major⟩ :: rest))
+  have hretainBase := recursorFieldRetains_valueGraphs
+    (funRel := funRel) (store := store) (numArgs + 1) nf rhs
+    (sourceValues := sourceFields) (values := fields)
+    (sourcePre.reverse ++ [sourceSelf]) hfieldGraphs hfieldsLength
+  have hretains : RetainsValueGraphs funRel store
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      (recursorFieldSlots numArgs (major :: fields)) fields
+      (recursorFieldRetains (numArgs + 1) rhs nf) := by
+    intro retain hmember
+    obtain ⟨source, value, hsource, hslot, hborrowed, hvalue⟩ :=
+      hretainBase retain hmember
+    exact ⟨source, value,
+      by simpa [List.append_assoc] using hsource,
+      by simp [recursorFieldSlots, hslot], hborrowed, hvalue⟩
+  exact ⟨preRoots, ⟨hdepth, hentries⟩, hrestGraph,
+    by simpa [List.append_assoc] using howned, hslots,
+    hfieldWorld, hretains⟩
+
+/-- Identity-emitter wrapper for the recursor entry-state conversion. -/
+theorem recursorAltEntry_borrowed {ctx : Ctx} {cur : FnDef}
+    (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    (pre : List RVal) (major : RVal) (fields : Array RVal)
+    (hpreLength : pre.length = numArgs) (hfields : fields.size = nf)
+    (rest : List Root) :
+    EmitSound ctx cur (_root_.id : Emit)
+      (OwnsAltEntry .shared recursorEntryRoots
+        (major :: pre.reverse) fields rest)
+      (OwnsVEnvBorrowed (recursorInitialVEnv numArgs nf rhs)
+        (⟨.shared, major⟩ :: rest)
+        (recursorEntrySlots numArgs major fields) fields.toList) := by
+  apply EmitSound.strengthen
+  exact recursorAltEntry_borrowed_state numArgs nf rhs pre major fields
+    hpreLength hfields rest
+
+/-- Fuel-bounded identity-emitter wrapper for recursor entry conversion. -/
+theorem recursorAltEntry_borrowed_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    (pre : List RVal) (major : RVal) (fields : Array RVal)
+    (hpreLength : pre.length = numArgs) (hfields : fields.size = nf)
+    (rest : List Root) :
+    EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsAltEntry .shared recursorEntryRoots
+        (major :: pre.reverse) fields rest)
+      (OwnsVEnvBorrowed (recursorInitialVEnv numArgs nf rhs)
+        (⟨.shared, major⟩ :: rest)
+        (recursorEntrySlots numArgs major fields) fields.toList) := by
+  apply EmitSoundBelow.strengthen
+  exact recursorAltEntry_borrowed_state numArgs nf rhs pre major fields
+    hpreLength hfields rest
+
+/-- One uniformly bounded composition proof for the generated recursor
+prefix. Operational plan witnesses are limit-independent; only the final
+ownership judgment is indexed, so exact and bounded public certificates can
+share this body. -/
+private theorem recursorPrefix_generated_verified_core
+    {ctx : Ctx} {cur : FnDef} (numArgs nf : Nat)
+    (rhs : IxIR0.Expr) (state : LowSt) :
+    let dead : VEntry := .slot 0 0 .many false
+    let fieldInput : VEnv :=
+      ⟨List.replicate nf dead, (numArgs + 1) + nf⟩
+    let retains := recursorFieldRetains (numArgs + 1) rhs nf
+    let frame :=
+      parameterEntries 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs) ++
+        [.recSelf (numArgs + 1)]
+    let drops :=
+      (parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs)).map
+        (SlotDrop.offsetEntry nf)
+    ∃ fieldOutput fieldEmit rhsInput parameterEmit,
+      applyRecursorFieldRetains fieldInput retains =
+        (fieldOutput, fieldEmit) ∧
+      (releaseSlots
+          ⟨fieldOutput.entries ++ frame, fieldOutput.depth + 1⟩
+          drops).run state = .ok (rhsInput, parameterEmit) state ∧
+      ∀ limit {pre : List RVal} {major : RVal} {fields : Array RVal}
+          {rest : List Root},
+        pre.length = numArgs → fields.size = nf →
+          EmitSoundBelow ctx cur limit
+            (fieldEmit ∘
+              emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+              parameterEmit)
+            (OwnsAltEntry .shared recursorEntryRoots
+              (major :: pre.reverse) fields rest)
+            (OwnsVEnv rhsInput rest) := by
+  dsimp only
+  let dead : VEntry := .slot 0 0 .many false
+  let fieldInput : VEnv :=
+    ⟨List.replicate nf dead, (numArgs + 1) + nf⟩
+  let retains := recursorFieldRetains (numArgs + 1) rhs nf
+  let frame :=
+    parameterEntries 0 (List.replicate numArgs .many)
+        (fun i => countUses (nf + i) rhs) ++
+      [.recSelf (numArgs + 1)]
+  let drops :=
+    (parameterDrops 0 (List.replicate numArgs .many)
+        (fun i => countUses (nf + i) rhs)).map
+      (SlotDrop.offsetEntry nf)
+  obtain ⟨fieldOutput, fieldEmit, hfieldPlan⟩ :=
+    recursorFieldRetains_plan (numArgs + 1) ((numArgs + 1) + nf) nf rhs
+  have hfieldEntriesLength : fieldOutput.entries.length = nf := by
+    calc
+      fieldOutput.entries.length =
+          (⟨List.replicate nf dead,
+            (numArgs + 1) + nf⟩ : VEnv).entries.length :=
+        hfieldPlan.entries_length
+      _ = nf := by simp
+  obtain ⟨rhsInput, parameterEmit, hparameterPlan⟩ :=
+    recursorParameterDrops_releasePlan numArgs nf
+      (fieldOutput.depth + 1) rhs fieldOutput.entries
+      hfieldEntriesLength
+  refine ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+    ?_, ?_, ?_⟩
+  · simpa [fieldInput, retains, dead] using hfieldPlan.run
+  · simpa [frame, drops, List.append_assoc] using
+      hparameterPlan.run state
+  · intro limit pre major fields rest hpreLength hfields
+    have hfieldsLength : fields.toList.length = nf := by
+      simpa using hfields
+    have hcoveredBase := recursorFieldRetains_covered
+      (numArgs + 1) nf rhs fields.toList hfieldsLength
+    have hcovered : FieldRetainsCovered
+        (recursorFieldRetains (numArgs + 1) rhs nf)
+        (recursorEntrySlots numArgs major fields) fields.toList := by
+      intro retain hmem
+      obtain ⟨value, hslot, hborrowed⟩ :=
+        hcoveredBase retain hmem
+      exact ⟨value, by
+        simp [recursorEntrySlots, recursorFieldSlots, hslot], hborrowed⟩
+    have hentry := recursorAltEntry_borrowed_below
+      (ctx := ctx) (cur := cur) (limit := limit)
+      numArgs nf rhs pre major fields hpreLength hfields rest
+    have hfieldFramed := hfieldPlan.frameEntries frame
+    have hfield : EmitSoundBelow ctx cur limit fieldEmit
+        (OwnsVEnvBorrowed (recursorInitialVEnv numArgs nf rhs)
+          (⟨.shared, major⟩ :: rest)
+          (recursorEntrySlots numArgs major fields) fields.toList)
+        (OwnsVEnvBorrowed (frameVEnvEntries fieldOutput frame)
+          (⟨.shared, major⟩ :: rest)
+          (recursorEntrySlots numArgs major fields) fields.toList) := by
+      have hsound := hfieldFramed.soundBelow
+        (ctx := ctx) (cur := cur) (limit := limit)
+        (recursorEntrySlots numArgs major fields) fields.toList
+        hcovered (⟨.shared, major⟩ :: rest)
+      simpa [fieldInput, retains, frame, dead, recursorInitialVEnv,
+        frameVEnvEntries, List.append_assoc] using hsound
+    have hmajor : EmitSoundBelow ctx cur limit
+        (emitOp (.drop (.var
+          ((frameVEnvEntries fieldOutput frame).rel numArgs))))
+        (OwnsVEnvBorrowed (frameVEnvEntries fieldOutput frame)
+          (⟨.shared, major⟩ :: rest)
+          (recursorEntrySlots numArgs major fields) fields.toList)
+        (OwnsVEnvProtected (frameVEnvEntries fieldOutput frame).bump
+          rest (recursorEntrySlots numArgs major fields)) :=
+      drop_major_owned_below (limit := limit) (by
+        simp [recursorEntrySlots, recursorFieldSlots])
+    have hparameters : EmitSoundBelow ctx cur limit parameterEmit
+        (OwnsVEnvProtected (frameVEnvEntries fieldOutput frame).bump
+          rest (recursorEntrySlots numArgs major fields))
+        (OwnsVEnvProtected rhsInput rest
+          (recursorEntrySlots numArgs major fields)) := by
+      have hsound := hparameterPlan.soundBelow
+        (ctx := ctx) (cur := cur) (limit := limit) rest
+        (recursorEntrySlots numArgs major fields)
+      simpa [frameVEnvEntries, VEnv.bump, frame, List.append_assoc]
+        using hsound
+    have hforget : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+        (OwnsVEnvProtected rhsInput rest
+          (recursorEntrySlots numArgs major fields))
+        (OwnsVEnv rhsInput rest) :=
+      EmitSoundBelow.strengthen (fun h => h.1)
+    have hcomposed := EmitSoundBelow.comp hentry
+      (EmitSoundBelow.comp hfield
+        (EmitSoundBelow.comp hmajor
+          (EmitSoundBelow.comp hparameters hforget)))
+    simpa [frameVEnvEntries, VEnv.rel, Function.comp_def] using hcomposed
+
+
+/-- End-to-end certificate for the complete generated recursor prefix at an
+arbitrary branch width: retain every used borrowed field, release the major,
+then execute the canonical dead-parameter release plan. The returned
+`VEnv` is exactly the input expected by lowering the rule RHS. -/
+theorem recursorPrefix_generated_verified {ctx : Ctx} {cur : FnDef}
+    (numArgs nf : Nat) (rhs : IxIR0.Expr) (state : LowSt) :
+    let dead : VEntry := .slot 0 0 .many false
+    let fieldInput : VEnv :=
+      ⟨List.replicate nf dead, (numArgs + 1) + nf⟩
+    let retains := recursorFieldRetains (numArgs + 1) rhs nf
+    let frame :=
+      parameterEntries 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs) ++
+        [.recSelf (numArgs + 1)]
+    let drops :=
+      (parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs)).map
+        (SlotDrop.offsetEntry nf)
+    ∃ fieldOutput fieldEmit rhsInput parameterEmit,
+      applyRecursorFieldRetains fieldInput retains =
+        (fieldOutput, fieldEmit) ∧
+      (releaseSlots
+          ⟨fieldOutput.entries ++ frame, fieldOutput.depth + 1⟩
+          drops).run state = .ok (rhsInput, parameterEmit) state ∧
+      ∀ {pre : List RVal} {major : RVal} {fields : Array RVal}
+          {rest : List Root},
+        pre.length = numArgs → fields.size = nf →
+          EmitSound ctx cur
+            (fieldEmit ∘
+              emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+              parameterEmit)
+            (OwnsAltEntry .shared recursorEntryRoots
+              (major :: pre.reverse) fields rest)
+            (OwnsVEnv rhsInput rest) := by
+  dsimp only
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      hfieldRun, hparameterRun, hsound⟩ :=
+    recursorPrefix_generated_verified_core (ctx := ctx) (cur := cur)
+      numArgs nf rhs state
+  refine ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+    hfieldRun, hparameterRun, ?_⟩
+  intro pre major fields rest hpreLength hfields
+  exact EmitSound.of_below fun limit =>
+    hsound limit hpreLength hfields
+
+/-- Fuel-bounded end-to-end certificate for the generated recursor prefix.
+All prefix operations are call-free; the hereditary bound is carried solely
+to compose with the recursively proved rule body. -/
+theorem recursorPrefix_generated_verified_below
+    {ctx : Ctx} {cur : FnDef} (limit numArgs nf : Nat)
+    (rhs : IxIR0.Expr) (state : LowSt) :
+    let dead : VEntry := .slot 0 0 .many false
+    let fieldInput : VEnv :=
+      ⟨List.replicate nf dead, (numArgs + 1) + nf⟩
+    let retains := recursorFieldRetains (numArgs + 1) rhs nf
+    let frame :=
+      parameterEntries 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs) ++
+        [.recSelf (numArgs + 1)]
+    let drops :=
+      (parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs)).map
+        (SlotDrop.offsetEntry nf)
+    ∃ fieldOutput fieldEmit rhsInput parameterEmit,
+      applyRecursorFieldRetains fieldInput retains =
+        (fieldOutput, fieldEmit) ∧
+      (releaseSlots
+          ⟨fieldOutput.entries ++ frame, fieldOutput.depth + 1⟩
+          drops).run state = .ok (rhsInput, parameterEmit) state ∧
+      ∀ {pre : List RVal} {major : RVal} {fields : Array RVal}
+          {rest : List Root},
+        pre.length = numArgs → fields.size = nf →
+          EmitSoundBelow ctx cur limit
+            (fieldEmit ∘
+              emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+              parameterEmit)
+            (OwnsAltEntry .shared recursorEntryRoots
+              (major :: pre.reverse) fields rest)
+            (OwnsVEnv rhsInput rest) := by
+  dsimp only
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      hfieldRun, hparameterRun, hsound⟩ :=
+    recursorPrefix_generated_verified_core (ctx := ctx) (cur := cur)
+      numArgs nf rhs state
+  refine ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+    hfieldRun, hparameterRun, ?_⟩
+  intro pre major fields rest hpreLength hfields
+  exact hsound limit hpreLength hfields
+/-- Semantic composition rule for the three proof-relevant plans making up
+a generated recursor prefix.  Retaining fields enriches released logical
+entries, dropping the major removes the sole external branch root, and the
+parameter-release plan then preserves the resulting source environment all
+the way to the rule RHS input. -/
+theorem recursorPrefixPlans_valueSoundBelow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (numArgs nf : Nat) (rhs : IxIR0.Expr)
+    {fieldOutput rhsInput : VEnv} {fieldEmit parameterEmit : Emit}
+    (hfieldPlan : FieldRetainPlan
+      ⟨List.replicate nf (.slot 0 0 .many false),
+        (numArgs + 1) + nf⟩
+      (recursorFieldRetains (numArgs + 1) rhs nf)
+      fieldOutput fieldEmit)
+    (hparameterPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (nf + i) rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (nf + i) rhs)).map
+        (SlotDrop.offsetEntry nf))
+      rhsInput parameterEmit) :
+    ∀ sourceEnv sourceRest rest major fields,
+      EmitSoundBelow ctx cur limit
+        (fieldEmit ∘
+          emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+          parameterEmit)
+        (GraphOwnsVEnvRetains funRel recSelfRel
+          (recursorInitialVEnv numArgs nf rhs) sourceEnv
+          sourceRest rest [⟨.shared, major⟩]
+          (recursorFieldSlots numArgs (major :: fields)) fields
+          (recursorFieldRetains (numArgs + 1) rhs nf))
+        (GraphOwnsVEnv funRel recSelfRel rhsInput sourceEnv
+          sourceRest rest) := by
+  intro sourceEnv sourceRest rest major fields
+  let frame :=
+    parameterEntries 0 (List.replicate numArgs .many)
+        (fun i => countUses (nf + i) rhs) ++
+      [.recSelf (numArgs + 1)]
+  have hfieldFramed := hfieldPlan.frameEntries frame
+  have hfield : EmitSoundBelow ctx cur limit fieldEmit
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (recursorInitialVEnv numArgs nf rhs) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields
+        (recursorFieldRetains (numArgs + 1) rhs nf))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields []) := by
+    have hsound := hfieldFramed.valueSoundBelow
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit)
+      sourceEnv sourceRest rest [⟨.shared, major⟩]
+      (recursorFieldSlots numArgs (major :: fields)) fields
+    simpa [frame, recursorInitialVEnv, frameVEnvEntries,
+      List.append_assoc] using hsound
+  have hmajor : EmitSoundBelow ctx cur limit
+      (emitOp (.drop (.var
+        ((frameVEnvEntries fieldOutput frame).rel numArgs))))
+      (GraphOwnsVEnvRetains funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame) sourceEnv
+        sourceRest rest [⟨.shared, major⟩]
+        (recursorFieldSlots numArgs (major :: fields)) fields [])
+      (GraphOwnsVEnvProtected funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame).bump sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields))) :=
+    drop_major_value_below
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit)
+      (by simp [recursorFieldSlots])
+  have hparameters : EmitSoundBelow ctx cur limit parameterEmit
+      (GraphOwnsVEnvProtected funRel recSelfRel
+        (frameVEnvEntries fieldOutput frame).bump sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      (GraphOwnsVEnvProtected funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields))) := by
+    have hsound := (hparameterPlan.valueSoundBelow
+      (funRel := funRel) (recSelfRel := recSelfRel)
+      (ctx := ctx) (cur := cur) (limit := limit) sourceEnv).graphEmits
+      sourceRest rest (recursorFieldSlots numArgs (major :: fields))
+    simpa [frameVEnvEntries, VEnv.bump, frame, List.append_assoc]
+      using hsound
+  have hforget : EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (GraphOwnsVEnvProtected funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest
+        (recursorFieldSlots numArgs (major :: fields)))
+      (GraphOwnsVEnv funRel recSelfRel rhsInput sourceEnv
+        sourceRest rest) :=
+    EmitSoundBelow.strengthen (fun h => h.1)
+  have hcomposed := EmitSoundBelow.comp hfield
+    (EmitSoundBelow.comp hmajor
+      (EmitSoundBelow.comp hparameters hforget))
+  simpa [frameVEnvEntries, VEnv.rel, Function.comp_def] using hcomposed
+
+/-- When the lowered body starts directly at branch entry, an entry-layout
+realization turns the case predicate into the ordinary `OwnsVEnv` predicate
+used by expression lowering. -/
+theorem AltEntryRealizes.emitId {ctx : Ctx} {cur : FnDef}
+    {input : VEnv} {fieldCount : Nat}
+    {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hentry : AltEntryRealizes input fieldCount entryValid entryRoots)
+    {env : List RVal} {fields : Array RVal}
+    (hsize : fields.size = fieldCount) (hvalid : entryValid env fields)
+    (rest : List Root) :
+    EmitSound ctx cur (_root_.id : Emit)
+      (OwnsAltEntry fieldWorld entryRoots env fields rest)
+      (OwnsVEnv input rest) := by
+  apply EmitSound.strengthen
+  intro store branchEnv hpre
+  obtain ⟨henv, hown, _⟩ := hpre
+  subst branchEnv
+  obtain ⟨roots, hrealize, hperm⟩ := hentry hsize hvalid
+  refine ⟨roots, hrealize, ?_⟩
+  exact hown.perm (hperm.symm.append_right rest)
+
+/-- Fuel-bounded entry-layout adapter. -/
+theorem AltEntryRealizes.emitIdBelow {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv} {fieldCount : Nat}
+    {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hentry : AltEntryRealizes input fieldCount entryValid entryRoots)
+    {env : List RVal} {fields : Array RVal}
+    (hsize : fields.size = fieldCount) (hvalid : entryValid env fields)
+    (rest : List Root) :
+    EmitSoundBelow ctx cur limit (_root_.id : Emit)
+      (OwnsAltEntry fieldWorld entryRoots env fields rest)
+      (OwnsVEnv input rest) := by
+  apply EmitSoundBelow.strengthen
+  intro store branchEnv hpre
+  obtain ⟨henv, hown, _⟩ := hpre
+  subst branchEnv
+  obtain ⟨roots, hrealize, hperm⟩ := hentry hsize hvalid
+  refine ⟨roots, hrealize, ?_⟩
+  exact hown.perm (hperm.symm.append_right rest)
+
+/-- Close a lowered alternative body behind its case-entry prefix. This is
+the branch analogue of `LowerResultSound.fnOwnershipContract`: the prefix
+may retain borrowed fields and release the scrutinee/dead parameters before
+the ordinary expression proof begins. -/
+theorem LowerResultSound.altOwnershipContractWithPrefix
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {fieldWorld : Owned} {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    {entryEmit emit : Emit} {av : AVal} {tag fieldCount : Nat}
+    (hsound : LowerResultSound ctx cur input output cur.result emit av)
+    (hprefix : ∀ {env : List RVal} {fields : Array RVal}
+        {rest : List Root},
+      fields.size = fieldCount → entryValid env fields →
+        EmitSound ctx cur entryEmit
+          (OwnsAltEntry fieldWorld entryRoots env fields rest)
+          (OwnsVEnv input rest))
+    (hreleased : EntriesReleased output.entries) :
+    AltOwnershipContract ctx cur
+      (.mk tag fieldCount (entryEmit (emit (.ret (av.toAtom output)))))
+      fieldWorld entryValid entryRoots := by
+  refine ⟨?_⟩
+  intro fuel store store' env fields value rest hsize hvalid hown
+    hborrow hrun
+  exact (hprefix hsize hvalid _ _ (hsound.close hreleased rest))
+    ⟨rfl, hown, hborrow⟩ hrun
+
+/-- Prefix-free specialization for alternatives whose entry layout already
+matches the input `VEnv`. -/
+theorem LowerResultSound.altOwnershipContract
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {fieldWorld : Owned} {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    {emit : Emit} {av : AVal} {tag fieldCount : Nat}
+    (hsound : LowerResultSound ctx cur input output cur.result emit av)
+    (hentry : AltEntryRealizes input fieldCount entryValid entryRoots)
+    (hreleased : EntriesReleased output.entries) :
+    AltOwnershipContract ctx cur
+      (.mk tag fieldCount (emit (.ret (av.toAtom output))))
+      fieldWorld entryValid entryRoots := by
+  simpa using hsound.altOwnershipContractWithPrefix
+    (entryEmit := (_root_.id : Emit))
+    (fun hsize hvalid => hentry.emitId hsize hvalid _) hreleased
+
+/-- Close a bounded lowered alternative behind a bounded generated prefix. -/
+theorem LowerResultSoundBelow.altOwnershipContractWithPrefix
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {fieldWorld : Owned} {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    {entryEmit emit : Emit} {av : AVal} {tag fieldCount : Nat}
+    (hsound : LowerResultSoundBelow ctx cur limit input output
+      cur.result emit av)
+    (hprefix : ∀ {env : List RVal} {fields : Array RVal}
+        {rest : List Root},
+      fields.size = fieldCount → entryValid env fields →
+        EmitSoundBelow ctx cur limit entryEmit
+          (OwnsAltEntry fieldWorld entryRoots env fields rest)
+          (OwnsVEnv input rest))
+    (hreleased : EntriesReleased output.entries) :
+    AltOwnershipContractBelow ctx cur
+      (.mk tag fieldCount (entryEmit (emit (.ret (av.toAtom output)))))
+      fieldWorld entryValid entryRoots limit := by
+  refine ⟨?_⟩
+  intro fuel store store' env fields value rest hfuel hsize hvalid hown
+    hborrow hrun
+  have hcode : CodeOwnsBelow ctx cur limit
+      (OwnsAltEntry fieldWorld entryRoots env fields rest)
+      (fun store value =>
+        RootOwnership store (⟨cur.result, value⟩ :: rest))
+      (entryEmit (emit (.ret (av.toAtom output)))) :=
+    hprefix hsize hvalid limit (Nat.le_refl _) _ _
+      (hsound.close hreleased rest)
+  exact hcode (Nat.le_of_lt hfuel) ⟨rfl, hown, hborrow⟩ hrun
+
+/-- Prefix-free bounded alternative specialization. -/
+theorem LowerResultSoundBelow.altOwnershipContract
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {input output : VEnv}
+    {fieldWorld : Owned} {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    {emit : Emit} {av : AVal} {tag fieldCount : Nat}
+    (hsound : LowerResultSoundBelow ctx cur limit input output
+      cur.result emit av)
+    (hentry : AltEntryRealizes input fieldCount entryValid entryRoots)
+    (hreleased : EntriesReleased output.entries) :
+    AltOwnershipContractBelow ctx cur
+      (.mk tag fieldCount (emit (.ret (av.toAtom output))))
+      fieldWorld entryValid entryRoots limit := by
+  simpa using hsound.altOwnershipContractWithPrefix
+    (entryEmit := (_root_.id : Emit))
+    (fun hsize hvalid => hentry.emitIdBelow hsize hvalid _) hreleased
+
+/-- Recursive compiler premise for one recursor-rule RHS, stated against the
+actual field-retain and parameter-release results consumed by
+`lowerRecursorRule`. -/
+def RecursorRuleBodySound (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (fuel numArgs : Nat) (rule : IxIR0.RecRule) (state : LowSt) : Prop :=
+  ∀ {fieldOutput : VEnv} {fieldEmit : Emit}
+      {rhsInput : VEnv} {parameterEmit : Emit},
+    applyRecursorFieldRetains
+        ⟨List.replicate rule.fields (.slot 0 0 .many false),
+          (numArgs + 1) + rule.fields⟩
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields) =
+      (fieldOutput, fieldEmit) →
+    (releaseSlots
+        ⟨fieldOutput.entries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs) ++
+            [.recSelf (numArgs + 1)],
+          fieldOutput.depth + 1⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs)).map
+          (SlotDrop.offsetEntry rule.fields))).run state =
+      .ok (rhsInput, parameterEmit) state →
+    ∃ output bodyEmit av finalState,
+      (lowerE src fuel rhsInput .shared rule.rhs).run state =
+        .ok (output, bodyEmit, av) finalState ∧
+      LowerResultSound ctx cur rhsInput output .shared bodyEmit av ∧
+      EntriesReleased output.entries
+
+/-- Fuel-bounded recursive compiler premise for one recursor-rule RHS. -/
+def RecursorRuleBodySoundBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (src : IxIR0.Env) (fuel numArgs : Nat)
+    (rule : IxIR0.RecRule) (state : LowSt) : Prop :=
+  ∀ {fieldOutput : VEnv} {fieldEmit : Emit}
+      {rhsInput : VEnv} {parameterEmit : Emit},
+    applyRecursorFieldRetains
+        ⟨List.replicate rule.fields (.slot 0 0 .many false),
+          (numArgs + 1) + rule.fields⟩
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields) =
+      (fieldOutput, fieldEmit) →
+    (releaseSlots
+        ⟨fieldOutput.entries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs) ++
+            [.recSelf (numArgs + 1)],
+          fieldOutput.depth + 1⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs)).map
+          (SlotDrop.offsetEntry rule.fields))).run state =
+      .ok (rhsInput, parameterEmit) state →
+    ∃ output bodyEmit av finalState,
+      (lowerE src fuel rhsInput .shared rule.rhs).run state =
+        .ok (output, bodyEmit, av) finalState ∧
+      LowerResultSoundBelow ctx cur limit rhsInput output .shared
+        bodyEmit av ∧
+      EntriesReleased output.entries
+
+/-- Bounded ownership transformer for the exact generated retain/major/
+parameter prefix of one recursor rule. -/
+def RecursorRulePrefixSoundBelow (ctx : Ctx) (cur : FnDef)
+    (limit numArgs : Nat) (rule : IxIR0.RecRule) (state : LowSt) : Prop :=
+  ∀ {fieldOutput : VEnv} {fieldEmit : Emit}
+      {rhsInput : VEnv} {parameterEmit : Emit},
+    applyRecursorFieldRetains
+        ⟨List.replicate rule.fields (.slot 0 0 .many false),
+          (numArgs + 1) + rule.fields⟩
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields) =
+      (fieldOutput, fieldEmit) →
+    (releaseSlots
+        ⟨fieldOutput.entries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs) ++
+            [.recSelf (numArgs + 1)],
+          fieldOutput.depth + 1⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs)).map
+          (SlotDrop.offsetEntry rule.fields))).run state =
+      .ok (rhsInput, parameterEmit) state →
+    ∀ {pre : List RVal} {major : RVal} {fields : Array RVal}
+        {rest : List Root},
+      pre.length = numArgs → fields.size = rule.fields →
+        EmitSoundBelow ctx cur limit
+          (fieldEmit ∘
+            emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+            parameterEmit)
+          (OwnsAltEntry .shared recursorEntryRoots
+            (major :: pre.reverse) fields rest)
+          (OwnsVEnv rhsInput rest)
+
+/-- The executable retain/release prefix itself supplies the bounded prefix
+premise; callers need only identify its deterministic interpreter results. -/
+theorem recursorRulePrefixSound_generated_below
+    {ctx : Ctx} {cur : FnDef} (limit numArgs : Nat)
+    (rule : IxIR0.RecRule) (state : LowSt) :
+    RecursorRulePrefixSoundBelow ctx cur limit numArgs rule state := by
+  intro fieldOutput fieldEmit rhsInput parameterEmit
+    hfieldRun hparameterRun
+  intro pre major fields rest hpreLength hfields
+  obtain ⟨generatedFieldOutput, generatedFieldEmit,
+      generatedRhsInput, generatedParameterEmit,
+      generatedFieldRun, generatedParameterRun, hsound⟩ :=
+    recursorPrefix_generated_verified_below (ctx := ctx) (cur := cur)
+      limit numArgs rule.fields rule.rhs state
+  have hfieldEq :
+      (fieldOutput, fieldEmit) =
+        (generatedFieldOutput, generatedFieldEmit) :=
+    hfieldRun.symm.trans generatedFieldRun
+  cases hfieldEq
+  simp only [List.append_assoc] at hparameterRun
+  have hparameterResultEq :=
+    hparameterRun.symm.trans generatedParameterRun
+  have hparameterEq :
+      (rhsInput, parameterEmit) =
+        (generatedRhsInput, generatedParameterEmit) := by
+    simpa using hparameterResultEq
+  cases hparameterEq
+  exact hsound hpreLength hfields
+
+/-- Shared operational constructor for a generated recursor rule. Exact and
+bounded ownership clients choose their emitter, body, and alternative
+judgments, while prefix normalization, RHS sequencing, alternative assembly,
+run reconstruction, and entry-validity elimination occur once. -/
+private theorem lowerRecursorRule_generated_verified_core
+    {EmitJudgment : Emit → StatePred → StatePred → Prop}
+    {BodySound : VEnv → VEnv → Emit → AVal → Prop}
+    {Contract : Alt → Prop}
+    (src : IxIR0.Env) (fuel numArgs : Nat) (rule : IxIR0.RecRule)
+    (tag : Nat) (state : LowSt)
+    {fieldOutput : VEnv} {fieldEmit : Emit}
+    {rhsInput : VEnv} {parameterEmit : Emit}
+    (hfieldRun :
+      applyRecursorFieldRetains
+          ⟨List.replicate rule.fields (.slot 0 0 .many false),
+            (numArgs + 1) + rule.fields⟩
+          (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields) =
+        (fieldOutput, fieldEmit))
+    (hparameterRun :
+      (releaseSlots
+          ⟨fieldOutput.entries ++
+              (parameterEntries 0 (List.replicate numArgs .many)
+                  (fun i => countUses (rule.fields + i) rule.rhs) ++
+                [.recSelf (numArgs + 1)]),
+            fieldOutput.depth + 1⟩
+          ((parameterDrops 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs)).map
+            (SlotDrop.offsetEntry rule.fields))).run state =
+        .ok (rhsInput, parameterEmit) state)
+    (hprefix : ∀ {pre : List RVal} {major : RVal}
+        {fields : Array RVal} {rest : List Root},
+      pre.length = numArgs → fields.size = rule.fields →
+        EmitJudgment
+          (fieldEmit ∘
+            emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+            parameterEmit)
+          (OwnsAltEntry .shared recursorEntryRoots
+            (major :: pre.reverse) fields rest)
+          (OwnsVEnv rhsInput rest))
+    (hbody :
+      (releaseSlots
+          ⟨fieldOutput.entries ++
+              parameterEntries 0 (List.replicate numArgs .many)
+                (fun i => countUses (rule.fields + i) rule.rhs) ++
+              [.recSelf (numArgs + 1)],
+            fieldOutput.depth + 1⟩
+          ((parameterDrops 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs)).map
+            (SlotDrop.offsetEntry rule.fields))).run state =
+        .ok (rhsInput, parameterEmit) state →
+      ∃ output bodyEmit av finalState,
+        (lowerE src fuel rhsInput .shared rule.rhs).run state =
+          .ok (output, bodyEmit, av) finalState ∧
+        BodySound rhsInput output bodyEmit av ∧
+        EntriesReleased output.entries)
+    (hclose : ∀ {output : VEnv} {bodyEmit : Emit} {av : AVal},
+      BodySound rhsInput output bodyEmit av →
+      (∀ {env : List RVal} {fields : Array RVal} {rest : List Root},
+        fields.size = rule.fields → RecursorEntryValid numArgs env fields →
+          EmitJudgment
+            (fieldEmit ∘
+              emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+              parameterEmit)
+            (OwnsAltEntry .shared recursorEntryRoots env fields rest)
+            (OwnsVEnv rhsInput rest)) →
+      EntriesReleased output.entries →
+      Contract (.mk tag rule.fields
+        (fieldEmit
+          (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+            (parameterEmit (bodyEmit (.ret (av.toAtom output)))))))) :
+    ∃ finalState alt,
+      (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+        .ok alt finalState ∧
+      Contract alt := by
+  have hparameterRun' :
+      (releaseSlots
+          ⟨fieldOutput.entries ++
+              parameterEntries 0 (List.replicate numArgs .many)
+                (fun i => countUses (rule.fields + i) rule.rhs) ++
+              [.recSelf (numArgs + 1)],
+            fieldOutput.depth + 1⟩
+          ((parameterDrops 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs)).map
+            (SlotDrop.offsetEntry rule.fields))).run state =
+        .ok (rhsInput, parameterEmit) state := by
+    simpa [List.append_assoc] using hparameterRun
+  obtain ⟨output, bodyEmit, av, finalState,
+      hbodyRun, hsound, hreleased⟩ := hbody hparameterRun'
+  let alt : Alt :=
+    .mk tag rule.fields
+      (fieldEmit
+        (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+          (parameterEmit (bodyEmit (.ret (av.toAtom output))))))
+  refine ⟨finalState, alt, ?_, ?_⟩
+  · simp only [lowerRecursorRule]
+    rw [hfieldRun]
+    simp only
+    rw [estateBindRun]
+    simp only [VEnv.bump, List.append_assoc]
+    rw [hparameterRun]
+    simp only
+    rw [estateBindRun, hbodyRun]
+    rfl
+  · have hprefixValid : ∀ {env : List RVal} {fields : Array RVal}
+        {rest : List Root},
+      fields.size = rule.fields → RecursorEntryValid numArgs env fields →
+        EmitJudgment
+          (fieldEmit ∘
+            emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘
+            parameterEmit)
+          (OwnsAltEntry .shared recursorEntryRoots env fields rest)
+          (OwnsVEnv rhsInput rest) := by
+      intro env fields rest hfields hvalid
+      obtain ⟨pre, major, hpreLength, rfl⟩ := hvalid
+      exact hprefix hpreLength hfields
+    simpa [alt] using hclose hsound hprefixValid hreleased
+
+/-- The executable lowering of one arbitrary recursor rule produces an
+alternative satisfying the generic public entry contract. -/
+theorem lowerRecursorRule_generated_verified {ctx : Ctx} {cur : FnDef}
+    (hresult : cur.result = .shared)
+    (src : IxIR0.Env) (fuel numArgs : Nat) (rule : IxIR0.RecRule)
+    (tag : Nat) (state : LowSt)
+    (hbody : RecursorRuleBodySound ctx cur src fuel numArgs rule state) :
+    ∃ finalState alt,
+      (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+        .ok alt finalState ∧
+      AltOwnershipContract ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots := by
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      hfieldRun, hparameterRun, hprefix⟩ :=
+    recursorPrefix_generated_verified (ctx := ctx) (cur := cur)
+      numArgs rule.fields rule.rhs state
+  refine lowerRecursorRule_generated_verified_core
+    (EmitJudgment := EmitSound ctx cur)
+    (BodySound := fun input output emit av =>
+      LowerResultSound ctx cur input output .shared emit av)
+    (Contract := fun alt =>
+      AltOwnershipContract ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots)
+    src fuel numArgs rule tag state hfieldRun hparameterRun hprefix
+    (fun hparameterRun' => hbody hfieldRun hparameterRun') ?_
+  intro output bodyEmit av hsound hprefixValid hreleased
+  have hsoundCur : LowerResultSound ctx cur rhsInput output
+      cur.result bodyEmit av := by
+    simpa [hresult] using hsound
+  have hcontract := hsoundCur.altOwnershipContractWithPrefix
+    (fieldWorld := .shared)
+    (entryValid := RecursorEntryValid numArgs)
+    (entryRoots := recursorEntryRoots)
+    (entryEmit := fieldEmit ∘
+      emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘ parameterEmit)
+    (tag := tag) (fieldCount := rule.fields) hprefixValid hreleased
+  simpa [Function.comp_def] using hcontract
+
+/-- Exact-fuel version of `lowerRecursorRule_generated_verified`. The
+recursive RHS and the generated prefix both carry only bounded Hoare proofs,
+and the produced alternative is correspondingly bounded. -/
+theorem lowerRecursorRule_generated_verified_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (hresult : cur.result = .shared)
+    (src : IxIR0.Env) (fuel numArgs : Nat) (rule : IxIR0.RecRule)
+    (tag : Nat) (state : LowSt)
+    (hbody : RecursorRuleBodySoundBelow ctx cur limit src fuel numArgs
+      rule state) :
+    ∃ finalState alt,
+      (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+        .ok alt finalState ∧
+      AltOwnershipContractBelow ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots limit := by
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      hfieldRun, hparameterRun, hprefix⟩ :=
+    recursorPrefix_generated_verified_below (ctx := ctx) (cur := cur)
+      limit numArgs rule.fields rule.rhs state
+  refine lowerRecursorRule_generated_verified_core
+    (EmitJudgment := EmitSoundBelow ctx cur limit)
+    (BodySound := fun input output emit av =>
+      LowerResultSoundBelow ctx cur limit input output .shared emit av)
+    (Contract := fun alt =>
+      AltOwnershipContractBelow ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots limit)
+    src fuel numArgs rule tag state hfieldRun hparameterRun hprefix
+    (fun hparameterRun' => hbody hfieldRun hparameterRun') ?_
+  intro output bodyEmit av hsound hprefixValid hreleased
+  have hsoundCur : LowerResultSoundBelow ctx cur limit rhsInput output
+      cur.result bodyEmit av := by
+    simpa [hresult] using hsound
+  have hcontract := hsoundCur.altOwnershipContractWithPrefix
+    (fieldWorld := .shared)
+    (entryValid := RecursorEntryValid numArgs)
+    (entryRoots := recursorEntryRoots)
+    (entryEmit := fieldEmit ∘
+      emitOp (.drop (.var (fieldOutput.rel numArgs))) ∘ parameterEmit)
+    (tag := tag) (fieldCount := rule.fields) hprefixValid hreleased
+  simpa [Function.comp_def] using hcontract
+
+/-- Contract-parameterized state-threaded traversal of indexed recursor
+rules. Exact and bounded ownership plans share this executable spine and its
+recursive eliminators. -/
+inductive RecursorRulesPlanWith (RuleContract : Alt → Prop)
+    (src : IxIR0.Env) (fuel numArgs : Nat) :
+    LowSt → List (IxIR0.RecRule × Nat) → LowSt → List Alt → Prop where
+  | nil (state : LowSt) :
+      RecursorRulesPlanWith RuleContract src fuel numArgs
+        state [] state []
+  | cons {state middleState finalState : LowSt}
+      {rule : IxIR0.RecRule} {tag : Nat}
+      {rules : List (IxIR0.RecRule × Nat)} {alt : Alt} {alts : List Alt}
+      (hhead : (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+        .ok alt middleState)
+      (hcontract : RuleContract alt)
+      (tail : RecursorRulesPlanWith RuleContract src fuel numArgs
+        middleState rules finalState alts) :
+      RecursorRulesPlanWith RuleContract src fuel numArgs state
+        ((rule, tag) :: rules) finalState (alt :: alts)
+
+/-- Dependent traversal over the shared recursor-rule plan. State, source
+rule/tag, generated alternative, successful head execution, and the selected
+alternative contract are threaded once; clients retain the original tail
+witness together with the recursively produced result. -/
+theorem RecursorRulesPlanWith.traverse
+    {RuleContract : Alt → Prop}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {Result : LowSt → List (IxIR0.RecRule × Nat) →
+      LowSt → List Alt → Prop}
+    (hnil : ∀ state, Result state [] state [])
+    (hcons : ∀ {state middleState finalState : LowSt}
+        {rule : IxIR0.RecRule} {tag : Nat}
+        {rules : List (IxIR0.RecRule × Nat)}
+        {alt : Alt} {alts : List Alt},
+      (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+        .ok alt middleState →
+      RuleContract alt →
+      RecursorRulesPlanWith RuleContract src fuel numArgs
+        middleState rules finalState alts →
+      Result middleState rules finalState alts →
+      Result state ((rule, tag) :: rules) finalState (alt :: alts))
+    {state finalState : LowSt}
+    {rules : List (IxIR0.RecRule × Nat)} {alts : List Alt}
+    (hplan : RecursorRulesPlanWith RuleContract src fuel numArgs
+      state rules finalState alts) :
+    Result state rules finalState alts := by
+  induction hplan with
+  | nil state => exact hnil state
+  | cons hhead hcontract tail ih =>
+      exact hcons hhead hcontract tail ih
+
+/-- Exact ownership specialization of the shared traversal family. -/
+abbrev RecursorRulesPlan (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (fuel numArgs : Nat) :=
+  RecursorRulesPlanWith
+    (fun alt => AltOwnershipContract ctx cur alt .shared
+      (RecursorEntryValid numArgs) recursorEntryRoots)
+    src fuel numArgs
+
+/-- Public empty exact-plan constructor retained across the generic spine. -/
+theorem RecursorRulesPlan.nil {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel numArgs : Nat} (state : LowSt) :
+    RecursorRulesPlan ctx cur src fuel numArgs state [] state [] :=
+  RecursorRulesPlanWith.nil state
+
+/-- Public exact-plan step constructor retained across the generic spine. -/
+theorem RecursorRulesPlan.cons {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state middleState finalState : LowSt}
+    {rule : IxIR0.RecRule} {tag : Nat}
+    {rules : List (IxIR0.RecRule × Nat)} {alt : Alt} {alts : List Alt}
+    (hhead : (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+      .ok alt middleState)
+    (hcontract : AltOwnershipContract ctx cur alt .shared
+      (RecursorEntryValid numArgs) recursorEntryRoots)
+    (tail : RecursorRulesPlan ctx cur src fuel numArgs
+      middleState rules finalState alts) :
+    RecursorRulesPlan ctx cur src fuel numArgs state
+      ((rule, tag) :: rules) finalState (alt :: alts) :=
+  RecursorRulesPlanWith.cons hhead hcontract tail
+
+/-- Every specialization of the shared traversal computes the exact
+successful `mapM` result. -/
+theorem RecursorRulesPlanWith.run {RuleContract : Alt → Prop}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlanWith RuleContract src fuel numArgs
+      state rules finalState alts) :
+    (rules.mapM (lowerRecursorRule src fuel numArgs)).run state =
+      .ok alts finalState := by
+  exact RecursorRulesPlanWith.traverse
+    (Result := fun current currentRules currentFinal currentAlts =>
+      (currentRules.mapM (lowerRecursorRule src fuel numArgs)).run current =
+        .ok currentAlts currentFinal)
+    (hnil := by
+      intro current
+      rfl)
+    (hcons := by
+      intro state middleState finalState rule tag rules alt alts
+        hhead hcontract tail ih
+      simp only [List.mapM_cons]
+      rw [estateBindRun, hhead]
+      simp only
+      rw [estateBindRun, ih]
+      rfl)
+    (hplan := hplan)
+
+/-- Every output of the shared traversal carries its selected contract
+payload. -/
+theorem RecursorRulesPlanWith.forall_mem {RuleContract : Alt → Prop}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlanWith RuleContract src fuel numArgs
+      state rules finalState alts) :
+    ∀ alt ∈ alts, RuleContract alt := by
+  exact RecursorRulesPlanWith.traverse
+    (Result := fun _ _ _ currentAlts =>
+      ∀ selected ∈ currentAlts, RuleContract selected)
+    (hnil := by
+      intro current
+      simp)
+    (hcons := by
+      intro state middleState finalState rule tag rules alt alts
+        hhead hcontract tail ih selected hmem
+      simp only [List.mem_cons] at hmem
+      rcases hmem with rfl | htail
+      · exact hcontract
+      · exact ih selected htail)
+    (hplan := hplan)
+
+/-- Exact-plan compatibility wrapper for the shared run theorem. -/
+theorem RecursorRulesPlan.run {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlan ctx cur src fuel numArgs
+      state rules finalState alts) :
+    (rules.mapM (lowerRecursorRule src fuel numArgs)).run state =
+      .ok alts finalState :=
+  RecursorRulesPlanWith.run hplan
+
+/-- Exact-plan compatibility wrapper for shared contract membership. -/
+theorem RecursorRulesPlan.forall_mem {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlan ctx cur src fuel numArgs
+      state rules finalState alts) :
+    ∀ alt ∈ alts,
+      AltOwnershipContract ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots :=
+  RecursorRulesPlanWith.forall_mem hplan
+
+/-- Ownership contracts for every alternative that the evaluator can select.
+Indexing by the successful `Array.find?` equation mirrors `runCode` exactly
+and avoids imposing a separate uniqueness or array-membership invariant. -/
+def RecursorAltContracts (ctx : Ctx) (cur : FnDef) (numArgs : Nat)
+    (alts : Array Alt) : Prop :=
+  ∀ {cidx tag fieldCount : Nat} {body : Code},
+    alts.find? (fun alt => alt.cidx == cidx) =
+        some (.mk tag fieldCount body) →
+      AltOwnershipContract ctx cur (.mk tag fieldCount body) .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots
+
+/-- Pointwise contracts collect into the evaluator-selection-indexed bundle. -/
+theorem RecursorAltContracts.of_forall_mem {ctx : Ctx} {cur : FnDef}
+    {numArgs : Nat} {alts : Array Alt}
+    (hall : ∀ alt ∈ alts,
+      AltOwnershipContract ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots) :
+    RecursorAltContracts ctx cur numArgs alts := by
+  intro cidx tag fieldCount body hfind
+  exact hall (.mk tag fieldCount body)
+    (Array.mem_of_find?_eq_some hfind)
+
+/-- A completed rule traversal supplies the selection-indexed bundle used by
+the `case` evaluator. -/
+theorem RecursorRulesPlan.altContracts {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlan ctx cur src fuel numArgs
+      state rules finalState alts) :
+    RecursorAltContracts ctx cur numArgs alts.toArray := by
+  apply RecursorAltContracts.of_forall_mem
+  intro alt hmem
+  apply hplan.forall_mem alt
+  simpa using hmem
+
+/-- Selection-indexed alternative contracts available below one evaluator
+fuel bound. -/
+def RecursorAltContractsBelow (ctx : Ctx) (cur : FnDef)
+    (numArgs : Nat) (alts : Array Alt) (limit : Nat) : Prop :=
+  ∀ {cidx tag fieldCount : Nat} {body : Code},
+    alts.find? (fun alt => alt.cidx == cidx) =
+        some (.mk tag fieldCount body) →
+      AltOwnershipContractBelow ctx cur (.mk tag fieldCount body) .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots limit
+
+/-- Restrict a completed recursor alternative bundle to a fuel prefix. -/
+theorem RecursorAltContracts.below {ctx : Ctx} {cur : FnDef}
+    {numArgs : Nat} {alts : Array Alt}
+    (hcontracts : RecursorAltContracts ctx cur numArgs alts)
+    (limit : Nat) :
+    RecursorAltContractsBelow ctx cur numArgs alts limit := by
+  intro cidx tag fieldCount body hfind
+  exact (hcontracts hfind).below limit
+
+/-- Bounded recursor alternative bundles are contravariant in their bound. -/
+theorem RecursorAltContractsBelow.mono {ctx : Ctx} {cur : FnDef}
+    {numArgs : Nat} {alts : Array Alt} {smaller larger : Nat}
+    (hcontracts : RecursorAltContractsBelow ctx cur numArgs alts larger)
+    (hbound : smaller ≤ larger) :
+    RecursorAltContractsBelow ctx cur numArgs alts smaller := by
+  intro cidx tag fieldCount body hfind
+  exact (hcontracts hfind).mono hbound
+
+/-- Bounded ownership specialization of the shared traversal family. -/
+abbrev RecursorRulesPlanBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (src : IxIR0.Env) (fuel numArgs : Nat) :=
+  RecursorRulesPlanWith
+    (fun alt => AltOwnershipContractBelow ctx cur alt .shared
+      (RecursorEntryValid numArgs) recursorEntryRoots limit)
+    src fuel numArgs
+
+/-- Public empty bounded-plan constructor retained across the generic spine. -/
+theorem RecursorRulesPlanBelow.nil {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel numArgs : Nat}
+    (state : LowSt) :
+    RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state [] state [] :=
+  RecursorRulesPlanWith.nil state
+
+/-- Public bounded-plan step constructor retained across the generic spine. -/
+theorem RecursorRulesPlanBelow.cons {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state middleState finalState : LowSt}
+    {rule : IxIR0.RecRule} {tag : Nat}
+    {rules : List (IxIR0.RecRule × Nat)} {alt : Alt} {alts : List Alt}
+    (hhead : (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+      .ok alt middleState)
+    (hcontract : AltOwnershipContractBelow ctx cur alt .shared
+      (RecursorEntryValid numArgs) recursorEntryRoots limit)
+    (tail : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      middleState rules finalState alts) :
+    RecursorRulesPlanBelow ctx cur limit src fuel numArgs state
+      ((rule, tag) :: rules) finalState (alt :: alts) :=
+  RecursorRulesPlanWith.cons hhead hcontract tail
+
+/-- Bounded-plan compatibility wrapper for the shared run theorem. -/
+theorem RecursorRulesPlanBelow.run {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state rules finalState alts) :
+    (rules.mapM (lowerRecursorRule src fuel numArgs)).run state =
+      .ok alts finalState :=
+  RecursorRulesPlanWith.run hplan
+
+/-- Bounded-plan compatibility wrapper for shared contract membership. -/
+theorem RecursorRulesPlanBelow.forall_mem {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state rules finalState alts) :
+    ∀ alt ∈ alts,
+      AltOwnershipContractBelow ctx cur alt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots limit :=
+  RecursorRulesPlanWith.forall_mem hplan
+
+/-- Trace any generated alternative back to the exact source rule/tag run
+that produced it, retaining the remaining proof-relevant tail from that
+point to the traversal's final compiler state. -/
+theorem RecursorRulesPlanBelow.trace_mem {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state rules finalState alts) :
+    ∀ alt ∈ alts,
+      ∃ rule tag headState nextState tailRules tailAlts,
+        (rule, tag) ∈ rules ∧
+        (lowerRecursorRule src fuel numArgs (rule, tag)).run headState =
+          .ok alt nextState ∧
+        RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+          nextState tailRules finalState tailAlts := by
+  exact RecursorRulesPlanWith.traverse
+    (Result := fun _ currentRules currentFinal currentAlts =>
+      ∀ selected ∈ currentAlts,
+        ∃ rule tag headState nextState tailRules tailAlts,
+          (rule, tag) ∈ currentRules ∧
+          (lowerRecursorRule src fuel numArgs (rule, tag)).run headState =
+            .ok selected nextState ∧
+          RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+            nextState tailRules currentFinal tailAlts)
+    (hnil := by
+      intro current selected hmember
+      simp at hmember)
+    (hcons := by
+      intro state middleState finalState rule tag rules alt alts
+        hhead hcontract tail ih selected hmember
+      simp only [List.mem_cons] at hmember
+      rcases hmember with rfl | htail
+      · exact ⟨rule, tag, state, middleState, rules, alts,
+          by simp, hhead, tail⟩
+      · obtain ⟨foundRule, foundTag, headState, nextState,
+            tailRules, tailAlts, hfound, hrun, htailPlan⟩ :=
+          ih selected htail
+        exact ⟨foundRule, foundTag, headState, nextState,
+          tailRules, tailAlts, by simp [hfound], hrun, htailPlan⟩)
+    (hplan := hplan)
+
+/-- A bounded traversal supplies every selection-indexed alternative
+contract used by the exact-fuel recursor collector. -/
+theorem RecursorRulesPlanBelow.altContracts {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel numArgs : Nat}
+    {state finalState : LowSt} {rules : List (IxIR0.RecRule × Nat)}
+    {alts : List Alt}
+    (hplan : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state rules finalState alts) :
+    RecursorAltContractsBelow ctx cur numArgs alts.toArray limit := by
+  intro cidx tag fieldCount body hfind
+  apply hplan.forall_mem (.mk tag fieldCount body)
+  simpa using Array.mem_of_find?_eq_some hfind
+
+private theorem lowerSimExceptBindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+/-- At one exact evaluator index, bounded contracts for every selectable
+alternative preserve the public all-shared recursor boundary. -/
+theorem recursorFnOwnershipPreservesAt (ctx : Ctx) (numArgs : Nat)
+    (natLit : Bool) (alts : Array Alt) (fuel : Nat) :
+    let d : FnDef :=
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts⟩
+    RecursorAltContractsBelow ctx d numArgs alts fuel →
+      FnOwnershipPreservesAt ctx d
+        (List.replicate (numArgs + 1) .shared) fuel := by
+  dsimp only
+  let d : FnDef :=
+    ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts⟩
+  intro hcontracts
+  intro store store' args value rest hargsLength hown hrun
+  have hargsArity : args.length = numArgs + 1 := by
+    simpa using hargsLength
+  have hrootShape :
+      rootsForWorlds (List.replicate (numArgs + 1) .shared) args =
+        rootsFor .shared args :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hargsArity
+  rw [hrootShape] at hown
+  cases fuel with
+  | zero => simp [runCode] at hrun
+  | succ branchFuel =>
+    cases hreverse : args.reverse with
+    | nil =>
+      have hargsNil : args = [] := by
+        have h := congrArg List.reverse hreverse
+        simpa using h
+      simp [hargsNil] at hargsArity
+    | cons major runtimePre =>
+      have hargsForm : args = runtimePre.reverse ++ [major] := by
+        have h := congrArg List.reverse hreverse
+        simpa [List.reverse_cons] using h
+      have hruntimePreLength : runtimePre.length = numArgs := by
+        rw [hargsForm] at hargsArity
+        simp only [List.length_append, List.length_reverse,
+          List.length_singleton] at hargsArity
+        omega
+      have hvalid (fields : Array RVal) :
+          RecursorEntryValid numArgs (major :: runtimePre) fields := by
+        exact ⟨runtimePre.reverse, major, by simpa using hruntimePreLength,
+          by simp⟩
+      have hentryOwn (fields : Array RVal) : RootOwnership store
+          (recursorEntryRoots (major :: runtimePre) fields ++ rest) := by
+        simpa [recursorEntryRoots, hargsForm, List.reverse_cons] using hown
+      have hmajorWorld : HasWorld store .shared major := by
+        apply hown.roots_world ⟨.shared, major⟩
+        apply List.mem_append_left rest
+        simp [rootsFor, hargsForm]
+      rw [hreverse] at hrun
+      change runCode ctx (branchFuel + 1) d store
+          (major :: runtimePre) (.case (.var 0) natLit alts) =
+        .ok (store', value) at hrun
+      have hdispatch := hrun
+      rw [runCode.eq_def] at hdispatch
+      dsimp only at hdispatch
+      rw [show resolveAtom (major :: runtimePre) (.var 0) = .ok major
+        from rfl, lowerSimExceptBindOk] at hdispatch
+      cases major with
+      | erased => contradiction
+      | lit literal =>
+        cases literal with
+        | str string => contradiction
+        | nat n =>
+          cases hpeel : natLit with
+          | false => simp [hpeel] at hdispatch
+          | true =>
+            cases n with
+            | zero =>
+              cases halt : alts.find? (fun alt => alt.cidx == 0) with
+              | none => simp [hpeel, halt] at hdispatch
+              | some alt =>
+                cases alt with
+                | mk tag fieldCount body =>
+                  cases fieldCount with
+                  | zero =>
+                    exact runCode_case_nat_zero_contract_owned_below
+                      (ctx := ctx) (fuel := branchFuel) (cur := d)
+                      (store := store) (store' := store')
+                      (env := .lit (.nat 0) :: runtimePre)
+                      (scrut := .var 0)
+                      (alts := alts) (tag := tag) (body := body)
+                      (value := value) (rest := rest)
+                      (fieldWorld := .shared)
+                      (entryValid := RecursorEntryValid numArgs)
+                      (entryRoots := recursorEntryRoots)
+                      rfl halt (hcontracts halt) (hvalid #[])
+                      (hentryOwn #[]) (by simpa [hpeel] using hrun)
+                  | succ fieldCount =>
+                    simp [hpeel, halt] at hdispatch
+            | succ n =>
+              cases halt : alts.find? (fun alt => alt.cidx == 1) with
+              | none => simp [hpeel, halt] at hdispatch
+              | some alt =>
+                cases alt with
+                | mk tag fieldCount body =>
+                  by_cases hfieldCount : fieldCount = 1
+                  · subst fieldCount
+                    exact runCode_case_nat_succ_contract_owned_below
+                      (ctx := ctx) (fuel := branchFuel) (cur := d)
+                      (store := store) (store' := store')
+                      (env := .lit (.nat (n + 1)) :: runtimePre)
+                      (scrut := .var 0)
+                      (alts := alts) (n := n) (tag := tag) (body := body)
+                      (value := value) (rest := rest)
+                      (fieldWorld := .shared)
+                      (entryValid := RecursorEntryValid numArgs)
+                      (entryRoots := recursorEntryRoots)
+                      rfl halt (hcontracts halt)
+                      (hvalid #[.lit (.nat n)])
+                      (hentryOwn #[.lit (.nat n)])
+                      (by simpa [hpeel] using hrun)
+                  · simp [hpeel, halt, hfieldCount] at hdispatch
+      | loc loc =>
+        obtain ⟨ownedBox, hownedBox, hownedWorld⟩ := hmajorWorld
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at hownedBox
+          contradiction
+        | some box =>
+          rw [hget] at hownedBox
+          have hboxEq : box = ownedBox := Option.some.inj hownedBox
+          subst ownedBox
+          cases box with
+          | mk boxWorld rc node =>
+            dsimp only [NodeBox.world] at hownedWorld
+            subst boxWorld
+            cases node with
+            | papN fn arity papArgs =>
+              simp [hget] at hdispatch
+            | ctorN cid fields =>
+              cases halt : alts.find?
+                  (fun alt => alt.cidx == cid.cidx) with
+              | none => simp [hget, halt] at hdispatch
+              | some alt =>
+                cases alt with
+                | mk tag fieldCount body =>
+                  by_cases hsize : fields.size = fieldCount
+                  · exact runCode_case_ctor_contract_owned_below
+                      (ctx := ctx) (fuel := branchFuel) (cur := d)
+                      (store := store) (store' := store')
+                      (env := .loc loc :: runtimePre) (scrut := .var 0)
+                      (peelNat := natLit) (alts := alts) (loc := loc)
+                      (rc := rc) (world := .shared) (cid := cid)
+                      (fields := fields) (tag := tag)
+                      (nf := fieldCount) (body := body) (value := value)
+                      (rest := rest)
+                      (entryValid := RecursorEntryValid numArgs)
+                      (entryRoots := recursorEntryRoots)
+                      rfl hget halt hsize (hcontracts halt)
+                      (hvalid fields) (hentryOwn fields) hrun
+                  · simp [hget, halt, hsize] at hdispatch
+
+/-- Collecting completed contracts for every selectable alternative yields
+the public unbounded recursor contract. The implementation now seals the
+exact-fuel collector above, so recursive alternatives need only smaller-fuel
+self contracts when constructed by the mutual compiler proof. -/
+theorem recursorFnOwnershipContract (ctx : Ctx) (numArgs : Nat)
+    (natLit : Bool) (alts : Array Alt) :
+    let d : FnDef :=
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts⟩
+    RecursorAltContracts ctx d numArgs alts →
+      FnOwnershipContract ctx d
+        (List.replicate (numArgs + 1) .shared) := by
+  dsimp only
+  let d : FnDef :=
+    ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts⟩
+  intro hcontracts
+  apply fnOwnershipContract_of_below_step (by simp)
+  intro limit _
+  exact recursorFnOwnershipPreservesAt ctx numArgs natLit alts limit
+    (hcontracts.below limit)
+
+/-- Shared finalizer for a generated recursor. The result family lets exact
+contract sealing and one-index preservation remain distinct while target
+definition normalization and executable rule-traversal reconstruction occur
+once. -/
+private theorem lowerRecursor_generated_verified_core
+    (src : IxIR0.Env) (fuel numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) (state finalState : LowSt)
+    (alts : List Alt) (d : FnDef)
+    (hd : d = ⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alts.toArray⟩)
+    {Plan Result : FnDef → Prop}
+    (hplan : Plan d)
+    (hplanRun : ∀ {actual}, Plan actual →
+      (rules.toList.zipIdx.mapM
+        (lowerRecursorRule src fuel numArgs)).run state =
+          .ok alts finalState)
+    (hresult : Plan ⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alts.toArray⟩ →
+      Result ⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩) :
+    (lowerRecursor src fuel numArgs natLit rules).run state =
+        .ok d finalState ∧
+      Result d := by
+  subst d
+  constructor
+  · simp only [lowerRecursor]
+    rw [estateBindRun, hplanRun hplan]
+    rfl
+  · exact hresult hplan
+
+/-- Complete generated-recursors rule: an exact state-threaded traversal of
+the compiler's indexed rule list yields both the executable `lowerRecursor`
+result and its public `FnOwnershipContract`. -/
+theorem lowerRecursor_generated_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) (state finalState : LowSt)
+    (alts : List Alt) (d : FnDef)
+    (hd : d = ⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alts.toArray⟩)
+    (hplan : RecursorRulesPlan ctx d src fuel numArgs state
+      rules.toList.zipIdx finalState alts) :
+    (lowerRecursor src fuel numArgs natLit rules).run state =
+        .ok d finalState ∧
+      FnOwnershipContract ctx d
+        (List.replicate (numArgs + 1) .shared) := by
+  exact lowerRecursor_generated_verified_core
+    (Plan := fun actual =>
+      RecursorRulesPlan ctx actual src fuel numArgs state
+        rules.toList.zipIdx finalState alts)
+    (Result := fun actual => FnOwnershipContract ctx actual
+      (List.replicate (numArgs + 1) .shared))
+    src fuel numArgs natLit rules state finalState alts d hd hplan
+    (fun plan => plan.run)
+    (fun plan => recursorFnOwnershipContract ctx numArgs natLit alts.toArray
+      plan.altContracts)
+
+/-- Exact-fuel generated-recursors rule. A bounded state-threaded rule plan
+produces both the executable recursor and its one-index ownership theorem;
+`compilerContracts_of_below_step` later seals these results globally. -/
+theorem lowerRecursor_generated_verified_below {ctx : Ctx}
+    (limit : Nat) (src : IxIR0.Env) (fuel numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) (state finalState : LowSt)
+    (alts : List Alt) (d : FnDef)
+    (hd : d = ⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alts.toArray⟩)
+    (hplan : RecursorRulesPlanBelow ctx d limit src fuel numArgs state
+      rules.toList.zipIdx finalState alts) :
+    (lowerRecursor src fuel numArgs natLit rules).run state =
+        .ok d finalState ∧
+      FnOwnershipPreservesAt ctx d
+        (List.replicate (numArgs + 1) .shared) limit := by
+  exact lowerRecursor_generated_verified_core
+    (Plan := fun actual =>
+      RecursorRulesPlanBelow ctx actual limit src fuel numArgs state
+        rules.toList.zipIdx finalState alts)
+    (Result := fun actual => FnOwnershipPreservesAt ctx actual
+      (List.replicate (numArgs + 1) .shared) limit)
+    src fuel numArgs natLit rules state finalState alts d hd hplan
+    (fun plan => plan.run)
+    (fun plan => recursorFnOwnershipPreservesAt ctx numArgs natLit
+      alts.toArray limit plan.altContracts)
+
+/-! ## Source/target declaration-contract environment -/
+
+/-- The callable target signature determined by a source declaration.
+Constructors lower directly at use sites and externs remain target externs,
+so only definitions and recursors contribute function contracts. -/
+def sourceCallableSignature : IxIR0.Decl →
+    Option (List Owned × Owned)
+  | .defn result body =>
+      some ((lamUses body).map worldOfUses, result)
+  | .recursor numArgs _ _ =>
+      some (List.replicate (numArgs + 1) .shared, .shared)
+  | .ctor _ _ | .extern _ => none
+
+/-- Callable source branches of `lowerDecl` always emit a function at the
+same address; constructors and externs have no source callable signature. -/
+theorem lowerDecl_output_fn_of_callable
+    {src : IxIR0.Env} {fuel : Nat} {address : Ixon.Address}
+    {source : IxIR0.Decl} {worlds : List Owned}
+    {resultWorld : Owned} {initial final : LowSt}
+    {output : Option (Ixon.Address × Decl)}
+    (hsignature : sourceCallableSignature source =
+      some (worlds, resultWorld))
+    (hrun : (lowerDecl src fuel (address, source)).run initial =
+      .ok output final) :
+    ∃ d, output = some (address, .fn d) := by
+  cases source with
+  | defn result body =>
+    simp only [lowerDecl] at hrun
+    obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+      estateBindRun_ok_inv hrun
+    have hpure : some (address, Decl.fn
+        ⟨lamArity body, result, result == .shared && papSafe body, code⟩) = output ∧
+        bodyState = final := by
+      simpa using hpureRun
+    exact ⟨⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩, hpure.1.symm⟩
+  | ctor tag arity => simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+    simp only [lowerDecl] at hrun
+    obtain ⟨d, recursorState, hrecursorRun, hpureRun⟩ :=
+      estateBindRun_ok_inv hrun
+    have hpure : some (address, Decl.fn d) = output ∧
+        recursorState = final := by
+      simpa using hpureRun
+    exact ⟨d, hpure.1.symm⟩
+  | extern arity => simp [sourceCallableSignature] at hsignature
+
+/-- Callable declaration lowering preserves the source signature in the
+emitted same-address function.  This is the fuel-independent layout half of
+the eventual ownership contract. -/
+theorem lowerDecl_output_fn_layout_of_callable
+    {src : IxIR0.Env} {fuel : Nat} {address : Ixon.Address}
+    {source : IxIR0.Decl} {worlds : List Owned}
+    {resultWorld : Owned} {initial final : LowSt}
+    {output : Option (Ixon.Address × Decl)}
+    (hsignature : sourceCallableSignature source =
+      some (worlds, resultWorld))
+    (hrun : (lowerDecl src fuel (address, source)).run initial =
+      .ok output final) :
+    ∃ d, output = some (address, .fn d) ∧
+      d.arity = worlds.length ∧ d.result = resultWorld := by
+  cases source with
+  | defn result body =>
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simp only [lowerDecl] at hrun
+      obtain ⟨code, bodyState, _, hpureRun⟩ :=
+        estateBindRun_ok_inv hrun
+      have hpure :
+          some (address, Decl.fn
+            ⟨lamArity body, result,
+              result == .shared && papSafe body, code⟩) = output ∧
+            bodyState = final := by
+        simpa using hpureRun
+      refine ⟨⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩,
+        hpure.1.symm, ?_, rfl⟩
+      simp [lamUses_length]
+  | ctor tag arity => simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simp only [lowerDecl] at hrun
+      obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+        estateBindRun_ok_inv hrun
+      simp only [lowerRecursor] at hrecursorRun
+      obtain ⟨alts, rulesState, _, hafterRules⟩ :=
+        estateBindRun_ok_inv hrecursorRun
+      have hactual : actual =
+          ⟨numArgs + 1, .shared, true,
+            .case (.var 0) natLit alts.toArray⟩ := by
+        have hpure :
+            (⟨numArgs + 1, .shared, true,
+              .case (.var 0) natLit alts.toArray⟩ : FnDef) = actual ∧
+              rulesState = recursorState := by
+          simpa using hafterRules
+        exact hpure.1.symm
+      subst actual
+      have hpure :
+          some (address, Decl.fn
+            ⟨numArgs + 1, .shared, true,
+              .case (.var 0) natLit alts.toArray⟩) = output ∧
+            recursorState = final := by
+        simpa using hafterRecursor
+      refine ⟨⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩,
+        hpure.1.symm, by simp, rfl⟩
+  | extern arity => simp [sourceCallableSignature] at hsignature
+
+/-- If one declaration action returned a function, its input was a callable
+source declaration at the same producer address. -/
+theorem lowerDecl_fn_output_input_callable
+    {src : IxIR0.Env} {fuel : Nat}
+    {sourceAddress address : Ixon.Address} {source : IxIR0.Decl}
+    {initial final : LowSt} {d : FnDef}
+    (hrun : (lowerDecl src fuel (sourceAddress, source)).run initial =
+      .ok (some (address, .fn d)) final) :
+    sourceAddress = address ∧
+      ∃ worlds result,
+        sourceCallableSignature source = some (worlds, result) := by
+  cases source with
+  | defn result body =>
+      simp only [lowerDecl] at hrun
+      obtain ⟨code, bodyState, _, hpureRun⟩ :=
+        estateBindRun_ok_inv hrun
+      have hpure :
+          some (sourceAddress, Decl.fn
+            ⟨lamArity body, result,
+              result == .shared && papSafe body, code⟩) =
+              some (address, .fn d) ∧ bodyState = final := by
+        simpa using hpureRun
+      have haddress : sourceAddress = address :=
+        congrArg Prod.fst (Option.some.inj hpure.1)
+      exact ⟨haddress, ⟨(lamUses body).map worldOfUses, result, rfl⟩⟩
+  | ctor tag arity =>
+      simp [lowerDecl] at hrun
+  | recursor numArgs natLit rules =>
+      simp only [lowerDecl] at hrun
+      obtain ⟨actual, recursorState, _, hpureRun⟩ :=
+        estateBindRun_ok_inv hrun
+      have hpure :
+          some (sourceAddress, Decl.fn actual) =
+              some (address, .fn d) ∧ recursorState = final := by
+        simpa using hpureRun
+      have haddress : sourceAddress = address :=
+        congrArg Prod.fst (Option.some.inj hpure.1)
+      exact ⟨haddress,
+        ⟨List.replicate (numArgs + 1) .shared, .shared, rfl⟩⟩
+  | extern arity =>
+      simp [lowerDecl] at hrun
+
+/-- Fuel-independent correspondence between the source declaration map and
+the target context. The semantic contract is kept separate so all functions
+can be closed simultaneously by evaluator-fuel induction. -/
+structure SourceDeclLayout (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  fn : ∀ {address source worlds result},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = worlds.length ∧ d.result = result
+  extern : ∀ {address arity},
+    src address = some (.extern arity) →
+    ctx.decls address = some (.extern arity)
+
+/-- Pointwise ownership preservation of every source-backed target function
+at one exact evaluator-fuel index. -/
+def SourceFnPreservesAt (src : IxIR0.Env) (ctx : Ctx)
+    (fuel : Nat) : Prop :=
+  ∀ {address source worlds result d},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    FnOwnershipPreservesAt ctx d worlds fuel
+
+/-- The declaration environment's contracts restricted to evaluator indices
+strictly below `limit`. This is the mutual-call induction hypothesis used
+while proving every function at the exact index `limit`. -/
+structure SourceDeclContractsBelow (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) extends SourceDeclLayout src ctx where
+  fn_preserves : ∀ {fuel}, fuel < limit →
+    SourceFnPreservesAt src ctx fuel
+
+/-- Public, unbounded ownership contracts for every source-backed target
+function, together with exact declaration-layout correspondence. -/
+structure SourceDeclContracts (src : IxIR0.Env) (ctx : Ctx)
+    extends SourceDeclLayout src ctx where
+  fn_contract : ∀ {address source worlds result d},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    FnOwnershipContract ctx d worlds
+
+/-- Restrict a completed declaration environment to a fuel prefix. -/
+theorem SourceDeclContracts.below {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclContracts src ctx) (limit : Nat) :
+    SourceDeclContractsBelow src ctx limit := by
+  refine { toSourceDeclLayout := hcontracts.toSourceDeclLayout, fn_preserves := ?_ }
+  intro fuel _ address source worlds result d hsrc hsignature hdecl
+  exact (hcontracts.fn_contract hsrc hsignature hdecl).preserves
+
+/-- Fuel-prefix declaration environments are contravariant in the bound. -/
+theorem SourceDeclContractsBelow.mono {src : IxIR0.Env} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontracts : SourceDeclContractsBelow src ctx larger)
+    (hbound : smaller ≤ larger) :
+    SourceDeclContractsBelow src ctx smaller := by
+  refine { toSourceDeclLayout := hcontracts.toSourceDeclLayout, fn_preserves := ?_ }
+  intro fuel hfuel
+  exact hcontracts.fn_preserves (Nat.lt_of_lt_of_le hfuel hbound)
+
+/-- Recover the unique target function and its bounded contract from a
+callable source declaration. This is the lookup rule used by recursive
+`ref` lowering at one mutual-induction step. -/
+theorem SourceDeclContractsBelow.fnContract {src : IxIR0.Env} {ctx : Ctx}
+    {limit : Nat}
+    (hcontracts : SourceDeclContractsBelow src ctx limit)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Owned} {result : Owned}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source =
+      some (worlds, result)) :
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = worlds.length ∧ d.result = result ∧
+      FnOwnershipContractBelow ctx d worlds limit := by
+  obtain ⟨d, hdecl, harity, hresult⟩ :=
+    hcontracts.fn hsrc hsignature
+  refine ⟨d, hdecl, harity, hresult, ⟨harity.symm, ?_⟩⟩
+  intro fuel hfuel
+  exact hcontracts.fn_preserves hfuel hsrc hsignature hdecl
+
+/-- Bounded definition lookup in the source/target declaration environment. -/
+theorem SourceDeclContractsBelow.defn {src : IxIR0.Env} {ctx : Ctx}
+    {limit : Nat}
+    (hcontracts : SourceDeclContractsBelow src ctx limit)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    (hsrc : src address = some (.defn result body)) :
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = lamArity body ∧ d.result = result ∧
+      FnOwnershipContractBelow ctx d
+        ((lamUses body).map worldOfUses) limit := by
+  obtain ⟨d, hdecl, harity, hresult, hcontract⟩ :=
+    hcontracts.fnContract hsrc (by rfl)
+  exact ⟨d, hdecl, by simpa using harity, hresult, hcontract⟩
+
+/-- Bounded recursor lookup in the source/target declaration environment. -/
+theorem SourceDeclContractsBelow.recursor {src : IxIR0.Env} {ctx : Ctx}
+    {limit : Nat}
+    (hcontracts : SourceDeclContractsBelow src ctx limit)
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule}
+    (hsrc : src address = some (.recursor numArgs natLit rules)) :
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = numArgs + 1 ∧ d.result = .shared ∧
+      FnOwnershipContractBelow ctx d
+        (List.replicate (numArgs + 1) .shared) limit := by
+  obtain ⟨d, hdecl, harity, hresult, hcontract⟩ :=
+    hcontracts.fnContract hsrc (by rfl)
+  exact ⟨d, hdecl, by simpa using harity, hresult, hcontract⟩
+
+/-- Seal an exact-fuel mutual compiler proof into contracts for the whole
+declaration environment. At each index the proof producer may call any
+source-backed target function only through the strictly smaller environment;
+strong induction closes self recursion and mutually recursive calls alike. -/
+theorem sourceDeclContracts_of_below_step {src : IxIR0.Env} {ctx : Ctx}
+    (hlayout : SourceDeclLayout src ctx)
+    (hstep : ∀ limit,
+      SourceDeclContractsBelow src ctx limit →
+      SourceFnPreservesAt src ctx limit) :
+    SourceDeclContracts src ctx := by
+  have hall : ∀ fuel, SourceFnPreservesAt src ctx fuel := by
+    intro fuel
+    induction fuel using Nat.strongRecOn with
+    | ind fuel ih =>
+      apply hstep fuel
+      refine { toSourceDeclLayout := hlayout, fn_preserves := ?_ }
+      intro prior hprior
+      exact ih prior hprior
+  refine { toSourceDeclLayout := hlayout, fn_contract := ?_ }
+  intro address source worlds result d hsrc hsignature hdecl
+  obtain ⟨d', hdecl', harity, _⟩ := hlayout.fn hsrc hsignature
+  have hd : d' = d := by
+    have hsame : some (Decl.fn d') = some (Decl.fn d) :=
+      hdecl'.symm.trans hdecl
+    exact Decl.fn.inj (Option.some.inj hsame)
+  subst d'
+  refine ⟨harity.symm, ?_⟩
+  intro fuel
+  exact hall fuel hsrc hsignature hdecl
+
+/-- Definition lookup specialized from the generic declaration contract
+environment. -/
+theorem SourceDeclContracts.defn {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclContracts src ctx)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    (hsrc : src address = some (.defn result body)) :
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = lamArity body ∧ d.result = result ∧
+      FnOwnershipContract ctx d ((lamUses body).map worldOfUses) := by
+  obtain ⟨d, hdecl, harity, hresult⟩ :=
+    hcontracts.fn hsrc (by rfl)
+  refine ⟨d, hdecl, ?_, hresult, ?_⟩
+  · simpa using harity
+  · exact hcontracts.fn_contract hsrc (by rfl) hdecl
+
+/-- Recursor lookup specialized from the generic declaration contract
+environment. -/
+theorem SourceDeclContracts.recursor {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclContracts src ctx)
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule}
+    (hsrc : src address = some (.recursor numArgs natLit rules)) :
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = numArgs + 1 ∧ d.result = .shared ∧
+      FnOwnershipContract ctx d
+        (List.replicate (numArgs + 1) .shared) := by
+  obtain ⟨d, hdecl, harity, hresult⟩ :=
+    hcontracts.fn hsrc (by rfl)
+  exact ⟨d, hdecl, by simpa using harity, hresult,
+    hcontracts.fn_contract hsrc (by rfl) hdecl⟩
+
+/-- The two recursive semantic obligations of a closed lowering context:
+source-backed direct calls and higher-order pap application. -/
+def CompilerPreservesAt (src : IxIR0.Env) (ctx : Ctx)
+    (fuel : Nat) : Prop :=
+  SourceFnPreservesAt src ctx fuel ∧ ApplyOwnershipPreservesAt ctx fuel
+
+/-- Mutual compiler contracts available below one evaluator-fuel bound. -/
+structure CompilerContractsBelow (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) : Prop where
+  decls : SourceDeclContractsBelow src ctx limit
+  apply : ApplyOwnershipContractBelow ctx limit
+
+/-- Completed direct-call and higher-order-application contracts for a
+closed lowering context. -/
+structure CompilerContracts (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  decls : SourceDeclContracts src ctx
+  apply : ApplyOwnershipContract ctx
+
+/-- Restrict all completed compiler contracts to a fuel prefix. -/
+theorem CompilerContracts.below {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : CompilerContracts src ctx) (limit : Nat) :
+    CompilerContractsBelow src ctx limit :=
+  ⟨hcontracts.decls.below limit, hcontracts.apply.below limit⟩
+
+/-- The combined bounded environment is contravariant in its bound. -/
+theorem CompilerContractsBelow.mono {src : IxIR0.Env} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontracts : CompilerContractsBelow src ctx larger)
+    (hbound : smaller ≤ larger) :
+    CompilerContractsBelow src ctx smaller :=
+  ⟨hcontracts.decls.mono hbound, hcontracts.apply.mono hbound⟩
+
+/-- Seal the exact-fuel output of the mutual compiler proof into both public
+context contracts at once. The producer at `limit` receives only contracts
+below `limit`, so direct recursion, cross-declaration calls, and `applyGo`
+cycles are all justified by the evaluator's strict fuel decrease. -/
+theorem compilerContracts_of_below_step {src : IxIR0.Env} {ctx : Ctx}
+    (hlayout : SourceDeclLayout src ctx)
+    (hstep : ∀ limit,
+      CompilerContractsBelow src ctx limit →
+      CompilerPreservesAt src ctx limit) :
+    CompilerContracts src ctx := by
+  have hall : ∀ fuel, CompilerPreservesAt src ctx fuel := by
+    intro fuel
+    induction fuel using Nat.strongRecOn with
+    | ind fuel ih =>
+      apply hstep fuel
+      refine ⟨?_, ?_⟩
+      · refine { toSourceDeclLayout := hlayout, fn_preserves := ?_ }
+        intro prior hprior
+        exact (ih prior hprior).1
+      · refine ⟨?_⟩
+        intro prior hprior
+        exact (ih prior hprior).2
+  refine ⟨?_, ?_⟩
+  · apply sourceDeclContracts_of_below_step hlayout
+    intro limit _
+    exact (hall limit).1
+  · apply applyOwnershipContract_of_below_step
+    intro limit _
+    exact (hall limit).2
+
+/-! ## Closing source-backed and generated declarations together -/
+
+/-- Exact-index ownership preservation for every function accumulated in a
+successful lowering state. Generated functions are all-shared at their public
+capture-plus-parameter boundary. -/
+def ExtraFnPreservesAt (ctx : Ctx) (state : LowSt) (fuel : Nat) : Prop :=
+  ∀ {address d}, (address, .fn d) ∈ state.extra →
+    d.result = .shared ∧
+      FnOwnershipPreservesAt ctx d
+        (List.replicate d.arity .shared) fuel
+
+/-- The result-world half of the generated-function invariant is independent
+of evaluator fuel. -/
+def ExtraFnResultsShared (state : LowSt) : Prop :=
+  ∀ {address d}, (address, .fn d) ∈ state.extra →
+    d.result = .shared
+
+structure ExtraFnContractsBelow (ctx : Ctx) (state : LowSt)
+    (limit : Nat) : Prop where
+  fn_result : ExtraFnResultsShared state
+  fn_preserves : ∀ {fuel}, fuel < limit →
+    ExtraFnPreservesAt ctx state fuel
+
+structure ExtraFnContracts (ctx : Ctx) (state : LowSt) : Prop where
+  fn_contract : ∀ {address d}, (address, .fn d) ∈ state.extra →
+    d.result = .shared ∧
+      FnOwnershipContract ctx d (List.replicate d.arity .shared)
+
+theorem ExtraFnContracts.below {ctx : Ctx} {state : LowSt}
+    (hcontracts : ExtraFnContracts ctx state) (limit : Nat) :
+    ExtraFnContractsBelow ctx state limit := by
+  refine ⟨fun hmember => (hcontracts.fn_contract hmember).1, ?_⟩
+  intro fuel _ address d hmember
+  obtain ⟨hresult, hcontract⟩ := hcontracts.fn_contract hmember
+  exact ⟨hresult, hcontract.preserves⟩
+
+theorem ExtraFnContractsBelow.mono {ctx : Ctx} {state : LowSt}
+    {smaller larger : Nat}
+    (hcontracts : ExtraFnContractsBelow ctx state larger)
+    (hbound : smaller ≤ larger) :
+    ExtraFnContractsBelow ctx state smaller := by
+  refine ⟨hcontracts.fn_result, ?_⟩
+  intro fuel hfuel
+  exact hcontracts.fn_preserves (Nat.lt_of_lt_of_le hfuel hbound)
+
+/-- Every source-backed callable has the homogeneous shared signature needed
+for it to be a legal target of an arbitrary pap. -/
+def SourceAllShared (src : IxIR0.Env) : Prop :=
+  ∀ {address source worlds result},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    result = .shared ∧
+      worlds = List.replicate worlds.length .shared
+
+/-- A source-backed callable needs the homogeneous shared signature only when
+its lowered declaration permits dynamic PAP entry. Direct calls to declarations
+with unique or affine boundaries remain legal because they bypass `applyGo`.
+Keeping this premise owner-sensitive is what lets mixed-mode programs close the
+same whole-context compiler contracts as all-shared programs. -/
+def SourcePapSafe (src : IxIR0.Env) (ctx : Ctx) : Prop :=
+  ∀ {address source worlds result d},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    d.papSafe = true →
+    result = .shared ∧
+      worlds = List.replicate worlds.length .shared
+
+/-- The former global all-shared premise is a sufficient, but no longer
+necessary, way to establish owner-sensitive PAP safety. -/
+theorem SourceAllShared.papSafe {src : IxIR0.Env} {ctx : Ctx}
+    (hshared : SourceAllShared src) : SourcePapSafe src ctx := by
+  intro address source worlds result d hsrc hsignature _ _
+  exact hshared hsrc hsignature
+
+/-- `SourcePapSafe` is genuinely weaker than the former global all-shared
+premise: a unique-boundary declaration remains available to direct calls when
+its target declaration rejects shared-PAP entry. -/
+theorem sourcePapSafe_not_sourceAllShared :
+    ∃ src ctx, SourcePapSafe src ctx ∧ ¬ SourceAllShared src := by
+  let address : Ixon.Address := Ixon.Address.replicate 0xA5
+  let source : IxIR0.Decl :=
+    .defn .unique (.lam .affine (.var 0))
+  let target : FnDef :=
+    ⟨1, .unique, false, .ret (.var 0)⟩
+  let src : IxIR0.Env := fun candidate =>
+    if candidate = address then some source else none
+  let ctx : Ctx :=
+    { decls := fun candidate =>
+        if candidate = address then some (.fn target) else none }
+  refine ⟨src, ctx, ?_, ?_⟩
+  · intro candidate found worlds result d hsrc hsignature hdecl hsafe
+    have hcandidate : candidate = address := by
+      by_cases heq : candidate = address
+      · exact heq
+      · simp [src, heq] at hsrc
+    subst candidate
+    have htarget : target = d := by
+      simpa [ctx] using hdecl
+    subst d
+    simp [target] at hsafe
+  · intro hshared
+    have h := hshared (address := address) (source := source)
+      (worlds := [.unique]) (result := .unique)
+      (by simp [src]) (by simp [source, sourceCallableSignature, lamUses,
+        worldOfUses])
+    cases h.1
+
+/-- Every target function is either the lowering of the same-address source
+callable or an exact generated-state member. -/
+def FnDeclCovered (src : IxIR0.Env) (ctx : Ctx) (state : LowSt) : Prop :=
+  ∀ {address d}, ctx.decls address = some (.fn d) →
+    (∃ source worlds result,
+      src address = some source ∧
+      sourceCallableSignature source = some (worlds, result)) ∨
+    (address, .fn d) ∈ state.extra
+
+/-- Source and generated contracts cover exactly the declarations admitted by
+the evaluator's dynamic PAP-entry check. -/
+theorem papSafeDeclContractsBelow_of_source_extra
+    {src : IxIR0.Env} {ctx : Ctx} {state : LowSt} {limit : Nat}
+    (hsource : SourceDeclContractsBelow src ctx limit)
+    (hextra : ExtraFnContractsBelow ctx state limit)
+    (hpapsafe : SourcePapSafe src ctx)
+    (hcovered : FnDeclCovered src ctx state) :
+    PapSafeDeclContractsBelow ctx limit := by
+  refine ⟨?_⟩
+  intro address d hdecl hsafe
+  cases hcovered hdecl with
+  | inl hsourceMember =>
+    obtain ⟨source, worlds, result, hsrc, hsignature⟩ := hsourceMember
+    obtain ⟨target, htargetDecl, harity, hresult, hcontract⟩ :=
+      hsource.fnContract hsrc hsignature
+    have htarget : target = d := by
+      have heq : some (Decl.fn target) = some (Decl.fn d) :=
+        htargetDecl.symm.trans hdecl
+      exact Decl.fn.inj (Option.some.inj heq)
+    subst target
+    obtain ⟨hsourceResult, hworlds⟩ :=
+      hpapsafe hsrc hsignature hdecl hsafe
+    have hresultShared : d.result = .shared :=
+      hresult.trans hsourceResult
+    have hworlds' : worlds = List.replicate d.arity .shared := by
+      rw [hworlds, harity]
+    rw [hworlds'] at hcontract
+    exact ⟨hresultShared, hcontract⟩
+  | inr hextraMember =>
+    have hpreserves := fun {fuel} (hfuel : fuel < limit) =>
+      hextra.fn_preserves hfuel hextraMember
+    refine ⟨hextra.fn_result hextraMember, ⟨by simp, ?_⟩⟩
+    intro fuel hfuel
+    exact (hpreserves hfuel).2
+
+/-- Jointly seal source declarations, generated declarations, and pap
+application. At the current evaluator index the producer receives only the
+three strictly smaller environments, so the cycle remains contractive. -/
+theorem compilerContracts_of_source_extra_below_step
+    {src : IxIR0.Env} {ctx : Ctx} {state : LowSt}
+    (hlayout : SourceDeclLayout src ctx)
+    (hpapsafe : SourcePapSafe src ctx)
+    (hextraResults : ExtraFnResultsShared state)
+    (hcovered : FnDeclCovered src ctx state)
+    (hstep : ∀ limit,
+      SourceDeclContractsBelow src ctx limit →
+      ExtraFnContractsBelow ctx state limit →
+      ApplyOwnershipContractBelow ctx limit →
+      SourceFnPreservesAt src ctx limit ∧
+        ExtraFnPreservesAt ctx state limit) :
+    CompilerContracts src ctx ∧ ExtraFnContracts ctx state := by
+  have hall : ∀ fuel,
+      SourceFnPreservesAt src ctx fuel ∧
+        ExtraFnPreservesAt ctx state fuel ∧
+        ApplyOwnershipPreservesAt ctx fuel := by
+    intro fuel
+    induction fuel using Nat.strongRecOn with
+    | ind fuel ih =>
+      let hsourceBelow : SourceDeclContractsBelow src ctx fuel :=
+        { toSourceDeclLayout := hlayout
+          fn_preserves := fun hprior => (ih _ hprior).1 }
+      let hextraBelow : ExtraFnContractsBelow ctx state fuel :=
+        ⟨hextraResults, fun hprior => (ih _ hprior).2.1⟩
+      let happlyBelow : ApplyOwnershipContractBelow ctx fuel :=
+        ⟨fun hprior => (ih _ hprior).2.2⟩
+      have hfunctions := hstep fuel hsourceBelow hextraBelow happlyBelow
+      have hdecls := papSafeDeclContractsBelow_of_source_extra
+        hsourceBelow hextraBelow hpapsafe hcovered
+      exact ⟨hfunctions.1, hfunctions.2,
+        applyOwnershipPreservesAt_of_papSafeDeclsBelow hdecls happlyBelow⟩
+  have hsourceContracts : SourceDeclContracts src ctx :=
+    sourceDeclContracts_of_below_step hlayout fun limit _ => (hall limit).1
+  have hextraContracts : ExtraFnContracts ctx state := by
+    refine ⟨?_⟩
+    intro address d hmember
+    have hresult := (hall 0).2.1 hmember |>.1
+    refine ⟨hresult, ⟨by simp, ?_⟩⟩
+    intro fuel
+    exact (hall fuel).2.1 hmember |>.2
+  have happlyContract : ApplyOwnershipContract ctx :=
+    applyOwnershipContract_of_below_step fun limit _ => (hall limit).2.2
+  exact ⟨⟨hsourceContracts, happlyContract⟩, hextraContracts⟩
+
+/-! ## Whole-pass target statements
+
+These definitions make the four independently checkable M2b claims concrete.
+They are deliberately separate: semantic value correspondence does not hide
+memory progress, reclamation, or counter obligations. -/
+
+/-! ## Semantic call and application contracts -/
+
+/-- Left-to-right source evaluation of an argument vector. Each argument may
+use its own sufficient fuel: source fuel is a totality witness rather than a
+cost, and the compiler proof only needs the resulting values in source order.
+Keeping this relation on expression lists (rather than world-annotated
+compiler arguments) makes it reusable by both `lowerSpine` and `applyRest`. -/
+inductive SourceArgsEval (sourceCtx : IxIR0.Ctx)
+    (sourceEnv : List IxIR0.Value) :
+    List IxIR0.Expr → List IxIR0.Value → Prop where
+  | nil : SourceArgsEval sourceCtx sourceEnv [] []
+  | cons {expr : IxIR0.Expr} {value : IxIR0.Value}
+      {expressions : List IxIR0.Expr} {values : List IxIR0.Value}
+      {fuel : Nat} :
+      IxIR0.eval sourceCtx fuel sourceEnv expr = .ok value →
+      SourceArgsEval sourceCtx sourceEnv expressions values →
+      SourceArgsEval sourceCtx sourceEnv
+        (expr :: expressions) (value :: values)
+
+/-- Dependent lockstep traversal of source argument expressions and their
+evaluated values.  Each callback receives the exact head evaluation and the
+original tail witness together with the recursively produced result. -/
+theorem SourceArgsEval.traverse {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value}
+    {Result : List IxIR0.Expr → List IxIR0.Value → Prop}
+    (hnil : Result [] [])
+    (hcons : ∀ {expr : IxIR0.Expr} {value : IxIR0.Value}
+        {expressions : List IxIR0.Expr} {values : List IxIR0.Value}
+        {fuel : Nat},
+      IxIR0.eval sourceCtx fuel sourceEnv expr = .ok value →
+      SourceArgsEval sourceCtx sourceEnv expressions values →
+      Result expressions values →
+      Result (expr :: expressions) (value :: values))
+    {expressions : List IxIR0.Expr} {values : List IxIR0.Value}
+    (hargs : SourceArgsEval sourceCtx sourceEnv expressions values) :
+    Result expressions values := by
+  induction hargs with
+  | nil => exact hnil
+  | cons heval htail ih => exact hcons heval htail ih
+
+@[simp] theorem SourceArgsEval.lengths {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : SourceArgsEval sourceCtx sourceEnv expressions values) :
+    expressions.length = values.length := by
+  exact SourceArgsEval.traverse
+    (Result := fun currentExpressions currentValues =>
+      currentExpressions.length = currentValues.length)
+    (hnil := rfl)
+    (hcons := by
+      intro expr value currentExpressions currentValues fuel heval htail ih
+      simp [ih])
+    hargs
+
+/-- Source argument evaluation restricts to the same prefix on both sides. -/
+theorem SourceArgsEval.take {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : SourceArgsEval sourceCtx sourceEnv expressions values)
+    (count : Nat) :
+    SourceArgsEval sourceCtx sourceEnv
+      (expressions.take count) (values.take count) := by
+  exact (SourceArgsEval.traverse
+    (Result := fun currentExpressions currentValues =>
+      ∀ currentCount,
+        SourceArgsEval sourceCtx sourceEnv
+          (currentExpressions.take currentCount)
+          (currentValues.take currentCount))
+    (hnil := by
+      intro currentCount
+      simp
+      exact .nil)
+    (hcons := by
+      intro expr value currentExpressions currentValues fuel heval htail ih
+        currentCount
+      cases currentCount with
+      | zero => exact .nil
+      | succ currentCount =>
+        simpa using SourceArgsEval.cons heval (ih currentCount))
+    hargs) count
+
+/-- Source argument evaluation restricts to the corresponding suffix. -/
+theorem SourceArgsEval.drop {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {expressions : List IxIR0.Expr}
+    {values : List IxIR0.Value}
+    (hargs : SourceArgsEval sourceCtx sourceEnv expressions values)
+    (count : Nat) :
+    SourceArgsEval sourceCtx sourceEnv
+      (expressions.drop count) (values.drop count) := by
+  exact (SourceArgsEval.traverse
+    (Result := fun currentExpressions currentValues =>
+      ∀ currentCount,
+        SourceArgsEval sourceCtx sourceEnv
+          (currentExpressions.drop currentCount)
+          (currentValues.drop currentCount))
+    (hnil := by
+      intro currentCount
+      simp
+      exact .nil)
+    (hcons := by
+      intro expr value currentExpressions currentValues fuel heval htail ih
+        currentCount
+      cases currentCount with
+      | zero => exact .cons heval htail
+      | succ currentCount => simpa using ih currentCount)
+    hargs) count
+
+/-- Source-side n-ary application, fuel-free at the interface: each step is
+one `IxIR0.apply` at some fuel of its own. Currying makes this the exact
+source counterpart of the target's `applyGo` argument list. -/
+inductive SourceApplies (sourceCtx : IxIR0.Ctx) :
+    IxIR0.Value → List IxIR0.Value → IxIR0.Value → Prop where
+  | nil {value : IxIR0.Value} : SourceApplies sourceCtx value [] value
+  | cons {function argument middle result : IxIR0.Value}
+      {arguments : List IxIR0.Value} {fuel : Nat} :
+      IxIR0.apply sourceCtx fuel function argument = .ok middle →
+      SourceApplies sourceCtx middle arguments result →
+      SourceApplies sourceCtx function (argument :: arguments) result
+
+/-- Dependent traversal of a source application spine.  Clients receive the
+exact head application, the original tail derivation, and the recursively
+produced result while the initial value, remaining arguments, and final value
+stay synchronized. -/
+theorem SourceApplies.traverse {sourceCtx : IxIR0.Ctx}
+    {Result : IxIR0.Value → List IxIR0.Value → IxIR0.Value → Prop}
+    (hnil : ∀ value, Result value [] value)
+    (hcons : ∀ {function argument middle result : IxIR0.Value}
+        {arguments : List IxIR0.Value} {fuel : Nat},
+      IxIR0.apply sourceCtx fuel function argument = .ok middle →
+      SourceApplies sourceCtx middle arguments result →
+      Result middle arguments result →
+      Result function (argument :: arguments) result)
+    {function result : IxIR0.Value} {arguments : List IxIR0.Value}
+    (hargs : SourceApplies sourceCtx function arguments result) :
+    Result function arguments result := by
+  induction hargs with
+  | nil => exact hnil _
+  | cons hstep htail ih => exact hcons hstep htail ih
+
+/-- Applying a prefix and then the rest is applying the concatenation. -/
+theorem SourceApplies.append {sourceCtx : IxIR0.Ctx}
+    {function middle result : IxIR0.Value}
+    {left right : List IxIR0.Value}
+    (hleft : SourceApplies sourceCtx function left middle)
+    (hright : SourceApplies sourceCtx middle right result) :
+    SourceApplies sourceCtx function (left ++ right) result := by
+  exact (SourceApplies.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      ∀ {remaining final},
+        SourceApplies sourceCtx currentResult remaining final →
+        SourceApplies sourceCtx currentFunction
+          (currentArguments ++ remaining) final)
+    (hnil := by
+      intro value remaining final hremaining
+      simpa using hremaining)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hstep htail ih remaining final hremaining
+      exact .cons hstep (ih hremaining))
+    hleft) hright
+
+/-- One more argument after a completed spine. -/
+theorem SourceApplies.snoc {sourceCtx : IxIR0.Ctx}
+    {function middle result argument : IxIR0.Value}
+    {arguments : List IxIR0.Value} {fuel : Nat}
+    (hspine : SourceApplies sourceCtx function arguments middle)
+    (hstep : IxIR0.apply sourceCtx fuel middle argument = .ok result) :
+    SourceApplies sourceCtx function (arguments ++ [argument]) result :=
+  hspine.append (.cons hstep .nil)
+
+/-- Split one source application derivation at the same numeric boundary
+used by `knownCall`'s `take`/`drop` executable branches. -/
+theorem SourceApplies.splitAt {sourceCtx : IxIR0.Ctx}
+    {function result : IxIR0.Value} {arguments : List IxIR0.Value}
+    (hargs : SourceApplies sourceCtx function arguments result)
+    (count : Nat) :
+    ∃ middle,
+      SourceApplies sourceCtx function (arguments.take count) middle ∧
+      SourceApplies sourceCtx middle (arguments.drop count) result := by
+  exact (SourceApplies.traverse
+    (Result := fun currentFunction currentArguments currentResult =>
+      ∀ currentCount,
+        ∃ middle,
+          SourceApplies sourceCtx currentFunction
+              (currentArguments.take currentCount) middle ∧
+            SourceApplies sourceCtx middle
+              (currentArguments.drop currentCount) currentResult)
+    (hnil := by
+      intro value currentCount
+      simp
+      exact ⟨value, .nil, .nil⟩)
+    (hcons := by
+      intro currentFunction argument currentMiddle currentResult
+        currentArguments fuel hstep htail ih currentCount
+      cases currentCount with
+      | zero => exact ⟨currentFunction, .nil, .cons hstep htail⟩
+      | succ currentCount =>
+        obtain ⟨middle, hprefix, hsuffix⟩ := ih currentCount
+        exact ⟨middle, .cons hstep hprefix, hsuffix⟩)
+    hargs) count
+
+/-- Splitting a spine at any point exposes the intermediate source value. -/
+theorem SourceApplies.split {sourceCtx : IxIR0.Ctx}
+    {function result : IxIR0.Value} :
+    ∀ {left right : List IxIR0.Value},
+      SourceApplies sourceCtx function (left ++ right) result →
+      ∃ middle, SourceApplies sourceCtx function left middle ∧
+        SourceApplies sourceCtx middle right result := by
+  intro left right hargs
+  simpa using SourceApplies.splitAt hargs left.length
+
+/-- Invert one successful source application evaluation into the three
+predecessor-fuel computations used by IxIR₀'s evaluator. -/
+theorem sourceEval_app_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {function argument : IxIR0.Expr}
+    {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv
+      (.app function argument) = .ok result) :
+    ∃ fuel sourceFunction sourceArgument,
+      IxIR0.eval sourceCtx fuel sourceEnv function = .ok sourceFunction ∧
+      IxIR0.eval sourceCtx fuel sourceEnv argument = .ok sourceArgument ∧
+      IxIR0.apply sourceCtx fuel sourceFunction sourceArgument =
+        .ok result := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel =>
+    rw [IxIR0.eval.eq_def] at heval
+    dsimp only at heval
+    cases hfunction : IxIR0.eval sourceCtx fuel sourceEnv function with
+    | error error =>
+      rw [hfunction] at heval
+      contradiction
+    | ok sourceFunction =>
+      rw [hfunction, bindOk] at heval
+      cases hargument : IxIR0.eval sourceCtx fuel sourceEnv argument with
+      | error error =>
+        rw [hargument] at heval
+        contradiction
+      | ok sourceArgument =>
+        rw [hargument, bindOk] at heval
+        exact ⟨fuel, sourceFunction, sourceArgument, hfunction,
+          hargument, heval⟩
+
+/-- Invert successful source-variable evaluation to the corresponding
+source-environment lookup. -/
+theorem sourceEval_var_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {index : Nat}
+    {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv (.var index) =
+      .ok result) :
+    sourceEnv[index]? = some result := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel =>
+    cases hlookup : sourceEnv[index]? with
+    | none => simp [IxIR0.eval, hlookup] at heval
+    | some value =>
+      have hvalue : value = result := by
+        simpa [IxIR0.eval, hlookup] using heval
+      subst value
+      rfl
+
+/-- Successful scalar-source evaluation pins the literal constructor. -/
+theorem sourceEval_lit_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {literal : IxIR0.Literal}
+    {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv (.lit literal) =
+      .ok result) :
+    result = .lit literal := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel => simpa [IxIR0.eval] using heval.symm
+
+/-- Successful erased-source evaluation pins the erased value. -/
+theorem sourceEval_erased_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv .erased =
+      .ok result) :
+    result = .erased := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel => simpa [IxIR0.eval] using heval.symm
+
+/-- A source lambda evaluates immediately to the closure over its current
+environment. -/
+theorem sourceEval_lam_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {uses : Uses} {body : IxIR0.Expr}
+    {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv (.lam uses body) =
+      .ok result) :
+    result = .clos uses sourceEnv body := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel => simpa [IxIR0.eval] using heval.symm
+
+/-- Invert one successful source let into the bound-value and body
+evaluations at the common predecessor fuel used by `IxIR0.eval`. -/
+theorem sourceEval_let_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {uses : Uses}
+    {value body : IxIR0.Expr} {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv
+      (.letE uses value body) = .ok result) :
+    ∃ fuel bound,
+      IxIR0.eval sourceCtx fuel sourceEnv value = .ok bound ∧
+      IxIR0.eval sourceCtx fuel (bound :: sourceEnv) body = .ok result := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel =>
+    rw [IxIR0.eval.eq_def] at heval
+    dsimp only at heval
+    cases hvalue : IxIR0.eval sourceCtx fuel sourceEnv value with
+    | error error =>
+      rw [hvalue] at heval
+      contradiction
+    | ok bound =>
+      rw [hvalue, bindOk] at heval
+      exact ⟨fuel, bound, hvalue, heval⟩
+
+/-- Invert one successful source projection into evaluation of its target
+and the evaluator's constructor/erased projection relation. -/
+theorem sourceEval_proj_inv {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {index : Nat}
+    {source : IxIR0.Expr} {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv
+      (.proj index source) = .ok result) :
+    ∃ fuel target,
+      IxIR0.eval sourceCtx fuel sourceEnv source = .ok target ∧
+      SourceProject index target result := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel =>
+    have hwhole := heval
+    rw [IxIR0.eval.eq_def] at heval
+    dsimp only at heval
+    cases htarget : IxIR0.eval sourceCtx fuel sourceEnv source with
+    | error error =>
+      rw [htarget] at heval
+      contradiction
+    | ok target =>
+      exact ⟨fuel, target, htarget,
+        SourceProject.of_eval htarget hwhole⟩
+
+/-- Global-reference evaluation is independent of the surrounding source
+environment; definitions deliberately evaluate their bodies in `[]`. -/
+theorem sourceEval_ref_closed {sourceCtx : IxIR0.Ctx} {sourceFuel : Nat}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {value : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref address) =
+      .ok value) :
+    IxIR0.eval sourceCtx sourceFuel [] (.ref address) = .ok value := by
+  cases sourceFuel with
+  | zero => simp [IxIR0.eval] at heval
+  | succ fuel =>
+    rw [IxIR0.eval.eq_def] at heval ⊢
+    exact heval
+
+/-- Source semantics of a flattened application spine: evaluate the head,
+evaluate all arguments left-to-right in the unchanged pure environment, and
+apply the resulting source values in order. An inductive proposition (rather
+than a `structure`) keeps the existential source values proof-irrelevant. -/
+inductive SourceSpineEval (sourceCtx : IxIR0.Ctx)
+    (sourceEnv : List IxIR0.Value) (head : IxIR0.Expr)
+    (arguments : List IxIR0.Expr) (result : IxIR0.Value) : Prop where
+  | intro {headValue : IxIR0.Value}
+      {argumentValues : List IxIR0.Value} :
+      (∃ fuel, IxIR0.eval sourceCtx fuel sourceEnv head = .ok headValue) →
+      SourceArgsEval sourceCtx sourceEnv arguments argumentValues →
+      SourceApplies sourceCtx headValue argumentValues result →
+      SourceSpineEval sourceCtx sourceEnv head arguments result
+
+/-- Dependent eliminator for source-spine semantics. Keeping the sole direct
+destruction beside the judgment gives downstream proofs the exact hidden head
+and argument values without duplicating constructor-sensitive case splits. -/
+theorem SourceSpineEval.eliminate
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {head : IxIR0.Expr} {arguments : List IxIR0.Expr}
+    {result : IxIR0.Value} {Result : Prop}
+    (hspine : SourceSpineEval sourceCtx sourceEnv head arguments result)
+    (hintro : ∀ {headValue : IxIR0.Value}
+        {argumentValues : List IxIR0.Value},
+      (∃ fuel, IxIR0.eval sourceCtx fuel sourceEnv head = .ok headValue) →
+      SourceArgsEval sourceCtx sourceEnv arguments argumentValues →
+      SourceApplies sourceCtx headValue argumentValues result →
+      Result) :
+    Result := by
+  cases hspine with
+  | intro hhead harguments happlies =>
+      exact hintro hhead harguments happlies
+
+/-- A successful head evaluation is the empty-argument source spine. -/
+theorem SourceSpineEval.of_eval_nil {sourceCtx : IxIR0.Ctx}
+    {sourceFuel : Nat} {sourceEnv : List IxIR0.Value}
+    {head : IxIR0.Expr} {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv head = .ok result) :
+    SourceSpineEval sourceCtx sourceEnv head [] result :=
+  .intro ⟨sourceFuel, heval⟩ .nil .nil
+
+/-- One successful source `.app` evaluation is the singleton flattened
+spine used by `lowerE`'s application branch. -/
+theorem SourceSpineEval.of_eval_app {sourceCtx : IxIR0.Ctx}
+    {sourceFuel : Nat} {sourceEnv : List IxIR0.Value}
+    {function argument : IxIR0.Expr} {result : IxIR0.Value}
+    (heval : IxIR0.eval sourceCtx sourceFuel sourceEnv
+      (.app function argument) = .ok result) :
+    SourceSpineEval sourceCtx sourceEnv function [argument] result := by
+  obtain ⟨fuel, sourceFunction, sourceArgument, hfunction, hargument,
+      happly⟩ := sourceEval_app_inv heval
+  exact .intro ⟨fuel, hfunction⟩ (.cons hargument .nil)
+    (.cons happly .nil)
+
+/-- Flattening one more syntactic application preserves the source spine
+judgment and prepends exactly its argument/value pair. -/
+theorem SourceSpineEval.flattenApp {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {function argument : IxIR0.Expr}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : SourceSpineEval sourceCtx sourceEnv
+      (.app function argument) arguments result) :
+    SourceSpineEval sourceCtx sourceEnv function
+      (argument :: arguments) result := by
+  apply hspine.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨_, hhead⟩ := hhead
+    obtain ⟨fuel, sourceFunction, sourceArgument, hfunction, hargument,
+        happly⟩ := sourceEval_app_inv hhead
+    exact .intro ⟨fuel, hfunction⟩ (.cons hargument harguments)
+      (.cons happly happlies)
+
+/-- Expose the source reference identity, argument values, and application
+derivation carried by a reference-headed source spine. -/
+theorem SourceSpineEval.refData {sourceCtx : IxIR0.Ctx}
+    {sourceEnv : List IxIR0.Value} {address : Ixon.Address}
+    {arguments : List IxIR0.Expr} {result : IxIR0.Value}
+    (hspine : SourceSpineEval sourceCtx sourceEnv (.ref address)
+      arguments result) :
+    ∃ sourceFunction sourceArguments,
+      (∃ fuel, IxIR0.eval sourceCtx fuel [] (.ref address) =
+        .ok sourceFunction) ∧
+      SourceArgsEval sourceCtx sourceEnv arguments sourceArguments ∧
+      SourceApplies sourceCtx sourceFunction sourceArguments result := by
+  apply hspine.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨fuel, hhead⟩ := hhead
+    exact ⟨headValue, argumentValues,
+      ⟨fuel, sourceEval_ref_closed hhead⟩, harguments, happlies⟩
+
+/-- The source value a global reference denotes, at some source fuel. This
+is the callee's source identity: a `.defn` denotes its closure, while
+constructors, recursors, and externs denote their zero-argument paps. -/
+def SourceRefValue (sourceCtx : IxIR0.Ctx) (address : Ixon.Address)
+    (value : IxIR0.Value) : Prop :=
+  ∃ fuel, IxIR0.eval sourceCtx fuel [] (.ref address) = .ok value
+
+/-- A source reference to a recursor denotes its canonical empty pap. -/
+theorem SourceRefValue.recursorValue {sourceCtx : IxIR0.Ctx}
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule} {sourceFunction : IxIR0.Value}
+    (hlookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules))
+    (href : SourceRefValue sourceCtx address sourceFunction) :
+    sourceFunction = .pap (.rec_ address (numArgs + 1)) [] := by
+  obtain ⟨fuel, href⟩ := href
+  cases fuel with
+  | zero => simp [IxIR0.eval] at href
+  | succ fuel => simpa [IxIR0.eval, hlookup] using href.symm
+
+/-- Total source arity used by partial-application nodes. Unlike
+`sourceCallableSignature`, this includes constructors and externs, which do
+not become target function declarations but can still be stored as paps. -/
+def sourceDeclArity : IxIR0.Decl → Nat
+  | .defn _ body => lamArity body
+  | .ctor _ arity => arity
+  | .recursor numArgs _ _ => numArgs + 1
+  | .extern arity => arity
+
+/-- Source declarations that may back a same-address target pap.  Ordinary
+definitions must pass the executable all-shared safety check; recursors and
+externs have homogeneous shared signatures by construction. Constructors
+are deliberately excluded because partial constructor applications use a
+generated eta-wrapper instead. -/
+def SourcePapEligible : IxIR0.Decl → Prop
+  | .defn result body => result = .shared ∧ papSafe body = true
+  | .ctor _ _ => False
+  | .recursor _ _ _ => True
+  | .extern _ => True
+
+/-- Canonical function correspondence for the whole lowering pass.
+
+There are three origins for a target pap node: a source declaration at the
+same address, a generated eta wrapper for a partially applied constructor,
+or a lifted local lambda. In every static case the related source value is
+the residual result of applying exactly the values stored in the pap. -/
+inductive CompilerFunctionRel (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env)
+    (state : LowSt) : Sim.FunctionRel where
+  | source {value sourceFunction : IxIR0.Value}
+      {address : Ixon.Address} {arity : Nat}
+      {captures : List IxIR0.Value} {source : IxIR0.Decl} :
+      src address = some source →
+      SourcePapEligible source →
+      sourceDeclArity source = arity →
+      SourceRefValue sourceCtx address sourceFunction →
+      SourceApplies sourceCtx sourceFunction captures value →
+      captures.length < arity →
+      CompilerFunctionRel sourceCtx src state value address arity captures
+  | wrapper {value sourceFunction : IxIR0.Value}
+      {captures : List IxIR0.Value} {memo : WrapperMemo} :
+      memo ∈ state.wrappers →
+      src memo.source = some (.ctor memo.tag memo.arity) →
+      SourceRefValue sourceCtx memo.source sourceFunction →
+      SourceApplies sourceCtx sourceFunction captures value →
+      captures.length < memo.arity →
+      CompilerFunctionRel sourceCtx src state value memo.wrapper
+        memo.arity captures
+  | lifted {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+      {captures : List IxIR0.Value} :
+      CompilerLiftedFunctionRel src state value address arity captures →
+      CompilerFunctionRel sourceCtx src state value address arity captures
+
+/-- Every branch of the canonical function relation survives later compiler
+state extension. Static-source evidence is state independent; wrapper memos
+and lifted declaration provenance are monotone suffix invariants. -/
+theorem CompilerFunctionRel.monoState
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {initial final : LowSt} (hextends : ExtraExtends initial final)
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (hrel : CompilerFunctionRel sourceCtx src initial value address arity
+      captures) :
+    CompilerFunctionRel sourceCtx src final value address arity captures := by
+  cases hrel with
+  | source hsrc heligible harity href happly hunder =>
+    exact .source hsrc heligible harity href happly hunder
+  | wrapper hmember hsrc href happly hunder =>
+    exact .wrapper (hextends.wrapper_mem hmember) hsrc href happly hunder
+  | lifted hlifted =>
+    exact .lifted (hlifted.monoState hextends)
+
+/-- Every function represented by the compiler relation is a genuine
+under-saturated pap. -/
+theorem CompilerFunctionRel.underfilled
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {state : LowSt}
+    {value : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value}
+    (hrel : CompilerFunctionRel sourceCtx src state value address arity
+      captures) :
+    captures.length < arity := by
+  cases hrel with
+  | source _ _ _ _ _ hunder => exact hunder
+  | wrapper _ _ _ _ hunder => exact hunder
+  | lifted hlifted => exact hlifted.underfilled
+
+/-- Successful source evaluation is deterministic even when the two proofs
+use different fuel witnesses. -/
+theorem sourceEval_ok_unique {sourceCtx : IxIR0.Ctx}
+    {leftFuel rightFuel : Nat} {sourceEnv : List IxIR0.Value}
+    {expr : IxIR0.Expr} {left right : IxIR0.Value}
+    (hleft : IxIR0.eval sourceCtx leftFuel sourceEnv expr = .ok left)
+    (hright : IxIR0.eval sourceCtx rightFuel sourceEnv expr = .ok right) :
+    left = right := by
+  have hleft' := IxIR0.eval_mono
+    (Nat.le_max_left leftFuel rightFuel) hleft
+  have hright' := IxIR0.eval_mono
+    (Nat.le_max_right leftFuel rightFuel) hright
+  rw [hleft'] at hright'
+  exact Except.ok.inj hright'
+
+/-- Source application is likewise deterministic across independent fuel
+witnesses. -/
+theorem sourceApply_ok_unique {sourceCtx : IxIR0.Ctx}
+    {leftFuel rightFuel : Nat} {function argument : IxIR0.Value}
+    {left right : IxIR0.Value}
+    (hleft : IxIR0.apply sourceCtx leftFuel function argument = .ok left)
+    (hright : IxIR0.apply sourceCtx rightFuel function argument = .ok right) :
+    left = right := by
+  have hleft' := IxIR0.apply_mono
+    (Nat.le_max_left leftFuel rightFuel) hleft
+  have hright' := IxIR0.apply_mono
+    (Nat.le_max_right leftFuel rightFuel) hright
+  rw [hleft'] at hright'
+  exact Except.ok.inj hright'
+
+/-- An n-ary source application has a unique result, although each step in
+`SourceApplies` deliberately carries an independent fuel witness. -/
+theorem SourceApplies.deterministic {sourceCtx : IxIR0.Ctx}
+    {function : IxIR0.Value} {arguments : List IxIR0.Value}
+    {left right : IxIR0.Value}
+    (hleft : SourceApplies sourceCtx function arguments left)
+    (hright : SourceApplies sourceCtx function arguments right) :
+    left = right := by
+  exact (SourceApplies.traverse
+    (Result := fun currentFunction currentArguments currentLeft =>
+      ∀ {currentRight},
+        SourceApplies sourceCtx currentFunction currentArguments
+          currentRight →
+        currentLeft = currentRight)
+    (hnil := by
+      intro value currentRight hcurrentRight
+      cases hcurrentRight
+      rfl)
+    (hcons := by
+      intro currentFunction argument middle currentLeft currentArguments
+        leftFuel hleftStep hleftTail ih currentRight hcurrentRight
+      cases hcurrentRight with
+      | @cons _ _ rightMiddle right _ rightFuel hrightStep hrightTail =>
+        have hmiddle : middle = rightMiddle :=
+          sourceApply_ok_unique hleftStep hrightStep
+        subst rightMiddle
+        exact ih hrightTail)
+    hleft) hright
+
+/-- Extend a residual lambda prefix by one source application while it
+remains strictly under-saturated. -/
+theorem LambdaPrefix.snoc_of_apply
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expr : IxIR0.Expr} {supplied : List IxIR0.Value}
+    {function argument result : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr supplied function)
+    (hunder : (supplied ++ [argument]).length < lamArity expr)
+    (happly : ∃ fuel,
+      IxIR0.apply sourceCtx fuel function argument = .ok result) :
+    LambdaPrefix sourceEnv expr (supplied ++ [argument]) result := by
+  exact (LambdaPrefix.traverse
+    (Result := fun currentEnv currentExpr currentSupplied currentFunction =>
+      (currentSupplied ++ [argument]).length < lamArity currentExpr →
+      (∃ fuel,
+        IxIR0.apply sourceCtx fuel currentFunction argument = .ok result) →
+      LambdaPrefix currentEnv currentExpr
+        (currentSupplied ++ [argument]) result)
+    (hnil := by
+      intro currentEnv uses body hunder happly
+      obtain ⟨applyFuel, happly⟩ := happly
+      cases body with
+      | lam nextUses nextBody =>
+        have hcanonical : IxIR0.apply sourceCtx 2
+            (.clos uses currentEnv (.lam nextUses nextBody)) argument =
+            .ok (.clos nextUses (argument :: currentEnv) nextBody) := by
+          simp [IxIR0.apply, IxIR0.eval]
+        have hresult : result =
+            .clos nextUses (argument :: currentEnv) nextBody :=
+          sourceApply_ok_unique happly hcanonical
+        subst result
+        simpa using
+          (LambdaPrefix.cons (LambdaPrefix.nil
+            (sourceEnv := argument :: currentEnv)
+            (uses := nextUses) (body := nextBody)))
+      | var => simp [lamArity] at hunder
+      | ref => simp [lamArity] at hunder
+      | app => simp [lamArity] at hunder
+      | letE => simp [lamArity] at hunder
+      | proj => simp [lamArity] at hunder
+      | lit => simp [lamArity] at hunder
+      | erased => simp [lamArity] at hunder)
+    (hcons := by
+      intro currentEnv uses body first currentArguments currentFunction
+        hinner ih hunder happly
+      have hinnerUnder : (currentArguments ++ [argument]).length <
+          lamArity body := by
+        simpa [lamArity] using hunder
+      have hextended := ih hinnerUnder happly
+      simpa using (LambdaPrefix.cons hextended))
+    (h := hprefix)) hunder happly
+
+/-- Extend a residual lambda prefix by an arbitrary still-underfilled
+source application spine. -/
+theorem LambdaPrefix.append_of_applies
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expr : IxIR0.Expr} {supplied additional : List IxIR0.Value}
+    {function result : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr supplied function)
+    (happlies : SourceApplies sourceCtx function additional result)
+    (hunder : (supplied ++ additional).length < lamArity expr) :
+    LambdaPrefix sourceEnv expr (supplied ++ additional) result := by
+  induction additional generalizing supplied function result with
+  | nil =>
+    cases happlies
+    simpa using hprefix
+  | cons argument additional ih =>
+    cases happlies with
+    | @cons _ _ middle result _ applyFuel hstep htail =>
+      have honeUnder : (supplied ++ [argument]).length < lamArity expr := by
+        simp only [List.length_append, List.length_cons,
+          List.length_nil] at hunder ⊢
+        omega
+      have hone := hprefix.snoc_of_apply honeUnder ⟨applyFuel, hstep⟩
+      have htailUnder : ((supplied ++ [argument]) ++ additional).length <
+          lamArity expr := by
+        simpa [List.append_assoc] using hunder
+      have hall := ih hone htail htailUnder
+      simpa [List.append_assoc] using hall
+
+/-- Under-filling a compiler-related pap preserves its origin and extends
+the stored source prefix by exactly the newly applied values. -/
+theorem CompilerFunctionRel.underfilledApply
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {state : LowSt}
+    {function result : IxIR0.Value} {address : Ixon.Address}
+    {arity : Nat} {captures arguments : List IxIR0.Value}
+    (hrel : CompilerFunctionRel sourceCtx src state function address arity
+      captures)
+    (happlies : SourceApplies sourceCtx function arguments result)
+    (hunder : (captures ++ arguments).length < arity) :
+    CompilerFunctionRel sourceCtx src state result address arity
+      (captures ++ arguments) := by
+  cases hrel with
+  | source hsrc heligible harity href hprefix _ =>
+    exact .source hsrc heligible harity href (hprefix.append happlies) hunder
+  | wrapper hmember hsrc href hprefix _ =>
+    exact .wrapper hmember hsrc href (hprefix.append happlies) hunder
+  | lifted hlifted =>
+    obtain ⟨sourceEnv, expr, selected, supplied, hlift, hselected,
+      hcaptures, harity, hprefix⟩ := hlifted
+    subst captures
+    subst arity
+    have hprefixUnder : (supplied ++ arguments).length < lamArity expr := by
+      simp only [List.length_append] at hunder ⊢
+      omega
+    apply CompilerFunctionRel.lifted
+    refine ⟨sourceEnv, expr, selected, supplied ++ arguments, hlift,
+      hselected, ?_, rfl,
+      hprefix.append_of_applies happlies hprefixUnder⟩
+    simp [List.append_assoc]
+
+/-- The erased source value absorbs every argument while preserving strict
+argument evaluation outside this relation. -/
+theorem SourceApplies.erased (sourceCtx : IxIR0.Ctx) :
+    ∀ arguments : List IxIR0.Value,
+      SourceApplies sourceCtx .erased arguments .erased
+  | [] => .nil
+  | argument :: arguments => by
+      exact SourceApplies.cons (fuel := 1)
+        (by simp [IxIR0.apply])
+        (SourceApplies.erased sourceCtx arguments)
+
+/-- Applying an arbitrary still-underfilling argument vector to a source pap
+only extends its stored prefix.  This uniform lemma is useful for recursors
+and externs as well as constructor and definition heads. -/
+theorem sourcePap_underfills {sourceCtx : IxIR0.Ctx}
+    {head : IxIR0.Head} {captures arguments : List IxIR0.Value}
+    (hunder : (captures ++ arguments).length < head.arity) :
+    SourceApplies sourceCtx (.pap head captures) arguments
+      (.pap head (captures ++ arguments)) := by
+  induction arguments generalizing captures with
+  | nil => simpa using (SourceApplies.nil (sourceCtx := sourceCtx)
+      (value := IxIR0.Value.pap head captures))
+  | cons argument arguments ih =>
+    have honeUnder : (captures ++ [argument]).length < head.arity := by
+      simp only [List.length_append, List.length_cons, List.length_nil]
+        at hunder ⊢
+      omega
+    have hnotLength : captures.length + 1 ≠ head.arity := by
+      simpa using Nat.ne_of_lt honeUnder
+    have htailUnder :
+        ((captures ++ [argument]) ++ arguments).length < head.arity := by
+      simpa [List.append_assoc] using hunder
+    apply SourceApplies.cons
+      (middle := .pap head (captures ++ [argument])) (fuel := 2)
+    · simp [IxIR0.apply, IxIR0.saturate, hnotLength]
+    · simpa [List.append_assoc] using
+        (ih (captures := captures ++ [argument]) htailUnder)
+
+/-- Invert a saturated source recursor reference at the pre-major/major
+boundary.  The conclusion exposes exactly the rule lookup and RHS evaluator
+environment that the corresponding target case alternative must simulate. -/
+theorem sourceRecursorRef_saturates_inv
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {sourceFunction sourceResult major : IxIR0.Value}
+    {pre : List IxIR0.Value}
+    (hlookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hpreLength : pre.length = numArgs)
+    (happlies : SourceApplies sourceCtx sourceFunction
+      (pre ++ [major]) sourceResult) :
+    ∃ tag fields rule sourceFuel,
+      IxIR0.majorCtor natLit major = .ok (tag, fields) ∧
+      rules[tag]? = some rule ∧
+      fields.length = rule.fields ∧
+      IxIR0.eval sourceCtx sourceFuel
+        (fields.reverse ++ pre.reverse ++
+          [.pap (.rec_ address (numArgs + 1)) []])
+        rule.rhs = .ok sourceResult := by
+  have hfunction := href.recursorValue hlookup
+  subst sourceFunction
+  have hunder : ([] ++ pre).length <
+      (IxIR0.Head.rec_ address (numArgs + 1)).arity := by
+    simp [IxIR0.Head.arity, hpreLength]
+  have hprefix : SourceApplies sourceCtx
+      (.pap (.rec_ address (numArgs + 1)) []) pre
+      (.pap (.rec_ address (numArgs + 1)) pre) :=
+    sourcePap_underfills hunder
+  obtain ⟨middle, hleft, hright⟩ :=
+    SourceApplies.split (left := pre) (right := [major]) (by
+      simpa using happlies)
+  have hmiddle : middle = .pap (.rec_ address (numArgs + 1)) pre :=
+    hleft.deterministic hprefix
+  subst middle
+  cases hright with
+  | @cons _ _ middle result arguments applyFuel hstep htail =>
+    cases htail
+    cases applyFuel with
+    | zero => simp [IxIR0.apply] at hstep
+    | succ fuel =>
+      rw [IxIR0.apply.eq_def] at hstep
+      dsimp only at hstep
+      cases fuel with
+      | zero => simp [IxIR0.saturate] at hstep
+      | succ fuel =>
+        rw [IxIR0.saturate.eq_def] at hstep
+        dsimp only at hstep
+        have hlength : (pre ++ [major]).length = numArgs + 1 := by
+          simp [hpreLength]
+        simp only [IxIR0.Head.arity, hlength, beq_self_eq_true,
+          if_true] at hstep
+        cases fuel with
+        | zero => simp [IxIR0.fire] at hstep
+        | succ sourceFuel =>
+          rw [IxIR0.fire.eq_def] at hstep
+          dsimp only at hstep
+          rw [hlookup] at hstep
+          simp only at hstep
+          have hlast : (pre ++ [major]).getLast? = some major := by
+            simp
+          rw [hlast] at hstep
+          simp only at hstep
+          cases hmajor : IxIR0.majorCtor natLit major with
+          | error error =>
+            rw [hmajor] at hstep
+            contradiction
+          | ok pair =>
+            rcases pair with ⟨tag, fields⟩
+            rw [hmajor] at hstep
+            rw [lowerSimExceptBindOk] at hstep
+            cases hrule : rules[tag]? with
+            | none =>
+              rw [hrule] at hstep
+              contradiction
+            | some rule =>
+              rw [hrule] at hstep
+              by_cases hfields : fields.length != rule.fields
+              · simp [hfields] at hstep
+              · have hfieldEq : fields.length = rule.fields := by
+                  simpa using hfields
+                simp only [hfields] at hstep
+                exact ⟨tag, fields, rule, sourceFuel, rfl, hrule,
+                  hfieldEq, by simpa using hstep⟩
+
+/-- Split a pointwise argument graph at its final value when the target
+runtime stack has already exposed the reversed prefix and major premise. -/
+theorem valuesGraph_splitLast
+    {funRel : Sim.FunctionRel} {store : Store}
+    {sourceArgs : List IxIR0.Value} {args : List RVal}
+    {runtimePre : List RVal} {major : RVal} {numArgs : Nat}
+    (hgraph : Sim.ValuesGraph funRel store sourceArgs args)
+    (hargsForm : args = runtimePre.reverse ++ [major])
+    (hpreLength : runtimePre.length = numArgs) :
+    ∃ sourcePre sourceMajor,
+      sourceArgs = sourcePre ++ [sourceMajor] ∧
+      sourcePre.length = numArgs ∧
+      Sim.ValuesGraph funRel store sourcePre runtimePre.reverse ∧
+      Sim.ValueGraph funRel store sourceMajor major := by
+  have hsourceLength : sourceArgs.length = numArgs + 1 := by
+    calc
+      sourceArgs.length = args.length := hgraph.length
+      _ = numArgs + 1 := by simp [hargsForm, hpreLength]
+  have hsourceBound : numArgs < sourceArgs.length := by omega
+  let sourcePre := sourceArgs.take numArgs
+  let sourceMajor := sourceArgs[numArgs]
+  have hsourceForm : sourceArgs = sourcePre ++ [sourceMajor] := by
+    have htake := List.take_append_getElem hsourceBound
+    have htakeAll : sourceArgs.take (numArgs + 1) = sourceArgs := by
+      apply List.take_of_length_le
+      omega
+    simpa [sourcePre, sourceMajor, htakeAll] using htake.symm
+  have hsourcePreLength : sourcePre.length = numArgs := by
+    simp [sourcePre, hsourceLength]
+  have htargetTake : args.take numArgs = runtimePre.reverse := by
+    rw [hargsForm]
+    apply List.take_left'
+    simpa using hpreLength
+  have hpreGraph : Sim.ValuesGraph funRel store sourcePre
+      runtimePre.reverse := by
+    simpa [sourcePre, htargetTake] using hgraph.take numArgs
+  have hsourceLookup : sourceArgs[numArgs]? = some sourceMajor :=
+    List.getElem?_eq_getElem hsourceBound
+  obtain ⟨runtimeMajor, hruntimeLookup, hmajorGraph⟩ :=
+    hgraph.get? hsourceLookup
+  have htargetLookup : args[numArgs]? = some major := by
+    rw [hargsForm]
+    simp [← hpreLength]
+  have hruntimeMajor : runtimeMajor = major := by
+    rw [htargetLookup] at hruntimeLookup
+    exact Option.some.inj hruntimeLookup.symm
+  subst runtimeMajor
+  exact ⟨sourcePre, sourceMajor, hsourceForm, hsourcePreLength,
+    hpreGraph, hmajorGraph⟩
+
+/-- Applying exactly the missing arguments to an under-saturated source
+constructor pap produces the constructor with the stored prefix followed by
+those arguments. This is the source counterpart of IxIR₁'s static
+constructor allocation. -/
+theorem sourceCtorPap_saturates {sourceCtx : IxIR0.Ctx}
+    {address : Ixon.Address} {tag arity : Nat}
+    {captures arguments : List IxIR0.Value}
+    (hunder : captures.length < arity)
+    (hsaturated : (captures ++ arguments).length = arity) :
+    SourceApplies sourceCtx (.pap (.ctor address tag arity) captures)
+      arguments (.ctor address tag (captures ++ arguments)) := by
+  induction arguments generalizing captures with
+  | nil => simp at hsaturated; omega
+  | cons argument arguments ih =>
+    by_cases hfinal : (captures ++ [argument]).length = arity
+    · have hnil : arguments = [] := by
+        apply List.eq_nil_of_length_eq_zero
+        have htotal :
+            ((captures ++ [argument]) ++ arguments).length = arity := by
+          simpa [List.append_assoc] using hsaturated
+        simp only [List.length_append] at htotal hfinal
+        omega
+      subst arguments
+      apply SourceApplies.cons
+        (middle := .ctor address tag (captures ++ [argument])) (fuel := 3)
+      · simp [IxIR0.apply, IxIR0.saturate, IxIR0.fire,
+          IxIR0.Head.arity, hfinal]
+      · exact .nil
+    · have htotal :
+          ((captures ++ [argument]) ++ arguments).length = arity := by
+        simpa [List.append_assoc] using hsaturated
+      have hnextUnder : (captures ++ [argument]).length < arity := by
+        simp only [List.length_append] at htotal hfinal ⊢
+        omega
+      have hnotLength : captures.length + 1 ≠ arity := by
+        simpa using Nat.ne_of_lt hnextUnder
+      apply SourceApplies.cons
+        (middle := .pap (.ctor address tag arity)
+          (captures ++ [argument])) (fuel := 2)
+      · simp [IxIR0.apply, IxIR0.saturate, IxIR0.Head.arity,
+          hnotLength]
+      · simpa [List.append_assoc] using
+          (ih hnextUnder htotal)
+
+/-- A constructor reference followed by exactly its declared number of
+arguments evaluates to the corresponding source constructor value. The
+explicit source-context lookup is the semantic/program consistency premise;
+`SourceRefValue` then pins the otherwise existential reference fuel. -/
+theorem sourceCtorRef_saturates {sourceCtx : IxIR0.Ctx}
+    {address : Ixon.Address} {tag arity : Nat}
+    {sourceFunction : IxIR0.Value} {arguments : List IxIR0.Value}
+    (hlookup : sourceCtx.env address = some (.ctor tag arity))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hlength : arguments.length = arity) :
+    SourceApplies sourceCtx sourceFunction arguments
+      (.ctor address tag arguments) := by
+  obtain ⟨sourceFuel, href⟩ := href
+  cases arity with
+  | zero =>
+    have harguments : arguments = [] :=
+      List.eq_nil_of_length_eq_zero hlength
+    subst arguments
+    have hcanonical :
+        IxIR0.eval sourceCtx 3 [] (.ref address) =
+          .ok (.ctor address tag []) := by
+      simp [IxIR0.eval, hlookup, IxIR0.saturate, IxIR0.fire,
+        IxIR0.Head.arity]
+    have hfunction : sourceFunction = .ctor address tag [] :=
+      sourceEval_ok_unique href hcanonical
+    subst sourceFunction
+    exact .nil
+  | succ arity =>
+    have hcanonical :
+        IxIR0.eval sourceCtx 2 [] (.ref address) =
+          .ok (.pap (.ctor address tag (arity + 1)) []) := by
+      simp [IxIR0.eval, hlookup, IxIR0.saturate, IxIR0.Head.arity]
+    have hfunction :
+        sourceFunction = .pap (.ctor address tag (arity + 1)) [] :=
+      sourceEval_ok_unique href hcanonical
+    subst sourceFunction
+    simpa using sourceCtorPap_saturates
+      (sourceCtx := sourceCtx) (address := address) (tag := tag)
+      (arity := arity + 1) (captures := []) (arguments := arguments)
+      (by simp) (by simpa using hlength)
+
+/-- Exact-fuel semantic preservation for one compiled declaration body.
+
+Two conclusions, not one. The result clause is the obvious half. The *frame*
+clause is the half that makes the contract usable at a call site at all: a
+caller's post-state predicate (`GraphOwnsResult` and friends) demands
+`RootsGraph` for its framed roots in the store the callee returns, and that
+does not follow from ownership. A general callee both frees and allocates,
+so neither `StoreGraphExtends` nor `StoreGraphRestricts` covers it, and the
+obligation has to be discharged by the callee rather than reconstructed by
+the caller. The argument worlds are carried in lockstep with
+`FnOwnershipContract` so the two contracts share one call-site premise. -/
+def FnValuePreservesAt (funRel : Sim.FunctionRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (d : FnDef) (argWorlds : List Owned)
+    (sourceFunction : IxIR0.Value) (fuel : Nat) : Prop :=
+  ∀ {store store' : Store} {args : List RVal} {value : RVal}
+      {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+    args.length = argWorlds.length →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    Sim.RootsGraph funRel store sourceRest rest →
+    RootOwnership store (rootsForWorlds argWorlds args ++ rest) →
+    runCode ctx fuel d store args.reverse d.body = .ok (store', value) →
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest
+
+/-- Semantic contract for one compiled function declaration: entered on
+arguments realizing source values, its body returns a value realizing the
+source evaluator's own result for that saturated application, without
+disturbing the caller's framed graphs. -/
+structure FnValueContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (sourceFunction : IxIR0.Value) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  preserves : ∀ {fuel : Nat},
+    FnValuePreservesAt funRel sourceCtx ctx d argWorlds sourceFunction fuel
+
+/-- One function's semantic contract restricted to evaluator fuels strictly
+below `limit`. -/
+structure FnValueContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (sourceFunction : IxIR0.Value)
+    (limit : Nat) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    FnValuePreservesAt funRel sourceCtx ctx d argWorlds sourceFunction fuel
+
+theorem FnValueContract.below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {d : FnDef}
+    {argWorlds : List Owned} {sourceFunction : IxIR0.Value}
+    (hcontract : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction) (limit : Nat) :
+    FnValueContractBelow funRel sourceCtx ctx d argWorlds sourceFunction
+      limit :=
+  ⟨hcontract.arity_eq, fun _ => hcontract.preserves⟩
+
+theorem FnValueContractBelow.mono {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {d : FnDef}
+    {argWorlds : List Owned} {sourceFunction : IxIR0.Value}
+    {smaller larger : Nat}
+    (hcontract : FnValueContractBelow funRel sourceCtx ctx d argWorlds
+      sourceFunction larger)
+    (hbound : smaller ≤ larger) :
+    FnValueContractBelow funRel sourceCtx ctx d argWorlds sourceFunction
+      smaller :=
+  ⟨hcontract.arity_eq,
+    fun hfuel => hcontract.preserves (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Seal a one-fuel-step semantic body proof into an unbounded function
+contract. The step may use the same function only at strictly smaller target
+evaluator fuels. -/
+theorem fnValueContract_of_below_step {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {d : FnDef}
+    {argWorlds : List Owned} {sourceFunction : IxIR0.Value}
+    (harity : argWorlds.length = d.arity)
+    (hstep : ∀ limit,
+      FnValueContractBelow funRel sourceCtx ctx d argWorlds sourceFunction
+        limit →
+      FnValuePreservesAt funRel sourceCtx ctx d argWorlds sourceFunction
+        limit) :
+    FnValueContract funRel sourceCtx ctx d argWorlds sourceFunction := by
+  refine ⟨harity, ?_⟩
+  intro fuel store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hrun
+  have hall : ∀ index,
+      FnValuePreservesAt funRel sourceCtx ctx d argWorlds sourceFunction
+        index := by
+    intro index
+    induction index using Nat.strongRecOn with
+    | ind index ih =>
+      apply hstep index
+      refine ⟨harity, ?_⟩
+      intro prior hprior
+      exact ih prior hprior
+  exact hall fuel hlength hargs happlies hframe hown hrun
+
+/-- Exact-fuel semantic preservation for higher-order application, with the
+same two-clause shape and the same frame obligation as the direct-call
+contract. `applyGo` consumes one shared function root and all supplied
+shared argument roots, matching `ApplyOwnershipContract`. -/
+def ApplyValuePreservesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (fuel : Nat) : Prop :=
+  ∀ {store store' : Store} {function : RVal} {args : List RVal}
+      {value : RVal} {sourceFunction : IxIR0.Value}
+      {sourceArgs : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root},
+    Sim.ValueGraph funRel store sourceFunction function →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    Sim.RootsGraph funRel store sourceRest rest →
+    RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+    applyGo ctx fuel store function args = .ok (store', value) →
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest
+
+/-- Whole-context semantic application contract. This is where `FunctionRel`
+stops being an assumption and becomes an obligation: an abstract relation
+that merely *claims* a pap realizes a source function must additionally make
+that pap compute the source function. -/
+structure ApplyValueContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  preserves : ∀ {fuel : Nat},
+    ApplyValuePreservesAt funRel sourceCtx ctx fuel
+
+/-- Semantic compatibility of the pure IxIR₀ extern oracle with IxIR₁'s
+scalar-only ABI. The compiler does not manufacture this fact: it is the
+explicit trusted boundary saying that related scalar arguments produce
+related results at the same extern address. -/
+structure ExternValueContract (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) : Prop where
+  preserves : ∀ {store : Store} {address : Ixon.Address} {arity : Nat}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {sourceArgs : List IxIR0.Value} {args : List RVal} {result : RVal},
+    sourceCtx.env address = some (.extern arity) →
+    SourceRefValue sourceCtx address sourceFunction →
+    sourceArgs.length = arity →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    Sim.ValuesGraph funRel store sourceArgs args →
+    callScalarOracle ctx address args = .ok result →
+    Sim.ValueGraph funRel store sourceResult result
+
+/-- Higher-order semantic application below an evaluator-fuel bound.
+Saturating and over-applied paps re-enter declarations at strictly smaller
+fuel, so this belongs in the same mutual induction as the call contract. -/
+structure ApplyValueContractBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (limit : Nat) : Prop where
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    ApplyValuePreservesAt funRel sourceCtx ctx fuel
+
+theorem ApplyValueContract.below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx}
+    (hcontract : ApplyValueContract funRel sourceCtx ctx) (limit : Nat) :
+    ApplyValueContractBelow funRel sourceCtx ctx limit :=
+  ⟨fun _ => hcontract.preserves⟩
+
+theorem ApplyValueContractBelow.mono {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {smaller larger : Nat}
+    (hcontract : ApplyValueContractBelow funRel sourceCtx ctx larger)
+    (hbound : smaller ≤ larger) :
+    ApplyValueContractBelow funRel sourceCtx ctx smaller :=
+  ⟨fun hfuel => hcontract.preserves (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Pointwise semantic preservation of every source-backed target function at
+one exact evaluator-fuel index. The source identity of the callee is pinned
+by `SourceRefValue` at the same address the layout relation uses, so a
+declaration cannot be related to a source function it was not compiled
+from. -/
+def SourceFnValuePreservesAt (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (fuel : Nat) : Prop :=
+  ∀ {address : Ixon.Address} {source : IxIR0.Decl}
+      {worlds : List Owned} {result : Owned} {d : FnDef}
+      {sourceFunction : IxIR0.Value},
+    src address = some source →
+    sourceCallableSignature source = some (worlds, result) →
+    ctx.decls address = some (.fn d) →
+    SourceRefValue sourceCtx address sourceFunction →
+    FnValuePreservesAt funRel sourceCtx ctx d worlds sourceFunction fuel
+
+/-- Semantic declaration contracts below an evaluator-fuel bound: the mutual
+induction hypothesis for cross-declaration and self calls. -/
+structure SourceDeclValueContractsBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) : Prop where
+  fn_preserves : ∀ {fuel : Nat}, fuel < limit →
+    SourceFnValuePreservesAt funRel sourceCtx src ctx fuel
+
+/-- Public, unbounded semantic contracts for every source-backed target
+function. -/
+structure SourceDeclValueContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  fn_preserves : ∀ {fuel : Nat},
+    SourceFnValuePreservesAt funRel sourceCtx src ctx fuel
+
+/-- Package the pointwise semantic declaration environment as the call-site
+`FnValueContract` once the (fuel-independent) layout supplies its arity. -/
+theorem SourceDeclValueContracts.fnContract {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclValueContracts funRel sourceCtx src ctx)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Owned} {result : Owned} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (harity : worlds.length = d.arity) :
+    FnValueContract funRel sourceCtx ctx d worlds sourceFunction := by
+  refine ⟨harity, ?_⟩
+  intro fuel
+  exact hcontracts.fn_preserves hsrc hsignature hdecl href
+
+theorem SourceDeclValueContractsBelow.fnContract
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx} {limit : Nat}
+    (hcontracts : SourceDeclValueContractsBelow funRel sourceCtx src ctx
+      limit)
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Owned} {result : Owned} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (harity : worlds.length = d.arity) :
+    FnValueContractBelow funRel sourceCtx ctx d worlds sourceFunction
+      limit := by
+  refine ⟨harity, ?_⟩
+  intro fuel hfuel
+  exact hcontracts.fn_preserves hfuel hsrc hsignature hdecl href
+
+theorem SourceDeclValueContracts.below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : SourceDeclValueContracts funRel sourceCtx src ctx)
+    (limit : Nat) :
+    SourceDeclValueContractsBelow funRel sourceCtx src ctx limit :=
+  ⟨fun _ => hcontracts.fn_preserves⟩
+
+theorem SourceDeclValueContractsBelow.mono {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontracts : SourceDeclValueContractsBelow funRel sourceCtx src ctx
+      larger) (hbound : smaller ≤ larger) :
+    SourceDeclValueContractsBelow funRel sourceCtx src ctx smaller :=
+  ⟨fun hfuel => hcontracts.fn_preserves (Nat.lt_of_lt_of_le hfuel hbound)⟩
+
+/-- Semantic twin of `CompilerContracts`: direct calls and higher-order
+application both carry their source result. -/
+structure CompilerValueContracts (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx) : Prop where
+  decls : SourceDeclValueContracts funRel sourceCtx src ctx
+  apply : ApplyValueContract funRel sourceCtx ctx
+  extern : ExternValueContract funRel sourceCtx ctx
+
+structure CompilerValueContractsBelow (funRel : Sim.FunctionRel)
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ctx : Ctx)
+    (limit : Nat) : Prop where
+  decls : SourceDeclValueContractsBelow funRel sourceCtx src ctx limit
+  apply : ApplyValueContractBelow funRel sourceCtx ctx limit
+  extern : ExternValueContract funRel sourceCtx ctx
+
+theorem CompilerValueContracts.below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ctx : Ctx}
+    (hcontracts : CompilerValueContracts funRel sourceCtx src ctx)
+    (limit : Nat) :
+    CompilerValueContractsBelow funRel sourceCtx src ctx limit :=
+  ⟨hcontracts.decls.below limit, hcontracts.apply.below limit,
+    hcontracts.extern⟩
+
+theorem CompilerValueContractsBelow.mono {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontracts : CompilerValueContractsBelow funRel sourceCtx src ctx
+      larger) (hbound : smaller ≤ larger) :
+    CompilerValueContractsBelow funRel sourceCtx src ctx smaller :=
+  ⟨hcontracts.decls.mono hbound, hcontracts.apply.mono hbound,
+    hcontracts.extern⟩
+
+/-- Simultaneously seal semantic declaration and higher-order-application
+contracts. At index `limit`, the producer receives both families only below
+`limit`; strong induction then constructs the public unbounded package
+without assuming the result being proved. -/
+theorem compilerValueContracts_of_below_step
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx}
+    (hextern : ExternValueContract funRel sourceCtx ctx)
+    (hstep : ∀ limit,
+      CompilerValueContractsBelow funRel sourceCtx src ctx limit →
+      SourceFnValuePreservesAt funRel sourceCtx src ctx limit ∧
+        ApplyValuePreservesAt funRel sourceCtx ctx limit) :
+    CompilerValueContracts funRel sourceCtx src ctx := by
+  have hall : ∀ index,
+      SourceFnValuePreservesAt funRel sourceCtx src ctx index ∧
+        ApplyValuePreservesAt funRel sourceCtx ctx index := by
+    intro index
+    induction index using Nat.strongRecOn with
+    | ind index ih =>
+      apply hstep index
+      refine ⟨⟨?_⟩, ⟨?_⟩, hextern⟩
+      · intro prior hprior
+        exact (ih prior hprior).1
+      · intro prior hprior
+        exact (ih prior hprior).2
+  refine ⟨⟨?_⟩, ⟨?_⟩, hextern⟩
+  · intro fuel
+    exact (hall fuel).1
+  · intro fuel
+    exact (hall fuel).2
+
+/-! ### Semantic compiler-induction interfaces -/
+
+/-- Successful expression lowering refines a successful source evaluation at
+one compiler-fuel index. Source evaluation is pure, so both semantic
+environment indices are the same even though lowering may consume target
+owners from its `VEnv`. -/
+def LowerEValuePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+/-- Contractive semantic expression interface at one target evaluator
+bound. Compiler recursion remains indexed separately by `fuel`. -/
+def LowerEValuePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+/-- Descriptor-shape companion to semantic expression preservation. If a
+successful lowering run returns the literal erased descriptor, then the
+successful source evaluation returned `◻` as well. This small reflection
+fact selects the two semantically different `applyRest` branches without
+strengthening every `LowerResultValueSound` operation lemma. -/
+def LowerEReflectsErased (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env)
+    (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    av = .constA .erased →
+    sourceValue = .erased
+
+/-- Successful borrowing-position lowering refines evaluation of the source
+target. This is the semantic companion consumed by the projection branch of
+the expression induction. -/
+def LowerBorrowValuePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+def LowerBorrowValuePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+/-- Descriptor reflection for a borrowing position. It is separated from
+the value transformer because it is a pure statement about source and
+compiler executions and therefore remains meaningful without a realizable
+heap precondition. -/
+def LowerBorrowReflectsErased (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env)
+    (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    av = .constA .erased →
+    sourceValue = .erased
+
+/-- Descriptor reflection for flattened spines. This is the companion
+needed by `.app`: an erased target descriptor implies the complete source
+application result was erased, including dynamic erased absorption. -/
+def LowerSpineReflectsErased (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env)
+    (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    av = .constA .erased →
+    sourceResult = .erased
+
+/-- Successful `lowerArgs` refines pointwise left-to-right source argument
+evaluation. Worlds remain compiler-side annotations; the source relation
+tracks only the expressions and their values. -/
+def LowerArgsValuePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+def LowerArgsValuePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+/-- Semantic preservation for the genuine (non-erased) branch of
+`applyRest`. The function has already been produced at shared ownership;
+this interface evaluates the source/target argument tail and applies the two
+completed higher-order contracts. -/
+def ApplyRestNonErasedValuePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    SourceArgsEval sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueSound funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    LowerResultValueSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+def ApplyRestNonErasedValuePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    SourceArgsEval sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+/-- Successful flattened-spine lowering refines `SourceSpineEval` at one
+compiler-fuel index. This is the semantic induction interface shared by the
+`.app` branch of `lowerE` and the recursive `.app` head of `lowerSpine`. -/
+def LowerSpineValuePreserves (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+def LowerSpineValuePreservesBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+/-! ### Reachable-state semantic compiler interfaces -/
+
+/-- Semantic contract for the current generated function. As on the
+ownership side, the substantive contract is needed only in environments
+that can expose a synthetic `recSelf` entry. -/
+structure CurrentSelfValueContract (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) : Prop where
+  result : cur.result = .shared
+  ownership : FnOwnershipContract ctx cur
+    (List.replicate cur.arity .shared)
+  value : ∀ {sourceFunction : IxIR0.Value},
+    recSelfRel sourceFunction cur.arity →
+    FnValueContract funRel sourceCtx ctx cur
+      (List.replicate cur.arity .shared) sourceFunction
+
+/-- Contractive current-self contract at one evaluator bound. -/
+structure CurrentSelfValueContractBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) : Prop where
+  result : cur.result = .shared
+  ownership : FnOwnershipContractBelow ctx cur
+    (List.replicate cur.arity .shared) limit
+  value : ∀ {sourceFunction : IxIR0.Value},
+    recSelfRel sourceFunction cur.arity →
+    FnValueContractBelow funRel sourceCtx ctx cur
+      (List.replicate cur.arity .shared) sourceFunction limit
+
+theorem CurrentSelfValueContract.below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (hcontract : CurrentSelfValueContract funRel recSelfRel sourceCtx ctx
+      cur) (limit : Nat) :
+    CurrentSelfValueContractBelow funRel recSelfRel sourceCtx ctx cur
+      limit :=
+  ⟨hcontract.result, hcontract.ownership.below limit,
+    fun hself => (hcontract.value hself).below limit⟩
+
+/-- Bounded current-self semantics are either available substantively or
+irrelevant because the logical environment has no synthetic self entry. -/
+def SelfValueAvailableBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (input : VEnv) : Prop :=
+  CurrentSelfValueContractBelow funRel recSelfRel sourceCtx ctx cur limit ∨
+    NoRecSelf input
+
+theorem SelfValueAvailableBelow.of_contract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (hcontract : CurrentSelfValueContractBelow funRel recSelfRel sourceCtx
+      ctx cur limit) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input :=
+  Or.inl hcontract
+
+theorem SelfValueAvailableBelow.of_noRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv} (hno : NoRecSelf input) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input :=
+  Or.inr hno
+
+theorem SelfValueAvailableBelow.mapNoRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfValueAvailableBelow.bump
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfValueAvailableBelow.pop
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      input.pop :=
+  havailable.mapNoRecSelf NoRecSelf.pop
+
+theorem SelfValueAvailableBelow.setSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (changed abs remaining : Nat) (uses : Uses) (held : Bool) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      (input.setEntry changed (.slot abs remaining uses held)) :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.setSlot changed abs remaining uses held)
+
+theorem SelfValueAvailableBelow.consSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input : VEnv}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (abs remaining : Nat) (uses : Uses) (held : Bool) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      { input with
+        entries := .slot abs remaining uses held :: input.entries } :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.consSlot abs remaining uses held)
+
+theorem SelfValueAvailableBelow.lowerE
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfValueAvailableBelow.lowerBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {release : Bool}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfValueAvailableBelow.lowerArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {args : List (IxIR0.Expr × Owned)}
+    {state finalState : LowSt} {emit : Emit} {avs : List AVal}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+theorem SelfValueAvailableBelow.applyRest
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {resultWorld : Owned}
+    {pre : Emit} {function : AVal} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input)
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok (output, emit, av) finalState) :
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+      output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).applyRest hrun hno)
+
+/-- Current-self semantics are available substantively for recursor-rule
+environments or vacuously for ordinary environments with no self marker. -/
+def SelfValueAvailable (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (input : VEnv) : Prop :=
+  CurrentSelfValueContract funRel recSelfRel sourceCtx ctx cur ∨
+    NoRecSelf input
+
+theorem SelfValueAvailable.of_contract
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (hcontract : CurrentSelfValueContract funRel recSelfRel sourceCtx ctx
+      cur) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input :=
+  Or.inl hcontract
+
+theorem SelfValueAvailable.of_noRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (hno : NoRecSelf input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input :=
+  Or.inr hno
+
+theorem SelfValueAvailable.mapNoRecSelf
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hpreserve : NoRecSelf input → NoRecSelf output) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur output := by
+  cases havailable with
+  | inl hcontract => exact Or.inl hcontract
+  | inr hno => exact Or.inr (hpreserve hno)
+
+theorem SelfValueAvailable.bump
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input.bump :=
+  havailable.mapNoRecSelf NoRecSelf.bump
+
+theorem SelfValueAvailable.pop
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input.pop :=
+  havailable.mapNoRecSelf NoRecSelf.pop
+
+theorem SelfValueAvailable.setSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (changed abs remaining : Nat) (uses : Uses) (held : Bool) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      (input.setEntry changed (.slot abs remaining uses held)) :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.setSlot changed abs remaining uses held)
+
+theorem SelfValueAvailable.consSlot
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {input : VEnv}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (abs remaining : Nat) (uses : Uses) (held : Bool) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      { input with
+        entries := .slot abs remaining uses held :: input.entries } :=
+  havailable.mapNoRecSelf
+    (fun hno => hno.consSlot abs remaining uses held)
+
+theorem SelfValueAvailable.lowerE
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).expr hrun hno)
+
+theorem SelfValueAvailable.lowerBorrow
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal} {release : Bool}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).borrow hrun hno)
+
+theorem SelfValueAvailable.lowerArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+    {emit : Emit} {avs : List AVal}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).args hrun hno)
+
+theorem SelfValueAvailable.applyRest
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {resultWorld : Owned} {pre : Emit} {function : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input)
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok (output, emit, av) finalState) :
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur output :=
+  havailable.mapNoRecSelf
+    (fun hno => (lowerPreservesNoRecSelf src fuel).applyRest hrun hno)
+
+/-- Reachable-state expression semantics. The successful subrun need only
+end at a suffix-prefix of the ambient whole-pass state indexing `funRel`. -/
+def LowerEValuePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+def LowerBorrowValuePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+def LowerArgsValuePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+def ApplyRestNonErasedValuePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    SourceArgsEval sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueSound funRel recSelfRel ctx cur start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction
+      function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+def LowerSpineValuePreservesWithin (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+/-! ### Fuel-bounded reachable-state semantic interfaces -/
+
+/-- Reachable-state expression semantics restricted to one target evaluator
+bound. -/
+def LowerEValuePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av
+
+/-- Reachable-state borrow semantics restricted to one evaluator bound. -/
+def LowerBorrowValuePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {expr : IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+      {sourceValue : IxIR0.Value} {state finalState : LowSt}
+      {emit : Emit} {av : AVal} {release : Bool},
+    IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release
+
+/-- Reachable-state argument semantics restricted to one evaluator bound. -/
+def LowerArgsValuePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+      {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+      {emit : Emit} {avs : List AVal},
+    SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst) sourceValues →
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValues (args.map Prod.snd) emit avs
+
+/-- Reachable-state non-erased application semantics restricted to one
+evaluator bound. -/
+def ApplyRestNonErasedValuePreservesWithinBelow
+    (funRel : Sim.FunctionRel) (recSelfRel : RecSelfRel)
+    (sourceCtx : IxIR0.Ctx) (ctx : Ctx) (cur : FnDef) (limit : Nat)
+    (src : IxIR0.Env) (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {start input output : VEnv}
+      {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+      {sourceFunction sourceResult : IxIR0.Value}
+      {resultWorld : Owned} {emitFunction emit : Emit}
+      {function av : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt},
+    function ≠ .constA .erased →
+    SourceArgsEval sourceCtx sourceMiddle args sourceArgs →
+    SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start input
+      sourceStart sourceMiddle sourceFunction .shared emitFunction function →
+    (applyRest src fuel input resultWorld emitFunction function args).run
+      state = .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av
+
+/-- Reachable-state spine semantics restricted to one evaluator bound. -/
+def LowerSpineValuePreservesWithinBelow (funRel : Sim.FunctionRel)
+    (recSelfRel : RecSelfRel) (sourceCtx : IxIR0.Ctx)
+    (ctx : Ctx) (cur : FnDef) (limit : Nat) (src : IxIR0.Env)
+    (ambient : LowSt) (fuel : Nat) : Prop :=
+  ∀ {input output : VEnv} {world : Owned}
+      {head : IxIR0.Expr} {args : List IxIR0.Expr}
+      {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+      {state finalState : LowSt} {emit : Emit} {av : AVal},
+    SourceSpineEval sourceCtx sourceEnv head args sourceResult →
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    ExtraExtends finalState ambient →
+    SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit input →
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av
+
+/-- No successful argument-lowering run exists at zero compiler fuel. -/
+theorem lowerArgsValuePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur src 0 := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    _ hrun
+  simp only [lowerArgs] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerArgsValuePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src 0 := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    _ hrun
+  simp only [lowerArgs] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerEReflectsErased_zero (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) : LowerEReflectsErased sourceCtx src 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av _ hrun _
+  simp only [lowerE] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- No successful expression-lowering run exists at zero compiler fuel. -/
+theorem lowerEValuePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av _ hrun
+  simp only [lowerE] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerEValuePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerEValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av _ hrun
+  simp only [lowerE] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- No successful borrow-lowering run exists at zero compiler fuel. -/
+theorem lowerBorrowValuePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    LowerBorrowValuePreserves funRel recSelfRel sourceCtx ctx cur src 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release _ hrun
+  simp only [lowerBorrow] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerBorrowValuePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerBorrowValuePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release _ hrun
+  simp only [lowerBorrow] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerBorrowReflectsErased_zero (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) : LowerBorrowReflectsErased sourceCtx src 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release _ hrun _
+  simp only [lowerBorrow] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- No successful spine-lowering run exists at zero compiler fuel. -/
+theorem lowerSpineValuePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    LowerSpineValuePreserves funRel recSelfRel sourceCtx ctx cur src 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun
+  simp only [lowerSpine] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerSpineValuePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    LowerSpineValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun
+  simp only [lowerSpine] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerEValuePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerEValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av _ hrun _ _
+  simp only [lowerE] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerBorrowValuePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerBorrowValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release _ hrun _ _
+  simp only [lowerBorrow] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerArgsValuePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    _ hrun _ _
+  simp only [lowerArgs] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem applyRestNonErasedValuePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    ApplyRestNonErasedValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun _ _
+  simp only [applyRest] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerSpineValuePreservesWithin_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerSpineValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  simp only [lowerSpine] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- The bounded reachable semantic cluster is vacuous at zero compiler
+fuel. -/
+theorem lowerEValuePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerEValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient 0 := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av hsource hrun _ _
+  exact lowerEValuePreservesBelow_zero src hsource hrun
+
+theorem lowerBorrowValuePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerBorrowValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient 0 := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun _ _
+  exact lowerBorrowValuePreservesBelow_zero src hsource hrun
+
+theorem lowerArgsValuePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient 0 := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun _ _
+  exact lowerArgsValuePreservesBelow_zero src hsource hrun
+
+theorem applyRestNonErasedValuePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun _ _
+  simp only [applyRest] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+theorem lowerSpineValuePreservesWithinBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (ambient : LowSt) :
+    LowerSpineValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av hsource hrun _ _
+  exact lowerSpineValuePreservesBelow_zero src hsource hrun
+
+theorem lowerSpineReflectsErased_zero (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) : LowerSpineReflectsErased sourceCtx src 0 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _
+  simp only [lowerSpine] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- The genuine `applyRest` branch always returns a fresh slot descriptor.
+Consequently a successful erased descriptor can only have come from the
+syntactic erased-function branch. -/
+theorem applyRest_nonErased_run_result_slot
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {resultWorld : Owned} {pre : Emit} {function : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hfunction : function ≠ .constA .erased)
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok (output, emit, av) finalState) :
+    ∃ abs, av = .slotA abs := by
+  cases fuel with
+  | zero =>
+    simp only [applyRest] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ fuel =>
+    cases function with
+    | slotA functionAbs =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, requireState, _, hafterRequire⟩ :=
+        estateBindRun_ok_inv hrun
+      obtain ⟨argsResult, argsState, _, hpureRun⟩ :=
+        estateBindRun_ok_inv hafterRequire
+      rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+      have hpure :
+          (argsOutput.bump,
+            pre ∘ emitArgs ∘
+              emitOp (.apply ((AVal.slotA functionAbs).toAtom argsOutput)
+                (avs.map (·.toAtom argsOutput)).toArray),
+            AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+            argsState = finalState := by
+        simpa using hpureRun
+      exact ⟨argsOutput.depth, (congrArg Prod.snd
+        (congrArg Prod.snd hpure.1)).symm⟩
+    | constA atom =>
+      cases atom with
+      | erased => exact (hfunction rfl).elim
+      | var index =>
+        simp only [applyRest] at hrun
+        obtain ⟨_, requireState, _, hafterRequire⟩ :=
+          estateBindRun_ok_inv hrun
+        obtain ⟨argsResult, argsState, _, hpureRun⟩ :=
+          estateBindRun_ok_inv hafterRequire
+        rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+        have hpure :
+            (argsOutput.bump,
+              pre ∘ emitArgs ∘
+                emitOp (.apply ((AVal.constA (.var index)).toAtom argsOutput)
+                  (avs.map (·.toAtom argsOutput)).toArray),
+              AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+              argsState = finalState := by
+          simpa [Function.comp_def] using hpureRun
+        exact ⟨argsOutput.depth, (congrArg Prod.snd
+          (congrArg Prod.snd hpure.1)).symm⟩
+      | lit literal =>
+        simp only [applyRest] at hrun
+        obtain ⟨_, requireState, _, hafterRequire⟩ :=
+          estateBindRun_ok_inv hrun
+        obtain ⟨argsResult, argsState, _, hpureRun⟩ :=
+          estateBindRun_ok_inv hafterRequire
+        rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+        have hpure :
+            (argsOutput.bump,
+              pre ∘ emitArgs ∘
+                emitOp (.apply ((AVal.constA (.lit literal)).toAtom argsOutput)
+                  (avs.map (·.toAtom argsOutput)).toArray),
+              AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+              argsState = finalState := by
+          simpa [Function.comp_def] using hpureRun
+        exact ⟨argsOutput.depth, (congrArg Prod.snd
+          (congrArg Prod.snd hpure.1)).symm⟩
+
+/-- Every successful `knownCall` returns a slot: terminal calls push the
+operation result directly, and over-application enters `applyRest` with that
+non-erased slot as its function descriptor. -/
+theorem knownCall_run_result_slot
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {build : Array Atom → Op} {count : Nat} {argWorlds : List Owned}
+    {resultWorld : Owned} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (knownCall src fuel input build count argWorlds resultWorld
+      args).run state = .ok (output, emit, av) finalState) :
+    ∃ abs, av = .slotA abs := by
+  cases fuel with
+  | zero =>
+    simp only [knownCall] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ fuel =>
+    simp only [knownCall] at hrun
+    obtain ⟨argsResult, argsState, _, hafterArgs⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    by_cases hterminal : args.length ≤ count
+    · rw [if_pos hterminal] at hafterArgs
+      have hpure :
+          (argsOutput.bump,
+            emitArgs ∘ emitOp
+              (build (avs.map (·.toAtom argsOutput)).toArray),
+            AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+            argsState = finalState := by
+        simpa using hafterArgs
+      exact ⟨argsOutput.depth, (congrArg Prod.snd
+        (congrArg Prod.snd hpure.1)).symm⟩
+    · rw [if_neg hterminal] at hafterArgs
+      exact applyRest_nonErased_run_result_slot (by simp) hafterArgs
+
+theorem applyRest_run_constErased_inv
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {resultWorld : Owned} {pre : Emit} {function : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt} {emit : Emit}
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok (output, emit, .constA .erased) finalState) :
+    function = .constA .erased := by
+  by_cases hfunction : function = .constA .erased
+  · exact hfunction
+  · obtain ⟨abs, hav⟩ :=
+      applyRest_nonErased_run_result_slot hfunction hrun
+    contradiction
+
+theorem knownCall_run_ne_constErased
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {build : Array Atom → Op} {count : Nat} {argWorlds : List Owned}
+    {resultWorld : Owned} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit}
+    (hrun : (knownCall src fuel input build count argWorlds resultWorld
+      args).run state = .ok (output, emit, .constA .erased) finalState) :
+    False := by
+  obtain ⟨abs, hav⟩ := knownCall_run_result_slot hrun
+  contradiction
+
+/-- Static reference dispatch never returns the literal erased descriptor.
+Every successful branch terminates in `knownCall`; constructor wrappers add
+only a stateful lookup before that call. -/
+theorem lowerSpine_ref_run_ne_constErased
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {address : Ixon.Address} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit}
+    (hrun : (lowerSpine src fuel input world (.ref address) args).run
+      state = .ok (output, emit, .constA .erased) finalState) :
+    False := by
+  cases fuel with
+  | zero =>
+    simp only [lowerSpine] at hrun
+    exact estateThrowRun_not_ok hrun
+  | succ fuel =>
+    simp only [lowerSpine] at hrun
+    cases hsrc : src address with
+    | none =>
+      rw [hsrc] at hrun
+      exact estateThrowRun_not_ok hrun
+    | some source =>
+      rw [hsrc] at hrun
+      cases source with
+      | defn result body =>
+        simp only at hrun
+        by_cases hunder : args.length < lamArity body
+        · rw [if_pos hunder] at hrun
+          have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+          cases world with
+          | unique =>
+            exact estateThrowRun_not_ok (by simpa [huuEq] using hrun)
+          | shared =>
+            cases result with
+            | unique =>
+              exact estateThrowRun_not_ok
+                (by simpa [hsuEq, huuEq] using hrun)
+            | shared =>
+              cases hp : papSafe body with
+              | false =>
+                exact estateThrowRun_not_ok
+                  (by simpa [hsuEq, hp] using hrun)
+              | true =>
+                apply knownCall_run_ne_constErased
+                simpa [hsuEq, hp] using hrun
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, _, _, hknownRun⟩ := estateBindRun_ok_inv hrun
+          exact knownCall_run_ne_constErased hknownRun
+      | ctor tag arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+          cases world with
+          | unique =>
+            exact estateThrowRun_not_ok (by simpa [huuEq] using hrun)
+          | shared =>
+            have hrun' :
+                ((wrapperFor address tag arity) >>= fun wrapper =>
+                  knownCall src fuel input (.papp wrapper ·) args.length
+                    (List.replicate args.length .shared) .shared args).run
+                    state =
+                  .ok (output, emit, .constA .erased) finalState := by
+              simpa [hsuEq] using hrun
+            obtain ⟨_, _, _, hknownRun⟩ := estateBindRun_ok_inv hrun'
+            exact knownCall_run_ne_constErased hknownRun
+        · apply knownCall_run_ne_constErased
+          simpa [if_neg hunder] using hrun
+      | recursor numArgs natLit rules =>
+        simp only at hrun
+        by_cases hunder : args.length < numArgs + 1
+        · rw [if_pos hunder] at hrun
+          have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+          cases world with
+          | unique =>
+            exact estateThrowRun_not_ok (by simpa [huuEq] using hrun)
+          | shared =>
+            apply knownCall_run_ne_constErased
+            simpa [hsuEq] using hrun
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, _, _, hknownRun⟩ := estateBindRun_ok_inv hrun
+          exact knownCall_run_ne_constErased hknownRun
+      | extern arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+          cases world with
+          | unique =>
+            exact estateThrowRun_not_ok (by simpa [huuEq] using hrun)
+          | shared =>
+            apply knownCall_run_ne_constErased
+            simpa [hsuEq] using hrun
+        · apply knownCall_run_ne_constErased
+          simpa [if_neg hunder] using hrun
+
+/-- Shared operational decomposition for one successful argument-list step.
+The result family is independent of the source relation, so semantic and
+profile clients share nil recovery, monadic sequencing, emitter/list
+reconstruction, and final-state recovery. -/
+theorem lowerArgs_run_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {args : List (IxIR0.Expr × Owned)}
+    {state finalState : LowSt} {emit : Emit} {avs : List AVal}
+    {Result : List (IxIR0.Expr × Owned) → VEnv → Emit → List AVal →
+      LowSt → Prop}
+    (hnil : Result [] input (_root_.id : Emit) [] state)
+    (hcons : ∀ (expr : IxIR0.Expr) (world : Owned)
+        (tail : List (IxIR0.Expr × Owned))
+        {middle actualOutput : VEnv} {emitHead emitTail : Emit}
+        {av : AVal} {tailAVals : List AVal}
+        {middleState tailState : LowSt},
+      (lowerE src fuel input world expr).run state =
+        .ok (middle, emitHead, av) middleState →
+      (lowerArgs src fuel middle tail).run middleState =
+        .ok (actualOutput, emitTail, tailAVals) tailState →
+      Result ((expr, world) :: tail) actualOutput (emitHead ∘ emitTail)
+        (av :: tailAVals) tailState)
+    (hrun : (lowerArgs src (fuel + 1) input args).run state =
+      .ok (output, emit, avs) finalState) :
+    Result args output emit avs finalState := by
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact hnil
+  | cons arg tail =>
+    rcases arg with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases headResult with ⟨middle, emitHead, av⟩
+    dsimp only at hafterHead
+    obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+      estateBindRun_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, emitTail, tailAVals⟩
+    have hpure :
+        (actualOutput, emitHead ∘ emitTail, av :: tailAVals) =
+            (output, emit, avs) ∧
+          tailState = finalState := by
+      simpa using hpureRun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    exact hcons expr world tail hheadRun htailRun
+
+/-- Semantic-source adapter for `lowerArgs_run_core`. `SourceArgsEval`
+inversion remains canonical across ordinary, bounded, and reachable semantic
+clients, while the operational decomposition is shared with profile proofs. -/
+private theorem lowerArgs_run_value_sound_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {sourceEnv sourceValues : List IxIR0.Value}
+    {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+    {emit : Emit} {avs : List AVal}
+    {Result : VEnv → List IxIR0.Value → List Owned → Emit →
+      List AVal → LowSt → Prop}
+    (hnil : Result input [] [] (_root_.id : Emit) [] state)
+    (hcons : ∀ (expr : IxIR0.Expr) (world : Owned)
+        (tail : List (IxIR0.Expr × Owned))
+        {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+        {sourceTail : List IxIR0.Value}
+        {middle actualOutput : VEnv} {emitHead emitTail : Emit}
+        {av : AVal} {tailAVals : List AVal}
+        {middleState tailState : LowSt},
+      IxIR0.eval sourceCtx sourceFuel sourceEnv expr = .ok sourceValue →
+      SourceArgsEval sourceCtx sourceEnv (tail.map Prod.fst) sourceTail →
+      (lowerE src fuel input world expr).run state =
+        .ok (middle, emitHead, av) middleState →
+      (lowerArgs src fuel middle tail).run middleState =
+        .ok (actualOutput, emitTail, tailAVals) tailState →
+      Result actualOutput (sourceValue :: sourceTail)
+        (world :: tail.map Prod.snd) (emitHead ∘ emitTail)
+        (av :: tailAVals) tailState)
+    (hsource : SourceArgsEval sourceCtx sourceEnv (args.map Prod.fst)
+      sourceValues)
+    (hrun : (lowerArgs src (fuel + 1) input args).run state =
+      .ok (output, emit, avs) finalState) :
+    Result output sourceValues (args.map Prod.snd) emit avs finalState := by
+  exact (lowerArgs_run_core
+    (Result := fun actualArgs actualOutput actualEmit actualAVals
+        actualState =>
+      ∀ {actualSourceValues : List IxIR0.Value},
+        SourceArgsEval sourceCtx sourceEnv (actualArgs.map Prod.fst)
+          actualSourceValues →
+        Result actualOutput actualSourceValues (actualArgs.map Prod.snd)
+          actualEmit actualAVals actualState)
+    (hnil := by
+      intro actualSourceValues hactualSource
+      cases hactualSource
+      exact hnil)
+    (hcons := by
+      intro expr world tail middle actualOutput emitHead emitTail av
+        tailAVals middleState tailState hheadRun htailRun
+        actualSourceValues hactualSource
+      change SourceArgsEval sourceCtx sourceEnv
+        (expr :: tail.map Prod.fst) actualSourceValues at hactualSource
+      cases hactualSource with
+      | cons hsourceHead hsourceTail =>
+        exact hcons expr world tail hsourceHead hsourceTail hheadRun htailRun)
+    hrun) hsource
+
+/-- The semantic `lowerArgs` induction step. The source relation and the
+executable lowerer decompose in the same list order, after which
+`LowerResultValueSound.consArgs` supplies the semantic frame rule needed by
+the tail. -/
+theorem lowerArgsValuePreserves_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (htail : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel) :
+    LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun
+  exact lowerArgs_run_value_sound_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals _ =>
+      LowerArgsValueSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv actualSourceValues worlds actualEmit actualAVals)
+    (hnil := lowerArgs_nil_value_sound)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead hsourceTail
+        hheadRun htailRun
+      exact (hexpr hsourceHead hheadRun).consArgs
+        (htail hsourceTail htailRun))
+    hsource hrun
+
+/-- Shared strict-fuel closure for argument judgments. The predicate
+parameters keep semantic and profile result contracts distinct while
+predecessor-hypothesis narrowing and tail recursion are proved once. -/
+theorem lowerArgsPreserves_of_expr_core
+    {Expr Args : Nat → Prop}
+    (hzero : Args 0)
+    (hsucc : ∀ {fuel}, Expr fuel → Args fuel → Args (fuel + 1))
+    (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel → Expr prior) :
+    Args fuel := by
+  induction fuel with
+  | zero => exact hzero
+  | succ fuel ih =>
+    apply hsucc
+    · exact hexpr fuel (Nat.lt_succ_self fuel)
+    · apply ih
+      intro prior hprior
+      exact hexpr prior (Nat.lt_trans hprior (Nat.lt_succ_self fuel))
+
+/-- `lowerArgs` semantic preservation at any compiler fuel follows from the
+strictly smaller expression hypotheses, matching the recursive fuel
+discipline of the executable mutually recursive cluster. -/
+theorem lowerArgsValuePreserves_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src prior) :
+    LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur src fuel :=
+  lowerArgsPreserves_of_expr_core
+    (Expr := LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src)
+    (Args := LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur src)
+    (hzero := lowerArgsValuePreserves_zero src)
+    (hsucc := fun hexpr htail =>
+      lowerArgsValuePreserves_succ hexpr htail)
+    fuel hexpr
+
+theorem lowerArgsValuePreservesBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEValuePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src fuel)
+    (htail : LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel) :
+    LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun
+  exact lowerArgs_run_value_sound_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals _ =>
+      LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv actualSourceValues worlds actualEmit
+        actualAVals)
+    (hnil := lowerArgs_nil_value_sound_below)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead hsourceTail
+        hheadRun htailRun
+      exact (hexpr hsourceHead hheadRun).consArgs
+        (htail hsourceTail htailRun))
+    hsource hrun
+
+theorem lowerArgsValuePreservesBelow_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+        src prior) :
+    LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+      src fuel :=
+  lowerArgsPreserves_of_expr_core
+    (Expr := LowerEValuePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src)
+    (Args := LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src)
+    (hzero := lowerArgsValuePreservesBelow_zero src)
+    (hsucc := fun hexpr htail =>
+      lowerArgsValuePreservesBelow_succ hexpr htail)
+    fuel hexpr
+
+/-! ### Semantic call primitives at the operation level -/
+
+/-- Semantic transfer across a direct invocation, from a contract available
+strictly below the invocation fuel. A successful invocation at `fuel + 1`
+enters the callee body at `fuel`, which is exactly where the mutual
+declaration induction needs the strict decrease. -/
+theorem invoke_fn_value_below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {f : Ixon.Address}
+    {args : List RVal} {store store' : Store} {value : RVal} {d : FnDef}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hdecl : ctx.decls f = some (.fn d))
+    (harity : argWorlds.length = d.arity)
+    (hcontract : ∀ {smaller : Nat}, smaller < fuel →
+      FnValuePreservesAt funRel sourceCtx ctx d argWorlds sourceFunction
+        smaller)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+    (hinvoke : invoke ctx fuel f args store = .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  cases fuel with
+  | zero => simp [invoke] at hinvoke
+  | succ fuel =>
+    simp only [invoke, hdecl] at hinvoke
+    split at hinvoke
+    · contradiction
+    next hlen =>
+      have hargsLength : args.length = argWorlds.length := by
+        have hd : args.length = d.arity := by simpa using hlen
+        exact hd.trans harity.symm
+      cases hrun : runCode ctx fuel d store args.reverse d.body with
+      | error e =>
+        rw [hrun] at hinvoke
+        change (.error e : Except Err (Store × RVal)) =
+          .ok (store', value) at hinvoke
+        contradiction
+      | ok out =>
+        rw [hrun] at hinvoke
+        change checkResultWorld d.result out = .ok (store', value) at hinvoke
+        obtain ⟨hpair, _⟩ := checkResultWorld_ok hinvoke
+        subst out
+        exact hcontract (Nat.lt_succ_self fuel) hargsLength hargs hsource
+          hframe hown hrun
+
+/-- Operation-level semantic direct call. -/
+theorem runOp_call_value_below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur d : FnDef}
+    {store store' : Store} {env : List RVal} {f : Ixon.Address}
+    {atoms : Array Atom} {args : List RVal} {value : RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls f = some (.fn d))
+    (harity : argWorlds.length = d.arity)
+    (hcontract : ∀ {smaller : Nat}, smaller < fuel →
+      FnValuePreservesAt funRel sourceCtx ctx d argWorlds sourceFunction
+        smaller)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.call f atoms) =
+      .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hatoms, bindOk] at hrun
+  exact invoke_fn_value_below hdecl harity hcontract hargs hsource hframe
+    hown hrun
+
+/-- Operation-level semantic recursive self call. The current function's own
+contract is available at the enclosing index, since the body re-enters at
+`fuel` while the operation runs at `fuel + 1`. -/
+theorem runOp_callSelf_value_below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {atoms : Array Atom}
+    {args : List RVal} {value : RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (harity : argWorlds.length = cur.arity)
+    (hcontract : ∀ {smaller : Nat}, smaller < fuel + 1 →
+      FnValuePreservesAt funRel sourceCtx ctx cur argWorlds sourceFunction
+        smaller)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.callSelf atoms) =
+      .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hatoms, bindOk] at hrun
+  split at hrun
+  · contradiction
+  next hlen =>
+    have hargsLength : args.length = argWorlds.length := by
+      have hd : args.length = cur.arity := by simpa using hlen
+      exact hd.trans harity.symm
+    cases hcode : runCode ctx fuel cur store args.reverse cur.body with
+    | error e =>
+      rw [hcode] at hrun
+      change (.error e : Except Err (Store × RVal)) =
+        .ok (store', value) at hrun
+      contradiction
+    | ok out =>
+      rw [hcode] at hrun
+      change checkResultWorld cur.result out = .ok (store', value) at hrun
+      obtain ⟨hpair, _⟩ := checkResultWorld_ok hrun
+      subst out
+      exact hcontract (Nat.lt_succ_self fuel) hargsLength hargs hsource
+        hframe hown hcode
+
+/-- Unbounded direct-call semantic primitive. -/
+theorem runOp_call_value {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur d : FnDef}
+    {store store' : Store} {env : List RVal} {f : Ixon.Address}
+    {atoms : Array Atom} {args : List RVal} {value : RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.call f atoms) =
+      .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  exact runOp_call_value_below hatoms hdecl hcontract.arity_eq
+    (fun _ => hcontract.preserves) hargs hsource hframe hown hrun
+
+/-- Unbounded recursive-self-call semantic primitive. -/
+theorem runOp_callSelf_value {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {atoms : Array Atom}
+    {args : List RVal} {value : RVal}
+    {argWorlds : List Owned} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hcontract : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.callSelf atoms) =
+      .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  exact runOp_callSelf_value_below hatoms hcontract.arity_eq
+    (fun _ => hcontract.preserves) hargs hsource hframe hown hrun
+
+/-- Operation-level semantic extern call. A successful IxIR₁ operation
+leaves the store unchanged; the explicit oracle contract supplies the result
+graph for the corresponding saturated IxIR₀ extern application. -/
+theorem runOp_extern_value {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {f : Ixon.Address}
+    {atoms : Array Atom} {args : List RVal} {value : RVal}
+    {arity : Nat} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hrun : runOp ctx (fuel + 1) cur store env (.extern f atoms) =
+      .ok (store', value)) :
+    store' = store ∧ Sim.ValueGraph funRel store sourceResult value := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hatoms, bindOk] at hrun
+  cases horacle : callScalarOracle ctx f args with
+  | error error =>
+    rw [horacle] at hrun
+    contradiction
+  | ok result =>
+    rw [horacle] at hrun
+    have hpair : (store, result) = (store', value) :=
+      Except.ok.inj hrun
+    cases hpair
+    exact ⟨rfl, hcontract.preserves hlookup href hlength hsource hargs
+      horacle⟩
+
+/-- Operation-level higher-order semantic application under a bounded
+contract environment. -/
+theorem runOp_apply_value_below {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {functionAtom : Atom}
+    {function : RVal} {atoms : Array Atom} {args : List RVal}
+    {value : RVal} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hcontract : ApplyValueContractBelow funRel sourceCtx ctx (fuel + 1))
+    (hfunctionGraph : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env
+      (.apply functionAtom atoms) = .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hfunction, bindOk, hatoms, bindOk] at hrun
+  exact hcontract.preserves (Nat.lt_succ_self fuel) hfunctionGraph hargs
+    hsource hframe hown hrun
+
+/-- Unbounded operation-level higher-order semantic application. -/
+theorem runOp_apply_value {funRel : Sim.FunctionRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {functionAtom : Atom}
+    {function : RVal} {atoms : Array Atom} {args : List RVal}
+    {value : RVal} {sourceFunction sourceResult : IxIR0.Value}
+    {sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hatoms : resolveAtoms env atoms = .ok args)
+    (hcontract : ApplyValueContract funRel sourceCtx ctx)
+    (hfunctionGraph : Sim.ValueGraph funRel store sourceFunction function)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs sourceResult)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env
+      (.apply functionAtom atoms) = .ok (store', value)) :
+    Sim.ValueGraph funRel store' sourceResult value ∧
+      Sim.RootsGraph funRel store' sourceRest rest :=
+  runOp_apply_value_below hfunction hatoms (hcontract.below (fuel + 1))
+    hfunctionGraph hargs hsource hframe hown hrun
+
+/-- State-indexed semantic direct-call primitive.  This is the operation
+midpoint used by paired value/profile proofs: the arguments and caller frame
+are consumed and reconstructed around the exact callee run. -/
+theorem call_graph_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {avs : List AVal} {f : Ixon.Address}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    OpSound ctx cur (.call f (avs.map (·.toAtom output)).toArray)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult d.result (.slotA output.depth) sourceRest rest slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+      runOp_call_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hdecl hvalue hvalueGraphs
+        hsource hcombinedFrame hownCall hrun
+    have hownAfter : RootOwnership store'
+        (⟨d.result, result⟩ :: envRoots ++ rest) :=
+      runOp_call_owned havs.resolveAtoms hdecl hownership hownCall hrun
+    obtain ⟨henvAfter, hrestAfter⟩ :=
+      hcombinedAfter.splitAppend henvFrame.lengths
+    have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+        output sourceOutput env envRoots :=
+      houtput.ofRootsGraph henvAfter
+    refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+      hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- State-indexed semantic `callSelf` primitive, parallel to
+`call_graph_op` but entering the current declaration. -/
+theorem callSelf_graph_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {avs : List AVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    OpSound ctx cur (.callSelf (avs.map (·.toAtom output)).toArray)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs worlds avs sourceRest rest slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult cur.result (.slotA output.depth) sourceRest rest
+        slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+      runOp_callSelf_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hvalue hvalueGraphs hsource
+        hcombinedFrame hownCall hrun
+    have hownAfter : RootOwnership store'
+        (⟨cur.result, result⟩ :: envRoots ++ rest) :=
+      runOp_callSelf_owned havs.resolveAtoms hownership hownCall hrun
+    obtain ⟨henvAfter, hrestAfter⟩ :=
+      hcombinedAfter.splitAppend henvFrame.lengths
+    have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+        output sourceOutput env envRoots :=
+      houtput.ofRootsGraph henvAfter
+    refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+      hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Consume a semantic argument vector through a direct call. The callee's
+frame clause preserves the canonical environment roots and caller roots as
+one concatenated graph; `VEnvValueGraph.ofRootsGraph` reconstructs the
+unchanged logical environment after splitting that frame. -/
+theorem LowerArgsValueSound.call_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : FnOwnershipContract ctx d worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound :=
+        hargs.toLowerArgsSound.call_owned hdecl hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+      runOp_call_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hdecl hvalue hvalueGraphs
+        hsource hcombinedFrame hownCall hrun
+    have hownAfter : RootOwnership store'
+        (⟨d.result, result⟩ :: envRoots ++ rest) :=
+      runOp_call_owned havs.resolveAtoms hdecl hownership hownCall hrun
+    obtain ⟨henvAfter, hrestAfter⟩ :=
+      hcombinedAfter.splitAppend henvFrame.lengths
+    have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+        output sourceOutput env envRoots :=
+      houtput.ofRootsGraph henvAfter
+    refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+      hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Fuel-bounded direct-call semantic consumer. -/
+theorem LowerArgsValueSoundBelow.call_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    {f : Ixon.Address}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : FnOwnershipContractBelow ctx d worlds limit)
+    (hvalue : FnValueContractBelow funRel sourceCtx ctx d worlds
+      sourceFunction limit)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump sourceInput sourceOutput sourceResult d.result
+      (emit ∘ emitOp (.call f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hargs.toLowerArgsSoundBelow.call_owned hdecl hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSoundBelow.emit
+  intro fuel store env store' result hfuel hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hvalueAt : ∀ {smaller : Nat}, smaller < fuel →
+        FnValuePreservesAt funRel sourceCtx ctx d worlds sourceFunction
+          smaller := by
+      intro smaller hsmaller
+      exact hvalue.preserves
+        (Nat.lt_trans hsmaller
+          (Nat.lt_trans (Nat.lt_succ_self fuel) hfuel))
+    obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+      runOp_call_value_below
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hdecl hvalue.arity_eq hvalueAt
+        hvalueGraphs hsource hcombinedFrame hownCall hrun
+    have hownershipAt : FnOwnershipContractBelow ctx d worlds fuel :=
+      hownership.mono (Nat.le_of_lt
+        (Nat.lt_trans (Nat.lt_succ_self fuel) hfuel))
+    have hownAfter : RootOwnership store'
+        (⟨d.result, result⟩ :: envRoots ++ rest) :=
+      runOp_call_owned_below havs.resolveAtoms hdecl hownershipAt
+        hownCall hrun
+    obtain ⟨henvAfter, hrestAfter⟩ :=
+      hcombinedAfter.splitAppend henvFrame.lengths
+    have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+        output sourceOutput env envRoots :=
+      houtput.ofRootsGraph henvAfter
+    refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+      hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self counterpart of `LowerArgsValueSound.call_graph`. -/
+theorem LowerArgsValueSound.callSelf_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound :=
+        hargs.toLowerArgsSound.callSelf_owned hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+      runOp_callSelf_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hvalue hvalueGraphs hsource
+        hcombinedFrame hownCall hrun
+    have hownAfter : RootOwnership store'
+        (⟨cur.result, result⟩ :: envRoots ++ rest) :=
+      runOp_callSelf_owned havs.resolveAtoms hownership hownCall hrun
+    obtain ⟨henvAfter, hrestAfter⟩ :=
+      hcombinedAfter.splitAppend henvFrame.lengths
+    have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+        output sourceOutput env envRoots :=
+      houtput.ofRootsGraph henvAfter
+    refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+      hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Fuel-bounded recursive-self semantic consumer. -/
+theorem LowerArgsValueSoundBelow.callSelf_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hownership : FnOwnershipContractBelow ctx cur worlds limit)
+    (hvalue : FnValueContractBelow funRel sourceCtx ctx cur worlds
+      sourceFunction limit)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hargs.toLowerArgsSoundBelow.callSelf_owned hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSoundBelow.emit
+  intro fuel store env store' result hfuel hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have henvFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput) envRoots :=
+    houtput.entries.rootsGraphExact
+  have hcombinedFrame : Sim.RootsGraph funRel store
+      (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+      (envRoots ++ rest) :=
+    henvFrame.append hrestGraph
+  have hownCall : RootOwnership store
+      (rootsForWorlds worlds values ++ (envRoots ++ rest)) := by
+    simpa [List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hvalueAt : ∀ {smaller : Nat}, smaller < fuel + 1 →
+        FnValuePreservesAt funRel sourceCtx ctx cur worlds sourceFunction
+          smaller := by
+      intro smaller hsmaller
+      exact hvalue.preserves (Nat.lt_trans hsmaller hfuel)
+    obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+      runOp_callSelf_value_below
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hvalue.arity_eq hvalueAt
+        hvalueGraphs hsource hcombinedFrame hownCall hrun
+    have hownershipAt : FnOwnershipContractBelow ctx cur worlds
+        (fuel + 1) :=
+      hownership.mono (Nat.le_of_lt hfuel)
+    have hownAfter : RootOwnership store'
+        (⟨cur.result, result⟩ :: envRoots ++ rest) :=
+      runOp_callSelf_owned_below havs.resolveAtoms hownershipAt
+        hownCall hrun
+    obtain ⟨henvAfter, hrestAfter⟩ :=
+      hcombinedAfter.splitAppend henvFrame.lengths
+    have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+        output sourceOutput env envRoots :=
+      houtput.ofRootsGraph henvAfter
+    refine ⟨⟨envRoots, result, houtputAfter.bump result, ?_,
+      hresultGraph, hrestAfter, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Recursive-self call where the callee's source identity is supplied by a
+synthetic `recSelf` environment entry. The relation witness is intentionally
+recovered inside the semantic precondition; no runtime slot represents this
+entry, so it cannot be selected by an ordinary `ValueGraph` lookup. -/
+theorem LowerArgsValueSound.callSelf_entry_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hownership : FnOwnershipContract ctx cur worlds)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur worlds sourceFunction)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound :=
+        hargs.toLowerArgsSound.callSelf_owned hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots post code hcode
+  intro fuel store env finalStore finalValue hpre hrun
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨source, hsourceLookup, hself⟩ :=
+    hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  have hsound := hargs.callSelf_graph hownership (hvalue hself) hsource
+  exact hsound.graphEmits sourceRest rest slots post code hcode
+    ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ hrun
+
+/-- Fuel-bounded recursive-self call where the source identity is recovered
+from the synthetic `recSelf` environment entry. -/
+theorem LowerArgsValueSoundBelow.callSelf_entry_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv} {index arity : Nat}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {worlds : List Owned} {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs worlds emit avs)
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hhead : sourceInput[index]? = some sourceFunction)
+    (hownership : FnOwnershipContractBelow ctx cur worlds limit)
+    (hvalue : recSelfRel sourceFunction arity →
+      FnValueContractBelow funRel sourceCtx ctx cur worlds sourceFunction
+        limit)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump sourceInput sourceOutput sourceResult cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hargs.toLowerArgsSoundBelow.callSelf_owned hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hpre hrun
+  obtain ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ := hpre
+  obtain ⟨source, hsourceLookup, hself⟩ :=
+    hinput.getRecSelf hentry
+  have hsourceEq : source = sourceFunction := by
+    rw [hhead] at hsourceLookup
+    exact (Option.some.inj hsourceLookup).symm
+  subst source
+  have hsound := hargs.callSelf_graph hownership (hvalue hself) hsource
+  exact hsound.graphEmits sourceRest rest slots bound hbound post code hcode
+    hfuel ⟨⟨envRoots, hinput, hrestGraph, hown⟩, hslots⟩ hrun
+
+/-- Operation-level semantic scalar extern call. -/
+theorem extern_graph_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {output : VEnv} {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {avs : List AVal} {f : Ixon.Address} {arity : Nat}
+    {resultWorld : Owned}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    OpSound ctx cur (.extern f (avs.map (·.toAtom output)).toArray)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output sourceOutput
+        sourceArgs (List.replicate avs.length .shared) avs sourceRest rest
+        slots)
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult resultWorld (.slotA output.depth) sourceRest rest
+        slots) := by
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hownExtern : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hownAfter : RootOwnership store'
+        (⟨resultWorld, result⟩ :: envRoots ++ rest) :=
+      runOp_extern_owned havs.resolveAtoms hownExtern hrun
+    obtain ⟨hstore, hresultGraph⟩ :=
+      runOp_extern_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hcontract hlookup href hlength
+        hsource hvalueGraphs hrun
+    subst store'
+    refine ⟨⟨envRoots, result, houtput.bump result, ?_,
+      hresultGraph, hrestGraph, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Consume a homogeneous shared argument prefix through the scalar extern
+ABI while preserving its source result. Since the ABI rejects locations and
+does not modify the store, both the semantic environment and caller frame
+remain valid without a heap transport step. -/
+theorem LowerArgsValueSound.extern_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {f : Ixon.Address}
+    {arity : Nat} {resultWorld : Owned}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      input output.bump sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound := hargs.toLowerArgsSound.extern_owned
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hownExtern : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hownAfter : RootOwnership store'
+        (⟨resultWorld, result⟩ :: envRoots ++ rest) :=
+      runOp_extern_owned havs.resolveAtoms hownExtern hrun
+    obtain ⟨hstore, hresultGraph⟩ :=
+      runOp_extern_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hcontract hlookup href hlength
+        hsource hvalueGraphs hrun
+    subst store'
+    refine ⟨⟨envRoots, result, houtput.bump result, ?_,
+      hresultGraph, hrestGraph, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+theorem LowerArgsValueSoundBelow.extern_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {f : Ixon.Address}
+    {arity : Nat} {resultWorld : Owned}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hlength : sourceArgs.length = arity)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output.bump sourceInput sourceOutput sourceResult resultWorld
+      (emit ∘ emitOp (.extern f (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow := hargs.toLowerArgsSoundBelow.extern_owned
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  have hvaluesLength : values.length = avs.length :=
+    havs.lengths.2.symm
+  have hroots :
+      rootsForWorlds (List.replicate avs.length .shared) values =
+        rootsFor .shared values :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+  have hownExtern : RootOwnership store
+      (rootsFor .shared values ++ (envRoots ++ rest)) := by
+    simpa [hroots, List.append_assoc] using hown
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hownAfter : RootOwnership store'
+        (⟨resultWorld, result⟩ :: envRoots ++ rest) :=
+      runOp_extern_owned havs.resolveAtoms hownExtern hrun
+    obtain ⟨hstore, hresultGraph⟩ :=
+      runOp_extern_value
+        (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+        (fuel := fuel) havs.resolveAtoms hcontract hlookup href hlength
+        hsource hvalueGraphs hrun
+    subst store'
+    refine ⟨⟨envRoots, result, houtput.bump result, ?_,
+      hresultGraph, hrestGraph, hownAfter⟩, hslots.bump result⟩
+    apply AValRealizes.slot
+    · simp [VEnv.bump]
+    · simp [VEnv.bump, VEnv.rel]
+
+/-- Operation-level semantic higher-order application from the protected
+post-argument state.  The original realization witness fixes the runtime
+value of stable constant descriptors; slot descriptors are reconstructed
+from the protected absolute slot carried through argument lowering. -/
+theorem apply_graph_op
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {functionInput output : VEnv} {functionEnv : List RVal}
+    {sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {avs : List AVal} {function : AVal} {functionValue : RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    {slots : List (Nat × RVal)}
+    (hfunctionStable : AValStable function)
+    (hfunction : AValRealizes functionInput functionEnv function
+      functionValue)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    OpSound ctx cur
+      (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray)
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest)
+        (⟨.shared, functionValue⟩ :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth) sourceRest rest slots) := by
+  intro opFuel argsStore argsEnv store' result hargsPost hrunOp
+  obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+      hframeGraphFinal, hownArgs⟩, hslotsOut⟩ := hargsPost
+  cases hframeGraphFinal with
+  | cons _ hfunctionWorldFinal hfunctionGraphFinal hrestGraphFinal =>
+    have hfunctionFinal :
+        AValRealizes output argsEnv function functionValue :=
+      hfunctionStable.realize_of_protection hfunction
+        hslotsOut.left_of_append
+    have hvaluesLength : values.length = avs.length :=
+      havs.lengths.2.symm
+    have hroots :
+        rootsForWorlds (List.replicate avs.length .shared) values =
+          rootsFor .shared values :=
+      rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+    have hownApply : RootOwnership argsStore
+        (⟨.shared, functionValue⟩ :: rootsFor .shared values ++
+          (outRoots ++ rest)) := by
+      apply hownArgs.perm
+      simpa [hroots, List.append_assoc] using
+        (perm_extract_root ⟨.shared, functionValue⟩
+          (rootsForWorlds (List.replicate avs.length .shared) values ++
+            outRoots) [] rest)
+    have henvFrame : Sim.RootsGraph funRel argsStore
+        (entrySourceRoots output.entries sourceOutput) outRoots :=
+      houtput.entries.rootsGraphExact
+    have hcombinedFrame : Sim.RootsGraph funRel argsStore
+        (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+        (outRoots ++ rest) :=
+      henvFrame.append hrestGraphFinal
+    cases opFuel with
+    | zero => simp [runOp] at hrunOp
+    | succ opFuel =>
+      obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+        runOp_apply_value
+          (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+          (fuel := opFuel) hfunctionFinal.resolveAtom havs.resolveAtoms
+          hvalue (by simpa using hfunctionGraphFinal) hvalueGraphs hsource
+          hcombinedFrame hownApply hrunOp
+      have hownAfter : RootOwnership store'
+          (⟨.shared, result⟩ :: outRoots ++ rest) :=
+        runOp_apply_owned hfunctionFinal.resolveAtom havs.resolveAtoms
+          hownership hownApply hrunOp
+      obtain ⟨henvAfter, hrestAfter⟩ :=
+        hcombinedAfter.splitAppend henvFrame.lengths
+      have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+          output sourceOutput argsEnv outRoots :=
+        houtput.ofRootsGraph henvAfter
+      refine ⟨⟨outRoots, result, houtputAfter.bump result, ?_,
+        hresultGraph, hrestAfter, hownAfter⟩,
+        hslotsOut.right_of_append.bump result⟩
+      apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+
+/-- Lower shared arguments while semantically framing an already-produced
+function, then consume the function and arguments through the higher-order
+application contracts. -/
+theorem LowerArgsValueSound.apply_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    ∀ sourceRest rest slots,
+      EmitSound ctx cur
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots) := by
+  intro sourceRest rest slots post code hcode
+  intro fuel store env finalStore finalValue hfunctionPre hrun
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : HasWorld store .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (perm_extract_root functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happlySound : EmitSound ctx cur
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpSound.emit
+    intro opFuel argsStore argsEnv store' result hargsPost hrunOp
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownArgs⟩, hslotsOut⟩ := hargsPost
+    cases hframeGraphFinal with
+    | cons _ hfunctionWorldFinal hfunctionGraphFinal hrestGraphFinal =>
+      have hfunctionFinal :
+          AValRealizes output argsEnv function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslotsOut.left_of_append
+      have hfunctionGraph' : Sim.ValueGraph funRel argsStore
+          sourceFunction functionValue := by
+        simpa [functionRoot] using hfunctionGraphFinal
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          rootsForWorlds (List.replicate avs.length .shared) values =
+            rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : RootOwnership argsStore
+          (functionRoot :: rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [functionRoot, hroots, List.append_assoc] using
+          (perm_extract_root functionRoot
+            (rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraphFinal
+      cases opFuel with
+      | zero => simp [runOp] at hrunOp
+      | succ opFuel =>
+        obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+          runOp_apply_value
+            (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+            (fuel := opFuel) hfunctionFinal.resolveAtom havs.resolveAtoms
+            hvalue hfunctionGraph' hvalueGraphs hsource hcombinedFrame
+            hownApply hrunOp
+        have hownAfter : RootOwnership store'
+            (⟨.shared, result⟩ :: outRoots ++ rest) :=
+          runOp_apply_owned hfunctionFinal.resolveAtom havs.resolveAtoms
+            hownership hownApply hrunOp
+        obtain ⟨henvAfter, hrestAfter⟩ :=
+          hcombinedAfter.splitAppend henvFrame.lengths
+        have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+            output sourceOutput argsEnv outRoots :=
+          houtput.ofRootsGraph henvAfter
+        refine ⟨⟨outRoots, result, houtputAfter.bump result, ?_,
+          hresultGraph, hrestAfter, hownAfter⟩,
+          hslotsOut.right_of_append.bump result⟩
+        apply AValRealizes.slot
+        · simp [VEnv.bump]
+        · simp [VEnv.bump, VEnv.rel]
+  have hargsCont : CodeOwns ctx cur
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      post (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code) :=
+    happlySound post code hcode
+  have hargsCode : CodeOwns ctx cur
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      post
+      (emit (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code)) :=
+    hargs.graphEmits ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots)
+      post _ hargsCont
+  exact hargsCode hargsPre hrun
+
+/-- Fuel-bounded higher-order application after shared argument lowering. -/
+theorem LowerArgsValueSoundBelow.apply_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {input output : VEnv}
+    {sourceInput sourceOutput sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emit : Emit} {avs : List AVal} {function : AVal}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emit avs)
+    (hfunctionStable : AValStable function)
+    (hownership : ApplyOwnershipContractBelow ctx limit)
+    (hvalue : ApplyValueContractBelow funRel sourceCtx ctx limit)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    ∀ sourceRest rest slots,
+      EmitSoundBelow ctx cur limit
+        (emit ∘ emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+        (GraphOwnsResultProtected funRel recSelfRel input sourceInput
+          sourceFunction .shared function sourceRest rest slots)
+        (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+          sourceResult .shared (.slotA output.depth)
+          sourceRest rest slots) := by
+  intro sourceRest rest slots bound hbound post code hcode
+  intro fuel store env finalStore finalValue hfuel hfunctionPre hrun
+  obtain ⟨⟨envRoots, functionValue, hinput, hfunction,
+      hfunctionGraph, hrestGraph, hownFunction⟩, hslots⟩ := hfunctionPre
+  let functionRoot : Root := ⟨.shared, functionValue⟩
+  have hfunctionWorld : HasWorld store .shared functionValue :=
+    hownFunction.roots_world functionRoot (by simp [functionRoot])
+  have hframeGraph : Sim.RootsGraph funRel store
+      ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest) :=
+    .cons rfl hfunctionWorld hfunctionGraph hrestGraph
+  have hfunctionProtection :
+      SlotsRealize input env (aValProtection function functionValue) :=
+    hfunctionStable.protection_realized hfunction
+  have hargsOwn : RootOwnership store (envRoots ++ functionRoot :: rest) := by
+    apply hownFunction.perm
+    simpa [functionRoot] using
+      (perm_extract_root functionRoot envRoots [] rest).symm
+  have hargsPre : GraphOwnsVEnvProtected funRel recSelfRel input
+      sourceInput ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots) store env :=
+    ⟨⟨envRoots, hinput, hframeGraph, hargsOwn⟩,
+      hfunctionProtection.append hslots⟩
+  have happlySound : EmitSoundBelow ctx cur limit
+      (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray))
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      (GraphOwnsResultProtected funRel recSelfRel output.bump sourceOutput
+        sourceResult .shared (.slotA output.depth)
+        sourceRest rest slots) := by
+    apply OpSoundBelow.emit
+    intro opFuel argsStore argsEnv store' result hopFuel hargsPost hrunOp
+    obtain ⟨⟨outRoots, values, houtput, havs, hvalueGraphs,
+        hframeGraphFinal, hownArgs⟩, hslotsOut⟩ := hargsPost
+    cases hframeGraphFinal with
+    | cons _ hfunctionWorldFinal hfunctionGraphFinal hrestGraphFinal =>
+      have hfunctionFinal :
+          AValRealizes output argsEnv function functionValue :=
+        hfunctionStable.realize_of_protection hfunction
+          hslotsOut.left_of_append
+      have hfunctionGraph' : Sim.ValueGraph funRel argsStore
+          sourceFunction functionValue := by
+        simpa [functionRoot] using hfunctionGraphFinal
+      have hvaluesLength : values.length = avs.length :=
+        havs.lengths.2.symm
+      have hroots :
+          rootsForWorlds (List.replicate avs.length .shared) values =
+            rootsFor .shared values :=
+        rootsForWorlds_replicate_eq_rootsFor .shared hvaluesLength
+      have hownApply : RootOwnership argsStore
+          (functionRoot :: rootsFor .shared values ++
+            (outRoots ++ rest)) := by
+        apply hownArgs.perm
+        simpa [functionRoot, hroots, List.append_assoc] using
+          (perm_extract_root functionRoot
+            (rootsForWorlds (List.replicate avs.length .shared) values ++
+              outRoots) [] rest)
+      have henvFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput) outRoots :=
+        houtput.entries.rootsGraphExact
+      have hcombinedFrame : Sim.RootsGraph funRel argsStore
+          (entrySourceRoots output.entries sourceOutput ++ sourceRest)
+          (outRoots ++ rest) :=
+        henvFrame.append hrestGraphFinal
+      cases opFuel with
+      | zero => simp [runOp] at hrunOp
+      | succ opFuel =>
+        have hvalueAt : ApplyValueContractBelow funRel sourceCtx ctx
+            (opFuel + 1) :=
+          hvalue.mono (Nat.le_of_lt hopFuel)
+        obtain ⟨hresultGraph, hcombinedAfter⟩ :=
+          runOp_apply_value_below
+            (sourceCtx := sourceCtx) (ctx := ctx) (cur := cur)
+            (fuel := opFuel) hfunctionFinal.resolveAtom havs.resolveAtoms
+            hvalueAt hfunctionGraph' hvalueGraphs hsource hcombinedFrame
+            hownApply hrunOp
+        have hownershipAt : ApplyOwnershipContractBelow ctx
+            (opFuel + 1) :=
+          hownership.mono (Nat.le_of_lt hopFuel)
+        have hownAfter : RootOwnership store'
+            (⟨.shared, result⟩ :: outRoots ++ rest) :=
+          runOp_apply_owned_below hfunctionFinal.resolveAtom
+            havs.resolveAtoms hownershipAt hownApply hrunOp
+        obtain ⟨henvAfter, hrestAfter⟩ :=
+          hcombinedAfter.splitAppend henvFrame.lengths
+        have houtputAfter : VEnvValueGraph funRel recSelfRel store'
+            output sourceOutput argsEnv outRoots :=
+          houtput.ofRootsGraph henvAfter
+        refine ⟨⟨outRoots, result, houtputAfter.bump result, ?_,
+          hresultGraph, hrestAfter, hownAfter⟩,
+          hslotsOut.right_of_append.bump result⟩
+        apply AValRealizes.slot
+        · simp [VEnv.bump]
+        · simp [VEnv.bump, VEnv.rel]
+  have hargsCont : CodeOwnsBelow ctx cur bound
+      (GraphOwnsArgsResultProtected funRel recSelfRel output
+        sourceOutput sourceArgs (List.replicate avs.length .shared) avs
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      post (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code) :=
+    happlySound bound hbound post code hcode
+  have hargsCode : CodeOwnsBelow ctx cur bound
+      (GraphOwnsVEnvProtected funRel recSelfRel input sourceInput
+        ((.shared, sourceFunction) :: sourceRest) (functionRoot :: rest)
+        (aValProtection function functionValue ++ slots))
+      post
+      (emit (emitOp (.apply (function.toAtom output)
+        (avs.map (·.toAtom output)).toArray) code)) :=
+    hargs.graphEmits ((.shared, sourceFunction) :: sourceRest)
+      (functionRoot :: rest)
+      (aValProtection function functionValue ++ slots)
+      bound hbound post _ hargsCont
+  exact hargsCode hfuel hargsPre hrun
+
+/-- Fuel-bounded full non-erased semantic application composition. -/
+theorem LowerResultValueSoundBelow.applyArgs_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hownership : ApplyOwnershipContractBelow ctx limit)
+    (hvalue : ApplyValueContractBelow funRel sourceCtx ctx limit)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      start output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow := hfunction.toLowerResultSoundBelow.applyArgs
+        hargs.toLowerArgsSoundBelow hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSoundBelow.comp
+    (hfunction.graphEmits sourceRest rest slots)
+    (hargs.apply_graph hfunction.stable hownership hvalue hsource
+      sourceRest rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-- Full non-erased semantic application composition: produce the function,
+evaluate its shared arguments left-to-right, and relate the target `apply`
+result to the source n-ary application result. -/
+theorem LowerResultValueSound.applyArgs_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {emitFunction emitArgs : Emit} {function : AVal} {avs : List AVal}
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    LowerResultValueSound funRel recSelfRel ctx cur
+      start output.bump sourceStart sourceOutput sourceResult .shared
+      ((emitFunction ∘ emitArgs) ∘
+        emitOp (.apply (function.toAtom output)
+          (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound := hfunction.toLowerResultSound.applyArgs
+        hargs.toLowerArgsSound hownership
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hcomposed := EmitSound.comp
+    (hfunction.graphEmits sourceRest rest slots)
+    (hargs.apply_graph hfunction.stable hownership hvalue hsource
+      sourceRest rest slots)
+  simpa [Function.comp_def] using hcomposed
+
+/-- Executable non-erased `applyRest` branch with semantic higher-order
+application. -/
+theorem applyRest_shared_value_verified
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (start input output : VEnv)
+    (sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value)
+    (sourceFunction sourceResult : IxIR0.Value)
+    (emitFunction emitArgs : Emit) (function : AVal)
+    (args : List IxIR0.Expr) (avs : List AVal)
+    (state finalState : LowSt)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsRun :
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult) :
+    (applyRest src (Nat.succ fuel) input .shared emitFunction function
+      args).run state =
+        .ok (output.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom output)
+              (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultValueSound funRel recSelfRel ctx cur start output.bump
+        sourceStart sourceOutput sourceResult .shared
+        ((emitFunction ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom output)
+            (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [applyRest]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    rw [estateBindRun, hargsRun]
+    rfl
+  · exact hfunction.applyArgs_graph hargsSound hownership hvalue hsource
+
+/-- Source-neutral operational inversion for successful non-erased
+`applyRest` runs. The result family keeps ownership, semantic, profile, and
+reachable clients separate while the result-world guard, argument run,
+homogeneous-world normalization, and final slot recovery remain canonical. -/
+theorem applyRest_nonErased_run_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv}
+    {resultWorld : Owned} {pre emit : Emit} {function av : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {Result : Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hfinish : ∀ (argsOutput : VEnv) (emitArgs : Emit)
+        (avs : List AVal) (argsState : LowSt),
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+          .ok (argsOutput, emitArgs, avs) argsState →
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared →
+      Result .shared argsOutput.bump
+        ((pre ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom argsOutput)
+            (avs.map (·.toAtom argsOutput)).toArray))
+        (.slotA argsOutput.depth) argsState)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hrun : (applyRest src (fuel + 1) input resultWorld pre function
+      args).run state = .ok (output, emit, av) finalState) :
+    Result resultWorld output emit av finalState := by
+  simp only [applyRest] at hrun
+  cases resultWorld with
+  | unique =>
+    have hrequire :
+        (requireResultWorld .shared .unique).run state =
+          .error "call result is shared at unique demand" state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    contradiction
+  | shared =>
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire] at hrun
+    simp only at hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    have hpure :
+        (argsOutput.bump,
+          (pre ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom argsOutput)
+              (avs.map (·.toAtom argsOutput)).toArray),
+          AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa [Function.comp_def] using hpureRun
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    exact hfinish argsOutput emitArgs avs argsState hargsRun
+      hworldsHomogeneous
+
+/-- Semantic inversion of any successful non-erased `applyRest` run. The
+argument correspondence is obtained from `LowerArgsValuePreserves`, and the
+successful result-world guard forces the shared result required by target
+`apply`. This is the tail consumer used by over-applied known calls. -/
+theorem applyRest_nonErased_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {function av : AVal} {args : List IxIR0.Expr}
+    {state finalState : LowSt}
+    (hfunctionNe : function ≠ .constA .erased)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult)
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      function args).run state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av := by
+  exact applyRest_nonErased_run_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle sourceResult actualWorld actualEmit actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hargsRun
+        hworldsHomogeneous => by
+      have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+          sourceArgs := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsValueSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hsource)
+    hfunctionNe hrun
+
+/-- No successful non-erased `applyRest` run exists at zero compiler fuel. -/
+theorem applyRestNonErasedValuePreserves_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) :
+    ApplyRestNonErasedValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun
+  simp only [applyRest] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- One semantic `applyRest` induction step follows directly from semantic
+argument lowering plus the completed ownership and value contracts for
+higher-order application. -/
+theorem applyRestNonErasedValuePreserves_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+  exact applyRest_nonErased_run_value_sound hargs hownership hvalue
+    hfunctionNe hsourceArgs hsource hfunction hrun
+
+/-- Shared zero/successor dispatcher for exact and bounded non-erased
+`applyRest` semantic and profile preservation. Argument closure remains a
+callback, so each flavor retains its own result and higher-order contracts
+while fuel case analysis and strict-hypothesis narrowing occur once. -/
+theorem applyRestNonErasedPreserves_of_expr_core
+    {Expr Args ApplyRest : Nat → Prop}
+    (hargsOfExpr : ∀ fuel,
+      (∀ prior, prior < fuel → Expr prior) → Args fuel)
+    (hzero : ApplyRest 0)
+    (hsucc : ∀ {fuel}, Args fuel → ApplyRest (fuel + 1))
+    (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel → Expr prior) :
+    ApplyRest fuel := by
+  cases fuel with
+  | zero => exact hzero
+  | succ fuel =>
+    apply hsucc
+    apply hargsOfExpr fuel
+    intro prior hprior
+    exact hexpr prior (Nat.lt_trans hprior (Nat.lt_succ_self fuel))
+
+/-- Close non-erased `applyRest` semantic preservation directly from all
+strictly smaller expression hypotheses. This is the compiler-fuel induction
+form consumed by `knownCall` and `lowerSpine`. -/
+theorem applyRestNonErasedValuePreserves_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src prior)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel :=
+  applyRestNonErasedPreserves_of_expr_core
+    (Expr := LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src)
+    (Args := LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur src)
+    (ApplyRest := ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src)
+    (hargsOfExpr := fun fuel hexpr =>
+      lowerArgsValuePreserves_of_expr fuel hexpr)
+    (hzero := applyRestNonErasedValuePreserves_zero src)
+    (hsucc := fun hargs =>
+      applyRestNonErasedValuePreserves_succ hargs hownership hvalue)
+    fuel hexpr
+
+/-- Fuel-bounded semantic inversion of a successful non-erased
+`applyRest` run. -/
+theorem applyRest_nonErased_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel)
+    (hownership : ApplyOwnershipContractBelow ctx limit)
+    (hvalue : ApplyValueContractBelow funRel sourceCtx ctx limit)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {function av : AVal} {args : List IxIR0.Expr}
+    {state finalState : LowSt}
+    (hfunctionNe : function ≠ .constA .erased)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult)
+    (hfunction : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle sourceFunction .shared
+      emitFunction function)
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      function args).run state = .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle sourceResult resultWorld emit av := by
+  exact applyRest_nonErased_run_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle sourceResult actualWorld
+        actualEmit actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hargsRun
+        hworldsHomogeneous => by
+      have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+          sourceArgs := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsValueSoundBelow funRel recSelfRel ctx cur
+          limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hsource)
+    hfunctionNe hrun
+
+/-- No successful bounded non-erased `applyRest` run exists at zero
+compiler fuel. -/
+theorem applyRestNonErasedValuePreservesBelow_zero
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) :
+    ApplyRestNonErasedValuePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src 0 := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState _ _ _ _ hrun
+  simp only [applyRest] at hrun
+  exact (estateThrowRun_not_ok hrun).elim
+
+/-- One bounded semantic `applyRest` induction step follows from bounded
+argument lowering and bounded higher-order contracts. -/
+theorem applyRestNonErasedValuePreservesBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel)
+    (hownership : ApplyOwnershipContractBelow ctx limit)
+    (hvalue : ApplyValueContractBelow funRel sourceCtx ctx limit) :
+    ApplyRestNonErasedValuePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+  exact applyRest_nonErased_run_value_sound_below hargs hownership hvalue
+    hfunctionNe hsourceArgs hsource hfunction hrun
+
+/-- Close bounded non-erased `applyRest` preservation from all strictly
+smaller bounded expression hypotheses. -/
+theorem applyRestNonErasedValuePreservesBelow_of_expr
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEValuePreservesBelow funRel recSelfRel sourceCtx ctx cur limit
+        src prior)
+    (hownership : ApplyOwnershipContractBelow ctx limit)
+    (hvalue : ApplyValueContractBelow funRel sourceCtx ctx limit) :
+    ApplyRestNonErasedValuePreservesBelow funRel recSelfRel sourceCtx ctx
+      cur limit src fuel :=
+  applyRestNonErasedPreserves_of_expr_core
+    (Expr := LowerEValuePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src)
+    (Args := LowerArgsValuePreservesBelow funRel recSelfRel sourceCtx ctx cur
+      limit src)
+    (ApplyRest := ApplyRestNonErasedValuePreservesBelow funRel recSelfRel
+      sourceCtx ctx cur limit src)
+    (hargsOfExpr := fun fuel hexpr =>
+      lowerArgsValuePreservesBelow_of_expr fuel hexpr)
+    (hzero := applyRestNonErasedValuePreservesBelow_zero src)
+    (hsucc := fun hargs =>
+      applyRestNonErasedValuePreservesBelow_succ hargs hownership hvalue)
+    fuel hexpr
+
+/-! The semantic proof is intentionally a companion refinement over the
+ownership development above. `LowerResultSound` remains the reusable
+ownership/frame judgment; the semantic induction may consume it, but does not
+add source values to each of its existing operation and continuation lemmas. -/
+
+/-- Successful source evaluation has some target execution with a graph-
+related result. `funRel` is the lambda-lifting/pap correspondence that the
+generated-environment proof must instantiate. -/
+def SemanticForwardSimulation (sourceCtx : IxIR0.Ctx) (targetCtx : Ctx)
+    (source : IxIR0.Expr) (target : Code) (funRel : Sim.FunctionRel) : Prop :=
+  ∀ {sourceFuel sourceValue},
+    IxIR0.eval sourceCtx sourceFuel [] source = .ok sourceValue →
+    ∃ targetFuel targetStore targetValue,
+      runMain targetCtx target targetFuel = .ok (targetStore, targetValue) ∧
+        Sim.ValueGraph funRel targetStore sourceValue targetValue
+
+/-- No evaluator fuel may expose a dynamic memory-discipline failure. Fuel,
+ordinary stuckness, and closed-world failures remain separate claims. -/
+def MemoryErrorUnreachable (targetCtx : Ctx) (target : Code) : Prop :=
+  ∀ fuel message, runMain targetCtx target fuel ≠ .error (.mem message)
+
+/-- No evaluator fuel may expose an ordinary dynamic stuck branch.  This is
+deliberately independent of memory safety: raw lowering has a formal erased-
+projection counterexample, while validated source programs may discharge the
+proposition through a stronger admissibility theorem. -/
+def OrdinaryStuckUnreachable (targetCtx : Ctx) (target : Code) : Prop :=
+  ∀ fuel message, runMain targetCtx target fuel ≠ .error (.stuck message)
+
+/-- Every reference reached by the closed target program is present.  Oracle
+failure remains ordinary stuckness; this proposition isolates declaration-
+environment completeness only. -/
+def UnknownRefUnreachable (targetCtx : Ctx) (target : Code) : Prop :=
+  ∀ fuel address,
+    runMain targetCtx target fuel ≠ .error (.unknownRef address)
+
+/-- Release the final result root according to the statically requested
+world. Scalars are inert under either release operation. -/
+def releaseResult (targetCtx : Ctx) (world : Owned) (fuel : Nat)
+    (store : Store) (value : RVal) : Except Err Store :=
+  match world with
+  | .shared => dropVal targetCtx fuel store value
+  | .unique => dropUVal targetCtx fuel store value
+
+/-- A closed successful run can release its final result and leave no live
+nodes. `RootOwnership` alone intentionally admits rootless cycles;
+`reclamation_of_run_invariants` combines it with the separate append-order
+trace invariant chosen for the current no-reuse lowerer. -/
+def Reclamation (targetCtx : Ctx) (target : Code)
+    (resultWorld : Owned) : Prop :=
+  ∀ {runFuel store value},
+    runMain targetCtx target runFuel = .ok (store, value) →
+    ∃ releaseFuel released,
+      releaseResult targetCtx resultWorld releaseFuel store value =
+          .ok released ∧
+        released.live = 0
+
+/-- Reclamation reduces to the two independent run invariants established by
+the ownership simulation and the append-only runtime trace.  Release
+termination comes from `Progress`; the finite empty-root theorem then turns
+their conjunction into concrete `Store.live = 0`. -/
+theorem reclamation_of_run_invariants {targetCtx : Ctx} {target : Code}
+    {resultWorld : Owned}
+    (hinvariants : ∀ {runFuel store value},
+      runMain targetCtx target runFuel = .ok (store, value) →
+      Sim.RootOwnership store [⟨resultWorld, value⟩] ∧
+        Ix.Compiler.IxIR1.Reclamation.AllocationOrderInvariant store) :
+    Reclamation targetCtx target resultWorld := by
+  intro runFuel store value hrun
+  obtain ⟨hown, horder⟩ := hinvariants hrun
+  cases resultWorld with
+  | shared =>
+    obtain ⟨releaseFuel, released, hrelease, hlive⟩ :=
+      Ix.Compiler.IxIR1.Reclamation.shared_reclamation hown horder
+    exact ⟨releaseFuel, released, by
+      simpa [releaseResult] using hrelease, hlive⟩
+  | unique =>
+    obtain ⟨releaseFuel, released, hrelease, hlive⟩ :=
+      Ix.Compiler.IxIR1.Reclamation.unique_reclamation hown horder
+    exact ⟨releaseFuel, released, by
+      simpa [releaseResult] using hrelease, hlive⟩
+
+/-- For a fresh `runMain`, exact result ownership and a zero reuse counter are
+the only client-facing obligations needed for reclamation.  The evaluator
+trace theorem derives append allocation order from the latter. -/
+theorem reclamation_of_run_ownership_and_zero_reuses
+    {targetCtx : Ctx} {target : Code} {resultWorld : Owned}
+    (hownership : ∀ {runFuel store value},
+      runMain targetCtx target runFuel = .ok (store, value) →
+        Sim.RootOwnership store [⟨resultWorld, value⟩])
+    (hzero : ∀ {runFuel store value},
+      runMain targetCtx target runFuel = .ok (store, value) →
+        store.reuses = 0) :
+    Reclamation targetCtx target resultWorld := by
+  apply reclamation_of_run_invariants
+  intro runFuel store value hrun
+  exact ⟨hownership hrun,
+    (Ix.Compiler.IxIR1.Reclamation.runMain_order_of_reuses_eq_zero
+      hrun (hzero hrun)).1⟩
+
+/-- The four instruction-level counters observed independently of semantic
+heap equality. -/
+structure CostObservation where
+  allocs : Nat
+  reuses : Nat
+  frees : Nat
+  rcops : Nat
+  deriving BEq, Repr
+
+def costObservation (store : Store) : CostObservation :=
+  ⟨store.allocs, store.reuses, store.frees, store.rcops⟩
+
+/-- A result-independent counter property of every successful target run.
+This is the convenient producer interface for equations such as
+`reuses = 0`; semantic clients can lift it into `CostRefinement` without
+mixing the counter proof into `ValueGraph`. -/
+def RunCostInvariant (targetCtx : Ctx) (target : Code)
+    (spec : CostObservation → Prop) : Prop :=
+  ∀ {targetFuel targetStore targetValue},
+    runMain targetCtx target targetFuel = .ok (targetStore, targetValue) →
+    spec (costObservation targetStore)
+
+/-- The counter-only allocation/free law exposed through `CostRefinement`.
+The stronger runtime equation also identifies `allocs - frees` with the
+number of live slots, but that heap observation deliberately remains outside
+the four-counter interface. -/
+def AllocationFreeCostSpec (observation : CostObservation) : Prop :=
+  observation.frees ≤ observation.allocs
+
+/-- Exact runtime heap accounting gives every target program the general
+counter inequality `frees ≤ allocs`, independently of its result. -/
+theorem runCostInvariant_allocationFree (targetCtx : Ctx) (target : Code) :
+    RunCostInvariant targetCtx target AllocationFreeCostSpec := by
+  intro targetFuel targetStore targetValue hrun
+  exact Ix.Compiler.IxIR1.Reclamation.runMain_frees_le_allocs hrun
+
+/-- On a successful fresh run, the counter difference is exactly the live
+heap size. -/
+theorem costObservation_allocs_sub_frees_eq_live
+    {targetCtx : Ctx} {target : Code} {targetFuel : Nat}
+    {targetStore : Store} {targetValue : RVal}
+    (hrun : runMain targetCtx target targetFuel =
+      .ok (targetStore, targetValue)) :
+    (costObservation targetStore).allocs -
+        (costObservation targetStore).frees = targetStore.live := by
+  have hbalance :=
+    Ix.Compiler.IxIR1.Reclamation.runMain_live_add_frees_eq_allocs hrun
+  simp only [costObservation]
+  omega
+
+/-- Successful top-level executions are independent of the particular fuel
+that was large enough.  Raising both runs to their common maximum exposes
+the same deterministic evaluator result. -/
+theorem runMain_success_unique {targetCtx : Ctx} {target : Code}
+    {leftFuel rightFuel : Nat} {leftStore rightStore : Store}
+    {leftValue rightValue : RVal}
+    (hleft : runMain targetCtx target leftFuel =
+      .ok (leftStore, leftValue))
+    (hright : runMain targetCtx target rightFuel =
+      .ok (rightStore, rightValue)) :
+    (leftStore, leftValue) = (rightStore, rightValue) := by
+  have hleftMax := runMain_mono
+    (Nat.le_max_left leftFuel rightFuel) hleft
+  have hrightMax := runMain_mono
+    (Nat.le_max_right leftFuel rightFuel) hright
+  exact Except.ok.inj (hleftMax.symm.trans hrightMax)
+
+/-- One exact successful run is enough to establish any counter property for
+all successful fuels.  This turns kernel-checked execution traces into
+reusable cost refinements without re-running an evaluator induction for each
+equation. -/
+theorem RunCostInvariant.of_witness
+    {targetCtx : Ctx} {target : Code}
+    {spec : CostObservation → Prop}
+    {witnessFuel : Nat} {witnessStore : Store} {witnessValue : RVal}
+    (hrun : runMain targetCtx target witnessFuel =
+      .ok (witnessStore, witnessValue))
+    (hspec : spec (costObservation witnessStore)) :
+    RunCostInvariant targetCtx target spec := by
+  intro targetFuel targetStore targetValue htarget
+  have hresult :
+      (targetStore, targetValue) = (witnessStore, witnessValue) :=
+    runMain_success_unique htarget hrun
+  cases hresult
+  exact hspec
+
+/-- A caller-supplied cost specification relates the source result to the
+target's counter observation whenever related successful runs are compared.
+Keeping `spec` abstract permits exact equations and asymptotic inequalities
+without mixing either into semantic equality. -/
+def CostRefinement (sourceCtx : IxIR0.Ctx) (targetCtx : Ctx)
+    (source : IxIR0.Expr) (target : Code) (funRel : Sim.FunctionRel)
+    (spec : IxIR0.Value → CostObservation → Prop) : Prop :=
+  ∀ {sourceFuel sourceValue targetFuel targetStore targetValue},
+    IxIR0.eval sourceCtx sourceFuel [] source = .ok sourceValue →
+    runMain targetCtx target targetFuel = .ok (targetStore, targetValue) →
+    Sim.ValueGraph funRel targetStore sourceValue targetValue →
+    spec sourceValue (costObservation targetStore)
+
+/-- Independent cost refinements compose pointwise. -/
+theorem CostRefinement.and
+    {sourceCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {source : IxIR0.Expr} {target : Code} {funRel : Sim.FunctionRel}
+    {left right : IxIR0.Value → CostObservation → Prop}
+    (hleft : CostRefinement sourceCtx targetCtx source target funRel left)
+    (hright : CostRefinement sourceCtx targetCtx source target funRel right) :
+    CostRefinement sourceCtx targetCtx source target funRel
+      (fun sourceValue observation =>
+        left sourceValue observation ∧ right sourceValue observation) := by
+  intro sourceFuel sourceValue targetFuel targetStore targetValue
+    hsource htarget hgraph
+  exact ⟨hleft hsource htarget hgraph, hright hsource htarget hgraph⟩
+
+/-- A target-only counter invariant is a cost refinement for the
+result-independent lifting of its specification. -/
+theorem RunCostInvariant.costRefinement
+    {sourceCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {source : IxIR0.Expr} {target : Code} {funRel : Sim.FunctionRel}
+    {spec : CostObservation → Prop}
+    (hcost : RunCostInvariant targetCtx target spec) :
+    CostRefinement sourceCtx targetCtx source target funRel
+      (fun _ observation => spec observation) := by
+  intro sourceFuel sourceValue targetFuel targetStore targetValue
+    _hsource htarget _hgraph
+  exact hcost htarget
+
+/-- Every source/target pair satisfies the structural allocation/free cost
+refinement whenever their successful runs and value graph are compared. -/
+theorem allocationFreeCostRefinement
+    {sourceCtx : IxIR0.Ctx} {targetCtx : Ctx}
+    {source : IxIR0.Expr} {target : Code} {funRel : Sim.FunctionRel} :
+    CostRefinement sourceCtx targetCtx source target funRel
+      (fun _ observation => AllocationFreeCostSpec observation) := by
+  apply RunCostInvariant.costRefinement
+  exact runCostInvariant_allocationFree targetCtx target
+
+/-! ## First executable lowering cases -/
+
+private theorem scalar_id_sound_at {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {world : Owned} {atom : Atom}
+    {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : rvalLocation? value = none) :
+    LowerResultSoundBelow ctx cur limit Γ Γ world (_root_.id : Emit)
+      (.constA atom) := by
+  refine ⟨hstable, ?_⟩
+  intro rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, value, hΓ, .const (hresolve env),
+    hown.addNoLocation hnone⟩, hslots⟩
+
+theorem scalar_id_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {world : Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : rvalLocation? value = none) :
+    LowerResultSound ctx cur Γ Γ world (_root_.id : Emit)
+      (.constA atom) := by
+  apply LowerResultSound.of_below
+  intro limit
+  exact scalar_id_sound_at (limit := limit) hstable hresolve hnone
+
+private theorem scalar_id_value_sound_at {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : rvalLocation? value = none)
+    (hvalue : ∀ store,
+      Sim.ValueGraph funRel store sourceValue value) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv sourceValue world (_root_.id : Emit)
+      (.constA atom) := by
+  refine
+    { toLowerResultSoundBelow := scalar_id_sound_at hstable hresolve hnone
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.strengthen
+  intro store env hpre
+  obtain ⟨⟨roots, hΓ, hrestGraph, hown⟩, hslots⟩ := hpre
+  exact ⟨⟨roots, value, hΓ, .const (hresolve env), hvalue store,
+    hrestGraph, hown.addNoLocation hnone⟩, hslots⟩
+
+/-- Semantic scalar identity rule. The source/result graph premise is
+store-polymorphic because literals and erased values do not inspect the heap. -/
+theorem scalar_id_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : rvalLocation? value = none)
+    (hvalue : ∀ store,
+      Sim.ValueGraph funRel store sourceValue value) :
+    LowerResultValueSound funRel recSelfRel ctx cur Γ Γ
+      sourceEnv sourceEnv sourceValue world (_root_.id : Emit)
+      (.constA atom) := by
+  exact LowerResultValueSound.of_below fun limit =>
+    scalar_id_value_sound_at (limit := limit)
+      hstable hresolve hnone hvalue
+
+/-- Fuel-bounded ownership rule for an environment-independent scalar. -/
+theorem scalar_id_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {world : Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : rvalLocation? value = none) :
+    LowerResultSoundBelow ctx cur limit Γ Γ world (_root_.id : Emit)
+      (.constA atom) := by
+  exact scalar_id_sound_at hstable hresolve hnone
+
+theorem scalar_id_value_sound_below {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {world : Owned} {atom : Atom} {value : RVal}
+    (hstable : AValStable (.constA atom))
+    (hresolve : ∀ env, resolveAtom env atom = .ok value)
+    (hnone : rvalLocation? value = none)
+    (hvalue : ∀ store, Sim.ValueGraph funRel store sourceValue value) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv sourceValue world (_root_.id : Emit)
+      (.constA atom) := by
+  exact scalar_id_value_sound_at hstable hresolve hnone hvalue
+
+theorem lower_lit_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {world : Owned} {literal : IxIR0.Literal} :
+    LowerResultSound ctx cur Γ Γ world (_root_.id : Emit)
+      (.constA (.lit literal)) := by
+  apply scalar_id_sound .lit
+  · intro env; rfl
+  · rfl
+
+private theorem lower_lit_value_sound_at {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Owned}
+    {literal : IxIR0.Literal} :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv (.lit literal) world (_root_.id : Emit)
+      (.constA (.lit literal)) := by
+  apply scalar_id_value_sound_at .lit
+  · intro env
+    rfl
+  · rfl
+  · intro store
+    exact .lit
+
+theorem lower_lit_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Owned}
+    {literal : IxIR0.Literal} :
+    LowerResultValueSound funRel recSelfRel ctx cur Γ Γ
+      sourceEnv sourceEnv (.lit literal) world (_root_.id : Emit)
+      (.constA (.lit literal)) := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lower_lit_value_sound_at (limit := limit)
+
+theorem lower_lit_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {world : Owned}
+    {literal : IxIR0.Literal} :
+    LowerResultSoundBelow ctx cur limit Γ Γ world (_root_.id : Emit)
+      (.constA (.lit literal)) := by
+  apply scalar_id_sound_below .lit
+  · intro env
+    rfl
+  · rfl
+
+theorem lower_lit_value_sound_below {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {sourceEnv : List IxIR0.Value}
+    {world : Owned} {literal : IxIR0.Literal} :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv (.lit literal) world (_root_.id : Emit)
+      (.constA (.lit literal)) := by
+  exact lower_lit_value_sound_at
+
+theorem lower_erased_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {world : Owned} :
+    LowerResultSound ctx cur Γ Γ world (_root_.id : Emit)
+      (.constA .erased) := by
+  apply scalar_id_sound .erased
+  · intro env; rfl
+  · rfl
+
+private theorem lower_erased_value_sound_at {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Owned} :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv .erased world (_root_.id : Emit)
+      (.constA .erased) := by
+  apply scalar_id_value_sound_at .erased
+  · intro env
+    rfl
+  · rfl
+  · intro store
+    exact .erased
+
+theorem lower_erased_value_sound {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {sourceEnv : List IxIR0.Value} {world : Owned} :
+    LowerResultValueSound funRel recSelfRel ctx cur Γ Γ
+      sourceEnv sourceEnv .erased world (_root_.id : Emit)
+      (.constA .erased) := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lower_erased_value_sound_at (limit := limit)
+
+theorem lower_erased_sound_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {world : Owned} :
+    LowerResultSoundBelow ctx cur limit Γ Γ world (_root_.id : Emit)
+      (.constA .erased) := by
+  apply scalar_id_sound_below .erased
+  · intro env
+    rfl
+  · rfl
+
+theorem lower_erased_value_sound_below {funRel : Sim.FunctionRel}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {Γ : VEnv} {sourceEnv : List IxIR0.Value}
+    {world : Owned} :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit Γ Γ
+      sourceEnv sourceEnv .erased world (_root_.id : Emit)
+      (.constA .erased) := by
+  exact lower_erased_value_sound_at
+
+/-- Evaluate shared arguments to an erased function, release every produced
+owner, and return the erased scalar at the caller's demanded result world. -/
+theorem LowerResultSound.discardArgs {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv} {resultWorld : Owned}
+    {emitFunction emitArgs : Emit} {avs : List AVal}
+    (hfunction : LowerResultSound ctx cur start input .shared
+      emitFunction (.constA .erased))
+    (hargs : LowerArgsSound ctx cur input output
+      (List.replicate avs.length .shared) emitArgs avs) :
+    LowerResultSound ctx cur start (releaseAll output avs).1 resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased) := by
+  refine ⟨.erased, ?_⟩
+  intro rest slots
+  have hrelease := releaseAll_sound (ctx := ctx) (cur := cur)
+    (Γ := output) hargs.stable
+  have hcomposed := EmitSound.comp (hfunction.emits rest slots)
+    (EmitSound.comp (discard_const_result AValStable.erased rest slots)
+      (EmitSound.comp (hargs.emits rest slots)
+        (EmitSound.comp (hrelease rest slots)
+          ((lower_erased_sound (ctx := ctx) (cur := cur)
+            (Γ := (releaseAll output avs).1)
+            (world := resultWorld)).emits rest slots))))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Semantic erased-application composition. The erased function result is
+ownership-inert, every argument is still evaluated and graph-related, and
+`releaseAll` consumes those temporary argument values before producing the
+source evaluator's erased result. -/
+theorem LowerResultValueSound.discardArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceValues :
+      List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emitArgs : Emit}
+    {avs : List AVal}
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased))
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceMiddle sourceOutput sourceValues
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    LowerResultValueSound funRel recSelfRel ctx cur start
+      (releaseAll output avs).1 sourceStart sourceOutput .erased
+      resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased) := by
+  refine
+    { toLowerResultSound := hfunction.toLowerResultSound.discardArgs
+        hargs.toLowerArgsSound
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hrelease := releaseAll_value_sound
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (Γ := output)
+    (sourceEnv := sourceOutput) hargs.stable hsourceLength
+  have hcomposed := EmitSound.comp
+    (hfunction.graphEmits sourceRest rest slots)
+    (EmitSound.comp
+      (discard_const_result_value
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := input)
+        (sourceEnv := sourceMiddle) (sourceValue := IxIR0.Value.erased)
+        AValStable.erased sourceRest rest slots)
+      (EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+        (EmitSound.comp (hrelease.graphEmits sourceRest rest slots)
+          ((lower_erased_value_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur)
+            (Γ := (releaseAll output avs).1)
+            (sourceEnv := sourceOutput) (world := resultWorld)).graphEmits
+              sourceRest rest slots))))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Executable erased `applyRest` branch with source-value correspondence.
+The source application of erased is erased after every argument, while the
+target evaluates and releases the same graph-related argument vector. -/
+theorem applyRest_erased_value_verified
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (start input output : VEnv)
+    (sourceStart sourceMiddle sourceOutput sourceArgs :
+      List IxIR0.Value)
+    (resultWorld : Owned) (emitFunction emitArgs : Emit)
+    (args : List IxIR0.Expr) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsValueSound funRel recSelfRel ctx cur
+      input output sourceMiddle sourceOutput sourceArgs
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased))
+    (hsourceLength : sourceArgs.length = avs.length) :
+    (applyRest src (Nat.succ fuel) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok ((releaseAll output avs).1,
+          (emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2,
+          .constA .erased) finalState ∧
+      LowerResultValueSound funRel recSelfRel ctx cur start
+        (releaseAll output avs).1 sourceStart sourceOutput .erased
+        resultWorld
+        ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+        (.constA .erased) := by
+  constructor
+  · simp only [applyRest]
+    rw [estateBindRun, hargsRun]
+    rfl
+  · exact hfunction.discardArgs hargsSound hsourceLength
+
+/-- Source-neutral operational inversion for the erased `applyRest` branch.
+The result family separates ownership, semantic, profile, and reachable
+clients while argument execution, homogeneous-world normalization, full
+release, and erased-result recovery remain canonical. -/
+theorem applyRest_erased_run_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv}
+    {resultWorld : Owned} {pre emit : Emit} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {av : AVal}
+    {Result : Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hfinish : ∀ (argsOutput : VEnv) (emitArgs : Emit)
+        (avs : List AVal) (argsState : LowSt),
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+          .ok (argsOutput, emitArgs, avs) argsState →
+      avs.length = args.length →
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared →
+      Result resultWorld (releaseAll argsOutput avs).1
+        ((pre ∘ emitArgs) ∘ (releaseAll argsOutput avs).2)
+        (.constA .erased) argsState)
+    (hrun : (applyRest src (fuel + 1) input resultWorld pre
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState) :
+    Result resultWorld output emit av finalState := by
+  simp only [applyRest] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+    estateBindRun_ok_inv hrun
+  rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+  have hpure :
+      ((releaseAll argsOutput avs).1,
+        (pre ∘ emitArgs) ∘ (releaseAll argsOutput avs).2,
+        AVal.constA .erased) = (output, emit, av) ∧
+        argsState = finalState := by
+    simpa [Function.comp_def] using hpureRun
+  obtain ⟨hresult, hstate⟩ := hpure
+  cases hresult
+  subst finalState
+  have havsLength : avs.length = args.length := by
+    simpa using lowerArgs_success_length src hargsRun
+  have hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared := by
+    simpa [havsLength] using map_shared_arg_worlds args
+  exact hfinish argsOutput emitArgs avs argsState hargsRun havsLength
+    hworldsHomogeneous
+
+/-- Semantic-source adapter for `applyRest_erased_run_core`. Source argument
+pairing and source/target length agreement are recovered once for ordinary
+and reachable exact/bounded value clients. -/
+private theorem applyRest_erased_run_value_sound_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {pre emit : Emit} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {av : AVal}
+    {Result : Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hfinish : ∀ (argsOutput : VEnv) (emitArgs : Emit)
+        (avs : List AVal) (argsState : LowSt),
+      SourceArgsEval sourceCtx sourceMiddle
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+        sourceArgs →
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+          .ok (argsOutput, emitArgs, avs) argsState →
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared →
+      sourceArgs.length = avs.length →
+      Result resultWorld (releaseAll argsOutput avs).1
+        ((pre ∘ emitArgs) ∘ (releaseAll argsOutput avs).2)
+        (.constA .erased) argsState)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hrun : (applyRest src (fuel + 1) input resultWorld pre
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState) :
+    Result resultWorld output emit av finalState := by
+  exact applyRest_erased_run_core
+    (Result := Result)
+    (hfinish := fun argsOutput emitArgs avs argsState hargsRun havsLength
+        hworldsHomogeneous => by
+      have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+          sourceArgs := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hsourceLength : sourceArgs.length = avs.length := by
+        rw [← hsourceArgs.lengths, ← havsLength]
+      exact hfinish argsOutput emitArgs avs argsState hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength)
+    hrun
+
+/-- Semantic inversion of the erased `applyRest` branch. Arguments remain
+strictly evaluated and graph-related, then all their owners are released;
+the source and target results are both the erased scalar at either demanded
+world. -/
+theorem applyRest_erased_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  exact applyRest_erased_run_value_sound_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle .erased actualWorld actualEmit actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength => by
+      have hargsSound := hargs hsourcePaired hargsRun
+      have hhomogeneous : LowerArgsValueSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs hhomogeneous hsourceLength)
+    hsourceArgs hrun
+
+/-- Semantic flattening branch of `lowerSpine`: the executable recursive
+call and `SourceSpineEval.flattenApp` prepend the same argument. -/
+theorem lowerSpine_app_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hspine : LowerSpineValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {input output : VEnv} {world : Owned}
+    {function argument : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv
+      (.app function argument) args sourceResult)
+    (hrun : (lowerSpine src (fuel + 1) input world
+      (.app function argument) args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hspine hsource.flattenApp
+  simpa [lowerSpine] using hrun
+
+/-- The expression-level `.app` constructor is now a semantic delegation to
+the singleton source/target spine, rather than an uncovered head case. -/
+theorem lowerE_app_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel sourceFuel : Nat}
+    (hspine : LowerSpineValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {input output : VEnv} {world : Owned}
+    {function argument : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv
+      (.app function argument) = .ok sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.app function argument)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hspine (SourceSpineEval.of_eval_app hsource)
+  simpa [lowerE] using hrun
+
+/-- Source-neutral operational normalization for an erased-head spine. Every
+successful run is exactly the corresponding erased-function `applyRest` run
+at predecessor fuel. -/
+theorem lowerSpine_erased_run_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState) :
+    (applyRest src (fuel + 1) input world (_root_.id : Emit)
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState := by
+  simpa [lowerSpine] using hrun
+
+/-- Semantic-source adapter for `lowerSpine_erased_run_core`. The result
+family keeps ordinary and reachable value clients separate while erased-head
+evaluation, erased-result forcing, and source argument recovery occur once. -/
+private theorem lowerSpine_erased_run_value_sound_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {Result : IxIR0.Value → Prop}
+    (hfinish : ∀ {sourceArgs : List IxIR0.Value},
+      SourceArgsEval sourceCtx sourceEnv args sourceArgs →
+      (applyRest src (fuel + 1) input world (_root_.id : Emit)
+        (.constA .erased) args).run state =
+          .ok (output, emit, av) finalState →
+      Result .erased)
+    (hsource : SourceSpineEval sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState) :
+    Result sourceResult := by
+  apply hsource.eliminate
+  · intro headValue argumentValues hhead harguments happlies
+    obtain ⟨_, hhead⟩ := hhead
+    have herasedEval : IxIR0.eval sourceCtx 1 sourceEnv .erased =
+        .ok .erased := by
+      simp [IxIR0.eval]
+    have hheadValue : headValue = .erased :=
+      sourceEval_ok_unique hhead herasedEval
+    subst headValue
+    have hresult : sourceResult = .erased :=
+      happlies.deterministic
+        (SourceApplies.erased sourceCtx argumentValues)
+    subst sourceResult
+    exact hfinish harguments (lowerSpine_erased_run_core hrun)
+
+/-- Complete semantic erased-head spine. The source head and every source
+application result are forced to `◻`; the target evaluates the same argument
+vector, releases it, and returns its erased scalar at either result world. -/
+theorem lowerSpine_erased_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_erased_run_value_sound_core
+    (Result := fun actualResult =>
+      LowerResultValueSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av)
+    (hfinish := by
+      intro sourceArgs hsourceArgs hrestRun
+      exact applyRest_erased_run_value_sound hargs hsourceArgs
+        (lower_erased_value_sound (funRel := funRel)
+          (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+          (sourceEnv := sourceEnv) (world := .shared)) hrestRun)
+    hsource hrun
+
+/-- Bounded erased-function path: evaluate and release every shared
+argument, then return the ownership-inert erased value. -/
+theorem LowerResultSoundBelow.discardArgs
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {start input output : VEnv} {resultWorld : Owned}
+    {emitFunction emitArgs : Emit} {avs : List AVal}
+    (hfunction : LowerResultSoundBelow ctx cur limit start input .shared
+      emitFunction (.constA .erased))
+    (hargs : LowerArgsSoundBelow ctx cur limit input output
+      (List.replicate avs.length .shared) emitArgs avs) :
+    LowerResultSoundBelow ctx cur limit start (releaseAll output avs).1
+      resultWorld ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased) := by
+  refine ⟨.erased, ?_⟩
+  intro rest slots
+  have hrelease := releaseAll_sound_below
+    (ctx := ctx) (cur := cur) (limit := limit)
+    (Γ := output) hargs.stable
+  have hcomposed := EmitSoundBelow.comp (hfunction.emits rest slots)
+    (EmitSoundBelow.comp
+      (discard_const_result_below AValStable.erased rest slots)
+      (EmitSoundBelow.comp (hargs.emits rest slots)
+        (EmitSoundBelow.comp (hrelease rest slots)
+          ((lower_erased_sound_below (ctx := ctx) (cur := cur)
+            (limit := limit) (Γ := (releaseAll output avs).1)
+            (world := resultWorld)).emits rest slots))))
+  simpa [Function.comp_def] using hcomposed
+
+/-- Fuel-bounded semantic erased-application composition. -/
+theorem LowerResultValueSoundBelow.discardArgs
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceOutput sourceValues :
+      List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emitArgs : Emit}
+    {avs : List AVal}
+    (hfunction : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle .erased .shared
+      emitFunction (.constA .erased))
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceMiddle sourceOutput sourceValues
+      (List.replicate avs.length .shared) emitArgs avs)
+    (hsourceLength : sourceValues.length = avs.length) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start
+      (releaseAll output avs).1 sourceStart sourceOutput .erased
+      resultWorld
+      ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+      (.constA .erased) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hfunction.toLowerResultSoundBelow.discardArgs
+          hargs.toLowerArgsSoundBelow
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  have hrelease := releaseAll_value_sound_below
+    (funRel := funRel) (recSelfRel := recSelfRel)
+    (ctx := ctx) (cur := cur) (limit := limit) (Γ := output)
+    (sourceEnv := sourceOutput) hargs.stable hsourceLength
+  have hcomposed := EmitSoundBelow.comp
+    (hfunction.graphEmits sourceRest rest slots)
+    (EmitSoundBelow.comp
+      (discard_const_result_value_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := input)
+        (sourceEnv := sourceMiddle) (sourceValue := IxIR0.Value.erased)
+        AValStable.erased sourceRest rest slots)
+      (EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+        (EmitSoundBelow.comp (hrelease.graphEmits sourceRest rest slots)
+          ((lower_erased_value_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit)
+            (Γ := (releaseAll output avs).1)
+            (sourceEnv := sourceOutput) (world := resultWorld)).graphEmits
+              sourceRest rest slots))))
+  simpa [Function.comp_def] using hcomposed
+
+/-- The first sequencing case of the compiler induction: a scalar literal is
+materialized for a `many` binder, its sole variable occurrence moves that
+slot into the result, and the old source environment remains realized under
+the newly pushed runtime slot. -/
+theorem lower_let_lit_var_sound {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {literal : IxIR0.Literal} :
+    LowerResultSound ctx cur Γ Γ.bump .shared
+      (emitOp (.pure (.lit literal))) (.slotA Γ.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨roots, hΓ, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    have hop := runOp_pure_scalar_owned (ctx := ctx) (cur := cur)
+      (fuel := fuel) (world := Owned.shared) (roots := roots ++ rest)
+      (env := env) (target := .lit literal) (value := .lit literal)
+      rfl rfl hown
+    have hpair : (store, RVal.lit literal) = (store', result) :=
+      Except.ok.inj (hop.1.symm.trans hrun)
+    cases hpair
+    refine ⟨⟨roots, .lit literal, hΓ.bump (.lit literal), ?_, hop.2⟩,
+      hslots.bump (.lit literal)⟩
+    · apply AValRealizes.slot
+      · simp [VEnv.bump]
+      · simp [VEnv.bump, VEnv.rel]
+
+/-- Executable/proof base case for the actual `lowerArgs` definition. -/
+theorem lowerArgs_nil_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (state : LowSt) :
+    (lowerArgs src (Nat.succ fuel) Γ []).run state =
+        .ok (Γ, (_root_.id : Emit), []) state ∧
+      LowerArgsSound ctx cur Γ Γ [] (_root_.id : Emit) [] := by
+  exact ⟨by simp [lowerArgs], lowerArgs_nil_sound⟩
+
+/-- Generic executable/proof cons rule. This is the constructor used by the
+eventual mutual induction once its head `lowerE` and tail `lowerArgs`
+recursive calls have returned. -/
+theorem lowerArgs_cons_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input middle output : VEnv)
+    (expr : IxIR0.Expr) (world : Owned)
+    (args : List (IxIR0.Expr × Owned))
+    (emitHead emitTail : Emit) (av : AVal) (avs : List AVal)
+    (state middleState finalState : LowSt)
+    (hheadRun : (lowerE src fuel input world expr).run state =
+      .ok (middle, emitHead, av) middleState)
+    (htailRun : (lowerArgs src fuel middle args).run middleState =
+      .ok (output, emitTail, avs) finalState)
+    (hhead : LowerResultSound ctx cur input middle world emitHead av)
+    (htail : LowerArgsSound ctx cur middle output (args.map Prod.snd)
+      emitTail avs) :
+    (lowerArgs src (Nat.succ fuel) input ((expr, world) :: args)).run state =
+        .ok (output, emitHead ∘ emitTail, av :: avs) finalState ∧
+      LowerArgsSound ctx cur input output
+        (world :: args.map Prod.snd) (emitHead ∘ emitTail) (av :: avs) := by
+  constructor
+  · simp only [lowerArgs]
+    rw [estateBindRun, hheadRun]
+    simp only
+    rw [estateBindRun, htailRun]
+    rfl
+  · exact hhead.consArgs htail
+
+/-- Bounded executable/proof cons rule for the mutual induction. -/
+theorem lowerArgs_cons_verified_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (fuel : Nat) (input middle output : VEnv)
+    (expr : IxIR0.Expr) (world : Owned)
+    (args : List (IxIR0.Expr × Owned))
+    (emitHead emitTail : Emit) (av : AVal) (avs : List AVal)
+    (state middleState finalState : LowSt)
+    (hheadRun : (lowerE src fuel input world expr).run state =
+      .ok (middle, emitHead, av) middleState)
+    (htailRun : (lowerArgs src fuel middle args).run middleState =
+      .ok (output, emitTail, avs) finalState)
+    (hhead : LowerResultSoundBelow ctx cur limit input middle world
+      emitHead av)
+    (htail : LowerArgsSoundBelow ctx cur limit middle output
+      (args.map Prod.snd) emitTail avs) :
+    (lowerArgs src (Nat.succ fuel) input ((expr, world) :: args)).run state =
+        .ok (output, emitHead ∘ emitTail, av :: avs) finalState ∧
+      LowerArgsSoundBelow ctx cur limit input output
+        (world :: args.map Prod.snd) (emitHead ∘ emitTail)
+        (av :: avs) := by
+  constructor
+  · simp only [lowerArgs]
+    rw [estateBindRun, hheadRun]
+    simp only
+    rw [estateBindRun, htailRun]
+    rfl
+  · exact hhead.consArgs htail
+
+/-- The executable erased branch of `applyRest`, paired with argument
+evaluation and exact release of every shared argument owner. No result-world
+guard is needed because the returned erased scalar inhabits either world. -/
+theorem applyRest_erased_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (start input output : VEnv)
+    (resultWorld : Owned) (emitFunction emitArgs : Emit)
+    (args : List IxIR0.Expr) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared)
+    (hfunction : LowerResultSound ctx cur start input .shared
+      emitFunction (.constA .erased)) :
+    (applyRest src (Nat.succ fuel) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok ((releaseAll output avs).1,
+          (emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2,
+          .constA .erased) finalState ∧
+      LowerResultSound ctx cur start (releaseAll output avs).1 resultWorld
+        ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+        (.constA .erased) := by
+  constructor
+  · simp only [applyRest]
+    rw [estateBindRun, hargsRun]
+    rfl
+  · have hhomogeneous : LowerArgsSound ctx cur input output
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hfunction.discardArgs hhomogeneous
+
+/-- The executable non-erased branch of `applyRest`, paired with the
+ownership proof for the exact emitter it returns. Unknown callees are
+shared-only in v1, so both the supplied arguments and the result use the
+shared world. -/
+theorem applyRest_shared_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (start input output : VEnv)
+    (emitFunction emitArgs : Emit) (function : AVal)
+    (args : List IxIR0.Expr) (avs : List AVal)
+    (state finalState : LowSt)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsRun :
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared)
+    (hfunction : LowerResultSound ctx cur start input .shared
+      emitFunction function)
+    (hcontract : ApplyOwnershipContract ctx) :
+    (applyRest src (Nat.succ fuel) input .shared emitFunction function
+      args).run state =
+        .ok (output.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom output)
+              (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur start output.bump .shared
+        ((emitFunction ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom output)
+            (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [applyRest]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state =
+          .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    rw [estateBindRun, hargsRun]
+    rfl
+  · have hhomogeneous : LowerArgsSound ctx cur input output
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hfunction.applyArgs hhomogeneous hcontract
+
+/-- Bounded erased `applyRest` branch. The executable length invariant
+derives the homogeneous shared-world telescope internally. -/
+theorem applyRest_erased_verified_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (fuel : Nat) (start input output : VEnv)
+    (resultWorld : Owned) (emitFunction emitArgs : Emit)
+    (args : List IxIR0.Expr) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSoundBelow ctx cur limit input output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hfunction : LowerResultSoundBelow ctx cur limit start input .shared
+      emitFunction (.constA .erased)) :
+    (applyRest src (Nat.succ fuel) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok ((releaseAll output avs).1,
+          (emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2,
+          .constA .erased) finalState ∧
+      LowerResultSoundBelow ctx cur limit start (releaseAll output avs).1
+        resultWorld
+        ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+        (.constA .erased) := by
+  constructor
+  · simp only [applyRest]
+    rw [estateBindRun, hargsRun]
+    rfl
+  · have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsSoundBelow ctx cur limit input output
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hfunction.discardArgs hhomogeneous
+
+/-- Bounded non-erased `applyRest` branch. -/
+theorem applyRest_shared_verified_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (fuel : Nat) (start input output : VEnv)
+    (emitFunction emitArgs : Emit) (function : AVal)
+    (args : List IxIR0.Expr) (avs : List AVal)
+    (state finalState : LowSt)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsRun :
+      (lowerArgs src fuel input
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSoundBelow ctx cur limit input output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hfunction : LowerResultSoundBelow ctx cur limit start input .shared
+      emitFunction function)
+    (hcontract : ApplyOwnershipContractBelow ctx limit) :
+    (applyRest src (Nat.succ fuel) input .shared emitFunction function
+      args).run state =
+        .ok (output.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom output)
+              (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSoundBelow ctx cur limit start output.bump .shared
+        ((emitFunction ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom output)
+            (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [applyRest]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state =
+          .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    rw [estateBindRun, hargsRun]
+    rfl
+  · have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsSoundBelow ctx cur limit input output
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hfunction.applyArgs hhomogeneous hcontract
+
+/-- One compiler-fuel step for `applyRest`, derived from predecessor-fuel
+argument lowering and the bounded higher-order application contract. -/
+theorem applyRestPreservesBelow_succ
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (happly : ApplyOwnershipContractBelow ctx limit) :
+    ApplyRestPreservesBelow ctx cur limit src (fuel + 1) := by
+  intro start input resultWorld pre function args state finalState
+    output emit av hfunction hrun hrepresented havailable
+  by_cases herased : function = .constA .erased
+  · subst function
+    simp only [applyRest] at hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+    have hpure :
+        ((releaseAll argsOutput avs).1,
+          pre ∘ emitArgs ∘ (releaseAll argsOutput avs).2,
+          AVal.constA .erased) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa using hpureRun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    have hargsSound := hargs hargsRun hrepresented havailable
+    have havsLength : avs.length = args.length := by
+      simpa using lowerArgs_success_length src hargsRun
+    have hworldsHomogeneous :
+        ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+          List.replicate avs.length .shared := by
+      simpa [havsLength] using map_shared_arg_worlds args
+    have hhomogeneous : LowerArgsSoundBelow ctx cur limit input argsOutput
+        (List.replicate avs.length .shared) emitArgs avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    simpa [Function.comp_def] using hfunction.discardArgs hhomogeneous
+  · cases resultWorld with
+    | shared =>
+      simp only [applyRest] at hrun
+      have hrequire :
+          (requireResultWorld .shared .shared).run state =
+            .ok () state := by
+        rfl
+      rw [estateBindRun, hrequire] at hrun
+      simp only at hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        estateBindRun_ok_inv hrun
+      rcases argsResult with ⟨argsOutput, emitArgs, avs⟩
+      have hpure :
+          (argsOutput.bump,
+            pre ∘ emitArgs ∘
+              emitOp (.apply (function.toAtom argsOutput)
+                (avs.map (·.toAtom argsOutput)).toArray),
+            AVal.slotA argsOutput.depth) = (output, emit, av) ∧
+            argsState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hargsSound := hargs hargsRun hrepresented havailable
+      have havsLength : avs.length = args.length := by
+        simpa using lowerArgs_success_length src hargsRun
+      have hworldsHomogeneous :
+          ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+            List.replicate avs.length .shared := by
+        simpa [havsLength] using map_shared_arg_worlds args
+      have hhomogeneous : LowerArgsSoundBelow ctx cur limit input argsOutput
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs hhomogeneous happly
+    | unique =>
+      simp only [applyRest] at hrun
+      have hrequire :
+          (requireResultWorld .shared .unique).run state =
+            .error "call result is shared at unique demand" state := by
+        rfl
+      rw [estateBindRun, hrequire] at hrun
+      contradiction
+
+/-- Like `lowerArgs`, `applyRest` follows from strictly smaller expression
+soundness. Higher-order evaluator recursion is supplied separately by the
+bounded compiler contract. -/
+theorem applyRestPreservesBelow_of_expr
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (fuel : Nat)
+    (hexpr : ∀ prior, prior < fuel →
+      LowerEPreservesBelow ctx cur limit src prior)
+    (hextra : ∀ prior, prior < fuel →
+      LowerArgsExtraMonotone src prior)
+    (happly : ApplyOwnershipContractBelow ctx limit) :
+    ApplyRestPreservesBelow ctx cur limit src fuel := by
+  cases fuel with
+  | zero =>
+    intro start input resultWorld pre function args state finalState
+      output emit av hfunction hrun hrepresented _
+    simp only [applyRest] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ fuel =>
+    apply applyRestPreservesBelow_succ
+    · apply lowerArgsPreservesBelow_of_expr fuel
+      intro prior hprior
+      exact hexpr prior (Nat.lt_trans hprior (Nat.lt_succ_self fuel))
+      intro prior hprior
+      exact hextra prior (Nat.lt_trans hprior (Nat.lt_succ_self fuel))
+    · exact happly
+
+/-- A successful non-erased `applyRest` run necessarily passed its shared
+result-world guard. This executable fact is independent of semantic
+contracts and is used to classify over-applied static producers. -/
+theorem applyRest_slot_run_world_shared
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {resultWorld : Owned} {pre emit : Emit} {abs : Nat}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (applyRest src fuel input resultWorld pre (.slotA abs)
+      args).run state = .ok (output, emit, av) finalState) :
+    resultWorld = .shared := by
+  cases fuel with
+  | zero =>
+    simp only [applyRest] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | succ fuel =>
+    simp only [applyRest] at hrun
+    obtain ⟨checked, nextState, hrequireRun, _⟩ :=
+      estateBindRun_ok_inv hrun
+    cases checked
+    exact (requireResultWorld_run_ok_inv hrequireRun).1.symm
+
+/-- In the excess-tail branch of `knownCall`, successful execution forces
+the requested result world to be shared before higher-order application. -/
+theorem knownCall_over_run_world_shared
+    {src : IxIR0.Env} {fuel count : Nat} {build : Array Atom → Op}
+    {argWorlds : List Owned} {resultWorld : Owned} {input output : VEnv}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hover : count < args.length)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    resultWorld = .shared := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, _, hafterPrefix⟩ :=
+    estateBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  rw [if_neg (Nat.not_le.mpr hover)] at hafterPrefix
+  exact applyRest_slot_run_world_shared hafterPrefix
+
+/-- Shared semantic sequencing for `knownCall`. The state predicate lets
+ordinary and ambient-state clients choose how a successful tail transports
+their prefix evidence, while prefix execution, source splitting, terminal
+output recovery, and excess-tail dispatch remain canonical. -/
+private theorem knownCall_run_value_sound_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Owned}
+    {resultWorld : Owned} {input output : VEnv}
+    {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {Reach : LowSt → Prop}
+    {PrefixSound : VEnv → Emit → List AVal → Prop}
+    {BuiltSound : IxIR0.Value → VEnv → Emit → List AVal → Prop}
+    {Result : IxIR0.Value → VEnv → Emit → AVal → LowSt → Prop}
+    (hprefixBack : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {prefixState : LowSt},
+      (applyRest src fuel prefixOutput.bump resultWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) (args.drop count)).run prefixState =
+          .ok (output, emit, av) finalState →
+      Reach finalState → Reach prefixState)
+    (hprefixSound : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {prefixState : LowSt},
+      SourceArgsEval sourceCtx sourceEnv
+        (((args.take count).zip
+          (padWorlds argWorlds count)).map Prod.fst)
+        (sourceValues.take count) →
+      (lowerArgs src fuel input
+        ((args.take count).zip
+          (padWorlds argWorlds count))).run state =
+          .ok (prefixOutput, emitPrefix, prefixAVals) prefixState →
+      Reach prefixState → PrefixSound prefixOutput emitPrefix prefixAVals)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      PrefixSound prefixOutput emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip
+          (padWorlds argWorlds count)).length →
+      BuiltSound sourceBuilt prefixOutput emitPrefix prefixAVals)
+    (hterminalFinish : ∀ {sourceBuilt : IxIR0.Value}
+        {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {prefixState : LowSt},
+      args.length ≤ count →
+      BuiltSound sourceBuilt prefixOutput emitPrefix prefixAVals →
+      Result sourceBuilt prefixOutput.bump
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) prefixState)
+    (hoverFinish : ∀ {sourceBuilt : IxIR0.Value}
+        {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {prefixState : LowSt},
+      count < args.length →
+      BuiltSound sourceBuilt prefixOutput emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceBuilt (sourceValues.drop count)
+        sourceResult →
+      (applyRest src fuel prefixOutput.bump resultWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) (args.drop count)).run prefixState =
+          .ok (output, emit, av) finalState →
+      Reach finalState → Result sourceResult output emit av finalState)
+    (hfinalReach : Reach finalState)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    Result sourceResult output emit av finalState := by
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    estateBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  have hprefixSource : SourceArgsEval sourceCtx sourceEnv
+      (((args.take count).zip
+        (padWorlds argWorlds count)).map Prod.fst)
+      (sourceValues.take count) := by
+    rw [knownCall_prefix_exprs_eq]
+    exact hsourceArgs.take count
+  obtain ⟨sourceBuilt, hprefixApply, htailApply⟩ :=
+    hsource.splitAt count
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    have hprefix := hprefixSound hprefixSource hprefixRun hfinalReach
+    have hbuilt := hbuild hprefix hprefixApply hprefixLength
+    have hsourceLe : sourceValues.length ≤ count := by
+      simpa [← hsourceArgs.lengths] using hle
+    rw [List.drop_eq_nil_of_le hsourceLe] at htailApply
+    cases htailApply
+    exact hterminalFinish hle hbuilt
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixReach := hprefixBack hafterPrefix hfinalReach
+    have hprefix := hprefixSound hprefixSource hprefixRun hprefixReach
+    have hbuilt := hbuild hprefix hprefixApply hprefixLength
+    exact hoverFinish hover hbuilt htailApply hafterPrefix hfinalReach
+
+/-- Semantic counterpart of `knownCall_run_sound_below`. One source
+argument/application spine is split at the executable `take count` boundary.
+The operation-specific premise relates the built prefix result; a terminal
+run returns it directly, while an excess tail is delegated to the proved
+non-erased `applyRest` transformer. -/
+theorem knownCall_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Owned}
+    {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueSound funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueSound funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  exact knownCall_run_value_sound_core
+    (Reach := fun _ => True)
+    (PrefixSound := fun prefixOutput emitPrefix prefixAVals =>
+      LowerArgsValueSound funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip
+          (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals)
+    (BuiltSound := fun sourceBuilt prefixOutput emitPrefix prefixAVals =>
+      LowerResultValueSound funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (Result := fun actualResult actualOutput actualEmit actualAv _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv actualResult resultWorld actualEmit actualAv)
+    (hprefixBack := by
+      intro _ _ _ _ _ _
+      trivial)
+    (hprefixSound := by
+      intro _ _ _ _ hprefixSource hprefixRun _
+      exact hargs hprefixSource hprefixRun)
+    (hbuild := hbuild)
+    (hterminalFinish := by
+      intro _ _ _ _ _ hle hbuilt
+      simpa [hterminalWorld hle] using hbuilt)
+    (hoverFinish := by
+      intro sourceBuilt prefixOutput emitPrefix prefixAVals _ hover
+        hbuilt htailApply hafterPrefix _
+      have hbuiltShared : LowerResultValueSound funRel recSelfRel ctx cur
+          input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+          (emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+          (.slotA prefixOutput.depth) := by
+        simpa [hoverWorld hover] using hbuilt
+      exact hrest (by simp) (hsourceArgs.drop count) htailApply
+        hbuiltShared hafterPrefix)
+    (hfinalReach := trivial) hsourceArgs hsource hrun
+
+/-- Direct-call specialization of the semantic `knownCall` rule. The
+source prefix result is exactly the result named by the callee's
+`FnValueContract`; any excess source/target tail is then handled by
+`ApplyRestNonErasedValuePreserves`. -/
+theorem knownCall_call_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {argWorlds : List Owned}
+    {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph hdecl hownership hvalue hprefixApply
+
+/-- Recursive-self specialization of semantic `knownCall`. The source
+function identity is supplied by the surrounding recursor environment, while
+the target operation invokes the current declaration directly. -/
+theorem knownCall_callSelf_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {argWorlds : List Owned}
+    {resultWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hownership : FnOwnershipContract ctx cur argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx cur argWorlds
+      sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → cur.result = resultWorld)
+    (hoverWorld : count < args.length → cur.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.callSelf_graph hownership hvalue hprefixApply
+
+/-- Recursive-self `knownCall` whose source identity is represented by the
+input environment's synthetic self entry. The value contract is selected
+from the `recSelfRel` witness inside `callSelf_entry_graph`, while ownership
+and result-world facts remain ordinary static current-function contracts. -/
+theorem knownCall_callSelf_entry_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hownership : FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => by simpa [hresult]) (fun _ => by simpa [hresult]) hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  have hbuilt := hprefix.callSelf_entry_graph hentry hhead hownership
+    hvalue hprefixApply
+  simpa [hresult] using hbuilt
+
+/-- Constructor-allocation specialization of semantic `knownCall`. The
+source-side premise identifies saturation of the constructor reference with
+the constructor value holding exactly the evaluated prefix fields. -/
+theorem knownCall_alloc_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {world : Owned}
+    {cid : CtorId} {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Scalar-extern specialization of semantic `knownCall`. The trusted oracle
+contract relates the exact source application prefix to the emitted target
+extern result; an excess tail is valid only when the successful executable
+path has forced that intermediate result into the shared world. -/
+theorem knownCall_extern_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {f : Ixon.Address}
+    {input output : VEnv} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph hcontract hlookup href htakeLength
+      hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- Partial-application specialization of semantic `knownCall`. Its sole
+semantic side condition is the canonical function-relation fact for the
+residual source function and the prefix stored in the fresh pap node. -/
+theorem knownCall_papp_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel count : Nat} {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_sound hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) (fun _ => rfl) hrun
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixSound
+  apply hprefix.papp_graph hdecl (hfun hprefixApply)
+  simpa [havsLength] using hunder
+
+/-- Static-address pap allocation under the canonical whole-pass function
+relation. The relation side condition of `knownCall_papp_run_value_sound` is
+now derived solely from source lookup, source-reference evaluation, and the
+same prefix application derivation already split from the source spine. -/
+theorem knownCall_papp_source_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src relationState)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_sound hargs hrest hcount hdecl hunder
+    hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+
+/-- Constructor-wrapper pap allocation under the canonical function
+relation. `ExtraRepresented.wrapper` supplies the target declaration in the
+eventual spine theorem; this local rule needs only the cached memo and its
+arity agreement. -/
+theorem knownCall_papp_wrapper_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ relationState.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src relationState)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_sound hargs hrest hcount hdecl hunder
+    hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+
+/-- Saturated and over-applied definition references preserve the source
+spine result. The source reference witness selects the semantic identity used
+by the declaration contract; the executable result-world guard supplies the
+terminal or over-application equality required by `knownCall`. -/
+theorem lowerSpine_ref_defn_call_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_sound hargs hrest (by simp) hcount
+    hdecl hownership hvalue hsourceArgs hsourceApply ?_ ?_ hknownRun
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+/-- Under-applied definition references allocate a pap related to the exact
+residual source function obtained by applying the evaluated argument prefix.
+The executable branch already rules out unique function values, unique
+results, and unsafe pap bodies. -/
+theorem lowerSpine_ref_defn_partial_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (estateThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (estateThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_sound hargs hrest
+          (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown
+
+/-- Saturated and over-applied recursor references are semantic direct calls
+through the generated recursor declaration. Both the firing telescope and
+its intermediate result live in the shared world. -/
+theorem lowerSpine_ref_recursor_call_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_sound hargs hrest (by simp) hcount
+    hdecl hownership hvalue hsourceArgs hsourceApply ?_ ?_ hknownRun
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+/-- Under-applied recursor references allocate a same-address pap governed
+by the canonical compiler function relation. -/
+theorem lowerSpine_ref_recursor_partial_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_sound hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown
+
+/-- Saturated and over-applied constructor references allocate the target
+node for the exact source saturation prefix, then delegate any excess tail to
+semantic higher-order application. -/
+theorem lowerSpine_ref_ctor_alloc_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_sound hargs hrest hcount rfl rfl
+    hsourceArgs hsourceApply hctor hknown
+
+/-- Under-applied constructor references use the memoized eta wrapper. The
+run's final state contains the produced (or reused) memo; an enclosing
+compiler-state extension transports that provenance to the ambient relation
+index. -/
+theorem lowerSpine_ref_ctor_partial_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      estateBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ relationState.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_sound hargs hrest
+      (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun
+
+/-- Saturated and over-applied extern references route the evaluated source
+prefix through the explicit scalar-oracle compatibility contract. -/
+theorem lowerSpine_ref_extern_call_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_sound hargs hrest hcontract hcount
+    hlookup href hsourceArgs hsourceApply hknown
+
+/-- Under-applied extern references are ordinary same-address paps. Target
+layout supplies the extern declaration used by pap allocation, while the
+canonical function relation records the residual source application. -/
+theorem lowerSpine_ref_extern_partial_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_sound hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown
+
+/-- Shared complete dispatch for a successful static-reference spine. The
+result proposition keeps ownership, semantic, progress, and profile clients
+separate while source lookup, declaration classification, arity comparison,
+and unknown-reference rejection remain canonical. -/
+theorem lowerSpine_ref_run_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {Result : Prop}
+    (hdefnPartial : ∀ (result : Owned) (body : IxIR0.Expr),
+      src f = some (.defn result body) →
+      args.length < lamArity body → Result)
+    (hdefnCall : ∀ (result : Owned) (body : IxIR0.Expr),
+      src f = some (.defn result body) →
+      lamArity body ≤ args.length → Result)
+    (hctorPartial : ∀ (tag arity : Nat),
+      src f = some (.ctor tag arity) → args.length < arity → Result)
+    (hctorAlloc : ∀ (tag arity : Nat),
+      src f = some (.ctor tag arity) → arity ≤ args.length → Result)
+    (hrecursorPartial : ∀ (numArgs : Nat) (natLit : Bool)
+        (rules : Array IxIR0.RecRule),
+      src f = some (.recursor numArgs natLit rules) →
+      args.length < numArgs + 1 → Result)
+    (hrecursorCall : ∀ (numArgs : Nat) (natLit : Bool)
+        (rules : Array IxIR0.RecRule),
+      src f = some (.recursor numArgs natLit rules) →
+      numArgs + 1 ≤ args.length → Result)
+    (hexternPartial : ∀ (arity : Nat),
+      src f = some (.extern arity) → args.length < arity → Result)
+    (hexternCall : ∀ (arity : Nat),
+      src f = some (.extern arity) → arity ≤ args.length → Result)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState) :
+    Result := by
+  cases hsrc : src f with
+  | none =>
+    exact (estateThrowRun_not_ok
+      (by simpa [lowerSpine, hsrc] using hrun)).elim
+  | some source =>
+    cases source with
+    | defn result body =>
+      by_cases hunder : args.length < lamArity body
+      · exact hdefnPartial result body hsrc hunder
+      · exact hdefnCall result body hsrc (Nat.le_of_not_gt hunder)
+    | ctor tag arity =>
+      by_cases hunder : args.length < arity
+      · exact hctorPartial tag arity hsrc hunder
+      · exact hctorAlloc tag arity hsrc (Nat.le_of_not_gt hunder)
+    | recursor numArgs natLit rules =>
+      by_cases hunder : args.length < numArgs + 1
+      · exact hrecursorPartial numArgs natLit rules hsrc hunder
+      · exact hrecursorCall numArgs natLit rules hsrc
+          (Nat.le_of_not_gt hunder)
+    | extern arity =>
+      by_cases hunder : args.length < arity
+      · exact hexternPartial arity hsrc hunder
+      · exact hexternCall arity hsrc (Nat.le_of_not_gt hunder)
+
+/-- Complete semantic `.ref` spine dispatch for the canonical compiler
+function relation. Definitions and recursors use paired ownership/value
+contracts, constructors use source saturation plus wrapper provenance, and
+externs cross the explicit scalar-oracle compatibility boundary. -/
+theorem lowerSpine_ref_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceResult world emit av)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_value_sound
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_value_sound
+        hargs hrest hcontracts.decls hvalues.decls hsrc hcount hsource hrun)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_value_sound
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_value_sound
+        hargs hrest hlookup hsrc hcount hsource hrun)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_value_sound
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_value_sound
+        hargs hrest hcontracts.decls hvalues.decls hsrc hcount hsource hrun)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_value_sound
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_value_sound
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun)
+    hrun
+
+/-- Semantic saturated/over-applied recursive-self spine. The source
+variable lookup identifies the self function in `SourceSpineEval`; the
+synthetic environment entry supplies its `recSelfRel` witness when the call
+emission is interpreted. Under-application remains deliberately rejected by
+the executable v1 lowerer. -/
+theorem lowerSpine_recSelf_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hownership : FnOwnershipContract ctx cur
+      (List.replicate arity .shared))
+    (hvalue : ∀ {sourceFunction : IxIR0.Value},
+      recSelfRel sourceFunction arity →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate arity .shared) sourceFunction)
+    (hresult : cur.result = .shared)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (estateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state =
+              .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        exact knownCall_callSelf_entry_run_value_sound hargs hrest hcount
+          hentry hsourceHead hownership hvalue hresult hsourceArgs
+          hsourceApply hrun
+
+/-- One successful compiler-fuel `knownCall` step, factored uniformly across
+call, self-call, allocation, pap, and extern builders. -/
+theorem knownCall_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel count : Nat} {build : Array Atom → Op}
+    {argWorlds : List Owned} {resultWorld buildWorld : Owned}
+    {input : VEnv} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {output : VEnv}
+    {emit : Emit} {av : AVal}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hbuild : ∀ {prefixOutput : VEnv}
+        {emitPrefix : Emit} {prefixAVals : List AVal},
+      LowerArgsSoundBelow ctx cur limit input prefixOutput
+          (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+          emitPrefix prefixAVals →
+      prefixAVals.length =
+          ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultSoundBelow ctx cur limit input prefixOutput.bump buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState) :
+    ExtraRepresented ctx finalState →
+    SelfAvailableBelow ctx cur limit input →
+    LowerResultSoundBelow ctx cur limit input output resultWorld emit av := by
+  intro hrepresented havailable
+  simp only [knownCall] at hrun
+  obtain ⟨prefixResult, prefixState, hprefixRun, hafterPrefix⟩ :=
+    estateBindRun_ok_inv hrun
+  rcases prefixResult with ⟨prefixOutput, emitPrefix, prefixAVals⟩
+  dsimp only at hafterPrefix
+  have hprefixLength := lowerArgs_success_length src hprefixRun
+  by_cases hle : args.length ≤ count
+  · rw [if_pos hle] at hafterPrefix
+    have hpure :
+        (prefixOutput.bump,
+          emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray),
+          AVal.slotA prefixOutput.depth) = (output, emit, av) ∧
+          prefixState = finalState := by
+      simpa using hafterPrefix
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    have hprefixSound := hargs hprefixRun hrepresented havailable
+    have hbuilt := hbuild hprefixSound hprefixLength
+    simpa [hterminalWorld hle] using hbuilt
+  · have hover : count < args.length := Nat.lt_of_not_ge hle
+    rw [if_neg hle] at hafterPrefix
+    have hprefixRepresented : ExtraRepresented ctx prefixState :=
+      hrepresented.of_extends
+      (hrestExtra prefixOutput.bump resultWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) (args.drop count) hafterPrefix)
+    have hprefixSound := hargs hprefixRun hprefixRepresented havailable
+    have hbuilt := hbuild hprefixSound hprefixLength
+    have hbuiltShared : LowerResultSoundBelow ctx cur limit input
+        prefixOutput.bump .shared
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth) := by
+      simpa [hoverWorld hover] using hbuilt
+    have hprefixAvailable := havailable.lowerArgs hprefixRun
+    exact hrest hbuiltShared hafterPrefix hrepresented hprefixAvailable.bump
+
+/-- Uniform wrapper for operation builders whose world law holds for every
+argument list. -/
+theorem knownCallPreservesBelow_succ
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel count : Nat} {build : Array Atom → Op}
+    {argWorlds : List Owned} {resultWorld buildWorld : Owned}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hbuild : ∀ {input output : VEnv} {args : List IxIR0.Expr}
+        {emit : Emit} {avs : List AVal},
+      LowerArgsSoundBelow ctx cur limit input output
+          (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+          emit avs →
+      LowerResultSoundBelow ctx cur limit input output.bump buildWorld
+        (emit ∘ emitOp (build (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth))
+    (hterminalWorld : ∀ {args : List IxIR0.Expr},
+      args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : ∀ {args : List IxIR0.Expr},
+      count < args.length → buildWorld = .shared) :
+    KnownCallPreservesBelow ctx cur limit src (fuel + 1) build count
+      argWorlds resultWorld := by
+  intro input args state finalState output emit av hrun hrepresented
+    havailable
+  exact knownCall_run_sound_below hargs hrest hrestExtra
+    (fun hsound _ => hbuild (args := args) hsound)
+    (fun hle => hterminalWorld hle) (fun hover => hoverWorld hover) hrun
+    hrepresented havailable
+
+/-- A partial application consumes every supplied shared argument into a
+fresh shared pap. Choosing the known-call prefix length to be the whole
+argument list makes the over-application branch impossible. -/
+theorem knownCall_papp_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {f : Ixon.Address} {d : Decl}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hdecl : ctx.decls f = some d)
+    (hunder : args.length < declArity d)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) args.length
+      (List.replicate args.length .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output .shared emit av := by
+  refine knownCall_run_sound_below
+    (build := .papp f) (count := args.length)
+    (argWorlds := List.replicate args.length .shared)
+    (resultWorld := .shared) (buildWorld := .shared)
+    (args := args) hargs hrest hrestExtra ?_ ?_ ?_ hrun hrepresented
+      havailable
+  · intro prefixOutput emitPrefix prefixAVals hprefixSound hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate args.length .shared) args.length (by simp)
+      (Nat.le_refl _)
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate args.length .shared) args.length (by simp)
+      (Nat.le_refl _)
+    have havsLength : prefixAVals.length = args.length :=
+      hprefixLength.trans hzipLength
+    have hsound : LowerArgsSoundBelow ctx cur limit input prefixOutput
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    apply hsound.papp_owned hdecl
+    simpa [havsLength] using hunder
+  · intro _
+    rfl
+  · intro hover
+    omega
+
+/-- A saturated extern prefix consumes homogeneous shared scalar arguments.
+Terminal calls return at the demanded world; an excess tail is necessarily
+shared by executable `applyRest` inversion. -/
+theorem knownCall_extern_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel count : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hcount : count ≤ args.length)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  refine knownCall_run_sound_below
+    (build := .extern f) (count := count)
+    (argWorlds := List.replicate count .shared)
+    (resultWorld := world) (buildWorld := world)
+    (args := args) hargs hrest hrestExtra ?_ ?_ ?_ hrun hrepresented
+      havailable
+  · intro prefixOutput emitPrefix prefixAVals hprefixSound hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hsound : LowerArgsSoundBelow ctx cur limit input prefixOutput
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    exact hsound.extern_owned
+  · intro _
+    rfl
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-- A saturated constructor prefix consumes a homogeneous telescope in the
+node's whole-value world. If an excess application tail exists, successful
+execution forces that node world to be shared. -/
+theorem knownCall_alloc_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel count : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {cid : CtorId}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hcount : count ≤ args.length)
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  refine knownCall_run_sound_below
+    (build := .alloc world cid) (count := count)
+    (argWorlds := List.replicate count world)
+    (resultWorld := world) (buildWorld := world)
+    (args := args) hargs hrest hrestExtra ?_ ?_ ?_ hrun hrepresented
+      havailable
+  · intro prefixOutput emitPrefix prefixAVals hprefixSound hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hsound : LowerArgsSoundBelow ctx cur limit input prefixOutput
+        (List.replicate prefixAVals.length world)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    exact hsound.alloc_owned
+  · intro _
+    rfl
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+/-! ## Executable `lowerSpine` dispatch -/
+
+/-- Flattening one more source application is exactly the recursive
+`lowerSpine` judgment on the extended argument list. -/
+theorem lowerSpine_app_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ output : VEnv)
+    (world : Owned) (function argument : IxIR0.Expr)
+    (args : List IxIR0.Expr) (emit : Emit) (av : AVal)
+    (state finalState : LowSt)
+    (hrun : (lowerSpine src fuel Γ world function (argument :: args)).run
+      state = .ok (output, emit, av) finalState)
+    (hsound : LowerResultSound ctx cur Γ output world emit av) :
+    (lowerSpine src (Nat.succ fuel) Γ world (.app function argument)
+      args).run state = .ok (output, emit, av) finalState ∧
+      LowerResultSound ctx cur Γ output world emit av := by
+  exact ⟨by simpa [lowerSpine] using hrun, hsound⟩
+
+/-- A syntactic erased spine head evaluates all shared arguments, releases
+their owners, and returns erased at either demanded result world. -/
+theorem lowerSpine_erased_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ output : VEnv)
+    (world : Owned) (args : List IxIR0.Expr)
+    (emitArgs : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel Γ
+        (args.map (fun arg => (arg, Owned.shared)))).run state =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur Γ output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) Γ world .erased args).run
+        state =
+        .ok ((releaseAll output avs).1,
+          ((_root_.id : Emit) ∘ emitArgs) ∘ (releaseAll output avs).2,
+          .constA .erased) finalState ∧
+      LowerResultSound ctx cur Γ (releaseAll output avs).1 world
+        (((_root_.id : Emit) ∘ emitArgs) ∘ (releaseAll output avs).2)
+        (.constA .erased) := by
+  have happly := applyRest_erased_verified (ctx := ctx) (cur := cur)
+    src fuel Γ Γ output world (_root_.id : Emit) emitArgs args avs
+    state finalState hargsRun hargsSound hworldsHomogeneous
+    (lower_erased_sound (ctx := ctx) (cur := cur) (Γ := Γ)
+      (world := .shared))
+  constructor
+  · simpa only [lowerSpine] using happly.1
+  · exact happly.2
+
+/-- An ordinary source variable (as opposed to `recSelf`) is lowered as a
+shared function value and then enters the proved non-erased `applyRest`
+path. -/
+theorem lowerSpine_var_apply_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input functionOutput output : VEnv)
+    (i abs remaining : Nat) (uses : Uses) (held : Bool)
+    (args : List IxIR0.Expr) (emitFunction emitArgs : Emit)
+    (function : AVal) (avs : List AVal)
+    (state middleState finalState : LowSt)
+    (hentry : input.entries[i]? =
+      some (.slot abs remaining uses held))
+    (hfunctionRun :
+      (lowerE src (Nat.succ fuel) input .shared (.var i)).run state =
+        .ok (functionOutput, emitFunction, function) middleState)
+    (hfunction : LowerResultSound ctx cur input functionOutput .shared
+      emitFunction function)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsRun :
+      (lowerArgs src fuel functionOutput
+        (args.map (fun arg => (arg, Owned.shared)))).run middleState =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur functionOutput output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared)
+    (hcontract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.var i)
+      args).run state =
+        .ok (output.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom output)
+              (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        ((emitFunction ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom output)
+            (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have happly := applyRest_shared_verified (ctx := ctx) (cur := cur)
+    src fuel input functionOutput output emitFunction emitArgs function
+    args avs middleState finalState hfunctionNe hargsRun hargsSound
+    hworldsHomogeneous hfunction hcontract
+  constructor
+  · simp only [lowerSpine]
+    rw [hentry]
+    simp only
+    rw [estateBindRun, hfunctionRun]
+    exact happly.1
+  · exact happly.2
+
+/-- Source heads handled by `lowerSpine`'s final dynamic fallback: lower the
+head expression normally, then pass its descriptor to `applyRest`. -/
+inductive DynamicSpineHead : IxIR0.Expr → Prop where
+  | lam (uses : Uses) (body : IxIR0.Expr) :
+      DynamicSpineHead (.lam uses body)
+  | letE (uses : Uses) (value body : IxIR0.Expr) :
+      DynamicSpineHead (.letE uses value body)
+  | proj (index : Nat) (value : IxIR0.Expr) :
+      DynamicSpineHead (.proj index value)
+  | lit (literal : IxIR0.Literal) :
+      DynamicSpineHead (.lit literal)
+
+/-- Executable inversion for the four dynamic spine heads. They all run the
+same predecessor-fuel `lowerE` action followed by the same `applyRest`
+action; the syntactic predicate merely justifies selecting that fallback
+branch of `lowerSpine`. -/
+theorem lowerSpine_dynamic_run_inv
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState) :
+    ∃ functionOutput emitFunction function middleState,
+      (lowerE src (fuel + 1) input .shared head).run state =
+        .ok (functionOutput, emitFunction, function) middleState ∧
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState := by
+  cases hshape <;> simp only [lowerSpine] at hrun
+  all_goals
+    obtain ⟨functionResult, middleState, hfunctionRun, hrestRun⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases functionResult with ⟨functionOutput, emitFunction, function⟩
+    exact ⟨functionOutput, emitFunction, function, middleState,
+      hfunctionRun, hrestRun⟩
+
+/-- Dynamic spine reflection follows the only branch capable of returning
+literal erased: the head expression returned erased and `applyRest` absorbed
+the argument vector. Source application of erased is deterministic. -/
+theorem lowerSpine_dynamic_run_reflectsErased
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    (hreflect : LowerEReflectsErased sourceCtx src fuel)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 1) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (herased : av = .constA .erased) :
+    sourceResult = .erased := by
+  subst av
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    cases hshape <;> simp only [lowerSpine] at hrun
+    all_goals
+      obtain ⟨functionResult, middleState, hfunctionRun, hrestRun⟩ :=
+        estateBindRun_ok_inv hrun
+      rcases functionResult with
+        ⟨functionOutput, emitFunction, function⟩
+      have hfunctionErased : function = .constA .erased :=
+        applyRest_run_constErased_inv hrestRun
+      have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun hfunctionErased
+      subst sourceFunction
+      exact hsourceApply.deterministic
+        (SourceApplies.erased sourceCtx sourceArgs)
+
+/-- One compiler-fuel step of pure erased-descriptor reflection for both
+expressions and spines. This theorem closes application flattening, ordinary
+variables, synthetic self, static references, and all dynamic heads without
+any heap realizability premise. -/
+theorem lowerSpineReflectsErased_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    (hspine : LowerSpineReflectsErased sourceCtx src fuel)
+    (hexpr : LowerEReflectsErased sourceCtx src fuel) :
+    LowerSpineReflectsErased sourceCtx src (fuel + 1) := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av hsource hrun herased
+  cases head with
+  | app function argument =>
+    apply hspine hsource.flattenApp
+    · simpa [lowerSpine] using hrun
+    · exact herased
+  | erased =>
+    apply hsource.eliminate
+    · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+      obtain ⟨sourceFuel, hhead⟩ := hhead
+      have hsourceFunction : sourceFunction = .erased :=
+        sourceEval_erased_inv hhead
+      subst sourceFunction
+      exact hsourceApply.deterministic
+        (SourceApplies.erased sourceCtx sourceArgs)
+  | ref address =>
+    subst av
+    exact (lowerSpine_ref_run_ne_constErased hrun).elim
+  | lam uses body =>
+    exact lowerSpine_dynamic_run_reflectsErased hexpr (.lam uses body)
+      hsource hrun herased
+  | letE uses value body =>
+    exact lowerSpine_dynamic_run_reflectsErased hexpr
+      (.letE uses value body) hsource hrun herased
+  | proj index source =>
+    exact lowerSpine_dynamic_run_reflectsErased hexpr
+      (.proj index source) hsource hrun herased
+  | lit literal =>
+    exact lowerSpine_dynamic_run_reflectsErased hexpr (.lit literal)
+      hsource hrun herased
+  | var index =>
+    subst av
+    apply hsource.eliminate
+    · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+      obtain ⟨sourceFuel, hhead⟩ := hhead
+      have hdynamic :
+          ∀ {functionOutput : VEnv} {emitFunction : Emit}
+              {function : AVal} {middleState : LowSt},
+            (lowerE src fuel input .shared (.var index)).run state =
+                .ok (functionOutput, emitFunction, function) middleState →
+            (applyRest src fuel functionOutput world emitFunction function
+                args).run middleState =
+                .ok (output, emit, .constA .erased) finalState →
+            sourceResult = .erased := by
+        intro functionOutput emitFunction function middleState
+          hfunctionRun hrestRun
+        have hfunctionErased : function = .constA .erased :=
+          applyRest_run_constErased_inv hrestRun
+        have hsourceErased : sourceFunction = .erased :=
+          hexpr hhead hfunctionRun hfunctionErased
+        subst sourceFunction
+        exact hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      simp only [lowerSpine] at hrun
+      cases hentry : input.entries[index]? with
+      | none =>
+        obtain ⟨functionResult, middleState, hfunctionRun, hrestRun⟩ :=
+          estateBindRun_ok_inv (by simpa [hentry] using hrun)
+        rcases functionResult with
+          ⟨functionOutput, emitFunction, function⟩
+        exact hdynamic hfunctionRun hrestRun
+      | some entry =>
+        cases entry with
+        | slot abs remaining uses held =>
+          obtain ⟨functionResult, middleState, hfunctionRun, hrestRun⟩ :=
+            estateBindRun_ok_inv (by simpa [hentry] using hrun)
+          rcases functionResult with
+            ⟨functionOutput, emitFunction, function⟩
+          exact hdynamic hfunctionRun hrestRun
+        | recSelf arity =>
+          rw [hentry] at hrun
+          simp only at hrun
+          by_cases hunder : args.length < arity
+          · rw [if_pos hunder] at hrun
+            exact (estateThrowRun_not_ok hrun).elim
+          · rw [if_neg hunder] at hrun
+            obtain ⟨_, _, _, hknownRun⟩ := estateBindRun_ok_inv hrun
+            exact (knownCall_run_ne_constErased hknownRun).elim
+
+/-- Shared semantic core for every `lowerSpine` branch that lowers its head
+at the shared world and then delegates to `applyRest`. The head relation and
+final result remain client-defined, while source-spine inversion, erased
+reflection, and erased/non-erased application dispatch are single-sourced. -/
+private theorem lowerSpine_apply_run_value_sound_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {HeadSound : IxIR0.Value → VEnv → Emit → AVal → LowSt → Prop}
+    {Result : IxIR0.Value → Prop}
+    (hheadSound : ∀ {sourceFuel : Nat}
+        {sourceFunction : IxIR0.Value} {functionOutput : VEnv}
+        {emitFunction : Emit} {function : AVal} {middleState : LowSt},
+      IxIR0.eval sourceCtx sourceFuel sourceEnv head = .ok sourceFunction →
+      (lowerE src (fuel + 1) input .shared head).run state =
+        .ok (functionOutput, emitFunction, function) middleState →
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState →
+      HeadSound sourceFunction functionOutput emitFunction function
+        middleState)
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (herasedFinish : ∀ {sourceArgs : List IxIR0.Value}
+        {functionOutput : VEnv} {emitFunction : Emit}
+        {middleState : LowSt},
+      SourceArgsEval sourceCtx sourceEnv args sourceArgs →
+      HeadSound .erased functionOutput emitFunction (.constA .erased)
+        middleState →
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        (.constA .erased) args).run middleState =
+          .ok (output, emit, av) finalState →
+      Result .erased)
+    (hnonErasedFinish : ∀ {sourceFunction : IxIR0.Value}
+        {sourceArgs : List IxIR0.Value} {functionOutput : VEnv}
+        {emitFunction : Emit} {function : AVal} {middleState : LowSt},
+      function ≠ .constA .erased →
+      SourceArgsEval sourceCtx sourceEnv args sourceArgs →
+      SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+      HeadSound sourceFunction functionOutput emitFunction function
+        middleState →
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState →
+      Result sourceResult)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hinvert : ∃ functionOutput emitFunction function middleState,
+      (lowerE src (fuel + 1) input .shared head).run state =
+        .ok (functionOutput, emitFunction, function) middleState ∧
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState) :
+    Result sourceResult := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceArgs hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    obtain ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩ := hinvert
+    have hfunctionSound := hheadSound hhead hfunctionRun hrestRun
+    by_cases herased : function = .constA .erased
+    · have hsourceErased : sourceFunction = .erased :=
+        hreflect hhead hfunctionRun herased
+      subst sourceFunction
+      have hresult : sourceResult = .erased :=
+        hsourceApply.deterministic
+          (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      subst function
+      exact herasedFinish hsourceArgs hfunctionSound hrestRun
+    · exact hnonErasedFinish herased hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+
+/-- Complete semantic dynamic-head spine rule. `LowerEReflectsErased`
+selects erased absorption versus genuine higher-order application; both
+branches consume the same source argument vector carried by
+`SourceSpineEval`. -/
+theorem lowerSpine_dynamic_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_apply_run_value_sound_core
+    (HeadSound := fun sourceFunction functionOutput emitFunction function
+        _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input functionOutput
+        sourceEnv sourceEnv sourceFunction .shared emitFunction function)
+    (Result := fun actualResult =>
+      LowerResultValueSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av)
+    (hheadSound := by
+      intro _ _ _ _ _ _ hhead hfunctionRun _
+      exact hexpr hhead hfunctionRun)
+    (hreflect := hreflect)
+    (herasedFinish := by
+      intro _ _ _ _ hsourceArgs hfunctionSound hrestRun
+      exact applyRest_erased_run_value_sound hargs hsourceArgs
+        hfunctionSound hrestRun)
+    (hnonErasedFinish := by
+      intro _ _ _ _ _ _ hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+      exact hrest hfunctionNe hsourceArgs hsourceApply hfunctionSound
+        hrestRun)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)
+
+/-- Executable inversion for an ordinary variable spine. Every entry shape
+except the synthetic recursor-self marker follows the same lower-then-apply
+path as the dynamic syntactic heads. -/
+theorem lowerSpine_var_dynamic_run_inv
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {i : Nat} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[i]? ≠ some (.recSelf arity))
+    (hrun : (lowerSpine src (fuel + 2) input world (.var i) args).run
+      state = .ok (output, emit, av) finalState) :
+    ∃ functionOutput emitFunction function middleState,
+      (lowerE src (fuel + 1) input .shared (.var i)).run state =
+        .ok (functionOutput, emitFunction, function) middleState ∧
+      (applyRest src (fuel + 1) functionOutput world emitFunction
+        function args).run middleState =
+          .ok (output, emit, av) finalState := by
+  simp only [lowerSpine] at hrun
+  cases hentry : input.entries[i]? with
+  | none =>
+    obtain ⟨functionResult, middleState, hfunctionRun, hrestRun⟩ :=
+      estateBindRun_ok_inv (by simpa [hentry] using hrun)
+    rcases functionResult with ⟨functionOutput, emitFunction, function⟩
+    exact ⟨functionOutput, emitFunction, function, middleState,
+      hfunctionRun, hrestRun⟩
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (hnotSelf arity hentry).elim
+    | slot abs remaining uses held =>
+      obtain ⟨functionResult, middleState, hfunctionRun, hrestRun⟩ :=
+        estateBindRun_ok_inv (by simpa [hentry] using hrun)
+      rcases functionResult with ⟨functionOutput, emitFunction, function⟩
+      exact ⟨functionOutput, emitFunction, function, middleState,
+        hfunctionRun, hrestRun⟩
+
+/-- Semantic ordinary-variable spine. Descriptor reflection selects erased
+absorption versus genuine higher-order application exactly as for dynamic
+heads; the only excluded case is the dedicated static self-call marker. -/
+theorem lowerSpine_var_dynamic_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves funRel recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    {input output : VEnv} {world : Owned} {i : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[i]? ≠ some (.recSelf arity))
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var i) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var i) args).run
+      state = .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_apply_run_value_sound_core
+    (HeadSound := fun sourceFunction functionOutput emitFunction function
+        _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input functionOutput
+        sourceEnv sourceEnv sourceFunction .shared emitFunction function)
+    (Result := fun actualResult =>
+      LowerResultValueSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av)
+    (hheadSound := by
+      intro _ _ _ _ _ _ hhead hfunctionRun _
+      exact hexpr hhead hfunctionRun)
+    (hreflect := hreflect)
+    (herasedFinish := by
+      intro _ _ _ _ hsourceArgs hfunctionSound hrestRun
+      exact applyRest_erased_run_value_sound hargs hsourceArgs
+        hfunctionSound hrestRun)
+    (hnonErasedFinish := by
+      intro _ _ _ _ _ _ hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+      exact hrest hfunctionNe hsourceArgs hsourceApply hfunctionSound
+        hrestRun)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)
+
+/-- Shared complete head classification for `lowerSpine`. The dependent
+result family exposes the refined head to each callback while application,
+erased, reference, dynamic, and variable-entry dispatch remain canonical
+across ownership, semantic, progress, and profile clients. -/
+theorem lowerSpine_run_core
+    {input : VEnv} {head : IxIR0.Expr}
+    {Result : IxIR0.Expr → Prop}
+    (happ : ∀ (function argument : IxIR0.Expr),
+      Result (.app function argument))
+    (herased : Result .erased)
+    (hvar : ∀ (index : Nat),
+      (∀ arity, input.entries[index]? ≠ some (.recSelf arity)) →
+      Result (.var index))
+    (hrecSelf : ∀ (index arity : Nat),
+      input.entries[index]? = some (.recSelf arity) → Result (.var index))
+    (href : ∀ (address : Ixon.Address), Result (.ref address))
+    (hdynamic : ∀ (dynamic : IxIR0.Expr),
+      DynamicSpineHead dynamic → Result dynamic) :
+    Result head := by
+  cases head with
+  | app function argument => exact happ function argument
+  | erased => exact herased
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none => exact hvar index (fun arity => by simp [hentry])
+    | some entry =>
+      cases entry with
+      | recSelf arity => exact hrecSelf index arity hentry
+      | slot abs remaining uses held =>
+        exact hvar index (fun arity => by simp [hentry])
+  | ref address => exact href address
+  | lam uses body => exact hdynamic (.lam uses body) (.lam uses body)
+  | letE uses value body =>
+    exact hdynamic (.letE uses value body) (.letE uses value body)
+  | proj index value =>
+    exact hdynamic (.proj index value) (.proj index value)
+  | lit literal => exact hdynamic (.lit literal) (.lit literal)
+
+/-- One complete semantic `lowerSpine` step. Every executable head family is
+covered: application flattening, erased absorption, ordinary variable
+application, synthetic self calls, static declaration dispatch, and dynamic
+lower-then-apply heads. Current-self contracts are requested only when the
+input actually contains a `recSelf` marker. -/
+theorem lowerSpine_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hexpr : LowerEValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hrestNext : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hselfOwnership : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      FnOwnershipContract ctx cur (List.replicate arity .shared))
+    (hselfValue : ∀ {index arity : Nat}
+        {sourceFunction : IxIR0.Value},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      recSelfRel sourceFunction arity →
+      FnValueContract
+        (CompilerFunctionRel sourceCtx src relationState) sourceCtx ctx cur
+        (List.replicate arity .shared) sourceFunction)
+    (hselfResult : ∀ {index arity : Nat},
+      input.entries[index]? = some (VEntry.recSelf arity) →
+      cur.result = .shared)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineEval sourceCtx sourceEnv actualHead args sourceResult →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultValueSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+        input output sourceEnv sourceEnv sourceResult world emit av)
+    (happ := by
+      intro _ _ hsource hrun
+      exact lowerSpine_app_run_value_sound hspine hsource hrun)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_value_sound hargs hsource hrun)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_value_sound hexpr hreflect hargs
+        hrestNext hnotSelf hsource hrun)
+    (hrecSelf := by
+      intro _ _ hentry hsource hrun
+      exact lowerSpine_recSelf_run_value_sound hargs hrest hentry
+        (hselfOwnership hentry) (fun hrel => hselfValue hentry hrel)
+        (hselfResult hentry) hsource hrun)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_value_sound henv hargs hrest hknownExtra
+        hcontracts hvalues hsource hrun hextends hrepresented)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_value_sound hexpr hreflect hargs
+        hrestNext hshape hsource hrun)
+    hsource hrun
+
+/-- One flattened application node delegates to the predecessor-fuel spine
+proof. -/
+theorem lowerSpine_app_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hspine : LowerSpinePreservesBelow ctx cur limit src fuel)
+    {input output : VEnv} {world : Owned}
+    {function argument : IxIR0.Expr} {args : List IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerSpine src (fuel + 1) input world
+      (.app function argument) args).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  apply hspine
+  · simpa [lowerSpine] using hrun
+  · exact hrepresented
+  · exact havailable
+
+/-- The syntactic erased spine head is handled entirely by bounded
+`applyRest` absorption. -/
+theorem lowerSpine_erased_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerSpine src (fuel + 1) input world .erased args).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  apply hrest (lower_erased_sound_below (ctx := ctx) (cur := cur)
+    (limit := limit) (Γ := input) (world := .shared))
+  · simpa [lowerSpine] using hrun
+  · exact hrepresented
+  · exact havailable
+
+/-- Dynamic fallback heads first use predecessor-fuel `lowerE`, then the
+already-derived predecessor-fuel `applyRest` transformer. -/
+theorem lowerSpine_dynamic_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hshape : DynamicSpineHead head)
+    (hrun : (lowerSpine src (fuel + 1) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  cases hshape <;> simp only [lowerSpine] at hrun
+  all_goals
+    obtain ⟨functionResult, functionState, hfunctionRun, hafterFunction⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases functionResult with ⟨functionOutput, emitFunction, function⟩
+    have hfunctionRepresented : ExtraRepresented ctx functionState :=
+      hrepresented.of_extends
+      (hrestExtra functionOutput world emitFunction function args
+        hafterFunction)
+    exact hrest (hexpr hfunctionRun hfunctionRepresented havailable)
+      hafterFunction hrepresented (havailable.lowerE hfunctionRun)
+
+/-- An ordinary variable spine head follows the same lower-then-apply path
+as the syntactic dynamic fallback. The side condition excludes only the
+dedicated `recSelf` entry handled by the static self-call rule. -/
+theorem lowerSpine_var_dynamic_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {i : Nat}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hnotSelf : ∀ arity,
+      input.entries[i]? ≠ some (.recSelf arity))
+    (hrun : (lowerSpine src (fuel + 1) input world (.var i) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  simp only [lowerSpine] at hrun
+  cases hentry : input.entries[i]? with
+  | none =>
+    obtain ⟨functionResult, functionState, hfunctionRun, hafterFunction⟩ :=
+      estateBindRun_ok_inv (by simpa [hentry] using hrun)
+    rcases functionResult with ⟨functionOutput, emitFunction, function⟩
+    have hfunctionRepresented : ExtraRepresented ctx functionState :=
+      hrepresented.of_extends
+      (hrestExtra functionOutput world emitFunction function args
+        hafterFunction)
+    exact hrest (hexpr hfunctionRun hfunctionRepresented havailable)
+      hafterFunction hrepresented (havailable.lowerE hfunctionRun)
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (hnotSelf arity hentry).elim
+    | slot abs remaining uses held =>
+      obtain ⟨functionResult, functionState, hfunctionRun, hafterFunction⟩ :=
+        estateBindRun_ok_inv (by simpa [hentry] using hrun)
+      rcases functionResult with ⟨functionOutput, emitFunction, function⟩
+      have hfunctionRepresented : ExtraRepresented ctx functionState :=
+        hrepresented.of_extends
+        (hrestExtra functionOutput world emitFunction function args
+          hafterFunction)
+      exact hrest (hexpr hfunctionRun hfunctionRepresented havailable)
+        hafterFunction hrepresented (havailable.lowerE hfunctionRun)
+
+/-- Saturated or over-applied recursive-self dispatch is bounded-sound in
+one rule. The successful result-world guard forces the all-shared recursor
+boundary, while `knownCall` handles both the terminal and tail-application
+shapes. -/
+theorem lowerSpine_recSelf_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {i arity : Nat}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hentry : input.entries[i]? = some (.recSelf arity))
+    (hself : FnOwnershipContractBelow ctx cur
+      (List.replicate cur.arity .shared) limit)
+    (hresult : cur.result = .shared)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var i) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  simp only [lowerSpine] at hrun
+  rw [hentry] at hrun
+  simp only at hrun
+  by_cases hunder : args.length < arity
+  · rw [if_pos hunder] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  · rw [if_neg hunder] at hrun
+    have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+    cases world with
+    | unique =>
+      have hrequire :
+          (requireResultWorld .shared .unique).run state =
+            .error "call result is shared at unique demand" state := by
+        rfl
+      rw [estateBindRun, hrequire] at hrun
+      contradiction
+    | shared =>
+      have hrequire :
+          (requireResultWorld .shared .shared).run state = .ok () state := by
+        rfl
+      rw [estateBindRun, hrequire] at hrun
+      simp only at hrun
+      refine knownCall_run_sound_below
+        (build := .callSelf) (count := arity)
+        (argWorlds := List.replicate arity .shared)
+        (resultWorld := .shared) (buildWorld := .shared)
+        (args := args) hargs hrest hrestExtra ?_ ?_ ?_ hrun hrepresented
+          havailable
+      · intro prefixOutput emitPrefix prefixAVals hprefixSound
+          hprefixLength
+        have hshape := knownCall_prefix_worlds_eq args
+          (List.replicate arity .shared) arity (by simp) hcount
+        have hzipLength := knownCall_prefix_length_eq args
+          (List.replicate arity .shared) arity (by simp) hcount
+        have havsLength : prefixAVals.length = arity :=
+          hprefixLength.trans hzipLength
+        have hsound : LowerArgsSoundBelow ctx cur limit input prefixOutput
+            (List.replicate arity .shared) emitPrefix prefixAVals := by
+          simpa only [hshape] using hprefixSound
+        by_cases harity : arity = cur.arity
+        · have hself' : FnOwnershipContractBelow ctx cur
+              (List.replicate arity .shared) limit := by
+            simpa [harity] using hself
+          simpa [hresult] using hsound.callSelf_owned hself'
+        · have hmismatch : prefixAVals.length ≠ cur.arity := by
+            intro heq
+            exact harity (havsLength.symm.trans heq)
+          simpa [hresult] using
+            hsound.callSelf_arity_mismatch hmismatch
+      · intro _
+        rfl
+      · intro _
+        rfl
+
+/-- Saturated and over-applied source definitions share one bounded direct-
+call proof. The executable world guard supplies the terminal result equality
+or the shared intermediate world required before applying an excess tail. -/
+theorem lowerSpine_ref_defn_call_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  obtain ⟨d, hdecl, harity, hresult, hcontract⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_run_sound_below
+    (build := .call f) (count := lamArity body)
+    (argWorlds := (lamUses body).map worldOfUses)
+    (resultWorld := world) (buildWorld := result)
+    (args := args) hargs hrest hrestExtra ?_ ?_ ?_ hknownRun hrepresented
+      havailable
+  · intro prefixOutput emitPrefix prefixAVals hprefixSound _
+    have hshape := knownCall_prefix_worlds_eq args
+      ((lamUses body).map worldOfUses) (lamArity body)
+      (by simp) hcount
+    have hsound : LowerArgsSoundBelow ctx cur limit input prefixOutput
+        ((lamUses body).map worldOfUses) emitPrefix prefixAVals := by
+      simpa only [hshape] using hprefixSound
+    simpa [hresult] using hsound.call_owned hdecl hcontract
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hne] using hguard
+
+/-- Under-applied source definitions that successfully pass the shared-
+function guards consume all supplied arguments into a bounded pap node. -/
+theorem lowerSpine_ref_defn_partial_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [huuEq] using hrun
+  | shared =>
+    cases result with
+    | unique =>
+      apply False.elim
+      apply estateThrowRun_not_ok
+      simpa [hsuEq, huuEq] using hrun
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        apply False.elim
+        apply estateThrowRun_not_ok
+        simpa [hsuEq, hp] using hrun
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        exact knownCall_papp_run_sound_below
+          (f := f) (d := .fn d) (args := args) hargs hrest hrestExtra
+          hdecl (by simpa [declArity, harity] using hunder) hknown
+          hrepresented havailable
+
+/-- Saturated and over-applied recursor references are ordinary bounded
+all-shared direct calls once the generated recursor declaration is recovered
+from the source/target contract environment. -/
+theorem lowerSpine_ref_recursor_call_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  obtain ⟨d, hdecl, harity, hresult, hcontract⟩ :=
+    hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_run_sound_below
+    (build := .call f) (count := numArgs + 1)
+    (argWorlds := List.replicate (numArgs + 1) .shared)
+    (resultWorld := world) (buildWorld := .shared)
+    (args := args) hargs hrest hrestExtra ?_ ?_ ?_ hknownRun hrepresented
+      havailable
+  · intro prefixOutput emitPrefix prefixAVals hprefixSound _
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate (numArgs + 1) .shared) (numArgs + 1)
+      (by simp) hcount
+    have hsound : LowerArgsSoundBelow ctx cur limit input prefixOutput
+        (List.replicate (numArgs + 1) .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape] using hprefixSound
+    simpa [hresult] using hsound.call_owned hdecl hcontract
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [heq] using hguard
+  · intro _
+    rfl
+
+/-- An under-applied recursor is a shared pap over all supplied arguments;
+its target declaration and strict under-application bound come from the
+bounded generated-recursor contract. -/
+theorem lowerSpine_ref_recursor_partial_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [huuEq] using hrun
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    exact knownCall_papp_run_sound_below
+      (f := f) (d := .fn d) (args := args) hargs hrest hrestExtra hdecl
+      (by simpa [declArity, harity] using hunder) hknown hrepresented
+      havailable
+
+/-- Saturated and over-applied extern references use the homogeneous bounded
+extern consumer; the excess-tail shared-world fact is recovered from the
+successful run itself. -/
+theorem lowerSpine_ref_extern_call_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_sound_below
+    (count := arity) hargs hrest hrestExtra hcount hknown hrepresented
+      havailable
+
+/-- Under-applied extern references are shared paps backed by the extern
+declaration supplied by the source/target layout. -/
+theorem lowerSpine_ref_extern_partial_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [huuEq] using hrun
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    exact knownCall_papp_run_sound_below
+      (f := f) (d := .extern arity) (args := args) hargs hrest hrestExtra
+      hdecl (by simpa [declArity] using hunder) hknown hrepresented
+      havailable
+
+/-- Saturated and over-applied constructors lower through the bounded
+homogeneous allocation rule at the demanded whole-value world. -/
+theorem lowerSpine_ref_ctor_alloc_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_sound_below
+    (count := arity) hargs hrest hrestExtra hcount hknown hrepresented
+      havailable
+
+/-- Under-applied constructors use the statefully memoized eta-wrapper. The
+whole-program layout need only certify the declaration and arity of the
+wrapper actually returned by that successful lookup. -/
+theorem lowerSpine_ref_ctor_partial_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [huuEq] using hrun
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      estateBindRun_ok_inv hrun'
+    have hmemo : (⟨f, tag, arity, wrapper⟩ : WrapperMemo) ∈
+        finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hdecl := hrepresented.wrapper hmemo
+    exact knownCall_papp_run_sound_below
+      (f := wrapper) (d := ctorWrapperDecl f tag arity) (args := args)
+      hargs hrest hrestExtra hdecl
+      (by simpa [ctorWrapperDecl, declArity] using hunder) hknownRun
+      hrepresented havailable
+
+/-- Complete bounded `.ref` spine dispatch. Source declarations select the
+proved definition, constructor, recursor, or extern family; unknown
+references cannot produce a successful lowering run. -/
+theorem lowerSpine_ref_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hargsExtra : LowerArgsExtraMonotone src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultSoundBelow ctx cur limit input output world
+      emit av)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_sound_below
+        hargs hrest hrestExtra hdecls hsrc hunder hrun hrepresented
+        havailable)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_sound_below
+        hargs hrest hrestExtra hdecls hsrc hcount hrun hrepresented
+        havailable)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_sound_below
+        hargs hrest hrestExtra
+        (knownCallExtraMonotone_succ hargsExtra hrestExtra)
+        hsrc hunder hrun hrepresented havailable)
+    (hctorAlloc := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_ctor_alloc_run_sound_below
+        hargs hrest hrestExtra hsrc hcount hrun hrepresented havailable)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_sound_below
+        hargs hrest hrestExtra hdecls hsrc hunder hrun hrepresented
+        havailable)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_sound_below
+        hargs hrest hrestExtra hdecls hsrc hcount hrun hrepresented
+        havailable)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_sound_below
+        hargs hrest hrestExtra hdecls hsrc hunder hrun hrepresented
+        havailable)
+    (hexternCall := by
+      intro _ hsrc hcount
+      exact lowerSpine_ref_extern_call_run_sound_below
+        hargs hrest hrestExtra hsrc hcount hrun hrepresented havailable)
+    hrun
+
+/-- One complete bounded `lowerSpine` step. All syntactic dispatch families
+are now connected; the two generated-environment obligations are explicit:
+`recSelf` entries must name the current shared contract, and a state-created
+constructor wrapper must be represented in the final target context. -/
+theorem lowerSpine_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hspine : LowerSpinePreservesBelow ctx cur limit src (fuel + 1))
+    (hexpr : LowerEPreservesBelow ctx cur limit src (fuel + 1))
+    (hargs : LowerArgsPreservesBelow ctx cur limit src fuel)
+    (hargsExtra : LowerArgsExtraMonotone src fuel)
+    (hrest : ApplyRestPreservesBelow ctx cur limit src fuel)
+    (hrestNext : ApplyRestPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestExtra : ApplyRestExtraMonotone src fuel)
+    (hrestNextExtra : ApplyRestExtraMonotone src (fuel + 1))
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultSoundBelow ctx cur limit input output world emit av)
+    (happ := by
+      intro _ _ hrun
+      exact lowerSpine_app_run_sound_below hspine hrun hrepresented
+        havailable)
+    (herased := by
+      intro hrun
+      exact lowerSpine_erased_run_sound_below hrestNext hrun hrepresented
+        havailable)
+    (hvar := by
+      intro _ hnotSelf hrun
+      exact lowerSpine_var_dynamic_run_sound_below hexpr hrestNext
+        hrestNextExtra hnotSelf hrun hrepresented havailable)
+    (hrecSelf := by
+      intro index arity hentry hrun
+      cases havailable with
+      | inl hself =>
+        obtain ⟨hresult, hcontract⟩ := hself
+        exact lowerSpine_recSelf_run_sound_below
+          hargs hrest hrestExtra hentry hcontract hresult hrun hrepresented
+          (SelfAvailableBelow.of_contract ⟨hresult, hcontract⟩)
+      | inr hno => exact (hno index arity hentry).elim)
+    (href := by
+      intro _ hrun
+      exact lowerSpine_ref_run_sound_below hargs hargsExtra hrest
+        hrestExtra hdecls hrun hrepresented havailable)
+    (hdynamic := by
+      intro _ hshape hrun
+      exact lowerSpine_dynamic_run_sound_below hexpr hrestNext
+        hrestNextExtra hshape hrun hrepresented havailable)
+    hrun
+
+/-- Standalone reference lowering is the empty-argument spine dispatch with
+two extra administrative compiler-fuel steps for `knownCall` and its empty
+`lowerArgs` prefix. -/
+theorem lowerE_ref_run_to_lowerSpine_nil
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {f : Ixon.Address} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState) :
+    (lowerSpine src (fuel + 3) input world (.ref f) []).run state =
+      .ok (output, emit, av) finalState := by
+  cases hsrc : src f with
+  | none =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [lowerE, hsrc] using hrun
+  | some source =>
+    cases source with
+    | defn result body =>
+      cases hn : lamArity body with
+      | zero =>
+        simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc, hn,
+          padWorlds, Function.comp_def] using hrun
+      | succ n =>
+        simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc, hn,
+          padWorlds, Function.comp_def] using hrun
+    | ctor tag arity =>
+      cases arity with
+      | zero =>
+        simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc,
+          padWorlds, Function.comp_def] using hrun
+      | succ arity =>
+        simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc,
+          padWorlds, Function.comp_def] using hrun
+    | recursor numArgs natLit rules =>
+      simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc,
+        padWorlds, Function.comp_def] using hrun
+    | extern arity =>
+      cases arity with
+      | zero =>
+        simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc,
+          padWorlds, Function.comp_def] using hrun
+      | succ arity =>
+        simpa [lowerE, lowerSpine, knownCall, lowerArgs, hsrc,
+          padWorlds, Function.comp_def] using hrun
+
+/-- Every successful standalone source reference inherits bounded soundness
+from complete empty-spine dispatch. -/
+theorem lowerE_ref_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hargs : LowerArgsPreservesBelow ctx cur limit src (fuel + 1))
+    (hargsExtra : LowerArgsExtraMonotone src (fuel + 1))
+    (hrest : ApplyRestPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestExtra : ApplyRestExtraMonotone src (fuel + 1))
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  apply lowerSpine_ref_run_sound_below hargs hargsExtra hrest hrestExtra
+    hdecls
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hrepresented
+  · exact havailable
+
+/-- Semantic standalone reference lowering is the empty source/target spine.
+The existing executable equivalence contributes the two administrative fuel
+steps needed to expose `knownCall`; no additional semantic case split is
+required at the expression boundary. -/
+theorem lowerE_ref_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hrest : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref f) =
+      .ok sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceResult world emit av := by
+  apply lowerSpine_ref_run_value_sound henv hargs hrest hknownExtra
+    hcontracts hvalues (SourceSpineEval.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+
+/-- Successful literal lowering is bounded-sound at every contract limit. -/
+theorem lowerE_lit_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, av) ∧
+        state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  exact lower_lit_sound_below
+
+private theorem lowerE_lit_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.lit literal) world emit av := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, av) ∧
+        state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  exact lower_lit_value_sound_at
+
+/-- Semantic literal branch: the source evaluator returns the same literal
+the target lowers to an environment-independent scalar. -/
+theorem lowerE_lit_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv (.lit literal) world emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerE_lit_run_value_sound_at (limit := limit) hrun
+
+/-- Fuel-bounded semantic literal branch. -/
+theorem lowerE_lit_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {literal : IxIR0.Literal} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv (.lit literal) world emit av := by
+  exact lowerE_lit_run_value_sound_at hrun
+
+/-- Successful erased lowering is bounded-sound at every contract limit. -/
+theorem lowerE_erased_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, av) ∧
+        state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  exact lower_erased_sound_below
+
+private theorem lowerE_erased_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv .erased world emit av := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, av) ∧
+        state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  exact lower_erased_value_sound_at
+
+/-- Semantic erased branch: `◻` on both sides, with no heap participation. -/
+theorem lowerE_erased_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv .erased world emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerE_erased_run_value_sound_at (limit := limit) hrun
+
+/-- Fuel-bounded semantic erased branch. -/
+theorem lowerE_erased_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv .erased world emit av := by
+  exact lowerE_erased_run_value_sound_at hrun
+
+/-- Shared operational proof for successful variable lowering. Clients
+supply the meaning of a final move and a repeated shared retain; missing,
+synthetic, released, exhausted, mismatched-world, and repeated unique entries
+are rejected here, together with exact output and state recovery. -/
+theorem lowerE_var_run_sound_core
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {i : Nat} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    {Result : Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hmove : ∀ {abs : Nat} {uses : Uses},
+      input.entries[i]? = some (.slot abs 1 uses true) →
+      Result (worldOfUses uses)
+        (input.setEntry i (.slot abs 0 uses false))
+        (_root_.id : Emit) (.slotA abs) state)
+    (hdup : ∀ {abs remaining : Nat} {uses : Uses},
+      worldOfUses uses = .shared →
+      input.entries[i]? =
+        some (.slot abs (Nat.succ (Nat.succ remaining)) uses true) →
+      let next := input.setEntry i
+        (.slot abs (Nat.succ remaining) uses true)
+      Result .shared next.bump
+        (emitOp (.dup (.var (next.rel abs)))) (.slotA next.depth) state)
+    (hrun : (lowerE src (fuel + 1) input world (.var i)).run state =
+      .ok (output, emit, av) finalState) :
+    Result world output emit av finalState := by
+  have hssNe : (Owned.shared != Owned.shared) = false := by decide
+  have huuNe : (Owned.unique != Owned.unique) = false := by decide
+  have hsuNe : (Owned.shared != Owned.unique) = true := by decide
+  have husNe : (Owned.unique != Owned.shared) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[i]? with
+  | none =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [lowerE, hentry] using hrun
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      apply False.elim
+      apply estateThrowRun_not_ok
+      simpa [lowerE, hentry] using hrun
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        apply False.elim
+        apply estateThrowRun_not_ok
+        simpa [lowerE, hentry] using hrun
+      | true =>
+        by_cases hworld : worldOfUses uses = world
+        · subst world
+          have hsame :
+              (worldOfUses uses != worldOfUses uses) = false := by
+            cases uses <;> decide
+          cases remaining with
+          | zero =>
+            apply False.elim
+            apply estateThrowRun_not_ok
+            simpa [lowerE, hentry, hsame] using hrun
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry i (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, av) ∧ state = finalState := by
+                simpa [lowerE, hentry, hsame] using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact hmove hentry
+            | succ remaining =>
+              cases uses with
+              | erased =>
+                have heq :
+                    (Owned.shared == Owned.unique) = false := by decide
+                have hpure :
+                    let next := input.setEntry i
+                      (.slot abs (Nat.succ remaining) .erased true)
+                    (next.bump,
+                      emitOp (.dup (.var (next.rel abs))),
+                      AVal.slotA next.depth) = (output, emit, av) ∧
+                      state = finalState := by
+                  simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                    using hrun
+                dsimp only at hpure
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact hdup (by rfl) hentry
+              | linear =>
+                have heq :
+                    (Owned.unique == Owned.unique) = true := by decide
+                apply False.elim
+                apply estateThrowRun_not_ok
+                simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                  hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                  using hrun
+              | affine =>
+                have heq :
+                    (Owned.unique == Owned.unique) = true := by decide
+                apply False.elim
+                apply estateThrowRun_not_ok
+                simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                  hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                  using hrun
+              | many =>
+                have heq :
+                    (Owned.shared == Owned.unique) = false := by decide
+                have hpure :
+                    let next := input.setEntry i
+                      (.slot abs (Nat.succ remaining) .many true)
+                    (next.bump,
+                      emitOp (.dup (.var (next.rel abs))),
+                      AVal.slotA next.depth) = (output, emit, av) ∧
+                      state = finalState := by
+                  simpa [lowerE, hentry, worldOfUses, hsame, heq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq, huuEq]
+                    using hrun
+                dsimp only at hpure
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact hdup (by rfl) hentry
+        · have hdiff : (worldOfUses uses != world) = true := by
+            cases uses <;> cases world <;>
+              simp_all [worldOfUses] <;> decide
+          cases uses <;> cases world
+          all_goals
+            try { exact (hworld (by rfl)).elim }
+          all_goals
+            apply False.elim
+            apply estateThrowRun_not_ok
+            simpa [lowerE, hentry, worldOfUses, hdiff, hssNe, huuNe,
+              hsuNe, husNe, hsuEq, huuEq] using hrun
+
+/-- Every successful variable lowering branch is bounded-sound. Impossible
+entry states and ownership mismatches are discharged from the successful
+monadic run; final uses move an owner and repeated shared uses retain it. -/
+theorem lowerE_var_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.var i)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  exact lowerE_var_run_sound_core
+    (Result := fun resultWorld resultOutput resultEmit resultAv _ =>
+      LowerResultSoundBelow ctx cur limit input resultOutput resultWorld
+        resultEmit resultAv)
+    (hmove := fun hentry => lower_var_move_sound_below hentry)
+    (hdup := fun hworld hentry =>
+      lower_var_shared_dup_sound_below hworld hentry)
+    hrun
+
+private theorem lowerE_var_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world (.var i)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact lowerE_var_run_sound_core
+    (Result := fun resultWorld resultOutput resultEmit resultAv _ =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        resultOutput sourceEnv sourceEnv sourceValue resultWorld resultEmit
+        resultAv)
+    (hmove := fun hentry =>
+      lower_held_move_value_sound_at hsource hentry)
+    (hdup := fun hworld hentry =>
+      lower_held_retain_value_sound_at hsource hworld hentry)
+    hrun
+
+/-- Semantic variable branch of `lowerE`. A final use moves the source
+value's owner out of the environment; a repeated shared use retains it and
+returns a fresh owner for the same graph. Every other entry state and every
+world mismatch is unreachable in a successful run. -/
+theorem lowerE_var_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world (.var i)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact LowerResultValueSound.of_below fun limit =>
+    lowerE_var_run_value_sound_at (limit := limit) hsource hrun
+
+/-- Fuel-bounded semantic variable branch. The only emitted operation is the
+non-final shared `dup`; final uses are ownership-preserving identity emits. -/
+theorem lowerE_var_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {world : Owned} {i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world (.var i)).run state =
+      .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact lowerE_var_run_value_sound_at hsource hrun
+
+/-- Every successful variable expression returns a slot descriptor. -/
+theorem lowerE_var_run_ne_constErased
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {index : Nat} {emit : Emit}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, .constA .erased) finalState) :
+    False := by
+  have hnotErased := lowerE_var_run_sound_core
+    (Result := fun _ _ _ result _ => result ≠ .constA .erased)
+    (hmove := fun _ => by simp)
+    (hdup := fun _ _ => by simp)
+    hrun
+  exact hnotErased rfl
+
+/-- Shared operational proof for successful variable borrowing. Clients
+supply the meaning of a final shared move and a repeated shared borrow;
+missing, synthetic, released, exhausted, and unique entries are rejected
+here, together with exact release-bit, output, and state recovery. -/
+theorem lowerBorrow_var_run_sound_core
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv} {i : Nat}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {Result : VEnv → Emit → AVal → Bool → LowSt → Prop}
+    (hmove : ∀ {abs : Nat} {uses : Uses},
+      worldOfUses uses = .shared →
+      input.entries[i]? = some (.slot abs 1 uses true) →
+      Result (input.setEntry i (.slot abs 0 uses false))
+        (_root_.id : Emit) (.slotA abs) true state)
+    (hrepeated : ∀ {abs remaining : Nat} {uses : Uses},
+      worldOfUses uses = .shared →
+      input.entries[i]? =
+        some (.slot abs (Nat.succ (Nat.succ remaining)) uses true) →
+      let next := input.setEntry i
+        (.slot abs (Nat.succ remaining) uses true)
+      Result next (_root_.id : Emit) (.slotA abs) false state)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, av, release) finalState) :
+    Result output emit av release finalState := by
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[i]? with
+  | none =>
+    apply False.elim
+    apply estateThrowRun_not_ok
+    simpa [lowerBorrow, hentry] using hrun
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      apply False.elim
+      apply estateThrowRun_not_ok
+      simpa [lowerBorrow, hentry] using hrun
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        apply False.elim
+        apply estateThrowRun_not_ok
+        simpa [lowerBorrow, hentry] using hrun
+      | true =>
+        cases uses with
+        | erased =>
+          cases remaining with
+          | zero =>
+            apply False.elim
+            apply estateThrowRun_not_ok
+            simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry i (.slot abs 0 .erased false),
+                    (_root_.id : Emit), AVal.slotA abs, true) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact hmove (by rfl) hentry
+            | succ remaining =>
+              have hpure :
+                  let next := input.setEntry i
+                    (.slot abs (Nat.succ remaining) .erased true)
+                  (next, (_root_.id : Emit), AVal.slotA abs, false) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+              dsimp only at hpure
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact hrepeated (by rfl) hentry
+        | linear =>
+          apply False.elim
+          apply estateThrowRun_not_ok
+          simpa [lowerBorrow, hentry, worldOfUses, huuEq] using hrun
+        | affine =>
+          apply False.elim
+          apply estateThrowRun_not_ok
+          simpa [lowerBorrow, hentry, worldOfUses, huuEq] using hrun
+        | many =>
+          cases remaining with
+          | zero =>
+            apply False.elim
+            apply estateThrowRun_not_ok
+            simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry i (.slot abs 0 .many false),
+                    (_root_.id : Emit), AVal.slotA abs, true) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact hmove (by rfl) hentry
+            | succ remaining =>
+              have hpure :
+                  let next := input.setEntry i
+                    (.slot abs (Nat.succ remaining) .many true)
+                  (next, (_root_.id : Emit), AVal.slotA abs, false) =
+                      (output, emit, av, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+              dsimp only at hpure
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              exact hrepeated (by rfl) hentry
+
+/-- Every successful variable borrow is bounded-sound. Unique entries,
+released entries, and overcounted entries cannot reach a successful run;
+final shared uses transfer an owner and repeated shared uses retain it in the
+environment. -/
+theorem lowerBorrow_var_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {i : Nat}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowSoundBelow ctx cur limit input output emit av release := by
+  exact lowerBorrow_var_run_sound_core
+    (Result := fun resultOutput resultEmit resultAv resultRelease _ =>
+      LowerBorrowSoundBelow ctx cur limit input resultOutput resultEmit
+        resultAv resultRelease)
+    (hmove := fun hworld hentry =>
+      lower_var_shared_move_borrow_sound_below hworld hentry)
+    (hrepeated := fun hworld hentry =>
+      lower_var_shared_borrow_sound_below hworld hentry)
+    hrun
+
+private theorem lowerBorrow_var_run_value_sound_at
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceEnv sourceEnv sourceValue emit av release := by
+  exact lowerBorrow_var_run_sound_core
+    (Result := fun resultOutput resultEmit resultAv resultRelease _ =>
+      LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit input
+        resultOutput sourceEnv sourceEnv sourceValue resultEmit resultAv
+        resultRelease)
+    (hmove := fun hworld hentry =>
+      lower_var_shared_move_borrow_value_sound_at
+        hsource hworld hentry)
+    (hrepeated := fun hworld hentry =>
+      lower_var_shared_borrow_value_sound_at hsource hworld hentry)
+    hrun
+
+/-- Semantic variable-borrow branch of the executable lowerer. Successful
+final shared uses move the source-related owner to the caller, while repeated
+shared uses keep that owner in the updated semantic environment. -/
+theorem lowerBorrow_var_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur
+      input output sourceEnv sourceEnv sourceValue emit av release := by
+  exact LowerBorrowValueSound.of_below fun limit =>
+    lowerBorrow_var_run_value_sound_at (limit := limit) hsource hrun
+
+theorem lowerBorrow_var_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat} {input output : VEnv} {i : Nat}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hsource : sourceEnv[i]? = some sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceEnv sourceEnv sourceValue emit av release := by
+  exact lowerBorrow_var_run_value_sound_at hsource hrun
+
+/-- A variable borrow is always represented by a slot descriptor; every
+other executable branch is an error. -/
+theorem lowerBorrow_var_run_ne_constErased
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv} {i : Nat}
+    {emit : Emit} {release : Bool} {state finalState : LowSt}
+    (hrun : (lowerBorrow src (fuel + 1) input (.var i)).run state =
+      .ok (output, emit, .constA .erased, release) finalState) :
+    False := by
+  have hnotErased := lowerBorrow_var_run_sound_core
+    (Result := fun _ _ result _ _ => result ≠ .constA .erased)
+    (hmove := fun _ _ => by simp)
+    (hrepeated := fun _ _ => by simp)
+    hrun
+  exact hnotErased rfl
+
+/-- Every non-variable expression uses `lowerBorrow`'s ordinary
+shared-expression fallback. -/
+inductive DynamicBorrowHead : IxIR0.Expr → Prop where
+  | ref (address : Ixon.Address) : DynamicBorrowHead (.ref address)
+  | app (function argument : IxIR0.Expr) :
+      DynamicBorrowHead (.app function argument)
+  | lam (uses : Uses) (body : IxIR0.Expr) :
+      DynamicBorrowHead (.lam uses body)
+  | letE (uses : Uses) (value body : IxIR0.Expr) :
+      DynamicBorrowHead (.letE uses value body)
+  | proj (index : Nat) (value : IxIR0.Expr) :
+      DynamicBorrowHead (.proj index value)
+  | lit (literal : IxIR0.Literal) : DynamicBorrowHead (.lit literal)
+  | erased : DynamicBorrowHead .erased
+
+/-- Shared operational proof for the ordinary-expression borrowing fallback.
+The result predicates keep state-only, semantic, reflection, and profile
+clients separate while the monadic inversion and descriptor dispatch stay
+canonical. -/
+theorem lowerBorrow_dynamic_run_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {ExprResult : VEnv → Emit → AVal → LowSt → Prop}
+    {BorrowResult : VEnv → Emit → AVal → Bool → LowSt → Prop}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExprResult exprOutput exprEmit exprAv exprState)
+    (hslot : ∀ {exprOutput : VEnv} {exprEmit : Emit} {abs : Nat}
+        {exprState : LowSt},
+      ExprResult exprOutput exprEmit (.slotA abs) exprState →
+      BorrowResult exprOutput exprEmit (.slotA abs) true exprState)
+    (hconst : ∀ {exprOutput : VEnv} {exprEmit : Emit} {atom : Atom}
+        {exprState : LowSt},
+      ExprResult exprOutput exprEmit (.constA atom) exprState →
+      BorrowResult exprOutput exprEmit (.constA atom) false exprState)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    BorrowResult output emit av release finalState := by
+  cases hshape <;> simp only [lowerBorrow] at hrun
+  all_goals
+    obtain ⟨exprResult, exprState, hexprRun, hafterExpr⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases exprResult with ⟨exprOutput, exprEmit, exprValue⟩
+    cases exprValue with
+    | slotA abs =>
+      have hpure :
+          (exprOutput, exprEmit, AVal.slotA abs, true) =
+              (output, emit, av, release) ∧
+            exprState = finalState := by
+        simpa using hafterExpr
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      exact hslot (hexpr hexprRun)
+    | constA atom =>
+      have hpure :
+          (exprOutput, exprEmit, AVal.constA atom, false) =
+              (output, emit, av, release) ∧
+            exprState = finalState := by
+        simpa using hafterExpr
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      exact hconst (hexpr hexprRun)
+
+theorem lowerBorrow_dynamic_extraMonotone
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel)
+    {input : VEnv} {expr : IxIR0.Expr}
+    (hshape : DynamicBorrowHead expr) :
+    ExtraMonotone (lowerBorrow src (fuel + 1) input expr) := by
+  cases hshape <;> simp only [lowerBorrow]
+  all_goals
+    apply ExtraMonotone.bind (hexpr input .shared _)
+    intro exprResult
+    rcases exprResult with ⟨output, emit, value⟩
+    exact ExtraMonotone.pure
+      (output, emit, value,
+        match value with | .slotA _ => true | .constA _ => false)
+
+theorem lowerBorrowExtraMonotone_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraMonotone src fuel) :
+    LowerBorrowExtraMonotone src (fuel + 1) := by
+  intro input expr
+  cases expr with
+  | var index => exact lowerBorrow_var_extraMonotone src fuel input index
+  | ref address =>
+    exact lowerBorrow_dynamic_extraMonotone hexpr (.ref address)
+  | app function argument =>
+    exact lowerBorrow_dynamic_extraMonotone hexpr
+      (.app function argument)
+  | lam uses body =>
+    exact lowerBorrow_dynamic_extraMonotone hexpr (.lam uses body)
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_extraMonotone hexpr
+      (.letE uses value body)
+  | proj index value =>
+    exact lowerBorrow_dynamic_extraMonotone hexpr (.proj index value)
+  | lit literal =>
+    exact lowerBorrow_dynamic_extraMonotone hexpr (.lit literal)
+  | erased => exact lowerBorrow_dynamic_extraMonotone hexpr .erased
+
+theorem lowerBorrow_dynamic_extraProvenance
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel)
+    {input : VEnv} {expr : IxIR0.Expr}
+    (hshape : DynamicBorrowHead expr) :
+    ExtraProvenanceMonotone src
+      (lowerBorrow src (fuel + 1) input expr) := by
+  cases hshape <;> simp only [lowerBorrow]
+  all_goals
+    apply ExtraProvenanceMonotone.bind (hexpr input .shared _)
+    intro exprResult
+    rcases exprResult with ⟨output, emit, value⟩
+    exact ExtraProvenanceMonotone.pure src
+      (output, emit, value,
+        match value with | .slotA _ => true | .constA _ => false)
+
+theorem lowerBorrowExtraProvenance_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEExtraProvenance src fuel) :
+    LowerBorrowExtraProvenance src (fuel + 1) := by
+  intro input expr
+  cases expr with
+  | var index => exact (lowerBorrow_var_extraProvenance
+      src fuel input index)
+  | ref address =>
+    exact lowerBorrow_dynamic_extraProvenance hexpr (.ref address)
+  | app function argument =>
+    exact lowerBorrow_dynamic_extraProvenance hexpr
+      (.app function argument)
+  | lam uses body =>
+    exact lowerBorrow_dynamic_extraProvenance hexpr (.lam uses body)
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_extraProvenance hexpr
+      (.letE uses value body)
+  | proj index value =>
+    exact lowerBorrow_dynamic_extraProvenance hexpr (.proj index value)
+  | lit literal =>
+    exact lowerBorrow_dynamic_extraProvenance hexpr (.lit literal)
+  | erased => exact lowerBorrow_dynamic_extraProvenance hexpr .erased
+
+/-- One fuel step for the entire state-only lowering cluster. Every recursive
+compiler call is at predecessor fuel; the only generated declarations come
+from the wrapper and lambda rules already isolated above. -/
+theorem lowerExtraMonotone_succ {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerExtraMonotone src fuel) :
+    LowerExtraMonotone src (fuel + 1) where
+  expr := lowerEExtraMonotone_succ
+    hprev.expr hprev.spine hprev.borrow hprev.lam
+  borrow := lowerBorrowExtraMonotone_succ hprev.expr
+  spine := lowerSpineExtraMonotone_succ
+    hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+  knownCall := knownCallExtraMonotone_succ hprev.args hprev.applyRest
+  args := lowerArgsExtraMonotone_succ hprev.expr hprev.args
+  applyRest := applyRestExtraMonotone_succ hprev.args
+  lam := fun input expr =>
+    lowerLam_extraMonotone_succ hprev.fnBody input expr
+  fnBody := lowerFnBodyExtraMonotone_succ hprev.expr
+
+/-- One compiler-fuel step preserves exact provenance for both primitive
+generated-declaration sites and every recursively threaded subaction. -/
+theorem lowerExtraProvenance_succ {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerExtraProvenance src fuel) :
+    LowerExtraProvenance src (fuel + 1) where
+  expr := lowerEExtraProvenance_succ
+    hprev.expr hprev.spine hprev.borrow hprev.lam
+  borrow := lowerBorrowExtraProvenance_succ hprev.expr
+  spine := lowerSpineExtraProvenance_succ
+    hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+  knownCall := knownCallExtraProvenance_succ
+    hprev.args hprev.applyRest
+  args := lowerArgsExtraProvenance_succ hprev.expr hprev.args
+  applyRest := applyRestExtraProvenance_succ hprev.args
+  lam := fun input expr hpositive =>
+    lowerLam_extraProvenance_succ hprev.fnBody input expr hpositive
+  fnBody := lowerFnBodyExtraProvenance_succ hprev.expr
+
+/-- All successful lowering-cluster actions prepend (and never discard)
+generated declarations. -/
+theorem lowerExtraMonotone (src : IxIR0.Env) :
+    ∀ fuel, LowerExtraMonotone src fuel
+  | 0 => lowerExtraMonotone_zero src
+  | fuel + 1 => lowerExtraMonotone_succ (lowerExtraMonotone src fuel)
+
+/-- Complete compiler-fuel induction for generated-declaration provenance. -/
+theorem lowerExtraProvenance (src : IxIR0.Env) :
+    ∀ fuel, LowerExtraProvenance src fuel
+  | 0 => lowerExtraProvenance_zero src
+  | fuel + 1 =>
+    lowerExtraProvenance_succ (lowerExtraProvenance src fuel)
+
+theorem lowerE_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {output : VEnv} {emit : Emit} {value : AVal}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).expr input world expr hrun
+
+theorem lowerBorrow_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {result : VEnv × Emit × AVal × Bool}
+    (hrun : (lowerBorrow src fuel input expr).run state =
+      .ok result finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).borrow input expr hrun
+
+theorem lowerSpine_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {state finalState : LowSt} {result : VEnv × Emit × AVal}
+    (hrun : (lowerSpine src fuel input world head args).run state =
+      .ok result finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).spine input world head args hrun
+
+theorem lowerArgs_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv}
+    {args : List (IxIR0.Expr × Owned)} {state finalState : LowSt}
+    {result : VEnv × Emit × List AVal}
+    (hrun : (lowerArgs src fuel input args).run state =
+      .ok result finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).args input args hrun
+
+theorem knownCall_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv}
+    {build : Array Atom → Op} {count : Nat}
+    {argWorlds : List Owned} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {result : VEnv × Emit × AVal}
+    (hrun : (knownCall src fuel input build count argWorlds resultWorld
+      args).run state = .ok result finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).knownCall input build count argWorlds
+    resultWorld args hrun
+
+theorem applyRest_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv}
+    {resultWorld : Owned} {pre : Emit} {function : AVal}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {result : VEnv × Emit × AVal}
+    (hrun : (applyRest src fuel input resultWorld pre function args).run
+      state = .ok result finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).applyRest input resultWorld pre function
+    args hrun
+
+theorem lowerLam_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {result : VEnv × Emit × AVal}
+    (hrun : (lowerLam src fuel input expr).run state =
+      .ok result finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).lam input expr hrun
+
+theorem lowerFnBody_extraExtends
+    {src : IxIR0.Env} {fuel : Nat} {input : VEnv}
+    {drops : List SlotDrop} {world : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {code : Code}
+    (hrun : (lowerFnBody src fuel input drops world body).run state =
+      .ok code finalState) :
+    ExtraExtends state finalState :=
+  (lowerExtraMonotone src fuel).fnBody input drops world body hrun
+
+/-- One recursor alternative sequences only canonical entry cleanup and an
+ordinary expression-lowering action, so it preserves the generated-state
+extension invariant. -/
+theorem lowerRecursorRule_extraMonotone (src : IxIR0.Env) (fuel numArgs : Nat)
+    (ruleTag : IxIR0.RecRule × Nat) :
+    ExtraMonotone (lowerRecursorRule src fuel numArgs ruleTag) := by
+  rcases ruleTag with ⟨rule, tag⟩
+  simp only [lowerRecursorRule]
+  apply ExtraMonotone.bind (releaseSlots_extraMonotone _ _)
+  intro releaseResult
+  rcases releaseResult with ⟨input, releaseEmit⟩
+  apply ExtraMonotone.bind
+    ((lowerExtraMonotone src fuel).expr input .shared rule.rhs)
+  intro bodyResult
+  rcases bodyResult with ⟨output, bodyEmit, value⟩
+  exact ExtraMonotone.pure _
+
+/-- Traversing all recursor alternatives preserves generated state. -/
+theorem lowerRecursor_extraMonotone (src : IxIR0.Env) (fuel numArgs : Nat)
+    (natLit : Bool) (rules : Array IxIR0.RecRule) :
+    ExtraMonotone (lowerRecursor src fuel numArgs natLit rules) := by
+  simp only [lowerRecursor]
+  apply ExtraMonotone.bind
+    (ExtraMonotone.listMapM (lowerRecursorRule src fuel numArgs)
+      (lowerRecursorRule_extraMonotone src fuel numArgs)
+      rules.toList.zipIdx)
+  intro alts
+  exact ExtraMonotone.pure
+    (⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alts.toArray⟩ : FnDef)
+
+/-- Every declaration-lowering branch preserves generated state. -/
+theorem lowerDecl_extraMonotone (src : IxIR0.Env) (fuel : Nat) :
+    ∀ item, ExtraMonotone (lowerDecl src fuel item)
+  | (address, .defn result body) => by
+      simp only [lowerDecl]
+      apply ExtraMonotone.bind
+        ((lowerExtraMonotone src fuel).fnBody _ _ result _)
+      intro code
+      exact ExtraMonotone.pure
+        (some (address, Decl.fn ⟨lamArity body, result,
+          result == .shared && papSafe body, code⟩))
+  | (_, .ctor tag arity) => by
+      simp only [lowerDecl]
+      exact ExtraMonotone.pure
+        (none : Option (Ixon.Address × Decl))
+  | (address, .recursor numArgs natLit rules) => by
+      simp only [lowerDecl]
+      apply ExtraMonotone.bind
+        (lowerRecursor_extraMonotone src fuel numArgs natLit rules)
+      intro d
+      exact ExtraMonotone.pure (some (address, Decl.fn d))
+  | (address, .extern arity) => by
+      simp only [lowerDecl]
+      exact ExtraMonotone.pure (some (address, Decl.extern arity))
+
+/-- The full declaration traversal preserves generated state. -/
+theorem lowerDecls_extraMonotone (src : IxIR0.Env) (fuel : Nat)
+    (decls : List (Ixon.Address × IxIR0.Decl)) :
+    ExtraMonotone (decls.filterMapM (lowerDecl src fuel)) :=
+  ExtraMonotone.listFilterMapM (lowerDecl src fuel)
+    (lowerDecl_extraMonotone src fuel) decls
+
+/-- Whole-program lowering extends the empty generated-state trajectory;
+the final `get` merely exposes the accumulated declarations in the result. -/
+theorem lowerAllAction_extraMonotone
+    (decls : List (Ixon.Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainWorld : Owned) (fuel : Nat) :
+    ExtraMonotone (lowerAllAction decls main mainWorld fuel) := by
+  let src := IxIR0.Env.ofList decls
+  simp only [lowerAllAction]
+  apply ExtraMonotone.bind (lowerDecls_extraMonotone src fuel decls)
+  intro base
+  apply ExtraMonotone.bind
+    ((lowerExtraMonotone src fuel).fnBody ⟨[], 0⟩ [] mainWorld main)
+  intro mainCode
+  apply ExtraMonotone.bind ExtraMonotone.get
+  intro state
+  exact ExtraMonotone.pure (base ++ state.extra, mainCode)
+
+theorem lowerRecursorRule_extraProvenance
+    (src : IxIR0.Env) (fuel numArgs : Nat)
+    (ruleTag : IxIR0.RecRule × Nat) :
+    ExtraProvenanceMonotone src
+      (lowerRecursorRule src fuel numArgs ruleTag) := by
+  rcases ruleTag with ⟨rule, tag⟩
+  simp only [lowerRecursorRule]
+  apply ExtraProvenanceMonotone.bind
+    (releaseSlots_extraProvenance src _ _)
+  intro releaseResult
+  rcases releaseResult with ⟨input, releaseEmit⟩
+  apply ExtraProvenanceMonotone.bind
+    ((lowerExtraProvenance src fuel).expr input .shared rule.rhs)
+  intro bodyResult
+  rcases bodyResult with ⟨output, bodyEmit, value⟩
+  exact ExtraProvenanceMonotone.pure src _
+
+theorem lowerRecursor_extraProvenance
+    (src : IxIR0.Env) (fuel numArgs : Nat)
+    (natLit : Bool) (rules : Array IxIR0.RecRule) :
+    ExtraProvenanceMonotone src
+      (lowerRecursor src fuel numArgs natLit rules) := by
+  simp only [lowerRecursor]
+  apply ExtraProvenanceMonotone.bind
+    (ExtraProvenanceMonotone.listMapM src
+      (lowerRecursorRule src fuel numArgs)
+      (lowerRecursorRule_extraProvenance src fuel numArgs)
+      rules.toList.zipIdx)
+  intro alts
+  exact ExtraProvenanceMonotone.pure src
+    (⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alts.toArray⟩ : FnDef)
+
+theorem lowerDecl_extraProvenance (src : IxIR0.Env) (fuel : Nat) :
+    ∀ item, ExtraProvenanceMonotone src (lowerDecl src fuel item)
+  | (address, .defn result body) => by
+      simp only [lowerDecl]
+      apply ExtraProvenanceMonotone.bind
+        ((lowerExtraProvenance src fuel).fnBody _ _ result _)
+      intro code
+      exact ExtraProvenanceMonotone.pure src
+        (some (address, Decl.fn ⟨lamArity body, result,
+          result == .shared && papSafe body, code⟩))
+  | (_, .ctor tag arity) => by
+      simp only [lowerDecl]
+      exact ExtraProvenanceMonotone.pure src
+        (none : Option (Ixon.Address × Decl))
+  | (address, .recursor numArgs natLit rules) => by
+      simp only [lowerDecl]
+      apply ExtraProvenanceMonotone.bind
+        (lowerRecursor_extraProvenance src fuel numArgs natLit rules)
+      intro d
+      exact ExtraProvenanceMonotone.pure src
+        (some (address, Decl.fn d))
+  | (address, .extern arity) => by
+      simp only [lowerDecl]
+      exact ExtraProvenanceMonotone.pure src
+        (some (address, Decl.extern arity))
+
+theorem lowerDecls_extraProvenance (src : IxIR0.Env) (fuel : Nat)
+    (decls : List (Ixon.Address × IxIR0.Decl)) :
+    ExtraProvenanceMonotone src
+      (decls.filterMapM (lowerDecl src fuel)) :=
+  ExtraProvenanceMonotone.listFilterMapM src (lowerDecl src fuel)
+    (lowerDecl_extraProvenance src fuel) decls
+
+/-- Whole-program lowering from any state preserves exact origin witnesses
+for every generated declaration added by declarations or the main body. -/
+theorem lowerAllAction_extraProvenance
+    (decls : List (Ixon.Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (mainWorld : Owned) (fuel : Nat) :
+    ExtraProvenanceMonotone (IxIR0.Env.ofList decls)
+      (lowerAllAction decls main mainWorld fuel) := by
+  let src := IxIR0.Env.ofList decls
+  simp only [lowerAllAction]
+  apply ExtraProvenanceMonotone.bind
+    (lowerDecls_extraProvenance src fuel decls)
+  intro base
+  apply ExtraProvenanceMonotone.bind
+    ((lowerExtraProvenance src fuel).fnBody
+      ⟨[], 0⟩ [] mainWorld main)
+  intro mainCode
+  apply ExtraProvenanceMonotone.bind
+    (ExtraProvenanceMonotone.get src)
+  intro state
+  exact ExtraProvenanceMonotone.pure src
+    (base ++ state.extra, mainCode)
+
+/-- Closed whole-pass provenance: no generated row can come from an
+arbitrary pre-existing compiler state. -/
+theorem lowerAllAction_extraProvenance_empty
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat}
+    {result : List (Ixon.Address × Decl) × Code} {finalState : LowSt}
+    (hrun : (lowerAllAction decls main mainWorld fuel).run {} =
+      .ok result finalState) :
+    ExtraProvenanceExtends (IxIR0.Env.ofList decls)
+      ({} : LowSt) finalState :=
+  lowerAllAction_extraProvenance decls main mainWorld fuel hrun
+
+/-- Every final generated declaration exposed by a successful whole-program
+action occurs verbatim in the returned target declaration list. -/
+theorem lowerAllAction_extra_mem_result
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    (hrun : (lowerAllAction decls main mainWorld fuel).run initial =
+      .ok (targetDecls, mainCode) finalState) :
+    ∀ {item}, item ∈ finalState.extra → item ∈ targetDecls := by
+  intro item hmember
+  simp only [lowerAllAction] at hrun
+  obtain ⟨base, baseState, hbase, hafterBase⟩ :=
+    estateBindRun_ok_inv hrun
+  obtain ⟨compiledMain, mainState, hmain, hafterMain⟩ :=
+    estateBindRun_ok_inv hafterBase
+  obtain ⟨observed, getState, hget, hpure⟩ :=
+    estateBindRun_ok_inv hafterMain
+  have hget' : mainState = observed ∧ mainState = getState := by
+    simpa using hget
+  obtain ⟨hobserved, hgetState⟩ := hget'
+  subst observed
+  subst getState
+  have hpure' :
+      (base ++ mainState.extra, compiledMain) =
+          (targetDecls, mainCode) ∧ mainState = finalState := by
+    simpa using hpure
+  obtain ⟨hresult, hstate⟩ := hpure'
+  subst finalState
+  have hdecls : base ++ mainState.extra = targetDecls :=
+    congrArg Prod.fst hresult
+  rw [← hdecls]
+  exact List.mem_append_right base hmember
+
+/-- Recover the exact `lowerDecl` sub-run for any source-list member of a
+successful whole-program action. Its final state is a represented suffix of
+the whole trajectory, and any emitted base declaration occurs in the returned
+target list. -/
+theorem lowerAllAction_decl_trace
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat} {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    (hrun : (lowerAllAction decls main mainWorld fuel).run initial =
+      .ok (targetDecls, mainCode) finalState)
+    {item : Ixon.Address × IxIR0.Decl} (hitem : item ∈ decls) :
+    ∃ itemInitial itemFinal output,
+      (lowerDecl (IxIR0.Env.ofList decls) fuel item).run itemInitial =
+        .ok output itemFinal ∧
+      ExtraExtends itemFinal finalState ∧
+      ∀ value, output = some value → value ∈ targetDecls := by
+  let src := IxIR0.Env.ofList decls
+  simp only [lowerAllAction] at hrun
+  obtain ⟨base, baseState, hbase, hafterBase⟩ :=
+    estateBindRun_ok_inv hrun
+  obtain ⟨compiledMain, mainState, hmain, hafterMain⟩ :=
+    estateBindRun_ok_inv hafterBase
+  obtain ⟨observed, getState, hget, hpure⟩ :=
+    estateBindRun_ok_inv hafterMain
+  have hget' : mainState = observed ∧ mainState = getState := by
+    simpa using hget
+  obtain ⟨hobserved, hgetState⟩ := hget'
+  subst observed
+  subst getState
+  have hpure' :
+      (base ++ mainState.extra, compiledMain) =
+          (targetDecls, mainCode) ∧ mainState = finalState := by
+    simpa using hpure
+  obtain ⟨hresult, hstate⟩ := hpure'
+  subst finalState
+  obtain ⟨itemInitial, itemFinal, output, hitemRun, hitemExtends,
+      houtput⟩ := listFilterMapM_trace (lowerDecl src fuel)
+        (lowerDecl_extraMonotone src fuel) decls hbase hitem
+  refine ⟨itemInitial, itemFinal, output, ?_,
+    hitemExtends.trans (lowerFnBody_extraExtends hmain), ?_⟩
+  · simpa [src] using hitemRun
+  · intro value hvalue
+    have hbaseMember := houtput value hvalue
+    have hdecls : base ++ mainState.extra = targetDecls :=
+      congrArg Prod.fst hresult
+    rw [← hdecls]
+    exact List.mem_append_left _ hbaseMember
+
+/-- A successful whole-program action from the default state carries the
+exact cache/declaration reachability witness needed to construct the final
+`ExtraRepresented` layout. -/
+theorem lowerAllAction_extraExtends_empty
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat} {result : List (Ixon.Address × Decl) × Code}
+    {finalState : LowSt}
+    (hrun : (lowerAllAction decls main mainWorld fuel).run {} =
+      .ok result finalState) :
+    ExtraExtends ({} : LowSt) finalState :=
+  lowerAllAction_extraMonotone decls main mainWorld fuel hrun
+
+/-- Once the target context represents the final `extra` list, a successful
+whole-program run from the default state also represents every memoized
+constructor wrapper. No arbitrary-state wrapper oracle remains. -/
+theorem lowerAllAction_extraRepresented
+    {ctx : Ctx} {decls : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Owned} {fuel : Nat}
+    {result : List (Ixon.Address × Decl) × Code} {finalState : LowSt}
+    (hrun : (lowerAllAction decls main mainWorld fuel).run {} =
+      .ok result finalState)
+    (hdecls : ∀ {address decl}, (address, decl) ∈ finalState.extra →
+      ctx.decls address = some decl) :
+    ExtraRepresented ctx finalState :=
+  (lowerAllAction_extraExtends_empty hrun).represented_of_empty hdecls
+
+/-- Non-variable borrowing is derived directly from predecessor-fuel
+expression soundness. Slot results carry a releasable temporary owner;
+stable constants are ownership-inert non-releasing borrows. -/
+theorem lowerBorrow_dynamic_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerBorrowSoundBelow ctx cur limit input output emit av release := by
+  exact (lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv exprState =>
+      ExtraRepresented ctx exprState →
+      LowerResultSoundBelow ctx cur limit input exprOutput .shared
+        exprEmit exprAv)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease
+        borrowState =>
+      ExtraRepresented ctx borrowState →
+      LowerBorrowSoundBelow ctx cur limit input borrowOutput borrowEmit
+        borrowAv borrowRelease)
+    (hexpr := fun hsubrun hrepresented =>
+      hexpr hsubrun hrepresented havailable)
+    (hslot := fun hsound hrepresented =>
+      (hsound hrepresented).asBorrowSlot)
+    (hconst := fun hsound hrepresented =>
+      (hsound hrepresented).asBorrowConst)
+    hshape hrun) hrepresented
+
+/-- Semantic dynamic-borrow branch. Every non-variable borrowing position is
+lowered as an ordinary shared expression and adapted by the two borrow
+adapters, so the source graph passes through unchanged and only the release
+obligation is recomputed from the descriptor. -/
+theorem lowerBorrow_dynamic_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+      {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+        .ok (exprOutput, exprEmit, exprAv) exprState →
+      LowerResultValueSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release := by
+  exact lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease _ =>
+      LowerBorrowValueSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceValue borrowEmit borrowAv borrowRelease)
+    (hexpr := fun hsubrun => hexpr hsubrun)
+    (hslot := fun hsound => hsound.asBorrowSlot)
+    (hconst := fun hsound => hsound.asBorrowConst)
+    hshape hrun
+
+/-- A complete bounded `lowerBorrow` step follows from predecessor-fuel
+expression soundness plus the direct variable-borrow rule. -/
+theorem lowerBorrowPreservesBelow_succ
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel) :
+    LowerBorrowPreservesBelow ctx cur limit src (fuel + 1) := by
+  intro input expr state finalState output emit av release hrun hrepresented
+    havailable
+  cases expr with
+  | var i => exact lowerBorrow_var_run_sound_below hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr (.ref address) hrun
+      hrepresented havailable
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr
+      (.app function argument) hrun hrepresented havailable
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr (.lam uses body) hrun
+      hrepresented havailable
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr
+      (.letE uses value body) hrun hrepresented havailable
+  | proj index value =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr (.proj index value) hrun
+      hrepresented havailable
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr (.lit literal) hrun
+      hrepresented havailable
+  | erased =>
+    exact lowerBorrow_dynamic_run_sound_below hexpr .erased hrun
+      hrepresented havailable
+
+/-- One complete semantic borrow step. Variables use the direct lookup rule;
+every other constructor delegates to predecessor-fuel expression semantics
+and then applies the descriptor-preserving borrow adapter. -/
+theorem lowerBorrowValuePreserves_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEValuePreserves funRel recSelfRel sourceCtx ctx cur
+      src fuel) :
+    LowerBorrowValuePreserves funRel recSelfRel sourceCtx ctx cur src
+      (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun
+  cases expr with
+  | var index =>
+    exact lowerBorrow_var_run_value_sound (sourceEval_var_inv hsource) hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun) (.ref address) hrun
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun)
+      (.app function argument) hrun
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun) (.lam uses body) hrun
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun)
+      (.letE uses value body) hrun
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun) (.proj index source) hrun
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun) (.lit literal) hrun
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_sound
+      (fun hsubrun => hexpr hsource hsubrun) .erased hrun
+
+/-- The non-variable borrow adapter reflects an erased descriptor through
+its predecessor `lowerE` run. Slot results cannot equal erased; scalar
+results retain the exact atom returned by that run. -/
+theorem lowerBorrow_dynamic_run_reflectsErased
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    (hreflect : LowerEReflectsErased sourceCtx src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    {release : Bool} {state finalState : LowSt}
+    (hshape : DynamicBorrowHead expr)
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (herased : av = .constA .erased) :
+    sourceValue = .erased := by
+  exact (lowerBorrow_dynamic_run_core
+    (ExprResult := fun _ _ exprAv _ =>
+      exprAv = .constA .erased → sourceValue = .erased)
+    (BorrowResult := fun _ _ borrowAv _ _ =>
+      borrowAv = .constA .erased → sourceValue = .erased)
+    (hexpr := fun hsubrun herased => hreflect hsource hsubrun herased)
+    (hslot := fun _ hcontra => by cases hcontra)
+    (hconst := fun hsound => hsound)
+    hshape hrun) herased
+
+theorem lowerBorrowReflectsErased_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    (hreflect : LowerEReflectsErased sourceCtx src fuel) :
+    LowerBorrowReflectsErased sourceCtx src (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun herased
+  cases expr with
+  | var index =>
+    subst av
+    exact (lowerBorrow_var_run_ne_constErased hrun).elim
+  | ref address =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect (.ref address)
+      hsource hrun herased
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect
+      (.app function argument) hsource hrun herased
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect (.lam uses body)
+      hsource hrun herased
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect
+      (.letE uses value body) hsource hrun herased
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect
+      (.proj index source) hsource hrun herased
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect (.lit literal)
+      hsource hrun herased
+  | erased =>
+    exact lowerBorrow_dynamic_run_reflectsErased hreflect .erased
+      hsource hrun herased
+
+/-- Shared operational proof for projection lowering. Clients supply the
+logical meaning of a successful borrow and one semantic adapter per concrete
+descriptor branch; world rejection, monadic inversion, and output recovery
+remain independent of the ownership, graph, reflection, or profile judgment
+being established. -/
+theorem lowerE_proj_run_sound_core
+    {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    {BorrowResult : VEnv → Emit → AVal → Bool → LowSt → Prop}
+    {ProjectionResult : Owned → VEnv → Emit → AVal → LowSt → Prop}
+    (hborrow : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+        {borrowed : AVal} {release : Bool} {middleState : LowSt},
+      (lowerBorrow src fuel input source).run state =
+          .ok (borrowOutput, borrowEmit, borrowed, release) middleState →
+      BorrowResult borrowOutput borrowEmit borrowed release middleState)
+    (hvar : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+        {relative : Nat} {release : Bool} {middleState : LowSt},
+      BorrowResult borrowOutput borrowEmit (.constA (.var relative))
+          release middleState →
+      ProjectionResult .shared borrowOutput.bump
+        (borrowEmit ∘ emitOp (.fetch (.var relative) index))
+        (.slotA borrowOutput.depth) middleState)
+    (hlit : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+        {literal : IxIR0.Literal} {release : Bool} {middleState : LowSt},
+      BorrowResult borrowOutput borrowEmit (.constA (.lit literal))
+          release middleState →
+      ProjectionResult .shared borrowOutput.bump
+        (borrowEmit ∘ emitOp (.fetch (.lit literal) index))
+        (.slotA borrowOutput.depth) middleState)
+    (herased : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+        {release : Bool} {middleState : LowSt},
+      BorrowResult borrowOutput borrowEmit (.constA .erased) release
+          middleState →
+      ProjectionResult .shared borrowOutput borrowEmit (.constA .erased)
+        middleState)
+    (hslotKept : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+        {targetAbs : Nat} {middleState : LowSt},
+      BorrowResult borrowOutput borrowEmit (.slotA targetAbs) false
+          middleState →
+      ProjectionResult .shared borrowOutput.bump.bump
+        (borrowEmit ∘
+          emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+          emitOp (.dup
+            (.var (borrowOutput.bump.rel borrowOutput.depth))))
+        (.slotA borrowOutput.bump.depth) middleState)
+    (hslotReleased : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+        {targetAbs : Nat} {middleState : LowSt},
+      BorrowResult borrowOutput borrowEmit (.slotA targetAbs) true
+          middleState →
+      ProjectionResult .shared borrowOutput.bump.bump.bump
+        (borrowEmit ∘
+          emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+          emitOp (.dup
+            (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+          emitOp (.drop
+            (.var (borrowOutput.bump.bump.rel targetAbs))))
+        (.slotA borrowOutput.bump.depth) middleState)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState) :
+    ProjectionResult world output emit av finalState := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp only [lowerE, huuEq, if_true] at hrun
+    exact (estateThrowRun_not_ok hrun).elim
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      estateBindRun_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.var relative) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact hvar (hborrow hborrowRun)
+      | lit literal =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.lit literal) index),
+              AVal.slotA borrowOutput.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact hlit (hborrow hborrowRun)
+      | erased =>
+        have hpure :
+            (borrowOutput, borrowEmit, AVal.constA .erased) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact herased (hborrow hborrowRun)
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure :
+            (borrowOutput.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact hslotKept (hborrow hborrowRun)
+      | true =>
+        have hpure :
+            (borrowOutput.bump.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs)) index) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                emitOp (.drop
+                  (.var (borrowOutput.bump.bump.rel targetAbs))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        exact hslotReleased (hborrow hborrowRun)
+
+/-- Every successful shared projection lowering is bounded-sound. The
+borrowing sub-run determines whether the target owner remains in the output
+environment or is released after retaining the fetched field; erased values
+absorb projection, while other stable constants make target execution stuck. -/
+theorem lowerE_proj_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hborrow : LowerBorrowPreservesBelow ctx cur limit src fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  exact (lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release
+        middleState =>
+      ExtraRepresented ctx middleState →
+      LowerBorrowSoundBelow ctx cur limit input borrowOutput borrowEmit
+        borrowed release)
+    (ProjectionResult := fun projectionWorld projectionOutput projectionEmit
+        projectionAv projectionState =>
+      ExtraRepresented ctx projectionState →
+      LowerResultSoundBelow ctx cur limit input projectionOutput
+        projectionWorld
+        projectionEmit projectionAv)
+    (hborrow := fun hsubrun hrepresented =>
+      hborrow hsubrun hrepresented havailable)
+    (hvar := fun hsound hrepresented => by
+      cases (hsound hrepresented).stable)
+    (hlit := fun hsound hrepresented =>
+      (hsound hrepresented).projectConst)
+    (herased := fun hsound hrepresented =>
+      (hsound hrepresented).returnErased)
+    (hslotKept := fun hsound hrepresented =>
+      (hsound hrepresented).projectSlotKept)
+    (hslotReleased := fun hsound hrepresented =>
+      (hsound hrepresented).projectSlotReleased)
+    hrun) hrepresented
+
+/-- Semantic projection branch of the executable lowerer. The four target
+descriptors are dispatched against the two source outcomes: a slot borrow
+selects the corresponding constructor field, the erased descriptor absorbs
+an erased target, and the remaining two pairings are unreachable. The
+compiler-induction hypothesis is supplied for the exact borrow run, so this
+theorem carries no fuel bound of its own. -/
+theorem lowerE_proj_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    (hborrow : ∀ {borrowOutput : VEnv} {borrowEmit : Emit}
+      {borrowed : AVal} {release : Bool} {middleState : LowSt},
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, borrowed, release) middleState →
+      LowerBorrowValueSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceTarget borrowEmit borrowed release)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release _ =>
+      LowerBorrowValueSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceTarget borrowEmit borrowed release)
+    (ProjectionResult := fun projectionWorld projectionOutput projectionEmit
+        projectionAv _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input projectionOutput
+        sourceEnv sourceEnv sourceValue projectionWorld projectionEmit
+        projectionAv)
+    (hborrow := fun hsubrun => hborrow hsubrun)
+    (hvar := fun hsound => by cases hsound.stable)
+    (hlit := fun hsound => hsound.projectConst)
+    (herased := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectCtorErased
+      | erased => exact hsound.returnErased)
+    (hslotKept := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectSlotKept hfield
+      | erased => exact hsound.projectSlotKeptErased)
+    (hslotReleased := fun hsound => by
+      cases hproject with
+      | ctor hfield => exact hsound.projectSlotReleased hfield
+      | erased => exact hsound.projectSlotReleasedErased)
+    hrun
+
+/-- If projection lowering returns literal erased, its borrowing sub-run
+returned literal erased as well. All fetch-producing branches return slots. -/
+theorem lowerE_proj_run_constErased_inv
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {index : Nat} {source : IxIR0.Expr}
+    {emit : Emit} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, .constA .erased) finalState) :
+    ∃ borrowOutput borrowEmit release middleState,
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, .constA .erased, release)
+          middleState := by
+  exact (lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release
+        middleState =>
+      (lowerBorrow src fuel input source).run state =
+        .ok (borrowOutput, borrowEmit, borrowed, release) middleState)
+    (ProjectionResult := fun _ _ _ projectionAv _ =>
+      projectionAv = .constA .erased →
+      ∃ borrowOutput borrowEmit release middleState,
+        (lowerBorrow src fuel input source).run state =
+          .ok (borrowOutput, borrowEmit, .constA .erased, release)
+            middleState)
+    (hborrow := fun hsubrun => hsubrun)
+    (hvar := fun _ hcontra => by cases hcontra)
+    (hlit := fun _ hcontra => by cases hcontra)
+    (herased := fun hsubrun _ => ⟨_, _, _, _, hsubrun⟩)
+    (hslotKept := fun _ hcontra => by cases hcontra)
+    (hslotReleased := fun _ hcontra => by cases hcontra)
+    hrun) rfl
+
+/-- Fully instantiated semantic projection: with a source variable as the
+projection target the borrow hypothesis is discharged by the variable-borrow
+theorem, so this carries no compiler-induction premise at all. -/
+theorem lowerE_proj_var_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {index i : Nat}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value}
+    {sourceTarget sourceValue : IxIR0.Value}
+    (hsource : sourceEnv[i]? = some sourceTarget)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 2) input world
+      (.proj index (.var i))).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  refine lowerE_proj_run_value_sound (fuel := fuel + 1) ?_ hproject hrun
+  intro borrowOutput borrowEmit borrowed release middleState hborrowRun
+  exact lowerBorrow_var_run_value_sound hsource hborrowRun
+
+/-- The expression-level application constructor delegates exactly to the
+predecessor-fuel spine proof. -/
+theorem lowerE_app_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hspine : LowerSpinePreservesBelow ctx cur limit src fuel)
+    {input output : VEnv} {world : Owned} {function argument : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.app function argument)).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  apply hspine
+  · simpa [lowerE] using hrun
+  · exact hrepresented
+  · exact havailable
+
+/-- Expression constructors that neither install a local binder nor create a
+lifted local declaration. These are exactly the cases already closed by the
+bounded compiler induction's variable, spine, borrow, and scalar layers. -/
+inductive NonbindingLowerEHead : IxIR0.Expr → Prop where
+  | var (index : Nat) : NonbindingLowerEHead (.var index)
+  | ref (address : Ixon.Address) : NonbindingLowerEHead (.ref address)
+  | app (function argument : IxIR0.Expr) :
+      NonbindingLowerEHead (.app function argument)
+  | proj (index : Nat) (source : IxIR0.Expr) :
+      NonbindingLowerEHead (.proj index source)
+  | lit (literal : IxIR0.Literal) : NonbindingLowerEHead (.lit literal)
+  | erased : NonbindingLowerEHead .erased
+
+/-- Consolidated bounded `lowerE` step for every nonbinding constructor.
+Lambda lifting and let installation are supplied by their adjacent dedicated
+rules. -/
+theorem lowerE_nonbinding_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hspine : LowerSpinePreservesBelow ctx cur limit src fuel)
+    (hargsNext : LowerArgsPreservesBelow ctx cur limit src (fuel + 1))
+    (hargsNextExtra : LowerArgsExtraMonotone src (fuel + 1))
+    (hrestNext : ApplyRestPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestNextExtra : ApplyRestExtraMonotone src (fuel + 1))
+    (hborrow : LowerBorrowPreservesBelow ctx cur limit src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hshape : NonbindingLowerEHead expr)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  cases hshape with
+  | var index => exact lowerE_var_run_sound_below hrun
+  | ref address =>
+    exact lowerE_ref_run_sound_below hargsNext hargsNextExtra hrestNext
+      hrestNextExtra hdecls hrun hrepresented havailable
+  | app function argument =>
+    exact lowerE_app_run_sound_below hspine hrun hrepresented havailable
+  | proj index source =>
+    exact lowerE_proj_run_sound_below hborrow hrun hrepresented havailable
+  | lit literal => exact lowerE_lit_run_sound_below hrun
+  | erased => exact lowerE_erased_run_sound_below hrun
+
+/-- Invert a pure post-map that preserves the third component of a lowered
+expression result. This factors the common tail of every executable let
+installation branch. -/
+theorem lowerE_mapResult_run_inv
+    {src : IxIR0.Env} {fuel : Nat} {bodyInput output : VEnv}
+    {world : Owned} {body : IxIR0.Expr} {map : VEnv → Emit → VEnv × Emit}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : ((lowerE src fuel bodyInput world body) >>= fun result =>
+      let (bodyOutput, bodyEmit, resultValue) := result
+      let mapped := map bodyOutput bodyEmit
+      pure (mapped.1, mapped.2, resultValue)).run state =
+        .ok (output, emit, av) finalState) :
+    ∃ bodyOutput bodyEmit bodyFinal,
+      (lowerE src fuel bodyInput world body).run state =
+        .ok (bodyOutput, bodyEmit, av) bodyFinal := by
+  obtain ⟨bodyResult, bodyFinal, hbodyRun, hpureRun⟩ :=
+    estateBindRun_ok_inv hrun
+  rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+  have hpure :
+      (let mapped := map bodyOutput bodyEmit;
+        (mapped.1, mapped.2, resultValue)) = (output, emit, av) ∧
+        bodyFinal = finalState := by
+    simpa using hpureRun
+  have hvalue : resultValue = av := by
+    simpa using congrArg (fun result => result.2.2) hpure.1
+  subst resultValue
+  exact ⟨bodyOutput, bodyEmit, bodyFinal, hbodyRun⟩
+
+/-- Shared operational dispatcher for successful let lowering. The result
+family keeps inversion, bounded ownership, and exact/bounded semantic and
+profile clients separate while value/body sequencing, binder-shape
+classification, dead-use rejection, output recovery, and the common
+environment facts occur once. -/
+theorem lowerE_let_run_sound_core
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {uses : Uses} {value body : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    {Result : VEnv → Emit → AVal → LowSt → Prop}
+    (hslotAffine : ∀ {middle : VEnv} {valueEmit : Emit} {abs : Nat}
+        {valueState : LowSt} {bodyOutput : VEnv} {bodyEmit : Emit}
+        {resultValue : AVal} {bodyState : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+          .ok (middle, valueEmit, .slotA abs) valueState →
+      uses = .affine →
+      let heldInput := installAliasBinder middle abs 0 .affine true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+      (lowerE src fuel bodyInput world body).run valueState =
+          .ok (bodyOutput, bodyEmit, resultValue) bodyState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      FirstEntryTracks bodyInput .affine (countUses 0 body) →
+      heldInput.entries[0]? = some (.slot abs 0 .affine true) →
+      Result bodyOutput.pop
+        (valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘ bodyEmit)
+        resultValue bodyState)
+    (hslotMany : ∀ {middle : VEnv} {valueEmit : Emit} {abs : Nat}
+        {valueState : LowSt} {bodyOutput : VEnv} {bodyEmit : Emit}
+        {resultValue : AVal} {bodyState : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+          .ok (middle, valueEmit, .slotA abs) valueState →
+      uses = .many →
+      let heldInput := installAliasBinder middle abs 0 .many true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+      (lowerE src fuel bodyInput world body).run valueState =
+          .ok (bodyOutput, bodyEmit, resultValue) bodyState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      FirstEntryTracks bodyInput .many (countUses 0 body) →
+      heldInput.entries[0]? = some (.slot abs 0 .many true) →
+      Result bodyOutput.pop
+        (valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘ bodyEmit)
+        resultValue bodyState)
+    (hslotUsed : ∀ {middle : VEnv} {valueEmit : Emit} {abs : Nat}
+        {valueState : LowSt} {bodyOutput : VEnv} {bodyEmit : Emit}
+        {resultValue : AVal} {bodyState : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+          .ok (middle, valueEmit, .slotA abs) valueState →
+      let bodyInput := installAliasBinder middle abs (countUses 0 body)
+        uses true
+      (lowerE src fuel bodyInput world body).run valueState =
+          .ok (bodyOutput, bodyEmit, resultValue) bodyState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      FirstEntryTracks bodyInput uses (countUses 0 body) →
+      Result bodyOutput.pop (valueEmit ∘ bodyEmit) resultValue bodyState)
+    (hconstUnused : ∀ {middle : VEnv} {valueEmit : Emit}
+        {atom : Atom} {valueState : LowSt} {bodyOutput : VEnv}
+        {bodyEmit : Emit} {resultValue : AVal} {bodyState : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+          .ok (middle, valueEmit, .constA atom) valueState →
+      let bodyInput := installPushedBinder middle 0 uses false
+      (lowerE src fuel bodyInput world body).run valueState =
+          .ok (bodyOutput, bodyEmit, resultValue) bodyState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      FirstEntryTracks bodyInput uses (countUses 0 body) →
+      Result bodyOutput.pop
+        (valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit) resultValue bodyState)
+    (hconstUsed : ∀ {middle : VEnv} {valueEmit : Emit}
+        {atom : Atom} {valueState : LowSt} {bodyOutput : VEnv}
+        {bodyEmit : Emit} {resultValue : AVal} {bodyState : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+          .ok (middle, valueEmit, .constA atom) valueState →
+      let bodyInput := installPushedBinder middle (countUses 0 body)
+        uses true
+      (lowerE src fuel bodyInput world body).run valueState =
+          .ok (bodyOutput, bodyEmit, resultValue) bodyState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      FirstEntryTracks bodyInput uses (countUses 0 body) →
+      Result bodyOutput.pop
+        (valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit) resultValue bodyState)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    Result output emit av finalState := by
+  simp only [lowerE] at hrun
+  obtain ⟨valueResult, valueState, hvalueRun, hafterValue⟩ :=
+    estateBindRun_ok_inv hrun
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases uses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := estateBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (estateThrowRun_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := estateBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (estateThrowRun_not_ok hthrow).elim
+      | affine =>
+        let heldInput := installAliasBinder middle abs 0 .affine true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+          estateBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hafterBody
+        obtain ⟨hresult, hstate⟩ := hpure
+        cases hresult
+        subst finalState
+        have hno : NoRecSelf middle → NoRecSelf bodyInput := by
+          intro hmiddle
+          have hinstalled :=
+            (hmiddle.consSlot abs 0 .affine true).setSlot
+              0 abs 0 .affine false
+          simpa [bodyInput, heldInput, installAliasBinder] using
+            hinstalled.bump
+        have htracked : FirstEntryTracks bodyInput .affine
+            (countUses 0 body) := by
+          refine ⟨abs, middle.entries, ?_⟩
+          simp [bodyInput, heldInput, installAliasBinder, VEnv.setEntry,
+            VEnv.bump, hzero]
+        have hentry : heldInput.entries[0]? =
+            some (.slot abs 0 .affine true) := by
+          simp [heldInput, installAliasBinder]
+        exact hslotAffine hvalueRun rfl hbodyRun hno htracked hentry
+      | many =>
+        let heldInput := installAliasBinder middle abs 0 .many true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+          estateBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hafterBody
+        obtain ⟨hresult, hstate⟩ := hpure
+        cases hresult
+        subst finalState
+        have hno : NoRecSelf middle → NoRecSelf bodyInput := by
+          intro hmiddle
+          have hinstalled :=
+            (hmiddle.consSlot abs 0 .many true).setSlot
+              0 abs 0 .many false
+          simpa [bodyInput, heldInput, installAliasBinder] using
+            hinstalled.bump
+        have htracked : FirstEntryTracks bodyInput .many
+            (countUses 0 body) := by
+          refine ⟨abs, middle.entries, ?_⟩
+          simp [bodyInput, heldInput, installAliasBinder, VEnv.setEntry,
+            VEnv.bump, hzero]
+        have hentry : heldInput.entries[0]? =
+            some (.slot abs 0 .many true) := by
+          simp [heldInput, installAliasBinder]
+        exact hslotMany hvalueRun rfl hbodyRun hno htracked hentry
+    · let bodyInput := installAliasBinder middle abs
+          (countUses 0 body) uses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue)).run
+            valueState = .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installAliasBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        estateBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue) =
+              (output, emit, av) ∧ bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      have hno : NoRecSelf middle → NoRecSelf bodyInput := by
+        intro hmiddle
+        simpa [bodyInput, installAliasBinder] using
+          hmiddle.consSlot abs (countUses 0 body) uses true
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨abs, middle.entries, ?_⟩
+        simp [bodyInput, installAliasBinder, hzero]
+      exact hslotUsed hvalueRun hbodyRun hno htracked
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput := installPushedBinder middle 0 uses false
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        estateBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      have hno : NoRecSelf middle → NoRecSelf bodyInput := by
+        intro hmiddle
+        simpa [bodyInput, installPushedBinder, VEnv.bump] using
+          (hmiddle.consSlot middle.depth 0 uses false).bump
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨middle.depth, middle.entries, ?_⟩
+        simp [bodyInput, installPushedBinder, hzero]
+      exact hconstUnused hvalueRun hbodyRun hno htracked
+    · let bodyInput := installPushedBinder middle (countUses 0 body)
+          uses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+        estateBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hafterBody
+      obtain ⟨hresult, hstate⟩ := hpure
+      cases hresult
+      subst finalState
+      have hno : NoRecSelf middle → NoRecSelf bodyInput := by
+        intro hmiddle
+        simpa [bodyInput, installPushedBinder, VEnv.bump] using
+          (hmiddle.consSlot middle.depth (countUses 0 body) uses true).bump
+      have htracked : FirstEntryTracks bodyInput uses
+          (countUses 0 body) := by
+        refine ⟨middle.depth, middle.entries, ?_⟩
+        simp [bodyInput, installPushedBinder, hzero]
+      exact hconstUsed hvalueRun hbodyRun hno htracked
+
+/-- Every successful let run exposes the predecessor-fuel body run with the
+same result descriptor. Binder materialization and cleanup change only the
+environment and emitter components. -/
+theorem lowerE_let_body_run_inv
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {uses : Uses} {value body : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    ∃ bodyInput bodyOutput bodyEmit bodyState bodyFinal,
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, av) bodyFinal := by
+  exact lowerE_let_run_sound_core
+    (Result := fun _ _ resultValue _ =>
+      ∃ bodyInput bodyOutput bodyEmit bodyState bodyFinal,
+        (lowerE src fuel bodyInput world body).run bodyState =
+          .ok (bodyOutput, bodyEmit, resultValue) bodyFinal)
+    (hslotAffine := by
+      intro _ _ _ valueState bodyOutput bodyEmit _ bodyState _
+      intro _
+      dsimp only
+      intro hbodyRun _ _ _
+      exact ⟨_, bodyOutput, bodyEmit, valueState, bodyState, hbodyRun⟩)
+    (hslotMany := by
+      intro _ _ _ valueState bodyOutput bodyEmit _ bodyState _
+      intro _
+      dsimp only
+      intro hbodyRun _ _ _
+      exact ⟨_, bodyOutput, bodyEmit, valueState, bodyState, hbodyRun⟩)
+    (hslotUsed := by
+      intro _ _ _ valueState bodyOutput bodyEmit _ bodyState _
+      dsimp only
+      intro hbodyRun _ _
+      exact ⟨_, bodyOutput, bodyEmit, valueState, bodyState, hbodyRun⟩)
+    (hconstUnused := by
+      intro _ _ _ valueState bodyOutput bodyEmit _ bodyState _
+      dsimp only
+      intro hbodyRun _ _
+      exact ⟨_, bodyOutput, bodyEmit, valueState, bodyState, hbodyRun⟩)
+    (hconstUsed := by
+      intro _ _ _ valueState bodyOutput bodyEmit _ bodyState _
+      dsimp only
+      intro hbodyRun _ _
+      exact ⟨_, bodyOutput, bodyEmit, valueState, bodyState, hbodyRun⟩)
+    hrun
+
+/-- Every successful let installation is bounded-sound once the companion
+compile-state induction proves that the body consumes its counted first
+entry. Slot values alias their existing owner; dead shared/affine aliases are
+released before the body; stable constants are materialized in the physical
+slot the executable lowerer installs. -/
+theorem lowerE_let_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  exact (lowerE_let_run_sound_core
+    (Result := fun branchOutput branchEmit branchValue branchState =>
+      ExtraRepresented ctx branchState →
+      LowerResultSoundBelow ctx cur limit input branchOutput world
+        branchEmit branchValue)
+    (hslotAffine := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun _ htracked hentry hrepresented
+      let heldInput := installAliasBinder middle abs 0 .affine true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+      have hmiddleAvailable := havailable.lowerE hvalueRun
+      have hbodyAvailable : SelfAvailableBelow ctx cur limit bodyInput := by
+        have hinstalled :=
+          (hmiddleAvailable.consSlot abs 0 .affine true).setSlot
+            0 abs 0 .affine false
+        simpa [bodyInput, heldInput, installAliasBinder] using
+          hinstalled.bump
+      have hbodySound := hexpr hbodyRun hrepresented hbodyAvailable
+      have hvalueSound := hexpr hvalueRun
+        (hrepresented.of_extends (lowerE_extraExtends hbodyRun))
+        havailable
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : ∀ rest slots,
+          EmitSoundBelow ctx cur limit
+            (emitOp (.dropU (.var (middle.rel abs))))
+            (OwnsResultProtected middle .unique (.slotA abs) rest slots)
+            (OwnsVEnvProtected bodyInput rest slots) := by
+        intro rest slots
+        have halias := installAliasBinder_held_below
+          (ctx := ctx) (cur := cur) (limit := limit)
+          (Γ := middle) (abs := abs) (remaining := 0)
+          (uses := .affine) rest slots
+        have hdrop := release_slot_affine_owned_below
+          (ctx := ctx) (cur := cur) (limit := limit)
+          (Γ := heldInput) (i := 0) (abs := abs) hentry rest slots
+        have hcomposed := EmitSoundBelow.comp halias hdrop
+        simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+          worldOfUses, Function.comp_def] using hcomposed
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotMany := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun _ htracked hentry hrepresented
+      let heldInput := installAliasBinder middle abs 0 .many true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+      have hmiddleAvailable := havailable.lowerE hvalueRun
+      have hbodyAvailable : SelfAvailableBelow ctx cur limit bodyInput := by
+        have hinstalled :=
+          (hmiddleAvailable.consSlot abs 0 .many true).setSlot
+            0 abs 0 .many false
+        simpa [bodyInput, heldInput, installAliasBinder] using
+          hinstalled.bump
+      have hbodySound := hexpr hbodyRun hrepresented hbodyAvailable
+      have hvalueSound := hexpr hvalueRun
+        (hrepresented.of_extends (lowerE_extraExtends hbodyRun))
+        havailable
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : ∀ rest slots,
+          EmitSoundBelow ctx cur limit
+            (emitOp (.drop (.var (middle.rel abs))))
+            (OwnsResultProtected middle .shared (.slotA abs) rest slots)
+            (OwnsVEnvProtected bodyInput rest slots) := by
+        intro rest slots
+        have halias := installAliasBinder_held_below
+          (ctx := ctx) (cur := cur) (limit := limit)
+          (Γ := middle) (abs := abs) (remaining := 0)
+          (uses := .many) rest slots
+        have hdrop := release_slot_many_owned_below
+          (ctx := ctx) (cur := cur) (limit := limit)
+          (Γ := heldInput) (i := 0) (abs := abs) hentry rest slots
+        have hcomposed := EmitSoundBelow.comp halias hdrop
+        simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+          worldOfUses, Function.comp_def] using hcomposed
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotUsed := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun _ htracked hrepresented
+      let bodyInput := installAliasBinder middle abs
+        (countUses 0 body) uses true
+      have hmiddleAvailable := havailable.lowerE hvalueRun
+      have hbodyAvailable : SelfAvailableBelow ctx cur limit bodyInput := by
+        simpa [bodyInput, installAliasBinder] using
+          hmiddleAvailable.consSlot abs (countUses 0 body) uses true
+      have hbodySound := hexpr hbodyRun hrepresented hbodyAvailable
+      have hvalueSound := hexpr hvalueRun
+        (hrepresented.of_extends (lowerE_extraExtends hbodyRun))
+        havailable
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_held_below
+        (ctx := ctx) (cur := cur) (limit := limit)
+        (Γ := middle) (abs := abs) (remaining := countUses 0 body)
+        (uses := uses)
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [Function.comp_def] using hsound)
+    (hconstUnused := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun _ htracked hrepresented
+      let bodyInput := installPushedBinder middle 0 uses false
+      have hmiddleAvailable := havailable.lowerE hvalueRun
+      have hbodyAvailable : SelfAvailableBelow ctx cur limit bodyInput := by
+        simpa [bodyInput, installPushedBinder, VEnv.bump] using
+          (hmiddleAvailable.consSlot middle.depth 0 uses false).bump
+      have hbodySound := hexpr hbodyRun hrepresented hbodyAvailable
+      have hvalueSound := hexpr hvalueRun
+        (hrepresented.of_extends (lowerE_extraExtends hbodyRun))
+        havailable
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_below
+        (ctx := ctx) (cur := cur) (limit := limit)
+        (Γ := middle) (atom := atom) (remaining := 0)
+        (uses := uses) (held := false) hvalueSound.stable
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hconstUsed := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun _ htracked hrepresented
+      let bodyInput := installPushedBinder middle (countUses 0 body)
+        uses true
+      have hmiddleAvailable := havailable.lowerE hvalueRun
+      have hbodyAvailable : SelfAvailableBelow ctx cur limit bodyInput := by
+        simpa [bodyInput, installPushedBinder, VEnv.bump] using
+          (hmiddleAvailable.consSlot middle.depth (countUses 0 body) uses
+            true).bump
+      have hbodySound := hexpr hbodyRun hrepresented hbodyAvailable
+      have hvalueSound := hexpr hvalueRun
+        (hrepresented.of_extends (lowerE_extraExtends hbodyRun))
+        havailable
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_below
+        (ctx := ctx) (cur := cur) (limit := limit)
+        (Γ := middle) (atom := atom) (remaining := countUses 0 body)
+        (uses := uses) (held := true) hvalueSound.stable
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    hrun) hrepresented
+/-- Semantic let branch of `lowerE`. The bound expression's source value is
+installed as the body's leading environment entry — as an alias for a
+slot-backed result, materialized for a scalar, and immediately released when
+the body never mentions it — and the body's source result is returned after
+the logical pop. -/
+theorem lowerE_let_run_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    (hrecursive : ∀ {middle bodyInput bodyOutput : VEnv}
+      {valueEmit bodyEmit : Emit} {boundValue resultValue : AVal}
+      {valueState bodyState bodyFinal : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+        .ok (middle, valueEmit, boundValue) valueState →
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, resultValue) bodyFinal →
+      bodyState = valueState →
+      ExtraExtends bodyFinal finalState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      LowerResultValueSound funRel recSelfRel ctx cur input middle
+          sourceEnv sourceEnv boundSource (worldOfUses uses)
+          valueEmit boundValue ∧
+        LowerResultValueSound funRel recSelfRel ctx cur bodyInput bodyOutput
+          (boundSource :: sourceEnv) (boundSource :: sourceEnv)
+          sourceValue world bodyEmit resultValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact (lowerE_let_run_sound_core
+    (Result := fun branchOutput branchEmit branchValue branchState =>
+      ExtraExtends branchState finalState →
+      LowerResultValueSound funRel recSelfRel ctx cur input branchOutput
+        sourceEnv sourceEnv sourceValue world branchEmit branchValue)
+    (hslotAffine := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked hentry hwithin
+      let heldInput := installAliasBinder middle abs 0 .affine true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderValueSound funRel recSelfRel ctx cur
+          middle bodyInput sourceEnv boundSource .unique (.slotA abs)
+          (emitOp (.dropU (.var (middle.rel abs)))) := by
+        refine { toInstallBinderSound := ?_, graphEmits := ?_ }
+        · intro rest slots
+          have halias := installAliasBinder_held
+            (ctx := ctx) (cur := cur) (Γ := middle) (abs := abs)
+            (remaining := 0) (uses := .affine) rest slots
+          have hdrop := release_slot_affine_owned
+            (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+            (abs := abs) hentry rest slots
+          have hcomposed := EmitSound.comp halias hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+        · intro sourceRest rest slots
+          have halias := installAliasBinder_held_value_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs) (remaining := 0) (uses := .affine)
+          have hdrop := release_slot_affine_value_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+            (abs := abs) hentry
+            (boundSource :: sourceEnv) sourceRest rest slots
+          have hcomposed := EmitSound.comp
+            (halias.graphEmits sourceRest rest slots) hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotMany := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked hentry hwithin
+      let heldInput := installAliasBinder middle abs 0 .many true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderValueSound funRel recSelfRel ctx cur
+          middle bodyInput sourceEnv boundSource .shared (.slotA abs)
+          (emitOp (.drop (.var (middle.rel abs)))) := by
+        refine { toInstallBinderSound := ?_, graphEmits := ?_ }
+        · intro rest slots
+          have halias := installAliasBinder_held
+            (ctx := ctx) (cur := cur) (Γ := middle) (abs := abs)
+            (remaining := 0) (uses := .many) rest slots
+          have hdrop := release_slot_many_owned
+            (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+            (abs := abs) hentry rest slots
+          have hcomposed := EmitSound.comp halias hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+        · intro sourceRest rest slots
+          have halias := installAliasBinder_held_value_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs) (remaining := 0) (uses := .many)
+          have hdrop := release_slot_many_value_sound
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (Γ := heldInput) (i := 0)
+            (abs := abs) hentry
+            (boundSource :: sourceEnv) sourceRest rest slots
+          have hcomposed := EmitSound.comp
+            (halias.graphEmits sourceRest rest slots) hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotUsed := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_held_value_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := countUses 0 body) (uses := uses)
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [Function.comp_def] using hsound)
+    (hconstUnused := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := 0)
+        (uses := uses) (held := false) hvalueSound.stable
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hconstUsed := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_sound
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := countUses 0 body)
+        (uses := uses) (held := true) hvalueSound.stable
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    hrun) (ExtraExtends.refl _)
+/-- Fuel-bounded semantic let lowering. All binder emitters and both
+recursive expression results remain at the same target evaluator limit. -/
+theorem lowerE_let_run_value_sound_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {boundSource sourceValue : IxIR0.Value}
+    (hrecursive : ∀ {middle bodyInput bodyOutput : VEnv}
+      {valueEmit bodyEmit : Emit} {boundValue resultValue : AVal}
+      {valueState bodyState bodyFinal : LowSt},
+      (lowerE src fuel input (worldOfUses uses) value).run state =
+        .ok (middle, valueEmit, boundValue) valueState →
+      (lowerE src fuel bodyInput world body).run bodyState =
+        .ok (bodyOutput, bodyEmit, resultValue) bodyFinal →
+      bodyState = valueState →
+      ExtraExtends bodyFinal finalState →
+      (NoRecSelf middle → NoRecSelf bodyInput) →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input middle
+          sourceEnv sourceEnv boundSource (worldOfUses uses)
+          valueEmit boundValue ∧
+        LowerResultValueSoundBelow funRel recSelfRel ctx cur limit bodyInput bodyOutput
+          (boundSource :: sourceEnv) (boundSource :: sourceEnv)
+          sourceValue world bodyEmit resultValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact (lowerE_let_run_sound_core
+    (Result := fun branchOutput branchEmit branchValue branchState =>
+      ExtraExtends branchState finalState →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        branchOutput sourceEnv sourceEnv sourceValue world branchEmit
+        branchValue)
+    (hslotAffine := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked hentry hwithin
+      let heldInput := installAliasBinder middle abs 0 .affine true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .affine false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderValueSoundBelow funRel recSelfRel ctx cur
+          limit middle bodyInput sourceEnv boundSource .unique (.slotA abs)
+          (emitOp (.dropU (.var (middle.rel abs)))) := by
+        refine { toInstallBinderSoundBelow := ?_, graphEmits := ?_ }
+        · intro rest slots
+          have halias := installAliasBinder_held_below
+            (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+            (abs := abs) (remaining := 0) (uses := .affine) rest slots
+          have hdrop := release_slot_affine_owned_below
+            (ctx := ctx) (cur := cur) (limit := limit)
+            (Γ := heldInput) (i := 0) (abs := abs) hentry rest slots
+          have hcomposed := EmitSoundBelow.comp halias hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+        · intro sourceRest rest slots
+          have halias := installAliasBinder_held_value_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs) (remaining := 0) (uses := .affine)
+          have hdrop := release_slot_affine_value_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit)
+            (Γ := heldInput) (i := 0) (abs := abs) hentry
+            (boundSource :: sourceEnv) sourceRest rest slots
+          have hcomposed := EmitSoundBelow.comp
+            (halias.graphEmits sourceRest rest slots) hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotMany := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      intro huses
+      subst uses
+      dsimp only
+      intro hbodyRun hno htracked hentry hwithin
+      let heldInput := installAliasBinder middle abs 0 .many true
+      let bodyInput :=
+        (heldInput.setEntry 0 (.slot abs 0 .many false)).bump
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall : InstallBinderValueSoundBelow funRel recSelfRel ctx cur
+          limit middle bodyInput sourceEnv boundSource .shared (.slotA abs)
+          (emitOp (.drop (.var (middle.rel abs)))) := by
+        refine { toInstallBinderSoundBelow := ?_, graphEmits := ?_ }
+        · intro rest slots
+          have halias := installAliasBinder_held_below
+            (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+            (abs := abs) (remaining := 0) (uses := .many) rest slots
+          have hdrop := release_slot_many_owned_below
+            (ctx := ctx) (cur := cur) (limit := limit)
+            (Γ := heldInput) (i := 0) (abs := abs) hentry rest slots
+          have hcomposed := EmitSoundBelow.comp halias hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+        · intro sourceRest rest slots
+          have halias := installAliasBinder_held_value_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+            (sourceEnv := sourceEnv) (boundSource := boundSource)
+            (abs := abs) (remaining := 0) (uses := .many)
+          have hdrop := release_slot_many_value_sound_below
+            (funRel := funRel) (recSelfRel := recSelfRel)
+            (ctx := ctx) (cur := cur) (limit := limit)
+            (Γ := heldInput) (i := 0) (abs := abs) hentry
+            (boundSource :: sourceEnv) sourceRest rest slots
+          have hcomposed := EmitSoundBelow.comp
+            (halias.graphEmits sourceRest rest slots) hdrop
+          simpa [bodyInput, heldInput, installAliasBinder, VEnv.rel,
+            worldOfUses, Function.comp_def] using hcomposed
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hslotUsed := by
+      intro middle valueEmit abs valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := installAliasBinder_held_value_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (abs := abs) (remaining := countUses 0 body) (uses := uses)
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [Function.comp_def] using hsound)
+    (hconstUnused := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := 0)
+        (uses := uses) (held := false) hvalueSound.stable
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    (hconstUsed := by
+      intro middle valueEmit atom valueState bodyOutput bodyEmit resultValue
+        bodyState hvalueRun
+      dsimp only
+      intro hbodyRun hno htracked hwithin
+      obtain ⟨hvalueSound, hbodySound⟩ :=
+        hrecursive hvalueRun hbodyRun rfl hwithin hno
+      have hreleased := hreleases htracked hbodyRun
+      have hinstall := materializeConstBinder_value_sound_below
+        (funRel := funRel) (recSelfRel := recSelfRel)
+        (ctx := ctx) (cur := cur) (limit := limit) (Γ := middle)
+        (sourceEnv := sourceEnv) (boundSource := boundSource)
+        (atom := atom) (remaining := countUses 0 body)
+        (uses := uses) (held := true) hvalueSound.stable
+      have hsound := hvalueSound.installThen hinstall hbodySound hreleased
+      simpa [worldOfUses, Function.comp_def] using hsound)
+    hrun) (ExtraExtends.refl _)
+/-- Shared source/run dispatcher for complete expression semantics. The
+result family and constructor callbacks keep ordinary, reachable, bounded,
+and reflection clients logically separate while source inversion and the
+application-to-spine conversion remain canonical. -/
+private theorem lowerE_run_value_sound_core
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    {state finalState : LowSt} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    {Result : IxIR0.Value → Prop}
+    (hvar : ∀ (index : Nat) {result : IxIR0.Value},
+      sourceEnv[index]? = some result →
+      (lowerE src (fuel + 1) input world (.var index)).run state =
+        .ok (output, emit, av) finalState →
+      Result result)
+    (href : ∀ (address : Ixon.Address) {result : IxIR0.Value},
+      IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref address) = .ok result →
+      (lowerE src (fuel + 1) input world (.ref address)).run state =
+        .ok (output, emit, av) finalState →
+      Result result)
+    (happ : ∀ (function argument : IxIR0.Expr)
+        {result : IxIR0.Value},
+      SourceSpineEval sourceCtx sourceEnv function [argument] result →
+      (lowerSpine src fuel input world function [argument]).run state =
+        .ok (output, emit, av) finalState →
+      Result result)
+    (hlam : ∀ (uses : Uses) (body : IxIR0.Expr),
+      (lowerE src (fuel + 1) input world (.lam uses body)).run state =
+        .ok (output, emit, av) finalState →
+      Result (.clos uses sourceEnv body))
+    (hlet : ∀ (uses : Uses) (value body : IxIR0.Expr)
+        {sourceStep : Nat} {bound result : IxIR0.Value},
+      IxIR0.eval sourceCtx sourceStep sourceEnv value = .ok bound →
+      IxIR0.eval sourceCtx sourceStep (bound :: sourceEnv) body =
+        .ok result →
+      (lowerE src (fuel + 1) input world (.letE uses value body)).run
+        state = .ok (output, emit, av) finalState →
+      Result result)
+    (hproj : ∀ (index : Nat) (source : IxIR0.Expr)
+        {sourceStep : Nat} {target result : IxIR0.Value},
+      IxIR0.eval sourceCtx sourceStep sourceEnv source = .ok target →
+      SourceProject index target result →
+      (lowerE src (fuel + 1) input world (.proj index source)).run state =
+        .ok (output, emit, av) finalState →
+      Result result)
+    (hlit : ∀ (literal : IxIR0.Literal),
+      (lowerE src (fuel + 1) input world (.lit literal)).run state =
+        .ok (output, emit, av) finalState →
+      Result (.lit literal))
+    (herased :
+      (lowerE src (fuel + 1) input world .erased).run state =
+        .ok (output, emit, av) finalState →
+      Result .erased)
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    Result sourceValue := by
+  cases expr with
+  | var index =>
+    exact hvar index (sourceEval_var_inv hsource) hrun
+  | ref address =>
+    exact href address hsource hrun
+  | app function argument =>
+    apply happ function argument (SourceSpineEval.of_eval_app hsource)
+    simpa [lowerE] using hrun
+  | lam uses body =>
+    have hvalue := sourceEval_lam_inv hsource
+    subst sourceValue
+    exact hlam uses body hrun
+  | letE uses value body =>
+    obtain ⟨sourceStep, boundSource, hvalueSource, hbodySource⟩ :=
+      sourceEval_let_inv hsource
+    exact hlet uses value body hvalueSource hbodySource hrun
+  | proj index source =>
+    obtain ⟨sourceStep, sourceTarget, htarget, hproject⟩ :=
+      sourceEval_proj_inv hsource
+    exact hproj index source htarget hproject hrun
+  | lit literal =>
+    have hvalue := sourceEval_lit_inv hsource
+    subst sourceValue
+    exact hlit literal hrun
+  | erased =>
+    have hvalue := sourceEval_erased_inv hsource
+    subst sourceValue
+    exact herased hrun
+
+/-- One complete semantic expression step. Source evaluator inversion supplies
+the exact recursive values for let and projection; application and reference
+delegate to their completed spine routes; lambda provenance is included in
+the canonical whole-pass function relation. -/
+theorem lowerE_run_value_sound
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {relationState : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hspine : LowerSpineValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hborrow : LowerBorrowValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src fuel)
+    (hargsNext : LowerArgsValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hrestNext : ApplyRestNonErasedValuePreserves
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      sourceCtx ctx cur src (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src relationState) sourceCtx src ctx)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState relationState)
+    (hrepresented : ExtraRepresented ctx relationState) :
+    LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src relationState) recSelfRel
+      ctx cur input output sourceEnv sourceEnv sourceValue world emit av := by
+  exact lowerE_run_value_sound_core
+    (Result := fun result =>
+      LowerResultValueSound
+        (CompilerFunctionRel sourceCtx src relationState) recSelfRel ctx cur
+        input output sourceEnv sourceEnv result world emit av)
+    (hvar := fun _ _ hlookup hbranchRun =>
+      lowerE_var_run_value_sound hlookup hbranchRun)
+    (href := fun _ _ hbranchSource hbranchRun =>
+      lowerE_ref_run_value_sound henv hargsNext hrestNext hknownExtra
+        hcontracts hvalues hbranchSource hbranchRun hextends hrepresented)
+    (happ := fun _ _ _ hsourceSpine hspineRun =>
+      hspine hsourceSpine hspineRun)
+    (hlam := fun _ _ hbranchRun =>
+      lowerE_lam_run_value_sound_any
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := fun _ _ body _ _ _ hvalueSource hbodySource hbranchRun =>
+      lowerE_let_run_value_sound
+        (fun hvalueRun hbodyRun _ _ _ =>
+          ⟨hexpr hvalueSource hvalueRun, hexpr hbodySource hbodyRun⟩)
+        (hreleases body) hbranchRun)
+    (hproj := fun _ _ _ _ _ htarget hproject hbranchRun =>
+      lowerE_proj_run_value_sound
+        (fun hborrowRun => hborrow htarget hborrowRun) hproject hbranchRun)
+    (hlit := fun _ hbranchRun => lowerE_lit_run_value_sound hbranchRun)
+    (herased := fun hbranchRun =>
+      lowerE_erased_run_value_sound hbranchRun)
+    hsource hrun
+
+/-- One complete expression-reflection step. Let cleanup preserves the body
+descriptor, projection exposes its erased borrow, and all allocating or
+scalar constructors are ruled out by executable result shape. -/
+theorem lowerEReflectsErased_succ
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEReflectsErased sourceCtx src fuel)
+    (hborrow : LowerBorrowReflectsErased sourceCtx src fuel)
+    (hspine : LowerSpineReflectsErased sourceCtx src fuel) :
+    LowerEReflectsErased sourceCtx src (fuel + 1) := by
+  intro input output world expr sourceEnv sourceFuel sourceValue state
+    finalState emit av hsource hrun herased
+  exact lowerE_run_value_sound_core
+    (Result := fun result => result = .erased)
+    (hvar := fun _ _ _ hbranchRun => by
+      subst av
+      exact (lowerE_var_run_ne_constErased hbranchRun).elim)
+    (href := fun _ _ _ hbranchRun => by
+      subst av
+      exact (lowerSpine_ref_run_ne_constErased
+        (lowerE_ref_run_to_lowerSpine_nil hbranchRun)).elim)
+    (happ := fun _ _ _ hsourceSpine hspineRun =>
+      hspine hsourceSpine hspineRun herased)
+    (hlam := fun _ _ hbranchRun => by
+      subst av
+      exact (lowerE_lam_run_ne_constErased hbranchRun).elim)
+    (hlet := fun _ _ _ _ _ _ _ hbodySource hbranchRun => by
+      obtain ⟨bodyInput, bodyOutput, bodyEmit, bodyState, bodyFinal,
+          hbodyRun⟩ := lowerE_let_body_run_inv hbranchRun
+      exact hexpr hbodySource hbodyRun herased)
+    (hproj := fun _ _ _ sourceTarget _ htarget hproject hbranchRun => by
+      subst av
+      obtain ⟨borrowOutput, borrowEmit, release, middleState,
+          hborrowRun⟩ := lowerE_proj_run_constErased_inv hbranchRun
+      have htargetErased : sourceTarget = .erased :=
+        hborrow htarget hborrowRun rfl
+      cases hproject with
+      | ctor hfield => contradiction
+      | erased => rfl)
+    (hlit := fun _ hbranchRun => by
+      subst av
+      simp [lowerE] at hbranchRun)
+    (herased := fun _ => rfl)
+    hsource hrun
+
+/-- Closed pure reflection cluster for the three mutually recursive actions
+whose result descriptor can expose erased absorption. -/
+structure LowerReflectsErased (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env)
+    (fuel : Nat) : Prop where
+  expr : LowerEReflectsErased sourceCtx src fuel
+  borrow : LowerBorrowReflectsErased sourceCtx src fuel
+  spine : LowerSpineReflectsErased sourceCtx src fuel
+
+theorem lowerReflectsErased (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) :
+    ∀ fuel, LowerReflectsErased sourceCtx src fuel
+  | 0 =>
+      { expr := lowerEReflectsErased_zero sourceCtx src
+        borrow := lowerBorrowReflectsErased_zero sourceCtx src
+        spine := lowerSpineReflectsErased_zero sourceCtx src }
+  | fuel + 1 => by
+      have hprev := lowerReflectsErased sourceCtx src fuel
+      exact
+        { expr := lowerEReflectsErased_succ
+            hprev.expr hprev.borrow hprev.spine
+          borrow := lowerBorrowReflectsErased_succ hprev.expr
+          spine := lowerSpineReflectsErased_succ hprev.spine hprev.expr }
+
+theorem lowerE_reflectsErased (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) (fuel : Nat) :
+    LowerEReflectsErased sourceCtx src fuel :=
+  (lowerReflectsErased sourceCtx src fuel).expr
+
+theorem lowerBorrow_reflectsErased (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) (fuel : Nat) :
+    LowerBorrowReflectsErased sourceCtx src fuel :=
+  (lowerReflectsErased sourceCtx src fuel).borrow
+
+theorem lowerSpine_reflectsErased (sourceCtx : IxIR0.Ctx)
+    (src : IxIR0.Env) (fuel : Nat) :
+    LowerSpineReflectsErased sourceCtx src fuel :=
+  (lowerReflectsErased sourceCtx src fuel).spine
+
+/-! ### Reachable-state semantic induction steps -/
+
+/-- Reachable-state argument sequencing. The tail run transports the head
+subrun's final state into the ambient compiler result. -/
+theorem lowerArgsValuePreservesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel)
+    (htail : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel) :
+    LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun hextends havailable
+  exact (lowerArgs_run_value_sound_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals actualState =>
+      ExtraExtends actualState ambient →
+      SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerArgsValueSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv actualSourceValues worlds actualEmit actualAVals)
+    (hnil := fun _ _ => lowerArgs_nil_value_sound)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead hsourceTail
+        hheadRun htailRun hwithin hself
+      have hmiddleExtends : ExtraExtends _ ambient :=
+        (lowerArgs_extraExtends htailRun).trans hwithin
+      have hheadSound :=
+        hexpr hsourceHead hheadRun hmiddleExtends hself
+      have htailSound := htail hsourceTail htailRun hwithin
+        (hself.lowerE hheadRun)
+      exact hheadSound.consArgs htailSound)
+    hsource hrun) hextends havailable
+
+/-- Fuel-bounded reachable-state argument sequencing. -/
+theorem lowerArgsValuePreservesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (htail : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel) :
+    LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient (fuel + 1) := by
+  intro input output sourceEnv sourceValues args state finalState emit avs
+    hsource hrun hextends havailable
+  exact (lowerArgs_run_value_sound_core
+    (Result := fun actualOutput actualSourceValues worlds actualEmit
+        actualAVals actualState =>
+      ExtraExtends actualState ambient →
+      SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+        input →
+      LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv actualSourceValues worlds actualEmit
+        actualAVals)
+    (hnil := fun _ _ => lowerArgs_nil_value_sound_below)
+    (hcons := by
+      intro _ _ _ _ _ _ _ _ _ _ _ _ _ _ hsourceHead hsourceTail
+        hheadRun htailRun hwithin hself
+      have hmiddleExtends : ExtraExtends _ ambient :=
+        (lowerArgs_extraExtends htailRun).trans hwithin
+      have hheadSound :=
+        hexpr hsourceHead hheadRun hmiddleExtends hself
+      have htailSound := htail hsourceTail htailRun hwithin
+        (hself.lowerE hheadRun)
+      exact hheadSound.consArgs htailSound)
+    hsource hrun) hextends havailable
+
+/-- Reachable-state non-erased higher-order application. Its sole recursive
+subrun is the argument traversal ending in the same compiler state. -/
+theorem applyRestNonErasedValuePreservesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hownership : ApplyOwnershipContract ctx)
+    (hvalue : ApplyValueContract funRel sourceCtx ctx) :
+    ApplyRestNonErasedValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+    hextends havailable
+  exact (applyRest_nonErased_run_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerResultValueSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle sourceResult actualWorld actualEmit actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hargsRun
+        hworldsHomogeneous hwithin hself => by
+      have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+          sourceArgs := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsValueSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hsource)
+    hfunctionNe hrun) hextends havailable
+
+/-- Fuel-bounded reachable-state non-erased higher-order application. -/
+theorem applyRestNonErasedValuePreservesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hownership : ApplyOwnershipContractBelow ctx limit)
+    (hvalue : ApplyValueContractBelow funRel sourceCtx ctx limit) :
+    ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient (fuel + 1) := by
+  intro start input output sourceStart sourceMiddle sourceArgs
+    sourceFunction sourceResult resultWorld emitFunction emit function av
+    args state finalState hfunctionNe hsourceArgs hsource hfunction hrun
+    hextends havailable
+  exact (applyRest_nonErased_run_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+        input →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle sourceResult actualWorld
+        actualEmit actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hargsRun
+        hworldsHomogeneous hwithin hself => by
+      have hsourcePaired : SourceArgsEval sourceCtx sourceMiddle
+          ((args.map (fun arg => (arg, Owned.shared))).map Prod.fst)
+          sourceArgs := by
+        simpa [Function.comp_def] using hsourceArgs
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsValueSoundBelow funRel recSelfRel ctx cur
+          limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.applyArgs_graph hhomogeneous hownership hvalue hsource)
+    hfunctionNe hrun) hextends havailable
+
+/-- Reachable-state erased application, used by erased and dynamically
+erased spine heads. -/
+theorem applyRest_erased_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueSound funRel recSelfRel ctx cur
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  exact (applyRest_erased_run_value_sound_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfValueAvailable funRel recSelfRel sourceCtx ctx cur input →
+      LowerResultValueSound funRel recSelfRel ctx cur start actualOutput
+        sourceStart sourceMiddle .erased actualWorld actualEmit actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength hwithin hself => by
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsValueSound funRel recSelfRel ctx cur
+          input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs hhomogeneous hsourceLength)
+    hsourceArgs hrun) hextends havailable
+
+/-- Fuel-bounded reachable-state erased application. -/
+theorem applyRest_erased_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    {start input output : VEnv}
+    {sourceStart sourceMiddle sourceArgs : List IxIR0.Value}
+    {resultWorld : Owned} {emitFunction emit : Emit}
+    {args : List IxIR0.Expr} {av : AVal}
+    {state finalState : LowSt}
+    (hsourceArgs : SourceArgsEval sourceCtx sourceMiddle args sourceArgs)
+    (hfunction : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      start input sourceStart sourceMiddle .erased .shared emitFunction
+      (.constA .erased))
+    (hrun : (applyRest src (fuel + 1) input resultWorld emitFunction
+      (.constA .erased) args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start output
+      sourceStart sourceMiddle .erased resultWorld emit av := by
+  exact (applyRest_erased_run_value_sound_core
+    (Result := fun actualWorld actualOutput actualEmit actualAv actualState =>
+      ExtraExtends actualState ambient →
+      SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+        input →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit start
+        actualOutput sourceStart sourceMiddle .erased actualWorld actualEmit
+        actualAv)
+    (hfinish := fun argsOutput emitArgs avs _ hsourcePaired hargsRun
+        hworldsHomogeneous hsourceLength hwithin hself => by
+      have hargsSound := hargs hsourcePaired hargsRun hwithin hself
+      have hhomogeneous : LowerArgsValueSoundBelow funRel recSelfRel ctx cur
+          limit input argsOutput sourceMiddle sourceMiddle sourceArgs
+          (List.replicate avs.length .shared) emitArgs avs := by
+        simpa [hworldsHomogeneous] using hargsSound
+      simpa [Function.comp_def] using
+        hfunction.discardArgs hhomogeneous hsourceLength)
+    hsourceArgs hrun) hextends havailable
+
+/-- Reachable-state dynamic borrow adapter. Its post-processing is pure, so
+the expression subrun ends in the same state as the enclosing borrow run. -/
+theorem lowerBorrow_dynamic_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExtraExtends exprState ambient →
+      LowerResultValueSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    LowerBorrowValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue emit av release := by
+  exact (lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv exprState =>
+      ExtraExtends exprState ambient →
+      LowerResultValueSound funRel recSelfRel ctx cur input exprOutput
+        sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease
+        borrowState =>
+      ExtraExtends borrowState ambient →
+      LowerBorrowValueSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceValue borrowEmit borrowAv borrowRelease)
+    (hexpr := fun hsubrun hwithin => hexpr hsubrun hwithin)
+    (hslot := fun hsound hwithin =>
+      (hsound hwithin).asBorrowSlot)
+    (hconst := fun hsound hwithin =>
+      (hsound hwithin).asBorrowConst)
+    hshape hrun) hextends
+
+/-- Fuel-bounded reachable-state dynamic borrow adapter. -/
+theorem lowerBorrow_dynamic_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {release : Bool}
+    {state finalState : LowSt}
+    {sourceEnv : List IxIR0.Value} {sourceValue : IxIR0.Value}
+    (hexpr : ∀ {exprOutput : VEnv} {exprEmit : Emit} {exprAv : AVal}
+        {exprState : LowSt},
+      (lowerE src fuel input .shared expr).run state =
+          .ok (exprOutput, exprEmit, exprAv) exprState →
+      ExtraExtends exprState ambient →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        exprOutput sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue emit av release := by
+  exact (lowerBorrow_dynamic_run_core
+    (ExprResult := fun exprOutput exprEmit exprAv exprState =>
+      ExtraExtends exprState ambient →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        exprOutput sourceEnv sourceEnv sourceValue .shared exprEmit exprAv)
+    (BorrowResult := fun borrowOutput borrowEmit borrowAv borrowRelease
+        borrowState =>
+      ExtraExtends borrowState ambient →
+      LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit input
+        borrowOutput sourceEnv sourceEnv sourceValue borrowEmit borrowAv
+        borrowRelease)
+    (hexpr := fun hsubrun hwithin => hexpr hsubrun hwithin)
+    (hslot := fun hsound hwithin =>
+      (hsound hwithin).asBorrowSlot)
+    (hconst := fun hsound hwithin =>
+      (hsound hwithin).asBorrowConst)
+    hshape hrun) hextends
+
+/-- Reachable-state borrow induction step. Non-variable borrowing delegates
+to an expression subrun with the same final compiler state. -/
+theorem lowerBorrowValuePreservesWithin_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel) :
+    LowerBorrowValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+    exact lowerBorrow_var_run_value_sound (sourceEval_var_inv hsource) hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.ref address) hrun hextends
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.app function argument) hrun hextends
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.lam uses body) hrun hextends
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.letE uses value body) hrun hextends
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.proj index source) hrun hextends
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.lit literal) hrun hextends
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_sound_within
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      .erased hrun hextends
+
+/-- Fuel-bounded reachable-state borrow induction step. -/
+theorem lowerBorrowValuePreservesWithinBelow_succ
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel) :
+    LowerBorrowValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1) := by
+  intro input output expr sourceEnv sourceFuel sourceValue state finalState
+    emit av release hsource hrun hextends havailable
+  cases expr with
+  | var index =>
+    exact lowerBorrow_var_run_value_sound_below
+      (sourceEval_var_inv hsource) hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.ref address) hrun hextends
+  | app function argument =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.app function argument) hrun hextends
+  | lam uses body =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.lam uses body) hrun hextends
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.letE uses value body) hrun hextends
+  | proj index source =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.proj index source) hrun hextends
+  | lit literal =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      (.lit literal) hrun hextends
+  | erased =>
+    exact lowerBorrow_dynamic_run_value_sound_within_below
+      (fun hsubrun hwithin => hexpr hsource hsubrun hwithin havailable)
+      .erased hrun hextends
+
+/-- Reachable-state semantic `knownCall`. In the excess-tail case,
+`applyRest` monotonicity proves that the evaluated prefix also lies inside
+the ambient state; the tail itself uses the enclosing suffix witness. -/
+theorem knownCall_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {build : Array Atom → Op} {argWorlds : List Owned}
+    {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueSound funRel recSelfRel ctx cur input prefixOutput
+        sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueSound funRel recSelfRel ctx cur input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  exact knownCall_run_value_sound_core
+    (Reach := fun actualState => ExtraExtends actualState ambient)
+    (PrefixSound := fun prefixOutput emitPrefix prefixAVals =>
+      LowerArgsValueSound funRel recSelfRel ctx cur input prefixOutput
+          sourceEnv sourceEnv (sourceValues.take count)
+          (((args.take count).zip
+            (padWorlds argWorlds count)).map Prod.snd)
+          emitPrefix prefixAVals ∧
+        SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+          prefixOutput)
+    (BuiltSound := fun sourceBuilt prefixOutput emitPrefix prefixAVals =>
+      LowerResultValueSound funRel recSelfRel ctx cur input
+          prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+          (emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+          (.slotA prefixOutput.depth) ∧
+        SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+          prefixOutput.bump)
+    (Result := fun actualResult actualOutput actualEmit actualAv _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input actualOutput
+        sourceEnv sourceEnv actualResult resultWorld actualEmit actualAv)
+    (hprefixBack := by
+      intro _ _ _ _ hafterPrefix hreach
+      exact (applyRest_extraExtends hafterPrefix).trans hreach)
+    (hprefixSound := by
+      intro _ _ _ _ hprefixSource hprefixRun hreach
+      exact ⟨hargs hprefixSource hprefixRun hreach havailable,
+        havailable.lowerArgs hprefixRun⟩)
+    (hbuild := by
+      intro _ _ _ _ hprefix hprefixApply hprefixLength
+      exact ⟨hbuild hprefix.1 hprefixApply hprefixLength,
+        hprefix.2.bump⟩)
+    (hterminalFinish := by
+      intro _ _ _ _ _ hle hbuilt
+      simpa [hterminalWorld hle] using hbuilt.1)
+    (hoverFinish := by
+      intro sourceBuilt prefixOutput emitPrefix prefixAVals _ hover
+        hbuilt htailApply hafterPrefix hreach
+      have hbuiltShared : LowerResultValueSound funRel recSelfRel ctx cur
+          input prefixOutput.bump sourceEnv sourceEnv sourceBuilt .shared
+          (emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+          (.slotA prefixOutput.depth) := by
+        simpa [hoverWorld hover] using hbuilt.1
+      exact hrest (by simp) (hsourceArgs.drop count) htailApply
+        hbuiltShared hafterPrefix hreach hbuilt.2)
+    (hfinalReach := hextends) hsourceArgs hsource hrun
+
+/-- Fuel-bounded reachable-state semantic `knownCall`. -/
+theorem knownCall_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {build : Array Atom → Op}
+    {argWorlds : List Owned} {resultWorld buildWorld : Owned}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hbuild : ∀ {prefixOutput : VEnv} {emitPrefix : Emit}
+        {prefixAVals : List AVal} {sourceBuilt : IxIR0.Value},
+      LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (((args.take count).zip (padWorlds argWorlds count)).map Prod.snd)
+        emitPrefix prefixAVals →
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      prefixAVals.length =
+        ((args.take count).zip (padWorlds argWorlds count)).length →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+        (emitPrefix ∘ emitOp
+          (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+        (.slotA prefixOutput.depth))
+    (hterminalWorld : args.length ≤ count → buildWorld = resultWorld)
+    (hoverWorld : count < args.length → buildWorld = .shared)
+    (hrun : (knownCall src (fuel + 1) input build count argWorlds
+      resultWorld args).run state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  exact knownCall_run_value_sound_core
+    (Reach := fun actualState => ExtraExtends actualState ambient)
+    (PrefixSound := fun prefixOutput emitPrefix prefixAVals =>
+      LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit input
+          prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+          (((args.take count).zip
+            (padWorlds argWorlds count)).map Prod.snd)
+          emitPrefix prefixAVals ∧
+        SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+          prefixOutput)
+    (BuiltSound := fun sourceBuilt prefixOutput emitPrefix prefixAVals =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+          prefixOutput.bump sourceEnv sourceEnv sourceBuilt buildWorld
+          (emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+          (.slotA prefixOutput.depth) ∧
+        SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+          prefixOutput.bump)
+    (Result := fun actualResult actualOutput actualEmit actualAv _ =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        actualOutput sourceEnv sourceEnv actualResult resultWorld
+        actualEmit actualAv)
+    (hprefixBack := by
+      intro _ _ _ _ hafterPrefix hreach
+      exact (applyRest_extraExtends hafterPrefix).trans hreach)
+    (hprefixSound := by
+      intro _ _ _ _ hprefixSource hprefixRun hreach
+      exact ⟨hargs hprefixSource hprefixRun hreach havailable,
+        havailable.lowerArgs hprefixRun⟩)
+    (hbuild := by
+      intro _ _ _ _ hprefix hprefixApply hprefixLength
+      exact ⟨hbuild hprefix.1 hprefixApply hprefixLength,
+        hprefix.2.bump⟩)
+    (hterminalFinish := by
+      intro _ _ _ _ _ hle hbuilt
+      simpa [hterminalWorld hle] using hbuilt.1)
+    (hoverFinish := by
+      intro sourceBuilt prefixOutput emitPrefix prefixAVals _ hover
+        hbuilt htailApply hafterPrefix hreach
+      have hbuiltShared : LowerResultValueSoundBelow funRel recSelfRel ctx
+          cur limit input prefixOutput.bump sourceEnv sourceEnv sourceBuilt
+          .shared
+          (emitPrefix ∘ emitOp
+            (build (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+          (.slotA prefixOutput.depth) := by
+        simpa [hoverWorld hover] using hbuilt.1
+      exact hrest (by simp) (hsourceArgs.drop count) htailApply
+        hbuiltShared hafterPrefix hreach hbuilt.2)
+    (hfinalReach := hextends) hsourceArgs hsource hrun
+
+theorem knownCall_call_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {argWorlds : List Owned} {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hvalue : FnValueContract funRel sourceCtx ctx d argWorlds
+      sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound_within hargs hrest hsourceArgs hsource
+    ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph hdecl hownership hvalue hprefixApply
+
+theorem knownCall_call_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur d : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {argWorlds : List Owned}
+    {resultWorld : Owned} {f : Ixon.Address}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hworlds : argWorlds.length = count)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hownership : FnOwnershipContractBelow ctx d argWorlds limit)
+    (hvalue : FnValueContractBelow funRel sourceCtx ctx d argWorlds
+      sourceFunction limit)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hterminalWorld : args.length ≤ count → d.result = resultWorld)
+    (hoverWorld : count < args.length → d.result = .shared)
+    (hrun : (knownCall src (fuel + 1) input (.call f ·) count
+      argWorlds resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound_within_below hargs hrest hsourceArgs
+    hsource ?_ hterminalWorld hoverWorld hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args argWorlds count
+    hworlds hcount
+  have hprefix : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      argWorlds emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  exact hprefix.call_graph hdecl hownership hvalue hprefixApply
+
+theorem knownCall_callSelf_entry_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hownership : FnOwnershipContract ctx cur
+      (List.replicate count .shared))
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContract funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => by simpa [hresult]) (fun _ => by simpa [hresult]) hrun
+      hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  have hbuilt := hprefix.callSelf_entry_graph hentry hhead hownership
+    hvalue hprefixApply
+  simpa [hresult] using hbuilt
+
+theorem knownCall_callSelf_entry_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count index : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hentry : input.entries[index]? = some (.recSelf count))
+    (hhead : sourceEnv[index]? = some sourceFunction)
+    (hownership : FnOwnershipContractBelow ctx cur
+      (List.replicate count .shared) limit)
+    (hvalue : recSelfRel sourceFunction count →
+      FnValueContractBelow funRel sourceCtx ctx cur
+        (List.replicate count .shared) sourceFunction limit)
+    (hresult : cur.result = .shared)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.callSelf ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_sound_within_below hargs hrest hsourceArgs
+    hsource ?_ (fun _ => by simpa [hresult])
+      (fun _ => by simpa [hresult]) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply _
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hprefix : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate count .shared) emitPrefix prefixAVals := by
+    simpa only [hshape] using hprefixSound
+  have hbuilt := hprefix.callSelf_entry_graph hentry hhead hownership
+    hvalue hprefixApply
+  simpa [hresult] using hbuilt
+
+theorem knownCall_alloc_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {world : Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world) emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+theorem knownCall_alloc_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {world : Owned} {cid : CtorId}
+    {sourceAddress : Ixon.Address} {sourceTag : Nat}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take count)
+      (.ctor sourceAddress sourceTag (sourceValues.take count)))
+    (hrun : (knownCall src (fuel + 1) input (.alloc world cid ·) count
+      (List.replicate count world) world args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  refine knownCall_run_value_sound_within_below hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count world) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count world) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+        input prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length world) emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hbuilt := hprefix.alloc_graph haddress htag
+    rw [hprefixApply.deterministic hctor]
+    exact hbuilt
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+theorem knownCall_extern_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {input output : VEnv} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+        prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph hcontract hlookup href htakeLength
+      hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+theorem knownCall_extern_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {f : Ixon.Address}
+    {input output : VEnv} {resultWorld : Owned}
+    {args : List IxIR0.Expr} {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcontract : ExternValueContract funRel sourceCtx ctx)
+    (hcount : count ≤ args.length)
+    (hlookup : sourceCtx.env f = some (.extern count))
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.extern f ·) count
+      (List.replicate count .shared) resultWorld args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult resultWorld emit av := by
+  refine knownCall_run_value_sound_within_below hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) ?_ hrun hextends havailable
+  · intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+      hprefixApply hprefixLength
+    have hshape := knownCall_prefix_worlds_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have hzipLength := knownCall_prefix_length_eq args
+      (List.replicate count .shared) count (by simp) hcount
+    have havsLength : prefixAVals.length = count :=
+      hprefixLength.trans hzipLength
+    have hprefix : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+        input prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+        (List.replicate prefixAVals.length .shared)
+        emitPrefix prefixAVals := by
+      simpa only [hshape, havsLength] using hprefixSound
+    have hvalueCount : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hvalueCount]
+    exact hprefix.extern_graph hcontract hlookup href htakeLength
+      hprefixApply
+  · intro hover
+    exact knownCall_over_run_world_shared hover hrun
+
+theorem knownCall_papp_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel count : Nat}
+    {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_sound_within hargs hrest hsourceArgs hsource
+    ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+      prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixSound
+  apply hprefix.papp_graph hdecl (hfun hprefixApply)
+  simpa [havsLength] using hunder
+
+theorem knownCall_papp_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt}
+    {fuel count : Nat} {f : Ixon.Address} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hfun : ∀ {sourceBuilt : IxIR0.Value},
+      SourceApplies sourceCtx sourceFunction (sourceValues.take count)
+        sourceBuilt →
+      funRel sourceBuilt f (declArity d) (sourceValues.take count))
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult .shared emit av := by
+  refine knownCall_run_value_sound_within_below hargs hrest hsourceArgs
+    hsource ?_ (fun _ => rfl) (fun _ => rfl) hrun hextends havailable
+  intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+    hprefixApply hprefixLength
+  have hshape := knownCall_prefix_worlds_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have hzipLength := knownCall_prefix_length_eq args
+    (List.replicate count .shared) count (by simp) hcount
+  have havsLength : prefixAVals.length = count :=
+    hprefixLength.trans hzipLength
+  have hprefix : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input prefixOutput sourceEnv sourceEnv (sourceValues.take count)
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa only [hshape, havsLength] using hprefixSound
+  apply hprefix.papp_graph hdecl (hfun hprefixApply)
+  simpa [havsLength] using hunder
+
+theorem knownCall_papp_source_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_sound_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+theorem knownCall_papp_source_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel count : Nat}
+    {f : Ixon.Address} {source : IxIR0.Decl} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hsrc : src f = some source)
+    (heligible : SourcePapEligible source)
+    (harity : sourceDeclArity source = declArity d)
+    (href : SourceRefValue sourceCtx f sourceFunction)
+    (hdecl : ctx.decls f = some d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp f ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_sound_within_below hargs hrest hcount
+    hdecl hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    apply CompilerFunctionRel.source hsrc heligible harity href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    simpa [htakeLength] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+theorem knownCall_papp_wrapper_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_sound_within hargs hrest hcount hdecl
+    hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+theorem knownCall_papp_wrapper_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel count : Nat}
+    {memo : WrapperMemo} {d : Decl}
+    {input output : VEnv} {args : List IxIR0.Expr}
+    {sourceEnv sourceValues : List IxIR0.Value}
+    {sourceFunction sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hcount : count ≤ args.length)
+    (hmember : memo ∈ ambient.wrappers)
+    (hsrc : src memo.source = some (.ctor memo.tag memo.arity))
+    (href : SourceRefValue sourceCtx memo.source sourceFunction)
+    (hdecl : ctx.decls memo.wrapper = some d)
+    (harity : memo.arity = declArity d)
+    (hunder : count < declArity d)
+    (hsourceArgs : SourceArgsEval sourceCtx sourceEnv args sourceValues)
+    (hsource : SourceApplies sourceCtx sourceFunction sourceValues
+      sourceResult)
+    (hrun : (knownCall src (fuel + 1) input (.papp memo.wrapper ·) count
+      (List.replicate count .shared) .shared args).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      .shared emit av := by
+  apply knownCall_papp_run_value_sound_within_below hargs hrest hcount
+    hdecl hunder hsourceArgs hsource
+  · intro sourceBuilt hprefixApply
+    rw [← harity]
+    apply CompilerFunctionRel.wrapper hmember hsrc href hprefixApply
+    have hcountValues : count ≤ sourceValues.length := by
+      simpa [← hsourceArgs.lengths] using hcount
+    have htakeLength : (sourceValues.take count).length = count := by
+      simp [List.length_take, hcountValues]
+    rw [htakeLength]
+    simpa [harity] using hunder
+  · exact hrun
+  · exact hextends
+  · exact havailable
+
+theorem lowerSpine_ref_defn_call_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_sound_within hargs hrest (by simp)
+    hcount hdecl hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+theorem lowerSpine_ref_defn_partial_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (estateThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (estateThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_sound_within hargs hrest
+          (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown hextends havailable
+
+theorem lowerSpine_ref_defn_call_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hcount : lamArity body ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ := hdecls.defn hsrc
+  have hvalue : FnValueContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction limit := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_sound_within_below hargs hrest (by simp)
+    hcount hdecl (hownership.below limit) hvalue hsourceArgs hsourceApply
+      ?_ ?_ hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = lamArity body :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro hover
+    have hne : args.length ≠ lamArity body := Nat.ne_of_gt hover
+    simpa [hresult, hne] using hguard
+
+theorem lowerSpine_ref_defn_partial_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world result : Owned} {f : Ixon.Address}
+    {body : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.defn result body))
+    (hunder : args.length < lamArity body)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.defn hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    cases result with
+    | unique =>
+      exact (estateThrowRun_not_ok
+        (by simpa [hsuEq, huuEq] using hrun)).elim
+    | shared =>
+      cases hp : papSafe body with
+      | false =>
+        exact (estateThrowRun_not_ok
+          (by simpa [hsuEq, hp] using hrun)).elim
+      | true =>
+        have hknown :
+            (knownCall src (fuel + 1) input (.papp f ·) args.length
+              (List.replicate args.length .shared) .shared args).run state =
+              .ok (output, emit, av) finalState := by
+          simpa [hsuEq, hp] using hrun
+        apply knownCall_papp_source_run_value_sound_within_below hargs hrest
+          (Nat.le_refl _) hsrc ⟨rfl, hp⟩
+          (by simpa [sourceDeclArity, declArity] using harity.symm)
+          href hdecl (by simpa [declArity, harity] using hunder)
+          hsourceArgs hsourceApply hknown hextends havailable
+
+theorem lowerSpine_ref_recursor_call_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_sound_within hargs hrest (by simp)
+    hcount hdecl hownership hvalue hsourceArgs hsourceApply ?_ ?_
+      hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+theorem lowerSpine_ref_recursor_partial_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_sound_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+theorem lowerSpine_ref_recursor_call_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    (hvalues : SourceDeclValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hcount : numArgs + 1 ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, hresult, hownership⟩ :=
+    hdecls.recursor hsrc
+  have hvalue : FnValueContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      (List.replicate (numArgs + 1) .shared) sourceFunction limit := by
+    apply hvalues.fnContract hsrc (by rfl) hdecl href
+    simpa using harity.symm
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_neg (Nat.not_lt.mpr hcount)] at hrun
+  obtain ⟨checked, nextState, hrequireRun, hknownRun⟩ :=
+    estateBindRun_ok_inv hrun
+  cases checked
+  obtain ⟨hguard, _⟩ := requireResultWorld_run_ok_inv hrequireRun
+  refine knownCall_call_run_value_sound_within_below hargs hrest (by simp)
+    hcount hdecl (hownership.below limit) hvalue hsourceArgs hsourceApply
+      ?_ ?_ hknownRun hextends havailable
+  · intro hterminal
+    have heq : args.length = numArgs + 1 :=
+      Nat.le_antisymm hterminal hcount
+    simpa [hresult, heq] using hguard
+  · intro _
+    simpa [hresult] using hguard
+
+theorem lowerSpine_ref_recursor_partial_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {numArgs : Nat} {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunder : args.length < numArgs + 1)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  obtain ⟨d, hdecl, harity, _, _⟩ := hdecls.recursor hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_sound_within_below hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible])
+      (by simpa [sourceDeclArity, declArity] using harity.symm)
+      href hdecl (by simpa [declArity, harity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+theorem lowerSpine_ref_ctor_alloc_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_sound_within hargs hrest hcount rfl rfl
+    hsourceArgs hsourceApply hctor hknown hextends havailable
+
+theorem lowerSpine_ref_ctor_partial_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      estateBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ ambient.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_sound_within hargs hrest
+      (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun hextends havailable
+
+theorem lowerSpine_ref_ctor_alloc_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.ctor tag arity))
+    (hsrc : src f = some (.ctor tag arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hvalueCount : arity ≤ sourceValues.length := by
+    simpa [← hsourceArgs.lengths] using hcount
+  have htakeLength : (sourceValues.take arity).length = arity := by
+    simp [List.length_take, hvalueCount]
+  have hctor : SourceApplies sourceCtx sourceFunction
+      (sourceValues.take arity)
+      (.ctor f tag (sourceValues.take arity)) :=
+    sourceCtorRef_saturates hlookup href htakeLength
+  have hknown :
+      (knownCall src (fuel + 1) input
+        (.alloc world (ctorIdOf f tag) ·) arity
+        (List.replicate arity world) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_alloc_run_value_sound_within_below hargs hrest hcount
+    rfl rfl hsourceArgs hsourceApply hctor hknown hextends havailable
+
+theorem lowerSpine_ref_ctor_partial_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {tag arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal}
+    (hsrc : src f = some (.ctor tag arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hrun' :
+        ((wrapperFor f tag arity) >>= fun wrapper =>
+          knownCall src (fuel + 1) input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    obtain ⟨wrapper, wrapperState, hwrapperRun, hknownRun⟩ :=
+      estateBindRun_ok_inv hrun'
+    let memo : WrapperMemo := ⟨f, tag, arity, wrapper⟩
+    have hmemoFinal : memo ∈ finalState.wrappers :=
+      (hknownExtra input (.papp wrapper ·) args.length
+        (List.replicate args.length .shared) .shared args
+        hknownRun).wrapper_mem (wrapperFor_memo_mem hwrapperRun)
+    have hmemo : memo ∈ ambient.wrappers :=
+      hextends.wrapper_mem hmemoFinal
+    have hdecl := hrepresented.wrapper hmemo
+    apply knownCall_papp_wrapper_run_value_sound_within_below hargs hrest
+      (Nat.le_refl _) hmemo hsrc href hdecl
+      (by simp [memo, ctorWrapperDecl, declArity])
+      (by simpa [memo, ctorWrapperDecl, declArity] using hunder)
+      hsourceArgs hsourceApply hknownRun hextends havailable
+
+theorem lowerSpine_ref_extern_call_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_sound_within hargs hrest hcontract
+    hcount hlookup href hsourceArgs hsourceApply hknown hextends havailable
+
+theorem lowerSpine_ref_extern_partial_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_sound_within hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+theorem lowerSpine_ref_extern_call_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hcontract : ExternValueContract
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hlookup : sourceCtx.env f = some (.extern arity))
+    (hsrc : src f = some (.extern arity))
+    (hcount : arity ≤ args.length)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hknown :
+      (knownCall src (fuel + 1) input (.extern f ·) arity
+        (List.replicate arity .shared) world args).run state =
+        .ok (output, emit, av) finalState := by
+    simpa [lowerSpine, hsrc, Nat.not_lt.mpr hcount] using hrun
+  exact knownCall_extern_run_value_sound_within_below hargs hrest
+    hcontract hcount hlookup href hsourceArgs hsourceApply hknown hextends
+    havailable
+
+theorem lowerSpine_ref_extern_partial_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hdecls : SourceDeclContracts src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {arity : Nat} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hsrc : src f = some (.extern arity))
+    (hunder : args.length < arity)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  obtain ⟨sourceFunction, sourceValues, href, hsourceArgs,
+      hsourceApply⟩ := hsource.refData
+  have hdecl := hdecls.extern hsrc
+  simp only [lowerSpine] at hrun
+  rw [hsrc] at hrun
+  simp only at hrun
+  rw [if_pos hunder] at hrun
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases world with
+  | unique =>
+    exact (estateThrowRun_not_ok (by simpa [huuEq] using hrun)).elim
+  | shared =>
+    have hknown :
+        (knownCall src (fuel + 1) input (.papp f ·) args.length
+          (List.replicate args.length .shared) .shared args).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [hsuEq] using hrun
+    apply knownCall_papp_source_run_value_sound_within_below hargs hrest
+      (Nat.le_refl _) hsrc (by simp [SourcePapEligible]) (by rfl) href hdecl
+      (by simpa [declArity] using hunder)
+      hsourceArgs hsourceApply hknown hextends havailable
+
+/-- Complete reachable-state static-reference dispatch. Wrapper and lifted
+provenance are interpreted in the ambient whole-pass state while all
+recursive argument/tail runs are justified by their suffix witnesses. -/
+theorem lowerSpine_ref_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur input
+      output sourceEnv sourceEnv sourceResult world emit av)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_value_sound_within
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_value_sound_within
+        hargs hrest hcontracts.decls hvalues.decls hsrc hcount hsource hrun
+        hextends havailable)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_value_sound_within
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented havailable)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_value_sound_within
+        hargs hrest hlookup hsrc hcount hsource hrun hextends havailable)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_value_sound_within
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_value_sound_within
+        hargs hrest hcontracts.decls hvalues.decls hsrc hcount hsource hrun
+        hextends havailable)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_value_sound_within
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_value_sound_within
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun
+        hextends havailable)
+    hrun
+
+/-- Fuel-bounded reachable-state static-reference dispatch. -/
+theorem lowerSpine_ref_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.ref f) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.ref f) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  exact lowerSpine_ref_run_core
+    (Result := LowerResultValueSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+      input output sourceEnv sourceEnv sourceResult world emit av)
+    (hdefnPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_defn_partial_run_value_sound_within_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hdefnCall := by
+      intro _ _ hsrc hcount
+      exact lowerSpine_ref_defn_call_run_value_sound_within_below
+        hargs hrest hcontracts.decls hvalues.decls hsrc hcount hsource hrun
+        hextends havailable)
+    (hctorPartial := by
+      intro _ _ hsrc hunder
+      exact lowerSpine_ref_ctor_partial_run_value_sound_within_below
+        hargs hrest hknownExtra hsrc hunder hsource hrun hextends
+        hrepresented havailable)
+    (hctorAlloc := by
+      intro tag arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.ctor tag arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_ctor_alloc_run_value_sound_within_below
+        hargs hrest hlookup hsrc hcount hsource hrun hextends havailable)
+    (hrecursorPartial := by
+      intro _ _ _ hsrc hunder
+      exact lowerSpine_ref_recursor_partial_run_value_sound_within_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hrecursorCall := by
+      intro _ _ _ hsrc hcount
+      exact lowerSpine_ref_recursor_call_run_value_sound_within_below
+        hargs hrest hcontracts.decls hvalues.decls hsrc hcount hsource hrun
+        hextends havailable)
+    (hexternPartial := by
+      intro _ hsrc hunder
+      exact lowerSpine_ref_extern_partial_run_value_sound_within_below
+        hargs hrest hcontracts.decls hsrc hunder hsource hrun hextends
+        havailable)
+    (hexternCall := by
+      intro arity hsrc hcount
+      have hlookup : sourceCtx.env f = some (.extern arity) := by
+        rw [henv]
+        exact hsrc
+      exact lowerSpine_ref_extern_call_run_value_sound_within_below
+        hargs hrest hvalues.extern hlookup hsrc hcount hsource hrun
+        hextends havailable)
+    hrun
+
+/-- Unbounded ownership wrapper for a malformed recursive-self arity. -/
+theorem LowerArgsSound.callSelf_arity_mismatch
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsSound ctx cur input output worlds emit avs)
+    (harity : avs.length ≠ cur.arity) :
+    LowerResultSound ctx cur input output.bump cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine ⟨.slot, ?_⟩
+  intro rest slots
+  apply EmitSound.comp (hargs.emits rest slots)
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms] at hrun
+    have hvaluesLength : values.length = avs.length :=
+      havs.lengths.2.symm
+    have hne : values.length ≠ cur.arity := by
+      intro heq
+      exact harity (hvaluesLength.symm.trans heq)
+    change (if (values.length != cur.arity) = true then
+        .error (.stuck "callSelf arity mismatch")
+      else
+        (do
+          let out ← runCode ctx fuel cur store values.reverse cur.body
+          checkResultWorld cur.result out)) =
+        .ok (store', result) at hrun
+    have hbne : (values.length != cur.arity) = true := by
+      simp [hne]
+    rw [if_pos hbne] at hrun
+    contradiction
+
+/-- Semantic wrapper for a malformed recursive-self arity. The emitted
+target operation is stuck before entering the current function, so its graph
+postcondition is vacuous while the ownership transformer remains exact. -/
+theorem LowerArgsValueSound.callSelf_arity_mismatch_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceResult : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceResult worlds emit avs)
+    (harity : avs.length ≠ cur.arity) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output.bump
+      sourceInput sourceOutput sourceValue cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSound :=
+        hargs.toLowerArgsSound.callSelf_arity_mismatch harity
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSound.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSound.emit
+  intro fuel store env store' result hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms] at hrun
+    have hvaluesLength : values.length = avs.length :=
+      havs.lengths.2.symm
+    have hne : values.length ≠ cur.arity := by
+      intro heq
+      exact harity (hvaluesLength.symm.trans heq)
+    change (if (values.length != cur.arity) = true then
+        .error (.stuck "callSelf arity mismatch")
+      else
+        (do
+          let out ← runCode ctx fuel cur store values.reverse cur.body
+          checkResultWorld cur.result out)) =
+        .ok (store', result) at hrun
+    have hbne : (values.length != cur.arity) = true := by
+      simp [hne]
+    rw [if_pos hbne] at hrun
+    contradiction
+
+theorem LowerArgsValueSoundBelow.callSelf_arity_mismatch_graph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput sourceResult : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {worlds : List Owned}
+    {emit : Emit} {avs : List AVal}
+    (hargs : LowerArgsValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceResult worlds emit avs)
+    (harity : avs.length ≠ cur.arity) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+      output.bump sourceInput sourceOutput sourceValue cur.result
+      (emit ∘ emitOp
+        (.callSelf (avs.map (·.toAtom output)).toArray))
+      (.slotA output.depth) := by
+  refine
+    { toLowerResultSoundBelow :=
+        hargs.toLowerArgsSoundBelow.callSelf_arity_mismatch harity
+      graphEmits := ?_ }
+  intro sourceRest rest slots
+  apply EmitSoundBelow.comp (hargs.graphEmits sourceRest rest slots)
+  apply OpSoundBelow.emit
+  intro fuel store env store' result _ hpre hrun
+  obtain ⟨⟨envRoots, values, houtput, havs, hvalueGraphs,
+      hrestGraph, hown⟩, hslots⟩ := hpre
+  cases fuel with
+  | zero => simp [runOp] at hrun
+  | succ fuel =>
+    rw [runOp.eq_def] at hrun
+    dsimp only at hrun
+    rw [havs.resolveAtoms] at hrun
+    have hvaluesLength : values.length = avs.length :=
+      havs.lengths.2.symm
+    have hne : values.length ≠ cur.arity := by
+      intro heq
+      exact harity (hvaluesLength.symm.trans heq)
+    change (if (values.length != cur.arity) = true then
+        .error (.stuck "callSelf arity mismatch")
+      else
+        (do
+          let out ← runCode ctx fuel cur store values.reverse cur.body
+          checkResultWorld cur.result out)) =
+        .ok (store', result) at hrun
+    have hbne : (values.length != cur.arity) = true := by
+      simp [hne]
+    rw [if_pos hbne] at hrun
+    contradiction
+
+/-- Reachable-state recursive-self spine. A malformed advertised arity is
+covered by the stuck-operation rule; the matching case consumes the current
+function's semantic contract. -/
+theorem lowerSpine_recSelf_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfValueContract funRel recSelfRel sourceCtx ctx cur)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (estateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state = .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        refine knownCall_run_value_sound_within
+          (build := .callSelf) (count := arity)
+          (argWorlds := List.replicate arity .shared)
+          (resultWorld := .shared) (buildWorld := .shared)
+          hargs hrest hsourceArgs hsourceApply ?_ (fun _ => rfl)
+            (fun _ => rfl) hrun hextends havailable
+        intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+          hprefixApply hprefixLength
+        have hshape := knownCall_prefix_worlds_eq args
+          (List.replicate arity .shared) arity (by simp) hcount
+        have hzipLength := knownCall_prefix_length_eq args
+          (List.replicate arity .shared) arity (by simp) hcount
+        have havsLength : prefixAVals.length = arity :=
+          hprefixLength.trans hzipLength
+        have hprefix : LowerArgsValueSound funRel recSelfRel ctx cur input
+            prefixOutput sourceEnv sourceEnv (sourceValues.take arity)
+            (List.replicate arity .shared) emitPrefix prefixAVals := by
+          simpa only [hshape] using hprefixSound
+        by_cases harity : arity = cur.arity
+        · have hownership : FnOwnershipContract ctx cur
+              (List.replicate arity .shared) := by
+            simpa [harity] using hself.ownership
+          have hvalue : recSelfRel sourceFunction arity →
+              FnValueContract funRel sourceCtx ctx cur
+                (List.replicate arity .shared) sourceFunction := by
+            intro hrel
+            simpa [harity] using hself.value (by simpa [harity] using hrel)
+          have hbuilt := hprefix.callSelf_entry_graph hentry hsourceHead
+            hownership hvalue hprefixApply
+          simpa [hself.result] using hbuilt
+        · have hmismatch : prefixAVals.length ≠ cur.arity := by
+            intro heq
+            exact harity (havsLength.symm.trans heq)
+          simpa [hself.result] using
+            hprefix.callSelf_arity_mismatch_graph
+              (sourceValue := sourceBuilt) hmismatch
+
+theorem lowerSpine_recSelf_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {ctx : Ctx} {cur : FnDef}
+    {limit fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {index arity : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hentry : input.entries[index]? = some (.recSelf arity))
+    (hself : CurrentSelfValueContractBelow funRel recSelfRel sourceCtx ctx
+      cur limit)
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  apply hsource.eliminate
+  · intro sourceFunction sourceValues hhead hsourceArgs hsourceApply
+    obtain ⟨sourceFuel, hhead⟩ := hhead
+    have hsourceHead : sourceEnv[index]? = some sourceFunction :=
+      sourceEval_var_inv hhead
+    simp only [lowerSpine] at hrun
+    rw [hentry] at hrun
+    simp only at hrun
+    by_cases hunder : args.length < arity
+    · rw [if_pos hunder] at hrun
+      exact (estateThrowRun_not_ok hrun).elim
+    · rw [if_neg hunder] at hrun
+      have hcount : arity ≤ args.length := Nat.le_of_not_gt hunder
+      cases world with
+      | unique =>
+        have hrequire :
+            (requireResultWorld .shared .unique).run state =
+              .error "call result is shared at unique demand" state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        contradiction
+      | shared =>
+        have hrequire :
+            (requireResultWorld .shared .shared).run state =
+              .ok () state := by
+          rfl
+        rw [estateBindRun, hrequire] at hrun
+        simp only at hrun
+        refine knownCall_run_value_sound_within_below
+          (build := .callSelf) (count := arity)
+          (argWorlds := List.replicate arity .shared)
+          (resultWorld := .shared) (buildWorld := .shared)
+          hargs hrest hsourceArgs hsourceApply ?_ (fun _ => rfl)
+            (fun _ => rfl) hrun hextends havailable
+        intro prefixOutput emitPrefix prefixAVals sourceBuilt hprefixSound
+          hprefixApply hprefixLength
+        have hshape := knownCall_prefix_worlds_eq args
+          (List.replicate arity .shared) arity (by simp) hcount
+        have hzipLength := knownCall_prefix_length_eq args
+          (List.replicate arity .shared) arity (by simp) hcount
+        have havsLength : prefixAVals.length = arity :=
+          hprefixLength.trans hzipLength
+        have hprefix : LowerArgsValueSoundBelow funRel recSelfRel ctx cur
+            limit input prefixOutput sourceEnv sourceEnv
+            (sourceValues.take arity) (List.replicate arity .shared)
+            emitPrefix prefixAVals := by
+          simpa only [hshape] using hprefixSound
+        by_cases harity : arity = cur.arity
+        · have hownership : FnOwnershipContractBelow ctx cur
+              (List.replicate arity .shared) limit := by
+            simpa [harity] using hself.ownership
+          have hvalue : recSelfRel sourceFunction arity →
+              FnValueContractBelow funRel sourceCtx ctx cur
+                (List.replicate arity .shared) sourceFunction limit := by
+            intro hrel
+            simpa [harity] using hself.value (by simpa [harity] using hrel)
+          have hbuilt := hprefix.callSelf_entry_graph hentry hsourceHead
+            hownership hvalue hprefixApply
+          simpa [hself.result] using hbuilt
+        · have hmismatch : prefixAVals.length ≠ cur.arity := by
+            intro heq
+            exact harity (havsLength.symm.trans heq)
+          simpa [hself.result] using
+            hprefix.callSelf_arity_mismatch_graph
+              (sourceValue := sourceBuilt) hmismatch
+
+theorem lowerSpine_erased_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_erased_run_value_sound_core
+    (Result := fun actualResult =>
+      LowerResultValueSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av)
+    (hfinish := by
+      intro sourceArgs hsourceArgs hrestRun
+      exact applyRest_erased_run_value_sound_within hargs hsourceArgs
+        (lower_erased_value_sound (funRel := funRel)
+          (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+          (sourceEnv := sourceEnv) (world := .shared))
+        hrestRun hextends havailable)
+    hsource hrun
+
+theorem lowerSpine_erased_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv .erased args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world .erased args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_erased_run_value_sound_core
+    (Result := fun actualResult =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av)
+    (hfinish := by
+      intro sourceArgs hsourceArgs hrestRun
+      exact applyRest_erased_run_value_sound_within_below hargs
+        hsourceArgs
+        (lower_erased_value_sound_below (funRel := funRel)
+          (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur)
+          (limit := limit) (sourceEnv := sourceEnv) (world := .shared))
+        hrestRun hextends havailable)
+    hsource hrun
+
+theorem lowerSpine_dynamic_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_apply_run_value_sound_core
+    (HeadSound := fun sourceFunction functionOutput emitFunction function
+        _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input functionOutput
+          sourceEnv sourceEnv sourceFunction .shared emitFunction function ∧
+        SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+          functionOutput)
+    (Result := fun actualResult =>
+      LowerResultValueSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av)
+    (hheadSound := by
+      intro _ _ _ _ _ _ hhead hfunctionRun hrestRun
+      exact ⟨hexpr hhead hfunctionRun
+          ((applyRest_extraExtends hrestRun).trans hextends) havailable,
+        havailable.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := by
+      intro _ _ _ _ hsourceArgs hfunctionSound hrestRun
+      exact applyRest_erased_run_value_sound_within hargs hsourceArgs
+        hfunctionSound.1 hrestRun hextends hfunctionSound.2)
+    (hnonErasedFinish := by
+      intro _ _ _ _ _ _ hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+      exact hrest hfunctionNe hsourceArgs hsourceApply hfunctionSound.1
+        hrestRun hextends hfunctionSound.2)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)
+
+theorem lowerSpine_dynamic_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned}
+    {head : IxIR0.Expr} {args : List IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceResult : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hshape : DynamicSpineHead head)
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_apply_run_value_sound_core
+    (HeadSound := fun sourceFunction functionOutput emitFunction function
+        _ =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+          functionOutput sourceEnv sourceEnv sourceFunction .shared
+          emitFunction function ∧
+        SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+          functionOutput)
+    (Result := fun actualResult =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av)
+    (hheadSound := by
+      intro _ _ _ _ _ _ hhead hfunctionRun hrestRun
+      exact ⟨hexpr hhead hfunctionRun
+          ((applyRest_extraExtends hrestRun).trans hextends) havailable,
+        havailable.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := by
+      intro _ _ _ _ hsourceArgs hfunctionSound hrestRun
+      exact applyRest_erased_run_value_sound_within_below hargs
+        hsourceArgs hfunctionSound.1 hrestRun hextends hfunctionSound.2)
+    (hnonErasedFinish := by
+      intro _ _ _ _ _ _ hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+      exact hrest hfunctionNe hsourceArgs hsourceApply hfunctionSound.1
+        hrestRun hextends hfunctionSound.2)
+    hsource (lowerSpine_dynamic_run_inv hshape hrun)
+
+theorem lowerSpine_var_dynamic_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreservesWithin funRel recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin funRel recSelfRel
+      sourceCtx ctx cur src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_apply_run_value_sound_core
+    (HeadSound := fun sourceFunction functionOutput emitFunction function
+        _ =>
+      LowerResultValueSound funRel recSelfRel ctx cur input functionOutput
+          sourceEnv sourceEnv sourceFunction .shared emitFunction function ∧
+        SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+          functionOutput)
+    (Result := fun actualResult =>
+      LowerResultValueSound funRel recSelfRel ctx cur input output
+        sourceEnv sourceEnv actualResult world emit av)
+    (hheadSound := by
+      intro _ _ _ _ _ _ hhead hfunctionRun hrestRun
+      exact ⟨hexpr hhead hfunctionRun
+          ((applyRest_extraExtends hrestRun).trans hextends) havailable,
+        havailable.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := by
+      intro _ _ _ _ hsourceArgs hfunctionSound hrestRun
+      exact applyRest_erased_run_value_sound_within hargs hsourceArgs
+        hfunctionSound.1 hrestRun hextends hfunctionSound.2)
+    (hnonErasedFinish := by
+      intro _ _ _ _ _ _ hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+      exact hrest hfunctionNe hsourceArgs hsourceApply hfunctionSound.1
+        hrestRun hextends hfunctionSound.2)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)
+
+theorem lowerSpine_var_dynamic_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient (fuel + 1))
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hnotSelf : ∀ arity,
+      input.entries[index]? ≠ some (.recSelf arity))
+    (hsource : SourceSpineEval sourceCtx sourceEnv (.var index) args
+      sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world (.var index) args).run
+      state = .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceResult world emit av := by
+  exact lowerSpine_apply_run_value_sound_core
+    (HeadSound := fun sourceFunction functionOutput emitFunction function
+        _ =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+          functionOutput sourceEnv sourceEnv sourceFunction .shared
+          emitFunction function ∧
+        SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx cur limit
+          functionOutput)
+    (Result := fun actualResult =>
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        output sourceEnv sourceEnv actualResult world emit av)
+    (hheadSound := by
+      intro _ _ _ _ _ _ hhead hfunctionRun hrestRun
+      exact ⟨hexpr hhead hfunctionRun
+          ((applyRest_extraExtends hrestRun).trans hextends) havailable,
+        havailable.lowerE hfunctionRun⟩)
+    (hreflect := hreflect)
+    (herasedFinish := by
+      intro _ _ _ _ hsourceArgs hfunctionSound hrestRun
+      exact applyRest_erased_run_value_sound_within_below hargs
+        hsourceArgs hfunctionSound.1 hrestRun hextends hfunctionSound.2)
+    (hnonErasedFinish := by
+      intro _ _ _ _ _ _ hfunctionNe hsourceArgs hsourceApply
+        hfunctionSound hrestRun
+      exact hrest hfunctionNe hsourceArgs hsourceApply hfunctionSound.1
+        hrestRun hextends hfunctionSound.2)
+    hsource (lowerSpine_var_dynamic_run_inv hnotSelf hrun)
+
+/-- One complete reachable-state semantic spine step. This is the induction
+form used by the generic compiler proof: every recursive run is constrained
+to the ambient whole-pass state, and current-self semantics are requested
+only when the logical environment actually contains its marker. -/
+theorem lowerSpine_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hexpr : LowerEValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineEval sourceCtx sourceEnv actualHead args sourceResult →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+        recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+        world emit av)
+    (happ := by
+      intro _ _ hsource hrun
+      apply hspine hsource.flattenApp
+      · simpa [lowerSpine] using hrun
+      · exact hextends
+      · exact havailable)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_value_sound_within hargs hsource hrun
+        hextends havailable)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_value_sound_within hexpr hreflect
+        hargs hrestNext hnotSelf hsource hrun hextends havailable)
+    (hrecSelf := by
+      intro index arity hentry hsource hrun
+      cases havailable with
+      | inl hself =>
+        exact lowerSpine_recSelf_run_value_sound_within hargs hrest
+          hentry hself hsource hrun hextends
+          (SelfValueAvailable.of_contract hself)
+      | inr hno => exact (hno index arity hentry).elim)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_value_sound_within henv hargs hrest
+        hknownExtra hcontracts hvalues hsource hrun hextends hrepresented
+        havailable)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_value_sound_within hexpr hreflect hargs
+        hrestNext hshape hsource hrun hextends havailable)
+    hsource hrun
+
+/-- One complete fuel-bounded reachable-state semantic spine step. -/
+theorem lowerSpine_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hspine : LowerSpineValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hexpr : LowerEValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hreflect : LowerEReflectsErased sourceCtx src (fuel + 1))
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hrestNext : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 1))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : SourceSpineEval sourceCtx sourceEnv head args sourceResult)
+    (hrun : (lowerSpine src (fuel + 2) input world head args).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  exact lowerSpine_run_core
+    (Result := fun actualHead =>
+      SourceSpineEval sourceCtx sourceEnv actualHead args sourceResult →
+      (lowerSpine src (fuel + 2) input world actualHead args).run state =
+          .ok (output, emit, av) finalState →
+      LowerResultValueSoundBelow
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv sourceResult world emit av)
+    (happ := by
+      intro _ _ hsource hrun
+      apply hspine hsource.flattenApp
+      · simpa [lowerSpine] using hrun
+      · exact hextends
+      · exact havailable)
+    (herased := by
+      intro hsource hrun
+      exact lowerSpine_erased_run_value_sound_within_below hargs hsource
+        hrun hextends havailable)
+    (hvar := by
+      intro _ hnotSelf hsource hrun
+      exact lowerSpine_var_dynamic_run_value_sound_within_below hexpr
+        hreflect hargs hrestNext hnotSelf hsource hrun hextends havailable)
+    (hrecSelf := by
+      intro index arity hentry hsource hrun
+      cases havailable with
+      | inl hself =>
+        exact lowerSpine_recSelf_run_value_sound_within_below hargs hrest
+          hentry hself hsource hrun hextends
+          (SelfValueAvailableBelow.of_contract hself)
+      | inr hno => exact (hno index arity hentry).elim)
+    (href := by
+      intro _ hsource hrun
+      exact lowerSpine_ref_run_value_sound_within_below henv hargs hrest
+        hknownExtra hcontracts hvalues hsource hrun hextends hrepresented
+        havailable)
+    (hdynamic := by
+      intro _ hshape hsource hrun
+      exact lowerSpine_dynamic_run_value_sound_within_below hexpr hreflect
+        hargs hrestNext hshape hsource hrun hextends havailable)
+    hsource hrun
+
+theorem lowerE_ref_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrest : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref f) =
+      .ok sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  apply lowerSpine_ref_run_value_sound_within henv hargs hrest hknownExtra
+    hcontracts hvalues (SourceSpineEval.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+  · exact havailable
+
+/-- Fuel-bounded standalone reference lowering. -/
+theorem lowerE_ref_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hargs : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hrest : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {input output : VEnv} {world : Owned} {f : Ixon.Address}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceResult : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv (.ref f) =
+      .ok sourceResult)
+    (hrun : (lowerE src (fuel + 1) input world (.ref f)).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceResult
+      world emit av := by
+  apply lowerSpine_ref_run_value_sound_within_below henv hargs hrest
+    hknownExtra hcontracts hvalues (SourceSpineEval.of_eval_nil hsource)
+  · exact lowerE_ref_run_to_lowerSpine_nil hrun
+  · exact hextends
+  · exact hrepresented
+  · exact havailable
+
+theorem lowerE_proj_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hborrow : LowerBorrowValuePreservesWithin funRel recSelfRel sourceCtx
+      ctx cur src ambient fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceTarget sourceValue : IxIR0.Value}
+    (htarget : IxIR0.eval sourceCtx sourceFuel sourceEnv source =
+      .ok sourceTarget)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact (lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release
+        middleState =>
+      ExtraExtends middleState ambient →
+      LowerBorrowValueSound funRel recSelfRel ctx cur input borrowOutput
+        sourceEnv sourceEnv sourceTarget borrowEmit borrowed release)
+    (ProjectionResult := fun projectionWorld projectionOutput projectionEmit
+        projectionAv projectionState =>
+      ExtraExtends projectionState ambient →
+      LowerResultValueSound funRel recSelfRel ctx cur input projectionOutput
+        sourceEnv sourceEnv sourceValue projectionWorld projectionEmit
+        projectionAv)
+    (hborrow := fun hsubrun hwithin =>
+      hborrow htarget hsubrun hwithin havailable)
+    (hvar := fun hsound hwithin => by
+      cases (hsound hwithin).stable)
+    (hlit := fun hsound hwithin =>
+      (hsound hwithin).projectConst)
+    (herased := fun hsound hwithin => by
+      cases hproject with
+      | ctor hfield => exact (hsound hwithin).projectCtorErased
+      | erased => exact (hsound hwithin).returnErased)
+    (hslotKept := fun hsound hwithin => by
+      cases hproject with
+      | ctor hfield => exact (hsound hwithin).projectSlotKept hfield
+      | erased => exact (hsound hwithin).projectSlotKeptErased)
+    (hslotReleased := fun hsound hwithin => by
+      cases hproject with
+      | ctor hfield => exact (hsound hwithin).projectSlotReleased hfield
+      | erased => exact (hsound hwithin).projectSlotReleasedErased)
+    hrun) hextends
+
+/-- Fuel-bounded reachable-state projection semantics. -/
+theorem lowerE_proj_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hborrow : LowerBorrowValuePreservesWithinBelow funRel recSelfRel
+      sourceCtx ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {index : Nat}
+    {source : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceTarget sourceValue : IxIR0.Value}
+    (htarget : IxIR0.eval sourceCtx sourceFuel sourceEnv source =
+      .ok sourceTarget)
+    (hproject : SourceProject index sourceTarget sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  exact (lowerE_proj_run_sound_core
+    (BorrowResult := fun borrowOutput borrowEmit borrowed release
+        middleState =>
+      ExtraExtends middleState ambient →
+      LowerBorrowValueSoundBelow funRel recSelfRel ctx cur limit input
+        borrowOutput sourceEnv sourceEnv sourceTarget borrowEmit borrowed
+        release)
+    (ProjectionResult := fun projectionWorld projectionOutput projectionEmit
+        projectionAv projectionState =>
+      ExtraExtends projectionState ambient →
+      LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input
+        projectionOutput sourceEnv sourceEnv sourceValue projectionWorld
+        projectionEmit projectionAv)
+    (hborrow := fun hsubrun hwithin =>
+      hborrow htarget hsubrun hwithin havailable)
+    (hvar := fun hsound hwithin => by
+      cases (hsound hwithin).stable)
+    (hlit := fun hsound hwithin =>
+      (hsound hwithin).projectConst)
+    (herased := fun hsound hwithin => by
+      cases hproject with
+      | ctor hfield => exact (hsound hwithin).projectCtorErased
+      | erased => exact (hsound hwithin).returnErased)
+    (hslotKept := fun hsound hwithin => by
+      cases hproject with
+      | ctor hfield => exact (hsound hwithin).projectSlotKept hfield
+      | erased => exact (hsound hwithin).projectSlotKeptErased)
+    (hslotReleased := fun hsound hwithin => by
+      cases hproject with
+      | ctor hfield => exact (hsound hwithin).projectSlotReleased hfield
+      | erased => exact (hsound hwithin).projectSlotReleasedErased)
+    hrun) hextends
+
+/-- Reachable-state let semantics. The body-to-enclosing suffix supplied by
+the generic binder proof also transports the earlier bound-value run, while
+the explicit no-self map rebuilds current-self availability for the
+installed body environment. -/
+theorem lowerE_let_run_value_sound_within
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithin funRel recSelfRel sourceCtx ctx cur
+      src ambient fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {valueFuel bodyFuel : Nat}
+    {boundSource sourceValue : IxIR0.Value}
+    (hvalueSource : IxIR0.eval sourceCtx valueFuel sourceEnv value =
+      .ok boundSource)
+    (hbodySource : IxIR0.eval sourceCtx bodyFuel
+      (boundSource :: sourceEnv) body = .ok sourceValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailable funRel recSelfRel sourceCtx ctx cur
+      input) :
+    LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  apply lowerE_let_run_value_sound
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- Fuel-bounded reachable-state let semantics. -/
+theorem lowerE_let_run_value_sound_within_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} {fuel : Nat}
+    (hexpr : LowerEValuePreservesWithinBelow funRel recSelfRel sourceCtx
+      ctx cur limit src ambient fuel)
+    {input output : VEnv} {world : Owned} {uses : Uses}
+    {value body : IxIR0.Expr} {emit : Emit} {av : AVal}
+    {state finalState : LowSt} {sourceEnv : List IxIR0.Value}
+    {valueFuel bodyFuel : Nat}
+    {boundSource sourceValue : IxIR0.Value}
+    (hvalueSource : IxIR0.eval sourceCtx valueFuel sourceEnv value =
+      .ok boundSource)
+    (hbodySource : IxIR0.eval sourceCtx bodyFuel
+      (boundSource :: sourceEnv) body = .ok sourceValue)
+    (hreleases : LowerEReleasesTrackedFirst src fuel body)
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses value body)).run state =
+        .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (havailable : SelfValueAvailableBelow funRel recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow funRel recSelfRel ctx cur limit input output
+      sourceEnv sourceEnv sourceValue world emit av := by
+  apply lowerE_let_run_value_sound_below
+  · intro middle bodyInput bodyOutput valueEmit bodyEmit boundValue
+      resultValue valueState bodyState bodyFinal hvalueRun hbodyRun
+      hbodyState hbodyFinal hbodyNo
+    subst bodyState
+    have hbodyExtends : ExtraExtends bodyFinal ambient :=
+      hbodyFinal.trans hextends
+    have hvalueExtends : ExtraExtends valueState ambient :=
+      (lowerE_extraExtends hbodyRun).trans hbodyExtends
+    have hmiddleAvailable := havailable.lowerE hvalueRun
+    exact ⟨hexpr hvalueSource hvalueRun hvalueExtends havailable,
+      hexpr hbodySource hbodyRun hbodyExtends
+        (hmiddleAvailable.mapNoRecSelf hbodyNo)⟩
+  · exact hreleases
+  · exact hrun
+
+/-- One complete reachable-state semantic expression step. Together with
+the reachable spine/borrow/argument rules, this is the last local component
+needed by the closed compiler-fuel induction. -/
+theorem lowerE_run_value_sound_within
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hspine : LowerSpineValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hborrow : LowerBorrowValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient fuel)
+    (hargsNext : LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailable
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceValue
+      world emit av := by
+  exact lowerE_run_value_sound_core
+    (Result := fun result =>
+      LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+        recSelfRel ctx cur input output sourceEnv sourceEnv result world
+        emit av)
+    (hvar := fun _ _ hlookup hbranchRun =>
+      lowerE_var_run_value_sound hlookup hbranchRun)
+    (href := fun _ _ hbranchSource hbranchRun =>
+      lowerE_ref_run_value_sound_within henv hargsNext hrestNext
+        hknownExtra hcontracts hvalues hbranchSource hbranchRun hextends
+        hrepresented havailable)
+    (happ := fun _ _ _ hsourceSpine hspineRun =>
+      hspine hsourceSpine hspineRun hextends havailable)
+    (hlam := fun _ _ hbranchRun =>
+      lowerE_lam_run_value_sound_any
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := fun _ _ body _ _ _ hvalueSource hbodySource hbranchRun =>
+      lowerE_let_run_value_sound_within hexpr hvalueSource hbodySource
+        (hreleases body) hbranchRun hextends havailable)
+    (hproj := fun _ _ _ _ _ htarget hproject hbranchRun =>
+      lowerE_proj_run_value_sound_within hborrow htarget hproject
+        hbranchRun hextends havailable)
+    (hlit := fun _ hbranchRun => lowerE_lit_run_value_sound hbranchRun)
+    (herased := fun hbranchRun =>
+      lowerE_erased_run_value_sound hbranchRun)
+    hsource hrun
+
+/-- One complete fuel-bounded reachable-state semantic expression step. -/
+theorem lowerE_run_value_sound_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env}
+    {ambient : LowSt} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit fuel : Nat}
+    {state finalState : LowSt}
+    (henv : sourceCtx.env = src)
+    (hexpr : LowerEValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hspine : LowerSpineValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hborrow : LowerBorrowValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient fuel)
+    (hargsNext : LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hrestNext : ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient (fuel + 1))
+    (hknownExtra : KnownCallExtraMonotone src (fuel + 2))
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {sourceEnv : List IxIR0.Value} {sourceFuel : Nat}
+    {sourceValue : IxIR0.Value} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (havailable : SelfValueAvailableBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceValue
+      world emit av := by
+  exact lowerE_run_value_sound_core
+    (Result := fun result =>
+      LowerResultValueSoundBelow
+        (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx cur limit
+        input output sourceEnv sourceEnv result world emit av)
+    (hvar := fun _ _ hlookup hbranchRun =>
+      lowerE_var_run_value_sound_below hlookup hbranchRun)
+    (href := fun _ _ hbranchSource hbranchRun =>
+      lowerE_ref_run_value_sound_within_below henv hargsNext hrestNext
+        hknownExtra hcontracts hvalues hbranchSource hbranchRun hextends
+        hrepresented havailable)
+    (happ := fun _ _ _ hsourceSpine hspineRun =>
+      hspine hsourceSpine hspineRun hextends havailable)
+    (hlam := fun _ _ hbranchRun =>
+      lowerE_lam_run_value_sound_any_below
+        (fun value address arity captures hlifted =>
+          CompilerFunctionRel.lifted (hlifted.monoState hextends))
+        (hrepresented.of_extends hextends) hbranchRun)
+    (hlet := fun _ _ body _ _ _ hvalueSource hbodySource hbranchRun =>
+      lowerE_let_run_value_sound_within_below hexpr hvalueSource
+        hbodySource (hreleases body) hbranchRun hextends havailable)
+    (hproj := fun _ _ _ _ _ htarget hproject hbranchRun =>
+      lowerE_proj_run_value_sound_within_below hborrow htarget hproject
+        hbranchRun hextends havailable)
+    (hlit := fun _ hbranchRun =>
+      lowerE_lit_run_value_sound_below hbranchRun)
+    (herased := fun hbranchRun =>
+      lowerE_erased_run_value_sound_below hbranchRun)
+    hsource hrun
+
+/-- One complete bounded expression step. The semantic recursive premises
+are separated from the two compiler-state facts they cannot express:
+successful let bodies release their counted binder, and the final target
+context represents declarations accumulated by lambda lifting. -/
+theorem lowerE_run_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    (hspine : LowerSpinePreservesBelow ctx cur limit src fuel)
+    (hargsNext : LowerArgsPreservesBelow ctx cur limit src (fuel + 1))
+    (hargsNextExtra : LowerArgsExtraMonotone src (fuel + 1))
+    (hrestNext : ApplyRestPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestNextExtra : ApplyRestExtraMonotone src (fuel + 1))
+    (hborrow : LowerBorrowPreservesBelow ctx cur limit src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (hreleases : ∀ body, LowerEReleasesTrackedFirst src fuel body)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av := by
+  cases expr with
+  | var index =>
+    exact lowerE_nonbinding_run_sound_below hspine hargsNext hargsNextExtra
+      hrestNext hrestNextExtra hborrow hdecls (.var index) hrun
+      hrepresented havailable
+  | ref address =>
+    exact lowerE_nonbinding_run_sound_below hspine hargsNext hargsNextExtra
+      hrestNext hrestNextExtra hborrow hdecls (.ref address) hrun
+      hrepresented havailable
+  | app function argument =>
+    exact lowerE_nonbinding_run_sound_below hspine hargsNext hargsNextExtra
+      hrestNext hrestNextExtra hborrow hdecls (.app function argument)
+      hrun hrepresented havailable
+  | lam uses body =>
+    exact lowerE_lam_run_sound_below hrepresented hrun
+  | letE uses value body =>
+    exact lowerE_let_run_sound_below hexpr (hreleases body) hrun
+      hrepresented havailable
+  | proj index source =>
+    exact lowerE_nonbinding_run_sound_below hspine hargsNext hargsNextExtra
+      hrestNext hrestNextExtra hborrow hdecls (.proj index source) hrun
+      hrepresented havailable
+  | lit literal =>
+    exact lowerE_nonbinding_run_sound_below hspine hargsNext hargsNextExtra
+      hrestNext hrestNextExtra hborrow hdecls (.lit literal) hrun
+      hrepresented havailable
+  | erased =>
+    exact lowerE_nonbinding_run_sound_below hspine hargsNext hargsNextExtra
+      hrestNext hrestNextExtra hborrow hdecls .erased hrun hrepresented
+      havailable
+
+/-- Non-erased dynamic heads compose their proved `lowerE` result with the
+shared `applyRest` branch. -/
+theorem lowerSpine_dynamic_apply_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input functionOutput output : VEnv) (head : IxIR0.Expr)
+    (args : List IxIR0.Expr) (emitFunction emitArgs : Emit)
+    (function : AVal) (avs : List AVal)
+    (state middleState finalState : LowSt)
+    (hshape : DynamicSpineHead head)
+    (hfunctionRun :
+      (lowerE src (Nat.succ fuel) input .shared head).run state =
+        .ok (functionOutput, emitFunction, function) middleState)
+    (hfunction : LowerResultSound ctx cur input functionOutput .shared
+      emitFunction function)
+    (hfunctionNe : function ≠ .constA .erased)
+    (hargsRun :
+      (lowerArgs src fuel functionOutput
+        (args.map (fun arg => (arg, Owned.shared)))).run middleState =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur functionOutput output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared)
+    (hcontract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared head
+      args).run state =
+        .ok (output.bump,
+          (emitFunction ∘ emitArgs) ∘
+            emitOp (.apply (function.toAtom output)
+              (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        ((emitFunction ∘ emitArgs) ∘
+          emitOp (.apply (function.toAtom output)
+            (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have happly := applyRest_shared_verified (ctx := ctx) (cur := cur)
+    src fuel input functionOutput output emitFunction emitArgs function
+    args avs middleState finalState hfunctionNe hargsRun hargsSound
+    hworldsHomogeneous hfunction hcontract
+  constructor
+  · cases hshape <;>
+      simp only [lowerSpine] <;>
+      rw [estateBindRun, hfunctionRun] <;>
+      exact happly.1
+  · exact happly.2
+
+/-- If the dynamically lowered head is erased, its arguments are evaluated
+and released through the erased `applyRest` branch at either result world. -/
+theorem lowerSpine_dynamic_erased_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input functionOutput output : VEnv) (resultWorld : Owned)
+    (head : IxIR0.Expr) (args : List IxIR0.Expr)
+    (emitFunction emitArgs : Emit) (avs : List AVal)
+    (state middleState finalState : LowSt)
+    (hshape : DynamicSpineHead head)
+    (hfunctionRun :
+      (lowerE src (Nat.succ fuel) input .shared head).run state =
+        .ok (functionOutput, emitFunction, .constA .erased) middleState)
+    (hfunction : LowerResultSound ctx cur input functionOutput .shared
+      emitFunction (.constA .erased))
+    (hargsRun :
+      (lowerArgs src fuel functionOutput
+        (args.map (fun arg => (arg, Owned.shared)))).run middleState =
+        .ok (output, emitArgs, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur functionOutput output
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitArgs avs)
+    (hworldsHomogeneous :
+      ((args.map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate avs.length .shared) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input resultWorld head
+      args).run state =
+        .ok ((releaseAll output avs).1,
+          (emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2,
+          .constA .erased) finalState ∧
+      LowerResultSound ctx cur input (releaseAll output avs).1 resultWorld
+        ((emitFunction ∘ emitArgs) ∘ (releaseAll output avs).2)
+        (.constA .erased) := by
+  have happly := applyRest_erased_verified (ctx := ctx) (cur := cur)
+    src fuel input functionOutput output resultWorld emitFunction emitArgs
+    args avs middleState finalState hargsRun hargsSound
+    hworldsHomogeneous hfunction
+  constructor
+  · cases hshape <;>
+      simp only [lowerSpine] <;>
+      rw [estateBindRun, hfunctionRun] <;>
+      exact happly.1
+  · exact happly.2
+
+/-- The terminal direct-call branch of the executable `knownCall`: once the
+proved argument prefix has no over-application tail, it is consumed by the
+callee contract and the fresh result slot is returned. -/
+theorem knownCall_call_terminal_verified {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (n : Nat) (argWorlds : List Owned)
+    (resultDemand : Owned) (args : List IxIR0.Expr)
+    (emit : Emit) (avs : List AVal) (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emit avs)
+    (hle : args.length ≤ n)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)) :
+    (knownCall src (Nat.succ fuel) input (.call f ·) n argWorlds
+      resultDemand args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp
+            (.call f (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump d.result
+        (emit ∘ emitOp
+          (.call f (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hargsRun]
+    simp [hle]
+  · exact hargsSound.call_owned hdecl hcontract
+
+/-- Terminal recursive-self branch of `knownCall`, paired with the current
+function's ownership contract. -/
+theorem knownCall_callSelf_terminal_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (n : Nat) (argWorlds : List Owned) (resultDemand : Owned)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emit avs)
+    (hle : args.length ≤ n)
+    (hcontract : FnOwnershipContract ctx cur
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)) :
+    (knownCall src (Nat.succ fuel) input (.callSelf ·) n argWorlds
+      resultDemand args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp
+            (.callSelf (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump cur.result
+        (emit ∘ emitOp
+          (.callSelf (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hargsRun]
+    simp [hle]
+  · exact hargsSound.callSelf_owned hcontract
+
+/-- Exact-saturation `recSelf` dispatch in `lowerSpine`. The v1 source
+restriction supplies an all-shared telescope and the current function
+contract closes the recursive call. -/
+theorem lowerSpine_recSelf_terminal_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (i arity : Nat) (args : List IxIR0.Expr)
+    (emit : Emit) (avs : List AVal) (state finalState : LowSt)
+    (hentry : input.entries[i]? = some (.recSelf arity))
+    (hargsLength : args.length = arity)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take arity).zip
+          (padWorlds (List.replicate arity .shared) arity))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd)
+      emit avs)
+    (hcontract : FnOwnershipContract ctx cur
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd))
+    (hresult : cur.result = .shared) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.var i)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp
+            (.callSelf (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp
+          (.callSelf (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_callSelf_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output arity
+    (List.replicate arity .shared) .shared args emit avs state finalState
+    hargsRun hargsSound (by omega) hcontract
+  constructor
+  · simp only [lowerSpine]
+    rw [hentry]
+    simp only
+    rw [if_neg (by omega)]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    exact hknown.1
+  · simpa [hresult] using hknown.2
+
+/-- Over-applied recursive-self branch of `knownCall`: call the current
+function on its saturated prefix, protect the shared recursive result, then
+apply the remaining shared arguments. -/
+theorem knownCall_callSelf_overapplied_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (n : Nat) (argWorlds : List Owned) (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hover : n < args.length)
+    (hcallContract : FnOwnershipContract ctx cur
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd))
+    (hresult : cur.result = .shared)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop n).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (knownCall src (Nat.succ (Nat.succ fuel)) input (.callSelf ·) n
+      argWorlds .shared args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.callSelf
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.callSelf
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hcall : LowerResultSound ctx cur input prefixOutput.bump .shared
+      (emitPrefix ∘ emitOp (.callSelf
+        (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+      (.slotA prefixOutput.depth) := by
+    simpa [hresult] using hprefixSound.callSelf_owned hcallContract
+  have happly := applyRest_shared_verified (ctx := ctx) (cur := cur)
+    src fuel input prefixOutput.bump output
+    (emitPrefix ∘ emitOp (.callSelf
+      (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+    emitTail (.slotA prefixOutput.depth) (args.drop n) tailAVals
+    middleState finalState (by simp) htailRun htailSound htailWorlds
+    hcall happlyContract
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hprefixRun]
+    simp only
+    rw [if_neg (Nat.not_le.mpr hover)]
+    exact happly.1
+  · exact happly.2
+
+/-- Over-applied `recSelf` dispatch in `lowerSpine`, including the recursive
+prefix call and higher-order application of the tail. -/
+theorem lowerSpine_recSelf_overapplied_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (i arity : Nat) (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hentry : input.entries[i]? = some (.recSelf arity))
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take arity).zip
+          (padWorlds (List.replicate arity .shared) arity))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hover : arity < args.length)
+    (hcallContract : FnOwnershipContract ctx cur
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd))
+    (hresult : cur.result = .shared)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop arity).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop arity).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop arity).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ (Nat.succ fuel))) input .shared
+      (.var i) args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.callSelf
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.callSelf
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_callSelf_overapplied_verified
+    (ctx := ctx) (cur := cur) src fuel input prefixOutput output arity
+    (List.replicate arity .shared) args emitPrefix emitTail prefixAVals
+    tailAVals state middleState finalState hprefixRun hprefixSound hover
+    hcallContract hresult htailRun htailSound htailWorlds happlyContract
+  constructor
+  · simp only [lowerSpine]
+    rw [hentry]
+    simp only
+    rw [if_neg (by omega)]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    exact hknown.1
+  · exact hknown.2
+
+/-- Exact-saturation definition dispatch in `lowerSpine`, reducing its
+source declaration/world checks to the terminal direct-call `knownCall`
+rule. -/
+theorem lowerSpine_ref_call_terminal_verified {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (result : Owned) (body : IxIR0.Expr)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hsrc : src f = some (.defn result body))
+    (hargsLength : args.length = lamArity body)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take (lamArity body)).zip
+          (padWorlds ((lamUses body).map worldOfUses)
+            (lamArity body)))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take (lamArity body)).zip
+        (padWorlds ((lamUses body).map worldOfUses)
+          (lamArity body))).map Prod.snd)
+      emit avs)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d
+      (((args.take (lamArity body)).zip
+        (padWorlds ((lamUses body).map worldOfUses)
+          (lamArity body))).map Prod.snd))
+    (hresult : d.result = result) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input result (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.call f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump result
+        (emit ∘ emitOp (.call f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_call_terminal_verified (ctx := ctx) (cur := cur)
+    src fuel input output f (lamArity body)
+    ((lamUses body).map worldOfUses) result args emit avs state finalState
+    hargsRun hargsSound (by omega) hdecl hcontract
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    have hrequire :
+        (requireResultWorld result
+          (if args.length == lamArity body then result else .shared)).run
+            state = .ok () state := by
+      simp [hargsLength, requireResultWorld]
+    rw [estateBindRun, hrequire]
+    simp only
+    exact hknown.1
+  · simpa [hresult] using hknown.2
+
+/-- Exact-saturation recursor dispatch. Once the recursor has been lowered
+to a target function, its all-shared firing telescope is an ordinary direct
+call under that declaration's contract. -/
+theorem lowerSpine_ref_recursor_terminal_verified
+    {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) (args : List IxIR0.Expr)
+    (emit : Emit) (avs : List AVal) (state finalState : LowSt)
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hargsLength : args.length = numArgs + 1)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take (numArgs + 1)).zip
+          (padWorlds (List.replicate (numArgs + 1) .shared)
+            (numArgs + 1)))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take (numArgs + 1)).zip
+        (padWorlds (List.replicate (numArgs + 1) .shared)
+          (numArgs + 1))).map Prod.snd)
+      emit avs)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d
+      (((args.take (numArgs + 1)).zip
+        (padWorlds (List.replicate (numArgs + 1) .shared)
+          (numArgs + 1))).map Prod.snd))
+    (hresult : d.result = .shared) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.call f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp (.call f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_call_terminal_verified (ctx := ctx) (cur := cur)
+    src fuel input output f (numArgs + 1)
+    (List.replicate (numArgs + 1) .shared) .shared args emit avs
+    state finalState hargsRun hargsSound (by omega) hdecl hcontract
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    exact hknown.1
+  · simpa [hresult] using hknown.2
+
+/-- The over-applied direct-call branch of `knownCall`. The saturated prefix
+is consumed by the callee contract, its shared result is protected while the
+remaining shared arguments are lowered, and the resulting prefix is consumed
+by `apply`. -/
+theorem knownCall_call_overapplied_verified {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (f : Ixon.Address) (n : Nat) (argWorlds : List Owned)
+    (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hover : n < args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcallContract : FnOwnershipContract ctx d
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd))
+    (hresult : d.result = .shared)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop n).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (knownCall src (Nat.succ (Nat.succ fuel)) input (.call f ·) n
+      argWorlds .shared args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.call f
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.call f
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hcall : LowerResultSound ctx cur input prefixOutput.bump .shared
+      (emitPrefix ∘ emitOp (.call f
+        (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+      (.slotA prefixOutput.depth) := by
+    simpa [hresult] using hprefixSound.call_owned hdecl hcallContract
+  have happly := applyRest_shared_verified (ctx := ctx) (cur := cur)
+    src fuel input prefixOutput.bump output
+    (emitPrefix ∘ emitOp (.call f
+      (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+    emitTail (.slotA prefixOutput.depth) (args.drop n) tailAVals
+    middleState finalState (by simp) htailRun htailSound htailWorlds
+    hcall happlyContract
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hprefixRun]
+    simp only
+    rw [if_neg (Nat.not_le.mpr hover)]
+    exact happly.1
+  · exact happly.2
+
+/-- Over-applied definition dispatch in `lowerSpine`: the source declaration
+check selects a shared saturated prefix call, after which `knownCall` lowers
+and applies the remaining shared arguments. -/
+theorem lowerSpine_ref_call_overapplied_verified
+    {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (f : Ixon.Address) (body : IxIR0.Expr) (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hsrc : src f = some (.defn .shared body))
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take (lamArity body)).zip
+          (padWorlds ((lamUses body).map worldOfUses)
+            (lamArity body)))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take (lamArity body)).zip
+        (padWorlds ((lamUses body).map worldOfUses)
+          (lamArity body))).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hover : lamArity body < args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcallContract : FnOwnershipContract ctx d
+      (((args.take (lamArity body)).zip
+        (padWorlds ((lamUses body).map worldOfUses)
+          (lamArity body))).map Prod.snd))
+    (hresult : d.result = .shared)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop (lamArity body)).map
+          (fun arg => (arg, Owned.shared)))).run middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop (lamArity body)).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop (lamArity body)).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ (Nat.succ fuel))) input .shared
+      (.ref f) args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.call f
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.call f
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_call_overapplied_verified
+    (ctx := ctx) (cur := cur) src fuel input prefixOutput output f
+    (lamArity body) ((lamUses body).map worldOfUses) args
+    emitPrefix emitTail prefixAVals tailAVals state middleState finalState
+    hprefixRun hprefixSound hover hdecl hcallContract hresult htailRun
+    htailSound htailWorlds happlyContract
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    have hrequire :
+        (requireResultWorld .shared
+          (if args.length == lamArity body then .shared else .shared)).run
+            state = .ok () state := by
+      simp [requireResultWorld]
+    rw [estateBindRun, hrequire]
+    simp only
+    exact hknown.1
+  · exact hknown.2
+
+/-- Over-applied recursor dispatch is the all-shared recursor analogue of
+over-applied definition dispatch: direct-call the firing prefix, then apply
+the remaining arguments to its shared result. -/
+theorem lowerSpine_ref_recursor_overapplied_verified
+    {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (f : Ixon.Address) (numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take (numArgs + 1)).zip
+          (padWorlds (List.replicate (numArgs + 1) .shared)
+            (numArgs + 1)))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take (numArgs + 1)).zip
+        (padWorlds (List.replicate (numArgs + 1) .shared)
+          (numArgs + 1))).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hover : numArgs + 1 < args.length)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcallContract : FnOwnershipContract ctx d
+      (((args.take (numArgs + 1)).zip
+        (padWorlds (List.replicate (numArgs + 1) .shared)
+          (numArgs + 1))).map Prod.snd))
+    (hresult : d.result = .shared)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop (numArgs + 1)).map
+          (fun arg => (arg, Owned.shared)))).run middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop (numArgs + 1)).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop (numArgs + 1)).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ (Nat.succ fuel))) input .shared
+      (.ref f) args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.call f
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.call f
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_call_overapplied_verified
+    (ctx := ctx) (cur := cur) src fuel input prefixOutput output f
+    (numArgs + 1) (List.replicate (numArgs + 1) .shared) args
+    emitPrefix emitTail prefixAVals tailAVals state middleState finalState
+    hprefixRun hprefixSound hover hdecl hcallContract hresult htailRun
+    htailSound htailWorlds happlyContract
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    have hrequire :
+        (requireResultWorld .shared .shared).run state = .ok () state := by
+      rfl
+    rw [estateBindRun, hrequire]
+    simp only
+    exact hknown.1
+  · exact hknown.2
+
+/-- The homogeneous constructor counterpart of
+`knownCall_call_terminal_verified`. Whole-value mode scoping makes every
+field world equal to the newly allocated node's world. -/
+theorem knownCall_alloc_terminal_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (world : Owned) (cid : CtorId) (n : Nat)
+    (argWorlds : List Owned) (resultDemand : Owned)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take n).zip (padWorlds argWorlds n)).map Prod.snd =
+        List.replicate avs.length world)
+    (hle : args.length ≤ n) :
+    (knownCall src (Nat.succ fuel) input (.alloc world cid ·) n
+      argWorlds resultDemand args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.alloc world cid
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump world
+        (emit ∘ emitOp (.alloc world cid
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hargsRun]
+    simp [hle]
+  · have hhomogeneous : LowerArgsSound ctx cur input output
+        (List.replicate avs.length world) emit avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hhomogeneous.alloc_owned
+
+/-- Over-applied shared-constructor branch of `knownCall`: allocate the
+saturated field prefix, protect the fresh constructor root, then emit the
+remaining higher-order application. -/
+theorem knownCall_alloc_overapplied_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (cid : CtorId) (n : Nat) (argWorlds : List Owned)
+    (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hprefixWorlds :
+      ((args.take n).zip (padWorlds argWorlds n)).map Prod.snd =
+        List.replicate prefixAVals.length .shared)
+    (hover : n < args.length)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop n).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (knownCall src (Nat.succ (Nat.succ fuel)) input
+      (.alloc .shared cid ·) n argWorlds .shared args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.alloc .shared cid
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.alloc .shared cid
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hhomogeneous : LowerArgsSound ctx cur input prefixOutput
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa [hprefixWorlds] using hprefixSound
+  have halloc : LowerResultSound ctx cur input prefixOutput.bump .shared
+      (emitPrefix ∘ emitOp (.alloc .shared cid
+        (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+      (.slotA prefixOutput.depth) := hhomogeneous.alloc_owned
+  have happly := applyRest_shared_verified (ctx := ctx) (cur := cur)
+    src fuel input prefixOutput.bump output
+    (emitPrefix ∘ emitOp (.alloc .shared cid
+      (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+    emitTail (.slotA prefixOutput.depth) (args.drop n) tailAVals
+    middleState finalState (by simp) htailRun htailSound htailWorlds
+    halloc happlyContract
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hprefixRun]
+    simp only
+    rw [if_neg (Nat.not_le.mpr hover)]
+    exact happly.1
+  · exact happly.2
+
+/-- Over-applied constructor dispatch in `lowerSpine`. Only the shared world
+can reach the emitted tail `apply`; unique over-application is rejected by
+`applyRest`'s world guard. -/
+theorem lowerSpine_ref_ctor_overapplied_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (f : Ixon.Address) (tag arity : Nat) (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hsrc : src f = some (.ctor tag arity))
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take arity).zip
+          (padWorlds (List.replicate arity .shared) arity))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hprefixWorlds :
+      ((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd =
+        List.replicate prefixAVals.length .shared)
+    (hover : arity < args.length)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop arity).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop arity).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop arity).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ (Nat.succ fuel))) input .shared
+      (.ref f) args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.alloc .shared (ctorIdOf f tag)
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.alloc .shared (ctorIdOf f tag)
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_alloc_overapplied_verified
+    (ctx := ctx) (cur := cur) src fuel input prefixOutput output
+    (ctorIdOf f tag) arity (List.replicate arity .shared) args
+    emitPrefix emitTail prefixAVals tailAVals state middleState finalState
+    hprefixRun hprefixSound hprefixWorlds hover htailRun htailSound
+    htailWorlds happlyContract
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Terminal partial-application branch of `knownCall`: all supplied shared
+arguments become captures of one fresh pap node. -/
+theorem knownCall_papp_terminal_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (d : Decl) (n : Nat)
+    (argWorlds : List Owned) (resultDemand : Owned)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take n).zip (padWorlds argWorlds n)).map Prod.snd =
+        List.replicate avs.length .shared)
+    (hle : args.length ≤ n)
+    (hdecl : ctx.decls f = some d)
+    (hunder : avs.length < declArity d) :
+    (knownCall src (Nat.succ fuel) input (.papp f ·) n argWorlds
+      resultDemand args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.papp f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp (.papp f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hargsRun]
+    simp [hle]
+  · have hhomogeneous : LowerArgsSound ctx cur input output
+        (List.replicate avs.length .shared) emit avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hhomogeneous.papp_owned hdecl hunder
+
+/-- Terminal scalar-extern branch of `knownCall`. Successful evaluation
+certifies all argument descriptors and the result scalar, so the result may
+inhabit the requested world. -/
+theorem knownCall_extern_terminal_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (n : Nat) (argWorlds : List Owned)
+    (resultDemand : Owned) (args : List IxIR0.Expr)
+    (emit : Emit) (avs : List AVal) (state finalState : LowSt)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take n).zip (padWorlds argWorlds n)).map Prod.snd =
+        List.replicate avs.length .shared)
+    (hle : args.length ≤ n) :
+    (knownCall src (Nat.succ fuel) input (.extern f ·) n argWorlds
+      resultDemand args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.extern f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump resultDemand
+        (emit ∘ emitOp (.extern f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hargsRun]
+    simp [hle]
+  · have hhomogeneous : LowerArgsSound ctx cur input output
+        (List.replicate avs.length .shared) emit avs := by
+      simpa [hworldsHomogeneous] using hargsSound
+    exact hhomogeneous.extern_owned
+
+/-- Exact-saturation extern dispatch in `lowerSpine`. -/
+theorem lowerSpine_ref_extern_terminal_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (world : Owned) (f : Ixon.Address) (arity : Nat)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hsrc : src f = some (.extern arity))
+    (hargsLength : args.length = arity)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take arity).zip
+          (padWorlds (List.replicate arity .shared) arity))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd =
+          List.replicate avs.length .shared) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input world (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.extern f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump world
+        (emit ∘ emitOp (.extern f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_extern_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output f arity
+    (List.replicate arity .shared) world args emit avs state finalState
+    hargsRun hargsSound hworldsHomogeneous (by omega)
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Over-applied scalar-extern branch of `knownCall`. The scalar prefix
+result is ownership-inert but may still be framed as a shared result while
+the remaining arguments are lowered and passed to `apply`. -/
+theorem knownCall_extern_overapplied_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (f : Ixon.Address) (n : Nat) (argWorlds : List Owned)
+    (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take n).zip (padWorlds argWorlds n))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take n).zip (padWorlds argWorlds n)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hprefixWorlds :
+      ((args.take n).zip (padWorlds argWorlds n)).map Prod.snd =
+        List.replicate prefixAVals.length .shared)
+    (hover : n < args.length)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop n).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop n).map (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (knownCall src (Nat.succ (Nat.succ fuel)) input (.extern f ·) n
+      argWorlds .shared args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.extern f
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.extern f
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hhomogeneous : LowerArgsSound ctx cur input prefixOutput
+      (List.replicate prefixAVals.length .shared)
+      emitPrefix prefixAVals := by
+    simpa [hprefixWorlds] using hprefixSound
+  have hextern : LowerResultSound ctx cur input prefixOutput.bump .shared
+      (emitPrefix ∘ emitOp (.extern f
+        (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+      (.slotA prefixOutput.depth) := hhomogeneous.extern_owned
+  have happly := applyRest_shared_verified (ctx := ctx) (cur := cur)
+    src fuel input prefixOutput.bump output
+    (emitPrefix ∘ emitOp (.extern f
+      (prefixAVals.map (·.toAtom prefixOutput)).toArray))
+    emitTail (.slotA prefixOutput.depth) (args.drop n) tailAVals
+    middleState finalState (by simp) htailRun htailSound htailWorlds
+    hextern happlyContract
+  constructor
+  · simp only [knownCall]
+    rw [estateBindRun, hprefixRun]
+    simp only
+    rw [if_neg (Nat.not_le.mpr hover)]
+    exact happly.1
+  · exact happly.2
+
+/-- Over-applied extern dispatch in `lowerSpine`, pairing the saturated
+scalar oracle prefix with the emitted tail `apply`. -/
+theorem lowerSpine_ref_extern_overapplied_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat)
+    (input prefixOutput output : VEnv)
+    (f : Ixon.Address) (arity : Nat) (args : List IxIR0.Expr)
+    (emitPrefix emitTail : Emit) (prefixAVals tailAVals : List AVal)
+    (state middleState finalState : LowSt)
+    (hsrc : src f = some (.extern arity))
+    (hprefixRun :
+      (lowerArgs src (Nat.succ fuel) input
+        ((args.take arity).zip
+          (padWorlds (List.replicate arity .shared) arity))).run state =
+        .ok (prefixOutput, emitPrefix, prefixAVals) middleState)
+    (hprefixSound : LowerArgsSound ctx cur input prefixOutput
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd)
+      emitPrefix prefixAVals)
+    (hprefixWorlds :
+      ((args.take arity).zip
+        (padWorlds (List.replicate arity .shared) arity)).map Prod.snd =
+        List.replicate prefixAVals.length .shared)
+    (hover : arity < args.length)
+    (htailRun :
+      (lowerArgs src fuel prefixOutput.bump
+        ((args.drop arity).map (fun arg => (arg, Owned.shared)))).run
+          middleState =
+        .ok (output, emitTail, tailAVals) finalState)
+    (htailSound : LowerArgsSound ctx cur prefixOutput.bump output
+      (((args.drop arity).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd)
+      emitTail tailAVals)
+    (htailWorlds :
+      (((args.drop arity).map
+        (fun arg => (arg, Owned.shared))).map Prod.snd) =
+        List.replicate tailAVals.length .shared)
+    (happlyContract : ApplyOwnershipContract ctx) :
+    (lowerSpine src (Nat.succ (Nat.succ (Nat.succ fuel))) input .shared
+      (.ref f) args).run state =
+        .ok (output.bump,
+          ((emitPrefix ∘ emitOp (.extern f
+              (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+            emitTail) ∘
+            emitOp (.apply
+              ((AVal.slotA prefixOutput.depth).toAtom output)
+              (tailAVals.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (((emitPrefix ∘ emitOp (.extern f
+            (prefixAVals.map (·.toAtom prefixOutput)).toArray)) ∘
+          emitTail) ∘
+          emitOp (.apply
+            ((AVal.slotA prefixOutput.depth).toAtom output)
+            (tailAVals.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_extern_overapplied_verified
+    (ctx := ctx) (cur := cur) src fuel input prefixOutput output f arity
+    (List.replicate arity .shared) args emitPrefix emitTail prefixAVals
+    tailAVals state middleState finalState hprefixRun hprefixSound
+    hprefixWorlds hover htailRun htailSound htailWorlds happlyContract
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Under-applied all-`many` definition dispatch in `lowerSpine`. The source
+checks select `papp`; target arity agreement establishes that the emitted
+capture prefix is strictly under-saturating. -/
+theorem lowerSpine_ref_def_partial_verified {ctx : Ctx} {cur d : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (body : IxIR0.Expr) (args : List IxIR0.Expr)
+    (emit : Emit) (avs : List AVal) (state finalState : LowSt)
+    (hsrc : src f = some (.defn .shared body))
+    (hunderSource : args.length < lamArity body)
+    (hpapSafe : papSafe body = true)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take args.length).zip
+          (padWorlds (List.replicate args.length .shared)
+            args.length))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd =
+        List.replicate avs.length .shared)
+    (hdecl : ctx.decls f = some (.fn d))
+    (harity : d.arity = lamArity body) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.papp f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp (.papp f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have havsLength : avs.length = args.length := by
+    have hlength := congrArg List.length hworldsHomogeneous
+    simp [padWorlds] at hlength
+    omega
+  have hunderTarget : avs.length < declArity (.fn d) := by
+    simp only [declArity]
+    omega
+  have hknown := knownCall_papp_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output f (.fn d)
+    args.length (List.replicate args.length .shared) .shared args emit avs
+    state finalState hargsRun hargsSound hworldsHomogeneous
+    (Nat.le_refl _) hdecl hunderTarget
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp [hunderSource, hpapSafe]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Under-applied recursor dispatch shares the same pap ownership rule. The
+target declaration's arity is tied to the source recursor firing arity. -/
+theorem lowerSpine_ref_recursor_partial_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) (targetDecl : Decl)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hsrc : src f = some (.recursor numArgs natLit rules))
+    (hunderSource : args.length < numArgs + 1)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take args.length).zip
+          (padWorlds (List.replicate args.length .shared)
+            args.length))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd =
+        List.replicate avs.length .shared)
+    (hdecl : ctx.decls f = some targetDecl)
+    (harity : declArity targetDecl = numArgs + 1) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.papp f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp (.papp f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have havsLength : avs.length = args.length := by
+    have hlength := congrArg List.length hworldsHomogeneous
+    simp [padWorlds] at hlength
+    omega
+  have hunderTarget : avs.length < declArity targetDecl := by omega
+  have hknown := knownCall_papp_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output f targetDecl
+    args.length (List.replicate args.length .shared) .shared args emit avs
+    state finalState hargsRun hargsSound hworldsHomogeneous
+    (Nat.le_refl _) hdecl hunderTarget
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp [hunderSource]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Under-applied extern dispatch also builds a shared pap; no oracle call is
+made until later saturation. -/
+theorem lowerSpine_ref_extern_partial_verified
+    {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f : Ixon.Address) (arity : Nat) (args : List IxIR0.Expr)
+    (emit : Emit) (avs : List AVal) (state finalState : LowSt)
+    (hsrc : src f = some (.extern arity))
+    (hunderSource : args.length < arity)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take args.length).zip
+          (padWorlds (List.replicate args.length .shared)
+            args.length))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd =
+        List.replicate avs.length .shared)
+    (hdecl : ctx.decls f = some (.extern arity)) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.papp f
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp (.papp f
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have havsLength : avs.length = args.length := by
+    have hlength := congrArg List.length hworldsHomogeneous
+    simp [padWorlds] at hlength
+    omega
+  have hunderTarget : avs.length < declArity (.extern arity) := by
+    simp only [declArity]
+    omega
+  have hknown := knownCall_papp_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output f (.extern arity)
+    args.length (List.replicate args.length .shared) .shared args emit avs
+    state finalState hargsRun hargsSound hworldsHomogeneous
+    (Nat.le_refl _) hdecl hunderTarget
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp [hunderSource]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Under-applied constructor dispatch, including the stateful eta-wrapper
+lookup/creation step. The eventual whole-program proof supplies the generated
+wrapper declaration in `ctx`; its arity makes the following `papp` strictly
+under-saturated. -/
+theorem lowerSpine_ref_ctor_partial_verified
+    {ctx : Ctx} {cur wrapperDef : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (f wrapper : Ixon.Address) (tag arity : Nat)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state wrapperState finalState : LowSt)
+    (hsrc : src f = some (.ctor tag arity))
+    (hunderSource : args.length < arity)
+    (hwrapperRun : (wrapperFor f tag arity).run state =
+      .ok wrapper wrapperState)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take args.length).zip
+          (padWorlds (List.replicate args.length .shared)
+            args.length))).run wrapperState =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take args.length).zip
+        (padWorlds (List.replicate args.length .shared)
+          args.length)).map Prod.snd =
+        List.replicate avs.length .shared)
+    (hdecl : ctx.decls wrapper = some (.fn wrapperDef))
+    (harity : wrapperDef.arity = arity) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input .shared (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.papp wrapper
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump .shared
+        (emit ∘ emitOp (.papp wrapper
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have havsLength : avs.length = args.length := by
+    have hlength := congrArg List.length hworldsHomogeneous
+    simp [padWorlds] at hlength
+    omega
+  have hunderTarget : avs.length < declArity (.fn wrapperDef) := by
+    simp only [declArity]
+    omega
+  have hknown := knownCall_papp_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output wrapper
+    (.fn wrapperDef) args.length (List.replicate args.length .shared)
+    .shared args emit avs wrapperState finalState hargsRun hargsSound
+    hworldsHomogeneous (Nat.le_refl _) hdecl hunderTarget
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_pos hunderSource]
+    rw [if_neg (by decide)]
+    rw [estateBindRun, hwrapperRun]
+    exact hknown.1
+  · exact hknown.2
+
+/-- Exact-saturation constructor dispatch in `lowerSpine`, including its
+whole-value field-world telescope and concrete constructor identity. -/
+theorem lowerSpine_ref_ctor_terminal_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (input output : VEnv)
+    (world : Owned) (f : Ixon.Address) (tag arity : Nat)
+    (args : List IxIR0.Expr) (emit : Emit) (avs : List AVal)
+    (state finalState : LowSt)
+    (hsrc : src f = some (.ctor tag arity))
+    (hargsLength : args.length = arity)
+    (hargsRun :
+      (lowerArgs src fuel input
+        ((args.take arity).zip
+          (padWorlds (List.replicate arity world) arity))).run state =
+        .ok (output, emit, avs) finalState)
+    (hargsSound : LowerArgsSound ctx cur input output
+      (((args.take arity).zip
+        (padWorlds (List.replicate arity world) arity)).map Prod.snd)
+      emit avs)
+    (hworldsHomogeneous :
+      ((args.take arity).zip
+        (padWorlds (List.replicate arity world) arity)).map Prod.snd =
+          List.replicate avs.length world) :
+    (lowerSpine src (Nat.succ (Nat.succ fuel)) input world (.ref f)
+      args).run state =
+        .ok (output.bump,
+          emit ∘ emitOp (.alloc world (ctorIdOf f tag)
+            (avs.map (·.toAtom output)).toArray),
+          .slotA output.depth) finalState ∧
+      LowerResultSound ctx cur input output.bump world
+        (emit ∘ emitOp (.alloc world (ctorIdOf f tag)
+          (avs.map (·.toAtom output)).toArray))
+        (.slotA output.depth) := by
+  have hknown := knownCall_alloc_terminal_verified
+    (ctx := ctx) (cur := cur) src fuel input output world
+    (ctorIdOf f tag) arity (List.replicate arity world) world args
+    emit avs state finalState hargsRun hargsSound hworldsHomogeneous
+    (by omega)
+  constructor
+  · simp only [lowerSpine]
+    rw [hsrc]
+    simp only
+    rw [if_neg (by omega)]
+    exact hknown.1
+  · exact hknown.2
+
+/-- The executable compiler equations for the first two induction cases,
+paired with their semantic proofs. -/
+theorem lowerE_lit_verified {ctx : Ctx} {cur : FnDef} (src : IxIR0.Env)
+    (fuel : Nat) (Γ : VEnv) (world : Owned) (literal : IxIR0.Literal)
+    (state : LowSt) :
+    (lowerE src (Nat.succ fuel) Γ world (.lit literal)).run state =
+        .ok (Γ, (_root_.id : Emit), .constA (.lit literal)) state ∧
+      LowerResultSound ctx cur Γ Γ world (_root_.id : Emit)
+        (.constA (.lit literal)) := by
+  constructor
+  · simp [lowerE]
+  · exact lower_lit_sound
+
+theorem lowerE_lit_verified_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (world : Owned) (literal : IxIR0.Literal) (state : LowSt) :
+    (lowerE src (Nat.succ fuel) Γ world (.lit literal)).run state =
+        .ok (Γ, (_root_.id : Emit), .constA (.lit literal)) state ∧
+      LowerResultSoundBelow ctx cur limit Γ Γ world (_root_.id : Emit)
+        (.constA (.lit literal)) := by
+  constructor
+  · simp [lowerE]
+  · exact lower_lit_sound_below
+
+theorem lowerE_erased_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (world : Owned)
+    (state : LowSt) :
+    (lowerE src (Nat.succ fuel) Γ world .erased).run state =
+        .ok (Γ, (_root_.id : Emit), .constA .erased) state ∧
+      LowerResultSound ctx cur Γ Γ world (_root_.id : Emit)
+        (.constA .erased) := by
+  constructor
+  · simp [lowerE]
+  · exact lower_erased_sound
+
+theorem lowerE_erased_verified_below {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (world : Owned) (state : LowSt) :
+    (lowerE src (Nat.succ fuel) Γ world .erased).run state =
+        .ok (Γ, (_root_.id : Emit), .constA .erased) state ∧
+      LowerResultSoundBelow ctx cur limit Γ Γ world (_root_.id : Emit)
+        (.constA .erased) := by
+  constructor
+  · simp [lowerE]
+  · exact lower_erased_sound_below
+
+/-- The executable final-use branch and its generic semantic move theorem. -/
+theorem lowerE_var_move_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (i abs : Nat)
+    (uses : Uses) (state : LowSt)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    (lowerE src (Nat.succ fuel) Γ (worldOfUses uses) (.var i)).run state =
+        .ok (Γ.setEntry i (.slot abs 0 uses false),
+          (_root_.id : Emit), .slotA abs) state ∧
+      LowerResultSound ctx cur Γ
+        (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+        (_root_.id : Emit) (.slotA abs) := by
+  constructor
+  · have hshared : (Owned.shared != Owned.shared) = false := by decide
+    have hunique : (Owned.unique != Owned.unique) = false := by decide
+    cases uses <;>
+      simp [lowerE, hentry, worldOfUses, hshared, hunique]
+  · exact lower_var_move_sound hentry
+
+theorem lowerE_var_move_verified_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (i abs : Nat)
+    (uses : Uses) (state : LowSt)
+    (hentry : Γ.entries[i]? = some (.slot abs 1 uses true)) :
+    (lowerE src (Nat.succ fuel) Γ (worldOfUses uses) (.var i)).run state =
+        .ok (Γ.setEntry i (.slot abs 0 uses false),
+          (_root_.id : Emit), .slotA abs) state ∧
+      LowerResultSoundBelow ctx cur limit Γ
+        (Γ.setEntry i (.slot abs 0 uses false)) (worldOfUses uses)
+        (_root_.id : Emit) (.slotA abs) := by
+  constructor
+  · have hshared : (Owned.shared != Owned.shared) = false := by decide
+    have hunique : (Owned.unique != Owned.unique) = false := by decide
+    cases uses <;>
+      simp [lowerE, hentry, worldOfUses, hshared, hunique]
+  · exact lower_var_move_sound_below hentry
+
+/-- The executable shared-dup branch and its exact retain proof. -/
+theorem lowerE_var_many_dup_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (i abs remaining : Nat)
+    (state : LowSt)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) .many true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) .many true)
+    (lowerE src (Nat.succ fuel) Γ .shared (.var i)).run state =
+        .ok (Γ'.bump, emitOp (.dup (.var (Γ'.rel abs))),
+          .slotA Γ'.depth) state ∧
+      LowerResultSound ctx cur Γ Γ'.bump .shared
+        (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  dsimp only
+  constructor
+  · have hsame : (Owned.shared != Owned.shared) = false := by decide
+    have hunique : (Owned.shared == Owned.unique) = false := by decide
+    simp [lowerE, hentry, worldOfUses, hsame, hunique]
+  · exact lower_var_many_dup_sound hentry
+
+theorem lowerE_var_many_dup_verified_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv)
+    (i abs remaining : Nat) (state : LowSt)
+    (hentry : Γ.entries[i]? =
+      some (.slot abs (Nat.succ (Nat.succ remaining)) .many true)) :
+    let Γ' := Γ.setEntry i (.slot abs (Nat.succ remaining) .many true)
+    (lowerE src (Nat.succ fuel) Γ .shared (.var i)).run state =
+        .ok (Γ'.bump, emitOp (.dup (.var (Γ'.rel abs))),
+          .slotA Γ'.depth) state ∧
+      LowerResultSoundBelow ctx cur limit Γ Γ'.bump .shared
+        (emitOp (.dup (.var (Γ'.rel abs)))) (.slotA Γ'.depth) := by
+  dsimp only
+  constructor
+  · have hsame : (Owned.shared != Owned.shared) = false := by decide
+    have hunique : (Owned.shared == Owned.unique) = false := by decide
+    simp [lowerE, hentry, worldOfUses, hsame, hunique]
+  · exact lower_var_many_dup_sound_below hentry
+
+/-- Executable lowering and semantic ownership agree for the first
+nontrivial `let`/variable derivation. -/
+theorem lowerE_let_lit_var_verified {ctx : Ctx} {cur : FnDef}
+    (src : IxIR0.Env) (fuel : Nat) (Γ : VEnv) (literal : IxIR0.Literal)
+    (state : LowSt) :
+    (lowerE src (Nat.succ (Nat.succ fuel)) Γ .shared
+      (.letE .many (.lit literal) (.var 0))).run state =
+        .ok (Γ.bump, emitOp (.pure (.lit literal)), .slotA Γ.depth) state ∧
+      LowerResultSound ctx cur Γ Γ.bump .shared
+        (emitOp (.pure (.lit literal))) (.slotA Γ.depth) := by
+  constructor
+  · have hsame : (Owned.shared != Owned.shared) = false := by decide
+    simp [lowerE, countUses, worldOfUses, VEnv.bump, VEnv.pop,
+      VEnv.setEntry, Function.comp_def, hsame]
+  · exact lower_let_lit_var_sound
+
+/-- A non-head linear entry exercises root extraction and permutation: the
+preceding shared source root remains in the environment while the selected
+unique root becomes the expression result. -/
+theorem fixture_nonhead_unique_move_sound {ctx : Ctx} {cur : FnDef} :
+    let Γ : VEnv :=
+      ⟨[.slot 1 1 .many true, .slot 0 1 .linear true], 2⟩
+    LowerResultSound ctx cur Γ
+      (Γ.setEntry 1 (.slot 0 0 .linear false)) .unique
+      (_root_.id : Emit) (.slotA 0) := by
+  dsimp only
+  apply lower_var_move_sound
+  rfl
+
+/-- Two argument expressions each push a runtime slot. The cons proof keeps
+the first absolute slot protected while the second push changes its relative
+index, then realizes both descriptors in source order. -/
+theorem fixture_two_pushed_args_sound {ctx : Ctx} {cur : FnDef}
+    {Γ : VEnv} {first second : IxIR0.Literal} :
+    LowerArgsSound ctx cur Γ Γ.bump.bump [.shared, .shared]
+      (emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second)))
+      [.slotA Γ.depth, .slotA Γ.bump.depth] := by
+  exact (lower_let_lit_var_sound (ctx := ctx) (cur := cur)
+    (Γ := Γ) (literal := first)).consArgs
+      ((lower_let_lit_var_sound (ctx := ctx) (cur := cur)
+        (Γ := Γ.bump) (literal := second)).consArgs
+        (lowerArgs_nil_sound (ctx := ctx) (cur := cur) (Γ := Γ.bump.bump)))
+
+/-- The two protected argument slots become fields of one shared
+constructor, leaving exactly the fresh node as the expression result. -/
+theorem fixture_two_pushed_alloc_sound {ctx : Ctx} {cur : FnDef}
+    {Γ : VEnv} {first second : IxIR0.Literal} {cid : CtorId} :
+    LowerResultSound ctx cur Γ Γ.bump.bump.bump .shared
+      ((emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second))) ∘
+        emitOp (.alloc .shared cid
+          (([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).map
+            (·.toAtom Γ.bump.bump)).toArray))
+      (.slotA Γ.bump.bump.depth) := by
+  exact (fixture_two_pushed_args_sound (ctx := ctx) (cur := cur)
+    (Γ := Γ) (first := first) (second := second)).alloc_owned
+
+/-- The same protected two-argument prefix becomes the captures of a fresh
+shared pap when the target declaration still expects more arguments. -/
+theorem fixture_two_pushed_papp_sound {ctx : Ctx} {cur : FnDef}
+    {Γ : VEnv} {first second : IxIR0.Literal}
+    {f : Ixon.Address} {d : Decl}
+    (hdecl : ctx.decls f = some d)
+    (hunder : 2 < declArity d) :
+    LowerResultSound ctx cur Γ Γ.bump.bump.bump .shared
+      ((emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second))) ∘
+        emitOp (.papp f
+          (([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).map
+            (·.toAtom Γ.bump.bump)).toArray))
+      (.slotA Γ.bump.bump.depth) := by
+  have hargs : LowerArgsSound ctx cur Γ Γ.bump.bump
+      (List.replicate
+        ([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).length
+        .shared)
+      (emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second)))
+      [AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] := by
+    simpa using (fixture_two_pushed_args_sound (ctx := ctx) (cur := cur)
+      (Γ := Γ) (first := first) (second := second))
+  exact hargs.papp_owned hdecl (by simpa using hunder)
+
+/-- A scalar extern consumes the same two shared argument owners on every
+successful run and returns an ownership-inert scalar at either result world. -/
+theorem fixture_two_pushed_extern_sound {ctx : Ctx} {cur : FnDef}
+    {Γ : VEnv} {world : Owned} {first second : IxIR0.Literal}
+    {f : Ixon.Address} :
+    LowerResultSound ctx cur Γ Γ.bump.bump.bump world
+      ((emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second))) ∘
+        emitOp (.extern f
+          (([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).map
+            (·.toAtom Γ.bump.bump)).toArray))
+      (.slotA Γ.bump.bump.depth) := by
+  have hargs : LowerArgsSound ctx cur Γ Γ.bump.bump
+      (List.replicate
+        ([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).length
+        .shared)
+      (emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second)))
+      [AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] := by
+    simpa using (fixture_two_pushed_args_sound (ctx := ctx) (cur := cur)
+      (Γ := Γ) (first := first) (second := second))
+  exact hargs.extern_owned
+
+/-- The direct-call dual: an abstract two-shared-argument contract consumes
+both protected roots and supplies the declaration's result root. -/
+theorem fixture_two_pushed_call_sound {ctx : Ctx} {cur d : FnDef}
+    {Γ : VEnv} {first second : IxIR0.Literal} {f : Ixon.Address}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d [.shared, .shared]) :
+    LowerResultSound ctx cur Γ Γ.bump.bump.bump d.result
+      ((emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second))) ∘
+        emitOp (.call f
+          (([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).map
+            (·.toAtom Γ.bump.bump)).toArray))
+      (.slotA Γ.bump.bump.depth) := by
+  exact (fixture_two_pushed_args_sound (ctx := ctx) (cur := cur)
+    (Γ := Γ) (first := first) (second := second)).call_owned
+      hdecl hcontract
+
+/-- A previously produced shared function survives both argument pushes;
+the final `apply` consumes that function root and both argument roots and
+returns one fresh shared result root. -/
+theorem fixture_two_pushed_apply_sound {ctx : Ctx} {cur : FnDef}
+    {start Γ : VEnv} {emitFunction : Emit} {function : AVal}
+    {first second : IxIR0.Literal}
+    (hfunction : LowerResultSound ctx cur start Γ .shared
+      emitFunction function)
+    (hcontract : ApplyOwnershipContract ctx) :
+    LowerResultSound ctx cur start Γ.bump.bump.bump .shared
+      ((emitFunction ∘
+        (emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second)))) ∘
+        emitOp (.apply (function.toAtom Γ.bump.bump)
+          (([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).map
+            (·.toAtom Γ.bump.bump)).toArray))
+      (.slotA Γ.bump.bump.depth) := by
+  exact hfunction.applyArgs
+    (fixture_two_pushed_args_sound (ctx := ctx) (cur := cur)
+      (Γ := Γ) (first := first) (second := second))
+    hcontract
+
+/-- `releaseAll` drops both slot-backed arguments in order. Each drop pushes
+an inert slot, so both absolute arguments resolve at relative index one when
+their respective operation is emitted. -/
+theorem fixture_two_pushed_releaseAll_eq {Γ : VEnv} :
+    releaseAll Γ.bump.bump
+      [AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] =
+      (Γ.bump.bump.bump.bump,
+        emitOp (.drop (.var (Γ.bump.bump.rel Γ.depth))) ∘
+          emitOp (.drop (.var (Γ.bump.bump.bump.rel Γ.bump.depth)))) := by
+  rfl
+
+/-- Erased application evaluates the same two pushing arguments, consumes
+both resulting shared owners via `releaseAll`, and leaves only the erased
+scalar result. -/
+theorem fixture_two_pushed_erased_release_sound
+    {ctx : Ctx} {cur : FnDef} {Γ : VEnv}
+    {world : Owned} {first second : IxIR0.Literal} :
+    LowerResultSound ctx cur Γ Γ.bump.bump.bump.bump world
+      (((_root_.id : Emit) ∘
+        (emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second)))) ∘
+        (emitOp (.drop (.var (Γ.bump.bump.rel Γ.depth))) ∘
+          emitOp (.drop (.var (Γ.bump.bump.bump.rel Γ.bump.depth)))))
+      (.constA .erased) := by
+  have hargs : LowerArgsSound ctx cur Γ Γ.bump.bump
+      (List.replicate
+        ([AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] : List AVal).length
+        .shared)
+      (emitOp (.pure (.lit first)) ∘ emitOp (.pure (.lit second)))
+      [AVal.slotA Γ.depth, AVal.slotA Γ.bump.depth] := by
+    simpa using (fixture_two_pushed_args_sound (ctx := ctx) (cur := cur)
+      (Γ := Γ) (first := first) (second := second))
+  have hsound := (lower_erased_sound (ctx := ctx) (cur := cur)
+    (Γ := Γ) (world := .shared)).discardArgs
+      (resultWorld := world) hargs
+  rw [fixture_two_pushed_releaseAll_eq] at hsound
+  exact hsound
+
+/-- Closed proof fixture for the exact code emitted by
+`let many x := literal; x`. -/
+theorem fixture_closed_let_lit_owned {ctx : Ctx} {cur : FnDef}
+    {literal : IxIR0.Literal} :
+    CodeOwns ctx cur (OwnsVEnv ⟨[], 0⟩ [])
+      (fun store value =>
+        RootOwnership store [⟨Owned.shared, value⟩])
+      (.letOp (.pure (.lit literal)) (.ret (.var 0))) := by
+  let Γ₀ : VEnv := ⟨[], 0⟩
+  have h : CodeOwns ctx cur (OwnsVEnv Γ₀ [])
+      (fun store value =>
+        RootOwnership store (⟨Owned.shared, value⟩ :: []))
+      ((emitOp (.pure (.lit literal)))
+        (.ret ((AVal.slotA Γ₀.depth).toAtom Γ₀.bump))) :=
+    LowerResultSound.close
+      (lower_let_lit_var_sound (ctx := ctx) (cur := cur)
+        (Γ := Γ₀) (literal := literal))
+      EntriesReleased.nil []
+  change CodeOwns ctx cur (OwnsVEnv Γ₀ [])
+    (fun store value =>
+      RootOwnership store (⟨Owned.shared, value⟩ :: []))
+    ((emitOp (.pure (.lit literal)))
+      (.ret ((AVal.slotA Γ₀.depth).toAtom Γ₀.bump)))
+  exact h
+
+/-- Generated releases handle several dead parameters in canonical
+inner-to-outer order, mixing shared `drop` with affine `dropU`. -/
+theorem parameterDrops_mixed_generated_verified {ctx : Ctx} {cur : FnDef}
+    (state : LowSt) :
+    ∃ output emit,
+      (releaseSlots
+        ⟨parameterEntries 0 [.many, .affine, .many] (fun _ => 0), 3⟩
+        (parameterDrops 0 [.many, .affine, .many] (fun _ => 0))).run state =
+          .ok (output, emit) state ∧
+      ReleaseSlotsSound ctx cur
+        ⟨parameterEntries 0 [.many, .affine, .many] (fun _ => 0), 3⟩
+        output emit := by
+  exact parameterDrops_verified (ctx := ctx) (cur := cur)
+    0 [.many, .affine, .many] (fun _ => 0) state
+      (by simp [ParameterDropsAdmissible])
+
+/-- A declaration-level generated-release fixture: three unused parameters
+mix shared and affine ownership, while the scalar body leaves every entry
+released and therefore yields a callable contract. -/
+theorem lowerDecl_all_dead_mixed_generated_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (address : Ixon.Address)
+    (literal : IxIR0.Literal) (state : LowSt) :
+    let sourceBody : IxIR0.Expr :=
+      .lam .many (.lam .affine (.lam .many (.lit literal)))
+    ∃ finalState d,
+      (lowerDecl src (Nat.succ (Nat.succ fuel))
+        (address, .defn .shared sourceBody)).run state =
+          .ok (some (address, .fn d)) finalState ∧
+      FnOwnershipContract ctx d [.shared, .unique, .shared] := by
+  dsimp only
+  apply lowerDecl_defn_generated_verified (ctx := ctx)
+    src (Nat.succ fuel) address .shared
+      (.lam .many (.lam .affine (.lam .many (.lit literal)))) state
+  · simp [ParameterDropsAdmissible, lamUses, stripLams, countUses]
+  · intro middle releaseEmit hrelease
+    simp [releaseSlots, parameterEntries, parameterDrops, lamUses,
+      stripLams, lamArity, countUses, VEnv.rel, VEnv.setEntry,
+      VEnv.bump, Function.comp_def] at hrelease
+    obtain ⟨hmiddle, hemit⟩ := hrelease
+    have hreleased : EntriesReleased middle.entries := by
+      rw [← hmiddle]
+      exact EntriesReleased.slot
+        (EntriesReleased.slot (EntriesReleased.slot EntriesReleased.nil))
+    refine ⟨middle, (_root_.id : Emit), .constA (.lit literal), state,
+      ?_, ?_, ?_⟩
+    · exact (lowerE_lit_verified (ctx := ctx)
+        (cur := ⟨3, .shared, false,
+          (releaseEmit ∘ (_root_.id : Emit)) (.ret (.lit literal))⟩)
+        src fuel middle .shared literal state).1
+    · exact (lowerE_lit_verified (ctx := ctx)
+        (cur := ⟨3, .shared, false,
+          (releaseEmit ∘ (_root_.id : Emit)) (.ret (.lit literal))⟩)
+        src fuel middle .shared literal state).2
+    · exact hreleased
+
+/-- `lowerFnBody` and the contract constructor agree on the smallest real
+function body: a single parameter used exactly once. This covers both shared
+and unique parameter worlds through `worldOfUses`. -/
+theorem lowerFnBody_single_var_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (uses : Uses) (state : LowSt) :
+    let input : VEnv := ⟨[.slot 0 1 uses true], 1⟩
+    let d : FnDef :=
+      ⟨1, worldOfUses uses, false, .ret (.var 0)⟩
+    (lowerFnBody src (Nat.succ (Nat.succ fuel)) input []
+      (worldOfUses uses) (.var 0)).run state =
+        .ok d.body state ∧
+      FnOwnershipContract ctx d [worldOfUses uses] := by
+  dsimp only
+  constructor
+  · have hsame : (worldOfUses uses != worldOfUses uses) = false := by
+      cases uses <;> decide
+    simp [lowerFnBody, releaseSlots, lowerE, hsame, VEnv.setEntry,
+      VEnv.rel, AVal.toAtom]
+  · let input : VEnv := ⟨[.slot 0 1 uses true], 1⟩
+    let output := input.setEntry 0 (.slot 0 0 uses false)
+    let d : FnDef := ⟨1, worldOfUses uses, false, .ret (.var 0)⟩
+    have hsound : LowerResultSound ctx d input output
+        (worldOfUses uses) (_root_.id : Emit) (.slotA 0) := by
+      apply lower_var_move_sound
+      rfl
+    apply hsound.fnOwnershipContract (FnEntryRealizes.singleton uses 1)
+    · rfl
+    · exact EntriesReleased.slot EntriesReleased.nil
+    · rfl
+
+/-- A real two-parameter function-body run with one dead shared parameter.
+The entry release emits `drop`, records that owner as released, and the live
+inner parameter is then moved to the result. -/
+theorem lowerFnBody_dead_many_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (state : LowSt) :
+    let input : VEnv :=
+      ⟨[.slot 1 1 .many true, .slot 0 0 .many true], 2⟩
+    let d : FnDef :=
+      ⟨2, .shared, false, .letOp (.drop (.var 1)) (.ret (.var 1))⟩
+    (lowerFnBody src (Nat.succ (Nat.succ fuel)) input
+      [⟨1, 0, .many⟩] .shared (.var 0)).run state =
+        .ok d.body state ∧
+      FnOwnershipContract ctx d [.shared, .shared] := by
+  dsimp only
+  let remaining : Nat → Nat := fun i => if i = 0 then 1 else 0
+  let input : VEnv :=
+    ⟨parameterEntries 0 [.many, .many] remaining, 2⟩
+  let middle :=
+    (input.setEntry 1 (.slot 0 0 .many false)).bump
+  let output := middle.setEntry 0 (.slot 1 0 .many false)
+  let releaseEmit : Emit :=
+    emitOp (.drop (.var (input.rel 0))) ∘ (_root_.id : Emit)
+  let d : FnDef :=
+    ⟨2, .shared, false, .letOp (.drop (.var 1)) (.ret (.var 1))⟩
+  have hplan : ReleasePlan input [⟨1, 0, .many⟩] middle releaseEmit := by
+    apply ReleasePlan.many
+    · rfl
+    · exact ReleasePlan.nil
+  have hvar := lowerE_var_move_verified (ctx := ctx) (cur := d)
+    src fuel middle 0 1 .many state (by rfl)
+  have hfn := lowerFnBody_verified (ctx := ctx) (cur := d)
+    src (Nat.succ fuel) input middle output [⟨1, 0, .many⟩]
+    .shared (.var 0) releaseEmit (_root_.id : Emit) (.slotA 1)
+    state state hplan hvar.1 hvar.2
+  constructor
+  · simpa [input, middle, output, releaseEmit, d, VEnv.rel,
+      VEnv.setEntry, VEnv.bump, parameterEntries, remaining,
+      AVal.toAtom, emitOp, Function.comp_def] using hfn.1
+  · have hentry : FnEntryRealizes input [.shared, .shared] := by
+      exact FnEntryRealizes.parameterEntries [.many, .many] remaining
+    have hreleased : EntriesReleased output.entries := by
+      exact EntriesReleased.slot (EntriesReleased.slot EntriesReleased.nil)
+    apply hfn.2.fnOwnershipContract hentry rfl hreleased
+    rfl
+
+/-- The corresponding real `lowerDecl` branch: a two-argument definition
+whose outer shared parameter is dead lowers to the verified drop/return
+function and immediately receives its callable contract. -/
+theorem lowerDecl_dead_many_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (address : Ixon.Address)
+    (state : LowSt) :
+    let sourceBody : IxIR0.Expr :=
+      .lam .many (.lam .many (.var 0))
+    let d : FnDef :=
+      ⟨2, .shared, true, .letOp (.drop (.var 1)) (.ret (.var 1))⟩
+    (lowerDecl src (Nat.succ (Nat.succ fuel))
+      (address, .defn .shared sourceBody)).run state =
+        .ok (some (address, .fn d)) state ∧
+      FnOwnershipContract ctx d [.shared, .shared] := by
+  dsimp only
+  let sourceBody : IxIR0.Expr := .lam .many (.lam .many (.var 0))
+  let remaining : Nat → Nat := fun i => countUses i (.var 0)
+  let input : VEnv :=
+    ⟨parameterEntries 0 [.many, .many] remaining, 2⟩
+  let middle := (input.setEntry 1 (.slot 0 0 .many false)).bump
+  let output := middle.setEntry 0 (.slot 1 0 .many false)
+  let releaseEmit : Emit :=
+    emitOp (.drop (.var (input.rel 0))) ∘ (_root_.id : Emit)
+  let d : FnDef :=
+    ⟨2, .shared, true, .letOp (.drop (.var 1)) (.ret (.var 1))⟩
+  have hplan : ReleasePlan input [⟨1, 0, .many⟩] middle releaseEmit := by
+    apply ReleasePlan.many
+    · rfl
+    · exact ReleasePlan.nil
+  have hvar := lowerE_var_move_verified (ctx := ctx) (cur := d)
+    src fuel middle 0 1 .many state (by rfl)
+  have hreleased : EntriesReleased output.entries :=
+    EntriesReleased.slot (EntriesReleased.slot EntriesReleased.nil)
+  have hdecl := lowerDecl_defn_verified (ctx := ctx)
+    src (Nat.succ fuel) address .shared sourceBody middle output
+    releaseEmit (_root_.id : Emit) (.slotA 1) state state d
+    (by simpa [sourceBody, input, remaining, parameterDrops, lamUses,
+      stripLams, lamArity, countUses] using hplan)
+    (by simpa [sourceBody, output, stripLams, worldOfUses] using hvar.1)
+    (by simp [d, sourceBody, releaseEmit, input, output, middle,
+      remaining, parameterEntries, VEnv.rel, VEnv.setEntry, VEnv.bump,
+      lamArity, papSafe, lamUses, AVal.toAtom, emitOp, Function.comp_def])
+    hvar.2 hreleased
+  simpa [sourceBody, d, lamUses, worldOfUses] using hdecl
+
+private def NullaryRecursorEntryValid
+    (env : List RVal) (fields : Array RVal) : Prop :=
+  ∃ major, env = [major] ∧ fields = #[]
+
+private def nullaryRecursorEntryRoots
+    (env : List RVal) (_ : Array RVal) : List Root :=
+  match env with
+  | major :: _ => [⟨.shared, major⟩]
+  | [] => []
+
+/-- Entry shape for the first nontrivial recursor-prefix fixture. The
+function receives one pre-major parameter and the major; dispatch exposes one
+borrowed constructor field. -/
+private def OneFieldDeadParamEntryValid
+    (env : List RVal) (fields : Array RVal) : Prop :=
+  ∃ pre major field, env = [major, pre] ∧ fields = #[field]
+
+/-- Function-argument root order for `OneFieldDeadParamEntryValid`. This
+matches the source argument vector (`pre`, then `major`), independently of
+the reversed runtime environment. -/
+private def oneFieldDeadParamEntryRoots
+    (env : List RVal) (_ : Array RVal) : List Root :=
+  match env with
+  | major :: pre :: _ => [⟨.shared, pre⟩, ⟨.shared, major⟩]
+  | _ => []
+
+/-- A complete non-nullary recursor prefix: retain one borrowed field, drop
+the major, drop one dead pre-major parameter, then move the retained field to
+the result. This isolates all three ownership transitions generated by the
+corresponding `lowerRecursor` fold. -/
+theorem lowerRecursor_one_field_dead_param_alt_contract
+    {ctx : Ctx} {cur : FnDef} (hresult : cur.result = .shared) :
+    AltOwnershipContract ctx cur
+      (.mk 0 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 4)) (.ret (.var 2))))))
+      .shared OneFieldDeadParamEntryValid
+        oneFieldDeadParamEntryRoots := by
+  let input : VEnv :=
+    ⟨[.slot 3 1 .many true, .slot 0 0 .many false, .recSelf 2], 6⟩
+  let output := input.setEntry 0 (.slot 3 0 .many false)
+  have hbody : LowerResultSound ctx cur input output cur.result
+      (_root_.id : Emit) (.slotA 3) := by
+    rw [hresult]
+    apply lower_var_move_sound
+    rfl
+  have hprefix : ∀ {env : List RVal} {fields : Array RVal}
+      {rest : List Root},
+      fields.size = 1 → OneFieldDeadParamEntryValid env fields →
+        EmitSound ctx cur
+          (emitOp (.dup (.var 0)) ∘
+            emitOp (.drop (.var 2)) ∘
+            emitOp (.drop (.var 4)))
+          (OwnsAltEntry .shared oneFieldDeadParamEntryRoots env fields rest)
+          (OwnsVEnv input rest) := by
+    intro env fields rest _ hvalid
+    obtain ⟨pre, major, field, rfl, rfl⟩ := hvalid
+    intro post code hcode
+    let entryFrame : List RVal → Prop :=
+      fun oldEnv => oldEnv = [field, major, pre]
+    have hafterDup : CodeOwns ctx cur
+        (OwnsPushedRoot entryFrame .shared
+          ([⟨.shared, pre⟩, ⟨.shared, major⟩] ++ rest))
+        post
+        ((emitOp (.drop (.var 2)) ∘ emitOp (.drop (.var 4))) code) := by
+      intro nextFuel nextStore nextEnv resultStore resultValue hpushed hrun
+      obtain ⟨ownedField, oldEnv, rfl, hold, hown⟩ := hpushed
+      subst oldEnv
+      let majorFrame : List RVal → Prop :=
+        fun current => current = [ownedField, field, major, pre]
+      have hafterMajor : CodeOwns ctx cur
+          (OwnsAfterPush majorFrame
+            (⟨.shared, ownedField⟩ :: ⟨.shared, pre⟩ :: rest))
+          post (emitOp (.drop (.var 4)) code) := by
+        intro majorFuel majorStore majorEnv finalStore finalValue
+          hpushedMajor hrunMajor
+        obtain ⟨majorResult, oldEnv, rfl, holdMajor, hownMajor⟩ :=
+          hpushedMajor
+        subst oldEnv
+        let paramFrame : List RVal → Prop :=
+          fun current =>
+            current = [majorResult, ownedField, field, major, pre]
+        have hafterParam : CodeOwns ctx cur
+            (OwnsAfterPush paramFrame ([⟨.shared, ownedField⟩] ++ rest))
+            post code := by
+          intro paramFuel paramStore paramEnv finalStore finalValue
+            hpushedParam hrunParam
+          obtain ⟨paramResult, oldEnv, rfl, holdParam, hownParam⟩ :=
+            hpushedParam
+          subst oldEnv
+          have hrealize : VEnvRealizes input
+              [paramResult, majorResult, ownedField, field, major, pre]
+              [⟨.shared, ownedField⟩] := by
+            refine ⟨by simp [input], ?_⟩
+            apply EntriesRealize.held
+            · simp [input]
+            · simp [input, VEnv.rel]
+            · apply EntriesRealize.released
+              · simp [input]
+              · exact EntriesRealize.recSelf EntriesRealize.nil
+          apply hcode
+          · exact ⟨[⟨.shared, ownedField⟩], hrealize,
+              by simpa using hownParam⟩
+          · exact hrunParam
+        apply (emit_drop_value_owned (ctx := ctx) (cur := cur)
+          (target := .var 4) (value := pre) (frame := paramFrame)
+          (rest := ⟨.shared, ownedField⟩ :: rest))
+          post code hafterParam
+        · refine ⟨rfl, rfl, ?_⟩
+          exact hownMajor.perm
+            (perm_extract_root ⟨.shared, pre⟩
+              [⟨.shared, ownedField⟩] [] rest)
+        · exact hrunMajor
+      apply (emit_drop_value_owned (ctx := ctx) (cur := cur)
+        (target := .var 2) (value := major) (frame := majorFrame)
+        (rest := ⟨.shared, ownedField⟩ :: ⟨.shared, pre⟩ :: rest))
+        post (emitOp (.drop (.var 4)) code) hafterMajor
+      · refine ⟨rfl, rfl, ?_⟩
+        exact hown.perm
+          (perm_extract_root ⟨.shared, major⟩
+            [⟨.shared, ownedField⟩, ⟨.shared, pre⟩] [] rest)
+      · simpa [Function.comp_def] using hrun
+    intro startFuel startStore branchEnv endStore endValue hentry hrun
+    have hpre :
+        entryFrame branchEnv ∧
+          resolveAtom branchEnv (.var 0) = .ok field ∧
+          HasWorld startStore .shared field ∧
+          RootOwnership startStore
+            ([⟨.shared, pre⟩, ⟨.shared, major⟩] ++ rest) := by
+      obtain ⟨henv, hown, hborrow⟩ := hentry
+      have hbranch : branchEnv = [field, major, pre] := by
+        simpa using henv
+      refine ⟨hbranch, ?_, hborrow field (by simp), ?_⟩
+      · rw [hbranch]
+        rfl
+      · simpa [oneFieldDeadParamEntryRoots] using hown
+    exact (emit_retain_borrowed (ctx := ctx) (cur := cur)
+      (atom := .var 0) (value := field) (frame := entryFrame)
+      (rest := [⟨.shared, pre⟩, ⟨.shared, major⟩] ++ rest))
+      post ((emitOp (.drop (.var 2)) ∘ emitOp (.drop (.var 4))) code)
+      hafterDup (fuel := startFuel) (store := startStore)
+      (env := branchEnv) (store' := endStore) (value := endValue) hpre
+      (by simpa [Function.comp_def] using hrun)
+  have hcontract := hbody.altOwnershipContractWithPrefix
+    (fieldWorld := .shared)
+    (entryValid := OneFieldDeadParamEntryValid)
+    (entryRoots := oneFieldDeadParamEntryRoots)
+    (entryEmit := emitOp (.dup (.var 0)) ∘
+      emitOp (.drop (.var 2)) ∘ emitOp (.drop (.var 4)))
+    (tag := 0) (fieldCount := 1) hprefix
+    (EntriesReleased.slot
+      (EntriesReleased.slot
+        (EntriesReleased.recSelf EntriesReleased.nil)))
+  simpa [input, output, VEnv.setEntry, VEnv.rel, AVal.toAtom,
+    emitOp, Function.comp_def] using hcontract
+
+/-- Exact contract for the first concrete `lowerRecursor` prefix shape:
+a nullary rule with no pre-major parameters. The alternative owns the shared
+major, exposes no fields, drops the major, and then returns a scalar literal. -/
+theorem lowerRecursor_nullary_lit_alt_contract {ctx : Ctx} {cur : FnDef}
+    (literal : IxIR0.Literal) :
+    AltOwnershipContract ctx cur
+      (.mk 0 0 (.letOp (.drop (.var 0)) (.ret (.lit literal))))
+      .shared NullaryRecursorEntryValid nullaryRecursorEntryRoots := by
+  let input : VEnv := ⟨[.recSelf 1], 2⟩
+  have hbody : LowerResultSound ctx cur input input cur.result
+      (_root_.id : Emit) (.constA (.lit literal)) := lower_lit_sound
+  have hprefix : ∀ {env : List RVal} {fields : Array RVal}
+      {rest : List Root},
+      fields.size = 0 → NullaryRecursorEntryValid env fields →
+        EmitSound ctx cur (emitOp (.drop (.var 0)))
+          (OwnsAltEntry .shared nullaryRecursorEntryRoots env fields rest)
+          (OwnsVEnv input rest) := by
+    intro env fields rest hsize hvalid
+    obtain ⟨major, rfl, rfl⟩ := hvalid
+    intro post code hcode
+    intro fuel store branchEnv store' value hpre hrun
+    obtain ⟨henv, hown, _⟩ := hpre
+    have hbranch : branchEnv = [major] := by simpa using henv
+    subst branchEnv
+    let frame : List RVal → Prop := fun oldEnv => oldEnv = [major]
+    have hnext : CodeOwns ctx cur (OwnsAfterPush frame rest) post code := by
+      intro nextFuel nextStore nextEnv resultStore resultValue hpushed
+        hcodeRun
+      obtain ⟨pushed, oldEnv, rfl, hold, hownRest⟩ := hpushed
+      subst oldEnv
+      apply hcode
+      · have hrealize : VEnvRealizes input (pushed :: [major]) [] := by
+          exact ⟨by simp [input], EntriesRealize.recSelf EntriesRealize.nil⟩
+        refine ⟨[], hrealize, ?_⟩
+        · simpa using hownRest
+      · exact hcodeRun
+    apply emit_drop_value_owned (target := .var 0) (value := major)
+      (frame := frame) (rest := rest) post code hnext
+    · exact ⟨rfl, rfl, by simpa [nullaryRecursorEntryRoots] using hown⟩
+    · exact hrun
+  have hcontract := hbody.altOwnershipContractWithPrefix
+    (fieldWorld := .shared)
+    (entryValid := NullaryRecursorEntryValid)
+    (entryRoots := nullaryRecursorEntryRoots)
+    (entryEmit := emitOp (.drop (.var 0))) (tag := 0) (fieldCount := 0)
+    hprefix (EntriesReleased.recSelf EntriesReleased.nil)
+  simpa [input, AVal.toAtom, emitOp, Function.comp_def] using hcontract
+
+/-- The executable `lowerRecursor` equation paired with the contract of its
+generated nullary alternative. -/
+theorem lowerRecursor_nullary_lit_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (literal : IxIR0.Literal)
+    (state : LowSt) :
+    let alt : Alt :=
+      .mk 0 0 (.letOp (.drop (.var 0)) (.ret (.lit literal)))
+    let d : FnDef := ⟨1, .shared, true, .case (.var 0) false #[alt]⟩
+    (lowerRecursor src (Nat.succ fuel) 0 false
+      #[⟨0, .lit literal⟩]).run state = .ok d state ∧
+      AltOwnershipContract ctx d alt .shared
+        NullaryRecursorEntryValid nullaryRecursorEntryRoots := by
+  dsimp only
+  constructor
+  · simp [lowerRecursor, lowerRecursorRule, recursorFieldRetains,
+      applyRecursorFieldRetains, releaseSlots, parameterEntries,
+      parameterDrops, lowerE, AVal.toAtom, emitOp, VEnv.rel]
+  · exact lowerRecursor_nullary_lit_alt_contract literal
+
+/-- The non-nullary prefix contract is paired with the real recursor fold.
+The generated code retains field zero, drops the major at relative index two,
+drops the dead pre-major parameter at index four, and returns the retained
+field at index two. -/
+theorem lowerRecursor_one_field_dead_param_verified {ctx : Ctx}
+    (src : IxIR0.Env) (fuel : Nat) (state : LowSt) :
+    let alt : Alt :=
+      .mk 0 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 4)) (.ret (.var 2)))))
+    let d : FnDef := ⟨2, .shared, true, .case (.var 0) false #[alt]⟩
+    (lowerRecursor src (Nat.succ fuel) 1 false
+      #[⟨1, .var 0⟩]).run state = .ok d state ∧
+      AltOwnershipContract ctx d alt .shared
+        OneFieldDeadParamEntryValid oneFieldDeadParamEntryRoots := by
+  dsimp only
+  constructor
+  · have hsame : (Owned.shared != Owned.shared) = false := by decide
+    simp [lowerRecursor, lowerRecursorRule, recursorFieldRetains,
+      applyRecursorFieldRetains, releaseSlots, parameterEntries,
+      parameterDrops, SlotDrop.offsetEntry, lowerE, countUses, worldOfUses,
+      hsame, VEnv.rel, VEnv.setEntry, VEnv.bump, AVal.toAtom, emitOp,
+      Function.comp_def]
+  · exact lowerRecursor_one_field_dead_param_alt_contract rfl
+
+/-- Canonical recursor parameter cleanup with more than one release. The
+innermost and outermost pre-major parameters are dead while the middle one is
+returned, so the shared drops occur at changing relative indices two and
+five after the major has first been dropped. -/
+theorem lowerRecursor_three_params_release_order_verified
+    (src : IxIR0.Env) (fuel : Nat) (state : LowSt) :
+    let alt : Alt :=
+      .mk 0 0
+        (.letOp (.drop (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 5)) (.ret (.var 5)))))
+    let d : FnDef := ⟨4, .shared, true, .case (.var 0) false #[alt]⟩
+    (lowerRecursor src (Nat.succ fuel) 3 false
+      #[⟨0, .var 1⟩]).run state = .ok d state := by
+  dsimp only
+  have hsame : (Owned.shared != Owned.shared) = false := by decide
+  simp [lowerRecursor, lowerRecursorRule, recursorFieldRetains,
+    applyRecursorFieldRetains,
+    releaseSlots, parameterEntries, parameterDrops, SlotDrop.offsetEntry,
+    lowerE, countUses, worldOfUses, hsame, VEnv.rel, VEnv.setEntry,
+    VEnv.bump, AVal.toAtom, emitOp, Function.comp_def]
+
+/-- A unary Nat alternative whose result is a scalar exercises the complete
+alternative constructor. The predecessor is exposed as a borrow, the entry
+layout records its physical slot, and the branch itself owns no input roots. -/
+theorem fixture_nat_succ_alt_contract {ctx : Ctx} {cur : FnDef}
+    (n : Nat) (literal : IxIR0.Literal) :
+    AltOwnershipContract ctx cur
+      (.mk 1 1 (.ret (.lit literal))) .shared
+      (fun env fields =>
+        env = [] ∧ fields = #[RVal.lit (.nat n)])
+      (fun _ _ => []) := by
+  let input : VEnv := ⟨[], 1⟩
+  have hentry : AltEntryRealizes input 1
+      (fun env fields =>
+        env = [] ∧ fields = #[RVal.lit (.nat n)])
+      (fun _ _ => []) := by
+    intro env fields hsize hvalid
+    obtain ⟨rfl, rfl⟩ := hvalid
+    exact ⟨[], ⟨rfl, EntriesRealize.nil⟩, List.Perm.refl []⟩
+  have hsound : LowerResultSound ctx cur input input cur.result
+      (_root_.id : Emit) (.constA (.lit literal)) :=
+    lower_lit_sound
+  simpa [AVal.toAtom] using hsound.altOwnershipContract
+    (fieldWorld := .shared) (tag := 1) hentry EntriesReleased.nil
+
+/-- The alternative fixture plugs into peeled-successor dispatch and yields
+the exact result root while starting from the empty store/root set. -/
+theorem fixture_nat_succ_alt_dispatch_owned {ctx : Ctx} {cur : FnDef}
+    (fuel n : Nat) (literal : IxIR0.Literal) {store' : Store}
+    {value : RVal}
+    (hrun : runCode ctx (fuel + 1) cur {} []
+      (.case (.lit (.nat (n + 1))) true
+        #[.mk 1 1 (.ret (.lit literal))]) = .ok (store', value)) :
+    RootOwnership store' [⟨cur.result, value⟩] := by
+  apply runCode_case_nat_succ_contract_owned
+    (ctx := ctx) (fuel := fuel) (cur := cur) (store := ({} : Store))
+    (store' := store') (env := [])
+    (scrut := .lit (.nat (n + 1)))
+    (alts := #[.mk 1 1 (.ret (.lit literal))])
+    (n := n) (tag := 1) (body := .ret (.lit literal))
+    (value := value) (rest := [])
+    (entryValid := fun env fields =>
+      env = [] ∧ fields = #[RVal.lit (.nat n)])
+    (entryRoots := fun _ _ => [])
+  · rfl
+  · simp [Alt.cidx]
+  · exact fixture_nat_succ_alt_contract n literal
+  · exact ⟨rfl, rfl⟩
+  · exact RootOwnership.empty
+  · exact hrun
+
+/-! ## Contentful semantic-projection instances
+
+Both fixtures run the real lowerer on a real expression and apply the
+semantic projection theorem to that exact output, so neither the run nor the
+`SourceProject` premise is assumed. The source environment holds a
+two-field constructor, and the selected field is the *second* one, so a
+field-index-blind proof could not close them. -/
+
+/-- Final-use projection: the single source occurrence is consumed, so the
+compiler emits `fetch`, `dup`, and the destructive `drop` of the pair, and
+the theorem still returns the selected field's graph after the release. -/
+theorem fixture_proj_var_final_use_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} (src : IxIR0.Env) (fuel : Nat)
+    (state : LowSt) (address : Ixon.Address) (tag : Nat)
+    (first second : IxIR0.Value) :
+    ∃ output emit av,
+      (lowerE src (fuel + 2) ⟨[.slot 0 1 .many true], 1⟩ .shared
+        (.proj 1 (.var 0))).run state = .ok (output, emit, av) state ∧
+      LowerResultValueSound funRel recSelfRel ctx cur
+        ⟨[.slot 0 1 .many true], 1⟩ output
+        [.ctor address tag [first, second]]
+        [.ctor address tag [first, second]] second .shared emit av := by
+  obtain ⟨output, emit, av, hrun⟩ :
+      ∃ output emit av,
+        (lowerE src (fuel + 2) ⟨[.slot 0 1 .many true], 1⟩ .shared
+          (.proj 1 (.var 0))).run state = .ok (output, emit, av) state := by
+    simp [lowerE, lowerBorrow, worldOfUses, VEnv.setEntry, VEnv.bump,
+      VEnv.rel, Function.comp_def, emitOp]
+  exact ⟨output, emit, av, hrun,
+    lowerE_proj_var_run_value_sound (i := 0) rfl (.ctor rfl) hrun⟩
+
+/-- Repeated-use projection: one source occurrence survives, so the pair
+stays owned by the output environment and no `drop` is emitted. -/
+theorem fixture_proj_var_kept_value_sound
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} (src : IxIR0.Env) (fuel : Nat)
+    (state : LowSt) (address : Ixon.Address) (tag : Nat)
+    (first second : IxIR0.Value) :
+    ∃ output emit av,
+      (lowerE src (fuel + 2) ⟨[.slot 0 2 .many true], 1⟩ .shared
+        (.proj 1 (.var 0))).run state = .ok (output, emit, av) state ∧
+      LowerResultValueSound funRel recSelfRel ctx cur
+        ⟨[.slot 0 2 .many true], 1⟩ output
+        [.ctor address tag [first, second]]
+        [.ctor address tag [first, second]] second .shared emit av := by
+  obtain ⟨output, emit, av, hrun⟩ :
+      ∃ output emit av,
+        (lowerE src (fuel + 2) ⟨[.slot 0 2 .many true], 1⟩ .shared
+          (.proj 1 (.var 0))).run state = .ok (output, emit, av) state := by
+    simp [lowerE, lowerBorrow, worldOfUses, VEnv.setEntry, VEnv.bump,
+      VEnv.rel, Function.comp_def, emitOp]
+  exact ⟨output, emit, av, hrun,
+    lowerE_proj_var_run_value_sound (i := 0) rfl (.ctor rfl) hrun⟩
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/LowerStateBase.lean b/Ix/Compiler/IxIR1/LowerStateBase.lean
new file mode 100644
index 000000000..dd9f7d791
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerStateBase.lean
@@ -0,0 +1,3277 @@
+import Ix.Compiler.IxIR1.Lower
+
+/-!
+# Structural compile-environment invariants
+
+State-only facts needed by the semantic lowering proof, kept below
+`LowerSim` in the import graph.  In particular, ordinary function bodies
+start without the synthetic recursor-self entry and successful lowering
+never invents one.
+-/
+
+namespace Ix.Compiler.IxIR1.Lower
+
+open Ix.Compiler.Ixon (Owned Uses)
+
+/-- No logical entry advertises the recursor-only `callSelf` capability. -/
+def NoRecSelf (input : VEnv) : Prop :=
+  ∀ (index arity : Nat),
+    input.entries[index]? ≠ some (VEntry.recSelf arity)
+
+theorem NoRecSelf.empty : NoRecSelf ⟨[], depth⟩ := by
+  intro index arity
+  simp
+
+theorem NoRecSelf.bump {input : VEnv} (h : NoRecSelf input) :
+    NoRecSelf input.bump := by
+  simpa [NoRecSelf, VEnv.bump] using h
+
+theorem NoRecSelf.setSlot {input : VEnv} (h : NoRecSelf input)
+    (changed abs remaining : Nat) (uses : Uses) (held : Bool) :
+    NoRecSelf
+      (input.setEntry changed (.slot abs remaining uses held)) := by
+  intro index arity hentry
+  by_cases heq : changed = index
+  · subst index
+    rw [VEnv.setEntry, List.getElem?_set] at hentry
+    simp at hentry
+  · rw [VEnv.setEntry, List.getElem?_set] at hentry
+    simp [heq] at hentry
+    exact h index arity hentry
+
+theorem NoRecSelf.consSlot {input : VEnv} (h : NoRecSelf input)
+    (abs remaining : Nat) (uses : Uses) (held : Bool) :
+    NoRecSelf
+      { input with
+        entries := .slot abs remaining uses held :: input.entries } := by
+  intro index arity hentry
+  cases index with
+  | zero => simp at hentry
+  | succ index =>
+    exact h index arity (by simpa using hentry)
+
+theorem NoRecSelf.pop {input : VEnv} (h : NoRecSelf input) :
+    NoRecSelf input.pop := by
+  intro index arity hentry
+  exact h (index + 1) arity (by simpa [VEnv.pop] using hentry)
+
+theorem NoRecSelf.of_entries_eq {input output : VEnv}
+    (h : NoRecSelf input) (hentries : output.entries = input.entries) :
+    NoRecSelf output := by
+  simpa [NoRecSelf, hentries] using h
+
+theorem NoRecSelf.of_mem_not_recSelf (input : VEnv)
+    (hentries : ∀ entry ∈ input.entries, ∀ arity,
+      entry ≠ VEntry.recSelf arity) :
+    NoRecSelf input := by
+  intro index arity hentry
+  obtain ⟨hindex, heq⟩ := List.getElem?_eq_some_iff.mp hentry
+  have hmember : VEntry.recSelf arity ∈ input.entries := by
+    rw [← heq]
+    exact List.getElem_mem hindex
+  exact hentries (.recSelf arity) hmember arity rfl
+
+private theorem parameterEntries_mem_not_recSelf (base : Nat) :
+    ∀ (modes : List Uses) (remaining : Nat → Nat) entry,
+      entry ∈ parameterEntries base modes remaining →
+      ∀ arity, entry ≠ VEntry.recSelf arity := by
+  intro modes remaining
+  exact parameterEntries_traverse remaining
+    (Result := fun _ _ entries =>
+      ∀ entry ∈ entries, ∀ arity, entry ≠ VEntry.recSelf arity)
+    (hnil := by
+      intro current entry hmember
+      simp at hmember)
+    (hcons := by
+      intro current mode rest tail htail entry hmember arity heq
+      rw [List.mem_append] at hmember
+      cases hmember with
+      | inl hinner => exact htail entry hinner arity heq
+      | inr hlast =>
+        simp only [List.mem_singleton] at hlast
+        subst entry
+        contradiction)
+    base modes
+
+/-- Canonical ordinary-function parameter layouts contain only slots. -/
+theorem parameterEntries_noRecSelf (base : Nat) (modes : List Uses)
+    (remaining : Nat → Nat) (depth : Nat) :
+    NoRecSelf ⟨parameterEntries base modes remaining, depth⟩ := by
+  apply NoRecSelf.of_mem_not_recSelf
+  intro entry hmember arity
+  exact parameterEntries_mem_not_recSelf base modes remaining entry hmember
+    arity
+
+/-- Foundational dependent traversal for the pure `releaseAll` fold.  Empty,
+constant, and slot normalization plus environment and emitter threading
+recurse once; clients provide only their three result constructors. -/
+theorem releaseAll_traverse_core
+    {Result : VEnv → List AVal → VEnv → Emit → Prop}
+    (hnil : ∀ input,
+      Result input [] input (_root_.id : Emit))
+    (hconst : ∀ {input : VEnv} {atom : Atom} {rest : List AVal}
+        {output : VEnv} {emit : Emit},
+      Result input rest output emit →
+      Result input (.constA atom :: rest) output emit)
+    (hslot : ∀ {input : VEnv} {abs : Nat} {rest : List AVal}
+        {output : VEnv} {tailEmit : Emit},
+      Result input.bump rest output tailEmit →
+      Result input (.slotA abs :: rest) output
+        (emitOp (.drop (.var (input.rel abs))) ∘ tailEmit))
+    (input : VEnv) (values : List AVal) :
+    Result input values (releaseAll input values).1
+      (releaseAll input values).2 := by
+  induction values generalizing input with
+  | nil => exact hnil input
+  | cons value rest ih =>
+    cases value with
+    | constA atom =>
+      simpa [releaseAll] using hconst (ih input)
+    | slotA abs =>
+      simpa [releaseAll] using hslot (ih input.bump)
+
+theorem NoRecSelf.releaseAll (input : VEnv) (values : List AVal)
+    (h : NoRecSelf input) :
+    NoRecSelf (releaseAll input values).1 := by
+  exact releaseAll_traverse_core
+    (Result := fun initial _ output _ =>
+      NoRecSelf initial → NoRecSelf output)
+    (hnil := fun _ hinitial => hinitial)
+    (hconst := fun htail hinitial => htail hinitial)
+    (hslot := fun htail hinitial => htail hinitial.bump)
+    input values h
+
+private theorem throw_run_not_ok {α : Type} {message : String}
+    {initial final : LowSt} {result : α}
+    (hrun : (throw message : LowerM α).run initial = .ok result final) :
+    False := by
+  change EStateM.Result.error message initial = .ok result final at hrun
+  contradiction
+
+private theorem bind_run_ok_inv {error state α β : Type}
+    {action : EStateM error state α} {next : α → EStateM error state β}
+    {initial final : state} {result : β}
+    (hrun : (action >>= next).run initial = .ok result final) :
+    ∃ value middle,
+      action.run initial = .ok value middle ∧
+      (next value).run middle = .ok result final := by
+  change
+    (match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error err nextState => .error err nextState) =
+      .ok result final at hrun
+  cases haction : action.run initial with
+  | ok value middle =>
+    rw [haction] at hrun
+    exact ⟨value, middle, rfl, hrun⟩
+  | error err middle =>
+    rw [haction] at hrun
+    contradiction
+
+/-- Source-neutral operational traversal for a successful `lowerCaptures`
+run.  Empty recovery, both bind inversions, compiler-state threading, and
+final tuple reconstruction happen once; clients supply only their empty
+judgment and one successful-capture composition step. -/
+theorem lowerCaptures_run_core
+    (e : IxIR0.Expr)
+    {Result : VEnv → VEnv → List Nat → Emit → List AVal → Prop}
+    (hnil : ∀ input,
+      Result input input [] (_root_.id : Emit) [])
+    (hcons : ∀ {index : Nat} {rest : List Nat}
+        {input middle output : VEnv} {headEmit tailEmit : Emit}
+        {headValue : AVal} {tailValues : List AVal}
+        {state middleState : LowSt},
+      (lowerCapture e input index).run state =
+        .ok (middle, headEmit, headValue) middleState →
+      Result middle output rest tailEmit tailValues →
+      Result input output (index :: rest) (headEmit ∘ tailEmit)
+        (headValue :: tailValues))
+    {captures : List Nat} {input output : VEnv}
+    {emit : Emit} {values : List AVal} {state finalState : LowSt}
+    (hrun : (lowerCaptures e input captures).run state =
+      .ok (output, emit, values) finalState) :
+    Result input output captures emit values := by
+  induction captures generalizing input output emit values state finalState with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, values) ∧
+          state = finalState := by
+      simpa [lowerCaptures] using hrun
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    exact hnil _
+  | cons index rest ih =>
+    simp only [lowerCaptures] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      bind_run_ok_inv hrun
+    rcases headResult with ⟨middle, headEmit, headValue⟩
+    obtain ⟨tailResult, tailState, htailRun, hafterTail⟩ :=
+      bind_run_ok_inv hafterHead
+    rcases tailResult with ⟨tailOutput, tailEmit, tailValues⟩
+    have hpure :
+        (tailOutput, headEmit ∘ tailEmit, headValue :: tailValues) =
+            (output, emit, values) ∧ tailState = finalState := by
+      simpa using hafterTail
+    obtain ⟨hresult, hstate⟩ := hpure
+    cases hresult
+    subst finalState
+    exact hcons hheadRun (ih htailRun)
+
+/-- Property-polymorphic action traversal for `lowerCaptures`.  Its
+left-to-right `lowerCapture` sequencing and final pure tuple construction
+recurse once for every action invariant closed under `pure` and `bind`. -/
+theorem lowerCaptures_action_core
+    (e : IxIR0.Expr)
+    {ActionProperty : {α : Type} → LowerM α → Prop}
+    (hpure : ∀ {α : Type} (value : α),
+      ActionProperty (pure value : LowerM α))
+    (hbind : ∀ {α β : Type} {action : LowerM α}
+        {next : α → LowerM β},
+      ActionProperty action →
+      (∀ value, ActionProperty (next value)) →
+      ActionProperty (action >>= next))
+    (hcapture : ∀ input index,
+      ActionProperty (lowerCapture e input index)) :
+    ∀ (input : VEnv) (captures : List Nat),
+      ActionProperty (lowerCaptures e input captures) := by
+  intro input captures
+  induction captures generalizing input with
+  | nil =>
+    change ActionProperty
+      (pure (input, (_root_.id : Emit), ([] : List AVal)) :
+        LowerM (VEnv × Emit × List AVal))
+    exact hpure _
+  | cons index rest ih =>
+    simp only [lowerCaptures]
+    apply hbind (hcapture input index)
+    intro headResult
+    rcases headResult with ⟨middle, headEmit, headValue⟩
+    apply hbind (ih middle)
+    intro tailResult
+    rcases tailResult with ⟨output, tailEmit, tailValues⟩
+    exact hpure
+      (output, headEmit ∘ tailEmit, headValue :: tailValues)
+
+private theorem map_run_ok_inv {α β : Type} {action : LowerM α}
+    {f : α → β} {initial final : LowSt} {result : β}
+    (hrun : (f <$> action).run initial = .ok result final) :
+    ∃ value,
+      action.run initial = .ok value final ∧ f value = result := by
+  have hbind : (action >>= fun value => pure (f value)).run initial =
+      .ok result final := by
+    simpa only [bind_pure_comp] using hrun
+  obtain ⟨value, middle, haction, hpure⟩ := bind_run_ok_inv hbind
+  have hresult : f value = result ∧ middle = final := by
+    simpa using hpure
+  cases hresult.2
+  exact ⟨value, haction, hresult.1⟩
+
+/-- Source-neutral operational traversal for a successful `releaseSlots`
+run.  Mode rejection, environment rewriting, depth advancement, tail-run
+recovery, and emitter composition recurse once; clients supply only their
+empty, affine-drop, and shared-drop judgments. -/
+theorem releaseSlots_run_core
+    {Result : VEnv → VEnv → List SlotDrop → Emit → Prop}
+    (hnil : ∀ input,
+      Result input input [] (_root_.id : Emit))
+    (haffine : ∀ {entry abs : Nat} {rest : List SlotDrop}
+        {input output : VEnv} {tailEmit : Emit},
+      Result
+        (input.setEntry entry (.slot abs 0 .affine false)).bump
+        output rest tailEmit →
+      Result input output
+        (⟨entry, abs, .affine⟩ :: rest)
+        (emitOp (.dropU (.var (input.rel abs))) ∘ tailEmit))
+    (hmany : ∀ {entry abs : Nat} {rest : List SlotDrop}
+        {input output : VEnv} {tailEmit : Emit},
+      Result
+        (input.setEntry entry (.slot abs 0 .many false)).bump
+        output rest tailEmit →
+      Result input output
+        (⟨entry, abs, .many⟩ :: rest)
+        (emitOp (.drop (.var (input.rel abs))) ∘ tailEmit))
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    {state finalState : LowSt}
+    (hrun : (releaseSlots input drops).run state =
+      .ok (output, emit) finalState) :
+    Result input output drops emit := by
+  induction drops generalizing input output emit state finalState with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit)) = (output, emit) ∧
+          state = finalState := by
+      simpa [releaseSlots] using hrun
+    obtain ⟨hresult, _⟩ := hpure
+    cases hresult
+    exact hnil input
+  | cons drop rest ih =>
+    rcases drop with ⟨entry, abs, uses⟩
+    cases uses with
+    | erased =>
+      obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv (by
+        simpa [releaseSlots] using hrun)
+      exact (throw_run_not_ok hthrow).elim
+    | linear =>
+      obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv (by
+        simpa [releaseSlots] using hrun)
+      exact (throw_run_not_ok hthrow).elim
+    | affine =>
+      have hmap :
+          ((fun result : VEnv × Emit =>
+              (result.1,
+                emitOp (.dropU (.var (input.rel abs))) ∘ result.2)) <$>
+            releaseSlots
+              (input.setEntry entry
+                (.slot abs 0 .affine false)).bump rest).run state =
+            .ok (output, emit) finalState := by
+        simpa [releaseSlots] using hrun
+      obtain ⟨tailResult, htailRun, hvalue⟩ := map_run_ok_inv hmap
+      rcases tailResult with ⟨actualOutput, tailEmit⟩
+      have houtput : actualOutput = output := congrArg Prod.fst hvalue
+      have hemit :
+          emitOp (.dropU (.var (input.rel abs))) ∘ tailEmit = emit :=
+        congrArg Prod.snd hvalue
+      subst output
+      subst emit
+      exact haffine (ih htailRun)
+    | many =>
+      have hmap :
+          ((fun result : VEnv × Emit =>
+              (result.1,
+                emitOp (.drop (.var (input.rel abs))) ∘ result.2)) <$>
+            releaseSlots
+              (input.setEntry entry
+                (.slot abs 0 .many false)).bump rest).run state =
+            .ok (output, emit) finalState := by
+        simpa [releaseSlots] using hrun
+      obtain ⟨tailResult, htailRun, hvalue⟩ := map_run_ok_inv hmap
+      rcases tailResult with ⟨actualOutput, tailEmit⟩
+      have houtput : actualOutput = output := congrArg Prod.fst hvalue
+      have hemit :
+          emitOp (.drop (.var (input.rel abs))) ∘ tailEmit = emit :=
+        congrArg Prod.snd hvalue
+      subst output
+      subst emit
+      exact hmany (ih htailRun)
+
+/-- Property-polymorphic action traversal for `releaseSlots`.  Its mode
+dispatch, state-free head action, environment threading, tail action, and
+pure emitter assembly recurse once for every property closed under `pure`,
+`bind`, and an immediately throwing bind. -/
+theorem releaseSlots_action_core
+    {ActionProperty : {α : Type} → LowerM α → Prop}
+    (hpure : ∀ {α : Type} (value : α),
+      ActionProperty (pure value : LowerM α))
+    (hbind : ∀ {α β : Type} {action : LowerM α}
+        {next : α → LowerM β},
+      ActionProperty action →
+      (∀ value, ActionProperty (next value)) →
+      ActionProperty (action >>= next))
+    (hthrowBind : ∀ {α β : Type} (message : String)
+        (next : α → LowerM β),
+      ActionProperty
+        ((EStateM.throw message : LowerM α) >>= next)) :
+    ∀ (input : VEnv) (drops : List SlotDrop),
+      ActionProperty (releaseSlots input drops) := by
+  intro input drops
+  induction drops generalizing input with
+  | nil =>
+    change ActionProperty
+      (pure (input, (_root_.id : Emit)) : LowerM (VEnv × Emit))
+    exact hpure _
+  | cons drop rest ih =>
+    simp only [releaseSlots]
+    cases drop.uses with
+    | erased => exact hthrowBind _ _
+    | linear => exact hthrowBind _ _
+    | affine =>
+      apply hbind (hpure _)
+      intro headEmit
+      apply hbind
+        (ih (input.setEntry drop.entry
+          (.slot drop.abs 0 .affine false)).bump)
+      intro tailResult
+      rcases tailResult with ⟨output, tailEmit⟩
+      exact hpure (output, headEmit ∘ tailEmit)
+    | many =>
+      apply hbind (hpure _)
+      intro headEmit
+      apply hbind
+        (ih (input.setEntry drop.entry
+          (.slot drop.abs 0 .many false)).bump)
+      intro tailResult
+      rcases tailResult with ⟨output, tailEmit⟩
+      exact hpure (output, headEmit ∘ tailEmit)
+
+theorem releaseSlots_noRecSelf (input : VEnv) :
+    ∀ {drops output emit state finalState},
+      (releaseSlots input drops).run state =
+        .ok (output, emit) finalState →
+      NoRecSelf input → NoRecSelf output := by
+  intro drops output emit state finalState hrun hno
+  exact releaseSlots_run_core
+    (Result := fun initial final _ _ =>
+      NoRecSelf initial → NoRecSelf final)
+    (hnil := fun _ h => h)
+    (haffine := by
+      intro entry abs rest initial final tailEmit htail hinitial
+      exact htail
+        (hinitial.setSlot entry abs 0 .affine false).bump)
+    (hmany := by
+      intro entry abs rest initial final tailEmit htail hinitial
+      exact htail
+        (hinitial.setSlot entry abs 0 .many false).bump)
+    hrun hno
+
+theorem lowerCapture_noRecSelf (expr : IxIR0.Expr) (input : VEnv)
+    (index : Nat) {output : VEnv} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState)
+    (hno : NoRecSelf input) : NoRecSelf output := by
+  cases hentry : input.entries[index]? with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (hno index arity hentry).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact (throw_run_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          exact (throw_run_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses index expr
+          · have houtput : output =
+                (input.setEntry index
+                  (.slot abs (remaining - countUses index expr) uses true)).bump := by
+              have hvalue := congrArg
+                (fun result : EStateM.Result String LowSt
+                    (VEnv × Emit × AVal) =>
+                  match result with
+                  | .ok value _ => value.1
+                  | .error _ _ => input) hrun
+              simpa [lowerCapture, hentry, huniqueEq, hmore] using hvalue.symm
+            subst output
+            exact (hno.setSlot index abs
+              (remaining - countUses index expr) uses true).bump
+          · by_cases hequal : remaining = countUses index expr
+            · have houtput : output =
+                  input.setEntry index (.slot abs 0 uses false) := by
+                have hvalue := congrArg
+                  (fun result : EStateM.Result String LowSt
+                      (VEnv × Emit × AVal) =>
+                    match result with
+                    | .ok value _ => value.1
+                    | .error _ _ => input) hrun
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hvalue.symm
+              subst output
+              exact hno.setSlot index abs 0 uses false
+            · exact (throw_run_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_noRecSelf (expr : IxIR0.Expr) :
+    ∀ {indices input output emit values state finalState},
+      (lowerCaptures expr input indices).run state =
+        .ok (output, emit, values) finalState →
+      NoRecSelf input → NoRecSelf output := by
+  intro indices input output emit values state finalState hrun
+  apply lowerCaptures_run_core
+    (Result := fun input output _ _ _ =>
+      NoRecSelf input → NoRecSelf output)
+    (e := expr) (hrun := hrun)
+  · intro input hno
+    exact hno
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail hno
+    exact htail
+      (lowerCapture_noRecSelf expr input index hheadRun hno)
+
+def LowerEPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState →
+    NoRecSelf input → NoRecSelf output
+
+def LowerBorrowPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {release : Bool},
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, value, release) finalState →
+    NoRecSelf input → NoRecSelf output
+
+def LowerSpinePreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {head : IxIR0.Expr}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, value) finalState →
+    NoRecSelf input → NoRecSelf output
+
+def KnownCallPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {build : Array Atom → Op} {count : Nat}
+      {argWorlds : List Owned} {resultWorld : Owned}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (knownCall src fuel input build count argWorlds resultWorld args).run
+      state = .ok (output, emit, value) finalState →
+    NoRecSelf input → NoRecSelf output
+
+def LowerArgsPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {args : List (IxIR0.Expr × Owned)}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {values : List AVal},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, values) finalState →
+    NoRecSelf input → NoRecSelf output
+
+def ApplyRestPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {resultWorld : Owned} {pre : Emit}
+      {function : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {value : AVal},
+    (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, value) finalState →
+    NoRecSelf input → NoRecSelf output
+
+def LowerLamPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState →
+    NoRecSelf input → NoRecSelf output
+
+structure LowerPreservesNoRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEPreservesNoRecSelf src fuel
+  borrow : LowerBorrowPreservesNoRecSelf src fuel
+  spine : LowerSpinePreservesNoRecSelf src fuel
+  knownCall : KnownCallPreservesNoRecSelf src fuel
+  args : LowerArgsPreservesNoRecSelf src fuel
+  applyRest : ApplyRestPreservesNoRecSelf src fuel
+  lam : LowerLamPreservesNoRecSelf src fuel
+
+theorem lowerPreservesNoRecSelf_zero (src : IxIR0.Env) :
+    LowerPreservesNoRecSelf src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr state finalState output emit value hrun _
+    exact (throw_run_not_ok (by simpa [lowerE] using hrun)).elim
+  · intro input expr state finalState output emit value release hrun _
+    exact (throw_run_not_ok (by simpa [lowerBorrow] using hrun)).elim
+  · intro input world head args state finalState output emit value hrun _
+    exact (throw_run_not_ok (by simpa [lowerSpine] using hrun)).elim
+  · intro input build count argWorlds resultWorld args state finalState
+      output emit value hrun _
+    exact (throw_run_not_ok (by simpa [knownCall] using hrun)).elim
+  · intro input args state finalState output emit values hrun _
+    exact (throw_run_not_ok (by simpa [lowerArgs] using hrun)).elim
+  · intro input resultWorld pre function args state finalState output emit
+      value hrun _
+    exact (throw_run_not_ok (by simpa [applyRest] using hrun)).elim
+  · intro input expr state finalState output emit value hrun _
+    exact (throw_run_not_ok (by simpa [lowerLam] using hrun)).elim
+
+theorem lowerArgsPreservesNoRecSelf_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    (hargs : LowerArgsPreservesNoRecSelf src fuel) :
+    LowerArgsPreservesNoRecSelf src (fuel + 1) := by
+  intro input args state finalState output emit values hrun hno
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, values) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    cases hpure.1
+    exact hno
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      bind_run_ok_inv hrun
+    rcases headResult with ⟨middle, headEmit, headValue⟩
+    obtain ⟨tailResult, tailState, htailRun, hafterTail⟩ :=
+      bind_run_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, tailEmit, tailValues⟩
+    have hvalue : actualOutput = output := by
+      have hpure :
+          (actualOutput, headEmit ∘ tailEmit, headValue :: tailValues) =
+              (output, emit, values) ∧ tailState = finalState := by
+        simpa using hafterTail
+      exact congrArg Prod.fst hpure.1
+    subst output
+    exact hargs htailRun (hexpr hheadRun hno)
+
+theorem applyRestPreservesNoRecSelf_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesNoRecSelf src fuel) :
+    ApplyRestPreservesNoRecSelf src (fuel + 1) := by
+  intro input resultWorld pre function args state finalState output emit value
+    hrun hno
+  cases function with
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest] at hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hrun
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hpure : (releaseAll middle values).1 = output := by
+        have hvalue :
+            ((releaseAll middle values).1,
+              pre ∘ argsEmit ∘ (releaseAll middle values).2,
+              AVal.constA .erased) = (output, emit, value) ∧
+              argsState = finalState := by
+          simpa using hpureRun
+        exact congrArg Prod.fst hvalue.1
+      subst output
+      exact (hargs hargsRun hno).releaseAll middle values
+    | var relative =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have houtput : middle.bump = output := by
+        have hvalue := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1
+            | .error _ _ => input) hpureRun
+        simpa using hvalue
+      subst output
+      exact (hargs hargsRun hno).bump
+    | lit literal =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have houtput : middle.bump = output := by
+        have hvalue := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1
+            | .error _ _ => input) hpureRun
+        simpa using hvalue
+      subst output
+      exact (hargs hargsRun hno).bump
+  | slotA abs =>
+    simp only [applyRest] at hrun
+    obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      bind_run_ok_inv hafterCheck
+    rcases argsResult with ⟨middle, argsEmit, values⟩
+    have houtput : middle.bump = output := by
+      have hvalue := congrArg
+        (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+          match result with
+          | .ok value _ => value.1
+          | .error _ _ => input) hpureRun
+      simpa using hvalue
+    subst output
+    exact (hargs hargsRun hno).bump
+
+theorem knownCallPreservesNoRecSelf_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesNoRecSelf src fuel)
+    (hrest : ApplyRestPreservesNoRecSelf src fuel) :
+    KnownCallPreservesNoRecSelf src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args state finalState output
+    emit value hrun hno
+  simp only [knownCall] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hafterArgs⟩ :=
+    bind_run_ok_inv hrun
+  rcases argsResult with ⟨middle, argsEmit, values⟩
+  have hmiddle := hargs hargsRun hno
+  by_cases hterminal : args.length ≤ count
+  · have houtput : middle.bump = output := by
+      have hvalue := congrArg
+        (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+          match result with
+          | .ok value _ => value.1
+          | .error _ _ => input) hafterArgs
+      simpa [hterminal] using hvalue
+    subst output
+    exact hmiddle.bump
+  · have hrestRun :
+        (applyRest src fuel middle.bump resultWorld
+          (argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray))
+          (.slotA middle.depth) (args.drop count)).run argsState =
+            .ok (output, emit, value) finalState := by
+      simpa [hterminal] using hafterArgs
+    exact hrest hrestRun hmiddle.bump
+
+private theorem lowerBorrow_dynamic_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {releaseFlag : Bool}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal × Bool)}
+    (hrun : (finish <$> lowerE src fuel input .shared expr).run state =
+        .ok (output, emit, value, releaseFlag) finalState)
+    (hfinish : ∀ result, (finish result).1 = result.1)
+    (hno : NoRecSelf input) : NoRecSelf output := by
+  obtain ⟨exprResult, hexprRun, hvalue⟩ := map_run_ok_inv hrun
+  rcases exprResult with ⟨middle, middleEmit, middleValue⟩
+  have houtput : middle = output := by
+    have := congrArg Prod.fst hvalue
+    simpa [hfinish] using this
+  subst output
+  exact hexpr hexprRun hno
+
+theorem lowerBorrowPreservesNoRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel) :
+    LowerBorrowPreservesNoRecSelf src (fuel + 1) := by
+  intro input expr state finalState output emit value release hrun hno
+  cases expr with
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none => exact (throw_run_not_ok (by
+        simpa [lowerBorrow, hentry] using hrun)).elim
+    | some entry =>
+      cases entry with
+      | recSelf arity => exact (hno index arity hentry).elim
+      | slot abs remaining uses held =>
+        cases held with
+        | false => exact (throw_run_not_ok (by
+            simpa [lowerBorrow, hentry] using hrun)).elim
+        | true =>
+          by_cases hunique : worldOfUses uses = .unique
+          · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+            exact (throw_run_not_ok (by
+              simpa [lowerBorrow, hentry, hunique, huuEq] using hrun)).elim
+          · have huniqueEq :
+                (worldOfUses uses == Owned.unique) = false := by
+              cases uses <;> simp_all [worldOfUses] <;> decide
+            cases remaining with
+            | zero => exact (throw_run_not_ok (by
+                simpa [lowerBorrow, hentry, huniqueEq] using hrun)).elim
+            | succ remaining =>
+              cases remaining with
+              | zero =>
+                have hpure :
+                    (input.setEntry index (.slot abs 0 uses false),
+                      (_root_.id : Emit), AVal.slotA abs, true) =
+                        (output, emit, value, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, huniqueEq] using hrun
+                cases hpure.1
+                exact hno.setSlot index abs 0 uses false
+              | succ remaining =>
+                have hpure :
+                    (input.setEntry index
+                        (.slot abs (remaining + 1) uses true),
+                      (_root_.id : Emit), AVal.slotA abs, false) =
+                        (output, emit, value, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, huniqueEq] using hrun
+                cases hpure.1
+                exact hno.setSlot index abs (remaining + 1) uses true
+  | ref address =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+  | app function argument =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+  | lam uses body =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+  | letE uses value body =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+  | proj index source =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+  | lit literal =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+  | erased =>
+    apply lowerBorrow_dynamic_noRecSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hno
+
+private theorem lowerE_applyRest_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    (hrest : ApplyRestPreservesNoRecSelf src fuel)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (do
+      let (middle, headEmit, function) ←
+        lowerE src fuel input .shared head
+      applyRest src fuel middle world headEmit function args).run state =
+        .ok (output, emit, value) finalState)
+    (hno : NoRecSelf input) : NoRecSelf output := by
+  obtain ⟨headResult, middleState, hheadRun, hrestRun⟩ :=
+    bind_run_ok_inv hrun
+  rcases headResult with ⟨middle, headEmit, function⟩
+  exact hrest hrestRun (hexpr hheadRun hno)
+
+theorem lowerSpinePreservesNoRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    (hspine : LowerSpinePreservesNoRecSelf src fuel)
+    (hknown : KnownCallPreservesNoRecSelf src fuel)
+    (hrest : ApplyRestPreservesNoRecSelf src fuel) :
+    LowerSpinePreservesNoRecSelf src (fuel + 1) := by
+  intro input world head args state finalState output emit value hrun hno
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases head with
+  | app function argument =>
+    apply hspine
+    · simpa [lowerSpine] using hrun
+    · exact hno
+  | erased =>
+    apply hrest
+    · simpa [lowerSpine] using hrun
+    · exact hno
+  | var index =>
+    simp only [lowerSpine] at hrun
+    cases hentry : input.entries[index]? with
+    | none =>
+      apply lowerE_applyRest_noRecSelf hexpr hrest
+      · simpa [hentry] using hrun
+      · exact hno
+    | some entry =>
+      cases entry with
+      | recSelf arity => exact (hno index arity hentry).elim
+      | slot abs remaining uses held =>
+        apply lowerE_applyRest_noRecSelf hexpr hrest
+        · simpa [hentry] using hrun
+        · exact hno
+  | ref address =>
+    simp only [lowerSpine] at hrun
+    cases hsource : src address with
+    | none =>
+      rw [hsource] at hrun
+      exact (throw_run_not_ok hrun).elim
+    | some decl =>
+      rw [hsource] at hrun
+      cases decl with
+      | defn result body =>
+        simp only at hrun
+        by_cases hunder : args.length < lamArity body
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared =>
+            cases result with
+            | unique => exact (throw_run_not_ok hrun).elim
+            | shared =>
+              cases hp : papSafe body with
+              | false => exact (throw_run_not_ok (by
+                  simpa [hp, hsuEq] using hrun)).elim
+              | true =>
+                apply hknown
+                · simpa [hp, hsuEq] using hrun
+                · exact hno
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, checkedState, _, hknownRun⟩ := bind_run_ok_inv hrun
+          exact hknown hknownRun hno
+      | ctor tag arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared =>
+            obtain ⟨wrapper, wrapperState, _, hknownRun⟩ :=
+              bind_run_ok_inv hrun
+            exact hknown hknownRun hno
+        · rw [if_neg hunder] at hrun
+          exact hknown hrun hno
+      | recursor numArgs natLit rules =>
+        simp only at hrun
+        by_cases hunder : args.length < numArgs + 1
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared => exact hknown hrun hno
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, checkedState, _, hknownRun⟩ := bind_run_ok_inv hrun
+          exact hknown hknownRun hno
+      | extern arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared => exact hknown hrun hno
+        · rw [if_neg hunder] at hrun
+          exact hknown hrun hno
+  | lam uses body =>
+    apply lowerE_applyRest_noRecSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hno
+  | letE uses bound body =>
+    apply lowerE_applyRest_noRecSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hno
+  | proj index source =>
+    apply lowerE_applyRest_noRecSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hno
+  | lit literal =>
+    apply lowerE_applyRest_noRecSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hno
+
+theorem lowerLamPreservesNoRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat} :
+    LowerLamPreservesNoRecSelf src (fuel + 1) := by
+  intro input expr state finalState output emit value hrun hno
+  cases hp : papSafe expr with
+  | false => simp [lowerLam, hp] at hrun
+  | true =>
+    simp only [lowerLam] at hrun
+    simp only [hp, ↓reduceIte, bind_pure_comp] at hrun
+    let captures := (List.range input.entries.length).filter
+      (fun index => countUses index expr > 0)
+    have hcaptures : captures = (List.range input.entries.length).filter
+        (fun index => countUses index expr > 0) := rfl
+    rw [← hcaptures] at hrun
+    obtain ⟨captureResult, captureState, hcaptureRun, hafterCapture⟩ :=
+      bind_run_ok_inv hrun
+    rcases captureResult with ⟨captureOutput, captureEmit, captureValues⟩
+    obtain ⟨fnAddr, addressState, _, hafterFresh⟩ :=
+      bind_run_ok_inv hafterCapture
+    obtain ⟨code, bodyState, _, hafterBody⟩ :=
+      bind_run_ok_inv hafterFresh
+    obtain ⟨_, _, hvalue⟩ := map_run_ok_inv hafterBody
+    have houtput : captureOutput.bump = output := by
+      exact congrArg Prod.fst hvalue
+    subst output
+    exact (lowerCaptures_noRecSelf expr hcaptureRun hno).bump
+
+private theorem lowerE_ref_entries_eq_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {address : Ixon.Address}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.ref address)).run state =
+      .ok (output, emit, value) finalState) :
+    output.entries = input.entries := by
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases hsource : src address with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerE, hsource] using hrun)).elim
+  | some decl =>
+    cases decl with
+    | defn result body =>
+      cases harity : lamArity body with
+      | zero =>
+        have hrun' := hrun
+        simp only [lowerE, hsource, harity] at hrun'
+        obtain ⟨_, checkedState, _, hpureRun⟩ := bind_run_ok_inv hrun'
+        have houtput := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1.entries
+            | .error _ _ => []) hpureRun
+        simpa [VEnv.bump] using houtput.symm
+      | succ arity =>
+        cases world with
+        | unique => exact (throw_run_not_ok (by
+            simpa [lowerE, hsource, harity, huuEq] using hrun)).elim
+        | shared =>
+          cases result with
+          | unique => exact (throw_run_not_ok (by
+              simpa [lowerE, hsource, harity, hsuEq, huuEq]
+                using hrun)).elim
+          | shared =>
+            cases hp : papSafe body with
+            | false => exact (throw_run_not_ok (by
+                simpa [lowerE, hsource, harity, hsuEq, hp]
+                  using hrun)).elim
+            | true =>
+              have hpure := hrun
+              simp [lowerE, hsource, harity, hsuEq, hp] at hpure
+              rw [← hpure.1.1]
+              rfl
+    | ctor tag arity =>
+      cases arity with
+      | zero =>
+        have hpure := hrun
+        simp [lowerE, hsource] at hpure
+        rw [← hpure.1.1]
+        rfl
+      | succ arity =>
+        cases world with
+        | unique => exact (throw_run_not_ok (by
+            simpa [lowerE, hsource, huuEq] using hrun)).elim
+        | shared =>
+          have hrun' := hrun
+          simp only [lowerE, hsource, hsuEq, Bool.false_eq_true,
+            if_false] at hrun'
+          obtain ⟨wrapper, wrapperState, _, hpureRun⟩ :=
+            bind_run_ok_inv hrun'
+          have houtput := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1.entries
+              | .error _ _ => []) hpureRun
+          simpa [VEnv.bump] using houtput.symm
+    | recursor numArgs natLit rules =>
+      cases world with
+      | unique => exact (throw_run_not_ok (by
+          simpa [lowerE, hsource, huuEq] using hrun)).elim
+      | shared =>
+        have hpure := hrun
+        simp [lowerE, hsource, hsuEq] at hpure
+        rw [← hpure.1.1]
+        rfl
+    | extern arity =>
+      cases arity with
+      | zero =>
+        have hpure := hrun
+        simp [lowerE, hsource] at hpure
+        rw [← hpure.1.1]
+        rfl
+      | succ arity =>
+        cases world with
+        | unique => exact (throw_run_not_ok (by
+            simpa [lowerE, hsource, huuEq] using hrun)).elim
+        | shared =>
+          have hpure := hrun
+          simp [lowerE, hsource, hsuEq] at hpure
+          rw [← hpure.1.1]
+          rfl
+
+private theorem lowerE_proj_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowPreservesNoRecSelf src fuel)
+    {input output : VEnv} {world : Owned} {fieldIndex : Nat}
+    {source : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj fieldIndex source)).run state =
+        .ok (output, emit, value) finalState)
+    (hno : NoRecSelf input) : NoRecSelf output := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp [lowerE, huuEq] at hrun
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      bind_run_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hborrowNo := hborrow hborrowRun hno
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure : borrowOutput.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowNo.bump
+      | lit literal =>
+        have hpure : borrowOutput.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowNo.bump
+      | erased =>
+        have hpure : borrowOutput = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowNo
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure : borrowOutput.bump.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowNo.bump.bump
+      | true =>
+        have hpure : borrowOutput.bump.bump.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowNo.bump.bump.bump
+
+private theorem lowerE_mapped_body_pop_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    {bodyInput output : VEnv} {world : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal)}
+    (hrun : (finish <$> lowerE src fuel bodyInput world body).run state =
+      .ok (output, emit, value) finalState)
+    (hfinish : ∀ result, (finish result).1 = result.1.pop)
+    (hno : NoRecSelf bodyInput) : NoRecSelf output := by
+  obtain ⟨bodyResult, hbodyRun, hvalue⟩ := map_run_ok_inv hrun
+  rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+  have houtput : bodyOutput.pop = output := by
+    have := congrArg Prod.fst hvalue
+    simpa [hfinish] using this
+  subst output
+  exact (hexpr hbodyRun hno).pop
+
+private theorem lowerE_let_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    {input output : VEnv} {world : Owned} {binderUses : Uses}
+    {bound body : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE binderUses bound body)).run state =
+        .ok (output, emit, value) finalState)
+    (hno : NoRecSelf input) : NoRecSelf output := by
+  simp only [lowerE] at hrun
+  obtain ⟨boundResult, boundState, hboundRun, hafterBound⟩ :=
+    bind_run_ok_inv hrun
+  rcases boundResult with ⟨middle, boundEmit, boundValue⟩
+  have hmiddle := hexpr hboundRun hno
+  cases boundValue with
+  | slotA boundAbs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases binderUses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv
+          (by simpa [hzero] using hafterBound)
+        exact (throw_run_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv
+          (by simpa [hzero] using hafterBound)
+        exact (throw_run_not_ok hthrow).elim
+      | affine =>
+        let bodyInput : VEnv :=
+          { middle with
+            entries := .slot boundAbs 0 .affine false :: middle.entries
+            depth := middle.depth + 1 }
+        have hbodyNo : NoRecSelf bodyInput := by
+          exact hmiddle.consSlot boundAbs 0 .affine false
+        apply lowerE_mapped_body_pop_noRecSelf hexpr
+          (bodyInput := bodyInput)
+          (by simpa [hzero, bodyInput] using hafterBound)
+          (fun _ => rfl) hbodyNo
+      | many =>
+        let bodyInput : VEnv :=
+          { middle with
+            entries := .slot boundAbs 0 .many false :: middle.entries
+            depth := middle.depth + 1 }
+        have hbodyNo : NoRecSelf bodyInput := by
+          exact hmiddle.consSlot boundAbs 0 .many false
+        apply lowerE_mapped_body_pop_noRecSelf hexpr
+          (bodyInput := bodyInput)
+          (by simpa [hzero, bodyInput] using hafterBound)
+          (fun _ => rfl) hbodyNo
+    · let bodyInput : VEnv :=
+        { middle with
+          entries :=
+            .slot boundAbs (countUses 0 body) binderUses true ::
+              middle.entries }
+      have hbodyNo : NoRecSelf bodyInput := by
+        exact hmiddle.consSlot boundAbs (countUses 0 body) binderUses true
+      apply lowerE_mapped_body_pop_noRecSelf hexpr
+        (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl) hbodyNo
+
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput : VEnv :=
+        { middle with
+          entries := .slot middle.depth 0 binderUses false :: middle.entries
+          depth := middle.depth + 1 }
+      have hbodyNo : NoRecSelf bodyInput := by
+        exact hmiddle.consSlot middle.depth 0 binderUses false
+      apply lowerE_mapped_body_pop_noRecSelf hexpr
+        (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl) hbodyNo
+
+    · let bodyInput : VEnv :=
+        { middle with
+          entries :=
+            .slot middle.depth (countUses 0 body) binderUses true ::
+              middle.entries
+          depth := middle.depth + 1 }
+      have hbodyNo : NoRecSelf bodyInput := by
+        exact hmiddle.consSlot middle.depth (countUses 0 body) binderUses true
+      apply lowerE_mapped_body_pop_noRecSelf hexpr
+        (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl) hbodyNo
+
+private theorem lowerE_var_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {index : Nat} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState)
+    (hno : NoRecSelf input) : NoRecSelf output := by
+  have hssNe : (Owned.shared != Owned.shared) = false := by decide
+  have huuNe : (Owned.unique != Owned.unique) = false := by decide
+  have hsuNe : (Owned.shared != Owned.unique) = true := by decide
+  have husNe : (Owned.unique != Owned.shared) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[index]? with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (hno index arity hentry).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact (throw_run_not_ok (by
+          simpa [lowerE, hentry] using hrun)).elim
+      | true =>
+        by_cases hworld : worldOfUses uses = world
+        · subst world
+          have hsame :
+              (worldOfUses uses != worldOfUses uses) = false := by
+            cases uses <;> decide
+          cases remaining with
+          | zero => exact (throw_run_not_ok (by
+              simpa [lowerE, hentry, hsame] using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry index (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, value) ∧ state = finalState := by
+                simpa [lowerE, hentry, hsame] using hrun
+              cases hpure.1
+              exact hno.setSlot index abs 0 uses false
+            | succ remaining =>
+              by_cases hunique : worldOfUses uses = .unique
+              · have huniqueEq :
+                    (worldOfUses uses == Owned.unique) = true := by
+                  rw [hunique]
+                  exact huuEq
+                exact (throw_run_not_ok (by
+                  simpa [lowerE, hentry, hsame, huniqueEq, huuNe]
+                    using hrun)).elim
+              · have huniqueEq :
+                    (worldOfUses uses == Owned.unique) = false := by
+                  cases uses <;> simp_all [worldOfUses] <;> decide
+                let changed := input.setEntry index
+                  (.slot abs (remaining + 1) uses true)
+                have hpure :
+                    (changed.bump,
+                      emitOp (.dup (.var (changed.rel abs))),
+                      AVal.slotA changed.depth) =
+                        (output, emit, value) ∧ state = finalState := by
+                  simpa [lowerE, hentry, hsame, huniqueEq, hssNe, changed]
+                    using hrun
+                cases hpure.1
+                exact (hno.setSlot index abs (remaining + 1) uses true).bump
+        · cases uses <;> cases world
+          all_goals
+            try { exact (hworld (by rfl)).elim }
+          all_goals
+            exact (throw_run_not_ok (by
+              simpa [lowerE, hentry, worldOfUses, hssNe, huuNe, hsuNe,
+                husNe, hsuEq, huuEq] using hrun)).elim
+
+theorem lowerEPreservesNoRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesNoRecSelf src fuel)
+    (hborrow : LowerBorrowPreservesNoRecSelf src fuel)
+    (hspine : LowerSpinePreservesNoRecSelf src fuel)
+    (hlam : LowerLamPreservesNoRecSelf src fuel) :
+    LowerEPreservesNoRecSelf src (fuel + 1) := by
+  intro input world expr state finalState output emit value hrun hno
+  cases expr with
+  | var index => exact lowerE_var_noRecSelf hrun hno
+  | ref address =>
+    exact hno.of_entries_eq (lowerE_ref_entries_eq_noRecSelf hrun)
+  | app function argument =>
+    apply hspine
+    · simpa [lowerE] using hrun
+    · exact hno
+  | lam uses body =>
+    cases world with
+    | unique =>
+      have huuEq : (Owned.unique == Owned.unique) = true := by decide
+      exact (throw_run_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+    | shared =>
+      have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+      apply hlam
+      · simpa [lowerE, hsuEq] using hrun
+      · exact hno
+  | letE uses bound body => exact lowerE_let_noRecSelf hexpr hrun hno
+  | proj fieldIndex source => exact lowerE_proj_noRecSelf hborrow hrun hno
+  | lit literal =>
+    have hpure :
+        (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+            (output, emit, value) ∧ state = finalState := by
+      simpa [lowerE] using hrun
+    cases hpure.1
+    exact hno
+  | erased =>
+    have hpure :
+        (input, (_root_.id : Emit), AVal.constA .erased) =
+            (output, emit, value) ∧ state = finalState := by
+      simpa [lowerE] using hrun
+    cases hpure.1
+    exact hno
+
+theorem lowerPreservesNoRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerPreservesNoRecSelf src fuel) :
+    LowerPreservesNoRecSelf src (fuel + 1) where
+  expr := lowerEPreservesNoRecSelf_succ
+    hprev.expr hprev.borrow hprev.spine hprev.lam
+  borrow := lowerBorrowPreservesNoRecSelf_succ hprev.expr
+  spine := lowerSpinePreservesNoRecSelf_succ
+    hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+  knownCall := knownCallPreservesNoRecSelf_succ hprev.args hprev.applyRest
+  args := lowerArgsPreservesNoRecSelf_succ hprev.expr hprev.args
+  applyRest := applyRestPreservesNoRecSelf_succ hprev.args
+  lam := lowerLamPreservesNoRecSelf_succ
+
+/-- Successful lowering never synthesizes the recursor-only logical entry. -/
+theorem lowerPreservesNoRecSelf (src : IxIR0.Env) :
+    ∀ fuel, LowerPreservesNoRecSelf src fuel
+  | 0 => lowerPreservesNoRecSelf_zero src
+  | fuel + 1 =>
+    lowerPreservesNoRecSelf_succ (lowerPreservesNoRecSelf src fuel)
+
+theorem lowerE_noRecSelf
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState)
+    (hno : NoRecSelf input) : NoRecSelf output :=
+  (lowerPreservesNoRecSelf src fuel).expr hrun hno
+
+/-! ## Logical-entry cardinality
+
+The lowering environment may gain physical runtime slots (`depth`), but a
+completed expression never gains or loses source-level logical entries.  Let
+binders are installed only for the recursive body run and are popped again at
+the boundary.  This structural invariant complements exact occurrence
+consumption: together they rule out untracked output entries when closing a
+generated function body. -/
+
+/-- The output contains exactly as many source-level entries as the input. -/
+def EntryCountPreserved (input output : VEnv) : Prop :=
+  output.entries.length = input.entries.length
+
+theorem EntryCountPreserved.refl (input : VEnv) :
+    EntryCountPreserved input input := rfl
+
+theorem EntryCountPreserved.trans {first middle final : VEnv}
+    (hleft : EntryCountPreserved first middle)
+    (hright : EntryCountPreserved middle final) :
+    EntryCountPreserved first final :=
+  Eq.trans hright hleft
+
+theorem EntryCountPreserved.bump {input output : VEnv}
+    (h : EntryCountPreserved input output) :
+    EntryCountPreserved input output.bump := by
+  simpa [EntryCountPreserved, VEnv.bump] using h
+
+theorem releaseAll_preservesEntryCount (input : VEnv) (values : List AVal) :
+    EntryCountPreserved input (releaseAll input values).1 := by
+  exact releaseAll_traverse_core
+    (Result := fun initial _ output _ =>
+      EntryCountPreserved initial output)
+    (hnil := EntryCountPreserved.refl)
+    (hconst := fun htail => htail)
+    (hslot := by
+      intro initial abs rest output tailEmit htail
+      simpa [EntryCountPreserved, VEnv.bump] using htail)
+    input values
+
+/-- Entry releases update slots in place and therefore preserve logical-entry
+cardinality even though each emitted drop bumps the physical depth. -/
+theorem releaseSlots_preservesEntryCount (input : VEnv) :
+    ∀ {drops output emit state finalState},
+      (releaseSlots input drops).run state =
+        .ok (output, emit) finalState →
+      EntryCountPreserved input output := by
+  intro drops output emit state finalState hrun
+  exact releaseSlots_run_core
+    (Result := fun initial final _ _ =>
+      EntryCountPreserved initial final)
+    (hnil := EntryCountPreserved.refl)
+    (haffine := by
+      intro entry abs rest initial final tailEmit htail
+      simpa [EntryCountPreserved, VEnv.bump, VEnv.setEntry] using htail)
+    (hmany := by
+      intro entry abs rest initial final tailEmit htail
+      simpa [EntryCountPreserved, VEnv.bump, VEnv.setEntry] using htail)
+    hrun
+
+theorem lowerCapture_preservesEntryCount (expr : IxIR0.Expr) (input : VEnv)
+    (index : Nat) {output : VEnv} {emit : Emit} {value : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    EntryCountPreserved input output := by
+  cases hentry : input.entries[index]? with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (throw_run_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact (throw_run_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          exact (throw_run_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses index expr
+          · have houtput : output =
+                (input.setEntry index
+                  (.slot abs (remaining - countUses index expr) uses true)).bump := by
+              have hvalue := congrArg
+                (fun result : EStateM.Result String LowSt
+                    (VEnv × Emit × AVal) =>
+                  match result with
+                  | .ok value _ => value.1
+                  | .error _ _ => input) hrun
+              simpa [lowerCapture, hentry, huniqueEq, hmore] using hvalue.symm
+            subst output
+            simp [EntryCountPreserved, VEnv.setEntry, VEnv.bump]
+          · by_cases hequal : remaining = countUses index expr
+            · have houtput : output =
+                  input.setEntry index (.slot abs 0 uses false) := by
+                have hvalue := congrArg
+                  (fun result : EStateM.Result String LowSt
+                      (VEnv × Emit × AVal) =>
+                    match result with
+                    | .ok value _ => value.1
+                    | .error _ _ => input) hrun
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hvalue.symm
+              subst output
+              simp [EntryCountPreserved, VEnv.setEntry]
+            · exact (throw_run_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_preservesEntryCount (expr : IxIR0.Expr) :
+    ∀ {indices input output emit values state finalState},
+      (lowerCaptures expr input indices).run state =
+        .ok (output, emit, values) finalState →
+      EntryCountPreserved input output := by
+  intro indices input output emit values state finalState hrun
+  apply lowerCaptures_run_core
+    (Result := fun input output _ _ _ =>
+      EntryCountPreserved input output)
+    (e := expr) (hrun := hrun)
+  · intro input
+    exact .refl input
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail
+    exact (lowerCapture_preservesEntryCount expr input index hheadRun).trans
+      htail
+
+def LowerEPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState →
+    EntryCountPreserved input output
+
+def LowerBorrowPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {release : Bool},
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, value, release) finalState →
+    EntryCountPreserved input output
+
+def LowerSpinePreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {head : IxIR0.Expr}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, value) finalState →
+    EntryCountPreserved input output
+
+def KnownCallPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {build : Array Atom → Op} {count : Nat}
+      {argWorlds : List Owned} {resultWorld : Owned}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (knownCall src fuel input build count argWorlds resultWorld args).run
+      state = .ok (output, emit, value) finalState →
+    EntryCountPreserved input output
+
+def LowerArgsPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {args : List (IxIR0.Expr × Owned)}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {values : List AVal},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, values) finalState →
+    EntryCountPreserved input output
+
+def ApplyRestPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {resultWorld : Owned} {pre : Emit}
+      {function : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {value : AVal},
+    (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, value) finalState →
+    EntryCountPreserved input output
+
+def LowerLamPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState →
+    EntryCountPreserved input output
+
+structure LowerPreservesEntryCount (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEPreservesEntryCount src fuel
+  borrow : LowerBorrowPreservesEntryCount src fuel
+  spine : LowerSpinePreservesEntryCount src fuel
+  knownCall : KnownCallPreservesEntryCount src fuel
+  args : LowerArgsPreservesEntryCount src fuel
+  applyRest : ApplyRestPreservesEntryCount src fuel
+  lam : LowerLamPreservesEntryCount src fuel
+
+theorem lowerPreservesEntryCount_zero (src : IxIR0.Env) :
+    LowerPreservesEntryCount src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr state finalState output emit value hrun
+    exact (throw_run_not_ok (by simpa [lowerE] using hrun)).elim
+  · intro input expr state finalState output emit value release hrun
+    exact (throw_run_not_ok (by simpa [lowerBorrow] using hrun)).elim
+  · intro input world head args state finalState output emit value hrun
+    exact (throw_run_not_ok (by simpa [lowerSpine] using hrun)).elim
+  · intro input build count argWorlds resultWorld args state finalState
+      output emit value hrun
+    exact (throw_run_not_ok (by simpa [knownCall] using hrun)).elim
+  · intro input args state finalState output emit values hrun
+    exact (throw_run_not_ok (by simpa [lowerArgs] using hrun)).elim
+  · intro input resultWorld pre function args state finalState output emit
+      value hrun
+    exact (throw_run_not_ok (by simpa [applyRest] using hrun)).elim
+  · intro input expr state finalState output emit value hrun
+    exact (throw_run_not_ok (by simpa [lowerLam] using hrun)).elim
+
+theorem lowerArgsPreservesEntryCount_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    (hargs : LowerArgsPreservesEntryCount src fuel) :
+    LowerArgsPreservesEntryCount src (fuel + 1) := by
+  intro input args state finalState output emit values hrun
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, values) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    cases hpure.1
+    exact .refl input
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      bind_run_ok_inv hrun
+    rcases headResult with ⟨middle, headEmit, headValue⟩
+    obtain ⟨tailResult, tailState, htailRun, hafterTail⟩ :=
+      bind_run_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, tailEmit, tailValues⟩
+    have hvalue : actualOutput = output := by
+      have hpure :
+          (actualOutput, headEmit ∘ tailEmit, headValue :: tailValues) =
+              (output, emit, values) ∧ tailState = finalState := by
+        simpa using hafterTail
+      exact congrArg Prod.fst hpure.1
+    subst output
+    exact (hexpr hheadRun).trans (hargs htailRun)
+
+theorem applyRestPreservesEntryCount_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesEntryCount src fuel) :
+    ApplyRestPreservesEntryCount src (fuel + 1) := by
+  intro input resultWorld pre function args state finalState output emit value
+    hrun
+  cases function with
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest] at hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hrun
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hpure : (releaseAll middle values).1 = output := by
+        have hvalue :
+            ((releaseAll middle values).1,
+              pre ∘ argsEmit ∘ (releaseAll middle values).2,
+              AVal.constA .erased) = (output, emit, value) ∧
+              argsState = finalState := by
+          simpa using hpureRun
+        exact congrArg Prod.fst hvalue.1
+      subst output
+      exact (hargs hargsRun).trans
+        (releaseAll_preservesEntryCount middle values)
+    | var relative =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have houtput : middle.bump = output := by
+        have hvalue := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1
+            | .error _ _ => input) hpureRun
+        simpa using hvalue
+      subst output
+      exact (hargs hargsRun).bump
+    | lit literal =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have houtput : middle.bump = output := by
+        have hvalue := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1
+            | .error _ _ => input) hpureRun
+        simpa using hvalue
+      subst output
+      exact (hargs hargsRun).bump
+  | slotA abs =>
+    simp only [applyRest] at hrun
+    obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      bind_run_ok_inv hafterCheck
+    rcases argsResult with ⟨middle, argsEmit, values⟩
+    have houtput : middle.bump = output := by
+      have hvalue := congrArg
+        (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+          match result with
+          | .ok value _ => value.1
+          | .error _ _ => input) hpureRun
+      simpa using hvalue
+    subst output
+    exact (hargs hargsRun).bump
+
+theorem knownCallPreservesEntryCount_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesEntryCount src fuel)
+    (hrest : ApplyRestPreservesEntryCount src fuel) :
+    KnownCallPreservesEntryCount src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args state finalState output
+    emit value hrun
+  simp only [knownCall] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hafterArgs⟩ :=
+    bind_run_ok_inv hrun
+  rcases argsResult with ⟨middle, argsEmit, values⟩
+  have hmiddle := hargs hargsRun
+  by_cases hterminal : args.length ≤ count
+  · have houtput : middle.bump = output := by
+      have hvalue := congrArg
+        (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+          match result with
+          | .ok value _ => value.1
+          | .error _ _ => input) hafterArgs
+      simpa [hterminal] using hvalue
+    subst output
+    exact hmiddle.bump
+  · have hrestRun :
+        (applyRest src fuel middle.bump resultWorld
+          (argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray))
+          (.slotA middle.depth) (args.drop count)).run argsState =
+            .ok (output, emit, value) finalState := by
+      simpa [hterminal] using hafterArgs
+    exact hmiddle.bump.trans (hrest hrestRun)
+
+private theorem lowerBorrow_dynamic_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {releaseFlag : Bool}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal × Bool)}
+    (hrun : (finish <$> lowerE src fuel input .shared expr).run state =
+        .ok (output, emit, value, releaseFlag) finalState)
+    (hfinish : ∀ result, (finish result).1 = result.1) :
+    EntryCountPreserved input output := by
+  obtain ⟨exprResult, hexprRun, hvalue⟩ := map_run_ok_inv hrun
+  rcases exprResult with ⟨middle, middleEmit, middleValue⟩
+  have houtput : middle = output := by
+    have := congrArg Prod.fst hvalue
+    simpa [hfinish] using this
+  subst output
+  exact hexpr hexprRun
+
+theorem lowerBorrowPreservesEntryCount_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel) :
+    LowerBorrowPreservesEntryCount src (fuel + 1) := by
+  intro input expr state finalState output emit value release hrun
+  cases expr with
+  | var index =>
+    cases hentry : input.entries[index]? with
+    | none => exact (throw_run_not_ok (by
+        simpa [lowerBorrow, hentry] using hrun)).elim
+    | some entry =>
+      cases entry with
+      | recSelf arity => exact (throw_run_not_ok (by
+          simpa [lowerBorrow, hentry] using hrun)).elim
+      | slot abs remaining uses held =>
+        cases held with
+        | false => exact (throw_run_not_ok (by
+            simpa [lowerBorrow, hentry] using hrun)).elim
+        | true =>
+          by_cases hunique : worldOfUses uses = .unique
+          · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+            exact (throw_run_not_ok (by
+              simpa [lowerBorrow, hentry, hunique, huuEq] using hrun)).elim
+          · have huniqueEq :
+                (worldOfUses uses == Owned.unique) = false := by
+              cases uses <;> simp_all [worldOfUses] <;> decide
+            cases remaining with
+            | zero => exact (throw_run_not_ok (by
+                simpa [lowerBorrow, hentry, huniqueEq] using hrun)).elim
+            | succ remaining =>
+              cases remaining with
+              | zero =>
+                have hpure :
+                    (input.setEntry index (.slot abs 0 uses false),
+                      (_root_.id : Emit), AVal.slotA abs, true) =
+                        (output, emit, value, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, huniqueEq] using hrun
+                cases hpure.1
+                simp [EntryCountPreserved, VEnv.setEntry]
+              | succ remaining =>
+                have hpure :
+                    (input.setEntry index
+                        (.slot abs (remaining + 1) uses true),
+                      (_root_.id : Emit), AVal.slotA abs, false) =
+                        (output, emit, value, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, huniqueEq] using hrun
+                cases hpure.1
+                simp [EntryCountPreserved, VEnv.setEntry]
+  | ref address =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | app function argument =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | lam uses body =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | letE uses value body =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | proj index source =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | lit literal =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | erased =>
+    apply lowerBorrow_dynamic_preservesEntryCount hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+
+private theorem lowerE_applyRest_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    (hrest : ApplyRestPreservesEntryCount src fuel)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (do
+      let (middle, headEmit, function) ←
+        lowerE src fuel input .shared head
+      applyRest src fuel middle world headEmit function args).run state =
+        .ok (output, emit, value) finalState) :
+    EntryCountPreserved input output := by
+  obtain ⟨headResult, middleState, hheadRun, hrestRun⟩ :=
+    bind_run_ok_inv hrun
+  rcases headResult with ⟨middle, headEmit, function⟩
+  exact (hexpr hheadRun).trans (hrest hrestRun)
+
+theorem lowerSpinePreservesEntryCount_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    (hspine : LowerSpinePreservesEntryCount src fuel)
+    (hknown : KnownCallPreservesEntryCount src fuel)
+    (hrest : ApplyRestPreservesEntryCount src fuel) :
+    LowerSpinePreservesEntryCount src (fuel + 1) := by
+  intro input world head args state finalState output emit value hrun
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases head with
+  | app function argument =>
+    apply hspine
+    simpa [lowerSpine] using hrun
+  | erased =>
+    apply hrest
+    simpa [lowerSpine] using hrun
+  | var index =>
+    simp only [lowerSpine] at hrun
+    cases hentry : input.entries[index]? with
+    | none =>
+      apply lowerE_applyRest_preservesEntryCount hexpr hrest
+      simpa [hentry] using hrun
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        rw [hentry] at hrun
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          exact (throw_run_not_ok hrun).elim
+        · rw [if_neg hunder] at hrun
+          obtain ⟨unitValue, checkedState, _, hknownRun⟩ :=
+            bind_run_ok_inv hrun
+          cases unitValue
+          exact hknown hknownRun
+      | slot abs remaining uses held =>
+        apply lowerE_applyRest_preservesEntryCount hexpr hrest
+        simpa [hentry] using hrun
+  | ref address =>
+    simp only [lowerSpine] at hrun
+    cases hsource : src address with
+    | none =>
+      rw [hsource] at hrun
+      exact (throw_run_not_ok hrun).elim
+    | some decl =>
+      rw [hsource] at hrun
+      cases decl with
+      | defn result body =>
+        simp only at hrun
+        by_cases hunder : args.length < lamArity body
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared =>
+            cases result with
+            | unique => exact (throw_run_not_ok hrun).elim
+            | shared =>
+              cases hp : papSafe body with
+              | false => exact (throw_run_not_ok (by
+                  simpa [hp, hsuEq] using hrun)).elim
+              | true =>
+                apply hknown
+                simpa [hp, hsuEq] using hrun
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, checkedState, _, hknownRun⟩ := bind_run_ok_inv hrun
+          exact hknown hknownRun
+      | ctor tag arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared =>
+            obtain ⟨wrapper, wrapperState, _, hknownRun⟩ :=
+              bind_run_ok_inv hrun
+            exact hknown hknownRun
+        · rw [if_neg hunder] at hrun
+          exact hknown hrun
+      | recursor numArgs natLit rules =>
+        simp only at hrun
+        by_cases hunder : args.length < numArgs + 1
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared => exact hknown hrun
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, checkedState, _, hknownRun⟩ := bind_run_ok_inv hrun
+          exact hknown hknownRun
+      | extern arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared => exact hknown hrun
+        · rw [if_neg hunder] at hrun
+          exact hknown hrun
+  | lam uses body =>
+    apply lowerE_applyRest_preservesEntryCount hexpr hrest
+    simpa [lowerSpine] using hrun
+  | letE uses bound body =>
+    apply lowerE_applyRest_preservesEntryCount hexpr hrest
+    simpa [lowerSpine] using hrun
+  | proj index source =>
+    apply lowerE_applyRest_preservesEntryCount hexpr hrest
+    simpa [lowerSpine] using hrun
+  | lit literal =>
+    apply lowerE_applyRest_preservesEntryCount hexpr hrest
+    simpa [lowerSpine] using hrun
+
+theorem lowerLamPreservesEntryCount_succ
+    {src : IxIR0.Env} {fuel : Nat} :
+    LowerLamPreservesEntryCount src (fuel + 1) := by
+  intro input expr state finalState output emit value hrun
+  cases hp : papSafe expr with
+  | false => simp [lowerLam, hp] at hrun
+  | true =>
+    simp only [lowerLam] at hrun
+    simp only [hp, ↓reduceIte, bind_pure_comp] at hrun
+    let captures := (List.range input.entries.length).filter
+      (fun index => countUses index expr > 0)
+    have hcaptures : captures = (List.range input.entries.length).filter
+        (fun index => countUses index expr > 0) := rfl
+    rw [← hcaptures] at hrun
+    obtain ⟨captureResult, captureState, hcaptureRun, hafterCapture⟩ :=
+      bind_run_ok_inv hrun
+    rcases captureResult with ⟨captureOutput, captureEmit, captureValues⟩
+    obtain ⟨fnAddr, addressState, _, hafterFresh⟩ :=
+      bind_run_ok_inv hafterCapture
+    obtain ⟨code, bodyState, _, hafterBody⟩ :=
+      bind_run_ok_inv hafterFresh
+    obtain ⟨_, _, hvalue⟩ := map_run_ok_inv hafterBody
+    have houtput : captureOutput.bump = output :=
+      congrArg Prod.fst hvalue
+    subst output
+    exact (lowerCaptures_preservesEntryCount expr hcaptureRun).bump
+
+private theorem lowerE_proj_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowPreservesEntryCount src fuel)
+    {input output : VEnv} {world : Owned} {fieldIndex : Nat}
+    {source : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj fieldIndex source)).run state =
+        .ok (output, emit, value) finalState) :
+    EntryCountPreserved input output := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp [lowerE, huuEq] at hrun
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      bind_run_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hborrowCount := hborrow hborrowRun
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure : borrowOutput.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowCount.bump
+      | lit literal =>
+        have hpure : borrowOutput.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowCount.bump
+      | erased =>
+        have hpure : borrowOutput = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowCount
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure : borrowOutput.bump.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowCount.bump.bump
+      | true =>
+        have hpure : borrowOutput.bump.bump.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowCount.bump.bump.bump
+
+private theorem lowerE_mapped_body_pop_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    {middle bodyInput output : VEnv} {world : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal)}
+    {binder : VEntry}
+    (hrun : (finish <$> lowerE src fuel bodyInput world body).run state =
+      .ok (output, emit, value) finalState)
+    (hfinish : ∀ result, (finish result).1 = result.1.pop)
+    (hentries : bodyInput.entries = binder :: middle.entries) :
+    EntryCountPreserved middle output := by
+  obtain ⟨bodyResult, hbodyRun, hvalue⟩ := map_run_ok_inv hrun
+  rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+  have houtput : bodyOutput.pop = output := by
+    have := congrArg Prod.fst hvalue
+    simpa [hfinish] using this
+  subst output
+  have hbodyCount := hexpr hbodyRun
+  rw [EntryCountPreserved] at hbodyCount ⊢
+  simp only [VEnv.pop]
+  rw [List.length_tail]
+  rw [hbodyCount, hentries]
+  simp
+
+private theorem lowerE_let_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    {input output : VEnv} {world : Owned} {binderUses : Uses}
+    {bound body : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE binderUses bound body)).run state =
+        .ok (output, emit, value) finalState) :
+    EntryCountPreserved input output := by
+  simp only [lowerE] at hrun
+  obtain ⟨boundResult, boundState, hboundRun, hafterBound⟩ :=
+    bind_run_ok_inv hrun
+  rcases boundResult with ⟨middle, boundEmit, boundValue⟩
+  have hmiddle := hexpr hboundRun
+  cases boundValue with
+  | slotA boundAbs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases binderUses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv
+          (by simpa [hzero] using hafterBound)
+        exact (throw_run_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv
+          (by simpa [hzero] using hafterBound)
+        exact (throw_run_not_ok hthrow).elim
+      | affine =>
+        let bodyInput : VEnv :=
+          { middle with
+            entries := .slot boundAbs 0 .affine false :: middle.entries
+            depth := middle.depth + 1 }
+        apply hmiddle.trans
+        apply lowerE_mapped_body_pop_preservesEntryCount hexpr
+          (middle := middle) (bodyInput := bodyInput)
+          (by simpa [hzero, bodyInput] using hafterBound)
+          (fun _ => rfl)
+        rfl
+      | many =>
+        let bodyInput : VEnv :=
+          { middle with
+            entries := .slot boundAbs 0 .many false :: middle.entries
+            depth := middle.depth + 1 }
+        apply hmiddle.trans
+        apply lowerE_mapped_body_pop_preservesEntryCount hexpr
+          (middle := middle) (bodyInput := bodyInput)
+          (by simpa [hzero, bodyInput] using hafterBound)
+          (fun _ => rfl)
+        rfl
+    · let bodyInput : VEnv :=
+        { middle with
+          entries :=
+            .slot boundAbs (countUses 0 body) binderUses true ::
+              middle.entries }
+      apply hmiddle.trans
+      apply lowerE_mapped_body_pop_preservesEntryCount hexpr
+        (middle := middle) (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl)
+      rfl
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput : VEnv :=
+        { middle with
+          entries := .slot middle.depth 0 binderUses false :: middle.entries
+          depth := middle.depth + 1 }
+      apply hmiddle.trans
+      apply lowerE_mapped_body_pop_preservesEntryCount hexpr
+        (middle := middle) (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl)
+      rfl
+    · let bodyInput : VEnv :=
+        { middle with
+          entries :=
+            .slot middle.depth (countUses 0 body) binderUses true ::
+              middle.entries
+          depth := middle.depth + 1 }
+      apply hmiddle.trans
+      apply lowerE_mapped_body_pop_preservesEntryCount hexpr
+        (middle := middle) (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl)
+      rfl
+
+private theorem lowerE_var_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {index : Nat} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState) :
+    EntryCountPreserved input output := by
+  have hssNe : (Owned.shared != Owned.shared) = false := by decide
+  have huuNe : (Owned.unique != Owned.unique) = false := by decide
+  have hsuNe : (Owned.shared != Owned.unique) = true := by decide
+  have husNe : (Owned.unique != Owned.shared) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[index]? with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (throw_run_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact (throw_run_not_ok (by
+          simpa [lowerE, hentry] using hrun)).elim
+      | true =>
+        by_cases hworld : worldOfUses uses = world
+        · subst world
+          have hsame :
+              (worldOfUses uses != worldOfUses uses) = false := by
+            cases uses <;> decide
+          cases remaining with
+          | zero => exact (throw_run_not_ok (by
+              simpa [lowerE, hentry, hsame] using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry index (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, value) ∧ state = finalState := by
+                simpa [lowerE, hentry, hsame] using hrun
+              cases hpure.1
+              simp [EntryCountPreserved, VEnv.setEntry]
+            | succ remaining =>
+              by_cases hunique : worldOfUses uses = .unique
+              · have huniqueEq :
+                    (worldOfUses uses == Owned.unique) = true := by
+                  rw [hunique]
+                  exact huuEq
+                exact (throw_run_not_ok (by
+                  simpa [lowerE, hentry, hsame, huniqueEq, huuNe]
+                    using hrun)).elim
+              · have huniqueEq :
+                    (worldOfUses uses == Owned.unique) = false := by
+                  cases uses <;> simp_all [worldOfUses] <;> decide
+                let changed := input.setEntry index
+                  (.slot abs (remaining + 1) uses true)
+                have hpure :
+                    (changed.bump,
+                      emitOp (.dup (.var (changed.rel abs))),
+                      AVal.slotA changed.depth) =
+                        (output, emit, value) ∧ state = finalState := by
+                  simpa [lowerE, hentry, hsame, huniqueEq, hssNe, changed]
+                    using hrun
+                cases hpure.1
+                simp [EntryCountPreserved, changed, VEnv.setEntry, VEnv.bump]
+        · cases uses <;> cases world
+          all_goals
+            try { exact (hworld (by rfl)).elim }
+          all_goals
+            exact (throw_run_not_ok (by
+              simpa [lowerE, hentry, worldOfUses, hssNe, huuNe, hsuNe,
+                husNe, hsuEq, huuEq] using hrun)).elim
+
+theorem lowerEPreservesEntryCount_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesEntryCount src fuel)
+    (hborrow : LowerBorrowPreservesEntryCount src fuel)
+    (hspine : LowerSpinePreservesEntryCount src fuel)
+    (hlam : LowerLamPreservesEntryCount src fuel) :
+    LowerEPreservesEntryCount src (fuel + 1) := by
+  intro input world expr state finalState output emit value hrun
+  cases expr with
+  | var index => exact lowerE_var_preservesEntryCount hrun
+  | ref address =>
+    exact congrArg List.length (lowerE_ref_entries_eq_noRecSelf hrun)
+  | app function argument =>
+    apply hspine
+    simpa [lowerE] using hrun
+  | lam uses body =>
+    cases world with
+    | unique =>
+      have huuEq : (Owned.unique == Owned.unique) = true := by decide
+      exact (throw_run_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+    | shared =>
+      have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+      apply hlam
+      simpa [lowerE, hsuEq] using hrun
+  | letE uses bound body => exact lowerE_let_preservesEntryCount hexpr hrun
+  | proj fieldIndex source =>
+    exact lowerE_proj_preservesEntryCount hborrow hrun
+  | lit literal =>
+    have hpure :
+        (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+            (output, emit, value) ∧ state = finalState := by
+      simpa [lowerE] using hrun
+    cases hpure.1
+    exact .refl input
+  | erased =>
+    have hpure :
+        (input, (_root_.id : Emit), AVal.constA .erased) =
+            (output, emit, value) ∧ state = finalState := by
+      simpa [lowerE] using hrun
+    cases hpure.1
+    exact .refl input
+
+theorem lowerPreservesEntryCount_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerPreservesEntryCount src fuel) :
+    LowerPreservesEntryCount src (fuel + 1) where
+  expr := lowerEPreservesEntryCount_succ
+    hprev.expr hprev.borrow hprev.spine hprev.lam
+  borrow := lowerBorrowPreservesEntryCount_succ hprev.expr
+  spine := lowerSpinePreservesEntryCount_succ
+    hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+  knownCall := knownCallPreservesEntryCount_succ hprev.args hprev.applyRest
+  args := lowerArgsPreservesEntryCount_succ hprev.expr hprev.args
+  applyRest := applyRestPreservesEntryCount_succ hprev.args
+  lam := lowerLamPreservesEntryCount_succ
+
+/-- Successful expression lowering preserves the cardinality of its logical
+source environment, even though emitted operations may increase runtime depth. -/
+theorem lowerPreservesEntryCount (src : IxIR0.Env) :
+    ∀ fuel, LowerPreservesEntryCount src fuel
+  | 0 => lowerPreservesEntryCount_zero src
+  | fuel + 1 =>
+    lowerPreservesEntryCount_succ (lowerPreservesEntryCount src fuel)
+
+theorem lowerE_preservesEntryCount
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState) :
+    EntryCountPreserved input output :=
+  (lowerPreservesEntryCount src fuel).expr hrun
+
+/-! ## Recursive-self entry preservation
+
+Unlike an ordinary slot, the synthetic recursor entry carries no ownership.
+Successful lowering may inspect it only as the head of a saturated recursive
+call; it never rewrites it.  The pointwise invariant below records that fact
+without imposing any restriction on the ordinary entries around it. -/
+
+def RecSelfAt (input : VEnv) (index arity : Nat) : Prop :=
+  input.entries[index]? = some (.recSelf arity)
+
+theorem RecSelfAt.bump {input : VEnv} {index arity : Nat}
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt input.bump index arity := by
+  simpa [RecSelfAt, VEnv.bump] using hself
+
+theorem RecSelfAt.of_entries_eq {input output : VEnv}
+    {index arity : Nat} (hentries : output.entries = input.entries)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity := by
+  simpa [RecSelfAt, hentries] using hself
+
+theorem RecSelfAt.setSlot {input : VEnv} {index arity changed : Nat}
+    {oldAbs oldRemaining : Nat} {oldUses : Uses} {oldHeld : Bool}
+    (hself : RecSelfAt input index arity)
+    (hslot : input.entries[changed]? =
+      some (.slot oldAbs oldRemaining oldUses oldHeld))
+    (newAbs newRemaining : Nat) (newUses : Uses) (newHeld : Bool) :
+    RecSelfAt
+      (input.setEntry changed
+        (.slot newAbs newRemaining newUses newHeld))
+      index arity := by
+  have hne : changed ≠ index := by
+    intro heq
+    subst changed
+    rw [hself] at hslot
+    cases hslot
+  rw [RecSelfAt, VEnv.setEntry, List.getElem?_set]
+  simp [hne]
+  exact hself
+
+theorem RecSelfAt.cons {input : VEnv} {index arity : Nat}
+    {entry : VEntry} (hself : RecSelfAt input index arity) :
+    RecSelfAt { input with entries := entry :: input.entries }
+      (index + 1) arity := by
+  simpa [RecSelfAt] using hself
+
+theorem RecSelfAt.pop_succ {input : VEnv} {index arity : Nat}
+    (hself : RecSelfAt input (index + 1) arity) :
+    RecSelfAt input.pop index arity := by
+  simpa [RecSelfAt, VEnv.pop] using hself
+
+theorem releaseAll_recSelfAt (input : VEnv) (values : List AVal)
+    {index arity : Nat} (hself : RecSelfAt input index arity) :
+    RecSelfAt (releaseAll input values).1 index arity := by
+  exact releaseAll_traverse_core
+    (Result := fun initial _ output _ =>
+      RecSelfAt initial index arity → RecSelfAt output index arity)
+    (hnil := fun _ hinitial => hinitial)
+    (hconst := fun htail hinitial => htail hinitial)
+    (hslot := fun htail hinitial => htail hinitial.bump)
+    input values hself
+
+theorem lowerCapture_recSelfAt (expr : IxIR0.Expr) (input : VEnv)
+    (captured : Nat) {output : VEnv} {emit : Emit} {value : AVal}
+    {state finalState : LowSt} {index arity : Nat}
+    (hrun : (lowerCapture expr input captured).run state =
+      .ok (output, emit, value) finalState)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity := by
+  cases hentry : input.entries[captured]? with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf foundArity => exact (throw_run_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact (throw_run_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+          exact (throw_run_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses captured expr
+          · have houtput : output =
+                (input.setEntry captured
+                  (.slot abs (remaining - countUses captured expr)
+                    uses true)).bump := by
+              have hvalue := congrArg
+                (fun result : EStateM.Result String LowSt
+                    (VEnv × Emit × AVal) =>
+                  match result with
+                  | .ok value _ => value.1
+                  | .error _ _ => input) hrun
+              simpa [lowerCapture, hentry, huniqueEq, hmore]
+                using hvalue.symm
+            subst output
+            exact (hself.setSlot hentry abs
+              (remaining - countUses captured expr) uses true).bump
+          · by_cases hequal : remaining = countUses captured expr
+            · have houtput : output =
+                  input.setEntry captured (.slot abs 0 uses false) := by
+                have hvalue := congrArg
+                  (fun result : EStateM.Result String LowSt
+                      (VEnv × Emit × AVal) =>
+                    match result with
+                    | .ok value _ => value.1
+                    | .error _ _ => input) hrun
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hvalue.symm
+              subst output
+              exact hself.setSlot hentry abs 0 uses false
+            · exact (throw_run_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_recSelfAt (expr : IxIR0.Expr) :
+    ∀ {captures input output emit values state finalState index arity},
+      (lowerCaptures expr input captures).run state =
+        .ok (output, emit, values) finalState →
+      RecSelfAt input index arity → RecSelfAt output index arity := by
+  intro captures input output emit values state finalState index arity hrun
+  apply lowerCaptures_run_core
+    (Result := fun input output _ _ _ =>
+      RecSelfAt input index arity → RecSelfAt output index arity)
+    (e := expr) (hrun := hrun)
+  · intro input hself
+    exact hself
+  · intro captured rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail hself
+    exact htail
+      (lowerCapture_recSelfAt expr input captured hheadRun hself)
+
+def LowerEPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit} {value : AVal}
+      {index arity : Nat},
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+def LowerBorrowPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {release : Bool}
+      {index arity : Nat},
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, value, release) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+def LowerSpinePreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {head : IxIR0.Expr}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {index arity : Nat},
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, value) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+def KnownCallPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {build : Array Atom → Op} {count : Nat}
+      {argWorlds : List Owned} {resultWorld : Owned}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {index arity : Nat},
+    (knownCall src fuel input build count argWorlds resultWorld args).run
+      state = .ok (output, emit, value) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+def LowerArgsPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {args : List (IxIR0.Expr × Owned)}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {values : List AVal} {index arity : Nat},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, values) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+def ApplyRestPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {resultWorld : Owned} {pre : Emit}
+      {function : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {value : AVal} {index arity : Nat},
+    (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, value) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+def LowerLamPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {index arity : Nat},
+    (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState →
+    RecSelfAt input index arity → RecSelfAt output index arity
+
+structure LowerPreservesRecSelf (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEPreservesRecSelf src fuel
+  borrow : LowerBorrowPreservesRecSelf src fuel
+  spine : LowerSpinePreservesRecSelf src fuel
+  knownCall : KnownCallPreservesRecSelf src fuel
+  args : LowerArgsPreservesRecSelf src fuel
+  applyRest : ApplyRestPreservesRecSelf src fuel
+  lam : LowerLamPreservesRecSelf src fuel
+
+theorem lowerPreservesRecSelf_zero (src : IxIR0.Env) :
+    LowerPreservesRecSelf src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr state finalState output emit value index arity
+      hrun _
+    exact (throw_run_not_ok (by simpa [lowerE] using hrun)).elim
+  · intro input expr state finalState output emit value release index arity
+      hrun _
+    exact (throw_run_not_ok (by simpa [lowerBorrow] using hrun)).elim
+  · intro input world head args state finalState output emit value index
+      arity hrun _
+    exact (throw_run_not_ok (by simpa [lowerSpine] using hrun)).elim
+  · intro input build count argWorlds resultWorld args state finalState
+      output emit value index arity hrun _
+    exact (throw_run_not_ok (by simpa [knownCall] using hrun)).elim
+  · intro input args state finalState output emit values index arity hrun _
+    exact (throw_run_not_ok (by simpa [lowerArgs] using hrun)).elim
+  · intro input resultWorld pre function args state finalState output emit
+      value index arity hrun _
+    exact (throw_run_not_ok (by simpa [applyRest] using hrun)).elim
+  · intro input expr state finalState output emit value index arity hrun _
+    exact (throw_run_not_ok (by simpa [lowerLam] using hrun)).elim
+
+theorem lowerArgsPreservesRecSelf_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    (hargs : LowerArgsPreservesRecSelf src fuel) :
+    LowerArgsPreservesRecSelf src (fuel + 1) := by
+  intro input args state finalState output emit values index arity hrun hself
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, values) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    cases hpure.1
+    exact hself
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      bind_run_ok_inv hrun
+    rcases headResult with ⟨middle, headEmit, headValue⟩
+    obtain ⟨tailResult, tailState, htailRun, hafterTail⟩ :=
+      bind_run_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, tailEmit, tailValues⟩
+    have houtput : actualOutput = output := by
+      have hpure :
+          (actualOutput, headEmit ∘ tailEmit, headValue :: tailValues) =
+              (output, emit, values) ∧ tailState = finalState := by
+        simpa using hafterTail
+      exact congrArg Prod.fst hpure.1
+    subst output
+    exact hargs htailRun (hexpr hheadRun hself)
+
+theorem applyRestPreservesRecSelf_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesRecSelf src fuel) :
+    ApplyRestPreservesRecSelf src (fuel + 1) := by
+  intro input resultWorld pre function args state finalState output emit value
+    index arity hrun hself
+  cases function with
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest] at hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hrun
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hpure : (releaseAll middle values).1 = output := by
+        have hvalue :
+            ((releaseAll middle values).1,
+              pre ∘ argsEmit ∘ (releaseAll middle values).2,
+              AVal.constA .erased) = (output, emit, value) ∧
+              argsState = finalState := by
+          simpa using hpureRun
+        exact congrArg Prod.fst hvalue.1
+      subst output
+      exact releaseAll_recSelfAt middle values (hargs hargsRun hself)
+    | var relative =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have houtput : middle.bump = output := by
+        have hvalue := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1
+            | .error _ _ => input) hpureRun
+        simpa using hvalue
+      subst output
+      exact (hargs hargsRun hself).bump
+    | lit literal =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        bind_run_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have houtput : middle.bump = output := by
+        have hvalue := congrArg
+          (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+            match result with
+            | .ok value _ => value.1
+            | .error _ _ => input) hpureRun
+        simpa using hvalue
+      subst output
+      exact (hargs hargsRun hself).bump
+  | slotA abs =>
+    simp only [applyRest] at hrun
+    obtain ⟨_, checkedState, _, hafterCheck⟩ := bind_run_ok_inv hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      bind_run_ok_inv hafterCheck
+    rcases argsResult with ⟨middle, argsEmit, values⟩
+    have houtput : middle.bump = output := by
+      have hvalue := congrArg
+        (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+          match result with
+          | .ok value _ => value.1
+          | .error _ _ => input) hpureRun
+      simpa using hvalue
+    subst output
+    exact (hargs hargsRun hself).bump
+
+theorem knownCallPreservesRecSelf_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesRecSelf src fuel)
+    (hrest : ApplyRestPreservesRecSelf src fuel) :
+    KnownCallPreservesRecSelf src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args state finalState output
+    emit value index arity hrun hself
+  simp only [knownCall] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hafterArgs⟩ :=
+    bind_run_ok_inv hrun
+  rcases argsResult with ⟨middle, argsEmit, values⟩
+  have hmiddle := hargs hargsRun hself
+  by_cases hterminal : args.length ≤ count
+  · have houtput : middle.bump = output := by
+      have hvalue := congrArg
+        (fun result : EStateM.Result String LowSt (VEnv × Emit × AVal) =>
+          match result with
+          | .ok value _ => value.1
+          | .error _ _ => input) hafterArgs
+      simpa [hterminal] using hvalue
+    subst output
+    exact hmiddle.bump
+  · have hrestRun :
+        (applyRest src fuel middle.bump resultWorld
+          (argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray))
+          (.slotA middle.depth) (args.drop count)).run argsState =
+            .ok (output, emit, value) finalState := by
+      simpa [hterminal] using hafterArgs
+    exact hrest hrestRun hmiddle.bump
+
+private theorem lowerBorrow_dynamic_recSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {releaseFlag : Bool} {index arity : Nat}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal × Bool)}
+    (hrun : (finish <$> lowerE src fuel input .shared expr).run state =
+        .ok (output, emit, value, releaseFlag) finalState)
+    (hfinish : ∀ result, (finish result).1 = result.1)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity := by
+  obtain ⟨exprResult, hexprRun, hvalue⟩ := map_run_ok_inv hrun
+  rcases exprResult with ⟨middle, middleEmit, middleValue⟩
+  have houtput : middle = output := by
+    have := congrArg Prod.fst hvalue
+    simpa [hfinish] using this
+  subst output
+  exact hexpr hexprRun hself
+
+theorem lowerBorrowPreservesRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel) :
+    LowerBorrowPreservesRecSelf src (fuel + 1) := by
+  intro input expr state finalState output emit value release selfIndex
+    selfArity hrun hself
+  cases expr with
+  | var variableIndex =>
+    cases hentry : input.entries[variableIndex]? with
+    | none => exact (throw_run_not_ok (by
+        simpa [lowerBorrow, hentry] using hrun)).elim
+    | some entry =>
+      cases entry with
+      | recSelf arity => exact (throw_run_not_ok (by
+          simpa [lowerBorrow, hentry] using hrun)).elim
+      | slot abs remaining uses held =>
+        cases held with
+        | false => exact (throw_run_not_ok (by
+            simpa [lowerBorrow, hentry] using hrun)).elim
+        | true =>
+          by_cases hunique : worldOfUses uses = .unique
+          · have huuEq : (Owned.unique == Owned.unique) = true := by decide
+            exact (throw_run_not_ok (by
+              simpa [lowerBorrow, hentry, hunique, huuEq] using hrun)).elim
+          · have huniqueEq :
+                (worldOfUses uses == Owned.unique) = false := by
+              cases uses <;> simp_all [worldOfUses] <;> decide
+            cases remaining with
+            | zero => exact (throw_run_not_ok (by
+                simpa [lowerBorrow, hentry, huniqueEq] using hrun)).elim
+            | succ remaining =>
+              cases remaining with
+              | zero =>
+                have hpure :
+                    (input.setEntry variableIndex
+                        (.slot abs 0 uses false),
+                      (_root_.id : Emit), AVal.slotA abs, true) =
+                        (output, emit, value, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, huniqueEq] using hrun
+                cases hpure.1
+                exact hself.setSlot hentry abs 0 uses false
+              | succ remaining =>
+                have hpure :
+                    (input.setEntry variableIndex
+                        (.slot abs (remaining + 1) uses true),
+                      (_root_.id : Emit), AVal.slotA abs, false) =
+                        (output, emit, value, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, huniqueEq] using hrun
+                cases hpure.1
+                exact hself.setSlot hentry abs (remaining + 1) uses true
+  | ref address =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+  | app function argument =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+  | lam uses body =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+  | letE uses value body =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+  | proj index source =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+  | lit literal =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+  | erased =>
+    apply lowerBorrow_dynamic_recSelf hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl) hself
+
+private theorem lowerE_applyRest_recSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    (hrest : ApplyRestPreservesRecSelf src fuel)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal} {index arity : Nat}
+    (hrun : (do
+      let (middle, headEmit, function) ←
+        lowerE src fuel input .shared head
+      applyRest src fuel middle world headEmit function args).run state =
+        .ok (output, emit, value) finalState)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity := by
+  obtain ⟨headResult, middleState, hheadRun, hrestRun⟩ :=
+    bind_run_ok_inv hrun
+  rcases headResult with ⟨middle, headEmit, function⟩
+  exact hrest hrestRun (hexpr hheadRun hself)
+
+theorem lowerSpinePreservesRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    (hspine : LowerSpinePreservesRecSelf src fuel)
+    (hknown : KnownCallPreservesRecSelf src fuel)
+    (hrest : ApplyRestPreservesRecSelf src fuel) :
+    LowerSpinePreservesRecSelf src (fuel + 1) := by
+  intro input world head args state finalState output emit value selfIndex
+    selfArity hrun hself
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases head with
+  | app function argument =>
+    apply hspine
+    · simpa [lowerSpine] using hrun
+    · exact hself
+  | erased =>
+    apply hrest
+    · simpa [lowerSpine] using hrun
+    · exact hself
+  | var variableIndex =>
+    simp only [lowerSpine] at hrun
+    cases hentry : input.entries[variableIndex]? with
+    | none =>
+      apply lowerE_applyRest_recSelf hexpr hrest
+      · simpa [hentry] using hrun
+      · exact hself
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        rw [hentry] at hrun
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          exact (throw_run_not_ok hrun).elim
+        · rw [if_neg hunder] at hrun
+          obtain ⟨unitValue, checkedState, _, hknownRun⟩ :=
+            bind_run_ok_inv hrun
+          cases unitValue
+          exact hknown hknownRun hself
+      | slot abs remaining uses held =>
+        apply lowerE_applyRest_recSelf hexpr hrest
+        · simpa [hentry] using hrun
+        · exact hself
+  | ref address =>
+    simp only [lowerSpine] at hrun
+    cases hsource : src address with
+    | none =>
+      rw [hsource] at hrun
+      exact (throw_run_not_ok hrun).elim
+    | some decl =>
+      rw [hsource] at hrun
+      cases decl with
+      | defn result body =>
+        simp only at hrun
+        by_cases hunder : args.length < lamArity body
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared =>
+            cases result with
+            | unique => exact (throw_run_not_ok hrun).elim
+            | shared =>
+              cases hp : papSafe body with
+              | false => exact (throw_run_not_ok (by
+                  simpa [hp, hsuEq] using hrun)).elim
+              | true =>
+                apply hknown
+                · simpa [hp, hsuEq] using hrun
+                · exact hself
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, checkedState, _, hknownRun⟩ := bind_run_ok_inv hrun
+          exact hknown hknownRun hself
+      | ctor tag arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared =>
+            obtain ⟨wrapper, wrapperState, _, hknownRun⟩ :=
+              bind_run_ok_inv hrun
+            exact hknown hknownRun hself
+        · rw [if_neg hunder] at hrun
+          exact hknown hrun hself
+      | recursor numArgs natLit rules =>
+        simp only at hrun
+        by_cases hunder : args.length < numArgs + 1
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared => exact hknown hrun hself
+        · rw [if_neg hunder] at hrun
+          obtain ⟨_, checkedState, _, hknownRun⟩ := bind_run_ok_inv hrun
+          exact hknown hknownRun hself
+      | extern arity =>
+        simp only at hrun
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder] at hrun
+          cases world with
+          | unique => exact (throw_run_not_ok hrun).elim
+          | shared => exact hknown hrun hself
+        · rw [if_neg hunder] at hrun
+          exact hknown hrun hself
+  | lam uses body =>
+    apply lowerE_applyRest_recSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hself
+  | letE uses bound body =>
+    apply lowerE_applyRest_recSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hself
+  | proj index source =>
+    apply lowerE_applyRest_recSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hself
+  | lit literal =>
+    apply lowerE_applyRest_recSelf hexpr hrest
+    · simpa [lowerSpine] using hrun
+    · exact hself
+
+theorem lowerLamPreservesRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat} :
+    LowerLamPreservesRecSelf src (fuel + 1) := by
+  intro input expr state finalState output emit value index arity hrun hself
+  cases hp : papSafe expr with
+  | false => simp [lowerLam, hp] at hrun
+  | true =>
+    simp only [lowerLam] at hrun
+    simp only [hp, ↓reduceIte, bind_pure_comp] at hrun
+    let captures := (List.range input.entries.length).filter
+      (fun index => countUses index expr > 0)
+    have hcaptures : captures = (List.range input.entries.length).filter
+        (fun index => countUses index expr > 0) := rfl
+    rw [← hcaptures] at hrun
+    obtain ⟨captureResult, captureState, hcaptureRun, hafterCapture⟩ :=
+      bind_run_ok_inv hrun
+    rcases captureResult with ⟨captureOutput, captureEmit, captureValues⟩
+    obtain ⟨fnAddr, addressState, _, hafterFresh⟩ :=
+      bind_run_ok_inv hafterCapture
+    obtain ⟨code, bodyState, _, hafterBody⟩ :=
+      bind_run_ok_inv hafterFresh
+    obtain ⟨_, _, hvalue⟩ := map_run_ok_inv hafterBody
+    have houtput : captureOutput.bump = output :=
+      congrArg Prod.fst hvalue
+    subst output
+    exact (lowerCaptures_recSelfAt expr hcaptureRun hself).bump
+
+private theorem lowerE_proj_recSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowPreservesRecSelf src fuel)
+    {input output : VEnv} {world : Owned} {fieldIndex : Nat}
+    {source : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal} {index arity : Nat}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj fieldIndex source)).run state =
+        .ok (output, emit, value) finalState)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp [lowerE, huuEq] at hrun
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      bind_run_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hborrowSelf := hborrow hborrowRun hself
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure : borrowOutput.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowSelf.bump
+      | lit literal =>
+        have hpure : borrowOutput.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowSelf.bump
+      | erased =>
+        have hpure : borrowOutput = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowSelf
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure : borrowOutput.bump.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowSelf.bump.bump
+      | true =>
+        have hpure : borrowOutput.bump.bump.bump = output := by
+          have hvalue := congrArg
+            (fun result : EStateM.Result String LowSt
+                (VEnv × Emit × AVal) =>
+              match result with
+              | .ok value _ => value.1
+              | .error _ _ => input) hafterBorrow
+          simpa using hvalue
+        subst output
+        exact hborrowSelf.bump.bump.bump
+
+private theorem lowerE_mapped_body_pop_recSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    {middle bodyInput output : VEnv} {world : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal)}
+    {binder : VEntry} {index arity : Nat}
+    (hrun : (finish <$> lowerE src fuel bodyInput world body).run state =
+      .ok (output, emit, value) finalState)
+    (hfinish : ∀ result, (finish result).1 = result.1.pop)
+    (hentries : bodyInput.entries = binder :: middle.entries)
+    (hself : RecSelfAt middle index arity) :
+    RecSelfAt output index arity := by
+  obtain ⟨bodyResult, hbodyRun, hvalue⟩ := map_run_ok_inv hrun
+  rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+  have houtput : bodyOutput.pop = output := by
+    have := congrArg Prod.fst hvalue
+    simpa [hfinish] using this
+  subst output
+  have hbodyInput : RecSelfAt bodyInput (index + 1) arity := by
+    rw [RecSelfAt, hentries]
+    simpa [RecSelfAt] using hself
+  exact (hexpr hbodyRun hbodyInput).pop_succ
+
+private theorem lowerE_let_recSelf
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    {input output : VEnv} {world : Owned} {binderUses : Uses}
+    {bound body : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal} {index arity : Nat}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE binderUses bound body)).run state =
+        .ok (output, emit, value) finalState)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity := by
+  simp only [lowerE] at hrun
+  obtain ⟨boundResult, boundState, hboundRun, hafterBound⟩ :=
+    bind_run_ok_inv hrun
+  rcases boundResult with ⟨middle, boundEmit, boundValue⟩
+  have hmiddle := hexpr hboundRun hself
+  cases boundValue with
+  | slotA boundAbs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases binderUses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv
+          (by simpa [hzero] using hafterBound)
+        exact (throw_run_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := bind_run_ok_inv
+          (by simpa [hzero] using hafterBound)
+        exact (throw_run_not_ok hthrow).elim
+      | affine =>
+        let bodyInput : VEnv :=
+          { middle with
+            entries := .slot boundAbs 0 .affine false :: middle.entries
+            depth := middle.depth + 1 }
+        apply lowerE_mapped_body_pop_recSelf hexpr
+          (middle := middle) (bodyInput := bodyInput)
+          (by simpa [hzero, bodyInput] using hafterBound)
+          (fun _ => rfl) (by rfl) hmiddle
+      | many =>
+        let bodyInput : VEnv :=
+          { middle with
+            entries := .slot boundAbs 0 .many false :: middle.entries
+            depth := middle.depth + 1 }
+        apply lowerE_mapped_body_pop_recSelf hexpr
+          (middle := middle) (bodyInput := bodyInput)
+          (by simpa [hzero, bodyInput] using hafterBound)
+          (fun _ => rfl) (by rfl) hmiddle
+    · let bodyInput : VEnv :=
+        { middle with
+          entries :=
+            .slot boundAbs (countUses 0 body) binderUses true ::
+              middle.entries }
+      apply lowerE_mapped_body_pop_recSelf hexpr
+        (middle := middle) (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl) (by rfl) hmiddle
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput : VEnv :=
+        { middle with
+          entries := .slot middle.depth 0 binderUses false ::
+            middle.entries
+          depth := middle.depth + 1 }
+      apply lowerE_mapped_body_pop_recSelf hexpr
+        (middle := middle) (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl) (by rfl) hmiddle
+    · let bodyInput : VEnv :=
+        { middle with
+          entries :=
+            .slot middle.depth (countUses 0 body) binderUses true ::
+              middle.entries
+          depth := middle.depth + 1 }
+      apply lowerE_mapped_body_pop_recSelf hexpr
+        (middle := middle) (bodyInput := bodyInput)
+        (by simpa [hzero, bodyInput] using hafterBound)
+        (fun _ => rfl) (by rfl) hmiddle
+
+private theorem lowerE_var_recSelf
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {variableIndex : Nat} {state finalState : LowSt}
+    {emit : Emit} {value : AVal} {selfIndex selfArity : Nat}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.var variableIndex)).run state =
+        .ok (output, emit, value) finalState)
+    (hself : RecSelfAt input selfIndex selfArity) :
+    RecSelfAt output selfIndex selfArity := by
+  have hssNe : (Owned.shared != Owned.shared) = false := by decide
+  have huuNe : (Owned.unique != Owned.unique) = false := by decide
+  have hsuNe : (Owned.shared != Owned.unique) = true := by decide
+  have husNe : (Owned.unique != Owned.shared) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  cases hentry : input.entries[variableIndex]? with
+  | none => exact (throw_run_not_ok (by
+      simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact (throw_run_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact (throw_run_not_ok (by
+          simpa [lowerE, hentry] using hrun)).elim
+      | true =>
+        by_cases hworld : worldOfUses uses = world
+        · subst world
+          have hsame :
+              (worldOfUses uses != worldOfUses uses) = false := by
+            cases uses <;> decide
+          cases remaining with
+          | zero => exact (throw_run_not_ok (by
+              simpa [lowerE, hentry, hsame] using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry variableIndex (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, value) ∧ state = finalState := by
+                simpa [lowerE, hentry, hsame] using hrun
+              cases hpure.1
+              exact hself.setSlot hentry abs 0 uses false
+            | succ remaining =>
+              by_cases hunique : worldOfUses uses = .unique
+              · have huniqueEq :
+                    (worldOfUses uses == Owned.unique) = true := by
+                  rw [hunique]
+                  exact huuEq
+                exact (throw_run_not_ok (by
+                  simpa [lowerE, hentry, hsame, huniqueEq, huuNe]
+                    using hrun)).elim
+              · have huniqueEq :
+                    (worldOfUses uses == Owned.unique) = false := by
+                  cases uses <;> simp_all [worldOfUses] <;> decide
+                let changed := input.setEntry variableIndex
+                  (.slot abs (remaining + 1) uses true)
+                have hpure :
+                    (changed.bump,
+                      emitOp (.dup (.var (changed.rel abs))),
+                      AVal.slotA changed.depth) =
+                        (output, emit, value) ∧ state = finalState := by
+                  simpa [lowerE, hentry, hsame, huniqueEq, hssNe, changed]
+                    using hrun
+                cases hpure.1
+                exact (hself.setSlot hentry abs
+                  (remaining + 1) uses true).bump
+        · cases uses <;> cases world
+          all_goals
+            try { exact (hworld (by rfl)).elim }
+          all_goals
+            exact (throw_run_not_ok (by
+              simpa [lowerE, hentry, worldOfUses, hssNe, huuNe, hsuNe,
+                husNe, hsuEq, huuEq] using hrun)).elim
+
+theorem lowerEPreservesRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesRecSelf src fuel)
+    (hborrow : LowerBorrowPreservesRecSelf src fuel)
+    (hspine : LowerSpinePreservesRecSelf src fuel)
+    (hlam : LowerLamPreservesRecSelf src fuel) :
+    LowerEPreservesRecSelf src (fuel + 1) := by
+  intro input world expr state finalState output emit value index arity hrun
+    hself
+  cases expr with
+  | var variableIndex => exact lowerE_var_recSelf hrun hself
+  | ref address =>
+    exact hself.of_entries_eq (lowerE_ref_entries_eq_noRecSelf hrun)
+  | app function argument =>
+    apply hspine
+    · simpa [lowerE] using hrun
+    · exact hself
+  | lam uses body =>
+    cases world with
+    | unique =>
+      have huuEq : (Owned.unique == Owned.unique) = true := by decide
+      exact (throw_run_not_ok (by
+        simpa [lowerE, huuEq] using hrun)).elim
+    | shared =>
+      have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+      apply hlam
+      · simpa [lowerE, hsuEq] using hrun
+      · exact hself
+  | letE uses bound body => exact lowerE_let_recSelf hexpr hrun hself
+  | proj fieldIndex source => exact lowerE_proj_recSelf hborrow hrun hself
+  | lit literal =>
+    have hpure :
+        (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+            (output, emit, value) ∧ state = finalState := by
+      simpa [lowerE] using hrun
+    cases hpure.1
+    exact hself
+  | erased =>
+    have hpure :
+        (input, (_root_.id : Emit), AVal.constA .erased) =
+            (output, emit, value) ∧ state = finalState := by
+      simpa [lowerE] using hrun
+    cases hpure.1
+    exact hself
+
+theorem lowerPreservesRecSelf_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerPreservesRecSelf src fuel) :
+    LowerPreservesRecSelf src (fuel + 1) where
+  expr := lowerEPreservesRecSelf_succ
+    hprev.expr hprev.borrow hprev.spine hprev.lam
+  borrow := lowerBorrowPreservesRecSelf_succ hprev.expr
+  spine := lowerSpinePreservesRecSelf_succ
+    hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+  knownCall := knownCallPreservesRecSelf_succ hprev.args hprev.applyRest
+  args := lowerArgsPreservesRecSelf_succ hprev.expr hprev.args
+  applyRest := applyRestPreservesRecSelf_succ hprev.args
+  lam := lowerLamPreservesRecSelf_succ
+
+/-- Successful expression lowering preserves every synthetic recursive-self
+entry at its original logical index. -/
+theorem lowerPreservesRecSelf (src : IxIR0.Env) :
+    ∀ fuel, LowerPreservesRecSelf src fuel
+  | 0 => lowerPreservesRecSelf_zero src
+  | fuel + 1 =>
+    lowerPreservesRecSelf_succ (lowerPreservesRecSelf src fuel)
+
+theorem lowerE_recSelfAt
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {index arity : Nat}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState)
+    (hself : RecSelfAt input index arity) :
+    RecSelfAt output index arity :=
+  (lowerPreservesRecSelf src fuel).expr hrun hself
+
+end Ix.Compiler.IxIR1.Lower
diff --git a/Ix/Compiler/IxIR1/LowerStateSim.lean b/Ix/Compiler/IxIR1/LowerStateSim.lean
new file mode 100644
index 000000000..d4f4e01dd
--- /dev/null
+++ b/Ix/Compiler/IxIR1/LowerStateSim.lean
@@ -0,0 +1,8245 @@
+import Ix.Compiler.IxIR1.LowerSim
+
+/-!
+# Compile-state simulation for IxIR₀ → IxIR₁ lowering
+
+This companion proves that successful lowering consumes exactly each source
+entry's syntactic occurrence count. In particular, a counted let binder is
+released before the executable lowerer removes its logical entry.
+-/
+
+namespace Ix.Compiler.IxIR1.LowerSim
+
+open Ix.Compiler.Ixon (Owned Uses)
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.Sim
+
+theorem trackedThrowRun_not_ok {error state α : Type}
+    {err : error} {initial final : state} {value : α}
+    (h : (throw err : EStateM error state α).run initial =
+      .ok value final) : False := by
+  change EStateM.Result.error err initial = .ok value final at h
+  contradiction
+
+theorem trackedBindRun_ok_inv {error state α β : Type}
+    {action : EStateM error state α} {next : α → EStateM error state β}
+    {initial final : state} {result : β}
+    (h : (action >>= next).run initial = .ok result final) :
+    ∃ value middle,
+      action.run initial = .ok value middle ∧
+      (next value).run middle = .ok result final := by
+  change
+    (match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error err nextState => .error err nextState) =
+      .ok result final at h
+  cases haction : action.run initial with
+  | ok value middle =>
+    rw [haction] at h
+    exact ⟨value, middle, rfl, h⟩
+  | error err middle =>
+    rw [haction] at h
+    contradiction
+
+theorem trackedMapRun_ok_inv {error state α β : Type}
+    {action : EStateM error state α} {f : α → β}
+    {initial final : state} {result : β}
+    (hrun : (f <$> action).run initial = .ok result final) :
+    ∃ value, action.run initial = .ok value final ∧ f value = result := by
+  have hbind : (action >>= fun value => pure (f value)).run initial =
+      .ok result final := by
+    simpa only [bind_pure_comp] using hrun
+  obtain ⟨value, middle, haction, hpure⟩ := trackedBindRun_ok_inv hbind
+  have hresult : f value = result ∧ middle = final := by
+    simpa using hpure
+  cases hresult.2
+  exact ⟨value, haction, hresult.1⟩
+
+def EntryTracksAt (Γ : VEnv) (index abs : Nat) (uses : Uses)
+    (remaining : Nat) : Prop :=
+  Γ.entries[index]? =
+    some (.slot abs remaining uses (remaining != 0))
+
+def EntryConsumption (input output : VEnv)
+    (consumed : Nat → Nat) : Prop :=
+  ∀ index abs uses base,
+    EntryTracksAt input index abs uses (base + consumed index) →
+    EntryTracksAt output index abs uses base
+
+/-- Every entry in a fixed logical prefix has the requested remaining-use
+count and the canonical held bit. -/
+def EntriesTrackCounts (Γ : VEnv) (count : Nat)
+    (remaining : Nat → Nat) : Prop :=
+  ∀ index, index < count →
+    ∃ abs uses, EntryTracksAt Γ index abs uses (remaining index)
+
+private theorem entriesReleased_of_getElem_slot_false :
+    ∀ entries : List VEntry,
+      (∀ index, index < entries.length →
+        ∃ abs remaining uses,
+          entries[index]? = some (.slot abs remaining uses false)) →
+      EntriesReleased entries := by
+  intro entries
+  induction entries with
+  | nil => exact fun _ => .nil
+  | cons entry tail ih =>
+    intro hall
+    obtain ⟨abs, remaining, uses, hhead⟩ := hall 0 (by simp)
+    have hentry : entry = .slot abs remaining uses false := by
+      simpa using hhead
+    subst entry
+    apply EntriesReleased.slot
+    apply ih
+    intro index hindex
+    obtain ⟨tailAbs, tailRemaining, tailUses, htail⟩ :=
+      hall (index + 1) (by simp; omega)
+    exact ⟨tailAbs, tailRemaining, tailUses, by simpa using htail⟩
+
+/-- Exact consumption releases every tracked entry once the output is known to
+have no additional logical entries. -/
+theorem EntryConsumption.entriesReleased {input output : VEnv}
+    {consumed : Nat → Nat} {count : Nat}
+    (hconsume : EntryConsumption input output consumed)
+    (htracks : EntriesTrackCounts input count consumed)
+    (hlength : output.entries.length = count) :
+    EntriesReleased output.entries := by
+  apply entriesReleased_of_getElem_slot_false
+  intro index hindex
+  have hcount : index < count := by simpa [hlength] using hindex
+  obtain ⟨abs, uses, htrack⟩ := htracks index hcount
+  have hout := hconsume index abs uses 0 (by simpa using htrack)
+  exact ⟨abs, 0, uses, by simpa [EntryTracksAt] using hout⟩
+
+private theorem entriesReleased_of_prefix_slots_recSelf :
+    ∀ (count : Nat) (entries : List VEntry) (arity : Nat),
+      entries.length = count + 1 →
+      (∀ index, index < count →
+        ∃ abs remaining uses,
+          entries[index]? = some (.slot abs remaining uses false)) →
+      entries[count]? = some (.recSelf arity) →
+      EntriesReleased entries := by
+  intro count
+  induction count with
+  | zero =>
+    intro entries arity hlength _ hself
+    cases entries with
+    | nil => simp at hlength
+    | cons entry tail =>
+      have htailLength : tail.length = 0 := by simpa using hlength
+      cases tail with
+      | nil =>
+        have hentry : entry = .recSelf arity := by simpa using hself
+        subst entry
+        exact EntriesReleased.recSelf EntriesReleased.nil
+      | cons tailHead tailRest => simp at htailLength
+  | succ count ih =>
+    intro entries arity hlength hprefix hself
+    cases entries with
+    | nil => simp at hlength
+    | cons entry tail =>
+      obtain ⟨abs, remaining, uses, hhead⟩ :=
+        hprefix 0 (Nat.zero_lt_succ count)
+      have hentry : entry = .slot abs remaining uses false := by
+        simpa using hhead
+      subst entry
+      apply EntriesReleased.slot
+      apply ih tail arity
+      · simpa using hlength
+      · intro index hindex
+        obtain ⟨tailAbs, tailRemaining, tailUses, htail⟩ :=
+          hprefix (index + 1) (by omega)
+        exact ⟨tailAbs, tailRemaining, tailUses, by simpa using htail⟩
+      · simpa using hself
+
+/-- Exact consumption releases every ordinary entry in a tracked prefix while
+the structural lowering invariant preserves the trailing recursive-self
+entry used by recursor rule bodies. -/
+theorem EntryConsumption.entriesReleasedWithRecSelf
+    {input output : VEnv} {consumed : Nat → Nat}
+    {count arity : Nat}
+    (hconsume : EntryConsumption input output consumed)
+    (htracks : EntriesTrackCounts input count consumed)
+    (hlength : output.entries.length = count + 1)
+    (hself : RecSelfAt output count arity) :
+    EntriesReleased output.entries := by
+  apply entriesReleased_of_prefix_slots_recSelf count output.entries arity
+    hlength
+  · intro index hindex
+    obtain ⟨abs, uses, htrack⟩ := htracks index hindex
+    have hout := hconsume index abs uses 0 (by simpa using htrack)
+    exact ⟨abs, 0, uses, by simpa [EntryTracksAt] using hout⟩
+  · exact hself
+
+private theorem EntriesTrackCounts.frameLiveSlot
+    {Γ : VEnv} {count abs : Nat} {uses : Uses}
+    {remaining : Nat → Nat}
+    (htracks : EntriesTrackCounts Γ count remaining)
+    (hlength : Γ.entries.length = count)
+    (hlive : remaining count ≠ 0) :
+    EntriesTrackCounts
+      (frameVEnvEntries Γ
+        [.slot abs (remaining count) uses true])
+      (count + 1) remaining := by
+  intro index hindex
+  by_cases hprefix : index < count
+  · obtain ⟨trackedAbs, trackedUses, htrack⟩ := htracks index hprefix
+    refine ⟨trackedAbs, trackedUses, ?_⟩
+    have hΓ : index < Γ.entries.length := by simpa [hlength] using hprefix
+    rw [EntryTracksAt] at htrack ⊢
+    change (Γ.entries ++ [.slot abs (remaining count) uses true])[index]? = _
+    rw [List.getElem?_append_left hΓ]
+    exact htrack
+  · have hi : index = count := by omega
+    subst index
+    refine ⟨abs, uses, ?_⟩
+    simp [EntryTracksAt, frameVEnvEntries, hlength, hlive]
+
+private theorem EntriesTrackCounts.frameReleasedSlot
+    {Γ : VEnv} {count abs : Nat} {uses : Uses}
+    {remaining : Nat → Nat}
+    (htracks : EntriesTrackCounts Γ count remaining)
+    (hlength : Γ.entries.length = count)
+    (hdead : remaining count = 0) :
+    let framed := frameVEnvEntries Γ [.slot abs 0 uses true]
+    EntriesTrackCounts
+      ((framed.setEntry count (.slot abs 0 uses false)).bump)
+      (count + 1) remaining := by
+  dsimp only
+  intro index hindex
+  by_cases hprefix : index < count
+  · obtain ⟨trackedAbs, trackedUses, htrack⟩ := htracks index hprefix
+    refine ⟨trackedAbs, trackedUses, ?_⟩
+    have hframed : EntryTracksAt
+        (frameVEnvEntries Γ [.slot abs 0 uses true]) index trackedAbs
+          trackedUses (remaining index) := by
+      have hΓ : index < Γ.entries.length := by simpa [hlength] using hprefix
+      rw [EntryTracksAt] at htrack ⊢
+      change (Γ.entries ++ [.slot abs 0 uses true])[index]? = _
+      rw [List.getElem?_append_left hΓ]
+      exact htrack
+    have hne : count ≠ index := by omega
+    simpa [EntryTracksAt, VEnv.setEntry, VEnv.bump, hne] using hframed
+  · have hi : index = count := by omega
+    subst index
+    refine ⟨abs, uses, ?_⟩
+    rw [hdead]
+    simp [EntryTracksAt, frameVEnvEntries, VEnv.setEntry, VEnv.bump,
+      hlength]
+
+theorem EntriesTrackCounts.frameCanonicalSlot
+    {Γ : VEnv} {count abs : Nat} {uses : Uses}
+    {remaining : Nat → Nat}
+    (htracks : EntriesTrackCounts Γ count remaining)
+    (hlength : Γ.entries.length = count) :
+    EntriesTrackCounts
+      (frameVEnvEntries Γ
+        [.slot abs (remaining count) uses (remaining count != 0)])
+      (count + 1) remaining := by
+  intro index hindex
+  by_cases hprefix : index < count
+  · obtain ⟨trackedAbs, trackedUses, htrack⟩ := htracks index hprefix
+    refine ⟨trackedAbs, trackedUses, ?_⟩
+    have hΓ : index < Γ.entries.length := by simpa [hlength] using hprefix
+    rw [EntryTracksAt] at htrack ⊢
+    change
+      (Γ.entries ++
+        [.slot abs (remaining count) uses (remaining count != 0)])[index]? = _
+    rw [List.getElem?_append_left hΓ]
+    exact htrack
+  · have hi : index = count := by omega
+    subst index
+    refine ⟨abs, uses, ?_⟩
+    simp [EntryTracksAt, frameVEnvEntries, hlength]
+
+/-- The canonical generated parameter-drop plan leaves every logical parameter
+at its original remaining-use count with the canonical held bit. This
+strengthens `parameterDrops_releasePlan_atDepth` by recording the state fact
+needed after the body consumes those remaining occurrences. -/
+theorem parameterDrops_releasePlan_tracked_atDepth (base depth : Nat)
+    (modes : List Uses) (remaining : Nat → Nat)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨parameterEntries base modes remaining, depth⟩
+        (parameterDrops base modes remaining) output emit ∧
+      EntriesTrackCounts output modes.length remaining := by
+  exact parameterDrops_releasePlan_traverse remaining
+    (Result := fun _ _ sourceModes output =>
+      EntriesTrackCounts output sourceModes.length remaining)
+    (hnil := by
+      intro _ _ index hindex
+      simp at hindex)
+    (hlive := by
+      intro current _ mode rest innerOutput htracks hlength hlive
+      simpa using EntriesTrackCounts.frameLiveSlot
+        (abs := current) (uses := mode) htracks hlength hlive)
+    (hmany := by
+      intro current _ rest innerOutput htracks hlength hdead
+      simpa using EntriesTrackCounts.frameReleasedSlot
+        (abs := current) (uses := .many) htracks hlength hdead)
+    (haffine := by
+      intro current _ rest innerOutput htracks hlength hdead
+      simpa using EntriesTrackCounts.frameReleasedSlot
+        (abs := current) (uses := .affine) htracks hlength hdead)
+    base depth modes hadmissible
+
+/-- Canonical ordinary-function entry specialization. -/
+theorem parameterDrops_releasePlan_tracked (base : Nat)
+    (modes : List Uses) (remaining : Nat → Nat)
+    (hadmissible : ParameterDropsAdmissible modes remaining) :
+    ∃ output emit,
+      ReleasePlan
+        ⟨parameterEntries base modes remaining, base + modes.length⟩
+        (parameterDrops base modes remaining) output emit ∧
+      EntriesTrackCounts output modes.length remaining :=
+  parameterDrops_releasePlan_tracked_atDepth base (base + modes.length)
+    modes remaining hadmissible
+
+/-- The generated recursor-field retain fold leaves each field placeholder at
+exactly its RHS occurrence count.  Zero-use fields remain released; live
+fields are activated by the corresponding `dup`. -/
+theorem recursorFieldRetains_plan_tracked
+    (fieldAbs depth fieldCount : Nat) (rhs : IxIR0.Expr) :
+    let dead : VEntry := .slot 0 0 .many false
+    ∃ output emit,
+      FieldRetainPlan
+        ⟨List.replicate fieldCount dead, depth⟩
+        (recursorFieldRetains fieldAbs rhs fieldCount)
+        output emit ∧
+      EntriesTrackCounts output fieldCount
+        (fun index => countUses index rhs) := by
+  dsimp only
+  exact recursorFieldRetains_plan_traverse rhs
+    (Result := fun _ _ currentCount output =>
+      EntriesTrackCounts output currentCount
+        (fun index => countUses index rhs))
+    (hnilResult := by
+      intro _ _ index hindex
+      simp at hindex)
+    (hskipResult := by
+      intro _ _ currentCount tailOutput htracks hlength hzero
+      simpa [hzero] using EntriesTrackCounts.frameCanonicalSlot
+        (abs := 0) (uses := .many) htracks hlength)
+    (hretainResult := by
+      intro _ currentDepth currentCount tailOutput htracks hlength
+        hnonzero
+      simpa using EntriesTrackCounts.frameLiveSlot
+        (abs := currentDepth) (uses := .many) htracks hlength hnonzero)
+    fieldAbs depth fieldCount
+
+theorem replicate_many_parameterDropsAdmissible
+    (count : Nat) (remaining : Nat → Nat) :
+    ParameterDropsAdmissible (List.replicate count .many) remaining :=
+  parameterDropsAdmissible_replicate_many count remaining
+
+/-- Every descriptor in a successfully executed release list has a runtime
+release mode.  The other two source modes are precisely the error branches
+of `releaseSlots`. -/
+theorem releaseSlots_run_drop_admissible
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    {state finalState : LowSt}
+    (hrun : (releaseSlots input drops).run state =
+      .ok (output, emit) finalState) :
+    ∀ drop ∈ drops, drop.uses = .many ∨ drop.uses = .affine := by
+  exact releaseSlots_run_core
+    (Result := fun _ _ selectedDrops _ =>
+      ∀ drop ∈ selectedDrops,
+        drop.uses = .many ∨ drop.uses = .affine)
+    (hnil := by simp)
+    (haffine := by
+      intro entry abs rest initial final tailEmit htail selected hselected
+      rcases List.mem_cons.mp hselected with rfl | hrest
+      · exact Or.inr rfl
+      · exact htail selected hrest)
+    (hmany := by
+      intro entry abs rest initial final tailEmit htail selected hselected
+      rcases List.mem_cons.mp hselected with rfl | hrest
+      · exact Or.inl rfl
+      · exact htail selected hrest)
+    hrun
+
+/-- If every generated dead-parameter descriptor has a runtime release
+mode, the source telescope satisfies the exact syntactic admissibility
+predicate used by the function-entry proof. -/
+theorem parameterDropsAdmissible_of_drop_admissible
+    (base : Nat) (modes : List Uses) (remaining : Nat → Nat)
+    (hdrops : ∀ drop ∈ parameterDrops base modes remaining,
+      drop.uses = .many ∨ drop.uses = .affine) :
+    ParameterDropsAdmissible modes remaining := by
+  induction modes generalizing base with
+  | nil => trivial
+  | cons mode modes ih =>
+    constructor
+    · apply ih (base + 1)
+      intro drop hdrop
+      apply hdrops drop
+      simpa [parameterDrops] using
+        List.mem_append_left
+          (if remaining modes.length == 0 then
+            [⟨modes.length, base, mode⟩]
+          else []) hdrop
+    · intro hzero
+      apply hdrops ⟨modes.length, base, mode⟩
+      simp [parameterDrops, hzero]
+
+/-- Successful execution of the compiler-generated parameter release list
+is itself the missing admissibility certificate. -/
+theorem parameterDropsAdmissible_of_releaseSlots_run
+    (base : Nat) (modes : List Uses) (remaining : Nat → Nat)
+    {input output : VEnv} {emit : Emit} {state finalState : LowSt}
+    (hrun : (releaseSlots input (parameterDrops base modes remaining)).run
+      state = .ok (output, emit) finalState) :
+    ParameterDropsAdmissible modes remaining :=
+  parameterDropsAdmissible_of_drop_admissible base modes remaining
+    (releaseSlots_run_drop_admissible hrun)
+
+/-- The exact generated field/parameter prefix establishes the logical RHS
+layout needed by occurrence accounting: every ordinary entry is tracked by
+its RHS count and the final entry is the untouched recursive-self marker. -/
+theorem recursorPrefix_entries_tracked
+    (numArgs fields : Nat) (rhs : IxIR0.Expr) (state : LowSt)
+    {fieldOutput : VEnv} {fieldEmit : Emit}
+    {rhsInput : VEnv} {parameterEmit : Emit}
+    (hfieldRun :
+      applyRecursorFieldRetains
+          ⟨List.replicate fields (.slot 0 0 .many false),
+            (numArgs + 1) + fields⟩
+          (recursorFieldRetains (numArgs + 1) rhs fields) =
+        (fieldOutput, fieldEmit))
+    (hparameterRun :
+      (releaseSlots
+          ⟨fieldOutput.entries ++
+              parameterEntries 0 (List.replicate numArgs .many)
+                (fun i => countUses (fields + i) rhs) ++
+              [.recSelf (numArgs + 1)],
+            fieldOutput.depth + 1⟩
+          ((parameterDrops 0 (List.replicate numArgs .many)
+              (fun i => countUses (fields + i) rhs)).map
+            (SlotDrop.offsetEntry fields))).run state =
+        .ok (rhsInput, parameterEmit) state) :
+    EntriesTrackCounts rhsInput (fields + numArgs)
+        (fun index => countUses index rhs) ∧
+      rhsInput.entries.length = fields + numArgs + 1 ∧
+      RecSelfAt rhsInput (fields + numArgs) (numArgs + 1) := by
+  obtain ⟨plannedFieldOutput, plannedFieldEmit,
+      hfieldPlan, hfieldTracks⟩ :=
+    recursorFieldRetains_plan_tracked
+      (numArgs + 1) ((numArgs + 1) + fields) fields rhs
+  have hfieldEq :
+      (fieldOutput, fieldEmit) =
+        (plannedFieldOutput, plannedFieldEmit) :=
+    hfieldRun.symm.trans hfieldPlan.run
+  cases hfieldEq
+  have hfieldLength : fieldOutput.entries.length = fields := by
+    calc
+      fieldOutput.entries.length =
+          (List.replicate fields
+            (VEntry.slot 0 0 Uses.many false)).length :=
+        hfieldPlan.entries_length
+      _ = fields := by simp
+  let paramModes := List.replicate numArgs Uses.many
+  let paramRemaining : Nat → Nat :=
+    fun index => countUses (fields + index) rhs
+  obtain ⟨parameterOutput, plannedParameterEmit,
+      hparameterPlan, hparameterTracks⟩ :=
+    parameterDrops_releasePlan_tracked_atDepth
+      0 (fieldOutput.depth + 1) paramModes paramRemaining
+      (replicate_many_parameterDropsAdmissible numArgs paramRemaining)
+  have hparameterLength : parameterOutput.entries.length = numArgs := by
+    calc
+      parameterOutput.entries.length =
+          (parameterEntries 0 paramModes paramRemaining).length :=
+        hparameterPlan.entries_length
+      _ = numArgs := by simp [paramModes]
+  let plannedRhsInput :=
+    prependVEnvEntries fieldOutput.entries
+      (frameVEnvEntries parameterOutput [.recSelf (numArgs + 1)])
+  have hfullPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (fields + i) rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (fields + i) rhs)).map
+        (SlotDrop.offsetEntry fields))
+      plannedRhsInput plannedParameterEmit := by
+    have hframed := hparameterPlan.frameEntries
+      [.recSelf (numArgs + 1)]
+    have hprepended := hframed.prependEntries fieldOutput.entries
+    simpa [plannedRhsInput, prependVEnvEntries, frameVEnvEntries,
+      paramModes, paramRemaining, hfieldLength, List.append_assoc]
+      using hprepended
+  have hfullRun := hfullPlan.run state
+  have hrhsEq :
+      (plannedRhsInput, plannedParameterEmit) =
+          (rhsInput, parameterEmit) ∧ state = state := by
+    simpa using hfullRun.symm.trans hparameterRun
+  have hinputs := hrhsEq.1
+  have hrhsInput : plannedRhsInput = rhsInput :=
+    congrArg Prod.fst hinputs
+  subst rhsInput
+  refine ⟨?_, ?_, ?_⟩
+  · intro index hindex
+    by_cases hfield : index < fields
+    · obtain ⟨abs, uses, htrack⟩ := hfieldTracks index hfield
+      refine ⟨abs, uses, ?_⟩
+      rw [EntryTracksAt] at htrack ⊢
+      change
+        (fieldOutput.entries ++
+          (parameterOutput.entries ++ [.recSelf (numArgs + 1)]))[index]? = _
+      have hfield' : index < fieldOutput.entries.length := by
+        simpa [hfieldLength] using hfield
+      rw [List.getElem?_append_left hfield']
+      exact htrack
+    · let parameterIndex := index - fields
+      have hparameterIndex : parameterIndex < numArgs := by
+        dsimp only [parameterIndex]
+        omega
+      obtain ⟨abs, uses, htrack⟩ :=
+        hparameterTracks parameterIndex
+          (by simpa [paramModes] using hparameterIndex)
+      refine ⟨abs, uses, ?_⟩
+      rw [EntryTracksAt] at htrack ⊢
+      change
+        (fieldOutput.entries ++
+          (parameterOutput.entries ++ [.recSelf (numArgs + 1)]))[index]? = _
+      have hindexEq :
+          index = fieldOutput.entries.length + parameterIndex := by
+        dsimp only [parameterIndex]
+        omega
+      rw [hindexEq]
+      rw [List.getElem?_append_right (Nat.le_add_right _ _)]
+      simp only [Nat.add_sub_cancel_left]
+      have hparameter' :
+          parameterIndex < parameterOutput.entries.length := by
+        simpa [hparameterLength] using hparameterIndex
+      rw [List.getElem?_append_left hparameter']
+      simpa only [paramRemaining, hfieldLength] using htrack
+  · simp [plannedRhsInput, prependVEnvEntries, frameVEnvEntries,
+      hfieldLength, hparameterLength]
+    omega
+  · simp [RecSelfAt, plannedRhsInput, prependVEnvEntries,
+      frameVEnvEntries, hfieldLength, hparameterLength]
+
+theorem EntryTracksAt.index_lt {Γ : VEnv} {index abs : Nat}
+    {uses : Uses} {remaining : Nat}
+    (htrack : EntryTracksAt Γ index abs uses remaining) :
+    index < Γ.entries.length := by
+  rw [EntryTracksAt] at htrack
+  exact (List.getElem?_eq_some_iff.mp htrack).choose
+
+theorem EntryTracksAt.bump {Γ : VEnv} {index abs : Nat}
+    {uses : Uses} {remaining : Nat}
+    (htrack : EntryTracksAt Γ index abs uses remaining) :
+    EntryTracksAt Γ.bump index abs uses remaining := by
+  exact htrack
+
+theorem EntryTracksAt.of_entries_eq {Γ Δ : VEnv} {index abs : Nat}
+    {uses : Uses} {remaining : Nat}
+    (hentries : Δ.entries = Γ.entries)
+    (htrack : EntryTracksAt Γ index abs uses remaining) :
+    EntryTracksAt Δ index abs uses remaining := by
+  simpa [EntryTracksAt, hentries] using htrack
+
+theorem EntryTracksAt.set_self {Γ : VEnv} {index abs remaining : Nat}
+    {uses : Uses}
+    (htrack : EntryTracksAt Γ index abs uses remaining) :
+    EntryTracksAt
+      (Γ.setEntry index
+        (.slot abs remaining uses (remaining != 0)))
+      index abs uses remaining := by
+  rw [EntryTracksAt, VEnv.setEntry, List.getElem?_set]
+  simp [htrack.index_lt]
+
+theorem EntryTracksAt.set_self_to {Γ : VEnv}
+    {index oldAbs oldRemaining : Nat} {oldUses : Uses}
+    (newAbs remaining : Nat) (uses : Uses)
+    (htrack : EntryTracksAt Γ index oldAbs oldUses oldRemaining) :
+    EntryTracksAt
+      (Γ.setEntry index
+        (.slot newAbs remaining uses (remaining != 0)))
+      index newAbs uses remaining := by
+  rw [EntryTracksAt, VEnv.setEntry, List.getElem?_set]
+  simp [htrack.index_lt]
+
+theorem EntryTracksAt.set_ne {Γ : VEnv} {tracked changed abs : Nat}
+    {uses : Uses} {remaining : Nat} {entry : VEntry}
+    (hne : changed ≠ tracked)
+    (htrack : EntryTracksAt Γ tracked abs uses remaining) :
+    EntryTracksAt (Γ.setEntry changed entry) tracked abs uses remaining := by
+  rw [EntryTracksAt, VEnv.setEntry, List.getElem?_set]
+  simp [hne]
+  simpa [EntryTracksAt] using htrack
+
+theorem EntryTracksAt.slot_inj {Γ : VEnv} {index : Nat}
+    {knownAbs knownRemaining trackedAbs trackedRemaining : Nat}
+    {knownUses trackedUses : Uses} {knownHeld : Bool}
+    (htrack : EntryTracksAt Γ index trackedAbs trackedUses
+      trackedRemaining)
+    (hentry : Γ.entries[index]? = some
+      (.slot knownAbs knownRemaining knownUses knownHeld)) :
+    knownAbs = trackedAbs ∧ knownRemaining = trackedRemaining ∧
+      knownUses = trackedUses ∧
+      knownHeld = (trackedRemaining != 0) := by
+  rw [EntryTracksAt] at htrack
+  have hsome := Option.some.inj (hentry.symm.trans htrack)
+  exact VEntry.slot.inj hsome
+
+theorem EntryTracksAt.cons {Γ : VEnv} {index abs : Nat}
+    {uses : Uses} {remaining : Nat} {entry : VEntry}
+    (htrack : EntryTracksAt Γ index abs uses remaining) :
+    EntryTracksAt { Γ with entries := entry :: Γ.entries }
+      (index + 1) abs uses remaining := by
+  simpa [EntryTracksAt] using htrack
+
+theorem EntryTracksAt.pop_succ {Γ : VEnv} {index abs : Nat}
+    {uses : Uses} {remaining : Nat}
+    (htrack : EntryTracksAt Γ (index + 1) abs uses remaining) :
+    EntryTracksAt Γ.pop index abs uses remaining := by
+  simpa [EntryTracksAt, VEnv.pop] using htrack
+
+theorem EntryConsumption.zero (Γ : VEnv) :
+    EntryConsumption Γ Γ (fun _ => 0) := by
+  intro index abs uses base htrack
+  simpa using htrack
+
+theorem EntryConsumption.bump {input output : VEnv}
+    {consumed : Nat → Nat}
+    (hconsume : EntryConsumption input output consumed) :
+    EntryConsumption input output.bump consumed := by
+  intro index abs uses base htrack
+  exact (hconsume index abs uses base htrack).bump
+
+theorem EntryConsumption.comp {first middle final : VEnv}
+    {left right : Nat → Nat}
+    (hleft : EntryConsumption first middle left)
+    (hright : EntryConsumption middle final right) :
+    EntryConsumption first final (fun i => left i + right i) := by
+  intro index abs uses base htrack
+  have hfirst : EntryTracksAt first index abs uses
+      ((base + right index) + left index) := by
+    simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using htrack
+  exact hright index abs uses base
+    (hleft index abs uses (base + right index) hfirst)
+
+theorem EntryConsumption.bind_under_binder
+    {input middle bodyInput bodyOutput : VEnv}
+    {value body : IxIR0.Expr} {binder : VEntry}
+    (hvalue : EntryConsumption input middle
+      (fun index => countUses index value))
+    (hbody : EntryConsumption bodyInput bodyOutput
+      (fun index => countUses index body))
+    (hentries : bodyInput.entries = binder :: middle.entries) :
+    EntryConsumption input bodyOutput.pop
+      (fun index => countUses index value + countUses (index + 1) body) := by
+  intro index abs uses base htrack
+  have hvalueInput : EntryTracksAt input index abs uses
+      ((base + countUses (index + 1) body) + countUses index value) := by
+    simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using htrack
+  have hmiddle := hvalue index abs uses
+    (base + countUses (index + 1) body) hvalueInput
+  have hbodyInput : EntryTracksAt bodyInput (index + 1) abs uses
+      (base + countUses (index + 1) body) := by
+    rw [EntryTracksAt, hentries]
+    simpa [EntryTracksAt] using hmiddle
+  exact EntryTracksAt.pop_succ
+    (hbody (index + 1) abs uses base hbodyInput)
+
+theorem EntryConsumption.of_entries_eq {input output : VEnv}
+    (hentries : output.entries = input.entries) :
+    EntryConsumption input output (fun _ => 0) := by
+  intro index abs uses base htrack
+  simpa [EntryTracksAt, hentries] using htrack
+
+theorem releaseAll_entries_eq (input : VEnv) :
+    ∀ values : List AVal,
+      (releaseAll input values).1.entries = input.entries := by
+  intro values
+  exact releaseAll_traverse_core
+    (Result := fun initial _ output _ =>
+      output.entries = initial.entries)
+    (hnil := fun _ => rfl)
+    (hconst := fun htail => htail)
+    (hslot := by
+      intro initial abs rest output tailEmit htail
+      simpa [VEnv.bump] using htail)
+    input values
+
+theorem releaseAll_consumes_zero (input : VEnv) (values : List AVal) :
+    EntryConsumption input (releaseAll input values).1 (fun _ => 0) :=
+  EntryConsumption.of_entries_eq (releaseAll_entries_eq input values)
+
+theorem FirstEntryTracks.entryTracksAt
+    {Γ : VEnv} {uses : Uses} {remaining : Nat}
+    (htrack : FirstEntryTracks Γ uses remaining) :
+    ∃ abs, EntryTracksAt Γ 0 abs uses remaining := by
+  obtain ⟨abs, tail, hentries⟩ := htrack
+  exact ⟨abs, by simp [EntryTracksAt, hentries]⟩
+
+theorem EntryTracksAt.zeroReleased {Γ : VEnv} {abs : Nat}
+    {uses : Uses}
+    (htrack : EntryTracksAt Γ 0 abs uses 0) :
+    FirstEntryReleased Γ := by
+  cases hentries : Γ.entries with
+  | nil => simp [EntryTracksAt, hentries] at htrack
+  | cons entry tail =>
+    have hentry : entry = .slot abs 0 uses false := by
+      simpa [EntryTracksAt, hentries] using htrack
+    subst entry
+    exact ⟨abs, 0, uses, tail, hentries⟩
+
+def countUsesExprs (index : Nat) (exprs : List IxIR0.Expr) : Nat :=
+  (exprs.map (countUses index)).sum
+
+def countUsesArgs (index : Nat)
+    (args : List (IxIR0.Expr × Owned)) : Nat :=
+  (args.map (fun arg => countUses index arg.1)).sum
+
+@[simp] theorem countUsesArgs_map_shared (index : Nat)
+    (exprs : List IxIR0.Expr) :
+    countUsesArgs index (exprs.map (fun expr => (expr, Owned.shared))) =
+      countUsesExprs index exprs := by
+  induction exprs with
+  | nil => rfl
+  | cons expr rest ih =>
+    simp [countUsesArgs, countUsesExprs, Function.comp_def]
+
+theorem countUsesArgs_zip (index : Nat) :
+    ∀ (exprs : List IxIR0.Expr) (worlds : List Owned),
+      exprs.length ≤ worlds.length →
+      countUsesArgs index (exprs.zip worlds) =
+        countUsesExprs index exprs := by
+  intro exprs
+  induction exprs with
+  | nil => intro worlds _; rfl
+  | cons expr rest ih =>
+    intro worlds hlength
+    cases worlds with
+    | nil => simp at hlength
+    | cons world worlds =>
+      simp only [List.length_cons, Nat.add_le_add_iff_right] at hlength
+      change countUses index expr +
+          countUsesArgs index (rest.zip worlds) =
+        countUses index expr + countUsesExprs index rest
+      rw [ih worlds hlength]
+
+@[simp] theorem padWorlds_length (worlds : List Owned) (count : Nat) :
+    (padWorlds worlds count).length = count := by
+  simp [padWorlds]
+  omega
+
+theorem countUsesArgs_knownPrefix (index : Nat)
+    (args : List IxIR0.Expr) (worlds : List Owned) (count : Nat) :
+    countUsesArgs index ((args.take count).zip (padWorlds worlds count)) =
+      countUsesExprs index (args.take count) := by
+  apply countUsesArgs_zip
+  simpa using Nat.min_le_left count args.length
+
+theorem countUsesExprs_take_add_drop (index count : Nat)
+    (args : List IxIR0.Expr) :
+    countUsesExprs index (args.take count) +
+        countUsesExprs index (args.drop count) =
+      countUsesExprs index args := by
+  simp only [countUsesExprs]
+  rw [← List.sum_append, ← List.map_append]
+  simp
+
+def LowerEConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit} {av : AVal},
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState →
+    EntryConsumption input output (fun index => countUses index expr)
+
+theorem LowerEConsumesEntries.releasesTrackedFirst
+    {src : IxIR0.Env} {fuel : Nat}
+    (hconsume : LowerEConsumesEntries src fuel) (expr : IxIR0.Expr) :
+    LowerEReleasesTrackedFirst src fuel expr := by
+  intro input output world uses state finalState emit av htrack hrun
+  obtain ⟨abs, hat⟩ := htrack.entryTracksAt
+  apply EntryTracksAt.zeroReleased (abs := abs)
+  exact hconsume hrun 0 abs uses 0 (by simpa using hat)
+
+theorem lowerE_var_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {varIndex : Nat} {emit : Emit} {av : AVal}
+    {state finalState : LowSt}
+    (hrun : (lowerE src (fuel + 1) input world (.var varIndex)).run state =
+      .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.var varIndex)) := by
+  have hssNe : (Owned.shared != Owned.shared) = false := by decide
+  have huuNe : (Owned.unique != Owned.unique) = false := by decide
+  have hsuNe : (Owned.shared != Owned.unique) = true := by decide
+  have husNe : (Owned.unique != Owned.shared) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  intro index abs uses base htrack
+  by_cases heq : varIndex = index
+  · subst index
+    cases base with
+    | zero =>
+      have hentry : input.entries[varIndex]? =
+          some (.slot abs 1 uses true) := by
+        simpa [EntryTracksAt, countUses] using htrack
+      by_cases hworld : worldOfUses uses = world
+      · subst world
+        have hsame :
+            (worldOfUses uses != worldOfUses uses) = false := by
+          cases uses <;> decide
+        have hpure :
+            (input.setEntry varIndex (.slot abs 0 uses false),
+              (_root_.id : Emit), AVal.slotA abs) =
+                (output, emit, av) ∧ state = finalState := by
+          simpa [lowerE, hentry, hsame] using hrun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        apply EntryTracksAt.set_self_to abs 0 uses
+        exact htrack
+      · cases uses <;> cases world
+        all_goals
+          try { exact (hworld (by rfl)).elim }
+        all_goals
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hentry, worldOfUses, hssNe, huuNe, hsuNe,
+              husNe, hsuEq, huuEq] using hrun)).elim
+    | succ base =>
+      have hentry : input.entries[varIndex]? =
+          some (.slot abs (base + 2) uses true) := by
+        simpa [EntryTracksAt, countUses, Nat.add_assoc] using htrack
+      by_cases hworld : worldOfUses uses = world
+      · subst world
+        have hsame :
+            (worldOfUses uses != worldOfUses uses) = false := by
+          cases uses <;> decide
+        cases uses with
+        | erased =>
+          have heqUnique :
+              (Owned.shared == Owned.unique) = false := by decide
+          have hpure :
+              let changed := input.setEntry varIndex
+                (.slot abs (base + 1) .erased true)
+              (changed.bump,
+                emitOp (.dup (.var (changed.rel abs))),
+                AVal.slotA changed.depth) = (output, emit, av) ∧
+                state = finalState := by
+            simpa [lowerE, hentry, worldOfUses, hsame, heqUnique,
+              hssNe] using hrun
+          dsimp only at hpure
+          obtain ⟨hvalue, hstate⟩ := hpure
+          cases hvalue
+          subst finalState
+          apply EntryTracksAt.bump
+          apply EntryTracksAt.set_self_to abs (base + 1) .erased
+          exact htrack
+        | linear =>
+          have heqUnique :
+              (Owned.unique == Owned.unique) = true := by decide
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hentry, worldOfUses, hsame, heqUnique,
+              huuNe] using hrun)).elim
+        | affine =>
+          have heqUnique :
+              (Owned.unique == Owned.unique) = true := by decide
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hentry, worldOfUses, hsame, heqUnique,
+              huuNe] using hrun)).elim
+        | many =>
+          have heqUnique :
+              (Owned.shared == Owned.unique) = false := by decide
+          have hpure :
+              let changed := input.setEntry varIndex
+                (.slot abs (base + 1) .many true)
+              (changed.bump,
+                emitOp (.dup (.var (changed.rel abs))),
+                AVal.slotA changed.depth) = (output, emit, av) ∧
+                state = finalState := by
+            simpa [lowerE, hentry, worldOfUses, hsame, heqUnique,
+              hssNe] using hrun
+          dsimp only at hpure
+          obtain ⟨hvalue, hstate⟩ := hpure
+          cases hvalue
+          subst finalState
+          apply EntryTracksAt.bump
+          apply EntryTracksAt.set_self_to abs (base + 1) .many
+          exact htrack
+      · cases uses <;> cases world
+        all_goals
+          try { exact (hworld (by rfl)).elim }
+        all_goals
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hentry, worldOfUses, hssNe, huuNe, hsuNe,
+              husNe, hsuEq, huuEq] using hrun)).elim
+  · have hcount : countUses index (.var varIndex) = 0 := by
+      simp [countUses, heq]
+    have htrack' : EntryTracksAt input index abs uses base := by
+      simpa [hcount] using htrack
+    cases hentry : input.entries[varIndex]? with
+    | none =>
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerE, hentry] using hrun)).elim
+      | slot variableAbs remaining variableUses held =>
+        cases held with
+        | false =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hentry] using hrun)).elim
+        | true =>
+          by_cases hworld : worldOfUses variableUses = world
+          · subst world
+            have hsame :
+                (worldOfUses variableUses != worldOfUses variableUses) =
+                  false := by
+              cases variableUses <;> decide
+            cases remaining with
+            | zero =>
+              exact (trackedThrowRun_not_ok (by
+                simpa [lowerE, hentry, hsame] using hrun)).elim
+            | succ remaining =>
+              cases remaining with
+              | zero =>
+                have hpure :
+                    (input.setEntry varIndex
+                        (.slot variableAbs 0 variableUses false),
+                      (_root_.id : Emit), AVal.slotA variableAbs) =
+                        (output, emit, av) ∧ state = finalState := by
+                  simpa [lowerE, hentry, hsame] using hrun
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact EntryTracksAt.set_ne heq htrack'
+              | succ remaining =>
+                cases variableUses with
+                | erased =>
+                  have heqUnique :
+                      (Owned.shared == Owned.unique) = false := by decide
+                  have hpure :
+                      let changed := input.setEntry varIndex
+                        (.slot variableAbs (Nat.succ remaining) .erased true)
+                      (changed.bump,
+                        emitOp (.dup (.var (changed.rel variableAbs))),
+                        AVal.slotA changed.depth) = (output, emit, av) ∧
+                        state = finalState := by
+                    simpa [lowerE, hentry, worldOfUses, hsame,
+                      heqUnique, hssNe] using hrun
+                  dsimp only at hpure
+                  obtain ⟨hvalue, hstate⟩ := hpure
+                  cases hvalue
+                  subst finalState
+                  exact (EntryTracksAt.set_ne heq htrack').bump
+                | linear =>
+                  have heqUnique :
+                      (Owned.unique == Owned.unique) = true := by decide
+                  exact (trackedThrowRun_not_ok (by
+                    simpa [lowerE, hentry, worldOfUses, hsame, heqUnique,
+                      huuNe] using hrun)).elim
+                | affine =>
+                  have heqUnique :
+                      (Owned.unique == Owned.unique) = true := by decide
+                  exact (trackedThrowRun_not_ok (by
+                    simpa [lowerE, hentry, worldOfUses, hsame, heqUnique,
+                      huuNe] using hrun)).elim
+                | many =>
+                  have heqUnique :
+                      (Owned.shared == Owned.unique) = false := by decide
+                  have hpure :
+                      let changed := input.setEntry varIndex
+                        (.slot variableAbs (Nat.succ remaining) .many true)
+                      (changed.bump,
+                        emitOp (.dup (.var (changed.rel variableAbs))),
+                        AVal.slotA changed.depth) = (output, emit, av) ∧
+                        state = finalState := by
+                    simpa [lowerE, hentry, worldOfUses, hsame,
+                      heqUnique, hssNe] using hrun
+                  dsimp only at hpure
+                  obtain ⟨hvalue, hstate⟩ := hpure
+                  cases hvalue
+                  subst finalState
+                  exact (EntryTracksAt.set_ne heq htrack').bump
+          · have hdiff : (worldOfUses variableUses != world) = true := by
+              cases variableUses <;> cases world <;>
+                simp_all [worldOfUses] <;> decide
+            cases variableUses <;> cases world
+            all_goals
+              try { exact (hworld (by rfl)).elim }
+            all_goals
+              exact (trackedThrowRun_not_ok (by
+                simpa [lowerE, hentry, worldOfUses, hdiff, hssNe, huuNe,
+                  hsuNe, husNe, hsuEq, huuEq] using hrun)).elim
+
+def LowerBorrowConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit}
+      {av : AVal} {release : Bool},
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, av, release) finalState →
+    EntryConsumption input output (fun index => countUses index expr)
+
+def LowerSpineConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Owned} {head : IxIR0.Expr}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {av : AVal},
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, av) finalState →
+    EntryConsumption input output
+      (fun index => countUses index head + countUsesExprs index args)
+
+def LowerArgsConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {args : List (IxIR0.Expr × Owned)}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {avs : List AVal},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, avs) finalState →
+    EntryConsumption input output (fun index => countUsesArgs index args)
+
+def KnownCallConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {build : Array Atom → Op} {count : Nat}
+      {argWorlds : List Owned} {resultWorld : Owned}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {av : AVal},
+    (knownCall src fuel input build count argWorlds resultWorld args).run
+      state = .ok (output, emit, av) finalState →
+    EntryConsumption input output (fun index => countUsesExprs index args)
+
+def ApplyRestConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {resultWorld : Owned} {pre : Emit}
+      {function : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {av : AVal},
+    (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, av) finalState →
+    EntryConsumption input output (fun index => countUsesExprs index args)
+
+def LowerLamConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv}
+      {emit : Emit} {av : AVal},
+    (lowerLam src fuel input expr).run state =
+      .ok (output, emit, av) finalState →
+    EntryConsumption input output (fun index => countUses index expr)
+
+structure LowerConsumesEntries (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEConsumesEntries src fuel
+  borrow : LowerBorrowConsumesEntries src fuel
+  spine : LowerSpineConsumesEntries src fuel
+  knownCall : KnownCallConsumesEntries src fuel
+  args : LowerArgsConsumesEntries src fuel
+  applyRest : ApplyRestConsumesEntries src fuel
+  lam : LowerLamConsumesEntries src fuel
+
+theorem lowerConsumesEntries_zero (src : IxIR0.Env) :
+    LowerConsumesEntries src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr state finalState output emit av hrun
+    exact (trackedThrowRun_not_ok (by simpa [lowerE] using hrun)).elim
+  · intro input expr state finalState output emit av release hrun
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerBorrow] using hrun)).elim
+  · intro input world head args state finalState output emit av hrun
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerSpine] using hrun)).elim
+  · intro input build count argWorlds resultWorld args state finalState
+      output emit av hrun
+    exact (trackedThrowRun_not_ok (by
+      simpa [knownCall] using hrun)).elim
+  · intro input args state finalState output emit avs hrun
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerArgs] using hrun)).elim
+  · intro input resultWorld pre function args state finalState output emit av
+      hrun
+    exact (trackedThrowRun_not_ok (by
+      simpa [applyRest] using hrun)).elim
+  · intro input expr state finalState output emit av hrun
+    exact (trackedThrowRun_not_ok (by simpa [lowerLam] using hrun)).elim
+
+theorem lowerArgsConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    (hargs : LowerArgsConsumesEntries src fuel) :
+    LowerArgsConsumesEntries src (fuel + 1) := by
+  intro input args state finalState output emit avs hrun
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, avs) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    simpa [countUsesArgs] using EntryConsumption.zero input
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hheadRun, hafterHead⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases headResult with ⟨middle, headEmit, av⟩
+    obtain ⟨tailResult, tailState, htailRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, tailEmit, tailValues⟩
+    have hpure :
+        (actualOutput, headEmit ∘ tailEmit, av :: tailValues) =
+            (output, emit, avs) ∧ tailState = finalState := by
+      simpa using hpureRun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    have hcomposed := (hexpr hheadRun).comp (hargs htailRun)
+    simpa [countUsesArgs] using hcomposed
+
+theorem applyRestConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsConsumesEntries src fuel) :
+    ApplyRestConsumesEntries src (fuel + 1) := by
+  intro input resultWorld pre function args state finalState output emit av
+    hrun
+  cases function with
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest] at hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hrun
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hpure :
+          ((releaseAll middle values).1,
+            pre ∘ argsEmit ∘ (releaseAll middle values).2,
+            AVal.constA .erased) = (output, emit, av) ∧
+            argsState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hcomposed := (hargs hargsRun).comp
+        (releaseAll_consumes_zero middle values)
+      simpa using hcomposed
+    | var functionIndex =>
+      simp only [applyRest] at hrun
+      obtain ⟨unitValue, checkedState, _, hafterCheck⟩ :=
+        trackedBindRun_ok_inv hrun
+      cases unitValue
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hpure :
+          (middle.bump,
+            pre ∘ argsEmit ∘ emitOp (.apply
+              ((AVal.constA (.var functionIndex)).toAtom middle)
+              (values.map (·.toAtom middle)).toArray),
+            AVal.slotA middle.depth) = (output, emit, av) ∧
+            argsState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      simpa using (hargs hargsRun).bump
+    | lit literal =>
+      simp only [applyRest] at hrun
+      obtain ⟨unitValue, checkedState, _, hafterCheck⟩ :=
+        trackedBindRun_ok_inv hrun
+      cases unitValue
+      obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hpure :
+          (middle.bump,
+            pre ∘ argsEmit ∘ emitOp (.apply
+              ((AVal.constA (.lit literal)).toAtom middle)
+              (values.map (·.toAtom middle)).toArray),
+            AVal.slotA middle.depth) = (output, emit, av) ∧
+            argsState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      simpa using (hargs hargsRun).bump
+  | slotA functionAbs =>
+    simp only [applyRest] at hrun
+    obtain ⟨unitValue, checkedState, _, hafterCheck⟩ :=
+      trackedBindRun_ok_inv hrun
+    cases unitValue
+    obtain ⟨argsResult, argsState, hargsRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hafterCheck
+    rcases argsResult with ⟨middle, argsEmit, values⟩
+    have hpure :
+        (middle.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.slotA functionAbs).toAtom middle)
+            (values.map (·.toAtom middle)).toArray),
+          AVal.slotA middle.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa using hpureRun
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    simpa using (hargs hargsRun).bump
+
+theorem knownCallConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsConsumesEntries src fuel)
+    (hrest : ApplyRestConsumesEntries src fuel) :
+    KnownCallConsumesEntries src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args state finalState output
+    emit av hrun
+  simp only [knownCall] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hafterArgs⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases argsResult with ⟨middle, argsEmit, values⟩
+  have hprefix := hargs hargsRun
+  have hprefix' : EntryConsumption input middle
+      (fun index => countUsesExprs index (args.take count)) := by
+    simpa only [countUsesArgs_knownPrefix] using hprefix
+  by_cases hterminal : args.length ≤ count
+  · have hpure :
+        (middle.bump,
+          argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray),
+          AVal.slotA middle.depth) = (output, emit, av) ∧
+          argsState = finalState := by
+      simpa [hterminal] using hafterArgs
+    obtain ⟨hvalue, hstate⟩ := hpure
+    cases hvalue
+    subst finalState
+    have htake : args.take count = args :=
+      List.take_of_length_le hterminal
+    simpa [htake] using hprefix'.bump
+  · have hrestRun :
+        (applyRest src fuel middle.bump resultWorld
+          (argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray))
+          (.slotA middle.depth) (args.drop count)).run argsState =
+            .ok (output, emit, av) finalState := by
+      simpa [hterminal] using hafterArgs
+    have hcomposed := hprefix'.bump.comp (hrest hrestRun)
+    simpa [countUsesArgs_knownPrefix,
+      countUsesExprs_take_add_drop] using hcomposed
+
+theorem lowerSpine_dynamic_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    (hrest : ApplyRestConsumesEntries src fuel)
+    {input output : VEnv} {world : Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (do
+      let (middle, headEmit, function) ←
+        lowerE src fuel input .shared head
+      applyRest src fuel middle world headEmit function args).run state =
+        .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index head + countUsesExprs index args) := by
+  obtain ⟨headResult, middleState, hheadRun, hrestRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases headResult with ⟨middle, headEmit, function⟩
+  exact (hexpr hheadRun).comp (hrest hrestRun)
+
+theorem lowerSpine_var_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    (hknown : KnownCallConsumesEntries src fuel)
+    (hrest : ApplyRestConsumesEntries src fuel)
+    {input output : VEnv} {world : Owned} {varIndex : Nat}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (lowerSpine src (fuel + 1) input world (.var varIndex)
+      args).run state = .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.var varIndex) +
+        countUsesExprs index args) := by
+  simp only [lowerSpine] at hrun
+  cases hentry : input.entries[varIndex]? with
+  | none =>
+    rw [hentry] at hrun
+    simp only at hrun
+    exact lowerSpine_dynamic_consumesEntries hexpr hrest hrun
+  | some entry =>
+    cases entry with
+    | slot abs remaining uses held =>
+      rw [hentry] at hrun
+      simp only at hrun
+      exact lowerSpine_dynamic_consumesEntries hexpr hrest hrun
+    | recSelf arity =>
+      rw [hentry] at hrun
+      simp only at hrun
+      by_cases hunder : args.length < arity
+      · rw [if_pos hunder] at hrun
+        exact (trackedThrowRun_not_ok hrun).elim
+      · rw [if_neg hunder] at hrun
+        obtain ⟨unitValue, checkedState, _, hknownRun⟩ :=
+          trackedBindRun_ok_inv hrun
+        cases unitValue
+        have hargsConsume := hknown hknownRun
+        intro index trackedAbs trackedUses base htrack
+        have hne : varIndex ≠ index := by
+          intro heq
+          subst index
+          rw [EntryTracksAt] at htrack
+          rw [hentry] at htrack
+          cases htrack
+        have hzero : countUses index (.var varIndex) = 0 := by
+          simp [countUses, hne]
+        exact hargsConsume index trackedAbs trackedUses base
+          (by simpa [hzero] using htrack)
+
+theorem lowerSpine_ref_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat}
+    (hknown : KnownCallConsumesEntries src fuel)
+    {input output : VEnv} {world : Owned} {address : Ixon.Address}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (lowerSpine src (fuel + 1) input world (.ref address)
+      args).run state = .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.ref address) +
+        countUsesExprs index args) := by
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  simp only [lowerSpine] at hrun
+  cases hsource : src address with
+  | none =>
+    rw [hsource] at hrun
+    exact (trackedThrowRun_not_ok hrun).elim
+  | some decl =>
+    rw [hsource] at hrun
+    cases decl with
+    | defn result body =>
+      simp only at hrun
+      by_cases hunder : args.length < lamArity body
+      · rw [if_pos hunder] at hrun
+        cases world with
+        | unique => exact (trackedThrowRun_not_ok hrun).elim
+        | shared =>
+          cases result with
+          | unique => exact (trackedThrowRun_not_ok hrun).elim
+          | shared =>
+            cases hp : papSafe body with
+            | false =>
+              exact (trackedThrowRun_not_ok (by
+                simpa [hp, hsuEq] using hrun)).elim
+            | true =>
+              have hknownRun :
+                  (knownCall src fuel input (.papp address ·) args.length
+                    (List.replicate args.length .shared) .shared args).run
+                    state = .ok (output, emit, av) finalState := by
+                simpa [hp, hsuEq] using hrun
+              simpa [countUses] using hknown hknownRun
+      · rw [if_neg hunder] at hrun
+        obtain ⟨unitValue, checkedState, _, hknownRun⟩ :=
+          trackedBindRun_ok_inv hrun
+        cases unitValue
+        simpa [countUses] using hknown hknownRun
+    | ctor tag arity =>
+      simp only at hrun
+      by_cases hunder : args.length < arity
+      · rw [if_pos hunder] at hrun
+        cases world with
+        | unique => exact (trackedThrowRun_not_ok hrun).elim
+        | shared =>
+          obtain ⟨wrapper, wrapperState, _, hknownRun⟩ :=
+            trackedBindRun_ok_inv hrun
+          simpa [countUses] using hknown hknownRun
+      · rw [if_neg hunder] at hrun
+        simpa [countUses] using hknown hrun
+    | recursor numArgs natLit rules =>
+      simp only at hrun
+      by_cases hunder : args.length < numArgs + 1
+      · rw [if_pos hunder] at hrun
+        cases world with
+        | unique => exact (trackedThrowRun_not_ok hrun).elim
+        | shared => simpa [countUses] using hknown hrun
+      · rw [if_neg hunder] at hrun
+        obtain ⟨unitValue, checkedState, _, hknownRun⟩ :=
+          trackedBindRun_ok_inv hrun
+        cases unitValue
+        simpa [countUses] using hknown hknownRun
+    | extern arity =>
+      simp only at hrun
+      by_cases hunder : args.length < arity
+      · rw [if_pos hunder] at hrun
+        cases world with
+        | unique => exact (trackedThrowRun_not_ok hrun).elim
+        | shared => simpa [countUses] using hknown hrun
+      · rw [if_neg hunder] at hrun
+        simpa [countUses] using hknown hrun
+
+theorem lowerSpineConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    (hspine : LowerSpineConsumesEntries src fuel)
+    (hknown : KnownCallConsumesEntries src fuel)
+    (hrest : ApplyRestConsumesEntries src fuel) :
+    LowerSpineConsumesEntries src (fuel + 1) := by
+  intro input world head args state finalState output emit av hrun
+  cases head with
+  | app function argument =>
+    have hrecursive := hspine (by simpa [lowerSpine] using hrun)
+    simpa [countUses, countUsesExprs, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm] using hrecursive
+  | erased =>
+    have happly := hrest (by simpa [lowerSpine] using hrun)
+    simpa [countUses] using happly
+  | var index =>
+    exact lowerSpine_var_consumesEntries hexpr hknown hrest hrun
+  | ref address =>
+    exact lowerSpine_ref_consumesEntries hknown hrun
+  | lam uses body =>
+    exact lowerSpine_dynamic_consumesEntries hexpr hrest
+      (by simpa [lowerSpine] using hrun)
+  | letE uses value body =>
+    exact lowerSpine_dynamic_consumesEntries hexpr hrest
+      (by simpa [lowerSpine] using hrun)
+  | proj index source =>
+    exact lowerSpine_dynamic_consumesEntries hexpr hrest
+      (by simpa [lowerSpine] using hrun)
+  | lit literal =>
+    exact lowerSpine_dynamic_consumesEntries hexpr hrest
+      (by simpa [lowerSpine] using hrun)
+
+theorem lowerBorrow_var_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {varIndex : Nat} {state finalState : LowSt}
+    {emit : Emit} {av : AVal} {release : Bool}
+    (hrun : (lowerBorrow src (fuel + 1) input (.var varIndex)).run state =
+      .ok (output, emit, av, release) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.var varIndex)) := by
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  intro index abs uses base htrack
+  by_cases heq : varIndex = index
+  · subst index
+    cases base with
+    | zero =>
+      have hentry : input.entries[varIndex]? =
+          some (.slot abs 1 uses true) := by
+        simpa [EntryTracksAt, countUses] using htrack
+      cases uses with
+      | erased =>
+        have hpure :
+            (input.setEntry varIndex (.slot abs 0 .erased false),
+              (_root_.id : Emit), AVal.slotA abs, true) =
+                (output, emit, av, release) ∧ state = finalState := by
+          simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        apply EntryTracksAt.set_self_to abs 0 .erased
+        exact htrack
+      | linear =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+            using hrun)).elim
+      | affine =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+            using hrun)).elim
+      | many =>
+        have hpure :
+            (input.setEntry varIndex (.slot abs 0 .many false),
+              (_root_.id : Emit), AVal.slotA abs, true) =
+                (output, emit, av, release) ∧ state = finalState := by
+          simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        apply EntryTracksAt.set_self_to abs 0 .many
+        exact htrack
+    | succ base =>
+      have hentry : input.entries[varIndex]? =
+          some (.slot abs (base + 2) uses true) := by
+        simpa [EntryTracksAt, countUses, Nat.add_assoc] using htrack
+      cases uses with
+      | erased =>
+        have hpure :
+            (input.setEntry varIndex
+                (.slot abs (base + 1) .erased true),
+              (_root_.id : Emit), AVal.slotA abs, false) =
+                (output, emit, av, release) ∧ state = finalState := by
+          simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        apply EntryTracksAt.set_self_to abs (base + 1) .erased
+        exact htrack
+      | linear =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+            using hrun)).elim
+      | affine =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+            using hrun)).elim
+      | many =>
+        have hpure :
+            (input.setEntry varIndex
+                (.slot abs (base + 1) .many true),
+              (_root_.id : Emit), AVal.slotA abs, false) =
+                (output, emit, av, release) ∧ state = finalState := by
+          simpa [lowerBorrow, hentry, worldOfUses, hsuEq] using hrun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        apply EntryTracksAt.set_self_to abs (base + 1) .many
+        exact htrack
+  · have hcount : countUses index (.var varIndex) = 0 := by
+      simp [countUses, heq]
+    have htrack' : EntryTracksAt input index abs uses base := by
+      simpa [hcount] using htrack
+    cases hentry : input.entries[varIndex]? with
+    | none =>
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerBorrow, hentry] using hrun)).elim
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry] using hrun)).elim
+      | slot variableAbs remaining variableUses held =>
+        cases held with
+        | false =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerBorrow, hentry] using hrun)).elim
+        | true =>
+          cases variableUses with
+          | linear =>
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+                using hrun)).elim
+          | affine =>
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerBorrow, hentry, worldOfUses, huuEq]
+                using hrun)).elim
+          | erased =>
+            cases remaining with
+            | zero =>
+              exact (trackedThrowRun_not_ok (by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                  using hrun)).elim
+            | succ remaining =>
+              cases remaining with
+              | zero =>
+                have hpure :
+                    (input.setEntry varIndex
+                        (.slot variableAbs 0 .erased false),
+                      (_root_.id : Emit), AVal.slotA variableAbs, true) =
+                        (output, emit, av, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                    using hrun
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact EntryTracksAt.set_ne heq htrack'
+              | succ remaining =>
+                have hpure :
+                    (input.setEntry varIndex
+                        (.slot variableAbs (remaining + 1) .erased true),
+                      (_root_.id : Emit), AVal.slotA variableAbs, false) =
+                        (output, emit, av, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                    using hrun
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact EntryTracksAt.set_ne heq htrack'
+          | many =>
+            cases remaining with
+            | zero =>
+              exact (trackedThrowRun_not_ok (by
+                simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                  using hrun)).elim
+            | succ remaining =>
+              cases remaining with
+              | zero =>
+                have hpure :
+                    (input.setEntry varIndex
+                        (.slot variableAbs 0 .many false),
+                      (_root_.id : Emit), AVal.slotA variableAbs, true) =
+                        (output, emit, av, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                    using hrun
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact EntryTracksAt.set_ne heq htrack'
+              | succ remaining =>
+                have hpure :
+                    (input.setEntry varIndex
+                        (.slot variableAbs (remaining + 1) .many true),
+                      (_root_.id : Emit), AVal.slotA variableAbs, false) =
+                        (output, emit, av, release) ∧
+                      state = finalState := by
+                  simpa [lowerBorrow, hentry, worldOfUses, hsuEq]
+                    using hrun
+                obtain ⟨hvalue, hstate⟩ := hpure
+                cases hvalue
+                subst finalState
+                exact EntryTracksAt.set_ne heq htrack'
+
+theorem lowerBorrow_dynamic_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    {release : Bool}
+    (hshape : DynamicBorrowHead expr)
+    (hrun : (lowerBorrow src (fuel + 1) input expr).run state =
+      .ok (output, emit, av, release) finalState) :
+    EntryConsumption input output (fun index => countUses index expr) := by
+  cases hshape <;> simp only [lowerBorrow] at hrun
+  all_goals
+    obtain ⟨exprResult, exprState, hexprRun, hpureRun⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases exprResult with ⟨actualOutput, actualEmit, value⟩
+    simp at hpureRun
+    have houtput : actualOutput = output := hpureRun.1.1
+    subst output
+    exact hexpr hexprRun
+
+theorem lowerBorrowConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel) :
+    LowerBorrowConsumesEntries src (fuel + 1) := by
+  intro input expr state finalState output emit av release hrun
+  cases expr with
+  | var index => exact lowerBorrow_var_consumesEntries hrun
+  | ref address =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr (.ref address) hrun
+  | app function argument =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr
+      (.app function argument) hrun
+  | lam uses body =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr (.lam uses body) hrun
+  | letE uses value body =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr
+      (.letE uses value body) hrun
+  | proj index source =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr
+      (.proj index source) hrun
+  | lit literal =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr (.lit literal) hrun
+  | erased =>
+    exact lowerBorrow_dynamic_consumesEntries hexpr .erased hrun
+
+def captureUseCount (expr : IxIR0.Expr) (captures : List Nat)
+    (index : Nat) : Nat :=
+  captures.count index * countUses index expr
+
+@[simp] theorem captureUseCount_nil (expr : IxIR0.Expr) :
+    captureUseCount expr [] = fun _ => 0 := by
+  funext index
+  simp [captureUseCount]
+
+theorem captureUseCount_cons (expr : IxIR0.Expr) (captured : Nat)
+    (rest : List Nat) :
+    captureUseCount expr (captured :: rest) = fun index =>
+      (if captured = index then countUses index expr else 0) +
+        captureUseCount expr rest index := by
+  funext index
+  by_cases heq : captured = index
+  · subst index
+    simp [captureUseCount, Nat.add_mul, Nat.add_comm]
+  · have hne : index ≠ captured := Ne.symm heq
+    simp [captureUseCount, heq]
+
+theorem lowerCapture_consumesEntries
+    {expr : IxIR0.Expr} {input output : VEnv} {captured : Nat}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerCapture expr input captured).run state =
+      .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => if captured = index then countUses index expr else 0) := by
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  simp only [lowerCapture] at hrun
+  cases hentry : input.entries[captured]? with
+  | none =>
+    rw [hentry] at hrun
+    exact (trackedThrowRun_not_ok hrun).elim
+  | some entry =>
+    rw [hentry] at hrun
+    cases entry with
+    | recSelf arity =>
+      exact (trackedThrowRun_not_ok hrun).elim
+    | slot capturedAbs remaining capturedUses held =>
+      cases held with
+      | false =>
+        exact (trackedThrowRun_not_ok hrun).elim
+      | true =>
+        cases capturedUses with
+        | linear =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [worldOfUses, huuEq] using hrun)).elim
+        | affine =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [worldOfUses, huuEq] using hrun)).elim
+        | erased =>
+          by_cases hmore : remaining > countUses captured expr
+          · have hpure :
+                let changed := input.setEntry captured
+                  (.slot capturedAbs
+                    (remaining - countUses captured expr) .erased true)
+                (changed.bump,
+                  emitOp (.dup (.var (changed.rel capturedAbs))),
+                  AVal.slotA changed.depth) = (output, emit, av) ∧
+                  state = finalState := by
+              simpa [worldOfUses, hsuEq, hmore] using hrun
+            dsimp only at hpure
+            obtain ⟨hvalue, hstate⟩ := hpure
+            cases hvalue
+            subst finalState
+            intro index abs uses base htrack
+            by_cases heq : captured = index
+            · subst index
+              obtain ⟨rfl, hremaining, rfl, _⟩ :=
+                htrack.slot_inj hentry
+              simp at hremaining
+              have hbase : 0 < base := by omega
+              have hbne : (base != 0) = true := by
+                simp [Nat.ne_of_gt hbase]
+              have hcanonical := EntryTracksAt.set_self_to capturedAbs
+                base .erased htrack
+              apply EntryTracksAt.bump
+              simpa [hremaining, Nat.add_sub_cancel_right,
+                Nat.ne_of_gt hbase, hbne] using hcanonical
+            · have hzero :
+                  (if captured = index then countUses index expr else 0) =
+                    0 := by simp [heq]
+              have htrack' :
+                  EntryTracksAt input index abs uses base := by
+                simpa [hzero] using htrack
+              exact (EntryTracksAt.set_ne heq htrack').bump
+          · by_cases hequal : remaining = countUses captured expr
+            · have hpure :
+                  (input.setEntry captured
+                      (.slot capturedAbs 0 .erased false),
+                    (_root_.id : Emit), AVal.slotA capturedAbs) =
+                      (output, emit, av) ∧ state = finalState := by
+                simpa [worldOfUses, hsuEq, hmore, hequal] using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              intro index abs uses base htrack
+              by_cases heq : captured = index
+              · subst index
+                obtain ⟨rfl, hremaining, rfl, _⟩ :=
+                  htrack.slot_inj hentry
+                simp at hremaining
+                have hbase : base = 0 := by omega
+                subst base
+                apply EntryTracksAt.set_self_to capturedAbs 0 .erased
+                exact htrack
+              · have hzero :
+                    (if captured = index then countUses index expr else 0) =
+                      0 := by simp [heq]
+                have htrack' :
+                    EntryTracksAt input index abs uses base := by
+                  simpa [hzero] using htrack
+                exact EntryTracksAt.set_ne heq htrack'
+            · exact (trackedThrowRun_not_ok (by
+                simpa [worldOfUses, hsuEq, hmore, hequal]
+                  using hrun)).elim
+        | many =>
+          by_cases hmore : remaining > countUses captured expr
+          · have hpure :
+                let changed := input.setEntry captured
+                  (.slot capturedAbs
+                    (remaining - countUses captured expr) .many true)
+                (changed.bump,
+                  emitOp (.dup (.var (changed.rel capturedAbs))),
+                  AVal.slotA changed.depth) = (output, emit, av) ∧
+                  state = finalState := by
+              simpa [worldOfUses, hsuEq, hmore] using hrun
+            dsimp only at hpure
+            obtain ⟨hvalue, hstate⟩ := hpure
+            cases hvalue
+            subst finalState
+            intro index abs uses base htrack
+            by_cases heq : captured = index
+            · subst index
+              obtain ⟨rfl, hremaining, rfl, _⟩ :=
+                htrack.slot_inj hentry
+              simp at hremaining
+              have hbase : 0 < base := by omega
+              have hbne : (base != 0) = true := by
+                simp [Nat.ne_of_gt hbase]
+              have hcanonical := EntryTracksAt.set_self_to capturedAbs
+                base .many htrack
+              apply EntryTracksAt.bump
+              simpa [hremaining, Nat.add_sub_cancel_right,
+                Nat.ne_of_gt hbase, hbne] using hcanonical
+            · have hzero :
+                  (if captured = index then countUses index expr else 0) =
+                    0 := by simp [heq]
+              have htrack' :
+                  EntryTracksAt input index abs uses base := by
+                simpa [hzero] using htrack
+              exact (EntryTracksAt.set_ne heq htrack').bump
+          · by_cases hequal : remaining = countUses captured expr
+            · have hpure :
+                  (input.setEntry captured
+                      (.slot capturedAbs 0 .many false),
+                    (_root_.id : Emit), AVal.slotA capturedAbs) =
+                      (output, emit, av) ∧ state = finalState := by
+                simpa [worldOfUses, hsuEq, hmore, hequal] using hrun
+              obtain ⟨hvalue, hstate⟩ := hpure
+              cases hvalue
+              subst finalState
+              intro index abs uses base htrack
+              by_cases heq : captured = index
+              · subst index
+                obtain ⟨rfl, hremaining, rfl, _⟩ :=
+                  htrack.slot_inj hentry
+                simp at hremaining
+                have hbase : base = 0 := by omega
+                subst base
+                apply EntryTracksAt.set_self_to capturedAbs 0 .many
+                exact htrack
+              · have hzero :
+                    (if captured = index then countUses index expr else 0) =
+                      0 := by simp [heq]
+                have htrack' :
+                    EntryTracksAt input index abs uses base := by
+                  simpa [hzero] using htrack
+                exact EntryTracksAt.set_ne heq htrack'
+            · exact (trackedThrowRun_not_ok (by
+                simpa [worldOfUses, hsuEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_consumesEntries (expr : IxIR0.Expr) :
+    ∀ {captures : List Nat} {input output : VEnv}
+      {state finalState : LowSt} {emit : Emit} {values : List AVal},
+    (lowerCaptures expr input captures).run state =
+      .ok (output, emit, values) finalState →
+    EntryConsumption input output (captureUseCount expr captures) := by
+  intro captures input output state finalState emit values hrun
+  apply lowerCaptures_run_core
+    (Result := fun input output captures _ _ =>
+      EntryConsumption input output (captureUseCount expr captures))
+    (e := expr) (hrun := hrun)
+  · intro input
+    rw [captureUseCount_nil]
+    exact EntryConsumption.zero input
+  · intro captured rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hheadRun htail
+    have hcomposed :=
+      (lowerCapture_consumesEntries hheadRun).comp htail
+    rw [captureUseCount_cons]
+    exact hcomposed
+
+theorem captureUseCount_selected_at (expr : IxIR0.Expr) (length index : Nat)
+    (hindex : index < length) :
+    captureUseCount expr
+        ((List.range length).filter (fun i => countUses i expr > 0))
+        index =
+      countUses index expr := by
+  by_cases hzero : countUses index expr = 0
+  · simp [captureUseCount, hzero]
+  · have hpositive : (countUses index expr > 0 : Bool) = true := by
+      simp
+      omega
+    have hcount :
+        List.count index
+            ((List.range length).filter
+              (fun i => countUses i expr > 0)) =
+          List.count index (List.range length) :=
+      List.count_filter (p := fun i => countUses i expr > 0)
+        (a := index) (l := List.range length) hpositive
+    rw [captureUseCount, hcount, List.count_range]
+    simp [hindex]
+
+theorem lowerCaptures_selected_consumesEntries
+    {expr : IxIR0.Expr} {input output : VEnv}
+    {state finalState : LowSt} {emit : Emit} {values : List AVal}
+    (hrun : (lowerCaptures expr input
+      ((List.range input.entries.length).filter
+        (fun i => countUses i expr > 0))).run state =
+        .ok (output, emit, values) finalState) :
+    EntryConsumption input output (fun index => countUses index expr) := by
+  have hcaptures := lowerCaptures_consumesEntries expr hrun
+  intro index abs uses base htrack
+  have hcount := captureUseCount_selected_at expr input.entries.length
+    index htrack.index_lt
+  exact hcaptures index abs uses base (by simpa [hcount] using htrack)
+
+theorem lowerLamConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat} :
+    LowerLamConsumesEntries src (fuel + 1) := by
+  intro input expr state finalState output emit av hrun
+  apply lowerLam_run_core
+    (Result := fun _ output _ _ =>
+      EntryConsumption input output (fun index => countUses index expr))
+    (hrun := hrun)
+  intro _bodyFuel captureOutput captureEmit captureValues captureState
+    _fnAddr _addressState _code _bodyState _hfuel _hp hcaptureRun _hfreshRun
+    _hbodyRun
+  have hselected :
+      (lowerCaptures expr input
+        ((List.range input.entries.length).filter
+          (fun index => countUses index expr > 0))).run state =
+        .ok (captureOutput, captureEmit, captureValues) captureState := by
+    simpa [liftCaptureIndices] using hcaptureRun
+  exact (lowerCaptures_selected_consumesEntries hselected).bump
+
+theorem lowerE_let_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    {input output : VEnv} {world : Owned} {binderUses : Uses}
+    {value body : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE binderUses value body)).run state =
+        .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.letE binderUses value body)) := by
+  simp only [lowerE] at hrun
+  obtain ⟨valueResult, valueState, hvalueRun, hafterValue⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  have hvalueConsume := hexpr hvalueRun
+  cases boundValue with
+  | slotA boundAbs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases binderUses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := trackedBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (trackedThrowRun_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := trackedBindRun_ok_inv
+          (by simpa [hzero] using hafterValue)
+        exact (trackedThrowRun_not_ok hthrow).elim
+      | affine =>
+        let heldInput :=
+          installAliasBinder middle boundAbs 0 Uses.affine true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot boundAbs 0 .affine false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.dropU (.var (middle.rel boundAbs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hpureRun⟩ :=
+          trackedBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.dropU (.var (middle.rel boundAbs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hpureRun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        have hentries : bodyInput.entries =
+            (.slot boundAbs 0 .affine false) :: middle.entries := by
+          simp [bodyInput, heldInput, installAliasBinder, VEnv.setEntry,
+            VEnv.bump]
+        simpa [countUses] using hvalueConsume.bind_under_binder
+          (hexpr hbodyRun) hentries
+      | many =>
+        let heldInput :=
+          installAliasBinder middle boundAbs 0 Uses.many true
+        let bodyInput :=
+          (heldInput.setEntry 0 (.slot boundAbs 0 .many false)).bump
+        have hcontinue :
+            ((lowerE src fuel bodyInput world body) >>= fun result =>
+              let (bodyOutput, bodyEmit, resultValue) := result
+              pure (bodyOutput.pop,
+                valueEmit ∘ emitOp (.drop (.var (middle.rel boundAbs))) ∘
+                  bodyEmit,
+                resultValue)).run valueState =
+              .ok (output, emit, av) finalState := by
+          simpa [hzero, heldInput, bodyInput, installAliasBinder,
+            VEnv.setEntry, VEnv.bump] using hafterValue
+        obtain ⟨bodyResult, bodyState, hbodyRun, hpureRun⟩ :=
+          trackedBindRun_ok_inv hcontinue
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+        have hpure :
+            (bodyOutput.pop,
+              valueEmit ∘ emitOp (.drop (.var (middle.rel boundAbs))) ∘
+                bodyEmit,
+              resultValue) = (output, emit, av) ∧
+              bodyState = finalState := by
+          simpa using hpureRun
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        have hentries : bodyInput.entries =
+            (.slot boundAbs 0 .many false) :: middle.entries := by
+          simp [bodyInput, heldInput, installAliasBinder, VEnv.setEntry,
+            VEnv.bump]
+        simpa [countUses] using hvalueConsume.bind_under_binder
+          (hexpr hbodyRun) hentries
+    · let bodyInput := installAliasBinder middle boundAbs
+          (countUses 0 body) binderUses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue)).run
+            valueState = .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installAliasBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop, valueEmit ∘ bodyEmit, resultValue) =
+              (output, emit, av) ∧ bodyState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hentries : bodyInput.entries =
+          (.slot boundAbs (countUses 0 body) binderUses true) ::
+            middle.entries := by
+        simp [bodyInput, installAliasBinder]
+      simpa [countUses] using hvalueConsume.bind_under_binder
+        (hexpr hbodyRun) hentries
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · let bodyInput := installPushedBinder middle 0 binderUses false
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop,
+            valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hentries : bodyInput.entries =
+          (.slot middle.depth 0 binderUses false) :: middle.entries := by
+        simp [bodyInput, installPushedBinder]
+      simpa [countUses] using hvalueConsume.bind_under_binder
+        (hexpr hbodyRun) hentries
+    · let bodyInput := installPushedBinder middle (countUses 0 body)
+          binderUses true
+      have hcontinue :
+          ((lowerE src fuel bodyInput world body) >>= fun result =>
+            let (bodyOutput, bodyEmit, resultValue) := result
+            pure (bodyOutput.pop,
+              valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+              resultValue)).run valueState =
+            .ok (output, emit, av) finalState := by
+        simpa [hzero, bodyInput, installPushedBinder] using hafterValue
+      obtain ⟨bodyResult, bodyState, hbodyRun, hpureRun⟩ :=
+        trackedBindRun_ok_inv hcontinue
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, resultValue⟩
+      have hpure :
+          (bodyOutput.pop,
+            valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit,
+            resultValue) = (output, emit, av) ∧
+            bodyState = finalState := by
+        simpa using hpureRun
+      obtain ⟨hvalue, hstate⟩ := hpure
+      cases hvalue
+      subst finalState
+      have hentries : bodyInput.entries =
+          (.slot middle.depth (countUses 0 body) binderUses true) ::
+            middle.entries := by
+        simp [bodyInput, installPushedBinder]
+      simpa [countUses] using hvalueConsume.bind_under_binder
+        (hexpr hbodyRun) hentries
+
+theorem lowerE_proj_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowConsumesEntries src fuel)
+    {input output : VEnv} {world : Owned} {fieldIndex : Nat}
+    {source : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj fieldIndex source)).run state =
+        .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.proj fieldIndex source)) := by
+  cases world with
+  | unique =>
+    have huuEq : (Owned.unique == Owned.unique) = true := by decide
+    simp [lowerE, huuEq] at hrun
+  | shared =>
+    have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+    simp only [lowerE, hsuEq, Bool.false_eq_true, if_false] at hrun
+    obtain ⟨borrowResult, middleState, hborrowRun, hafterBorrow⟩ :=
+      trackedBindRun_ok_inv hrun
+    rcases borrowResult with
+      ⟨borrowOutput, borrowEmit, borrowed, release⟩
+    have hconsume := hborrow hborrowRun
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | var relative =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.var relative) fieldIndex),
+              AVal.slotA borrowOutput.depth) = (output, emit, av) ∧
+              middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        simpa [countUses] using hconsume.bump
+      | lit literal =>
+        have hpure :
+            (borrowOutput.bump,
+              borrowEmit ∘ emitOp (.fetch (.lit literal) fieldIndex),
+              AVal.slotA borrowOutput.depth) = (output, emit, av) ∧
+              middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        simpa [countUses] using hconsume.bump
+      | erased =>
+        have hpure :
+            (borrowOutput, borrowEmit, AVal.constA .erased) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        simpa [countUses] using hconsume
+    | slotA targetAbs =>
+      cases release with
+      | false =>
+        have hpure :
+            (borrowOutput.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs))
+                  fieldIndex) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        simpa [countUses] using hconsume.bump.bump
+      | true =>
+        have hpure :
+            (borrowOutput.bump.bump.bump,
+              borrowEmit ∘
+                emitOp (.fetch (.var (borrowOutput.rel targetAbs))
+                  fieldIndex) ∘
+                emitOp (.dup
+                  (.var (borrowOutput.bump.rel borrowOutput.depth))) ∘
+                emitOp (.drop
+                  (.var (borrowOutput.bump.bump.rel targetAbs))),
+              AVal.slotA borrowOutput.bump.depth) =
+                (output, emit, av) ∧ middleState = finalState := by
+          simpa using hafterBorrow
+        obtain ⟨hvalue, hstate⟩ := hpure
+        cases hvalue
+        subst finalState
+        simpa [countUses] using hconsume.bump.bump.bump
+
+theorem lowerE_lit_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {literal : IxIR0.Literal}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.lit literal)).run state =
+      .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.lit literal)) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA (.lit literal)) =
+          (output, emit, av) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  simpa [countUses] using EntryConsumption.zero input
+
+theorem lowerE_erased_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world .erased).run state =
+      .ok (output, emit, av) finalState) :
+    EntryConsumption input output (fun index => countUses index .erased) := by
+  have hpure :
+      (input, (_root_.id : Emit), AVal.constA .erased) =
+          (output, emit, av) ∧ state = finalState := by
+    simpa [lowerE] using hrun
+  obtain ⟨hvalue, hstate⟩ := hpure
+  cases hvalue
+  subst finalState
+  simpa [countUses] using EntryConsumption.zero input
+
+theorem lowerE_ref_entries_eq
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {address : Ixon.Address}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.ref address)).run state =
+      .ok (output, emit, av) finalState) :
+    output.entries = input.entries := by
+  have huuEq : (Owned.unique == Owned.unique) = true := by decide
+  have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+  cases hsource : src address with
+  | none =>
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerE, hsource] using hrun)).elim
+  | some decl =>
+    cases decl with
+    | defn result body =>
+      cases harity : lamArity body with
+      | zero =>
+        have hrun' := hrun
+        simp only [lowerE, hsource, harity] at hrun'
+        obtain ⟨unitValue, checkedState, _, hpureRun⟩ :=
+          trackedBindRun_ok_inv hrun'
+        cases unitValue
+        simp at hpureRun
+        rw [← hpureRun.1.1]
+        rfl
+      | succ arity =>
+        cases world with
+        | unique =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hsource, harity, huuEq] using hrun)).elim
+        | shared =>
+          cases result with
+          | unique =>
+            exact (trackedThrowRun_not_ok (by
+              simpa [lowerE, hsource, harity, hsuEq, huuEq]
+                using hrun)).elim
+          | shared =>
+            cases hp : papSafe body with
+            | false =>
+              exact (trackedThrowRun_not_ok (by
+                simpa [lowerE, hsource, harity, hsuEq, hp]
+                  using hrun)).elim
+            | true =>
+              have hpure := hrun
+              simp [lowerE, hsource, harity, hsuEq, hp] at hpure
+              rw [← hpure.1.1]
+              rfl
+    | ctor tag arity =>
+      cases arity with
+      | zero =>
+        have hpure := hrun
+        simp [lowerE, hsource] at hpure
+        rw [← hpure.1.1]
+        rfl
+      | succ arity =>
+        cases world with
+        | unique =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hsource, huuEq] using hrun)).elim
+        | shared =>
+          have hrun' := hrun
+          simp only [lowerE, hsource, hsuEq, Bool.false_eq_true,
+            if_false] at hrun'
+          obtain ⟨wrapper, wrapperState, _, hpureRun⟩ :=
+            trackedBindRun_ok_inv hrun'
+          simp at hpureRun
+          rw [← hpureRun.1.1]
+          rfl
+    | recursor numArgs natLit rules =>
+      cases world with
+      | unique =>
+        exact (trackedThrowRun_not_ok (by
+          simpa [lowerE, hsource, huuEq] using hrun)).elim
+      | shared =>
+        have hpure := hrun
+        simp [lowerE, hsource, hsuEq] at hpure
+        rw [← hpure.1.1]
+        rfl
+    | extern arity =>
+      cases arity with
+      | zero =>
+        have hpure := hrun
+        simp [lowerE, hsource] at hpure
+        rw [← hpure.1.1]
+        rfl
+      | succ arity =>
+        cases world with
+        | unique =>
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerE, hsource, huuEq] using hrun)).elim
+        | shared =>
+          have hpure := hrun
+          simp [lowerE, hsource, hsuEq] at hpure
+          rw [← hpure.1.1]
+          rfl
+
+theorem lowerE_ref_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {address : Ixon.Address}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.ref address)).run state =
+      .ok (output, emit, av) finalState) :
+    EntryConsumption input output
+      (fun index => countUses index (.ref address)) := by
+  have hzero := EntryConsumption.of_entries_eq (lowerE_ref_entries_eq hrun)
+  simpa [countUses] using hzero
+
+theorem lowerEConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEConsumesEntries src fuel)
+    (hborrow : LowerBorrowConsumesEntries src fuel)
+    (hspine : LowerSpineConsumesEntries src fuel)
+    (hlam : LowerLamConsumesEntries src fuel) :
+    LowerEConsumesEntries src (fuel + 1) := by
+  intro input world expr state finalState output emit av hrun
+  cases expr with
+  | var index => exact lowerE_var_consumesEntries hrun
+  | ref address => exact lowerE_ref_consumesEntries hrun
+  | app function argument =>
+    have hspineRun :
+        (lowerSpine src fuel input world function [argument]).run state =
+          .ok (output, emit, av) finalState := by
+      simpa [lowerE] using hrun
+    simpa [countUses, countUsesExprs] using hspine hspineRun
+  | lam uses body =>
+    cases world with
+    | unique =>
+      have huuEq : (Owned.unique == Owned.unique) = true := by decide
+      have hthrow :
+          (throw
+              "function values live in the shared world (one-shot closures deferred)" :
+            LowerM (VEnv × Emit × AVal)).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [lowerE, huuEq] using hrun
+      exact (trackedThrowRun_not_ok hthrow).elim
+    | shared =>
+      have hsuEq : (Owned.shared == Owned.unique) = false := by decide
+      have hlamRun :
+          (lowerLam src fuel input (.lam uses body)).run state =
+            .ok (output, emit, av) finalState := by
+        simpa [lowerE, hsuEq] using hrun
+      exact hlam hlamRun
+  | letE uses value body =>
+    exact lowerE_let_consumesEntries hexpr hrun
+  | proj index source =>
+    exact lowerE_proj_consumesEntries hborrow hrun
+  | lit literal => exact lowerE_lit_consumesEntries hrun
+  | erased => exact lowerE_erased_consumesEntries hrun
+
+theorem lowerConsumesEntries_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerConsumesEntries src fuel) :
+    LowerConsumesEntries src (fuel + 1) where
+  expr := lowerEConsumesEntries_succ
+    hprev.expr hprev.borrow hprev.spine hprev.lam
+  borrow := lowerBorrowConsumesEntries_succ hprev.expr
+  spine := lowerSpineConsumesEntries_succ
+    hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+  knownCall := knownCallConsumesEntries_succ hprev.args hprev.applyRest
+  args := lowerArgsConsumesEntries_succ hprev.expr hprev.args
+  applyRest := applyRestConsumesEntries_succ hprev.args
+  lam := lowerLamConsumesEntries_succ
+
+/-- Every successful lowering-cluster run consumes exactly the syntactic
+occurrence count of each tracked source entry. -/
+theorem lowerConsumesEntries (src : IxIR0.Env) :
+    ∀ fuel, LowerConsumesEntries src fuel
+  | 0 => lowerConsumesEntries_zero src
+  | fuel + 1 => lowerConsumesEntries_succ (lowerConsumesEntries src fuel)
+
+theorem lowerE_consumesEntries
+    {src : IxIR0.Env} {fuel : Nat} {input output : VEnv}
+    {world : Owned} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState) :
+    EntryConsumption input output (fun index => countUses index expr) :=
+  (lowerConsumesEntries src fuel).expr hrun
+
+/-- The counted first entry installed for a let body is always released by
+every successful lowering run. -/
+theorem lowerE_releasesTrackedFirst
+    (src : IxIR0.Env) (fuel : Nat) (expr : IxIR0.Expr) :
+    LowerEReleasesTrackedFirst src fuel expr :=
+  LowerEConsumesEntries.releasesTrackedFirst
+    (lowerConsumesEntries src fuel).expr expr
+
+/-! ## Reachable semantic fuel induction -/
+
+/-- A lowering action cannot produce a successful result. This small
+state-independent predicate packages the two administrative base cases of
+the semantic fuel induction. -/
+def LowerNoSuccess {α : Type} (action : LowerM α) : Prop :=
+  ∀ {initial final result},
+    action.run initial = .ok result final → False
+
+theorem LowerNoSuccess.throw {α : Type} (message : String) :
+    LowerNoSuccess (throw message : LowerM α) := by
+  intro initial final result hrun
+  exact trackedThrowRun_not_ok hrun
+
+theorem LowerNoSuccess.bindLeft {α β : Type}
+    {action : LowerM α} {next : α → LowerM β}
+    (haction : LowerNoSuccess action) :
+    LowerNoSuccess (action >>= next) := by
+  intro initial final result hrun
+  obtain ⟨value, middle, hfirst, _⟩ := trackedBindRun_ok_inv hrun
+  exact haction hfirst
+
+theorem LowerNoSuccess.bindRight {α β : Type}
+    {action : LowerM α} {next : α → LowerM β}
+    (hnext : ∀ value, LowerNoSuccess (next value)) :
+    LowerNoSuccess (action >>= next) := by
+  intro initial final result hrun
+  obtain ⟨value, middle, _, hsecond⟩ := trackedBindRun_ok_inv hrun
+  exact hnext value hsecond
+
+theorem lowerE_noSuccess_zero (src : IxIR0.Env) (input : VEnv)
+    (world : Owned) (expr : IxIR0.Expr) :
+    LowerNoSuccess (lowerE src 0 input world expr) := by
+  simp only [lowerE]
+  exact LowerNoSuccess.throw _
+
+theorem lowerBorrow_noSuccess_zero (src : IxIR0.Env) (input : VEnv)
+    (expr : IxIR0.Expr) :
+    LowerNoSuccess (lowerBorrow src 0 input expr) := by
+  simp only [lowerBorrow]
+  exact LowerNoSuccess.throw _
+
+theorem lowerSpine_noSuccess_zero (src : IxIR0.Env) (input : VEnv)
+    (world : Owned) (head : IxIR0.Expr) (args : List IxIR0.Expr) :
+    LowerNoSuccess (lowerSpine src 0 input world head args) := by
+  simp only [lowerSpine]
+  exact LowerNoSuccess.throw _
+
+theorem knownCall_noSuccess_zero (src : IxIR0.Env) (input : VEnv)
+    (build : Array Atom → Op) (count : Nat) (argWorlds : List Owned)
+    (resultWorld : Owned) (args : List IxIR0.Expr) :
+    LowerNoSuccess
+      (knownCall src 0 input build count argWorlds resultWorld args) := by
+  simp only [knownCall]
+  exact LowerNoSuccess.throw _
+
+theorem applyRest_noSuccess_zero (src : IxIR0.Env) (input : VEnv)
+    (resultWorld : Owned) (pre : Emit) (function : AVal)
+    (args : List IxIR0.Expr) :
+    LowerNoSuccess
+      (applyRest src 0 input resultWorld pre function args) := by
+  simp only [applyRest]
+  exact LowerNoSuccess.throw _
+
+/-- `lowerSpine` has one extra administrative layer over the other mutual
+actions. At fuel one every branch reaches a zero-fuel action before it can
+return, including the stateful constructor-wrapper branch. -/
+theorem lowerSpine_noSuccess_one (src : IxIR0.Env) (input : VEnv)
+    (world : Owned) (head : IxIR0.Expr) (args : List IxIR0.Expr) :
+    LowerNoSuccess (lowerSpine src 1 input world head args) := by
+  cases head with
+  | app function argument =>
+    simp only [lowerSpine]
+    exact LowerNoSuccess.throw _
+  | erased =>
+    simp only [lowerSpine]
+    exact applyRest_noSuccess_zero src input world id (.constA .erased) args
+  | var index =>
+    simp only [lowerSpine]
+    cases hentry : input.entries[index]? with
+    | none =>
+      simp only
+      exact LowerNoSuccess.bindLeft
+        (lowerE_noSuccess_zero src input .shared (.var index))
+    | some entry =>
+      cases entry with
+      | recSelf arity =>
+        simp only
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder]
+          exact LowerNoSuccess.throw _
+        · rw [if_neg hunder]
+          exact LowerNoSuccess.bindRight (fun _ =>
+            knownCall_noSuccess_zero src input (.callSelf ·) arity
+              (List.replicate arity .shared) world args)
+      | slot abs remaining uses held =>
+        simp only
+        exact LowerNoSuccess.bindLeft
+          (lowerE_noSuccess_zero src input .shared (.var index))
+  | ref address =>
+    simp only [lowerSpine]
+    cases hsrc : src address with
+    | none =>
+      simp only
+      exact LowerNoSuccess.throw _
+    | some decl =>
+      cases decl with
+      | defn result body =>
+        simp only
+        by_cases hunder : args.length < lamArity body
+        · rw [if_pos hunder]
+          by_cases hworld : world == .unique
+          · rw [if_pos hworld]
+            exact LowerNoSuccess.throw _
+          · rw [if_neg hworld]
+            by_cases hresult : result == .unique
+            · rw [if_pos hresult]
+              exact LowerNoSuccess.throw _
+            · rw [if_neg hresult]
+              by_cases hpap : !papSafe body
+              · rw [if_pos hpap]
+                exact LowerNoSuccess.throw _
+              · rw [if_neg hpap]
+                exact knownCall_noSuccess_zero src input (.papp address ·)
+                  args.length (List.replicate args.length .shared) world args
+        · rw [if_neg hunder]
+          exact LowerNoSuccess.bindRight (fun _ =>
+            knownCall_noSuccess_zero src input (.call address ·)
+              (lamArity body) ((lamUses body).map worldOfUses) world args)
+      | ctor tag arity =>
+        simp only
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder]
+          by_cases hworld : world == .unique
+          · rw [if_pos hworld]
+            exact LowerNoSuccess.throw _
+          · rw [if_neg hworld]
+            exact LowerNoSuccess.bindRight (fun wrapper =>
+              knownCall_noSuccess_zero src input (.papp wrapper ·)
+                args.length (List.replicate args.length .shared) world args)
+        · rw [if_neg hunder]
+          exact knownCall_noSuccess_zero src input
+            (.alloc world (ctorIdOf address tag) ·) arity
+            (List.replicate arity world) world args
+      | recursor numArgs natLit rules =>
+        simp only
+        by_cases hunder : args.length < numArgs + 1
+        · rw [if_pos hunder]
+          by_cases hworld : world == .unique
+          · rw [if_pos hworld]
+            exact LowerNoSuccess.throw _
+          · rw [if_neg hworld]
+            exact knownCall_noSuccess_zero src input (.papp address ·)
+              args.length (List.replicate args.length .shared) world args
+        · rw [if_neg hunder]
+          exact LowerNoSuccess.bindRight (fun _ =>
+            knownCall_noSuccess_zero src input (.call address ·)
+              (numArgs + 1) (List.replicate (numArgs + 1) .shared)
+              world args)
+      | extern arity =>
+        simp only
+        by_cases hunder : args.length < arity
+        · rw [if_pos hunder]
+          by_cases hworld : world == .unique
+          · rw [if_pos hworld]
+            exact LowerNoSuccess.throw _
+          · rw [if_neg hworld]
+            exact knownCall_noSuccess_zero src input (.papp address ·)
+              args.length (List.replicate args.length .shared) world args
+        · rw [if_neg hunder]
+          exact knownCall_noSuccess_zero src input (.extern address ·)
+            arity (List.replicate arity .shared) world args
+  | lam uses body =>
+    simp only [lowerSpine]
+    exact LowerNoSuccess.bindLeft
+      (lowerE_noSuccess_zero src input .shared (.lam uses body))
+  | letE uses value body =>
+    simp only [lowerSpine]
+    exact LowerNoSuccess.bindLeft
+      (lowerE_noSuccess_zero src input .shared (.letE uses value body))
+  | proj index source =>
+    simp only [lowerSpine]
+    exact LowerNoSuccess.bindLeft
+      (lowerE_noSuccess_zero src input .shared (.proj index source))
+  | lit literal =>
+    simp only [lowerSpine]
+    exact LowerNoSuccess.bindLeft
+      (lowerE_noSuccess_zero src input .shared (.lit literal))
+
+theorem lowerEPreservesBelow_zero
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} :
+    LowerEPreservesBelow ctx cur limit src 0 := by
+  intro input world expr state finalState output emit av hrun hrepresented _
+  exact (lowerE_noSuccess_zero src input world expr hrun).elim
+
+theorem lowerBorrowPreservesBelow_zero
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} :
+    LowerBorrowPreservesBelow ctx cur limit src 0 := by
+  intro input expr state finalState output emit av release hrun hrepresented _
+  exact (lowerBorrow_noSuccess_zero src input expr hrun).elim
+
+theorem lowerSpinePreservesBelow_zero
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} :
+    LowerSpinePreservesBelow ctx cur limit src 0 := by
+  intro input world head args state finalState output emit av hrun hrepresented _
+  exact (lowerSpine_noSuccess_zero src input world head args hrun).elim
+
+theorem lowerSpinePreservesBelow_one
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} :
+    LowerSpinePreservesBelow ctx cur limit src 1 := by
+  intro input world head args state finalState output emit av hrun hrepresented _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+theorem lowerArgs_noSuccess_zero (src : IxIR0.Env) (input : VEnv)
+    (args : List (IxIR0.Expr × Owned)) :
+    LowerNoSuccess (lowerArgs src 0 input args) := by
+  simp only [lowerArgs]
+  exact LowerNoSuccess.throw _
+
+theorem lowerArgsPreservesBelow_zero
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} :
+    LowerArgsPreservesBelow ctx cur limit src 0 := by
+  intro input args state finalState output emit avs hrun hrepresented _
+  exact (lowerArgs_noSuccess_zero src input args hrun).elim
+
+theorem applyRestPreservesBelow_zero
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env} :
+    ApplyRestPreservesBelow ctx cur limit src 0 := by
+  intro start input resultWorld pre function args state finalState output emit
+    av hfunction hrun hrepresented _
+  exact (applyRest_noSuccess_zero src input resultWorld pre function args
+    hrun).elim
+
+/-- Shared compiler-fuel recursion for reachable semantic and progress
+clusters.  The cluster fields and their one-step constructors are predicate
+parameters, so the zero case, the special spine-at-one case, and the
+two-predecessor successor case are assembled once without identifying any
+public interface or proof flavor. -/
+theorem lowerValueClusterWithin_core
+    {Expr Borrow Spine Args ApplyRest Cluster : Nat → Prop}
+    (hzero : Cluster 0)
+    (hclusterExpr : ∀ {fuel}, Cluster fuel → Expr fuel)
+    (hclusterBorrow : ∀ {fuel}, Cluster fuel → Borrow fuel)
+    (hclusterSpine : ∀ {fuel}, Cluster fuel → Spine fuel)
+    (hclusterArgs : ∀ {fuel}, Cluster fuel → Args fuel)
+    (hclusterApplyRest : ∀ {fuel}, Cluster fuel → ApplyRest fuel)
+    (hmake : ∀ {fuel}, Expr fuel → Borrow fuel → Spine fuel →
+      Args fuel → ApplyRest fuel → Cluster fuel)
+    (hargsSucc : ∀ {fuel}, Expr fuel → Args fuel → Args (fuel + 1))
+    (happlyRestSucc : ∀ {fuel}, Args fuel → ApplyRest (fuel + 1))
+    (hborrowSucc : ∀ {fuel}, Expr fuel → Borrow (fuel + 1))
+    (hspineOne : Spine 1)
+    (hspineSucc : ∀ {fuel},
+      Spine (fuel + 1) → Expr (fuel + 1) → Args fuel →
+      ApplyRest fuel → ApplyRest (fuel + 1) → Spine (fuel + 2))
+    (hexprSucc : ∀ {fuel},
+      Expr fuel → Spine fuel → Borrow fuel → Args (fuel + 1) →
+      ApplyRest (fuel + 1) → Expr (fuel + 1)) :
+    ∀ fuel, Cluster fuel := by
+  intro fuel
+  induction fuel using Nat.strongRecOn with
+  | ind fuel ih =>
+    cases fuel with
+    | zero => exact hzero
+    | succ previous =>
+      have hprev : Cluster previous :=
+        ih previous (Nat.lt_succ_self previous)
+      have hargs : Args (previous + 1) :=
+        hargsSucc (hclusterExpr hprev) (hclusterArgs hprev)
+      have hrest : ApplyRest (previous + 1) :=
+        happlyRestSucc (hclusterArgs hprev)
+      have hborrow : Borrow (previous + 1) :=
+        hborrowSucc (hclusterExpr hprev)
+      have hspine : Spine (previous + 1) := by
+        cases previous with
+        | zero => exact hspineOne
+        | succ prior =>
+          have hprior : Cluster prior := ih prior (by omega)
+          exact hspineSucc (hclusterSpine hprev) (hclusterExpr hprev)
+            (hclusterArgs hprior) (hclusterApplyRest hprior)
+            (hclusterApplyRest hprev)
+      exact hmake
+        (hexprSucc (hclusterExpr hprev) (hclusterSpine hprev)
+          (hclusterBorrow hprev) hargs hrest)
+        hborrow hspine hargs hrest
+
+/-- The mutually recursive semantic compiler invariant at one fuel. Its
+successful-run premises are reachable-state premises: the target context
+need represent only the declarations in that run's final lowering state. -/
+structure LowerClusterPreservesBelow (ctx : Ctx) (cur : FnDef)
+    (limit : Nat) (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEPreservesBelow ctx cur limit src fuel
+  borrow : LowerBorrowPreservesBelow ctx cur limit src fuel
+  spine : LowerSpinePreservesBelow ctx cur limit src fuel
+  args : LowerArgsPreservesBelow ctx cur limit src fuel
+  applyRest : ApplyRestPreservesBelow ctx cur limit src fuel
+
+/-- The bounded source-declaration environment supplies exactly the current
+self contract needed while lowering any recursor body. -/
+theorem SourceDeclContractsBelow.recursorCurrentSelf
+    {src : IxIR0.Env} {ctx : Ctx} {limit : Nat}
+    (hcontracts : SourceDeclContractsBelow src ctx limit)
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule}
+    (hsrc : src address = some (.recursor numArgs natLit rules)) :
+    ∃ d, ctx.decls address = some (.fn d) ∧
+      d.arity = numArgs + 1 ∧ CurrentSelfContractBelow ctx d limit := by
+  obtain ⟨d, hdecl, harity, hresult, hcontract⟩ :=
+    hcontracts.recursor hsrc
+  refine ⟨d, hdecl, harity, hresult, ?_⟩
+  simpa [harity] using hcontract
+
+/-- Complete fuel induction for the expression/borrow/spine/arguments/rest
+lowering cluster. `ExtraRepresented` is threaded only along successful runs;
+`ExtraExtends` transports both declarations and shape-indexed wrapper memos
+to earlier sequential sub-runs. The remaining premises are evaluator and
+source/self contracts, not compiler-recursion or wrapper-oracle hypotheses. -/
+theorem lowerClusterPreservesBelow
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit) :
+    ∀ fuel, LowerClusterPreservesBelow ctx cur limit src fuel :=
+  lowerValueClusterWithin_core
+    (Expr := LowerEPreservesBelow ctx cur limit src)
+    (Borrow := LowerBorrowPreservesBelow ctx cur limit src)
+    (Spine := LowerSpinePreservesBelow ctx cur limit src)
+    (Args := LowerArgsPreservesBelow ctx cur limit src)
+    (ApplyRest := ApplyRestPreservesBelow ctx cur limit src)
+    (Cluster := LowerClusterPreservesBelow ctx cur limit src)
+    (hzero := {
+      expr := lowerEPreservesBelow_zero
+      borrow := lowerBorrowPreservesBelow_zero
+      spine := lowerSpinePreservesBelow_zero
+      args := lowerArgsPreservesBelow_zero
+      applyRest := applyRestPreservesBelow_zero })
+    (hclusterExpr := fun hcluster => hcluster.expr)
+    (hclusterBorrow := fun hcluster => hcluster.borrow)
+    (hclusterSpine := fun hcluster => hcluster.spine)
+    (hclusterArgs := fun hcluster => hcluster.args)
+    (hclusterApplyRest := fun hcluster => hcluster.applyRest)
+    (hmake := fun hexpr hborrow hspine hargs hrest => {
+      expr := hexpr
+      borrow := hborrow
+      spine := hspine
+      args := hargs
+      applyRest := hrest })
+    (hargsSucc := by
+      intro fuel hexpr hargs
+      exact lowerArgsPreservesBelow_succ hexpr hargs
+        (lowerExtraMonotone src fuel).args)
+    (happlyRestSucc := fun hargs =>
+      applyRestPreservesBelow_succ hargs happly)
+    (hborrowSucc := fun hexpr =>
+      lowerBorrowPreservesBelow_succ hexpr)
+    (hspineOne := lowerSpinePreservesBelow_one)
+    (hspineSucc := by
+      intro fuel hprevSpine hprevExpr hpriorArgs hpriorRest hprevRest
+      intro input world head args state finalState output emit av hrun
+        hrepresented havailable
+      exact lowerSpine_run_sound_below hprevSpine hprevExpr hpriorArgs
+        (lowerExtraMonotone src fuel).args hpriorRest hprevRest
+        (lowerExtraMonotone src fuel).applyRest
+        (lowerExtraMonotone src (fuel + 1)).applyRest hdecls hrun
+        hrepresented havailable)
+    (hexprSucc := by
+      intro fuel hprevExpr hprevSpine hprevBorrow hargs hrest
+      intro input world expr state finalState output emit av hrun
+        hrepresented havailable
+      exact lowerE_run_sound_below hprevExpr hprevSpine hargs
+        (lowerExtraMonotone src (fuel + 1)).args hrest
+        (lowerExtraMonotone src (fuel + 1)).applyRest hprevBorrow
+        hdecls (fun body => lowerE_releasesTrackedFirst src fuel body)
+        hrepresented hrun havailable)
+
+/-! ### Closed reachable-state value induction -/
+
+/-- At compiler fuel one, `lowerSpine` still cannot complete: every branch
+reaches a zero-fuel recursive action first. This is the semantic companion
+to `lowerSpinePreservesBelow_one`. -/
+theorem lowerSpineValuePreservesWithin_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValuePreservesWithin funRel recSelfRel sourceCtx ctx cur src
+      ambient 1 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+/-- The complete reachable-state semantic invariant for the mutually
+recursive lowering cluster at one compiler-fuel index. All function
+provenance is indexed by the ambient state of the enclosing whole-pass run;
+individual successful subruns supply only an `ExtraExtends` suffix proof. -/
+structure LowerValueClusterWithin
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (fuel : Nat) : Prop where
+  expr : LowerEValuePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  borrow : LowerBorrowValuePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  spine : LowerSpineValuePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  args : LowerArgsValuePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+  applyRest : ApplyRestNonErasedValuePreservesWithin
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur src ambient fuel
+
+/-- Complete compiler-fuel induction for value correspondence. The static
+declaration and higher-order application hypotheses are semantic contracts
+of the final target context; compiler recursion, erased reflection, let
+cleanup, and generated-declaration reachability are all discharged here. -/
+theorem lowerValueClusterWithin
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx) :
+    ∀ fuel,
+      LowerValueClusterWithin sourceCtx src ambient recSelfRel ctx cur fuel :=
+  lowerValueClusterWithin_core
+    (Expr := LowerEValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Borrow := LowerBorrowValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Spine := LowerSpineValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Args := LowerArgsValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (ApplyRest := ApplyRestNonErasedValuePreservesWithin
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur src ambient)
+    (Cluster := LowerValueClusterWithin sourceCtx src ambient recSelfRel ctx
+      cur)
+    (hzero := {
+      expr := lowerEValuePreservesWithin_zero src ambient
+      borrow := lowerBorrowValuePreservesWithin_zero src ambient
+      spine := lowerSpineValuePreservesWithin_zero src ambient
+      args := lowerArgsValuePreservesWithin_zero src ambient
+      applyRest := applyRestNonErasedValuePreservesWithin_zero src ambient })
+    (hclusterExpr := fun hcluster => hcluster.expr)
+    (hclusterBorrow := fun hcluster => hcluster.borrow)
+    (hclusterSpine := fun hcluster => hcluster.spine)
+    (hclusterArgs := fun hcluster => hcluster.args)
+    (hclusterApplyRest := fun hcluster => hcluster.applyRest)
+    (hmake := fun hexpr hborrow hspine hargs hrest => {
+      expr := hexpr
+      borrow := hborrow
+      spine := hspine
+      args := hargs
+      applyRest := hrest })
+    (hargsSucc := fun hexpr hargs =>
+      lowerArgsValuePreservesWithin_succ hexpr hargs)
+    (happlyRestSucc := fun hargs =>
+      applyRestNonErasedValuePreservesWithin_succ hargs
+        hcontracts.apply hvalues.apply)
+    (hborrowSucc := fun hexpr =>
+      lowerBorrowValuePreservesWithin_succ hexpr)
+    (hspineOne := lowerSpineValuePreservesWithin_one)
+    (hspineSucc := by
+      intro fuel hprevSpine hprevExpr hpriorArgs hpriorRest hprevRest
+      intro input output world head args sourceEnv sourceResult state
+        finalState emit av hsource hrun hextends havailable
+      exact lowerSpine_run_value_sound_within (fuel := fuel) henv
+        hprevSpine hprevExpr
+        (lowerE_reflectsErased sourceCtx src (fuel + 1)) hpriorArgs
+        hpriorRest hprevRest
+        (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts hvalues
+        hsource hrun hextends hrepresented havailable)
+    (hexprSucc := by
+      intro fuel hprevExpr hprevSpine hprevBorrow hargs hrest
+      intro input output world expr sourceEnv sourceFuel sourceValue state
+        finalState emit av hsource hrun hextends havailable
+      exact lowerE_run_value_sound_within (fuel := fuel) henv hprevExpr
+        hprevSpine hprevBorrow hargs hrest
+        (lowerExtraMonotone src (fuel + 2)).knownCall hcontracts hvalues
+        (fun body => lowerE_releasesTrackedFirst src fuel body)
+        hsource hrun hextends hrepresented havailable)
+
+/-- At compiler fuel one, the bounded semantic spine interface is likewise
+vacuous because every executable branch reaches a zero-fuel subaction. -/
+theorem lowerSpineValuePreservesWithinBelow_one
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {cur : FnDef}
+    {limit : Nat} {src : IxIR0.Env} {ambient : LowSt} :
+    LowerSpineValuePreservesWithinBelow funRel recSelfRel sourceCtx ctx cur
+      limit src ambient 1 := by
+  intro input output world head args sourceEnv sourceResult state finalState
+    emit av _ hrun _ _
+  exact (lowerSpine_noSuccess_one src input world head args hrun).elim
+
+/-- Fuel-bounded reachable-state semantic invariant for the complete
+mutually recursive lowering cluster. -/
+structure LowerValueClusterWithinBelow
+    (sourceCtx : IxIR0.Ctx) (src : IxIR0.Env) (ambient : LowSt)
+    (recSelfRel : RecSelfRel) (ctx : Ctx) (cur : FnDef)
+    (limit fuel : Nat) : Prop where
+  expr : LowerEValuePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  borrow : LowerBorrowValuePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  spine : LowerSpineValuePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  args : LowerArgsValuePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+  applyRest : ApplyRestNonErasedValuePreservesWithinBelow
+    (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+    cur limit src ambient fuel
+
+/-- Complete compiler-fuel induction under semantic contracts bounded at a
+single target evaluator limit. This is the contractive cluster used while
+the declaration and higher-order apply contracts themselves are sealed. -/
+theorem lowerValueClusterWithinBelow
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit) :
+    ∀ fuel, LowerValueClusterWithinBelow sourceCtx src ambient recSelfRel
+      ctx cur limit fuel :=
+  lowerValueClusterWithin_core
+    (Expr := LowerEValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Borrow := LowerBorrowValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Spine := LowerSpineValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Args := LowerArgsValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (ApplyRest := ApplyRestNonErasedValuePreservesWithinBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit src ambient)
+    (Cluster := LowerValueClusterWithinBelow sourceCtx src ambient
+      recSelfRel ctx cur limit)
+    (hzero := {
+      expr := lowerEValuePreservesWithinBelow_zero src ambient
+      borrow := lowerBorrowValuePreservesWithinBelow_zero src ambient
+      spine := lowerSpineValuePreservesWithinBelow_zero src ambient
+      args := lowerArgsValuePreservesWithinBelow_zero src ambient
+      applyRest :=
+        applyRestNonErasedValuePreservesWithinBelow_zero src ambient })
+    (hclusterExpr := fun hcluster => hcluster.expr)
+    (hclusterBorrow := fun hcluster => hcluster.borrow)
+    (hclusterSpine := fun hcluster => hcluster.spine)
+    (hclusterArgs := fun hcluster => hcluster.args)
+    (hclusterApplyRest := fun hcluster => hcluster.applyRest)
+    (hmake := fun hexpr hborrow hspine hargs hrest => {
+      expr := hexpr
+      borrow := hborrow
+      spine := hspine
+      args := hargs
+      applyRest := hrest })
+    (hargsSucc := fun hexpr hargs =>
+      lowerArgsValuePreservesWithinBelow_succ hexpr hargs)
+    (happlyRestSucc := fun hargs =>
+      applyRestNonErasedValuePreservesWithinBelow_succ hargs
+        (hcontracts.apply.below limit) hvalues.apply)
+    (hborrowSucc := fun hexpr =>
+      lowerBorrowValuePreservesWithinBelow_succ hexpr)
+    (hspineOne := lowerSpineValuePreservesWithinBelow_one)
+    (hspineSucc := by
+      intro fuel hprevSpine hprevExpr hpriorArgs hpriorRest hprevRest
+      intro input output world head args sourceEnv sourceResult state
+        finalState emit av hsource hrun hextends havailable
+      exact lowerSpine_run_value_sound_within_below (fuel := fuel) henv
+        hprevSpine hprevExpr
+        (lowerE_reflectsErased sourceCtx src (fuel + 1)) hpriorArgs
+        hpriorRest hprevRest
+        (lowerExtraMonotone src (fuel + 1)).knownCall hcontracts hvalues
+        hsource hrun hextends hrepresented havailable)
+    (hexprSucc := by
+      intro fuel hprevExpr hprevSpine hprevBorrow hargs hrest
+      intro input output world expr sourceEnv sourceFuel sourceValue state
+        finalState emit av hsource hrun hextends havailable
+      exact lowerE_run_value_sound_within_below (fuel := fuel) henv
+        hprevExpr hprevSpine hprevBorrow hargs hrest
+        (lowerExtraMonotone src (fuel + 2)).knownCall hcontracts hvalues
+        (fun body => lowerE_releasesTrackedFirst src fuel body)
+        hsource hrun hextends hrepresented havailable)
+
+/-- Bounded ordinary-expression interface with no recursive-self entry. -/
+theorem lowerE_run_value_sound_within_noRecSelf_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hno : NoRecSelf input) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceValue
+      world emit av :=
+  (lowerValueClusterWithinBelow (recSelfRel := recSelfRel) (cur := cur)
+    henv hrepresented hcontracts hvalues fuel).expr hsource hrun hextends
+      (SelfValueAvailableBelow.of_noRecSelf hno)
+
+/-- Bounded recursor-rule expression interface with current-self semantics. -/
+theorem lowerE_run_value_sound_within_currentSelf_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hself : CurrentSelfValueContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit) :
+    LowerResultValueSoundBelow (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur limit input output sourceEnv sourceEnv sourceValue
+      world emit av :=
+  (lowerValueClusterWithinBelow (recSelfRel := recSelfRel) (cur := cur)
+    henv hrepresented hcontracts hvalues fuel).expr hsource hrun hextends
+      (SelfValueAvailableBelow.of_contract hself)
+
+/-- Ordinary expressions expose the closed semantic compiler induction
+without requiring a current recursive-self contract. -/
+theorem lowerE_run_value_sound_within_noRecSelf
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hno : NoRecSelf input) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceValue world
+      emit av :=
+  (lowerValueClusterWithin (recSelfRel := recSelfRel) (cur := cur) henv
+    hrepresented hcontracts hvalues fuel).expr hsource hrun hextends
+      (SelfValueAvailable.of_noRecSelf hno)
+
+/-- Recursor-rule expressions use the same closed semantic induction with
+the generated current-function value contract. -/
+theorem lowerE_run_value_sound_within_currentSelf
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {sourceEnv : List IxIR0.Value}
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    {state finalState : LowSt} {emit : Emit} {av : AVal}
+    (hsource : IxIR0.eval sourceCtx sourceFuel sourceEnv expr =
+      .ok sourceValue)
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hextends : ExtraExtends finalState ambient)
+    (hself : CurrentSelfValueContract
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur) :
+    LowerResultValueSound (CompilerFunctionRel sourceCtx src ambient)
+      recSelfRel ctx cur input output sourceEnv sourceEnv sourceValue world
+      emit av :=
+  (lowerValueClusterWithin (recSelfRel := recSelfRel) (cur := cur) henv
+    hrepresented hcontracts hvalues fuel).expr hsource hrun hextends
+      (SelfValueAvailable.of_contract hself)
+
+/-! ### Source saturation lemmas for declaration contracts -/
+
+/-- Evaluating an expression and then supplying exactly its leading lambda
+telescope is the same source computation as evaluating `stripLams` in the
+reversed argument environment. Fuel witnesses remain existential because
+source fuel is a totality witness, not a cost. -/
+theorem sourceEval_stripLams_of_applies (sourceCtx : IxIR0.Ctx) :
+    ∀ {sourceEnv : List IxIR0.Value} {expr : IxIR0.Expr}
+      {function result : IxIR0.Value} {args : List IxIR0.Value}
+      {evalFuel : Nat},
+      IxIR0.eval sourceCtx evalFuel sourceEnv expr = .ok function →
+      args.length = lamArity expr →
+      SourceApplies sourceCtx function args result →
+      ∃ bodyFuel,
+        IxIR0.eval sourceCtx bodyFuel (args.reverse ++ sourceEnv)
+          (stripLams expr) = .ok result := by
+  intro sourceEnv expr
+  induction expr generalizing sourceEnv with
+  | var index =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+  | ref address =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+  | app fn arg =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+  | lam uses body ih =>
+    intro function result args evalFuel heval hlength happlies
+    cases evalFuel with
+    | zero => simp [IxIR0.eval] at heval
+    | succ evalFuel =>
+      have hfunction : function = .clos uses sourceEnv body := by
+        simpa [IxIR0.eval] using heval.symm
+      subst function
+      cases args with
+      | nil => simp [lamArity] at hlength
+      | cons argument arguments =>
+        have htailLength : arguments.length = lamArity body := by
+          simpa [lamArity] using hlength
+        cases happlies with
+        | @cons _ _ middle _ _ applyFuel hstep htail =>
+          cases applyFuel with
+          | zero => simp [IxIR0.apply] at hstep
+          | succ applyFuel =>
+            have hbodyEval : IxIR0.eval sourceCtx applyFuel
+                (argument :: sourceEnv) body = .ok middle := by
+              simpa [IxIR0.apply] using hstep
+            obtain ⟨bodyFuel, hresult⟩ :=
+              ih hbodyEval htailLength htail
+            refine ⟨bodyFuel, ?_⟩
+            simpa [stripLams, List.reverse_cons, List.append_assoc] using
+              hresult
+  | letE uses value body =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+  | proj index value =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+  | lit literal =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+  | erased =>
+    intro function result args evalFuel heval hlength happlies
+    have hnil : args = [] :=
+      List.eq_nil_of_length_eq_zero (by simpa [lamArity] using hlength)
+    subst args
+    cases happlies
+    exact ⟨evalFuel, by simpa [stripLams] using heval⟩
+
+/-- Complete a residual lifted-closure prefix with the remaining arguments.
+The resulting source environment is exactly the selected prefix's full
+application order reversed, followed by the original closure environment. -/
+theorem LambdaPrefix.saturate
+    {sourceCtx : IxIR0.Ctx} {sourceEnv : List IxIR0.Value}
+    {expr : IxIR0.Expr} {supplied remaining : List IxIR0.Value}
+    {function result : IxIR0.Value}
+    (hprefix : LambdaPrefix sourceEnv expr supplied function)
+    (hlength : (supplied ++ remaining).length = lamArity expr)
+    (happlies : SourceApplies sourceCtx function remaining result) :
+    ∃ fuel,
+      IxIR0.eval sourceCtx fuel
+        ((supplied ++ remaining).reverse ++ sourceEnv)
+        (stripLams expr) = .ok result := by
+  exact (LambdaPrefix.traverse
+    (Result := fun currentEnv currentExpr currentSupplied currentFunction =>
+      (currentSupplied ++ remaining).length = lamArity currentExpr →
+      SourceApplies sourceCtx currentFunction remaining result →
+      ∃ fuel,
+        IxIR0.eval sourceCtx fuel
+          ((currentSupplied ++ remaining).reverse ++ currentEnv)
+          (stripLams currentExpr) = .ok result)
+    (hnil := by
+      intro currentEnv uses body hlength happlies
+      have heval : IxIR0.eval sourceCtx 1 currentEnv (.lam uses body) =
+          .ok (.clos uses currentEnv body) := by
+        simp [IxIR0.eval]
+      simpa using sourceEval_stripLams_of_applies sourceCtx heval
+        (by simpa using hlength) happlies)
+    (hcons := by
+      intro currentEnv uses body argument currentSupplied currentFunction
+        hinner ih hlength happlies
+      have hinnerLength : (currentSupplied ++ remaining).length =
+          lamArity body := by
+        simpa [lamArity] using hlength
+      obtain ⟨fuel, hresult⟩ := ih hinnerLength happlies
+      refine ⟨fuel, ?_⟩
+      simpa [stripLams, List.reverse_cons, List.append_assoc] using hresult)
+    (h := hprefix)) hlength happlies
+
+/-- A source definition reference exposes the exact closed evaluation of its
+body, independent of the existential reference fuel. -/
+theorem SourceRefValue.defnBody
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {world : Owned} {body : IxIR0.Expr} {function : IxIR0.Value}
+    (hlookup : sourceCtx.env address = some (.defn world body))
+    (href : SourceRefValue sourceCtx address function) :
+    ∃ fuel, IxIR0.eval sourceCtx fuel [] body = .ok function := by
+  obtain ⟨fuel, href⟩ := href
+  cases fuel with
+  | zero => simp [IxIR0.eval] at href
+  | succ fuel =>
+    exact ⟨fuel, by simpa [IxIR0.eval, hlookup] using href⟩
+
+/-- Saturating a source definition reference reaches its stripped body under
+the reversed source argument vector. -/
+theorem SourceRefValue.defnSaturate
+    {sourceCtx : IxIR0.Ctx} {address : Ixon.Address}
+    {world : Owned} {body : IxIR0.Expr}
+    {function result : IxIR0.Value} {args : List IxIR0.Value}
+    (hlookup : sourceCtx.env address = some (.defn world body))
+    (href : SourceRefValue sourceCtx address function)
+    (hlength : args.length = lamArity body)
+    (happlies : SourceApplies sourceCtx function args result) :
+    ∃ fuel, IxIR0.eval sourceCtx fuel args.reverse
+      (stripLams body) = .ok result := by
+  obtain ⟨evalFuel, heval⟩ := href.defnBody hlookup
+  simpa using sourceEval_stripLams_of_applies sourceCtx heval hlength
+    happlies
+
+/-! ### Semantic function closure -/
+
+/-- Closing a semantic lowering result with its generated `ret` exposes the
+source result graph and preserves an arbitrary semantic caller frame. This
+is the value-level counterpart of `LowerResultSound.close`; ownership of the
+returned root remains available through the parent judgment when needed. -/
+theorem LowerResultValueSound.closeGraph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueSound funRel recSelfRel ctx cur input output
+      sourceInput sourceOutput sourceValue world emit av)
+    (hreleased : EntriesReleased output.entries)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root) :
+    CodeOwns ctx cur
+      (GraphOwnsVEnv funRel recSelfRel input sourceInput sourceRest rest)
+      (fun store value =>
+        Sim.ValueGraph funRel store sourceValue value ∧
+          Sim.RootsGraph funRel store sourceRest rest)
+      (emit (.ret (av.toAtom output))) := by
+  have hret : CodeOwns ctx cur
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest [])
+      (fun store value =>
+        Sim.ValueGraph funRel store sourceValue value ∧
+          Sim.RootsGraph funRel store sourceRest rest)
+      (.ret (av.toAtom output)) := by
+    intro fuel store env store' value hprotected hrun
+    obtain ⟨⟨roots, result, houtput, hav, hvalue, hframe, _⟩, _⟩ :=
+      hprotected
+    have hroots : roots = [] :=
+      EntriesRealize.eq_nil_of_released hreleased
+        houtput.entries.entriesRealize
+    subst roots
+    cases fuel with
+    | zero => simp [runCode] at hrun
+    | succ fuel =>
+      rw [Nat.add_one] at hrun
+      rw [runCode.eq_def] at hrun
+      dsimp only at hrun
+      rw [hav.resolveAtom] at hrun
+      have hpair : (store, result) = (store', value) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨hvalue, hframe⟩
+  intro fuel store env store' value hpre hrun
+  exact hsound.graphEmits sourceRest rest []
+    (fun store value =>
+      Sim.ValueGraph funRel store sourceValue value ∧
+        Sim.RootsGraph funRel store sourceRest rest)
+    (.ret (av.toAtom output)) hret
+    ⟨hpre, SlotsRealize.nil⟩ hrun
+
+/-- Bounded counterpart of `closeGraph`; this is the function-exit rule used
+while mutually recursive declaration contracts are available only below the
+current evaluator index. -/
+theorem LowerResultValueSoundBelow.closeGraph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {input output : VEnv}
+    {sourceInput sourceOutput : List IxIR0.Value}
+    {sourceValue : IxIR0.Value} {world : Owned}
+    {emit : Emit} {av : AVal}
+    (hsound : LowerResultValueSoundBelow funRel recSelfRel ctx cur limit
+      input output sourceInput sourceOutput sourceValue world emit av)
+    (hreleased : EntriesReleased output.entries)
+    (sourceRest : List (Owned × IxIR0.Value)) (rest : List Root) :
+    CodeOwnsBelow ctx cur limit
+      (GraphOwnsVEnv funRel recSelfRel input sourceInput sourceRest rest)
+      (fun store value =>
+        Sim.ValueGraph funRel store sourceValue value ∧
+          Sim.RootsGraph funRel store sourceRest rest)
+      (emit (.ret (av.toAtom output))) := by
+  have hret : CodeOwnsBelow ctx cur limit
+      (GraphOwnsResultProtected funRel recSelfRel output sourceOutput
+        sourceValue world av sourceRest rest [])
+      (fun store value =>
+        Sim.ValueGraph funRel store sourceValue value ∧
+          Sim.RootsGraph funRel store sourceRest rest)
+      (.ret (av.toAtom output)) := by
+    intro fuel store env store' value _ hprotected hrun
+    obtain ⟨⟨roots, result, houtput, hav, hvalue, hframe, _⟩, _⟩ :=
+      hprotected
+    have hroots : roots = [] :=
+      EntriesRealize.eq_nil_of_released hreleased
+        houtput.entries.entriesRealize
+    subst roots
+    cases fuel with
+    | zero => simp [runCode] at hrun
+    | succ fuel =>
+      rw [Nat.add_one] at hrun
+      rw [runCode.eq_def] at hrun
+      dsimp only at hrun
+      rw [hav.resolveAtom] at hrun
+      have hpair : (store, result) = (store', value) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨hvalue, hframe⟩
+  intro fuel store env store' value hfuel hpre hrun
+  exact hsound.graphEmits sourceRest rest [] limit (Nat.le_refl _)
+    (fun store value =>
+      Sim.ValueGraph funRel store sourceValue value ∧
+        Sim.RootsGraph funRel store sourceRest rest)
+    (.ret (av.toAtom output)) hret hfuel
+    ⟨hpre, SlotsRealize.nil⟩ hrun
+
+/-- Contractive function-entry/exit adapter. A bounded expression theorem
+for the lowered body is enough to prove the function at the bound itself;
+all declaration/apply dependencies used by that expression theorem may
+therefore remain strictly below the bound. -/
+theorem lowerFnBody_parameterEntries_valuePreservesAt_below
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {sourceCtx : IxIR0.Ctx} {ctx : Ctx} {src : IxIR0.Env}
+    {compilerFuel limit : Nat}
+    (modes : List Uses) (world : Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hbodyPreserves : LowerEValuePreservesBelow funRel recSelfRel
+      sourceCtx ctx ⟨modes.length, world, papSafeFlag, code⟩
+        limit src compilerFuel)
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    {sourceFunction : IxIR0.Value}
+    (hsaturates : ∀ {sourceArgs : List IxIR0.Value}
+        {sourceResult : IxIR0.Value},
+      sourceArgs.length = modes.length →
+      SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+      ∃ sourceFuel,
+        IxIR0.eval sourceCtx sourceFuel sourceArgs.reverse body =
+          .ok sourceResult) :
+    FnValuePreservesAt funRel sourceCtx ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ (modes.map worldOfUses)
+      sourceFunction limit := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  obtain ⟨plannedMiddle, plannedEmit, hplan, htracks⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have hmiddleLength : plannedMiddle.entries.length = modes.length := by
+    calc
+      plannedMiddle.entries.length = input.entries.length :=
+        hplan'.entries_length
+      _ = modes.length := by simp [input, remaining]
+  have hreleased : EntriesReleased output.entries :=
+    hconsume.entriesReleased htracks (Eq.trans hcount hmiddleLength)
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  have hargsLength : args.length = modes.length := by
+    simpa using hlength
+  have hsourceArgsLength : sourceArgs.length = args.length := by
+    simpa using hargs.length
+  obtain ⟨sourceFuel, hsource⟩ := hsaturates
+    (hsourceArgsLength.trans hargsLength) happlies
+  have hbodySound : LowerResultValueSoundBelow funRel recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit plannedMiddle output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world emit av :=
+    hbodyPreserves hsource hbodyRun
+  have hfull : LowerResultValueSoundBelow funRel recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit input output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world
+      (plannedEmit ∘ emit) av :=
+    hbodySound.afterRelease (hplan'.valueSoundBelow sourceArgs.reverse)
+  have hpre : GraphOwnsVEnv funRel recSelfRel input sourceArgs.reverse
+      sourceRest rest store args.reverse := by
+    refine ⟨(rootsForWorlds (modes.map worldOfUses) args).reverse,
+      ?_, hframe, ?_⟩
+    · simpa [input] using VEnvValueGraph.parameterEntries
+        (recSelfRel := recSelfRel) modes remaining hargsLength hargs hown
+    · exact hown.perm
+        ((List.reverse_perm
+          (rootsForWorlds (modes.map worldOfUses) args)).symm.append_right
+            rest)
+  have hcodeRun' : runCode ctx limit
+      ⟨modes.length, world, papSafeFlag, code⟩ store args.reverse
+      ((plannedEmit ∘ emit) (.ret (av.toAtom output))) =
+        .ok (store', value) := by
+    rw [hcode]
+    exact hcodeRun
+  exact hfull.closeGraph hreleased sourceRest rest (Nat.le_refl _)
+    hpre hcodeRun'
+
+/-- Contractive ordinary-declaration producer. Once the bounded expression
+induction is available for the actual emitted function, this proves that
+function at the current evaluator bound without assuming its own unbounded
+semantic contract. -/
+theorem lowerDecl_defn_valuePreservesAt_below
+    {funRel : Sim.FunctionRel} {sourceCtx : IxIR0.Ctx}
+    {src : IxIR0.Env} {ctx : Ctx} {compilerFuel limit : Nat}
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hlookup : sourceCtx.env address = some (.defn result body))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hbodyPreserves : LowerEValuePreservesBelow funRel
+      (fun _ _ => False) sourceCtx ctx d limit src compilerFuel)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState) :
+    FnValuePreservesAt funRel sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧
+        bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hbodyPreserves' : LowerEValuePreservesBelow funRel
+      (fun _ _ => False) sourceCtx ctx
+      ⟨(lamUses body).length, result,
+        result == .shared && papSafe body, code⟩ limit src compilerFuel := by
+    intro input output world expr sourceEnv sourceFuel sourceValue
+      state finalState emit av hsource hrun
+    simpa using hbodyPreserves hsource hrun
+  have hpreserves : FnValuePreservesAt funRel sourceCtx ctx
+      ⟨(lamUses body).length, result,
+        result == .shared && papSafe body, code⟩
+      ((lamUses body).map worldOfUses) sourceFunction limit :=
+    lowerFnBody_parameterEntries_valuePreservesAt_below
+      (recSelfRel := fun _ _ => False)
+      (compilerFuel := compilerFuel) (limit := limit)
+      (lamUses body) result (stripLams body) hbodyPreserves'
+      hadmissible (by simpa using hbodyRun)
+      (by
+        intro sourceArgs sourceResult hlength happlies
+        exact href.defnSaturate hlookup (by simpa using hlength) happlies)
+  have hfn : (⟨(lamUses body).length, result,
+      result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn]
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  exact hpreserves hlength hargs happlies hframe hown hcodeRun
+
+/-- Reachable-state specialization of the contractive function-entry
+adapter.  Unlike `lowerFnBody_parameterEntries_valuePreservesAt_below`, this
+version follows the one actual body run into the ambient final lowering
+state.  That is the shape supplied by `lowerAllAction`: generated function
+provenance is only known in the final accumulated state, and
+`ExtraExtends` transports it back to this particular body run. -/
+theorem lowerFnBody_parameterEntries_valuePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx}
+    {compilerFuel limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (modes : List Uses) (world : Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceFunction : IxIR0.Value}
+    (hsaturates : ∀ {sourceArgs : List IxIR0.Value}
+        {sourceResult : IxIR0.Value},
+      sourceArgs.length = modes.length →
+      SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+      ∃ sourceFuel,
+        IxIR0.eval sourceCtx sourceFuel sourceArgs.reverse body =
+          .ok sourceResult) :
+    FnValuePreservesAt (CompilerFunctionRel sourceCtx src ambient)
+      sourceCtx ctx ⟨modes.length, world, papSafeFlag, code⟩
+      (modes.map worldOfUses) sourceFunction limit := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun (by
+      simpa [input, remaining] using
+        parameterEntries_noRecSelf 0 modes remaining modes.length)
+  obtain ⟨plannedMiddle, plannedEmit, hplan, htracks⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have hmiddleLength : plannedMiddle.entries.length = modes.length := by
+    calc
+      plannedMiddle.entries.length = input.entries.length :=
+        hplan'.entries_length
+      _ = modes.length := by simp [input, remaining]
+  have hreleased : EntriesReleased output.entries :=
+    hconsume.entriesReleased htracks (Eq.trans hcount hmiddleLength)
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  have hargsLength : args.length = modes.length := by
+    simpa using hlength
+  have hsourceArgsLength : sourceArgs.length = args.length := by
+    simpa using hargs.length
+  obtain ⟨sourceFuel, hsource⟩ := hsaturates
+    (hsourceArgsLength.trans hargsLength) happlies
+  have hbodySound : LowerResultValueSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit plannedMiddle output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world emit av :=
+    lowerE_run_value_sound_within_noRecSelf_below
+      (recSelfRel := recSelfRel)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hsource hbodyRun hextends
+      hmiddleNo
+  have hfull : LowerResultValueSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ limit input output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world
+      (plannedEmit ∘ emit) av :=
+    hbodySound.afterRelease (hplan'.valueSoundBelow sourceArgs.reverse)
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+      sourceArgs.reverse sourceRest rest store args.reverse := by
+    refine ⟨(rootsForWorlds (modes.map worldOfUses) args).reverse,
+      ?_, hframe, ?_⟩
+    · simpa [input] using VEnvValueGraph.parameterEntries
+        (recSelfRel := recSelfRel) modes remaining hargsLength hargs hown
+    · exact hown.perm
+        ((List.reverse_perm
+          (rootsForWorlds (modes.map worldOfUses) args)).symm.append_right
+            rest)
+  have hcodeRun' : runCode ctx limit
+      ⟨modes.length, world, papSafeFlag, code⟩ store args.reverse
+      ((plannedEmit ∘ emit) (.ret (av.toAtom output))) =
+        .ok (store', value) := by
+    rw [hcode]
+    exact hcodeRun
+  exact hfull.closeGraph hreleased sourceRest rest (Nat.le_refl _)
+    hpre hcodeRun'
+
+/-- A successful ordinary declaration run proves its own dead-parameter
+admissibility: `lowerFnBody` executes the generated release list before any
+body lowering, and the forbidden modes are exactly its error cases. -/
+theorem lowerDecl_defn_parameterDropsAdmissible
+    {src : IxIR0.Env} {compilerFuel : Nat}
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    (hrun : (lowerDecl src compilerFuel (address, .defn result body)).run
+      state = .ok (some (address, .fn d)) finalState) :
+    ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)) := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+    trackedBindRun_ok_inv hrun
+  cases compilerFuel with
+  | zero =>
+    exact (trackedThrowRun_not_ok (by
+      simpa [lowerFnBody] using hbodyRun)).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hbodyRun
+    obtain ⟨releaseResult, releaseState, hreleaseRun, _⟩ :=
+      trackedBindRun_ok_inv hbodyRun
+    exact parameterDropsAdmissible_of_releaseSlots_run 0 (lamUses body)
+      (fun index => countUses index (stripLams body)) hreleaseRun
+
+/-- An ordinary source declaration produced by a reachable whole-pass run
+satisfies the exact semantic contract at the current evaluator index using
+only strictly-smaller semantic declaration/application contracts. -/
+theorem lowerDecl_defn_valuePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {compilerFuel limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some (.defn result body))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValuePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧
+        bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hlookup : sourceCtx.env address = some (.defn result body) := by
+    rw [henv]
+    exact hsrc
+  have hpreserves : FnValuePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨(lamUses body).length, result,
+        result == .shared && papSafe body, code⟩
+      ((lamUses body).map worldOfUses) sourceFunction limit :=
+    lowerFnBody_parameterEntries_valuePreservesAt_within_below
+      (recSelfRel := fun _ _ => False)
+      (compilerFuel := compilerFuel) (limit := limit)
+      henv hrepresented hcontracts hvalues (lamUses body) result
+      (stripLams body) hadmissible (by simpa using hbodyRun) hextends
+      (by
+        intro sourceArgs sourceResult hlength happlies
+        exact href.defnSaturate hlookup (by simpa using hlength) happlies)
+  have hfn : (⟨(lamUses body).length, result,
+      result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn]
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  exact hpreserves hlength hargs happlies hframe hown hcodeRun
+
+/-- A successfully lowered ordinary body realizes any source function whose
+saturated applications evaluate the source body in the canonical reversed
+argument environment. This is the semantic function-entry/exit adapter;
+recursive call contracts remain explicit in `hvalues`. -/
+theorem lowerFnBody_parameterEntries_valuePreservesAt
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx}
+    {compilerFuel targetFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    (modes : List Uses) (world : Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceFunction : IxIR0.Value}
+    (hsaturates : ∀ {sourceArgs : List IxIR0.Value}
+        {sourceResult : IxIR0.Value},
+      sourceArgs.length = modes.length →
+      SourceApplies sourceCtx sourceFunction sourceArgs sourceResult →
+      ∃ sourceFuel,
+        IxIR0.eval sourceCtx sourceFuel sourceArgs.reverse body =
+          .ok sourceResult) :
+    FnValuePreservesAt (CompilerFunctionRel sourceCtx src ambient)
+      sourceCtx ctx ⟨modes.length, world, papSafeFlag, code⟩
+      (modes.map worldOfUses) sourceFunction targetFuel := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun (by
+      simpa [input, remaining] using
+        parameterEntries_noRecSelf 0 modes remaining modes.length)
+  obtain ⟨plannedMiddle, plannedEmit, hplan, htracks⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have hmiddleLength : plannedMiddle.entries.length = modes.length := by
+    calc
+      plannedMiddle.entries.length = input.entries.length :=
+        hplan'.entries_length
+      _ = modes.length := by simp [input, remaining]
+  have hreleased : EntriesReleased output.entries :=
+    hconsume.entriesReleased htracks (Eq.trans hcount hmiddleLength)
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  have hargsLength : args.length = modes.length := by
+    simpa using hlength
+  have hsourceArgsLength : sourceArgs.length = args.length := by
+    simpa using hargs.length
+  obtain ⟨sourceFuel, hsource⟩ := hsaturates
+    (hsourceArgsLength.trans hargsLength) happlies
+  have hbodySound : LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ plannedMiddle output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world emit av :=
+    lowerE_run_value_sound_within_noRecSelf
+      (recSelfRel := recSelfRel)
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hsource hbodyRun hextends
+      hmiddleNo
+  have hfull : LowerResultValueSound
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel ctx
+      ⟨modes.length, world, papSafeFlag, code⟩ input output
+      sourceArgs.reverse sourceArgs.reverse sourceResult world
+      (plannedEmit ∘ emit) av :=
+    hbodySound.afterRelease (hplan'.valueSound sourceArgs.reverse)
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel input
+      sourceArgs.reverse sourceRest rest store args.reverse := by
+    refine ⟨(rootsForWorlds (modes.map worldOfUses) args).reverse,
+      ?_, hframe, ?_⟩
+    · simpa [input] using VEnvValueGraph.parameterEntries
+        (recSelfRel := recSelfRel) modes remaining hargsLength hargs hown
+    · exact hown.perm
+        ((List.reverse_perm
+          (rootsForWorlds (modes.map worldOfUses) args)).symm.append_right
+            rest)
+  have hcodeRun' : runCode ctx targetFuel
+      ⟨modes.length, world, papSafeFlag, code⟩ store args.reverse
+      ((plannedEmit ∘ emit) (.ret (av.toAtom output))) =
+        .ok (store', value) := by
+    rw [hcode]
+    exact hcodeRun
+  exact hfull.closeGraph hreleased sourceRest rest hpre hcodeRun'
+
+/-- An actual successful ordinary `lowerDecl` run satisfies the exact-fuel
+semantic contract of the source definition it compiled. The public source
+reference fixes the source function, while `defnSaturate` supplies the body
+evaluation required by the generic function-entry adapter. -/
+theorem lowerDecl_defn_valuePreservesAt
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {compilerFuel targetFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some (.defn result body))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValuePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+      ((lamUses body).map worldOfUses) sourceFunction targetFuel := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧
+        bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hlookup : sourceCtx.env address = some (.defn result body) := by
+    rw [henv]
+    exact hsrc
+  have hpreserves : FnValuePreservesAt
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨(lamUses body).length, result,
+        result == .shared && papSafe body, code⟩
+      ((lamUses body).map worldOfUses) sourceFunction targetFuel :=
+    lowerFnBody_parameterEntries_valuePreservesAt
+      (recSelfRel := fun _ _ => False)
+      (compilerFuel := compilerFuel) (targetFuel := targetFuel)
+      henv hrepresented hcontracts hvalues (lamUses body) result
+      (stripLams body) hadmissible (by simpa using hbodyRun) hextends
+      (by
+        intro sourceArgs sourceResult hlength happlies
+        exact href.defnSaturate hlookup (by simpa using hlength) happlies)
+  have hfn : (⟨(lamUses body).length, result,
+      result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn]
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  exact hpreserves hlength hargs happlies hframe hown hcodeRun
+
+/-- Unbounded packaging of the ordinary declaration adapter. This theorem
+does not seal the mutually recursive compiler contracts—`hvalues` is still
+an explicit premise—but it removes all function-entry, cleanup, and source
+saturation obligations from that eventual contractive construction. -/
+theorem lowerDecl_defn_valueContract
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {compilerFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    {sourceFunction : IxIR0.Value}
+    (hsrc : src address = some (.defn result body))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (compilerFuel + 1)
+      (address, .defn result body)).run state =
+        .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValueContract (CompilerFunctionRel sourceCtx src ambient)
+      sourceCtx ctx d ((lamUses body).map worldOfUses) sourceFunction := by
+  have hshape : d.arity = lamArity body := by
+    have hrunShape := hrun
+    simp only [lowerDecl] at hrunShape
+    obtain ⟨code, bodyState, _, hpureRun⟩ :=
+      trackedBindRun_ok_inv hrunShape
+    have hpure :
+        some (address, Decl.fn ⟨lamArity body, result,
+          result == .shared && papSafe body, code⟩) =
+            some (address, Decl.fn d) ∧
+          bodyState = finalState := by
+      simpa using hpureRun
+    have hd : d = ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩ := by
+      have hp := Option.some.inj hpure.1
+      exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+    rw [hd]
+  refine ⟨?_, ?_⟩
+  · calc
+      ((lamUses body).map worldOfUses).length = lamArity body := by simp
+      _ = d.arity := hshape.symm
+  · intro targetFuel
+    exact lowerDecl_defn_valuePreservesAt
+      (targetFuel := targetFuel) henv hrepresented hcontracts hvalues
+      hsrc href hadmissible hrun hextends
+
+/-! ### Whole-main value agreement -/
+
+/-- Recover the exact main-body lowering run from a successful whole-program
+action. Declaration traversal supplies the initial state; the trailing
+`get` and `pure` leave the main body's final state unchanged. -/
+theorem lowerAllAction_main_trace
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat} {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    (hrun : (lowerAllAction decls main mainWorld fuel).run initial =
+      .ok (targetDecls, mainCode) finalState) :
+    ∃ mainInitial,
+      (lowerFnBody (IxIR0.Env.ofList decls) fuel ⟨[], 0⟩ [] mainWorld
+        main).run mainInitial = .ok mainCode finalState := by
+  simp only [lowerAllAction] at hrun
+  obtain ⟨base, baseState, _, hafterBase⟩ :=
+    trackedBindRun_ok_inv hrun
+  obtain ⟨compiledMain, mainState, hmain, hafterMain⟩ :=
+    trackedBindRun_ok_inv hafterBase
+  obtain ⟨observed, getState, hget, hpure⟩ :=
+    trackedBindRun_ok_inv hafterMain
+  have hget' : mainState = observed ∧ mainState = getState := by
+    simpa using hget
+  obtain ⟨hobserved, hgetState⟩ := hget'
+  subst observed
+  subst getState
+  have hpure' :
+      (base ++ mainState.extra, compiledMain) =
+          (targetDecls, mainCode) ∧
+        mainState = finalState := by
+    simpa using hpure
+  have hcode : compiledMain = mainCode := congrArg Prod.snd hpure'.1
+  subst mainCode
+  refine ⟨baseState, ?_⟩
+  rw [← hpure'.2]
+  exact hmain
+
+/-- Every successful execution of an actually lowered closed main owns
+exactly its declared result root.  This is the ownership half of
+`Reclamation`; unlike value agreement it needs no successful source run. -/
+theorem lowerAllAction_main_owned
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {targetFuel : Nat} {targetStore : Store}
+    {targetValue : RVal}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (htarget : runMain ctx mainCode targetFuel =
+      .ok (targetStore, targetValue)) :
+    RootOwnership targetStore [⟨mainWorld, targetValue⟩] := by
+  obtain ⟨mainInitial, hmain⟩ := lowerAllAction_main_trace hlower
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerFnBody] at hmain
+    exact (trackedThrowRun_not_ok hmain).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hmain
+    obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+      trackedBindRun_ok_inv hmain
+    rcases releaseResult with ⟨middle, releaseEmit⟩
+    obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+      trackedBindRun_ok_inv hafterRelease
+    rcases bodyResult with ⟨output, emit, av⟩
+    have hpure :
+        (releaseEmit ∘ emit) (.ret (av.toAtom output)) = mainCode ∧
+          bodyState = finalState := by
+      simpa using hafterBody
+    obtain ⟨hcode, hbodyState⟩ := hpure
+    subst bodyState
+    let input : VEnv := ⟨[], 0⟩
+    have hplan : ReleasePlan input [] input (_root_.id : Emit) := .nil
+    have hplanRun : (releaseSlots input []).run mainInitial =
+        .ok (input, (_root_.id : Emit)) mainInitial :=
+      hplan.run mainInitial
+    have heq :
+        (input, (_root_.id : Emit)) = (middle, releaseEmit) ∧
+          mainInitial = releaseState := by
+      simpa [input] using hplanRun.symm.trans hrelease
+    have hmiddle : input = middle := congrArg Prod.fst heq.1
+    have hemitting : (_root_.id : Emit) = releaseEmit :=
+      congrArg Prod.snd heq.1
+    subst middle
+    subst releaseEmit
+    cases heq.2
+    let cur : FnDef := ⟨0, .shared, false, mainCode⟩
+    have hbodySound : LowerResultSoundBelow ctx cur targetFuel input output
+        mainWorld emit av :=
+      (lowerClusterPreservesBelow (cur := cur)
+        (hcontracts.apply.below targetFuel)
+        (hcontracts.decls.below targetFuel) bodyFuel).expr
+        hbodyRun hrepresented
+        (SelfAvailableBelow.of_noRecSelf
+          (by intro index arity hentry; simp [input] at hentry))
+    have hfull : LowerResultSoundBelow ctx cur targetFuel input output
+        mainWorld ((_root_.id : Emit) ∘ emit) av :=
+      hbodySound.afterRelease hplan.soundBelow
+    have hcount := lowerE_preservesEntryCount hbodyRun
+    have houtputEntries : output.entries = [] := by
+      apply List.eq_nil_of_length_eq_zero
+      simpa [EntryCountPreserved, input] using hcount
+    have hreleased : EntriesReleased output.entries := by
+      rw [houtputEntries]
+      exact .nil
+    have hpre : OwnsVEnv input [] ({} : Store) [] := by
+      refine ⟨[], ?_, ?_⟩
+      · exact ⟨by simp [input], EntriesRealize.nil⟩
+      · simpa using RootOwnership.empty
+    have htarget' : runCode ctx targetFuel cur ({} : Store) []
+        (((_root_.id : Emit) ∘ emit) (.ret (av.toAtom output))) =
+          .ok (targetStore, targetValue) := by
+      unfold runMain at htarget
+      change runCode ctx targetFuel cur ({} : Store) [] mainCode =
+        .ok (targetStore, targetValue) at htarget
+      rw [hcode]
+      exact htarget
+    exact hfull.close hreleased [] (Nat.le_refl _) hpre htarget'
+
+/-- Generic value agreement for the compiled whole-program main. The theorem
+deliberately accepts a successful target execution: proving that such an
+execution exists for every successful source run is the separate progress
+obligation (`MemoryErrorUnreachable` and ordinary-stuck exclusion). -/
+theorem lowerAllAction_main_value_graph
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel targetFuel : Nat}
+    {sourceValue : IxIR0.Value} {targetStore : Store}
+    {targetValue : RVal}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue)
+    (htarget : runMain ctx mainCode targetFuel =
+      .ok (targetStore, targetValue)) :
+    Sim.ValueGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      targetStore sourceValue targetValue := by
+  obtain ⟨mainInitial, hmain⟩ := lowerAllAction_main_trace hlower
+  cases compilerFuel with
+  | zero =>
+    simp only [lowerFnBody] at hmain
+    exact (trackedThrowRun_not_ok hmain).elim
+  | succ bodyFuel =>
+    simp only [lowerFnBody] at hmain
+    obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+      trackedBindRun_ok_inv hmain
+    rcases releaseResult with ⟨middle, releaseEmit⟩
+    obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+      trackedBindRun_ok_inv hafterRelease
+    rcases bodyResult with ⟨output, emit, av⟩
+    have hpure :
+        (releaseEmit ∘ emit) (.ret (av.toAtom output)) = mainCode ∧
+          bodyState = finalState := by
+      simpa using hafterBody
+    obtain ⟨hcode, hbodyState⟩ := hpure
+    subst bodyState
+    let input : VEnv := ⟨[], 0⟩
+    have hplan : ReleasePlan input [] input (_root_.id : Emit) := by
+      exact .nil
+    have hplanRun : (releaseSlots input []).run mainInitial =
+        .ok (input, (_root_.id : Emit)) mainInitial :=
+      hplan.run mainInitial
+    have heq :
+        (input, (_root_.id : Emit)) = (middle, releaseEmit) ∧
+          mainInitial = releaseState := by
+      simpa [input] using hplanRun.symm.trans hrelease
+    have hmiddle : input = middle := congrArg Prod.fst heq.1
+    have hemitting : (_root_.id : Emit) = releaseEmit :=
+      congrArg Prod.snd heq.1
+    subst middle
+    subst releaseEmit
+    cases heq.2
+    let cur : FnDef := ⟨0, .shared, false, mainCode⟩
+    have hbodySound : LowerResultValueSound
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) ctx cur input output [] [] sourceValue
+        mainWorld emit av :=
+      lowerE_run_value_sound_within_noRecSelf
+        (recSelfRel := fun _ _ => False) (cur := cur) henv hrepresented
+        hcontracts hvalues hsource hbodyRun (ExtraExtends.refl _)
+        (by intro index arity hentry; simp [input] at hentry)
+    have hfull : LowerResultValueSound
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) ctx cur input output [] [] sourceValue
+        mainWorld ((_root_.id : Emit) ∘ emit) av :=
+      hbodySound.afterRelease (hplan.valueSound [])
+    have hcount := lowerE_preservesEntryCount hbodyRun
+    have houtputEntries : output.entries = [] := by
+      apply List.eq_nil_of_length_eq_zero
+      simpa [EntryCountPreserved, input] using hcount
+    have hreleased : EntriesReleased output.entries := by
+      rw [houtputEntries]
+      exact .nil
+    have hpre : GraphOwnsVEnv
+        (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+        (fun _ _ => False) input [] [] [] ({} : Store) [] := by
+      refine ⟨[], ?_, Sim.RootsGraph.nil, RootOwnership.empty⟩
+      exact ⟨by simp [input], EntriesValueGraph.nil⟩
+    have htarget' : runCode ctx targetFuel cur ({} : Store) []
+        (((_root_.id : Emit) ∘ emit) (.ret (av.toAtom output))) =
+          .ok (targetStore, targetValue) := by
+      unfold runMain at htarget
+      change runCode ctx targetFuel cur ({} : Store) [] mainCode =
+        .ok (targetStore, targetValue) at htarget
+      rw [hcode]
+      exact htarget
+    exact (hfull.closeGraph hreleased [] [] hpre htarget').1
+
+/-- Lift whole-main value agreement to the public forward-simulation
+proposition once target progress is supplied independently. This statement
+makes the remaining split explicit: compiler value contracts establish
+agreement, while the progress premise establishes existence of a successful
+target run. -/
+theorem lowerAllAction_semanticForwardSimulation_of_targetProgress
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx)
+    (hprogress : ∀ {sourceFuel sourceValue},
+      IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue →
+      ∃ targetFuel targetStore targetValue,
+        runMain ctx mainCode targetFuel = .ok (targetStore, targetValue)) :
+    SemanticForwardSimulation sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  intro sourceFuel sourceValue hsource
+  obtain ⟨targetFuel, targetStore, targetValue, htarget⟩ :=
+    hprogress hsource
+  refine ⟨targetFuel, targetStore, targetValue, htarget, ?_⟩
+  exact lowerAllAction_main_value_graph henv hlower hrepresented
+    hcontracts hvalues hsource htarget
+
+/-- Ordinary generated bodies need no current-self assumption: successful
+lowering from a self-free logical environment is covered directly by the
+closed compiler-fuel cluster. -/
+theorem lowerE_run_sound_below_noRecSelf
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hno : NoRecSelf input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av :=
+  (lowerClusterPreservesBelow (cur := cur) happly hdecls fuel).expr
+    hrun hrepresented (SelfAvailableBelow.of_noRecSelf hno)
+
+/-- Recursor-rule bodies use the same closed cluster with the substantive
+current-function contract supplied by the generated recursor environment. -/
+theorem lowerE_run_sound_below_currentSelf
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {fuel : Nat} {input output : VEnv} {world : Owned}
+    {expr : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {av : AVal}
+    (hrun : (lowerE src fuel input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hself : CurrentSelfContractBelow ctx cur limit) :
+    LowerResultSoundBelow ctx cur limit input output world emit av :=
+  (lowerClusterPreservesBelow (cur := cur) happly hdecls fuel).expr
+    hrun hrepresented (SelfAvailableBelow.of_contract hself)
+
+/-- A successful recursor-rule RHS run closes all ordinary logical entries
+while preserving the trailing recursive-self marker.  This discharges the
+state-side premise consumed by the generated alternative theorem. -/
+theorem lowerRecursorRule_rhs_sound_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (hself : CurrentSelfContractBelow ctx cur limit)
+    {fuel numArgs : Nat} {rule : IxIR0.RecRule}
+    {state finalState : LowSt}
+    {fieldOutput rhsInput output : VEnv}
+    {fieldEmit parameterEmit bodyEmit : Emit} {av : AVal}
+    (hfieldRun :
+      applyRecursorFieldRetains
+          ⟨List.replicate rule.fields (.slot 0 0 .many false),
+            (numArgs + 1) + rule.fields⟩
+          (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields) =
+        (fieldOutput, fieldEmit))
+    (hparameterRun :
+      (releaseSlots
+          ⟨fieldOutput.entries ++
+              parameterEntries 0 (List.replicate numArgs .many)
+                (fun i => countUses (rule.fields + i) rule.rhs) ++
+              [.recSelf (numArgs + 1)],
+            fieldOutput.depth + 1⟩
+          ((parameterDrops 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs)).map
+            (SlotDrop.offsetEntry rule.fields))).run state =
+        .ok (rhsInput, parameterEmit) state)
+    (hbodyRun : (lowerE src fuel rhsInput .shared rule.rhs).run state =
+      .ok (output, bodyEmit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    LowerResultSoundBelow ctx cur limit rhsInput output .shared
+        bodyEmit av ∧
+      EntriesReleased output.entries := by
+  obtain ⟨htracks, hinputLength, hinputSelf⟩ :=
+    recursorPrefix_entries_tracked numArgs rule.fields rule.rhs state
+      hfieldRun hparameterRun
+  have hsound := lowerE_run_sound_below_currentSelf
+    happly hdecls hbodyRun hrepresented hself
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have houtputLength :
+      output.entries.length = rule.fields + numArgs + 1 :=
+    Eq.trans hcount hinputLength
+  have houtputSelf :
+      RecSelfAt output (rule.fields + numArgs) (numArgs + 1) :=
+    lowerE_recSelfAt hbodyRun hinputSelf
+  exact ⟨hsound,
+    hconsume.entriesReleasedWithRecSelf htracks houtputLength houtputSelf⟩
+
+/-- Determinism of the generated prefix turns one concrete successful RHS
+run into the universally quantified body premise expected by
+`lowerRecursorRule_generated_verified_below`. -/
+theorem recursorRuleBodySoundBelow_of_run
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (hself : CurrentSelfContractBelow ctx cur limit)
+    {fuel numArgs : Nat} {rule : IxIR0.RecRule}
+    {state finalState : LowSt}
+    {canonicalFieldOutput canonicalRhsInput output : VEnv}
+    {canonicalFieldEmit canonicalParameterEmit bodyEmit : Emit}
+    {av : AVal}
+    (hfieldRun :
+      applyRecursorFieldRetains
+          ⟨List.replicate rule.fields (.slot 0 0 .many false),
+            (numArgs + 1) + rule.fields⟩
+          (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields) =
+        (canonicalFieldOutput, canonicalFieldEmit))
+    (hparameterRun :
+      (releaseSlots
+          ⟨canonicalFieldOutput.entries ++
+              parameterEntries 0 (List.replicate numArgs .many)
+                (fun i => countUses (rule.fields + i) rule.rhs) ++
+              [.recSelf (numArgs + 1)],
+            canonicalFieldOutput.depth + 1⟩
+          ((parameterDrops 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs)).map
+            (SlotDrop.offsetEntry rule.fields))).run state =
+        .ok (canonicalRhsInput, canonicalParameterEmit) state)
+    (hbodyRun :
+      (lowerE src fuel canonicalRhsInput .shared rule.rhs).run state =
+        .ok (output, bodyEmit, av) finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    RecursorRuleBodySoundBelow ctx cur limit src fuel numArgs rule state := by
+  intro fieldOutput fieldEmit rhsInput parameterEmit
+    hfieldRun' hparameterRun'
+  have hfieldPair :
+      (fieldOutput, fieldEmit) =
+        (canonicalFieldOutput, canonicalFieldEmit) :=
+    hfieldRun'.symm.trans hfieldRun
+  have hfieldOutput : fieldOutput = canonicalFieldOutput :=
+    congrArg Prod.fst hfieldPair
+  subst fieldOutput
+  have hparameterPair :
+      (rhsInput, parameterEmit) =
+          (canonicalRhsInput, canonicalParameterEmit) ∧ state = state := by
+    simpa using hparameterRun'.symm.trans hparameterRun
+  have hrhsInput : rhsInput = canonicalRhsInput :=
+    congrArg Prod.fst hparameterPair.1
+  subst rhsInput
+  obtain ⟨hsound, hreleased⟩ := lowerRecursorRule_rhs_sound_below
+    happly hdecls hself hfieldRun hparameterRun hbodyRun hrepresented
+  exact ⟨output, bodyEmit, av, finalState,
+    hbodyRun, hsound, hreleased⟩
+
+/-- Actual successful lowering of one recursor rule produces a bounded
+ownership-safe alternative; all generated-prefix and RHS cleanup obligations
+are reconstructed from the run itself. -/
+theorem lowerRecursorRule_preservesAlt_below
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (hself : CurrentSelfContractBelow ctx cur limit)
+    (hresult : cur.result = .shared)
+    {fuel numArgs : Nat} {rule : IxIR0.RecRule} {tag : Nat}
+    {state finalState : LowSt} {alt : Alt}
+    (hrun : (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+      .ok alt finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    AltOwnershipContractBelow ctx cur alt .shared
+      (RecursorEntryValid numArgs) recursorEntryRoots limit := by
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      hfieldRun, hparameterRun, _⟩ :=
+    recursorPrefix_generated_verified_below (ctx := ctx) (cur := cur)
+      limit numArgs rule.fields rule.rhs state
+  have hparameterRun' :
+      (releaseSlots
+        ⟨fieldOutput.entries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs) ++
+            [.recSelf (numArgs + 1)],
+          fieldOutput.depth + 1⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs)).map
+          (SlotDrop.offsetEntry rule.fields))).run state =
+        .ok (rhsInput, parameterEmit) state := by
+    simpa [List.append_assoc] using hparameterRun
+  have horiginalRun := hrun
+  simp only [lowerRecursorRule] at hrun
+  rw [hfieldRun] at hrun
+  simp only at hrun
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases releaseResult with ⟨actualRhsInput, actualParameterEmit⟩
+  have hreleaseEq :
+      (rhsInput, parameterEmit) =
+          (actualRhsInput, actualParameterEmit) ∧ state = releaseState := by
+    simpa [VEnv.bump, List.append_assoc] using
+      hparameterRun'.symm.trans hreleaseRun
+  have hrhsInput : rhsInput = actualRhsInput :=
+    congrArg Prod.fst hreleaseEq.1
+  have hparameterEmit : parameterEmit = actualParameterEmit :=
+    congrArg Prod.snd hreleaseEq.1
+  have hreleaseState : state = releaseState := hreleaseEq.2
+  subst actualRhsInput
+  subst actualParameterEmit
+  subst releaseState
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, bodyEmit, av⟩
+  have hpure :
+      Alt.mk tag rule.fields
+          (fieldEmit
+            (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+              (parameterEmit
+                (bodyEmit (.ret (av.toAtom output)))))) = alt ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨halt, hstate⟩ := hpure
+  subst bodyState
+  have hbody : RecursorRuleBodySoundBelow
+      ctx cur limit src fuel numArgs rule state :=
+    recursorRuleBodySoundBelow_of_run
+      happly hdecls hself hfieldRun hparameterRun' hbodyRun hrepresented
+  obtain ⟨generatedFinalState, generatedAlt,
+      hgeneratedRun, hcontract⟩ :=
+    lowerRecursorRule_generated_verified_below
+      hresult src fuel numArgs rule tag state hbody
+  have hrunEq : alt = generatedAlt ∧ finalState = generatedFinalState := by
+    simpa using horiginalRun.symm.trans hgeneratedRun
+  rw [hrunEq.1]
+  exact hcontract
+
+/-- Reconstruct the bounded proof-relevant rule plan from the compiler's
+actual successful `mapM` traversal.  Final generated-state representation is
+transported backward along each tail before proving its head alternative. -/
+theorem recursorRulesPlanBelow_of_run
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (hself : CurrentSelfContractBelow ctx cur limit)
+    (hresult : cur.result = .shared)
+    (fuel numArgs : Nat) :
+    ∀ {rules : List (IxIR0.RecRule × Nat)}
+        {state finalState : LowSt} {alts : List Alt},
+      (rules.mapM (lowerRecursorRule src fuel numArgs)).run state =
+        .ok alts finalState →
+      ExtraRepresented ctx finalState →
+      RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+        state rules finalState alts := by
+  intro rules
+  induction rules with
+  | nil =>
+    intro state finalState alts hrun _
+    have hpure : ([] : List Alt) = alts ∧ state = finalState := by
+      simpa using hrun
+    obtain ⟨halts, hstate⟩ := hpure
+    subst alts
+    subst finalState
+    exact RecursorRulesPlanBelow.nil state
+  | cons ruleTag rules ih =>
+    intro state finalState alts hrun hrepresented
+    rcases ruleTag with ⟨rule, tag⟩
+    simp only [List.mapM_cons] at hrun
+    obtain ⟨headAlt, middleState, hheadRun, hafterHead⟩ :=
+      trackedBindRun_ok_inv hrun
+    obtain ⟨tailAlts, tailState, htailRun, hafterTail⟩ :=
+      trackedBindRun_ok_inv hafterHead
+    have hpure : headAlt :: tailAlts = alts ∧
+        tailState = finalState := by
+      simpa using hafterTail
+    obtain ⟨halts, hstate⟩ := hpure
+    subst alts
+    subst finalState
+    have htailExtends : ExtraExtends middleState tailState :=
+      (ExtraMonotone.listMapM
+        (lowerRecursorRule src fuel numArgs)
+        (lowerRecursorRule_extraMonotone src fuel numArgs) rules) htailRun
+    have hmiddleRepresented : ExtraRepresented ctx middleState :=
+      hrepresented.of_extends htailExtends
+    have hheadContract : AltOwnershipContractBelow ctx cur headAlt .shared
+        (RecursorEntryValid numArgs) recursorEntryRoots limit :=
+      lowerRecursorRule_preservesAlt_below
+        happly hdecls hself hresult hheadRun hmiddleRepresented
+    exact RecursorRulesPlanBelow.cons hheadRun hheadContract
+      (ih htailRun hrepresented)
+
+/-- Invert one successful generated-rule lowering into the two exact prefix
+plans and the concrete semantic RHS run.  The static retain/release plans
+also prove that neither prefix phase changes the compiler state. -/
+theorem lowerRecursorRule_run_plan_inv
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {rule : IxIR0.RecRule} {tag : Nat}
+    {state finalState : LowSt} {alt : Alt}
+    (hrun : (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+      .ok alt finalState) :
+    ∃ fieldOutput fieldEmit rhsInput parameterEmit
+        output bodyEmit av,
+      FieldRetainPlan
+        ⟨List.replicate rule.fields (.slot 0 0 .many false),
+          (numArgs + 1) + rule.fields⟩
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields)
+        fieldOutput fieldEmit ∧
+      ReleasePlan
+        ⟨fieldOutput.entries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs) ++
+            [.recSelf (numArgs + 1)],
+          fieldOutput.depth + 1⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs)).map
+          (SlotDrop.offsetEntry rule.fields))
+        rhsInput parameterEmit ∧
+      (lowerE src fuel rhsInput .shared rule.rhs).run state =
+        .ok (output, bodyEmit, av) finalState ∧
+      alt = .mk tag rule.fields
+        (fieldEmit
+          (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+            (parameterEmit
+              (bodyEmit (.ret (av.toAtom output)))))) := by
+  obtain ⟨fieldOutput, fieldEmit, hfieldPlan⟩ :=
+    recursorFieldRetains_plan (numArgs + 1)
+      ((numArgs + 1) + rule.fields) rule.fields rule.rhs
+  have hfieldLength : fieldOutput.entries.length = rule.fields := by
+    calc
+      fieldOutput.entries.length =
+          (⟨List.replicate rule.fields (.slot 0 0 .many false),
+            (numArgs + 1) + rule.fields⟩ : VEnv).entries.length :=
+        hfieldPlan.entries_length
+      _ = rule.fields := by simp
+  obtain ⟨rhsInput, parameterEmit, hparameterPlan⟩ :=
+    recursorParameterDrops_releasePlan numArgs rule.fields
+      (fieldOutput.depth + 1) rule.rhs fieldOutput.entries hfieldLength
+  have hfieldRun := hfieldPlan.run
+  have horiginal := hrun
+  simp only [lowerRecursorRule] at hrun
+  rw [hfieldRun] at hrun
+  simp only at hrun
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases releaseResult with ⟨actualRhsInput, actualParameterEmit⟩
+  have hparameterRun := hparameterPlan.run state
+  have hreleaseEq :
+      (rhsInput, parameterEmit) =
+          (actualRhsInput, actualParameterEmit) ∧
+        state = releaseState := by
+    simpa [VEnv.bump, List.append_assoc] using
+      hparameterRun.symm.trans hreleaseRun
+  obtain ⟨hrhsInput, hreleaseState⟩ := hreleaseEq
+  have hparameterEmit : parameterEmit = actualParameterEmit :=
+    congrArg Prod.snd hrhsInput
+  have hrhsInputOnly : rhsInput = actualRhsInput :=
+    congrArg Prod.fst hrhsInput
+  subst actualRhsInput
+  subst actualParameterEmit
+  subst releaseState
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, bodyEmit, av⟩
+  have hpure :
+      Alt.mk tag rule.fields
+          (fieldEmit
+            (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+              (parameterEmit
+                (bodyEmit (.ret (av.toAtom output)))))) = alt ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨halt, hbodyState⟩ := hpure
+  subst bodyState
+  exact ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+    output, bodyEmit, av, hfieldPlan,
+    by simpa [List.append_assoc] using hparameterPlan,
+    hbodyRun, halt.symm⟩
+
+/-- Invert a successful target alternative selection all the way back to
+the indexed source rule that generated it.  Besides the exact rule lookup,
+the result retains both executable prefix plans, the semantic RHS run, and
+the remaining state-threaded traversal after the selected rule. -/
+theorem RecursorRulesPlanBelow.find?_run_plan_inv
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel numArgs : Nat} {state finalState : LowSt}
+    {rules : Array IxIR0.RecRule} {alts : List Alt}
+    (hplan : RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+      state rules.toList.zipIdx finalState alts)
+    {cidx selectedTag fieldCount : Nat} {body : Code}
+    (hfind : alts.toArray.find? (fun alt => alt.cidx == cidx) =
+      some (.mk selectedTag fieldCount body)) :
+    ∃ rule headState nextState tailRules tailAlts
+        fieldOutput fieldEmit rhsInput parameterEmit
+        output bodyEmit av,
+      rules[cidx]? = some rule ∧
+      selectedTag = cidx ∧
+      fieldCount = rule.fields ∧
+      FieldRetainPlan
+        ⟨List.replicate rule.fields (.slot 0 0 .many false),
+          (numArgs + 1) + rule.fields⟩
+        (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields)
+        fieldOutput fieldEmit ∧
+      ReleasePlan
+        ⟨fieldOutput.entries ++
+            parameterEntries 0 (List.replicate numArgs .many)
+              (fun i => countUses (rule.fields + i) rule.rhs) ++
+            [.recSelf (numArgs + 1)],
+          fieldOutput.depth + 1⟩
+        ((parameterDrops 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs)).map
+          (SlotDrop.offsetEntry rule.fields))
+        rhsInput parameterEmit ∧
+      (lowerE src fuel rhsInput .shared rule.rhs).run headState =
+        .ok (output, bodyEmit, av) nextState ∧
+      body = fieldEmit
+        (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+          (parameterEmit
+            (bodyEmit (.ret (av.toAtom output))))) ∧
+      RecursorRulesPlanBelow ctx cur limit src fuel numArgs
+        nextState tailRules finalState tailAlts := by
+  have hmember : (.mk selectedTag fieldCount body : Alt) ∈ alts := by
+    simpa using Array.mem_of_find?_eq_some hfind
+  obtain ⟨rule, tag, headState, nextState, tailRules, tailAlts,
+      hsourceMember, hheadRun, htailPlan⟩ :=
+    hplan.trace_mem (.mk selectedTag fieldCount body) hmember
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      output, bodyEmit, av, hfieldPlan, hparameterPlan,
+      hbodyRun, halt⟩ :=
+    lowerRecursorRule_run_plan_inv hheadRun
+  have hselectedTag : selectedTag = cidx := by
+    have hmatch := Array.find?_some
+      (p := fun alt : Alt => alt.cidx == cidx)
+      (a := .mk selectedTag fieldCount body)
+      (xs := alts.toArray) hfind
+    exact beq_iff_eq.mp hmatch
+  have htag : selectedTag = tag := by
+    injection halt
+  have hfieldCount : fieldCount = rule.fields := by
+    injection halt
+  have hbody : body = fieldEmit
+      (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+        (parameterEmit
+          (bodyEmit (.ret (av.toAtom output))))) := by
+    injection halt
+  have htagCidx : tag = cidx := htag.symm.trans hselectedTag
+  obtain ⟨_, htagBound, hruleElem⟩ :=
+    List.mem_zipIdx hsourceMember
+  have htagLt : tag < rules.toList.length := by
+    simpa using htagBound
+  have hruleTag : rules[tag]? = some rule := by
+    rw [← Array.getElem?_toList]
+    rw [List.getElem?_eq_getElem htagLt]
+    exact congrArg some hruleElem.symm
+  have hrule : rules[cidx]? = some rule := by
+    rwa [← htagCidx]
+  exact ⟨rule, headState, nextState, tailRules, tailAlts,
+    fieldOutput, fieldEmit, rhsInput, parameterEmit,
+    output, bodyEmit, av, hrule, hselectedTag, hfieldCount,
+    hfieldPlan, hparameterPlan, hbodyRun, hbody, htailPlan⟩
+
+/-- Execute the exact generated prefix and RHS for one selected recursor
+rule while transporting the source result and the caller's framed graphs.
+This is independent of how the case dispatcher represented the major; the
+caller supplies the corresponding source/target field graph and field-world
+facts. -/
+theorem lowerRecursorRule_branch_value_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {recSelfRel : RecSelfRel} {ctx : Ctx} {cur : FnDef} {limit : Nat}
+    {fuel numArgs : Nat} {rule : IxIR0.RecRule}
+    {headState nextState : LowSt}
+    {fieldOutput rhsInput output : VEnv}
+    {fieldEmit parameterEmit bodyEmit : Emit} {av : AVal}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hself : CurrentSelfValueContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      cur limit)
+    (hfieldPlan : FieldRetainPlan
+      ⟨List.replicate rule.fields (.slot 0 0 .many false),
+        (numArgs + 1) + rule.fields⟩
+      (recursorFieldRetains (numArgs + 1) rule.rhs rule.fields)
+      fieldOutput fieldEmit)
+    (hparameterPlan : ReleasePlan
+      ⟨fieldOutput.entries ++
+          parameterEntries 0 (List.replicate numArgs .many)
+            (fun i => countUses (rule.fields + i) rule.rhs) ++
+          [.recSelf (numArgs + 1)],
+        fieldOutput.depth + 1⟩
+      ((parameterDrops 0 (List.replicate numArgs .many)
+          (fun i => countUses (rule.fields + i) rule.rhs)).map
+        (SlotDrop.offsetEntry rule.fields))
+      rhsInput parameterEmit)
+    (hbodyRun : (lowerE src fuel rhsInput .shared rule.rhs).run headState =
+      .ok (output, bodyEmit, av) nextState)
+    (hextends : ExtraExtends nextState ambient)
+    {sourcePre : List IxIR0.Value} {pre : List RVal}
+    {sourceFields : List IxIR0.Value} {fields : List RVal}
+    {sourceSelf sourceValue : IxIR0.Value} {major : RVal}
+    {sourceFuel : Nat}
+    (hsource : IxIR0.eval sourceCtx sourceFuel
+      (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+      rule.rhs = .ok sourceValue)
+    (hpreLength : pre.length = numArgs)
+    (hfieldsLength : fields.length = rule.fields)
+    {store store' : Store} {value : RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hpreGraphs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourcePre pre)
+    (hfieldGraphs : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceFields fields)
+    (hsourceSelf : recSelfRel sourceSelf (numArgs + 1))
+    (hframe : Sim.RootsGraph
+      (CompilerFunctionRel sourceCtx src ambient) store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (pre ++ [major]) ++ rest))
+    (hfieldWorld : ∀ field ∈ fields, HasWorld store .shared field)
+    {branchFuel : Nat} (hbound : branchFuel ≤ limit)
+    (hbranchRun : runCode ctx branchFuel cur store
+      (fields.reverse ++ major :: pre.reverse)
+      (fieldEmit
+        (emitOp (.drop (.var (fieldOutput.rel numArgs)))
+          (parameterEmit
+            (bodyEmit (.ret (av.toAtom output)))))) =
+        .ok (store', value)) :
+    Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceValue value ∧
+      Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceRest rest := by
+  have hentry := recursorAltEntry_value_state
+    (funRel := CompilerFunctionRel sourceCtx src ambient)
+    (recSelfRel := recSelfRel) numArgs rule.fields rule.rhs
+    hpreLength hfieldsLength hpreGraphs hfieldGraphs hsourceSelf hframe hown
+    hfieldWorld
+  have hprefix := recursorPrefixPlans_valueSoundBelow
+    (funRel := CompilerFunctionRel sourceCtx src ambient)
+    (recSelfRel := recSelfRel) (ctx := ctx) (cur := cur) (limit := limit)
+    numArgs rule.fields rule.rhs hfieldPlan hparameterPlan
+    (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+    sourceRest rest major fields
+  have hbodySound := lowerE_run_value_sound_within_currentSelf_below
+    henv hrepresented hcontracts hvalues hsource hbodyRun hextends hself
+  have hnextRepresented : ExtraRepresented ctx nextState :=
+    hrepresented.of_extends hextends
+  have hownershipSelf : CurrentSelfContractBelow ctx cur limit :=
+    ⟨hself.result, hself.ownership⟩
+  have hfieldRun := hfieldPlan.run
+  have hparameterRun := hparameterPlan.run headState
+  obtain ⟨_, hreleased⟩ := lowerRecursorRule_rhs_sound_below
+    (hcontracts.below limit).apply (hcontracts.below limit).decls
+    hownershipSelf hfieldRun hparameterRun hbodyRun hnextRepresented
+  have hbodyCode : CodeOwnsBelow ctx cur limit
+      (GraphOwnsVEnv (CompilerFunctionRel sourceCtx src ambient)
+        recSelfRel rhsInput
+        (sourceFields.reverse ++ sourcePre.reverse ++ [sourceSelf])
+        sourceRest rest)
+      (fun resultStore resultValue =>
+        Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient)
+            resultStore sourceValue resultValue ∧
+          Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+            resultStore sourceRest rest)
+      (bodyEmit (.ret (av.toAtom output))) :=
+    hbodySound.closeGraph hreleased sourceRest rest
+  exact hprefix limit (Nat.le_refl limit)
+    (fun resultStore resultValue =>
+      Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient)
+          resultStore sourceValue resultValue ∧
+        Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+          resultStore sourceRest rest)
+    (bodyEmit (.ret (av.toAtom output))) hbodyCode
+    (fuel := branchFuel) (store := store)
+    (env := fields.reverse ++ major :: pre.reverse)
+    (store' := store') (value := value) hbound hentry
+    (by simpa [Function.comp_def] using hbranchRun)
+
+private theorem lowerStateSimExceptBindOk {error α β : Type}
+    (value : α) (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+/-- Actual successful lowering of an entire recursor reconstructs the rule
+plan and yields its exact-index function ownership theorem. -/
+theorem lowerRecursor_preservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {fuel numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule} {state finalState : LowSt} {d : FnDef}
+    (hself : CurrentSelfContractBelow ctx d limit)
+    (hrun : (lowerRecursor src fuel numArgs natLit rules).run state =
+      .ok d finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    FnOwnershipPreservesAt ctx d
+      (List.replicate (numArgs + 1) .shared) limit := by
+  simp only [lowerRecursor] at hrun
+  obtain ⟨alts, rulesState, hrulesRun, hafterRules⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      (⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩ : FnDef) = d ∧
+        rulesState = finalState := by
+    simpa using hafterRules
+  obtain ⟨hd, hstate⟩ := hpure
+  subst d
+  subst rulesState
+  have hplan : RecursorRulesPlanBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit src fuel numArgs state rules.toList.zipIdx finalState alts :=
+    recursorRulesPlanBelow_of_run happly hdecls hself rfl
+      fuel numArgs hrulesRun hrepresented
+  have hverified :
+      (lowerRecursor src fuel numArgs natLit rules).run state =
+          .ok ⟨numArgs + 1, .shared, true,
+            .case (.var 0) natLit alts.toArray⟩ finalState ∧
+        FnOwnershipPreservesAt ctx
+          ⟨numArgs + 1, .shared, true,
+            .case (.var 0) natLit alts.toArray⟩
+          (List.replicate (numArgs + 1) .shared) limit :=
+    lowerRecursor_generated_verified_below
+      limit src fuel numArgs natLit rules state finalState alts
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      rfl hplan
+  have hpreserves : FnOwnershipPreservesAt ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared) limit := hverified.2
+  intro store store' args value rest hlength hown hcodeRun
+  exact hpreserves hlength hown hcodeRun
+
+/-- Exact-fuel semantic preservation for a successfully generated source
+recursor.  Source saturation identifies the chosen rule and its evaluator
+environment; target case dispatch is then joined to the exact generated
+prefix/RHS trace for that same indexed rule. -/
+theorem lowerRecursor_valuePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hrun : (lowerRecursor src compilerFuel numArgs natLit rules).run state =
+      .ok d finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValuePreservesAt (CompilerFunctionRel sourceCtx src ambient)
+      sourceCtx ctx d (List.replicate (numArgs + 1) .shared)
+      sourceFunction limit := by
+  simp only [lowerRecursor] at hrun
+  obtain ⟨alts, rulesState, hrulesRun, hafterRules⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      (⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩ : FnDef) = d ∧
+        rulesState = finalState := by
+    simpa using hafterRules
+  obtain ⟨hd, hstate⟩ := hpure
+  subst d
+  subst rulesState
+  have hsourceLookup : sourceCtx.env address =
+      some (.recursor numArgs natLit rules) := by
+    rw [henv]
+    exact hsrc
+  have hsourceFunction := href.recursorValue hsourceLookup
+  subst sourceFunction
+  let recSelfRel : RecSelfRel := fun value arity =>
+    value = .pap (.rec_ address (numArgs + 1)) [] ∧
+      arity = numArgs + 1
+  obtain ⟨ownedD, hownedDecl, _, _, hownedContract⟩ :=
+    hcontracts.decls.recursor hsrc
+  have hownedD : ownedD =
+      (⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩ : FnDef) := by
+    have hsame : some (Decl.fn ownedD) = some
+        (.fn ⟨numArgs + 1, .shared, true,
+          .case (.var 0) natLit alts.toArray⟩) :=
+      hownedDecl.symm.trans hdecl
+    exact Decl.fn.inj (Option.some.inj hsame)
+  subst ownedD
+  have hvalueContract : FnValueContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      (List.replicate (numArgs + 1) .shared)
+      (.pap (.rec_ address (numArgs + 1)) []) limit := by
+    apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+    simp
+  have hself : CurrentSelfValueContractBelow
+      (CompilerFunctionRel sourceCtx src ambient) recSelfRel sourceCtx ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit := by
+    refine ⟨rfl, ?_, ?_⟩
+    · simpa using hownedContract.below limit
+    · intro candidate hcandidate
+      change candidate = .pap (.rec_ address (numArgs + 1)) [] ∧
+        numArgs + 1 = numArgs + 1 at hcandidate
+      rcases hcandidate with ⟨rfl, _⟩
+      exact hvalueContract
+  have hfinalRepresented : ExtraRepresented ctx finalState :=
+    hrepresented.of_extends hextends
+  have hownershipSelf : CurrentSelfContractBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit := ⟨hself.result, hself.ownership⟩
+  have hplan : RecursorRulesPlanBelow ctx
+      ⟨numArgs + 1, .shared, true, .case (.var 0) natLit alts.toArray⟩
+      limit src compilerFuel numArgs state rules.toList.zipIdx
+      finalState alts :=
+    recursorRulesPlanBelow_of_run (hcontracts.below limit).apply
+      (hcontracts.below limit).decls hownershipSelf rfl
+      compilerFuel numArgs hrulesRun hfinalRepresented
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hargsLength hargs happlies hframe hown htarget
+  have hargsArity : args.length = numArgs + 1 := by
+    simpa using hargsLength
+  have hrootShape :
+      rootsForWorlds (List.replicate (numArgs + 1) .shared) args =
+        rootsFor .shared args :=
+    rootsForWorlds_replicate_eq_rootsFor .shared hargsArity
+  rw [hrootShape] at hown
+  cases limit with
+  | zero => simp [runCode] at htarget
+  | succ branchFuel =>
+    cases hreverse : args.reverse with
+    | nil =>
+      have hargsNil : args = [] := by
+        have h := congrArg List.reverse hreverse
+        simpa using h
+      simp [hargsNil] at hargsArity
+    | cons major runtimePre =>
+      have hargsForm : args = runtimePre.reverse ++ [major] := by
+        have h := congrArg List.reverse hreverse
+        simpa [List.reverse_cons] using h
+      have hruntimePreLength : runtimePre.length = numArgs := by
+        rw [hargsForm] at hargsArity
+        simp only [List.length_append, List.length_reverse,
+          List.length_singleton] at hargsArity
+        omega
+      obtain ⟨sourcePre, sourceMajor, hsourceArgsForm,
+          hsourcePreLength, hpreGraphs, hmajorGraph⟩ :=
+        valuesGraph_splitLast hargs hargsForm hruntimePreLength
+      rw [hsourceArgsForm] at happlies
+      obtain ⟨sourceTag, sourceFields, sourceRule, sourceFuel,
+          hsourceMajor, hsourceRule, hsourceFieldsLength, hsourceEval⟩ :=
+        sourceRecursorRef_saturates_inv hsourceLookup href
+          hsourcePreLength happlies
+      have hmajorWorld : HasWorld store .shared major := by
+        apply hown.roots_world ⟨.shared, major⟩
+        apply List.mem_append_left rest
+        simp [rootsFor, hargsForm]
+      have hentryOwn : RootOwnership store
+          (rootsFor .shared (runtimePre.reverse ++ [major]) ++ rest) := by
+        simpa [hargsForm] using hown
+      rw [hreverse] at htarget
+      change runCode ctx (branchFuel + 1)
+          ⟨numArgs + 1, .shared, true,
+            .case (.var 0) natLit alts.toArray⟩
+          store (major :: runtimePre)
+          (.case (.var 0) natLit alts.toArray) =
+        .ok (store', value) at htarget
+      have hdispatch := htarget
+      rw [runCode.eq_def] at hdispatch
+      dsimp only at hdispatch
+      rw [show resolveAtom (major :: runtimePre) (.var 0) = .ok major
+        from rfl, lowerStateSimExceptBindOk] at hdispatch
+      have finish {cidx selectedTag fieldCount : Nat} {body : Code}
+          (halt : alts.toArray.find? (fun alt => alt.cidx == cidx) =
+            some (.mk selectedTag fieldCount body))
+          (hcidx : cidx = sourceTag)
+          {targetFields : List RVal}
+          (hfieldGraphs : Sim.ValuesGraph
+            (CompilerFunctionRel sourceCtx src ambient) store
+            sourceFields targetFields)
+          (htargetFieldsLength : targetFields.length = fieldCount)
+          (hfieldWorld : ∀ field ∈ targetFields,
+            HasWorld store .shared field)
+          (hbranchRun : runCode ctx branchFuel
+            ⟨numArgs + 1, .shared, true,
+              .case (.var 0) natLit alts.toArray⟩
+            store (targetFields.reverse ++ major :: runtimePre) body =
+              .ok (store', value)) :
+          Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient)
+              store' sourceResult value ∧
+            Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+              store' sourceRest rest := by
+        obtain ⟨rule, headState, nextState, tailRules, tailAlts,
+            fieldOutput, fieldEmit, rhsInput, parameterEmit,
+            output, bodyEmit, av, hrule, _, hfieldCount,
+            hfieldPlan, hparameterPlan, hbodyRun, hbody, htailPlan⟩ :=
+          hplan.find?_run_plan_inv halt
+        have hsourceRuleAt : rules[cidx]? = some sourceRule := by
+          rw [hcidx]
+          exact hsourceRule
+        have hruleEq : rule = sourceRule :=
+          Option.some.inj (hrule.symm.trans hsourceRuleAt)
+        subst rule
+        have htargetRuleLength : targetFields.length = sourceRule.fields :=
+          htargetFieldsLength.trans hfieldCount
+        have htailExtends : ExtraExtends nextState finalState :=
+          (ExtraMonotone.listMapM
+            (lowerRecursorRule src compilerFuel numArgs)
+            (lowerRecursorRule_extraMonotone src compilerFuel numArgs)
+            tailRules) htailPlan.run
+        have hnextExtends : ExtraExtends nextState ambient :=
+          htailExtends.trans hextends
+        rw [hbody] at hbranchRun
+        exact lowerRecursorRule_branch_value_below
+          (recSelfRel := recSelfRel) (limit := branchFuel + 1)
+          (branchFuel := branchFuel)
+          henv hrepresented hcontracts hvalues
+          hself hfieldPlan hparameterPlan hbodyRun hnextExtends
+          (sourcePre := sourcePre) (pre := runtimePre.reverse)
+          (sourceFields := sourceFields) (fields := targetFields)
+          (sourceSelf := .pap (.rec_ address (numArgs + 1)) [])
+          (sourceValue := sourceResult) (major := major)
+          hsourceEval (by simpa using hruntimePreLength)
+          htargetRuleLength hpreGraphs hfieldGraphs ⟨rfl, rfl⟩
+          hframe hentryOwn hfieldWorld (by omega)
+          (by simpa using hbranchRun)
+      cases hmajorGraph with
+      | @lit literal =>
+        cases literal with
+        | str string => simp [IxIR0.majorCtor] at hsourceMajor
+        | nat n =>
+          cases hpeel : natLit with
+          | false => simp [IxIR0.majorCtor, hpeel] at hsourceMajor
+          | true =>
+              cases n with
+              | zero =>
+                have hmajorPair :
+                    0 = sourceTag ∧ sourceFields = [] := by
+                  simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                have htag : sourceTag = 0 :=
+                  hmajorPair.1.symm
+                have hfields : sourceFields = [] :=
+                  hmajorPair.2
+                subst sourceTag
+                subst sourceFields
+                cases halt : alts.toArray.find?
+                    (fun alt => alt.cidx == 0) with
+                | none => simp [hpeel, halt] at hdispatch
+                | some alt =>
+                  cases alt with
+                  | mk selectedTag fieldCount body =>
+                    cases fieldCount with
+                    | zero =>
+                      have hbranch := hdispatch
+                      simp [hpeel, halt] at hbranch
+                      exact finish halt rfl Sim.ValuesGraph.nil rfl
+                        (by simp) (by simpa [hpeel] using hbranch)
+                    | succ fieldCount =>
+                      simp [hpeel, halt] at hdispatch
+              | succ n =>
+                have hmajorPair :
+                    1 = sourceTag ∧
+                      [.lit (.nat n)] = sourceFields := by
+                  simpa [IxIR0.majorCtor, hpeel] using hsourceMajor
+                have htag : sourceTag = 1 :=
+                  hmajorPair.1.symm
+                have hfields : sourceFields = [.lit (.nat n)] :=
+                  hmajorPair.2.symm
+                subst sourceTag
+                subst sourceFields
+                cases halt : alts.toArray.find?
+                    (fun alt => alt.cidx == 1) with
+                | none => simp [hpeel, halt] at hdispatch
+                | some alt =>
+                  cases alt with
+                  | mk selectedTag fieldCount body =>
+                    by_cases hfieldCount : fieldCount = 1
+                    · subst fieldCount
+                      have hbranch := hdispatch
+                      simp [hpeel, halt] at hbranch
+                      exact finish halt rfl
+                        (.cons .lit .nil) rfl (by simp [HasWorld])
+                        (by simpa [hpeel] using hbranch)
+                    · simp [hpeel, halt, hfieldCount] at hdispatch
+      | erased => simp [IxIR0.majorCtor] at hsourceMajor
+      | @ctor sourceAddress sourceCtorTag sourceCtorFields loc
+          world rc cid targetFields hget haddress htag hfieldGraphs =>
+        have hmajorPair :
+            sourceCtorTag = sourceTag ∧
+              sourceCtorFields = sourceFields := by
+          simpa [IxIR0.majorCtor] using hsourceMajor
+        have hsourceTagEq : sourceTag = sourceCtorTag :=
+          hmajorPair.1.symm
+        have hsourceFieldsEq : sourceFields = sourceCtorFields :=
+          hmajorPair.2.symm
+        subst sourceTag
+        subst sourceFields
+        obtain ⟨ownedBox, hownedBox, hownedWorld⟩ := hmajorWorld
+        rw [hget] at hownedBox
+        have hboxEq :
+            (⟨world, rc, .ctorN cid targetFields⟩ : NodeBox) =
+              ownedBox := Option.some.inj hownedBox
+        subst ownedBox
+        dsimp only [NodeBox.world] at hownedWorld
+        subst world
+        cases halt : alts.toArray.find?
+            (fun alt => alt.cidx == cid.cidx) with
+        | none => simp [hget, halt] at hdispatch
+        | some alt =>
+          cases alt with
+          | mk selectedTag fieldCount body =>
+            by_cases hsize : targetFields.size = fieldCount
+            · have hbranch := htarget
+              rw [runCode_case_ctor rfl hget halt hsize] at hbranch
+              rw [Array.foldl_cons_eq_reverse_append] at hbranch
+              exact finish halt htag
+                (by simpa using hfieldGraphs)
+                (by simpa using hsize)
+                (hown.caseFieldsBorrowed hget)
+                hbranch
+            · simp [hget, halt, hsize] at hdispatch
+      | function hget hfun hcaptures =>
+        simp [hget] at hdispatch
+
+/-- Declaration-facing recursor rule over the actual `lowerDecl` result. -/
+theorem lowerDecl_recursor_preservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {fuel : Nat} {address : Ixon.Address} {numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {state finalState : LowSt} {d : FnDef}
+    (hself : CurrentSelfContractBelow ctx d limit)
+    (hrun :
+      (lowerDecl src fuel (address, .recursor numArgs natLit rules)).run
+        state = .ok (some (address, .fn d)) finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    FnOwnershipPreservesAt ctx d
+      (List.replicate (numArgs + 1) .shared) limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn actual) = some (address, Decl.fn d) ∧
+        recursorState = finalState := by
+    simpa using hafterRecursor
+  have hd : actual = d := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2
+  have hrecursorState : recursorState = finalState := hpure.2
+  subst actual
+  subst recursorState
+  intro store store' args value rest hlength hown hcodeRun
+  exact lowerRecursor_preservesAt
+    happly hdecls hself hrecursorRun hrepresented hlength hown hcodeRun
+
+/-- Declaration-facing semantic recursor rule over the actual `lowerDecl`
+result.  The declaration adapter contributes no runtime behavior; it only
+recovers the exact generated recursor body and final compiler state used by
+`lowerRecursor_valuePreservesAt_within_below`. -/
+theorem lowerDecl_recursor_valuePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel numArgs : Nat}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {address : Ixon.Address} {sourceFunction : IxIR0.Value}
+    {state finalState : LowSt} {d : FnDef}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hsrc : src address = some (.recursor numArgs natLit rules))
+    (hdecl : ctx.decls address = some (.fn d))
+    (href : SourceRefValue sourceCtx address sourceFunction)
+    (hrun :
+      (lowerDecl src compilerFuel
+        (address, .recursor numArgs natLit rules)).run state =
+          .ok (some (address, .fn d)) finalState)
+    (hextends : ExtraExtends finalState ambient) :
+    FnValuePreservesAt (CompilerFunctionRel sourceCtx src ambient)
+      sourceCtx ctx d (List.replicate (numArgs + 1) .shared)
+      sourceFunction limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn actual) = some (address, Decl.fn d) ∧
+        recursorState = finalState := by
+    simpa using hafterRecursor
+  have hd : actual = d := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2
+  have hrecursorState : recursorState = finalState := hpure.2
+  subst actual
+  subst recursorState
+  intro store store' args value sourceArgs sourceResult sourceRest rest
+    hlength hargs happlies hframe hown hcodeRun
+  exact lowerRecursor_valuePreservesAt_within_below
+    henv hrepresented hcontracts hvalues hsrc hdecl href
+    hrecursorRun hextends hlength hargs happlies hframe hown hcodeRun
+
+/-- Declaration-facing inversion of an ordinary successful `lowerFnBody`.
+The returned expression proof is self-contract-free; only the canonical
+entry cleanup and the actual body run are exposed. -/
+theorem lowerFnBody_run_sound_below_noRecSelf
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {fuel : Nat} {input : VEnv} {drops : List SlotDrop}
+    {world : Owned} {body : IxIR0.Expr} {state finalState : LowSt}
+    {code : Code}
+    (hrun : (lowerFnBody src (fuel + 1) input drops world body).run state =
+      .ok code finalState)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hno : NoRecSelf input) :
+    ∃ middle releaseEmit releaseState output emit av,
+      (releaseSlots input drops).run state =
+        .ok (middle, releaseEmit) releaseState ∧
+      (lowerE src fuel middle world body).run releaseState =
+        .ok (output, emit, av) finalState ∧
+      code = (releaseEmit ∘ emit) (.ret (av.toAtom output)) ∧
+      LowerResultSoundBelow ctx cur limit middle output world emit av := by
+  simp only [lowerFnBody] at hrun
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hstate⟩ := hpure
+  subst bodyState
+  have hmiddleNo := releaseSlots_noRecSelf input hreleaseRun hno
+  refine ⟨middle, releaseEmit, releaseState, output, emit, av,
+    hreleaseRun, hbodyRun, hcode.symm, ?_⟩
+  exact lowerE_run_sound_below_noRecSelf happly hdecls hbodyRun
+    hrepresented hmiddleNo
+
+/-- A successful ordinary function-body lowering over the canonical parameter
+telescope preserves ownership at the exact evaluator index. Dead-entry release,
+exact body consumption, logical-entry cardinality, and the self-free semantic
+path are all discharged here. -/
+theorem lowerFnBody_parameterEntries_preservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (modes : List Uses) (world : Owned) (body : IxIR0.Expr)
+    {state finalState : LowSt} {code : Code} {papSafeFlag : Bool}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hrun : (lowerFnBody src (fuel + 1)
+      ⟨parameterEntries 0 modes (fun index => countUses index body),
+        modes.length⟩
+      (parameterDrops 0 modes (fun index => countUses index body))
+      world body).run state = .ok code finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    FnOwnershipPreservesAt ctx ⟨modes.length, world, papSafeFlag, code⟩
+      (modes.map worldOfUses) limit := by
+  let remaining : Nat → Nat := fun index => countUses index body
+  let input : VEnv :=
+    ⟨parameterEntries 0 modes remaining, modes.length⟩
+  let drops := parameterDrops 0 modes remaining
+  have hrun' :
+      (lowerFnBody src (fuel + 1) input drops world body).run state =
+        .ok code finalState := by
+    simpa [input, drops, remaining] using hrun
+  obtain ⟨middle, releaseEmit, releaseState, output, emit, av,
+      hreleaseRun, hbodyRun, hcode, hbodySound⟩ :=
+    lowerFnBody_run_sound_below_noRecSelf
+      (cur := (⟨modes.length, world, papSafeFlag, code⟩ : FnDef))
+      happly hdecls hrun' hrepresented
+      (by simpa [input, remaining] using
+        parameterEntries_noRecSelf 0 modes remaining modes.length)
+  obtain ⟨plannedMiddle, plannedEmit, hplan, htracks⟩ :=
+    parameterDrops_releasePlan_tracked 0 modes remaining
+      (by simpa [remaining] using hadmissible)
+  have hplan' : ReleasePlan input drops plannedMiddle plannedEmit := by
+    simpa [input, drops] using hplan
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan'.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  obtain ⟨hmiddle, hstate⟩ := heq
+  cases hmiddle
+  subst releaseState
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have hmiddleLength : middle.entries.length = modes.length := by
+    calc
+      middle.entries.length = input.entries.length := hplan'.entries_length
+      _ = modes.length := by simp [input, remaining]
+  have hreleased : EntriesReleased output.entries :=
+    hconsume.entriesReleased htracks (Eq.trans hcount hmiddleLength)
+  have hfull : LowerResultSoundBelow ctx
+      (⟨modes.length, world, papSafeFlag, code⟩ : FnDef)
+        limit input output world
+      (releaseEmit ∘ emit) av :=
+    hbodySound.afterRelease hplan'.soundBelow
+  apply hfull.fnOwnershipPreservesAt
+    (FnEntryRealizes.parameterEntries modes remaining)
+  · simp
+  · exact hreleased
+  · exact hcode
+
+/-- Declaration-facing ordinary-definition rule. The theorem follows the
+actual `lowerDecl` result rather than a separately supplied body plan. -/
+theorem lowerDecl_defn_preservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {address : Ixon.Address} {result : Owned} {body : IxIR0.Expr}
+    {state finalState : LowSt} {d : FnDef}
+    (hadmissible : ParameterDropsAdmissible (lamUses body)
+      (fun index => countUses index (stripLams body)))
+    (hrun : (lowerDecl src (fuel + 1) (address, .defn result body)).run
+      state = .ok (some (address, .fn d)) finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    FnOwnershipPreservesAt ctx d ((lamUses body).map worldOfUses) limit := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, hbodyRun, hpureRun⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧ bodyState = finalState := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  cases hpure.2
+  subst d
+  have hpreserves : FnOwnershipPreservesAt ctx
+      ⟨(lamUses body).length, result,
+        result == .shared && papSafe body, code⟩
+      ((lamUses body).map worldOfUses) limit :=
+    lowerFnBody_parameterEntries_preservesAt
+      happly hdecls (lamUses body) result (stripLams body) hadmissible
+      (by simpa using hbodyRun) hrepresented
+  have hfn : (⟨(lamUses body).length, result,
+      result == .shared && papSafe body, code⟩ : FnDef) =
+      ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩ := by
+    rw [lamUses_length]
+  rw [← hfn]
+  intro store store' args value rest hlength hown hcodeRun
+  exact hpreserves hlength hown hcodeRun
+
+/-- The complete bounded expression step with counted-binder release
+discharged. Generated-declaration representation is now its only remaining
+compile-state premise. -/
+theorem lowerE_run_sound_below_counted
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    (hspine : LowerSpinePreservesBelow ctx cur limit src fuel)
+    (hargsNext : LowerArgsPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestNext : ApplyRestPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestNextExtra : ApplyRestExtraMonotone src (fuel + 1))
+    (hborrow : LowerBorrowPreservesBelow ctx cur limit src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState : LowSt}
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av :=
+  lowerE_run_sound_below hexpr hspine hargsNext
+    (lowerExtraMonotone src (fuel + 1)).args hrestNext hrestNextExtra
+    hborrow hdecls
+    (fun body => lowerE_releasesTrackedFirst src fuel body) hrepresented hrun
+    havailable
+
+/-- Ambient whole-program form of the complete expression step. The final
+context represents one later state, while `ExtraExtends` transports that
+layout back to the successful expression run's own final state. -/
+theorem lowerE_run_sound_below_ambient
+    {ctx : Ctx} {cur : FnDef} {limit : Nat} {src : IxIR0.Env}
+    {fuel : Nat}
+    (hexpr : LowerEPreservesBelow ctx cur limit src fuel)
+    (hspine : LowerSpinePreservesBelow ctx cur limit src fuel)
+    (hargsNext : LowerArgsPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestNext : ApplyRestPreservesBelow ctx cur limit src (fuel + 1))
+    (hrestNextExtra : ApplyRestExtraMonotone src (fuel + 1))
+    (hborrow : LowerBorrowPreservesBelow ctx cur limit src fuel)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {world : Owned} {expr : IxIR0.Expr}
+    {emit : Emit} {av : AVal} {state finalState ambient : LowSt}
+    (hambient : ExtraRepresented ctx ambient)
+    (hwithin : ExtraExtends finalState ambient)
+    (hrun : (lowerE src (fuel + 1) input world expr).run state =
+      .ok (output, emit, av) finalState)
+    (havailable : SelfAvailableBelow ctx cur limit input) :
+    LowerResultSoundBelow ctx cur limit input output world emit av :=
+  lowerE_run_sound_below_counted hexpr hspine hargsNext hrestNext
+    hrestNextExtra hborrow hdecls (hambient.of_extends hwithin) hrun
+    havailable
+
+/-! ## Lifted-function entry layout -/
+
+/-- The structural capture-entry builder realizes an ordered selected subset
+of shared runtime arguments. `next` is the next absolute capture slot; it is
+threaded in lockstep with the selected values, while unselected source entries
+remain released logical placeholders. -/
+private theorem selectedEntriesFrom_entriesRealize
+    {Γ : VEnv} {env : List RVal}
+    (selected : Nat → Bool) (remaining : Nat → Nat) :
+    ∀ (indices : List Nat) (next : Nat) (values : List RVal),
+      values.length = (indices.filter selected).length →
+      0 < Γ.depth →
+      next + values.length ≤ Γ.depth →
+      (∀ index, index < values.length →
+        env[Γ.rel (next + index)]? = values[index]?) →
+      EntriesRealize Γ env
+        (selectedEntriesFrom selected remaining indices next)
+        (rootsFor .shared values) := by
+  intro indices next values hlength hpositive hbound hslots
+  exact selectedEntriesFrom_traverse selected remaining
+    (Result := fun sourceIndices current entries =>
+      ∀ runtimeValues,
+        runtimeValues.length = (sourceIndices.filter selected).length →
+        0 < Γ.depth →
+        current + runtimeValues.length ≤ Γ.depth →
+        (∀ index, index < runtimeValues.length →
+          env[Γ.rel (current + index)]? = runtimeValues[index]?) →
+        EntriesRealize Γ env entries (rootsFor .shared runtimeValues))
+    (hnil := by
+      intro current runtimeValues hlength _ _ _
+      cases runtimeValues with
+      | nil => exact EntriesRealize.nil
+      | cons value values => simp at hlength)
+    (hfalse := by
+      intro entry entries current tail hselected ih runtimeValues hlength
+        hpositive hbound hslots
+      apply EntriesRealize.released (by omega)
+      apply ih runtimeValues
+      · simpa [hselected] using hlength
+      · exact hpositive
+      · exact hbound
+      · exact hslots)
+    (htrue := by
+      intro entry entries current tail hselected ih runtimeValues hlength
+        hpositive hbound hslots
+      cases runtimeValues with
+      | nil => simp [hselected] at hlength
+      | cons value values =>
+        simp only [rootsFor, List.map_cons]
+        apply EntriesRealize.held
+        · exact Nat.lt_of_lt_of_le (by simp) hbound
+        · have hhead := hslots 0 (by simp)
+          simpa using hhead
+        · apply ih values
+          · simpa [hselected] using hlength
+          · exact hpositive
+          · simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using hbound
+          · intro index hindex
+            have htail := hslots (index + 1) (by simp [hindex])
+            simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using htail)
+    indices next values hlength hpositive hbound hslots
+
+/-- Semantic companion to `selectedEntriesFrom_entriesRealize`.  The first
+`ValuesAt` witness supplies every logical source entry, while the filtered
+witness and pointwise runtime graph supply exactly the held capture subset;
+unselected entries remain present on the source side but own no root. -/
+private theorem selectedEntriesFrom_entriesValueGraph
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel}
+    {store : Store} {Γ : VEnv} {env : List RVal}
+    {sourceEnv : List IxIR0.Value}
+    (selected : Nat → Bool) (remaining : Nat → Nat) :
+    ∀ (indices : List Nat) (next : Nat)
+        (allSources selectedSources : List IxIR0.Value)
+        (values : List RVal),
+      ValuesAt sourceEnv indices allSources →
+      ValuesAt sourceEnv (indices.filter selected) selectedSources →
+      Sim.ValuesGraph funRel store selectedSources values →
+      0 < Γ.depth →
+      next + values.length ≤ Γ.depth →
+      (∀ index, index < values.length →
+        env[Γ.rel (next + index)]? = values[index]?) →
+      (∀ value, value ∈ values → HasWorld store .shared value) →
+      EntriesValueGraph funRel recSelfRel store Γ env
+        (selectedEntriesFrom selected remaining indices next)
+        allSources (rootsFor .shared values) := by
+  intro indices next allSources selectedSources values hall hselected hgraphs
+    hpositive hbound hslots hworlds
+  exact selectedEntriesFrom_traverse selected remaining
+    (Result := fun sourceIndices current entries =>
+      ∀ allSourceValues selectedSourceValues runtimeValues,
+        ValuesAt sourceEnv sourceIndices allSourceValues →
+        ValuesAt sourceEnv (sourceIndices.filter selected)
+          selectedSourceValues →
+        Sim.ValuesGraph funRel store selectedSourceValues runtimeValues →
+        0 < Γ.depth →
+        current + runtimeValues.length ≤ Γ.depth →
+        (∀ index, index < runtimeValues.length →
+          env[Γ.rel (current + index)]? = runtimeValues[index]?) →
+        (∀ value, value ∈ runtimeValues → HasWorld store .shared value) →
+        EntriesValueGraph funRel recSelfRel store Γ env entries
+          allSourceValues (rootsFor .shared runtimeValues))
+    (hnil := by
+      intro current allSourceValues selectedSourceValues runtimeValues
+        hall hselected hgraphs _ _ _ _
+      cases hall
+      cases hselected
+      cases hgraphs
+      exact EntriesValueGraph.nil)
+    (hfalse := by
+      intro entry entries current tail hselectedBit ih allSourceValues
+        selectedSourceValues runtimeValues hall hselected hgraphs hpositive
+        hbound hslots hworlds
+      cases hall with
+      | @cons _ source _ tailSources hsource htailAll =>
+        simp only [List.filter_cons, hselectedBit, Bool.false_eq_true,
+          if_false] at hselected
+        apply EntriesValueGraph.released (by omega)
+        exact ih tailSources selectedSourceValues runtimeValues htailAll
+          hselected hgraphs hpositive hbound hslots hworlds)
+    (htrue := by
+      intro entry entries current tail hselectedBit ih allSourceValues
+        selectedSourceValues runtimeValues hall hselected hgraphs hpositive
+        hbound hslots hworlds
+      cases hall with
+      | @cons _ source _ tailSources hsource htailAll =>
+        simp only [List.filter_cons, hselectedBit, ↓reduceIte] at hselected
+        cases hselected with
+        | @cons _ selectedSource _ selectedTail hselectedSource
+            hselectedTail =>
+          cases hgraphs with
+          | @cons _ runtimeValue _ runtimeTail hvalue htailGraphs =>
+            have hsourceEq : selectedSource = source := by
+              exact Option.some.inj (hselectedSource.symm.trans hsource)
+            subst selectedSource
+            simp only [rootsFor, List.map_cons]
+            apply EntriesValueGraph.held
+            · exact Nat.lt_of_lt_of_le (by simp) hbound
+            · have hhead := hslots 0 (by simp)
+              simpa using hhead
+            · exact hworlds runtimeValue (by simp)
+            · exact hvalue
+            · apply ih tailSources selectedTail runtimeTail htailAll
+                hselectedTail htailGraphs hpositive
+              · simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+                  using hbound
+              · intro index hindex
+                have htail := hslots (index + 1) (by simp [hindex])
+                simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+                  using htail
+              · intro value hvalueMem
+                exact hworlds value (by simp [hvalueMem]))
+    indices next allSources selectedSources values hall hselected hgraphs
+      hpositive hbound hslots hworlds
+
+/-- Reading a bottom-indexed absolute slot from the evaluator's reversed
+function environment recovers the corresponding source-order argument. -/
+private theorem getElem?_reverse_at_absolute
+    {values : List α} {depth index : Nat}
+    (hlength : values.length = depth) (hindex : index < depth) :
+    values.reverse[depth - 1 - index]? = values[index]? := by
+  have hbound : depth - 1 - index < values.length := by omega
+  have hreverse := List.getElem?_reverse (l := values) hbound
+  have heq : values.length - 1 - (depth - 1 - index) = index := by omega
+  simpa [heq] using hreverse
+
+/-- Consecutive valid source-environment indices select the corresponding
+list segment. -/
+private theorem ValuesAt.range'_of_get (sourceEnv : List IxIR0.Value) :
+    ∀ (start : Nat) (values : List IxIR0.Value),
+      (∀ offset, offset < values.length →
+        sourceEnv[start + offset]? = values[offset]?) →
+      ValuesAt sourceEnv (List.range' start values.length) values := by
+  intro start values
+  induction values generalizing start with
+  | nil =>
+    intro _
+    exact ValuesAt.nil
+  | cons head tail ih =>
+    intro hget
+    have hhead : sourceEnv[start]? = some head := by
+      have h := hget 0 (by simp)
+      simpa using h
+    apply ValuesAt.cons hhead
+    have htail := ih (start + 1) (by
+      intro offset hoffset
+      have h := hget (offset + 1) (by simp [hoffset])
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using h)
+    simpa [List.range'_succ] using htail
+
+/-- The full source environment is selected by its canonical index range. -/
+private theorem ValuesAt.range_self (sourceEnv : List IxIR0.Value) :
+    ValuesAt sourceEnv (List.range sourceEnv.length) sourceEnv := by
+  have h := ValuesAt.range'_of_get sourceEnv 0 sourceEnv (by
+    intro offset hoffset
+    simp)
+  simpa [List.range_eq_range'] using h
+
+/-- Semantic entry graph for a lifted function's public
+capture-then-parameter calling convention.  Runtime arguments are supplied
+in public order, while both the evaluator stack and the leading source
+parameter environment are reversed at function entry. -/
+theorem VEnvValueGraph.lifted
+    {funRel : Sim.FunctionRel} {recSelfRel : RecSelfRel} {store : Store}
+    (entryCount : Nat) (modes : List Uses)
+    (parameterRemaining : Nat → Nat)
+    (selected : Nat → Bool) (captureRemaining : Nat → Nat)
+    {sourceEnv selectedSources parameterSources : List IxIR0.Value}
+    {captureArgs parameterArgs : List RVal} {rest : List Root}
+    (hsourceLength : sourceEnv.length = entryCount)
+    (hselected : ValuesAt sourceEnv
+      ((List.range entryCount).filter selected) selectedSources)
+    (hcaptureLength : captureArgs.length =
+      ((List.range entryCount).filter selected).length)
+    (hparameterLength : parameterArgs.length = modes.length)
+    (hcaptures : Sim.ValuesGraph funRel store selectedSources captureArgs)
+    (hparameters : Sim.ValuesGraph funRel store parameterSources
+      parameterArgs)
+    (hpositive : 0 < modes.length)
+    (hshared : modes.map worldOfUses =
+      List.replicate modes.length .shared)
+    (hown : RootOwnership store
+      (rootsFor .shared (captureArgs ++ parameterArgs) ++ rest)) :
+    let captures := (List.range entryCount).filter selected
+    let Γ : VEnv :=
+      ⟨Lower.parameterEntries captures.length modes parameterRemaining ++
+          selectedEntriesFrom selected captureRemaining
+            (List.range entryCount) 0,
+        captures.length + modes.length⟩
+    VEnvValueGraph funRel recSelfRel store Γ
+      (parameterSources.reverse ++ sourceEnv)
+      (captureArgs ++ parameterArgs).reverse
+      ((rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+        rootsFor .shared captureArgs) := by
+  dsimp only
+  let captures := (List.range entryCount).filter selected
+  let args := captureArgs ++ parameterArgs
+  let Γ : VEnv :=
+    ⟨Lower.parameterEntries captures.length modes parameterRemaining ++
+        selectedEntriesFrom selected captureRemaining
+          (List.range entryCount) 0,
+      captures.length + modes.length⟩
+  have hcaptureLength' : captureArgs.length = captures.length := by
+    simpa [captures] using hcaptureLength
+  have htotal : args.length = captures.length + modes.length := by
+    simp [args, hcaptureLength', hparameterLength]
+  have hrootShape : rootsFor .shared args =
+      rootsFor .shared captureArgs ++ rootsFor .shared parameterArgs := by
+    simp [args, rootsFor]
+  have hparameterWorlds : ∀ root,
+      root ∈ rootsForWorlds (modes.map worldOfUses) parameterArgs →
+      HasWorld store root.world root.value := by
+    intro root hroot
+    rw [hshared,
+      rootsForWorlds_replicate_eq_rootsFor .shared hparameterLength] at hroot
+    apply hown.roots_world root
+    rw [hrootShape]
+    exact List.mem_append_left rest (List.mem_append_right _ hroot)
+  have hparameter₀ := parameterEntries_entriesValueGraph
+    (funRel := funRel) (recSelfRel := recSelfRel) (store := store)
+    parameterRemaining captures.length modes
+    (sourceArgs := parameterSources) (args := parameterArgs)
+    (suffix := captureArgs.reverse) hparameterLength
+    (by simp [hcaptureLength']) hparameters hparameterWorlds
+  have hparameter : EntriesValueGraph funRel recSelfRel store Γ
+      args.reverse
+      (Lower.parameterEntries captures.length modes parameterRemaining)
+      parameterSources.reverse
+      (rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse := by
+    have htransport := hparameter₀.of_depth_eq (Δ := Γ) (by simp [Γ])
+    have henv : args.reverse =
+        parameterArgs.reverse ++ captureArgs.reverse := by
+      simp [args, List.reverse_append]
+    simpa [henv] using htransport
+  have hall : ValuesAt sourceEnv (List.range entryCount) sourceEnv := by
+    rw [← hsourceLength]
+    exact ValuesAt.range_self sourceEnv
+  have hcaptureWorlds : ∀ value, value ∈ captureArgs →
+      HasWorld store .shared value := by
+    intro value hvalue
+    apply hown.roots_world ⟨.shared, value⟩
+    rw [hrootShape]
+    apply List.mem_append_left rest
+    exact List.mem_append_left _ (by simpa [rootsFor] using hvalue)
+  have hcaptureEntries : EntriesValueGraph funRel recSelfRel store Γ
+      args.reverse
+      (selectedEntriesFrom selected captureRemaining
+        (List.range entryCount) 0)
+      sourceEnv (rootsFor .shared captureArgs) := by
+    apply selectedEntriesFrom_entriesValueGraph selected captureRemaining
+      (sourceEnv := sourceEnv)
+    · exact hall
+    · exact hselected
+    · exact hcaptures
+    · dsimp [Γ]
+      exact Nat.add_pos_right captures.length hpositive
+    · simp [Γ, hcaptureLength']
+    · intro index hindex
+      have hindexArgs : index < args.length := by omega
+      have hindexTotal : index < captures.length + modes.length := by omega
+      have hreverse := getElem?_reverse_at_absolute
+        (values := args) htotal hindexTotal
+      have happend : args[index]? = captureArgs[index]? := by
+        exact List.getElem?_append_left
+          (by simpa [hcaptureLength'] using hindex)
+      simpa [Γ, VEnv.rel, htotal] using hreverse.trans happend
+    · exact hcaptureWorlds
+  refine ⟨?_, ?_⟩
+  · simpa [Γ, args, Nat.add_comm] using htotal
+  · simpa [Γ, args] using hparameter.append hcaptureEntries
+
+/-- A lifted function's mixed logical environment realizes its public
+capture-then-parameter calling convention. Captures occupy the first shared
+argument prefix; the canonical parameter telescope follows it, and released
+outer placeholders contribute no roots. -/
+theorem FnEntryRealizes.lifted
+    (entryCount : Nat) (modes : List Uses)
+    (parameterRemaining : Nat → Nat)
+    (selected : Nat → Bool) (captureRemaining : Nat → Nat)
+    (hpositive : 0 < modes.length)
+    (hshared : modes.map worldOfUses =
+      List.replicate modes.length .shared) :
+    let captures := (List.range entryCount).filter selected
+    FnEntryRealizes
+      ⟨Lower.parameterEntries captures.length modes parameterRemaining ++
+          selectedEntriesFrom selected captureRemaining
+            (List.range entryCount) 0,
+        captures.length + modes.length⟩
+      (List.replicate (captures.length + modes.length) .shared) := by
+  dsimp only
+  let captures := (List.range entryCount).filter selected
+  intro args hargs
+  have htotal : args.length = captures.length + modes.length := by
+    simpa [captures] using hargs
+  let captureArgs := args.take captures.length
+  let parameterArgs := args.drop captures.length
+  have hcapturesLe : captures.length ≤ args.length := by omega
+  have hcaptureLength : captureArgs.length = captures.length := by
+    simp [captureArgs, List.length_take, Nat.min_eq_left hcapturesLe]
+  have hparameterLength : parameterArgs.length = modes.length := by
+    simp [parameterArgs, List.length_drop, htotal]
+  have hsplit : captureArgs ++ parameterArgs = args := by
+    exact List.take_append_drop captures.length args
+  let Γ : VEnv :=
+    ⟨Lower.parameterEntries captures.length modes parameterRemaining ++
+        selectedEntriesFrom selected captureRemaining
+          (List.range entryCount) 0,
+      captures.length + modes.length⟩
+  have hparameter₀ := parameterEntries_entriesRealize parameterRemaining
+    captures.length modes (args := parameterArgs)
+      (suffix := captureArgs.reverse) hparameterLength (by simp [hcaptureLength])
+  have hparameter : EntriesRealize Γ args.reverse
+      (Lower.parameterEntries captures.length modes parameterRemaining)
+      (rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse := by
+    have htransport := hparameter₀.of_depth_eq (Δ := Γ) (by simp [Γ])
+    have henv : args.reverse = parameterArgs.reverse ++ captureArgs.reverse := by
+      rw [← hsplit, List.reverse_append]
+    simpa [henv] using htransport
+  have hcaptures : EntriesRealize Γ args.reverse
+      (selectedEntriesFrom selected captureRemaining
+        (List.range entryCount) 0)
+      (rootsFor .shared captureArgs) := by
+    apply selectedEntriesFrom_entriesRealize selected captureRemaining
+    · simpa [captures, hcaptureLength]
+    · dsimp [Γ]
+      omega
+    · simp [Γ, hcaptureLength]
+    · intro index hindex
+      have hindexArgs : index < args.length := by omega
+      have hindexTotal : index < captures.length + modes.length := by omega
+      have hreverse := getElem?_reverse_at_absolute
+        (values := args) htotal hindexTotal
+      have happend : args[index]? = captureArgs[index]? := by
+        rw [← hsplit]
+        exact List.getElem?_append_left
+          (by simpa [hcaptureLength] using hindex)
+      simpa [Γ, VEnv.rel, htotal] using hreverse.trans happend
+  refine ⟨(rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+      rootsFor .shared captureArgs, ?_, ?_⟩
+  · refine ⟨?_, hparameter.append hcaptures⟩
+    simpa [Γ] using htotal
+  · have hparameterRoots :
+        rootsForWorlds (modes.map worldOfUses) parameterArgs =
+          rootsFor .shared parameterArgs := by
+      rw [hshared]
+      exact rootsForWorlds_replicate_eq_rootsFor .shared hparameterLength
+    have htarget :
+        rootsForWorlds
+            (List.replicate (captures.length + modes.length) .shared) args =
+          rootsFor .shared captureArgs ++ rootsFor .shared parameterArgs := by
+      rw [rootsForWorlds_replicate_eq_rootsFor .shared htotal]
+      rw [← hsplit]
+      simp [rootsFor]
+    rw [hparameterRoots, htarget]
+    exact (List.reverse_perm _).append_right _ |>.trans List.perm_append_comm
+
+/-- Removing the leading lambda telescope shifts every older free-variable
+index by exactly the telescope arity. -/
+theorem countUses_eq_stripLams_shift (expr : IxIR0.Expr) (index : Nat) :
+    countUses index expr =
+      countUses (lamArity expr + index) (stripLams expr) := by
+  induction expr generalizing index with
+  | lam uses body ih =>
+    simp only [countUses, lamArity, stripLams]
+    rw [ih]
+    have heq : lamArity body + (index + 1) =
+        lamArity body + 1 + index := by omega
+    rw [heq]
+  | var => simp only [lamArity, Nat.zero_add, stripLams]
+  | ref => simp only [lamArity, Nat.zero_add, stripLams]
+  | app => simp only [lamArity, Nat.zero_add, stripLams]
+  | letE => simp only [lamArity, Nat.zero_add, stripLams]
+  | proj => simp only [lamArity, Nat.zero_add, stripLams]
+  | lit => simp only [lamArity, Nat.zero_add, stripLams]
+  | erased => simp only [lamArity, Nat.zero_add, stripLams]
+
+private theorem uses_eq_many_of_beq {uses : Uses}
+    (h : (uses == .many) = true) : uses = .many := by
+  cases uses with
+  | erased => exact Bool.noConfusion h
+  | linear => exact Bool.noConfusion h
+  | affine => exact Bool.noConfusion h
+  | many => rfl
+
+private theorem all_many_eq_replicate :
+    ∀ modes : List Uses,
+      modes.all (fun uses => uses == .many) = true →
+      modes = List.replicate modes.length .many := by
+  intro modes
+  induction modes with
+  | nil => simp
+  | cons mode modes ih =>
+    intro hall
+    simp only [List.all_cons, Bool.and_eq_true] at hall
+    have hmode : mode = .many := uses_eq_many_of_beq hall.1
+    subst mode
+    simp only [List.length_cons, List.replicate_succ, List.cons.injEq, true_and]
+    exact ih hall.2
+
+/-- The executable `papSafe` check pins the entire lifted parameter telescope
+to `many`, not merely its mapped ownership worlds. -/
+theorem papSafe_lamUses_eq_replicate {expr : IxIR0.Expr}
+    (hsafe : papSafe expr = true) :
+    lamUses expr = List.replicate (lamArity expr) .many := by
+  have hsafe' : (lamUses expr).all (fun uses => uses == .many) = true := by
+    simpa [papSafe] using hsafe
+  have hall := all_many_eq_replicate (lamUses expr) hsafe'
+  simpa using hall
+
+/-- Append the selected older-entry range to a tracked parameter prefix. The
+selection bit is required to be exactly the canonical nonzero-count bit; this
+turns both live captures and released placeholders into ordinary tracked
+entries for the body-consumption theorem. -/
+theorem EntriesTrackCounts.frameSelectedRange
+    {Γ : VEnv} {baseCount : Nat} {counts : Nat → Nat}
+    (htracks : EntriesTrackCounts Γ baseCount counts)
+    (hlength : Γ.entries.length = baseCount)
+    (selected : Nat → Bool) (remaining : Nat → Nat) :
+    ∀ (start count next : Nat),
+      (∀ offset, offset < count →
+        selected (start + offset) = (counts (baseCount + offset) != 0)) →
+      (∀ offset, offset < count →
+        remaining (start + offset) = counts (baseCount + offset)) →
+      EntriesTrackCounts
+        (frameVEnvEntries Γ
+          (selectedEntriesFrom selected remaining
+            (List.range' start count) next))
+        (baseCount + count) counts := by
+  intro start count
+  induction count generalizing Γ baseCount start with
+  | zero =>
+    intro next _ _
+    simpa [selectedEntriesFrom, frameVEnvEntries] using htracks
+  | succ count ih =>
+    intro next hselected hremaining
+    have hselectedHead := hselected 0 (by omega)
+    have hremainingHead := hremaining 0 (by omega)
+    cases hhead : selected start with
+    | false =>
+      have hzero : counts baseCount = 0 := by
+        simp [hhead] at hselectedHead
+        omega
+      have hremainingHead' : remaining start = 0 := by
+        simpa [hzero] using hremainingHead
+      let head : VEntry := .slot 0 0 .many false
+      let Γhead := frameVEnvEntries Γ [head]
+      have hheadTracks : EntriesTrackCounts Γhead (baseCount + 1) counts := by
+        have hcanonical := EntriesTrackCounts.frameCanonicalSlot
+          (abs := 0) (uses := .many) htracks hlength
+        simpa [Γhead, head, hzero] using hcanonical
+      have hheadLength : Γhead.entries.length = baseCount + 1 := by
+        simp [Γhead, head, frameVEnvEntries, hlength]
+      have htail := ih (Γ := Γhead) (baseCount := baseCount + 1)
+        hheadTracks hheadLength (start := start + 1) next
+        (fun offset hoffset => by
+          have h := hselected (offset + 1) (by omega)
+          simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using h)
+        (fun offset hoffset => by
+          have h := hremaining (offset + 1) (by omega)
+          simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using h)
+      simpa [List.range'_succ, selectedEntriesFrom, hhead, Γhead, head,
+        frameVEnvEntries, List.append_assoc, Nat.add_assoc, Nat.add_comm,
+        Nat.add_left_comm] using htail
+    | true =>
+      have hnonzero : counts baseCount ≠ 0 := by
+        simpa [hhead] using hselectedHead
+      have hremainingHead' : remaining start = counts baseCount := by
+        simpa using hremainingHead
+      let head : VEntry := .slot next (remaining start) .many true
+      let Γhead := frameVEnvEntries Γ [head]
+      have hheadTracks : EntriesTrackCounts Γhead (baseCount + 1) counts := by
+        have hcanonical := EntriesTrackCounts.frameCanonicalSlot
+          (abs := next) (uses := .many) htracks hlength
+        have hheld : (counts baseCount != 0) = true := by simp [hnonzero]
+        rw [hheld] at hcanonical
+        simpa [Γhead, head, hremainingHead'] using hcanonical
+      have hheadLength : Γhead.entries.length = baseCount + 1 := by
+        simp [Γhead, head, frameVEnvEntries, hlength]
+      have htail := ih (Γ := Γhead) (baseCount := baseCount + 1)
+        hheadTracks hheadLength (start := start + 1) (next + 1)
+        (fun offset hoffset => by
+          have h := hselected (offset + 1) (by omega)
+          simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using h)
+        (fun offset hoffset => by
+          have h := hremaining (offset + 1) (by omega)
+          simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using h)
+      simpa [List.range'_succ, selectedEntriesFrom, hhead, Γhead, head,
+        frameVEnvEntries, List.append_assoc, Nat.add_assoc, Nat.add_comm,
+        Nat.add_left_comm] using htail
+
+/-- Every selected-entry frame consists solely of ordinary slots. -/
+theorem selectedEntriesFrom_noRecSelf
+    (selected : Nat → Bool) (remaining : Nat → Nat) :
+    ∀ (indices : List Nat) (next depth : Nat),
+      NoRecSelf
+        ⟨selectedEntriesFrom selected remaining indices next, depth⟩ := by
+  intro indices next depth
+  exact selectedEntriesFrom_traverse selected remaining
+    (Result := fun _ _ entries => NoRecSelf ⟨entries, depth⟩)
+    (hnil := fun _ => NoRecSelf.empty)
+    (hfalse := by
+      intro index rest current tail hselected htail
+      exact htail.consSlot 0 0 .many false)
+    (htrue := by
+      intro index rest current tail hselected htail
+      exact htail.consSlot current (remaining index) .many true)
+    indices next
+
+/-- Concatenating two self-free logical entry blocks remains self-free. -/
+theorem NoRecSelf.appendEntries
+    {left right : List VEntry} {depth : Nat}
+    (hleft : NoRecSelf ⟨left, depth⟩)
+    (hright : NoRecSelf ⟨right, depth⟩) :
+    NoRecSelf ⟨left ++ right, depth⟩ := by
+  apply NoRecSelf.of_mem_not_recSelf
+  intro entry hmember arity heq
+  rw [List.mem_append] at hmember
+  cases hmember with
+  | inl hleftMember =>
+    obtain ⟨index, hget⟩ := List.mem_iff_getElem?.mp hleftMember
+    subst entry
+    exact hleft index arity hget
+  | inr hrightMember =>
+    obtain ⟨index, hget⟩ := List.mem_iff_getElem?.mp hrightMember
+    subst entry
+    exact hright index arity hget
+
+/-- A successfully lowered lifted body preserves the all-shared public
+capture-plus-parameter signature. This closes entry realization, generated
+parameter cleanup, exact consumption of both parameter and captured-variable
+entries, and the self-free body boundary in one declaration-level rule. -/
+theorem lowerFnBody_liftedEntries_preservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    (entryCount : Nat) (modes : List Uses) (body : IxIR0.Expr)
+    (selected : Nat → Bool)
+    {state finalState : LowSt} {code : Code}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hselected : ∀ index, index < entryCount →
+      selected index = (countUses (modes.length + index) body != 0))
+    (hpositive : 0 < modes.length)
+    (hshared : modes.map worldOfUses =
+      List.replicate modes.length .shared)
+    (hrun : (lowerFnBody src (fuel + 1)
+      (let captures := (List.range entryCount).filter selected
+       ⟨parameterEntries captures.length modes
+            (fun index => countUses index body) ++
+          selectedEntriesFrom selected
+            (fun index => countUses (modes.length + index) body)
+            (List.range entryCount) 0,
+        captures.length + modes.length⟩)
+      (let captures := (List.range entryCount).filter selected
+       parameterDrops captures.length modes
+          (fun index => countUses index body))
+      .shared body).run state = .ok code finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    let captures := (List.range entryCount).filter selected
+    FnOwnershipPreservesAt ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩
+      (List.replicate (captures.length + modes.length) .shared) limit := by
+  dsimp only
+  let captures := (List.range entryCount).filter selected
+  let parameterRemaining : Nat → Nat := fun index => countUses index body
+  let captureRemaining : Nat → Nat :=
+    fun index => countUses (modes.length + index) body
+  let outerEntries := selectedEntriesFrom selected captureRemaining
+    (List.range entryCount) 0
+  let input : VEnv :=
+    ⟨parameterEntries captures.length modes parameterRemaining ++ outerEntries,
+      captures.length + modes.length⟩
+  let drops := parameterDrops captures.length modes parameterRemaining
+  have hrun' :
+      (lowerFnBody src (fuel + 1) input drops .shared body).run state =
+        .ok code finalState := by
+    simpa [input, drops, outerEntries, parameterRemaining, captureRemaining,
+      captures] using hrun
+  have hno : NoRecSelf input := by
+    apply NoRecSelf.appendEntries
+    · exact parameterEntries_noRecSelf captures.length modes
+        parameterRemaining (captures.length + modes.length)
+    · simpa [outerEntries] using
+        selectedEntriesFrom_noRecSelf selected captureRemaining
+          (List.range entryCount) 0 (captures.length + modes.length)
+  obtain ⟨middle, releaseEmit, releaseState, output, emit, av,
+      hreleaseRun, hbodyRun, hcode, hbodySound⟩ :=
+    lowerFnBody_run_sound_below_noRecSelf
+      (cur :=
+        (⟨captures.length + modes.length, .shared, true, code⟩ : FnDef))
+      happly hdecls hrun' hrepresented hno
+  obtain ⟨parameterOutput, plannedEmit, hparameterPlan, hparameterTracks⟩ :=
+    parameterDrops_releasePlan_tracked_atDepth captures.length
+      (captures.length + modes.length) modes parameterRemaining
+      (by simpa [parameterRemaining] using hadmissible)
+  let plannedMiddle := frameVEnvEntries parameterOutput outerEntries
+  have hplan : ReleasePlan input drops plannedMiddle plannedEmit := by
+    have hframed := hparameterPlan.frameEntries outerEntries
+    simpa [input, drops, plannedMiddle, outerEntries, frameVEnvEntries]
+      using hframed
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  have hstate := heq.2
+  subst releaseState
+  have hparameterLength : parameterOutput.entries.length = modes.length := by
+    calc
+      parameterOutput.entries.length =
+          (parameterEntries captures.length modes parameterRemaining).length :=
+        hparameterPlan.entries_length
+      _ = modes.length := parameterEntries_length _ _ _
+  have htracks : EntriesTrackCounts plannedMiddle (modes.length + entryCount)
+      (fun index => countUses index body) := by
+    have hframed := hparameterTracks.frameSelectedRange hparameterLength
+      selected captureRemaining 0 entryCount 0
+      (fun offset hoffset => by
+        simpa [captureRemaining] using hselected offset hoffset)
+      (fun offset hoffset => by
+        simp [captureRemaining, parameterRemaining])
+    simpa [plannedMiddle, outerEntries, List.range_eq_range'] using hframed
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have hmiddleLength : plannedMiddle.entries.length =
+      modes.length + entryCount := by
+    calc
+      plannedMiddle.entries.length = input.entries.length := hplan.entries_length
+      _ = modes.length + entryCount := by
+        simp [input, outerEntries, parameterRemaining, captureRemaining]
+  have hreleased : EntriesReleased output.entries :=
+    hconsume.entriesReleased htracks (Eq.trans hcount hmiddleLength)
+  have hfull : LowerResultSoundBelow ctx
+      (⟨captures.length + modes.length, .shared, true, code⟩ : FnDef)
+      limit input output .shared (plannedEmit ∘ emit) av :=
+    hbodySound.afterRelease hplan.soundBelow
+  apply hfull.fnOwnershipPreservesAt
+    (FnEntryRealizes.lifted entryCount modes parameterRemaining selected
+      captureRemaining hpositive hshared)
+  · simp [captures]
+  · exact hreleased
+  · exact hcode
+
+/-- Semantic execution of one generated lifted body at an exact target
+fuel.  The stored capture prefix and the remaining lambda parameters are
+separated explicitly: selected outer values populate the framed source
+environment, while the complete supplied-parameter vector is reversed in
+front of it, exactly as in the source evaluator. -/
+theorem lowerFnBody_liftedEntries_run_value_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit compilerFuel targetFuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (entryCount : Nat) (modes : List Uses) (body : IxIR0.Expr)
+    (selected : Nat → Bool)
+    {state finalState : LowSt} {code : Code}
+    (hadmissible : ParameterDropsAdmissible modes
+      (fun index => countUses index body))
+    (hselectDef : ∀ index, index < entryCount →
+      selected index = (countUses (modes.length + index) body != 0))
+    (hpositive : 0 < modes.length)
+    (hshared : modes.map worldOfUses =
+      List.replicate modes.length .shared)
+    (hrun : (lowerFnBody src (compilerFuel + 1)
+      (let captures := (List.range entryCount).filter selected
+       ⟨parameterEntries captures.length modes
+            (fun index => countUses index body) ++
+          selectedEntriesFrom selected
+            (fun index => countUses (modes.length + index) body)
+            (List.range entryCount) 0,
+        captures.length + modes.length⟩)
+      (let captures := (List.range entryCount).filter selected
+       parameterDrops captures.length modes
+          (fun index => countUses index body))
+      .shared body).run state = .ok code finalState)
+    (hextends : ExtraExtends finalState ambient)
+    {sourceEnv selectedSources parameterSources : List IxIR0.Value}
+    {sourceResult : IxIR0.Value}
+    {store store' : Store} {captureArgs parameterArgs : List RVal}
+    {value : RVal} {sourceRest : List (Owned × IxIR0.Value)}
+    {rest : List Root}
+    (hsourceLength : sourceEnv.length = entryCount)
+    (hselectedValues : ValuesAt sourceEnv
+      ((List.range entryCount).filter selected) selectedSources)
+    (hcaptureLength : captureArgs.length =
+      ((List.range entryCount).filter selected).length)
+    (hparameterLength : parameterArgs.length = modes.length)
+    (hcaptureGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store selectedSources
+      captureArgs)
+    (hparameterGraph : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store parameterSources
+      parameterArgs)
+    (hsource : ∃ sourceFuel, IxIR0.eval sourceCtx sourceFuel
+      (parameterSources.reverse ++ sourceEnv) body = .ok sourceResult)
+    (hframe : Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (captureArgs ++ parameterArgs) ++ rest))
+    (htarget : targetFuel ≤ limit)
+    (hcodeRun : runCode ctx targetFuel
+      ⟨((List.range entryCount).filter selected).length + modes.length,
+        .shared, true, code⟩ store (captureArgs ++ parameterArgs).reverse code =
+      .ok (store', value)) :
+    Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceResult value ∧
+      Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceRest rest := by
+  let captures := (List.range entryCount).filter selected
+  let parameterRemaining : Nat → Nat := fun index => countUses index body
+  let captureRemaining : Nat → Nat :=
+    fun index => countUses (modes.length + index) body
+  let outerEntries := selectedEntriesFrom selected captureRemaining
+    (List.range entryCount) 0
+  let input : VEnv :=
+    ⟨parameterEntries captures.length modes parameterRemaining ++ outerEntries,
+      captures.length + modes.length⟩
+  let drops := parameterDrops captures.length modes parameterRemaining
+  have hrun' :
+      (lowerFnBody src (compilerFuel + 1) input drops .shared body).run state =
+        .ok code finalState := by
+    simpa [input, drops, outerEntries, parameterRemaining, captureRemaining,
+      captures] using hrun
+  simp only [lowerFnBody] at hrun'
+  obtain ⟨releaseResult, releaseState, hreleaseRun, hafterRelease⟩ :=
+    trackedBindRun_ok_inv hrun'
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbodyRun, hafterBody⟩ :=
+    trackedBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, av⟩
+  have hpure :
+      (releaseEmit ∘ emit) (.ret (av.toAtom output)) = code ∧
+        bodyState = finalState := by
+    simpa using hafterBody
+  obtain ⟨hcode, hbodyState⟩ := hpure
+  subst bodyState
+  have hinputNo : NoRecSelf input := by
+    apply NoRecSelf.appendEntries
+    · exact parameterEntries_noRecSelf captures.length modes
+        parameterRemaining (captures.length + modes.length)
+    · simpa [outerEntries] using
+        selectedEntriesFrom_noRecSelf selected captureRemaining
+          (List.range entryCount) 0 (captures.length + modes.length)
+  have hmiddleNo : NoRecSelf middle :=
+    releaseSlots_noRecSelf input hreleaseRun hinputNo
+  obtain ⟨parameterOutput, plannedEmit, hparameterPlan,
+      hparameterTracks⟩ :=
+    parameterDrops_releasePlan_tracked_atDepth captures.length
+      (captures.length + modes.length) modes parameterRemaining
+      (by simpa [parameterRemaining] using hadmissible)
+  let plannedMiddle := frameVEnvEntries parameterOutput outerEntries
+  have hplan : ReleasePlan input drops plannedMiddle plannedEmit := by
+    have hframed := hparameterPlan.frameEntries outerEntries
+    simpa [input, drops, plannedMiddle, outerEntries, frameVEnvEntries]
+      using hframed
+  have hplanRun : (releaseSlots input drops).run state =
+      .ok (plannedMiddle, plannedEmit) state := hplan.run state
+  have heq :
+      (plannedMiddle, plannedEmit) = (middle, releaseEmit) ∧
+        state = releaseState := by
+    simpa using hplanRun.symm.trans hreleaseRun
+  have hmiddle : plannedMiddle = middle := congrArg Prod.fst heq.1
+  have hemit : plannedEmit = releaseEmit := congrArg Prod.snd heq.1
+  subst middle
+  subst releaseEmit
+  cases heq.2
+  have hparameterOutputLength : parameterOutput.entries.length =
+      modes.length := by
+    calc
+      parameterOutput.entries.length =
+          (parameterEntries captures.length modes parameterRemaining).length :=
+        hparameterPlan.entries_length
+      _ = modes.length := parameterEntries_length _ _ _
+  have htracks : EntriesTrackCounts plannedMiddle
+      (modes.length + entryCount) (fun index => countUses index body) := by
+    have hframed := hparameterTracks.frameSelectedRange
+      hparameterOutputLength selected captureRemaining 0 entryCount 0
+      (fun offset hoffset => by
+        simpa [captureRemaining] using hselectDef offset hoffset)
+      (fun offset hoffset => by
+        simp [captureRemaining, parameterRemaining])
+    simpa [plannedMiddle, outerEntries, List.range_eq_range'] using hframed
+  have hconsume := lowerE_consumesEntries hbodyRun
+  have hcount := lowerE_preservesEntryCount hbodyRun
+  have hmiddleLength : plannedMiddle.entries.length =
+      modes.length + entryCount := by
+    calc
+      plannedMiddle.entries.length = input.entries.length :=
+        hplan.entries_length
+      _ = modes.length + entryCount := by
+        simp [input, outerEntries, parameterRemaining, captureRemaining]
+  have hreleased : EntriesReleased output.entries :=
+    hconsume.entriesReleased htracks (Eq.trans hcount hmiddleLength)
+  obtain ⟨sourceFuel, hsourceEval⟩ := hsource
+  have hbodySound : LowerResultValueSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩
+        limit plannedMiddle
+      output (parameterSources.reverse ++ sourceEnv)
+      (parameterSources.reverse ++ sourceEnv) sourceResult .shared emit av :=
+    lowerE_run_value_sound_within_noRecSelf_below
+      (recSelfRel := fun _ _ => False)
+      (cur :=
+        (⟨captures.length + modes.length, .shared, true, code⟩ : FnDef))
+      henv hrepresented hcontracts hvalues hsourceEval hbodyRun hextends
+      hmiddleNo
+  have hfull : LowerResultValueSoundBelow
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) ctx
+      ⟨captures.length + modes.length, .shared, true, code⟩
+        limit input output
+      (parameterSources.reverse ++ sourceEnv)
+      (parameterSources.reverse ++ sourceEnv) sourceResult .shared
+      (plannedEmit ∘ emit) av :=
+    hbodySound.afterRelease
+      (hplan.valueSoundBelow (parameterSources.reverse ++ sourceEnv))
+  have hentryGraph : VEnvValueGraph
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) store
+      input (parameterSources.reverse ++ sourceEnv)
+      (captureArgs ++ parameterArgs).reverse
+      ((rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+        rootsFor .shared captureArgs) := by
+    simpa [input, outerEntries, parameterRemaining, captureRemaining,
+      captures] using
+      VEnvValueGraph.lifted (recSelfRel := fun _ _ => False)
+        entryCount modes parameterRemaining selected captureRemaining
+        hsourceLength hselectedValues hcaptureLength hparameterLength
+        hcaptureGraph hparameterGraph hpositive hshared hown
+  have hparameterRoots :
+      rootsForWorlds (modes.map worldOfUses) parameterArgs =
+        rootsFor .shared parameterArgs := by
+    rw [hshared]
+    exact rootsForWorlds_replicate_eq_rootsFor .shared hparameterLength
+  have hpre : GraphOwnsVEnv
+      (CompilerFunctionRel sourceCtx src ambient) (fun _ _ => False) input
+      (parameterSources.reverse ++ sourceEnv) sourceRest rest store
+      (captureArgs ++ parameterArgs).reverse := by
+    refine ⟨(rootsForWorlds
+        (modes.map worldOfUses) parameterArgs).reverse ++
+          rootsFor .shared captureArgs, hentryGraph, hframe, ?_⟩
+    have hrootPerm :
+        (rootsFor .shared (captureArgs ++ parameterArgs) ++ rest).Perm
+          (((rootsForWorlds (modes.map worldOfUses) parameterArgs).reverse ++
+              rootsFor .shared captureArgs) ++ rest) := by
+      rw [hparameterRoots]
+      simp only [rootsFor, List.map_append]
+      exact (List.perm_append_comm.trans
+        ((List.reverse_perm
+          (parameterArgs.map fun value => (⟨.shared, value⟩ : Root))).symm
+            |>.append_right (captureArgs.map fun value =>
+              (⟨.shared, value⟩ : Root)))).append_right rest
+    exact hown.perm hrootPerm
+  have hcodeRun' : runCode ctx targetFuel
+      ⟨captures.length + modes.length, .shared, true, code⟩ store
+      (captureArgs ++ parameterArgs).reverse
+      ((plannedEmit ∘ emit) (.ret (av.toAtom output))) =
+        .ok (store', value) := by
+    rw [hcode]
+    simpa [captures] using hcodeRun
+  exact hfull.closeGraph hreleased sourceRest rest htarget hpre hcodeRun'
+
+/-- A compiler-provenanced lifted pap computes its residual source closure
+when the stored prefix plus the newly supplied arguments saturate the
+generated declaration.  This is the generated-function branch needed by
+the semantic `applyGo` proof; unlike `FnValuePreservesAt`, selected outer
+captures are target calling arguments but are not source applications. -/
+theorem invoke_lifted_value_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    {sourceFunction sourceResult : IxIR0.Value}
+    {address : Ixon.Address} {arity : Nat}
+    {captures sourceArgs : List IxIR0.Value}
+    {store store' : Store} {got args : List RVal} {value : RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hlifted : CompilerLiftedFunctionRel src ambient sourceFunction address
+      arity captures)
+    (hgot : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store captures got)
+    (hargs : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceArgs args)
+    (happlies : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult)
+    (hframe : Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (got ++ args) ++ rest))
+    (hfuel : fuel ≤ limit)
+    (hinvoke : invoke ctx fuel address (got ++ args) store =
+      .ok (store', value)) :
+    Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceResult value ∧
+      Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceRest rest := by
+  obtain ⟨sourceEnv, expr, selectedSources, suppliedSources, hliftCode,
+      hselectedValues, hcaptures, harity, hprefix⟩ := hlifted
+  subst captures
+  subst arity
+  obtain ⟨bodyCompilerFuel, bodyInitial, bodyFinal, code, hsafe,
+      hbodyRun, hbodyExtends, hmember⟩ := hliftCode
+  have hselectedLength := hselectedValues.length
+  rw [← hselectedLength] at hmember
+  have hdecl : ctx.decls address = some (.fn
+      ⟨selectedSources.length + lamArity expr, .shared, true, code⟩) :=
+    hrepresented.decl hmember
+  have hmodes := papSafe_lamUses_eq_replicate hsafe
+  have hadmissible : ParameterDropsAdmissible (lamUses expr)
+      (fun index => countUses index (stripLams expr)) := by
+    rw [hmodes]
+    exact parameterDropsAdmissible_replicate_many _ _
+  have hselectDef : ∀ index, index < sourceEnv.length →
+      decide (0 < countUses index expr) =
+        (countUses ((lamUses expr).length + index) (stripLams expr) != 0) := by
+    intro index _
+    rw [lamUses_length]
+    rw [← countUses_eq_stripLams_shift expr index]
+    cases countUses index expr <;> rfl
+  have hshared : (lamUses expr).map worldOfUses =
+      List.replicate (lamUses expr).length .shared := by
+    rw [hmodes]
+    simp [worldOfUses]
+  have hpositive : 0 < (lamUses expr).length := by
+    have hunder := hprefix.length_lt_lamArity
+    rw [lamUses_length]
+    omega
+  cases bodyCompilerFuel with
+  | zero =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [lowerFnBody] using hbodyRun)).elim
+  | succ compilerFuel =>
+    let selectedArgs := got.take selectedSources.length
+    let suppliedArgs := got.drop selectedSources.length
+    have hgotSplit : selectedArgs ++ suppliedArgs = got := by
+      exact List.take_append_drop selectedSources.length got
+    have hselectedGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store selectedSources
+        selectedArgs := by
+      simpa [selectedArgs] using hgot.take selectedSources.length
+    have hsuppliedGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store suppliedSources
+        suppliedArgs := by
+      simpa [suppliedArgs] using hgot.drop selectedSources.length
+    have hparameterGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store
+        (suppliedSources ++ sourceArgs) (suppliedArgs ++ args) :=
+      hsuppliedGraph.append hargs
+    have hselectedArgsLength : selectedArgs.length =
+        (liftCaptureIndices sourceEnv.length expr).length := by
+      calc
+        selectedArgs.length = selectedSources.length := by
+          simpa [selectedArgs] using hselectedGraph.length.symm
+        _ = (liftCaptureIndices sourceEnv.length expr).length :=
+          hselectedValues.length
+    have htotalSplit : selectedArgs ++ (suppliedArgs ++ args) =
+        got ++ args := by
+      rw [← List.append_assoc, hgotSplit]
+    have hownSplit : RootOwnership store
+        (rootsFor .shared (selectedArgs ++ (suppliedArgs ++ args)) ++
+          rest) := by
+      rw [htotalSplit]
+      exact hown
+    have hbodyRun' :
+        (lowerFnBody src (compilerFuel + 1)
+          (liftedBodyVEnv sourceEnv.length expr)
+          (liftedBodyDrops sourceEnv.length expr) .shared
+          (stripLams expr)).run bodyInitial = .ok code bodyFinal := by
+      simpa using hbodyRun
+    cases fuel with
+    | zero => simp [invoke] at hinvoke
+    | succ innerFuel =>
+      simp only [invoke, hdecl] at hinvoke
+      split at hinvoke
+      · contradiction
+      next hlength =>
+        have htotalLength : (got ++ args).length =
+            selectedSources.length + lamArity expr := by
+          simpa using hlength
+        have hparameterLength : (suppliedArgs ++ args).length =
+            (lamUses expr).length := by
+          have hgotLength : got.length =
+              selectedSources.length + suppliedSources.length := by
+            simpa using hgot.length.symm
+          have hsuppliedLength : suppliedArgs.length =
+              suppliedSources.length := hsuppliedGraph.length.symm
+          simp only [List.length_append] at htotalLength ⊢
+          rw [lamUses_length]
+          omega
+        have hlambdaLength : (suppliedSources ++ sourceArgs).length =
+            lamArity expr := by
+          calc
+            (suppliedSources ++ sourceArgs).length =
+                (suppliedArgs ++ args).length := hparameterGraph.length
+            _ = (lamUses expr).length := hparameterLength
+            _ = lamArity expr := lamUses_length expr
+        obtain ⟨sourceFuel, hsourceEval⟩ :=
+          hprefix.saturate hlambdaLength happlies
+        cases hcodeEval : runCode ctx innerFuel
+            ⟨selectedSources.length + lamArity expr, .shared, true, code⟩
+            store
+            (got ++ args).reverse code with
+        | error error =>
+            rw [hcodeEval] at hinvoke
+            change (.error error : Except Err (Store × RVal)) =
+              .ok (store', value) at hinvoke
+            contradiction
+        | ok out =>
+            rw [hcodeEval] at hinvoke
+            change checkResultWorld .shared out = .ok (store', value) at hinvoke
+            obtain ⟨hpair, _⟩ := checkResultWorld_ok hinvoke
+            subst out
+            have hcodeEval' : runCode ctx innerFuel
+                ⟨(liftCaptureIndices sourceEnv.length expr).length +
+                    (lamUses expr).length,
+                  .shared, true, code⟩ store
+                (selectedArgs ++ (suppliedArgs ++ args)).reverse code =
+                .ok (store', value) := by
+              rw [htotalSplit, ← hselectedLength, lamUses_length]
+              exact hcodeEval
+            exact lowerFnBody_liftedEntries_run_value_within_below
+              (compilerFuel := compilerFuel) (targetFuel := innerFuel)
+              henv hrepresented hcontracts hvalues sourceEnv.length
+              (lamUses expr) (stripLams expr)
+              (fun index => countUses index expr > 0)
+              hadmissible hselectDef hpositive hshared
+              (by simpa [liftedBodyVEnv, liftedBodyDrops,
+                liftCaptureIndices] using hbodyRun')
+              hbodyExtends (sourceEnv := sourceEnv)
+              (selectedSources := selectedSources)
+              (parameterSources := suppliedSources ++ sourceArgs)
+              (captureArgs := selectedArgs)
+              (parameterArgs := suppliedArgs ++ args)
+              (sourceResult := sourceResult) rfl
+              (by simpa [liftCaptureIndices] using hselectedValues)
+              (by simpa [liftCaptureIndices] using hselectedArgsLength)
+              hparameterLength hselectedGraph hparameterGraph
+              ⟨sourceFuel, hsourceEval⟩ hframe hownSplit (by omega)
+              hcodeEval'
+
+/-- Semantic companion of `applyGo_preparePap_owned`.  Retaining the stored
+pap values is a graph extension; consuming the old pap is a restriction, and
+the exact post-state ownership roots keep every stored argument, new
+argument, and caller-frame graph live across both steps. -/
+theorem applyGo_preparePap_valueGraphs
+    {funRel : Sim.FunctionRel} {ctx : Ctx} {fuel : Nat}
+    {store dupStore readyStore : Store} {loc rc : Nat}
+    {address : Ixon.Address} {arity : Nat} {got : Array RVal}
+    {args : List RVal} {captures sourceArgs : List IxIR0.Value}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hget : store.get? loc = some
+      ⟨.shared, rc, .papN address arity got⟩)
+    (hcaptures : Sim.ValuesGraph funRel store captures got.toList)
+    (hargs : Sim.ValuesGraph funRel store sourceArgs args)
+    (hframe : Sim.RootsGraph funRel store sourceRest rest)
+    (hown : RootOwnership store
+      (⟨.shared, .loc loc⟩ :: rootsFor .shared args ++ rest))
+    (hdup : dupVals store got.toList = .ok dupStore)
+    (hdrop : dropVal ctx fuel dupStore (.loc loc) = .ok readyStore) :
+    Sim.ValuesGraph funRel readyStore captures got.toList ∧
+      Sim.ValuesGraph funRel readyStore sourceArgs args ∧
+      Sim.RootsGraph funRel readyStore sourceRest rest ∧
+      RootOwnership readyStore
+        (rootsFor .shared (got.toList ++ args) ++ rest) := by
+  have hready : RootOwnership readyStore
+      (rootsFor .shared (got.toList ++ args) ++ rest) :=
+    applyGo_preparePap_owned hget hown hdup hdrop
+  have hextends : StoreGraphExtends store dupStore := dupVals_extends hdup
+  have hrestricts : StoreGraphRestricts dupStore readyStore :=
+    dropVal_restricts hdrop
+  have hcombined : Sim.ValuesGraph funRel dupStore
+      (captures ++ sourceArgs) (got.toList ++ args) :=
+    (hcaptures.append hargs).monoStore hextends
+  have hcombinedReady : Sim.ValuesGraph funRel readyStore
+      (captures ++ sourceArgs) (got.toList ++ args) := by
+    apply hcombined.ofRestrictsIn hrestricts hready
+    intro runtime hmember
+    exact ⟨.shared, List.mem_append_left rest (by
+      simpa [rootsFor] using hmember)⟩
+  obtain ⟨hcapturesReady, hargsReady⟩ :=
+    hcombinedReady.splitAppend hcaptures.length
+  have hframeReady : Sim.RootsGraph funRel readyStore sourceRest rest := by
+    apply hframe.monoStore hextends |>.ofRestrictsIn hrestricts hready
+    intro root hmember
+    exact List.mem_append_right _ hmember
+  exact ⟨hcapturesReady, hargsReady, hframeReady, hready⟩
+
+/-- Ownership half of lifted-function invocation, recovered directly from
+the same exact generated-body provenance used by
+`invoke_lifted_value_below`. -/
+theorem invoke_lifted_owned_below
+    {src : IxIR0.Env} {ambient : LowSt} {ctx : Ctx} {fuel : Nat}
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    {sourceFunction : IxIR0.Value} {address : Ixon.Address} {arity : Nat}
+    {captures : List IxIR0.Value} {runtimeArgs : List RVal}
+    {store store' : Store} {value : RVal} {rest : List Root}
+    (hlifted : CompilerLiftedFunctionRel src ambient sourceFunction address
+      arity captures)
+    (hown : RootOwnership store
+      (rootsFor .shared runtimeArgs ++ rest))
+    (hinvoke : invoke ctx fuel address runtimeArgs store =
+      .ok (store', value)) :
+    RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨sourceEnv, expr, selectedSources, suppliedSources, hliftCode,
+      hselectedValues, _, _, hprefix⟩ := hlifted
+  obtain ⟨bodyCompilerFuel, bodyInitial, bodyFinal, code, hsafe,
+      hbodyRun, hbodyExtends, hmember⟩ := hliftCode
+  have hdecl : ctx.decls address = some (.fn
+      ⟨(liftCaptureIndices sourceEnv.length expr).length + lamArity expr,
+        .shared, true, code⟩) := hrepresented.decl hmember
+  have hmodes := papSafe_lamUses_eq_replicate hsafe
+  have hadmissible : ParameterDropsAdmissible (lamUses expr)
+      (fun index => countUses index (stripLams expr)) := by
+    rw [hmodes]
+    exact parameterDropsAdmissible_replicate_many _ _
+  have hselectDef : ∀ index, index < sourceEnv.length →
+      decide (0 < countUses index expr) =
+        (countUses ((lamUses expr).length + index) (stripLams expr) != 0) := by
+    intro index _
+    rw [lamUses_length]
+    rw [← countUses_eq_stripLams_shift expr index]
+    cases countUses index expr <;> rfl
+  have hshared : (lamUses expr).map worldOfUses =
+      List.replicate (lamUses expr).length .shared := by
+    rw [hmodes]
+    simp [worldOfUses]
+  have hpositive : 0 < (lamUses expr).length := by
+    have hunder := hprefix.length_lt_lamArity
+    rw [lamUses_length]
+    omega
+  cases bodyCompilerFuel with
+  | zero =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [lowerFnBody] using hbodyRun)).elim
+  | succ compilerFuel =>
+    have hbodyRun' :
+        (lowerFnBody src (compilerFuel + 1)
+          (liftedBodyVEnv sourceEnv.length expr)
+          (liftedBodyDrops sourceEnv.length expr) .shared
+          (stripLams expr)).run bodyInitial = .ok code bodyFinal := by
+      simpa using hbodyRun
+    have hbodyRepresented : ExtraRepresented ctx bodyFinal :=
+      hrepresented.of_extends hbodyExtends
+    have hownership : FnOwnershipContractBelow ctx
+        ⟨(liftCaptureIndices sourceEnv.length expr).length + lamArity expr,
+          .shared, true, code⟩
+        (List.replicate
+          ((liftCaptureIndices sourceEnv.length expr).length +
+            lamArity expr) .shared) fuel := by
+      constructor
+      · simp
+      · intro smaller hsmaller
+        have hpreserves : FnOwnershipPreservesAt ctx
+            ⟨(liftCaptureIndices sourceEnv.length expr).length +
+                (lamUses expr).length,
+              .shared, true, code⟩
+            (List.replicate
+              ((liftCaptureIndices sourceEnv.length expr).length +
+                (lamUses expr).length) .shared) smaller :=
+          lowerFnBody_liftedEntries_preservesAt
+          (limit := smaller) (fuel := compilerFuel)
+          (state := bodyInitial) (finalState := bodyFinal) (code := code)
+          (hcontracts.apply.below smaller)
+          (hcontracts.decls.below smaller) sourceEnv.length
+          (lamUses expr) (stripLams expr)
+          (fun index => countUses index expr > 0)
+          hadmissible hselectDef hpositive hshared
+          (by simpa [liftedBodyVEnv, liftedBodyDrops,
+            liftCaptureIndices] using hbodyRun') hbodyRepresented
+        intro callStore callStore' callArgs callValue callRest hlength
+          hcallOwn hcallRun
+        exact hpreserves
+          (by simpa [lamUses_length] using hlength)
+          (by simpa [lamUses_length] using hcallOwn)
+          (by simpa [lamUses_length] using hcallRun)
+    have hargsLength : runtimeArgs.length =
+        (liftCaptureIndices sourceEnv.length expr).length +
+          lamArity expr := by
+      simpa [declArity] using invoke_success_length hdecl hinvoke
+    have hroots : rootsForWorlds
+        (List.replicate
+          ((liftCaptureIndices sourceEnv.length expr).length +
+            lamArity expr) .shared) runtimeArgs =
+        rootsFor .shared runtimeArgs :=
+      rootsForWorlds_replicate_eq_rootsFor .shared hargsLength
+    have hown' : RootOwnership store
+        (rootsForWorlds
+          (List.replicate
+            ((liftCaptureIndices sourceEnv.length expr).length +
+              lamArity expr) .shared) runtimeArgs ++ rest) := by
+      rwa [hroots]
+    exact invoke_fn_owned_below hdecl hownership hown' hinvoke
+
+/-- Saturating invocation for every origin admitted by
+`CompilerFunctionRel`.  Besides source-result and caller-frame graphs, the
+paired ownership conclusion is retained for an over-application tail. -/
+theorem invoke_compilerFunction_value_owned_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit fuel : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit)
+    (hwrapperValue : ∀ (memo : WrapperMemo)
+        (baseFunction : IxIR0.Value),
+      sourceCtx.env memo.source = some (.ctor memo.tag memo.arity) →
+      SourceRefValue sourceCtx memo.source baseFunction →
+      FnValueContract (CompilerFunctionRel sourceCtx src ambient)
+        sourceCtx ctx
+        ⟨memo.arity, .shared, true,
+          .letOp (.alloc .shared (ctorIdOf memo.source memo.tag)
+            (descendingVars memo.arity).toArray) (.ret (.var 0))⟩
+        (List.replicate memo.arity .shared) baseFunction)
+    (hwrapperOwnership : ∀ memo : WrapperMemo,
+      FnOwnershipContract ctx
+        ⟨memo.arity, .shared, true,
+          .letOp (.alloc .shared (ctorIdOf memo.source memo.tag)
+            (descendingVars memo.arity).toArray) (.ret (.var 0))⟩
+        (List.replicate memo.arity .shared))
+    {sourceFunction sourceResult : IxIR0.Value}
+    {address : Ixon.Address} {arity : Nat}
+    {captures sourceArgs : List IxIR0.Value}
+    {store store' : Store} {got args : List RVal} {value : RVal}
+    {sourceRest : List (Owned × IxIR0.Value)} {rest : List Root}
+    (hrel : CompilerFunctionRel sourceCtx src ambient sourceFunction address
+      arity captures)
+    (hcaptures : Sim.ValuesGraph
+      (CompilerFunctionRel sourceCtx src ambient) store captures got)
+    (hargs : Sim.ValuesGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceArgs args)
+    (happlies : SourceApplies sourceCtx sourceFunction sourceArgs
+      sourceResult)
+    (hframe : Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient)
+      store sourceRest rest)
+    (hown : RootOwnership store
+      (rootsFor .shared (got ++ args) ++ rest))
+    (hfuel : fuel ≤ limit)
+    (hinvoke : invoke ctx fuel address (got ++ args) store =
+      .ok (store', value)) :
+    Sim.ValueGraph (CompilerFunctionRel sourceCtx src ambient) store'
+        sourceResult value ∧
+      Sim.RootsGraph (CompilerFunctionRel sourceCtx src ambient) store'
+          sourceRest rest ∧
+        RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  cases hrel with
+  | @source relatedFunction baseFunction targetAddress targetArity
+      storedSources source hsrc heligible harity href hprefix hunder =>
+    have hfullGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store
+        (captures ++ sourceArgs) (got ++ args) :=
+      hcaptures.append hargs
+    have hfullApply : SourceApplies sourceCtx baseFunction
+        (captures ++ sourceArgs) sourceResult :=
+      hprefix.append happlies
+    cases source with
+    | defn result body =>
+      obtain ⟨hresultShared, hsafe⟩ := heligible
+      subst result
+      obtain ⟨d, hdecl, harityDef, hresultDef, hownership⟩ :=
+        hcontracts.decls.defn hsrc
+      have hvalueContract : FnValueContractBelow
+          (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+          ((lamUses body).map worldOfUses) baseFunction limit := by
+        apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+        simpa using harityDef.symm
+      have hmodes := papSafe_lamUses_eq_replicate hsafe
+      have hworlds : (lamUses body).map worldOfUses =
+          List.replicate (lamUses body).length .shared := by
+        rw [hmodes]
+        simp [worldOfUses]
+      have htotalLength : (got ++ args).length =
+          (lamUses body).length := by
+        have hinvokeLength := invoke_success_length hdecl hinvoke
+        simpa [declArity, harityDef] using hinvokeLength
+      have hroots : rootsForWorlds
+          ((lamUses body).map worldOfUses) (got ++ args) =
+          rootsFor .shared (got ++ args) := by
+        rw [hworlds]
+        exact rootsForWorlds_replicate_eq_rootsFor .shared htotalLength
+      have hown' : RootOwnership store
+          (rootsForWorlds ((lamUses body).map worldOfUses)
+            (got ++ args) ++ rest) := by
+        rwa [hroots]
+      have hsemantic := invoke_fn_value_below hdecl
+        hvalueContract.arity_eq
+        (fun {smaller} hsmaller => hvalueContract.preserves
+          (Nat.lt_of_lt_of_le hsmaller hfuel))
+        hfullGraph hfullApply hframe hown' hinvoke
+      have howned := invoke_fn_owned hdecl hownership hown' hinvoke
+      rw [hresultDef] at howned
+      exact ⟨hsemantic.1, hsemantic.2, howned⟩
+    | ctor tag ctorArity => exact heligible.elim
+    | recursor numArgs natLit rules =>
+      obtain ⟨d, hdecl, harityRec, hresultRec, hownership⟩ :=
+        hcontracts.decls.recursor hsrc
+      have hvalueContract : FnValueContractBelow
+          (CompilerFunctionRel sourceCtx src ambient) sourceCtx ctx d
+          (List.replicate (numArgs + 1) .shared) baseFunction limit := by
+        apply hvalues.decls.fnContract hsrc (by rfl) hdecl href
+        simpa using harityRec.symm
+      have htotalLength : (got ++ args).length = numArgs + 1 := by
+        have hinvokeLength := invoke_success_length hdecl hinvoke
+        simpa [declArity, harityRec] using hinvokeLength
+      have hroots : rootsForWorlds
+          (List.replicate (numArgs + 1) .shared) (got ++ args) =
+          rootsFor .shared (got ++ args) :=
+        rootsForWorlds_replicate_eq_rootsFor .shared htotalLength
+      have hown' : RootOwnership store
+          (rootsForWorlds (List.replicate (numArgs + 1) .shared)
+            (got ++ args) ++ rest) := by
+        rwa [hroots]
+      have hsemantic := invoke_fn_value_below hdecl
+        hvalueContract.arity_eq
+        (fun {smaller} hsmaller => hvalueContract.preserves
+          (Nat.lt_of_lt_of_le hsmaller hfuel))
+        hfullGraph hfullApply hframe hown' hinvoke
+      have howned := invoke_fn_owned hdecl hownership hown' hinvoke
+      rw [hresultRec] at howned
+      exact ⟨hsemantic.1, hsemantic.2, howned⟩
+    | extern externArity =>
+      have hdecl := hcontracts.decls.extern hsrc
+      have hlookup : sourceCtx.env address =
+          some (.extern externArity) := by
+        rw [henv]
+        exact hsrc
+      have hsourceLength : (captures ++ sourceArgs).length =
+          externArity := by
+        have hinvokeLength := invoke_success_length hdecl hinvoke
+        have hgraphLength := hfullGraph.length
+        simpa [declArity] using hgraphLength.trans hinvokeLength
+      cases fuel with
+      | zero => simp [invoke] at hinvoke
+      | succ innerFuel =>
+        simp only [invoke, hdecl] at hinvoke
+        split at hinvoke
+        · contradiction
+        next _ =>
+          cases horacle : callScalarOracle ctx address (got ++ args) with
+          | error error =>
+              rw [horacle] at hinvoke
+              contradiction
+          | ok runtimeResult =>
+              rw [horacle] at hinvoke
+              have hpair : (store, runtimeResult) = (store', value) :=
+                Except.ok.inj hinvoke
+              cases hpair
+              have hvalueGraph := hvalues.extern.preserves hlookup href
+                hsourceLength hfullApply hfullGraph horacle
+              have hscalar := callScalarOracle_ok horacle
+              have howned : RootOwnership store
+                  (⟨.shared, value⟩ :: rest) :=
+                (hown.dropScalars hscalar.1).addNoLocation
+                  (RVal.rvalLocation?_eq_none_of_isScalar hscalar.2)
+              exact ⟨hvalueGraph, hframe, howned⟩
+  | @wrapper relatedFunction baseFunction storedSources memo hmember hsrc
+      href hprefix hunder =>
+    let wrapperDef : FnDef :=
+      ⟨memo.arity, .shared, true,
+        .letOp (.alloc .shared (ctorIdOf memo.source memo.tag)
+          (descendingVars memo.arity).toArray) (.ret (.var 0))⟩
+    have hdecl : ctx.decls memo.wrapper = some (.fn wrapperDef) := by
+      simpa [wrapperDef, ctorWrapperDecl] using
+        hrepresented.wrapper hmember
+    have hlookup : sourceCtx.env memo.source =
+        some (.ctor memo.tag memo.arity) := by
+      rw [henv]
+      exact hsrc
+    have hfullGraph : Sim.ValuesGraph
+        (CompilerFunctionRel sourceCtx src ambient) store
+        (captures ++ sourceArgs) (got ++ args) :=
+      hcaptures.append hargs
+    have hfullApply : SourceApplies sourceCtx baseFunction
+        (captures ++ sourceArgs) sourceResult :=
+      hprefix.append happlies
+    have hvalueContract := hwrapperValue memo baseFunction hlookup href
+    have hownership := hwrapperOwnership memo
+    have htotalLength : (got ++ args).length = memo.arity := by
+      have hinvokeLength := invoke_success_length hdecl hinvoke
+      simpa [wrapperDef, declArity] using hinvokeLength
+    have hroots : rootsForWorlds
+        (List.replicate memo.arity .shared) (got ++ args) =
+        rootsFor .shared (got ++ args) :=
+      rootsForWorlds_replicate_eq_rootsFor .shared htotalLength
+    have hown' : RootOwnership store
+        (rootsForWorlds (List.replicate memo.arity .shared)
+          (got ++ args) ++ rest) := by
+      rwa [hroots]
+    have hsemantic := invoke_fn_value_below hdecl hvalueContract.arity_eq
+      (fun {_} _ => hvalueContract.preserves) hfullGraph hfullApply hframe
+      hown' hinvoke
+    have howned := invoke_fn_owned hdecl hownership hown' hinvoke
+    exact ⟨hsemantic.1, hsemantic.2, howned⟩
+  | lifted hlifted =>
+    have hsemantic := invoke_lifted_value_below henv hrepresented
+      hcontracts hvalues hlifted hcaptures hargs happlies hframe hown hfuel
+      hinvoke
+    have howned := invoke_lifted_owned_below hrepresented hcontracts
+      hlifted hown hinvoke
+    exact ⟨hsemantic.1, hsemantic.2, howned⟩
+
+/-- A successful lambda lowering adds the generated lifted declaration to the
+compile state, and that declaration has the all-shared ownership contract
+advertised by the emitted partial application. -/
+theorem lowerLam_generatedFn_preservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env} {fuel : Nat}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (hpositive : 0 < lamArity expr)
+    (hrun : (lowerLam src (fuel + 1) input expr).run state =
+      .ok (output, emit, value) finalState)
+    (hrepresented : ExtraRepresented ctx finalState) :
+    let captures := (List.range input.entries.length).filter
+      (fun index => countUses index expr > 0)
+    ∃ address code,
+      (address, .fn
+        ⟨captures.length + lamArity expr, .shared, true, code⟩) ∈
+          finalState.extra ∧
+      ctx.decls address = some (.fn
+        ⟨captures.length + lamArity expr, .shared, true, code⟩) ∧
+      FnOwnershipPreservesAt ctx
+        ⟨captures.length + lamArity expr, .shared, true, code⟩
+        (List.replicate (captures.length + lamArity expr) .shared) limit := by
+  let captures := liftCaptureIndices input.entries.length expr
+  change ∃ address code,
+    (address, .fn
+      ⟨captures.length + lamArity expr, .shared, true, code⟩) ∈
+        finalState.extra ∧
+    ctx.decls address = some (.fn
+      ⟨captures.length + lamArity expr, .shared, true, code⟩) ∧
+    FnOwnershipPreservesAt ctx
+      ⟨captures.length + lamArity expr, .shared, true, code⟩
+      (List.replicate (captures.length + lamArity expr) .shared) limit
+  refine lowerLam_run_core
+    (Result := fun finalState _ _ _ =>
+      ExtraRepresented ctx finalState →
+      ∃ address code,
+        (address, .fn
+          ⟨captures.length + lamArity expr, .shared, true, code⟩) ∈
+            finalState.extra ∧
+        ctx.decls address = some (.fn
+          ⟨captures.length + lamArity expr, .shared, true, code⟩) ∧
+        FnOwnershipPreservesAt ctx
+          ⟨captures.length + lamArity expr, .shared, true, code⟩
+          (List.replicate
+            (captures.length + lamArity expr) .shared) limit)
+    ?_ hrun hrepresented
+  intro bodyFuel _captureOutput _captureEmit _captureValues _captureState
+    fnAddr addressState code bodyState _hfuel hp _hcaptureRun _hfreshRun hbodyRun
+    hrepresented
+  let ambient : LowSt :=
+    { bodyState with
+      extra := (fnAddr, .fn
+        ⟨captures.length + lamArity expr, .shared, true, code⟩) ::
+          bodyState.extra }
+  change ExtraRepresented ctx ambient at hrepresented
+  have hextends : ExtraExtends bodyState ambient := by
+    refine ⟨[(fnAddr, .fn
+      ⟨captures.length + lamArity expr, .shared, true, code⟩)],
+      [], ?_, ?_, ?_⟩
+    · simp [ambient]
+    · simp [ambient]
+    · simp
+  have hbodyRepresented : ExtraRepresented ctx bodyState :=
+    hrepresented.of_extends hextends
+  have hmember :
+      (fnAddr, .fn
+        ⟨captures.length + lamArity expr, .shared, true, code⟩) ∈
+          ambient.extra := by
+    simp [ambient]
+  have hdecl := hrepresented.decl hmember
+  have hmodes := papSafe_lamUses_eq_replicate hp
+  have hadmissible : ParameterDropsAdmissible (lamUses expr)
+      (fun index => countUses index (stripLams expr)) := by
+    rw [hmodes]
+    exact parameterDropsAdmissible_replicate_many _ _
+  have hselected : ∀ index, index < input.entries.length →
+      decide (0 < countUses index expr) =
+        (countUses ((lamUses expr).length + index) (stripLams expr) != 0) := by
+    intro index _
+    rw [lamUses_length]
+    rw [← countUses_eq_stripLams_shift expr index]
+    cases countUses index expr <;> rfl
+  have hshared : (lamUses expr).map worldOfUses =
+      List.replicate (lamUses expr).length .shared := by
+    rw [hmodes]
+    simp [worldOfUses]
+  cases bodyFuel with
+  | zero =>
+    exact (trackedThrowRun_not_ok
+      (by simpa [lowerFnBody] using hbodyRun)).elim
+  | succ innerFuel =>
+    have hbodyRun' :
+        (lowerFnBody src (innerFuel + 1)
+          (let generatedCaptures :=
+              (List.range input.entries.length).filter
+                (fun index => countUses index expr > 0)
+           ⟨parameterEntries generatedCaptures.length (lamUses expr)
+                (fun index => countUses index (stripLams expr)) ++
+              selectedEntriesFrom
+                (fun index => countUses index expr > 0)
+                (fun index => countUses ((lamUses expr).length + index)
+                  (stripLams expr))
+                (List.range input.entries.length) 0,
+            generatedCaptures.length + (lamUses expr).length⟩)
+          (let generatedCaptures :=
+              (List.range input.entries.length).filter
+                (fun index => countUses index expr > 0)
+           parameterDrops generatedCaptures.length (lamUses expr)
+              (fun index => countUses index (stripLams expr)))
+          .shared (stripLams expr)).run addressState =
+            .ok code bodyState := by
+      simpa [liftedBodyVEnv, liftedBodyDrops, liftCaptureIndices,
+        lamUses_length] using hbodyRun
+    have hpreserves : FnOwnershipPreservesAt ctx
+        ⟨captures.length + (lamUses expr).length, .shared, true, code⟩
+        (List.replicate
+          (captures.length + (lamUses expr).length) .shared) limit := by
+      exact lowerFnBody_liftedEntries_preservesAt
+        (fuel := innerFuel) (state := addressState)
+        (finalState := bodyState) (code := code)
+        happly hdecls input.entries.length
+        (lamUses expr) (stripLams expr)
+        (fun index => countUses index expr > 0)
+        hadmissible hselected (by simpa using hpositive) hshared
+        hbodyRun' hbodyRepresented
+    refine ⟨fnAddr, code, hmember, hdecl, ?_⟩
+    rw [lamUses_length] at hpreserves
+    exact hpreserves
+
+private theorem wrapperBindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem wrapperBindErr {error α β : Type} (err : error)
+    (next : α → Except error β) :
+    ((Except.error err : Except error α) >>= next) = .error err := rfl
+
+private theorem descendingVars_resolveFrom (args suffix : List RVal) :
+    ∀ accum,
+      (descendingVars args.length).toArray.foldlM
+        (fun acc atom => do pure (acc ++ [← resolveAtom
+          (args.reverse ++ suffix) atom])) accum =
+        .ok (accum ++ args) := by
+  induction args generalizing suffix with
+  | nil =>
+    intro accum
+    simp only [List.length_nil, descendingVars, List.foldlM_toArray,
+      List.foldlM_nil, List.append_nil]
+    rfl
+  | cons head tail ih =>
+    intro accum
+    simp only [List.length_cons, descendingVars, List.foldlM_toArray,
+      List.foldlM_cons]
+    have hhead : resolveAtom ((head :: tail).reverse ++ suffix)
+        (.var tail.length) = .ok head := by
+      simp [resolveAtom]
+    rw [hhead, wrapperBindOk]
+    have htail := ih (head :: suffix) (accum ++ [head])
+    simpa [List.append_assoc] using htail
+
+theorem descendingVars_resolveAtoms (args : List RVal) :
+    resolveAtoms args.reverse (descendingVars args.length).toArray =
+      .ok args := by
+  unfold resolveAtoms
+  simpa using descendingVars_resolveFrom args [] []
+
+/-- A generated constructor eta-wrapper consumes its all-shared argument
+vector and returns ownership of the freshly allocated shared constructor. -/
+theorem ctorWrapper_fnOwnershipContract (ctx : Ctx)
+    (source : Ixon.Address) (tag arity : Nat) :
+    FnOwnershipContract ctx
+      ⟨arity, .shared, true,
+        .letOp (.alloc .shared (ctorIdOf source tag)
+          (descendingVars arity).toArray)
+          (.ret (.var 0))⟩
+      (List.replicate arity .shared) := by
+  constructor
+  · simp
+  · intro fuel store store' args value rest hlength hown hrun
+    have hargsLength : args.length = arity := by simpa using hlength
+    have hresolve : resolveAtoms args.reverse
+        (descendingVars arity).toArray = .ok args := by
+      rw [← hargsLength]
+      exact descendingVars_resolveAtoms args
+    have hroots : rootsForWorlds (List.replicate arity .shared) args =
+        rootsFor .shared args :=
+      rootsForWorlds_replicate_eq_rootsFor .shared hargsLength
+    have hinput : RootOwnership store
+        (rootsFor .shared args ++ rest) := by
+      rwa [hroots] at hown
+    cases fuel with
+    | zero => simp [runCode] at hrun
+    | succ outerFuel =>
+      cases outerFuel with
+      | zero => simp [runCode, runOp, wrapperBindErr] at hrun
+      | succ innerFuel =>
+        simp only [runCode] at hrun
+        simp only [runOp] at hrun
+        rw [hresolve] at hrun
+        simp [resolveAtom, wrapperBindOk] at hrun
+        obtain ⟨hstore, hvalue⟩ := hrun
+        subst store'
+        subst value
+        apply RootOwnership.allocNode
+        · simpa [nodeChildren] using hinput
+        · trivial
+
+/-- A constructor eta-wrapper has the corresponding source semantics at
+every target evaluator index.  The wrapper's allocation is fresh, so the
+argument graphs become constructor-field graphs while the caller frame is
+transported through the one-node store extension. -/
+theorem ctorWrapper_fnValueContract
+    {funRel : Sim.FunctionRel} (sourceCtx : IxIR0.Ctx) (ctx : Ctx)
+    (source : Ixon.Address) (tag arity : Nat)
+    (sourceFunction : IxIR0.Value)
+    (hlookup : sourceCtx.env source = some (.ctor tag arity))
+    (href : SourceRefValue sourceCtx source sourceFunction) :
+    FnValueContract funRel sourceCtx ctx
+      ⟨arity, .shared, true,
+        .letOp (.alloc .shared (ctorIdOf source tag)
+          (descendingVars arity).toArray)
+          (.ret (.var 0))⟩
+      (List.replicate arity .shared) sourceFunction := by
+  constructor
+  · simp
+  · intro fuel store store' args value sourceArgs sourceResult
+      sourceRest rest hlength hargs hsource hframe hown hrun
+    have hargsLength : args.length = arity := by simpa using hlength
+    have hsourceArgsLength : sourceArgs.length = arity := by
+      simpa [hargsLength] using hargs.length
+    have hcanonical : SourceApplies sourceCtx sourceFunction sourceArgs
+        (.ctor source tag sourceArgs) :=
+      sourceCtorRef_saturates hlookup href hsourceArgsLength
+    have hsourceResult : sourceResult = .ctor source tag sourceArgs :=
+      hsource.deterministic hcanonical
+    subst sourceResult
+    have hresolve : resolveAtoms args.reverse
+        (descendingVars arity).toArray = .ok args := by
+      rw [← hargsLength]
+      exact descendingVars_resolveAtoms args
+    have hroots : rootsForWorlds (List.replicate arity .shared) args =
+        rootsFor .shared args :=
+      rootsForWorlds_replicate_eq_rootsFor .shared hargsLength
+    have hinput : RootOwnership store
+        (rootsFor .shared args ++ rest) := by
+      rwa [hroots] at hown
+    cases fuel with
+    | zero => simp [runCode] at hrun
+    | succ outerFuel =>
+      cases outerFuel with
+      | zero => simp [runCode, runOp, wrapperBindErr] at hrun
+      | succ innerFuel =>
+        simp only [runCode] at hrun
+        simp only [runOp] at hrun
+        rw [hresolve] at hrun
+        simp [resolveAtom, wrapperBindOk] at hrun
+        obtain ⟨hstore, hvalue⟩ := hrun
+        subst store'
+        subst value
+        let node : Node :=
+          .ctorN (ctorIdOf source tag) args.toArray
+        let allocated := store.allocNode .shared node
+        have hextends : Sim.StoreGraphExtends store allocated.1 :=
+          Sim.StoreGraphExtends.allocNode store .shared node
+        have hfields : Sim.ValuesGraph funRel allocated.1 sourceArgs args :=
+          hargs.monoStore hextends
+        have hresultGraph : Sim.ValueGraph funRel allocated.1
+            (.ctor source tag sourceArgs) (.loc allocated.2) := by
+          apply Sim.ValueGraph.ctor
+          · exact Sim.HeapIso.get?_allocNode_new store .shared node
+          · rfl
+          · rfl
+          · simpa [node] using hfields
+        have hframeAfter : Sim.RootsGraph funRel allocated.1
+            sourceRest rest := hframe.monoStore hextends
+        simpa [allocated, node] using And.intro hresultGraph hframeAfter
+
+/-- Exact semantic preservation for `applyGo` at the current evaluator
+index.  Declaration and recursive-application semantics are required only
+strictly below this index through `hvalues`; generated lifted bodies are
+recovered from their compiler provenance. -/
+theorem applyValuePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx} {src : IxIR0.Env} {ambient : LowSt}
+    {ctx : Ctx} {limit : Nat}
+    (henv : sourceCtx.env = src)
+    (hrepresented : ExtraRepresented ctx ambient)
+    (hcontracts : CompilerContracts src ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx src ambient) sourceCtx src ctx limit) :
+    ApplyValuePreservesAt (CompilerFunctionRel sourceCtx src ambient)
+      sourceCtx ctx limit := by
+  intro store store' function args value sourceFunction sourceArgs
+    sourceResult sourceRest rest hfunction hargs happlies hframe hown hrun
+  cases limit with
+  | zero => simp [applyGo] at hrun
+  | succ fuel =>
+    cases hfunction with
+    | lit => simp [applyGo] at hrun
+    | erased =>
+      have hsourceResult : sourceResult = .erased :=
+        happlies.deterministic (SourceApplies.erased sourceCtx sourceArgs)
+      subst sourceResult
+      have hargsOwn : RootOwnership store
+          (rootsFor .shared args ++ rest) :=
+        hown.dropNoLocation rfl
+      simp only [applyGo] at hrun
+      cases hdrop : dropMany ctx fuel store args with
+      | error error =>
+        rw [hdrop, wrapperBindErr] at hrun
+        contradiction
+      | ok dropped =>
+        rw [hdrop, wrapperBindOk] at hrun
+        have hrestOwn : RootOwnership dropped rest :=
+          dropMany_preserves hargsOwn hdrop
+        have hrestrict : StoreGraphRestricts store dropped :=
+          dropMany_restricts hdrop
+        injection hrun with hpair
+        cases hpair
+        exact ⟨.erased,
+          hframe.ofRestricts hrestrict hrestOwn⟩
+    | @ctor sourceAddress sourceTag sourceFields loc boxWorld rc cid fields
+        hget haddress htag hfields =>
+      simp [applyGo, hget] at hrun
+    | @function relatedFunction address arity captures loc rc got hget hfun
+        hgot =>
+      simp only [applyGo] at hrun
+      rw [hget] at hrun
+      dsimp only at hrun
+      cases hdup : dupVals store got.toList with
+      | error error =>
+        rw [hdup, wrapperBindErr] at hrun
+        contradiction
+      | ok dupStore =>
+        rw [hdup, wrapperBindOk] at hrun
+        cases hdrop : dropVal ctx fuel dupStore (.loc loc) with
+        | error error =>
+          rw [hdrop, wrapperBindErr] at hrun
+          contradiction
+        | ok readyStore =>
+          rw [hdrop, wrapperBindOk] at hrun
+          let total := got.toList ++ args
+          obtain ⟨hgotReady, hargsReady, hframeReady, hready⟩ :=
+            applyGo_preparePap_valueGraphs hget hgot hargs hframe hown
+              hdup hdrop
+          split at hrun
+          next hunder =>
+            have hsourceUnder : (captures ++ sourceArgs).length < arity := by
+              have htotalGraph := hgotReady.append hargsReady
+              have hlength := htotalGraph.length
+              rw [hlength]
+              simpa [total] using hunder
+            have hnewRel := hfun.underfilledApply happlies hsourceUnder
+            injection hrun with hpair
+            cases hpair
+            let node : Node := .papN address arity total.toArray
+            let allocated := readyStore.allocNode .shared node
+            have hextends : StoreGraphExtends readyStore allocated.1 :=
+              StoreGraphExtends.allocNode readyStore .shared node
+            have htotalGraph : Sim.ValuesGraph
+                (CompilerFunctionRel sourceCtx src ambient) allocated.1
+                (captures ++ sourceArgs) total := by
+              exact (hgotReady.append hargsReady).monoStore hextends
+            have hresultGraph : Sim.ValueGraph
+                (CompilerFunctionRel sourceCtx src ambient) allocated.1
+                sourceResult (.loc allocated.2) := by
+              apply Sim.ValueGraph.function
+              · exact Sim.HeapIso.get?_allocNode_new readyStore .shared node
+              · exact hnewRel
+              · simpa [node] using htotalGraph
+            have hframeAfter := hframeReady.monoStore hextends
+            simpa [allocated, node, total] using
+              And.intro hresultGraph hframeAfter
+          next hnotUnder =>
+            split at hrun
+            next hexact =>
+              have hsafety : ∃ declaration,
+                  ctx.decls address = some declaration ∧
+                    declPapSafe declaration = true := by
+                cases hdecl : ctx.decls address with
+                | none => simp [hdecl] at hrun
+                | some declaration =>
+                  cases hpapsafe : declPapSafe declaration with
+                  | false => simp [hdecl, hpapsafe] at hrun
+                  | true => exact ⟨declaration, rfl, hpapsafe⟩
+              obtain ⟨declaration, hdecl, hpapsafe⟩ := hsafety
+              simp only [hdecl, hpapsafe, if_true] at hrun
+              have hcalled := invoke_compilerFunction_value_owned_below
+                henv hrepresented hcontracts hvalues
+                (fun memo baseFunction hlookup href =>
+                  ctorWrapper_fnValueContract
+                    (funRel := CompilerFunctionRel sourceCtx src ambient)
+                    sourceCtx ctx memo.source memo.tag memo.arity
+                    baseFunction hlookup href)
+                (fun memo => ctorWrapper_fnOwnershipContract ctx memo.source
+                  memo.tag memo.arity)
+                hfun hgotReady hargsReady happlies hframeReady hready
+                (Nat.le_succ fuel) hrun
+              exact ⟨hcalled.1, hcalled.2.1⟩
+            next hover =>
+              have hsafety : ∃ declaration,
+                  ctx.decls address = some declaration ∧
+                    declPapSafe declaration = true := by
+                cases hdecl : ctx.decls address with
+                | none => simp [hdecl] at hrun
+                | some declaration =>
+                  cases hpapsafe : declPapSafe declaration with
+                  | false => simp [hdecl, hpapsafe] at hrun
+                  | true => exact ⟨declaration, rfl, hpapsafe⟩
+              obtain ⟨declaration, hdecl, hpapsafe⟩ := hsafety
+              simp only [hdecl, hpapsafe, if_true] at hrun
+              have hfunUnder := hfun.underfilled
+              have hgotUnder : got.toList.length < arity := by
+                have hlength := hgotReady.length
+                omega
+              have hgotLe : got.toList.length ≤ arity :=
+                Nat.le_of_lt hgotUnder
+              have hoverLength : arity < total.length := by
+                have hnotExact : total.length ≠ arity := by
+                  intro heq
+                  apply hover
+                  simpa [total] using heq
+                have hle : arity ≤ total.length :=
+                  Nat.le_of_not_gt hnotUnder
+                omega
+              let missing := arity - got.toList.length
+              have hmissing : got.toList.length + missing = arity := by
+                exact Nat.add_sub_of_le hgotLe
+              have hmissingLe : missing ≤ args.length := by
+                simp only [total, List.length_append] at hoverLength
+                omega
+              have htakeTotal : total.take arity =
+                  got.toList ++ args.take missing := by
+                rw [List.take_append]
+                rw [List.take_of_length_le hgotLe]
+              have hdropTotal : total.drop arity = args.drop missing := by
+                rw [List.drop_append]
+                rw [List.drop_eq_nil_of_le hgotLe]
+                rfl
+              have hsourceWhole : SourceApplies sourceCtx sourceFunction
+                  (sourceArgs.take missing ++ sourceArgs.drop missing)
+                  sourceResult := by
+                rw [List.take_append_drop]
+                exact happlies
+              obtain ⟨middleSource, hprefixApply, htailApply⟩ :=
+                hsourceWhole.split
+              have hprefixGraph := hargsReady.take missing
+              have htailGraph := hargsReady.drop missing
+              have htailWorld : ∀ runtime,
+                  runtime ∈ args.drop missing →
+                  HasWorld readyStore .shared runtime := by
+                intro runtime hmember
+                apply hready.roots_world ⟨.shared, runtime⟩
+                apply List.mem_append_left rest
+                have hmemberArgs : runtime ∈ args :=
+                  List.mem_of_mem_drop hmember
+                have hmemberTotal : runtime ∈ total := by
+                  exact List.mem_append_right got.toList hmemberArgs
+                simpa [total, rootsFor] using hmemberTotal
+              let tailSourceRest : List (Owned × IxIR0.Value) :=
+                (sourceArgs.drop missing).map
+                  (fun source => (.shared, source))
+              let tailRoots : List Root :=
+                rootsFor .shared (args.drop missing)
+              have htailFrame : Sim.RootsGraph
+                  (CompilerFunctionRel sourceCtx src ambient) readyStore
+                  tailSourceRest tailRoots := by
+                exact htailGraph.rootsGraph .shared htailWorld
+              have hcombinedFrame : Sim.RootsGraph
+                  (CompilerFunctionRel sourceCtx src ambient) readyStore
+                  (tailSourceRest ++ sourceRest) (tailRoots ++ rest) :=
+                htailFrame.append hframeReady
+              have hrootsSplit : rootsFor .shared total =
+                  rootsFor .shared (total.take arity) ++
+                    rootsFor .shared (total.drop arity) := by
+                unfold rootsFor
+                rw [← List.map_append]
+                exact congrArg _ (List.take_append_drop arity total).symm
+              have hpartition : RootOwnership readyStore
+                  (rootsFor .shared (got.toList ++ args.take missing) ++
+                    (tailRoots ++ rest)) := by
+                have hsplit := hready
+                rw [hrootsSplit] at hsplit
+                rw [htakeTotal, hdropTotal] at hsplit
+                simpa [tailRoots, List.append_assoc] using hsplit
+              cases hinvoke : invoke ctx fuel address
+                  (total.take arity) readyStore with
+              | error error =>
+                  rw [hinvoke, wrapperBindErr] at hrun
+                  contradiction
+              | ok called =>
+                rcases called with ⟨calledStore, calledValue⟩
+                rw [hinvoke, wrapperBindOk] at hrun
+                have hinvokePrefix : invoke ctx fuel address
+                    (got.toList ++ args.take missing) readyStore =
+                    .ok (calledStore, calledValue) := by
+                  rw [← htakeTotal]
+                  exact hinvoke
+                have hcalled := invoke_compilerFunction_value_owned_below
+                  henv hrepresented hcontracts hvalues
+                  (fun memo baseFunction hlookup href =>
+                    ctorWrapper_fnValueContract
+                      (funRel := CompilerFunctionRel sourceCtx src ambient)
+                      sourceCtx ctx memo.source memo.tag memo.arity
+                      baseFunction hlookup href)
+                  (fun memo => ctorWrapper_fnOwnershipContract ctx
+                    memo.source memo.tag memo.arity)
+                  hfun hgotReady hprefixGraph hprefixApply hcombinedFrame
+                  hpartition (Nat.le_succ fuel) hinvokePrefix
+                have htailLength : tailSourceRest.length = tailRoots.length := by
+                  simp [tailSourceRest, tailRoots, rootsFor,
+                    hargsReady.length]
+                obtain ⟨htailFrameAfter, hframeAfter⟩ :=
+                  hcalled.2.1.splitAppend htailLength
+                have htailGraphAfter : Sim.ValuesGraph
+                    (CompilerFunctionRel sourceCtx src ambient) calledStore
+                    (sourceArgs.drop missing) (args.drop missing) := by
+                  exact htailFrameAfter.valuesGraph
+                have hrecursiveRun : applyGo ctx fuel calledStore calledValue
+                    (args.drop missing) = .ok (store', value) := by
+                  change applyGo ctx fuel calledStore calledValue
+                    (total.drop arity) = .ok (store', value) at hrun
+                  rw [hdropTotal] at hrun
+                  exact hrun
+                exact hvalues.apply.preserves (Nat.lt_succ_self fuel)
+                  hcalled.1 htailGraphAfter htailApply hframeAfter
+                  hcalled.2.2 hrecursiveRun
+
+/-! ### Whole-pass semantic contract sealing -/
+
+/-- A successful lookup in the source list environment identifies the exact
+source declaration occurrence traversed by `lowerAllAction`.  No no-duplicate
+assumption is needed in this direction: `Env.ofList` returns an actual
+`find?` member. -/
+theorem sourceEnv_ofList_lookup_mem
+    {decls : List (Ixon.Address × IxIR0.Decl)}
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    (hlookup : IxIR0.Env.ofList decls address = some source) :
+    (address, source) ∈ decls := by
+  unfold IxIR0.Env.ofList at hlookup
+  obtain ⟨item, hfind, hvalue⟩ :=
+    Option.map_eq_some_iff.mp hlookup
+  rcases item with ⟨itemAddress, itemSource⟩
+  have hbeq : itemAddress == address :=
+    List.find?_some
+      (p := fun item : Ixon.Address × IxIR0.Decl =>
+        item.1 == address) hfind
+  have haddress : itemAddress = address :=
+    Ixon.Address.eq_of_beq hbeq
+  have hsource : itemSource = source := by
+    simpa using hvalue
+  subst itemAddress
+  subst itemSource
+  exact List.mem_of_find?_eq_some hfind
+
+/-- The IxIR₁ list environment likewise returns an actual declaration
+occurrence.  This reverse lookup is the bridge from an exact raw target
+context to the whole-pass declaration list. -/
+theorem targetEnv_ofList_lookup_mem
+    {decls : List (Ixon.Address × Decl)}
+    {address : Ixon.Address} {declaration : Decl}
+    (hlookup : Env.ofList decls address = some declaration) :
+    (address, declaration) ∈ decls := by
+  unfold Env.ofList at hlookup
+  obtain ⟨item, hfind, hvalue⟩ :=
+    Option.map_eq_some_iff.mp hlookup
+  rcases item with ⟨itemAddress, itemDeclaration⟩
+  have hbeq : itemAddress == address :=
+    List.find?_some
+      (p := fun item : Ixon.Address × Decl =>
+        item.1 == address) hfind
+  have haddress : itemAddress = address :=
+    Ixon.Address.eq_of_beq hbeq
+  have hdeclaration : itemDeclaration = declaration := by
+    simpa using hvalue
+  subst itemAddress
+  subst itemDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+/-- Every callable source row traversed by the whole pass is the row selected
+by its list environment.  Validated addressed erasure supplies this premise
+from its collision-free producer namespace. -/
+def SourceCallableRowsSelected
+    (decls : List (Ixon.Address × IxIR0.Decl)) : Prop :=
+  ∀ {address source worlds result},
+    (address, source) ∈ decls →
+    sourceCallableSignature source = some (worlds, result) →
+    IxIR0.Env.ofList decls address = some source
+
+/-- Recover the exact same-address callable declaration run selected by the
+final target context.  This is the semantic counterpart of the concrete
+fixture's `addLowerDecl_run`, generalized to any successful whole pass. -/
+theorem lowerAllAction_callable_decl_trace
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Owned} {result : Owned} {d : FnDef}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hsrc : IxIR0.Env.ofList decls address = some source)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : ctx.decls address = some (.fn d)) :
+    ∃ itemInitial itemFinal,
+      (lowerDecl (IxIR0.Env.ofList decls) compilerFuel
+        (address, source)).run itemInitial =
+          .ok (some (address, .fn d)) itemFinal ∧
+      ExtraExtends itemFinal finalState := by
+  obtain ⟨itemInitial, itemFinal, output, hrun, hextends, houtput⟩ :=
+    lowerAllAction_decl_trace hlower (sourceEnv_ofList_lookup_mem hsrc)
+  obtain ⟨generated, hgenerated⟩ :=
+    lowerDecl_output_fn_of_callable hsignature hrun
+  have hgeneratedDecl : ctx.decls address = some (.fn generated) :=
+    htarget (houtput _ hgenerated)
+  have hd : generated = d := by
+    have heq : some (Decl.fn generated) = some (Decl.fn d) :=
+      hgeneratedDecl.symm.trans hdecl
+    exact Decl.fn.inj (Option.some.inj heq)
+  subst generated
+  rw [hgenerated] at hrun
+  exact ⟨itemInitial, itemFinal, hrun, hextends⟩
+
+/-- A successful whole pass determines the complete same-address layout of
+every callable source declaration represented by its returned raw target
+list. -/
+theorem lowerAllAction_sourceDeclLayout
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl) :
+    SourceDeclLayout (IxIR0.Env.ofList decls) ctx := by
+  constructor
+  · intro address source worlds result hsrc hsignature
+    obtain ⟨itemInitial, itemFinal, output, hrun, _, houtput⟩ :=
+      lowerAllAction_decl_trace hlower
+        (sourceEnv_ofList_lookup_mem hsrc)
+    obtain ⟨d, hemitted, harity, hresult⟩ :=
+      lowerDecl_output_fn_layout_of_callable hsignature hrun
+    exact ⟨d, htarget (houtput _ hemitted), harity, hresult⟩
+  · intro address arity hsrc
+    obtain ⟨itemInitial, itemFinal, output, hrun, _, houtput⟩ :=
+      lowerAllAction_decl_trace hlower
+        (sourceEnv_ofList_lookup_mem hsrc)
+    have hemitted : output = some (address, .extern arity) := by
+      symm
+      simpa [lowerDecl] using congrArg
+        (fun result : EStateM.Result String LowSt
+            (Option (Ixon.Address × Decl)) =>
+          match result with
+          | .ok value _ => value
+          | .error _ _ => none) hrun
+    exact htarget (houtput _ hemitted)
+
+/-- A successful ordinary-definition lowering run exposes the PAP-safety bit
+computed from the source result world and body. -/
+theorem lowerDecl_defn_papSafe_of_run
+    {src : IxIR0.Env} {fuel : Nat} {address : Ixon.Address}
+    {result : Owned} {body : IxIR0.Expr} {initial final : LowSt}
+    {d : FnDef}
+    (hrun : (lowerDecl src fuel (address, .defn result body)).run initial =
+      .ok (some (address, .fn d)) final)
+    (hresult : result = .shared) (hbody : papSafe body = true) :
+    d.papSafe = true := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨code, bodyState, _, hpureRun⟩ := trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn ⟨lamArity body, result,
+        result == .shared && papSafe body, code⟩) =
+          some (address, Decl.fn d) ∧ bodyState = final := by
+    simpa using hpureRun
+  have hd : d = ⟨lamArity body, result,
+      result == .shared && papSafe body, code⟩ := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+  subst d
+  simp [hresult, hbody]
+
+/-- Generated recursor declarations always permit dynamic PAP entry. -/
+theorem lowerDecl_recursor_papSafe_of_run
+    {src : IxIR0.Env} {fuel numArgs : Nat} {address : Ixon.Address}
+    {natLit : Bool} {rules : Array IxIR0.RecRule}
+    {initial final : LowSt} {d : FnDef}
+    (hrun : (lowerDecl src fuel
+      (address, .recursor numArgs natLit rules)).run initial =
+        .ok (some (address, .fn d)) final) :
+    d.papSafe = true := by
+  simp only [lowerDecl] at hrun
+  obtain ⟨actual, recursorState, hrecursorRun, hafterRecursor⟩ :=
+    trackedBindRun_ok_inv hrun
+  have hpure :
+      some (address, Decl.fn actual) = some (address, Decl.fn d) ∧
+        recursorState = final := by
+    simpa using hafterRecursor
+  have hd : actual = d := by
+    have hp := Option.some.inj hpure.1
+    exact Decl.fn.inj (Prod.mk.inj hp).2
+  subst actual
+  simp only [lowerRecursor] at hrecursorRun
+  obtain ⟨alts, rulesState, _, hafterRules⟩ :=
+    trackedBindRun_ok_inv hrecursorRun
+  have hshape :
+      (⟨numArgs + 1, .shared, true,
+        .case (.var 0) natLit alts.toArray⟩ : FnDef) = d ∧
+        rulesState = recursorState := by
+    simpa using hafterRules
+  rw [← hshape.1]
+
+/-- If the emitted function admits dynamic PAP entry, its source signature is
+homogeneously shared.  Definitions recover both facts from the committed
+`papSafe` bit; recursors have that signature by construction. -/
+theorem lowerDecl_callable_signature_of_papSafe_run
+    {src : IxIR0.Env} {fuel : Nat} {address : Ixon.Address}
+    {source : IxIR0.Decl} {worlds : List Owned} {result : Owned}
+    {initial final : LowSt} {d : FnDef}
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hrun : (lowerDecl src fuel (address, source)).run initial =
+      .ok (some (address, .fn d)) final)
+    (hsafe : d.papSafe = true) :
+    result = .shared ∧
+      worlds = List.replicate worlds.length .shared := by
+  cases source with
+  | defn sourceResult body =>
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simp only [lowerDecl] at hrun
+      obtain ⟨code, bodyState, _, hpureRun⟩ :=
+        trackedBindRun_ok_inv hrun
+      have hpure :
+          some (address, Decl.fn
+            ⟨lamArity body, sourceResult,
+              sourceResult == .shared && papSafe body, code⟩) =
+              some (address, .fn d) ∧ bodyState = final := by
+        simpa using hpureRun
+      have hd : d =
+          ⟨lamArity body, sourceResult,
+            sourceResult == .shared && papSafe body, code⟩ := by
+        have hp := Option.some.inj hpure.1
+        exact Decl.fn.inj (Prod.mk.inj hp).2.symm
+      subst d
+      change (sourceResult == .shared && papSafe body) = true at hsafe
+      simp only [Bool.and_eq_true] at hsafe
+      obtain ⟨hresultBeq, hbody⟩ := hsafe
+      have hresult : sourceResult = .shared := by
+        cases sourceResult <;> simp_all
+      have hmodes := papSafe_lamUses_eq_replicate hbody
+      refine ⟨hresult, ?_⟩
+      rw [hmodes]
+      simp [worldOfUses]
+  | ctor tag arity => simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      refine ⟨rfl, ?_⟩
+      simp
+  | extern arity => simp [sourceCallableSignature] at hsignature
+
+/-- Owner-sensitive PAP safety is a theorem of the concrete whole-pass
+declaration trace, not an all-shared source-environment assumption. -/
+theorem lowerAllAction_sourcePapSafe
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl) :
+    SourcePapSafe (IxIR0.Env.ofList decls) ctx := by
+  intro address source worlds result d hsrc hsignature hdecl hsafe
+  obtain ⟨itemInitial, itemFinal, hrun, _⟩ :=
+    lowerAllAction_callable_decl_trace hlower htarget hsrc hsignature hdecl
+  exact lowerDecl_callable_signature_of_papSafe_run
+    hsignature hrun hsafe
+
+/-- Every raw function returned by the whole pass came either from a selected
+same-address callable source row or from the final generated-declaration
+accumulator.  This is the exact declaration partition consumed by
+`FnDeclCovered`. -/
+theorem lowerAllAction_fn_mem_source_or_extra
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hselected : SourceCallableRowsSelected decls)
+    {address : Ixon.Address} {d : FnDef}
+    (hmember : (address, .fn d) ∈ targetDecls) :
+    (∃ source worlds result,
+      IxIR0.Env.ofList decls address = some source ∧
+      sourceCallableSignature source = some (worlds, result)) ∨
+    (address, .fn d) ∈ finalState.extra := by
+  let src := IxIR0.Env.ofList decls
+  simp only [lowerAllAction] at hlower
+  obtain ⟨base, baseState, hbase, hafterBase⟩ :=
+    trackedBindRun_ok_inv hlower
+  obtain ⟨compiledMain, mainState, hmain, hafterMain⟩ :=
+    trackedBindRun_ok_inv hafterBase
+  obtain ⟨observed, getState, hget, hpure⟩ :=
+    trackedBindRun_ok_inv hafterMain
+  have hget' : mainState = observed ∧ mainState = getState := by
+    simpa using hget
+  obtain ⟨hobserved, hgetState⟩ := hget'
+  subst observed
+  subst getState
+  have hpure' :
+      (base ++ mainState.extra, compiledMain) =
+          (targetDecls, mainCode) ∧ mainState = finalState := by
+    simpa using hpure
+  obtain ⟨hresult, hstate⟩ := hpure'
+  subst finalState
+  have hdecls : base ++ mainState.extra = targetDecls :=
+    congrArg Prod.fst hresult
+  rw [← hdecls, List.mem_append] at hmember
+  cases hmember with
+  | inl hbaseMember =>
+      obtain ⟨item, itemInitial, itemFinal, hitem, hitemRun⟩ :=
+        listFilterMapM_result_trace (lowerDecl src compilerFuel)
+          decls hbase hbaseMember
+      rcases item with ⟨sourceAddress, source⟩
+      obtain ⟨haddress, worlds, result, hsignature⟩ :=
+        lowerDecl_fn_output_input_callable hitemRun
+      subst sourceAddress
+      exact Or.inl ⟨source, worlds, result,
+        hselected hitem hsignature, hsignature⟩
+  | inr hextra => exact Or.inr hextra
+
+/-- With an exact raw target context, the whole-pass source/generated
+partition closes declaration coverage without admitting synthetic aliases. -/
+theorem lowerAllAction_fnDeclCovered
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (hselected : SourceCallableRowsSelected decls)
+    (hctx : ctx.decls = Env.ofList targetDecls) :
+    FnDeclCovered (IxIR0.Env.ofList decls) ctx finalState := by
+  intro address d hdecl
+  have hlookup : Env.ofList targetDecls address = some (.fn d) := by
+    rw [← hctx]
+    exact hdecl
+  exact lowerAllAction_fn_mem_source_or_extra hlower hselected
+    (targetEnv_ofList_lookup_mem hlookup)
+
+/-- Every PAP admitted by the whole-pass compiler relation resolves to a
+declaration whose content-addressed metadata permits dynamic PAP entry.  The
+proof is origin-sensitive: source definitions expose the computed bit,
+recursors and generated functions are safe by construction, and externs are
+scalar-only. -/
+theorem lowerAllAction_compilerFunction_declPapSafe
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    {sourceFunction : IxIR0.Value} {address : Ixon.Address}
+    {arity : Nat} {captures : List IxIR0.Value}
+    (hrel : CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+      finalState sourceFunction address arity captures) :
+    ∃ declaration, ctx.decls address = some declaration ∧
+      declPapSafe declaration = true := by
+  cases hrel with
+  | @source relatedFunction baseFunction targetAddress targetArity
+      storedSources source hsrc heligible harity href happly hunder =>
+    cases source with
+    | defn result body =>
+      obtain ⟨hresult, hbody⟩ := heligible
+      obtain ⟨d, hdecl, _, _, _⟩ := hcontracts.decls.defn hsrc
+      obtain ⟨itemInitial, itemFinal, hrun, _⟩ :=
+        lowerAllAction_callable_decl_trace hlower htarget hsrc (by rfl)
+          hdecl
+      refine ⟨.fn d, hdecl, ?_⟩
+      exact lowerDecl_defn_papSafe_of_run hrun hresult hbody
+    | ctor tag ctorArity => exact heligible.elim
+    | recursor numArgs natLit rules =>
+      obtain ⟨d, hdecl, _, _, _⟩ := hcontracts.decls.recursor hsrc
+      obtain ⟨itemInitial, itemFinal, hrun, _⟩ :=
+        lowerAllAction_callable_decl_trace hlower htarget hsrc (by rfl)
+          hdecl
+      refine ⟨.fn d, hdecl, ?_⟩
+      exact lowerDecl_recursor_papSafe_of_run hrun
+    | extern externArity =>
+      have hdecl := hcontracts.decls.extern hsrc
+      exact ⟨.extern externArity, hdecl, rfl⟩
+  | @wrapper relatedFunction baseFunction storedSources memo hmember hsrc
+      href happly hunder =>
+    refine ⟨ctorWrapperDecl memo.source memo.tag memo.arity,
+      hrepresented.wrapper hmember, ?_⟩
+    simp [ctorWrapperDecl, declPapSafe]
+  | lifted hlifted =>
+    obtain ⟨sourceEnv, expr, selected, supplied, hliftCode, _, _, _, _⟩ :=
+      hlifted
+    obtain ⟨fuel, bodyInitial, generated, code, _, _, _, hmember⟩ :=
+      hliftCode
+    refine ⟨.fn
+        ⟨(liftCaptureIndices sourceEnv.length expr).length + lamArity expr,
+          .shared, true, code⟩,
+      hrepresented.decl hmember, rfl⟩
+
+/-- At one evaluator index, every source-backed callable emitted by an
+actual whole-pass run satisfies its semantic function contract using only
+the mutually recursive semantic contracts below that index. -/
+theorem lowerAllAction_sourceFnValuePreservesAt_within_below
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel limit : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hvalues : CompilerValueContractsBelow
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit) :
+    SourceFnValuePreservesAt
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx limit := by
+  intro address source worlds result d sourceFunction
+    hsrc hsignature hdecl href
+  obtain ⟨itemInitial, itemFinal, hrun, hextends⟩ :=
+    lowerAllAction_callable_decl_trace hlower htarget hsrc hsignature hdecl
+  cases source with
+  | defn sourceResult body =>
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    cases compilerFuel with
+    | zero =>
+      simp only [lowerDecl] at hrun
+      obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+        trackedBindRun_ok_inv hrun
+      exact (trackedThrowRun_not_ok (by
+        simpa [lowerFnBody] using hbodyRun)).elim
+    | succ bodyFuel =>
+      have hadmissible := lowerDecl_defn_parameterDropsAdmissible hrun
+      intro store store' args value sourceArgs sourceValue sourceRest rest
+        hlength hargs happlies hframe hown hcodeRun
+      exact lowerDecl_defn_valuePreservesAt_within_below
+        (compilerFuel := bodyFuel) (limit := limit)
+        henv hrepresented hcontracts hvalues hsrc href hadmissible
+        (by simpa [Nat.succ_eq_add_one] using hrun) hextends
+        hlength hargs happlies hframe hown hcodeRun
+  | ctor tag arity =>
+    simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    intro store store' args value sourceArgs sourceValue sourceRest rest
+      hlength hargs happlies hframe hown hcodeRun
+    exact lowerDecl_recursor_valuePreservesAt_within_below
+      (compilerFuel := compilerFuel) (limit := limit)
+      henv hrepresented hcontracts hvalues hsrc hdecl href hrun hextends
+      hlength hargs happlies hframe hown hcodeRun
+  | extern arity =>
+    simp [sourceCallableSignature] at hsignature
+
+/-- Seal the actual whole-pass declaration and `applyGo` producers by strong
+evaluator-fuel induction.  Generated lifted functions and constructor
+wrappers need no separate semantic environment: their exact compiler
+provenance is reconstructed inside the application producer. -/
+theorem lowerAllAction_compilerValueContracts
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx) :
+    CompilerValueContracts
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx (IxIR0.Env.ofList decls) ctx := by
+  apply compilerValueContracts_of_below_step hextern
+  intro limit hvalues
+  constructor
+  · exact lowerAllAction_sourceFnValuePreservesAt_within_below
+      henv hlower htarget hrepresented hcontracts hvalues
+  · exact applyValuePreservesAt_within_below
+      henv hrepresented hcontracts hvalues
+
+/-- Whole-main value agreement with semantic compiler contracts constructed
+from this very whole-pass output.  Only ownership contracts and the explicit
+extern-oracle compatibility boundary remain as semantic premises. -/
+theorem lowerAllAction_main_value_graph_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx} {sourceFuel targetFuel : Nat}
+    {sourceValue : IxIR0.Value} {targetStore : Store}
+    {targetValue : RVal}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hsource : IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue)
+    (htargetRun : runMain ctx mainCode targetFuel =
+      .ok (targetStore, targetValue)) :
+    Sim.ValueGraph
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      targetStore sourceValue targetValue := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  exact lowerAllAction_main_value_graph henv hlower hrepresented
+    hcontracts hvalues hsource htargetRun
+
+/-- Public semantic forward simulation after the semantic contract seal.
+Target-run existence remains deliberately separate as the progress premise;
+all value-agreement contracts now come from the actual compiler output. -/
+theorem lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed
+    {sourceCtx : IxIR0.Ctx}
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat}
+    {initial finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (henv : sourceCtx.env = IxIR0.Env.ofList decls)
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run initial =
+        .ok (targetDecls, mainCode) finalState)
+    (htargetDecls : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (hcontracts : CompilerContracts (IxIR0.Env.ofList decls) ctx)
+    (hextern : ExternValueContract
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls) finalState)
+      sourceCtx ctx)
+    (hprogress : ∀ {sourceFuel sourceValue},
+      IxIR0.eval sourceCtx sourceFuel [] main = .ok sourceValue →
+      ∃ targetFuel targetStore targetValue,
+        runMain ctx mainCode targetFuel = .ok (targetStore, targetValue)) :
+    SemanticForwardSimulation sourceCtx ctx main mainCode
+      (CompilerFunctionRel sourceCtx (IxIR0.Env.ofList decls)
+        finalState) := by
+  have hvalues := lowerAllAction_compilerValueContracts
+    henv hlower htargetDecls hrepresented hcontracts hextern
+  intro sourceFuel sourceValue hsource
+  exact lowerAllAction_semanticForwardSimulation_of_targetProgress
+    henv hlower hrepresented hcontracts hvalues hprogress hsource
+
+/-- Package the exact declaration shape and callable contract of a generated
+constructor wrapper. -/
+theorem ctorWrapper_ownershipContract (ctx : Ctx)
+    (source : Ixon.Address) (tag arity : Nat) :
+    ∃ d, ctorWrapperDecl source tag arity = .fn d ∧
+      d.result = .shared ∧
+      FnOwnershipContract ctx d (List.replicate d.arity .shared) := by
+  refine ⟨⟨arity, .shared, true,
+      .letOp (.alloc .shared (ctorIdOf source tag)
+        (descendingVars arity).toArray) (.ret (.var 0))⟩, rfl, rfl, ?_⟩
+  exact ctorWrapper_fnOwnershipContract ctx source tag arity
+
+/-! ### Ownership from generated-declaration provenance -/
+
+/-- Every operationally provenanced generated function satisfies its exact
+all-shared ownership transformer at the current evaluator index. -/
+theorem GeneratedDeclProvenance.fnPreservesAt
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env}
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit)
+    {state : LowSt} (hrepresented : ExtraRepresented ctx state)
+    {address : Ixon.Address} {d : FnDef}
+    (hprovenance : GeneratedDeclProvenance src state (address, .fn d)) :
+    d.result = .shared ∧
+      FnOwnershipPreservesAt ctx d
+        (List.replicate d.arity .shared) limit := by
+  cases hprovenance with
+  | inl hwrapper =>
+    obtain ⟨wrapperAddress, source, tag, arity, hitem⟩ := hwrapper
+    have haddress : address = wrapperAddress := congrArg Prod.fst hitem
+    have hdecl : (Decl.fn d) = ctorWrapperDecl source tag arity :=
+      congrArg Prod.snd hitem
+    subst address
+    simp only [ctorWrapperDecl] at hdecl
+    have hd : d =
+        ⟨arity, .shared, true,
+          .letOp (.alloc .shared (ctorIdOf source tag)
+            (descendingVars arity).toArray) (.ret (.var 0))⟩ :=
+      Decl.fn.inj hdecl
+    subst d
+    exact ⟨rfl,
+      (ctorWrapper_fnOwnershipContract ctx source tag arity).preserves⟩
+  | inr hlifted =>
+    obtain ⟨generatedAddress, entryCount, expr, bodyFuel, bodyInitial,
+      generated, code, hitem, hpositive, hsafe, hbodyRun, hgenerated,
+      hmember⟩ := hlifted
+    have haddress : address = generatedAddress := congrArg Prod.fst hitem
+    have hdecl : Decl.fn d = .fn
+        ⟨(liftCaptureIndices entryCount expr).length + lamArity expr,
+          .shared, true, code⟩ := congrArg Prod.snd hitem
+    subst address
+    have hd : d =
+        ⟨(liftCaptureIndices entryCount expr).length + lamArity expr,
+          .shared, true, code⟩ := Decl.fn.inj hdecl
+    subst d
+    have hbodyRepresented : ExtraRepresented ctx generated :=
+      hrepresented.of_extends hgenerated
+    have hmodes := papSafe_lamUses_eq_replicate hsafe
+    have hadmissible : ParameterDropsAdmissible (lamUses expr)
+        (fun index => countUses index (stripLams expr)) := by
+      rw [hmodes]
+      exact parameterDropsAdmissible_replicate_many _ _
+    have hselected : ∀ index, index < entryCount →
+        decide (0 < countUses index expr) =
+          (countUses ((lamUses expr).length + index)
+            (stripLams expr) != 0) := by
+      intro index _
+      rw [lamUses_length]
+      rw [← countUses_eq_stripLams_shift expr index]
+      cases countUses index expr <;> rfl
+    have hshared : (lamUses expr).map worldOfUses =
+        List.replicate (lamUses expr).length .shared := by
+      rw [hmodes]
+      simp [worldOfUses]
+    cases bodyFuel with
+    | zero =>
+      exact (trackedThrowRun_not_ok
+        (by simpa [lowerFnBody] using hbodyRun)).elim
+    | succ innerFuel =>
+      have hbodyRun' :
+          (lowerFnBody src (innerFuel + 1)
+            (let captures := (List.range entryCount).filter
+                (fun index => countUses index expr > 0)
+             ⟨parameterEntries captures.length (lamUses expr)
+                  (fun index => countUses index (stripLams expr)) ++
+                selectedEntriesFrom
+                  (fun index => countUses index expr > 0)
+                  (fun index => countUses ((lamUses expr).length + index)
+                    (stripLams expr))
+                  (List.range entryCount) 0,
+              captures.length + (lamUses expr).length⟩)
+            (let captures := (List.range entryCount).filter
+                (fun index => countUses index expr > 0)
+             parameterDrops captures.length (lamUses expr)
+                (fun index => countUses index (stripLams expr)))
+            .shared (stripLams expr)).run bodyInitial =
+              .ok code generated := by
+        simpa [liftedBodyVEnv, liftedBodyDrops, liftCaptureIndices,
+          lamUses_length] using hbodyRun
+      have hpreserves : FnOwnershipPreservesAt ctx
+          ⟨(liftCaptureIndices entryCount expr).length +
+              (lamUses expr).length,
+            .shared, true, code⟩
+          (List.replicate
+            ((liftCaptureIndices entryCount expr).length +
+              (lamUses expr).length) .shared) limit := by
+        exact lowerFnBody_liftedEntries_preservesAt
+          (fuel := innerFuel) (state := bodyInitial)
+          (finalState := generated) (code := code)
+          happly hdecls entryCount (lamUses expr) (stripLams expr)
+          (fun index => countUses index expr > 0)
+          hadmissible hselected (by simpa [lamUses_length] using hpositive)
+          hshared hbodyRun' hbodyRepresented
+      refine ⟨rfl, ?_⟩
+      rw [lamUses_length] at hpreserves
+      exact hpreserves
+
+/-- A provenanced extension from the empty compiler state supplies the
+generated-function half of one contractive compiler step. -/
+theorem ExtraProvenanceExtends.extraFnPreservesAt_of_empty
+    {ctx : Ctx} {limit : Nat} {src : IxIR0.Env} {state : LowSt}
+    (hprovenance : ExtraProvenanceExtends src ({} : LowSt) state)
+    (hrepresented : ExtraRepresented ctx state)
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow src ctx limit) :
+    ExtraFnPreservesAt ctx state limit := by
+  intro address d hmember
+  exact (hprovenance.provenance_of_empty hmember).fnPreservesAt
+    happly hdecls hrepresented
+
+/-- Generated result worlds are fixed by provenance alone, independently of
+the semantic evaluator index. -/
+theorem ExtraProvenanceExtends.extraFnResultsShared_of_empty
+    {src : IxIR0.Env} {state : LowSt}
+    (hprovenance : ExtraProvenanceExtends src ({} : LowSt) state) :
+    ExtraFnResultsShared state := by
+  intro address d hmember
+  have horigin := hprovenance.provenance_of_empty hmember
+  cases horigin with
+  | inl hwrapper =>
+    obtain ⟨wrapperAddress, source, tag, arity, hitem⟩ := hwrapper
+    have hdecl : Decl.fn d = ctorWrapperDecl source tag arity :=
+      congrArg Prod.snd hitem
+    simp only [ctorWrapperDecl] at hdecl
+    exact congrArg FnDef.result (Decl.fn.inj hdecl)
+  | inr hlifted =>
+    obtain ⟨generatedAddress, entryCount, expr, bodyFuel, bodyInitial,
+      generated, code, hitem, _⟩ := hlifted
+    have hdecl : Decl.fn d = .fn
+        ⟨(liftCaptureIndices entryCount expr).length + lamArity expr,
+          .shared, true, code⟩ := congrArg Prod.snd hitem
+    exact congrArg FnDef.result (Decl.fn.inj hdecl)
+
+/-- At one evaluator index, every source-backed function emitted by an
+actual whole-program lowering run satisfies its ownership transformer from
+the three strictly-smaller contract environments. -/
+theorem lowerAllAction_sourceFnPreservesAt
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel limit : Nat}
+    {finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hrepresented : ExtraRepresented ctx finalState)
+    (happly : ApplyOwnershipContractBelow ctx limit)
+    (hdecls : SourceDeclContractsBelow
+      (IxIR0.Env.ofList decls) ctx limit) :
+    SourceFnPreservesAt (IxIR0.Env.ofList decls) ctx limit := by
+  intro address source worlds result d hsrc hsignature hdecl
+  obtain ⟨itemInitial, itemFinal, hrun, hextends⟩ :=
+    lowerAllAction_callable_decl_trace hlower htarget
+      hsrc hsignature hdecl
+  have hitemRepresented : ExtraRepresented ctx itemFinal :=
+    hrepresented.of_extends hextends
+  cases source with
+  | defn sourceResult body =>
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      cases compilerFuel with
+      | zero =>
+          simp only [lowerDecl] at hrun
+          obtain ⟨code, bodyState, hbodyRun, _⟩ :=
+            trackedBindRun_ok_inv hrun
+          exact (trackedThrowRun_not_ok (by
+            simpa [lowerFnBody] using hbodyRun)).elim
+      | succ bodyFuel =>
+          intro store store' args value rest hlength hown hcodeRun
+          exact lowerDecl_defn_preservesAt
+            (fuel := bodyFuel) happly hdecls
+            (lowerDecl_defn_parameterDropsAdmissible hrun)
+            (by simpa [Nat.succ_eq_add_one] using hrun)
+            hitemRepresented hlength hown hcodeRun
+  | ctor tag arity =>
+      simp [sourceCallableSignature] at hsignature
+  | recursor numArgs natLit rules =>
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      obtain ⟨self, hselfDecl, _, hself⟩ :=
+        hdecls.recursorCurrentSelf hsrc
+      have hsame : self = d := by
+        have heq : some (Decl.fn self) = some (Decl.fn d) :=
+          hselfDecl.symm.trans hdecl
+        exact Decl.fn.inj (Option.some.inj heq)
+      subst self
+      intro store store' args value rest hlength hown hcodeRun
+      exact lowerDecl_recursor_preservesAt
+        happly hdecls hself hrun hitemRepresented
+        hlength hown hcodeRun
+  | extern arity =>
+      simp [sourceCallableSignature] at hsignature
+
+/-- A successful whole-program lowering from the empty compiler state seals
+all ownership contracts of its exact raw target context. Source declarations,
+lifted functions, constructor wrappers, and dynamic PAP entry are closed by
+one evaluator-fuel induction; no generated-function contract is assumed. -/
+theorem lowerAllAction_compilerContracts
+    {decls : List (Ixon.Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {compilerFuel : Nat} {finalState : LowSt}
+    {targetDecls : List (Ixon.Address × Decl)} {mainCode : Code}
+    {ctx : Ctx}
+    (hlower :
+      (lowerAllAction decls main mainWorld compilerFuel).run {} =
+        .ok (targetDecls, mainCode) finalState)
+    (htarget : ∀ {targetAddress targetDecl},
+      (targetAddress, targetDecl) ∈ targetDecls →
+      ctx.decls targetAddress = some targetDecl)
+    (hselected : SourceCallableRowsSelected decls)
+    (hctx : ctx.decls = Env.ofList targetDecls) :
+    CompilerContracts (IxIR0.Env.ofList decls) ctx ∧
+      ExtraFnContracts ctx finalState := by
+  have hprovenance := lowerAllAction_extraProvenance_empty hlower
+  have hrepresented : ExtraRepresented ctx finalState :=
+    lowerAllAction_extraRepresented hlower fun hmember =>
+      htarget (lowerAllAction_extra_mem_result hlower hmember)
+  apply compilerContracts_of_source_extra_below_step
+    (lowerAllAction_sourceDeclLayout hlower htarget)
+    (lowerAllAction_sourcePapSafe hlower htarget)
+    hprovenance.extraFnResultsShared_of_empty
+    (lowerAllAction_fnDeclCovered hlower hselected hctx)
+  intro limit hdecls _ happly
+  exact ⟨lowerAllAction_sourceFnPreservesAt
+      hlower htarget hrepresented happly hdecls,
+    hprovenance.extraFnPreservesAt_of_empty
+      hrepresented happly hdecls⟩
+
+end Ix.Compiler.IxIR1.LowerSim
diff --git a/Ix/Compiler/IxIR1/Mono.lean b/Ix/Compiler/IxIR1/Mono.lean
new file mode 100644
index 000000000..cdbca429a
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Mono.lean
@@ -0,0 +1,1160 @@
+import Ix.Compiler.Fuel
+import Ix.Compiler.IxIR1.Eval
+
+/-!
+# Fuel monotonicity for the IxIR₁ evaluator
+
+Successful state-passing evaluation is stable under raising fuel for all
+eight mutually recursive evaluator functions. Every reached non-fuel error
+is stable as well. These are the target-side composition principles needed
+by progress and settlement proofs: independently constructed observations
+can be raised to one common fuel without changing their result.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+private theorem bindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem bindErr {error α β : Type} (err : error)
+    (next : α → Except error β) :
+    ((Except.error err : Except error α) >>= next) = .error err := rfl
+
+private def MonoAt (fuel : Nat) : Prop :=
+  (∀ ctx cur store env code out,
+    runCode ctx fuel cur store env code = .ok out →
+      runCode ctx (fuel + 1) cur store env code = .ok out) ∧
+  (∀ ctx cur store env op out,
+    runOp ctx fuel cur store env op = .ok out →
+      runOp ctx (fuel + 1) cur store env op = .ok out) ∧
+  (∀ ctx address args store out,
+    invoke ctx fuel address args store = .ok out →
+      invoke ctx (fuel + 1) address args store = .ok out) ∧
+  (∀ ctx store function args out,
+    applyGo ctx fuel store function args = .ok out →
+      applyGo ctx (fuel + 1) store function args = .ok out) ∧
+  (∀ ctx store value out,
+    dropVal ctx fuel store value = .ok out →
+      dropVal ctx (fuel + 1) store value = .ok out) ∧
+  (∀ ctx store values out,
+    dropMany ctx fuel store values = .ok out →
+      dropMany ctx (fuel + 1) store values = .ok out) ∧
+  (∀ ctx store value out,
+    dropUVal ctx fuel store value = .ok out →
+      dropUVal ctx (fuel + 1) store value = .ok out) ∧
+  (∀ ctx store values out,
+    dropManyU ctx fuel store values = .ok out →
+      dropManyU ctx (fuel + 1) store values = .ok out)
+
+private theorem monoAt : ∀ fuel, MonoAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code out h
+      rw [runCode.eq_def] at h
+      simp at h
+    · intro ctx cur store env op out h
+      rw [runOp.eq_def] at h
+      simp at h
+    · intro ctx address args store out h
+      rw [invoke.eq_def] at h
+      simp at h
+    · intro ctx store function args out h
+      rw [applyGo.eq_def] at h
+      simp at h
+    · intro ctx store value out h
+      rw [dropVal.eq_def] at h
+      simp at h
+    · intro ctx store values out h
+      rw [dropMany.eq_def] at h
+      simp at h
+    · intro ctx store value out h
+      rw [dropUVal.eq_def] at h
+      simp at h
+    · intro ctx store values out h
+      rw [dropManyU.eq_def] at h
+      simp at h
+  | succ fuel ih =>
+    obtain ⟨ihCode, ihOp, ihInvoke, ihApply, ihDrop, ihDropMany,
+      ihDropU, ihDropManyU⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code out h
+      cases code with
+      | ret atom =>
+        rw [runCode.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | letOp op rest =>
+        rw [runCode.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hop : runOp ctx fuel cur store env op with
+        | error err =>
+          rw [hop, bindErr] at h
+          contradiction
+        | ok opOut =>
+          rcases opOut with ⟨middle, value⟩
+          rw [hop, bindOk] at h
+          rw [ihOp _ _ _ _ _ _ hop, bindOk]
+          exact ihCode _ _ _ _ _ _ h
+      | case scrut peelNat alts =>
+        rw [runCode.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hscrut : resolveAtom env scrut with
+        | error err =>
+          rw [hscrut, bindErr] at h
+          contradiction
+        | ok scrutValue =>
+          rw [hscrut, bindOk] at h
+          rw [bindOk]
+          cases scrutValue with
+          | loc loc =>
+            dsimp only at h ⊢
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at h
+            | some box =>
+              simp only [hbox] at h ⊢
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity args => simp at h
+                | ctorN cid fields =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == cid.cidx) with
+                  | none => simp [halt] at h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases hsize : fields.size != fieldCount
+                      · simp only [halt, hsize, Bool.false_eq_true,
+                          if_false] at h ⊢
+                        exact ihCode _ _ _ _ _ _ h
+                      · simp [halt, hsize] at h
+          | lit literal =>
+            cases literal with
+            | str string => simp at h
+            | nat value =>
+              cases hpeel : peelNat with
+              | false => simp [hpeel] at h
+              | true =>
+                cases value with
+                | zero =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == 0) with
+                  | none => simp [hpeel, halt] at h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at h ⊢
+                        exact ihCode _ _ _ _ _ _ h
+                      | succ fieldCount => simp [hpeel, halt] at h
+                | succ value =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == 1) with
+                  | none => simp [hpeel, halt] at h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero => simp [hpeel, halt] at h
+                      | succ fieldCount =>
+                        cases fieldCount with
+                        | zero =>
+                          simp only [hpeel, halt] at h ⊢
+                          exact ihCode _ _ _ _ _ _ h
+                        | succ fieldCount => simp [hpeel, halt] at h
+          | erased => simp at h
+    · intro ctx cur store env op out h
+      cases op with
+      | pure atom =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | alloc world cid args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | reuse target cid args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | free target =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | dup target =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | drop target =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases htarget : resolveAtom env target with
+        | error err =>
+          rw [htarget, bindErr] at h
+          contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          rw [bindOk]
+          cases targetValue with
+          | loc loc =>
+            dsimp only at h ⊢
+            cases hdrop : dropVal ctx fuel store (.loc loc) with
+            | error err =>
+              rw [hdrop, bindErr] at h
+              contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at h
+              rw [ihDrop _ _ _ _ hdrop, bindOk]
+              exact h
+          | lit literal => exact h
+          | erased => exact h
+      | dropU target =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases htarget : resolveAtom env target with
+        | error err =>
+          rw [htarget, bindErr] at h
+          contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          rw [bindOk]
+          cases targetValue with
+          | loc loc =>
+            dsimp only at h ⊢
+            cases hdrop : dropUVal ctx fuel store (.loc loc) with
+            | error err =>
+              rw [hdrop, bindErr] at h
+              contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at h
+              rw [ihDropU _ _ _ _ hdrop, bindOk]
+              exact h
+          | lit literal => exact h
+          | erased => exact h
+      | fetch target field =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | call address args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hargs : resolveAtoms env args with
+        | error err =>
+          rw [hargs, bindErr] at h
+          contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          rw [bindOk]
+          exact ihInvoke _ _ _ _ _ h
+      | callSelf args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hargs : resolveAtoms env args with
+        | error err =>
+          rw [hargs, bindErr] at h
+          contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          rw [bindOk]
+          cases harity : values.length != cur.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h ⊢
+            cases hcode : runCode ctx fuel cur store values.reverse
+                cur.body with
+            | error err =>
+              rw [hcode, bindErr] at h
+              contradiction
+            | ok result =>
+              rw [hcode, bindOk] at h
+              rw [ihCode _ _ _ _ _ _ hcode, bindOk]
+              exact h
+          · simp [harity] at h
+      | papp address args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | apply function args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hfunction : resolveAtom env function with
+        | error err =>
+          rw [hfunction, bindErr] at h
+          contradiction
+        | ok functionValue =>
+          rw [hfunction, bindOk] at h
+          rw [bindOk]
+          cases hargs : resolveAtoms env args with
+          | error err =>
+            rw [hargs, bindErr] at h
+            contradiction
+          | ok values =>
+            rw [hargs, bindOk] at h
+            rw [bindOk]
+            exact ihApply _ _ _ _ _ h
+      | extern address args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+    · intro ctx address args store out h
+      rw [invoke.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases hdecl : ctx.decls address with
+      | none => simp [hdecl] at h
+      | some decl =>
+        simp only [hdecl] at h ⊢
+        cases decl with
+        | extern arity => exact h
+        | fn d =>
+          dsimp only at h ⊢
+          cases harity : args.length != d.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h ⊢
+            cases hcode : runCode ctx fuel d store args.reverse d.body with
+            | error err =>
+              rw [hcode, bindErr] at h
+              contradiction
+            | ok result =>
+              rw [hcode, bindOk] at h
+              rw [ihCode _ _ _ _ _ _ hcode, bindOk]
+              exact h
+          · simp [harity] at h
+    · intro ctx store function args out h
+      rw [applyGo.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases function with
+      | lit literal => simp at h
+      | erased =>
+        cases hdrop : dropMany ctx fuel store args with
+        | error err =>
+          rw [hdrop, bindErr] at h
+          contradiction
+        | ok dropped =>
+          rw [hdrop, bindOk] at h
+          rw [ihDropMany _ _ _ _ hdrop, bindOk]
+          exact h
+      | loc loc =>
+        dsimp only at h ⊢
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at h
+        | some box =>
+          simp only [hbox] at h ⊢
+          cases box with
+          | mk world rc node =>
+            cases node with
+            | ctorN cid fields => simp at h
+            | papN address arity captured =>
+              dsimp only at h ⊢
+              cases hdup : dupVals store captured.toList with
+              | error err =>
+                rw [hdup, bindErr] at h
+                contradiction
+              | ok duplicated =>
+                rw [hdup, bindOk] at h
+                rw [bindOk]
+                cases hdrop : dropVal ctx fuel duplicated (.loc loc) with
+                | error err =>
+                  rw [hdrop, bindErr] at h
+                  contradiction
+                | ok ready =>
+                  rw [hdrop, bindOk] at h
+                  rw [ihDrop _ _ _ _ hdrop, bindOk]
+                  by_cases hunder :
+                      (captured.toList ++ args).length < arity
+                  · simp only [hunder] at h ⊢
+                    exact h
+                  · simp only [hunder] at h ⊢
+                    cases hexact :
+                        (captured.toList ++ args).length == arity
+                    · simp only [hexact, Bool.false_eq_true,
+                        if_false] at h ⊢
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at h
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false => simp [hdecl, hpapsafe] at h
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at h ⊢
+                          cases hinvoke : invoke ctx fuel address
+                              ((captured.toList ++ args).take arity) ready with
+                          | error err =>
+                            rw [hinvoke, bindErr] at h
+                            contradiction
+                          | ok called =>
+                            rcases called with ⟨calledStore, calledValue⟩
+                            rw [hinvoke, bindOk] at h
+                            rw [ihInvoke _ _ _ _ _ hinvoke, bindOk]
+                            exact ihApply _ _ _ _ _ h
+                    · simp only [hexact, if_true] at h ⊢
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at h
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false => simp [hdecl, hpapsafe] at h
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at h ⊢
+                          exact ihInvoke _ _ _ _ _ h
+    · intro ctx store value out h
+      rw [dropVal.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases value with
+      | lit literal => exact h
+      | erased => exact h
+      | loc loc =>
+        dsimp only at h ⊢
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at h
+        | some box =>
+          simp only [hbox] at h ⊢
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => simp at h
+            | shared =>
+              cases hrc : rc == 1
+              · simp only [hrc, Bool.false_eq_true, if_false] at h ⊢
+                exact h
+              · simp only [hrc, if_true] at h ⊢
+                cases node with
+                | ctorN cid fields =>
+                  exact ihDropMany _ _ _ _ h
+                | papN address arity args =>
+                  exact ihDropMany _ _ _ _ h
+    · intro ctx store values out h
+      rw [dropMany.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases values with
+      | nil => exact h
+      | cons value rest =>
+        dsimp only at h ⊢
+        cases hdrop : dropVal ctx fuel store value with
+        | error err =>
+          rw [hdrop, bindErr] at h
+          contradiction
+        | ok middle =>
+          rw [hdrop, bindOk] at h
+          rw [ihDrop _ _ _ _ hdrop, bindOk]
+          exact ihDropMany _ _ _ _ h
+    · intro ctx store value out h
+      rw [dropUVal.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases value with
+      | lit literal => exact h
+      | erased => exact h
+      | loc loc =>
+        dsimp only at h ⊢
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at h
+        | some box =>
+          simp only [hbox] at h ⊢
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => simp at h
+            | unique =>
+              cases node with
+              | papN address arity args => simp at h
+              | ctorN cid fields =>
+                exact ihDropManyU _ _ _ _ h
+    · intro ctx store values out h
+      rw [dropManyU.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases values with
+      | nil => exact h
+      | cons value rest =>
+        dsimp only at h ⊢
+        cases hdrop : dropUVal ctx fuel store value with
+        | error err =>
+          rw [hdrop, bindErr] at h
+          contradiction
+        | ok middle =>
+          rw [hdrop, bindOk] at h
+          rw [ihDropU _ _ _ _ hdrop, bindOk]
+          exact ihDropManyU _ _ _ _ h
+
+/-! ## Persistence of terminal evaluator errors -/
+
+/-- Any reached non-fuel error is stable when one unit of evaluator fuel is
+added.  The mutual proof covers stuck, memory, and closed-world failures that
+may surface through calls, higher-order application, or recursive release. -/
+private def ErrorMonoAt (fuel : Nat) (error : Err) : Prop :=
+  (∀ ctx cur store env code,
+    runCode ctx fuel cur store env code = .error (error) →
+      runCode ctx (fuel + 1) cur store env code = .error (error)) ∧
+  (∀ ctx cur store env op,
+    runOp ctx fuel cur store env op = .error (error) →
+      runOp ctx (fuel + 1) cur store env op = .error (error)) ∧
+  (∀ ctx address args store,
+    invoke ctx fuel address args store = .error (error) →
+      invoke ctx (fuel + 1) address args store = .error (error)) ∧
+  (∀ ctx store function args,
+    applyGo ctx fuel store function args = .error (error) →
+      applyGo ctx (fuel + 1) store function args = .error (error)) ∧
+  (∀ ctx store value,
+    dropVal ctx fuel store value = .error (error) →
+      dropVal ctx (fuel + 1) store value = .error (error)) ∧
+  (∀ ctx store values,
+    dropMany ctx fuel store values = .error (error) →
+      dropMany ctx (fuel + 1) store values = .error (error)) ∧
+  (∀ ctx store value,
+    dropUVal ctx fuel store value = .error (error) →
+      dropUVal ctx (fuel + 1) store value = .error (error)) ∧
+  (∀ ctx store values,
+    dropManyU ctx fuel store values = .error (error) →
+      dropManyU ctx (fuel + 1) store values = .error (error))
+
+private theorem errorMonoAt : ∀ fuel error, error ≠ .fuel → ErrorMonoAt fuel error := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    intro error hnonfuel
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code h
+      rw [runCode.eq_def] at h
+      simp_all
+    · intro ctx cur store env op h
+      rw [runOp.eq_def] at h
+      simp_all
+    · intro ctx address args store h
+      rw [invoke.eq_def] at h
+      simp_all
+    · intro ctx store function args h
+      rw [applyGo.eq_def] at h
+      simp_all
+    · intro ctx store value h
+      rw [dropVal.eq_def] at h
+      simp_all
+    · intro ctx store values h
+      rw [dropMany.eq_def] at h
+      simp_all
+    · intro ctx store value h
+      rw [dropUVal.eq_def] at h
+      simp_all
+    · intro ctx store values h
+      rw [dropManyU.eq_def] at h
+      simp_all
+  | succ fuel ih =>
+    intro error hnonfuel
+    obtain ⟨ihCode, ihOp, ihInvoke, ihApply, ihDrop, ihDropMany,
+      ihDropU, ihDropManyU⟩ := ih error hnonfuel
+    obtain ⟨monoCode, monoOp, monoInvoke, monoApply, monoDrop,
+      monoDropMany, monoDropU, monoDropManyU⟩ := monoAt fuel
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code h
+      cases code with
+      | ret atom =>
+        rw [runCode.eq_def] at h ⊢
+        dsimp only at h ⊢
+        exact h
+      | letOp op rest =>
+        rw [runCode.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hop : runOp ctx fuel cur store env op with
+        | error err =>
+          rw [hop, bindErr] at h
+          have herr : err = error := Except.error.inj h
+          subst err
+          rw [ihOp _ _ _ _ _ hop, bindErr]
+        | ok opOut =>
+          rcases opOut with ⟨middle, value⟩
+          rw [hop, bindOk] at h
+          rw [monoOp _ _ _ _ _ _ hop, bindOk]
+          exact ihCode _ _ _ _ _ h
+      | case scrut peelNat alts =>
+        rw [runCode.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hscrut : resolveAtom env scrut with
+        | error err =>
+          rw [hscrut, bindErr] at h
+          rw [bindErr]
+          exact h
+        | ok scrutValue =>
+          rw [hscrut, bindOk] at h
+          rw [bindOk]
+          cases scrutValue with
+          | loc loc =>
+            dsimp only at h ⊢
+            cases hbox : store.get? loc with
+            | none => simp only [hbox] at h ⊢; exact h
+            | some box =>
+              simp only [hbox] at h ⊢
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity args => exact h
+                | ctorN cid fields =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == cid.cidx) with
+                  | none => simp only [halt] at h ⊢; exact h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases hsize : fields.size != fieldCount
+                      · simp only [halt, hsize, Bool.false_eq_true,
+                          if_false] at h ⊢
+                        exact ihCode _ _ _ _ _ h
+                      · simp only [halt, hsize, if_true] at h ⊢
+                        exact h
+          | lit literal =>
+            cases literal with
+            | str string => exact h
+            | nat value =>
+              cases hpeel : peelNat with
+              | false => simp only [hpeel] at h ⊢; exact h
+              | true =>
+                cases value with
+                | zero =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == 0) with
+                  | none => simp only [hpeel, halt] at h ⊢; exact h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at h ⊢
+                        exact ihCode _ _ _ _ _ h
+                      | succ fieldCount =>
+                        simp only [hpeel, halt] at h ⊢
+                        exact h
+                | succ value =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == 1) with
+                  | none => simp only [hpeel, halt] at h ⊢; exact h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at h ⊢
+                        exact h
+                      | succ fieldCount =>
+                        cases fieldCount with
+                        | zero =>
+                          simp only [hpeel, halt] at h ⊢
+                          exact ihCode _ _ _ _ _ h
+                        | succ fieldCount =>
+                          simp only [hpeel, halt] at h ⊢
+                          exact h
+          | erased => exact h
+    · intro ctx cur store env op h
+      cases op with
+      | pure atom =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | alloc world cid args =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | reuse target cid args =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | free target =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | dup target =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | drop target =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases htarget : resolveAtom env target with
+        | error err =>
+          rw [htarget, bindErr] at h
+          rw [bindErr]
+          exact h
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          rw [bindOk]
+          cases targetValue with
+          | loc loc =>
+            dsimp only at h ⊢
+            cases hdrop : dropVal ctx fuel store (.loc loc) with
+            | error err =>
+              rw [hdrop, bindErr] at h
+              have herr : err = error := Except.error.inj h
+              subst err
+              rw [ihDrop _ _ _ hdrop, bindErr]
+            | ok dropped =>
+              rw [hdrop, bindOk] at h
+              contradiction
+          | lit literal => exact h
+          | erased => exact h
+      | dropU target =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases htarget : resolveAtom env target with
+        | error err =>
+          rw [htarget, bindErr] at h
+          rw [bindErr]
+          exact h
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          rw [bindOk]
+          cases targetValue with
+          | loc loc =>
+            dsimp only at h ⊢
+            cases hdrop : dropUVal ctx fuel store (.loc loc) with
+            | error err =>
+              rw [hdrop, bindErr] at h
+              have herr : err = error := Except.error.inj h
+              subst err
+              rw [ihDropU _ _ _ hdrop, bindErr]
+            | ok dropped =>
+              rw [hdrop, bindOk] at h
+              contradiction
+          | lit literal => exact h
+          | erased => exact h
+      | fetch target field =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | call address args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hargs : resolveAtoms env args with
+        | error err =>
+          rw [hargs, bindErr] at h
+          rw [bindErr]
+          exact h
+        | ok values =>
+          rw [hargs, bindOk] at h
+          rw [bindOk]
+          exact ihInvoke _ _ _ _ h
+      | callSelf args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hargs : resolveAtoms env args with
+        | error err =>
+          rw [hargs, bindErr] at h
+          rw [bindErr]
+          exact h
+        | ok values =>
+          rw [hargs, bindOk] at h
+          rw [bindOk]
+          cases harity : values.length != cur.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h ⊢
+            cases hcode : runCode ctx fuel cur store values.reverse
+                cur.body with
+            | error err =>
+              rw [hcode, bindErr] at h
+              have herr : err = error := Except.error.inj h
+              subst err
+              rw [ihCode _ _ _ _ _ hcode, bindErr]
+            | ok result =>
+              rw [hcode, bindOk] at h
+              rw [monoCode _ _ _ _ _ _ hcode, bindOk]
+              exact h
+          · simp only [harity, if_true] at h ⊢
+            exact h
+      | papp address args =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | apply function args =>
+        rw [runOp.eq_def] at h ⊢
+        dsimp only at h ⊢
+        cases hfunction : resolveAtom env function with
+        | error err =>
+          rw [hfunction, bindErr] at h
+          rw [bindErr]
+          exact h
+        | ok functionValue =>
+          rw [hfunction, bindOk] at h
+          rw [bindOk]
+          cases hargs : resolveAtoms env args with
+          | error err =>
+            rw [hargs, bindErr] at h
+            rw [bindErr]
+            exact h
+          | ok values =>
+            rw [hargs, bindOk] at h
+            rw [bindOk]
+            exact ihApply _ _ _ _ h
+      | extern address args =>
+        rw [runOp.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+    · intro ctx address args store h
+      rw [invoke.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases hdecl : ctx.decls address with
+      | none => simp only [hdecl] at h ⊢; exact h
+      | some decl =>
+        simp only [hdecl] at h ⊢
+        cases decl with
+        | extern arity => exact h
+        | fn d =>
+          dsimp only at h ⊢
+          cases harity : args.length != d.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h ⊢
+            cases hcode : runCode ctx fuel d store args.reverse d.body with
+            | error err =>
+              rw [hcode, bindErr] at h
+              have herr : err = error := Except.error.inj h
+              subst err
+              rw [ihCode _ _ _ _ _ hcode, bindErr]
+            | ok result =>
+              rw [hcode, bindOk] at h
+              rw [monoCode _ _ _ _ _ _ hcode, bindOk]
+              exact h
+          · simp only [harity, if_true] at h ⊢
+            exact h
+    · intro ctx store function args h
+      rw [applyGo.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases function with
+      | lit literal => exact h
+      | erased =>
+        cases hdrop : dropMany ctx fuel store args with
+        | error err =>
+          rw [hdrop, bindErr] at h
+          have herr : err = error := Except.error.inj h
+          subst err
+          rw [ihDropMany _ _ _ hdrop, bindErr]
+        | ok dropped =>
+          rw [hdrop, bindOk] at h
+          contradiction
+      | loc loc =>
+        dsimp only at h ⊢
+        cases hbox : store.get? loc with
+        | none => simp only [hbox] at h ⊢; exact h
+        | some box =>
+          simp only [hbox] at h ⊢
+          cases box with
+          | mk world rc node =>
+            cases node with
+            | ctorN cid fields => exact h
+            | papN address arity captured =>
+              dsimp only at h ⊢
+              cases hdup : dupVals store captured.toList with
+              | error err =>
+                rw [hdup, bindErr] at h
+                rw [bindErr]
+                exact h
+              | ok duplicated =>
+                rw [hdup, bindOk] at h
+                rw [bindOk]
+                cases hdrop : dropVal ctx fuel duplicated (.loc loc) with
+                | error err =>
+                  rw [hdrop, bindErr] at h
+                  have herr : err = error := Except.error.inj h
+                  subst err
+                  rw [ihDrop _ _ _ hdrop, bindErr]
+                | ok ready =>
+                  rw [hdrop, bindOk] at h
+                  rw [monoDrop _ _ _ _ hdrop, bindOk]
+                  by_cases hunder :
+                      (captured.toList ++ args).length < arity
+                  · simp only [hunder] at h ⊢
+                    exact h
+                  · simp only [hunder] at h ⊢
+                    cases hexact :
+                        (captured.toList ++ args).length == arity
+                    · simp only [hexact, Bool.false_eq_true,
+                        if_false] at h ⊢
+                      cases hdecl : ctx.decls address with
+                      | none => simp only [hdecl] at h ⊢; exact h
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false =>
+                          simp only [hdecl, hpapsafe,
+                            Bool.false_eq_true, if_false] at h ⊢
+                          exact h
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at h ⊢
+                          cases hinvoke : invoke ctx fuel address
+                              ((captured.toList ++ args).take arity) ready with
+                          | error err =>
+                            rw [hinvoke, bindErr] at h
+                            have herr : err = error := Except.error.inj h
+                            subst err
+                            rw [ihInvoke _ _ _ _ hinvoke, bindErr]
+                          | ok called =>
+                            rcases called with ⟨calledStore, calledValue⟩
+                            rw [hinvoke, bindOk] at h
+                            rw [monoInvoke _ _ _ _ _ hinvoke, bindOk]
+                            exact ihApply _ _ _ _ h
+                    · simp only [hexact, if_true] at h ⊢
+                      cases hdecl : ctx.decls address with
+                      | none => simp only [hdecl] at h ⊢; exact h
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false =>
+                          simp only [hdecl, hpapsafe,
+                            Bool.false_eq_true, if_false] at h ⊢
+                          exact h
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at h ⊢
+                          exact ihInvoke _ _ _ _ h
+    · intro ctx store value h
+      rw [dropVal.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases value with
+      | lit literal => exact h
+      | erased => exact h
+      | loc loc =>
+        dsimp only at h ⊢
+        cases hbox : store.get? loc with
+        | none => simp only [hbox] at h ⊢; exact h
+        | some box =>
+          simp only [hbox] at h ⊢
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => exact h
+            | shared =>
+              cases hrc : rc == 1
+              · simp only [hrc, Bool.false_eq_true, if_false] at h ⊢
+                exact h
+              · simp only [hrc, if_true] at h ⊢
+                cases node with
+                | ctorN cid fields =>
+                  exact ihDropMany _ _ _ h
+                | papN address arity args =>
+                  exact ihDropMany _ _ _ h
+    · intro ctx store values h
+      rw [dropMany.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases values with
+      | nil => exact h
+      | cons value rest =>
+        dsimp only at h ⊢
+        cases hdrop : dropVal ctx fuel store value with
+        | error err =>
+          rw [hdrop, bindErr] at h
+          have herr : err = error := Except.error.inj h
+          subst err
+          rw [ihDrop _ _ _ hdrop, bindErr]
+        | ok middle =>
+          rw [hdrop, bindOk] at h
+          rw [monoDrop _ _ _ _ hdrop, bindOk]
+          exact ihDropMany _ _ _ h
+    · intro ctx store value h
+      rw [dropUVal.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases value with
+      | lit literal => exact h
+      | erased => exact h
+      | loc loc =>
+        dsimp only at h ⊢
+        cases hbox : store.get? loc with
+        | none => simp only [hbox] at h ⊢; exact h
+        | some box =>
+          simp only [hbox] at h ⊢
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => exact h
+            | unique =>
+              cases node with
+              | papN address arity args => exact h
+              | ctorN cid fields =>
+                exact ihDropManyU _ _ _ h
+    · intro ctx store values h
+      rw [dropManyU.eq_def] at h ⊢
+      dsimp only at h ⊢
+      cases values with
+      | nil => exact h
+      | cons value rest =>
+        dsimp only at h ⊢
+        cases hdrop : dropUVal ctx fuel store value with
+        | error err =>
+          rw [hdrop, bindErr] at h
+          have herr : err = error := Except.error.inj h
+          subst err
+          rw [ihDropU _ _ _ hdrop, bindErr]
+        | ok middle =>
+          rw [hdrop, bindOk] at h
+          rw [monoDropU _ _ _ _ hdrop, bindOk]
+          exact ihDropManyU _ _ _ h
+/-- Successful code execution is stable under raising fuel. -/
+theorem runCode_mono {ctx : Ctx} {fuel larger : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {code : Code}
+    {out : Store × RVal} (hle : fuel ≤ larger)
+    (hrun : runCode ctx fuel cur store env code = .ok out) :
+    runCode ctx larger cur store env code = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).1 _ _ _ _ _ _ h) hle hrun
+
+/-- Every reached non-fuel code error persists when fuel is raised. -/
+theorem runCode_error_mono {ctx : Ctx} {fuel larger : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {code : Code} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : runCode ctx fuel cur store env code = .error error) :
+    runCode ctx larger cur store env code = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h => (errorMonoAt current error hne).1 _ _ _ _ _ h)
+    hle hrun
+
+/-- A dynamic memory error in code execution persists when fuel is raised.
+Fuel may reveal more execution, but it cannot repair an already-reached
+memory-discipline failure. -/
+theorem runCode_mem_mono {ctx : Ctx} {fuel larger : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {code : Code} {message : String}
+    (hle : fuel ≤ larger)
+    (hrun : runCode ctx fuel cur store env code = .error (.mem message)) :
+    runCode ctx larger cur store env code = .error (.mem message) :=
+  runCode_error_mono hle (by simp) hrun
+
+/-- Successful primitive-operation execution is stable under raising fuel. -/
+theorem runOp_mono {ctx : Ctx} {fuel larger : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {op : Op}
+    {out : Store × RVal} (hle : fuel ≤ larger)
+    (hrun : runOp ctx fuel cur store env op = .ok out) :
+    runOp ctx larger cur store env op = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.1 _ _ _ _ _ _ h) hle hrun
+
+/-- Every reached non-fuel primitive-operation error persists when fuel is
+raised. -/
+theorem runOp_error_mono {ctx : Ctx} {fuel larger : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {op : Op} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : runOp ctx fuel cur store env op = .error error) :
+    runOp ctx larger cur store env op = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h => (errorMonoAt current error hne).2.1 _ _ _ _ _ h)
+    hle hrun
+
+theorem runOp_mem_mono {ctx : Ctx} {fuel larger : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {op : Op} {message : String}
+    (hle : fuel ≤ larger)
+    (hrun : runOp ctx fuel cur store env op = .error (.mem message)) :
+    runOp ctx larger cur store env op = .error (.mem message) :=
+  runOp_error_mono hle (by simp) hrun
+
+/-- Successful known invocation is stable under raising fuel. -/
+theorem invoke_mono {ctx : Ctx} {fuel larger : Nat}
+    {address : Ixon.Address}
+    {args : List RVal} {store : Store} {out : Store × RVal}
+    (hle : fuel ≤ larger)
+    (hrun : invoke ctx fuel address args store = .ok out) :
+    invoke ctx larger address args store = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.2.1 _ _ _ _ _ h) hle hrun
+
+theorem invoke_error_mono {ctx : Ctx} {fuel larger : Nat}
+    {address : Ixon.Address} {args : List RVal} {store : Store}
+    {error : Err} (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : invoke ctx fuel address args store = .error error) :
+    invoke ctx larger address args store = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h => (errorMonoAt current error hne).2.2.1 _ _ _ _ h)
+    hle hrun
+
+/-- Successful higher-order application is stable under raising fuel. -/
+theorem applyGo_mono {ctx : Ctx} {fuel larger : Nat} {store : Store}
+    {function : RVal} {args : List RVal} {out : Store × RVal}
+    (hle : fuel ≤ larger)
+    (hrun : applyGo ctx fuel store function args = .ok out) :
+    applyGo ctx larger store function args = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.2.2.1 _ _ _ _ _ h) hle hrun
+
+theorem applyGo_error_mono {ctx : Ctx} {fuel larger : Nat} {store : Store}
+    {function : RVal} {args : List RVal} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : applyGo ctx fuel store function args = .error error) :
+    applyGo ctx larger store function args = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h =>
+      (errorMonoAt current error hne).2.2.2.1 _ _ _ _ h)
+    hle hrun
+
+/-- Successful shared deep drop is stable under raising fuel. -/
+theorem dropVal_mono {ctx : Ctx} {fuel larger : Nat} {store : Store}
+    {value : RVal} {out : Store} (hle : fuel ≤ larger)
+    (hrun : dropVal ctx fuel store value = .ok out) :
+    dropVal ctx larger store value = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.2.2.2.1 _ _ _ _ h) hle hrun
+
+theorem dropVal_error_mono {ctx : Ctx} {fuel larger : Nat}
+    {store : Store} {value : RVal} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : dropVal ctx fuel store value = .error error) :
+    dropVal ctx larger store value = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h =>
+      (errorMonoAt current error hne).2.2.2.2.1 _ _ _ h)
+    hle hrun
+
+theorem dropMany_mono {ctx : Ctx} {fuel larger : Nat} {store : Store}
+    {values : List RVal} {out : Store} (hle : fuel ≤ larger)
+    (hrun : dropMany ctx fuel store values = .ok out) :
+    dropMany ctx larger store values = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.2.2.2.2.1 _ _ _ _ h) hle hrun
+
+theorem dropMany_error_mono {ctx : Ctx} {fuel larger : Nat}
+    {store : Store} {values : List RVal} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : dropMany ctx fuel store values = .error error) :
+    dropMany ctx larger store values = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h =>
+      (errorMonoAt current error hne).2.2.2.2.2.1 _ _ _ h)
+    hle hrun
+
+/-- Successful unique deep free is stable under raising fuel. -/
+theorem dropUVal_mono {ctx : Ctx} {fuel larger : Nat} {store : Store}
+    {value : RVal} {out : Store} (hle : fuel ≤ larger)
+    (hrun : dropUVal ctx fuel store value = .ok out) :
+    dropUVal ctx larger store value = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.2.2.2.2.2.1 _ _ _ _ h) hle hrun
+
+theorem dropUVal_error_mono {ctx : Ctx} {fuel larger : Nat}
+    {store : Store} {value : RVal} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : dropUVal ctx fuel store value = .error error) :
+    dropUVal ctx larger store value = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h =>
+      (errorMonoAt current error hne).2.2.2.2.2.2.1 _ _ _ h)
+    hle hrun
+
+theorem dropManyU_mono {ctx : Ctx} {fuel larger : Nat} {store : Store}
+    {values : List RVal} {out : Store} (hle : fuel ≤ larger)
+    (hrun : dropManyU ctx fuel store values = .ok out) :
+    dropManyU ctx larger store values = .ok out := by
+  exact fuel_mono_of_succ
+    (fun current h => (monoAt current).2.2.2.2.2.2.2 _ _ _ _ h) hle hrun
+
+theorem dropManyU_error_mono {ctx : Ctx} {fuel larger : Nat}
+    {store : Store} {values : List RVal} {error : Err}
+    (hle : fuel ≤ larger) (hne : error ≠ .fuel)
+    (hrun : dropManyU ctx fuel store values = .error error) :
+    dropManyU ctx larger store values = .error error := by
+  exact fuel_mono_of_succ
+    (fun current h =>
+      (errorMonoAt current error hne).2.2.2.2.2.2.2 _ _ _ h)
+    hle hrun
+
+/-- Top-level specialization of `runCode_mono`. -/
+theorem runMain_mono {ctx : Ctx} {code : Code} {fuel larger : Nat}
+    {out : Store × RVal} (hle : fuel ≤ larger)
+    (hrun : runMain ctx code fuel = .ok out) :
+    runMain ctx code larger = .ok out :=
+  runCode_mono hle hrun
+
+/-- Top-level specialization of `runCode_error_mono`. -/
+theorem runMain_error_mono {ctx : Ctx} {code : Code}
+    {fuel larger : Nat} {error : Err} (hle : fuel ≤ larger)
+    (hne : error ≠ .fuel)
+    (hrun : runMain ctx code fuel = .error error) :
+    runMain ctx code larger = .error error :=
+  runCode_error_mono hle hne hrun
+
+/-- Reached ordinary stuckness persists when evaluator fuel is raised. -/
+theorem runMain_stuck_mono {ctx : Ctx} {code : Code}
+    {fuel larger : Nat} {message : String} (hle : fuel ≤ larger)
+    (hrun : runMain ctx code fuel = .error (.stuck message)) :
+    runMain ctx code larger = .error (.stuck message) :=
+  runMain_error_mono hle (by simp) hrun
+
+/-- A reached closed-world lookup failure persists when fuel is raised. -/
+theorem runMain_unknownRef_mono {ctx : Ctx} {code : Code}
+    {fuel larger : Nat} {address : Ixon.Address} (hle : fuel ≤ larger)
+    (hrun : runMain ctx code fuel = .error (.unknownRef address)) :
+    runMain ctx code larger = .error (.unknownRef address) :=
+  runMain_error_mono hle (by simp) hrun
+
+/-- Top-level specialization of `runCode_mem_mono`. -/
+theorem runMain_mem_mono {ctx : Ctx} {code : Code}
+    {fuel larger : Nat} {message : String} (hle : fuel ≤ larger)
+    (hrun : runMain ctx code fuel = .error (.mem message)) :
+    runMain ctx code larger = .error (.mem message) :=
+  runCode_mem_mono hle hrun
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/MutualBlock.lean b/Ix/Compiler/IxIR1/MutualBlock.lean
new file mode 100644
index 000000000..cfe45c73d
--- /dev/null
+++ b/Ix/Compiler/IxIR1/MutualBlock.lean
@@ -0,0 +1,1240 @@
+import Ix.Compiler.IxIR1.Decode
+import Ix.Compiler.IxIR1.Readdress
+
+/-!
+# Cycle-safe IxIR₁ block identities
+
+Ordinary IxIR₁ declaration hashes can be computed only after every addressed
+dependency is known.  A source-backed function and one of its generated
+closures may instead form a genuine address cycle.  This module gives such a
+strongly connected component a finite canonical spelling: edges within the
+ordered block use local indices, external edges retain full addresses, the
+symbolic block is hashed once, and executable member keys are independently
+derived from that block identity and member index.
+
+The module is deliberately independent of SCC discovery.  It is the checked
+artifact boundary consumed by a later whole-program pass: strict canonical
+decoding, scope validation, collision checks, materialization, and an erased
+semantic audit.  Native BLAKE3 calls remain confined to compiled producers,
+ingress, and tests.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR
+
+namespace MutualBlock
+
+/-! ## Symbolic block syntax -/
+
+/-- An address-bearing edge in a canonical block. -/
+inductive Ref where
+  | local (index : Nat)
+  | external (address : Address)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Constructor identity with a symbolic block edge. -/
+structure CtorId where
+  block : Ref
+  indIdx : Nat
+  cidx : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- IxIR₁ operations with every static address represented symbolically. -/
+inductive Op where
+  | pure (atom : Atom)
+  | alloc (world : Owned) (cid : CtorId) (args : Array Atom)
+  | reuse (target : Atom) (cid : CtorId) (args : Array Atom)
+  | free (target : Atom)
+  | dup (target : Atom)
+  | drop (target : Atom)
+  | dropU (target : Atom)
+  | fetch (target : Atom) (field : Nat)
+  | call (function : Ref) (args : Array Atom)
+  | callSelf (args : Array Atom)
+  | papp (function : Ref) (args : Array Atom)
+  | apply (function : Atom) (args : Array Atom)
+  | extern (function : Ref) (args : Array Atom)
+
+mutual
+
+/-- A symbolic case alternative. -/
+inductive Alt where
+  | mk (cidx fields : Nat) (body : Code)
+
+/-- Symbolic IxIR₁ code. -/
+inductive Code where
+  | ret (atom : Atom)
+  | letOp (operation : Op) (rest : Code)
+  | case (scrutinee : Atom) (peelNat : Bool) (alternatives : Array Alt)
+
+end
+
+/-- A saturated symbolic function. -/
+structure FnDef where
+  arity : Nat
+  result : Owned
+  papSafe : Bool
+  body : Code
+
+/-- A declaration in a symbolic IxIR₁ block. -/
+inductive Decl where
+  | fn (definition : FnDef)
+  | extern (arity : Nat)
+
+/-! ## Temporary-name abstraction and materialization -/
+
+/-- First zero-based position of an address in an ordered key list. -/
+def localIndex? (keys : List Address) (address : Address) : Option Nat :=
+  let rec loop : Nat → List Address → Option Nat
+    | _, [] => none
+    | index, key :: rest =>
+        if key == address then some index else loop (index + 1) rest
+  loop 0 keys
+
+namespace Ref
+
+def abstract (keys : List Address) (address : Address) : Ref :=
+  match localIndex? keys address with
+  | some index => .local index
+  | none => .external address
+
+def externalReferences : Ref → List Address
+  | .local _ => []
+  | .external address => [address]
+
+def wellScoped (memberCount : Nat) : Ref → Bool
+  | .local index => index < memberCount
+  | .external _ => true
+
+def materialize (memberKeys : Array Address) : Ref → Except String Address
+  | .local index =>
+      match memberKeys[index]? with
+      | some address => .ok address
+      | none => .error s!"IxIR1 block local reference {index} is out of range"
+  | .external address => .ok address
+
+end Ref
+
+namespace CtorId
+
+def abstract (keys : List Address) (cid : IxIR1.CtorId) : CtorId :=
+  { block := Ref.abstract keys cid.block
+    indIdx := cid.indIdx
+    cidx := cid.cidx }
+
+def materialize (memberKeys : Array Address)
+    (cid : CtorId) : Except String IxIR1.CtorId :=
+  return ⟨← cid.block.materialize memberKeys, cid.indIdx, cid.cidx⟩
+
+def externalReferences (cid : CtorId) : List Address :=
+  cid.block.externalReferences
+
+def wellScoped (memberCount : Nat) (cid : CtorId) : Bool :=
+  cid.block.wellScoped memberCount
+
+end CtorId
+
+namespace Op
+
+def abstract (keys : List Address) : IxIR1.Op → Op
+  | .pure atom => .pure atom
+  | .alloc world cid args => .alloc world (CtorId.abstract keys cid) args
+  | .reuse target cid args => .reuse target (CtorId.abstract keys cid) args
+  | .free target => .free target
+  | .dup target => .dup target
+  | .drop target => .drop target
+  | .dropU target => .dropU target
+  | .fetch target field => .fetch target field
+  | .call function args => .call (Ref.abstract keys function) args
+  | .callSelf args => .callSelf args
+  | .papp function args => .papp (Ref.abstract keys function) args
+  | .apply function args => .apply function args
+  | .extern function args => .extern (Ref.abstract keys function) args
+
+def materialize (memberKeys : Array Address) : Op → Except String IxIR1.Op
+  | .pure atom => .ok (.pure atom)
+  | .alloc world cid args =>
+      return .alloc world (← cid.materialize memberKeys) args
+  | .reuse target cid args =>
+      return .reuse target (← cid.materialize memberKeys) args
+  | .free target => .ok (.free target)
+  | .dup target => .ok (.dup target)
+  | .drop target => .ok (.drop target)
+  | .dropU target => .ok (.dropU target)
+  | .fetch target field => .ok (.fetch target field)
+  | .call function args =>
+      return .call (← function.materialize memberKeys) args
+  | .callSelf args => .ok (.callSelf args)
+  | .papp function args =>
+      return .papp (← function.materialize memberKeys) args
+  | .apply function args => .ok (.apply function args)
+  | .extern function args =>
+      return .extern (← function.materialize memberKeys) args
+
+def externalReferences : Op → List Address
+  | .alloc _ cid _ | .reuse _ cid _ => cid.externalReferences
+  | .call function _ | .papp function _ | .extern function _ =>
+      function.externalReferences
+  | _ => []
+
+def wellScoped (memberCount : Nat) : Op → Bool
+  | .alloc _ cid _ | .reuse _ cid _ => cid.wellScoped memberCount
+  | .call function _ | .papp function _ | .extern function _ =>
+      function.wellScoped memberCount
+  | _ => true
+
+end Op
+
+mutual
+
+def Code.abstract (keys : List Address) : IxIR1.Code → Code
+  | .ret atom => .ret atom
+  | .letOp operation rest =>
+      .letOp (Op.abstract keys operation) (Code.abstract keys rest)
+  | .case scrutinee peelNat alternatives =>
+      .case scrutinee peelNat (alternatives.map (Alt.abstract keys))
+
+def Alt.abstract (keys : List Address) : IxIR1.Alt → Alt
+  | .mk cidx fields body => .mk cidx fields (Code.abstract keys body)
+
+end
+
+mutual
+
+def Code.materialize (memberKeys : Array Address) :
+    Code → Except String IxIR1.Code
+  | .ret atom => .ok (.ret atom)
+  | .letOp operation rest =>
+      return .letOp (← operation.materialize memberKeys)
+        (← Code.materialize memberKeys rest)
+  | .case scrutinee peelNat alternatives =>
+      return .case scrutinee peelNat
+        (← alternatives.mapM (Alt.materialize memberKeys))
+
+def Alt.materialize (memberKeys : Array Address) :
+    Alt → Except String IxIR1.Alt
+  | .mk cidx fields body =>
+      return .mk cidx fields (← Code.materialize memberKeys body)
+
+end
+
+mutual
+
+def Code.externalReferences : Code → List Address
+  | .ret _ => []
+  | .letOp operation rest =>
+      operation.externalReferences ++ Code.externalReferences rest
+  | .case _ _ alternatives =>
+      AltList.externalReferences alternatives.toList
+
+def Alt.externalReferences : Alt → List Address
+  | .mk _ _ body => Code.externalReferences body
+
+def AltList.externalReferences : List Alt → List Address
+  | [] => []
+  | alternative :: rest =>
+      Alt.externalReferences alternative ++ AltList.externalReferences rest
+
+end
+
+mutual
+
+def Code.wellScoped (memberCount : Nat) : Code → Bool
+  | .ret _ => true
+  | .letOp operation rest =>
+      operation.wellScoped memberCount && Code.wellScoped memberCount rest
+  | .case _ _ alternatives =>
+      AltList.wellScoped memberCount alternatives.toList
+
+def Alt.wellScoped (memberCount : Nat) : Alt → Bool
+  | .mk _ _ body => Code.wellScoped memberCount body
+
+def AltList.wellScoped (memberCount : Nat) : List Alt → Bool
+  | [] => true
+  | alternative :: rest =>
+      Alt.wellScoped memberCount alternative &&
+        AltList.wellScoped memberCount rest
+
+end
+
+namespace FnDef
+
+def abstract (keys : List Address) (definition : IxIR1.FnDef) : FnDef :=
+  { arity := definition.arity
+    result := definition.result
+    papSafe := definition.papSafe
+    body := Code.abstract keys definition.body }
+
+def materialize (memberKeys : Array Address)
+    (definition : FnDef) : Except String IxIR1.FnDef :=
+  return ⟨definition.arity, definition.result, definition.papSafe,
+    ← definition.body.materialize memberKeys⟩
+
+def externalReferences (definition : FnDef) : List Address :=
+  definition.body.externalReferences
+
+def wellScoped (memberCount : Nat) (definition : FnDef) : Bool :=
+  definition.body.wellScoped memberCount
+
+end FnDef
+
+namespace Decl
+
+def abstract (keys : List Address) : IxIR1.Decl → Decl
+  | .fn definition => .fn (FnDef.abstract keys definition)
+  | .extern arity => .extern arity
+
+def materialize (memberKeys : Array Address) :
+    Decl → Except String IxIR1.Decl
+  | .fn definition => return .fn (← definition.materialize memberKeys)
+  | .extern arity => .ok (.extern arity)
+
+def externalReferences : Decl → List Address
+  | .fn definition => definition.externalReferences
+  | .extern _ => []
+
+def wellScoped (memberCount : Nat) : Decl → Bool
+  | .fn definition => definition.wellScoped memberCount
+  | .extern _ => true
+
+end Decl
+
+/-- Abstract a transiently keyed ordered block. Keys affect only local-edge
+classification and never enter the canonical bytes. -/
+def abstractMembers (members : List (Address × IxIR1.Decl)) : List Decl :=
+  let keys := members.map (·.1)
+  members.map fun member => Decl.abstract keys member.2
+
+/-! ## Executable structural equality -/
+
+namespace Op
+
+def structurallyEq : Op → Op → Bool
+  | .pure left, .pure right => left == right
+  | .alloc lw lc la, .alloc rw rc ra =>
+      lw == rw && lc == rc && la == ra
+  | .reuse lt lc la, .reuse rt rc ra =>
+      lt == rt && lc == rc && la == ra
+  | .free left, .free right
+  | .dup left, .dup right
+  | .drop left, .drop right
+  | .dropU left, .dropU right => left == right
+  | .fetch lt lf, .fetch rt rf => lt == rt && lf == rf
+  | .call lf la, .call rf ra
+  | .papp lf la, .papp rf ra
+  | .extern lf la, .extern rf ra => lf == rf && la == ra
+  | .callSelf left, .callSelf right => left == right
+  | .apply lf la, .apply rf ra => lf == rf && la == ra
+  | _, _ => false
+
+theorem structurallyEq_eq_true_iff (left right : Op) :
+    structurallyEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [structurallyEq, beq_iff_eq, and_assoc]
+
+end Op
+
+mutual
+
+def Code.structurallyEq : Code → Code → Bool
+  | .ret left, .ret right => left == right
+  | .letOp leftOp leftRest, .letOp rightOp rightRest =>
+      Op.structurallyEq leftOp rightOp &&
+        Code.structurallyEq leftRest rightRest
+  | .case ls lp la, .case rs rp ra =>
+      ls == rs && lp == rp &&
+        AltList.structurallyEq la.toList ra.toList
+  | _, _ => false
+
+def Alt.structurallyEq : Alt → Alt → Bool
+  | .mk lc lf lb, .mk rc rf rb =>
+      lc == rc && lf == rf && Code.structurallyEq lb rb
+
+def AltList.structurallyEq : List Alt → List Alt → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      Alt.structurallyEq left right &&
+        AltList.structurallyEq leftRest rightRest
+  | _, _ => false
+
+end
+
+
+mutual
+
+theorem Code.structurallyEq_eq_true_iff (left right : Code) :
+    Code.structurallyEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [Code.structurallyEq, Op.structurallyEq_eq_true_iff,
+      Code.structurallyEq_eq_true_iff,
+      AltList.structurallyEq_eq_true_iff, beq_iff_eq, and_assoc]
+
+theorem Alt.structurallyEq_eq_true_iff (left right : Alt) :
+    Alt.structurallyEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [Alt.structurallyEq, Code.structurallyEq_eq_true_iff,
+    beq_iff_eq, and_assoc]
+
+theorem AltList.structurallyEq_eq_true_iff (left right : List Alt) :
+    AltList.structurallyEq left right = true ↔ left = right := by
+  cases left with
+  | nil => cases right <;> simp [AltList.structurallyEq]
+  | cons left leftRest =>
+      cases right with
+      | nil => simp [AltList.structurallyEq]
+      | cons right rightRest =>
+          simp [AltList.structurallyEq,
+            Alt.structurallyEq_eq_true_iff,
+            AltList.structurallyEq_eq_true_iff]
+
+end
+
+
+namespace FnDef
+
+def structurallyEq (left right : FnDef) : Bool :=
+  left.arity == right.arity && left.result == right.result &&
+    left.papSafe == right.papSafe &&
+    Code.structurallyEq left.body right.body
+
+theorem structurallyEq_eq_true_iff (left right : FnDef) :
+    structurallyEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [structurallyEq, Code.structurallyEq_eq_true_iff,
+    beq_iff_eq, and_assoc]
+
+end FnDef
+
+namespace Decl
+
+def structurallyEq : Decl → Decl → Bool
+  | .fn left, .fn right => FnDef.structurallyEq left right
+  | .extern left, .extern right => left == right
+  | _, _ => false
+
+theorem structurallyEq_eq_true_iff (left right : Decl) :
+    structurallyEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [structurallyEq, FnDef.structurallyEq_eq_true_iff,
+      beq_iff_eq]
+
+end Decl
+
+/-! ## Canonical bytes and identities -/
+
+namespace Ref
+
+def bytes : Ref → ByteArray
+  | .local index => Encoding.tag 0 ++ Encoding.nat index
+  | .external address => Encoding.tag 1 ++ Encoding.address address
+
+end Ref
+
+namespace CtorId
+
+def bytes (cid : CtorId) : ByteArray :=
+  cid.block.bytes ++ Encoding.nat cid.indIdx ++ Encoding.nat cid.cidx
+
+end CtorId
+
+namespace Op
+
+def bytes : Op → ByteArray
+  | .pure atom => Encoding.tag 0 ++ IxIR1.Atom.bytes atom
+  | .alloc world cid args =>
+      Encoding.tag 1 ++ Encoding.tag world.toBits ++ cid.bytes ++
+        Encoding.array IxIR1.Atom.bytes args
+  | .reuse target cid args =>
+      Encoding.tag 2 ++ IxIR1.Atom.bytes target ++ cid.bytes ++
+        Encoding.array IxIR1.Atom.bytes args
+  | .free target => Encoding.tag 3 ++ IxIR1.Atom.bytes target
+  | .dup target => Encoding.tag 4 ++ IxIR1.Atom.bytes target
+  | .drop target => Encoding.tag 5 ++ IxIR1.Atom.bytes target
+  | .dropU target => Encoding.tag 6 ++ IxIR1.Atom.bytes target
+  | .fetch target field =>
+      Encoding.tag 7 ++ IxIR1.Atom.bytes target ++ Encoding.nat field
+  | .call function args =>
+      Encoding.tag 8 ++ function.bytes ++
+        Encoding.array IxIR1.Atom.bytes args
+  | .callSelf args =>
+      Encoding.tag 9 ++ Encoding.array IxIR1.Atom.bytes args
+  | .papp function args =>
+      Encoding.tag 10 ++ function.bytes ++
+        Encoding.array IxIR1.Atom.bytes args
+  | .apply function args =>
+      Encoding.tag 11 ++ IxIR1.Atom.bytes function ++
+        Encoding.array IxIR1.Atom.bytes args
+  | .extern function args =>
+      Encoding.tag 12 ++ function.bytes ++
+        Encoding.array IxIR1.Atom.bytes args
+
+end Op
+
+mutual
+
+def Code.bytes : Code → ByteArray
+  | .ret atom => Encoding.tag 0 ++ IxIR1.Atom.bytes atom
+  | .letOp operation rest => Encoding.tag 1 ++ operation.bytes ++ rest.bytes
+  | .case scrutinee peelNat alternatives =>
+      Encoding.tag 2 ++ IxIR1.Atom.bytes scrutinee ++
+        Encoding.bool peelNat ++ Encoding.nat alternatives.size ++
+        AltList.bytes alternatives.toList
+
+def Alt.bytes : Alt → ByteArray
+  | .mk cidx fields body =>
+      Encoding.nat cidx ++ Encoding.nat fields ++ body.bytes
+
+def AltList.bytes : List Alt → ByteArray
+  | [] => ByteArray.empty
+  | head :: tail => head.bytes ++ AltList.bytes tail
+
+end
+
+
+namespace FnDef
+
+def bytes (definition : FnDef) : ByteArray :=
+  Encoding.nat definition.arity ++ Encoding.tag definition.result.toBits ++
+    Encoding.bool definition.papSafe ++ definition.body.bytes
+
+end FnDef
+
+namespace Decl
+
+def bytes : Decl → ByteArray
+  | .fn definition => Encoding.tag 0 ++ definition.bytes
+  | .extern arity => Encoding.tag 1 ++ Encoding.nat arity
+
+end Decl
+
+namespace Block
+
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/mutual-block/2" ++ Encoding.tag 0
+
+def preimage (members : List Decl) : ByteArray :=
+  addressDomain ++ Encoding.list Decl.bytes members
+
+def address (members : List Decl) : Address :=
+  Address.blake3 (preimage members)
+
+theorem address_eq_iff_preimage_eq (left right : List Decl)
+    (hcollision : Address.Blake3NoCollision (preimage left) (preimage right)) :
+    address left = address right ↔ preimage left = preimage right := by
+  constructor
+  · exact hcollision
+  · intro h
+    simp only [address]
+    rw [h]
+
+end Block
+
+namespace Member
+
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/mutual-member/1" ++ Encoding.tag 0
+
+def preimage (block : Address) (index : Nat) : ByteArray :=
+  addressDomain ++ Encoding.address block ++ Encoding.nat index
+
+def address (block : Address) (index : Nat) : Address :=
+  Address.blake3 (preimage block index)
+
+theorem address_eq_iff_preimage_eq (leftBlock rightBlock : Address)
+    (leftIndex rightIndex : Nat)
+    (hcollision : Address.Blake3NoCollision
+      (preimage leftBlock leftIndex) (preimage rightBlock rightIndex)) :
+    address leftBlock leftIndex = address rightBlock rightIndex ↔
+      preimage leftBlock leftIndex = preimage rightBlock rightIndex := by
+  constructor
+  · exact hcollision
+  · intro h
+    simp only [address]
+    rw [h]
+
+end Member
+
+/-! ## Strict block decoder -/
+
+open Ix.Compiler.IxIR.Decode
+open Ix.Compiler.Ixon
+
+def getRefTag : UInt8 → GetM Ref
+  | 0 => do return .local (← Decode.getNat)
+  | 1 => do return .external (← Decode.getAddress)
+  | tag => throw s!"IxIR1 block reference: invalid tag {tag}"
+
+def getRef : GetM Ref := do
+  getRefTag (← getU8)
+
+def getCtorId : GetM CtorId := do
+  return ⟨← getRef, ← Decode.getNat, ← Decode.getNat⟩
+
+def getOpTag : UInt8 → GetM Op
+  | 0 => do return .pure (← IxIR1.getAtom)
+  | 1 => do
+      let world ← IxIR0.getOwned
+      let cid ← getCtorId
+      return .alloc world cid (← Decode.getArray IxIR1.getAtom)
+  | 2 => do
+      let target ← IxIR1.getAtom
+      let cid ← getCtorId
+      return .reuse target cid (← Decode.getArray IxIR1.getAtom)
+  | 3 => do return .free (← IxIR1.getAtom)
+  | 4 => do return .dup (← IxIR1.getAtom)
+  | 5 => do return .drop (← IxIR1.getAtom)
+  | 6 => do return .dropU (← IxIR1.getAtom)
+  | 7 => do return .fetch (← IxIR1.getAtom) (← Decode.getNat)
+  | 8 => do return .call (← getRef) (← Decode.getArray IxIR1.getAtom)
+  | 9 => do return .callSelf (← Decode.getArray IxIR1.getAtom)
+  | 10 => do return .papp (← getRef) (← Decode.getArray IxIR1.getAtom)
+  | 11 => do return .apply (← IxIR1.getAtom) (← Decode.getArray IxIR1.getAtom)
+  | 12 => do return .extern (← getRef) (← Decode.getArray IxIR1.getAtom)
+  | tag => throw s!"IxIR1 block operation: invalid tag {tag}"
+
+def getOp : GetM Op := do
+  getOpTag (← getU8)
+
+def getAlt (recur : GetM Code) : GetM Alt := do
+  return .mk (← Decode.getNat) (← Decode.getNat) (← recur)
+
+def getCodeTag (recur : GetM Code) : UInt8 → GetM Code
+  | 0 => do return .ret (← IxIR1.getAtom)
+  | 1 => do return .letOp (← getOp) (← recur)
+  | 2 => do
+      let scrutinee ← IxIR1.getAtom
+      let peelNat ← Decode.getBool
+      return .case scrutinee peelNat (← Decode.getArray (getAlt recur))
+  | tag => throw s!"IxIR1 block code: invalid tag {tag}"
+
+def getCodeFuel : Nat → GetM Code
+  | 0 => throw "IxIR1 block code: recursion limit"
+  | fuel + 1 => do
+      getCodeTag (getCodeFuel fuel) (← getU8)
+
+def getCode : GetM Code := do
+  let state ← get
+  getCodeFuel (state.bytes.size + 1)
+
+def getFnDef : GetM FnDef := do
+  return ⟨← Decode.getNat, ← IxIR0.getOwned, ← Decode.getBool,
+    ← getCode⟩
+
+def getDeclTag : UInt8 → GetM Decl
+  | 0 => do return .fn (← getFnDef)
+  | 1 => do return .extern (← Decode.getNat)
+  | tag => throw s!"IxIR1 block declaration: invalid tag {tag}"
+
+def getDecl : GetM Decl := do
+  getDeclTag (← getU8)
+
+def getBlockPreimage : GetM (List Decl) := do
+  Decode.expectBytes Block.addressDomain
+  Decode.getList getDecl
+
+def Block.decodePreimage (bytes : ByteArray) : Except String (List Decl) :=
+  Decode.runCanonical getBlockPreimage Block.preimage bytes
+
+def Block.decodeArtifact (bytes : ByteArray) : Except String (List Decl) := do
+  let members ← Block.decodePreimage bytes
+  if members.isEmpty then
+    throw "IxIR1 mutual block must contain at least one member"
+  unless members.all (Decl.wellScoped members.length) do
+    throw "IxIR1 mutual block contains an out-of-range local reference"
+  return members
+
+/-! ### Cursor-relative decoder proofs -/
+
+theorem getRef_spec : ∀ target : Ref, GetSpec getRef target.bytes target
+  | .local index => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec index) Ref.local
+      have htotal := GetSpec.bind (next := getRefTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getRef, Ref.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .external address => by
+      have hpayload := Decode.getSpecMap
+        (Decode.getAddress_spec address) Ref.external
+      have htotal := GetSpec.bind (next := getRefTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getRef, Ref.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+theorem getCtorId_spec (cid : CtorId) :
+    GetSpec getCtorId cid.bytes cid := by
+  have hspec := Decode.getSpecMap3 (getRef_spec cid.block)
+    (Decode.getNat_spec cid.indIdx) (Decode.getNat_spec cid.cidx) CtorId.mk
+  simpa [getCtorId, CtorId.bytes] using hspec
+
+private theorem getAtomArray_spec (atoms : Array Atom) :
+    GetSpec (Decode.getArray IxIR1.getAtom)
+      (Encoding.array IxIR1.Atom.bytes atoms) atoms :=
+  Decode.getArray_spec IxIR1.getAtom IxIR1.Atom.bytes
+    IxIR1.getAtom_spec atoms
+
+theorem getOp_spec : ∀ operation : Op,
+    GetSpec getOp operation.bytes operation
+  | .pure atom => by
+      have hpayload := Decode.getSpecMap (IxIR1.getAtom_spec atom) Op.pure
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .alloc world cid args => by
+      have hpayload := Decode.getSpecMap3 (IxIR0.getOwned_spec world)
+        (getCtorId_spec cid) (getAtomArray_spec args) Op.alloc
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .reuse target cid args => by
+      have hpayload := Decode.getSpecMap3 (IxIR1.getAtom_spec target)
+        (getCtorId_spec cid) (getAtomArray_spec args) Op.reuse
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 2) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .free target => by
+      have hpayload := Decode.getSpecMap (IxIR1.getAtom_spec target) Op.free
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 3) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .dup target => by
+      have hpayload := Decode.getSpecMap (IxIR1.getAtom_spec target) Op.dup
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 4) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .drop target => by
+      have hpayload := Decode.getSpecMap (IxIR1.getAtom_spec target) Op.drop
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 5) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .dropU target => by
+      have hpayload := Decode.getSpecMap (IxIR1.getAtom_spec target) Op.dropU
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 6) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .fetch target field => by
+      have hpayload := Decode.getSpecMap2 (IxIR1.getAtom_spec target)
+        (Decode.getNat_spec field) Op.fetch
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 7) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .call function args => by
+      have hpayload := Decode.getSpecMap2 (getRef_spec function)
+        (getAtomArray_spec args) Op.call
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 8) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .callSelf args => by
+      have hpayload := Decode.getSpecMap (getAtomArray_spec args) Op.callSelf
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 9) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .papp function args => by
+      have hpayload := Decode.getSpecMap2 (getRef_spec function)
+        (getAtomArray_spec args) Op.papp
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 10) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .apply function args => by
+      have hpayload := Decode.getSpecMap2 (IxIR1.getAtom_spec function)
+        (getAtomArray_spec args) Op.apply
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 11) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .extern function args => by
+      have hpayload := Decode.getSpecMap2 (getRef_spec function)
+        (getAtomArray_spec args) Op.extern
+      have htotal := GetSpec.bind (next := getOpTag)
+        (Decode.getU8_tag_spec 12) hpayload
+      simpa only [getOp, Op.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+theorem AltList.bytes_eq_listBytes (alternatives : List Alt) :
+    AltList.bytes alternatives = Decode.listBytes Alt.bytes alternatives := by
+  induction alternatives with
+  | nil => rfl
+  | cons head tail ih => simp [AltList.bytes, Decode.listBytes, ih]
+
+theorem AltList.member_size_le {alternative : Alt}
+    {alternatives : List Alt} (hmember : alternative ∈ alternatives) :
+    alternative.bytes.size ≤ (AltList.bytes alternatives).size := by
+  induction alternatives with
+  | nil => simp at hmember
+  | cons head tail ih =>
+      simp only [List.mem_cons] at hmember
+      simp only [AltList.bytes, ByteArray.size_append]
+      rcases hmember with rfl | hmember
+      · omega
+      · have htail := ih hmember
+        omega
+
+theorem Alt.body_size_lt_bytes (cidx fields : Nat) (body : Code) :
+    body.bytes.size < (Alt.mk cidx fields body).bytes.size := by
+  simp only [Alt.bytes, ByteArray.size_append]
+  have hcidx := Decode.nat_size_pos cidx
+  have hfields := Decode.nat_size_pos fields
+  omega
+
+/-- Structural induction exposing every code body nested in an alternative
+array. -/
+theorem Code.nested_induction (property : Code → Prop)
+    (hret : ∀ atom, property (.ret atom))
+    (hlet : ∀ operation rest, property rest →
+      property (.letOp operation rest))
+    (hcase : ∀ scrutinee peelNat alternatives,
+      (∀ cidx fields body,
+        Alt.mk cidx fields body ∈ alternatives.toList → property body) →
+      property (.case scrutinee peelNat alternatives))
+    (code : Code) : property code := by
+  apply Code.rec
+    (motive_1 := fun alternative => match alternative with
+      | .mk _ _ body => property body)
+    (motive_2 := property)
+    (motive_3 := fun alternatives => ∀ cidx fields body,
+      Alt.mk cidx fields body ∈ alternatives.toList → property body)
+    (motive_4 := fun alternatives => ∀ cidx fields body,
+      Alt.mk cidx fields body ∈ alternatives → property body)
+    (mk := by intro cidx fields body hbody; exact hbody)
+    (ret := hret)
+    (letOp := by
+      intro operation rest hrest
+      exact hlet operation rest hrest)
+    (case := hcase)
+    (by intro alternatives halternatives; exact halternatives)
+    (by simp)
+    (by
+      intro head tail hhead htail cidx fields body hmember
+      simp only [List.mem_cons] at hmember
+      rcases hmember with hheadEq | htailMem
+      · cases hheadEq
+        exact hhead
+      · exact htail cidx fields body htailMem)
+
+theorem getCodeFuel_spec (code : Code) (fuel : Nat)
+    (hfuel : code.bytes.size < fuel) :
+    GetSpec (getCodeFuel fuel) code.bytes code := by
+  apply Code.nested_induction
+    (property := fun code => ∀ fuel, code.bytes.size < fuel →
+      GetSpec (getCodeFuel fuel) code.bytes code)
+    (code := code)
+  · intro atom fuel hfuel
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+        have hpayload := Decode.getSpecMap
+          (IxIR1.getAtom_spec atom) Code.ret
+        have htotal := GetSpec.bind
+          (next := getCodeTag (getCodeFuel fuel))
+          (Decode.getU8_tag_spec 0) hpayload
+        simpa only [getCodeFuel, Code.bytes, ByteArray.append_assoc,
+          ByteArray.append_empty] using htotal
+  · intro operation rest hrest fuel hfuel
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+        have hrestFuel : rest.bytes.size < fuel := by
+          simp only [Code.bytes, ByteArray.size_append,
+            Decode.tag_size] at hfuel
+          omega
+        have hpayload := Decode.getSpecMap2 (getOp_spec operation)
+          (hrest fuel hrestFuel) Code.letOp
+        have htotal := GetSpec.bind
+          (next := getCodeTag (getCodeFuel fuel))
+          (Decode.getU8_tag_spec 1) hpayload
+        simpa only [getCodeFuel, Code.bytes, ByteArray.append_assoc,
+          ByteArray.append_empty] using htotal
+  · intro scrutinee peelNat alternatives hchildren fuel hfuel
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+        let admissible : Alt → Prop := fun alternative =>
+          alternative ∈ alternatives.toList ∧
+            match alternative with
+            | .mk _ _ body => body.bytes.size < fuel
+        have hadmissible : ∀ alternative ∈ alternatives.toList,
+            admissible alternative := by
+          intro alternative hmember
+          cases alternative with
+          | mk cidx fields body =>
+              refine ⟨hmember, ?_⟩
+              have hbody := Alt.body_size_lt_bytes cidx fields body
+              have halternative := AltList.member_size_le hmember
+              simp only [Code.bytes, ByteArray.size_append,
+                Decode.tag_size] at hfuel
+              omega
+        have hone : ∀ alternative, admissible alternative →
+            GetSpec (getAlt (getCodeFuel fuel))
+              alternative.bytes alternative := by
+          intro alternative halternative
+          rcases halternative with ⟨hmember, hbodyFuel⟩
+          cases alternative with
+          | mk cidx fields body =>
+              have hspec := Decode.getSpecMap3
+                (Decode.getNat_spec cidx) (Decode.getNat_spec fields)
+                (hchildren cidx fields body hmember fuel hbodyFuel) Alt.mk
+              simpa [getAlt, Alt.bytes] using hspec
+        have harray := Decode.getArray_spec_of
+          (getAlt (getCodeFuel fuel)) Alt.bytes admissible hone
+          alternatives hadmissible
+        rw [Decode.array_eq_counted,
+          ← AltList.bytes_eq_listBytes alternatives.toList] at harray
+        have hpayload := Decode.getSpecMap3
+          (IxIR1.getAtom_spec scrutinee)
+          (Decode.getBool_spec peelNat) harray Code.case
+        have htotal := GetSpec.bind
+          (next := getCodeTag (getCodeFuel fuel))
+          (Decode.getU8_tag_spec 2) hpayload
+        simpa only [getCodeFuel, Code.bytes, ByteArray.append_assoc,
+          ByteArray.append_empty] using htotal
+  · exact hfuel
+
+theorem getCode_spec (code : Code) :
+    GetSpec getCode code.bytes code := by
+  intro pre suffix
+  let fuel := (pre ++ code.bytes ++ suffix).size + 1
+  have hfuel : code.bytes.size < fuel := by
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  have hspec := getCodeFuel_spec code fuel hfuel pre suffix
+  simpa [getCode, fuel] using hspec
+
+theorem getFnDef_spec (definition : FnDef) :
+    GetSpec getFnDef definition.bytes definition := by
+  have hspec := Decode.getSpecMap4 (Decode.getNat_spec definition.arity)
+    (IxIR0.getOwned_spec definition.result)
+    (Decode.getBool_spec definition.papSafe) (getCode_spec definition.body)
+    FnDef.mk
+  simpa [getFnDef, FnDef.bytes] using hspec
+
+theorem getDecl_spec : ∀ declaration : Decl,
+    GetSpec getDecl declaration.bytes declaration
+  | .fn definition => by
+      have hpayload := Decode.getSpecMap (getFnDef_spec definition) Decl.fn
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 0) hpayload
+      simpa only [getDecl, Decl.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+  | .extern arity => by
+      have hpayload := Decode.getSpecMap (Decode.getNat_spec arity) Decl.extern
+      have htotal := GetSpec.bind (next := getDeclTag)
+        (Decode.getU8_tag_spec 1) hpayload
+      simpa only [getDecl, Decl.bytes, ByteArray.append_assoc,
+        ByteArray.append_empty] using htotal
+
+theorem getBlockPreimage_spec (members : List Decl) :
+    GetSpec getBlockPreimage (Block.preimage members) members := by
+  let next : Unit → GetM (List Decl) := fun _ => Decode.getList getDecl
+  have htotal := GetSpec.bind (next := next)
+    (Decode.expectBytes_spec Block.addressDomain)
+    (Decode.getList_spec getDecl Decl.bytes getDecl_spec members)
+  simpa [getBlockPreimage, Block.preimage, next] using htotal
+
+/-! ### Strict top-level codec laws -/
+
+theorem Block.decodePreimage_roundtrip (members : List Decl) :
+    Block.decodePreimage (Block.preimage members) = .ok members := by
+  exact Decode.runCanonical_of_spec getBlockPreimage Block.preimage members
+    (getBlockPreimage_spec members)
+
+theorem Block.decodePreimage_canonical {bytes : ByteArray}
+    {members : List Decl}
+    (hdecode : Block.decodePreimage bytes = .ok members) :
+    Block.preimage members = bytes := by
+  exact Decode.runCanonical_canonical getBlockPreimage Block.preimage hdecode
+
+theorem Block.preimage_injective : Function.Injective Block.preimage := by
+  intro left right hbytes
+  have hok : (Except.ok left : Except String (List Decl)) = .ok right := by
+    calc
+      .ok left = Block.decodePreimage (Block.preimage left) :=
+        (Block.decodePreimage_roundtrip left).symm
+      _ = Block.decodePreimage (Block.preimage right) :=
+        congrArg Block.decodePreimage hbytes
+      _ = .ok right := Block.decodePreimage_roundtrip right
+  exact Except.ok.inj hok
+
+/-! ## Collision-checked construction and ingress materialization -/
+
+namespace DeclList
+
+def structurallyEq : List Decl → List Decl → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      Decl.structurallyEq left right && structurallyEq leftRest rightRest
+  | _, _ => false
+
+theorem structurallyEq_eq_true_iff (left right : List Decl) :
+    structurallyEq left right = true ↔ left = right := by
+  induction left generalizing right with
+  | nil => cases right <;> simp [structurallyEq]
+  | cons left rest ih =>
+      cases right with
+      | nil => simp [structurallyEq]
+      | cons right rightRest =>
+          simp [structurallyEq, Decl.structurallyEq_eq_true_iff, ih]
+
+end DeclList
+
+/-- Old block-member key to its final derived key. -/
+abbrev Renaming := Readdress.Renaming
+
+/-- A completely materialized cycle-safe block. -/
+structure Result where
+  blockAddress : Address
+  blockMembers : List Decl
+  members : List (Address × IxIR1.Decl)
+  addressMap : Renaming
+
+namespace Result
+
+def transientAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.1)
+
+def derivedAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.2)
+
+def memberKeysDerived (result : Result) : Bool :=
+  let rec loop : Nat → Renaming → Bool
+    | _, [] => true
+    | index, entry :: rest =>
+        entry.2 == Member.address result.blockAddress index &&
+          loop (index + 1) rest
+  loop 0 result.addressMap &&
+    result.members.map (·.1) == result.derivedAddresses
+
+def blockStable (result : Result) : Bool :=
+  DeclList.structurallyEq
+    (abstractMembers result.members) result.blockMembers
+
+def noTransientKeys (result : Result) : Bool :=
+  !(result.members.map (·.1)).any result.transientAddresses.contains
+
+def noTransientReferences (result : Result) : Bool :=
+  let references := result.members.flatMap fun member =>
+    Readdress.Decl.references member.2
+  !references.any result.transientAddresses.contains
+
+/-- Executable certificate that materialization is exactly the completed
+address image of the transient block and that re-abstraction recovers the
+canonical symbolic artifact. -/
+def semanticAudit (result : Result)
+    (raw : List (Address × IxIR1.Decl)) : Bool :=
+  let rename := Readdress.Renaming.apply result.addressMap
+  let original := IxIR1.Env.ofList raw
+  let emitted := IxIR1.Env.ofList result.members
+  DeclList.structurallyEq result.blockMembers (abstractMembers raw) &&
+    result.blockAddress == Block.address result.blockMembers &&
+    result.memberKeysDerived && result.blockStable &&
+    result.noTransientKeys && result.noTransientReferences &&
+    raw.all (fun entry =>
+      match original entry.1, emitted (rename entry.1) with
+      | some before, some after =>
+          Readdress.Decl.structurallyEq after
+            (Readdress.Decl.mapAddresses rename before)
+      | _, _ => false) &&
+    result.members.all (fun entry =>
+      match emitted entry.1 with
+      | some declaration =>
+          Readdress.Decl.structurallyEq
+            (Readdress.Decl.mapAddresses rename declaration) declaration
+      | none => false)
+
+end Result
+
+abbrev CertifiedResult (raw : List (Address × IxIR1.Decl)) :=
+  { result : Result // result.semanticAudit raw = true }
+
+private def firstDuplicate? : List Address → Option Address
+  | [] => none
+  | address :: rest =>
+      if rest.contains address then some address else firstDuplicate? rest
+
+private def firstOverlap? (left right : List Address) : Option Address :=
+  left.find? right.contains
+
+private def deriveMap (block : Address) :
+    Nat → List (Address × IxIR1.Decl) → Renaming
+  | _, [] => []
+  | index, member :: rest =>
+      (member.1, Member.address block index) ::
+        deriveMap block (index + 1) rest
+
+/-- Materialized stored block, independent of transient producer names. -/
+structure Artifact where
+  blockAddress : Address
+  blockMembers : List Decl
+  members : List (Address × IxIR1.Decl)
+
+namespace Artifact
+
+def memberKeysDerived (artifact : Artifact) : Bool :=
+  let rec loop : Nat → List (Address × IxIR1.Decl) → Bool
+    | _, [] => true
+    | index, member :: rest =>
+        member.1 == Member.address artifact.blockAddress index &&
+          loop (index + 1) rest
+  loop 0 artifact.members
+
+def stable (artifact : Artifact) : Bool :=
+  DeclList.structurallyEq
+    (abstractMembers artifact.members) artifact.blockMembers
+
+def audit (artifact : Artifact) : Bool :=
+  artifact.blockAddress == Block.address artifact.blockMembers &&
+    artifact.members.length == artifact.blockMembers.length &&
+    artifact.blockMembers.all
+      (Decl.wellScoped artifact.blockMembers.length) &&
+    artifact.memberKeysDerived && artifact.stable
+
+end Artifact
+
+private def deriveKeys (block : Address) : Nat → Nat → List Address
+  | _, 0 => []
+  | index, count + 1 =>
+      Member.address block index :: deriveKeys block (index + 1) count
+
+/-- Validate and materialize a decoded symbolic block. -/
+def Block.materializeArtifact (reserved : List Address)
+    (blockMembers : List Decl) : Except String Artifact := do
+  if blockMembers.isEmpty then
+    throw "IxIR1 mutual block must contain at least one member"
+  unless blockMembers.all (Decl.wellScoped blockMembers.length) do
+    throw "IxIR1 mutual block contains an out-of-range local reference"
+  let blockAddress := Block.address blockMembers
+  if reserved.contains blockAddress then
+    throw s!"IxIR1 mutual-block identity collides with reserved identity {Address.toHex blockAddress}"
+  let external := blockMembers.flatMap Decl.externalReferences
+  if external.contains blockAddress then
+    throw s!"IxIR1 mutual-block identity collides with an external reference {Address.toHex blockAddress}"
+  let derived := deriveKeys blockAddress 0 blockMembers.length
+  if let some duplicate := firstDuplicate? derived then
+    throw s!"BLAKE3 collision between IxIR1 mutual-block member keys {Address.toHex duplicate}"
+  if derived.contains blockAddress then
+    throw s!"IxIR1 mutual-block member key collides with its block identity {Address.toHex blockAddress}"
+  if let some overlap := firstOverlap? derived reserved then
+    throw s!"IxIR1 mutual-block member key collides with reserved identity {Address.toHex overlap}"
+  if let some overlap := firstOverlap? derived external then
+    throw s!"IxIR1 mutual-block member key captures an external reference {Address.toHex overlap}"
+  let declarations ← blockMembers.mapM
+    (Decl.materialize derived.toArray)
+  let artifact : Artifact :=
+    { blockAddress, blockMembers, members := derived.zip declarations }
+  unless artifact.audit do
+    throw "internal: decoded IxIR1 mutual block failed materialization audit"
+  return artifact
+
+def Block.decodeMaterialized (reserved : List Address)
+    (bytes : ByteArray) : Except String Artifact := do
+  Block.materializeArtifact reserved (← Block.decodeArtifact bytes)
+
+private def certify (raw : List (Address × IxIR1.Decl))
+    (result : Result) : Except String (CertifiedResult raw) :=
+  if haudit : result.semanticAudit raw then .ok ⟨result, haudit⟩
+  else .error "internal: IxIR1 mutual-block materialization failed semantic audit"
+
+/-- Construct and certify one ordered cycle-safe block while protecting every
+caller-owned external identity. -/
+def runCertified (reserved : List Address)
+    (raw : List (Address × IxIR1.Decl)) :
+    Except String (CertifiedResult raw) := do
+  if raw.isEmpty then
+    throw "IxIR1 mutual block must contain at least one member"
+  let transient := raw.map (·.1)
+  if let some duplicate := firstDuplicate? transient then
+    throw s!"duplicate IxIR1 mutual-block temporary address {Address.toHex duplicate}"
+  if let some overlap := firstOverlap? transient reserved then
+    throw s!"IxIR1 mutual-block temporary address overlaps reserved identity {Address.toHex overlap}"
+  let blockMembers := abstractMembers raw
+  unless blockMembers.all (Decl.wellScoped blockMembers.length) do
+    throw "internal: abstracted IxIR1 mutual block contains an out-of-range local reference"
+  let blockAddress := Block.address blockMembers
+  if transient.contains blockAddress then
+    throw s!"IxIR1 mutual-block identity overlaps temporary namespace {Address.toHex blockAddress}"
+  if reserved.contains blockAddress then
+    throw s!"IxIR1 mutual-block identity collides with reserved identity {Address.toHex blockAddress}"
+  let external := blockMembers.flatMap Decl.externalReferences
+  if external.contains blockAddress then
+    throw s!"IxIR1 mutual-block identity collides with an external reference {Address.toHex blockAddress}"
+  let addressMap := deriveMap blockAddress 0 raw
+  let derived := addressMap.map (·.2)
+  if let some duplicate := firstDuplicate? derived then
+    throw s!"BLAKE3 collision between IxIR1 mutual-block member keys {Address.toHex duplicate}"
+  if derived.contains blockAddress then
+    throw s!"IxIR1 mutual-block member key collides with its block identity {Address.toHex blockAddress}"
+  if let some overlap := firstOverlap? derived transient then
+    throw s!"IxIR1 mutual-block member key overlaps temporary namespace {Address.toHex overlap}"
+  if let some overlap := firstOverlap? derived reserved then
+    throw s!"IxIR1 mutual-block member key collides with reserved identity {Address.toHex overlap}"
+  if let some overlap := firstOverlap? derived external then
+    throw s!"IxIR1 mutual-block member key captures an external reference {Address.toHex overlap}"
+  let memberKeys := derived.toArray
+  let materialized ← blockMembers.mapM (Decl.materialize memberKeys)
+  let result : Result :=
+    { blockAddress
+      blockMembers
+      members := derived.zip materialized
+      addressMap }
+  certify raw result
+
+def run (reserved : List Address)
+    (raw : List (Address × IxIR1.Decl)) : Except String Result := do
+  return (← runCertified reserved raw).1
+
+theorem semanticAudit_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × IxIR1.Decl)}
+    {result : Result} (hrun : run reserved raw = .ok result) :
+    result.semanticAudit raw = true := by
+  unfold run at hrun
+  cases hcertified : runCertified reserved raw with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2
+
+/-! Pure structural format guards. Digest fixtures live in `Tests.lean`. -/
+
+private def fixtureA : Address := Address.replicate 0xfa
+private def fixtureB : Address := Address.replicate 0xfb
+private def fixtureExternal : Address := Address.replicate 0xee
+
+#guard Ref.bytes (.local 128) == ByteArray.mk #[0, 128, 1]
+#guard (Ref.bytes (.external fixtureExternal)).size == 33
+#guard Op.bytes (.call (.local 1) #[]) == ByteArray.mk #[8, 0, 1, 0]
+#guard Decl.bytes (.fn ⟨0, .shared, true,
+  .letOp (.call (.local 1) #[]) (.ret .erased)⟩) ==
+    ByteArray.mk #[0, 0, 1, 1, 1, 8, 0, 1, 0, 0, 2]
+#guard
+  DeclList.structurallyEq
+    (abstractMembers
+      [(fixtureA, .fn ⟨0, .shared, true,
+          .letOp (.call fixtureB #[]) (.ret .erased)⟩),
+       (fixtureB, .fn ⟨0, .shared, true,
+          .letOp (.papp fixtureA #[]) (.ret .erased)⟩)])
+    [.fn ⟨0, .shared, true,
+        .letOp (.call (.local 1) #[]) (.ret .erased)⟩,
+     .fn ⟨0, .shared, true,
+        .letOp (.papp (.local 0) #[]) (.ret .erased)⟩]
+
+end MutualBlock
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/NoReuse.lean b/Ix/Compiler/IxIR1/NoReuse.lean
new file mode 100644
index 000000000..6067e4096
--- /dev/null
+++ b/Ix/Compiler/IxIR1/NoReuse.lean
@@ -0,0 +1,4076 @@
+import Ix.Compiler.IxIR1.Reclamation
+import Ix.Compiler.IxIR1.LowerStateSim
+
+/-!
+# Syntactic and dynamic absence of IxIR₁ reuse
+
+`Reclamation.AllocationOrderInvariant` is a semantic trace invariant.  This
+module supplies its compiler-facing premise: the current IxIR₀→IxIR₁
+lowerer never emits `Op.reuse`, and execution of a closed reuse-free program
+therefore leaves the fresh store's reuse counter at zero.
+-/
+
+namespace Ix.Compiler.IxIR1.NoReuse
+
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Lower
+
+private theorem bindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem bindErr {error α β : Type} (err : error)
+    (next : α → Except error β) :
+    ((Except.error err : Except error α) >>= next) = .error err := rfl
+
+/-- The one instruction excluded by the current append-only lowerer. -/
+def OpNoReuse : Op → Prop
+  | .reuse .. => False
+  | _ => True
+
+mutual
+
+/-- Every operation and every recursively nested alternative is reuse-free. -/
+def CodeNoReuse : Code → Prop
+  | .ret _ => True
+  | .letOp op rest => OpNoReuse op ∧ CodeNoReuse rest
+  | .case _ _ alternatives =>
+      ∀ alternative ∈ alternatives, AltNoReuse alternative
+
+def AltNoReuse : Alt → Prop
+  | .mk _ _ body => CodeNoReuse body
+
+end
+
+/-- Every callable function body in the runtime environment is reuse-free. -/
+def CtxNoReuse (ctx : Ctx) : Prop :=
+  ∀ {address definition},
+    ctx.decls address = some (.fn definition) → CodeNoReuse definition.body
+
+/-! ## Executable reflection
+
+The compiler proves reuse-freedom before content addressing, but the final
+artifact may content-deduplicate declarations.  These small structural checks
+let downstream attachment boundaries validate the exact emitted syntax and
+reflect the result back into the propositions consumed by simulation. -/
+
+/-- Executable counterpart of `OpNoReuse`. -/
+def checkOp : Op → Bool
+  | .reuse .. => false
+  | _ => true
+
+mutual
+
+/-- Executable counterpart of `CodeNoReuse`. -/
+def checkCode : Code → Bool
+  | .ret _ => true
+  | .letOp operation rest => checkOp operation && checkCode rest
+  | .case _ _ alternatives => checkAlternatives alternatives.toList
+
+/-- Executable counterpart of `AltNoReuse`. -/
+def checkAlt : Alt → Bool
+  | .mk _ _ body => checkCode body
+
+/-- Structural list walk used beneath case-alternative arrays. -/
+def checkAlternatives : List Alt → Bool
+  | [] => true
+  | head :: tail => checkAlt head && checkAlternatives tail
+
+end
+
+theorem checkOp_eq_true_iff (operation : Op) :
+    checkOp operation = true ↔ OpNoReuse operation := by
+  cases operation <;> simp [checkOp, OpNoReuse]
+
+/-- The executable recursive syntax walk decides exactly `CodeNoReuse`. -/
+theorem checkCode_eq_true_iff (code : Code) :
+    checkCode code = true ↔ CodeNoReuse code := by
+  apply Code.rec
+    (motive_1 := fun operation =>
+      checkOp operation = true ↔ OpNoReuse operation)
+    (motive_2 := fun alternative =>
+      checkAlt alternative = true ↔ AltNoReuse alternative)
+    (motive_3 := fun code =>
+      checkCode code = true ↔ CodeNoReuse code)
+    (motive_4 := fun alternatives =>
+      checkAlternatives alternatives.toList = true ↔
+        ∀ alternative ∈ alternatives, AltNoReuse alternative)
+    (motive_5 := fun alternatives =>
+      checkAlternatives alternatives = true ↔
+        ∀ alternative ∈ alternatives, AltNoReuse alternative)
+    (pure := by intros; simp [checkOp, OpNoReuse])
+    (alloc := by intros; simp [checkOp, OpNoReuse])
+    (reuse := by intros; simp [checkOp, OpNoReuse])
+    (free := by intros; simp [checkOp, OpNoReuse])
+    (dup := by intros; simp [checkOp, OpNoReuse])
+    (drop := by intros; simp [checkOp, OpNoReuse])
+    (dropU := by intros; simp [checkOp, OpNoReuse])
+    (fetch := by intros; simp [checkOp, OpNoReuse])
+    (call := by intros; simp [checkOp, OpNoReuse])
+    (callSelf := by intros; simp [checkOp, OpNoReuse])
+    (papp := by intros; simp [checkOp, OpNoReuse])
+    (apply := by intros; simp [checkOp, OpNoReuse])
+    (extern := by intros; simp [checkOp, OpNoReuse])
+    (mk := by
+      intro cidx fields body hbody
+      simpa [checkAlt, AltNoReuse] using hbody)
+    (ret := by intros; simp [checkCode, CodeNoReuse])
+    (letOp := by
+      intro operation rest hoperation hrest
+      simp [checkCode, CodeNoReuse, hoperation, hrest])
+    (case := by
+      intro scrutinee peelNat alternatives halternatives
+      simpa [checkCode, CodeNoReuse] using halternatives)
+    (by
+      intro alternatives halternatives
+      simpa using halternatives)
+    (by simp [checkAlternatives])
+    (by
+      intro head tail hhead htail
+      simp [checkAlternatives, hhead, htail])
+    code
+
+/-- A difference-list emitter preserves reuse-free continuations. -/
+def EmitNoReuse (emit : Emit) : Prop :=
+  ∀ code, CodeNoReuse code → CodeNoReuse (emit code)
+
+theorem emitNoReuse_id : EmitNoReuse (_root_.id : Emit) := by
+  intro code hcode
+  exact hcode
+
+theorem emitNoReuse_emitOp {op : Op} (hop : OpNoReuse op) :
+    EmitNoReuse (emitOp op) := by
+  intro code hcode
+  simpa [emitOp, CodeNoReuse] using And.intro hop hcode
+
+theorem emitNoReuse_comp {first second : Emit}
+    (hfirst : EmitNoReuse first) (hsecond : EmitNoReuse second) :
+    EmitNoReuse (first ∘ second) := by
+  intro code hcode
+  exact hfirst (second code) (hsecond code hcode)
+
+/-- Retaining pap captures changes only RC state. -/
+theorem dupVals_reuses {store store' : Store} {values : List RVal}
+    (heval : dupVals store values = .ok store') :
+    store'.reuses = store.reuses := by
+  induction values generalizing store with
+  | nil =>
+    change (.ok store : Except Err Store) = .ok store' at heval
+    injection heval with hstore
+    subst store'
+    rfl
+  | cons head tail ih =>
+    cases head with
+    | lit literal =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      exact ih heval
+    | erased =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      exact ih heval
+    | loc location =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      cases hget : store.get? location with
+      | none => simp [hget, bindErr] at heval
+      | some box =>
+        cases box with
+        | mk world rc node =>
+          cases world with
+          | unique => simp [hget, bindErr] at heval
+          | shared =>
+            simp only [hget] at heval
+            have htail := ih heval
+            simpa [Sim.incRcStore, Store.setBox, Store.rcTick] using htail
+
+private def DropReusesAt (fuel : Nat) : Prop :=
+  (∀ ctx store value store',
+    dropVal ctx fuel store value = .ok store' →
+      store'.reuses = store.reuses) ∧
+  (∀ ctx store values store',
+    dropMany ctx fuel store values = .ok store' →
+      store'.reuses = store.reuses) ∧
+  (∀ ctx store value store',
+    dropUVal ctx fuel store value = .ok store' →
+      store'.reuses = store.reuses) ∧
+  (∀ ctx store values store',
+    dropManyU ctx fuel store values = .ok store' →
+      store'.reuses = store.reuses)
+
+private theorem dropReusesAt : ∀ fuel, DropReusesAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx store value store' heval
+      rw [dropVal.eq_def] at heval
+      simp at heval
+    · intro ctx store values store' heval
+      rw [dropMany.eq_def] at heval
+      simp at heval
+    · intro ctx store value store' heval
+      rw [dropUVal.eq_def] at heval
+      simp at heval
+    · intro ctx store values store' heval
+      rw [dropManyU.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany, ihUVal, ihUMany⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx store value store' heval
+      cases value with
+      | lit literal =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        rfl
+      | erased =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        rfl
+      | loc location =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? location with
+        | none => simp [hget] at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => simp at heval
+            | shared =>
+              dsimp only at heval
+              by_cases hrc : rc = 1
+              · subst rc
+                have hbeq : ((1 : Nat) == 1) = true := by decide
+                rw [hbeq] at heval
+                cases node with
+                | ctorN cid fields =>
+                  have htail := ihMany _ _ _ _ heval
+                  simpa [Store.rcTick, Store.kill] using htail
+                | papN address arity args =>
+                  have htail := ihMany _ _ _ _ heval
+                  simpa [Store.rcTick, Store.kill] using htail
+              · have hbeq : (rc == 1) = false := by simp [hrc]
+                rw [hbeq] at heval
+                injection heval with hstore
+                subst store'
+                simp [Store.rcTick, Store.setBox]
+    · intro ctx store values store' heval
+      cases values with
+      | nil =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        rfl
+      | cons value values =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropVal ctx fuel store value with
+        | error err => rw [hfirst, bindErr] at heval; contradiction
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          exact (ihMany _ _ _ _ heval).trans (ihVal _ _ _ _ hfirst)
+    · intro ctx store value store' heval
+      cases value with
+      | lit literal =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        rfl
+      | erased =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        rfl
+      | loc location =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? location with
+        | none => simp [hget] at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => simp at heval
+            | unique =>
+              cases node with
+              | ctorN cid fields =>
+                have htail := ihUMany _ _ _ _ heval
+                simpa [Store.kill] using htail
+              | papN address arity args => simp at heval
+    · intro ctx store values store' heval
+      cases values with
+      | nil =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        rfl
+      | cons value values =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropUVal ctx fuel store value with
+        | error err => rw [hfirst, bindErr] at heval; contradiction
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          exact (ihUMany _ _ _ _ heval).trans (ihUVal _ _ _ _ hfirst)
+
+theorem dropVal_reuses {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {value : RVal} (heval : dropVal ctx fuel store value = .ok store') :
+    store'.reuses = store.reuses :=
+  (dropReusesAt fuel).1 ctx store value store' heval
+
+theorem dropMany_reuses {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {values : List RVal}
+    (heval : dropMany ctx fuel store values = .ok store') :
+    store'.reuses = store.reuses :=
+  (dropReusesAt fuel).2.1 ctx store values store' heval
+
+theorem dropUVal_reuses {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {value : RVal} (heval : dropUVal ctx fuel store value = .ok store') :
+    store'.reuses = store.reuses :=
+  (dropReusesAt fuel).2.2.1 ctx store value store' heval
+
+theorem dropManyU_reuses {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {values : List RVal}
+    (heval : dropManyU ctx fuel store values = .ok store') :
+    store'.reuses = store.reuses :=
+  (dropReusesAt fuel).2.2.2 ctx store values store' heval
+
+private def EvalReusesAt (fuel : Nat) : Prop :=
+  (∀ ctx cur store env code store' value,
+    CtxNoReuse ctx → CodeNoReuse cur.body → CodeNoReuse code →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+      store'.reuses = store.reuses) ∧
+  (∀ ctx cur store env op store' value,
+    CtxNoReuse ctx → CodeNoReuse cur.body → OpNoReuse op →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+      store'.reuses = store.reuses) ∧
+  (∀ ctx address args store store' value,
+    CtxNoReuse ctx →
+    invoke ctx fuel address args store = .ok (store', value) →
+      store'.reuses = store.reuses) ∧
+  (∀ ctx store function args store' value,
+    CtxNoReuse ctx →
+    applyGo ctx fuel store function args = .ok (store', value) →
+      store'.reuses = store.reuses)
+
+/-- Successful execution of reuse-free code in a reuse-free declaration
+environment preserves the reuse counter exactly. -/
+private theorem evalReusesAt : ∀ fuel, EvalReusesAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value hctx hcur hcode heval
+      rw [runCode.eq_def] at heval
+      simp at heval
+    · intro ctx cur store env op store' value hctx hcur hop heval
+      rw [runOp.eq_def] at heval
+      simp at heval
+    · intro ctx address args store store' value hctx heval
+      rw [invoke.eq_def] at heval
+      simp at heval
+    · intro ctx store function args store' value hctx heval
+      rw [applyGo.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihCode, ihOp, ihInvoke, ihApply⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value hctx hcur hcode heval
+      cases code with
+      | ret atom =>
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          rfl
+      | letOp op rest =>
+        simp only [CodeNoReuse] at hcode
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hopEval : runOp ctx fuel cur store env op with
+        | error err => rw [hopEval, bindErr] at heval; contradiction
+        | ok result =>
+          rcases result with ⟨middle, opValue⟩
+          rw [hopEval, bindOk] at heval
+          exact (ihCode _ _ _ _ _ _ _ hctx hcur hcode.2 heval).trans
+            (ihOp _ _ _ _ _ _ _ hctx hcur hcode.1 hopEval)
+      | case scrut peelNat alternatives =>
+        simp only [CodeNoReuse] at hcode
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hscrut : resolveAtom env scrut with
+        | error err => rw [hscrut, bindErr] at heval; contradiction
+        | ok scrutValue =>
+          rw [hscrut, bindOk] at heval
+          cases scrutValue with
+          | loc location =>
+            dsimp only at heval
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity captured => simp at heval
+                | ctorN cid fields =>
+                  cases halt : alternatives.find?
+                      (fun alternative => alternative.cidx == cid.cidx) with
+                  | none => simp [halt] at heval
+                  | some alternative =>
+                    have haltNo := hcode alternative
+                      (Array.mem_of_find?_eq_some halt)
+                    cases alternative with
+                    | mk cidx fieldCount body =>
+                      simp only [AltNoReuse] at haltNo
+                      cases hsize : fields.size != fieldCount
+                      · simp only [halt, hsize, Bool.false_eq_true,
+                          if_false] at heval
+                        exact ihCode _ _ _ _ _ _ _ hctx hcur haltNo heval
+                      · simp [halt, hsize] at heval
+          | lit literal =>
+            cases literal with
+            | str string => simp at heval
+            | nat n =>
+              cases hpeel : peelNat with
+              | false => simp [hpeel] at heval
+              | true =>
+                cases n with
+                | zero =>
+                  cases halt : alternatives.find?
+                      (fun alternative => alternative.cidx == 0) with
+                  | none => simp [hpeel, halt] at heval
+                  | some alternative =>
+                    have haltNo := hcode alternative
+                      (Array.mem_of_find?_eq_some halt)
+                    cases alternative with
+                    | mk cidx fieldCount body =>
+                      simp only [AltNoReuse] at haltNo
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at heval
+                        exact ihCode _ _ _ _ _ _ _ hctx hcur haltNo heval
+                      | succ fieldCount => simp [hpeel, halt] at heval
+                | succ n =>
+                  cases halt : alternatives.find?
+                      (fun alternative => alternative.cidx == 1) with
+                  | none => simp [hpeel, halt] at heval
+                  | some alternative =>
+                    have haltNo := hcode alternative
+                      (Array.mem_of_find?_eq_some halt)
+                    cases alternative with
+                    | mk cidx fieldCount body =>
+                      simp only [AltNoReuse] at haltNo
+                      cases fieldCount with
+                      | zero => simp [hpeel, halt] at heval
+                      | succ fieldCount =>
+                        cases fieldCount with
+                        | zero =>
+                          simp only [hpeel, halt] at heval
+                          exact ihCode _ _ _ _ _ _ _ hctx hcur haltNo heval
+                        | succ fieldCount => simp [hpeel, halt] at heval
+          | erased => simp at heval
+    · intro ctx cur store env op store' value hctx hcur hop heval
+      cases op with
+      | pure atom =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          rfl
+      | alloc world cid atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          simp [Store.allocNode]
+      | reuse target cid atoms =>
+        simp [OpNoReuse] at hop
+      | free target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal => simp at heval
+          | erased => simp at heval
+          | loc location =>
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | shared => simp at heval
+                | unique =>
+                  have hpair := Except.ok.inj heval
+                  cases hpair
+                  simp [Store.kill]
+      | dup target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+          | loc location =>
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | unique => simp at heval
+                | shared =>
+                  have hpair := Except.ok.inj heval
+                  cases hpair
+                  simp [Store.setBox, Store.rcTick]
+      | drop target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+          | loc location =>
+            dsimp only at heval
+            cases hdrop : dropVal ctx fuel store (.loc location) with
+            | error err => rw [hdrop, bindErr] at heval; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact dropVal_reuses hdrop
+      | dropU target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+          | loc location =>
+            dsimp only at heval
+            cases hdrop : dropUVal ctx fuel store (.loc location) with
+            | error err => rw [hdrop, bindErr] at heval; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact dropUVal_reuses hdrop
+      | fetch target field =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal => simp at heval
+          | erased => simp at heval
+          | loc location =>
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity captured => simp at heval
+                | ctorN cid fields =>
+                  cases hfield : fields[field]? with
+                  | none => simp [hfield] at heval
+                  | some result =>
+                    simp only [hfield] at heval
+                    have hpair := Except.ok.inj heval
+                    cases hpair
+                    rfl
+      | call address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          exact ihInvoke _ _ _ _ _ _ hctx heval
+      | callSelf atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases harity : values.length != cur.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hbody : runCode ctx fuel cur store values.reverse
+                cur.body with
+            | error err => rw [hbody, bindErr] at heval; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hbody, bindOk] at heval
+              obtain ⟨hresult, _⟩ := Sim.checkResultWorld_ok heval
+              cases hresult
+              exact ihCode _ _ _ _ _ _ _ hctx hcur hcur hbody
+          · simp [harity] at heval
+      | papp address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases hdecl : ctx.decls address with
+          | none => simp [hdecl] at heval
+          | some declaration =>
+            simp only [hdecl] at heval
+            by_cases hlength : values.length < declArity declaration
+            · simp only [hlength, if_true] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              simp [Store.allocNode]
+            · simp [hlength] at heval
+      | apply function atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hfunction : resolveAtom env function with
+        | error err => rw [hfunction, bindErr] at heval; contradiction
+        | ok functionValue =>
+          rw [hfunction, bindOk] at heval
+          cases hargs : resolveAtoms env atoms with
+          | error err => rw [hargs, bindErr] at heval; contradiction
+          | ok values =>
+            rw [hargs, bindOk] at heval
+            exact ihApply _ _ _ _ _ _ hctx heval
+      | extern address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases hcall : callScalarOracle ctx address values with
+          | error err => rw [hcall, bindErr] at heval; contradiction
+          | ok result =>
+            rw [hcall, bindOk] at heval
+            have hpair := Except.ok.inj heval
+            cases hpair
+            rfl
+    · intro ctx address args store store' value hctx heval
+      rw [invoke.eq_def] at heval
+      dsimp only at heval
+      cases hdecl : ctx.decls address with
+      | none => simp [hdecl] at heval
+      | some declaration =>
+        simp only [hdecl] at heval
+        cases declaration with
+        | extern arity =>
+          cases harity : args.length != arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hcall : callScalarOracle ctx address args with
+            | error err => simp [hcall] at heval
+            | ok result =>
+              simp only [hcall] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              rfl
+          · simp [harity] at heval
+        | fn definition =>
+          cases harity : args.length != definition.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hbody : runCode ctx fuel definition store args.reverse
+                definition.body with
+            | error err => rw [hbody, bindErr] at heval; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hbody, bindOk] at heval
+              obtain ⟨hresult, _⟩ := Sim.checkResultWorld_ok heval
+              cases hresult
+              have hbodyNo := hctx hdecl
+              exact ihCode _ _ _ _ _ _ _ hctx hbodyNo hbodyNo hbody
+          · simp [harity] at heval
+    · intro ctx store function args store' value hctx heval
+      rw [applyGo.eq_def] at heval
+      dsimp only at heval
+      cases function with
+      | lit literal => simp at heval
+      | erased =>
+        cases hdrop : dropMany ctx fuel store args with
+        | error err => rw [hdrop, bindErr] at heval; contradiction
+        | ok dropped =>
+          rw [hdrop, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact dropMany_reuses hdrop
+      | loc location =>
+        cases hbox : store.get? location with
+        | none => simp [hbox] at heval
+        | some box =>
+          simp only [hbox] at heval
+          cases box with
+          | mk world rc node =>
+            cases node with
+            | ctorN cid fields => simp at heval
+            | papN address arity captured =>
+              dsimp only at heval
+              cases hdup : dupVals store captured.toList with
+              | error err => rw [hdup, bindErr] at heval; contradiction
+              | ok retained =>
+                rw [hdup, bindOk] at heval
+                cases hdrop : dropVal ctx fuel retained (.loc location) with
+                | error err => rw [hdrop, bindErr] at heval; contradiction
+                | ok ready =>
+                  rw [hdrop, bindOk] at heval
+                  have hdupReuse := dupVals_reuses hdup
+                  have hdropReuse := dropVal_reuses hdrop
+                  by_cases hunder :
+                      (captured.toList ++ args).length < arity
+                  · simp only [hunder, if_true] at heval
+                    have hpair := Except.ok.inj heval
+                    cases hpair
+                    simpa [Store.allocNode] using
+                      hdropReuse.trans hdupReuse
+                  · simp only [hunder, if_false] at heval
+                    by_cases hexact :
+                        (captured.toList ++ args).length = arity
+                    · simp only [hexact, beq_self_eq_true, if_true]
+                        at heval
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at heval
+                      | some declaration =>
+                        cases hpapsafe : declPapSafe declaration with
+                        | false => simp [hdecl, hpapsafe] at heval
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at heval
+                          exact (ihInvoke _ _ _ _ _ _ hctx heval).trans
+                            (hdropReuse.trans hdupReuse)
+                    · have hbeq :
+                          ((captured.toList ++ args).length == arity) =
+                            false := by
+                        exact beq_eq_false_iff_ne.mpr hexact
+                      simp only [hbeq, Bool.false_eq_true, if_false] at heval
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at heval
+                      | some declaration =>
+                        cases hpapsafe : declPapSafe declaration with
+                        | false => simp [hdecl, hpapsafe] at heval
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at heval
+                          cases hinvoke : invoke ctx fuel address
+                              ((captured.toList ++ args).take arity) ready with
+                          | error err =>
+                            rw [hinvoke, bindErr] at heval
+                            contradiction
+                          | ok called =>
+                            rcases called with ⟨calledStore, calledValue⟩
+                            rw [hinvoke, bindOk] at heval
+                            exact (ihApply _ _ _ _ _ _ hctx heval).trans
+                              ((ihInvoke _ _ _ _ _ _ hctx hinvoke).trans
+                                (hdropReuse.trans hdupReuse))
+
+private def EvalPAPsUnderAt (fuel : Nat) : Prop :=
+  (∀ ctx cur store env code store' value,
+    CtxNoReuse ctx → CodeNoReuse cur.body → CodeNoReuse code →
+    Reclamation.PAPsUnder store →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+      Reclamation.PAPsUnder store') ∧
+  (∀ ctx cur store env op store' value,
+    CtxNoReuse ctx → CodeNoReuse cur.body → OpNoReuse op →
+    Reclamation.PAPsUnder store →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+      Reclamation.PAPsUnder store') ∧
+  (∀ ctx address args store store' value,
+    CtxNoReuse ctx → Reclamation.PAPsUnder store →
+    invoke ctx fuel address args store = .ok (store', value) →
+      Reclamation.PAPsUnder store') ∧
+  (∀ ctx store function args store' value,
+    CtxNoReuse ctx → Reclamation.PAPsUnder store →
+    applyGo ctx fuel store function args = .ok (store', value) →
+      Reclamation.PAPsUnder store')
+
+/-- Reuse-free execution preserves the strict under-saturation of every
+live PAP.  The induction follows dynamic calls and application chains; its
+only PAP-producing branches are guarded by the evaluator's strict length
+tests. -/
+private theorem evalPAPsUnderAt : ∀ fuel, EvalPAPsUnderAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value hctx hcur hcode hpaps heval
+      rw [runCode.eq_def] at heval
+      simp at heval
+    · intro ctx cur store env op store' value hctx hcur hop hpaps heval
+      rw [runOp.eq_def] at heval
+      simp at heval
+    · intro ctx address args store store' value hctx hpaps heval
+      rw [invoke.eq_def] at heval
+      simp at heval
+    · intro ctx store function args store' value hctx hpaps heval
+      rw [applyGo.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihCode, ihOp, ihInvoke, ihApply⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value hctx hcur hcode hpaps heval
+      cases code with
+      | ret atom =>
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact hpaps
+      | letOp op rest =>
+        simp only [CodeNoReuse] at hcode
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hopEval : runOp ctx fuel cur store env op with
+        | error err => rw [hopEval, bindErr] at heval; contradiction
+        | ok result =>
+          rcases result with ⟨middle, opValue⟩
+          rw [hopEval, bindOk] at heval
+          exact ihCode _ _ _ _ _ _ _ hctx hcur hcode.2
+            (ihOp _ _ _ _ _ _ _ hctx hcur hcode.1 hpaps hopEval) heval
+      | case scrut peelNat alternatives =>
+        simp only [CodeNoReuse] at hcode
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hscrut : resolveAtom env scrut with
+        | error err => rw [hscrut, bindErr] at heval; contradiction
+        | ok scrutValue =>
+          rw [hscrut, bindOk] at heval
+          cases scrutValue with
+          | loc location =>
+            dsimp only at heval
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity captured => simp at heval
+                | ctorN cid fields =>
+                  cases halt : alternatives.find?
+                      (fun alternative => alternative.cidx == cid.cidx) with
+                  | none => simp [halt] at heval
+                  | some alternative =>
+                    have haltNo := hcode alternative
+                      (Array.mem_of_find?_eq_some halt)
+                    cases alternative with
+                    | mk cidx fieldCount body =>
+                      simp only [AltNoReuse] at haltNo
+                      cases hsize : fields.size != fieldCount
+                      · simp only [halt, hsize, Bool.false_eq_true,
+                          if_false] at heval
+                        exact ihCode _ _ _ _ _ _ _ hctx hcur haltNo hpaps
+                          heval
+                      · simp [halt, hsize] at heval
+          | lit literal =>
+            cases literal with
+            | str string => simp at heval
+            | nat n =>
+              cases hpeel : peelNat with
+              | false => simp [hpeel] at heval
+              | true =>
+                cases n with
+                | zero =>
+                  cases halt : alternatives.find?
+                      (fun alternative => alternative.cidx == 0) with
+                  | none => simp [hpeel, halt] at heval
+                  | some alternative =>
+                    have haltNo := hcode alternative
+                      (Array.mem_of_find?_eq_some halt)
+                    cases alternative with
+                    | mk cidx fieldCount body =>
+                      simp only [AltNoReuse] at haltNo
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at heval
+                        exact ihCode _ _ _ _ _ _ _ hctx hcur haltNo hpaps
+                          heval
+                      | succ fieldCount => simp [hpeel, halt] at heval
+                | succ n =>
+                  cases halt : alternatives.find?
+                      (fun alternative => alternative.cidx == 1) with
+                  | none => simp [hpeel, halt] at heval
+                  | some alternative =>
+                    have haltNo := hcode alternative
+                      (Array.mem_of_find?_eq_some halt)
+                    cases alternative with
+                    | mk cidx fieldCount body =>
+                      simp only [AltNoReuse] at haltNo
+                      cases fieldCount with
+                      | zero => simp [hpeel, halt] at heval
+                      | succ fieldCount =>
+                        cases fieldCount with
+                        | zero =>
+                          simp only [hpeel, halt] at heval
+                          exact ihCode _ _ _ _ _ _ _ hctx hcur haltNo hpaps
+                            heval
+                        | succ fieldCount => simp [hpeel, halt] at heval
+          | erased => simp at heval
+    · intro ctx cur store env op store' value hctx hcur hop hpaps heval
+      cases op with
+      | pure atom =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact hpaps
+      | alloc world cid atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact hpaps.allocCtor world cid values.toArray
+      | reuse target cid atoms =>
+        simp [OpNoReuse] at hop
+      | free target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal => simp at heval
+          | erased => simp at heval
+          | loc location =>
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | shared => simp at heval
+                | unique =>
+                  have hpair := Except.ok.inj heval
+                  cases hpair
+                  exact hpaps.kill hbox
+      | dup target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+          | loc location =>
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | unique => simp at heval
+                | shared =>
+                  have hpair := Except.ok.inj heval
+                  cases hpair
+                  simpa [Sim.incRcStore] using hpaps.incRcStore hbox
+      | drop target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+          | loc location =>
+            dsimp only at heval
+            cases hdrop : dropVal ctx fuel store (.loc location) with
+            | error err => rw [hdrop, bindErr] at heval; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact hpaps.dropVal hdrop
+      | dropU target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+          | loc location =>
+            dsimp only at heval
+            cases hdrop : dropUVal ctx fuel store (.loc location) with
+            | error err => rw [hdrop, bindErr] at heval; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact hpaps.dropUVal hdrop
+      | fetch target field =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal => simp at heval
+          | erased => simp at heval
+          | loc location =>
+            cases hbox : store.get? location with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity captured => simp at heval
+                | ctorN cid fields =>
+                  cases hfield : fields[field]? with
+                  | none => simp [hfield] at heval
+                  | some result =>
+                    simp only [hfield] at heval
+                    have hpair := Except.ok.inj heval
+                    cases hpair
+                    exact hpaps
+      | call address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          exact ihInvoke _ _ _ _ _ _ hctx hpaps heval
+      | callSelf atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases harity : values.length != cur.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hbody : runCode ctx fuel cur store values.reverse
+                cur.body with
+            | error err => rw [hbody, bindErr] at heval; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hbody, bindOk] at heval
+              obtain ⟨hresult, _⟩ := Sim.checkResultWorld_ok heval
+              cases hresult
+              exact ihCode _ _ _ _ _ _ _ hctx hcur hcur hpaps hbody
+          · simp [harity] at heval
+      | papp address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases hdecl : ctx.decls address with
+          | none => simp [hdecl] at heval
+          | some declaration =>
+            simp only [hdecl] at heval
+            by_cases hlength : values.length < declArity declaration
+            · simp only [hlength, if_true] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact hpaps.allocPap .shared address (declArity declaration)
+                values.toArray (by simpa using hlength)
+            · simp [hlength] at heval
+      | apply function atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hfunction : resolveAtom env function with
+        | error err => rw [hfunction, bindErr] at heval; contradiction
+        | ok functionValue =>
+          rw [hfunction, bindOk] at heval
+          cases hargs : resolveAtoms env atoms with
+          | error err => rw [hargs, bindErr] at heval; contradiction
+          | ok values =>
+            rw [hargs, bindOk] at heval
+            exact ihApply _ _ _ _ _ _ hctx hpaps heval
+      | extern address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases hcall : callScalarOracle ctx address values with
+          | error err => rw [hcall, bindErr] at heval; contradiction
+          | ok result =>
+            rw [hcall, bindOk] at heval
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact hpaps
+    · intro ctx address args store store' value hctx hpaps heval
+      rw [invoke.eq_def] at heval
+      dsimp only at heval
+      cases hdecl : ctx.decls address with
+      | none => simp [hdecl] at heval
+      | some declaration =>
+        simp only [hdecl] at heval
+        cases declaration with
+        | extern arity =>
+          cases harity : args.length != arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hcall : callScalarOracle ctx address args with
+            | error err => simp [hcall] at heval
+            | ok result =>
+              simp only [hcall] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact hpaps
+          · simp [harity] at heval
+        | fn definition =>
+          cases harity : args.length != definition.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hbody : runCode ctx fuel definition store args.reverse
+                definition.body with
+            | error err => rw [hbody, bindErr] at heval; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hbody, bindOk] at heval
+              obtain ⟨hresult, _⟩ := Sim.checkResultWorld_ok heval
+              cases hresult
+              have hbodyNo := hctx hdecl
+              exact ihCode _ _ _ _ _ _ _ hctx hbodyNo hbodyNo hpaps hbody
+          · simp [harity] at heval
+    · intro ctx store function args store' value hctx hpaps heval
+      rw [applyGo.eq_def] at heval
+      dsimp only at heval
+      cases function with
+      | lit literal => simp at heval
+      | erased =>
+        cases hdrop : dropMany ctx fuel store args with
+        | error err => rw [hdrop, bindErr] at heval; contradiction
+        | ok dropped =>
+          rw [hdrop, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact hpaps.dropMany hdrop
+      | loc location =>
+        cases hbox : store.get? location with
+        | none => simp [hbox] at heval
+        | some box =>
+          simp only [hbox] at heval
+          cases box with
+          | mk world rc node =>
+            cases node with
+            | ctorN cid fields => simp at heval
+            | papN address arity captured =>
+              dsimp only at heval
+              cases hdup : dupVals store captured.toList with
+              | error err => rw [hdup, bindErr] at heval; contradiction
+              | ok retained =>
+                rw [hdup, bindOk] at heval
+                cases hdrop : dropVal ctx fuel retained (.loc location) with
+                | error err => rw [hdrop, bindErr] at heval; contradiction
+                | ok ready =>
+                  rw [hdrop, bindOk] at heval
+                  have hready := (hpaps.dupVals hdup).dropVal hdrop
+                  by_cases hunder :
+                      (captured.toList ++ args).length < arity
+                  · simp only [hunder, if_true] at heval
+                    have hpair := Except.ok.inj heval
+                    cases hpair
+                    exact hready.allocPap .shared address arity
+                      (captured.toList ++ args).toArray
+                      (by simpa using hunder)
+                  · simp only [hunder, if_false] at heval
+                    by_cases hexact :
+                        (captured.toList ++ args).length = arity
+                    · simp only [hexact, beq_self_eq_true, if_true]
+                        at heval
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at heval
+                      | some declaration =>
+                        cases hpapsafe : declPapSafe declaration with
+                        | false => simp [hdecl, hpapsafe] at heval
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at heval
+                          exact ihInvoke _ _ _ _ _ _ hctx hready heval
+                    · have hbeq :
+                          ((captured.toList ++ args).length == arity) =
+                            false := by
+                        exact beq_eq_false_iff_ne.mpr hexact
+                      simp only [hbeq, Bool.false_eq_true, if_false] at heval
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at heval
+                      | some declaration =>
+                        cases hpapsafe : declPapSafe declaration with
+                        | false => simp [hdecl, hpapsafe] at heval
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at heval
+                          cases hinvoke : invoke ctx fuel address
+                              ((captured.toList ++ args).take arity) ready with
+                          | error err =>
+                            rw [hinvoke, bindErr] at heval
+                            contradiction
+                          | ok called =>
+                            rcases called with ⟨calledStore, calledValue⟩
+                            rw [hinvoke, bindOk] at heval
+                            exact ihApply _ _ _ _ _ _ hctx
+                              (ihInvoke _ _ _ _ _ _ hctx hready hinvoke)
+                              heval
+
+/-- Reuse-free source code preserves strict PAP under-saturation. -/
+theorem runCode_papsUnder {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {code : Code} {value : RVal}
+    (hctx : CtxNoReuse ctx) (hcur : CodeNoReuse cur.body)
+    (hcode : CodeNoReuse code) (hpaps : Reclamation.PAPsUnder store)
+    (heval : runCode ctx fuel cur store env code = .ok (store', value)) :
+    Reclamation.PAPsUnder store' :=
+  (evalPAPsUnderAt fuel).1 ctx cur store env code store' value
+    hctx hcur hcode hpaps heval
+
+/-- Operation-level PAP-shape preservation for a reuse-free instruction. -/
+theorem runOp_papsUnder {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {op : Op} {value : RVal}
+    (hctx : CtxNoReuse ctx) (hcur : CodeNoReuse cur.body)
+    (hop : OpNoReuse op) (hpaps : Reclamation.PAPsUnder store)
+    (heval : runOp ctx fuel cur store env op = .ok (store', value)) :
+    Reclamation.PAPsUnder store' :=
+  (evalPAPsUnderAt fuel).2.1 ctx cur store env op store' value
+    hctx hcur hop hpaps heval
+
+/-- Declared invocation preserves PAP shape in a reuse-free context. -/
+theorem invoke_papsUnder {ctx : Ctx} {fuel : Nat}
+    {address : Ixon.Address} {args : List RVal} {store store' : Store}
+    {value : RVal} (hctx : CtxNoReuse ctx)
+    (hpaps : Reclamation.PAPsUnder store)
+    (heval : invoke ctx fuel address args store = .ok (store', value)) :
+    Reclamation.PAPsUnder store' :=
+  (evalPAPsUnderAt fuel).2.2.1 ctx address args store store' value hctx hpaps
+    heval
+
+/-- Higher-order application preserves PAP shape across all redispatches. -/
+theorem applyGo_papsUnder {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {function : RVal} {args : List RVal}
+    {value : RVal} (hctx : CtxNoReuse ctx)
+    (hpaps : Reclamation.PAPsUnder store)
+    (heval : applyGo ctx fuel store function args = .ok (store', value)) :
+    Reclamation.PAPsUnder store' :=
+  (evalPAPsUnderAt fuel).2.2.2 ctx store function args store' value hctx
+    hpaps heval
+
+theorem runCode_reuses_eq {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {code : Code} {value : RVal}
+    (hctx : CtxNoReuse ctx) (hcur : CodeNoReuse cur.body)
+    (hcode : CodeNoReuse code)
+    (heval : runCode ctx fuel cur store env code = .ok (store', value)) :
+    store'.reuses = store.reuses :=
+  (evalReusesAt fuel).1 ctx cur store env code store' value
+    hctx hcur hcode heval
+
+/-- The operation-level projection of reuse-free execution.  Exporting this
+alongside `runCode_reuses_eq` lets later compositional simulations preserve
+append-only heap invariants one instruction at a time. -/
+theorem runOp_reuses_eq {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {op : Op} {value : RVal}
+    (hctx : CtxNoReuse ctx) (hcur : CodeNoReuse cur.body)
+    (hop : OpNoReuse op)
+    (heval : runOp ctx fuel cur store env op = .ok (store', value)) :
+    store'.reuses = store.reuses :=
+  (evalReusesAt fuel).2.1 ctx cur store env op store' value
+    hctx hcur hop heval
+
+/-- Declared invocation preserves the reuse counter whenever every callable
+body in the runtime context is reuse-free. -/
+theorem invoke_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {address : Ixon.Address} {args : List RVal} {store store' : Store}
+    {value : RVal} (hctx : CtxNoReuse ctx)
+    (heval : invoke ctx fuel address args store = .ok (store', value)) :
+    store'.reuses = store.reuses :=
+  (evalReusesAt fuel).2.2.1 ctx address args store store' value hctx heval
+
+/-- Higher-order application preserves the reuse counter in a reuse-free
+runtime context, including every PAP branch and dynamically selected callee. -/
+theorem applyGo_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {function : RVal} {args : List RVal}
+    {value : RVal} (hctx : CtxNoReuse ctx)
+    (heval : applyGo ctx fuel store function args = .ok (store', value)) :
+    store'.reuses = store.reuses :=
+  (evalReusesAt fuel).2.2.2 ctx store function args store' value hctx heval
+
+/-- A successful fresh execution of a reuse-free closed program executes no
+in-place reuse, so its counter remains definitionally zero. -/
+theorem runMain_reuses_eq_zero {ctx : Ctx} {fuel : Nat} {code : Code}
+    {store : Store} {value : RVal} (hctx : CtxNoReuse ctx)
+    (hcode : CodeNoReuse code)
+    (heval : runMain ctx code fuel = .ok (store, value)) :
+    store.reuses = 0 := by
+  exact (evalReusesAt fuel).1 ctx ⟨0, .shared, false, code⟩ ({} : Store) []
+    code store value hctx hcode hcode heval
+
+/-- The exact counter equation contributed by the current lowerer. -/
+def ReuseFreeCostSpec (observation : LowerSim.CostObservation) : Prop :=
+  observation.reuses = 0
+
+/-- The current lowerer's general counter contract: no in-place reuse and no
+more completed frees than allocations. -/
+def CurrentLowererCostSpec (observation : LowerSim.CostObservation) : Prop :=
+  ReuseFreeCostSpec observation ∧
+    LowerSim.AllocationFreeCostSpec observation
+
+/-- Reuse-free syntax and declarations expose their dynamic counter equation
+through the generic target-only cost interface. -/
+theorem runCostInvariant_of_noReuse {ctx : Ctx} {code : Code}
+    (hctx : CtxNoReuse ctx) (hcode : CodeNoReuse code) :
+    LowerSim.RunCostInvariant ctx code ReuseFreeCostSpec := by
+  intro targetFuel targetStore targetValue hrun
+  exact runMain_reuses_eq_zero hctx hcode hrun
+
+/-- Reuse-free syntax combines its compiler-specific zero-reuse equation
+with the evaluator's general allocation/free balance. -/
+theorem runCostInvariant_of_noReuse_with_allocationFree
+    {ctx : Ctx} {code : Code}
+    (hctx : CtxNoReuse ctx) (hcode : CodeNoReuse code) :
+    LowerSim.RunCostInvariant ctx code CurrentLowererCostSpec := by
+  intro targetFuel targetStore targetValue hrun
+  exact ⟨runMain_reuses_eq_zero hctx hcode hrun,
+    Ix.Compiler.IxIR1.Reclamation.runMain_frees_le_allocs hrun⟩
+
+/-! ## Compiler syntax -/
+
+def DeclNoReuse : Decl → Prop
+  | .fn definition => CodeNoReuse definition.body
+  | .extern _ => True
+
+def DeclListNoReuse (declarations : List (Ixon.Address × Decl)) : Prop :=
+  ∀ declaration ∈ declarations, DeclNoReuse declaration.2
+
+/-- Executable reuse-freedom check for one declaration. -/
+def checkDecl : Decl → Bool
+  | .fn definition => checkCode definition.body
+  | .extern _ => true
+
+/-- Executable reuse-freedom check for a finite declaration environment. -/
+def checkDeclarations (declarations : List (Ixon.Address × Decl)) : Bool :=
+  declarations.all fun declaration => checkDecl declaration.2
+
+theorem checkDecl_eq_true_iff (declaration : Decl) :
+    checkDecl declaration = true ↔ DeclNoReuse declaration := by
+  cases declaration with
+  | fn definition =>
+      exact checkCode_eq_true_iff definition.body
+  | extern arity =>
+      simp [checkDecl, DeclNoReuse]
+
+/-- The finite declaration check reflects exactly into `DeclListNoReuse`. -/
+theorem checkDeclarations_eq_true_iff
+    (declarations : List (Ixon.Address × Decl)) :
+    checkDeclarations declarations = true ↔
+      DeclListNoReuse declarations := by
+  simp only [checkDeclarations, List.all_eq_true, DeclListNoReuse]
+  constructor
+  · intro checked declaration member
+    exact (checkDecl_eq_true_iff declaration.2).mp
+      (checked declaration member)
+  · intro noReuse declaration member
+    exact (checkDecl_eq_true_iff declaration.2).mpr
+      (noReuse declaration member)
+
+def StateNoReuse (state : LowSt) : Prop :=
+  DeclListNoReuse state.extra
+
+theorem StateNoReuse.empty : StateNoReuse ({} : LowSt) := by
+  simp [StateNoReuse, DeclListNoReuse]
+
+/-- A compiler action preserves the reuse-free generated-declaration
+invariant along every successful state transition. -/
+def PreservesStateNoReuse {α : Type} (action : LowerM α) : Prop :=
+  ∀ {initial final result},
+    StateNoReuse initial →
+    action.run initial = .ok result final →
+    StateNoReuse final
+
+private theorem stateBindRun_ok_inv {error state α β : Type}
+    {action : EStateM error state α} {next : α → EStateM error state β}
+    {initial final : state} {result : β}
+    (hrun : (action >>= next).run initial = .ok result final) :
+    ∃ value middle,
+      action.run initial = .ok value middle ∧
+      (next value).run middle = .ok result final := by
+  change
+    (match action.run initial with
+      | .ok value nextState => (next value).run nextState
+      | .error err nextState => .error err nextState) =
+      .ok result final at hrun
+  cases haction : action.run initial with
+  | ok value middle =>
+    rw [haction] at hrun
+    exact ⟨value, middle, rfl, hrun⟩
+  | error err middle =>
+    rw [haction] at hrun
+    contradiction
+
+private theorem stateThrowRun_not_ok {error state α : Type}
+    {err : error} {initial final : state} {result : α}
+    (hrun : (throw err : EStateM error state α).run initial =
+      .ok result final) : False := by
+  change EStateM.Result.error err initial = .ok result final at hrun
+  contradiction
+
+private theorem stateMapRun_ok_inv {α β : Type} {action : LowerM α}
+    {map : α → β} {initial final : LowSt} {result : β}
+    (hrun : (map <$> action).run initial = .ok result final) :
+    ∃ value, action.run initial = .ok value final ∧ map value = result := by
+  have hbind : (action >>= fun value => pure (map value)).run initial =
+      .ok result final := by
+    simpa only [bind_pure_comp] using hrun
+  obtain ⟨value, middle, haction, hpure⟩ := stateBindRun_ok_inv hbind
+  have hresult : map value = result ∧ middle = final := by
+    simpa using hpure
+  cases hresult.2
+  exact ⟨value, haction, hresult.1⟩
+
+theorem PreservesStateNoReuse.pure {α : Type} (value : α) :
+    PreservesStateNoReuse (pure value : LowerM α) := by
+  intro initial final result hinitial hrun
+  have hpure : value = result ∧ initial = final := by
+    simpa using hrun
+  rw [← hpure.2]
+  exact hinitial
+
+theorem PreservesStateNoReuse.throw {α : Type} (message : String) :
+    PreservesStateNoReuse (throw message : LowerM α) := by
+  intro initial final result hinitial hrun
+  exact (stateThrowRun_not_ok hrun).elim
+
+theorem PreservesStateNoReuse.throwBind {α β : Type} (message : String)
+    (next : α → LowerM β) :
+    PreservesStateNoReuse
+      ((EStateM.throw message : LowerM α) >>= next) := by
+  intro initial final result hinitial hrun
+  change EStateM.Result.error message initial = .ok result final at hrun
+  contradiction
+
+theorem PreservesStateNoReuse.get :
+    PreservesStateNoReuse (get : LowerM LowSt) := by
+  intro initial final result hinitial hrun
+  change EStateM.Result.ok initial initial = .ok result final at hrun
+  injection hrun with _ hstate
+  subst final
+  exact hinitial
+
+theorem PreservesStateNoReuse.bind {α β : Type}
+    {action : LowerM α} {next : α → LowerM β}
+    (haction : PreservesStateNoReuse action)
+    (hnext : ∀ value, PreservesStateNoReuse (next value)) :
+    PreservesStateNoReuse (action >>= next) := by
+  intro initial final result hinitial hrun
+  obtain ⟨value, middle, hfirst, hsecond⟩ :=
+    stateBindRun_ok_inv hrun
+  exact hnext value (haction hinitial hfirst) hsecond
+
+theorem PreservesStateNoReuse.map {α β : Type} {action : LowerM α}
+    (haction : PreservesStateNoReuse action) (map : α → β) :
+    PreservesStateNoReuse (map <$> action) := by
+  have hbind : PreservesStateNoReuse
+      (action >>= fun value => (Pure.pure (map value) : LowerM β)) :=
+    PreservesStateNoReuse.bind haction
+      (fun value => PreservesStateNoReuse.pure (map value))
+  intro initial final result hinitial hrun
+  apply hbind hinitial
+  simpa only [bind_pure_comp] using hrun
+
+theorem PreservesStateNoReuse.listMapM {α β : Type}
+    (action : α → LowerM β)
+    (haction : ∀ value, PreservesStateNoReuse (action value)) :
+    ∀ values : List α, PreservesStateNoReuse (values.mapM action)
+  | [] => by
+      simpa using (PreservesStateNoReuse.pure ([] : List β))
+  | value :: rest => by
+      rw [List.mapM_cons]
+      apply PreservesStateNoReuse.bind (haction value)
+      intro head
+      apply PreservesStateNoReuse.bind
+        (PreservesStateNoReuse.listMapM action haction rest)
+      intro tail
+      exact PreservesStateNoReuse.pure (head :: tail)
+
+theorem PreservesStateNoReuse.listFilterMapM {α β : Type}
+    (action : α → LowerM (Option β))
+    (haction : ∀ value, PreservesStateNoReuse (action value)) :
+    ∀ values : List α, PreservesStateNoReuse (values.filterMapM action)
+  | [] => by
+      simpa using (PreservesStateNoReuse.pure ([] : List β))
+  | value :: rest => by
+      rw [List.filterMapM_cons]
+      apply PreservesStateNoReuse.bind (haction value)
+      intro head
+      cases head with
+      | none =>
+        exact PreservesStateNoReuse.listFilterMapM action haction rest
+      | some head =>
+        apply PreservesStateNoReuse.bind
+          (PreservesStateNoReuse.listFilterMapM action haction rest)
+        intro tail
+        exact PreservesStateNoReuse.pure (head :: tail)
+
+theorem StateNoReuse.prepend {state : LowSt}
+    {item : Ixon.Address × Decl} (hitem : DeclNoReuse item.2)
+    (hstate : StateNoReuse state) :
+    StateNoReuse { state with extra := item :: state.extra } := by
+  intro declaration hmember
+  rw [List.mem_cons] at hmember
+  cases hmember with
+  | inl hhead =>
+    subst declaration
+    exact hitem
+  | inr htail => exact hstate declaration htail
+
+theorem ctorWrapperDecl_noReuse (source : Ixon.Address)
+    (tag arity : Nat) :
+    DeclNoReuse (ctorWrapperDecl source tag arity) := by
+  simp [ctorWrapperDecl, DeclNoReuse, CodeNoReuse, OpNoReuse]
+
+theorem freshAddr_preservesStateNoReuse :
+    PreservesStateNoReuse freshAddr := by
+  intro initial final result hinitial hrun
+  change EStateM.Result.ok (synthAddr initial.fresh)
+      { initial with fresh := initial.fresh + 1 } =
+    .ok result final at hrun
+  have hstate : { initial with fresh := initial.fresh + 1 } = final :=
+    congrArg
+      (fun outcome : EStateM.Result String LowSt Ixon.Address =>
+        match outcome with
+        | .ok _ state | .error _ state => state) hrun
+  subst final
+  exact hinitial
+
+theorem pushExtra_preservesStateNoReuse
+    (item : Ixon.Address × Decl) (hitem : DeclNoReuse item.2) :
+    PreservesStateNoReuse (pushExtra item) := by
+  intro initial final result hinitial hrun
+  simp [pushExtra] at hrun
+  subst final
+  exact hinitial.prepend hitem
+
+theorem wrapperFor_preservesStateNoReuse (source : Ixon.Address)
+    (tag arity : Nat) :
+    PreservesStateNoReuse (wrapperFor source tag arity) := by
+  intro initial final result hinitial hrun
+  cases hcached : initial.wrappers.find?
+      (·.matches source tag arity) with
+  | none =>
+    simp [wrapperFor, hcached] at hrun
+    have hstate :
+        { initial with
+            fresh := initial.fresh + 1
+            wrappers :=
+              ⟨source, tag, arity, synthAddr initial.fresh⟩ ::
+                initial.wrappers
+            extra :=
+              (synthAddr initial.fresh,
+                ctorWrapperDecl source tag arity) :: initial.extra } =
+          final := by
+      exact congrArg
+        (fun outcome : EStateM.Result String LowSt Ixon.Address =>
+          match outcome with
+          | .ok _ state | .error _ state => state) hrun
+    subst final
+    exact hinitial.prepend (ctorWrapperDecl_noReuse source tag arity)
+  | some memo =>
+    simp [wrapperFor, hcached] at hrun
+    obtain ⟨_, hstate⟩ := hrun
+    subst final
+    exact hinitial
+
+theorem releaseSlots_emitNoReuse (input : VEnv) :
+    ∀ {drops output emit state finalState},
+      (releaseSlots input drops).run state = .ok (output, emit) finalState →
+      EmitNoReuse emit := by
+  intro drops output emit state finalState hrun
+  exact releaseSlots_run_core
+    (Result := fun _ _ _ resultEmit => EmitNoReuse resultEmit)
+    (hnil := fun _ => emitNoReuse_id)
+    (haffine := by
+      intro entry abs rest initial final tailEmit htail
+      exact emitNoReuse_comp
+        (emitNoReuse_emitOp
+          (op := .dropU (.var (initial.rel abs)))
+          (by simp [OpNoReuse]))
+        htail)
+    (hmany := by
+      intro entry abs rest initial final tailEmit htail
+      exact emitNoReuse_comp
+        (emitNoReuse_emitOp
+          (op := .drop (.var (initial.rel abs)))
+          (by simp [OpNoReuse]))
+        htail)
+    hrun
+
+theorem applyRecursorFieldRetains_emitNoReuse (input : VEnv)
+    (retains : List RecursorFieldRetain) :
+    EmitNoReuse (applyRecursorFieldRetains input retains).2 := by
+  induction retains generalizing input with
+  | nil => exact emitNoReuse_id
+  | cons retain rest ih =>
+    simp only [applyRecursorFieldRetains]
+    exact emitNoReuse_comp
+      (emitNoReuse_emitOp (op := .dup (.var (input.rel retain.fieldAbs)))
+        (by simp [OpNoReuse]))
+      (ih _)
+
+theorem releaseAll_emitNoReuse (input : VEnv) (values : List AVal) :
+    EmitNoReuse (releaseAll input values).2 := by
+  exact releaseAll_traverse_core
+    (Result := fun _ _ _ emit => EmitNoReuse emit)
+    (hnil := fun _ => emitNoReuse_id)
+    (hconst := fun htail => htail)
+    (hslot := by
+      intro initial abs rest output tailEmit htail
+      exact emitNoReuse_comp
+        (emitNoReuse_emitOp (op := .drop (.var (initial.rel abs)))
+          (by simp [OpNoReuse]))
+        htail)
+    input values
+
+theorem lowerCapture_emitNoReuse {expr : IxIR0.Expr} {input output : VEnv}
+    {index : Nat} {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (hrun : (lowerCapture expr input index).run state =
+      .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  cases hentry : input.entries[index]? with
+  | none =>
+    exact (stateThrowRun_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (stateThrowRun_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true :=
+            by decide
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Ixon.Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses index expr
+          · have hemit : emit = emitOp (.dup (.var
+                ((input.setEntry index
+                  (.slot abs (remaining - countUses index expr) uses true)).rel
+                    abs))) := by
+              have hpure := congrArg
+                (fun result : EStateM.Result String LowSt
+                    (VEnv × Emit × AVal) =>
+                  match result with
+                  | .ok result _ => result.2.1
+                  | .error _ _ => (_root_.id : Emit)) hrun
+              simpa [lowerCapture, hentry, huniqueEq, hmore] using hpure.symm
+            subst emit
+            exact emitNoReuse_emitOp
+              (op := .dup (.var
+                ((input.setEntry index
+                  (.slot abs (remaining - countUses index expr) uses true)).rel
+                    abs))) (by simp [OpNoReuse])
+          · by_cases hequal : remaining = countUses index expr
+            · have hemit : emit = (_root_.id : Emit) := by
+                have hpure := congrArg
+                  (fun result : EStateM.Result String LowSt
+                      (VEnv × Emit × AVal) =>
+                    match result with
+                    | .ok result _ => result.2.1
+                    | .error _ _ => (_root_.id : Emit)) hrun
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hpure.symm
+              subst emit
+              exact emitNoReuse_id
+            · exact (stateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_emitNoReuse (expr : IxIR0.Expr) :
+    ∀ {input captures state finalState output emit values},
+      (lowerCaptures expr input captures).run state =
+        .ok (output, emit, values) finalState →
+      EmitNoReuse emit := by
+  intro input captures state finalState output emit values hrun
+  apply lowerCaptures_run_core
+    (Result := fun _ _ _ emit _ => EmitNoReuse emit)
+    (e := expr) (hrun := hrun)
+  · intro input
+    exact emitNoReuse_id
+  · intro index rest input middle output headEmit tailEmit headValue
+      tailValues state middleState hhead htail
+    exact emitNoReuse_comp (lowerCapture_emitNoReuse hhead) htail
+
+def LowerENoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Ixon.Owned} {expr : IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit}
+      {value : AVal},
+    (lowerE src fuel input world expr).run state =
+      .ok (output, emit, value) finalState →
+    EmitNoReuse emit
+
+def LowerBorrowNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal} {release : Bool},
+    (lowerBorrow src fuel input expr).run state =
+      .ok (output, emit, value, release) finalState →
+    EmitNoReuse emit
+
+def LowerSpineNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {world : Ixon.Owned} {head : IxIR0.Expr}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerSpine src fuel input world head args).run state =
+      .ok (output, emit, value) finalState →
+    EmitNoReuse emit
+
+def KnownCallNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {build : Array Atom → Op} {count : Nat}
+      {argWorlds : List Ixon.Owned} {resultWorld : Ixon.Owned}
+      {args : List IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (∀ atoms, OpNoReuse (build atoms)) →
+    (knownCall src fuel input build count argWorlds resultWorld args).run
+        state = .ok (output, emit, value) finalState →
+    EmitNoReuse emit
+
+def LowerArgsNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {args : List (IxIR0.Expr × Ixon.Owned)}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit}
+      {values : List AVal},
+    (lowerArgs src fuel input args).run state =
+      .ok (output, emit, values) finalState →
+    EmitNoReuse emit
+
+def ApplyRestNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {resultWorld : Ixon.Owned} {pre : Emit}
+      {function : AVal} {args : List IxIR0.Expr}
+      {state finalState : LowSt} {output : VEnv} {emit : Emit}
+      {value : AVal},
+    EmitNoReuse pre →
+    (applyRest src fuel input resultWorld pre function args).run state =
+      .ok (output, emit, value) finalState →
+    EmitNoReuse emit
+
+def LowerLamNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {expr : IxIR0.Expr} {state finalState : LowSt}
+      {output : VEnv} {emit : Emit} {value : AVal},
+    (lowerLam src fuel input expr).run state =
+      .ok (output, emit, value) finalState →
+    EmitNoReuse emit
+
+def LowerFnBodyNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ {input : VEnv} {drops : List SlotDrop} {world : Ixon.Owned}
+      {body : IxIR0.Expr} {state finalState : LowSt} {code : Code},
+    (lowerFnBody src fuel input drops world body).run state =
+      .ok code finalState →
+    CodeNoReuse code
+
+structure LowerNoReuseCluster (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerENoReuse src fuel
+  borrow : LowerBorrowNoReuse src fuel
+  spine : LowerSpineNoReuse src fuel
+  knownCall : KnownCallNoReuse src fuel
+  args : LowerArgsNoReuse src fuel
+  applyRest : ApplyRestNoReuse src fuel
+  lam : LowerLamNoReuse src fuel
+  fnBody : LowerFnBodyNoReuse src fuel
+
+private theorem lowerNoReuse_zero (src : IxIR0.Env) :
+    LowerNoReuseCluster src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr state finalState output emit value hrun
+    exact (stateThrowRun_not_ok (by simpa [lowerE] using hrun)).elim
+  · intro input expr state finalState output emit value release hrun
+    exact (stateThrowRun_not_ok (by simpa [lowerBorrow] using hrun)).elim
+  · intro input world head args state finalState output emit value hrun
+    exact (stateThrowRun_not_ok (by simpa [lowerSpine] using hrun)).elim
+  · intro input build count argWorlds resultWorld args state finalState
+      output emit value hbuild hrun
+    exact (stateThrowRun_not_ok (by simpa [knownCall] using hrun)).elim
+  · intro input args state finalState output emit values hrun
+    exact (stateThrowRun_not_ok (by simpa [lowerArgs] using hrun)).elim
+  · intro input resultWorld pre function args state finalState output emit
+      value hpre hrun
+    exact (stateThrowRun_not_ok (by simpa [applyRest] using hrun)).elim
+  · intro input expr state finalState output emit value hrun
+    exact (stateThrowRun_not_ok (by simpa [lowerLam] using hrun)).elim
+  · intro input drops world body state finalState code hrun
+    exact (stateThrowRun_not_ok (by simpa [lowerFnBody] using hrun)).elim
+
+private theorem lowerArgsNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel) (hargs : LowerArgsNoReuse src fuel) :
+    LowerArgsNoReuse src (fuel + 1) := by
+  intro input args state finalState output emit values hrun
+  cases args with
+  | nil =>
+    have hpure :
+        (input, (_root_.id : Emit), []) = (output, emit, values) ∧
+          state = finalState := by
+      simpa [lowerArgs] using hrun
+    cases hpure.1
+    exact emitNoReuse_id
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs] at hrun
+    obtain ⟨headResult, middleState, hhead, hafterHead⟩ :=
+      stateBindRun_ok_inv hrun
+    rcases headResult with ⟨middle, headEmit, headValue⟩
+    obtain ⟨tailResult, tailState, htail, hpure⟩ :=
+      stateBindRun_ok_inv hafterHead
+    rcases tailResult with ⟨actualOutput, tailEmit, tailValues⟩
+    have hemit : headEmit ∘ tailEmit = emit := by
+      simpa using congrArg
+        (fun result : EStateM.Result String LowSt
+            (VEnv × Emit × List AVal) =>
+          match result with
+          | .ok result _ => result.2.1
+          | .error _ _ => (_root_.id : Emit)) hpure
+    subst emit
+    exact emitNoReuse_comp (hexpr hhead) (hargs htail)
+
+private theorem applyRestNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsNoReuse src fuel) :
+    ApplyRestNoReuse src (fuel + 1) := by
+  intro input resultWorld pre function args state finalState output emit value
+    hpre hrun
+  cases function with
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest] at hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpure⟩ :=
+        stateBindRun_ok_inv hrun
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hemit :
+          pre ∘ argsEmit ∘ (releaseAll middle values).2 = emit := by
+        simpa using congrArg
+          (fun result : EStateM.Result String LowSt
+              (VEnv × Emit × AVal) =>
+            match result with
+            | .ok result _ => result.2.1
+            | .error _ _ => (_root_.id : Emit)) hpure
+      subst emit
+      have hargsNo : EmitNoReuse argsEmit := hargs hargsRun
+      have hprefix : EmitNoReuse (pre ∘ argsEmit) :=
+        emitNoReuse_comp (first := pre) (second := argsEmit) hpre hargsNo
+      exact emitNoReuse_comp
+        (first := pre ∘ argsEmit)
+        (second := (releaseAll middle values).2) hprefix
+        (releaseAll_emitNoReuse middle values)
+    | var relative =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ :=
+        stateBindRun_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpure⟩ :=
+        stateBindRun_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hemit : pre ∘ argsEmit ∘ emitOp (.apply
+          ((AVal.constA (.var relative)).toAtom middle)
+          (values.map (·.toAtom middle)).toArray) = emit := by
+        simpa using congrArg
+          (fun result : EStateM.Result String LowSt
+              (VEnv × Emit × AVal) =>
+            match result with
+            | .ok result _ => result.2.1
+            | .error _ _ => (_root_.id : Emit)) hpure
+      subst emit
+      have hargsNo : EmitNoReuse argsEmit := hargs hargsRun
+      have hprefix : EmitNoReuse (pre ∘ argsEmit) :=
+        emitNoReuse_comp (first := pre) (second := argsEmit) hpre hargsNo
+      exact emitNoReuse_comp
+        (first := pre ∘ argsEmit)
+        (second := emitOp (.apply
+          ((AVal.constA (.var relative)).toAtom middle)
+          (values.map (·.toAtom middle)).toArray)) hprefix
+        (emitNoReuse_emitOp (by simp [OpNoReuse]))
+    | lit literal =>
+      simp only [applyRest] at hrun
+      obtain ⟨_, checkedState, _, hafterCheck⟩ :=
+        stateBindRun_ok_inv hrun
+      obtain ⟨argsResult, argsState, hargsRun, hpure⟩ :=
+        stateBindRun_ok_inv hafterCheck
+      rcases argsResult with ⟨middle, argsEmit, values⟩
+      have hemit : pre ∘ argsEmit ∘ emitOp (.apply
+          ((AVal.constA (.lit literal)).toAtom middle)
+          (values.map (·.toAtom middle)).toArray) = emit := by
+        simpa using congrArg
+          (fun result : EStateM.Result String LowSt
+              (VEnv × Emit × AVal) =>
+            match result with
+            | .ok result _ => result.2.1
+            | .error _ _ => (_root_.id : Emit)) hpure
+      subst emit
+      have hargsNo : EmitNoReuse argsEmit := hargs hargsRun
+      have hprefix : EmitNoReuse (pre ∘ argsEmit) :=
+        emitNoReuse_comp (first := pre) (second := argsEmit) hpre hargsNo
+      exact emitNoReuse_comp
+        (first := pre ∘ argsEmit)
+        (second := emitOp (.apply
+          ((AVal.constA (.lit literal)).toAtom middle)
+          (values.map (·.toAtom middle)).toArray)) hprefix
+        (emitNoReuse_emitOp (by simp [OpNoReuse]))
+  | slotA abs =>
+    simp only [applyRest] at hrun
+    obtain ⟨_, checkedState, _, hafterCheck⟩ :=
+      stateBindRun_ok_inv hrun
+    obtain ⟨argsResult, argsState, hargsRun, hpure⟩ :=
+      stateBindRun_ok_inv hafterCheck
+    rcases argsResult with ⟨middle, argsEmit, values⟩
+    have hemit : pre ∘ argsEmit ∘ emitOp (.apply
+        ((AVal.slotA abs).toAtom middle)
+        (values.map (·.toAtom middle)).toArray) = emit := by
+      simpa using congrArg
+        (fun result : EStateM.Result String LowSt
+            (VEnv × Emit × AVal) =>
+          match result with
+          | .ok result _ => result.2.1
+          | .error _ _ => (_root_.id : Emit)) hpure
+    subst emit
+    have hargsNo : EmitNoReuse argsEmit := hargs hargsRun
+    have hprefix : EmitNoReuse (pre ∘ argsEmit) :=
+      emitNoReuse_comp (first := pre) (second := argsEmit) hpre hargsNo
+    exact emitNoReuse_comp
+      (first := pre ∘ argsEmit)
+      (second := emitOp (.apply ((AVal.slotA abs).toAtom middle)
+        (values.map (·.toAtom middle)).toArray)) hprefix
+      (emitNoReuse_emitOp (by simp [OpNoReuse]))
+
+private theorem knownCallNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsNoReuse src fuel)
+    (hrest : ApplyRestNoReuse src fuel) :
+    KnownCallNoReuse src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args state finalState output
+    emit value hbuild hrun
+  simp only [knownCall] at hrun
+  obtain ⟨argsResult, argsState, hargsRun, hafterArgs⟩ :=
+    stateBindRun_ok_inv hrun
+  rcases argsResult with ⟨middle, argsEmit, values⟩
+  by_cases hterminal : args.length ≤ count
+  · have hpure :
+        (middle.bump,
+          argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray),
+          AVal.slotA middle.depth) = (output, emit, value) ∧
+          argsState = finalState := by
+      simpa [hterminal] using hafterArgs
+    have hemit : argsEmit ∘ emitOp
+        (build (values.map (·.toAtom middle)).toArray) = emit :=
+      congrArg (fun result : VEnv × Emit × AVal => result.2.1) hpure.1
+    subst emit
+    have hargsNo : EmitNoReuse argsEmit := hargs hargsRun
+    exact emitNoReuse_comp (first := argsEmit)
+      (second := emitOp
+        (build (values.map (·.toAtom middle)).toArray)) hargsNo
+      (emitNoReuse_emitOp (hbuild _))
+  · have hrestRun :
+        (applyRest src fuel middle.bump resultWorld
+          (argsEmit ∘ emitOp
+            (build (values.map (·.toAtom middle)).toArray))
+          (.slotA middle.depth)
+          (args.drop count)).run argsState =
+            .ok (output, emit, value) finalState := by
+      simpa [hterminal] using hafterArgs
+    have hargsNo : EmitNoReuse argsEmit := hargs hargsRun
+    have hpre : EmitNoReuse (argsEmit ∘ emitOp
+        (build (values.map (·.toAtom middle)).toArray)) :=
+      emitNoReuse_comp (first := argsEmit)
+        (second := emitOp
+          (build (values.map (·.toAtom middle)).toArray)) hargsNo
+        (emitNoReuse_emitOp (hbuild _))
+    exact hrest hpre hrestRun
+
+private theorem lowerBorrow_dynamicNoReuse {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel)
+    {input output : VEnv} {expr : IxIR0.Expr}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    {release : Bool}
+    {finish : (VEnv × Emit × AVal) → (VEnv × Emit × AVal × Bool)}
+    (hrun : (finish <$> lowerE src fuel input .shared expr).run state =
+      .ok (output, emit, value, release) finalState)
+    (hfinish : ∀ result, (finish result).2.1 = result.2.1) :
+    EmitNoReuse emit := by
+  obtain ⟨exprResult, hexprRun, hvalue⟩ := stateMapRun_ok_inv hrun
+  rcases exprResult with ⟨middle, middleEmit, middleValue⟩
+  have hemit : middleEmit = emit :=
+    calc
+      middleEmit = (finish (middle, middleEmit, middleValue)).2.1 :=
+        (hfinish (middle, middleEmit, middleValue)).symm
+      _ = emit := congrArg
+        (fun result : VEnv × Emit × AVal × Bool => result.2.1)
+        hvalue
+  subst emit
+  exact hexpr hexprRun
+
+private theorem lowerBorrowVarNoReuse {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {index : Nat} {state finalState : LowSt}
+    {emit : Emit} {value : AVal} {release : Bool}
+    (hrun : (lowerBorrow src (fuel + 1) input (.var index)).run state =
+      .ok (output, emit, value, release) finalState) :
+    EmitNoReuse emit := by
+  cases hentry : input.entries[index]? with
+  | none =>
+    exact (stateThrowRun_not_ok (by
+      simpa [lowerBorrow, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerBorrow, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (stateThrowRun_not_ok (by
+          simpa [lowerBorrow, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true :=
+            by decide
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerBorrow, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Ixon.Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          cases remaining with
+          | zero =>
+            exact (stateThrowRun_not_ok (by
+              simpa [lowerBorrow, hentry, huniqueEq] using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry index (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs, true) =
+                      (output, emit, value, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, huniqueEq] using hrun
+              have hemit : (_root_.id : Emit) = emit :=
+                congrArg
+                  (fun result : VEnv × Emit × AVal × Bool =>
+                    result.2.1) hpure.1
+              rw [← hemit]
+              exact emitNoReuse_id
+            | succ remaining =>
+              have hpure :
+                  (input.setEntry index
+                      (.slot abs (remaining + 1) uses true),
+                    (_root_.id : Emit), AVal.slotA abs, false) =
+                      (output, emit, value, release) ∧
+                    state = finalState := by
+                simpa [lowerBorrow, hentry, huniqueEq] using hrun
+              have hemit : (_root_.id : Emit) = emit :=
+                congrArg
+                  (fun result : VEnv × Emit × AVal × Bool =>
+                    result.2.1) hpure.1
+              rw [← hemit]
+              exact emitNoReuse_id
+
+private theorem lowerBorrowNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel) :
+    LowerBorrowNoReuse src (fuel + 1) := by
+  intro input expr state finalState output emit value release hrun
+  cases expr with
+  | var index => exact lowerBorrowVarNoReuse hrun
+  | ref address =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | app function argument =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | lam uses body =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | letE uses bound body =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | proj index source =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | lit literal =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+  | erased =>
+    exact lowerBorrow_dynamicNoReuse hexpr
+      (by simpa [lowerBorrow] using hrun) (fun _ => rfl)
+
+private theorem lowerEApplyRestNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel)
+    (hrest : ApplyRestNoReuse src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {head : IxIR0.Expr}
+    {args : List IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (do
+      let (middle, headEmit, function) ←
+        lowerE src fuel input .shared head
+      applyRest src fuel middle world headEmit function args).run state =
+        .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  obtain ⟨headResult, middleState, hhead, htail⟩ :=
+    stateBindRun_ok_inv hrun
+  rcases headResult with ⟨middle, headEmit, function⟩
+  exact hrest (hexpr hhead) htail
+
+private theorem lowerSpineNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel)
+    (hspine : LowerSpineNoReuse src fuel)
+    (hknown : KnownCallNoReuse src fuel)
+    (hrest : ApplyRestNoReuse src fuel) :
+    LowerSpineNoReuse src (fuel + 1) := by
+  intro input world head args state finalState output emit value hrun
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by
+    decide
+  cases head with
+  | app function argument =>
+    exact hspine (by simpa [lowerSpine] using hrun)
+  | erased =>
+    exact hrest emitNoReuse_id (by simpa [lowerSpine] using hrun)
+  | var index =>
+    simp only [lowerSpine] at hrun
+    cases hentry : input.entries[index]? with
+    | none =>
+      exact lowerEApplyRestNoReuse hexpr hrest (by
+        simpa [hentry] using hrun)
+    | some entry =>
+      cases entry with
+      | slot abs remaining uses held =>
+        exact lowerEApplyRestNoReuse hexpr hrest (by
+          simpa [hentry] using hrun)
+      | recSelf arity =>
+        by_cases hunder : args.length < arity
+        · exact (stateThrowRun_not_ok (by
+            simpa [hentry, hunder] using hrun)).elim
+        · obtain ⟨_, checkedState, _, hknownRun⟩ :=
+            stateBindRun_ok_inv (by simpa [hentry, hunder] using hrun)
+          exact hknown (by intro atoms; simp [OpNoReuse]) hknownRun
+  | ref address =>
+    simp only [lowerSpine] at hrun
+    cases hsource : src address with
+    | none =>
+      exact (stateThrowRun_not_ok (by
+        simpa [hsource] using hrun)).elim
+    | some declaration =>
+      cases declaration with
+      | defn result body =>
+        by_cases hunder : args.length < lamArity body
+        · cases world with
+          | unique =>
+            exact (stateThrowRun_not_ok (by
+              simpa [hsource, hunder] using hrun)).elim
+          | shared =>
+            cases result with
+            | unique =>
+              exact (stateThrowRun_not_ok (by
+                simpa [hsource, hunder] using hrun)).elim
+            | shared =>
+              cases hp : papSafe body with
+              | false =>
+                exact (stateThrowRun_not_ok (by
+                  simpa [hsource, hunder, hp, hsuEq] using hrun)).elim
+              | true =>
+                exact hknown
+                  (build := fun atoms => .papp address atoms)
+                  (by intro atoms; simp [OpNoReuse]) (by
+                  simpa [hsource, hunder, hp, hsuEq] using hrun)
+        · obtain ⟨_, checkedState, _, hknownRun⟩ :=
+            stateBindRun_ok_inv (by
+              simpa [hsource, hunder] using hrun)
+          exact hknown (by intro atoms; simp [OpNoReuse]) hknownRun
+      | ctor tag arity =>
+        by_cases hunder : args.length < arity
+        · cases world with
+          | unique =>
+            exact (stateThrowRun_not_ok (by
+              simpa [hsource, hunder] using hrun)).elim
+          | shared =>
+            obtain ⟨wrapper, wrapperState, _, hknownRun⟩ :=
+              stateBindRun_ok_inv (by
+                simpa [hsource, hunder] using hrun)
+            exact hknown (by intro atoms; simp [OpNoReuse]) hknownRun
+        · exact hknown
+            (build := fun atoms => .alloc world (ctorIdOf address tag) atoms)
+            (by intro atoms; simp [OpNoReuse]) (by
+            simpa [hsource, hunder] using hrun)
+      | recursor numArgs natLit rules =>
+        by_cases hunder : args.length < numArgs + 1
+        · cases world with
+          | unique =>
+            exact (stateThrowRun_not_ok (by
+              simpa [hsource, hunder] using hrun)).elim
+          | shared =>
+            exact hknown
+              (build := fun atoms => .papp address atoms)
+              (by intro atoms; simp [OpNoReuse]) (by
+              simpa [hsource, hunder] using hrun)
+        · obtain ⟨_, checkedState, _, hknownRun⟩ :=
+            stateBindRun_ok_inv (by
+              simpa [hsource, hunder] using hrun)
+          exact hknown (by intro atoms; simp [OpNoReuse]) hknownRun
+      | extern arity =>
+        by_cases hunder : args.length < arity
+        · cases world with
+          | unique =>
+            exact (stateThrowRun_not_ok (by
+              simpa [hsource, hunder] using hrun)).elim
+          | shared =>
+            exact hknown
+              (build := fun atoms => .papp address atoms)
+              (by intro atoms; simp [OpNoReuse]) (by
+              simpa [hsource, hunder] using hrun)
+        · exact hknown
+            (build := fun atoms => .extern address atoms)
+            (by intro atoms; simp [OpNoReuse]) (by
+            simpa [hsource, hunder] using hrun)
+  | lam uses body =>
+    exact lowerEApplyRestNoReuse hexpr hrest (by
+      simpa [lowerSpine] using hrun)
+  | letE uses bound body =>
+    exact lowerEApplyRestNoReuse hexpr hrest (by
+      simpa [lowerSpine] using hrun)
+  | proj index source =>
+    exact lowerEApplyRestNoReuse hexpr hrest (by
+      simpa [lowerSpine] using hrun)
+  | lit literal =>
+    exact lowerEApplyRestNoReuse hexpr hrest (by
+      simpa [lowerSpine] using hrun)
+
+private theorem lowerEVarNoReuse {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {state finalState : LowSt} {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.var index)).run state =
+      .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  have hssNe : (Ixon.Owned.shared != Ixon.Owned.shared) = false := by
+    decide
+  have huuNe : (Ixon.Owned.unique != Ixon.Owned.unique) = false := by
+    decide
+  have hsuNe : (Ixon.Owned.shared != Ixon.Owned.unique) = true := by
+    decide
+  have husNe : (Ixon.Owned.unique != Ixon.Owned.shared) = true := by
+    decide
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by
+    decide
+  have huuEq : (Ixon.Owned.unique == Ixon.Owned.unique) = true := by
+    decide
+  cases hentry : input.entries[index]? with
+  | none =>
+    exact (stateThrowRun_not_ok (by
+      simpa [lowerE, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerE, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (stateThrowRun_not_ok (by
+          simpa [lowerE, hentry] using hrun)).elim
+      | true =>
+        by_cases hworld : worldOfUses uses = world
+        · subst world
+          have hsame :
+              (worldOfUses uses != worldOfUses uses) = false := by
+            cases uses <;> decide
+          cases remaining with
+          | zero =>
+            exact (stateThrowRun_not_ok (by
+              simpa [lowerE, hentry, hsame] using hrun)).elim
+          | succ remaining =>
+            cases remaining with
+            | zero =>
+              have hpure :
+                  (input.setEntry index (.slot abs 0 uses false),
+                    (_root_.id : Emit), AVal.slotA abs) =
+                      (output, emit, value) ∧ state = finalState := by
+                simpa [lowerE, hentry, hsame] using hrun
+              have hemit : (_root_.id : Emit) = emit :=
+                congrArg
+                  (fun result : VEnv × Emit × AVal => result.2.1)
+                  hpure.1
+              rw [← hemit]
+              exact emitNoReuse_id
+            | succ remaining =>
+              cases uses with
+              | erased =>
+                have hpure :
+                    let input' := input.setEntry index
+                      (.slot abs (Nat.succ remaining) .erased true)
+                    (input'.bump,
+                      emitOp (.dup (.var (input'.rel abs))),
+                      AVal.slotA input'.depth) =
+                        (output, emit, value) ∧ state = finalState := by
+                  simpa [lowerE, hentry, worldOfUses, hsame, hsuEq,
+                    hssNe, huuNe, hsuNe, husNe, huuEq] using hrun
+                dsimp only at hpure
+                have hemit :
+                    emitOp (.dup (.var
+                      ((input.setEntry index
+                        (.slot abs (Nat.succ remaining) .erased true)).rel
+                          abs))) = emit := by
+                  simpa using congrArg
+                    (fun result : VEnv × Emit × AVal => result.2.1)
+                    hpure.1
+                rw [← hemit]
+                exact emitNoReuse_emitOp (by simp [OpNoReuse])
+              | linear =>
+                exact (stateThrowRun_not_ok (by
+                  simpa [lowerE, hentry, worldOfUses, hsame, huuEq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq] using hrun)).elim
+              | affine =>
+                exact (stateThrowRun_not_ok (by
+                  simpa [lowerE, hentry, worldOfUses, hsame, huuEq,
+                    hssNe, huuNe, hsuNe, husNe, hsuEq] using hrun)).elim
+              | many =>
+                have hpure :
+                    let input' := input.setEntry index
+                      (.slot abs (Nat.succ remaining) .many true)
+                    (input'.bump,
+                      emitOp (.dup (.var (input'.rel abs))),
+                      AVal.slotA input'.depth) =
+                        (output, emit, value) ∧ state = finalState := by
+                  simpa [lowerE, hentry, worldOfUses, hsame, hsuEq,
+                    hssNe, huuNe, hsuNe, husNe, huuEq] using hrun
+                dsimp only at hpure
+                have hemit :
+                    emitOp (.dup (.var
+                      ((input.setEntry index
+                        (.slot abs (Nat.succ remaining) .many true)).rel
+                          abs))) = emit := by
+                  simpa using congrArg
+                    (fun result : VEnv × Emit × AVal => result.2.1)
+                    hpure.1
+                rw [← hemit]
+                exact emitNoReuse_emitOp (by simp [OpNoReuse])
+        · have hdiff : (worldOfUses uses != world) = true := by
+            cases uses <;> cases world <;>
+              simp_all [worldOfUses] <;> decide
+          cases uses <;> cases world
+          all_goals
+            try { exact (hworld (by rfl)).elim }
+          all_goals
+            exact (stateThrowRun_not_ok (by
+              simpa [lowerE, hentry, worldOfUses, hdiff, hssNe, huuNe,
+                hsuNe, husNe, hsuEq, huuEq] using hrun)).elim
+
+private theorem pureTripleRun_emitNoReuse
+    {expectedOutput output : VEnv} {expectedEmit emit : Emit}
+    {expectedValue value : AVal} {state finalState : LowSt}
+    (hexpected : EmitNoReuse expectedEmit)
+    (hrun : (pure (expectedOutput, expectedEmit, expectedValue) :
+        LowerM (VEnv × Emit × AVal)).run state =
+      .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  have hpure :
+      (expectedOutput, expectedEmit, expectedValue) =
+          (output, emit, value) ∧ state = finalState := by
+    simpa using hrun
+  have hemit : expectedEmit = emit :=
+    congrArg (fun result : VEnv × Emit × AVal => result.2.1) hpure.1
+  rw [← hemit]
+  exact hexpected
+
+private theorem lowerERefNoReuse {src : IxIR0.Env} {fuel : Nat}
+    {input output : VEnv} {world : Ixon.Owned}
+    {address : Ixon.Address} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world (.ref address)).run state =
+      .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  have hsuEq : (Ixon.Owned.shared == Ixon.Owned.unique) = false := by
+    decide
+  cases hsource : src address with
+  | none =>
+    exact (stateThrowRun_not_ok (by
+      simpa [lowerE, hsource] using hrun)).elim
+  | some declaration =>
+    cases declaration with
+    | defn result body =>
+      cases harity : lamArity body with
+      | zero =>
+        obtain ⟨unitValue, _, hvalue⟩ :=
+          stateMapRun_ok_inv (by
+            simpa [lowerE, hsource, harity] using hrun)
+        cases unitValue
+        have hemit : emitOp (.call address #[]) = emit :=
+          congrArg (fun result : VEnv × Emit × AVal => result.2.1)
+            hvalue
+        rw [← hemit]
+        exact emitNoReuse_emitOp (by simp [OpNoReuse])
+      | succ arity =>
+        cases world with
+        | unique =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerE, hsource, harity] using hrun)).elim
+        | shared =>
+          cases result with
+          | unique =>
+            exact (stateThrowRun_not_ok (by
+              simpa [lowerE, hsource, harity] using hrun)).elim
+          | shared =>
+            cases hp : papSafe body with
+            | false =>
+              exact (stateThrowRun_not_ok (by
+                simpa [lowerE, hsource, harity, hp, hsuEq]
+                  using hrun)).elim
+            | true =>
+              exact pureTripleRun_emitNoReuse
+                (emitNoReuse_emitOp (op := .papp address #[])
+                  (by simp [OpNoReuse])) (by
+                    simpa [lowerE, hsource, harity, hp, hsuEq]
+                      using hrun)
+    | ctor tag arity =>
+      cases arity with
+      | zero =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_emitOp
+            (op := .alloc world (ctorIdOf address tag) #[])
+            (by simp [OpNoReuse])) (by
+              simpa [lowerE, hsource] using hrun)
+      | succ arity =>
+        cases world with
+        | unique =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerE, hsource] using hrun)).elim
+        | shared =>
+          obtain ⟨wrapper, _, hvalue⟩ :=
+            stateMapRun_ok_inv (by
+              simpa [lowerE, hsource] using hrun)
+          have hemit : emitOp (.papp wrapper #[]) = emit :=
+            congrArg (fun result : VEnv × Emit × AVal => result.2.1)
+              hvalue
+          rw [← hemit]
+          exact emitNoReuse_emitOp (by simp [OpNoReuse])
+    | recursor numArgs natLit rules =>
+      cases world with
+      | unique =>
+        exact (stateThrowRun_not_ok (by
+          simpa [lowerE, hsource] using hrun)).elim
+      | shared =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_emitOp (op := .papp address #[])
+            (by simp [OpNoReuse])) (by
+              simpa [lowerE, hsource] using hrun)
+    | extern arity =>
+      cases arity with
+      | zero =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_emitOp (op := .extern address #[])
+            (by simp [OpNoReuse])) (by
+              simpa [lowerE, hsource] using hrun)
+      | succ arity =>
+        cases world with
+        | unique =>
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerE, hsource] using hrun)).elim
+        | shared =>
+          exact pureTripleRun_emitNoReuse
+            (emitNoReuse_emitOp (op := .papp address #[])
+              (by simp [OpNoReuse])) (by
+                simpa [lowerE, hsource] using hrun)
+
+private theorem lowerELetNoReuse {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {uses : Ixon.Uses}
+    {bound body : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.letE uses bound body)).run state =
+        .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  obtain ⟨boundResult, boundState, hbound, hafterBound⟩ :=
+    stateBindRun_ok_inv (by simpa [lowerE] using hrun)
+  rcases boundResult with ⟨middle, boundEmit, boundValue⟩
+  have hboundNo : EmitNoReuse boundEmit := hexpr hbound
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · cases uses with
+      | erased =>
+        obtain ⟨_, _, hthrow, _⟩ := stateBindRun_ok_inv (by
+          simpa [hzero] using hafterBound)
+        exact (stateThrowRun_not_ok hthrow).elim
+      | linear =>
+        obtain ⟨_, _, hthrow, _⟩ := stateBindRun_ok_inv (by
+          simpa [hzero] using hafterBound)
+        exact (stateThrowRun_not_ok hthrow).elim
+      | affine =>
+        obtain ⟨bodyResult, hbody, hvalue⟩ :=
+          stateMapRun_ok_inv (by simpa [hzero] using hafterBound)
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+        have hemit :
+            boundEmit ∘ emitOp (.dropU (.var (middle.rel abs))) ∘
+              bodyEmit = emit := by
+          exact congrArg
+            (fun result : VEnv × Emit × AVal => result.2.1) hvalue
+        rw [← hemit]
+        exact emitNoReuse_comp (first := boundEmit)
+          (second := emitOp (.dropU (.var (middle.rel abs))) ∘ bodyEmit)
+          hboundNo
+          (emitNoReuse_comp
+            (emitNoReuse_emitOp (by simp [OpNoReuse]))
+            (hexpr hbody))
+      | many =>
+        obtain ⟨bodyResult, hbody, hvalue⟩ :=
+          stateMapRun_ok_inv (by simpa [hzero] using hafterBound)
+        rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+        have hemit :
+            boundEmit ∘ emitOp (.drop (.var (middle.rel abs))) ∘
+              bodyEmit = emit := by
+          exact congrArg
+            (fun result : VEnv × Emit × AVal => result.2.1) hvalue
+        rw [← hemit]
+        exact emitNoReuse_comp (first := boundEmit)
+          (second := emitOp (.drop (.var (middle.rel abs))) ∘ bodyEmit)
+          hboundNo
+          (emitNoReuse_comp
+            (emitNoReuse_emitOp (by simp [OpNoReuse]))
+            (hexpr hbody))
+    · obtain ⟨bodyResult, hbody, hvalue⟩ :=
+        stateMapRun_ok_inv (by simpa [hzero] using hafterBound)
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+      have hemit : boundEmit ∘ bodyEmit = emit := by
+        exact congrArg
+          (fun result : VEnv × Emit × AVal => result.2.1) hvalue
+      rw [← hemit]
+      exact emitNoReuse_comp hboundNo (hexpr hbody)
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · obtain ⟨bodyResult, hbody, hvalue⟩ :=
+        stateMapRun_ok_inv (by simpa [hzero] using hafterBound)
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+      have hemit :
+          boundEmit ∘ emitOp (.pure atom) ∘ bodyEmit = emit := by
+        exact congrArg
+          (fun result : VEnv × Emit × AVal => result.2.1) hvalue
+      rw [← hemit]
+      exact emitNoReuse_comp (first := boundEmit)
+        (second := emitOp (.pure atom) ∘ bodyEmit) hboundNo
+        (emitNoReuse_comp
+          (emitNoReuse_emitOp (by simp [OpNoReuse]))
+          (hexpr hbody))
+    · obtain ⟨bodyResult, hbody, hvalue⟩ :=
+        stateMapRun_ok_inv (by simpa [hzero] using hafterBound)
+      rcases bodyResult with ⟨bodyOutput, bodyEmit, bodyValue⟩
+      have hemit :
+          boundEmit ∘ emitOp (.pure atom) ∘ bodyEmit = emit := by
+        exact congrArg
+          (fun result : VEnv × Emit × AVal => result.2.1) hvalue
+      rw [← hemit]
+      exact emitNoReuse_comp (first := boundEmit)
+        (second := emitOp (.pure atom) ∘ bodyEmit) hboundNo
+        (emitNoReuse_comp
+          (emitNoReuse_emitOp (by simp [OpNoReuse]))
+          (hexpr hbody))
+
+private theorem lowerEProjNoReuse {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowNoReuse src fuel)
+    {input output : VEnv} {world : Ixon.Owned} {index : Nat}
+    {source : IxIR0.Expr} {state finalState : LowSt}
+    {emit : Emit} {value : AVal}
+    (hrun : (lowerE src (fuel + 1) input world
+      (.proj index source)).run state =
+        .ok (output, emit, value) finalState) :
+    EmitNoReuse emit := by
+  cases world with
+  | unique =>
+    simp [lowerE] at hrun
+  | shared =>
+    obtain ⟨borrowResult, borrowState, hborrowRun, hafterBorrow⟩ :=
+      stateBindRun_ok_inv (by simpa [lowerE] using hrun)
+    rcases borrowResult with ⟨middle, borrowEmit, borrowed, release⟩
+    have hborrowNo : EmitNoReuse borrowEmit := hborrow hborrowRun
+    cases borrowed with
+    | constA atom =>
+      cases atom with
+      | erased =>
+        exact pureTripleRun_emitNoReuse hborrowNo (by
+          simpa using hafterBorrow)
+      | var relative =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_comp hborrowNo
+            (emitNoReuse_emitOp
+              (op := .fetch (.var relative) index)
+              (by simp [OpNoReuse]))) (by
+              simpa using hafterBorrow)
+      | lit literal =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_comp hborrowNo
+            (emitNoReuse_emitOp
+              (op := .fetch (.lit literal) index)
+              (by simp [OpNoReuse]))) (by
+              simpa using hafterBorrow)
+    | slotA abs =>
+      cases release with
+      | false =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_comp (first := borrowEmit)
+            (second := emitOp (.fetch (.var (middle.rel abs)) index) ∘
+              emitOp (.dup (.var (middle.bump.rel middle.depth))))
+            hborrowNo
+            (emitNoReuse_comp
+              (emitNoReuse_emitOp (by simp [OpNoReuse]))
+              (emitNoReuse_emitOp (by simp [OpNoReuse])))) (by
+                simpa using hafterBorrow)
+      | true =>
+        exact pureTripleRun_emitNoReuse
+          (emitNoReuse_comp (first := borrowEmit)
+            (second := emitOp (.fetch (.var (middle.rel abs)) index) ∘
+              emitOp (.dup (.var (middle.bump.rel middle.depth))) ∘
+              emitOp (.drop (.var (middle.bump.bump.rel abs))))
+            hborrowNo
+            (emitNoReuse_comp
+              (emitNoReuse_emitOp (by simp [OpNoReuse]))
+              (emitNoReuse_comp
+                (emitNoReuse_emitOp (by simp [OpNoReuse]))
+                (emitNoReuse_emitOp (by simp [OpNoReuse]))))) (by
+                  simpa using hafterBorrow)
+
+private theorem lowerENoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel)
+    (hspine : LowerSpineNoReuse src fuel)
+    (hborrow : LowerBorrowNoReuse src fuel)
+    (hlam : LowerLamNoReuse src fuel) :
+    LowerENoReuse src (fuel + 1) := by
+  intro input world expr state finalState output emit value hrun
+  cases expr with
+  | var index => exact lowerEVarNoReuse hrun
+  | ref address => exact lowerERefNoReuse hrun
+  | lit literal =>
+    exact pureTripleRun_emitNoReuse emitNoReuse_id (by
+      simpa [lowerE] using hrun)
+  | erased =>
+    exact pureTripleRun_emitNoReuse emitNoReuse_id (by
+      simpa [lowerE] using hrun)
+  | lam uses body =>
+    cases world with
+    | unique =>
+      have hthrow :
+          (throw
+            "function values live in the shared world (one-shot closures deferred)" :
+            LowerM (VEnv × Emit × AVal)).run state =
+              .ok (output, emit, value) finalState := by
+        simpa [lowerE] using hrun
+      exact (stateThrowRun_not_ok hthrow).elim
+    | shared =>
+      exact hlam (by simpa [lowerE] using hrun)
+  | letE uses bound body => exact lowerELetNoReuse hexpr hrun
+  | app function argument =>
+    exact hspine (by simpa [lowerE] using hrun)
+  | proj index source => exact lowerEProjNoReuse hborrow hrun
+
+private theorem lowerLamNoReuse_succ {src : IxIR0.Env} {fuel : Nat} :
+    LowerLamNoReuse src (fuel + 1) := by
+  intro input expr state finalState output emit value hrun
+  apply LowerSim.lowerLam_run_core
+    (Result := fun _ _ emit _ => EmitNoReuse emit)
+    (hrun := hrun)
+  intro _bodyFuel captureOutput captureEmit captureValues _captureState
+    fnAddress _addressState _code _bodyState _hfuel _hp hcaptureRun
+    _hfreshRun _hbodyRun
+  exact emitNoReuse_comp
+    (first := captureEmit)
+    (second := emitOp (.papp fnAddress
+      (captureValues.map (·.toAtom captureOutput)).toArray))
+    (lowerCaptures_emitNoReuse expr hcaptureRun)
+    (emitNoReuse_emitOp (by simp [OpNoReuse]))
+
+private theorem lowerFnBodyNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerENoReuse src fuel) :
+    LowerFnBodyNoReuse src (fuel + 1) := by
+  intro input drops world body state finalState code hrun
+  simp only [lowerFnBody] at hrun
+  obtain ⟨releaseResult, releaseState, hrelease, hafterRelease⟩ :=
+    stateBindRun_ok_inv hrun
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  obtain ⟨bodyResult, bodyState, hbody, hpure⟩ :=
+    stateBindRun_ok_inv hafterRelease
+  rcases bodyResult with ⟨output, emit, value⟩
+  have hcode :
+      (releaseEmit ∘ emit) (.ret (value.toAtom output)) = code := by
+    simpa using congrArg
+      (fun result : EStateM.Result String LowSt Code =>
+        match result with
+        | .ok result _ => result
+        | .error _ _ => .ret .erased) hpure
+  rw [← hcode]
+  apply emitNoReuse_comp (releaseSlots_emitNoReuse input hrelease)
+    (hexpr hbody)
+  simp [CodeNoReuse]
+
+private theorem lowerNoReuse_succ {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerNoReuseCluster src fuel) :
+    LowerNoReuseCluster src (fuel + 1) :=
+  { expr := lowerENoReuse_succ hprev.expr hprev.spine hprev.borrow hprev.lam
+    borrow := lowerBorrowNoReuse_succ hprev.expr
+    spine := lowerSpineNoReuse_succ hprev.expr hprev.spine
+      hprev.knownCall hprev.applyRest
+    knownCall := knownCallNoReuse_succ hprev.args hprev.applyRest
+    args := lowerArgsNoReuse_succ hprev.expr hprev.args
+    applyRest := applyRestNoReuse_succ hprev.args
+    lam := lowerLamNoReuse_succ
+    fnBody := lowerFnBodyNoReuse_succ hprev.expr }
+
+/-- Every successful mutually recursive expression-lowering action emits no
+`reuse`, at every compiler fuel. -/
+theorem lowerNoReuse (src : IxIR0.Env) :
+    ∀ fuel, LowerNoReuseCluster src fuel := by
+  intro fuel
+  induction fuel with
+  | zero => exact lowerNoReuse_zero src
+  | succ fuel ih =>
+    simpa [Nat.succ_eq_add_one] using lowerNoReuse_succ ih
+
+/-- Closing a successfully lowered function body with `ret` produces
+reuse-free target code. -/
+theorem lowerFnBody_noReuse {src : IxIR0.Env} {fuel : Nat}
+    {input : VEnv} {drops : List SlotDrop} {world : Ixon.Owned}
+    {body : IxIR0.Expr} {state finalState : LowSt} {code : Code}
+    (hrun : (lowerFnBody src fuel input drops world body).run state =
+      .ok code finalState) :
+    CodeNoReuse code :=
+  (lowerNoReuse src fuel).fnBody hrun
+
+/-! ## Generated-declaration state -/
+
+theorem requireResultWorld_preservesStateNoReuse
+    (actual demand : Ixon.Owned) :
+    PreservesStateNoReuse (requireResultWorld actual demand) := by
+  cases actual <;> cases demand <;>
+    simp [requireResultWorld] <;>
+    first
+    | exact PreservesStateNoReuse.pure _
+    | exact PreservesStateNoReuse.throw _
+
+theorem releaseSlots_preservesStateNoReuse (input : VEnv) :
+    ∀ drops : List SlotDrop,
+      PreservesStateNoReuse (releaseSlots input drops) := by
+  exact releaseSlots_action_core
+    (ActionProperty := fun {α : Type} (action : LowerM α) =>
+      PreservesStateNoReuse action)
+    (hpure := fun value => PreservesStateNoReuse.pure value)
+    (hbind := fun haction hnext =>
+      PreservesStateNoReuse.bind haction hnext)
+    (hthrowBind := fun message next =>
+      PreservesStateNoReuse.throwBind message next)
+    input
+
+theorem lowerCapture_preservesStateNoReuse (expr : IxIR0.Expr)
+    (input : VEnv) (index : Nat) :
+    PreservesStateNoReuse (lowerCapture expr input index) := by
+  intro state finalState result hstate hrun
+  cases hentry : input.entries[index]? with
+  | none =>
+    exact (stateThrowRun_not_ok (by
+      simpa [lowerCapture, hentry] using hrun)).elim
+  | some entry =>
+    cases entry with
+    | recSelf arity =>
+      exact (stateThrowRun_not_ok (by
+        simpa [lowerCapture, hentry] using hrun)).elim
+    | slot abs remaining uses held =>
+      cases held with
+      | false =>
+        exact (stateThrowRun_not_ok (by
+          simpa [lowerCapture, hentry] using hrun)).elim
+      | true =>
+        by_cases hunique : worldOfUses uses = .unique
+        · have huuEq :
+              (Ixon.Owned.unique == Ixon.Owned.unique) = true := by
+            decide
+          exact (stateThrowRun_not_ok (by
+            simpa [lowerCapture, hentry, hunique, huuEq] using hrun)).elim
+        · have huniqueEq :
+              (worldOfUses uses == Ixon.Owned.unique) = false := by
+            cases uses <;> simp_all [worldOfUses] <;> decide
+          by_cases hmore : remaining > countUses index expr
+          · have hfinal : state = finalState := by
+              have hfull :
+                  ((input.setEntry index
+                      (.slot abs (remaining - countUses index expr)
+                        uses true)).bump,
+                    emitOp (.dup (.var
+                      ((input.setEntry index
+                        (.slot abs (remaining - countUses index expr)
+                          uses true)).rel abs))),
+                    AVal.slotA
+                      (input.setEntry index
+                        (.slot abs (remaining - countUses index expr)
+                          uses true)).depth) = result ∧
+                    state = finalState := by
+                simpa [lowerCapture, hentry, huniqueEq, hmore] using hrun
+              exact hfull.2
+            subst finalState
+            exact hstate
+          · by_cases hequal : remaining = countUses index expr
+            · have hfinal : state = finalState := by
+                have hfull :
+                    (input.setEntry index (.slot abs 0 uses false),
+                      (_root_.id : Emit), AVal.slotA abs) = result ∧
+                      state = finalState := by
+                  simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                    using hrun
+                exact hfull.2
+              subst finalState
+              exact hstate
+            · exact (stateThrowRun_not_ok (by
+                simpa [lowerCapture, hentry, huniqueEq, hmore, hequal]
+                  using hrun)).elim
+
+theorem lowerCaptures_preservesStateNoReuse (expr : IxIR0.Expr) :
+    ∀ (input : VEnv) (captures : List Nat),
+      PreservesStateNoReuse (lowerCaptures expr input captures) := by
+  exact lowerCaptures_action_core
+    (e := expr)
+    (ActionProperty := fun {α : Type} (action : LowerM α) =>
+      PreservesStateNoReuse action)
+    (hpure := fun value => PreservesStateNoReuse.pure value)
+    (hbind := fun haction hnext =>
+      PreservesStateNoReuse.bind haction hnext)
+    (hcapture := lowerCapture_preservesStateNoReuse expr)
+
+def LowerEPreservesStateNoReuse (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input world expr,
+    PreservesStateNoReuse (lowerE src fuel input world expr)
+
+def LowerBorrowPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input expr,
+    PreservesStateNoReuse (lowerBorrow src fuel input expr)
+
+def LowerSpinePreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input world head args,
+    PreservesStateNoReuse (lowerSpine src fuel input world head args)
+
+def KnownCallPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input build count argWorlds resultWorld args,
+    PreservesStateNoReuse
+      (knownCall src fuel input build count argWorlds resultWorld args)
+
+def LowerArgsPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input args,
+    PreservesStateNoReuse (lowerArgs src fuel input args)
+
+def ApplyRestPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input resultWorld pre function args,
+    PreservesStateNoReuse
+      (applyRest src fuel input resultWorld pre function args)
+
+def LowerLamPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input expr,
+    PreservesStateNoReuse (lowerLam src fuel input expr)
+
+def LowerFnBodyPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) : Prop :=
+  ∀ input drops world body,
+    PreservesStateNoReuse (lowerFnBody src fuel input drops world body)
+
+structure LowerStateNoReuseCluster
+    (src : IxIR0.Env) (fuel : Nat) : Prop where
+  expr : LowerEPreservesStateNoReuse src fuel
+  borrow : LowerBorrowPreservesStateNoReuse src fuel
+  spine : LowerSpinePreservesStateNoReuse src fuel
+  knownCall : KnownCallPreservesStateNoReuse src fuel
+  args : LowerArgsPreservesStateNoReuse src fuel
+  applyRest : ApplyRestPreservesStateNoReuse src fuel
+  lam : LowerLamPreservesStateNoReuse src fuel
+  fnBody : LowerFnBodyPreservesStateNoReuse src fuel
+
+private theorem lowerStateNoReuse_zero (src : IxIR0.Env) :
+    LowerStateNoReuseCluster src 0 := by
+  refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+  · intro input world expr
+    simp only [lowerE]
+    exact PreservesStateNoReuse.throw _
+  · intro input expr
+    simp only [lowerBorrow]
+    exact PreservesStateNoReuse.throw _
+  · intro input world head args
+    simp only [lowerSpine]
+    exact PreservesStateNoReuse.throw _
+  · intro input build count argWorlds resultWorld args
+    simp only [knownCall]
+    exact PreservesStateNoReuse.throw _
+  · intro input args
+    simp only [lowerArgs]
+    exact PreservesStateNoReuse.throw _
+  · intro input resultWorld pre function args
+    simp only [applyRest]
+    exact PreservesStateNoReuse.throw _
+  · intro input expr
+    simp only [lowerLam]
+    exact PreservesStateNoReuse.throw _
+  · intro input drops world body
+    simp only [lowerFnBody]
+    exact PreservesStateNoReuse.throw _
+
+private theorem lowerFnBodyPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel) :
+    LowerFnBodyPreservesStateNoReuse src (fuel + 1) := by
+  intro input drops world body
+  simp only [lowerFnBody]
+  apply PreservesStateNoReuse.bind
+    (releaseSlots_preservesStateNoReuse input drops)
+  intro releaseResult
+  rcases releaseResult with ⟨middle, releaseEmit⟩
+  apply PreservesStateNoReuse.bind (hexpr middle world body)
+  intro bodyResult
+  rcases bodyResult with ⟨output, bodyEmit, value⟩
+  exact PreservesStateNoReuse.pure
+    (releaseEmit (bodyEmit (.ret (value.toAtom output))))
+
+private theorem lowerLamPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hfnBody : LowerFnBodyPreservesStateNoReuse src fuel) :
+    LowerLamPreservesStateNoReuse src (fuel + 1) := by
+  intro input expr initial finalState result hinitial hrun
+  rcases result with ⟨output, emit, value⟩
+  apply LowerSim.lowerLam_run_core
+    (Result := fun finalState _ _ _ => StateNoReuse finalState)
+    (hrun := hrun)
+  intro bodyFuel _captureOutput _captureEmit _captureValues captureState
+    _fnAddress addressState code bodyState hfuel _hp hcaptureRun
+    hfreshRun hbodyRun
+  have hbodyFuel : bodyFuel = fuel := by
+    exact Nat.add_right_cancel hfuel
+  subst bodyFuel
+  have hcaptureState :=
+    lowerCaptures_preservesStateNoReuse expr input _ hinitial hcaptureRun
+  have haddressState :=
+    freshAddr_preservesStateNoReuse hcaptureState hfreshRun
+  have hbodyState := hfnBody _ _ _ _ haddressState hbodyRun
+  have hcode : CodeNoReuse code := lowerFnBody_noReuse hbodyRun
+  exact hbodyState.prepend hcode
+
+private theorem lowerArgsPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    (hargs : LowerArgsPreservesStateNoReuse src fuel) :
+    LowerArgsPreservesStateNoReuse src (fuel + 1) := by
+  intro input args
+  cases args with
+  | nil =>
+    simp only [lowerArgs]
+    exact PreservesStateNoReuse.pure _
+  | cons head rest =>
+    rcases head with ⟨expr, world⟩
+    simp only [lowerArgs]
+    apply PreservesStateNoReuse.bind (hexpr input world expr)
+    intro headResult
+    rcases headResult with ⟨middle, headEmit, value⟩
+    apply PreservesStateNoReuse.bind (hargs middle rest)
+    intro tailResult
+    rcases tailResult with ⟨output, tailEmit, values⟩
+    exact PreservesStateNoReuse.pure
+      (output, headEmit ∘ tailEmit, value :: values)
+
+private theorem applyRestPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesStateNoReuse src fuel) :
+    ApplyRestPreservesStateNoReuse src (fuel + 1) := by
+  intro input resultWorld pre function args
+  cases function with
+  | slotA abs =>
+    simp only [applyRest]
+    apply PreservesStateNoReuse.bind
+      (requireResultWorld_preservesStateNoReuse .shared resultWorld)
+    intro unitValue
+    cases unitValue
+    apply PreservesStateNoReuse.bind
+      (hargs input (args.map (fun arg => (arg, Ixon.Owned.shared))))
+    intro argsResult
+    rcases argsResult with ⟨output, argsEmit, values⟩
+    exact PreservesStateNoReuse.pure
+      (output.bump,
+        pre ∘ argsEmit ∘ emitOp (.apply
+          ((AVal.slotA abs).toAtom output)
+          (values.map (·.toAtom output)).toArray),
+        AVal.slotA output.depth)
+  | constA atom =>
+    cases atom with
+    | erased =>
+      simp only [applyRest]
+      apply PreservesStateNoReuse.bind
+        (hargs input (args.map (fun arg => (arg, Ixon.Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact PreservesStateNoReuse.pure
+        ((releaseAll output values).1,
+          pre ∘ argsEmit ∘ (releaseAll output values).2,
+          AVal.constA .erased)
+    | var relative =>
+      simp only [applyRest]
+      apply PreservesStateNoReuse.bind
+        (requireResultWorld_preservesStateNoReuse .shared resultWorld)
+      intro unitValue
+      cases unitValue
+      apply PreservesStateNoReuse.bind
+        (hargs input (args.map (fun arg => (arg, Ixon.Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact PreservesStateNoReuse.pure
+        (output.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.constA (.var relative)).toAtom output)
+            (values.map (·.toAtom output)).toArray),
+          AVal.slotA output.depth)
+    | lit literal =>
+      simp only [applyRest]
+      apply PreservesStateNoReuse.bind
+        (requireResultWorld_preservesStateNoReuse .shared resultWorld)
+      intro unitValue
+      cases unitValue
+      apply PreservesStateNoReuse.bind
+        (hargs input (args.map (fun arg => (arg, Ixon.Owned.shared))))
+      intro argsResult
+      rcases argsResult with ⟨output, argsEmit, values⟩
+      exact PreservesStateNoReuse.pure
+        (output.bump,
+          pre ∘ argsEmit ∘ emitOp (.apply
+            ((AVal.constA (.lit literal)).toAtom output)
+            (values.map (·.toAtom output)).toArray),
+          AVal.slotA output.depth)
+
+private theorem knownCallPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hargs : LowerArgsPreservesStateNoReuse src fuel)
+    (hrest : ApplyRestPreservesStateNoReuse src fuel) :
+    KnownCallPreservesStateNoReuse src (fuel + 1) := by
+  intro input build count argWorlds resultWorld args
+  simp only [knownCall]
+  apply PreservesStateNoReuse.bind
+    (hargs input ((args.take count).zip (padWorlds argWorlds count)))
+  intro argsResult
+  rcases argsResult with ⟨output, argsEmit, values⟩
+  by_cases hterminal : args.length ≤ count
+  · simp only [if_pos hterminal]
+    exact PreservesStateNoReuse.pure
+      (output.bump,
+        argsEmit ∘ emitOp
+          (build (values.map (·.toAtom output)).toArray),
+        AVal.slotA output.depth)
+  · simp only [if_neg hterminal]
+    exact hrest output.bump resultWorld
+      (argsEmit ∘ emitOp
+        (build (values.map (·.toAtom output)).toArray))
+      (.slotA output.depth) (args.drop count)
+
+private theorem lowerBorrowVarPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv) (index : Nat) :
+    PreservesStateNoReuse
+      (lowerBorrow src (fuel + 1) input (.var index)) := by
+  simp only [lowerBorrow]
+  cases hentry : input.entries[index]? with
+  | none => exact PreservesStateNoReuse.throw _
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact PreservesStateNoReuse.throw _
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact PreservesStateNoReuse.throw _
+      | true =>
+        cases uses with
+        | linear => exact PreservesStateNoReuse.throw _
+        | affine => exact PreservesStateNoReuse.throw _
+        | erased =>
+          cases remaining with
+          | zero => exact PreservesStateNoReuse.throw _
+          | succ remaining =>
+            cases remaining with
+            | zero => exact PreservesStateNoReuse.pure _
+            | succ remaining => exact PreservesStateNoReuse.pure _
+        | many =>
+          cases remaining with
+          | zero => exact PreservesStateNoReuse.throw _
+          | succ remaining =>
+            cases remaining with
+            | zero => exact PreservesStateNoReuse.pure _
+            | succ remaining => exact PreservesStateNoReuse.pure _
+
+private theorem lowerBorrowDynamicPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    {input : VEnv} {expr : IxIR0.Expr} :
+    PreservesStateNoReuse (do
+      let (output, emit, value) ←
+        lowerE src fuel input .shared expr
+      let release :=
+        match value with | .slotA _ => true | .constA _ => false
+      pure (output, emit, value, release)) := by
+  apply PreservesStateNoReuse.bind (hexpr input .shared expr)
+  intro exprResult
+  rcases exprResult with ⟨output, emit, value⟩
+  exact PreservesStateNoReuse.pure
+    (output, emit, value,
+      match value with | .slotA _ => true | .constA _ => false)
+
+private theorem lowerBorrowPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel) :
+    LowerBorrowPreservesStateNoReuse src (fuel + 1) := by
+  intro input expr
+  cases expr with
+  | var index =>
+    exact (lowerBorrowVarPreservesStateNoReuse src fuel input index)
+  | ref address =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+  | app function argument =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+  | lam uses body =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+  | letE uses value body =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+  | proj index value =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+  | lit literal =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+  | erased =>
+    simp only [lowerBorrow]
+    exact lowerBorrowDynamicPreservesStateNoReuse hexpr
+
+private theorem lowerEVarPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv)
+    (world : Ixon.Owned) (index : Nat) :
+    PreservesStateNoReuse
+      (lowerE src (fuel + 1) input world (.var index)) := by
+  simp only [lowerE]
+  cases hentry : input.entries[index]? with
+  | none => exact PreservesStateNoReuse.throw _
+  | some entry =>
+    cases entry with
+    | recSelf arity => exact PreservesStateNoReuse.throw _
+    | slot abs remaining uses held =>
+      cases held with
+      | false => exact PreservesStateNoReuse.throw _
+      | true =>
+        cases remaining with
+        | zero =>
+          cases uses <;> cases world <;>
+            first
+            | exact PreservesStateNoReuse.pure _
+            | exact PreservesStateNoReuse.throw _
+        | succ remaining =>
+          cases remaining with
+          | zero =>
+            cases uses <;> cases world <;>
+              first
+              | exact PreservesStateNoReuse.pure _
+              | exact PreservesStateNoReuse.throw _
+          | succ remaining =>
+            cases uses <;> cases world <;>
+              first
+              | exact PreservesStateNoReuse.pure _
+              | exact PreservesStateNoReuse.throw _
+
+private theorem lowerERefPreservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) (input : VEnv)
+    (world : Ixon.Owned) (address : Ixon.Address) :
+    PreservesStateNoReuse
+      (lowerE src (fuel + 1) input world (.ref address)) := by
+  simp only [lowerE]
+  cases hsource : src address with
+  | none =>
+    simp only
+    exact PreservesStateNoReuse.throw _
+  | some declaration =>
+    cases declaration with
+    | defn result body =>
+      simp only
+      cases harity : lamArity body with
+      | zero =>
+        apply PreservesStateNoReuse.bind
+          (requireResultWorld_preservesStateNoReuse result world)
+        intro unitValue
+        cases unitValue
+        exact PreservesStateNoReuse.pure _
+      | succ arity =>
+        cases result <;> cases world <;> cases hp : papSafe body <;>
+          first
+          | exact PreservesStateNoReuse.pure _
+          | exact PreservesStateNoReuse.throw _
+    | ctor tag arity =>
+      simp only
+      cases arity with
+      | zero => exact PreservesStateNoReuse.pure _
+      | succ arity =>
+        cases world with
+        | unique => exact PreservesStateNoReuse.throw _
+        | shared =>
+          apply PreservesStateNoReuse.bind
+            (wrapperFor_preservesStateNoReuse address tag (arity + 1))
+          intro wrapper
+          exact PreservesStateNoReuse.pure _
+    | recursor numArgs natLit rules =>
+      simp only
+      cases world <;> first
+        | exact PreservesStateNoReuse.pure _
+        | exact PreservesStateNoReuse.throw _
+    | extern arity =>
+      simp only
+      cases arity with
+      | zero => exact PreservesStateNoReuse.pure _
+      | succ arity =>
+        cases world <;> first
+          | exact PreservesStateNoReuse.pure _
+          | exact PreservesStateNoReuse.throw _
+
+private theorem lowerELamPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hlam : LowerLamPreservesStateNoReuse src fuel)
+    (input : VEnv) (world : Ixon.Owned) (uses : Ixon.Uses)
+    (body : IxIR0.Expr) :
+    PreservesStateNoReuse
+      (lowerE src (fuel + 1) input world (.lam uses body)) := by
+  cases world with
+  | unique =>
+    simp only [lowerE]
+    exact PreservesStateNoReuse.throw _
+  | shared =>
+    have hsuEq :
+        (Ixon.Owned.shared == Ixon.Owned.unique) = false := by
+      decide
+    intro initial final result hinitial hrun
+    exact hlam input (.lam uses body) hinitial (by
+      simpa only [lowerE, hsuEq, Bool.false_eq_true, if_false] using hrun)
+
+private theorem lowerEProjPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hborrow : LowerBorrowPreservesStateNoReuse src fuel)
+    (input : VEnv) (world : Ixon.Owned) (index : Nat)
+    (source : IxIR0.Expr) :
+    PreservesStateNoReuse
+      (lowerE src (fuel + 1) input world (.proj index source)) := by
+  cases world with
+  | unique =>
+    simp only [lowerE]
+    exact PreservesStateNoReuse.throw _
+  | shared =>
+    simp only [lowerE]
+    apply PreservesStateNoReuse.bind (hborrow input source)
+    intro borrowResult
+    rcases borrowResult with ⟨output, emit, value, release⟩
+    cases value with
+    | slotA abs =>
+      cases release <;> exact PreservesStateNoReuse.pure _
+    | constA atom =>
+      cases atom <;> exact PreservesStateNoReuse.pure _
+
+private theorem lowerELetPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    (input : VEnv) (world : Ixon.Owned) (uses : Ixon.Uses)
+    (value body : IxIR0.Expr) :
+    PreservesStateNoReuse
+      (lowerE src (fuel + 1) input world (.letE uses value body)) := by
+  simp only [lowerE]
+  apply PreservesStateNoReuse.bind
+    (hexpr input (worldOfUses uses) value)
+  intro valueResult
+  rcases valueResult with ⟨middle, valueEmit, boundValue⟩
+  cases boundValue with
+  | slotA abs =>
+    by_cases hzero : countUses 0 body = 0
+    · simp only [hzero, beq_self_eq_true, if_true]
+      cases uses with
+      | erased => exact PreservesStateNoReuse.throwBind _ _
+      | linear => exact PreservesStateNoReuse.throwBind _ _
+      | affine =>
+        apply PreservesStateNoReuse.bind
+          (PreservesStateNoReuse.pure _)
+        intro releaseEmit
+        apply PreservesStateNoReuse.bind (hexpr _ world body)
+        intro bodyResult
+        rcases bodyResult with ⟨output, bodyEmit, result⟩
+        exact PreservesStateNoReuse.pure
+          (output.pop, valueEmit ∘ releaseEmit ∘ bodyEmit, result)
+      | many =>
+        apply PreservesStateNoReuse.bind
+          (PreservesStateNoReuse.pure _)
+        intro releaseEmit
+        apply PreservesStateNoReuse.bind (hexpr _ world body)
+        intro bodyResult
+        rcases bodyResult with ⟨output, bodyEmit, result⟩
+        exact PreservesStateNoReuse.pure
+          (output.pop, valueEmit ∘ releaseEmit ∘ bodyEmit, result)
+    · simp [hzero]
+      apply PreservesStateNoReuse.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact PreservesStateNoReuse.pure
+        (output.pop, valueEmit ∘ bodyEmit, result)
+  | constA atom =>
+    by_cases hzero : countUses 0 body = 0
+    · simp only [hzero, beq_self_eq_true, if_true]
+      apply PreservesStateNoReuse.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact PreservesStateNoReuse.pure
+        (output.pop,
+          valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit, result)
+    · simp [hzero]
+      apply PreservesStateNoReuse.bind (hexpr _ world body)
+      intro bodyResult
+      rcases bodyResult with ⟨output, bodyEmit, result⟩
+      exact PreservesStateNoReuse.pure
+        (output.pop,
+          valueEmit ∘ emitOp (.pure atom) ∘ bodyEmit, result)
+
+private theorem lowerEPreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    (hspine : LowerSpinePreservesStateNoReuse src fuel)
+    (hborrow : LowerBorrowPreservesStateNoReuse src fuel)
+    (hlam : LowerLamPreservesStateNoReuse src fuel) :
+    LowerEPreservesStateNoReuse src (fuel + 1) := by
+  intro input world expr
+  cases expr with
+  | var index =>
+    exact (lowerEVarPreservesStateNoReuse src fuel input world index)
+  | ref address =>
+    exact (lowerERefPreservesStateNoReuse src fuel input world address)
+  | lit literal =>
+    simp only [lowerE]
+    exact PreservesStateNoReuse.pure _
+  | erased =>
+    simp only [lowerE]
+    exact PreservesStateNoReuse.pure _
+  | lam uses body =>
+    exact (lowerELamPreservesStateNoReuse hlam input world uses body)
+  | letE uses value body =>
+    exact (lowerELetPreservesStateNoReuse
+      hexpr input world uses value body)
+  | app function argument =>
+    simp only [lowerE]
+    exact hspine input world function [argument]
+  | proj index source =>
+    exact (lowerEProjPreservesStateNoReuse
+      hborrow input world index source)
+
+private theorem lowerSpineDynamicPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    (hrest : ApplyRestPreservesStateNoReuse src fuel)
+    (input : VEnv) (world : Ixon.Owned) (head : IxIR0.Expr)
+    (args : List IxIR0.Expr) :
+    PreservesStateNoReuse (do
+      let (output, emit, function) ←
+        lowerE src fuel input .shared head
+      applyRest src fuel output world emit function args) := by
+  apply PreservesStateNoReuse.bind (hexpr input .shared head)
+  intro headResult
+  rcases headResult with ⟨output, emit, function⟩
+  exact hrest output world emit function args
+
+private theorem lowerSpineVarPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    (hknown : KnownCallPreservesStateNoReuse src fuel)
+    (hrest : ApplyRestPreservesStateNoReuse src fuel)
+    (input : VEnv) (world : Ixon.Owned) (index : Nat)
+    (args : List IxIR0.Expr) :
+    PreservesStateNoReuse
+      (lowerSpine src (fuel + 1) input world (.var index) args) := by
+  simp only [lowerSpine]
+  cases hentry : input.entries[index]? with
+  | none =>
+    simp only
+    exact lowerSpineDynamicPreservesStateNoReuse
+      hexpr hrest input world (.var index) args
+  | some entry =>
+    cases entry with
+    | slot abs remaining uses held =>
+      simp only
+      exact lowerSpineDynamicPreservesStateNoReuse
+        hexpr hrest input world (.var index) args
+    | recSelf arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        exact PreservesStateNoReuse.throw _
+      · simp only [if_neg hunder]
+        apply PreservesStateNoReuse.bind
+          (requireResultWorld_preservesStateNoReuse .shared world)
+        intro unitValue
+        cases unitValue
+        exact hknown input (.callSelf ·) arity
+          (List.replicate arity .shared) world args
+
+private theorem lowerSpineRefPreservesStateNoReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    (hknown : KnownCallPreservesStateNoReuse src fuel)
+    (input : VEnv) (world : Ixon.Owned) (address : Ixon.Address)
+    (args : List IxIR0.Expr) :
+    PreservesStateNoReuse
+      (lowerSpine src (fuel + 1) input world (.ref address) args) := by
+  simp only [lowerSpine]
+  cases hsource : src address with
+  | none =>
+    simp only
+    exact PreservesStateNoReuse.throw _
+  | some declaration =>
+    cases declaration with
+    | defn result body =>
+      simp only
+      by_cases hunder : args.length < lamArity body
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact PreservesStateNoReuse.throw _
+        | shared =>
+          cases result with
+          | unique => exact PreservesStateNoReuse.throw _
+          | shared =>
+            cases hp : papSafe body with
+            | false => exact PreservesStateNoReuse.throw _
+            | true =>
+              exact hknown input (.papp address ·) args.length
+                (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        apply PreservesStateNoReuse.bind
+          (requireResultWorld_preservesStateNoReuse result
+            (if args.length == lamArity body then world else .shared))
+        intro unitValue
+        cases unitValue
+        exact hknown input (.call address ·) (lamArity body)
+          ((lamUses body).map worldOfUses) world args
+    | ctor tag arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact PreservesStateNoReuse.throw _
+        | shared =>
+          apply PreservesStateNoReuse.bind
+            (wrapperFor_preservesStateNoReuse address tag arity)
+          intro wrapper
+          exact hknown input (.papp wrapper ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        exact hknown input (.alloc world (ctorIdOf address tag) ·) arity
+          (List.replicate arity world) world args
+    | recursor numArgs natLit rules =>
+      simp only
+      by_cases hunder : args.length < numArgs + 1
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact PreservesStateNoReuse.throw _
+        | shared =>
+          exact hknown input (.papp address ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        apply PreservesStateNoReuse.bind
+          (requireResultWorld_preservesStateNoReuse .shared world)
+        intro unitValue
+        cases unitValue
+        exact hknown input (.call address ·) (numArgs + 1)
+          (List.replicate (numArgs + 1) .shared) world args
+    | extern arity =>
+      simp only
+      by_cases hunder : args.length < arity
+      · simp only [if_pos hunder]
+        cases world with
+        | unique => exact PreservesStateNoReuse.throw _
+        | shared =>
+          exact hknown input (.papp address ·) args.length
+            (List.replicate args.length .shared) .shared args
+      · simp only [if_neg hunder]
+        exact hknown input (.extern address ·) arity
+          (List.replicate arity .shared) world args
+
+private theorem lowerSpinePreservesStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hexpr : LowerEPreservesStateNoReuse src fuel)
+    (hspine : LowerSpinePreservesStateNoReuse src fuel)
+    (hknown : KnownCallPreservesStateNoReuse src fuel)
+    (hrest : ApplyRestPreservesStateNoReuse src fuel) :
+    LowerSpinePreservesStateNoReuse src (fuel + 1) := by
+  intro input world head args
+  cases head with
+  | app function argument =>
+    simp only [lowerSpine]
+    exact hspine input world function (argument :: args)
+  | erased =>
+    simp only [lowerSpine]
+    exact hrest input world (_root_.id : Emit) (.constA .erased) args
+  | var index =>
+    exact (lowerSpineVarPreservesStateNoReuse
+      hexpr hknown hrest input world index args)
+  | ref address =>
+    exact (lowerSpineRefPreservesStateNoReuse
+      hknown input world address args)
+  | lam uses body =>
+    simp only [lowerSpine]
+    exact lowerSpineDynamicPreservesStateNoReuse
+      hexpr hrest input world (.lam uses body) args
+  | letE uses value body =>
+    simp only [lowerSpine]
+    exact lowerSpineDynamicPreservesStateNoReuse
+      hexpr hrest input world (.letE uses value body) args
+  | proj index source =>
+    simp only [lowerSpine]
+    exact lowerSpineDynamicPreservesStateNoReuse
+      hexpr hrest input world (.proj index source) args
+  | lit literal =>
+    simp only [lowerSpine]
+    exact lowerSpineDynamicPreservesStateNoReuse
+      hexpr hrest input world (.lit literal) args
+
+private theorem lowerStateNoReuse_succ
+    {src : IxIR0.Env} {fuel : Nat}
+    (hprev : LowerStateNoReuseCluster src fuel) :
+    LowerStateNoReuseCluster src (fuel + 1) :=
+  { expr := lowerEPreservesStateNoReuse_succ
+      hprev.expr hprev.spine hprev.borrow hprev.lam
+    borrow := lowerBorrowPreservesStateNoReuse_succ hprev.expr
+    spine := lowerSpinePreservesStateNoReuse_succ
+      hprev.expr hprev.spine hprev.knownCall hprev.applyRest
+    knownCall := knownCallPreservesStateNoReuse_succ
+      hprev.args hprev.applyRest
+    args := lowerArgsPreservesStateNoReuse_succ hprev.expr hprev.args
+    applyRest := applyRestPreservesStateNoReuse_succ hprev.args
+    lam := lowerLamPreservesStateNoReuse_succ hprev.fnBody
+    fnBody := lowerFnBodyPreservesStateNoReuse_succ hprev.expr }
+
+/-- Every lowering-cluster action preserves reuse-freedom of the accumulated
+generated declarations. -/
+theorem lowerStateNoReuse (src : IxIR0.Env) :
+    ∀ fuel, LowerStateNoReuseCluster src fuel := by
+  intro fuel
+  induction fuel with
+  | zero => exact lowerStateNoReuse_zero src
+  | succ fuel ih =>
+    simpa [Nat.succ_eq_add_one] using lowerStateNoReuse_succ ih
+
+private theorem fieldRetainPlan_emitNoReuse
+    {input output : VEnv} {retains : List RecursorFieldRetain}
+    {emit : Emit}
+    (hplan : LowerSim.FieldRetainPlan input retains output emit) :
+    EmitNoReuse emit := by
+  induction hplan with
+  | nil => exact emitNoReuse_id
+  | retain hentry tail ih =>
+    exact emitNoReuse_comp
+      (emitNoReuse_emitOp (by simp [OpNoReuse])) ih
+
+private theorem releasePlan_emitNoReuse
+    {input output : VEnv} {drops : List SlotDrop} {emit : Emit}
+    (hplan : LowerSim.ReleasePlan input drops output emit) :
+    EmitNoReuse emit := by
+  induction hplan with
+  | nil => exact emitNoReuse_id
+  | many hentry tail ih =>
+    exact emitNoReuse_comp
+      (emitNoReuse_emitOp (by simp [OpNoReuse])) ih
+  | affine hentry tail ih =>
+    exact emitNoReuse_comp
+      (emitNoReuse_emitOp (by simp [OpNoReuse])) ih
+
+/-- Every successfully generated recursor alternative is reuse-free. -/
+theorem lowerRecursorRule_noReuse
+    {src : IxIR0.Env} {fuel numArgs : Nat}
+    {rule : IxIR0.RecRule} {tag : Nat}
+    {state finalState : LowSt} {alternative : Alt}
+    (hrun : (lowerRecursorRule src fuel numArgs (rule, tag)).run state =
+      .ok alternative finalState) :
+    AltNoReuse alternative := by
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      output, bodyEmit, value, hfield, hparameter, hbody, hshape⟩ :=
+    LowerSim.lowerRecursorRule_run_plan_inv hrun
+  subst alternative
+  simp only [AltNoReuse]
+  exact fieldRetainPlan_emitNoReuse hfield _
+    ((emitNoReuse_emitOp (op := .drop (.var (fieldOutput.rel numArgs)))
+        (by simp [OpNoReuse])) _
+      (releasePlan_emitNoReuse hparameter _
+        (((lowerNoReuse src fuel).expr hbody) _
+          (by simp [CodeNoReuse]))))
+
+theorem lowerRecursorRule_preservesStateNoReuse
+    (src : IxIR0.Env) (fuel numArgs : Nat)
+    (item : IxIR0.RecRule × Nat) :
+    PreservesStateNoReuse (lowerRecursorRule src fuel numArgs item) := by
+  intro initial finalState alternative hinitial hrun
+  rcases item with ⟨rule, tag⟩
+  obtain ⟨fieldOutput, fieldEmit, rhsInput, parameterEmit,
+      output, bodyEmit, value, hfield, hparameter, hbody, hshape⟩ :=
+    LowerSim.lowerRecursorRule_run_plan_inv hrun
+  exact (lowerStateNoReuse src fuel).expr rhsInput .shared rule.rhs
+    hinitial hbody
+
+private theorem listMapM_altNoReuse {α : Type}
+    (action : α → LowerM Alt)
+    (haction : ∀ item {initial finalState alternative},
+      (action item).run initial = .ok alternative finalState →
+      AltNoReuse alternative) :
+    ∀ (items : List α) {initial finalState : LowSt}
+        {alternatives : List Alt},
+      (items.mapM action).run initial = .ok alternatives finalState →
+      ∀ alternative ∈ alternatives, AltNoReuse alternative := by
+  intro items
+  induction items with
+  | nil =>
+    intro initial finalState alternatives hrun alternative hmember
+    have hpure : ([] : List Alt) = alternatives ∧
+        initial = finalState := by
+      simpa using hrun
+    rw [← hpure.1] at hmember
+    simp at hmember
+  | cons head tail ih =>
+    intro initial finalState alternatives hrun alternative hmember
+    simp only [List.mapM_cons] at hrun
+    obtain ⟨headAlt, middle, hhead, hafterHead⟩ :=
+      stateBindRun_ok_inv hrun
+    obtain ⟨tailAlts, tailState, htail, hpure⟩ :=
+      stateBindRun_ok_inv hafterHead
+    have hresult : headAlt :: tailAlts = alternatives ∧
+        tailState = finalState := by
+      simpa using hpure
+    rw [← hresult.1] at hmember
+    simp only [List.mem_cons] at hmember
+    cases hmember with
+    | inl hselected =>
+      subst alternative
+      exact haction head hhead
+    | inr hselected => exact ih htail alternative hselected
+
+theorem lowerRecursor_preservesStateNoReuse
+    (src : IxIR0.Env) (fuel numArgs : Nat) (natLit : Bool)
+    (rules : Array IxIR0.RecRule) :
+    PreservesStateNoReuse
+      (lowerRecursor src fuel numArgs natLit rules) := by
+  simp only [lowerRecursor]
+  apply PreservesStateNoReuse.bind
+    (PreservesStateNoReuse.listMapM
+      (lowerRecursorRule src fuel numArgs)
+      (lowerRecursorRule_preservesStateNoReuse src fuel numArgs)
+      rules.toList.zipIdx)
+  intro alternatives
+  exact PreservesStateNoReuse.pure
+    (⟨numArgs + 1, .shared, true,
+      .case (.var 0) natLit alternatives.toArray⟩ : FnDef)
+
+/-- A successfully lowered recursor has reuse-free alternatives. -/
+theorem lowerRecursor_noReuse
+    {src : IxIR0.Env} {fuel numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule} {state finalState : LowSt}
+    {definition : FnDef}
+    (hrun : (lowerRecursor src fuel numArgs natLit rules).run state =
+      .ok definition finalState) :
+    CodeNoReuse definition.body := by
+  obtain ⟨alternatives, halts, hdefinition⟩ := stateMapRun_ok_inv (by
+    simpa [lowerRecursor] using hrun)
+  have hall := listMapM_altNoReuse
+    (lowerRecursorRule src fuel numArgs)
+    (fun item _ _ _ hrun => lowerRecursorRule_noReuse hrun)
+    rules.toList.zipIdx halts
+  cases hdefinition
+  simp only [CodeNoReuse]
+  intro alternative hmember
+  exact hall alternative (by simpa using hmember)
+
+def OptionDeclNoReuse : Option (Ixon.Address × Decl) → Prop
+  | none => True
+  | some item => DeclNoReuse item.2
+
+theorem lowerDecl_preservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat) :
+    ∀ item, PreservesStateNoReuse (lowerDecl src fuel item)
+  | (address, .defn result body) => by
+      simp only [lowerDecl]
+      apply PreservesStateNoReuse.bind
+        ((lowerStateNoReuse src fuel).fnBody _ _ result _)
+      intro code
+      exact PreservesStateNoReuse.pure
+        (some (address, Decl.fn ⟨lamArity body, result,
+          result == .shared && papSafe body, code⟩))
+  | (_, .ctor tag arity) => by
+      simp only [lowerDecl]
+      exact PreservesStateNoReuse.pure
+        (none : Option (Ixon.Address × Decl))
+  | (address, .recursor numArgs natLit rules) => by
+      simp only [lowerDecl]
+      apply PreservesStateNoReuse.bind
+        (lowerRecursor_preservesStateNoReuse
+          src fuel numArgs natLit rules)
+      intro definition
+      exact PreservesStateNoReuse.pure
+        (some (address, Decl.fn definition))
+  | (address, .extern arity) => by
+      simp only [lowerDecl]
+      exact PreservesStateNoReuse.pure
+        (some (address, Decl.extern arity))
+
+/-- Every optional base declaration returned by `lowerDecl` is reuse-free. -/
+theorem lowerDecl_noReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    {item : Ixon.Address × IxIR0.Decl} {state finalState : LowSt}
+    {output : Option (Ixon.Address × Decl)}
+    (hrun : (lowerDecl src fuel item).run state =
+      .ok output finalState) :
+    OptionDeclNoReuse output := by
+  rcases item with ⟨address, declaration⟩
+  cases declaration with
+  | defn result body =>
+    obtain ⟨code, hbody, houtput⟩ := stateMapRun_ok_inv (by
+      simpa [lowerDecl] using hrun)
+    cases houtput
+    exact lowerFnBody_noReuse hbody
+  | ctor tag arity =>
+    have hpure : none = output ∧ state = finalState := by
+      simpa [lowerDecl] using hrun
+    rw [← hpure.1]
+    simp [OptionDeclNoReuse]
+  | recursor numArgs natLit rules =>
+    obtain ⟨definition, hrecursor, houtput⟩ := stateMapRun_ok_inv (by
+      simpa [lowerDecl] using hrun)
+    cases houtput
+    exact lowerRecursor_noReuse hrecursor
+  | extern arity =>
+    have hpure : some (address, Decl.extern arity) = output ∧
+        state = finalState := by
+      simpa [lowerDecl] using hrun
+    rw [← hpure.1]
+    simp [OptionDeclNoReuse, DeclNoReuse]
+
+theorem DeclListNoReuse.append
+    {left right : List (Ixon.Address × Decl)}
+    (hleft : DeclListNoReuse left)
+    (hright : DeclListNoReuse right) :
+    DeclListNoReuse (left ++ right) := by
+  intro declaration hmember
+  rw [List.mem_append] at hmember
+  cases hmember with
+  | inl hleftMember => exact hleft declaration hleftMember
+  | inr hrightMember => exact hright declaration hrightMember
+
+private theorem listFilterMapM_declNoReuse {α : Type}
+    (action : α → LowerM (Option (Ixon.Address × Decl)))
+    (haction : ∀ item {initial finalState output},
+      (action item).run initial = .ok output finalState →
+      OptionDeclNoReuse output) :
+    ∀ (items : List α) {initial finalState : LowSt}
+        {declarations : List (Ixon.Address × Decl)},
+      (items.filterMapM action).run initial =
+        .ok declarations finalState →
+      DeclListNoReuse declarations := by
+  intro items
+  induction items with
+  | nil =>
+    intro initial finalState declarations hrun
+    have hpure : ([] : List (Ixon.Address × Decl)) = declarations ∧
+        initial = finalState := by
+      simpa using hrun
+    intro declaration hmember
+    rw [← hpure.1] at hmember
+    simp at hmember
+  | cons head tail ih =>
+    intro initial finalState declarations hrun
+    rw [List.filterMapM_cons] at hrun
+    obtain ⟨headOutput, middle, hhead, hafterHead⟩ :=
+      stateBindRun_ok_inv hrun
+    have hheadNo := haction head hhead
+    cases headOutput with
+    | none =>
+      exact ih (by simpa only using hafterHead)
+    | some headDeclaration =>
+      obtain ⟨tailDeclarations, tailState, htail, hpure⟩ :=
+        stateBindRun_ok_inv hafterHead
+      have hresult : headDeclaration :: tailDeclarations = declarations ∧
+          tailState = finalState := by
+        simpa [Function.comp_def] using hpure
+      intro declaration hmember
+      rw [← hresult.1] at hmember
+      simp only [List.mem_cons] at hmember
+      cases hmember with
+      | inl hselected =>
+        subst declaration
+        exact hheadNo
+      | inr hselected => exact ih htail declaration hselected
+
+theorem lowerDecls_preservesStateNoReuse
+    (src : IxIR0.Env) (fuel : Nat)
+    (declarations : List (Ixon.Address × IxIR0.Decl)) :
+    PreservesStateNoReuse
+      (declarations.filterMapM (lowerDecl src fuel)) :=
+  PreservesStateNoReuse.listFilterMapM (lowerDecl src fuel)
+    (lowerDecl_preservesStateNoReuse src fuel) declarations
+
+theorem lowerDecls_noReuse
+    {src : IxIR0.Env} {fuel : Nat}
+    {inputs : List (Ixon.Address × IxIR0.Decl)}
+    {state finalState : LowSt}
+    {declarations : List (Ixon.Address × Decl)}
+    (hrun : (inputs.filterMapM (lowerDecl src fuel)).run state =
+      .ok declarations finalState) :
+    DeclListNoReuse declarations :=
+  listFilterMapM_declNoReuse (lowerDecl src fuel)
+    (fun _item _ _ _ hrun => lowerDecl_noReuse hrun) inputs hrun
+
+/-- Every declaration and the closed main body returned by a successful
+whole-program lowering run are reuse-free; the final generated state carries
+the same invariant. -/
+theorem lowerAllAction_noReuse
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {fuel : Nat}
+    {targetDeclarations : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt}
+    (hrun : (lowerAllAction declarations main mainWorld fuel).run {} =
+      .ok (targetDeclarations, mainCode) finalState) :
+    DeclListNoReuse targetDeclarations ∧
+      CodeNoReuse mainCode ∧ StateNoReuse finalState := by
+  let src := IxIR0.Env.ofList declarations
+  simp only [lowerAllAction] at hrun
+  obtain ⟨base, baseState, hbase, hafterBase⟩ :=
+    stateBindRun_ok_inv hrun
+  obtain ⟨compiledMain, mainState, hmain, hafterMain⟩ :=
+    stateBindRun_ok_inv hafterBase
+  obtain ⟨observed, getState, hget, hpure⟩ :=
+    stateBindRun_ok_inv hafterMain
+  have hgetState : mainState = observed ∧ mainState = getState := by
+    simpa using hget
+  have hresult :
+      (base ++ observed.extra, compiledMain) =
+          (targetDeclarations, mainCode) ∧
+        getState = finalState := by
+    simpa using hpure
+  have hbaseNo : DeclListNoReuse base := by
+    apply lowerDecls_noReuse hbase
+  have hbaseState : StateNoReuse baseState := by
+    apply lowerDecls_preservesStateNoReuse src fuel declarations
+      StateNoReuse.empty
+    simpa [src] using hbase
+  have hmainNo : CodeNoReuse compiledMain := lowerFnBody_noReuse hmain
+  have hmainState : StateNoReuse mainState :=
+    (lowerStateNoReuse src fuel).fnBody ⟨[], 0⟩ [] mainWorld main
+      hbaseState hmain
+  have hdeclsEq : base ++ mainState.extra = targetDeclarations := by
+    rw [hgetState.1]
+    exact congrArg Prod.fst hresult.1
+  have hmainEq : compiledMain = mainCode :=
+    congrArg Prod.snd hresult.1
+  have hfinalEq : mainState = finalState :=
+    hgetState.2.trans hresult.2
+  refine ⟨?_, ?_, ?_⟩
+  · rw [← hdeclsEq]
+    exact hbaseNo.append hmainState
+  · rwa [← hmainEq]
+  · rwa [← hfinalEq]
+
+private theorem envOfList_some_mem
+    {entries : List (Ixon.Address × Decl)} {address : Ixon.Address}
+    {declaration : Decl}
+    (hlookup : Env.ofList entries address = some declaration) :
+    (address, declaration) ∈ entries := by
+  unfold Env.ofList at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ :=
+    Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryDeclaration⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Ixon.Address × Decl => entry.1 == address) hfind
+  have haddress : entryAddress = address :=
+    Ixon.Address.eq_of_beq hbeq
+  have hdeclaration : entryDeclaration = declaration := by
+    simpa using hvalue
+  subst entryAddress
+  subst entryDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+/-- A declaration-list environment is reuse-free whenever every declaration
+in the backing list is reuse-free. -/
+theorem ctxOfList_noReuse
+    {declarations : List (Ixon.Address × Decl)}
+    {oracle : Ixon.Address → List RVal → Option RVal}
+    (hdeclarations : DeclListNoReuse declarations) :
+    CtxNoReuse
+      ({ decls := Env.ofList declarations, oracle := oracle } : Ctx) := by
+  intro address definition hlookup
+  exact hdeclarations (address, .fn definition)
+    (envOfList_some_mem hlookup)
+
+/-- The exact declaration-list context returned by a successful whole pass is
+reuse-free, including every lifted body and constructor wrapper accumulated in
+the final compiler state. -/
+theorem lowerAllAction_ctxNoReuse
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {targetDeclarations : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {ctx : Ctx}
+    (hlower :
+      (lowerAllAction declarations main mainWorld compilerFuel).run {} =
+        .ok (targetDeclarations, mainCode) finalState)
+    (hdecls : ctx.decls = Env.ofList targetDeclarations) :
+    CtxNoReuse ctx := by
+  have houtput := lowerAllAction_noReuse hlower
+  intro address definition hlookup
+  rw [hdecls] at hlookup
+  exact houtput.1 (address, .fn definition)
+    (envOfList_some_mem hlookup)
+
+/-- The actual whole-pass output instantiates `CostRefinement` with the exact
+equation `reuses = 0`.  The source run and value graph remain semantically
+relevant to the interface but are intentionally absent from the counter
+proof. -/
+theorem lowerAllAction_reuseCostRefinement
+    {sourceCtx : IxIR0.Ctx} {funRel : Sim.FunctionRel}
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {targetDeclarations : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {ctx : Ctx}
+    (hlower :
+      (lowerAllAction declarations main mainWorld compilerFuel).run {} =
+        .ok (targetDeclarations, mainCode) finalState)
+    (hdecls : ctx.decls = Env.ofList targetDeclarations) :
+    LowerSim.CostRefinement sourceCtx ctx main mainCode funRel
+      (fun _ observation => ReuseFreeCostSpec observation) := by
+  apply LowerSim.RunCostInvariant.costRefinement
+  exact runCostInvariant_of_noReuse
+    (lowerAllAction_ctxNoReuse hlower hdecls)
+    (lowerAllAction_noReuse hlower).2.1
+
+/-- The whole-pass output satisfies the current lowerer's combined counter
+contract: `reuses = 0 ∧ frees ≤ allocs`. -/
+theorem lowerAllAction_costRefinement
+    {sourceCtx : IxIR0.Ctx} {funRel : Sim.FunctionRel}
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {targetDeclarations : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {ctx : Ctx}
+    (hlower :
+      (lowerAllAction declarations main mainWorld compilerFuel).run {} =
+        .ok (targetDeclarations, mainCode) finalState)
+    (hdecls : ctx.decls = Env.ofList targetDeclarations) :
+    LowerSim.CostRefinement sourceCtx ctx main mainCode funRel
+      (fun _ observation => CurrentLowererCostSpec observation) := by
+  apply LowerSim.RunCostInvariant.costRefinement
+  exact runCostInvariant_of_noReuse_with_allocationFree
+    (lowerAllAction_ctxNoReuse hlower hdecls)
+    (lowerAllAction_noReuse hlower).2.1
+
+/-- The actual transient lowerer satisfies `LowerSim.Reclamation`: every
+successful compiled-main execution can release its result and reach a store
+with no live nodes. -/
+theorem lowerAllAction_reclamation
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {targetDeclarations : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : LowSt} {ctx : Ctx}
+    (hlower :
+      (lowerAllAction declarations main mainWorld compilerFuel).run {} =
+        .ok (targetDeclarations, mainCode) finalState)
+    (hdecls : ctx.decls = Env.ofList targetDeclarations)
+    (hrepresented : LowerSim.ExtraRepresented ctx finalState)
+    (hcontracts :
+      LowerSim.CompilerContracts (IxIR0.Env.ofList declarations) ctx) :
+    LowerSim.Reclamation ctx mainCode mainWorld := by
+  have houtput := lowerAllAction_noReuse hlower
+  have hctx : CtxNoReuse ctx :=
+    lowerAllAction_ctxNoReuse hlower hdecls
+  apply LowerSim.reclamation_of_run_ownership_and_zero_reuses
+  · intro runFuel store value hrun
+    exact LowerSim.lowerAllAction_main_owned hlower hrepresented hcontracts
+      hrun
+  · intro runFuel store value hrun
+    exact runMain_reuses_eq_zero hctx houtput.2.1 hrun
+
+end Ix.Compiler.IxIR1.NoReuse
diff --git a/Ix/Compiler/IxIR1/NoReuseAddressed.lean b/Ix/Compiler/IxIR1/NoReuseAddressed.lean
new file mode 100644
index 000000000..a9a4f5496
--- /dev/null
+++ b/Ix/Compiler/IxIR1/NoReuseAddressed.lean
@@ -0,0 +1,325 @@
+import Ix.Compiler.IxIR1.NoReuse
+import Ix.Compiler.IxIR1.LowerFullyAddressedSim
+
+/-!
+# Reclamation across IxIR₁ address normalization
+
+Address normalization rewrites only declaration identities stored in code and
+pap/constructor nodes. Locations, ownership counts, release behavior, and the
+live-node metric are unchanged. This module transports the transient
+lowerer's reclamation theorem to both content-addressed production boundaries.
+-/
+
+namespace Ix.Compiler.IxIR1.NoReuse
+
+open Ix.Compiler.IxIR1
+
+@[simp] theorem storeMapAddresses_live
+    (rename : Ixon.Address → Ixon.Address) (store : Store) :
+    (Readdress.Store.mapAddresses rename store).live = store.live := by
+  simp only [Store.live, Readdress.Store.mapAddresses]
+  rw [Array.foldl_map]
+  simp
+
+/-- Reclamation is equivariant under every address renaming accepted by the
+evaluator context relation.  Address normalization changes declaration
+identities beneath code and heap nodes, but leaves locations, result values,
+release behavior, and the live-node count intact. -/
+theorem reclamation_mapAddresses
+    {rename : Ixon.Address → Ixon.Address}
+    {before after : Ctx} {code : Code} {world : Ixon.Owned}
+    (hcontexts : Readdress.Ctx.Renames rename before after)
+    (hreclamation : LowerSim.Reclamation before code world) :
+    LowerSim.Reclamation after
+      (Readdress.Code.mapAddresses rename code) world := by
+  intro runFuel mappedStore value hmappedRun
+  have htransport :=
+    Readdress.runMain_mapAddresses hcontexts code runFuel
+  rw [hmappedRun] at htransport
+  cases hraw : runMain before code runFuel with
+  | error error =>
+      rw [hraw] at htransport
+      contradiction
+  | ok output =>
+      rcases output with ⟨rawStore, rawValue⟩
+      rw [hraw] at htransport
+      have hresult :
+          mappedStore = Readdress.Store.mapAddresses rename rawStore ∧
+            value = rawValue := by
+        simpa only [Readdress.mapRunResult_ok, Except.ok.injEq,
+          Prod.mk.injEq] using htransport
+      rcases hresult with ⟨hstore, hvalue⟩
+      subst mappedStore
+      subst value
+      obtain ⟨releaseFuel, released, hrelease, hlive⟩ :=
+        hreclamation hraw
+      refine ⟨releaseFuel,
+        Readdress.Store.mapAddresses rename released, ?_, ?_⟩
+      · cases world with
+        | shared =>
+            have hrelease' :
+                dropVal before releaseFuel rawStore rawValue =
+                  .ok released := by
+              simpa [LowerSim.releaseResult] using hrelease
+            simp only [LowerSim.releaseResult]
+            rw [(Readdress.evalTransportAt hcontexts releaseFuel).dropVal,
+              hrelease']
+            rfl
+        | unique =>
+            have hrelease' :
+                dropUVal before releaseFuel rawStore rawValue =
+                  .ok released := by
+              simpa [LowerSim.releaseResult] using hrelease
+            simp only [LowerSim.releaseResult]
+            rw [(Readdress.evalTransportAt hcontexts releaseFuel).dropUVal,
+              hrelease']
+            rfl
+      · simpa using hlive
+
+/-- Every result-independent counter invariant survives a compatible address
+renaming.  The successful addressed run has the exact mapped raw store, and
+`costObservation` ignores the address-bearing contents of its nodes. -/
+theorem runCostInvariant_mapAddresses
+    {rename : Ixon.Address → Ixon.Address}
+    {before after : Ctx} {code : Code}
+    {spec : LowerSim.CostObservation → Prop}
+    (hcontexts : Readdress.Ctx.Renames rename before after)
+    (hcost : LowerSim.RunCostInvariant before code spec) :
+    LowerSim.RunCostInvariant after
+      (Readdress.Code.mapAddresses rename code) spec := by
+  intro targetFuel mappedStore value hmappedRun
+  have htransport :=
+    Readdress.runMain_mapAddresses hcontexts code targetFuel
+  rw [hmappedRun] at htransport
+  cases hraw : runMain before code targetFuel with
+  | error error =>
+      rw [hraw] at htransport
+      contradiction
+  | ok output =>
+      rcases output with ⟨rawStore, rawValue⟩
+      rw [hraw] at htransport
+      have hresult :
+          mappedStore = Readdress.Store.mapAddresses rename rawStore ∧
+            value = rawValue := by
+        simpa only [Readdress.mapRunResult_ok, Except.ok.injEq,
+          Prod.mk.injEq] using htransport
+      rcases hresult with ⟨hstore, hvalue⟩
+      subst mappedStore
+      subst value
+      simpa using hcost hraw
+
+/-- The SCC-aware production boundary preserves any reclamation theorem
+established for its certified pre-address execution context. -/
+theorem lowerAllFullyAddressed_reclamation_of_raw
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (Lower.lowerAllAction declarations main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllFullyAddressed declarations main mainWorld compilerFuel =
+        .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : LowerSim.Reclamation
+      (result.preAddressCtx raw oracle) mainCode mainWorld) :
+    LowerSim.Reclamation (result.addressedCtx oracle) result.main
+      mainWorld := by
+  have hrun :=
+    Lower.readdressAll_run_of_lowerAllFullyAddressed_eq_ok
+      hlower haddressed
+  have haudit := ReaddressAll.semanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_mapAddresses haudit]
+  apply reclamation_mapAddresses
+    (result.renames_preAddressCtx haudit oracle)
+  exact hraw
+
+/-- Indexed-production analogue of
+`lowerAllFullyAddressed_reclamation_of_raw`. -/
+theorem lowerAllIndexedFullyAddressed_reclamation_of_raw
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (Lower.lowerAllIndexedAction declarations main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllIndexedFullyAddressed declarations main mainWorld
+        compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : LowerSim.Reclamation
+      (result.preAddressCtx raw oracle) mainCode mainWorld) :
+    LowerSim.Reclamation (result.addressedCtx oracle) result.main
+      mainWorld := by
+  have hrun :=
+    Lower.readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      hlower haddressed
+  have haudit := ReaddressAll.semanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_mapAddresses haudit]
+  apply reclamation_mapAddresses
+    (result.renames_preAddressCtx haudit oracle)
+  exact hraw
+
+/-- Alias-free indexed-production reclamation transport. The raw theorem is
+stated against the literal declaration-list context and crosses the final SCC
+pass through its certified rebuild renaming. -/
+theorem lowerAllIndexedFullyAddressed_reclamation_of_exact_raw
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (Lower.lowerAllIndexedAction declarations main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllIndexedFullyAddressed declarations main mainWorld
+        compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : LowerSim.Reclamation
+      (result.rebuildSourceCtx raw oracle) mainCode mainWorld) :
+    LowerSim.Reclamation (result.addressedCtx oracle) result.main
+      mainWorld := by
+  have hrun :=
+    Lower.readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      hlower haddressed
+  have haudit := ReaddressAll.rebuildSemanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_rebuildMapAddresses haudit]
+  apply reclamation_mapAddresses
+    (result.renames_rebuildSourceCtx haudit oracle)
+  exact hraw
+
+/-- The indexed SCC-aware production boundary preserves every target-only
+counter invariant already established for its certified raw execution
+context. -/
+theorem lowerAllIndexedFullyAddressed_runCostInvariant_of_raw
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    {spec : LowerSim.CostObservation → Prop}
+    (hlower :
+      (Lower.lowerAllIndexedAction declarations main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllIndexedFullyAddressed declarations main mainWorld
+        compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : LowerSim.RunCostInvariant
+      (result.preAddressCtx raw oracle) mainCode spec) :
+    LowerSim.RunCostInvariant (result.addressedCtx oracle) result.main
+      spec := by
+  have hrun :=
+    Lower.readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      hlower haddressed
+  have haudit := ReaddressAll.semanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_mapAddresses haudit]
+  intro targetFuel targetStore targetValue htarget
+  exact runCostInvariant_mapAddresses
+    (spec := spec) (result.renames_preAddressCtx haudit oracle)
+    hraw htarget
+
+/-- Alias-free transport of target-only counter invariants through complete
+SCC addressing. -/
+theorem lowerAllIndexedFullyAddressed_runCostInvariant_of_exact_raw
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    {spec : LowerSim.CostObservation → Prop}
+    (hlower :
+      (Lower.lowerAllIndexedAction declarations main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllIndexedFullyAddressed declarations main mainWorld
+        compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hraw : LowerSim.RunCostInvariant
+      (result.rebuildSourceCtx raw oracle) mainCode spec) :
+    LowerSim.RunCostInvariant (result.addressedCtx oracle) result.main
+      spec := by
+  have hrun :=
+    Lower.readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      hlower haddressed
+  have haudit := ReaddressAll.rebuildSemanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_rebuildMapAddresses haudit]
+  intro targetFuel targetStore targetValue htarget
+  exact runCostInvariant_mapAddresses
+    (spec := spec) (result.renames_rebuildSourceCtx haudit oracle)
+    hraw htarget
+
+/-- The actual indexed, fully-addressed compiler output satisfies the first
+concrete `CostRefinement` equation, `reuses = 0`, whenever its certified
+pre-address context is reuse-free.  This premise is explicit because the
+semantic transport context also contains stable aliases, not just the raw
+declaration list returned by lowering. -/
+theorem lowerAllIndexedFullyAddressed_reuseCostRefinement
+    {sourceCtx : IxIR0.Ctx} {funRel : Sim.FunctionRel}
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (Lower.lowerAllIndexedAction declarations main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllIndexedFullyAddressed declarations main mainWorld
+        compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hctx : CtxNoReuse (result.preAddressCtx raw oracle)) :
+    LowerSim.CostRefinement sourceCtx (result.addressedCtx oracle)
+      main result.main funRel
+      (fun _ observation => ReuseFreeCostSpec observation) := by
+  apply LowerSim.RunCostInvariant.costRefinement
+  have hlower' :
+      (Lower.lowerAllAction declarations main mainWorld compilerFuel).run {} =
+        .ok (raw, mainCode) finalState := by
+    simpa only [Lower.lowerAllIndexedAction_eq_lowerAllAction] using hlower
+  have hrawCost : LowerSim.RunCostInvariant
+      (result.preAddressCtx raw oracle) mainCode ReuseFreeCostSpec := by
+    intro targetFuel targetStore targetValue htarget
+    exact runCostInvariant_of_noReuse hctx
+      (lowerAllAction_noReuse hlower').2.1 htarget
+  intro targetFuel targetStore targetValue htarget
+  exact lowerAllIndexedFullyAddressed_runCostInvariant_of_raw
+    (spec := ReuseFreeCostSpec) hlower haddressed oracle hrawCost htarget
+
+/-- The indexed fully-addressed production output satisfies the complete
+current-lowerer counter contract `reuses = 0 ∧ frees ≤ allocs`. -/
+theorem lowerAllIndexedFullyAddressed_costRefinement
+    {sourceCtx : IxIR0.Ctx} {funRel : Sim.FunctionRel}
+    {declarations : List (Ixon.Address × IxIR0.Decl)}
+    {main : IxIR0.Expr} {mainWorld : Ixon.Owned} {compilerFuel : Nat}
+    {raw : List (Ixon.Address × Decl)} {mainCode : Code}
+    {finalState : Lower.LowSt} {result : ReaddressAll.Result}
+    (hlower :
+      (Lower.lowerAllIndexedAction declarations main mainWorld
+        compilerFuel).run {} = .ok (raw, mainCode) finalState)
+    (haddressed :
+      Lower.lowerAllIndexedFullyAddressed declarations main mainWorld
+        compilerFuel = .ok result)
+    (oracle : Ixon.Address → List RVal → Option RVal)
+    (hctx : CtxNoReuse (result.preAddressCtx raw oracle)) :
+    LowerSim.CostRefinement sourceCtx (result.addressedCtx oracle)
+      main result.main funRel
+      (fun _ observation => CurrentLowererCostSpec observation) := by
+  have hreuses : LowerSim.CostRefinement sourceCtx
+      (result.addressedCtx oracle) main result.main funRel
+      (fun _ observation => ReuseFreeCostSpec observation) :=
+    lowerAllIndexedFullyAddressed_reuseCostRefinement
+      (sourceCtx := sourceCtx) (funRel := funRel)
+      hlower haddressed oracle hctx
+  have hallocFree : LowerSim.CostRefinement sourceCtx
+      (result.addressedCtx oracle) main result.main funRel
+      (fun _ observation => LowerSim.AllocationFreeCostSpec observation) :=
+    LowerSim.allocationFreeCostRefinement
+  change LowerSim.CostRefinement sourceCtx (result.addressedCtx oracle)
+    main result.main funRel (fun _ observation =>
+      ReuseFreeCostSpec observation ∧
+        LowerSim.AllocationFreeCostSpec observation)
+  apply LowerSim.CostRefinement.and
+  · exact hreuses
+  · exact hallocFree
+
+end Ix.Compiler.IxIR1.NoReuse
diff --git a/Ix/Compiler/IxIR1/Optimizer.lean b/Ix/Compiler/IxIR1/Optimizer.lean
new file mode 100644
index 000000000..877b4aee4
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Optimizer.lean
@@ -0,0 +1,798 @@
+import Ix.Compiler.IxIR1.HPTCache
+import Ix.Compiler.IxIR1.HPTPAPFuseProgram
+
+/-!
+# Deterministic IxIR₁ optimizer harness
+
+This module is the control and observation boundary for whole-program IxIR₁
+optimization.  It wraps the checked, fact-propagating HPT case simplifier
+(impossible-alternative pruning plus exact unary case collapse), exact scalar
+fetch forwarding after allocation/reuse, scalar and exact-leaf destruction
+specialization, local PAP/application fusion, and checked rooted declaration
+reachability with:
+
+- explicit harness and pass-policy versions;
+- deterministic, fail-soft resource controls;
+- exact static before/after observations;
+- content-addressed input, output, certificate, and report identities; and
+- an explicit disabled path that returns the input graph unchanged.
+
+The observations are structural compiler counters, not dynamic execution
+counters.  `instructions` counts each `ret`, `letOp`, and `case` node once;
+operation-specific fields classify the operation bound by each `letOp`.
+`codeBytes` is the sum of canonical function-body and main spellings, while
+`storedArtifactBytes` follows the actual ordinary/mutual artifact framing.
+
+An exhausted optimizer budget, unsupported policy version, or failed graph
+rebuild selects the unoptimized graph and records why.  It never turns an
+otherwise accepted program into a compiler rejection.
+-/
+
+namespace Ix.Compiler.IxIR1.Optimizer
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR
+
+def currentHarnessVersion : Nat := 5
+def currentCasePruneVersion : Nat := 3
+def currentFetchForwardVersion : Nat := 1
+def currentDestructionVersion : Nat := 1
+def currentPAPFuseVersion : Nat := 1
+def currentReachabilityVersion : Nat := Reachability.currentVersion
+
+/-! ## Structural observations -/
+
+/-- Static control, call, and heap-operation counts over IxIR₁ code. -/
+structure Counts where
+  instructions : Nat := 0
+  returns : Nat := 0
+  cases : Nat := 0
+  alternatives : Nat := 0
+  allocations : Nat := 0
+  reuses : Nat := 0
+  frees : Nat := 0
+  rcIncrements : Nat := 0
+  rcDecrements : Nat := 0
+  uniqueDrops : Nat := 0
+  fetches : Nat := 0
+  directCalls : Nat := 0
+  selfCalls : Nat := 0
+  papAllocations : Nat := 0
+  applies : Nat := 0
+  externCalls : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+def Counts.add (left right : Counts) : Counts :=
+  { instructions := left.instructions + right.instructions
+    returns := left.returns + right.returns
+    cases := left.cases + right.cases
+    alternatives := left.alternatives + right.alternatives
+    allocations := left.allocations + right.allocations
+    reuses := left.reuses + right.reuses
+    frees := left.frees + right.frees
+    rcIncrements := left.rcIncrements + right.rcIncrements
+    rcDecrements := left.rcDecrements + right.rcDecrements
+    uniqueDrops := left.uniqueDrops + right.uniqueDrops
+    fetches := left.fetches + right.fetches
+    directCalls := left.directCalls + right.directCalls
+    selfCalls := left.selfCalls + right.selfCalls
+    papAllocations := left.papAllocations + right.papAllocations
+    applies := left.applies + right.applies
+    externCalls := left.externCalls + right.externCalls }
+
+private def countsOfOp : Op → Counts
+  | .pure _ => {}
+  | .alloc _ _ _ => { allocations := 1 }
+  | .reuse _ _ _ => { reuses := 1 }
+  | .free _ => { frees := 1 }
+  | .dup _ => { rcIncrements := 1 }
+  | .drop _ => { rcDecrements := 1 }
+  | .dropU _ => { uniqueDrops := 1 }
+  | .fetch _ _ => { fetches := 1 }
+  | .call _ _ => { directCalls := 1 }
+  | .callSelf _ => { selfCalls := 1 }
+  | .papp _ _ => { papAllocations := 1 }
+  | .apply _ _ => { applies := 1 }
+  | .extern _ _ => { externCalls := 1 }
+
+mutual
+
+def countsCode : Code → Counts
+  | .ret _ => { instructions := 1, returns := 1 }
+  | .letOp operation rest =>
+      (countsOfOp operation).add
+        ((countsCode rest).add { instructions := 1 })
+  | .case _ _ alternatives =>
+      alternatives.foldl
+        (fun total alternative => total.add (countsAlternative alternative))
+        { instructions := 1
+          cases := 1
+          alternatives := alternatives.size }
+
+def countsAlternative : Alt → Counts
+  | .mk _ _ body => countsCode body
+
+end
+
+/-- Deterministic whole-program static observation. -/
+structure Observation where
+  storedArtifacts : Nat := 0
+  mutualBlocks : Nat := 0
+  functions : Nat := 0
+  externs : Nat := 0
+  counts : Counts := {}
+  codeBytes : Nat := 0
+  storedArtifactBytes : Nat := 0
+  deriving BEq, Repr, Inhabited
+
+private def declarationCounts : Decl → Counts
+  | .fn function => countsCode function.body
+  | .extern _ => {}
+
+private def declarationCodeBytes : Decl → Nat
+  | .fn function => function.body.bytes.size
+  | .extern _ => 0
+
+private def artifactStoredBytes : ReaddressAll.Artifact → Nat
+  | .stable _ declaration | .ordinary _ declaration =>
+      declaration.preimage.size
+  | .mutual block => MutualBlock.Block.preimage block.blockMembers |>.size
+
+/-- Observe the exact addressed declaration graph plus its main code. -/
+def observe (program : List ReaddressAll.Artifact) (main : Code) : Observation :=
+  let declarations := HPT.declarationEntries program
+  { storedArtifacts := program.length
+    mutualBlocks := program.countP fun
+      | .mutual _ => true
+      | _ => false
+    functions := declarations.countP fun
+      | (_, .fn _) => true
+      | _ => false
+    externs := declarations.countP fun
+      | (_, .extern _) => true
+      | _ => false
+    counts := declarations.foldl
+      (fun total entry => total.add (declarationCounts entry.2))
+      (countsCode main)
+    codeBytes := declarations.foldl
+      (fun total entry => total + declarationCodeBytes entry.2)
+      main.bytes.size
+    storedArtifactBytes := program.foldl
+      (fun total artifact => total + artifactStoredBytes artifact) 0 }
+
+/-! ## Exact graph and certificate identities -/
+
+private def graphDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/optimizer-graph/1" ++ Encoding.tag 0
+
+private def artifactBytes : ReaddressAll.Artifact → ByteArray
+  | .stable address declaration =>
+      Encoding.tag 0 ++ Encoding.address address ++
+        Encoding.blob declaration.preimage
+  | .ordinary address declaration =>
+      Encoding.tag 1 ++ Encoding.address address ++
+        Encoding.blob declaration.preimage
+  | .mutual block =>
+      Encoding.tag 2 ++ Encoding.address block.blockAddress ++
+        Encoding.blob (MutualBlock.Block.preimage block.blockMembers)
+
+/-- One digest commits to artifact kind/order, stable ABI rows, addressed
+ordinary/mutual payloads, and the exact main code. -/
+def graphRoot (program : List ReaddressAll.Artifact) (main : Code) : Address :=
+  Address.blake3
+    (graphDomain ++ Encoding.list artifactBytes program ++
+      Encoding.blob main.bytes)
+
+private def checkedStore (result : HPT.Result) : HPT.Cache.Store :=
+  HPT.Cache.Store.ofResult result
+
+def certificateBytes (result : HPT.Result) : Nat :=
+  (checkedStore result).framedSize
+
+def certificateRoot (result : HPT.Result) : Address :=
+  Address.blake3 (HPT.Cache.encodeStore (checkedStore result))
+
+/-! ## Versioned fail-soft policy -/
+
+/-- Deterministic admission limits for the existing shrinking pass.  HPT
+production/checking has its own limits; these bound optimizer traversal and
+report inputs after a checked analysis already exists. -/
+structure Budget where
+  maxInputInstructions : Nat := 16 * 1024 * 1024
+  maxInputCodeBytes : Nat := 64 * 1024 * 1024
+  maxCertificateBytes : Nat := 64 * 1024 * 1024
+  deriving BEq, Repr
+
+structure CasePrunePolicy where
+  version : Nat := currentCasePruneVersion
+  enabled : Bool := true
+  budget : Budget := {}
+  deriving BEq, Repr
+
+structure FetchForwardPolicy where
+  version : Nat := currentFetchForwardVersion
+  enabled : Bool := true
+  deriving BEq, Repr
+
+structure DestructionPolicy where
+  version : Nat := currentDestructionVersion
+  enabled : Bool := true
+  deriving BEq, Repr
+
+structure PAPFusePolicy where
+  version : Nat := currentPAPFuseVersion
+  enabled : Bool := true
+  deriving BEq, Repr
+
+structure ReachabilityPolicy where
+  version : Nat := currentReachabilityVersion
+  enabled : Bool := true
+  /-- Additional exported declarations which must remain addressable even when
+  they are not reachable from top-level main. -/
+  roots : List Address := []
+  deriving BEq, Repr
+
+structure Policy where
+  version : Nat := currentHarnessVersion
+  casePrune : CasePrunePolicy := {}
+  fetchForward : FetchForwardPolicy := {}
+  destruction : DestructionPolicy := {}
+  papFuse : PAPFusePolicy := {}
+  reachability : ReachabilityPolicy := {}
+  deriving BEq, Repr
+
+def defaultPolicy : Policy := {}
+
+namespace Policy
+
+/-- Executable optimizer policy projected into the proof-facing composed
+pass selection.  Keeping this projection public ensures the harness and its
+semantic theorem refer to literally the same pass bundle. -/
+def passes (policy : Policy) : HPT.OptimizeProgram.Passes :=
+  { casePrune := policy.casePrune.enabled
+    fetchForward := policy.fetchForward.enabled
+    destroy := policy.destruction.enabled
+    papFuse := policy.papFuse.enabled
+    reachability := policy.reachability.enabled
+    roots := policy.reachability.roots }
+
+/-- Exact old-keyed declaration rows consumed by the optimizer's single
+content-address rebuild. -/
+def rebuildEntries (policy : Policy)
+    (program : List ReaddressAll.Artifact) (summaries : HPT.SummaryEnv)
+    (main : Code) : List (Address × Decl) :=
+  (HPT.OptimizeProgram.selectReachable policy.passes
+    (HPT.OptimizeProgram.rewriteEntries policy.passes
+      (HPT.programDeclEnv program) summaries
+      (HPT.declarationEntries program))
+    (HPT.OptimizeProgram.rewriteMain policy.passes
+      (HPT.programDeclEnv program) summaries main).code).entries
+
+end Policy
+
+inductive SkipReason where
+  | unsupportedHarnessVersion (actual expected : Nat)
+  | unsupportedPassVersion (actual expected : Nat)
+  | unsupportedFetchForwardVersion (actual expected : Nat)
+  | unsupportedDestructionVersion (actual expected : Nat)
+  | unsupportedPAPFuseVersion (actual expected : Nat)
+  | unsupportedReachabilityVersion (actual expected : Nat)
+  | disabled
+  | instructionBudget (actual limit : Nat)
+  | codeByteBudget (actual limit : Nat)
+  | certificateByteBudget (actual limit : Nat)
+  | rebuildRejected
+  deriving BEq, Repr
+
+inductive Disposition where
+  | skipped (reason : SkipReason)
+  | unchanged
+  | changed
+  deriving BEq, Repr
+
+structure Report where
+  policy : Policy
+  disposition : Disposition
+  inputRoot : Address
+  outputRoot : Address
+  certificateRoot : Address
+  certificateBytes : Nat
+  before : Observation
+  after : Observation
+  removedAlternatives : Nat
+  collapsedCases : Nat
+  materializedFetches : Nat
+  forwardedFetches : Nat
+  elidedScalarDrops : Nat
+  specializedUniqueDrops : Nat
+  fusedPaps : Nat
+  underSaturatedPaps : Nat
+  exactlySaturatedPaps : Nat
+  overSaturatedPaps : Nat
+  removedDeclarations : Nat
+  /-- Populated only when the semantics-preserving rebuild rejected and the
+  harness selected the original graph. -/
+  diagnostic : String := ""
+  deriving BEq, Repr
+
+private def natFields (values : List Nat) : ByteArray :=
+  Encoding.list Encoding.nat values
+
+private def Counts.bytes (counts : Counts) : ByteArray :=
+  natFields
+    [counts.instructions, counts.returns, counts.cases, counts.alternatives,
+     counts.allocations, counts.reuses, counts.frees, counts.rcIncrements,
+     counts.rcDecrements, counts.uniqueDrops, counts.fetches,
+     counts.directCalls, counts.selfCalls, counts.papAllocations,
+     counts.applies, counts.externCalls]
+
+private def Observation.bytes (observation : Observation) : ByteArray :=
+  natFields
+      [observation.storedArtifacts, observation.mutualBlocks,
+       observation.functions, observation.externs] ++
+    observation.counts.bytes ++
+    natFields [observation.codeBytes, observation.storedArtifactBytes]
+
+private def Budget.bytes (budget : Budget) : ByteArray :=
+  natFields [budget.maxInputInstructions, budget.maxInputCodeBytes,
+    budget.maxCertificateBytes]
+
+private def Policy.bytes (policy : Policy) : ByteArray :=
+  Encoding.nat policy.version ++ Encoding.nat policy.casePrune.version ++
+    Encoding.bool policy.casePrune.enabled ++ policy.casePrune.budget.bytes ++
+    Encoding.nat policy.fetchForward.version ++
+    Encoding.bool policy.fetchForward.enabled ++
+    Encoding.nat policy.destruction.version ++
+    Encoding.bool policy.destruction.enabled ++
+    Encoding.nat policy.papFuse.version ++ Encoding.bool policy.papFuse.enabled ++
+    Encoding.nat policy.reachability.version ++
+    Encoding.bool policy.reachability.enabled ++
+    Encoding.list Encoding.address policy.reachability.roots
+
+private def SkipReason.bytes : SkipReason → ByteArray
+  | .unsupportedHarnessVersion actual expected =>
+      Encoding.tag 0 ++ natFields [actual, expected]
+  | .unsupportedPassVersion actual expected =>
+      Encoding.tag 1 ++ natFields [actual, expected]
+  | .unsupportedPAPFuseVersion actual expected =>
+      Encoding.tag 2 ++ natFields [actual, expected]
+  | .disabled => Encoding.tag 3
+  | .instructionBudget actual limit =>
+      Encoding.tag 4 ++ natFields [actual, limit]
+  | .codeByteBudget actual limit =>
+      Encoding.tag 5 ++ natFields [actual, limit]
+  | .certificateByteBudget actual limit =>
+      Encoding.tag 6 ++ natFields [actual, limit]
+  | .rebuildRejected => Encoding.tag 7
+  | .unsupportedFetchForwardVersion actual expected =>
+      Encoding.tag 8 ++ natFields [actual, expected]
+  | .unsupportedReachabilityVersion actual expected =>
+      Encoding.tag 9 ++ natFields [actual, expected]
+  | .unsupportedDestructionVersion actual expected =>
+      Encoding.tag 10 ++ natFields [actual, expected]
+
+private def Disposition.bytes : Disposition → ByteArray
+  | .skipped reason => Encoding.tag 0 ++ reason.bytes
+  | .unchanged => Encoding.tag 1
+  | .changed => Encoding.tag 2
+
+namespace Report
+
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/optimizer-report/6" ++ Encoding.tag 0
+
+/-- Canonical machine-independent report spelling. -/
+def bytes (report : Report) : ByteArray :=
+  addressDomain ++ report.policy.bytes ++ report.disposition.bytes ++
+    Encoding.address report.inputRoot ++ Encoding.address report.outputRoot ++
+    Encoding.address report.certificateRoot ++
+    Encoding.nat report.certificateBytes ++ report.before.bytes ++
+    report.after.bytes ++ Encoding.nat report.removedAlternatives ++
+    Encoding.nat report.collapsedCases ++
+    Encoding.nat report.materializedFetches ++
+    Encoding.nat report.forwardedFetches ++
+    Encoding.nat report.elidedScalarDrops ++
+    Encoding.nat report.specializedUniqueDrops ++
+    Encoding.nat report.fusedPaps ++
+    Encoding.nat report.underSaturatedPaps ++
+    Encoding.nat report.exactlySaturatedPaps ++
+    Encoding.nat report.overSaturatedPaps ++
+    Encoding.nat report.removedDeclarations ++
+    Encoding.string report.diagnostic
+
+def address (report : Report) : Address :=
+  Address.blake3 report.bytes
+
+end Report
+
+/-! ## Checked optimization execution -/
+
+structure Outcome where
+  /-- `none` means the original graph is the selected output. -/
+  rebuilt : Option ReaddressAll.Result
+  report : Report
+
+namespace Outcome
+
+def artifacts (outcome : Outcome)
+    (input : List ReaddressAll.Artifact) : List ReaddressAll.Artifact :=
+  outcome.rebuilt.map (fun result => result.artifacts) |>.getD input
+
+def main (outcome : Outcome) (input : Code) : Code :=
+  outcome.rebuilt.map (fun result => result.main) |>.getD input
+
+/-- Oracle seen by the selected input program.  A rebuilt outcome pulls the
+final oracle back through the optimizer's exact rebuild renaming; a skipped
+outcome uses it literally. -/
+def sourceOracle (outcome : Outcome) (policy : Policy)
+    (program : List ReaddressAll.Artifact) (summaries : HPT.SummaryEnv)
+    (main : Code) (oracle : Address → List RVal → Option RVal) :
+    Address → List RVal → Option RVal :=
+  match outcome.rebuilt with
+  | none => oracle
+  | some result => fun address arguments =>
+      oracle (result.rebuildRename
+        (policy.rebuildEntries program summaries main) address) arguments
+
+/-- Old addressed program context from which the selected optimizer result is
+proved. -/
+def sourceCtx (outcome : Outcome) (policy : Policy)
+    (program : List ReaddressAll.Artifact) (summaries : HPT.SummaryEnv)
+    (main : Code) (oracle : Address → List RVal → Option RVal) : Ctx :=
+  { decls := HPT.programDeclEnv program
+    oracle := outcome.sourceOracle policy program summaries main oracle }
+
+/-- Runtime context of the fail-soft selected graph. -/
+def targetCtx (outcome : Outcome) (program : List ReaddressAll.Artifact)
+    (oracle : Address → List RVal → Option RVal) : Ctx :=
+  match outcome.rebuilt with
+  | none => { decls := HPT.programDeclEnv program, oracle }
+  | some result => result.addressedCtx oracle
+
+/-- Result relation for the fail-soft harness.  Skipping is literal equality.
+A successful optimization first relates logical executions modulo allocation
+history, then maps declaration identities stored in the optimized heap through
+the single certified rebuild. -/
+def RunRefines (outcome : Outcome) (policy : Policy)
+    (program : List ReaddressAll.Artifact) (summaries : HPT.SummaryEnv)
+    (main : Code) (sourceOut targetOut : Store × RVal) : Prop :=
+  match outcome.rebuilt with
+  | none => targetOut = sourceOut
+  | some result =>
+      ∃ logicalOut,
+        targetOut =
+          (Readdress.Store.mapAddresses
+            (result.rebuildRename
+              (policy.rebuildEntries program summaries main)) logicalOut.1,
+            logicalOut.2) ∧
+          Sim.RunHistoryIso HPT.OptimizeProgram.emptyHistoryIso
+            sourceOut logicalOut
+
+/-- The proof-facing selected context uses exactly the declaration environment
+committed to by `Outcome.artifacts`. -/
+theorem targetCtx_decls (outcome : Outcome)
+    (program : List ReaddressAll.Artifact)
+    (oracle : Address → List RVal → Option RVal) :
+    (outcome.targetCtx program oracle).decls =
+      HPT.programDeclEnv (outcome.artifacts program) := by
+  cases hrebuilt : outcome.rebuilt with
+  | none => simp [targetCtx, artifacts, hrebuilt]
+  | some result =>
+      have henv := HPT.OptimizeProgram.envOfList_declarationEntries
+        result.artifacts
+      change
+        Env.ofList
+            (result.artifacts.flatMap ReaddressAll.Artifact.declarations) =
+          HPT.programDeclEnv result.artifacts at henv
+      simpa only [targetCtx, artifacts, hrebuilt, Option.map_some,
+        Option.getD_some, ReaddressAll.Result.addressedCtx,
+        ReaddressAll.Result.asReaddressResult,
+        Readdress.Result.addressedCtx, Readdress.Result.declarations,
+        List.append_nil, ReaddressAll.Result.declarations] using henv
+
+end Outcome
+
+private def skipReason? (policy : Policy) (before : Observation)
+    (checkedBytes : Nat) : Option SkipReason :=
+  if policy.version != currentHarnessVersion then
+    some (.unsupportedHarnessVersion policy.version currentHarnessVersion)
+  else if policy.casePrune.version != currentCasePruneVersion then
+    some (.unsupportedPassVersion policy.casePrune.version
+      currentCasePruneVersion)
+  else if policy.fetchForward.version != currentFetchForwardVersion then
+    some (.unsupportedFetchForwardVersion policy.fetchForward.version
+      currentFetchForwardVersion)
+  else if policy.destruction.version != currentDestructionVersion then
+    some (.unsupportedDestructionVersion policy.destruction.version
+      currentDestructionVersion)
+  else if policy.papFuse.version != currentPAPFuseVersion then
+    some (.unsupportedPAPFuseVersion policy.papFuse.version
+      currentPAPFuseVersion)
+  else if policy.reachability.version != currentReachabilityVersion then
+    some (.unsupportedReachabilityVersion policy.reachability.version
+      currentReachabilityVersion)
+  else if !policy.casePrune.enabled && !policy.fetchForward.enabled &&
+      !policy.destruction.enabled && !policy.papFuse.enabled &&
+      !policy.reachability.enabled then
+    some .disabled
+  else if before.counts.instructions >
+      policy.casePrune.budget.maxInputInstructions then
+    some (.instructionBudget before.counts.instructions
+      policy.casePrune.budget.maxInputInstructions)
+  else if before.codeBytes > policy.casePrune.budget.maxInputCodeBytes then
+    some (.codeByteBudget before.codeBytes
+      policy.casePrune.budget.maxInputCodeBytes)
+  else if checkedBytes > policy.casePrune.budget.maxCertificateBytes then
+    some (.certificateByteBudget checkedBytes
+      policy.casePrune.budget.maxCertificateBytes)
+  else
+    none
+
+private def skippedOutcome (policy : Policy) (reason : SkipReason)
+    (root checkedRoot : Address) (checkedBytes : Nat)
+    (before : Observation) (diagnostic : String := "") : Outcome :=
+  { rebuilt := none
+    report :=
+      { policy
+        disposition := .skipped reason
+        inputRoot := root
+        outputRoot := root
+        certificateRoot := checkedRoot
+        certificateBytes := checkedBytes
+        before
+        after := before
+        removedAlternatives := 0
+        collapsedCases := 0
+        materializedFetches := 0
+        forwardedFetches := 0
+        elidedScalarDrops := 0
+        specializedUniqueDrops := 0
+        fusedPaps := 0
+        underSaturatedPaps := 0
+        exactlySaturatedPaps := 0
+        overSaturatedPaps := 0
+        removedDeclarations := 0
+        diagnostic } }
+
+private def runChecked (policy : Policy)
+    (program : List ReaddressAll.Artifact) (main : Code)
+    (summaries : HPT.SummaryEnv) (analysis : HPT.Result) : Outcome :=
+  let before := observe program main
+  let inputRoot := graphRoot program main
+  let checkedBytes := certificateBytes analysis
+  let checkedRoot := certificateRoot analysis
+  match skipReason? policy before checkedBytes with
+  | some reason =>
+      skippedOutcome policy reason inputRoot checkedRoot checkedBytes before
+  | none =>
+      match HPT.OptimizeProgram.rebuildProgram policy.passes [] program summaries
+          main with
+      | .error message =>
+          skippedOutcome policy .rebuildRejected inputRoot checkedRoot
+            checkedBytes before message
+      | .ok pruned =>
+          let after := observe pruned.result.artifacts pruned.result.main
+          let outputRoot := graphRoot pruned.result.artifacts pruned.result.main
+          let caseChanges := pruned.changes.casePrune
+          let fetchChanges := pruned.changes.fetchForward
+          let destructionChanges := pruned.changes.destroy
+          let papChanges := pruned.changes.papFuse
+          { rebuilt := some pruned.result
+            report :=
+              { policy
+                disposition :=
+                  if caseChanges.removedAlternatives == 0 &&
+                      caseChanges.collapsedCases == 0 &&
+                      caseChanges.materializedFetches == 0 &&
+                      fetchChanges.forwardedFetches == 0 &&
+                      destructionChanges.elidedScalarDrops == 0 &&
+                      destructionChanges.specializedUniqueDrops == 0 &&
+                      papChanges.fusedPaps == 0 &&
+                      pruned.changes.removedDeclarations == 0 then .unchanged
+                  else .changed
+                inputRoot
+                outputRoot
+                certificateRoot := checkedRoot
+                certificateBytes := checkedBytes
+                before
+                after
+                removedAlternatives := caseChanges.removedAlternatives
+                collapsedCases := caseChanges.collapsedCases
+                materializedFetches := caseChanges.materializedFetches
+                forwardedFetches := fetchChanges.forwardedFetches
+                elidedScalarDrops := destructionChanges.elidedScalarDrops
+                specializedUniqueDrops :=
+                  destructionChanges.specializedUniqueDrops
+                fusedPaps := papChanges.fusedPaps
+                underSaturatedPaps := papChanges.underSaturated
+                exactlySaturatedPaps := papChanges.exactlySaturated
+                overSaturatedPaps := papChanges.overSaturated
+                removedDeclarations := pruned.changes.removedDeclarations } }
+
+/-- A selected rebuilt result can only come from the successful branch of the
+same composed pass invocation used by the harness. -/
+private theorem runChecked_rebuilt_eq_some
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {summaries : HPT.SummaryEnv} {analysis : HPT.Result}
+    {result : ReaddressAll.Result}
+    (hselected :
+      (runChecked policy program main summaries analysis).rebuilt =
+        some result) :
+    ∃ optimized,
+      HPT.OptimizeProgram.rebuildProgram policy.passes [] program summaries
+          main = .ok optimized ∧
+        optimized.result = result := by
+  cases hskip : skipReason? policy (observe program main)
+      (certificateBytes analysis) with
+  | some reason =>
+      simp [runChecked, hskip, skippedOutcome] at hselected
+  | none =>
+      cases hrebuild : HPT.OptimizeProgram.rebuildProgram policy.passes []
+          program summaries main with
+      | error message =>
+          simp [runChecked, hskip, hrebuild, skippedOutcome] at hselected
+      | ok optimized =>
+          refine ⟨optimized, rfl, ?_⟩
+          simpa [runChecked, hskip, hrebuild] using hselected
+
+/-- Run the versioned harness from an in-process HPT production that already
+crossed the ordinary checker. -/
+def runWithProducedHPT (policy : Policy)
+    (program : List ReaddressAll.Artifact) (main : Code)
+    {limits : HPT.Limits}
+    (production : HPT.Production limits program) : Outcome :=
+  runChecked policy program main production.certificate.summaryEnv
+    production.result
+
+/-- Cached HPT hits and rebuilt rows carry the same whole-program checked
+boundary, so they can drive the identical deterministic harness. -/
+def runWithCachedHPT (policy : Policy)
+    (program : List ReaddressAll.Artifact) (main : Code)
+    {limits : HPT.Cache.Limits}
+    (production : HPT.Cache.Production limits program) : Outcome :=
+  runChecked policy program main production.certificate.summaryEnv
+    production.result
+
+/-- Proof-facing inversion of the produced-HPT harness's rebuilt branch. -/
+theorem rebuilt_eq_some_of_runWithProducedHPT
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {limits : HPT.Limits} {production : HPT.Production limits program}
+    {result : ReaddressAll.Result}
+    (hselected :
+      (runWithProducedHPT policy program main production).rebuilt =
+        some result) :
+    ∃ optimized,
+      HPT.OptimizeProgram.rebuildProgram policy.passes [] program
+          production.certificate.summaryEnv main = .ok optimized ∧
+        optimized.result = result := by
+  exact runChecked_rebuilt_eq_some hselected
+
+/-- Proof-facing inversion of the cached-HPT harness's rebuilt branch. -/
+theorem rebuilt_eq_some_of_runWithCachedHPT
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {limits : HPT.Cache.Limits}
+    {production : HPT.Cache.Production limits program}
+    {result : ReaddressAll.Result}
+    (hselected :
+      (runWithCachedHPT policy program main production).rebuilt =
+        some result) :
+    ∃ optimized,
+      HPT.OptimizeProgram.rebuildProgram policy.passes [] program
+          production.certificate.summaryEnv main = .ok optimized ∧
+        optimized.result = result := by
+  exact runChecked_rebuilt_eq_some hselected
+
+/-- Every directly produced fail-soft optimizer selection preserves a
+successful execution at the same fuel under its explicit oracle pullback. -/
+theorem runMain_of_runWithProducedHPT_eq
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {limits : HPT.Limits} {production : HPT.Production limits program}
+    {outcome : Outcome}
+    (houtcome : runWithProducedHPT policy program main production = outcome)
+    (oracle : Address → List RVal → Option RVal) (fuel : Nat)
+    {sourceOut : Store × RVal}
+    (hrun : runMain
+      (outcome.sourceCtx policy program production.certificate.summaryEnv
+        main oracle) main fuel = .ok sourceOut) :
+    ∃ targetOut,
+      runMain (outcome.targetCtx program oracle) (outcome.main main) fuel =
+          .ok targetOut ∧
+        outcome.RunRefines policy program production.certificate.summaryEnv
+          main sourceOut targetOut := by
+  cases hrebuilt : outcome.rebuilt with
+  | none =>
+      refine ⟨sourceOut, ?_, ?_⟩
+      · simpa [Outcome.sourceCtx, Outcome.sourceOracle,
+          Outcome.targetCtx, Outcome.main, hrebuilt] using hrun
+      · simp [Outcome.RunRefines, hrebuilt]
+  | some result =>
+      have hselected :
+          (runWithProducedHPT policy program main production).rebuilt =
+            some result := by
+        rw [houtcome, hrebuilt]
+      obtain ⟨optimized, hrebuild, hresult⟩ :=
+        rebuilt_eq_some_of_runWithProducedHPT hselected
+      subst result
+      have hsource :
+          runMain
+            (HPT.OptimizeProgram.rebuildOriginalCtx optimized.result
+              (policy.rebuildEntries program
+                production.certificate.summaryEnv main)
+              (HPT.programDeclEnv program) oracle)
+            main fuel = .ok sourceOut := by
+        simpa [Outcome.sourceCtx, Outcome.sourceOracle, hrebuilt,
+          HPT.OptimizeProgram.rebuildOriginalCtx,
+          ReaddressAll.Result.rebuildSourceCtx] using hrun
+      obtain ⟨logicalOut, htarget, hhistory⟩ :=
+        HPT.OptimizeProgram.runMain_rebuildProgram_of_runWith_eq_ok
+          production.checked hrebuild oracle fuel hsource
+      let targetOut : Store × RVal :=
+        (Readdress.Store.mapAddresses
+          (optimized.result.rebuildRename
+            (policy.rebuildEntries program
+              production.certificate.summaryEnv main)) logicalOut.1,
+          logicalOut.2)
+      refine ⟨targetOut, ?_, ?_⟩
+      · simpa [targetOut, Outcome.targetCtx, Outcome.main, hrebuilt,
+          Policy.rebuildEntries] using htarget
+      · simp only [Outcome.RunRefines, hrebuilt]
+        exact ⟨logicalOut, rfl, hhistory⟩
+
+/-- Cached checked summaries expose the identical fail-soft successful-run
+contract. -/
+theorem runMain_of_runWithCachedHPT_eq
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {limits : HPT.Cache.Limits}
+    {production : HPT.Cache.Production limits program}
+    {outcome : Outcome}
+    (houtcome : runWithCachedHPT policy program main production = outcome)
+    (oracle : Address → List RVal → Option RVal) (fuel : Nat)
+    {sourceOut : Store × RVal}
+    (hrun : runMain
+      (outcome.sourceCtx policy program production.certificate.summaryEnv
+        main oracle) main fuel = .ok sourceOut) :
+    ∃ targetOut,
+      runMain (outcome.targetCtx program oracle) (outcome.main main) fuel =
+          .ok targetOut ∧
+        outcome.RunRefines policy program production.certificate.summaryEnv
+          main sourceOut targetOut := by
+  cases hrebuilt : outcome.rebuilt with
+  | none =>
+      refine ⟨sourceOut, ?_, ?_⟩
+      · simpa [Outcome.sourceCtx, Outcome.sourceOracle,
+          Outcome.targetCtx, Outcome.main, hrebuilt] using hrun
+      · simp [Outcome.RunRefines, hrebuilt]
+  | some result =>
+      have hselected :
+          (runWithCachedHPT policy program main production).rebuilt =
+            some result := by
+        rw [houtcome, hrebuilt]
+      obtain ⟨optimized, hrebuild, hresult⟩ :=
+        rebuilt_eq_some_of_runWithCachedHPT hselected
+      subst result
+      have hsource :
+          runMain
+            (HPT.OptimizeProgram.rebuildOriginalCtx optimized.result
+              (policy.rebuildEntries program
+                production.certificate.summaryEnv main)
+              (HPT.programDeclEnv program) oracle)
+            main fuel = .ok sourceOut := by
+        simpa [Outcome.sourceCtx, Outcome.sourceOracle, hrebuilt,
+          HPT.OptimizeProgram.rebuildOriginalCtx,
+          ReaddressAll.Result.rebuildSourceCtx] using hrun
+      obtain ⟨logicalOut, htarget, hhistory⟩ :=
+        HPT.OptimizeProgram.runMain_rebuildProgram_of_runWith_eq_ok
+          production.checked hrebuild oracle fuel hsource
+      let targetOut : Store × RVal :=
+        (Readdress.Store.mapAddresses
+          (optimized.result.rebuildRename
+            (policy.rebuildEntries program
+              production.certificate.summaryEnv main)) logicalOut.1,
+          logicalOut.2)
+      refine ⟨targetOut, ?_, ?_⟩
+      · simpa [targetOut, Outcome.targetCtx, Outcome.main, hrebuilt,
+          Policy.rebuildEntries] using htarget
+      · simp only [Outcome.RunRefines, hrebuilt]
+        exact ⟨logicalOut, rfl, hhistory⟩
+
+end Ix.Compiler.IxIR1.Optimizer
diff --git a/Ix/Compiler/IxIR1/OptimizerReclamation.lean b/Ix/Compiler/IxIR1/OptimizerReclamation.lean
new file mode 100644
index 000000000..82bd62a6a
--- /dev/null
+++ b/Ix/Compiler/IxIR1/OptimizerReclamation.lean
@@ -0,0 +1,256 @@
+import Ix.Compiler.IxIR1.Optimizer
+import Ix.Compiler.IxIR1.NoReuseAddressed
+
+/-!
+# Reclamation through the fail-soft IxIR₁ optimizer
+
+The optimizer's successful-run theorem is intentionally one-way, but that is
+enough for closed-main reclamation once the source has one successful run.
+The forwarded run supplies a target witness, evaluator determinism identifies
+every other successful target run with that witness, allocation-history
+isomorphism transports deep release, and the final exact rebuild transports
+the released heap through its certified address map.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address Owned)
+
+namespace LowerSim
+
+/-- Releasing a result does not inspect the declaration environment or
+oracle. -/
+theorem releaseResult_ctx_eq (before after : Ctx) (world : Owned)
+    (fuel : Nat) (store : Store) (value : RVal) :
+    releaseResult after world fuel store value =
+      releaseResult before world fuel store value := by
+  cases world with
+  | shared =>
+      exact Sim.dropVal_ctx_eq before after fuel store value
+  | unique =>
+      exact Sim.dropUVal_ctx_eq before after fuel store value
+
+end LowerSim
+
+namespace Sim.RunHistoryIso
+
+/-- A related successful result can be released whenever its source result
+can, and absence of live nodes survives the allocation-history relation. -/
+theorem releaseResult_live_eq_zero
+    {left right : Store} {before : HeapHistoryIso left right}
+    {sourceOut targetOut : Store × RVal}
+    (hresult : RunHistoryIso before sourceOut targetOut)
+    (ctx : Ctx) (world : Owned) {fuel : Nat} {released : Store}
+    (hrelease : LowerSim.releaseResult ctx world fuel sourceOut.1 sourceOut.2 =
+      .ok released)
+    (hlive : released.live = 0) :
+    ∃ targetReleased,
+      LowerSim.releaseResult ctx world fuel targetOut.1 targetOut.2 =
+          .ok targetReleased ∧
+        targetReleased.live = 0 := by
+  obtain ⟨heap, _, hvalue⟩ := hresult
+  cases world with
+  | shared =>
+      have hsource : dropVal ctx fuel sourceOut.1 sourceOut.2 =
+          .ok released := by
+        simpa [LowerSim.releaseResult] using hrelease
+      obtain ⟨targetReleased, htarget, hstores⟩ :=
+        dropVal_historyIso heap hvalue hsource
+      exact ⟨targetReleased, by
+        simpa [LowerSim.releaseResult] using htarget,
+        hstores.right_live_eq_zero hlive⟩
+  | unique =>
+      have hsource : dropUVal ctx fuel sourceOut.1 sourceOut.2 =
+          .ok released := by
+        simpa [LowerSim.releaseResult] using hrelease
+      obtain ⟨targetReleased, htarget, hstores⟩ :=
+        dropUVal_historyIso heap hvalue hsource
+      exact ⟨targetReleased, by
+        simpa [LowerSim.releaseResult] using htarget,
+        hstores.right_live_eq_zero hlive⟩
+
+end Sim.RunHistoryIso
+
+namespace Readdress
+
+/-- A release witness commutes with a certified declaration-address image;
+the address map changes no location liveness. -/
+theorem releaseResult_mapAddresses
+    {rename : Address → Address} {before after : Ctx}
+    (hcontexts : Ctx.Renames rename before after)
+    (world : Owned) {fuel : Nat} {store released : Store} {value : RVal}
+    (hrelease : LowerSim.releaseResult before world fuel store value =
+      .ok released)
+    (hlive : released.live = 0) :
+    LowerSim.releaseResult after world fuel (Store.mapAddresses rename store)
+        value = .ok (Store.mapAddresses rename released) ∧
+      (Store.mapAddresses rename released).live = 0 := by
+  constructor
+  · cases world with
+    | shared =>
+        have hsource : dropVal before fuel store value = .ok released := by
+          simpa [LowerSim.releaseResult] using hrelease
+        simp only [LowerSim.releaseResult]
+        rw [(evalTransportAt hcontexts fuel).dropVal, hsource]
+        rfl
+    | unique =>
+        have hsource : dropUVal before fuel store value = .ok released := by
+          simpa [LowerSim.releaseResult] using hrelease
+        simp only [LowerSim.releaseResult]
+        rw [(evalTransportAt hcontexts fuel).dropUVal, hsource]
+        rfl
+  · simpa using hlive
+
+end Readdress
+
+namespace Optimizer.Outcome
+
+/-- A selected optimizer result inherits reclamation from one successful
+source run.  `hselected` exposes the exact rebuild only in the rebuilt branch;
+the skipped branch is literal source equality. -/
+theorem reclamation_of_witness
+    {outcome : Optimizer.Outcome} {policy : Optimizer.Policy}
+    {program : List ReaddressAll.Artifact} {summaries : HPT.SummaryEnv}
+    {main : Code} {oracle : Address → List RVal → Option RVal}
+    {world : Owned} {fuel : Nat} {sourceOut targetOut : Store × RVal}
+    (hselected : ∀ {result}, outcome.rebuilt = some result →
+      ∃ optimized,
+        HPT.OptimizeProgram.rebuildProgram policy.passes [] program summaries
+            main = .ok optimized ∧
+          optimized.result = result)
+    (hsource : runMain
+      (outcome.sourceCtx policy program summaries main oracle) main fuel =
+        .ok sourceOut)
+    (htarget : runMain (outcome.targetCtx program oracle)
+      (outcome.main main) fuel = .ok targetOut)
+    (hrefines : outcome.RunRefines policy program summaries main sourceOut
+      targetOut)
+    (hreclamation : LowerSim.Reclamation
+      (outcome.sourceCtx policy program summaries main oracle) main world) :
+    LowerSim.Reclamation (outcome.targetCtx program oracle)
+      (outcome.main main) world := by
+  intro runFuel runStore runValue hrun
+  have htargetRelease :
+      ∃ releaseFuel released,
+        LowerSim.releaseResult (outcome.targetCtx program oracle) world
+            releaseFuel targetOut.1 targetOut.2 = .ok released ∧
+          released.live = 0 := by
+    cases hrebuilt : outcome.rebuilt with
+    | none =>
+        have hout : targetOut = sourceOut := by
+          simpa [Optimizer.Outcome.RunRefines, hrebuilt] using hrefines
+        subst targetOut
+        simpa [Optimizer.Outcome.sourceCtx, Optimizer.Outcome.sourceOracle,
+          Optimizer.Outcome.targetCtx, Optimizer.Outcome.main, hrebuilt] using
+          hreclamation hsource
+    | some result =>
+        obtain ⟨optimized, hrebuild, hresult⟩ := hselected hrebuilt
+        subst result
+        obtain ⟨logicalOut, htargetOut, hhistory⟩ := by
+          simpa only [Optimizer.Outcome.RunRefines, hrebuilt] using hrefines
+        subst targetOut
+        obtain ⟨releaseFuel, released, hrelease, hlive⟩ :=
+          hreclamation hsource
+        obtain ⟨logicalReleased, hlogicalRelease, hlogicalLive⟩ :=
+          hhistory.releaseResult_live_eq_zero
+            (outcome.sourceCtx policy program summaries main oracle) world
+            hrelease hlive
+        have hrebuildRaw :=
+          HPT.OptimizeProgram.rebuild_of_rebuildProgram_eq_ok hrebuild
+        have haudit :=
+          ReaddressAll.rebuildSemanticAudit_of_rebuild_eq_ok hrebuildRaw
+        let entries := policy.rebuildEntries program summaries main
+        have hlogicalRelease' :
+            LowerSim.releaseResult
+                (optimized.result.rebuildSourceCtx entries oracle) world
+                releaseFuel logicalOut.1 logicalOut.2 =
+              .ok logicalReleased := by
+          rw [LowerSim.releaseResult_ctx_eq
+            (outcome.sourceCtx policy program summaries main oracle)
+            (optimized.result.rebuildSourceCtx entries oracle)]
+          exact hlogicalRelease
+        have hmapped := Readdress.releaseResult_mapAddresses
+          (optimized.result.renames_rebuildSourceCtx
+            (raw := entries)
+            (main := (HPT.OptimizeProgram.rewriteMain policy.passes
+              (HPT.programDeclEnv program) summaries main).code)
+            (by simpa [entries, Optimizer.Policy.rebuildEntries] using haudit)
+            oracle)
+          world hlogicalRelease' hlogicalLive
+        refine ⟨releaseFuel,
+          Readdress.Store.mapAddresses
+            (optimized.result.rebuildRename entries) logicalReleased, ?_, ?_⟩
+        · simpa [Optimizer.Outcome.targetCtx, Optimizer.Outcome.main,
+            hrebuilt, entries] using hmapped.1
+        · exact hmapped.2
+  have houtput : (runStore, runValue) = targetOut :=
+    LowerSim.runMain_success_unique hrun htarget
+  cases houtput
+  exact htargetRelease
+
+end Optimizer.Outcome
+
+namespace Optimizer
+
+/-- Directly produced checked HPT results preserve reclamation through the
+fail-soft optimizer selection. -/
+theorem reclamation_of_runWithProducedHPT_eq
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {limits : HPT.Limits} {production : HPT.Production limits program}
+    {outcome : Outcome}
+    (houtcome : runWithProducedHPT policy program main production = outcome)
+    (oracle : Address → List RVal → Option RVal) (world : Owned)
+    (hprogress : ∃ fuel sourceOut,
+      runMain
+        (outcome.sourceCtx policy program production.certificate.summaryEnv
+          main oracle)
+        main fuel = .ok sourceOut)
+    (hreclamation : LowerSim.Reclamation
+      (outcome.sourceCtx policy program production.certificate.summaryEnv
+        main oracle)
+      main world) :
+    LowerSim.Reclamation (outcome.targetCtx program oracle)
+      (outcome.main main) world := by
+  obtain ⟨fuel, sourceOut, hsource⟩ := hprogress
+  obtain ⟨targetOut, htarget, hrefines⟩ :=
+    runMain_of_runWithProducedHPT_eq houtcome oracle fuel hsource
+  exact outcome.reclamation_of_witness
+    (hselected := by
+      intro result hrebuilt
+      apply rebuilt_eq_some_of_runWithProducedHPT
+      rw [houtcome]
+      exact hrebuilt)
+    hsource htarget hrefines hreclamation
+
+/-- Cached checked HPT results expose the same reclamation contract. -/
+theorem reclamation_of_runWithCachedHPT_eq
+    {policy : Policy} {program : List ReaddressAll.Artifact} {main : Code}
+    {limits : HPT.Cache.Limits}
+    {production : HPT.Cache.Production limits program} {outcome : Outcome}
+    (houtcome : runWithCachedHPT policy program main production = outcome)
+    (oracle : Address → List RVal → Option RVal) (world : Owned)
+    (hprogress : ∃ fuel sourceOut,
+      runMain
+        (outcome.sourceCtx policy program production.certificate.summaryEnv
+          main oracle)
+        main fuel = .ok sourceOut)
+    (hreclamation : LowerSim.Reclamation
+      (outcome.sourceCtx policy program production.certificate.summaryEnv
+        main oracle)
+      main world) :
+    LowerSim.Reclamation (outcome.targetCtx program oracle)
+      (outcome.main main) world := by
+  obtain ⟨fuel, sourceOut, hsource⟩ := hprogress
+  obtain ⟨targetOut, htarget, hrefines⟩ :=
+    runMain_of_runWithCachedHPT_eq houtcome oracle fuel hsource
+  exact outcome.reclamation_of_witness
+    (hselected := by
+      intro result hrebuilt
+      apply rebuilt_eq_some_of_runWithCachedHPT
+      rw [houtcome]
+      exact hrebuilt)
+    hsource htarget hrefines hreclamation
+
+end Optimizer
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/Progress.lean b/Ix/Compiler/IxIR1/Progress.lean
new file mode 100644
index 000000000..2a4c1f6d9
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Progress.lean
@@ -0,0 +1,739 @@
+import Ix.Compiler.IxIR1.Sim
+import Ix.Compiler.IxIR1.Mono
+
+/-!
+# Progress foundations for the IxIR₁ evaluator
+
+The ownership development proves partial correctness: if an evaluator call
+succeeds, exact roots are conserved.  Progress also needs the complementary
+fact that well-owned states cannot take a dynamic memory-error branch.
+
+This file starts with the recursive release core.  At every fuel, a shared
+drop or unique deep free from its matching owned root either exhausts fuel or
+succeeds while consuming exactly that root.  In particular, no `.mem`,
+ordinary `.stuck`, or closed-world error is reachable inside the deep-release
+mutual recursion.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim
+
+/-- The only permitted failure in a progress approximation is fuel
+exhaustion. -/
+def SucceedsOrFuel {alpha : Type} (result : Except Err alpha) : Prop :=
+  result = .error .fuel ∨ ∃ value, result = .ok value
+
+/-- A finite evaluator observation that has genuinely settled without a
+memory-discipline failure or a closed-world lookup failure.  Unlike
+`SucceedsOrFuel`, this judgment still admits ordinary stuckness, but excludes
+fuel exhaustion, `Err.mem`, and `Err.unknownRef`.  The latter strengthening
+lets the source-guided call/extern contracts expose their closed-world
+content independently of the remaining projection-admissibility boundary. -/
+inductive SettlesWithoutMemory {alpha : Type} (result : Except Err alpha) :
+    Prop where
+  | success (value : alpha) (hrun : result = .ok value)
+  | stuck (message : String) (hrun : result = .error (.stuck message))
+
+private theorem bindOk {error alpha beta : Type} (value : alpha)
+    (next : alpha → Except error beta) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem bindErr {error alpha beta : Type} (err : error)
+    (next : alpha → Except error beta) :
+    ((Except.error err : Except error alpha) >>= next) = .error err := rfl
+
+/-! A proof-oriented count of live slots.  Unlike the public counter-facing
+`Store.live`, this recursive list presentation makes the strict decrease of
+`Store.kill` transparent to the termination argument below. -/
+
+private def liveSlotsList {alpha : Type} : List (Option alpha) → Nat
+  | [] => 0
+  | none :: rest => liveSlotsList rest
+  | some _ :: rest => liveSlotsList rest + 1
+
+private def Store.liveSlots (store : Store) : Nat :=
+  liveSlotsList store.nodes.toList
+
+private theorem liveSlotsList_set_none {alpha : Type} :
+    ∀ {values : List (Option alpha)} {index : Nat} {value : alpha},
+      values[index]? = some (some value) →
+      liveSlotsList (values.set index none) + 1 = liveSlotsList values
+  | [], index, value, hget => by simp at hget
+  | head :: tail, 0, value, hget => by
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at hget
+      subst head
+      simp [liveSlotsList]
+  | head :: tail, index + 1, value, hget => by
+      simp only [List.getElem?_cons_succ] at hget
+      have ih := liveSlotsList_set_none hget
+      cases head <;> simp [liveSlotsList] at ih ⊢ <;> omega
+
+private theorem liveSlotsList_set_some {alpha : Type} :
+    ∀ {values : List (Option alpha)} {index : Nat} {old new : alpha},
+      values[index]? = some (some old) →
+      liveSlotsList (values.set index (some new)) = liveSlotsList values
+  | [], index, old, new, hget => by simp at hget
+  | head :: tail, 0, old, new, hget => by
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at hget
+      subst head
+      simp [liveSlotsList]
+  | head :: tail, index + 1, old, new, hget => by
+      simp only [List.getElem?_cons_succ] at hget
+      have ih := liveSlotsList_set_some (new := new) hget
+      cases head <;> simp [liveSlotsList] at ih ⊢ <;> omega
+
+private theorem Store.liveSlots_rcTick (store : Store) :
+    store.rcTick.liveSlots = store.liveSlots := rfl
+
+private theorem Store.liveSlots_kill {store : Store} {loc : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    (store.kill loc).liveSlots + 1 = store.liveSlots := by
+  have hnodes := nodes_get?_of_get? hget
+  have hlist : store.nodes.toList[loc]? = some (some box) := by
+    simpa using hnodes
+  simp only [Store.liveSlots, Store.kill, Array.toList_set!]
+  exact liveSlotsList_set_none hlist
+
+private theorem Store.liveSlots_setBox {store : Store} {loc : Nat}
+    {old new : NodeBox} (hget : store.get? loc = some old) :
+    (store.setBox loc new).liveSlots = store.liveSlots := by
+  have hnodes := nodes_get?_of_get? hget
+  have hlist : store.nodes.toList[loc]? = some (some old) := by
+    simpa using hnodes
+  simp only [Store.liveSlots, Store.setBox, Array.toList_set!]
+  exact liveSlotsList_set_some hlist
+
+private theorem Store.liveSlots_decRcStore {store : Store} {loc : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    (decRcStore store loc box).liveSlots = store.liveSlots := by
+  unfold decRcStore
+  rw [Store.liveSlots_setBox]
+  · exact Store.liveSlots_rcTick store
+  · simpa using hget
+
+private def DropSafeAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ store value rest,
+    RootOwnership store (⟨.shared, value⟩ :: rest) →
+      dropVal ctx fuel store value = .error .fuel ∨
+        ∃ store', dropVal ctx fuel store value = .ok store' ∧
+          RootOwnership store' rest) ∧
+  (∀ store values rest,
+    RootOwnership store (rootsFor .shared values ++ rest) →
+      dropMany ctx fuel store values = .error .fuel ∨
+        ∃ store', dropMany ctx fuel store values = .ok store' ∧
+          RootOwnership store' rest)
+
+private def DropUSafeAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ store value rest,
+    RootOwnership store (⟨.unique, value⟩ :: rest) →
+      dropUVal ctx fuel store value = .error .fuel ∨
+        ∃ store', dropUVal ctx fuel store value = .ok store' ∧
+          RootOwnership store' rest) ∧
+  (∀ store values rest,
+    RootOwnership store (rootsFor .unique values ++ rest) →
+      dropManyU ctx fuel store values = .error .fuel ∨
+        ∃ store', dropManyU ctx fuel store values = .ok store' ∧
+          RootOwnership store' rest)
+
+private def DropSafetyAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  DropSafeAt ctx fuel ∧ DropUSafeAt ctx fuel
+
+/-- Shared and unique deep-release safety follow one evaluator-fuel
+traversal.  The owner-sensitive single-root cases remain separate, while the
+zero-fuel and sequential-release recursion are established together. -/
+private theorem dropSafetyAt (ctx : Ctx) : ∀ fuel, DropSafetyAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨⟨?_, ?_⟩, ⟨?_, ?_⟩⟩
+    · intro store value rest hown
+      left
+      simp [dropVal]
+    · intro store values rest hown
+      left
+      simp [dropMany]
+    · intro store value rest hown
+      left
+      simp [dropUVal]
+    · intro store values rest hown
+      left
+      simp [dropManyU]
+  | succ fuel ih =>
+    obtain ⟨⟨ihVal, ihMany⟩, ⟨ihUVal, ihManyU⟩⟩ := ih
+    refine ⟨⟨?_, ?_⟩, ⟨?_, ?_⟩⟩
+    · intro store value rest hown
+      cases value with
+      | lit literal =>
+        right
+        exact ⟨store, by simp [dropVal], hown.dropNoLocation rfl⟩
+      | erased =>
+        right
+        exact ⟨store, by simp [dropVal], hown.dropNoLocation rfl⟩
+      | loc loc =>
+        have hworld := hown.roots_world
+          (⟨.shared, .loc loc⟩ : Root) (by simp)
+        obtain ⟨box, hget, hboxWorld⟩ := hworld
+        cases box with
+        | mk world rc node =>
+          change world = .shared at hboxWorld
+          subst world
+          by_cases hrc : rc = 1
+          · subst rc
+            have htickGet :
+                store.rcTick.get? loc = some ⟨.shared, 1, node⟩ := by
+              simpa using hget
+            have hchildren : RootOwnership (store.rcTick.kill loc)
+                (rootsFor .shared (nodeChildren node) ++ rest) :=
+              (hown.rcTick).killSharedOne htickGet
+            cases node with
+            | ctorN cid fields =>
+              simpa [dropVal, hget] using
+                ihMany (store.rcTick.kill loc) fields.toList rest hchildren
+            | papN address arity args =>
+              simpa [dropVal, hget] using
+                ihMany (store.rcTick.kill loc) args.toList rest hchildren
+          · have hrcPos : 0 < rc := hown.shared_rc_pos hget
+            have hrcMany : 1 < rc := by omega
+            right
+            exact ⟨decRcStore store loc ⟨.shared, rc, node⟩,
+              dropVal_shared_many (ctx := ctx) (fuel := fuel)
+                hrcMany hget,
+              hown.dropSharedMany hrcMany hget⟩
+    · intro store values rest hown
+      cases values with
+      | nil =>
+        right
+        exact ⟨store, by simp [dropMany], by
+          simpa [rootsFor] using hown⟩
+      | cons value values =>
+        have hfirstOwn : RootOwnership store
+            (⟨.shared, value⟩ ::
+              (rootsFor .shared values ++ rest)) := by
+          simpa [rootsFor] using hown
+        rcases ihVal store value _ hfirstOwn with
+          hfirstFuel | ⟨middle, hfirst, hmiddle⟩
+        · left
+          rw [dropMany.eq_def]
+          dsimp only
+          rw [hfirstFuel, bindErr]
+        · rcases ihMany middle values rest hmiddle with
+            hrestFuel | ⟨store', hrest, hfinal⟩
+          · left
+            rw [dropMany.eq_def]
+            dsimp only
+            rw [hfirst, bindOk]
+            exact hrestFuel
+          · right
+            refine ⟨store', ?_, hfinal⟩
+            rw [dropMany.eq_def]
+            dsimp only
+            rw [hfirst, bindOk]
+            exact hrest
+    · intro store value rest hown
+      cases value with
+      | lit literal =>
+        right
+        exact ⟨store, by simp [dropUVal], hown.dropNoLocation rfl⟩
+      | erased =>
+        right
+        exact ⟨store, by simp [dropUVal], hown.dropNoLocation rfl⟩
+      | loc loc =>
+        have hworld := hown.roots_world
+          (⟨.unique, .loc loc⟩ : Root) (by simp)
+        obtain ⟨box, hget, hboxWorld⟩ := hworld
+        cases box with
+        | mk world rc node =>
+          change world = .unique at hboxWorld
+          subst world
+          have hrc : rc = 1 := (hown.counts hget).1
+          subst rc
+          cases node with
+          | ctorN cid fields =>
+            have hchildren : RootOwnership (store.kill loc)
+                (rootsFor .unique fields.toList ++ rest) :=
+              hown.killUniqueOne hget
+            simpa [dropUVal, hget] using
+              ihManyU (store.kill loc) fields.toList rest hchildren
+          | papN address arity args =>
+            have hshared : (Owned.unique : Owned) = .shared :=
+              hown.pap_shared hget rfl
+            contradiction
+    · intro store values rest hown
+      cases values with
+      | nil =>
+        right
+        exact ⟨store, by simp [dropManyU], by
+          simpa [rootsFor] using hown⟩
+      | cons value values =>
+        have hfirstOwn : RootOwnership store
+            (⟨.unique, value⟩ ::
+              (rootsFor .unique values ++ rest)) := by
+          simpa [rootsFor] using hown
+        rcases ihUVal store value _ hfirstOwn with
+          hfirstFuel | ⟨middle, hfirst, hmiddle⟩
+        · left
+          rw [dropManyU.eq_def]
+          dsimp only
+          rw [hfirstFuel, bindErr]
+        · rcases ihManyU middle values rest hmiddle with
+            hrestFuel | ⟨store', hrest, hfinal⟩
+          · left
+            rw [dropManyU.eq_def]
+            dsimp only
+            rw [hfirst, bindOk]
+            exact hrestFuel
+          · right
+            refine ⟨store', ?_, hfinal⟩
+            rw [dropManyU.eq_def]
+            dsimp only
+            rw [hfirst, bindOk]
+            exact hrest
+
+/-- A well-owned shared root can only succeed or exhaust fuel during deep
+release, and success consumes exactly that root. -/
+theorem dropVal_safe {ctx : Ctx} {fuel : Nat} {store : Store}
+    {value : RVal} {rest : List Root}
+    (hown : RootOwnership store (⟨.shared, value⟩ :: rest)) :
+    dropVal ctx fuel store value = .error .fuel ∨
+      ∃ store', dropVal ctx fuel store value = .ok store' ∧
+        RootOwnership store' rest :=
+  (dropSafetyAt ctx fuel).1.1 store value rest hown
+
+/-- Sequential shared release has the same fuel-or-success progress
+property. -/
+theorem dropMany_safe {ctx : Ctx} {fuel : Nat} {store : Store}
+    {values : List RVal} {rest : List Root}
+    (hown : RootOwnership store (rootsFor .shared values ++ rest)) :
+    dropMany ctx fuel store values = .error .fuel ∨
+      ∃ store', dropMany ctx fuel store values = .ok store' ∧
+        RootOwnership store' rest :=
+  (dropSafetyAt ctx fuel).1.2 store values rest hown
+
+/-- A well-owned unique root can only succeed or exhaust fuel during deep
+free, and success consumes exactly that root. -/
+theorem dropUVal_safe {ctx : Ctx} {fuel : Nat} {store : Store}
+    {value : RVal} {rest : List Root}
+    (hown : RootOwnership store (⟨.unique, value⟩ :: rest)) :
+    dropUVal ctx fuel store value = .error .fuel ∨
+      ∃ store', dropUVal ctx fuel store value = .ok store' ∧
+        RootOwnership store' rest :=
+  (dropSafetyAt ctx fuel).2.1 store value rest hown
+
+/-- Sequential unique deep free has the same fuel-or-success progress
+property. -/
+theorem dropManyU_safe {ctx : Ctx} {fuel : Nat} {store : Store}
+    {values : List RVal} {rest : List Root}
+    (hown : RootOwnership store (rootsFor .unique values ++ rest)) :
+    dropManyU ctx fuel store values = .error .fuel ∨
+      ∃ store', dropManyU ctx fuel store values = .ok store' ∧
+        RootOwnership store' rest :=
+  (dropSafetyAt ctx fuel).2.2 store values rest hown
+
+/-! ## Deep-release termination -/
+
+private def DropValProgressAt (ctx : Ctx) (store : Store) : Prop :=
+  ∀ value rest,
+    RootOwnership store (⟨.shared, value⟩ :: rest) →
+    ∃ fuel store',
+      dropVal ctx fuel store value = .ok store' ∧
+      RootOwnership store' rest ∧
+      store'.liveSlots ≤ store.liveSlots
+
+private def DropManyProgressAt (ctx : Ctx) (store : Store) : Prop :=
+  ∀ values rest,
+    RootOwnership store (rootsFor .shared values ++ rest) →
+    ∃ fuel store',
+      dropMany ctx fuel store values = .ok store' ∧
+      RootOwnership store' rest ∧
+      store'.liveSlots ≤ store.liveSlots
+
+/-- Unique single-root termination half of the combined deep-release
+judgment. -/
+private def DropUValProgressAt (ctx : Ctx) (store : Store) : Prop :=
+  ∀ value rest,
+    RootOwnership store (⟨.unique, value⟩ :: rest) →
+    ∃ fuel store',
+      dropUVal ctx fuel store value = .ok store' ∧
+      RootOwnership store' rest ∧
+      store'.liveSlots ≤ store.liveSlots
+
+/-- Unique sequential termination half of the combined deep-release
+judgment. -/
+private def DropManyUProgressAt (ctx : Ctx) (store : Store) : Prop :=
+  ∀ values rest,
+    RootOwnership store (rootsFor .unique values ++ rest) →
+    ∃ fuel store',
+      dropManyU ctx fuel store values = .ok store' ∧
+      RootOwnership store' rest ∧
+      store'.liveSlots ≤ store.liveSlots
+
+private def DropProgressAt (ctx : Ctx) (store : Store) : Prop :=
+  (DropValProgressAt ctx store ∧ DropManyProgressAt ctx store) ∧
+    (DropUValProgressAt ctx store ∧ DropManyUProgressAt ctx store)
+
+/-- Shared and unique deep-release termination use one strong induction on
+the number of live heap slots.  Each owner keeps its local destruction rule;
+recursive child release and sequential fuel synchronization share the same
+well-founded traversal. -/
+private theorem dropProgressAt (ctx : Ctx) : ∀ live store,
+    store.liveSlots = live →
+    DropProgressAt ctx store := by
+  intro live
+  induction live using Nat.strongRecOn with
+  | ind live ih =>
+    have hval : ∀ store, store.liveSlots = live →
+        DropValProgressAt ctx store := by
+      intro store hlive value rest hown
+      cases value with
+      | lit literal =>
+        exact ⟨1, store, by simp [dropVal],
+          hown.dropNoLocation rfl, Nat.le_refl _⟩
+      | erased =>
+        exact ⟨1, store, by simp [dropVal],
+          hown.dropNoLocation rfl, Nat.le_refl _⟩
+      | loc loc =>
+        have hworld := hown.roots_world
+          (⟨.shared, .loc loc⟩ : Root) (by simp)
+        obtain ⟨box, hget, hboxWorld⟩ := hworld
+        cases box with
+        | mk world rc node =>
+          change world = .shared at hboxWorld
+          subst world
+          by_cases hrc : rc = 1
+          · subst rc
+            have htickGet :
+                store.rcTick.get? loc = some ⟨.shared, 1, node⟩ := by
+              simpa using hget
+            let killed := store.rcTick.kill loc
+            have hkilledOwn : RootOwnership killed
+                (rootsFor .shared (nodeChildren node) ++ rest) := by
+              dsimp only [killed]
+              exact (hown.rcTick).killSharedOne htickGet
+            have hkilledEq : killed.liveSlots + 1 = live := by
+              have hk : killed.liveSlots + 1 = store.liveSlots := by
+                dsimp only [killed]
+                have hkill := Store.liveSlots_kill htickGet
+                rw [Store.liveSlots_rcTick] at hkill
+                exact hkill
+              exact hk.trans hlive
+            have hkilledLt : killed.liveSlots < live := by omega
+            have hsmall := ih killed.liveSlots hkilledLt killed rfl
+            cases node with
+            | ctorN cid fields =>
+              obtain ⟨fuel, store', hrun, hown', hslots⟩ :=
+                hsmall.1.2 fields.toList rest (by
+                  simpa [nodeChildren] using hkilledOwn)
+              refine ⟨fuel + 1, store', ?_, hown', ?_⟩
+              · simpa [dropVal, hget] using hrun
+              · exact Nat.le_trans hslots (by omega)
+            | papN address arity args =>
+              obtain ⟨fuel, store', hrun, hown', hslots⟩ :=
+                hsmall.1.2 args.toList rest (by
+                  simpa [nodeChildren] using hkilledOwn)
+              refine ⟨fuel + 1, store', ?_, hown', ?_⟩
+              · simpa [dropVal, hget] using hrun
+              · exact Nat.le_trans hslots (by omega)
+          · have hrcPos : 0 < rc := hown.shared_rc_pos hget
+            have hrcMany : 1 < rc := by omega
+            let store' := decRcStore store loc ⟨.shared, rc, node⟩
+            refine ⟨1, store', ?_, ?_, ?_⟩
+            · exact dropVal_shared_many (ctx := ctx) (fuel := 0)
+                hrcMany hget
+            · exact hown.dropSharedMany hrcMany hget
+            · exact Nat.le_of_eq (Store.liveSlots_decRcStore hget)
+    have hvalLe : ∀ store, store.liveSlots ≤ live →
+        DropValProgressAt ctx store := by
+      intro store hle
+      rcases Nat.eq_or_lt_of_le hle with heq | hlt
+      · exact hval store heq
+      · exact (ih store.liveSlots hlt store rfl).1.1
+    have hmanyLe : ∀ values store rest,
+        store.liveSlots ≤ live →
+        RootOwnership store (rootsFor .shared values ++ rest) →
+        ∃ fuel store',
+          dropMany ctx fuel store values = .ok store' ∧
+          RootOwnership store' rest ∧
+          store'.liveSlots ≤ store.liveSlots := by
+      intro values
+      induction values with
+      | nil =>
+        intro store rest hle hown
+        exact ⟨1, store, by simp [dropMany], by
+          simpa [rootsFor] using hown, Nat.le_refl _⟩
+      | cons value values ihValues =>
+        intro store rest hle hown
+        have hfirstOwn : RootOwnership store
+            (⟨.shared, value⟩ ::
+              (rootsFor .shared values ++ rest)) := by
+          simpa [rootsFor] using hown
+        obtain ⟨firstFuel, middle, hfirst, hmiddle, hmiddleSlots⟩ :=
+          hvalLe store hle value _ hfirstOwn
+        obtain ⟨restFuel, store', hrest, hfinal, hfinalSlots⟩ :=
+          ihValues middle rest (Nat.le_trans hmiddleSlots hle) hmiddle
+        let common := max firstFuel restFuel
+        have hfirst' : dropVal ctx common store value = .ok middle :=
+          dropVal_mono (Nat.le_max_left _ _) hfirst
+        have hrest' : dropMany ctx common middle values = .ok store' :=
+          dropMany_mono (Nat.le_max_right _ _) hrest
+        refine ⟨common + 1, store', ?_, hfinal,
+          Nat.le_trans hfinalSlots hmiddleSlots⟩
+        rw [dropMany.eq_def]
+        dsimp only
+        rw [hfirst', bindOk]
+        exact hrest'
+    have hshared : ∀ store, store.liveSlots = live →
+        DropValProgressAt ctx store ∧ DropManyProgressAt ctx store := by
+      intro store hlive
+      exact ⟨hval store hlive, fun values rest hown =>
+        hmanyLe values store rest (by omega) hown⟩
+    have huval : ∀ store, store.liveSlots = live →
+        DropUValProgressAt ctx store := by
+      intro store hlive value rest hown
+      cases value with
+      | lit literal =>
+        exact ⟨1, store, by simp [dropUVal],
+          hown.dropNoLocation rfl, Nat.le_refl _⟩
+      | erased =>
+        exact ⟨1, store, by simp [dropUVal],
+          hown.dropNoLocation rfl, Nat.le_refl _⟩
+      | loc loc =>
+        have hworld := hown.roots_world
+          (⟨.unique, .loc loc⟩ : Root) (by simp)
+        obtain ⟨box, hget, hboxWorld⟩ := hworld
+        cases box with
+        | mk world rc node =>
+          change world = .unique at hboxWorld
+          subst world
+          have hrc : rc = 1 := (hown.counts hget).1
+          subst rc
+          cases node with
+          | ctorN cid fields =>
+            let killed := store.kill loc
+            have hkilledOwn : RootOwnership killed
+                (rootsFor .unique fields.toList ++ rest) := by
+              dsimp only [killed]
+              simpa [nodeChildren] using hown.killUniqueOne hget
+            have hkilledEq : killed.liveSlots + 1 = live := by
+              have hk : killed.liveSlots + 1 = store.liveSlots := by
+                dsimp only [killed]
+                exact Store.liveSlots_kill hget
+              exact hk.trans hlive
+            have hkilledLt : killed.liveSlots < live := by omega
+            have hsmall := ih killed.liveSlots hkilledLt killed rfl
+            obtain ⟨fuel, store', hrun, hown', hslots⟩ :=
+              hsmall.2.2 fields.toList rest hkilledOwn
+            refine ⟨fuel + 1, store', ?_, hown', ?_⟩
+            · simpa [dropUVal, hget] using hrun
+            · exact Nat.le_trans hslots (by omega)
+          | papN address arity args =>
+            have hshared : (Owned.unique : Owned) = .shared :=
+              hown.pap_shared hget rfl
+            contradiction
+    have huvalLe : ∀ store, store.liveSlots ≤ live →
+        DropUValProgressAt ctx store := by
+      intro store hle
+      rcases Nat.eq_or_lt_of_le hle with heq | hlt
+      · exact huval store heq
+      · exact (ih store.liveSlots hlt store rfl).2.1
+    have hmanyULe : ∀ values store rest,
+        store.liveSlots ≤ live →
+        RootOwnership store (rootsFor .unique values ++ rest) →
+        ∃ fuel store',
+          dropManyU ctx fuel store values = .ok store' ∧
+          RootOwnership store' rest ∧
+          store'.liveSlots ≤ store.liveSlots := by
+      intro values
+      induction values with
+      | nil =>
+        intro store rest hle hown
+        exact ⟨1, store, by simp [dropManyU], by
+          simpa [rootsFor] using hown, Nat.le_refl _⟩
+      | cons value values ihValues =>
+        intro store rest hle hown
+        have hfirstOwn : RootOwnership store
+            (⟨.unique, value⟩ ::
+              (rootsFor .unique values ++ rest)) := by
+          simpa [rootsFor] using hown
+        obtain ⟨firstFuel, middle, hfirst, hmiddle, hmiddleSlots⟩ :=
+          huvalLe store hle value _ hfirstOwn
+        obtain ⟨restFuel, store', hrest, hfinal, hfinalSlots⟩ :=
+          ihValues middle rest (Nat.le_trans hmiddleSlots hle) hmiddle
+        let common := max firstFuel restFuel
+        have hfirst' : dropUVal ctx common store value = .ok middle :=
+          dropUVal_mono (Nat.le_max_left _ _) hfirst
+        have hrest' : dropManyU ctx common middle values = .ok store' :=
+          dropManyU_mono (Nat.le_max_right _ _) hrest
+        refine ⟨common + 1, store', ?_, hfinal,
+          Nat.le_trans hfinalSlots hmiddleSlots⟩
+        rw [dropManyU.eq_def]
+        dsimp only
+        rw [hfirst', bindOk]
+        exact hrest'
+    intro store hlive
+    exact ⟨hshared store hlive,
+      ⟨huval store hlive, fun values rest hown =>
+        hmanyULe values store rest (by omega) hown⟩⟩
+
+/-- Every well-owned shared root has some successful deep-release fuel. -/
+theorem dropVal_progress {ctx : Ctx} {store : Store} {value : RVal}
+    {rest : List Root}
+    (hown : RootOwnership store (⟨.shared, value⟩ :: rest)) :
+    ∃ fuel store', dropVal ctx fuel store value = .ok store' ∧
+      RootOwnership store' rest := by
+  obtain ⟨fuel, store', hrun, hown', _⟩ :=
+    (dropProgressAt ctx store.liveSlots store rfl).1.1 value rest hown
+  exact ⟨fuel, store', hrun, hown'⟩
+
+/-- Every well-owned vector of shared roots has some successful sequential
+release fuel. -/
+theorem dropMany_progress {ctx : Ctx} {store : Store}
+    {values : List RVal} {rest : List Root}
+    (hown : RootOwnership store (rootsFor .shared values ++ rest)) :
+    ∃ fuel store', dropMany ctx fuel store values = .ok store' ∧
+      RootOwnership store' rest := by
+  obtain ⟨fuel, store', hrun, hown', _⟩ :=
+    (dropProgressAt ctx store.liveSlots store rfl).1.2 values rest hown
+  exact ⟨fuel, store', hrun, hown'⟩
+
+/-- Every well-owned unique root has some successful deep-free fuel. -/
+theorem dropUVal_progress {ctx : Ctx} {store : Store} {value : RVal}
+    {rest : List Root}
+    (hown : RootOwnership store (⟨.unique, value⟩ :: rest)) :
+    ∃ fuel store', dropUVal ctx fuel store value = .ok store' ∧
+      RootOwnership store' rest := by
+  obtain ⟨fuel, store', hrun, hown', _⟩ :=
+    (dropProgressAt ctx store.liveSlots store rfl).2.1 value rest hown
+  exact ⟨fuel, store', hrun, hown'⟩
+
+/-- Every well-owned vector of unique roots has some successful sequential
+deep-free fuel. -/
+theorem dropManyU_progress {ctx : Ctx} {store : Store}
+    {values : List RVal} {rest : List Root}
+    (hown : RootOwnership store (rootsFor .unique values ++ rest)) :
+    ∃ fuel store', dropManyU ctx fuel store values = .ok store' ∧
+      RootOwnership store' rest := by
+  obtain ⟨fuel, store', hrun, hown', _⟩ :=
+    (dropProgressAt ctx store.liveSlots store rfl).2.2 values rest hown
+  exact ⟨fuel, store', hrun, hown'⟩
+
+/-! ## Callable progress contracts -/
+
+/-- Successful body execution exists for every well-owned argument frame.
+This is the total-correctness companion of `FnOwnershipContract`; keeping the
+two contracts separate lets the established ownership development remain a
+reusable partial-correctness layer. -/
+structure FnProgressContract (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  progresses : ∀ {store : Store} {args : List RVal} {rest : List Root},
+    args.length = argWorlds.length →
+    RootOwnership store (rootsForWorlds argWorlds args ++ rest) →
+    ∃ fuel store' value,
+      runCode ctx fuel d store args.reverse d.body = .ok (store', value)
+
+/-- Entering a known function terminates when its body has a progress
+contract.  The existing ownership contract proves the constructed body
+result passes the evaluator's dynamic result-world check. -/
+theorem invoke_fn_progress {ctx : Ctx} {address : Ixon.Address}
+    {d : FnDef} {argWorlds : List Owned} {args : List RVal}
+    {store : Store} {rest : List Root}
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnProgressContract ctx d argWorlds)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hlength : args.length = argWorlds.length)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      invoke ctx fuel address args store = .ok (store', value) := by
+  obtain ⟨bodyFuel, store', value, hbody⟩ :=
+    hprogress.progresses hlength hown
+  have hout : RootOwnership store' (⟨d.result, value⟩ :: rest) :=
+    hownership.preserves hlength hown hbody
+  have hworld : HasWorld store' d.result value :=
+    hout.roots_world ⟨d.result, value⟩ (by simp)
+  have hcheck : checkResultWorld d.result (store', value) =
+      .ok (store', value) := by
+    simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+  have harity : args.length = d.arity :=
+    hlength.trans hprogress.arity_eq
+  refine ⟨bodyFuel + 1, store', value, ?_⟩
+  rw [invoke.eq_def]
+  dsimp only
+  rw [hdecl]
+  dsimp only
+  simp only [harity]
+  simp
+  rw [hbody, bindOk]
+  exact hcheck
+
+/-- Operation-level direct-call progress, with exact result ownership ready
+for the caller continuation. -/
+theorem runOp_call_progress {ctx : Ctx} {cur d : FnDef}
+    {address : Ixon.Address} {atoms : Array Atom} {args : List RVal}
+    {argWorlds : List Owned} {store : Store} {env : List RVal}
+    {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls address = some (.fn d))
+    (hprogress : FnProgressContract ctx d argWorlds)
+    (hownership : FnOwnershipContract ctx d argWorlds)
+    (hlength : args.length = argWorlds.length)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.call address atoms) =
+          .ok (store', value) ∧
+        RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  obtain ⟨invokeFuel, store', value, hinvoke⟩ :=
+    invoke_fn_progress hdecl hprogress hownership hlength hown
+  have hrun : runOp ctx (invokeFuel + 1) cur store env
+      (.call address atoms) = .ok (store', value) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hargs, bindOk]
+    exact hinvoke
+  refine ⟨invokeFuel + 1, store', value, hrun, ?_⟩
+  exact runOp_call_owned (fuel := invokeFuel) hargs hdecl hownership
+    hown hrun
+
+/-- Recursive self-call progress.  The progress contract supplies a body
+run; its ownership twin proves that run passes `checkResultWorld`. -/
+theorem runOp_callSelf_progress {ctx : Ctx} {cur : FnDef}
+    {atoms : Array Atom} {args : List RVal}
+    {argWorlds : List Owned} {store : Store} {env : List RVal}
+    {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hprogress : FnProgressContract ctx cur argWorlds)
+    (hownership : FnOwnershipContract ctx cur argWorlds)
+    (hlength : args.length = argWorlds.length)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest)) :
+    ∃ fuel store' value,
+      runOp ctx fuel cur store env (.callSelf atoms) =
+          .ok (store', value) ∧
+        RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  obtain ⟨bodyFuel, store', value, hbody⟩ :=
+    hprogress.progresses hlength hown
+  have hout : RootOwnership store'
+      (⟨cur.result, value⟩ :: rest) :=
+    hownership.preserves hlength hown hbody
+  have hworld : HasWorld store' cur.result value :=
+    hout.roots_world ⟨cur.result, value⟩ (by simp)
+  have hcheck : checkResultWorld cur.result (store', value) =
+      .ok (store', value) := by
+    simp [checkResultWorld, rval_hasWorld_eq_true_iff.mpr hworld]
+  have harity : args.length = cur.arity :=
+    hlength.trans hprogress.arity_eq
+  have hrun : runOp ctx (bodyFuel + 1) cur store env
+      (.callSelf atoms) = .ok (store', value) := by
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hargs, bindOk]
+    simp only [harity]
+    simp
+    rw [hbody, bindOk]
+    exact hcheck
+  exact ⟨bodyFuel + 1, store', value, hrun, hout⟩
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/RcPotential.lean b/Ix/Compiler/IxIR1/RcPotential.lean
new file mode 100644
index 000000000..97b2bd9e7
--- /dev/null
+++ b/Ix/Compiler/IxIR1/RcPotential.lean
@@ -0,0 +1,195 @@
+import Ix.Compiler.IxIR1.Sim
+
+namespace Ix.Compiler.IxIR1.CostTrace
+
+/-! ## Reference-count potential
+
+Raw reference-count traffic is not locally compositional across deep drop:
+one source-level release may recursively visit an arbitrarily large heap.
+The missing state is the outstanding shared reference-count mass.  Each
+successful shared `drop` trades exactly one unit of that potential for one
+executed RC instruction, while a retain creates one unit and executes one RC
+instruction.  This makes deep release free in the amortized measure and
+explains the tariff's factor of two for retained values. -/
+
+def slotSharedRcPotential : Option NodeBox → Nat
+  | some ⟨.shared, rc, _⟩ => rc
+  | some ⟨.unique, _, _⟩ | none => 0
+
+def sharedRcPotentialList : List (Option NodeBox) → Nat
+  | [] => 0
+  | slot :: rest => slotSharedRcPotential slot + sharedRcPotentialList rest
+
+theorem sharedRcPotentialList_append (left right) :
+    sharedRcPotentialList (left ++ right) =
+      sharedRcPotentialList left + sharedRcPotentialList right := by
+  induction left with
+  | nil => simp [sharedRcPotentialList]
+  | cons head tail ih =>
+      simp [sharedRcPotentialList, ih, Nat.add_assoc]
+
+/-- Sum of the reference counts in all live shared heap slots. -/
+def sharedRcPotential (store : Store) : Nat :=
+  sharedRcPotentialList store.nodes.toList
+
+@[simp] theorem sharedRcPotential_rcTick (store : Store) :
+    sharedRcPotential store.rcTick = sharedRcPotential store := rfl
+
+/-- Executed RC instructions plus the shared ownership they leave pending. -/
+def amortizedRc (store : Store) : Nat :=
+  store.rcops + sharedRcPotential store
+
+/-- Growth of the RC potential across a target-store transition. -/
+def RcPotentialGrowthLE (before after : Store) (allowance : Nat) : Prop :=
+  amortizedRc after ≤ amortizedRc before + allowance
+
+theorem RcPotentialGrowthLE.refl (store : Store) :
+    RcPotentialGrowthLE store store 0 := by
+  simp [RcPotentialGrowthLE]
+
+theorem RcPotentialGrowthLE.trans {first middle last : Store} {left right}
+    (hleft : RcPotentialGrowthLE first middle left)
+    (hright : RcPotentialGrowthLE middle last right) :
+    RcPotentialGrowthLE first last (left + right) := by
+  simp only [RcPotentialGrowthLE] at hleft hright ⊢
+  omega
+
+theorem RcPotentialGrowthLE.monoAllowance {before after : Store}
+    {smaller larger : Nat} (h : RcPotentialGrowthLE before after smaller)
+    (hle : smaller ≤ larger) :
+    RcPotentialGrowthLE before after larger := by
+  simp only [RcPotentialGrowthLE] at h ⊢
+  omega
+
+/-- A potential bound started from an empty heap is an ordinary bound on
+executed RC instructions. -/
+theorem RcPotentialGrowthLE.rcops_of_initial_zero
+    {before after : Store} {allowance : Nat}
+    (hgrowth : RcPotentialGrowthLE before after allowance)
+    (hpotential : sharedRcPotential before = 0) :
+    after.rcops ≤ before.rcops + allowance := by
+  simp only [RcPotentialGrowthLE, amortizedRc, hpotential, Nat.add_zero]
+    at hgrowth
+  omega
+
+theorem sharedRcPotentialList_set :
+    ∀ {slots : List (Option NodeBox)} {index : Nat} {old new},
+      slots[index]? = some old →
+      sharedRcPotentialList (slots.set index new) +
+          slotSharedRcPotential old =
+        sharedRcPotentialList slots + slotSharedRcPotential new
+  | [], index, old, new, hget => by simp at hget
+  | head :: rest, 0, old, new, hget => by
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at hget
+      subst head
+      simp [sharedRcPotentialList]
+      omega
+  | head :: rest, index + 1, old, new, hget => by
+      simp only [List.getElem?_cons_succ] at hget
+      have ih := sharedRcPotentialList_set (new := new) hget
+      simp only [List.set, sharedRcPotentialList]
+      omega
+
+theorem sharedRcPotential_setBox {store : Store} {location : Nat}
+    {old new : NodeBox} (hget : store.get? location = some old) :
+    sharedRcPotential (store.setBox location new) +
+        slotSharedRcPotential (some old) =
+      sharedRcPotential store + slotSharedRcPotential (some new) := by
+  have hnodes := Sim.nodes_get?_of_get? hget
+  have hlist : store.nodes.toList[location]? = some (some old) := by
+    simpa using hnodes
+  simp only [sharedRcPotential, Store.setBox, Array.toList_set!]
+  exact sharedRcPotentialList_set hlist
+
+theorem sharedRcPotential_kill {store : Store} {location : Nat}
+    {box : NodeBox} (hget : store.get? location = some box) :
+    sharedRcPotential (store.kill location) +
+        slotSharedRcPotential (some box) = sharedRcPotential store := by
+  have hnodes := Sim.nodes_get?_of_get? hget
+  have hlist : store.nodes.toList[location]? = some (some box) := by
+    simpa using hnodes
+  have hset := sharedRcPotentialList_set
+    (new := none) hlist
+  simpa [sharedRcPotential, Store.kill, Array.toList_set!,
+    slotSharedRcPotential] using hset
+
+theorem RcPotentialGrowthLE.allocNode (store : Store)
+    (world : Ixon.Owned) (node : Node) :
+    RcPotentialGrowthLE store (store.allocNode world node).1 1 := by
+  cases world <;>
+    simp [RcPotentialGrowthLE, amortizedRc, sharedRcPotential,
+      sharedRcPotentialList_append, sharedRcPotentialList,
+      slotSharedRcPotential, Store.allocNode] <;>
+    omega
+
+theorem amortizedRc_incRcStore {store : Store} {location rc : Nat}
+    {node : Node}
+    (hget : store.get? location = some ⟨.shared, rc, node⟩) :
+    amortizedRc
+        (Sim.incRcStore store location ⟨.shared, rc, node⟩) =
+      amortizedRc store + 2 := by
+  have hset := sharedRcPotential_setBox
+    (new := (⟨.shared, rc + 1, node⟩ : NodeBox))
+    (by simpa using hget)
+  simp [slotSharedRcPotential] at hset
+  simp only [Sim.incRcStore, amortizedRc, sharedRcPotential_rcTick]
+  change store.rcops + 1 +
+      sharedRcPotential
+        (store.setBox location ⟨.shared, rc + 1, node⟩) =
+    store.rcops + sharedRcPotential store + 2
+  omega
+
+theorem amortizedRc_tickKillSharedOne {store : Store}
+    {location : Nat} {node : Node}
+    (hget : store.get? location = some ⟨.shared, 1, node⟩) :
+    amortizedRc (store.rcTick.kill location) = amortizedRc store := by
+  have hgetTick :
+      store.rcTick.get? location = some ⟨.shared, 1, node⟩ := by
+    simpa using hget
+  have hkill := sharedRcPotential_kill hgetTick
+  have hpotential :
+      sharedRcPotential (store.rcTick.kill location) + 1 =
+        sharedRcPotential store := by
+    simpa [slotSharedRcPotential] using hkill
+  change store.rcops + 1 +
+      sharedRcPotential (store.rcTick.kill location) =
+    store.rcops + sharedRcPotential store
+  omega
+
+theorem amortizedRc_decRcStore {store : Store} {location rc : Nat}
+    {node : Node} (hrc : 1 < rc)
+    (hget : store.get? location = some ⟨.shared, rc, node⟩) :
+    amortizedRc
+        (Sim.decRcStore store location ⟨.shared, rc, node⟩) =
+      amortizedRc store := by
+  have hgetTick :
+      store.rcTick.get? location = some ⟨.shared, rc, node⟩ := by
+    simpa using hget
+  have hset := sharedRcPotential_setBox
+    (new := (⟨.shared, rc - 1, node⟩ : NodeBox)) hgetTick
+  have hpotential :
+      sharedRcPotential
+          (Sim.decRcStore store location ⟨.shared, rc, node⟩) + 1 =
+        sharedRcPotential store := by
+    simp only [Sim.decRcStore]
+    simp [slotSharedRcPotential] at hset
+    omega
+  change store.rcops + 1 +
+      sharedRcPotential
+        (Sim.decRcStore store location ⟨.shared, rc, node⟩) =
+    store.rcops + sharedRcPotential store
+  omega
+
+theorem amortizedRc_killUnique {store : Store} {location rc : Nat}
+    {node : Node}
+    (hget : store.get? location = some ⟨.unique, rc, node⟩) :
+    amortizedRc (store.kill location) = amortizedRc store := by
+  have hkill := sharedRcPotential_kill hget
+  have hpotential : sharedRcPotential (store.kill location) =
+      sharedRcPotential store := by
+    simpa [slotSharedRcPotential] using hkill
+  unfold amortizedRc
+  rw [hpotential]
+  rfl
+
+end Ix.Compiler.IxIR1.CostTrace
diff --git a/Ix/Compiler/IxIR1/Reachability.lean b/Ix/Compiler/IxIR1/Reachability.lean
new file mode 100644
index 000000000..f3d8cba02
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Reachability.lean
@@ -0,0 +1,731 @@
+import Ix.Compiler.IxIR1.EvalRewrite
+import Ix.Compiler.IxIR1.Serialize
+
+/-!
+# Checked rooted declaration reachability
+
+This pass removes declarations which cannot be reached from top-level main or
+an explicitly exported root.  A certificate is checked against an exact graph
+digest, root list, canonical retained list, and successor closure.
+
+Dynamic `apply` is deliberately conservative in version 1.  If it occurs in
+main or a retained declaration, the checker accepts only the complete
+declaration set.  Otherwise every executable declaration lookup is named by a
+direct `call` or `papp`, and the exact evaluator proof below transports a run
+through the filtered environment.  `callSelf` stays within its already
+retained owner; constructor identities and direct oracle calls do not perform
+declaration lookup.
+-/
+
+namespace Ix.Compiler.IxIR1.Reachability
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR
+open Ix.Compiler.IxIR1.Sim
+
+def currentVersion : Nat := 1
+
+/-! ## Executable edge and safety walks -/
+
+namespace Op
+
+/-- Declaration keys which this operation can look up without inspecting a
+runtime value. -/
+def targets : Ix.Compiler.IxIR1.Op → List Address
+  | .call function _ | .papp function _ => [function]
+  | _ => []
+
+def hasApply : Ix.Compiler.IxIR1.Op → Bool
+  | .apply _ _ => true
+  | _ => false
+
+/-- Version-1 safety: dynamic application requires the all-retained fallback;
+direct calls and PAP creation must point outside the declaration domain or to
+a retained declaration. -/
+def safe (keys retained : List Address) : Ix.Compiler.IxIR1.Op → Bool
+  | .call function _ | .papp function _ =>
+      !keys.contains function || retained.contains function
+  | .apply _ _ => false
+  | _ => true
+
+end Op
+
+mutual
+
+def Code.targets : Code → List Address
+  | .ret _ => []
+  | .letOp operation rest => Op.targets operation ++ Code.targets rest
+  | .case _ _ alternatives => AltList.targets alternatives.toList
+
+def Alt.targets : Alt → List Address
+  | .mk _ _ body => Code.targets body
+
+def AltList.targets : List Alt → List Address
+  | [] => []
+  | alternative :: rest => Alt.targets alternative ++ AltList.targets rest
+
+end
+
+mutual
+
+def Code.hasApply : Code → Bool
+  | .ret _ => false
+  | .letOp operation rest => Op.hasApply operation || Code.hasApply rest
+  | .case _ _ alternatives => AltList.hasApply alternatives.toList
+
+def Alt.hasApply : Alt → Bool
+  | .mk _ _ body => Code.hasApply body
+
+def AltList.hasApply : List Alt → Bool
+  | [] => false
+  | alternative :: rest =>
+      Alt.hasApply alternative || AltList.hasApply rest
+
+end
+
+mutual
+
+def Code.safe (keys retained : List Address) : Code → Bool
+  | .ret _ => true
+  | .letOp operation rest =>
+      Op.safe keys retained operation && Code.safe keys retained rest
+  | .case _ _ alternatives =>
+      AltList.safe keys retained alternatives.toList
+
+def Alt.safe (keys retained : List Address) : Alt → Bool
+  | .mk _ _ body => Code.safe keys retained body
+
+def AltList.safe (keys retained : List Address) : List Alt → Bool
+  | [] => true
+  | alternative :: rest =>
+      Alt.safe keys retained alternative && AltList.safe keys retained rest
+
+end
+
+namespace Decl
+
+def safe (keys retained : List Address) : Decl → Bool
+  | .extern _ => true
+  | .fn function => Code.safe keys retained function.body
+
+end Decl
+
+/-! ## Certificate and deterministic producer -/
+
+private def entryBytes (entry : Address × Decl) : ByteArray :=
+  Encoding.address entry.1 ++ Encoding.blob entry.2.preimage
+
+private def inputDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/reachability-input/1" ++ Encoding.tag 0
+
+/-- Exact digest of the old-keyed declaration rows and main code checked by a
+reachability certificate. -/
+def inputRoot (entries : List (Address × Decl)) (main : Code) : Address :=
+  Address.blake3
+    (inputDomain ++ Encoding.list entryBytes entries ++
+      Encoding.blob main.bytes)
+
+structure Certificate where
+  version : Nat := currentVersion
+  inputRoot : Address
+  roots : List Address
+  retained : List Address
+  deriving BEq, Repr
+
+private def keysOf (entries : List (Address × Decl)) : List Address :=
+  entries.map (fun entry => entry.1)
+
+private def canonicalRetained (keys retained : List Address) : Bool :=
+  retained == keys.filter retained.contains
+
+private def allRetained (keys retained : List Address) : Bool :=
+  keys.all retained.contains
+
+private def rootsRetained (keys retained roots : List Address) : Bool :=
+  roots.all fun root => keys.contains root && retained.contains root
+
+private def retainedDeclarationsSafe (keys retained : List Address)
+    (entries : List (Address × Decl)) : Bool :=
+  entries.all fun entry =>
+    !retained.contains entry.1 || Decl.safe keys retained entry.2
+
+/-- Executable certificate checker.  A complete retained set is always safe.
+Any proper subset must be statically closed and contain no dynamic `apply` in
+main or a retained function. -/
+def validate (entries : List (Address × Decl)) (main : Code)
+    (expectedRoots : List Address) (certificate : Certificate) : Bool :=
+  let keys := keysOf entries
+  certificate.version == currentVersion &&
+    certificate.inputRoot == inputRoot entries main &&
+    certificate.roots == expectedRoots &&
+    canonicalRetained keys certificate.retained &&
+    rootsRetained keys certificate.retained expectedRoots &&
+    (allRetained keys certificate.retained ||
+      (Code.safe keys certificate.retained main &&
+        retainedDeclarationsSafe keys certificate.retained entries))
+
+private def pushNew (known : List Address) (address : Address) : List Address :=
+  if known.contains address then known else known ++ [address]
+
+private def addTargets (keys : List Address) (known : List Address)
+    (targets : List Address) : List Address :=
+  targets.foldl (fun result target =>
+    if keys.contains target then pushNew result target else result) known
+
+private def closureStep (keys : List Address)
+    (entries : List (Address × Decl)) (known : List Address) : List Address :=
+  entries.foldl (fun result entry =>
+    if result.contains entry.1 then
+      match entry.2 with
+      | .extern _ => result
+      | .fn function => addTargets keys result (Code.targets function.body)
+    else
+      result) known
+
+private def close (keys : List Address) (entries : List (Address × Decl)) :
+    Nat → List Address → List Address
+  | 0, known => known
+  | fuel + 1, known => close keys entries fuel (closureStep keys entries known)
+
+private def selectedHasApply (retained : List Address)
+    (entries : List (Address × Decl)) : Bool :=
+  entries.any fun entry =>
+    retained.contains entry.1 &&
+      match entry.2 with
+      | .extern _ => false
+      | .fn function => Code.hasApply function.body
+
+/-- Untrusted deterministic producer.  `run` and external callers always send
+its output back through `validate`; this routine need not be trusted for
+soundness or completeness. -/
+def produce (entries : List (Address × Decl)) (main : Code)
+    (roots : List Address) : Certificate :=
+  let keys := keysOf entries
+  let seeded := addTargets keys roots (Code.targets main)
+  let discovered := close keys entries entries.length seeded
+  let retained := keys.filter discovered.contains
+  let needsOpenWorld := Code.hasApply main || selectedHasApply retained entries
+  { inputRoot := inputRoot entries main
+    roots
+    retained := if needsOpenWorld then keys else retained }
+
+structure Checked where
+  certificate : Certificate
+  deriving Repr
+
+/-- Public fail-closed checked-artifact API. -/
+def check (entries : List (Address × Decl)) (main : Code)
+    (roots : List Address) (certificate : Certificate) :
+    Except String Checked :=
+  if validate entries main roots certificate then
+    .ok ⟨certificate⟩
+  else
+    .error "invalid IxIR1 rooted-reachability certificate"
+
+theorem validate_of_check_eq_ok
+    {entries : List (Address × Decl)} {main : Code}
+    {roots : List Address} {certificate : Certificate} {checked : Checked}
+    (hcheck : check entries main roots certificate = .ok checked) :
+    validate entries main roots certificate = true := by
+  unfold check at hcheck
+  split at hcheck
+  · assumption
+  · contradiction
+
+def filterEntries (retained : List Address)
+    (entries : List (Address × Decl)) : List (Address × Decl) :=
+  entries.filter fun entry => retained.contains entry.1
+
+structure Outcome where
+  entries : List (Address × Decl)
+  certificate : Certificate
+  accepted : Bool
+  removedDeclarations : Nat
+
+/-- Produce, check, and apply reachability.  An internal producer/checker
+disagreement fails soft to the complete input list. -/
+def run (roots : List Address) (entries : List (Address × Decl))
+    (main : Code) : Outcome :=
+  let certificate := produce entries main roots
+  if validate entries main roots certificate then
+    let filtered := filterEntries certificate.retained entries
+    { entries := filtered
+      certificate
+      accepted := true
+      removedDeclarations := entries.length - filtered.length }
+  else
+    { entries
+      certificate
+      accepted := false
+      removedDeclarations := 0 }
+
+/-! ## Exact evaluator transport through a checked restriction -/
+
+private theorem envOfList_some_mem
+    {entries : List (Address × Decl)} {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList entries address = some declaration) :
+    (address, declaration) ∈ entries := by
+  unfold Env.ofList at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryDeclaration⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × Decl => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hdeclaration : entryDeclaration = declaration := by
+    simpa using hvalue
+  subst entryAddress
+  subst entryDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+private theorem key_mem_of_envOfList_eq_some
+    {entries : List (Address × Decl)} {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList entries address = some declaration) :
+    address ∈ keysOf entries := by
+  exact List.mem_map.mpr ⟨(address, declaration), envOfList_some_mem hlookup,
+    rfl⟩
+
+theorem envOfList_filterEntries (retained : List Address)
+    (entries : List (Address × Decl)) (address : Address) :
+    Env.ofList (filterEntries retained entries) address =
+      if retained.contains address then Env.ofList entries address else none := by
+  unfold filterEntries Env.ofList
+  rw [List.find?_filter]
+  by_cases hretained : address ∈ retained
+  · have hpred :
+        (fun entry : Address × Decl =>
+          decide (retained.contains entry.1 = true ∧
+            (entry.1 == address) = true)) =
+        (fun entry : Address × Decl => entry.1 == address) := by
+      funext entry
+      by_cases hsame : entry.1 = address
+      · simp [hsame, hretained]
+      · simp [hsame]
+    rw [hpred]
+    simp [hretained]
+  · have hpred :
+        (fun entry : Address × Decl =>
+          decide (retained.contains entry.1 = true ∧
+            (entry.1 == address) = true)) =
+        (fun _ : Address × Decl => false) := by
+      funext entry
+      by_cases hsame : entry.1 = address
+      · simp [hsame, hretained]
+      · simp [hsame]
+    rw [hpred]
+    simp [hretained]
+
+private theorem envOfList_eq_none_of_key_not_mem
+    {entries : List (Address × Decl)} {address : Address}
+    (hmissing : address ∉ keysOf entries) :
+    Env.ofList entries address = none := by
+  cases hlookup : Env.ofList entries address with
+  | none => rfl
+  | some declaration =>
+      exact (hmissing (key_mem_of_envOfList_eq_some hlookup)).elim
+
+private theorem envOfList_filterEntries_eq_of_safe
+    {entries : List (Address × Decl)} {retained : List Address}
+    {address : Address}
+    (hsafe : (!(keysOf entries).contains address ||
+        retained.contains address) = true) :
+    Env.ofList (filterEntries retained entries) address =
+      Env.ofList entries address := by
+  rw [envOfList_filterEntries]
+  cases hretained : retained.contains address with
+  | true => simp
+  | false =>
+      simp only [hretained] at hsafe
+      have hmissing : address ∉ keysOf entries := by
+        simpa using hsafe
+      simp [envOfList_eq_none_of_key_not_mem hmissing]
+
+private def sourceCtx (entries : List (Address × Decl))
+    (oracle : Address → List RVal → Option RVal) : Ctx :=
+  { decls := Env.ofList entries, oracle }
+
+private def filteredCtx (retained : List Address)
+    (entries : List (Address × Decl))
+    (oracle : Address → List RVal → Option RVal) : Ctx :=
+  { decls := Env.ofList (filterEntries retained entries), oracle }
+
+private theorem AltList.safe_of_mem {keys retained : List Address}
+    {alternatives : List Alt} {alternative : Alt}
+    (hsafe : AltList.safe keys retained alternatives = true)
+    (hmember : alternative ∈ alternatives) :
+    Alt.safe keys retained alternative = true := by
+  induction alternatives with
+  | nil => simp at hmember
+  | cons head rest ih =>
+      simp only [AltList.safe, Bool.and_eq_true] at hsafe
+      cases hmember with
+      | head => exact hsafe.1
+      | tail _ member => exact ih hsafe.2 member
+
+private theorem function_safe_of_lookup
+    {entries : List (Address × Decl)} {retained : List Address}
+    {address : Address} {function : FnDef}
+    (hentries : retainedDeclarationsSafe (keysOf entries) retained entries =
+      true)
+    (hlookup : Env.ofList entries address = some (.fn function))
+    (hretained : retained.contains address = true) :
+    Code.safe (keysOf entries) retained function.body = true := by
+  have hmember : (address, .fn function) ∈ entries :=
+    envOfList_some_mem hlookup
+  have hrow := List.all_eq_true.mp hentries _ hmember
+  have hrow' : address ∉ retained ∨
+      Code.safe (keysOf entries) retained function.body = true := by
+    simpa [Decl.safe] using hrow
+  exact hrow'.resolve_left (by simpa using hretained)
+
+private theorem runCode_case_restricted_eq
+    {entries : List (Address × Decl)} {retained : List Address}
+    {oracle : Address → List RVal → Option RVal} {fuel : Nat}
+    (ih : ∀ (current : FnDef),
+      Code.safe (keysOf entries) retained current.body = true →
+      ∀ (store : Store) (environment : List RVal) (input : Code),
+        Code.safe (keysOf entries) retained input = true →
+        runCode (filteredCtx retained entries oracle) fuel current store
+            environment input =
+          runCode (sourceCtx entries oracle) fuel current store environment
+            input)
+    (current : FnDef)
+    (hcurrent : Code.safe (keysOf entries) retained current.body = true)
+    (store : Store) (environment : List RVal) (scrutinee : Atom)
+    (peelNat : Bool) (alternatives : Array Alt)
+    (hsafe : Code.safe (keysOf entries) retained
+      (.case scrutinee peelNat alternatives) = true) :
+    runCode (filteredCtx retained entries oracle) (fuel + 1) current store
+        environment (.case scrutinee peelNat alternatives) =
+      runCode (sourceCtx entries oracle) (fuel + 1) current store environment
+        (.case scrutinee peelNat alternatives) := by
+  simp only [Code.safe] at hsafe
+  simp only [runCode]
+  cases hscrutinee : resolveAtom environment scrutinee with
+  | error error => simp [bind, Except.bind]
+  | ok value =>
+      simp only [bind, Except.bind]
+      cases value with
+      | erased => simp
+      | lit literal =>
+          cases literal with
+          | str value => simp
+          | nat value =>
+              simp only
+              cases peelNat with
+              | false => simp
+              | true =>
+                  simp only
+                  cases value with
+                  | zero =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 0) with
+                      | none => simp
+                      | some alternative =>
+                          have hmember : alternative ∈ alternatives :=
+                            Array.mem_of_find?_eq_some hfind
+                          have haltSafe := AltList.safe_of_mem hsafe
+                            (by simpa using hmember)
+                          cases alternative with
+                          | mk cidx fields body =>
+                              simp only [Alt.safe] at haltSafe
+                              cases fields with
+                              | zero =>
+                                  simpa using ih current hcurrent store
+                                    environment body haltSafe
+                              | succ fields => simp
+                  | succ value =>
+                      simp only
+                      cases hfind : alternatives.find?
+                          (fun alternative => alternative.cidx == 1) with
+                      | none => simp
+                      | some alternative =>
+                          have hmember : alternative ∈ alternatives :=
+                            Array.mem_of_find?_eq_some hfind
+                          have haltSafe := AltList.safe_of_mem hsafe
+                            (by simpa using hmember)
+                          cases alternative with
+                          | mk cidx fields body =>
+                              simp only [Alt.safe] at haltSafe
+                              cases fields with
+                              | zero => simp
+                              | succ fields =>
+                                  cases fields with
+                                  | zero =>
+                                      simpa using ih current hcurrent store
+                                        (.lit (.nat value) :: environment)
+                                        body haltSafe
+                                  | succ fields => simp
+      | loc location =>
+          simp only
+          cases hget : store.get? location with
+          | none => simp
+          | some box =>
+              simp only
+              cases hnode : box.node with
+              | papN function arity arguments => simp
+              | ctorN identity fields =>
+                  simp only
+                  cases hfind : alternatives.find?
+                      (fun alternative =>
+                        alternative.cidx == identity.cidx) with
+                  | none => simp
+                  | some alternative =>
+                      have hmember : alternative ∈ alternatives :=
+                        Array.mem_of_find?_eq_some hfind
+                      have haltSafe := AltList.safe_of_mem hsafe
+                        (by simpa using hmember)
+                      cases alternative with
+                      | mk cidx fieldCount body =>
+                          simp only [Alt.safe] at haltSafe
+                          by_cases hfields : fields.size = fieldCount
+                          · simpa [hfields] using
+                              ih current hcurrent store
+                                (fields.foldl
+                                  (fun result field => field :: result)
+                                  environment) body haltSafe
+                          · simp [hfields]
+
+private structure RestrictedAt
+    (entries : List (Address × Decl)) (retained : List Address)
+    (oracle : Address → List RVal → Option RVal)
+    (entriesSafe : retainedDeclarationsSafe (keysOf entries) retained entries =
+      true) (fuel : Nat) : Prop where
+  runCode : ∀ (current : FnDef),
+    Code.safe (keysOf entries) retained current.body = true →
+    ∀ (store : Store) (environment : List RVal) (input : Code),
+      Code.safe (keysOf entries) retained input = true →
+      IxIR1.runCode (filteredCtx retained entries oracle) fuel current store
+          environment input =
+        IxIR1.runCode (sourceCtx entries oracle) fuel current store environment
+          input
+  runOp : ∀ (current : FnDef),
+    Code.safe (keysOf entries) retained current.body = true →
+    ∀ (store : Store) (environment : List RVal) (operation : Op),
+      Op.safe (keysOf entries) retained operation = true →
+      IxIR1.runOp (filteredCtx retained entries oracle) fuel current store
+          environment operation =
+        IxIR1.runOp (sourceCtx entries oracle) fuel current store environment
+          operation
+  invoke : ∀ (function : Address),
+    (!(keysOf entries).contains function || retained.contains function) =
+      true →
+    ∀ (arguments : List RVal) (store : Store),
+      IxIR1.invoke (filteredCtx retained entries oracle) fuel function
+          arguments store =
+        IxIR1.invoke (sourceCtx entries oracle) fuel function arguments store
+
+private theorem restrictedAt
+    (entries : List (Address × Decl)) (retained : List Address)
+    (oracle : Address → List RVal → Option RVal)
+    (entriesSafe : retainedDeclarationsSafe (keysOf entries) retained entries =
+      true) :
+    ∀ fuel, RestrictedAt entries retained oracle entriesSafe fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [runCode, runOp, IxIR1.invoke]
+  | succ fuel smaller =>
+      refine ⟨?_, ?_, ?_⟩
+      · intro current hcurrent store environment input hsafe
+        cases input with
+        | ret atom => simp [runCode]
+        | letOp operation rest =>
+            simp only [Code.safe, Bool.and_eq_true] at hsafe
+            simp only [runCode]
+            rw [smaller.runOp current hcurrent store environment operation
+              hsafe.1]
+            cases hoperation : runOp (sourceCtx entries oracle) fuel current
+                store environment operation with
+            | error error => rfl
+            | ok output =>
+                rcases output with ⟨next, value⟩
+                exact smaller.runCode current hcurrent next
+                  (value :: environment) rest hsafe.2
+        | case scrutinee peelNat alternatives =>
+            exact runCode_case_restricted_eq smaller.runCode current hcurrent
+              store environment scrutinee peelNat alternatives hsafe
+      · intro current hcurrent store environment operation hsafe
+        cases operation with
+        | pure atom => simp [runOp]
+        | alloc world identity arguments => simp [runOp]
+        | reuse target identity arguments => simp [runOp]
+        | free target => simp [runOp]
+        | dup target => simp [runOp]
+        | drop target =>
+            simp only [runOp]
+            cases htarget : resolveAtom environment target with
+            | error error => simp [bind, Except.bind]
+            | ok value =>
+                simp only [bind, Except.bind]
+                cases value with
+                | lit literal => rfl
+                | erased => rfl
+                | loc location =>
+                    change (do
+                        let next ← dropVal
+                          (filteredCtx retained entries oracle) fuel store
+                          (.loc location)
+                        .ok (next, RVal.erased)) =
+                      (do
+                        let next ← dropVal (sourceCtx entries oracle) fuel
+                          store (.loc location)
+                        .ok (next, RVal.erased))
+                    rw [dropVal_ctx_eq (sourceCtx entries oracle)
+                      (filteredCtx retained entries oracle) fuel store
+                      (.loc location)]
+        | dropU target =>
+            simp only [runOp]
+            cases htarget : resolveAtom environment target with
+            | error error => simp [bind, Except.bind]
+            | ok value =>
+                simp only [bind, Except.bind]
+                cases value with
+                | lit literal => rfl
+                | erased => rfl
+                | loc location =>
+                    change (do
+                        let next ← dropUVal
+                          (filteredCtx retained entries oracle) fuel store
+                          (.loc location)
+                        .ok (next, RVal.erased)) =
+                      (do
+                        let next ← dropUVal (sourceCtx entries oracle) fuel
+                          store (.loc location)
+                        .ok (next, RVal.erased))
+                    rw [dropUVal_ctx_eq (sourceCtx entries oracle)
+                      (filteredCtx retained entries oracle) fuel store
+                      (.loc location)]
+        | fetch target field => simp [runOp]
+        | call function arguments =>
+            simp only [Op.safe] at hsafe
+            simp only [runOp]
+            cases harguments : resolveAtoms environment arguments with
+            | error error => rfl
+            | ok values => exact smaller.invoke function hsafe values store
+        | callSelf arguments =>
+            simp only [runOp]
+            cases harguments : resolveAtoms environment arguments with
+            | error error => simp [bind, Except.bind]
+            | ok values =>
+                simp only [bind, Except.bind]
+                by_cases harity : values.length = current.arity
+                · simp only [harity]
+                  rw [smaller.runCode current hcurrent store values.reverse
+                    current.body hcurrent]
+                · simp [harity]
+        | papp function arguments =>
+            simp only [Op.safe] at hsafe
+            simp only [runOp]
+            cases harguments : resolveAtoms environment arguments with
+            | error error => rfl
+            | ok values =>
+                simp only [bind, Except.bind]
+                have hlookup :
+                    (filteredCtx retained entries oracle).decls function =
+                      (sourceCtx entries oracle).decls function :=
+                  envOfList_filterEntries_eq_of_safe hsafe
+                rw [hlookup]
+        | apply function arguments =>
+            simp [Op.safe] at hsafe
+        | extern function arguments =>
+            simp [runOp, callScalarOracle, filteredCtx, sourceCtx]
+      · intro function hsafe arguments store
+        have hlookup :
+            (filteredCtx retained entries oracle).decls function =
+              (sourceCtx entries oracle).decls function := by
+          exact envOfList_filterEntries_eq_of_safe hsafe
+        simp only [IxIR1.invoke]
+        rw [hlookup]
+        cases hsource : Env.ofList entries function with
+        | none => simp [sourceCtx, hsource]
+        | some declaration =>
+            have hkey : function ∈ keysOf entries :=
+              key_mem_of_envOfList_eq_some hsource
+            have hkeyBool : (keysOf entries).contains function = true := by
+              simpa using hkey
+            have hretained : retained.contains function = true := by
+              have hsafe' : function ∉ keysOf entries ∨
+                  function ∈ retained := by
+                simpa using hsafe
+              have hmember := hsafe'.resolve_left (fun hmissing =>
+                hmissing hkey)
+              simpa using hmember
+            cases declaration with
+            | extern arity =>
+                simp [sourceCtx, hsource, filteredCtx, callScalarOracle]
+            | fn called =>
+                have hcalledSafe := function_safe_of_lookup entriesSafe
+                  hsource hretained
+                by_cases harity : arguments.length = called.arity
+                · have harityBool :
+                      (arguments.length != called.arity) = false := by
+                    simp [harity]
+                  simp only [sourceCtx, hsource, harityBool,
+                    Bool.false_eq_true, if_false]
+                  have hbody := smaller.runCode called hcalledSafe store
+                    arguments.reverse called.body hcalledSafe
+                  simpa [sourceCtx] using congrArg
+                    (fun output => output >>= checkResultWorld called.result)
+                    hbody
+                · simp [sourceCtx, hsource, harity]
+
+private theorem filterEntries_eq_self_of_allRetained
+    {entries : List (Address × Decl)} {retained : List Address}
+    (hall : allRetained (keysOf entries) retained = true) :
+    filterEntries retained entries = entries := by
+  apply List.filter_eq_self.mpr
+  intro entry hmember
+  have hkey : entry.1 ∈ keysOf entries := by
+    exact List.mem_map.mpr ⟨entry, hmember, rfl⟩
+  have hretained := List.all_eq_true.mp hall entry.1 hkey
+  simpa using hretained
+
+/-- A valid proper-subset certificate preserves the complete top-level
+evaluator result exactly.  The all-retained dynamic-apply fallback is the
+degenerate equality case. -/
+theorem runMain_filterEntries_eq_of_validate
+    {entries : List (Address × Decl)} {main : Code}
+    {roots : List Address} {certificate : Certificate}
+    (hvalid : validate entries main roots certificate = true)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain
+        { decls := Env.ofList
+            (filterEntries certificate.retained entries)
+          oracle }
+        main fuel =
+      runMain { decls := Env.ofList entries, oracle } main fuel := by
+  simp only [validate, Bool.and_eq_true, Bool.or_eq_true] at hvalid
+  have hmode := hvalid.2
+  cases hmode with
+  | inl hall =>
+      have hentries : filterEntries certificate.retained entries = entries :=
+        filterEntries_eq_self_of_allRetained hall
+      rw [hentries]
+  | inr hclosed =>
+      let current : FnDef := ⟨0, .shared, false, main⟩
+      have heq :=
+        (restrictedAt entries certificate.retained oracle hclosed.2 fuel).runCode
+          current hclosed.1 {} [] main hclosed.1
+      simpa [runMain, current, filteredCtx, sourceCtx] using heq
+
+/-- The produce/check/apply wrapper is fail-soft and exact whether its
+internally produced certificate is accepted or rejected. -/
+theorem runMain_run_eq (roots : List Address)
+    (entries : List (Address × Decl)) (main : Code)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain { decls := Env.ofList (run roots entries main).entries, oracle }
+        main fuel =
+      runMain { decls := Env.ofList entries, oracle } main fuel := by
+  generalize hcertificate : produce entries main roots = certificate
+  cases hvalid : validate entries main roots certificate with
+  | false => simp [run, hcertificate, hvalid]
+  | true =>
+      simp only [run, hcertificate, hvalid, if_true]
+      exact runMain_filterEntries_eq_of_validate hvalid oracle fuel
+
+end Ix.Compiler.IxIR1.Reachability
diff --git a/Ix/Compiler/IxIR1/Readdress.lean b/Ix/Compiler/IxIR1/Readdress.lean
new file mode 100644
index 000000000..5360f19b4
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Readdress.lean
@@ -0,0 +1,593 @@
+import Ix.Compiler.IxIR1.Serialize
+
+/-!
+# IxIR₁ generated-declaration readdressing
+
+The lowering proof works over transient names for lifted lambdas and
+constructor wrappers.  This module is the compiled artifact boundary: it
+rewrites those names to the BLAKE3 address of each finished declaration.
+
+Generated declarations may refer to other generated declarations, so hashing
+is dependency ordered.  `callSelf` contains no address and therefore does not
+form a dependency.  A direct generated-address cycle fails closed, as do
+temporary-name overlap with source declarations and an observed BLAKE3
+collision between distinct preimages.  Identical generated declarations are
+content-deduplicated deliberately.
+
+The hash call is native.  Consequently `run` belongs in compiled entry points
+and tests, not in elaboration-time `#guard`s.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address)
+
+namespace Readdress
+
+/-- Old generated name to finished content address. -/
+abbrev Renaming := List (Address × Address)
+
+namespace Renaming
+
+/-- Look up one transient generated name. -/
+def lookup (mapping : Renaming) (address : Address) : Option Address :=
+  (mapping.find? fun entry => entry.1 == address).map (·.2)
+
+/-- Rewrite an address when it names a generated declaration. -/
+def apply (mapping : Renaming) (address : Address) : Address :=
+  (mapping.lookup address).getD address
+
+/-- Whether the domain already contains this generated name. -/
+def contains (mapping : Renaming) (address : Address) : Bool :=
+  mapping.any fun entry => entry.1 == address
+
+end Renaming
+
+namespace CtorId
+
+/-- Rewrite the block identity carried by a constructor identity. -/
+def mapAddresses (rename : Address → Address) (constructor : CtorId) : CtorId :=
+  { constructor with block := rename constructor.block }
+
+end CtorId
+
+namespace Op
+
+/-- Apply an address renaming to every address-bearing operation field. -/
+def mapAddresses (rename : Address → Address) : Op → Op
+  | .pure atom => .pure atom
+  | .alloc world cid args =>
+      .alloc world (CtorId.mapAddresses rename cid) args
+  | .reuse target cid args =>
+      .reuse target (CtorId.mapAddresses rename cid) args
+  | .free target => .free target
+  | .dup target => .dup target
+  | .drop target => .drop target
+  | .dropU target => .dropU target
+  | .fetch target field => .fetch target field
+  | .call function args => .call (rename function) args
+  | .callSelf args => .callSelf args
+  | .papp function args => .papp (rename function) args
+  | .apply function args => .apply function args
+  | .extern function args => .extern (rename function) args
+
+/-- Direct semantic address references carried by an operation. -/
+def references : Op → List Address
+  | .alloc _ cid _ | .reuse _ cid _ => [cid.block]
+  | .call function _ | .papp function _ | .extern function _ => [function]
+  | _ => []
+
+end Op
+
+mutual
+
+/-- Apply an address renaming throughout code. -/
+def Code.mapAddresses (rename : Address → Address) : Code → Code
+  | .ret atom => .ret atom
+  | .letOp op rest =>
+      .letOp (Op.mapAddresses rename op) (Code.mapAddresses rename rest)
+  | .case scrutinee peelNat alternatives =>
+      .case scrutinee peelNat
+        (AltList.mapAddresses rename alternatives.toList).toArray
+
+/-- Apply an address renaming beneath one case alternative. -/
+def Alt.mapAddresses (rename : Address → Address) : Alt → Alt
+  | .mk constructor fields body =>
+      .mk constructor fields (Code.mapAddresses rename body)
+
+/-- Executable walk beneath an alternative array. -/
+def AltList.mapAddresses (rename : Address → Address) : List Alt → List Alt
+  | [] => []
+  | alternative :: rest =>
+      Alt.mapAddresses rename alternative :: AltList.mapAddresses rename rest
+
+end
+
+/-! ## Executable structural equality
+
+The mutually nested `Code`/`Alt` syntax does not receive a lawful equality
+instance from Lean's deriving machinery.  Readdressing needs a proof-reflecting
+comparison at its final semantic audit, so keep the small comparison here
+beside the complete address walk. -/
+
+namespace Op
+
+def structurallyEq : Op → Op → Bool
+  | .pure left, .pure right => left == right
+  | .alloc leftWorld leftCtor leftArgs,
+      .alloc rightWorld rightCtor rightArgs =>
+      leftWorld == rightWorld && leftCtor == rightCtor &&
+        leftArgs == rightArgs
+  | .reuse leftTarget leftCtor leftArgs,
+      .reuse rightTarget rightCtor rightArgs =>
+      leftTarget == rightTarget && leftCtor == rightCtor &&
+        leftArgs == rightArgs
+  | .free left, .free right
+  | .dup left, .dup right
+  | .drop left, .drop right
+  | .dropU left, .dropU right => left == right
+  | .fetch leftTarget leftField, .fetch rightTarget rightField =>
+      leftTarget == rightTarget && leftField == rightField
+  | .call leftFunction leftArgs, .call rightFunction rightArgs
+  | .papp leftFunction leftArgs, .papp rightFunction rightArgs
+  | .extern leftFunction leftArgs, .extern rightFunction rightArgs =>
+      leftFunction == rightFunction && leftArgs == rightArgs
+  | .callSelf left, .callSelf right => left == right
+  | .apply leftFunction leftArgs, .apply rightFunction rightArgs =>
+      leftFunction == rightFunction && leftArgs == rightArgs
+  | _, _ => false
+
+theorem structurallyEq_eq_true_iff (left right : Op) :
+    structurallyEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [structurallyEq, beq_iff_eq, and_assoc]
+
+end Op
+
+mutual
+
+def Code.structurallyEq : Code → Code → Bool
+  | .ret left, .ret right => left == right
+  | .letOp leftOp leftRest, .letOp rightOp rightRest =>
+      Op.structurallyEq leftOp rightOp &&
+        Code.structurallyEq leftRest rightRest
+  | .case leftScrutinee leftPeel leftAlternatives,
+      .case rightScrutinee rightPeel rightAlternatives =>
+      leftScrutinee == rightScrutinee && leftPeel == rightPeel &&
+        AltList.structurallyEq leftAlternatives.toList
+          rightAlternatives.toList
+  | _, _ => false
+
+def Alt.structurallyEq : Alt → Alt → Bool
+  | .mk leftConstructor leftFields leftBody,
+      .mk rightConstructor rightFields rightBody =>
+      leftConstructor == rightConstructor && leftFields == rightFields &&
+        Code.structurallyEq leftBody rightBody
+
+def AltList.structurallyEq : List Alt → List Alt → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      Alt.structurallyEq left right &&
+        AltList.structurallyEq leftRest rightRest
+  | _, _ => false
+
+end
+
+mutual
+
+theorem Code.structurallyEq_eq_true_iff (left right : Code) :
+    Code.structurallyEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [Code.structurallyEq, Op.structurallyEq_eq_true_iff,
+      Code.structurallyEq_eq_true_iff,
+      AltList.structurallyEq_eq_true_iff, beq_iff_eq, and_assoc]
+
+theorem Alt.structurallyEq_eq_true_iff (left right : Alt) :
+    Alt.structurallyEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [Alt.structurallyEq, Code.structurallyEq_eq_true_iff,
+    beq_iff_eq, and_assoc]
+
+theorem AltList.structurallyEq_eq_true_iff (left right : List Alt) :
+    AltList.structurallyEq left right = true ↔ left = right := by
+  cases left with
+  | nil => cases right <;> simp [AltList.structurallyEq]
+  | cons left leftRest =>
+      cases right with
+      | nil => simp [AltList.structurallyEq]
+      | cons right rightRest =>
+          simp [AltList.structurallyEq,
+            Alt.structurallyEq_eq_true_iff,
+            AltList.structurallyEq_eq_true_iff]
+
+end
+
+mutual
+
+/-- Direct and nested semantic address references carried by code. -/
+def Code.references : Code → List Address
+  | .ret _ => []
+  | .letOp op rest => Op.references op ++ Code.references rest
+  | .case _ _ alternatives => AltList.references alternatives.toList
+
+/-- Semantic address references beneath one case alternative. -/
+def Alt.references : Alt → List Address
+  | .mk _ _ body => Code.references body
+
+/-- Executable reference walk beneath an alternative array. -/
+def AltList.references : List Alt → List Address
+  | [] => []
+  | alternative :: rest =>
+      Alt.references alternative ++ AltList.references rest
+
+end
+
+namespace FnDef
+
+/-- Apply an address renaming throughout a function declaration. -/
+def mapAddresses (rename : Address → Address) (definition : FnDef) : FnDef :=
+  { definition with body := Code.mapAddresses rename definition.body }
+
+/-- Semantic address references carried by a function declaration. -/
+def references (definition : FnDef) : List Address :=
+  Code.references definition.body
+
+def structurallyEq (left right : FnDef) : Bool :=
+  left.arity == right.arity && left.result == right.result &&
+    left.papSafe == right.papSafe &&
+    Code.structurallyEq left.body right.body
+
+theorem structurallyEq_eq_true_iff (left right : FnDef) :
+    structurallyEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [structurallyEq, Code.structurallyEq_eq_true_iff,
+    beq_iff_eq, and_assoc]
+
+end FnDef
+
+namespace Decl
+
+/-- Apply an address renaming throughout a declaration. -/
+def mapAddresses (rename : Address → Address) : Decl → Decl
+  | .fn definition => .fn (FnDef.mapAddresses rename definition)
+  | .extern arity => .extern arity
+
+/-- Semantic address references carried by a declaration. -/
+def references : Decl → List Address
+  | .fn definition => FnDef.references definition
+  | .extern _ => []
+
+def structurallyEq : Decl → Decl → Bool
+  | .fn left, .fn right => FnDef.structurallyEq left right
+  | .extern left, .extern right => left == right
+  | _, _ => false
+
+theorem structurallyEq_eq_true_iff (left right : Decl) :
+    structurallyEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [structurallyEq, FnDef.structurallyEq_eq_true_iff,
+      beq_iff_eq]
+
+end Decl
+
+/-- One completely readdressed lowering result.  Source-backed declaration
+keys stay stable, while their bodies are rewritten to the generated content
+addresses.  `generated` contains only content-addressed declarations and may
+be shorter than `addressMap` when identical declarations deduplicate. -/
+structure Result where
+  source : List (Address × Decl)
+  generated : List (Address × Decl)
+  main : Code
+  addressMap : Renaming
+
+/-- The environment spelling consumed by the evaluator and pipeline. -/
+def Result.declarations (result : Result) : List (Address × Decl) :=
+  result.source ++ result.generated
+
+/-- Transient generated names, in dependency-resolution order. -/
+def Result.transientAddresses (result : Result) : List Address :=
+  result.addressMap.map (·.1)
+
+/-- No emitted declaration key belongs to the transient namespace. -/
+def Result.noTransientKeys (result : Result) : Bool :=
+  let transient := result.transientAddresses
+  !(result.declarations.map (·.1)).any transient.contains
+
+/-- No transient generated name remains in any emitted reference. -/
+def Result.noTransientReferences (result : Result) : Bool :=
+  let transient := result.transientAddresses
+  let declarationReferences :=
+    (result.source ++ result.generated).flatMap fun entry =>
+      Decl.references entry.2
+  !(declarationReferences ++ Code.references result.main).any transient.contains
+
+/-- Every emitted generated key is the canonical address of its declaration.
+This audit executes BLAKE3 and therefore belongs in compiled tests. -/
+def Result.generatedAreAddressed (result : Result) : Bool :=
+  result.generated.all fun entry => entry.1 == entry.2.address
+
+/-- Executable certificate that the emitted environment is the exact
+declaration image of the pre-address environment at every raw key, and that
+every emitted lookup is already stable under the completed renaming.  The
+second clause supplies semantic aliases for newly introduced content keys
+without requiring an inverse address map. -/
+def Result.semanticAudit (result : Result)
+    (raw : List (Address × Decl)) (rawMain : Code) : Bool :=
+  let rename := Renaming.apply result.addressMap
+  let emitted := Env.ofList result.declarations
+  let original := Env.ofList raw
+  Code.structurallyEq result.main (Code.mapAddresses rename rawMain) &&
+    raw.all (fun entry =>
+      match original entry.1, emitted (rename entry.1) with
+      | some before, some after =>
+          Decl.structurallyEq after (Decl.mapAddresses rename before)
+      | _, _ => false) &&
+    result.declarations.all (fun entry =>
+      match emitted entry.1 with
+      | some declaration =>
+          Decl.structurallyEq
+            (Decl.mapAddresses rename declaration) declaration
+      | none => false)
+
+/-- Every protected identity is fixed by the completed address map.  The
+production lowerer protects all original IxIR₀ declaration addresses,
+including constructors that have no source-backed IxIR₁ declaration entry. -/
+def Result.protects (result : Result) (addresses : List Address) : Bool :=
+  addresses.all fun address =>
+    Renaming.apply result.addressMap address == address
+
+/-- Reflect one member of an executable protection check into equality. -/
+theorem Result.apply_eq_of_protects {result : Result}
+    {addresses : List Address} (hprotects : result.protects addresses = true)
+    {address : Address} (haddress : address ∈ addresses) :
+    Renaming.apply result.addressMap address = address := by
+  have hequal := (List.all_eq_true.mp hprotects) address haddress
+  exact Address.eq_of_beq hequal
+
+/-- A successful post-pass carries an erased proof of its semantic audit.
+The subtype proof has no runtime representation in emitted artifacts. -/
+abbrev CertifiedResult (raw : List (Address × Decl)) (rawMain : Code) :=
+  { result : Result // result.semanticAudit raw rawMain = true }
+
+private def certify (raw : List (Address × Decl)) (rawMain : Code)
+    (result : Result) : Except String (CertifiedResult raw rawMain) :=
+  if haudit : result.semanticAudit raw rawMain then
+    .ok ⟨result, haudit⟩
+  else
+    .error "internal: generated readdressing failed semantic audit"
+
+private def firstDuplicate? : List Address → Option Address
+  | [] => none
+  | address :: rest =>
+      if rest.contains address then some address else firstDuplicate? rest
+
+private def firstOverlap? (keys : List Address)
+    (source : List (Address × Decl)) : Option Address :=
+  keys.find? fun key => source.any fun entry => entry.1 == key
+
+private def referencesResolved (keys : List Address)
+    (mapping : Renaming) (declaration : Decl) : Bool :=
+  (Decl.references declaration).all fun reference =>
+    !keys.contains reference || mapping.contains reference
+
+/-- Remove and return the first declaration whose generated dependencies are
+already in the renaming.  The residual list preserves its original order. -/
+private def takeReady (keys : List Address) (mapping : Renaming) :
+    List (Address × Decl) →
+      Option ((Address × Decl) × List (Address × Decl))
+  | [] => none
+  | entry :: rest =>
+      if referencesResolved keys mapping entry.2 then
+        some (entry, rest)
+      else
+        match takeReady keys mapping rest with
+        | none => none
+        | some (ready, residual) => some (ready, entry :: residual)
+
+private def findDeclaration? (address : Address) :
+    List (Address × Decl) → Option Decl
+  | [] => none
+  | entry :: rest =>
+      if entry.1 == address then some entry.2
+      else findDeclaration? address rest
+
+private structure BuildState where
+  addressMap : Renaming := []
+  /-- Reverse dependency order while building; reversed once at the end. -/
+  generatedRev : List (Address × Decl) := []
+
+private def samePreimage (left right : Decl) : Bool :=
+  left.preimage == right.preimage
+
+/-- Record one finished declaration, content-deduplicating an identical
+preimage and rejecting an observed address collision with different bytes. -/
+private def install (keys : List Address)
+    (source : List (Address × Decl)) (old : Address)
+    (declaration : Decl) (state : BuildState) : Except String BuildState :=
+  let address := declaration.address
+  if keys.contains address then
+    .error s!"generated content address overlaps temporary namespace {Address.toHex address}"
+  else
+    match findDeclaration? address source with
+    | some _ =>
+        .error s!"generated content address collides with source declaration key {Address.toHex address}"
+    | none =>
+        match findDeclaration? address state.generatedRev with
+        | some found =>
+            if samePreimage found declaration then
+              .ok { state with
+                addressMap := (old, address) :: state.addressMap }
+            else
+              .error s!"BLAKE3 collision while readdressing generated declaration {Address.toHex old}"
+        | none =>
+            .ok
+              { addressMap := (old, address) :: state.addressMap
+                generatedRev := (address, declaration) :: state.generatedRev }
+
+private def build (keys : List Address) (source : List (Address × Decl)) :
+    Nat → List (Address × Decl) → BuildState → Except String BuildState
+  | 0, [], state => .ok state
+  | 0, _ :: _, _ =>
+      .error "generated declaration address dependency cycle"
+  | _ + 1, [], state => .ok state
+  | fuel + 1, pending, state =>
+      match takeReady keys state.addressMap pending with
+      | none => .error "generated declaration address dependency cycle"
+      | some ((old, declaration), residual) => do
+          let rewritten := Decl.mapAddresses
+            (Renaming.apply state.addressMap) declaration
+          let state ← install keys source old rewritten state
+          build keys source fuel residual state
+
+/-- Rewrite and content-address all generated declarations, retaining an
+erased certificate that the resulting evaluator environment is the exact
+semantic address image of the raw one.
+
+`source` contains source-backed declarations whose keys must remain stable;
+`generated` contains transiently keyed lifts/wrappers.  The result is
+dependency ordered, exact-content deduplicated, and includes the complete
+old-to-new provenance map. -/
+def runCertified (source generated : List (Address × Decl)) (main : Code) :
+    Except String (CertifiedResult (source ++ generated) main) := do
+  if generated.isEmpty then
+    return ← certify (source ++ generated) main
+      { source, generated := [], main, addressMap := [] }
+  let keys := generated.map (·.1)
+  if let some duplicate := firstDuplicate? keys then
+    throw s!"duplicate generated temporary address {Address.toHex duplicate}"
+  if let some overlap := firstOverlap? keys source then
+    throw s!"generated temporary address overlaps source declaration {Address.toHex overlap}"
+  let state ← build keys source keys.length generated {}
+  let addressMap := state.addressMap.reverse
+  let rename := Renaming.apply addressMap
+  let result : Result :=
+    { source := source.map fun entry =>
+        (entry.1, Decl.mapAddresses rename entry.2)
+      generated := state.generatedRev.reverse
+      main := Code.mapAddresses rename main
+      addressMap }
+  unless result.noTransientKeys do
+    throw "internal: generated readdressing emitted a transient key"
+  unless result.noTransientReferences do
+    throw "internal: generated readdressing left a transient reference"
+  certify (source ++ generated) main result
+
+/-- Artifact-facing projection of `runCertified`. -/
+def run (source generated : List (Address × Decl)) (main : Code) :
+    Except String Result := do
+  return (← runCertified source generated main).1
+
+/-- Run the ordinary certified post-pass and additionally reject any result
+whose renaming changes a caller-protected identity.  This closes the
+constructor-address gap at the production lowering boundary: constructors
+are absent from the IxIR₁ declaration environment but their IxIR₀ keys still
+occur in `CtorId.block` and must remain stable. -/
+def runProtected (reserved : List Address)
+    (source generated : List (Address × Decl)) (main : Code) :
+    Except String Result := do
+  let result ← run source generated main
+  if _hprotects : result.protects reserved then
+    return result
+  else
+    throw "generated address map rewrites a protected source identity"
+
+/-- A successful protected run is also a successful ordinary certified run
+and carries the requested fixed-identity audit. -/
+theorem run_and_protects_of_runProtected_eq_ok
+    {reserved : List Address}
+    {source generated : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : runProtected reserved source generated main = .ok result) :
+    run source generated main = .ok result ∧
+      result.protects reserved = true := by
+  unfold runProtected at hrun
+  cases hbase : run source generated main with
+  | error message =>
+      rw [hbase] at hrun
+      change Except.error message = Except.ok result at hrun
+      contradiction
+  | ok candidate =>
+      rw [hbase] at hrun
+      change
+        (if candidate.protects reserved = true then
+          Except.ok candidate
+        else
+          Except.error
+            "generated address map rewrites a protected source identity") =
+          Except.ok result at hrun
+      by_cases hprotects : candidate.protects reserved = true
+      · rw [if_pos hprotects] at hrun
+        have hresult : candidate = result := by injection hrun
+        subst result
+        exact ⟨rfl, hprotects⟩
+      · rw [if_neg hprotects] at hrun
+        contradiction
+
+/-- Every successful artifact-facing run retains the erased semantic
+certificate constructed by `runCertified`. -/
+theorem semanticAudit_of_run_eq_ok
+    {source generated : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : run source generated main = .ok result) :
+    result.semanticAudit (source ++ generated) main = true := by
+  unfold run at hrun
+  cases hcertified : runCertified source generated main with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2
+
+/-- Protected runs retain the same semantic audit as ordinary runs. -/
+theorem semanticAudit_of_runProtected_eq_ok
+    {reserved : List Address}
+    {source generated : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : runProtected reserved source generated main = .ok result) :
+    result.semanticAudit (source ++ generated) main = true :=
+  semanticAudit_of_run_eq_ok
+    (run_and_protects_of_runProtected_eq_ok hrun).1
+
+/-! Pure structural format guards.  Hashing behavior is pinned by the compiled
+test executable. -/
+
+private def fixtureOldA : Address := Address.replicate 0xFA
+private def fixtureOldB : Address := Address.replicate 0xFB
+private def fixtureNewA : Address := Address.replicate 0x0A
+private def fixtureNewB : Address := Address.replicate 0x0B
+
+private def fixtureCode : Code :=
+  .letOp (.call fixtureOldA #[])
+    (.case (.var 0) false
+      #[.mk 0 0 (.letOp (.papp fixtureOldB #[]) (.ret (.var 0)))])
+
+private def fixtureOps : List Op :=
+  [.alloc .shared ⟨fixtureOldA, 0, 0⟩ #[],
+   .reuse .erased ⟨fixtureOldA, 0, 1⟩ #[],
+   .call fixtureOldA #[],
+   .papp fixtureOldB #[],
+   .extern fixtureOldA #[]]
+
+private def fixtureMap : Renaming :=
+  [(fixtureOldA, fixtureNewA), (fixtureOldB, fixtureNewB)]
+
+#guard Code.references fixtureCode == [fixtureOldA, fixtureOldB]
+#guard fixtureOps.flatMap Op.references ==
+  [fixtureOldA, fixtureOldA, fixtureOldA, fixtureOldB, fixtureOldA]
+#guard (fixtureOps.map (Op.mapAddresses (Renaming.apply fixtureMap))).flatMap
+    Op.references ==
+  [fixtureNewA, fixtureNewA, fixtureNewA, fixtureNewB, fixtureNewA]
+#guard
+  Code.references
+    (Code.mapAddresses
+      (Renaming.apply fixtureMap)
+      fixtureCode) == [fixtureNewA, fixtureNewB]
+
+end Readdress
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/ReaddressAll.lean b/Ix/Compiler/IxIR1/ReaddressAll.lean
new file mode 100644
index 000000000..a41b75872
--- /dev/null
+++ b/Ix/Compiler/IxIR1/ReaddressAll.lean
@@ -0,0 +1,876 @@
+import Ix.Compiler.IxIR1.MutualBlock
+
+/-!
+# Whole-program IxIR₁ content addressing
+
+Ordinary declaration hashing handles a dependency DAG, while
+`IxIR1.MutualBlock` gives a finite spelling to genuine address cycles.  This
+module joins those two artifact forms.  It discovers strongly connected
+components across one flat IxIR₁ environment, processes the component DAG
+from dependencies to users, hashes acyclic singletons as ordinary
+declarations, and sends cyclic components through the mutual-block boundary.
+
+The pass is independent of lowering's current source/generated partition.
+Function keys are producer names to readdress.  `.extern` declaration keys
+remain stable because they select an opaque oracle ABI not represented by the
+arity-only declaration bytes; caller-owned identities absent from the
+declaration environment (notably constructor blocks) are supplied separately
+as `reserved`.  The result retains a complete map (including identity entries
+for stable externs) and ordered stable/ordinary/block artifact provenance for
+later pipeline and proof integration.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address)
+
+namespace ReaddressAll
+
+abbrev Renaming := Readdress.Renaming
+
+/-! ## Deterministic strongly connected components -/
+
+/-- One SCC, with members retained in input declaration order. -/
+structure Component where
+  members : List (Address × Decl)
+
+namespace Component
+
+def keys (component : Component) : List Address :=
+  component.members.map (·.1)
+
+/-- A singleton with an explicit self-address edge is cyclic.  `callSelf`
+does not carry an address and therefore remains an ordinary singleton. -/
+def cyclic (component : Component) : Bool :=
+  match component.members with
+  | [(address, declaration)] =>
+      (Readdress.Decl.references declaration).contains address
+  | _ :: _ :: _ => true
+  | _ => false
+
+end Component
+
+private structure GraphPartition where
+  /-- Source-index to SCC number.  Numbers are assigned in user-to-dependency
+  topological order by the second Kosaraju pass. -/
+  componentOf : Array Nat
+  componentCount : Nat
+  /-- Source-indexed internal dependency edges. -/
+  edges : Array (Array Nat)
+
+/-- Iterative Kosaraju partitioning.  Both depth-first passes use explicit
+arrays as stacks, so a long dependency chain does not consume the native call
+stack.  Address lookup is hash-indexed; graph construction and both passes are
+linear in declarations plus address-reference edges. -/
+private def graphPartition (raw : List (Address × Decl)) : GraphPartition :=
+  Id.run do
+    let entries := raw.toArray
+    let count := entries.size
+    let mut keyIndex : Std.HashMap Address Nat := {}
+    let mut sourceIndex := 0
+    for entry in entries do
+      keyIndex := keyIndex.insert entry.1 sourceIndex
+      sourceIndex := sourceIndex + 1
+
+    let mut edges : Array (Array Nat) := Array.replicate count #[]
+    let mut reverseEdges : Array (Array Nat) := Array.replicate count #[]
+    let mut edgeIndex := 0
+    for entry in entries do
+      let mut outgoing : Array Nat := #[]
+      for reference in Readdress.Decl.references entry.2 do
+        match keyIndex.get? reference with
+        | none => pure ()
+        | some dependency => outgoing := outgoing.push dependency
+      edges := edges.set! edgeIndex outgoing
+      for dependency in outgoing do
+        reverseEdges := reverseEdges.set! dependency
+          (reverseEdges[dependency]!.push edgeIndex)
+      edgeIndex := edgeIndex + 1
+
+    -- Finish times in the original user-to-dependency graph.
+    let mut visited := Array.replicate count false
+    let mut finished : Array Nat := #[]
+    for root in [:count] do
+      if !visited[root]! then
+        visited := visited.set! root true
+        let mut stack : Array (Nat × Nat) := #[(root, 0)]
+        while !stack.isEmpty do
+          let frame := stack.back!
+          let node := frame.1
+          let next := frame.2
+          let outgoing := edges[node]!
+          if next < outgoing.size then
+            stack := stack.set! (stack.size - 1) (node, next + 1)
+            let dependency := outgoing[next]!
+            if !visited[dependency]! then
+              visited := visited.set! dependency true
+              stack := stack.push (dependency, 0)
+          else
+            stack := stack.pop
+            finished := finished.push node
+
+    -- Descending finish time over the transpose assigns components in
+    -- user-to-dependency topological order.
+    let mut componentOf := Array.replicate count count
+    let mut componentCount := 0
+    for root in finished.reverse do
+      if componentOf[root]! == count then
+        componentOf := componentOf.set! root componentCount
+        let mut stack : Array Nat := #[root]
+        while !stack.isEmpty do
+          let node := stack.back!
+          stack := stack.pop
+          for user in reverseEdges[node]! do
+            if componentOf[user]! == count then
+              componentOf := componentOf.set! user componentCount
+              stack := stack.push user
+        componentCount := componentCount + 1
+    return { componentOf, componentCount, edges }
+
+private def componentBuckets (raw : List (Address × Decl))
+    (partition : GraphPartition) : Array (Array (Address × Decl)) :=
+  Id.run do
+    let entries := raw.toArray
+    let mut buckets := Array.replicate partition.componentCount #[]
+    let mut sourceIndex := 0
+    for entry in entries do
+      let component := partition.componentOf[sourceIndex]!
+      buckets := buckets.set! component
+        (buckets[component]!.push entry)
+      sourceIndex := sourceIndex + 1
+    return buckets
+
+/-- Discover the SCC partition in first-member source order.  Member order is
+also the original declaration order, independent of DFS traversal details. -/
+def discoverComponents (raw : List (Address × Decl)) : List Component :=
+  let partition := graphPartition raw
+  let buckets := componentBuckets raw partition
+  Id.run do
+    let mut emitted := Array.replicate partition.componentCount false
+    let mut components : Array Component := #[]
+    for index in [:raw.length] do
+      let component := partition.componentOf[index]!
+      if !emitted[component]! then
+        emitted := emitted.set! component true
+        components := components.push ⟨buckets[component]!.toList⟩
+    return components.toList
+
+/-- Insert one component in a source-rank min heap. -/
+private def heapInsert (rank : Array Nat) (heap : Array Nat)
+    (component : Nat) : Array Nat :=
+  Id.run do
+    let mut result := heap.push component
+    let mut index := result.size - 1
+    let mut rising := true
+    while rising && index > 0 do
+      let parent := (index - 1) / 2
+      if rank[result[index]!]! < rank[result[parent]!]! then
+        let childValue := result[index]!
+        let parentValue := result[parent]!
+        result := result.set! index parentValue
+        result := result.set! parent childValue
+        index := parent
+      else
+        rising := false
+    return result
+
+/-- Remove the source-rank-minimal component from a nonempty heap. -/
+private def heapTakeMin (rank : Array Nat)
+    (heap : Array Nat) : Nat × Array Nat :=
+  Id.run do
+    let minimum := heap[0]!
+    let last := heap.back!
+    let mut result := heap.pop
+    if !result.isEmpty then
+      result := result.set! 0 last
+      let mut index := 0
+      let mut falling := true
+      while falling do
+        let left := 2 * index + 1
+        if left < result.size then
+          let right := left + 1
+          let child :=
+            if right < result.size &&
+                rank[result[right]!]! < rank[result[left]!]! then
+              right
+            else
+              left
+          if rank[result[child]!]! < rank[result[index]!]! then
+            let parentValue := result[index]!
+            let childValue := result[child]!
+            result := result.set! index childValue
+            result := result.set! child parentValue
+            index := child
+          else
+            falling := false
+        else
+          falling := false
+    return (minimum, result)
+
+/-- SCCs in the same stable dependency-first order as repeatedly selecting
+the first ready source component, implemented with a component DAG and a
+source-rank min heap. -/
+private def discoverComponentsDependencyFirst
+    (raw : List (Address × Decl)) : List Component :=
+  let partition := graphPartition raw
+  let buckets := componentBuckets raw partition
+  Id.run do
+    let count := partition.componentCount
+    let mut rank := Array.replicate count raw.length
+    for sourceIndex in [:partition.componentOf.size] do
+      let component := partition.componentOf[sourceIndex]!
+      if rank[component]! == raw.length then
+        rank := rank.set! component sourceIndex
+
+    let mut dependencyCount := Array.replicate count 0
+    let mut users : Array (Array Nat) := Array.replicate count #[]
+    -- `seen[dependency] == user` records that this component edge has already
+    -- been charged while traversing another member/reference of the same SCC.
+    let mut seen := Array.replicate count count
+    for sourceIndex in [:partition.componentOf.size] do
+      let user := partition.componentOf[sourceIndex]!
+      for dependencyIndex in partition.edges[sourceIndex]! do
+        let dependency := partition.componentOf[dependencyIndex]!
+        if dependency != user && seen[dependency]! != user then
+          seen := seen.set! dependency user
+          dependencyCount := dependencyCount.set! user
+            (dependencyCount[user]! + 1)
+          users := users.set! dependency (users[dependency]!.push user)
+
+    let mut ready : Array Nat := #[]
+    for component in [:count] do
+      if dependencyCount[component]! == 0 then
+        ready := heapInsert rank ready component
+
+    let mut components : Array Component := #[]
+    while !ready.isEmpty do
+      let (component, residual) := heapTakeMin rank ready
+      ready := residual
+      components := components.push ⟨buckets[component]!.toList⟩
+      for user in users[component]! do
+        let remaining := dependencyCount[user]! - 1
+        dependencyCount := dependencyCount.set! user remaining
+        if remaining == 0 then
+          ready := heapInsert rank ready user
+    return components.toList
+
+/-! ## Artifact/result model -/
+
+/-- One dependency-ordered stored artifact.  Equal ordinary declarations and
+equal mutual blocks may be shared by several raw keys, so an artifact list can
+be shorter than the complete address map. -/
+inductive Artifact where
+  | stable (address : Address) (declaration : Decl)
+  | ordinary (address : Address) (declaration : Decl)
+  | mutual (block : MutualBlock.Result)
+
+namespace Artifact
+
+def declarations : Artifact → List (Address × Decl)
+  | .stable address declaration => [(address, declaration)]
+  | .ordinary address declaration => [(address, declaration)]
+  | .mutual block => block.members
+
+def identities : Artifact → List Address
+  | .stable address _ => [address]
+  | .ordinary address _ => [address]
+  | .mutual block => block.blockAddress :: block.derivedAddresses
+
+def contentAddressed : Artifact → Bool
+  | .stable _ (.extern _) => true
+  | .stable _ _ => false
+  | .ordinary address declaration => address == declaration.address
+  | .mutual block =>
+      block.blockAddress == MutualBlock.Block.address block.blockMembers &&
+        block.memberKeysDerived && block.blockStable
+
+end Artifact
+
+/-- A fully readdressed flat IxIR₁ program. -/
+structure Result where
+  artifacts : List Artifact
+  main : Code
+  addressMap : Renaming
+  /-- Caller-owned identities absent from the declaration producer
+  environment.  These are retained so constructor-key protection remains an
+  artifact-auditable fact rather than only a construction-time check. -/
+  reserved : List Address
+
+private def allUnique : List Address → Bool
+  | [] => true
+  | address :: rest => !rest.contains address && allUnique rest
+
+namespace Result
+
+def declarations (result : Result) : List (Address × Decl) :=
+  result.artifacts.flatMap Artifact.declarations
+
+/-- Forget artifact provenance while retaining the generic address-image
+interface used by `ReaddressSim`.  The generated-only pass's `Result` is also
+the semantic carrier for an arbitrary certified declaration image. -/
+def asReaddressResult (result : Result) : Readdress.Result :=
+  { source := result.declarations
+    generated := []
+    main := result.main
+    addressMap := result.addressMap }
+
+def blocks (result : Result) : List MutualBlock.Result :=
+  result.artifacts.filterMap fun
+    | .stable _ _ => none
+    | .ordinary _ _ => none
+    | .mutual block => some block
+
+def ordinary (result : Result) : List (Address × Decl) :=
+  result.artifacts.filterMap fun
+    | .stable _ _ => none
+    | .ordinary address declaration => some (address, declaration)
+    | .mutual _ => none
+
+def stable (result : Result) : List (Address × Decl) :=
+  result.artifacts.filterMap fun
+    | .stable address declaration => some (address, declaration)
+    | .ordinary _ _ | .mutual _ => none
+
+def blockAddresses (result : Result) : List Address :=
+  result.blocks.map (·.blockAddress)
+
+def transientAddresses (result : Result) : List Address :=
+  (result.addressMap.filter fun entry => entry.1 != entry.2).map (·.1)
+
+def finalAddresses (result : Result) : List Address :=
+  result.declarations.map (·.1)
+
+def noTransientKeys (result : Result) : Bool :=
+  !result.finalAddresses.any result.transientAddresses.contains
+
+def noTransientReferences (result : Result) : Bool :=
+  let references := result.declarations.flatMap fun entry =>
+    Readdress.Decl.references entry.2
+  !(references ++ Readdress.Code.references result.main).any
+    result.transientAddresses.contains
+
+def contentAddressed (result : Result) : Bool :=
+  result.artifacts.all Artifact.contentAddressed
+
+def protectsReserved (result : Result) : Bool :=
+  result.reserved.all fun address =>
+    Readdress.Renaming.apply result.addressMap address == address
+
+def mappingComplete (result : Result)
+    (raw : List (Address × Decl)) : Bool :=
+  result.addressMap.length == raw.length &&
+    raw.all fun entry => result.addressMap.contains entry.1
+
+/-- Total address action used to transport an already-addressed graph without
+adding semantic aliases to its source environment.  Existing producer keys
+move forward.  A newly emitted key that was not already a producer key moves
+back to one of its old (now unoccupied) producer spellings; every other
+address stays fixed. -/
+def rebuildRename (result : Result)
+    (raw : List (Address × Decl)) (address : Address) : Address :=
+  match Env.ofList raw address with
+  | some _ => Readdress.Renaming.apply result.addressMap address
+  | none =>
+      match result.addressMap.find? fun entry => entry.2 == address with
+      | some entry => entry.1
+      | none => address
+
+/-- Executable whole-program certificate.  It checks the exact declaration
+and main-code address image, fixed-point stability of every emitted lookup,
+canonical ordinary/block identities, complete provenance, and absence of the
+transient namespace. -/
+def semanticAudit (result : Result)
+    (raw : List (Address × Decl)) (rawMain : Code) : Bool :=
+  result.asReaddressResult.semanticAudit raw rawMain &&
+    (result.protectsReserved && result.mappingComplete raw &&
+      result.contentAddressed && allUnique result.finalAddresses &&
+      result.noTransientKeys && result.noTransientReferences)
+
+/-- Executable exact-source audit for rebuilding an already-addressed graph.
+Besides the ordinary content-address image audit, it checks that
+`rebuildRename` maps the main and every raw row to the emitted graph, that
+reverse-image keys land in holes of the emitted environment, and that every
+emitted declaration has a producer preimage.  Those finite checks eliminate
+the alias context needed by generic total readdressing. -/
+def rebuildSemanticAudit (result : Result)
+    (raw : List (Address × Decl)) (rawMain : Code) : Bool :=
+  let rename := result.rebuildRename raw
+  let emitted := Env.ofList result.declarations
+  let original := Env.ofList raw
+  result.semanticAudit raw rawMain &&
+    Readdress.Code.structurallyEq result.main
+      (Readdress.Code.mapAddresses rename rawMain) &&
+    raw.all (fun entry =>
+      match original entry.1, emitted (rename entry.1) with
+      | some before, some after =>
+          Readdress.Decl.structurallyEq before entry.2 &&
+            Readdress.Decl.structurallyEq after
+              (Readdress.Decl.mapAddresses rename before)
+      | _, _ => false) &&
+    result.addressMap.all (fun entry =>
+      (match original entry.2 with
+       | some _ => true
+       | none => (emitted entry.1).isNone) &&
+      match original entry.1 with
+      | some _ => result.rebuildRename raw entry.1 == entry.2
+      | none => false) &&
+    result.declarations.all (fun entry =>
+      result.addressMap.any fun mapping => mapping.2 == entry.1)
+
+/-- The whole-program audit contains the exact generic semantic image audit
+consumed by evaluator equivariance. -/
+theorem semanticAudit_asReaddressResult {result : Result}
+    {raw : List (Address × Decl)} {rawMain : Code}
+    (haudit : result.semanticAudit raw rawMain = true) :
+    result.asReaddressResult.semanticAudit raw rawMain = true := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  exact haudit.1
+
+theorem protectsReserved_of_semanticAudit {result : Result}
+    {raw : List (Address × Decl)} {rawMain : Code}
+    (haudit : result.semanticAudit raw rawMain = true) :
+    result.protectsReserved = true := by
+  simp only [semanticAudit, Bool.and_eq_true] at haudit
+  exact haudit.2.1.1.1.1.1
+
+/-- Pointwise constructor/reserved-identity stability exposed by the audited
+artifact. -/
+theorem apply_reserved {result : Result}
+    {raw : List (Address × Decl)} {rawMain : Code}
+    (haudit : result.semanticAudit raw rawMain = true)
+    {address : Address} (haddress : address ∈ result.reserved) :
+    Readdress.Renaming.apply result.addressMap address = address := by
+  have hfixed := (List.all_eq_true.mp
+    (result.protectsReserved_of_semanticAudit haudit)) address haddress
+  exact Address.eq_of_beq hfixed
+
+end Result
+
+abbrev CertifiedResult (reserved : List Address)
+    (raw : List (Address × Decl)) (rawMain : Code) :=
+  { result : Result //
+    result.semanticAudit raw rawMain = true ∧ result.reserved = reserved ∧
+      result.rebuildSemanticAudit raw rawMain = true }
+
+/-- A rebuilt graph additionally certifies transport from the exact old-keyed
+source environment, rather than only from the generic alias-bearing one. -/
+abbrev RebuildCertifiedResult (reserved : List Address)
+    (raw : List (Address × Decl)) (rawMain : Code) :=
+  { result : Result //
+    result.semanticAudit raw rawMain = true ∧ result.reserved = reserved ∧
+      result.rebuildSemanticAudit raw rawMain = true }
+
+/-! ## Dependency-ordered construction -/
+
+private def firstDuplicate? : List Address → Option Address
+  | [] => none
+  | address :: rest =>
+      if rest.contains address then some address else firstDuplicate? rest
+
+private def firstOverlap? (left right : List Address) : Option Address :=
+  left.find? right.contains
+
+private def externalReferences (keys : List Address)
+    (raw : List (Address × Decl)) (main : Code) : List Address :=
+  let references := raw.flatMap (fun entry =>
+      Readdress.Decl.references entry.2) ++ Readdress.Code.references main
+  references.filter fun address => !keys.contains address
+
+private def stableExternKeys (raw : List (Address × Decl)) : List Address :=
+  raw.filterMap fun
+    | (address, .extern _) => some address
+    | _ => none
+
+private structure BuildState where
+  addressMap : Renaming := []
+  /-- Reverse dependency order while building. -/
+  artifactsRev : List Artifact := []
+
+namespace BuildState
+
+def declarationKeys (state : BuildState) : List Address :=
+  state.artifactsRev.flatMap fun artifact =>
+    (Artifact.declarations artifact).map (·.1)
+
+def blockAddresses (state : BuildState) : List Address :=
+  state.artifactsRev.filterMap fun
+    | .stable _ _ => none
+    | .ordinary _ _ => none
+    | .mutual block => some block.blockAddress
+
+def usedIdentities (state : BuildState) : List Address :=
+  state.artifactsRev.flatMap Artifact.identities
+
+def findOrdinary? (state : BuildState) (address : Address) : Option Decl :=
+  let rec loop : List Artifact → Option Decl
+    | [] => none
+    | .stable _ _ :: rest => loop rest
+    | .ordinary found declaration :: rest =>
+        if found == address then some declaration else loop rest
+    | .mutual _ :: rest => loop rest
+  loop state.artifactsRev
+
+def findBlock? (state : BuildState)
+    (address : Address) : Option MutualBlock.Result :=
+  let rec loop : List Artifact → Option MutualBlock.Result
+    | [] => none
+    | .stable _ _ :: rest => loop rest
+    | .ordinary _ _ :: rest => loop rest
+    | .mutual block :: rest =>
+        if block.blockAddress == address then some block else loop rest
+  loop state.artifactsRev
+
+end BuildState
+
+private def samePreimage (left right : Decl) : Bool :=
+  left.preimage == right.preimage
+
+private def appendMap (state : BuildState) (mapping : Renaming) : BuildState :=
+  { state with addressMap := state.addressMap ++ mapping }
+
+/-- Preserve an opaque extern ABI identity.  Its declaration bytes encode
+only arity and therefore cannot independently identify the oracle ledger. -/
+private def installStable (old : Address) (declaration : Decl)
+    (state : BuildState) : Except String BuildState :=
+  match declaration with
+  | .extern _ =>
+      .ok
+        { addressMap := state.addressMap ++ [(old, old)]
+          artifactsRev := .stable old declaration :: state.artifactsRev }
+  | _ => .error "internal: non-extern declaration reached stable installation"
+
+/-- Hash and install one acyclic singleton. -/
+private def installOrdinary (keys protectedIdentities : List Address)
+    (old : Address) (rawDeclaration : Decl)
+    (state : BuildState) : Except String BuildState := do
+  let declaration := Readdress.Decl.mapAddresses
+    (Readdress.Renaming.apply state.addressMap) rawDeclaration
+  let address := declaration.address
+  if keys.contains address then
+    throw s!"IxIR1 content address overlaps transient namespace {Address.toHex address}"
+  if protectedIdentities.contains address then
+    throw s!"IxIR1 content address collides with protected identity {Address.toHex address}"
+  match state.findOrdinary? address with
+  | some found =>
+      if samePreimage found declaration then
+        return appendMap state [(old, address)]
+      else
+        throw s!"BLAKE3 collision while readdressing IxIR1 declaration {Address.toHex old}"
+  | none =>
+      if state.usedIdentities.contains address then
+        .error s!"IxIR1 declaration address collides with a mutual-block identity {Address.toHex address}"
+      else
+        .ok
+          { addressMap := state.addressMap ++ [(old, address)]
+            artifactsRev := .ordinary address declaration :: state.artifactsRev }
+
+/-- Build or exact-content-deduplicate one cyclic component. -/
+private def installMutual (keys protectedIdentities : List Address)
+    (component : Component) (state : BuildState) : Except String BuildState := do
+  let localKeys := component.keys
+  let rename := Readdress.Renaming.apply state.addressMap
+  let rewritten := component.members.map fun entry =>
+    (entry.1, Readdress.Decl.mapAddresses rename entry.2)
+  /- Protect every other producer key here.  The one-block constructor already
+  protects this component's own transient keys and all of its external edges. -/
+  let otherTransient := keys.filter fun address => !localKeys.contains address
+  let candidate ← MutualBlock.run
+    (protectedIdentities ++ otherTransient) rewritten
+  match state.findBlock? candidate.blockAddress with
+  | some existing =>
+      if MutualBlock.DeclList.structurallyEq
+          existing.blockMembers candidate.blockMembers then
+        if existing.derivedAddresses == candidate.derivedAddresses then
+          return appendMap state candidate.addressMap
+        else
+          throw "internal: equal IxIR1 mutual blocks derived different member keys"
+      else
+        throw s!"BLAKE3 collision between IxIR1 mutual blocks {Address.toHex candidate.blockAddress}"
+  | none =>
+      if state.usedIdentities.contains candidate.blockAddress then
+        .error s!"IxIR1 mutual-block identity collides with an emitted identity {Address.toHex candidate.blockAddress}"
+      else
+        match firstOverlap? candidate.derivedAddresses
+            state.usedIdentities with
+        | some overlap =>
+            .error s!"IxIR1 mutual-block member key collides with an emitted identity {Address.toHex overlap}"
+        | none =>
+            .ok
+              { addressMap := state.addressMap ++ candidate.addressMap
+                artifactsRev := .mutual candidate :: state.artifactsRev }
+
+private def installComponent (keys protectedIdentities : List Address)
+    (component : Component) (state : BuildState) : Except String BuildState :=
+  if component.cyclic then
+    installMutual keys protectedIdentities component state
+  else
+    match component.members with
+    | [(old, declaration@(.extern _))] =>
+        installStable old declaration state
+    | [(old, declaration)] =>
+        installOrdinary keys protectedIdentities old declaration state
+    | _ => .error "internal: non-cyclic IxIR1 SCC was not a singleton"
+
+private def build (keys protectedIdentities : List Address) :
+    List Component → BuildState → Except String BuildState
+  | [], state => .ok state
+  | component :: rest, state => do
+      let state ← installComponent keys protectedIdentities component state
+      build keys protectedIdentities rest state
+
+private def certify (reserved : List Address)
+    (raw : List (Address × Decl)) (rawMain : Code)
+    (result : Result) : Except String (CertifiedResult reserved raw rawMain) :=
+  if haudit : result.semanticAudit raw rawMain then
+    if hreserved : result.reserved = reserved then
+      if hexact : result.rebuildSemanticAudit raw rawMain then
+        .ok ⟨result, haudit, hreserved, hexact⟩
+      else
+        .error "internal: whole-program IxIR1 readdressing failed exact-source semantic audit"
+    else
+      .error "internal: whole-program IxIR1 readdressing retained the wrong reserved identities"
+  else
+    .error "internal: whole-program IxIR1 readdressing failed semantic audit"
+
+/-- Discover, dependency-order, and content-address a complete flat IxIR₁
+environment.  `reserved` contains caller-owned identities that are not
+declaration producer keys (notably constructor/oracle identities). -/
+def runCertified (reserved : List Address)
+    (raw : List (Address × Decl)) (main : Code) :
+    Except String (CertifiedResult reserved raw main) := do
+  let keys := raw.map (·.1)
+  if let some duplicate := firstDuplicate? keys then
+    throw s!"duplicate IxIR1 declaration producer key {Address.toHex duplicate}"
+  if let some overlap := firstOverlap? keys reserved then
+    throw s!"IxIR1 declaration producer key overlaps reserved identity {Address.toHex overlap}"
+  let protectedIdentities :=
+    reserved ++ stableExternKeys raw ++ externalReferences keys raw main
+  let components := discoverComponentsDependencyFirst raw
+  let state ← build keys protectedIdentities components {}
+  let result : Result :=
+    { artifacts := state.artifactsRev.reverse
+      main := Readdress.Code.mapAddresses
+        (Readdress.Renaming.apply state.addressMap) main
+      addressMap := state.addressMap
+      reserved }
+  unless result.mappingComplete raw do
+    throw "internal: whole-program IxIR1 readdressing produced an incomplete map"
+  unless result.noTransientKeys do
+    throw "internal: whole-program IxIR1 readdressing emitted a transient key"
+  unless result.noTransientReferences do
+    throw "internal: whole-program IxIR1 readdressing left a transient reference"
+  unless result.protectsReserved do
+    throw "internal: whole-program IxIR1 readdressing rewrote a reserved identity"
+  certify reserved raw main result
+
+def run (reserved : List Address)
+    (raw : List (Address × Decl)) (main : Code) : Except String Result := do
+  return (← runCertified reserved raw main).1
+
+/-! ## Rebuilding an already-addressed graph -/
+
+/-- Domain-separated temporary producer name used only while rebuilding an
+already-content-addressed graph.  It cannot escape: `rebuildCertified`
+re-certifies the final artifact against the caller's original keys. -/
+def rebuildTemporaryAddress (address : Address) : Address :=
+  Address.blake3
+    (IxIR.Encoding.domain "compilatrix/ixir1/rebuild-temporary/1" ++
+      IxIR.Encoding.address address)
+
+/-- Existing extern keys are stable ABI identities; function keys receive a
+temporary producer spelling before the ordinary SCC pass runs again. -/
+def rebuildTemporaryRenaming (raw : List (Address × Decl)) : Renaming :=
+  raw.map fun entry =>
+    match entry.2 with
+    | .fn _ => (entry.1, rebuildTemporaryAddress entry.1)
+    | .extern _ => (entry.1, entry.1)
+
+private def rebuildTemporaryKeys
+    (raw : List (Address × Decl)) : List Address :=
+  raw.filterMap fun entry =>
+    match entry.2 with
+    | .fn _ => some (rebuildTemporaryAddress entry.1)
+    | .extern _ => none
+
+private def composeRebuildMap (raw : List (Address × Decl))
+    (temporary final : Renaming) : Renaming :=
+  raw.map fun entry =>
+    (entry.1, Readdress.Renaming.apply final
+      (Readdress.Renaming.apply temporary entry.1))
+
+/-- Rebuild a graph whose current keys may already be its declaration or
+mutual-block content addresses.  The ordinary producer rejects output keys in
+its transient namespace, so this adapter first alpha-renames function
+producers into a domain-separated temporary namespace.  Extern identities and
+all caller-owned/external identities remain fixed.  The returned result is
+then certified directly against the original graph; neither a temporary key
+nor the intermediate address map is exposed. -/
+def rebuildCertified (reserved : List Address)
+    (raw : List (Address × Decl)) (main : Code) :
+    Except String (RebuildCertifiedResult reserved raw main) := do
+  let keys := raw.map (·.1)
+  if let some duplicate := firstDuplicate? keys then
+    throw s!"duplicate IxIR1 declaration key while rebuilding {Address.toHex duplicate}"
+  let temporaryKeys := rebuildTemporaryKeys raw
+  let protectedIdentities :=
+    keys ++ reserved ++ externalReferences keys raw main
+  if let some overlap := firstOverlap? temporaryKeys protectedIdentities then
+    throw s!"IxIR1 rebuild temporary address collides with an existing identity {Address.toHex overlap}"
+  if let some duplicate := firstDuplicate? temporaryKeys then
+    throw s!"BLAKE3 collision between IxIR1 rebuild temporary addresses {Address.toHex duplicate}"
+  let temporary := rebuildTemporaryRenaming raw
+  let rename := Readdress.Renaming.apply temporary
+  let temporaryRaw := raw.map fun entry =>
+    (rename entry.1, Readdress.Decl.mapAddresses rename entry.2)
+  let temporaryMain := Readdress.Code.mapAddresses rename main
+  let intermediate ← runCertified reserved temporaryRaw temporaryMain
+  let result : Result :=
+    { intermediate.1 with
+      addressMap := composeRebuildMap raw temporary
+        intermediate.1.addressMap
+      reserved }
+  if haudit : result.semanticAudit raw main then
+    if hreserved : result.reserved = reserved then
+      if hexact : result.rebuildSemanticAudit raw main then
+        return ⟨result, haudit, hreserved, hexact⟩
+      else
+        throw "internal: IxIR1 rebuild failed exact-source semantic audit"
+    else
+      throw "internal: IxIR1 rebuild retained the wrong reserved identities"
+  else
+    throw "internal: IxIR1 rebuild failed semantic audit"
+
+/-- Unbundled already-addressed graph rebuild. -/
+def rebuild (reserved : List Address)
+    (raw : List (Address × Decl)) (main : Code) : Except String Result := do
+  return (← rebuildCertified reserved raw main).1
+
+theorem semanticAudit_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrebuild : rebuild reserved raw main = .ok result) :
+    result.semanticAudit raw main = true := by
+  unfold rebuild at hrebuild
+  cases hcertified : rebuildCertified reserved raw main with
+  | error message =>
+      rw [hcertified] at hrebuild
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrebuild
+      have hvalue : certified.1 = result := by injection hrebuild
+      subst result
+      exact certified.2.1
+
+theorem reserved_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrebuild : rebuild reserved raw main = .ok result) :
+    result.reserved = reserved := by
+  unfold rebuild at hrebuild
+  cases hcertified : rebuildCertified reserved raw main with
+  | error message =>
+      rw [hcertified] at hrebuild
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrebuild
+      have hvalue : certified.1 = result := by injection hrebuild
+      subst result
+      exact certified.2.2.1
+
+theorem rebuildSemanticAudit_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrebuild : rebuild reserved raw main = .ok result) :
+    result.rebuildSemanticAudit raw main = true := by
+  unfold rebuild at hrebuild
+  cases hcertified : rebuildCertified reserved raw main with
+  | error message =>
+      rw [hcertified] at hrebuild
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrebuild
+      have hvalue : certified.1 = result := by injection hrebuild
+      subst result
+      exact certified.2.2.2
+
+theorem semanticAudit_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrun : run reserved raw main = .ok result) :
+    result.semanticAudit raw main = true := by
+  unfold run at hrun
+  cases hcertified : runCertified reserved raw main with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2.1
+
+theorem reserved_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrun : run reserved raw main = .ok result) :
+    result.reserved = reserved := by
+  unfold run at hrun
+  cases hcertified : runCertified reserved raw main with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2.2.1
+
+/-- Every successful ordinary SCC pass supports transport from the exact raw
+declaration environment, without installing aliases at newly emitted content
+keys. -/
+theorem rebuildSemanticAudit_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrun : run reserved raw main = .ok result) :
+    result.rebuildSemanticAudit raw main = true := by
+  unfold run at hrun
+  cases hcertified : runCertified reserved raw main with
+  | error message =>
+      rw [hcertified] at hrun
+      contradiction
+  | ok certified =>
+      rw [hcertified] at hrun
+      have hvalue : certified.1 = result := by injection hrun
+      subst result
+      exact certified.2.2.2
+
+theorem protectsReserved_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result} (hrun : run reserved raw main = .ok result) :
+    result.protectsReserved = true :=
+  Result.protectsReserved_of_semanticAudit
+    (semanticAudit_of_run_eq_ok hrun)
+
+/-! Pure SCC/dispatch guards.  Digest behavior is exercised by the compiled
+test executable. -/
+
+private def fixtureA : Address := Address.replicate 0xa1
+private def fixtureB : Address := Address.replicate 0xa2
+private def fixtureC : Address := Address.replicate 0xa3
+private def fixtureD : Address := Address.replicate 0xa4
+
+private def fixtureRaw : List (Address × Decl) :=
+  [(fixtureA, .fn ⟨1, .shared, true,
+      .letOp (.call fixtureB #[.var 0]) (.ret (.var 0))⟩),
+   (fixtureB, .fn ⟨0, .shared, true,
+      .letOp (.papp fixtureA #[]) (.ret .erased)⟩),
+   (fixtureC, .fn ⟨0, .shared, true,
+      .letOp (.call fixtureA #[]) (.ret .erased)⟩),
+   (fixtureD, .extern 0)]
+
+#guard (discoverComponents fixtureRaw).map Component.keys ==
+  [[fixtureA, fixtureB], [fixtureC], [fixtureD]]
+#guard (discoverComponents
+  [(fixtureA, .fn ⟨0, .shared, true,
+      .letOp (.call fixtureA #[]) (.ret .erased)⟩)]).all Component.cyclic
+#guard !(discoverComponents
+  [(fixtureA, .fn ⟨0, .shared, true,
+      .letOp (.callSelf #[]) (.ret .erased)⟩)]).any Component.cyclic
+
+end ReaddressAll
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/ReaddressAllSim.lean b/Ix/Compiler/IxIR1/ReaddressAllSim.lean
new file mode 100644
index 000000000..a801e59c7
--- /dev/null
+++ b/Ix/Compiler/IxIR1/ReaddressAllSim.lean
@@ -0,0 +1,355 @@
+import Ix.Compiler.IxIR1.ReaddressAll
+import Ix.Compiler.IxIR1.ReaddressSim
+
+/-!
+# Semantic transport for whole-program IxIR₁ readdressing
+
+`ReaddressAll.Result` retains richer stable/ordinary/block provenance than the
+generated-only result, but its semantic core is the same exact address image.
+This module projects that core into the already proved evaluator equivariance
+interface and exposes concrete successful-run transport for the SCC pass.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address)
+
+namespace ReaddressAll
+
+namespace Result
+
+def addressedCtx (result : Result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Ctx :=
+  result.asReaddressResult.addressedCtx oracle
+
+def preAddressCtx (result : Result)
+    (raw : List (Address × Decl))
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Ctx :=
+  result.asReaddressResult.preAddressCtx raw oracle
+
+/-- Exact old-keyed source context for a certified rebuild.  Unlike
+`preAddressCtx`, its declaration environment contains no aliases. -/
+def rebuildSourceCtx (result : Result)
+    (raw : List (Address × Decl))
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Ctx :=
+  { decls := Env.ofList raw
+    oracle := fun address arguments =>
+      oracle (result.rebuildRename raw address) arguments }
+
+theorem main_eq_mapAddresses {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.semanticAudit raw main = true) :
+    result.main = Readdress.Code.mapAddresses
+      (Readdress.Renaming.apply result.addressMap) main := by
+  exact result.asReaddressResult.main_eq_mapAddresses
+    (result.semanticAudit_asReaddressResult haudit)
+
+theorem renames_preAddressCtx {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.semanticAudit raw main = true)
+    (oracle : Address → List RVal → Option RVal) :
+    Readdress.Ctx.Renames
+      (Readdress.Renaming.apply result.addressMap)
+      (result.preAddressCtx raw oracle) (result.addressedCtx oracle) := by
+  exact result.asReaddressResult.renames_preAddressCtx
+    (result.semanticAudit_asReaddressResult haudit) oracle
+
+private theorem envOfList_some_mem
+    {entries : List (Address × Decl)} {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList entries address = some declaration) :
+    (address, declaration) ∈ entries := by
+  unfold Env.ofList at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryDeclaration⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × Decl => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hdeclaration : entryDeclaration = declaration := by
+    simpa using hvalue
+  subst entryAddress
+  subst entryDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+/-- The finite exact-source rebuild audit reflects into the total context
+relation used by evaluator equivariance. -/
+theorem renames_rebuildSourceCtx {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.rebuildSemanticAudit raw main = true)
+    (oracle : Address → List RVal → Option RVal) :
+    Readdress.Ctx.Renames (result.rebuildRename raw)
+      (result.rebuildSourceCtx raw oracle) (result.addressedCtx oracle) := by
+  simp only [Result.rebuildSemanticAudit, Bool.and_eq_true] at haudit
+  constructor
+  · intro address
+    simp only [Result.addressedCtx, Result.rebuildSourceCtx,
+      Readdress.Result.addressedCtx, Readdress.Result.declarations,
+      Result.asReaddressResult, List.append_nil]
+    change Env.ofList result.declarations (result.rebuildRename raw address) =
+      (Env.ofList raw address).map
+        (Readdress.Decl.mapAddresses (result.rebuildRename raw))
+    cases horiginal : Env.ofList raw address with
+    | some declaration =>
+        have hmember : (address, declaration) ∈ raw :=
+          envOfList_some_mem horiginal
+        have hrow := (List.all_eq_true.mp haudit.1.1.2)
+          (address, declaration) hmember
+        simp only [Result.rebuildRename, horiginal] at hrow
+        cases hemitted : Env.ofList result.declarations
+            (Readdress.Renaming.apply result.addressMap address) with
+        | none => simp [hemitted] at hrow
+        | some emitted =>
+            simp only [hemitted, Bool.and_eq_true] at hrow
+            have hequal : emitted = Readdress.Decl.mapAddresses
+                (result.rebuildRename raw) declaration :=
+              (Readdress.Decl.structurallyEq_eq_true_iff _ _).mp (by
+                simpa [horiginal, hemitted] using hrow.2)
+            simp [Result.rebuildRename, horiginal, hemitted, hequal]
+    | none =>
+        cases hreverse : result.addressMap.find?
+            (fun entry => entry.2 == address) with
+        | some mapping =>
+            rcases mapping with ⟨source, target⟩
+            have htargetBeq : target == address :=
+              List.find?_some
+                (p := fun entry : Address × Address => entry.2 == address)
+                hreverse
+            have htarget : target = address := Address.eq_of_beq htargetBeq
+            subst target
+            have hmember : (source, address) ∈ result.addressMap :=
+              List.mem_of_find?_eq_some hreverse
+            have hpair := (List.all_eq_true.mp haudit.1.2)
+              (source, address) hmember
+            simp only [Bool.and_eq_true] at hpair
+            have hsafe := hpair.1
+            simp only [horiginal] at hsafe
+            simp only [Result.rebuildRename, horiginal, hreverse,
+              Option.map_none]
+            simpa using hsafe
+        | none =>
+            simp only [Result.rebuildRename, horiginal, hreverse,
+              Option.map_none]
+            cases hemitted : Env.ofList result.declarations address with
+            | none => rfl
+            | some declaration =>
+                have hmember : (address, declaration) ∈ result.declarations :=
+                  envOfList_some_mem hemitted
+                have hcovered := (List.all_eq_true.mp haudit.2)
+                  (address, declaration) hmember
+                obtain ⟨mapping, hmapping, hmaps⟩ :=
+                  List.any_eq_true.mp hcovered
+                have hmissing := (List.find?_eq_none.mp hreverse)
+                  mapping hmapping
+                exact (hmissing hmaps).elim
+  · intro address arguments
+    rfl
+
+/-- Every literal raw row is selected by the exact source environment carried
+by the rebuild audit.  Ordinary initial addressing and rebuilding both expose
+this fact through their successful-run certificates. -/
+theorem raw_lookup_of_mem_of_rebuildSemanticAudit {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.rebuildSemanticAudit raw main = true)
+    {address : Address} {declaration : Decl}
+    (hmember : (address, declaration) ∈ raw) :
+    Env.ofList raw address = some declaration := by
+  simp only [Result.rebuildSemanticAudit, Bool.and_eq_true] at haudit
+  have hrow := (List.all_eq_true.mp haudit.1.1.2)
+    (address, declaration) hmember
+  cases hlookup : Env.ofList raw address with
+  | none => simp [hlookup] at hrow
+  | some selected =>
+      cases hemitted : Env.ofList result.declarations
+          (result.rebuildRename raw address) with
+      | none => simp [hlookup, hemitted] at hrow
+      | some emitted =>
+          simp only [hlookup, hemitted, Bool.and_eq_true] at hrow
+          have hselected : selected = declaration :=
+            (Readdress.Decl.structurallyEq_eq_true_iff _ _).mp hrow.1
+          simpa [hlookup, hselected]
+
+/-- Every selected emitted declaration has an exact raw producer whose key
+maps to the emitted key and whose declaration maps to the selected value.
+This is the lookup-facing provenance needed to back-translate reachable
+runtime heaps without requiring the rebuild map to be globally surjective. -/
+theorem declaration_preimage_of_lookup_of_rebuildSemanticAudit
+    {result : Result} {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.rebuildSemanticAudit raw main = true)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList result.declarations address = some declaration) :
+    ∃ sourceAddress sourceDeclaration,
+      Env.ofList raw sourceAddress = some sourceDeclaration ∧
+        result.rebuildRename raw sourceAddress = address ∧
+        Readdress.Decl.mapAddresses (result.rebuildRename raw)
+          sourceDeclaration = declaration := by
+  have hrenames :=
+    result.renames_rebuildSourceCtx haudit (fun _ _ => none)
+  simp only [Result.rebuildSemanticAudit, Bool.and_eq_true] at haudit
+  have hmember : (address, declaration) ∈ result.declarations :=
+    envOfList_some_mem hlookup
+  have hcovered := (List.all_eq_true.mp haudit.2)
+    (address, declaration) hmember
+  obtain ⟨mapping, mappingMember, mapsTo⟩ :=
+    List.any_eq_true.mp hcovered
+  obtain ⟨sourceAddress, targetAddress⟩ := mapping
+  have targetEq : targetAddress = address := Address.eq_of_beq mapsTo
+  subst targetAddress
+  have hsourcePair := (List.all_eq_true.mp haudit.1.2)
+    (sourceAddress, address) mappingMember
+  simp only [Bool.and_eq_true] at hsourcePair
+  have hsource := hsourcePair.2
+  cases sourceLookup : Env.ofList raw sourceAddress with
+  | none => simp [sourceLookup] at hsource
+  | some sourceDeclaration =>
+      have renameEq : result.rebuildRename raw sourceAddress = address := by
+        exact Address.eq_of_beq (by simpa [sourceLookup] using hsource)
+      have relation := hrenames.decls sourceAddress
+      simp only [Result.addressedCtx, Result.rebuildSourceCtx,
+        Readdress.Result.addressedCtx, Readdress.Result.declarations,
+        Result.asReaddressResult, List.append_nil] at relation
+      rw [renameEq, hlookup, sourceLookup] at relation
+      simp only [Option.map_some, Option.some.injEq] at relation
+      exact ⟨sourceAddress, sourceDeclaration, sourceLookup, renameEq,
+        relation.symm⟩
+
+theorem main_eq_rebuildMapAddresses {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.rebuildSemanticAudit raw main = true) :
+    result.main = Readdress.Code.mapAddresses
+      (result.rebuildRename raw) main := by
+  simp only [Result.rebuildSemanticAudit, Bool.and_eq_true] at haudit
+  exact (Readdress.Code.structurallyEq_eq_true_iff _ _).mp
+    haudit.1.1.1.2
+
+end Result
+
+/-- A successful SCC pass transports the complete evaluator result, including
+heap-retained constructor/PAP addresses, address-bearing errors, and counters. -/
+theorem runMain_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : run reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      Readdress.mapRunResult
+        (Readdress.Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx raw oracle) main fuel) := by
+  have haudit := semanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_mapAddresses haudit]
+  exact Readdress.runMain_mapAddresses
+    (result.renames_preAddressCtx haudit oracle) main fuel
+
+theorem runMain_success_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : run reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    {fuel : Nat} {store : Store} {value : RVal}
+    (hsource : runMain (result.preAddressCtx raw oracle) main fuel =
+      .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      .ok (Readdress.Store.mapAddresses
+        (Readdress.Renaming.apply result.addressMap) store, value) := by
+  rw [runMain_of_run_eq_ok hrun oracle fuel, hsource]
+  rfl
+
+/-- Exact-source transport for the ordinary SCC pass.  Successful initial
+content addressing now certifies the same alias-free source view as rebuilds. -/
+theorem runMain_exact_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : run reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      Readdress.mapRunResult (result.rebuildRename raw)
+        (runMain (result.rebuildSourceCtx raw oracle) main fuel) := by
+  have haudit := rebuildSemanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_rebuildMapAddresses haudit]
+  exact Readdress.runMain_mapAddresses
+    (result.renames_rebuildSourceCtx haudit oracle) main fuel
+
+/-- Successful-run specialization of ordinary exact-source transport. -/
+theorem runMain_exact_success_of_run_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : run reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    {fuel : Nat} {store : Store} {value : RVal}
+    (hsource : runMain (result.rebuildSourceCtx raw oracle) main fuel =
+      .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      .ok (Readdress.Store.mapAddresses
+        (result.rebuildRename raw) store, value) := by
+  rw [runMain_exact_of_run_eq_ok hrun oracle fuel, hsource]
+  rfl
+
+/-- The already-addressed rebuild adapter has the same complete evaluator
+transport as the initial SCC pass.  Its source context contains the original
+rows plus the stable aliases required by total address equivariance. -/
+theorem runMain_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrebuild : rebuild reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      Readdress.mapRunResult
+        (Readdress.Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx raw oracle) main fuel) := by
+  have haudit := semanticAudit_of_rebuild_eq_ok hrebuild
+  rw [result.main_eq_mapAddresses haudit]
+  exact Readdress.runMain_mapAddresses
+    (result.renames_preAddressCtx haudit oracle) main fuel
+
+/-- Successful-run specialization for rebuilding an already-addressed graph. -/
+theorem runMain_success_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrebuild : rebuild reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    {fuel : Nat} {store : Store} {value : RVal}
+    (hsource : runMain (result.preAddressCtx raw oracle) main fuel =
+      .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      .ok (Readdress.Store.mapAddresses
+        (Readdress.Renaming.apply result.addressMap) store, value) := by
+  rw [runMain_of_rebuild_eq_ok hrebuild oracle fuel, hsource]
+  rfl
+
+/-- Exact-source transport for rebuilding an already-addressed graph.  The
+source declaration environment is precisely `Env.ofList raw`; no newly
+emitted content key is installed as an alias. -/
+theorem runMain_exact_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrebuild : rebuild reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      Readdress.mapRunResult (result.rebuildRename raw)
+        (runMain (result.rebuildSourceCtx raw oracle) main fuel) := by
+  have haudit := rebuildSemanticAudit_of_rebuild_eq_ok hrebuild
+  rw [result.main_eq_rebuildMapAddresses haudit]
+  exact Readdress.runMain_mapAddresses
+    (result.renames_rebuildSourceCtx haudit oracle) main fuel
+
+/-- Successful-run specialization of exact-source rebuild transport. -/
+theorem runMain_exact_success_of_rebuild_eq_ok
+    {reserved : List Address} {raw : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrebuild : rebuild reserved raw main = .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    {fuel : Nat} {store : Store} {value : RVal}
+    (hsource : runMain (result.rebuildSourceCtx raw oracle) main fuel =
+      .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      .ok (Readdress.Store.mapAddresses
+        (result.rebuildRename raw) store, value) := by
+  rw [runMain_exact_of_rebuild_eq_ok hrebuild oracle fuel, hsource]
+  rfl
+
+end ReaddressAll
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/ReaddressOwnership.lean b/Ix/Compiler/IxIR1/ReaddressOwnership.lean
new file mode 100644
index 000000000..5359b867b
--- /dev/null
+++ b/Ix/Compiler/IxIR1/ReaddressOwnership.lean
@@ -0,0 +1,158 @@
+import Ix.Compiler.IxIR1.Sim
+import Ix.Compiler.IxIR1.ReaddressSim
+
+/-!
+# Ownership invariance under IxIR₁ address renaming
+
+Readdressing changes declaration identities retained by constructor and PAP
+nodes, but it leaves locations, ownership worlds, reference counts, and heap
+edges unchanged.  This file exposes that fact at the exact `RootOwnership`
+boundary used by compiler simulations.
+-/
+
+namespace Ix.Compiler.IxIR1.Sim
+
+@[simp] theorem nodeChildren_mapAddresses
+    (rename : Ixon.Address → Ixon.Address) (node : IxIR1.Node) :
+    nodeChildren (IxIR1.Readdress.Node.mapAddresses rename node) =
+      nodeChildren node := by
+  cases node <;> rfl
+
+@[simp] theorem slotEdgeLocations_mapAddresses
+    (rename : Ixon.Address → Ixon.Address)
+    (slot : Option IxIR1.NodeBox) :
+    slotEdgeLocations
+        (slot.map (IxIR1.Readdress.NodeBox.mapAddresses rename)) =
+      slotEdgeLocations slot := by
+  cases slot with
+  | none => rfl
+  | some box =>
+      simp [slotEdgeLocations, IxIR1.Readdress.NodeBox.mapAddresses,
+        nodeChildren_mapAddresses]
+
+@[simp] theorem edgeLocations_mapAddresses
+    (rename : Ixon.Address → Ixon.Address) (store : IxIR1.Store) :
+    edgeLocations (IxIR1.Readdress.Store.mapAddresses rename store) =
+      edgeLocations store := by
+  simp only [edgeLocations, IxIR1.Readdress.Store.mapAddresses,
+    Array.toList_map, List.flatMap_map]
+  apply congrArg (fun visit => List.flatMap visit store.nodes.toList)
+  funext slot
+  exact slotEdgeLocations_mapAddresses rename slot
+
+@[simp] theorem incoming_mapAddresses
+    (rename : Ixon.Address → Ixon.Address) (store : IxIR1.Store)
+    (roots : List Root) (location : Nat) :
+    incoming (IxIR1.Readdress.Store.mapAddresses rename store) roots location =
+      incoming store roots location := by
+  simp [incoming, edgeLocations_mapAddresses]
+
+/-- Heap-world evidence ignores the declaration identities stored below a
+live node. -/
+theorem hasWorld_mapAddresses_iff
+    (rename : Ixon.Address → Ixon.Address) (store : IxIR1.Store)
+    (world : Ixon.Owned) (value : IxIR1.RVal) :
+    HasWorld (IxIR1.Readdress.Store.mapAddresses rename store) world value ↔
+      HasWorld store world value := by
+  cases value with
+  | lit literal => simp [HasWorld]
+  | erased => simp [HasWorld]
+  | loc location =>
+      simp only [HasWorld, IxIR1.Readdress.Store.get?_mapAddresses]
+      constructor
+      · rintro ⟨mapped, mappedAt, mappedWorld⟩
+        cases originalAt : store.get? location with
+        | none => simp [originalAt] at mappedAt
+        | some original =>
+            simp only [originalAt, Option.map_some,
+              Option.some.injEq] at mappedAt
+            subst mapped
+            exact ⟨original, rfl, by simpa using mappedWorld⟩
+      · rintro ⟨original, originalAt, originalWorld⟩
+        exact ⟨IxIR1.Readdress.NodeBox.mapAddresses rename original,
+          by simp [originalAt], by simpa using originalWorld⟩
+
+/-- Exact root ownership is invariant under arbitrary declaration-address
+renaming.  Constructor/PAP identities are operational metadata rather than
+heap edges; all ownership-relevant structure is unchanged. -/
+theorem rootOwnership_mapAddresses_iff
+    (rename : Ixon.Address → Ixon.Address) (store : IxIR1.Store)
+    (roots : List Root) :
+    RootOwnership (IxIR1.Readdress.Store.mapAddresses rename store) roots ↔
+      RootOwnership store roots := by
+  constructor
+  · intro mappedOwnership
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro root member
+      exact (hasWorld_mapAddresses_iff rename store root.world
+        root.value).mp (mappedOwnership.roots_world root member)
+    · intro location box boxAt child childMember
+      have mappedAt :
+          (IxIR1.Readdress.Store.mapAddresses rename store).get? location =
+            some (IxIR1.Readdress.NodeBox.mapAddresses rename box) := by
+        simp [boxAt]
+      have mappedChild : child ∈ nodeChildren
+          (IxIR1.Readdress.NodeBox.mapAddresses rename box).node := by
+        simpa using childMember
+      exact (hasWorld_mapAddresses_iff rename store box.world child).mp
+        (by simpa using mappedOwnership.edges_world mappedAt child mappedChild)
+    · intro location box function arity arguments boxAt node
+      have mappedAt :
+          (IxIR1.Readdress.Store.mapAddresses rename store).get? location =
+            some (IxIR1.Readdress.NodeBox.mapAddresses rename box) := by
+        simp [boxAt]
+      have mappedNode :
+          (IxIR1.Readdress.NodeBox.mapAddresses rename box).node =
+            .papN (rename function) arity arguments := by
+        rw [IxIR1.Readdress.NodeBox.mapAddresses_node, node]
+        rfl
+      simpa using mappedOwnership.pap_shared mappedAt mappedNode
+    · intro location box boxAt
+      have mappedAt :
+          (IxIR1.Readdress.Store.mapAddresses rename store).get? location =
+            some (IxIR1.Readdress.NodeBox.mapAddresses rename box) := by
+        simp [boxAt]
+      simpa using mappedOwnership.counts mappedAt
+  · intro ownership
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro root member
+      exact (hasWorld_mapAddresses_iff rename store root.world
+        root.value).mpr (ownership.roots_world root member)
+    · intro location mappedBox mappedAt child childMember
+      cases boxAt : store.get? location with
+      | none => simp [boxAt] at mappedAt
+      | some box =>
+          simp only [IxIR1.Readdress.Store.get?_mapAddresses, boxAt,
+            Option.map_some, Option.some.injEq] at mappedAt
+          subst mappedBox
+          have originalChild : child ∈ nodeChildren box.node := by
+            simpa using childMember
+          exact (hasWorld_mapAddresses_iff rename store box.world child).mpr
+            (ownership.edges_world boxAt child originalChild)
+    · intro location mappedBox function arity arguments mappedAt mappedNode
+      cases boxAt : store.get? location with
+      | none => simp [boxAt] at mappedAt
+      | some box =>
+          simp only [IxIR1.Readdress.Store.get?_mapAddresses, boxAt,
+            Option.map_some, Option.some.injEq] at mappedAt
+          subst mappedBox
+          cases nodeEq : box.node with
+          | ctorN cid fields =>
+              simp [IxIR1.Readdress.NodeBox.mapAddresses,
+                IxIR1.Readdress.Node.mapAddresses, nodeEq] at mappedNode
+          | papN originalFunction originalArity originalArguments =>
+              have originalShared : box.world = .shared :=
+                ownership.pap_shared (loc := location) (box := box)
+                  (f := originalFunction) (arity := originalArity)
+                  (args := originalArguments) boxAt nodeEq
+              simpa using originalShared
+    · intro location mappedBox mappedAt
+      cases boxAt : store.get? location with
+      | none => simp [boxAt] at mappedAt
+      | some box =>
+          simp only [IxIR1.Readdress.Store.get?_mapAddresses, boxAt,
+            Option.map_some, Option.some.injEq] at mappedAt
+          subst mappedBox
+          simpa using ownership.counts boxAt
+
+end Ix.Compiler.IxIR1.Sim
diff --git a/Ix/Compiler/IxIR1/ReaddressSim.lean b/Ix/Compiler/IxIR1/ReaddressSim.lean
new file mode 100644
index 000000000..deebfd7d2
--- /dev/null
+++ b/Ix/Compiler/IxIR1/ReaddressSim.lean
@@ -0,0 +1,1735 @@
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.IxIR1.Readdress
+
+/-!
+# Semantic transport for IxIR₁ address renaming
+
+Content addressing changes declaration keys and every reference to those
+keys.  Runtime heaps also retain addresses in constructor identities and PAP
+nodes, so semantic transport must cover the whole evaluator state rather than
+only its input code.
+
+This module first defines the structural action of an arbitrary address map
+on evaluator state and errors.  `Ctx.Renames` is the exact forward lookup and
+oracle compatibility required by the evaluator; it intentionally permits
+non-injective maps when declarations with the same image are semantically the
+same, which is the case used by exact-content deduplication.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address)
+
+namespace Readdress
+
+namespace Node
+
+/-- Apply an address map to the identities retained in a heap node. -/
+def mapAddresses (rename : Address → Address) : Node → Node
+  | .ctorN constructor fields =>
+      .ctorN (CtorId.mapAddresses rename constructor) fields
+  | .papN function arity arguments =>
+      .papN (rename function) arity arguments
+
+end Node
+
+namespace NodeBox
+
+/-- Apply an address map beneath one live heap cell. -/
+def mapAddresses (rename : Address → Address) (box : NodeBox) : NodeBox :=
+  { box with node := Node.mapAddresses rename box.node }
+
+end NodeBox
+
+namespace Store
+
+/-- Apply an address map to every live or dead heap cell.  Locations,
+ownership, reference counts, and all cost counters remain unchanged. -/
+def mapAddresses (rename : Address → Address) (store : Store) : Store :=
+  { store with
+      nodes := store.nodes.map (Option.map (NodeBox.mapAddresses rename)) }
+
+end Store
+
+namespace Err
+
+/-- Address action on evaluator failures.  Only a closed-world lookup failure
+retains an address. -/
+def mapAddresses (rename : Address → Address) : Err → Err
+  | .fuel => .fuel
+  | .stuck message => .stuck message
+  | .mem message => .mem message
+  | .unknownRef address => .unknownRef (rename address)
+
+end Err
+
+/-- Address action on a store-returning evaluator result. -/
+def mapStoreResult (rename : Address → Address) :
+    Except Err Store → Except Err Store
+  | .ok store => .ok (Store.mapAddresses rename store)
+  | .error error => .error (Err.mapAddresses rename error)
+
+/-- Address action on an ordinary evaluator result.  Runtime values contain
+locations and scalars but no declaration addresses. -/
+def mapRunResult (rename : Address → Address) :
+    Except Err (Store × RVal) → Except Err (Store × RVal)
+  | .ok (store, value) => .ok (Store.mapAddresses rename store, value)
+  | .error error => .error (Err.mapAddresses rename error)
+
+/-- Address action on a scalar/runtime-value evaluator result. -/
+def mapValueResult (rename : Address → Address) :
+    Except Err RVal → Except Err RVal
+  | .ok value => .ok value
+  | .error error => .error (Err.mapAddresses rename error)
+
+/-- Address action on a list-of-runtime-values evaluator result. -/
+def mapValuesResult (rename : Address → Address) :
+    Except Err (List RVal) → Except Err (List RVal)
+  | .ok values => .ok values
+  | .error error => .error (Err.mapAddresses rename error)
+
+@[simp] private theorem except_ok_bind {Error Value Result : Type}
+    (value : Value) (next : Value → Except Error Result) :
+    (Except.ok value >>= next) = next value := rfl
+
+@[simp] private theorem except_error_bind {Error Value Result : Type}
+    (error : Error) (next : Value → Except Error Result) :
+    (Except.error error >>= next) = Except.error error := rfl
+
+@[simp] theorem mapRunResult_ok (rename : Address → Address)
+    (store : Store) (value : RVal) :
+    mapRunResult rename (.ok (store, value)) =
+      .ok (Store.mapAddresses rename store, value) := rfl
+
+@[simp] theorem mapRunResult_error (rename : Address → Address)
+    (error : Err) :
+    mapRunResult rename (.error error) =
+      .error (Err.mapAddresses rename error) := rfl
+
+@[simp] theorem mapStoreResult_ok (rename : Address → Address)
+    (store : Store) :
+    mapStoreResult rename (.ok store) =
+      .ok (Store.mapAddresses rename store) := rfl
+
+@[simp] theorem mapStoreResult_error (rename : Address → Address)
+    (error : Err) :
+    mapStoreResult rename (.error error) =
+      .error (Err.mapAddresses rename error) := rfl
+
+@[simp] theorem Err.mapAddresses_fuel (rename : Address → Address) :
+    Err.mapAddresses rename .fuel = .fuel := rfl
+
+@[simp] theorem Err.mapAddresses_stuck (rename : Address → Address)
+    (message : String) :
+    Err.mapAddresses rename (.stuck message) = .stuck message := rfl
+
+@[simp] theorem Err.mapAddresses_mem (rename : Address → Address)
+    (message : String) :
+    Err.mapAddresses rename (.mem message) = .mem message := rfl
+
+@[simp] theorem Err.mapAddresses_unknownRef (rename : Address → Address)
+    (address : Address) :
+    Err.mapAddresses rename (.unknownRef address) =
+      .unknownRef (rename address) := rfl
+
+namespace Ctx
+
+/-- The target context is the forward image of the source context at every
+address that the source evaluator can request.  The oracle condition is
+separate because extern declarations and direct `extern` operations both
+consult it. -/
+structure Renames (rename : Address → Address) (before after : Ctx) : Prop where
+  decls : ∀ address,
+    after.decls (rename address) =
+      (before.decls address).map (Decl.mapAddresses rename)
+  oracle : ∀ address arguments,
+    after.oracle (rename address) arguments = before.oracle address arguments
+
+end Ctx
+
+@[simp] theorem declPapSafe_mapAddresses (rename : Address → Address)
+    (declaration : Decl) :
+    declPapSafe (Decl.mapAddresses rename declaration) =
+      declPapSafe declaration := by
+  cases declaration <;> rfl
+
+/-! ## Certified readdressing contexts -/
+
+private theorem envOfList_some_mem
+    {entries : List (Address × Decl)} {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList entries address = some declaration) :
+    (address, declaration) ∈ entries := by
+  unfold Env.ofList at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryDeclaration⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × Decl => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hdeclaration : entryDeclaration = declaration := by
+    simpa using hvalue
+  subst entryAddress
+  subst entryDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+theorem Result.main_eq_mapAddresses {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.semanticAudit raw main = true) :
+    result.main =
+      Code.mapAddresses (Renaming.apply result.addressMap) main := by
+  simp only [Result.semanticAudit, Bool.and_eq_true] at haudit
+  exact (Code.structurallyEq_eq_true_iff _ _).mp haudit.1.1
+
+theorem Result.lookup_eq_mapAddresses {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.semanticAudit raw main = true)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList raw address = some declaration) :
+    Env.ofList result.declarations
+        (Renaming.apply result.addressMap address) =
+      some (Decl.mapAddresses
+        (Renaming.apply result.addressMap) declaration) := by
+  simp only [Result.semanticAudit, Bool.and_eq_true] at haudit
+  have hmember : (address, declaration) ∈ raw :=
+    envOfList_some_mem hlookup
+  have hentry := (List.all_eq_true.mp haudit.1.2)
+    (address, declaration) hmember
+  cases hemitted : Env.ofList result.declarations
+      (Renaming.apply result.addressMap address) with
+  | none => simp [hlookup, hemitted] at hentry
+  | some emitted =>
+      have hequal : emitted =
+          Decl.mapAddresses (Renaming.apply result.addressMap) declaration :=
+        (Decl.structurallyEq_eq_true_iff _ _).mp (by
+          simpa [hlookup, hemitted] using hentry)
+      simp [hequal]
+
+theorem Result.lookup_stable {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.semanticAudit raw main = true)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList result.declarations address = some declaration) :
+    Decl.mapAddresses (Renaming.apply result.addressMap) declaration =
+      declaration := by
+  simp only [Result.semanticAudit, Bool.and_eq_true] at haudit
+  have hmember : (address, declaration) ∈ result.declarations :=
+    envOfList_some_mem hlookup
+  have hentry := (List.all_eq_true.mp haudit.2)
+    (address, declaration) hmember
+  exact (Decl.structurallyEq_eq_true_iff _ _).mp (by
+    simpa [hlookup] using hentry)
+
+/-- The theorem-facing source environment contains the raw declaration at
+every successful raw lookup.  At an otherwise-unbound address it supplies
+the stable emitted lookup of the renamed key; these aliases are exactly what
+makes the context relation total after new content keys are introduced. -/
+def Result.preAddressEnv (result : Result)
+    (raw : List (Address × Decl)) : Env :=
+  fun address =>
+    match Env.ofList raw address with
+    | some declaration => some declaration
+    | none =>
+        Env.ofList result.declarations
+          (Renaming.apply result.addressMap address)
+
+/-- Evaluator context for the emitted, content-addressed artifact. -/
+def Result.addressedCtx (result : Result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Ctx :=
+  { decls := Env.ofList result.declarations, oracle }
+
+/-- Pull the addressed oracle back along the same map used for declarations.
+Raw lookups remain exact; stable aliases cover newly introduced target keys. -/
+def Result.preAddressCtx (result : Result)
+    (raw : List (Address × Decl))
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Ctx :=
+  { decls := result.preAddressEnv raw
+    oracle := fun address arguments =>
+      oracle (Renaming.apply result.addressMap address) arguments }
+
+@[simp] theorem Result.preAddressCtx_decls_of_lookup
+    (result : Result) (raw : List (Address × Decl))
+    (oracle : Address → List RVal → Option RVal)
+    {address : Address} {declaration : Decl}
+    (hlookup : Env.ofList raw address = some declaration) :
+    (result.preAddressCtx raw oracle).decls address = some declaration := by
+  simp [Result.preAddressCtx, Result.preAddressEnv, hlookup]
+
+/-- A successful semantic audit constructs the exact total context relation
+consumed by evaluator equivariance. -/
+theorem Result.renames_preAddressCtx {result : Result}
+    {raw : List (Address × Decl)} {main : Code}
+    (haudit : result.semanticAudit raw main = true)
+    (oracle : Address → List RVal → Option RVal) :
+    Ctx.Renames (Renaming.apply result.addressMap)
+      (result.preAddressCtx raw oracle) (result.addressedCtx oracle) := by
+  constructor
+  · intro address
+    simp only [Result.preAddressCtx, Result.addressedCtx,
+      Result.preAddressEnv]
+    cases hraw : Env.ofList raw address with
+    | some declaration =>
+        simpa [hraw] using result.lookup_eq_mapAddresses haudit hraw
+    | none =>
+        simp only
+        cases hemitted : Env.ofList result.declarations
+            (Renaming.apply result.addressMap address) with
+        | none => simp
+        | some declaration =>
+            have hstable := result.lookup_stable haudit hemitted
+            simp [hstable]
+  · intro address arguments
+    rfl
+
+/-! ## Structural evaluator-state laws -/
+
+@[simp] theorem NodeBox.mapAddresses_world (rename : Address → Address)
+    (box : NodeBox) :
+    (NodeBox.mapAddresses rename box).world = box.world := rfl
+
+@[simp] theorem NodeBox.mapAddresses_rc (rename : Address → Address)
+    (box : NodeBox) :
+    (NodeBox.mapAddresses rename box).rc = box.rc := rfl
+
+@[simp] theorem NodeBox.mapAddresses_node (rename : Address → Address)
+    (box : NodeBox) :
+    (NodeBox.mapAddresses rename box).node =
+      Node.mapAddresses rename box.node := rfl
+
+@[simp] theorem Store.mapAddresses_allocs (rename : Address → Address)
+    (store : Store) :
+    (Store.mapAddresses rename store).allocs = store.allocs := rfl
+
+@[simp] theorem Store.mapAddresses_reuses (rename : Address → Address)
+    (store : Store) :
+    (Store.mapAddresses rename store).reuses = store.reuses := rfl
+
+@[simp] theorem Store.mapAddresses_frees (rename : Address → Address)
+    (store : Store) :
+    (Store.mapAddresses rename store).frees = store.frees := rfl
+
+@[simp] theorem Store.mapAddresses_rcops (rename : Address → Address)
+    (store : Store) :
+    (Store.mapAddresses rename store).rcops = store.rcops := rfl
+
+@[simp] theorem Store.mapAddresses_empty (rename : Address → Address) :
+    Store.mapAddresses rename ({} : Store) = {} := by
+  simp [Store.mapAddresses]
+
+@[simp] theorem Store.get?_mapAddresses (rename : Address → Address)
+    (store : Store) (location : Nat) :
+    (Store.mapAddresses rename store).get? location =
+      (store.get? location).map (NodeBox.mapAddresses rename) := by
+  simp only [Store.mapAddresses, Store.get?, Array.getElem?_map]
+  cases hcell : store.nodes[location]? with
+  | none => simp
+  | some cell =>
+      cases cell <;> simp
+
+@[simp] theorem Store.mapAddresses_setBox (rename : Address → Address)
+    (store : Store) (location : Nat) (box : NodeBox) :
+    Store.mapAddresses rename (store.setBox location box) =
+      (Store.mapAddresses rename store).setBox location
+        (NodeBox.mapAddresses rename box) := by
+  simp [Store.mapAddresses, Store.setBox]
+
+@[simp] theorem Store.mapAddresses_kill (rename : Address → Address)
+    (store : Store) (location : Nat) :
+    Store.mapAddresses rename (store.kill location) =
+      (Store.mapAddresses rename store).kill location := by
+  simp [Store.mapAddresses, Store.kill]
+
+@[simp] theorem Store.mapAddresses_rcTick (rename : Address → Address)
+    (store : Store) :
+    Store.mapAddresses rename store.rcTick =
+      (Store.mapAddresses rename store).rcTick := by
+  simp [Store.mapAddresses, Store.rcTick]
+
+@[simp] theorem Store.mapAddresses_allocNode_fst
+    (rename : Address → Address) (store : Store)
+    (world : Ixon.Owned) (node : Node) :
+    Store.mapAddresses rename (store.allocNode world node).1 =
+      ((Store.mapAddresses rename store).allocNode world
+        (Node.mapAddresses rename node)).1 := by
+  simp [Store.mapAddresses, Store.allocNode, NodeBox.mapAddresses]
+
+@[simp] theorem Store.mapAddresses_allocNode_snd
+    (rename : Address → Address) (store : Store)
+    (world : Ixon.Owned) (node : Node) :
+    (store.allocNode world node).2 =
+      ((Store.mapAddresses rename store).allocNode world
+        (Node.mapAddresses rename node)).2 := by
+  simp [Store.mapAddresses, Store.allocNode]
+
+@[simp] theorem Store.mapAddresses_countReuse
+    (rename : Address → Address) (store : Store) :
+    Store.mapAddresses rename { store with reuses := store.reuses + 1 } =
+      { Store.mapAddresses rename store with
+        reuses := (Store.mapAddresses rename store).reuses + 1 } := by
+  simp [Store.mapAddresses]
+
+@[simp] theorem RVal.hasWorld_mapAddresses
+    (rename : Address → Address) (store : Store)
+    (world : Ixon.Owned) (value : RVal) :
+    value.hasWorld (Store.mapAddresses rename store) world =
+      value.hasWorld store world := by
+  cases value with
+  | loc location =>
+      cases hbox : store.get? location <;> simp [RVal.hasWorld, hbox]
+  | lit literal => simp [RVal.hasWorld]
+  | erased => simp [RVal.hasWorld]
+
+theorem checkResultWorld_mapAddresses
+    (rename : Address → Address) (world : Ixon.Owned)
+    (out : Store × RVal) :
+    checkResultWorld world
+        (Store.mapAddresses rename out.1, out.2) =
+      mapRunResult rename (checkResultWorld world out) := by
+  rcases out with ⟨store, value⟩
+  by_cases hworld : value.hasWorld store world
+  · simp [checkResultWorld, mapRunResult, hworld]
+  · simp [checkResultWorld, mapRunResult, Err.mapAddresses, hworld]
+
+theorem resolveAtom_mapValueResult (rename : Address → Address)
+    (environment : List RVal) (atom : Atom) :
+    mapValueResult rename (resolveAtom environment atom) =
+      resolveAtom environment atom := by
+  cases atom with
+  | var index =>
+      cases hvalue : environment[index]? <;>
+        simp [resolveAtom, mapValueResult, Err.mapAddresses, hvalue]
+  | lit literal => simp [resolveAtom, mapValueResult]
+  | erased => simp [resolveAtom, mapValueResult]
+
+private theorem resolveAtomsList_mapValuesResult
+    (rename : Address → Address) (environment : List RVal)
+    (atoms : List Atom) (initial : List RVal) :
+    mapValuesResult rename
+        (atoms.foldlM (fun accumulated atom => do
+          pure (accumulated ++ [← resolveAtom environment atom])) initial) =
+      atoms.foldlM (fun accumulated atom => do
+        pure (accumulated ++ [← resolveAtom environment atom])) initial := by
+  induction atoms generalizing initial with
+  | nil =>
+      change (Except.ok initial : Except Err (List RVal)) = .ok initial
+      rfl
+  | cons atom rest ih =>
+      simp only [List.foldlM_cons]
+      cases hresolve : resolveAtom environment atom with
+      | ok value =>
+          change mapValuesResult rename
+              (rest.foldlM (fun accumulated atom => do
+                pure (accumulated ++ [← resolveAtom environment atom]))
+                (initial ++ [value])) =
+            rest.foldlM (fun accumulated atom => do
+              pure (accumulated ++ [← resolveAtom environment atom]))
+              (initial ++ [value])
+          exact ih (initial ++ [value])
+      | error error =>
+          have hmapped := resolveAtom_mapValueResult rename environment atom
+          simp [hresolve, mapValueResult] at hmapped
+          change Except.error (Err.mapAddresses rename error) =
+            Except.error error
+          rw [hmapped]
+
+theorem resolveAtoms_mapValuesResult (rename : Address → Address)
+    (environment : List RVal) (atoms : Array Atom) :
+    mapValuesResult rename (resolveAtoms environment atoms) =
+      resolveAtoms environment atoms := by
+  simp only [resolveAtoms, ← Array.foldlM_toList]
+  exact resolveAtomsList_mapValuesResult rename environment atoms.toList []
+
+theorem Err.mapAddresses_of_resolveAtom_error
+    (rename : Address → Address) (environment : List RVal) (atom : Atom)
+    {error : Err} (herror : resolveAtom environment atom = .error error) :
+    Err.mapAddresses rename error = error := by
+  have hmapped := resolveAtom_mapValueResult rename environment atom
+  simpa [herror, mapValueResult] using hmapped
+
+theorem Err.mapAddresses_of_resolveAtoms_error
+    (rename : Address → Address) (environment : List RVal)
+    (atoms : Array Atom) {error : Err}
+    (herror : resolveAtoms environment atoms = .error error) :
+    Err.mapAddresses rename error = error := by
+  have hmapped := resolveAtoms_mapValuesResult rename environment atoms
+  simpa [herror, mapValuesResult] using hmapped
+
+@[simp] theorem Alt.cidx_mapAddresses (rename : Address → Address)
+    (alternative : Alt) :
+    (Alt.mapAddresses rename alternative).cidx = alternative.cidx := by
+  cases alternative <;> rfl
+
+private theorem AltList.find?_mapAddresses (rename : Address → Address)
+    (constructor : Nat) (alternatives : List Alt) :
+    (AltList.mapAddresses rename alternatives).find?
+        (fun alternative => alternative.cidx == constructor) =
+      (alternatives.find?
+        (fun alternative => alternative.cidx == constructor)).map
+          (Alt.mapAddresses rename) := by
+  induction alternatives with
+  | nil => rfl
+  | cons alternative rest ih =>
+      cases alternative with
+      | mk cidx fields body =>
+          simp only [AltList.mapAddresses, Alt.mapAddresses, Alt.cidx,
+            List.find?_cons]
+          by_cases hmatch : cidx == constructor
+          · simp only [hmatch, Option.map_some]
+            rfl
+          · simp only [hmatch]
+            exact ih
+
+theorem AltArray.find?_mapAddresses (rename : Address → Address)
+    (constructor : Nat) (alternatives : Array Alt) :
+    ((AltList.mapAddresses rename alternatives.toList).toArray.find?
+        (fun alternative => alternative.cidx == constructor)) =
+      (alternatives.find?
+        (fun alternative => alternative.cidx == constructor)).map
+          (Alt.mapAddresses rename) := by
+  simpa only [← Array.find?_toList, List.toList_toArray] using
+    AltList.find?_mapAddresses rename constructor alternatives.toList
+
+@[simp] theorem Decl.declArity_mapAddresses (rename : Address → Address)
+    (declaration : Decl) :
+    declArity (Decl.mapAddresses rename declaration) =
+      declArity declaration := by
+  cases declaration <;> rfl
+
+@[simp] theorem FnDef.mapAddresses_arity (rename : Address → Address)
+    (definition : FnDef) :
+    (FnDef.mapAddresses rename definition).arity = definition.arity := rfl
+
+@[simp] theorem FnDef.mapAddresses_result (rename : Address → Address)
+    (definition : FnDef) :
+    (FnDef.mapAddresses rename definition).result = definition.result := rfl
+
+@[simp] theorem FnDef.mapAddresses_body (rename : Address → Address)
+    (definition : FnDef) :
+    (FnDef.mapAddresses rename definition).body =
+      Code.mapAddresses rename definition.body := rfl
+
+/-- Reference-count duplication is insensitive to declaration addresses and
+commutes with the heap action exactly. -/
+theorem dupVals_mapAddresses (rename : Address → Address)
+    (store : Store) (values : List RVal) :
+    dupVals (Store.mapAddresses rename store) values =
+      mapStoreResult rename (dupVals store values) := by
+  induction values generalizing store with
+  | nil =>
+      change Except.ok (Store.mapAddresses rename store) =
+        mapStoreResult rename (Except.ok store)
+      rfl
+  | cons value rest ih =>
+      cases value with
+      | lit literal =>
+          change dupVals (Store.mapAddresses rename store) rest =
+            mapStoreResult rename (dupVals store rest)
+          exact ih store
+      | erased =>
+          change dupVals (Store.mapAddresses rename store) rest =
+            mapStoreResult rename (dupVals store rest)
+          exact ih store
+      | loc location =>
+          cases hbox : store.get? location with
+          | none =>
+              simp only [dupVals, List.foldlM_cons,
+                Store.get?_mapAddresses, hbox, Option.map_none]
+              change Except.error
+                  (.mem s!"dup of a dead location {location}") =
+                mapStoreResult rename
+                  (Except.error (.mem s!"dup of a dead location {location}"))
+              rfl
+          | some box =>
+              cases hworld : box.world with
+              | unique =>
+                  simp only [dupVals, List.foldlM_cons,
+                    Store.get?_mapAddresses, hbox, Option.map_some,
+                    NodeBox.mapAddresses_world, hworld]
+                  change Except.error (.mem "dup of a unique node") =
+                    mapStoreResult rename
+                      (Except.error (.mem "dup of a unique node"))
+                  rfl
+              | shared =>
+                  simp only [dupVals, List.foldlM_cons,
+                    Store.get?_mapAddresses, hbox, Option.map_some,
+                    NodeBox.mapAddresses_world, hworld]
+                  let next :=
+                    (store.setBox location
+                      { box with rc := box.rc + 1 }).rcTick
+                  have hnext :
+                      ((Store.mapAddresses rename store).setBox location
+                        { world := .shared
+                          rc := (NodeBox.mapAddresses rename box).rc + 1
+                          node := (NodeBox.mapAddresses rename box).node }).rcTick =
+                        Store.mapAddresses rename next := by
+                    simp [next, NodeBox.mapAddresses, hworld]
+                  have hsourceNext :
+                      (store.setBox location
+                        { world := .shared
+                          rc := box.rc + 1
+                          node := box.node }).rcTick = next := by
+                    simp [next, hworld]
+                  rw [hnext]
+                  rw [hsourceNext]
+                  change dupVals (Store.mapAddresses rename next) rest =
+                    mapStoreResult rename (dupVals next rest)
+                  exact ih next
+
+/-- The scalar-only oracle boundary commutes with a context renaming. -/
+theorem callScalarOracle_mapAddresses
+    {rename : Address → Address} {before after : Ctx}
+    (contexts : Ctx.Renames rename before after)
+    (function : Address) (arguments : List RVal) :
+    callScalarOracle after (rename function) arguments =
+      mapValueResult rename
+        (callScalarOracle before function arguments) := by
+  simp only [callScalarOracle, contexts.oracle function arguments]
+  split
+  · simp_all [mapValueResult, Err.mapAddresses]
+  · cases horacle : before.oracle function arguments with
+    | none => simp [mapValueResult, Err.mapAddresses]
+    | some value =>
+        by_cases hvalue : value.isScalar
+        · simp [hvalue, mapValueResult]
+        · simp [hvalue, mapValueResult, Err.mapAddresses]
+
+/-! ## Fueled evaluator equivariance -/
+
+/-- All mutually recursive evaluator entries commute with an address map at
+one common fuel index.  Packaging them together mirrors the evaluator's
+termination argument and lets every successor case consume the complete
+strictly-smaller hypothesis. -/
+structure EvalTransportAt (rename : Address → Address)
+    (before after : Ctx) (fuel : Nat) : Prop where
+  runCode : ∀ (current : FnDef) (store : Store)
+      (environment : List RVal) (code : Code),
+    runCode after fuel (FnDef.mapAddresses rename current)
+        (Store.mapAddresses rename store) environment
+        (Code.mapAddresses rename code) =
+      mapRunResult rename
+        (runCode before fuel current store environment code)
+  runOp : ∀ (current : FnDef) (store : Store)
+      (environment : List RVal) (operation : Op),
+    runOp after fuel (FnDef.mapAddresses rename current)
+        (Store.mapAddresses rename store) environment
+        (Op.mapAddresses rename operation) =
+      mapRunResult rename
+        (runOp before fuel current store environment operation)
+  invoke : ∀ (function : Address) (arguments : List RVal) (store : Store),
+    IxIR1.invoke after fuel (rename function) arguments
+        (Store.mapAddresses rename store) =
+      mapRunResult rename
+        (IxIR1.invoke before fuel function arguments store)
+  applyGo : ∀ (store : Store) (function : RVal) (arguments : List RVal),
+    IxIR1.applyGo after fuel (Store.mapAddresses rename store)
+        function arguments =
+      mapRunResult rename
+        (IxIR1.applyGo before fuel store function arguments)
+  dropVal : ∀ (store : Store) (value : RVal),
+    IxIR1.dropVal after fuel (Store.mapAddresses rename store) value =
+      mapStoreResult rename (IxIR1.dropVal before fuel store value)
+  dropMany : ∀ (store : Store) (values : List RVal),
+    IxIR1.dropMany after fuel (Store.mapAddresses rename store) values =
+      mapStoreResult rename (IxIR1.dropMany before fuel store values)
+  dropUVal : ∀ (store : Store) (value : RVal),
+    IxIR1.dropUVal after fuel (Store.mapAddresses rename store) value =
+      mapStoreResult rename (IxIR1.dropUVal before fuel store value)
+  dropManyU : ∀ (store : Store) (values : List RVal),
+    IxIR1.dropManyU after fuel (Store.mapAddresses rename store) values =
+      mapStoreResult rename (IxIR1.dropManyU before fuel store values)
+
+/-- Exact evaluator equivariance at every fuel. -/
+theorem evalTransportAt {rename : Address → Address} {before after : Ctx}
+    (contexts : Ctx.Renames rename before after) :
+    ∀ fuel, EvalTransportAt rename before after fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor <;> intros <;>
+        simp [runCode, runOp, IxIR1.invoke, IxIR1.applyGo,
+          IxIR1.dropVal, IxIR1.dropMany, IxIR1.dropUVal,
+          IxIR1.dropManyU, mapRunResult, mapStoreResult,
+          Err.mapAddresses]
+  | succ fuel smaller =>
+      refine {
+        runCode := ?_
+        runOp := ?_
+        invoke := ?_
+        applyGo := ?_
+        dropVal := ?_
+        dropMany := ?_
+        dropUVal := ?_
+        dropManyU := ?_ }
+      · intro current store environment code
+        cases code with
+        | ret atom =>
+            simp only [runCode, Code.mapAddresses]
+            cases hresolve : resolveAtom environment atom with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment atom hresolve
+                simp [mapRunResult, hmapped]
+            | ok value => simp [mapRunResult]
+        | letOp operation rest =>
+            simp only [runCode, Code.mapAddresses]
+            rw [smaller.runOp current store environment operation]
+            cases hop : runOp before fuel current store environment operation with
+            | error error =>
+                change Except.error (Err.mapAddresses rename error) =
+                  mapRunResult rename (Except.error error)
+                rfl
+            | ok out =>
+                rcases out with ⟨next, value⟩
+                simp only [mapRunResult]
+                exact smaller.runCode current next (value :: environment) rest
+        | case scrutinee peelNat alternatives =>
+            simp only [runCode, Code.mapAddresses]
+            cases hresolve : resolveAtom environment scrutinee with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment scrutinee hresolve
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases value with
+                | erased => simp [mapRunResult, Err.mapAddresses]
+                | lit literal =>
+                    cases literal with
+                    | str string => simp [mapRunResult, Err.mapAddresses]
+                    | nat number =>
+                        cases peelNat with
+                        | false => simp [mapRunResult, Err.mapAddresses]
+                        | true =>
+                            cases number with
+                            | zero =>
+                                simp only [except_ok_bind]
+                                rw [AltArray.find?_mapAddresses rename 0
+                                  alternatives]
+                                cases halt : alternatives.find?
+                                    (fun alternative =>
+                                      alternative.cidx == 0) with
+                                | none =>
+                                    simp [mapRunResult,
+                                      Err.mapAddresses]
+                                | some alternative =>
+                                    cases alternative with
+                                    | mk constructor fields body =>
+                                        cases fields with
+                                        | zero =>
+                                            simp only [Option.map_some,
+                                              Alt.mapAddresses]
+                                            exact smaller.runCode current store
+                                              environment body
+                                        | succ fields =>
+                                            simp [Alt.mapAddresses,
+                                              mapRunResult,
+                                              Err.mapAddresses]
+                            | succ predecessor =>
+                                simp only [except_ok_bind]
+                                rw [AltArray.find?_mapAddresses rename 1
+                                  alternatives]
+                                cases halt : alternatives.find?
+                                    (fun alternative =>
+                                      alternative.cidx == 1) with
+                                | none =>
+                                    simp [mapRunResult,
+                                      Err.mapAddresses]
+                                | some alternative =>
+                                    cases alternative with
+                                    | mk constructor fields body =>
+                                        cases fields with
+                                        | zero =>
+                                            simp [Alt.mapAddresses,
+                                              mapRunResult,
+                                              Err.mapAddresses]
+                                        | succ fields =>
+                                            cases fields with
+                                            | zero =>
+                                                simp only [Option.map_some,
+                                                  Alt.mapAddresses]
+                                                exact smaller.runCode current
+                                                  store
+                                                  (.lit (.nat predecessor) ::
+                                                    environment)
+                                                  body
+                                            | succ fields =>
+                                                simp [Alt.mapAddresses,
+                                                  mapRunResult,
+                                                  Err.mapAddresses]
+                | loc location =>
+                    simp only [except_ok_bind]
+                    cases hbox : store.get? location with
+                    | none =>
+                        simp [Store.get?_mapAddresses, hbox, mapRunResult,
+                          Err.mapAddresses]
+                    | some box =>
+                        simp only [Store.get?_mapAddresses, hbox,
+                          Option.map_some, NodeBox.mapAddresses_node]
+                        cases hnode : box.node with
+                        | papN function arity arguments =>
+                            simp [Node.mapAddresses, mapRunResult,
+                              Err.mapAddresses]
+                        | ctorN constructor fields =>
+                            simp only [Node.mapAddresses,
+                              CtorId.mapAddresses]
+                            rw [AltArray.find?_mapAddresses rename
+                              constructor.cidx alternatives]
+                            cases halt : alternatives.find?
+                                (fun alternative =>
+                                  alternative.cidx == constructor.cidx) with
+                            | none =>
+                                simp [mapRunResult, Err.mapAddresses]
+                            | some alternative =>
+                                cases alternative with
+                                | mk alternativeConstructor fieldCount body =>
+                                    simp only [Option.map_some,
+                                      Alt.mapAddresses]
+                                    by_cases hsize :
+                                        fields.size != fieldCount
+                                    · simp [hsize, mapRunResult,
+                                        Err.mapAddresses]
+                                    · simp only [hsize]
+                                      exact smaller.runCode current store
+                                        (fields.foldl
+                                          (fun accumulated field =>
+                                            field :: accumulated)
+                                          environment)
+                                        body
+      · intro current store environment operation
+        cases operation with
+        | pure atom =>
+            simp only [runOp, Op.mapAddresses]
+            cases hresolve : resolveAtom environment atom with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment atom hresolve
+                simp [mapRunResult, hmapped]
+            | ok value => simp [mapRunResult]
+        | alloc world constructor atoms =>
+            simp only [runOp, Op.mapAddresses]
+            cases hresolve : resolveAtoms environment atoms with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                  rename environment atoms hresolve
+                simp [mapRunResult, hmapped]
+            | ok values =>
+                change Except.ok
+                    (((Store.mapAddresses rename store).allocNode world
+                      (.ctorN (CtorId.mapAddresses rename constructor)
+                        values.toArray)).1,
+                      RVal.loc
+                        (((Store.mapAddresses rename store).allocNode world
+                          (.ctorN (CtorId.mapAddresses rename constructor)
+                            values.toArray)).2)) =
+                  Except.ok
+                    (Store.mapAddresses rename
+                      ((store.allocNode world
+                        (.ctorN constructor values.toArray)).1),
+                      RVal.loc
+                        ((store.allocNode world
+                          (.ctorN constructor values.toArray)).2))
+                simp [Store.mapAddresses_allocNode_fst, Node.mapAddresses]
+                exact
+                  (Store.mapAddresses_allocNode_snd rename store world
+                    (.ctorN constructor values.toArray)).symm
+        | reuse target constructor atoms =>
+            simp only [runOp, Op.mapAddresses]
+            cases hatoms : resolveAtoms environment atoms with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                  rename environment atoms hatoms
+                simp [mapRunResult, hmapped]
+            | ok values =>
+                cases htarget : resolveAtom environment target with
+                | error error =>
+                    have hmapped := Err.mapAddresses_of_resolveAtom_error
+                      rename environment target htarget
+                    simp [mapRunResult, hmapped]
+                | ok value =>
+                    cases value with
+                    | lit literal =>
+                        simp [mapRunResult, Err.mapAddresses]
+                    | erased =>
+                        simp [mapRunResult, Err.mapAddresses]
+                    | loc location =>
+                        cases hbox : store.get? location with
+                        | none =>
+                            simp [Store.get?_mapAddresses, hbox, mapRunResult,
+                              Err.mapAddresses]
+                        | some box =>
+                            cases hworld : box.world with
+                            | shared =>
+                                simp [Store.get?_mapAddresses, hbox, hworld,
+                                  mapRunResult, Err.mapAddresses]
+                            | unique =>
+                                simp only [except_ok_bind,
+                                  Store.get?_mapAddresses, hbox,
+                                  Option.map_some, NodeBox.mapAddresses_world,
+                                  hworld]
+                                change Except.ok
+                                    ({ ((Store.mapAddresses rename store).setBox
+                                      location
+                                      ⟨.unique, 1,
+                                        .ctorN
+                                          (CtorId.mapAddresses rename constructor)
+                                          values.toArray⟩) with
+                                      reuses :=
+                                        ((Store.mapAddresses rename store).setBox
+                                          location
+                                          ⟨.unique, 1,
+                                            .ctorN
+                                              (CtorId.mapAddresses rename
+                                                constructor)
+                                              values.toArray⟩).reuses + 1 },
+                                      RVal.loc location) =
+                                  Except.ok
+                                    (Store.mapAddresses rename
+                                      { (store.setBox location
+                                        ⟨.unique, 1,
+                                          .ctorN constructor values.toArray⟩) with
+                                        reuses :=
+                                          (store.setBox location
+                                            ⟨.unique, 1,
+                                              .ctorN constructor
+                                                values.toArray⟩).reuses + 1 },
+                                      RVal.loc location)
+                                simp [NodeBox.mapAddresses,
+                                  Node.mapAddresses]
+        | free target =>
+            simp only [runOp, Op.mapAddresses]
+            cases htarget : resolveAtom environment target with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment target htarget
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases value with
+                | lit literal => simp [mapRunResult, Err.mapAddresses]
+                | erased => simp [mapRunResult, Err.mapAddresses]
+                | loc location =>
+                    cases hbox : store.get? location with
+                    | none =>
+                        simp [Store.get?_mapAddresses, hbox, mapRunResult,
+                          Err.mapAddresses]
+                    | some box =>
+                        cases hworld : box.world with
+                        | shared =>
+                            simp [Store.get?_mapAddresses, hbox, hworld,
+                              mapRunResult, Err.mapAddresses]
+                        | unique =>
+                            simp [Store.get?_mapAddresses, hbox, hworld,
+                              mapRunResult]
+        | dup target =>
+            simp only [runOp, Op.mapAddresses]
+            cases htarget : resolveAtom environment target with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment target htarget
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases value with
+                | lit literal => simp [mapRunResult]
+                | erased => simp [mapRunResult]
+                | loc location =>
+                    cases hbox : store.get? location with
+                    | none =>
+                        simp [Store.get?_mapAddresses, hbox, mapRunResult,
+                          Err.mapAddresses]
+                    | some box =>
+                        cases hworld : box.world with
+                        | unique =>
+                            simp [Store.get?_mapAddresses, hbox, hworld,
+                              mapRunResult, Err.mapAddresses]
+                        | shared =>
+                            simp only [except_ok_bind,
+                              Store.get?_mapAddresses, hbox,
+                              Option.map_some, NodeBox.mapAddresses_world,
+                              hworld]
+                            simp [mapRunResult, NodeBox.mapAddresses, hworld]
+        | drop target =>
+            simp only [runOp, Op.mapAddresses]
+            cases htarget : resolveAtom environment target with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment target htarget
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases value with
+                | lit literal => simp [mapRunResult]
+                | erased => simp [mapRunResult]
+                | loc location =>
+                    simp only [except_ok_bind]
+                    rw [smaller.dropVal store (.loc location)]
+                    cases hdrop : IxIR1.dropVal before fuel store
+                        (.loc location) with
+                    | error error =>
+                        change Except.error (Err.mapAddresses rename error) =
+                          mapRunResult rename (Except.error error)
+                        rfl
+                    | ok next =>
+                        change Except.ok
+                            (Store.mapAddresses rename next, RVal.erased) =
+                          mapRunResult rename
+                            (Except.ok (next, RVal.erased))
+                        rfl
+        | dropU target =>
+            simp only [runOp, Op.mapAddresses]
+            cases htarget : resolveAtom environment target with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment target htarget
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases value with
+                | lit literal => simp [mapRunResult]
+                | erased => simp [mapRunResult]
+                | loc location =>
+                    simp only [except_ok_bind]
+                    rw [smaller.dropUVal store (.loc location)]
+                    cases hdrop : IxIR1.dropUVal before fuel store
+                        (.loc location) with
+                    | error error =>
+                        change Except.error (Err.mapAddresses rename error) =
+                          mapRunResult rename (Except.error error)
+                        rfl
+                    | ok next =>
+                        change Except.ok
+                            (Store.mapAddresses rename next, RVal.erased) =
+                          mapRunResult rename
+                            (Except.ok (next, RVal.erased))
+                        rfl
+        | fetch target field =>
+            simp only [runOp, Op.mapAddresses]
+            cases htarget : resolveAtom environment target with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment target htarget
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases value with
+                | lit literal => simp [mapRunResult, Err.mapAddresses]
+                | erased => simp [mapRunResult, Err.mapAddresses]
+                | loc location =>
+                    simp only [except_ok_bind]
+                    cases hbox : store.get? location with
+                    | none =>
+                        simp [Store.get?_mapAddresses, hbox, mapRunResult,
+                          Err.mapAddresses]
+                    | some box =>
+                        simp only [Store.get?_mapAddresses, hbox,
+                          Option.map_some, NodeBox.mapAddresses_node]
+                        cases hnode : box.node with
+                        | papN function arity arguments =>
+                            simp [Node.mapAddresses, mapRunResult,
+                              Err.mapAddresses]
+                        | ctorN constructor fields =>
+                            simp only [Node.mapAddresses]
+                            cases hfield : fields[field]? with
+                            | none =>
+                                simp [mapRunResult, Err.mapAddresses]
+                            | some value => simp [mapRunResult]
+        | call function atoms =>
+            simp only [runOp, Op.mapAddresses]
+            cases hresolve : resolveAtoms environment atoms with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                  rename environment atoms hresolve
+                simp [mapRunResult, hmapped]
+            | ok arguments =>
+                exact smaller.invoke function arguments store
+        | callSelf atoms =>
+            simp only [runOp, Op.mapAddresses,
+              FnDef.mapAddresses_arity, FnDef.mapAddresses_body,
+              FnDef.mapAddresses_result]
+            cases hresolve : resolveAtoms environment atoms with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                  rename environment atoms hresolve
+                simp [mapRunResult, hmapped]
+            | ok arguments =>
+                simp only [except_ok_bind]
+                by_cases harity : arguments.length != current.arity
+                · simp [harity, mapRunResult, Err.mapAddresses]
+                · simp only [harity]
+                  rw [smaller.runCode current store arguments.reverse
+                    current.body]
+                  cases hrun : runCode before fuel current store
+                      arguments.reverse current.body with
+                  | error error =>
+                      change Except.error (Err.mapAddresses rename error) =
+                        mapRunResult rename (Except.error error)
+                      rfl
+                  | ok out =>
+                      rcases out with ⟨resultStore, value⟩
+                      simp only [mapRunResult]
+                      exact checkResultWorld_mapAddresses rename current.result
+                        (resultStore, value)
+        | papp function atoms =>
+            simp only [runOp, Op.mapAddresses]
+            cases hresolve : resolveAtoms environment atoms with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                  rename environment atoms hresolve
+                simp [mapRunResult, hmapped]
+            | ok arguments =>
+                simp only [contexts.decls function]
+                cases hdecl : before.decls function with
+                | none =>
+                    simp [mapRunResult, Err.mapAddresses]
+                | some declaration =>
+                    simp only [Option.map_some,
+                      Decl.declArity_mapAddresses]
+                    by_cases hless : arguments.length < declArity declaration
+                    · simp only [except_ok_bind, hless]
+                      change Except.ok
+                          (((Store.mapAddresses rename store).allocNode .shared
+                            (.papN (rename function)
+                              (declArity declaration) arguments.toArray)).1,
+                            RVal.loc
+                              (((Store.mapAddresses rename store).allocNode
+                                .shared (.papN (rename function)
+                                  (declArity declaration)
+                                  arguments.toArray)).2)) =
+                        Except.ok
+                          (Store.mapAddresses rename
+                            ((store.allocNode .shared
+                              (.papN function (declArity declaration)
+                                arguments.toArray)).1),
+                            RVal.loc
+                              ((store.allocNode .shared
+                                (.papN function (declArity declaration)
+                                  arguments.toArray)).2))
+                      simp [Store.mapAddresses_allocNode_fst,
+                        Node.mapAddresses]
+                      exact
+                        (Store.mapAddresses_allocNode_snd rename store .shared
+                          (.papN function (declArity declaration)
+                            arguments.toArray)).symm
+                    · simp [hless, mapRunResult, Err.mapAddresses]
+        | apply function atoms =>
+            simp only [runOp, Op.mapAddresses]
+            cases hfunction : resolveAtom environment function with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtom_error
+                  rename environment function hfunction
+                simp [mapRunResult, hmapped]
+            | ok value =>
+                cases harguments : resolveAtoms environment atoms with
+                | error error =>
+                    have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                      rename environment atoms harguments
+                    simp [mapRunResult, hmapped]
+                | ok arguments =>
+                    simp only [except_ok_bind]
+                    exact smaller.applyGo store value arguments
+        | extern function atoms =>
+            simp only [runOp, Op.mapAddresses]
+            cases hresolve : resolveAtoms environment atoms with
+            | error error =>
+                have hmapped := Err.mapAddresses_of_resolveAtoms_error
+                  rename environment atoms hresolve
+                simp [mapRunResult, hmapped]
+            | ok arguments =>
+                simp only [except_ok_bind]
+                rw [callScalarOracle_mapAddresses contexts]
+                cases horacle : callScalarOracle before function arguments with
+                | error error =>
+                    change Except.error (Err.mapAddresses rename error) =
+                      mapRunResult rename (Except.error error)
+                    rfl
+                | ok value =>
+                    change Except.ok
+                        (Store.mapAddresses rename store, value) =
+                      mapRunResult rename (Except.ok (store, value))
+                    rfl
+      · intro function arguments store
+        simp only [IxIR1.invoke, contexts.decls function]
+        cases hdecl : before.decls function with
+        | none =>
+            simp [mapRunResult, Err.mapAddresses]
+        | some declaration =>
+            cases declaration with
+            | extern arity =>
+                simp only [Option.map_some, Decl.mapAddresses]
+                by_cases harity : arguments.length != arity
+                · simp [harity, mapRunResult, Err.mapAddresses]
+                · simp only [harity]
+                  rw [callScalarOracle_mapAddresses contexts]
+                  cases horacle : callScalarOracle before function arguments with
+                  | error error =>
+                      simp [mapValueResult, mapRunResult]
+                  | ok value =>
+                      simp [mapValueResult, mapRunResult]
+            | fn definition =>
+                simp only [Option.map_some, Decl.mapAddresses]
+                simp only [FnDef.mapAddresses_arity,
+                  FnDef.mapAddresses_body, FnDef.mapAddresses_result]
+                by_cases harity : arguments.length != definition.arity
+                · simp [harity, mapRunResult, Err.mapAddresses]
+                · simp only [harity]
+                  rw [smaller.runCode definition store arguments.reverse
+                    definition.body]
+                  cases hrun : runCode before fuel definition store
+                      arguments.reverse definition.body with
+                  | error error =>
+                      change Except.error (Err.mapAddresses rename error) =
+                        mapRunResult rename (Except.error error)
+                      rfl
+                  | ok out =>
+                      rcases out with ⟨resultStore, value⟩
+                      simp only [mapRunResult]
+                      exact checkResultWorld_mapAddresses rename
+                        definition.result (resultStore, value)
+      · intro store function arguments
+        cases function with
+        | lit literal =>
+            simp [IxIR1.applyGo, mapRunResult, Err.mapAddresses]
+        | erased =>
+            simp only [IxIR1.applyGo]
+            rw [smaller.dropMany store arguments]
+            cases hdrop : IxIR1.dropMany before fuel store arguments with
+            | error error =>
+                change Except.error (Err.mapAddresses rename error) =
+                  mapRunResult rename (Except.error error)
+                rfl
+            | ok next =>
+                change Except.ok (Store.mapAddresses rename next, RVal.erased) =
+                  mapRunResult rename (Except.ok (next, RVal.erased))
+                rfl
+        | loc location =>
+            simp only [IxIR1.applyGo, Store.get?_mapAddresses]
+            cases hbox : store.get? location with
+            | none =>
+                simp [mapRunResult, Err.mapAddresses]
+            | some box =>
+                simp only [Option.map_some,
+                  NodeBox.mapAddresses_node]
+                cases hnode : box.node with
+                | ctorN constructor fields =>
+                    simp [Node.mapAddresses, mapRunResult,
+                      Err.mapAddresses]
+                | papN called arity captured =>
+                    simp only [Node.mapAddresses]
+                    rw [dupVals_mapAddresses rename store captured.toList]
+                    cases hdup : dupVals store captured.toList with
+                    | error error =>
+                        change Except.error (Err.mapAddresses rename error) =
+                          mapRunResult rename (Except.error error)
+                        rfl
+                    | ok duplicated =>
+                        simp only [mapStoreResult]
+                        change (do
+                            let dropped ← IxIR1.dropVal after fuel
+                              (Store.mapAddresses rename duplicated)
+                              (.loc location)
+                            let total := captured.toList ++ arguments
+                            if total.length < arity then
+                              let (next, fresh) := dropped.allocNode .shared
+                                (.papN (rename called) arity total.toArray)
+                              .ok (next, .loc fresh)
+                            else if total.length == arity then
+                              match after.decls (rename called) with
+                              | none => .error (.unknownRef (rename called))
+                              | some declaration =>
+                                if declPapSafe declaration then
+                                  IxIR1.invoke after fuel (rename called)
+                                    total dropped
+                                else .error (.stuck
+                                  "shared pap targets a non-pap-safe declaration")
+                            else
+                              match after.decls (rename called) with
+                              | none => .error (.unknownRef (rename called))
+                              | some declaration =>
+                                if declPapSafe declaration then do
+                                  let (next, value) ← IxIR1.invoke after fuel
+                                    (rename called) (total.take arity) dropped
+                                  IxIR1.applyGo after fuel next value
+                                    (total.drop arity)
+                                else .error (.stuck
+                                  "shared pap targets a non-pap-safe declaration")) =
+                          mapRunResult rename (do
+                            let dropped ← IxIR1.dropVal before fuel duplicated
+                              (.loc location)
+                            let total := captured.toList ++ arguments
+                            if total.length < arity then
+                              let (next, fresh) := dropped.allocNode .shared
+                                (.papN called arity total.toArray)
+                              .ok (next, .loc fresh)
+                            else if total.length == arity then
+                              match before.decls called with
+                              | none => .error (.unknownRef called)
+                              | some declaration =>
+                                if declPapSafe declaration then
+                                  IxIR1.invoke before fuel called total dropped
+                                else .error (.stuck
+                                  "shared pap targets a non-pap-safe declaration")
+                            else
+                              match before.decls called with
+                              | none => .error (.unknownRef called)
+                              | some declaration =>
+                                if declPapSafe declaration then do
+                                  let (next, value) ← IxIR1.invoke before fuel
+                                    called (total.take arity) dropped
+                                  IxIR1.applyGo before fuel next value
+                                    (total.drop arity)
+                                else .error (.stuck
+                                  "shared pap targets a non-pap-safe declaration"))
+                        rw [smaller.dropVal duplicated (.loc location)]
+                        cases hdrop : IxIR1.dropVal before fuel duplicated
+                            (.loc location) with
+                        | error error =>
+                            change Except.error
+                                (Err.mapAddresses rename error) =
+                              mapRunResult rename (Except.error error)
+                            rfl
+                        | ok dropped =>
+                            simp only [mapStoreResult]
+                            let total := captured.toList ++ arguments
+                            change (if total.length < arity then
+                                let (next, fresh) :=
+                                  (Store.mapAddresses rename dropped).allocNode
+                                    .shared
+                                    (.papN (rename called) arity total.toArray)
+                                .ok (next, .loc fresh)
+                              else if total.length == arity then
+                                match after.decls (rename called) with
+                                | none => .error (.unknownRef (rename called))
+                                | some declaration =>
+                                  if declPapSafe declaration then
+                                    IxIR1.invoke after fuel (rename called)
+                                      total (Store.mapAddresses rename dropped)
+                                  else .error (.stuck
+                                    "shared pap targets a non-pap-safe declaration")
+                              else
+                                match after.decls (rename called) with
+                                | none => .error (.unknownRef (rename called))
+                                | some declaration =>
+                                  if declPapSafe declaration then do
+                                    let (next, value) ← IxIR1.invoke after fuel
+                                      (rename called) (total.take arity)
+                                      (Store.mapAddresses rename dropped)
+                                    IxIR1.applyGo after fuel next value
+                                      (total.drop arity)
+                                  else .error (.stuck
+                                    "shared pap targets a non-pap-safe declaration")) =
+                              mapRunResult rename
+                                (if total.length < arity then
+                                  let (next, fresh) := dropped.allocNode .shared
+                                    (.papN called arity total.toArray)
+                                  .ok (next, .loc fresh)
+                                else if total.length == arity then
+                                  match before.decls called with
+                                  | none => .error (.unknownRef called)
+                                  | some declaration =>
+                                    if declPapSafe declaration then
+                                      IxIR1.invoke before fuel called total dropped
+                                    else .error (.stuck
+                                      "shared pap targets a non-pap-safe declaration")
+                                else
+                                  match before.decls called with
+                                  | none => .error (.unknownRef called)
+                                  | some declaration =>
+                                    if declPapSafe declaration then do
+                                      let (next, value) ← IxIR1.invoke before fuel
+                                        called (total.take arity) dropped
+                                      IxIR1.applyGo before fuel next value
+                                        (total.drop arity)
+                                    else .error (.stuck
+                                      "shared pap targets a non-pap-safe declaration"))
+                            by_cases hless : total.length < arity
+                            · simp only [hless]
+                              change Except.ok
+                                  (((Store.mapAddresses rename dropped).allocNode
+                                    .shared (.papN (rename called) arity
+                                      total.toArray)).1,
+                                    RVal.loc
+                                      (((Store.mapAddresses rename dropped).allocNode
+                                        .shared (.papN (rename called) arity
+                                          total.toArray)).2)) =
+                                Except.ok
+                                  (Store.mapAddresses rename
+                                    ((dropped.allocNode .shared
+                                      (.papN called arity total.toArray)).1),
+                                    RVal.loc
+                                      ((dropped.allocNode .shared
+                                        (.papN called arity total.toArray)).2))
+                              simp [Store.mapAddresses_allocNode_fst,
+                                Node.mapAddresses]
+                              exact
+                                (Store.mapAddresses_allocNode_snd rename dropped
+                                  .shared
+                                  (.papN called arity total.toArray)).symm
+                            · simp only [hless]
+                              rw [contexts.decls called]
+                              cases hdecl : before.decls called with
+                              | none =>
+                                  simp [hdecl, mapRunResult, Err.mapAddresses]
+                              | some declaration =>
+                                simp only [hdecl, Option.map_some,
+                                  declPapSafe_mapAddresses]
+                                cases hpapsafe : declPapSafe declaration with
+                                | false =>
+                                  simp [hpapsafe, mapRunResult,
+                                    Err.mapAddresses]
+                                | true =>
+                                  simp only [hpapsafe, if_true]
+                                  by_cases hequal : total.length == arity
+                                  · simp only [hequal]
+                                    exact smaller.invoke called total dropped
+                                  · simp only [hequal]
+                                    rw [smaller.invoke called (total.take arity)
+                                      dropped]
+                                    cases hinvoke : IxIR1.invoke before fuel
+                                        called (total.take arity) dropped with
+                                    | error error =>
+                                        change Except.error
+                                            (Err.mapAddresses rename error) =
+                                          mapRunResult rename
+                                            (Except.error error)
+                                        rfl
+                                    | ok out =>
+                                        rcases out with ⟨calledStore, value⟩
+                                        simp only [mapRunResult]
+                                        exact smaller.applyGo calledStore value
+                                          (total.drop arity)
+      · intro store value
+        cases value with
+        | lit literal => simp [IxIR1.dropVal, mapStoreResult]
+        | erased => simp [IxIR1.dropVal, mapStoreResult]
+        | loc location =>
+            simp only [IxIR1.dropVal, Store.get?_mapAddresses]
+            cases hbox : store.get? location with
+            | none =>
+                simp [mapStoreResult, Err.mapAddresses]
+            | some box =>
+                simp only [Option.map_some,
+                  NodeBox.mapAddresses_world]
+                cases hworld : box.world with
+                | unique =>
+                    simp [mapStoreResult, Err.mapAddresses]
+                | shared =>
+                    simp only
+                    by_cases hone : box.rc == 1
+                    · simp only [hone, ↓reduceIte,
+                        NodeBox.mapAddresses_rc]
+                      cases hnode : box.node with
+                      | ctorN constructor fields =>
+                          simp only [hnode, NodeBox.mapAddresses_node,
+                            Node.mapAddresses]
+                          simpa only [Store.mapAddresses_rcTick,
+                            Store.mapAddresses_kill] using
+                            smaller.dropMany (store.rcTick.kill location)
+                              fields.toList
+                      | papN function arity arguments =>
+                          simp only [hnode, NodeBox.mapAddresses_node,
+                            Node.mapAddresses]
+                          simpa only [Store.mapAddresses_rcTick,
+                            Store.mapAddresses_kill] using
+                            smaller.dropMany (store.rcTick.kill location)
+                              arguments.toList
+                    · simp only [hone, NodeBox.mapAddresses_rc]
+                      simp [Bool.false_eq_true, mapStoreResult,
+                        NodeBox.mapAddresses]
+      · intro store values
+        cases values with
+        | nil => simp [IxIR1.dropMany, mapStoreResult]
+        | cons value rest =>
+            simp only [IxIR1.dropMany]
+            rw [smaller.dropVal store value]
+            cases hdrop : IxIR1.dropVal before fuel store value with
+            | error error =>
+                change Except.error (Err.mapAddresses rename error) =
+                  mapStoreResult rename (Except.error error)
+                rfl
+            | ok next =>
+                simp only [mapStoreResult]
+                exact smaller.dropMany next rest
+      · intro store value
+        cases value with
+        | lit literal => simp [IxIR1.dropUVal, mapStoreResult]
+        | erased => simp [IxIR1.dropUVal, mapStoreResult]
+        | loc location =>
+            simp only [IxIR1.dropUVal, Store.get?_mapAddresses]
+            cases hbox : store.get? location with
+            | none =>
+                simp [mapStoreResult, Err.mapAddresses]
+            | some box =>
+                simp only [Option.map_some,
+                  NodeBox.mapAddresses_world]
+                cases hworld : box.world with
+                | shared =>
+                    simp [mapStoreResult, Err.mapAddresses]
+                | unique =>
+                    simp only
+                    cases hnode : box.node with
+                    | ctorN constructor fields =>
+                        simp only [hnode, NodeBox.mapAddresses_node,
+                          Node.mapAddresses]
+                        simpa only [Store.mapAddresses_kill] using
+                          smaller.dropManyU (store.kill location)
+                            fields.toList
+                    | papN function arity arguments =>
+                        simp [hnode, NodeBox.mapAddresses_node,
+                          Node.mapAddresses, mapStoreResult,
+                          Err.mapAddresses]
+      · intro store values
+        cases values with
+        | nil => simp [IxIR1.dropManyU, mapStoreResult]
+        | cons value rest =>
+            simp only [IxIR1.dropManyU]
+            rw [smaller.dropUVal store value]
+            cases hdrop : IxIR1.dropUVal before fuel store value with
+            | error error =>
+                change Except.error (Err.mapAddresses rename error) =
+                  mapStoreResult rename (Except.error error)
+                rfl
+            | ok next =>
+                simp only [mapStoreResult]
+                exact smaller.dropManyU next rest
+
+/-! ## Public evaluator transport interface -/
+
+/-- Code evaluation is equivariant under every context-compatible address
+renaming.  This exposes the bundled mutual-induction result without requiring
+clients to mention `EvalTransportAt`. -/
+theorem runCode_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (fuel : Nat) (current : FnDef) (store : Store)
+    (environment : List RVal) (code : Code) :
+    runCode after fuel (FnDef.mapAddresses rename current)
+        (Store.mapAddresses rename store) environment
+        (Code.mapAddresses rename code) =
+      mapRunResult rename
+        (runCode before fuel current store environment code) :=
+  (evalTransportAt contexts fuel).runCode current store environment code
+
+/-- Single-operation evaluation is equivariant under every compatible
+address renaming. -/
+theorem runOp_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (fuel : Nat) (current : FnDef) (store : Store)
+    (environment : List RVal) (operation : Op) :
+    runOp after fuel (FnDef.mapAddresses rename current)
+        (Store.mapAddresses rename store) environment
+        (Op.mapAddresses rename operation) =
+      mapRunResult rename
+        (runOp before fuel current store environment operation) :=
+  (evalTransportAt contexts fuel).runOp current store environment operation
+
+/-- Known-function invocation is equivariant under a compatible address
+renaming. -/
+theorem invoke_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (fuel : Nat) (function : Address) (arguments : List RVal)
+    (store : Store) :
+    IxIR1.invoke after fuel (rename function) arguments
+        (Store.mapAddresses rename store) =
+      mapRunResult rename
+        (IxIR1.invoke before fuel function arguments store) :=
+  (evalTransportAt contexts fuel).invoke function arguments store
+
+/-- Dynamic application is equivariant under every context-compatible
+address renaming. Runtime values themselves need no mapping: declaration
+identities occur only in the context and in heap-resident PAP nodes. -/
+theorem applyGo_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (fuel : Nat) (store : Store) (function : RVal)
+    (arguments : List RVal) :
+    IxIR1.applyGo after fuel (Store.mapAddresses rename store)
+        function arguments =
+      mapRunResult rename
+        (IxIR1.applyGo before fuel store function arguments) :=
+  (evalTransportAt contexts fuel).applyGo store function arguments
+
+/-- Successful reference-count duplication on a renamed heap reflects to the
+original heap and preserves an exact heap preimage. -/
+theorem dupVals_success_preimage {rename : Address → Address}
+    {store store' : Store} {values : List RVal}
+    (run : dupVals (Store.mapAddresses rename store) values = .ok store') :
+    ∃ sourceStore',
+      dupVals store values = .ok sourceStore' ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [dupVals_mapAddresses] at run
+  cases sourceRun : dupVals store values with
+  | error error => simp [sourceRun, mapStoreResult] at run
+  | ok sourceStore' =>
+      simp only [sourceRun, mapStoreResult, Except.ok.injEq] at run
+      exact ⟨sourceStore', rfl, run.symm⟩
+
+/-- Successful shared destruction on a renamed heap reflects to the original
+context and preserves an exact heap preimage. -/
+theorem dropVal_success_preimage {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    {fuel : Nat} {store store' : Store} {value : RVal}
+    (run : IxIR1.dropVal after fuel (Store.mapAddresses rename store) value =
+      .ok store') :
+    ∃ sourceStore',
+      IxIR1.dropVal before fuel store value = .ok sourceStore' ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [(evalTransportAt contexts fuel).dropVal] at run
+  cases sourceRun : IxIR1.dropVal before fuel store value with
+  | error error => simp [sourceRun, mapStoreResult] at run
+  | ok sourceStore' =>
+      simp only [sourceRun, mapStoreResult, Except.ok.injEq] at run
+      exact ⟨sourceStore', rfl, run.symm⟩
+
+/-- Successful destruction of a list of shared values on a renamed heap
+reflects to the original context and preserves an exact heap preimage. -/
+theorem dropMany_success_preimage {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    {fuel : Nat} {store store' : Store} {values : List RVal}
+    (run : IxIR1.dropMany after fuel (Store.mapAddresses rename store) values =
+      .ok store') :
+    ∃ sourceStore',
+      IxIR1.dropMany before fuel store values = .ok sourceStore' ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [(evalTransportAt contexts fuel).dropMany] at run
+  cases sourceRun : IxIR1.dropMany before fuel store values with
+  | error error => simp [sourceRun, mapStoreResult] at run
+  | ok sourceStore' =>
+      simp only [sourceRun, mapStoreResult, Except.ok.injEq] at run
+      exact ⟨sourceStore', rfl, run.symm⟩
+
+/-- A successful dynamic application on a renamed heap comes from a
+successful application on the original heap. No injectivity or surjectivity
+of the address map is needed because the input heap is already an exact image
+and mapped errors cannot become successes. -/
+theorem applyGo_success_preimage {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    {fuel : Nat} {store store' : Store} {function : RVal}
+    {arguments : List RVal} {value : RVal}
+    (run : IxIR1.applyGo after fuel (Store.mapAddresses rename store)
+      function arguments = .ok (store', value)) :
+    ∃ sourceStore',
+      IxIR1.applyGo before fuel store function arguments =
+          .ok (sourceStore', value) ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [applyGo_mapAddresses contexts] at run
+  cases sourceRun : IxIR1.applyGo before fuel store function arguments with
+  | error error => simp [sourceRun, mapRunResult] at run
+  | ok output =>
+      obtain ⟨sourceStore', sourceValue⟩ := output
+      simp only [sourceRun, mapRunResult, Except.ok.injEq,
+        Prod.mk.injEq] at run
+      obtain ⟨storeEq, valueEq⟩ := run
+      subst sourceValue
+      exact ⟨sourceStore', rfl, storeEq.symm⟩
+
+/-- Successful renamed code execution reflects to a successful source run
+with the same runtime value and a heap preimage. -/
+theorem runCode_success_preimage {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    {fuel : Nat} {current : FnDef} {store store' : Store}
+    {environment : List RVal} {code : Code} {value : RVal}
+    (run : runCode after fuel (FnDef.mapAddresses rename current)
+      (Store.mapAddresses rename store) environment
+      (Code.mapAddresses rename code) = .ok (store', value)) :
+    ∃ sourceStore',
+      runCode before fuel current store environment code =
+          .ok (sourceStore', value) ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [runCode_mapAddresses contexts] at run
+  cases sourceRun : runCode before fuel current store environment code with
+  | error error => simp [sourceRun, mapRunResult] at run
+  | ok output =>
+      obtain ⟨sourceStore', sourceValue⟩ := output
+      simp only [sourceRun, mapRunResult, Except.ok.injEq,
+        Prod.mk.injEq] at run
+      obtain ⟨storeEq, valueEq⟩ := run
+      subst sourceValue
+      exact ⟨sourceStore', rfl, storeEq.symm⟩
+
+/-- Successful renamed operation execution reflects to a successful source
+operation and a heap preimage. -/
+theorem runOp_success_preimage {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    {fuel : Nat} {current : FnDef} {store store' : Store}
+    {environment : List RVal} {operation : Op} {value : RVal}
+    (run : runOp after fuel (FnDef.mapAddresses rename current)
+      (Store.mapAddresses rename store) environment
+      (Op.mapAddresses rename operation) = .ok (store', value)) :
+    ∃ sourceStore',
+      runOp before fuel current store environment operation =
+          .ok (sourceStore', value) ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [runOp_mapAddresses contexts] at run
+  cases sourceRun : runOp before fuel current store environment operation with
+  | error error => simp [sourceRun, mapRunResult] at run
+  | ok output =>
+      obtain ⟨sourceStore', sourceValue⟩ := output
+      simp only [sourceRun, mapRunResult, Except.ok.injEq,
+        Prod.mk.injEq] at run
+      obtain ⟨storeEq, valueEq⟩ := run
+      subst sourceValue
+      exact ⟨sourceStore', rfl, storeEq.symm⟩
+
+/-- Successful invocation of a renamed declaration reflects to the original
+declaration and produces a heap preimage. -/
+theorem invoke_success_preimage {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    {fuel : Nat} {function : Address} {arguments : List RVal}
+    {store store' : Store} {value : RVal}
+    (run : IxIR1.invoke after fuel (rename function) arguments
+      (Store.mapAddresses rename store) = .ok (store', value)) :
+    ∃ sourceStore',
+      IxIR1.invoke before fuel function arguments store =
+          .ok (sourceStore', value) ∧
+        store' = Store.mapAddresses rename sourceStore' := by
+  rw [invoke_mapAddresses contexts] at run
+  cases sourceRun : IxIR1.invoke before fuel function arguments store with
+  | error error => simp [sourceRun, mapRunResult] at run
+  | ok output =>
+      obtain ⟨sourceStore', sourceValue⟩ := output
+      simp only [sourceRun, mapRunResult, Except.ok.injEq,
+        Prod.mk.injEq] at run
+      obtain ⟨storeEq, valueEq⟩ := run
+      subst sourceValue
+      exact ⟨sourceStore', rfl, storeEq.symm⟩
+
+/-- A fresh-store top-level run has exactly the renamed result, including
+renamed errors and address-bearing heap nodes. -/
+theorem runMain_mapAddresses {rename : Address → Address}
+    {before after : Ctx} (contexts : Ctx.Renames rename before after)
+    (code : Code) (fuel : Nat := 100000) :
+    runMain after (Code.mapAddresses rename code) fuel =
+      mapRunResult rename (runMain before code fuel) := by
+  simpa [runMain, FnDef.mapAddresses] using
+    (runCode_mapAddresses contexts fuel
+      (⟨0, .shared, false, code⟩ : FnDef) ({} : Store) [] code)
+
+/-- The concrete content-addressing pass preserves a top-level run exactly.
+The source side uses the certified pre-address context: it agrees with every
+raw lookup and adds only stable aliases for newly introduced content keys. -/
+theorem runMain_of_run_eq_ok
+    {source generated : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : Readdress.run source generated main = .ok result)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none)
+    (fuel : Nat := 100000) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      mapRunResult (Renaming.apply result.addressMap)
+        (runMain (result.preAddressCtx (source ++ generated) oracle)
+          main fuel) := by
+  have haudit := semanticAudit_of_run_eq_ok hrun
+  rw [result.main_eq_mapAddresses haudit]
+  exact runMain_mapAddresses
+    (result.renames_preAddressCtx haudit oracle) main fuel
+
+/-- Successful raw execution therefore produces the same runtime value,
+the address-renamed heap, and identical instruction-level cost counters. -/
+theorem runMain_success_of_run_eq_ok
+    {source generated : List (Address × Decl)} {main : Code}
+    {result : Result}
+    (hrun : Readdress.run source generated main = .ok result)
+    (oracle : Address → List RVal → Option RVal)
+    {fuel : Nat} {store : Store} {value : RVal}
+    (hsource :
+      runMain (result.preAddressCtx (source ++ generated) oracle) main fuel =
+        .ok (store, value)) :
+    runMain (result.addressedCtx oracle) result.main fuel =
+      .ok (Store.mapAddresses (Renaming.apply result.addressMap) store,
+        value) := by
+  rw [runMain_of_run_eq_ok hrun oracle fuel, hsource]
+  rfl
+
+end Readdress
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/Reclamation.lean b/Ix/Compiler/IxIR1/Reclamation.lean
new file mode 100644
index 000000000..cfc7b785c
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Reclamation.lean
@@ -0,0 +1,2500 @@
+import Ix.Compiler.IxIR1.Progress
+
+/-!
+# IxIR₁ reclamation
+
+`Sim.RootOwnership` deliberately records exact external and internal owner
+counts without imposing a heap topology.  That is the right interface for
+semantic simulation, but by itself it admits an unreachable cycle (and even
+an isolated shared node with reference count zero).
+
+The executable lowerer currently allocates by appending and emits no in-place
+`reuse`.  Its runtime heaps therefore satisfy the separate history invariant
+below: every live reference count is positive and every owning edge points
+from a newer allocation to an older one.  Exact ownership plus this finite
+allocation order is enough to rule out every live node once the root list is
+empty.
+-/
+
+namespace Ix.Compiler.IxIR1.Reclamation
+
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Sim
+
+private theorem bindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem bindErr {error α β : Type} (err : error)
+    (next : α → Except error β) :
+    ((Except.error err : Except error α) >>= next) = .error err := rfl
+
+/-- The trace-level heap fact maintained by append-only IxIR₁ execution.
+
+It is intentionally separate from `RootOwnership`: ownership proofs remain
+insensitive to allocation history and `HeapIso`, while reclamation uses the
+concrete append order of the current no-reuse lowerer. -/
+structure AllocationOrderInvariant (store : Store) : Prop where
+  rc_pos : ∀ {loc box}, store.get? loc = some box → 0 < box.rc
+  child_lt : ∀ {parent box childLoc},
+    store.get? parent = some box →
+    RVal.loc childLoc ∈ nodeChildren box.node →
+    childLoc < parent
+
+/-- Every live partial-application node is genuinely partial: its stored
+capture is strictly shorter than the arity at which it dispatches.  The
+source evaluator establishes this at both PAP allocation sites, but its
+unchecked heap type cannot express the fact directly. -/
+structure PAPsUnder (store : Store) : Prop where
+  captured_lt : ∀ {location world rc address arity captured},
+    store.get? location =
+      some ⟨world, rc, .papN address arity captured⟩ →
+    captured.size < arity
+
+namespace PAPsUnder
+
+/-- The empty heap contains no malformed PAP. -/
+theorem empty : PAPsUnder ({} : Store) := by
+  constructor
+  intro location world rc address arity captured found
+  simp [Store.get?] at found
+
+/-- Removing live nodes or changing only their reference counts preserves
+PAP under-saturation. -/
+theorem ofRestricts {before after : Store} (h : PAPsUnder before)
+    (restricts : StoreGraphRestricts before after) : PAPsUnder after := by
+  constructor
+  intro location world rc address arity captured found
+  obtain ⟨beforeRc, beforeFound⟩ := restricts found
+  exact h.captured_lt beforeFound
+
+/-- A shared retain changes only the selected reference count. -/
+theorem incRcStore {store : Store} {location rc : Nat} {node : Node}
+    (h : PAPsUnder store)
+    (found : store.get? location = some ⟨.shared, rc, node⟩) :
+    PAPsUnder (Sim.incRcStore store location ⟨.shared, rc, node⟩) :=
+  h.ofRestricts (StoreGraphRestricts.incRcStore found)
+
+/-- Killing a live slot cannot expose a malformed PAP. -/
+theorem kill {store : Store} {location : Nat} {box : NodeBox}
+    (h : PAPsUnder store) (found : store.get? location = some box) :
+    PAPsUnder (store.kill location) :=
+  h.ofRestricts (StoreGraphRestricts.kill found)
+
+/-- Retaining a vector of shared values cannot change PAP payloads. -/
+theorem dupVals {store store' : Store} {values : List RVal}
+    (h : PAPsUnder store) (run : dupVals store values = .ok store') :
+    PAPsUnder store' := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except Err Store) = .ok store' at run
+      injection run with storeEq
+      subst store'
+      exact h
+  | cons head tail ih =>
+      cases head with
+      | lit literal =>
+          simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at run
+          exact ih h run
+      | erased =>
+          simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at run
+          exact ih h run
+      | loc location =>
+          simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at run
+          cases found : store.get? location with
+          | none => simp [found, bindErr] at run
+          | some box =>
+              cases box with
+              | mk world rc node =>
+                  cases world with
+                  | unique => simp [found, bindErr] at run
+                  | shared =>
+                      simp only [found] at run
+                      exact ih (h.incRcStore found) run
+
+/-- Appending a constructor preserves all existing PAP payloads. -/
+theorem allocCtor {store : Store} (h : PAPsUnder store)
+    (world : Ixon.Owned) (cid : CtorId) (fields : Array RVal) :
+    PAPsUnder (store.allocNode world (.ctorN cid fields)).1 := by
+  constructor
+  intro location boxWorld rc address arity captured found
+  by_cases fresh : location = store.nodes.size
+  · subst location
+    have allocated := HeapIso.get?_allocNode_new store world
+      (.ctorN cid fields)
+    have impossible :
+        (⟨boxWorld, rc, .papN address arity captured⟩ : NodeBox) =
+          ⟨world, 1, .ctorN cid fields⟩ :=
+      Option.some.inj (found.symm.trans allocated)
+    cases impossible
+  · exact h.captured_lt (HeapIso.get?_of_allocNode_old fresh found)
+
+/-- Appending a checked under-saturated PAP preserves the global property. -/
+theorem allocPap {store : Store} (h : PAPsUnder store)
+    (world : Ixon.Owned) (address : Ixon.Address) (arity : Nat)
+    (captured : Array RVal) (under : captured.size < arity) :
+    PAPsUnder (store.allocNode world (.papN address arity captured)).1 := by
+  constructor
+  intro location boxWorld rc foundAddress foundArity foundCaptured found
+  by_cases fresh : location = store.nodes.size
+  · subst location
+    have allocated := HeapIso.get?_allocNode_new store world
+      (.papN address arity captured)
+    have boxEq :
+        (⟨boxWorld, rc, .papN foundAddress foundArity foundCaptured⟩ :
+          NodeBox) = ⟨world, 1, .papN address arity captured⟩ :=
+      Option.some.inj (found.symm.trans allocated)
+    cases boxEq
+    exact under
+  · exact h.captured_lt (HeapIso.get?_of_allocNode_old fresh found)
+
+/-- Shared and unique recursive releases only remove nodes or alter RCs. -/
+theorem dropVal {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {value : RVal} (h : PAPsUnder store)
+    (run : Ix.Compiler.IxIR1.dropVal ctx fuel store value = .ok store') :
+    PAPsUnder store' :=
+  h.ofRestricts (dropVal_restricts run)
+
+theorem dropMany {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {values : List RVal} (h : PAPsUnder store)
+    (run : Ix.Compiler.IxIR1.dropMany ctx fuel store values = .ok store') :
+    PAPsUnder store' :=
+  h.ofRestricts (dropMany_restricts run)
+
+theorem dropUVal {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {value : RVal} (h : PAPsUnder store)
+    (run : Ix.Compiler.IxIR1.dropUVal ctx fuel store value = .ok store') :
+    PAPsUnder store' :=
+  h.ofRestricts (dropUVal_restricts run)
+
+theorem dropManyU {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {values : List RVal} (h : PAPsUnder store)
+    (run : Ix.Compiler.IxIR1.dropManyU ctx fuel store values = .ok store') :
+    PAPsUnder store' :=
+  h.ofRestricts (dropManyU_restricts run)
+
+end PAPsUnder
+
+/-- A runtime value names only a slot already present in the store.  Unlike
+`LiveRVal`, this deliberately permits a dead-but-allocated slot: stale values
+can remain in an evaluator environment after their final release, but they
+still cannot predict a future append location. -/
+def ValueInBounds (store : Store) : RVal → Prop
+  | .loc loc => loc < store.nodes.size
+  | .lit _ | .erased => True
+
+def ValuesInBounds (store : Store) (values : List RVal) : Prop :=
+  ∀ value ∈ values, ValueInBounds store value
+
+theorem ValueInBounds.mono {before after : Store} {value : RVal}
+    (hsize : before.nodes.size ≤ after.nodes.size)
+    (h : ValueInBounds before value) : ValueInBounds after value := by
+  cases value with
+  | loc loc => exact Nat.lt_of_lt_of_le h hsize
+  | lit literal => trivial
+  | erased => trivial
+
+theorem ValuesInBounds.mono {before after : Store} {values : List RVal}
+    (hsize : before.nodes.size ≤ after.nodes.size)
+    (h : ValuesInBounds before values) : ValuesInBounds after values := by
+  intro value hvalue
+  exact (h value hvalue).mono hsize
+
+theorem ValuesInBounds.nil (store : Store) : ValuesInBounds store [] := by
+  simp [ValuesInBounds]
+
+theorem ValuesInBounds.cons {store : Store} {value : RVal}
+    {values : List RVal} (hvalue : ValueInBounds store value)
+    (hvalues : ValuesInBounds store values) :
+    ValuesInBounds store (value :: values) := by
+  intro found hfound
+  rcases List.mem_cons.mp hfound with rfl | htail
+  · exact hvalue
+  · exact hvalues found htail
+
+theorem ValuesInBounds.append {store : Store} {left right : List RVal}
+    (hleft : ValuesInBounds store left)
+    (hright : ValuesInBounds store right) :
+    ValuesInBounds store (left ++ right) := by
+  intro value hvalue
+  rcases List.mem_append.mp hvalue with hvalue | hvalue
+  · exact hleft value hvalue
+  · exact hright value hvalue
+
+theorem ValuesInBounds.reverse {store : Store} {values : List RVal}
+    (h : ValuesInBounds store values) :
+    ValuesInBounds store values.reverse := by
+  intro value hvalue
+  exact h value (by simpa using hvalue)
+
+theorem ValuesInBounds.take {store : Store} {values : List RVal}
+    (h : ValuesInBounds store values) (n : Nat) :
+    ValuesInBounds store (values.take n) := by
+  intro value hvalue
+  exact h value (List.mem_of_mem_take hvalue)
+
+theorem ValuesInBounds.drop {store : Store} {values : List RVal}
+    (h : ValuesInBounds store values) (n : Nat) :
+    ValuesInBounds store (values.drop n) := by
+  intro value hvalue
+  exact h value (List.mem_of_mem_drop hvalue)
+
+private theorem ValuesInBounds.foldlPrependList {store : Store}
+    {values env : List RVal} (hvalues : ValuesInBounds store values)
+    (henv : ValuesInBounds store env) :
+    ValuesInBounds store (values.foldl (fun acc value => value :: acc) env) := by
+  induction values generalizing env with
+  | nil => exact henv
+  | cons value values ih =>
+    simp only [List.foldl_cons]
+    exact ih
+      (fun found hfound =>
+        hvalues found (List.mem_cons_of_mem value hfound))
+      (henv.cons (hvalues value (List.mem_cons_self)))
+
+theorem ValuesInBounds.foldlPrepend {store : Store} {values : Array RVal}
+    {env : List RVal} (hvalues : ValuesInBounds store values.toList)
+    (henv : ValuesInBounds store env) :
+    ValuesInBounds store (values.foldl (fun acc value => value :: acc) env) := by
+  rw [← Array.foldl_toList]
+  exact hvalues.foldlPrependList henv
+
+theorem RVal.inBounds_of_get? {store : Store} {loc : Nat} {box : NodeBox}
+    (hget : store.get? loc = some box) :
+    ValueInBounds store (RVal.loc loc) :=
+  (Array.getElem?_eq_some_iff.mp (nodes_get?_of_get? hget)).1
+
+/-- Backward edges in a live node are automatically allocated and bounded. -/
+theorem AllocationOrderInvariant.childrenInBounds {store : Store}
+    (h : AllocationOrderInvariant store) {parent : Nat} {box : NodeBox}
+    (hget : store.get? parent = some box) :
+    ValuesInBounds store (nodeChildren box.node) := by
+  intro child hchild
+  cases child with
+  | loc childLoc =>
+    exact Nat.lt_trans (h.child_lt hget hchild)
+      (RVal.inBounds_of_get? hget)
+  | lit literal => trivial
+  | erased => trivial
+
+theorem resolveAtom_inBounds {store : Store} {env : List RVal}
+    {atom : Atom} {value : RVal} (henv : ValuesInBounds store env)
+    (hresolve : resolveAtom env atom = .ok value) :
+    ValueInBounds store value := by
+  cases atom with
+  | var idx =>
+    cases hget : env[idx]? with
+    | none => simp [resolveAtom, hget] at hresolve
+    | some found =>
+      simp [resolveAtom, hget] at hresolve
+      subst value
+      exact henv found (List.mem_of_getElem? hget)
+  | lit literal =>
+    simp [resolveAtom] at hresolve
+    subst value
+    trivial
+  | erased =>
+    simp [resolveAtom] at hresolve
+    subst value
+    trivial
+
+private theorem resolveAtomsList_inBounds {store : Store}
+    {env : List RVal} (henv : ValuesInBounds store env) :
+    ∀ (atoms : List Atom) (acc values : List RVal),
+      ValuesInBounds store acc →
+      atoms.foldlM
+          (fun acc atom => do
+            pure (acc ++ [← resolveAtom env atom])) acc = .ok values →
+      ValuesInBounds store values
+  | [], acc, values, hacc, heval => by
+      change (Except.ok acc : Except Err (List RVal)) = .ok values at heval
+      injection heval with hvalues
+      subst values
+      exact hacc
+  | atom :: atoms, acc, values, hacc, heval => by
+      simp only [List.foldlM_cons] at heval
+      cases hresolve : resolveAtom env atom with
+      | error err => simp [hresolve, bindErr] at heval
+      | ok value =>
+        rw [hresolve, bindOk] at heval
+        apply resolveAtomsList_inBounds henv atoms (acc ++ [value]) values
+        · exact hacc.append
+            ((ValuesInBounds.nil store).cons
+              (resolveAtom_inBounds henv hresolve))
+        · exact heval
+
+theorem resolveAtoms_inBounds {store : Store} {env : List RVal}
+    {atoms : Array Atom} {values : List RVal}
+    (henv : ValuesInBounds store env)
+    (heval : resolveAtoms env atoms = .ok values) :
+    ValuesInBounds store values := by
+  rw [resolveAtoms, ← Array.foldlM_toList] at heval
+  exact resolveAtomsList_inBounds henv atoms.toList [] values
+    (ValuesInBounds.nil store) heval
+
+/-! ## Counter and live-slot accounting -/
+
+private def liveCountList {alpha : Type} : List (Option alpha) → Nat
+  | [] => 0
+  | none :: rest => liveCountList rest
+  | some _ :: rest => liveCountList rest + 1
+
+private theorem liveCountList_eq_zero_iff_no_some {alpha : Type} :
+    ∀ values : List (Option alpha),
+      liveCountList values = 0 ↔ ∀ value, some value ∉ values
+  | [] => by simp [liveCountList]
+  | none :: rest => by
+      simp [liveCountList, liveCountList_eq_zero_iff_no_some rest]
+  | some head :: rest => by
+      constructor
+      · intro hzero
+        simp [liveCountList] at hzero
+      · intro hnone
+        exact False.elim (hnone head (by simp))
+
+private theorem foldl_live_eq {alpha : Type}
+    (values : List (Option alpha)) (acc : Nat) :
+    values.foldl (fun n value => if value.isSome then n + 1 else n) acc =
+      acc + liveCountList values := by
+  induction values generalizing acc with
+  | nil => simp [liveCountList]
+  | cons head tail ih =>
+      cases head <;> simp [liveCountList, ih] <;> omega
+
+private theorem Store.live_eq_liveCountList (store : Store) :
+    store.live = liveCountList store.nodes.toList := by
+  rw [Store.live, ← Array.foldl_toList]
+  simpa using foldl_live_eq store.nodes.toList 0
+
+/-- A store has no live nodes exactly when its slot array contains no live
+box.  This representation bridge is useful when a heap is related by a
+location bijection rather than by literal array equality. -/
+theorem Store.live_eq_zero_iff_no_live_slot (store : Store) :
+    store.live = 0 ↔ ∀ box, some box ∉ store.nodes := by
+  rw [Store.live_eq_liveCountList]
+  simpa using liveCountList_eq_zero_iff_no_some store.nodes.toList
+
+private theorem liveCountList_set_none {alpha : Type} :
+    ∀ {values : List (Option alpha)} {index : Nat} {value : alpha},
+      values[index]? = some (some value) →
+      liveCountList (values.set index none) + 1 = liveCountList values
+  | [], index, value, hget => by simp at hget
+  | head :: tail, 0, value, hget => by
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at hget
+      subst head
+      simp [liveCountList]
+  | head :: tail, index + 1, value, hget => by
+      simp only [List.getElem?_cons_succ] at hget
+      have ih := liveCountList_set_none hget
+      cases head <;> simp [liveCountList] at ih ⊢ <;> omega
+
+private theorem liveCountList_set_some {alpha : Type} :
+    ∀ {values : List (Option alpha)} {index : Nat} {old new : alpha},
+      values[index]? = some (some old) →
+      liveCountList (values.set index (some new)) = liveCountList values
+  | [], index, old, new, hget => by simp at hget
+  | head :: tail, 0, old, new, hget => by
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at hget
+      subst head
+      simp [liveCountList]
+  | head :: tail, index + 1, old, new, hget => by
+      simp only [List.getElem?_cons_succ] at hget
+      have ih := liveCountList_set_some (new := new) hget
+      cases head <;> simp [liveCountList] at ih ⊢ <;> omega
+
+private theorem Store.live_allocNode (store : Store) (world : Ixon.Owned)
+    (node : Node) :
+    (store.allocNode world node).1.live = store.live + 1 := by
+  simp [Store.live, Store.allocNode]
+
+private theorem Store.live_kill {store : Store} {loc : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    (store.kill loc).live + 1 = store.live := by
+  have hnodes := nodes_get?_of_get? hget
+  have hlist : store.nodes.toList[loc]? = some (some box) := by
+    simpa using hnodes
+  rw [Store.live_eq_liveCountList, Store.live_eq_liveCountList]
+  simp only [Store.kill, Array.toList_set!]
+  exact liveCountList_set_none hlist
+
+private theorem Store.live_setBox {store : Store} {loc : Nat}
+    {old new : NodeBox} (hget : store.get? loc = some old) :
+    (store.setBox loc new).live = store.live := by
+  have hnodes := nodes_get?_of_get? hget
+  have hlist : store.nodes.toList[loc]? = some (some old) := by
+    simpa using hnodes
+  rw [Store.live_eq_liveCountList, Store.live_eq_liveCountList]
+  simp only [Store.setBox, Array.toList_set!]
+  exact liveCountList_set_some hlist
+
+/-- The store-history facts preserved by every successful evaluator entry.
+Besides monotone slot capacity and reuse count, the two balance equations say
+that allocation exactly accounts for new slots and for the sum of live nodes
+and completed frees. -/
+structure StoreFootprint (before after : Store) : Prop where
+  nodes_size : before.nodes.size ≤ after.nodes.size
+  reuses : before.reuses ≤ after.reuses
+  allocation_balance :
+    after.nodes.size + before.allocs = before.nodes.size + after.allocs
+  live_balance :
+    after.live + after.frees + before.allocs =
+      before.live + before.frees + after.allocs
+
+theorem StoreFootprint.refl (store : Store) : StoreFootprint store store := by
+  constructor <;> omega
+
+theorem StoreFootprint.trans {first second third : Store}
+    (h₁ : StoreFootprint first second) (h₂ : StoreFootprint second third) :
+    StoreFootprint first third := by
+  constructor
+  · exact Nat.le_trans h₁.nodes_size h₂.nodes_size
+  · exact Nat.le_trans h₁.reuses h₂.reuses
+  · have hfirst := h₁.allocation_balance
+    have hsecond := h₂.allocation_balance
+    omega
+  · have hfirst := h₁.live_balance
+    have hsecond := h₂.live_balance
+    omega
+
+private theorem footprint_allocNode (store : Store) (world : Ixon.Owned)
+    (node : Node) :
+    StoreFootprint store (store.allocNode world node).1 := by
+  constructor
+  · simp [Store.allocNode]
+  · simp [Store.allocNode]
+  · simp [Store.allocNode]
+    omega
+  · rw [Store.live_allocNode]
+    simp [Store.allocNode]
+    omega
+
+private theorem footprint_setBox {store : Store} {loc : Nat}
+    {old new : NodeBox} (hget : store.get? loc = some old) :
+    StoreFootprint store (store.setBox loc new) := by
+  constructor
+  · simp [Store.setBox]
+  · simp [Store.setBox]
+  · simp [Store.setBox]
+  · rw [Store.live_setBox hget]
+    simp [Store.setBox]
+
+private theorem footprint_kill {store : Store} {loc : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    StoreFootprint store (store.kill loc) := by
+  constructor
+  · simp [Store.kill]
+  · simp [Store.kill]
+  · simp [Store.kill]
+  · have hlive := Store.live_kill hget
+    have hfrees : (store.kill loc).frees = store.frees + 1 := rfl
+    have hallocs : (store.kill loc).allocs = store.allocs := rfl
+    rw [hfrees, hallocs]
+    omega
+
+private theorem footprint_rcTick (store : Store) :
+    StoreFootprint store store.rcTick := by
+  constructor
+  · simp [Store.rcTick]
+  · simp [Store.rcTick]
+  · simp [Store.rcTick]
+  · change store.live + store.frees + store.allocs =
+      store.live + store.frees + store.allocs
+    rfl
+
+private theorem footprint_reuse {store : Store} {loc : Nat}
+    {old : NodeBox} (hget : store.get? loc = some old) (node : Node) :
+    StoreFootprint store
+      { store.setBox loc ⟨.unique, 1, node⟩ with
+        reuses := (store.setBox loc ⟨.unique, 1, node⟩).reuses + 1 } := by
+  have hset := footprint_setBox (new := ⟨.unique, 1, node⟩) hget
+  constructor
+  · simpa using hset.nodes_size
+  · simp [Store.setBox]
+  · simpa using hset.allocation_balance
+  · change (store.setBox loc ⟨.unique, 1, node⟩).live +
+      (store.setBox loc ⟨.unique, 1, node⟩).frees + store.allocs =
+        store.live + store.frees +
+          (store.setBox loc ⟨.unique, 1, node⟩).allocs
+    exact hset.live_balance
+
+private theorem footprint_incRcStore {store : Store} {loc : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    StoreFootprint store (Sim.incRcStore store loc box) := by
+  unfold Sim.incRcStore
+  exact (footprint_setBox (new := { box with rc := box.rc + 1 }) hget).trans
+    (footprint_rcTick _)
+
+private theorem footprint_decRcStore {store : Store} {loc : Nat}
+    {box : NodeBox} (hget : store.get? loc = some box) :
+    StoreFootprint store (Sim.decRcStore store loc box) := by
+  unfold Sim.decRcStore
+  apply (footprint_rcTick store).trans
+  apply footprint_setBox
+  simpa using hget
+
+/-- The pap-retain helper only updates RC state. -/
+theorem dupVals_footprint {store store' : Store} {values : List RVal}
+    (heval : dupVals store values = .ok store') :
+    StoreFootprint store store' := by
+  induction values generalizing store with
+  | nil =>
+    change (.ok store : Except Err Store) = .ok store' at heval
+    injection heval with hstore
+    subst store'
+    exact StoreFootprint.refl store
+  | cons head tail ih =>
+    cases head with
+    | lit literal =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      exact ih heval
+    | erased =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      exact ih heval
+    | loc loc =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      cases hget : store.get? loc with
+      | none => simp [hget, bindErr] at heval
+      | some box =>
+        cases box with
+        | mk world rc node =>
+          cases world with
+          | unique => simp [hget, bindErr] at heval
+          | shared =>
+            simp only [hget] at heval
+            exact (footprint_incRcStore hget).trans
+              (ih heval)
+
+private def FootprintAt (fuel : Nat) : Prop :=
+  (∀ ctx cur store env code store' value,
+    runCode ctx fuel cur store env code = .ok (store', value) →
+      StoreFootprint store store') ∧
+  (∀ ctx cur store env op store' value,
+    runOp ctx fuel cur store env op = .ok (store', value) →
+      StoreFootprint store store') ∧
+  (∀ ctx address args store store' value,
+    invoke ctx fuel address args store = .ok (store', value) →
+      StoreFootprint store store') ∧
+  (∀ ctx store function args store' value,
+    applyGo ctx fuel store function args = .ok (store', value) →
+      StoreFootprint store store') ∧
+  (∀ ctx store value store',
+    dropVal ctx fuel store value = .ok store' →
+      StoreFootprint store store') ∧
+  (∀ ctx store values store',
+    dropMany ctx fuel store values = .ok store' →
+      StoreFootprint store store') ∧
+  (∀ ctx store value store',
+    dropUVal ctx fuel store value = .ok store' →
+      StoreFootprint store store') ∧
+  (∀ ctx store values store',
+    dropManyU ctx fuel store values = .ok store' →
+      StoreFootprint store store')
+
+/-- Every successful evaluator entry is monotone in allocated slot capacity
+and in the reuse counter.  This history theorem is independent of ownership
+and is what lets an equal endpoint reuse count rule out reuse in every
+intermediate call. -/
+private theorem footprintAt : ∀ fuel, FootprintAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value h
+      rw [runCode.eq_def] at h
+      simp at h
+    · intro ctx cur store env op store' value h
+      rw [runOp.eq_def] at h
+      simp at h
+    · intro ctx address args store store' value h
+      rw [invoke.eq_def] at h
+      simp at h
+    · intro ctx store function args store' value h
+      rw [applyGo.eq_def] at h
+      simp at h
+    · intro ctx store value store' h
+      rw [dropVal.eq_def] at h
+      simp at h
+    · intro ctx store values store' h
+      rw [dropMany.eq_def] at h
+      simp at h
+    · intro ctx store value store' h
+      rw [dropUVal.eq_def] at h
+      simp at h
+    · intro ctx store values store' h
+      rw [dropManyU.eq_def] at h
+      simp at h
+  | succ fuel ih =>
+    obtain ⟨ihCode, ihOp, ihInvoke, ihApply, ihDrop, ihDropMany,
+      ihDropU, ihDropManyU⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value h
+      cases code with
+      | ret atom =>
+        rw [runCode.eq_def] at h
+        dsimp only at h
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at h; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at h
+          have hpair := Except.ok.inj h
+          cases hpair
+          exact StoreFootprint.refl store
+      | letOp op rest =>
+        rw [runCode.eq_def] at h
+        dsimp only at h
+        cases hop : runOp ctx fuel cur store env op with
+        | error err => rw [hop, bindErr] at h; contradiction
+        | ok opOut =>
+          rcases opOut with ⟨middle, opValue⟩
+          rw [hop, bindOk] at h
+          exact (ihOp _ _ _ _ _ _ _ hop).trans
+            (ihCode _ _ _ _ _ _ _ h)
+      | case scrut peelNat alts =>
+        rw [runCode.eq_def] at h
+        dsimp only at h
+        cases hscrut : resolveAtom env scrut with
+        | error err => rw [hscrut, bindErr] at h; contradiction
+        | ok scrutValue =>
+          rw [hscrut, bindOk] at h
+          cases scrutValue with
+          | loc loc =>
+            dsimp only at h
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at h
+            | some box =>
+              simp only [hbox] at h
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity args => simp at h
+                | ctorN cid fields =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == cid.cidx) with
+                  | none => simp [halt] at h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases hsize : fields.size != fieldCount
+                      · simp only [halt, hsize, Bool.false_eq_true,
+                          if_false] at h
+                        exact ihCode _ _ _ _ _ _ _ h
+                      · simp [halt, hsize] at h
+          | lit literal =>
+            cases literal with
+            | str string => simp at h
+            | nat n =>
+              cases hpeel : peelNat with
+              | false => simp [hpeel] at h
+              | true =>
+                cases n with
+                | zero =>
+                  cases halt : alts.find? (fun alt => alt.cidx == 0) with
+                  | none => simp [hpeel, halt] at h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at h
+                        exact ihCode _ _ _ _ _ _ _ h
+                      | succ fieldCount => simp [hpeel, halt] at h
+                | succ n =>
+                  cases halt : alts.find? (fun alt => alt.cidx == 1) with
+                  | none => simp [hpeel, halt] at h
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero => simp [hpeel, halt] at h
+                      | succ fieldCount =>
+                        cases fieldCount with
+                        | zero =>
+                          simp only [hpeel, halt] at h
+                          exact ihCode _ _ _ _ _ _ _ h
+                        | succ fieldCount => simp [hpeel, halt] at h
+          | erased => simp at h
+    · intro ctx cur store env op store' value h
+      cases op with
+      | pure atom =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at h; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at h
+          have hpair := Except.ok.inj h
+          cases hpair
+          exact StoreFootprint.refl store
+      | alloc world cid atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at h; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          have hpair := Except.ok.inj h
+          cases hpair
+          exact footprint_allocNode store world (.ctorN cid values.toArray)
+      | reuse target cid atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at h; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at h; contradiction
+          | ok targetValue =>
+            rw [htarget, bindOk] at h
+            cases targetValue with
+            | lit literal => simp at h
+            | erased => simp at h
+            | loc loc =>
+              cases hbox : store.get? loc with
+              | none => simp [hbox] at h
+              | some box =>
+                simp only [hbox] at h
+                cases box with
+                | mk world rc node =>
+                  cases world with
+                  | shared => simp at h
+                  | unique =>
+                    dsimp only at h
+                    have hpair := Except.ok.inj h
+                    cases hpair
+                    exact footprint_reuse hbox
+                      (.ctorN cid values.toArray)
+      | free target =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at h; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          cases targetValue with
+          | lit literal => simp at h
+          | erased => simp at h
+          | loc loc =>
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at h
+            | some box =>
+              simp only [hbox] at h
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | shared => simp at h
+                | unique =>
+                  have hpair := Except.ok.inj h
+                  cases hpair
+                  exact footprint_kill hbox
+      | dup target =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at h; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+          | erased =>
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+          | loc loc =>
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at h
+            | some box =>
+              simp only [hbox] at h
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | unique => simp at h
+                | shared =>
+                  have hpair := Except.ok.inj h
+                  cases hpair
+                  exact footprint_incRcStore hbox
+      | drop target =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at h; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+          | erased =>
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+          | loc loc =>
+            dsimp only at h
+            cases hdrop : dropVal ctx fuel store (.loc loc) with
+            | error err => rw [hdrop, bindErr] at h; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at h
+              have hpair := Except.ok.inj h
+              cases hpair
+              exact ihDrop _ _ _ _ hdrop
+      | dropU target =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at h; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+          | erased =>
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+          | loc loc =>
+            dsimp only at h
+            cases hdrop : dropUVal ctx fuel store (.loc loc) with
+            | error err => rw [hdrop, bindErr] at h; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at h
+              have hpair := Except.ok.inj h
+              cases hpair
+              exact ihDropU _ _ _ _ hdrop
+      | fetch target field =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at h; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at h
+          cases targetValue with
+          | lit literal => simp at h
+          | erased => simp at h
+          | loc loc =>
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at h
+            | some box =>
+              simp only [hbox] at h
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity args => simp at h
+                | ctorN cid fields =>
+                  cases hfield : fields[field]? with
+                  | none => simp [hfield] at h
+                  | some result =>
+                    simp only [hfield] at h
+                    have hpair := Except.ok.inj h
+                    cases hpair
+                    exact StoreFootprint.refl store
+      | call address atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at h; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          exact ihInvoke _ _ _ _ _ _ h
+      | callSelf atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at h; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          cases harity : values.length != cur.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h
+            cases hcode : runCode ctx fuel cur store values.reverse
+                cur.body with
+            | error err => rw [hcode, bindErr] at h; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hcode, bindOk] at h
+              obtain ⟨hresult, _⟩ := checkResultWorld_ok h
+              cases hresult
+              exact ihCode _ _ _ _ _ _ _ hcode
+          · simp [harity] at h
+      | papp address atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at h; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          cases hdecl : ctx.decls address with
+          | none => simp [hdecl] at h
+          | some decl =>
+            simp only [hdecl] at h
+            by_cases hlen : values.length < declArity decl
+            · simp only [hlen, if_true] at h
+              have hpair := Except.ok.inj h
+              cases hpair
+              exact footprint_allocNode store .shared
+                (.papN address (declArity decl) values.toArray)
+            · simp only [hlen, if_false] at h
+              contradiction
+      | apply function atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hfunction : resolveAtom env function with
+        | error err => rw [hfunction, bindErr] at h; contradiction
+        | ok functionValue =>
+          rw [hfunction, bindOk] at h
+          cases hargs : resolveAtoms env atoms with
+          | error err => rw [hargs, bindErr] at h; contradiction
+          | ok values =>
+            rw [hargs, bindOk] at h
+            exact ihApply _ _ _ _ _ _ h
+      | extern address atoms =>
+        rw [runOp.eq_def] at h
+        dsimp only at h
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at h; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at h
+          cases hcall : callScalarOracle ctx address values with
+          | error err => rw [hcall, bindErr] at h; contradiction
+          | ok result =>
+            rw [hcall, bindOk] at h
+            have hpair := Except.ok.inj h
+            cases hpair
+            exact StoreFootprint.refl store
+    · intro ctx address args store store' value h
+      rw [invoke.eq_def] at h
+      dsimp only at h
+      cases hdecl : ctx.decls address with
+      | none => simp [hdecl] at h
+      | some decl =>
+        simp only [hdecl] at h
+        cases decl with
+        | extern arity =>
+          cases harity : args.length != arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h
+            cases hcall : callScalarOracle ctx address args with
+            | error err => simp [hcall] at h
+            | ok result =>
+              simp only [hcall] at h
+              have hpair := Except.ok.inj h
+              cases hpair
+              exact StoreFootprint.refl store
+          · simp [harity] at h
+        | fn d =>
+          cases harity : args.length != d.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at h
+            cases hcode : runCode ctx fuel d store args.reverse d.body with
+            | error err => rw [hcode, bindErr] at h; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hcode, bindOk] at h
+              obtain ⟨hresult, _⟩ := checkResultWorld_ok h
+              cases hresult
+              exact ihCode _ _ _ _ _ _ _ hcode
+          · simp [harity] at h
+    · intro ctx store function args store' value h
+      rw [applyGo.eq_def] at h
+      dsimp only at h
+      cases function with
+      | lit literal => simp at h
+      | erased =>
+        dsimp only at h
+        cases hdrop : dropMany ctx fuel store args with
+        | error err => rw [hdrop, bindErr] at h; contradiction
+        | ok dropped =>
+          rw [hdrop, bindOk] at h
+          have hpair := Except.ok.inj h
+          cases hpair
+          exact ihDropMany _ _ _ _ hdrop
+      | loc loc =>
+        dsimp only at h
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at h
+        | some box =>
+          simp only [hbox] at h
+          cases box with
+          | mk world rc node =>
+            cases node with
+            | ctorN cid fields =>
+              dsimp only at h
+              simp at h
+            | papN address arity captured =>
+              dsimp only at h
+              cases hdup : dupVals store captured.toList with
+              | error err => rw [hdup, bindErr] at h; contradiction
+              | ok duplicated =>
+                rw [hdup, bindOk] at h
+                cases hdrop : dropVal ctx fuel duplicated (.loc loc) with
+                | error err => rw [hdrop, bindErr] at h; contradiction
+                | ok ready =>
+                  rw [hdrop, bindOk] at h
+                  have hprefix := (dupVals_footprint hdup).trans
+                    (ihDrop _ _ _ _ hdrop)
+                  by_cases hunder :
+                      (captured.toList ++ args).length < arity
+                  · simp only [hunder] at h
+                    have hpair := Except.ok.inj h
+                    cases hpair
+                    exact hprefix.trans
+                      (footprint_allocNode ready .shared
+                        (.papN address arity
+                          (captured.toList ++ args).toArray))
+                  · simp only [hunder] at h
+                    cases hexact :
+                        (captured.toList ++ args).length == arity
+                    · simp only [hexact, Bool.false_eq_true, if_false] at h
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at h
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false => simp [hdecl, hpapsafe] at h
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at h
+                          cases hinvoke : invoke ctx fuel address
+                              ((captured.toList ++ args).take arity) ready with
+                          | error err =>
+                            rw [hinvoke, bindErr] at h
+                            contradiction
+                          | ok called =>
+                            rcases called with ⟨calledStore, calledValue⟩
+                            rw [hinvoke, bindOk] at h
+                            exact hprefix.trans
+                              ((ihInvoke _ _ _ _ _ _ hinvoke).trans
+                                (ihApply _ _ _ _ _ _ h))
+                    · simp only [hexact, if_true] at h
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at h
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false => simp [hdecl, hpapsafe] at h
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at h
+                          exact hprefix.trans (ihInvoke _ _ _ _ _ _ h)
+    · intro ctx store value store' h
+      rw [dropVal.eq_def] at h
+      dsimp only at h
+      cases value with
+      | lit literal =>
+        injection h with hstore
+        subst store'
+        exact StoreFootprint.refl store
+      | erased =>
+        injection h with hstore
+        subst store'
+        exact StoreFootprint.refl store
+      | loc loc =>
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at h
+        | some box =>
+          simp only [hbox] at h
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => simp at h
+            | shared =>
+              cases hrc : rc == 1
+              · simp only [hrc, Bool.false_eq_true, if_false] at h
+                injection h with hstore
+                subst store'
+                exact footprint_decRcStore hbox
+              · simp only [hrc, if_true] at h
+                have hprefix := (footprint_rcTick store).trans
+                  (footprint_kill (by simpa using hbox))
+                cases node with
+                | ctorN cid fields =>
+                  exact hprefix.trans (ihDropMany _ _ _ _ h)
+                | papN address arity args =>
+                  exact hprefix.trans (ihDropMany _ _ _ _ h)
+    · intro ctx store values store' h
+      rw [dropMany.eq_def] at h
+      dsimp only at h
+      cases values with
+      | nil =>
+        injection h with hstore
+        subst store'
+        exact StoreFootprint.refl store
+      | cons value rest =>
+        dsimp only at h
+        cases hdrop : dropVal ctx fuel store value with
+        | error err => rw [hdrop, bindErr] at h; contradiction
+        | ok middle =>
+          rw [hdrop, bindOk] at h
+          exact (ihDrop _ _ _ _ hdrop).trans
+            (ihDropMany _ _ _ _ h)
+    · intro ctx store value store' h
+      rw [dropUVal.eq_def] at h
+      dsimp only at h
+      cases value with
+      | lit literal =>
+        injection h with hstore
+        subst store'
+        exact StoreFootprint.refl store
+      | erased =>
+        injection h with hstore
+        subst store'
+        exact StoreFootprint.refl store
+      | loc loc =>
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at h
+        | some box =>
+          simp only [hbox] at h
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => simp at h
+            | unique =>
+              cases node with
+              | papN address arity args => simp at h
+              | ctorN cid fields =>
+                exact (footprint_kill hbox).trans
+                  (ihDropManyU _ _ _ _ h)
+    · intro ctx store values store' h
+      rw [dropManyU.eq_def] at h
+      dsimp only at h
+      cases values with
+      | nil =>
+        injection h with hstore
+        subst store'
+        exact StoreFootprint.refl store
+      | cons value rest =>
+        dsimp only at h
+        cases hdrop : dropUVal ctx fuel store value with
+        | error err => rw [hdrop, bindErr] at h; contradiction
+        | ok middle =>
+          rw [hdrop, bindOk] at h
+          exact (ihDropU _ _ _ _ hdrop).trans
+            (ihDropManyU _ _ _ _ h)
+
+theorem runCode_footprint {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {code : Code} {value : RVal}
+    (heval : runCode ctx fuel cur store env code = .ok (store', value)) :
+    StoreFootprint store store' :=
+  (footprintAt fuel).1 ctx cur store env code store' value heval
+
+theorem runOp_footprint {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {op : Op} {value : RVal}
+    (heval : runOp ctx fuel cur store env op = .ok (store', value)) :
+    StoreFootprint store store' :=
+  (footprintAt fuel).2.1 ctx cur store env op store' value heval
+
+theorem invoke_footprint {ctx : Ctx} {fuel : Nat} {address : Ixon.Address}
+    {args : List RVal} {store store' : Store} {value : RVal}
+    (heval : invoke ctx fuel address args store = .ok (store', value)) :
+    StoreFootprint store store' :=
+  (footprintAt fuel).2.2.1 ctx address args store store' value heval
+
+theorem applyGo_footprint {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {function : RVal} {args : List RVal} {value : RVal}
+    (heval : applyGo ctx fuel store function args = .ok (store', value)) :
+    StoreFootprint store store' :=
+  (footprintAt fuel).2.2.2.1 ctx store function args store' value heval
+
+theorem runMain_footprint {ctx : Ctx} {fuel : Nat} {code : Code}
+    {store : Store} {value : RVal}
+    (heval : runMain ctx code fuel = .ok (store, value)) :
+    StoreFootprint ({} : Store) store :=
+  runCode_footprint heval
+
+/-- Every slot in a fresh successful run comes from exactly one allocation.
+Reuse overwrites an existing live slot and therefore changes neither side. -/
+theorem runMain_nodes_size_eq_allocs {ctx : Ctx} {fuel : Nat} {code : Code}
+    {store : Store} {value : RVal}
+    (heval : runMain ctx code fuel = .ok (store, value)) :
+    store.nodes.size = store.allocs := by
+  have hbalance := (runMain_footprint heval).allocation_balance
+  simpa using hbalance
+
+/-- Fresh successful execution exactly partitions allocations into live nodes
+and completed frees.  In-place reuse preserves liveness and does not count as
+either allocation or free. -/
+theorem runMain_live_add_frees_eq_allocs
+    {ctx : Ctx} {fuel : Nat} {code : Code}
+    {store : Store} {value : RVal}
+    (heval : runMain ctx code fuel = .ok (store, value)) :
+    store.live + store.frees = store.allocs := by
+  have hbalance := (runMain_footprint heval).live_balance
+  have hemptyLive : ({} : Store).live = 0 := rfl
+  rw [hemptyLive, Nat.zero_add] at hbalance
+  simpa using hbalance
+
+/-- A counter-only consequence of exact live-slot accounting. -/
+theorem runMain_frees_le_allocs {ctx : Ctx} {fuel : Nat} {code : Code}
+    {store : Store} {value : RVal}
+    (heval : runMain ctx code fuel = .ok (store, value)) :
+    store.frees ≤ store.allocs := by
+  have hbalance := runMain_live_add_frees_eq_allocs heval
+  omega
+
+theorem AllocationOrderInvariant.empty :
+    AllocationOrderInvariant ({} : Store) := by
+  constructor <;> intro <;> simp [Store.get?] at *
+
+/-- Membership in the flattened edge multiset has a concrete live parent.
+This is the converse direction to `Sim.child_location_mem_edgeLocations`.
+-/
+theorem parent_of_mem_edgeLocations {store : Store} {childLoc : Nat}
+    (h : childLoc ∈ edgeLocations store) :
+    ∃ parent box, store.get? parent = some box ∧
+      RVal.loc childLoc ∈ nodeChildren box.node := by
+  rw [edgeLocations, List.mem_flatMap] at h
+  obtain ⟨slot, hslot, hedge⟩ := h
+  cases slot with
+  | none => simp [slotEdgeLocations] at hedge
+  | some box =>
+    have harray : some box ∈ store.nodes := by simpa using hslot
+    obtain ⟨parent, hparentArray⟩ :=
+      (Array.mem_iff_getElem?).mp harray
+    have hparent : store.get? parent = some box := by
+      rw [Store.get?, hparentArray]
+      rfl
+    change childLoc ∈ (nodeChildren box.node).filterMap rvalLocation?
+      at hedge
+    rw [List.mem_filterMap] at hedge
+    obtain ⟨child, hchild, hloc⟩ := hedge
+    cases child with
+    | loc loc =>
+      simp [rvalLocation?] at hloc
+      subst loc
+      exact ⟨parent, box, hparent, hchild⟩
+    | lit literal => simp [rvalLocation?] at hloc
+    | erased => simp [rvalLocation?] at hloc
+
+/-- With no external roots, a live node satisfying exact ownership has at
+least one incoming heap edge.  Positivity is needed only for the shared
+case; unique ownership already fixes the incoming count at one. -/
+theorem incoming_pos_of_live {store : Store}
+    (hown : RootOwnership store [])
+    (horder : AllocationOrderInvariant store)
+    {loc : Nat} {box : NodeBox} (hget : store.get? loc = some box) :
+    0 < incoming store [] loc := by
+  have hpos := horder.rc_pos hget
+  have hcount := hown.counts hget
+  cases box with
+  | mk world rc node =>
+    cases world with
+    | shared =>
+      change 0 < rc at hpos
+      change rc = incoming store [] loc at hcount
+      omega
+    | unique =>
+      change 0 < rc at hpos
+      change rc = 1 ∧ incoming store [] loc = 1 at hcount
+      omega
+
+/-- Exact empty-root ownership and allocation order admit no live slot.
+
+Following the mandatory incoming edge moves to a strictly newer live parent.
+The measure is the parent's remaining distance to the finite array bound, so
+the impossible infinite ascent is rejected directly by Lean's termination
+checker. -/
+theorem no_live_of_empty_roots {store : Store}
+    (hown : RootOwnership store [])
+    (horder : AllocationOrderInvariant store)
+    {loc : Nat} {box : NodeBox} (hget : store.get? loc = some box) : False := by
+  have hincoming := incoming_pos_of_live hown horder hget
+  have hedge : loc ∈ edgeLocations store := by
+    apply List.count_pos_iff.mp
+    simpa [incoming] using hincoming
+  obtain ⟨parent, parentBox, hparent, hchild⟩ :=
+    parent_of_mem_edgeLocations hedge
+  have hlt : loc < parent := horder.child_lt hparent hchild
+  exact no_live_of_empty_roots hown horder hparent
+termination_by store.nodes.size - loc
+decreasing_by
+  have hlocBound : loc < store.nodes.size :=
+    (Array.getElem?_eq_some_iff.mp (nodes_get?_of_get? hget)).1
+  have hparentBound : parent < store.nodes.size :=
+    (Array.getElem?_eq_some_iff.mp (nodes_get?_of_get? hparent)).1
+  omega
+
+private theorem foldl_live_eq_acc_of_no_some :
+    ∀ (slots : List (Option NodeBox)) (acc : Nat),
+      (∀ box, some box ∉ slots) →
+      slots.foldl
+          (fun count slot => if slot.isSome then count + 1 else count)
+          acc = acc
+  | [], acc, _ => rfl
+  | none :: slots, acc, hnone => by
+      simp only [List.foldl_cons, Option.isSome_none, Bool.false_eq_true,
+        if_false]
+      apply foldl_live_eq_acc_of_no_some slots acc
+      intro box hbox
+      exact hnone box (by simp [hbox])
+  | some head :: slots, acc, hnone => by
+      exact False.elim (hnone head (by simp))
+
+/-- The finite empty-root reclamation theorem: exact ownership plus the
+append-only trace invariant leaves the concrete store with zero live slots.
+-/
+theorem live_eq_zero_of_empty_roots {store : Store}
+    (hown : RootOwnership store [])
+    (horder : AllocationOrderInvariant store) :
+    store.live = 0 := by
+  have hnoSome : ∀ box : NodeBox, some box ∉ store.nodes.toList := by
+    intro box hmem
+    have harray : some box ∈ store.nodes := by simpa using hmem
+    obtain ⟨loc, hloc⟩ := (Array.mem_iff_getElem?).mp harray
+    have hget : store.get? loc = some box := by
+      rw [Store.get?, hloc]
+      rfl
+    exact no_live_of_empty_roots hown horder hget
+  rw [Store.live, ← Array.foldl_toList]
+  exact foldl_live_eq_acc_of_no_some store.nodes.toList 0 hnoSome
+
+/-! ## Primitive preservation
+
+The current lowering is append-only.  The lemmas in this section cover every
+store mutation used by its allocation and release paths.  There is
+deliberately no preservation theorem for `reuseNodeStore`: overwriting an old
+slot with references to newer slots invalidates the concrete location order.
+-/
+
+theorem AllocationOrderInvariant.rcTick {store : Store}
+    (h : AllocationOrderInvariant store) :
+    AllocationOrderInvariant store.rcTick := by
+  constructor
+  · intro loc box hget
+    exact h.rc_pos (by simpa using hget)
+  · intro parent box childLoc hget hchild
+    exact h.child_lt (by simpa using hget) hchild
+
+/-- Updating only the count of one live slot preserves allocation order when
+the replacement count remains positive. -/
+theorem AllocationOrderInvariant.setRc {store : Store} {loc : Nat}
+    {box : NodeBox} {newRc : Nat}
+    (h : AllocationOrderInvariant store)
+    (hget : store.get? loc = some box) (hpos : 0 < newRc) :
+    AllocationOrderInvariant
+      (store.setBox loc { box with rc := newRc }) := by
+  constructor
+  · intro other otherBox hother
+    by_cases heq : loc = other
+    · subst other
+      have hupdated := get?_setBox_same
+        (new := { box with rc := newRc }) hget
+      have hboxeq : otherBox = { box with rc := newRc } :=
+        Option.some.inj (hother.symm.trans hupdated)
+      subst otherBox
+      exact hpos
+    · exact h.rc_pos
+        (get?_of_setBox_other heq hget hother)
+  · intro parent parentBox childLoc hparent hchild
+    by_cases heq : loc = parent
+    · subst parent
+      have hupdated := get?_setBox_same
+        (new := { box with rc := newRc }) hget
+      have hboxeq : parentBox = { box with rc := newRc } :=
+        Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      exact h.child_lt hget hchild
+    · exact h.child_lt
+        (get?_of_setBox_other heq hget hparent) hchild
+
+theorem AllocationOrderInvariant.kill {store : Store} {loc : Nat}
+    {box : NodeBox} (h : AllocationOrderInvariant store)
+    (hget : store.get? loc = some box) :
+    AllocationOrderInvariant (store.kill loc) := by
+  constructor
+  · intro other otherBox hother
+    by_cases heq : loc = other
+    · subst other
+      rw [get?_kill_same hget] at hother
+      contradiction
+    · exact h.rc_pos (get?_of_kill_other heq hget hother)
+  · intro parent parentBox childLoc hparent hchild
+    by_cases heq : loc = parent
+    · subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    · exact h.child_lt
+        (get?_of_kill_other heq hget hparent) hchild
+
+theorem AllocationOrderInvariant.incRcStore {store : Store} {loc : Nat}
+    {box : NodeBox} (h : AllocationOrderInvariant store)
+    (hget : store.get? loc = some box) :
+    AllocationOrderInvariant (incRcStore store loc box) := by
+  rw [Sim.incRcStore]
+  exact (h.setRc hget (by omega)).rcTick
+
+theorem AllocationOrderInvariant.decRcStore {store : Store} {loc rc : Nat}
+    {world : Ixon.Owned} {node : Node}
+    (h : AllocationOrderInvariant store) (hrc : 1 < rc)
+    (hget : store.get? loc = some ⟨world, rc, node⟩) :
+    AllocationOrderInvariant
+      (decRcStore store loc ⟨world, rc, node⟩) := by
+  rw [Sim.decRcStore]
+  apply h.rcTick.setRc (by simpa using hget)
+  change 0 < rc - 1
+  omega
+
+/-- Appending a node whose location children are already allocated preserves
+the concrete order: every child lies below the old array size, which is
+exactly the fresh parent location. -/
+theorem AllocationOrderInvariant.allocNodeOfInBounds {store : Store}
+    {world : Ixon.Owned} {node : Node}
+    (h : AllocationOrderInvariant store)
+    (hchildren : ValuesInBounds store (nodeChildren node)) :
+    AllocationOrderInvariant (store.allocNode world node).1 := by
+  constructor
+  · intro loc box hget
+    by_cases hnew : loc = store.nodes.size
+    · subst loc
+      have hfresh := HeapIso.get?_allocNode_new store world node
+      have hboxeq : box = ⟨world, 1, node⟩ :=
+        Option.some.inj (hget.symm.trans hfresh)
+      subst box
+      simp
+    · exact h.rc_pos (HeapIso.get?_of_allocNode_old hnew hget)
+  · intro parent box childLoc hget hchild
+    by_cases hnew : parent = store.nodes.size
+    · subst parent
+      have hfresh := HeapIso.get?_allocNode_new store world node
+      have hboxeq : box = ⟨world, 1, node⟩ :=
+        Option.some.inj (hget.symm.trans hfresh)
+      subst box
+      exact hchildren (.loc childLoc) hchild
+    · exact h.child_lt
+        (HeapIso.get?_of_allocNode_old hnew hget) hchild
+
+/-- Ownership-facing allocation form: liveness is stronger than the allocated
+location bound required by `allocNodeOfInBounds`. -/
+theorem AllocationOrderInvariant.allocNode {store : Store}
+    {world : Ixon.Owned} {node : Node}
+    (h : AllocationOrderInvariant store)
+    (hchildren : ∀ child ∈ nodeChildren node, LiveRVal store child) :
+    AllocationOrderInvariant (store.allocNode world node).1 := by
+  apply h.allocNodeOfInBounds
+  intro child hchild
+  cases child with
+  | loc childLoc =>
+    obtain ⟨box, hget⟩ := hchildren (.loc childLoc) hchild
+    exact RVal.inBounds_of_get? hget
+  | lit literal => trivial
+  | erased => trivial
+
+private def SharedDropOrderAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ (store : Store) (value : RVal) (store' : Store),
+    AllocationOrderInvariant store →
+    dropVal ctx fuel store value = .ok store' →
+    AllocationOrderInvariant store') ∧
+  (∀ (store : Store) (values : List RVal) (store' : Store),
+    AllocationOrderInvariant store →
+    dropMany ctx fuel store values = .ok store' →
+    AllocationOrderInvariant store')
+
+/-- Successful shared deep release preserves positivity and allocation order,
+including every recursive final-owner child release. -/
+private theorem sharedDropOrderAt (ctx : Ctx) :
+    ∀ fuel, SharedDropOrderAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_⟩
+    · intro store value store' horder heval
+      rw [dropVal.eq_def] at heval
+      simp at heval
+    · intro store values store' horder heval
+      rw [dropMany.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany⟩ := ih
+    refine ⟨?_, ?_⟩
+    · intro store value store' horder heval
+      cases value with
+      | lit literal =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact horder
+      | erased =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact horder
+      | loc loc =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at heval
+          simp at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => simp at heval
+            | shared =>
+              dsimp only at heval
+              by_cases hrc : rc = 1
+              · subst rc
+                have hbeq : ((1 : Nat) == 1) = true := by decide
+                rw [hbeq] at heval
+                have htickGet :
+                    store.rcTick.get? loc = some ⟨.shared, 1, node⟩ := by
+                  simpa using hget
+                have hprefix := horder.rcTick.kill htickGet
+                cases node with
+                | ctorN cid fields =>
+                  exact ihMany _ fields.toList store' hprefix heval
+                | papN fn arity args =>
+                  exact ihMany _ args.toList store' hprefix heval
+              · have hbeq : (rc == 1) = false := by simp [hrc]
+                rw [hbeq] at heval
+                have hpos : 0 < rc := horder.rc_pos hget
+                have hmany : 1 < rc := by omega
+                injection heval with hstore
+                subst store'
+                exact horder.decRcStore hmany hget
+    · intro store values store' horder heval
+      cases values with
+      | nil =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact horder
+      | cons value values =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropVal ctx fuel store value with
+        | error err =>
+          rw [hfirst, bindErr] at heval
+          simp at heval
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          exact ihMany middle values store'
+            (ihVal store value middle horder hfirst) heval
+
+theorem AllocationOrderInvariant.dropVal {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (h : AllocationOrderInvariant store)
+    (heval : dropVal ctx fuel store value = .ok store') :
+    AllocationOrderInvariant store' :=
+  (sharedDropOrderAt ctx fuel).1 store value store' h heval
+
+theorem AllocationOrderInvariant.dropMany {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (h : AllocationOrderInvariant store)
+    (heval : dropMany ctx fuel store values = .ok store') :
+    AllocationOrderInvariant store' :=
+  (sharedDropOrderAt ctx fuel).2 store values store' h heval
+
+private def UniqueDropOrderAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ (store : Store) (value : RVal) (store' : Store),
+    AllocationOrderInvariant store →
+    dropUVal ctx fuel store value = .ok store' →
+    AllocationOrderInvariant store') ∧
+  (∀ (store : Store) (values : List RVal) (store' : Store),
+    AllocationOrderInvariant store →
+    dropManyU ctx fuel store values = .ok store' →
+    AllocationOrderInvariant store')
+
+/-- Successful unique deep release only kills slots, so it preserves the
+append order through its complete recursive constructor traversal. -/
+private theorem uniqueDropOrderAt (ctx : Ctx) :
+    ∀ fuel, UniqueDropOrderAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_⟩
+    · intro store value store' horder heval
+      rw [dropUVal.eq_def] at heval
+      simp at heval
+    · intro store values store' horder heval
+      rw [dropManyU.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany⟩ := ih
+    refine ⟨?_, ?_⟩
+    · intro store value store' horder heval
+      cases value with
+      | lit literal =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact horder
+      | erased =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact horder
+      | loc loc =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at heval
+          simp at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => simp at heval
+            | unique =>
+              cases node with
+              | ctorN cid fields =>
+                exact ihMany _ fields.toList store'
+                  (horder.kill hget) heval
+              | papN fn arity args => simp at heval
+    · intro store values store' horder heval
+      cases values with
+      | nil =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact horder
+      | cons value values =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropUVal ctx fuel store value with
+        | error err =>
+          rw [hfirst, bindErr] at heval
+          simp at heval
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          exact ihMany middle values store'
+            (ihVal store value middle horder hfirst) heval
+
+theorem AllocationOrderInvariant.dropUVal {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (h : AllocationOrderInvariant store)
+    (heval : dropUVal ctx fuel store value = .ok store') :
+    AllocationOrderInvariant store' :=
+  (uniqueDropOrderAt ctx fuel).1 store value store' h heval
+
+theorem AllocationOrderInvariant.dropManyU {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (h : AllocationOrderInvariant store)
+    (heval : dropManyU ctx fuel store values = .ok store') :
+    AllocationOrderInvariant store' :=
+  (uniqueDropOrderAt ctx fuel).2 store values store' h heval
+
+/-- Retaining any sequence of shared values changes only positive reference
+counts and therefore preserves the trace invariant. -/
+theorem AllocationOrderInvariant.dupVals {store store' : Store}
+    {values : List RVal} (h : AllocationOrderInvariant store)
+    (heval : dupVals store values = .ok store') :
+    AllocationOrderInvariant store' := by
+  induction values generalizing store with
+  | nil =>
+    change (.ok store : Except Err Store) = .ok store' at heval
+    injection heval with hstore
+    subst store'
+    exact h
+  | cons head tail ih =>
+    cases head with
+    | lit literal =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      exact ih h heval
+    | erased =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      exact ih h heval
+    | loc loc =>
+      simp only [Ix.Compiler.IxIR1.dupVals, List.foldlM_cons] at heval
+      cases hget : store.get? loc with
+      | none => simp [hget, bindErr] at heval
+      | some box =>
+        cases box with
+        | mk world rc node =>
+          cases world with
+          | unique => simp [hget, bindErr] at heval
+          | shared =>
+            simp only [hget] at heval
+            exact ih (h.incRcStore hget) heval
+
+private structure OrderResult (before after : Store) (value : RVal) : Prop where
+  order : AllocationOrderInvariant after
+  valueInBounds : ValueInBounds after value
+  papsUnder : PAPsUnder before → PAPsUnder after
+
+private def OrderAt (fuel : Nat) : Prop :=
+  (∀ ctx cur store env code store' value,
+    AllocationOrderInvariant store → ValuesInBounds store env →
+    store'.reuses = store.reuses →
+    runCode ctx fuel cur store env code = .ok (store', value) →
+    OrderResult store store' value) ∧
+  (∀ ctx cur store env op store' value,
+    AllocationOrderInvariant store → ValuesInBounds store env →
+    store'.reuses = store.reuses →
+    runOp ctx fuel cur store env op = .ok (store', value) →
+    OrderResult store store' value) ∧
+  (∀ ctx address args store store' value,
+    AllocationOrderInvariant store → ValuesInBounds store args →
+    store'.reuses = store.reuses →
+    invoke ctx fuel address args store = .ok (store', value) →
+    OrderResult store store' value) ∧
+  (∀ ctx store function args store' value,
+    AllocationOrderInvariant store → ValueInBounds store function →
+    ValuesInBounds store args → store'.reuses = store.reuses →
+    applyGo ctx fuel store function args = .ok (store', value) →
+    OrderResult store store' value)
+
+/-- A successful trace whose endpoint reuse count is unchanged preserves the
+append allocation order.  The proof also establishes that its result cannot
+name a future slot.  `StoreFootprint` forces the same reuse equality at every
+intermediate call, so even dynamically unreachable `reuse` instructions are
+harmless and an executed one is contradictory. -/
+private theorem orderAt : ∀ fuel, OrderAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value horder henv hreuses heval
+      rw [runCode.eq_def] at heval
+      simp at heval
+    · intro ctx cur store env op store' value horder henv hreuses heval
+      rw [runOp.eq_def] at heval
+      simp at heval
+    · intro ctx address args store store' value horder hargs hreuses heval
+      rw [invoke.eq_def] at heval
+      simp at heval
+    · intro ctx store function args store' value horder hfunction hargs
+        hreuses heval
+      rw [applyGo.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihCode, ihOp, ihInvoke, ihApply⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro ctx cur store env code store' value horder henv hreuses heval
+      cases code with
+      | ret atom =>
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact ⟨horder, resolveAtom_inBounds henv hresolve, id⟩
+      | letOp op rest =>
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hop : runOp ctx fuel cur store env op with
+        | error err => rw [hop, bindErr] at heval; contradiction
+        | ok opOut =>
+          rcases opOut with ⟨middle, opValue⟩
+          rw [hop, bindOk] at heval
+          have hopFoot := runOp_footprint hop
+          have hrestFoot := runCode_footprint heval
+          have hopReusesLe : store.reuses ≤ middle.reuses := by
+            simpa using hopFoot.reuses
+          have hrestReusesLe : middle.reuses ≤ store'.reuses := by
+            simpa using hrestFoot.reuses
+          have hopReuses : middle.reuses = store.reuses := by omega
+          have hrestReuses : store'.reuses = middle.reuses := by omega
+          obtain ⟨hmiddleOrder, hopBound, hopPaps⟩ :=
+            ihOp _ _ _ _ _ _ _ horder henv hopReuses hop
+          have henvMiddle : ValuesInBounds middle env :=
+            henv.mono hopFoot.nodes_size
+          have tail := ihCode _ _ _ _ _ _ _ hmiddleOrder
+            (henvMiddle.cons hopBound) hrestReuses heval
+          exact ⟨tail.order, tail.valueInBounds,
+            fun hpaps => tail.papsUnder (hopPaps hpaps)⟩
+      | case scrut peelNat alts =>
+        rw [runCode.eq_def] at heval
+        dsimp only at heval
+        cases hscrut : resolveAtom env scrut with
+        | error err => rw [hscrut, bindErr] at heval; contradiction
+        | ok scrutValue =>
+          rw [hscrut, bindOk] at heval
+          cases scrutValue with
+          | loc loc =>
+            dsimp only at heval
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity args => simp at heval
+                | ctorN cid fields =>
+                  cases halt : alts.find?
+                      (fun alt => alt.cidx == cid.cidx) with
+                  | none => simp [halt] at heval
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases hsize : fields.size != fieldCount
+                      · simp only [halt, hsize, Bool.false_eq_true,
+                          if_false] at heval
+                        have hfields := horder.childrenInBounds hbox
+                        exact ihCode _ _ _ _ _ _ _ horder
+                          (hfields.foldlPrepend henv) hreuses heval
+                      · simp [halt, hsize] at heval
+          | lit literal =>
+            cases literal with
+            | str string => simp at heval
+            | nat n =>
+              cases hpeel : peelNat with
+              | false => simp [hpeel] at heval
+              | true =>
+                cases n with
+                | zero =>
+                  cases halt : alts.find? (fun alt => alt.cidx == 0) with
+                  | none => simp [hpeel, halt] at heval
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero =>
+                        simp only [hpeel, halt] at heval
+                        exact ihCode _ _ _ _ _ _ _ horder henv hreuses heval
+                      | succ fieldCount => simp [hpeel, halt] at heval
+                | succ n =>
+                  cases halt : alts.find? (fun alt => alt.cidx == 1) with
+                  | none => simp [hpeel, halt] at heval
+                  | some alt =>
+                    cases alt with
+                    | mk cidx fieldCount body =>
+                      cases fieldCount with
+                      | zero => simp [hpeel, halt] at heval
+                      | succ fieldCount =>
+                        cases fieldCount with
+                        | zero =>
+                          simp only [hpeel, halt] at heval
+                          exact ihCode _ _ _ _ _ _ _ horder
+                            (henv.cons (by trivial)) hreuses heval
+                        | succ fieldCount => simp [hpeel, halt] at heval
+          | erased => simp at heval
+    · intro ctx cur store env op store' value horder henv hreuses heval
+      cases op with
+      | pure atom =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtom env atom with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok result =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact ⟨horder, resolveAtom_inBounds henv hresolve, id⟩
+      | alloc world cid atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtoms env atoms with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hresolve, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          have hvalues := resolveAtoms_inBounds henv hresolve
+          refine ⟨?_, ?_, ?_⟩
+          · apply horder.allocNodeOfInBounds
+            simpa [nodeChildren] using hvalues
+          · simp [ValueInBounds, Store.allocNode]
+          · intro hpaps
+            exact hpaps.allocCtor world cid values.toArray
+      | reuse target cid atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hargs : resolveAtoms env atoms with
+        | error err => rw [hargs, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hargs, bindOk] at heval
+          cases htarget : resolveAtom env target with
+          | error err => rw [htarget, bindErr] at heval; contradiction
+          | ok targetValue =>
+            rw [htarget, bindOk] at heval
+            cases targetValue with
+            | lit literal => simp at heval
+            | erased => simp at heval
+            | loc loc =>
+              cases hbox : store.get? loc with
+              | none => simp [hbox] at heval
+              | some box =>
+                simp only [hbox] at heval
+                cases box with
+                | mk world rc node =>
+                  cases world with
+                  | shared => simp at heval
+                  | unique =>
+                    have hpair := Except.ok.inj heval
+                    cases hpair
+                    simp [Store.setBox] at hreuses
+      | free target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal => simp at heval
+          | erased => simp at heval
+          | loc loc =>
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | shared => simp at heval
+                | unique =>
+                  have hpair := Except.ok.inj heval
+                  cases hpair
+                  exact ⟨horder.kill hbox, by trivial,
+                    fun hpaps => hpaps.kill hbox⟩
+      | dup target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact ⟨horder, by trivial, id⟩
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact ⟨horder, by trivial, id⟩
+          | loc loc =>
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases world with
+                | unique => simp at heval
+                | shared =>
+                  have hpair := Except.ok.inj heval
+                  cases hpair
+                  refine ⟨horder.incRcStore hbox,
+                    (RVal.inBounds_of_get? hbox).mono
+                      (footprint_incRcStore hbox).nodes_size, ?_⟩
+                  intro hpaps
+                  simpa [Sim.incRcStore] using hpaps.incRcStore hbox
+      | drop target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact ⟨horder, by trivial, id⟩
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact ⟨horder, by trivial, id⟩
+          | loc loc =>
+            dsimp only at heval
+            cases hdrop : dropVal ctx fuel store (.loc loc) with
+            | error err => rw [hdrop, bindErr] at heval; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact ⟨horder.dropVal hdrop, by trivial,
+                fun hpaps => hpaps.dropVal hdrop⟩
+      | dropU target =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact ⟨horder, by trivial, id⟩
+          | erased =>
+            have hpair := Except.ok.inj heval
+            cases hpair
+            exact ⟨horder, by trivial, id⟩
+          | loc loc =>
+            dsimp only at heval
+            cases hdrop : dropUVal ctx fuel store (.loc loc) with
+            | error err => rw [hdrop, bindErr] at heval; contradiction
+            | ok dropped =>
+              rw [hdrop, bindOk] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              exact ⟨horder.dropUVal hdrop, by trivial,
+                fun hpaps => hpaps.dropUVal hdrop⟩
+      | fetch target field =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases htarget : resolveAtom env target with
+        | error err => rw [htarget, bindErr] at heval; contradiction
+        | ok targetValue =>
+          rw [htarget, bindOk] at heval
+          cases targetValue with
+          | lit literal => simp at heval
+          | erased => simp at heval
+          | loc loc =>
+            cases hbox : store.get? loc with
+            | none => simp [hbox] at heval
+            | some box =>
+              simp only [hbox] at heval
+              cases box with
+              | mk world rc node =>
+                cases node with
+                | papN address arity args => simp at heval
+                | ctorN cid fields =>
+                  cases hfield : fields[field]? with
+                  | none => simp [hfield] at heval
+                  | some result =>
+                    simp only [hfield] at heval
+                    have hpair := Except.ok.inj heval
+                    have hstoreEq : store = store' :=
+                      congrArg Prod.fst hpair
+                    have hvalueEq : result = value :=
+                      congrArg Prod.snd hpair
+                    subst store'
+                    subst value
+                    have hmember : result ∈ fields.toList := by
+                      simpa using
+                        (Array.mem_iff_getElem?).2 ⟨field, hfield⟩
+                    exact ⟨horder,
+                      horder.childrenInBounds hbox result
+                        (by simpa [nodeChildren] using hmember), id⟩
+      | call address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtoms env atoms with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hresolve, bindOk] at heval
+          exact ihInvoke _ _ _ _ _ _ horder
+            (resolveAtoms_inBounds henv hresolve) hreuses heval
+      | callSelf atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtoms env atoms with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hresolve, bindOk] at heval
+          cases harity : values.length != cur.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hcode : runCode ctx fuel cur store values.reverse
+                cur.body with
+            | error err => rw [hcode, bindErr] at heval; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hcode, bindOk] at heval
+              obtain ⟨hresult, _⟩ := checkResultWorld_ok heval
+              cases hresult
+              exact ihCode _ _ _ _ _ _ _ horder
+                (resolveAtoms_inBounds henv hresolve).reverse
+                hreuses hcode
+          · simp [harity] at heval
+      | papp address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtoms env atoms with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hresolve, bindOk] at heval
+          cases hdecl : ctx.decls address with
+          | none => simp [hdecl] at heval
+          | some decl =>
+            simp only [hdecl] at heval
+            by_cases hlen : values.length < declArity decl
+            · simp only [hlen, if_true] at heval
+              have hpair := Except.ok.inj heval
+              cases hpair
+              have hvalues := resolveAtoms_inBounds henv hresolve
+              refine ⟨?_, ?_, ?_⟩
+              · apply horder.allocNodeOfInBounds
+                simpa [nodeChildren] using hvalues
+              · simp [ValueInBounds, Store.allocNode]
+              · intro hpaps
+                exact hpaps.allocPap .shared address (declArity decl)
+                  values.toArray (by simpa using hlen)
+            · simp [hlen] at heval
+      | apply function atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hfunction : resolveAtom env function with
+        | error err => rw [hfunction, bindErr] at heval; contradiction
+        | ok functionValue =>
+          rw [hfunction, bindOk] at heval
+          cases hresolve : resolveAtoms env atoms with
+          | error err => rw [hresolve, bindErr] at heval; contradiction
+          | ok values =>
+            rw [hresolve, bindOk] at heval
+            exact ihApply _ _ _ _ _ _ horder
+              (resolveAtom_inBounds henv hfunction)
+              (resolveAtoms_inBounds henv hresolve) hreuses heval
+      | extern address atoms =>
+        rw [runOp.eq_def] at heval
+        dsimp only at heval
+        cases hresolve : resolveAtoms env atoms with
+        | error err => rw [hresolve, bindErr] at heval; contradiction
+        | ok values =>
+          rw [hresolve, bindOk] at heval
+          cases hcall : callScalarOracle ctx address values with
+          | error err => rw [hcall, bindErr] at heval; contradiction
+          | ok result =>
+            rw [hcall, bindOk] at heval
+            have hpair := Except.ok.inj heval
+            have hstoreEq : store = store' :=
+              congrArg Prod.fst hpair
+            have hvalueEq : result = value :=
+              congrArg Prod.snd hpair
+            subst store'
+            subst value
+            have hscalar := (callScalarOracle_ok hcall).2
+            refine ⟨horder, ?_, id⟩
+            cases result <;> simp_all [RVal.isScalar, ValueInBounds]
+    · intro ctx address args store store' value horder hargs hreuses heval
+      rw [invoke.eq_def] at heval
+      dsimp only at heval
+      cases hdecl : ctx.decls address with
+      | none => simp [hdecl] at heval
+      | some decl =>
+        simp only [hdecl] at heval
+        cases decl with
+        | extern arity =>
+          cases harity : args.length != arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hcall : callScalarOracle ctx address args with
+            | error err => simp [hcall] at heval
+            | ok result =>
+              simp only [hcall] at heval
+              have hpair := Except.ok.inj heval
+              have hstoreEq : store = store' :=
+                congrArg Prod.fst hpair
+              have hvalueEq : result = value :=
+                congrArg Prod.snd hpair
+              subst store'
+              subst value
+              have hscalar := (callScalarOracle_ok hcall).2
+              refine ⟨horder, ?_, id⟩
+              cases result <;> simp_all [RVal.isScalar, ValueInBounds]
+          · simp [harity] at heval
+        | fn d =>
+          cases harity : args.length != d.arity
+          · simp only [harity, Bool.false_eq_true, if_false] at heval
+            cases hcode : runCode ctx fuel d store args.reverse d.body with
+            | error err => rw [hcode, bindErr] at heval; contradiction
+            | ok result =>
+              rcases result with ⟨bodyStore, bodyValue⟩
+              rw [hcode, bindOk] at heval
+              obtain ⟨hresult, _⟩ := checkResultWorld_ok heval
+              cases hresult
+              exact ihCode _ _ _ _ _ _ _ horder hargs.reverse
+                hreuses hcode
+          · simp [harity] at heval
+    · intro ctx store function args store' value horder hfunction hargs
+        hreuses heval
+      rw [applyGo.eq_def] at heval
+      dsimp only at heval
+      cases function with
+      | lit literal => simp at heval
+      | erased =>
+        dsimp only at heval
+        cases hdrop : dropMany ctx fuel store args with
+        | error err => rw [hdrop, bindErr] at heval; contradiction
+        | ok dropped =>
+          rw [hdrop, bindOk] at heval
+          have hpair := Except.ok.inj heval
+          cases hpair
+          exact ⟨horder.dropMany hdrop, by trivial,
+            fun hpaps => hpaps.dropMany hdrop⟩
+      | loc loc =>
+        dsimp only at heval
+        cases hbox : store.get? loc with
+        | none => simp [hbox] at heval
+        | some box =>
+          simp only [hbox] at heval
+          cases box with
+          | mk world rc node =>
+            cases node with
+            | ctorN cid fields =>
+              dsimp only at heval
+              simp at heval
+            | papN address arity captured =>
+              dsimp only at heval
+              cases hdup : dupVals store captured.toList with
+              | error err => rw [hdup, bindErr] at heval; contradiction
+              | ok duplicated =>
+                rw [hdup, bindOk] at heval
+                cases hdrop : dropVal ctx fuel duplicated (.loc loc) with
+                | error err => rw [hdrop, bindErr] at heval; contradiction
+                | ok ready =>
+                  rw [hdrop, bindOk] at heval
+                  have hdupFoot := dupVals_footprint hdup
+                  have hdropFoot := (footprintAt fuel).2.2.2.2.1
+                    ctx duplicated (.loc loc) ready hdrop
+                  have hprefix := hdupFoot.trans hdropFoot
+                  have hreadyOrder := (horder.dupVals hdup).dropVal hdrop
+                  have hcaptured := horder.childrenInBounds hbox
+                  have htotal :
+                      ValuesInBounds ready (captured.toList ++ args) :=
+                    (hcaptured.append hargs).mono hprefix.nodes_size
+                  by_cases hunder :
+                      (captured.toList ++ args).length < arity
+                  · simp only [hunder] at heval
+                    have hpair := Except.ok.inj heval
+                    cases hpair
+                    refine ⟨?_, ?_, ?_⟩
+                    · apply hreadyOrder.allocNodeOfInBounds
+                      simpa [nodeChildren] using htotal
+                    · simp [ValueInBounds, Store.allocNode]
+                    · intro hpaps
+                      exact ((hpaps.dupVals hdup).dropVal hdrop).allocPap
+                        .shared address arity
+                        (captured.toList ++ args).toArray
+                        (by simpa using hunder)
+                  · simp only [hunder] at heval
+                    cases hexact :
+                        (captured.toList ++ args).length == arity
+                    · simp only [hexact, Bool.false_eq_true, if_false]
+                        at heval
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at heval
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false => simp [hdecl, hpapsafe] at heval
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at heval
+                          cases hinvoke : invoke ctx fuel address
+                              ((captured.toList ++ args).take arity) ready with
+                          | error err =>
+                            rw [hinvoke, bindErr] at heval
+                            contradiction
+                          | ok called =>
+                            rcases called with ⟨calledStore, calledValue⟩
+                            rw [hinvoke, bindOk] at heval
+                            have hinvokeFoot := invoke_footprint hinvoke
+                            have happlyFoot := applyGo_footprint heval
+                            have hprefixReuseLe :
+                                store.reuses ≤ ready.reuses :=
+                              hprefix.reuses
+                            have hinvokeReuseLe :
+                                ready.reuses ≤ calledStore.reuses := by
+                              simpa using hinvokeFoot.reuses
+                            have happlyReuseLe :
+                                calledStore.reuses ≤ store'.reuses := by
+                              simpa using happlyFoot.reuses
+                            have hreadyReuse :
+                                ready.reuses = store.reuses := by
+                              omega
+                            have hcalledReuse :
+                                calledStore.reuses = ready.reuses := by omega
+                            have hfinalReuse :
+                                store'.reuses = calledStore.reuses := by omega
+                            obtain ⟨hcalledOrder, hcalledValue,
+                              hcalledPaps⟩ :=
+                              ihInvoke _ _ _ _ _ _ hreadyOrder
+                                (htotal.take arity) hcalledReuse hinvoke
+                            have hrestBounds : ValuesInBounds calledStore
+                                ((captured.toList ++ args).drop arity) :=
+                              (htotal.drop arity).mono hinvokeFoot.nodes_size
+                            have tail := ihApply _ _ _ _ _ _ hcalledOrder
+                              hcalledValue hrestBounds hfinalReuse heval
+                            exact ⟨tail.order, tail.valueInBounds,
+                              fun hpaps => tail.papsUnder (hcalledPaps
+                                ((hpaps.dupVals hdup).dropVal hdrop))⟩
+                    · simp only [hexact, if_true] at heval
+                      cases hdecl : ctx.decls address with
+                      | none => simp [hdecl] at heval
+                      | some decl =>
+                        cases hpapsafe : declPapSafe decl with
+                        | false => simp [hdecl, hpapsafe] at heval
+                        | true =>
+                          simp only [hdecl, hpapsafe, if_true] at heval
+                          have hinvokeFoot := invoke_footprint heval
+                          have hprefixReuseLe :
+                              store.reuses ≤ ready.reuses :=
+                            hprefix.reuses
+                          have hinvokeReuseLe :
+                              ready.reuses ≤ store'.reuses := by
+                            simpa using hinvokeFoot.reuses
+                          have hreadyReuse : ready.reuses = store.reuses := by
+                            omega
+                          have hfinalReuse :
+                              store'.reuses = ready.reuses := by
+                            omega
+                          have called := ihInvoke _ _ _ _ _ _ hreadyOrder
+                            htotal hfinalReuse heval
+                          exact ⟨called.order, called.valueInBounds,
+                            fun hpaps => called.papsUnder
+                              ((hpaps.dupVals hdup).dropVal hdrop)⟩
+
+theorem runCode_order_of_reuses_eq {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {code : Code} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (henv : ValuesInBounds store env)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : runCode ctx fuel cur store env code = .ok (store', value)) :
+    AllocationOrderInvariant store' ∧ ValueInBounds store' value := by
+  have result := (orderAt fuel).1 ctx cur store env code store' value
+    horder henv hreuses heval
+  exact ⟨result.order, result.valueInBounds⟩
+
+/-- The same dynamic no-reuse premise preserves strict PAP shape. -/
+theorem runCode_papsUnder_of_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal} {code : Code}
+    {value : RVal} (horder : AllocationOrderInvariant store)
+    (henv : ValuesInBounds store env) (hpaps : PAPsUnder store)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : runCode ctx fuel cur store env code = .ok (store', value)) :
+    PAPsUnder store' :=
+  ((orderAt fuel).1 ctx cur store env code store' value
+    horder henv hreuses heval).papsUnder hpaps
+
+/-- The operation-level projection of `runCode_order_of_reuses_eq`.  This is
+the compositional boundary used by local operation contracts: once a
+primitive proves that it did not execute `reuse`, the shared evaluator
+induction supplies allocation order and result boundedness. -/
+theorem runOp_order_of_reuses_eq {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {op : Op} {value : RVal}
+    (horder : AllocationOrderInvariant store)
+    (henv : ValuesInBounds store env)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : runOp ctx fuel cur store env op = .ok (store', value)) :
+    AllocationOrderInvariant store' ∧ ValueInBounds store' value := by
+  have result := (orderAt fuel).2.1 ctx cur store env op store' value
+    horder henv hreuses heval
+  exact ⟨result.order, result.valueInBounds⟩
+
+theorem runOp_papsUnder_of_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal} {op : Op}
+    {value : RVal} (horder : AllocationOrderInvariant store)
+    (henv : ValuesInBounds store env) (hpaps : PAPsUnder store)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : runOp ctx fuel cur store env op = .ok (store', value)) :
+    PAPsUnder store' :=
+  ((orderAt fuel).2.1 ctx cur store env op store' value
+    horder henv hreuses heval).papsUnder hpaps
+
+/-- Declared-call projection of the allocation-order induction.  Exposing
+this alongside the code and operation forms lets run-indexed cost contracts
+sequence a dynamically selected callee without rebuilding the evaluator
+induction. -/
+theorem invoke_order_of_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {address : Ixon.Address} {args : List RVal} {store store' : Store}
+    {value : RVal} (horder : AllocationOrderInvariant store)
+    (hargs : ValuesInBounds store args)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : invoke ctx fuel address args store = .ok (store', value)) :
+    AllocationOrderInvariant store' ∧ ValueInBounds store' value := by
+  have result := (orderAt fuel).2.2.1 ctx address args store store' value
+    horder hargs hreuses heval
+  exact ⟨result.order, result.valueInBounds⟩
+
+theorem invoke_papsUnder_of_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {address : Ixon.Address} {args : List RVal} {store store' : Store}
+    {value : RVal} (horder : AllocationOrderInvariant store)
+    (hargs : ValuesInBounds store args) (hpaps : PAPsUnder store)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : invoke ctx fuel address args store = .ok (store', value)) :
+    PAPsUnder store' :=
+  ((orderAt fuel).2.2.1 ctx address args store store' value
+    horder hargs hreuses heval).papsUnder hpaps
+
+/-- Higher-order-application projection of the allocation-order induction. -/
+theorem applyGo_order_of_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {function : RVal} {args : List RVal}
+    {value : RVal} (horder : AllocationOrderInvariant store)
+    (hfunction : ValueInBounds store function)
+    (hargs : ValuesInBounds store args)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : applyGo ctx fuel store function args = .ok (store', value)) :
+    AllocationOrderInvariant store' ∧ ValueInBounds store' value := by
+  have result := (orderAt fuel).2.2.2 ctx store function args store' value
+    horder hfunction hargs hreuses heval
+  exact ⟨result.order, result.valueInBounds⟩
+
+theorem applyGo_papsUnder_of_reuses_eq {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {function : RVal} {args : List RVal}
+    {value : RVal} (horder : AllocationOrderInvariant store)
+    (hfunction : ValueInBounds store function)
+    (hargs : ValuesInBounds store args) (hpaps : PAPsUnder store)
+    (hreuses : store'.reuses = store.reuses)
+    (heval : applyGo ctx fuel store function args = .ok (store', value)) :
+    PAPsUnder store' :=
+  ((orderAt fuel).2.2.2 ctx store function args store' value
+    horder hfunction hargs hreuses heval).papsUnder hpaps
+
+/-- A fresh successful evaluator run with zero executed reuses is
+allocation-ordered.  No syntactic no-reuse scan is required: monotonicity of
+the counter proves that every dynamically reached operation was append-only.
+-/
+theorem runMain_order_of_reuses_eq_zero {ctx : Ctx} {fuel : Nat}
+    {code : Code} {store : Store} {value : RVal}
+    (heval : runMain ctx code fuel = .ok (store, value))
+    (hreuses : store.reuses = 0) :
+    AllocationOrderInvariant store ∧ ValueInBounds store value := by
+  have result := (orderAt fuel).1 ctx ⟨0, .shared, false, code⟩
+    ({} : Store) [] code
+    store value AllocationOrderInvariant.empty
+    (ValuesInBounds.nil ({} : Store)) hreuses heval
+  exact ⟨result.order, result.valueInBounds⟩
+
+/-! ## Final-root release
+
+These are the reusable bridge from the existing exact-ownership simulation
+to concrete leak freedom.  The ownership proof consumes the sole root; the
+parallel trace proof preserves allocation order; the empty-root theorem then
+rules out every remaining slot.
+-/
+
+theorem shared_release_live_eq_zero {ctx : Ctx} {fuel : Nat}
+    {store released : Store} {value : RVal}
+    (hown : RootOwnership store [⟨.shared, value⟩])
+    (horder : AllocationOrderInvariant store)
+    (heval : dropVal ctx fuel store value = .ok released) :
+    released.live = 0 := by
+  apply live_eq_zero_of_empty_roots
+  · exact Sim.dropVal_preserves hown heval
+  · exact horder.dropVal heval
+
+theorem unique_release_live_eq_zero {ctx : Ctx} {fuel : Nat}
+    {store released : Store} {value : RVal}
+    (hown : RootOwnership store [⟨.unique, value⟩])
+    (horder : AllocationOrderInvariant store)
+    (heval : dropUVal ctx fuel store value = .ok released) :
+    released.live = 0 := by
+  apply live_eq_zero_of_empty_roots
+  · exact Sim.dropUVal_preserves hown heval
+  · exact horder.dropUVal heval
+
+/-- A well-owned, allocation-ordered shared result always has enough release
+fuel, and that release empties the concrete heap. -/
+theorem shared_reclamation {ctx : Ctx} {store : Store} {value : RVal}
+    (hown : RootOwnership store [⟨.shared, value⟩])
+    (horder : AllocationOrderInvariant store) :
+    ∃ fuel released,
+      dropVal ctx fuel store value = .ok released ∧ released.live = 0 := by
+  obtain ⟨fuel, released, heval, _⟩ :=
+    dropVal_progress (ctx := ctx) hown
+  exact ⟨fuel, released, heval,
+    shared_release_live_eq_zero hown horder heval⟩
+
+/-- The corresponding theorem for a unique final result. -/
+theorem unique_reclamation {ctx : Ctx} {store : Store} {value : RVal}
+    (hown : RootOwnership store [⟨.unique, value⟩])
+    (horder : AllocationOrderInvariant store) :
+    ∃ fuel released,
+      dropUVal ctx fuel store value = .ok released ∧ released.live = 0 := by
+  obtain ⟨fuel, released, heval, _⟩ :=
+    dropUVal_progress (ctx := ctx) hown
+  exact ⟨fuel, released, heval,
+    unique_release_live_eq_zero hown horder heval⟩
+
+end Ix.Compiler.IxIR1.Reclamation
diff --git a/Ix/Compiler/IxIR1/Serialize.lean b/Ix/Compiler/IxIR1/Serialize.lean
new file mode 100644
index 000000000..7843d4ac4
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Serialize.lean
@@ -0,0 +1,159 @@
+import Ix.Compiler.IxIR.Encoding
+import Ix.Compiler.IxIR0.Serialize
+import Ix.Compiler.IxIR1.Basic
+
+/-!
+# IxIR₁ canonical hash preimages
+
+Every first-order operation, branch, and declaration has an explicit byte
+spelling. The top-level declaration preimage is domain-separated as
+`compilatrix/ixir1/decl/2`, followed by NUL and the declaration payload. Version
+2 commits the owner-sensitive dynamic-PAP-entry bit on function declarations.
+`callSelf` prevents an ordinary recursive function from placing its own digest
+inside its preimage; other call and PAP edges retain exact 32-byte addresses.
+
+The mutually nested `Code`/`Alt` grammar is encoded with an explicit list walk,
+matching the generated nested recursor while remaining executable by Lean's
+code generator.
+-/
+
+namespace Ix.Compiler.IxIR1
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR
+
+namespace Atom
+
+/-- Canonical atom payload. -/
+def bytes : Atom → ByteArray
+  | .var index => Encoding.tag 0 ++ Encoding.nat index
+  | .lit literal => Encoding.tag 1 ++ literal.bytes
+  | .erased => Encoding.tag 2
+
+end Atom
+
+namespace CtorId
+
+/-- Canonical constructor identity. -/
+def bytes (cid : CtorId) : ByteArray :=
+  Encoding.address cid.block ++ Encoding.nat cid.indIdx ++
+    Encoding.nat cid.cidx
+
+end CtorId
+
+namespace Op
+
+/-- Canonical primitive-operation payload. -/
+def bytes : Op → ByteArray
+  | .pure atom => Encoding.tag 0 ++ atom.bytes
+  | .alloc world cid args =>
+      Encoding.tag 1 ++ Encoding.tag world.toBits ++ cid.bytes ++
+        Encoding.array Atom.bytes args
+  | .reuse target cid args =>
+      Encoding.tag 2 ++ target.bytes ++ cid.bytes ++
+        Encoding.array Atom.bytes args
+  | .free target => Encoding.tag 3 ++ target.bytes
+  | .dup target => Encoding.tag 4 ++ target.bytes
+  | .drop target => Encoding.tag 5 ++ target.bytes
+  | .dropU target => Encoding.tag 6 ++ target.bytes
+  | .fetch target field =>
+      Encoding.tag 7 ++ target.bytes ++ Encoding.nat field
+  | .call function args =>
+      Encoding.tag 8 ++ Encoding.address function ++
+        Encoding.array Atom.bytes args
+  | .callSelf args => Encoding.tag 9 ++ Encoding.array Atom.bytes args
+  | .papp function args =>
+      Encoding.tag 10 ++ Encoding.address function ++
+        Encoding.array Atom.bytes args
+  | .apply function args =>
+      Encoding.tag 11 ++ function.bytes ++ Encoding.array Atom.bytes args
+  | .extern function args =>
+      Encoding.tag 12 ++ Encoding.address function ++
+        Encoding.array Atom.bytes args
+
+end Op
+
+mutual
+
+/-- Canonical code payload. -/
+def Code.bytes : Code → ByteArray
+  | .ret atom => Encoding.tag 0 ++ atom.bytes
+  | .letOp op rest => Encoding.tag 1 ++ op.bytes ++ rest.bytes
+  | .case scrut peelNat alts =>
+      Encoding.tag 2 ++ scrut.bytes ++ Encoding.bool peelNat ++
+        Encoding.nat alts.size ++ AltList.bytes alts.toList
+
+/-- Canonical case-alternative payload. -/
+def Alt.bytes : Alt → ByteArray
+  | .mk cidx fields body =>
+      Encoding.nat cidx ++ Encoding.nat fields ++ body.bytes
+
+/-- Executable order-preserving walk beneath an alternative array. -/
+def AltList.bytes : List Alt → ByteArray
+  | [] => ByteArray.empty
+  | head :: tail => head.bytes ++ AltList.bytes tail
+
+end
+
+namespace FnDef
+
+/-- Canonical saturated-function payload. -/
+def bytes (fn : FnDef) : ByteArray :=
+  Encoding.nat fn.arity ++ Encoding.tag fn.result.toBits ++
+    Encoding.bool fn.papSafe ++ fn.body.bytes
+
+end FnDef
+
+namespace Decl
+
+/-- The versioned domain prefix for IxIR₁ declaration identities. -/
+def addressDomain : ByteArray :=
+  Encoding.domain "compilatrix/ixir1/decl/2" ++ Encoding.tag 0
+
+/-- Canonical declaration payload, without the address domain. -/
+def payloadBytes : Decl → ByteArray
+  | .fn definition => Encoding.tag 0 ++ definition.bytes
+  | .extern arity => Encoding.tag 1 ++ Encoding.nat arity
+
+/-- Complete canonical hash preimage for one IxIR₁ declaration. -/
+def preimage (decl : Decl) : ByteArray :=
+  addressDomain ++ payloadBytes decl
+
+/-- BLAKE3 content address of an IxIR₁ declaration. -/
+def address (decl : Decl) : Address :=
+  Address.blake3 decl.preimage
+
+/-- Pair a declaration with its computed content address. -/
+def addressed (decl : Decl) : Address × Decl :=
+  (decl.address, decl)
+
+/-- Address equality exposes byte identity under exactly the pairwise
+collision premise for these two preimages. -/
+theorem address_eq_iff_preimage_eq (left right : Decl)
+    (hcollision : Address.Blake3NoCollision left.preimage right.preimage) :
+    left.address = right.address ↔ left.preimage = right.preimage := by
+  constructor
+  · exact hcollision
+  · intro h
+    simp only [address]
+    rw [h]
+
+@[simp] theorem addressed_fst (decl : Decl) : decl.addressed.1 = decl.address :=
+  rfl
+
+@[simp] theorem addressed_snd (decl : Decl) : decl.addressed.2 = decl :=
+  rfl
+
+end Decl
+
+/-! Small format-freezing structural vectors; BLAKE3 vectors live in the
+compiled test executable because the current hash implementation is FFI. -/
+
+#guard Atom.bytes (.lit (.nat 128)) == ByteArray.mk #[1, 0, 128, 1]
+#guard Code.bytes (.case .erased false #[.mk 0 0 (.ret .erased)]) ==
+  ByteArray.mk #[2, 2, 0, 1, 0, 0, 0, 2]
+#guard Decl.payloadBytes (.fn ⟨1, .shared, true, .ret (.var 0)⟩) ==
+  ByteArray.mk #[0, 1, 1, 1, 0, 0, 0]
+#guard Decl.payloadBytes (.extern 128) == ByteArray.mk #[1, 128, 1]
+
+end Ix.Compiler.IxIR1
diff --git a/Ix/Compiler/IxIR1/Sim.lean b/Ix/Compiler/IxIR1/Sim.lean
new file mode 100644
index 000000000..ec3d7dd13
--- /dev/null
+++ b/Ix/Compiler/IxIR1/Sim.lean
@@ -0,0 +1,6882 @@
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.IxIR0.Eval
+
+/-!
+# IxIR₀ → IxIR₁ memory-simulation foundations
+
+This file separates the four relations needed by the lowering proof:
+
+1. `ValueGraph` realizes a pure IxIR₀ value at an IxIR₁ scalar or live
+   heap root. Function-shaped values use an explicit correspondence oracle;
+   constructor data is checked recursively.
+2. `RootOwnership` states the exact ownership equation for a multiset of
+   live roots. Shared refcounts equal incoming roots plus heap edges; unique
+   nodes have one incoming owner. Edges and roots remain in one ownership
+   world, and pap nodes are shared.
+3. `HeapIso` identifies live heaps through a finite partial bijection of
+   locations. Dead slots and cost counters are intentionally absent.
+4. `StoreGraphExtends` preserves existing node shapes while allowing RC-only
+   updates and unrelated allocation, so semantic graphs can survive ordinary
+   memory-management steps without demanding full heap isomorphism.
+
+The primitive lemmas below this foundation are the first layer of the formal
+IxIR₀ → IxIR₁ simulation. They are kept independent of lowering so the
+later compiler induction can reuse them for hand-written and generated code.
+-/
+
+namespace Ix.Compiler.IxIR1.Sim
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR0 (Literal)
+
+/-! ## Pure values realized by a heap graph -/
+
+/-- The lowering-specific correspondence for function-shaped values.
+`captures` are the pure values stored in the target pap node. Lambda lifting
+and known heads will instantiate this oracle in the compiler theorem. -/
+abbrev FunctionRel :=
+  IxIR0.Value → Address → Nat → List IxIR0.Value → Prop
+
+mutual
+
+  /-- A pure IxIR₀ value realized by an IxIR₁ scalar or live heap node. -/
+  inductive ValueGraph (funRel : FunctionRel) (store : Store) :
+      IxIR0.Value → RVal → Prop where
+    | lit {l : Literal} : ValueGraph funRel store (.lit l) (.lit l)
+    | erased : ValueGraph funRel store .erased .erased
+    | ctor {adr : Address} {tag : Nat} {args : List IxIR0.Value}
+        {loc : Nat} {world : Owned} {rc : Nat} {cid : CtorId}
+        {fields : Array RVal} :
+        store.get? loc = some ⟨world, rc, .ctorN cid fields⟩ →
+        cid.block = adr →
+        cid.cidx = tag →
+        ValuesGraph funRel store args fields.toList →
+        ValueGraph funRel store (.ctor adr tag args) (.loc loc)
+    | function {v : IxIR0.Value} {f : Address} {arity : Nat}
+        {captures : List IxIR0.Value} {loc rc : Nat} {args : Array RVal} :
+        store.get? loc = some ⟨.shared, rc, .papN f arity args⟩ →
+        funRel v f arity captures →
+        ValuesGraph funRel store captures args.toList →
+        ValueGraph funRel store v (.loc loc)
+
+  /-- Pointwise realization of node fields or pap captures. -/
+  inductive ValuesGraph (funRel : FunctionRel) (store : Store) :
+      List IxIR0.Value → List RVal → Prop where
+    | nil : ValuesGraph funRel store [] []
+    | cons {v : IxIR0.Value} {rv : RVal}
+        {vs : List IxIR0.Value} {rvs : List RVal} :
+        ValueGraph funRel store v rv →
+        ValuesGraph funRel store vs rvs →
+        ValuesGraph funRel store (v :: vs) (rv :: rvs)
+
+end
+
+/-- Pointwise value graphs have equal source and runtime vector lengths. -/
+@[simp] theorem ValuesGraph.length {funRel : FunctionRel} {store : Store} :
+    ∀ {values : List IxIR0.Value} {runtimeValues : List RVal},
+      ValuesGraph funRel store values runtimeValues →
+      values.length = runtimeValues.length
+  | _, _, .nil => rfl
+  | _, _, .cons _ tail => by simp [tail.length]
+
+/-- Pointwise value graphs concatenate in lockstep. -/
+theorem ValuesGraph.append {funRel : FunctionRel} {store : Store}
+    {sourceLeft sourceRight : List IxIR0.Value}
+    {runtimeLeft runtimeRight : List RVal}
+    (hleft : ValuesGraph funRel store sourceLeft runtimeLeft)
+    (hright : ValuesGraph funRel store sourceRight runtimeRight) :
+    ValuesGraph funRel store (sourceLeft ++ sourceRight)
+      (runtimeLeft ++ runtimeRight) := by
+  induction sourceLeft generalizing runtimeLeft with
+  | nil =>
+    cases hleft
+    simpa using hright
+  | cons source sourceLeft ih =>
+    cases hleft with
+    | cons hhead htail => exact .cons hhead (ih htail)
+
+/-- Pointwise value graphs are insensitive to reversing both vectors. -/
+theorem ValuesGraph.reverse {funRel : FunctionRel} {store : Store}
+    : ∀ {sourceValues : List IxIR0.Value} {runtimeValues : List RVal},
+      ValuesGraph funRel store sourceValues runtimeValues →
+      ValuesGraph funRel store sourceValues.reverse runtimeValues.reverse
+  | _, _, .nil => .nil
+  | _, _, .cons hhead htail => by
+      simpa [List.reverse_cons] using
+        htail.reverse.append (ValuesGraph.cons hhead ValuesGraph.nil)
+
+/-- Split a pointwise graph at corresponding source/runtime prefixes. -/
+theorem ValuesGraph.splitAppend {funRel : FunctionRel} {store : Store}
+    {sourceLeft sourceRight : List IxIR0.Value}
+    {runtimeLeft runtimeRight : List RVal}
+    (hlength : sourceLeft.length = runtimeLeft.length)
+    (graph : ValuesGraph funRel store (sourceLeft ++ sourceRight)
+      (runtimeLeft ++ runtimeRight)) :
+    ValuesGraph funRel store sourceLeft runtimeLeft ∧
+      ValuesGraph funRel store sourceRight runtimeRight := by
+  induction sourceLeft generalizing runtimeLeft with
+  | nil =>
+    have hruntime : runtimeLeft = [] :=
+      List.length_eq_zero_iff.mp hlength.symm
+    subst runtimeLeft
+    exact ⟨.nil, by simpa using graph⟩
+  | cons source sourceLeft ih =>
+    cases runtimeLeft with
+    | nil => simp at hlength
+    | cons runtime runtimeLeft =>
+      simp only [List.length_cons, Nat.succ.injEq] at hlength
+      change ValuesGraph funRel store
+        (source :: (sourceLeft ++ sourceRight))
+        (runtime :: (runtimeLeft ++ runtimeRight)) at graph
+      cases graph with
+      | cons hhead htail =>
+        obtain ⟨hleft, hright⟩ := ih hlength htail
+        exact ⟨.cons hhead hleft, hright⟩
+
+/-- Restrict a pointwise graph to equal numeric prefixes. -/
+theorem ValuesGraph.take {funRel : FunctionRel} {store : Store}
+    {sourceValues : List IxIR0.Value} {runtimeValues : List RVal}
+    (graph : ValuesGraph funRel store sourceValues runtimeValues)
+    (count : Nat) :
+    ValuesGraph funRel store (sourceValues.take count)
+      (runtimeValues.take count) := by
+  have hsource := List.take_append_drop count sourceValues
+  have hruntime := List.take_append_drop count runtimeValues
+  have hlength : (sourceValues.take count).length =
+      (runtimeValues.take count).length := by
+    simp [graph.length]
+  have hwhole : ValuesGraph funRel store
+      (sourceValues.take count ++ sourceValues.drop count)
+      (runtimeValues.take count ++ runtimeValues.drop count) := by
+    simpa [hsource, hruntime] using graph
+  exact (hwhole.splitAppend hlength).1
+
+/-- Restrict a pointwise graph to corresponding suffixes. -/
+theorem ValuesGraph.drop {funRel : FunctionRel} {store : Store}
+    {sourceValues : List IxIR0.Value} {runtimeValues : List RVal}
+    (graph : ValuesGraph funRel store sourceValues runtimeValues)
+    (count : Nat) :
+    ValuesGraph funRel store (sourceValues.drop count)
+      (runtimeValues.drop count) := by
+  have hsource := List.take_append_drop count sourceValues
+  have hruntime := List.take_append_drop count runtimeValues
+  have hlength : (sourceValues.take count).length =
+      (runtimeValues.take count).length := by
+    simp [graph.length]
+  have hwhole : ValuesGraph funRel store
+      (sourceValues.take count ++ sourceValues.drop count)
+      (runtimeValues.take count ++ runtimeValues.drop count) := by
+    simpa [hsource, hruntime] using graph
+  exact (hwhole.splitAppend hlength).2
+
+/-- One-way preservation of live heap shape. Existing live locations keep
+their world and node contents, while reference counts may change and the
+target store may contain additional live nodes. This is exactly the store
+relation under which pure `ValueGraph`s remain valid. -/
+def StoreGraphExtends (before after : Store) : Prop :=
+  ∀ {loc world rc node},
+    before.get? loc = some ⟨world, rc, node⟩ →
+    ∃ rc', after.get? loc = some ⟨world, rc', node⟩
+
+/-- Reverse shape inclusion used by destructive operations. Every node still
+live afterward existed beforehand with the same world and contents, though
+its reference count may differ. Dropped nodes may disappear. -/
+def StoreGraphRestricts (before after : Store) : Prop :=
+  ∀ {loc world rc node},
+    after.get? loc = some ⟨world, rc, node⟩ →
+    ∃ rc', before.get? loc = some ⟨world, rc', node⟩
+
+theorem StoreGraphExtends.refl (store : Store) :
+    StoreGraphExtends store store := by
+  intro loc world rc node hget
+  exact ⟨rc, hget⟩
+
+theorem StoreGraphExtends.trans {first middle last : Store}
+    (h₁ : StoreGraphExtends first middle)
+    (h₂ : StoreGraphExtends middle last) :
+    StoreGraphExtends first last := by
+  intro loc world rc node hget
+  obtain ⟨middleRc, hmiddle⟩ := h₁ hget
+  exact h₂ hmiddle
+
+theorem StoreGraphRestricts.refl (store : Store) :
+    StoreGraphRestricts store store := by
+  intro loc world rc node hget
+  exact ⟨rc, hget⟩
+
+theorem StoreGraphRestricts.trans {first middle last : Store}
+    (h₁ : StoreGraphRestricts first middle)
+    (h₂ : StoreGraphRestricts middle last) :
+    StoreGraphRestricts first last := by
+  intro loc world rc node hget
+  obtain ⟨middleRc, hmiddle⟩ := h₂ hget
+  exact h₁ hmiddle
+
+theorem StoreGraphRestricts.rcTick (store : Store) :
+    StoreGraphRestricts store store.rcTick := by
+  intro loc world rc node hget
+  exact ⟨rc, by simpa [Store.rcTick, Store.get?] using hget⟩
+
+/-- Pure value realization ignores refcount changes and survives allocation
+of unrelated nodes. The mutual recursor transports constructor fields and pap
+captures through the same store relation. -/
+theorem ValueGraph.monoStore {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphExtends before after)
+    {value : IxIR0.Value} {runtimeValue : RVal}
+    (graph : ValueGraph funRel before value runtimeValue) :
+    ValueGraph funRel after value runtimeValue := by
+  refine ValueGraph.rec
+    (motive_1 := fun value runtimeValue _ =>
+      ValueGraph funRel after value runtimeValue)
+    (motive_2 := fun values runtimeValues _ =>
+      ValuesGraph funRel after values runtimeValues)
+    ?_ ?_ ?_ ?_ ?_ ?_ graph
+  · intro literal
+    exact .lit
+  · exact .erased
+  · intro address tag args loc world rc cid fields hget haddress htag
+      _ hfields
+    obtain ⟨rc', hget'⟩ := hstore hget
+    exact .ctor hget' haddress htag hfields
+  · intro value address arity captures loc rc args hget hfun _ hcaptures
+    obtain ⟨rc', hget'⟩ := hstore hget
+    exact .function hget' hfun hcaptures
+  · exact .nil
+  · intro value runtimeValue values runtimeValues _ _ hvalue hvalues
+    exact .cons hvalue hvalues
+
+/-- Pointwise value realization survives the same shape-preserving store
+extension as a single value. This companion is especially useful when an
+allocation turns an already-related argument vector into node fields. -/
+theorem ValuesGraph.monoStore {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphExtends before after)
+    {values : List IxIR0.Value} {runtimeValues : List RVal}
+    (graphs : ValuesGraph funRel before values runtimeValues) :
+    ValuesGraph funRel after values runtimeValues := by
+  refine ValuesGraph.rec
+    (motive_1 := fun value runtimeValue _ =>
+      ValueGraph funRel after value runtimeValue)
+    (motive_2 := fun values runtimeValues _ =>
+      ValuesGraph funRel after values runtimeValues)
+    ?_ ?_ ?_ ?_ ?_ ?_ graphs
+  · intro literal
+    exact .lit
+  · exact .erased
+  · intro address tag args loc world rc cid fields hget haddress htag
+      _ hfields
+    obtain ⟨rc', hget'⟩ := hstore hget
+    exact .ctor hget' haddress htag hfields
+  · intro value address arity captures loc rc args hget hfun _ hcaptures
+    obtain ⟨rc', hget'⟩ := hstore hget
+    exact .function hget' hfun hcaptures
+  · exact .nil
+  · intro value runtimeValue values runtimeValues _ _ hvalue hvalues
+    exact .cons hvalue hvalues
+
+/-- Pointwise graph lookup: a successful source-list lookup identifies the
+runtime value at the same position together with its `ValueGraph`. -/
+theorem ValuesGraph.get? {funRel : FunctionRel} {store : Store}
+    {sourceValues : List IxIR0.Value} {runtimeValues : List RVal}
+    (graphs : ValuesGraph funRel store sourceValues runtimeValues)
+    {index : Nat} {sourceValue : IxIR0.Value}
+    (hsource : sourceValues[index]? = some sourceValue) :
+    ∃ runtimeValue,
+      runtimeValues[index]? = some runtimeValue ∧
+      ValueGraph funRel store sourceValue runtimeValue := by
+  induction index generalizing sourceValues runtimeValues with
+  | zero =>
+    cases graphs with
+    | nil => simp at hsource
+    | cons hvalue htail =>
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at hsource
+      subst sourceValue
+      exact ⟨_, rfl, hvalue⟩
+  | succ index ih =>
+    cases graphs with
+    | nil => simp at hsource
+    | cons hvalue htail =>
+      rw [List.getElem?_cons_succ] at hsource
+      obtain ⟨runtimeValue, hruntime, hvalue⟩ := ih htail hsource
+      exact ⟨runtimeValue, by simpa using hruntime, hvalue⟩
+
+/-- Once successful target execution identifies a constructor node, a
+constructor-shaped source graph recovers the pointwise field graph. The
+extra target-node premise is essential because the abstract `FunctionRel`
+may otherwise relate an arbitrary source value to a pap. -/
+theorem ValueGraph.ctor_fields_of_get
+    {funRel : FunctionRel} {store : Store}
+    {address : Address} {tag : Nat} {sourceFields : List IxIR0.Value}
+    {loc rc : Nat} {world : Owned} {cid : CtorId}
+    {fields : Array RVal}
+    (graph : ValueGraph funRel store
+      (.ctor address tag sourceFields) (.loc loc))
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩) :
+    cid.block = address ∧ cid.cidx = tag ∧
+      ValuesGraph funRel store sourceFields fields.toList := by
+  cases graph with
+  | ctor hgraphGet haddress htag hfields =>
+    have hbox := Option.some.inj (hgraphGet.symm.trans hget)
+    cases hbox
+    exact ⟨haddress, htag, hfields⟩
+  | function hgraphGet hfun hcaptures =>
+    have hbox := Option.some.inj (hgraphGet.symm.trans hget)
+    have hnode := congrArg NodeBox.node hbox
+    contradiction
+
+/-- Inversion at the erased scalar. Literal graphs carry their literal and
+both located graphs produce `.loc`, so a target execution that yields
+`RVal.erased` pins the source side exactly. Note the converse fails: the
+abstract `FunctionRel` may relate the source erased value to a pap node. -/
+theorem ValueGraph.eq_erased_of_erased {funRel : FunctionRel} {store : Store}
+    {sourceValue : IxIR0.Value}
+    (graph : ValueGraph funRel store sourceValue .erased) :
+    sourceValue = .erased := by
+  cases graph
+  rfl
+
+/-! ## Roots and exact ownership -/
+
+/-- One external heap owner, annotated with the world in which it may be
+consumed. Scalars carry no heap ownership but are valid in either world. -/
+structure Root where
+  world : Owned
+  value : RVal
+  deriving BEq, Repr
+
+/-- Scalars inhabit either world; a location inhabits the world stored in its
+live `NodeBox`. -/
+def HasWorld (store : Store) (world : Owned) : RVal → Prop
+  | .loc loc => ∃ box, store.get? loc = some box ∧ box.world = world
+  | .lit _ | .erased => True
+
+/-- Heap-world evidence is monotone under shape-preserving store extension. -/
+theorem HasWorld.monoStore {before after : Store}
+    (hstore : StoreGraphExtends before after)
+    {world : Owned} {value : RVal}
+    (h : HasWorld before world value) : HasWorld after world value := by
+  cases value with
+  | loc loc =>
+    obtain ⟨box, hget, hworld⟩ := h
+    cases box with
+    | mk boxWorld rc node =>
+      obtain ⟨rc', hget'⟩ := hstore hget
+      exact ⟨⟨boxWorld, rc', node⟩, hget', hworld⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- The evaluator's executable result-world check is exactly the
+propositional world predicate used by the memory simulation. -/
+theorem rval_hasWorld_eq_true_iff {store : Store} {world : Owned}
+    {value : RVal} :
+    RVal.hasWorld store world value = true ↔ HasWorld store world value := by
+  cases value with
+  | lit l => simp [RVal.hasWorld, HasWorld]
+  | erased => simp [RVal.hasWorld, HasWorld]
+  | loc loc =>
+    simp only [RVal.hasWorld, HasWorld]
+    cases hbox : store.get? loc with
+    | none => simp
+    | some box =>
+      simp only [Option.some.injEq, exists_eq_left']
+      cases box.world <;> cases world <;> decide
+
+/-- Any successful dynamic result-boundary check returns the same value
+and establishes its declared world. -/
+theorem checkResultWorld_ok {world : Owned} {out out' : Store × RVal}
+    (h : checkResultWorld world out = .ok out') :
+    out' = out ∧ HasWorld out.1 world out.2 := by
+  simp only [checkResultWorld] at h
+  split at h
+  next hw =>
+    simp only [Except.ok.injEq] at h
+    subst out'
+    exact ⟨rfl, rval_hasWorld_eq_true_iff.mp hw⟩
+  next => contradiction
+
+/-- Successful ownership-aware main execution exposes both its literal body
+run and the checked result-world witness.  This is the top-level analogue of
+`invoke_fn_result_hasWorld`, with the exact synthetic current function kept
+available to structured lowering simulations. -/
+theorem runOwnedMain_ok {ctx : Ctx} {world : Owned} {code : Code}
+    {fuel : Nat} {out : Store × RVal}
+    (run : runOwnedMain ctx world code fuel = .ok out) :
+    runCode ctx fuel ⟨0, world, false, code⟩ ({} : Store) [] code =
+        .ok out ∧
+      HasWorld out.1 world out.2 := by
+  unfold runOwnedMain at run
+  cases bodyRun :
+      runCode ctx fuel ⟨0, world, false, code⟩ ({} : Store) [] code with
+  | error error =>
+      simp only [bodyRun, bind, Except.bind] at run
+      contradiction
+  | ok bodyOut =>
+      have checked : checkResultWorld world bodyOut = .ok out := by
+        simpa only [bodyRun, bind, Except.bind] using run
+      obtain ⟨outputEq, resultWorld⟩ := checkResultWorld_ok checked
+      subst out
+      exact ⟨rfl, resultWorld⟩
+
+/-- A successful call to a function declaration returns a scalar or a
+live location in the `FnDef.result` world. This is the first reusable
+call-result ownership contract for the compiler simulation. -/
+theorem invoke_fn_result_hasWorld {ctx : Ctx} {fuel : Nat}
+    {f : Address} {args : List RVal} {store store' : Store}
+    {value : RVal} {d : FnDef}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hinvoke : invoke ctx fuel f args store = .ok (store', value)) :
+    HasWorld store' d.result value := by
+  cases fuel with
+  | zero => simp [invoke] at hinvoke
+  | succ fuel =>
+    simp only [invoke, hdecl] at hinvoke
+    split at hinvoke
+    · contradiction
+    · cases hrun : runCode ctx fuel d store args.reverse d.body with
+      | error e =>
+        rw [hrun] at hinvoke
+        change (.error e : Except Err (Store × RVal)) =
+          .ok (store', value) at hinvoke
+        contradiction
+      | ok out =>
+        rw [hrun] at hinvoke
+        change checkResultWorld d.result out = .ok (store', value) at hinvoke
+        obtain ⟨hpair, hw⟩ := checkResultWorld_ok hinvoke
+        subst out
+        exact hw
+
+/-- Every successful invocation supplied exactly the declaration arity,
+independently of whether the target is a function or scalar extern. -/
+theorem invoke_success_length {ctx : Ctx} {fuel : Nat} {f : Address}
+    {args : List RVal} {store store' : Store} {value : RVal} {d : Decl}
+    (hdecl : ctx.decls f = some d)
+    (hinvoke : invoke ctx fuel f args store = .ok (store', value)) :
+    args.length = declArity d := by
+  cases fuel with
+  | zero => simp [invoke] at hinvoke
+  | succ fuel =>
+    cases d <;> simp only [invoke, hdecl] at hinvoke
+    all_goals
+      split at hinvoke
+      next hne => contradiction
+      next heq => simpa [declArity] using heq
+
+/-- Source values with ownership demands, realized by target roots. -/
+inductive RootsGraph (funRel : FunctionRel) (store : Store) :
+    List (Owned × IxIR0.Value) → List Root → Prop where
+  | nil : RootsGraph funRel store [] []
+  | cons {world : Owned} {v : IxIR0.Value} {root : Root}
+      {vs : List (Owned × IxIR0.Value)} {roots : List Root} :
+      root.world = world →
+      HasWorld store world root.value →
+      ValueGraph funRel store v root.value →
+      RootsGraph funRel store vs roots →
+      RootsGraph funRel store ((world, v) :: vs) (root :: roots)
+
+@[simp] theorem RootsGraph.lengths {funRel : FunctionRel} {store : Store}
+    {sourceRoots : List (Owned × IxIR0.Value)} {roots : List Root}
+    (graph : RootsGraph funRel store sourceRoots roots) :
+    sourceRoots.length = roots.length := by
+  induction graph <;> simp_all
+
+/-- Concatenate two independently related root frames. -/
+theorem RootsGraph.append {funRel : FunctionRel} {store : Store}
+    {sourceLeft sourceRight : List (Owned × IxIR0.Value)}
+    {left right : List Root}
+    (hleft : RootsGraph funRel store sourceLeft left)
+    (hright : RootsGraph funRel store sourceRight right) :
+    RootsGraph funRel store (sourceLeft ++ sourceRight) (left ++ right) := by
+  induction hleft with
+  | nil => simpa using hright
+  | cons hrootWorld hworld hvalue _ ih =>
+    exact .cons hrootWorld hworld hvalue ih
+
+/-- Split a related concatenated frame at a prefix whose source/runtime
+lengths agree. The length premise prevents an arbitrary mismatched cut from
+dividing the two lockstep lists at different positions. -/
+theorem RootsGraph.splitAppend {funRel : FunctionRel} {store : Store}
+    {sourceLeft sourceRight : List (Owned × IxIR0.Value)}
+    {left right : List Root}
+    (hlength : sourceLeft.length = left.length)
+    (graph : RootsGraph funRel store
+      (sourceLeft ++ sourceRight) (left ++ right)) :
+    RootsGraph funRel store sourceLeft left ∧
+      RootsGraph funRel store sourceRight right := by
+  induction sourceLeft generalizing left with
+  | nil =>
+    have hleft : left = [] := List.length_eq_zero_iff.mp hlength.symm
+    subst left
+    exact ⟨.nil, by simpa using graph⟩
+  | cons source sourceLeft ih =>
+    cases left with
+    | nil => simp at hlength
+    | cons root left =>
+      rcases source with ⟨world, value⟩
+      simp only [List.length_cons, Nat.succ.injEq] at hlength
+      change RootsGraph funRel store
+        ((world, value) :: (sourceLeft ++ sourceRight))
+        (root :: (left ++ right)) at graph
+      cases graph with
+      | cons hrootWorld hworld hvalue htail =>
+        obtain ⟨hprefix, hsuffix⟩ := ih hlength htail
+        exact ⟨.cons hrootWorld hworld hvalue hprefix, hsuffix⟩
+
+/-- Root-list realization is monotone under the same heap-shape extension as
+individual values. Root worlds and runtime values remain unchanged. -/
+theorem RootsGraph.monoStore {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphExtends before after)
+    {values : List (Owned × IxIR0.Value)} {roots : List Root}
+    (graph : RootsGraph funRel before values roots) :
+    RootsGraph funRel after values roots := by
+  induction graph with
+  | nil => exact .nil
+  | cons hworld hhasWorld hvalue _ ih =>
+    exact .cons hworld (hhasWorld.monoStore hstore)
+      (hvalue.monoStore hstore) ih
+
+/-- The child references owned by a live node. -/
+def nodeChildren : Node → List RVal
+  | .ctorN _ fields => fields.toList
+  | .papN _ _ args => args.toList
+
+/-- Extract a location reference, ignoring scalars. -/
+def rvalLocation? : RVal → Option Nat
+  | .loc loc => some loc
+  | .lit _ | .erased => none
+
+def rootLocation? (root : Root) : Option Nat := rvalLocation? root.value
+
+/-- Location-owning edges contributed by one store slot. -/
+def slotEdgeLocations : Option NodeBox → List Nat
+  | none => []
+  | some box => (nodeChildren box.node).filterMap rvalLocation?
+
+/-- All location-owning edges of live heap nodes. Dead slots contribute no
+owners. Multiplicity is retained. -/
+def edgeLocations (store : Store) : List Nat :=
+  store.nodes.toList.flatMap slotEdgeLocations
+
+/-- Incoming ownership multiplicity at `loc`: external roots plus live heap
+edges. -/
+def incoming (store : Store) (roots : List Root) (loc : Nat) : Nat :=
+  ((roots.filterMap rootLocation?) ++ edgeLocations store).count loc
+
+/-- Exact root/edge ownership invariant. Cost counters and dead slots do not
+participate in it. -/
+structure RootOwnership (store : Store) (roots : List Root) : Prop where
+  roots_world : ∀ root ∈ roots, HasWorld store root.world root.value
+  edges_world : ∀ {loc box}, store.get? loc = some box →
+    ∀ child ∈ nodeChildren box.node, HasWorld store box.world child
+  pap_shared : ∀ {loc box f arity args},
+    store.get? loc = some box → box.node = .papN f arity args →
+    box.world = .shared
+  counts : ∀ {loc box}, store.get? loc = some box →
+    match box.world with
+    | .shared => box.rc = incoming store roots loc
+    | .unique => box.rc = 1 ∧ incoming store roots loc = 1
+
+/-- Exact ownership depends on the root multiset, not its presentation order.
+Compiler environments use an ordered list, so moving an arbitrary source
+entry to the distinguished result position relies on this bridge. -/
+theorem RootOwnership.perm {store : Store} {roots roots' : List Root}
+    (h : RootOwnership store roots) (hp : roots.Perm roots') :
+    RootOwnership store roots' := by
+  refine ⟨?_, h.edges_world, h.pap_shared, ?_⟩
+  · intro root hroot
+    exact h.roots_world root (hp.mem_iff.mpr hroot)
+  · intro loc box hbox
+    have hcount := ((hp.filterMap rootLocation?).append_right
+      (edgeLocations store)).count_eq loc
+    have hincoming : incoming store roots loc = incoming store roots' loc := by
+      simpa [incoming] using hcount
+    rw [← hincoming]
+    exact h.counts hbox
+
+/-- A graph rooted at a value that remains live after a destructive store
+restriction can be rebuilt in the post-state. Exact post-state ownership
+supplies liveness for every recursive node edge. -/
+theorem ValueGraph.ofRestricts {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphRestricts before after)
+    {roots : List Root} (hown : RootOwnership after roots)
+    {value : IxIR0.Value} {runtimeValue : RVal} {world : Owned}
+    (hworld : HasWorld after world runtimeValue)
+    (graph : ValueGraph funRel before value runtimeValue) :
+    ValueGraph funRel after value runtimeValue := by
+  refine ValueGraph.rec
+    (motive_1 := fun source runtime _ => ∀ {supportWorld : Owned},
+      HasWorld after supportWorld runtime →
+      ValueGraph funRel after source runtime)
+    (motive_2 := fun sources runtimes _ => ∀ {supportWorld : Owned},
+      (∀ runtime, runtime ∈ runtimes →
+        HasWorld after supportWorld runtime) →
+      ValuesGraph funRel after sources runtimes)
+    ?_ ?_ ?_ ?_ ?_ ?_ graph hworld
+  · intro literal supportWorld _
+    exact .lit
+  · intro supportWorld _
+    exact .erased
+  · intro address tag args loc nodeWorld rc cid fields hget haddress htag
+      _ hfields supportWorld hlive
+    obtain ⟨afterBox, hafter, hafterWorld⟩ := hlive
+    rcases afterBox with ⟨afterWorld, afterRc, afterNode⟩
+    change afterWorld = supportWorld at hafterWorld
+    subst supportWorld
+    obtain ⟨beforeRc, hbefore⟩ := hstore hafter
+    have hboxEq :
+        (⟨afterWorld, beforeRc, afterNode⟩ : NodeBox) =
+          ⟨nodeWorld, rc, .ctorN cid fields⟩ :=
+      Option.some.inj (hbefore.symm.trans hget)
+    cases hboxEq
+    apply ValueGraph.ctor hafter haddress htag
+    apply hfields
+    intro child hchild
+    exact hown.edges_world hafter child
+      (by simpa [nodeChildren] using hchild)
+  · intro source address arity captures loc rc args hget hfun
+      _ hcaptures supportWorld hlive
+    obtain ⟨afterBox, hafter, hafterWorld⟩ := hlive
+    rcases afterBox with ⟨afterWorld, afterRc, afterNode⟩
+    change afterWorld = supportWorld at hafterWorld
+    subst supportWorld
+    obtain ⟨beforeRc, hbefore⟩ := hstore hafter
+    have hboxEq :
+        (⟨afterWorld, beforeRc, afterNode⟩ : NodeBox) =
+          ⟨.shared, rc, .papN address arity args⟩ :=
+      Option.some.inj (hbefore.symm.trans hget)
+    cases hboxEq
+    apply ValueGraph.function hafter hfun
+    apply hcaptures
+    intro child hchild
+    exact hown.edges_world hafter child
+      (by simpa [nodeChildren] using hchild)
+  · intro supportWorld _
+    exact .nil
+  · intro source runtime sources runtimes _ _ hsource hsources
+      supportWorld hall
+    exact .cons
+      (hsource (hall runtime (by simp)))
+      (hsources (fun child hchild => hall child (by simp [hchild])))
+
+private theorem rootsGraph_ofRestrictsSubset {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphRestricts before after)
+    {allRoots : List Root} (hown : RootOwnership after allRoots)
+    {sourceRoots : List (Owned × IxIR0.Value)} {roots : List Root}
+    (graphs : RootsGraph funRel before sourceRoots roots) :
+    (∀ root, root ∈ roots → root ∈ allRoots) →
+      RootsGraph funRel after sourceRoots roots := by
+  induction graphs with
+  | nil =>
+    intro _
+    exact .nil
+  | @cons world value root sourceTail rootTail hrootWorld _ hvalue
+      htail ih =>
+    intro hsubset
+    have hrootLive : HasWorld after world root.value := by
+      have hrootWorld' := hown.roots_world root
+        (hsubset root (by simp))
+      simpa [hrootWorld] using hrootWorld'
+    exact .cons hrootWorld hrootLive
+      (hvalue.ofRestricts hstore hown hrootLive)
+      (ih (fun candidate hmember =>
+        hsubset candidate (by simp [hmember])))
+
+theorem RootsGraph.ofRestrictsIn {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphRestricts before after)
+    {allRoots : List Root} (hown : RootOwnership after allRoots)
+    {sourceRoots : List (Owned × IxIR0.Value)} {roots : List Root}
+    (hsubset : ∀ root, root ∈ roots → root ∈ allRoots)
+    (graphs : RootsGraph funRel before sourceRoots roots) :
+    RootsGraph funRel after sourceRoots roots :=
+  rootsGraph_ofRestrictsSubset hstore hown graphs hsubset
+
+/-- Every semantically related root in a surviving root list keeps its graph
+under a destructive shape restriction. -/
+theorem RootsGraph.ofRestricts {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphRestricts before after)
+    {sourceRoots : List (Owned × IxIR0.Value)} {roots : List Root}
+    (hown : RootOwnership after roots)
+    (graphs : RootsGraph funRel before sourceRoots roots) :
+    RootsGraph funRel after sourceRoots roots :=
+  graphs.ofRestrictsIn hstore hown (fun _ => id)
+
+/-- Pointwise source values survive a destructive restriction whenever each
+runtime value is still represented by some root in the post-state ownership
+set. The supporting root's world is existential because `ValuesGraph` itself
+is intentionally world-agnostic. -/
+theorem ValuesGraph.ofRestrictsIn {funRel : FunctionRel}
+    {before after : Store} (hstore : StoreGraphRestricts before after)
+    {allRoots : List Root} (hown : RootOwnership after allRoots)
+    {sourceValues : List IxIR0.Value} {runtimeValues : List RVal}
+    (hsupport : ∀ runtime, runtime ∈ runtimeValues →
+      ∃ world, (⟨world, runtime⟩ : Root) ∈ allRoots)
+    (graphs : ValuesGraph funRel before sourceValues runtimeValues) :
+    ValuesGraph funRel after sourceValues runtimeValues := by
+  refine ValuesGraph.rec
+    (motive_1 := fun _ _ _ => True)
+    (motive_2 := fun sources runtimes _ =>
+      (∀ runtime, runtime ∈ runtimes →
+        ∃ world, (⟨world, runtime⟩ : Root) ∈ allRoots) →
+      ValuesGraph funRel after sources runtimes)
+    ?_ ?_ ?_ ?_ ?_ ?_ graphs hsupport
+  · intro _
+    trivial
+  · trivial
+  · simp
+  · simp
+  · intro _
+    exact .nil
+  · intro source runtime sources runtimes hvalue _ _ htail
+    intro hremaining
+    obtain ⟨world, hroot⟩ := hremaining runtime (by simp)
+    exact .cons
+      (hvalue.ofRestricts hstore hown
+        (hown.roots_world ⟨world, runtime⟩ hroot))
+      (htail (fun child hchild =>
+        hremaining child (by simp [hchild])))
+
+theorem RootOwnership.empty : RootOwnership ({} : Store) [] := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · simp
+  · intro loc box hbox
+    simp [Store.get?] at hbox
+  · intro loc box f arity args hbox
+    simp [Store.get?] at hbox
+  · intro loc box hbox
+    simp [Store.get?] at hbox
+
+/-- Every heap edge points to a live node. This is separated from exact owner
+counts so graph closure can also be used by location isomorphism. -/
+def LiveRVal (store : Store) : RVal → Prop
+  | .loc loc => ∃ box, store.get? loc = some box
+  | .lit _ | .erased => True
+
+def StoreClosed (store : Store) : Prop :=
+  ∀ {loc box}, store.get? loc = some box →
+    ∀ child ∈ nodeChildren box.node, LiveRVal store child
+
+theorem RootOwnership.storeClosed {store : Store} {roots : List Root}
+    (h : RootOwnership store roots) : StoreClosed store := by
+  intro loc box hbox child hchild
+  have hw := h.edges_world hbox child hchild
+  cases child with
+  | loc childLoc =>
+    obtain ⟨childBox, hlive, _⟩ := hw
+    exact ⟨childBox, hlive⟩
+  | lit l => trivial
+  | erased => trivial
+
+/-- Roots consumed as the fields/captures of one freshly allocated node. -/
+def rootsFor (world : Owned) (values : List RVal) : List Root :=
+  values.map fun value => ⟨world, value⟩
+
+/-- Roots for a heterogeneous function telescope. The arity equality in
+`FnOwnershipContract` rules out the truncating mismatch cases. -/
+def rootsForWorlds : List Owned → List RVal → List Root
+  | world :: worlds, value :: values =>
+      ⟨world, value⟩ :: rootsForWorlds worlds values
+  | _, _ => []
+
+/-- Turn a pointwise value graph into a homogeneous root frame once every
+runtime value is known live in the chosen ownership world. -/
+theorem ValuesGraph.rootsGraph {funRel : FunctionRel} {store : Store}
+    {sourceValues : List IxIR0.Value} {runtimeValues : List RVal}
+    (world : Owned)
+    (graphs : ValuesGraph funRel store sourceValues runtimeValues)
+    (hworld : ∀ runtime, runtime ∈ runtimeValues →
+      HasWorld store world runtime) :
+    RootsGraph funRel store
+      (sourceValues.map fun value => (world, value))
+      (rootsFor world runtimeValues) := by
+  induction sourceValues generalizing runtimeValues with
+  | nil =>
+    cases graphs
+    exact .nil
+  | cons source sources ih =>
+    cases graphs with
+    | cons hvalue hvalues =>
+      simp only [List.map_cons, rootsFor]
+      exact RootsGraph.cons rfl
+        (hworld _ (by simp)) hvalue
+        (ih hvalues (fun candidate hmember =>
+          hworld candidate (by simp [hmember])))
+
+/-- Forget the homogeneous ownership annotations of a root frame, recovering
+the underlying pointwise value graph. -/
+theorem RootsGraph.valuesGraph {funRel : FunctionRel} {store : Store}
+    {sourceValues : List IxIR0.Value} {runtimeValues : List RVal}
+    {world : Owned}
+    (graphs : RootsGraph funRel store
+      (sourceValues.map fun value => (world, value))
+      (rootsFor world runtimeValues)) :
+    ValuesGraph funRel store sourceValues runtimeValues := by
+  induction sourceValues generalizing runtimeValues with
+  | nil =>
+    cases runtimeValues with
+    | nil => exact .nil
+    | cons runtime runtimes => cases graphs
+  | cons source sources ih =>
+    cases runtimeValues with
+    | nil => cases graphs
+    | cons runtime runtimes =>
+      simp only [List.map_cons, rootsFor] at graphs
+      cases graphs with
+      | cons _ _ hvalue htail => exact .cons hvalue (ih htail)
+
+/-- With matching telescope lengths, every runtime value occurs in the
+heterogeneous root list at the world paired with one of its positions. -/
+theorem exists_root_mem_rootsForWorlds
+    {worlds : List Owned} {values : List RVal}
+    (hlength : worlds.length = values.length)
+    {value : RVal} (hvalue : value ∈ values) :
+    ∃ world, (⟨world, value⟩ : Root) ∈
+      rootsForWorlds worlds values := by
+  induction values generalizing worlds with
+  | nil => simp at hvalue
+  | cons head tail ih =>
+    cases worlds with
+    | nil => simp at hlength
+    | cons world worlds =>
+      simp only [List.length_cons, Nat.succ.injEq] at hlength
+      rcases List.mem_cons.mp hvalue with rfl | htail
+      · exact ⟨world, by simp [rootsForWorlds]⟩
+      · obtain ⟨foundWorld, hfound⟩ := ih hlength htail
+        exact ⟨foundWorld, by simp [rootsForWorlds, hfound]⟩
+
+@[simp] theorem rootsForWorlds_cons (world : Owned) (worlds : List Owned)
+    (value : RVal) (values : List RVal) :
+    rootsForWorlds (world :: worlds) (value :: values) =
+      ⟨world, value⟩ :: rootsForWorlds worlds values := rfl
+
+/-- The semantic ownership obligation attached to one lowered function.
+The argument worlds come from the corresponding IxIR₀ lambda telescope;
+`FnDef` stores only the arity and result world. A future whole-program
+compiler theorem will construct one contract per lowered declaration. -/
+structure FnOwnershipContract (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  preserves : ∀ {fuel : Nat} {store store' : Store} {args : List RVal}
+      {value : RVal} {rest : List Root},
+    args.length = argWorlds.length →
+    RootOwnership store (rootsForWorlds argWorlds args ++ rest) →
+    runCode ctx fuel d store args.reverse d.body = .ok (store', value) →
+    RootOwnership store' (⟨d.result, value⟩ :: rest)
+
+/-- Exact ownership preservation for one evaluator-fuel index. Separating
+the fuel index from `FnOwnershipContract` makes recursive self calls
+well-founded: a successful `callSelf` always enters the same body at a
+strictly smaller index. -/
+def FnOwnershipPreservesAt (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (fuel : Nat) : Prop :=
+  ∀ {store store' : Store} {args : List RVal} {value : RVal}
+      {rest : List Root},
+    args.length = argWorlds.length →
+    RootOwnership store (rootsForWorlds argWorlds args ++ rest) →
+    runCode ctx fuel d store args.reverse d.body = .ok (store', value) →
+    RootOwnership store' (⟨d.result, value⟩ :: rest)
+
+/-- A function contract available only below `limit`. This is the induction
+hypothesis consumed while proving a recursive function at the exact index
+`limit`; it deliberately cannot justify a same-index recursive call. -/
+structure FnOwnershipContractBelow (ctx : Ctx) (d : FnDef)
+    (argWorlds : List Owned) (limit : Nat) : Prop where
+  arity_eq : argWorlds.length = d.arity
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    FnOwnershipPreservesAt ctx d argWorlds fuel
+
+/-- An ordinary function contract can be restricted to any fuel prefix. -/
+theorem FnOwnershipContract.below {ctx : Ctx} {d : FnDef}
+    {argWorlds : List Owned}
+    (hcontract : FnOwnershipContract ctx d argWorlds) (limit : Nat) :
+    FnOwnershipContractBelow ctx d argWorlds limit := by
+  refine ⟨hcontract.arity_eq, ?_⟩
+  intro fuel _
+  exact hcontract.preserves
+
+/-- Fuel-prefix contracts are contravariant in their bound. -/
+theorem FnOwnershipContractBelow.mono {ctx : Ctx} {d : FnDef}
+    {argWorlds : List Owned} {smaller larger : Nat}
+    (hcontract : FnOwnershipContractBelow ctx d argWorlds larger)
+    (hbound : smaller ≤ larger) :
+    FnOwnershipContractBelow ctx d argWorlds smaller := by
+  refine ⟨hcontract.arity_eq, ?_⟩
+  intro fuel hfuel
+  exact hcontract.preserves (Nat.lt_of_lt_of_le hfuel hbound)
+
+/-- Seal a contractive, one-fuel-step body proof into the public unbounded
+function contract. At index `limit`, the producer receives ownership
+preservation only for strictly smaller self invocations. Strong induction
+then supplies every index without assuming the theorem being constructed. -/
+theorem fnOwnershipContract_of_below_step {ctx : Ctx} {d : FnDef}
+    {argWorlds : List Owned}
+    (harity : argWorlds.length = d.arity)
+    (hstep : ∀ limit,
+      FnOwnershipContractBelow ctx d argWorlds limit →
+      FnOwnershipPreservesAt ctx d argWorlds limit) :
+    FnOwnershipContract ctx d argWorlds := by
+  refine ⟨harity, ?_⟩
+  intro fuel store store' args value rest hlength hown hrun
+  have hall : ∀ index,
+      FnOwnershipPreservesAt ctx d argWorlds index := by
+    intro index
+    induction index using Nat.strongRecOn with
+    | ind index ih =>
+      apply hstep index
+      refine ⟨harity, ?_⟩
+      intro prior hprior
+      exact ih prior hprior
+  exact hall fuel hlength hown hrun
+
+/-- Exact ownership contract for one case alternative. `entryRoots` describes
+the roots consumed by the branch from the enclosing environment and exposed
+field values; `rest` is an arbitrary caller continuation. Constructor fields
+are borrows at dispatch, so their world evidence is supplied separately and
+the alternative must explicitly retain any field it keeps. -/
+structure AltOwnershipContract (ctx : Ctx) (cur : FnDef) (alt : Alt)
+    (fieldWorld : Owned)
+    (entryValid : List RVal → Array RVal → Prop)
+    (entryRoots : List RVal → Array RVal → List Root) : Prop where
+  preserves : match alt with
+    | .mk _ fieldCount body =>
+      ∀ {fuel : Nat} {store store' : Store} {env : List RVal}
+          {fields : Array RVal} {value : RVal} {rest : List Root},
+        fields.size = fieldCount →
+        entryValid env fields →
+        RootOwnership store (entryRoots env fields ++ rest) →
+        (∀ field ∈ fields.toList, HasWorld store fieldWorld field) →
+        runCode ctx fuel cur store
+            (fields.foldl (fun branchEnv field => field :: branchEnv) env)
+            body = .ok (store', value) →
+        RootOwnership store' (⟨cur.result, value⟩ :: rest)
+
+/-- A case-alternative ownership contract restricted to evaluator indices
+below `limit`. Recursive rule bodies use this form while their enclosing
+recursor contract is being sealed. -/
+structure AltOwnershipContractBelow (ctx : Ctx) (cur : FnDef) (alt : Alt)
+    (fieldWorld : Owned)
+    (entryValid : List RVal → Array RVal → Prop)
+    (entryRoots : List RVal → Array RVal → List Root)
+    (limit : Nat) : Prop where
+  preserves : match alt with
+    | .mk _ fieldCount body =>
+      ∀ {fuel : Nat} {store store' : Store} {env : List RVal}
+          {fields : Array RVal} {value : RVal} {rest : List Root},
+        fuel < limit →
+        fields.size = fieldCount →
+        entryValid env fields →
+        RootOwnership store (entryRoots env fields ++ rest) →
+        (∀ field ∈ fields.toList, HasWorld store fieldWorld field) →
+        runCode ctx fuel cur store
+            (fields.foldl (fun branchEnv field => field :: branchEnv) env)
+            body = .ok (store', value) →
+        RootOwnership store' (⟨cur.result, value⟩ :: rest)
+
+/-- Restrict a completed alternative contract to a fuel prefix. -/
+theorem AltOwnershipContract.below {ctx : Ctx} {cur : FnDef} {alt : Alt}
+    {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hcontract : AltOwnershipContract ctx cur alt fieldWorld
+      entryValid entryRoots) (limit : Nat) :
+    AltOwnershipContractBelow ctx cur alt fieldWorld
+      entryValid entryRoots limit := by
+  cases alt with
+  | mk tag fieldCount body =>
+    refine ⟨?_⟩
+    intro fuel store store' env fields value rest _ hsize hvalid hown
+      hfields hrun
+    exact hcontract.preserves hsize hvalid hown hfields hrun
+
+/-- Fuel-prefix alternative contracts are contravariant in their bound. -/
+theorem AltOwnershipContractBelow.mono {ctx : Ctx} {cur : FnDef}
+    {alt : Alt} {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    {smaller larger : Nat}
+    (hcontract : AltOwnershipContractBelow ctx cur alt fieldWorld
+      entryValid entryRoots larger)
+    (hbound : smaller ≤ larger) :
+    AltOwnershipContractBelow ctx cur alt fieldWorld
+      entryValid entryRoots smaller := by
+  cases alt with
+  | mk tag fieldCount body =>
+    refine ⟨?_⟩
+    intro fuel store store' env fields value rest hfuel
+    exact hcontract.preserves (Nat.lt_of_lt_of_le hfuel hbound)
+
+/-- Whole-context higher-order ownership obligation. Shared paps consume one
+function root and all supplied shared argument roots; every successful
+partial, saturated, or over-applied `applyGo` returns one shared root while
+preserving the unrelated continuation. Constructing this contract from all
+lowered declarations and pap producers is the callable half of the eventual
+whole-program compiler theorem. -/
+structure ApplyOwnershipContract (ctx : Ctx) : Prop where
+  preserves : ∀ {fuel : Nat} {store store' : Store} {function : RVal}
+      {args : List RVal} {value : RVal} {rest : List Root},
+    RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+    applyGo ctx fuel store function args = .ok (store', value) →
+    RootOwnership store' (⟨.shared, value⟩ :: rest)
+
+/-- Exact ownership preservation for `applyGo` at one evaluator-fuel index. -/
+def ApplyOwnershipPreservesAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  ∀ {store store' : Store} {function : RVal} {args : List RVal}
+      {value : RVal} {rest : List Root},
+    RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+    applyGo ctx fuel store function args = .ok (store', value) →
+    RootOwnership store' (⟨.shared, value⟩ :: rest)
+
+/-- Ownership preservation for one evaluator-fuel index and one fixed input
+heap. Reachability-sensitive simulations use this boundary when their
+compiler contract is valid on certified heap images rather than arbitrary
+synthetic heaps. -/
+def ApplyOwnershipPreservesFrom (ctx : Ctx) (fuel : Nat)
+    (store : Store) : Prop :=
+  ∀ {store' : Store} {function : RVal} {args : List RVal}
+      {value : RVal} {rest : List Root},
+    RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest) →
+    applyGo ctx fuel store function args = .ok (store', value) →
+    RootOwnership store' (⟨.shared, value⟩ :: rest)
+
+/-- A whole-context application contract specializes to every fixed input
+heap. -/
+theorem ApplyOwnershipContract.preservesFrom {ctx : Ctx}
+    (contract : ApplyOwnershipContract ctx) (fuel : Nat) (store : Store) :
+    ApplyOwnershipPreservesFrom ctx fuel store := by
+  intro store' function args value rest ownership run
+  exact contract.preserves ownership run
+
+/-- Higher-order application ownership restricted to indices below
+`limit`. Saturating and over-applied paps invoke declarations at smaller
+fuel, so this contract belongs in the same mutual fuel induction. -/
+structure ApplyOwnershipContractBelow (ctx : Ctx) (limit : Nat) : Prop where
+  preserves : ∀ {fuel : Nat}, fuel < limit →
+    ApplyOwnershipPreservesAt ctx fuel
+
+/-- Every function declaration marked safe for shared PAP entry has an
+all-shared signature and preserves ownership below the supplied evaluator-fuel
+bound. Externs need no stored contract because their successful ABI is
+scalar-only. -/
+structure PapSafeDeclContractsBelow (ctx : Ctx) (limit : Nat) : Prop where
+  fn : ∀ {address d}, ctx.decls address = some (.fn d) →
+    d.papSafe = true →
+    d.result = .shared ∧
+      FnOwnershipContractBelow ctx d
+        (List.replicate d.arity .shared) limit
+
+/-- Unbounded ownership contracts for every PAP-safe function declaration in
+a target context. -/
+structure PapSafeDeclContracts (ctx : Ctx) : Prop where
+  fn : ∀ {address d}, ctx.decls address = some (.fn d) →
+    d.papSafe = true →
+    d.result = .shared ∧
+      FnOwnershipContract ctx d (List.replicate d.arity .shared)
+
+/-- Restrict a completed application contract to a fuel prefix. -/
+theorem ApplyOwnershipContract.below {ctx : Ctx}
+    (hcontract : ApplyOwnershipContract ctx) (limit : Nat) :
+    ApplyOwnershipContractBelow ctx limit := by
+  refine ⟨?_⟩
+  intro fuel _
+  exact hcontract.preserves
+
+/-- Fuel-prefix application contracts are contravariant in the bound. -/
+theorem ApplyOwnershipContractBelow.mono {ctx : Ctx}
+    {smaller larger : Nat}
+    (hcontract : ApplyOwnershipContractBelow ctx larger)
+    (hbound : smaller ≤ larger) :
+    ApplyOwnershipContractBelow ctx smaller := by
+  refine ⟨?_⟩
+  intro fuel hfuel
+  exact hcontract.preserves (Nat.lt_of_lt_of_le hfuel hbound)
+
+theorem PapSafeDeclContractsBelow.mono {ctx : Ctx}
+    {smaller larger : Nat}
+    (hdecls : PapSafeDeclContractsBelow ctx larger)
+    (hbound : smaller ≤ larger) :
+    PapSafeDeclContractsBelow ctx smaller := by
+  refine ⟨?_⟩
+  intro address d hdecl hpapsafe
+  obtain ⟨hresult, hcontract⟩ := hdecls.fn hdecl hpapsafe
+  exact ⟨hresult, hcontract.mono hbound⟩
+
+theorem PapSafeDeclContracts.below {ctx : Ctx}
+    (hdecls : PapSafeDeclContracts ctx) (limit : Nat) :
+    PapSafeDeclContractsBelow ctx limit := by
+  refine ⟨?_⟩
+  intro address d hdecl hpapsafe
+  obtain ⟨hresult, hcontract⟩ := hdecls.fn hdecl hpapsafe
+  exact ⟨hresult, hcontract.below limit⟩
+
+/-- Seal a contractive exact-fuel application proof into the public
+unbounded `ApplyOwnershipContract`. -/
+theorem applyOwnershipContract_of_below_step {ctx : Ctx}
+    (hstep : ∀ limit,
+      ApplyOwnershipContractBelow ctx limit →
+      ApplyOwnershipPreservesAt ctx limit) :
+    ApplyOwnershipContract ctx := by
+  refine ⟨?_⟩
+  intro fuel store store' function args value rest hown hrun
+  have hall : ∀ index, ApplyOwnershipPreservesAt ctx index := by
+    intro index
+    induction index using Nat.strongRecOn with
+    | ind index ih =>
+      apply hstep index
+      refine ⟨?_⟩
+      intro prior hprior
+      exact ih prior hprior
+  exact hall fuel hown hrun
+
+@[simp] theorem filterMap_rootLocation?_rootsFor (world : Owned)
+    (values : List RVal) :
+    (rootsFor world values).filterMap rootLocation? =
+      values.filterMap rvalLocation? := by
+  rw [rootsFor, List.filterMap_map]
+  have hfun :
+      (rootLocation? ∘ fun value => (Root.mk world value)) =
+        rvalLocation? := by
+    funext value
+    cases value <;> rfl
+  rw [hfun]
+
+theorem RootOwnership.incoming_eq_zero_of_dead {store : Store}
+    {roots : List Root} (h : RootOwnership store roots) {loc : Nat}
+    (hdead : store.get? loc = none) : incoming store roots loc = 0 := by
+  rw [incoming, List.count_eq_zero]
+  intro hmem
+  rcases List.mem_append.mp hmem with hroot | hedge
+  · rw [List.mem_filterMap] at hroot
+    obtain ⟨root, hroot, hloc⟩ := hroot
+    have hworld := h.roots_world root hroot
+    cases root with
+    | mk world value =>
+      cases value with
+      | loc rootLoc =>
+        simp [rootLocation?, rvalLocation?] at hloc
+        subst rootLoc
+        obtain ⟨box, hlive, _⟩ := hworld
+        rw [hdead] at hlive
+        contradiction
+      | lit l => simp [rootLocation?, rvalLocation?] at hloc
+      | erased => simp [rootLocation?, rvalLocation?] at hloc
+  · rw [edgeLocations, List.mem_flatMap] at hedge
+    obtain ⟨slot, hslot, hedge⟩ := hedge
+    cases slot with
+    | none => simp [slotEdgeLocations] at hedge
+    | some parentBox =>
+      have harray : some parentBox ∈ store.nodes := by simpa using hslot
+      obtain ⟨parentLoc, hparentArray⟩ :=
+        (Array.mem_iff_getElem?).mp harray
+      have hparent : store.get? parentLoc = some parentBox := by
+        rw [Store.get?, hparentArray]
+        rfl
+      change loc ∈ (nodeChildren parentBox.node).filterMap rvalLocation?
+        at hedge
+      rw [List.mem_filterMap] at hedge
+      obtain ⟨child, hchild, hloc⟩ := hedge
+      have hworld := h.edges_world hparent child hchild
+      cases child with
+      | loc childLoc =>
+        simp [rvalLocation?] at hloc
+        subst childLoc
+        obtain ⟨box, hlive, _⟩ := hworld
+        rw [hdead] at hlive
+        contradiction
+      | lit l => simp [rvalLocation?] at hloc
+      | erased => simp [rvalLocation?] at hloc
+
+/-! ## Location renaming -/
+
+/-- Runtime values agree modulo a location relation. -/
+inductive RValIso (locRel : Nat → Nat → Prop) : RVal → RVal → Prop where
+  | loc {left right : Nat} : locRel left right →
+      RValIso locRel (.loc left) (.loc right)
+  | lit {l : Literal} : RValIso locRel (.lit l) (.lit l)
+  | erased : RValIso locRel .erased .erased
+
+/-- Pointwise runtime-value isomorphism. -/
+inductive RValsIso (locRel : Nat → Nat → Prop) :
+    List RVal → List RVal → Prop where
+  | nil : RValsIso locRel [] []
+  | cons {left right : RVal} {lefts rights : List RVal} :
+      RValIso locRel left right →
+      RValsIso locRel lefts rights →
+      RValsIso locRel (left :: lefts) (right :: rights)
+
+/-- Heap nodes agree in identity/arity and pointwise modulo locations. -/
+inductive NodeIso (locRel : Nat → Nat → Prop) : Node → Node → Prop where
+  | ctor {cid : CtorId} {left right : Array RVal} :
+      RValsIso locRel left.toList right.toList →
+      NodeIso locRel (.ctorN cid left) (.ctorN cid right)
+  | pap {f : Address} {arity : Nat} {left right : Array RVal} :
+      RValsIso locRel left.toList right.toList →
+      NodeIso locRel (.papN f arity left) (.papN f arity right)
+
+/-- Live boxes agree semantically. Refcounts are semantic ownership state;
+cost counters are not. -/
+structure NodeBoxIso (locRel : Nat → Nat → Prop)
+    (left right : NodeBox) : Prop where
+  world : left.world = right.world
+  rc : left.rc = right.rc
+  node : NodeIso locRel left.node right.node
+
+/-- A finite partial bijection covering exactly the live locations of two
+heaps. The relation itself is finite because both stores have finite arrays;
+`related_live` forbids mappings outside their live supports. -/
+structure HeapIso (left right : Store) where
+  locRel : Nat → Nat → Prop
+  left_unique : ∀ {l r₁ r₂}, locRel l r₁ → locRel l r₂ → r₁ = r₂
+  right_unique : ∀ {l₁ l₂ r}, locRel l₁ r → locRel l₂ r → l₁ = l₂
+  left_total : ∀ {loc box}, left.get? loc = some box →
+    ∃ rightLoc, locRel loc rightLoc
+  right_total : ∀ {loc box}, right.get? loc = some box →
+    ∃ leftLoc, locRel leftLoc loc
+  related_live : ∀ {leftLoc rightLoc}, locRel leftLoc rightLoc →
+    ∃ leftBox rightBox,
+      left.get? leftLoc = some leftBox ∧
+      right.get? rightLoc = some rightBox ∧
+      NodeBoxIso locRel leftBox rightBox
+
+namespace RValIso
+
+theorem eq_of_location_eq {left right : RVal}
+    (h : RValIso (fun l r => l = r) left right) : left = right := by
+  cases h with
+  | loc related => cases related; rfl
+  | lit => rfl
+  | erased => rfl
+
+theorem mono {r₁ r₂ : Nat → Nat → Prop}
+    (hmono : ∀ {l r}, r₁ l r → r₂ l r) {v₁ v₂ : RVal}
+    (h : RValIso r₁ v₁ v₂) : RValIso r₂ v₁ v₂ := by
+  cases h with
+  | loc h => exact .loc (hmono h)
+  | lit => exact .lit
+  | erased => exact .erased
+
+theorem refl (v : RVal) : RValIso (fun l r => l = r) v v := by
+  cases v with
+  | loc l => exact .loc rfl
+  | lit l => exact .lit
+  | erased => exact .erased
+
+theorem symm {r : Nat → Nat → Prop} {v₁ v₂ : RVal}
+    (h : RValIso r v₁ v₂) : RValIso (fun x y => r y x) v₂ v₁ := by
+  cases h with
+  | loc h => exact .loc h
+  | lit => exact .lit
+  | erased => exact .erased
+
+theorem trans {r₁ r₂ : Nat → Nat → Prop} {v₁ v₂ v₃ : RVal}
+    (h₁ : RValIso r₁ v₁ v₂) (h₂ : RValIso r₂ v₂ v₃) :
+    RValIso (fun x z => ∃ y, r₁ x y ∧ r₂ y z) v₁ v₃ := by
+  cases h₁ <;> cases h₂
+  · exact .loc ⟨_, ‹_›, ‹_›⟩
+  · exact .lit
+  · exact .erased
+
+end RValIso
+
+/-- Every runtime value vector is related to itself by location equality. -/
+theorem RValsIso.refl : ∀ values : List RVal,
+    RValsIso (fun l r => l = r) values values
+  | [] => .nil
+  | v :: rest => .cons (RValIso.refl v) (RValsIso.refl rest)
+
+theorem RValsIso.eq_of_location_eq {left right : List RVal}
+    (h : RValsIso (fun l r => l = r) left right) : left = right := by
+  induction h with
+  | nil => rfl
+  | cons head tail ih =>
+      rw [head.eq_of_location_eq, ih]
+
+private theorem rvalsIso_symm {r : Nat → Nat → Prop} :
+    ∀ {left right : List RVal}, RValsIso r left right →
+      RValsIso (fun x y => r y x) right left
+  | _, _, .nil => .nil
+  | _, _, .cons hv hvs => .cons hv.symm (rvalsIso_symm hvs)
+
+private theorem rvalsIso_mono {r₁ r₂ : Nat → Nat → Prop}
+    (hmono : ∀ {l r}, r₁ l r → r₂ l r) :
+    ∀ {left right : List RVal}, RValsIso r₁ left right →
+      RValsIso r₂ left right
+  | _, _, .nil => .nil
+  | _, _, .cons hv hvs =>
+    .cons (hv.mono hmono) (rvalsIso_mono hmono hvs)
+
+private theorem rvalsIso_trans {r₁ r₂ : Nat → Nat → Prop} :
+    ∀ {left middle right : List RVal},
+      RValsIso r₁ left middle → RValsIso r₂ middle right →
+      RValsIso (fun x z => ∃ y, r₁ x y ∧ r₂ y z) left right
+  | _, _, _, .nil, .nil => .nil
+  | _, _, _, .cons h₁ hs₁, .cons h₂ hs₂ =>
+    .cons (h₁.trans h₂) (rvalsIso_trans hs₁ hs₂)
+
+namespace NodeIso
+
+theorem mono {r₁ r₂ : Nat → Nat → Prop}
+    (hmono : ∀ {l r}, r₁ l r → r₂ l r) {left right : Node}
+    (h : NodeIso r₁ left right) : NodeIso r₂ left right := by
+  cases h with
+  | ctor h => exact .ctor (rvalsIso_mono hmono h)
+  | pap h => exact .pap (rvalsIso_mono hmono h)
+
+theorem refl (node : Node) : NodeIso (fun l r => l = r) node node := by
+  cases node with
+  | ctorN cid fields => exact .ctor (RValsIso.refl fields.toList)
+  | papN f arity args => exact .pap (RValsIso.refl args.toList)
+
+theorem symm {r : Nat → Nat → Prop} {left right : Node}
+    (h : NodeIso r left right) : NodeIso (fun x y => r y x) right left := by
+  cases h with
+  | ctor h => exact .ctor (rvalsIso_symm h)
+  | pap h => exact .pap (rvalsIso_symm h)
+
+theorem trans {r₁ r₂ : Nat → Nat → Prop} {left middle right : Node}
+    (h₁ : NodeIso r₁ left middle) (h₂ : NodeIso r₂ middle right) :
+    NodeIso (fun x z => ∃ y, r₁ x y ∧ r₂ y z) left right := by
+  cases h₁ <;> cases h₂
+  · exact .ctor (rvalsIso_trans ‹_› ‹_›)
+  · exact .pap (rvalsIso_trans ‹_› ‹_›)
+
+end NodeIso
+
+namespace NodeBoxIso
+
+theorem mono {r₁ r₂ : Nat → Nat → Prop}
+    (hmono : ∀ {l r}, r₁ l r → r₂ l r)
+    {left right : NodeBox} (h : NodeBoxIso r₁ left right) :
+    NodeBoxIso r₂ left right :=
+  ⟨h.world, h.rc, h.node.mono hmono⟩
+
+theorem refl (box : NodeBox) :
+    NodeBoxIso (fun l r => l = r) box box :=
+  ⟨rfl, rfl, NodeIso.refl box.node⟩
+
+theorem symm {r : Nat → Nat → Prop} {left right : NodeBox}
+    (h : NodeBoxIso r left right) :
+    NodeBoxIso (fun x y => r y x) right left :=
+  ⟨h.world.symm, h.rc.symm, h.node.symm⟩
+
+theorem trans {r₁ r₂ : Nat → Nat → Prop}
+    {left middle right : NodeBox} (h₁ : NodeBoxIso r₁ left middle)
+    (h₂ : NodeBoxIso r₂ middle right) :
+    NodeBoxIso (fun x z => ∃ y, r₁ x y ∧ r₂ y z) left right :=
+  ⟨h₁.world.trans h₂.world, h₁.rc.trans h₂.rc, h₁.node.trans h₂.node⟩
+
+end NodeBoxIso
+
+private def liveEq (store : Store) (left right : Nat) : Prop :=
+  left = right ∧ ∃ box, store.get? left = some box
+
+private theorem rvalIso_live_refl (store : Store) {v : RVal}
+    (h : LiveRVal store v) : RValIso (liveEq store) v v := by
+  cases v with
+  | loc loc => exact .loc ⟨rfl, h⟩
+  | lit l => exact .lit
+  | erased => exact .erased
+
+private theorem rvalsIso_live_refl (store : Store) :
+    ∀ {values : List RVal},
+      (∀ v ∈ values, LiveRVal store v) →
+      RValsIso (liveEq store) values values
+  | [], _ => .nil
+  | v :: rest, h =>
+    .cons (rvalIso_live_refl store (h v (by simp)))
+      (rvalsIso_live_refl store (fun x hx => h x (by simp [hx])))
+
+private theorem nodeBoxIso_live_refl {store : Store} (closed : StoreClosed store)
+    {loc : Nat} {box : NodeBox} (hbox : store.get? loc = some box) :
+    NodeBoxIso (liveEq store) box box := by
+  refine ⟨rfl, rfl, ?_⟩
+  cases hnode : box.node with
+  | ctorN cid fields =>
+    exact .ctor (rvalsIso_live_refl store
+      (fun v hv => closed hbox v (by simpa [nodeChildren, hnode] using hv)))
+  | papN f arity args =>
+    exact .pap (rvalsIso_live_refl store
+      (fun v hv => closed hbox v (by simpa [nodeChildren, hnode] using hv)))
+
+namespace HeapIso
+
+@[simp] theorem get?_fresh (store : Store) :
+    store.get? store.nodes.size = none := by
+  simp [Store.get?]
+
+@[simp] theorem get?_allocNode_new (store : Store) (world : Owned)
+    (node : Node) :
+    (store.allocNode world node).1.get? (store.allocNode world node).2 =
+      some ⟨world, 1, node⟩ := by
+  simp [Store.allocNode, Store.get?]
+
+theorem get?_allocNode_old {store : Store} {world : Owned} {node : Node}
+    {loc : Nat} {box : NodeBox} (h : store.get? loc = some box) :
+    (store.allocNode world node).1.get? loc = some box := by
+  have hne : loc ≠ store.nodes.size := by
+    intro heq
+    subst loc
+    rw [get?_fresh] at h
+    contradiction
+  simpa [Store.allocNode, Store.get?, Array.getElem?_push, hne] using h
+
+theorem get?_of_allocNode_old {store : Store} {world : Owned} {node : Node}
+    {loc : Nat} {box : NodeBox} (hne : loc ≠ store.nodes.size)
+    (h : (store.allocNode world node).1.get? loc = some box) :
+    store.get? loc = some box := by
+  simpa [Store.allocNode, Store.get?, Array.getElem?_push, hne] using h
+
+/-- Every heap is isomorphic to itself on live locations. -/
+def refl (store : Store) (closed : StoreClosed store) : HeapIso store store where
+  locRel := liveEq store
+  left_unique h₁ h₂ := h₁.1.symm.trans h₂.1
+  right_unique h₁ h₂ := h₁.1.trans h₂.1.symm
+  left_total := by intro loc box h; exact ⟨loc, rfl, box, h⟩
+  right_total := by intro loc box h; exact ⟨loc, rfl, box, h⟩
+  related_live := by
+    intro leftLoc rightLoc h
+    obtain ⟨rfl, box, hbox⟩ := h
+    exact ⟨box, box, hbox, hbox, nodeBoxIso_live_refl closed hbox⟩
+
+/-- Heap isomorphism is symmetric. -/
+def symm {left right : Store} (iso : HeapIso left right) :
+    HeapIso right left where
+  locRel := fun r l => iso.locRel l r
+  left_unique := iso.right_unique
+  right_unique := iso.left_unique
+  left_total := iso.right_total
+  right_total := iso.left_total
+  related_live := by
+    intro rightLoc leftLoc h
+    obtain ⟨leftBox, rightBox, hl, hr, hb⟩ := iso.related_live h
+    exact ⟨rightBox, leftBox, hr, hl, hb.symm⟩
+
+/-- Composition of finite live-location bijections. -/
+def trans {left middle right : Store} (first : HeapIso left middle)
+    (second : HeapIso middle right) : HeapIso left right where
+  locRel := fun l r => ∃ m, first.locRel l m ∧ second.locRel m r
+  left_unique := by
+    intro l r₁ r₂ h₁ h₂
+    obtain ⟨m₁, hl₁, hr₁⟩ := h₁
+    obtain ⟨m₂, hl₂, hr₂⟩ := h₂
+    have hm : m₁ = m₂ := first.left_unique hl₁ hl₂
+    subst m₂
+    exact second.left_unique hr₁ hr₂
+  right_unique := by
+    intro l₁ l₂ r h₁ h₂
+    obtain ⟨m₁, hl₁, hr₁⟩ := h₁
+    obtain ⟨m₂, hl₂, hr₂⟩ := h₂
+    have hm : m₁ = m₂ := second.right_unique hr₁ hr₂
+    subst m₂
+    exact first.right_unique hl₁ hl₂
+  left_total := by
+    intro loc box hbox
+    obtain ⟨mid, hmid⟩ := first.left_total hbox
+    obtain ⟨leftBox, midBox, _, hmidLive, _⟩ :=
+      first.related_live hmid
+    obtain ⟨rightLoc, hright⟩ := second.left_total hmidLive
+    exact ⟨rightLoc, mid, hmid, hright⟩
+  right_total := by
+    intro loc box hbox
+    obtain ⟨mid, hmid⟩ := second.right_total hbox
+    obtain ⟨midBox, rightBox, hmidLive, _, _⟩ :=
+      second.related_live hmid
+    obtain ⟨leftLoc, hleft⟩ := first.right_total hmidLive
+    exact ⟨leftLoc, mid, hleft, hmid⟩
+  related_live := by
+    intro leftLoc rightLoc hrel
+    obtain ⟨midLoc, hleftRel, hrightRel⟩ := hrel
+    obtain ⟨leftBox, midBox₁, hleft, hmid₁, hbox₁⟩ :=
+      first.related_live hleftRel
+    obtain ⟨midBox₂, rightBox, hmid₂, hright, hbox₂⟩ :=
+      second.related_live hrightRel
+    have hm : midBox₁ = midBox₂ := Option.some.inj (hmid₁.symm.trans hmid₂)
+    subst midBox₂
+    exact ⟨leftBox, rightBox, hleft, hright, hbox₁.trans hbox₂⟩
+
+/-- Corresponding allocations extend the finite live-location bijection with
+the two fresh append locations. -/
+def alloc {left right : Store} (iso : HeapIso left right)
+    {world : Owned} {leftNode rightNode : Node}
+    (hnode : NodeIso iso.locRel leftNode rightNode) :
+    HeapIso (left.allocNode world leftNode).1
+      (right.allocNode world rightNode).1 := by
+  let leftLoc := left.nodes.size
+  let rightLoc := right.nodes.size
+  let extended : Nat → Nat → Prop := fun l r =>
+    (l = leftLoc ∧ r = rightLoc) ∨ iso.locRel l r
+  have leftFresh : ∀ r, ¬ iso.locRel leftLoc r := by
+    intro r hrel
+    obtain ⟨leftBox, rightBox, hl, _, _⟩ := iso.related_live hrel
+    have : left.get? leftLoc = none := by
+      simp [leftLoc]
+    rw [this] at hl
+    contradiction
+  have rightFresh : ∀ l, ¬ iso.locRel l rightLoc := by
+    intro l hrel
+    obtain ⟨leftBox, rightBox, _, hr, _⟩ := iso.related_live hrel
+    have : right.get? rightLoc = none := by
+      simp [rightLoc]
+    rw [this] at hr
+    contradiction
+  refine
+    { locRel := extended
+      left_unique := ?_
+      right_unique := ?_
+      left_total := ?_
+      right_total := ?_
+      related_live := ?_ }
+  · intro l r₁ r₂ h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.2.trans h₂.2.symm
+    · rw [h₁.1] at h₂
+      exact False.elim (leftFresh r₂ h₂)
+    · rw [h₂.1] at h₁
+      exact False.elim (leftFresh r₁ h₁)
+    · exact iso.left_unique h₁ h₂
+  · intro l₁ l₂ r h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.1.trans h₂.1.symm
+    · rw [h₁.2] at h₂
+      exact False.elim (rightFresh l₂ h₂)
+    · rw [h₂.2] at h₁
+      exact False.elim (rightFresh l₁ h₁)
+    · exact iso.right_unique h₁ h₂
+  · intro loc box hbox
+    by_cases hnew : loc = leftLoc
+    · exact ⟨rightLoc, .inl ⟨hnew, rfl⟩⟩
+    · have hold : left.get? loc = some box := by
+        apply get?_of_allocNode_old (by simpa [leftLoc] using hnew) hbox
+      obtain ⟨r, hr⟩ := iso.left_total hold
+      exact ⟨r, .inr hr⟩
+  · intro loc box hbox
+    by_cases hnew : loc = rightLoc
+    · exact ⟨leftLoc, .inl ⟨rfl, hnew⟩⟩
+    · have hold : right.get? loc = some box := by
+        apply get?_of_allocNode_old (by simpa [rightLoc] using hnew) hbox
+      obtain ⟨l, hl⟩ := iso.right_total hold
+      exact ⟨l, .inr hl⟩
+  · intro l r hrel
+    rcases hrel with hnew | hold
+    · obtain ⟨rfl, rfl⟩ := hnew
+      refine ⟨⟨world, 1, leftNode⟩, ⟨world, 1, rightNode⟩, ?_, ?_, ?_⟩
+      · exact get?_allocNode_new left world leftNode
+      · exact get?_allocNode_new right world rightNode
+      · exact ⟨rfl, rfl, hnode.mono (fun h => .inr h)⟩
+    · obtain ⟨leftBox, rightBox, hl, hr, hb⟩ := iso.related_live hold
+      refine ⟨leftBox, rightBox, get?_allocNode_old hl,
+        get?_allocNode_old hr, hb.mono (fun h => .inr h)⟩
+
+end HeapIso
+
+/-! ## Exact ownership under heap isomorphism -/
+
+private theorem sum_map_eq_of_bijective_rel
+    {α β : Type} (rel : α → β → Prop) (leftValue : α → Nat)
+    (rightValue : β → Nat) :
+    ∀ (left : List α) (right : List β),
+      left.Nodup → right.Nodup →
+      (∀ x ∈ left, ∃ y ∈ right, rel x y) →
+      (∀ y ∈ right, ∃ x ∈ left, rel x y) →
+      (∀ {x y₁ y₂}, rel x y₁ → rel x y₂ → y₁ = y₂) →
+      (∀ {x₁ x₂ y}, rel x₁ y → rel x₂ y → x₁ = x₂) →
+      (∀ {x y}, rel x y → leftValue x = rightValue y) →
+      (left.map leftValue).sum = (right.map rightValue).sum := by
+  intro left
+  induction left with
+  | nil =>
+      intro right _ _ _ rightTotal _ _ _
+      cases right with
+      | nil => rfl
+      | cons y ys =>
+          obtain ⟨x, member, _⟩ := rightTotal y (by simp)
+          simp at member
+  | cons x xs ih =>
+      intro right leftNodup rightNodup leftTotal rightTotal
+        leftFunctional rightFunctional values
+      have xNotMem : x ∉ xs := (List.nodup_cons.mp leftNodup).1
+      have xsNodup : xs.Nodup := (List.nodup_cons.mp leftNodup).2
+      obtain ⟨y, yMember, related⟩ := leftTotal x (by simp)
+      obtain ⟨before, after, rightEq⟩ := List.mem_iff_append.mp yMember
+      subst right
+      let rightRest := before ++ after
+      have rearranged : (before ++ y :: after).Perm (y :: rightRest) := by
+        exact List.perm_middle
+      have rearrangedNodup : (y :: rightRest).Nodup :=
+        rearranged.nodup rightNodup
+      have yNotMem : y ∉ rightRest :=
+        (List.nodup_cons.mp rearrangedNodup).1
+      have rightRestNodup : rightRest.Nodup :=
+        (List.nodup_cons.mp rearrangedNodup).2
+      have tailLeftTotal : ∀ candidate ∈ xs,
+          ∃ target ∈ rightRest, rel candidate target := by
+        intro candidate candidateMember
+        obtain ⟨target, targetMember, candidateRelated⟩ :=
+          leftTotal candidate (by simp [candidateMember])
+        have targetNe : target ≠ y := by
+          intro equal
+          subst target
+          have candidateEq : candidate = x :=
+            rightFunctional candidateRelated related
+          subst candidate
+          exact xNotMem candidateMember
+        refine ⟨target, ?_, candidateRelated⟩
+        change target ∈ before ++ after
+        rw [List.mem_append]
+        simp only [List.mem_append, List.mem_cons] at targetMember
+        rcases targetMember with inBefore | targetMember
+        · exact Or.inl inBefore
+        · rcases targetMember with equal | inAfter
+          · exact False.elim (targetNe equal)
+          · exact Or.inr inAfter
+      have tailRightTotal : ∀ target ∈ rightRest,
+          ∃ candidate ∈ xs, rel candidate target := by
+        intro target targetMember
+        have targetMemberOriginal : target ∈ before ++ y :: after := by
+          change target ∈ before ++ after at targetMember
+          rw [List.mem_append] at targetMember
+          rcases targetMember with inBefore | inAfter
+          · exact List.mem_append.mpr (Or.inl inBefore)
+          · exact List.mem_append.mpr
+              (Or.inr (List.mem_cons.mpr (Or.inr inAfter)))
+        obtain ⟨candidate, candidateMember, candidateRelated⟩ :=
+          rightTotal target targetMemberOriginal
+        have candidateNe : candidate ≠ x := by
+          intro equal
+          subst candidate
+          have targetEq : target = y :=
+            leftFunctional candidateRelated related
+          subst target
+          exact yNotMem targetMember
+        refine ⟨candidate, ?_, candidateRelated⟩
+        exact List.mem_of_ne_of_mem candidateNe candidateMember
+      have tailSums := ih rightRest xsNodup rightRestNodup tailLeftTotal
+        tailRightTotal leftFunctional rightFunctional values
+      simp only [List.map_cons, List.sum_cons]
+      rw [values related, tailSums]
+      simp [rightRest, List.map_append, List.sum_append, Nat.add_left_comm]
+
+private def indexedBoxes : List (Option NodeBox) → Nat →
+    List (Nat × NodeBox)
+  | [], _ => []
+  | none :: rest, start => indexedBoxes rest (start + 1)
+  | some box :: rest, start =>
+      (start, box) :: indexedBoxes rest (start + 1)
+
+private theorem indexedBoxes_eq_zipIdx_filterMap
+    (entries : List (Option NodeBox)) (start : Nat) :
+    indexedBoxes entries start =
+      (entries.zipIdx start).filterMap fun (slot, location) =>
+        slot.map fun box => (location, box) := by
+  induction entries generalizing start with
+  | nil => rfl
+  | cons head tail ih =>
+      cases head <;> simp [indexedBoxes, ih]
+
+private def liveBoxes (store : Store) : List (Nat × NodeBox) :=
+  indexedBoxes store.nodes.toList 0
+
+private theorem mem_liveBoxes_iff {store : Store} {location : Nat}
+    {box : NodeBox} :
+    (location, box) ∈ liveBoxes store ↔ store.get? location = some box := by
+  constructor
+  · intro member
+    rw [liveBoxes, indexedBoxes_eq_zipIdx_filterMap,
+      List.mem_filterMap] at member
+    obtain ⟨entry, entryMember, mapped⟩ := member
+    rcases entry with ⟨slot, index⟩
+    cases slot with
+    | none => simp at mapped
+    | some entryBox =>
+        simp only [Option.map_some, Option.some.injEq, Prod.mk.injEq] at mapped
+        obtain ⟨locationEq, boxEq⟩ := mapped
+        subst index
+        subst entryBox
+        have indexed := List.mem_zipIdx entryMember
+        obtain ⟨_lower, upper, slotEq⟩ := indexed
+        have listAt : store.nodes.toList[location]? = some (some box) := by
+          rw [List.getElem?_eq_getElem (by simpa using upper)]
+          exact congrArg some slotEq.symm
+        have arrayAt : store.nodes[location]? = some (some box) := by
+          simpa using listAt
+        simp [Store.get?, arrayAt]
+  · intro found
+    have arrayAt : store.nodes[location]? = some (some box) := by
+      cases slot : store.nodes[location]? with
+      | none => simp [Store.get?, slot] at found
+      | some entry =>
+          cases entry with
+          | none => simp [Store.get?, slot] at found
+          | some entryBox =>
+              have boxEq : entryBox = box := by
+                simpa [Store.get?, slot] using found
+              subst entryBox
+              rfl
+    have listAt : store.nodes.toList[location]? = some (some box) := by
+      simpa using arrayAt
+    have zippedAt : store.nodes.toList.zipIdx[location]? =
+        some (some box, location) := by
+      rw [List.getElem?_zipIdx]
+      simpa using listAt
+    have zippedMember : (some box, location) ∈
+        store.nodes.toList.zipIdx := List.mem_of_getElem? zippedAt
+    rw [liveBoxes, indexedBoxes_eq_zipIdx_filterMap,
+      List.mem_filterMap]
+    exact ⟨(some box, location), zippedMember, by simp⟩
+
+private theorem indexedBoxes_location_ge
+    {entries : List (Option NodeBox)} {start location : Nat}
+    {box : NodeBox} (member : (location, box) ∈ indexedBoxes entries start) :
+    start ≤ location := by
+  induction entries generalizing start with
+  | nil => simp [indexedBoxes] at member
+  | cons head tail ih =>
+      cases head with
+      | none =>
+          exact Nat.le_trans (Nat.le_add_right start 1)
+            (ih (start := start + 1) member)
+      | some headBox =>
+          simp only [indexedBoxes, List.mem_cons] at member
+          rcases member with equal | member
+          · exact Nat.le_of_eq (congrArg Prod.fst equal).symm
+          · exact Nat.le_trans (Nat.le_add_right start 1)
+              (ih (start := start + 1) member)
+
+private theorem indexedBoxes_nodup (entries : List (Option NodeBox)) :
+    ∀ start, (indexedBoxes entries start).Nodup := by
+  induction entries with
+  | nil => simp [indexedBoxes]
+  | cons head tail ih =>
+      intro start
+      cases head with
+      | none => exact ih (start + 1)
+      | some box =>
+          rw [indexedBoxes, List.nodup_cons]
+          refine ⟨?_, ih (start + 1)⟩
+          intro member
+          have bound := indexedBoxes_location_ge member
+          omega
+
+private theorem liveBoxes_nodup (store : Store) :
+    (liveBoxes store).Nodup := by
+  exact indexedBoxes_nodup store.nodes.toList 0
+
+private def boxEdgeCount (needle : Nat) (entry : Nat × NodeBox) : Nat :=
+  ((nodeChildren entry.2.node).filterMap rvalLocation?).count needle
+
+private theorem edgeCount_indexedBoxes
+    (entries : List (Option NodeBox)) (start needle : Nat) :
+    (entries.flatMap slotEdgeLocations).count needle =
+      ((indexedBoxes entries start).map (boxEdgeCount needle)).sum := by
+  induction entries generalizing start with
+  | nil => rfl
+  | cons head tail ih =>
+      cases head with
+      | none => simpa [indexedBoxes, slotEdgeLocations] using ih (start + 1)
+      | some box =>
+          simp [indexedBoxes, slotEdgeLocations, boxEdgeCount,
+            List.count_append, ih (start + 1)]
+
+private theorem edgeLocations_count_eq_liveBoxes_sum
+    (store : Store) (needle : Nat) :
+    (edgeLocations store).count needle =
+      ((liveBoxes store).map (boxEdgeCount needle)).sum := by
+  exact edgeCount_indexedBoxes store.nodes.toList 0 needle
+
+private theorem RValsIso.locationCount_eq
+    {left right : Store} (iso : HeapIso left right)
+    {leftLoc rightLoc : Nat} (locations : iso.locRel leftLoc rightLoc) :
+    ∀ {leftValues rightValues : List RVal},
+      RValsIso iso.locRel leftValues rightValues →
+      (leftValues.filterMap rvalLocation?).count leftLoc =
+        (rightValues.filterMap rvalLocation?).count rightLoc
+  | _, _, .nil => rfl
+  | _, _, .cons head tail => by
+      have tailEq := RValsIso.locationCount_eq iso locations tail
+      cases head with
+      | @loc headLeft headRight related =>
+          have iff : headLeft = leftLoc ↔ headRight = rightLoc := by
+            constructor
+            · intro equal
+              subst_vars
+              exact iso.left_unique related locations
+            · intro equal
+              subst_vars
+              exact iso.right_unique related locations
+          by_cases leftEqual : headLeft = leftLoc
+          · have rightEqual := iff.mp leftEqual
+            simp [rvalLocation?, leftEqual, rightEqual, tailEq]
+          · have rightNe : headRight ≠ rightLoc := fun rightEqual =>
+              leftEqual (iff.mpr rightEqual)
+            simp [rvalLocation?, leftEqual, rightNe, tailEq]
+      | lit => simpa [rvalLocation?, tailEq]
+      | erased => simpa [rvalLocation?, tailEq]
+
+private theorem NodeIso.edgeCount_eq
+    {left right : Store} (iso : HeapIso left right)
+    {leftLoc rightLoc : Nat} (locations : iso.locRel leftLoc rightLoc)
+    {leftNode rightNode : Node} (nodes : NodeIso iso.locRel leftNode rightNode) :
+    ((nodeChildren leftNode).filterMap rvalLocation?).count leftLoc =
+      ((nodeChildren rightNode).filterMap rvalLocation?).count rightLoc := by
+  cases nodes with
+  | ctor fields =>
+      exact RValsIso.locationCount_eq iso locations fields
+  | pap args =>
+      exact RValsIso.locationCount_eq iso locations args
+
+private def liveBoxRel {left right : Store} (iso : HeapIso left right)
+    (leftEntry rightEntry : Nat × NodeBox) : Prop :=
+  iso.locRel leftEntry.1 rightEntry.1 ∧
+    left.get? leftEntry.1 = some leftEntry.2 ∧
+    right.get? rightEntry.1 = some rightEntry.2
+
+private theorem HeapIso.edgeLocations_count_eq
+    {left right : Store} (iso : HeapIso left right)
+    {leftLoc rightLoc : Nat} (locations : iso.locRel leftLoc rightLoc) :
+    (edgeLocations left).count leftLoc =
+      (edgeLocations right).count rightLoc := by
+  rw [edgeLocations_count_eq_liveBoxes_sum,
+    edgeLocations_count_eq_liveBoxes_sum]
+  apply sum_map_eq_of_bijective_rel (liveBoxRel iso)
+    (boxEdgeCount leftLoc) (boxEdgeCount rightLoc)
+    (liveBoxes left) (liveBoxes right)
+  · exact liveBoxes_nodup left
+  · exact liveBoxes_nodup right
+  · intro leftEntry leftMember
+    rcases leftEntry with ⟨entryLoc, entryBox⟩
+    have leftLive := mem_liveBoxes_iff.mp leftMember
+    obtain ⟨rightEntryLoc, related⟩ := iso.left_total leftLive
+    obtain ⟨relatedLeftBox, rightEntryBox, relatedLeftLive,
+      rightLive, _⟩ := iso.related_live related
+    have leftBoxEq : relatedLeftBox = entryBox :=
+      Option.some.inj (relatedLeftLive.symm.trans leftLive)
+    subst relatedLeftBox
+    exact ⟨(rightEntryLoc, rightEntryBox),
+      mem_liveBoxes_iff.mpr rightLive, related, leftLive, rightLive⟩
+  · intro rightEntry rightMember
+    rcases rightEntry with ⟨entryLoc, entryBox⟩
+    have rightLive := mem_liveBoxes_iff.mp rightMember
+    obtain ⟨leftEntryLoc, related⟩ := iso.right_total rightLive
+    obtain ⟨leftEntryBox, relatedRightBox, leftLive,
+      relatedRightLive, _⟩ := iso.related_live related
+    have rightBoxEq : relatedRightBox = entryBox :=
+      Option.some.inj (relatedRightLive.symm.trans rightLive)
+    subst relatedRightBox
+    exact ⟨(leftEntryLoc, leftEntryBox),
+      mem_liveBoxes_iff.mpr leftLive, related, leftLive, rightLive⟩
+  · intro leftEntry rightEntry₁ rightEntry₂ first second
+    rcases leftEntry with ⟨leftEntryLoc, leftEntryBox⟩
+    rcases rightEntry₁ with ⟨rightEntryLoc₁, rightEntryBox₁⟩
+    rcases rightEntry₂ with ⟨rightEntryLoc₂, rightEntryBox₂⟩
+    have locationEq : rightEntryLoc₁ = rightEntryLoc₂ :=
+      iso.left_unique first.1 second.1
+    subst rightEntryLoc₂
+    have boxEq : rightEntryBox₁ = rightEntryBox₂ :=
+      Option.some.inj (first.2.2.symm.trans second.2.2)
+    subst rightEntryBox₂
+    rfl
+  · intro leftEntry₁ leftEntry₂ rightEntry first second
+    rcases leftEntry₁ with ⟨leftEntryLoc₁, leftEntryBox₁⟩
+    rcases leftEntry₂ with ⟨leftEntryLoc₂, leftEntryBox₂⟩
+    rcases rightEntry with ⟨rightEntryLoc, rightEntryBox⟩
+    have locationEq : leftEntryLoc₁ = leftEntryLoc₂ :=
+      iso.right_unique first.1 second.1
+    subst leftEntryLoc₂
+    have boxEq : leftEntryBox₁ = leftEntryBox₂ :=
+      Option.some.inj (first.2.1.symm.trans second.2.1)
+    subst leftEntryBox₂
+    rfl
+  · intro leftEntry rightEntry related
+    rcases leftEntry with ⟨leftEntryLoc, leftEntryBox⟩
+    rcases rightEntry with ⟨rightEntryLoc, rightEntryBox⟩
+    obtain ⟨relatedLeftBox, relatedRightBox, leftLive, rightLive,
+      boxes⟩ := iso.related_live related.1
+    have leftBoxEq : relatedLeftBox = leftEntryBox :=
+      Option.some.inj (leftLive.symm.trans related.2.1)
+    have rightBoxEq : relatedRightBox = rightEntryBox :=
+      Option.some.inj (rightLive.symm.trans related.2.2)
+    subst relatedLeftBox
+    subst relatedRightBox
+    exact boxes.node.edgeCount_eq iso locations
+
+/-- External roots agree in ownership world and runtime value modulo a
+location relation. -/
+structure RootIso (locRel : Nat → Nat → Prop) (left right : Root) : Prop where
+  world : left.world = right.world
+  value : RValIso locRel left.value right.value
+
+/-- Pointwise root-list agreement modulo a location relation. -/
+inductive RootsIso (locRel : Nat → Nat → Prop) :
+    List Root → List Root → Prop where
+  | nil : RootsIso locRel [] []
+  | cons {left right : Root} {lefts rights : List Root} :
+      RootIso locRel left right →
+      RootsIso locRel lefts rights →
+      RootsIso locRel (left :: lefts) (right :: rights)
+
+namespace RootIso
+
+theorem mono {first second : Nat → Nat → Prop}
+    (lift : ∀ {left right}, first left right → second left right)
+    {left right : Root} (root : RootIso first left right) :
+    RootIso second left right :=
+  ⟨root.world, root.value.mono lift⟩
+
+theorem symm {locRel : Nat → Nat → Prop} {left right : Root}
+    (root : RootIso locRel left right) :
+    RootIso (fun rightLoc leftLoc => locRel leftLoc rightLoc) right left :=
+  ⟨root.world.symm, root.value.symm⟩
+
+/-- A heap isomorphism determines at most one root preimage for a fixed
+target root. -/
+theorem left_eq_of_right {leftStore rightStore : Store}
+    (iso : HeapIso leftStore rightStore)
+    {left₁ left₂ right : Root}
+    (first : RootIso iso.locRel left₁ right)
+    (second : RootIso iso.locRel left₂ right) : left₁ = left₂ := by
+  rcases left₁ with ⟨leftWorld₁, leftValue₁⟩
+  rcases left₂ with ⟨leftWorld₂, leftValue₂⟩
+  rcases right with ⟨rightWorld, rightValue⟩
+  have worldEq : leftWorld₁ = leftWorld₂ :=
+    first.world.trans second.world.symm
+  subst leftWorld₂
+  congr 1
+  cases first.value with
+  | loc firstRelated =>
+      cases second.value with
+      | loc secondRelated =>
+          exact congrArg RVal.loc
+            (iso.right_unique firstRelated secondRelated)
+  | lit => cases second.value; rfl
+  | erased => cases second.value; rfl
+
+end RootIso
+
+namespace HeapIso
+
+/-- Heap-world evidence follows a related runtime value across a heap
+isomorphism. -/
+theorem hasWorld {left right : Store} (iso : HeapIso left right)
+    {leftValue rightValue : RVal}
+    (value : RValIso iso.locRel leftValue rightValue)
+    {world : Ix.Compiler.Ixon.Owned}
+    (hasWorld : HasWorld left world leftValue) :
+    HasWorld right world rightValue := by
+  cases value with
+  | loc related =>
+      obtain ⟨sourceBox, sourceLive, sourceWorld⟩ := hasWorld
+      obtain ⟨relatedSourceBox, targetBox, relatedSourceLive, targetLive,
+        boxes⟩ := iso.related_live related
+      have boxEq : sourceBox = relatedSourceBox :=
+        Option.some.inj (sourceLive.symm.trans relatedSourceLive)
+      subst sourceBox
+      exact ⟨targetBox, targetLive, boxes.world.symm.trans sourceWorld⟩
+  | lit => trivial
+  | erased => trivial
+
+end HeapIso
+
+namespace RootsIso
+
+theorem mono {first second : Nat → Nat → Prop}
+    (lift : ∀ {left right}, first left right → second left right) :
+    ∀ {left right : List Root}, RootsIso first left right →
+      RootsIso second left right
+  | _, _, .nil => .nil
+  | _, _, .cons head tail => .cons (head.mono lift) (tail.mono lift)
+
+theorem symm {locRel : Nat → Nat → Prop} :
+    ∀ {left right : List Root}, RootsIso locRel left right →
+      RootsIso (fun rightLoc leftLoc => locRel leftLoc rightLoc) right left
+  | _, _, .nil => .nil
+  | _, _, .cons head tail => .cons head.symm tail.symm
+
+/-- Homogeneous root framing preserves a pointwise runtime-value
+isomorphism. -/
+theorem rootsFor {locRel : Nat → Nat → Prop}
+    (world : Ix.Compiler.Ixon.Owned) :
+    ∀ {left right : List RVal}, RValsIso locRel left right →
+      RootsIso locRel (rootsFor world left) (rootsFor world right)
+  | _, _, .nil => .nil
+  | _, _, .cons head tail => .cons ⟨rfl, head⟩ (rootsFor world tail)
+
+/-- Pointwise root isomorphisms concatenate. -/
+theorem append {locRel : Nat → Nat → Prop}
+    {leftPrefix rightPrefix leftSuffix rightSuffix : List Root}
+    (first : RootsIso locRel leftPrefix rightPrefix)
+    (suffix : RootsIso locRel leftSuffix rightSuffix) :
+    RootsIso locRel (leftPrefix ++ leftSuffix)
+      (rightPrefix ++ rightSuffix) := by
+  induction first with
+  | nil => exact suffix
+  | cons head tail ih => exact .cons head ih
+
+theorem tail {locRel : Nat → Nat → Prop} {left right : Root}
+    {lefts rights : List Root}
+    (roots : RootsIso locRel (left :: lefts) (right :: rights)) :
+    RootsIso locRel lefts rights := by
+  cases roots with
+  | cons head tail => exact tail
+
+/-- Dropping equal pointwise prefixes preserves root-list isomorphism. -/
+theorem drop {locRel : Nat → Nat → Prop} :
+    ∀ {left right : List Root}, RootsIso locRel left right →
+      ∀ count, RootsIso locRel (left.drop count) (right.drop count)
+  | _, _, .nil, count => by cases count <;> exact .nil
+  | _, _, .cons head tail, 0 => .cons head tail
+  | _, _, .cons head tail, count + 1 => tail.drop count
+
+theorem left_of_right_mem {locRel : Nat → Nat → Prop} :
+    ∀ {left right : List Root}, RootsIso locRel left right →
+      ∀ {rightRoot}, rightRoot ∈ right →
+        ∃ leftRoot, leftRoot ∈ left ∧ RootIso locRel leftRoot rightRoot
+  | _, _, .nil, _, member => by simp at member
+  | _, _, .cons head tail, rightRoot, member => by
+      simp only [List.mem_cons] at member
+      rcases member with equal | member
+      · subst rightRoot
+        exact ⟨_, by simp, head⟩
+      · obtain ⟨leftRoot, leftMember, related⟩ :=
+          tail.left_of_right_mem member
+        exact ⟨leftRoot, by simp [leftMember], related⟩
+
+/-- Pointwise root preimages of the same target list are unique. -/
+theorem left_eq_of_right {leftStore rightStore : Store}
+    (iso : HeapIso leftStore rightStore) :
+    ∀ {left₁ left₂ right : List Root},
+      RootsIso iso.locRel left₁ right →
+      RootsIso iso.locRel left₂ right →
+      left₁ = left₂
+  | _, _, _, .nil, .nil => rfl
+  | _, _, _, .cons firstHead firstTail, .cons secondHead secondTail => by
+      have headEq := RootIso.left_eq_of_right iso firstHead secondHead
+      have tailEq := RootsIso.left_eq_of_right iso firstTail secondTail
+      rw [headEq, tailEq]
+
+/-- Reorder the target presentation of a pointwise root isomorphism while
+applying the same permutation to its source presentation. -/
+theorem permuteRight {locRel : Nat → Nat → Prop}
+    {left right right' : List Root}
+    (roots : RootsIso locRel left right) (permutation : right.Perm right') :
+    ∃ left', left.Perm left' ∧ RootsIso locRel left' right' := by
+  induction permutation generalizing left with
+  | nil =>
+      cases roots
+      exact ⟨[], .refl [], .nil⟩
+  | cons root permutation ih =>
+      cases roots with
+      | cons head tail =>
+          obtain ⟨leftTail, tailPermutation, tailRoots⟩ := ih tail
+          exact ⟨_ :: leftTail, tailPermutation.cons _, .cons head tailRoots⟩
+  | swap first second rest =>
+      cases roots with
+      | cons firstRoot roots =>
+          cases roots with
+          | cons secondRoot tail =>
+              exact ⟨_, .swap _ _ _, .cons secondRoot (.cons firstRoot tail)⟩
+  | trans first second firstIh secondIh =>
+      obtain ⟨middleLeft, firstPerm, middleRoots⟩ := firstIh roots
+      obtain ⟨rightLeft, secondPerm, rightRoots⟩ := secondIh middleRoots
+      exact ⟨rightLeft, firstPerm.trans secondPerm, rightRoots⟩
+
+private theorem values {locRel : Nat → Nat → Prop} :
+    ∀ {left right : List Root}, RootsIso locRel left right →
+      RValsIso locRel (left.map Root.value) (right.map Root.value)
+  | _, _, .nil => .nil
+  | _, _, .cons head tail => .cons head.value tail.values
+
+private theorem right_hasWorld {left right : Store} (iso : HeapIso left right)
+    {leftRoots rightRoots : List Root}
+    (roots : RootsIso iso.locRel leftRoots rightRoots)
+    (leftWorlds : ∀ root ∈ leftRoots,
+      HasWorld left root.world root.value) :
+    ∀ root ∈ rightRoots, HasWorld right root.world root.value := by
+  induction roots with
+  | nil => intro root member; simp at member
+  | @cons leftRoot rightRoot leftRoots rightRoots head tail ih =>
+    intro root member
+    have tailWorlds : ∀ candidate ∈ leftRoots,
+        HasWorld left candidate.world candidate.value := by
+      intro candidate candidateMember
+      exact leftWorlds candidate (by simp [candidateMember])
+    simp only [List.mem_cons] at member
+    rcases member with equal | member
+    · subst root
+      have leftWorld := leftWorlds leftRoot (by simp)
+      have rightWorld := iso.hasWorld head.value leftWorld
+      simpa [head.world] using rightWorld
+    · exact ih tailWorlds root member
+
+private theorem locationCount_eq {left right : Store} (iso : HeapIso left right)
+    {leftLoc rightLoc : Nat} (locations : iso.locRel leftLoc rightLoc)
+    {leftRoots rightRoots : List Root}
+    (roots : RootsIso iso.locRel leftRoots rightRoots) :
+    (leftRoots.filterMap rootLocation?).count leftLoc =
+      (rightRoots.filterMap rootLocation?).count rightLoc := by
+  have values := RValsIso.locationCount_eq iso locations roots.values
+  have locationFunction :
+      (rvalLocation? ∘ Root.value) = rootLocation? := by
+    funext root
+    rfl
+  simpa only [List.filterMap_map, locationFunction] using values
+
+end RootsIso
+
+namespace HeapIso
+
+/-- Incoming ownership multiplicity is invariant under corresponding heap
+and root-list renamings. -/
+theorem incoming_eq {left right : Store} (iso : HeapIso left right)
+    {leftRoots rightRoots : List Root}
+    (roots : RootsIso iso.locRel leftRoots rightRoots)
+    {leftLoc rightLoc : Nat} (locations : iso.locRel leftLoc rightLoc) :
+    incoming left leftRoots leftLoc = incoming right rightRoots rightLoc := by
+  unfold incoming
+  rw [List.count_append, List.count_append,
+    roots.locationCount_eq iso locations,
+    iso.edgeLocations_count_eq locations]
+
+end HeapIso
+
+private theorem RValsIso.left_of_right_mem {locRel : Nat → Nat → Prop} :
+    ∀ {left right : List RVal}, RValsIso locRel left right →
+      ∀ {rightValue}, rightValue ∈ right →
+        ∃ leftValue, leftValue ∈ left ∧
+          RValIso locRel leftValue rightValue
+  | _, _, .nil, _, member => by simp at member
+  | _, _, .cons head tail, rightValue, member => by
+      simp only [List.mem_cons] at member
+      rcases member with equal | member
+      · subst rightValue
+        exact ⟨_, by simp, head⟩
+      · obtain ⟨leftValue, leftMember, related⟩ :=
+          tail.left_of_right_mem member
+        exact ⟨leftValue, by simp [leftMember], related⟩
+
+private theorem NodeIso.children {locRel : Nat → Nat → Prop}
+    {left right : Node} (nodes : NodeIso locRel left right) :
+    RValsIso locRel (nodeChildren left) (nodeChildren right) := by
+  cases nodes with
+  | ctor fields => exact fields
+  | pap args => exact args
+
+private theorem NodeIso.left_pap_of_right {locRel : Nat → Nat → Prop}
+    {left : Node} {f : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {rightArgs : Array RVal}
+    (nodes : NodeIso locRel left (.papN f arity rightArgs)) :
+    ∃ leftArgs, left = .papN f arity leftArgs := by
+  cases nodes with
+  | pap fields => exact ⟨_, rfl⟩
+
+namespace HeapIso
+
+/-- Exact ownership is invariant under a heap isomorphism when the external
+root list is renamed pointwise by the same location relation. -/
+theorem rootOwnership {left right : Store} (iso : HeapIso left right)
+    {leftRoots rightRoots : List Root}
+    (roots : RootsIso iso.locRel leftRoots rightRoots)
+    (owned : RootOwnership left leftRoots) :
+    RootOwnership right rightRoots := by
+  refine ⟨roots.right_hasWorld iso owned.roots_world, ?_, ?_, ?_⟩
+  · intro rightLoc rightBox rightLive child childMember
+    obtain ⟨leftLoc, related⟩ := iso.right_total rightLive
+    obtain ⟨leftBox, relatedRightBox, leftLive, relatedRightLive,
+      boxes⟩ := iso.related_live related
+    have rightBoxEq : relatedRightBox = rightBox :=
+      Option.some.inj (relatedRightLive.symm.trans rightLive)
+    subst relatedRightBox
+    obtain ⟨leftChild, leftMember, children⟩ :=
+      boxes.node.children.left_of_right_mem childMember
+    have leftWorld := owned.edges_world leftLive leftChild leftMember
+    have rightWorld := iso.hasWorld children leftWorld
+    simpa [boxes.world] using rightWorld
+  · intro rightLoc rightBox f arity args rightLive rightNode
+    obtain ⟨leftLoc, related⟩ := iso.right_total rightLive
+    obtain ⟨leftBox, relatedRightBox, leftLive, relatedRightLive,
+      boxes⟩ := iso.related_live related
+    have rightBoxEq : relatedRightBox = rightBox :=
+      Option.some.inj (relatedRightLive.symm.trans rightLive)
+    subst relatedRightBox
+    have nodes : NodeIso iso.locRel leftBox.node (.papN f arity args) := by
+      simpa [rightNode] using boxes.node
+    obtain ⟨leftArgs, leftNode⟩ := nodes.left_pap_of_right
+    have leftShared := owned.pap_shared leftLive leftNode
+    exact boxes.world ▸ leftShared
+  · intro rightLoc rightBox rightLive
+    obtain ⟨leftLoc, related⟩ := iso.right_total rightLive
+    obtain ⟨leftBox, relatedRightBox, leftLive, relatedRightLive,
+      boxes⟩ := iso.related_live related
+    have rightBoxEq : relatedRightBox = rightBox :=
+      Option.some.inj (relatedRightLive.symm.trans rightLive)
+    subst relatedRightBox
+    have leftCounts := owned.counts leftLive
+    have incomingEq := iso.incoming_eq roots related
+    rw [← boxes.world, ← boxes.rc, ← incomingEq]
+    exact leftCounts
+
+private theorem preimageRoot {left right : Store} (iso : HeapIso left right)
+    (root : Root) (world : HasWorld right root.world root.value) :
+    ∃ leftRoot, RootIso iso.locRel leftRoot root := by
+  rcases root with ⟨rootWorld, value⟩
+  cases value with
+  | loc rightLoc =>
+      obtain ⟨rightBox, rightLive, _rightWorld⟩ := world
+      obtain ⟨leftLoc, related⟩ := iso.right_total rightLive
+      exact ⟨⟨rootWorld, .loc leftLoc⟩, rfl, .loc related⟩
+  | lit literal =>
+      exact ⟨⟨rootWorld, .lit literal⟩, rfl, .lit⟩
+  | erased =>
+      exact ⟨⟨rootWorld, .erased⟩, rfl, .erased⟩
+
+private theorem rootsIsoPreimage {left right : Store}
+    (iso : HeapIso left right) :
+    ∀ (rightRoots : List Root),
+      (∀ root ∈ rightRoots, HasWorld right root.world root.value) →
+      ∃ leftRoots, RootsIso iso.locRel leftRoots rightRoots
+  | [], _ => ⟨[], .nil⟩
+  | root :: rest, worlds => by
+      obtain ⟨leftRoot, head⟩ := iso.preimageRoot root
+        (worlds root (by simp))
+      obtain ⟨leftRest, tail⟩ := iso.rootsIsoPreimage rest
+        (fun candidate member => worlds candidate (by simp [member]))
+      exact ⟨leftRoot :: leftRest, .cons head tail⟩
+
+/-- Pull an exact external-root presentation backward through a heap
+isomorphism. The returned list preserves root order and worlds while replacing
+each live location by its unique preimage. -/
+theorem rootOwnershipPreimage {left right : Store} (iso : HeapIso left right)
+    {rightRoots : List Root} (owned : RootOwnership right rightRoots) :
+    ∃ leftRoots,
+      RootsIso iso.locRel leftRoots rightRoots ∧
+        RootOwnership left leftRoots := by
+  obtain ⟨leftRoots, roots⟩ :=
+    iso.rootsIsoPreimage rightRoots owned.roots_world
+  exact ⟨leftRoots, roots, iso.symm.rootOwnership roots.symm owned⟩
+
+/-- Pull a cons-root ownership presentation backward while fixing a known
+preimage for its distinguished head. -/
+theorem rootOwnershipPreimageCons {left right : Store}
+    (iso : HeapIso left right) {leftRoot rightRoot : Root}
+    {rightRest : List Root} (head : RootIso iso.locRel leftRoot rightRoot)
+    (owned : RootOwnership right (rightRoot :: rightRest)) :
+    ∃ leftRest,
+      RootsIso iso.locRel (leftRoot :: leftRest) (rightRoot :: rightRest) ∧
+        RootOwnership left (leftRoot :: leftRest) := by
+  obtain ⟨leftRest, tail⟩ := iso.rootsIsoPreimage rightRest
+    (fun root member => owned.roots_world root (by simp [member]))
+  let roots : RootsIso iso.locRel (leftRoot :: leftRest)
+      (rightRoot :: rightRest) := .cons head tail
+  exact ⟨leftRest, roots, iso.symm.rootOwnership roots.symm owned⟩
+
+/-- Pull an ownership presentation backward while fixing any pointwise-related
+root prefix and choosing only the ambient preimage tail. -/
+theorem rootOwnershipPreimageAppend {left right : Store}
+    (iso : HeapIso left right)
+    {leftPrefix rightPrefix rightRest : List Root}
+    (first : RootsIso iso.locRel leftPrefix rightPrefix)
+    (owned : RootOwnership right (rightPrefix ++ rightRest)) :
+    ∃ leftRest,
+      RootsIso iso.locRel (leftPrefix ++ leftRest)
+          (rightPrefix ++ rightRest) ∧
+        RootOwnership left (leftPrefix ++ leftRest) := by
+  obtain ⟨leftRest, tail⟩ := iso.rootsIsoPreimage rightRest
+    (fun root member => owned.roots_world root
+      (List.mem_append_right rightPrefix member))
+  let roots := first.append tail
+  exact ⟨leftRest, roots, iso.symm.rootOwnership roots.symm owned⟩
+
+end HeapIso
+
+/-- Appending a fresh heap node preserves every existing live node shape. -/
+theorem StoreGraphExtends.allocNode (store : Store) (world : Owned)
+    (node : Node) :
+    StoreGraphExtends store (store.allocNode world node).1 := by
+  intro loc boxWorld rc oldNode hget
+  exact ⟨rc, HeapIso.get?_allocNode_old hget⟩
+
+/-! ## Allocation and exact ownership -/
+
+private theorem flatMap_set_eq_self {α β : Type} (f : α → List β) :
+    ∀ {values : List α} {idx : Nat} {old new : α},
+      values[idx]? = some old → f new = f old →
+      (values.set idx new).flatMap f = values.flatMap f
+  | [], idx, old, new, hget, _ => by simp at hget
+  | value :: rest, 0, old, new, hget, hsame => by
+    simp at hget
+    subst old
+    simp [hsame]
+  | value :: rest, idx + 1, old, new, hget, hsame => by
+    simp only [List.getElem?_cons_succ] at hget
+    simp [flatMap_set_eq_self f hget hsame]
+
+theorem nodes_get?_of_get? {store : Store} {loc : Nat} {box : NodeBox}
+    (h : store.get? loc = some box) :
+    store.nodes[loc]? = some (some box) := by
+  rw [Store.get?, Option.bind_eq_some_iff] at h
+  obtain ⟨slot, hslot, hid⟩ := h
+  change slot = some box at hid
+  subst slot
+  exact hslot
+
+theorem get?_setBox_same {store : Store} {loc : Nat} {old new : NodeBox}
+    (h : store.get? loc = some old) :
+    (store.setBox loc new).get? loc = some new := by
+  have hnodes := nodes_get?_of_get? h
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simp [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds, hlt]
+
+theorem get?_setBox_other {store : Store} {loc other : Nat}
+    {old new box : NodeBox} (hne : loc ≠ other)
+    (hlive : store.get? loc = some old) (h : store.get? other = some box) :
+    (store.setBox loc new).get? other = some box := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds,
+    Array.getElem?_setIfInBounds, hlt, hne] using h
+
+theorem get?_of_setBox_other {store : Store} {loc other : Nat}
+    {old new box : NodeBox} (hne : loc ≠ other)
+    (hlive : store.get? loc = some old)
+    (h : (store.setBox loc new).get? other = some box) :
+    store.get? other = some box := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [Store.setBox, Store.get?, Array.set!_eq_setIfInBounds,
+    Array.getElem?_setIfInBounds, hlt, hne] using h
+
+private theorem count_flatMap_set_remove {α β : Type} [BEq β]
+    (f : α → List β) (needle : β) :
+    ∀ {values : List α} {idx : Nat} {old new : α},
+      values[idx]? = some old → f new = [] →
+      List.count needle ((values.set idx new).flatMap f) +
+          List.count needle (f old) =
+        List.count needle (values.flatMap f)
+  | [], idx, old, new, hget, _ => by simp at hget
+  | value :: rest, 0, old, new, hget, hempty => by
+    simp at hget
+    subst old
+    simp [hempty, List.count_append, Nat.add_comm]
+  | value :: rest, idx + 1, old, new, hget, hempty => by
+    simp only [List.getElem?_cons_succ] at hget
+    simp only [List.set, List.flatMap_cons, List.count_append]
+    have ih := count_flatMap_set_remove f needle hget hempty
+    omega
+
+private theorem count_flatMap_set_add {α β : Type} [BEq β]
+    (f : α → List β) (needle : β) :
+    ∀ {values : List α} {idx : Nat} {old new : α},
+      values[idx]? = some old → f old = [] →
+      List.count needle ((values.set idx new).flatMap f) =
+        List.count needle (values.flatMap f) +
+          List.count needle (f new)
+  | [], idx, old, new, hget, _ => by simp at hget
+  | value :: rest, 0, old, new, hget, hempty => by
+    simp at hget
+    subst old
+    simp [hempty, List.count_append, Nat.add_comm]
+  | value :: rest, idx + 1, old, new, hget, hempty => by
+    simp only [List.getElem?_cons_succ] at hget
+    simp only [List.set, List.flatMap_cons, List.count_append]
+    have ih := count_flatMap_set_add f needle (new := new) hget hempty
+    omega
+
+theorem get?_kill_same {store : Store} {loc : Nat} {box : NodeBox}
+    (h : store.get? loc = some box) : (store.kill loc).get? loc = none := by
+  have hnodes := nodes_get?_of_get? h
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simp [Store.kill, Store.get?, Array.set!_eq_setIfInBounds, hlt]
+
+theorem get?_kill_other {store : Store} {loc other : Nat} {box otherBox}
+    (hne : loc ≠ other) (hlive : store.get? loc = some box)
+    (h : store.get? other = some otherBox) :
+    (store.kill loc).get? other = some otherBox := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [Store.kill, Store.get?, Array.set!_eq_setIfInBounds,
+    Array.getElem?_setIfInBounds, hlt, hne] using h
+
+theorem get?_of_kill_other {store : Store} {loc other : Nat} {box otherBox}
+    (hne : loc ≠ other) (hlive : store.get? loc = some box)
+    (h : (store.kill loc).get? other = some otherBox) :
+    store.get? other = some otherBox := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [Store.kill, Store.get?, Array.set!_eq_setIfInBounds,
+    Array.getElem?_setIfInBounds, hlt, hne] using h
+
+/-- Killing one live node leaves every surviving node's shape unchanged. -/
+theorem StoreGraphRestricts.kill {store : Store} {loc : Nat} {box : NodeBox}
+    (hlive : store.get? loc = some box) :
+    StoreGraphRestricts store (store.kill loc) := by
+  intro other world rc node hafter
+  by_cases heq : loc = other
+  · subst other
+    rw [get?_kill_same hlive] at hafter
+    contradiction
+  · exact ⟨rc, get?_of_kill_other heq hlive hafter⟩
+
+theorem count_edgeLocations_kill {store : Store} {loc : Nat}
+    {box : NodeBox} (needle : Nat) (h : store.get? loc = some box) :
+    List.count needle (edgeLocations (store.kill loc)) +
+        List.count needle ((nodeChildren box.node).filterMap rvalLocation?) =
+      List.count needle (edgeLocations store) := by
+  have hnodes := nodes_get?_of_get? h
+  have hlist : store.nodes.toList[loc]? = some (some box) := by
+    simpa using hnodes
+  rw [edgeLocations, edgeLocations, Store.kill, Array.toList_set!]
+  apply count_flatMap_set_remove slotEdgeLocations needle hlist
+  rfl
+
+theorem incoming_kill_one (store : Store) (loc : Nat) (world : Owned)
+    (node : Node) (rest : List Root) (needle : Nat)
+    (hget : store.get? loc = some ⟨world, 1, node⟩) :
+    incoming (store.kill loc) (rootsFor world (nodeChildren node) ++ rest)
+          needle + (if loc == needle then 1 else 0) =
+      incoming store (⟨world, .loc loc⟩ :: rest) needle := by
+  have hedge := count_edgeLocations_kill needle hget
+  by_cases heq : loc = needle
+  · subst needle
+    simp [incoming, List.filterMap_append, List.count_append,
+      rootLocation?, rvalLocation?] at hedge ⊢
+    omega
+  · simp [incoming, List.filterMap_append, List.count_append,
+      rootLocation?, rvalLocation?, heq] at hedge ⊢
+    omega
+
+theorem incoming_kill_shared_one (store : Store) (loc : Nat) (node : Node)
+    (rest : List Root) (needle : Nat)
+    (hget : store.get? loc = some ⟨.shared, 1, node⟩) :
+    incoming (store.kill loc) (rootsFor .shared (nodeChildren node) ++ rest)
+          needle + (if loc == needle then 1 else 0) =
+      incoming store (⟨.shared, .loc loc⟩ :: rest) needle :=
+  incoming_kill_one store loc .shared node rest needle hget
+
+theorem incoming_kill_unique_one (store : Store) (loc : Nat) (node : Node)
+    (rest : List Root) (needle : Nat)
+    (hget : store.get? loc = some ⟨.unique, 1, node⟩) :
+    incoming (store.kill loc) (rootsFor .unique (nodeChildren node) ++ rest)
+          needle + (if loc == needle then 1 else 0) =
+      incoming store (⟨.unique, .loc loc⟩ :: rest) needle :=
+  incoming_kill_one store loc .unique node rest needle hget
+
+private theorem sole_incoming_free_of_one {store : Store} {loc : Nat}
+    {world : Owned} {rest : List Root}
+    (hcount : 1 = incoming store (⟨world, .loc loc⟩ :: rest) loc) :
+    loc ∉ rest.filterMap rootLocation? ++ edgeLocations store := by
+  rw [incoming] at hcount
+  simp [rootLocation?, rvalLocation?, List.count] at hcount
+  intro hmem
+  rcases List.mem_append.mp hmem with hroot | hedge
+  · rw [List.mem_filterMap] at hroot
+    obtain ⟨root, hroot, hmap⟩ := hroot
+    exact hcount.1 loc root hroot hmap rfl
+  · exact hcount.2 loc hedge rfl
+
+/-- When a shared node has reference count one and its consuming root is
+listed first, no root in the tail and no heap edge can also point to it. -/
+theorem RootOwnership.sole_incoming_free {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, 1, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest)) :
+    loc ∉ rest.filterMap rootLocation? ++ edgeLocations store := by
+  exact sole_incoming_free_of_one (h.counts hget)
+
+/-- A unique node's exact-one incoming equation excludes every other root or
+heap edge from its consuming root. -/
+theorem RootOwnership.sole_incoming_free_unique {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.unique, 1, node⟩)
+    (h : RootOwnership store (⟨.unique, .loc loc⟩ :: rest)) :
+    loc ∉ rest.filterMap rootLocation? ++ edgeLocations store := by
+  have hcount := h.counts hget
+  exact sole_incoming_free_of_one hcount.2.symm
+
+theorem RootOwnership.sole_root_ne {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, 1, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest))
+    {root : Root} (hroot : root ∈ rest) : root.value ≠ .loc loc := by
+  intro heq
+  have hfree := h.sole_incoming_free hget
+  apply hfree
+  apply List.mem_append_left
+  rw [List.mem_filterMap]
+  exact ⟨root, hroot, by simp [rootLocation?, heq, rvalLocation?]⟩
+
+theorem child_location_mem_edgeLocations {store : Store} {parent : Nat}
+    {box : NodeBox} {childLoc : Nat}
+    (hparent : store.get? parent = some box)
+    (hchild : RVal.loc childLoc ∈ nodeChildren box.node) :
+    childLoc ∈ edgeLocations store := by
+  have harray : some box ∈ store.nodes :=
+    (Array.mem_iff_getElem?).2 ⟨parent, nodes_get?_of_get? hparent⟩
+  have hslot : some box ∈ store.nodes.toList := by simpa using harray
+  rw [edgeLocations, List.mem_flatMap]
+  refine ⟨some box, hslot, ?_⟩
+  change childLoc ∈ (nodeChildren box.node).filterMap rvalLocation?
+  rw [List.mem_filterMap]
+  exact ⟨.loc childLoc, hchild, rfl⟩
+
+theorem RootOwnership.sole_child_ne {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, 1, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest))
+    {parent : Nat} {box : NodeBox} {child : RVal}
+    (hparent : store.get? parent = some box)
+    (hchild : child ∈ nodeChildren box.node) : child ≠ .loc loc := by
+  intro heq
+  subst child
+  have hfree := h.sole_incoming_free hget
+  apply hfree
+  apply List.mem_append_right
+  exact child_location_mem_edgeLocations hparent hchild
+
+theorem RootOwnership.sole_root_ne_unique {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.unique, 1, node⟩)
+    (h : RootOwnership store (⟨.unique, .loc loc⟩ :: rest))
+    {root : Root} (hroot : root ∈ rest) : root.value ≠ .loc loc := by
+  intro heq
+  have hfree := h.sole_incoming_free_unique hget
+  apply hfree
+  apply List.mem_append_left
+  rw [List.mem_filterMap]
+  exact ⟨root, hroot, by simp [rootLocation?, heq, rvalLocation?]⟩
+
+theorem RootOwnership.sole_child_ne_unique {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.unique, 1, node⟩)
+    (h : RootOwnership store (⟨.unique, .loc loc⟩ :: rest))
+    {parent : Nat} {box : NodeBox} {child : RVal}
+    (hparent : store.get? parent = some box)
+    (hchild : child ∈ nodeChildren box.node) : child ≠ .loc loc := by
+  intro heq
+  subst child
+  have hfree := h.sole_incoming_free_unique hget
+  apply hfree
+  apply List.mem_append_right
+  exact child_location_mem_edgeLocations hparent hchild
+
+/-- Killing one live slot preserves the world of every value which does not
+name that slot. -/
+theorem HasWorld.kill {store : Store} {loc : Nat} {box : NodeBox}
+    {world : Owned} {value : RVal}
+    (hlive : store.get? loc = some box) (hne : value ≠ .loc loc)
+    (h : HasWorld store world value) :
+    HasWorld (store.kill loc) world value := by
+  cases value with
+  | loc valueLoc =>
+    obtain ⟨valueBox, hvalue, hworld⟩ := h
+    have hloc : loc ≠ valueLoc := by
+      intro heq
+      subst valueLoc
+      exact hne rfl
+    exact ⟨valueBox, get?_kill_other hloc hlive hvalue, hworld⟩
+  | lit l => trivial
+  | erased => trivial
+
+/-- Ownership-facing form of in-place unique reuse. It kills and revives the
+same slot, then restores the evaluator's counter behavior: one reuse and no
+free. Its node array is extensionally the evaluator's direct overwrite. -/
+def reuseNodeStore (store : Store) (loc : Nat) (node : Node) : Store :=
+  let revived := (store.kill loc).setBox loc ⟨.unique, 1, node⟩
+  { revived with frees := store.frees, reuses := store.reuses + 1 }
+
+theorem reuseNodeStore_eq_direct (store : Store) (loc : Nat) (node : Node) :
+    reuseNodeStore store loc node =
+      let updated := store.setBox loc ⟨.unique, 1, node⟩
+      { updated with reuses := updated.reuses + 1 } := by
+  cases store
+  simp [reuseNodeStore, Store.kill, Store.setBox,
+    Array.set!_eq_setIfInBounds]
+
+theorem get?_reuseNodeStore_same {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node}
+    (hget : store.get? loc = some oldBox) :
+    (reuseNodeStore store loc node).get? loc =
+      some ⟨.unique, 1, node⟩ := by
+  have hnodes := nodes_get?_of_get? hget
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simp [reuseNodeStore, Store.kill, Store.setBox, Store.get?,
+    Array.set!_eq_setIfInBounds, hlt]
+
+theorem get?_reuseNodeStore_other {store : Store} {loc other : Nat}
+    {oldBox otherBox : NodeBox} {node : Node} (hne : loc ≠ other)
+    (hlive : store.get? loc = some oldBox)
+    (hget : store.get? other = some otherBox) :
+    (reuseNodeStore store loc node).get? other = some otherBox := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [reuseNodeStore, Store.kill, Store.setBox, Store.get?,
+    Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds, hlt, hne]
+    using hget
+
+theorem get?_of_reuseNodeStore_other {store : Store} {loc other : Nat}
+    {oldBox otherBox : NodeBox} {node : Node} (hne : loc ≠ other)
+    (hlive : store.get? loc = some oldBox)
+    (hget : (reuseNodeStore store loc node).get? other = some otherBox) :
+    store.get? other = some otherBox := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [reuseNodeStore, Store.kill, Store.setBox, Store.get?,
+    Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds, hlt, hne]
+    using hget
+
+theorem count_edgeLocations_reuseNodeStore {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node} (needle : Nat)
+    (hget : store.get? loc = some oldBox) :
+    List.count needle (edgeLocations (reuseNodeStore store loc node)) =
+      List.count needle (edgeLocations (store.kill loc)) +
+        List.count needle ((nodeChildren node).filterMap rvalLocation?) := by
+  have hnodes := nodes_get?_of_get? hget
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  have hslot : (store.kill loc).nodes.toList[loc]? = some none := by
+    simp [Store.kill, Array.set!_eq_setIfInBounds, hlt]
+  rw [edgeLocations, edgeLocations, reuseNodeStore, Store.setBox,
+    Array.toList_set!]
+  apply count_flatMap_set_add slotEdgeLocations needle hslot
+  rfl
+
+theorem incoming_reuseNodeStore_same (store : Store) (loc : Nat)
+    (oldBox : NodeBox) (node : Node) (rest : List Root)
+    (hget : store.get? loc = some oldBox) :
+    incoming (reuseNodeStore store loc node)
+        (⟨.unique, .loc loc⟩ :: rest) loc =
+      incoming (store.kill loc)
+        (rootsFor .unique (nodeChildren node) ++ rest) loc + 1 := by
+  have hedge :=
+    count_edgeLocations_reuseNodeStore (node := node) loc hget
+  simp [incoming, List.filterMap_append,
+    rootLocation?, rvalLocation?, List.count] at hedge ⊢
+  omega
+
+theorem incoming_reuseNodeStore_other (store : Store) (loc : Nat)
+    (oldBox : NodeBox) (node : Node) (rest : List Root) {other : Nat}
+    (hne : loc ≠ other) (hget : store.get? loc = some oldBox) :
+    incoming (reuseNodeStore store loc node)
+        (⟨.unique, .loc loc⟩ :: rest) other =
+      incoming (store.kill loc)
+        (rootsFor .unique (nodeChildren node) ++ rest) other := by
+  have hedge :=
+    count_edgeLocations_reuseNodeStore (node := node) other hget
+  simp [incoming, List.filterMap_append, List.count_append,
+    rootLocation?, rvalLocation?, hne] at hedge ⊢
+  omega
+
+theorem HasWorld.reuseNodeStore {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node} {world : Owned} {value : RVal}
+    (hget : store.get? loc = some oldBox)
+    (h : HasWorld (store.kill loc) world value) :
+    HasWorld (reuseNodeStore store loc node) world value := by
+  cases value with
+  | loc valueLoc =>
+    obtain ⟨valueBox, hvalue, hworld⟩ := h
+    have hne : loc ≠ valueLoc := by
+      intro heq
+      subst valueLoc
+      rw [get?_kill_same hget] at hvalue
+      contradiction
+    have hold : store.get? valueLoc = some valueBox :=
+      get?_of_kill_other hne hget hvalue
+    exact ⟨valueBox, get?_reuseNodeStore_other hne hget hold, hworld⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- Ownership-facing form of in-place shared reuse.  As for unique reuse,
+the slot is killed and revived to expose the ownership transition while the
+observable allocator counters are restored to the evaluator's direct
+overwrite behavior: one reuse and no free. -/
+def reuseSharedNodeStore (store : Store) (loc : Nat) (node : Node) : Store :=
+  let revived := (store.kill loc).setBox loc ⟨.shared, 1, node⟩
+  { revived with frees := store.frees, reuses := store.reuses + 1 }
+
+theorem reuseSharedNodeStore_eq_direct (store : Store) (loc : Nat)
+    (node : Node) :
+    reuseSharedNodeStore store loc node =
+      let updated := store.setBox loc ⟨.shared, 1, node⟩
+      { updated with reuses := updated.reuses + 1 } := by
+  cases store
+  simp [reuseSharedNodeStore, Store.kill, Store.setBox,
+    Array.set!_eq_setIfInBounds]
+
+theorem get?_reuseSharedNodeStore_same {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node}
+    (hget : store.get? loc = some oldBox) :
+    (reuseSharedNodeStore store loc node).get? loc =
+      some ⟨.shared, 1, node⟩ := by
+  have hnodes := nodes_get?_of_get? hget
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simp [reuseSharedNodeStore, Store.kill, Store.setBox, Store.get?,
+    Array.set!_eq_setIfInBounds, hlt]
+
+theorem get?_reuseSharedNodeStore_other {store : Store} {loc other : Nat}
+    {oldBox otherBox : NodeBox} {node : Node} (hne : loc ≠ other)
+    (hlive : store.get? loc = some oldBox)
+    (hget : store.get? other = some otherBox) :
+    (reuseSharedNodeStore store loc node).get? other = some otherBox := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [reuseSharedNodeStore, Store.kill, Store.setBox, Store.get?,
+    Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds, hlt, hne]
+    using hget
+
+theorem get?_of_reuseSharedNodeStore_other {store : Store}
+    {loc other : Nat} {oldBox otherBox : NodeBox} {node : Node}
+    (hne : loc ≠ other) (hlive : store.get? loc = some oldBox)
+    (hget : (reuseSharedNodeStore store loc node).get? other =
+      some otherBox) :
+    store.get? other = some otherBox := by
+  have hnodes := nodes_get?_of_get? hlive
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simpa [reuseSharedNodeStore, Store.kill, Store.setBox, Store.get?,
+    Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds, hlt, hne]
+    using hget
+
+theorem count_edgeLocations_reuseSharedNodeStore {store : Store}
+    {loc : Nat} {oldBox : NodeBox} {node : Node} (needle : Nat)
+    (hget : store.get? loc = some oldBox) :
+    List.count needle (edgeLocations (reuseSharedNodeStore store loc node)) =
+      List.count needle (edgeLocations (store.kill loc)) +
+        List.count needle ((nodeChildren node).filterMap rvalLocation?) := by
+  have hnodes := nodes_get?_of_get? hget
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  have hslot : (store.kill loc).nodes.toList[loc]? = some none := by
+    simp [Store.kill, Array.set!_eq_setIfInBounds, hlt]
+  rw [edgeLocations, edgeLocations, reuseSharedNodeStore, Store.setBox,
+    Array.toList_set!]
+  apply count_flatMap_set_add slotEdgeLocations needle hslot
+  rfl
+
+theorem incoming_reuseSharedNodeStore_same (store : Store) (loc : Nat)
+    (oldBox : NodeBox) (node : Node) (rest : List Root)
+    (hget : store.get? loc = some oldBox) :
+    incoming (reuseSharedNodeStore store loc node)
+        (⟨.shared, .loc loc⟩ :: rest) loc =
+      incoming (store.kill loc)
+        (rootsFor .shared (nodeChildren node) ++ rest) loc + 1 := by
+  have hedge :=
+    count_edgeLocations_reuseSharedNodeStore (node := node) loc hget
+  simp [incoming, List.filterMap_append,
+    rootLocation?, rvalLocation?, List.count] at hedge ⊢
+  omega
+
+theorem incoming_reuseSharedNodeStore_other (store : Store) (loc : Nat)
+    (oldBox : NodeBox) (node : Node) (rest : List Root) {other : Nat}
+    (hne : loc ≠ other) (hget : store.get? loc = some oldBox) :
+    incoming (reuseSharedNodeStore store loc node)
+        (⟨.shared, .loc loc⟩ :: rest) other =
+      incoming (store.kill loc)
+        (rootsFor .shared (nodeChildren node) ++ rest) other := by
+  have hedge :=
+    count_edgeLocations_reuseSharedNodeStore (node := node) other hget
+  simp [incoming, List.filterMap_append, List.count_append,
+    rootLocation?, rvalLocation?, hne] at hedge ⊢
+  omega
+
+theorem HasWorld.reuseSharedNodeStore {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node} {world : Owned} {value : RVal}
+    (hget : store.get? loc = some oldBox)
+    (h : HasWorld (store.kill loc) world value) :
+    HasWorld (reuseSharedNodeStore store loc node) world value := by
+  cases value with
+  | loc valueLoc =>
+    obtain ⟨valueBox, hvalue, hworld⟩ := h
+    have hne : loc ≠ valueLoc := by
+      intro heq
+      subst valueLoc
+      rw [get?_kill_same hget] at hvalue
+      contradiction
+    have hold : store.get? valueLoc = some valueBox :=
+      get?_of_kill_other hne hget hvalue
+    exact ⟨valueBox, get?_reuseSharedNodeStore_other hne hget hold,
+      hworld⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- Store transition performed by a successful `dup` on a shared location. -/
+def incRcStore (store : Store) (loc : Nat) (box : NodeBox) : Store :=
+  (store.setBox loc { box with rc := box.rc + 1 }).rcTick
+
+@[simp] theorem get?_rcTick (store : Store) (loc : Nat) :
+    store.rcTick.get? loc = store.get? loc := rfl
+
+/-- Reference-count instrumentation changes no ownership-relevant store
+state. -/
+theorem RootOwnership.rcTick {store : Store} {roots : List Root}
+    (h : RootOwnership store roots) : RootOwnership store.rcTick roots := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simpa [HasWorld, Store.rcTick, Store.get?] using
+      h.roots_world root hroot
+  · intro loc box hbox child hchild
+    have hold : store.get? loc = some box := by simpa using hbox
+    simpa [HasWorld, Store.rcTick, Store.get?] using
+      h.edges_world hold child hchild
+  · intro loc box f arity args hbox hnode
+    apply h.pap_shared (loc := loc) (box := box) (f := f)
+      (arity := arity) (args := args)
+    · simpa using hbox
+    · exact hnode
+  · intro loc box hbox
+    have hold : store.get? loc = some box := by simpa using hbox
+    simpa [incoming, edgeLocations, Store.rcTick] using h.counts hold
+
+/-- Inverse allocation for the final shared owner: remove the node and turn
+each outgoing field/capture edge into a temporary root for recursive drop. -/
+theorem RootOwnership.killSharedOne {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, 1, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest)) :
+    RootOwnership (store.kill loc)
+      (rootsFor .shared (nodeChildren node) ++ rest) := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    rcases List.mem_append.mp hroot with hchildRoot | hrest
+    · rw [rootsFor, List.mem_map] at hchildRoot
+      obtain ⟨child, hchild, rfl⟩ := hchildRoot
+      apply HasWorld.kill hget (h.sole_child_ne hget hget hchild)
+      exact h.edges_world hget child hchild
+    · apply HasWorld.kill hget (h.sole_root_ne hget hrest)
+      apply h.roots_world root
+      exact List.mem_cons_of_mem _ hrest
+  · intro parent parentBox hparent child hchild
+    have hne : loc ≠ parent := by
+      intro heq
+      subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    have hold : store.get? parent = some parentBox :=
+      get?_of_kill_other hne hget hparent
+    apply HasWorld.kill hget (h.sole_child_ne hget hold hchild)
+    exact h.edges_world hold child hchild
+  · intro parent parentBox f arity args hparent hnode
+    have hne : loc ≠ parent := by
+      intro heq
+      subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    have hold : store.get? parent = some parentBox :=
+      get?_of_kill_other hne hget hparent
+    exact h.pap_shared hold hnode
+  · intro parent parentBox hparent
+    have hne : loc ≠ parent := by
+      intro heq
+      subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    have hold : store.get? parent = some parentBox :=
+      get?_of_kill_other hne hget hparent
+    have hincoming :=
+      incoming_kill_shared_one store loc node rest parent hget
+    have hincoming' :
+        incoming (store.kill loc)
+            (rootsFor .shared (nodeChildren node) ++ rest) parent =
+          incoming store (⟨.shared, .loc loc⟩ :: rest) parent := by
+      simpa [hne] using hincoming
+    rw [hincoming']
+    exact h.counts hold
+
+/-- Inverse allocation for a unique node: remove its sole-owned slot and turn
+each outgoing field edge into a temporary unique root for recursive `dropU`. -/
+theorem RootOwnership.killUniqueOne {store : Store} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.unique, 1, node⟩)
+    (h : RootOwnership store (⟨.unique, .loc loc⟩ :: rest)) :
+    RootOwnership (store.kill loc)
+      (rootsFor .unique (nodeChildren node) ++ rest) := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    rcases List.mem_append.mp hroot with hchildRoot | hrest
+    · rw [rootsFor, List.mem_map] at hchildRoot
+      obtain ⟨child, hchild, rfl⟩ := hchildRoot
+      apply HasWorld.kill hget
+        (h.sole_child_ne_unique hget hget hchild)
+      exact h.edges_world hget child hchild
+    · apply HasWorld.kill hget (h.sole_root_ne_unique hget hrest)
+      apply h.roots_world root
+      exact List.mem_cons_of_mem _ hrest
+  · intro parent parentBox hparent child hchild
+    have hne : loc ≠ parent := by
+      intro heq
+      subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    have hold : store.get? parent = some parentBox :=
+      get?_of_kill_other hne hget hparent
+    apply HasWorld.kill hget
+      (h.sole_child_ne_unique hget hold hchild)
+    exact h.edges_world hold child hchild
+  · intro parent parentBox f arity args hparent hnode
+    have hne : loc ≠ parent := by
+      intro heq
+      subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    have hold : store.get? parent = some parentBox :=
+      get?_of_kill_other hne hget hparent
+    exact h.pap_shared hold hnode
+  · intro parent parentBox hparent
+    have hne : loc ≠ parent := by
+      intro heq
+      subst parent
+      rw [get?_kill_same hget] at hparent
+      contradiction
+    have hold : store.get? parent = some parentBox :=
+      get?_of_kill_other hne hget hparent
+    have hincoming :=
+      incoming_kill_unique_one store loc node rest parent hget
+    have hincoming' :
+        incoming (store.kill loc)
+            (rootsFor .unique (nodeChildren node) ++ rest) parent =
+          incoming store (⟨.unique, .loc loc⟩ :: rest) parent := by
+      simpa [hne] using hincoming
+    rw [hincoming']
+    exact h.counts hold
+
+/-- Constructor nodes may inhabit either world; pap nodes are always shared. -/
+def NodeWorld (world : Owned) : Node → Prop
+  | .ctorN _ _ => True
+  | .papN _ _ _ => world = .shared
+
+/-- Fill the just-killed slot with a unique node. This is allocation into a
+known dead in-bounds slot: child roots become edges and a fresh root for the
+revived location is produced. -/
+theorem RootOwnership.reviveUnique {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node} {rest : List Root}
+    (hget : store.get? loc = some oldBox)
+    (h : RootOwnership (store.kill loc)
+      (rootsFor .unique (nodeChildren node) ++ rest))
+    (hworld : NodeWorld .unique node) :
+    RootOwnership (reuseNodeStore store loc node)
+      (⟨.unique, .loc loc⟩ :: rest) := by
+  let updated : NodeBox := ⟨.unique, 1, node⟩
+  have hupdated : (reuseNodeStore store loc node).get? loc =
+      some updated := get?_reuseNodeStore_same hget
+  have targetWorld :
+      HasWorld (reuseNodeStore store loc node) .unique (.loc loc) :=
+    ⟨updated, hupdated, rfl⟩
+  have childWorld : ∀ child ∈ nodeChildren node,
+      HasWorld (store.kill loc) .unique child := by
+    intro child hchild
+    apply h.roots_world ⟨.unique, child⟩
+    apply List.mem_append_left rest
+    simp [rootsFor, hchild]
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simp only [List.mem_cons] at hroot
+    rcases hroot with rfl | hrest
+    · exact targetWorld
+    · apply HasWorld.reuseNodeStore hget
+      apply h.roots_world root
+      exact List.mem_append_right _ hrest
+  · intro parent parentBox hparent child hchild
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      exact HasWorld.reuseNodeStore hget (childWorld child hchild)
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_reuseNodeStore_other heq hget hparent
+      have hkilled : (store.kill loc).get? parent = some parentBox :=
+        get?_kill_other heq hget hold
+      exact HasWorld.reuseNodeStore hget
+        (h.edges_world hkilled child hchild)
+  · intro parent parentBox f arity args hparent hnode
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      change node = .papN f arity args at hnode
+      cases node <;> simp_all [NodeWorld]
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_reuseNodeStore_other heq hget hparent
+      have hkilled : (store.kill loc).get? parent = some parentBox :=
+        get?_kill_other heq hget hold
+      exact h.pap_shared hkilled hnode
+  · intro parent parentBox hparent
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      have hzero := h.incoming_eq_zero_of_dead (get?_kill_same hget)
+      have hcount :=
+        incoming_reuseNodeStore_same store loc oldBox node rest hget
+      rw [hzero] at hcount
+      exact ⟨rfl, hcount⟩
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_reuseNodeStore_other heq hget hparent
+      have hkilled : (store.kill loc).get? parent = some parentBox :=
+        get?_kill_other heq hget hold
+      have hcount := h.counts hkilled
+      rw [incoming_reuseNodeStore_other store loc oldBox node rest heq hget]
+      exact hcount
+
+/-- In-place unique reuse consumes the old node root and the selected new
+field roots, then produces the same location as a root. `hpartition` is the
+ownership-level free/allocate pairing: the old fields plus ambient roots are
+the new fields plus the roots that remain outside the node, **as
+multisets** (`List.Perm`). Permutation rather than list equality is what
+same-arity field replacement produces — reusing `Cons(x, xs)` as
+`Cons(x, acc)` moves `acc` out of the ambient roots and `xs` into them,
+with no split making the two sides equal as lists. -/
+theorem RootOwnership.reuseNode {store : Store} {loc : Nat}
+    {oldNode newNode : Node} {before after : List Root}
+    (hget : store.get? loc = some ⟨.unique, 1, oldNode⟩)
+    (h : RootOwnership store (⟨.unique, .loc loc⟩ :: before))
+    (hpartition :
+      (rootsFor .unique (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .unique (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .unique newNode) :
+    RootOwnership (reuseNodeStore store loc newNode)
+      (⟨.unique, .loc loc⟩ :: after) := by
+  have hready := (h.killUniqueOne hget).perm hpartition
+  exact hready.reviveUnique hget hworld
+
+/-- Fill a just-killed slot with a shared node.  The proof is the shared
+counterpart of `reviveUnique`: the replacement root has refcount one, and
+the children supplied as temporary roots become the replacement's outgoing
+shared edges. -/
+theorem RootOwnership.reviveShared {store : Store} {loc : Nat}
+    {oldBox : NodeBox} {node : Node} {rest : List Root}
+    (hget : store.get? loc = some oldBox)
+    (h : RootOwnership (store.kill loc)
+      (rootsFor .shared (nodeChildren node) ++ rest))
+    (_hworld : NodeWorld .shared node) :
+    RootOwnership (reuseSharedNodeStore store loc node)
+      (⟨.shared, .loc loc⟩ :: rest) := by
+  let updated : NodeBox := ⟨.shared, 1, node⟩
+  have hupdated : (reuseSharedNodeStore store loc node).get? loc =
+      some updated := get?_reuseSharedNodeStore_same hget
+  have targetWorld :
+      HasWorld (reuseSharedNodeStore store loc node) .shared (.loc loc) :=
+    ⟨updated, hupdated, rfl⟩
+  have childWorld : ∀ child ∈ nodeChildren node,
+      HasWorld (store.kill loc) .shared child := by
+    intro child hchild
+    apply h.roots_world ⟨.shared, child⟩
+    apply List.mem_append_left rest
+    simp [rootsFor, hchild]
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simp only [List.mem_cons] at hroot
+    rcases hroot with rfl | hrest
+    · exact targetWorld
+    · apply HasWorld.reuseSharedNodeStore hget
+      apply h.roots_world root
+      exact List.mem_append_right _ hrest
+  · intro parent parentBox hparent child hchild
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      exact HasWorld.reuseSharedNodeStore hget (childWorld child hchild)
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_reuseSharedNodeStore_other heq hget hparent
+      have hkilled : (store.kill loc).get? parent = some parentBox :=
+        get?_kill_other heq hget hold
+      exact HasWorld.reuseSharedNodeStore hget
+        (h.edges_world hkilled child hchild)
+  · intro parent parentBox f arity args hparent hnode
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      rfl
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_reuseSharedNodeStore_other heq hget hparent
+      have hkilled : (store.kill loc).get? parent = some parentBox :=
+        get?_kill_other heq hget hold
+      exact h.pap_shared hkilled hnode
+  · intro parent parentBox hparent
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      have hzero := h.incoming_eq_zero_of_dead (get?_kill_same hget)
+      have hcount :=
+        incoming_reuseSharedNodeStore_same store loc oldBox node rest hget
+      rw [hzero] at hcount
+      exact hcount.symm
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_reuseSharedNodeStore_other heq hget hparent
+      have hkilled : (store.kill loc).get? parent = some parentBox :=
+        get?_kill_other heq hget hold
+      have hcount := h.counts hkilled
+      rw [incoming_reuseSharedNodeStore_other store loc oldBox node rest
+        heq hget]
+      exact hcount
+
+/-- In-place shared reuse consumes the unit-refcount parent root and the
+selected replacement-field roots, then produces the reused location as a
+shared root.  As in unique reuse, the field/ambient accounting is stated as
+a root-multiset permutation. -/
+theorem RootOwnership.reuseSharedNode {store : Store} {loc : Nat}
+    {oldNode newNode : Node} {before after : List Root}
+    (hget : store.get? loc = some ⟨.shared, 1, oldNode⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: before))
+    (hpartition :
+      (rootsFor .shared (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .shared (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .shared newNode) :
+    RootOwnership (reuseSharedNodeStore store loc newNode)
+      (⟨.shared, .loc loc⟩ :: after) := by
+  have hready := (h.killSharedOne hget).perm hpartition
+  exact hready.reviveShared hget hworld
+
+/-- Consuming a scalar root changes no heap ownership. -/
+theorem RootOwnership.dropNoLocation {store : Store} {world : Owned}
+    {value : RVal} {rest : List Root}
+    (hnone : rvalLocation? value = none)
+    (h : RootOwnership store (⟨world, value⟩ :: rest)) :
+    RootOwnership store rest := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    exact h.roots_world root (List.mem_cons_of_mem _ hroot)
+  · exact h.edges_world
+  · exact h.pap_shared
+  · intro loc box hbox
+    simpa [incoming, rootLocation?, hnone] using h.counts hbox
+
+/-- Scalars may be added as roots without changing heap ownership. -/
+theorem RootOwnership.addNoLocation {store : Store} {world : Owned}
+    {value : RVal} {rest : List Root}
+    (hnone : rvalLocation? value = none)
+    (h : RootOwnership store rest) :
+    RootOwnership store (⟨world, value⟩ :: rest) := by
+  have hscalar : HasWorld store world value := by
+    cases value <;> simp_all [rvalLocation?, HasWorld]
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simp only [List.mem_cons] at hroot
+    rcases hroot with rfl | hrest
+    · exact hscalar
+    · exact h.roots_world root hrest
+  · exact h.edges_world
+  · exact h.pap_shared
+  · intro loc box hbox
+    simpa [incoming, rootLocation?, hnone] using h.counts hbox
+
+theorem RVal.rvalLocation?_eq_none_of_isScalar {value : RVal}
+    (hscalar : value.isScalar = true) : rvalLocation? value = none := by
+  cases value <;> simp_all [RVal.isScalar, rvalLocation?]
+
+/-- A scalar-only argument vector contributes no heap owners, so consuming
+all of its logical roots leaves the ambient ownership state unchanged. -/
+theorem RootOwnership.dropScalars {store : Store} {world : Owned}
+    {rest : List Root} :
+    ∀ {values : List RVal}, values.all RVal.isScalar = true →
+      RootOwnership store (rootsFor world values ++ rest) →
+      RootOwnership store rest := by
+  intro values hscalar hown
+  induction values with
+  | nil => simpa [rootsFor] using hown
+  | cons value values ih =>
+    simp only [List.all_cons, Bool.and_eq_true] at hscalar
+    have hcons : RootOwnership store
+        (⟨world, value⟩ :: (rootsFor world values ++ rest)) := by
+      simpa [rootsFor] using hown
+    exact ih hscalar.2
+      (hcons.dropNoLocation
+        (RVal.rvalLocation?_eq_none_of_isScalar hscalar.1))
+
+/-- Successful use of the v1 extern boundary certifies both sides of the
+call as scalar-only. -/
+theorem callScalarOracle_ok {ctx : Ctx} {f : Address}
+    {args : List RVal} {value : RVal}
+    (hcall : callScalarOracle ctx f args = .ok value) :
+    args.all RVal.isScalar = true ∧ value.isScalar = true := by
+  cases hargs : args.all RVal.isScalar with
+  | false => simp [callScalarOracle, hargs] at hcall
+  | true =>
+    cases horacle : ctx.oracle f args with
+    | none => simp [callScalarOracle, hargs, horacle] at hcall
+    | some result =>
+      cases hresult : result.isScalar with
+      | false => simp [callScalarOracle, hargs, horacle, hresult] at hcall
+      | true =>
+        simp [callScalarOracle, hargs, horacle, hresult] at hcall
+        subst value
+        exact ⟨rfl, hresult⟩
+
+theorem RootOwnership.shared_rc_pos {store : Store} {loc rc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest)) : 0 < rc := by
+  have hcount := h.counts hget
+  change rc = incoming store (⟨.shared, .loc loc⟩ :: rest) loc at hcount
+  rw [hcount, incoming]
+  simp [rootLocation?, rvalLocation?, List.count]
+
+theorem get?_incRcStore_same {store : Store} {loc : Nat} {box : NodeBox}
+    (h : store.get? loc = some box) :
+    (incRcStore store loc box).get? loc =
+      some { box with rc := box.rc + 1 } := by
+  rw [incRcStore, get?_rcTick]
+  exact get?_setBox_same (new := { box with rc := box.rc + 1 }) h
+
+theorem get?_incRcStore_other {store : Store} {loc other : Nat}
+    {box otherBox : NodeBox} (hne : loc ≠ other)
+    (hlive : store.get? loc = some box)
+    (h : store.get? other = some otherBox) :
+    (incRcStore store loc box).get? other = some otherBox := by
+  rw [incRcStore, get?_rcTick]
+  exact get?_setBox_other (new := { box with rc := box.rc + 1 })
+    hne hlive h
+
+theorem get?_of_incRcStore_other {store : Store} {loc other : Nat}
+    {box otherBox : NodeBox} (hne : loc ≠ other)
+    (hlive : store.get? loc = some box)
+    (h : (incRcStore store loc box).get? other = some otherBox) :
+    store.get? other = some otherBox := by
+  apply get?_of_setBox_other (new := { box with rc := box.rc + 1 })
+    hne hlive
+  rw [incRcStore, get?_rcTick] at h
+  exact h
+
+/-- Incrementing one shared refcount preserves every live node's semantic
+shape; only the selected node's count changes. -/
+theorem StoreGraphExtends.incRcStore {store : Store} {loc rc : Nat}
+    {node : Node}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    StoreGraphExtends store
+      (incRcStore store loc ⟨.shared, rc, node⟩) := by
+  intro other world otherRc otherNode hother
+  by_cases heq : loc = other
+  · subst other
+    have hbox : (⟨world, otherRc, otherNode⟩ : NodeBox) =
+        ⟨.shared, rc, node⟩ :=
+      Option.some.inj (hother.symm.trans hget)
+    cases hbox
+    exact ⟨rc + 1, get?_incRcStore_same hget⟩
+  · exact ⟨otherRc, get?_incRcStore_other heq hget hother⟩
+
+/-- Incrementing one shared refcount also preserves every resulting live
+node's prior semantic shape.  This is the reverse inclusion counterpart of
+`StoreGraphExtends.incRcStore`. -/
+theorem StoreGraphRestricts.incRcStore {store : Store} {loc rc : Nat}
+    {node : Node}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    StoreGraphRestricts store
+      (incRcStore store loc ⟨.shared, rc, node⟩) := by
+  intro other world otherRc otherNode hother
+  by_cases heq : loc = other
+  · subst other
+    have hupdated := get?_incRcStore_same hget
+    have hbox : (⟨world, otherRc, otherNode⟩ : NodeBox) =
+        ⟨.shared, rc + 1, node⟩ :=
+      Option.some.inj (hother.symm.trans hupdated)
+    cases hbox
+    exact ⟨rc, hget⟩
+  · exact ⟨otherRc, get?_of_incRcStore_other heq hget hother⟩
+
+theorem edgeLocations_incRcStore {store : Store} {loc : Nat} {box : NodeBox}
+    (h : store.get? loc = some box) :
+    edgeLocations (incRcStore store loc box) = edgeLocations store := by
+  have hnodes := nodes_get?_of_get? h
+  have hlist : store.nodes.toList[loc]? = some (some box) := by
+    simpa using hnodes
+  rw [edgeLocations, incRcStore, Store.rcTick, Store.setBox,
+    Array.toList_set!]
+  apply flatMap_set_eq_self slotEdgeLocations hlist
+  rfl
+
+theorem incoming_incRcStore_same (store : Store) (loc rc : Nat)
+    (node : Node) (rest : List Root)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    incoming (incRcStore store loc ⟨.shared, rc, node⟩)
+        (⟨.shared, .loc loc⟩ :: ⟨.shared, .loc loc⟩ :: rest) loc =
+      incoming store (⟨.shared, .loc loc⟩ :: rest) loc + 1 := by
+  rw [incoming, incoming, edgeLocations_incRcStore hget]
+  simp [rootLocation?, rvalLocation?, List.count_append]
+
+theorem incoming_incRcStore_other (store : Store) (loc rc : Nat)
+    (node : Node) (rest : List Root) {other : Nat} (hne : loc ≠ other)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    incoming (incRcStore store loc ⟨.shared, rc, node⟩)
+        (⟨.shared, .loc loc⟩ :: ⟨.shared, .loc loc⟩ :: rest) other =
+      incoming store (⟨.shared, .loc loc⟩ :: rest) other := by
+  rw [incoming, incoming, edgeLocations_incRcStore hget]
+  simp [rootLocation?, rvalLocation?, List.count_append, hne]
+
+theorem incoming_incRcStore_retain_same (store : Store) (loc rc : Nat)
+    (node : Node) (rest : List Root)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    incoming (incRcStore store loc ⟨.shared, rc, node⟩)
+        (⟨.shared, .loc loc⟩ :: rest) loc =
+      incoming store rest loc + 1 := by
+  rw [incoming, incoming, edgeLocations_incRcStore hget]
+  simp [rootLocation?, rvalLocation?, List.count_append, Nat.add_comm]
+
+theorem incoming_incRcStore_retain_other (store : Store) (loc rc : Nat)
+    (node : Node) (rest : List Root) {other : Nat} (hne : loc ≠ other)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    incoming (incRcStore store loc ⟨.shared, rc, node⟩)
+        (⟨.shared, .loc loc⟩ :: rest) other =
+      incoming store rest other := by
+  rw [incoming, incoming, edgeLocations_incRcStore hget]
+  simp [rootLocation?, rvalLocation?, List.count_append, hne]
+
+theorem HasWorld.incRcStore {store : Store} {loc rc : Nat} {node : Node}
+    {world : Owned} {value : RVal}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩)
+    (h : HasWorld store world value) :
+    HasWorld (incRcStore store loc ⟨.shared, rc, node⟩) world value := by
+  cases value with
+  | loc valueLoc =>
+    obtain ⟨box, hbox, hworld⟩ := h
+    by_cases heq : loc = valueLoc
+    · subst valueLoc
+      have hboxeq : box = ⟨.shared, rc, node⟩ := by
+        exact Option.some.inj (hbox.symm.trans hget)
+      subst box
+      exact ⟨⟨.shared, rc + 1, node⟩,
+        get?_incRcStore_same hget, hworld⟩
+    · exact ⟨box, get?_incRcStore_other heq hget hbox, hworld⟩
+  | lit l => trivial
+  | erased => trivial
+
+/-- A successful shared `dup` retains the old root, returns a second root,
+and increments exactly the corresponding reference count. -/
+theorem RootOwnership.dup {store : Store} {loc rc : Nat} {node : Node}
+    {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest)) :
+    RootOwnership (incRcStore store loc ⟨.shared, rc, node⟩)
+      (⟨.shared, .loc loc⟩ :: ⟨.shared, .loc loc⟩ :: rest) := by
+  let updated : NodeBox := ⟨.shared, rc + 1, node⟩
+  have hupdated :
+      (incRcStore store loc ⟨.shared, rc, node⟩).get? loc =
+        some updated := by
+    exact get?_incRcStore_same hget
+  have targetWorld :
+      HasWorld (incRcStore store loc ⟨.shared, rc, node⟩)
+        .shared (.loc loc) := ⟨updated, hupdated, rfl⟩
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simp only [List.mem_cons] at hroot
+    rcases hroot with rfl | rfl | hrest
+    · exact targetWorld
+    · exact targetWorld
+    · apply HasWorld.incRcStore hget
+      apply h.roots_world root
+      exact .tail _ hrest
+  · intro parent parentBox hparent child hchild
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      apply HasWorld.incRcStore hget
+      exact h.edges_world hget child hchild
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_incRcStore_other heq hget hparent
+      exact HasWorld.incRcStore hget (h.edges_world hold child hchild)
+  · intro parent parentBox f arity args hparent hnode
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      change node = .papN f arity args at hnode
+      exact h.pap_shared (loc := loc)
+        (box := (⟨.shared, rc, node⟩ : NodeBox)) hget hnode
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_incRcStore_other heq hget hparent
+      exact h.pap_shared hold hnode
+  · intro parent parentBox hparent
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      have hcount := h.counts hget
+      change rc = incoming store (⟨.shared, .loc loc⟩ :: rest) loc
+        at hcount
+      change rc + 1 = incoming
+        (incRcStore store loc ⟨.shared, rc, node⟩)
+          (⟨.shared, .loc loc⟩ :: ⟨.shared, .loc loc⟩ :: rest) loc
+      rw [incoming_incRcStore_same store loc rc node rest hget, hcount]
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_incRcStore_other heq hget hparent
+      have hcount := h.counts hold
+      rw [incoming_incRcStore_other store loc rc node rest heq hget]
+      exact hcount
+
+/-- Retain a borrowed shared value as a new external root. Unlike `dup`, the
+borrow itself is an edge rather than an existing root, so this adds exactly
+one root and increments the refcount once. -/
+theorem RootOwnership.retainShared {store : Store} {loc rc : Nat}
+    {node : Node} {rest : List Root}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩)
+    (h : RootOwnership store rest) :
+    RootOwnership (incRcStore store loc ⟨.shared, rc, node⟩)
+      (⟨.shared, .loc loc⟩ :: rest) := by
+  let updated : NodeBox := ⟨.shared, rc + 1, node⟩
+  have hupdated :
+      (incRcStore store loc ⟨.shared, rc, node⟩).get? loc =
+        some updated := get?_incRcStore_same hget
+  have targetWorld :
+      HasWorld (incRcStore store loc ⟨.shared, rc, node⟩)
+        .shared (.loc loc) := ⟨updated, hupdated, rfl⟩
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simp only [List.mem_cons] at hroot
+    rcases hroot with rfl | hrest
+    · exact targetWorld
+    · exact HasWorld.incRcStore hget (h.roots_world root hrest)
+  · intro parent parentBox hparent child hchild
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      exact HasWorld.incRcStore hget (h.edges_world hget child hchild)
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_incRcStore_other heq hget hparent
+      exact HasWorld.incRcStore hget (h.edges_world hold child hchild)
+  · intro parent parentBox f arity args hparent hnode
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      change node = .papN f arity args at hnode
+      exact h.pap_shared (loc := loc)
+        (box := (⟨.shared, rc, node⟩ : NodeBox)) hget hnode
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_incRcStore_other heq hget hparent
+      exact h.pap_shared hold hnode
+  · intro parent parentBox hparent
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      have hcount := h.counts hget
+      change rc = incoming store rest loc at hcount
+      change rc + 1 = incoming
+        (incRcStore store loc ⟨.shared, rc, node⟩)
+          (⟨.shared, .loc loc⟩ :: rest) loc
+      rw [incoming_incRcStore_retain_same store loc rc node rest hget,
+        hcount]
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_incRcStore_other heq hget hparent
+      have hcount := h.counts hold
+      rw [incoming_incRcStore_retain_other store loc rc node rest heq hget]
+      exact hcount
+
+/-- Store transition performed by a non-final shared `drop`. -/
+def decRcStore (store : Store) (loc : Nat) (box : NodeBox) : Store :=
+  store.rcTick.setBox loc { box with rc := box.rc - 1 }
+
+theorem get?_decRcStore_same {store : Store} {loc : Nat} {box : NodeBox}
+    (h : store.get? loc = some box) :
+    (decRcStore store loc box).get? loc =
+      some { box with rc := box.rc - 1 } := by
+  apply get?_setBox_same
+  simpa using h
+
+theorem get?_decRcStore_other {store : Store} {loc other : Nat}
+    {box otherBox : NodeBox} (hne : loc ≠ other)
+    (hlive : store.get? loc = some box)
+    (h : store.get? other = some otherBox) :
+    (decRcStore store loc box).get? other = some otherBox := by
+  apply get?_setBox_other hne
+  · simpa using hlive
+  · simpa using h
+
+theorem get?_of_decRcStore_other {store : Store} {loc other : Nat}
+    {box otherBox : NodeBox} (hne : loc ≠ other)
+    (hlive : store.get? loc = some box)
+    (h : (decRcStore store loc box).get? other = some otherBox) :
+    store.get? other = some otherBox := by
+  have h' : store.rcTick.get? other = some otherBox := by
+    apply get?_of_setBox_other hne
+    · simpa using hlive
+    · exact h
+  simpa using h'
+
+/-- Decrementing a shared node's refcount preserves every live node shape. -/
+theorem StoreGraphRestricts.decRcStore {store : Store} {loc : Nat}
+    {box : NodeBox} (hlive : store.get? loc = some box) :
+    StoreGraphRestricts store (decRcStore store loc box) := by
+  intro other world rc node hafter
+  by_cases heq : loc = other
+  · subst other
+    have hupdated := get?_decRcStore_same hlive
+    have hboxEq :
+        ({ box with rc := box.rc - 1 } : NodeBox) = ⟨world, rc, node⟩ :=
+      Option.some.inj (hupdated.symm.trans hafter)
+    cases box with
+    | mk boxWorld boxRc boxNode =>
+      simp only at hboxEq
+      cases hboxEq
+      exact ⟨boxRc, hlive⟩
+  · exact ⟨rc, get?_of_decRcStore_other heq hlive hafter⟩
+
+theorem edgeLocations_decRcStore {store : Store} {loc : Nat} {box : NodeBox}
+    (h : store.get? loc = some box) :
+    edgeLocations (decRcStore store loc box) = edgeLocations store := by
+  have hnodes := nodes_get?_of_get? h
+  have hlist : store.nodes.toList[loc]? = some (some box) := by
+    simpa using hnodes
+  rw [edgeLocations, decRcStore, Store.setBox, Store.rcTick,
+    Array.toList_set!]
+  apply flatMap_set_eq_self slotEdgeLocations hlist
+  rfl
+
+theorem incoming_decRcStore_same (store : Store) (loc rc : Nat)
+    (node : Node) (rest : List Root)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    incoming (decRcStore store loc ⟨.shared, rc, node⟩) rest loc + 1 =
+      incoming store (⟨.shared, .loc loc⟩ :: rest) loc := by
+  rw [incoming, incoming, edgeLocations_decRcStore hget]
+  simp [rootLocation?, rvalLocation?, List.count_append]
+
+theorem incoming_decRcStore_other (store : Store) (loc rc : Nat)
+    (node : Node) (rest : List Root) {other : Nat} (hne : loc ≠ other)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    incoming (decRcStore store loc ⟨.shared, rc, node⟩) rest other =
+      incoming store (⟨.shared, .loc loc⟩ :: rest) other := by
+  rw [incoming, incoming, edgeLocations_decRcStore hget]
+  simp [rootLocation?, rvalLocation?, List.count_append, hne]
+
+theorem HasWorld.decRcStore {store : Store} {loc rc : Nat} {node : Node}
+    {world : Owned} {value : RVal}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩)
+    (h : HasWorld store world value) :
+    HasWorld (decRcStore store loc ⟨.shared, rc, node⟩) world value := by
+  cases value with
+  | loc valueLoc =>
+    obtain ⟨box, hbox, hworld⟩ := h
+    by_cases heq : loc = valueLoc
+    · subst valueLoc
+      have hboxeq : box = ⟨.shared, rc, node⟩ := by
+        exact Option.some.inj (hbox.symm.trans hget)
+      subst box
+      exact ⟨⟨.shared, rc - 1, node⟩,
+        get?_decRcStore_same hget, hworld⟩
+    · exact ⟨box, get?_decRcStore_other heq hget hbox, hworld⟩
+  | lit l => trivial
+  | erased => trivial
+
+/-- A non-final shared `drop` consumes one root and decrements its positive
+refcount. `dropVal_preserves` below combines this local branch with final-owner
+reclamation through a mutual induction over the executable deep drop. -/
+theorem RootOwnership.dropSharedMany {store : Store} {loc rc : Nat}
+    {node : Node} {rest : List Root} (hrc : 1 < rc)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: rest)) :
+    RootOwnership (decRcStore store loc ⟨.shared, rc, node⟩) rest := by
+  let updated : NodeBox := ⟨.shared, rc - 1, node⟩
+  have hupdated :
+      (decRcStore store loc ⟨.shared, rc, node⟩).get? loc =
+        some updated := get?_decRcStore_same hget
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    apply HasWorld.decRcStore hget
+    apply h.roots_world root
+    exact List.mem_cons_of_mem _ hroot
+  · intro parent parentBox hparent child hchild
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      apply HasWorld.decRcStore hget
+      exact h.edges_world hget child hchild
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_decRcStore_other heq hget hparent
+      exact HasWorld.decRcStore hget (h.edges_world hold child hchild)
+  · intro parent parentBox f arity args hparent hnode
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      change node = .papN f arity args at hnode
+      exact h.pap_shared (loc := loc)
+        (box := (⟨.shared, rc, node⟩ : NodeBox)) hget hnode
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_decRcStore_other heq hget hparent
+      exact h.pap_shared hold hnode
+  · intro parent parentBox hparent
+    by_cases heq : loc = parent
+    · subst parent
+      have hboxeq : parentBox = updated := by
+        exact Option.some.inj (hparent.symm.trans hupdated)
+      subst parentBox
+      have holdCount := h.counts hget
+      change rc = incoming store (⟨.shared, .loc loc⟩ :: rest) loc
+        at holdCount
+      change rc - 1 = incoming
+        (decRcStore store loc ⟨.shared, rc, node⟩) rest loc
+      have hdelta := incoming_decRcStore_same store loc rc node rest hget
+      omega
+    · have hold : store.get? parent = some parentBox :=
+        get?_of_decRcStore_other heq hget hparent
+      have hcount := h.counts hold
+      rw [incoming_decRcStore_other store loc rc node rest heq hget]
+      exact hcount
+
+/-! The abstract store transitions above are definitionally the successful
+branches of the executable evaluator. -/
+
+private theorem bindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    (Except.ok value >>= next) = next value := rfl
+
+private theorem bindErr {error α β : Type} (err : error)
+    (next : α → Except error β) :
+    ((Except.error err : Except error α) >>= next) = .error err := rfl
+
+/-! A `case` dispatch borrows its scrutinee and fields: selecting a branch
+does not mutate the store or add roots. The selected branch is responsible
+for every retain/release operation. -/
+
+theorem RootOwnership.caseFieldsBorrowed {store : Store} {roots : List Root}
+    {loc rc : Nat} {world : Owned} {cid : CtorId} {fields : Array RVal}
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (hown : RootOwnership store roots) :
+    ∀ field ∈ fields.toList, HasWorld store world field := by
+  intro field hfield
+  exact hown.edges_world hget field (by simpa [nodeChildren] using hfield)
+
+/-- Constructor-case dispatch is definitionally just entry into the selected
+alternative with borrowed fields prepended to the environment. -/
+theorem runCode_case_ctor {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {scrut : Atom} {peelNat : Bool}
+    {alts : Array Alt} {loc rc : Nat} {world : Owned} {cid : CtorId}
+    {fields : Array RVal} {tag nf : Nat} {body : Code}
+    (hresolve : resolveAtom env scrut = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (halt : alts.find? (fun alt => alt.cidx == cid.cidx) =
+      some (.mk tag nf body))
+    (hsize : fields.size = nf) :
+    runCode ctx (fuel + 1) cur store env (.case scrut peelNat alts) =
+      runCode ctx fuel cur store
+        (fields.foldl (fun e field => field :: e) env) body := by
+  rw [runCode.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [hget]
+  dsimp only
+  rw [halt]
+  simp [hsize]
+
+/-- Exact constructor-case interface. The dispatcher preserves the incoming
+root invariant and exposes only borrowed fields; a branch proof performs the
+actual ownership transformation. -/
+theorem runCode_case_ctor_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {scrut : Atom}
+    {peelNat : Bool} {alts : Array Alt} {loc rc : Nat} {world : Owned}
+    {cid : CtorId} {fields : Array RVal} {tag nf : Nat} {body : Code}
+    {value : RVal} {roots : List Root} {rest : List Root}
+    (hresolve : resolveAtom env scrut = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (halt : alts.find? (fun alt => alt.cidx == cid.cidx) =
+      some (.mk tag nf body))
+    (hsize : fields.size = nf)
+    (hown : RootOwnership store roots)
+    (hbranch : RootOwnership store roots →
+      (∀ field ∈ fields.toList, HasWorld store world field) →
+      runCode ctx fuel cur store
+          (fields.foldl (fun e field => field :: e) env) body =
+        .ok (store', value) →
+      RootOwnership store' (⟨cur.result, value⟩ :: rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut peelNat alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_ctor hresolve hget halt hsize] at hrun
+  exact hbranch hown (hown.caseFieldsBorrowed hget) hrun
+
+/-- Constructor dispatch through a reusable alternative contract. The case
+instruction supplies the field borrows; the selected alternative accounts
+for every retain/release and preserves the caller continuation. -/
+theorem runCode_case_ctor_contract_owned {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {scrut : Atom} {peelNat : Bool} {alts : Array Alt} {loc rc : Nat}
+    {world : Owned} {cid : CtorId} {fields : Array RVal} {tag nf : Nat}
+    {body : Code} {value : RVal} {rest : List Root}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hresolve : resolveAtom env scrut = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (halt : alts.find? (fun alt => alt.cidx == cid.cidx) =
+      some (.mk tag nf body))
+    (hsize : fields.size = nf)
+    (hcontract : AltOwnershipContract ctx cur (.mk tag nf body)
+      world entryValid entryRoots)
+    (hvalid : entryValid env fields)
+    (hown : RootOwnership store (entryRoots env fields ++ rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut peelNat alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_ctor hresolve hget halt hsize] at hrun
+  exact hcontract.preserves hsize hvalid hown
+    (hown.caseFieldsBorrowed hget) hrun
+
+/-- A peeled zero literal enters the nullary alternative without changing
+the store, environment, or roots. -/
+theorem runCode_case_nat_zero {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {scrut : Atom} {alts : Array Alt}
+    {tag : Nat} {body : Code}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat 0)))
+    (halt : alts.find? (fun alt => alt.cidx == 0) =
+      some (.mk tag 0 body)) :
+    runCode ctx (fuel + 1) cur store env (.case scrut true alts) =
+      runCode ctx fuel cur store env body := by
+  rw [runCode.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [halt]
+  simp
+
+/-- A peeled successor literal exposes its predecessor as an ownership-inert
+literal binding. -/
+theorem runCode_case_nat_succ {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {scrut : Atom} {alts : Array Alt}
+    {n tag : Nat} {body : Code}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat (n + 1))))
+    (halt : alts.find? (fun alt => alt.cidx == 1) =
+      some (.mk tag 1 body)) :
+    runCode ctx (fuel + 1) cur store env (.case scrut true alts) =
+      runCode ctx fuel cur store (.lit (.nat n) :: env) body := by
+  rw [runCode.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [halt]
+  simp
+
+/-- Exact root preservation wrapper for a peeled zero branch. -/
+theorem runCode_case_nat_zero_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {scrut : Atom}
+    {alts : Array Alt} {tag : Nat} {body : Code} {value : RVal}
+    {roots rest : List Root}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat 0)))
+    (halt : alts.find? (fun alt => alt.cidx == 0) =
+      some (.mk tag 0 body))
+    (hown : RootOwnership store roots)
+    (hbranch : RootOwnership store roots →
+      runCode ctx fuel cur store env body = .ok (store', value) →
+      RootOwnership store' (⟨cur.result, value⟩ :: rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut true alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_nat_zero hresolve halt] at hrun
+  exact hbranch hown hrun
+
+/-- Exact root preservation wrapper for a peeled successor branch. -/
+theorem runCode_case_nat_succ_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {scrut : Atom}
+    {alts : Array Alt} {n tag : Nat} {body : Code} {value : RVal}
+    {roots rest : List Root}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat (n + 1))))
+    (halt : alts.find? (fun alt => alt.cidx == 1) =
+      some (.mk tag 1 body))
+    (hown : RootOwnership store roots)
+    (hbranch : RootOwnership store roots →
+      runCode ctx fuel cur store (.lit (.nat n) :: env) body =
+        .ok (store', value) →
+      RootOwnership store' (⟨cur.result, value⟩ :: rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut true alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_nat_succ hresolve halt] at hrun
+  exact hbranch hown hrun
+
+/-- Peeled zero dispatch through the same alternative-contract interface as
+constructor cases. Its exposed field array is empty. -/
+theorem runCode_case_nat_zero_contract_owned {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {scrut : Atom} {alts : Array Alt} {tag : Nat} {body : Code}
+    {value : RVal} {rest : List Root} {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat 0)))
+    (halt : alts.find? (fun alt => alt.cidx == 0) =
+      some (.mk tag 0 body))
+    (hcontract : AltOwnershipContract ctx cur (.mk tag 0 body)
+      fieldWorld entryValid entryRoots)
+    (hvalid : entryValid env #[])
+    (hown : RootOwnership store (entryRoots env #[] ++ rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut true alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_nat_zero hresolve halt] at hrun
+  apply hcontract.preserves (fields := #[]) (by simp) hvalid hown
+  · simp
+  · simpa using hrun
+
+/-- Peeled successor dispatch exposes its scalar predecessor as a borrowed
+unary field and then applies the selected alternative contract. -/
+theorem runCode_case_nat_succ_contract_owned {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {scrut : Atom} {alts : Array Alt} {n tag : Nat} {body : Code}
+    {value : RVal} {rest : List Root} {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat (n + 1))))
+    (halt : alts.find? (fun alt => alt.cidx == 1) =
+      some (.mk tag 1 body))
+    (hcontract : AltOwnershipContract ctx cur (.mk tag 1 body)
+      fieldWorld entryValid entryRoots)
+    (hvalid : entryValid env #[.lit (.nat n)])
+    (hown : RootOwnership store
+      (entryRoots env #[.lit (.nat n)] ++ rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut true alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_nat_succ hresolve halt] at hrun
+  apply hcontract.preserves (fields := #[.lit (.nat n)]) (by simp)
+    hvalid hown
+  · intro field hfield
+    have : field = .lit (.nat n) := by simpa using hfield
+    subst field
+    trivial
+  · simpa using hrun
+
+/-- Constructor dispatch through an alternative contract available below
+the enclosing case fuel. -/
+theorem runCode_case_ctor_contract_owned_below {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {scrut : Atom} {peelNat : Bool} {alts : Array Alt} {loc rc : Nat}
+    {world : Owned} {cid : CtorId} {fields : Array RVal} {tag nf : Nat}
+    {body : Code} {value : RVal} {rest : List Root}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hresolve : resolveAtom env scrut = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (halt : alts.find? (fun alt => alt.cidx == cid.cidx) =
+      some (.mk tag nf body))
+    (hsize : fields.size = nf)
+    (hcontract : AltOwnershipContractBelow ctx cur (.mk tag nf body)
+      world entryValid entryRoots (fuel + 1))
+    (hvalid : entryValid env fields)
+    (hown : RootOwnership store (entryRoots env fields ++ rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut peelNat alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_ctor hresolve hget halt hsize] at hrun
+  exact hcontract.preserves (Nat.lt_succ_self fuel) hsize hvalid hown
+    (hown.caseFieldsBorrowed hget) hrun
+
+/-- Peeled-zero dispatch through a bounded nullary alternative contract. -/
+theorem runCode_case_nat_zero_contract_owned_below
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store store' : Store}
+    {env : List RVal} {scrut : Atom} {alts : Array Alt} {tag : Nat}
+    {body : Code} {value : RVal} {rest : List Root}
+    {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat 0)))
+    (halt : alts.find? (fun alt => alt.cidx == 0) =
+      some (.mk tag 0 body))
+    (hcontract : AltOwnershipContractBelow ctx cur (.mk tag 0 body)
+      fieldWorld entryValid entryRoots (fuel + 1))
+    (hvalid : entryValid env #[])
+    (hown : RootOwnership store (entryRoots env #[] ++ rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut true alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_nat_zero hresolve halt] at hrun
+  apply hcontract.preserves (fields := #[]) (Nat.lt_succ_self fuel)
+    (by simp) hvalid hown
+  · simp
+  · simpa using hrun
+
+/-- Peeled-successor dispatch through a bounded unary alternative
+contract. -/
+theorem runCode_case_nat_succ_contract_owned_below
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store store' : Store}
+    {env : List RVal} {scrut : Atom} {alts : Array Alt} {n tag : Nat}
+    {body : Code} {value : RVal} {rest : List Root}
+    {fieldWorld : Owned}
+    {entryValid : List RVal → Array RVal → Prop}
+    {entryRoots : List RVal → Array RVal → List Root}
+    (hresolve : resolveAtom env scrut = .ok (.lit (.nat (n + 1))))
+    (halt : alts.find? (fun alt => alt.cidx == 1) =
+      some (.mk tag 1 body))
+    (hcontract : AltOwnershipContractBelow ctx cur (.mk tag 1 body)
+      fieldWorld entryValid entryRoots (fuel + 1))
+    (hvalid : entryValid env #[.lit (.nat n)])
+    (hown : RootOwnership store
+      (entryRoots env #[.lit (.nat n)] ++ rest))
+    (hrun : runCode ctx (fuel + 1) cur store env
+      (.case scrut true alts) = .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runCode_case_nat_succ hresolve halt] at hrun
+  apply hcontract.preserves (fields := #[.lit (.nat n)])
+    (Nat.lt_succ_self fuel) (by simp) hvalid hown
+  · intro field hfield
+    have : field = .lit (.nat n) := by simpa using hfield
+    subst field
+    trivial
+  · simpa using hrun
+
+theorem dupVals_single {store : Store} {loc rc : Nat} {node : Node}
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    dupVals store [.loc loc] =
+      .ok (incRcStore store loc ⟨.shared, rc, node⟩) := by
+  simp [dupVals, hget, incRcStore]
+
+/-- `dupVals` turns one borrowed shared value into one owned root. Locations
+increment once; scalar roots are ownership-inert. -/
+theorem dupVals_borrowed_preserves {store store' : Store}
+    {value : RVal} {roots : List Root}
+    (hown : RootOwnership store roots)
+    (hworld : HasWorld store .shared value)
+    (heval : dupVals store [value] = .ok store') :
+    RootOwnership store' (⟨.shared, value⟩ :: roots) := by
+  cases value with
+  | lit literal =>
+    simp [dupVals] at heval
+    subst store'
+    exact hown.addNoLocation rfl
+  | erased =>
+    simp [dupVals] at heval
+    subst store'
+    exact hown.addNoLocation rfl
+  | loc loc =>
+    obtain ⟨box, hget, hboxWorld⟩ := hworld
+    cases box with
+    | mk world rc node =>
+      change world = .shared at hboxWorld
+      subst world
+      rw [dupVals_single hget] at heval
+      injection heval with hstore
+      subst store'
+      exact hown.retainShared hget
+
+/-- Duplicating shared values cannot invalidate the world of any value that
+was live beforehand. -/
+private theorem dupVals_hasWorld {store store' : Store}
+    {values : List RVal}
+    (heval : dupVals store values = .ok store') :
+    ∀ {world value}, HasWorld store world value →
+      HasWorld store' world value := by
+  induction values generalizing store with
+  | nil =>
+    change (.ok store : Except Err Store) = .ok store' at heval
+    injection heval with hstore
+    subst store'
+    exact fun h => h
+  | cons head tail ih =>
+    cases head with
+    | lit literal =>
+      simp only [dupVals, List.foldlM_cons] at heval
+      exact ih heval
+    | erased =>
+      simp only [dupVals, List.foldlM_cons] at heval
+      exact ih heval
+    | loc loc =>
+      simp only [dupVals, List.foldlM_cons] at heval
+      cases hget : store.get? loc with
+      | none => simp [hget, bindErr] at heval
+      | some box =>
+        cases box with
+        | mk boxWorld rc node =>
+          cases boxWorld with
+          | unique => simp [hget, bindErr] at heval
+          | shared =>
+            simp only [hget] at heval
+            exact ih heval ∘ HasWorld.incRcStore hget
+
+private theorem dupVals_cons_ok_inv {store store' : Store}
+    {head : RVal} {tail : List RVal}
+    (heval : dupVals store (head :: tail) = .ok store') :
+    ∃ middle, dupVals store [head] = .ok middle ∧
+      dupVals middle tail = .ok store' := by
+  rw [show head :: tail = [head] ++ tail by rfl, dupVals,
+    List.foldlM_append] at heval
+  change (dupVals store [head] >>= fun middle => dupVals middle tail) =
+    .ok store' at heval
+  cases hmiddle : dupVals store [head] with
+  | error err =>
+    rw [hmiddle, bindErr] at heval
+    contradiction
+  | ok middle =>
+    refine ⟨middle, rfl, ?_⟩
+    rw [hmiddle, bindOk] at heval
+    exact heval
+
+/-- Retaining one shared value changes at most a refcount and therefore
+preserves every pre-existing live node shape. -/
+private theorem dupVals_single_extends {store store' : Store}
+    {value : RVal} (heval : dupVals store [value] = .ok store') :
+    StoreGraphExtends store store' := by
+  cases value with
+  | lit literal =>
+    simp [dupVals] at heval
+    subst store'
+    exact StoreGraphExtends.refl store
+  | erased =>
+    simp [dupVals] at heval
+    subst store'
+    exact StoreGraphExtends.refl store
+  | loc loc =>
+    cases hget : store.get? loc with
+    | none => simp [dupVals, hget] at heval
+    | some box =>
+      cases box with
+      | mk world rc node =>
+        cases world with
+        | unique => simp [dupVals, hget] at heval
+        | shared =>
+          have hresult :
+              (store.setBox loc
+                ⟨.shared, rc + 1, node⟩).rcTick = store' := by
+            simpa [dupVals, hget] using heval
+          subst store'
+          intro other otherWorld otherRc otherNode hother
+          exact (StoreGraphExtends.incRcStore hget) hother
+
+/-- `dupVals` is a sequence of refcount-only extensions. -/
+theorem dupVals_extends {store store' : Store} {values : List RVal}
+    (heval : dupVals store values = .ok store') :
+    StoreGraphExtends store store' := by
+  induction values generalizing store with
+  | nil =>
+    change (.ok store : Except Err Store) = .ok store' at heval
+    injection heval with hstore
+    subst store'
+    exact StoreGraphExtends.refl store
+  | cons head tail ih =>
+    obtain ⟨middle, hhead, htail⟩ := dupVals_cons_ok_inv heval
+    exact StoreGraphExtends.trans (dupVals_single_extends hhead)
+      (ih htail)
+
+/-- `dupVals` turns a list of borrowed shared values into owned roots. -/
+theorem dupVals_borrowedMany_preserves {store store' : Store}
+    {values : List RVal} {roots : List Root}
+    (hown : RootOwnership store roots)
+    (hworld : ∀ value ∈ values, HasWorld store .shared value)
+    (heval : dupVals store values = .ok store') :
+    RootOwnership store' (rootsFor .shared values ++ roots) := by
+  induction values generalizing store roots with
+  | nil =>
+    change (.ok store : Except Err Store) = .ok store' at heval
+    injection heval with hstore
+    subst store'
+    simpa [rootsFor] using hown
+  | cons head tail ih =>
+    obtain ⟨middle, hheadEval, htailEval⟩ := dupVals_cons_ok_inv heval
+    have hheadWorld : HasWorld store .shared head :=
+      hworld head (by simp)
+    have hmiddle : RootOwnership middle (⟨.shared, head⟩ :: roots) :=
+      dupVals_borrowed_preserves hown hheadWorld hheadEval
+    have htailWorld : ∀ value ∈ tail,
+        HasWorld middle .shared value := by
+      intro value hvalue
+      exact dupVals_hasWorld hheadEval (hworld value (by simp [hvalue]))
+    have htail := ih hmiddle htailWorld htailEval
+    apply htail.perm
+    simpa [rootsFor, List.append_assoc] using
+      (List.perm_append_comm (l₁ := rootsFor .shared tail)
+        (l₂ := [(⟨.shared, head⟩ : Root)])).append_right roots
+
+theorem runOp_dup {ctx : Ctx} {fuel : Nat} {cur : FnDef} {store : Store}
+    {env : List RVal} {target : Atom} {loc rc : Nat} {node : Node}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    runOp ctx (fuel + 1) cur store env (.dup target) =
+      .ok (incRcStore store loc ⟨.shared, rc, node⟩, .loc loc) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve]
+  rw [bindOk]
+  simp only
+  rw [hget]
+  rfl
+
+/-- Executing `dup` on a borrowed shared value retains it as one owned root.
+This is the operation-level interface used immediately after `fetch`. -/
+theorem runOp_retain_borrowed {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {value : RVal}
+    {roots : List Root}
+    (hresolve : resolveAtom env target = .ok value)
+    (hworld : HasWorld store .shared value)
+    (hown : RootOwnership store roots) :
+    ∃ store',
+      runOp ctx (fuel + 1) cur store env (.dup target) =
+          .ok (store', value) ∧
+        RootOwnership store' (⟨.shared, value⟩ :: roots) := by
+  cases value with
+  | lit literal =>
+    refine ⟨store, ?_, hown.addNoLocation rfl⟩
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+  | erased =>
+    refine ⟨store, ?_, hown.addNoLocation rfl⟩
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+  | loc loc =>
+    obtain ⟨box, hget, hboxWorld⟩ := hworld
+    cases box with
+    | mk world rc node =>
+      change world = .shared at hboxWorld
+      subst world
+      refine ⟨incRcStore store loc ⟨.shared, rc, node⟩,
+        runOp_dup hresolve hget, hown.retainShared hget⟩
+
+/-- Semantic strengthening of `runOp_retain_borrowed`: refcount-only store
+updates preserve the pure value graph for the retained result. -/
+theorem runOp_retain_borrowed_valueGraph
+    {funRel : FunctionRel} {sourceValue : IxIR0.Value}
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {value : RVal}
+    {roots : List Root}
+    (hresolve : resolveAtom env target = .ok value)
+    (hworld : HasWorld store .shared value)
+    (hgraph : ValueGraph funRel store sourceValue value)
+    (hown : RootOwnership store roots) :
+    ∃ store',
+      runOp ctx (fuel + 1) cur store env (.dup target) =
+          .ok (store', value) ∧
+      StoreGraphExtends store store' ∧
+      ValueGraph funRel store' sourceValue value ∧
+      RootOwnership store' (⟨.shared, value⟩ :: roots) := by
+  cases value with
+  | lit literal =>
+    refine ⟨store, ?_, StoreGraphExtends.refl store, hgraph,
+      hown.addNoLocation rfl⟩
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+  | erased =>
+    refine ⟨store, ?_, StoreGraphExtends.refl store, hgraph,
+      hown.addNoLocation rfl⟩
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+  | loc loc =>
+    obtain ⟨box, hget, hboxWorld⟩ := hworld
+    cases box with
+    | mk world rc node =>
+      change world = .shared at hboxWorld
+      subst world
+      let store' := incRcStore store loc ⟨.shared, rc, node⟩
+      have hstore : StoreGraphExtends store store' :=
+        StoreGraphExtends.incRcStore hget
+      refine ⟨store', runOp_dup hresolve hget, hstore,
+        hgraph.monoStore hstore, hown.retainShared hget⟩
+
+/-- Retaining one borrowed field preserves shared-world evidence for every
+other field that a later step may retain. Locations transport through the
+single RC update; scalar evidence is unchanged. -/
+theorem runOp_retain_borrowed_preserves_hasWorlds
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {value : RVal}
+    {roots : List Root} {borrowed : List RVal}
+    (hresolve : resolveAtom env target = .ok value)
+    (hworld : HasWorld store .shared value)
+    (hown : RootOwnership store roots)
+    (hborrowed : ∀ candidate ∈ borrowed,
+      HasWorld store .shared candidate) :
+    ∃ store',
+      runOp ctx (fuel + 1) cur store env (.dup target) =
+          .ok (store', value) ∧
+        RootOwnership store' (⟨.shared, value⟩ :: roots) ∧
+        ∀ candidate ∈ borrowed,
+          HasWorld store' .shared candidate := by
+  cases value with
+  | lit literal =>
+    refine ⟨store, ?_, hown.addNoLocation rfl, hborrowed⟩
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+  | erased =>
+    refine ⟨store, ?_, hown.addNoLocation rfl, hborrowed⟩
+    rw [runOp.eq_def]
+    dsimp only
+    rw [hresolve, bindOk]
+  | loc loc =>
+    obtain ⟨box, hget, hboxWorld⟩ := hworld
+    cases box with
+    | mk world rc node =>
+      change world = .shared at hboxWorld
+      subst world
+      refine ⟨incRcStore store loc ⟨.shared, rc, node⟩,
+        runOp_dup hresolve hget, hown.retainShared hget, ?_⟩
+      intro candidate hmem
+      exact HasWorld.incRcStore hget (hborrowed candidate hmem)
+
+theorem runOp_reuse {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {cid : CtorId}
+    {args : Array Atom} {values : List RVal} {loc rc : Nat}
+    {oldNode : Node}
+    (hargs : resolveAtoms env args = .ok values)
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨.unique, rc, oldNode⟩) :
+    runOp ctx (fuel + 1) cur store env (.reuse target cid args) =
+      .ok (reuseNodeStore store loc (.ctorN cid values.toArray), .loc loc) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hargs, bindOk]
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [hget]
+  dsimp only
+  rw [reuseNodeStore_eq_direct]
+
+/-- Exact ownership transfer across a direct invocation from a contract
+available below the invocation fuel. A successful invocation at `fuel + 1`
+runs the callee body at `fuel`, so the bound is strict exactly where the
+mutual declaration induction needs it. -/
+theorem invoke_fn_owned_below {ctx : Ctx} {fuel : Nat} {f : Address}
+    {argWorlds : List Owned} {args : List RVal} {store store' : Store}
+    {value : RVal} {rest : List Root} {d : FnDef}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContractBelow ctx d argWorlds fuel)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest))
+    (hinvoke : invoke ctx fuel f args store = .ok (store', value)) :
+    RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  cases fuel with
+  | zero => simp [invoke] at hinvoke
+  | succ fuel =>
+    simp only [invoke, hdecl] at hinvoke
+    split at hinvoke
+    · contradiction
+    next hlen =>
+      have hargsLength : args.length = argWorlds.length := by
+        have hd : args.length = d.arity := by simpa using hlen
+        exact hd.trans hcontract.arity_eq.symm
+      cases hrun : runCode ctx fuel d store args.reverse d.body with
+      | error e =>
+        rw [hrun] at hinvoke
+        change (.error e : Except Err (Store × RVal)) =
+          .ok (store', value) at hinvoke
+        contradiction
+      | ok out =>
+        rw [hrun] at hinvoke
+        change checkResultWorld d.result out = .ok (store', value) at hinvoke
+        obtain ⟨hpair, _⟩ := checkResultWorld_ok hinvoke
+        subst out
+        exact hcontract.preserves (Nat.lt_succ_self fuel)
+          hargsLength hown hrun
+
+/-- Exact ownership transfer across a successful direct invocation: the
+callee consumes its argument roots and returns one root in its declared
+world, while every unrelated continuation root is preserved. -/
+theorem invoke_fn_owned {ctx : Ctx} {fuel : Nat} {f : Address}
+    {argWorlds : List Owned} {args : List RVal} {store store' : Store}
+    {value : RVal} {rest : List Root} {d : FnDef}
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d argWorlds)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest))
+    (hinvoke : invoke ctx fuel f args store = .ok (store', value)) :
+    RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  exact invoke_fn_owned_below hdecl (hcontract.below fuel) hown hinvoke
+
+private theorem rootsForWorlds_replicate_eq_rootsFor_apply (world : Owned) :
+    ∀ {values : List RVal} {count : Nat}, values.length = count →
+      rootsForWorlds (List.replicate count world) values =
+        rootsFor world values := by
+  intro values count hlength
+  induction values generalizing count with
+  | nil =>
+    cases count <;> simp_all [rootsFor, rootsForWorlds]
+  | cons value values ih =>
+    cases count with
+    | zero => simp at hlength
+    | succ count =>
+      simp only [List.length_cons, Nat.succ.injEq] at hlength
+      simp [List.replicate_succ, rootsFor, ih hlength]
+
+/-- Invocation through a declaration approved for shared PAP entry consumes
+shared argument roots and returns one shared root. Successful extern calls are
+covered by their scalar-only ABI. -/
+theorem invoke_papSafe_owned_below {ctx : Ctx} {fuel : Nat}
+    (hdecls : PapSafeDeclContractsBelow ctx fuel)
+    {address : Address} {d : Decl} {args : List RVal}
+    {store store' : Store} {value : RVal} {rest : List Root}
+    (hdecl : ctx.decls address = some d)
+    (hpapSafe : declPapSafe d = true)
+    (hown : RootOwnership store (rootsFor .shared args ++ rest))
+    (hrun : invoke ctx fuel address args store = .ok (store', value)) :
+    RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  cases d with
+  | fn fnDef =>
+    obtain ⟨hresult, hcontract⟩ := hdecls.fn hdecl hpapSafe
+    have hworlds : rootsForWorlds
+        (List.replicate fnDef.arity .shared) args =
+          rootsFor .shared args := by
+      have hlength : args.length = fnDef.arity := by
+        cases fuel with
+        | zero => simp [invoke] at hrun
+        | succ innerFuel =>
+          simp only [invoke, hdecl] at hrun
+          split at hrun
+          next hne => contradiction
+          next heq => simpa using heq
+      exact rootsForWorlds_replicate_eq_rootsFor_apply .shared hlength
+    have howned : RootOwnership store
+        (rootsForWorlds (List.replicate fnDef.arity .shared) args ++ rest) := by
+      rwa [hworlds]
+    have hout := invoke_fn_owned_below hdecl hcontract howned hrun
+    rwa [hresult] at hout
+  | extern arity =>
+    cases fuel with
+    | zero => simp [invoke] at hrun
+    | succ innerFuel =>
+      simp only [invoke, hdecl] at hrun
+      split at hrun
+      next hne => contradiction
+      next heq =>
+        cases hcall : callScalarOracle ctx address args with
+        | error err =>
+          rw [hcall] at hrun
+          contradiction
+        | ok result =>
+          rw [hcall] at hrun
+          simp only at hrun
+          injection hrun with hpair
+          cases hpair
+          have hscalar := callScalarOracle_ok hcall
+          exact (hown.dropScalars hscalar.1).addNoLocation
+            (RVal.rvalLocation?_eq_none_of_isScalar hscalar.2)
+
+/-- The evaluator-level interface for a lowered direct call: resolving the
+argument atoms and successfully invoking a function establishes the declared
+world of the returned value. Exact root conservation is the next call proof. -/
+theorem runOp_call_result_hasWorld {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {f : Address}
+    {args : Array Atom} {values : List RVal} {value : RVal} {d : FnDef}
+    (hargs : resolveAtoms env args = .ok values)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hrun : runOp ctx (fuel + 1) cur store env (.call f args) =
+      .ok (store', value)) :
+    HasWorld store' d.result value := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hargs, bindOk] at hrun
+  exact invoke_fn_result_hasWorld hdecl hrun
+
+/-- Exact operation-level direct-call interface under the bounded contract
+environment used by the mutual compiler induction. -/
+theorem runOp_call_owned_below {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {f : Address}
+    {atoms : Array Atom} {args : List RVal} {value : RVal} {d : FnDef}
+    {argWorlds : List Owned} {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContractBelow ctx d argWorlds fuel)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.call f atoms) =
+      .ok (store', value)) :
+    RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hargs, bindOk] at hrun
+  exact invoke_fn_owned_below hdecl hcontract hown hrun
+
+/-- Exact operation-level direct-call interface used by completed compiler
+contracts. -/
+theorem runOp_call_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {f : Address}
+    {atoms : Array Atom} {args : List RVal} {value : RVal} {d : FnDef}
+    {argWorlds : List Owned} {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls f = some (.fn d))
+    (hcontract : FnOwnershipContract ctx d argWorlds)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.call f atoms) =
+      .ok (store', value)) :
+    RootOwnership store' (⟨d.result, value⟩ :: rest) := by
+  exact runOp_call_owned_below hargs hdecl (hcontract.below fuel) hown hrun
+
+/-- Exact operation-level interface for unknown higher-order application
+under the bounded contract used by the mutual fuel induction. -/
+theorem runOp_apply_owned_below {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {functionAtom : Atom}
+    {function : RVal} {atoms : Array Atom} {args : List RVal}
+    {value : RVal} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hcontract : ApplyOwnershipContractBelow ctx (fuel + 1))
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env
+      (.apply functionAtom atoms) = .ok (store', value)) :
+    RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hfunction, bindOk, hargs, bindOk] at hrun
+  exact hcontract.preserves (Nat.lt_succ_self fuel) hown hrun
+
+/-- Exact operation-level interface for unknown higher-order application.
+The context contract hides pap saturation/over-application recursion while
+retaining the ownership boundary required by `applyRest`. -/
+theorem runOp_apply_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {functionAtom : Atom}
+    {function : RVal} {atoms : Array Atom} {args : List RVal}
+    {value : RVal} {rest : List Root}
+    (hfunction : resolveAtom env functionAtom = .ok function)
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hcontract : ApplyOwnershipContract ctx)
+    (hown : RootOwnership store
+      (⟨.shared, function⟩ :: rootsFor .shared args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env
+      (.apply functionAtom atoms) = .ok (store', value)) :
+    RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  exact runOp_apply_owned_below hfunction hargs
+    (hcontract.below (fuel + 1)) hown hrun
+
+/-- `callSelf` enforces the same result-world contract from the current
+function frame. -/
+theorem runOp_callSelf_result_hasWorld {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {args : Array Atom} {values : List RVal} {value : RVal}
+    (hargs : resolveAtoms env args = .ok values)
+    (hrun : runOp ctx (fuel + 1) cur store env (.callSelf args) =
+      .ok (store', value)) :
+    HasWorld store' cur.result value := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hargs, bindOk] at hrun
+  split at hrun
+  · contradiction
+  · cases hcode : runCode ctx fuel cur store values.reverse cur.body with
+    | error e =>
+      rw [hcode] at hrun
+      change (.error e : Except Err (Store × RVal)) =
+        .ok (store', value) at hrun
+      contradiction
+    | ok out =>
+      rw [hcode] at hrun
+      change checkResultWorld cur.result out = .ok (store', value) at hrun
+      obtain ⟨hpair, hw⟩ := checkResultWorld_ok hrun
+      subst out
+      exact hw
+
+/-- Exact ownership transfer for a recursive self call from a contract
+available below the operation's fuel bound. The evaluator enters `cur.body`
+at `fuel`, strictly below `fuel + 1`; this is the operational decrease used
+by the mutual declaration-contract seal. -/
+theorem runOp_callSelf_owned_below {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {atoms : Array Atom}
+    {args : List RVal} {value : RVal} {argWorlds : List Owned}
+    {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hcontract : FnOwnershipContractBelow ctx cur argWorlds (fuel + 1))
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.callSelf atoms) =
+      .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hargs, bindOk] at hrun
+  split at hrun
+  · contradiction
+  next hlen =>
+    have hargsLength : args.length = argWorlds.length := by
+      have hd : args.length = cur.arity := by simpa using hlen
+      exact hd.trans hcontract.arity_eq.symm
+    cases hcode : runCode ctx fuel cur store args.reverse cur.body with
+    | error e =>
+      rw [hcode] at hrun
+      change (.error e : Except Err (Store × RVal)) =
+        .ok (store', value) at hrun
+      contradiction
+    | ok out =>
+      rw [hcode] at hrun
+      change checkResultWorld cur.result out = .ok (store', value) at hrun
+      obtain ⟨hpair, _⟩ := checkResultWorld_ok hrun
+      subst out
+      exact hcontract.preserves (Nat.lt_succ_self fuel)
+        hargsLength hown hcode
+
+/-- Exact ownership transfer for recursive self calls, under the current
+function's public semantic contract. -/
+theorem runOp_callSelf_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {atoms : Array Atom}
+    {args : List RVal} {value : RVal} {argWorlds : List Owned}
+    {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hcontract : FnOwnershipContract ctx cur argWorlds)
+    (hown : RootOwnership store
+      (rootsForWorlds argWorlds args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.callSelf atoms) =
+      .ok (store', value)) :
+    RootOwnership store' (⟨cur.result, value⟩ :: rest) := by
+  exact runOp_callSelf_owned_below hargs (hcontract.below (fuel + 1))
+    hown hrun
+
+/-- Exact ownership transfer across the scalar-only extern ABI. Successful
+evaluation proves every argument and the result scalar, so argument roots
+are ownership-inert, the store is unchanged, and the result may be recorded
+in either demanded world. -/
+theorem runOp_extern_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {f : Address}
+    {atoms : Array Atom} {args : List RVal} {value : RVal}
+    {resultWorld : Owned} {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok args)
+    (hown : RootOwnership store (rootsFor .shared args ++ rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.extern f atoms) =
+      .ok (store', value)) :
+    RootOwnership store' (⟨resultWorld, value⟩ :: rest) := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hargs, bindOk] at hrun
+  cases horacle : callScalarOracle ctx f args with
+  | error err =>
+    rw [horacle] at hrun
+    change (Except.error err : Except Err (Store × RVal)) =
+      .ok (store', value) at hrun
+    contradiction
+  | ok result =>
+    rw [horacle] at hrun
+    change (Except.ok (store, result) : Except Err (Store × RVal)) =
+      .ok (store', value) at hrun
+    have hpair : (store, result) = (store', value) := Except.ok.inj hrun
+    cases hpair
+    have hscalar := callScalarOracle_ok horacle
+    exact (hown.dropScalars hscalar.1).addNoLocation
+      (RVal.rvalLocation?_eq_none_of_isScalar hscalar.2)
+
+theorem runOp_pure {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {value : RVal}
+    (hresolve : resolveAtom env target = .ok value) :
+    runOp ctx (fuel + 1) cur store env (.pure target) =
+      .ok (store, value) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+
+/-- The lowering emits `pure` for scalar constants. Binding that result adds
+an ownership-inert root in whichever world the continuation demands. -/
+theorem runOp_pure_scalar_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {value : RVal}
+    {world : Owned} {roots : List Root}
+    (hresolve : resolveAtom env target = .ok value)
+    (hnone : rvalLocation? value = none)
+    (hown : RootOwnership store roots) :
+    runOp ctx (fuel + 1) cur store env (.pure target) =
+        .ok (store, value) ∧
+      RootOwnership store (⟨world, value⟩ :: roots) :=
+  ⟨runOp_pure hresolve, hown.addNoLocation hnone⟩
+
+theorem runOp_alloc {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {world : Owned} {cid : CtorId}
+    {args : Array Atom} {values : List RVal}
+    (hresolve : resolveAtoms env args = .ok values) :
+    runOp ctx (fuel + 1) cur store env (.alloc world cid args) =
+      .ok ((store.allocNode world (.ctorN cid values.toArray)).1,
+        .loc (store.allocNode world (.ctorN cid values.toArray)).2) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+
+theorem runOp_free {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {loc rc : Nat}
+    {node : Node}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨.unique, rc, node⟩) :
+    runOp ctx (fuel + 1) cur store env (.free target) =
+      .ok (store.kill loc, .erased) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [hget]
+
+/-- The shallow-free evaluator branch consumes the unique parent root and
+exposes its fields as unique roots, ready for reuse, transfer, or deep drop. -/
+theorem runOp_free_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {loc : Nat}
+    {node : Node} {rest : List Root}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨.unique, 1, node⟩)
+    (hown : RootOwnership store (⟨.unique, .loc loc⟩ :: rest)) :
+    runOp ctx (fuel + 1) cur store env (.free target) =
+        .ok (store.kill loc, .erased) ∧
+      RootOwnership (store.kill loc)
+        (rootsFor .unique (nodeChildren node) ++ rest) :=
+  ⟨runOp_free hresolve hget, hown.killUniqueOne hget⟩
+
+theorem runOp_fetch {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {loc rc i : Nat}
+    {world : Owned} {cid : CtorId} {fields : Array RVal} {value : RVal}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (hfield : fields[i]? = some value) :
+    runOp ctx (fuel + 1) cur store env (.fetch target i) =
+      .ok (store, value) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [hget]
+  dsimp only
+  rw [hfield]
+
+/-- A successful fetch returns an existing node edge as a borrow: the store
+and root multiset are unchanged, while the returned value is known to inhabit
+the parent's world. -/
+theorem RootOwnership.fetchBorrowed {store : Store} {roots : List Root}
+    {loc rc i : Nat} {world : Owned} {cid : CtorId}
+    {fields : Array RVal} {value : RVal}
+    (hget : store.get? loc = some ⟨world, rc, .ctorN cid fields⟩)
+    (hfield : fields[i]? = some value)
+    (h : RootOwnership store roots) : HasWorld store world value := by
+  have harray : value ∈ fields :=
+    (Array.mem_iff_getElem?).2 ⟨i, hfield⟩
+  have hlist : value ∈ fields.toList := by simpa using harray
+  exact h.edges_world hget value (by simpa [nodeChildren] using hlist)
+
+theorem runOp_fetch_borrowed {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {target : Atom} {roots : List Root}
+    {loc rc i : Nat} {cid : CtorId} {fields : Array RVal} {value : RVal}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (hget : store.get? loc = some ⟨.shared, rc, .ctorN cid fields⟩)
+    (hfield : fields[i]? = some value)
+    (hown : RootOwnership store roots) :
+    runOp ctx (fuel + 1) cur store env (.fetch target i) =
+        .ok (store, value) ∧
+      HasWorld store .shared value :=
+  ⟨runOp_fetch hresolve hget hfield, hown.fetchBorrowed hget hfield⟩
+
+/-- Fetch followed by the lowering's retain step produces one owned shared
+field root while retaining every pre-existing root. -/
+theorem fetch_dupVals_preserves {store store' : Store} {roots : List Root}
+    {loc rc i : Nat} {cid : CtorId} {fields : Array RVal} {value : RVal}
+    (hget : store.get? loc = some ⟨.shared, rc, .ctorN cid fields⟩)
+    (hfield : fields[i]? = some value)
+    (hown : RootOwnership store roots)
+    (heval : dupVals store [value] = .ok store') :
+    RootOwnership store' (⟨.shared, value⟩ :: roots) :=
+  dupVals_borrowed_preserves hown (hown.fetchBorrowed hget hfield) heval
+
+theorem runOp_drop {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {target : Atom} {loc : Nat}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (heval : dropVal ctx fuel store (.loc loc) = .ok store') :
+    runOp ctx (fuel + 1) cur store env (.drop target) =
+      .ok (store', .erased) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [heval, bindOk]
+
+theorem runOp_dropU {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {target : Atom} {loc : Nat}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (heval : dropUVal ctx fuel store (.loc loc) = .ok store') :
+    runOp ctx (fuel + 1) cur store env (.dropU target) =
+      .ok (store', .erased) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [hresolve, bindOk]
+  dsimp only
+  rw [heval, bindOk]
+
+theorem dropVal_shared_many {ctx : Ctx} {fuel loc rc : Nat} {store : Store}
+    {node : Node} (hrc : 1 < rc)
+    (hget : store.get? loc = some ⟨.shared, rc, node⟩) :
+    dropVal ctx (fuel + 1) store (.loc loc) =
+      .ok (decRcStore store loc ⟨.shared, rc, node⟩) := by
+  rw [dropVal.eq_def]
+  dsimp only
+  rw [hget]
+  dsimp only
+  have hne : (rc == 1) = false := by
+    rw [beq_eq_false_iff_ne]
+    omega
+  rw [hne]
+  rfl
+
+private def DropPreservesAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ (store : Store) (value : RVal) (rest : List Root) (store' : Store),
+    RootOwnership store (⟨.shared, value⟩ :: rest) →
+    dropVal ctx fuel store value = .ok store' →
+    RootOwnership store' rest) ∧
+  (∀ (store : Store) (values : List RVal) (rest : List Root)
+      (store' : Store),
+    RootOwnership store (rootsFor .shared values ++ rest) →
+    dropMany ctx fuel store values = .ok store' →
+    RootOwnership store' rest)
+
+private theorem dropPreservesAt (ctx : Ctx) : ∀ fuel, DropPreservesAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_⟩
+    · intro store value rest store' hown heval
+      rw [dropVal.eq_def] at heval
+      simp at heval
+    · intro store values rest store' hown heval
+      rw [dropMany.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany⟩ := ih
+    refine ⟨?_, ?_⟩
+    · intro store value rest store' hown heval
+      cases value with
+      | lit literal =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact hown.dropNoLocation rfl
+      | erased =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact hown.dropNoLocation rfl
+      | loc loc =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at heval
+          simp at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => simp at heval
+            | shared =>
+              dsimp only at heval
+              by_cases hrc : rc = 1
+              · subst rc
+                have hbeq : ((1 : Nat) == 1) = true := by decide
+                rw [hbeq] at heval
+                have htickGet :
+                    store.rcTick.get? loc = some ⟨.shared, 1, node⟩ := by
+                  simpa using hget
+                have hkill := (hown.rcTick).killSharedOne htickGet
+                cases node with
+                | ctorN cid fields =>
+                  exact ihMany _ fields.toList rest store' hkill heval
+                | papN fn arity args =>
+                  exact ihMany _ args.toList rest store' hkill heval
+              · have hbeq : (rc == 1) = false := by simp [hrc]
+                rw [hbeq] at heval
+                have hrcPos : 0 < rc := hown.shared_rc_pos hget
+                have hrcMany : 1 < rc := by omega
+                injection heval with hstore
+                subst store'
+                exact hown.dropSharedMany hrcMany hget
+    · intro store values rest store' hown heval
+      cases values with
+      | nil =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        simpa [rootsFor] using hown
+      | cons value values =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropVal ctx fuel store value with
+        | error err =>
+          rw [hfirst, bindErr] at heval
+          simp at heval
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          have hfirstOwn :
+              RootOwnership store
+                (⟨.shared, value⟩ ::
+                  (rootsFor .shared values ++ rest)) := by
+            simpa [rootsFor] using hown
+          have hmiddle :
+              RootOwnership middle (rootsFor .shared values ++ rest) :=
+            ihVal store value _ middle hfirstOwn hfirst
+          exact ihMany middle values rest store' hmiddle heval
+
+/-- Every successful shared drop consumes exactly its input root while
+preserving the exact ownership invariant, including recursive rc-zero
+reclamation. -/
+theorem dropVal_preserves {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {value : RVal} {rest : List Root}
+    (hown : RootOwnership store (⟨.shared, value⟩ :: rest))
+    (heval : dropVal ctx fuel store value = .ok store') :
+    RootOwnership store' rest :=
+  (dropPreservesAt ctx fuel).1 store value rest store' hown heval
+
+/-- Successful sequential shared drops consume precisely the corresponding
+temporary roots. -/
+theorem dropMany_preserves {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {values : List RVal} {rest : List Root}
+    (hown : RootOwnership store (rootsFor .shared values ++ rest))
+    (heval : dropMany ctx fuel store values = .ok store') :
+    RootOwnership store' rest :=
+  (dropPreservesAt ctx fuel).2 store values rest store' hown heval
+
+private def DropRestrictsAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ (store : Store) (value : RVal) (store' : Store),
+    dropVal ctx fuel store value = .ok store' →
+    StoreGraphRestricts store store') ∧
+  (∀ (store : Store) (values : List RVal) (store' : Store),
+    dropMany ctx fuel store values = .ok store' →
+    StoreGraphRestricts store store')
+
+/-- Shared deep drop never changes the world or contents of a node that
+survives it. The mutual induction follows the evaluator's recursive child
+drop exactly; RC-only and kill steps compose through `StoreGraphRestricts`. -/
+private theorem dropRestrictsAt (ctx : Ctx) :
+    ∀ fuel, DropRestrictsAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_⟩
+    · intro store value store' heval
+      rw [dropVal.eq_def] at heval
+      simp at heval
+    · intro store values store' heval
+      rw [dropMany.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany⟩ := ih
+    refine ⟨?_, ?_⟩
+    · intro store value store' heval
+      cases value with
+      | lit literal =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact StoreGraphRestricts.refl store
+      | erased =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact StoreGraphRestricts.refl store
+      | loc loc =>
+        rw [dropVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at heval
+          simp at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | unique => simp at heval
+            | shared =>
+              dsimp only at heval
+              by_cases hrc : rc = 1
+              · subst rc
+                have hbeq : ((1 : Nat) == 1) = true := by decide
+                rw [hbeq] at heval
+                have htickGet :
+                    store.rcTick.get? loc = some ⟨.shared, 1, node⟩ := by
+                  simpa using hget
+                have hprefix : StoreGraphRestricts store
+                    (store.rcTick.kill loc) :=
+                  StoreGraphRestricts.trans
+                    (StoreGraphRestricts.rcTick store)
+                    (StoreGraphRestricts.kill htickGet)
+                cases node with
+                | ctorN cid fields =>
+                  exact StoreGraphRestricts.trans hprefix
+                    (ihMany _ fields.toList _ heval)
+                | papN fn arity args =>
+                  exact StoreGraphRestricts.trans hprefix
+                    (ihMany _ args.toList _ heval)
+              · have hbeq : (rc == 1) = false := by simp [hrc]
+                rw [hbeq] at heval
+                injection heval with hstore
+                subst store'
+                exact StoreGraphRestricts.decRcStore hget
+    · intro store values store' heval
+      cases values with
+      | nil =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact StoreGraphRestricts.refl store
+      | cons value values =>
+        rw [dropMany.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropVal ctx fuel store value with
+        | error err =>
+          rw [hfirst, bindErr] at heval
+          simp at heval
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          exact StoreGraphRestricts.trans
+            (ihVal store value middle hfirst)
+            (ihMany middle values store' heval)
+
+theorem dropVal_restricts {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (heval : dropVal ctx fuel store value = .ok store') :
+    StoreGraphRestricts store store' :=
+  (dropRestrictsAt ctx fuel).1 store value store' heval
+
+theorem dropMany_restricts {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (heval : dropMany ctx fuel store values = .ok store') :
+    StoreGraphRestricts store store' :=
+  (dropRestrictsAt ctx fuel).2 store values store' heval
+
+/-- The common prefix of every successful pap application: retain each
+stored capture, consume the pap root, and expose the stored and newly supplied
+arguments as one owned shared vector. -/
+theorem applyGo_preparePap_owned {ctx : Ctx} {fuel : Nat}
+    {store dupStore readyStore : Store} {loc rc : Nat}
+    {f : Address} {arity : Nat} {got : Array RVal}
+    {args : List RVal} {rest : List Root}
+    (hget : store.get? loc = some
+      ⟨.shared, rc, .papN f arity got⟩)
+    (hown : RootOwnership store
+      (⟨.shared, .loc loc⟩ :: rootsFor .shared args ++ rest))
+    (hdup : dupVals store got.toList = .ok dupStore)
+    (hdrop : dropVal ctx fuel dupStore (.loc loc) = .ok readyStore) :
+    RootOwnership readyStore
+      (rootsFor .shared (got.toList ++ args) ++ rest) := by
+  have hgotWorld : ∀ value ∈ got.toList,
+      HasWorld store .shared value := by
+    intro value hvalue
+    exact hown.edges_world hget value (by simpa [nodeChildren] using hvalue)
+  have hduped : RootOwnership dupStore
+      (rootsFor .shared got.toList ++
+        ⟨.shared, .loc loc⟩ :: rootsFor .shared args ++ rest) := by
+    simpa [List.append_assoc] using
+      dupVals_borrowedMany_preserves hown hgotWorld hdup
+  have hpapFirst : RootOwnership dupStore
+      (⟨.shared, .loc loc⟩ ::
+        rootsFor .shared got.toList ++ rootsFor .shared args ++ rest) := by
+    apply hduped.perm
+    simpa [List.append_assoc] using
+      (List.perm_append_comm
+        (l₁ := rootsFor .shared got.toList)
+        (l₂ := [(⟨.shared, .loc loc⟩ : Root)])).append_right
+          (rootsFor .shared args ++ rest)
+  have hready := dropVal_preserves hpapFirst hdrop
+  simpa [rootsFor, List.append_assoc] using hready
+
+private def DropUPreservesAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ (store : Store) (value : RVal) (rest : List Root) (store' : Store),
+    RootOwnership store (⟨.unique, value⟩ :: rest) →
+    dropUVal ctx fuel store value = .ok store' →
+    RootOwnership store' rest) ∧
+  (∀ (store : Store) (values : List RVal) (rest : List Root)
+      (store' : Store),
+    RootOwnership store (rootsFor .unique values ++ rest) →
+    dropManyU ctx fuel store values = .ok store' →
+    RootOwnership store' rest)
+
+private theorem dropUPreservesAt (ctx : Ctx) :
+    ∀ fuel, DropUPreservesAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_⟩
+    · intro store value rest store' hown heval
+      rw [dropUVal.eq_def] at heval
+      simp at heval
+    · intro store values rest store' hown heval
+      rw [dropManyU.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany⟩ := ih
+    refine ⟨?_, ?_⟩
+    · intro store value rest store' hown heval
+      cases value with
+      | lit literal =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact hown.dropNoLocation rfl
+      | erased =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact hown.dropNoLocation rfl
+      | loc loc =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at heval
+          simp at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => simp at heval
+            | unique =>
+              have hrc : rc = 1 := (hown.counts hget).1
+              subst rc
+              cases node with
+              | ctorN cid fields =>
+                have hkill := hown.killUniqueOne hget
+                exact ihMany _ fields.toList rest store' hkill heval
+              | papN fn arity args => simp at heval
+    · intro store values rest store' hown heval
+      cases values with
+      | nil =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        simpa [rootsFor] using hown
+      | cons value values =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropUVal ctx fuel store value with
+        | error err =>
+          rw [hfirst, bindErr] at heval
+          simp at heval
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          have hfirstOwn :
+              RootOwnership store
+                (⟨.unique, value⟩ ::
+                  (rootsFor .unique values ++ rest)) := by
+            simpa [rootsFor] using hown
+          have hmiddle :
+              RootOwnership middle (rootsFor .unique values ++ rest) :=
+            ihVal store value _ middle hfirstOwn hfirst
+          exact ihMany middle values rest store' hmiddle heval
+
+/-- Every successful unique deep drop consumes exactly its affine root and
+recursively reclaims its constructor tree without touching refcounts. -/
+theorem dropUVal_preserves {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {value : RVal} {rest : List Root}
+    (hown : RootOwnership store (⟨.unique, value⟩ :: rest))
+    (heval : dropUVal ctx fuel store value = .ok store') :
+    RootOwnership store' rest :=
+  (dropUPreservesAt ctx fuel).1 store value rest store' hown heval
+
+/-- Successful sequential unique drops consume precisely their temporary
+child roots. -/
+theorem dropManyU_preserves {ctx : Ctx} {fuel : Nat} {store store' : Store}
+    {values : List RVal} {rest : List Root}
+    (hown : RootOwnership store (rootsFor .unique values ++ rest))
+    (heval : dropManyU ctx fuel store values = .ok store') :
+    RootOwnership store' rest :=
+  (dropUPreservesAt ctx fuel).2 store values rest store' hown heval
+
+private def DropURestrictsAt (ctx : Ctx) (fuel : Nat) : Prop :=
+  (∀ (store : Store) (value : RVal) (store' : Store),
+    dropUVal ctx fuel store value = .ok store' →
+    StoreGraphRestricts store store') ∧
+  (∀ (store : Store) (values : List RVal) (store' : Store),
+    dropManyU ctx fuel store values = .ok store' →
+    StoreGraphRestricts store store')
+
+/-- Unique deep free likewise only removes nodes; all surviving locations
+retain their worlds and node contents. -/
+private theorem dropURestrictsAt (ctx : Ctx) :
+    ∀ fuel, DropURestrictsAt ctx fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_⟩
+    · intro store value store' heval
+      rw [dropUVal.eq_def] at heval
+      simp at heval
+    · intro store values store' heval
+      rw [dropManyU.eq_def] at heval
+      simp at heval
+  | succ fuel ih =>
+    obtain ⟨ihVal, ihMany⟩ := ih
+    refine ⟨?_, ?_⟩
+    · intro store value store' heval
+      cases value with
+      | lit literal =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact StoreGraphRestricts.refl store
+      | erased =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact StoreGraphRestricts.refl store
+      | loc loc =>
+        rw [dropUVal.eq_def] at heval
+        dsimp only at heval
+        cases hget : store.get? loc with
+        | none =>
+          rw [hget] at heval
+          simp at heval
+        | some box =>
+          rw [hget] at heval
+          cases box with
+          | mk world rc node =>
+            cases world with
+            | shared => simp at heval
+            | unique =>
+              cases node with
+              | ctorN cid fields =>
+                have hprefix : StoreGraphRestricts store
+                    (store.kill loc) :=
+                  StoreGraphRestricts.kill hget
+                have htail : StoreGraphRestricts (store.kill loc) store' :=
+                  ihMany (store.kill loc) fields.toList store' heval
+                intro other survivingWorld survivingRc survivingNode hafter
+                obtain ⟨middleRc, hmiddle⟩ := htail hafter
+                exact hprefix hmiddle
+              | papN fn arity args => simp at heval
+    · intro store values store' heval
+      cases values with
+      | nil =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        injection heval with hstore
+        subst store'
+        exact StoreGraphRestricts.refl store
+      | cons value values =>
+        rw [dropManyU.eq_def] at heval
+        dsimp only at heval
+        cases hfirst : dropUVal ctx fuel store value with
+        | error err =>
+          rw [hfirst, bindErr] at heval
+          simp at heval
+        | ok middle =>
+          rw [hfirst, bindOk] at heval
+          exact StoreGraphRestricts.trans
+            (ihVal store value middle hfirst)
+            (ihMany middle values store' heval)
+
+theorem dropUVal_restricts {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {value : RVal}
+    (heval : dropUVal ctx fuel store value = .ok store') :
+    StoreGraphRestricts store store' :=
+  (dropURestrictsAt ctx fuel).1 store value store' heval
+
+theorem dropManyU_restricts {ctx : Ctx} {fuel : Nat}
+    {store store' : Store} {values : List RVal}
+    (heval : dropManyU ctx fuel store values = .ok store') :
+    StoreGraphRestricts store store' :=
+  (dropURestrictsAt ctx fuel).2 store values store' heval
+
+@[simp] theorem edgeLocations_allocNode (store : Store) (world : Owned)
+    (node : Node) :
+    edgeLocations (store.allocNode world node).1 =
+      edgeLocations store ++ (nodeChildren node).filterMap rvalLocation? := by
+  simp [edgeLocations, slotEdgeLocations, Store.allocNode, Array.toList_push,
+    nodeChildren]
+
+theorem incoming_allocNode_old (store : Store) (world : Owned) (node : Node)
+    (rest : List Root) {loc : Nat} (hne : loc ≠ store.nodes.size) :
+    incoming (store.allocNode world node).1
+        (⟨world, .loc store.nodes.size⟩ :: rest) loc =
+      incoming store (rootsFor world (nodeChildren node) ++ rest) loc := by
+  simp [incoming, List.filterMap_append, List.count_append,
+    rootLocation?, rvalLocation?, Ne.symm hne, Nat.add_assoc, Nat.add_comm]
+
+theorem incoming_allocNode_new (store : Store) (world : Owned) (node : Node)
+    (rest : List Root) :
+    incoming (store.allocNode world node).1
+        (⟨world, .loc store.nodes.size⟩ :: rest) store.nodes.size =
+      incoming store (rootsFor world (nodeChildren node) ++ rest)
+        store.nodes.size + 1 := by
+  simp [incoming, List.filterMap_append, List.count_append,
+    rootLocation?, rvalLocation?, Nat.add_assoc, Nat.add_comm,
+    Nat.add_left_comm]
+
+theorem HasWorld.allocNode {store : Store} {world node rootWorld value}
+    (h : HasWorld store rootWorld value) :
+    HasWorld (store.allocNode world node).1 rootWorld value := by
+  cases value with
+  | loc loc =>
+    obtain ⟨box, hbox, hworld⟩ := h
+    exact ⟨box, HeapIso.get?_allocNode_old hbox, hworld⟩
+  | lit l => trivial
+  | erased => trivial
+
+theorem HasWorld.allocNode_new (store : Store) (world : Owned) (node : Node) :
+    HasWorld (store.allocNode world node).1 world
+      (.loc store.nodes.size) := by
+  exact ⟨⟨world, 1, node⟩, HeapIso.get?_allocNode_new store world node,
+    rfl⟩
+
+/-- Allocation consumes one root for every node child and produces one root
+for the fresh node. The exact incoming-owner/refcount equation is preserved. -/
+theorem RootOwnership.allocNode {store : Store} {world : Owned} {node : Node}
+    {rest : List Root}
+    (h : RootOwnership store (rootsFor world (nodeChildren node) ++ rest))
+    (hworld : NodeWorld world node) :
+    RootOwnership (store.allocNode world node).1
+      (⟨world, .loc store.nodes.size⟩ :: rest) := by
+  have childWorld : ∀ child ∈ nodeChildren node,
+      HasWorld store world child := by
+    intro child hchild
+    apply h.roots_world ⟨world, child⟩
+    apply List.mem_append_left rest
+    simp [rootsFor, hchild]
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root hroot
+    simp only [List.mem_cons] at hroot
+    rcases hroot with rfl | hrest
+    · exact HasWorld.allocNode_new store world node
+    · apply HasWorld.allocNode
+      apply h.roots_world root
+      exact List.mem_append_right _ hrest
+  · intro loc box hbox child hchild
+    by_cases hnew : loc = store.nodes.size
+    · subst loc
+      have hboxeq : box = ⟨world, 1, node⟩ := by
+        exact Option.some.inj
+          (hbox.symm.trans (HeapIso.get?_allocNode_new store world node))
+      subst box
+      exact HasWorld.allocNode (childWorld child hchild)
+    · have hold : store.get? loc = some box :=
+        HeapIso.get?_of_allocNode_old hnew hbox
+      exact HasWorld.allocNode (h.edges_world hold child hchild)
+  · intro loc box f arity args hbox hnode
+    by_cases hnew : loc = store.nodes.size
+    · subst loc
+      have hboxeq : box = ⟨world, 1, node⟩ := by
+        exact Option.some.inj
+          (hbox.symm.trans (HeapIso.get?_allocNode_new store world node))
+      subst box
+      change node = .papN f arity args at hnode
+      cases node <;> simp_all [NodeWorld]
+    · have hold : store.get? loc = some box :=
+        HeapIso.get?_of_allocNode_old hnew hbox
+      exact h.pap_shared hold hnode
+  · intro loc box hbox
+    by_cases hnew : loc = store.nodes.size
+    · subst loc
+      have hboxeq : box = ⟨world, 1, node⟩ := by
+        exact Option.some.inj
+          (hbox.symm.trans (HeapIso.get?_allocNode_new store world node))
+      subst box
+      have hzero := h.incoming_eq_zero_of_dead (HeapIso.get?_fresh store)
+      have hcount := incoming_allocNode_new store world node rest
+      rw [hzero] at hcount
+      cases world <;> simp_all
+    · have hold : store.get? loc = some box :=
+        HeapIso.get?_of_allocNode_old hnew hbox
+      have hcount := h.counts hold
+      rw [incoming_allocNode_old store world node rest hnew]
+      exact hcount
+
+/-- The reference meaning of unique reuse: shallow-free the old node, then
+append-allocate the replacement. -/
+theorem RootOwnership.freeAllocNode {store : Store} {loc : Nat}
+    {oldNode newNode : Node} {before after : List Root}
+    (hget : store.get? loc = some ⟨.unique, 1, oldNode⟩)
+    (h : RootOwnership store (⟨.unique, .loc loc⟩ :: before))
+    (hpartition :
+      (rootsFor .unique (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .unique (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .unique newNode) :
+    RootOwnership ((store.kill loc).allocNode .unique newNode).1
+      (⟨.unique,
+        .loc ((store.kill loc).allocNode .unique newNode).2⟩ :: after) := by
+  have hready := (h.killUniqueOne hget).perm hpartition
+  exact hready.allocNode hworld
+
+/-- Reference meaning of hot shared reuse: consume the final parent owner,
+shallow-free the old node, and freshly allocate the replacement. -/
+theorem RootOwnership.freeAllocSharedNode {store : Store} {loc : Nat}
+    {oldNode newNode : Node} {before after : List Root}
+    (hget : store.get? loc = some ⟨.shared, 1, oldNode⟩)
+    (h : RootOwnership store (⟨.shared, .loc loc⟩ :: before))
+    (hpartition :
+      (rootsFor .shared (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .shared (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .shared newNode) :
+    RootOwnership ((store.kill loc).allocNode .shared newNode).1
+      (⟨.shared,
+        .loc ((store.kill loc).allocNode .shared newNode).2⟩ :: after) := by
+  have hready := (h.killSharedOne hget).perm hpartition
+  exact hready.allocNode hworld
+
+/-- Allocation consumes the resolved field roots and returns ownership of the
+fresh constructor root. -/
+theorem runOp_alloc_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {world : Owned} {cid : CtorId}
+    {args : Array Atom} {values : List RVal} {rest : List Root}
+    (hresolve : resolveAtoms env args = .ok values)
+    (hown : RootOwnership store (rootsFor world values ++ rest)) :
+    runOp ctx (fuel + 1) cur store env (.alloc world cid args) =
+        .ok ((store.allocNode world (.ctorN cid values.toArray)).1,
+          .loc (store.allocNode world (.ctorN cid values.toArray)).2) ∧
+      RootOwnership (store.allocNode world (.ctorN cid values.toArray)).1
+        (⟨world,
+          .loc (store.allocNode world (.ctorN cid values.toArray)).2⟩ ::
+            rest) := by
+  refine ⟨runOp_alloc hresolve, ?_⟩
+  apply RootOwnership.allocNode
+  · simpa [nodeChildren] using hown
+  · trivial
+
+/-- Semantic strengthening of constructor allocation. Existing argument
+graphs survive the fresh allocation and become the fields of the newly
+related constructor root. -/
+theorem runOp_alloc_owned_valueGraph
+    {funRel : FunctionRel} {sourceValues : List IxIR0.Value}
+    {sourceAddress : Address} {sourceTag : Nat}
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {world : Owned} {cid : CtorId}
+    {args : Array Atom} {values : List RVal} {rest : List Root}
+    (hresolve : resolveAtoms env args = .ok values)
+    (haddress : cid.block = sourceAddress)
+    (htag : cid.cidx = sourceTag)
+    (hvalues : ValuesGraph funRel store sourceValues values)
+    (hown : RootOwnership store (rootsFor world values ++ rest)) :
+    let allocated := store.allocNode world (.ctorN cid values.toArray)
+    runOp ctx (fuel + 1) cur store env (.alloc world cid args) =
+        .ok (allocated.1, .loc allocated.2) ∧
+      StoreGraphExtends store allocated.1 ∧
+      ValueGraph funRel allocated.1
+        (.ctor sourceAddress sourceTag sourceValues) (.loc allocated.2) ∧
+      RootOwnership allocated.1
+        (⟨world, .loc allocated.2⟩ :: rest) := by
+  dsimp only
+  have hop := runOp_alloc_owned (ctx := ctx) (cur := cur)
+    (fuel := fuel) (cid := cid) (args := args) (values := values)
+    (rest := rest) hresolve hown
+  let allocated := store.allocNode world (.ctorN cid values.toArray)
+  have hstore : StoreGraphExtends store allocated.1 :=
+    StoreGraphExtends.allocNode store world (.ctorN cid values.toArray)
+  refine ⟨hop.1, hstore, ?_, hop.2⟩
+  apply ValueGraph.ctor
+  · exact HeapIso.get?_allocNode_new store world
+      (.ctorN cid values.toArray)
+  · exact haddress
+  · exact htag
+  · simpa using hvalues.monoStore hstore
+
+/-- Partial application consumes its shared captured-argument roots and
+stores them as the edges of one fresh shared pap node. -/
+theorem runOp_papp_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {f : Address} {d : Decl}
+    {atoms : Array Atom} {values : List RVal} {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok values)
+    (hdecl : ctx.decls f = some d)
+    (hunder : values.length < declArity d)
+    (hown : RootOwnership store (rootsFor .shared values ++ rest)) :
+    runOp ctx (fuel + 1) cur store env (.papp f atoms) =
+        .ok ((store.allocNode .shared
+          (.papN f (declArity d) values.toArray)).1,
+          .loc (store.allocNode .shared
+            (.papN f (declArity d) values.toArray)).2) ∧
+      RootOwnership
+        (store.allocNode .shared
+          (.papN f (declArity d) values.toArray)).1
+        (⟨.shared, .loc (store.allocNode .shared
+          (.papN f (declArity d) values.toArray)).2⟩ :: rest) := by
+  constructor
+  · rw [runOp.eq_def]
+    dsimp only
+    rw [hargs, bindOk, hdecl]
+    dsimp only
+    rw [if_pos hunder]
+  · apply RootOwnership.allocNode
+    · simpa [nodeChildren] using hown
+    · rfl
+
+/-- Semantic strengthening of partial-application allocation. The stored
+argument prefix remains graph-related after the fresh allocation, and the
+new pap root realizes the supplied source function value through `funRel`. -/
+theorem runOp_papp_owned_valueGraph
+    {funRel : FunctionRel} {sourceValue : IxIR0.Value}
+    {sourceValues : List IxIR0.Value}
+    {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store : Store} {env : List RVal} {f : Address} {d : Decl}
+    {atoms : Array Atom} {values : List RVal} {rest : List Root}
+    (hargs : resolveAtoms env atoms = .ok values)
+    (hdecl : ctx.decls f = some d)
+    (hunder : values.length < declArity d)
+    (hfun : funRel sourceValue f (declArity d) sourceValues)
+    (hvalues : ValuesGraph funRel store sourceValues values)
+    (hown : RootOwnership store (rootsFor .shared values ++ rest)) :
+    let allocated := store.allocNode .shared
+      (.papN f (declArity d) values.toArray)
+    runOp ctx (fuel + 1) cur store env (.papp f atoms) =
+        .ok (allocated.1, .loc allocated.2) ∧
+      StoreGraphExtends store allocated.1 ∧
+      ValueGraph funRel allocated.1 sourceValue (.loc allocated.2) ∧
+      RootOwnership allocated.1
+        (⟨.shared, .loc allocated.2⟩ :: rest) := by
+  dsimp only
+  have hop := runOp_papp_owned (ctx := ctx) (cur := cur)
+    (fuel := fuel) hargs hdecl hunder hown
+  let allocated := store.allocNode .shared
+    (.papN f (declArity d) values.toArray)
+  have hstore : StoreGraphExtends store allocated.1 :=
+    StoreGraphExtends.allocNode store .shared
+      (.papN f (declArity d) values.toArray)
+  refine ⟨hop.1, hstore, ?_, hop.2⟩
+  apply ValueGraph.function
+  · exact HeapIso.get?_allocNode_new store .shared
+      (.papN f (declArity d) values.toArray)
+  · exact hfun
+  · simpa using hvalues.monoStore hstore
+
+/-- Exact ownership preservation for one `applyGo` index, assuming all
+function declarations and recursive application indices below it are already
+available. The proof covers pap under-fill, saturation, and over-application. -/
+theorem applyOwnershipPreservesAt_of_papSafeDeclsBelow
+    {ctx : Ctx} {limit : Nat}
+    (hdecls : PapSafeDeclContractsBelow ctx limit)
+    (happly : ApplyOwnershipContractBelow ctx limit) :
+    ApplyOwnershipPreservesAt ctx limit := by
+  intro store store' function args value rest hown hrun
+  cases limit with
+  | zero => simp [applyGo] at hrun
+  | succ fuel =>
+    cases function with
+    | lit literal => simp [applyGo] at hrun
+    | erased =>
+      have hargsOwn : RootOwnership store
+          (rootsFor .shared args ++ rest) :=
+        hown.dropNoLocation rfl
+      simp only [applyGo] at hrun
+      cases hdrop : dropMany ctx fuel store args with
+      | error err =>
+        rw [hdrop, bindErr] at hrun
+        contradiction
+      | ok dropped =>
+        rw [hdrop, bindOk] at hrun
+        injection hrun with hpair
+        cases hpair
+        exact (dropMany_preserves hargsOwn hdrop).addNoLocation rfl
+    | loc loc =>
+      cases hget : store.get? loc with
+      | none => simp [applyGo, hget] at hrun
+      | some box =>
+        cases box with
+        | mk boxWorld rc node =>
+          cases node with
+          | ctorN cid fields => simp [applyGo, hget] at hrun
+          | papN address arity got =>
+            have hboxWorld : boxWorld = .shared :=
+              hown.pap_shared hget rfl
+            subst boxWorld
+            simp only [applyGo] at hrun
+            rw [hget] at hrun
+            dsimp only at hrun
+            cases hdup : dupVals store got.toList with
+            | error err =>
+              rw [hdup, bindErr] at hrun
+              contradiction
+            | ok dupStore =>
+              rw [hdup, bindOk] at hrun
+              cases hdrop : dropVal ctx fuel dupStore (.loc loc) with
+              | error err =>
+                rw [hdrop, bindErr] at hrun
+                contradiction
+              | ok readyStore =>
+                rw [hdrop, bindOk] at hrun
+                let total := got.toList ++ args
+                have hready : RootOwnership readyStore
+                    (rootsFor .shared total ++ rest) := by
+                  exact applyGo_preparePap_owned hget hown hdup hdrop
+                split at hrun
+                next hunder =>
+                  injection hrun with hpair
+                  cases hpair
+                  exact hready.allocNode rfl
+                next hnotUnder =>
+                  split at hrun
+                  next hexact =>
+                    cases hdecl : ctx.decls address with
+                    | none => simp [hdecl] at hrun
+                    | some decl =>
+                      cases hpapsafe : declPapSafe decl with
+                      | false => simp [hdecl, hpapsafe] at hrun
+                      | true =>
+                        have hinvoke : invoke ctx fuel address total
+                            readyStore = .ok (store', value) := by
+                          simpa [hdecl, hpapsafe] using hrun
+                        have hsmallDecls :=
+                          hdecls.mono (Nat.le_succ fuel)
+                        exact invoke_papSafe_owned_below hsmallDecls hdecl
+                          hpapsafe hready hinvoke
+                  next hover =>
+                    cases hdecl : ctx.decls address with
+                    | none => simp [hdecl] at hrun
+                    | some decl =>
+                      cases hpapsafe : declPapSafe decl with
+                      | false => simp [hdecl, hpapsafe] at hrun
+                      | true =>
+                        simp only [hdecl, hpapsafe, if_true] at hrun
+                        cases hinvoke : invoke ctx fuel address
+                            (total.take arity) readyStore with
+                        | error err =>
+                          rw [hinvoke, bindErr] at hrun
+                          contradiction
+                        | ok called =>
+                          rcases called with ⟨calledStore, result⟩
+                          rw [hinvoke, bindOk] at hrun
+                          have hpartition : RootOwnership readyStore
+                              (rootsFor .shared (total.take arity) ++
+                                (rootsFor .shared (total.drop arity) ++ rest)) := by
+                            have hsplit := hready
+                            have hrootsSplit : rootsFor .shared total =
+                                rootsFor .shared (total.take arity) ++
+                                  rootsFor .shared (total.drop arity) := by
+                              unfold rootsFor
+                              rw [← List.map_append]
+                              exact congrArg _
+                                (List.take_append_drop arity total).symm
+                            rw [hrootsSplit] at hsplit
+                            simpa only [List.append_assoc] using hsplit
+                          have hsmallDecls := hdecls.mono (Nat.le_succ fuel)
+                          have hcalled := invoke_papSafe_owned_below hsmallDecls
+                            hdecl hpapsafe hpartition hinvoke
+                          exact happly.preserves (Nat.lt_succ_self fuel)
+                            hcalled hrun
+
+/-- PAP-safe declaration contracts validate every successful shared PAP entry;
+unsafe dynamic targets fail before invocation, while direct calls are
+unaffected. -/
+theorem applyOwnershipContract_of_papSafeDecls {ctx : Ctx}
+    (hdecls : PapSafeDeclContracts ctx) :
+    ApplyOwnershipContract ctx := by
+  apply applyOwnershipContract_of_below_step
+  intro limit happly
+  exact applyOwnershipPreservesAt_of_papSafeDeclsBelow
+    (hdecls.below limit) happly
+
+theorem runOp_drop_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {target : Atom} {loc : Nat}
+    {rest : List Root}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (heval : dropVal ctx fuel store (.loc loc) = .ok store')
+    (hown : RootOwnership store (⟨.shared, .loc loc⟩ :: rest)) :
+    runOp ctx (fuel + 1) cur store env (.drop target) =
+        .ok (store', .erased) ∧
+      RootOwnership store' rest :=
+  ⟨runOp_drop hresolve heval, dropVal_preserves hown heval⟩
+
+theorem runOp_dropU_owned {ctx : Ctx} {fuel : Nat} {cur : FnDef}
+    {store store' : Store} {env : List RVal} {target : Atom} {loc : Nat}
+    {rest : List Root}
+    (hresolve : resolveAtom env target = .ok (.loc loc))
+    (heval : dropUVal ctx fuel store (.loc loc) = .ok store')
+    (hown : RootOwnership store (⟨.unique, .loc loc⟩ :: rest)) :
+    runOp ctx (fuel + 1) cur store env (.dropU target) =
+        .ok (store', .erased) ∧
+      RootOwnership store' rest :=
+  ⟨runOp_dropU hresolve heval, dropUVal_preserves hown heval⟩
+
+/-- A successful shared release of an arbitrary runtime value exposes both
+the exact surviving ownership and the reverse heap-shape relation needed to
+transport semantic graphs. Scalars leave the store unchanged; locations use
+the corresponding deep-drop theorems. -/
+theorem runOp_drop_value_owned_restricts {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {target : Atom} {value result : RVal} {rest : List Root}
+    (hresolve : resolveAtom env target = .ok value)
+    (hown : RootOwnership store (⟨.shared, value⟩ :: rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.drop target) =
+      .ok (store', result)) :
+    result = .erased ∧ StoreGraphRestricts store store' ∧
+      RootOwnership store' rest := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hresolve, bindOk] at hrun
+  cases value with
+  | lit literal =>
+    change (Except.ok (store, RVal.erased) :
+      Except Err (Store × RVal)) = .ok (store', result) at hrun
+    have hpair : (store, RVal.erased) = (store', result) :=
+      Except.ok.inj hrun
+    cases hpair
+    exact ⟨rfl, StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | erased =>
+    change (Except.ok (store, RVal.erased) :
+      Except Err (Store × RVal)) = .ok (store', result) at hrun
+    have hpair : (store, RVal.erased) = (store', result) :=
+      Except.ok.inj hrun
+    cases hpair
+    exact ⟨rfl, StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | loc loc =>
+    dsimp only at hrun
+    cases hdrop : dropVal ctx fuel store (.loc loc) with
+    | error err =>
+      rw [hdrop] at hrun
+      change (Except.error err : Except Err (Store × RVal)) =
+        .ok (store', result) at hrun
+      contradiction
+    | ok dropped =>
+      rw [hdrop] at hrun
+      change (Except.ok (dropped, RVal.erased) :
+        Except Err (Store × RVal)) = .ok (store', result) at hrun
+      have hpair : (dropped, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨rfl, dropVal_restricts hdrop,
+        dropVal_preserves hown hdrop⟩
+
+/-- Affine destruction has the same semantic store interface as shared
+release: it consumes one unique root and only removes heap nodes. -/
+theorem runOp_dropU_value_owned_restricts {ctx : Ctx} {fuel : Nat}
+    {cur : FnDef} {store store' : Store} {env : List RVal}
+    {target : Atom} {value result : RVal} {rest : List Root}
+    (hresolve : resolveAtom env target = .ok value)
+    (hown : RootOwnership store (⟨.unique, value⟩ :: rest))
+    (hrun : runOp ctx (fuel + 1) cur store env (.dropU target) =
+      .ok (store', result)) :
+    result = .erased ∧ StoreGraphRestricts store store' ∧
+      RootOwnership store' rest := by
+  rw [runOp.eq_def] at hrun
+  dsimp only at hrun
+  rw [hresolve, bindOk] at hrun
+  cases value with
+  | lit literal =>
+    change (Except.ok (store, RVal.erased) :
+      Except Err (Store × RVal)) = .ok (store', result) at hrun
+    have hpair : (store, RVal.erased) = (store', result) :=
+      Except.ok.inj hrun
+    cases hpair
+    exact ⟨rfl, StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | erased =>
+    change (Except.ok (store, RVal.erased) :
+      Except Err (Store × RVal)) = .ok (store', result) at hrun
+    have hpair : (store, RVal.erased) = (store', result) :=
+      Except.ok.inj hrun
+    cases hpair
+    exact ⟨rfl, StoreGraphRestricts.refl store,
+      hown.dropNoLocation rfl⟩
+  | loc loc =>
+    dsimp only at hrun
+    cases hdrop : dropUVal ctx fuel store (.loc loc) with
+    | error err =>
+      rw [hdrop] at hrun
+      change (Except.error err : Except Err (Store × RVal)) =
+        .ok (store', result) at hrun
+      contradiction
+    | ok dropped =>
+      rw [hdrop] at hrun
+      change (Except.ok (dropped, RVal.erased) :
+        Except Err (Store × RVal)) = .ok (store', result) at hrun
+      have hpair : (dropped, RVal.erased) = (store', result) :=
+        Except.ok.inj hrun
+      cases hpair
+      exact ⟨rfl, dropUVal_restricts hdrop,
+        dropUVal_preserves hown hdrop⟩
+
+/-- The live-location bijection used by reuse soundness. The reused target
+slot corresponds to the specification's fresh append location; every other
+live old location corresponds to itself. -/
+def reuseRel (store : Store) (target : Nat) (left right : Nat) : Prop :=
+  (left = target ∧ right = store.nodes.size) ∨
+  (left = right ∧ left ≠ target ∧
+    ∃ box, store.get? left = some box)
+
+private theorem rvalsIso_refl_of_mem {rel : Nat → Nat → Prop} :
+    ∀ {values : List RVal},
+      (∀ value ∈ values, RValIso rel value value) →
+      RValsIso rel values values
+  | [], _ => .nil
+  | value :: rest, h =>
+    .cons (h value (by simp))
+      (rvalsIso_refl_of_mem fun child hchild =>
+        h child (by simp [hchild]))
+
+/-- In-place reuse and its shallow-free-plus-append-allocation specification
+are isomorphic. Exact ownership supplies the critical fact that no surviving
+edge can point to the consumed target slot. -/
+def HeapIso.reuse {store : Store} {target : Nat} {oldBox : NodeBox}
+    {newNode : Node} {rest : List Root}
+    (hget : store.get? target = some oldBox)
+    (hown : RootOwnership (reuseNodeStore store target newNode)
+      (⟨.unique, .loc target⟩ :: rest)) :
+    HeapIso (reuseNodeStore store target newNode)
+      ((store.kill target).allocNode .unique newNode).1 := by
+  let left := reuseNodeStore store target newNode
+  let right := ((store.kill target).allocNode .unique newNode).1
+  let fresh := store.nodes.size
+  have hnew : left.get? target = some ⟨.unique, 1, newNode⟩ := by
+    exact get?_reuseNodeStore_same hget
+  have nodeSelfIso : ∀ {parent box}, left.get? parent = some box →
+      NodeIso (reuseRel store target) box.node box.node := by
+    intro parent box hparent
+    have childIso : ∀ child ∈ nodeChildren box.node,
+        RValIso (reuseRel store target) child child := by
+      intro child hchild
+      have hworld := hown.edges_world hparent child hchild
+      have hneValue := hown.sole_child_ne_unique hnew hparent hchild
+      cases child with
+      | loc childLoc =>
+        obtain ⟨childBox, hchildLive, _⟩ := hworld
+        have hne : childLoc ≠ target := by
+          intro heq
+          subst childLoc
+          exact hneValue rfl
+        have hold : store.get? childLoc = some childBox :=
+          get?_of_reuseNodeStore_other (Ne.symm hne) hget hchildLive
+        exact .loc (.inr ⟨rfl, hne, childBox, hold⟩)
+      | lit literal => exact .lit
+      | erased => exact .erased
+    cases hnode : box.node with
+    | ctorN cid fields =>
+      apply NodeIso.ctor
+      apply rvalsIso_refl_of_mem
+      intro child hchild
+      apply childIso child
+      simpa [nodeChildren, hnode] using hchild
+    | papN fn arity args =>
+      apply NodeIso.pap
+      apply rvalsIso_refl_of_mem
+      intro child hchild
+      apply childIso child
+      simpa [nodeChildren, hnode] using hchild
+  refine
+    { locRel := reuseRel store target
+      left_unique := ?_
+      right_unique := ?_
+      left_total := ?_
+      right_total := ?_
+      related_live := ?_ }
+  · intro loc right₁ right₂ h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.2.trans h₂.2.symm
+    · exact False.elim (h₂.2.1 h₁.1)
+    · exact False.elim (h₁.2.1 h₂.1)
+    · exact h₁.1.symm.trans h₂.1
+  · intro left₁ left₂ loc h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.1.trans h₂.1.symm
+    · obtain ⟨box, hbox⟩ := h₂.2.2
+      have heq : left₂ = store.nodes.size := h₂.1.trans h₁.2
+      subst left₂
+      rw [HeapIso.get?_fresh] at hbox
+      contradiction
+    · obtain ⟨box, hbox⟩ := h₁.2.2
+      have heq : left₁ = store.nodes.size := h₁.1.trans h₂.2
+      subst left₁
+      rw [HeapIso.get?_fresh] at hbox
+      contradiction
+    · exact h₁.1.trans h₂.1.symm
+  · intro loc box hbox
+    by_cases heq : loc = target
+    · exact ⟨fresh, .inl ⟨heq, rfl⟩⟩
+    · have hold : store.get? loc = some box :=
+        get?_of_reuseNodeStore_other (Ne.symm heq) hget hbox
+      exact ⟨loc, .inr ⟨rfl, heq, box, hold⟩⟩
+  · intro loc box hbox
+    by_cases heq : loc = fresh
+    · exact ⟨target, .inl ⟨rfl, heq⟩⟩
+    · have hnotFresh : loc ≠ (store.kill target).nodes.size := by
+        simpa [fresh, Store.kill] using heq
+      have hkilled : (store.kill target).get? loc = some box :=
+        HeapIso.get?_of_allocNode_old hnotFresh hbox
+      have hne : target ≠ loc := by
+        intro htarget
+        subst loc
+        rw [get?_kill_same hget] at hkilled
+        contradiction
+      have hold : store.get? loc = some box :=
+        get?_of_kill_other hne hget hkilled
+      exact ⟨loc, .inr ⟨rfl, Ne.symm hne, box, hold⟩⟩
+  · intro leftLoc rightLoc hrel
+    rcases hrel with hnewRel | holdRel
+    · obtain ⟨hleftLoc, hrightLoc⟩ := hnewRel
+      subst leftLoc
+      subst rightLoc
+      refine ⟨⟨.unique, 1, newNode⟩, ⟨.unique, 1, newNode⟩,
+        hnew, ?_, ?_⟩
+      · have hrightNew := HeapIso.get?_allocNode_new
+          (store.kill target) .unique newNode
+        change ((store.kill target).allocNode .unique newNode).1.get?
+          (store.kill target).nodes.size =
+            some ⟨.unique, 1, newNode⟩ at hrightNew
+        have hsize : (store.kill target).nodes.size = store.nodes.size := by
+          simp [Store.kill]
+        rw [hsize] at hrightNew
+        exact hrightNew
+      · exact ⟨rfl, rfl, nodeSelfIso hnew⟩
+    · obtain ⟨rfl, hne, oldLiveBox, hold⟩ := holdRel
+      have hleft : left.get? leftLoc = some oldLiveBox :=
+        get?_reuseNodeStore_other (Ne.symm hne) hget hold
+      have hkilled : (store.kill target).get? leftLoc = some oldLiveBox :=
+        get?_kill_other (Ne.symm hne) hget hold
+      have hright : right.get? leftLoc = some oldLiveBox :=
+        HeapIso.get?_allocNode_old hkilled
+      exact ⟨oldLiveBox, oldLiveBox, hleft, hright,
+        ⟨rfl, rfl, nodeSelfIso hleft⟩⟩
+
+/-- In-place shared reuse and its shallow-free-plus-append-allocation
+specification are isomorphic.  Unit shared ownership excludes every
+surviving root and heap edge from the consumed slot, so the reused location
+can correspond solely to the specification's fresh location. -/
+def HeapIso.reuseShared {store : Store} {target : Nat} {oldBox : NodeBox}
+    {newNode : Node} {rest : List Root}
+    (hget : store.get? target = some oldBox)
+    (hown : RootOwnership (reuseSharedNodeStore store target newNode)
+      (⟨.shared, .loc target⟩ :: rest)) :
+    HeapIso (reuseSharedNodeStore store target newNode)
+      ((store.kill target).allocNode .shared newNode).1 := by
+  let left := reuseSharedNodeStore store target newNode
+  let right := ((store.kill target).allocNode .shared newNode).1
+  let fresh := store.nodes.size
+  have hnew : left.get? target = some ⟨.shared, 1, newNode⟩ := by
+    exact get?_reuseSharedNodeStore_same hget
+  have nodeSelfIso : ∀ {parent box}, left.get? parent = some box →
+      NodeIso (reuseRel store target) box.node box.node := by
+    intro parent box hparent
+    have childIso : ∀ child ∈ nodeChildren box.node,
+        RValIso (reuseRel store target) child child := by
+      intro child hchild
+      have hworld := hown.edges_world hparent child hchild
+      have hneValue := hown.sole_child_ne hnew hparent hchild
+      cases child with
+      | loc childLoc =>
+        obtain ⟨childBox, hchildLive, _⟩ := hworld
+        have hne : childLoc ≠ target := by
+          intro heq
+          subst childLoc
+          exact hneValue rfl
+        have hold : store.get? childLoc = some childBox :=
+          get?_of_reuseSharedNodeStore_other (Ne.symm hne) hget hchildLive
+        exact .loc (.inr ⟨rfl, hne, childBox, hold⟩)
+      | lit literal => exact .lit
+      | erased => exact .erased
+    cases hnode : box.node with
+    | ctorN cid fields =>
+      apply NodeIso.ctor
+      apply rvalsIso_refl_of_mem
+      intro child hchild
+      apply childIso child
+      simpa [nodeChildren, hnode] using hchild
+    | papN fn arity args =>
+      apply NodeIso.pap
+      apply rvalsIso_refl_of_mem
+      intro child hchild
+      apply childIso child
+      simpa [nodeChildren, hnode] using hchild
+  refine
+    { locRel := reuseRel store target
+      left_unique := ?_
+      right_unique := ?_
+      left_total := ?_
+      right_total := ?_
+      related_live := ?_ }
+  · intro loc right₁ right₂ h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.2.trans h₂.2.symm
+    · exact False.elim (h₂.2.1 h₁.1)
+    · exact False.elim (h₁.2.1 h₂.1)
+    · exact h₁.1.symm.trans h₂.1
+  · intro left₁ left₂ loc h₁ h₂
+    rcases h₁ with h₁ | h₁ <;> rcases h₂ with h₂ | h₂
+    · exact h₁.1.trans h₂.1.symm
+    · obtain ⟨box, hbox⟩ := h₂.2.2
+      have heq : left₂ = store.nodes.size := h₂.1.trans h₁.2
+      subst left₂
+      rw [HeapIso.get?_fresh] at hbox
+      contradiction
+    · obtain ⟨box, hbox⟩ := h₁.2.2
+      have heq : left₁ = store.nodes.size := h₁.1.trans h₂.2
+      subst left₁
+      rw [HeapIso.get?_fresh] at hbox
+      contradiction
+    · exact h₁.1.trans h₂.1.symm
+  · intro loc box hbox
+    by_cases heq : loc = target
+    · exact ⟨fresh, .inl ⟨heq, rfl⟩⟩
+    · have hold : store.get? loc = some box :=
+        get?_of_reuseSharedNodeStore_other (Ne.symm heq) hget hbox
+      exact ⟨loc, .inr ⟨rfl, heq, box, hold⟩⟩
+  · intro loc box hbox
+    by_cases heq : loc = fresh
+    · exact ⟨target, .inl ⟨rfl, heq⟩⟩
+    · have hnotFresh : loc ≠ (store.kill target).nodes.size := by
+        simpa [fresh, Store.kill] using heq
+      have hkilled : (store.kill target).get? loc = some box :=
+        HeapIso.get?_of_allocNode_old hnotFresh hbox
+      have hne : target ≠ loc := by
+        intro htarget
+        subst loc
+        rw [get?_kill_same hget] at hkilled
+        contradiction
+      have hold : store.get? loc = some box :=
+        get?_of_kill_other hne hget hkilled
+      exact ⟨loc, .inr ⟨rfl, Ne.symm hne, box, hold⟩⟩
+  · intro leftLoc rightLoc hrel
+    rcases hrel with hnewRel | holdRel
+    · obtain ⟨hleftLoc, hrightLoc⟩ := hnewRel
+      subst leftLoc
+      subst rightLoc
+      refine ⟨⟨.shared, 1, newNode⟩, ⟨.shared, 1, newNode⟩,
+        hnew, ?_, ?_⟩
+      · have hrightNew := HeapIso.get?_allocNode_new
+          (store.kill target) .shared newNode
+        change ((store.kill target).allocNode .shared newNode).1.get?
+          (store.kill target).nodes.size =
+            some ⟨.shared, 1, newNode⟩ at hrightNew
+        have hsize : (store.kill target).nodes.size = store.nodes.size := by
+          simp [Store.kill]
+        rw [hsize] at hrightNew
+        exact hrightNew
+      · exact ⟨rfl, rfl, nodeSelfIso hnew⟩
+    · obtain ⟨rfl, hne, oldLiveBox, hold⟩ := holdRel
+      have hleft : left.get? leftLoc = some oldLiveBox :=
+        get?_reuseSharedNodeStore_other (Ne.symm hne) hget hold
+      have hkilled : (store.kill target).get? leftLoc = some oldLiveBox :=
+        get?_kill_other (Ne.symm hne) hget hold
+      have hright : right.get? leftLoc = some oldLiveBox :=
+        HeapIso.get?_allocNode_old hkilled
+      exact ⟨oldLiveBox, oldLiveBox, hleft, hright,
+        ⟨rfl, rfl, nodeSelfIso hleft⟩⟩
+
+/-- Full unique-reuse soundness. The in-place evaluator transition and the
+shallow-free-plus-append-allocation specification both preserve exact
+ownership, and their result roots correspond under a live-heap isomorphism.
+The partition premise is a root-multiset equation (`List.Perm`): canonical
+same-arity FBIP reuse permutes the roots without any common list split. -/
+theorem reuse_sound {store : Store} {target : Nat} {oldNode newNode : Node}
+    {before after : List Root}
+    (hget : store.get? target = some ⟨.unique, 1, oldNode⟩)
+    (hown : RootOwnership store (⟨.unique, .loc target⟩ :: before))
+    (hpartition :
+      (rootsFor .unique (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .unique (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .unique newNode) :
+    ∃ iso : HeapIso (reuseNodeStore store target newNode)
+        ((store.kill target).allocNode .unique newNode).1,
+      RootOwnership (reuseNodeStore store target newNode)
+          (⟨.unique, .loc target⟩ :: after) ∧
+      RootOwnership ((store.kill target).allocNode .unique newNode).1
+          (⟨.unique,
+            .loc ((store.kill target).allocNode .unique newNode).2⟩ :: after) ∧
+      iso.locRel target
+        ((store.kill target).allocNode .unique newNode).2 := by
+  have hinPlace := hown.reuseNode hget hpartition hworld
+  have hreference := hown.freeAllocNode hget hpartition hworld
+  let iso := HeapIso.reuse hget hinPlace
+  refine ⟨iso, hinPlace, hreference, ?_⟩
+  change reuseRel store target target
+    ((store.kill target).allocNode .unique newNode).2
+  exact .inl ⟨rfl, by simp [Store.kill, Store.allocNode]⟩
+
+/-- Full hot shared-reuse soundness.  Physical in-place replacement and the
+logical shallow-free-plus-fresh-allocation path preserve exact ownership,
+their result roots correspond, and their live heaps differ only by the
+reused-slot/fresh-slot renaming. -/
+theorem reuse_shared_sound {store : Store} {target : Nat}
+    {oldNode newNode : Node} {before after : List Root}
+    (hget : store.get? target = some ⟨.shared, 1, oldNode⟩)
+    (hown : RootOwnership store (⟨.shared, .loc target⟩ :: before))
+    (hpartition :
+      (rootsFor .shared (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .shared (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .shared newNode) :
+    ∃ iso : HeapIso (reuseSharedNodeStore store target newNode)
+        ((store.kill target).allocNode .shared newNode).1,
+      RootOwnership (reuseSharedNodeStore store target newNode)
+          (⟨.shared, .loc target⟩ :: after) ∧
+      RootOwnership ((store.kill target).allocNode .shared newNode).1
+          (⟨.shared,
+            .loc ((store.kill target).allocNode .shared newNode).2⟩ :: after) ∧
+      iso.locRel target
+        ((store.kill target).allocNode .shared newNode).2 := by
+  have hinPlace := hown.reuseSharedNode hget hpartition hworld
+  have hreference := hown.freeAllocSharedNode hget hpartition hworld
+  let iso := HeapIso.reuseShared hget hinPlace
+  refine ⟨iso, hinPlace, hreference, ?_⟩
+  change reuseRel store target target
+    ((store.kill target).allocNode .shared newNode).2
+  exact .inl ⟨rfl, by simp [Store.kill, Store.allocNode]⟩
+
+/-- The shared-reuse isomorphism self-relates every surviving external root.
+This stronger interface lets a caller transport continuations containing old
+live locations while mapping only the replaced result to its fresh logical
+location. -/
+theorem reuse_shared_sound_with_survivors {store : Store} {target : Nat}
+    {oldNode newNode : Node} {before after : List Root}
+    (hget : store.get? target = some ⟨.shared, 1, oldNode⟩)
+    (hown : RootOwnership store (⟨.shared, .loc target⟩ :: before))
+    (hpartition :
+      (rootsFor .shared (nodeChildren oldNode) ++ before).Perm
+        (rootsFor .shared (nodeChildren newNode) ++ after))
+    (hworld : NodeWorld .shared newNode) :
+    ∃ iso : HeapIso (reuseSharedNodeStore store target newNode)
+        ((store.kill target).allocNode .shared newNode).1,
+      RootOwnership (reuseSharedNodeStore store target newNode)
+          (⟨.shared, .loc target⟩ :: after) ∧
+      RootOwnership ((store.kill target).allocNode .shared newNode).1
+          (⟨.shared,
+            .loc ((store.kill target).allocNode .shared newNode).2⟩ :: after) ∧
+      iso.locRel target
+        ((store.kill target).allocNode .shared newNode).2 ∧
+      ∀ root ∈ after, RValIso iso.locRel root.value root.value := by
+  have hinPlace := hown.reuseSharedNode hget hpartition hworld
+  have hreference := hown.freeAllocSharedNode hget hpartition hworld
+  let iso := HeapIso.reuseShared hget hinPlace
+  refine ⟨iso, hinPlace, hreference, ?_, ?_⟩
+  · change reuseRel store target target
+      ((store.kill target).allocNode .shared newNode).2
+    exact .inl ⟨rfl, by simp [Store.kill, Store.allocNode]⟩
+  · intro root member
+    cases root with
+    | mk world value =>
+        cases value with
+        | lit literal => exact .lit
+        | erased => exact .erased
+        | loc location =>
+            have different : location ≠ target := by
+              intro same
+              apply hinPlace.sole_root_ne
+                (get?_reuseSharedNodeStore_same hget) member
+              simp [same]
+            obtain ⟨box, live, _⟩ :=
+              hinPlace.roots_world ⟨world, .loc location⟩ (by simp [member])
+            have oldLive : store.get? location = some box :=
+              get?_of_reuseSharedNodeStore_other (Ne.symm different) hget
+                live
+            apply RValIso.loc
+            exact .inr ⟨rfl, different, box, oldLive⟩
+
+/-! Value realization is insensitive to the concrete numbering of live heap
+locations. The generated mutual induction principles let these two theorems
+recurse through constructor fields and pap captures without adding a depth
+index to the semantic relation. -/
+
+theorem ValueGraph.transport {funRel : FunctionRel} {left right : Store}
+    (iso : HeapIso left right) {v : IxIR0.Value} {leftVal rightVal : RVal}
+    (graph : ValueGraph funRel left v leftVal)
+    (valueIso : RValIso iso.locRel leftVal rightVal) :
+    ValueGraph funRel right v rightVal := by
+  refine ValueGraph.rec
+    (motive_1 := fun v leftVal _ => ∀ {rightVal},
+      RValIso iso.locRel leftVal rightVal →
+      ValueGraph funRel right v rightVal)
+    (motive_2 := fun values leftVals _ => ∀ {rightVals},
+      RValsIso iso.locRel leftVals rightVals →
+      ValuesGraph funRel right values rightVals)
+    ?_ ?_ ?_ ?_ ?_ ?_ graph valueIso
+  · intro l rightVal hval
+    cases hval
+    exact .lit
+  · intro rightVal hval
+    cases hval
+    exact .erased
+  · intro adr tag args loc world rc cid fields hget hadr htag
+      hfields ihFields rightVal hval
+    cases hval with
+    | loc hloc =>
+      obtain ⟨leftBox, rightBox, hleft, hright, hboxes⟩ :=
+        iso.related_live hloc
+      have hlbox : leftBox = ⟨world, rc, .ctorN cid fields⟩ := by
+        exact Option.some.inj (hleft.symm.trans hget)
+      subst leftBox
+      cases rightBox with
+      | mk rightWorld rightRc rightNode =>
+        obtain ⟨hworld, hrc, hnode⟩ := hboxes
+        change world = rightWorld at hworld
+        change rc = rightRc at hrc
+        change NodeIso iso.locRel (.ctorN cid fields) rightNode at hnode
+        subst rightWorld
+        subst rightRc
+        cases hnode with
+        | ctor hfieldIso =>
+          exact .ctor hright hadr htag (ihFields hfieldIso)
+  · intro v f arity captures loc rc args hget hfun hargs ihArgs
+      rightVal hval
+    cases hval with
+    | loc hloc =>
+      obtain ⟨leftBox, rightBox, hleft, hright, hboxes⟩ :=
+        iso.related_live hloc
+      have hlbox : leftBox = ⟨.shared, rc, .papN f arity args⟩ := by
+        exact Option.some.inj (hleft.symm.trans hget)
+      subst leftBox
+      cases rightBox with
+      | mk rightWorld rightRc rightNode =>
+        obtain ⟨hworld, hrc, hnode⟩ := hboxes
+        change Owned.shared = rightWorld at hworld
+        change rc = rightRc at hrc
+        change NodeIso iso.locRel (.papN f arity args) rightNode at hnode
+        subst rightWorld
+        subst rightRc
+        cases hnode with
+        | pap hargIso =>
+          exact .function hright hfun (ihArgs hargIso)
+  · intro rightVals hvals
+    cases hvals
+    exact .nil
+  · intro v rv vs rvs hgraph hgraphs ihGraph ihGraphs rightVals hvals
+    cases hvals with
+    | cons hval hvals => exact .cons (ihGraph hval) (ihGraphs hvals)
+
+theorem ValuesGraph.transport {funRel : FunctionRel} {left right : Store}
+    (iso : HeapIso left right) {values : List IxIR0.Value}
+    {leftVals rightVals : List RVal}
+    (graphs : ValuesGraph funRel left values leftVals)
+    (valuesIso : RValsIso iso.locRel leftVals rightVals) :
+    ValuesGraph funRel right values rightVals := by
+  refine ValuesGraph.rec
+    (motive_1 := fun v leftVal _ => ∀ {rightVal},
+      RValIso iso.locRel leftVal rightVal →
+      ValueGraph funRel right v rightVal)
+    (motive_2 := fun values leftVals _ => ∀ {rightVals},
+      RValsIso iso.locRel leftVals rightVals →
+      ValuesGraph funRel right values rightVals)
+    ?_ ?_ ?_ ?_ ?_ ?_ graphs valuesIso
+  · intro l rightVal hval
+    cases hval
+    exact .lit
+  · intro rightVal hval
+    cases hval
+    exact .erased
+  · intro adr tag args loc world rc cid fields hget hadr htag
+      hfields ihFields rightVal hval
+    cases hval with
+    | loc hloc =>
+      obtain ⟨leftBox, rightBox, hleft, hright, hboxes⟩ :=
+        iso.related_live hloc
+      have hlbox : leftBox = ⟨world, rc, .ctorN cid fields⟩ := by
+        exact Option.some.inj (hleft.symm.trans hget)
+      subst leftBox
+      cases rightBox with
+      | mk rightWorld rightRc rightNode =>
+        obtain ⟨hworld, hrc, hnode⟩ := hboxes
+        change world = rightWorld at hworld
+        change rc = rightRc at hrc
+        change NodeIso iso.locRel (.ctorN cid fields) rightNode at hnode
+        subst rightWorld
+        subst rightRc
+        cases hnode with
+        | ctor hfieldIso =>
+          exact .ctor hright hadr htag (ihFields hfieldIso)
+  · intro v f arity captures loc rc args hget hfun hargs ihArgs
+      rightVal hval
+    cases hval with
+    | loc hloc =>
+      obtain ⟨leftBox, rightBox, hleft, hright, hboxes⟩ :=
+        iso.related_live hloc
+      have hlbox : leftBox = ⟨.shared, rc, .papN f arity args⟩ := by
+        exact Option.some.inj (hleft.symm.trans hget)
+      subst leftBox
+      cases rightBox with
+      | mk rightWorld rightRc rightNode =>
+        obtain ⟨hworld, hrc, hnode⟩ := hboxes
+        change Owned.shared = rightWorld at hworld
+        change rc = rightRc at hrc
+        change NodeIso iso.locRel (.papN f arity args) rightNode at hnode
+        subst rightWorld
+        subst rightRc
+        cases hnode with
+        | pap hargIso =>
+          exact .function hright hfun (ihArgs hargIso)
+  · intro rightVals hvals
+    cases hvals
+    exact .nil
+  · intro v rv vs rvs hgraph hgraphs ihGraph ihGraphs rightVals hvals
+    cases hvals with
+    | cons hval hvals => exact .cons (ihGraph hval) (ihGraphs hvals)
+
+/-! ## Primitive proof fixtures
+
+These derivations exercise the theorem API, rather than merely executing the
+interpreter. They cover shared alias decrement/reclamation, zero-RC unique
+deep-free, and in-place reuse versus a free-plus-allocation heap whose result
+location is deliberately different, plus shallow-free and borrow/retain fetch
+accounting. -/
+
+private def fixtureNode : Node := .ctorN default #[]
+
+private def fixtureStore : Store :=
+  (({} : Store).allocNode .shared fixtureNode).1
+
+private def fixtureLoc : Nat := (({} : Store).allocNode .shared fixtureNode).2
+
+theorem fixture_alloc_owned :
+    RootOwnership fixtureStore [⟨.shared, .loc fixtureLoc⟩] := by
+  apply RootOwnership.allocNode (store := ({} : Store))
+    (world := .shared) (node := fixtureNode) (rest := [])
+    RootOwnership.empty
+  trivial
+
+theorem fixture_dup_owned :
+    RootOwnership
+      (incRcStore fixtureStore fixtureLoc ⟨.shared, 1, fixtureNode⟩)
+      [⟨.shared, .loc fixtureLoc⟩, ⟨.shared, .loc fixtureLoc⟩] := by
+  apply RootOwnership.dup
+  · exact HeapIso.get?_allocNode_new ({} : Store) .shared fixtureNode
+  · exact fixture_alloc_owned
+
+theorem fixture_drop_owned :
+    RootOwnership
+      (decRcStore
+        (incRcStore fixtureStore fixtureLoc ⟨.shared, 1, fixtureNode⟩)
+        fixtureLoc ⟨.shared, 2, fixtureNode⟩)
+      [⟨.shared, .loc fixtureLoc⟩] := by
+  apply RootOwnership.dropSharedMany (rc := 2) (by omega)
+  · exact get?_incRcStore_same
+      (HeapIso.get?_allocNode_new ({} : Store) .shared fixtureNode)
+  · exact fixture_dup_owned
+
+private def fixtureDupStore : Store :=
+  incRcStore fixtureStore fixtureLoc ⟨.shared, 1, fixtureNode⟩
+
+private def fixtureAliasedNode : Node :=
+  .ctorN default #[.loc fixtureLoc, .loc fixtureLoc]
+
+private def fixtureAliasedStore : Store :=
+  (fixtureDupStore.allocNode .shared fixtureAliasedNode).1
+
+private def fixtureAliasedLoc : Nat :=
+  (fixtureDupStore.allocNode .shared fixtureAliasedNode).2
+
+theorem fixture_aliased_alloc_owned :
+    RootOwnership fixtureAliasedStore
+      [⟨.shared, .loc fixtureAliasedLoc⟩] := by
+  unfold fixtureAliasedStore fixtureAliasedLoc
+  apply RootOwnership.allocNode (store := fixtureDupStore)
+    (world := .shared) (node := fixtureAliasedNode) (rest := [])
+  · simpa [fixtureDupStore, fixtureAliasedNode, nodeChildren, rootsFor]
+      using fixture_dup_owned
+  · trivial
+
+private def fixtureAliasedAfterParent : Store :=
+  fixtureAliasedStore.rcTick.kill fixtureAliasedLoc
+
+private def fixtureAliasedAfterFirstChild : Store :=
+  decRcStore fixtureAliasedAfterParent fixtureLoc
+    ⟨.shared, 2, fixtureNode⟩
+
+private def fixtureAliasedDroppedStore : Store :=
+  fixtureAliasedAfterFirstChild.rcTick.kill fixtureLoc
+
+private def fixtureCtx : Ctx := { decls := Env.empty }
+
+private theorem fixture_aliased_parent_get :
+    fixtureAliasedStore.get? fixtureAliasedLoc =
+      some ⟨.shared, 1, fixtureAliasedNode⟩ := by
+  simp [fixtureAliasedStore, fixtureAliasedLoc]
+
+private theorem fixture_aliased_child_after_parent_get :
+    fixtureAliasedAfterParent.get? fixtureLoc =
+      some ⟨.shared, 2, fixtureNode⟩ := by
+  have hleaf : fixtureStore.get? fixtureLoc =
+      some ⟨.shared, 1, fixtureNode⟩ :=
+    HeapIso.get?_allocNode_new ({} : Store) .shared fixtureNode
+  have hdup : fixtureDupStore.get? fixtureLoc =
+      some ⟨.shared, 2, fixtureNode⟩ := by
+    exact get?_incRcStore_same hleaf
+  have hchild : fixtureAliasedStore.get? fixtureLoc =
+      some ⟨.shared, 2, fixtureNode⟩ := by
+    exact HeapIso.get?_allocNode_old hdup
+  have hne : fixtureAliasedLoc ≠ fixtureLoc := by decide
+  unfold fixtureAliasedAfterParent
+  apply get?_kill_other hne
+  · simpa using fixture_aliased_parent_get
+  · simpa using hchild
+
+private theorem fixture_aliased_child_after_first_get :
+    fixtureAliasedAfterFirstChild.get? fixtureLoc =
+      some ⟨.shared, 1, fixtureNode⟩ := by
+  exact get?_decRcStore_same fixture_aliased_child_after_parent_get
+
+theorem fixture_aliased_drop_eval :
+    dropVal fixtureCtx 8 fixtureAliasedStore (.loc fixtureAliasedLoc) =
+      .ok fixtureAliasedDroppedStore := by
+  rw [dropVal.eq_def]
+  dsimp only
+  rw [fixture_aliased_parent_get]
+  dsimp only
+  have hone : ((1 : Nat) == 1) = true := by decide
+  rw [hone]
+  change dropMany fixtureCtx 7 fixtureAliasedAfterParent
+      [.loc fixtureLoc, .loc fixtureLoc] = .ok fixtureAliasedDroppedStore
+  rw [dropMany.eq_def]
+  dsimp only
+  rw [dropVal.eq_def]
+  dsimp only
+  rw [fixture_aliased_child_after_parent_get]
+  dsimp only
+  have htwo : ((2 : Nat) == 1) = false := by decide
+  rw [htwo]
+  simp only [Bool.false_eq_true, if_false, Nat.reduceSub, bindOk]
+  change dropMany fixtureCtx 6 fixtureAliasedAfterFirstChild
+      [.loc fixtureLoc] = .ok fixtureAliasedDroppedStore
+  rw [dropMany.eq_def]
+  dsimp only
+  rw [dropVal.eq_def]
+  dsimp only
+  rw [fixture_aliased_child_after_first_get]
+  dsimp only
+  rw [hone]
+  simp only [if_true, fixtureNode]
+  rw [dropMany.eq_def]
+  rw [bindOk]
+  rw [dropMany.eq_def]
+  rfl
+
+theorem fixture_aliased_drop_owned :
+    RootOwnership fixtureAliasedDroppedStore [] :=
+  dropVal_preserves fixture_aliased_alloc_owned fixture_aliased_drop_eval
+
+theorem fixture_aliased_drop_live_zero :
+    fixtureAliasedDroppedStore.live = 0 := by
+  rfl
+
+theorem fixture_aliased_drop_counters :
+    fixtureAliasedDroppedStore.frees = 2 ∧
+      fixtureAliasedDroppedStore.rcops = 4 := by
+  constructor <;> rfl
+
+private def fixtureUniqueLeafStore : Store :=
+  (({} : Store).allocNode .unique fixtureNode).1
+
+private def fixtureUniqueLeafLoc : Nat :=
+  (({} : Store).allocNode .unique fixtureNode).2
+
+theorem fixture_unique_leaf_owned :
+    RootOwnership fixtureUniqueLeafStore
+      [⟨.unique, .loc fixtureUniqueLeafLoc⟩] := by
+  apply RootOwnership.allocNode (store := ({} : Store))
+    (world := .unique) (node := fixtureNode) (rest := [])
+  · exact RootOwnership.empty
+  · trivial
+
+private def fixtureUniqueParentNode : Node :=
+  .ctorN default #[.loc fixtureUniqueLeafLoc]
+
+private def fixtureUniqueStore : Store :=
+  (fixtureUniqueLeafStore.allocNode .unique fixtureUniqueParentNode).1
+
+private def fixtureUniqueLoc : Nat :=
+  (fixtureUniqueLeafStore.allocNode .unique fixtureUniqueParentNode).2
+
+theorem fixture_unique_alloc_owned :
+    RootOwnership fixtureUniqueStore
+      [⟨.unique, .loc fixtureUniqueLoc⟩] := by
+  unfold fixtureUniqueStore fixtureUniqueLoc
+  apply RootOwnership.allocNode (store := fixtureUniqueLeafStore)
+    (world := .unique) (node := fixtureUniqueParentNode) (rest := [])
+  · simpa [fixtureUniqueParentNode, nodeChildren, rootsFor]
+      using fixture_unique_leaf_owned
+  · trivial
+
+private def fixtureUniqueAfterParent : Store :=
+  fixtureUniqueStore.kill fixtureUniqueLoc
+
+private def fixtureUniqueDroppedStore : Store :=
+  fixtureUniqueAfterParent.kill fixtureUniqueLeafLoc
+
+private theorem fixture_unique_parent_get :
+    fixtureUniqueStore.get? fixtureUniqueLoc =
+      some ⟨.unique, 1, fixtureUniqueParentNode⟩ := by
+  simp [fixtureUniqueStore, fixtureUniqueLoc]
+
+private theorem fixture_unique_child_after_parent_get :
+    fixtureUniqueAfterParent.get? fixtureUniqueLeafLoc =
+      some ⟨.unique, 1, fixtureNode⟩ := by
+  have hleaf : fixtureUniqueLeafStore.get? fixtureUniqueLeafLoc =
+      some ⟨.unique, 1, fixtureNode⟩ := by
+    simp [fixtureUniqueLeafStore, fixtureUniqueLeafLoc]
+  have hchild : fixtureUniqueStore.get? fixtureUniqueLeafLoc =
+      some ⟨.unique, 1, fixtureNode⟩ :=
+    HeapIso.get?_allocNode_old hleaf
+  have hne : fixtureUniqueLoc ≠ fixtureUniqueLeafLoc := by decide
+  unfold fixtureUniqueAfterParent
+  exact get?_kill_other hne fixture_unique_parent_get hchild
+
+theorem fixture_unique_drop_eval :
+    dropUVal fixtureCtx 6 fixtureUniqueStore (.loc fixtureUniqueLoc) =
+      .ok fixtureUniqueDroppedStore := by
+  rw [dropUVal.eq_def]
+  dsimp only
+  rw [fixture_unique_parent_get]
+  change dropManyU fixtureCtx 5 fixtureUniqueAfterParent
+      [.loc fixtureUniqueLeafLoc] = .ok fixtureUniqueDroppedStore
+  rw [dropManyU.eq_def]
+  dsimp only
+  rw [dropUVal.eq_def]
+  dsimp only
+  rw [fixture_unique_child_after_parent_get]
+  simp only [fixtureNode]
+  rw [dropManyU.eq_def]
+  rw [bindOk]
+  rw [dropManyU.eq_def]
+  rfl
+
+theorem fixture_unique_drop_owned :
+    RootOwnership fixtureUniqueDroppedStore [] :=
+  dropUVal_preserves fixture_unique_alloc_owned fixture_unique_drop_eval
+
+theorem fixture_unique_drop_live_zero :
+    fixtureUniqueDroppedStore.live = 0 := by
+  rfl
+
+theorem fixture_unique_drop_counters :
+    fixtureUniqueDroppedStore.frees = 2 ∧
+      fixtureUniqueDroppedStore.rcops = 0 := by
+  constructor <;> rfl
+
+private def fixtureReuseCid : CtorId :=
+  { block := default, indIdx := 0, cidx := 1 }
+
+private def fixtureReuseNode : Node :=
+  .ctorN fixtureReuseCid #[.loc fixtureUniqueLeafLoc]
+
+private def fixtureReuseStore : Store :=
+  reuseNodeStore fixtureUniqueStore fixtureUniqueLoc fixtureReuseNode
+
+private def fixtureReuseSpec : Store :=
+  ((fixtureUniqueStore.kill fixtureUniqueLoc).allocNode
+    .unique fixtureReuseNode).1
+
+private def fixtureReuseFresh : Nat :=
+  ((fixtureUniqueStore.kill fixtureUniqueLoc).allocNode
+    .unique fixtureReuseNode).2
+
+theorem fixture_reuse_sound :
+    ∃ iso : HeapIso fixtureReuseStore fixtureReuseSpec,
+      RootOwnership fixtureReuseStore
+          [⟨.unique, .loc fixtureUniqueLoc⟩] ∧
+      RootOwnership fixtureReuseSpec
+          [⟨.unique, .loc fixtureReuseFresh⟩] ∧
+      iso.locRel fixtureUniqueLoc fixtureReuseFresh := by
+  simpa [fixtureReuseStore, fixtureReuseSpec, fixtureReuseFresh] using
+    (reuse_sound
+      (hget := fixture_unique_parent_get)
+      (hown := fixture_unique_alloc_owned)
+      (hpartition := .of_eq (by rfl))
+      (hworld := by
+        trivial)
+      (newNode := fixtureReuseNode)
+      (before := []) (after := []))
+
+theorem fixture_reuse_locations_differ :
+    fixtureUniqueLoc ≠ fixtureReuseFresh := by
+  decide
+
+theorem fixture_reuse_costs_excluded_from_iso :
+    fixtureReuseStore.allocs = 2 ∧
+      fixtureReuseStore.reuses = 1 ∧
+      fixtureReuseStore.frees = 0 ∧
+      fixtureReuseSpec.allocs = 3 ∧
+      fixtureReuseSpec.reuses = 0 ∧
+      fixtureReuseSpec.frees = 1 := by
+  constructor
+  · rfl
+  constructor
+  · rfl
+  constructor
+  · rfl
+  constructor
+  · rfl
+  constructor <;> rfl
+
+/-! Same-arity field-replacement reuse — the list-reverse shape.
+`Cons(x, xs)` is reused in place as `Cons(x, acc)`: the consumed roots are
+the old fields `{x, xs}` plus the ambient accumulator root `acc`, and the
+supplied roots are the new fields `{x, acc}` plus the leftover `xs`. The
+partition is a genuine non-identity permutation — the `#guard`s below check
+executably that the two root lists are unequal yet multiset-equal, so the
+old equality-shaped premise was uninstantiable here. -/
+
+private def fixtureSwapAccStore : Store :=
+  (({} : Store).allocNode .unique fixtureNode).1
+
+private def fixtureSwapAccLoc : Nat :=
+  (({} : Store).allocNode .unique fixtureNode).2
+
+private def fixtureSwapXsStore : Store :=
+  (fixtureSwapAccStore.allocNode .unique fixtureNode).1
+
+private def fixtureSwapXsLoc : Nat :=
+  (fixtureSwapAccStore.allocNode .unique fixtureNode).2
+
+private def fixtureSwapXStore : Store :=
+  (fixtureSwapXsStore.allocNode .unique fixtureNode).1
+
+private def fixtureSwapXLoc : Nat :=
+  (fixtureSwapXsStore.allocNode .unique fixtureNode).2
+
+/-- The reused cell `Cons(x, xs)`. -/
+private def fixtureSwapOldNode : Node :=
+  .ctorN fixtureReuseCid #[.loc fixtureSwapXLoc, .loc fixtureSwapXsLoc]
+
+/-- Its replacement `Cons(x, acc)` — same arity, second field swapped. -/
+private def fixtureSwapNewNode : Node :=
+  .ctorN fixtureReuseCid #[.loc fixtureSwapXLoc, .loc fixtureSwapAccLoc]
+
+private def fixtureSwapStore : Store :=
+  (fixtureSwapXStore.allocNode .unique fixtureSwapOldNode).1
+
+private def fixtureSwapLoc : Nat :=
+  (fixtureSwapXStore.allocNode .unique fixtureSwapOldNode).2
+
+private def fixtureSwapBefore : List Root :=
+  [⟨.unique, .loc fixtureSwapAccLoc⟩]
+
+private def fixtureSwapAfter : List Root :=
+  [⟨.unique, .loc fixtureSwapXsLoc⟩]
+
+-- Unequal as lists (no before/after split can equate them)…
+#guard ((rootsFor .unique (nodeChildren fixtureSwapOldNode) ++
+    fixtureSwapBefore) ==
+  (rootsFor .unique (nodeChildren fixtureSwapNewNode) ++
+    fixtureSwapAfter)) == false
+
+-- …but equal as root multisets: exactly the permutation premise.
+#guard (rootsFor .unique (nodeChildren fixtureSwapOldNode) ++
+    fixtureSwapBefore).isPerm
+  (rootsFor .unique (nodeChildren fixtureSwapNewNode) ++
+    fixtureSwapAfter)
+
+private theorem fixture_swap_acc_owned :
+    RootOwnership fixtureSwapAccStore
+      [⟨.unique, .loc fixtureSwapAccLoc⟩] := by
+  unfold fixtureSwapAccStore fixtureSwapAccLoc
+  apply RootOwnership.allocNode (store := ({} : Store))
+    (world := .unique) (node := fixtureNode) (rest := [])
+  · exact RootOwnership.empty
+  · trivial
+
+private theorem fixture_swap_xs_owned :
+    RootOwnership fixtureSwapXsStore
+      [⟨.unique, .loc fixtureSwapXsLoc⟩,
+       ⟨.unique, .loc fixtureSwapAccLoc⟩] := by
+  unfold fixtureSwapXsStore fixtureSwapXsLoc
+  apply RootOwnership.allocNode (store := fixtureSwapAccStore)
+    (world := .unique) (node := fixtureNode)
+    (rest := [⟨.unique, .loc fixtureSwapAccLoc⟩])
+  · simpa [fixtureNode, nodeChildren, rootsFor] using fixture_swap_acc_owned
+  · trivial
+
+private theorem fixture_swap_x_owned :
+    RootOwnership fixtureSwapXStore
+      [⟨.unique, .loc fixtureSwapXLoc⟩,
+       ⟨.unique, .loc fixtureSwapXsLoc⟩,
+       ⟨.unique, .loc fixtureSwapAccLoc⟩] := by
+  unfold fixtureSwapXStore fixtureSwapXLoc
+  apply RootOwnership.allocNode (store := fixtureSwapXsStore)
+    (world := .unique) (node := fixtureNode)
+    (rest := [⟨.unique, .loc fixtureSwapXsLoc⟩,
+              ⟨.unique, .loc fixtureSwapAccLoc⟩])
+  · simpa [fixtureNode, nodeChildren, rootsFor] using fixture_swap_xs_owned
+  · trivial
+
+private theorem fixture_swap_alloc_owned :
+    RootOwnership fixtureSwapStore
+      (⟨.unique, .loc fixtureSwapLoc⟩ :: fixtureSwapBefore) := by
+  unfold fixtureSwapStore fixtureSwapLoc fixtureSwapBefore
+  apply RootOwnership.allocNode (store := fixtureSwapXStore)
+    (world := .unique) (node := fixtureSwapOldNode)
+    (rest := [⟨.unique, .loc fixtureSwapAccLoc⟩])
+  · simpa [fixtureSwapOldNode, nodeChildren, rootsFor] using
+      fixture_swap_x_owned
+  · trivial
+
+private theorem fixture_swap_parent_get :
+    fixtureSwapStore.get? fixtureSwapLoc =
+      some ⟨.unique, 1, fixtureSwapOldNode⟩ :=
+  HeapIso.get?_allocNode_new fixtureSwapXStore .unique fixtureSwapOldNode
+
+/-- The old field roots plus `acc` permute (cons of a transposition —
+not an equality) to the new field roots plus `xs`. -/
+private theorem fixture_swap_partition :
+    (rootsFor .unique (nodeChildren fixtureSwapOldNode) ++
+        fixtureSwapBefore).Perm
+      (rootsFor .unique (nodeChildren fixtureSwapNewNode) ++
+        fixtureSwapAfter) := by
+  show List.Perm
+    ([⟨.unique, .loc fixtureSwapXLoc⟩, ⟨.unique, .loc fixtureSwapXsLoc⟩,
+      ⟨.unique, .loc fixtureSwapAccLoc⟩] : List Root)
+    ([⟨.unique, .loc fixtureSwapXLoc⟩, ⟨.unique, .loc fixtureSwapAccLoc⟩,
+      ⟨.unique, .loc fixtureSwapXsLoc⟩] : List Root)
+  exact .cons _ (.swap _ _ _)
+
+private def fixtureSwapReuseStore : Store :=
+  reuseNodeStore fixtureSwapStore fixtureSwapLoc fixtureSwapNewNode
+
+private def fixtureSwapReuseSpec : Store :=
+  ((fixtureSwapStore.kill fixtureSwapLoc).allocNode
+    .unique fixtureSwapNewNode).1
+
+private def fixtureSwapReuseFresh : Nat :=
+  ((fixtureSwapStore.kill fixtureSwapLoc).allocNode
+    .unique fixtureSwapNewNode).2
+
+/-- `reuse_sound` applied across a genuinely permuted partition: in-place
+reuse keeps `xs` alive as the leftover root while `acc` becomes the new
+second field, and both runs stay exactly owned and isomorphic. -/
+theorem fixture_swap_reuse_sound :
+    ∃ iso : HeapIso fixtureSwapReuseStore fixtureSwapReuseSpec,
+      RootOwnership fixtureSwapReuseStore
+          (⟨.unique, .loc fixtureSwapLoc⟩ :: fixtureSwapAfter) ∧
+      RootOwnership fixtureSwapReuseSpec
+          (⟨.unique, .loc fixtureSwapReuseFresh⟩ :: fixtureSwapAfter) ∧
+      iso.locRel fixtureSwapLoc fixtureSwapReuseFresh := by
+  simpa [fixtureSwapReuseStore, fixtureSwapReuseSpec,
+    fixtureSwapReuseFresh] using
+    (reuse_sound
+      (hget := fixture_swap_parent_get)
+      (hown := fixture_swap_alloc_owned)
+      (hpartition := fixture_swap_partition)
+      (hworld := by trivial)
+      (newNode := fixtureSwapNewNode)
+      (before := fixtureSwapBefore) (after := fixtureSwapAfter))
+
+private def fixtureCur : FnDef :=
+  { arity := 0, result := .shared, papSafe := false, body := .ret .erased }
+
+private def fixtureIdAddr : Address := default
+
+private def fixtureIdFn : FnDef :=
+  { arity := 1, result := .unique, papSafe := false, body := .ret (.var 0) }
+
+private def fixtureIdCtx : Ctx :=
+  { decls := fun a =>
+      if a = fixtureIdAddr then some (.fn fixtureIdFn) else none }
+
+/-- A one-argument identity demonstrates a non-circular function contract:
+the unique argument root becomes the unique result root without changing the
+store or unrelated roots. -/
+theorem fixture_id_contract :
+    FnOwnershipContract fixtureIdCtx fixtureIdFn [.unique] := by
+  refine ⟨rfl, ?_⟩
+  intro fuel store store' args value rest hlength hown hrun
+  cases args with
+  | nil => simp at hlength
+  | cons arg tail =>
+    cases tail with
+    | cons arg' tail => simp at hlength
+    | nil =>
+      cases fuel with
+      | zero => simp [runCode] at hrun
+      | succ fuel =>
+        rw [runCode.eq_def] at hrun
+        change (Except.ok (store, arg) : Except Err (Store × RVal)) =
+          Except.ok (store', value) at hrun
+        have hpair : (store, arg) = (store', value) :=
+          Except.ok.inj hrun
+        cases hpair
+        simpa [fixtureIdFn, rootsForWorlds] using hown
+
+theorem fixture_call_eval :
+    runOp fixtureIdCtx 3 fixtureCur fixtureUniqueStore
+        [.loc fixtureUniqueLoc] (.call fixtureIdAddr #[.var 0]) =
+      .ok (fixtureUniqueStore, .loc fixtureUniqueLoc) := by
+  rw [runOp.eq_def]
+  dsimp only
+  rw [show resolveAtoms [.loc fixtureUniqueLoc] #[.var 0] =
+    .ok [.loc fixtureUniqueLoc] by rfl, bindOk]
+  rw [invoke.eq_def]
+  dsimp only
+  rw [show fixtureIdCtx.decls fixtureIdAddr = some (.fn fixtureIdFn) by
+    simp [fixtureIdCtx]]
+  dsimp only [fixtureIdFn]
+  simp only [List.length_cons, List.length_nil, Nat.reduceAdd]
+  have harity : ¬ (((1 : Nat) != 1) = true) := by decide
+  rw [if_neg harity]
+  rw [runCode.eq_def]
+  dsimp only
+  rw [show resolveAtom [.loc fixtureUniqueLoc].reverse (.var 0) =
+    .ok (.loc fixtureUniqueLoc) by rfl, bindOk]
+  rw [bindOk]
+  unfold checkResultWorld RVal.hasWorld
+  dsimp only
+  have hworld : ((Owned.unique == Owned.unique) = true) := by decide
+  simp [fixture_unique_parent_get, hworld]
+
+theorem fixture_call_owned :
+    RootOwnership fixtureUniqueStore
+      [⟨.unique, .loc fixtureUniqueLoc⟩] := by
+  exact runOp_call_owned
+    (ctx := fixtureIdCtx) (fuel := 2) (cur := fixtureCur)
+    (store := fixtureUniqueStore) (store' := fixtureUniqueStore)
+    (env := [.loc fixtureUniqueLoc]) (f := fixtureIdAddr)
+    (atoms := #[.var 0]) (args := [.loc fixtureUniqueLoc])
+    (value := .loc fixtureUniqueLoc) (d := fixtureIdFn)
+    (argWorlds := [.unique]) (rest := [])
+    (by rfl)
+    (by simp [fixtureIdCtx])
+    fixture_id_contract
+    (by simpa [rootsForWorlds] using fixture_unique_alloc_owned)
+    fixture_call_eval
+
+theorem fixture_free_eval :
+    runOp fixtureCtx 1 fixtureCur fixtureUniqueStore
+        [.loc fixtureUniqueLoc] (.free (.var 0)) =
+      .ok (fixtureUniqueStore.kill fixtureUniqueLoc, .erased) := by
+  apply runOp_free
+  · rfl
+  · exact fixture_unique_parent_get
+
+theorem fixture_free_owned :
+    RootOwnership (fixtureUniqueStore.kill fixtureUniqueLoc)
+      [⟨.unique, .loc fixtureUniqueLeafLoc⟩] := by
+  have hfree :=
+    fixture_unique_alloc_owned.killUniqueOne fixture_unique_parent_get
+  simpa [fixtureUniqueParentNode, nodeChildren, rootsFor] using hfree
+
+private def fixtureCaseBody : Code :=
+  .letOp (.free (.var 1)) (.ret (.var 1))
+
+private def fixtureCaseAlts : Array Alt :=
+  #[.mk 0 1 fixtureCaseBody]
+
+private def fixtureCaseCode : Code :=
+  .case (.var 0) false fixtureCaseAlts
+
+private def fixtureCaseCur : FnDef :=
+  { arity := 0, result := .unique, papSafe := false, body := fixtureCaseCode }
+
+theorem fixture_case_field_borrowed :
+    HasWorld fixtureUniqueStore .unique (.loc fixtureUniqueLeafLoc) := by
+  apply fixture_unique_alloc_owned.caseFieldsBorrowed
+    (loc := fixtureUniqueLoc) (rc := 1) (cid := default)
+    (fields := #[.loc fixtureUniqueLeafLoc])
+  · simpa [fixtureUniqueParentNode] using fixture_unique_parent_get
+  · simp
+
+/-- The case fixture enters with a borrowed child, shallow-frees the unique
+scrutinee, and returns that child as the sole unique root. -/
+theorem fixture_case_eval :
+    runCode fixtureCtx 3 fixtureCaseCur fixtureUniqueStore
+        [.loc fixtureUniqueLoc] fixtureCaseCode =
+      .ok (fixtureUniqueStore.kill fixtureUniqueLoc,
+        .loc fixtureUniqueLeafLoc) := by
+  unfold fixtureCaseCode
+  rw [runCode_case_ctor
+    (hresolve := by rfl)
+    (hget := by
+      simpa [fixtureUniqueParentNode] using fixture_unique_parent_get)
+    (halt := by rfl) (hsize := by rfl)]
+  change runCode fixtureCtx 2 fixtureCaseCur fixtureUniqueStore
+    [.loc fixtureUniqueLeafLoc, .loc fixtureUniqueLoc] fixtureCaseBody =
+      .ok (fixtureUniqueStore.kill fixtureUniqueLoc,
+        .loc fixtureUniqueLeafLoc)
+  unfold fixtureCaseBody
+  rw [runCode.eq_def]
+  dsimp only
+  rw [runOp_free (hresolve := by rfl) fixture_unique_parent_get]
+  rw [bindOk]
+  rw [runCode.eq_def]
+  rfl
+
+theorem fixture_case_owned :
+    RootOwnership (fixtureUniqueStore.kill fixtureUniqueLoc)
+      [⟨.unique, .loc fixtureUniqueLeafLoc⟩] := by
+  apply runCode_case_ctor_owned
+    (ctx := fixtureCtx) (fuel := 2) (cur := fixtureCaseCur)
+    (store := fixtureUniqueStore)
+    (store' := fixtureUniqueStore.kill fixtureUniqueLoc)
+    (env := [.loc fixtureUniqueLoc]) (scrut := .var 0)
+    (peelNat := false) (alts := fixtureCaseAlts)
+    (loc := fixtureUniqueLoc) (rc := 1) (world := .unique)
+    (cid := default) (fields := #[.loc fixtureUniqueLeafLoc])
+    (tag := 0) (nf := 1) (body := fixtureCaseBody)
+    (value := .loc fixtureUniqueLeafLoc)
+    (roots := [⟨.unique, .loc fixtureUniqueLoc⟩]) (rest := [])
+  · rfl
+  · simpa [fixtureUniqueParentNode] using fixture_unique_parent_get
+  · rfl
+  · rfl
+  · exact fixture_unique_alloc_owned
+  · intro _ _ _
+    simpa [fixtureCaseCur] using fixture_free_owned
+  · exact fixture_case_eval
+
+private def fixtureNatBody : Code := .ret (.var 0)
+
+private def fixtureNatAlts : Array Alt :=
+  #[.mk 0 0 (.ret .erased), .mk 1 1 fixtureNatBody]
+
+private def fixtureNatCode : Code :=
+  .case (.var 0) true fixtureNatAlts
+
+private def fixtureNatCur : FnDef :=
+  { arity := 0, result := .shared, papSafe := false, body := fixtureNatCode }
+
+theorem fixture_nat_case_eval :
+    runCode fixtureCtx 2 fixtureNatCur ({} : Store)
+        [.lit (.nat 2)] fixtureNatCode =
+      .ok (({} : Store), .lit (.nat 1)) := by
+  unfold fixtureNatCode
+  rw [runCode_case_nat_succ (n := 1)
+    (hresolve := by rfl) (halt := by rfl)]
+  unfold fixtureNatBody
+  rw [runCode.eq_def]
+  rfl
+
+theorem fixture_nat_case_owned :
+    RootOwnership ({} : Store) [⟨.shared, .lit (.nat 1)⟩] := by
+  apply runCode_case_nat_succ_owned
+    (ctx := fixtureCtx) (fuel := 1) (cur := fixtureNatCur)
+    (store := ({} : Store)) (store' := ({} : Store))
+    (env := [.lit (.nat 2)]) (scrut := .var 0)
+    (alts := fixtureNatAlts) (n := 1) (tag := 1)
+    (body := fixtureNatBody) (value := .lit (.nat 1))
+    (roots := []) (rest := [])
+  · rfl
+  · rfl
+  · exact RootOwnership.empty
+  · intro _ _
+    exact RootOwnership.empty.addNoLocation (world := .shared) (by rfl)
+  · exact fixture_nat_case_eval
+
+private theorem fixture_aliased_child_get :
+    fixtureAliasedStore.get? fixtureLoc =
+      some ⟨.shared, 2, fixtureNode⟩ := by
+  have hleaf : fixtureStore.get? fixtureLoc =
+      some ⟨.shared, 1, fixtureNode⟩ :=
+    HeapIso.get?_allocNode_new ({} : Store) .shared fixtureNode
+  have hdup : fixtureDupStore.get? fixtureLoc =
+      some ⟨.shared, 2, fixtureNode⟩ :=
+    get?_incRcStore_same hleaf
+  exact HeapIso.get?_allocNode_old hdup
+
+theorem fixture_fetch_eval :
+    runOp fixtureCtx 1 fixtureCur fixtureAliasedStore
+        [.loc fixtureAliasedLoc] (.fetch (.var 0) 0) =
+      .ok (fixtureAliasedStore, .loc fixtureLoc) := by
+  apply runOp_fetch
+  · rfl
+  · exact fixture_aliased_parent_get
+  · rfl
+
+private def fixtureFetchRetainedStore : Store :=
+  incRcStore fixtureAliasedStore fixtureLoc
+    ⟨.shared, 2, fixtureNode⟩
+
+theorem fixture_fetch_dup_eval :
+    dupVals fixtureAliasedStore [.loc fixtureLoc] =
+      .ok fixtureFetchRetainedStore := by
+  exact dupVals_single fixture_aliased_child_get
+
+theorem fixture_fetch_dup_owned :
+    RootOwnership fixtureFetchRetainedStore
+      [⟨.shared, .loc fixtureLoc⟩,
+        ⟨.shared, .loc fixtureAliasedLoc⟩] := by
+  apply fetch_dupVals_preserves
+    (hget := fixture_aliased_parent_get) (i := 0)
+  · rfl
+  · exact fixture_aliased_alloc_owned
+  · exact fixture_fetch_dup_eval
+
+theorem fixture_fetch_dup_rc :
+    fixtureFetchRetainedStore.get? fixtureLoc =
+      some ⟨.shared, 3, fixtureNode⟩ :=
+  get?_incRcStore_same fixture_aliased_child_get
+
+end Ix.Compiler.IxIR1.Sim
diff --git a/Ix/Compiler/IxIR1/ThesisBench.lean b/Ix/Compiler/IxIR1/ThesisBench.lean
new file mode 100644
index 000000000..55e14ff22
--- /dev/null
+++ b/Ix/Compiler/IxIR1/ThesisBench.lean
@@ -0,0 +1,278 @@
+import Ix.Compiler.IxIR1.Lower
+
+/-!
+# Counter-level thesis evidence
+
+Paired IxIR₀ programs are lowered and executed twice: once with all runtime
+values shared, and once with the strongest modes the current restriction wall
+admits.  `eraseModes` makes "same program" executable rather than editorial:
+each pair has identical syntax after removing `Uses` annotations.
+
+The observations include the result digest and exact IxIR₁ instruction
+counters both before and after releasing the result.  These are deterministic
+interpreter counts, not wall-clock claims.  The present compiler still cannot
+destructure unique data and emits no `reuse`; accordingly this first suite
+measures construction and reclamation only and pins `reuses = 0` on both sides.
+-/
+
+namespace Ix.Compiler.IxIR1.ThesisBench
+
+open Ix.Compiler.Ixon (Address Owned Uses)
+open Ix.Compiler.IxIR0
+open Ix.Compiler.IxIR0.Examples
+open Ix.Compiler.IxIR1.Lower
+
+/-! ## Mode-insensitive program shape -/
+
+/-- Forget the lowering-only mode annotations from an IxIR₀ expression. -/
+def eraseModes : Expr → Expr
+  | .var index => .var index
+  | .ref address => .ref address
+  | .app function argument =>
+      .app (eraseModes function) (eraseModes argument)
+  | .lam _ body => .lam .many (eraseModes body)
+  | .letE _ value body =>
+      .letE .many (eraseModes value) (eraseModes body)
+  | .proj index value => .proj index (eraseModes value)
+  | .lit literal => .lit literal
+  | .erased => .erased
+
+/-! ## Executable observations -/
+
+structure CounterSnapshot where
+  allocs : Nat
+  reuses : Nat
+  frees : Nat
+  rcops : Nat
+  live : Nat
+  deriving BEq, Repr
+
+def CounterSnapshot.ofStore (store : Store) : CounterSnapshot :=
+  { allocs := store.allocs
+    reuses := store.reuses
+    frees := store.frees
+    rcops := store.rcops
+    live := store.live }
+
+inductive ResultDigest where
+  | nat (value : Nat)
+  | natPair (first second : Nat)
+  deriving BEq, Repr
+
+def digestTree? (tree : Tree) : Option ResultDigest :=
+  match natT? tree with
+  | some value => some (.nat value)
+  | none =>
+    match tree with
+    | .ctorT address 0 [first, second] => do
+      if address != pairMk then none
+      let first ← natT? first
+      let second ← natT? second
+      pure (.natPair first second)
+    | _ => none
+
+structure Observation where
+  result : ResultDigest
+  beforeRelease : CounterSnapshot
+  afterRelease : CounterSnapshot
+  deriving BEq, Repr
+
+/-- Compile, execute, decode, and release one closed benchmark. -/
+def observe (decls : List (Address × IxIR0.Decl)) (expression : Expr)
+    (world : Owned) : Option Observation := do
+  let (targetDecls, code) ←
+    (lowerAll decls expression world).toOption
+  let ctx : Ctx :=
+    { decls := Env.ofList targetDecls, oracle := tgtOracle }
+  let (store, value) ← (runMain ctx code).toOption
+  let tree ← treeOfR store 1000 value
+  let result ← digestTree? tree
+  let released ← (releaseResult ctx 100000 store value).toOption
+  pure
+    { result
+      beforeRelease := .ofStore store
+      afterRelease := .ofStore released }
+
+structure BenchmarkReport where
+  name : String
+  sameProgram : Bool
+  allShared : Option Observation
+  modeDirected : Option Observation
+  deriving BEq, Repr
+
+/-! ## Three paired programs -/
+
+/-- Build the same pair of unary naturals entirely in the shared world. -/
+def sharedPair : Expr :=
+  .letE .many (natE 2) (.letE .many (natE 3)
+    (.app (.app (.ref pairMk) (.var 1)) (.var 0)))
+
+/-- The identical pair construction with linear bindings and a unique result. -/
+def modePair : Expr :=
+  .letE .linear (natE 2) (.letE .linear (natE 3)
+    (.app (.app (.ref pairMk) (.var 1)) (.var 0)))
+
+/-- Construct `2̂`, discard it, and return `1̂` in the shared world. -/
+def sharedDead : Expr := .letE .many (natE 2) (natE 1)
+
+/-- The identical dead-value program with affine reclamation. -/
+def modeDead : Expr := .letE .affine (natE 2) (natE 1)
+
+private def keepSecondAddress : Address := synthAddr 700
+
+private def sharedKeepSecondBody : Expr :=
+  .lam .many (.lam .many (.var 0))
+
+private def modeKeepSecondBody : Expr :=
+  .lam .affine (.lam .many (.var 0))
+
+private def sharedKeepSecondDecls : List (Address × IxIR0.Decl) :=
+  declList ++ [(keepSecondAddress, .defn .shared sharedKeepSecondBody)]
+
+private def modeKeepSecondDecls : List (Address × IxIR0.Decl) :=
+  declList ++ [(keepSecondAddress, .defn .shared modeKeepSecondBody)]
+
+/-- Apply `fun _ y => y` to unary `1̂` and `2̂`.  Only the first
+parameter's mode changes between declaration sets; the result stays shared. -/
+def keepSecondMain : Expr :=
+  .app (.app (.ref keepSecondAddress) (natE 1)) (natE 2)
+
+def reports : List BenchmarkReport :=
+  [ { name := "pair-tree"
+      sameProgram := eraseModes sharedPair == eraseModes modePair
+      allShared := observe declList sharedPair .shared
+      modeDirected := observe declList modePair .unique }
+  , { name := "dead-tree"
+      sameProgram := eraseModes sharedDead == eraseModes modeDead
+      allShared := observe declList sharedDead .shared
+      modeDirected := observe declList modeDead .unique }
+  , { name := "dead-parameter"
+      sameProgram :=
+        eraseModes sharedKeepSecondBody == eraseModes modeKeepSecondBody
+      allShared := observe sharedKeepSecondDecls keepSecondMain .shared
+      modeDirected := observe modeKeepSecondDecls keepSecondMain .shared } ]
+
+private def snapshot (allocs reuses frees rcops live : Nat) :
+    CounterSnapshot :=
+  { allocs, reuses, frees, rcops, live }
+
+private def observation (result : ResultDigest)
+    (beforeRelease afterRelease : CounterSnapshot) : Observation :=
+  { result, beforeRelease, afterRelease }
+
+def expectedReports : List BenchmarkReport :=
+  [ { name := "pair-tree", sameProgram := true
+      allShared := some <| observation (.natPair 2 3)
+        (snapshot 8 0 0 0 8) (snapshot 8 0 8 8 0)
+      modeDirected := some <| observation (.natPair 2 3)
+        (snapshot 8 0 0 0 8) (snapshot 8 0 8 0 0) }
+  , { name := "dead-tree", sameProgram := true
+      allShared := some <| observation (.nat 1)
+        (snapshot 5 0 3 3 2) (snapshot 5 0 5 5 0)
+      modeDirected := some <| observation (.nat 1)
+        (snapshot 5 0 3 0 2) (snapshot 5 0 5 0 0) }
+  , { name := "dead-parameter", sameProgram := true
+      allShared := some <| observation (.nat 2)
+        (snapshot 5 0 2 2 3) (snapshot 5 0 5 5 0)
+      modeDirected := some <| observation (.nat 2)
+        (snapshot 5 0 2 0 3) (snapshot 5 0 5 3 0) } ]
+
+#guard reports == expectedReports
+
+structure CounterTotals where
+  allocs : Nat := 0
+  reuses : Nat := 0
+  frees : Nat := 0
+  rcops : Nat := 0
+  deriving BEq, Repr
+
+def CounterTotals.addSnapshot (total : CounterTotals)
+    (snapshot : CounterSnapshot) : CounterTotals :=
+  { allocs := total.allocs + snapshot.allocs
+    reuses := total.reuses + snapshot.reuses
+    frees := total.frees + snapshot.frees
+    rcops := total.rcops + snapshot.rcops }
+
+def releasedTotals (select : BenchmarkReport → Option Observation) :
+    List BenchmarkReport → CounterTotals
+  | [] => {}
+  | report :: rest =>
+    let tail := releasedTotals select rest
+    match select report with
+    | some observed => tail.addSnapshot observed.afterRelease
+    | none => tail
+
+def allSharedTotals : CounterTotals :=
+  releasedTotals (fun report => report.allShared) reports
+
+def modeDirectedTotals : CounterTotals :=
+  releasedTotals (fun report => report.modeDirected) reports
+
+def savedRcOps : Nat := allSharedTotals.rcops - modeDirectedTotals.rcops
+
+#guard allSharedTotals ==
+  ({ allocs := 18, reuses := 0, frees := 18, rcops := 18 } :
+    CounterTotals)
+#guard modeDirectedTotals ==
+  ({ allocs := 18, reuses := 0, frees := 18, rcops := 3 } :
+    CounterTotals)
+#guard savedRcOps == 15
+
+/-! ## Mode-adversarial boundaries
+
+These pairs share one mode-erased expression shape but sit on opposite sides
+of a static rule.  The exact diagnostics prevent a different rejection from
+accidentally satisfying the fixture. -/
+
+def sharedDuplicate : Expr :=
+  .letE .many (natE 1)
+    (.app (.app (.ref pairMk) (.var 0)) (.var 0))
+
+def linearDuplicate : Expr :=
+  .letE .linear (natE 1)
+    (.app (.app (.ref pairMk) (.var 0)) (.var 0))
+
+def deadLinear : Expr := .letE .linear (natE 2) (natE 1)
+
+def compileError? (expression : Expr) (world : Owned) : Option String :=
+  match lowerAll declList expression world with
+  | .ok _ => none
+  | .error message => some message
+
+structure AdversarialReport where
+  name : String
+  sameProgram : Bool
+  accepted : Bool
+  rejectedError : Option String
+  deriving BEq, Repr
+
+def adversarialReports : List AdversarialReport :=
+  [ { name := "duplicate-shared-vs-linear"
+      sameProgram := eraseModes sharedDuplicate == eraseModes linearDuplicate
+      accepted := (lowerAll declList sharedDuplicate .shared).isOk
+      rejectedError := compileError? linearDuplicate .unique }
+  , { name := "dead-affine-vs-linear"
+      sameProgram := eraseModes modeDead == eraseModes deadLinear
+      accepted := (lowerAll declList modeDead .unique).isOk
+      rejectedError := compileError? deadLinear .unique } ]
+
+#guard adversarialReports ==
+  [ { name := "duplicate-shared-vs-linear", sameProgram := true
+      accepted := true
+      rejectedError := some "unique variable used more than once" }
+  , { name := "dead-affine-vs-linear", sameProgram := true
+      accepted := true
+      rejectedError := some "unused linear binding" } ]
+
+def mismatchRejections : List (String × Option String) :=
+  [ ("dereliction", compileError?
+      (.letE .many (natE 1) (.app (.ref natSucc) (.var 0))) .unique)
+  , ("freeze", compileError?
+      (.letE .linear (natE 1) (.app (.ref natSucc) (.var 0))) .shared) ]
+
+#guard mismatchRejections ==
+  [ ("dereliction", some "dereliction: shared value at unique demand")
+  , ("freeze", some
+      "freeze not in v0: unique value at non-unique sink (see docs/compiler/lowering-restrictions.md)") ]
+
+end Ix.Compiler.IxIR1.ThesisBench
diff --git a/Ix/Compiler/IxIR1/WellModedGen.lean b/Ix/Compiler/IxIR1/WellModedGen.lean
new file mode 100644
index 000000000..be1c0bd11
--- /dev/null
+++ b/Ix/Compiler/IxIR1/WellModedGen.lean
@@ -0,0 +1,552 @@
+import Ix.Compiler.IxIR1.Lower
+
+/-!
+# Seeded well-moded IxIR₀ program generation
+
+A deterministic property corpus for the IxIR₀ → IxIR₁ differential boundary.
+Positive templates generate closed programs inside the lowerer's current
+ownership fragment and must pass source/target tree agreement plus target
+leak-freedom.  Adversarial templates sit exactly one mode boundary outside
+that fragment and must fail lowering with a pinned diagnostic.
+
+Generation has no ambient randomness.  Every case records the corpus seed,
+case index, and PRNG state at the start of the case; `replay` reconstructs it
+directly.  Template-preserving shrink candidates retain the same expected
+outcome, so a mismatch can be minimized without turning into an unrelated
+open or ill-shaped expression.
+-/
+
+namespace Ix.Compiler.IxIR1.WellModedGen
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR0
+open Ix.Compiler.IxIR0.Examples
+open Ix.Compiler.IxIR1.Lower
+
+def defaultSeed : UInt64 := 0x243f6a8885a308d3
+def defaultCases : Nat := 280
+
+/-! ## Replayable deterministic entropy -/
+
+abbrev GenM := StateM UInt64
+
+def next : GenM UInt64 := do
+  let state ← get
+  let state' := state * 6364136223846793005 + 1442695040888963407
+  set state'
+  return state'
+
+def choose (bound : Nat) : GenM Nat := do
+  if bound == 0 then return 0
+  return (← next).toNat % bound
+
+def chooseBool : GenM Bool := do
+  return (← choose 2) == 1
+
+def chooseNat : GenM Nat := choose 7
+
+def chooseNatList : GenM (List Nat) := do
+  let length ← choose 5
+  let mut values := []
+  for _ in [:length] do
+    values := (← chooseNat) :: values
+  return values.reverse
+
+/-! ## Closed program schemas -/
+
+inductive NatForm where
+  | ctor
+  | literal
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def NatForm.expr : NatForm → Nat → Expr
+  | .ctor, n => natE n
+  | .literal, n => .lit (.nat n)
+
+def chooseNatForm : GenM NatForm := do
+  if ← chooseBool then return .ctor else return .literal
+
+inductive Kind where
+  | natAdd
+  | externAdd
+  | sharedDuplicate
+  | sharedProjection
+  | sharedDead
+  | listLength
+  | listAppend
+  | capturedLambda
+  | dynamicPap
+  | partialAdd
+  | uniquePair
+  | linearPair
+  | linearIdentity
+  | affineDead
+  | mixedDropFst
+  | mixedDropSnd
+  | erasedApp
+  | erasedProjection
+  | freezeNeeded
+  | dereliction
+  | duplicateUnique
+  | deadLinear
+  | uniqueProjection
+  | nonManyLambda
+  | partialNonMany
+  | sharedCallAtUnique
+  | uniqueCapture
+  | uniqueRecursor
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def allKinds : Array Kind := #[
+  .natAdd,
+  .externAdd,
+  .sharedDuplicate,
+  .sharedProjection,
+  .sharedDead,
+  .listLength,
+  .listAppend,
+  .capturedLambda,
+  .dynamicPap,
+  .partialAdd,
+  .uniquePair,
+  .linearPair,
+  .linearIdentity,
+  .affineDead,
+  .mixedDropFst,
+  .mixedDropSnd,
+  .erasedApp,
+  .erasedProjection,
+  .freezeNeeded,
+  .dereliction,
+  .duplicateUnique,
+  .deadLinear,
+  .uniqueProjection,
+  .nonManyLambda,
+  .partialNonMany,
+  .sharedCallAtUnique,
+  .uniqueCapture,
+  .uniqueRecursor]
+
+inductive Template where
+  | natAdd (leftForm rightForm : NatForm) (left right : Nat)
+  | externAdd (left right : Nat)
+  | sharedDuplicate (value : Nat)
+  | sharedProjection (field left right : Nat)
+  | sharedDead (dead kept : Nat)
+  | listLength (values : List Nat)
+  | listAppend (left right : List Nat)
+  | capturedLambda (captured argument : Nat)
+  | dynamicPap (leftForm rightForm : NatForm) (left right : Nat)
+  | partialAdd (form : NatForm) (value : Nat)
+  | uniquePair (left right : Nat)
+  | linearPair (left right : Nat)
+  | linearIdentity (value : Nat)
+  | affineDead (dead kept : Nat)
+  | mixedDropFst (dead kept : Nat)
+  | mixedDropSnd (kept dead : Nat)
+  | erasedApp (argument : Nat)
+  | erasedProjection (field : Nat)
+  | freezeNeeded (value : Nat)
+  | dereliction (value : Nat)
+  | duplicateUnique (value : Nat)
+  | deadLinear (dead kept : Nat)
+  | uniqueProjection (field left right : Nat)
+  | nonManyLambda (argument result : Nat)
+  | partialNonMany (argument : Nat)
+  | sharedCallAtUnique (left right kept : Nat)
+  | uniqueCapture (value : Nat)
+  | uniqueRecursor (major : Nat)
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def Template.kind : Template → Kind
+  | .natAdd .. => .natAdd
+  | .externAdd .. => .externAdd
+  | .sharedDuplicate .. => .sharedDuplicate
+  | .sharedProjection .. => .sharedProjection
+  | .sharedDead .. => .sharedDead
+  | .listLength .. => .listLength
+  | .listAppend .. => .listAppend
+  | .capturedLambda .. => .capturedLambda
+  | .dynamicPap .. => .dynamicPap
+  | .partialAdd .. => .partialAdd
+  | .uniquePair .. => .uniquePair
+  | .linearPair .. => .linearPair
+  | .linearIdentity .. => .linearIdentity
+  | .affineDead .. => .affineDead
+  | .mixedDropFst .. => .mixedDropFst
+  | .mixedDropSnd .. => .mixedDropSnd
+  | .erasedApp .. => .erasedApp
+  | .erasedProjection .. => .erasedProjection
+  | .freezeNeeded .. => .freezeNeeded
+  | .dereliction .. => .dereliction
+  | .duplicateUnique .. => .duplicateUnique
+  | .deadLinear .. => .deadLinear
+  | .uniqueProjection .. => .uniqueProjection
+  | .nonManyLambda .. => .nonManyLambda
+  | .partialNonMany .. => .partialNonMany
+  | .sharedCallAtUnique .. => .sharedCallAtUnique
+  | .uniqueCapture .. => .uniqueCapture
+  | .uniqueRecursor .. => .uniqueRecursor
+
+private def app2 (fn left right : Expr) : Expr :=
+  .app (.app fn left) right
+
+def Template.expr : Template → Expr
+  | .natAdd leftForm rightForm left right =>
+    app2 (.ref natAddDef) (leftForm.expr left) (rightForm.expr right)
+  | .externAdd left right =>
+    app2 (.ref natAddExt) (.lit (.nat left)) (.lit (.nat right))
+  | .sharedDuplicate value =>
+    .letE .many (natE value)
+      (app2 (.ref pairMk) (.var 0) (.var 0))
+  | .sharedProjection field left right =>
+    .proj (field % 2) (app2 (.ref pairMk) (natE left) (natE right))
+  | .sharedDead dead kept =>
+    .letE .many (natE dead) (natE kept)
+  | .listLength values =>
+    .app (.ref lengthDef) (listE natE values)
+  | .listAppend left right =>
+    app2 (.ref appendDef) (listE natE left) (listE natE right)
+  | .capturedLambda captured argument =>
+    .app
+      (.lam .many
+        (.app
+          (.lam .many (app2 (.ref natAddDef) (.var 1) (.var 0)))
+          (natE argument)))
+      (natE captured)
+  | .dynamicPap leftForm rightForm left right =>
+    .letE .many (.app (.ref natAddDef) (leftForm.expr left))
+      (.app (.var 0) (rightForm.expr right))
+  | .partialAdd form value =>
+    .app (.ref natAddDef) (form.expr value)
+  | .uniquePair left right =>
+    app2 (.ref pairMk) (natE left) (natE right)
+  | .linearPair left right =>
+    .letE .linear (natE left)
+      (.letE .linear (natE right)
+        (app2 (.ref pairMk) (.var 1) (.var 0)))
+  | .linearIdentity value =>
+    .letE .linear (natE value) (.var 0)
+  | .affineDead dead kept =>
+    .letE .affine (natE dead) (natE kept)
+  | .mixedDropFst dead kept =>
+    app2 (.ref dropFstDef) (natE dead) (natE kept)
+  | .mixedDropSnd kept dead =>
+    app2 (.ref dropSndDef) (natE kept) (natE dead)
+  | .erasedApp argument =>
+    .app .erased (natE argument)
+  | .erasedProjection field =>
+    .proj field .erased
+  | .freezeNeeded value =>
+    .letE .linear (natE value) (.app (.ref natSucc) (.var 0))
+  | .dereliction value =>
+    .letE .many (natE value) (.app (.ref natSucc) (.var 0))
+  | .duplicateUnique value =>
+    .letE .linear (natE value)
+      (app2 (.ref pairMk) (.var 0) (.var 0))
+  | .deadLinear dead kept =>
+    .letE .linear (natE dead) (natE kept)
+  | .uniqueProjection field left right =>
+    .letE .linear (app2 (.ref pairMk) (natE left) (natE right))
+      (.proj (field % 2) (.var 0))
+  | .nonManyLambda argument result =>
+    .app (.lam .affine (.lit (.nat result))) (natE argument)
+  | .partialNonMany argument =>
+    .app (.ref dropFstDef) (natE argument)
+  | .sharedCallAtUnique left right kept =>
+    .letE .affine
+      (app2 (.ref natAddDef) (natE left) (natE right))
+      (natE kept)
+  | .uniqueCapture value =>
+    .letE .linear (natE value) (.lam .many (.var 1))
+  | .uniqueRecursor major =>
+    .letE .linear (natE major)
+      (.app
+        (.app
+          (.app (.ref natRec) (natE 0))
+          (.lam .many (.lam .many (.app (.ref natSucc) (.var 0)))))
+        (.var 0))
+
+inductive Expectation where
+  | differential (world : Owned)
+  | lowerError (world : Owned) (message : String)
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def Template.expectation : Template → Expectation
+  | .uniquePair .. | .linearPair .. | .linearIdentity .. | .affineDead .. =>
+    .differential .unique
+  | .freezeNeeded .. =>
+    .lowerError .shared RestrictionKind.freeze.diagnostic
+  | .dereliction .. =>
+    .lowerError .unique "dereliction: shared value at unique demand"
+  | .duplicateUnique .. =>
+    .lowerError .unique "unique variable used more than once"
+  | .deadLinear .. => .lowerError .shared "unused linear binding"
+  | .uniqueProjection .. =>
+    .lowerError .shared RestrictionKind.uniqueDestructuring.diagnostic
+  | .nonManyLambda .. | .partialNonMany .. =>
+    .lowerError .shared RestrictionKind.sharedFunctionValues.diagnostic
+  | .sharedCallAtUnique .. =>
+    .lowerError .shared "call result is shared at unique demand"
+  | .uniqueCapture .. =>
+    .lowerError .shared RestrictionKind.uniqueCapture.diagnostic
+  | .uniqueRecursor .. =>
+    .lowerError .shared RestrictionKind.modeMonomorphicRecursors.diagnostic
+  | _ => .differential .shared
+
+def genTemplate : Kind → GenM Template
+  | .natAdd => do
+    return .natAdd (← chooseNatForm) (← chooseNatForm)
+      (← chooseNat) (← chooseNat)
+  | .externAdd => return .externAdd (← chooseNat) (← chooseNat)
+  | .sharedDuplicate => return .sharedDuplicate (← chooseNat)
+  | .sharedProjection =>
+    return .sharedProjection (← choose 2) (← chooseNat) (← chooseNat)
+  | .sharedDead => return .sharedDead (← chooseNat) (← chooseNat)
+  | .listLength => return .listLength (← chooseNatList)
+  | .listAppend => return .listAppend (← chooseNatList) (← chooseNatList)
+  | .capturedLambda => return .capturedLambda (← chooseNat) (← chooseNat)
+  | .dynamicPap => do
+    return .dynamicPap (← chooseNatForm) (← chooseNatForm)
+      (← chooseNat) (← chooseNat)
+  | .partialAdd => return .partialAdd (← chooseNatForm) (← chooseNat)
+  | .uniquePair => return .uniquePair (← chooseNat) (← chooseNat)
+  | .linearPair => return .linearPair (← chooseNat) (← chooseNat)
+  | .linearIdentity => return .linearIdentity (← chooseNat)
+  | .affineDead => return .affineDead (← chooseNat) (← chooseNat)
+  | .mixedDropFst => return .mixedDropFst (← chooseNat) (← chooseNat)
+  | .mixedDropSnd => return .mixedDropSnd (← chooseNat) (← chooseNat)
+  | .erasedApp => return .erasedApp (← chooseNat)
+  | .erasedProjection => return .erasedProjection (← choose 4)
+  | .freezeNeeded => return .freezeNeeded (← chooseNat)
+  | .dereliction => return .dereliction (← chooseNat)
+  | .duplicateUnique => return .duplicateUnique (← chooseNat)
+  | .deadLinear => return .deadLinear (← chooseNat) (← chooseNat)
+  | .uniqueProjection =>
+    return .uniqueProjection (← choose 2) (← chooseNat) (← chooseNat)
+  | .nonManyLambda => return .nonManyLambda (← chooseNat) (← chooseNat)
+  | .partialNonMany => return .partialNonMany (← chooseNat)
+  | .sharedCallAtUnique =>
+    return .sharedCallAtUnique (← chooseNat) (← chooseNat) (← chooseNat)
+  | .uniqueCapture => return .uniqueCapture (← chooseNat)
+  | .uniqueRecursor => return .uniqueRecursor (← chooseNat)
+
+/-! ## Template-preserving shrinking -/
+
+private def shrinkNat (value : Nat) : List Nat :=
+  if value == 0 then []
+  else [0, value / 2].eraseDups
+
+private def shrinkNatList (values : List Nat) : List (List Nat) :=
+  if values.isEmpty then []
+  else
+    let zeros := values.map fun _ => 0
+    ([[], values.take (values.length / 2)] ++
+      if zeros == values then [] else [zeros]).eraseDups
+
+private def shrinkPair (make : Nat → Nat → Template) (left right : Nat) :
+    List Template :=
+  (shrinkNat left).map (make · right) ++
+    (shrinkNat right).map (make left)
+
+private def shrinkTriple (make : Nat → Nat → Nat → Template)
+    (first second third : Nat) : List Template :=
+  (shrinkNat first).map (make · second third) ++
+    (shrinkNat second).map (make first · third) ++
+    (shrinkNat third).map (make first second)
+
+def Template.shrinks : Template → List Template
+  | .natAdd leftForm rightForm left right =>
+    (if leftForm == .ctor then [.natAdd .literal rightForm left right] else []) ++
+    (if rightForm == .ctor then [.natAdd leftForm .literal left right] else []) ++
+    shrinkPair (.natAdd leftForm rightForm) left right
+  | .externAdd left right => shrinkPair .externAdd left right
+  | .sharedDuplicate value => (shrinkNat value).map .sharedDuplicate
+  | .sharedProjection field left right =>
+    shrinkPair (.sharedProjection field) left right
+  | .sharedDead dead kept => shrinkPair .sharedDead dead kept
+  | .listLength values => (shrinkNatList values).map .listLength
+  | .listAppend left right =>
+    (shrinkNatList left).map (.listAppend · right) ++
+      (shrinkNatList right).map (.listAppend left)
+  | .capturedLambda captured argument =>
+    shrinkPair .capturedLambda captured argument
+  | .dynamicPap leftForm rightForm left right =>
+    (if leftForm == .ctor then [.dynamicPap .literal rightForm left right]
+      else []) ++
+    (if rightForm == .ctor then [.dynamicPap leftForm .literal left right]
+      else []) ++
+    shrinkPair (.dynamicPap leftForm rightForm) left right
+  | .partialAdd form value =>
+    (if form == .ctor then [.partialAdd .literal value] else []) ++
+      (shrinkNat value).map (.partialAdd form)
+  | .uniquePair left right => shrinkPair .uniquePair left right
+  | .linearPair left right => shrinkPair .linearPair left right
+  | .linearIdentity value => (shrinkNat value).map .linearIdentity
+  | .affineDead dead kept => shrinkPair .affineDead dead kept
+  | .mixedDropFst dead kept => shrinkPair .mixedDropFst dead kept
+  | .mixedDropSnd kept dead => shrinkPair .mixedDropSnd kept dead
+  | .erasedApp argument => (shrinkNat argument).map .erasedApp
+  | .erasedProjection field => (shrinkNat field).map .erasedProjection
+  | .freezeNeeded value => (shrinkNat value).map .freezeNeeded
+  | .dereliction value => (shrinkNat value).map .dereliction
+  | .duplicateUnique value => (shrinkNat value).map .duplicateUnique
+  | .deadLinear dead kept => shrinkPair .deadLinear dead kept
+  | .uniqueProjection field left right =>
+    shrinkTriple .uniqueProjection field left right
+  | .nonManyLambda argument result =>
+    shrinkPair .nonManyLambda argument result
+  | .partialNonMany argument => (shrinkNat argument).map .partialNonMany
+  | .sharedCallAtUnique left right kept =>
+    shrinkTriple .sharedCallAtUnique left right kept
+  | .uniqueCapture value => (shrinkNat value).map .uniqueCapture
+  | .uniqueRecursor major => (shrinkNat major).map .uniqueRecursor
+
+/-! ## Cases, replay, checking, and failure minimization -/
+
+structure Replay where
+  seed : UInt64
+  index : Nat
+  state : UInt64
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure Case where
+  replayToken : Replay
+  kind : Kind
+  template : Template
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def generateAt (seed : UInt64) (index : Nat) (state : UInt64) :
+    Case × UInt64 :=
+  let kind := allKinds[index % allKinds.size]!
+  let (template, nextState) := (genTemplate kind).run state
+  (⟨⟨seed, index, state⟩, kind, template⟩, nextState)
+
+def replay (token : Replay) : Case :=
+  (generateAt token.seed token.index token.state).1
+
+def Case.holds (test : Case) : Bool :=
+  match test.template.expectation with
+  | .differential world => diffExpr test.template.expr world
+  | .lowerError world message => lowersErr test.template.expr world message
+
+def Case.withTemplate (test : Case) (template : Template) : Case :=
+  { test with kind := template.kind, template }
+
+inductive FailureKind where
+  | replayDrift
+  | shrinkExpectationDrift
+  | propertyMismatch
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure Failure where
+  kind : FailureKind
+  original : Case
+  minimized : Case
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def minimizeFailure : Nat → Case → Case
+  | 0, test => test
+  | fuel + 1, test =>
+    match test.template.shrinks.find? fun template =>
+        !(test.withTemplate template).holds with
+    | none => test
+    | some template => minimizeFailure fuel (test.withTemplate template)
+
+def checkCorpus (seed : UInt64 := defaultSeed)
+    (count : Nat := defaultCases) : Option Failure := Id.run do
+  let mut state := seed
+  for index in [:count] do
+    let (test, nextState) := generateAt seed index state
+    if replay test.replayToken != test then
+      return some ⟨.replayDrift, test, test⟩
+    if !test.template.shrinks.all fun template =>
+        template.expectation == test.template.expectation then
+      return some ⟨.shrinkExpectationDrift, test, test⟩
+    if !test.holds then
+      return some ⟨.propertyMismatch, test, minimizeFailure 128 test⟩
+    state := nextState
+  return none
+
+/-! ## A stable corpus fingerprint -/
+
+private def mix (hash value : UInt64) : UInt64 :=
+  hash * 1099511628211 + value + 1469598103934665603
+
+private def mixNat (hash : UInt64) (value : Nat) : UInt64 :=
+  mix hash value.toUInt64
+
+private def mixForm (hash : UInt64) : NatForm → UInt64
+  | .ctor => mix hash 0
+  | .literal => mix hash 1
+
+private def mixList (hash : UInt64) (values : List Nat) : UInt64 :=
+  values.foldl mixNat (mixNat hash values.length)
+
+def Template.fingerprint : Template → UInt64
+  | .natAdd lf rf left right =>
+    mixNat (mixNat (mixForm (mixForm (mix 0 0) lf) rf) left) right
+  | .externAdd left right => mixNat (mixNat (mix 0 1) left) right
+  | .sharedDuplicate value => mixNat (mix 0 2) value
+  | .sharedProjection field left right =>
+    mixNat (mixNat (mixNat (mix 0 3) field) left) right
+  | .sharedDead dead kept => mixNat (mixNat (mix 0 4) dead) kept
+  | .listLength values => mixList (mix 0 5) values
+  | .listAppend left right => mixList (mixList (mix 0 6) left) right
+  | .capturedLambda captured argument =>
+    mixNat (mixNat (mix 0 7) captured) argument
+  | .dynamicPap lf rf left right =>
+    mixNat (mixNat (mixForm (mixForm (mix 0 8) lf) rf) left) right
+  | .partialAdd form value => mixNat (mixForm (mix 0 9) form) value
+  | .uniquePair left right => mixNat (mixNat (mix 0 10) left) right
+  | .linearPair left right => mixNat (mixNat (mix 0 11) left) right
+  | .linearIdentity value => mixNat (mix 0 12) value
+  | .affineDead dead kept => mixNat (mixNat (mix 0 13) dead) kept
+  | .mixedDropFst dead kept => mixNat (mixNat (mix 0 14) dead) kept
+  | .mixedDropSnd kept dead => mixNat (mixNat (mix 0 15) kept) dead
+  | .erasedApp argument => mixNat (mix 0 16) argument
+  | .erasedProjection field => mixNat (mix 0 17) field
+  | .freezeNeeded value => mixNat (mix 0 18) value
+  | .dereliction value => mixNat (mix 0 19) value
+  | .duplicateUnique value => mixNat (mix 0 20) value
+  | .deadLinear dead kept => mixNat (mixNat (mix 0 21) dead) kept
+  | .uniqueProjection field left right =>
+    mixNat (mixNat (mixNat (mix 0 22) field) left) right
+  | .nonManyLambda argument result =>
+    mixNat (mixNat (mix 0 23) argument) result
+  | .partialNonMany argument => mixNat (mix 0 24) argument
+  | .sharedCallAtUnique left right kept =>
+    mixNat (mixNat (mixNat (mix 0 25) left) right) kept
+  | .uniqueCapture value => mixNat (mix 0 26) value
+  | .uniqueRecursor major => mixNat (mix 0 27) major
+
+structure Summary where
+  checked : Nat
+  differential : Nat
+  expectedRejections : Nat
+  allKindsSeen : Bool
+  finalState : UInt64
+  fingerprint : UInt64
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+def summarize (seed : UInt64 := defaultSeed)
+    (count : Nat := defaultCases) : Summary := Id.run do
+  let mut state := seed
+  let mut differential := 0
+  let mut expectedRejections := 0
+  let mut seen := Array.replicate allKinds.size false
+  let mut fingerprint : UInt64 := 0xcbf29ce484222325
+  for index in [:count] do
+    let (test, nextState) := generateAt seed index state
+    match test.template.expectation with
+    | .differential _ => differential := differential + 1
+    | .lowerError .. => expectedRejections := expectedRejections + 1
+    seen := seen.set! (index % allKinds.size) true
+    fingerprint := mix fingerprint test.template.fingerprint
+    state := nextState
+  return ⟨count, differential, expectedRejections,
+    seen.all (fun covered => covered), state, fingerprint⟩
+
+#guard allKinds.size == 28
+
+end Ix.Compiler.IxIR1.WellModedGen
diff --git a/Ix/Compiler/IxIR2/AllocationEvents.lean b/Ix/Compiler/IxIR2/AllocationEvents.lean
new file mode 100644
index 000000000..a82537dd1
--- /dev/null
+++ b/Ix/Compiler/IxIR2/AllocationEvents.lean
@@ -0,0 +1,400 @@
+import Ix.Compiler.IxIR2.HeapAccounting
+import Ix.Compiler.IxIR1.EvalIso
+
+/-!
+# Allocation events, independently of physical storage
+
+An allocation instruction either acquires a fresh slot or fills a reserved
+slot. Both count as one event. This auxiliary observation is separate from
+the semantic heap and value relations.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1 (Node NodeBox RVal)
+
+def Store.allocationEvents (store : Store) : Nat :=
+  store.heap.allocs + store.heap.reuses
+
+@[simp] theorem Store.allocationEvents_allocNode (store : Store)
+    (world : Owned) (node : Node) :
+    (store.allocNode world node).1.allocationEvents = store.allocationEvents + 1 := by
+  simp [Store.allocationEvents, IxIR1.Store.allocNode]
+  omega
+
+@[simp] theorem Store.allocationEvents_setBox (store : Store)
+    (location : Nat) (box : NodeBox) :
+    (store.setBox location box).allocationEvents = store.allocationEvents := rfl
+
+@[simp] theorem Store.allocationEvents_kill (store : Store) (location : Nat) :
+    (store.kill location).allocationEvents = store.allocationEvents := rfl
+
+@[simp] theorem Store.allocationEvents_reserve (store : Store) (location : Nat) :
+    (store.reserve location).allocationEvents = store.allocationEvents := rfl
+
+@[simp] theorem Store.allocationEvents_rcTick (store : Store) :
+    store.rcTick.allocationEvents = store.allocationEvents := rfl
+
+@[simp] theorem Store.allocationEvents_tickResetAttempt (store : Store) :
+    store.tickResetAttempt.allocationEvents = store.allocationEvents := rfl
+
+@[simp] theorem Store.allocationEvents_tickHotReset (store : Store) :
+    store.tickHotReset.allocationEvents = store.allocationEvents := rfl
+
+@[simp] theorem Store.allocationEvents_tickColdReset (store : Store) :
+    store.tickColdReset.allocationEvents = store.allocationEvents := rfl
+
+theorem Store.releaseReservation_allocationEvents {store output : Store}
+    {location : Nat} (run : store.releaseReservation location = .ok output) :
+    output.allocationEvents = store.allocationEvents := by
+  cases found : store.heap.nodes[location]? with
+  | none => simp [Store.releaseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box => simp [Store.releaseReservation, found] at run
+      | none =>
+          simp only [Store.releaseReservation, found, Except.ok.injEq] at run
+          subst output
+          rfl
+
+theorem Store.reuseReservation_allocationEvents {store output : Store}
+    {location payloadUnits : Nat} {world : Owned} {node : Node}
+    (run : store.reuseReservation location world node payloadUnits = .ok output) :
+    output.allocationEvents = store.allocationEvents + 1 := by
+  cases found : store.heap.nodes[location]? with
+  | none => simp [Store.reuseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box => simp [Store.reuseReservation, found] at run
+      | none =>
+          simp only [Store.reuseReservation, found, Except.ok.injEq] at run
+          subst output
+          change store.heap.allocs + (store.heap.reuses + 1) =
+            store.heap.allocs + store.heap.reuses + 1
+          omega
+
+theorem retainShared_allocationEvents {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) :
+    output.allocationEvents = store.allocationEvents := by
+  cases value with
+  | lit literal => cases run; rfl
+  | erased => cases run; rfl
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp [retainShared, found, shared] at run
+            subst output
+            rfl
+          · simp [retainShared, found, shared] at run
+
+theorem RetainSharedMany.allocationEvents {store output : Store}
+    {values : Array RVal} (run : RetainSharedMany store values output) :
+    output.allocationEvents = store.allocationEvents := by
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  have loop : ∀ (values : List RVal) {store output : Store},
+      values.foldlM retainShared store = .ok output →
+        output.allocationEvents = store.allocationEvents := by
+    intro values
+    induction values with
+    | nil => intro store output run; cases run; rfl
+    | cons value rest ih =>
+        intro store output run
+        rw [List.foldlM_cons] at run
+        cases head : retainShared store value with
+        | error error => simp [head, bind, Except.bind] at run
+        | ok middle =>
+            simp only [head, bind, Except.bind] at run
+            exact (ih run).trans (retainShared_allocationEvents head)
+  exact loop values.toList run
+
+theorem releaseSharedWork_allocationCounters {fuel remaining : Nat}
+    {store output : Store} {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    output.heap.allocs = store.heap.allocs ∧ output.heap.reuses = store.heap.reuses := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact ⟨rfl, rfl⟩
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact ⟨rfl, rfl⟩
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true,
+                          Nat.reduceBEq] at run
+                        simpa only [Store.kill_heap, Store.rcTick_heap,
+                          IxIR1.Store.kill, IxIR1.Store.rcTick] using ih run
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        simpa only [Store.setBox_heap, Store.rcTick_heap,
+                          IxIR1.Store.setBox, IxIR1.Store.rcTick] using ih run
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem releaseSharedWork_allocationEvents {fuel remaining : Nat}
+    {store output : Store} {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    output.allocationEvents = store.allocationEvents := by
+  obtain ⟨allocs, reuses⟩ := releaseSharedWork_allocationCounters run
+  simp only [Store.allocationEvents, allocs, reuses]
+
+theorem releaseShared_allocationCounters {fuel remaining : Nat}
+    {store output : Store} {value : RVal}
+    (run : releaseShared fuel store value = .ok (output, remaining)) :
+    output.heap.allocs = store.heap.allocs ∧ output.heap.reuses = store.heap.reuses :=
+  releaseSharedWork_allocationCounters run
+
+theorem releaseShared_allocationEvents {fuel remaining : Nat}
+    {store output : Store} {value : RVal}
+    (run : releaseShared fuel store value = .ok (output, remaining)) :
+    output.allocationEvents = store.allocationEvents :=
+  releaseSharedWork_allocationEvents run
+
+theorem dropUniqueWork_allocationEvents {fuel remaining : Nat}
+    {store output : Store} {values : List RVal}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) :
+    output.allocationEvents = store.allocationEvents := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; rfl
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; rfl
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN address arity captured => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        simpa only [Store.allocationEvents_kill] using ih run
+                  · simp [dropUniqueWork, found, unique] at run
+
+theorem dropUnique_allocationEvents {fuel remaining : Nat}
+    {store output : Store} {value : RVal}
+    (run : dropUnique fuel store value = .ok (output, remaining)) :
+    output.allocationEvents = store.allocationEvents := dropUniqueWork_allocationEvents run
+
+/-- Equality of event increments, without subtraction or an assumption about
+the incoming counters. It composes even when the two heaps have different
+allocation and reuse histories. -/
+def AllocationDelta (baselineBefore baselineAfter rewrittenBefore rewrittenAfter : Store) : Prop :=
+  baselineAfter.allocationEvents + rewrittenBefore.allocationEvents =
+    baselineBefore.allocationEvents + rewrittenAfter.allocationEvents
+
+namespace AllocationDelta
+
+theorem of_increments {baselineBefore baselineAfter rewrittenBefore rewrittenAfter : Store}
+    {count : Nat}
+    (baseline : baselineAfter.allocationEvents = baselineBefore.allocationEvents + count)
+    (rewritten : rewrittenAfter.allocationEvents = rewrittenBefore.allocationEvents + count) :
+    AllocationDelta baselineBefore baselineAfter rewrittenBefore rewrittenAfter := by
+  unfold AllocationDelta
+  omega
+
+theorem refl (baseline rewritten : Store) : AllocationDelta baseline baseline rewritten rewritten := by
+  unfold AllocationDelta
+  omega
+
+theorem trans {b₀ b₁ b₂ r₀ r₁ r₂ : Store}
+    (first : AllocationDelta b₀ b₁ r₀ r₁) (second : AllocationDelta b₁ b₂ r₁ r₂) :
+    AllocationDelta b₀ b₂ r₀ r₂ := by
+  unfold AllocationDelta at *
+  omega
+
+theorem preserves {b₀ b₁ r₀ r₁ : Store} (delta : AllocationDelta b₀ b₁ r₀ r₁)
+    (initial : b₀.allocationEvents = r₀.allocationEvents) :
+    b₁.allocationEvents = r₁.allocationEvents := by
+  unfold AllocationDelta at delta
+  omega
+
+end AllocationDelta
+
+/-- A partial application allocates precisely when its supplied arguments
+remain below the closure's arity. All other successful dispatches allocate
+nothing during this transfer. -/
+def applyAllocationEvents (store : Store) (function : RVal)
+    (arguments : Array RVal) : Nat :=
+  match function with
+  | .loc location =>
+      match store.get? location with
+      | some box =>
+          match box.node with
+          | .papN _ arity captured => if (captured ++ arguments).size < arity then 1 else 0
+          | _ => 0
+      | none => 0
+  | _ => 0
+
+theorem applyAllocationEvents_history {baseline rewritten : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.heap rewritten.heap)
+    {baselineFunction rewrittenFunction : RVal}
+    {baselineArguments rewrittenArguments : Array RVal}
+    (function : IxIR1.Sim.RValIso heap.locRel baselineFunction rewrittenFunction)
+    (argumentCount : baselineArguments.size = rewrittenArguments.size) :
+    applyAllocationEvents baseline baselineFunction baselineArguments =
+      applyAllocationEvents rewritten rewrittenFunction rewrittenArguments := by
+  cases function with
+  | lit => rfl
+  | erased => rfl
+  | loc locations =>
+      rcases heap.related locations with ⟨leftDead, rightDead⟩ |
+        ⟨leftBox, rightBox, leftAt, rightAt, boxes⟩
+      · simp [applyAllocationEvents, Store.get?, leftDead, rightDead]
+      · simp only [applyAllocationEvents, Store.get?, leftAt, rightAt]
+        have nodes := boxes.node
+        generalize leftBox.node = leftNode at nodes ⊢
+        generalize rightBox.node = rightNode at nodes ⊢
+        cases nodes with
+        | ctor fields => rfl
+        | pap captured =>
+            have capturedCount := captured.lengths
+            simpa only [Array.length_toList, Array.size_append,
+              argumentCount] using congrArg
+                (fun size => if size + rewrittenArguments.size < _ then 1 else 0) capturedCount
+
+theorem ApplyTransferCase.allocationEvents {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) :
+    target.store.allocationEvents = store.allocationEvents +
+      applyAllocationEvents store function arguments := by
+  cases classified with
+  | erased released =>
+      simpa [applyAllocationEvents] using releaseSharedWork_allocationEvents released
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      simp only [applyAllocationEvents, boxAt, node, totalUnder, ↓reduceIte,
+        Store.allocationEvents_allocNode]
+      rw [releaseSharedWork_allocationEvents released, retained.allocationEvents]
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      simp only [applyAllocationEvents, boxAt, node, Nat.not_lt.mpr totalEnough,
+        ↓reduceIte, Nat.add_zero]
+      exact (releaseSharedWork_allocationEvents released).trans retained.allocationEvents
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      simp only [applyAllocationEvents, boxAt, node, Nat.not_lt.mpr totalEnough,
+        ↓reduceIte, Nat.add_zero]
+      exact (releaseSharedWork_allocationEvents released).trans retained.allocationEvents
+
+theorem ApplyTransfer.allocationEvents {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) :
+    target.store.allocationEvents = store.allocationEvents +
+      applyAllocationEvents store function arguments := transferred.classify.allocationEvents
+
+def instructionAllocationEvents (store : Store) (frame : Frame) : Instr → Nat
+  | .alloc .. | .allocWith .. | .papp .. => 1
+  | .apply functionAtom argumentAtoms =>
+      match resolveAtom frame.values functionAtom, resolveAtoms frame.values argumentAtoms with
+      | .ok function, .ok arguments => applyAllocationEvents store function arguments
+      | _, _ => 0
+  | _ => 0
+
+theorem InstructionTransferCase.allocationEvents {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store heapFuel
+      frame stack instruction target) :
+    target.store.allocationEvents = store.allocationEvents +
+      instructionAllocationEvents store frame instruction := by
+  cases classified <;> simp only [instructionAllocationEvents, Nat.add_zero,
+    Store.allocationEvents_allocNode, Store.allocationEvents_kill,
+    Store.allocationEvents_reserve, Store.allocationEvents_tickHotReset,
+    Store.allocationEvents_tickResetAttempt]
+  case allocWithPhysical reused => exact Store.reuseReservation_allocationEvents reused
+  case discardPhysical released => exact Store.releaseReservation_allocationEvents released
+  case resetSharedCold retained => simpa using retained.allocationEvents
+  case retainShared retained => exact retainShared_allocationEvents retained
+  case releaseShared released => exact releaseShared_allocationEvents released
+  case dropUnique dropped => exact dropUnique_allocationEvents dropped
+  case apply functionResolved argumentsResolved transferred =>
+    simpa only [functionResolved, argumentsResolved] using transferred.allocationEvents
+
+def terminatorAllocationEvents (store : Store) (frame : Frame)
+    (stack : List Continuation) : Terminator → Nat
+  | .ret atom =>
+      match stack, resolveAtom frame.values atom with
+      | .applyMore arguments _ :: _, .ok value => applyAllocationEvents store value arguments
+      | _, _ => 0
+  | _ => 0
+
+theorem TerminatorTransferCase.allocationEvents {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store heapFuel
+      frame stack terminator target) :
+    target.store.allocationEvents = store.allocationEvents +
+      terminatorAllocationEvents store frame stack terminator := by
+  cases classified <;> simp only [terminatorAllocationEvents, Nat.add_zero]
+  case retApplyMore resolved noCredits world transferred =>
+    simpa only [resolved] using transferred.allocationEvents
+
+theorem Step.instructionAllocationEvents {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {target : Machine}
+    (step : Step context interpretation ⟨store, heapFuel, .running frame stack⟩ target)
+    {block : Block} {instruction : Instr}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instructionAt : block.instructions[frame.pc] = instruction) :
+    target.store.allocationEvents = store.allocationEvents +
+      instructionAllocationEvents store frame instruction := by
+  cases step.classify with
+  | instruction found bound atIndex classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      exact classified.allocationEvents
+  | terminator found terminal atTerminator classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      omega
+
+theorem Step.terminatorAllocationEvents {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {target : Machine}
+    (step : Step context interpretation ⟨store, heapFuel, .running frame stack⟩ target)
+    {block : Block} {terminator : Terminator}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator) :
+    target.store.allocationEvents = store.allocationEvents +
+      terminatorAllocationEvents store frame stack terminator := by
+  cases step.classify with
+  | instruction found bound atIndex classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      omega
+  | terminator found terminal atTerminator classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      exact classified.allocationEvents
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/Basic.lean b/Ix/Compiler/IxIR2/Basic.lean
new file mode 100644
index 000000000..8b1e2d3b7
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Basic.lean
@@ -0,0 +1,156 @@
+import Ix.Compiler.IxIR1.Basic
+
+/-!
+# IxIR₂: block-local ownership and reuse-credit IR
+
+IxIR₂ makes the ownership information needed for checked reuse explicit.
+Values and reuse credits live in separate block-local register files.  Block
+parameters describe the complete capability environment at each control-flow
+join, so the executable validator can check every block independently.
+
+This file is deliberately syntax-only.  `Ix.Compiler.IxIR2.Validate` supplies
+the bounded checker and its proof-facing acceptance predicate.
+-/
+
+namespace Ix.Compiler.IxIR2
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR0 (Literal)
+
+abbrev BlockId := Nat
+abbrev ValueId := Nat
+abbrev CreditId := Nat
+abbrev LayoutId := Address
+abbrev CtorId := IxIR1.CtorId
+
+/-- Block-local operands.  Registers are numbered in definition order. -/
+inductive Atom where
+  | reg (id : ValueId)
+  | lit (literal : Literal)
+  | erased
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Whether a function call transfers an argument root or merely observes it. -/
+inductive ParamPassing where
+  | owned
+  | borrowed
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Param where
+  world : Owned
+  passing : ParamPassing
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The checked call interface of one function. -/
+structure Signature where
+  params : Array Param
+  result : Owned
+  /-- May this function be entered through a shared partial application? -/
+  papSafe : Bool
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The ownership root that keeps a non-retaining view alive. -/
+inductive BorrowLender where
+  /-- A caller-owned root that this activation never consumes. -/
+  | caller
+  /-- A prior owning value in the same block. -/
+  | value (id : ValueId)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Capability available for one value at a block boundary or program point. -/
+inductive ValueCap where
+  | scalar
+  | owned (world : Owned)
+  | borrowed (world : Owned) (lender : BorrowLender)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- A required credit is definitely present; an optional credit may be absent. -/
+inductive CreditCap where
+  | required (layout : LayoutId)
+  | optional (layout : LayoutId)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Checked representation information for one constructor in one world. -/
+structure CtorSchema where
+  layout : LayoutId
+  fields : Array Owned
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Primitive instructions.  Result values and credits are appended to their
+respective register files in the order specified by the validator contract. -/
+inductive Instr where
+  | move (value : Atom)
+  | alloc (world : Owned) (cid : CtorId) (args : Array Atom)
+  | allocWith (credit : CreditId) (world : Owned) (cid : CtorId)
+      (args : Array Atom)
+  | discardCredit (credit : CreditId)
+  | takeUnique (target : Atom) (cid : CtorId)
+  | resetShared (target : Atom) (cid : CtorId)
+  | retainShared (target : Atom)
+  | releaseShared (target : Atom)
+  | dropUnique (target : Atom)
+  | freeUnique (target : Atom) (cid : CtorId)
+  | fetch (target : Atom) (cid : CtorId) (field : Nat)
+  | call (function : Address) (args : Array Atom)
+  | callSelf (args : Array Atom)
+  | papp (function : Address) (args : Array Atom)
+  | apply (function : Atom) (args : Array Atom)
+  | extern (function : Address) (args : Array Atom)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Complete arguments for one control-flow transfer. -/
+structure Edge where
+  target : BlockId
+  values : Array Atom
+  credits : Array CreditId
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure CtorAlt where
+  cid : CtorId
+  edge : Edge
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Literal peeling bundled with constructor dispatch for a dynamically
+represented IxIR₁ case scrutinee.  The successor transfer implicitly prepends
+the predecessor literal to the explicit edge arguments. -/
+structure NatPeel where
+  zero : Edge
+  succ : Edge
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Terminator where
+  | jump (edge : Edge)
+  | switchValue (scrutinee : Atom) (constructors : Array CtorAlt)
+      (natPeel : Option NatPeel)
+  | branchCredit (credit : CreditId) (someEdge noneEdge : Edge)
+  | ret (value : Atom)
+  | tailCall (function : Address) (args : Array Atom)
+  | tailCallSelf (args : Array Atom)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Block where
+  valueParams : Array ValueCap
+  creditParams : Array CreditCap
+  instructions : Array Instr
+  terminator : Terminator
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Block `0` is the entry block.  Block IDs are array indices. -/
+structure Function where
+  signature : Signature
+  blocks : Array Block
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Decl where
+  | fn (definition : Function)
+  | extern (arity : Nat)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- A finite, content-addressed declaration world plus its distinguished main
+function.  The validator rejects duplicate declaration addresses. -/
+structure Program where
+  declarations : List (Address × Decl)
+  main : Function
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+end Ix.Compiler.IxIR2
diff --git a/Ix/Compiler/IxIR2/Borrow/Examples.lean b/Ix/Compiler/IxIR2/Borrow/Examples.lean
new file mode 100644
index 000000000..788f80180
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/Examples.lean
@@ -0,0 +1,149 @@
+import Ix.Compiler.IxIR2.Borrow.Replay
+
+/-! Negative ownership and peak-space neighbors for the borrowed ABI.
+These hand-built programs test the optimizer boundary; the source gate
+separately derives its positive witnesses through the Ixon compiler. -/
+
+namespace Ix.Compiler.IxIR2.Borrow.Examples
+
+open Ix.Compiler.Ixon (Address)
+
+def readerAddress : Address := .replicate 1
+def workerAddress : Address := .replicate 2
+def captureAddress : Address := .replicate 3
+def readerBorrowed : Address := .replicate 11
+def workerBorrowed : Address := .replicate 12
+def leaf : CtorId := { block := .replicate 20, indIdx := 0, cidx := 0 }
+def box : CtorId := { block := .replicate 20, indIdx := 0, cidx := 1 }
+def layout : Address := .replicate 21
+
+def context : Validate.Context :=
+  { schemas := fun world cid =>
+      if world == .shared && (cid == leaf || cid == box) then
+        some { layout, fields := if cid == leaf then #[] else #[.shared] }
+      else none }
+
+def unary : Signature :=
+  { params := #[{ world := .shared, passing := .owned }], result := .shared, papSafe := true }
+
+def fn (instructions : Array Instr) (terminator : Terminator) : Function :=
+  { signature := unary
+    blocks := #[{ valueParams := #[.owned .shared], creditParams := #[]
+                  instructions, terminator }] }
+
+def reader : Function := fn #[.releaseShared (.reg 0)] (.ret (.lit (.nat 0)))
+
+def main (instructions : Array Instr := #[]) (terminator : Terminator := .ret (.lit (.nat 0))) :
+    Function :=
+  { signature := { params := #[], result := .shared, papSafe := false }
+    blocks := #[{ valueParams := #[], creditParams := #[], instructions, terminator }] }
+
+def program (worker : Function) : Program :=
+  { declarations := [(readerAddress, .fn reader), (workerAddress, .fn worker)]
+    main := main }
+
+def claims : List Summary :=
+  [{ owner := readerAddress, borrowed := readerBorrowed },
+   { owner := workerAddress, borrowed := workerBorrowed }]
+
+def accepted (program : Program) : Bool := (Validate.validate context program).isOk
+def rejected (program : Program) : Bool := !(check {} context program claims).isOk
+
+def returnEscape : Program := program (fn #[] (.ret (.reg 0)))
+def storeEscape : Program := program (fn #[.alloc .shared box #[.reg 0]] (.ret (.reg 1)))
+
+def capture : Function :=
+  { signature := { unary with params := unary.params ++ unary.params }
+    blocks := #[{
+      valueParams := #[.owned .shared, .owned .shared], creditParams := #[]
+      instructions := #[.releaseShared (.reg 0), .releaseShared (.reg 1)]
+      terminator := .ret (.lit (.nat 0)) }] }
+
+def captureEscape : Program :=
+  { program (fn #[.papp captureAddress #[.reg 0]] (.ret (.reg 1))) with
+    declarations := (program (fn #[.papp captureAddress #[.reg 0]] (.ret (.reg 1)))).declarations ++
+      [(captureAddress, .fn capture)] }
+
+def localTailLender : Program := program (fn
+  #[.releaseShared (.reg 0), .alloc .shared leaf #[]]
+  (.tailCall readerAddress #[.reg 1]))
+
+def laterReset : Program := program (fn
+  #[.retainShared (.reg 0), .call readerAddress #[.reg 1], .releaseShared (.reg 2),
+    .resetShared (.reg 0) leaf, .discardCredit 0]
+  (.ret (.lit (.nat 0))))
+
+/-- Delaying an early release can increase peak space even if the ownership
+validator accepts and two real RC operations disappear. Replay rejects it. -/
+def peakRegression : Program :=
+  { program (fn
+      #[.retainShared (.reg 0), .call readerAddress #[.reg 1], .releaseShared (.reg 2),
+        .releaseShared (.reg 0), .alloc .shared leaf #[], .releaseShared (.reg 3)]
+      (.ret (.lit (.nat 0)))) with
+    main := main #[.alloc .shared leaf #[]] (.tailCall workerAddress #[.reg 0]) }
+
+def peakRejected : Bool :=
+  match check {} context peakRegression claims with
+  | .error _ => false
+  | .ok rewritten =>
+      match replay context {} rewritten with
+      | .error .peakIncrease => true
+      | _ => false
+
+def noGainRejected : Bool :=
+  match check {} context peakRegression [] with
+  | .error _ => false
+  | .ok rewritten =>
+      match replay context {} rewritten with
+      | .error .noImprovement => true
+      | _ => false
+
+def budgetRejected : Bool :=
+  match check {} context peakRegression claims with
+  | .error _ => false
+  | .ok rewritten =>
+      match replay context { control := 0 } rewritten with
+      | .error (.execution .controlFuel) => true
+      | _ => false
+
+def collisionRejected : Bool :=
+  match check {} context (program reader)
+      [{ owner := readerAddress, borrowed := workerAddress }] with
+  | .error (.validation (.duplicateDeclaration _)) => true
+  | _ => false
+
+/-- Retaining a projected field creates an independent owned result. That
+retain must survive even when the containing parameter is borrowed. -/
+def fieldRetainPreserved : Bool :=
+  let source := program (fn
+    #[.fetch (.reg 0) box 0, .retainShared (.reg 1), .releaseShared (.reg 0)]
+    (.ret (.reg 2)))
+  accepted source && match check {} context source claims with
+  | .error _ => false
+  | .ok result =>
+      match result.program.declarations.find? (fun entry => entry.1 == workerBorrowed) with
+      | some (_, .fn definition) =>
+          definition.blocks[0]?.map (·.instructions) ==
+            some #[.fetch (.reg 0) box 0, .retainShared (.reg 1)]
+      | _ => false
+
+#guard fieldRetainPreserved
+
+def guards : List (String × Bool) :=
+  [("return-escape", accepted returnEscape && rejected returnEscape),
+   ("store-escape", accepted storeEscape && rejected storeEscape),
+   ("capture-escape", accepted captureEscape && rejected captureEscape),
+   ("local-tail-lender", accepted localTailLender && rejected localTailLender),
+   ("later-reset", accepted laterReset && rejected laterReset),
+   ("peak-regression", accepted peakRegression && peakRejected),
+   ("no-rc-gain", noGainRejected),
+   ("replay-budget", budgetRejected),
+   ("internal-label-collision", collisionRejected),
+   ("duplicate-summary", !(check {} context (program reader) (claims ++ claims)).isOk),
+   ("missing-summary-owner", !(check {} context (program reader)
+     [{ owner := .replicate 99, borrowed := readerBorrowed }]).isOk),
+   ("candidate-limit", !(check { maxCandidates := 0 } context (program reader) claims).isOk)]
+
+#guard guards.all (·.2)
+
+end Ix.Compiler.IxIR2.Borrow.Examples
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenCheck.lean b/Ix/Compiler/IxIR2/Borrow/OpenCheck.lean
new file mode 100644
index 000000000..8b6bc238d
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenCheck.lean
@@ -0,0 +1,175 @@
+import Ix.Compiler.IxIR2.Borrow.OpenSim
+
+/-! An open-input selector. All proposed summaries and all rewritten bodies
+must have a finite structural derivation. Selection never evaluates an input.
+The original main/factory continues to export the owned PAP entry. -/
+
+namespace Ix.Compiler.IxIR2.Borrow.Open
+
+open Ix.Compiler.Ixon (Address)
+
+structure Policy where
+  enabled : Bool := true
+  maxDepth : Nat := 32
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def moduleMain (factoryAddress : Address) : Function :=
+  { signature := { params := #[], result := .shared, papSafe := false }
+    blocks := #[{
+      valueParams := #[], creditParams := #[], instructions := #[]
+      terminator := .tailCall factoryAddress #[] }] }
+
+def readerSchema? (definition : Function) : Option Schema := do
+  let entry ← definition.blocks[0]?
+  let .switchValue _ alternatives _ := entry.terminator | none
+  let zero ← alternatives[0]?
+  let succ ← alternatives[1]?
+  let zeroBlock ← definition.blocks[1]?
+  let succBlock ← definition.blocks[2]?
+  let .ret (.lit (.nat zeroResult)) := zeroBlock.terminator | none
+  let .ret (.lit (.nat succResult)) := succBlock.terminator | none
+  let schema : Schema := { zero := zero.cid, succ := succ.cid, zeroResult, succResult }
+  if definition == reader schema false then some schema else none
+
+def inferSchema (program : Program) : Option Schema :=
+  program.declarations.findSome? fun
+    | (_, .fn definition) => readerSchema? definition
+    | _ => none
+
+def context (validation : Validate.Context) (program : Program) : Eval.Context :=
+  .ofProgram program validation.schemas
+
+structure Export (validation : Validate.Context) (program : Program) where
+  factoryAddress : Address
+  entryAddress : Address
+  main : program.main = moduleMain factoryAddress
+  factoryAt : (context validation program).declarations factoryAddress = some (.fn (factory entryAddress))
+
+def checkExport (validation : Validate.Context) (program : Program) : Option (Export validation program) := do
+  let block ← program.main.blocks[0]?
+  let .tailCall factoryAddress _ := block.terminator | none
+  let some (.fn declaration) := (context validation program).declarations factoryAddress | none
+  let first ← declaration.blocks[0]?
+  let instruction ← first.instructions[0]?
+  let .papp entryAddress _ := instruction | none
+  if hm : program.main = moduleMain factoryAddress then
+    if hf : (context validation program).declarations factoryAddress = some (.fn (factory entryAddress)) then
+      some ⟨factoryAddress, entryAddress, hm, hf⟩
+    else none
+  else none
+
+structure Entry (beforeContext afterContext : Eval.Context) (schema : Schema) where
+  summary : Summary
+  before : Function
+  after : Function
+  beforeAt : beforeContext.declarations summary.owner = some (.fn before)
+  afterAt : afterContext.declarations summary.borrowed = some (.fn after)
+  wrapperAt : afterContext.declarations summary.owner = some (.fn (ownedWrapper summary.borrowed before))
+  beforeBody : Body beforeContext schema false before
+  afterBody : Body afterContext schema true after
+  sameKind : beforeBody.isTwice = afterBody.isTwice
+  sameDepth : beforeBody.depth = afterBody.depth
+
+def checkEntry (beforeContext afterContext : Eval.Context) (schema : Schema)
+    (maxDepth : Nat) (summary : Summary) : Option (Entry beforeContext afterContext schema) := do
+  let some (.fn before) := beforeContext.declarations summary.owner | none
+  let some (.fn after) := afterContext.declarations summary.borrowed | none
+  let beforeBody ← recognizeBody beforeContext schema false maxDepth before
+  let afterBody ← recognizeBody afterContext schema true maxDepth after
+  if beforeAt : beforeContext.declarations summary.owner = some (.fn before) then
+    if afterAt : afterContext.declarations summary.borrowed = some (.fn after) then
+      if wrapperAt : afterContext.declarations summary.owner = some (.fn (ownedWrapper summary.borrowed before)) then
+        if sameKind : beforeBody.isTwice = afterBody.isTwice then
+          if sameDepth : beforeBody.depth = afterBody.depth then
+            some ⟨summary, before, after, beforeAt, afterAt, wrapperAt, beforeBody, afterBody, sameKind, sameDepth⟩
+          else none
+        else none
+      else none
+    else none
+  else none
+
+inductive Rejection where
+  | disabled
+  | noCandidates
+  | schema
+  | rewrite (error : Borrow.Error)
+  | export
+  | body
+  | coverage
+  | noImprovement
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+structure Certificate (limits : Limits) (validation : Validate.Context) (baseline : Program) where
+  rewrite : Checked limits validation baseline
+  schema : Schema
+  distinct : schema.zero ≠ schema.succ
+  entries : List (Entry (context validation baseline) (context validation rewrite.program) schema)
+  coverage : entries.map (·.summary) = rewrite.summaries
+  exported : Export validation baseline
+  targetExported : Export validation rewrite.program
+  sameFactory : exported.factoryAddress = targetExported.factoryAddress
+  sameExport : exported.entryAddress = targetExported.entryAddress
+  entry : Entry (context validation baseline) (context validation rewrite.program) schema
+  entryMember : entry.summary ∈ rewrite.summaries
+  entryAddress : entry.summary.owner = exported.entryAddress
+  improvement : entry.beforeBody.isTwice = true
+
+def certify (limits : Limits) (validation : Validate.Context) (baseline : Program)
+    (summaries : List Summary) (policy : Policy := {}) :
+    Except Rejection (Certificate limits validation baseline) := do
+  let rewrite ← (Borrow.check limits validation baseline summaries).mapError Rejection.rewrite
+  let some schema := inferSchema baseline | throw .schema
+  if distinct : schema.zero ≠ schema.succ then
+    let some exported := checkExport validation baseline | throw .export
+    let some targetExported := checkExport validation rewrite.program | throw .export
+    let some entries := summaries.mapM (checkEntry (context validation baseline)
+        (context validation rewrite.program) schema policy.maxDepth) | throw .body
+    if coverage : entries.map (·.summary) = rewrite.summaries then
+      if sameFactory : exported.factoryAddress = targetExported.factoryAddress then
+        if sameExport : exported.entryAddress = targetExported.entryAddress then
+          let some entry := entries.find? (fun entry => entry.summary.owner == exported.entryAddress) | throw .export
+          if entryAddress : entry.summary.owner = exported.entryAddress then
+            if entryMember : entry.summary ∈ rewrite.summaries then
+              if improvement : entry.beforeBody.isTwice = true then
+                return ⟨rewrite, schema, distinct, entries, coverage, exported, targetExported,
+                  sameFactory, sameExport, entry, entryMember, entryAddress, improvement⟩
+              else throw .noImprovement
+            else throw .coverage
+          else throw .export
+        else throw .export
+      else throw .export
+    else throw .coverage
+  else throw .schema
+
+structure Selection (limits : Limits) (validation : Validate.Context) (baseline : Program) where
+  baselineChecked : Validate.Checked limits.validator validation baseline
+  inference : Inference
+  attempt : Except Rejection (Certificate limits validation baseline)
+
+def optimize {limits : Limits} {validation : Validate.Context} {baseline : Program}
+    (checked : Validate.Checked limits.validator validation baseline) (policy : Policy := {}) :
+    Selection limits validation baseline :=
+  if !policy.enabled then ⟨checked, {}, .error .disabled⟩ else
+    let inference := infer limits validation baseline
+    let attempt := if inference.summaries.isEmpty then .error .noCandidates
+      else certify limits validation baseline inference.summaries policy
+    ⟨checked, inference, attempt⟩
+
+def Selection.program {limits validation baseline} (selection : Selection limits validation baseline) : Program :=
+  match selection.attempt with
+  | .ok certificate => certificate.rewrite.program
+  | .error _ => baseline
+
+theorem Selection.valid {limits validation baseline} (selection : Selection limits validation baseline) :
+    Validate.ValidWith limits.validator validation selection.program := by
+  cases h : selection.attempt with
+  | error _ => simpa [Selection.program, h] using
+      (show Validate.ValidWith limits.validator validation baseline from
+        ⟨selection.baselineChecked.stats, selection.baselineChecked.accepted⟩)
+  | ok certificate => simpa [Selection.program, h] using certificate.rewrite.valid
+
+theorem Selection.fallbackExact {limits validation baseline} (selection : Selection limits validation baseline)
+    {reason : Rejection} (fallback : selection.attempt = .error reason) : selection.program = baseline := by
+  simp [Selection.program, fallback]
+
+end Ix.Compiler.IxIR2.Borrow.Open
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenControl.lean b/Ix/Compiler/IxIR2/Borrow/OpenControl.lean
new file mode 100644
index 000000000..bf70ae7ba
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenControl.lean
@@ -0,0 +1,180 @@
+import Ix.Compiler.IxIR2.Borrow.OpenHeap
+
+namespace Ix.Compiler.IxIR2.Borrow.Open
+
+open Eval
+
+/-- A scalar-returning entry may halt or resume its immediate caller. The
+caller's remaining continuation stack is arbitrary and is preserved. -/
+inductive Exit where
+  | halt
+  | resume (caller : Frame) (rest : List Continuation)
+
+def Exit.stack : Exit → List Continuation
+  | .halt => []
+  | .resume caller rest => .resume caller :: rest
+
+def Exit.result (exit : Exit) (value : RVal) : Control :=
+  match exit with
+  | .halt => .halted value
+  | .resume caller rest => .running { caller with values := caller.values.push value } rest
+
+def start (definition : Function) (location : Nat) (store : Store) (fuel : Nat) (exit : Exit) : Machine :=
+  { store, heapFuel := fuel, control := .running { definition, values := #[.loc location] } exit.stack }
+
+def finish (store : Store) (fuel number : Nat) (exit : Exit) : Machine :=
+  { store, heapFuel := fuel, control := exit.result (.lit (.nat number)) }
+
+/-- Every intermediate state preserves the lender's complete heap, not just
+the final state. This composes under arbitrary suspended callers. -/
+inductive StableSteps (context : Context) (mode : Interpretation) : Nat → Machine → Machine → Prop where
+  | refl (machine : Machine) : StableSteps context mode 0 machine machine
+  | cons {count : Nat} {before middle after : Machine} {frame : Frame} {stack : List Continuation}
+      (running : before.control = .running frame stack)
+      (step : Step context mode before middle) (unchanged : middle.store = before.store)
+      (tail : StableSteps context mode count middle after) :
+      StableSteps context mode (count + 1) before after
+
+theorem StableSteps.steps {context mode count before after}
+    (trace : StableSteps context mode count before after) : Steps context mode count before after := by
+  induction trace with
+  | refl machine => exact .refl machine
+  | cons running step _ _ ih => exact .cons running step ih
+
+theorem StableSteps.one {context mode before after frame stack}
+    (step : Step context mode before after) (running : before.control = .running frame stack)
+    (unchanged : after.store = before.store) : StableSteps context mode 1 before after :=
+  .cons running step unchanged (.refl after)
+
+theorem StableSteps.trans {context mode firstCount secondCount before middle after}
+    (first : StableSteps context mode firstCount before middle)
+    (second : StableSteps context mode secondCount middle after) :
+    StableSteps context mode (firstCount + secondCount) before after := by
+  induction first with
+  | refl => simpa using second
+  | cons running step unchanged _ ih =>
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+        StableSteps.cons running step unchanged (ih second)
+
+theorem StableSteps.prefix {context mode count before after}
+    (trace : StableSteps context mode count before after) {prefixCount middle}
+    (initial : Steps context mode prefixCount before middle) (bound : prefixCount ≤ count) :
+    middle.store = before.store := by
+  induction trace generalizing prefixCount middle with
+  | refl =>
+      have zero : prefixCount = 0 := by omega
+      subst prefixCount
+      cases initial
+      rfl
+  | @cons count before next after frame stack running step unchanged tail ih =>
+      cases initial with
+      | refl => rfl
+      | cons _ head rest =>
+          have eq := step.deterministic head
+          subst_vars
+          exact (ih rest (by omega)).trans unchanged
+
+theorem returnScalar {context : Context} {mode : Interpretation} {frame : Frame} {current : Block}
+    (store : Store) (fuel number : Nat) (exit : Exit) (atom : Atom)
+    (blockAt : frame.definition.blocks[frame.block]? = some current)
+    (pc : frame.pc = current.instructions.size)
+    (term : current.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok (.lit (.nat number)))
+    (credits : frame.credits = #[]) :
+    StableSteps context mode 1
+      { store, heapFuel := fuel, control := .running frame exit.stack }
+      (finish store fuel number exit) := by
+  cases exit with
+  | halt =>
+      exact StableSteps.one
+        (Step.retHalt rfl blockAt pc term resolved credits rfl) rfl rfl
+  | resume caller rest =>
+      exact StableSteps.one
+        (Step.retResume rfl blockAt pc term resolved credits rfl) rfl rfl
+
+def readerFrame (schema : Schema) (borrowed : Bool) (major : Major) (location : Nat) : Frame :=
+  { definition := reader schema borrowed
+    block := match major with | .zero => 1 | .succ _ => 2
+    pc := major.fieldCost
+    values := #[.loc location] ++ major.fields }
+
+theorem readerPrefix (context : Context) (mode : Interpretation) (schema : Schema) (borrowed : Bool)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (view : major.At schema store location rc)
+    (fuel : Nat) (exit : Exit) :
+    StableSteps context mode (1 + major.fieldCost)
+      (start (reader schema borrowed) location store fuel exit)
+      { store, heapFuel := fuel, control := .running (readerFrame schema borrowed major location) exit.stack } := by
+  cases major with
+  | zero =>
+      have step : Step context mode (start (reader schema borrowed) location store fuel exit)
+          { store, heapFuel := fuel
+            control := .running (readerFrame schema borrowed .zero location) exit.stack } :=
+        Step.switchCtor (alternative := {
+          cid := schema.zero
+          edge := { target := 1, values := #[.reg 0], credits := #[] } })
+          rfl rfl rfl rfl rfl view rfl (by simp [Major.cid]) (by
+            exact EdgeTransfer.baseline (values := #[.loc location]) rfl rfl rfl rfl rfl rfl)
+      exact StableSteps.one step rfl rfl
+  | succ field =>
+      let middle : Machine := {
+        store, heapFuel := fuel
+        control := .running { definition := reader schema borrowed, block := 2, values := #[.loc location] } exit.stack }
+      have switch : Step context mode (start (reader schema borrowed) location store fuel exit) middle :=
+        Step.switchCtor (alternative := {
+          cid := schema.succ
+          edge := { target := 2, values := #[.reg 0], credits := #[] } })
+          rfl rfl rfl rfl rfl view rfl (by simp [Major.cid, distinct]) (by
+            exact EdgeTransfer.baseline (values := #[.loc location]) rfl rfl rfl rfl rfl rfl)
+      have fetch : Step context mode middle {
+          store, heapFuel := fuel
+          control := .running (readerFrame schema borrowed (.succ field) location) exit.stack } :=
+        Step.fetch (machine := middle) (atom := .reg 0) (cid := schema.succ)
+          (field := 0) (value := field) rfl rfl
+          (by simp [reader, block, release]; omega) (by cases borrowed <;> rfl) rfl view rfl rfl
+      exact (StableSteps.one switch rfl rfl).trans (StableSteps.one fetch rfl rfl)
+
+theorem readerBorrowed (context : Context) (mode : Interpretation) (schema : Schema)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (view : major.At schema store location rc)
+    (fuel : Nat) (exit : Exit) :
+    StableSteps context mode (2 + major.fieldCost)
+      (start (reader schema true) location store fuel exit)
+      (finish store fuel (major.result schema) exit) := by
+  have headPath := readerPrefix context mode schema true distinct major view fuel exit
+  have ret : StableSteps context mode 1
+      { store, heapFuel := fuel, control := .running (readerFrame schema true major location) exit.stack }
+      (finish store fuel (major.result schema) exit) := by
+    cases major with
+    | zero => exact returnScalar store fuel schema.zeroResult exit _ rfl rfl rfl rfl rfl
+    | succ field => exact returnScalar store fuel schema.succResult exit _ rfl rfl rfl rfl rfl
+  have count : 1 + major.fieldCost + 1 = 2 + major.fieldCost := by omega
+  simpa only [count] using headPath.trans ret
+
+theorem readerOwned (context : Context) (mode : Interpretation) (schema : Schema)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store output : Store} {location rc fuel remaining : Nat}
+    (view : major.At schema store location rc)
+    (released : releaseShared fuel store (.loc location) = .ok (output, remaining)) (exit : Exit) :
+    Steps context mode (3 + major.fieldCost)
+      (start (reader schema false) location store fuel exit)
+      (finish output remaining (major.result schema) exit) := by
+  have headPath := readerPrefix context mode schema false distinct major view fuel exit
+  let afterRelease : Frame := { readerFrame schema false major location with pc := major.fieldCost + 1 }
+  have drop : Step context mode
+      { store, heapFuel := fuel, control := .running (readerFrame schema false major location) exit.stack }
+      { store := output, heapFuel := remaining, control := .running afterRelease exit.stack } := by
+    cases major with
+    | zero => exact Step.releaseShared rfl rfl (by simp [readerFrame, reader, block, release, Major.fieldCost]) rfl rfl released
+    | succ field => exact Step.releaseShared rfl rfl (by simp [readerFrame, reader, block, release, Major.fieldCost]) rfl rfl released
+  have ret : StableSteps context mode 1
+      { store := output, heapFuel := remaining, control := .running afterRelease exit.stack }
+      (finish output remaining (major.result schema) exit) := by
+    cases major with
+    | zero => exact returnScalar output remaining schema.zeroResult exit _ rfl rfl rfl rfl rfl
+    | succ field => exact returnScalar output remaining schema.succResult exit _ rfl rfl rfl rfl rfl
+  have count : 1 + major.fieldCost + 1 + 1 = 3 + major.fieldCost := by omega
+  simpa only [count] using
+    (headPath.steps.trans (drop.toSteps rfl)).trans ret.steps
+
+end Ix.Compiler.IxIR2.Borrow.Open
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenExamples.lean b/Ix/Compiler/IxIR2/Borrow/OpenExamples.lean
new file mode 100644
index 000000000..bb9e03f8f
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenExamples.lean
@@ -0,0 +1,104 @@
+import Ix.Compiler.IxIR2.Borrow.OpenResources
+import Ix.Compiler.IxIR2.Borrow.Examples
+
+/-! Structural and lifetime neighbors for the open-input certificate. The
+positive source/measurement boundary is supplied by Borrow.Runtime. -/
+
+namespace Ix.Compiler.IxIR2.Borrow.Open.Examples
+
+open Ix.Compiler.Ixon (Address)
+
+def schema : Schema := { zero := Borrow.Examples.leaf, succ := Borrow.Examples.box, zeroResult := 11, succResult := 22 }
+def readerAddress : Address := .replicate 1
+def workerAddress : Address := .replicate 2
+def factoryAddress : Address := .replicate 3
+def cycleAddress : Address := .replicate 4
+def callerAddress : Address := .replicate 5
+def readerBorrowed : Address := .replicate 11
+def workerBorrowed : Address := .replicate 12
+def cycleBorrowed : Address := .replicate 14
+def validation : Validate.Context := Borrow.Examples.context
+
+def baseline : Program :=
+  { declarations := [(readerAddress, .fn (reader schema false)),
+      (workerAddress, .fn (twice false readerAddress)), (factoryAddress, .fn (factory workerAddress))]
+    main := moduleMain factoryAddress }
+
+def claims : List Summary :=
+  [{ owner := readerAddress, borrowed := readerBorrowed }, { owner := workerAddress, borrowed := workerBorrowed }]
+
+def accepted : Bool := (certify {} validation baseline claims).isOk
+
+def cycle : Program :=
+  { baseline with declarations := baseline.declarations ++ [(cycleAddress, .fn (forward false cycleAddress))] }
+
+def cycleClaims : List Summary := claims ++ [{ owner := cycleAddress, borrowed := cycleBorrowed }]
+
+def cycleRejected : Bool :=
+  (Borrow.check {} validation cycle cycleClaims).isOk &&
+    match certify {} validation cycle cycleClaims with
+    | .error .body => true
+    | _ => false
+
+/-- Baseline release before allocation is safe. Borrowing delays that final
+release across the allocation, so B2 must reject it without sampling a heap. -/
+def allocatingReader : Function :=
+  { reader schema false with
+    blocks := (reader schema false).blocks.set! 1
+      (block false #[.releaseShared (.reg 0), .alloc .shared schema.zero #[], .releaseShared (.reg 1)]
+        (.ret (.lit (.nat 11)))) }
+
+def allocation : Program :=
+  { baseline with declarations := baseline.declarations.map fun (address, declaration) =>
+      (address, if address == readerAddress then .fn allocatingReader else declaration) }
+
+def allocationRejected : Bool :=
+  (Borrow.check {} validation allocation claims).isOk &&
+    match certify {} validation allocation claims with
+    | .error .schema => true
+    | _ => false
+
+def callbackFreeFallback : Bool :=
+  match certify {} validation baseline claims { maxDepth := 0 } with
+  | .error .body => true
+  | _ => false
+
+def incompleteRejected : Bool := !(certify {} validation baseline
+  [{ owner := workerAddress, borrowed := workerBorrowed }]).isOk
+
+/-- A caller can borrow, regain its unchanged lender, then reset and discard
+the slot. The caller itself is deliberately not rewritten to a borrowed ABI. -/
+def resettingCaller : Function :=
+  { signature := signature false
+    blocks := #[block false #[.call workerBorrowed #[.reg 0], .resetShared (.reg 0) schema.zero, .discardCredit 0]
+      (.ret (.reg 1))] }
+
+def lenderThenReset : Bool :=
+  match certify {} validation baseline claims with
+  | .error _ => false
+  | .ok result =>
+      let program := { result.rewrite.program with
+        declarations := result.rewrite.program.declarations ++ [(callerAddress, .fn resettingCaller)] }
+      let allocated := ({} : Eval.Store).allocNode .shared (.ctorN schema.zero #[])
+      (Validate.validate validation program).isOk &&
+        match Eval.runFunction (context validation program) .physical resettingCaller #[.loc allocated.2] 100 100 allocated.1 with
+        | .error _ => false
+        | .ok output => output.value == .lit (.nat 11) && output.store.live == 0 &&
+            output.store.heap.allocs == output.store.heap.frees && output.store.hotResets == 1
+
+def localTailRejected : Bool := Borrow.Examples.accepted Borrow.Examples.localTailLender && Borrow.Examples.rejected Borrow.Examples.localTailLender
+def laterResetRejected : Bool := Borrow.Examples.accepted Borrow.Examples.laterReset && Borrow.Examples.rejected Borrow.Examples.laterReset
+
+def guards : Array (String × Bool) := #[
+  ("structural-open-certificate", accepted),
+  ("cyclic-summary-rejected", cycleRejected),
+  ("allocation-peak-hazard-rejected", allocationRejected),
+  ("structural-budget-fallback", callbackFreeFallback),
+  ("incomplete-summary-rejected", incompleteRejected),
+  ("borrow-then-reset", lenderThenReset),
+  ("local-tail-lender-rejected", localTailRejected),
+  ("later-reset-keeps-owned-parameter", laterResetRejected)]
+
+#guard guards.all (·.2)
+
+end Ix.Compiler.IxIR2.Borrow.Open.Examples
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenHeap.lean b/Ix/Compiler/IxIR2/Borrow/OpenHeap.lean
new file mode 100644
index 000000000..5a8b18509
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenHeap.lean
@@ -0,0 +1,142 @@
+import Ix.Compiler.IxIR2.Borrow.OpenShape
+import Ix.Compiler.IxIR1.Sim
+
+namespace Ix.Compiler.IxIR2.Borrow.Open
+
+open Eval
+
+/-- Only instrumentation differs after cancelling one retain/release pair. -/
+def bump (store : Store) (count : Nat) : Store :=
+  { store with heap := { store.heap with rcops := store.heap.rcops + count } }
+
+@[simp] theorem bump_zero (store : Store) : bump store 0 = store := rfl
+
+@[simp] theorem bump_get (store : Store) (count location : Nat) :
+    (bump store count).get? location = store.get? location := rfl
+
+@[simp] theorem bump_set (store : Store) (count location : Nat) (box : NodeBox) :
+    (bump store count).setBox location box = bump (store.setBox location box) count := rfl
+
+@[simp] theorem bump_kill (store : Store) (count location : Nat) :
+    (bump store count).kill location = bump (store.kill location) count := rfl
+
+@[simp] theorem bump_tick (store : Store) (count : Nat) :
+    (bump store count).rcTick = bump store.rcTick count := by
+  simp [bump, Store.rcTick, IxIR1.Store.rcTick, Nat.add_right_comm]
+
+theorem releaseWork_bump {fuel remaining : Nat} {store output : Store} {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) (count : Nat) :
+    releaseSharedWork fuel (bump store count) values = .ok (bump output count, remaining) := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; rfl
+      | cons => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; rfl
+      | cons value rest =>
+          cases value with
+          | lit => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unit : box.rc = 1
+                      · simp only [releaseSharedWork, bump_get, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unit, beq_self_eq_true,
+                          Nat.reduceBEq, bump_tick, bump_kill] at run ⊢
+                        exact ih run
+                      · simp only [releaseSharedWork, bump_get, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, beq_iff_eq, zero, unit,
+                          bump_tick, bump_set] at run ⊢
+                        exact ih run
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem release_bump {fuel remaining : Nat} {store output : Store} {value : RVal}
+    (run : releaseShared fuel store value = .ok (output, remaining)) (count : Nat) :
+    releaseShared fuel (bump store count) value = .ok (bump output count, remaining) :=
+  releaseWork_bump run count
+
+def retained (store : Store) (location : Nat) (box : NodeBox) : Store :=
+  (store.setBox location { box with rc := box.rc + 1 }).rcTick
+
+theorem retained_at {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    (retained store location box).get? location = some { box with rc := box.rc + 1 } :=
+  IxIR1.Sim.get?_setBox_same found
+
+theorem retain_eq {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (shared : box.world = .shared) :
+    retainShared store (.loc location) = .ok (retained store location box) := by
+  simp [retainShared, found, shared, retained]
+
+private theorem setBox_restore {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) : store.setBox location box = store := by
+  have slot := IxIR1.Sim.nodes_get?_of_get? found
+  obtain ⟨bound, valueAt⟩ := Array.getElem?_eq_some_iff.mp slot
+  have slots : store.heap.nodes.setIfInBounds location (some box) = store.heap.nodes := by
+    rw [Array.setIfInBounds, dif_pos bound, ← valueAt]
+    exact Array.set_getElem_self bound
+  simp only [Store.setBox, IxIR1.Store.setBox, Array.set!_eq_setIfInBounds, slots]
+
+/-- The temporary owner protects the entire reachable graph. Its first
+release cannot recurse or free any node, even if the original owner aliases
+other caller roots. It restores every slot and costs exactly two RC ticks. -/
+theorem retain_release_cancel {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (shared : box.world = .shared)
+    (positive : 0 < box.rc) (fuel : Nat) :
+    releaseShared (fuel + 1) (retained store location box) (.loc location) =
+      .ok (bump store 2, fuel) := by
+  have retainedAt := retained_at found
+  have nonunit : box.rc + 1 ≠ 1 := by omega
+  simp only [releaseShared, releaseSharedWork, retainedAt, shared, bne_self_eq_false,
+    Bool.false_eq_true, ↓reduceIte, beq_iff_eq,
+    Nat.add_eq_zero_iff, Nat.one_ne_zero, and_false, nonunit, Nat.add_sub_cancel]
+  have restore := setBox_restore found
+  have cancelled : ((retained store location box).rcTick).setBox location box = bump store 2 := by
+    simp only [retained, Store.rcTick, Store.setBox, IxIR1.Store.rcTick, IxIR1.Store.setBox,
+      Array.set!_eq_setIfInBounds, Array.setIfInBounds_setIfInBounds]
+    have slots := congrArg (fun s : Store => s.heap.nodes) restore
+    simp only [Store.setBox, IxIR1.Store.setBox, Array.set!_eq_setIfInBounds] at slots
+    simp only [slots, bump, Nat.add_assoc]
+  simpa [← shared] using cancelled
+
+inductive Major where
+  | zero
+  | succ (field : RVal)
+  deriving Repr
+
+def Major.cid (schema : Schema) : Major → CtorId
+  | .zero => schema.zero
+  | .succ _ => schema.succ
+
+def Major.fields : Major → Array RVal
+  | .zero => #[]
+  | .succ field => #[field]
+
+def Major.result (schema : Schema) : Major → Nat
+  | .zero => schema.zeroResult
+  | .succ _ => schema.succResult
+
+def Major.fieldCost : Major → Nat
+  | .zero => 0
+  | .succ _ => 1
+
+def Major.At (schema : Schema) (major : Major) (store : Store) (location rc : Nat) : Prop :=
+  store.get? location = some ⟨.shared, rc, .ctorN (major.cid schema) major.fields⟩
+
+theorem Major.At.bump {schema major store location rc}
+    (found : Major.At schema major store location rc) (count : Nat) :
+    Major.At schema major (bump store count) location rc := found
+
+theorem Major.At.retained {schema major store location rc}
+    (found : Major.At schema major store location rc) :
+    Major.At schema major (retained store location ⟨.shared, rc, .ctorN (major.cid schema) major.fields⟩)
+      location (rc + 1) := retained_at found
+
+end Ix.Compiler.IxIR2.Borrow.Open
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenResources.lean b/Ix/Compiler/IxIR2/Borrow/OpenResources.lean
new file mode 100644
index 000000000..63fbd4b4a
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenResources.lean
@@ -0,0 +1,179 @@
+import Ix.Compiler.IxIR2.Borrow.OpenCheck
+import Ix.Compiler.IxIR2.CreditReclamation
+
+namespace Ix.Compiler.IxIR2.Borrow.Open
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RootOwnership)
+open Ix.Compiler.IxIR1.Reclamation (AllocationOrderInvariant)
+
+theorem Entry.readWork_eq {beforeContext afterContext schema} (entry : Entry beforeContext afterContext schema) :
+    entry.beforeBody.readWork = entry.afterBody.readWork := by
+  simp only [Body.readWork, entry.sameKind]
+
+/-- Reusable function and continuation preservation. The only operational
+premise is the ordinary final heap release; `Entry.total` constructs that
+release internally for owned, allocation-ordered runtime inputs. -/
+theorem Entry.steps {beforeContext afterContext schema} (entry : Entry beforeContext afterContext schema)
+    (mode : Interpretation) (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store output : Store} {location rc fuel remaining : Nat}
+    (view : major.At schema store location rc) (positive : 0 < rc)
+    (released : releaseShared fuel store (.loc location) = .ok (output, remaining)) (exit : Exit) :
+    Steps beforeContext mode (entry.beforeBody.ownedCost major.fieldCost)
+      (start entry.before location store (fuel + 2 * entry.beforeBody.readWork) exit)
+      (finish (bump output (2 * entry.beforeBody.readWork)) remaining (major.result schema) exit) ∧
+    Steps afterContext mode (entry.afterBody.readCost major.fieldCost + 3)
+      (start (ownedWrapper entry.summary.borrowed entry.before) location store
+        (fuel + entry.beforeBody.readWork) exit)
+      (finish output remaining (major.result schema) exit) := by
+  refine ⟨entry.beforeBody.ownedSteps mode distinct major view positive released exit, ?_⟩
+  rw [entry.readWork_eq]
+  exact wrapper entry.afterAt (by rw [entry.afterBody.signature]; rfl) entry.afterBody.nonempty
+    mode major released exit (fun caller rest => entry.afterBody.borrowedSteps mode distinct major view fuel (.resume caller rest))
+
+/-- Every borrowed prefix preserves the exact caller store. In particular,
+the caller retains all ownership, refcounts, and constructor views required
+by a later take/reset, after the borrowed activation has returned. -/
+theorem Entry.lenderLifetime {beforeContext afterContext schema} (entry : Entry beforeContext afterContext schema)
+    (mode : Interpretation) (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (view : major.At schema store location rc)
+    (fuel : Nat) (exit : Exit) {count : Nat} {middle : Machine}
+    (path : Steps afterContext mode count
+      (start entry.after location store (fuel + entry.afterBody.readWork) exit) middle)
+    (bound : count ≤ entry.afterBody.readCost major.fieldCost) : middle.store = store :=
+  (entry.afterBody.borrowedSteps mode distinct major view fuel exit).prefix path bound
+
+structure Input (schema : Schema) (major : Major) (store : Store) (location rc : Nat) : Prop where
+  view : major.At schema store location rc
+  owned : RootOwnership store.heap [⟨.shared, .loc location⟩]
+  ordered : AllocationOrderInvariant store.heap
+  accounted : store.heap.allocs = store.live + store.heap.frees
+  peak : store.live ≤ store.peakLiveNodes
+
+def FullyReleased (store : Store) : Prop :=
+  store.live = 0 ∧ store.heap.allocs = store.heap.frees ∧ store.heap.nodes.all Option.isNone = true
+
+theorem fullyReleased_of_zero {before output : Store}
+    (accounted : before.heap.allocs = before.live + before.heap.frees)
+    (balanced : HeapBalance before output) (empty : output.live = 0) : FullyReleased output := by
+  have frees : output.heap.allocs = output.heap.frees := by
+    unfold HeapBalance at balanced
+    omega
+  refine ⟨empty, frees, ?_⟩
+  have none := Array.countP_eq_zero.mp ((Store.live_eq_countP output).symm.trans empty)
+  rw [Array.all_eq_true']
+  intro slot member
+  have absent := none slot member
+  cases slot <;> simp_all
+
+theorem FullyReleased.bump {store : Store} (released : FullyReleased store) (count : Nat) :
+    FullyReleased (bump store count) := released
+
+theorem released_peak {store output : Store} {fuel remaining : Nat} {value : RVal}
+    (released : releaseShared fuel store value = .ok (output, remaining)) :
+    output.peakLiveNodes = store.peakLiveNodes :=
+  congrArg Counters.peakLiveNodes (CreditRefinement.releaseWork_passive released)
+
+/-- The ownership and allocation-order invariants construct deep-release fuel
+for every admitted heap, including arbitrary shared descendants. There is no
+finite input matrix, source replay, or caller simulation obligation here. -/
+theorem Entry.total {beforeContext afterContext schema} (entry : Entry beforeContext afterContext schema)
+    (mode : Interpretation) (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (input : Input schema major store location rc) (exit : Exit) :
+    ∃ fuel output,
+      Steps beforeContext mode (entry.beforeBody.ownedCost major.fieldCost)
+        (start entry.before location store (fuel + 2 * entry.beforeBody.readWork) exit)
+        (finish (bump output (2 * entry.beforeBody.readWork)) 0 (major.result schema) exit) ∧
+      Steps afterContext mode (entry.afterBody.readCost major.fieldCost + 3)
+        (start (ownedWrapper entry.summary.borrowed entry.before) location store
+          (fuel + entry.beforeBody.readWork) exit)
+        (finish output 0 (major.result schema) exit) ∧
+      FullyReleased output ∧ FullyReleased (bump output (2 * entry.beforeBody.readWork)) ∧
+      output.peakLiveNodes = store.peakLiveNodes ∧
+      (bump output (2 * entry.beforeBody.readWork)).heap.rcops =
+        output.heap.rcops + 2 * entry.beforeBody.readWork := by
+  obtain ⟨fuel, output, released, empty⟩ := CreditRefinement.reclaim_progress input.owned input.ordered
+  have positive := RootOwnership.shared_rc_pos input.view input.owned
+  have paths := entry.steps mode distinct major input.view positive released exit
+  have clean := fullyReleased_of_zero input.accounted (releaseShared_heapBalance released) empty
+  exact ⟨fuel, output, paths.1, paths.2, clean, clean.bump _, released_peak released, rfl⟩
+
+theorem Certificate.strictImprovement {limits validation baseline}
+    (certificate : Certificate limits validation baseline)
+    (mode : Interpretation) (major : Major) {store : Store} {location rc : Nat}
+    (input : Input certificate.schema major store location rc) (exit : Exit) :
+    ∃ fuel output,
+      Steps (context validation baseline) mode (certificate.entry.beforeBody.ownedCost major.fieldCost)
+        (start certificate.entry.before location store (fuel + 2) exit)
+        (finish (bump output 2) 0 (major.result certificate.schema) exit) ∧
+      Steps (context validation certificate.rewrite.program) mode
+        (certificate.entry.afterBody.readCost major.fieldCost + 3)
+        (start (ownedWrapper certificate.entry.summary.borrowed certificate.entry.before) location store (fuel + 1) exit)
+        (finish output 0 (major.result certificate.schema) exit) ∧
+      FullyReleased output ∧ FullyReleased (bump output 2) ∧
+      output.peakLiveNodes = store.peakLiveNodes ∧
+      output.heap.rcops < (bump output 2).heap.rcops := by
+  obtain ⟨fuel, output, before, after, clean, beforeClean, peak, _⟩ :=
+    certificate.entry.total mode certificate.distinct major input exit
+  have work : certificate.entry.beforeBody.readWork = 1 := by
+    simp [Body.readWork, certificate.improvement]
+  refine ⟨fuel, output, ?_, ?_, clean, ?_, peak, ?_⟩
+  · simpa [work] using before
+  · simpa [work] using after
+  · simpa [work] using beforeClean
+  · simp [bump]
+
+theorem Certificate.controlCost {limits validation baseline}
+    (certificate : Certificate limits validation baseline) (major : Major) :
+    certificate.entry.afterBody.readCost major.fieldCost + 3 =
+      certificate.entry.beforeBody.ownedCost major.fieldCost + 1 := by
+  have kind : certificate.entry.afterBody.isTwice = true :=
+    certificate.entry.sameKind.symm.trans certificate.improvement
+  simp only [Body.readCost, Body.ownedCost, certificate.improvement, kind, ↓reduceIte]
+  rw [certificate.entry.sameDepth]
+  omega
+
+theorem initial_eq_start (definition : Function) (location fuel : Nat) (store : Store)
+    (peak : store.live ≤ store.peakLiveNodes) :
+    initialMachine definition #[.loc location] fuel store = start definition location store fuel .halt := by
+  change (Machine.mk { store with peakLiveNodes := max store.peakLiveNodes store.live } fuel
+    (.running { definition, values := #[.loc location] } [])) = _
+  rw [Nat.max_eq_left peak]
+  rfl
+
+/-- The public runner executes exactly the two certified open functions.
+Fuel is constructed from the input ownership invariant and each structural
+control cost, rather than guessed by the selecting compiler. -/
+theorem Certificate.runFunctions {limits validation baseline}
+    (certificate : Certificate limits validation baseline)
+    (mode : Interpretation) (major : Major) {store : Store} {location rc : Nat}
+    (input : Input certificate.schema major store location rc) :
+    ∃ fuel output,
+      runFunction (context validation baseline) mode certificate.entry.before #[.loc location]
+        (certificate.entry.beforeBody.ownedCost major.fieldCost) (fuel + 2) store =
+        .ok {
+          store := bump output 2, value := .lit (.nat (major.result certificate.schema))
+          controlRemaining := 0, heapRemaining := 0 } ∧
+      runFunction (context validation certificate.rewrite.program) mode
+        (ownedWrapper certificate.entry.summary.borrowed certificate.entry.before) #[.loc location]
+        (certificate.entry.afterBody.readCost major.fieldCost + 3) (fuel + 1) store =
+        .ok {
+          store := output, value := .lit (.nat (major.result certificate.schema))
+          controlRemaining := 0, heapRemaining := 0 } ∧
+      FullyReleased output ∧ FullyReleased (bump output 2) ∧
+      output.peakLiveNodes = store.peakLiveNodes := by
+  obtain ⟨fuel, output, before, after, clean, beforeClean, peak, _⟩ :=
+    certificate.strictImprovement mode major input .halt
+  refine ⟨fuel, output, ?_, ?_, clean, beforeClean, peak⟩
+  · rw [runFunction_eq_runMachine (by rw [certificate.entry.beforeBody.signature]; rfl)
+        certificate.entry.beforeBody.nonempty, initial_eq_start _ _ _ _ input.peak]
+    exact before.runMachine_halted
+  · have arity : (#[.loc location] : Array RVal).size =
+        (ownedWrapper certificate.entry.summary.borrowed certificate.entry.before).signature.params.size := by
+      change 1 = certificate.entry.before.signature.params.size
+      rw [certificate.entry.beforeBody.signature]
+      rfl
+    rw [runFunction_eq_runMachine arity (by rfl), initial_eq_start _ _ _ _ input.peak]
+    exact after.runMachine_halted
+
+end Ix.Compiler.IxIR2.Borrow.Open
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenShape.lean b/Ix/Compiler/IxIR2/Borrow/OpenShape.lean
new file mode 100644
index 000000000..5e43393fe
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenShape.lean
@@ -0,0 +1,151 @@
+import Ix.Compiler.IxIR2.Borrow.Rewrite
+import Ix.Compiler.IxIR2.Eval
+
+/-! Structural certificates for allocation-free borrowed readers. The
+certificate contains syntax and declaration lookup facts, never an execution
+of a runtime argument. The semantic proof is in `OpenSim`. -/
+
+namespace Ix.Compiler.IxIR2.Borrow.Open
+
+open Ix.Compiler.Ixon (Address)
+
+structure Schema where
+  zero : CtorId
+  succ : CtorId
+  zeroResult : Nat
+  succResult : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def signature (borrowed : Bool) : Signature :=
+  { params := #[{ world := .shared, passing := if borrowed then .borrowed else .owned }]
+    result := .shared
+    papSafe := !borrowed }
+
+def capability (borrowed : Bool) : ValueCap :=
+  if borrowed then .borrowed .shared .caller else .owned .shared
+
+def block (borrowed : Bool) (instructions : Array Instr) (terminator : Terminator) : Block :=
+  { valueParams := #[capability borrowed], creditParams := #[], instructions, terminator }
+
+def release (borrowed : Bool) : Array Instr :=
+  if borrowed then #[] else #[.releaseShared (.reg 0)]
+
+def reader (schema : Schema) (borrowed : Bool) : Function :=
+  { signature := signature borrowed
+    blocks := #[
+      block borrowed #[] (.switchValue (.reg 0) #[
+        { cid := schema.zero, edge := { target := 1, values := #[.reg 0], credits := #[] } },
+        { cid := schema.succ, edge := { target := 2, values := #[.reg 0], credits := #[] } }] none),
+      block borrowed (release borrowed) (.ret (.lit (.nat schema.zeroResult))),
+      block borrowed (#[.fetch (.reg 0) schema.succ 0] ++ release borrowed)
+        (.ret (.lit (.nat schema.succResult))) ] }
+
+def forward (borrowed : Bool) (address : Address) : Function :=
+  { signature := signature borrowed
+    blocks := #[block borrowed #[] (.tailCall address #[.reg 0])] }
+
+def twice (borrowed : Bool) (address : Address) : Function :=
+  { signature := signature borrowed
+    blocks := #[block borrowed #[
+      if borrowed then .move (.reg 0) else .retainShared (.reg 0),
+      .call address #[.reg 1], .releaseShared (.reg 2)] (.tailCall address #[.reg 0])] }
+
+def factory (address : Address) : Function :=
+  { signature := { params := #[], result := .shared, papSafe := true }
+    blocks := #[{ valueParams := #[], creditParams := #[], instructions := #[.papp address #[]]
+                  terminator := .ret (.reg 0) }] }
+
+/-- A finite declaration derivation rules out unresolved calls and recursive
+cycles. Its depth is independent of every runtime value and heap. -/
+inductive Chain (context : Eval.Context) (schema : Schema) (borrowed : Bool) : Function → Type where
+  | reader : Chain context schema borrowed (reader schema borrowed)
+  | forward (address : Address) (callee : Function)
+      (found : context.declarations address = some (.fn callee))
+      (tail : Chain context schema borrowed callee) :
+      Chain context schema borrowed (forward borrowed address)
+
+def Chain.depth {context schema borrowed definition} :
+    Chain context schema borrowed definition → Nat
+  | .reader => 0
+  | .forward _ _ _ tail => tail.depth + 1
+
+def recognizeChain (context : Eval.Context) (schema : Schema) (borrowed : Bool) :
+    Nat → (definition : Function) → Option (Chain context schema borrowed definition)
+  | 0, _ => none
+  | fuel + 1, definition =>
+      if exact : definition = reader schema borrowed then
+        some (exact ▸ Chain.reader)
+      else do
+        let some entry := definition.blocks[0]? | none
+        let .tailCall address _ := entry.terminator | none
+        let some (.fn callee) := context.declarations address | none
+        let tail ← recognizeChain context schema borrowed fuel callee
+        if found : context.declarations address = some (.fn callee) then
+          if exact : definition = forward borrowed address then
+            some (exact ▸ Chain.forward address callee found tail)
+          else none
+        else none
+
+inductive Body (context : Eval.Context) (schema : Schema) (borrowed : Bool) : Function → Type where
+  | chain {definition : Function} (chain : Chain context schema borrowed definition) :
+      Body context schema borrowed definition
+  | twice (address : Address) (callee : Function)
+      (found : context.declarations address = some (.fn callee))
+      (chain : Chain context schema borrowed callee) :
+      Body context schema borrowed (twice borrowed address)
+
+def Body.isTwice {context schema borrowed definition} : Body context schema borrowed definition → Bool
+  | .chain _ => false
+  | .twice .. => true
+
+def Body.depth {context schema borrowed definition} : Body context schema borrowed definition → Nat
+  | .chain derivation => derivation.depth
+  | .twice _ _ _ derivation => derivation.depth
+
+def Body.readWork {context schema borrowed definition} (body : Body context schema borrowed definition) : Nat :=
+  if body.isTwice then 1 else 0
+
+def Body.readCost {context schema borrowed definition} (body : Body context schema borrowed definition)
+    (fieldCost : Nat) : Nat :=
+  if body.isTwice then 2 * body.depth + 8 + 2 * fieldCost else body.depth + 2 + fieldCost
+
+def Body.ownedCost {context schema borrowed definition} (body : Body context schema borrowed definition)
+    (fieldCost : Nat) : Nat :=
+  if body.isTwice then 2 * body.depth + 10 + 2 * fieldCost else body.depth + 3 + fieldCost
+
+def recognizeBody (context : Eval.Context) (schema : Schema) (borrowed : Bool)
+    (fuel : Nat) (definition : Function) : Option (Body context schema borrowed definition) := do
+  match recognizeChain context schema borrowed fuel definition with
+  | some chain => some (.chain chain)
+  | none =>
+      let some entry := definition.blocks[0]? | none
+      let .tailCall address _ := entry.terminator | none
+      let some (.fn callee) := context.declarations address | none
+      let chain ← recognizeChain context schema borrowed fuel callee
+      if found : context.declarations address = some (.fn callee) then
+        if exact : definition = twice borrowed address then
+          some (exact ▸ Body.twice address callee found chain)
+        else none
+      else none
+
+theorem Chain.signature {context schema borrowed definition}
+    (chain : Chain context schema borrowed definition) : definition.signature = signature borrowed := by
+  cases chain <;> rfl
+
+theorem Chain.nonempty {context schema borrowed definition}
+    (chain : Chain context schema borrowed definition) : definition.blocks.isEmpty = false := by
+  cases chain <;> rfl
+
+theorem Body.signature {context schema borrowed definition}
+    (body : Body context schema borrowed definition) : definition.signature = signature borrowed := by
+  cases body with
+  | chain chain => exact chain.signature
+  | twice => rfl
+
+theorem Body.nonempty {context schema borrowed definition}
+    (body : Body context schema borrowed definition) : definition.blocks.isEmpty = false := by
+  cases body with
+  | chain derivation => exact derivation.nonempty
+  | twice => rfl
+
+end Ix.Compiler.IxIR2.Borrow.Open
diff --git a/Ix/Compiler/IxIR2/Borrow/OpenSim.lean b/Ix/Compiler/IxIR2/Borrow/OpenSim.lean
new file mode 100644
index 000000000..31e3898b2
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/OpenSim.lean
@@ -0,0 +1,188 @@
+import Ix.Compiler.IxIR2.Borrow.OpenControl
+
+namespace Ix.Compiler.IxIR2.Borrow.Open
+
+open Eval
+open Ix.Compiler.Ixon (Address)
+
+theorem Chain.borrowedSteps {context : Context} {schema : Schema} {definition : Function}
+    (chain : Chain context schema true definition) (mode : Interpretation)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (view : major.At schema store location rc)
+    (fuel : Nat) (exit : Exit) :
+    StableSteps context mode (chain.depth + 2 + major.fieldCost)
+      (start definition location store fuel exit) (finish store fuel (major.result schema) exit) := by
+  induction chain with
+  | reader => exact readerBorrowed context mode schema distinct major view fuel exit
+  | forward address callee found tail ih =>
+      have step : Step context mode (start (Open.forward true address) location store fuel exit)
+          (start callee location store fuel exit) :=
+        Step.tailCallFn rfl rfl rfl rfl rfl rfl found
+          (by rw [tail.signature]; rfl) tail.nonempty
+      have count : 1 + (tail.depth + 2 + major.fieldCost) = tail.depth + 1 + 2 + major.fieldCost := by omega
+      simpa only [Chain.depth, count] using (StableSteps.one step rfl rfl).trans ih
+
+theorem Chain.ownedSteps {context : Context} {schema : Schema} {definition : Function}
+    (chain : Chain context schema false definition) (mode : Interpretation)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store output : Store} {location rc fuel remaining : Nat}
+    (view : major.At schema store location rc)
+    (released : releaseShared fuel store (.loc location) = .ok (output, remaining)) (exit : Exit) :
+    Steps context mode (chain.depth + 3 + major.fieldCost)
+      (start definition location store fuel exit) (finish output remaining (major.result schema) exit) := by
+  induction chain with
+  | reader => exact readerOwned context mode schema distinct major view released exit
+  | forward address callee found tail ih =>
+      have step : Step context mode (start (Open.forward false address) location store fuel exit)
+          (start callee location store fuel exit) :=
+        Step.tailCallFn rfl rfl rfl rfl rfl rfl found
+          (by rw [tail.signature]; rfl) tail.nonempty
+      have count : 1 + (tail.depth + 3 + major.fieldCost) = tail.depth + 1 + 3 + major.fieldCost := by omega
+      simpa only [Chain.depth, count] using (step.toSteps rfl).trans ih
+
+def twiceSaved (borrowed : Bool) (address : Address) (location : Nat) : Frame :=
+  { definition := twice borrowed address, pc := 2, values := #[.loc location, .loc location] }
+
+def twiceResumed (borrowed : Bool) (address : Address) (location number : Nat) : Frame :=
+  { twiceSaved borrowed address location with values := #[.loc location, .loc location, .lit (.nat number)] }
+
+theorem twiceBorrowed {context : Context} {schema : Schema} {address : Address} {callee : Function}
+    (found : context.declarations address = some (.fn callee))
+    (chain : Chain context schema true callee) (mode : Interpretation)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (view : major.At schema store location rc)
+    (fuel : Nat) (exit : Exit) :
+    StableSteps context mode (2 * chain.depth + 8 + 2 * major.fieldCost)
+      (start (twice true address) location store (fuel + 1) exit)
+      (finish store fuel (major.result schema) exit) := by
+  let moved : Machine := {
+    store, heapFuel := fuel + 1
+    control := .running { definition := twice true address, pc := 1, values := #[.loc location, .loc location] } exit.stack }
+  let saved := twiceSaved true address location
+  let resumed := twiceResumed true address location (major.result schema)
+  let next : Machine := {
+    store, heapFuel := fuel
+    control := .running { resumed with pc := 3 } exit.stack }
+  have move : Step context mode (start (twice true address) location store (fuel + 1) exit) moved :=
+    Step.move (machine := start (twice true address) location store (fuel + 1) exit)
+      (atom := .reg 0) (value := .loc location) rfl rfl (by change 0 < 3; omega) rfl rfl
+  have call : Step context mode moved (start callee location store (fuel + 1) (.resume saved exit.stack)) :=
+    Step.callFn (machine := moved) (arguments := #[.reg 1]) (values := #[.loc location])
+      rfl rfl (by change 1 < 3; omega) rfl rfl rfl found
+      (by rw [chain.signature]; rfl) chain.nonempty
+  have first := chain.borrowedSteps mode distinct major view (fuel + 1) (.resume saved exit.stack)
+  have discard : Step context mode (finish store (fuel + 1) (major.result schema) (.resume saved exit.stack)) next :=
+    Step.releaseShared rfl rfl (by change 2 < 3; omega) rfl rfl
+      (by simp [releaseShared, releaseSharedWork, finish, resumed, twiceResumed])
+  have tailCall : Step context mode next (start callee location store fuel exit) :=
+    Step.tailCallFn rfl rfl rfl rfl rfl rfl found
+      (by rw [chain.signature]; rfl) chain.nonempty
+  have second := chain.borrowedSteps mode distinct major view fuel exit
+  have path := (((((StableSteps.one move rfl rfl).trans (StableSteps.one call rfl rfl)).trans first).trans
+    (StableSteps.one discard rfl rfl)).trans (StableSteps.one tailCall rfl rfl)).trans second
+  have count : 1 + 1 + (chain.depth + 2 + major.fieldCost) + 1 + 1 +
+      (chain.depth + 2 + major.fieldCost) = 2 * chain.depth + 8 + 2 * major.fieldCost := by omega
+  simpa only [count] using path
+
+theorem twiceOwned {context : Context} {schema : Schema} {address : Address} {callee : Function}
+    (found : context.declarations address = some (.fn callee))
+    (chain : Chain context schema false callee) (mode : Interpretation)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store output : Store} {location rc fuel remaining : Nat}
+    (view : major.At schema store location rc) (positive : 0 < rc)
+    (released : releaseShared fuel store (.loc location) = .ok (output, remaining)) (exit : Exit) :
+    Steps context mode (2 * chain.depth + 10 + 2 * major.fieldCost)
+      (start (twice false address) location store (fuel + 2) exit)
+      (finish (bump output 2) remaining (major.result schema) exit) := by
+  let box : NodeBox := ⟨.shared, rc, .ctorN (major.cid schema) major.fields⟩
+  let held := retained store location box
+  let moved : Machine := {
+    store := held, heapFuel := fuel + 2
+    control := .running { definition := twice false address, pc := 1, values := #[.loc location, .loc location] } exit.stack }
+  let saved := twiceSaved false address location
+  let resumed := twiceResumed false address location (major.result schema)
+  let next : Machine := {
+    store := bump store 2, heapFuel := fuel
+    control := .running { resumed with pc := 3 } exit.stack }
+  have retain : Step context mode (start (twice false address) location store (fuel + 2) exit) moved :=
+    Step.retainShared (machine := start (twice false address) location store (fuel + 2) exit)
+      (atom := .reg 0) (value := .loc location) rfl rfl (by change 0 < 3; omega) rfl rfl (retain_eq view rfl)
+  have call : Step context mode moved (start callee location held (fuel + 2) (.resume saved exit.stack)) :=
+    Step.callFn (machine := moved) (arguments := #[.reg 1]) (values := #[.loc location])
+      rfl rfl (by change 1 < 3; omega) rfl rfl rfl found
+      (by rw [chain.signature]; rfl) chain.nonempty
+  have first := chain.ownedSteps mode distinct major view.retained
+    (retain_release_cancel view rfl positive (fuel + 1)) (.resume saved exit.stack)
+  have discard : Step context mode (finish (bump store 2) (fuel + 1) (major.result schema) (.resume saved exit.stack)) next :=
+    Step.releaseShared rfl rfl (by change 2 < 3; omega) rfl rfl
+      (by simp [releaseShared, releaseSharedWork, finish, resumed, twiceResumed])
+  have tailCall : Step context mode next (start callee location (bump store 2) fuel exit) :=
+    Step.tailCallFn rfl rfl rfl rfl rfl rfl found
+      (by rw [chain.signature]; rfl) chain.nonempty
+  have second := chain.ownedSteps mode distinct major (view.bump 2) (release_bump released 2) exit
+  have path := (((((retain.toSteps rfl).trans (call.toSteps rfl)).trans first).trans
+    (discard.toSteps rfl)).trans (tailCall.toSteps rfl)).trans second
+  have count : 1 + 1 + (chain.depth + 3 + major.fieldCost) + 1 + 1 +
+      (chain.depth + 3 + major.fieldCost) = 2 * chain.depth + 10 + 2 * major.fieldCost := by omega
+  simpa only [count] using path
+
+/-- One exact owned wrapper brackets the borrowed execution with a live
+lender, performs the ordinary final release, and resumes the caller. -/
+theorem wrapper {context : Context} {schema : Schema} {borrowed : Address} {callee baseline : Function}
+    (found : context.declarations borrowed = some (.fn callee))
+    (arity : callee.signature.params.size = 1) (nonempty : callee.blocks.isEmpty = false)
+    (mode : Interpretation) (major : Major) {store output : Store} {location fuel remaining work count : Nat}
+    (released : releaseShared fuel store (.loc location) = .ok (output, remaining))
+    (exit : Exit)
+    (run : ∀ caller rest,
+      StableSteps context mode count
+        (start callee location store (fuel + work) (.resume caller rest))
+        (finish store fuel (major.result schema) (.resume caller rest))) :
+    Steps context mode (count + 3)
+      (start (ownedWrapper borrowed baseline) location store (fuel + work) exit)
+      (finish output remaining (major.result schema) exit) := by
+  let saved : Frame := { definition := ownedWrapper borrowed baseline, pc := 1, values := #[.loc location] }
+  let resumed : Frame := { saved with values := #[.loc location, .lit (.nat (major.result schema))] }
+  let next : Machine := {
+    store := output, heapFuel := remaining
+    control := .running { resumed with pc := 2 } exit.stack }
+  have call : Step context mode
+      (start (ownedWrapper borrowed baseline) location store (fuel + work) exit)
+      (start callee location store (fuel + work) (.resume saved exit.stack)) :=
+    Step.callFn (machine := start (ownedWrapper borrowed baseline) location store (fuel + work) exit)
+      (values := #[.loc location]) rfl rfl (by change 0 < 2; omega) rfl rfl rfl found
+      (by simpa using arity.symm) nonempty
+  have drop : Step context mode (finish store fuel (major.result schema) (.resume saved exit.stack)) next :=
+    Step.releaseShared rfl rfl (by change 1 < 2; omega) rfl rfl released
+  have ret : StableSteps context mode 1 next (finish output remaining (major.result schema) exit) :=
+    returnScalar output remaining (major.result schema) exit _ rfl rfl rfl rfl rfl
+  have path := (((call.toSteps rfl).trans (run saved exit.stack).steps).trans (drop.toSteps rfl)).trans ret.steps
+  have counts : 1 + count + 1 + 1 = count + 3 := by omega
+  simpa only [counts] using path
+
+theorem Body.borrowedSteps {context : Context} {schema : Schema} {definition : Function}
+    (body : Body context schema true definition) (mode : Interpretation)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store : Store} {location rc : Nat} (view : major.At schema store location rc)
+    (fuel : Nat) (exit : Exit) :
+    StableSteps context mode (body.readCost major.fieldCost)
+      (start definition location store (fuel + body.readWork) exit)
+      (finish store fuel (major.result schema) exit) := by
+  cases body with
+  | chain chain => exact chain.borrowedSteps mode distinct major view fuel exit
+  | twice address callee found chain => exact twiceBorrowed found chain mode distinct major view fuel exit
+
+theorem Body.ownedSteps {context : Context} {schema : Schema} {definition : Function}
+    (body : Body context schema false definition) (mode : Interpretation)
+    (distinct : schema.zero ≠ schema.succ) (major : Major)
+    {store output : Store} {location rc fuel remaining : Nat}
+    (view : major.At schema store location rc) (positive : 0 < rc)
+    (released : releaseShared fuel store (.loc location) = .ok (output, remaining)) (exit : Exit) :
+    Steps context mode (body.ownedCost major.fieldCost)
+      (start definition location store (fuel + 2 * body.readWork) exit)
+      (finish (bump output (2 * body.readWork)) remaining (major.result schema) exit) := by
+  cases body with
+  | chain chain => exact chain.ownedSteps mode distinct major view released exit
+  | twice address callee found chain => exact twiceOwned found chain mode distinct major view positive released exit
+
+end Ix.Compiler.IxIR2.Borrow.Open
diff --git a/Ix/Compiler/IxIR2/Borrow/Replay.lean b/Ix/Compiler/IxIR2/Borrow/Replay.lean
new file mode 100644
index 000000000..77599e118
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/Replay.lean
@@ -0,0 +1,166 @@
+import Ix.Compiler.IxIR2.Borrow.Rewrite
+import Ix.Compiler.IxIR2.Eval
+
+/-! Closed-program translation validation for borrowed calls. Structural
+validation is necessary but does not prove that moving a release preserves
+results or peak space. This boundary therefore derives finite execution
+certificates internally for the exact baseline and reconstructed program.
+Only scalar results, complete reclamation, a strict RC improvement, and no
+increase in peak live heap nodes can select the optional rewrite. It makes
+no claim about open functions on arbitrary runtime arguments. -/
+
+namespace Ix.Compiler.IxIR2.Borrow
+
+structure Budget where
+  control : Nat := 1000
+  heap : Nat := 1000
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+inductive ReplayError where
+  | execution (error : Eval.Error)
+  | nonScalar
+  | notClosed
+  | resultMismatch
+  | reclamation
+  | noImprovement
+  | peakIncrease
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def run (context : Validate.Context) (budget : Budget) (program : Program) :
+    Except Eval.Error Eval.Result :=
+  Eval.runMain (Eval.Context.ofProgram program context.schemas) .physical
+    program budget.control budget.heap
+
+structure Execution (context : Validate.Context) (budget : Budget) (program : Program) where
+  result : Eval.Result
+  number : Nat
+  ran : run context budget program = .ok result
+  scalar : result.value = .lit (.nat number)
+  arity : program.main.signature.params.size = 0
+  nonempty : program.main.blocks.isEmpty = false
+
+def execute (context : Validate.Context) (budget : Budget) (program : Program) :
+    Except ReplayError (Execution context budget program) := do
+  if arity : program.main.signature.params.size = 0 then
+    if nonempty : program.main.blocks.isEmpty = false then
+      match ran : run context budget program with
+      | .error error => .error (.execution error)
+      | .ok result =>
+          match scalar : result.value with
+          | .lit (.nat number) => pure ⟨result, number, ran, scalar, arity, nonempty⟩
+          | _ => .error .nonScalar
+    else .error .notClosed
+  else .error .notClosed
+
+/-- Reclamation checks actual slots as well as counters. -/
+def Reclaimed (store : Eval.Store) : Prop :=
+  store.heap.live = 0 ∧ store.heap.allocs = store.heap.frees ∧
+    store.heap.nodes.all Option.isNone = true
+
+instance (store : Eval.Store) : Decidable (Reclaimed store) :=
+  inferInstanceAs (Decidable (_ ∧ _ ∧ _))
+
+structure Improved (limits : Limits) (context : Validate.Context)
+    (budget : Budget) (baseline : Program) where
+  rewrite : Checked limits context baseline
+  before : Execution context budget baseline
+  after : Execution context budget rewrite.program
+  same : before.number = after.number
+  beforeReclaimed : Reclaimed before.result.store
+  afterReclaimed : Reclaimed after.result.store
+  fewerRC : after.result.store.heap.rcops < before.result.store.heap.rcops
+  peak : after.result.store.peakLiveNodes ≤ before.result.store.peakLiveNodes
+
+def replay {limits : Limits} (context : Validate.Context) (budget : Budget)
+    {baseline : Program} (rewrite : Checked limits context baseline) :
+    Except ReplayError (Improved limits context budget baseline) := do
+  let before ← execute context budget baseline
+  let after ← execute context budget rewrite.program
+  if same : before.number = after.number then
+    if beforeReclaimed : Reclaimed before.result.store then
+      if afterReclaimed : Reclaimed after.result.store then
+        if fewerRC : after.result.store.heap.rcops < before.result.store.heap.rcops then
+          if peak : after.result.store.peakLiveNodes ≤ before.result.store.peakLiveNodes then
+            pure ⟨rewrite, before, after, same, beforeReclaimed, afterReclaimed, fewerRC, peak⟩
+          else .error .peakIncrease
+        else .error .noImprovement
+      else .error .reclamation
+    else .error .reclamation
+  else .error .resultMismatch
+
+inductive Fallback where
+  | noCandidates
+  | rewrite (error : Error)
+  | replay (error : ReplayError)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+inductive Decision (limits : Limits) (context : Validate.Context)
+    (budget : Budget) (baseline : Program) where
+  | baseline (reason : Fallback)
+  | improved (result : Improved limits context budget baseline)
+
+structure Selection (limits : Limits) (context : Validate.Context)
+    (budget : Budget) (baseline : Program) where
+  baselineChecked : Validate.Checked limits.validator context baseline
+  inference : Inference
+  decision : Decision limits context budget baseline
+
+def Selection.program {limits context budget baseline}
+    (selected : Selection limits context budget baseline) : Program :=
+  match selected.decision with
+  | .baseline _ => baseline
+  | .improved result => result.rewrite.program
+
+def optimize {limits : Limits} {context : Validate.Context} {baseline : Program}
+    (baselineChecked : Validate.Checked limits.validator context baseline)
+    (budget : Budget := {}) : Selection limits context budget baseline :=
+  let inference := infer limits context baseline
+  let decision := if inference.summaries.isEmpty then .baseline .noCandidates else
+    match check limits context baseline inference.summaries with
+    | .error error => .baseline (.rewrite error)
+    | .ok rewrite =>
+        match replay context budget rewrite with
+        | .error error => .baseline (.replay error)
+        | .ok result => .improved result
+  ⟨baselineChecked, inference, decision⟩
+
+theorem Execution.steps {context budget program} (execution : Execution context budget program) :
+    ∃ count,
+      budget.control = count + execution.result.controlRemaining ∧
+      Eval.Steps (Eval.Context.ofProgram program context.schemas) .physical count
+        (Eval.initialMachine program.main #[] budget.heap)
+        { store := execution.result.store, heapFuel := execution.result.heapRemaining
+          control := .halted (.lit (.nat execution.number)) } := by
+  have ran := execution.ran
+  unfold run at ran
+  rw [Eval.runMain_eq_runMachine execution.arity execution.nonempty] at ran
+  simpa only [execution.scalar] using Eval.runMachine_steps ran
+
+theorem Improved.preservation {limits context budget baseline}
+    (result : Improved limits context budget baseline) :
+    result.before.result.value = result.after.result.value := by
+  rw [result.before.scalar, result.after.scalar, result.same]
+
+theorem Improved.resources {limits context budget baseline}
+    (result : Improved limits context budget baseline) :
+    Reclaimed result.before.result.store ∧ Reclaimed result.after.result.store ∧
+    result.after.result.store.heap.rcops < result.before.result.store.heap.rcops ∧
+    result.after.result.store.peakLiveNodes ≤ result.before.result.store.peakLiveNodes :=
+  ⟨result.beforeReclaimed, result.afterReclaimed, result.fewerRC, result.peak⟩
+
+theorem Selection.valid {limits context budget baseline}
+    (selected : Selection limits context budget baseline) :
+    Validate.ValidWith limits.validator context selected.program := by
+  cases h : selected.decision with
+  | baseline _ =>
+      simpa [Selection.program, h] using
+        (show Validate.ValidWith limits.validator context baseline from
+          ⟨selected.baselineChecked.stats, selected.baselineChecked.accepted⟩)
+  | improved result => simpa [Selection.program, h] using result.rewrite.valid
+
+theorem Selection.fallbackExact {limits context budget baseline}
+    (selected : Selection limits context budget baseline) {reason : Fallback}
+    (fallback : selected.decision = .baseline reason) : selected.program = baseline := by
+  simp [Selection.program, fallback]
+
+end Ix.Compiler.IxIR2.Borrow
diff --git a/Ix/Compiler/IxIR2/Borrow/Rewrite.lean b/Ix/Compiler/IxIR2/Borrow/Rewrite.lean
new file mode 100644
index 000000000..a83b532c5
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Borrow/Rewrite.lean
@@ -0,0 +1,185 @@
+import Ix.Compiler.IxIR2.Validate
+import Ix.Compiler.Ixon.Hash
+
+/-! Bounded proposals for a borrowed ABI. Summaries are claims, not facts:
+the checker reconstructs every variant from the exact baseline and validates
+the complete program, including all owned wrappers and their call sites.
+The first version borrows one shared parameter and rejects credit effects
+and recursive calls. It leaves constructor-field retains intact. -/
+
+namespace Ix.Compiler.IxIR2.Borrow
+
+open Ix.Compiler.Ixon (Address)
+
+structure Summary where
+  owner : Address
+  borrowed : Address
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+structure Limits where
+  maxCandidates : Nat := 32
+  maxRounds : Nat := 16
+  maxAttempts : Nat := 256
+  validator : Validate.Limits := Validate.defaultLimits
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+inductive Error where
+  | limit
+  | missingOwner (owner : Address)
+  | signature (owner : Address)
+  | unsupported (owner : Address)
+  | duplicateSummary
+  | validation (error : Validate.Error)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+/-- This is an internal label, not a persistent IxIR₂ content address.
+Collisions are rejected by whole-program validation. -/
+def borrowedAddress (owner : Address) : Address :=
+  Address.blake3 ("compilatrix/borrowed-entry/1\x00".toUTF8 ++ owner.hash)
+
+def eligible (definition : Function) : Bool :=
+  definition.signature.params == #[{ world := .shared, passing := .owned }] &&
+    definition.signature.result == .shared
+
+def borrowedAt? (summaries : List Summary) (owner : Address) : Option Address :=
+  (summaries.find? fun summary => summary.owner == owner).map (·.borrowed)
+
+private def loanAtom (loans : Array Bool) : Atom → Bool
+  | .reg id => loans[id]?.getD false
+  | .lit _ | .erased => false
+
+private def borrowedCap : ValueCap → ValueCap
+  | .owned .shared => .borrowed .shared .caller
+  | cap => cap
+
+/-- Replace root retains by non-consuming moves so result-register numbering
+does not change. Releases have no result and can simply be removed. Fetches
+produce field views, whose later retains remain real ownership operations. -/
+def rewriteBlock (owner : Address) (summaries : List Summary) (block : Block) :
+    Except Error Block := do
+  if !block.creditParams.isEmpty then throw (.unsupported owner)
+  let mut loans := block.valueParams.map (· == .owned .shared)
+  let mut instructions := #[]
+  for instruction in block.instructions do
+    match instruction with
+    | .retainShared atom =>
+        let loan := loanAtom loans atom
+        instructions := instructions.push (if loan then .move atom else instruction)
+        loans := loans.push loan
+    | .move atom =>
+        instructions := instructions.push instruction
+        loans := loans.push (loanAtom loans atom)
+    | .releaseShared atom =>
+        if !loanAtom loans atom then instructions := instructions.push instruction
+    | .call target args =>
+        instructions := instructions.push (.call ((borrowedAt? summaries target).getD target) args)
+        loans := loans.push false
+    | .alloc .. | .fetch .. | .papp .. | .apply .. =>
+        instructions := instructions.push instruction
+        loans := loans.push false
+    | .dropUnique .. | .freeUnique .. =>
+        instructions := instructions.push instruction
+    | .allocWith .. | .discardCredit .. | .takeUnique .. | .resetShared .. |
+        .callSelf .. | .extern .. => throw (.unsupported owner)
+  let terminator ← match block.terminator with
+    | .tailCall target args =>
+        pure (.tailCall ((borrowedAt? summaries target).getD target) args)
+    | .tailCallSelf .. | .branchCredit .. => throw (.unsupported owner)
+    | terminator => pure terminator
+  return { block with valueParams := block.valueParams.map borrowedCap
+                      instructions, terminator }
+
+def rewriteFunction (owner : Address) (summaries : List Summary)
+    (definition : Function) : Except Error Function := do
+  if !eligible definition then throw (.signature owner)
+  let blocks ← definition.blocks.mapM (rewriteBlock owner summaries)
+  return {
+    signature := { definition.signature with
+      params := #[{ world := .shared, passing := .borrowed }], papSafe := false }
+    blocks }
+
+/-- Dynamic/PAP entry still owns its argument. Its wrapper keeps the lender
+alive during the borrowed call and performs the final release on return. -/
+def ownedWrapper (borrowed : Address) (definition : Function) : Function :=
+  { signature := definition.signature
+    blocks := #[{
+      valueParams := #[.owned .shared], creditParams := #[]
+      instructions := #[.call borrowed #[.reg 0], .releaseShared (.reg 0)]
+      terminator := .ret (.reg 1) }] }
+
+def rebuild (limits : Limits) (baseline : Program) (summaries : List Summary) :
+    Except Error Program := do
+  if summaries.length > limits.maxCandidates then throw .limit
+  if summaries.any fun summary =>
+      (summaries.filter fun other => other.owner == summary.owner).length != 1 then
+    throw .duplicateSummary
+  let mut variants := []
+  for summary in summaries do
+    let some (_, .fn definition) := baseline.declarations.find? (fun entry => entry.1 == summary.owner)
+      | throw (.missingOwner summary.owner)
+    variants := variants ++ [(summary.borrowed, .fn (← rewriteFunction summary.owner summaries definition))]
+  let declarations := baseline.declarations.map fun (owner, declaration) =>
+    match borrowedAt? summaries owner, declaration with
+    | some borrowed, .fn definition => (owner, .fn (ownedWrapper borrowed definition))
+    | _, _ => (owner, declaration)
+  return { baseline with declarations := declarations ++ variants }
+
+structure Checked (limits : Limits) (context : Validate.Context) (baseline : Program) where
+  summaries : List Summary
+  program : Program
+  produced : rebuild limits baseline summaries = .ok program
+  baselineChecked : Validate.Checked limits.validator context baseline
+  checked : Validate.Checked limits.validator context program
+
+def check (limits : Limits) (context : Validate.Context) (baseline : Program)
+    (summaries : List Summary) : Except Error (Checked limits context baseline) := do
+  let baselineChecked ← match h : Validate.validateWith limits.validator context baseline with
+    | .error error => .error (.validation error)
+    | .ok stats => pure (Validate.Checked.mk stats h)
+  match h : rebuild limits baseline summaries with
+  | .error error => .error error
+  | .ok program =>
+      match checked : Validate.validateWith limits.validator context program with
+      | .error error => .error (.validation error)
+      | .ok stats => return {
+          summaries, program, produced := h, baselineChecked
+          checked := ⟨stats, checked⟩ }
+
+structure Inference where
+  summaries : List Summary := []
+  attempts : Nat := 0
+  rounds : Nat := 0
+  rejected : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+/-- Bounded dependency iteration. Each new claim is checked with all earlier
+claims. A failed attempt does not evict the last checked set. This version
+does not infer cyclic SCCs; a cycle without an accepted seed is left owned. -/
+def infer (limits : Limits) (context : Validate.Context) (baseline : Program) :
+    Inference := Id.run do
+  let candidates := baseline.declarations.filterMap fun
+    | (owner, .fn definition) => if eligible definition then some owner else none
+    | _ => none
+  if candidates.length > limits.maxCandidates then return {}
+  let mut state : Inference := {}
+  for _ in [:limits.maxRounds] do
+    let before := state.summaries.length
+    state := { state with rounds := state.rounds + 1 }
+    for owner in candidates do
+      if state.attempts < limits.maxAttempts && (borrowedAt? state.summaries owner).isNone then
+        let proposed := state.summaries ++ [{ owner, borrowed := borrowedAddress owner }]
+        state := { state with attempts := state.attempts + 1 }
+        match check limits context baseline proposed with
+        | .ok _ => state := { state with summaries := proposed }
+        | .error _ => state := { state with rejected := state.rejected + 1 }
+    if state.summaries.length == before || state.attempts == limits.maxAttempts then break
+  return state
+
+theorem Checked.valid {limits context baseline} (result : Checked limits context baseline) :
+    Validate.ValidWith limits.validator context result.program :=
+  ⟨result.checked.stats, result.checked.accepted⟩
+
+theorem Checked.exactRewrite {limits context baseline} (result : Checked limits context baseline) :
+    rebuild limits baseline result.summaries = .ok result.program := result.produced
+
+end Ix.Compiler.IxIR2.Borrow
diff --git a/Ix/Compiler/IxIR2/CallEval.lean b/Ix/Compiler/IxIR2/CallEval.lean
new file mode 100644
index 000000000..4aee119ab
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallEval.lean
@@ -0,0 +1,373 @@
+import Ix.Compiler.IxIR2.Eval
+
+/-!
+# Execution with continuation-owned credits
+
+The v1 dispatcher changes only direct non-tail calls. It saves the complete
+caller frame once and enters the callee with no credits. All other instructions
+and every terminator use the original evaluator, including its checks against
+abandoning a credit on return or transferring it across a forbidden boundary.
+The v0 runner is extensionally equal to the original runner.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval.Policy
+
+open Ix.Compiler.Ixon (Address)
+
+inductive DirectCall where
+  | function (address : Address) (arguments : Array Atom)
+  | self (arguments : Array Atom)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def DirectCall.instruction : DirectCall → Instr
+  | .function address arguments => .call address arguments
+  | .self arguments => .callSelf arguments
+
+def DirectCall.ofInstruction? : Instr → Option DirectCall
+  | .call address arguments => some (.function address arguments)
+  | .callSelf arguments => some (.self arguments)
+  | _ => none
+
+def DirectCall.arguments : DirectCall → Array Atom
+  | .function _ arguments | .self arguments => arguments
+
+def DirectCall.definition (context : Context) (frame : Frame) :
+    DirectCall → Except Error Function
+  | .self _ => .ok frame.definition
+  | .function address _ =>
+      match context.declarations address with
+      | some (.fn definition) => .ok definition
+      | some (.extern _) => .error (.stuck "call must not target an extern")
+      | none => .error (.unknownRef address)
+
+/-- Inspect exactly the current instruction, without interpreting a missing
+block, a terminator, or an invalid program counter as a call. -/
+def directCall? (frame : Frame) : Option DirectCall := do
+  let block ← frame.definition.blocks[frame.block]?
+  DirectCall.ofInstruction? (← block.instructions[frame.pc]?)
+
+def suspendCall (context : Context) (machine : Machine) (frame : Frame)
+    (stack : List Continuation) (call : DirectCall) : Except Error Machine := do
+  let values ← resolveAtoms frame.values call.arguments
+  let definition ← call.definition context frame
+  let callee ← enterFunction definition values
+  let caller : Frame := { frame with pc := frame.pc + 1 }
+  return { machine with control := .running callee (.resume caller :: stack) }
+
+def step (policy : CreditPolicy) (context : Context)
+    (interpretation : Interpretation) (machine : Machine) : Except Error Machine :=
+  match policy, machine.control with
+  | .suspendedCallsV1, .running frame stack =>
+      match directCall? frame with
+      | some call => suspendCall context machine frame stack call
+      | none => Eval.step context interpretation machine
+  | _, _ => Eval.step context interpretation machine
+
+def Step (policy : CreditPolicy) (context : Context)
+    (interpretation : Interpretation) (before after : Machine) : Prop :=
+  step policy context interpretation before = .ok after
+
+@[simp] theorem step_v0 (context : Context) (interpretation : Interpretation)
+    (machine : Machine) :
+    step .callLocalV0 context interpretation machine =
+      Eval.step context interpretation machine := rfl
+
+theorem step_of_noCall {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    (running : machine.control = .running frame stack)
+    (noCall : directCall? frame = none) :
+    step .suspendedCallsV1 context interpretation machine =
+      Eval.step context interpretation machine := by
+  simp [step, running, noCall]
+
+theorem step_of_call {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {call : DirectCall} (running : machine.control = .running frame stack)
+    (atCall : directCall? frame = some call) :
+    step .suspendedCallsV1 context interpretation machine =
+      suspendCall context machine frame stack call := by
+  simp [step, running, atCall]
+
+inductive Steps (policy : CreditPolicy) (context : Context)
+    (interpretation : Interpretation) : Nat → Machine → Machine → Prop where
+  | refl (machine : Machine) : Steps policy context interpretation 0 machine machine
+  | cons {count : Nat} {before middle after : Machine}
+      {frame : Frame} {stack : List Continuation}
+      (running : before.control = .running frame stack)
+      (head : Step policy context interpretation before middle)
+      (tail : Steps policy context interpretation count middle after) :
+      Steps policy context interpretation (count + 1) before after
+
+theorem Step.deterministic {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {before left right : Machine}
+    (leftStep : Step policy context interpretation before left)
+    (rightStep : Step policy context interpretation before right) : left = right :=
+  Except.ok.inj (leftStep.symm.trans rightStep)
+
+theorem Steps.trans {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {firstCount secondCount : Nat}
+    {before middle after : Machine}
+    (first : Steps policy context interpretation firstCount before middle)
+    (second : Steps policy context interpretation secondCount middle after) :
+    Steps policy context interpretation (firstCount + secondCount) before after := by
+  induction first with
+  | refl => simpa using second
+  | cons running head tail ih =>
+      simpa only [Nat.succ_add] using Steps.cons running head (ih second)
+
+def runMachine (policy : CreditPolicy) (context : Context)
+    (interpretation : Interpretation) : Nat → Machine → Except Error Result
+  | controlFuel, { store, heapFuel, control := .halted value } =>
+      .ok { store, value, controlRemaining := controlFuel, heapRemaining := heapFuel }
+  | 0, { control := .running .., .. } => .error .controlFuel
+  | controlFuel + 1, machine@{ control := .running .., .. } => do
+      let next ← step policy context interpretation machine
+      runMachine policy context interpretation controlFuel next
+
+def runFunction (policy : CreditPolicy) (context : Context)
+    (interpretation : Interpretation) (definition : Function)
+    (arguments : Array RVal) (controlFuel heapFuel : Nat) (store : Store := {}) :
+    Except Error Result := do
+  let _ ← enterFunction definition arguments
+  runMachine policy context interpretation controlFuel
+    (initialMachine definition arguments heapFuel store)
+
+def runMain (policy : CreditPolicy) (context : Context)
+    (interpretation : Interpretation) (program : Program)
+    (controlFuel : Nat := 100000) (heapFuel : Nat := 100000) : Except Error Result :=
+  runFunction policy context interpretation program.main #[] controlFuel heapFuel
+
+theorem runMachine_v0 (context : Context) (interpretation : Interpretation)
+    (controlFuel : Nat) (machine : Machine) :
+    runMachine .callLocalV0 context interpretation controlFuel machine =
+      Eval.runMachine context interpretation controlFuel machine := by
+  induction controlFuel generalizing machine with
+  | zero => cases machine with | mk store heapFuel control => cases control <;> rfl
+  | succ fuel ih =>
+      cases machine with
+      | mk store heapFuel control =>
+          cases control with
+          | halted value => rfl
+          | running frame stack =>
+              simp only [runMachine, Eval.runMachine, step_v0]
+              cases Eval.step context interpretation
+                  { store, heapFuel, control := .running frame stack } <;>
+                simp only [bind, Except.bind, ih]
+
+theorem runFunction_v0 (context : Context) (interpretation : Interpretation)
+    (definition : Function) (arguments : Array RVal) (controlFuel heapFuel : Nat)
+    (store : Store) :
+    runFunction .callLocalV0 context interpretation definition arguments
+        controlFuel heapFuel store =
+      Eval.runFunction context interpretation definition arguments
+        controlFuel heapFuel store := by
+  unfold runFunction Eval.runFunction enterFunction
+  split
+  · rfl
+  · split
+    · rfl
+    · simpa only [bind, Except.bind, pure, Except.pure, initialMachine] using
+        runMachine_v0 context interpretation controlFuel
+          (initialMachine definition arguments heapFuel store)
+
+theorem runMain_v0 (context : Context) (interpretation : Interpretation)
+    (program : Program) (controlFuel heapFuel : Nat) :
+    runMain .callLocalV0 context interpretation program controlFuel heapFuel =
+      Eval.runMain context interpretation program controlFuel heapFuel :=
+  runFunction_v0 ..
+
+theorem runMachine_steps {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {controlFuel : Nat} {machine : Machine}
+    {result : Result}
+    (run : runMachine policy context interpretation controlFuel machine = .ok result) :
+    ∃ count, controlFuel = count + result.controlRemaining ∧
+      Steps policy context interpretation count machine
+        { store := result.store, heapFuel := result.heapRemaining,
+          control := .halted result.value } := by
+  induction controlFuel generalizing machine with
+  | zero =>
+      rcases machine with ⟨store, heapFuel, control⟩
+      cases control with
+      | halted value =>
+          simp only [runMachine, Except.ok.injEq] at run
+          subst result
+          exact ⟨0, by simp, .refl _⟩
+      | running frame stack => cases run
+  | succ controlFuel ih =>
+      rcases machine with ⟨store, heapFuel, control⟩
+      cases control with
+      | halted value =>
+          simp only [runMachine, Except.ok.injEq] at run
+          subst result
+          exact ⟨0, by simp, .refl _⟩
+      | running frame stack =>
+          simp only [runMachine] at run
+          cases stepped : step policy context interpretation
+              { store, heapFuel, control := .running frame stack } with
+          | error error => simp [stepped, bind, Except.bind] at run
+          | ok next =>
+              simp only [stepped, bind, Except.bind] at run
+              obtain ⟨count, budget, steps⟩ := ih run
+              exact ⟨count + 1, by omega, .cons rfl stepped steps⟩
+
+theorem Steps.runMachine {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {count controlFuel : Nat}
+    {before after : Machine}
+    (steps : Steps policy context interpretation count before after) :
+    Policy.runMachine policy context interpretation (count + controlFuel) before =
+      Policy.runMachine policy context interpretation controlFuel after := by
+  induction steps with
+  | refl => simp only [Nat.zero_add]
+  | @cons count before middle after frame stack running head tail ih =>
+      rw [Nat.succ_add]
+      cases before with
+      | mk store heapFuel control =>
+          simp only at running
+          subst control
+          simp only [Policy.runMachine]
+          rw [head]
+          simp only [bind, Except.bind]
+          exact ih
+
+/-- The executable call has one saved caller and a callee with empty credits.
+The heap and remaining heap budget stay unchanged at the call transition. -/
+theorem suspendCall_iff {context : Context} {machine target : Machine}
+    {frame : Frame} {stack : List Continuation} {call : DirectCall} :
+    suspendCall context machine frame stack call = .ok target ↔
+      ∃ values definition,
+        resolveAtoms frame.values call.arguments = .ok values ∧
+        call.definition context frame = .ok definition ∧
+        values.size = definition.signature.params.size ∧
+        definition.blocks.isEmpty = false ∧
+        target = { machine with
+          control := .running { definition, values }
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } := by
+  unfold suspendCall
+  cases resolved : resolveAtoms frame.values call.arguments with
+  | error error => simp [bind, Except.bind]
+  | ok values =>
+      cases found : call.definition context frame with
+      | error error => simp [bind, Except.bind]
+      | ok definition =>
+          by_cases arity : values.size = definition.signature.params.size
+          · cases empty : definition.blocks.isEmpty with
+            | true => simp_all [enterFunction, bind, Except.bind]
+            | false =>
+                simp_all [enterFunction, bind, Except.bind, pure, Except.pure]
+                exact eq_comm
+          · simp [enterFunction, arity, bind, Except.bind]
+
+theorem Step.classify {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {before after : Machine}
+    (stepped : Step policy context interpretation before after) :
+    Eval.Step context interpretation before after ∨
+      ∃ frame stack call,
+        policy = .suspendedCallsV1 ∧ before.control = .running frame stack ∧
+        directCall? frame = some call ∧
+        suspendCall context before frame stack call = .ok after := by
+  cases policy with
+  | callLocalV0 => exact .inl stepped
+  | suspendedCallsV1 =>
+      cases control : before.control with
+      | halted value => exact .inl (by simpa [Step, Eval.Step, step, control] using stepped)
+      | running frame stack =>
+          cases atCall : directCall? frame with
+          | none => exact .inl (by simpa [Step, Eval.Step, step, control, atCall] using stepped)
+          | some call =>
+              exact .inr ⟨frame, stack, call, rfl, rfl, atCall,
+                by simpa [Step, step, control, atCall] using stepped⟩
+
+theorem directCall?_atInstruction {frame : Frame} {block : Block}
+    {instruction : Instr} (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instructionAt : block.instructions[frame.pc] = instruction) :
+    directCall? frame = DirectCall.ofInstruction? instruction := by
+  simp [directCall?, blockAt, Array.getElem?_eq_getElem pc, instructionAt]
+
+theorem directCall?_atTerminator {frame : Frame} {block : Block}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size) : directCall? frame = none := by
+  simp [directCall?, blockAt, pc]
+
+/-- Every successful old step is also a successful v1 step with exactly the
+same machine. Thus the new policy preserves all existing accepted executions. -/
+theorem of_originalStep {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (original : Eval.Step context interpretation before after) :
+    Step .suspendedCallsV1 context interpretation before after := by
+  cases original.classify with
+  | halted => rfl
+  | instruction blockAt pc instructionAt classified =>
+      have original := classified.step blockAt pc instructionAt
+      have atCall := directCall?_atInstruction blockAt pc instructionAt
+      cases classified <;>
+        try { simpa only [Step, Eval.Step, step, atCall,
+          DirectCall.ofInstruction?] using original }
+      all_goals simp_all [Step, step, DirectCall.ofInstruction?, suspendCall,
+        DirectCall.arguments, DirectCall.definition, enterFunction,
+        bind, Except.bind, pure, Except.pure]
+  | terminator blockAt pc terminatorAt classified =>
+      have original := classified.step blockAt pc terminatorAt
+      have noCall := directCall?_atTerminator blockAt pc
+      simpa only [Step, Eval.Step, step, noCall] using original
+
+theorem of_originalSteps {context : Context} {interpretation : Interpretation}
+    {count : Nat} {before after : Machine}
+    (original : Eval.Steps context interpretation count before after) :
+    Steps .suspendedCallsV1 context interpretation count before after := by
+  induction original with
+  | refl => exact .refl _
+  | cons running head tail ih => exact .cons running (of_originalStep head) ih
+
+theorem of_originalRun {context : Context} {interpretation : Interpretation}
+    {controlFuel : Nat} {machine : Machine} {result : Result}
+    (original : Eval.runMachine context interpretation controlFuel machine = .ok result) :
+    runMachine .suspendedCallsV1 context interpretation controlFuel machine = .ok result := by
+  obtain ⟨count, budget, steps⟩ := Eval.runMachine_steps original
+  rw [budget, (of_originalSteps steps).runMachine]
+  simp only [runMachine]
+
+theorem runFunction_eq_runMachine {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {definition : Function}
+    {arguments : Array RVal} {controlFuel heapFuel : Nat} {store : Store}
+    (arity : arguments.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    runFunction policy context interpretation definition arguments controlFuel heapFuel store =
+      runMachine policy context interpretation controlFuel
+        (initialMachine definition arguments heapFuel store) := by
+  simp [runFunction, enterFunction, arity, nonempty, bind, Except.bind]
+
+theorem runMain_eq_runMachine {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {program : Program} {controlFuel heapFuel : Nat}
+    (arity : program.main.signature.params.size = 0)
+    (nonempty : program.main.blocks.isEmpty = false) :
+    runMain policy context interpretation program controlFuel heapFuel =
+      runMachine policy context interpretation controlFuel
+        (initialMachine program.main #[] heapFuel) := by
+  apply runFunction_eq_runMachine
+  · simpa using arity.symm
+  · exact nonempty
+
+theorem Steps.cancelPrefixToHalted {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {prefixCount totalCount : Nat}
+    {before middle final : Machine} {store : Store} {heapFuel : Nat} {value : RVal}
+    (prefixSteps : Steps policy context interpretation prefixCount before middle)
+    (total : Steps policy context interpretation totalCount before final)
+    (halted : final = { store, heapFuel, control := .halted value }) :
+    ∃ suffixCount, totalCount = prefixCount + suffixCount ∧
+      Steps policy context interpretation suffixCount middle final := by
+  induction prefixSteps generalizing totalCount final with
+  | refl => exact ⟨totalCount, by simp, total⟩
+  | @cons prefixCount before prefixMiddle middle frame stack running head tail ih =>
+      cases total with
+      | refl =>
+          have controls : Control.running frame stack = .halted value := by
+            rw [← running]
+            exact congrArg Machine.control halted
+          contradiction
+      | cons totalRunning totalHead totalTail =>
+          have middleEq := head.deterministic totalHead
+          subst middleEq
+          obtain ⟨suffixCount, countEq, suffix⟩ := ih totalTail halted
+          exact ⟨suffixCount, by omega, suffix⟩
+
+end Ix.Compiler.IxIR2.Eval.Policy
diff --git a/Ix/Compiler/IxIR2/CallEvalFuel.lean b/Ix/Compiler/IxIR2/CallEvalFuel.lean
new file mode 100644
index 000000000..bc299b325
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallEvalFuel.lean
@@ -0,0 +1,60 @@
+import Ix.Compiler.IxIR2.CallEval
+import Ix.Compiler.IxIR2.EvalFuel
+
+/-! Successful policy executions have budget-independent values and stores. -/
+
+namespace Ix.Compiler.IxIR2.Eval.Policy
+
+theorem Step.addHeapFuel {policy : CreditPolicy} {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (stepped : Step policy context interpretation before after) (extra : Nat) :
+    Step policy context interpretation (before.addHeapFuel extra) (after.addHeapFuel extra) := by
+  cases policy with
+  | callLocalV0 => exact Eval.Step.addHeapFuel stepped extra
+  | suspendedCallsV1 =>
+      rcases stepped.classify with original | ⟨frame, stack, call, _, running, atCall, suspended⟩
+      · exact of_originalStep (original.addHeapFuel extra)
+      · obtain ⟨values, definition, resolved, found, arity, nonempty, rfl⟩ := suspendCall_iff.mp suspended
+        simp only [Step, step, Machine.addHeapFuel, running, atCall]
+        exact suspendCall_iff.mpr ⟨values, definition, resolved, found, arity, nonempty, rfl⟩
+
+theorem Steps.addHeapFuel {policy : CreditPolicy} {context : Context} {interpretation : Interpretation}
+    {count : Nat} {before after : Machine}
+    (steps : Steps policy context interpretation count before after) (extra : Nat) :
+    Steps policy context interpretation count (before.addHeapFuel extra) (after.addHeapFuel extra) := by
+  induction steps with
+  | refl => exact .refl _
+  | cons running head tail ih => exact .cons running (head.addHeapFuel extra) ih
+
+theorem Steps.halted_unique {policy : CreditPolicy} {context : Context} {interpretation : Interpretation}
+    {leftCount rightCount : Nat} {before : Machine}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat} {leftValue rightValue : RVal}
+    (left : Steps policy context interpretation leftCount before
+      { store := leftStore, heapFuel := leftFuel, control := .halted leftValue })
+    (right : Steps policy context interpretation rightCount before
+      { store := rightStore, heapFuel := rightFuel, control := .halted rightValue }) :
+    leftCount = rightCount ∧ leftStore = rightStore ∧ leftFuel = rightFuel ∧ leftValue = rightValue := by
+  obtain ⟨count, budget, suffix⟩ := left.cancelPrefixToHalted right rfl
+  cases suffix with
+  | refl => exact ⟨by omega, rfl, rfl, rfl⟩
+  | cons running => contradiction
+
+theorem runMain_success_unique {policy : CreditPolicy} {source : Program} {context : Context}
+    {interpretation : Interpretation} {leftControl rightControl leftHeap rightHeap : Nat}
+    {left right : Result} (arity : source.main.signature.params.size = 0)
+    (nonempty : source.main.blocks.isEmpty = false)
+    (leftRun : runMain policy context interpretation source leftControl leftHeap = .ok left)
+    (rightRun : runMain policy context interpretation source rightControl rightHeap = .ok right) :
+    left.store = right.store ∧ left.value = right.value := by
+  rw [runMain_eq_runMachine arity nonempty] at leftRun rightRun
+  obtain ⟨leftCount, _, leftSteps⟩ := runMachine_steps leftRun
+  obtain ⟨rightCount, _, rightSteps⟩ := runMachine_steps rightRun
+  have leftFunded := leftSteps.addHeapFuel rightHeap
+  have rightFunded := rightSteps.addHeapFuel leftHeap
+  have common : (initialMachine source.main #[] rightHeap).addHeapFuel leftHeap =
+      (initialMachine source.main #[] leftHeap).addHeapFuel rightHeap := by
+    simp [initialMachine, Machine.addHeapFuel, Nat.add_comm]
+  rw [common] at rightFunded
+  obtain ⟨_, stores, _, values⟩ := leftFunded.halted_unique rightFunded
+  exact ⟨stores, values⟩
+
+end Ix.Compiler.IxIR2.Eval.Policy
diff --git a/Ix/Compiler/IxIR2/CallResources.lean b/Ix/Compiler/IxIR2/CallResources.lean
new file mode 100644
index 000000000..4b4527b84
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallResources.lean
@@ -0,0 +1,107 @@
+import Ix.Compiler.IxIR2.CallEval
+import Ix.Compiler.IxIR2.Resources
+import Ix.Compiler.IxIR2.CostSteps
+import Ix.Compiler.IxIR2.EvalFuel
+
+/-!
+# Resources of executions with suspended credits
+
+Reservations held by every continuation already participate in the physical
+allocation balance. A direct call transfers that ownership to one saved frame
+without changing the heap or the total number of credits. Existing return,
+allocation, discard, and edge rules discharge the same balance. Cost and peak
+invariants therefore hold for every actual step of either versioned policy.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval.Policy
+
+theorem suspendCall_resources {context : Context} {before after : Machine}
+    {frame : Frame} {stack : List Continuation} {call : DirectCall}
+    (running : before.control = .running frame stack)
+    (called : suspendCall context before frame stack call = .ok after) :
+    after.store = before.store ∧ after.heapFuel = before.heapFuel ∧
+      after.presentCredits = before.presentCredits := by
+  obtain ⟨values, definition, _, _, _, _, rfl⟩ := suspendCall_iff.mp called
+  refine ⟨rfl, rfl, ?_⟩
+  cases before with
+  | mk store heapFuel control =>
+      simp only at running
+      subst control
+      simp [Machine.presentCredits_running, Frame.presentCredits,
+        Continuation.presentCredits]
+
+theorem Step.allocationAccounting {policy : CreditPolicy} {context : Context}
+    {before after : Machine} (stepped : Step policy context .physical before after)
+    (accounted : before.AllocationAccounting) : after.AllocationAccounting := by
+  rcases stepped.classify with original | ⟨frame, stack, call, _, running, _, called⟩
+  · exact original.allocationAccounting accounted
+  · obtain ⟨storeEq, _, creditsEq⟩ := suspendCall_resources running called
+    simpa only [Machine.AllocationAccounting, storeEq, creditsEq] using accounted
+
+theorem Steps.allocationAccounting {policy : CreditPolicy} {context : Context}
+    {count : Nat} {before after : Machine}
+    (steps : Steps policy context .physical count before after)
+    (accounted : before.AllocationAccounting) : after.AllocationAccounting := by
+  induction steps with
+  | refl => exact accounted
+  | cons running head tail ih => exact ih (head.allocationAccounting accounted)
+
+theorem runMachine_allocationAccounting {policy : CreditPolicy} {context : Context}
+    {controlFuel : Nat} {machine : Machine} {result : Result}
+    (run : runMachine policy context .physical controlFuel machine = .ok result)
+    (accounted : machine.AllocationAccounting) :
+    result.store.live + result.store.heap.frees = result.store.heap.allocs := by
+  obtain ⟨count, _, steps⟩ := runMachine_steps run
+  simpa [Machine.AllocationAccounting, Machine.presentCredits] using
+    steps.allocationAccounting accounted
+
+theorem runMain_allocationAccounting {policy : CreditPolicy} {context : Context}
+    {program : Program} {controlFuel heapFuel : Nat} {result : Result}
+    (arity : program.main.signature.params.size = 0)
+    (nonempty : program.main.blocks.isEmpty = false)
+    (run : runMain policy context .physical program controlFuel heapFuel = .ok result) :
+    result.store.live + result.store.heap.frees = result.store.heap.allocs := by
+  rw [runMain_eq_runMachine arity nonempty] at run
+  exact runMachine_allocationAccounting run (initialMachine_allocationAccounting ..)
+
+theorem Step.costs {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {before after : Machine}
+    (stepped : Step policy context interpretation before after) :
+    before.store.heap.rcops ≤ after.store.heap.rcops ∧
+      before.store.peakLiveNodes ≤ after.store.peakLiveNodes ∧
+      (before.store.live ≤ before.store.peakLiveNodes →
+        after.store.live ≤ after.store.peakLiveNodes) := by
+  rcases stepped.classify with original | ⟨frame, stack, call, _, running, _, called⟩
+  · exact ⟨original.rcops_mono, original.peakLive_mono, original.preservesPeakBound⟩
+  · have stores := (suspendCall_resources running called).1
+    simp only [stores]
+    exact ⟨Nat.le_refl _, Nat.le_refl _, id⟩
+
+theorem Steps.costs {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {count : Nat} {before after : Machine}
+    (steps : Steps policy context interpretation count before after) :
+    before.store.heap.rcops ≤ after.store.heap.rcops ∧
+      before.store.peakLiveNodes ≤ after.store.peakLiveNodes ∧
+      (before.store.live ≤ before.store.peakLiveNodes →
+        after.store.live ≤ after.store.peakLiveNodes) := by
+  induction steps with
+  | refl => exact ⟨Nat.le_refl _, Nat.le_refl _, id⟩
+  | cons running head tail ih =>
+      exact ⟨Nat.le_trans head.costs.1 ih.1,
+        Nat.le_trans head.costs.2.1 ih.2.1, ih.2.2 ∘ head.costs.2.2⟩
+
+theorem runMachine_prefix_costs {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {controlFuel prefixCount : Nat}
+    {initial middle : Machine} {result : Result}
+    (run : runMachine policy context interpretation controlFuel initial = .ok result)
+    (prefixSteps : Steps policy context interpretation prefixCount initial middle)
+    (initialPeak : initial.store.live ≤ initial.store.peakLiveNodes) :
+    middle.store.heap.rcops ≤ result.store.heap.rcops ∧
+      middle.store.peakLiveNodes ≤ result.store.peakLiveNodes ∧
+      middle.store.live ≤ result.store.peakLiveNodes := by
+  obtain ⟨count, _, execution⟩ := runMachine_steps run
+  obtain ⟨suffixCount, _, suffix⟩ := prefixSteps.cancelPrefixToHalted execution rfl
+  exact ⟨suffix.costs.1, suffix.costs.2.1,
+    Nat.le_trans (prefixSteps.costs.2.2 initialPeak) suffix.costs.2.1⟩
+
+end Ix.Compiler.IxIR2.Eval.Policy
diff --git a/Ix/Compiler/IxIR2/CallReuse.lean b/Ix/Compiler/IxIR2/CallReuse.lean
new file mode 100644
index 000000000..baf8f58b7
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuse.lean
@@ -0,0 +1,280 @@
+import Ix.Compiler.IxIR2.Reuse
+import Ix.Compiler.IxIR2.CallEval
+import Ix.Compiler.IxIR2.CreditFree
+
+/-!
+# Checked shared reuse across direct calls
+
+The v1 pass recognizes a consuming constructor prefix followed by a nonempty
+straight-line sequence of direct calls, an allocation, and a return. Reset
+exposes the owned fields; moves retain the original result-register numbering.
+The optional credit stays in the caller until the matching allocation. Every
+accepted site retains exact syntax, last-use, and representation evidence.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse
+
+open Ix.Compiler.Ixon (Address)
+
+def policy : CreditPolicy := .suspendedCallsV1
+
+def policyTag : String := "shared-call-reuse/1"
+
+/-- Structural source facts used by the executable simulation. The ordinary
+compiler produces this subset; unsupported checked input uses the baseline. -/
+def functionReady (definition : Function) : Bool :=
+  CreditFree.function definition &&
+    definition.blocks.all (fun block => block.creditParams.isEmpty) &&
+    match definition.blocks[0]? with
+    | none => false
+    | some entry => entry.valueParams.size == definition.signature.params.size
+
+def programReady (source : Program) : Bool :=
+  functionReady source.main && source.declarations.all (fun (_, declaration) =>
+    match declaration with
+    | .fn definition => functionReady definition
+    | .extern _ => true)
+
+theorem functionReady_creditFree {definition : Function}
+    (ready : functionReady definition = true) : CreditFree.function definition = true := by
+  simp only [functionReady, Bool.and_eq_true] at ready
+  exact ready.1.1
+
+theorem functionReady_entry {definition : Function} {entry : Block}
+    (ready : functionReady definition = true) (found : definition.blocks[0]? = some entry) :
+    entry.valueParams.size = definition.signature.params.size := by
+  simp only [functionReady, Bool.and_eq_true] at ready
+  have checked := ready.2
+  simpa only [found, beq_iff_eq] using checked
+
+theorem functionReady_credits {definition : Function} {block : Block} {blockId : Nat}
+    (ready : functionReady definition = true) (found : definition.blocks[blockId]? = some block) :
+    block.creditParams = #[] := by
+  simp only [functionReady, Bool.and_eq_true] at ready
+  have checked := ready.1.2
+  obtain ⟨bound, atBlock⟩ := Array.getElem?_eq_some_iff.mp found
+  have empty := Array.all_eq_true.mp checked blockId bound
+  simpa only [atBlock, Array.isEmpty_iff] using empty
+
+structure Shape where
+  valueParams : Array ValueCap
+  source : ValueId
+  sourceConstructor : CtorId
+  fieldCount : Nat
+  calls : Array Instr
+  allocationConstructor : CtorId
+  allocationArguments : Array Atom
+  result : Atom
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def Shape.fetches (shape : Shape) : Array Instr :=
+  (List.range shape.fieldCount).toArray.map fun field =>
+    .fetch (.reg shape.source) shape.sourceConstructor field
+
+def Shape.retains (shape : Shape) : Array Instr :=
+  (List.range shape.fieldCount).toArray.map fun field =>
+    .retainShared (.reg (shape.valueParams.size + field))
+
+def Shape.moves (shape : Shape) : Array Instr :=
+  (List.range shape.fieldCount).toArray.map fun field =>
+    .move (.reg (shape.valueParams.size + field))
+
+def Shape.baseline (shape : Shape) : Block :=
+  { valueParams := shape.valueParams
+    creditParams := #[]
+    instructions := shape.fetches ++ shape.retains ++
+      #[.releaseShared (.reg shape.source)] ++ shape.calls ++
+      #[.alloc .shared shape.allocationConstructor shape.allocationArguments]
+    terminator := .ret shape.result }
+
+def Shape.target (shape : Shape) : Block :=
+  { valueParams := shape.valueParams
+    creditParams := #[]
+    instructions := #[.resetShared (.reg shape.source) shape.sourceConstructor] ++
+      shape.moves ++ shape.calls ++
+      #[.allocWith 0 .shared shape.allocationConstructor shape.allocationArguments]
+    terminator := .ret shape.result }
+
+/-- Reuse the established exact-layout checker, independently of its v0
+tail-call shape recognizer. -/
+def Shape.layoutInput (shape : Shape) : Reuse.Shape :=
+  { parameterCount := shape.valueParams.size
+    source := shape.source
+    sourceConstructor := shape.sourceConstructor
+    fieldCount := shape.fieldCount
+    releasePosition := 2 * shape.fieldCount
+    allocationConstructor := shape.allocationConstructor
+    allocationArguments := shape.allocationArguments
+    tailArguments := #[] }
+
+def propose? (block : Block) : Option Shape := do
+  let .fetch (.reg source) sourceConstructor 0 ← block.instructions[0]? | none
+  let release ← block.instructions.findIdx? fun instruction =>
+    instruction == .releaseShared (.reg source)
+  let fieldCount := release / 2
+  let .alloc .shared allocationConstructor allocationArguments ← block.instructions.back? | none
+  let .ret result := block.terminator | none
+  return {
+    valueParams := block.valueParams, source, sourceConstructor, fieldCount
+    calls := block.instructions.extract (release + 1) (block.instructions.size - 1)
+    allocationConstructor, allocationArguments, result }
+
+structure Site (limits : Validate.Limits) (context : Validate.Context) (block : Block) where
+  shape : Shape
+  exact : block = shape.baseline
+  fieldsPositive : 0 < shape.fieldCount
+  sourceOwned : shape.valueParams[shape.source]? = some (.owned .shared)
+  callsNonempty : shape.calls.isEmpty = false
+  directCalls : shape.calls.all (Eval.Policy.DirectCall.ofInstruction? · |>.isSome) = true
+  placement : Reuse.Placement block
+  placementProduced : Reuse.inferPlacementWith limits block shape.source
+    (2 * shape.fieldCount) = .ok (some placement)
+  representation : Reuse.Representation
+  representationProduced : Reuse.representation? context shape.layoutInput = some representation
+
+def inspect (limits : Validate.Limits) (context : Validate.Context) (block : Block) :
+    Option (Site limits context block) := do
+  let shape ← propose? block
+  if exact : block = shape.baseline then
+    if fieldsPositive : 0 < shape.fieldCount then
+      if sourceOwned : shape.valueParams[shape.source]? = some (.owned .shared) then
+        if callsNonempty : shape.calls.isEmpty = false then
+          if directCalls : shape.calls.all
+              (Eval.Policy.DirectCall.ofInstruction? · |>.isSome) = true then
+            match placed : Reuse.inferPlacementWith limits block shape.source
+                (2 * shape.fieldCount) with
+            | .ok (some placement) =>
+                match represented : Reuse.representation? context shape.layoutInput with
+                | some representation => some {
+                    shape, exact, fieldsPositive, sourceOwned, callsNonempty, directCalls
+                    placement, placementProduced := placed
+                    representation, representationProduced := represented }
+                | none => none
+            | _ => none
+          else none
+        else none
+      else none
+    else none
+  else none
+
+inductive Decision (limits : Validate.Limits) (context : Validate.Context) (block : Block) where
+  | unchanged (rejected : inspect limits context block = none)
+  | accepted (site : Site limits context block)
+      (produced : inspect limits context block = some site)
+
+def decideBlock (limits : Validate.Limits) (context : Validate.Context) (block : Block) :
+    Decision limits context block :=
+  match produced : inspect limits context block with
+  | none => .unchanged produced
+  | some site => .accepted site produced
+
+def Decision.target {limits : Validate.Limits} {context : Validate.Context} {block : Block} :
+    Decision limits context block → Block
+  | .unchanged _ => block
+  | .accepted site _ => site.shape.target
+
+def rewriteBlock (limits : Validate.Limits) (context : Validate.Context) (block : Block) : Block :=
+  (decideBlock limits context block).target
+
+def rewriteFunction (limits : Validate.Limits) (context : Validate.Context)
+    (definition : Function) : Function :=
+  { definition with blocks := definition.blocks.map (rewriteBlock limits context) }
+
+def rewriteProgram (limits : Validate.Limits) (context : Validate.Context) (source : Program) : Program :=
+  { declarations := source.declarations.map fun (address, declaration) =>
+      (address, match declaration with
+        | .fn definition => .fn (rewriteFunction limits context definition)
+        | .extern arity => .extern arity)
+    main := rewriteFunction limits context source.main }
+
+structure Report where
+  scannedBlocks : Nat := 0
+  rewritten : Nat := 0
+  suspendedCallSites : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def reportBlock (limits : Validate.Limits) (context : Validate.Context)
+    (report : Report) (block : Block) : Report :=
+  match inspect limits context block with
+  | none => { report with scannedBlocks := report.scannedBlocks + 1 }
+  | some site =>
+      { scannedBlocks := report.scannedBlocks + 1
+        rewritten := report.rewritten + 1
+        suspendedCallSites := report.suspendedCallSites + site.shape.calls.size }
+
+def report (limits : Validate.Limits) (context : Validate.Context) (source : Program) : Report :=
+  let declarations := source.declarations.foldl (fun current (_, declaration) =>
+    match declaration with
+    | .extern _ => current
+    | .fn definition => definition.blocks.foldl (reportBlock limits context) current) {}
+  source.main.blocks.foldl (reportBlock limits context) declarations
+
+structure Output (limits : Validate.Limits) (context : Validate.Context) (source : Program) where
+  sourceChecked : Validate.Checked limits context source
+  sourceReady : programReady source = true
+  targetChecked : Validate.CheckedWithPolicy policy limits context
+    (rewriteProgram limits context source)
+
+def Output.target {limits : Validate.Limits} {context : Validate.Context} {source : Program}
+    (_output : Output limits context source) : Program := rewriteProgram limits context source
+
+inductive Error where
+  | invalidSource (error : Validate.Error)
+  | unsupportedSource
+  | invalidTarget (error : Validate.Error)
+  deriving Repr
+
+def optimizeWith (limits : Validate.Limits) (context : Validate.Context) (source : Program) :
+    Except Error (Output limits context source) :=
+  match sourceAccepted : Validate.validateWith limits context source with
+  | .error error => .error (.invalidSource error)
+  | .ok sourceStats =>
+      if sourceReady : programReady source = true then
+        match targetAccepted : Validate.validateWithPolicy policy limits context
+            (rewriteProgram limits context source) with
+        | .error error => .error (.invalidTarget error)
+        | .ok targetStats => .ok {
+            sourceChecked := ⟨sourceStats, sourceAccepted⟩
+            sourceReady
+            targetChecked := ⟨targetStats, targetAccepted⟩ }
+      else .error .unsupportedSource
+
+inductive Selection (limits : Validate.Limits) (context : Validate.Context) (source : Program) where
+  | optimized (output : Output limits context source)
+      (produced : optimizeWith limits context source = .ok output)
+  | baseline (checked : Validate.Checked limits context source) (error : Error)
+      (rejected : optimizeWith limits context source = .error error)
+
+def Selection.target {limits : Validate.Limits} {context : Validate.Context} {source : Program} :
+    Selection limits context source → Program
+  | .optimized output _ => output.target
+  | .baseline _ _ _ => source
+
+def Selection.policy {limits : Validate.Limits} {context : Validate.Context} {source : Program} :
+    Selection limits context source → CreditPolicy
+  | .optimized _ _ => CallReuse.policy
+  | .baseline _ _ _ => .callLocalV0
+
+def selectChecked (limits : Validate.Limits) (context : Validate.Context) (source : Program)
+    (checked : Validate.Checked limits context source) : Selection limits context source :=
+  match produced : optimizeWith limits context source with
+  | .ok output => .optimized output produced
+  | .error error => .baseline checked error produced
+
+theorem Selection.valid {limits : Validate.Limits} {context : Validate.Context} {source : Program}
+    (selection : Selection limits context source) :
+    ∃ stats, Validate.validateWithPolicy selection.policy limits context selection.target = .ok stats := by
+  cases selection with
+  | optimized output produced => exact ⟨output.targetChecked.stats, output.targetChecked.accepted⟩
+  | baseline checked error rejected => exact ⟨checked.stats, checked.accepted⟩
+
+theorem rewriteFunction_signature (limits : Validate.Limits) (context : Validate.Context)
+    (definition : Function) :
+    (rewriteFunction limits context definition).signature = definition.signature := rfl
+
+theorem rewriteFunction_blockCount (limits : Validate.Limits) (context : Validate.Context)
+    (definition : Function) :
+    (rewriteFunction limits context definition).blocks.size = definition.blocks.size := by
+  simp [rewriteFunction]
+
+end Ix.Compiler.IxIR2.CallReuse
diff --git a/Ix/Compiler/IxIR2/CallReuseApply.lean b/Ix/Compiler/IxIR2/CallReuseApply.lean
new file mode 100644
index 000000000..e4ecf4490
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseApply.lean
@@ -0,0 +1,147 @@
+import Ix.Compiler.IxIR2.CallReuseTransition
+
+/-! Complete partial and residual application under a growing history map. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso NodeBoxIso)
+
+structure TransferRel (limits : Validate.Limits) (validation : Validate.Context)
+    (context : Context) (before after : Array Nat) (leftBefore rightBefore : Store)
+    (leftAfter rightAfter : Machine) : Prop where
+  transition : HeapTransition context before after leftBefore leftAfter.store rightBefore rightAfter.store
+  fuel : leftAfter.heapFuel ≤ rightAfter.heapFuel
+  control : ControlRel limits validation after leftAfter.control rightAfter.control
+
+theorem HeapMap.papView {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {l r : Nat} {box : NodeBox}
+    {address : Ixon.Address} {arity : Nat} {captured : Array RVal}
+    (mapped : MapRel mapping l r) (found : left.get? l = some box)
+    (node : box.node = .papN address arity captured) :
+    ∃ targetBox targetCaptured,
+      right.get? r = some targetBox ∧ NodeBoxIso (MapRel mapping) box targetBox ∧
+      targetBox.node = .papN address arity targetCaptured ∧
+      RValsIso (MapRel mapping) captured.toList targetCaptured.toList := by
+  obtain ⟨targetBox, targetAt, boxes⟩ := heap.forward mapped found
+  have nodes := boxes.node
+  rw [node] at nodes
+  cases targetNode : targetBox.node with
+  | ctorN cid fields => rw [targetNode] at nodes; cases nodes
+  | papN targetAddress targetArity targetCaptured =>
+      rw [targetNode] at nodes
+      cases nodes with
+      | pap captured => exact ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, captured⟩
+
+theorem apply_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {leftFunction rightFunction : RVal} {leftArguments rightArguments : Array RVal}
+    {block : Block} {leftResume rightResume : Frame} {leftStack rightStack : List Continuation}
+    {leftAfter : Machine}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext)
+    (state : HeapState leftContext mapping leftStore rightStore) (fuel : leftFuel ≤ rightFuel)
+    (function : RValIso (MapRel mapping) leftFunction rightFunction)
+    (arguments : RValsIso (MapRel mapping) leftArguments.toList rightArguments.toList)
+    (resume : FrameRel limits validation mapping block leftResume rightResume)
+    (positive : 0 < leftResume.pc) (stack : StackRel limits validation mapping leftStack rightStack)
+    (transferred : ApplyTransfer leftContext .physical leftStore leftFuel leftFunction
+      leftArguments leftResume leftStack leftAfter) :
+    ∃ after rightAfter,
+      ApplyTransfer rightContext .physical rightStore rightFuel rightFunction
+        rightArguments rightResume rightStack rightAfter ∧
+      TransferRel limits validation leftContext mapping after leftStore rightStore leftAfter rightAfter := by
+  cases transferred.classify with
+  | erased released =>
+      cases function
+      obtain ⟨rightOut, rightRemaining, targetRun, remaining, transition⟩ :=
+        state.releaseWork fuel arguments released
+      exact ⟨mapping, _, ApplyTransfer.erased targetRun,
+        ⟨transition, remaining, .running (resume.pushResult positive .erased) stack⟩⟩
+  | @papUnder location box address arity captured retainedStore releasedStore outHeapFuel
+      found shared node capturedUnder retained released totalUnder =>
+      cases function with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, capturedRel⟩ :=
+            state.heap.papView mapped found node
+          obtain ⟨targetRetained, targetRetain, retaining⟩ := state.retainMany capturedRel retained
+          obtain ⟨targetReleased, targetFuel, targetRelease, remaining, releasing⟩ :=
+            retaining.state.releaseWork fuel (.cons (.loc mapped) .nil) released
+          have total : RValsIso (MapRel mapping) (captured ++ leftArguments).toList
+              (targetCaptured ++ rightArguments).toList := by
+            simpa only [Array.toList_append] using capturedRel.append arguments
+          have allocating := releasing.state.alloc (world := .shared)
+            (leftNode := .papN address arity (captured ++ leftArguments)) (.pap total) trivial
+          have moved := (retaining.trans releasing).trans allocating
+          have newValue : RValIso (MapRel (mapping.push targetReleased.heap.nodes.size))
+              (.loc releasedStore.heap.nodes.size) (.loc targetReleased.heap.nodes.size) :=
+            .loc (by rw [← releasing.state.heap.size]; exact MapRel.fresh ..)
+          refine ⟨_, _, ApplyTransfer.papUnder targetAt (boxes.world.symm.trans shared)
+            targetNode (by rw [← values_size capturedRel]; exact capturedUnder)
+            targetRetain targetRelease (by rw [← values_size total]; exact totalUnder),
+            ⟨moved, remaining, .running (sourceBlock := block) ?_ (stack.mono allocating.extension)⟩⟩
+          exact (resume.mono allocating.extension).pushResult positive newValue
+  | @papFn location box address arity captured retainedStore releasedStore outHeapFuel definition
+      found shared node capturedUnder retained released totalEnough declaration papSafe suppliedArity nonempty =>
+      cases function with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, capturedRel⟩ :=
+            state.heap.papView mapped found node
+          obtain ⟨targetRetained, targetRetain, retaining⟩ := state.retainMany capturedRel retained
+          obtain ⟨targetReleased, targetFuel, targetRelease, remainingFuel, releasing⟩ :=
+            retaining.state.releaseWork fuel (.cons (.loc mapped) .nil) released
+          have total : RValsIso (MapRel mapping) (captured ++ leftArguments).toList
+              (targetCaptured ++ rightArguments).toList := by
+            simpa only [Array.toList_append] using capturedRel.append arguments
+          have supplied := values_extract total 0 arity
+          have residual : RValsIso (MapRel mapping)
+              ((captured ++ leftArguments).extract arity (captured ++ leftArguments).size).toList
+              ((targetCaptured ++ rightArguments).extract arity
+                (targetCaptured ++ rightArguments).size).toList := by
+            simpa only [values_size total] using values_extract total arity (captured ++ leftArguments).size
+          obtain ⟨entryBlock, entry⟩ := FrameRel.functionEntry (limits := limits)
+            (validation := validation) (readyContext declaration) supplied suppliedArity
+          have empty : ((captured ++ leftArguments).extract arity (captured ++ leftArguments).size).isEmpty =
+              ((targetCaptured ++ rightArguments).extract arity
+                (targetCaptured ++ rightArguments).size).isEmpty := by
+            simp only [Array.isEmpty, values_size residual]
+          refine ⟨mapping, _, ApplyTransfer.papFn targetAt (boxes.world.symm.trans shared)
+            targetNode (by rw [← values_size capturedRel]; exact capturedUnder)
+            targetRetain targetRelease (by rw [← values_size total]; exact totalEnough)
+            (contexts.function declaration) papSafe
+            (by simpa only [rewriteFunction_signature, ← values_size supplied] using suppliedArity)
+            (rewriteFunction_nonempty nonempty),
+            ⟨retaining.trans releasing, remainingFuel, .running entry (.cons ?_ stack)⟩⟩
+          rw [empty]
+          split
+          · exact .resume resume positive
+          · exact .applyMore resume positive residual
+  | @papExtern location box address arity expectedArity captured retainedStore releasedStore outHeapFuel value
+      found shared node capturedUnder retained released totalEnough declaration suppliedArity remainingEmpty called =>
+      cases function with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, capturedRel⟩ :=
+            state.heap.papView mapped found node
+          obtain ⟨targetRetained, targetRetain, retaining⟩ := state.retainMany capturedRel retained
+          obtain ⟨targetReleased, targetFuel, targetRelease, remainingFuel, releasing⟩ :=
+            retaining.state.releaseWork fuel (.cons (.loc mapped) .nil) released
+          have total : RValsIso (MapRel mapping) (captured ++ leftArguments).toList
+              (targetCaptured ++ rightArguments).toList := by
+            simpa only [Array.toList_append] using capturedRel.append arguments
+          have supplied := values_extract total 0 arity
+          have residual : RValsIso (MapRel mapping)
+              ((captured ++ leftArguments).extract arity (captured ++ leftArguments).size).toList
+              ((targetCaptured ++ rightArguments).extract arity
+                (targetCaptured ++ rightArguments).size).toList := by
+            simpa only [values_size total] using values_extract total arity (captured ++ leftArguments).size
+          obtain ⟨targetCalled, valueRel⟩ := scalarOracle_related contexts supplied called
+          refine ⟨mapping, _, ApplyTransfer.papExtern targetAt (boxes.world.symm.trans shared)
+            targetNode (by rw [← values_size capturedRel]; exact capturedUnder)
+            targetRetain targetRelease (by rw [← values_size total]; exact totalEnough)
+            (contexts.extern declaration) (by rw [← values_size supplied]; exact suppliedArity)
+            (by simpa only [Array.isEmpty_iff_size_eq_zero, values_size residual] using remainingEmpty)
+            targetCalled,
+            ⟨retaining.trans releasing, remainingFuel, .running (resume.pushResult positive valueRel) stack⟩⟩
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseBody.lean b/Ix/Compiler/IxIR2/CallReuseBody.lean
new file mode 100644
index 000000000..e218112d2
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseBody.lean
@@ -0,0 +1,137 @@
+import Ix.Compiler.IxIR2.CallReuseShape
+
+/-! Suspended calls and the allocation that consumes the caller's optional credit. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+
+theorem callInstruction_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {block targetBlock : Block} {leftFrame rightFrame : Frame}
+    {leftStack rightStack : List Continuation} {call : Policy.DirectCall} {leftAfter : Machine}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext)
+    (machines : MachineRel limits validation leftContext mapping
+      { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack }
+      { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack })
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (advanced : FrameRel limits validation mapping block
+      { leftFrame with pc := leftFrame.pc + 1 } { rightFrame with pc := rightFrame.pc + 1 })
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (targetAt : rightFrame.definition.blocks[rightFrame.block]? = some targetBlock)
+    (targetPC : rightFrame.pc < targetBlock.instructions.size)
+    (targetInstruction : targetBlock.instructions[rightFrame.pc] = call.instruction)
+    (classified : InstructionTransferCase leftContext .physical leftStore leftFuel
+      leftFrame leftStack call.instruction leftAfter) :
+    ∃ rightAfter,
+      Policy.Step .suspendedCallsV1 rightContext .physical
+        { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } rightAfter ∧
+      TransferRel limits validation leftContext mapping mapping leftStore rightStore leftAfter rightAfter := by
+  cases call with
+  | function address arguments =>
+      cases classified with
+      | callFn noCredits resolved declaration arity nonempty =>
+          obtain ⟨target, stepped, related, _, targetStore⟩ := directCall_related contexts readyContext machines
+            frames advanced stack targetAt targetPC targetInstruction resolved
+            (by simp [Policy.DirectCall.definition, declaration]) arity nonempty
+          exact ⟨target, stepped, ⟨by simpa only [targetStore] using HeapTransition.refl machines.heapState,
+            related.fuel, related.control⟩⟩
+  | self arguments =>
+      cases classified with
+      | callSelf noCredits resolved arity nonempty =>
+          obtain ⟨target, stepped, related, _, targetStore⟩ := directCall_related contexts readyContext machines
+            frames advanced stack targetAt targetPC targetInstruction resolved rfl arity nonempty
+          exact ⟨target, stepped, ⟨by simpa only [targetStore] using HeapTransition.refl machines.heapState,
+            related.fuel, related.control⟩⟩
+
+theorem bodyAllocation_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {block : Block} {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {site : Site limits validation block} {credit : Credit} {leftAfter : Machine}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (schemas : leftContext.schemas = validation.schemas)
+    (machines : MachineRel limits validation leftContext mapping
+      { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack }
+      { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack })
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (produced : inspect limits validation block = some site)
+    (leftPC : leftFrame.pc = 2 * site.shape.fieldCount + 1 + site.shape.calls.size)
+    (rightPC : rightFrame.pc = site.shape.fieldCount + 1 + site.shape.calls.size)
+    (credits : rightFrame.credits = #[some credit])
+    (layout : credit.layout = site.representation.layout) (physical : PhysicalCredit credit)
+    (classified : InstructionTransferCase leftContext .physical leftStore leftFuel leftFrame leftStack
+      (.alloc .shared site.shape.allocationConstructor site.shape.allocationArguments) leftAfter) :
+    ∃ after rightAfter,
+      Policy.Step .suspendedCallsV1 rightContext .physical
+        { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } rightAfter ∧
+      TransferRel limits validation leftContext mapping after leftStore rightStore leftAfter rightAfter := by
+  cases classified with
+  | @alloc _ _ _ schema values schemaAt resolved fields =>
+      obtain ⟨sourceSchema, allocationSchema, _, allocationAt, _, _, _, allocationLayout⟩ := site.schemas
+      have schemaSame : schema = allocationSchema := by
+        rw [← schemas, schemaAt] at allocationAt
+        exact Option.some.inj allocationAt
+      subst allocationSchema
+      have creditLayout := layout.trans allocationLayout
+      have targetSchema : rightContext.schemas .shared site.shape.allocationConstructor = some schema := by
+        rw [← contexts.schemas]
+        exact schemaAt
+      obtain ⟨targetValues, targetResolved, valuesRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+      have targetFields := machines.heap.fieldWorlds valuesRel fields
+      have taken : CreditTake { rightFrame with pc := rightFrame.pc + 1 } 0
+          { rightFrame with pc := rightFrame.pc + 1, credits := #[none] } credit := by
+        have atCredit : ({ rightFrame with pc := rightFrame.pc + 1 } : Frame).credits[0]? =
+            some (some credit) := by simp [credits]
+        simpa [credits, Array.setIfInBounds] using CreditTake.of_lookup (CreditLookup.of_getElem atCredit)
+      have finished := frames.finishBody produced leftPC rightPC
+      have positive : 0 < ({ leftFrame with pc := leftFrame.pc + 1 } : Frame).pc := by simp
+      have targetAt : rightFrame.definition.blocks[rightFrame.block]? = some site.shape.target := by
+        simpa only [rewriteBlock_accepted produced] using frames.targetAt
+      have targetFound : site.shape.target.instructions[rightFrame.pc]? =
+          some (.allocWith 0 .shared site.shape.allocationConstructor site.shape.allocationArguments) := by
+        rw [rightPC]
+        exact site.shape.target_alloc_at
+      obtain ⟨targetPC, targetInstruction⟩ := Array.getElem?_eq_some_iff.mp targetFound
+      rcases physical with absent | ⟨location, present⟩
+      · have allocating := machines.heapState.alloc (world := .shared)
+          (leftNode := .ctorN site.shape.allocationConstructor values) (.ctor valuesRel)
+          ⟨schema, schemaAt, fields.size⟩
+        have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+            (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+          .loc (by rw [← machines.heap.size]; exact MapRel.fresh ..)
+        have targetCase := InstructionTransferCase.allocWithAbsent
+          (context := rightContext) (interpretation := .physical) (heapFuel := rightFuel)
+          (stack := rightStack) targetSchema targetResolved targetFields taken creditLayout absent
+        exact ⟨_, _, Policy.of_originalStep (targetCase.step targetAt targetPC targetInstruction),
+          ⟨allocating, machines.fuel,
+            .running ((finished.mono allocating.extension).pushResult positive valueRel)
+              (stack.mono allocating.extension)⟩⟩
+      · have empty : rightStore.EmptySlot location := machines.reservations.empty location (by
+          simp [Machine.reservations, Frame.reservations, Frame.liveCredits, credits,
+            Credit.reservation?, present])
+        have succeeds : ∃ output, rightStore.reuseReservation location .shared
+            (.ctorN site.shape.allocationConstructor targetValues) schema.fields.size = .ok output := by
+          change rightStore.heap.nodes[location]? = some none at empty
+          simp only [Store.reuseReservation, empty]
+          exact ⟨_, rfl⟩
+        obtain ⟨output, reused⟩ := succeeds
+        have allocating := machines.heapState.reuse
+          (leftNode := .ctorN site.shape.allocationConstructor values) (.ctor valuesRel)
+          ⟨schema, schemaAt, fields.size⟩ reused
+        have valueRel : RValIso (MapRel (mapping.push location))
+            (.loc leftStore.heap.nodes.size) (.loc location) :=
+          .loc (by rw [← machines.heap.size]; exact MapRel.fresh ..)
+        have targetCase := InstructionTransferCase.allocWithPhysical
+          (context := rightContext) (heapFuel := rightFuel) (stack := rightStack) rfl
+          targetSchema targetResolved targetFields taken creditLayout present reused
+        exact ⟨_, _, Policy.of_originalStep (targetCase.step targetAt targetPC targetInstruction),
+          ⟨allocating, machines.fuel,
+            .running ((finished.mono allocating.extension).pushResult positive valueRel)
+              (stack.mono allocating.extension)⟩⟩
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseCalls.lean b/Ix/Compiler/IxIR2/CallReuseCalls.lean
new file mode 100644
index 000000000..9f7fb9451
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseCalls.lean
@@ -0,0 +1,71 @@
+import Ix.Compiler.IxIR2.CallReuseControl
+
+/-!
+# Corresponding calls with suspended caller credits
+
+The callee receives related ordinary arguments and an empty credit file.
+The complete caller relation, including its pending credit and next program
+counter, is stored once in the continuation. Heap and cost state is unchanged.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValsIso)
+
+theorem directCall_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {block targetBlock : Block} {leftFrame rightFrame : Frame}
+    {leftStack rightStack : List Continuation} {call : Policy.DirectCall}
+    {arguments : Array RVal} {definition : Function}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext)
+    (machines : MachineRel limits validation leftContext mapping
+      { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack }
+      { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack })
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (advanced : FrameRel limits validation mapping block
+      { leftFrame with pc := leftFrame.pc + 1 } { rightFrame with pc := rightFrame.pc + 1 })
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (targetAt : rightFrame.definition.blocks[rightFrame.block]? = some targetBlock)
+    (targetPC : rightFrame.pc < targetBlock.instructions.size)
+    (targetInstruction : targetBlock.instructions[rightFrame.pc] = call.instruction)
+    (resolved : resolveAtoms leftFrame.values call.arguments = .ok arguments)
+    (found : call.definition leftContext leftFrame = .ok definition)
+    (arity : arguments.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    ∃ target,
+      Policy.Step .suspendedCallsV1 rightContext .physical
+        { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } target ∧
+      MachineRel limits validation leftContext mapping
+        { store := leftStore, heapFuel := leftFuel
+          control := .running { definition, values := arguments }
+            (.resume { leftFrame with pc := leftFrame.pc + 1 } :: leftStack) } target ∧
+      CostDelta leftStore leftStore rightStore target.store ∧ target.store = rightStore := by
+  obtain ⟨targetArguments, targetResolved, argumentsRelated⟩ :=
+    ReuseSim.resolveAtoms_iso frames.values resolved
+  have targetDefinition := directCall_definition contexts frames found
+  have definitionReady := directCall_ready readyContext frames.ready found
+  have sizes : arguments.size = targetArguments.size := by simpa using argumentsRelated.lengths
+  have targetArity : targetArguments.size =
+      (rewriteFunction limits validation definition).signature.params.size := by
+    simpa only [rewriteFunction_signature] using sizes.symm.trans arity
+  have targetNonempty := rewriteFunction_nonempty (limits := limits) (context := validation) nonempty
+  obtain ⟨entryBlock, entryFrames⟩ := FrameRel.functionEntry
+    (limits := limits) (validation := validation) definitionReady argumentsRelated arity
+  let target : Machine :=
+    { store := rightStore, heapFuel := rightFuel
+      control := .running
+        { definition := rewriteFunction limits validation definition, values := targetArguments }
+        (.resume { rightFrame with pc := rightFrame.pc + 1 } :: rightStack) }
+  have stepped : Policy.Step .suspendedCallsV1 rightContext .physical
+      { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } target :=
+    directCall_step rfl targetAt targetPC targetInstruction targetResolved
+      targetDefinition targetArity targetNonempty
+  refine ⟨target, stepped, ?_, .refl leftStore rightStore, rfl⟩
+  exact ⟨machines.heap, machines.ordered, machines.shaped, machines.fuel,
+    .running entryFrames (.cons (.resume advanced (by simp)) stack),
+    stepped.reservationOwnership machines.reservations⟩
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseControl.lean b/Ix/Compiler/IxIR2/CallReuseControl.lean
new file mode 100644
index 000000000..0a5b7464d
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseControl.lean
@@ -0,0 +1,370 @@
+import Ix.Compiler.IxIR2.CallReuse
+import Ix.Compiler.IxIR2.CallReuseHeapShape
+import Ix.Compiler.IxIR2.ReservationSteps
+
+/-!
+# Compiler control correspondence for suspended reuse
+
+The pass preserves declaration addresses, block identities, and all register
+numbers after its consuming prefix. A saved caller records its exact position
+and optional credit until the matching allocation. Allocation history extends
+all saved value correspondences without changing this control evidence.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse
+
+theorem rewriteBlock_valueParams (limits : Validate.Limits) (context : Validate.Context)
+    (block : Block) : (rewriteBlock limits context block).valueParams = block.valueParams := by
+  unfold rewriteBlock
+  cases decideBlock limits context block with
+  | unchanged => rfl
+  | accepted site produced => simp only [Decision.target, Shape.target, site.exact, Shape.baseline]
+
+theorem rewriteBlock_creditParams (limits : Validate.Limits) (context : Validate.Context)
+    (block : Block) : (rewriteBlock limits context block).creditParams = block.creditParams := by
+  unfold rewriteBlock
+  cases decideBlock limits context block with
+  | unchanged => rfl
+  | accepted site produced => simp only [Decision.target, Shape.target, site.exact, Shape.baseline]
+
+theorem rewriteBlock_rejected {limits : Validate.Limits} {context : Validate.Context} {block : Block}
+    (rejected : inspect limits context block = none) : rewriteBlock limits context block = block := by
+  unfold rewriteBlock decideBlock
+  split
+  · rfl
+  · rename_i site found
+    rw [rejected] at found
+    cases found
+
+theorem rewriteBlock_accepted {limits : Validate.Limits} {context : Validate.Context} {block : Block}
+    {site : Site limits context block} (produced : inspect limits context block = some site) :
+    rewriteBlock limits context block = site.shape.target := by
+  unfold rewriteBlock decideBlock
+  split
+  · rename_i missing
+    rw [produced] at missing
+    cases missing
+  · rename_i foundSite found
+    have same := Option.some.inj (found.symm.trans produced)
+    subst foundSite
+    rfl
+
+theorem rewriteFunction_block {limits : Validate.Limits} {context : Validate.Context}
+    {definition : Function} {block : Block} {blockId : Nat}
+    (found : definition.blocks[blockId]? = some block) :
+    (rewriteFunction limits context definition).blocks[blockId]? =
+      some (rewriteBlock limits context block) := by
+  simp [rewriteFunction, Array.getElem?_map, found]
+
+theorem rewriteFunction_nonempty {limits : Validate.Limits} {context : Validate.Context}
+    {definition : Function} (nonempty : definition.blocks.isEmpty = false) :
+    (rewriteFunction limits context definition).blocks.isEmpty = false := by
+  simpa [rewriteFunction] using nonempty
+
+namespace Sim
+
+open Eval
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+
+def rewriteDecl (limits : Validate.Limits) (validation : Validate.Context) : Decl → Decl
+  | .fn definition => .fn (rewriteFunction limits validation definition)
+  | .extern arity => .extern arity
+
+structure ContextRel (limits : Validate.Limits) (validation : Validate.Context)
+    (left right : Context) : Prop where
+  schemas : left.schemas = right.schemas
+  oracle : left.oracle = right.oracle
+  declarations : ∀ address, right.declarations address =
+    (left.declarations address).map (rewriteDecl limits validation)
+
+theorem ContextRel.ofProgram (limits : Validate.Limits) (validation : Validate.Context)
+    (source : Program) (oracle : Address → List RVal → Option RVal := fun _ _ => none) :
+    ContextRel limits validation (Context.ofProgram source validation.schemas oracle)
+      (Context.ofProgram (rewriteProgram limits validation source) validation.schemas oracle) := by
+  refine ⟨rfl, rfl, ?_⟩
+  intro address
+  simp only [Context.ofProgram, rewriteProgram, List.find?_map, Option.map_map,
+    Function.comp_def]
+  rfl
+
+theorem ContextRel.function {limits : Validate.Limits} {validation : Validate.Context}
+    {left right : Context} (contexts : ContextRel limits validation left right)
+    {address : Address} {definition : Function} (found : left.declarations address = some (.fn definition)) :
+    right.declarations address = some (.fn (rewriteFunction limits validation definition)) := by
+  rw [contexts.declarations, found]
+  rfl
+
+theorem ContextRel.extern {limits : Validate.Limits} {validation : Validate.Context}
+    {left right : Context} (contexts : ContextRel limits validation left right)
+    {address : Address} {arity : Nat} (found : left.declarations address = some (.extern arity)) :
+    right.declarations address = some (.extern arity) := by
+  rw [contexts.declarations, found]
+  rfl
+
+def ContextReady (context : Context) : Prop :=
+  ∀ {address definition}, context.declarations address = some (.fn definition) →
+    functionReady definition = true
+
+theorem programReady_context {source : Program} {schemas oracle}
+    (ready : programReady source = true) : ContextReady (Context.ofProgram source schemas oracle) := by
+  intro address definition found
+  simp only [programReady, Bool.and_eq_true] at ready
+  simp only [Context.ofProgram] at found
+  cases lookup : source.declarations.find? (fun entry => entry.1 == address) with
+  | none => simp [lookup] at found
+  | some entry =>
+      simp only [lookup, Option.map_some, Option.some.injEq] at found
+      have member := List.mem_of_find?_eq_some lookup
+      have checked := List.all_eq_true.mp ready.2 entry member
+      simpa only [found] using checked
+
+def PhysicalCredit (credit : Credit) : Prop :=
+  credit.presence = .absent ∨ ∃ location, credit.presence = .present (some location)
+
+/-- Stable points before a consuming prefix and after its release. Calls in
+the body retain the same one-element credit file in their saved caller. -/
+inductive Position (limits : Validate.Limits) (validation : Validate.Context) (block : Block) :
+    Nat → Nat → Array (Option Credit) → Prop where
+  | unchanged {pc : Nat} {credits : Array (Option Credit)}
+      (rejected : inspect limits validation block = none)
+      (cleared : credits.any Option.isSome = false) : Position limits validation block pc pc credits
+  | entry (site : Site limits validation block)
+      (produced : inspect limits validation block = some site) :
+      Position limits validation block 0 0 #[]
+  | body (site : Site limits validation block)
+      (produced : inspect limits validation block = some site)
+      (offset : Nat) (within : offset ≤ site.shape.calls.size) (credit : Credit)
+      (layout : credit.layout = site.representation.layout) (physical : PhysicalCredit credit) :
+      Position limits validation block (2 * site.shape.fieldCount + 1 + offset)
+        (site.shape.fieldCount + 1 + offset) #[some credit]
+  | finished (site : Site limits validation block)
+      (produced : inspect limits validation block = some site) :
+      Position limits validation block (2 * site.shape.fieldCount + site.shape.calls.size + 2)
+        (site.shape.fieldCount + site.shape.calls.size + 2) #[none]
+
+structure FrameRel (limits : Validate.Limits) (validation : Validate.Context) (mapping : Array Nat)
+    (sourceBlock : Block) (left right : Frame) : Prop where
+  definition : right.definition = rewriteFunction limits validation left.definition
+  ready : functionReady left.definition = true
+  blockId : right.block = left.block
+  sourceAt : left.definition.blocks[left.block]? = some sourceBlock
+  values : RValsIso (MapRel mapping) left.values.toList right.values.toList
+  leftCredits : left.credits = #[]
+  position : Position limits validation sourceBlock left.pc right.pc right.credits
+  entryCount : left.pc = 0 → left.values.size = sourceBlock.valueParams.size
+
+theorem FrameRel.targetAt {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {sourceBlock : Block} {left right : Frame}
+    (frames : FrameRel limits validation mapping sourceBlock left right) :
+    right.definition.blocks[right.block]? = some (rewriteBlock limits validation sourceBlock) := by
+  rw [frames.definition, frames.blockId]
+  exact rewriteFunction_block frames.sourceAt
+
+theorem FrameRel.mono {limits : Validate.Limits} {validation : Validate.Context}
+    {before after : Array Nat} {sourceBlock : Block} {left right : Frame}
+    (frames : FrameRel limits validation before sourceBlock left right)
+    (lift : ∀ {l r}, MapRel before l r → MapRel after l r) :
+    FrameRel limits validation after sourceBlock left right :=
+  { frames with values := frames.values.mono lift }
+
+theorem Position.atEntry (limits : Validate.Limits) (validation : Validate.Context) (block : Block) :
+    Position limits validation block 0 0 #[] := by
+  cases decideBlock limits validation block with
+  | unchanged rejected => exact .unchanged rejected (by simp)
+  | accepted site produced => exact .entry site produced
+
+theorem FrameRel.atEntry {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {definition : Function} {block : Block} {blockId : Nat}
+    {leftValues rightValues : Array RVal} (ready : functionReady definition = true)
+    (found : definition.blocks[blockId]? = some block)
+    (values : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (arity : leftValues.size = block.valueParams.size) :
+    FrameRel limits validation mapping block
+      { definition, block := blockId, values := leftValues }
+      { definition := rewriteFunction limits validation definition, block := blockId, values := rightValues } :=
+  ⟨rfl, ready, rfl, found, values, rfl, Position.atEntry .., fun _ => arity⟩
+
+theorem FrameRel.functionEntry {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {definition : Function} {leftValues rightValues : Array RVal}
+    (ready : functionReady definition = true)
+    (values : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (arity : leftValues.size = definition.signature.params.size) :
+    ∃ block, FrameRel limits validation mapping block
+      { definition, values := leftValues }
+      { definition := rewriteFunction limits validation definition, values := rightValues } := by
+  cases found : definition.blocks[0]? with
+  | none => simp [functionReady, found] at ready
+  | some block =>
+      exact ⟨block, FrameRel.atEntry ready found values
+        (arity.trans (functionReady_entry ready found).symm)⟩
+
+theorem FrameRel.pushResult {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right : Frame} {leftValue rightValue : RVal}
+    (frames : FrameRel limits validation mapping block left right) (positive : 0 < left.pc)
+    (value : RValIso (MapRel mapping) leftValue rightValue) :
+    FrameRel limits validation mapping block
+      { left with values := left.values.push leftValue }
+      { right with values := right.values.push rightValue } :=
+  { frames with
+    values := by simpa only [Array.toList_push] using frames.values.append (.cons value .nil)
+    entryCount := by intro zero; simp only at zero; omega }
+
+theorem Position.unchanged_parts {limits : Validate.Limits} {validation : Validate.Context}
+    {block : Block} {leftPC rightPC : Nat} {credits : Array (Option Credit)}
+    (position : Position limits validation block leftPC rightPC credits)
+    (rejected : inspect limits validation block = none) :
+    leftPC = rightPC ∧ credits.any Option.isSome = false := by
+  cases position with
+  | unchanged missing cleared => exact ⟨rfl, cleared⟩
+  | entry site produced => rw [rejected] at produced; cases produced
+  | body site produced offset within credit layout physical => rw [rejected] at produced; cases produced
+  | finished site produced => rw [rejected] at produced; cases produced
+
+theorem FrameRel.unchanged {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right : Frame}
+    (frames : FrameRel limits validation mapping block left right)
+    (rejected : inspect limits validation block = none) : left.pc = right.pc ∧ NoLiveCredits right :=
+  frames.position.unchanged_parts rejected
+
+theorem FrameRel.advanceUnchanged {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right : Frame}
+    (frames : FrameRel limits validation mapping block left right)
+    (rejected : inspect limits validation block = none) :
+    FrameRel limits validation mapping block { left with pc := left.pc + 1 } { right with pc := right.pc + 1 } := by
+  obtain ⟨pc, cleared⟩ := frames.unchanged rejected
+  exact { frames with
+    position := by rw [pc]; exact .unchanged rejected cleared
+    entryCount := by intro zero; simp only at zero; omega }
+
+inductive ContinuationRel (limits : Validate.Limits) (validation : Validate.Context) (mapping : Array Nat) :
+    Continuation → Continuation → Prop where
+  | resume {sourceBlock : Block} {left right : Frame}
+      (frames : FrameRel limits validation mapping sourceBlock left right)
+      (afterInstruction : 0 < left.pc) :
+      ContinuationRel limits validation mapping (.resume left) (.resume right)
+  | applyMore {sourceBlock : Block} {left right : Frame} {leftArguments rightArguments : Array RVal}
+      (frames : FrameRel limits validation mapping sourceBlock left right) (afterInstruction : 0 < left.pc)
+      (arguments : RValsIso (MapRel mapping) leftArguments.toList rightArguments.toList) :
+      ContinuationRel limits validation mapping (.applyMore leftArguments left) (.applyMore rightArguments right)
+
+inductive StackRel (limits : Validate.Limits) (validation : Validate.Context) (mapping : Array Nat) :
+    List Continuation → List Continuation → Prop where
+  | nil : StackRel limits validation mapping [] []
+  | cons {left right : Continuation} {lefts rights : List Continuation}
+      (head : ContinuationRel limits validation mapping left right)
+      (tail : StackRel limits validation mapping lefts rights) :
+      StackRel limits validation mapping (left :: lefts) (right :: rights)
+
+theorem ContinuationRel.mono {limits : Validate.Limits} {validation : Validate.Context}
+    {before after : Array Nat} {left right : Continuation}
+    (related : ContinuationRel limits validation before left right)
+    (lift : ∀ {l r}, MapRel before l r → MapRel after l r) :
+    ContinuationRel limits validation after left right := by
+  cases related with
+  | resume frames positive => exact .resume (frames.mono lift) positive
+  | applyMore frames positive arguments => exact .applyMore (frames.mono lift) positive (arguments.mono lift)
+
+theorem StackRel.mono {limits : Validate.Limits} {validation : Validate.Context}
+    {before after : Array Nat} {left right : List Continuation}
+    (related : StackRel limits validation before left right)
+    (lift : ∀ {l r}, MapRel before l r → MapRel after l r) : StackRel limits validation after left right := by
+  induction related with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (head.mono lift) ih
+
+inductive ControlRel (limits : Validate.Limits) (validation : Validate.Context) (mapping : Array Nat) :
+    Control → Control → Prop where
+  | halted {left right : RVal} (values : RValIso (MapRel mapping) left right) :
+      ControlRel limits validation mapping (.halted left) (.halted right)
+  | running {sourceBlock : Block} {left right : Frame} {leftStack rightStack : List Continuation}
+      (frames : FrameRel limits validation mapping sourceBlock left right)
+      (stack : StackRel limits validation mapping leftStack rightStack) :
+      ControlRel limits validation mapping (.running left leftStack) (.running right rightStack)
+
+structure MachineRel (limits : Validate.Limits) (validation : Validate.Context) (sourceContext : Context)
+    (mapping : Array Nat) (left right : Machine) : Prop where
+  heap : HeapMap left.store right.store mapping
+  ordered : Ordered left.store
+  shaped : Shaped sourceContext left.store
+  fuel : left.heapFuel ≤ right.heapFuel
+  control : ControlRel limits validation mapping left.control right.control
+  reservations : right.ReservationOwnership
+
+theorem initialMachine_related {limits : Validate.Limits} {validation : Validate.Context}
+    {sourceContext : Context} {definition : Function} {heapFuel : Nat}
+    (ready : functionReady definition = true) (arity : definition.signature.params.size = 0) :
+    MachineRel limits validation sourceContext #[]
+      (initialMachine definition #[] heapFuel)
+      (initialMachine (rewriteFunction limits validation definition) #[] heapFuel) := by
+  obtain ⟨block, frames⟩ := FrameRel.functionEntry (limits := limits) (validation := validation)
+    (mapping := #[]) ready (RValsIso.nil) arity.symm
+  exact ⟨HeapMap.empty, Ordered.empty, NodeProperty.empty _, Nat.le_refl _,
+    .running frames .nil, Policy.initialMachine_reservationOwnership ..⟩
+
+theorem directCall_definition {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat} {block : Block}
+    {left right : Frame} (contexts : ContextRel limits validation leftContext rightContext)
+    (frames : FrameRel limits validation mapping block left right)
+    {call : Policy.DirectCall} {definition : Function}
+    (found : call.definition leftContext left = .ok definition) :
+    call.definition rightContext right = .ok (rewriteFunction limits validation definition) := by
+  cases call with
+  | self arguments =>
+      simp only [Policy.DirectCall.definition, Except.ok.injEq] at found
+      subst definition
+      simp only [Policy.DirectCall.definition, frames.definition]
+  | function address arguments =>
+      cases declared : leftContext.declarations address with
+      | none => simp [Policy.DirectCall.definition, declared] at found
+      | some declaration =>
+          cases declaration with
+          | extern arity => simp [Policy.DirectCall.definition, declared] at found
+          | fn callee =>
+              simp only [Policy.DirectCall.definition, declared, Except.ok.injEq] at found
+              subst callee
+              simp only [Policy.DirectCall.definition, contexts.function declared]
+
+theorem directCall_ready {context : Context} (readyContext : ContextReady context)
+    {frame : Frame} (ready : functionReady frame.definition = true)
+    {call : Policy.DirectCall} {definition : Function}
+    (found : call.definition context frame = .ok definition) : functionReady definition = true := by
+  cases call with
+  | self arguments =>
+      simp only [Policy.DirectCall.definition, Except.ok.injEq] at found
+      exact found ▸ ready
+  | function address arguments =>
+      cases declared : context.declarations address with
+      | none => simp [Policy.DirectCall.definition, declared] at found
+      | some declaration =>
+          cases declaration with
+          | extern arity => simp [Policy.DirectCall.definition, declared] at found
+          | fn callee =>
+              simp only [Policy.DirectCall.definition, declared, Except.ok.injEq] at found
+              subst callee
+              exact readyContext declared
+
+theorem directCall_step {context : Context} {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block} {call : Policy.DirectCall}
+    {values : Array RVal} {definition : Function}
+    (running : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = call.instruction)
+    (resolved : resolveAtoms frame.values call.arguments = .ok values)
+    (found : call.definition context frame = .ok definition)
+    (arity : values.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    Policy.Step .suspendedCallsV1 context interpretation machine
+      { machine with
+        control := .running { definition, values }
+          (.resume { frame with pc := frame.pc + 1 } :: stack) } := by
+  have atCall : Policy.directCall? frame = some call := by
+    rw [Policy.directCall?_atInstruction blockAt pc instruction]
+    cases call <;> rfl
+  simp only [Policy.Step, Policy.step, running, atCall]
+  exact Policy.suspendCall_iff.mpr ⟨values, definition, resolved, found, arity, nonempty, rfl⟩
+
+end Sim
+
+end Ix.Compiler.IxIR2.CallReuse
diff --git a/Ix/Compiler/IxIR2/CallReuseHeapShape.lean b/Ix/Compiler/IxIR2/CallReuseHeapShape.lean
new file mode 100644
index 000000000..6b84a9138
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseHeapShape.lean
@@ -0,0 +1,208 @@
+import Ix.Compiler.IxIR2.CallReuseOrder
+
+/-!
+# Runtime constructor shapes from baseline allocation
+
+Reference-count changes and destruction preserve every surviving node's
+world and payload. Constructor allocation obtains its payload length from
+the evaluator's successful field check.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim (RValsIso)
+
+structure NodeProperty (property : Owned → Node → Prop) (store : Store) : Prop where
+  holds : ∀ {location box}, store.get? location = some box → property box.world box.node
+
+namespace NodeProperty
+
+theorem empty (property : Owned → Node → Prop) : NodeProperty property ({} : Store) := by
+  constructor
+  intro location box found
+  simp [Store.get?, IxIR1.Store.get?] at found
+
+theorem congr {property : Owned → Node → Prop} {left right : Store}
+    (valid : NodeProperty property left) (nodes : right.heap.nodes = left.heap.nodes) :
+    NodeProperty property right := by
+  constructor
+  intro location box found
+  exact valid.holds (by simpa only [Store.get?, IxIR1.Store.get?, nodes] using found)
+
+theorem rcTick {property : Owned → Node → Prop} {store : Store}
+    (valid : NodeProperty property store) : NodeProperty property store.rcTick := ⟨valid.holds⟩
+
+theorem setRc {property : Owned → Node → Prop} {store : Store} {location rc : Nat}
+    {box : NodeBox} (valid : NodeProperty property store) (found : store.get? location = some box) :
+    NodeProperty property (store.setBox location { box with rc }) := by
+  constructor
+  intro other otherBox after
+  by_cases same : location = other
+  · subst other
+    have updated := IxIR1.Sim.get?_setBox_same (new := { box with rc }) found
+    have equal : otherBox = { box with rc } := Option.some.inj (after.symm.trans updated)
+    subst otherBox
+    exact valid.holds (box := box) found
+  · exact valid.holds (IxIR1.Sim.get?_of_setBox_other same found after)
+
+theorem kill {property : Owned → Node → Prop} {store : Store} {location : Nat} {box : NodeBox}
+    (valid : NodeProperty property store) (found : store.get? location = some box) :
+    NodeProperty property (store.kill location) := by
+  constructor
+  intro other otherBox after
+  by_cases same : location = other
+  · subst other
+    have missing := IxIR1.Sim.get?_kill_same found
+    change (store.heap.kill location).get? location = some otherBox at after
+    rw [missing] at after
+    cases after
+  · exact valid.holds (IxIR1.Sim.get?_of_kill_other same found after)
+
+theorem alloc {property : Owned → Node → Prop} {store : Store} {world : Owned} {node : Node}
+    (valid : NodeProperty property store) (new : property world node) :
+    NodeProperty property (store.allocNode world node).1 := by
+  constructor
+  intro location box found
+  by_cases fresh : location = store.heap.nodes.size
+  · subst location
+    have atNew := IxIR1.Sim.HeapIso.get?_allocNode_new store.heap world node
+    have same : box = ⟨world, 1, node⟩ := Option.some.inj (found.symm.trans atNew)
+    subst box
+    exact new
+  · exact valid.holds (IxIR1.Sim.HeapIso.get?_of_allocNode_old fresh found)
+
+theorem retain {property : Owned → Node → Prop} {store output : Store} {value : RVal}
+    (valid : NodeProperty property store) (run : retainShared store value = .ok output) :
+    NodeProperty property output := by
+  cases value with
+  | lit => cases run; exact valid
+  | erased => cases run; exact valid
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp only [retainShared, found, shared, bne_self_eq_false, Bool.false_eq_true,
+              ↓reduceIte, Except.ok.injEq] at run
+            subst output
+            simpa only [shared] using (valid.setRc (rc := box.rc + 1) found).rcTick
+          · simp [retainShared, found, shared] at run
+
+theorem retainMany {property : Owned → Node → Prop} {store output : Store} {values : Array RVal}
+    (valid : NodeProperty property store) (run : RetainSharedMany store values output) :
+    NodeProperty property output := by
+  have loop : ∀ (values : List RVal) {store output : Store}, NodeProperty property store →
+      values.foldlM retainShared store = .ok output → NodeProperty property output := by
+    intro values
+    induction values with
+    | nil => intro store output valid run; cases run; exact valid
+    | cons head tail ih =>
+        intro store output valid run
+        rw [List.foldlM_cons] at run
+        cases first : retainShared store head with
+        | error error => simp [first, bind, Except.bind] at run
+        | ok middle =>
+            simp only [first, bind, Except.bind] at run
+            exact ih (valid.retain first) run
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  exact loop values.toList valid run
+
+theorem releaseWork {property : Owned → Node → Prop} {fuel remaining : Nat}
+    {store output : Store} {values : List RVal} (valid : NodeProperty property store)
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    NodeProperty property output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact valid
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact valid
+      | cons value rest =>
+          cases value with
+          | lit => exact ih valid run
+          | erased => exact ih valid run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true] at run
+                        exact ih (valid.rcTick.kill found) run
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        exact ih (valid.rcTick.setRc (rc := box.rc - 1) found)
+                          (by simpa only [shared] using run)
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem dropWork {property : Owned → Node → Prop} {fuel remaining : Nat}
+    {store output : Store} {values : List RVal} (valid : NodeProperty property store)
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) :
+    NodeProperty property output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact valid
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact valid
+      | cons value rest =>
+          cases value with
+          | lit => exact ih valid run
+          | erased => exact ih valid run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN address arity arguments => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        exact ih (valid.kill found) run
+                  · simp [dropUniqueWork, found, unique] at run
+
+end NodeProperty
+
+def ShapedNode (context : Context) (world : Owned) : Node → Prop
+  | .ctorN cid fields => ∃ schema, context.schemas world cid = some schema ∧
+      fields.size = schema.fields.size
+  | .papN .. => True
+
+abbrev Shaped (context : Context) (store : Store) : Prop :=
+  NodeProperty (ShapedNode context) store
+
+theorem Shaped.fields {context : Context} {store : Store} {location : Nat}
+    {box : NodeBox} {world : Owned} {cid : CtorId} {fields : Array RVal} {schema : CtorSchema}
+    (shaped : Shaped context store) (view : ConstructorView store location world cid box fields)
+    (schemaAt : context.schemas world cid = some schema) : fields.size = schema.fields.size := by
+  obtain ⟨found, boxWorld, node⟩ := view.parts
+  have shape := shaped.holds found
+  rw [boxWorld, node] at shape
+  obtain ⟨actualSchema, actualAt, sizes⟩ := shape
+  have equal := Option.some.inj (actualAt.symm.trans schemaAt)
+  subst actualSchema
+  exact sizes
+
+theorem HeapMap.fieldWorlds {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {leftValues rightValues : Array RVal} {schema : CtorSchema}
+    (related : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (checked : FieldWorlds left schema leftValues) : FieldWorlds right schema rightValues := by
+  have forward : ∀ {lefts rights : List RVal}, RValsIso (MapRel mapping) lefts rights →
+      FieldValuesWorldForward left right lefts rights := by
+    intro lefts rights related
+    induction related with
+    | nil => exact .nil
+    | cons head tail ih => exact .cons (fun _ valid => heap.hasWorld head valid) ih
+  exact checked.forward (forward related)
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseInstructions.lean b/Ix/Compiler/IxIR2/CallReuseInstructions.lean
new file mode 100644
index 000000000..876a6b62c
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseInstructions.lean
@@ -0,0 +1,151 @@
+import Ix.Compiler.IxIR2.CallReuseApply
+
+/-! Forward simulation of every ordinary instruction in an unchanged block. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+
+theorem values_scalar {mapping : Array Nat} {left right : Array RVal}
+    (related : RValsIso (MapRel mapping) left.toList right.toList) :
+    left.all RVal.isScalar = right.all RVal.isScalar := by
+  rw [← Array.all_toList, ← Array.all_toList]
+  generalize left.toList = leftList at related ⊢
+  generalize right.toList = rightList at related ⊢
+  induction related with
+  | nil => rfl
+  | cons head tail ih => cases head <;> simp only [List.all_cons, RVal.isScalar, ih]
+
+theorem instruction_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {block : Block} {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {instruction : Instr} {leftAfter : Machine}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext)
+    (state : HeapState leftContext mapping leftStore rightStore) (fuel : leftFuel ≤ rightFuel)
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (rejected : inspect limits validation block = none)
+    (free : CreditFree.instruction instruction = true)
+    (classified : InstructionTransferCase leftContext .physical leftStore leftFuel leftFrame
+      leftStack instruction leftAfter) :
+    ∃ after rightAfter,
+      InstructionTransferCase rightContext .physical rightStore rightFuel rightFrame
+        rightStack instruction rightAfter ∧
+      TransferRel limits validation leftContext mapping after leftStore rightStore leftAfter rightAfter := by
+  have advanced := frames.advanceUnchanged rejected
+  have positive : 0 < ({ leftFrame with pc := leftFrame.pc + 1 } : Frame).pc := by simp
+  have cleared := (frames.unchanged rejected).2
+  cases classified <;> try simp only [CreditFree.instruction, Bool.false_eq_true] at free
+  case move atom value resolved =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    exact ⟨mapping, _, .move targetResolved,
+      ⟨.refl state, fuel, .running (advanced.pushResult positive valueRel) stack⟩⟩
+  case alloc world cid arguments schema values schemaAt resolved fields =>
+    obtain ⟨targetValues, targetResolved, valuesRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    have allocating := state.alloc (world := world) (leftNode := .ctorN cid values)
+      (.ctor valuesRel) ⟨schema, schemaAt, fields.size⟩
+    have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+        (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+      .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+    exact ⟨_, _, .alloc (by rw [← contexts.schemas]; exact schemaAt)
+      targetResolved (state.heap.fieldWorlds valuesRel fields),
+      ⟨allocating, fuel, .running ((advanced.mono allocating.extension).pushResult positive valueRel)
+        (stack.mono allocating.extension)⟩⟩
+  case retainShared atom value output resolved retained =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    obtain ⟨targetOutput, targetRetain, retaining⟩ := state.retain valueRel retained
+    exact ⟨mapping, _, .retainShared targetResolved targetRetain,
+      ⟨retaining, fuel, .running (advanced.pushResult positive valueRel) stack⟩⟩
+  case releaseShared atom value output remaining resolved released =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    obtain ⟨targetOutput, targetFuel, targetRelease, remainingFuel, releasing⟩ :=
+      state.releaseWork fuel (.cons valueRel .nil) released
+    exact ⟨mapping, _, .releaseShared targetResolved targetRelease,
+      ⟨releasing, remainingFuel, .running advanced stack⟩⟩
+  case dropUnique atom value output remaining resolved dropped =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    obtain ⟨targetOutput, targetFuel, targetDrop, remainingFuel, dropping⟩ :=
+      state.dropWork fuel (.cons valueRel .nil) dropped
+    exact ⟨mapping, _, .dropUnique targetResolved targetDrop,
+      ⟨dropping, remainingFuel, .running advanced stack⟩⟩
+  case freeUnique atom cid location box fields resolved viewed scalarFields =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped viewed
+        exact ⟨mapping, _, .freeUnique targetResolved targetView
+          (by rw [← values_scalar fieldsRel]; exact scalarFields),
+          ⟨state.freeUnique mapped viewed.parts.1, fuel, .running advanced stack⟩⟩
+  case fetch atom cid field location box fields value resolved boxAt node fieldAt =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped (ConstructorView.of_box boxAt rfl node)
+        obtain ⟨targetField, targetFieldAt, fieldRel⟩ := fieldsRel.get? (by simpa using fieldAt)
+        exact ⟨mapping, _, .fetch targetResolved targetView.parts.1 targetView.parts.2.2
+          (by simpa using targetFieldAt),
+          ⟨.refl state, fuel, .running (advanced.pushResult positive fieldRel) stack⟩⟩
+  case callFn address atoms arguments definition noCredits resolved declaration arity nonempty =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    obtain ⟨entryBlock, entry⟩ := FrameRel.functionEntry (limits := limits)
+      (validation := validation) (readyContext declaration) argumentsRel arity
+    exact ⟨mapping, _, .callFn cleared targetResolved (contexts.function declaration)
+      (by simpa only [rewriteFunction_signature, ← values_size argumentsRel] using arity)
+      (rewriteFunction_nonempty nonempty),
+      ⟨.refl state, fuel, .running entry (.cons (.resume advanced positive) stack)⟩⟩
+  case callSelf atoms arguments noCredits resolved arity nonempty =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    obtain ⟨entryBlock, entry⟩ := FrameRel.functionEntry (limits := limits)
+      (validation := validation) frames.ready argumentsRel arity
+    have targetArity : targetArguments.size = rightFrame.definition.signature.params.size := by
+      simpa only [frames.definition, rewriteFunction_signature, ← values_size argumentsRel] using arity
+    have targetNonempty : rightFrame.definition.blocks.isEmpty = false := by
+      simpa only [frames.definition] using rewriteFunction_nonempty (limits := limits)
+        (context := validation) nonempty
+    refine ⟨mapping, _, .callSelf cleared targetResolved targetArity targetNonempty,
+      ⟨.refl state, fuel, .running (sourceBlock := entryBlock) ?_
+        (.cons (.resume advanced positive) stack)⟩⟩
+    simpa only [frames.definition] using entry
+  case pappFn address atoms arguments definition noCredits declaration papSafe resolved under =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    have allocating := state.alloc (world := .shared)
+      (leftNode := .papN address definition.signature.params.size arguments) (.pap argumentsRel) trivial
+    have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+        (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+      .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+    exact ⟨_, _, .pappFn cleared (contexts.function declaration) papSafe targetResolved
+      (by simpa only [rewriteFunction_signature, ← values_size argumentsRel] using under),
+      ⟨allocating, fuel, .running ((advanced.mono allocating.extension).pushResult positive valueRel)
+        (stack.mono allocating.extension)⟩⟩
+  case pappExtern address atoms arguments arity noCredits declaration resolved under =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    have allocating := state.alloc (world := .shared)
+      (leftNode := .papN address arity arguments) (.pap argumentsRel) trivial
+    have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+        (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+      .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+    exact ⟨_, _, .pappExtern cleared (contexts.extern declaration) targetResolved
+      (by rw [← values_size argumentsRel]; exact under),
+      ⟨allocating, fuel, .running ((advanced.mono allocating.extension).pushResult positive valueRel)
+        (stack.mono allocating.extension)⟩⟩
+  case apply functionAtom argumentAtoms function arguments noCredits functionResolved argumentsResolved transferred =>
+    obtain ⟨targetFunction, targetFunctionResolved, functionRel⟩ :=
+      ReuseSim.resolveAtom_iso frames.values functionResolved
+    obtain ⟨targetArguments, targetArgumentsResolved, argumentsRel⟩ :=
+      ReuseSim.resolveAtoms_iso frames.values argumentsResolved
+    obtain ⟨after, target, transfer, related⟩ := apply_related contexts readyContext state fuel
+      functionRel argumentsRel advanced positive stack transferred
+    exact ⟨after, target, .apply cleared targetFunctionResolved targetArgumentsResolved transfer, related⟩
+  case extern address atoms arguments arity value noCredits resolved declaration argumentArity called =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    obtain ⟨targetCalled, valueRel⟩ := scalarOracle_related contexts argumentsRel called
+    exact ⟨mapping, _, .extern cleared targetResolved (contexts.extern declaration)
+      (by rw [← values_size argumentsRel]; exact argumentArity) targetCalled,
+      ⟨.refl state, fuel, .running (advanced.pushResult positive valueRel) stack⟩⟩
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseMain.lean b/Ix/Compiler/IxIR2/CallReuseMain.lean
new file mode 100644
index 000000000..ea21a70a7
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseMain.lean
@@ -0,0 +1,91 @@
+import Ix.Compiler.IxIR2.CallReuseSimulation
+import Ix.Compiler.IxIR2.CallEvalFuel
+
+/-! Executable whole-main refinement for the actual v1 compiler output. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse
+
+open Eval
+open Sim
+
+theorem Output.mainSimulation {limits : Validate.Limits} {validation : Validate.Context} {source : Program}
+    (output : Output limits validation source) {controlFuel heapFuel : Nat} {baseline : Result}
+    (arity : source.main.signature.params.size = 0) (nonempty : source.main.blocks.isEmpty = false)
+    (run : Eval.runMain (Context.ofProgram source validation.schemas) .physical source
+      controlFuel heapFuel = .ok baseline) :
+    ∃ selectedControl selected mapping,
+      Policy.runMain policy (Context.ofProgram output.target validation.schemas) .physical output.target
+        selectedControl heapFuel = .ok selected ∧
+      HeapMap baseline.store selected.store mapping ∧
+      IxIR1.Sim.RValIso (MapRel mapping) baseline.value selected.value ∧
+      baseline.heapRemaining ≤ selected.heapRemaining ∧
+      baseline.store.allocationEvents = selected.store.allocationEvents ∧
+      baseline.store.CostBounds selected.store := by
+  have mainReady : functionReady source.main = true := by
+    have ready := output.sourceReady
+    simp only [programReady, Bool.and_eq_true] at ready
+    exact ready.1
+  rw [Eval.runMain_eq_runMachine arity nonempty] at run
+  obtain ⟨count, _, steps⟩ := Eval.runMachine_steps run
+  have initial := initialMachine_related (limits := limits) (validation := validation)
+    (sourceContext := Context.ofProgram source validation.schemas) (heapFuel := heapFuel) mainReady arity
+  obtain ⟨mapping, selectedCount, selectedFinal, targetSteps, related⟩ :=
+    simulate_to_halt (ContextRel.ofProgram limits validation source)
+      (programReady_context output.sourceReady) rfl initial steps ⟨baseline.value, rfl⟩
+  rcases selectedFinal with ⟨selectedStore, selectedFuel, selectedControl⟩
+  cases related.control with
+  | halted values =>
+      rename_i selectedValue
+      let selected : Result :=
+        { store := selectedStore, value := selectedValue, controlRemaining := 0, heapRemaining := selectedFuel }
+      refine ⟨selectedCount, selected, mapping, ?_, related.transition.state.heap, values, related.fuel, ?_, ?_⟩
+      · rw [Policy.runMain_eq_runMachine
+          (show output.target.main.signature.params.size = 0 from arity)
+          (rewriteFunction_nonempty nonempty)]
+        have executed := targetSteps.runMachine (controlFuel := 0)
+        simpa only [Nat.add_zero, Policy.runMachine, policy, Output.target, rewriteProgram, selected] using executed
+      · have counted := related.transition.events
+        change baseline.store.allocationEvents + 0 = selected.store.allocationEvents + 0 at counted
+        simpa only [Nat.add_zero] using counted
+      · exact related.transition.costs.preserves (Store.CostBounds.refl {})
+
+theorem Selection.mainEntry {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Program} (selection : Selection limits validation source)
+    (arity : source.main.signature.params.size = 0) (nonempty : source.main.blocks.isEmpty = false) :
+    selection.target.main.signature.params.size = 0 ∧ selection.target.main.blocks.isEmpty = false := by
+  cases selection with
+  | optimized output produced => exact ⟨arity, rewriteFunction_nonempty nonempty⟩
+  | baseline checked error rejected => exact ⟨arity, nonempty⟩
+
+/-- The chosen policy executes the actual checked selection. At a closed
+compiler endpoint the allocation-history map gives the existing semantic heap
+relation, including fallback to the unchanged checked baseline. -/
+theorem Selection.mainSimulation {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Program} (selection : Selection limits validation source)
+    {controlFuel heapFuel : Nat} {baseline : Result}
+    (arity : source.main.signature.params.size = 0) (nonempty : source.main.blocks.isEmpty = false)
+    (run : Eval.runMain (Context.ofProgram source validation.schemas) .physical source
+      controlFuel heapFuel = .ok baseline)
+    (closed : IxIR1.Sim.StoreClosed baseline.store.heap)
+    (live : IxIR1.Sim.LiveRVal baseline.store.heap baseline.value) :
+    ∃ selectedControl selected locRel,
+      Policy.runMain selection.policy (Context.ofProgram selection.target validation.schemas)
+        .physical selection.target selectedControl heapFuel = .ok selected ∧
+      ReuseSim.StableHeapRel baseline.store selected.store locRel ∧
+      IxIR1.Sim.RValIso locRel baseline.value selected.value ∧
+      baseline.heapRemaining ≤ selected.heapRemaining ∧
+      baseline.store.allocationEvents = selected.store.allocationEvents ∧
+      baseline.CostBounds selected := by
+  cases selection with
+  | optimized output produced =>
+      obtain ⟨control, selected, mapping, executed, heaps, values, budget, events, costs⟩ :=
+        output.mainSimulation arity nonempty run
+      exact ⟨control, selected, LiveMapRel baseline.store mapping, executed,
+        heaps.toStable closed, heaps.toHeapIso_value closed values live, budget, events, costs⟩
+  | baseline checked error rejected =>
+      exact ⟨controlFuel, baseline, Eq,
+        by simpa only [Selection.policy, Selection.target, Policy.runMain_v0] using run,
+        .contents ⟨rfl⟩,
+        IxIR1.Sim.RValIso.refl _, Nat.le_refl _, rfl, Store.CostBounds.refl _⟩
+
+end Ix.Compiler.IxIR2.CallReuse
diff --git a/Ix/Compiler/IxIR2/CallReuseOrder.lean b/Ix/Compiler/IxIR2/CallReuseOrder.lean
new file mode 100644
index 000000000..72776ccdc
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseOrder.lean
@@ -0,0 +1,197 @@
+import Ix.Compiler.IxIR2.ReuseHeapMapResults
+
+/-!
+# Baseline allocation order for call-spanning reuse
+
+Fresh baseline allocation keeps positive counts and edges to older slots.
+This trace property rules out a self-field in the constructor consumed by a
+hot prefix. It is independent of exact external root counts.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim (NodeIso RValsIso)
+open Ix.Compiler.IxIR1.Reclamation (AllocationOrderInvariant)
+
+def Ordered (store : Store) : Prop := AllocationOrderInvariant store.heap
+
+theorem Ordered.empty : Ordered ({} : Store) := AllocationOrderInvariant.empty
+
+theorem Ordered.congr {before after : Store} (ordered : Ordered before)
+    (nodes : after.heap.nodes = before.heap.nodes) : Ordered after := by
+  have get : ∀ location, after.heap.get? location = before.heap.get? location := by
+    intro location
+    simp only [IxIR1.Store.get?, nodes]
+  exact ⟨fun found => ordered.rc_pos (by simpa only [get] using found),
+    fun found child => ordered.child_lt (by simpa only [get] using found) child⟩
+
+theorem Ordered.retain {store output : Store} (ordered : Ordered store) {value : RVal}
+    (run : retainShared store value = .ok output) : Ordered output := by
+  cases value with
+  | lit => cases run; exact ordered
+  | erased => cases run; exact ordered
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp only [retainShared, found, shared, bne_self_eq_false, Bool.false_eq_true,
+              ↓reduceIte, Except.ok.injEq] at run
+            subst output
+            have result := (AllocationOrderInvariant.setRc ordered found
+              (newRc := box.rc + 1) (by omega)).rcTick
+            simpa only [Ordered, Store.setBox_heap, Store.rcTick_heap, shared] using result
+          · simp [retainShared, found, shared] at run
+
+theorem Ordered.retainMany {store output : Store} (ordered : Ordered store) {values : Array RVal}
+    (run : RetainSharedMany store values output) : Ordered output := by
+  have loop : ∀ (values : List RVal) {store output : Store}, Ordered store →
+      values.foldlM retainShared store = .ok output → Ordered output := by
+    intro values
+    induction values with
+    | nil => intro store output ordered run; cases run; exact ordered
+    | cons head tail ih =>
+        intro store output ordered run
+        rw [List.foldlM_cons] at run
+        cases first : retainShared store head with
+        | error error => simp [first, bind, Except.bind] at run
+        | ok middle =>
+            simp only [first, bind, Except.bind] at run
+            exact ih (ordered.retain first) run
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  exact loop values.toList ordered run
+
+theorem Ordered.releaseWork {fuel remaining : Nat} {store output : Store} {values : List RVal}
+    (ordered : Ordered store)
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) : Ordered output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact ordered
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact ordered
+      | cons value rest =>
+          cases value with
+          | lit => exact ih ordered run
+          | erased => exact ih ordered run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true] at run
+                        exact ih (store := store.rcTick.kill location)
+                          (AllocationOrderInvariant.rcTick ordered |>.kill found) run
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        have preserved := (AllocationOrderInvariant.rcTick ordered).setRc found
+                          (newRc := box.rc - 1) (by omega)
+                        exact ih (store := store.rcTick.setBox location { box with rc := box.rc - 1 })
+                          preserved (by simpa only [shared] using run)
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem Ordered.dropWork {fuel remaining : Nat} {store output : Store} {values : List RVal}
+    (ordered : Ordered store)
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) : Ordered output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact ordered
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact ordered
+      | cons value rest =>
+          cases value with
+          | lit => exact ih ordered run
+          | erased => exact ih ordered run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN address arity arguments => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        exact ih (store := store.kill location)
+                          (AllocationOrderInvariant.kill ordered found) run
+                  · simp [dropUniqueWork, found, unique] at run
+
+theorem HeapMap.valuesBounded {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {leftValues rightValues : List RVal}
+    (related : RValsIso (MapRel mapping) leftValues rightValues) :
+    IxIR1.Reclamation.ValuesInBounds left.heap leftValues := by
+  induction related with
+  | nil => simp [IxIR1.Reclamation.ValuesInBounds]
+  | cons head tail ih =>
+      intro value member
+      simp only [List.mem_cons] at member
+      rcases member with rfl | member
+      · cases head with
+        | loc mapped =>
+            change _ < left.heap.nodes.size
+            rw [← heap.size]
+            exact mapped.bound
+        | lit => trivial
+        | erased => trivial
+      · exact ih value member
+
+theorem Ordered.alloc {left right : Store} {mapping : Array Nat}
+    (ordered : Ordered left) (heap : HeapMap left right mapping)
+    {world : Owned} {leftNode rightNode : Node}
+    (related : NodeIso (MapRel mapping) leftNode rightNode) :
+    Ordered (left.allocNode world leftNode).1 :=
+  AllocationOrderInvariant.allocNodeOfInBounds ordered
+    (heap.valuesBounded (nodeChildren_iso related))
+
+/-- The actual successful retain/release prefix cancels against shallow
+removal. Allocation order supplies the missing self-edge exclusion internally. -/
+theorem hotPrefix_order {store retained output : Store} {target : Nat} {cid : CtorId}
+    {fields : Array RVal} {fieldFuel remaining : Nat} (ordered : Ordered store)
+    (targetAt : store.get? target = some ⟨.shared, 1, .ctorN cid fields⟩)
+    (retains : RetainSharedMany store fields retained)
+    (releases : releaseShared (fieldFuel + 1) retained (.loc target) = .ok (output, remaining)) :
+    ReuseSim.HeapContentsEq output (store.kill target) := by
+  have different : ∀ value ∈ fields.toList, value ≠ .loc target := by
+    intro value member same
+    subst value
+    have impossible := ordered.child_lt targetAt (show .loc target ∈
+      IxIR1.Sim.nodeChildren (.ctorN cid fields) from member)
+    omega
+  have retainsList : RetainSharedMany store fields.toList.toArray retained := by simpa using retains
+  have retainedTarget := ReuseSim.RetainSharedMany.preserves_box targetAt different retainsList
+  have childRelease : releaseSharedWork fieldFuel (retained.rcTick.kill target) fields.toList =
+      .ok (output, remaining) := by
+    simpa [releaseShared, releaseSharedWork, retainedTarget] using releases
+  have afterKill := ReuseSim.RetainSharedMany.kill_commute targetAt different retainsList
+  have positives : ∀ value ∈ fields.toList, ReuseSim.SharedPositive (store.kill target) value := by
+    intro value member
+    have world := retainMany_world retains value member
+    have positive : ReuseSim.SharedPositive store value := by
+      cases value with
+      | lit => trivial
+      | erased => trivial
+      | loc location =>
+          cases found : store.get? location with
+          | none => simp [RVal.hasWorld, found] at world
+          | some box =>
+              have shared : box.world = .shared := by simpa [RVal.hasWorld, found] using world
+              rcases box with ⟨boxWorld, rc, node⟩
+              dsimp at shared
+              subst boxWorld
+              exact ⟨rc, node, found, ordered.rc_pos found⟩
+    exact positive.kill targetAt (different value member)
+  exact ReuseSim.retainedFields_release_roundtrip
+    (releaseStart := retained.rcTick.kill target) positives afterKill ⟨rfl⟩ childRelease
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReusePrefix.lean b/Ix/Compiler/IxIR2/CallReusePrefix.lean
new file mode 100644
index 000000000..c42e14898
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReusePrefix.lean
@@ -0,0 +1,183 @@
+import Ix.Compiler.IxIR2.CallReusePrefixHeap
+
+/-! Actual target reset and move steps synchronize with the extracted baseline prefix. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+
+theorem move_prefix_control (shape : Shape) {context : Context} {frame : Frame}
+    {parameters fields : Array RVal} {store : Store} {heapFuel : Nat} {stack : List Continuation}
+    (blockAt : frame.definition.blocks[frame.block]? = some shape.target)
+    (parameterCount : parameters.size = shape.valueParams.size) (fieldCount : fields.size = shape.fieldCount) :
+    Eval.Steps context .physical shape.fieldCount
+      { store, heapFuel, control := .running { frame with pc := 1, values := parameters ++ fields } stack }
+      { store, heapFuel, control := .running
+          { frame with pc := shape.fieldCount + 1, values := parameters ++ fields ++ fields } stack } := by
+  have loop : ∀ count, count ≤ shape.fieldCount → Eval.Steps context .physical count
+      { store, heapFuel, control := .running { frame with pc := 1, values := parameters ++ fields } stack }
+      { store, heapFuel, control := .running
+          { frame with pc := 1 + count, values := prefixValues (parameters ++ fields) fields count } stack } := by
+    intro count within
+    induction count with
+    | zero =>
+        simpa [prefixValues] using (Eval.Steps.refl
+          ({ store, heapFuel, control := .running { frame with pc := 1, values := parameters ++ fields } stack } : Machine))
+    | succ count ih =>
+        have before := ih (by omega)
+        have bound : count < fields.size := by omega
+        have atInstruction := shape.move_at (field := count) (by omega)
+        obtain ⟨pc, instruction⟩ := Array.getElem?_eq_some_iff.mp atInstruction
+        have resolved : resolveAtom (prefixValues (parameters ++ fields) fields count)
+            (.reg (shape.valueParams.size + count)) = .ok fields[count] := by
+          simp only [prefixValues, resolveAtom, Array.getElem?_append, Array.size_append,
+            ← parameterCount, Nat.add_lt_add_iff_left, bound, ↓reduceIte,
+            show ¬parameters.size + count < parameters.size by omega, Nat.add_sub_cancel_left,
+            Array.getElem?_eq_getElem bound]
+        have one := (InstructionTransferCase.move (context := context)
+          (interpretation := .physical) (store := store) (heapFuel := heapFuel)
+          (frame := { frame with pc := 1 + count, values := prefixValues (parameters ++ fields) fields count })
+          (stack := stack) resolved).step blockAt pc instruction
+        have advanced := before.trans (one.toSteps rfl)
+        simpa only [prefixValues_succ bound, Nat.add_assoc] using advanced
+  have allFields : (fields.toList.take shape.fieldCount).toArray = fields := by
+    rw [← fieldCount]
+    have size : fields.size = fields.toList.length := Array.length_toList.symm
+    rw [size, List.take_length]
+  simpa only [prefixValues, allFields, Nat.add_comm 1] using loop shape.fieldCount (Nat.le_refl _)
+
+theorem FrameRel.afterPrefix {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right : Frame}
+    (frames : FrameRel limits validation mapping block left right)
+    {site : Site limits validation block} (produced : inspect limits validation block = some site)
+    {leftFields rightFields : Array RVal} (fields : RValsIso (MapRel mapping) leftFields.toList rightFields.toList)
+    {credit : Credit} (layout : credit.layout = site.representation.layout) (physical : PhysicalCredit credit) :
+    FrameRel limits validation mapping block
+      { left with pc := 2 * site.shape.fieldCount + 1, values := left.values ++ leftFields ++ leftFields }
+      { right with
+        pc := site.shape.fieldCount + 1
+        values := right.values ++ rightFields ++ rightFields
+        credits := #[some credit] } := by
+  exact { frames with
+    values := by simpa only [Array.toList_append] using (frames.values.append fields).append fields
+    position := by simpa only [Nat.add_zero] using Position.body site produced 0 (Nat.zero_le _) credit layout physical
+    entryCount := by intro zero; simp only at zero; omega }
+
+theorem reset_prefix_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore retained released : Store} {leftFuel rightFuel remaining : Nat}
+    {block : Block} {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {site : Site limits validation block} {location rc : Nat} {fields : Array RVal}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (schemas : leftContext.schemas = validation.schemas)
+    (machines : MachineRel limits validation leftContext mapping
+      { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack }
+      { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack })
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (produced : inspect limits validation block = some site)
+    (leftPC : leftFrame.pc = 0) (rightPC : rightFrame.pc = 0) (credits : rightFrame.credits = #[])
+    (resolved : resolveAtom leftFrame.values (.reg site.shape.source) = .ok (.loc location))
+    (found : leftStore.get? location = some ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (retains : RetainSharedMany leftStore fields retained)
+    (releases : releaseShared leftFuel retained (.loc location) = .ok (released, remaining)) :
+    ∃ rightAfter,
+      Policy.Steps .suspendedCallsV1 rightContext .physical (site.shape.fieldCount + 1)
+        { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } rightAfter ∧
+      TransferRel limits validation leftContext mapping mapping leftStore rightStore
+        { store := released, heapFuel := remaining
+          control := .running
+            { leftFrame with
+              pc := 2 * site.shape.fieldCount + 1
+              values := leftFrame.values ++ fields ++ fields } leftStack } rightAfter := by
+  obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+  cases valueRel with
+  | @loc _ targetLocation mapped =>
+      obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+        machines.heap.constructorView mapped (ConstructorView.of_box found rfl rfl)
+      have targetBoxEq : targetBox = ⟨.shared, rc, .ctorN site.shape.sourceConstructor targetFields⟩ := by
+        have world := boxes.world
+        have count := boxes.rc
+        have node := targetView.parts.2.2
+        cases targetBox
+        simp_all
+      have targetAt := targetView.parts.1
+      rw [targetBoxEq] at targetAt
+      have targetConstructor := ConstructorView.of_box targetAt rfl rfl
+      have targetFieldCount : targetFields.size = site.shape.fieldCount := (values_size fieldsRel).symm.trans fieldCount
+      have parameterCount : rightFrame.values.size = site.shape.valueParams.size := by
+        have count := frames.entryCount leftPC
+        have sourceCount : block.valueParams.size = site.shape.valueParams.size := by
+          simp only [site.exact, Shape.baseline]
+        exact (values_size frames.values).symm.trans (count.trans sourceCount)
+      obtain ⟨sourceSchema, _, sourceAt, _, _, _, sourceLayout, _⟩ := site.schemas
+      have targetSchema : rightContext.schemas .shared site.shape.sourceConstructor = some sourceSchema := by
+        rw [← contexts.schemas, schemas]
+        exact sourceAt
+      have targetBlockAt : rightFrame.definition.blocks[rightFrame.block]? = some site.shape.target := by
+        simpa only [rewriteBlock_accepted produced] using frames.targetAt
+      have resetAt : site.shape.target.instructions[rightFrame.pc]? =
+          some (.resetShared (.reg site.shape.source) site.shape.sourceConstructor) := by
+        rw [rightPC]
+        exact site.shape.reset_at
+      obtain ⟨resetPC, resetInstruction⟩ := Array.getElem?_eq_some_iff.mp resetAt
+      have finish : ∀ (targetStore : Store) (credit : Credit),
+          credit.layout = site.representation.layout → PhysicalCredit credit →
+          Eval.Step rightContext .physical
+            { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack }
+            { store := targetStore, heapFuel := rightFuel
+              control := .running
+                { rightFrame with
+                  pc := 1
+                  values := rightFrame.values ++ targetFields
+                  credits := #[some credit] } rightStack } →
+          HeapTransition leftContext mapping mapping leftStore released rightStore targetStore →
+          ∃ rightAfter,
+            Policy.Steps .suspendedCallsV1 rightContext .physical (site.shape.fieldCount + 1)
+              { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } rightAfter ∧
+            TransferRel limits validation leftContext mapping mapping leftStore rightStore
+              { store := released, heapFuel := remaining
+                control := .running
+                  { leftFrame with
+                    pc := 2 * site.shape.fieldCount + 1
+                    values := leftFrame.values ++ fields ++ fields } leftStack } rightAfter := by
+        intro targetStore credit layout physical reset transition
+        have moves := move_prefix_control site.shape (context := rightContext)
+          (frame := { rightFrame with credits := #[some credit] })
+          (store := targetStore) (heapFuel := rightFuel) (stack := rightStack)
+          targetBlockAt parameterCount targetFieldCount
+        have actual := (reset.toSteps rfl).trans moves
+        let target : Machine :=
+          { store := targetStore, heapFuel := rightFuel
+            control := .running
+              { rightFrame with
+                pc := site.shape.fieldCount + 1
+                values := rightFrame.values ++ targetFields ++ targetFields
+                credits := #[some credit] } rightStack }
+        refine ⟨target, ?_, ⟨transition, ?_, .running (frames.afterPrefix produced fieldsRel layout physical) stack⟩⟩
+        · simpa only [Nat.add_comm 1] using Policy.of_originalSteps actual
+        · exact Nat.le_trans (ReuseSim.releaseShared_remaining_le releases) machines.fuel
+      by_cases unit : rc = 1
+      · subst rc
+        have transition := machines.heapState.hotPrefix mapped found retains releases
+        apply finish _ { layout := sourceSchema.layout, presence := .present (some targetLocation) }
+          sourceLayout.symm (.inr ⟨targetLocation, rfl⟩) _ transition
+        have reset := (InstructionTransferCase.resetSharedPhysicalHot
+          (context := rightContext) (heapFuel := rightFuel) (stack := rightStack)
+          rfl targetSchema targetResolved targetConstructor rfl).step targetBlockAt resetPC resetInstruction
+        simpa only [rightPC, credits, Nat.zero_add, Array.push_empty, ReuseSim.physicalHotResetStore] using reset
+      · have many : 1 < rc := by
+          have positive : 0 < rc := machines.ordered.rc_pos found
+          omega
+        obtain ⟨targetStore, targetRetains, transition⟩ :=
+          machines.heapState.coldPrefix mapped targetAt many fieldsRel retains releases
+        apply finish targetStore { layout := sourceSchema.layout, presence := .absent }
+          sourceLayout.symm (.inl rfl) _ transition
+        have reset := (InstructionTransferCase.resetSharedCold
+          (context := rightContext) (interpretation := .physical) (heapFuel := rightFuel) (stack := rightStack)
+          targetSchema targetResolved targetConstructor many targetRetains).step targetBlockAt resetPC resetInstruction
+        simpa only [rightPC, credits, Nat.zero_add, Array.push_empty] using reset
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReusePrefixHeap.lean b/Ix/Compiler/IxIR2/CallReusePrefixHeap.lean
new file mode 100644
index 000000000..9c01d02fb
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReusePrefixHeap.lean
@@ -0,0 +1,72 @@
+import Ix.Compiler.IxIR2.CallReusePrefixTrace
+
+/-! Hot and cold reset facts derived from the actual baseline retain/release pair. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValsIso)
+
+theorem HeapState.hotPrefix {context : Context} {mapping : Array Nat}
+    {left right retained released : Store} {leftLocation rightLocation : Nat}
+    {cid : CtorId} {fields : Array RVal} {heapFuel remaining : Nat}
+    (state : HeapState context mapping left right)
+    (mapped : MapRel mapping leftLocation rightLocation)
+    (found : left.get? leftLocation = some ⟨.shared, 1, .ctorN cid fields⟩)
+    (retains : RetainSharedMany left fields retained)
+    (releases : releaseShared heapFuel retained (.loc leftLocation) = .ok (released, remaining)) :
+    HeapTransition context mapping mapping left released right
+      (ReuseSim.physicalHotResetStore right rightLocation) := by
+  cases heapFuel with
+  | zero => simp [releaseShared, releaseSharedWork] at releases
+  | succ fuel =>
+      have contents := hotPrefix_order state.ordered found retains releases
+      have heap := (state.heap.reserve mapped found).congr contents.nodes
+        (show (ReuseSim.physicalHotResetStore right rightLocation).heap.nodes =
+          (right.reserve rightLocation).heap.nodes from rfl)
+      have retainedObs := retains.observations
+      have releasedObs := releaseShared_observations releases
+      refine ⟨⟨heap, (state.ordered.retainMany retains).releaseWork releases,
+        (state.shaped.retainMany retains).releaseWork releases⟩,
+        MapExtends.refl mapping, ⟨?_, ?_⟩, ?_⟩
+      · change right.heap.rcops + left.heap.rcops ≤ released.heap.rcops + right.heap.rcops
+        omega
+      · intro before
+        change right.peakLiveNodes ≤ released.peakLiveNodes
+        rw [releasedObs.2.2.1, retainedObs.2.2.1]
+        exact before
+      · rw [releaseSharedWork_allocationEvents releases, retains.allocationEvents]
+        change left.allocationEvents + right.allocationEvents = right.allocationEvents + left.allocationEvents
+        omega
+
+theorem HeapState.coldPrefix {context : Context} {mapping : Array Nat}
+    {left right retained released : Store} {leftLocation rightLocation rc : Nat}
+    {cid : CtorId} {leftFields rightFields : Array RVal} {heapFuel remaining : Nat}
+    (state : HeapState context mapping left right)
+    (mapped : MapRel mapping leftLocation rightLocation)
+    (rightAt : right.get? rightLocation = some ⟨.shared, rc, .ctorN cid rightFields⟩)
+    (many : 1 < rc) (fields : RValsIso (MapRel mapping) leftFields.toList rightFields.toList)
+    (retains : RetainSharedMany left leftFields retained)
+    (releases : releaseShared heapFuel retained (.loc leftLocation) = .ok (released, remaining)) :
+    ∃ rightOutput,
+      RetainSharedMany
+        (ReuseSim.coldResetStartStore right rightLocation ⟨.shared, rc, .ctorN cid rightFields⟩)
+        rightFields rightOutput ∧
+      HeapTransition context mapping mapping left released right rightOutput := by
+  cases heapFuel with
+  | zero => simp [releaseShared, releaseSharedWork] at releases
+  | succ fuel =>
+      obtain ⟨rightRetained, targetRetains, retaining⟩ := state.retainMany fields retains
+      obtain ⟨rightReleased, rightRemaining, targetReleases, _, releasing⟩ :=
+        retaining.state.releaseWork (Nat.le_refl _) (.cons (.loc mapped) .nil) releases
+      obtain ⟨retainedRC, _, commutedRelease, commutedRetain, _⟩ :=
+        ReuseSim.coldPrefix_commutes (heapFuel := fuel) rightAt many targetRetains
+      have same := Except.ok.inj (targetReleases.symm.trans commutedRelease)
+      cases same
+      have paired := retaining.trans releasing
+      refine ⟨_, commutedRetain, ⟨⟨paired.state.heap.congr rfl rfl,
+        paired.state.ordered, paired.state.shaped⟩, MapExtends.refl mapping, ?_, ?_⟩⟩
+      · exact ⟨paired.costs.rcops, paired.costs.peakLive⟩
+      · exact paired.events
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReusePrefixTrace.lean b/Ix/Compiler/IxIR2/CallReusePrefixTrace.lean
new file mode 100644
index 000000000..b6e2b5ba7
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReusePrefixTrace.lean
@@ -0,0 +1,252 @@
+import Ix.Compiler.IxIR2.CallReuseBody
+
+/-! The successful baseline execution supplies every fact needed by a reset prefix. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+
+theorem step_instruction {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {block : Block} {instruction : Instr} {target : Machine}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size) (instructionAt : block.instructions[frame.pc] = instruction)
+    (stepped : Eval.Step context interpretation { store, heapFuel, control := .running frame stack } target) :
+    InstructionTransferCase context interpretation store heapFuel frame stack instruction target := by
+  cases stepped.classify with
+  | instruction found _ atInstruction classified =>
+      have blocks := Option.some.inj (found.symm.trans blockAt)
+      cases blocks
+      have instructions := atInstruction.symm.trans instructionAt
+      cases instructions
+      exact classified
+  | terminator found atEnd _ _ =>
+      have blocks := Option.some.inj (found.symm.trans blockAt)
+      cases blocks
+      omega
+
+theorem instruction_head {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel count : Nat} {frame : Frame} {stack : List Continuation}
+    {block : Block} {instruction : Instr} {final : Machine}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (found : block.instructions[frame.pc]? = some instruction)
+    (halted : ∃ value, final.control = .halted value)
+    (steps : Eval.Steps context interpretation count
+      { store, heapFuel, control := .running frame stack } final) :
+    ∃ remaining next, count = remaining + 1 ∧
+      InstructionTransferCase context interpretation store heapFuel frame stack instruction next ∧
+      Eval.Steps context interpretation remaining next final := by
+  cases steps with
+  | refl => obtain ⟨value, impossible⟩ := halted; cases impossible
+  | cons _ head tail =>
+      obtain ⟨pc, instructionAt⟩ := Array.getElem?_eq_some_iff.mp found
+      exact ⟨_, _, rfl, step_instruction blockAt pc instructionAt head, tail⟩
+
+def prefixValues (parameters fields : Array RVal) (count : Nat) : Array RVal :=
+  parameters ++ (fields.toList.take count).toArray
+
+theorem prefixValues_succ {parameters fields : Array RVal} {count : Nat}
+    (bound : count < fields.size) :
+    (prefixValues parameters fields count).push fields[count] = prefixValues parameters fields (count + 1) := by
+  apply Array.toList_inj.mp
+  simp only [prefixValues, Array.toList_push, Array.toList_append]
+  rw [← List.take_append_getElem (l := fields.toList) (i := count) (by simpa using bound)]
+  simp [List.append_assoc]
+
+theorem resolve_parameter_append {parameters suffix : Array RVal} {source : Nat} {value : RVal}
+    (bound : source < parameters.size) (resolved : resolveAtom parameters (.reg source) = .ok value) :
+    resolveAtom (parameters ++ suffix) (.reg source) = .ok value := by
+  simpa only [resolveAtom, Array.getElem?_append_left bound] using resolved
+
+theorem fetch_prefix_inverse {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    (site : Site limits validation block) {context : Context} {definition : Function} {blockId : Nat}
+    {parameters fields : Array RVal} {store : Store} {heapFuel total : Nat} {stack : List Continuation}
+    {location : Nat} {box : NodeBox} {final : Machine}
+    (blockAt : definition.blocks[blockId]? = some block)
+    (parameterCount : parameters.size = site.shape.valueParams.size)
+    (resolved : resolveAtom parameters (.reg site.shape.source) = .ok (.loc location))
+    (boxAt : store.get? location = some box) (node : box.node = .ctorN site.shape.sourceConstructor fields)
+    (halted : ∃ value, final.control = .halted value)
+    (steps : Eval.Steps context .physical total
+      { store, heapFuel, control := .running { definition, block := blockId, values := parameters } stack } final)
+    (count : Nat) (within : count ≤ site.shape.fieldCount) :
+    ∃ remaining, total = count + remaining ∧ count ≤ fields.size ∧
+      Eval.Steps context .physical remaining
+        { store, heapFuel
+          control := .running
+            { definition, block := blockId, pc := count, values := prefixValues parameters fields count } stack } final := by
+  induction count with
+  | zero => exact ⟨total, by omega, by omega, by simpa [prefixValues] using steps⟩
+  | succ count ih =>
+      obtain ⟨remaining, totalCount, fieldBound, rest⟩ := ih (by omega)
+      have instructionAt : block.instructions[count]? =
+          some (.fetch (.reg site.shape.source) site.shape.sourceConstructor count) := by
+        simpa only [site.exact] using site.shape.fetch_at (field := count) (by omega)
+      obtain ⟨afterCount, next, remainingCount, head, tail⟩ :=
+        instruction_head blockAt instructionAt halted rest
+      cases head with
+      | @fetch _ _ _ otherLocation otherBox otherFields value sourceResolved foundBox foundNode fieldAt =>
+          have root := resolve_parameter_append
+            (suffix := (fields.toList.take count).toArray)
+            (by rw [parameterCount]; exact site.sourceBound) resolved
+          have locations := Except.ok.inj (sourceResolved.symm.trans root)
+          cases locations
+          have boxes := Option.some.inj (foundBox.symm.trans boxAt)
+          cases boxes
+          have payloads := IxIR1.Node.ctorN.inj (foundNode.symm.trans node)
+          cases payloads.2
+          obtain ⟨currentBound, valueAt⟩ := Array.getElem?_eq_some_iff.mp fieldAt
+          subst value
+          refine ⟨afterCount, by omega, by omega, ?_⟩
+          simpa only [prefixValues_succ currentBound] using tail
+
+theorem retain_suffix_inverse {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    (site : Site limits validation block) {context : Context} {definition : Function} {blockId : Nat}
+    {parameters fields : Array RVal} {store : Store} {heapFuel total : Nat} {stack : List Continuation}
+    {final : Machine} (blockAt : definition.blocks[blockId]? = some block)
+    (parameterCount : parameters.size = site.shape.valueParams.size)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (halted : ∃ value, final.control = .halted value) (remaining : List RVal) :
+    ∀ (processed : List RVal), fields.toList = processed ++ remaining →
+      Eval.Steps context .physical total
+        { store, heapFuel
+          control := .running
+            { definition, block := blockId, pc := site.shape.fieldCount + processed.length,
+              values := parameters ++ fields ++ processed.toArray } stack } final →
+      ∃ afterCount retained, total = remaining.length + afterCount ∧
+        RetainSharedMany store remaining.toArray retained ∧
+        Eval.Steps context .physical afterCount
+          { store := retained, heapFuel
+            control := .running
+              { definition, block := blockId, pc := 2 * site.shape.fieldCount,
+                values := parameters ++ fields ++ fields } stack } final := by
+  induction remaining generalizing total store with
+  | nil =>
+      intro processed split steps
+      have processedEq : processed.toArray = fields := by
+        simpa using congrArg List.toArray split.symm
+      have processedSize : processed.length = site.shape.fieldCount := by
+        simpa only [List.size_toArray, fieldCount] using congrArg Array.size processedEq
+      exact ⟨total, store, by simp, RetainSharedMany.empty store,
+        by simpa only [processedEq, processedSize, Nat.two_mul] using steps⟩
+  | cons value remaining ih =>
+      intro processed split steps
+      have within : processed.length < site.shape.fieldCount := by
+        have sizes := congrArg List.length split
+        simp only [Array.length_toList, List.length_append, List.length_cons, fieldCount] at sizes
+        omega
+      have instructionAt : block.instructions[site.shape.fieldCount + processed.length]? =
+          some (.retainShared (.reg (site.shape.valueParams.size + processed.length))) := by
+        simpa only [site.exact] using site.shape.retain_at within
+      obtain ⟨nextCount, next, totalCount, head, tail⟩ := instruction_head blockAt instructionAt halted steps
+      cases head with
+      | @retainShared _ otherValue output resolved retained =>
+          have fieldAt : fields[processed.length]? = some value := by
+            have atList : fields.toList[processed.length]? = some value := by rw [split]; simp
+            simpa using atList
+          have resolveValue : resolveAtom (parameters ++ fields ++ processed.toArray)
+              (.reg (site.shape.valueParams.size + processed.length)) = .ok value := by
+            simp only [resolveAtom, Array.getElem?_append, Array.size_append, Nat.add_lt_add_iff_left, ← parameterCount,
+              show ¬parameters.size + processed.length < parameters.size by omega,
+              show processed.length < fields.size by omega, fieldAt,
+              ↓reduceIte, Nat.add_sub_cancel_left]
+          have same := Except.ok.inj (resolved.symm.trans resolveValue)
+          subst otherValue
+          have advancedValues : (parameters ++ fields ++ processed.toArray).push value =
+              parameters ++ fields ++ (processed ++ [value]).toArray := by
+            apply Array.toList_inj.mp
+            simp
+          have nextSteps : Eval.Steps context .physical nextCount
+              { store := output, heapFuel
+                control := .running
+                  { definition, block := blockId, pc := site.shape.fieldCount + (processed ++ [value]).length,
+                    values := parameters ++ fields ++ (processed ++ [value]).toArray } stack } final := by
+            simpa [advancedValues, List.length_append, Nat.add_assoc] using tail
+          obtain ⟨afterCount, output, restCount, retainedRest, rest⟩ :=
+            ih (processed ++ [value]) (by simpa [List.append_assoc] using split) nextSteps
+          exact ⟨afterCount, output, by simp only [List.length_cons]; omega,
+            RetainSharedMany.cons retained retainedRest, rest⟩
+
+theorem baseline_prefix_trace {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    (site : Site limits validation block) {context : Context} {definition : Function} {blockId : Nat}
+    {parameters : Array RVal} {store : Store} {heapFuel total : Nat} {stack : List Continuation}
+    {final : Machine} (blockAt : definition.blocks[blockId]? = some block)
+    (parameterCount : parameters.size = site.shape.valueParams.size)
+    (schemas : context.schemas = validation.schemas) (ordered : Ordered store) (shaped : Shaped context store)
+    (halted : ∃ value, final.control = .halted value)
+    (steps : Eval.Steps context .physical total
+      { store, heapFuel, control := .running { definition, block := blockId, values := parameters } stack } final) :
+    ∃ location box fields retained released remainingFuel remainingCount,
+      resolveAtom parameters (.reg site.shape.source) = .ok (.loc location) ∧
+      store.get? location = some box ∧ box.world = .shared ∧
+      box.node = .ctorN site.shape.sourceConstructor fields ∧ fields.size = site.shape.fieldCount ∧
+      RetainSharedMany store fields retained ∧
+      releaseShared heapFuel retained (.loc location) = .ok (released, remainingFuel) ∧
+      total = 2 * site.shape.fieldCount + 1 + remainingCount ∧
+      Eval.Steps context .physical remainingCount
+        { store := released, heapFuel := remainingFuel
+          control := .running
+            { definition, block := blockId, pc := 2 * site.shape.fieldCount + 1,
+              values := parameters ++ fields ++ fields } stack } final := by
+  have firstAt : block.instructions[0]? =
+      some (.fetch (.reg site.shape.source) site.shape.sourceConstructor 0) := by
+    simpa only [site.exact] using site.shape.fetch_at site.fieldsPositive
+  obtain ⟨_, _, _, first, _⟩ := instruction_head blockAt firstAt halted steps
+  cases first with
+  | @fetch _ _ _ location box fields firstValue resolved boxAt node _ =>
+      obtain ⟨afterFetchCount, fetchCount, fieldBound, afterFetch⟩ :=
+        fetch_prefix_inverse site blockAt parameterCount resolved boxAt node halted steps
+          site.shape.fieldCount (Nat.le_refl _)
+      let opened := (fields.toList.take site.shape.fieldCount).toArray
+      have openedSize : opened.size = site.shape.fieldCount := by
+        simp only [opened, List.size_toArray, List.length_take, Array.length_toList,
+          Nat.min_eq_left fieldBound]
+      obtain ⟨afterRetainCount, retained, retainCount, retains, afterRetain⟩ :=
+        retain_suffix_inverse site (fields := opened) blockAt parameterCount openedSize halted
+          opened.toList [] (by simp) (by simpa [prefixValues, opened] using afterFetch)
+      have retainedFields : RetainSharedMany store opened retained := by simpa using retains
+      have releaseAt : block.instructions[2 * site.shape.fieldCount]? =
+          some (.releaseShared (.reg site.shape.source)) := by
+        simpa only [site.exact] using site.shape.release_at
+      obtain ⟨remainingCount, _, releaseCount, head, tail⟩ :=
+        instruction_head blockAt releaseAt halted afterRetain
+      cases head with
+      | @releaseShared _ releasedValue released remainingFuel sourceResolved releases =>
+          have root : resolveAtom (parameters ++ opened ++ opened) (.reg site.shape.source) =
+              .ok (.loc location) := by
+            simpa only [Array.append_assoc] using resolve_parameter_append
+              (suffix := opened ++ opened) (by rw [parameterCount]; exact site.sourceBound) resolved
+          have same := Except.ok.inj (sourceResolved.symm.trans root)
+          subst releasedValue
+          have avoids : ∀ value ∈ opened.toList, value ≠ .loc location := by
+            intro value member same
+            subst value
+            have original : .loc location ∈ fields.toList := by
+              exact List.mem_of_mem_take (by simpa only [opened, List.toList_toArray] using member)
+            have older := ordered.child_lt boxAt (by simpa only [node, IxIR1.Sim.nodeChildren] using original)
+            omega
+          have retainedAt := ReuseSim.RetainSharedMany.preserves_box boxAt avoids retains
+          have shared : box.world = .shared := by
+            cases heapFuel with
+            | zero => simp [releaseShared, releaseSharedWork] at releases
+            | succ fuel =>
+                by_cases same : box.world = .shared
+                · exact same
+                · simp [releaseShared, releaseSharedWork, retainedAt, same] at releases
+          obtain ⟨sourceSchema, _, sourceAt, _, schemaFields, _, _, _⟩ := site.schemas
+          have fieldCount : fields.size = site.shape.fieldCount := by
+            have arity := shaped.fields (ConstructorView.of_box boxAt shared node)
+              (by rw [schemas]; exact sourceAt)
+            simpa only [schemaFields, Array.size_replicate] using arity
+          have openedEq : opened = fields := by
+            simp only [opened, ← fieldCount]
+            have size : fields.size = fields.toList.length := Array.length_toList.symm
+            rw [size, List.take_length]
+          refine ⟨location, box, fields, retained, released, remainingFuel, remainingCount,
+            resolved, boxAt, shared, node, fieldCount, ?_, releases, ?_, ?_⟩
+          · simpa only [openedEq] using retainedFields
+          · simp only [Array.length_toList, openedSize] at retainCount
+            omega
+          · simpa only [openedEq] using tail
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseProgress.lean b/Ix/Compiler/IxIR2/CallReuseProgress.lean
new file mode 100644
index 000000000..5a8344a06
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseProgress.lean
@@ -0,0 +1,127 @@
+import Ix.Compiler.IxIR2.CallReusePrefix
+
+/-! Every synchronization point after a reset or in an unchanged block advances. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+
+theorem step_terminator {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {block : Block} {target : Machine}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (stepped : Eval.Step context interpretation { store, heapFuel, control := .running frame stack } target) :
+    TerminatorTransferCase context interpretation store heapFuel frame stack block.terminator target := by
+  cases stepped.classify with
+  | instruction found beforeEnd _ _ =>
+      have blocks := Option.some.inj (found.symm.trans blockAt)
+      cases blocks
+      omega
+  | terminator found _ atTerminator classified =>
+      have blocks := Option.some.inj (found.symm.trans blockAt)
+      cases blocks
+      simpa only [atTerminator] using classified
+
+theorem Position.entry_parts {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    {leftPC rightPC : Nat} {credits : Array (Option Credit)}
+    (position : Position limits validation block leftPC rightPC credits)
+    {site : Site limits validation block} (produced : inspect limits validation block = some site)
+    (zero : leftPC = 0) : rightPC = 0 ∧ credits = #[] := by
+  cases position with
+  | unchanged rejected cleared => rw [rejected] at produced; cases produced
+  | entry => exact ⟨rfl, rfl⟩
+  | body => omega
+  | finished => omega
+
+theorem Frame.entry_eq {frame : Frame} (pc : frame.pc = 0) (credits : frame.credits = #[]) :
+    frame = { definition := frame.definition, block := frame.block, values := frame.values } := by
+  cases frame
+  simp_all
+
+theorem stable_step_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {block : Block} {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {leftAfter : Machine}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext) (schemas : leftContext.schemas = validation.schemas)
+    (machines : MachineRel limits validation leftContext mapping
+      { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack }
+      { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack })
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (outside : leftFrame.pc ≠ 0 ∨ inspect limits validation block = none)
+    (stepped : Eval.Step leftContext .physical
+      { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack } leftAfter) :
+    ∃ after rightAfter,
+      Policy.Step .suspendedCallsV1 rightContext .physical
+        { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } rightAfter ∧
+      TransferRel limits validation leftContext mapping after leftStore rightStore leftAfter rightAfter := by
+  rcases leftFrame with ⟨leftDefinition, leftBlock, leftPC, leftValues, leftCredits⟩
+  rcases rightFrame with ⟨rightDefinition, rightBlock, rightPC, rightValues, rightCredits⟩
+  have position := frames.position
+  cases position with
+  | unchanged rejected cleared =>
+      have targetAt : rightDefinition.blocks[rightBlock]? = some block := by
+        simpa only [rewriteBlock_rejected rejected] using frames.targetAt
+      cases stepped.classify with
+      | instruction found pc instructionAt classified =>
+          have blocks := Option.some.inj (found.symm.trans frames.sourceAt)
+          cases blocks
+          have free := CreditFree.instructionAt (functionReady_creditFree frames.ready) frames.sourceAt pc
+          rw [instructionAt] at free
+          obtain ⟨after, target, targetCase, related⟩ := instruction_related contexts readyContext
+            machines.heapState machines.fuel frames stack rejected free classified
+          exact ⟨after, target, Policy.of_originalStep (targetCase.step targetAt pc instructionAt), related⟩
+      | terminator found pc terminatorAt classified =>
+          have blocks := Option.some.inj (found.symm.trans frames.sourceAt)
+          cases blocks
+          obtain ⟨after, target, targetCase, related⟩ := terminator_related contexts readyContext
+            machines.heapState machines.fuel frames stack cleared classified
+          exact ⟨after, target, Policy.of_originalStep (targetCase.step targetAt pc terminatorAt), related⟩
+  | entry site produced =>
+      rcases outside with nonzero | rejected
+      · exact False.elim (nonzero rfl)
+      · rw [rejected] at produced; cases produced
+  | body site produced offset within credit layout physical =>
+      have targetAt : rightDefinition.blocks[rightBlock]? = some site.shape.target := by
+        simpa only [rewriteBlock_accepted produced] using frames.targetAt
+      by_cases beforeAllocation : offset < site.shape.calls.size
+      · obtain ⟨call, callAt⟩ := site.call_exists beforeAllocation
+        have sourceInstruction : block.instructions[2 * site.shape.fieldCount + 1 + offset]? = some call.instruction := by
+          simp only [site.exact, site.shape.call_at beforeAllocation,
+            Array.getElem?_eq_getElem beforeAllocation, callAt]
+        have targetInstruction : site.shape.target.instructions[site.shape.fieldCount + 1 + offset]? =
+            some call.instruction := by
+          simp only [site.shape.target_call_at beforeAllocation,
+            Array.getElem?_eq_getElem beforeAllocation, callAt]
+        obtain ⟨sourcePC, sourceOpcode⟩ := Array.getElem?_eq_some_iff.mp sourceInstruction
+        obtain ⟨targetPC, targetOpcode⟩ := Array.getElem?_eq_some_iff.mp targetInstruction
+        have classified := step_instruction frames.sourceAt sourcePC sourceOpcode stepped
+        have advanced := frames.advanceBody produced beforeAllocation rfl rfl rfl layout physical
+        obtain ⟨target, targetStep, related⟩ := callInstruction_related contexts readyContext machines
+          frames advanced stack targetAt targetPC targetOpcode classified
+        exact ⟨mapping, target, targetStep, related⟩
+      · have atAllocation : offset = site.shape.calls.size := by omega
+        subst offset
+        have sourceInstruction : block.instructions[2 * site.shape.fieldCount + 1 + site.shape.calls.size]? =
+            some (.alloc .shared site.shape.allocationConstructor site.shape.allocationArguments) := by
+          simpa only [site.exact] using site.shape.alloc_at
+        obtain ⟨sourcePC, sourceOpcode⟩ := Array.getElem?_eq_some_iff.mp sourceInstruction
+        exact bodyAllocation_related contexts schemas machines frames stack produced rfl rfl rfl layout physical
+          (step_instruction frames.sourceAt sourcePC sourceOpcode stepped)
+  | finished site produced =>
+      have sourcePC : 2 * site.shape.fieldCount + site.shape.calls.size + 2 = block.instructions.size := by
+        simp only [site.exact, Shape.baseline_size]
+      have targetPC : site.shape.fieldCount + site.shape.calls.size + 2 = site.shape.target.instructions.size := by simp
+      have targetAt : rightDefinition.blocks[rightBlock]? = some site.shape.target := by
+        simpa only [rewriteBlock_accepted produced] using frames.targetAt
+      have classified := step_terminator frames.sourceAt sourcePC stepped
+      obtain ⟨after, target, targetCase, related⟩ := terminator_related contexts readyContext
+        machines.heapState machines.fuel frames stack (by simp [NoLiveCredits]) classified
+      have sameTerminator : site.shape.target.terminator = block.terminator := by
+        simp only [site.exact, Shape.target, Shape.baseline]
+      exact ⟨after, target, Policy.of_originalStep (targetCase.step targetAt targetPC sameTerminator), related⟩
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseShape.lean b/Ix/Compiler/IxIR2/CallReuseShape.lean
new file mode 100644
index 000000000..6a168ad30
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseShape.lean
@@ -0,0 +1,158 @@
+import Ix.Compiler.IxIR2.CallReuseTerminators
+
+/-! Exact instruction coordinates of the recognized source and generated block. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse
+
+@[simp] theorem Shape.fetches_size (shape : Shape) : shape.fetches.size = shape.fieldCount := by
+  simp [Shape.fetches]
+
+@[simp] theorem Shape.retains_size (shape : Shape) : shape.retains.size = shape.fieldCount := by
+  simp [Shape.retains]
+
+@[simp] theorem Shape.moves_size (shape : Shape) : shape.moves.size = shape.fieldCount := by
+  simp [Shape.moves]
+
+@[simp] theorem Shape.baseline_size (shape : Shape) :
+    shape.baseline.instructions.size = 2 * shape.fieldCount + shape.calls.size + 2 := by
+  simp [Shape.baseline]; omega
+
+@[simp] theorem Shape.target_size (shape : Shape) :
+    shape.target.instructions.size = shape.fieldCount + shape.calls.size + 2 := by
+  simp [Shape.target]; omega
+
+theorem Shape.fetch_at (shape : Shape) {field : Nat} (within : field < shape.fieldCount) :
+    shape.baseline.instructions[field]? =
+      some (.fetch (.reg shape.source) shape.sourceConstructor field) := by
+  simp (discharger := omega) [Shape.baseline, Array.getElem?_append, Shape.fetches,
+    Shape.retains, Array.getElem?_range, within]
+
+theorem Shape.retain_at (shape : Shape) {field : Nat} (within : field < shape.fieldCount) :
+    shape.baseline.instructions[shape.fieldCount + field]? =
+      some (.retainShared (.reg (shape.valueParams.size + field))) := by
+  simp (discharger := omega) [Shape.baseline, Array.getElem?_append, Shape.fetches,
+    Shape.retains, Array.getElem?_push, Array.getElem?_range, within,
+    show ¬shape.fieldCount + field < shape.fieldCount by omega,
+    show field < shape.fieldCount + 1 by omega, show field ≠ shape.fieldCount by omega]
+
+theorem Shape.release_at (shape : Shape) :
+    shape.baseline.instructions[2 * shape.fieldCount]? = some (.releaseShared (.reg shape.source)) := by
+  simp (discharger := omega) [Shape.baseline, Array.getElem?_append, Shape.fetches,
+    Shape.retains, Array.getElem?_push, Nat.two_mul]
+
+theorem Shape.call_at (shape : Shape) {offset : Nat} (within : offset < shape.calls.size) :
+    shape.baseline.instructions[2 * shape.fieldCount + 1 + offset]? = shape.calls[offset]? := by
+  simp (discharger := omega) [Shape.baseline, Array.getElem?_append, Array.getElem?_push,
+    Nat.two_mul, Nat.add_assoc,
+    show ¬shape.fieldCount + (shape.fieldCount + (1 + offset)) < shape.fieldCount by omega,
+    show shape.fieldCount + (1 + offset) - (shape.fieldCount + 1) = offset by omega,
+    show offset ≠ shape.calls.size by omega]
+
+theorem Shape.alloc_at (shape : Shape) :
+    shape.baseline.instructions[2 * shape.fieldCount + 1 + shape.calls.size]? =
+      some (.alloc .shared shape.allocationConstructor shape.allocationArguments) := by
+  simp (discharger := omega) [Shape.baseline, Array.getElem?_append, Array.getElem?_push,
+    Nat.two_mul, Nat.add_assoc,
+    show ¬shape.fieldCount + (shape.fieldCount + (1 + shape.calls.size)) < shape.fieldCount by omega,
+    show shape.fieldCount + (1 + shape.calls.size) - (shape.fieldCount + 1) = shape.calls.size by omega]
+
+theorem Shape.reset_at (shape : Shape) :
+    shape.target.instructions[0]? = some (.resetShared (.reg shape.source) shape.sourceConstructor) := by
+  simp [Shape.target, Array.getElem?_append]
+
+theorem Shape.move_at (shape : Shape) {field : Nat} (within : field < shape.fieldCount) :
+    shape.target.instructions[1 + field]? = some (.move (.reg (shape.valueParams.size + field))) := by
+  simp (discharger := omega) [Shape.target, Array.getElem?_append, Shape.moves, within,
+    Nat.add_comm 1 field, Array.getElem?_range]
+
+theorem Shape.target_call_at (shape : Shape) {offset : Nat} (within : offset < shape.calls.size) :
+    shape.target.instructions[shape.fieldCount + 1 + offset]? = shape.calls[offset]? := by
+  simp (discharger := omega) [Shape.target, Array.getElem?_append, Array.getElem?_push,
+    Nat.add_assoc, Nat.add_sub_assoc,
+    show ¬shape.fieldCount + offset < shape.fieldCount by omega,
+    show offset ≠ shape.calls.size by omega]
+
+theorem Shape.target_alloc_at (shape : Shape) :
+    shape.target.instructions[shape.fieldCount + 1 + shape.calls.size]? =
+      some (.allocWith 0 .shared shape.allocationConstructor shape.allocationArguments) := by
+  simp (discharger := omega) [Shape.target, Array.getElem?_append, Array.getElem?_push,
+    Nat.add_assoc, Nat.add_sub_assoc,
+    show ¬shape.fieldCount + shape.calls.size < shape.fieldCount by omega]
+
+theorem Site.sourceBound {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    (site : Site limits validation block) : site.shape.source < site.shape.valueParams.size :=
+  (Array.getElem?_eq_some_iff.mp site.sourceOwned).1
+
+theorem Site.schemas {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    (site : Site limits validation block) :
+    ∃ sourceSchema allocationSchema,
+      validation.schemas .shared site.shape.sourceConstructor = some sourceSchema ∧
+      validation.schemas .shared site.shape.allocationConstructor = some allocationSchema ∧
+      sourceSchema.fields = Array.replicate site.shape.fieldCount .shared ∧
+      allocationSchema.fields = sourceSchema.fields ∧
+      site.representation.layout = sourceSchema.layout ∧
+      site.representation.layout = allocationSchema.layout := by
+  obtain ⟨source, allocation, sourceAt, allocationAt, fields, allocationFields, layouts, represented⟩ :=
+    Reuse.representation?_sound site.representationProduced
+  exact ⟨source, allocation, sourceAt, allocationAt, fields, allocationFields,
+    represented, represented.trans layouts⟩
+
+theorem Site.call_exists {limits : Validate.Limits} {validation : Validate.Context} {block : Block}
+    (site : Site limits validation block) {offset : Nat} (within : offset < site.shape.calls.size) :
+    ∃ call : Eval.Policy.DirectCall, site.shape.calls[offset] = call.instruction := by
+  have checked := Array.all_eq_true.mp site.directCalls offset within
+  cases found : site.shape.calls[offset] <;>
+    simp only [found, Eval.Policy.DirectCall.ofInstruction?, Option.isSome_none, Bool.false_eq_true] at checked
+  case call address arguments => exact ⟨.function address arguments, rfl⟩
+  case callSelf arguments => exact ⟨.self arguments, rfl⟩
+
+namespace Sim
+
+open Eval
+
+theorem FrameRel.advanceBody {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right : Frame}
+    (frames : FrameRel limits validation mapping block left right)
+    {site : Site limits validation block} (produced : inspect limits validation block = some site)
+    {offset : Nat} (within : offset < site.shape.calls.size) {credit : Credit}
+    (leftPC : left.pc = 2 * site.shape.fieldCount + 1 + offset)
+    (rightPC : right.pc = site.shape.fieldCount + 1 + offset)
+    (credits : right.credits = #[some credit]) (layout : credit.layout = site.representation.layout)
+    (physical : PhysicalCredit credit) :
+    FrameRel limits validation mapping block
+      { left with pc := left.pc + 1 } { right with pc := right.pc + 1 } := by
+  exact { frames with
+    position := by
+      simp only
+      rw [leftPC, rightPC, credits]
+      simpa only [Nat.add_assoc] using Position.body site produced (offset + 1) (by omega) credit layout physical
+    entryCount := by intro zero; simp only at zero; omega }
+
+theorem TransferRel.machineRel {limits : Validate.Limits} {validation : Validate.Context}
+    {context : Context} {before after : Array Nat} {leftBefore rightBefore : Store}
+    {leftAfter rightAfter : Machine}
+    (related : TransferRel limits validation context before after leftBefore rightBefore leftAfter rightAfter)
+    (reservations : rightAfter.ReservationOwnership) :
+    MachineRel limits validation context after leftAfter rightAfter :=
+  ⟨related.transition.state.heap, related.transition.state.ordered, related.transition.state.shaped,
+    related.fuel, related.control, reservations⟩
+
+theorem FrameRel.finishBody {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right : Frame}
+    (frames : FrameRel limits validation mapping block left right)
+    {site : Site limits validation block} (produced : inspect limits validation block = some site)
+    (leftPC : left.pc = 2 * site.shape.fieldCount + 1 + site.shape.calls.size)
+    (rightPC : right.pc = site.shape.fieldCount + 1 + site.shape.calls.size) :
+    FrameRel limits validation mapping block
+      { left with pc := left.pc + 1 } { right with pc := right.pc + 1, credits := #[none] } := by
+  exact { frames with
+    position := by
+      simp only
+      rw [show left.pc + 1 = 2 * site.shape.fieldCount + site.shape.calls.size + 2 by omega,
+        show right.pc + 1 = site.shape.fieldCount + site.shape.calls.size + 2 by omega]
+      exact Position.finished site produced
+    entryCount := by intro zero; simp only at zero; omega }
+
+end Sim
+
+end Ix.Compiler.IxIR2.CallReuse
diff --git a/Ix/Compiler/IxIR2/CallReuseSimulation.lean b/Ix/Compiler/IxIR2/CallReuseSimulation.lean
new file mode 100644
index 000000000..bbe401fe3
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseSimulation.lean
@@ -0,0 +1,88 @@
+import Ix.Compiler.IxIR2.CallReuseProgress
+
+/-! Whole finite executions of the actual checked block rewrite. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+
+def Simulates (limits : Validate.Limits) (validation : Validate.Context)
+    (leftContext rightContext : Context) (mapping : Array Nat)
+    (left right final : Machine) : Prop :=
+  ∃ after targetCount targetFinal,
+    Policy.Steps .suspendedCallsV1 rightContext .physical targetCount right targetFinal ∧
+    TransferRel limits validation leftContext mapping after left.store right.store final targetFinal
+
+/-- The compiler trace reconstructs caller suspension, every callee operation,
+the reset prefixes, and final credit consumption. No root-liveness or cost
+premise is supplied at a synchronization point. -/
+theorem simulate_to_halt {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat} {left right final : Machine} {count : Nat}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext) (schemas : leftContext.schemas = validation.schemas)
+    (machines : MachineRel limits validation leftContext mapping left right)
+    (steps : Eval.Steps leftContext .physical count left final)
+    (halted : ∃ value, final.control = .halted value) :
+    Simulates limits validation leftContext rightContext mapping left right final := by
+  induction count using Nat.strongRecOn generalizing mapping left right with
+  | ind count ih =>
+      have completeSuffix : ∀ {middleCount targetCount : Nat} {nextMap : Array Nat}
+          {leftMiddle rightMiddle : Machine}, middleCount < count →
+          Eval.Steps leftContext .physical middleCount leftMiddle final →
+          Policy.Steps .suspendedCallsV1 rightContext .physical targetCount right rightMiddle →
+          TransferRel limits validation leftContext mapping nextMap left.store right.store leftMiddle rightMiddle →
+          Simulates limits validation leftContext rightContext mapping left right final := by
+        intro middleCount targetCount nextMap leftMiddle rightMiddle smaller tail targetPrefix transferred
+        have nextMachines := transferred.machineRel
+          (targetPrefix.reservationOwnership machines.reservations)
+        obtain ⟨lastMap, lastCount, targetFinal, rest, related⟩ := ih middleCount smaller nextMachines tail
+        exact ⟨lastMap, targetCount + lastCount, targetFinal, targetPrefix.trans rest,
+          ⟨transferred.transition.trans related.transition, related.fuel, related.control⟩⟩
+      rcases left with ⟨leftStore, leftFuel, leftControl⟩
+      rcases right with ⟨rightStore, rightFuel, rightControl⟩
+      cases machines.control with
+      | halted values =>
+          cases steps with
+          | refl => exact ⟨mapping, 0, _, .refl _, ⟨.refl machines.heapState, machines.fuel, .halted values⟩⟩
+          | cons running _ _ => cases running
+      | @running block leftFrame rightFrame leftStack rightStack frames stack =>
+          have ordinary : (leftFrame.pc ≠ 0 ∨ inspect limits validation block = none) →
+              Simulates limits validation leftContext rightContext mapping
+                { store := leftStore, heapFuel := leftFuel, control := .running leftFrame leftStack }
+                { store := rightStore, heapFuel := rightFuel, control := .running rightFrame rightStack } final := by
+            intro outside
+            cases steps with
+            | refl => obtain ⟨value, impossible⟩ := halted; cases impossible
+            | cons _ head tail =>
+                obtain ⟨nextMap, target, targetStep, related⟩ :=
+                  stable_step_related contexts readyContext schemas machines frames stack outside head
+                exact completeSuffix (by omega) tail (.cons rfl targetStep (.refl _)) related
+          by_cases zero : leftFrame.pc = 0
+          · cases decideBlock limits validation block with
+            | unchanged rejected => exact ordinary (.inr rejected)
+            | accepted site produced =>
+                obtain ⟨targetZero, targetCredits⟩ := frames.position.entry_parts produced zero
+                have parameterCount : leftFrame.values.size = site.shape.valueParams.size := by
+                  simpa only [site.exact, Shape.baseline] using frames.entryCount zero
+                have canonical := Frame.entry_eq zero frames.leftCredits
+                have canonicalSteps : Eval.Steps leftContext .physical count
+                    { store := leftStore, heapFuel := leftFuel
+                      control := .running
+                        { definition := leftFrame.definition, block := leftFrame.block, values := leftFrame.values }
+                        leftStack } final := by
+                  simpa only [← canonical] using steps
+                obtain ⟨location, box, fields, retained, released, remainingFuel, remainingCount,
+                    resolved, found, shared, node, fieldCount, retains, releases, counts, tail⟩ :=
+                  baseline_prefix_trace site frames.sourceAt parameterCount schemas machines.ordered
+                    machines.shaped halted canonicalSteps
+                rcases box with ⟨world, rc, payload⟩
+                dsimp only at shared node
+                subst world
+                subst payload
+                obtain ⟨target, targetPrefix, related⟩ := reset_prefix_related contexts schemas machines
+                  frames stack produced zero targetZero targetCredits resolved found fieldCount retains releases
+                apply completeSuffix (middleCount := remainingCount) (by omega) _ targetPrefix related
+                simpa only [frames.leftCredits] using tail
+          · exact ordinary (.inl zero)
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseTerminators.lean b/Ix/Compiler/IxIR2/CallReuseTerminators.lean
new file mode 100644
index 000000000..3cb31aee9
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseTerminators.lean
@@ -0,0 +1,155 @@
+import Ix.Compiler.IxIR2.CallReuseInstructions
+
+/-! CFG edges, returns, tail calls, and residual application preserve the trace relation. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+
+theorem creditTakeMany_empty {frame after : Frame} {ids : Array CreditId} {credits : Array Credit}
+    (empty : frame.credits = #[]) (taken : CreditTakeMany frame ids after credits) :
+    ids = #[] ∧ after = frame ∧ credits = #[] := by
+  have sequence := taken.sequence
+  have parts : ∀ {frame after : Frame} {ids : List CreditId} {credits : List Credit},
+      CreditTakeSequence frame ids after credits → frame.credits = #[] →
+      ids = [] ∧ after = frame ∧ credits = [] := by
+    intro frame after ids credits sequence empty
+    cases sequence with
+    | nil => exact ⟨rfl, rfl, rfl⟩
+    | cons head tail =>
+        have found := head.target_eq.2
+        simp [empty] at found
+  obtain ⟨idsEmpty, rfl, creditsEmpty⟩ := parts sequence empty
+  exact ⟨by simpa using congrArg List.toArray idsEmpty, rfl,
+    by simpa using congrArg List.toArray creditsEmpty⟩
+
+theorem edge_related {limits : Validate.Limits} {validation : Validate.Context}
+    {mapping : Array Nat} {block : Block} {left right leftAfter : Frame}
+    {edge : Edge} {leftImplicit rightImplicit : Array RVal}
+    (frames : FrameRel limits validation mapping block left right)
+    (cleared : NoLiveCredits right)
+    (implicitValues : RValsIso (MapRel mapping) leftImplicit.toList rightImplicit.toList)
+    (transferred : EdgeTransfer left edge leftImplicit leftAfter) :
+    ∃ targetBlock rightAfter, EdgeTransfer right edge rightImplicit rightAfter ∧
+      FrameRel limits validation mapping targetBlock leftAfter rightAfter := by
+  obtain ⟨values, credits, after, targetBlock, resolved, taken, _, blockAt, arity, _, rfl⟩ := transferred.parts
+  obtain ⟨idsEmpty, rfl, rfl⟩ := creditTakeMany_empty frames.leftCredits taken
+  obtain ⟨targetValues, targetResolved, valuesRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+  have targetAt : right.definition.blocks[edge.target]? =
+      some (rewriteBlock limits validation targetBlock) := by
+    rw [frames.definition]
+    exact rewriteFunction_block blockAt
+  have emptyParams := functionReady_credits frames.ready blockAt
+  have targetTake : CreditTakeMany right edge.credits right #[] := by
+    rw [idsEmpty]
+    exact (CreditTakeSequence.nil right).toMany
+  have allValues : RValsIso (MapRel mapping) (leftImplicit ++ values).toList
+      (rightImplicit ++ targetValues).toList := by
+    simpa only [Array.toList_append] using implicitValues.append valuesRel
+  refine ⟨targetBlock, _, EdgeTransfer.of_parts targetResolved targetTake cleared targetAt
+    (by rw [rewriteBlock_valueParams, ← values_size allValues]; exact arity)
+    (by simp [rewriteBlock_creditParams, emptyParams]), ?_⟩
+  have entry := FrameRel.atEntry (limits := limits) (validation := validation)
+    frames.ready blockAt allValues arity
+  simpa only [Array.map_empty, frames.definition] using entry
+
+theorem terminator_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat}
+    {block : Block} {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {terminator : Terminator} {leftAfter : Machine}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    (readyContext : ContextReady leftContext)
+    (state : HeapState leftContext mapping leftStore rightStore) (fuel : leftFuel ≤ rightFuel)
+    (frames : FrameRel limits validation mapping block leftFrame rightFrame)
+    (stack : StackRel limits validation mapping leftStack rightStack)
+    (cleared : NoLiveCredits rightFrame)
+    (classified : TerminatorTransferCase leftContext .physical leftStore leftFuel leftFrame
+      leftStack terminator leftAfter) :
+    ∃ after rightAfter,
+      TerminatorTransferCase rightContext .physical rightStore rightFuel rightFrame
+        rightStack terminator rightAfter ∧
+      TransferRel limits validation leftContext mapping after leftStore rightStore leftAfter rightAfter := by
+  cases classified with
+  | jump transferred =>
+      obtain ⟨targetBlock, rightAfter, edge, related⟩ := edge_related frames cleared .nil transferred
+      exact ⟨mapping, _, .jump edge, ⟨.refl state, fuel, .running related stack⟩⟩
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      cases valueRel with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+            state.heap.constructorView mapped (ConstructorView.of_box boxAt rfl node)
+          obtain ⟨targetBlock, rightAfter, edge, related⟩ := edge_related frames cleared .nil transferred
+          exact ⟨mapping, _, .switchCtor targetResolved targetView.parts.1 targetView.parts.2.2
+            alternativeAt edge, ⟨.refl state, fuel, .running related stack⟩⟩
+  | switchNatZero resolved transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      cases valueRel
+      obtain ⟨targetBlock, rightAfter, edge, related⟩ := edge_related frames cleared .nil transferred
+      exact ⟨mapping, _, .switchNatZero targetResolved edge, ⟨.refl state, fuel, .running related stack⟩⟩
+  | switchNatSucc resolved transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      cases valueRel
+      obtain ⟨targetBlock, rightAfter, edge, related⟩ :=
+        edge_related frames cleared (.cons .lit .nil) transferred
+      exact ⟨mapping, _, .switchNatSucc targetResolved edge, ⟨.refl state, fuel, .running related stack⟩⟩
+  | branchPresent lookedUp present transferred =>
+      have found := (CreditTake.of_lookup lookedUp).target_eq.2
+      simp [frames.leftCredits] at found
+  | branchAbsent lookedUp absent transferred =>
+      have found := (CreditTake.of_lookup lookedUp).target_eq.2
+      simp [frames.leftCredits] at found
+  | retResume resolved noCredits world =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      have targetWorld : RVal.hasWorld rightStore rightFrame.definition.signature.result targetValue = true := by
+        rw [frames.definition, rewriteFunction_signature]
+        exact state.heap.hasWorld valueRel world
+      cases stack with
+      | cons head tail =>
+          cases head with
+          | resume caller positive =>
+              exact ⟨mapping, _, .retResume targetResolved cleared targetWorld,
+                ⟨.refl state, fuel, .running (caller.pushResult positive valueRel) tail⟩⟩
+  | retHalt resolved noCredits world =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      have targetWorld : RVal.hasWorld rightStore rightFrame.definition.signature.result targetValue = true := by
+        rw [frames.definition, rewriteFunction_signature]
+        exact state.heap.hasWorld valueRel world
+      cases stack
+      exact ⟨mapping, _, .retHalt targetResolved cleared targetWorld,
+        ⟨.refl state, fuel, .halted valueRel⟩⟩
+  | retApplyMore resolved noCredits world transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      have targetWorld : RVal.hasWorld rightStore rightFrame.definition.signature.result targetValue = true := by
+        rw [frames.definition, rewriteFunction_signature]
+        exact state.heap.hasWorld valueRel world
+      cases stack with
+      | cons head tail =>
+          cases head with
+          | applyMore caller positive arguments =>
+              obtain ⟨after, target, targetApply, related⟩ := apply_related contexts readyContext state fuel
+                valueRel arguments caller positive tail transferred
+              exact ⟨after, target, .retApplyMore targetResolved cleared targetWorld targetApply, related⟩
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+      obtain ⟨entryBlock, entry⟩ := FrameRel.functionEntry (limits := limits)
+        (validation := validation) (readyContext declaration) argumentsRel arity
+      exact ⟨mapping, _, .tailCallFn cleared targetResolved (contexts.function declaration)
+        (by simpa only [rewriteFunction_signature, ← values_size argumentsRel] using arity)
+        (rewriteFunction_nonempty nonempty), ⟨.refl state, fuel, .running entry stack⟩⟩
+  | tailCallSelf noCredits resolved arity nonempty =>
+      obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+      obtain ⟨entryBlock, entry⟩ := FrameRel.functionEntry (limits := limits)
+        (validation := validation) frames.ready argumentsRel arity
+      have targetArity : targetArguments.size = rightFrame.definition.signature.params.size := by
+        simpa only [frames.definition, rewriteFunction_signature, ← values_size argumentsRel] using arity
+      have targetNonempty : rightFrame.definition.blocks.isEmpty = false := by
+        simpa only [frames.definition] using rewriteFunction_nonempty (limits := limits)
+          (context := validation) nonempty
+      refine ⟨mapping, _, .tailCallSelf cleared targetResolved targetArity targetNonempty,
+        ⟨.refl state, fuel, .running (sourceBlock := entryBlock) ?_ stack⟩⟩
+      simpa only [frames.definition] using entry
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CallReuseTransition.lean b/Ix/Compiler/IxIR2/CallReuseTransition.lean
new file mode 100644
index 000000000..de0a239fd
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CallReuseTransition.lean
@@ -0,0 +1,220 @@
+import Ix.Compiler.IxIR2.CallReuseCalls
+
+/-! Compositional heap and cost facts for corresponding executable operations. -/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Eval
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso NodeIso)
+
+def MapExtends (before after : Array Nat) : Prop :=
+  ∀ {left right}, MapRel before left right → MapRel after left right
+
+theorem MapExtends.refl (mapping : Array Nat) : MapExtends mapping mapping := fun h => h
+
+theorem MapExtends.trans {first middle last : Array Nat}
+    (one : MapExtends first middle) (two : MapExtends middle last) : MapExtends first last :=
+  fun h => two (one h)
+
+theorem MapExtends.push (mapping : Array Nat) (target : Nat) :
+    MapExtends mapping (mapping.push target) := fun h => h.push target
+
+structure HeapState (context : Context) (mapping : Array Nat) (left right : Store) : Prop where
+  heap : HeapMap left right mapping
+  ordered : Ordered left
+  shaped : Shaped context left
+
+theorem MachineRel.heapState {limits : Validate.Limits} {validation : Validate.Context}
+    {context : Context} {mapping : Array Nat} {left right : Machine}
+    (machines : MachineRel limits validation context mapping left right) :
+    HeapState context mapping left.store right.store :=
+  ⟨machines.heap, machines.ordered, machines.shaped⟩
+
+structure HeapTransition (context : Context) (before after : Array Nat)
+    (leftBefore leftAfter rightBefore rightAfter : Store) : Prop where
+  state : HeapState context after leftAfter rightAfter
+  extension : MapExtends before after
+  costs : CostDelta leftBefore leftAfter rightBefore rightAfter
+  events : leftAfter.allocationEvents + rightBefore.allocationEvents =
+    rightAfter.allocationEvents + leftBefore.allocationEvents
+
+theorem HeapTransition.refl {context : Context} {mapping : Array Nat} {left right : Store}
+    (state : HeapState context mapping left right) :
+    HeapTransition context mapping mapping left left right right :=
+  ⟨state, MapExtends.refl mapping, .refl left right, by omega⟩
+
+theorem HeapTransition.trans {context : Context} {first middle last : Array Nat}
+    {l₀ l₁ l₂ r₀ r₁ r₂ : Store}
+    (one : HeapTransition context first middle l₀ l₁ r₀ r₁)
+    (two : HeapTransition context middle last l₁ l₂ r₁ r₂) :
+    HeapTransition context first last l₀ l₂ r₀ r₂ :=
+  ⟨two.state, MapExtends.trans one.extension two.extension, one.costs.trans two.costs,
+    by have _ := one.events; have _ := two.events; omega⟩
+
+theorem HeapState.alloc {context : Context} {mapping : Array Nat} {left right : Store}
+    (state : HeapState context mapping left right) {world : Owned} {leftNode rightNode : Node}
+    (nodes : NodeIso (MapRel mapping) leftNode rightNode)
+    (shaped : ShapedNode context world leftNode) :
+    HeapTransition context mapping (mapping.push right.heap.nodes.size)
+      left (left.allocNode world leftNode).1 right (right.allocNode world rightNode).1 := by
+  have heap := state.heap.alloc (world := world) nodes
+  refine ⟨⟨heap, state.ordered.alloc state.heap nodes, state.shaped.alloc shaped⟩,
+    MapExtends.push mapping right.heap.nodes.size, ?_, by simp; omega⟩
+  apply state.heap.costDelta heap (events := 1)
+    (charge := if world = .shared then 1 else 0)
+  · cases world <;> simp
+  · cases world <;> simp
+  · rfl
+  · rfl
+
+theorem HeapState.retain {context : Context} {mapping : Array Nat} {left right leftOut : Store}
+    (state : HeapState context mapping left right) {leftValue rightValue : RVal}
+    (values : RValIso (MapRel mapping) leftValue rightValue)
+    (run : retainShared left leftValue = .ok leftOut) :
+    ∃ rightOut, retainShared right rightValue = .ok rightOut ∧
+      HeapTransition context mapping mapping left leftOut right rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.retain values run
+  have leftObs := retainShared_observations run
+  have rightObs := retainShared_observations targetRun
+  have refs : referenceCount leftValue = referenceCount rightValue := by cases values <;> rfl
+  refine ⟨rightOut, targetRun, ⟨⟨heap, state.ordered.retain run, state.shaped.retain run⟩,
+    MapExtends.refl mapping, ?_, ?_⟩⟩
+  · apply state.heap.costDelta heap (events := 0) (charge := 2 * (referenceCount leftValue : Int))
+    · omega
+    · omega
+    · exact leftObs.2.2.1
+    · exact rightObs.2.2.1
+  · rw [retainShared_allocationEvents run, retainShared_allocationEvents targetRun]
+    omega
+
+theorem HeapState.reuse {context : Context} {mapping : Array Nat} {left right rightOut : Store}
+    (state : HeapState context mapping left right) {world : Owned} {leftNode rightNode : Node}
+    {location payload : Nat} (nodes : NodeIso (MapRel mapping) leftNode rightNode)
+    (shaped : ShapedNode context world leftNode)
+    (run : right.reuseReservation location world rightNode payload = .ok rightOut) :
+    HeapTransition context mapping (mapping.push location)
+      left (left.allocNode world leftNode).1 right rightOut := by
+  have heap := state.heap.reuse nodes run
+  have observed := Store.reuseReservation_observations run
+  refine ⟨⟨heap, state.ordered.alloc state.heap nodes, state.shaped.alloc shaped⟩,
+    MapExtends.push mapping location, ?_, ?_⟩
+  · apply state.heap.costDelta heap (events := 1)
+      (charge := if world = .shared then 1 else 0)
+    · cases world <;> simp
+    · have potential := observed.2.1
+      cases world <;> simp_all
+    · rfl
+    · exact observed.2.2.1
+  · rw [Store.allocationEvents_allocNode, Store.reuseReservation_allocationEvents run]
+    omega
+
+theorem HeapState.retainMany {context : Context} {mapping : Array Nat} {left right leftOut : Store}
+    (state : HeapState context mapping left right) {leftValues rightValues : Array RVal}
+    (values : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (run : RetainSharedMany left leftValues leftOut) :
+    ∃ rightOut, RetainSharedMany right rightValues rightOut ∧
+      HeapTransition context mapping mapping left leftOut right rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.retainMany values run
+  have leftObs := run.observations
+  have rightObs := targetRun.observations
+  have refs := referenceCountList_iso values
+  refine ⟨rightOut, targetRun, ⟨⟨heap, state.ordered.retainMany run, state.shaped.retainMany run⟩,
+    MapExtends.refl mapping, ?_, ?_⟩⟩
+  · apply state.heap.costDelta heap (events := 0)
+      (charge := 2 * (referenceCountList leftValues.toList : Int))
+    · omega
+    · omega
+    · exact leftObs.2.2.1
+    · exact rightObs.2.2.1
+  · rw [run.allocationEvents, targetRun.allocationEvents]
+    omega
+
+theorem HeapState.releaseWork {context : Context} {mapping : Array Nat}
+    {left right leftOut : Store} {leftFuel rightFuel leftRemaining : Nat}
+    (state : HeapState context mapping left right) (fuel : leftFuel ≤ rightFuel)
+    {leftValues rightValues : List RVal} (values : RValsIso (MapRel mapping) leftValues rightValues)
+    (run : releaseSharedWork leftFuel left leftValues = .ok (leftOut, leftRemaining)) :
+    ∃ rightOut rightRemaining,
+      releaseSharedWork rightFuel right rightValues = .ok (rightOut, rightRemaining) ∧
+      leftRemaining ≤ rightRemaining ∧
+      HeapTransition context mapping mapping left leftOut right rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.releaseWork values run
+  have raised := releaseSharedWork_addFuel targetRun (rightFuel - leftFuel)
+  rw [Nat.add_sub_of_le fuel] at raised
+  have leftObs := releaseSharedWork_observations run
+  have rightObs := releaseSharedWork_observations targetRun
+  refine ⟨rightOut, leftRemaining + (rightFuel - leftFuel), raised, by omega,
+    ⟨⟨heap, state.ordered.releaseWork run, state.shaped.releaseWork run⟩, MapExtends.refl mapping, ?_, ?_⟩⟩
+  · apply state.heap.costDelta heap (events := 0) (charge := 0)
+    · omega
+    · omega
+    · exact leftObs.2.2.1
+    · exact rightObs.2.2.1
+  · rw [releaseSharedWork_allocationEvents run, releaseSharedWork_allocationEvents targetRun]
+    omega
+
+theorem HeapState.dropWork {context : Context} {mapping : Array Nat}
+    {left right leftOut : Store} {leftFuel rightFuel leftRemaining : Nat}
+    (state : HeapState context mapping left right) (fuel : leftFuel ≤ rightFuel)
+    {leftValues rightValues : List RVal} (values : RValsIso (MapRel mapping) leftValues rightValues)
+    (run : dropUniqueWork leftFuel left leftValues = .ok (leftOut, leftRemaining)) :
+    ∃ rightOut rightRemaining,
+      dropUniqueWork rightFuel right rightValues = .ok (rightOut, rightRemaining) ∧
+      leftRemaining ≤ rightRemaining ∧
+      HeapTransition context mapping mapping left leftOut right rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.dropWork values run
+  have raised := dropUniqueWork_addFuel targetRun (rightFuel - leftFuel)
+  rw [Nat.add_sub_of_le fuel] at raised
+  have leftObs := dropUniqueWork_observations run
+  have rightObs := dropUniqueWork_observations targetRun
+  refine ⟨rightOut, leftRemaining + (rightFuel - leftFuel), raised, by omega,
+    ⟨⟨heap, state.ordered.dropWork run, state.shaped.dropWork run⟩, MapExtends.refl mapping, ?_, ?_⟩⟩
+  · apply state.heap.costDelta heap (events := 0) (charge := 0)
+    · omega
+    · omega
+    · exact leftObs.2.2.1
+    · exact rightObs.2.2.1
+  · rw [dropUniqueWork_allocationEvents run, dropUniqueWork_allocationEvents targetRun]
+    omega
+
+theorem HeapState.freeUnique {context : Context} {mapping : Array Nat} {left right : Store}
+    (state : HeapState context mapping left right) {l r : Nat} {box : NodeBox}
+    (mapped : MapRel mapping l r) (found : left.get? l = some box) :
+    HeapTransition context mapping mapping left (left.kill l) right (right.kill r) := by
+  have heap := state.heap.kill mapped found
+  refine ⟨⟨heap, state.ordered.kill found, state.shaped.kill found⟩, MapExtends.refl mapping,
+    ⟨by change right.heap.rcops + left.heap.rcops ≤ left.heap.rcops + right.heap.rcops; omega,
+      fun bound => bound⟩, by simp; omega⟩
+
+theorem values_size {mapping : Array Nat} {left right : Array RVal}
+    (related : RValsIso (MapRel mapping) left.toList right.toList) : left.size = right.size :=
+  by simpa using related.lengths
+
+theorem values_extract {mapping : Array Nat} {left right : Array RVal}
+    (related : RValsIso (MapRel mapping) left.toList right.toList) (start stop : Nat) :
+    RValsIso (MapRel mapping) (left.extract start stop).toList (right.extract start stop).toList := by
+  simp only [Array.toList_extract, List.extract_eq_take_drop]
+  exact (related.drop start).take (stop - start)
+
+theorem scalarOracle_related {limits : Validate.Limits} {validation : Validate.Context}
+    {leftContext rightContext : Context} {mapping : Array Nat}
+    (contexts : ContextRel limits validation leftContext rightContext)
+    {left right : Array RVal} {address : Ixon.Address} {value : RVal}
+    (values : RValsIso (MapRel mapping) left.toList right.toList)
+    (called : ScalarOracleCall leftContext address left value) :
+    ScalarOracleCall rightContext address right value ∧ RValIso (MapRel mapping) value value := by
+  obtain ⟨inputs, result⟩ := called.scalar
+  have scalar : (left.toList.all IxIR1.RVal.isScalar) = true := by
+    rw [Array.all_toList]
+    apply Array.all_eq_true.mpr
+    intro i bound
+    have valid := Array.all_eq_true.mp inputs i bound
+    cases valueAt : left[i] <;> simp_all only [RVal.isScalar, IxIR1.RVal.isScalar]
+  have equal := values.eq_of_allScalar scalar
+  have same : left = right := Array.toList_inj.mp equal
+  subst right
+  refine ⟨called.congrOracle contexts.oracle, ?_⟩
+  cases value <;> simp_all [RVal.isScalar] <;> constructor
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/CostObservations.lean b/Ix/Compiler/IxIR2/CostObservations.lean
new file mode 100644
index 000000000..58a7c10d5
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CostObservations.lean
@@ -0,0 +1,470 @@
+import Ix.Compiler.IxIR1.RcPotential
+import Ix.Compiler.IxIR2.AllocationEvents
+
+/-!
+# RC and peak-live observations of actual heap operations
+
+The shared-reference potential is the existing IxIR₁ cost algebra. These
+observations remain independent of semantic heap and value correspondence.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1 (Node NodeBox RVal)
+open Ix.Compiler.IxIR1.CostTrace
+
+def Store.pendingRC (store : Store) : Nat := sharedRcPotential store.heap
+
+def Store.amortizedRC (store : Store) : Nat := amortizedRc store.heap
+
+def referenceCount : RVal → Nat
+  | .loc _ => 1
+  | _ => 0
+
+def referenceCountList : List RVal → Nat
+  | [] => 0
+  | value :: rest => referenceCount value + referenceCountList rest
+
+theorem referenceCountList_iso {locRel : Nat → Nat → Prop}
+    {left right : List RVal} (values : IxIR1.Sim.RValsIso locRel left right) :
+    referenceCountList left = referenceCountList right := by
+  induction values with
+  | nil => rfl
+  | cons head tail ih => cases head <;> simp [referenceCountList, referenceCount, ih]
+
+@[simp] theorem Store.amortizedRC_allocNode (store : Store) (world : Owned) (node : Node) :
+    (store.allocNode world node).1.amortizedRC =
+      store.amortizedRC + (if world = .shared then 1 else 0) := by
+  cases world <;> simp [Store.amortizedRC, amortizedRc, sharedRcPotential,
+    sharedRcPotentialList_append, sharedRcPotentialList, slotSharedRcPotential,
+    IxIR1.Store.allocNode] <;> omega
+
+@[simp] theorem Store.peakLive_allocNode (store : Store) (world : Owned) (node : Node) :
+    (store.allocNode world node).1.peakLiveNodes =
+      max store.peakLiveNodes (store.allocNode world node).1.live := rfl
+
+@[simp] theorem Store.rcops_allocNode (store : Store) (world : Owned) (node : Node) :
+    (store.allocNode world node).1.heap.rcops = store.heap.rcops := rfl
+
+theorem retainShared_observations {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) :
+    output.heap.rcops = store.heap.rcops + referenceCount value ∧
+    output.amortizedRC = store.amortizedRC + 2 * referenceCount value ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live = store.live := by
+  cases value with
+  | lit literal => cases run; exact ⟨rfl, rfl, rfl, rfl⟩
+  | erased => cases run; exact ⟨rfl, rfl, rfl, rfl⟩
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp [retainShared, found, shared] at run
+            subst output
+            have rc := amortizedRc_incRcStore (store := store.heap)
+              (location := location) (rc := box.rc) (node := box.node)
+              (by rcases box with ⟨world, rc, node⟩; dsimp at shared; subst world; exact found)
+            refine ⟨rfl, ?_, rfl, ?_⟩
+            · simpa [Store.amortizedRC, IxIR1.Sim.incRcStore, Store.rcTick,
+                Store.setBox, referenceCount, shared] using rc
+            · exact Store.live_setBox found
+          · simp [retainShared, found, shared] at run
+
+theorem RetainSharedMany.observations {store output : Store} {values : Array RVal}
+    (run : RetainSharedMany store values output) :
+    output.heap.rcops = store.heap.rcops + referenceCountList values.toList ∧
+    output.amortizedRC = store.amortizedRC + 2 * referenceCountList values.toList ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live = store.live := by
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  have loop : ∀ (values : List RVal) {store output : Store},
+      values.foldlM retainShared store = .ok output →
+        output.heap.rcops = store.heap.rcops + referenceCountList values ∧
+        output.amortizedRC = store.amortizedRC + 2 * referenceCountList values ∧
+        output.peakLiveNodes = store.peakLiveNodes ∧ output.live = store.live := by
+    intro values
+    induction values with
+    | nil => intro store output run; cases run; exact ⟨rfl, rfl, rfl, rfl⟩
+    | cons value rest ih =>
+        intro store output run
+        rw [List.foldlM_cons] at run
+        cases head : retainShared store value with
+        | error error => simp [head, bind, Except.bind] at run
+        | ok middle =>
+            simp only [head, bind, Except.bind] at run
+            obtain ⟨firstRC, firstPotential, firstPeak, firstLive⟩ := retainShared_observations head
+            obtain ⟨tailRC, tailPotential, tailPeak, tailLive⟩ := ih run
+            simp only [referenceCountList]
+            exact ⟨by omega, by omega, tailPeak.trans firstPeak, tailLive.trans firstLive⟩
+  exact loop values.toList run
+
+theorem releaseSharedWork_observations {fuel remaining : Nat}
+    {store output : Store} {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    store.heap.rcops ≤ output.heap.rcops ∧ output.amortizedRC = store.amortizedRC ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live ≤ store.live := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact ⟨Nat.le_refl _, rfl, rfl, Nat.le_refl _⟩
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact ⟨Nat.le_refl _, rfl, rfl, Nat.le_refl _⟩
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true,
+                          Nat.reduceBEq] at run
+                        obtain ⟨rc, potential, peak, live⟩ := ih run
+                        have conserved := amortizedRc_tickKillSharedOne
+                          (store := store.heap) (location := location) (node := box.node)
+                          (by rcases box with ⟨world, rc, node⟩
+                              dsimp at shared unitRC; subst world; subst rc; exact found)
+                        have removed := Store.live_kill (store := store.rcTick) found
+                        refine ⟨?_, potential.trans ?_, peak, ?_⟩
+                        · change store.heap.rcops + 1 ≤ output.heap.rcops at rc; omega
+                        · simpa [Store.amortizedRC, Store.kill, Store.rcTick] using conserved
+                        · change (store.rcTick.kill location).live + 1 = store.live at removed
+                          omega
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        obtain ⟨rc, potential, peak, live⟩ := ih run
+                        have conserved := amortizedRc_decRcStore
+                          (store := store.heap) (location := location) (rc := box.rc)
+                          (node := box.node) (by omega)
+                          (by rcases box with ⟨world, rc, node⟩
+                              dsimp at shared; subst world; exact found)
+                        have unchanged := Store.live_setBox (store := store.rcTick)
+                          (new := ⟨.shared, box.rc - 1, box.node⟩) found
+                        refine ⟨?_, potential.trans ?_, peak, ?_⟩
+                        · change store.heap.rcops + 1 ≤ output.heap.rcops at rc; omega
+                        · simpa [Store.amortizedRC, IxIR1.Sim.decRcStore, Store.setBox,
+                            Store.rcTick] using conserved
+                        · change (store.rcTick.setBox location _).live = store.live at unchanged
+                          omega
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem releaseShared_observations {fuel remaining : Nat} {store output : Store} {value : RVal}
+    (run : releaseShared fuel store value = .ok (output, remaining)) :
+    store.heap.rcops ≤ output.heap.rcops ∧ output.amortizedRC = store.amortizedRC ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live ≤ store.live :=
+  releaseSharedWork_observations run
+
+theorem dropUniqueWork_observations {fuel remaining : Nat}
+    {store output : Store} {values : List RVal}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) :
+    output.heap.rcops = store.heap.rcops ∧ output.amortizedRC = store.amortizedRC ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live ≤ store.live := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact ⟨rfl, rfl, rfl, Nat.le_refl _⟩
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact ⟨rfl, rfl, rfl, Nat.le_refl _⟩
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN address arity captured => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        obtain ⟨rc, potential, peak, live⟩ := ih run
+                        have conserved := amortizedRc_killUnique
+                          (store := store.heap) (location := location) (rc := box.rc)
+                          (node := box.node)
+                          (by rcases box with ⟨world, rc, node⟩
+                              dsimp at unique; subst world; exact found)
+                        have removed := Store.live_kill found
+                        refine ⟨rc, potential.trans ?_, peak, by omega⟩
+                        simpa [Store.amortizedRC, Store.kill] using conserved
+                  · simp [dropUniqueWork, found, unique] at run
+
+theorem dropUnique_observations {fuel remaining : Nat} {store output : Store} {value : RVal}
+    (run : dropUnique fuel store value = .ok (output, remaining)) :
+    output.heap.rcops = store.heap.rcops ∧ output.amortizedRC = store.amortizedRC ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live ≤ store.live :=
+  dropUniqueWork_observations run
+
+@[simp] theorem Store.amortizedRC_tickResetAttempt (store : Store) :
+    store.tickResetAttempt.amortizedRC = store.amortizedRC := rfl
+
+@[simp] theorem Store.amortizedRC_tickHotReset (store : Store) :
+    store.tickHotReset.amortizedRC = store.amortizedRC := rfl
+
+@[simp] theorem Store.amortizedRC_tickColdReset (store : Store) :
+    store.tickColdReset.amortizedRC = store.amortizedRC := rfl
+
+theorem Store.amortizedRC_kill {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    (store.kill location).amortizedRC + slotSharedRcPotential (some box) =
+      store.amortizedRC := by
+  have removed := sharedRcPotential_kill (store := store.heap) found
+  unfold Store.amortizedRC amortizedRc
+  change store.heap.rcops + sharedRcPotential (store.heap.kill location) + _ = _
+  omega
+
+theorem Store.amortizedRC_reserve {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    (store.reserve location).amortizedRC + slotSharedRcPotential (some box) =
+      store.amortizedRC := by
+  have removed := Store.amortizedRC_kill found
+  simpa [Store.amortizedRC, amortizedRc, sharedRcPotential, Store.reserve,
+    Store.kill, IxIR1.Store.kill, IxIR1.Store.setBox] using removed
+
+theorem Store.amortizedRC_decrement {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (shared : box.world = .shared)
+    (many : 1 < box.rc) :
+    ((store.setBox location { box with rc := box.rc - 1 }).rcTick).amortizedRC =
+      store.amortizedRC := by
+  have changed := sharedRcPotential_setBox (store := store.heap)
+    (new := { box with rc := box.rc - 1 }) found
+  have slot : slotSharedRcPotential (some box) = box.rc := by
+    rcases box with ⟨world, rc, node⟩
+    dsimp at shared
+    subst world
+    rfl
+  rw [slot] at changed
+  simp only [slotSharedRcPotential, shared] at changed
+  unfold Store.amortizedRC amortizedRc
+  change store.heap.rcops + 1 + sharedRcPotential (store.heap.setBox location _) = _
+  simp only [shared]
+  omega
+
+theorem Store.releaseReservation_observations {store output : Store} {location : Nat}
+    (run : store.releaseReservation location = .ok output) :
+    output.heap.rcops = store.heap.rcops ∧ output.amortizedRC = store.amortizedRC ∧
+    output.peakLiveNodes = store.peakLiveNodes ∧ output.live = store.live := by
+  cases found : store.heap.nodes[location]? with
+  | none => simp [Store.releaseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box => simp [Store.releaseReservation, found] at run
+      | none =>
+          simp only [Store.releaseReservation, found, Except.ok.injEq] at run
+          subst output
+          exact ⟨rfl, rfl, rfl, rfl⟩
+
+theorem Store.reuseReservation_observations {store output : Store}
+    {location payloadUnits : Nat} {world : Owned} {node : Node}
+    (run : store.reuseReservation location world node payloadUnits = .ok output) :
+    output.heap.rcops = store.heap.rcops ∧
+    output.amortizedRC = store.amortizedRC + (if world = .shared then 1 else 0) ∧
+    output.peakLiveNodes = max store.peakLiveNodes output.live ∧
+    output.live = store.live + 1 := by
+  have live := (Store.reuseReservation_accounting run).1
+  cases found : store.heap.nodes[location]? with
+  | none => simp [Store.reuseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box => simp [Store.reuseReservation, found] at run
+      | none =>
+          simp only [Store.reuseReservation, found, Except.ok.injEq] at run
+          subst output
+          refine ⟨rfl, ?_, rfl, live⟩
+          have changed := sharedRcPotentialList_set
+            (new := some (NodeBox.mk world 1 node))
+            (show store.heap.nodes.toList[location]? = some none by simpa using found)
+          cases world <;>
+            simp only [slotSharedRcPotential, Nat.add_zero] at changed <;>
+            simp [Store.amortizedRC, amortizedRc, sharedRcPotential, changed,
+              Array.toList_setIfInBounds, Nat.add_assoc]
+
+/-- RC work performed by dynamic application, including the outstanding
+references it creates. Deep release is already included by conservation. -/
+def applyRCCharge (store : Store) (function : RVal) (arguments : Array RVal) : Int :=
+  match function with
+  | .loc location =>
+      match store.get? location with
+      | some box =>
+          match box.node with
+          | .papN _ _ captured =>
+              2 * (referenceCountList captured.toList : Int) +
+                (applyAllocationEvents store function arguments : Int)
+          | _ => 0
+      | none => 0
+  | _ => 0
+
+theorem applyRCCharge_history {baseline rewritten : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.heap rewritten.heap)
+    {baselineFunction rewrittenFunction : RVal}
+    {baselineArguments rewrittenArguments : Array RVal}
+    (function : IxIR1.Sim.RValIso heap.locRel baselineFunction rewrittenFunction)
+    (argumentCount : baselineArguments.size = rewrittenArguments.size) :
+    applyRCCharge baseline baselineFunction baselineArguments =
+      applyRCCharge rewritten rewrittenFunction rewrittenArguments := by
+  have allocations := applyAllocationEvents_history heap function argumentCount
+  cases function with
+  | lit => rfl
+  | erased => rfl
+  | loc locations =>
+      rcases heap.related locations with ⟨leftDead, rightDead⟩ |
+        ⟨leftBox, rightBox, leftAt, rightAt, boxes⟩
+      · simp [applyRCCharge, Store.get?, leftDead, rightDead]
+      · simp only [applyRCCharge, Store.get?, leftAt, rightAt]
+        have nodes := boxes.node
+        generalize leftBox.node = leftNode at nodes ⊢
+        generalize rightBox.node = rightNode at nodes ⊢
+        cases nodes with
+        | ctor fields => rfl
+        | pap captured => simp only [referenceCountList_iso captured, allocations]
+
+theorem ApplyTransferCase.rcCharge {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) :
+    (target.store.amortizedRC : Int) = store.amortizedRC +
+      applyRCCharge store function arguments := by
+  cases classified with
+  | erased released =>
+      have conserved := (releaseSharedWork_observations released).2.1
+      simpa only [applyRCCharge, Int.add_zero] using congrArg (fun n : Nat => (n : Int)) conserved
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      have first := retained.observations.2.1
+      have second := (releaseSharedWork_observations released).2.1
+      simp only [applyRCCharge, boxAt, node, applyAllocationEvents, totalUnder,
+        ↓reduceIte, Store.amortizedRC_allocNode, Int.natCast_add]
+      omega
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      have first := retained.observations.2.1
+      have second := (releaseSharedWork_observations released).2.1
+      simp only [applyRCCharge, boxAt, node, applyAllocationEvents,
+        Nat.not_lt.mpr totalEnough, ↓reduceIte, Int.natCast_zero, Int.add_zero]
+      omega
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      have first := retained.observations.2.1
+      have second := (releaseSharedWork_observations released).2.1
+      simp only [applyRCCharge, boxAt, node, applyAllocationEvents,
+        Nat.not_lt.mpr totalEnough, ↓reduceIte, Int.natCast_zero, Int.add_zero]
+      omega
+
+theorem ApplyTransferCase.peakLive {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) :
+    target.store.peakLiveNodes =
+      if applyAllocationEvents store function arguments = 0 then store.peakLiveNodes
+      else max store.peakLiveNodes target.store.live := by
+  cases classified with
+  | erased released => exact (releaseSharedWork_observations released).2.2.1
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      have first := retained.observations.2.2.1
+      have second := (releaseSharedWork_observations released).2.2.1
+      simp only [applyAllocationEvents, boxAt, node, totalUnder, ↓reduceIte,
+        Nat.one_ne_zero, Store.peakLive_allocNode, second, first]
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      have first := retained.observations.2.2.1
+      have second := (releaseSharedWork_observations released).2.2.1
+      simp only [applyAllocationEvents, boxAt, node, Nat.not_lt.mpr totalEnough,
+        ↓reduceIte, second, first]
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      have first := retained.observations.2.2.1
+      have second := (releaseSharedWork_observations released).2.2.1
+      simp only [applyAllocationEvents, boxAt, node, Nat.not_lt.mpr totalEnough,
+        ↓reduceIte, second, first]
+
+theorem ApplyTransferCase.live_le {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) :
+    target.store.live ≤ store.live + applyAllocationEvents store function arguments := by
+  cases classified with
+  | erased released => exact (releaseSharedWork_observations released).2.2.2
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      have first := retained.observations.2.2.2
+      have second := (releaseSharedWork_observations released).2.2.2
+      simp only [applyAllocationEvents, boxAt, node, totalUnder, ↓reduceIte,
+        Store.live_allocNode]
+      omega
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      have first := retained.observations.2.2.2
+      have second := (releaseSharedWork_observations released).2.2.2
+      simp only [applyAllocationEvents, boxAt, node, Nat.not_lt.mpr totalEnough,
+        ↓reduceIte, Nat.add_zero]
+      omega
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      have first := retained.observations.2.2.2
+      have second := (releaseSharedWork_observations released).2.2.2
+      simp only [applyAllocationEvents, boxAt, node, Nat.not_lt.mpr totalEnough,
+        ↓reduceIte, Nat.add_zero]
+      omega
+
+theorem ApplyTransfer.rcCharge {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) :
+    (target.store.amortizedRC : Int) = store.amortizedRC +
+      applyRCCharge store function arguments := transferred.classify.rcCharge
+
+theorem ApplyTransfer.peakLive {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) :
+    target.store.peakLiveNodes =
+      if applyAllocationEvents store function arguments = 0 then store.peakLiveNodes
+      else max store.peakLiveNodes target.store.live := transferred.classify.peakLive
+
+theorem ApplyTransfer.live_le {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) :
+    target.store.live ≤ store.live + applyAllocationEvents store function arguments :=
+  transferred.classify.live_le
+
+theorem ApplyTransfer.rcops_mono {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) : store.heap.rcops ≤ target.store.heap.rcops := by
+  cases transferred.classify with
+  | erased released => exact (releaseSharedWork_observations released).1
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      have first := retained.observations.1
+      have second := (releaseSharedWork_observations released).1
+      simp only [Store.rcops_allocNode]
+      omega
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      have first := retained.observations.1
+      have second := (releaseSharedWork_observations released).1
+      dsimp only
+      omega
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      have first := retained.observations.1
+      have second := (releaseSharedWork_observations released).1
+      dsimp only
+      omega
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/CostSteps.lean b/Ix/Compiler/IxIR2/CostSteps.lean
new file mode 100644
index 000000000..aa9a243a7
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CostSteps.lean
@@ -0,0 +1,371 @@
+import Ix.Compiler.IxIR2.CostObservations
+
+/-!
+# RC charges and peak observations of successful machine steps
+
+Every allocation occurs at the end of its heap operation. The exact peak
+equation therefore includes all internal heap work, even for dynamic apply.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.IxIR1.CostTrace
+
+private theorem slotSharedRC (box : NodeBox) :
+    slotSharedRcPotential (some box) = if box.world = .shared then box.rc else 0 := by
+  rcases box with ⟨world, rc, node⟩
+  cases world <;> rfl
+
+def resetRCCharge (store : Store) : RVal → Int
+  | .loc location =>
+      match store.get? location with
+      | some box =>
+          if box.rc = 1 then -1
+          else match box.node with
+            | .ctorN _ fields => 2 * (referenceCountList fields.toList : Int)
+            | _ => 0
+      | none => 0
+  | _ => 0
+
+theorem resetRCCharge_history {baseline rewritten : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.heap rewritten.heap)
+    {baselineValue rewrittenValue : RVal}
+    (values : IxIR1.Sim.RValIso heap.locRel baselineValue rewrittenValue) :
+    resetRCCharge baseline baselineValue = resetRCCharge rewritten rewrittenValue := by
+  cases values with
+  | lit => rfl
+  | erased => rfl
+  | loc locations =>
+      rcases heap.related locations with ⟨leftDead, rightDead⟩ |
+        ⟨leftBox, rightBox, leftAt, rightAt, boxes⟩
+      · simp [resetRCCharge, Store.get?, leftDead, rightDead]
+      · simp only [resetRCCharge, Store.get?, leftAt, rightAt, boxes.rc]
+        have nodes := boxes.node
+        generalize leftBox.node = leftNode at nodes ⊢
+        generalize rightBox.node = rightNode at nodes ⊢
+        cases nodes with
+        | ctor fields => simp only [referenceCountList_iso fields]
+        | pap captured => rfl
+
+def instructionRCCharge (store : Store) (frame : Frame) : Instr → Int
+  | .alloc world .. | .allocWith _ world .. => if world = .shared then 1 else 0
+  | .papp .. => 1
+  | .retainShared atom =>
+      match resolveAtom frame.values atom with
+      | .ok value => 2 * (referenceCount value : Int)
+      | _ => 0
+  | .resetShared atom _ =>
+      match resolveAtom frame.values atom with
+      | .ok value => resetRCCharge store value
+      | _ => 0
+  | .apply functionAtom argumentAtoms =>
+      match resolveAtom frame.values functionAtom, resolveAtoms frame.values argumentAtoms with
+      | .ok function, .ok arguments => applyRCCharge store function arguments
+      | _, _ => 0
+  | _ => 0
+
+theorem InstructionTransferCase.rcCharge {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store heapFuel
+      frame stack instruction target) :
+    (target.store.amortizedRC : Int) = store.amortizedRC +
+      instructionRCCharge store frame instruction := by
+  cases classified <;> simp only [instructionRCCharge, Int.add_zero,
+    Store.amortizedRC_allocNode, Int.natCast_add, Store.amortizedRC_tickHotReset,
+    ↓reduceIte] <;> try rfl
+  case alloc => split <;> simp_all
+  case allocWithAbsent => split <;> simp_all
+  case allocWithLogical => split <;> simp_all
+  case allocWithPhysical reused =>
+    have counted := (Store.reuseReservation_observations reused).2.1
+    split <;> simp_all
+  case discardPhysical released =>
+    exact congrArg (fun n : Nat => (n : Int))
+      (Store.releaseReservation_observations released).2.1
+  case takeUniqueLogical viewed unitRC =>
+    have removed := Store.amortizedRC_kill viewed.parts.1
+    simpa only [slotSharedRC, viewed.parts.2.1, reduceCtorEq, ↓reduceIte, Nat.add_zero]
+      using congrArg (fun n : Nat => (n : Int)) removed
+  case takeUniquePhysical viewed unitRC =>
+    have removed := Store.amortizedRC_reserve viewed.parts.1
+    simpa only [slotSharedRC, viewed.parts.2.1, reduceCtorEq, ↓reduceIte, Nat.add_zero]
+      using congrArg (fun n : Nat => (n : Int)) removed
+  case resetSharedLogicalHot resolved viewed unitRC =>
+    have removed := Store.amortizedRC_kill (store := store.tickResetAttempt) viewed.parts.1
+    simp only [slotSharedRC, viewed.parts.2.1, ↓reduceIte, unitRC,
+      Store.amortizedRC_tickResetAttempt] at removed
+    simp only [resolved, resetRCCharge, viewed.parts.1, unitRC, ↓reduceIte]
+    omega
+  case resetSharedPhysicalHot resolved viewed unitRC =>
+    have removed := Store.amortizedRC_reserve (store := store.tickResetAttempt) viewed.parts.1
+    simp only [slotSharedRC, viewed.parts.2.1, ↓reduceIte, unitRC,
+      Store.amortizedRC_tickResetAttempt] at removed
+    simp only [resolved, resetRCCharge, viewed.parts.1, unitRC, ↓reduceIte]
+    omega
+  case resetSharedCold resolved viewed many retained =>
+    have counted := retained.observations.2.1
+    have changed := Store.amortizedRC_decrement (store := store.tickResetAttempt)
+      viewed.parts.1 viewed.parts.2.1 many
+    rw [Store.amortizedRC_tickColdReset, changed, Store.amortizedRC_tickResetAttempt] at counted
+    simp only [resolved, resetRCCharge, viewed.parts.1, viewed.parts.2.2]
+    split <;> omega
+  case retainShared resolved retained =>
+    have counted := (retainShared_observations retained).2.1
+    simp only [resolved]
+    omega
+  case releaseShared released =>
+    exact congrArg (fun n : Nat => (n : Int)) (releaseShared_observations released).2.1
+  case dropUnique dropped =>
+    exact congrArg (fun n : Nat => (n : Int)) (dropUnique_observations dropped).2.1
+  case freeUnique viewed scalarFields =>
+    have removed := Store.amortizedRC_kill viewed.parts.1
+    simpa only [slotSharedRC, viewed.parts.2.1, reduceCtorEq, ↓reduceIte, Nat.add_zero]
+      using congrArg (fun n : Nat => (n : Int)) removed
+  case apply functionResolved argumentsResolved transferred =>
+    simpa only [functionResolved, argumentsResolved] using transferred.rcCharge
+
+theorem InstructionTransferCase.peakLive {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store heapFuel
+      frame stack instruction target) :
+    target.store.peakLiveNodes =
+      if instructionAllocationEvents store frame instruction = 0 then store.peakLiveNodes
+      else max store.peakLiveNodes target.store.live := by
+  cases classified <;> simp only [instructionAllocationEvents, ↓reduceIte,
+    Nat.one_ne_zero, Store.peakLive_allocNode] <;> try rfl
+  case allocWithPhysical reused => exact (Store.reuseReservation_observations reused).2.2.1
+  case discardPhysical released => exact (Store.releaseReservation_observations released).2.2.1
+  case resetSharedCold retained => exact retained.observations.2.2.1
+  case retainShared retained => exact (retainShared_observations retained).2.2.1
+  case releaseShared released => exact (releaseShared_observations released).2.2.1
+  case dropUnique dropped => exact (dropUnique_observations dropped).2.2.1
+  case apply functionResolved argumentsResolved transferred =>
+    simpa only [functionResolved, argumentsResolved] using transferred.peakLive
+
+theorem InstructionTransferCase.live_le {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store heapFuel
+      frame stack instruction target) :
+    target.store.live ≤ store.live + instructionAllocationEvents store frame instruction := by
+  cases classified <;> simp only [instructionAllocationEvents, Nat.add_zero,
+    Store.live_allocNode, Nat.le_refl]
+  case allocWithPhysical reused => exact Nat.le_of_eq (Store.reuseReservation_accounting reused).1
+  case discardPhysical released => exact Nat.le_of_eq (Store.releaseReservation_accounting released).1
+  case takeUniqueLogical viewed unitRC => have removed := Store.live_kill viewed.parts.1; omega
+  case takeUniquePhysical viewed unitRC => have removed := Store.live_reserve viewed.parts.1; omega
+  case resetSharedLogicalHot viewed unitRC =>
+    have removed := Store.live_kill (store := store.tickResetAttempt) viewed.parts.1
+    change (store.tickResetAttempt.kill _).live + 1 = store.live at removed
+    change (store.tickResetAttempt.kill _).live ≤ store.live
+    omega
+  case resetSharedPhysicalHot viewed unitRC =>
+    have removed := Store.live_reserve (store := store.tickResetAttempt) viewed.parts.1
+    change (store.tickResetAttempt.reserve _).live + 1 = store.live at removed
+    change (store.tickResetAttempt.reserve _).live ≤ store.live
+    omega
+  case resetSharedCold viewed many retained =>
+    have counted := retained.observations.2.2.2
+    exact Nat.le_of_eq (counted.trans (Store.live_setBox viewed.parts.1))
+  case retainShared retained => exact Nat.le_of_eq (retainShared_observations retained).2.2.2
+  case releaseShared released => exact (releaseShared_observations released).2.2.2
+  case dropUnique dropped => exact (dropUnique_observations dropped).2.2.2
+  case freeUnique viewed scalarFields => have removed := Store.live_kill viewed.parts.1; omega
+  case apply functionResolved argumentsResolved transferred =>
+    simpa only [functionResolved, argumentsResolved] using transferred.live_le
+
+def terminatorRCCharge (store : Store) (frame : Frame)
+    (stack : List Continuation) : Terminator → Int
+  | .ret atom =>
+      match stack, resolveAtom frame.values atom with
+      | .applyMore arguments _ :: _, .ok value => applyRCCharge store value arguments
+      | _, _ => 0
+  | _ => 0
+
+theorem TerminatorTransferCase.rcCharge {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store heapFuel
+      frame stack terminator target) :
+    (target.store.amortizedRC : Int) = store.amortizedRC +
+      terminatorRCCharge store frame stack terminator := by
+  cases classified <;> simp only [terminatorRCCharge, Int.add_zero]
+  case retApplyMore resolved noCredits world transferred =>
+    simpa only [resolved] using transferred.rcCharge
+
+theorem TerminatorTransferCase.peakLive {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store heapFuel
+      frame stack terminator target) :
+    target.store.peakLiveNodes =
+      if terminatorAllocationEvents store frame stack terminator = 0 then store.peakLiveNodes
+      else max store.peakLiveNodes target.store.live := by
+  cases classified <;> simp only [terminatorAllocationEvents, ↓reduceIte]
+  case retApplyMore resolved noCredits world transferred =>
+    simpa only [resolved] using transferred.peakLive
+
+theorem TerminatorTransferCase.live_le {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store heapFuel
+      frame stack terminator target) :
+    target.store.live ≤ store.live + terminatorAllocationEvents store frame stack terminator := by
+  cases classified <;> simp only [terminatorAllocationEvents, Nat.add_zero, Nat.le_refl]
+  case retApplyMore resolved noCredits world transferred =>
+    simpa only [resolved] using transferred.live_le
+
+theorem InstructionTransferCase.rcops_mono {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store heapFuel
+      frame stack instruction target) : store.heap.rcops ≤ target.store.heap.rcops := by
+  cases classified <;> try exact Nat.le_refl _
+  case allocWithPhysical reused =>
+    exact Nat.le_of_eq (Store.reuseReservation_observations reused).1.symm
+  case discardPhysical released =>
+    exact Nat.le_of_eq (Store.releaseReservation_observations released).1.symm
+  case resetSharedCold retained =>
+    have counted := retained.observations.1
+    change _ = store.heap.rcops + 1 + _ at counted
+    dsimp only
+    omega
+  case retainShared retained =>
+    have counted := (retainShared_observations retained).1
+    dsimp only
+    omega
+  case releaseShared released => exact (releaseShared_observations released).1
+  case dropUnique dropped => exact Nat.le_of_eq (dropUnique_observations dropped).1.symm
+  case apply transferred => exact transferred.rcops_mono
+
+theorem TerminatorTransferCase.rcops_mono {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store heapFuel
+      frame stack terminator target) : store.heap.rcops ≤ target.store.heap.rcops := by
+  cases classified <;> try exact Nat.le_refl _
+  case retApplyMore transferred => exact transferred.rcops_mono
+
+theorem Step.instructionCosts {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {target : Machine}
+    (step : Step context interpretation ⟨store, heapFuel, .running frame stack⟩ target)
+    {block : Block} {instruction : Instr}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instructionAt : block.instructions[frame.pc] = instruction) :
+    (target.store.amortizedRC : Int) = store.amortizedRC +
+      instructionRCCharge store frame instruction ∧
+    target.store.peakLiveNodes =
+      if Eval.instructionAllocationEvents store frame instruction = 0 then store.peakLiveNodes
+      else max store.peakLiveNodes target.store.live := by
+  cases step.classify with
+  | instruction found bound atIndex classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      exact ⟨classified.rcCharge, classified.peakLive⟩
+  | terminator found terminal atTerminator classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      omega
+
+theorem Step.terminatorCosts {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {target : Machine}
+    (step : Step context interpretation ⟨store, heapFuel, .running frame stack⟩ target)
+    {block : Block} {terminator : Terminator}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator) :
+    (target.store.amortizedRC : Int) = store.amortizedRC +
+      terminatorRCCharge store frame stack terminator ∧
+    target.store.peakLiveNodes =
+      if Eval.terminatorAllocationEvents store frame stack terminator = 0 then store.peakLiveNodes
+      else max store.peakLiveNodes target.store.live := by
+  cases step.classify with
+  | instruction found bound atIndex classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      omega
+  | terminator found terminal atTerminator classified =>
+      have same := Option.some.inj (found.symm.trans blockAt)
+      subst_vars
+      exact ⟨classified.rcCharge, classified.peakLive⟩
+
+/-- The stored peak includes the complete successful heap operation. -/
+theorem Step.peakRecords {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (step : Step context interpretation before after) :
+    ∃ events,
+      after.store.peakLiveNodes =
+        (if events = 0 then before.store.peakLiveNodes
+        else max before.store.peakLiveNodes after.store.live) ∧
+      after.store.live ≤ before.store.live + events := by
+  cases step.classify with
+  | halted => exact ⟨0, rfl, Nat.le_refl _⟩
+  | instruction found pc atIndex classified => exact ⟨_, classified.peakLive, classified.live_le⟩
+  | terminator found pc atTerminator classified => exact ⟨_, classified.peakLive, classified.live_le⟩
+
+theorem Step.peakLive_mono {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (step : Step context interpretation before after) :
+    before.store.peakLiveNodes ≤ after.store.peakLiveNodes := by
+  obtain ⟨events, recorded, _live⟩ := step.peakRecords
+  rw [recorded]
+  split
+  · exact Nat.le_refl _
+  · exact Nat.le_max_left _ _
+
+theorem Step.preservesPeakBound {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (step : Step context interpretation before after)
+    (initial : before.store.live ≤ before.store.peakLiveNodes) :
+    after.store.live ≤ after.store.peakLiveNodes := by
+  obtain ⟨events, recorded, live⟩ := step.peakRecords
+  rw [recorded]
+  split
+  · omega
+  · exact Nat.le_max_right _ _
+
+theorem Step.rcops_mono {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (step : Step context interpretation before after) :
+    before.store.heap.rcops ≤ after.store.heap.rcops := by
+  cases step.classify with
+  | halted => exact Nat.le_refl _
+  | instruction found pc atIndex classified => exact classified.rcops_mono
+  | terminator found pc atTerminator classified => exact classified.rcops_mono
+
+theorem Steps.costs_mono {context : Context} {interpretation : Interpretation}
+    {count : Nat} {before after : Machine}
+    (steps : Steps context interpretation count before after) :
+    before.store.heap.rcops ≤ after.store.heap.rcops ∧
+    before.store.peakLiveNodes ≤ after.store.peakLiveNodes := by
+  induction steps with
+  | refl => exact ⟨Nat.le_refl _, Nat.le_refl _⟩
+  | cons running head tail ih =>
+      exact ⟨Nat.le_trans head.rcops_mono ih.1, Nat.le_trans head.peakLive_mono ih.2⟩
+
+theorem Steps.preservesPeakBound {context : Context} {interpretation : Interpretation}
+    {count : Nat} {before after : Machine}
+    (steps : Steps context interpretation count before after)
+    (initial : before.store.live ≤ before.store.peakLiveNodes) :
+    after.store.live ≤ after.store.peakLiveNodes := by
+  induction steps with
+  | refl => exact initial
+  | cons running head tail ih => exact ih (head.preservesPeakBound initial)
+
+/-- Every intermediate state of a successful execution is bounded by its
+actual final counters. This includes reset, branch, and reuse macro states. -/
+theorem runMachine_prefix_costs {context : Context} {interpretation : Interpretation}
+    {controlFuel prefixCount : Nat} {initial middle : Machine} {result : Result}
+    (run : runMachine context interpretation controlFuel initial = .ok result)
+    (prefixSteps : Steps context interpretation prefixCount initial middle)
+    (initialPeak : initial.store.live ≤ initial.store.peakLiveNodes) :
+    middle.store.heap.rcops ≤ result.store.heap.rcops ∧
+    middle.store.peakLiveNodes ≤ result.store.peakLiveNodes ∧
+    middle.store.live ≤ result.store.peakLiveNodes := by
+  obtain ⟨count, _fuel, execution⟩ := runMachine_steps run
+  obtain ⟨suffixCount, _count, suffix⟩ := prefixSteps.cancelPrefixToHalted execution rfl
+  have costs := suffix.costs_mono
+  exact ⟨costs.1, costs.2, Nat.le_trans (prefixSteps.preservesPeakBound initialPeak) costs.2⟩
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/CreditApply.lean b/Ix/Compiler/IxIR2/CreditApply.lean
new file mode 100644
index 000000000..8c0774554
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditApply.lean
@@ -0,0 +1,166 @@
+import Ix.Compiler.IxIR2.CreditControl
+import Ix.Compiler.IxIR2.CreditHeap
+
+/-! Partial application and return-time residual application. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso NodeBoxIso)
+open CallReuse.Sim (MapRel HeapMap)
+
+structure TransferRel (before after : Array Nat) (left right : Machine) : Prop where
+  heap : HeapRel after left.store right.store
+  extension : MapExtends before after
+  fuel : left.heapFuel = right.heapFuel
+  control : ControlRel after left.control right.control
+
+structure MachineRel (mapping : Array Nat) (left right : Machine) : Prop where
+  heap : HeapRel mapping left.store right.store
+  fuel : left.heapFuel = right.heapFuel
+  control : ControlRel mapping left.control right.control
+  reservations : right.ReservationOwnership
+
+theorem TransferRel.machine {before after : Array Nat} {left right : Machine}
+    (related : TransferRel before after left right) (owned : right.ReservationOwnership) :
+    MachineRel after left right := ⟨related.heap, related.fuel, related.control, owned⟩
+
+theorem HeapRel.fieldWorlds {left right : Store} {mapping : Array Nat}
+    (state : HeapRel mapping left right) {leftValues rightValues : Array RVal} {schema : CtorSchema}
+    (related : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (checked : FieldWorlds left schema leftValues) : FieldWorlds right schema rightValues := by
+  have forward : ∀ {lefts rights : List RVal}, RValsIso (MapRel mapping) lefts rights →
+      FieldValuesWorldForward left right lefts rights := by
+    intro lefts rights related
+    induction related with
+    | nil => exact .nil
+    | cons head tail ih => exact .cons (fun _ valid => state.heap.hasWorld head valid) ih
+  exact checked.forward (forward related)
+
+theorem HeapRel.papView {left right : Store} {mapping : Array Nat}
+    (state : HeapRel mapping left right) {l r : Nat} {box : NodeBox}
+    {address : Ixon.Address} {arity : Nat} {captured : Array RVal}
+    (mapped : MapRel mapping l r) (found : left.get? l = some box)
+    (node : box.node = .papN address arity captured) :
+    ∃ targetBox targetCaptured,
+      right.get? r = some targetBox ∧ NodeBoxIso (MapRel mapping) box targetBox ∧
+      targetBox.node = .papN address arity targetCaptured ∧
+      RValsIso (MapRel mapping) captured.toList targetCaptured.toList := by
+  obtain ⟨targetBox, targetAt, boxes⟩ := state.heap.forward mapped found
+  have nodes := boxes.node
+  rw [node] at nodes
+  cases targetNode : targetBox.node with
+  | ctorN cid fields => rw [targetNode] at nodes; cases nodes
+  | papN targetAddress targetArity targetCaptured =>
+      rw [targetNode] at nodes
+      cases nodes with
+      | pap captured => exact ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, captured⟩
+
+/-- Dynamic dispatch preserves the actual result and the remaining traversal
+budget. The same proof serves ordinary application and every `applyMore`
+continuation, while retaining all caller credit files. -/
+theorem apply_related {context : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {heapFuel : Nat}
+    {leftFunction rightFunction : RVal} {leftArguments rightArguments : Array RVal}
+    {leftResume rightResume : Frame} {leftStack rightStack : List Continuation}
+    {leftAfter : Machine}
+    (state : HeapRel mapping leftStore rightStore)
+    (function : RValIso (MapRel mapping) leftFunction rightFunction)
+    (arguments : RValsIso (MapRel mapping) leftArguments.toList rightArguments.toList)
+    (resume : FrameRel mapping leftResume rightResume)
+    (stack : StackRel mapping leftStack rightStack)
+    (transferred : ApplyTransfer context .logical leftStore heapFuel leftFunction
+      leftArguments leftResume leftStack leftAfter) :
+    ∃ after rightAfter,
+      ApplyTransfer context .physical rightStore heapFuel rightFunction
+        rightArguments rightResume rightStack rightAfter ∧
+      TransferRel mapping after leftAfter rightAfter := by
+  cases transferred.classify with
+  | erased released =>
+      cases function
+      obtain ⟨rightOut, targetRun, heap⟩ := state.releaseWork arguments released
+      exact ⟨mapping, _, .erased targetRun,
+        ⟨heap, MapExtends.refl _, rfl, .running (resume.push .erased) stack⟩⟩
+  | @papUnder location box address arity captured retainedStore releasedStore remaining
+      found shared node capturedUnder retained released totalUnder =>
+      cases function with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, capturedRel⟩ :=
+            state.papView mapped found node
+          obtain ⟨targetRetained, targetRetain, retaining⟩ := state.retainMany capturedRel retained
+          obtain ⟨targetReleased, targetRelease, releasing⟩ :=
+            retaining.releaseWork (.cons (.loc mapped) .nil) released
+          have total : RValsIso (MapRel mapping) (captured ++ leftArguments).toList
+              (targetCaptured ++ rightArguments).toList := by
+            simpa only [Array.toList_append] using capturedRel.append arguments
+          have allocating := releasing.alloc (world := .shared)
+            (leftNode := .papN address arity (captured ++ leftArguments)) (.pap total)
+          have extension : MapExtends mapping (mapping.push targetReleased.heap.nodes.size) :=
+            MapExtends.push mapping targetReleased.heap.nodes.size
+          have newValue : RValIso (MapRel (mapping.push targetReleased.heap.nodes.size))
+              (.loc releasedStore.heap.nodes.size) (.loc targetReleased.heap.nodes.size) :=
+            .loc (by rw [← releasing.heap.size]; exact MapRel.fresh ..)
+          exact ⟨_, _, .papUnder targetAt (boxes.world.symm.trans shared)
+            targetNode (by rw [← values_size capturedRel]; exact capturedUnder)
+            targetRetain targetRelease (by rw [← values_size total]; exact totalUnder),
+            ⟨allocating, extension, rfl,
+              .running ((resume.mono extension).push newValue) (stack.mono extension)⟩⟩
+  | @papFn location box address arity captured retainedStore releasedStore remaining definition
+      found shared node capturedUnder retained released totalEnough declaration papSafe suppliedArity nonempty =>
+      cases function with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, capturedRel⟩ :=
+            state.papView mapped found node
+          obtain ⟨targetRetained, targetRetain, retaining⟩ := state.retainMany capturedRel retained
+          obtain ⟨targetReleased, targetRelease, releasing⟩ :=
+            retaining.releaseWork (.cons (.loc mapped) .nil) released
+          have total : RValsIso (MapRel mapping) (captured ++ leftArguments).toList
+              (targetCaptured ++ rightArguments).toList := by
+            simpa only [Array.toList_append] using capturedRel.append arguments
+          have supplied := values_extract total 0 arity
+          have residual : RValsIso (MapRel mapping)
+              ((captured ++ leftArguments).extract arity (captured ++ leftArguments).size).toList
+              ((targetCaptured ++ rightArguments).extract arity
+                (targetCaptured ++ rightArguments).size).toList := by
+            simpa only [values_size total] using values_extract total arity (captured ++ leftArguments).size
+          have empty : ((captured ++ leftArguments).extract arity (captured ++ leftArguments).size).isEmpty =
+              ((targetCaptured ++ rightArguments).extract arity
+                (targetCaptured ++ rightArguments).size).isEmpty := by
+            simp only [Array.isEmpty, values_size residual]
+          refine ⟨mapping, _, .papFn targetAt (boxes.world.symm.trans shared)
+            targetNode (by rw [← values_size capturedRel]; exact capturedUnder)
+            targetRetain targetRelease (by rw [← values_size total]; exact totalEnough)
+            declaration papSafe (by rw [← values_size supplied]; exact suppliedArity) nonempty,
+            ⟨releasing, MapExtends.refl _, rfl, .running (.entry definition supplied) (.cons ?_ stack)⟩⟩
+          rw [empty]
+          split
+          · exact .resume resume
+          · exact .applyMore resume residual
+  | @papExtern location box address arity expectedArity captured retainedStore releasedStore remaining value
+      found shared node capturedUnder retained released totalEnough declaration suppliedArity remainingEmpty called =>
+      cases function with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetCaptured, targetAt, boxes, targetNode, capturedRel⟩ :=
+            state.papView mapped found node
+          obtain ⟨targetRetained, targetRetain, retaining⟩ := state.retainMany capturedRel retained
+          obtain ⟨targetReleased, targetRelease, releasing⟩ :=
+            retaining.releaseWork (.cons (.loc mapped) .nil) released
+          have total : RValsIso (MapRel mapping) (captured ++ leftArguments).toList
+              (targetCaptured ++ rightArguments).toList := by
+            simpa only [Array.toList_append] using capturedRel.append arguments
+          have supplied := values_extract total 0 arity
+          have residual : RValsIso (MapRel mapping)
+              ((captured ++ leftArguments).extract arity (captured ++ leftArguments).size).toList
+              ((targetCaptured ++ rightArguments).extract arity
+                (targetCaptured ++ rightArguments).size).toList := by
+            simpa only [values_size total] using values_extract total arity (captured ++ leftArguments).size
+          obtain ⟨targetCalled, valueRel⟩ := scalarOracle_related supplied called
+          exact ⟨mapping, _, .papExtern targetAt (boxes.world.symm.trans shared)
+            targetNode (by rw [← values_size capturedRel]; exact capturedUnder)
+            targetRetain targetRelease (by rw [← values_size total]; exact totalEnough)
+            declaration (by rw [← values_size supplied]; exact suppliedArity)
+            (by simpa only [Array.isEmpty_iff_size_eq_zero, values_size residual] using remainingEmpty)
+            targetCalled,
+            ⟨releasing, MapExtends.refl _, rfl, .running (resume.push valueRel) stack⟩⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditControl.lean b/Ix/Compiler/IxIR2/CreditControl.lean
new file mode 100644
index 000000000..2dfc4df0e
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditControl.lean
@@ -0,0 +1,150 @@
+import Ix.Compiler.IxIR2.CreditRelation
+
+/-! Register resolution and linear credit transfer for the same CFG. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+open CallReuse.Sim (MapRel HeapMap)
+
+theorem values_size {mapping : Array Nat} {left right : Array RVal}
+    (related : RValsIso (MapRel mapping) left.toList right.toList) :
+    left.size = right.size := by simpa using related.lengths
+
+theorem values_extract {mapping : Array Nat} {left right : Array RVal}
+    (related : RValsIso (MapRel mapping) left.toList right.toList) (start stop : Nat) :
+    RValsIso (MapRel mapping) (left.extract start stop).toList
+      (right.extract start stop).toList := by
+  simp only [Array.toList_extract, List.extract_eq_take_drop]
+  exact (related.drop start).take (stop - start)
+
+theorem values_scalar {mapping : Array Nat} {left right : Array RVal}
+    (related : RValsIso (MapRel mapping) left.toList right.toList) :
+    left.all RVal.isScalar = right.all RVal.isScalar := by
+  rw [← Array.all_toList, ← Array.all_toList]
+  generalize left.toList = leftList at related ⊢
+  generalize right.toList = rightList at related ⊢
+  induction related with
+  | nil => rfl
+  | cons head tail ih => cases head <;> simp only [List.all_cons, RVal.isScalar, ih]
+
+theorem scalarOracle_related {context : Context} {mapping : Array Nat}
+    {left right : Array RVal} {address : Ixon.Address} {value : RVal}
+    (values : RValsIso (MapRel mapping) left.toList right.toList)
+    (called : ScalarOracleCall context address left value) :
+    ScalarOracleCall context address right value ∧ RValIso (MapRel mapping) value value := by
+  obtain ⟨inputs, result⟩ := called.scalar
+  have scalar : left.toList.all IxIR1.RVal.isScalar = true := by
+    rw [Array.all_toList]
+    apply Array.all_eq_true.mpr
+    intro i bound
+    have valid := Array.all_eq_true.mp inputs i bound
+    cases valueAt : left[i] <;> simp_all only [RVal.isScalar, IxIR1.RVal.isScalar]
+  have same : left = right := Array.toList_inj.mp (values.eq_of_allScalar scalar)
+  subst right
+  refine ⟨called, ?_⟩
+  cases value <;> simp_all [RVal.isScalar] <;> constructor
+
+theorem FrameRel.noCredits {mapping : Array Nat} {left right : Frame}
+    (related : FrameRel mapping left right) (cleared : NoLiveCredits left) :
+    NoLiveCredits right := by
+  change right.credits.any Option.isSome = false
+  change left.credits.any Option.isSome = false at cleared
+  rw [← Array.any_toList] at cleared ⊢
+  rw [← related.credits.any]
+  exact cleared
+
+theorem FrameRel.presentCredits {mapping : Array Nat} {left right : Frame}
+    (related : FrameRel mapping left right) : left.presentCredits = right.presentCredits := by
+  simp only [Frame.presentCredits, creditPresentCount_eq_countP, ← Array.countP_toList]
+  exact related.credits.weight
+
+theorem FrameRel.creditLookup {mapping : Array Nat} {left right : Frame}
+    (related : FrameRel mapping left right) {index : Nat} {credit : Credit}
+    (lookedUp : CreditLookup left index credit) :
+    ∃ target, CreditLookup right index target ∧ CreditRel credit target := by
+  have found := (CreditTake.of_lookup lookedUp).target_eq.2
+  obtain ⟨target, targetAt, credits⟩ := related.credits.get? (by simpa using found)
+  exact ⟨target, .of_getElem (by simpa using targetAt), credits⟩
+
+theorem FrameRel.creditTake {mapping : Array Nat} {left right after : Frame}
+    (related : FrameRel mapping left right) {index : Nat} {credit : Credit}
+    (taken : CreditTake left index after credit) :
+    ∃ target targetCredit, CreditTake right index target targetCredit ∧
+      FrameRel mapping after target ∧ CreditRel credit targetCredit := by
+  obtain ⟨rfl, found⟩ := taken.target_eq
+  obtain ⟨targetCredit, targetAt, credits⟩ := related.credits.get? (by simpa using found)
+  refine ⟨_, targetCredit, .of_lookup (.of_getElem (by simpa using targetAt)), ?_, credits⟩
+  exact { related with
+    credits := by
+      simpa only [Array.toList_setIfInBounds] using related.credits.setNone index }
+
+theorem FrameRel.creditSequence {mapping : Array Nat} {left right after : Frame}
+    (related : FrameRel mapping left right) {indices : List Nat} {credits : List Credit}
+    (taken : CreditTakeSequence left indices after credits) :
+    ∃ target targetCredits, CreditTakeSequence right indices target targetCredits ∧
+      FrameRel mapping after target ∧ CreditsRel (credits.map some) (targetCredits.map some) := by
+  induction taken generalizing right with
+  | nil => exact ⟨right, [], .nil _, related, .nil⟩
+  | cons head tail ih =>
+      obtain ⟨middle, targetCredit, first, frames, credit⟩ := related.creditTake head
+      obtain ⟨target, targetCredits, rest, frames, credits⟩ := ih frames
+      exact ⟨target, targetCredit :: targetCredits, .cons first rest, frames,
+        .cons (.live credit) credits⟩
+
+theorem FrameRel.creditMany {mapping : Array Nat} {left right after : Frame}
+    (related : FrameRel mapping left right) {indices : Array Nat} {credits : Array Credit}
+    (taken : CreditTakeMany left indices after credits) :
+    ∃ target targetCredits, CreditTakeMany right indices target targetCredits ∧
+      FrameRel mapping after target ∧
+      CreditsRel (credits.map some).toList (targetCredits.map some).toList := by
+  obtain ⟨target, targetCredits, steps, frames, credits⟩ := related.creditSequence taken.sequence
+  exact ⟨target, targetCredits.toArray, by simpa using steps.toMany,
+    frames, by simpa using credits⟩
+
+theorem FrameRel.edge {mapping : Array Nat} {left right after : Frame}
+    (related : FrameRel mapping left right) {edge : Edge} {leftImplicit rightImplicit : Array RVal}
+    (implicitValues : RValsIso (MapRel mapping) leftImplicit.toList rightImplicit.toList)
+    (transferred : EdgeTransfer left edge leftImplicit after) :
+    ∃ target, EdgeTransfer right edge rightImplicit target ∧ FrameRel mapping after target := by
+  obtain ⟨values, credits, middle, block, resolved, taken, cleared, blockAt,
+    valueArity, creditArity, rfl⟩ := transferred.parts
+  obtain ⟨targetValues, targetResolved, valueRel⟩ := ReuseSim.resolveAtoms_iso related.values resolved
+  obtain ⟨targetMiddle, targetCredits, targetTaken, middleRel, creditsRel⟩ := related.creditMany taken
+  have combined : RValsIso (MapRel mapping) (leftImplicit ++ values).toList
+      (rightImplicit ++ targetValues).toList := by
+    simpa only [Array.toList_append] using implicitValues.append valueRel
+  refine ⟨_, .of_parts targetResolved targetTaken (middleRel.noCredits cleared)
+    (by rw [← middleRel.definition]; exact blockAt)
+    (by rw [← values_size combined]; exact valueArity) ?_, ?_⟩
+  · have sizes := creditsRel.lengths
+    simp only [Array.length_toList, Array.size_map] at sizes
+    omega
+  · exact ⟨middleRel.definition, rfl, rfl, combined, creditsRel⟩
+
+theorem ContinuationRel.presentCredits {mapping : Array Nat} {left right : Continuation}
+    (related : ContinuationRel mapping left right) : left.presentCredits = right.presentCredits := by
+  cases related with
+  | resume frames => exact frames.presentCredits
+  | applyMore frames values => exact frames.presentCredits
+
+theorem StackRel.presentCredits {mapping : Array Nat} {left right : List Continuation}
+    (related : StackRel mapping left right) :
+    (left.map Continuation.presentCredits).sum = (right.map Continuation.presentCredits).sum := by
+  induction related with
+  | nil => rfl
+  | cons head tail ih => simp only [List.map_cons, List.sum_cons, head.presentCredits, ih]
+
+theorem reservedCredit {store : Store} {frame after : Frame} {stack : List Continuation}
+    {index location : Nat} {credit : Credit}
+    (owned : (Machine.mk store 0 (.running frame stack)).ReservationOwnership)
+    (taken : CreditTake frame index after credit)
+    (present : credit.presence = .present (some location)) : Store.EmptySlot store location := by
+  apply owned.empty
+  change location ∈ frame.reservations ++ stack.flatMap Continuation.reservations
+  apply List.mem_append_left
+  apply taken.reservations.mem_iff.mpr
+  simp [Credit.reservation?, present]
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditExamples.lean b/Ix/Compiler/IxIR2/CreditExamples.lean
new file mode 100644
index 000000000..bd3c20d36
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditExamples.lean
@@ -0,0 +1,325 @@
+import Ix.Compiler.IxIR2.CreditRefinement
+
+/-!
+# Full-credit regression gate
+
+These independently written CFGs exercise combinations beyond the existing
+single-candidate optimizer fixtures. Every accepted program runs through the
+actual policy runners; comparisons check the whole trace, result shape,
+exact costs, and complete reclamation. Guards execute during library builds.
+-/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement.Examples
+
+open Eval
+open Ix.Compiler.Ixon (Address Owned)
+
+private def blockAddress : Address := Address.replicate 0xb1
+private def layout : LayoutId := Address.replicate 0xb2
+private def pairLayout : LayoutId := Address.replicate 0xb3
+private def fieldLayout : LayoutId := Address.replicate 0xb4
+private def helperAddress : Address := Address.replicate 0xb5
+private def nestedAddress : Address := Address.replicate 0xb6
+private def leaf : CtorId := ⟨blockAddress, 0, 0⟩
+private def pair : CtorId := ⟨blockAddress, 0, 1⟩
+private def field : CtorId := ⟨blockAddress, 0, 2⟩
+
+private def schemas (world : Owned) (cid : CtorId) : Option CtorSchema :=
+  if cid == leaf then some ⟨layout, #[]⟩
+  else if cid == pair then some ⟨pairLayout, #[world, world]⟩
+  else if cid == field then some ⟨fieldLayout, #[world]⟩
+  else none
+
+private def signature (world : Owned := .unique) : Signature := ⟨#[], world, false⟩
+private def validation : Validate.Context := { schemas }
+
+private def accepts (policy : CreditPolicy) (program : Program) : Bool :=
+  (Validate.validateWithPolicy policy Validate.defaultLimits validation program).isOk
+
+private def rejects (policy : CreditPolicy) (kind : Validate.Violation) (program : Program) : Bool :=
+  match Validate.validateWithPolicy policy Validate.defaultLimits validation program with
+  | .error (.invalid _ actual _) => actual == kind
+  | _ => false
+
+private def run (policy : CreditPolicy) (interpretation : Interpretation) (program : Program)
+    (control : Nat := 3000) (heap : Nat := 2000) : Except Error Result :=
+  Policy.runMain policy (Context.ofProgram program schemas) interpretation program control heap
+
+private def laws (logical physical : Store) (credits : Nat) : Bool :=
+  decide (CounterLaw logical.snapshot physical.snapshot credits) &&
+    logical.peakLiveNodes == physical.peakLiveNodes &&
+    physical.live + physical.heap.frees + credits == physical.heap.allocs
+
+private def reclaimed (world : Owned) (result : Result) : Bool :=
+  match reclaim world 2000 result.store result.value with
+  | .ok (store, _) => store.live == 0 && store.heap.allocs == store.heap.frees
+  | _ => false
+
+private def trace : Nat → CreditPolicy → Context → Machine → Machine → Bool
+  | 0, _, _, _, _ => false
+  | fuel + 1, policy, context, logical, physical =>
+      laws logical.store physical.store physical.presentCredits &&
+        match logical.control, physical.control with
+        | .halted _, .halted _ => true
+        | .running .., .running .. =>
+            match Policy.step policy context .logical logical,
+                Policy.step policy context .physical physical with
+            | .ok left, .ok right => trace fuel policy context left right
+            | _, _ => false
+        | _, _ => false
+
+private def traceMatches (policy : CreditPolicy) (program : Program) : Bool :=
+  trace 3000 policy (Context.ofProgram program schemas)
+    (initialMachine program.main #[] 2000) (initialMachine program.main #[] 2000)
+
+private def leafAt (store : Store) (value : RVal) : Bool :=
+  match value with
+  | .loc location => match store.get? location with
+    | some ⟨.unique, 1, .ctorN cid fields⟩ => cid == leaf && fields.isEmpty
+    | _ => false
+  | _ => false
+
+private def pairResult (result : Result) : Bool :=
+  match result.value with
+  | .loc location => match result.store.get? location with
+    | some ⟨.unique, 1, .ctorN cid #[left, right]⟩ =>
+        cid == pair && left != right && leafAt result.store left && leafAt result.store right
+    | _ => false
+  | _ => false
+
+private def fieldResult (world : Owned) (value : Nat) (result : Result) : Bool :=
+  match result.value with
+  | .loc location => match result.store.get? location with
+    | some ⟨actualWorld, 1, .ctorN cid #[.lit (.nat actual)]⟩ =>
+        actualWorld == world && cid == field && actual == value
+    | _ => false
+  | _ => false
+
+/-! Two live reservations cross a back edge in reverse order. Nested callees
+allocate while those slots remain owned by a suspended caller. -/
+
+private def nested : Function :=
+  { signature := signature
+    blocks := #[
+      { valueParams := #[], creditParams := #[]
+        instructions := #[.alloc .unique leaf #[], .dropUnique (.reg 0)]
+        terminator := .ret (.lit (.nat 17)) }] }
+
+private def helper : Function :=
+  { signature := signature
+    blocks := #[
+      { valueParams := #[], creditParams := #[]
+        instructions := #[.alloc .unique leaf #[], .dropUnique (.reg 0), .call nestedAddress #[]]
+        terminator := .ret (.reg 1) }] }
+
+private def pairedLoop (iterations : Nat) (calls : Bool) : Program :=
+  { declarations := [(helperAddress, .fn helper), (nestedAddress, .fn nested)]
+    main :=
+      { signature := signature
+        blocks := #[
+          { valueParams := #[], creditParams := #[]
+            instructions := #[.alloc .unique leaf #[], .alloc .unique leaf #[],
+              .takeUnique (.reg 0) leaf, .takeUnique (.reg 1) leaf]
+            terminator := .jump { target := 1, values := #[.lit (.nat iterations)], credits := #[0, 1] } },
+          { valueParams := #[.scalar], creditParams := #[.required layout, .required layout]
+            instructions := #[]
+            terminator := .switchValue (.reg 0) #[] (some
+              { zero := { target := 3, values := #[], credits := #[0, 1] }
+                succ := { target := 2, values := #[], credits := #[0, 1] } }) },
+          { valueParams := #[.scalar], creditParams := #[.required layout, .required layout]
+            instructions := if calls then #[.call helperAddress #[], .dropUnique (.reg 1)] else #[]
+            terminator := .jump { target := 1, values := #[.reg 0], credits := #[1, 0] } },
+          { valueParams := #[], creditParams := #[.required layout, .required layout]
+            instructions := #[.allocWith 0 .unique leaf #[], .allocWith 1 .unique leaf #[],
+              .alloc .unique pair #[.reg 0, .reg 1]]
+            terminator := .ret (.reg 2) }] } }
+
+private def pairedCheck (policy : CreditPolicy) (iterations : Nat) (calls : Bool) : Bool :=
+  let program := pairedLoop iterations calls
+  accepts policy program && traceMatches policy program &&
+    match run policy .logical program, run policy .physical program 3100 2100 with
+    | .ok logical, .ok physical =>
+        let extra := if calls then 2 * iterations else 0
+        pairResult logical && pairResult physical && laws logical.store physical.store 0 &&
+          logical.store.heap.allocs == 5 + extra && logical.store.heap.frees == 2 + extra &&
+          physical.store.heap.allocs == 3 + extra && physical.store.heap.frees == extra &&
+          physical.store.heap.reuses == 2 && physical.store.heap.rcops == 0 &&
+          physical.store.peakLiveNodes == 3 && reclaimed .unique logical && reclaimed .unique physical
+    | _, _ => false
+
+#guard [0, 1, 2, 3, 16, 64].all fun count =>
+  pairedCheck .callLocalV0 count false && pairedCheck .suspendedCallsV1 count false &&
+    pairedCheck .suspendedCallsV1 count true
+#guard rejects .callLocalV0 .credit (pairedLoop 2 true)
+
+private def advance (policy : CreditPolicy) (program : Program) (interpretation : Interpretation)
+    (count : Nat) : Except Error Machine :=
+  count.fold (fun _ _ state => state.bind (Policy.step policy (Context.ofProgram program schemas) interpretation))
+    (.ok (initialMachine program.main #[] 2000))
+
+/-! At step 11 the nested callee is active, with two caller reservations and
+two continuation frames. Fresh allocation uses the next slot after both
+reservations; it cannot occupy either one. -/
+#guard match advance .suspendedCallsV1 (pairedLoop 1 true) .logical 11,
+    advance .suspendedCallsV1 (pairedLoop 1 true) .physical 11 with
+  | .ok logical, .ok physical =>
+      physical.presentCredits == 2 && physical.reservations == [0, 1] &&
+        (match physical.store.heap.nodes[0]? with | some none => true | _ => false) &&
+        (match physical.store.heap.nodes[1]? with | some none => true | _ => false) &&
+        physical.store.heap.nodes.size == 4 && physical.store.live == 1 &&
+        laws logical.store physical.store 2 &&
+        match physical.control with
+        | .running _ stack => stack.length == 2
+        | _ => false
+  | _, _ => false
+
+/-! Required unique, present optional shared, and absent optional shared
+credits coexist. The cold reset's old shared alias survives until released. -/
+
+private def mixed : Program :=
+  { declarations := []
+    main :=
+      { signature := signature
+        blocks := #[
+          { valueParams := #[], creditParams := #[]
+            instructions := #[
+              .alloc .unique field #[.lit (.nat 11)],
+              .alloc .shared field #[.lit (.nat 22)],
+              .alloc .shared field #[.lit (.nat 33)], .retainShared (.reg 2),
+              .takeUnique (.reg 0) field, .resetShared (.reg 1) field, .resetShared (.reg 2) field,
+              .allocWith 0 .unique field #[.reg 4], .allocWith 1 .shared field #[.reg 5],
+              .allocWith 2 .shared field #[.reg 6],
+              .releaseShared (.reg 3), .releaseShared (.reg 8), .releaseShared (.reg 9)]
+            terminator := .ret (.reg 7) }] } }
+
+private def mixedCheck (policy : CreditPolicy) : Bool :=
+  accepts policy mixed && traceMatches policy mixed &&
+    match run policy .logical mixed, run policy .physical mixed 3100 2100 with
+    | .ok logical, .ok physical =>
+        fieldResult .unique 11 logical && fieldResult .unique 11 physical &&
+          laws logical.store physical.store 0 &&
+          logical.store.heap.allocs == 6 && logical.store.heap.frees == 5 &&
+          physical.store.heap.allocs == 4 && physical.store.heap.frees == 3 &&
+          physical.store.heap.reuses == 2 && physical.store.heap.rcops == 5 &&
+          physical.store.resetAttempts == 2 && physical.store.hotResets == 1 &&
+          physical.store.coldResets == 1 && physical.store.reusedPayloadUnits == 2 &&
+          physical.store.peakLiveNodes == 4 && reclaimed .unique logical && reclaimed .unique physical
+    | _, _ => false
+
+#guard mixedCheck .callLocalV0 && mixedCheck .suspendedCallsV1
+#guard match advance .suspendedCallsV1 mixed .logical 7, advance .suspendedCallsV1 mixed .physical 7 with
+  | .ok logical, .ok physical =>
+      laws logical.store physical.store 2 && physical.presentCredits == 2 &&
+        match physical.control with
+        | .running frame [] => frame.credits.size == 3 &&
+            frame.credits[2]? == some (some { layout := fieldLayout, presence := .absent })
+        | _ => false
+  | _, _ => false
+
+/-! Both optional-credit branches reach the same join. One slot is reused,
+while another present or absent credit is explicitly discarded. -/
+
+private def diamond (cold : Bool) : Program :=
+  { declarations := []
+    main :=
+      { signature := signature .shared
+        blocks := #[
+          { valueParams := #[], creditParams := #[]
+            instructions := #[.alloc .shared field #[.lit (.nat 41)]] ++
+              (if cold then #[.retainShared (.reg 0)] else #[]) ++
+              #[.resetShared (.reg 0) field]
+            terminator := .branchCredit 0
+              { target := 1, values := if cold then #[.reg 1, .reg 2] else #[.lit (.nat 0), .reg 1], credits := #[0] }
+              { target := 2, values := if cold then #[.reg 1, .reg 2] else #[.lit (.nat 0), .reg 1], credits := #[0] } },
+          { valueParams := #[.owned .shared, .owned .shared], creditParams := #[.required fieldLayout]
+            instructions := #[]
+            terminator := .jump { target := 3, values := #[.reg 0, .reg 1], credits := #[0] } },
+          { valueParams := #[.owned .shared, .owned .shared], creditParams := #[.optional fieldLayout]
+            instructions := #[]
+            terminator := .jump { target := 3, values := #[.reg 0, .reg 1], credits := #[0] } },
+          { valueParams := #[.owned .shared, .owned .shared], creditParams := #[.optional fieldLayout]
+            instructions := #[.allocWith 0 .shared field #[.reg 1], .releaseShared (.reg 0),
+              .alloc .shared leaf #[]] ++
+              (if cold then #[.retainShared (.reg 3)] else #[]) ++
+              #[.resetShared (.reg 3) leaf, .discardCredit 1] ++
+              (if cold then #[.releaseShared (.reg 4)] else #[])
+            terminator := .ret (.reg 2) }] } }
+
+#guard [CreditPolicy.callLocalV0, .suspendedCallsV1].all fun policy =>
+  [false, true].all fun cold =>
+    let program := diamond cold
+    accepts policy program && traceMatches policy program &&
+      match run policy .logical program, run policy .physical program with
+      | .ok logical, .ok physical =>
+          fieldResult .shared 41 logical && fieldResult .shared 41 physical &&
+            laws logical.store physical.store 0 && physical.store.heap.reuses == (if cold then 0 else 1) &&
+            reclaimed .shared logical && reclaimed .shared physical
+      | _, _ => false
+
+/-! A borrowed parameter is read while the caller retains its owner and a
+separate reservation. The caller subsequently reuses that reservation. -/
+
+private def borrowed : Function :=
+  { signature := ⟨#[⟨.unique, .borrowed⟩], .unique, false⟩
+    blocks := #[
+      { valueParams := #[.borrowed .unique .caller], creditParams := #[]
+        instructions := #[.fetch (.reg 0) field 0]
+        terminator := .ret (.lit (.nat 17)) }] }
+
+private def borrowCall : Program :=
+  { declarations := [(helperAddress, .fn borrowed)]
+    main :=
+      { signature := signature
+        blocks := #[
+          { valueParams := #[], creditParams := #[]
+            instructions := #[.alloc .unique field #[.lit (.nat 51)], .alloc .unique leaf #[],
+              .takeUnique (.reg 1) leaf, .call helperAddress #[.reg 0], .dropUnique (.reg 2),
+              .allocWith 0 .unique leaf #[], .dropUnique (.reg 3)]
+            terminator := .ret (.reg 0) }] } }
+
+#guard accepts .suspendedCallsV1 borrowCall && traceMatches .suspendedCallsV1 borrowCall
+#guard rejects .callLocalV0 .credit borrowCall
+#guard match run .suspendedCallsV1 .logical borrowCall, run .suspendedCallsV1 .physical borrowCall with
+  | .ok logical, .ok physical =>
+      fieldResult .unique 51 logical && fieldResult .unique 51 physical &&
+        physical.store.heap.rcops == 0 && physical.store.heap.reuses == 1 &&
+        reclaimed .unique logical && reclaimed .unique physical
+  | _, _ => false
+
+/-! Malformed artifacts keep their existing rejection boundary. -/
+
+private def replaceBlock (program : Program) (id : Nat) (update : Block → Block) : Program :=
+  { program with main := { program.main with blocks := program.main.blocks.modify id update } }
+
+#guard rejects .suspendedCallsV1 .credit (replaceBlock (pairedLoop 1 false) 2 fun block =>
+  { block with terminator := .jump { target := 1, values := #[.reg 0], credits := #[0, 0] } })
+#guard rejects .suspendedCallsV1 .credit (replaceBlock (pairedLoop 1 false) 3 fun block =>
+  { block with
+    instructions := #[.allocWith 0 .unique field #[.lit (.nat 0)], .discardCredit 1]
+    terminator := .ret (.reg 0) })
+#guard rejects .suspendedCallsV1 .credit (replaceBlock (pairedLoop 1 false) 3 fun block =>
+  { block with
+    instructions := #[.discardCredit 0, .discardCredit 0, .discardCredit 1]
+    terminator := .ret (.lit (.nat 0)) })
+#guard rejects .suspendedCallsV1 .resources (replaceBlock (pairedLoop 1 false) 3 fun block =>
+  { block with instructions := #[], terminator := .ret (.lit (.nat 0)) })
+#guard rejects .suspendedCallsV1 .credit (replaceBlock (pairedLoop 1 true) 2 fun block =>
+  { block with instructions := #[], terminator := .tailCall helperAddress #[] })
+#guard [Instr.papp helperAddress #[], .apply .erased #[], .extern helperAddress #[]].all fun instruction =>
+  rejects .suspendedCallsV1 .credit (replaceBlock (pairedLoop 1 true) 2 fun block =>
+    { block with instructions := #[instruction] })
+#guard rejects .suspendedCallsV1 .borrow (replaceBlock borrowCall 0 fun block =>
+  { block with
+    instructions := #[.alloc .unique field #[.lit (.nat 51)], .fetch (.reg 0) field 0,
+      .dropUnique (.reg 0)]
+    terminator := .ret (.reg 1) })
+
+/-! Runner fuel is a budget, not a claim of divergence or semantic failure. -/
+#guard match run .suspendedCallsV1 .logical (pairedLoop 1 true) 0 100 with
+  | .error .controlFuel => true
+  | _ => false
+#guard match run .suspendedCallsV1 .physical (pairedLoop 1 true) 100 0 with
+  | .error .heapFuel => true
+  | _ => false
+
+end Ix.Compiler.IxIR2.CreditRefinement.Examples
diff --git a/Ix/Compiler/IxIR2/CreditFree.lean b/Ix/Compiler/IxIR2/CreditFree.lean
new file mode 100644
index 000000000..43a88e8a5
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditFree.lean
@@ -0,0 +1,32 @@
+import Ix.Compiler.IxIR2.Basic
+
+/-! The baseline instruction subset has no credit creation or consumption.
+This executable certificate is independent of the ordinary ownership validator.
+It lets clients transfer an entire execution between the two interpretations. -/
+
+namespace Ix.Compiler.IxIR2.CreditFree
+
+def instruction : Instr → Bool
+  | .allocWith .. | .discardCredit .. | .takeUnique .. | .resetShared .. => false
+  | _ => true
+
+def function (definition : Function) : Bool :=
+  definition.blocks.all fun block => block.instructions.all instruction
+
+def program (source : Program) : Bool :=
+  function source.main && source.declarations.all fun entry =>
+    match entry.2 with
+    | .fn definition => function definition
+    | .extern _ => true
+
+theorem instructionAt {definition : Function} {block : Block}
+    {blockId index : Nat} (free : function definition = true)
+    (blockAt : definition.blocks[blockId]? = some block)
+    (bound : index < block.instructions.size) :
+    instruction block.instructions[index] = true := by
+  obtain ⟨blockBound, blockEq⟩ := Array.getElem?_eq_some_iff.mp blockAt
+  subst block
+  exact Array.all_eq_true.mp
+    (Array.all_eq_true.mp free blockId blockBound) index bound
+
+end Ix.Compiler.IxIR2.CreditFree
diff --git a/Ix/Compiler/IxIR2/CreditHeap.lean b/Ix/Compiler/IxIR2/CreditHeap.lean
new file mode 100644
index 000000000..0d645acf6
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditHeap.lean
@@ -0,0 +1,185 @@
+import Ix.Compiler.IxIR2.CreditHeapObservations
+import Ix.Compiler.IxIR2.CallReuseOrder
+
+/-! Heap operations with exact logical/physical cost agreement. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso NodeIso NodeBoxIso)
+open CallReuse.Sim (MapRel HeapMap Ordered)
+open Ix.Compiler.IxIR1.Reclamation (AllocationOrderInvariant)
+
+/-- Reuse changes fresh allocation and free counts. Allocation events, RC,
+peak live nodes, and reset decisions agree throughout execution. -/
+structure HeapRel (mapping : Array Nat) (left right : Store) : Prop where
+  heap : HeapMap left right mapping
+  events : left.allocationEvents = right.allocationEvents
+  rcops : left.heap.rcops = right.heap.rcops
+  peak : left.peakLiveNodes = right.peakLiveNodes
+  attempts : left.resetAttempts = right.resetAttempts
+  hot : left.hotResets = right.hotResets
+  cold : left.coldResets = right.coldResets
+  ordered : Ordered left
+
+theorem HeapRel.empty : HeapRel #[] ({} : Store) ({} : Store) :=
+  ⟨.empty, rfl, rfl, rfl, rfl, rfl, rfl, .empty⟩
+
+theorem HeapRel.passive {mapping : Array Nat} {left right leftOut rightOut : Store}
+    (state : HeapRel mapping left right) (heap : HeapMap leftOut rightOut mapping)
+    (leftPassive : passiveCounters leftOut = passiveCounters left)
+    (rightPassive : passiveCounters rightOut = passiveCounters right)
+    (rcops : leftOut.heap.rcops = rightOut.heap.rcops) (ordered : Ordered leftOut) :
+    HeapRel mapping leftOut rightOut := by
+  have eventsLeft := congrArg (fun c => c.allocs + c.reuses) leftPassive
+  have eventsRight := congrArg (fun c => c.allocs + c.reuses) rightPassive
+  refine ⟨heap, eventsLeft.trans (state.events.trans eventsRight.symm), rcops, ?_, ?_, ?_, ?_, ordered⟩
+  · exact (congrArg Counters.peakLiveNodes leftPassive).trans
+      (state.peak.trans (congrArg Counters.peakLiveNodes rightPassive).symm)
+  · exact (congrArg Counters.resetAttempts leftPassive).trans
+      (state.attempts.trans (congrArg Counters.resetAttempts rightPassive).symm)
+  · exact (congrArg Counters.hotResets leftPassive).trans
+      (state.hot.trans (congrArg Counters.hotResets rightPassive).symm)
+  · exact (congrArg Counters.coldResets leftPassive).trans
+      (state.cold.trans (congrArg Counters.coldResets rightPassive).symm)
+
+theorem HeapRel.alloc {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) {world : Owned} {leftNode rightNode : Node}
+    (nodes : NodeIso (MapRel mapping) leftNode rightNode) :
+    HeapRel (mapping.push right.heap.nodes.size)
+      (left.allocNode world leftNode).1 (right.allocNode world rightNode).1 := by
+  have heap := state.heap.alloc (world := world) nodes
+  refine ⟨heap, by simp only [Store.allocationEvents_allocNode, state.events],
+    state.rcops, ?_, state.attempts, state.hot, state.cold, state.ordered.alloc state.heap nodes⟩
+  simp only [Store.peakLive_allocNode, state.peak, heap.live_eq]
+
+theorem HeapRel.kill {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) {l r : Nat} {box : NodeBox}
+    (mapped : MapRel mapping l r) (found : left.get? l = some box) :
+    HeapRel mapping (left.kill l) (right.kill r) :=
+  ⟨state.heap.kill mapped found, state.events, state.rcops, state.peak,
+    state.attempts, state.hot, state.cold, AllocationOrderInvariant.kill state.ordered found⟩
+
+theorem HeapRel.reserve {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) {l r : Nat} {box : NodeBox}
+    (mapped : MapRel mapping l r) (found : left.get? l = some box) :
+    HeapRel mapping (left.kill l) (right.reserve r) :=
+  ⟨state.heap.reserve mapped found, state.events, state.rcops, state.peak,
+    state.attempts, state.hot, state.cold, AllocationOrderInvariant.kill state.ordered found⟩
+
+theorem HeapRel.setBox {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) {l r : Nat} {old newLeft newRight : NodeBox}
+    (mapped : MapRel mapping l r) (found : left.get? l = some old)
+    (boxes : NodeBoxIso (MapRel mapping) newLeft newRight)
+    (ordered : Ordered (left.setBox l newLeft)) :
+    HeapRel mapping (left.setBox l newLeft) (right.setBox r newRight) :=
+  ⟨state.heap.setBox mapped found boxes, state.events, state.rcops, state.peak,
+    state.attempts, state.hot, state.cold, ordered⟩
+
+theorem HeapRel.rcTick {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) : HeapRel mapping left.rcTick right.rcTick :=
+  ⟨state.heap.rcTick, state.events, congrArg (· + 1) state.rcops, state.peak,
+    state.attempts, state.hot, state.cold, AllocationOrderInvariant.rcTick state.ordered⟩
+
+theorem HeapRel.tickAttempt {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) :
+    HeapRel mapping left.tickResetAttempt right.tickResetAttempt :=
+  ⟨state.heap.congr rfl rfl, state.events, state.rcops, state.peak,
+    congrArg (· + 1) state.attempts, state.hot, state.cold, state.ordered⟩
+
+theorem HeapRel.tickHot {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) :
+    HeapRel mapping left.tickHotReset right.tickHotReset :=
+  ⟨state.heap.congr rfl rfl, state.events, state.rcops, state.peak,
+    state.attempts, congrArg (· + 1) state.hot, state.cold, state.ordered⟩
+
+theorem HeapRel.tickCold {mapping : Array Nat} {left right : Store}
+    (state : HeapRel mapping left right) :
+    HeapRel mapping left.tickColdReset right.tickColdReset :=
+  ⟨state.heap.congr rfl rfl, state.events, state.rcops, state.peak,
+    state.attempts, state.hot, congrArg (· + 1) state.cold, state.ordered⟩
+
+theorem HeapRel.reuse {mapping : Array Nat} {left right rightOut : Store}
+    (state : HeapRel mapping left right) {location payload : Nat} {world : Owned}
+    {leftNode rightNode : Node} (nodes : NodeIso (MapRel mapping) leftNode rightNode)
+    (run : right.reuseReservation location world rightNode payload = .ok rightOut) :
+    HeapRel (mapping.push location) (left.allocNode world leftNode).1 rightOut := by
+  have heap := state.heap.reuse nodes run
+  have observed := Store.reuseReservation_observations run
+  have events := Store.reuseReservation_allocationEvents run
+  refine ⟨heap, by rw [Store.allocationEvents_allocNode, events, state.events],
+    state.rcops.trans observed.1.symm, ?_, ?_, ?_, ?_, state.ordered.alloc state.heap nodes⟩
+  · rw [Store.peakLive_allocNode, observed.2.2.1, state.peak, heap.live_eq]
+  all_goals
+    unfold Store.reuseReservation at run
+    split at run
+    · cases run
+      first | exact state.attempts | exact state.hot | exact state.cold
+    · cases run
+
+theorem HeapRel.discard {mapping : Array Nat} {left right rightOut : Store}
+    (state : HeapRel mapping left right) {location : Nat}
+    (run : right.releaseReservation location = .ok rightOut) :
+    HeapRel mapping left rightOut := by
+  unfold Store.releaseReservation at run
+  split at run
+  · cases run
+    exact ⟨state.heap.congr rfl rfl, state.events, state.rcops, state.peak,
+      state.attempts, state.hot, state.cold, state.ordered⟩
+  · cases run
+
+theorem HeapRel.retain {mapping : Array Nat} {left right leftOut : Store}
+    (state : HeapRel mapping left right) {leftValue rightValue : RVal}
+    (values : RValIso (MapRel mapping) leftValue rightValue)
+    (run : retainShared left leftValue = .ok leftOut) :
+    ∃ rightOut, retainShared right rightValue = .ok rightOut ∧ HeapRel mapping leftOut rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.retain values run
+  refine ⟨rightOut, targetRun, state.passive heap (retain_passive run)
+    (retain_passive targetRun) ?_ (state.ordered.retain run)⟩
+  have leftRC := (retainShared_observations run).1
+  have rightRC := (retainShared_observations targetRun).1
+  have refs : referenceCount leftValue = referenceCount rightValue := by cases values <;> rfl
+  rw [leftRC, rightRC, state.rcops, refs]
+
+theorem HeapRel.retainMany {mapping : Array Nat} {left right leftOut : Store}
+    (state : HeapRel mapping left right) {leftValues rightValues : Array RVal}
+    (values : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (run : RetainSharedMany left leftValues leftOut) :
+    ∃ rightOut, RetainSharedMany right rightValues rightOut ∧ HeapRel mapping leftOut rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.retainMany values run
+  refine ⟨rightOut, targetRun, state.passive heap (retainMany_passive run)
+    (retainMany_passive targetRun) ?_ (state.ordered.retainMany run)⟩
+  rw [run.observations.1, targetRun.observations.1, state.rcops, referenceCountList_iso values]
+
+theorem HeapRel.releaseWork {mapping : Array Nat} {left right leftOut : Store}
+    (state : HeapRel mapping left right) {fuel remaining : Nat}
+    {leftValues rightValues : List RVal} (values : RValsIso (MapRel mapping) leftValues rightValues)
+    (run : releaseSharedWork fuel left leftValues = .ok (leftOut, remaining)) :
+    ∃ rightOut, releaseSharedWork fuel right rightValues = .ok (rightOut, remaining) ∧
+      HeapRel mapping leftOut rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.releaseWork values run
+  refine ⟨rightOut, targetRun, state.passive heap (releaseWork_passive run)
+    (releaseWork_passive targetRun) ?_ (state.ordered.releaseWork run)⟩
+  have beforePending := state.heap.pendingRC_eq
+  have afterPending := heap.pendingRC_eq
+  have leftRC := (releaseSharedWork_observations run).2.1
+  have rightRC := (releaseSharedWork_observations targetRun).2.1
+  change leftOut.heap.rcops + leftOut.pendingRC = left.heap.rcops + left.pendingRC at leftRC
+  change rightOut.heap.rcops + rightOut.pendingRC = right.heap.rcops + right.pendingRC at rightRC
+  have initial := state.rcops
+  omega
+
+theorem HeapRel.dropWork {mapping : Array Nat} {left right leftOut : Store}
+    (state : HeapRel mapping left right) {fuel remaining : Nat}
+    {leftValues rightValues : List RVal} (values : RValsIso (MapRel mapping) leftValues rightValues)
+    (run : dropUniqueWork fuel left leftValues = .ok (leftOut, remaining)) :
+    ∃ rightOut, dropUniqueWork fuel right rightValues = .ok (rightOut, remaining) ∧
+      HeapRel mapping leftOut rightOut := by
+  obtain ⟨rightOut, targetRun, heap⟩ := state.heap.dropWork values run
+  exact ⟨rightOut, targetRun, state.passive heap (dropWork_passive run)
+    (dropWork_passive targetRun) ((dropUniqueWork_observations run).1.trans
+      (state.rcops.trans (dropUniqueWork_observations targetRun).1.symm))
+    (state.ordered.dropWork run)⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditHeapObservations.lean b/Ix/Compiler/IxIR2/CreditHeapObservations.lean
new file mode 100644
index 000000000..7a89823f5
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditHeapObservations.lean
@@ -0,0 +1,113 @@
+import Ix.Compiler.IxIR2.CreditRelation
+
+/-! Counters untouched by retain and recursive destruction. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+
+/-- Recursive heap traversal changes RC and free counts; every other counter
+is preserved. Live nodes are tracked separately by the heap relation. -/
+def passiveCounters (store : Store) : Counters :=
+  { store.counters with frees := 0, rcops := 0 }
+
+theorem retain_passive {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) :
+    passiveCounters output = passiveCounters store := by
+  cases value with
+  | lit => cases run; rfl
+  | erased => cases run; rfl
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp [retainShared, found, shared] at run
+            subst output
+            rfl
+          · simp [retainShared, found, shared] at run
+
+theorem retainMany_passive {store output : Store} {values : Array RVal}
+    (run : RetainSharedMany store values output) :
+    passiveCounters output = passiveCounters store := by
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  have loop : ∀ (values : List RVal) {store output : Store},
+      values.foldlM retainShared store = .ok output →
+      passiveCounters output = passiveCounters store := by
+    intro values
+    induction values with
+    | nil => intro store output run; cases run; rfl
+    | cons head tail ih =>
+        intro store output run
+        rw [List.foldlM_cons] at run
+        cases first : retainShared store head with
+        | error error => simp [first, bind, Except.bind] at run
+        | ok middle =>
+            simp only [first, bind, Except.bind] at run
+            exact (ih run).trans (retain_passive first)
+  exact loop values.toList run
+
+theorem releaseWork_passive {fuel remaining : Nat} {store output : Store} {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    passiveCounters output = passiveCounters store := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; rfl
+      | cons => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; rfl
+      | cons value rest =>
+          cases value with
+          | lit => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unit : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unit, beq_self_eq_true,
+                          Nat.reduceBEq] at run
+                        have preserved := ih run
+                        exact preserved
+                      · simp [releaseSharedWork, found, shared, zero, unit] at run
+                        have preserved := ih run
+                        exact preserved
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem dropWork_passive {fuel remaining : Nat} {store output : Store} {values : List RVal}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) :
+    passiveCounters output = passiveCounters store := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; rfl
+      | cons => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; rfl
+      | cons value rest =>
+          cases value with
+          | lit => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        have preserved := ih run
+                        exact preserved
+                  · simp [dropUniqueWork, found, unique] at run
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditInstructions.lean b/Ix/Compiler/IxIR2/CreditInstructions.lean
new file mode 100644
index 000000000..0b5a5a250
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditInstructions.lean
@@ -0,0 +1,230 @@
+import Ix.Compiler.IxIR2.CreditApply
+
+/-! Every instruction of the logical/physical credit language. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+open CallReuse.Sim (MapRel)
+
+theorem instruction_related {context : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {heapFuel : Nat}
+    {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {instruction : Instr} {leftAfter : Machine}
+    (state : HeapRel mapping leftStore rightStore)
+    (frames : FrameRel mapping leftFrame rightFrame)
+    (stack : StackRel mapping leftStack rightStack)
+    (owned : (Machine.mk rightStore 0 (.running rightFrame rightStack)).ReservationOwnership)
+    (classified : InstructionTransferCase context .logical leftStore heapFuel leftFrame
+      leftStack instruction leftAfter) :
+    ∃ after rightAfter,
+      InstructionTransferCase context .physical rightStore heapFuel rightFrame
+        rightStack instruction rightAfter ∧ TransferRel mapping after leftAfter rightAfter := by
+  have advanced := frames.advance
+  cases classified
+  case move atom value resolved =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    exact ⟨mapping, _, .move targetResolved,
+      ⟨state, MapExtends.refl _, rfl, .running (advanced.push valueRel) stack⟩⟩
+  case alloc world cid arguments schema values schemaAt resolved fields =>
+    obtain ⟨targetValues, targetResolved, valuesRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    have allocating := state.alloc (world := world) (leftNode := .ctorN cid values) (.ctor valuesRel)
+    have extension : MapExtends mapping (mapping.push rightStore.heap.nodes.size) :=
+      MapExtends.push mapping rightStore.heap.nodes.size
+    have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+        (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+      .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+    exact ⟨_, _, .alloc schemaAt targetResolved (state.fieldWorlds valuesRel fields),
+      ⟨allocating, extension, rfl,
+        .running ((advanced.mono extension).push valueRel) (stack.mono extension)⟩⟩
+  case allocWithAbsent index credit world cid arguments schema values next
+      schemaAt resolved fields taken layout absent =>
+    obtain ⟨targetValues, targetResolved, valuesRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    obtain ⟨targetNext, targetCredit, targetTaken, nextRel, creditRel⟩ := advanced.creditTake taken
+    cases creditRel with
+    | present => cases absent
+    | absent creditLayout =>
+        have allocating := state.alloc (world := world) (leftNode := .ctorN cid values) (.ctor valuesRel)
+        have extension : MapExtends mapping (mapping.push rightStore.heap.nodes.size) :=
+          MapExtends.push mapping rightStore.heap.nodes.size
+        have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+            (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+          .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+        exact ⟨_, _, .allocWithAbsent schemaAt targetResolved (state.fieldWorlds valuesRel fields)
+          targetTaken layout rfl, ⟨allocating, extension, rfl,
+            .running ((nextRel.mono extension).push valueRel) (stack.mono extension)⟩⟩
+  case allocWithLogical index credit world cid arguments schema values next
+      mode schemaAt resolved fields taken layout present =>
+    obtain ⟨targetValues, targetResolved, valuesRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    obtain ⟨targetNext, targetCredit, targetTaken, nextRel, creditRel⟩ := advanced.creditTake taken
+    cases creditRel with
+    | absent => cases present
+    | present creditLayout location =>
+        have empty := reservedCredit (frame := { rightFrame with pc := rightFrame.pc + 1 })
+          owned targetTaken rfl
+        obtain ⟨output, reused⟩ : ∃ output,
+            rightStore.reuseReservation location world (.ctorN cid targetValues)
+              schema.fields.size = .ok output := by
+          unfold Store.reuseReservation
+          rw [empty]
+          exact ⟨_, rfl⟩
+        have allocating := state.reuse (leftNode := .ctorN cid values) (.ctor valuesRel) reused
+        have extension : MapExtends mapping (mapping.push location) := MapExtends.push mapping location
+        have valueRel : RValIso (MapRel (mapping.push location))
+            (.loc leftStore.heap.nodes.size) (.loc location) :=
+          .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+        exact ⟨_, _, .allocWithPhysical rfl schemaAt targetResolved (state.fieldWorlds valuesRel fields)
+          targetTaken layout rfl reused, ⟨allocating, extension, rfl,
+            .running ((nextRel.mono extension).push valueRel) (stack.mono extension)⟩⟩
+  case allocWithPhysical => contradiction
+  case discardAbsent index credit next taken absent =>
+    obtain ⟨targetNext, targetCredit, targetTaken, nextRel, creditRel⟩ := advanced.creditTake taken
+    cases creditRel with
+    | present => cases absent
+    | absent => exact ⟨mapping, _, .discardAbsent targetTaken rfl,
+        ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  case discardLogical index credit next mode taken present =>
+    obtain ⟨targetNext, targetCredit, targetTaken, nextRel, creditRel⟩ := advanced.creditTake taken
+    cases creditRel with
+    | absent => cases present
+    | present creditLayout location =>
+        have empty := reservedCredit (frame := { rightFrame with pc := rightFrame.pc + 1 })
+          owned targetTaken rfl
+        obtain ⟨output, released⟩ : ∃ output,
+            rightStore.releaseReservation location = .ok output := by
+          unfold Store.releaseReservation
+          rw [empty]
+          exact ⟨_, rfl⟩
+        exact ⟨mapping, _, .discardPhysical rfl targetTaken rfl released,
+          ⟨state.discard released, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  case discardPhysical => contradiction
+  case takeUniqueLogical atom cid schema location box fields mode schemaAt resolved viewed unitRC =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped viewed
+        exact ⟨mapping, _, .takeUniquePhysical rfl schemaAt targetResolved targetView
+          (boxes.rc.symm.trans unitRC),
+          ⟨state.reserve mapped viewed.parts.1, MapExtends.refl _, rfl,
+            .running (advanced.appendCredit fieldsRel (.present schema.layout targetLocation)) stack⟩⟩
+  case takeUniquePhysical => contradiction
+  case resetSharedLogicalHot atom cid schema location box fields mode schemaAt resolved viewed unitRC =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped viewed
+        exact ⟨mapping, _, .resetSharedPhysicalHot rfl schemaAt targetResolved targetView
+          (boxes.rc.symm.trans unitRC),
+          ⟨(state.tickAttempt.reserve mapped viewed.parts.1).tickHot, MapExtends.refl _, rfl,
+            .running (advanced.appendCredit fieldsRel (.present schema.layout targetLocation)) stack⟩⟩
+  case resetSharedPhysicalHot => contradiction
+  case resetSharedCold atom cid schema location box fields output schemaAt resolved viewed many retained =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped viewed
+        have changed := ((state.tickAttempt.setBox mapped viewed.parts.1
+          (newLeft := { box with rc := box.rc - 1 })
+          (newRight := { targetBox with rc := targetBox.rc - 1 })
+          ⟨boxes.world, congrArg (· - 1) boxes.rc, boxes.node⟩
+          (IxIR1.Reclamation.AllocationOrderInvariant.setRc state.ordered viewed.parts.1
+            (newRc := box.rc - 1) (by omega))).rcTick).tickCold
+        obtain ⟨targetOutput, targetRetained, heap⟩ := changed.retainMany fieldsRel retained
+        exact ⟨mapping, _, .resetSharedCold schemaAt targetResolved targetView
+          (by rw [← boxes.rc]; exact many) targetRetained,
+          ⟨heap, MapExtends.refl _, rfl,
+            .running (advanced.appendCredit fieldsRel (.absent schema.layout)) stack⟩⟩
+  case retainShared atom value output resolved retained =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    obtain ⟨targetOutput, targetRun, heap⟩ := state.retain valueRel retained
+    exact ⟨mapping, _, .retainShared targetResolved targetRun,
+      ⟨heap, MapExtends.refl _, rfl, .running (advanced.push valueRel) stack⟩⟩
+  case releaseShared atom value output remaining resolved released =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    obtain ⟨targetOutput, targetRun, heap⟩ := state.releaseWork (.cons valueRel .nil) released
+    exact ⟨mapping, _, .releaseShared targetResolved targetRun,
+      ⟨heap, MapExtends.refl _, rfl, .running advanced stack⟩⟩
+  case dropUnique atom value output remaining resolved dropped =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    obtain ⟨targetOutput, targetRun, heap⟩ := state.dropWork (.cons valueRel .nil) dropped
+    exact ⟨mapping, _, .dropUnique targetResolved targetRun,
+      ⟨heap, MapExtends.refl _, rfl, .running advanced stack⟩⟩
+  case freeUnique atom cid location box fields resolved viewed scalarFields =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped viewed
+        exact ⟨mapping, _, .freeUnique targetResolved targetView
+          (by rw [← values_scalar fieldsRel]; exact scalarFields),
+          ⟨state.kill mapped viewed.parts.1, MapExtends.refl _, rfl, .running advanced stack⟩⟩
+  case fetch atom cid field location box fields value resolved boxAt node fieldAt =>
+    obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+    cases valueRel with
+    | @loc _ targetLocation mapped =>
+        obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+          state.heap.constructorView mapped (ConstructorView.of_box boxAt rfl node)
+        obtain ⟨targetField, targetFieldAt, fieldRel⟩ := fieldsRel.get? (by simpa using fieldAt)
+        exact ⟨mapping, _, .fetch targetResolved targetView.parts.1 targetView.parts.2.2
+          (by simpa using targetFieldAt),
+          ⟨state, MapExtends.refl _, rfl, .running (advanced.push fieldRel) stack⟩⟩
+  case callFn address atoms arguments definition noCredits resolved declaration arity nonempty =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    exact ⟨mapping, _, .callFn (frames.noCredits noCredits) targetResolved declaration
+      (by rw [← values_size argumentsRel]; exact arity) nonempty,
+      ⟨state, MapExtends.refl _, rfl,
+        .running (.entry definition argumentsRel) (.cons (.resume advanced) stack)⟩⟩
+  case callSelf atoms arguments noCredits resolved arity nonempty =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    refine ⟨mapping, _, .callSelf (frames.noCredits noCredits) targetResolved
+      (by rw [← values_size argumentsRel, ← frames.definition]; exact arity)
+      (by rw [← frames.definition]; exact nonempty),
+      ⟨state, MapExtends.refl _, rfl, .running ?_ (.cons (.resume advanced) stack)⟩⟩
+    simpa only [frames.definition] using FrameRel.entry leftFrame.definition argumentsRel
+  case pappFn address atoms arguments definition noCredits declaration papSafe resolved under =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    have allocating := state.alloc (world := .shared)
+      (leftNode := .papN address definition.signature.params.size arguments) (.pap argumentsRel)
+    have extension : MapExtends mapping (mapping.push rightStore.heap.nodes.size) :=
+      MapExtends.push mapping rightStore.heap.nodes.size
+    have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+        (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+      .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+    exact ⟨_, _, .pappFn (frames.noCredits noCredits) declaration papSafe targetResolved
+      (by rw [← values_size argumentsRel]; exact under),
+      ⟨allocating, extension, rfl,
+        .running ((advanced.mono extension).push valueRel) (stack.mono extension)⟩⟩
+  case pappExtern address atoms arguments arity noCredits declaration resolved under =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    have allocating := state.alloc (world := .shared)
+      (leftNode := .papN address arity arguments) (.pap argumentsRel)
+    have extension : MapExtends mapping (mapping.push rightStore.heap.nodes.size) :=
+      MapExtends.push mapping rightStore.heap.nodes.size
+    have valueRel : RValIso (MapRel (mapping.push rightStore.heap.nodes.size))
+        (.loc leftStore.heap.nodes.size) (.loc rightStore.heap.nodes.size) :=
+      .loc (by rw [← state.heap.size]; exact MapRel.fresh ..)
+    exact ⟨_, _, .pappExtern (frames.noCredits noCredits) declaration targetResolved
+      (by rw [← values_size argumentsRel]; exact under),
+      ⟨allocating, extension, rfl,
+        .running ((advanced.mono extension).push valueRel) (stack.mono extension)⟩⟩
+  case apply functionAtom argumentAtoms function arguments noCredits functionResolved argumentsResolved transferred =>
+    obtain ⟨targetFunction, targetFunctionResolved, functionRel⟩ :=
+      ReuseSim.resolveAtom_iso frames.values functionResolved
+    obtain ⟨targetArguments, targetArgumentsResolved, argumentsRel⟩ :=
+      ReuseSim.resolveAtoms_iso frames.values argumentsResolved
+    obtain ⟨after, target, transfer, related⟩ :=
+      apply_related state functionRel argumentsRel advanced stack transferred
+    exact ⟨after, target, .apply (frames.noCredits noCredits)
+      targetFunctionResolved targetArgumentsResolved transfer, related⟩
+  case extern address atoms arguments arity value noCredits resolved declaration argumentArity called =>
+    obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+    obtain ⟨targetCalled, valueRel⟩ := scalarOracle_related argumentsRel called
+    exact ⟨mapping, _, .extern (frames.noCredits noCredits) targetResolved declaration
+      (by rw [← values_size argumentsRel]; exact argumentArity) targetCalled,
+      ⟨state, MapExtends.refl _, rfl, .running (advanced.push valueRel) stack⟩⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditPolicy.lean b/Ix/Compiler/IxIR2/CreditPolicy.lean
new file mode 100644
index 000000000..ed39452a9
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditPolicy.lean
@@ -0,0 +1,24 @@
+import Ix.Compiler.IxIR2.Basic
+
+/-!
+# Versioned credit boundaries
+
+The original policy keeps credits local to a call. The second policy permits
+only direct non-tail calls to suspend credits in their owning continuation.
+Neither policy passes credits as arguments or permits a live credit at return,
+tail call, partial application, dynamic application, or an extern boundary.
+-/
+
+namespace Ix.Compiler.IxIR2
+
+inductive CreditPolicy where
+  | callLocalV0
+  | suspendedCallsV1
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- An explicit artifact input; changing a credit boundary changes this tag. -/
+def CreditPolicy.tag : CreditPolicy → String
+  | .callLocalV0 => "call-local/0"
+  | .suspendedCallsV1 => "suspended-direct-calls/1"
+
+end Ix.Compiler.IxIR2
diff --git a/Ix/Compiler/IxIR2/CreditReclamation.lean b/Ix/Compiler/IxIR2/CreditReclamation.lean
new file mode 100644
index 000000000..704377ea0
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditReclamation.lean
@@ -0,0 +1,163 @@
+import Ix.Compiler.IxIR2.CreditSimulation
+import Ix.Compiler.IxIR2.LowerSim
+
+/-!
+# Owned results and complete reclamation
+
+Successful execution and counter refinement need no optimizer-specific
+ownership history. Complete reclamation has an explicit domain: the logical
+result owns the remaining heap. Allocation order is derived by the execution
+bridge, and release fuel is constructed internally from that ownership fact.
+-/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim (RootOwnership HeapIso HasWorld LiveRVal RValIso)
+open Ix.Compiler.IxIR1.Reclamation (AllocationOrderInvariant)
+open CallReuse.Sim (MapRel)
+
+theorem live_of_world {store : IxIR1.Store} {world : Owned} {value : RVal}
+    (valid : HasWorld store world value) : LiveRVal store value := by
+  cases value with
+  | lit => trivial
+  | erased => trivial
+  | loc location =>
+      obtain ⟨box, found, _⟩ := valid
+      exact ⟨box, found⟩
+
+/-- The allocation-history relation restricts to the established finite
+live-heap bijection at every closed logical endpoint. -/
+def OutcomeRel.ownedIso {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) {world : Owned}
+    (owned : RootOwnership logical.store.heap [⟨world, logical.value⟩]) :
+    HeapIso logical.store.heap physical.store.heap :=
+  related.heap.heap.toHeapIso owned.storeClosed
+
+theorem OutcomeRel.ownedValue {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) {world : Owned}
+    (owned : RootOwnership logical.store.heap [⟨world, logical.value⟩]) :
+    RValIso (related.ownedIso owned).locRel logical.value physical.value :=
+  related.heap.heap.toHeapIso_value owned.storeClosed related.value
+    (live_of_world (owned.roots_world ⟨world, logical.value⟩ (by simp)))
+
+theorem OutcomeRel.ownership {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) {world : Owned}
+    (owned : RootOwnership logical.store.heap [⟨world, logical.value⟩]) :
+    RootOwnership physical.store.heap [⟨world, physical.value⟩] := by
+  have roots : IxIR1.Sim.RootsIso (related.ownedIso owned).locRel
+      [⟨world, logical.value⟩] [⟨world, physical.value⟩] :=
+    .cons ⟨rfl, related.ownedValue owned⟩ .nil
+  exact (related.ownedIso owned).rootOwnership roots owned
+
+theorem OutcomeRel.valueGraph {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) {world : Owned}
+    (owned : RootOwnership logical.store.heap [⟨world, logical.value⟩])
+    {functions : IxIR1.Sim.FunctionRel} {value : IxIR0.Value}
+    (graph : IxIR1.Sim.ValueGraph functions logical.store.heap value logical.value) :
+    IxIR1.Sim.ValueGraph functions physical.store.heap value physical.value :=
+  graph.transport (related.ownedIso owned) (related.ownedValue owned)
+
+def reclaim (world : Owned) (fuel : Nat) (store : Store) (value : RVal) :
+    Except Error (Store × Nat) :=
+  match world with
+  | .shared => releaseShared fuel store value
+  | .unique => dropUnique fuel store value
+
+theorem reclaim_passive {world : Owned} {fuel remaining : Nat} {store output : Store} {value : RVal}
+    (run : reclaim world fuel store value = .ok (output, remaining)) :
+    passiveCounters output = passiveCounters store := by
+  cases world with
+  | shared => exact releaseWork_passive run
+  | unique => exact dropWork_passive run
+
+theorem reclaim_balance {world : Owned} {fuel remaining : Nat} {store output : Store} {value : RVal}
+    (run : reclaim world fuel store value = .ok (output, remaining)) : HeapBalance store output := by
+  cases world with
+  | shared => exact releaseShared_heapBalance run
+  | unique => exact dropUnique_heapBalance run
+
+theorem HeapRel.reclaim {mapping : Array Nat} {left right output : Store}
+    (state : HeapRel mapping left right) {world : Owned} {fuel remaining : Nat}
+    {leftValue rightValue : RVal} (values : RValIso (MapRel mapping) leftValue rightValue)
+    (run : reclaim world fuel left leftValue = .ok (output, remaining)) :
+    ∃ target, reclaim world fuel right rightValue = .ok (target, remaining) ∧
+      HeapRel mapping output target := by
+  cases world with
+  | shared => exact state.releaseWork (.cons values .nil) run
+  | unique => exact state.dropWork (.cons values .nil) run
+
+/-- The existing ownership progress proof supplies a finite release budget.
+The bridge from IxIR₁ destruction is used only for its identical heap rules;
+all actual IxIR₂ diagnostics and costs are retained by heap congruence. -/
+theorem reclaim_progress {store : Store} {value : RVal} {world : Owned}
+    (owned : RootOwnership store.heap [⟨world, value⟩])
+    (ordered : AllocationOrderInvariant store.heap) :
+    ∃ fuel output, reclaim world fuel store value = .ok (output, 0) ∧ output.live = 0 := by
+  let bare : Store := { heap := store.heap }
+  have stores : Lower.Sim.StoreRel store.heap bare := ⟨rfl, rfl, rfl, rfl, rfl⟩
+  have same : ReuseSim.HeapContentsEq bare store := ⟨rfl⟩
+  cases world with
+  | shared =>
+      obtain ⟨sourceFuel, sourceOut, sourceRun, sourceEmpty⟩ :=
+        IxIR1.Reclamation.shared_reclamation (ctx := { decls := fun _ => none }) owned ordered
+      have positive : Lower.Sim.PositiveSharedRC store.heap := fun found _ => ordered.rc_pos found
+      obtain ⟨fuel, bareOut, bareRun, related, _⟩ :=
+        Lower.Sim.dropVal_simulates_releaseSharedWork positive stores sourceRun
+      obtain ⟨output, run, contents⟩ := same.releaseShared bareRun
+      refine ⟨fuel, output, run, ?_⟩
+      have bareEmpty : bareOut.live = 0 := by
+        change bareOut.heap.live = 0
+        rw [related.heap]
+        exact sourceEmpty
+      rw [Store.live_eq_countP, ← contents.nodes, ← Store.live_eq_countP]
+      exact bareEmpty
+  | unique =>
+      obtain ⟨sourceFuel, sourceOut, sourceRun, sourceEmpty⟩ :=
+        IxIR1.Reclamation.unique_reclamation (ctx := { decls := fun _ => none }) owned ordered
+      obtain ⟨fuel, bareOut, bareRun, related⟩ :=
+        Lower.Sim.dropUVal_simulates_dropUniqueWork stores sourceRun
+      obtain ⟨output, run, contents⟩ := same.dropUnique bareRun
+      refine ⟨fuel, output, run, ?_⟩
+      have bareEmpty : bareOut.live = 0 := by
+        change bareOut.heap.live = 0
+        rw [related.heap]
+        exact sourceEmpty
+      rw [Store.live_eq_countP, ← contents.nodes, ← Store.live_eq_countP]
+      exact bareEmpty
+
+structure ReclamationRel (mapping : Array Nat) (logical physical : Store) : Prop where
+  heap : HeapRel mapping logical physical
+  logicalEmpty : logical.live = 0
+  physicalEmpty : physical.live = 0
+  logicalFreed : logical.heap.allocs = logical.heap.frees
+  physicalFreed : physical.heap.allocs = physical.heap.frees
+  counters : CounterLaw logical.snapshot physical.snapshot 0
+
+/-- Both actual heaps reclaim completely, with the same independent release
+budget and the same comparative allocation, free, RC, and peak observations. -/
+theorem OutcomeRel.reclamation {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) {world : Owned}
+    (owned : RootOwnership logical.store.heap [⟨world, logical.value⟩]) :
+    ∃ fuel left right,
+      reclaim world fuel logical.store logical.value = .ok (left, 0) ∧
+      reclaim world fuel physical.store physical.value = .ok (right, 0) ∧
+      ReclamationRel mapping left right := by
+  obtain ⟨fuel, left, leftRun, leftEmpty⟩ := reclaim_progress owned related.heap.ordered
+  obtain ⟨right, rightRun, heap⟩ := related.heap.reclaim related.value leftRun
+  have rightEmpty := heap.heap.right_empty leftEmpty
+  have leftBalance := reclaim_balance leftRun
+  have rightBalance := reclaim_balance rightRun
+  have leftInitial := related.logicalAccounting
+  have rightInitial := related.accounted
+  unfold HeapBalance at leftBalance rightBalance
+  have leftAccount : left.live + left.heap.frees = left.heap.allocs := by omega
+  have rightAccount : right.live + right.heap.frees + 0 = right.heap.allocs := by omega
+  have noReuses : left.heap.reuses = 0 :=
+    (congrArg Counters.reuses (reclaim_passive leftRun)).trans related.logicalReuses
+  exact ⟨fuel, left, right, leftRun, rightRun,
+    ⟨heap, leftEmpty, rightEmpty, by omega, by omega,
+      heap.counterLaw leftAccount noReuses rightAccount⟩⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditRefinement.lean b/Ix/Compiler/IxIR2/CreditRefinement.lean
new file mode 100644
index 000000000..87c36e076
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditRefinement.lean
@@ -0,0 +1,138 @@
+import Ix.Compiler.IxIR2.CreditReclamation
+import Ix.Compiler.IxIR2.CallEvalFuel
+
+/-!
+# General logical/physical credit refinement
+
+The execution bridge covers both credit policies and every instruction,
+including branches, loops, borrowed arguments, PAPs, scalar externs, and
+continuation-owned caller credits. Successful logical execution supplies a
+physical execution with the same budgets. Independent successful budgets
+give the same heap/value observations.
+
+The checked entry point fixes the exact program, schemas, and credit policy.
+Validation acceptance is not a proof of semantic root ownership: the owned
+endpoint states that additional assumption explicitly. No optimizer-specific
+step, progress, target-heap, or resource premise is required.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval.Policy
+
+theorem Steps.deterministic {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {count : Nat} {before left right : Machine}
+    (one : Steps policy context interpretation count before left)
+    (two : Steps policy context interpretation count before right) : left = right := by
+  induction one generalizing right with
+  | refl => cases two; rfl
+  | cons running head tail ih =>
+      cases two with
+      | cons _ otherHead otherTail =>
+          have same := head.deterministic otherHead
+          subst same
+          exact ih otherTail
+
+theorem Steps.take {policy : CreditPolicy} {context : Context}
+    {interpretation : Interpretation} {count prefixLength : Nat} {before after : Machine}
+    (steps : Steps policy context interpretation count before after) (bound : prefixLength ≤ count) :
+    ∃ middle, Steps policy context interpretation prefixLength before middle ∧
+      Steps policy context interpretation (count - prefixLength) middle after := by
+  induction steps generalizing prefixLength with
+  | refl =>
+      have zero : prefixLength = 0 := by omega
+      subst prefixLength
+      exact ⟨_, .refl _, .refl _⟩
+  | @cons count before middle after frame stack running head tail ih =>
+      cases prefixLength with
+      | zero => exact ⟨before, .refl _, .cons running head tail⟩
+      | succ prefixLength =>
+          obtain ⟨target, front, back⟩ := ih (prefixLength := prefixLength) (by omega)
+          exact ⟨target, .cons running head front, by simpa using back⟩
+
+end Ix.Compiler.IxIR2.Eval.Policy
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RootOwnership)
+
+/-- Any physical prefix of a successful logical main has its corresponding
+logical prefix. Reservations include every suspended caller frame. -/
+theorem runMain_prefix_resources {policy : CreditPolicy} {context : Context} {program : Program}
+    {controlFuel heapFuel count : Nat} {logical : Result} {physicalPrefix : Machine}
+    (run : Policy.runMain policy context .logical program controlFuel heapFuel = .ok logical)
+    (prefixRun : Policy.Steps policy context .physical count
+      (initialMachine program.main #[] heapFuel) physicalPrefix) :
+    ∃ mapping logicalPrefix,
+      Policy.Steps policy context .logical count
+        (initialMachine program.main #[] heapFuel) logicalPrefix ∧
+      MachineRel mapping logicalPrefix physicalPrefix ∧ physicalPrefix.AllocationAccounting ∧
+      CounterLaw logicalPrefix.store.snapshot physicalPrefix.store.snapshot physicalPrefix.presentCredits := by
+  obtain ⟨arity, nonempty⟩ := main_shape run
+  rw [Policy.runMain_eq_runMachine arity nonempty] at run
+  obtain ⟨total, _, logicalSteps⟩ := Policy.runMachine_steps run
+  obtain ⟨_, matched, matchedSteps, related, _, _⟩ := prefix_resources logicalSteps
+  rcases matched with ⟨store, fuel, control⟩
+  have controls := related.control
+  dsimp only at controls
+  cases controls with
+  | halted values =>
+      obtain ⟨suffix, length, _⟩ := prefixRun.cancelPrefixToHalted matchedSteps rfl
+      obtain ⟨left, leftPrefix, _⟩ := logicalSteps.take (prefixLength := count) (by omega)
+      obtain ⟨mapping, right, rightPrefix, machines, accounted, counters⟩ := prefix_resources leftPrefix
+      have same := rightPrefix.deterministic prefixRun
+      subst right
+      exact ⟨mapping, left, leftPrefix, machines, accounted, counters⟩
+
+/-- Successful runs may choose control and traversal budgets independently.
+Their semantic observations do not depend on those choices. -/
+theorem runMain_refines_independent {policy : CreditPolicy} {context : Context} {program : Program}
+    {logicalControl logicalHeap physicalControl physicalHeap : Nat} {logical physical : Result}
+    (leftRun : Policy.runMain policy context .logical program logicalControl logicalHeap = .ok logical)
+    (rightRun : Policy.runMain policy context .physical program physicalControl physicalHeap = .ok physical) :
+    ∃ mapping, OutcomeRel mapping logical physical := by
+  obtain ⟨arity, nonempty⟩ := main_shape leftRun
+  obtain ⟨mapping, target, targetRun, related⟩ := runMain_refines leftRun
+  obtain ⟨stores, values⟩ := Policy.runMain_success_unique arity nonempty targetRun rightRun
+  refine ⟨mapping, ?_⟩
+  exact ⟨stores ▸ related.heap, values ▸ related.value,
+    stores ▸ related.counters, stores ▸ related.accounted⟩
+
+/-- The exact checked program and policy execute with the matching physical
+result. Acceptance is retained at the API boundary; the operational theorem
+is stronger and does not require it. -/
+theorem checked_runMain_refines {policy : CreditPolicy} {limits : Validate.Limits}
+    {validation : Validate.Context} {program : Program}
+    (_checked : Validate.CheckedWithPolicy policy limits validation program)
+    {oracle : Ixon.Address → List RVal → Option RVal} {controlFuel heapFuel : Nat} {logical : Result}
+    (run : Policy.runMain policy (Context.ofProgram program validation.schemas oracle)
+      .logical program controlFuel heapFuel = .ok logical) :
+    ∃ mapping physical,
+      Policy.runMain policy (Context.ofProgram program validation.schemas oracle)
+        .physical program controlFuel heapFuel = .ok physical ∧
+      ResultRel mapping logical physical :=
+  runMain_refines run
+
+/-- Owned checked programs preserve root ownership and reclaim both actual
+heaps completely. The reclamation budget is constructed from the logical
+ownership premise and the allocation order derived by execution. -/
+theorem checked_runMain_owned {policy : CreditPolicy} {limits : Validate.Limits}
+    {validation : Validate.Context} {program : Program}
+    (checked : Validate.CheckedWithPolicy policy limits validation program)
+    {oracle : Ixon.Address → List RVal → Option RVal} {controlFuel heapFuel : Nat} {logical : Result}
+    (run : Policy.runMain policy (Context.ofProgram program validation.schemas oracle)
+      .logical program controlFuel heapFuel = .ok logical)
+    (owned : RootOwnership logical.store.heap [⟨program.main.signature.result, logical.value⟩]) :
+    ∃ mapping physical,
+      Policy.runMain policy (Context.ofProgram program validation.schemas oracle)
+        .physical program controlFuel heapFuel = .ok physical ∧
+      ResultRel mapping logical physical ∧
+      RootOwnership physical.store.heap [⟨program.main.signature.result, physical.value⟩] ∧
+      ∃ fuel left right,
+        reclaim program.main.signature.result fuel logical.store logical.value = .ok (left, 0) ∧
+        reclaim program.main.signature.result fuel physical.store physical.value = .ok (right, 0) ∧
+        ReclamationRel mapping left right := by
+  obtain ⟨mapping, physical, physicalRun, related⟩ := checked_runMain_refines checked run
+  exact ⟨mapping, physical, physicalRun, related, related.toOutcomeRel.ownership owned,
+    related.toOutcomeRel.reclamation owned⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditRelation.lean b/Ix/Compiler/IxIR2/CreditRelation.lean
new file mode 100644
index 000000000..b6e780031
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditRelation.lean
@@ -0,0 +1,195 @@
+import Ix.Compiler.IxIR2.ReuseHeapMapResults
+import Ix.Compiler.IxIR2.EvalCounter
+import Ix.Compiler.IxIR2.ReservationSteps
+
+/-!
+# Logical and physical credit states
+
+The program, block, and instruction positions are identical. Allocation
+history relates every register, including old names in suspended callers.
+Only live heap locations must be injective. Credits agree in layout and
+presence; physical reservations are owned separately across the whole stack.
+No relation in this module mentions an optimizer or a rewrite trace.
+-/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+open CallReuse.Sim (MapRel HeapMap)
+
+def MapExtends (before after : Array Nat) : Prop :=
+  ∀ {left right}, MapRel before left right → MapRel after left right
+
+theorem MapExtends.refl (mapping : Array Nat) : MapExtends mapping mapping := fun h => h
+
+theorem MapExtends.trans {first middle last : Array Nat}
+    (one : MapExtends first middle) (two : MapExtends middle last) :
+    MapExtends first last := fun h => two (one h)
+
+theorem MapExtends.push (mapping : Array Nat) (location : Nat) :
+    MapExtends mapping (mapping.push location) := fun h => h.push location
+
+inductive CreditRel : Credit → Credit → Prop where
+  | absent (layout : LayoutId) :
+      CreditRel ⟨layout, .absent⟩ ⟨layout, .absent⟩
+  | present (layout : LayoutId) (location : Nat) :
+      CreditRel ⟨layout, .present none⟩ ⟨layout, .present (some location)⟩
+
+theorem CreditRel.layout {left right : Credit} (related : CreditRel left right) :
+    left.layout = right.layout := by cases related <;> rfl
+
+theorem CreditRel.isPresent {left right : Credit} (related : CreditRel left right) :
+    left.isPresent = right.isPresent := by cases related <;> rfl
+
+inductive CreditSlotRel : Option Credit → Option Credit → Prop where
+  | consumed : CreditSlotRel none none
+  | live {left right : Credit} (credit : CreditRel left right) :
+      CreditSlotRel (some left) (some right)
+
+inductive CreditsRel : List (Option Credit) → List (Option Credit) → Prop where
+  | nil : CreditsRel [] []
+  | cons {left right lefts rights} (head : CreditSlotRel left right)
+      (tail : CreditsRel lefts rights) : CreditsRel (left :: lefts) (right :: rights)
+
+theorem CreditsRel.lengths {left right : List (Option Credit)}
+    (related : CreditsRel left right) : left.length = right.length := by
+  induction related with
+  | nil => rfl
+  | cons _ _ ih => simp only [List.length_cons, ih]
+
+theorem CreditsRel.get? {left right : List (Option Credit)}
+    (related : CreditsRel left right) {index : Nat} {credit : Credit}
+    (found : left[index]? = some (some credit)) :
+    ∃ target, right[index]? = some (some target) ∧ CreditRel credit target := by
+  induction related generalizing index with
+  | nil => simp at found
+  | cons head tail ih =>
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero, Option.some.injEq] at found
+          subst_vars
+          cases head with
+          | live credit => exact ⟨_, rfl, credit⟩
+      | succ index => exact ih found
+
+theorem CreditsRel.setNone {left right : List (Option Credit)}
+    (related : CreditsRel left right) (index : Nat) :
+    CreditsRel (left.set index none) (right.set index none) := by
+  induction related generalizing index with
+  | nil => simp; exact .nil
+  | cons head tail ih =>
+      cases index with
+      | zero => exact .cons .consumed tail
+      | succ index => exact .cons head (ih index)
+
+theorem CreditsRel.append {left right moreLeft moreRight : List (Option Credit)}
+    (related : CreditsRel left right) (more : CreditsRel moreLeft moreRight) :
+    CreditsRel (left ++ moreLeft) (right ++ moreRight) := by
+  induction related with
+  | nil => exact more
+  | cons head tail ih => exact .cons head ih
+
+theorem CreditsRel.any {left right : List (Option Credit)}
+    (related : CreditsRel left right) :
+    left.any Option.isSome = right.any Option.isSome := by
+  induction related with
+  | nil => rfl
+  | cons head tail ih => cases head <;> simp [List.any_cons, ih]
+
+theorem CreditsRel.weight {left right : List (Option Credit)}
+    (related : CreditsRel left right) :
+    left.countP (fun c => c.any Credit.isPresent) =
+      right.countP (fun c => c.any Credit.isPresent) := by
+  induction related with
+  | nil => rfl
+  | cons head tail ih =>
+      cases head with
+      | consumed => simpa using ih
+      | live credit => simp only [List.countP_cons, Option.any_some, credit.isPresent, ih]
+
+structure FrameRel (mapping : Array Nat) (left right : Frame) : Prop where
+  definition : left.definition = right.definition
+  block : left.block = right.block
+  pc : left.pc = right.pc
+  values : RValsIso (MapRel mapping) left.values.toList right.values.toList
+  credits : CreditsRel left.credits.toList right.credits.toList
+
+theorem FrameRel.mono {before after : Array Nat} {left right : Frame}
+    (related : FrameRel before left right) (extension : MapExtends before after) :
+    FrameRel after left right := { related with values := related.values.mono extension }
+
+theorem FrameRel.advance {mapping : Array Nat} {left right : Frame}
+    (related : FrameRel mapping left right) :
+    FrameRel mapping { left with pc := left.pc + 1 } { right with pc := right.pc + 1 } :=
+  { related with pc := congrArg (· + 1) related.pc }
+
+theorem FrameRel.push {mapping : Array Nat} {left right : Frame}
+    (related : FrameRel mapping left right) {leftValue rightValue : RVal}
+    (value : RValIso (MapRel mapping) leftValue rightValue) :
+    FrameRel mapping { left with values := left.values.push leftValue }
+      { right with values := right.values.push rightValue } :=
+  { related with values := by simpa using related.values.append (.cons value .nil) }
+
+theorem FrameRel.appendCredit {mapping : Array Nat} {left right : Frame}
+    (related : FrameRel mapping left right) {leftValues rightValues : Array RVal}
+    (values : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    {leftCredit rightCredit : Credit} (credit : CreditRel leftCredit rightCredit) :
+    FrameRel mapping
+      { left with
+        values := left.values ++ leftValues
+        credits := left.credits.push (some leftCredit) }
+      { right with
+        values := right.values ++ rightValues
+        credits := right.credits.push (some rightCredit) } :=
+  { related with
+    values := by simpa using related.values.append values
+    credits := by simpa using related.credits.append (.cons (.live credit) .nil) }
+
+theorem FrameRel.entry {mapping : Array Nat} (definition : Function)
+    {left right : Array RVal} (values : RValsIso (MapRel mapping) left.toList right.toList) :
+    FrameRel mapping { definition, values := left } { definition, values := right } :=
+  ⟨rfl, rfl, rfl, values, .nil⟩
+
+inductive ContinuationRel (mapping : Array Nat) : Continuation → Continuation → Prop where
+  | resume {left right : Frame} (frames : FrameRel mapping left right) :
+      ContinuationRel mapping (.resume left) (.resume right)
+  | applyMore {left right : Frame} {leftValues rightValues : Array RVal}
+      (frames : FrameRel mapping left right)
+      (values : RValsIso (MapRel mapping) leftValues.toList rightValues.toList) :
+      ContinuationRel mapping (.applyMore leftValues left) (.applyMore rightValues right)
+
+inductive StackRel (mapping : Array Nat) : List Continuation → List Continuation → Prop where
+  | nil : StackRel mapping [] []
+  | cons {left right lefts rights} (head : ContinuationRel mapping left right)
+      (tail : StackRel mapping lefts rights) : StackRel mapping (left :: lefts) (right :: rights)
+
+theorem ContinuationRel.mono {before after : Array Nat} {left right : Continuation}
+    (related : ContinuationRel before left right) (extension : MapExtends before after) :
+    ContinuationRel after left right := by
+  cases related with
+  | resume frames => exact .resume (frames.mono extension)
+  | applyMore frames values => exact .applyMore (frames.mono extension) (values.mono extension)
+
+theorem StackRel.mono {before after : Array Nat} {left right : List Continuation}
+    (related : StackRel before left right) (extension : MapExtends before after) :
+    StackRel after left right := by
+  induction related with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (head.mono extension) ih
+
+inductive ControlRel (mapping : Array Nat) : Control → Control → Prop where
+  | halted {left right : RVal} (values : RValIso (MapRel mapping) left right) :
+      ControlRel mapping (.halted left) (.halted right)
+  | running {left right : Frame} {leftStack rightStack : List Continuation}
+      (frames : FrameRel mapping left right) (stack : StackRel mapping leftStack rightStack) :
+      ControlRel mapping (.running left leftStack) (.running right rightStack)
+
+theorem ControlRel.mono {before after : Array Nat} {left right : Control}
+    (related : ControlRel before left right) (extension : MapExtends before after) :
+    ControlRel after left right := by
+  cases related with
+  | halted values => exact .halted (values.mono extension)
+  | running frames stack => exact .running (frames.mono extension) (stack.mono extension)
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditResources.lean b/Ix/Compiler/IxIR2/CreditResources.lean
new file mode 100644
index 000000000..1b48df46d
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditResources.lean
@@ -0,0 +1,152 @@
+import Ix.Compiler.IxIR2.CreditSteps
+
+/-! Logical allocation accounting and the complete all-prefix counter law. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+
+/-- Logical execution balances live nodes and frees, and never performs a
+physical reuse. Reset diagnostics do not affect either fact. -/
+def LogicalEffect (before after : Store) : Prop :=
+  HeapBalance before after ∧ after.heap.reuses = before.heap.reuses
+
+theorem LogicalEffect.refl (store : Store) : LogicalEffect store store := ⟨.refl _, rfl⟩
+
+theorem LogicalEffect.trans {first middle last : Store}
+    (one : LogicalEffect first middle) (two : LogicalEffect middle last) :
+    LogicalEffect first last := ⟨one.1.trans two.1, two.2.trans one.2⟩
+
+theorem LogicalEffect.alloc (store : Store) (world : Ixon.Owned) (node : Node) :
+    LogicalEffect store (store.allocNode world node).1 := ⟨.allocNode .., rfl⟩
+
+theorem LogicalEffect.kill {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) : LogicalEffect store (store.kill location) :=
+  ⟨.kill found, rfl⟩
+
+theorem LogicalEffect.retain {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) : LogicalEffect store output :=
+  ⟨retainShared_heapBalance run, congrArg Counters.reuses (retain_passive run)⟩
+
+theorem LogicalEffect.retainMany {store output : Store} {values : Array RVal}
+    (run : RetainSharedMany store values output) : LogicalEffect store output :=
+  ⟨run.heapBalance, congrArg Counters.reuses (retainMany_passive run)⟩
+
+theorem LogicalEffect.releaseWork {store output : Store} {fuel remaining : Nat} {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) : LogicalEffect store output :=
+  ⟨releaseSharedWork_heapBalance run, congrArg Counters.reuses (releaseWork_passive run)⟩
+
+theorem LogicalEffect.dropWork {store output : Store} {fuel remaining : Nat} {values : List RVal}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) : LogicalEffect store output :=
+  ⟨dropUniqueWork_heapBalance run, congrArg Counters.reuses (dropWork_passive run)⟩
+
+theorem apply_logicalEffect {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {function : RVal} {arguments : Array RVal}
+    {resume : Frame} {stack : List Continuation} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function arguments resume stack target) :
+    LogicalEffect store target.store := by
+  cases transferred.classify with
+  | erased released => exact LogicalEffect.releaseWork released
+  | papUnder _ _ _ _ retained released _ =>
+      exact ((LogicalEffect.retainMany retained).trans
+        (LogicalEffect.releaseWork released)).trans (LogicalEffect.alloc ..)
+  | papFn _ _ _ _ retained released _ _ _ _ _ =>
+      exact (LogicalEffect.retainMany retained).trans (LogicalEffect.releaseWork released)
+  | papExtern _ _ _ _ retained released _ _ _ _ _ =>
+      exact (LogicalEffect.retainMany retained).trans (LogicalEffect.releaseWork released)
+
+theorem instruction_logicalEffect {context : Context} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context .logical store heapFuel frame stack instruction target) :
+    LogicalEffect store target.store := by
+  cases classified <;> try contradiction
+  case move => exact LogicalEffect.refl _
+  case alloc => exact LogicalEffect.alloc ..
+  case allocWithAbsent => exact LogicalEffect.alloc ..
+  case allocWithLogical => exact LogicalEffect.alloc ..
+  case discardAbsent => exact LogicalEffect.refl _
+  case discardLogical => exact LogicalEffect.refl _
+  case takeUniqueLogical viewed unitRC => exact LogicalEffect.kill viewed.parts.1
+  case resetSharedLogicalHot viewed unitRC => exact LogicalEffect.kill viewed.parts.1
+  case resetSharedCold target cid schema location box fields output schemaAt resolved viewed many retained =>
+    refine ⟨(HeapBalance.setBox (new := { box with rc := box.rc - 1 }) viewed.parts.1).trans retained.heapBalance, ?_⟩
+    exact congrArg Counters.reuses (retainMany_passive retained)
+  case retainShared retained => exact LogicalEffect.retain retained
+  case releaseShared released => exact LogicalEffect.releaseWork released
+  case dropUnique dropped => exact LogicalEffect.dropWork dropped
+  case freeUnique viewed scalarFields => exact LogicalEffect.kill viewed.parts.1
+  case fetch => exact LogicalEffect.refl _
+  case callFn => exact LogicalEffect.refl _
+  case callSelf => exact LogicalEffect.refl _
+  case pappFn => exact LogicalEffect.alloc ..
+  case pappExtern => exact LogicalEffect.alloc ..
+  case apply transferred => exact apply_logicalEffect transferred
+  case extern => exact LogicalEffect.refl _
+
+theorem terminator_logicalEffect {context : Context} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context .logical store heapFuel frame stack terminator target) :
+    LogicalEffect store target.store := by
+  cases classified <;> first
+    | exact LogicalEffect.refl _
+    | (apply apply_logicalEffect; assumption)
+
+theorem step_logicalEffect {policy : CreditPolicy} {context : Context} {before after : Machine}
+    (stepped : Policy.Step policy context .logical before after) :
+    LogicalEffect before.store after.store := by
+  rcases stepped.classify with original | ⟨frame, stack, call, _, running, _, called⟩
+  · cases original.classify with
+    | halted => exact LogicalEffect.refl _
+    | instruction _ _ _ classified => exact instruction_logicalEffect classified
+    | terminator _ _ _ classified => exact terminator_logicalEffect classified
+  · rw [(Policy.suspendCall_resources running called).1]
+    exact LogicalEffect.refl _
+
+theorem steps_logicalEffect {policy : CreditPolicy} {context : Context} {before after : Machine}
+    {count : Nat} (steps : Policy.Steps policy context .logical count before after) :
+    LogicalEffect before.store after.store := by
+  induction steps with
+  | refl => exact LogicalEffect.refl _
+  | cons running head tail ih => exact (step_logicalEffect head).trans ih
+
+theorem HeapRel.counterLaw {mapping : Array Nat} {left right : Store} {credits : Nat}
+    (state : HeapRel mapping left right)
+    (balanced : left.live + left.heap.frees = left.heap.allocs)
+    (logicalReuses : left.heap.reuses = 0)
+    (physical : right.live + right.heap.frees + credits = right.heap.allocs) :
+    CounterLaw left.snapshot right.snapshot credits := by
+  have events := state.events
+  change left.heap.allocs + left.heap.reuses = right.heap.allocs + right.heap.reuses at events
+  have live := state.heap.live_eq
+  exact ⟨by dsimp [Store.snapshot, Store.counters]; omega,
+    by dsimp [Store.snapshot, Store.counters]; omega,
+    state.rcops, live, state.attempts, state.hot, state.cold⟩
+
+theorem MachineRel.counterLaw {mapping : Array Nat} {left right : Machine}
+    (machines : MachineRel mapping left right)
+    (balanced : left.store.live + left.store.heap.frees = left.store.heap.allocs)
+    (logicalReuses : left.store.heap.reuses = 0)
+    (physical : right.AllocationAccounting) :
+    CounterLaw left.store.snapshot right.store.snapshot right.presentCredits :=
+  machines.heap.counterLaw balanced logicalReuses physical
+
+/-- The full specification's intermediate counter equations hold for every
+logical prefix and its actual physical counterpart. All caller reservations
+are included in the outstanding-credit term. -/
+theorem prefix_resources {policy : CreditPolicy} {context : Context} {definition : Function}
+    {heapFuel count : Nat} {left : Machine}
+    (steps : Policy.Steps policy context .logical count (initialMachine definition #[] heapFuel) left) :
+    ∃ mapping right, Policy.Steps policy context .physical count
+        (initialMachine definition #[] heapFuel) right ∧
+      MachineRel mapping left right ∧ right.AllocationAccounting ∧
+      CounterLaw left.store.snapshot right.store.snapshot right.presentCredits := by
+  obtain ⟨mapping, right, targetSteps, machines, _⟩ := steps_related (initial_related definition heapFuel) steps
+  have logical := steps_logicalEffect steps
+  have balanced : left.store.live + left.store.heap.frees = left.store.heap.allocs := by
+    simpa [HeapBalance, initialMachine, Store.live, IxIR1.Store.live] using logical.1
+  have noReuses : left.store.heap.reuses = 0 := logical.2
+  have physical := targetSteps.allocationAccounting (initialMachine_allocationAccounting ..)
+  exact ⟨mapping, right, targetSteps, machines, physical,
+    machines.counterLaw balanced noReuses physical⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditSimulation.lean b/Ix/Compiler/IxIR2/CreditSimulation.lean
new file mode 100644
index 000000000..4c8f7765d
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditSimulation.lean
@@ -0,0 +1,90 @@
+import Ix.Compiler.IxIR2.CreditResources
+
+/-! Public successful-main refinement for both credit policies. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso)
+open CallReuse.Sim (MapRel)
+
+/-- Budget-independent observations of a completed execution. -/
+structure OutcomeRel (mapping : Array Nat) (logical physical : Result) : Prop where
+  heap : HeapRel mapping logical.store physical.store
+  value : RValIso (MapRel mapping) logical.value physical.value
+  counters : CounterLaw logical.store.snapshot physical.store.snapshot 0
+  accounted : physical.store.live + physical.store.heap.frees = physical.store.heap.allocs
+
+structure ResultRel (mapping : Array Nat) (logical physical : Result) : Prop
+    extends OutcomeRel mapping logical physical where
+  control : logical.controlRemaining = physical.controlRemaining
+  traversal : logical.heapRemaining = physical.heapRemaining
+
+theorem OutcomeRel.logicalReuses {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) : logical.store.heap.reuses = 0 := by
+  have events := related.heap.events
+  have allocs := related.counters.allocs
+  change logical.store.heap.allocs + logical.store.heap.reuses =
+    physical.store.heap.allocs + physical.store.heap.reuses at events
+  change logical.store.heap.allocs = physical.store.heap.allocs + physical.store.heap.reuses at allocs
+  omega
+
+theorem OutcomeRel.logicalAccounting {mapping : Array Nat} {logical physical : Result}
+    (related : OutcomeRel mapping logical physical) :
+    logical.store.live + logical.store.heap.frees = logical.store.heap.allocs := by
+  have allocs := related.counters.allocs
+  have frees := related.counters.frees
+  have live := related.counters.live
+  have physical := related.accounted
+  dsimp only [Store.snapshot, Store.counters] at allocs frees live
+  omega
+
+theorem main_shape {policy : CreditPolicy} {context : Context} {program : Program}
+    {interpretation : Interpretation} {controlFuel heapFuel : Nat} {result : Result}
+    (run : Policy.runMain policy context interpretation program controlFuel heapFuel = .ok result) :
+    program.main.signature.params.size = 0 ∧ program.main.blocks.isEmpty = false := by
+  by_cases arity : program.main.signature.params.size = 0
+  · refine ⟨arity, ?_⟩
+    cases empty : program.main.blocks.isEmpty with
+    | false => rfl
+    | true => simp [Policy.runMain, Policy.runFunction, enterFunction, arity, empty,
+        bind, Except.bind] at run
+  · simp [Policy.runMain, Policy.runFunction, enterFunction, Ne.symm arity,
+      bind, Except.bind] at run
+
+/-- A successful logical main executes physically with the same control and
+traversal budgets. The theorem covers the whole instruction language and
+derives all heap, continuation, reservation, and cost facts internally. -/
+theorem runMain_refines {policy : CreditPolicy} {context : Context} {program : Program}
+    {controlFuel heapFuel : Nat} {logical : Result}
+    (run : Policy.runMain policy context .logical program controlFuel heapFuel = .ok logical) :
+    ∃ mapping physical,
+      Policy.runMain policy context .physical program controlFuel heapFuel = .ok physical ∧
+      ResultRel mapping logical physical := by
+  obtain ⟨arity, nonempty⟩ := main_shape run
+  rw [Policy.runMain_eq_runMachine arity nonempty] at run
+  obtain ⟨count, budget, steps⟩ := Policy.runMachine_steps run
+  obtain ⟨mapping, target, targetSteps, machines, accounted, counters⟩ := prefix_resources steps
+  rcases target with ⟨store, fuel, control⟩
+  have controls := machines.control
+  dsimp only at controls
+  cases controls with
+  | halted values =>
+      refine ⟨mapping, ⟨store, _, logical.controlRemaining, fuel⟩, ?_,
+        ⟨⟨machines.heap, values, counters, accounted⟩, rfl, machines.fuel⟩⟩
+      rw [Policy.runMain_eq_runMachine arity nonempty, budget, targetSteps.runMachine]
+      simp only [Policy.runMachine]
+
+/-- Legacy v0 clients obtain the same full-credit guarantee for the original
+runner. This strictly extends the credit-free interpretation bridge. -/
+theorem runMain_v0_refines {context : Context} {program : Program}
+    {controlFuel heapFuel : Nat} {logical : Result}
+    (run : Eval.runMain context .logical program controlFuel heapFuel = .ok logical) :
+    ∃ mapping physical,
+      Eval.runMain context .physical program controlFuel heapFuel = .ok physical ∧
+      ResultRel mapping logical physical := by
+  have policyRun : Policy.runMain .callLocalV0 context .logical program controlFuel heapFuel = .ok logical :=
+    (Policy.runMain_v0 ..).trans run
+  simpa only [Policy.runMain_v0] using runMain_refines policyRun
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditSteps.lean b/Ix/Compiler/IxIR2/CreditSteps.lean
new file mode 100644
index 000000000..d1a29999f
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditSteps.lean
@@ -0,0 +1,120 @@
+import Ix.Compiler.IxIR2.CreditTerminators
+
+/-! The complete small-step bridge, including continuation-owned v1 credits. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+
+theorem original_step_related {context : Context} {mapping : Array Nat}
+    {left right leftAfter : Machine} (machines : MachineRel mapping left right)
+    (stepped : Eval.Step context .logical left leftAfter) :
+    ∃ after rightAfter, Eval.Step context .physical right rightAfter ∧
+      TransferRel mapping after leftAfter rightAfter := by
+  rcases left with ⟨leftStore, leftFuel, leftControl⟩
+  rcases right with ⟨rightStore, rightFuel, rightControl⟩
+  have fuels := machines.fuel
+  dsimp only at fuels
+  subst rightFuel
+  cases machines.control with
+  | halted values =>
+      have same := Except.ok.inj stepped
+      subst leftAfter
+      exact ⟨mapping, _, rfl,
+        ⟨machines.heap, MapExtends.refl _, rfl, .halted values⟩⟩
+  | running frames stack =>
+      cases stepped.classify with
+      | instruction blockAt pc instructionAt classified =>
+          obtain ⟨after, target, targetCase, related⟩ :=
+            instruction_related machines.heap frames stack machines.reservations classified
+          exact ⟨after, target, targetCase.step
+            (by rw [← frames.definition, ← frames.block]; exact blockAt)
+            (by rw [← frames.pc]; exact pc)
+            (by simpa only [← frames.pc] using instructionAt), related⟩
+      | terminator blockAt pc terminatorAt classified =>
+          obtain ⟨after, target, targetCase, related⟩ :=
+            terminator_related machines.heap frames stack classified
+          exact ⟨after, target, targetCase.step
+            (by rw [← frames.definition, ← frames.block]; exact blockAt)
+            (by rw [← frames.pc]; exact pc) terminatorAt, related⟩
+
+theorem FrameRel.directCall {mapping : Array Nat} {left right : Frame}
+    (frames : FrameRel mapping left right) : Policy.directCall? left = Policy.directCall? right := by
+  unfold Policy.directCall?
+  rw [frames.definition, frames.block, frames.pc]
+
+theorem FrameRel.callDefinition {mapping : Array Nat} {left right : Frame}
+    (frames : FrameRel mapping left right) (context : Context) (call : Policy.DirectCall) :
+    call.definition context left = call.definition context right := by
+  cases call with
+  | function => rfl
+  | self => simp only [Policy.DirectCall.definition, frames.definition]
+
+theorem step_related {policy : CreditPolicy} {context : Context} {mapping : Array Nat}
+    {left right leftAfter : Machine} (machines : MachineRel mapping left right)
+    (stepped : Policy.Step policy context .logical left leftAfter) :
+    ∃ after rightAfter, Policy.Step policy context .physical right rightAfter ∧
+      TransferRel mapping after leftAfter rightAfter := by
+  rcases stepped.classify with original | ⟨frame, stack, call, rfl, running, atCall, called⟩
+  · obtain ⟨after, target, targetStep, related⟩ := original_step_related machines original
+    refine ⟨after, target, ?_, related⟩
+    cases policy with
+    | callLocalV0 => exact targetStep
+    | suspendedCallsV1 => exact Policy.of_originalStep targetStep
+  · rcases left with ⟨leftStore, leftFuel, leftControl⟩
+    rcases right with ⟨rightStore, rightFuel, rightControl⟩
+    dsimp only at running
+    subst leftControl
+    have controls := machines.control
+    dsimp only at controls
+    cases controls with
+    | @running _ rightFrame _ rightStack frames stacks =>
+        obtain ⟨values, definition, resolved, defined, arity, nonempty, rfl⟩ :=
+          Policy.suspendCall_iff.mp called
+        obtain ⟨targetValues, targetResolved, valuesRel⟩ :=
+          ReuseSim.resolveAtoms_iso frames.values resolved
+        have targetAt : Policy.directCall? rightFrame = some call :=
+          frames.directCall.symm.trans atCall
+        have targetCall := (Policy.suspendCall_iff
+          (machine := Machine.mk rightStore rightFuel (.running rightFrame rightStack))
+          (frame := rightFrame) (stack := rightStack) (call := call)).mpr
+          ⟨targetValues, definition, targetResolved,
+            (frames.callDefinition context call).symm.trans defined,
+            (values_size valuesRel).symm.trans arity, nonempty, rfl⟩
+        refine ⟨mapping, Machine.mk rightStore rightFuel
+          (.running { definition, values := targetValues }
+            (.resume { rightFrame with pc := rightFrame.pc + 1 } :: rightStack)), ?_,
+          ⟨machines.heap, MapExtends.refl _, machines.fuel,
+            .running (.entry definition valuesRel) (.cons (.resume frames.advance) stacks)⟩⟩
+        simpa only [Policy.Step, Policy.step, targetAt] using targetCall
+
+/-- Every finite logical prefix has a physical prefix of the same length,
+with equal remaining heap fuel, exact observation agreement, and unique
+reservations across all active and suspended frames. -/
+theorem steps_related {policy : CreditPolicy} {context : Context} {mapping : Array Nat}
+    {left right leftAfter : Machine} {count : Nat}
+    (machines : MachineRel mapping left right)
+    (steps : Policy.Steps policy context .logical count left leftAfter) :
+    ∃ after rightAfter, Policy.Steps policy context .physical count right rightAfter ∧
+      MachineRel after leftAfter rightAfter ∧ MapExtends mapping after := by
+  induction steps generalizing mapping right with
+  | refl => exact ⟨mapping, right, .refl _, machines, MapExtends.refl _⟩
+  | @cons count left middle final frame stack running head tail ih =>
+      obtain ⟨middleMap, targetMiddle, targetHead, transferred⟩ := step_related machines head
+      have next := transferred.machine (targetHead.reservationOwnership machines.reservations)
+      obtain ⟨after, target, targetTail, related, extension⟩ := ih next
+      rcases right with ⟨rightStore, rightFuel, rightControl⟩
+      have controls := machines.control
+      rw [running] at controls
+      cases controls with
+      | running frames stacks =>
+          exact ⟨after, target, .cons rfl targetHead targetTail, related,
+            MapExtends.trans transferred.extension extension⟩
+
+theorem initial_related (definition : Function) (heapFuel : Nat) :
+    MachineRel #[] (initialMachine definition #[] heapFuel)
+      (initialMachine definition #[] heapFuel) :=
+  ⟨.empty, rfl, .running (.entry definition .nil) .nil,
+    Policy.initialMachine_reservationOwnership ..⟩
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/CreditTerminators.lean b/Ix/Compiler/IxIR2/CreditTerminators.lean
new file mode 100644
index 000000000..9ca8ddfee
--- /dev/null
+++ b/Ix/Compiler/IxIR2/CreditTerminators.lean
@@ -0,0 +1,98 @@
+import Ix.Compiler.IxIR2.CreditInstructions
+
+/-! Jumps, dispatch, returns, and both tail-call forms. -/
+
+namespace Ix.Compiler.IxIR2.CreditRefinement
+
+open Eval
+open Ix.Compiler.IxIR1.Sim (RValIso RValsIso)
+open CallReuse.Sim (MapRel)
+
+theorem terminator_related {context : Context} {mapping : Array Nat}
+    {leftStore rightStore : Store} {heapFuel : Nat}
+    {leftFrame rightFrame : Frame} {leftStack rightStack : List Continuation}
+    {terminator : Terminator} {leftAfter : Machine}
+    (state : HeapRel mapping leftStore rightStore)
+    (frames : FrameRel mapping leftFrame rightFrame)
+    (stack : StackRel mapping leftStack rightStack)
+    (classified : TerminatorTransferCase context .logical leftStore heapFuel leftFrame
+      leftStack terminator leftAfter) :
+    ∃ after rightAfter,
+      TerminatorTransferCase context .physical rightStore heapFuel rightFrame
+        rightStack terminator rightAfter ∧ TransferRel mapping after leftAfter rightAfter := by
+  cases classified with
+  | jump transferred =>
+      obtain ⟨target, targetTransfer, nextRel⟩ := frames.edge .nil transferred
+      exact ⟨mapping, _, .jump targetTransfer,
+        ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      cases valueRel with
+      | @loc _ targetLocation mapped =>
+          obtain ⟨targetBox, targetFields, targetView, boxes, fieldsRel⟩ :=
+            state.heap.constructorView mapped (ConstructorView.of_box boxAt rfl node)
+          obtain ⟨target, targetTransfer, nextRel⟩ := frames.edge .nil transferred
+          exact ⟨mapping, _, .switchCtor targetResolved targetView.parts.1 targetView.parts.2.2
+            alternativeAt targetTransfer,
+            ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  | switchNatZero resolved transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      cases valueRel
+      obtain ⟨target, targetTransfer, nextRel⟩ := frames.edge .nil transferred
+      exact ⟨mapping, _, .switchNatZero targetResolved targetTransfer,
+        ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  | switchNatSucc resolved transferred =>
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      cases valueRel
+      obtain ⟨target, targetTransfer, nextRel⟩ := frames.edge (.cons .lit .nil) transferred
+      exact ⟨mapping, _, .switchNatSucc targetResolved targetTransfer,
+        ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  | branchPresent lookedUp present transferred =>
+      obtain ⟨targetCredit, targetLookup, creditRel⟩ := frames.creditLookup lookedUp
+      obtain ⟨target, targetTransfer, nextRel⟩ := frames.edge .nil transferred
+      exact ⟨mapping, _, .branchPresent targetLookup (creditRel.isPresent.symm.trans present) targetTransfer,
+        ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  | branchAbsent lookedUp absent transferred =>
+      obtain ⟨targetCredit, targetLookup, creditRel⟩ := frames.creditLookup lookedUp
+      obtain ⟨target, targetTransfer, nextRel⟩ := frames.edge .nil transferred
+      exact ⟨mapping, _, .branchAbsent targetLookup (creditRel.isPresent.symm.trans absent) targetTransfer,
+        ⟨state, MapExtends.refl _, rfl, .running nextRel stack⟩⟩
+  | retResume resolved noCredits world =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | resume caller =>
+              obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+              exact ⟨mapping, _, .retResume targetResolved (frames.noCredits noCredits)
+                (by rw [← frames.definition]; exact state.heap.hasWorld valueRel world),
+                ⟨state, MapExtends.refl _, rfl, .running (caller.push valueRel) rest⟩⟩
+  | retHalt resolved noCredits world =>
+      cases stack
+      obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+      exact ⟨mapping, _, .retHalt targetResolved (frames.noCredits noCredits)
+        (by rw [← frames.definition]; exact state.heap.hasWorld valueRel world),
+        ⟨state, MapExtends.refl _, rfl, .halted valueRel⟩⟩
+  | retApplyMore resolved noCredits world transferred =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | applyMore caller arguments =>
+              obtain ⟨targetValue, targetResolved, valueRel⟩ := ReuseSim.resolveAtom_iso frames.values resolved
+              obtain ⟨after, target, targetTransfer, related⟩ :=
+                apply_related state valueRel arguments caller rest transferred
+              exact ⟨after, target, .retApplyMore targetResolved (frames.noCredits noCredits)
+                (by rw [← frames.definition]; exact state.heap.hasWorld valueRel world) targetTransfer, related⟩
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+      exact ⟨mapping, _, .tailCallFn (frames.noCredits noCredits) targetResolved declaration
+        (by rw [← values_size argumentsRel]; exact arity) nonempty,
+        ⟨state, MapExtends.refl _, rfl, .running (.entry _ argumentsRel) stack⟩⟩
+  | tailCallSelf noCredits resolved arity nonempty =>
+      obtain ⟨targetArguments, targetResolved, argumentsRel⟩ := ReuseSim.resolveAtoms_iso frames.values resolved
+      refine ⟨mapping, _, .tailCallSelf (frames.noCredits noCredits) targetResolved
+        (by rw [← values_size argumentsRel, ← frames.definition]; exact arity)
+        (by rw [← frames.definition]; exact nonempty),
+        ⟨state, MapExtends.refl _, rfl, .running ?_ stack⟩⟩
+      simpa only [frames.definition] using FrameRel.entry leftFrame.definition argumentsRel
+
+end Ix.Compiler.IxIR2.CreditRefinement
diff --git a/Ix/Compiler/IxIR2/Eval.lean b/Ix/Compiler/IxIR2/Eval.lean
new file mode 100644
index 000000000..9a9f48ba1
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Eval.lean
@@ -0,0 +1,5334 @@
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.IxIR2.Validate
+
+/-!
+# Logical and physical execution for IxIR₂
+
+The two interpretations share one small-step control machine.  Logical
+execution frees a consumed constructor immediately and allocates freshly at
+`allocWith`; physical execution reserves the slot and either reuses or
+releases it.  Calls are represented by an explicit continuation stack, so the
+total runner spends exactly one control unit per IxIR₂ instruction or
+terminator.  Recursive heap traversal has an independent budget.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+abbrev RVal := IxIR1.RVal
+abbrev Node := IxIR1.Node
+abbrev NodeBox := IxIR1.NodeBox
+
+inductive Interpretation where
+  | logical
+  | physical
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Error where
+  | controlFuel
+  | heapFuel
+  | stuck (detail : String)
+  | mem (detail : String)
+  | unknownRef (address : Address)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Counters shared by the logical and physical observations. -/
+structure Counters where
+  allocs : Nat := 0
+  reuses : Nat := 0
+  frees : Nat := 0
+  rcops : Nat := 0
+  resetAttempts : Nat := 0
+  hotResets : Nat := 0
+  coldResets : Nat := 0
+  reusedPayloadUnits : Nat := 0
+  peakLiveNodes : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The IxIR₁ heap representation is reused deliberately.  IxIR₂ adds reset
+observations while preserving the existing constructor/PAP runtime boundary. -/
+structure Store where
+  heap : IxIR1.Store := {}
+  resetAttempts : Nat := 0
+  hotResets : Nat := 0
+  coldResets : Nat := 0
+  reusedPayloadUnits : Nat := 0
+  peakLiveNodes : Nat := 0
+  deriving Repr, Inhabited
+
+def Store.get? (store : Store) (location : Nat) : Option NodeBox :=
+  store.heap.get? location
+
+def Store.live (store : Store) : Nat := store.heap.live
+
+def Store.counters (store : Store) : Counters :=
+  { allocs := store.heap.allocs
+    reuses := store.heap.reuses
+    frees := store.heap.frees
+    rcops := store.heap.rcops
+    resetAttempts := store.resetAttempts
+    hotResets := store.hotResets
+    coldResets := store.coldResets
+    reusedPayloadUnits := store.reusedPayloadUnits
+    peakLiveNodes := store.peakLiveNodes }
+
+private def Store.withPeak (store : Store) : Store :=
+  { store with peakLiveNodes := max store.peakLiveNodes store.live }
+
+@[simp] theorem Store.withPeak_heap (store : Store) :
+    store.withPeak.heap = store.heap := by
+  rfl
+
+def Store.allocNode (store : Store) (world : Owned) (node : Node) :
+    Store × Nat :=
+  let (heap, location) := store.heap.allocNode world node
+  ({ store with heap }.withPeak, location)
+
+@[simp] theorem Store.allocNode_heap (store : Store) (world : Owned)
+    (node : Node) :
+    (store.allocNode world node).1.heap =
+      (store.heap.allocNode world node).1 := by
+  rfl
+
+@[simp] theorem Store.allocNode_location (store : Store) (world : Owned)
+    (node : Node) :
+    (store.allocNode world node).2 =
+      (store.heap.allocNode world node).2 := by
+  rfl
+
+def Store.setBox (store : Store) (location : Nat) (box : NodeBox) : Store :=
+  { store with heap := store.heap.setBox location box }
+
+@[simp] theorem Store.setBox_heap (store : Store) (location : Nat)
+    (box : NodeBox) :
+    (store.setBox location box).heap = store.heap.setBox location box := by
+  rfl
+
+def Store.kill (store : Store) (location : Nat) : Store :=
+  { store with heap := store.heap.kill location }
+
+@[simp] theorem Store.kill_heap (store : Store) (location : Nat) :
+    (store.kill location).heap = store.heap.kill location := by
+  rfl
+
+def Store.rcTick (store : Store) : Store :=
+  { store with heap := store.heap.rcTick }
+
+@[simp] theorem Store.rcTick_heap (store : Store) :
+    store.rcTick.heap = store.heap.rcTick := by
+  rfl
+
+/-- Remove a live node without counting a free.  The physical credit becomes
+the sole authority for this empty slot. -/
+def Store.reserve (store : Store) (location : Nat) : Store :=
+  { store with
+    heap := { store.heap with
+      nodes := store.heap.nodes.setIfInBounds location none } }
+
+def Store.releaseReservation (store : Store) (location : Nat) :
+    Except Error Store :=
+  match (store.heap.nodes)[location]? with
+  | some none =>
+      .ok { store with heap := { store.heap with frees := store.heap.frees + 1 } }
+  | _ => .error (.mem "release of a non-reserved physical slot")
+
+def Store.reuseReservation (store : Store) (location : Nat) (world : Owned)
+    (node : Node) (payloadUnits : Nat) : Except Error Store :=
+  match (store.heap.nodes)[location]? with
+  | some none =>
+      let box : NodeBox := { world, rc := 1, node }
+      let heap :=
+        { store.heap with
+          nodes := store.heap.nodes.setIfInBounds location (some box)
+          reuses := store.heap.reuses + 1 }
+      .ok ({ store with
+        heap
+        reusedPayloadUnits := store.reusedPayloadUnits + payloadUnits }).withPeak
+  | _ => .error (.mem "reuse of a non-reserved physical slot")
+
+def Store.tickResetAttempt (store : Store) : Store :=
+  { store with resetAttempts := store.resetAttempts + 1 }
+
+def Store.tickHotReset (store : Store) : Store :=
+  { store with hotResets := store.hotResets + 1 }
+
+def Store.tickColdReset (store : Store) : Store :=
+  { store with coldResets := store.coldResets + 1 }
+
+inductive CreditPresence where
+  | absent
+  /-- `none` in the logical interpretation, the reserved slot in physical. -/
+  | present (reservation : Option Nat)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Credit where
+  layout : LayoutId
+  presence : CreditPresence
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Credit.isPresent : Credit → Bool
+  | { presence := .present _, .. } => true
+  | { presence := .absent, .. } => false
+
+private def Credit.presentFor (interpretation : Interpretation)
+    (layout : LayoutId) (location : Nat) : Credit :=
+  match interpretation with
+  | .logical => { layout, presence := .present none }
+  | .physical => { layout, presence := .present (some location) }
+
+structure Context where
+  declarations : Address → Option Decl := fun _ => none
+  schemas : Owned → CtorId → Option CtorSchema := fun _ _ => none
+  oracle : Address → List RVal → Option RVal := fun _ _ => none
+
+def Context.ofProgram (program : Program)
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Context :=
+  { declarations := fun address =>
+      (program.declarations.find? fun entry => entry.1 == address).map (·.2)
+    schemas
+    oracle }
+
+def RVal.isScalar : RVal → Bool
+  | .loc _ => false
+  | .lit _ | .erased => true
+
+def RVal.hasWorld (store : Store) (world : Owned) : RVal → Bool
+  | .loc location =>
+      match store.get? location with
+      | some box => box.world == world
+      | none => false
+  | .lit _ | .erased => true
+
+def resolveAtom (values : Array RVal) : Atom → Except Error RVal
+  | .reg id =>
+      match (values)[id]? with
+      | some value => .ok value
+      | none => .error (.stuck s!"unknown value register {id}")
+  | .lit literal => .ok (.lit literal)
+  | .erased => .ok .erased
+
+def resolveAtoms (values : Array RVal) (atoms : Array Atom) :
+    Except Error (Array RVal) :=
+  atoms.foldlM (fun output atom => do
+    return output.push (← resolveAtom values atom)) #[]
+
+private def lookupSchema (context : Context) (world : Owned) (cid : CtorId) :
+    Except Error CtorSchema :=
+  match context.schemas world cid with
+  | some schema => .ok schema
+  | none => .error (.stuck "missing constructor schema")
+
+private def requireCtor (store : Store) (location : Nat) (world : Owned)
+    (cid : CtorId) : Except Error (NodeBox × Array RVal) := do
+  let box ← match store.get? location with
+    | some box => pure box
+    | none => .error (.mem s!"dead constructor location {location}")
+  if box.world != world then
+    .error (.mem "constructor ownership-world mismatch")
+  else
+    match box.node with
+    | .ctorN actual fields =>
+        if actual == cid then return (box, fields)
+        else .error (.stuck "constructor identity mismatch")
+    | .papN .. => .error (.stuck "constructor operation on a PAP")
+
+/-! ## Heap-only recursive primitives -/
+
+/-- Increment one shared reference, leaving scalar values unchanged. -/
+def retainShared (store : Store) (value : RVal) : Except Error Store :=
+  match value with
+  | .lit _ | .erased => .ok store
+  | .loc location =>
+      match store.get? location with
+      | none => .error (.mem s!"retain of dead location {location}")
+      | some box =>
+          if box.world != .shared then
+            .error (.mem "retain of a unique node")
+          else
+            .ok ((store.setBox location { box with rc := box.rc + 1 }).rcTick)
+
+private def retainSharedMany (store : Store) (values : Array RVal) :
+    Except Error Store :=
+  values.foldlM retainShared store
+
+/-- Deep shared release.  Every work-list item, including a scalar leaf,
+consumes one heap-traversal unit; control fuel is not visible here. -/
+def releaseSharedWork : Nat → Store → List RVal → Except Error (Store × Nat)
+  | fuel, store, [] => .ok (store, fuel)
+  | 0, _, _ :: _ => .error .heapFuel
+  | fuel + 1, store, value :: rest =>
+      match value with
+      | .lit _ | .erased => releaseSharedWork fuel store rest
+      | .loc location =>
+          match store.get? location with
+          | none => .error (.mem s!"release of dead location {location}")
+          | some box =>
+              if box.world != .shared then
+                .error (.mem "release of a unique node")
+              else
+                let store := store.rcTick
+                if box.rc == 0 then
+                  .error (.mem "shared node has zero refcount")
+                else if box.rc == 1 then
+                  let children := match box.node with
+                    | .ctorN _ fields => fields.toList
+                    | .papN _ _ arguments => arguments.toList
+                  releaseSharedWork fuel (store.kill location) (children ++ rest)
+                else
+                  releaseSharedWork fuel
+                    (store.setBox location { box with rc := box.rc - 1 }) rest
+
+def releaseShared (heapFuel : Nat) (store : Store) (value : RVal) :
+    Except Error (Store × Nat) :=
+  releaseSharedWork heapFuel store [value]
+
+/-- Deep unique destruction with a separate work-list budget. -/
+def dropUniqueWork : Nat → Store → List RVal → Except Error (Store × Nat)
+  | fuel, store, [] => .ok (store, fuel)
+  | 0, _, _ :: _ => .error .heapFuel
+  | fuel + 1, store, value :: rest =>
+      match value with
+      | .lit _ | .erased => dropUniqueWork fuel store rest
+      | .loc location =>
+          match store.get? location with
+          | none => .error (.mem s!"dropUnique of dead location {location}")
+          | some box =>
+              if box.world != .unique then
+                .error (.mem "dropUnique of a shared node")
+              else
+                match box.node with
+                | .papN .. => .error (.mem "dropUnique of a PAP")
+                | .ctorN _ fields =>
+                    dropUniqueWork fuel (store.kill location)
+                      (fields.toList ++ rest)
+
+def dropUnique (heapFuel : Nat) (store : Store) (value : RVal) :
+    Except Error (Store × Nat) :=
+  dropUniqueWork heapFuel store [value]
+
+/-! ## Small-step control machine -/
+
+structure Frame where
+  definition : Function
+  block : BlockId := 0
+  pc : Nat := 0
+  values : Array RVal := #[]
+  credits : Array (Option Credit) := #[]
+  deriving Repr, Inhabited
+
+inductive Continuation where
+  | resume (frame : Frame)
+  | applyMore (arguments : Array RVal) (frame : Frame)
+  deriving Repr, Inhabited
+
+inductive Control where
+  | running (frame : Frame) (stack : List Continuation)
+  | halted (value : RVal)
+  deriving Repr, Inhabited
+
+structure Machine where
+  store : Store := {}
+  heapFuel : Nat := 0
+  control : Control
+  deriving Repr, Inhabited
+
+structure Result where
+  store : Store
+  value : RVal
+  controlRemaining : Nat
+  heapRemaining : Nat
+  deriving Repr, Inhabited
+
+def creditPresentCount (credits : Array (Option Credit)) : Nat :=
+  credits.foldl (fun total credit =>
+    match credit with
+    | some credit => if credit.isPresent then total + 1 else total
+    | none => total) 0
+
+def Frame.presentCredits (frame : Frame) : Nat :=
+  creditPresentCount frame.credits
+
+def Continuation.presentCredits : Continuation → Nat
+  | .resume frame | .applyMore _ frame => frame.presentCredits
+
+def Machine.presentCredits (machine : Machine) : Nat :=
+  match machine.control with
+  | .halted _ => 0
+  | .running frame stack =>
+      frame.presentCredits +
+        stack.foldl (fun total continuation =>
+          total + continuation.presentCredits) 0
+
+private def Frame.advance (frame : Frame) : Frame :=
+  { frame with pc := frame.pc + 1 }
+
+private def Frame.pushValue (frame : Frame) (value : RVal) : Frame :=
+  { frame with values := frame.values.push value }
+
+private def Frame.pushValues (frame : Frame) (values : Array RVal) : Frame :=
+  { frame with values := frame.values ++ values }
+
+private def Frame.pushCredit (frame : Frame) (credit : Credit) : Frame :=
+  { frame with credits := frame.credits.push (some credit) }
+
+private def Frame.hasCredits (frame : Frame) : Bool :=
+  frame.credits.any Option.isSome
+
+private def currentBlock (frame : Frame) : Except Error Block :=
+  match (frame.definition.blocks)[frame.block]? with
+  | some block => .ok block
+  | none => .error (.stuck s!"missing current block {frame.block}")
+
+/-- Shared entry check for both versioned credit policies. Every callee starts
+with an empty credit register file; caller credits stay in its continuation. -/
+def enterFunction (definition : Function) (arguments : Array RVal) :
+    Except Error Frame :=
+  if arguments.size != definition.signature.params.size then
+    .error (.stuck "function argument arity mismatch")
+  else if definition.blocks.isEmpty then
+    .error (.stuck "function has no entry block")
+  else
+    .ok { definition, values := arguments }
+
+private def creditAt (frame : Frame) (id : CreditId) : Except Error Credit :=
+  match (frame.credits)[id]? with
+  | some (some credit) => .ok credit
+  | some none => .error (.mem s!"credit {id} was already consumed")
+  | none => .error (.stuck s!"unknown credit register {id}")
+
+private def takeCredit (frame : Frame) (id : CreditId) :
+    Except Error (Frame × Credit) := do
+  let credit ← creditAt frame id
+  return ({ frame with credits := frame.credits.setIfInBounds id none }, credit)
+
+private def takeCredits (frame : Frame) (ids : Array CreditId) :
+    Except Error (Frame × Array Credit) :=
+  ids.foldlM (fun state id => do
+    let (frame, credit) ← takeCredit state.1 id
+    return (frame, state.2.push credit)) (frame, #[])
+
+private def checkFieldWorlds (store : Store) (schema : CtorSchema)
+    (values : Array RVal) : Except Error Unit := do
+  if values.size != schema.fields.size then
+    .error (.stuck "constructor field-count mismatch")
+  else
+    for pair in values.toList.zip schema.fields.toList do
+      if !pair.1.hasWorld store pair.2 then
+        .error (.mem "constructor field ownership-world mismatch")
+
+/-- Public semantic premise used by allocation reduction and simulation
+lemmas.  Its executable witness remains shared with the evaluator. -/
+def FieldWorlds (store : Store) (schema : CtorSchema)
+    (values : Array RVal) : Prop :=
+  checkFieldWorlds store schema values = .ok ()
+
+/-- The executable field check certifies the actual runtime payload arity. -/
+theorem FieldWorlds.size {store : Store} {schema : CtorSchema} {values : Array RVal}
+    (checked : FieldWorlds store schema values) : values.size = schema.fields.size := by
+  by_cases same : values.size = schema.fields.size
+  · exact same
+  · simp [FieldWorlds, checkFieldWorlds, same] at checked
+
+/-- A uniform constructor schema accepts an equally sized value vector when
+every value inhabits that world.  Baseline pipeline schemas have exactly this
+form, so semantic simulation can discharge the evaluator's executable field
+check from source ownership evidence. -/
+theorem FieldWorlds.of_replicate {store : Store} {schema : CtorSchema}
+    {values : Array RVal} {world : Owned} {count : Nat}
+    (schemaFields : schema.fields = Array.replicate count world)
+    (valueCount : values.size = count)
+    (worlds : ∀ value ∈ values.toList,
+      RVal.hasWorld store world value = true) :
+    FieldWorlds store schema values := by
+  have loop : ∀ entries : List RVal,
+      (∀ value ∈ entries, RVal.hasWorld store world value = true) →
+      (for pair in entries.zip (List.replicate entries.length world) do
+          if !RVal.hasWorld store pair.2 pair.1 then
+            Except.error
+              (Error.mem "constructor field ownership-world mismatch")) =
+        Except.ok PUnit.unit := by
+    intro entries entryWorlds
+    induction entries with
+    | nil => rfl
+    | cons value rest ih =>
+        have head := entryWorlds value (by simp)
+        have tail : ∀ candidate ∈ rest,
+            RVal.hasWorld store world candidate = true := by
+          intro candidate member
+          exact entryWorlds candidate (by simp [member])
+        simp only [List.length_cons, List.replicate_succ,
+          List.zip_cons_cons, List.forIn_cons]
+        have headFalse :
+            (!RVal.hasWorld store world value) = false := by
+          simp [head]
+        rw [headFalse]
+        simp only [Bool.false_eq_true, ↓reduceIte, bind, Except.bind,
+          pure, Except.pure]
+        exact ih tail
+  unfold FieldWorlds checkFieldWorlds
+  rw [schemaFields]
+  have sizes :
+      (values.size != (Array.replicate count world).size) = false := by
+    simp [valueCount]
+  rw [sizes]
+  simp only [Bool.false_eq_true, ↓reduceIte, Array.toList_replicate]
+  have lengthEq : values.toList.length = count := by
+    simpa using valueCount
+  rw [← lengthEq]
+  rw [loop values.toList worlds]
+
+/-- Inversion of `of_replicate`: a successful uniform-schema check exposes
+both the exact field count and the dynamic world of every field. -/
+theorem FieldWorlds.to_replicate {store : Store} {schema : CtorSchema}
+    {values : Array RVal} {world : Owned} {count : Nat}
+    (schemaFields : schema.fields = Array.replicate count world)
+    (worlds : FieldWorlds store schema values) :
+    values.size = count ∧
+      ∀ value ∈ values.toList,
+        RVal.hasWorld store world value = true := by
+  have loop : ∀ entries : List RVal,
+      (for pair in entries.zip (List.replicate entries.length world) do
+          if !RVal.hasWorld store pair.2 pair.1 then
+            Except.error
+              (Error.mem "constructor field ownership-world mismatch")) =
+        Except.ok PUnit.unit →
+      ∀ value ∈ entries,
+        RVal.hasWorld store world value = true := by
+    intro entries
+    induction entries with
+    | nil => simp
+    | cons head tail ih =>
+        intro run value member
+        simp only [List.length_cons, List.replicate_succ,
+          List.zip_cons_cons, List.forIn_cons] at run
+        have headWorld : RVal.hasWorld store world head = true := by
+          cases found : RVal.hasWorld store world head with
+          | false =>
+              simp only [found, Bool.not_false, ↓reduceIte, bind,
+                Except.bind] at run
+              cases run
+          | true => rfl
+        have tailRun :
+            (for pair in tail.zip (List.replicate tail.length world) do
+                if !RVal.hasWorld store pair.2 pair.1 then
+                  Except.error
+                    (Error.mem
+                      "constructor field ownership-world mismatch")) =
+              Except.ok PUnit.unit := by
+          simpa [headWorld] using run
+        simp only [List.mem_cons] at member
+        rcases member with rfl | member
+        · exact headWorld
+        · exact ih tailRun value member
+  unfold FieldWorlds checkFieldWorlds at worlds
+  rw [schemaFields] at worlds
+  by_cases valueCount : values.size = count
+  · have sizes :
+        (values.size != (Array.replicate count world).size) = false := by
+      simp [valueCount]
+    rw [sizes] at worlds
+    simp only [Bool.false_eq_true, ↓reduceIte,
+      Array.toList_replicate] at worlds
+    have lengthEq : values.toList.length = count := by
+      simpa using valueCount
+    rw [← lengthEq] at worlds
+    exact ⟨valueCount, loop values.toList worlds⟩
+  · have sizes :
+        (values.size != (Array.replicate count world).size) = true := by
+      simp [valueCount]
+    rw [sizes] at worlds
+    simp at worlds
+
+/-- Constructor-field validation depends on a store only through the dynamic
+world observed for each field value.  This congruence theorem lets semantic
+simulations transport `FieldWorlds` across a heap relation without unfolding
+the evaluator's private checker. -/
+theorem FieldWorlds.congrStore {left right : Store} {schema : CtorSchema}
+    {values : Array RVal}
+    (sameWorlds : ∀ world value,
+      RVal.hasWorld left world value = RVal.hasWorld right world value)
+    (worlds : FieldWorlds left schema values) :
+    FieldWorlds right schema values := by
+  unfold FieldWorlds checkFieldWorlds at worlds ⊢
+  simpa only [← sameWorlds] using worlds
+
+/-- Pointwise value relation used by the public field-check transport seam. -/
+inductive FieldValuesWorldEq (left right : Store) :
+    List RVal → List RVal → Prop where
+  | nil : FieldValuesWorldEq left right [] []
+  | cons {leftValue rightValue : RVal} {lefts rights : List RVal}
+      (head : ∀ world,
+        RVal.hasWorld left world leftValue =
+          RVal.hasWorld right world rightValue)
+      (tail : FieldValuesWorldEq left right lefts rights) :
+      FieldValuesWorldEq left right (leftValue :: lefts)
+        (rightValue :: rights)
+
+theorem FieldValuesWorldEq.length_eq {left right : Store} :
+    ∀ {lefts rights : List RVal},
+      FieldValuesWorldEq left right lefts rights →
+      lefts.length = rights.length
+  | _, _, .nil => rfl
+  | _, _, .cons _ tail => by simp [tail.length_eq]
+
+/-- Constructor-field validation transports across pointwise values that make
+the same dynamic ownership observation.  This is the allocation-facing
+equivariance interface: clients need not unfold the private checker or require
+the two value vectors to use identical concrete heap locations. -/
+theorem FieldWorlds.transport {left right : Store} {schema : CtorSchema}
+    {leftValues rightValues : Array RVal}
+    (related : FieldValuesWorldEq left right
+      leftValues.toList rightValues.toList)
+    (worlds : FieldWorlds left schema leftValues) :
+    FieldWorlds right schema rightValues := by
+  have sizes : leftValues.size = rightValues.size := by
+    simpa using related.length_eq
+  have loop : ∀ {lefts rights : List RVal},
+      FieldValuesWorldEq left right lefts rights →
+      ∀ schemaFields : List Owned,
+        ((for pair in lefts.zip schemaFields do
+            if !pair.1.hasWorld left pair.2 then
+              Except.error
+                (Error.mem "constructor field ownership-world mismatch")) :
+            Except Error Unit) =
+          ((for pair in rights.zip schemaFields do
+            if !pair.1.hasWorld right pair.2 then
+              Except.error
+                (Error.mem "constructor field ownership-world mismatch")) :
+            Except Error Unit) := by
+    intro lefts rights valuesRelated
+    induction valuesRelated with
+    | nil => intro schemaFields; simp
+    | cons valueRelated tailRelated ih =>
+        intro schemaFields
+        cases schemaFields with
+        | nil => rfl
+        | cons world rest =>
+            simp only [List.zip_cons_cons, List.forIn_cons]
+            rw [valueRelated world]
+            split <;> simp only [bind, Except.bind, pure, Except.pure]
+            exact ih rest
+  unfold FieldWorlds checkFieldWorlds at worlds ⊢
+  rw [← sizes]
+  rw [← loop related schema.fields.toList]
+  exact worlds
+
+/-- Pointwise preservation of successful world observations. Dead historical
+registers need not have the same observations after physical reuse. -/
+inductive FieldValuesWorldForward (left right : Store) : List RVal → List RVal → Prop where
+  | nil : FieldValuesWorldForward left right [] []
+  | cons {leftValue rightValue : RVal} {lefts rights : List RVal}
+      (head : ∀ world, RVal.hasWorld left world leftValue = true →
+        RVal.hasWorld right world rightValue = true)
+      (tail : FieldValuesWorldForward left right lefts rights) :
+      FieldValuesWorldForward left right (leftValue :: lefts) (rightValue :: rights)
+
+theorem FieldValuesWorldForward.length_eq {left right : Store} :
+    ∀ {lefts rights : List RVal}, FieldValuesWorldForward left right lefts rights →
+      lefts.length = rights.length
+  | _, _, .nil => rfl
+  | _, _, .cons _ tail => by simp [tail.length_eq]
+
+theorem FieldWorlds.forward {left right : Store} {schema : CtorSchema}
+    {leftValues rightValues : Array RVal}
+    (related : FieldValuesWorldForward left right leftValues.toList rightValues.toList)
+    (worlds : FieldWorlds left schema leftValues) : FieldWorlds right schema rightValues := by
+  have sizes : leftValues.size = rightValues.size := by simpa using related.length_eq
+  have loop : ∀ {lefts rights : List RVal},
+      FieldValuesWorldForward left right lefts rights → ∀ schemaFields : List Owned,
+        ((for pair in lefts.zip schemaFields do
+            if !pair.1.hasWorld left pair.2 then
+              Except.error (Error.mem "constructor field ownership-world mismatch")) :
+            Except Error Unit) = .ok () →
+        ((for pair in rights.zip schemaFields do
+            if !pair.1.hasWorld right pair.2 then
+              Except.error (Error.mem "constructor field ownership-world mismatch")) :
+            Except Error Unit) = .ok () := by
+    intro lefts rights related
+    induction related with
+    | nil => intro schemaFields checked; simpa using checked
+    | @cons leftValue rightValue lefts rights head tail ih =>
+        intro schemaFields checked
+        cases schemaFields with
+        | nil => rfl
+        | cons world rest =>
+            simp only [List.zip_cons_cons, List.forIn_cons] at checked ⊢
+            cases observed : RVal.hasWorld left world leftValue with
+            | false => simp [observed, bind, Except.bind] at checked
+            | true =>
+                have rightObserved := head world observed
+                simp [observed, bind, Except.bind, pure, Except.pure] at checked
+                simpa [rightObserved, bind, Except.bind, pure, Except.pure] using
+                  ih rest (by simpa [bind, Except.bind, pure, Except.pure] using checked)
+  have arity := worlds.size
+  unfold FieldWorlds checkFieldWorlds at worlds ⊢
+  simp only [← sizes, arity, bne_self_eq_false, Bool.false_eq_true, ↓reduceIte] at worlds ⊢
+  exact loop related schema.fields.toList worlds
+
+private def callScalarOracle (context : Context) (address : Address)
+    (arguments : Array RVal) : Except Error RVal :=
+  if !arguments.all RVal.isScalar then
+    .error (.mem "extern heap arguments require an ownership policy")
+  else
+    match context.oracle address arguments.toList with
+    | none => .error (.unknownRef address)
+    | some value =>
+        if value.isScalar then .ok value
+        else .error (.mem "extern heap results require an ownership policy")
+
+private def declarationArity : Decl → Nat
+  | .fn definition => definition.signature.params.size
+  | .extern arity => arity
+
+private def declarationPapSafe : Decl → Bool
+  | .fn definition => definition.signature.papSafe
+  | .extern _ => true
+
+private def ensureCallBoundary (frame : Frame) : Except Error Unit :=
+  if frame.hasCredits then
+    .error (.mem "reuse credit crossed a call boundary")
+  else
+    return ()
+
+private def resumeImmediate (store : Store) (heapFuel : Nat) (value : RVal)
+    (frame : Frame) (stack : List Continuation) : Machine :=
+  { store := store
+    heapFuel := heapFuel
+    control := .running (frame.pushValue value) stack }
+
+private def beginApply (context : Context) (_interpretation : Interpretation)
+    (store : Store) (heapFuel : Nat) (function : RVal)
+    (arguments : Array RVal) (resume : Frame) (stack : List Continuation) :
+    Except Error Machine := do
+  match function with
+  | .lit _ => .error (.stuck "apply of a scalar literal")
+  | .erased =>
+      let (store, heapFuel) ←
+        releaseSharedWork heapFuel store arguments.toList
+      return resumeImmediate store heapFuel .erased resume stack
+  | .loc location =>
+      let box ← match store.get? location with
+        | some box => pure box
+        | none => .error (.mem s!"apply of dead location {location}")
+      if box.world != .shared then
+        .error (.mem "apply of a unique node")
+      else
+        match box.node with
+        | .ctorN .. => .error (.stuck "apply of a constructor node")
+        | .papN address arity captured =>
+            if captured.size >= arity then
+              .error (.stuck "malformed saturated PAP")
+            else
+              let store ← retainSharedMany store captured
+              let (store, heapFuel) ←
+                releaseSharedWork heapFuel store [.loc location]
+              let total := captured ++ arguments
+              if total.size < arity then
+                let (store, location) :=
+                  store.allocNode .shared (.papN address arity total)
+                return resumeImmediate store heapFuel (.loc location) resume stack
+              else
+                let declaration ← match context.declarations address with
+                  | some declaration => pure declaration
+                  | none => .error (.unknownRef address)
+                if !declarationPapSafe declaration then
+                  .error (.stuck "shared PAP targets a non-pap-safe function")
+                else
+                  let supplied := total.extract 0 arity
+                  let rest := total.extract arity total.size
+                  match declaration with
+                  | .fn definition =>
+                      let callee ← enterFunction definition supplied
+                      let continuation : Continuation :=
+                        if rest.isEmpty then Continuation.resume resume
+                        else Continuation.applyMore rest resume
+                      let nextMachine : Machine :=
+                        { store := store
+                          heapFuel := heapFuel
+                          control := .running callee (continuation :: stack) }
+                      return nextMachine
+                  | .extern expectedArity =>
+                      if supplied.size != expectedArity then
+                        .error (.stuck "extern PAP arity mismatch")
+                      else if !rest.isEmpty then
+                        .error (.stuck "over-application of a scalar extern result")
+                      else
+                        let value ← callScalarOracle context address supplied
+                        return resumeImmediate store heapFuel value resume stack
+
+private def transferEdge (frame : Frame) (edge : Edge)
+    (implicitValues : Array RVal := #[]) : Except Error Frame := do
+  let values ← resolveAtoms frame.values edge.values
+  let (frame, credits) ← takeCredits frame edge.credits
+  if frame.hasCredits then
+    .error (.mem "edge abandoned a live reuse credit")
+  else
+    let target ← match (frame.definition.blocks)[edge.target]? with
+      | some block => pure block
+      | none => .error (.stuck s!"edge targets missing block {edge.target}")
+    let values := implicitValues ++ values
+    if values.size != target.valueParams.size then
+      .error (.stuck "edge value arity mismatch")
+    else if credits.size != target.creditParams.size then
+      .error (.stuck "edge credit arity mismatch")
+    else
+      return { frame with
+        block := edge.target
+        pc := 0
+        values
+        credits := credits.map some }
+
+private def runInstruction (context : Context)
+    (interpretation : Interpretation) (machine : Machine) (frame : Frame)
+    (stack : List Continuation) (instruction : Instr) : Except Error Machine := do
+  let next := frame.advance
+  match instruction with
+  | .move atom =>
+      let value ← resolveAtom frame.values atom
+      return { machine with control := .running (next.pushValue value) stack }
+  | .alloc world cid arguments =>
+      let schema ← lookupSchema context world cid
+      let values ← resolveAtoms frame.values arguments
+      checkFieldWorlds machine.store schema values
+      let (store, location) := machine.store.allocNode world (.ctorN cid values)
+      return { machine with
+        store
+        control := .running (next.pushValue (.loc location)) stack }
+  | .allocWith creditId world cid arguments =>
+      let schema ← lookupSchema context world cid
+      let values ← resolveAtoms frame.values arguments
+      checkFieldWorlds machine.store schema values
+      let (next, credit) ← takeCredit next creditId
+      if credit.layout != schema.layout then
+        .error (.mem "allocWith credit layout mismatch")
+      else
+        match interpretation, credit.presence with
+        | _, .absent =>
+            let (store, location) :=
+              machine.store.allocNode world (.ctorN cid values)
+            return { machine with
+              store
+              control := .running (next.pushValue (.loc location)) stack }
+        | .logical, .present none =>
+            let (store, location) :=
+              machine.store.allocNode world (.ctorN cid values)
+            return { machine with
+              store
+              control := .running (next.pushValue (.loc location)) stack }
+        | .physical, .present (some location) =>
+            let store ← machine.store.reuseReservation location world
+              (.ctorN cid values) schema.fields.size
+            return { machine with
+              store
+              control := .running (next.pushValue (.loc location)) stack }
+        | _, .present _ =>
+            .error (.mem "credit reservation belongs to the other interpretation")
+  | .discardCredit creditId =>
+      let (next, credit) ← takeCredit next creditId
+      let store ← match interpretation, credit.presence with
+        | _, .absent => pure machine.store
+        | .logical, .present none => pure machine.store
+        | .physical, .present (some location) =>
+            machine.store.releaseReservation location
+        | _, .present _ =>
+            .error (.mem "credit reservation belongs to the other interpretation")
+      return { machine with store, control := .running next stack }
+  | .takeUnique target cid =>
+      let schema ← lookupSchema context .unique cid
+      match ← resolveAtom frame.values target with
+      | .loc location =>
+          let (box, fields) ← requireCtor machine.store location .unique cid
+          if box.rc != 1 then
+            .error (.mem "unique constructor has a non-unit refcount")
+          else
+            let store := match interpretation with
+              | .logical => machine.store.kill location
+              | .physical => machine.store.reserve location
+            let credit := Credit.presentFor interpretation schema.layout location
+            let next := (next.pushValues fields).pushCredit credit
+            return { machine with store, control := .running next stack }
+      | _ => .error (.mem "takeUnique requires a constructor location")
+  | .resetShared target cid =>
+      let schema ← lookupSchema context .shared cid
+      match ← resolveAtom frame.values target with
+      | .loc location =>
+          let (box, fields) ← requireCtor machine.store location .shared cid
+          let store := machine.store.tickResetAttempt
+          if box.rc == 0 then
+            .error (.mem "shared constructor has zero refcount")
+          else if box.rc == 1 then
+            let store := (match interpretation with
+              | .logical => store.kill location
+              | .physical => store.reserve location).tickHotReset
+            let credit := Credit.presentFor interpretation schema.layout location
+            let next := (next.pushValues fields).pushCredit credit
+            return { machine with store, control := .running next stack }
+          else
+            let store :=
+              ((store.setBox location { box with rc := box.rc - 1 }).rcTick).tickColdReset
+            let store ← retainSharedMany store fields
+            let credit : Credit := { layout := schema.layout, presence := .absent }
+            let next := (next.pushValues fields).pushCredit credit
+            return { machine with store, control := .running next stack }
+      | _ => .error (.mem "resetShared requires a constructor location")
+  | .retainShared target =>
+      let value ← resolveAtom frame.values target
+      let store ← retainShared machine.store value
+      return { machine with
+        store
+        control := .running (next.pushValue value) stack }
+  | .releaseShared target =>
+      let value ← resolveAtom frame.values target
+      let (store, heapFuel) ← releaseShared machine.heapFuel machine.store value
+      return { store, heapFuel, control := .running next stack }
+  | .dropUnique target =>
+      let value ← resolveAtom frame.values target
+      let (store, heapFuel) ← dropUnique machine.heapFuel machine.store value
+      return { store, heapFuel, control := .running next stack }
+  | .freeUnique target cid =>
+      match ← resolveAtom frame.values target with
+      | .loc location =>
+          let (_, fields) ← requireCtor machine.store location .unique cid
+          if !fields.all RVal.isScalar then
+            .error (.mem "freeUnique requires an all-scalar constructor")
+          else
+            return { machine with
+              store := machine.store.kill location
+              control := .running next stack }
+      | _ => .error (.mem "freeUnique requires a constructor location")
+  | .fetch target cid field =>
+      match ← resolveAtom frame.values target with
+      | .loc location =>
+          let box ← match machine.store.get? location with
+            | some box => pure box
+            | none => .error (.mem s!"fetch from dead location {location}")
+          match box.node with
+          | .papN .. => .error (.stuck "fetch from a PAP")
+          | .ctorN actual fields =>
+              if actual != cid then
+                .error (.stuck "fetch constructor identity mismatch")
+              else
+                match (fields)[field]? with
+                | some value =>
+                    return { machine with
+                      control := .running (next.pushValue value) stack }
+                | none => .error (.stuck s!"fetch field {field} out of range")
+      | _ => .error (.stuck "fetch from a non-location")
+  | .call address arguments =>
+      ensureCallBoundary frame
+      let values ← resolveAtoms frame.values arguments
+      match context.declarations address with
+      | some (.fn definition) =>
+          let callee ← enterFunction definition values
+          return { machine with
+            control := .running callee (.resume next :: stack) }
+      | some (.extern _) => .error (.stuck "call must not target an extern")
+      | none => .error (.unknownRef address)
+  | .callSelf arguments =>
+      ensureCallBoundary frame
+      let values ← resolveAtoms frame.values arguments
+      let callee ← enterFunction frame.definition values
+      return { machine with control := .running callee (.resume next :: stack) }
+  | .papp address arguments =>
+      ensureCallBoundary frame
+      let values ← resolveAtoms frame.values arguments
+      let declaration ← match context.declarations address with
+        | some declaration => pure declaration
+        | none => .error (.unknownRef address)
+      let arity := declarationArity declaration
+      if !declarationPapSafe declaration then
+        .error (.stuck "PAP target is not papSafe")
+      else if values.size >= arity then
+        .error (.stuck "papp must be strictly under-saturated")
+      else
+        let (store, location) :=
+          machine.store.allocNode .shared (.papN address arity values)
+        return { machine with
+          store
+          control := .running (next.pushValue (.loc location)) stack }
+  | .apply function arguments =>
+      ensureCallBoundary frame
+      let function ← resolveAtom frame.values function
+      let arguments ← resolveAtoms frame.values arguments
+      beginApply context interpretation machine.store machine.heapFuel function
+        arguments next stack
+  | .extern address arguments =>
+      ensureCallBoundary frame
+      let values ← resolveAtoms frame.values arguments
+      match context.declarations address with
+      | some (.extern arity) =>
+          if values.size != arity then
+            .error (.stuck "extern arity mismatch")
+          else
+            let value ← callScalarOracle context address values
+            return { machine with control := .running (next.pushValue value) stack }
+      | some (.fn _) => .error (.stuck "extern instruction targets a function")
+      | none => .error (.unknownRef address)
+
+private def finishReturn (context : Context)
+    (interpretation : Interpretation) (machine : Machine) (frame : Frame)
+    (stack : List Continuation) (value : RVal) : Except Error Machine := do
+  if frame.hasCredits then
+    .error (.mem "function returned with a live reuse credit")
+  else if !value.hasWorld machine.store frame.definition.signature.result then
+    .error (.mem "function result ownership-world mismatch")
+  else
+    match stack with
+    | [] => return { machine with control := .halted value }
+    | .resume caller :: rest =>
+        return { machine with control := .running (caller.pushValue value) rest }
+    | .applyMore arguments caller :: rest =>
+        beginApply context interpretation machine.store machine.heapFuel value
+          arguments caller rest
+
+private def runTerminator (context : Context)
+    (interpretation : Interpretation) (machine : Machine) (frame : Frame)
+    (stack : List Continuation) (terminator : Terminator) : Except Error Machine := do
+  match terminator with
+  | .jump edge =>
+      let frame ← transferEdge frame edge
+      return { machine with control := .running frame stack }
+  | .switchValue scrutinee constructors natPeel =>
+      match ← resolveAtom frame.values scrutinee with
+      | .loc location =>
+          let box ← match machine.store.get? location with
+            | some box => pure box
+            | none => .error (.mem s!"switch on dead location {location}")
+          match box.node with
+          | .papN .. => .error (.stuck "switch on a PAP")
+          | .ctorN cid _ =>
+              match constructors.find? fun alternative => alternative.cid == cid with
+              | none => .error (.stuck "missing constructor alternative")
+              | some alternative =>
+                  let frame ← transferEdge frame alternative.edge
+                  return { machine with control := .running frame stack }
+      | .lit (.nat number) =>
+          match natPeel with
+          | none => .error (.stuck "Nat switch without literal peeling")
+          | some peel =>
+              match number with
+              | 0 =>
+                  let frame ← transferEdge frame peel.zero
+                  return { machine with control := .running frame stack }
+              | predecessor + 1 =>
+                  let frame ← transferEdge frame peel.succ #[.lit (.nat predecessor)]
+                  return { machine with control := .running frame stack }
+      | .lit (.str _) | .erased => .error (.stuck "switch on a non-Nat scalar")
+  | .branchCredit credit someEdge noneEdge =>
+      let credit ← creditAt frame credit
+      let edge := if credit.isPresent then someEdge else noneEdge
+      let frame ← transferEdge frame edge
+      return { machine with control := .running frame stack }
+  | .ret atom =>
+      let value ← resolveAtom frame.values atom
+      finishReturn context interpretation machine frame stack value
+  | .tailCall address arguments =>
+      ensureCallBoundary frame
+      let values ← resolveAtoms frame.values arguments
+      match context.declarations address with
+      | some (.fn definition) =>
+          let frame ← enterFunction definition values
+          return { machine with control := .running frame stack }
+      | some (.extern _) => .error (.stuck "tailCall must not target an extern")
+      | none => .error (.unknownRef address)
+  | .tailCallSelf arguments =>
+      ensureCallBoundary frame
+      let values ← resolveAtoms frame.values arguments
+      let frame ← enterFunction frame.definition values
+      return { machine with control := .running frame stack }
+
+/-- One control transition: exactly one IxIR₂ instruction or terminator. -/
+def step (context : Context) (interpretation : Interpretation)
+    (machine : Machine) : Except Error Machine := do
+  match machine.control with
+  | .halted _ => return machine
+  | .running frame stack =>
+      let block ← currentBlock frame
+      if h : frame.pc < block.instructions.size then
+        runInstruction context interpretation machine frame stack
+          block.instructions[frame.pc]
+      else if frame.pc == block.instructions.size then
+        runTerminator context interpretation machine frame stack block.terminator
+      else
+        .error (.stuck "program counter passed the block terminator")
+
+/-- Unfueled small-step relation underlying the total runner. -/
+def Step (context : Context) (interpretation : Interpretation)
+    (before after : Machine) : Prop :=
+  step context interpretation before = .ok after
+
+/-- Public proof interface for one checked CFG-edge transfer. It exposes the
+resulting frame without making simulation clients unfold the evaluator's
+private dispatcher. -/
+def EdgeTransfer (frame : Frame) (edge : Edge)
+    (implicitValues : Array RVal) (target : Frame) : Prop :=
+  transferEdge frame edge implicitValues = .ok target
+
+/-- Public proof interface for one dynamic-application dispatch.  Both an
+`apply` instruction and an `applyMore` return continuation enter the same
+private executable worker; exposing its exact successful equation here keeps
+their semantic proofs on one control boundary. -/
+def ApplyTransfer (context : Context) (interpretation : Interpretation)
+    (store : Store) (heapFuel : Nat) (function : RVal)
+    (arguments : Array RVal) (resume : Frame)
+    (stack : List Continuation) (target : Machine) : Prop :=
+  beginApply context interpretation store heapFuel function arguments resume
+    stack = .ok target
+
+/-- Public equation for one scalar-only external call. -/
+def ScalarOracleCall (context : Context) (address : Address)
+    (arguments : Array RVal) (value : RVal) : Prop :=
+  callScalarOracle context address arguments = .ok value
+
+theorem ScalarOracleCall.congrOracle {left right : Context}
+    {address : Address} {arguments : Array RVal} {value : RVal}
+    (oracles : left.oracle = right.oracle)
+    (called : ScalarOracleCall left address arguments value) :
+    ScalarOracleCall right address arguments value := by
+  unfold ScalarOracleCall callScalarOracle at called ⊢
+  rw [← oracles]
+  exact called
+
+/-- A successful scalar oracle boundary certifies that both its full argument
+vector and returned value are scalar. -/
+theorem ScalarOracleCall.scalar {context : Context} {address : Address}
+    {arguments : Array RVal} {value : RVal}
+    (called : ScalarOracleCall context address arguments value) :
+    arguments.all RVal.isScalar = true ∧ value.isScalar = true := by
+  by_cases argumentsScalar : arguments.all RVal.isScalar = true
+  · refine ⟨argumentsScalar, ?_⟩
+    cases oracleAt : context.oracle address arguments.toList with
+    | none =>
+        simp [ScalarOracleCall, callScalarOracle, argumentsScalar,
+          oracleAt] at called
+    | some result =>
+        by_cases resultScalar : result.isScalar = true
+        · simp [ScalarOracleCall, callScalarOracle, argumentsScalar,
+            oracleAt, resultScalar] at called
+          cases called
+          exact resultScalar
+        · simp [ScalarOracleCall, callScalarOracle, argumentsScalar,
+            oracleAt, resultScalar] at called
+  · simp [ScalarOracleCall, callScalarOracle, argumentsScalar] at called
+
+/-- Public equation for the shared-value retain loop used while opening a
+PAP.  The implementation remains centralized in the evaluator while
+simulation clients can relate it to IxIR₁'s `dupVals`. -/
+def RetainSharedMany (store : Store) (values : Array RVal)
+    (target : Store) : Prop :=
+  retainSharedMany store values = .ok target
+
+/-- Public equation for looking up a live credit without consuming it.  This
+is the semantic premise used by `branchCredit`. -/
+def CreditLookup (frame : Frame) (id : CreditId) (credit : Credit) : Prop :=
+  creditAt frame id = .ok credit
+
+/-- Public equation for consuming one linear credit from a frame.  Allocation
+and discard rules use the returned frame directly, keeping the private slot
+update centralized in the evaluator. -/
+def CreditTake (frame : Frame) (id : CreditId) (target : Frame)
+    (credit : Credit) : Prop :=
+  takeCredit frame id = .ok (target, credit)
+
+/-- Public equation for transferring a vector of linear credits across a CFG
+edge. -/
+def CreditTakeMany (frame : Frame) (ids : Array CreditId) (target : Frame)
+    (credits : Array Credit) : Prop :=
+  takeCredits frame ids = .ok (target, credits)
+
+/-- A structural view of batch credit consumption.  It exposes the sequence
+of successful single-credit takes without exposing the evaluator's private
+fold implementation. -/
+inductive CreditTakeSequence :
+    Frame → List CreditId → Frame → List Credit → Prop where
+  | nil (frame : Frame) : CreditTakeSequence frame [] frame []
+  | cons {frame middle target : Frame} {id : CreditId}
+      {ids : List CreditId} {credit : Credit} {credits : List Credit}
+      (head : CreditTake frame id middle credit)
+      (tail : CreditTakeSequence middle ids target credits) :
+      CreditTakeSequence frame (id :: ids) target (credit :: credits)
+
+private theorem takeCredit_changeDefinition (frame : Frame) (id : CreditId)
+    (definition : Function) :
+    takeCredit { frame with definition } id =
+      (takeCredit frame id).map (fun output =>
+        ({ output.1 with definition }, output.2)) := by
+  unfold takeCredit creditAt
+  cases found : frame.credits[id]? with
+  | none =>
+      simp [bind, Except.bind, Except.map]
+  | some slot =>
+      cases slot with
+      | none =>
+          simp [bind, Except.bind, Except.map]
+      | some credit =>
+          simp [bind, Except.bind, pure, Except.pure, Except.map]
+
+theorem CreditLookup.congrDefinition {frame : Frame} {id : CreditId}
+    {credit : Credit} (definition : Function)
+    (lookedUp : CreditLookup frame id credit) :
+    CreditLookup { frame with definition } id credit := by
+  unfold CreditLookup creditAt at lookedUp ⊢
+  simpa using lookedUp
+
+theorem CreditTake.congrDefinition {frame target : Frame} {id : CreditId}
+    {credit : Credit} (definition : Function)
+    (taken : CreditTake frame id target credit) :
+    CreditTake { frame with definition } id
+      { target with definition } credit := by
+  unfold CreditTake at taken ⊢
+  rw [takeCredit_changeDefinition, taken]
+  rfl
+
+/-- Successful single-credit consumption exposes the exact frame update and
+the live slot that was removed. -/
+theorem CreditTake.target_eq {frame target : Frame} {id : CreditId}
+    {credit : Credit} (taken : CreditTake frame id target credit) :
+    target = { frame with
+      credits := frame.credits.setIfInBounds id none } ∧
+      frame.credits[id]? = some (some credit) := by
+  unfold CreditTake takeCredit creditAt at taken
+  cases found : frame.credits[id]? with
+  | none =>
+      simp [found, bind, Except.bind] at taken
+  | some slot =>
+      cases slot with
+      | none =>
+          simp [found, bind, Except.bind] at taken
+      | some foundCredit =>
+          simp [found, bind, Except.bind, pure, Except.pure] at taken
+          obtain ⟨rfl, rfl⟩ := taken
+          exact ⟨rfl, rfl⟩
+
+private theorem takeCredits_changeDefinition (frame : Frame)
+    (ids : Array CreditId) (definition : Function) :
+    takeCredits { frame with definition } ids =
+      (takeCredits frame ids).map (fun output =>
+        ({ output.1 with definition }, output.2)) := by
+  unfold takeCredits
+  rw [← Array.foldlM_toList, ← Array.foldlM_toList]
+  let transform : Frame × Array Credit → Frame × Array Credit :=
+    fun state => ({ state.1 with definition }, state.2)
+  let takeStep : Frame × Array Credit → CreditId →
+      Except Error (Frame × Array Credit) :=
+    fun state id => do
+      let (next, credit) ← takeCredit state.1 id
+      return (next, state.2.push credit)
+  have one : ∀ (state : Frame × Array Credit) (id : CreditId),
+      takeStep (transform state) id =
+        (takeStep state id).map transform := by
+    intro state id
+    simp only [takeStep, transform]
+    rw [takeCredit_changeDefinition]
+    cases taken : takeCredit state.1 id with
+    | error error =>
+        simp [bind, Except.bind, Except.map]
+    | ok output =>
+        obtain ⟨next, credit⟩ := output
+        simp [bind, Except.bind, pure, Except.pure, Except.map]
+  have loop : ∀ (remaining : List CreditId)
+      (state : Frame × Array Credit),
+      List.foldlM takeStep (transform state) remaining =
+        (List.foldlM takeStep state remaining).map transform := by
+    intro remaining
+    induction remaining with
+    | nil => intro state; rfl
+    | cons id tail ih =>
+        intro state
+        simp only [List.foldlM_cons]
+        cases taken : takeStep state id with
+        | error error =>
+            have transformed := one state id
+            rw [taken] at transformed
+            simp only [Except.map] at transformed
+            rw [transformed]
+            simp [bind, Except.bind, Except.map]
+        | ok next =>
+            have transformed := one state id
+            rw [taken] at transformed
+            simp only [Except.map] at transformed
+            rw [transformed]
+            simpa [bind, Except.bind, Except.map] using ih next
+  exact loop ids.toList (frame, #[])
+
+/-- Consuming credits changes only the credit file of a frame. -/
+theorem CreditTakeMany.definition {frame target : Frame}
+    {ids : Array CreditId} {credits : Array Credit}
+    (taken : CreditTakeMany frame ids target credits) :
+    target.definition = frame.definition := by
+  unfold CreditTakeMany at taken
+  have preserved :=
+    takeCredits_changeDefinition frame ids frame.definition
+  have inputEq : { frame with definition := frame.definition } = frame := by
+    cases frame
+    rfl
+  rw [inputEq, taken] at preserved
+  simp only [Except.map, Except.ok.injEq, Prod.mk.injEq] at preserved
+  have definitions := congrArg Frame.definition preserved.1
+  simpa using definitions
+
+/-- Successful batch consumption decomposes into the corresponding sequence
+of successful single-credit takes. -/
+theorem CreditTakeMany.sequence {frame target : Frame}
+    {ids : Array CreditId} {credits : Array Credit}
+    (taken : CreditTakeMany frame ids target credits) :
+    CreditTakeSequence frame ids.toList target credits.toList := by
+  let takeStep : Frame × Array Credit → CreditId →
+      Except Error (Frame × Array Credit) :=
+    fun state id => do
+      let (next, credit) ← takeCredit state.1 id
+      return (next, state.2.push credit)
+  have loop : ∀ (remaining : List CreditId) (current : Frame)
+      (initial : Array Credit) {final : Frame} {output : Array Credit},
+      List.foldlM takeStep (current, initial) remaining =
+        .ok (final, output) →
+      ∃ suffix : List Credit,
+        CreditTakeSequence current remaining final suffix ∧
+          output.toList = initial.toList ++ suffix := by
+    intro remaining
+    induction remaining with
+    | nil =>
+        intro current initial final output run
+        simp only [List.foldlM_nil] at run
+        obtain ⟨rfl, rfl⟩ := run
+        exact ⟨[], .nil current, by simp⟩
+    | cons id rest ih =>
+        intro current initial final output run
+        rw [List.foldlM_cons] at run
+        cases headRun : takeCredit current id with
+        | error error =>
+            simp [takeStep, headRun, bind, Except.bind] at run
+        | ok result =>
+            obtain ⟨middle, credit⟩ := result
+            simp only [takeStep, headRun, bind, Except.bind, pure,
+              Except.pure] at run
+            obtain ⟨suffix, tail, outputEq⟩ :=
+              ih middle (initial.push credit) run
+            refine ⟨credit :: suffix, .cons ?_ tail, ?_⟩
+            · exact headRun
+            · simp [outputEq, List.append_assoc]
+  unfold CreditTakeMany takeCredits at taken
+  rw [← Array.foldlM_toList] at taken
+  change List.foldlM takeStep (frame, #[]) ids.toList =
+    .ok (target, credits) at taken
+  obtain ⟨suffix, sequence, outputEq⟩ := loop ids.toList frame #[] taken
+  have suffixEq : credits.toList = suffix := by simpa using outputEq
+  subst suffix
+  exact sequence
+
+/-- A sequence of successful single-credit takes reconstructs the evaluator's
+batch operation. -/
+theorem CreditTakeSequence.toMany {frame target : Frame}
+    {ids : List CreditId} {credits : List Credit}
+    (sequence : CreditTakeSequence frame ids target credits) :
+    CreditTakeMany frame ids.toArray target credits.toArray := by
+  let takeStep : Frame × Array Credit → CreditId →
+      Except Error (Frame × Array Credit) :=
+    fun state id => do
+      let (next, credit) ← takeCredit state.1 id
+      return (next, state.2.push credit)
+  have loop : ∀ {current final : Frame} {remaining : List CreditId}
+      {output : List Credit},
+      CreditTakeSequence current remaining final output →
+      ∀ initial : Array Credit,
+        List.foldlM takeStep (current, initial) remaining =
+          .ok (final, initial ++ output.toArray) := by
+    intro current final remaining output sequence
+    induction sequence with
+    | nil current =>
+        intro initial
+        rfl
+    | @cons current middle final id remaining credit output head tail ih =>
+        intro initial
+        rw [List.foldlM_cons]
+        unfold CreditTake at head
+        have headStep : takeStep (current, initial) id =
+            .ok (middle, initial.push credit) := by
+          dsimp only [takeStep]
+          rw [head]
+          rfl
+        rw [headStep]
+        simp only [bind, Except.bind]
+        rw [ih (initial.push credit)]
+        congr 2
+        apply Array.toList_inj.mp
+        simp
+  unfold CreditTakeMany takeCredits
+  rw [← Array.foldlM_toList]
+  change List.foldlM takeStep (frame, #[]) ids =
+    .ok (target, credits.toArray)
+  simpa using loop sequence #[]
+
+/-- No unconsumed credit remains in this frame. -/
+def NoLiveCredits (frame : Frame) : Prop :=
+  frame.credits.any Option.isSome = false
+
+/-- Public equation for the ownership- and identity-checked constructor view
+used by destructive operations. -/
+def ConstructorView (store : Store) (location : Nat) (world : Owned)
+    (cid : CtorId) (box : NodeBox) (fields : Array RVal) : Prop :=
+  requireCtor store location world cid = .ok (box, fields)
+
+/-- Constructor inspection is extensional in the selected heap lookup. -/
+theorem ConstructorView.congrStore {left right : Store} {location : Nat}
+    {world : Owned} {cid : CtorId} {box : NodeBox}
+    {fields : Array RVal}
+    (same : left.get? location = right.get? location)
+    (viewed : ConstructorView left location world cid box fields) :
+    ConstructorView right location world cid box fields := by
+  unfold ConstructorView requireCtor at viewed ⊢
+  rw [← same]
+  exact viewed
+
+/-- A successful checked constructor view exposes the exact live box,
+ownership world, and constructor payload that justified it. -/
+theorem ConstructorView.parts {store : Store} {location : Nat}
+    {world : Owned} {cid : CtorId} {box : NodeBox}
+    {fields : Array RVal}
+    (viewed : ConstructorView store location world cid box fields) :
+    store.get? location = some box ∧
+      box.world = world ∧ box.node = .ctorN cid fields := by
+  unfold ConstructorView requireCtor at viewed
+  cases boxAt : store.get? location with
+  | none =>
+      simp [boxAt, bind, Except.bind] at viewed
+  | some foundBox =>
+      simp only [boxAt, bind, Except.bind, pure, Except.pure] at viewed
+      by_cases worldEq : foundBox.world = world
+      · simp [worldEq] at viewed
+        cases node : foundBox.node with
+        | papN address arity arguments => simp [node] at viewed
+        | ctorN actual actualFields =>
+            simp only [node] at viewed
+            by_cases cidEq : actual = cid
+            · subst actual
+              simp at viewed
+              obtain ⟨rfl, rfl⟩ := viewed
+              exact ⟨rfl, worldEq, node⟩
+            · simp [cidEq] at viewed
+      · simp [worldEq] at viewed
+
+theorem CreditLookup.of_getElem {frame : Frame} {id : CreditId}
+    {credit : Credit}
+    (found : frame.credits[id]? = some (some credit)) :
+    CreditLookup frame id credit := by
+  unfold CreditLookup creditAt
+  rw [found]
+
+theorem CreditTake.of_lookup {frame : Frame} {id : CreditId}
+    {credit : Credit} (found : CreditLookup frame id credit) :
+    CreditTake frame id
+      { frame with credits := frame.credits.setIfInBounds id none }
+      credit := by
+  unfold CreditTake takeCredit
+  unfold CreditLookup at found
+  rw [found]
+  rfl
+
+theorem CreditTakeMany.single {frame target : Frame} {id : CreditId}
+    {credit : Credit} (taken : CreditTake frame id target credit) :
+    CreditTakeMany frame #[id] target #[credit] := by
+  unfold CreditTakeMany takeCredits
+  unfold CreditTake at taken
+  simp [taken]
+  rfl
+
+theorem ConstructorView.of_box {store : Store} {location : Nat}
+    {world : Owned} {cid : CtorId} {box : NodeBox}
+    {fields : Array RVal}
+    (boxAt : store.get? location = some box)
+    (boxWorld : box.world = world)
+    (node : box.node = .ctorN cid fields) :
+    ConstructorView store location world cid box fields := by
+  unfold ConstructorView requireCtor
+  rw [boxAt]
+  simp [boxWorld, node]
+  rfl
+
+theorem RetainSharedMany.empty (store : Store) :
+    RetainSharedMany store #[] store := by
+  rfl
+
+theorem RetainSharedMany.cons {store middle target : Store}
+    {value : RVal} {values : List RVal}
+    (head : retainShared store value = .ok middle)
+    (tail : RetainSharedMany middle values.toArray target) :
+    RetainSharedMany store (value :: values).toArray target := by
+  unfold RetainSharedMany retainSharedMany at tail ⊢
+  rw [← Array.foldlM_toList] at tail ⊢
+  change List.foldlM retainShared middle values = .ok target at tail
+  change (do
+    let next ← retainShared store value
+    List.foldlM retainShared next values) = .ok target
+  rw [head]
+  exact tail
+
+/-- Invert a successful nonempty batch retain into its first retain and the
+remaining batch.  This is the elimination counterpart of
+`RetainSharedMany.cons`; clients can reason inductively without unfolding the
+private executable fold. -/
+theorem RetainSharedMany.cons_inv {store target : Store}
+    {value : RVal} {values : List RVal}
+    (run : RetainSharedMany store (value :: values).toArray target) :
+    ∃ middle,
+      retainShared store value = .ok middle ∧
+      RetainSharedMany middle values.toArray target := by
+  unfold RetainSharedMany retainSharedMany at run
+  rw [← Array.foldlM_toList] at run
+  change (do
+    let middle ← retainShared store value
+    List.foldlM retainShared middle values) = .ok target at run
+  cases head : retainShared store value with
+  | error error =>
+      rw [head] at run
+      contradiction
+  | ok middle =>
+      refine ⟨middle, rfl, ?_⟩
+      unfold RetainSharedMany retainSharedMany
+      rw [← Array.foldlM_toList]
+      simpa only [head, bind, Except.bind] using run
+
+/-- Applying an erased function releases the supplied shared arguments and
+resumes the caller immediately with the erased value. -/
+theorem ApplyTransfer.erased {context : Context}
+    {interpretation : Interpretation} {store outStore : Store}
+    {heapFuel outHeapFuel : Nat} {arguments : Array RVal}
+    {resume : Frame} {stack : List Continuation}
+    (released : releaseSharedWork heapFuel store arguments.toList =
+      .ok (outStore, outHeapFuel)) :
+    ApplyTransfer context interpretation store heapFuel .erased arguments
+      resume stack
+      { store := outStore
+        heapFuel := outHeapFuel
+        control := .running
+          { resume with values := resume.values.push .erased } stack } := by
+  unfold ApplyTransfer beginApply resumeImmediate Frame.pushValue
+  rw [released]
+  rfl
+
+/-- Opening an under-saturated PAP retains its captured arguments, consumes
+the old PAP owner, allocates the longer PAP, and resumes the caller in the
+same control step. -/
+theorem ApplyTransfer.papUnder {context : Context}
+    {interpretation : Interpretation} {store retainedStore releasedStore : Store}
+    {heapFuel outHeapFuel : Nat} {location : Nat} {box : NodeBox}
+    {address : Address} {arity : Nat} {captured arguments : Array RVal}
+    {resume : Frame} {stack : List Continuation}
+    (boxAt : store.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : RetainSharedMany store captured retainedStore)
+    (released : releaseSharedWork heapFuel retainedStore [.loc location] =
+      .ok (releasedStore, outHeapFuel))
+    (totalUnder : (captured ++ arguments).size < arity) :
+    let allocation := releasedStore.allocNode .shared
+      (.papN address arity (captured ++ arguments))
+    ApplyTransfer context interpretation store heapFuel (.loc location)
+      arguments resume stack
+      { store := allocation.1
+        heapFuel := outHeapFuel
+        control := .running
+          { resume with values := resume.values.push (.loc allocation.2) }
+          stack } := by
+  dsimp only
+  unfold RetainSharedMany at retained
+  unfold ApplyTransfer beginApply
+  simp only
+  rw [boxAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [shared]
+  rw [if_neg (by decide)]
+  rw [node]
+  simp only
+  rw [if_neg (by omega)]
+  rw [retained]
+  simp only
+  rw [released]
+  simp only
+  rw [if_pos totalUnder]
+  rfl
+
+/-- Opening a saturated or over-saturated PAP enters its checked function
+target.  Remaining arguments are represented by the evaluator's explicit
+`applyMore` continuation; exact saturation uses an ordinary resume. -/
+theorem ApplyTransfer.papFn {context : Context}
+    {interpretation : Interpretation} {store retainedStore releasedStore : Store}
+    {heapFuel outHeapFuel : Nat} {location : Nat} {box : NodeBox}
+    {address : Address} {arity : Nat} {captured arguments : Array RVal}
+    {definition : Function} {resume : Frame} {stack : List Continuation}
+    (boxAt : store.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : RetainSharedMany store captured retainedStore)
+    (released : releaseSharedWork heapFuel retainedStore [.loc location] =
+      .ok (releasedStore, outHeapFuel))
+    (totalEnough : arity ≤ (captured ++ arguments).size)
+    (declaration : context.declarations address = some (.fn definition))
+    (papSafe : definition.signature.papSafe = true)
+    (suppliedArity :
+      ((captured ++ arguments).extract 0 arity).size =
+        definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let total := captured ++ arguments
+    let supplied := total.extract 0 arity
+    let remaining := total.extract arity total.size
+    let callee : Frame := { definition, values := supplied }
+    let continuation : Continuation :=
+      if remaining.isEmpty then .resume resume
+      else .applyMore remaining resume
+    ApplyTransfer context interpretation store heapFuel (.loc location)
+      arguments resume stack
+      { store := releasedStore
+        heapFuel := outHeapFuel
+        control := .running callee (continuation :: stack) } := by
+  dsimp only
+  unfold RetainSharedMany at retained
+  unfold ApplyTransfer beginApply
+  simp only
+  rw [boxAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [shared]
+  rw [if_neg (by decide)]
+  rw [node]
+  simp only
+  rw [if_neg (by omega)]
+  rw [retained]
+  simp only
+  rw [released]
+  simp only
+  rw [if_neg (Nat.not_lt.mpr totalEnough)]
+  rw [declaration]
+  simp only
+  simp only [declarationPapSafe, papSafe, Bool.not_true, Bool.false_eq_true,
+    ↓reduceIte]
+  have arityGuard : ¬
+      ((((captured ++ arguments).extract 0 arity).size !=
+        definition.signature.params.size) = true) := by
+    intro unequal
+    exact (bne_iff_ne.mp unequal) suppliedArity
+  have blockGuard : ¬ (definition.blocks.isEmpty = true) := by
+    simp [nonempty]
+  unfold enterFunction
+  rw [if_neg arityGuard, if_neg blockGuard]
+
+/-- A PAP may also target a scalar extern declaration.  Successful extern
+application is necessarily exactly saturated because a scalar result cannot
+be fed through `applyMore`; it resumes the suspended frame immediately. -/
+theorem ApplyTransfer.papExtern {context : Context}
+    {interpretation : Interpretation} {store retainedStore releasedStore : Store}
+    {heapFuel outHeapFuel : Nat} {location : Nat} {box : NodeBox}
+    {address : Address} {arity expectedArity : Nat}
+    {captured arguments : Array RVal} {value : RVal}
+    {resume : Frame} {stack : List Continuation}
+    (boxAt : store.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : RetainSharedMany store captured retainedStore)
+    (released : releaseSharedWork heapFuel retainedStore [.loc location] =
+      .ok (releasedStore, outHeapFuel))
+    (totalEnough : arity ≤ (captured ++ arguments).size)
+    (declaration : context.declarations address =
+      some (.extern expectedArity))
+    (suppliedArity :
+      ((captured ++ arguments).extract 0 arity).size = expectedArity)
+    (remainingEmpty :
+      ((captured ++ arguments).extract arity
+        (captured ++ arguments).size).isEmpty = true)
+    (called : ScalarOracleCall context address
+      ((captured ++ arguments).extract 0 arity) value) :
+    ApplyTransfer context interpretation store heapFuel (.loc location)
+      arguments resume stack
+      { store := releasedStore
+        heapFuel := outHeapFuel
+        control := .running
+          { resume with values := resume.values.push value } stack } := by
+  unfold RetainSharedMany at retained
+  unfold ApplyTransfer beginApply resumeImmediate Frame.pushValue
+  simp only
+  rw [boxAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [shared]
+  rw [if_neg (by decide)]
+  rw [node]
+  simp only
+  rw [if_neg (by omega)]
+  rw [retained]
+  simp only
+  rw [released]
+  simp only
+  rw [if_neg (Nat.not_lt.mpr totalEnough)]
+  rw [declaration]
+  simp only [declarationPapSafe, Bool.not_true, Bool.false_eq_true,
+    ↓reduceIte]
+  have arityGuard : ¬
+      ((((captured ++ arguments).extract 0 arity).size != expectedArity) =
+        true) := by
+    intro unequal
+    exact (bne_iff_ne.mp unequal) suppliedArity
+  rw [if_neg arityGuard]
+  rw [remainingEmpty]
+  simp only [Bool.not_true, Bool.false_eq_true, ↓reduceIte]
+  unfold ScalarOracleCall at called
+  rw [called]
+
+/-- Exhaustive successful shapes of the dynamic-application worker.  This
+indexed relation records the runtime evidence hidden by `beginApply` while
+fixing its exact output machine, so clients can eliminate an arbitrary
+`ApplyTransfer` without unfolding the private dispatcher. -/
+inductive ApplyTransferCase (context : Context)
+    (interpretation : Interpretation) (store : Store) (heapFuel : Nat)
+    (arguments : Array RVal) (resume : Frame) (stack : List Continuation) :
+    RVal → Machine → Prop where
+  | erased {outStore : Store} {outHeapFuel : Nat}
+      (released : releaseSharedWork heapFuel store arguments.toList =
+        .ok (outStore, outHeapFuel)) :
+      ApplyTransferCase context interpretation store heapFuel arguments
+        resume stack .erased
+        { store := outStore
+          heapFuel := outHeapFuel
+          control := .running
+            { resume with values := resume.values.push .erased } stack }
+  | papUnder {location : Nat} {box : NodeBox} {address : Address}
+      {arity : Nat} {captured : Array RVal}
+      {retainedStore releasedStore : Store} {outHeapFuel : Nat}
+      (boxAt : store.get? location = some box)
+      (shared : box.world = .shared)
+      (node : box.node = .papN address arity captured)
+      (capturedUnder : captured.size < arity)
+      (retained : RetainSharedMany store captured retainedStore)
+      (released : releaseSharedWork heapFuel retainedStore [.loc location] =
+        .ok (releasedStore, outHeapFuel))
+      (totalUnder : (captured ++ arguments).size < arity) :
+      ApplyTransferCase context interpretation store heapFuel arguments
+        resume stack (.loc location)
+        (let allocation := releasedStore.allocNode .shared
+          (.papN address arity (captured ++ arguments))
+        { store := allocation.1
+          heapFuel := outHeapFuel
+          control := .running
+            { resume with
+              values := resume.values.push (.loc allocation.2) } stack })
+  | papFn {location : Nat} {box : NodeBox} {address : Address}
+      {arity : Nat} {captured : Array RVal}
+      {retainedStore releasedStore : Store} {outHeapFuel : Nat}
+      {definition : Function}
+      (boxAt : store.get? location = some box)
+      (shared : box.world = .shared)
+      (node : box.node = .papN address arity captured)
+      (capturedUnder : captured.size < arity)
+      (retained : RetainSharedMany store captured retainedStore)
+      (released : releaseSharedWork heapFuel retainedStore [.loc location] =
+        .ok (releasedStore, outHeapFuel))
+      (totalEnough : arity ≤ (captured ++ arguments).size)
+      (declaration : context.declarations address = some (.fn definition))
+      (papSafe : definition.signature.papSafe = true)
+      (suppliedArity :
+        ((captured ++ arguments).extract 0 arity).size =
+          definition.signature.params.size)
+      (nonempty : definition.blocks.isEmpty = false) :
+      ApplyTransferCase context interpretation store heapFuel arguments
+        resume stack (.loc location)
+        (let total := captured ++ arguments
+        let supplied := total.extract 0 arity
+        let remaining := total.extract arity total.size
+        let callee : Frame := { definition, values := supplied }
+        let continuation : Continuation :=
+          if remaining.isEmpty then .resume resume
+          else .applyMore remaining resume
+        { store := releasedStore
+          heapFuel := outHeapFuel
+          control := .running callee (continuation :: stack) })
+  | papExtern {location : Nat} {box : NodeBox} {address : Address}
+      {arity expectedArity : Nat} {captured : Array RVal}
+      {retainedStore releasedStore : Store} {outHeapFuel : Nat}
+      {value : RVal}
+      (boxAt : store.get? location = some box)
+      (shared : box.world = .shared)
+      (node : box.node = .papN address arity captured)
+      (capturedUnder : captured.size < arity)
+      (retained : RetainSharedMany store captured retainedStore)
+      (released : releaseSharedWork heapFuel retainedStore [.loc location] =
+        .ok (releasedStore, outHeapFuel))
+      (totalEnough : arity ≤ (captured ++ arguments).size)
+      (declaration : context.declarations address =
+        some (.extern expectedArity))
+      (suppliedArity :
+        ((captured ++ arguments).extract 0 arity).size = expectedArity)
+      (remainingEmpty :
+        ((captured ++ arguments).extract arity
+          (captured ++ arguments).size).isEmpty = true)
+      (called : ScalarOracleCall context address
+        ((captured ++ arguments).extract 0 arity) value) :
+      ApplyTransferCase context interpretation store heapFuel arguments
+        resume stack (.loc location)
+        { store := releasedStore
+          heapFuel := outHeapFuel
+          control := .running
+            { resume with values := resume.values.push value } stack }
+
+/-- Every explicit successful application shape reconstructs the public
+transfer equation. -/
+theorem ApplyTransferCase.transfer {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {function : RVal} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) :
+    ApplyTransfer context interpretation store heapFuel function arguments
+      resume stack target := by
+  cases classified with
+  | erased released => exact ApplyTransfer.erased released
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      exact ApplyTransfer.papUnder boxAt shared node capturedUnder retained
+        released totalUnder
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      exact ApplyTransfer.papFn boxAt shared node capturedUnder retained
+        released totalEnough declaration papSafe suppliedArity nonempty
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      exact ApplyTransfer.papExtern boxAt shared node capturedUnder retained
+        released totalEnough declaration suppliedArity remainingEmpty called
+
+/-- Invert an arbitrary successful dynamic dispatch into exactly one of the
+four public runtime shapes. -/
+theorem ApplyTransfer.classify {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {function : RVal} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel
+      function arguments resume stack target) :
+    ApplyTransferCase context interpretation store heapFuel arguments
+      resume stack function target := by
+  unfold ApplyTransfer beginApply at transferred
+  simp only [bind, Except.bind, pure, Except.pure] at transferred
+  cases function with
+  | lit literal =>
+      simp at transferred
+  | erased =>
+      cases released : releaseSharedWork heapFuel store arguments.toList with
+      | error error =>
+          simp [released] at transferred
+      | ok output =>
+          obtain ⟨outStore, outHeapFuel⟩ := output
+          simp [released, resumeImmediate, Frame.pushValue] at transferred
+          subst target
+          exact .erased released
+  | loc location =>
+      cases boxAt : store.get? location with
+      | none =>
+          simp [boxAt] at transferred
+      | some box =>
+          cases box with
+          | mk world rc node =>
+              cases world with
+              | unique =>
+                  simp [boxAt] at transferred
+              | shared =>
+                  cases node with
+                  | ctorN cid fields =>
+                      simp [boxAt] at transferred
+                  | papN address arity captured =>
+                      have sharedEq :
+                          (Owned.shared != Owned.shared) = false := by decide
+                      simp only [boxAt, sharedEq, Bool.false_eq_true, if_false]
+                        at transferred
+                      by_cases capturedUnder : captured.size < arity
+                      · have capturedNotEnough : ¬arity ≤ captured.size :=
+                          Nat.not_le_of_gt capturedUnder
+                        simp only [capturedNotEnough, ↓reduceIte]
+                          at transferred
+                        cases retainedRun : retainSharedMany store captured with
+                        | error error =>
+                            simp only [retainedRun] at transferred
+                            cases transferred
+                        | ok retainedStore =>
+                            simp only [retainedRun] at transferred
+                            cases releasedRun : releaseSharedWork heapFuel
+                                retainedStore [.loc location] with
+                            | error error =>
+                                simp only [releasedRun] at transferred
+                                cases transferred
+                            | ok output =>
+                                simp only [releasedRun] at transferred
+                                obtain ⟨releasedStore, outHeapFuel⟩ := output
+                                by_cases totalUnder :
+                                    (captured ++ arguments).size < arity
+                                · simp only [if_pos totalUnder] at transferred
+                                  injection transferred with targetEq
+                                  subst target
+                                  exact .papUnder boxAt rfl rfl capturedUnder
+                                    retainedRun releasedRun totalUnder
+                                · have totalEnough :
+                                      arity ≤ (captured ++ arguments).size :=
+                                    Nat.le_of_not_gt totalUnder
+                                  simp only [if_neg totalUnder] at transferred
+                                  cases declarationAt :
+                                      context.declarations address with
+                                  | none =>
+                                      simp only [declarationAt] at transferred
+                                      cases transferred
+                                  | some declaration =>
+                                      simp only [declarationAt] at transferred
+                                      cases declaration with
+                                      | fn definition =>
+                                          cases papSafe :
+                                              definition.signature.papSafe with
+                                          | false =>
+                                              simp only [declarationPapSafe,
+                                                papSafe, Bool.not_false,
+                                                if_true]
+                                                at transferred
+                                              cases transferred
+                                          | true =>
+                                              simp only [declarationPapSafe,
+                                                papSafe, Bool.not_true,
+                                                Bool.false_eq_true, if_false]
+                                                at transferred
+                                              by_cases suppliedArity :
+                                                  ((captured ++ arguments).extract
+                                                    0 arity).size =
+                                                  definition.signature.params.size
+                                              · have arityMatch :
+                                                    (((captured ++ arguments).extract
+                                                      0 arity).size !=
+                                                      definition.signature.params.size) =
+                                                    false := by
+                                                  exact Bool.eq_false_iff.mpr
+                                                    (fun mismatch =>
+                                                      (bne_iff_ne.mp mismatch)
+                                                        suppliedArity)
+                                                cases blockEmpty :
+                                                    definition.blocks.isEmpty with
+                                                | true =>
+                                                    simp only [enterFunction,
+                                                      arityMatch,
+                                                      Bool.false_eq_true,
+                                                      if_false, blockEmpty,
+                                                      if_true]
+                                                      at transferred
+                                                    cases transferred
+                                                | false =>
+                                                    simp only [enterFunction,
+                                                      arityMatch,
+                                                      Bool.false_eq_true,
+                                                      if_false, blockEmpty]
+                                                      at transferred
+                                                    injection transferred with
+                                                      targetEq
+                                                    subst target
+                                                    exact .papFn boxAt rfl rfl
+                                                      capturedUnder retainedRun
+                                                      releasedRun totalEnough
+                                                      declarationAt papSafe
+                                                      suppliedArity blockEmpty
+                                              · have arityMismatch :
+                                                    (((captured ++ arguments).extract
+                                                      0 arity).size !=
+                                                      definition.signature.params.size) =
+                                                    true := by
+                                                  exact bne_iff_ne.mpr
+                                                    suppliedArity
+                                                simp only [enterFunction,
+                                                  arityMismatch, if_true]
+                                                  at transferred
+                                                cases transferred
+                                      | extern expectedArity =>
+                                          simp only [declarationPapSafe,
+                                            Bool.not_true,
+                                            Bool.false_eq_true, ↓reduceIte]
+                                            at transferred
+                                          by_cases suppliedArity :
+                                              ((captured ++ arguments).extract
+                                                0 arity).size = expectedArity
+                                          · have arityMatch :
+                                                (((captured ++ arguments).extract
+                                                  0 arity).size !=
+                                                  expectedArity) = false := by
+                                              exact Bool.eq_false_iff.mpr
+                                                (fun mismatch =>
+                                                  (bne_iff_ne.mp mismatch)
+                                                    suppliedArity)
+                                            simp only [arityMatch,
+                                              Bool.false_eq_true, if_false]
+                                              at transferred
+                                            cases remainingEmpty :
+                                                ((captured ++ arguments).extract
+                                                  arity
+                                                  (captured ++ arguments).size).isEmpty
+                                              with
+                                            | false =>
+                                                simp only [remainingEmpty,
+                                                  Bool.not_false, if_true]
+                                                  at transferred
+                                                cases transferred
+                                            | true =>
+                                                simp only [remainingEmpty,
+                                                  Bool.not_true,
+                                                  Bool.false_eq_true, if_false]
+                                                  at transferred
+                                                cases called : callScalarOracle
+                                                    context address
+                                                    ((captured ++ arguments).extract
+                                                      0 arity) with
+                                                | error error =>
+                                                    simp only [called]
+                                                      at transferred
+                                                    cases transferred
+                                                | ok value =>
+                                                    simp only [called]
+                                                      at transferred
+                                                    injection transferred with
+                                                      targetEq
+                                                    subst target
+                                                    exact .papExtern boxAt rfl rfl
+                                                      capturedUnder retainedRun
+                                                      releasedRun totalEnough
+                                                      declarationAt suppliedArity
+                                                      remainingEmpty called
+                                          · have arityMismatch :
+                                                (((captured ++ arguments).extract
+                                                  0 arity).size !=
+                                                  expectedArity) = true := by
+                                              exact bne_iff_ne.mpr
+                                                suppliedArity
+                                            simp only [arityMismatch, if_true]
+                                              at transferred
+                                            cases transferred
+                      · have capturedEnough : arity ≤ captured.size :=
+                          Nat.le_of_not_gt capturedUnder
+                        simp only [capturedEnough, ↓reduceIte] at transferred
+                        cases transferred
+
+/-- General checked edge transfer from public value-resolution and linear
+credit premises.  This is the proof seam used by optional-credit branches. -/
+theorem EdgeTransfer.of_parts {frame after : Frame} {edge : Edge}
+    {implicitValues values : Array RVal} {credits : Array Credit}
+    {block : Block}
+    (resolved : resolveAtoms frame.values edge.values = .ok values)
+    (taken : CreditTakeMany frame edge.credits after credits)
+    (cleared : NoLiveCredits after)
+    (blockAt : after.definition.blocks[edge.target]? = some block)
+    (valueArity : (implicitValues ++ values).size = block.valueParams.size)
+    (creditArity : credits.size = block.creditParams.size) :
+    EdgeTransfer frame edge implicitValues
+      { after with
+        block := edge.target
+        pc := 0
+        values := implicitValues ++ values
+        credits := credits.map some } := by
+  unfold EdgeTransfer transferEdge
+  rw [resolved]
+  simp only [bind, Except.bind]
+  unfold CreditTakeMany at taken
+  rw [taken]
+  simp only
+  have noLive : after.hasCredits = false := by
+    unfold Frame.hasCredits
+    exact cleared
+  rw [noLive]
+  simp only [Bool.false_eq_true, ↓reduceIte]
+  rw [blockAt]
+  simp [pure, Except.pure, valueArity, creditArity]
+
+/-- Invert a successful edge transfer into its value resolution, linear
+credit consumption, target lookup, ABI checks, and exact successor frame. -/
+theorem EdgeTransfer.parts {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal}
+    (transferred : EdgeTransfer frame edge implicitValues target) :
+    ∃ values credits after block,
+      resolveAtoms frame.values edge.values = .ok values ∧
+        CreditTakeMany frame edge.credits after credits ∧
+        NoLiveCredits after ∧
+        after.definition.blocks[edge.target]? = some block ∧
+        (implicitValues ++ values).size = block.valueParams.size ∧
+        credits.size = block.creditParams.size ∧
+        target = { after with
+          block := edge.target
+          pc := 0
+          values := implicitValues ++ values
+          credits := credits.map some } := by
+  unfold EdgeTransfer transferEdge at transferred
+  cases resolved : resolveAtoms frame.values edge.values with
+  | error error =>
+      rw [resolved] at transferred
+      contradiction
+  | ok values =>
+      rw [resolved] at transferred
+      simp only [bind, Except.bind] at transferred
+      cases taken : takeCredits frame edge.credits with
+      | error error =>
+          rw [taken] at transferred
+          contradiction
+      | ok output =>
+          obtain ⟨after, credits⟩ := output
+          rw [taken] at transferred
+          simp only at transferred
+          cases live : after.hasCredits with
+          | true =>
+              rw [live] at transferred
+              simp at transferred
+          | false =>
+              rw [live] at transferred
+              simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+              cases blockAt : after.definition.blocks[edge.target]? with
+              | none =>
+                  rw [blockAt] at transferred
+                  contradiction
+              | some block =>
+                  rw [blockAt] at transferred
+                  simp only [pure, Except.pure] at transferred
+                  cases valueMismatch :
+                      ((implicitValues ++ values).size !=
+                        block.valueParams.size) with
+                  | true =>
+                      rw [valueMismatch] at transferred
+                      simp at transferred
+                  | false =>
+                      rw [valueMismatch] at transferred
+                      simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+                      cases creditMismatch :
+                          (credits.size != block.creditParams.size) with
+                      | true =>
+                          rw [creditMismatch] at transferred
+                          simp at transferred
+                      | false =>
+                          rw [creditMismatch] at transferred
+                          simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+                          have valueArity : (implicitValues ++ values).size =
+                              block.valueParams.size := by
+                            simpa using valueMismatch
+                          have creditArity : credits.size =
+                              block.creditParams.size := by
+                            simpa using creditMismatch
+                          have targetEq := Except.ok.inj transferred
+                          refine ⟨values, credits, after, block, rfl, ?_, ?_,
+                            ?_, valueArity, creditArity, targetEq.symm⟩
+                          · exact taken
+                          · unfold NoLiveCredits
+                            exact live
+                          · exact blockAt
+
+/-- Baseline lowering carries no credits. Resolving its explicit edge values,
+finding the target block, and matching the two target arities therefore
+determines the exact successor frame. -/
+theorem EdgeTransfer.baseline {frame : Frame} {edge : Edge}
+    {implicitValues values : Array RVal} {block : Block}
+    (resolved : resolveAtoms frame.values edge.values = .ok values)
+    (frameCredits : frame.credits = #[])
+    (edgeCredits : edge.credits = #[])
+    (blockAt : frame.definition.blocks[edge.target]? = some block)
+    (valueArity : (implicitValues ++ values).size = block.valueParams.size)
+    (blockCredits : block.creditParams = #[]) :
+    EdgeTransfer frame edge implicitValues
+      { frame with
+        block := edge.target
+        pc := 0
+        values := implicitValues ++ values
+        credits := #[] } := by
+  have noLive : frame.hasCredits = false := by
+    simp [Frame.hasCredits, frameCredits]
+  have taken : takeCredits frame edge.credits = .ok (frame, #[]) := by
+    rw [edgeCredits]
+    rfl
+  unfold EdgeTransfer transferEdge
+  rw [resolved]
+  simp only [bind, Except.bind]
+  rw [taken]
+  simp only
+  rw [noLive]
+  simp only [Bool.false_eq_true, ↓reduceIte]
+  rw [blockAt]
+  simp [pure, Except.pure, valueArity, blockCredits]
+
+/-- A successful edge transfer is insensitive to replacing the enclosing
+function definition when the selected target block keeps the same incoming
+value and credit ABI.  The resulting frame changes only its definition. -/
+theorem EdgeTransfer.congrDefinition {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal} {definition : Function}
+    {sourceBlock rewrittenBlock : Block}
+    (sourceAt : frame.definition.blocks[edge.target]? = some sourceBlock)
+    (rewrittenAt : definition.blocks[edge.target]? = some rewrittenBlock)
+    (valueParams : rewrittenBlock.valueParams = sourceBlock.valueParams)
+    (creditParams : rewrittenBlock.creditParams = sourceBlock.creditParams)
+    (transferred : EdgeTransfer frame edge implicitValues target) :
+    EdgeTransfer { frame with definition } edge implicitValues
+      { target with definition } := by
+  unfold EdgeTransfer transferEdge at transferred ⊢
+  cases resolved : resolveAtoms frame.values edge.values with
+  | error error =>
+      rw [resolved] at transferred
+      contradiction
+  | ok values =>
+      rw [resolved] at transferred
+      simp only [bind, Except.bind] at transferred ⊢
+      cases taken : takeCredits frame edge.credits with
+      | error error =>
+          rw [taken] at transferred
+          contradiction
+      | ok output =>
+          obtain ⟨after, credits⟩ := output
+          rw [taken] at transferred
+          simp only at transferred
+          have afterDefinition : after.definition = frame.definition :=
+            CreditTakeMany.definition taken
+          have rewrittenTaken :=
+            takeCredits_changeDefinition frame edge.credits definition
+          rw [taken] at rewrittenTaken
+          simp only [Except.map] at rewrittenTaken
+          rw [rewrittenTaken]
+          simp only
+          have rewrittenLive :
+              ({ after with definition }).hasCredits = after.hasCredits := rfl
+          cases live : after.hasCredits with
+          | true =>
+              rw [live] at transferred
+              simp only [↓reduceIte] at transferred
+              simp at transferred
+          | false =>
+              rw [live] at transferred
+              simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+              rw [rewrittenLive, live]
+              simp only [Bool.false_eq_true, ↓reduceIte]
+              rw [afterDefinition, sourceAt] at transferred
+              simp only [pure, Except.pure] at transferred
+              rw [rewrittenAt]
+              simp only [pure, Except.pure]
+              cases valueArity :
+                  ((implicitValues ++ values).size !=
+                    sourceBlock.valueParams.size) with
+              | true =>
+                  rw [valueArity] at transferred
+                  simp only [↓reduceIte] at transferred
+                  simp at transferred
+              | false =>
+                  rw [valueArity] at transferred
+                  simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+                  rw [valueParams, valueArity]
+                  simp only [Bool.false_eq_true, ↓reduceIte]
+                  cases creditArity :
+                      (credits.size != sourceBlock.creditParams.size) with
+                  | true =>
+                      rw [creditArity] at transferred
+                      simp only [↓reduceIte] at transferred
+                      simp at transferred
+                  | false =>
+                      rw [creditArity] at transferred
+                      simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+                      rw [creditParams, creditArity]
+                      simp only [Bool.false_eq_true, ↓reduceIte]
+                      cases transferred
+                      rfl
+
+/-- Every successful transfer selected a concrete block at its edge target. -/
+theorem EdgeTransfer.targetBlock {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal}
+    (transferred : EdgeTransfer frame edge implicitValues target) :
+    ∃ block, frame.definition.blocks[edge.target]? = some block := by
+  unfold EdgeTransfer transferEdge at transferred
+  cases resolved : resolveAtoms frame.values edge.values with
+  | error error =>
+      rw [resolved] at transferred
+      contradiction
+  | ok values =>
+      rw [resolved] at transferred
+      simp only [bind, Except.bind] at transferred
+      cases taken : takeCredits frame edge.credits with
+      | error error =>
+          rw [taken] at transferred
+          contradiction
+      | ok output =>
+          obtain ⟨after, credits⟩ := output
+          rw [taken] at transferred
+          simp only at transferred
+          have afterDefinition : after.definition = frame.definition :=
+            CreditTakeMany.definition taken
+          cases live : after.hasCredits with
+          | true =>
+              rw [live] at transferred
+              simp at transferred
+          | false =>
+              rw [live] at transferred
+              simp only [Bool.false_eq_true, ↓reduceIte] at transferred
+              cases found : after.definition.blocks[edge.target]? with
+              | none =>
+                  rw [found] at transferred
+                  contradiction
+              | some block =>
+                  exact ⟨block, by simpa [afterDefinition] using found⟩
+
+/-- An edge transfer retains its enclosing function definition. -/
+theorem EdgeTransfer.definition {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal}
+    (transferred : EdgeTransfer frame edge implicitValues target) :
+    target.definition = frame.definition := by
+  obtain ⟨block, blockAt⟩ := transferred.targetBlock
+  have changed := transferred.congrDefinition
+    (definition := frame.definition) blockAt blockAt rfl rfl
+  have inputEq : { frame with definition := frame.definition } = frame := by
+    cases frame
+    rfl
+  rw [inputEq] at changed
+  unfold EdgeTransfer at transferred changed
+  have targetEq : target = { target with definition := frame.definition } :=
+    Except.ok.inj (transferred.symm.trans changed)
+  have definitions := congrArg Frame.definition targetEq
+  simpa using definitions
+
+/-- Reduction rule for the present arm of an optional-credit branch.  The
+credit is transferred by the selected edge, rather than consumed by the
+terminator itself. -/
+theorem Step.branchCreditPresent {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame target : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit} {someEdge noneEdge : Edge}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup frame creditId credit)
+    (present : credit.isPresent = true)
+    (transferred : EdgeTransfer frame someEdge #[] target) :
+    Step context interpretation machine
+      { machine with control := .running target stack } := by
+  unfold Step step currentBlock runTerminator
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp only
+  unfold CreditLookup at lookedUp
+  rw [lookedUp]
+  simp only
+  rw [present]
+  unfold EdgeTransfer at transferred
+  simp [transferred]
+
+/-- Reduction rule for the absent arm of an optional-credit branch. -/
+theorem Step.branchCreditAbsent {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame target : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit} {someEdge noneEdge : Edge}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup frame creditId credit)
+    (absent : credit.isPresent = false)
+    (transferred : EdgeTransfer frame noneEdge #[] target) :
+    Step context interpretation machine
+      { machine with control := .running target stack } := by
+  unfold Step step currentBlock runTerminator
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp only
+  unfold CreditLookup at lookedUp
+  rw [lookedUp]
+  simp only
+  rw [absent]
+  unfold EdgeTransfer at transferred
+  simp [transferred]
+
+/-- Reduction rule for an ordinary block jump. -/
+theorem Step.jump {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame target : Frame}
+    {stack : List Continuation} {block : Block} {edge : Edge}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .jump edge)
+    (transferred : EdgeTransfer frame edge #[] target) :
+    Step context interpretation machine
+      { machine with control := .running target stack } := by
+  unfold Step step currentBlock runTerminator
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  unfold EdgeTransfer at transferred
+  simp [transferred]
+
+/-- Reduction rule for constructor dispatch through an exact alternative. -/
+theorem Step.switchCtor {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame target : Frame} {stack : List Continuation} {block : Block}
+    {scrutinee : Atom} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {location : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : resolveAtom frame.values scrutinee = .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer frame alternative.edge #[] target) :
+    Step context interpretation machine
+      { machine with control := .running target stack } := by
+  unfold Step step currentBlock runTerminator
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp only
+  rw [resolved]
+  simp only
+  rw [boxAt]
+  simp only
+  rw [node]
+  simp only
+  rw [alternativeAt]
+  unfold EdgeTransfer at transferred
+  simp [transferred]
+
+/-- Reduction rule for the zero branch of a literal-Nat switch. -/
+theorem Step.switchNatZero {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame target : Frame} {stack : List Continuation} {block : Block}
+    {scrutinee : Atom} {constructors : Array CtorAlt} {peel : NatPeel}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : resolveAtom frame.values scrutinee = .ok (.lit (.nat 0)))
+    (transferred : EdgeTransfer frame peel.zero #[] target) :
+    Step context interpretation machine
+      { machine with control := .running target stack } := by
+  unfold Step step currentBlock runTerminator
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp only
+  rw [resolved]
+  unfold EdgeTransfer at transferred
+  simp [transferred]
+
+/-- Reduction rule for the successor branch of a literal-Nat switch. The
+predecessor is the branch's one implicit leading value. -/
+theorem Step.switchNatSucc {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame target : Frame} {stack : List Continuation} {block : Block}
+    {scrutinee : Atom} {constructors : Array CtorAlt} {peel : NatPeel}
+    {predecessor : Nat}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : resolveAtom frame.values scrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (transferred : EdgeTransfer frame peel.succ
+      #[.lit (.nat predecessor)] target) :
+    Step context interpretation machine
+      { machine with control := .running target stack } := by
+  unfold Step step currentBlock runTerminator
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp only
+  rw [resolved]
+  unfold EdgeTransfer at transferred
+  simp [transferred]
+
+/-- Reduction rule for returning a value to an ordinary suspended caller. -/
+theorem Step.retResume {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame caller : Frame}
+    {rest : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal}
+    (control : machine.control =
+      .running frame (.resume caller :: rest))
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (noCredits : frame.credits = #[])
+    (world : value.hasWorld machine.store
+      frame.definition.signature.result = true) :
+    Step context interpretation machine
+      { machine with
+        control := .running
+          { caller with values := caller.values.push value } rest } := by
+  unfold Step step currentBlock runTerminator finishReturn
+    Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp [resolved, Frame.hasCredits, noCredits, world]
+
+/-- Reduction rule for a direct tail call to a compiler function. -/
+theorem Step.tailCallFn {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom} {values : Array RVal}
+    {definition : Function}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments)
+    (noCredits : frame.credits = #[])
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (declaration : context.declarations address = some (.fn definition))
+    (arity : values.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition, values } stack } := by
+  unfold Step step currentBlock runTerminator ensureCallBoundary
+    Frame.hasCredits enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp [noCredits, resolved, declaration, arity, nonempty]
+
+/-- Reduction rule for a tail-recursive self call. -/
+theorem Step.tailCallSelf {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {arguments : Array Atom} {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf arguments)
+    (noCredits : frame.credits = #[])
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (arity : values.size = frame.definition.signature.params.size)
+    (nonempty : frame.definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition := frame.definition, values }
+          stack } := by
+  unfold Step step currentBlock runTerminator ensureCallBoundary
+    Frame.hasCredits enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp [noCredits, resolved, arity, nonempty]
+
+/-- Tail-recursive self call after all credit slots have been consumed.  In
+contrast to the baseline-specialized `tailCallSelf` rule above, this rule
+accepts a nonempty credit file containing only `none`; `allocWith` produces
+exactly that state after consuming a rewrite credit. -/
+theorem Step.tailCallSelfCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {arguments : Array Atom} {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf arguments)
+    (noCredits : NoLiveCredits frame)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (arity : values.size = frame.definition.signature.params.size)
+    (nonempty : frame.definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition := frame.definition, values }
+          stack } := by
+  unfold Step step currentBlock runTerminator ensureCallBoundary
+    Frame.hasCredits enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  unfold NoLiveCredits at noCredits
+  simp [noCredits, resolved, arity, nonempty]
+
+/-- Reduction rule for returning from the outermost frame. -/
+theorem Step.retHalt {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {block : Block}
+    {atom : Atom} {value : RVal}
+    (control : machine.control = .running frame [])
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (noCredits : frame.credits = #[])
+    (world : value.hasWorld machine.store
+      frame.definition.signature.result = true) :
+    Step context interpretation machine
+      { machine with control := .halted value } := by
+  unfold Step step currentBlock runTerminator finishReturn
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp [resolved, Frame.hasCredits, noCredits, world]
+
+/-- Reduction rule for the public small-step relation at a `move`
+instruction.  Simulation proofs can use this rule without depending on the
+evaluator's private instruction dispatcher. -/
+theorem Step.move {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {block : Block} {atom : Atom} {value : RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .move atom)
+    (resolved : resolveAtom frame.values atom = .ok value) :
+    Step context interpretation machine
+      { machine with
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value }
+          stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  rw [resolved]
+
+/-- Reduction rule for a checked ordinary allocation. -/
+theorem Step.alloc {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {block : Block} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema}
+    {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .alloc world cid arguments)
+    (schemaAt : context.schemas world cid = some schema)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (fields : FieldWorlds machine.store schema values) :
+    let allocation := machine.store.allocNode world (.ctorN cid values)
+    Step context interpretation machine
+      { machine with
+        store := allocation.1
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push (.loc allocation.2) }
+          stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold FieldWorlds at fields
+  rw [fields]
+
+/-- An absent credit is consumed and allocation falls back to a fresh slot in
+either interpretation. -/
+theorem Step.allocWithAbsent {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame next : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema} {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : context.schemas world cid = some schema)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (fields : FieldWorlds machine.store schema values)
+    (taken : CreditTake { frame with pc := frame.pc + 1 }
+      creditId next credit)
+    (layout : credit.layout = schema.layout)
+    (absent : credit.presence = .absent) :
+    let allocation := machine.store.allocNode world (.ctorN cid values)
+    Step context interpretation machine
+      { machine with
+        store := allocation.1
+        control := .running
+          { next with values := next.values.push (.loc allocation.2) }
+          stack } := by
+  dsimp only
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold FieldWorlds at fields
+  rw [fields]
+  simp only
+  unfold CreditTake at taken
+  rw [taken]
+  simp [layout, absent, Frame.pushValue]
+
+/-- A present logical credit records the reset opportunity but still allocates
+a fresh semantic node. -/
+theorem Step.allocWithLogical {context : Context} {machine : Machine}
+    {frame next : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema} {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : context.schemas world cid = some schema)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (fields : FieldWorlds machine.store schema values)
+    (taken : CreditTake { frame with pc := frame.pc + 1 }
+      creditId next credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present none) :
+    let allocation := machine.store.allocNode world (.ctorN cid values)
+    Step context .logical machine
+      { machine with
+        store := allocation.1
+        control := .running
+          { next with values := next.values.push (.loc allocation.2) }
+          stack } := by
+  dsimp only
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold FieldWorlds at fields
+  rw [fields]
+  simp only
+  unfold CreditTake at taken
+  rw [taken]
+  simp [layout, present, Frame.pushValue]
+
+/-- A present physical credit reuses its reserved slot after an exact layout
+check. -/
+theorem Step.allocWithPhysical {context : Context} {machine : Machine}
+    {frame next : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema} {values : Array RVal}
+    {location : Nat} {store : Store}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : context.schemas world cid = some schema)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (fields : FieldWorlds machine.store schema values)
+    (taken : CreditTake { frame with pc := frame.pc + 1 }
+      creditId next credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present (some location))
+    (reused : machine.store.reuseReservation location world
+      (.ctorN cid values) schema.fields.size = .ok store) :
+    Step context .physical machine
+      { machine with
+        store
+        control := .running
+          { next with values := next.values.push (.loc location) }
+          stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold FieldWorlds at fields
+  rw [fields]
+  simp only
+  unfold CreditTake at taken
+  rw [taken]
+  simp only
+  rw [layout]
+  have sameLayout : (schema.layout != schema.layout) = false := by
+    simp
+  rw [sameLayout]
+  simp only [Bool.false_eq_true, ↓reduceIte]
+  rw [present]
+  simp only
+  rw [reused]
+  rfl
+
+/-- Discarding an absent credit changes neither the heap nor the advanced
+frame beyond consuming the credit slot. -/
+theorem Step.discardCreditAbsent {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame next : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .discardCredit creditId)
+    (taken : CreditTake { frame with pc := frame.pc + 1 }
+      creditId next credit)
+    (absent : credit.presence = .absent) :
+    Step context interpretation machine
+      { machine with control := .running next stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold CreditTake at taken
+  rw [taken]
+  simp [absent]
+
+/-- Discarding a present logical credit needs no physical heap action. -/
+theorem Step.discardCreditLogical {context : Context} {machine : Machine}
+    {frame next : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .discardCredit creditId)
+    (taken : CreditTake { frame with pc := frame.pc + 1 }
+      creditId next credit)
+    (present : credit.presence = .present none) :
+    Step context .logical machine
+      { machine with control := .running next stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold CreditTake at taken
+  rw [taken]
+  simp [present]
+
+/-- Discarding a present physical credit releases its reserved slot. -/
+theorem Step.discardCreditPhysical {context : Context} {machine : Machine}
+    {frame next : Frame} {stack : List Continuation} {block : Block}
+    {creditId : CreditId} {credit : Credit} {location : Nat} {store : Store}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .discardCredit creditId)
+    (taken : CreditTake { frame with pc := frame.pc + 1 }
+      creditId next credit)
+    (present : credit.presence = .present (some location))
+    (released : machine.store.releaseReservation location = .ok store) :
+    Step context .physical machine
+      { machine with store, control := .running next stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold CreditTake at taken
+  rw [taken]
+  simp only
+  rw [present]
+  simp only
+  rw [released]
+
+/-- Logical unique extraction kills the constructor and yields its fields plus
+a reservation-free required credit. -/
+theorem Step.takeUniqueLogical {context : Context} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {target : Atom} {cid : CtorId} {schema : CtorSchema} {location : Nat}
+    {box : NodeBox} {fields : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .takeUnique target cid)
+    (schemaAt : context.schemas .unique cid = some schema)
+    (resolved : resolveAtom frame.values target = .ok (.loc location))
+    (viewed : ConstructorView machine.store location .unique cid box fields)
+    (unitRC : box.rc = 1) :
+    Step context .logical machine
+      { machine with
+        store := machine.store.kill location
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values ++ fields
+            credits := frame.credits.push (some
+              { layout := schema.layout, presence := .present none }) }
+          stack } := by
+  unfold Step step currentBlock runInstruction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold ConstructorView at viewed
+  rw [viewed]
+  simp [unitRC, Credit.presentFor, Frame.advance, Frame.pushValues,
+    Frame.pushCredit]
+
+/-- Physical unique extraction reserves the constructor slot and records its
+location in the required credit. -/
+theorem Step.takeUniquePhysical {context : Context} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {target : Atom} {cid : CtorId} {schema : CtorSchema} {location : Nat}
+    {box : NodeBox} {fields : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .takeUnique target cid)
+    (schemaAt : context.schemas .unique cid = some schema)
+    (resolved : resolveAtom frame.values target = .ok (.loc location))
+    (viewed : ConstructorView machine.store location .unique cid box fields)
+    (unitRC : box.rc = 1) :
+    Step context .physical machine
+      { machine with
+        store := machine.store.reserve location
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values ++ fields
+            credits := frame.credits.push (some
+              { layout := schema.layout,
+                presence := .present (some location) }) }
+          stack } := by
+  unfold Step step currentBlock runInstruction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold ConstructorView at viewed
+  rw [viewed]
+  simp [unitRC, Credit.presentFor, Frame.advance, Frame.pushValues,
+    Frame.pushCredit]
+
+/-- A unit-refcount logical shared reset takes the hot path, kills the source
+node, and exposes a reservation-free present credit. -/
+theorem Step.resetSharedLogicalHot {context : Context} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {target : Atom} {cid : CtorId} {schema : CtorSchema} {location : Nat}
+    {box : NodeBox} {fields : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .resetShared target cid)
+    (schemaAt : context.schemas .shared cid = some schema)
+    (resolved : resolveAtom frame.values target = .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared cid box fields)
+    (unitRC : box.rc = 1) :
+    Step context .logical machine
+      { machine with
+        store := ((machine.store.tickResetAttempt).kill location).tickHotReset
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values ++ fields
+            credits := frame.credits.push (some
+              { layout := schema.layout, presence := .present none }) }
+          stack } := by
+  unfold Step step currentBlock runInstruction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold ConstructorView at viewed
+  rw [viewed]
+  simp [unitRC, Credit.presentFor, Frame.advance, Frame.pushValues,
+    Frame.pushCredit]
+
+/-- A unit-refcount physical shared reset reserves the source slot and exposes
+its location in a present credit. -/
+theorem Step.resetSharedPhysicalHot {context : Context} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {target : Atom} {cid : CtorId} {schema : CtorSchema} {location : Nat}
+    {box : NodeBox} {fields : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .resetShared target cid)
+    (schemaAt : context.schemas .shared cid = some schema)
+    (resolved : resolveAtom frame.values target = .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared cid box fields)
+    (unitRC : box.rc = 1) :
+    Step context .physical machine
+      { machine with
+        store :=
+          ((machine.store.tickResetAttempt).reserve location).tickHotReset
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values ++ fields
+            credits := frame.credits.push (some
+              { layout := schema.layout,
+                presence := .present (some location) }) }
+          stack } := by
+  unfold Step step currentBlock runInstruction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold ConstructorView at viewed
+  rw [viewed]
+  simp [unitRC, Credit.presentFor, Frame.advance, Frame.pushValues,
+    Frame.pushCredit]
+
+/-- A multiply referenced shared reset takes the common cold path in either
+interpretation: decrement the parent, retain its projected fields, and emit
+an absent optional credit. -/
+theorem Step.resetSharedCold {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {target : Atom} {cid : CtorId} {schema : CtorSchema} {location : Nat}
+    {box : NodeBox} {fields : Array RVal} {store : Store}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .resetShared target cid)
+    (schemaAt : context.schemas .shared cid = some schema)
+    (resolved : resolveAtom frame.values target = .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared cid box fields)
+    (shared : 1 < box.rc)
+    (retained : RetainSharedMany
+      ((((machine.store.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+      fields store) :
+    Step context interpretation machine
+      { machine with
+        store
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values ++ fields
+            credits := frame.credits.push (some
+              { layout := schema.layout, presence := .absent }) }
+          stack } := by
+  unfold Step step currentBlock runInstruction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  unfold lookupSchema
+  rw [schemaAt]
+  simp only
+  rw [resolved]
+  simp only
+  unfold ConstructorView at viewed
+  rw [viewed]
+  simp only
+  have nonzero : (box.rc == 0) = false := by
+    apply beq_eq_false_iff_ne.mpr
+    omega
+  have nonunit : (box.rc == 1) = false := by
+    apply beq_eq_false_iff_ne.mpr
+    omega
+  rw [nonzero, nonunit]
+  simp only [Bool.false_eq_true, ↓reduceIte]
+  unfold RetainSharedMany at retained
+  rw [retained]
+  rfl
+
+/-- Reduction rule for a successful shared retain. -/
+theorem Step.retainShared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal} {store : Store}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .retainShared atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (retained : retainShared machine.store value = .ok store) :
+    Step context interpretation machine
+      { machine with
+        store
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value }
+          stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  rw [resolved]
+  simp only
+  rw [retained]
+
+/-- Reduction rule for a successful deep shared release. -/
+theorem Step.releaseShared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal} {store : Store} {heapFuel : Nat}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .releaseShared atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (released : releaseShared machine.heapFuel machine.store value =
+      .ok (store, heapFuel)) :
+    Step context interpretation machine
+      { store, heapFuel,
+        control := .running { frame with pc := frame.pc + 1 } stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  rw [resolved]
+  simp only
+  rw [released]
+
+/-- Reduction rule for a successful deep unique drop. -/
+theorem Step.dropUnique {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal} {store : Store} {heapFuel : Nat}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .dropUnique atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (dropped : dropUnique machine.heapFuel machine.store value =
+      .ok (store, heapFuel)) :
+    Step context interpretation machine
+      { store, heapFuel,
+        control := .running { frame with pc := frame.pc + 1 } stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  rw [resolved]
+  simp only
+  rw [dropped]
+
+/-- Reduction rule for a checked all-scalar unique constructor free. -/
+theorem Step.freeUnique {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {atom : Atom} {cid : CtorId} {location : Nat}
+    {box : NodeBox} {fields : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .freeUnique atom cid)
+    (resolved : resolveAtom frame.values atom = .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN cid fields)
+    (scalarFields : fields.all RVal.isScalar = true) :
+    Step context interpretation machine
+      { machine with
+        store := machine.store.kill location
+        control := .running { frame with pc := frame.pc + 1 } stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance requireCtor
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  rw [resolved]
+  simp only
+  rw [boxAt]
+  simp [unique, node, scalarFields]
+
+/-- Reduction rule for a successful checked constructor projection. -/
+theorem Step.fetch {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {block : Block} {atom : Atom} {cid : CtorId} {field location : Nat}
+    {box : NodeBox} {fields : Array RVal} {value : RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .fetch atom cid field)
+    (resolved : resolveAtom frame.values atom = .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (fieldAt : fields[field]? = some value) :
+    Step context interpretation machine
+      { machine with
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value }
+          stack } := by
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp only
+  rw [resolved]
+  simp only
+  rw [boxAt]
+  simp only
+  rw [node]
+  simp [fieldAt]
+
+/-- Reduction rule for entering a directly addressed compiler function and
+suspending the advanced caller frame. -/
+theorem Step.callFn {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom} {values : Array RVal}
+    {definition : Function}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .call address arguments)
+    (noCredits : frame.credits = #[])
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (declaration : context.declarations address = some (.fn definition))
+    (arity : values.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition, values }
+          (.resume { frame with pc := frame.pc + 1 } :: stack) } := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp [noCredits, resolved, declaration, arity, nonempty]
+
+/-- Reduction rule for entering the current function recursively and
+suspending the advanced caller frame. -/
+theorem Step.callSelf {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    {arguments : Array Atom} {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .callSelf arguments)
+    (noCredits : frame.credits = #[])
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (arity : values.size = frame.definition.signature.params.size)
+    (nonempty : frame.definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition := frame.definition, values }
+          (.resume { frame with pc := frame.pc + 1 } :: stack) } := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp [noCredits, resolved, arity, nonempty]
+
+/-- Reduction rule for allocating a strictly under-saturated PAP whose target
+is a compiler function.  Baseline lowering carries no credits, so its call
+boundary is discharged by the empty credit file. -/
+theorem Step.pappFn {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {block : Block} {address : Address} {arguments : Array Atom}
+    {values : Array RVal} {definition : Function}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .papp address arguments)
+    (noCredits : frame.credits = #[])
+    (declaration : context.declarations address = some (.fn definition))
+    (papSafe : definition.signature.papSafe = true)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (under : values.size < definition.signature.params.size) :
+    let allocation := machine.store.allocNode .shared
+      (.papN address definition.signature.params.size values)
+    Step context interpretation machine
+      { machine with
+        store := allocation.1
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push (.loc allocation.2) }
+          stack } := by
+  dsimp only
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp [ensureCallBoundary, Frame.hasCredits, noCredits, resolved,
+    declaration, declarationArity, declarationPapSafe, papSafe,
+    Nat.not_le.mpr under]
+  rfl
+
+/-- Reduction rule for a scalar external call. -/
+theorem Step.extern {context : Context} {interpretation : Interpretation}
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {block : Block} {address : Address} {arguments : Array Atom}
+    {values : Array RVal} {arity : Nat} {value : RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .extern address arguments)
+    (noCredits : frame.credits = #[])
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (declaration : context.declarations address = some (.extern arity))
+    (argumentArity : values.size = arity)
+    (called : ScalarOracleCall context address values value) :
+    Step context interpretation machine
+      { machine with
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value }
+          stack } := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp [noCredits, resolved, declaration, argumentArity]
+  unfold ScalarOracleCall at called
+  rw [called]
+
+/-- Reduction rule for dynamic application.  Operand resolution and the
+advanced caller coordinate are discharged here; the shared `ApplyTransfer`
+relation describes whether dispatch resumes immediately, enters a PAP target,
+or installs an `applyMore` continuation. -/
+theorem Step.apply {context : Context} {interpretation : Interpretation}
+    {machine target : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    {functionAtom : Atom} {argumentAtoms : Array Atom}
+    {function : RVal} {arguments : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .apply functionAtom argumentAtoms)
+    (noCredits : frame.credits = #[])
+    (functionResolved : resolveAtom frame.values functionAtom = .ok function)
+    (argumentsResolved :
+      resolveAtoms frame.values argumentAtoms = .ok arguments)
+    (transferred : ApplyTransfer context interpretation machine.store
+      machine.heapFuel function arguments { frame with pc := frame.pc + 1 }
+      stack target) :
+    Step context interpretation machine target := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  simp [noCredits, functionResolved, argumentsResolved]
+  simpa [ApplyTransfer, noCredits] using transferred
+
+/-- Returning through an over-application continuation dispatches the
+callee's value through the same `ApplyTransfer` relation used by the original
+`apply` instruction. -/
+theorem Step.retApplyMore {context : Context}
+    {interpretation : Interpretation} {machine target : Machine}
+    {frame caller : Frame} {arguments : Array RVal}
+    {rest : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal}
+    (control : machine.control =
+      .running frame (.applyMore arguments caller :: rest))
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (noCredits : frame.credits = #[])
+    (world : value.hasWorld machine.store
+      frame.definition.signature.result = true)
+    (transferred : ApplyTransfer context interpretation machine.store
+      machine.heapFuel value arguments caller rest target) :
+    Step context interpretation machine target := by
+  unfold Step step currentBlock runTerminator finishReturn
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  simp [resolved, Frame.hasCredits, noCredits, world]
+  exact transferred
+
+/-! ## Exhaustive call-boundary rules
+
+The baseline-facing rules above use an empty credit array because lowered
+source frames never allocate credit registers.  Generated helper frames and
+the raw evaluator can instead reach a call boundary with a nonempty array
+whose every slot has been consumed.  The following rules expose that full
+successful evaluator domain through `NoLiveCredits`. -/
+
+/-- Return to an ordinary continuation after every credit slot has been
+consumed, including a nonempty file of `none` entries. -/
+theorem Step.retResumeCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame caller : Frame} {rest : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal}
+    (control : machine.control =
+      .running frame (.resume caller :: rest))
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (noCredits : NoLiveCredits frame)
+    (world : value.hasWorld machine.store
+      frame.definition.signature.result = true) :
+    Step context interpretation machine
+      { machine with
+        control := .running
+          { caller with values := caller.values.push value } rest } := by
+  unfold Step step currentBlock runTerminator finishReturn Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  unfold NoLiveCredits at noCredits
+  simp [resolved, Frame.hasCredits, noCredits, world]
+
+/-- Return from the outermost frame after every credit slot has been
+consumed. -/
+theorem Step.retHaltCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {block : Block} {atom : Atom} {value : RVal}
+    (control : machine.control = .running frame [])
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (noCredits : NoLiveCredits frame)
+    (world : value.hasWorld machine.store
+      frame.definition.signature.result = true) :
+    Step context interpretation machine
+      { machine with control := .halted value } := by
+  unfold Step step currentBlock runTerminator finishReturn
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  unfold NoLiveCredits at noCredits
+  simp [resolved, Frame.hasCredits, noCredits, world]
+
+/-- Return through an over-application continuation after every credit slot
+has been consumed. -/
+theorem Step.retApplyMoreCleared {context : Context}
+    {interpretation : Interpretation} {machine target : Machine}
+    {frame caller : Frame} {arguments : Array RVal}
+    {rest : List Continuation} {block : Block}
+    {atom : Atom} {value : RVal}
+    (control : machine.control =
+      .running frame (.applyMore arguments caller :: rest))
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom frame.values atom = .ok value)
+    (noCredits : NoLiveCredits frame)
+    (world : value.hasWorld machine.store
+      frame.definition.signature.result = true)
+    (transferred : ApplyTransfer context interpretation machine.store
+      machine.heapFuel value arguments caller rest target) :
+    Step context interpretation machine target := by
+  unfold Step step currentBlock runTerminator finishReturn
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  unfold NoLiveCredits at noCredits
+  simp [resolved, Frame.hasCredits, noCredits, world]
+  exact transferred
+
+/-- Direct tail-call entry with an arbitrary fully consumed credit file. -/
+theorem Step.tailCallFnCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom} {values : Array RVal}
+    {definition : Function}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments)
+    (noCredits : NoLiveCredits frame)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (declaration : context.declarations address = some (.fn definition))
+    (arity : values.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition, values } stack } := by
+  unfold Step step currentBlock runTerminator ensureCallBoundary
+    Frame.hasCredits enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  have pcBeq : (frame.pc == block.instructions.size) = true :=
+    beq_iff_eq.mpr pc
+  rw [dif_neg (by omega), if_pos pcBeq, terminator]
+  unfold NoLiveCredits at noCredits
+  simp [noCredits, resolved, declaration, arity, nonempty]
+
+/-- Direct call entry with an arbitrary fully consumed credit file. -/
+theorem Step.callFnCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom} {values : Array RVal}
+    {definition : Function}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .call address arguments)
+    (noCredits : NoLiveCredits frame)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (declaration : context.declarations address = some (.fn definition))
+    (arity : values.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition, values }
+          (.resume { frame with pc := frame.pc + 1 } :: stack) } := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  unfold NoLiveCredits at noCredits
+  simp [noCredits, resolved, declaration, arity, nonempty]
+
+/-- Recursive call entry with an arbitrary fully consumed credit file. -/
+theorem Step.callSelfCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {arguments : Array Atom} {values : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .callSelf arguments)
+    (noCredits : NoLiveCredits frame)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (arity : values.size = frame.definition.signature.params.size)
+    (nonempty : frame.definition.blocks.isEmpty = false) :
+    Step context interpretation machine
+      { machine with
+        control := .running { definition := frame.definition, values }
+          (.resume { frame with pc := frame.pc + 1 } :: stack) } := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance enterFunction
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  unfold NoLiveCredits at noCredits
+  simp [noCredits, resolved, arity, nonempty]
+
+/-- Function-targeted PAP construction with an arbitrary fully consumed
+credit file. -/
+theorem Step.pappFnCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom} {values : Array RVal}
+    {definition : Function}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .papp address arguments)
+    (noCredits : NoLiveCredits frame)
+    (declaration : context.declarations address = some (.fn definition))
+    (papSafe : definition.signature.papSafe = true)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (under : values.size < definition.signature.params.size) :
+    let allocation := machine.store.allocNode .shared
+      (.papN address definition.signature.params.size values)
+    Step context interpretation machine
+      { machine with
+        store := allocation.1
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push (.loc allocation.2) }
+          stack } := by
+  dsimp only
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  unfold NoLiveCredits at noCredits
+  simp [ensureCallBoundary, Frame.hasCredits, noCredits, resolved,
+    declaration, declarationArity, declarationPapSafe, papSafe,
+    Nat.not_le.mpr under]
+  rfl
+
+/-- Extern-targeted PAP construction is a genuine successful evaluator
+shape when the captured vector is strictly under-saturated. -/
+theorem Step.pappExternCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom} {values : Array RVal}
+    {arity : Nat}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .papp address arguments)
+    (noCredits : NoLiveCredits frame)
+    (declaration : context.declarations address = some (.extern arity))
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (under : values.size < arity) :
+    let allocation := machine.store.allocNode .shared
+      (.papN address arity values)
+    Step context interpretation machine
+      { machine with
+        store := allocation.1
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push (.loc allocation.2) }
+          stack } := by
+  dsimp only
+  unfold Step step currentBlock runInstruction Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  unfold NoLiveCredits at noCredits
+  simp [ensureCallBoundary, Frame.hasCredits, noCredits, resolved,
+    declaration, declarationArity, declarationPapSafe,
+    Nat.not_le.mpr under]
+  rfl
+
+/-- Scalar extern invocation with an arbitrary fully consumed credit file. -/
+theorem Step.externCleared {context : Context}
+    {interpretation : Interpretation} {machine : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {address : Address} {arguments : Array Atom}
+    {values : Array RVal} {arity : Nat} {value : RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .extern address arguments)
+    (noCredits : NoLiveCredits frame)
+    (resolved : resolveAtoms frame.values arguments = .ok values)
+    (declaration : context.declarations address = some (.extern arity))
+    (argumentArity : values.size = arity)
+    (called : ScalarOracleCall context address values value) :
+    Step context interpretation machine
+      { machine with
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value }
+          stack } := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance Frame.pushValue
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  unfold NoLiveCredits at noCredits
+  simp [noCredits, resolved, declaration, argumentArity]
+  unfold ScalarOracleCall at called
+  rw [called]
+
+/-- Dynamic application with an arbitrary fully consumed credit file. -/
+theorem Step.applyCleared {context : Context}
+    {interpretation : Interpretation} {machine target : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    {functionAtom : Atom} {argumentAtoms : Array Atom}
+    {function : RVal} {arguments : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .apply functionAtom argumentAtoms)
+    (noCredits : NoLiveCredits frame)
+    (functionResolved : resolveAtom frame.values functionAtom = .ok function)
+    (argumentsResolved :
+      resolveAtoms frame.values argumentAtoms = .ok arguments)
+    (transferred : ApplyTransfer context interpretation machine.store
+      machine.heapFuel function arguments { frame with pc := frame.pc + 1 }
+      stack target) :
+    Step context interpretation machine target := by
+  unfold Step step currentBlock runInstruction ensureCallBoundary
+    Frame.hasCredits Frame.advance
+  rw [control]
+  simp only
+  rw [blockAt]
+  simp only [bind, Except.bind, pure, Except.pure]
+  rw [dif_pos pc, instruction]
+  unfold NoLiveCredits at noCredits
+  simp [noCredits, functionResolved, argumentsResolved]
+  simpa [ApplyTransfer, noCredits] using transferred
+
+/-! ## Exhaustive successful-step classification -/
+
+/-- Public equation for the private instruction worker at a canonical running
+machine. -/
+def InstructionTransfer (context : Context)
+    (interpretation : Interpretation) (store : Store) (heapFuel : Nat)
+    (frame : Frame) (stack : List Continuation) (instruction : Instr)
+    (target : Machine) : Prop :=
+  runInstruction context interpretation
+    { store, heapFuel, control := .running frame stack }
+    frame stack instruction = .ok target
+
+/-- Every successful runtime shape of one IxIR₂ instruction.  The relation is
+indexed by the instruction and exact output machine, so eliminating it exposes
+all dynamic evidence needed by simulation clients. -/
+inductive InstructionTransferCase (context : Context)
+    (interpretation : Interpretation) (store : Store) (heapFuel : Nat)
+    (frame : Frame) (stack : List Continuation) : Instr → Machine → Prop where
+  | move {atom : Atom} {value : RVal}
+      (resolved : resolveAtom frame.values atom = .ok value) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.move atom)
+        { store, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack }
+  | alloc {world : Owned} {cid : CtorId} {arguments : Array Atom}
+      {schema : CtorSchema} {values : Array RVal}
+      (schemaAt : context.schemas world cid = some schema)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (fields : FieldWorlds store schema values) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.alloc world cid arguments)
+        (let allocation := store.allocNode world (.ctorN cid values)
+        { store := allocation.1, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc allocation.2) }
+            stack })
+  | allocWithAbsent {creditId : CreditId} {credit : Credit}
+      {world : Owned} {cid : CtorId} {arguments : Array Atom}
+      {schema : CtorSchema} {values : Array RVal} {next : Frame}
+      (schemaAt : context.schemas world cid = some schema)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (fields : FieldWorlds store schema values)
+      (taken : CreditTake { frame with pc := frame.pc + 1 }
+        creditId next credit)
+      (layout : credit.layout = schema.layout)
+      (absent : credit.presence = .absent) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.allocWith creditId world cid arguments)
+        (let allocation := store.allocNode world (.ctorN cid values)
+        { store := allocation.1, heapFuel
+          control := .running
+            { next with values := next.values.push (.loc allocation.2) }
+            stack })
+  | allocWithLogical {creditId : CreditId} {credit : Credit}
+      {world : Owned} {cid : CtorId} {arguments : Array Atom}
+      {schema : CtorSchema} {values : Array RVal} {next : Frame}
+      (mode : interpretation = .logical)
+      (schemaAt : context.schemas world cid = some schema)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (fields : FieldWorlds store schema values)
+      (taken : CreditTake { frame with pc := frame.pc + 1 }
+        creditId next credit)
+      (layout : credit.layout = schema.layout)
+      (present : credit.presence = .present none) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.allocWith creditId world cid arguments)
+        (let allocation := store.allocNode world (.ctorN cid values)
+        { store := allocation.1, heapFuel
+          control := .running
+            { next with values := next.values.push (.loc allocation.2) }
+            stack })
+  | allocWithPhysical {creditId : CreditId} {credit : Credit}
+      {world : Owned} {cid : CtorId} {arguments : Array Atom}
+      {schema : CtorSchema} {values : Array RVal} {next : Frame}
+      {location : Nat} {outStore : Store}
+      (mode : interpretation = .physical)
+      (schemaAt : context.schemas world cid = some schema)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (fields : FieldWorlds store schema values)
+      (taken : CreditTake { frame with pc := frame.pc + 1 }
+        creditId next credit)
+      (layout : credit.layout = schema.layout)
+      (present : credit.presence = .present (some location))
+      (reused : store.reuseReservation location world (.ctorN cid values)
+        schema.fields.size = .ok outStore) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.allocWith creditId world cid arguments)
+        { store := outStore, heapFuel
+          control := .running
+            { next with values := next.values.push (.loc location) } stack }
+  | discardAbsent {creditId : CreditId} {credit : Credit} {next : Frame}
+      (taken : CreditTake { frame with pc := frame.pc + 1 }
+        creditId next credit)
+      (absent : credit.presence = .absent) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.discardCredit creditId)
+        { store, heapFuel, control := .running next stack }
+  | discardLogical {creditId : CreditId} {credit : Credit} {next : Frame}
+      (mode : interpretation = .logical)
+      (taken : CreditTake { frame with pc := frame.pc + 1 }
+        creditId next credit)
+      (present : credit.presence = .present none) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.discardCredit creditId)
+        { store, heapFuel, control := .running next stack }
+  | discardPhysical {creditId : CreditId} {credit : Credit} {next : Frame}
+      {location : Nat} {outStore : Store}
+      (mode : interpretation = .physical)
+      (taken : CreditTake { frame with pc := frame.pc + 1 }
+        creditId next credit)
+      (present : credit.presence = .present (some location))
+      (released : store.releaseReservation location = .ok outStore) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.discardCredit creditId)
+        { store := outStore, heapFuel, control := .running next stack }
+  | takeUniqueLogical {target : Atom} {cid : CtorId}
+      {schema : CtorSchema} {location : Nat} {box : NodeBox}
+      {fields : Array RVal}
+      (mode : interpretation = .logical)
+      (schemaAt : context.schemas .unique cid = some schema)
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (viewed : ConstructorView store location .unique cid box fields)
+      (unitRC : box.rc = 1) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.takeUnique target cid)
+        { store := store.kill location, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values ++ fields
+              credits := frame.credits.push (some
+                { layout := schema.layout, presence := .present none }) }
+            stack }
+  | takeUniquePhysical {target : Atom} {cid : CtorId}
+      {schema : CtorSchema} {location : Nat} {box : NodeBox}
+      {fields : Array RVal}
+      (mode : interpretation = .physical)
+      (schemaAt : context.schemas .unique cid = some schema)
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (viewed : ConstructorView store location .unique cid box fields)
+      (unitRC : box.rc = 1) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.takeUnique target cid)
+        { store := store.reserve location, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values ++ fields
+              credits := frame.credits.push (some
+                { layout := schema.layout,
+                  presence := .present (some location) }) }
+            stack }
+  | resetSharedLogicalHot {target : Atom} {cid : CtorId}
+      {schema : CtorSchema} {location : Nat} {box : NodeBox}
+      {fields : Array RVal}
+      (mode : interpretation = .logical)
+      (schemaAt : context.schemas .shared cid = some schema)
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (viewed : ConstructorView store location .shared cid box fields)
+      (unitRC : box.rc = 1) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.resetShared target cid)
+        { store := ((store.tickResetAttempt).kill location).tickHotReset
+          heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values ++ fields
+              credits := frame.credits.push (some
+                { layout := schema.layout, presence := .present none }) }
+            stack }
+  | resetSharedPhysicalHot {target : Atom} {cid : CtorId}
+      {schema : CtorSchema} {location : Nat} {box : NodeBox}
+      {fields : Array RVal}
+      (mode : interpretation = .physical)
+      (schemaAt : context.schemas .shared cid = some schema)
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (viewed : ConstructorView store location .shared cid box fields)
+      (unitRC : box.rc = 1) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.resetShared target cid)
+        { store := ((store.tickResetAttempt).reserve location).tickHotReset
+          heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values ++ fields
+              credits := frame.credits.push (some
+                { layout := schema.layout,
+                  presence := .present (some location) }) }
+            stack }
+  | resetSharedCold {target : Atom} {cid : CtorId}
+      {schema : CtorSchema} {location : Nat} {box : NodeBox}
+      {fields : Array RVal} {outStore : Store}
+      (schemaAt : context.schemas .shared cid = some schema)
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (viewed : ConstructorView store location .shared cid box fields)
+      (shared : 1 < box.rc)
+      (retained : RetainSharedMany
+        ((((store.tickResetAttempt).setBox location
+          { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+        fields outStore) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.resetShared target cid)
+        { store := outStore, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values ++ fields
+              credits := frame.credits.push (some
+                { layout := schema.layout, presence := .absent }) }
+            stack }
+  | retainShared {target : Atom} {value : RVal} {outStore : Store}
+      (resolved : resolveAtom frame.values target = .ok value)
+      (retained : Eval.retainShared store value = .ok outStore) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.retainShared target)
+        { store := outStore, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack }
+  | releaseShared {target : Atom} {value : RVal} {outStore : Store}
+      {outHeapFuel : Nat}
+      (resolved : resolveAtom frame.values target = .ok value)
+      (released : Eval.releaseShared heapFuel store value =
+        .ok (outStore, outHeapFuel)) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.releaseShared target)
+        { store := outStore, heapFuel := outHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack }
+  | dropUnique {target : Atom} {value : RVal} {outStore : Store}
+      {outHeapFuel : Nat}
+      (resolved : resolveAtom frame.values target = .ok value)
+      (dropped : Eval.dropUnique heapFuel store value =
+        .ok (outStore, outHeapFuel)) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.dropUnique target)
+        { store := outStore, heapFuel := outHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack }
+  | freeUnique {target : Atom} {cid : CtorId} {location : Nat}
+      {box : NodeBox} {fields : Array RVal}
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (viewed : ConstructorView store location .unique cid box fields)
+      (scalarFields : fields.all RVal.isScalar = true) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.freeUnique target cid)
+        { store := store.kill location, heapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack }
+  | fetch {target : Atom} {cid : CtorId} {field location : Nat}
+      {box : NodeBox} {fields : Array RVal} {value : RVal}
+      (resolved : resolveAtom frame.values target = .ok (.loc location))
+      (boxAt : store.get? location = some box)
+      (node : box.node = .ctorN cid fields)
+      (fieldAt : fields[field]? = some value) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.fetch target cid field)
+        { store, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack }
+  | callFn {address : Address} {arguments : Array Atom}
+      {values : Array RVal} {definition : Function}
+      (noCredits : NoLiveCredits frame)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (declaration : context.declarations address = some (.fn definition))
+      (arity : values.size = definition.signature.params.size)
+      (nonempty : definition.blocks.isEmpty = false) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.call address arguments)
+        { store, heapFuel
+          control := .running { definition, values }
+            (.resume { frame with pc := frame.pc + 1 } :: stack) }
+  | callSelf {arguments : Array Atom} {values : Array RVal}
+      (noCredits : NoLiveCredits frame)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (arity : values.size = frame.definition.signature.params.size)
+      (nonempty : frame.definition.blocks.isEmpty = false) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.callSelf arguments)
+        { store, heapFuel
+          control := .running { definition := frame.definition, values }
+            (.resume { frame with pc := frame.pc + 1 } :: stack) }
+  | pappFn {address : Address} {arguments : Array Atom}
+      {values : Array RVal} {definition : Function}
+      (noCredits : NoLiveCredits frame)
+      (declaration : context.declarations address = some (.fn definition))
+      (papSafe : definition.signature.papSafe = true)
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (under : values.size < definition.signature.params.size) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.papp address arguments)
+        (let allocation := store.allocNode .shared
+          (.papN address definition.signature.params.size values)
+        { store := allocation.1, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc allocation.2) }
+            stack })
+  | pappExtern {address : Address} {arguments : Array Atom}
+      {values : Array RVal} {arity : Nat}
+      (noCredits : NoLiveCredits frame)
+      (declaration : context.declarations address = some (.extern arity))
+      (resolved : resolveAtoms frame.values arguments = .ok values)
+      (under : values.size < arity) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.papp address arguments)
+        (let allocation := store.allocNode .shared
+          (.papN address arity values)
+        { store := allocation.1, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc allocation.2) }
+            stack })
+  | apply {functionAtom : Atom} {argumentAtoms : Array Atom}
+      {function : RVal} {arguments : Array RVal} {target : Machine}
+      (noCredits : NoLiveCredits frame)
+      (functionResolved : resolveAtom frame.values functionAtom = .ok function)
+      (argumentsResolved :
+        resolveAtoms frame.values argumentAtoms = .ok arguments)
+      (transferred : ApplyTransfer context interpretation store heapFuel
+        function arguments { frame with pc := frame.pc + 1 } stack target) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.apply functionAtom argumentAtoms) target
+  | extern {address : Address} {argumentAtoms : Array Atom}
+      {arguments : Array RVal} {arity : Nat} {value : RVal}
+      (noCredits : NoLiveCredits frame)
+      (resolved : resolveAtoms frame.values argumentAtoms = .ok arguments)
+      (declaration : context.declarations address = some (.extern arity))
+      (argumentArity : arguments.size = arity)
+      (called : ScalarOracleCall context address arguments value) :
+      InstructionTransferCase context interpretation store heapFuel frame stack
+        (.extern address argumentAtoms)
+        { store, heapFuel
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack }
+
+/-- Each classified instruction shape reconstructs the public small step once
+the enclosing block lookup and program-counter facts are supplied. -/
+theorem InstructionTransferCase.step {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation}
+    {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store
+      heapFuel frame stack instruction target)
+    {block : Block}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instructionAt : block.instructions[frame.pc] = instruction) :
+    Step context interpretation
+      { store, heapFuel, control := .running frame stack } target := by
+  cases classified with
+  | move resolved =>
+      exact Step.move rfl blockAt pc instructionAt resolved
+  | alloc schemaAt resolved fields =>
+      exact Step.alloc rfl blockAt pc instructionAt schemaAt resolved fields
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      exact Step.allocWithAbsent rfl blockAt pc instructionAt schemaAt
+        resolved fields taken layout absent
+  | allocWithLogical mode schemaAt resolved fields taken layout present =>
+      cases mode
+      exact Step.allocWithLogical rfl blockAt pc instructionAt schemaAt
+        resolved fields taken layout present
+  | allocWithPhysical mode schemaAt resolved fields taken layout present reused =>
+      cases mode
+      exact Step.allocWithPhysical rfl blockAt pc instructionAt schemaAt
+        resolved fields taken layout present reused
+  | discardAbsent taken absent =>
+      exact Step.discardCreditAbsent rfl blockAt pc instructionAt taken absent
+  | discardLogical mode taken present =>
+      cases mode
+      exact Step.discardCreditLogical rfl blockAt pc instructionAt taken present
+  | discardPhysical mode taken present released =>
+      cases mode
+      exact Step.discardCreditPhysical rfl blockAt pc instructionAt taken
+        present released
+  | takeUniqueLogical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact Step.takeUniqueLogical rfl blockAt pc instructionAt schemaAt
+        resolved viewed unitRC
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact Step.takeUniquePhysical rfl blockAt pc instructionAt schemaAt
+        resolved viewed unitRC
+  | resetSharedLogicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact Step.resetSharedLogicalHot rfl blockAt pc instructionAt schemaAt
+        resolved viewed unitRC
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact Step.resetSharedPhysicalHot rfl blockAt pc instructionAt schemaAt
+        resolved viewed unitRC
+  | resetSharedCold schemaAt resolved viewed shared retained =>
+      exact Step.resetSharedCold rfl blockAt pc instructionAt schemaAt resolved
+        viewed shared retained
+  | retainShared resolved retained =>
+      exact Step.retainShared rfl blockAt pc instructionAt resolved retained
+  | releaseShared resolved released =>
+      exact Step.releaseShared rfl blockAt pc instructionAt resolved released
+  | dropUnique resolved dropped =>
+      exact Step.dropUnique rfl blockAt pc instructionAt resolved dropped
+  | freeUnique resolved viewed scalarFields =>
+      obtain ⟨boxAt, unique, node⟩ := viewed.parts
+      exact Step.freeUnique rfl blockAt pc instructionAt resolved boxAt unique
+        node scalarFields
+  | fetch resolved boxAt node fieldAt =>
+      exact Step.fetch rfl blockAt pc instructionAt resolved boxAt node fieldAt
+  | callFn noCredits resolved declaration arity nonempty =>
+      exact Step.callFnCleared rfl blockAt pc instructionAt noCredits resolved
+        declaration arity nonempty
+  | callSelf noCredits resolved arity nonempty =>
+      exact Step.callSelfCleared rfl blockAt pc instructionAt noCredits resolved
+        arity nonempty
+  | pappFn noCredits declaration papSafe resolved under =>
+      exact Step.pappFnCleared rfl blockAt pc instructionAt noCredits declaration
+        papSafe resolved under
+  | pappExtern noCredits declaration resolved under =>
+      exact Step.pappExternCleared rfl blockAt pc instructionAt noCredits
+        declaration resolved under
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact Step.applyCleared rfl blockAt pc instructionAt noCredits
+        functionResolved argumentsResolved transferred
+  | extern noCredits resolved declaration argumentArity called =>
+      exact Step.externCleared rfl blockAt pc instructionAt noCredits resolved
+        declaration argumentArity called
+
+/-- Invert an arbitrary successful instruction-worker equation into its exact
+runtime case. -/
+theorem InstructionTransfer.classify {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation}
+    {instruction : Instr} {target : Machine}
+    (transferred : InstructionTransfer context interpretation store heapFuel
+      frame stack instruction target) :
+    InstructionTransferCase context interpretation store heapFuel frame stack
+      instruction target := by
+  unfold InstructionTransfer runInstruction at transferred
+  simp only [bind, Except.bind, pure, Except.pure] at transferred
+  cases instruction with
+  | move atom =>
+      cases resolved : resolveAtom frame.values atom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          simp [resolved, Frame.advance, Frame.pushValue] at transferred
+          subst target
+          exact .move resolved
+  | alloc world cid arguments =>
+      cases schemaAt : context.schemas world cid with
+      | none => simp [lookupSchema, schemaAt] at transferred
+      | some schema =>
+          simp only [lookupSchema, schemaAt] at transferred
+          cases resolved : resolveAtoms frame.values arguments with
+          | error error => simp [resolved] at transferred
+          | ok values =>
+              simp only [resolved] at transferred
+              cases fields : checkFieldWorlds store schema values with
+              | error error => simp [fields] at transferred
+              | ok checkedUnit =>
+                  cases checkedUnit
+                  simp [fields, Frame.advance, Frame.pushValue] at transferred
+                  subst target
+                  exact .alloc schemaAt resolved fields
+  | allocWith creditId world cid arguments =>
+      cases schemaAt : context.schemas world cid with
+      | none => simp [lookupSchema, schemaAt] at transferred
+      | some schema =>
+          simp only [lookupSchema, schemaAt] at transferred
+          cases resolved : resolveAtoms frame.values arguments with
+          | error error => simp [resolved] at transferred
+          | ok values =>
+              simp only [resolved] at transferred
+              cases fields : checkFieldWorlds store schema values with
+              | error error => simp [fields] at transferred
+              | ok checkedUnit =>
+                  cases checkedUnit
+                  simp only [fields] at transferred
+                  cases taken : takeCredit frame.advance creditId with
+                  | error error => simp [taken] at transferred
+                  | ok output =>
+                      obtain ⟨next, credit⟩ := output
+                      simp only [taken] at transferred
+                      have taken' : CreditTake
+                          { frame with pc := frame.pc + 1 }
+                          creditId next credit := by
+                        simpa [CreditTake, Frame.advance] using taken
+                      by_cases layout : credit.layout = schema.layout
+                      · cases presence : credit.presence with
+                        | absent =>
+                            simp [layout, presence, Frame.pushValue]
+                              at transferred
+                            subst target
+                            exact .allocWithAbsent schemaAt resolved fields
+                              taken' layout presence
+                        | present reservation =>
+                            cases interpretation with
+                            | logical =>
+                                cases reservation with
+                                | none =>
+                                    simp [layout, presence, Frame.pushValue]
+                                      at transferred
+                                    subst target
+                                    exact .allocWithLogical rfl schemaAt
+                                      resolved fields taken' layout presence
+                                | some location =>
+                                    simp [layout, presence] at transferred
+                            | physical =>
+                                cases reservation with
+                                | none =>
+                                    simp [layout, presence] at transferred
+                                | some location =>
+                                    cases reused : store.reuseReservation
+                                        location world (.ctorN cid values)
+                                        schema.fields.size with
+                                    | error error =>
+                                        simp [layout, presence, reused]
+                                          at transferred
+                                    | ok outStore =>
+                                        simp [layout, presence, reused,
+                                          Frame.pushValue]
+                                          at transferred
+                                        subst target
+                                        exact .allocWithPhysical rfl schemaAt
+                                          resolved fields taken' layout
+                                          presence reused
+                      · simp [layout] at transferred
+  | discardCredit creditId =>
+      cases taken : takeCredit frame.advance creditId with
+      | error error => simp [taken] at transferred
+      | ok output =>
+          obtain ⟨next, credit⟩ := output
+          simp only [taken] at transferred
+          have taken' : CreditTake { frame with pc := frame.pc + 1 }
+              creditId next credit := by
+            simpa [CreditTake, Frame.advance] using taken
+          cases presence : credit.presence with
+          | absent =>
+              simp [presence] at transferred
+              subst target
+              exact .discardAbsent taken' presence
+          | present reservation =>
+              cases interpretation with
+              | logical =>
+                  cases reservation with
+                  | none =>
+                      simp [presence] at transferred
+                      subst target
+                      exact .discardLogical rfl taken' presence
+                  | some location => simp [presence] at transferred
+              | physical =>
+                  cases reservation with
+                  | none => simp [presence] at transferred
+                  | some location =>
+                      cases released : store.releaseReservation location with
+                      | error error => simp [presence, released] at transferred
+                      | ok outStore =>
+                          simp [presence, released] at transferred
+                          subst target
+                          exact .discardPhysical rfl taken' presence released
+  | takeUnique targetAtom cid =>
+      cases schemaAt : context.schemas .unique cid with
+      | none => simp [lookupSchema, schemaAt] at transferred
+      | some schema =>
+          simp only [lookupSchema, schemaAt] at transferred
+          cases resolved : resolveAtom frame.values targetAtom with
+          | error error => simp [resolved] at transferred
+          | ok value =>
+              cases value with
+              | lit literal => simp [resolved] at transferred
+              | erased => simp [resolved] at transferred
+              | loc location =>
+                  simp only [resolved] at transferred
+                  cases viewed : requireCtor store location .unique cid with
+                  | error error => simp [viewed] at transferred
+                  | ok output =>
+                      obtain ⟨box, fields⟩ := output
+                      simp only [viewed] at transferred
+                      by_cases unitRC : box.rc = 1
+                      · cases interpretation with
+                        | logical =>
+                            simp [unitRC, Credit.presentFor, Frame.advance,
+                              Frame.pushValues, Frame.pushCredit] at transferred
+                            subst target
+                            exact .takeUniqueLogical rfl schemaAt resolved
+                              viewed unitRC
+                        | physical =>
+                            simp [unitRC, Credit.presentFor, Frame.advance,
+                              Frame.pushValues, Frame.pushCredit] at transferred
+                            subst target
+                            exact .takeUniquePhysical rfl schemaAt resolved
+                              viewed unitRC
+                      · simp [unitRC] at transferred
+  | resetShared targetAtom cid =>
+      cases schemaAt : context.schemas .shared cid with
+      | none => simp [lookupSchema, schemaAt] at transferred
+      | some schema =>
+          simp only [lookupSchema, schemaAt] at transferred
+          cases resolved : resolveAtom frame.values targetAtom with
+          | error error => simp [resolved] at transferred
+          | ok value =>
+              cases value with
+              | lit literal => simp [resolved] at transferred
+              | erased => simp [resolved] at transferred
+              | loc location =>
+                  simp only [resolved] at transferred
+                  cases viewed : requireCtor store location .shared cid with
+                  | error error => simp [viewed] at transferred
+                  | ok output =>
+                      obtain ⟨box, fields⟩ := output
+                      simp only [viewed] at transferred
+                      by_cases zero : box.rc = 0
+                      · simp [zero] at transferred
+                      · by_cases unitRC : box.rc = 1
+                        · cases interpretation with
+                          | logical =>
+                              simp [unitRC, Credit.presentFor,
+                                Frame.advance, Frame.pushValues,
+                                Frame.pushCredit] at transferred
+                              subst target
+                              exact .resetSharedLogicalHot rfl schemaAt
+                                resolved viewed unitRC
+                          | physical =>
+                              simp [unitRC, Credit.presentFor,
+                                Frame.advance, Frame.pushValues,
+                                Frame.pushCredit] at transferred
+                              subst target
+                              exact .resetSharedPhysicalHot rfl schemaAt
+                                resolved viewed unitRC
+                        · have shared : 1 < box.rc := by omega
+                          let beforeRetain :=
+                            ((((store.tickResetAttempt).setBox location
+                              { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+                          cases retained : retainSharedMany beforeRetain fields with
+                          | error error =>
+                              simp [zero, unitRC, beforeRetain, retained]
+                                at transferred
+                          | ok outStore =>
+                              simp [zero, unitRC, beforeRetain, retained,
+                                Frame.advance, Frame.pushValues,
+                                Frame.pushCredit] at transferred
+                              subst target
+                              exact .resetSharedCold schemaAt resolved viewed
+                                shared retained
+  | retainShared targetAtom =>
+      cases resolved : resolveAtom frame.values targetAtom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          simp only [resolved] at transferred
+          cases retained : Eval.retainShared store value with
+          | error error => simp [retained] at transferred
+          | ok outStore =>
+              simp [retained, Frame.advance, Frame.pushValue] at transferred
+              subst target
+              exact .retainShared resolved retained
+  | releaseShared targetAtom =>
+      cases resolved : resolveAtom frame.values targetAtom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          simp only [resolved] at transferred
+          cases released : Eval.releaseShared heapFuel store value with
+          | error error => simp [released] at transferred
+          | ok output =>
+              obtain ⟨outStore, outHeapFuel⟩ := output
+              simp [released, Frame.advance] at transferred
+              subst target
+              exact .releaseShared resolved released
+  | dropUnique targetAtom =>
+      cases resolved : resolveAtom frame.values targetAtom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          simp only [resolved] at transferred
+          cases dropped : Eval.dropUnique heapFuel store value with
+          | error error => simp [dropped] at transferred
+          | ok output =>
+              obtain ⟨outStore, outHeapFuel⟩ := output
+              simp [dropped, Frame.advance] at transferred
+              subst target
+              exact .dropUnique resolved dropped
+  | freeUnique targetAtom cid =>
+      cases resolved : resolveAtom frame.values targetAtom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          cases value with
+          | lit literal => simp [resolved] at transferred
+          | erased => simp [resolved] at transferred
+          | loc location =>
+              simp only [resolved] at transferred
+              cases viewed : requireCtor store location .unique cid with
+              | error error => simp [viewed] at transferred
+              | ok output =>
+                  obtain ⟨box, fields⟩ := output
+                  simp only [viewed] at transferred
+                  cases scalarFields : fields.all RVal.isScalar with
+                  | false => simp [scalarFields] at transferred
+                  | true =>
+                      simp [scalarFields, Frame.advance] at transferred
+                      subst target
+                      exact .freeUnique resolved viewed scalarFields
+  | fetch targetAtom cid field =>
+      cases resolved : resolveAtom frame.values targetAtom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          cases value with
+          | lit literal => simp [resolved] at transferred
+          | erased => simp [resolved] at transferred
+          | loc location =>
+              simp only [resolved] at transferred
+              cases boxAt : store.get? location with
+              | none => simp [boxAt] at transferred
+              | some box =>
+                  simp only [boxAt] at transferred
+                  cases node : box.node with
+                  | papN address arity captured => simp [node] at transferred
+                  | ctorN actual fields =>
+                      simp only [node] at transferred
+                      by_cases same : actual = cid
+                      · subst actual
+                        cases fieldAt : fields[field]? with
+                        | none => simp [fieldAt] at transferred
+                        | some fieldValue =>
+                            simp [fieldAt, Frame.advance, Frame.pushValue]
+                              at transferred
+                            subst target
+                            exact .fetch resolved boxAt node fieldAt
+                      · simp [same] at transferred
+  | call address arguments =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases resolved : resolveAtoms frame.values arguments with
+          | error error => simp [resolved] at transferred
+          | ok values =>
+              simp only [resolved] at transferred
+              cases declaration : context.declarations address with
+              | none => simp [declaration] at transferred
+              | some declared =>
+                  simp only [declaration] at transferred
+                  cases declared with
+                  | extern arity => simp at transferred
+                  | fn definition =>
+                      by_cases arity :
+                          values.size = definition.signature.params.size
+                      · cases empty : definition.blocks.isEmpty with
+                        | true =>
+                            simp [enterFunction, arity, empty] at transferred
+                        | false =>
+                            simp [enterFunction, arity, empty, Frame.advance]
+                              at transferred
+                            subst target
+                            exact .callFn noCredits resolved declaration arity
+                              empty
+                      · simp [enterFunction, arity] at transferred
+  | callSelf arguments =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases resolved : resolveAtoms frame.values arguments with
+          | error error => simp [resolved] at transferred
+          | ok values =>
+              simp only [resolved] at transferred
+              by_cases arity :
+                  values.size = frame.definition.signature.params.size
+              · cases empty : frame.definition.blocks.isEmpty with
+                | true =>
+                    simp [enterFunction, arity, empty]
+                      at transferred
+                | false =>
+                    simp [enterFunction, arity, empty, Frame.advance]
+                      at transferred
+                    subst target
+                    exact .callSelf noCredits resolved arity empty
+              · simp [enterFunction, arity] at transferred
+  | papp address arguments =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases resolved : resolveAtoms frame.values arguments with
+          | error error => simp [resolved] at transferred
+          | ok values =>
+              simp only [resolved] at transferred
+              cases declaration : context.declarations address with
+              | none => simp [declaration] at transferred
+              | some declared =>
+                  simp only [declaration] at transferred
+                  cases declared with
+                  | fn definition =>
+                      cases papSafe : definition.signature.papSafe with
+                      | false =>
+                          simp [declarationPapSafe, papSafe] at transferred
+                      | true =>
+                          by_cases under :
+                              values.size < definition.signature.params.size
+                          · have notEnough : ¬
+                                definition.signature.params.size ≤
+                                  values.size := Nat.not_le_of_gt under
+                            simp [declarationArity, declarationPapSafe,
+                              papSafe, notEnough, Frame.advance,
+                              Frame.pushValue] at transferred
+                            subst target
+                            exact .pappFn noCredits declaration papSafe
+                              resolved under
+                          · have enough : definition.signature.params.size ≤
+                                values.size := Nat.le_of_not_gt under
+                            simp [declarationArity, declarationPapSafe,
+                              papSafe, enough] at transferred
+                  | extern arity =>
+                      by_cases under : values.size < arity
+                      · have notEnough : ¬arity ≤ values.size :=
+                          Nat.not_le_of_gt under
+                        simp [declarationArity, declarationPapSafe,
+                          notEnough, Frame.advance, Frame.pushValue]
+                          at transferred
+                        subst target
+                        exact .pappExtern noCredits declaration resolved under
+                      · have enough : arity ≤ values.size :=
+                          Nat.le_of_not_gt under
+                        simp [declarationArity, declarationPapSafe, enough]
+                          at transferred
+  | apply functionAtom argumentAtoms =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases functionResolved : resolveAtom frame.values functionAtom with
+          | error error => simp [functionResolved] at transferred
+          | ok function =>
+              simp only [functionResolved] at transferred
+              cases argumentsResolved :
+                  resolveAtoms frame.values argumentAtoms with
+              | error error => simp [argumentsResolved] at transferred
+              | ok arguments =>
+                  simp only [argumentsResolved] at transferred
+                  change ApplyTransfer context interpretation store heapFuel
+                    function arguments { frame with pc := frame.pc + 1 }
+                    stack target at transferred
+                  exact .apply noCredits functionResolved argumentsResolved
+                    transferred
+  | extern address arguments =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases resolved : resolveAtoms frame.values arguments with
+          | error error => simp [resolved] at transferred
+          | ok values =>
+              simp only [resolved] at transferred
+              cases declaration : context.declarations address with
+              | none => simp [declaration] at transferred
+              | some declared =>
+                  simp only [declaration] at transferred
+                  cases declared with
+                  | fn definition => simp at transferred
+                  | extern arity =>
+                      by_cases argumentArity : values.size = arity
+                      · cases called : callScalarOracle context address values with
+                        | error error => simp [argumentArity, called] at transferred
+                        | ok value =>
+                            simp [argumentArity, called, Frame.advance,
+                              Frame.pushValue] at transferred
+                            subst target
+                            exact .extern noCredits resolved declaration
+                              argumentArity called
+                      · simp [argumentArity] at transferred
+
+/-- Public equation for the private terminator worker at a canonical running
+machine. -/
+def TerminatorTransfer (context : Context)
+    (interpretation : Interpretation) (store : Store) (heapFuel : Nat)
+    (frame : Frame) (stack : List Continuation) (terminator : Terminator)
+    (target : Machine) : Prop :=
+  runTerminator context interpretation
+    { store, heapFuel, control := .running frame stack }
+    frame stack terminator = .ok target
+
+/-- Every successful runtime shape of one IxIR₂ terminator. -/
+inductive TerminatorTransferCase (context : Context)
+    (interpretation : Interpretation) (store : Store) (heapFuel : Nat)
+    (frame : Frame) : List Continuation → Terminator → Machine → Prop where
+  | jump {stack : List Continuation} {edge : Edge} {target : Frame}
+      (transferred : EdgeTransfer frame edge #[] target) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.jump edge)
+        { store, heapFuel, control := .running target stack }
+  | switchCtor {stack : List Continuation} {scrutinee : Atom}
+      {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+      {location : Nat} {box : NodeBox} {cid : CtorId}
+      {fields : Array RVal} {alternative : CtorAlt} {target : Frame}
+      (resolved : resolveAtom frame.values scrutinee = .ok (.loc location))
+      (boxAt : store.get? location = some box)
+      (node : box.node = .ctorN cid fields)
+      (alternativeAt : constructors.find? (fun candidate =>
+        candidate.cid == cid) = some alternative)
+      (transferred : EdgeTransfer frame alternative.edge #[] target) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.switchValue scrutinee constructors natPeel)
+        { store, heapFuel, control := .running target stack }
+  | switchNatZero {stack : List Continuation} {scrutinee : Atom}
+      {constructors : Array CtorAlt} {peel : NatPeel} {target : Frame}
+      (resolved : resolveAtom frame.values scrutinee =
+        .ok (.lit (.nat 0)))
+      (transferred : EdgeTransfer frame peel.zero #[] target) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.switchValue scrutinee constructors (some peel))
+        { store, heapFuel, control := .running target stack }
+  | switchNatSucc {stack : List Continuation} {scrutinee : Atom}
+      {constructors : Array CtorAlt} {peel : NatPeel} {predecessor : Nat}
+      {target : Frame}
+      (resolved : resolveAtom frame.values scrutinee =
+        .ok (.lit (.nat (predecessor + 1))))
+      (transferred : EdgeTransfer frame peel.succ
+        #[.lit (.nat predecessor)] target) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.switchValue scrutinee constructors (some peel))
+        { store, heapFuel, control := .running target stack }
+  | branchPresent {stack : List Continuation} {creditId : CreditId}
+      {credit : Credit} {someEdge noneEdge : Edge} {target : Frame}
+      (lookedUp : CreditLookup frame creditId credit)
+      (present : credit.isPresent = true)
+      (transferred : EdgeTransfer frame someEdge #[] target) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.branchCredit creditId someEdge noneEdge)
+        { store, heapFuel, control := .running target stack }
+  | branchAbsent {stack : List Continuation} {creditId : CreditId}
+      {credit : Credit} {someEdge noneEdge : Edge} {target : Frame}
+      (lookedUp : CreditLookup frame creditId credit)
+      (absent : credit.isPresent = false)
+      (transferred : EdgeTransfer frame noneEdge #[] target) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.branchCredit creditId someEdge noneEdge)
+        { store, heapFuel, control := .running target stack }
+  | retResume {caller : Frame} {rest : List Continuation}
+      {atom : Atom} {value : RVal}
+      (resolved : resolveAtom frame.values atom = .ok value)
+      (noCredits : NoLiveCredits frame)
+      (world : value.hasWorld store frame.definition.signature.result = true) :
+      TerminatorTransferCase context interpretation store heapFuel frame
+        (.resume caller :: rest) (.ret atom)
+        { store, heapFuel
+          control := .running
+            { caller with values := caller.values.push value } rest }
+  | retHalt {atom : Atom} {value : RVal}
+      (resolved : resolveAtom frame.values atom = .ok value)
+      (noCredits : NoLiveCredits frame)
+      (world : value.hasWorld store frame.definition.signature.result = true) :
+      TerminatorTransferCase context interpretation store heapFuel frame
+        [] (.ret atom) { store, heapFuel, control := .halted value }
+  | retApplyMore {caller : Frame} {arguments : Array RVal}
+      {rest : List Continuation} {atom : Atom} {value : RVal}
+      {target : Machine}
+      (resolved : resolveAtom frame.values atom = .ok value)
+      (noCredits : NoLiveCredits frame)
+      (world : value.hasWorld store frame.definition.signature.result = true)
+      (transferred : ApplyTransfer context interpretation store heapFuel value
+        arguments caller rest target) :
+      TerminatorTransferCase context interpretation store heapFuel frame
+        (.applyMore arguments caller :: rest) (.ret atom) target
+  | tailCallFn {stack : List Continuation} {address : Address}
+      {argumentAtoms : Array Atom} {arguments : Array RVal}
+      {definition : Function}
+      (noCredits : NoLiveCredits frame)
+      (resolved : resolveAtoms frame.values argumentAtoms = .ok arguments)
+      (declaration : context.declarations address = some (.fn definition))
+      (arity : arguments.size = definition.signature.params.size)
+      (nonempty : definition.blocks.isEmpty = false) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.tailCall address argumentAtoms)
+        { store, heapFuel
+          control := .running { definition, values := arguments } stack }
+  | tailCallSelf {stack : List Continuation} {argumentAtoms : Array Atom}
+      {arguments : Array RVal}
+      (noCredits : NoLiveCredits frame)
+      (resolved : resolveAtoms frame.values argumentAtoms = .ok arguments)
+      (arity : arguments.size = frame.definition.signature.params.size)
+      (nonempty : frame.definition.blocks.isEmpty = false) :
+      TerminatorTransferCase context interpretation store heapFuel frame stack
+        (.tailCallSelf argumentAtoms)
+        { store, heapFuel
+          control := .running
+            { definition := frame.definition, values := arguments } stack }
+
+/-- Each classified terminator shape reconstructs the public small step once
+the enclosing terminal position is supplied. -/
+theorem TerminatorTransferCase.step {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation}
+    {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store
+      heapFuel frame stack terminator target)
+    {block : Block}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator) :
+    Step context interpretation
+      { store, heapFuel, control := .running frame stack } target := by
+  cases classified with
+  | jump transferred =>
+      exact Step.jump rfl blockAt pc terminatorAt transferred
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      exact Step.switchCtor rfl blockAt pc terminatorAt resolved boxAt node
+        alternativeAt transferred
+  | switchNatZero resolved transferred =>
+      exact Step.switchNatZero rfl blockAt pc terminatorAt resolved transferred
+  | switchNatSucc resolved transferred =>
+      exact Step.switchNatSucc rfl blockAt pc terminatorAt resolved transferred
+  | branchPresent lookedUp present transferred =>
+      exact Step.branchCreditPresent rfl blockAt pc terminatorAt lookedUp
+        present transferred
+  | branchAbsent lookedUp absent transferred =>
+      exact Step.branchCreditAbsent rfl blockAt pc terminatorAt lookedUp absent
+        transferred
+  | retResume resolved noCredits world =>
+      exact Step.retResumeCleared rfl blockAt pc terminatorAt resolved noCredits
+        world
+  | retHalt resolved noCredits world =>
+      exact Step.retHaltCleared rfl blockAt pc terminatorAt resolved noCredits
+        world
+  | retApplyMore resolved noCredits world transferred =>
+      exact Step.retApplyMoreCleared rfl blockAt pc terminatorAt resolved
+        noCredits world transferred
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      exact Step.tailCallFnCleared rfl blockAt pc terminatorAt noCredits
+        resolved declaration arity nonempty
+  | tailCallSelf noCredits resolved arity nonempty =>
+      exact Step.tailCallSelfCleared rfl blockAt pc terminatorAt noCredits
+        resolved arity nonempty
+
+/-- Invert an arbitrary successful terminator-worker equation into its exact
+runtime case. -/
+theorem TerminatorTransfer.classify {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation}
+    {terminator : Terminator} {target : Machine}
+    (transferred : TerminatorTransfer context interpretation store heapFuel
+      frame stack terminator target) :
+    TerminatorTransferCase context interpretation store heapFuel frame stack
+      terminator target := by
+  unfold TerminatorTransfer runTerminator at transferred
+  simp only [bind, Except.bind, pure, Except.pure] at transferred
+  cases terminator with
+  | jump edge =>
+      cases edgeRun : transferEdge frame edge with
+      | error error => simp [edgeRun] at transferred
+      | ok targetFrame =>
+          simp [edgeRun] at transferred
+          subst target
+          exact .jump edgeRun
+  | switchValue scrutinee constructors natPeel =>
+      cases resolved : resolveAtom frame.values scrutinee with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          cases value with
+          | erased => simp [resolved] at transferred
+          | loc location =>
+              simp only [resolved] at transferred
+              cases boxAt : store.get? location with
+              | none => simp [boxAt] at transferred
+              | some box =>
+                  simp only [boxAt] at transferred
+                  cases node : box.node with
+                  | papN address arity arguments =>
+                      simp [node] at transferred
+                  | ctorN cid fields =>
+                      simp only [node] at transferred
+                      cases alternativeAt : constructors.find?
+                          (fun candidate => candidate.cid == cid) with
+                      | none => simp [alternativeAt] at transferred
+                      | some alternative =>
+                          simp only [alternativeAt] at transferred
+                          cases edgeRun : transferEdge frame alternative.edge with
+                          | error error => simp [edgeRun] at transferred
+                          | ok targetFrame =>
+                              simp [edgeRun] at transferred
+                              subst target
+                              exact .switchCtor resolved boxAt node alternativeAt
+                                edgeRun
+          | lit literal =>
+              cases literal with
+              | str string => simp [resolved] at transferred
+              | nat number =>
+                  cases natPeel with
+                  | none => simp [resolved] at transferred
+                  | some peel =>
+                      cases number with
+                      | zero =>
+                          simp only [resolved] at transferred
+                          cases edgeRun : transferEdge frame peel.zero with
+                          | error error => simp [edgeRun] at transferred
+                          | ok targetFrame =>
+                              simp [edgeRun] at transferred
+                              subst target
+                              exact .switchNatZero resolved edgeRun
+                      | succ predecessor =>
+                          simp only [resolved] at transferred
+                          cases edgeRun : transferEdge frame peel.succ
+                              #[.lit (.nat predecessor)] with
+                          | error error => simp [edgeRun] at transferred
+                          | ok targetFrame =>
+                              simp [edgeRun] at transferred
+                              subst target
+                              exact .switchNatSucc resolved edgeRun
+  | branchCredit creditId someEdge noneEdge =>
+      cases lookedUp : creditAt frame creditId with
+      | error error => simp [lookedUp] at transferred
+      | ok credit =>
+          simp only [lookedUp] at transferred
+          cases present : credit.isPresent with
+          | false =>
+              cases edgeRun : transferEdge frame noneEdge with
+              | error error => simp [present, edgeRun] at transferred
+              | ok targetFrame =>
+                  simp [present, edgeRun] at transferred
+                  subst target
+                  exact .branchAbsent lookedUp present edgeRun
+          | true =>
+              cases edgeRun : transferEdge frame someEdge with
+              | error error => simp [present, edgeRun] at transferred
+              | ok targetFrame =>
+                  simp [present, edgeRun] at transferred
+                  subst target
+                  exact .branchPresent lookedUp present edgeRun
+  | ret atom =>
+      cases resolved : resolveAtom frame.values atom with
+      | error error => simp [resolved] at transferred
+      | ok value =>
+          simp only [resolved] at transferred
+          unfold finishReturn at transferred
+          simp only [pure, Except.pure] at transferred
+          cases live : frame.hasCredits with
+          | true => simp [live] at transferred
+          | false =>
+              have noCredits : NoLiveCredits frame := by
+                simpa [NoLiveCredits, Frame.hasCredits] using live
+              simp only [live, Bool.false_eq_true, ↓reduceIte] at transferred
+              cases world : value.hasWorld store
+                  frame.definition.signature.result with
+              | false => simp [world] at transferred
+              | true =>
+                  simp only [world, Bool.not_true, Bool.false_eq_true,
+                    ↓reduceIte] at transferred
+                  cases stack with
+                  | nil =>
+                      simp at transferred
+                      subst target
+                      exact .retHalt resolved noCredits world
+                  | cons continuation rest =>
+                      cases continuation with
+                      | resume caller =>
+                          simp [Frame.pushValue] at transferred
+                          subst target
+                          exact .retResume resolved noCredits world
+                      | applyMore arguments caller =>
+                          change ApplyTransfer context interpretation store
+                            heapFuel value arguments caller rest target
+                            at transferred
+                          exact .retApplyMore resolved noCredits world
+                            transferred
+  | tailCall address argumentAtoms =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases resolved : resolveAtoms frame.values argumentAtoms with
+          | error error => simp [resolved] at transferred
+          | ok arguments =>
+              simp only [resolved] at transferred
+              cases declaration : context.declarations address with
+              | none => simp [declaration] at transferred
+              | some declared =>
+                  simp only [declaration] at transferred
+                  cases declared with
+                  | extern arity => simp at transferred
+                  | fn definition =>
+                      by_cases arity :
+                          arguments.size = definition.signature.params.size
+                      · cases empty : definition.blocks.isEmpty with
+                        | true =>
+                            simp [enterFunction, arity, empty] at transferred
+                        | false =>
+                            simp [enterFunction, arity, empty] at transferred
+                            subst target
+                            exact .tailCallFn noCredits resolved declaration
+                              arity empty
+                      · simp [enterFunction, arity] at transferred
+  | tailCallSelf argumentAtoms =>
+      cases live : frame.hasCredits with
+      | true => simp [ensureCallBoundary, live] at transferred
+      | false =>
+          have noCredits : NoLiveCredits frame := by
+            simpa [NoLiveCredits, Frame.hasCredits] using live
+          simp only [ensureCallBoundary, live, Bool.false_eq_true,
+            ↓reduceIte, pure, Except.pure] at transferred
+          cases resolved : resolveAtoms frame.values argumentAtoms with
+          | error error => simp [resolved] at transferred
+          | ok arguments =>
+              simp only [resolved] at transferred
+              by_cases arity :
+                  arguments.size = frame.definition.signature.params.size
+              · cases empty : frame.definition.blocks.isEmpty with
+                | true => simp [enterFunction, arity, empty] at transferred
+                | false =>
+                    simp [enterFunction, arity, empty] at transferred
+                    subst target
+                    exact .tailCallSelf noCredits resolved arity empty
+              · simp [enterFunction, arity] at transferred
+
+/-- Exhaustive successful shapes of the public one-step evaluator. -/
+inductive StepCase (context : Context) (interpretation : Interpretation) :
+    Machine → Machine → Prop where
+  | halted {store : Store} {heapFuel : Nat} {value : RVal} :
+      StepCase context interpretation
+        { store, heapFuel, control := .halted value }
+        { store, heapFuel, control := .halted value }
+  | instruction {store : Store} {heapFuel : Nat} {frame : Frame}
+      {stack : List Continuation} {block : Block} {instruction : Instr}
+      {target : Machine}
+      (blockAt : frame.definition.blocks[frame.block]? = some block)
+      (pc : frame.pc < block.instructions.size)
+      (instructionAt : block.instructions[frame.pc] = instruction)
+      (classified : InstructionTransferCase context interpretation store
+        heapFuel frame stack instruction target) :
+      StepCase context interpretation
+        { store, heapFuel, control := .running frame stack } target
+  | terminator {store : Store} {heapFuel : Nat} {frame : Frame}
+      {stack : List Continuation} {block : Block} {terminator : Terminator}
+      {target : Machine}
+      (blockAt : frame.definition.blocks[frame.block]? = some block)
+      (pc : frame.pc = block.instructions.size)
+      (terminatorAt : block.terminator = terminator)
+      (classified : TerminatorTransferCase context interpretation store
+        heapFuel frame stack terminator target) :
+      StepCase context interpretation
+        { store, heapFuel, control := .running frame stack } target
+
+/-- Every classified whole-step shape reconstructs the public evaluator
+equation. -/
+theorem StepCase.step {context : Context} {interpretation : Interpretation}
+    {before after : Machine}
+    (classified : StepCase context interpretation before after) :
+    Step context interpretation before after := by
+  cases classified with
+  | halted => rfl
+  | instruction blockAt pc instructionAt instructionCase =>
+      exact instructionCase.step blockAt pc instructionAt
+  | terminator blockAt pc terminatorAt terminatorCase =>
+      exact terminatorCase.step blockAt pc terminatorAt
+
+/-- Every successful public step is either the halted self-step, one exact
+instruction runtime shape, or one exact terminator runtime shape. -/
+theorem Step.classify {context : Context} {interpretation : Interpretation}
+    {before after : Machine}
+    (stepped : Step context interpretation before after) :
+    StepCase context interpretation before after := by
+  unfold Step step at stepped
+  cases before with
+  | mk store heapFuel control =>
+      cases control with
+      | halted value =>
+          change Except.ok
+            { store, heapFuel, control := .halted value } = .ok after
+            at stepped
+          injection stepped with afterEq
+          subst after
+          exact .halted
+      | running frame stack =>
+          unfold currentBlock at stepped
+          cases blockAt : frame.definition.blocks[frame.block]? with
+          | none =>
+              simp [blockAt, bind, Except.bind] at stepped
+          | some block =>
+              simp only [blockAt, bind, Except.bind]
+                at stepped
+              by_cases pc : frame.pc < block.instructions.size
+              · rw [dif_pos pc] at stepped
+                change InstructionTransfer context interpretation store
+                  heapFuel frame stack block.instructions[frame.pc] after
+                  at stepped
+                exact .instruction blockAt pc rfl stepped.classify
+              · rw [dif_neg pc] at stepped
+                by_cases terminal : frame.pc = block.instructions.size
+                · have terminalBool :
+                      (frame.pc == block.instructions.size) = true :=
+                    beq_iff_eq.mpr terminal
+                  rw [terminalBool] at stepped
+                  change TerminatorTransfer context interpretation store
+                    heapFuel frame stack block.terminator after at stepped
+                  exact .terminator blockAt terminal rfl stepped.classify
+                · have terminalBool :
+                      (frame.pc == block.instructions.size) = false :=
+                    Bool.eq_false_iff.mpr (by
+                      intro equal
+                      exact terminal (beq_iff_eq.mp equal))
+                  rw [terminalBool] at stepped
+                  simp at stepped
+
+/-- A finite sequence of genuine running-state transitions.  Requiring the
+source of each transition to be running prevents the evaluator's halted
+self-step from pretending to consume control fuel. -/
+inductive Steps (context : Context) (interpretation : Interpretation) :
+    Nat → Machine → Machine → Prop where
+  | refl (machine : Machine) : Steps context interpretation 0 machine machine
+  | cons {count : Nat} {before middle after : Machine}
+      {frame : Frame} {stack : List Continuation}
+      (running : before.control = .running frame stack)
+      (head : Step context interpretation before middle)
+      (tail : Steps context interpretation count middle after) :
+      Steps context interpretation (Nat.succ count) before after
+
+/-- One running small step is a one-element finite execution. -/
+theorem Step.toSteps {context : Context} {interpretation : Interpretation}
+    {before after : Machine} {frame : Frame} {stack : List Continuation}
+    (running : before.control = .running frame stack)
+    (step : Step context interpretation before after) :
+    Steps context interpretation 1 before after :=
+  .cons running step (.refl after)
+
+/-- The evaluator's one-step relation is deterministic because it is the
+successful graph of the executable `step` function. -/
+theorem Step.deterministic {context : Context}
+    {interpretation : Interpretation} {before left right : Machine}
+    (leftStep : Step context interpretation before left)
+    (rightStep : Step context interpretation before right) :
+    left = right := by
+  exact Except.ok.inj (leftStep.symm.trans rightStep)
+
+/-- Finite executions compose and their exact step counts add. -/
+theorem Steps.trans {context : Context} {interpretation : Interpretation}
+    {firstCount secondCount : Nat} {before middle after : Machine}
+    (first : Steps context interpretation firstCount before middle)
+    (second : Steps context interpretation secondCount middle after) :
+    Steps context interpretation (firstCount + secondCount) before after := by
+  induction first with
+  | refl => simpa using second
+  | cons running head tail ih =>
+      simpa only [Nat.succ_add] using
+        (Steps.cons running head (ih second))
+
+/-- Any finite prefix of an execution that eventually halts can be cancelled
+from the unique execution path.  In particular the prefix cannot run past the
+halted endpoint, because `Steps` admits transitions only from running states. -/
+theorem Steps.cancelPrefixToHalted {context : Context}
+    {interpretation : Interpretation}
+    {prefixCount totalCount : Nat} {before middle final : Machine}
+    {store : Store} {heapFuel : Nat} {value : RVal}
+    (prefixSteps : Steps context interpretation prefixCount before middle)
+    (total : Steps context interpretation totalCount before final)
+    (halted : final = { store, heapFuel, control := .halted value }) :
+    ∃ suffixCount,
+      totalCount = prefixCount + suffixCount ∧
+        Steps context interpretation suffixCount middle final := by
+  induction prefixSteps generalizing totalCount final with
+  | refl machine =>
+      exact ⟨totalCount, by simp, total⟩
+  | @cons prefixCount before prefixMiddle middle frame stack running head tail
+      ih =>
+      cases total with
+      | refl =>
+          have controls : Control.running frame stack = .halted value := by
+            rw [← running]
+            exact congrArg Machine.control halted
+          contradiction
+      | @cons totalCount _ totalMiddle final totalFrame totalStack
+          totalRunning totalHead totalTail =>
+          have middleEq : prefixMiddle = totalMiddle :=
+            head.deterministic totalHead
+          subst totalMiddle
+          obtain ⟨suffixCount, countEq, suffix⟩ :=
+            ih totalTail halted
+          exact ⟨suffixCount, by omega, suffix⟩
+
+/-- Total runner with a control budget independent of `Machine.heapFuel`. -/
+def runMachine (context : Context) (interpretation : Interpretation) :
+    Nat → Machine → Except Error Result
+  | controlFuel, { store, heapFuel, control := .halted value } =>
+      let result : Result :=
+        { store := store
+          value := value
+          controlRemaining := controlFuel
+          heapRemaining := heapFuel }
+      .ok result
+  | 0, { store := _, heapFuel := _, control := .running .. } =>
+      .error .controlFuel
+  | controlFuel + 1,
+      machine@{ store := _, heapFuel := _, control := .running .. } => do
+      let machine ← step context interpretation machine
+      runMachine context interpretation controlFuel machine
+
+/-- Exact machine state from which `runFunction` starts after its entry checks
+succeed. Keeping this constructor public lets compiler simulations connect a
+certified entry block to the finite-step runner without unfolding private
+evaluator helpers. -/
+def initialMachine (definition : Function) (arguments : Array RVal)
+    (heapFuel : Nat) (store : Store := {}) : Machine :=
+  { store := store.withPeak
+    heapFuel
+    control := .running { definition, values := arguments } [] }
+
+/-- A fresh initial machine has the literal empty target store; peak tracking
+does not perturb it. -/
+@[simp] theorem initialMachine_store_empty (definition : Function)
+    (arguments : Array RVal) (heapFuel : Nat) :
+    (initialMachine definition arguments heapFuel).store = ({} : Store) := by
+  rfl
+
+def runFunction (context : Context) (interpretation : Interpretation)
+    (definition : Function) (arguments : Array RVal) (controlFuel heapFuel : Nat)
+    (store : Store := {}) : Except Error Result := do
+  let frame ← enterFunction definition arguments
+  runMachine context interpretation controlFuel
+    { store := store.withPeak, heapFuel, control := .running frame [] }
+
+/-- Public reduction of a successful function-entry check to the exact
+initial machine. -/
+theorem runFunction_eq_runMachine {context : Context}
+    {interpretation : Interpretation} {definition : Function}
+    {arguments : Array RVal} {controlFuel heapFuel : Nat} {store : Store}
+    (arity : arguments.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    runFunction context interpretation definition arguments controlFuel
+        heapFuel store =
+      runMachine context interpretation controlFuel
+        (initialMachine definition arguments heapFuel store) := by
+  simp [runFunction, initialMachine, enterFunction, arity, nonempty]
+  rfl
+
+def runMain (context : Context) (interpretation : Interpretation)
+    (program : Program) (controlFuel : Nat := 100000)
+    (heapFuel : Nat := 100000) : Except Error Result :=
+  runFunction context interpretation program.main #[] controlFuel heapFuel
+
+/-- Public main-entry specialization of `runFunction_eq_runMachine`. -/
+theorem runMain_eq_runMachine {context : Context}
+    {interpretation : Interpretation} {program : Program}
+    {controlFuel heapFuel : Nat}
+    (arity : program.main.signature.params.size = 0)
+    (nonempty : program.main.blocks.isEmpty = false) :
+    runMain context interpretation program controlFuel heapFuel =
+      runMachine context interpretation controlFuel
+        (initialMachine program.main #[] heapFuel) := by
+  unfold runMain
+  apply runFunction_eq_runMachine
+  · simpa using arity.symm
+  · exact nonempty
+
+/-- Running a finite execution prefix spends exactly its step count from the
+control budget and leaves evaluation of the suffix unchanged. -/
+theorem Steps.runMachine {context : Context}
+    {interpretation : Interpretation} {count controlFuel : Nat}
+    {before after : Machine}
+    (steps : Steps context interpretation count before after) :
+    Ix.Compiler.IxIR2.Eval.runMachine context interpretation
+        (count + controlFuel) before =
+      Ix.Compiler.IxIR2.Eval.runMachine context interpretation
+        controlFuel after := by
+  induction steps with
+  | refl => simp only [Nat.zero_add]
+  | @cons count before middle after frame stack running head tail ih =>
+      rw [Nat.succ_add]
+      cases before with
+      | mk store heapFuel beforeControl =>
+          simp only at running
+          subst beforeControl
+          simp only [Ix.Compiler.IxIR2.Eval.runMachine]
+          rw [head]
+          simp only [bind, Except.bind]
+          exact ih
+
+/-- A finite execution ending in a halt gives an exact successful runner
+witness with no unused control fuel. -/
+theorem Steps.runMachine_halted {context : Context}
+    {interpretation : Interpretation} {count : Nat}
+    {before : Machine} {store : Store} {heapFuel : Nat} {value : RVal}
+    (steps : Steps context interpretation count before
+      { store, heapFuel, control := .halted value }) :
+    Ix.Compiler.IxIR2.Eval.runMachine context interpretation count before =
+      .ok
+        { store
+          value
+          controlRemaining := 0
+          heapRemaining := heapFuel } := by
+  simpa [Ix.Compiler.IxIR2.Eval.runMachine] using
+    (steps.runMachine (controlFuel := 0))
+
+/-- A successful runner exposes its exact finite execution and the unused
+control budget. The execution stops at the reported halted store and value. -/
+theorem runMachine_steps {context : Context} {interpretation : Interpretation}
+    {controlFuel : Nat} {machine : Machine} {result : Result}
+    (run : runMachine context interpretation controlFuel machine = .ok result) :
+    ∃ count,
+      controlFuel = count + result.controlRemaining ∧
+        Steps context interpretation count machine
+          { store := result.store
+            heapFuel := result.heapRemaining
+            control := .halted result.value } := by
+  induction controlFuel generalizing machine with
+  | zero =>
+      rcases machine with ⟨store, heapFuel, control⟩
+      cases control with
+      | halted value =>
+          simp only [runMachine, Except.ok.injEq] at run
+          subst result
+          exact ⟨0, by simp, .refl _⟩
+      | running frame stack => cases run
+  | succ controlFuel ih =>
+      rcases machine with ⟨store, heapFuel, control⟩
+      cases control with
+      | halted value =>
+          simp only [runMachine, Except.ok.injEq] at run
+          subst result
+          exact ⟨0, by simp, .refl _⟩
+      | running frame stack =>
+          simp only [runMachine] at run
+          cases stepped : step context interpretation
+              { store, heapFuel, control := .running frame stack } with
+          | error error => simp [stepped, bind, Except.bind] at run
+          | ok next =>
+              simp only [stepped, bind, Except.bind] at run
+              obtain ⟨count, budget, steps⟩ := ih run
+              exact ⟨count + 1, by omega, .cons rfl stepped steps⟩
+
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/EvalCounter.lean b/Ix/Compiler/IxIR2/EvalCounter.lean
new file mode 100644
index 000000000..6fae3ffc6
--- /dev/null
+++ b/Ix/Compiler/IxIR2/EvalCounter.lean
@@ -0,0 +1,273 @@
+import Ix.Compiler.IxIR1.Sim
+import Ix.Compiler.IxIR2.Eval
+
+/-!
+# IxIR₂ credit-counter algebra
+
+`CounterLaw` is the numeric projection of the logical/physical heap relation.
+The local lemmas below cover every operation that can change the number of
+present credits.  They are intentionally independent of a particular CFG;
+the later heap-isomorphism simulation composes these deltas along machine
+steps.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+/-! ## Credit-local heap relation -/
+
+/-- Runtime credits agree in layout and presence.  A present physical credit
+additionally owns an actual empty in-bounds slot; the logical credit carries
+layout only because its corresponding node has already been freed. -/
+inductive CreditIso (physical : Store) : Option Credit → Option Credit → Prop
+  | consumed : CreditIso physical none none
+  | absent (layout : LayoutId) :
+      CreditIso physical
+        (some { layout, presence := .absent })
+        (some { layout, presence := .absent })
+  | present (layout : LayoutId) (slot : Nat)
+      (reserved : (physical.heap.nodes)[slot]? = some none) :
+      CreditIso physical
+        (some { layout, presence := .present none })
+        (some { layout, presence := .present (some slot) })
+
+inductive CreditsIso (physical : Store) :
+    List (Option Credit) → List (Option Credit) → Prop
+  | nil : CreditsIso physical [] []
+  | cons {logicalCredit physicalCredit logicalCredits physicalCredits} :
+      CreditIso physical logicalCredit physicalCredit →
+      CreditsIso physical logicalCredits physicalCredits →
+      CreditsIso physical (logicalCredit :: logicalCredits)
+        (physicalCredit :: physicalCredits)
+
+/-- Counter state plus the derived live-node observation. -/
+structure Snapshot where
+  counters : Counters
+  live : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Store.snapshot (store : Store) : Snapshot :=
+  { counters := store.counters, live := store.live }
+
+/-- The advertised intermediate relation, extended with the reset observations
+that both interpretations share. -/
+structure CounterLaw (logical physical : Snapshot) (presentCredits : Nat) :
+    Prop where
+  allocs : logical.counters.allocs =
+    physical.counters.allocs + physical.counters.reuses
+  frees : logical.counters.frees =
+    physical.counters.frees + physical.counters.reuses + presentCredits
+  rcops : logical.counters.rcops = physical.counters.rcops
+  live : logical.live = physical.live
+  resetAttempts : logical.counters.resetAttempts =
+    physical.counters.resetAttempts
+  hotResets : logical.counters.hotResets = physical.counters.hotResets
+  coldResets : logical.counters.coldResets = physical.counters.coldResets
+
+instance (logical physical : Snapshot) (presentCredits : Nat) :
+    Decidable (CounterLaw logical physical presentCredits) :=
+  if allocs : logical.counters.allocs =
+      physical.counters.allocs + physical.counters.reuses then
+    if frees : logical.counters.frees =
+        physical.counters.frees + physical.counters.reuses + presentCredits then
+      if rcops : logical.counters.rcops = physical.counters.rcops then
+        if live : logical.live = physical.live then
+          if attempts : logical.counters.resetAttempts =
+              physical.counters.resetAttempts then
+            if hot : logical.counters.hotResets = physical.counters.hotResets then
+              if cold : logical.counters.coldResets =
+                  physical.counters.coldResets then
+                isTrue ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+              else isFalse fun relation => cold relation.coldResets
+            else isFalse fun relation => hot relation.hotResets
+          else isFalse fun relation => attempts relation.resetAttempts
+        else isFalse fun relation => live relation.live
+      else isFalse fun relation => rcops relation.rcops
+    else isFalse fun relation => frees relation.frees
+  else isFalse fun relation => allocs relation.allocs
+
+/-- The interface used by the later logical/physical step simulation: a live
+heap bijection, pointwise credit authority, and the numeric counter law. -/
+structure CreditHeapIso (logical physical : Store)
+    (logicalCredits physicalCredits : Array (Option Credit)) where
+  heap : IxIR1.Sim.HeapIso logical.heap physical.heap
+  credits : CreditsIso physical logicalCredits.toList physicalCredits.toList
+  counters : CounterLaw logical.snapshot physical.snapshot
+    (creditPresentCount physicalCredits)
+
+namespace Snapshot
+
+def logicalTake (state : Snapshot) : Snapshot :=
+  { state with
+    counters := { state.counters with frees := state.counters.frees + 1 }
+    live := state.live - 1 }
+
+def physicalTake (state : Snapshot) : Snapshot :=
+  { state with live := state.live - 1 }
+
+def logicalHotReset (state : Snapshot) : Snapshot :=
+  { logicalTake state with
+    counters :=
+      { (logicalTake state).counters with
+        resetAttempts := state.counters.resetAttempts + 1
+        hotResets := state.counters.hotResets + 1 } }
+
+def physicalHotReset (state : Snapshot) : Snapshot :=
+  { physicalTake state with
+    counters :=
+      { (physicalTake state).counters with
+        resetAttempts := state.counters.resetAttempts + 1
+        hotResets := state.counters.hotResets + 1 } }
+
+def logicalReuse (state : Snapshot) : Snapshot :=
+  { state with
+    counters := { state.counters with allocs := state.counters.allocs + 1 }
+    live := state.live + 1 }
+
+def physicalReuse (state : Snapshot) (payloadUnits : Nat) : Snapshot :=
+  { state with
+    counters :=
+      { state.counters with
+        reuses := state.counters.reuses + 1
+        reusedPayloadUnits := state.counters.reusedPayloadUnits + payloadUnits }
+    live := state.live + 1 }
+
+def logicalDiscard (state : Snapshot) : Snapshot := state
+
+def physicalDiscard (state : Snapshot) : Snapshot :=
+  { state with
+    counters := { state.counters with frees := state.counters.frees + 1 } }
+
+def freshAlloc (state : Snapshot) : Snapshot :=
+  { state with
+    counters := { state.counters with allocs := state.counters.allocs + 1 }
+    live := state.live + 1 }
+
+def coldReset (state : Snapshot) (rcDelta : Nat) : Snapshot :=
+  { state with
+    counters :=
+      { state.counters with
+        rcops := state.counters.rcops + rcDelta
+        resetAttempts := state.counters.resetAttempts + 1
+        coldResets := state.counters.coldResets + 1 } }
+
+end Snapshot
+
+namespace CounterLaw
+
+theorem empty : CounterLaw (default : Snapshot) (default : Snapshot) 0 := by
+  constructor <;> rfl
+
+theorem afterTake {logical physical : Snapshot} {presentCredits : Nat}
+    (relation : CounterLaw logical physical presentCredits) :
+    CounterLaw logical.logicalTake physical.physicalTake
+      (presentCredits + 1) := by
+  rcases relation with ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+  constructor
+  · exact allocs
+  · simp only [Snapshot.logicalTake, Snapshot.physicalTake]
+    omega
+  · exact rcops
+  · simp only [Snapshot.logicalTake, Snapshot.physicalTake]
+    omega
+  · exact attempts
+  · exact hot
+  · exact cold
+
+theorem afterHotReset {logical physical : Snapshot} {presentCredits : Nat}
+    (relation : CounterLaw logical physical presentCredits) :
+    CounterLaw logical.logicalHotReset physical.physicalHotReset
+      (presentCredits + 1) := by
+  rcases relation with ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+  constructor
+  · exact allocs
+  · simp only [Snapshot.logicalHotReset, Snapshot.physicalHotReset,
+      Snapshot.logicalTake, Snapshot.physicalTake]
+    omega
+  · exact rcops
+  · simp only [Snapshot.logicalHotReset, Snapshot.physicalHotReset,
+      Snapshot.logicalTake, Snapshot.physicalTake]
+    omega
+  · simp only [Snapshot.logicalHotReset, Snapshot.physicalHotReset,
+      Snapshot.logicalTake, Snapshot.physicalTake]
+    omega
+  · simp only [Snapshot.logicalHotReset, Snapshot.physicalHotReset,
+      Snapshot.logicalTake, Snapshot.physicalTake]
+    omega
+  · exact cold
+
+theorem afterReuse {logical physical : Snapshot} {presentCredits : Nat}
+    (payloadUnits : Nat)
+    (relation : CounterLaw logical physical (presentCredits + 1)) :
+    CounterLaw logical.logicalReuse (physical.physicalReuse payloadUnits)
+      presentCredits := by
+  rcases relation with ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+  constructor
+  · simp only [Snapshot.logicalReuse, Snapshot.physicalReuse]
+    omega
+  · simp only [Snapshot.logicalReuse, Snapshot.physicalReuse]
+    omega
+  · exact rcops
+  · simp only [Snapshot.logicalReuse, Snapshot.physicalReuse]
+    omega
+  · exact attempts
+  · exact hot
+  · exact cold
+
+theorem afterDiscard {logical physical : Snapshot} {presentCredits : Nat}
+    (relation : CounterLaw logical physical (presentCredits + 1)) :
+    CounterLaw logical.logicalDiscard physical.physicalDiscard
+      presentCredits := by
+  rcases relation with ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+  constructor
+  · exact allocs
+  · simp only [Snapshot.logicalDiscard, Snapshot.physicalDiscard]
+    omega
+  · exact rcops
+  · exact live
+  · exact attempts
+  · exact hot
+  · exact cold
+
+theorem afterFreshAlloc {logical physical : Snapshot} {presentCredits : Nat}
+    (relation : CounterLaw logical physical presentCredits) :
+    CounterLaw logical.freshAlloc physical.freshAlloc presentCredits := by
+  rcases relation with ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+  constructor
+  · simp only [Snapshot.freshAlloc]
+    omega
+  · simpa only [Snapshot.freshAlloc] using frees
+  · exact rcops
+  · simp only [Snapshot.freshAlloc]
+    omega
+  · exact attempts
+  · exact hot
+  · exact cold
+
+theorem afterColdReset {logical physical : Snapshot} {presentCredits rcDelta : Nat}
+    (relation : CounterLaw logical physical presentCredits) :
+    CounterLaw (logical.coldReset rcDelta) (physical.coldReset rcDelta)
+      presentCredits := by
+  rcases relation with ⟨allocs, frees, rcops, live, attempts, hot, cold⟩
+  constructor
+  · exact allocs
+  · exact frees
+  · simp only [Snapshot.coldReset]
+    omega
+  · exact live
+  · simp only [Snapshot.coldReset]
+    omega
+  · exact hot
+  · simp only [Snapshot.coldReset]
+    omega
+
+/-- At a validated terminal state there are no present credits, yielding the
+terminal free equation directly. -/
+theorem terminalFrees {logical physical : Snapshot}
+    (relation : CounterLaw logical physical 0) :
+    logical.counters.frees =
+      physical.counters.frees + physical.counters.reuses := by
+  simpa using relation.frees
+
+end CounterLaw
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/EvalExamples.lean b/Ix/Compiler/IxIR2/EvalExamples.lean
new file mode 100644
index 000000000..6705618ee
--- /dev/null
+++ b/Ix/Compiler/IxIR2/EvalExamples.lean
@@ -0,0 +1,388 @@
+import Ix.Compiler.IxIR2.EvalCounter
+
+/-!
+# Executable IxIR₂ logical/physical witnesses
+
+The fixtures run the same validated programs under both interpretations.  They
+pin the intermediate present-credit equation, terminal reuse/discard laws,
+hot and cold reset decisions, and the separation of control from recursive
+heap-traversal fuel.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval.Examples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+private def blockAddress : Address := Address.replicate 0x61
+private def layout : LayoutId := Address.replicate 0x62
+private def functionAddress : Address := Address.replicate 0x63
+
+private def nodeCtor : CtorId :=
+  { block := blockAddress, indIdx := 0, cidx := 0 }
+
+private def schemas : Owned → CtorId → Option CtorSchema
+  | .unique, cid =>
+      if cid == nodeCtor then
+        some { layout, fields := #[.unique] }
+      else
+        none
+  | .shared, cid =>
+      if cid == nodeCtor then
+        some { layout, fields := #[.shared] }
+      else
+        none
+
+private def signature (result : Owned) : Signature :=
+  { params := #[], result, papSafe := false }
+
+private def validationContext : Validate.Context := { schemas }
+
+private def validates (program : Program) : Bool :=
+  match Validate.validate validationContext program with
+  | .ok _ => true
+  | .error _ => false
+
+private def run (interpretation : Interpretation) (program : Program)
+    (controlFuel : Nat := 100) (heapFuel : Nat := 100) : Except Error Result :=
+  runMain (Context.ofProgram program schemas) interpretation program
+    controlFuel heapFuel
+
+private def lawHolds (logical physical : Store) (presentCredits : Nat) : Bool :=
+  let left := logical.counters
+  let right := physical.counters
+  left.allocs == right.allocs + right.reuses &&
+    left.frees == right.frees + right.reuses + presentCredits &&
+    left.rcops == right.rcops &&
+    logical.live == physical.live &&
+    left.resetAttempts == right.resetAttempts &&
+    left.hotResets == right.hotResets &&
+    left.coldResets == right.coldResets
+
+private def returnedCtor (result : Result) : Option (CtorId × Array RVal) :=
+  match result.value with
+  | .loc location =>
+      match result.store.get? location with
+      | some { node := .ctorN cid fields, .. } => some (cid, fields)
+      | _ => none
+  | _ => none
+
+private def sameCtorResult (left right : Result) : Bool :=
+  returnedCtor left == returnedCtor right
+
+/-! ## Unique required-credit reuse -/
+
+private def uniqueReuse : Program :=
+  { declarations := []
+    main :=
+      { signature := signature .unique
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .unique nodeCtor #[.lit (.nat 7)],
+              .takeUnique (.reg 0) nodeCtor,
+              .allocWith 0 .unique nodeCtor #[.reg 1]]
+            terminator := .ret (.reg 2) }] } }
+
+#guard validates uniqueReuse
+
+private def uniqueLogical := run .logical uniqueReuse 4 0
+private def uniquePhysical := run .physical uniqueReuse 4 0
+
+#guard match uniqueLogical, uniquePhysical with
+  | .ok logical, .ok physical =>
+      sameCtorResult logical physical &&
+        logical.controlRemaining == 0 && physical.controlRemaining == 0 &&
+        logical.heapRemaining == 0 && physical.heapRemaining == 0 &&
+        logical.store.counters.allocs == 2 &&
+        logical.store.counters.frees == 1 &&
+        logical.store.counters.reuses == 0 &&
+        physical.store.counters.allocs == 1 &&
+        physical.store.counters.frees == 0 &&
+        physical.store.counters.reuses == 1 &&
+        physical.store.counters.reusedPayloadUnits == 1 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+/-! The state after `takeUnique` has one present credit and already satisfies
+the intermediate equation. -/
+
+private def initialMachine (program : Program) : Machine :=
+  { heapFuel := 0
+    control := .running { definition := program.main } [] }
+
+private def stepToTake (interpretation : Interpretation) : Except Error Machine := do
+  let context := Context.ofProgram uniqueReuse schemas
+  let first ← step context interpretation (initialMachine uniqueReuse)
+  step context interpretation first
+
+private def afterTakeLogical := stepToTake .logical
+private def afterTakePhysical := stepToTake .physical
+
+#guard match afterTakeLogical, afterTakePhysical with
+  | .ok logical, .ok physical =>
+      logical.presentCredits == 1 && physical.presentCredits == 1 &&
+        logical.store.live == 0 && physical.store.live == 0 &&
+        physical.store.live + physical.store.counters.frees + physical.presentCredits ==
+          physical.store.counters.allocs &&
+        lawHolds logical.store physical.store physical.presentCredits
+  | _, _ => false
+
+/-! ## Credit discard -/
+
+private def uniqueDiscard : Program :=
+  { declarations := []
+    main :=
+      { signature := signature .unique
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .unique nodeCtor #[.lit (.nat 9)],
+              .takeUnique (.reg 0) nodeCtor,
+              .discardCredit 0]
+            terminator := .ret (.reg 1) }] } }
+
+#guard validates uniqueDiscard
+
+#guard match run .logical uniqueDiscard 4 0, run .physical uniqueDiscard 4 0 with
+  | .ok logical, .ok physical =>
+      logical.value == physical.value &&
+        logical.store.counters.allocs == 1 &&
+        physical.store.counters.allocs == 1 &&
+        logical.store.counters.frees == 1 &&
+        physical.store.counters.frees == 1 &&
+        logical.store.counters.reuses == 0 &&
+        physical.store.counters.reuses == 0 &&
+        logical.store.live == 0 && physical.store.live == 0 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+/-! ## Hot shared reset and optional-credit branching -/
+
+private def hotReset : Program :=
+  { declarations := []
+    main :=
+      { signature := signature .shared
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .shared nodeCtor #[.lit (.nat 11)],
+              .resetShared (.reg 0) nodeCtor]
+            terminator := .branchCredit 0
+              { target := 1, values := #[.reg 1], credits := #[0] }
+              { target := 2, values := #[.reg 1], credits := #[0] } },
+          { valueParams := #[.owned .shared]
+            creditParams := #[.required layout]
+            instructions := #[.allocWith 0 .shared nodeCtor #[.reg 0]]
+            terminator := .ret (.reg 1) },
+          { valueParams := #[.owned .shared]
+            creditParams := #[.optional layout]
+            instructions := #[.allocWith 0 .shared nodeCtor #[.reg 0]]
+            terminator := .ret (.reg 1) }] } }
+
+#guard validates hotReset
+
+#guard match run .logical hotReset 5 0, run .physical hotReset 5 0 with
+  | .ok logical, .ok physical =>
+      sameCtorResult logical physical &&
+        logical.store.counters.resetAttempts == 1 &&
+        physical.store.counters.resetAttempts == 1 &&
+        logical.store.counters.hotResets == 1 &&
+        physical.store.counters.hotResets == 1 &&
+        logical.store.counters.coldResets == 0 &&
+        physical.store.counters.coldResets == 0 &&
+        physical.store.counters.reuses == 1 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+/-! ## Cold shared reset -/
+
+private def coldReset : Program :=
+  { declarations := []
+    main :=
+      { signature := signature .shared
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .shared nodeCtor #[.lit (.nat 13)],
+              .retainShared (.reg 0),
+              .resetShared (.reg 0) nodeCtor]
+            terminator := .branchCredit 0
+              { target := 1, values := #[.reg 1, .reg 2], credits := #[0] }
+              { target := 2, values := #[.reg 1, .reg 2], credits := #[0] } },
+          { valueParams := #[.owned .shared, .owned .shared]
+            creditParams := #[.required layout]
+            instructions := #[
+              .allocWith 0 .shared nodeCtor #[.reg 1],
+              .releaseShared (.reg 0)]
+            terminator := .ret (.reg 2) },
+          { valueParams := #[.owned .shared, .owned .shared]
+            creditParams := #[.optional layout]
+            instructions := #[
+              .allocWith 0 .shared nodeCtor #[.reg 1],
+              .releaseShared (.reg 0)]
+            terminator := .ret (.reg 2) }] } }
+
+#guard validates coldReset
+
+#guard match run .logical coldReset 7 2, run .physical coldReset 7 2 with
+  | .ok logical, .ok physical =>
+      sameCtorResult logical physical &&
+        logical.store.counters.resetAttempts == 1 &&
+        physical.store.counters.resetAttempts == 1 &&
+        logical.store.counters.hotResets == 0 &&
+        physical.store.counters.hotResets == 0 &&
+        logical.store.counters.coldResets == 1 &&
+        physical.store.counters.coldResets == 1 &&
+        logical.store.counters.rcops == 3 &&
+        physical.store.counters.rcops == 3 &&
+        logical.heapRemaining == 0 && physical.heapRemaining == 0 &&
+        physical.store.counters.reuses == 0 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+/-! Heap traversal cannot steal control fuel, and control exhaustion is
+reported independently of abundant heap fuel. -/
+
+#guard match run .physical coldReset 7 1 with
+  | .error .heapFuel => true
+  | _ => false
+
+#guard match run .physical coldReset 6 100 with
+  | .error .controlFuel => true
+  | _ => false
+
+/-! ## Explicit call-stack/PAP execution -/
+
+private def papIdentity : Function :=
+  { signature :=
+      { params := #[{ world := .shared, passing := .owned }]
+        result := .shared
+        papSafe := true }
+    blocks := #[
+      { valueParams := #[.owned .shared]
+        creditParams := #[]
+        instructions := #[]
+        terminator := .ret (.reg 0) }] }
+
+private def papApply : Program :=
+  { declarations := [(functionAddress, .fn papIdentity)]
+    main :=
+      { signature := signature .shared
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .shared nodeCtor #[.lit (.nat 17)],
+              .papp functionAddress #[],
+              .apply (.reg 1) #[.reg 0]]
+            terminator := .ret (.reg 2) }] } }
+
+#guard validates papApply
+
+#guard match run .logical papApply 5 1, run .physical papApply 5 1 with
+  | .ok logical, .ok physical =>
+      sameCtorResult logical physical &&
+        logical.controlRemaining == 0 && physical.controlRemaining == 0 &&
+        logical.heapRemaining == 0 && physical.heapRemaining == 0 &&
+        logical.store.counters.allocs == 2 &&
+        physical.store.counters.allocs == 2 &&
+        logical.store.counters.frees == 1 &&
+        physical.store.counters.frees == 1 &&
+        logical.store.counters.rcops == 1 &&
+        physical.store.counters.rcops == 1 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+private def papFirst : Function :=
+  { signature :=
+      { params := #[
+          { world := .shared, passing := .owned },
+          { world := .shared, passing := .owned }]
+        result := .shared
+        papSafe := true }
+    blocks := #[
+      { valueParams := #[.owned .shared, .owned .shared]
+        creditParams := #[]
+        instructions := #[.releaseShared (.reg 1)]
+        terminator := .ret (.reg 0) }] }
+
+/-- Applying one argument to an empty binary PAP must take the under-saturated
+branch and allocate a longer PAP before the second application saturates it. -/
+private def papUnderApply : Program :=
+  { declarations := [(functionAddress, .fn papFirst)]
+    main :=
+      { signature := signature .shared
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .shared nodeCtor #[.lit (.nat 17)],
+              .alloc .shared nodeCtor #[.lit (.nat 23)],
+              .papp functionAddress #[],
+              .apply (.reg 2) #[.reg 0],
+              .apply (.reg 3) #[.reg 1]]
+            terminator := .ret (.reg 4) }] } }
+
+#guard validates papUnderApply
+
+#guard match run .logical papUnderApply 8 5,
+    run .physical papUnderApply 8 5 with
+  | .ok logical, .ok physical =>
+      sameCtorResult logical physical &&
+        returnedCtor logical == some (nodeCtor, #[.lit (.nat 17)]) &&
+        logical.controlRemaining == 0 && physical.controlRemaining == 0 &&
+        logical.heapRemaining == 0 && physical.heapRemaining == 0 &&
+        logical.store.counters.allocs == 4 &&
+        physical.store.counters.allocs == 4 &&
+        logical.store.counters.frees == 3 &&
+        physical.store.counters.frees == 3 &&
+        logical.store.counters.rcops == 5 &&
+        physical.store.counters.rcops == 5 &&
+        logical.store.peakLiveNodes == 3 &&
+        physical.store.peakLiveNodes == 3 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+/-- Over-applying an identity PAP to another identity PAP and a constructor
+forces the first callee return through `applyMore`, which then saturates the
+returned PAP with the residual constructor owner. -/
+private def papOverApply : Program :=
+  { declarations := [(functionAddress, .fn papIdentity)]
+    main :=
+      { signature := signature .shared
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .alloc .shared nodeCtor #[.lit (.nat 31)],
+              .papp functionAddress #[],
+              .papp functionAddress #[],
+              .apply (.reg 2) #[.reg 1, .reg 0]]
+            terminator := .ret (.reg 3) }] } }
+
+#guard validates papOverApply
+
+#guard match run .logical papOverApply 7 2,
+    run .physical papOverApply 7 2 with
+  | .ok logical, .ok physical =>
+      sameCtorResult logical physical &&
+        returnedCtor logical == some (nodeCtor, #[.lit (.nat 31)]) &&
+        logical.controlRemaining == 0 && physical.controlRemaining == 0 &&
+        logical.heapRemaining == 0 && physical.heapRemaining == 0 &&
+        logical.store.counters.allocs == 3 &&
+        physical.store.counters.allocs == 3 &&
+        logical.store.counters.frees == 2 &&
+        physical.store.counters.frees == 2 &&
+        logical.store.counters.rcops == 2 &&
+        physical.store.counters.rcops == 2 &&
+        logical.store.peakLiveNodes == 3 &&
+        physical.store.peakLiveNodes == 3 &&
+        lawHolds logical.store physical.store 0
+  | _, _ => false
+
+end Ix.Compiler.IxIR2.Eval.Examples
diff --git a/Ix/Compiler/IxIR2/EvalFuel.lean b/Ix/Compiler/IxIR2/EvalFuel.lean
new file mode 100644
index 000000000..a3e467f53
--- /dev/null
+++ b/Ix/Compiler/IxIR2/EvalFuel.lean
@@ -0,0 +1,205 @@
+import Ix.Compiler.IxIR2.Eval
+
+/-! Successful executions have budget-independent values and heaps. Extra
+heap fuel is carried through each step unchanged, then deterministic finite
+execution compares runs with a common initial budget. -/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+theorem releaseSharedWork_addFuel {fuel : Nat} {store output : Store}
+    {values : List RVal} {remaining : Nat}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining))
+    (extra : Nat) :
+    releaseSharedWork (fuel + extra) store values = .ok (output, remaining + extra) := by
+  induction fuel generalizing store values output remaining with
+  | zero =>
+      cases values with
+      | nil =>
+          simp [releaseSharedWork] at run
+          obtain ⟨rfl, rfl⟩ := run
+          simp [releaseSharedWork]
+      | cons => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil =>
+          simp [releaseSharedWork] at run
+          obtain ⟨rfl, rfl⟩ := run
+          simp [releaseSharedWork]
+      | cons value values =>
+          cases value with
+          | lit literal =>
+              simpa [releaseSharedWork, Nat.succ_add] using ih run
+          | erased =>
+              simpa [releaseSharedWork, Nat.succ_add] using ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  cases world : box.world with
+                  | unique => simp [releaseSharedWork, found, world] at run
+                  | shared =>
+                      by_cases zero : box.rc = 0
+                      · simp [releaseSharedWork, found, world, zero] at run
+                      · by_cases unit : box.rc = 1
+                        · cases node : box.node with
+                          | ctorN cid fields =>
+                              simp [releaseSharedWork, Nat.succ_add, found, world,
+                                unit, node] at run ⊢
+                              exact ih run
+                          | papN address arity arguments =>
+                              simp [releaseSharedWork, Nat.succ_add, found, world,
+                                unit, node] at run ⊢
+                              exact ih run
+                        · simp [releaseSharedWork, Nat.succ_add, found, world,
+                            zero, unit] at run ⊢
+                          exact ih run
+
+theorem dropUniqueWork_addFuel {fuel : Nat} {store output : Store}
+    {values : List RVal} {remaining : Nat}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining))
+    (extra : Nat) :
+    dropUniqueWork (fuel + extra) store values = .ok (output, remaining + extra) := by
+  induction fuel generalizing store values output remaining with
+  | zero =>
+      cases values with
+      | nil =>
+          simp [dropUniqueWork] at run
+          obtain ⟨rfl, rfl⟩ := run
+          simp [dropUniqueWork]
+      | cons => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil =>
+          simp [dropUniqueWork] at run
+          obtain ⟨rfl, rfl⟩ := run
+          simp [dropUniqueWork]
+      | cons value values =>
+          cases value with
+          | lit literal =>
+              simpa [dropUniqueWork, Nat.succ_add] using ih run
+          | erased =>
+              simpa [dropUniqueWork, Nat.succ_add] using ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  cases world : box.world with
+                  | shared => simp [dropUniqueWork, found, world] at run
+                  | unique =>
+                      cases node : box.node with
+                      | papN => simp [dropUniqueWork, found, world, node] at run
+                      | ctorN cid fields =>
+                          simp [dropUniqueWork, Nat.succ_add, found, world, node] at run ⊢
+                          exact ih run
+
+def Machine.addHeapFuel (machine : Machine) (extra : Nat) : Machine :=
+  { machine with heapFuel := machine.heapFuel + extra }
+
+theorem ApplyTransfer.addHeapFuel {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {function : RVal} {arguments : Array RVal}
+    {resume : Frame} {stack : List Continuation} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) (extra : Nat) :
+    ApplyTransfer context interpretation store (heapFuel + extra) function
+      arguments resume stack (target.addHeapFuel extra) := by
+  cases transferred.classify with
+  | erased released =>
+      exact (ApplyTransferCase.erased (releaseSharedWork_addFuel released extra)).transfer
+  | papUnder a b c d e released g =>
+      exact (ApplyTransferCase.papUnder a b c d e
+        (releaseSharedWork_addFuel released extra) g).transfer
+  | papFn a b c d e released g h i j k =>
+      exact (ApplyTransferCase.papFn a b c d e
+        (releaseSharedWork_addFuel released extra) g h i j k).transfer
+  | papExtern a b c d e released g h i j k =>
+      exact (ApplyTransferCase.papExtern a b c d e
+        (releaseSharedWork_addFuel released extra) g h i j k).transfer
+
+private theorem instructionAddHeapFuel {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context interpretation store heapFuel frame
+      stack instruction target) (extra : Nat) :
+    InstructionTransferCase context interpretation store (heapFuel + extra) frame
+      stack instruction (target.addHeapFuel extra) := by
+  cases classified <;> try (constructor <;> assumption)
+  case allocWithLogical a b c d e f g => exact .allocWithLogical a b c d e f g
+  case discardLogical a b c => exact .discardLogical a b c
+  case releaseShared resolved released =>
+    exact .releaseShared resolved (releaseSharedWork_addFuel released extra)
+  case dropUnique resolved dropped =>
+    exact .dropUnique resolved (dropUniqueWork_addFuel dropped extra)
+  case apply a b c transferred => exact .apply a b c (transferred.addHeapFuel extra)
+
+private theorem terminatorAddHeapFuel {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context interpretation store heapFuel frame
+      stack terminator target) (extra : Nat) :
+    TerminatorTransferCase context interpretation store (heapFuel + extra) frame
+      stack terminator (target.addHeapFuel extra) := by
+  cases classified with
+  | jump h => exact .jump h
+  | switchCtor a b c d e => exact .switchCtor a b c d e
+  | switchNatZero a b => exact .switchNatZero a b
+  | switchNatSucc a b => exact .switchNatSucc a b
+  | branchPresent a b c => exact .branchPresent a b c
+  | branchAbsent a b c => exact .branchAbsent a b c
+  | retResume a b c => exact .retResume a b c
+  | retHalt a b c => exact .retHalt a b c
+  | retApplyMore a b c d => exact .retApplyMore a b c (d.addHeapFuel extra)
+  | tailCallFn a b c d e => exact .tailCallFn a b c d e
+  | tailCallSelf a b c d => exact .tailCallSelf a b c d
+
+theorem Step.addHeapFuel {context : Context} {interpretation : Interpretation}
+    {before after : Machine} (stepped : Step context interpretation before after)
+    (extra : Nat) :
+    Step context interpretation (before.addHeapFuel extra) (after.addHeapFuel extra) := by
+  cases stepped.classify with
+  | halted => rfl
+  | instruction a b c classified => exact (instructionAddHeapFuel classified extra).step a b c
+  | terminator a b c classified => exact (terminatorAddHeapFuel classified extra).step a b c
+
+theorem Steps.addHeapFuel {context : Context} {interpretation : Interpretation}
+    {count : Nat} {before after : Machine}
+    (steps : Steps context interpretation count before after) (extra : Nat) :
+    Steps context interpretation count (before.addHeapFuel extra) (after.addHeapFuel extra) := by
+  induction steps with
+  | refl => exact .refl _
+  | cons running head tail ih => exact .cons running (head.addHeapFuel extra) ih
+
+theorem Steps.halted_unique {context : Context} {interpretation : Interpretation}
+    {leftCount rightCount : Nat} {before : Machine}
+    {leftStore rightStore : Store} {leftFuel rightFuel : Nat} {leftValue rightValue : RVal}
+    (left : Steps context interpretation leftCount before
+      { store := leftStore, heapFuel := leftFuel, control := .halted leftValue })
+    (right : Steps context interpretation rightCount before
+      { store := rightStore, heapFuel := rightFuel, control := .halted rightValue }) :
+    leftCount = rightCount ∧ leftStore = rightStore ∧ leftFuel = rightFuel ∧ leftValue = rightValue := by
+  obtain ⟨count, budget, suffix⟩ := left.cancelPrefixToHalted right rfl
+  cases suffix with
+  | refl => exact ⟨by omega, rfl, rfl, rfl⟩
+  | cons running => contradiction
+
+/-- Any two successful main runs of the same program and interpretation
+return the same value and complete store, even with different budgets. -/
+theorem runMain_success_unique {source : Program} {context : Context}
+    {interpretation : Interpretation} {leftControl rightControl leftHeap rightHeap : Nat}
+    {left right : Result} (arity : source.main.signature.params.size = 0)
+    (nonempty : source.main.blocks.isEmpty = false)
+    (leftRun : runMain context interpretation source leftControl leftHeap = .ok left)
+    (rightRun : runMain context interpretation source rightControl rightHeap = .ok right) :
+    left.store = right.store ∧ left.value = right.value := by
+  rw [runMain_eq_runMachine arity nonempty] at leftRun rightRun
+  obtain ⟨leftCount, _, leftSteps⟩ := runMachine_steps leftRun
+  obtain ⟨rightCount, _, rightSteps⟩ := runMachine_steps rightRun
+  have leftFunded := leftSteps.addHeapFuel rightHeap
+  have rightFunded := rightSteps.addHeapFuel leftHeap
+  have common : (initialMachine source.main #[] rightHeap).addHeapFuel leftHeap =
+      (initialMachine source.main #[] leftHeap).addHeapFuel rightHeap := by
+    simp [initialMachine, Machine.addHeapFuel, Nat.add_comm]
+  rw [common] at rightFunded
+  obtain ⟨_, stores, _, values⟩ := leftFunded.halted_unique rightFunded
+  exact ⟨stores, values⟩
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/HeapAccounting.lean b/Ix/Compiler/IxIR2/HeapAccounting.lean
new file mode 100644
index 000000000..8f13b2c31
--- /dev/null
+++ b/Ix/Compiler/IxIR2/HeapAccounting.lean
@@ -0,0 +1,361 @@
+import Ix.Compiler.IxIR2.Eval
+import Ix.Compiler.IxIR1.Reclamation
+import Init.Data.Array.Count
+
+/-!
+# Allocation accounting for physical heap operations
+
+A reserved slot is absent from the live-node array but has not been freed.
+The machine accounting theorem adds its live credit to the heap balance.
+These lemmas describe actual successful heap operations, independently of
+the semantic heap relation and of any optimization savings claim.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1 (Node NodeBox RVal)
+
+private theorem foldl_countP {α : Type} (p : α → Bool) (values : List α)
+    (initial : Nat) :
+    values.foldl (fun total value => if p value then total + 1 else total) initial =
+      initial + values.countP p := by
+  induction values generalizing initial with
+  | nil => simp
+  | cons value rest ih =>
+      simp only [List.foldl_cons, List.countP_cons, ih]
+      split <;> omega
+
+theorem Store.live_eq_countP (store : Store) :
+    store.live = store.heap.nodes.countP Option.isSome := by
+  rw [Store.live, IxIR1.Store.live, ← Array.foldl_toList, foldl_countP]
+  simp
+
+private theorem countP_update {α : Type} {values : Array α} {index : Nat}
+    {old new : α} (p : α → Bool) (found : values[index]? = some old) :
+    (values.setIfInBounds index new).countP p + (if p old then 1 else 0) =
+      values.countP p + (if p new then 1 else 0) := by
+  have bound : index < values.size := (Array.getElem?_eq_some_iff.mp found).1
+  have atIndex : values[index] = old := (Array.getElem?_eq_some_iff.mp found).2
+  have lower := Array.boole_getElem_le_countP (p := p) bound
+  rw [atIndex] at lower
+  simp only [Array.setIfInBounds, bound, ↓reduceDIte, Array.countP_set, atIndex]
+  omega
+
+theorem Store.live_setBox {store : Store} {location : Nat} {old new : NodeBox}
+    (found : store.get? location = some old) :
+    (store.setBox location new).live = store.live := by
+  have slot : store.heap.nodes[location]? = some (some old) :=
+    IxIR1.Sim.nodes_get?_of_get? found
+  have update := countP_update (new := some new) Option.isSome slot
+  simpa [Store.live_eq_countP, Store.setBox, IxIR1.Store.setBox] using update
+
+theorem Store.live_reserve {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    (store.reserve location).live + 1 = store.live := by
+  have slot : store.heap.nodes[location]? = some (some box) :=
+    IxIR1.Sim.nodes_get?_of_get? found
+  simpa [Store.live_eq_countP, Store.reserve] using
+    (countP_update (new := none) Option.isSome slot)
+
+theorem Store.live_kill {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    (store.kill location).live + 1 = store.live := by
+  simpa [Store.live_eq_countP, Store.kill, IxIR1.Store.kill, Store.reserve] using
+    Store.live_reserve found
+
+theorem Store.live_allocNode (store : Store) (world : Owned) (node : Node) :
+    (store.allocNode world node).1.live = store.live + 1 := by
+  simp [Store.live_eq_countP, IxIR1.Store.allocNode]
+
+/-- Ordinary heap operations preserve live nodes plus completed frees,
+relative to fresh allocations. This relation permits different RC counters. -/
+def HeapBalance (before after : Store) : Prop :=
+  after.live + after.heap.frees + before.heap.allocs =
+    before.live + before.heap.frees + after.heap.allocs
+
+namespace HeapBalance
+
+theorem refl (store : Store) : HeapBalance store store := rfl
+
+theorem trans {first second third : Store}
+    (left : HeapBalance first second) (right : HeapBalance second third) :
+    HeapBalance first third := by
+  unfold HeapBalance at *
+  omega
+
+theorem allocNode (store : Store) (world : Owned) (node : Node) :
+    HeapBalance store (store.allocNode world node).1 := by
+  unfold HeapBalance
+  rw [Store.live_allocNode]
+  simp only [Store.allocNode_heap, IxIR1.Store.allocNode]
+  omega
+
+theorem setBox {store : Store} {location : Nat} {old new : NodeBox}
+    (found : store.get? location = some old) :
+    HeapBalance store (store.setBox location new) := by
+  unfold HeapBalance
+  rw [Store.live_setBox found]
+  rfl
+
+theorem kill {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    HeapBalance store (store.kill location) := by
+  have live := Store.live_kill found
+  unfold HeapBalance
+  simp only [Store.kill_heap, IxIR1.Store.kill]
+  omega
+
+theorem rcTick (store : Store) : HeapBalance store store.rcTick := rfl
+
+end HeapBalance
+
+theorem retainShared_heapBalance {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) : HeapBalance store output := by
+  cases value with
+  | lit literal => cases run; exact .refl _
+  | erased => cases run; exact .refl _
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp [retainShared, found, shared] at run
+            subst output
+            exact (HeapBalance.setBox found).trans (.rcTick _)
+          · simp [retainShared, found, shared] at run
+
+theorem RetainSharedMany.heapBalance {store output : Store} {values : Array RVal}
+    (run : RetainSharedMany store values output) : HeapBalance store output := by
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  have loop : ∀ (values : List RVal) {store output : Store},
+      values.foldlM retainShared store = .ok output → HeapBalance store output := by
+    intro values
+    induction values with
+    | nil => intro store output run; cases run; exact .refl _
+    | cons value rest ih =>
+        intro store output run
+        rw [List.foldlM_cons] at run
+        cases head : retainShared store value with
+        | error error => simp [head, bind, Except.bind] at run
+        | ok middle =>
+            simp only [head, bind, Except.bind] at run
+            exact (retainShared_heapBalance head).trans (ih run)
+  exact loop values.toList run
+
+theorem releaseSharedWork_heapBalance {fuel remaining : Nat} {store output : Store}
+    {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    HeapBalance store output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true] at run
+                        have tickAt : store.rcTick.get? location = some box := found
+                        exact (HeapBalance.rcTick store).trans
+                          ((HeapBalance.kill tickAt).trans (ih run))
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        have tickAt : store.rcTick.get? location = some box := found
+                        exact (HeapBalance.rcTick store).trans
+                          ((HeapBalance.setBox tickAt).trans (ih run))
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem releaseShared_heapBalance {fuel remaining : Nat} {store output : Store}
+    {value : RVal} (run : releaseShared fuel store value = .ok (output, remaining)) :
+    HeapBalance store output := releaseSharedWork_heapBalance run
+
+theorem dropUniqueWork_heapBalance {fuel remaining : Nat} {store output : Store}
+    {values : List RVal}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) :
+    HeapBalance store output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN address arity captured => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        exact (HeapBalance.kill found).trans (ih run)
+                  · simp [dropUniqueWork, found, unique] at run
+
+theorem dropUnique_heapBalance {fuel remaining : Nat} {store output : Store}
+    {value : RVal} (run : dropUnique fuel store value = .ok (output, remaining)) :
+    HeapBalance store output := dropUniqueWork_heapBalance run
+
+theorem Store.releaseReservation_accounting {store output : Store} {location : Nat}
+    (run : store.releaseReservation location = .ok output) :
+    output.live = store.live ∧ output.heap.allocs = store.heap.allocs ∧
+      output.heap.frees = store.heap.frees + 1 := by
+  cases found : store.heap.nodes[location]? with
+  | none => simp [Store.releaseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box => simp [Store.releaseReservation, found] at run
+      | none =>
+          simp only [Store.releaseReservation, found, Except.ok.injEq] at run
+          subst output
+          exact ⟨rfl, rfl, rfl⟩
+
+theorem Store.reuseReservation_accounting {store output : Store}
+    {location payloadUnits : Nat} {world : Owned} {node : Node}
+    (run : store.reuseReservation location world node payloadUnits = .ok output) :
+    output.live = store.live + 1 ∧ output.heap.allocs = store.heap.allocs ∧
+      output.heap.frees = store.heap.frees := by
+  cases found : store.heap.nodes[location]? with
+  | none => simp [Store.reuseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box => simp [Store.reuseReservation, found] at run
+      | none =>
+          simp only [Store.reuseReservation, found, Except.ok.injEq] at run
+          subst output
+          refine ⟨?_, rfl, rfl⟩
+          simpa [Store.live_eq_countP] using
+            (countP_update (new := some (NodeBox.mk world 1 node)) Option.isSome found)
+
+/-! ## Credits retained by frames and continuations -/
+
+def Credit.weight (credit : Credit) : Nat := if credit.isPresent then 1 else 0
+
+theorem Credit.weight_absent {credit : Credit} (absent : credit.presence = .absent) :
+    credit.weight = 0 := by
+  rcases credit with ⟨layout, presence⟩
+  cases absent
+  rfl
+
+theorem Credit.weight_present {credit : Credit} {reservation : Option Nat}
+    (present : credit.presence = .present reservation) : credit.weight = 1 := by
+  rcases credit with ⟨layout, presence⟩
+  cases present
+  rfl
+
+theorem creditPresentCount_eq_countP (credits : Array (Option Credit)) :
+    creditPresentCount credits = credits.countP (·.any Credit.isPresent) := by
+  have worker : (fun (total : Nat) (credit : Option Credit) =>
+      match credit with
+      | some credit => if credit.isPresent then total + 1 else total
+      | none => total) =
+      (fun total credit => if credit.any Credit.isPresent then total + 1 else total) := by
+    funext total credit
+    cases credit <;> rfl
+  unfold creditPresentCount
+  calc
+    _ = credits.foldl
+        (fun total credit => if credit.any Credit.isPresent then total + 1 else total) 0 :=
+      congrArg (fun f : Nat → Option Credit → Nat => credits.foldl f 0) worker
+    _ = _ := by
+      rw [← Array.foldl_toList, foldl_countP]
+      simp
+
+@[simp] theorem creditPresentCount_empty : creditPresentCount #[] = 0 := rfl
+
+@[simp] theorem creditPresentCount_push (credits : Array (Option Credit)) (credit : Credit) :
+    creditPresentCount (credits.push (some credit)) =
+      creditPresentCount credits + credit.weight := by
+  simp [creditPresentCount_eq_countP, ← Array.countP_toList, Credit.weight]
+
+theorem creditPresentCount_map_some (credits : Array Credit) :
+    creditPresentCount (credits.map some) = (credits.toList.map Credit.weight).sum := by
+  rw [creditPresentCount_eq_countP, ← Array.countP_toList]
+  simp only [Array.toList_map, List.countP_map]
+  have listCount : ∀ credits : List Credit,
+      credits.countP (fun credit => (some credit).any Credit.isPresent) =
+        (credits.map Credit.weight).sum := by
+    intro credits
+    induction credits with
+    | nil => rfl
+    | cons credit rest ih =>
+        simp only [Option.any_some] at ih
+        simp [List.countP_cons, Credit.weight, ih, Nat.add_comm]
+  exact listCount credits.toList
+
+theorem CreditTake.presentCredits {frame target : Frame} {id : CreditId}
+    {credit : Credit} (taken : CreditTake frame id target credit) :
+    target.presentCredits + credit.weight = frame.presentCredits := by
+  obtain ⟨targetEq, found⟩ := taken.target_eq
+  rw [targetEq]
+  simpa [Frame.presentCredits, creditPresentCount_eq_countP, Credit.weight] using
+    (countP_update (new := none) (·.any Credit.isPresent) found)
+
+theorem CreditTakeSequence.presentCredits {frame target : Frame}
+    {ids : List CreditId} {credits : List Credit}
+    (taken : CreditTakeSequence frame ids target credits) :
+    target.presentCredits + (credits.map Credit.weight).sum = frame.presentCredits := by
+  induction taken with
+  | nil => simp
+  | cons head tail ih =>
+      have first := head.presentCredits
+      simp only [List.map_cons, List.sum_cons]
+      omega
+
+theorem CreditTakeMany.presentCredits {frame target : Frame}
+    {ids : Array CreditId} {credits : Array Credit}
+    (taken : CreditTakeMany frame ids target credits) :
+    target.presentCredits + creditPresentCount (credits.map some) = frame.presentCredits := by
+  rw [creditPresentCount_map_some]
+  exact taken.sequence.presentCredits
+
+theorem NoLiveCredits.presentCredits {frame : Frame} (cleared : NoLiveCredits frame) :
+    frame.presentCredits = 0 := by
+  rw [Frame.presentCredits, creditPresentCount_eq_countP, Array.countP_eq_zero]
+  intro slot member
+  have absent := (Array.any_eq_false'.mp cleared) slot member
+  cases slot <;> simp_all
+
+theorem EdgeTransfer.presentCredits {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal} (transfer : EdgeTransfer frame edge implicitValues target) :
+    target.presentCredits = frame.presentCredits := by
+  obtain ⟨values, credits, after, block, _, taken, cleared, _, _, _, targetEq⟩ := transfer.parts
+  have count := taken.presentCredits
+  rw [cleared.presentCredits, Nat.zero_add] at count
+  subst target
+  exact count
+
+private theorem foldl_weight {α : Type} (weight : α → Nat) (values : List α) (initial : Nat) :
+    values.foldl (fun total value => total + weight value) initial =
+      initial + (values.map weight).sum := by
+  induction values generalizing initial with
+  | nil => simp
+  | cons value rest ih => simp [ih, Nat.add_assoc]
+
+theorem Machine.presentCredits_running (store : Store) (heapFuel : Nat)
+    (frame : Frame) (stack : List Continuation) :
+    (Machine.mk store heapFuel (.running frame stack)).presentCredits =
+      frame.presentCredits + (stack.map Continuation.presentCredits).sum := by
+  simp [Machine.presentCredits, foldl_weight]
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/Interpretation.lean b/Ix/Compiler/IxIR2/Interpretation.lean
new file mode 100644
index 000000000..f9fdc2223
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Interpretation.lean
@@ -0,0 +1,270 @@
+import Ix.Compiler.IxIR2.CreditFree
+import Ix.Compiler.IxIR2.Eval
+
+/-! Exact interpretation independence for programs without credit operations.
+Calls, recursive calls, edges, and residual PAP application preserve the
+inventory of function bodies. No heap or fuel observation is weakened. -/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+theorem ApplyTransfer.interpretation {context : Context}
+    {first second : Interpretation} {store : Store} {heapFuel : Nat}
+    {function : RVal} {arguments : Array RVal} {resume : Frame}
+    {stack : List Continuation} {target : Machine}
+    (transferred : ApplyTransfer context first store heapFuel function
+      arguments resume stack target) :
+    ApplyTransfer context second store heapFuel function arguments resume
+      stack target := transferred
+
+theorem InstructionTransfer.interpretation {context : Context}
+    {first second : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr}
+    {target : Machine} (free : CreditFree.instruction instruction = true)
+    (transferred : InstructionTransfer context first store heapFuel frame
+      stack instruction target) :
+    InstructionTransfer context second store heapFuel frame stack
+      instruction target := by
+  cases instruction <;> first | exact transferred | contradiction
+
+theorem TerminatorTransfer.interpretation {context : Context}
+    {first second : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator}
+    {target : Machine}
+    (transferred : TerminatorTransfer context first store heapFuel frame
+      stack terminator target) :
+    TerminatorTransfer context second store heapFuel frame stack
+      terminator target := transferred
+
+private theorem instructionCaseInterpretation {context : Context}
+    {first second : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {instruction : Instr}
+    {target : Machine} (free : CreditFree.instruction instruction = true)
+    (classified : InstructionTransferCase context first store heapFuel frame
+      stack instruction target) :
+    InstructionTransferCase context second store heapFuel frame stack
+      instruction target := by
+  cases classified <;> try contradiction
+  all_goals first
+    | (constructor <;> assumption)
+    | (apply InstructionTransferCase.apply <;> first
+        | assumption
+        | (apply ApplyTransfer.interpretation; assumption))
+
+private theorem terminatorCaseInterpretation {context : Context}
+    {first second : Interpretation} {store : Store} {heapFuel : Nat}
+    {frame : Frame} {stack : List Continuation} {terminator : Terminator}
+    {target : Machine}
+    (classified : TerminatorTransferCase context first store heapFuel frame
+      stack terminator target) :
+    TerminatorTransferCase context second store heapFuel frame stack
+      terminator target := by
+  cases classified with
+  | jump h => exact .jump h
+  | switchCtor a b c d e => exact .switchCtor a b c d e
+  | switchNatZero a b => exact .switchNatZero a b
+  | switchNatSucc a b => exact .switchNatSucc a b
+  | branchPresent a b c => exact .branchPresent a b c
+  | branchAbsent a b c => exact .branchAbsent a b c
+  | retResume a b c => exact .retResume a b c
+  | retHalt a b c => exact .retHalt a b c
+  | retApplyMore a b c d => exact .retApplyMore a b c d.interpretation
+  | tailCallFn a b c d e => exact .tailCallFn a b c d e
+  | tailCallSelf a b c d => exact .tailCallSelf a b c d
+
+private def continuationFunction : Continuation → Function
+  | .resume frame | .applyMore _ frame => frame.definition
+
+private def stackFunctions (predicate : Function → Prop)
+    (stack : List Continuation) : Prop :=
+  ∀ continuation ∈ stack, predicate (continuationFunction continuation)
+
+private def machineFunctions (predicate : Function → Prop)
+    (machine : Machine) : Prop :=
+  match machine.control with
+  | .halted _ => True
+  | .running frame stack => predicate frame.definition ∧ stackFunctions predicate stack
+
+private theorem applyFunctions {predicate : Function → Prop}
+    {context : Context} {interpretation : Interpretation}
+    (declarations : ∀ address definition,
+      context.declarations address = some (.fn definition) → predicate definition)
+    {store : Store} {heapFuel : Nat} {function : RVal}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {target : Machine} (caller : predicate resume.definition)
+    (saved : stackFunctions predicate stack)
+    (transferred : ApplyTransfer context interpretation store heapFuel
+      function arguments resume stack target) : machineFunctions predicate target := by
+  cases transferred.classify with
+  | erased | papUnder | papExtern => exact ⟨caller, saved⟩
+  | papFn _ _ _ _ _ _ _ declaration _ _ _ =>
+      refine ⟨declarations _ _ declaration, ?_⟩
+      intro continuation member
+      simp only [List.mem_cons] at member
+      rcases member with equal | member
+      · subst continuation
+        split <;> exact caller
+      · exact saved _ member
+
+private theorem instructionFunctions {predicate : Function → Prop}
+    {context : Context} {interpretation : Interpretation}
+    (declarations : ∀ address definition,
+      context.declarations address = some (.fn definition) → predicate definition)
+    {store : Store} {heapFuel : Nat} {frame : Frame}
+    {stack : List Continuation} {instruction : Instr} {target : Machine}
+    (current : predicate frame.definition) (saved : stackFunctions predicate stack)
+    (free : CreditFree.instruction instruction = true)
+    (transferred : InstructionTransferCase context interpretation store heapFuel
+      frame stack instruction target) : machineFunctions predicate target := by
+  cases transferred <;> try contradiction
+  case apply transferred =>
+    exact applyFunctions declarations
+      (resume := { frame with pc := frame.pc + 1 }) current saved transferred
+  all_goals first
+    | exact ⟨current, saved⟩
+    | (refine ⟨?_, ?_⟩
+       · first | exact current | exact declarations _ _ (by assumption)
+       · intro continuation member
+         rcases List.mem_cons.mp member with equal | member
+         · subst continuation; exact current
+         · exact saved _ member)
+
+private theorem terminatorFunctions {predicate : Function → Prop}
+    {context : Context} {interpretation : Interpretation}
+    (declarations : ∀ address definition,
+      context.declarations address = some (.fn definition) → predicate definition)
+    {store : Store} {heapFuel : Nat} {frame : Frame}
+    {stack : List Continuation} {terminator : Terminator} {target : Machine}
+    (current : predicate frame.definition) (saved : stackFunctions predicate stack)
+    (transferred : TerminatorTransferCase context interpretation store heapFuel
+      frame stack terminator target) : machineFunctions predicate target := by
+  cases transferred with
+  | jump edge | switchCtor _ _ _ _ edge | switchNatZero _ edge
+  | switchNatSucc _ edge | branchPresent _ _ edge | branchAbsent _ _ edge =>
+      exact ⟨edge.definition.symm ▸ current, saved⟩
+  | retResume =>
+      exact ⟨saved _ (List.mem_cons_self), fun continuation member =>
+        saved continuation (List.mem_cons_of_mem _ member)⟩
+  | retHalt => trivial
+  | retApplyMore _ _ _ transferred =>
+      exact applyFunctions declarations (saved _ List.mem_cons_self)
+        (fun continuation member => saved continuation (List.mem_cons_of_mem _ member))
+        transferred
+  | tailCallFn _ _ declaration _ _ => exact ⟨declarations _ _ declaration, saved⟩
+  | tailCallSelf => exact ⟨current, saved⟩
+
+private theorem stepInterpretation {context : Context}
+    {first second : Interpretation}
+    (declarations : ∀ address definition,
+      context.declarations address = some (.fn definition) →
+        CreditFree.function definition = true)
+    {before after : Machine}
+    (free : machineFunctions (fun definition => CreditFree.function definition = true) before)
+    (stepped : Step context first before after) :
+    Step context second before after ∧
+      machineFunctions (fun definition => CreditFree.function definition = true) after := by
+  cases stepped.classify with
+  | halted => exact ⟨rfl, trivial⟩
+  | instruction blockAt pc instructionAt classified =>
+      have instructionFree := CreditFree.instructionAt free.1 blockAt pc
+      rw [instructionAt] at instructionFree
+      refine ⟨?_, instructionFunctions declarations free.1 free.2 instructionFree classified⟩
+      exact (instructionCaseInterpretation instructionFree classified).step
+        blockAt pc instructionAt
+  | terminator blockAt pc terminatorAt classified =>
+      refine ⟨?_, terminatorFunctions declarations free.1 free.2 classified⟩
+      exact (terminatorCaseInterpretation classified).step blockAt pc terminatorAt
+
+private theorem stepsInterpretation {context : Context}
+    {first second : Interpretation}
+    (declarations : ∀ address definition,
+      context.declarations address = some (.fn definition) →
+        CreditFree.function definition = true)
+    {count : Nat} {before after : Machine}
+    (free : machineFunctions (fun definition => CreditFree.function definition = true) before)
+    (steps : Steps context first count before after) :
+    Steps context second count before after := by
+  induction steps with
+  | refl => exact .refl _
+  | cons running head tail ih =>
+      obtain ⟨head, nextFree⟩ := stepInterpretation declarations free head
+      exact .cons running head (ih nextFree)
+
+/-- Change credit interpretation without changing any successful runner
+observation, including both remaining budgets and every heap counter. -/
+theorem runMachine_creditFree {context : Context} {first second : Interpretation}
+    (declarations : ∀ address definition,
+      context.declarations address = some (.fn definition) →
+        CreditFree.function definition = true)
+    {definition : Function} (free : CreditFree.function definition = true)
+    {arguments : Array RVal} {store : Store}
+    {controlFuel heapFuel : Nat} {result : Result}
+    (run : runMachine context first controlFuel
+      (initialMachine definition arguments heapFuel store) = .ok result) :
+    runMachine context second controlFuel
+      (initialMachine definition arguments heapFuel store) = .ok result := by
+  obtain ⟨count, budget, steps⟩ := runMachine_steps run
+  have transported : Steps context second count
+      (initialMachine definition arguments heapFuel store)
+      { store := result.store, heapFuel := result.heapRemaining,
+        control := .halted result.value } :=
+    stepsInterpretation declarations ⟨free, by simp [stackFunctions]⟩ steps
+  rw [budget, transported.runMachine]
+  cases result with
+  | mk store value controlRemaining heapRemaining =>
+      cases controlRemaining <;> rfl
+
+private theorem programDeclarations {source : Program}
+    (free : CreditFree.program source = true)
+    {schemas : Ixon.Owned → CtorId → Option CtorSchema}
+    {oracle : Ixon.Address → List RVal → Option RVal}
+    (address : Ixon.Address) (definition : Function)
+    (found : (Context.ofProgram source schemas oracle).declarations address =
+      some (.fn definition)) : CreditFree.function definition = true := by
+  obtain ⟨entry, member, value⟩ := Option.map_eq_some_iff.mp found
+  simp only [CreditFree.program, Bool.and_eq_true] at free
+  have entryFree := List.all_eq_true.mp free.2 entry (List.mem_of_find?_eq_some member)
+  rw [value] at entryFree
+  exact entryFree
+
+/-- Declared runtime functions inherit the complete baseline interpretation
+boundary, for arbitrary arguments and initial heaps. -/
+theorem runFunction_creditFree {source : Program}
+    (free : CreditFree.program source = true)
+    {schemas : Ixon.Owned → CtorId → Option CtorSchema}
+    {oracle : Ixon.Address → List RVal → Option RVal}
+    {address : Ixon.Address} {definition : Function}
+    (declared : (Context.ofProgram source schemas oracle).declarations address = some (.fn definition))
+    {arguments : Array RVal} {store : Store}
+    {first second : Interpretation} {controlFuel heapFuel : Nat} {result : Result}
+    (arity : arguments.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false)
+    (run : runFunction (Context.ofProgram source schemas oracle) first definition
+      arguments controlFuel heapFuel store = .ok result) :
+    runFunction (Context.ofProgram source schemas oracle) second definition
+      arguments controlFuel heapFuel store = .ok result := by
+  rw [runFunction_eq_runMachine arity nonempty] at run ⊢
+  exact runMachine_creditFree (programDeclarations free) (programDeclarations free address definition declared) run
+
+/-- The complete credit-free main boundary. The same schemas and scalar
+oracle are used on both sides; the validated compiler additionally closes
+the extern boundary. -/
+theorem runMain_creditFree {source : Program}
+    (free : CreditFree.program source = true)
+    {schemas : Ixon.Owned → CtorId → Option CtorSchema}
+    {oracle : Ixon.Address → List RVal → Option RVal}
+    {first second : Interpretation} {controlFuel heapFuel : Nat}
+    {result : Result}
+    (arity : source.main.signature.params.size = 0)
+    (nonempty : source.main.blocks.isEmpty = false)
+    (run : runMain (Context.ofProgram source schemas oracle) first source
+      controlFuel heapFuel = .ok result) :
+    runMain (Context.ofProgram source schemas oracle) second source
+      controlFuel heapFuel = .ok result := by
+  rw [runMain_eq_runMachine arity nonempty] at run ⊢
+  have mainFree : CreditFree.function source.main = true := by
+    simp only [CreditFree.program, Bool.and_eq_true] at free
+    exact free.1
+  exact runMachine_creditFree (programDeclarations free)
+    mainFree run
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/Liveness.lean b/Ix/Compiler/IxIR2/Liveness.lean
new file mode 100644
index 000000000..ebaaaee82
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Liveness.lean
@@ -0,0 +1,909 @@
+import Ix.Compiler.IxIR2.Validate
+
+/-!
+# Checked block-local liveness for IxIR₂
+
+This is the first liveness artifact consumed by reuse insertion.  A proposal
+stores one conservative last-use bound per value register.  Bounds use the
+encoding `0 = unused` and `position + 1 = live through position`; therefore a
+proposal may safely keep a value live longer than necessary.  The checker
+replays every value operand in instructions, terminators, and CFG edges and
+rejects any uncovered use under explicit resource limits.
+
+The artifact is deliberately block-local at this stage.  Interprocedural
+parameter/result liveness and dead-parameter rewriting remain separate
+roadmap work, while reset placement only needs the checked local fact that the
+consumed scrutinee has no later use in its block.
+-/
+
+namespace Ix.Compiler.IxIR2.Liveness
+
+open Ix.Compiler.IxIR2
+
+/-- One syntactic value-register use at an instruction position.  The block
+terminator occupies position `block.instructions.size`. -/
+structure Use where
+  value : ValueId
+  position : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+private def recordAtom (position : Nat) (uses : Array Use) : Atom → Array Use
+  | .reg value => uses.push { value, position }
+  | .lit _ | .erased => uses
+
+private def recordAtoms (position : Nat) (uses : Array Use)
+    (atoms : Array Atom) : Array Use :=
+  atoms.foldl (recordAtom position) uses
+
+private def recordEdge (position : Nat) (uses : Array Use)
+    (edge : Edge) : Array Use :=
+  recordAtoms position uses edge.values
+
+private def recordInstruction (position : Nat) (uses : Array Use) :
+    Instr → Array Use
+  | .move value => recordAtom position uses value
+  | .alloc _ _ arguments | .allocWith _ _ _ arguments =>
+      recordAtoms position uses arguments
+  | .discardCredit _ => uses
+  | .takeUnique target _ | .resetShared target _ |
+      .retainShared target | .releaseShared target | .dropUnique target |
+      .freeUnique target _ | .fetch target _ _ =>
+      recordAtom position uses target
+  | .call _ arguments | .callSelf arguments | .papp _ arguments |
+      .extern _ arguments =>
+      recordAtoms position uses arguments
+  | .apply function arguments =>
+      recordAtoms position (recordAtom position uses function) arguments
+
+private def recordTerminator (position : Nat) (uses : Array Use) :
+    Terminator → Array Use
+  | .jump edge => recordEdge position uses edge
+  | .switchValue scrutinee constructors natPeel =>
+      let uses := recordAtom position uses scrutinee
+      let uses := constructors.foldl (fun current alternative =>
+        recordEdge position current alternative.edge) uses
+      match natPeel with
+      | none => uses
+      | some peel =>
+          recordEdge position (recordEdge position uses peel.zero) peel.succ
+  | .branchCredit _ someEdge noneEdge =>
+      recordEdge position (recordEdge position uses someEdge) noneEdge
+  | .ret value => recordAtom position uses value
+  | .tailCall _ arguments | .tailCallSelf arguments =>
+      recordAtoms position uses arguments
+
+private def scanInstruction (state : Nat × Array Use)
+    (instruction : Instr) : Nat × Array Use :=
+  (state.1 + 1, recordInstruction state.1 state.2 instruction)
+
+/-- Complete, deterministic value-use inventory for one block. -/
+def blockUses (block : Block) : Array Use :=
+  let state := block.instructions.foldl scanInstruction (0, #[])
+  recordTerminator state.1 state.2 block.terminator
+
+/-- Declarative membership of an atom among an instruction's runtime value
+operands.  This mirrors `recordInstruction` but is proof-facing and does not
+expose the accumulator used by the executable inventory. -/
+inductive InstrUsesAtom : Instr → Atom → Prop where
+  | move {atom} : InstrUsesAtom (.move atom) atom
+  | alloc {world cid arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.alloc world cid arguments) atom
+  | allocWith {credit world cid arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.allocWith credit world cid arguments) atom
+  | takeUnique {target cid} : InstrUsesAtom (.takeUnique target cid) target
+  | resetShared {target cid} : InstrUsesAtom (.resetShared target cid) target
+  | retainShared {target} : InstrUsesAtom (.retainShared target) target
+  | releaseShared {target} : InstrUsesAtom (.releaseShared target) target
+  | dropUnique {target} : InstrUsesAtom (.dropUnique target) target
+  | freeUnique {target cid} : InstrUsesAtom (.freeUnique target cid) target
+  | fetch {target cid field} : InstrUsesAtom (.fetch target cid field) target
+  | call {function arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.call function arguments) atom
+  | callSelf {arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.callSelf arguments) atom
+  | papp {function arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.papp function arguments) atom
+  | applyFunction {function arguments} :
+      InstrUsesAtom (.apply function arguments) function
+  | applyArgument {function arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.apply function arguments) atom
+  | extern {function arguments atom} : atom ∈ arguments.toList →
+      InstrUsesAtom (.extern function arguments) atom
+
+/-- Declarative membership among an edge's transferred value operands. -/
+inductive EdgeUsesAtom (edge : Edge) : Atom → Prop where
+  | value {atom} : atom ∈ edge.values.toList → EdgeUsesAtom edge atom
+
+/-- Declarative membership among a terminator's direct and edge value
+operands. -/
+inductive TerminatorUsesAtom : Terminator → Atom → Prop where
+  | jump {edge atom} : EdgeUsesAtom edge atom →
+      TerminatorUsesAtom (.jump edge) atom
+  | switchScrutinee {scrutinee constructors natPeel} :
+      TerminatorUsesAtom (.switchValue scrutinee constructors natPeel)
+        scrutinee
+  | switchCtor {scrutinee constructors natPeel alternative atom} :
+      alternative ∈ constructors.toList → EdgeUsesAtom alternative.edge atom →
+      TerminatorUsesAtom (.switchValue scrutinee constructors natPeel) atom
+  | switchNatZero {scrutinee constructors peel atom} :
+      EdgeUsesAtom peel.zero atom →
+      TerminatorUsesAtom (.switchValue scrutinee constructors (some peel)) atom
+  | switchNatSucc {scrutinee constructors peel atom} :
+      EdgeUsesAtom peel.succ atom →
+      TerminatorUsesAtom (.switchValue scrutinee constructors (some peel)) atom
+  | branchSome {credit someEdge noneEdge atom} :
+      EdgeUsesAtom someEdge atom →
+      TerminatorUsesAtom (.branchCredit credit someEdge noneEdge) atom
+  | branchNone {credit someEdge noneEdge atom} :
+      EdgeUsesAtom noneEdge atom →
+      TerminatorUsesAtom (.branchCredit credit someEdge noneEdge) atom
+  | ret {atom} : TerminatorUsesAtom (.ret atom) atom
+  | tailCall {function arguments atom} : atom ∈ arguments.toList →
+      TerminatorUsesAtom (.tailCall function arguments) atom
+  | tailCallSelf {arguments atom} : atom ∈ arguments.toList →
+      TerminatorUsesAtom (.tailCallSelf arguments) atom
+
+private theorem recordAtom_preserves {position : Nat} {uses : Array Use}
+    {atom : Atom} {use : Use} (member : use ∈ uses) :
+    use ∈ recordAtom position uses atom := by
+  cases atom <;> simp [recordAtom, member]
+
+private theorem foldRecordAtoms_preserves {position : Nat}
+    {uses : Array Use} {atoms : List Atom} {use : Use}
+    (member : use ∈ uses) :
+    use ∈ atoms.foldl (recordAtom position) uses := by
+  induction atoms generalizing uses with
+  | nil => exact member
+  | cons atom rest ih =>
+      simp only [List.foldl_cons]
+      exact ih (recordAtom_preserves member)
+
+private theorem foldRecordAtoms_reg {position value : Nat}
+    {uses : Array Use} {atoms : List Atom} {atom : Atom}
+    (member : atom ∈ atoms) (register : atom = .reg value) :
+    { value, position } ∈ atoms.foldl (recordAtom position) uses := by
+  induction atoms generalizing uses with
+  | nil => simp at member
+  | cons head rest ih =>
+      simp only [List.foldl_cons]
+      rcases List.mem_cons.mp member with same | tail
+      · subst head
+        subst atom
+        apply foldRecordAtoms_preserves
+        simp [recordAtom]
+      · exact ih tail
+
+private theorem recordAtoms_preserves {position : Nat} {uses : Array Use}
+    {atoms : Array Atom} {use : Use} (member : use ∈ uses) :
+    use ∈ recordAtoms position uses atoms := by
+  unfold recordAtoms
+  rw [← Array.foldl_toList]
+  exact foldRecordAtoms_preserves member
+
+private theorem recordAtoms_reg {position value : Nat}
+    {uses : Array Use} {atoms : Array Atom} {atom : Atom}
+    (member : atom ∈ atoms.toList) (register : atom = .reg value) :
+    { value, position } ∈ recordAtoms position uses atoms := by
+  unfold recordAtoms
+  rw [← Array.foldl_toList]
+  exact foldRecordAtoms_reg member register
+
+private theorem recordInstruction_preserves {position : Nat}
+    {uses : Array Use} {instruction : Instr} {use : Use}
+    (member : use ∈ uses) :
+    use ∈ recordInstruction position uses instruction := by
+  cases instruction with
+  | move atom => exact recordAtom_preserves member
+  | alloc world cid arguments => exact recordAtoms_preserves member
+  | allocWith credit world cid arguments =>
+      exact recordAtoms_preserves member
+  | discardCredit credit => exact member
+  | takeUnique target cid => exact recordAtom_preserves member
+  | resetShared target cid => exact recordAtom_preserves member
+  | retainShared target => exact recordAtom_preserves member
+  | releaseShared target => exact recordAtom_preserves member
+  | dropUnique target => exact recordAtom_preserves member
+  | freeUnique target cid => exact recordAtom_preserves member
+  | fetch target cid field => exact recordAtom_preserves member
+  | call function arguments => exact recordAtoms_preserves member
+  | callSelf arguments => exact recordAtoms_preserves member
+  | papp function arguments => exact recordAtoms_preserves member
+  | apply function arguments =>
+      exact recordAtoms_preserves (recordAtom_preserves member)
+  | extern function arguments => exact recordAtoms_preserves member
+
+private theorem recordInstruction_reg {position value : Nat}
+    {uses : Array Use} {instruction : Instr} {atom : Atom}
+    (operand : InstrUsesAtom instruction atom)
+    (register : atom = .reg value) :
+    { value, position } ∈ recordInstruction position uses instruction := by
+  cases operand with
+  | move =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | alloc member =>
+      exact recordAtoms_reg member register
+  | allocWith member =>
+      exact recordAtoms_reg member register
+  | takeUnique =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | resetShared =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | retainShared =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | releaseShared =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | dropUnique =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | freeUnique =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | fetch =>
+      cases register
+      simp [recordInstruction, recordAtom]
+  | call member =>
+      exact recordAtoms_reg member register
+  | callSelf member =>
+      exact recordAtoms_reg member register
+  | papp member =>
+      exact recordAtoms_reg member register
+  | applyFunction =>
+      cases register
+      apply recordAtoms_preserves
+      simp [recordAtom]
+  | applyArgument member =>
+      exact recordAtoms_reg member register
+  | extern member =>
+      exact recordAtoms_reg member register
+
+private theorem recordEdge_preserves {position : Nat} {uses : Array Use}
+    {edge : Edge} {use : Use} (member : use ∈ uses) :
+    use ∈ recordEdge position uses edge :=
+  recordAtoms_preserves member
+
+private theorem recordEdge_reg {position value : Nat} {uses : Array Use}
+    {edge : Edge} {atom : Atom} (operand : EdgeUsesAtom edge atom)
+    (register : atom = .reg value) :
+    { value, position } ∈ recordEdge position uses edge := by
+  cases operand with
+  | value member => exact recordAtoms_reg member register
+
+private theorem foldCtorEdges_preserves {position : Nat}
+    {uses : Array Use} {constructors : List CtorAlt} {use : Use}
+    (member : use ∈ uses) :
+    use ∈ constructors.foldl
+      (fun current alternative => recordEdge position current alternative.edge)
+      uses := by
+  induction constructors generalizing uses with
+  | nil => exact member
+  | cons alternative rest ih =>
+      simp only [List.foldl_cons]
+      exact ih (recordEdge_preserves member)
+
+private theorem foldCtorEdges_reg {position value : Nat}
+    {uses : Array Use} {constructors : List CtorAlt}
+    {alternative : CtorAlt} {atom : Atom}
+    (member : alternative ∈ constructors)
+    (operand : EdgeUsesAtom alternative.edge atom)
+    (register : atom = .reg value) :
+    { value, position } ∈ constructors.foldl
+      (fun current candidate => recordEdge position current candidate.edge)
+      uses := by
+  induction constructors generalizing uses with
+  | nil => simp at member
+  | cons head rest ih =>
+      simp only [List.foldl_cons]
+      rcases List.mem_cons.mp member with same | tail
+      · subst head
+        apply foldCtorEdges_preserves
+        exact recordEdge_reg operand register
+      · exact ih tail
+
+private theorem recordTerminator_preserves {position : Nat}
+    {uses : Array Use} {terminator : Terminator} {use : Use}
+    (member : use ∈ uses) :
+    use ∈ recordTerminator position uses terminator := by
+  cases terminator with
+  | jump edge => exact recordEdge_preserves member
+  | switchValue scrutinee constructors natPeel =>
+      have afterScrutinee : use ∈ recordAtom position uses scrutinee :=
+        recordAtom_preserves member
+      have afterConstructors : use ∈ constructors.foldl
+          (fun current alternative =>
+            recordEdge position current alternative.edge)
+          (recordAtom position uses scrutinee) := by
+        rw [← Array.foldl_toList]
+        exact foldCtorEdges_preserves afterScrutinee
+      cases natPeel with
+      | none => exact afterConstructors
+      | some peel =>
+          exact recordEdge_preserves
+            (recordEdge_preserves afterConstructors)
+  | branchCredit credit someEdge noneEdge =>
+      exact recordEdge_preserves (recordEdge_preserves member)
+  | ret atom => exact recordAtom_preserves member
+  | tailCall function arguments => exact recordAtoms_preserves member
+  | tailCallSelf arguments => exact recordAtoms_preserves member
+
+private theorem foldInstructions_preserves {state : Nat × Array Use}
+    {instructions : List Instr} {use : Use} (member : use ∈ state.2) :
+    use ∈ (instructions.foldl scanInstruction state).2 := by
+  induction instructions generalizing state with
+  | nil => exact member
+  | cons instruction rest ih =>
+      simp only [List.foldl_cons]
+      apply ih
+      exact recordInstruction_preserves member
+
+private theorem foldInstructions_reg (instructions : List Instr) :
+    ∀ {start : Nat} {uses : Array Use} {index : Nat}
+      {instruction : Instr} {atom : Atom} {value : Nat},
+      instructions[index]? = some instruction →
+      InstrUsesAtom instruction atom →
+      atom = .reg value →
+      (⟨value, start + index⟩ : Use) ∈
+        (instructions.foldl scanInstruction (start, uses)).2 := by
+  induction instructions with
+  | nil =>
+      intro start uses index instruction atom value found
+      simp at found
+  | cons head rest ih =>
+      intro start uses index instruction atom value found operand register
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero, Option.some.injEq] at found
+          subst instruction
+          simp only [List.foldl_cons, Nat.add_zero]
+          apply foldInstructions_preserves
+          change (⟨value, start⟩ : Use) ∈
+            recordInstruction start uses head
+          exact recordInstruction_reg operand register
+      | succ index =>
+          simp only [List.getElem?_cons_succ] at found
+          simp only [List.foldl_cons]
+          have recorded := ih (start := start + 1)
+            (uses := recordInstruction start uses head) found operand register
+          simpa [scanInstruction, Nat.add_assoc, Nat.add_comm,
+            Nat.add_left_comm] using recorded
+
+private theorem foldInstructions_position (instructions : List Instr)
+    (start : Nat) (uses : Array Use) :
+    (instructions.foldl scanInstruction (start, uses)).1 =
+      start + instructions.length := by
+  induction instructions generalizing start uses with
+  | nil => simp
+  | cons instruction rest ih =>
+      simp only [List.foldl_cons]
+      rw [ih]
+      simp only [scanInstruction, List.length_cons]
+      omega
+
+private theorem recordTerminator_reg {position value : Nat}
+    {uses : Array Use} {terminator : Terminator} {atom : Atom}
+    (operand : TerminatorUsesAtom terminator atom)
+    (register : atom = .reg value) :
+    { value, position } ∈ recordTerminator position uses terminator := by
+  cases operand with
+  | jump edgeOperand => exact recordEdge_reg edgeOperand register
+  | @switchScrutinee scrutinee constructors natPeel =>
+      cases register
+      unfold recordTerminator
+      have afterScrutinee : (⟨value, position⟩ : Use) ∈
+          recordAtom position uses (.reg value) := by
+        simp [recordAtom]
+      have afterConstructors : (⟨value, position⟩ : Use) ∈
+          constructors.foldl
+            (fun current alternative =>
+              recordEdge position current alternative.edge)
+            (recordAtom position uses (.reg value)) := by
+        rw [← Array.foldl_toList]
+        exact foldCtorEdges_preserves afterScrutinee
+      cases natPeel with
+      | none => exact afterConstructors
+      | some peel =>
+          exact recordEdge_preserves
+            (recordEdge_preserves afterConstructors)
+  | @switchCtor scrutinee constructors natPeel alternative atom member
+      edgeOperand =>
+      cases natPeel with
+      | none =>
+          simp only [recordTerminator]
+          rw [← Array.foldl_toList]
+          exact foldCtorEdges_reg member edgeOperand register
+      | some peel =>
+          simp only [recordTerminator]
+          apply recordEdge_preserves
+          apply recordEdge_preserves
+          rw [← Array.foldl_toList]
+          exact foldCtorEdges_reg member edgeOperand register
+  | switchNatZero edgeOperand =>
+      unfold recordTerminator
+      apply recordEdge_preserves
+      exact recordEdge_reg edgeOperand register
+  | switchNatSucc edgeOperand =>
+      unfold recordTerminator
+      exact recordEdge_reg edgeOperand register
+  | branchSome edgeOperand =>
+      unfold recordTerminator
+      apply recordEdge_preserves
+      exact recordEdge_reg edgeOperand register
+  | branchNone edgeOperand =>
+      unfold recordTerminator
+      exact recordEdge_reg edgeOperand register
+  | ret =>
+      cases register
+      simp [recordTerminator, recordAtom]
+  | tailCall member =>
+      exact recordAtoms_reg member register
+  | tailCallSelf member =>
+      exact recordAtoms_reg member register
+
+/-- Every declarative register operand of an indexed instruction occurs in
+the executable block-use inventory at that instruction's position. -/
+theorem instruction_reg_mem_blockUses {block : Block} {position : Nat}
+    {instruction : Instr} {atom : Atom} {value : Nat}
+    (found : block.instructions[position]? = some instruction)
+    (operand : InstrUsesAtom instruction atom)
+    (register : atom = .reg value) :
+    (⟨value, position⟩ : Use) ∈ blockUses block := by
+  unfold blockUses
+  rw [← Array.foldl_toList]
+  apply recordTerminator_preserves
+  have listFound : block.instructions.toList[position]? = some instruction := by
+    simpa using found
+  have recorded := foldInstructions_reg block.instructions.toList
+    (start := 0) (uses := (#[] : Array Use)) listFound operand register
+  simpa using recorded
+
+/-- Every declarative direct register operand of a terminator occurs at the
+terminator position in the executable block-use inventory. -/
+theorem terminator_reg_mem_blockUses {block : Block} {atom : Atom}
+    {value : Nat} (operand : TerminatorUsesAtom block.terminator atom)
+    (register : atom = .reg value) :
+    (⟨value, block.instructions.size⟩ : Use) ∈ blockUses block := by
+  unfold blockUses
+  rw [← Array.foldl_toList]
+  have position :
+      (block.instructions.toList.foldl scanInstruction (0, #[])).1 =
+        block.instructions.size := by
+    simpa using foldInstructions_position block.instructions.toList 0 #[]
+  rw [← position]
+  exact recordTerminator_reg operand register
+
+private theorem mem_recordAtom {position : Nat} {uses : Array Use}
+    {atom : Atom} {use : Use}
+    (member : use ∈ recordAtom position uses atom) :
+    use ∈ uses ∨
+      (use.position = position ∧ atom = .reg use.value) := by
+  cases atom with
+  | reg value =>
+      simp only [recordAtom, Array.mem_push] at member
+      cases member with
+      | inl member => exact .inl member
+      | inr same =>
+          subst use
+          exact .inr ⟨rfl, rfl⟩
+  | lit literal => exact .inl member
+  | erased => exact .inl member
+
+private theorem mem_foldRecordAtoms {position : Nat} {uses : Array Use}
+    {atoms : List Atom} {use : Use}
+    (member : use ∈ atoms.foldl (recordAtom position) uses) :
+    use ∈ uses ∨
+      ∃ atom ∈ atoms,
+        use.position = position ∧ atom = .reg use.value := by
+  induction atoms generalizing uses with
+  | nil => exact .inl member
+  | cons head tail ih =>
+      simp only [List.foldl_cons] at member
+      cases ih member with
+      | inl first =>
+          cases mem_recordAtom first with
+          | inl previous => exact .inl previous
+          | inr added =>
+              exact .inr ⟨head, by simp, added⟩
+      | inr later =>
+          obtain ⟨atom, atomMem, added⟩ := later
+          exact .inr ⟨atom, by simp [atomMem], added⟩
+
+private theorem mem_recordAtoms {position : Nat} {uses : Array Use}
+    {atoms : Array Atom} {use : Use}
+    (member : use ∈ recordAtoms position uses atoms) :
+    use ∈ uses ∨
+      ∃ atom ∈ atoms.toList,
+        use.position = position ∧ atom = .reg use.value := by
+  unfold recordAtoms at member
+  rw [← Array.foldl_toList] at member
+  exact mem_foldRecordAtoms member
+
+private theorem mem_recordInstruction {position : Nat} {uses : Array Use}
+    {instruction : Instr} {use : Use}
+    (member : use ∈ recordInstruction position uses instruction) :
+    use ∈ uses ∨
+      (use.position = position ∧
+        InstrUsesAtom instruction (.reg use.value)) := by
+  cases instruction with
+  | move atom =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          exact .inr ⟨added.1, added.2 ▸ .move⟩
+  | alloc world cid arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .alloc atomMem⟩
+  | allocWith credit world cid arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .allocWith atomMem⟩
+  | discardCredit credit => exact .inl member
+  | takeUnique target cid =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .takeUnique⟩
+  | resetShared target cid =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .resetShared⟩
+  | retainShared target =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .retainShared⟩
+  | releaseShared target =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .releaseShared⟩
+  | dropUnique target =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .dropUnique⟩
+  | freeUnique target cid =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .freeUnique⟩
+  | fetch target cid field =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .fetch⟩
+  | call function arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .call atomMem⟩
+  | callSelf arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .callSelf atomMem⟩
+  | papp function arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .papp atomMem⟩
+  | apply function arguments =>
+      cases mem_recordAtoms member with
+      | inl beforeArguments =>
+          cases mem_recordAtom beforeArguments with
+          | inl previous => exact .inl previous
+          | inr added =>
+              exact .inr ⟨added.1, added.2 ▸ .applyFunction⟩
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .applyArgument atomMem⟩
+  | extern function arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .extern atomMem⟩
+
+private theorem mem_recordEdge {position : Nat} {uses : Array Use}
+    {edge : Edge} {use : Use}
+    (member : use ∈ recordEdge position uses edge) :
+    use ∈ uses ∨
+      (use.position = position ∧
+        EdgeUsesAtom edge (.reg use.value)) := by
+  cases mem_recordAtoms member with
+  | inl previous => exact .inl previous
+  | inr added =>
+      obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+      exact .inr ⟨positionEq, atomEq ▸ .value atomMem⟩
+
+private theorem mem_foldCtorEdges {position : Nat} {uses : Array Use}
+    {constructors : List CtorAlt} {use : Use}
+    (member : use ∈ constructors.foldl
+      (fun current alternative =>
+        recordEdge position current alternative.edge) uses) :
+    use ∈ uses ∨
+      ∃ alternative ∈ constructors,
+        use.position = position ∧
+          EdgeUsesAtom alternative.edge (.reg use.value) := by
+  induction constructors generalizing uses with
+  | nil => exact .inl member
+  | cons head tail ih =>
+      simp only [List.foldl_cons] at member
+      cases ih member with
+      | inl first =>
+          cases mem_recordEdge first with
+          | inl previous => exact .inl previous
+          | inr added => exact .inr ⟨head, by simp, added⟩
+      | inr later =>
+          obtain ⟨alternative, alternativeMem, added⟩ := later
+          exact .inr ⟨alternative, by simp [alternativeMem], added⟩
+
+private theorem mem_recordTerminator {position : Nat} {uses : Array Use}
+    {terminator : Terminator} {use : Use}
+    (member : use ∈ recordTerminator position uses terminator) :
+    use ∈ uses ∨
+      (use.position = position ∧
+        TerminatorUsesAtom terminator (.reg use.value)) := by
+  cases terminator with
+  | jump edge =>
+      cases mem_recordEdge member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, .jump added.2⟩
+  | switchValue scrutinee constructors natPeel =>
+      cases natPeel with
+      | none =>
+          simp only [recordTerminator] at member
+          rw [← Array.foldl_toList] at member
+          cases mem_foldCtorEdges member with
+          | inl beforeConstructors =>
+              cases mem_recordAtom beforeConstructors with
+              | inl previous => exact .inl previous
+              | inr added =>
+                  exact .inr ⟨added.1, added.2 ▸ .switchScrutinee⟩
+          | inr added =>
+              obtain ⟨alternative, alternativeMem, positionEq, operand⟩ :=
+                added
+              exact .inr ⟨positionEq,
+                .switchCtor (by simpa using alternativeMem) operand⟩
+      | some peel =>
+          simp only [recordTerminator] at member
+          cases mem_recordEdge member with
+          | inr added => exact .inr ⟨added.1, .switchNatSucc added.2⟩
+          | inl beforeSucc =>
+              cases mem_recordEdge beforeSucc with
+              | inr added => exact .inr ⟨added.1, .switchNatZero added.2⟩
+              | inl beforeNat =>
+                  rw [← Array.foldl_toList] at beforeNat
+                  cases mem_foldCtorEdges beforeNat with
+                  | inl beforeConstructors =>
+                      cases mem_recordAtom beforeConstructors with
+                      | inl previous => exact .inl previous
+                      | inr added =>
+                          exact .inr
+                            ⟨added.1, added.2 ▸ .switchScrutinee⟩
+                  | inr added =>
+                      obtain ⟨alternative, alternativeMem, positionEq,
+                        operand⟩ := added
+                      exact .inr ⟨positionEq,
+                        .switchCtor (by simpa using alternativeMem) operand⟩
+  | branchCredit credit someEdge noneEdge =>
+      cases mem_recordEdge member with
+      | inr added => exact .inr ⟨added.1, .branchNone added.2⟩
+      | inl beforeNone =>
+          cases mem_recordEdge beforeNone with
+          | inl previous => exact .inl previous
+          | inr added => exact .inr ⟨added.1, .branchSome added.2⟩
+  | ret atom =>
+      cases mem_recordAtom member with
+      | inl previous => exact .inl previous
+      | inr added => exact .inr ⟨added.1, added.2 ▸ .ret⟩
+  | tailCall function arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .tailCall atomMem⟩
+  | tailCallSelf arguments =>
+      cases mem_recordAtoms member with
+      | inl previous => exact .inl previous
+      | inr added =>
+          obtain ⟨atom, atomMem, positionEq, atomEq⟩ := added
+          exact .inr ⟨positionEq, atomEq ▸ .tailCallSelf atomMem⟩
+
+private theorem mem_foldInstructions (instructions : List Instr) :
+    ∀ {start : Nat} {uses : Array Use} {use : Use},
+      use ∈ (instructions.foldl scanInstruction (start, uses)).2 →
+      use ∈ uses ∨
+        ∃ index instruction,
+          instructions[index]? = some instruction ∧
+            use.position = start + index ∧
+            InstrUsesAtom instruction (.reg use.value) := by
+  induction instructions with
+  | nil =>
+      intro start uses use member
+      exact .inl member
+  | cons head tail ih =>
+      intro start uses use member
+      simp only [List.foldl_cons] at member
+      have classified := ih (start := start + 1)
+        (uses := recordInstruction start uses head) (use := use)
+        (by simpa [scanInstruction] using member)
+      cases classified with
+      | inl first =>
+          cases mem_recordInstruction first with
+          | inl previous => exact .inl previous
+          | inr added =>
+              exact .inr ⟨0, head, by simp, by simpa using added.1,
+                added.2⟩
+      | inr later =>
+          obtain ⟨index, instruction, found, positionEq, operand⟩ := later
+          exact .inr ⟨index + 1, instruction, by simpa using found,
+            by omega, operand⟩
+
+/-- Every executable use-inventory entry comes from either the instruction
+at its recorded position or the block terminator. Together with the forward
+lemmas above, this makes `blockUses` a faithful syntax inventory. -/
+theorem mem_blockUses {block : Block} {use : Use}
+    (member : use ∈ blockUses block) :
+    (∃ instruction,
+        block.instructions[use.position]? = some instruction ∧
+          InstrUsesAtom instruction (.reg use.value)) ∨
+      (use.position = block.instructions.size ∧
+        TerminatorUsesAtom block.terminator (.reg use.value)) := by
+  unfold blockUses at member
+  rw [← Array.foldl_toList] at member
+  cases mem_recordTerminator member with
+  | inl beforeTerminator =>
+      have classified := mem_foldInstructions block.instructions.toList
+        (start := 0) (uses := #[]) beforeTerminator
+      cases classified with
+      | inl empty => simp at empty
+      | inr instructionUse =>
+          obtain ⟨index, instruction, found, positionEq, operand⟩ :=
+            instructionUse
+          left
+          have positionEq' : use.position = index := by simpa using positionEq
+          exact ⟨instruction, by rw [positionEq']; simpa using found,
+            operand⟩
+  | inr terminatorUse =>
+      right
+      refine ⟨terminatorUse.1.trans ?_, terminatorUse.2⟩
+      simpa using foldInstructions_position block.instructions.toList 0 #[]
+
+/-- Dense conservative last-use vector.  Entry `0` means no claimed use;
+entry `position + 1` means live through at least that position. -/
+structure BlockSummary where
+  lastUses : Array Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+private def growTo (values : Array Nat) (size : Nat) : Array Nat :=
+  if size ≤ values.size then values
+  else values ++ Array.replicate (size - values.size) 0
+
+private def recordLastUse (values : Array Nat) (use : Use) : Array Nat :=
+  let values := growTo values (use.value + 1)
+  let previous := (values[use.value]?).getD 0
+  values.setIfInBounds use.value (max previous (use.position + 1))
+
+/-- Exact local solution produced by the default planner.  The checker does
+not rely on exactness and also accepts conservative larger bounds. -/
+def inferBlock (block : Block) : BlockSummary :=
+  { lastUses := (blockUses block).foldl recordLastUse
+      (Array.replicate block.valueParams.size 0) }
+
+def BlockSummary.lastUse? (summary : BlockSummary)
+    (value : ValueId) : Option Nat := do
+  let encoded ← summary.lastUses[value]?
+  match encoded with
+  | 0 => none
+  | position + 1 => some position
+
+/-- Does this proposal cover this particular semantic operand use? -/
+def coversUse (summary : BlockSummary) (use : Use) : Bool :=
+  match summary.lastUses[use.value]? with
+  | some bound => use.position < bound
+  | none => false
+
+/-- Every syntactic semantic use must be included.  Extra liveness is safe. -/
+def covers (block : Block) (summary : BlockSummary) : Bool :=
+  (blockUses block).all (coversUse summary)
+
+structure Stats where
+  uses : Nat
+  valueSlots : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Resource where
+  | uses
+  | valueSlots
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Error where
+  | limit (resource : Resource) (actual maximum : Nat)
+  | uncoveredUse
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- A checked conservative local solution.  The retained equation is the
+proof-facing reflection boundary for individual-use theorems. -/
+structure CheckedBlock (block : Block) where
+  summary : BlockSummary
+  stats : Stats
+  accepted : covers block summary = true
+
+def checkBlockWith (limits : Validate.Limits) (block : Block)
+    (summary : BlockSummary) : Except Error (CheckedBlock block) :=
+  let uses := blockUses block
+  if uses.size > limits.maxFlowWork then
+    .error (.limit .uses uses.size limits.maxFlowWork)
+  else if summary.lastUses.size > limits.maxValueRegisters then
+    .error (.limit .valueSlots summary.lastUses.size limits.maxValueRegisters)
+  else if accepted : covers block summary = true then
+    .ok { summary
+          stats := { uses := uses.size, valueSlots := summary.lastUses.size }
+          accepted }
+  else
+    .error .uncoveredUse
+
+def checkBlock (block : Block) (summary : BlockSummary) :
+    Except Error (CheckedBlock block) :=
+  checkBlockWith Validate.defaultLimits block summary
+
+/-- Run the default exact planner through the same untrusted-artifact checker
+used for externally supplied conservative proposals. -/
+def inferCheckedWith (limits : Validate.Limits) (block : Block) :
+    Except Error (CheckedBlock block) :=
+  let uses := blockUses block
+  if uses.size > limits.maxFlowWork then
+    .error (.limit .uses uses.size limits.maxFlowWork)
+  else
+    let requiredSlots := uses.foldl
+      (fun size use => max size (use.value + 1)) block.valueParams.size
+    if requiredSlots > limits.maxValueRegisters then
+      .error (.limit .valueSlots requiredSlots limits.maxValueRegisters)
+    else
+      checkBlockWith limits block (inferBlock block)
+
+def inferChecked (block : Block) : Except Error (CheckedBlock block) :=
+  inferCheckedWith Validate.defaultLimits block
+
+namespace CheckedBlock
+
+/-- Every indexed source use is covered by the retained checked proposal. -/
+theorem coversAt {block : Block} (checked : CheckedBlock block)
+    (index : Nat) (bound : index < (blockUses block).size) :
+    coversUse checked.summary (blockUses block)[index] = true := by
+  exact (Array.all_eq_true.mp checked.accepted) index bound
+
+/-- A checked exact bound at `position` excludes every later syntactic use of
+that register in the block. -/
+theorem no_use_after {block : Block} (checked : CheckedBlock block)
+    {value : ValueId} {position : Nat}
+    (last : checked.summary.lastUse? value = some position) :
+    ∀ index, (bound : index < (blockUses block).size) →
+      (blockUses block)[index].value = value →
+      (blockUses block)[index].position ≤ position := by
+  intro index bound sameValue
+  have covered := checked.coversAt index bound
+  unfold coversUse at covered
+  have encoded : checked.summary.lastUses[value]? = some (position + 1) := by
+    cases found : checked.summary.lastUses[value]? with
+    | none => simp [BlockSummary.lastUse?, found] at last
+    | some valueBound =>
+        cases valueBound with
+        | zero => simp [BlockSummary.lastUse?, found] at last
+        | succ predecessor =>
+            simp [BlockSummary.lastUse?, found] at last
+            subst predecessor
+            rfl
+  rw [sameValue, encoded] at covered
+  simp only at covered
+  exact Nat.le_of_lt_succ (of_decide_eq_true covered)
+
+end CheckedBlock
+
+end Ix.Compiler.IxIR2.Liveness
diff --git a/Ix/Compiler/IxIR2/LivenessExamples.lean b/Ix/Compiler/IxIR2/LivenessExamples.lean
new file mode 100644
index 000000000..cba6182ee
--- /dev/null
+++ b/Ix/Compiler/IxIR2/LivenessExamples.lean
@@ -0,0 +1,96 @@
+import Ix.Compiler.IxIR2.Liveness
+
+/-!
+# Checked liveness examples
+
+The fixture deliberately places value uses in an instruction, the
+terminator scrutinee, a constructor edge, and both literal-peel edges.  It
+checks exact inference, conservative over-approximation, uncovered-use
+rejection, and both resource gates exposed by the block-local checker.
+-/
+
+namespace Ix.Compiler.IxIR2.Liveness.Examples
+
+open Ix.Compiler.IxIR2
+
+private def edge (target : BlockId) (values : Array Atom) : Edge :=
+  { target, values, credits := #[] }
+
+def mixedBlock : Block :=
+  { valueParams := #[.scalar, .scalar]
+    creditParams := #[]
+    instructions := #[
+      .move (.reg 0),
+      .apply (.reg 1) #[.reg 2]]
+    terminator := .switchValue (.reg 3) #[
+      { cid := default, edge := edge 1 #[.reg 0] }]
+      (some {
+        zero := edge 2 #[.reg 1]
+        succ := edge 3 #[.reg 3] }) }
+
+def expectedUses : Array Use := #[
+  { value := 0, position := 0 },
+  { value := 1, position := 1 },
+  { value := 2, position := 1 },
+  { value := 3, position := 2 },
+  { value := 0, position := 2 },
+  { value := 1, position := 2 },
+  { value := 3, position := 2 }]
+
+def exactSummary : BlockSummary := { lastUses := #[3, 3, 2, 3] }
+
+/-- Extra liveness is accepted: each claimed bound may exceed the exact
+last-use position by an arbitrary amount. -/
+def conservativeSummary : BlockSummary := { lastUses := #[4, 5, 3, 4] }
+
+/-- Register two is last used by the `apply` instruction at position one;
+the checked certificate rules out a later use even though other values occur
+on successor edges. -/
+theorem registerTwoNoUseAfter (checked : CheckedBlock mixedBlock)
+    (last : checked.summary.lastUse? 2 = some 1) :
+    ∀ index, (bound : index < (blockUses mixedBlock).size) →
+      (blockUses mixedBlock)[index].value = 2 →
+      (blockUses mixedBlock)[index].position ≤ 1 :=
+  checked.no_use_after last
+
+def suite : Bool :=
+  blockUses mixedBlock == expectedUses &&
+  inferBlock mixedBlock == exactSummary &&
+  (match inferChecked mixedBlock with
+   | .ok checked =>
+       checked.summary == exactSummary &&
+         checked.stats == { uses := 7, valueSlots := 4 }
+   | .error _ => false) &&
+  (match checkBlock mixedBlock conservativeSummary with
+   | .ok checked => checked.summary == conservativeSummary
+   | .error _ => false) &&
+  (match checkBlock mixedBlock { lastUses := #[3, 3, 1, 3] } with
+   | .error .uncoveredUse => true
+   | _ => false) &&
+  (match checkBlock mixedBlock { lastUses := #[3, 3, 2] } with
+   | .error .uncoveredUse => true
+   | _ => false) &&
+  (match checkBlockWith
+      { Validate.defaultLimits with maxFlowWork := 6 }
+      mixedBlock exactSummary with
+   | .error (.limit .uses 7 6) => true
+   | _ => false) &&
+  (match checkBlockWith
+      { Validate.defaultLimits with maxValueRegisters := 3 }
+      mixedBlock exactSummary with
+   | .error (.limit .valueSlots 4 3) => true
+   | _ => false)
+
+#guard suite
+
+/-- Proof-carrying result of the executable certificate/rejection suite. -/
+structure CheckedSuite : Type where
+  accepted : suite = true
+
+def checkSuite : Except String CheckedSuite :=
+  if accepted : suite = true then
+    .ok { accepted }
+  else
+    .error "checked block-liveness suite failed"
+
+end Ix.Compiler.IxIR2.Liveness.Examples
diff --git a/Ix/Compiler/IxIR2/Lower.lean b/Ix/Compiler/IxIR2/Lower.lean
new file mode 100644
index 000000000..76599acde
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Lower.lean
@@ -0,0 +1,7324 @@
+import Ix.Compiler.IxIR2.Validate
+import Ix.Compiler.IxIR2.CreditFree
+
+/-!
+# Structured IxIR₁ to IxIR₂ lowering
+
+IxIR₁ deliberately erases two facts that IxIR₂ must check: function-parameter
+worlds and the full constructor identity at `fetch`, `free`, and case sites.
+The lowering context supplies exactly those owner-sensitive facts.  Everything
+else here is producer-computed: blocks, SSA ordinals, capability transfer,
+edge parameters, scalar-leaf facts, and the proof-facing validation equation.
+
+The baseline is intentionally conservative.  Function parameters use the
+owned IxIR₁ calling convention, raw `reuse` is rejected, and every live source
+environment slot is transferred at a join.  Parameter reduction, borrowing,
+and reset/reuse insertion are later checked transformations over this output.
+
+Successful lowering also retains a recursive `CodeTrace` mirroring the exact
+source-code derivation.  Its checked block order and instruction coordinates
+let semantic proofs recover generated CFG facts from trace membership instead
+of accepting those coordinates as caller-supplied premises.
+-/
+
+namespace Ix.Compiler.IxIR2.Lower
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+/-- A stable source-code coordinate. `branches` records alternative indices
+from outermost to innermost; `offset` counts `letOp`s in the current arm. -/
+structure SourceSite where
+  owner : Validate.Owner
+  branches : List Nat := []
+  offset : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def SourceSite.next (site : SourceSite) : SourceSite :=
+  { site with offset := site.offset + 1 }
+
+def SourceSite.alternative (site : SourceSite) (index : Nat) : SourceSite :=
+  { site with branches := site.branches ++ [index], offset := 0 }
+
+/-- Facts retained from validated IxIR₀/IxIR₁ production. Missing facts
+fail closed at the operation that needs them. -/
+structure Context where
+  /-- Parameter worlds in call order for each addressed IxIR₁ function. -/
+  parameterWorlds : Address → Option (Array Owned) := fun _ => none
+  schemas : Owned → CtorId → Option CtorSchema := fun _ _ => none
+  /-- Exact constructor at one IxIR₁ projection. -/
+  fetchCtor : SourceSite → Option CtorId := fun _ => none
+  /-- Checked all-scalar constructor at one IxIR₁ shallow free. -/
+  scalarFreeCtor : SourceSite → Option CtorId := fun _ => none
+  /-- Full constructor identities for an IxIR₁ alternative. More than one
+  identity is permitted because IxIR₁ dispatch retains only tag/arity;
+  checked lowering emits one IxIR₂ edge for every producer-admitted full
+  identity. An empty list permits a Nat-only alternative. -/
+  caseCtors : SourceSite → Nat → List CtorId := fun _ _ => []
+  /-- Generic tooling may preserve scalar externs. The certified pipeline
+  leaves this false. -/
+  allowExtern : Bool := false
+  /-- Structural recursion budget for one source-code path. -/
+  maxDepth : Nat := 100000
+
+structure Input where
+  declarations : List (Address × IxIR1.Decl)
+  main : IxIR1.Code
+  mainResult : Owned
+
+/-- View the source main as a closed synthetic function, matching the target
+machine's uniform function/frame representation. -/
+def Input.mainDefinition (input : Input) : IxIR1.FnDef :=
+  { arity := 0
+    result := input.mainResult
+    papSafe := false
+    body := input.main }
+
+inductive Error where
+  | duplicateDeclaration (address : Address)
+  | missingParameterWorlds (address : Address)
+  | signature (owner : Validate.Owner) (detail : String)
+  | source (site : SourceSite) (detail : String)
+  | ownership (site : SourceSite) (detail : String)
+  | schema (site : SourceSite) (detail : String)
+  | unsupported (site : SourceSite) (detail : String)
+  | resources (site : SourceSite)
+  | internal (detail : String)
+  | validation (error : Validate.Error)
+  deriving BEq, Repr
+
+inductive TargetPosition where
+  | instruction (index : Nat)
+  | terminator
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Capability tracked for one source de Bruijn binding while constructing
+an SSA block.  Retaining this producer-computed state in the flat position
+trace lets semantic clients recover ownership worlds without replaying the
+private lowering monad. -/
+inductive BindingCap where
+  | scalar
+  | owned (world : Owned)
+  | borrowed (world : Owned) (lender : BorrowLender)
+  | dead
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- One source position's producer-computed target coordinate. A source arm
+may occur more than once when the same IxIR₁ alternative serves both a
+constructor and a literal-Nat path. -/
+structure PositionTrace where
+  source : SourceSite
+  block : BlockId
+  target : TargetPosition
+  /-- Source-slot capabilities immediately before this source operation or
+  terminator.  The checked trace audits their live/dead shape against the
+  recursive code trace before exposing them to simulation. -/
+  sourceCapabilities : Array BindingCap
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Exact environment-to-parameter transfer generated at one edge. -/
+structure EdgeTrace where
+  source : SourceSite
+  sourceBlock : BlockId
+  target : BlockId
+  /-- Source-slot map at the end of the predecessor block. Live slots name
+  operands in that frame; consumed slots are absent. -/
+  sourceInputMap : Array (Option Atom)
+  targetParams : Array ValueCap
+  implicitScalars : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Shift register operands across a prefix of implicit block parameters.
+Literals and erased operands are independent of the register file. -/
+def shiftAtom (amount : Nat) : Atom → Atom
+  | .reg id => .reg (id + amount)
+  | .lit literal => .lit literal
+  | .erased => .erased
+
+/-- The proof-side successor map generated for a CFG edge. Implicit scalar
+parameters occupy the prefix; every live explicit source slot is shifted past
+that prefix while a consumed slot remains absent. -/
+def EdgeTrace.sourceMapOf (implicitScalars : Nat)
+    (explicitMap : Array (Option Atom)) : Array (Option Atom) :=
+  let implicitMap := (List.range implicitScalars).toArray.map fun index =>
+    some (.reg index)
+  implicitMap ++ explicitMap.map fun
+    | none => none
+    | some atom => some (shiftAtom implicitScalars atom)
+
+/-- Explicit edge operands derived from a predecessor source map. A consumed
+slot is represented by the inert erased value so block-parameter ordinals
+remain aligned with source de Bruijn slots. -/
+def EdgeTrace.explicitValuesOf
+    (sourceInputMap : Array (Option Atom)) : Array Atom :=
+  sourceInputMap.map fun
+    | none => .erased
+    | some atom => atom
+
+/-- Before any implicit prefix is added, every live successor source slot is
+the same-position block parameter. -/
+def EdgeTrace.explicitMapOf
+    (sourceInputMap : Array (Option Atom)) : Array (Option Atom) :=
+  sourceInputMap.mapIdx fun index slot =>
+    match slot with
+    | none => none
+    | some _ => some (.reg index)
+
+/-- Explicit operands carried by this exact generated edge. -/
+def EdgeTrace.explicitValues (trace : EdgeTrace) : Array Atom :=
+  EdgeTrace.explicitValuesOf trace.sourceInputMap
+
+/-- Proof-side map for the source environment visible on entry to the
+successor. Live slots name successor block-local registers; consumed slots
+are absent. Implicit scalar values (currently Nat predecessors) occupy the
+prefix. -/
+def EdgeTrace.sourceMap (trace : EdgeTrace) : Array (Option Atom) :=
+  EdgeTrace.sourceMapOf trace.implicitScalars
+    (EdgeTrace.explicitMapOf trace.sourceInputMap)
+
+namespace InputMap
+
+/-- Translate one source atom through a partial source-slot map. -/
+def translateAtom (mapping : Array (Option Atom)) : IxIR1.Atom → Option Atom
+  | .var index => (mapping[index]?).bind id
+  | .lit literal => some (.lit literal)
+  | .erased => some .erased
+
+/-- Translate a source operand vector pointwise and in order. -/
+def translateAtoms (mapping : Array (Option Atom))
+    (atoms : Array IxIR1.Atom) : Option (Array Atom) := do
+  let translated ← atoms.toList.mapM (translateAtom mapping)
+  return translated.toArray
+
+/-- A successor proof map may forget live slots but cannot retarget one. -/
+def Forgets (next current : Array (Option Atom)) : Prop :=
+  ∀ (index : Nat) (atom : Atom),
+    next[index]? = some (some atom) →
+    current[index]? = some (some atom)
+
+/-- Finite executable check for `Forgets`. -/
+def checksForgets (next current : Array (Option Atom)) : Bool :=
+  (List.range next.size).all fun index =>
+    match next[index]? with
+    | some (some atom) => current[index]? == some (some atom)
+    | _ => true
+
+/-- Reflect the finite forgetting check into its proof-facing relation. -/
+theorem forgets_of_check {next current : Array (Option Atom)}
+    (checked : checksForgets next current = true) :
+    Forgets next current := by
+  intro index atom nextAt
+  have bound : index < next.size :=
+    (Array.getElem?_eq_some_iff.mp nextAt).1
+  have member : index ∈ List.range next.size := List.mem_range.mpr bound
+  have point := List.all_eq_true.mp checked index member
+  simp [nextAt] at point
+  exact point
+
+end InputMap
+
+/-- Derivation-shaped output of one successful `compileCode` call.  Unlike
+the flat position and edge indexes below, this tree preserves the exact
+recursive structure on which the block-compositional simulation proceeds.
+Terminal nodes retain the installed block; instruction nodes retain the
+pre/post source maps and recursive continuation; switch nodes retain their
+locally generated edges and recursive child runs in production order. -/
+inductive CodeTrace where
+  | ret (source : SourceSite) (sourceBlock : BlockId)
+      (sourceInputMap : Array (Option Atom))
+      (entryValueCount : Nat)
+      (sourceAtom : IxIR1.Atom) (targetAtom : Atom) (generated : Block)
+  | tailCall (source : SourceSite) (sourceBlock : BlockId)
+      (sourceInputMap : Array (Option Atom)) (entryValueCount : Nat)
+      (address : Address)
+      (arguments : Array IxIR1.Atom) (generated : Block)
+  | tailCallSelf (source : SourceSite) (sourceBlock : BlockId)
+      (sourceInputMap : Array (Option Atom)) (entryValueCount : Nat)
+      (arguments : Array IxIR1.Atom) (generated : Block)
+  | letOp (source : SourceSite) (sourceBlock : BlockId)
+      (sourceInputMap nextInputMap : Array (Option Atom))
+      (entryValueCount : Nat)
+      (operation : IxIR1.Op) (targetIndex : Nat)
+      (targetInstruction : Instr) (next : CodeTrace)
+  | switchValue (source : SourceSite) (sourceBlock : BlockId)
+      (sourceInputMap : Array (Option Atom)) (entryValueCount : Nat)
+      (sourceScrutinee : IxIR1.Atom) (peelNat : Bool)
+      (alternatives : Array IxIR1.Alt) (targetScrutinee : Atom)
+      (generated : Block) (outgoing : List EdgeTrace)
+      (children : List CodeTrace)
+
+/-- Root source coordinate of one recursive compiler run. -/
+def CodeTrace.source : CodeTrace → SourceSite
+  | .ret source .. | .tailCall source .. | .tailCallSelf source ..
+  | .letOp source .. | .switchValue source .. => source
+
+/-- Block in which one recursive compiler run begins. -/
+def CodeTrace.sourceBlock : CodeTrace → BlockId
+  | .ret _ block .. | .tailCall _ block .. | .tailCallSelf _ block ..
+  | .letOp _ block .. | .switchValue _ block .. => block
+
+/-- Proof map visible at the beginning of one recursive compiler run. -/
+def CodeTrace.sourceInputMap : CodeTrace → Array (Option Atom)
+  | .ret _ _ input .. | .tailCall _ _ input ..
+  | .tailCallSelf _ _ input .. | .letOp _ _ input ..
+  | .switchValue _ _ input .. => input
+
+/-- Number of target value registers present when this recursive compiler
+run begins. -/
+def CodeTrace.entryValueCount : CodeTrace → Nat
+  | .ret _ _ _ count .. | .tailCall _ _ _ count ..
+  | .tailCallSelf _ _ _ count .. | .letOp _ _ _ _ count ..
+  | .switchValue _ _ _ count .. => count
+
+/-- Exact IxIR₁ code consumed by one recursive compiler call.  The source
+syntax is reconstructed from constructor payloads, so instruction
+continuations recurse through the same tree used by the semantic proof. -/
+def CodeTrace.sourceCode : CodeTrace → IxIR1.Code
+  | .ret _ _ _ _ source _ _ => .ret source
+  | .tailCall _ _ _ _ address arguments _ =>
+      .letOp (.call address arguments) (.ret (.var 0))
+  | .tailCallSelf _ _ _ _ arguments _ =>
+      .letOp (.callSelf arguments) (.ret (.var 0))
+  | .letOp _ _ _ _ _ operation _ _ next =>
+      .letOp operation next.sourceCode
+  | .switchValue _ _ _ _ scrutinee peelNat alternatives _ _ _ _ =>
+      .case scrutinee peelNat alternatives
+
+/-- Installed blocks in reservation/production order.  A `letOp` remains in
+its continuation's block, while a switch owns its terminal block and then the
+blocks recursively produced for its children. -/
+def CodeTrace.blocks : CodeTrace → List (BlockId × Block)
+  | .ret _ block _ _ _ _ generated
+  | .tailCall _ block _ _ _ _ generated
+  | .tailCallSelf _ block _ _ _ generated => [(block, generated)]
+  | .letOp _ _ _ _ _ _ _ _ next => next.blocks
+  | .switchValue _ block _ _ _ _ _ _ generated _ children =>
+      (block, generated) :: children.flatMap CodeTrace.blocks
+
+/-- The block completed by a compiler call before descending into any switch
+children.  Leading instruction nodes share their continuation's block. -/
+def CodeTrace.headBlock : CodeTrace → BlockId × Block
+  | .ret _ block _ _ _ _ generated
+  | .tailCall _ block _ _ _ _ generated
+  | .tailCallSelf _ block _ _ _ generated
+  | .switchValue _ block _ _ _ _ _ _ generated _ _ => (block, generated)
+  | .letOp _ _ _ _ _ _ _ _ next => next.headBlock
+
+/-- Target program counter at which this recursive compiler call begins.
+Terminal/switch nodes begin at their completed instruction-array length;
+instruction nodes begin at their retained instruction coordinate. -/
+def CodeTrace.entryPc : CodeTrace → Nat
+  | .ret _ _ _ _ _ _ generated
+  | .tailCall _ _ _ _ _ _ generated
+  | .tailCallSelf _ _ _ _ _ generated
+  | .switchValue _ _ _ _ _ _ _ _ generated _ _ =>
+      generated.instructions.size
+  | .letOp _ _ _ _ _ _ index _ _ => index
+
+/-- Flat producer position corresponding to the beginning of this recursive
+trace node. -/
+def CodeTrace.targetPosition : CodeTrace → TargetPosition
+  | .letOp _ _ _ _ _ _ index _ _ => .instruction index
+  | .ret .. | .tailCall .. | .tailCallSelf .. | .switchValue .. =>
+      .terminator
+
+/-- The completed head block is always present in the recursive block list. -/
+theorem CodeTrace.headBlock_mem_blocks :
+    ∀ trace : CodeTrace, trace.headBlock ∈ trace.blocks
+  | .ret .. => by simp [CodeTrace.headBlock, CodeTrace.blocks]
+  | .tailCall .. => by simp [CodeTrace.headBlock, CodeTrace.blocks]
+  | .tailCallSelf .. => by simp [CodeTrace.headBlock, CodeTrace.blocks]
+  | .letOp _ _ _ _ _ _ _ _ next => by
+      simpa [CodeTrace.headBlock, CodeTrace.blocks] using
+        CodeTrace.headBlock_mem_blocks next
+  | .switchValue .. => by simp [CodeTrace.headBlock, CodeTrace.blocks]
+
+/-- Immediate recursive compiler calls.  Instruction nodes have one
+continuation; switch nodes expose every constructor/Nat child in production
+order; terminal nodes have none. -/
+def CodeTrace.children : CodeTrace → List CodeTrace
+  | .letOp _ _ _ _ _ _ _ _ next => [next]
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children => children
+  | _ => []
+
+/-- Local block-entry ABI check for one recursive compiler node. Nodes that
+begin after an already emitted instruction do not introduce a target block
+entry and therefore impose no parameter-count condition. -/
+def CodeTrace.entryValueCountMatches (trace : CodeTrace) : Bool :=
+  if trace.entryPc == 0 then
+    trace.entryValueCount == trace.headBlock.2.valueParams.size
+  else
+    true
+
+mutual
+
+/-- Executable recursive audit that every compiler node beginning at target
+PC zero has exactly the value-register count declared by its completed head
+block's parameter ABI. -/
+def CodeTrace.entryValueCountsMatch : CodeTrace → Bool
+  | trace@(.ret ..) | trace@(.tailCall ..) | trace@(.tailCallSelf ..) =>
+      trace.entryValueCountMatches
+  | trace@(.letOp _ _ _ _ _ _ _ _ next) =>
+      trace.entryValueCountMatches && next.entryValueCountsMatch
+  | trace@(.switchValue _ _ _ _ _ _ _ _ _ _ children) =>
+      trace.entryValueCountMatches &&
+        codeTraceListEntryValueCountsMatch children
+
+private def codeTraceListEntryValueCountsMatch : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.entryValueCountsMatch &&
+        codeTraceListEntryValueCountsMatch rest
+
+end
+
+/-- Reflexive/transitive reachability through the exact recursive compiler
+call tree. -/
+inductive CodeTrace.Descendant (root : CodeTrace) : CodeTrace → Prop where
+  | refl : Descendant root root
+  | step {parent child : CodeTrace} :
+      Descendant root parent → child ∈ parent.children →
+      Descendant root child
+
+/-- Blocks produced by an immediate recursive call remain in the parent's
+flattened canonical block list. -/
+theorem CodeTrace.blocks_subset_of_child {parent child : CodeTrace}
+    (childMem : child ∈ parent.children) :
+    ∀ {entry : BlockId × Block}, entry ∈ child.blocks →
+      entry ∈ parent.blocks := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at childMem
+  | tailCall _ _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at childMem
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at childMem
+  | letOp _ _ _ _ _ _ _ _ next =>
+      simp [CodeTrace.children] at childMem
+      subst child
+      intro entry member
+      simpa [CodeTrace.blocks] using member
+  | switchValue source block input entryValueCount sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children =>
+      intro entry member
+      simp only [CodeTrace.children] at childMem
+      simp only [CodeTrace.blocks, List.mem_cons]
+      right
+      exact List.mem_flatMap.mpr ⟨child, childMem, member⟩
+
+/-- Every descendant's blocks remain blocks of the root compiler run. -/
+theorem CodeTrace.Descendant.blocks_subset {root child : CodeTrace}
+    (descendant : Descendant root child) :
+    ∀ {entry : BlockId × Block}, entry ∈ child.blocks →
+      entry ∈ root.blocks := by
+  induction descendant with
+  | refl => exact fun member => member
+  | @step parent child parentDescendant childMem ih =>
+      intro entry member
+      exact ih (CodeTrace.blocks_subset_of_child childMem member)
+
+namespace CodeTrace
+
+/-- Extract the local block-entry ABI check from the recursive certificate. -/
+theorem entryValueCountMatches_of_match {trace : CodeTrace}
+    (matched : trace.entryValueCountsMatch = true) :
+    trace.entryValueCountMatches = true := by
+  cases trace with
+  | ret source block input entryValueCount sourceAtom targetAtom generated =>
+      simpa [CodeTrace.entryValueCountsMatch] using matched
+  | tailCall source block input entryValueCount address arguments generated =>
+      simpa [CodeTrace.entryValueCountsMatch] using matched
+  | tailCallSelf source block input entryValueCount arguments generated =>
+      simpa [CodeTrace.entryValueCountsMatch] using matched
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp only [CodeTrace.entryValueCountsMatch, Bool.and_eq_true] at matched
+      exact matched.1
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [CodeTrace.entryValueCountsMatch, Bool.and_eq_true] at matched
+      exact matched.1
+
+/-- At a checked target block entry, the retained target value count is
+exactly the completed head block's value-parameter count. -/
+theorem entryValueCount_eq_headParams_of_match
+    {trace : CodeTrace} (matched : trace.entryValueCountsMatch = true)
+    (pc : trace.entryPc = 0) :
+    trace.entryValueCount = trace.headBlock.2.valueParams.size := by
+  have localMatch := CodeTrace.entryValueCountMatches_of_match matched
+  change (if trace.entryPc == 0 then
+      trace.entryValueCount == trace.headBlock.2.valueParams.size
+    else true) = true at localMatch
+  rw [if_pos (beq_iff_eq.mpr pc)] at localMatch
+  exact beq_iff_eq.mp localMatch
+
+private theorem codeTraceListEntryValueCountsMatch_of_mem
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListEntryValueCountsMatch traces = true)
+    (member : child ∈ traces) : child.entryValueCountsMatch = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListEntryValueCountsMatch, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- The recursive block-entry ABI audit is inherited by every immediate
+compiler continuation or switch child. -/
+theorem entryValueCountsMatch_of_child {parent child : CodeTrace}
+    (matched : parent.entryValueCountsMatch = true)
+    (member : child ∈ parent.children) :
+    child.entryValueCountsMatch = true := by
+  cases parent with
+  | ret source block input entryValueCount sourceAtom targetAtom generated =>
+      simp [CodeTrace.children] at member
+  | tailCall source block input entryValueCount address arguments generated =>
+      simp [CodeTrace.children] at member
+  | tailCallSelf source block input entryValueCount arguments generated =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.entryValueCountsMatch, Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [CodeTrace.entryValueCountsMatch, Bool.and_eq_true] at matched
+      exact codeTraceListEntryValueCountsMatch_of_mem
+        matched.2 member
+
+/-- Every recursive descendant inherits the checked block-entry target-value
+ABI certificate. -/
+theorem Descendant.entryValueCountsMatch {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.entryValueCountsMatch = true) :
+    child.entryValueCountsMatch = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.entryValueCountsMatch_of_child ih childMem
+
+section InductTree
+
+variable (motive : CodeTrace → Prop)
+  (retCase : ∀ source block input entryValueCount sourceAtom targetAtom generated,
+    motive (.ret source block input entryValueCount sourceAtom targetAtom generated))
+  (tailCallCase : ∀ source block input entryValueCount address arguments generated,
+    motive (.tailCall source block input entryValueCount address arguments generated))
+  (tailCallSelfCase : ∀ source block input entryValueCount arguments generated,
+    motive (.tailCallSelf source block input entryValueCount arguments generated))
+  (letOpCase : ∀ source block input nextInput entryValueCount operation targetIndex
+      targetInstruction next,
+    motive next →
+    motive (.letOp source block input nextInput entryValueCount operation targetIndex
+      targetInstruction next))
+  (switchCase : ∀ source block input entryValueCount sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children,
+    (∀ child, child ∈ children → motive child) →
+    motive (.switchValue source block input entryValueCount sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children))
+
+include retCase tailCallCase tailCallSelfCase letOpCase switchCase
+
+mutual
+
+private theorem inductTreeCore : (trace : CodeTrace) → motive trace
+  | .ret source block input entryValueCount sourceAtom targetAtom generated =>
+      retCase source block input entryValueCount sourceAtom targetAtom generated
+  | .tailCall source block input entryValueCount address arguments generated =>
+      tailCallCase source block input entryValueCount address arguments generated
+  | .tailCallSelf source block input entryValueCount arguments generated =>
+      tailCallSelfCase source block input entryValueCount arguments generated
+  | .letOp source block input nextInput entryValueCount operation targetIndex
+      targetInstruction next =>
+      letOpCase source block input nextInput entryValueCount operation targetIndex
+        targetInstruction next (inductTreeCore next)
+  | .switchValue source block input entryValueCount sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children =>
+      switchCase source block input entryValueCount sourceScrutinee peel alternatives
+        targetScrutinee generated outgoing children
+          (inductTreeListCore children)
+
+private theorem inductTreeListCore :
+    (traces : List CodeTrace) → ∀ child, child ∈ traces → motive child
+  | [], child, member => by
+      let _ := retCase
+      let _ := tailCallCase
+      let _ := tailCallSelfCase
+      let _ := letOpCase
+      let _ := switchCase
+      simp at member
+  | head :: tail, child, member => by
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal =>
+          subst child
+          exact inductTreeCore head
+      | inr member => exact inductTreeListCore tail child member
+
+end
+
+/-- Tree induction that exposes hypotheses for every switch child nested in
+the list.  This is the proof principle used by the semantic simulation; it
+avoids rebuilding recursion from the flat position/edge indexes. -/
+theorem inductTree (trace : CodeTrace) : motive trace :=
+  inductTreeCore motive retCase tailCallCase tailCallSelfCase letOpCase
+    switchCase trace
+
+end InductTree
+
+end CodeTrace
+
+/-- Exact source-operation/target-instruction syntax correspondence for the
+baseline lowering subset. Constructor identities erased by IxIR₁ are checked
+elsewhere; all retained operands, addresses, fields, and worlds agree here. -/
+def operationMatches (input : Array (Option Atom)) : IxIR1.Op → Instr → Bool
+  | .pure source, .move target =>
+      InputMap.translateAtom input source == some target
+  | .alloc sourceWorld sourceCtor sourceArgs,
+      .alloc targetWorld targetCtor targetArgs =>
+      sourceWorld == targetWorld && sourceCtor == targetCtor &&
+        InputMap.translateAtoms input sourceArgs == some targetArgs
+  | .free source, .freeUnique target _
+  | .dup source, .retainShared target
+  | .drop source, .releaseShared target
+  | .dropU source, .dropUnique target =>
+      InputMap.translateAtom input source == some target
+  | .fetch source sourceField, .fetch target _ targetField =>
+      sourceField == targetField &&
+        InputMap.translateAtom input source == some target
+  | .call sourceAddress sourceArgs, .call targetAddress targetArgs
+  | .papp sourceAddress sourceArgs, .papp targetAddress targetArgs
+  | .extern sourceAddress sourceArgs, .extern targetAddress targetArgs =>
+      sourceAddress == targetAddress &&
+        InputMap.translateAtoms input sourceArgs == some targetArgs
+  | .callSelf sourceArgs, .callSelf targetArgs =>
+      InputMap.translateAtoms input sourceArgs == some targetArgs
+  | .apply sourceFunction sourceArgs, .apply targetFunction targetArgs =>
+      InputMap.translateAtom input sourceFunction == some targetFunction &&
+        InputMap.translateAtoms input sourceArgs == some targetArgs
+  | _, _ => false
+
+/-- Proof-facing form of `operationMatches`. It exposes exactly the retained
+operand/address/field syntax while intentionally leaving erased constructor
+identity at fetch/free sites to the owner-keyed provenance sidecars. -/
+def OperationSyntax (input : Array (Option Atom)) : IxIR1.Op → Instr → Prop
+  | .pure source, .move target =>
+      InputMap.translateAtom input source = some target
+  | .alloc sourceWorld sourceCtor sourceArgs,
+      .alloc targetWorld targetCtor targetArgs =>
+      sourceWorld = targetWorld ∧ sourceCtor = targetCtor ∧
+        InputMap.translateAtoms input sourceArgs = some targetArgs
+  | .free source, .freeUnique target _
+  | .dup source, .retainShared target
+  | .drop source, .releaseShared target
+  | .dropU source, .dropUnique target =>
+      InputMap.translateAtom input source = some target
+  | .fetch source sourceField, .fetch target _ targetField =>
+      sourceField = targetField ∧
+        InputMap.translateAtom input source = some target
+  | .call sourceAddress sourceArgs, .call targetAddress targetArgs
+  | .papp sourceAddress sourceArgs, .papp targetAddress targetArgs
+  | .extern sourceAddress sourceArgs, .extern targetAddress targetArgs =>
+      sourceAddress = targetAddress ∧
+        InputMap.translateAtoms input sourceArgs = some targetArgs
+  | .callSelf sourceArgs, .callSelf targetArgs =>
+      InputMap.translateAtoms input sourceArgs = some targetArgs
+  | .apply sourceFunction sourceArgs, .apply targetFunction targetArgs =>
+      InputMap.translateAtom input sourceFunction = some targetFunction ∧
+        InputMap.translateAtoms input sourceArgs = some targetArgs
+  | _, _ => False
+
+/-- Reflect executable operation syntax checking into its proof-facing form. -/
+theorem operationSyntax_of_match {input : Array (Option Atom)}
+    {source : IxIR1.Op} {target : Instr}
+    (matched : operationMatches input source target = true) :
+    OperationSyntax input source target := by
+  cases source <;> cases target <;>
+    simp_all [operationMatches, OperationSyntax, Bool.and_eq_true]
+
+mutual
+
+/-- Executable syntax/terminator coherence for the recursive compiler trace. -/
+def CodeTrace.syntaxMatches : CodeTrace → Bool
+  | .ret _ _ input _ sourceAtom targetAtom generated =>
+      (InputMap.translateAtom input sourceAtom == some targetAtom) &&
+        (generated.terminator == .ret targetAtom)
+  | .tailCall _ _ input _ sourceAddress sourceArgs generated =>
+      match generated.terminator with
+      | .tailCall targetAddress targetArgs =>
+          sourceAddress == targetAddress &&
+            (InputMap.translateAtoms input sourceArgs == some targetArgs)
+      | _ => false
+  | .tailCallSelf _ _ input _ sourceArgs generated =>
+      match generated.terminator with
+      | .tailCallSelf targetArgs =>
+          InputMap.translateAtoms input sourceArgs == some targetArgs
+      | _ => false
+  | .letOp _ _ input _ _ operation _ instruction next =>
+      operationMatches input operation instruction && next.syntaxMatches
+  | .switchValue _ _ input _ sourceScrutinee _ _ targetScrutinee generated
+      _ children =>
+      (InputMap.translateAtom input sourceScrutinee == some targetScrutinee) &&
+        (match generated.terminator with
+        | .switchValue actual _ _ => actual == targetScrutinee
+        | _ => false) &&
+        codeTraceListSyntaxMatches children
+
+private def codeTraceListSyntaxMatches : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.syntaxMatches && codeTraceListSyntaxMatches rest
+
+end
+
+/-- Local syntax facts at an instruction trace node. -/
+theorem CodeTrace.letOpSyntax_of_match
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op} {index : Nat} {instruction : Instr}
+    {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      operation index instruction next).syntaxMatches = true) :
+    operationMatches input operation instruction = true ∧
+      next.syntaxMatches = true := by
+  simpa [CodeTrace.syntaxMatches, Bool.and_eq_true] using matched
+
+/-- Proof-facing source/target operation syntax at one checked instruction
+trace node. -/
+theorem CodeTrace.letOpOperationSyntax_of_match
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op} {index : Nat} {instruction : Instr}
+    {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      operation index instruction next).syntaxMatches = true) :
+    OperationSyntax input operation instruction :=
+  operationSyntax_of_match (CodeTrace.letOpSyntax_of_match matched).1
+
+/-- Local syntax and terminator facts at a return trace node. -/
+theorem CodeTrace.retSyntax_of_match
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (matched : (CodeTrace.ret source block input entryValueCount sourceAtom
+      targetAtom generated).syntaxMatches = true) :
+    InputMap.translateAtom input sourceAtom = some targetAtom ∧
+      generated.terminator = .ret targetAtom := by
+  change ((InputMap.translateAtom input sourceAtom == some targetAtom) &&
+    (generated.terminator == Terminator.ret targetAtom)) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  exact ⟨beq_iff_eq.mp matched.1, beq_iff_eq.mp matched.2⟩
+
+/-- A coherent addressed tail-call node exposes the exact emitted argument
+vector and terminator. -/
+theorem CodeTrace.tailCallSyntax_of_match
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {sourceArgs : Array IxIR1.Atom}
+    {generated : Block}
+    (matched : (CodeTrace.tailCall source block input entryValueCount address
+      sourceArgs generated).syntaxMatches = true) :
+    ∃ targetArgs,
+      InputMap.translateAtoms input sourceArgs = some targetArgs ∧
+        generated.terminator = .tailCall address targetArgs := by
+  cases terminatorEq : generated.terminator with
+  | jump edge => simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | switchValue scrutinee constructors natPeel =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | branchCredit credit someEdge noneEdge =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | ret value => simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | tailCall targetAddress targetArgs =>
+      simp only [CodeTrace.syntaxMatches, terminatorEq, Bool.and_eq_true] at matched
+      have addressEq : address = targetAddress := beq_iff_eq.mp matched.1
+      subst targetAddress
+      exact ⟨targetArgs, beq_iff_eq.mp matched.2, rfl⟩
+  | tailCallSelf targetArgs =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+
+/-- A coherent self-tail-call node exposes the exact emitted argument vector
+and terminator. -/
+theorem CodeTrace.tailCallSelfSyntax_of_match
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceArgs : Array IxIR1.Atom} {generated : Block}
+    (matched : (CodeTrace.tailCallSelf source block input entryValueCount
+      sourceArgs generated).syntaxMatches = true) :
+    ∃ targetArgs,
+      InputMap.translateAtoms input sourceArgs = some targetArgs ∧
+        generated.terminator = .tailCallSelf targetArgs := by
+  cases terminatorEq : generated.terminator with
+  | jump edge => simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | switchValue scrutinee constructors natPeel =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | branchCredit credit someEdge noneEdge =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | ret value => simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | tailCall targetAddress targetArgs =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | tailCallSelf targetArgs =>
+      simp only [CodeTrace.syntaxMatches, terminatorEq] at matched
+      exact ⟨targetArgs, beq_iff_eq.mp matched, rfl⟩
+
+/-- A coherent switch node exposes its translated scrutinee and exact emitted
+switch terminator payload. -/
+theorem CodeTrace.switchSyntax_of_match
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace}
+    (matched : (CodeTrace.switchValue source block input entryValueCount
+      sourceScrutinee peelNat alternatives targetScrutinee generated outgoing
+      children).syntaxMatches = true) :
+    ∃ constructors natPeel,
+      InputMap.translateAtom input sourceScrutinee = some targetScrutinee ∧
+        generated.terminator =
+          .switchValue targetScrutinee constructors natPeel := by
+  cases terminatorEq : generated.terminator with
+  | jump edge => simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | switchValue actual constructors natPeel =>
+      simp only [CodeTrace.syntaxMatches, terminatorEq, Bool.and_eq_true] at matched
+      have scrutineeEq : actual = targetScrutinee := beq_iff_eq.mp matched.1.2
+      subst actual
+      exact ⟨constructors, natPeel, beq_iff_eq.mp matched.1.1, rfl⟩
+  | branchCredit credit someEdge noneEdge =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | ret value => simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | tailCall targetAddress targetArgs =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+  | tailCallSelf targetArgs =>
+      simp [CodeTrace.syntaxMatches, terminatorEq] at matched
+
+private theorem codeTraceListSyntaxMatches_of_mem
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListSyntaxMatches traces = true)
+    (member : child ∈ traces) : child.syntaxMatches = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListSyntaxMatches, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Syntax coherence is inherited by every immediate recursive call. -/
+theorem CodeTrace.syntaxMatches_of_child {parent child : CodeTrace}
+    (matched : parent.syntaxMatches = true)
+    (member : child ∈ parent.children) :
+    child.syntaxMatches = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      exact (CodeTrace.letOpSyntax_of_match matched).2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [CodeTrace.syntaxMatches, Bool.and_eq_true] at matched
+      exact codeTraceListSyntaxMatches_of_mem matched.2 member
+
+/-- Every descendant of a syntax-coherent compiler trace retains exact
+source operands and target instruction/terminator syntax. -/
+theorem CodeTrace.Descendant.syntaxMatches {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.syntaxMatches = true) :
+    child.syntaxMatches = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.syntaxMatches_of_child ih childMem
+
+/-- Value-register delta for the syntax-directed baseline instruction subset.
+Credit-producing/consuming optimized instructions are deliberately absent. -/
+def Instr.baselineValueDelta : Instr → Option Nat
+  | .move _ | .alloc .. | .retainShared _ | .fetch ..
+  | .call .. | .callSelf _ | .papp .. | .apply .. | .extern .. => some 1
+  | .releaseShared _ | .dropUnique _ | .freeUnique .. => some 0
+  | .allocWith .. | .discardCredit _ | .takeUnique .. | .resetShared .. => none
+
+/-- Proof-map atom installed for the new IxIR₁ binder produced by one
+baseline target instruction. -/
+def Instr.baselineBinderAtom (entryValueCount : Nat) : Instr → Option Atom
+  | .move _ | .alloc .. | .retainShared _ | .fetch ..
+  | .call .. | .callSelf _ | .papp .. | .apply .. | .extern .. =>
+      some (.reg entryValueCount)
+  | .releaseShared _ | .dropUnique _ | .freeUnique .. => some .erased
+  | .allocWith .. | .discardCredit _ | .takeUnique .. | .resetShared .. => none
+
+mutual
+
+/-- Executable internal coherence check for instruction coordinates retained
+by the recursive trace. -/
+def CodeTrace.instructionsMatch : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp source block _ nextInput entryValueCount _ index instruction next =>
+      match Instr.baselineValueDelta instruction with
+      | some delta =>
+          (next.source == source.next) &&
+            (next.sourceBlock == block) &&
+            (next.sourceInputMap == nextInput) &&
+            (next.entryPc == index + 1) &&
+            (next.entryValueCount == entryValueCount + delta) &&
+            (next.headBlock.1 == block) &&
+            (next.headBlock.2.instructions[index]? == some instruction) &&
+            next.instructionsMatch
+      | none => false
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListInstructionsMatch children
+
+private def codeTraceListInstructionsMatch : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.instructionsMatch && codeTraceListInstructionsMatch rest
+
+end
+
+mutual
+
+/-- Executable coherence check for proof-map progression at every recursive
+instruction node. The new binder is retained at the head; every older slot
+may stay identical or become dead, but can never be retargeted. -/
+def CodeTrace.inputMapsMatch : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ input nextInput entryValueCount _ _ instruction next =>
+      match Instr.baselineBinderAtom entryValueCount instruction with
+      | some head =>
+          (nextInput.size == input.size + 1) &&
+            (nextInput[0]? == some (some head)) &&
+            InputMap.checksForgets nextInput (#[some head] ++ input) &&
+            next.inputMapsMatch
+      | none => false
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListInputMapsMatch children
+
+private def codeTraceListInputMapsMatch : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.inputMapsMatch && codeTraceListInputMapsMatch rest
+
+end
+
+
+/-- Decode the local proof-map coherence at an instruction node. -/
+theorem CodeTrace.inputMapForgets_of_match
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    {head : Atom}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      operation index instruction next).inputMapsMatch = true)
+    (binder : Instr.baselineBinderAtom entryValueCount instruction =
+      some head) :
+    nextInput.size = input.size + 1 ∧
+      nextInput[0]? = some (some head) ∧
+      InputMap.Forgets nextInput (#[some head] ++ input) ∧
+      next.inputMapsMatch = true := by
+  change (match Instr.baselineBinderAtom entryValueCount instruction with
+    | some actual =>
+        (nextInput.size == input.size + 1) &&
+          (nextInput[0]? == some (some actual)) &&
+          InputMap.checksForgets nextInput (#[some actual] ++ input) &&
+          next.inputMapsMatch
+    | none => false) = true at matched
+  rw [binder] at matched
+  simp only [Bool.and_eq_true] at matched
+  exact ⟨beq_iff_eq.mp matched.1.1.1,
+    beq_iff_eq.mp matched.1.1.2,
+    InputMap.forgets_of_check matched.1.2, matched.2⟩
+
+/-- Every retained instruction binder grows the source proof map by exactly
+one slot, even when its target instruction is effect-only. -/
+theorem CodeTrace.inputMapSize_of_match
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      operation index instruction next).inputMapsMatch = true) :
+    nextInput.size = input.size + 1 := by
+  cases binder : Instr.baselineBinderAtom entryValueCount instruction with
+  | none => simp [CodeTrace.inputMapsMatch, binder] at matched
+  | some head =>
+      exact (CodeTrace.inputMapForgets_of_match matched binder).1
+
+/-- Structural facts certified at one instruction/continuation node. -/
+structure CodeTrace.LetOpMatch
+    (source : SourceSite) (block : BlockId)
+    (input nextInput : Array (Option Atom)) (entryValueCount : Nat)
+    (operation : IxIR1.Op)
+    (index : Nat) (instruction : Instr) (next : CodeTrace) : Prop where
+  nextSource : next.source = source.next
+  nextBlock : next.sourceBlock = block
+  nextInput : next.sourceInputMap = nextInput
+  nextPc : next.entryPc = index + 1
+  nextValueCount : next.entryValueCount = entryValueCount +
+    ((Instr.baselineValueDelta instruction).getD 0)
+  headBlock : next.headBlock.1 = block
+  instructionAt : next.headBlock.2.instructions[index]? = some instruction
+  nextInstructions : next.instructionsMatch = true
+
+/-- Decode the executable instruction-node coherence check into the exact
+source-site, environment-map, block, and instruction equalities used by the
+semantic induction. -/
+theorem CodeTrace.letOpMatch_of_match
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      operation index instruction next).instructionsMatch = true) :
+    CodeTrace.LetOpMatch source block input nextInput entryValueCount operation
+      index instruction next := by
+  change (match Instr.baselineValueDelta instruction with
+    | some delta =>
+        (next.source == source.next) &&
+          (next.sourceBlock == block) &&
+          (next.sourceInputMap == nextInput) &&
+          (next.entryPc == index + 1) &&
+          (next.entryValueCount == entryValueCount + delta) &&
+          (next.headBlock.1 == block) &&
+          (next.headBlock.2.instructions[index]? == some instruction) &&
+          next.instructionsMatch
+    | none => false) = true at matched
+  cases deltaEq : Instr.baselineValueDelta instruction with
+  | none => simp [deltaEq] at matched
+  | some delta =>
+      rw [deltaEq] at matched
+      simp only [Bool.and_eq_true] at matched
+      obtain ⟨⟨⟨⟨⟨⟨⟨nextSource, nextBlock⟩, nextInput⟩,
+        nextPc⟩, nextValueCount⟩, headBlock⟩, instructionAt⟩,
+        nextInstructions⟩ := matched
+      exact
+        { nextSource := beq_iff_eq.mp nextSource
+          nextBlock := beq_iff_eq.mp nextBlock
+          nextInput := beq_iff_eq.mp nextInput
+          nextPc := beq_iff_eq.mp nextPc
+          nextValueCount := by
+            simpa [deltaEq] using (beq_iff_eq.mp nextValueCount)
+          headBlock := beq_iff_eq.mp headBlock
+          instructionAt := beq_iff_eq.mp instructionAt
+          nextInstructions }
+
+/-- A coherent recursive trace positioned at its completed block terminator
+and exposing a target self tail call is itself the corresponding source
+self-tail node.  A nested instruction node is excluded by its retained
+instruction slot, while every other terminal trace kind emits a distinct
+terminator constructor. -/
+theorem CodeTrace.tailCallSelf_of_terminal
+    (trace : CodeTrace) {targetArgs : Array Atom}
+    (syntaxMatch : trace.syntaxMatches = true)
+    (instructions : trace.instructionsMatch = true)
+    (terminalPc : trace.entryPc = trace.headBlock.2.instructions.size)
+    (terminator : trace.headBlock.2.terminator =
+      .tailCallSelf targetArgs) :
+    ∃ (source : SourceSite) (block : BlockId)
+        (input : Array (Option Atom)) (entryValueCount : Nat)
+        (sourceArgs : Array IxIR1.Atom) (generated : Block),
+      trace = .tailCallSelf source block input entryValueCount sourceArgs
+          generated ∧
+        InputMap.translateAtoms input sourceArgs = some targetArgs := by
+  cases trace with
+  | ret source block input entryValueCount sourceAtom targetAtom generated =>
+      simp only [CodeTrace.headBlock] at terminator
+      have emitted := (CodeTrace.retSyntax_of_match syntaxMatch).2
+      rw [emitted] at terminator
+      cases terminator
+  | tailCall source block input entryValueCount address sourceArgs generated =>
+      simp only [CodeTrace.headBlock] at terminator
+      obtain ⟨target, _translated, emitted⟩ :=
+        CodeTrace.tailCallSyntax_of_match syntaxMatch
+      rw [emitted] at terminator
+      cases terminator
+  | tailCallSelf source block input entryValueCount sourceArgs generated =>
+      simp only [CodeTrace.headBlock] at terminator
+      obtain ⟨target, translated, emitted⟩ :=
+        CodeTrace.tailCallSelfSyntax_of_match syntaxMatch
+      have targetEq : target = targetArgs := by
+        rw [emitted] at terminator
+        injection terminator
+      subst target
+      exact ⟨source, block, input, entryValueCount, sourceArgs, generated,
+        rfl, translated⟩
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      have matched := CodeTrace.letOpMatch_of_match instructions
+      have bound := (Array.getElem?_eq_some_iff.mp matched.instructionAt).1
+      simp only [CodeTrace.entryPc, CodeTrace.headBlock] at terminalPc
+      omega
+  | switchValue source block input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [CodeTrace.headBlock] at terminator
+      obtain ⟨constructors, natPeel, _translated, emitted⟩ :=
+        CodeTrace.switchSyntax_of_match syntaxMatch
+      rw [emitted] at terminator
+      cases terminator
+
+/-- A coherent instruction trace points to the exact retained instruction in
+the completed block shared with its continuation. -/
+theorem CodeTrace.instructionAt_of_match
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      operation index instruction next).instructionsMatch = true) :
+    next.headBlock.2.instructions[index]? = some instruction :=
+  (CodeTrace.letOpMatch_of_match matched).instructionAt
+
+/-- Instruction coherence also identifies the recursive run's completed head
+block with the block in which that source run began. -/
+theorem CodeTrace.headBlock_eq_sourceBlock_of_match {trace : CodeTrace}
+    (matched : trace.instructionsMatch = true) :
+    trace.headBlock.1 = trace.sourceBlock := by
+  cases trace with
+  | ret source sourceBlock sourceInput entryValueCount sourceAtom targetAtom generated => rfl
+  | tailCall source sourceBlock sourceInput entryValueCount address arguments generated => rfl
+  | tailCallSelf source sourceBlock sourceInput entryValueCount arguments generated => rfl
+  | letOp source block input nextInput entryValueCount operation index instruction next =>
+      exact (CodeTrace.letOpMatch_of_match matched).headBlock
+  | switchValue source sourceBlock sourceInput entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children => rfl
+
+private theorem codeTraceListInstructionsMatch_of_mem
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListInstructionsMatch traces = true)
+    (member : child ∈ traces) : child.instructionsMatch = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListInstructionsMatch, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Instruction coherence is inherited by every immediate recursive call. -/
+theorem CodeTrace.instructionsMatch_of_child {parent child : CodeTrace}
+    (matched : parent.instructionsMatch = true)
+    (member : child ∈ parent.children) :
+    child.instructionsMatch = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      exact (CodeTrace.letOpMatch_of_match matched).nextInstructions
+  | switchValue source block input entryValueCount sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children =>
+      exact codeTraceListInstructionsMatch_of_mem matched member
+
+/-- Every descendant of a coherent compiler trace is instruction-coherent. -/
+theorem CodeTrace.Descendant.instructionsMatch {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.instructionsMatch = true) :
+    child.instructionsMatch = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.instructionsMatch_of_child ih childMem
+
+private theorem codeTraceListInputMapsMatch_of_mem
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListInputMapsMatch traces = true)
+    (member : child ∈ traces) : child.inputMapsMatch = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListInputMapsMatch, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Proof-map coherence is inherited by every immediate recursive call. -/
+theorem CodeTrace.inputMapsMatch_of_child {parent child : CodeTrace}
+    (matched : parent.inputMapsMatch = true)
+    (member : child ∈ parent.children) :
+    child.inputMapsMatch = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      cases binder : Instr.baselineBinderAtom entryValueCount instruction with
+      | none => simp [CodeTrace.inputMapsMatch, binder] at matched
+      | some head =>
+          exact (CodeTrace.inputMapForgets_of_match matched binder).2.2.2
+  | switchValue source block input entryValueCount sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children =>
+      exact codeTraceListInputMapsMatch_of_mem matched member
+
+/-- Every descendant of a coherent compiler trace has coherent proof-map
+progression. -/
+theorem CodeTrace.Descendant.inputMapsMatch {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.inputMapsMatch = true) :
+    child.inputMapsMatch = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.inputMapsMatch_of_child ih childMem
+
+private def sourceOpEq : IxIR1.Op → IxIR1.Op → Bool
+  | .pure left, .pure right => left == right
+  | .alloc lw lc la, .alloc rw rc ra =>
+      lw == rw && lc == rc && la == ra
+  | .reuse lt lc la, .reuse rt rc ra =>
+      lt == rt && lc == rc && la == ra
+  | .free left, .free right
+  | .dup left, .dup right
+  | .drop left, .drop right
+  | .dropU left, .dropU right => left == right
+  | .fetch lt lf, .fetch rt rf => lt == rt && lf == rf
+  | .call lf la, .call rf ra
+  | .papp lf la, .papp rf ra
+  | .extern lf la, .extern rf ra => lf == rf && la == ra
+  | .callSelf left, .callSelf right => left == right
+  | .apply lf la, .apply rf ra => lf == rf && la == ra
+  | _, _ => false
+
+private theorem sourceOpEq_eq_true_iff (left right : IxIR1.Op) :
+    sourceOpEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [sourceOpEq, beq_iff_eq, and_assoc]
+
+mutual
+
+private def sourceCodeEq : IxIR1.Code → IxIR1.Code → Bool
+  | .ret left, .ret right => left == right
+  | .letOp leftOp leftRest, .letOp rightOp rightRest =>
+      sourceOpEq leftOp rightOp && sourceCodeEq leftRest rightRest
+  | .case ls lp la, .case rs rp ra =>
+      ls == rs && lp == rp && sourceAltListEq la.toList ra.toList
+  | _, _ => false
+
+private def sourceAltEq : IxIR1.Alt → IxIR1.Alt → Bool
+  | .mk lc lf lb, .mk rc rf rb =>
+      lc == rc && lf == rf && sourceCodeEq lb rb
+
+private def sourceAltListEq : List IxIR1.Alt → List IxIR1.Alt → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      sourceAltEq left right && sourceAltListEq leftRest rightRest
+  | _, _ => false
+
+end
+
+mutual
+
+private theorem sourceCodeEq_eq_true_iff
+    (left right : IxIR1.Code) :
+    sourceCodeEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [sourceCodeEq, sourceOpEq_eq_true_iff,
+      sourceCodeEq_eq_true_iff, sourceAltListEq_eq_true_iff,
+      beq_iff_eq, and_assoc]
+
+private theorem sourceAltEq_eq_true_iff
+    (left right : IxIR1.Alt) :
+    sourceAltEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [sourceAltEq, sourceCodeEq_eq_true_iff, beq_iff_eq, and_assoc]
+
+private theorem sourceAltListEq_eq_true_iff
+    (left right : List IxIR1.Alt) :
+    sourceAltListEq left right = true ↔ left = right := by
+  cases left with
+  | nil => cases right <;> simp [sourceAltListEq]
+  | cons left leftRest =>
+      cases right with
+      | nil => simp [sourceAltListEq]
+      | cons right rightRest =>
+          simp [sourceAltListEq, sourceAltEq_eq_true_iff,
+            sourceAltListEq_eq_true_iff]
+
+end
+
+/-- Locate the unique source alternative selected by a constructor tag,
+retaining its source-array ordinal for `SourceSite.alternative`. Successful
+lowering rejects duplicate tags before constructing a switch trace. -/
+def sourceAlternativeAtTag? (alternatives : Array IxIR1.Alt) (tag : Nat) :
+    Option (IxIR1.Alt × Nat) :=
+  alternatives.toList.zipIdx.find? fun pair =>
+    match pair.1 with
+    | .mk candidate _ _ => candidate == tag
+
+/-- Forgetting the retained source ordinal recovers the evaluator's ordinary
+first-matching-alternative lookup. -/
+theorem sourceAlternativeAtTag?_map_fst
+    (alternatives : Array IxIR1.Alt) (tag : Nat) :
+    (sourceAlternativeAtTag? alternatives tag).map Prod.fst =
+      alternatives.find? (fun alternative =>
+        match alternative with
+        | .mk candidate _ _ => candidate == tag) := by
+  rw [sourceAlternativeAtTag?]
+  rw [← Array.find?_toList]
+  let predicate : IxIR1.Alt → Bool := fun alternative =>
+    match alternative with
+    | .mk candidate _ _ => candidate == tag
+  change Option.map Prod.fst
+      (alternatives.toList.zipIdx.find? (predicate ∘ Prod.fst)) =
+    alternatives.toList.find? predicate
+  rw [← List.find?_map]
+  simp only [List.zipIdx_map_fst]
+
+/-- Lift the evaluator's successful alternative lookup to the indexed form
+retained by a lowering trace. -/
+theorem sourceAlternativeAtTag?_of_find?
+    {alternatives : Array IxIR1.Alt} {tag : Nat}
+    {alternative : IxIR1.Alt}
+    (found : alternatives.find? (fun candidate =>
+      match candidate with
+      | .mk candidateTag _ _ => candidateTag == tag) = some alternative) :
+    ∃ index,
+      sourceAlternativeAtTag? alternatives tag = some (alternative, index) := by
+  have mapped :
+      (sourceAlternativeAtTag? alternatives tag).map Prod.fst =
+        some alternative := by
+    rw [sourceAlternativeAtTag?_map_fst, found]
+  obtain ⟨pair, pairFound, first⟩ := Option.map_eq_some_iff.mp mapped
+  obtain ⟨selected, index⟩ := pair
+  simp only at first
+  subst selected
+  exact ⟨index, pairFound⟩
+
+/-- A successful tag lookup retains the literal source-array ordinal of the
+selected alternative. -/
+theorem sourceAlternativeAtTag?_getElem? {alternatives : Array IxIR1.Alt}
+    {tag : Nat} {alternative : IxIR1.Alt} {index : Nat}
+    (found : sourceAlternativeAtTag? alternatives tag =
+      some (alternative, index)) :
+    alternatives[index]? = some alternative := by
+  have member : (alternative, index) ∈ alternatives.toList.zipIdx :=
+    List.mem_of_find?_eq_some found
+  have selected : alternatives.toList[index]? = some alternative :=
+    List.mk_mem_zipIdx_iff_getElem?.mp member
+  simpa using selected
+
+/-- The constructor tag stored in a successful lookup is the searched tag. -/
+theorem sourceAlternativeAtTag?_tag {alternatives : Array IxIR1.Alt}
+    {tag actualTag fieldCount : Nat} {body : IxIR1.Code} {index : Nat}
+    (found : sourceAlternativeAtTag? alternatives tag =
+      some (.mk actualTag fieldCount body, index)) :
+    actualTag = tag := by
+  have matched := List.find?_some found
+  exact beq_iff_eq.mp matched
+
+/-- Source proof map after a constructor edge and its generated field-fetch
+prologue. IxIR₁ binds fields in reverse order, while IxIR₂ appends fetch
+results in increasing field order. -/
+def constructorChildInputMap (parameterCount fieldCount : Nat) :
+    Array (Option Atom) :=
+  (List.range fieldCount).reverse.toArray.map fun field =>
+    some (.reg (parameterCount + field))
+
+/-- Executable certificate for the exact fetch prefix inserted before a
+constructor alternative's source body. -/
+def fetchPrologueMatches (instructions : Array Instr) (target : Atom)
+    (cid : CtorId) (fieldCount : Nat) : Bool :=
+  (List.range fieldCount).all fun field =>
+    instructions[field]? == some (.fetch target cid field)
+
+/-- Every certified field ordinal names the exact generated fetch. -/
+theorem fetchPrologueAt_of_match {instructions : Array Instr} {target : Atom}
+    {cid : CtorId} {fieldCount field : Nat}
+    (matched : fetchPrologueMatches instructions target cid fieldCount = true)
+    (bound : field < fieldCount) :
+    instructions[field]? = some (.fetch target cid field) := by
+  have member : field ∈ List.range fieldCount := List.mem_range.mpr bound
+  have checked := List.all_eq_true.mp matched field member
+  exact beq_iff_eq.mp checked
+
+/-- Exact association of one emitted constructor target, its retained edge,
+and the recursive compiler call for the corresponding source alternative. -/
+def constructorBranchMatches (source : SourceSite) (sourceBlock : BlockId)
+    (sourceInputMap : Array (Option Atom))
+    (sourceScrutinee : IxIR1.Atom) (alternatives : Array IxIR1.Alt)
+    (target : CtorAlt) (edge : EdgeTrace) (child : CodeTrace) : Bool :=
+  match sourceAlternativeAtTag? alternatives target.cid.cidx,
+      InputMap.translateAtom (EdgeTrace.explicitMapOf sourceInputMap)
+        sourceScrutinee with
+  | some (.mk tag fieldCount body, alternativeIndex), some childScrutinee =>
+      (tag == target.cid.cidx) &&
+      (edge.source == source) &&
+      (edge.sourceBlock == sourceBlock) &&
+      (edge.sourceInputMap == sourceInputMap) &&
+      (edge.implicitScalars == 0) &&
+      (edge.targetParams.size ==
+        edge.implicitScalars + edge.sourceInputMap.size) &&
+      (edge.target == target.edge.target) &&
+      (target.edge.values == edge.explicitValues) &&
+      target.edge.credits.isEmpty &&
+      (child.source == source.alternative alternativeIndex) &&
+      sourceCodeEq child.sourceCode body &&
+      (child.sourceBlock == edge.target) &&
+      (child.sourceInputMap ==
+        constructorChildInputMap edge.targetParams.size fieldCount ++
+          EdgeTrace.explicitMapOf edge.sourceInputMap) &&
+      (child.entryPc == fieldCount) &&
+      (child.entryValueCount == edge.targetParams.size + fieldCount) &&
+      (child.headBlock.1 == edge.target) &&
+      (child.headBlock.2.valueParams == edge.targetParams) &&
+      child.headBlock.2.creditParams.isEmpty &&
+      fetchPrologueMatches child.headBlock.2.instructions childScrutinee
+        target.cid fieldCount
+  | _, _ => false
+
+/-- Exact association for one literal-Nat edge. The successor edge has one
+implicit scalar parameter; the zero edge has none. -/
+def natBranchMatches (source : SourceSite) (sourceBlock : BlockId)
+    (sourceInputMap : Array (Option Atom)) (alternatives : Array IxIR1.Alt)
+    (tag fieldCount implicitScalars : Nat) (target : Edge)
+    (edge : EdgeTrace) (child : CodeTrace) : Bool :=
+  match sourceAlternativeAtTag? alternatives tag with
+  | some (.mk actualTag actualFieldCount body, alternativeIndex) =>
+      (actualTag == tag) &&
+      (actualFieldCount == fieldCount) &&
+      (edge.source == source) &&
+      (edge.sourceBlock == sourceBlock) &&
+      (edge.sourceInputMap == sourceInputMap) &&
+      (edge.implicitScalars == implicitScalars) &&
+      (edge.targetParams.size ==
+        edge.implicitScalars + edge.sourceInputMap.size) &&
+      (edge.target == target.target) &&
+      (target.values == edge.explicitValues) &&
+      target.credits.isEmpty &&
+      (child.source == source.alternative alternativeIndex) &&
+      sourceCodeEq child.sourceCode body &&
+      (child.sourceBlock == edge.target) &&
+      (child.sourceInputMap == edge.sourceMap) &&
+      (child.entryPc == 0) &&
+      (child.entryValueCount == edge.targetParams.size) &&
+      (child.headBlock.1 == edge.target) &&
+      (child.headBlock.2.valueParams == edge.targetParams) &&
+      child.headBlock.2.creditParams.isEmpty &&
+      (if implicitScalars == 1 then
+        edge.targetParams[0]? == some .scalar
+      else implicitScalars == 0)
+  | none => false
+
+/-- Proof-facing facts reflected from one successful constructor-branch
+association check. -/
+structure ConstructorBranchMatch (source : SourceSite)
+    (sourceBlock : BlockId) (sourceInputMap : Array (Option Atom))
+    (sourceScrutinee : IxIR1.Atom) (alternatives : Array IxIR1.Alt)
+    (target : CtorAlt) (edge : EdgeTrace) (child : CodeTrace) : Type where
+  alternativeIndex : Nat
+  tag : Nat
+  fieldCount : Nat
+  body : IxIR1.Code
+  childScrutinee : Atom
+  sourceAlternative : sourceAlternativeAtTag? alternatives target.cid.cidx =
+    some (.mk tag fieldCount body, alternativeIndex)
+  translatedScrutinee :
+    InputMap.translateAtom (EdgeTrace.explicitMapOf sourceInputMap)
+      sourceScrutinee = some childScrutinee
+  constructorTag : tag = target.cid.cidx
+  edgeSource : edge.source = source
+  edgeSourceBlock : edge.sourceBlock = sourceBlock
+  edgeSourceInput : edge.sourceInputMap = sourceInputMap
+  edgeImplicitScalars : edge.implicitScalars = 0
+  edgeParameterCount : edge.targetParams.size =
+    edge.implicitScalars + edge.sourceInputMap.size
+  edgeTarget : edge.target = target.edge.target
+  edgeValues : target.edge.values = edge.explicitValues
+  edgeCredits : target.edge.credits.isEmpty = true
+  childSource : child.source = source.alternative alternativeIndex
+  childCode : child.sourceCode = body
+  childBlock : child.sourceBlock = edge.target
+  childInput : child.sourceInputMap =
+    constructorChildInputMap edge.targetParams.size fieldCount ++
+      EdgeTrace.explicitMapOf edge.sourceInputMap
+  childPc : child.entryPc = fieldCount
+  childValueCount : child.entryValueCount =
+    edge.targetParams.size + fieldCount
+  childHeadBlock : child.headBlock.1 = edge.target
+  childParams : child.headBlock.2.valueParams = edge.targetParams
+  childCredits : child.headBlock.2.creditParams.isEmpty = true
+  fetchPrologue : fetchPrologueMatches child.headBlock.2.instructions
+    childScrutinee target.cid fieldCount = true
+
+/-- Reflect an executable constructor association into exact source, edge,
+child, and fetch-prologue facts. -/
+def constructorBranchMatch_of_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {target : CtorAlt} {edge : EdgeTrace} {child : CodeTrace}
+    (matched : constructorBranchMatches source sourceBlock sourceInputMap
+      sourceScrutinee alternatives target edge child = true) :
+    ConstructorBranchMatch source sourceBlock sourceInputMap sourceScrutinee
+      alternatives target edge child := by
+  unfold constructorBranchMatches at matched
+  generalize alternativeEq :
+    sourceAlternativeAtTag? alternatives target.cid.cidx = alternative at matched
+  cases alternative with
+  | none => simp at matched
+  | some pair =>
+      obtain ⟨alternative, alternativeIndex⟩ := pair
+      cases alternative with
+      | mk tag fieldCount body =>
+          generalize translatedEq :
+            InputMap.translateAtom
+              (EdgeTrace.explicitMapOf sourceInputMap) sourceScrutinee =
+                translated at matched
+          cases translated with
+          | none => simp at matched
+          | some childScrutinee =>
+              simp only [Bool.and_eq_true] at matched
+              obtain ⟨rest, fetchPrologue⟩ := matched
+              obtain ⟨rest, childCredits⟩ := rest
+              obtain ⟨rest, childParams⟩ := rest
+              obtain ⟨rest, childHeadBlock⟩ := rest
+              obtain ⟨rest, childValueCount⟩ := rest
+              obtain ⟨rest, childPc⟩ := rest
+              obtain ⟨rest, childInput⟩ := rest
+              obtain ⟨rest, childBlock⟩ := rest
+              obtain ⟨rest, childCode⟩ := rest
+              obtain ⟨rest, childSource⟩ := rest
+              obtain ⟨rest, edgeCredits⟩ := rest
+              obtain ⟨rest, edgeValues⟩ := rest
+              obtain ⟨rest, edgeTarget⟩ := rest
+              obtain ⟨rest, edgeParameterCount⟩ := rest
+              obtain ⟨rest, edgeImplicitScalars⟩ := rest
+              obtain ⟨rest, edgeSourceInput⟩ := rest
+              obtain ⟨rest, edgeSourceBlock⟩ := rest
+              obtain ⟨constructorTag, edgeSource⟩ := rest
+              exact
+                { alternativeIndex
+                  tag
+                  fieldCount
+                  body
+                  childScrutinee
+                  sourceAlternative := alternativeEq
+                  translatedScrutinee := translatedEq
+                  constructorTag := beq_iff_eq.mp constructorTag
+                  edgeSource := beq_iff_eq.mp edgeSource
+                  edgeSourceBlock := beq_iff_eq.mp edgeSourceBlock
+                  edgeSourceInput := beq_iff_eq.mp edgeSourceInput
+                  edgeImplicitScalars := beq_iff_eq.mp edgeImplicitScalars
+                  edgeParameterCount := beq_iff_eq.mp edgeParameterCount
+                  edgeTarget := beq_iff_eq.mp edgeTarget
+                  edgeValues := beq_iff_eq.mp edgeValues
+                  edgeCredits
+                  childSource := beq_iff_eq.mp childSource
+                  childCode := (sourceCodeEq_eq_true_iff _ _).mp childCode
+                  childBlock := beq_iff_eq.mp childBlock
+                  childInput := beq_iff_eq.mp childInput
+                  childPc := beq_iff_eq.mp childPc
+                  childValueCount := beq_iff_eq.mp childValueCount
+                  childHeadBlock := beq_iff_eq.mp childHeadBlock
+                  childParams := beq_iff_eq.mp childParams
+                  childCredits
+                  fetchPrologue }
+
+/-- Proof-facing facts reflected from one successful literal-Nat branch
+association check. -/
+structure NatBranchMatch (source : SourceSite) (sourceBlock : BlockId)
+    (sourceInputMap : Array (Option Atom)) (alternatives : Array IxIR1.Alt)
+    (tag fieldCount implicitScalars : Nat) (target : Edge)
+    (edge : EdgeTrace) (child : CodeTrace) : Type where
+  alternativeIndex : Nat
+  body : IxIR1.Code
+  sourceAlternative : sourceAlternativeAtTag? alternatives tag =
+    some (.mk tag fieldCount body, alternativeIndex)
+  edgeSource : edge.source = source
+  edgeSourceBlock : edge.sourceBlock = sourceBlock
+  edgeSourceInput : edge.sourceInputMap = sourceInputMap
+  edgeImplicitScalars : edge.implicitScalars = implicitScalars
+  edgeParameterCount : edge.targetParams.size =
+    edge.implicitScalars + edge.sourceInputMap.size
+  edgeTarget : edge.target = target.target
+  edgeValues : target.values = edge.explicitValues
+  edgeCredits : target.credits.isEmpty = true
+  childSource : child.source = source.alternative alternativeIndex
+  childCode : child.sourceCode = body
+  childBlock : child.sourceBlock = edge.target
+  childInput : child.sourceInputMap = edge.sourceMap
+  childPc : child.entryPc = 0
+  childValueCount : child.entryValueCount = edge.targetParams.size
+  childHeadBlock : child.headBlock.1 = edge.target
+  childParams : child.headBlock.2.valueParams = edge.targetParams
+  childCredits : child.headBlock.2.creditParams.isEmpty = true
+  implicitConvention :
+    (if implicitScalars == 1 then
+      edge.targetParams[0]? == some .scalar
+    else implicitScalars == 0) = true
+
+/-- Reflect an executable Nat association into exact source, edge, child, and
+implicit-predecessor facts. -/
+def natBranchMatch_of_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)} {alternatives : Array IxIR1.Alt}
+    {tag fieldCount implicitScalars : Nat} {target : Edge}
+    {edge : EdgeTrace} {child : CodeTrace}
+    (matched : natBranchMatches source sourceBlock sourceInputMap alternatives
+      tag fieldCount implicitScalars target edge child = true) :
+    NatBranchMatch source sourceBlock sourceInputMap alternatives tag
+      fieldCount implicitScalars target edge child := by
+  unfold natBranchMatches at matched
+  generalize alternativeEq :
+    sourceAlternativeAtTag? alternatives tag = alternative at matched
+  cases alternative with
+  | none => simp at matched
+  | some pair =>
+      obtain ⟨alternative, alternativeIndex⟩ := pair
+      cases alternative with
+      | mk actualTag actualFieldCount body =>
+          simp only [Bool.and_eq_true] at matched
+          obtain ⟨rest, implicitConvention⟩ := matched
+          obtain ⟨rest, childCredits⟩ := rest
+          obtain ⟨rest, childParams⟩ := rest
+          obtain ⟨rest, childHeadBlock⟩ := rest
+          obtain ⟨rest, childValueCount⟩ := rest
+          obtain ⟨rest, childPc⟩ := rest
+          obtain ⟨rest, childInput⟩ := rest
+          obtain ⟨rest, childBlock⟩ := rest
+          obtain ⟨rest, childCode⟩ := rest
+          obtain ⟨rest, childSource⟩ := rest
+          obtain ⟨rest, edgeCredits⟩ := rest
+          obtain ⟨rest, edgeValues⟩ := rest
+          obtain ⟨rest, edgeTarget⟩ := rest
+          obtain ⟨rest, edgeParameterCount⟩ := rest
+          obtain ⟨rest, edgeImplicitScalars⟩ := rest
+          obtain ⟨rest, edgeSourceInput⟩ := rest
+          obtain ⟨rest, edgeSourceBlock⟩ := rest
+          obtain ⟨rest, edgeSource⟩ := rest
+          obtain ⟨actualTagEq, actualFieldCountEq⟩ := rest
+          have tagEq : actualTag = tag := beq_iff_eq.mp actualTagEq
+          have fieldCountEq : actualFieldCount = fieldCount :=
+            beq_iff_eq.mp actualFieldCountEq
+          subst actualTag
+          subst actualFieldCount
+          exact
+            { alternativeIndex
+              body
+              sourceAlternative := alternativeEq
+              edgeSource := beq_iff_eq.mp edgeSource
+              edgeSourceBlock := beq_iff_eq.mp edgeSourceBlock
+              edgeSourceInput := beq_iff_eq.mp edgeSourceInput
+              edgeImplicitScalars := beq_iff_eq.mp edgeImplicitScalars
+              edgeParameterCount := beq_iff_eq.mp edgeParameterCount
+              edgeTarget := beq_iff_eq.mp edgeTarget
+              edgeValues := beq_iff_eq.mp edgeValues
+              edgeCredits
+              childSource := beq_iff_eq.mp childSource
+              childCode := (sourceCodeEq_eq_true_iff _ _).mp childCode
+              childBlock := beq_iff_eq.mp childBlock
+              childInput := beq_iff_eq.mp childInput
+              childPc := beq_iff_eq.mp childPc
+              childValueCount := beq_iff_eq.mp childValueCount
+              childHeadBlock := beq_iff_eq.mp childHeadBlock
+              childParams := beq_iff_eq.mp childParams
+              childCredits
+              implicitConvention }
+
+/-- Local switch certificate. Constructor targets consume the first parallel
+edge/child entries in emitted order; an optional Nat zero/successor pair
+consumes exactly the final two. No unassociated edge or child is permitted. -/
+def switchNodeBranchesMatch (source : SourceSite) (sourceBlock : BlockId)
+    (sourceInputMap : Array (Option Atom))
+    (sourceScrutinee : IxIR1.Atom) (peelNat : Bool)
+    (alternatives : Array IxIR1.Alt) (generated : Block)
+    (outgoing : List EdgeTrace) (children : List CodeTrace) : Bool :=
+  match generated.terminator with
+  | .switchValue _ constructors natPeel =>
+      let constructorCount := constructors.size
+      let natCount := if natPeel.isSome then 2 else 0
+      (outgoing.length == constructorCount + natCount) &&
+      (children.length == constructorCount + natCount) &&
+      (constructors.toList.zipIdx.all fun pair =>
+        match outgoing[pair.2]?, children[pair.2]? with
+        | some edge, some child =>
+            constructorBranchMatches source sourceBlock sourceInputMap
+              sourceScrutinee alternatives pair.1 edge child
+        | _, _ => false) &&
+      match peelNat, natPeel with
+      | false, none => true
+      | true, some peel =>
+          match outgoing[constructorCount]?, children[constructorCount]?,
+              outgoing[constructorCount + 1]?, children[constructorCount + 1]?
+              with
+          | some zeroEdge, some zeroChild, some succEdge, some succChild =>
+              natBranchMatches source sourceBlock sourceInputMap alternatives
+                0 0 0 peel.zero zeroEdge zeroChild &&
+              natBranchMatches source sourceBlock sourceInputMap alternatives
+                1 1 1 peel.succ succEdge succChild
+          | _, _, _, _ => false
+      | _, _ => false
+  | _ => false
+
+/-- A checked switch exposes its exact emitted target vectors, with no spare
+edge or child and with Nat presence agreeing with the source flag. -/
+theorem switchBranchShape_of_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    (matched : switchNodeBranchesMatch source sourceBlock sourceInputMap
+      sourceScrutinee peelNat alternatives generated outgoing children = true) :
+    ∃ targetScrutinee constructors natPeel,
+      generated.terminator =
+          .switchValue targetScrutinee constructors natPeel ∧
+        outgoing.length = constructors.size +
+          (if natPeel.isSome then 2 else 0) ∧
+        children.length = constructors.size +
+          (if natPeel.isSome then 2 else 0) ∧
+        peelNat = natPeel.isSome := by
+  cases terminatorEq : generated.terminator with
+  | jump edge => simp [switchNodeBranchesMatch, terminatorEq] at matched
+  | branchCredit credit someEdge noneEdge =>
+      simp [switchNodeBranchesMatch, terminatorEq] at matched
+  | ret value => simp [switchNodeBranchesMatch, terminatorEq] at matched
+  | tailCall function arguments =>
+      simp [switchNodeBranchesMatch, terminatorEq] at matched
+  | tailCallSelf arguments =>
+      simp [switchNodeBranchesMatch, terminatorEq] at matched
+  | switchValue targetScrutinee constructors natPeel =>
+      simp only [switchNodeBranchesMatch, terminatorEq, Bool.and_eq_true] at matched
+      obtain ⟨⟨⟨outgoingLength, childrenLength⟩, _⟩, natMatched⟩ := matched
+      refine ⟨targetScrutinee, constructors, natPeel, rfl,
+        beq_iff_eq.mp outgoingLength, beq_iff_eq.mp childrenLength, ?_⟩
+      cases peelNat <;> cases natPeel <;> simp_all
+
+/-- Select one constructor association from a checked switch once its three
+parallel entries are named. The list-shape theorem above supplies their
+existence; this definition supplies all semantic facts. -/
+def constructorBranchMatchAt_of_switch_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    {targetScrutinee : Atom} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {index : Nat} {target : CtorAlt}
+    {edge : EdgeTrace} {child : CodeTrace}
+    (matched : switchNodeBranchesMatch source sourceBlock sourceInputMap
+      sourceScrutinee peelNat alternatives generated outgoing children = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors natPeel)
+    (targetAt : constructors[index]? = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child) :
+    ConstructorBranchMatch source sourceBlock sourceInputMap sourceScrutinee
+      alternatives target edge child := by
+  unfold switchNodeBranchesMatch at matched
+  rw [terminator] at matched
+  simp only [Bool.and_eq_true] at matched
+  obtain ⟨⟨⟨_, _⟩, constructorsMatched⟩, _⟩ := matched
+  have targetListAt : constructors.toList[index]? = some target := by
+    simpa using targetAt
+  have member : (target, index) ∈ constructors.toList.zipIdx :=
+    List.mk_mem_zipIdx_iff_getElem?.mpr targetListAt
+  have branchMatched :=
+    List.all_eq_true.mp constructorsMatched (target, index) member
+  simp [edgeAt, childAt] at branchMatched
+  exact constructorBranchMatch_of_match branchMatched
+
+/-- Select the checked Nat-zero association at the first post-constructor
+ordinal. -/
+def natZeroBranchMatchAt_of_switch_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {edge : EdgeTrace} {child : CodeTrace}
+    (matched : switchNodeBranchesMatch source sourceBlock sourceInputMap
+      sourceScrutinee true alternatives generated outgoing children = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (edgeAt : outgoing[constructors.size]? = some edge)
+    (childAt : children[constructors.size]? = some child) :
+    NatBranchMatch source sourceBlock sourceInputMap alternatives 0 0 0
+      peel.zero edge child := by
+  unfold switchNodeBranchesMatch at matched
+  rw [terminator] at matched
+  simp only [Bool.and_eq_true] at matched
+  obtain ⟨⟨⟨_, _⟩, _⟩, natMatched⟩ := matched
+  cases succEdgeAt : outgoing[constructors.size + 1]? with
+  | none => simp [edgeAt, childAt, succEdgeAt] at natMatched
+  | some succEdge =>
+      cases succChildAt : children[constructors.size + 1]? with
+      | none => simp [edgeAt, childAt, succEdgeAt, succChildAt] at natMatched
+      | some succChild =>
+          simp [edgeAt, childAt, succEdgeAt, succChildAt,
+            Bool.and_eq_true] at natMatched
+          exact natBranchMatch_of_match natMatched.1
+
+/-- Select the checked Nat-successor association at the second
+post-constructor ordinal. -/
+def natSuccBranchMatchAt_of_switch_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {edge : EdgeTrace} {child : CodeTrace}
+    (matched : switchNodeBranchesMatch source sourceBlock sourceInputMap
+      sourceScrutinee true alternatives generated outgoing children = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (edgeAt : outgoing[constructors.size + 1]? = some edge)
+    (childAt : children[constructors.size + 1]? = some child) :
+    NatBranchMatch source sourceBlock sourceInputMap alternatives 1 1 1
+      peel.succ edge child := by
+  unfold switchNodeBranchesMatch at matched
+  rw [terminator] at matched
+  simp only [Bool.and_eq_true] at matched
+  obtain ⟨⟨⟨_, _⟩, _⟩, natMatched⟩ := matched
+  cases zeroEdgeAt : outgoing[constructors.size]? with
+  | none => simp [edgeAt, childAt, zeroEdgeAt] at natMatched
+  | some zeroEdge =>
+      cases zeroChildAt : children[constructors.size]? with
+      | none => simp [edgeAt, childAt, zeroEdgeAt, zeroChildAt] at natMatched
+      | some zeroChild =>
+          simp [edgeAt, childAt, zeroEdgeAt, zeroChildAt,
+            Bool.and_eq_true] at natMatched
+          exact natBranchMatch_of_match natMatched.2
+
+/-- Both literal-Nat branches selected from one checked switch. Keeping their
+parallel list coordinates in one record lets semantic clients enter either
+child without repeating list-length or lookup reasoning. -/
+structure NatBranchPairMatch (source : SourceSite) (sourceBlock : BlockId)
+    (sourceInputMap : Array (Option Atom))
+    (alternatives : Array IxIR1.Alt) (constructors : Array CtorAlt)
+    (peel : NatPeel) (outgoing : List EdgeTrace)
+    (children : List CodeTrace) : Type where
+  zeroEdge : EdgeTrace
+  zeroChild : CodeTrace
+  succEdge : EdgeTrace
+  succChild : CodeTrace
+  zeroEdgeAt : outgoing[constructors.size]? = some zeroEdge
+  zeroChildAt : children[constructors.size]? = some zeroChild
+  succEdgeAt : outgoing[constructors.size + 1]? = some succEdge
+  succChildAt : children[constructors.size + 1]? = some succChild
+  zero : NatBranchMatch source sourceBlock sourceInputMap alternatives
+    0 0 0 peel.zero zeroEdge zeroChild
+  succ : NatBranchMatch source sourceBlock sourceInputMap alternatives
+    1 1 1 peel.succ succEdge succChild
+
+/-- Reflect the complete zero/successor pair from a checked Nat switch. -/
+def natBranchPairMatch_of_switch_match
+    {source : SourceSite} {sourceBlock : BlockId}
+    {sourceInputMap : Array (Option Atom)}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    (matched : switchNodeBranchesMatch source sourceBlock sourceInputMap
+      sourceScrutinee true alternatives generated outgoing children = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel)) :
+    NatBranchPairMatch source sourceBlock sourceInputMap alternatives
+      constructors peel outgoing children := by
+  unfold switchNodeBranchesMatch at matched
+  rw [terminator] at matched
+  simp only [Bool.and_eq_true] at matched
+  obtain ⟨⟨⟨_, _⟩, _⟩, natMatched⟩ := matched
+  cases zeroEdgeAt : outgoing[constructors.size]? with
+  | none => simp [zeroEdgeAt] at natMatched
+  | some zeroEdge =>
+      cases zeroChildAt : children[constructors.size]? with
+      | none => simp [zeroEdgeAt, zeroChildAt] at natMatched
+      | some zeroChild =>
+          cases succEdgeAt : outgoing[constructors.size + 1]? with
+          | none =>
+              simp [zeroEdgeAt, zeroChildAt, succEdgeAt] at natMatched
+          | some succEdge =>
+              cases succChildAt : children[constructors.size + 1]? with
+              | none =>
+                  simp [zeroEdgeAt, zeroChildAt, succEdgeAt, succChildAt]
+                    at natMatched
+              | some succChild =>
+                  simp only [zeroEdgeAt, zeroChildAt, succEdgeAt, succChildAt,
+                    Bool.and_eq_true] at natMatched
+                  exact
+                    { zeroEdge
+                      zeroChild
+                      succEdge
+                      succChild
+                      zeroEdgeAt
+                      zeroChildAt
+                      succEdgeAt
+                      succChildAt
+                      zero := natBranchMatch_of_match natMatched.1
+                      succ := natBranchMatch_of_match natMatched.2 }
+
+mutual
+
+/-- Recursive switch/child/prologue coherence for a whole compiler trace. -/
+def CodeTrace.switchBranchesMatch : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ _ _ _ next => next.switchBranchesMatch
+  | .switchValue source block input _ sourceScrutinee peelNat alternatives _
+      generated outgoing children =>
+      switchNodeBranchesMatch source block input sourceScrutinee peelNat
+        alternatives generated outgoing children &&
+      codeTraceListSwitchBranchesMatch children
+
+private def codeTraceListSwitchBranchesMatch : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.switchBranchesMatch && codeTraceListSwitchBranchesMatch rest
+
+end
+
+/-- Extract the local switch association check from the recursive trace
+certificate. -/
+theorem CodeTrace.switchNodeBranchesMatch_of_match
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace}
+    (matched : (CodeTrace.switchValue source block input entryValueCount
+      sourceScrutinee peelNat alternatives targetScrutinee generated outgoing
+      children).switchBranchesMatch = true) :
+    switchNodeBranchesMatch source block input sourceScrutinee peelNat
+      alternatives generated outgoing children = true := by
+  change (switchNodeBranchesMatch source block input sourceScrutinee peelNat
+    alternatives generated outgoing children &&
+      codeTraceListSwitchBranchesMatch children) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  exact matched.1
+
+private theorem codeTraceListSwitchBranchesMatch_of_mem
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListSwitchBranchesMatch traces = true)
+    (member : child ∈ traces) : child.switchBranchesMatch = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListSwitchBranchesMatch, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Switch coherence is inherited by every immediate recursive call. -/
+theorem CodeTrace.switchBranchesMatch_of_child {parent child : CodeTrace}
+    (matched : parent.switchBranchesMatch = true)
+    (member : child ∈ parent.children) :
+    child.switchBranchesMatch = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simpa [CodeTrace.switchBranchesMatch] using matched
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [CodeTrace.switchBranchesMatch, Bool.and_eq_true] at matched
+      exact codeTraceListSwitchBranchesMatch_of_mem matched.2 member
+
+/-- Every descendant inherits exact switch-edge/child/prologue coherence. -/
+theorem CodeTrace.Descendant.switchBranchesMatch {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.switchBranchesMatch = true) :
+    child.switchBranchesMatch = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.switchBranchesMatch_of_child ih childMem
+
+/-! ## Allocation-schema evidence retained for semantic simulation -/
+
+/-- The schema fact needed by one ordinary source allocation: the lookup is
+present, has exactly the source operand count, and is uniform in the source
+allocation world required by IxIR₂ v0. -/
+private def allocationSchemaMatches
+    (schemas : Owned → CtorId → Option CtorSchema) : IxIR1.Op → Bool
+  | .alloc world identity arguments =>
+      match schemas world identity with
+      | some schema =>
+          schema.fields == Array.replicate arguments.size world
+      | none => false
+  | _ => true
+
+mutual
+
+/-- Recursive allocation-schema coherence for one compiler derivation. This
+is checked after ordinary validation and retained by `Checked`, avoiding any
+later inversion of the validator's dataflow implementation. -/
+def CodeTrace.allocationSchemasMatch
+    (schemas : Owned → CtorId → Option CtorSchema) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ operation _ _ next =>
+      allocationSchemaMatches schemas operation &&
+        next.allocationSchemasMatch schemas
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListAllocationSchemasMatch schemas children
+
+private def codeTraceListAllocationSchemasMatch
+    (schemas : Owned → CtorId → Option CtorSchema) :
+    List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.allocationSchemasMatch schemas &&
+        codeTraceListAllocationSchemasMatch schemas rest
+
+end
+
+/-- Reflect the exact schema lookup and uniform field vector at one retained
+ordinary allocation node. -/
+theorem CodeTrace.allocationSchema_of_match
+    (schemas : Owned → CtorId → Option CtorSchema)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.alloc world identity arguments) index instruction next).allocationSchemasMatch
+        schemas = true) :
+    ∃ schema, schemas world identity = some schema ∧
+      schema.fields = Array.replicate arguments.size world := by
+  change (allocationSchemaMatches schemas (.alloc world identity arguments) &&
+    next.allocationSchemasMatch schemas) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  have localMatch := matched.1
+  unfold allocationSchemaMatches at localMatch
+  cases lookup : schemas world identity with
+  | none => simp [lookup] at localMatch
+  | some schema =>
+      refine ⟨schema, rfl, ?_⟩
+      exact beq_iff_eq.mp (by simpa [lookup] using localMatch)
+
+private theorem codeTraceListAllocationSchemasMatch_of_mem
+    (schemas : Owned → CtorId → Option CtorSchema)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListAllocationSchemasMatch schemas traces = true)
+    (member : child ∈ traces) :
+    child.allocationSchemasMatch schemas = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListAllocationSchemasMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Allocation-schema coherence is inherited by every immediate recursive
+compiler call. -/
+theorem CodeTrace.allocationSchemasMatch_of_child
+    (schemas : Owned → CtorId → Option CtorSchema)
+    {parent child : CodeTrace}
+    (matched : parent.allocationSchemasMatch schemas = true)
+    (member : child ∈ parent.children) :
+    child.allocationSchemasMatch schemas = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.allocationSchemasMatch, Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListAllocationSchemasMatch_of_mem schemas matched member
+
+/-- Every recursive trace descendant inherits the checked allocation-schema
+facts of its root. -/
+theorem CodeTrace.Descendant.allocationSchemasMatch
+    (schemas : Owned → CtorId → Option CtorSchema)
+    {root child : CodeTrace} (descendant : Descendant root child)
+    (matched : root.allocationSchemasMatch schemas = true) :
+    child.allocationSchemasMatch schemas = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.allocationSchemasMatch_of_child schemas ih childMem
+
+
+/-- Executable structural equality for retained IxIR₁ function sources. -/
+def functionSourceEq (left right : IxIR1.FnDef) : Bool :=
+  left.arity == right.arity && left.result == right.result &&
+    left.papSafe == right.papSafe && sourceCodeEq left.body right.body
+
+/-- Reflection theorem for retained IxIR₁ function-source equality. -/
+theorem functionSourceEq_eq_true_iff
+    (left right : IxIR1.FnDef) :
+    functionSourceEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [functionSourceEq, sourceCodeEq_eq_true_iff,
+    beq_iff_eq, and_assoc]
+
+private def sourceDeclEq : IxIR1.Decl → IxIR1.Decl → Bool
+  | .extern left, .extern right => left == right
+  | .fn left, .fn right => functionSourceEq left right
+  | _, _ => false
+
+private theorem sourceDeclEq_eq_true_iff (left right : IxIR1.Decl) :
+    sourceDeclEq left right = true ↔ left = right := by
+  cases left <;> cases right <;>
+    simp [sourceDeclEq, functionSourceEq_eq_true_iff, beq_iff_eq]
+
+private def sourceEntryEq
+    (left right : Address × IxIR1.Decl) : Bool :=
+  left.1 == right.1 && sourceDeclEq left.2 right.2
+
+private theorem sourceEntryEq_eq_true_iff
+    (left right : Address × IxIR1.Decl) :
+    sourceEntryEq left right = true ↔ left = right := by
+  obtain ⟨leftAddress, leftDecl⟩ := left
+  obtain ⟨rightAddress, rightDecl⟩ := right
+  simp [sourceEntryEq, sourceDeclEq_eq_true_iff, beq_iff_eq]
+
+private def sourceDeclListEq :
+    List (Address × IxIR1.Decl) → List (Address × IxIR1.Decl) → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      sourceEntryEq left right && sourceDeclListEq leftRest rightRest
+  | _, _ => false
+
+private theorem sourceDeclListEq_eq_true_iff
+    (left right : List (Address × IxIR1.Decl)) :
+    sourceDeclListEq left right = true ↔ left = right := by
+  induction left generalizing right with
+  | nil => cases right <;> simp [sourceDeclListEq]
+  | cons head tail ih =>
+      cases right with
+      | nil => simp [sourceDeclListEq]
+      | cons rightHead rightTail =>
+          simp [sourceDeclListEq, sourceEntryEq_eq_true_iff, ih]
+
+/-- Executable equality for lowering inputs. Source syntax deliberately lacks
+global `BEq` instances, so the producer reuses its exact structural source
+comparators at this boundary. -/
+def inputEq (left right : Input) : Bool :=
+  sourceDeclListEq left.declarations right.declarations &&
+    sourceCodeEq left.main right.main && left.mainResult == right.mainResult
+
+/-- Reflection theorem for the checked lowering-input equality. -/
+theorem inputEq_eq_true_iff (left right : Input) :
+    inputEq left right = true ↔ left = right := by
+  cases left
+  cases right
+  simp [inputEq, sourceDeclListEq_eq_true_iff,
+    sourceCodeEq_eq_true_iff, beq_iff_eq, and_assoc]
+
+/-- Canonical proof map at a function entry: source de Bruijn parameters are
+reversed onto target call-order registers. -/
+def entryInputMap (arity : Nat) : Array (Option Atom) :=
+  (List.range arity).toArray.map fun sourceIndex =>
+    some (.reg (arity - 1 - sourceIndex))
+
+
+/-- Exact source/target identity retained around one recursive compiler
+derivation.  Parameter ownership is intentionally target-only, while arity,
+result world, PAP safety, and code remain the source function's facts. -/
+structure FunctionSourceMatch (source : IxIR1.FnDef) (generated : Function)
+    (root : CodeTrace) : Prop where
+  code : root.sourceCode = source.body
+  arity : generated.signature.params.size = source.arity
+  result : generated.signature.result = source.result
+  papSafe : generated.signature.papSafe = source.papSafe
+  entryBlock : root.sourceBlock = 0
+  entryPc : root.entryPc = 0
+  entryValueCount : root.entryValueCount = source.arity
+  entryInput : root.sourceInputMap = entryInputMap source.arity
+
+/-- Executable producer check for `FunctionSourceMatch`. -/
+def functionSourceMatches (source : IxIR1.FnDef) (generated : Function)
+    (root : CodeTrace) : Bool :=
+  sourceCodeEq root.sourceCode source.body &&
+    (generated.signature.params.size == source.arity) &&
+    (generated.signature.result == source.result) &&
+    (generated.signature.papSafe == source.papSafe) &&
+    (root.sourceBlock == 0) &&
+    (root.entryPc == 0) &&
+    (root.entryValueCount == source.arity) &&
+    (root.sourceInputMap == entryInputMap source.arity)
+
+/-- Turn the executable source-identity check into the proof-facing record. -/
+theorem functionSourceMatch_of_match {source : IxIR1.FnDef}
+    {generated : Function} {root : CodeTrace}
+    (matched : functionSourceMatches source generated root = true) :
+    FunctionSourceMatch source generated root := by
+  simp only [functionSourceMatches, Bool.and_eq_true] at matched
+  rcases matched with ⟨⟨⟨⟨⟨⟨⟨code, arity⟩, result⟩, papSafe⟩,
+    entryBlock⟩, entryPc⟩, entryValueCount⟩, entryInput⟩
+  exact
+    { code := (sourceCodeEq_eq_true_iff _ _).mp code
+      arity := beq_iff_eq.mp arity
+      result := beq_iff_eq.mp result
+      papSafe := beq_iff_eq.mp papSafe
+      entryBlock := beq_iff_eq.mp entryBlock
+      entryPc := beq_iff_eq.mp entryPc
+      entryValueCount := beq_iff_eq.mp entryValueCount
+      entryInput := beq_iff_eq.mp entryInput }
+
+/-- One source function and the exact recursive compiler derivation that
+produced its target function. -/
+structure FunctionTrace where
+  owner : Validate.Owner
+  source : IxIR1.FnDef
+  generated : Function
+  root : CodeTrace
+  /-- The recursive compiler run begins at this owner's empty branch path and
+  zero source offset. -/
+  rootSource : root.source = ({ owner := owner } : SourceSite)
+  /-- The recursive trace reconstructs the literal source body, and the
+  generated signature preserves every non-ownership source signature fact. -/
+  sourceOrder : FunctionSourceMatch source generated root
+  /-- Every instruction node names the exact instruction retained at its
+  final generated block coordinate. -/
+  instructionOrder : root.instructionsMatch = true
+  /-- Every instruction continuation keeps or forgets source slots without
+  retargeting them. -/
+  inputMapOrder : root.inputMapsMatch = true
+  /-- Every recursive compiler node at target PC zero has the value-register
+  count declared by its completed head block's parameter ABI. -/
+  entryValueCountOrder : root.entryValueCountsMatch = true
+  /-- Every retained source operand translates to the target operand emitted
+  at that node, and every terminal node retains its exact terminator. -/
+  syntaxOrder : root.syntaxMatches = true
+  /-- Every switch target is associated in order with exactly one generated
+  edge and recursive child; constructor children additionally certify their
+  field-fetch prologue and Nat children their implicit-prefix convention. -/
+  switchBranchOrder : root.switchBranchesMatch = true
+  /-- Every retained terminal block is exactly the corresponding generated
+  block, in canonical block-id order.  The producer checks this internal
+  invariant once after finishing the mutable block array. -/
+  blockOrder : root.blocks =
+    generated.blocks.toList.zipIdx.map fun pair => (pair.2, pair.1)
+
+/-- External identity of a retained function trace at an artifact boundary. -/
+structure FunctionTraceMatch (trace : FunctionTrace) (owner : Validate.Owner)
+    (source : IxIR1.FnDef) (generated : Function) : Prop where
+  owner : trace.owner = owner
+  source : trace.source = source
+  generated : trace.generated = generated
+
+/-- Executable check tying a function trace to an external source/target
+pair. The trace's internal source/signature/code certificate remains separate. -/
+def functionTraceMatches (trace : FunctionTrace) (owner : Validate.Owner)
+    (source : IxIR1.FnDef) (generated : Function) : Bool :=
+  (trace.owner == owner) && functionSourceEq trace.source source &&
+    (trace.generated == generated)
+
+/-- Reflect the executable external trace-identity check. -/
+theorem functionTraceMatch_of_match {trace : FunctionTrace}
+    {owner : Validate.Owner} {source : IxIR1.FnDef} {generated : Function}
+    (matched : functionTraceMatches trace owner source generated = true) :
+    FunctionTraceMatch trace owner source generated := by
+  simp only [functionTraceMatches, Bool.and_eq_true] at matched
+  exact
+    { owner := beq_iff_eq.mp matched.1.1
+      source := (functionSourceEq_eq_true_iff _ _).mp matched.1.2
+      generated := beq_iff_eq.mp matched.2 }
+
+namespace FunctionTrace
+
+/-- The recursive derivation is rooted at the literal retained source body. -/
+theorem rootSourceCode (trace : FunctionTrace) :
+    trace.root.sourceCode = trace.source.body :=
+  trace.sourceOrder.code
+
+/-- Generated parameter ownership may be richer, but arity is unchanged. -/
+theorem sourceArity (trace : FunctionTrace) :
+    trace.generated.signature.params.size = trace.source.arity :=
+  trace.sourceOrder.arity
+
+/-- Lowering preserves the declared result world. -/
+theorem sourceResult (trace : FunctionTrace) :
+    trace.generated.signature.result = trace.source.result :=
+  trace.sourceOrder.result
+
+/-- Lowering preserves the source PAP-entry policy. -/
+theorem sourcePapSafe (trace : FunctionTrace) :
+    trace.generated.signature.papSafe = trace.source.papSafe :=
+  trace.sourceOrder.papSafe
+
+/-- Every retained compiler derivation starts at CFG block zero. -/
+theorem entryBlock (trace : FunctionTrace) :
+    trace.root.sourceBlock = 0 :=
+  trace.sourceOrder.entryBlock
+
+/-- Every retained compiler derivation starts before its first instruction. -/
+theorem entryPc (trace : FunctionTrace) :
+    trace.root.entryPc = 0 :=
+  trace.sourceOrder.entryPc
+
+/-- Entry value-register count is exactly the source arity. -/
+theorem entryValueCount (trace : FunctionTrace) :
+    trace.root.entryValueCount = trace.source.arity :=
+  trace.sourceOrder.entryValueCount
+
+/-- Every retained compiler derivation starts with the canonical reversed
+source-parameter map. -/
+theorem entryInput (trace : FunctionTrace) :
+    trace.root.sourceInputMap = entryInputMap trace.source.arity :=
+  trace.sourceOrder.entryInput
+
+/-- The completed root block is the function entry block. -/
+theorem rootHeadBlock (trace : FunctionTrace) :
+    trace.root.headBlock.1 = 0 :=
+  (CodeTrace.headBlock_eq_sourceBlock_of_match trace.instructionOrder).trans
+    trace.entryBlock
+
+/-- Indexing the derivation's canonical block list yields exactly the block
+at that identifier in the generated function.  This is the direct bridge
+from recursive trace induction to evaluator block lookup. -/
+theorem blockAt (trace : FunctionTrace) (id : BlockId) :
+    trace.root.blocks[id]? =
+      (trace.generated.blocks[id]?).map fun block => (id, block) := by
+  rw [trace.blockOrder]
+  simp [Function.comp_def]
+
+/-- Any block reached through recursive trace traversal is the actual block
+installed at its retained identifier.  This membership-oriented form is what
+the semantic induction uses for switch children, whose block-list ordinal is
+not carried separately by the induction hypothesis. -/
+theorem blockAt_of_mem (trace : FunctionTrace) {id : BlockId} {block : Block}
+    (member : (id, block) ∈ trace.root.blocks) :
+    trace.generated.blocks[id]? = some block := by
+  rw [trace.blockOrder] at member
+  simp only [List.mem_map] at member
+  obtain ⟨⟨candidate, index⟩, zipped, equal⟩ := member
+  have indexEq : index = id := congrArg Prod.fst equal
+  have blockEq : candidate = block := congrArg Prod.snd equal
+  subst index
+  subst candidate
+  simpa using (List.mk_mem_zipIdx_iff_getElem?.mp zipped)
+
+/-- The head block exposed by the recursive derivation is executable directly
+from the generated function, without a caller-supplied block-lookup premise. -/
+theorem headBlockAt (trace : FunctionTrace) :
+    trace.generated.blocks[trace.root.headBlock.1]? =
+      some trace.root.headBlock.2 :=
+  trace.blockAt_of_mem trace.root.headBlock_mem_blocks
+
+/-- Every successfully retained function has its certified entry/head block. -/
+theorem generatedNonempty (trace : FunctionTrace) :
+    trace.generated.blocks.isEmpty = false := by
+  have found := trace.headBlockAt
+  apply Array.isEmpty_eq_false_iff.mpr
+  intro empty
+  rw [empty] at found
+  simp at found
+
+/-- Every recursive continuation or switch child names its exact executable
+head block in the generated function.  This removes block lookup as a premise
+from induction hypotheses over `CodeTrace.Descendant`. -/
+theorem descendantHeadBlockAt (trace : FunctionTrace) {child : CodeTrace}
+    (descendant : trace.root.Descendant child) :
+    trace.generated.blocks[child.headBlock.1]? = some child.headBlock.2 :=
+  trace.blockAt_of_mem
+    (descendant.blocks_subset child.headBlock_mem_blocks)
+
+/-- Every recursive continuation/switch child inherits the producer's exact
+instruction-coordinate certificate. -/
+theorem descendantInstructionsMatch (trace : FunctionTrace)
+    {child : CodeTrace} (descendant : trace.root.Descendant child) :
+    child.instructionsMatch = true :=
+  descendant.instructionsMatch trace.instructionOrder
+
+/-- Every recursive continuation/switch child inherits proof-map
+progression coherence. -/
+theorem descendantInputMapsMatch (trace : FunctionTrace)
+    {child : CodeTrace} (descendant : trace.root.Descendant child) :
+    child.inputMapsMatch = true :=
+  descendant.inputMapsMatch trace.inputMapOrder
+
+/-- Every recursive continuation or switch child beginning at target PC zero
+has exactly the target values declared by its head block's parameter ABI. -/
+theorem descendantEntryValueCount (trace : FunctionTrace)
+    {child : CodeTrace} (descendant : trace.root.Descendant child)
+    (pc : child.entryPc = 0) :
+    child.entryValueCount = child.headBlock.2.valueParams.size :=
+  CodeTrace.entryValueCount_eq_headParams_of_match
+    (descendant.entryValueCountsMatch trace.entryValueCountOrder) pc
+
+/-- Every recursive continuation/switch child inherits exact source/target
+operand and terminator syntax. -/
+theorem descendantSyntaxMatches (trace : FunctionTrace)
+    {child : CodeTrace} (descendant : trace.root.Descendant child) :
+    child.syntaxMatches = true :=
+  descendant.syntaxMatches trace.syntaxOrder
+
+/-- Every recursive continuation/switch child inherits exact branch-edge,
+child-body, successor-map, and constructor-prologue coherence. -/
+theorem descendantSwitchBranchesMatch (trace : FunctionTrace)
+    {child : CodeTrace} (descendant : trace.root.Descendant child) :
+    child.switchBranchesMatch = true :=
+  descendant.switchBranchesMatch trace.switchBranchOrder
+
+/-- A recursive instruction node exposes its checked proof-facing operation
+syntax directly from trace membership. -/
+theorem descendantOperationSyntax (trace : FunctionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op} {index : Nat} {instruction : Instr}
+    {next : CodeTrace}
+    (descendant : trace.root.Descendant
+      (.letOp source block input nextInput entryValueCount operation index
+        instruction next)) :
+    OperationSyntax input operation instruction :=
+  CodeTrace.letOpOperationSyntax_of_match
+    (trace.descendantSyntaxMatches descendant)
+
+/-- A recursive instruction node carries all exact continuation metadata and
+names an instruction in the generated function's actual block array. -/
+theorem descendantLetOpMatch (trace : FunctionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    (descendant : trace.root.Descendant
+      (.letOp source block input nextInput entryValueCount operation index
+        instruction next)) :
+    CodeTrace.LetOpMatch source block input nextInput entryValueCount operation
+        index instruction next ∧
+      trace.generated.blocks[block]? = some next.headBlock.2 := by
+  have matched := trace.descendantInstructionsMatch descendant
+  have localMatch := CodeTrace.letOpMatch_of_match matched
+  refine ⟨localMatch, ?_⟩
+  have blockAt := trace.descendantHeadBlockAt descendant
+  simpa [CodeTrace.headBlock, localMatch.headBlock] using blockAt
+
+end FunctionTrace
+
+structure Trace where
+  positions : List PositionTrace := []
+  edges : List EdgeTrace := []
+  functions : List FunctionTrace := []
+
+/-! ## Producer-retained source capabilities -/
+
+/-- Live/dead and representation agreement between one producer capability
+and the corresponding partial source-slot map entry.  Scalars may retain any
+scalar-compatible atom; owners and borrows must name concrete SSA registers;
+a consumed binding must be absent. -/
+def BindingCap.matchesInput : BindingCap → Option Atom → Bool
+  | .dead, none => true
+  | .dead, some _ => false
+  | .scalar, some _ => true
+  | .owned _, some (.reg _) | .borrowed _ _, some (.reg _) => true
+  | .owned _, _ | .borrowed _ _, _ | .scalar, none => false
+
+/-- Exact agreement between a producer-side source capability and the
+capability declared for a target block parameter.  Dead bindings have no
+target-parameter counterpart; their source input-map entry is absent. -/
+def BindingCap.matchesParameter : BindingCap → ValueCap → Bool
+  | .scalar, .scalar => true
+  | .owned sourceWorld, .owned targetWorld => sourceWorld == targetWorld
+  | .borrowed sourceWorld sourceLender,
+      .borrowed targetWorld targetLender =>
+      sourceWorld == targetWorld && sourceLender == targetLender
+  | _, _ => false
+
+/-- Every live source slot that still names an inherited block parameter
+retains exactly that parameter's declared capability.  Registers appended by
+instructions are intentionally outside this check; their capability flow is
+audited by the operation-specific transition predicates below. -/
+def PositionTrace.parameterCapabilitiesMatch (position : PositionTrace)
+    (input : Array (Option Atom)) (parameters : Array ValueCap) : Bool :=
+  (List.range input.size).all fun sourceIndex =>
+    match input[sourceIndex]? with
+    | some (some (.reg targetIndex)) =>
+        match parameters[targetIndex]? with
+        | none => true
+        | some parameter =>
+            match position.sourceCapabilities[sourceIndex]? with
+            | some capability => capability.matchesParameter parameter
+            | none => false
+    | _ => true
+
+/-- Reflection of parameter-capability coherence without specializing the
+parameter kind.  In particular, an inherited target parameter can never be
+backed by a dead producer binding. -/
+theorem PositionTrace.capability_of_parameterCapabilitiesMatch
+    {position : PositionTrace} {input : Array (Option Atom)}
+    {parameters : Array ValueCap}
+    (matched : position.parameterCapabilitiesMatch input parameters = true)
+    {sourceIndex targetIndex : Nat} {parameter : ValueCap}
+    (inputAt : input[sourceIndex]? = some (some (.reg targetIndex)))
+    (parameterAt : parameters[targetIndex]? = some parameter) :
+    ∃ capability,
+      position.sourceCapabilities[sourceIndex]? = some capability ∧
+        capability.matchesParameter parameter = true := by
+  have inputBound : sourceIndex < input.size :=
+    (Array.getElem?_eq_some_iff.mp inputAt).1
+  have point := List.all_eq_true.mp matched sourceIndex
+    (List.mem_range.mpr inputBound)
+  simp only [inputAt] at point
+  rw [parameterAt] at point
+  cases capabilityAt : position.sourceCapabilities[sourceIndex]? with
+  | none => simp [capabilityAt] at point
+  | some capability =>
+      exact ⟨capability, rfl, by
+        simpa [capabilityAt] using point⟩
+
+/-- Reflection of parameter-capability coherence for an owned parameter.
+This is the ownership bridge used by semantic clients: a source slot mapped
+to an owned target parameter is itself the exact producer owner. -/
+theorem PositionTrace.owned_of_parameterCapabilitiesMatch
+    {position : PositionTrace} {input : Array (Option Atom)}
+    {parameters : Array ValueCap}
+    (matched : position.parameterCapabilitiesMatch input parameters = true)
+    {sourceIndex targetIndex : Nat} {world : Owned}
+    (inputAt : input[sourceIndex]? = some (some (.reg targetIndex)))
+    (parameterAt : parameters[targetIndex]? = some (.owned world)) :
+    position.sourceCapabilities[sourceIndex]? = some (.owned world) := by
+  have inputBound : sourceIndex < input.size :=
+    (Array.getElem?_eq_some_iff.mp inputAt).1
+  have point := List.all_eq_true.mp matched sourceIndex
+    (List.mem_range.mpr inputBound)
+  simp only [inputAt] at point
+  rw [parameterAt] at point
+  cases capabilityAt : position.sourceCapabilities[sourceIndex]? with
+  | none => simp [capabilityAt] at point
+  | some capability =>
+      cases capability with
+      | scalar => simp [capabilityAt, BindingCap.matchesParameter] at point
+      | owned actualWorld =>
+          have worldEq : actualWorld = world := by
+            exact beq_iff_eq.mp (by
+              simpa [capabilityAt, BindingCap.matchesParameter] using point)
+          subst actualWorld
+          rfl
+      | borrowed actualWorld lender =>
+          simp [capabilityAt, BindingCap.matchesParameter] at point
+      | dead => simp [capabilityAt, BindingCap.matchesParameter] at point
+
+/-- Whether a source capability may cross an owned boundary in `expected`.
+Scalars are accepted in either world; concrete owners must match exactly;
+borrows and dead bindings cannot be consumed. -/
+def BindingCap.canConsume (expected : Owned) : BindingCap → Bool
+  | .scalar => true
+  | .owned actual => actual == expected
+  | .borrowed .. | .dead => false
+
+/-- Capability of a source operand at one retained position. -/
+def sourceCapability? (capabilities : Array BindingCap) :
+    IxIR1.Atom → Option BindingCap
+  | .lit _ | .erased => some .scalar
+  | .var index => capabilities[index]?
+
+/-- Retire a borrow whose dynamic lifetime is rooted at a consumed SSA owner.
+Other capabilities, including caller-rooted borrows, are unchanged. -/
+def BindingCap.retireLender (lender : ValueId) : BindingCap → BindingCap
+  | .borrowed world (.value actual) =>
+      if actual == lender then .dead else .borrowed world (.value actual)
+  | capability => capability
+
+/-- Retire every source borrow rooted at one consumed target register. -/
+def retireLenderCapabilities (capabilities : Array BindingCap)
+    (lender : ValueId) : Array BindingCap :=
+  capabilities.map (BindingCap.retireLender lender)
+
+/-- Consume one source owner and retire all of its target-register loans.  The
+retained source input map supplies the exact SSA lender identity. -/
+def retireOwnerCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (index : Nat) :
+    Option (Array BindingCap) :=
+  match input[index]? with
+  | some (some (.reg lender)) =>
+      some (retireLenderCapabilities
+        (capabilities.setIfInBounds index .dead) lender)
+  | _ => none
+
+/-- Retiring one owner and its loans preserves source-slot cardinality. -/
+theorem retireOwnerCapabilities?_size
+    {capabilities remaining : Array BindingCap}
+    {input : Array (Option Atom)} {index : Nat}
+    (retired : retireOwnerCapabilities? capabilities input index =
+      some remaining) :
+    remaining.size = capabilities.size := by
+  unfold retireOwnerCapabilities? at retired
+  split at retired <;> try contradiction
+  next lender _ =>
+    injection retired with remainingEq
+    subst remaining
+    simp [retireLenderCapabilities]
+
+/-- Capability vector produced by the lowerer's `pure`/`move` rule. Scalars
+and borrows are copied; an owned source slot is consumed before the same owner
+is rebound at the new de Bruijn head, and loans rooted at the old SSA owner
+are retired. -/
+def moveCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (source : IxIR1.Atom) :
+    Option (Array BindingCap) :=
+  match sourceCapability? capabilities source with
+  | none | some .dead => none
+  | some capability =>
+      let remaining? :=
+        match source, capability with
+        | .var index, .owned _ =>
+            retireOwnerCapabilities? capabilities input index
+        | _, _ => some capabilities
+      remaining?.map fun remaining => #[capability] ++ remaining
+
+/-- One retained before/after position pair agrees with the exact
+`pure`/`move` capability effect. -/
+def PositionTrace.moveMatches (before after : PositionTrace)
+    (input : Array (Option Atom)) (source : IxIR1.Atom) : Bool :=
+  match moveCapabilities? before.sourceCapabilities input source with
+  | some expected => expected == after.sourceCapabilities
+  | none => false
+
+/-- A flat producer position names this exact recursive trace coordinate and
+its capability vector has the same live/dead shape as the proof input map. -/
+def PositionTrace.coordinateMatches (position : PositionTrace)
+    (source : SourceSite) (block : BlockId) (target : TargetPosition)
+    (input : Array (Option Atom)) : Bool :=
+  position.source == source && position.block == block &&
+    position.target == target &&
+    position.sourceCapabilities.size == input.size &&
+    (List.range input.size).all fun index =>
+      match position.sourceCapabilities[index]?, input[index]? with
+      | some capability, some slot => capability.matchesInput slot
+      | _, _ => false
+
+/-- A matching flat coordinate carries exactly one capability for every
+source slot in the recursive trace input map. -/
+theorem PositionTrace.sourceCapabilities_size_of_coordinateMatch
+    {position : PositionTrace} {source : SourceSite} {block : BlockId}
+    {target : TargetPosition} {input : Array (Option Atom)}
+    (matched : position.coordinateMatches source block target input = true) :
+    position.sourceCapabilities.size = input.size := by
+  unfold PositionTrace.coordinateMatches at matched
+  simp only [Bool.and_eq_true] at matched
+  exact beq_iff_eq.mp matched.1.2
+
+/-- An owned capability at a matching producer position names an exact SSA
+register in the recursive source input map. -/
+theorem PositionTrace.inputReg_of_owned_coordinateMatch
+    {position : PositionTrace} {source : SourceSite} {block : BlockId}
+    {target : TargetPosition} {input : Array (Option Atom)}
+    (matched : position.coordinateMatches source block target input = true)
+    {index : Nat} {world : Owned}
+    (capabilityAt : position.sourceCapabilities[index]? =
+      some (.owned world)) :
+    ∃ id, input[index]? = some (some (.reg id)) := by
+  have sizeEq := position.sourceCapabilities_size_of_coordinateMatch matched
+  have bound : index < input.size := by
+    rw [← sizeEq]
+    exact (Array.getElem?_eq_some_iff.mp capabilityAt).1
+  unfold PositionTrace.coordinateMatches at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.2 index
+    (List.mem_range.mpr bound)
+  rw [capabilityAt] at point
+  cases inputAt : input[index]? with
+  | none => simp [inputAt] at point
+  | some slot =>
+      cases slot with
+      | none => simp [inputAt, BindingCap.matchesInput] at point
+      | some atom =>
+          cases atom with
+          | reg id => exact ⟨id, rfl⟩
+          | lit literal | erased =>
+              simp [inputAt, BindingCap.matchesInput] at point
+
+/-- Whether the flat producer index contains the exact coordinate and
+live/dead capability shape for one recursive code node. -/
+def CodeTrace.positionMatches (positions : List PositionTrace)
+    (trace : CodeTrace) : Bool :=
+  positions.any fun position =>
+    position.coordinateMatches trace.source trace.sourceBlock
+      trace.targetPosition trace.sourceInputMap
+
+mutual
+
+/-- Every recursive code node has a matching producer position.  This is the
+whole-trace coordinate audit used to select dynamic ownership invariants on
+both sides of an instruction or branch transition. -/
+def CodeTrace.positionsMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | trace@(.ret ..) | trace@(.tailCall ..) | trace@(.tailCallSelf ..) =>
+      trace.positionMatches positions
+  | trace@(.letOp _ _ _ _ _ _ _ _ next) =>
+      trace.positionMatches positions && next.positionsMatch positions
+  | trace@(.switchValue _ _ _ _ _ _ _ _ _ _ children) =>
+      trace.positionMatches positions &&
+        codeTraceListPositionsMatch positions children
+
+private def codeTraceListPositionsMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.positionsMatch positions &&
+        codeTraceListPositionsMatch positions rest
+
+end
+
+/-- Project the current node's flat-position audit from recursive
+whole-subtree coherence. -/
+theorem CodeTrace.positionMatches_of_positionsMatch
+    (positions : List PositionTrace) {trace : CodeTrace}
+    (matched : trace.positionsMatch positions = true) :
+    trace.positionMatches positions = true := by
+  cases trace <;>
+    simp_all [CodeTrace.positionsMatch, Bool.and_eq_true]
+
+/-- Reflect the exact producer position for any recursively audited node. -/
+theorem CodeTrace.position_of_positionsMatch
+    (positions : List PositionTrace) {trace : CodeTrace}
+    (matched : trace.positionsMatch positions = true) :
+    ∃ position, position ∈ positions ∧
+      position.coordinateMatches trace.source trace.sourceBlock
+        trace.targetPosition trace.sourceInputMap = true := by
+  exact List.any_eq_true.mp
+    (trace.positionMatches_of_positionsMatch positions matched)
+
+private theorem codeTraceListPositionsMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListPositionsMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.positionsMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListPositionsMatch, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Position coherence is inherited by every immediate recursive compiler
+call. -/
+theorem CodeTrace.positionsMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.positionsMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.positionsMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.positionsMatch, Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      have childrenMatched :
+          codeTraceListPositionsMatch positions children = true := by
+        simp only [CodeTrace.positionsMatch, Bool.and_eq_true] at matched
+        exact matched.2
+      exact codeTraceListPositionsMatch_of_mem positions childrenMatched member
+
+/-- Every recursive descendant inherits whole-position coherence. -/
+theorem CodeTrace.Descendant.positionsMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.positionsMatch positions = true) :
+    child.positionsMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.positionsMatch_of_child positions ih childMem
+
+/-- Whole-program producer-position coordinate audit. -/
+def Trace.positionsMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.positionsMatch trace.positions
+
+/-- Project whole-program position coherence to one retained function. -/
+theorem Trace.functionPositionsMatch {trace : Trace}
+    (matched : trace.positionsMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.positionsMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Producer capabilities at inherited block parameters -/
+
+/-- Every flat producer position naming this recursive node agrees with the
+capabilities declared by the node's inherited block parameters. -/
+def CodeTrace.positionParameterCapabilitiesMatch
+    (positions : List PositionTrace) (trace : CodeTrace) : Bool :=
+  positions.all fun position =>
+    if position.coordinateMatches trace.source trace.sourceBlock
+        trace.targetPosition trace.sourceInputMap then
+      position.parameterCapabilitiesMatch trace.sourceInputMap
+        trace.headBlock.2.valueParams
+    else
+      true
+
+mutual
+
+/-- Recursive audit connecting every source capability vector to the target
+block parameters still named by its input map. -/
+def CodeTrace.parameterCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | trace@(.ret ..) | trace@(.tailCall ..) | trace@(.tailCallSelf ..) =>
+      trace.positionParameterCapabilitiesMatch positions
+  | trace@(.letOp _ _ _ _ _ _ _ _ next) =>
+      trace.positionParameterCapabilitiesMatch positions &&
+        next.parameterCapabilitiesMatch positions
+  | trace@(.switchValue _ _ _ _ _ _ _ _ _ _ children) =>
+      trace.positionParameterCapabilitiesMatch positions &&
+        codeTraceListParameterCapabilitiesMatch positions children
+
+private def codeTraceListParameterCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.parameterCapabilitiesMatch positions &&
+        codeTraceListParameterCapabilitiesMatch positions rest
+
+end
+
+/-- Project the current node's parameter-capability audit from recursive
+whole-subtree coherence. -/
+theorem CodeTrace.positionParameterCapabilitiesMatch_of_match
+    (positions : List PositionTrace) {trace : CodeTrace}
+    (matched : trace.parameterCapabilitiesMatch positions = true) :
+    trace.positionParameterCapabilitiesMatch positions = true := by
+  cases trace <;>
+    simp_all [CodeTrace.parameterCapabilitiesMatch, Bool.and_eq_true]
+
+/-- Reflect parameter-capability agreement for any matching flat position at
+the current recursive trace node. -/
+theorem CodeTrace.positionParameterCapabilities_of_match
+    (positions : List PositionTrace) {trace : CodeTrace}
+    (matched : trace.parameterCapabilitiesMatch positions = true)
+    {position : PositionTrace} (member : position ∈ positions)
+    (coordinate : position.coordinateMatches trace.source trace.sourceBlock
+      trace.targetPosition trace.sourceInputMap = true) :
+    position.parameterCapabilitiesMatch trace.sourceInputMap
+      trace.headBlock.2.valueParams = true := by
+  have localMatch := trace.positionParameterCapabilitiesMatch_of_match positions
+    matched
+  have point := List.all_eq_true.mp localMatch position member
+  rw [if_pos coordinate] at point
+  exact point
+
+private theorem codeTraceListParameterCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListParameterCapabilitiesMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.parameterCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListParameterCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Parameter-capability coherence is inherited by every immediate recursive
+compiler call. -/
+theorem CodeTrace.parameterCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.parameterCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.parameterCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.parameterCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      have childrenMatched :
+          codeTraceListParameterCapabilitiesMatch positions children = true :=
+        by
+          simp only [CodeTrace.parameterCapabilitiesMatch,
+            Bool.and_eq_true] at matched
+          exact matched.2
+      exact codeTraceListParameterCapabilitiesMatch_of_mem positions
+        childrenMatched member
+
+/-- Every recursive descendant inherits parameter-capability coherence. -/
+theorem CodeTrace.Descendant.parameterCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.parameterCapabilitiesMatch positions = true) :
+    child.parameterCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.parameterCapabilitiesMatch_of_child positions ih
+        childMem
+
+/-- Whole-program audit of producer capabilities against inherited target
+block parameters. -/
+def Trace.parameterCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.parameterCapabilitiesMatch trace.positions
+
+/-- Project the whole-program parameter-capability audit to one retained
+function. -/
+theorem Trace.functionParameterCapabilitiesMatch {trace : Trace}
+    (matched : trace.parameterCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.parameterCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Producer capability flow for `pure` / `move` -/
+
+/-- Every flat position naming the continuation of this `pure` node is paired
+with a current position whose capability vector evolves by `moveCapabilities?`.
+The separate whole-position audit guarantees that the continuation set is
+nonempty. -/
+def CodeTrace.pureTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (source : IxIR1.Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+          positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          before.moveMatches after current.sourceInputMap source
+    else
+      true
+
+mutual
+
+/-- Recursive audit of every `pure` capability transition in a code tree. -/
+def CodeTrace.pureCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | trace@(.letOp _ _ _ _ _ operation _ _ next) =>
+      (match operation with
+       | .pure source => trace.pureTransitionMatches positions next source
+       | _ => true) &&
+        next.pureCapabilitiesMatch positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListPureCapabilitiesMatch positions children
+
+private def codeTraceListPureCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.pureCapabilitiesMatch positions &&
+        codeTraceListPureCapabilitiesMatch positions rest
+
+end
+
+/-- Reflect the checked before-position for an arbitrary matching
+continuation position of one `pure` node. -/
+theorem CodeTrace.pureTransition_of_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {index : Nat} {targetAtom : Atom}
+    {next : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.pure sourceAtom) index (.move targetAtom) next
+        ).pureCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.moveMatches after input sourceAtom = true := by
+  change (CodeTrace.pureTransitionMatches positions
+      (.letOp source block input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      next sourceAtom && next.pureCapabilitiesMatch positions) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+private theorem codeTraceListPureCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListPureCapabilitiesMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.pureCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListPureCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- `pure` capability-flow coherence is inherited by immediate recursive
+compiler calls. -/
+theorem CodeTrace.pureCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.pureCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.pureCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.pureCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListPureCapabilitiesMatch_of_mem positions matched member
+
+/-- Every recursive descendant inherits the checked `pure` capability-flow
+audit. -/
+theorem CodeTrace.Descendant.pureCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.pureCapabilitiesMatch positions = true) :
+    child.pureCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.pureCapabilitiesMatch_of_child positions ih childMem
+
+/-- Whole-program `pure` capability-flow audit. -/
+def Trace.pureCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.pureCapabilitiesMatch trace.positions
+
+/-- Project whole-program `pure` capability flow to one retained function. -/
+theorem Trace.functionPureCapabilitiesMatch {trace : Trace}
+    (matched : trace.pureCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.pureCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Producer capability flow for `dup` / `retainShared` -/
+
+/-- Capability vector produced by the lowerer's shared-retain rule. Scalars
+remain scalar; an owned or borrowed shared value produces a new shared owner
+without consuming the source slot. -/
+def dupCapabilities? (capabilities : Array BindingCap)
+    (source : IxIR1.Atom) : Option (Array BindingCap) :=
+  match sourceCapability? capabilities source with
+  | some .scalar => some (#[.scalar] ++ capabilities)
+  | some (.owned .shared) | some (.borrowed .shared _) =>
+      some (#[.owned .shared] ++ capabilities)
+  | none | some (.owned .unique) | some (.borrowed .unique _) |
+      some .dead => none
+
+/-- One retained before/after position pair agrees with the exact
+`dup`/`retainShared` capability effect. -/
+def PositionTrace.dupMatches (before after : PositionTrace)
+    (source : IxIR1.Atom) : Bool :=
+  match dupCapabilities? before.sourceCapabilities source with
+  | some expected => expected == after.sourceCapabilities
+  | none => false
+
+/-- Every flat position naming the continuation of this `dup` node is paired
+with a current position whose capability vector evolves by `dupCapabilities?`.
+-/
+def CodeTrace.dupTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (source : IxIR1.Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+      positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          before.dupMatches after source
+    else
+      true
+
+mutual
+
+/-- Recursive audit of every `dup` capability transition in a code tree. -/
+def CodeTrace.dupCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | trace@(.letOp _ _ _ _ _ operation _ _ next) =>
+      (match operation with
+       | .dup source => trace.dupTransitionMatches positions next source
+       | _ => true) &&
+        next.dupCapabilitiesMatch positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListDupCapabilitiesMatch positions children
+
+private def codeTraceListDupCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.dupCapabilitiesMatch positions &&
+        codeTraceListDupCapabilitiesMatch positions rest
+
+end
+
+/-- Reflect the checked before-position for an arbitrary matching
+continuation position of one `dup` node. -/
+theorem CodeTrace.dupTransition_of_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {index : Nat} {targetAtom : Atom}
+    {next : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.dup sourceAtom) index (.retainShared targetAtom) next
+        ).dupCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.dupMatches after sourceAtom = true := by
+  change (CodeTrace.dupTransitionMatches positions
+      (.letOp source block input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      next sourceAtom && next.dupCapabilitiesMatch positions) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+private theorem codeTraceListDupCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListDupCapabilitiesMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.dupCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListDupCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- `dup` capability-flow coherence is inherited by immediate recursive
+compiler calls. -/
+theorem CodeTrace.dupCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.dupCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.dupCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.dupCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListDupCapabilitiesMatch_of_mem positions matched member
+
+/-- Every recursive descendant inherits the checked `dup` capability-flow
+audit. -/
+theorem CodeTrace.Descendant.dupCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.dupCapabilitiesMatch positions = true) :
+    child.dupCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.dupCapabilitiesMatch_of_child positions ih childMem
+
+/-- Whole-program `dup` capability-flow audit. -/
+def Trace.dupCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.dupCapabilitiesMatch trace.positions
+
+/-- Project whole-program `dup` capability flow to one retained function. -/
+theorem Trace.functionDupCapabilitiesMatch {trace : Trace}
+    (matched : trace.dupCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.dupCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Producer capability flow for `fetch` -/
+
+/-- Capability vector accepted by the ownership simulation for the lowerer's
+non-consuming projection rule.  The baseline schema is uniform in the
+constructor world, so the projected value is borrowed in that same world.
+An owned constructor lends through its translated register; an existing
+borrow preserves its original lender. -/
+def fetchCapabilities? (capabilities : Array BindingCap)
+    (source : IxIR1.Atom) (target : Atom) : Option (Array BindingCap) :=
+  match sourceCapability? capabilities source with
+  | some (.owned world) =>
+      match target with
+      | .reg id =>
+          some (#[.borrowed world (.value id)] ++ capabilities)
+      | .lit _ | .erased => none
+  | some (.borrowed world lender) =>
+      some (#[.borrowed world lender] ++ capabilities)
+  | none | some .scalar | some .dead => none
+
+/-- One retained before/after position pair agrees with the exact
+baseline-compatible `fetch` capability effect. -/
+def PositionTrace.fetchMatches (before after : PositionTrace)
+    (source : IxIR1.Atom) (target : Atom) : Bool :=
+  match fetchCapabilities? before.sourceCapabilities source target with
+  | some expected => expected == after.sourceCapabilities
+  | none => false
+
+/-- Every flat position naming the continuation of this `fetch` node is
+paired with a current position whose capability vector evolves by
+`fetchCapabilities?`. -/
+def CodeTrace.fetchTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (source : IxIR1.Atom) (target : Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+      positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          before.fetchMatches after source target
+    else
+      true
+
+mutual
+
+/-- Recursive audit of every `fetch` capability transition in a code tree. -/
+def CodeTrace.fetchCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | trace@(.letOp _ _ _ _ _ operation _ instruction next) =>
+      (match operation, instruction with
+       | .fetch source _, .fetch target _ _ =>
+           trace.fetchTransitionMatches positions next source target
+       | .fetch .., _ => false
+       | _, _ => true) &&
+        next.fetchCapabilitiesMatch positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListFetchCapabilitiesMatch positions children
+
+private def codeTraceListFetchCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.fetchCapabilitiesMatch positions &&
+        codeTraceListFetchCapabilitiesMatch positions rest
+
+end
+
+/-- Reflect the checked before-position for an arbitrary matching
+continuation position of one `fetch` node. -/
+theorem CodeTrace.fetchTransition_of_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {sourceField index : Nat}
+    {targetAtom : Atom} {targetCid : CtorId} {targetField : Nat}
+    {next : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next
+        ).fetchCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.fetchMatches after sourceAtom targetAtom = true := by
+  change (CodeTrace.fetchTransitionMatches positions
+      (.letOp source block input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+          (.fetch targetAtom targetCid targetField) next)
+      next sourceAtom targetAtom && next.fetchCapabilitiesMatch positions) =
+        true at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+private theorem codeTraceListFetchCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListFetchCapabilitiesMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.fetchCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListFetchCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- `fetch` capability-flow coherence is inherited by immediate recursive
+compiler calls. -/
+theorem CodeTrace.fetchCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.fetchCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.fetchCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.fetchCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListFetchCapabilitiesMatch_of_mem positions matched member
+
+/-- Every recursive descendant inherits the checked `fetch` capability-flow
+audit. -/
+theorem CodeTrace.Descendant.fetchCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.fetchCapabilitiesMatch positions = true) :
+    child.fetchCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.fetchCapabilitiesMatch_of_child positions ih childMem
+
+/-- Whole-program `fetch` capability-flow audit. -/
+def Trace.fetchCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.fetchCapabilitiesMatch trace.positions
+
+/-- Project whole-program `fetch` capability flow to one retained function. -/
+theorem Trace.functionFetchCapabilitiesMatch {trace : Trace}
+    (matched : trace.fetchCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.fetchCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Shared owned-boundary capability consumption -/
+
+/-- Consume one source operand at an owned boundary, mirroring
+`consumeExpected`. Scalars are ownership-inert; an exact owner and all loans
+rooted at its SSA register are retired; borrows, dead slots, and wrong-world
+owners fail closed. -/
+def consumeCapability? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (world : Owned) (source : IxIR1.Atom) :
+    Option (Array BindingCap) :=
+  match source, sourceCapability? capabilities source with
+  | _, some .scalar => some capabilities
+  | .var index, some (.owned actual) =>
+      if actual == world then
+        retireOwnerCapabilities? capabilities input index
+      else
+        none
+  | _, _ => none
+
+/-- Sequential owned-boundary consumption in source argument order. -/
+def consumeCapabilitiesList? (capabilities : Array BindingCap)
+    (input : Array (Option Atom))
+    (world : Owned) : List IxIR1.Atom → Option (Array BindingCap)
+  | [] => some capabilities
+  | source :: rest => do
+      let remaining ← consumeCapability? capabilities input world source
+      consumeCapabilitiesList? remaining input world rest
+
+/-- Sequentially consume a heterogeneous owned parameter telescope.  The
+two lists must have identical cardinality; each argument is checked and
+retired in the world of its corresponding parameter. -/
+def consumeCapabilitiesWorlds? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) :
+    List Owned → List IxIR1.Atom → Option (Array BindingCap)
+  | [], [] => some capabilities
+  | world :: worlds, source :: sources => do
+      let remaining ← consumeCapability? capabilities input world source
+      consumeCapabilitiesWorlds? remaining input worlds sources
+  | _, _ => none
+
+/-- A successful heterogeneous consumption has matching parameter and
+argument cardinalities. -/
+theorem consumeCapabilitiesWorlds?_length
+    {capabilities remaining : Array BindingCap}
+    {input : Array (Option Atom)} {worlds : List Owned}
+    {sources : List IxIR1.Atom}
+    (consumed : consumeCapabilitiesWorlds? capabilities input worlds sources =
+      some remaining) :
+    worlds.length = sources.length := by
+  induction worlds generalizing capabilities sources with
+  | nil =>
+      cases sources with
+      | nil => rfl
+      | cons source rest => simp [consumeCapabilitiesWorlds?] at consumed
+  | cons world worlds ih =>
+      cases sources with
+      | nil => simp [consumeCapabilitiesWorlds?] at consumed
+      | cons source sources =>
+          simp only [consumeCapabilitiesWorlds?] at consumed
+          cases step : consumeCapability? capabilities input world source with
+          | none => simp [step] at consumed
+          | some next =>
+              simp only [step] at consumed
+              simp [ih consumed]
+
+/-! ### Exact capability flow for destructive operations -/
+
+/-- The ownership world and operand consumed by a baseline destruction
+operation. Other operations do not participate in this audit. -/
+def destructionSpec? : IxIR1.Op → Option (Owned × IxIR1.Atom)
+  | .free source => some (.unique, source)
+  | .drop source => some (.shared, source)
+  | .dropU source => some (.unique, source)
+  | _ => none
+
+/-- Exact continuation capability vector after destruction: consume the
+selected owner (and retire its rooted loans), then bind the erased scalar
+result at the de Bruijn head. -/
+def destructionCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (world : Owned)
+    (source : IxIR1.Atom) : Option (Array BindingCap) := do
+  let remaining ← consumeCapability? capabilities input world source
+  return #[.scalar] ++ remaining
+
+/-- One retained destruction before/after pair has the exact
+consume-and-bind-scalar effect. -/
+def PositionTrace.destructionResultMatches (before after : PositionTrace)
+    (input : Array (Option Atom)) (world : Owned)
+    (source : IxIR1.Atom) : Bool :=
+  match destructionCapabilities? before.sourceCapabilities input world source with
+  | some expected => expected == after.sourceCapabilities
+  | none => false
+
+/-- Every continuation position of one destruction node has an exact
+capability predecessor. -/
+def CodeTrace.destructionTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (world : Owned)
+    (source : IxIR1.Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+      positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          before.destructionResultMatches after current.sourceInputMap world
+            source
+    else
+      true
+
+mutual
+
+/-- Recursive exact capability audit for shallow free and shared/unique deep
+destruction. -/
+def CodeTrace.destructionCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | trace@(.letOp _ _ _ _ _ operation _ _ next) =>
+      (match destructionSpec? operation with
+       | some (world, source) =>
+           trace.destructionTransitionMatches positions next world source
+       | none => true) &&
+        next.destructionCapabilitiesMatch positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListDestructionCapabilitiesMatch positions children
+
+private def codeTraceListDestructionCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.destructionCapabilitiesMatch positions &&
+        codeTraceListDestructionCapabilitiesMatch positions rest
+
+end
+
+/-- Reflect the exact capability predecessor of any matching continuation
+position at an audited destruction node. -/
+theorem CodeTrace.destructionTransition_of_match
+    (positions : List PositionTrace)
+    {sourceSite : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op} {world : Owned} {sourceAtom : IxIR1.Atom}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    {after : PositionTrace}
+    (operationMatch : destructionSpec? operation = some (world, sourceAtom))
+    (matched : (CodeTrace.letOp sourceSite block input nextInput
+      entryValueCount operation index instruction next
+        ).destructionCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches sourceSite block (.instruction index) input =
+        true ∧
+      before.destructionResultMatches after input world sourceAtom = true := by
+  change (((match destructionSpec? operation with
+      | some (world, source) =>
+          (CodeTrace.letOp sourceSite block input nextInput entryValueCount
+            operation index instruction next).destructionTransitionMatches
+              positions next world source
+      | none => true) &&
+    next.destructionCapabilitiesMatch positions) = true) at matched
+  rw [operationMatch] at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+private theorem codeTraceListDestructionCapabilitiesMatch_of_mem
+    (positions : List PositionTrace) {traces : List CodeTrace}
+    {child : CodeTrace}
+    (matched : codeTraceListDestructionCapabilitiesMatch positions traces =
+      true)
+    (member : child ∈ traces) :
+    child.destructionCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListDestructionCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Destruction capability coherence is inherited by every immediate
+recursive compiler call. -/
+theorem CodeTrace.destructionCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.destructionCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.destructionCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.destructionCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListDestructionCapabilitiesMatch_of_mem positions matched
+        member
+
+/-- Every recursive descendant inherits checked destruction capability
+coherence. -/
+theorem CodeTrace.Descendant.destructionCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.destructionCapabilitiesMatch positions = true) :
+    child.destructionCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.destructionCapabilitiesMatch_of_child positions ih
+        childMem
+
+/-- Whole-program destructive capability-flow audit. -/
+def Trace.destructionCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.destructionCapabilitiesMatch trace.positions
+
+/-- Project whole-program destruction capability flow to one retained
+function. -/
+theorem Trace.functionDestructionCapabilitiesMatch {trace : Trace}
+    (matched : trace.destructionCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.destructionCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Exact producer capability flow for ordinary allocation -/
+
+/-- Consuming one operand changes capability state, never its cardinality. -/
+theorem consumeCapability?_size {capabilities remaining : Array BindingCap}
+    {input : Array (Option Atom)} {world : Owned} {source : IxIR1.Atom}
+    (consumed : consumeCapability? capabilities input world source =
+      some remaining) :
+    remaining.size = capabilities.size := by
+  cases source with
+  | lit literal =>
+      simp [consumeCapability?, sourceCapability?] at consumed
+      subst remaining
+      rfl
+  | erased =>
+      simp [consumeCapability?, sourceCapability?] at consumed
+      subst remaining
+      rfl
+  | var index =>
+      cases capabilityAt : capabilities[index]? with
+      | none => simp [consumeCapability?, sourceCapability?, capabilityAt] at consumed
+      | some capability =>
+          cases capability with
+          | scalar =>
+              simp [consumeCapability?, sourceCapability?, capabilityAt] at consumed
+              subst remaining
+              rfl
+          | borrowed actual lender =>
+              simp [consumeCapability?, sourceCapability?, capabilityAt] at consumed
+          | dead =>
+              simp [consumeCapability?, sourceCapability?, capabilityAt] at consumed
+          | owned actual =>
+              simp [consumeCapability?, sourceCapability?, capabilityAt] at consumed
+              obtain ⟨_, remainingEq⟩ := consumed
+              exact retireOwnerCapabilities?_size remainingEq
+
+/-- Sequential consumption preserves the source-slot cardinality. -/
+theorem consumeCapabilitiesList?_size
+    {capabilities remaining : Array BindingCap} {world : Owned}
+    {input : Array (Option Atom)} {sources : List IxIR1.Atom}
+    (consumed : consumeCapabilitiesList? capabilities input world sources =
+      some remaining) :
+    remaining.size = capabilities.size := by
+  induction sources generalizing capabilities with
+  | nil =>
+      simp [consumeCapabilitiesList?] at consumed
+      subst remaining
+      rfl
+  | cons source rest ih =>
+      simp only [consumeCapabilitiesList?] at consumed
+      cases step : consumeCapability? capabilities input world source with
+      | none => simp [step] at consumed
+      | some next =>
+          simp only [step] at consumed
+          exact (ih consumed).trans (consumeCapability?_size step)
+
+/-- Heterogeneous consumption preserves source-slot cardinality. -/
+theorem consumeCapabilitiesWorlds?_size
+    {capabilities remaining : Array BindingCap}
+    {input : Array (Option Atom)} {worlds : List Owned}
+    {sources : List IxIR1.Atom}
+    (consumed : consumeCapabilitiesWorlds? capabilities input worlds sources =
+      some remaining) :
+    remaining.size = capabilities.size := by
+  induction worlds generalizing capabilities sources with
+  | nil =>
+      cases sources with
+      | nil =>
+          simp [consumeCapabilitiesWorlds?] at consumed
+          subst remaining
+          rfl
+      | cons source rest => simp [consumeCapabilitiesWorlds?] at consumed
+  | cons world worlds ih =>
+      cases sources with
+      | nil => simp [consumeCapabilitiesWorlds?] at consumed
+      | cons source sources =>
+          simp only [consumeCapabilitiesWorlds?] at consumed
+          cases step : consumeCapability? capabilities input world source with
+          | none => simp [step] at consumed
+          | some next =>
+              simp only [step] at consumed
+              exact (ih consumed).trans (consumeCapability?_size step)
+
+/-- Exact capability vector after an ordinary uniform-world allocation. -/
+def allocationCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (world : Owned)
+    (arguments : Array IxIR1.Atom) :
+    Option (Array BindingCap) := do
+  let remaining ← consumeCapabilitiesList? capabilities input world
+    arguments.toList
+  return #[.owned world] ++ remaining
+
+/-- One retained allocation before/after pair has the exact sequential
+consume-and-bind capability effect. -/
+def PositionTrace.allocationResultMatches (before after : PositionTrace)
+    (input : Array (Option Atom)) (world : Owned)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  match allocationCapabilities? before.sourceCapabilities input world
+      arguments with
+  | some expected => expected == after.sourceCapabilities
+  | none => false
+
+/-- Checked allocation-specific projection of one producer position.  Besides
+coordinate/live-map agreement, every source field operand is scalar or an
+owner in the allocation world. -/
+def PositionTrace.allocationMatches (position : PositionTrace)
+    (source : SourceSite) (block : BlockId) (index : Nat)
+    (input : Array (Option Atom)) (world : Owned)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  position.coordinateMatches source block (.instruction index) input &&
+    arguments.toList.all fun argument =>
+      match sourceCapability? position.sourceCapabilities argument with
+      | some capability => capability.canConsume world
+      | none => false
+
+/-- Every continuation position of one ordinary allocation is paired with a
+current position carrying its exact sequential consumption effect. -/
+def CodeTrace.allocationTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (world : Owned)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+          positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          before.allocationResultMatches after current.sourceInputMap world
+            arguments
+    else
+      true
+
+mutual
+
+/-- Every ordinary constructor or function-PAP allocation node has an exact
+sequential consume-and-bind continuation. Constructor allocations additionally
+retain their schema-facing producer position; recursive continuations and
+switch children satisfy the same audit. -/
+def CodeTrace.allocationCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | trace@(.letOp source block input _ _ operation index _ next) =>
+      (match operation with
+       | .alloc world _ arguments =>
+           (positions.any fun position =>
+             position.allocationMatches source block index input world arguments) &&
+           trace.allocationTransitionMatches positions next world arguments
+       | .papp _ arguments =>
+           trace.allocationTransitionMatches positions next .shared arguments
+       | _ => true) &&
+        next.allocationCapabilitiesMatch positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListAllocationCapabilitiesMatch positions children
+
+private def codeTraceListAllocationCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.allocationCapabilitiesMatch positions &&
+        codeTraceListAllocationCapabilitiesMatch positions rest
+
+end
+
+/-- Reflect the retained producer position at one audited allocation node. -/
+theorem CodeTrace.allocationPosition_of_capabilities_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.alloc world identity arguments) index instruction next
+        ).allocationCapabilitiesMatch positions = true) :
+    ∃ position, position ∈ positions ∧
+      position.allocationMatches source block index input world arguments =
+        true := by
+  change (((positions.any fun position =>
+      position.allocationMatches source block index input world arguments) &&
+        (CodeTrace.letOp source block input nextInput entryValueCount
+          (.alloc world identity arguments) index instruction next
+        ).allocationTransitionMatches positions next world arguments) &&
+    next.allocationCapabilitiesMatch positions) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  exact List.any_eq_true.mp matched.1.1
+
+/-- Reflect the exact producer capability predecessor of any matching
+continuation position at an audited ordinary allocation. -/
+theorem CodeTrace.allocationTransition_of_capabilities_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.alloc world identity arguments) index instruction next
+        ).allocationCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.allocationResultMatches after input world arguments = true := by
+  change (((positions.any fun position =>
+      position.allocationMatches source block index input world arguments) &&
+        (CodeTrace.letOp source block input nextInput entryValueCount
+          (.alloc world identity arguments) index instruction next
+        ).allocationTransitionMatches positions next world arguments) &&
+    next.allocationCapabilitiesMatch positions) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1.2 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+/-- Reflect the exact shared capture consumption and fresh PAP-owner binding
+at any audited function partial application. -/
+theorem CodeTrace.pappTransition_of_capabilities_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.papp address arguments) index instruction next
+        ).allocationCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.allocationResultMatches after input .shared arguments = true := by
+  change (((CodeTrace.letOp source block input nextInput entryValueCount
+      (.papp address arguments) index instruction next
+        ).allocationTransitionMatches positions next .shared arguments &&
+    next.allocationCapabilitiesMatch positions) = true) at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+/-- An audited allocation position has the exact capability/input-map
+cardinality. -/
+theorem PositionTrace.sourceCapabilities_size_of_allocationMatch
+    {position : PositionTrace} {source : SourceSite} {block : BlockId}
+    {index : Nat} {input : Array (Option Atom)} {world : Owned}
+    {arguments : Array IxIR1.Atom}
+    (matched : position.allocationMatches source block index input world
+      arguments = true) :
+    position.sourceCapabilities.size = input.size := by
+  unfold PositionTrace.allocationMatches at matched
+  simp only [Bool.and_eq_true] at matched
+  exact sourceCapabilities_size_of_coordinateMatch matched.1
+
+/-- Allocation-specific matching includes the generic recursive-node
+coordinate match used by the dynamic ownership invariant. -/
+theorem PositionTrace.coordinateMatches_of_allocationMatch
+    {position : PositionTrace} {source : SourceSite} {block : BlockId}
+    {index : Nat} {input : Array (Option Atom)} {world : Owned}
+    {arguments : Array IxIR1.Atom}
+    (matched : position.allocationMatches source block index input world
+      arguments = true) :
+    position.coordinateMatches source block (.instruction index) input =
+      true := by
+  unfold PositionTrace.allocationMatches at matched
+  simp only [Bool.and_eq_true] at matched
+  exact matched.1
+
+/-- Every retained allocation argument resolves through a scalar or an exact
+owner in the allocation world. -/
+theorem PositionTrace.sourceCapability_canConsume_of_allocationMatch
+    {position : PositionTrace} {source : SourceSite} {block : BlockId}
+    {index : Nat} {input : Array (Option Atom)} {world : Owned}
+    {arguments : Array IxIR1.Atom}
+    (matched : position.allocationMatches source block index input world
+      arguments = true) {argument : IxIR1.Atom}
+    (member : argument ∈ arguments.toList) :
+    ∃ capability,
+      sourceCapability? position.sourceCapabilities argument =
+          some capability ∧
+        capability.canConsume world = true := by
+  unfold PositionTrace.allocationMatches at matched
+  simp only [Bool.and_eq_true] at matched
+  have argumentsMatched := matched.2
+  have argumentMatched :=
+    List.all_eq_true.mp argumentsMatched argument member
+  cases capabilityAt : sourceCapability? position.sourceCapabilities argument with
+  | none => simp [capabilityAt] at argumentMatched
+  | some capability =>
+      exact ⟨capability, rfl, by simpa [capabilityAt] using argumentMatched⟩
+
+private theorem codeTraceListAllocationCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListAllocationCapabilitiesMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.allocationCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListAllocationCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Allocation-capability coherence is inherited by every immediate
+recursive compiler call. -/
+theorem CodeTrace.allocationCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.allocationCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.allocationCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.allocationCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListAllocationCapabilitiesMatch_of_mem positions matched
+        member
+
+/-- Every recursive descendant inherits the producer capability audit. -/
+theorem CodeTrace.Descendant.allocationCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.allocationCapabilitiesMatch positions = true) :
+    child.allocationCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.allocationCapabilitiesMatch_of_child positions ih childMem
+
+/-- Whole-program producer capability audit. -/
+def Trace.allocationCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.allocationCapabilitiesMatch trace.positions
+
+/-- Project the whole capability audit to one retained function. -/
+theorem Trace.functionAllocationCapabilitiesMatch {trace : Trace}
+    (matched : trace.allocationCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.allocationCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Does this capability contribute an external ownership root? -/
+def BindingCap.hasOwnedRoot : BindingCap → Bool
+  | .owned _ => true
+  | .scalar | .borrowed .. | .dead => false
+
+/-- Is this capability a borrow whose provenance would have to cross a
+suspended source call? -/
+def BindingCap.isBorrowed : BindingCap → Bool
+  | .borrowed .. => true
+  | .scalar | .owned _ | .dead => false
+
+def noOwnedRoots (capabilities : Array BindingCap) : Bool :=
+  capabilities.toList.all fun capability => !capability.hasOwnedRoot
+
+def noBorrows (capabilities : Array BindingCap) : Bool :=
+  capabilities.toList.all fun capability => !capability.isBorrowed
+
+/-! ### Borrow-free producer state at terminal allocations
+
+The reset/reuse pass only recognizes allocations whose recursive source
+continuation is a self tail call.  At that boundary every value which can
+survive the allocation is about to cross the owned call ABI, so the producer
+must have retired all outstanding borrows.  Keep this as a focused recursive
+audit: ordinary allocations may legitimately coexist with live borrows. -/
+
+/-- Check every producer position for one terminal allocation coordinate.
+Nonmatching flat positions are irrelevant to the recursive trace node. -/
+def terminalAllocationPositionsNoBorrows (positions : List PositionTrace)
+    (source : SourceSite) (block : BlockId)
+    (input : Array (Option Atom)) (index : Nat) : Bool :=
+  positions.all fun position =>
+    if position.coordinateMatches source block (.instruction index) input then
+      noBorrows position.sourceCapabilities
+    else
+      true
+
+mutual
+
+/-- Recursive producer audit for allocations immediately followed by a
+self-tail terminal.  This is precisely the allocation shape consumed by the
+dynamic reset/reuse recognizer. -/
+def CodeTrace.terminalAllocationNoBorrows
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp source block input _ _ operation index _ next =>
+      (match operation, next with
+       | .alloc .., .tailCallSelf .. =>
+           terminalAllocationPositionsNoBorrows positions source block input
+             index
+       | _, _ => true) &&
+        next.terminalAllocationNoBorrows positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListTerminalAllocationNoBorrows positions children
+
+private def codeTraceListTerminalAllocationNoBorrows
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.terminalAllocationNoBorrows positions &&
+        codeTraceListTerminalAllocationNoBorrows positions rest
+
+end
+
+/-- Reflect the focused audit at one named producer position. -/
+theorem CodeTrace.terminalAllocationPositionNoBorrows_of_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId} {arguments : Array IxIR1.Atom}
+    {index : Nat} {instruction : Instr}
+    {tailSource : SourceSite} {tailBlock : BlockId}
+    {tailInput : Array (Option Atom)} {tailEntryValueCount : Nat}
+    {tailArguments : Array IxIR1.Atom} {generated : Block}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.alloc world identity arguments) index instruction
+        (.tailCallSelf tailSource tailBlock tailInput tailEntryValueCount
+          tailArguments generated)).terminalAllocationNoBorrows positions =
+            true)
+    {position : PositionTrace} (member : position ∈ positions)
+    (coordinate : position.coordinateMatches source block
+      (.instruction index) input = true) :
+    noBorrows position.sourceCapabilities = true := by
+  change (terminalAllocationPositionsNoBorrows positions source block input
+      index && _) = true at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 position member
+  rw [if_pos coordinate] at point
+  exact point
+
+private theorem codeTraceListTerminalAllocationNoBorrows_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListTerminalAllocationNoBorrows positions traces = true)
+    (member : child ∈ traces) :
+    child.terminalAllocationNoBorrows positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListTerminalAllocationNoBorrows,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- The terminal-allocation audit is inherited by every immediate recursive
+compiler call. -/
+theorem CodeTrace.terminalAllocationNoBorrows_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.terminalAllocationNoBorrows positions = true)
+    (member : child ∈ parent.children) :
+    child.terminalAllocationNoBorrows positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.terminalAllocationNoBorrows,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListTerminalAllocationNoBorrows_of_mem positions matched
+        member
+
+/-- Every recursive descendant inherits the focused terminal-allocation
+borrow audit. -/
+theorem CodeTrace.Descendant.terminalAllocationNoBorrows
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.terminalAllocationNoBorrows positions = true) :
+    child.terminalAllocationNoBorrows positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.terminalAllocationNoBorrows_of_child positions ih
+        childMem
+
+/-- Whole-program audit for borrow-free terminal allocation coordinates. -/
+def Trace.terminalAllocationNoBorrows (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.terminalAllocationNoBorrows trace.positions
+
+/-- Project the whole-program audit to one retained function. -/
+theorem Trace.functionTerminalAllocationNoBorrows {trace : Trace}
+    (matched : trace.terminalAllocationNoBorrows = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.terminalAllocationNoBorrows trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Exact producer capability flow for dynamic application -/
+
+/-- Exact continuation capability vector after dynamic application.  The
+function value and every newly supplied argument cross the shared owned
+boundary in source order; the dynamically returned value is then bound as a
+fresh shared owner. -/
+def applyCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (function : IxIR1.Atom)
+    (arguments : Array IxIR1.Atom) : Option (Array BindingCap) := do
+  let remaining ← consumeCapability? capabilities input .shared function
+  let remaining ← consumeCapabilitiesList? remaining input .shared
+    arguments.toList
+  return #[.owned .shared] ++ remaining
+
+/-- One retained dynamic-application before/after pair has the exact
+consume-function/consume-arguments/bind-result effect. -/
+def PositionTrace.applyResultMatches (before after : PositionTrace)
+    (input : Array (Option Atom)) (function : IxIR1.Atom)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  match applyCapabilities? before.sourceCapabilities input function arguments with
+  | some expected =>
+      noBorrows expected && expected == after.sourceCapabilities
+  | none => false
+
+/-- Every continuation position of one dynamic application has an exact
+capability predecessor. -/
+def CodeTrace.applyTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (function : IxIR1.Atom)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+      positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          before.applyResultMatches after current.sourceInputMap function
+            arguments
+    else
+      true
+
+mutual
+
+/-- Recursive exact capability audit for dynamic application. -/
+def CodeTrace.applyCapabilitiesMatch
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | trace@(.letOp _ _ _ _ _ operation _ _ next) =>
+      (match operation with
+       | .apply function arguments =>
+           trace.applyTransitionMatches positions next function arguments
+       | _ => true) &&
+        next.applyCapabilitiesMatch positions
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListApplyCapabilitiesMatch positions children
+
+private def codeTraceListApplyCapabilitiesMatch
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.applyCapabilitiesMatch positions &&
+        codeTraceListApplyCapabilitiesMatch positions rest
+
+end
+
+/-- Reflect the exact producer capability predecessor of any matching
+continuation position at an audited dynamic application. -/
+theorem CodeTrace.applyTransition_of_capabilities_match
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {function : IxIR1.Atom} {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.apply function arguments) index instruction next
+        ).applyCapabilitiesMatch positions = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.applyResultMatches after input function arguments = true := by
+  change (((CodeTrace.letOp source block input nextInput entryValueCount
+      (.apply function arguments) index instruction next
+        ).applyTransitionMatches positions next function arguments &&
+    next.applyCapabilitiesMatch positions) = true) at matched
+  simp only [Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeMatch.1, beforeMatch.2⟩
+
+private theorem codeTraceListApplyCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListApplyCapabilitiesMatch positions traces = true)
+    (member : child ∈ traces) :
+    child.applyCapabilitiesMatch positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListApplyCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Dynamic-application capability coherence is inherited by every immediate
+recursive compiler call. -/
+theorem CodeTrace.applyCapabilitiesMatch_of_child
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.applyCapabilitiesMatch positions = true)
+    (member : child ∈ parent.children) :
+    child.applyCapabilitiesMatch positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.applyCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListApplyCapabilitiesMatch_of_mem positions matched member
+
+/-- Every recursive descendant inherits checked dynamic-application
+capability coherence. -/
+theorem CodeTrace.Descendant.applyCapabilitiesMatch
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.applyCapabilitiesMatch positions = true) :
+    child.applyCapabilitiesMatch positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.applyCapabilitiesMatch_of_child positions ih childMem
+
+/-- Whole-program dynamic-application capability-flow audit. -/
+def Trace.applyCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.applyCapabilitiesMatch trace.positions
+
+/-- Project the whole dynamic-application audit to one retained function. -/
+theorem Trace.functionApplyCapabilitiesMatch {trace : Trace}
+    (matched : trace.applyCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.applyCapabilitiesMatch trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ### Exact producer capability flow for calls and returns -/
+
+/-- The baseline call ABI accepts only owned parameters.  Keeping this
+projection executable makes a future borrowed-parameter ABI an explicit
+extension rather than silently treating a borrow as a transfer. -/
+def ownedParameterWorlds? : List Param → Option (List Owned)
+  | [] => some []
+  | parameter :: rest =>
+      if parameter.passing == .owned then
+        (ownedParameterWorlds? rest).map (parameter.world :: ·)
+      else
+        none
+
+/-- Capability vector visible in source de Bruijn order at a target function
+entry. Target parameters arrive in call order, hence the reversal. -/
+def entryCapabilities (signature : Signature) : Array BindingCap :=
+  signature.params.toList.reverse.map (fun parameter =>
+    match parameter.passing with
+    | .owned => .owned parameter.world
+    | .borrowed => .borrowed parameter.world .caller) |>.toArray
+
+/-! ### PAP-safe function-entry capabilities -/
+
+/-- A PAP-safe retained function must expose the all-owned/shared entry
+capability vector required by dynamic saturation.  Keeping this check in the
+artifact audit makes the runtime PAP boundary independent of validator
+implementation details. -/
+def FunctionTrace.sharedPapEntryCapabilitiesMatch
+    (trace : FunctionTrace) : Bool :=
+  if trace.generated.signature.papSafe then
+    entryCapabilities trace.generated.signature ==
+      Array.replicate trace.generated.signature.params.size (.owned .shared)
+  else
+    true
+
+/-- Whole-program PAP-entry capability audit. -/
+def Trace.sharedPapEntryCapabilitiesMatch (trace : Trace) : Bool :=
+  trace.functions.all FunctionTrace.sharedPapEntryCapabilitiesMatch
+
+/-- Project the PAP-entry audit to one retained function. -/
+theorem Trace.functionSharedPapEntryCapabilitiesMatch {trace : Trace}
+    (matched : trace.sharedPapEntryCapabilitiesMatch = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.sharedPapEntryCapabilitiesMatch = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Consume the arguments of one baseline call using its owned parameter
+telescope. -/
+def callRemainingCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (signature : Signature)
+    (arguments : Array IxIR1.Atom) : Option (Array BindingCap) := do
+  let worlds ← ownedParameterWorlds? signature.params.toList
+  consumeCapabilitiesWorlds? capabilities input worlds arguments.toList
+
+/-- Exact ordinary-call continuation state: transferred argument owners are
+retired, no borrow remains suspended in the baseline ABI, and the returned
+owner is bound at the source-environment head. -/
+def PositionTrace.callResultMatches (before after : PositionTrace)
+    (input : Array (Option Atom)) (signature : Signature)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  match callRemainingCapabilities? before.sourceCapabilities input signature
+      arguments with
+  | some remaining =>
+      noBorrows remaining &&
+        (#[.owned signature.result] ++ remaining) == after.sourceCapabilities
+  | none => false
+
+/-- Every matching predecessor/continuation pair of an ordinary call has the
+same exact consume/suspend/result-bind transition. Quantifying both sides
+prevents duplicate flat coordinates from choosing different suspended root
+frames. -/
+def CodeTrace.callTransitionMatches (positions : List PositionTrace)
+    (current next : CodeTrace) (signature : Signature)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap then
+      positions.all fun before =>
+        if before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap then
+          before.callResultMatches after current.sourceInputMap signature
+            arguments
+        else
+          true
+    else
+      true
+
+/-- A tail call transfers every local owner before discarding its frame. -/
+def PositionTrace.tailCallMatches (position : PositionTrace)
+    (source : SourceSite) (block : BlockId)
+    (input : Array (Option Atom)) (signature : Signature)
+    (arguments : Array IxIR1.Atom) : Bool :=
+  position.coordinateMatches source block .terminator input &&
+    match callRemainingCapabilities? position.sourceCapabilities input
+        signature arguments with
+    | some remaining => noOwnedRoots remaining
+    | none => false
+
+/-- A source return transfers exactly its declared result owner and leaves no
+other local owner behind. Scalars remain ownership-inert. -/
+def PositionTrace.returnMatches (position : PositionTrace)
+    (source : SourceSite) (block : BlockId)
+    (input : Array (Option Atom)) (result : Owned)
+    (atom : IxIR1.Atom) : Bool :=
+  position.coordinateMatches source block .terminator input &&
+    match consumeCapability? position.sourceCapabilities input result atom with
+    | some remaining => noOwnedRoots remaining
+    | none => false
+
+/-- Lookup the checked target signature used to audit an addressed source
+call. -/
+def targetSignature? (declarations : List (Address × Decl))
+    (address : Address) : Option Signature := do
+  let declaration ←
+    (declarations.find? fun entry => entry.1 == address).map (fun entry => entry.2)
+  match declaration with
+  | .fn definition => some definition.signature
+  | .extern _ => none
+
+/-- All flat positions matching one function root carry the canonical entry
+capability vector of its emitted signature. -/
+def FunctionTrace.entryCapabilitiesMatch (trace : FunctionTrace)
+    (positions : List PositionTrace) : Bool :=
+  positions.all fun position =>
+    if position.coordinateMatches trace.root.source trace.root.sourceBlock
+        trace.root.targetPosition trace.root.sourceInputMap then
+      position.sourceCapabilities == entryCapabilities trace.generated.signature
+    else
+      true
+
+mutual
+
+/-- Recursive call/return capability audit for one retained function. -/
+def CodeTrace.callCapabilitiesMatch (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature) :
+    CodeTrace → Bool
+  | trace@(.ret source block input _ atom _ _) =>
+      positions.all fun position =>
+        if position.coordinateMatches trace.source trace.sourceBlock
+            trace.targetPosition trace.sourceInputMap then
+          position.returnMatches source block input current.result atom
+        else
+          true
+  | .tailCall source block input _ address arguments _ =>
+      match targetSignature? declarations address with
+      | some signature => signature.result == current.result &&
+          positions.any fun position =>
+            position.tailCallMatches source block input signature arguments
+      | none => false
+  | .tailCallSelf source block input _ arguments _ =>
+      positions.any fun position =>
+        position.tailCallMatches source block input current arguments
+  | trace@(.letOp _ _ _ _ _ operation _ _ next) =>
+      (match operation with
+       | .call address arguments =>
+           match targetSignature? declarations address with
+           | some signature =>
+               trace.callTransitionMatches positions next signature arguments
+           | none => false
+       | .callSelf arguments =>
+           trace.callTransitionMatches positions next current arguments
+       | _ => true) &&
+        next.callCapabilitiesMatch positions declarations current
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      codeTraceListCallCapabilitiesMatch positions declarations current children
+
+private def codeTraceListCallCapabilitiesMatch
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature) :
+    List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.callCapabilitiesMatch positions declarations current &&
+        codeTraceListCallCapabilitiesMatch positions declarations current rest
+
+end
+
+/-- One retained function has canonical entry capabilities and exact
+call/return ownership flow throughout its recursive trace. -/
+def FunctionTrace.callCapabilitiesMatch (trace : FunctionTrace)
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) : Bool :=
+  trace.entryCapabilitiesMatch positions &&
+    trace.root.callCapabilitiesMatch positions declarations
+      trace.generated.signature
+
+/-- Whole-program call/return capability-flow audit. -/
+def FunctionTrace.targetSignatureMatches (trace : FunctionTrace)
+    (declarations : List (Address × Decl)) : Bool :=
+  match trace.owner with
+  | .main => true
+  | .declaration address =>
+      targetSignature? declarations address == some trace.generated.signature
+
+/-- Whole-program call/return capability-flow audit. Besides local flow, each
+declaration-owned trace is tied to the signature selected by the executable
+target declaration lookup used at call sites. -/
+def Trace.callCapabilitiesMatch (trace : Trace)
+    (declarations : List (Address × Decl)) : Bool :=
+  (trace.functions.all fun functionTrace =>
+    functionTrace.callCapabilitiesMatch trace.positions declarations) &&
+  (trace.functions.all fun functionTrace =>
+    functionTrace.targetSignatureMatches declarations)
+
+private theorem codeTraceListCallCapabilitiesMatch_of_mem
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListCallCapabilitiesMatch positions declarations
+      current traces = true)
+    (member : child ∈ traces) :
+    child.callCapabilitiesMatch positions declarations current = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListCallCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Call/return capability coherence is inherited by every recursive child. -/
+theorem CodeTrace.callCapabilitiesMatch_of_child
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {parent child : CodeTrace}
+    (matched : parent.callCapabilitiesMatch positions declarations current =
+      true)
+    (member : child ∈ parent.children) :
+    child.callCapabilitiesMatch positions declarations current = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      simp only [CodeTrace.callCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      exact codeTraceListCallCapabilitiesMatch_of_mem positions declarations
+        current matched member
+
+/-- Every recursive descendant inherits checked call/return capability flow. -/
+theorem CodeTrace.Descendant.callCapabilitiesMatch
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {root child : CodeTrace} (descendant : Descendant root child)
+    (matched : root.callCapabilitiesMatch positions declarations current =
+      true) :
+    child.callCapabilitiesMatch positions declarations current = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.callCapabilitiesMatch_of_child positions declarations
+        current ih childMem
+
+/-- Project the whole-program call audit to one retained function. -/
+theorem Trace.functionCallCapabilitiesMatch {trace : Trace}
+    {declarations : List (Address × Decl)}
+    (matched : trace.callCapabilitiesMatch declarations = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.callCapabilitiesMatch trace.positions declarations = true :=
+  by
+    simp only [Trace.callCapabilitiesMatch, Bool.and_eq_true] at matched
+    exact List.all_eq_true.mp matched.1 functionTrace member
+
+/-- A declaration-owned retained trace has the exact signature selected by
+the call audit's target lookup. -/
+theorem Trace.targetSignature_of_call_match {trace : Trace}
+    {declarations : List (Address × Decl)}
+    (matched : trace.callCapabilitiesMatch declarations = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions)
+    {address : Address} (owner : functionTrace.owner = .declaration address) :
+    targetSignature? declarations address =
+      some functionTrace.generated.signature := by
+  simp only [Trace.callCapabilitiesMatch, Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.2 functionTrace member
+  unfold FunctionTrace.targetSignatureMatches at point
+  rw [owner] at point
+  exact beq_iff_eq.mp point
+
+/-- Recover canonical entry capabilities from a checked function audit. -/
+theorem FunctionTrace.entryCapabilities_of_call_match
+    {trace : FunctionTrace} {positions : List PositionTrace}
+    {declarations : List (Address × Decl)}
+    (matched : trace.callCapabilitiesMatch positions declarations = true)
+    {position : PositionTrace} (member : position ∈ positions)
+    (coordinate : position.coordinateMatches trace.root.source
+      trace.root.sourceBlock trace.root.targetPosition
+      trace.root.sourceInputMap = true) :
+    position.sourceCapabilities = entryCapabilities trace.generated.signature := by
+  simp only [FunctionTrace.callCapabilitiesMatch, Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 position member
+  rw [if_pos coordinate] at point
+  exact beq_iff_eq.mp point
+
+/-- Reflect an addressed ordinary call's exact predecessor and continuation
+effect. -/
+theorem CodeTrace.callTransition_of_capabilities_match
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {index : Nat} {instruction : Instr}
+    {next : CodeTrace} {before after : PositionTrace}
+    (signatureAt : targetSignature? declarations address = some signature)
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.call address arguments) index instruction next).callCapabilitiesMatch positions
+        declarations current = true)
+    (beforeMember : before ∈ positions)
+    (beforeCoordinate : before.coordinateMatches source block
+      (.instruction index) input = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    before.callResultMatches after input signature arguments = true := by
+  simp only [CodeTrace.callCapabilitiesMatch, signatureAt,
+    Bool.and_eq_true] at matched
+  have transition := matched.1
+  have point := List.all_eq_true.mp transition after afterMember
+  rw [if_pos afterCoordinate] at point
+  have beforePoint := List.all_eq_true.mp point before beforeMember
+  rw [if_pos (by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeCoordinate)] at beforePoint
+  exact beforePoint
+
+/-- Reflect a self call's exact predecessor and continuation effect. -/
+theorem CodeTrace.callSelfTransition_of_capabilities_match
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {arguments : Array IxIR1.Atom} {index : Nat} {instruction : Instr}
+    {next : CodeTrace} {before after : PositionTrace}
+    (matched : (CodeTrace.letOp source block input nextInput entryValueCount
+      (.callSelf arguments) index instruction next).callCapabilitiesMatch
+        positions declarations current = true)
+    (beforeMember : before ∈ positions)
+    (beforeCoordinate : before.coordinateMatches source block
+      (.instruction index) input = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    before.callResultMatches after input current arguments = true := by
+  simp only [CodeTrace.callCapabilitiesMatch, Bool.and_eq_true] at matched
+  have point := List.all_eq_true.mp matched.1 after afterMember
+  rw [if_pos afterCoordinate] at point
+  have beforePoint := List.all_eq_true.mp point before beforeMember
+  rw [if_pos (by
+    simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+      CodeTrace.sourceInputMap] using beforeCoordinate)] at beforePoint
+  exact beforePoint
+
+/-- Reflect the exact terminal transfer at a checked addressed tail call. -/
+theorem CodeTrace.tailCallPosition_of_capabilities_match
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {generated : Block}
+    (signatureAt : targetSignature? declarations address = some signature)
+    (matched : (CodeTrace.tailCall source block input entryValueCount address
+      arguments generated).callCapabilitiesMatch positions declarations current =
+        true) :
+    ∃ position, position ∈ positions ∧
+      position.tailCallMatches source block input signature arguments = true := by
+  change (match targetSignature? declarations address with
+    | some found => found.result == current.result &&
+        positions.any fun position =>
+          position.tailCallMatches source block input found arguments
+    | none => false) = true at matched
+  rw [signatureAt] at matched
+  simp only [Bool.and_eq_true] at matched
+  exact List.any_eq_true.mp matched.2
+
+/-- A checked addressed tail call preserves the dynamic result world. This
+is needed when source completion crosses a replaced caller frame. -/
+theorem CodeTrace.tailCallResult_of_capabilities_match
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {generated : Block}
+    (signatureAt : targetSignature? declarations address = some signature)
+    (matched : (CodeTrace.tailCall source block input entryValueCount address
+      arguments generated).callCapabilitiesMatch positions declarations current =
+        true) :
+    signature.result = current.result := by
+  simp only [CodeTrace.callCapabilitiesMatch, signatureAt,
+    Bool.and_eq_true, beq_iff_eq] at matched
+  exact matched.1
+
+/-- Reflect the exact terminal transfer at a checked self tail call. -/
+theorem CodeTrace.tailCallSelfPosition_of_capabilities_match
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {arguments : Array IxIR1.Atom} {generated : Block}
+    (matched : (CodeTrace.tailCallSelf source block input entryValueCount
+      arguments generated).callCapabilitiesMatch positions declarations current =
+        true) :
+    ∃ position, position ∈ positions ∧
+      position.tailCallMatches source block input current arguments = true := by
+  exact List.any_eq_true.mp matched
+
+/-- Reflect the exact return transfer at one checked terminal position. -/
+theorem CodeTrace.returnPositionMatch_of_capabilities_match
+    (positions : List PositionTrace)
+    (declarations : List (Address × Decl)) (current : Signature)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {atom : IxIR1.Atom} {target : Atom} {generated : Block}
+    (matched : (CodeTrace.ret source block input entryValueCount atom target
+      generated).callCapabilitiesMatch positions declarations current = true)
+    {position : PositionTrace} (member : position ∈ positions)
+    (coordinate : position.coordinateMatches source block .terminator input =
+      true) :
+    position.returnMatches source block input current.result atom = true := by
+  change (positions.all fun candidate =>
+    if candidate.coordinateMatches source block .terminator input then
+      candidate.returnMatches source block input current.result atom
+    else true) = true at matched
+  have point := List.all_eq_true.mp matched position member
+  rw [if_pos coordinate] at point
+  exact point
+
+/-! ### Producer capability flow across switch edges -/
+
+/-- The first source slot whose live owner is carried by a given predecessor
+register. This is the source-index form of the lowerer's private
+`ownerParameter?` search. -/
+def edgeOwnerIndex? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) (lender : ValueId) : Option Nat :=
+  (List.range capabilities.size).find? fun index =>
+    match capabilities[index]?, input[index]? with
+    | some (.owned _), some (some (.reg actual)) => actual == lender
+    | _, _ => false
+
+/-- Rebase one producer capability onto the canonical same-index registers of
+a generated CFG edge. Local borrows are accepted only when the lowerer's
+selected owner has the same world as the borrow. -/
+def BindingCap.rebaseEdge? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) : BindingCap → Option BindingCap
+  | .scalar => some .scalar
+  | .owned world => some (.owned world)
+  | .borrowed world .caller => some (.borrowed world .caller)
+  | .borrowed world (.value lender) =>
+      match edgeOwnerIndex? capabilities input lender with
+      | some ownerIndex =>
+          match capabilities[ownerIndex]? with
+          | some (.owned ownerWorld) =>
+              if ownerWorld == world then
+                some (.borrowed world (.value ownerIndex))
+              else
+                none
+          | _ => none
+      | none => none
+  | .dead => some .dead
+
+/-- Canonical capability vector after a generated edge has copied every live
+source slot into the same-index target parameter. -/
+def edgeCapabilities? (capabilities : Array BindingCap)
+    (input : Array (Option Atom)) : Option (Array BindingCap) :=
+  if capabilities.toList.all fun capability =>
+      (capability.rebaseEdge? capabilities input).isSome then
+    some (capabilities.map fun capability =>
+      (capability.rebaseEdge? capabilities input).getD .dead)
+  else
+    none
+
+/-- Edge rebasing preserves the producer capability-vector cardinality. -/
+theorem edgeCapabilities?_size
+    {capabilities output : Array BindingCap}
+    {input : Array (Option Atom)}
+    (result : edgeCapabilities? capabilities input = some output) :
+    output.size = capabilities.size := by
+  unfold edgeCapabilities? at result
+  split at result
+  · injection result with outputEq
+    subst output
+    simp
+  · contradiction
+
+/-- Shift local lender registers across an implicit block-parameter prefix. -/
+def BindingCap.shiftLender (amount : Nat) : BindingCap → BindingCap
+  | .borrowed world (.value lender) =>
+      .borrowed world (.value (lender + amount))
+  | capability => capability
+
+/-- Exact capability vector at a constructor child: the edge-rebased source
+slots are preceded by borrowed fields in reverse source-binding order. -/
+def constructorChildCapabilities?
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (input : Array (Option Atom)) (scrutinee : IxIR1.Atom) (cid : CtorId)
+    (capabilities : Array BindingCap) : Option (Array BindingCap) :=
+  match edgeCapabilities? capabilities input with
+  | none => none
+  | some rebased =>
+      match scrutinee with
+      | .var sourceIndex =>
+          match rebased[sourceIndex]? with
+          | some (.owned world) =>
+              match schemas world cid with
+              | some schema =>
+                  let fields := schema.fields.map fun fieldWorld =>
+                    BindingCap.borrowed fieldWorld (.value sourceIndex)
+                  some (fields.reverse ++ rebased)
+              | none => none
+          | some (.borrowed world lender) =>
+              match schemas world cid with
+              | some schema =>
+                  let fields := schema.fields.map fun fieldWorld =>
+                    BindingCap.borrowed fieldWorld lender
+                  some (fields.reverse ++ rebased)
+              | none => none
+          | _ => none
+      | .lit _ | .erased => none
+
+/-- Exact capability vector at a literal-zero child. -/
+def natZeroChildCapabilities? (input : Array (Option Atom))
+    (capabilities : Array BindingCap) : Option (Array BindingCap) :=
+  edgeCapabilities? capabilities input
+
+/-- Exact capability vector at a literal-successor child. The peeled scalar
+occupies register zero, so every local lender is shifted once. -/
+def natSuccChildCapabilities? (input : Array (Option Atom))
+    (capabilities : Array BindingCap) : Option (Array BindingCap) :=
+  match edgeCapabilities? capabilities input with
+  | some rebased =>
+      some (#[.scalar] ++ rebased.map (BindingCap.shiftLender 1))
+  | none => none
+
+/-- Every matching child position has a producer predecessor whose capability
+vector evolves by `expected`. The whole-position audit separately guarantees
+that both coordinate sets are inhabited. -/
+def CodeTrace.branchTransitionMatches (positions : List PositionTrace)
+    (current child : CodeTrace)
+    (expected : Array BindingCap → Option (Array BindingCap)) : Bool :=
+  positions.all fun after =>
+    if after.coordinateMatches child.source child.sourceBlock
+        child.targetPosition child.sourceInputMap then
+      positions.any fun before =>
+        before.coordinateMatches current.source current.sourceBlock
+            current.targetPosition current.sourceInputMap &&
+          (expected before.sourceCapabilities ==
+            some after.sourceCapabilities)
+    else
+      true
+
+/-- Local switch ownership-flow audit. Constructor children use their selected
+schema; optional Nat children occupy the two canonical post-constructor
+ordinals. Structural branch coherence independently certifies those ordinals. -/
+def CodeTrace.switchNodeCapabilitiesMatch
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | trace@(.switchValue _ _ input _ sourceScrutinee peelNat _ _ generated _
+      children) =>
+      match generated.terminator with
+      | .switchValue _ constructors natPeel =>
+          (constructors.toList.zipIdx.all fun pair =>
+            match children[pair.2]? with
+            | some child =>
+                trace.branchTransitionMatches positions child fun before =>
+                  constructorChildCapabilities? schemas input sourceScrutinee
+                    pair.1.cid before
+            | none => false) &&
+          match peelNat, natPeel with
+          | false, none => true
+          | true, some _ =>
+              match children[constructors.size]?,
+                  children[constructors.size + 1]? with
+              | some zeroChild, some succChild =>
+                  trace.branchTransitionMatches positions zeroChild
+                      (natZeroChildCapabilities? input) &&
+                    trace.branchTransitionMatches positions succChild
+                      (natSuccChildCapabilities? input)
+              | _, _ => false
+          | _, _ => false
+      | _ => false
+  | _ => true
+
+mutual
+
+/-- Recursive audit of every switch capability transition in a code tree. -/
+def CodeTrace.switchCapabilitiesMatch
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace) : CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ _ _ _ next =>
+      next.switchCapabilitiesMatch schemas positions
+  | trace@(.switchValue _ _ _ _ _ _ _ _ _ _ children) =>
+      trace.switchNodeCapabilitiesMatch schemas positions &&
+        codeTraceListSwitchCapabilitiesMatch schemas positions children
+
+private def codeTraceListSwitchCapabilitiesMatch
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace) : List CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      trace.switchCapabilitiesMatch schemas positions &&
+        codeTraceListSwitchCapabilitiesMatch schemas positions rest
+
+end
+
+/-- Whole-program switch capability-flow audit. -/
+def Trace.switchCapabilitiesMatch (trace : Trace)
+    (schemas : Owned → CtorId → Option CtorSchema) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.switchCapabilitiesMatch schemas trace.positions
+
+/-- Reflect the producer predecessor of one matching switch-child position. -/
+theorem CodeTrace.branchTransition_of_match
+    (positions : List PositionTrace) {current child : CodeTrace}
+    {expected : Array BindingCap → Option (Array BindingCap)}
+    {after : PositionTrace}
+    (matched : current.branchTransitionMatches positions child expected = true)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches child.source child.sourceBlock
+      child.targetPosition child.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches current.source current.sourceBlock
+        current.targetPosition current.sourceInputMap = true ∧
+      expected before.sourceCapabilities = some after.sourceCapabilities := by
+  have point := List.all_eq_true.mp matched after afterMember
+  rw [if_pos afterCoordinate] at point
+  obtain ⟨before, beforeMember, beforeMatch⟩ := List.any_eq_true.mp point
+  simp only [Bool.and_eq_true] at beforeMatch
+  exact ⟨before, beforeMember, beforeMatch.1,
+    beq_iff_eq.mp beforeMatch.2⟩
+
+/-- Select the checked constructor capability transition at one exact
+parallel branch ordinal. -/
+theorem CodeTrace.constructorBranchTransition_of_switch_match
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {index : Nat} {target : CtorAlt}
+    {child : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.switchValue source block input entryValueCount
+      sourceScrutinee peelNat alternatives targetScrutinee generated outgoing
+      children).switchNodeCapabilitiesMatch schemas positions = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors natPeel)
+    (targetAt : constructors[index]? = some target)
+    (childAt : children[index]? = some child)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches child.source child.sourceBlock
+      child.targetPosition child.sourceInputMap = true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block .terminator input = true ∧
+      constructorChildCapabilities? schemas input sourceScrutinee target.cid
+        before.sourceCapabilities = some after.sourceCapabilities := by
+  have matched' := matched
+  simp only [CodeTrace.switchNodeCapabilitiesMatch, terminator,
+    Bool.and_eq_true] at matched'
+  have targetListAt : constructors.toList[index]? = some target := by
+    simpa using targetAt
+  have targetMember : (target, index) ∈ constructors.toList.zipIdx :=
+    List.mk_mem_zipIdx_iff_getElem?.mpr targetListAt
+  have point := List.all_eq_true.mp matched'.1 (target, index) targetMember
+  simp only [childAt] at point
+  have transition := CodeTrace.branchTransition_of_match positions point
+    afterMember afterCoordinate
+  simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+    CodeTrace.sourceInputMap] using transition
+
+/-- Select the checked literal-zero capability transition at its canonical
+post-constructor ordinal. -/
+theorem CodeTrace.natZeroBranchTransition_of_switch_match
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {zeroChild succChild : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.switchValue source block input entryValueCount
+      sourceScrutinee true alternatives targetScrutinee generated outgoing
+      children).switchNodeCapabilitiesMatch schemas positions = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (zeroChildAt : children[constructors.size]? = some zeroChild)
+    (succChildAt : children[constructors.size + 1]? = some succChild)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches zeroChild.source
+      zeroChild.sourceBlock zeroChild.targetPosition zeroChild.sourceInputMap =
+        true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block .terminator input = true ∧
+      natZeroChildCapabilities? input before.sourceCapabilities =
+        some after.sourceCapabilities := by
+  have matched' := matched
+  simp only [CodeTrace.switchNodeCapabilitiesMatch, terminator, zeroChildAt,
+    succChildAt, Bool.and_eq_true] at matched'
+  have transition := CodeTrace.branchTransition_of_match positions
+    matched'.2.1 afterMember afterCoordinate
+  simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+    CodeTrace.sourceInputMap] using transition
+
+/-- Select the checked literal-successor capability transition at its
+canonical post-constructor ordinal. -/
+theorem CodeTrace.natSuccBranchTransition_of_switch_match
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {zeroChild succChild : CodeTrace} {after : PositionTrace}
+    (matched : (CodeTrace.switchValue source block input entryValueCount
+      sourceScrutinee true alternatives targetScrutinee generated outgoing
+      children).switchNodeCapabilitiesMatch schemas positions = true)
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (zeroChildAt : children[constructors.size]? = some zeroChild)
+    (succChildAt : children[constructors.size + 1]? = some succChild)
+    (afterMember : after ∈ positions)
+    (afterCoordinate : after.coordinateMatches succChild.source
+      succChild.sourceBlock succChild.targetPosition succChild.sourceInputMap =
+        true) :
+    ∃ before, before ∈ positions ∧
+      before.coordinateMatches source block .terminator input = true ∧
+      natSuccChildCapabilities? input before.sourceCapabilities =
+        some after.sourceCapabilities := by
+  have matched' := matched
+  simp only [CodeTrace.switchNodeCapabilitiesMatch, terminator, zeroChildAt,
+    succChildAt, Bool.and_eq_true] at matched'
+  have transition := CodeTrace.branchTransition_of_match positions
+    matched'.2.2 afterMember afterCoordinate
+  simpa [CodeTrace.source, CodeTrace.sourceBlock, CodeTrace.targetPosition,
+    CodeTrace.sourceInputMap] using transition
+
+private theorem codeTraceListSwitchCapabilitiesMatch_of_mem
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace)
+    {traces : List CodeTrace} {child : CodeTrace}
+    (matched : codeTraceListSwitchCapabilitiesMatch schemas positions traces =
+      true)
+    (member : child ∈ traces) :
+    child.switchCapabilitiesMatch schemas positions = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [codeTraceListSwitchCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Switch capability-flow coherence is inherited by every immediate
+recursive compiler call. -/
+theorem CodeTrace.switchCapabilitiesMatch_of_child
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace) {parent child : CodeTrace}
+    (matched : parent.switchCapabilitiesMatch schemas positions = true)
+    (member : child ∈ parent.children) :
+    child.switchCapabilitiesMatch schemas positions = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [CodeTrace.children] at member
+  | letOp source block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [CodeTrace.children] at member
+      subst child
+      exact matched
+  | switchValue source block input entryValueCount sourceScrutinee peel
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [CodeTrace.switchCapabilitiesMatch,
+        Bool.and_eq_true] at matched
+      exact codeTraceListSwitchCapabilitiesMatch_of_mem schemas positions
+        matched.2 member
+
+/-- Every recursive descendant inherits the checked switch capability-flow
+audit. -/
+theorem CodeTrace.Descendant.switchCapabilitiesMatch
+    (schemas : Owned → CtorId → Option CtorSchema)
+    (positions : List PositionTrace) {root child : CodeTrace}
+    (descendant : Descendant root child)
+    (matched : root.switchCapabilitiesMatch schemas positions = true) :
+    child.switchCapabilitiesMatch schemas positions = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMem ih =>
+      exact CodeTrace.switchCapabilitiesMatch_of_child schemas positions ih
+        childMem
+
+/-- Project whole-program switch capability flow to one retained function. -/
+theorem Trace.functionSwitchCapabilitiesMatch {trace : Trace}
+    {schemas : Owned → CtorId → Option CtorSchema}
+    (matched : trace.switchCapabilitiesMatch schemas = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.switchCapabilitiesMatch schemas trace.positions = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Every retained function derivation agrees with the checked constructor
+schemas at its ordinary allocation nodes. -/
+def Trace.allocationSchemasMatch (trace : Trace)
+    (schemas : Owned → CtorId → Option CtorSchema) : Bool :=
+  trace.functions.all fun functionTrace =>
+    functionTrace.root.allocationSchemasMatch schemas
+
+/-- Project whole-trace allocation-schema coherence to one retained function. -/
+theorem Trace.functionAllocationSchemasMatch {trace : Trace}
+    {schemas : Owned → CtorId → Option CtorSchema}
+    (matched : trace.allocationSchemasMatch schemas = true)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ trace.functions) :
+    functionTrace.root.allocationSchemasMatch schemas = true := by
+  exact List.all_eq_true.mp matched functionTrace member
+
+/-- Executable whole-program alignment of source declarations, emitted target
+declarations, and retained function traces. Externs consume no trace; each
+function consumes one exact owner/source/target trace; the sole remaining
+trace must be the closed main. -/
+def programTraceMatches :
+    List (Address × IxIR1.Decl) → List (Address × Decl) →
+      List FunctionTrace → IxIR1.FnDef → Function → Bool
+  | [], [], [trace], mainSource, mainGenerated =>
+      functionTraceMatches trace .main mainSource mainGenerated
+  | (sourceAddress, .extern sourceArity) :: sourceRest,
+      (targetAddress, .extern targetArity) :: targetRest,
+      traces, mainSource, mainGenerated =>
+      sourceAddress == targetAddress && sourceArity == targetArity &&
+        programTraceMatches sourceRest targetRest traces mainSource mainGenerated
+  | (sourceAddress, .fn sourceDefinition) :: sourceRest,
+      (targetAddress, .fn targetDefinition) :: targetRest,
+      trace :: traces, mainSource, mainGenerated =>
+      sourceAddress == targetAddress &&
+        functionTraceMatches trace (.declaration sourceAddress)
+          sourceDefinition targetDefinition &&
+        programTraceMatches sourceRest targetRest traces mainSource mainGenerated
+  | _, _, _, _, _ => false
+
+/-- Proof-facing declaration/trace alignment reflected from
+`programTraceMatches`. -/
+inductive ProgramTraceOrder (mainSource : IxIR1.FnDef)
+    (mainGenerated : Function) :
+    List (Address × IxIR1.Decl) → List (Address × Decl) →
+      List FunctionTrace → Prop where
+  | main {trace : FunctionTrace}
+      (matched : FunctionTraceMatch trace .main mainSource mainGenerated) :
+      ProgramTraceOrder mainSource mainGenerated [] [] [trace]
+  | extern {address : Address} {arity : Nat}
+      {sourceRest : List (Address × IxIR1.Decl)}
+      {targetRest : List (Address × Decl)}
+      {traces : List FunctionTrace}
+      (rest : ProgramTraceOrder mainSource mainGenerated sourceRest targetRest
+        traces) :
+      ProgramTraceOrder mainSource mainGenerated
+        ((address, .extern arity) :: sourceRest)
+        ((address, .extern arity) :: targetRest) traces
+  | function {address : Address} {sourceDefinition : IxIR1.FnDef}
+      {targetDefinition : Function}
+      {sourceRest : List (Address × IxIR1.Decl)}
+      {targetRest : List (Address × Decl)}
+      {trace : FunctionTrace} {traces : List FunctionTrace}
+      (matched : FunctionTraceMatch trace (.declaration address)
+        sourceDefinition targetDefinition)
+      (rest : ProgramTraceOrder mainSource mainGenerated sourceRest targetRest
+        traces) :
+      ProgramTraceOrder mainSource mainGenerated
+        ((address, .fn sourceDefinition) :: sourceRest)
+        ((address, .fn targetDefinition) :: targetRest) (trace :: traces)
+
+/-- Reflect the executable whole-program trace-order check. -/
+theorem programTraceOrder_of_match
+    {source : List (Address × IxIR1.Decl)}
+    {target : List (Address × Decl)} {traces : List FunctionTrace}
+    {mainSource : IxIR1.FnDef} {mainGenerated : Function}
+    (matched : programTraceMatches source target traces mainSource
+      mainGenerated = true) :
+    ProgramTraceOrder mainSource mainGenerated source target traces := by
+  induction source generalizing target traces with
+  | nil =>
+      cases target with
+      | cons targetEntry targetRest =>
+          simp [programTraceMatches] at matched
+      | nil =>
+          cases traces with
+          | nil => simp [programTraceMatches] at matched
+          | cons trace rest =>
+              cases rest with
+              | nil =>
+                  exact .main (functionTraceMatch_of_match
+                    (by simpa [programTraceMatches] using matched))
+              | cons next tail => simp [programTraceMatches] at matched
+  | cons sourceEntry sourceRest ih =>
+      obtain ⟨sourceAddress, sourceDeclaration⟩ := sourceEntry
+      cases target with
+      | nil => simp [programTraceMatches] at matched
+      | cons targetEntry targetRest =>
+          obtain ⟨targetAddress, targetDeclaration⟩ := targetEntry
+          cases sourceDeclaration with
+          | extern sourceArity =>
+              cases targetDeclaration with
+              | fn targetDefinition =>
+                  simp [programTraceMatches] at matched
+              | extern targetArity =>
+                  simp only [programTraceMatches, Bool.and_eq_true] at matched
+                  have addressEq : sourceAddress = targetAddress :=
+                    beq_iff_eq.mp matched.1.1
+                  have arityEq : sourceArity = targetArity :=
+                    beq_iff_eq.mp matched.1.2
+                  subst targetAddress
+                  subst targetArity
+                  exact .extern (ih matched.2)
+          | fn sourceDefinition =>
+              cases targetDeclaration with
+              | extern targetArity =>
+                  simp [programTraceMatches] at matched
+              | fn targetDefinition =>
+                  cases traces with
+                  | nil => simp [programTraceMatches] at matched
+                  | cons trace rest =>
+                      simp only [programTraceMatches, Bool.and_eq_true] at matched
+                      have addressEq : sourceAddress = targetAddress :=
+                        beq_iff_eq.mp matched.1.1
+                      subst targetAddress
+                      exact .function
+                        (functionTraceMatch_of_match matched.1.2)
+                        (ih matched.2)
+
+/-- Every source function occurrence in a checked program order has the
+corresponding emitted declaration and retained exact function trace. -/
+theorem ProgramTraceOrder.function_exists_of_source_mem
+    {mainSource : IxIR1.FnDef} {mainGenerated : Function}
+    {source : List (Address × IxIR1.Decl)}
+    {target : List (Address × Decl)} {traces : List FunctionTrace}
+    (order : ProgramTraceOrder mainSource mainGenerated source target traces)
+    {address : Address} {sourceDefinition : IxIR1.FnDef}
+    (member : (address, .fn sourceDefinition) ∈ source) :
+    ∃ targetDefinition trace,
+      (address, .fn targetDefinition) ∈ target ∧
+        trace ∈ traces ∧
+        FunctionTraceMatch trace (.declaration address) sourceDefinition
+          targetDefinition := by
+  induction order with
+  | main matched => simp at member
+  | @extern headAddress arity sourceRest targetRest traces rest ih =>
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simp at equal
+      | inr member =>
+          obtain ⟨targetDefinition, trace, targetMember, traceMember,
+            traceMatch⟩ := ih member
+          exact ⟨targetDefinition, trace, List.mem_cons_of_mem _ targetMember,
+            traceMember, traceMatch⟩
+  | @function headAddress headSource headTarget sourceRest targetRest trace traces
+      matched rest ih =>
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal =>
+          cases equal
+          exact ⟨headTarget, trace, by simp, by simp, matched⟩
+      | inr member =>
+          obtain ⟨targetDefinition, childTrace, targetMember, traceMember,
+            traceMatch⟩ := ih member
+          exact ⟨targetDefinition, childTrace,
+            List.mem_cons_of_mem _ targetMember,
+            List.mem_cons_of_mem _ traceMember, traceMatch⟩
+
+/-- Source and target declaration lookup traverse the same checked order.
+Consequently a source function selected by first-binding-wins lookup has the
+exact emitted definition and retained trace selected at the corresponding
+target address, even if the raw lists contain repeated keys. -/
+theorem ProgramTraceOrder.function_exists_of_source_lookup
+    {mainSource : IxIR1.FnDef} {mainGenerated : Function}
+    {source : List (Address × IxIR1.Decl)}
+    {target : List (Address × Decl)} {traces : List FunctionTrace}
+    (order : ProgramTraceOrder mainSource mainGenerated source target traces)
+    {address : Address} {sourceDefinition : IxIR1.FnDef}
+    (lookup : IxIR1.Env.ofList source address =
+      some (.fn sourceDefinition)) :
+    ∃ targetDefinition trace,
+      (target.find? fun entry => entry.1 == address).map (·.2) =
+          some (.fn targetDefinition) ∧
+        trace ∈ traces ∧
+        FunctionTraceMatch trace (.declaration address) sourceDefinition
+          targetDefinition := by
+  induction order with
+  | main matched =>
+      simp [IxIR1.Env.ofList] at lookup
+  | @extern headAddress arity sourceRest targetRest traces rest ih =>
+      by_cases same : headAddress = address
+      · subst address
+        simp [IxIR1.Env.ofList] at lookup
+      · have tailLookup : IxIR1.Env.ofList sourceRest address =
+            some (.fn sourceDefinition) := by
+          simpa [IxIR1.Env.ofList, same] using lookup
+        obtain ⟨targetDefinition, trace, targetLookup, traceMember,
+          traceMatch⟩ := ih tailLookup
+        exact ⟨targetDefinition, trace, by simpa [same] using targetLookup,
+          traceMember, traceMatch⟩
+  | @function headAddress headSource headTarget sourceRest targetRest trace
+      traces matched rest ih =>
+      by_cases same : headAddress = address
+      · subst address
+        have sourceEq : headSource = sourceDefinition := by
+          simpa [IxIR1.Env.ofList] using lookup
+        subst sourceDefinition
+        exact ⟨headTarget, trace, by simp, by simp, matched⟩
+      · have tailLookup : IxIR1.Env.ofList sourceRest address =
+            some (.fn sourceDefinition) := by
+          simpa [IxIR1.Env.ofList, same] using lookup
+        obtain ⟨targetDefinition, childTrace, targetLookup, traceMember,
+          traceMatch⟩ := ih tailLookup
+        exact ⟨targetDefinition, childTrace,
+          by simpa [same] using targetLookup,
+          List.mem_cons_of_mem _ traceMember, traceMatch⟩
+
+/-- Symmetric lookup form of the declaration-order theorem. A target function
+selected by first-binding-wins lookup comes from the exact source function and
+retained trace at the same address; an extern entry can therefore never be
+mistaken for a function in either direction. -/
+theorem ProgramTraceOrder.function_exists_of_target_lookup
+    {mainSource : IxIR1.FnDef} {mainGenerated : Function}
+    {source : List (Address × IxIR1.Decl)}
+    {target : List (Address × Decl)} {traces : List FunctionTrace}
+    (order : ProgramTraceOrder mainSource mainGenerated source target traces)
+    {address : Address} {targetDefinition : Function}
+    (lookup : (target.find? fun entry => entry.1 == address).map (·.2) =
+      some (.fn targetDefinition)) :
+    ∃ sourceDefinition trace,
+      IxIR1.Env.ofList source address = some (.fn sourceDefinition) ∧
+        trace ∈ traces ∧
+        FunctionTraceMatch trace (.declaration address) sourceDefinition
+          targetDefinition := by
+  induction order with
+  | main matched => simp at lookup
+  | @extern headAddress arity sourceRest targetRest traces rest ih =>
+      by_cases same : headAddress = address
+      · subst address
+        simp at lookup
+      · have tailLookup :
+            (targetRest.find? fun entry => entry.1 == address).map (·.2) =
+              some (.fn targetDefinition) := by
+          simpa [same] using lookup
+        obtain ⟨sourceDefinition, trace, sourceLookup, traceMember,
+            traceMatch⟩ := ih tailLookup
+        exact ⟨sourceDefinition, trace,
+          by simpa [IxIR1.Env.ofList, same] using sourceLookup,
+          traceMember, traceMatch⟩
+  | @function headAddress headSource headTarget sourceRest targetRest trace
+      traces matched rest ih =>
+      by_cases same : headAddress = address
+      · subst address
+        have targetEq : headTarget = targetDefinition := by
+          simpa using lookup
+        subst targetDefinition
+        exact ⟨headSource, trace, by simp [IxIR1.Env.ofList], by simp, matched⟩
+      · have tailLookup :
+            (targetRest.find? fun entry => entry.1 == address).map (·.2) =
+              some (.fn targetDefinition) := by
+          simpa [same] using lookup
+        obtain ⟨sourceDefinition, childTrace, sourceLookup, traceMember,
+            traceMatch⟩ := ih tailLookup
+        exact ⟨sourceDefinition, childTrace,
+          by simpa [IxIR1.Env.ofList, same] using sourceLookup,
+          List.mem_cons_of_mem _ traceMember, traceMatch⟩
+
+/-- A target extern selected by first-binding-wins lookup is the matching
+source extern.  In particular, a checked function declaration cannot be
+observed as an extern on only one side of the lowering boundary. -/
+theorem ProgramTraceOrder.extern_of_target_lookup
+    {mainSource : IxIR1.FnDef} {mainGenerated : Function}
+    {source : List (Address × IxIR1.Decl)}
+    {target : List (Address × Decl)} {traces : List FunctionTrace}
+    (order : ProgramTraceOrder mainSource mainGenerated source target traces)
+    {address : Address} {arity : Nat}
+    (lookup : (target.find? fun entry => entry.1 == address).map (·.2) =
+      some (.extern arity)) :
+    IxIR1.Env.ofList source address = some (.extern arity) := by
+  induction order with
+  | main matched => simp at lookup
+  | @extern headAddress headArity sourceRest targetRest traces rest ih =>
+      by_cases same : headAddress = address
+      · subst address
+        have arityEq : headArity = arity := by simpa using lookup
+        subst arity
+        simp [IxIR1.Env.ofList]
+      · have tailLookup :
+            (targetRest.find? fun entry => entry.1 == address).map (·.2) =
+              some (.extern arity) := by
+          simpa [same] using lookup
+        simpa [IxIR1.Env.ofList, same] using ih tailLookup
+  | @function headAddress headSource headTarget sourceRest targetRest trace
+      traces matched rest ih =>
+      by_cases same : headAddress = address
+      · subst address
+        simp at lookup
+      · have tailLookup :
+            (targetRest.find? fun entry => entry.1 == address).map (·.2) =
+              some (.extern arity) := by
+          simpa [same] using lookup
+        simpa [IxIR1.Env.ofList, same] using ih tailLookup
+
+/-- A retained trace whose certified owner is `main` is the unique final main
+entry of the whole-program declaration/trace alignment. -/
+theorem ProgramTraceOrder.main_of_mem_owner
+    {mainSource : IxIR1.FnDef} {mainGenerated : Function}
+    {source : List (Address × IxIR1.Decl)}
+    {target : List (Address × Decl)} {traces : List FunctionTrace}
+    (order : ProgramTraceOrder mainSource mainGenerated source target traces)
+    {trace : FunctionTrace}
+    (member : trace ∈ traces) (owner : trace.owner = .main) :
+    FunctionTraceMatch trace .main mainSource mainGenerated := by
+  induction order with
+  | main matched =>
+      simp only [List.mem_singleton] at member
+      subst trace
+      exact matched
+  | @extern address arity sourceRest targetRest traces rest ih =>
+      exact ih member
+  | @function address sourceDefinition targetDefinition sourceRest targetRest
+      head traces matched rest ih =>
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal =>
+          subst trace
+          rw [matched.owner] at owner
+          cases owner
+      | inr member => exact ih member
+
+structure Artifact where
+  source : Input
+  program : Program
+  validationContext : Validate.Context
+  trace : Trace
+  mainTrace : FunctionTrace
+  /-- The distinguished synthetic-main derivation is retained in the exact
+  whole-program trace consumed by recursive simulation. -/
+  mainTraceMember : mainTrace ∈ trace.functions
+  mainTraceOrder : FunctionTraceMatch mainTrace .main source.mainDefinition
+    program.main
+  /-- Exact declaration/function-trace order, ending in the retained main. -/
+  functionTraceOrder : programTraceMatches source.declarations
+    program.declarations trace.functions source.mainDefinition program.main = true
+
+namespace Artifact
+
+/-- Proof-facing whole-program declaration/function-trace alignment. -/
+theorem functionTraceOrderProof (artifact : Artifact) :
+    ProgramTraceOrder artifact.source.mainDefinition artifact.program.main
+      artifact.source.declarations artifact.program.declarations
+      artifact.trace.functions :=
+  programTraceOrder_of_match artifact.functionTraceOrder
+
+/-- Resolve one retained source function occurrence to its emitted definition
+and exact recursive trace. -/
+theorem functionTrace_of_source_mem (artifact : Artifact)
+    {address : Address} {sourceDefinition : IxIR1.FnDef}
+    (member : (address, .fn sourceDefinition) ∈
+      artifact.source.declarations) :
+    ∃ targetDefinition trace,
+      (address, .fn targetDefinition) ∈ artifact.program.declarations ∧
+        trace ∈ artifact.trace.functions ∧
+        FunctionTraceMatch trace (.declaration address) sourceDefinition
+          targetDefinition :=
+  artifact.functionTraceOrderProof.function_exists_of_source_mem member
+
+/-- Lookup-facing form of `functionTrace_of_source_mem`, aligned with the
+declaration function installed by `Eval.Context.ofProgram`. -/
+theorem functionTrace_of_source_lookup (artifact : Artifact)
+    {address : Address} {sourceDefinition : IxIR1.FnDef}
+    (lookup : IxIR1.Env.ofList artifact.source.declarations address =
+      some (.fn sourceDefinition)) :
+    ∃ targetDefinition trace,
+      (artifact.program.declarations.find? fun entry =>
+        entry.1 == address).map (·.2) = some (.fn targetDefinition) ∧
+      trace ∈ artifact.trace.functions ∧
+      FunctionTraceMatch trace (.declaration address) sourceDefinition
+        targetDefinition :=
+  artifact.functionTraceOrderProof.function_exists_of_source_lookup lookup
+
+/-- Lookup-facing inverse of `functionTrace_of_source_lookup`, used by
+forward target execution proofs to recover the exact retained source callee. -/
+theorem functionTrace_of_target_lookup (artifact : Artifact)
+    {address : Address} {targetDefinition : Function}
+    (lookup : (artifact.program.declarations.find? fun entry =>
+      entry.1 == address).map (·.2) = some (.fn targetDefinition)) :
+    ∃ sourceDefinition trace,
+      IxIR1.Env.ofList artifact.source.declarations address =
+          some (.fn sourceDefinition) ∧
+        trace ∈ artifact.trace.functions ∧
+        FunctionTraceMatch trace (.declaration address) sourceDefinition
+          targetDefinition :=
+  artifact.functionTraceOrderProof.function_exists_of_target_lookup lookup
+
+/-- Resolve a target extern lookup to the exact source extern selected at the
+same address. -/
+theorem sourceExtern_of_target_lookup (artifact : Artifact)
+    {address : Address} {arity : Nat}
+    (lookup : (artifact.program.declarations.find? fun entry =>
+      entry.1 == address).map (·.2) = some (.extern arity)) :
+    IxIR1.Env.ofList artifact.source.declarations address =
+      some (.extern arity) :=
+  artifact.functionTraceOrderProof.extern_of_target_lookup lookup
+
+/-- The distinguished trace is the source main's trace. -/
+theorem mainOwner (artifact : Artifact) :
+    artifact.mainTrace.owner = .main :=
+  artifact.mainTraceOrder.owner
+
+/-- The distinguished trace retains the exact synthetic source main. -/
+theorem mainSource (artifact : Artifact) :
+    artifact.mainTrace.source = artifact.source.mainDefinition :=
+  artifact.mainTraceOrder.source
+
+/-- The distinguished trace generated the target program's actual main. -/
+theorem mainGenerated (artifact : Artifact) :
+    artifact.mainTrace.generated = artifact.program.main :=
+  artifact.mainTraceOrder.generated
+
+/-- The emitted main remains closed. -/
+theorem mainArity (artifact : Artifact) :
+    artifact.program.main.signature.params.size = 0 := by
+  have arity := artifact.mainTrace.sourceArity
+  rw [artifact.mainGenerated, artifact.mainSource] at arity
+  simpa [Input.mainDefinition] using arity
+
+/-- The recursive main derivation reconstructs the literal input main code. -/
+theorem mainRootSourceCode (artifact : Artifact) :
+    artifact.mainTrace.root.sourceCode = artifact.source.main := by
+  rw [artifact.mainTrace.rootSourceCode, artifact.mainSource]
+  rfl
+
+/-- A closed source main starts with the empty source-slot map. -/
+theorem mainEntryInput (artifact : Artifact) :
+    artifact.mainTrace.root.sourceInputMap = #[] := by
+  rw [artifact.mainTrace.entryInput, artifact.mainSource]
+  simp [Input.mainDefinition, entryInputMap]
+
+/-- The trace's completed root block is the actual block-zero entry of the
+emitted target main. -/
+theorem mainHeadBlockAt (artifact : Artifact) :
+    artifact.program.main.blocks[0]? =
+      some artifact.mainTrace.root.headBlock.2 := by
+  have blockAt := artifact.mainTrace.headBlockAt
+  rw [artifact.mainGenerated, artifact.mainTrace.rootHeadBlock] at blockAt
+  exact blockAt
+
+/-- The retained entry-block witness discharges the evaluator's nonempty-main
+entry check. -/
+theorem mainNonempty (artifact : Artifact) :
+    artifact.program.main.blocks.isEmpty = false := by
+  have found := artifact.mainHeadBlockAt
+  obtain ⟨bound, _⟩ := Array.getElem?_eq_some_iff.mp found
+  simpa [Array.isEmpty] using (Nat.ne_of_gt bound)
+
+end Artifact
+
+/-- A successful lower-and-check result retains the exact validator equation,
+so later simulation files never need to trust a Boolean acceptance claim. -/
+structure Checked where
+  artifact : Artifact
+  stats : Validate.Stats
+  accepted : Validate.validate artifact.validationContext artifact.program =
+    .ok stats
+  /-- The emitted baseline contains no credit operations. This checked
+  syntactic inventory supports exact interpretation independence. -/
+  creditFree : CreditFree.program artifact.program = true
+  /-- Every recursive derivation node is represented by a flat producer
+  position with the exact source/block/target coordinate and input-map
+  capability shape. -/
+  positionCoordinates : artifact.trace.positionsMatch = true
+  /-- Every live source slot that names an inherited target block parameter
+  carries exactly that parameter's declared ownership capability. -/
+  parameterCapabilities : artifact.trace.parameterCapabilitiesMatch = true
+  /-- Every retained `pure` node has the producer's exact move/copy/consume
+  transition between its current and continuation capability vectors. -/
+  pureCapabilities : artifact.trace.pureCapabilitiesMatch = true
+  /-- Every retained `dup` node has the producer's exact scalar-copy or
+  shared-owner retention transition. -/
+  dupCapabilities : artifact.trace.dupCapabilitiesMatch = true
+  /-- Every retained `fetch` node borrows in the source constructor world and
+  retains the producer's exact lender. -/
+  fetchCapabilities : artifact.trace.fetchCapabilitiesMatch = true
+  /-- Every retained shallow/deep destruction node consumes its exact owner,
+  retires rooted loans, and binds the erased scalar result. -/
+  destructionCapabilities :
+    artifact.trace.destructionCapabilitiesMatch = true
+  /-- The post-validation semantic projection used by allocation simulation:
+  every retained source allocation has the exact uniform target schema. -/
+  allocationSchemas : artifact.trace.allocationSchemasMatch
+    artifact.validationContext.schemas = true
+  /-- Every retained constructor or function-PAP allocation is paired with
+  the producer's exact pre-operation capability vector and exact sequential
+  consume-and-bind continuation, checked against its recursive input map and
+  owned operand world. -/
+  allocationCapabilities : artifact.trace.allocationCapabilitiesMatch = true
+  /-- Every allocation immediately followed by a recursive self tail call is
+  reached only after the producer has retired all outstanding borrows. -/
+  terminalAllocationNoBorrows :
+    artifact.trace.terminalAllocationNoBorrows = true
+  /-- Every retained dynamic application consumes its function operand and
+  supplied arguments at the shared boundary, then binds one shared result
+  owner. -/
+  applyCapabilities : artifact.trace.applyCapabilitiesMatch = true
+  /-- Every PAP-safe retained function has the canonical all-owned/shared
+  entry capability vector used by dynamic exact and over-saturation. -/
+  sharedPapEntryCapabilities :
+    artifact.trace.sharedPapEntryCapabilitiesMatch = true
+  /-- Every switch edge rebases local lenders exactly; constructor children
+  prepend schema-world field borrows and Nat-successor children shift lenders
+  across their implicit scalar parameter. -/
+  switchCapabilities : artifact.trace.switchCapabilitiesMatch
+    artifact.validationContext.schemas = true
+  /-- Function entries, ordinary and tail calls, and returns implement the
+  exact baseline ownership-transfer ABI. -/
+  callCapabilities : artifact.trace.callCapabilitiesMatch
+    artifact.program.declarations = true
+
+namespace Checked
+
+/-- Every returned checked artifact satisfies the public bounded-validity
+predicate by construction. -/
+theorem valid (checked : Checked) :
+    Validate.Valid checked.artifact.validationContext checked.artifact.program :=
+  ⟨checked.stats, checked.accepted⟩
+
+/-- Recover the borrow-free producer vector at a terminal allocation node. -/
+theorem terminalAllocationPositionNoBorrows (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId} {arguments : Array IxIR1.Atom}
+    {index : Nat} {instruction : Instr}
+    {tailSource : SourceSite} {tailBlock : BlockId}
+    {tailInput : Array (Option Atom)} {tailEntryValueCount : Nat}
+    {tailArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.alloc world identity arguments) index instruction
+          (.tailCallSelf tailSource tailBlock tailInput tailEntryValueCount
+            tailArguments generated)))
+    {position : PositionTrace}
+    (positionMember : position ∈ checked.artifact.trace.positions)
+    (coordinate : position.coordinateMatches source block
+      (.instruction index) input = true) :
+    noBorrows position.sourceCapabilities = true := by
+  have rootMatch := checked.artifact.trace.functionTerminalAllocationNoBorrows
+    checked.terminalAllocationNoBorrows functionMember
+  have localMatch := descendant.terminalAllocationNoBorrows
+    checked.artifact.trace.positions rootMatch
+  exact CodeTrace.terminalAllocationPositionNoBorrows_of_match
+    checked.artifact.trace.positions localMatch positionMember coordinate
+
+/-- Recover the exact flat producer position for any recursive trace node in
+a retained function. -/
+theorem position (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {trace : CodeTrace}
+    (descendant : functionTrace.root.Descendant trace) :
+    ∃ position, position ∈ checked.artifact.trace.positions ∧
+      position.coordinateMatches trace.source trace.sourceBlock
+        trace.targetPosition trace.sourceInputMap = true := by
+  have rootMatch := Trace.functionPositionsMatch
+    checked.positionCoordinates member
+  exact CodeTrace.position_of_positionsMatch checked.artifact.trace.positions
+    (descendant.positionsMatch checked.artifact.trace.positions rootMatch)
+
+/-- Recover the exact producer owner behind an inherited owned target
+parameter at any retained recursive trace node. -/
+theorem ownedParameterCapability (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {trace : CodeTrace}
+    (descendant : functionTrace.root.Descendant trace)
+    {position : PositionTrace}
+    (positionMember : position ∈ checked.artifact.trace.positions)
+    (coordinate : position.coordinateMatches trace.source trace.sourceBlock
+      trace.targetPosition trace.sourceInputMap = true)
+    {sourceIndex targetIndex : Nat} {world : Owned}
+    (inputAt : trace.sourceInputMap[sourceIndex]? =
+      some (some (.reg targetIndex)))
+    (parameterAt : trace.headBlock.2.valueParams[targetIndex]? =
+      some (.owned world)) :
+    position.sourceCapabilities[sourceIndex]? = some (.owned world) := by
+  have rootMatch := Trace.functionParameterCapabilitiesMatch
+    checked.parameterCapabilities member
+  have localMatch := descendant.parameterCapabilitiesMatch
+    checked.artifact.trace.positions rootMatch
+  have positionMatch := trace.positionParameterCapabilities_of_match
+    checked.artifact.trace.positions localMatch positionMember coordinate
+  exact position.owned_of_parameterCapabilitiesMatch positionMatch inputAt
+    parameterAt
+
+/-- Recover the producer capability corresponding to any inherited target
+block parameter.  The reflected `matchesParameter` equation retains the exact
+scalar/owned/borrowed kind and excludes a consumed source binding. -/
+theorem parameterCapability (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {trace : CodeTrace}
+    (descendant : functionTrace.root.Descendant trace)
+    {position : PositionTrace}
+    (positionMember : position ∈ checked.artifact.trace.positions)
+    (coordinate : position.coordinateMatches trace.source trace.sourceBlock
+      trace.targetPosition trace.sourceInputMap = true)
+    {sourceIndex targetIndex : Nat} {parameter : ValueCap}
+    (inputAt : trace.sourceInputMap[sourceIndex]? =
+      some (some (.reg targetIndex)))
+    (parameterAt : trace.headBlock.2.valueParams[targetIndex]? =
+      some parameter) :
+    ∃ capability,
+      position.sourceCapabilities[sourceIndex]? = some capability ∧
+        capability.matchesParameter parameter = true := by
+  have rootMatch := Trace.functionParameterCapabilitiesMatch
+    checked.parameterCapabilities member
+  have localMatch := descendant.parameterCapabilitiesMatch
+    checked.artifact.trace.positions rootMatch
+  have positionMatch := trace.positionParameterCapabilities_of_match
+    checked.artifact.trace.positions localMatch positionMember coordinate
+  exact position.capability_of_parameterCapabilitiesMatch positionMatch inputAt
+    parameterAt
+
+/-- Recover the local switch capability audit at any retained switch node. -/
+theorem switchNodeCapabilities (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue source block input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)) :
+    (CodeTrace.switchValue source block input entryValueCount sourceScrutinee
+      peelNat alternatives targetScrutinee generated outgoing children
+        ).switchNodeCapabilitiesMatch
+          checked.artifact.validationContext.schemas
+          checked.artifact.trace.positions = true := by
+  have rootMatch := Trace.functionSwitchCapabilitiesMatch
+    checked.switchCapabilities member
+  have nodeMatch := descendant.switchCapabilitiesMatch
+    checked.artifact.validationContext.schemas
+    checked.artifact.trace.positions rootMatch
+  change ((CodeTrace.switchValue source block input entryValueCount
+    sourceScrutinee peelNat alternatives targetScrutinee generated outgoing
+    children).switchNodeCapabilitiesMatch
+      checked.artifact.validationContext.schemas
+      checked.artifact.trace.positions &&
+    codeTraceListSwitchCapabilitiesMatch
+      checked.artifact.validationContext.schemas
+      checked.artifact.trace.positions children) = true at nodeMatch
+  simp only [Bool.and_eq_true] at nodeMatch
+  exact nodeMatch.1
+
+/-- Recover the exact constructor-child capability transition at a checked
+switch ordinal. -/
+theorem constructorBranchTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List EdgeTrace}
+    {children : List CodeTrace} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {index : Nat} {target : CtorAlt}
+    {child : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue source block input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors natPeel)
+    (targetAt : constructors[index]? = some target)
+    (childAt : children[index]? = some child)
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches child.source child.sourceBlock
+      child.targetPosition child.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block .terminator input = true ∧
+      constructorChildCapabilities?
+        checked.artifact.validationContext.schemas input sourceScrutinee
+          target.cid before.sourceCapabilities =
+        some after.sourceCapabilities := by
+  exact CodeTrace.constructorBranchTransition_of_switch_match
+    checked.artifact.validationContext.schemas
+    checked.artifact.trace.positions
+    (checked.switchNodeCapabilities member descendant) terminator targetAt
+      childAt afterMember afterCoordinate
+
+/-- A checked constructor-child transition fixes the selected schema arity.
+The child coordinate counts both the edge-rebased source vector and every
+borrowed constructor field, so comparison with the source alternative is
+exact rather than merely a lower bound from the generated fetch prologue. -/
+theorem constructorBranchSchemaArity
+    (checked : Checked) {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {site : SourceSite} {blockId : BlockId} {input : Array (Option Atom)}
+    {entryValueCount : Nat} {sourceScrutinee : IxIR1.Atom}
+    {peelNat : Bool} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : EdgeTrace}
+    {child : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (childAt : children[index]? = some child)
+    (branch : ConstructorBranchMatch site blockId input sourceScrutinee
+      alternatives target edge child) :
+    ∃ world schema,
+      checked.artifact.validationContext.schemas world target.cid =
+          some schema ∧
+        schema.fields.size = branch.fieldCount := by
+  have childMember : child ∈ children := List.mem_of_getElem? childAt
+  have childDescendant : functionTrace.root.Descendant child :=
+    .step descendant childMember
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position member childDescendant
+  obtain ⟨before, _beforeMember, beforeCoordinate, transition⟩ :=
+    checked.constructorBranchTransition member descendant terminator targetAt
+      childAt afterMember afterCoordinate
+  have beforeSize : before.sourceCapabilities.size = input.size :=
+    before.sourceCapabilities_size_of_coordinateMatch beforeCoordinate
+  have afterSize : after.sourceCapabilities.size = child.sourceInputMap.size :=
+    after.sourceCapabilities_size_of_coordinateMatch afterCoordinate
+  have childSize : child.sourceInputMap.size =
+      branch.fieldCount + input.size := by
+    rw [branch.childInput]
+    simp [constructorChildInputMap, EdgeTrace.explicitMapOf,
+      branch.edgeSourceInput]
+  unfold constructorChildCapabilities? at transition
+  cases rebasedEq : edgeCapabilities? before.sourceCapabilities input with
+  | none => simp [rebasedEq] at transition
+  | some rebased =>
+      simp only [rebasedEq] at transition
+      cases sourceScrutinee with
+      | lit literal => simp at transition
+      | erased => simp at transition
+      | var sourceIndex =>
+          cases capabilityEq : rebased[sourceIndex]? with
+          | none => simp [capabilityEq] at transition
+          | some capability =>
+              cases capability with
+              | scalar => simp [capabilityEq] at transition
+              | dead => simp [capabilityEq] at transition
+              | owned world =>
+                  cases schemaEq : checked.artifact.validationContext.schemas
+                      world target.cid with
+                  | none => simp [capabilityEq, schemaEq] at transition
+                  | some schema =>
+                      simp only [capabilityEq, schemaEq] at transition
+                      injection transition with afterEq
+                      have rebasedSize : rebased.size =
+                          before.sourceCapabilities.size :=
+                        edgeCapabilities?_size rebasedEq
+                      refine ⟨world, schema, schemaEq, ?_⟩
+                      have sizeEq := congrArg Array.size afterEq
+                      simp only [Array.size_append, Array.size_reverse,
+                        Array.size_map] at sizeEq
+                      omega
+              | borrowed world lender =>
+                  cases schemaEq : checked.artifact.validationContext.schemas
+                      world target.cid with
+                  | none => simp [capabilityEq, schemaEq] at transition
+                  | some schema =>
+                      simp only [capabilityEq, schemaEq] at transition
+                      injection transition with afterEq
+                      have rebasedSize : rebased.size =
+                          before.sourceCapabilities.size :=
+                        edgeCapabilities?_size rebasedEq
+                      refine ⟨world, schema, schemaEq, ?_⟩
+                      have sizeEq := congrArg Array.size afterEq
+                      simp only [Array.size_append, Array.size_reverse,
+                        Array.size_map] at sizeEq
+                      omega
+
+/-- Recover the exact literal-zero child capability transition. -/
+theorem natZeroBranchTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {zeroChild succChild : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue source block input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (zeroChildAt : children[constructors.size]? = some zeroChild)
+    (succChildAt : children[constructors.size + 1]? = some succChild)
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches zeroChild.source
+      zeroChild.sourceBlock zeroChild.targetPosition zeroChild.sourceInputMap =
+        true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block .terminator input = true ∧
+      natZeroChildCapabilities? input before.sourceCapabilities =
+        some after.sourceCapabilities := by
+  exact CodeTrace.natZeroBranchTransition_of_switch_match
+    checked.artifact.validationContext.schemas
+    checked.artifact.trace.positions
+    (checked.switchNodeCapabilities member descendant) terminator zeroChildAt
+      succChildAt afterMember afterCoordinate
+
+/-- Recover the exact literal-successor child capability transition. -/
+theorem natSuccBranchTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List EdgeTrace} {children : List CodeTrace}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {zeroChild succChild : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue source block input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (zeroChildAt : children[constructors.size]? = some zeroChild)
+    (succChildAt : children[constructors.size + 1]? = some succChild)
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches succChild.source
+      succChild.sourceBlock succChild.targetPosition succChild.sourceInputMap =
+        true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block .terminator input = true ∧
+      natSuccChildCapabilities? input before.sourceCapabilities =
+        some after.sourceCapabilities := by
+  exact CodeTrace.natSuccBranchTransition_of_switch_match
+    checked.artifact.validationContext.schemas
+    checked.artifact.trace.positions
+    (checked.switchNodeCapabilities member descendant) terminator zeroChildAt
+      succChildAt afterMember afterCoordinate
+
+/-- Recover the producer capability predecessor of any matching continuation
+position at a retained `pure`/`move` node. -/
+theorem pureTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {index : Nat} {targetAtom : Atom}
+    {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.moveMatches after input sourceAtom = true := by
+  have rootMatch := Trace.functionPureCapabilitiesMatch
+    checked.pureCapabilities member
+  exact CodeTrace.pureTransition_of_match checked.artifact.trace.positions
+    (descendant.pureCapabilitiesMatch checked.artifact.trace.positions
+      rootMatch) afterMember afterCoordinate
+
+/-- Recover the producer capability predecessor of any matching continuation
+position at a retained `dup`/`retainShared` node. -/
+theorem dupTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {index : Nat} {targetAtom : Atom}
+    {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.dupMatches after sourceAtom = true := by
+  have rootMatch := Trace.functionDupCapabilitiesMatch
+    checked.dupCapabilities member
+  exact CodeTrace.dupTransition_of_match checked.artifact.trace.positions
+    (descendant.dupCapabilitiesMatch checked.artifact.trace.positions
+      rootMatch) afterMember afterCoordinate
+
+/-- Recover the producer capability predecessor of any matching continuation
+position at a retained `fetch` node. -/
+theorem fetchTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {sourceField index : Nat}
+    {targetAtom : Atom} {targetCid : CtorId} {targetField : Nat}
+    {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+          (.fetch targetAtom targetCid targetField) next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.fetchMatches after sourceAtom targetAtom = true := by
+  have rootMatch := Trace.functionFetchCapabilitiesMatch
+    checked.fetchCapabilities member
+  exact CodeTrace.fetchTransition_of_match checked.artifact.trace.positions
+    (descendant.fetchCapabilitiesMatch checked.artifact.trace.positions
+      rootMatch) afterMember afterCoordinate
+
+/-- Recover the exact consume/loan-retirement/scalar-bind transition at any
+retained destruction node. -/
+theorem destructionTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {sourceSite : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {operation : IxIR1.Op} {world : Owned} {sourceAtom : IxIR1.Atom}
+    {index : Nat} {instruction : Instr} {next : CodeTrace}
+    (operationMatch : destructionSpec? operation = some (world, sourceAtom))
+    (descendant : functionTrace.root.Descendant
+      (.letOp sourceSite block input nextInput entryValueCount operation index
+        instruction next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches sourceSite block (.instruction index) input =
+        true ∧
+      before.destructionResultMatches after input world sourceAtom = true := by
+  have rootMatch := Trace.functionDestructionCapabilitiesMatch
+    checked.destructionCapabilities member
+  exact CodeTrace.destructionTransition_of_match
+    checked.artifact.trace.positions operationMatch
+      (descendant.destructionCapabilitiesMatch
+        checked.artifact.trace.positions rootMatch)
+      afterMember afterCoordinate
+
+/-- Recover the exact checked schema at any retained ordinary allocation in a
+function trace belonging to this artifact. -/
+theorem allocationSchema (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.alloc world identity arguments) index instruction next)) :
+    ∃ schema,
+      checked.artifact.validationContext.schemas world identity = some schema ∧
+      schema.fields = Array.replicate arguments.size world := by
+  have rootMatch := checked.artifact.trace.functionAllocationSchemasMatch
+    checked.allocationSchemas member
+  exact CodeTrace.allocationSchema_of_match
+    checked.artifact.validationContext.schemas
+      (descendant.allocationSchemasMatch
+        checked.artifact.validationContext.schemas rootMatch)
+
+/-- Recover the producer capability position at any retained allocation. -/
+theorem allocationPosition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.alloc world identity arguments) index instruction next)) :
+    ∃ position, position ∈ checked.artifact.trace.positions ∧
+      position.allocationMatches source block index input world arguments =
+        true := by
+  have rootMatch := Trace.functionAllocationCapabilitiesMatch
+    checked.allocationCapabilities member
+  exact CodeTrace.allocationPosition_of_capabilities_match
+    checked.artifact.trace.positions
+      (descendant.allocationCapabilitiesMatch
+        checked.artifact.trace.positions rootMatch)
+
+/-- Recover the exact sequential consume-and-bind transition at any retained
+ordinary allocation. -/
+theorem allocationTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.alloc world identity arguments) index instruction next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.allocationResultMatches after input world arguments = true := by
+  have rootMatch := Trace.functionAllocationCapabilitiesMatch
+    checked.allocationCapabilities member
+  exact CodeTrace.allocationTransition_of_capabilities_match
+    checked.artifact.trace.positions
+      (descendant.allocationCapabilitiesMatch
+        checked.artifact.trace.positions rootMatch)
+      afterMember afterCoordinate
+
+/-- Recover the exact shared capture consumption and fresh-owner transition at
+any retained function partial application. -/
+theorem pappTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.papp address arguments) index instruction next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.allocationResultMatches after input .shared arguments = true := by
+  have rootMatch := Trace.functionAllocationCapabilitiesMatch
+    checked.allocationCapabilities member
+  exact CodeTrace.pappTransition_of_capabilities_match
+    checked.artifact.trace.positions
+      (descendant.allocationCapabilitiesMatch
+        checked.artifact.trace.positions rootMatch)
+      afterMember afterCoordinate
+
+/-- Recover the exact shared function/argument consumption and shared-result
+binding transition at any retained dynamic application. -/
+theorem applyTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {function : IxIR1.Atom} {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.apply function arguments) index instruction next))
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    ∃ before, before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches source block (.instruction index) input = true ∧
+      before.applyResultMatches after input function arguments = true := by
+  have rootMatch := Trace.functionApplyCapabilitiesMatch
+    checked.applyCapabilities member
+  exact CodeTrace.applyTransition_of_capabilities_match
+    checked.artifact.trace.positions
+      (descendant.applyCapabilitiesMatch checked.artifact.trace.positions
+        rootMatch)
+      afterMember afterCoordinate
+
+/-- A caller-selected schema lookup at a retained allocation is necessarily
+the exact uniform schema certified by the checked compiler trace. -/
+theorem allocationSchemaFields (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {world : Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {index : Nat}
+    {instruction : Instr} {next : CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.alloc world identity arguments) index instruction next))
+    {schema : CtorSchema}
+    (schemaAt : checked.artifact.validationContext.schemas world identity =
+      some schema) :
+    schema.fields = Array.replicate arguments.size world := by
+  obtain ⟨found, foundAt, fields⟩ := checked.allocationSchema member descendant
+  have equal : found = schema := Option.some.inj (foundAt.symm.trans schemaAt)
+  simpa [equal] using fields
+
+/-- Recover the complete call/return capability audit for one retained
+function. -/
+theorem functionCallCapabilitiesMatch (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions) :
+    functionTrace.callCapabilitiesMatch checked.artifact.trace.positions
+      checked.artifact.program.declarations = true :=
+  checked.artifact.trace.functionCallCapabilitiesMatch
+    checked.callCapabilities member
+
+/-- Recover the canonical capability vector at any retained function root. -/
+theorem entryCapabilities (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {position : PositionTrace}
+    (positionMember : position ∈ checked.artifact.trace.positions)
+    (coordinate : position.coordinateMatches functionTrace.root.source
+      functionTrace.root.sourceBlock functionTrace.root.targetPosition
+      functionTrace.root.sourceInputMap = true) :
+    position.sourceCapabilities =
+      Lower.entryCapabilities functionTrace.generated.signature := by
+  exact FunctionTrace.entryCapabilities_of_call_match
+    (checked.functionCallCapabilitiesMatch member) positionMember coordinate
+
+/-- PAP safety in a checked artifact exposes the exact all-owned/shared
+capability vector expected at the dynamically selected callee root. -/
+theorem papSafeEntryCapabilities (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    (papSafe : functionTrace.generated.signature.papSafe = true) :
+    Lower.entryCapabilities functionTrace.generated.signature =
+      Array.replicate functionTrace.generated.signature.params.size
+        (.owned .shared) := by
+  have point := checked.artifact.trace.functionSharedPapEntryCapabilitiesMatch
+    checked.sharedPapEntryCapabilities member
+  unfold FunctionTrace.sharedPapEntryCapabilitiesMatch at point
+  rw [papSafe] at point
+  exact beq_iff_eq.mp point
+
+/-- A retained declaration trace exposes the exact signature used by checked
+addressed calls. -/
+theorem targetSignature (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {address : Address} (owner : functionTrace.owner = .declaration address) :
+    targetSignature? checked.artifact.program.declarations address =
+      some functionTrace.generated.signature :=
+  checked.artifact.trace.targetSignature_of_call_match
+    checked.callCapabilities member owner
+
+/-- Recover an addressed ordinary call's exact consume/suspend/result-bind
+transition. -/
+theorem callTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {index : Nat} {instruction : Instr}
+    {next : CodeTrace} {before : PositionTrace}
+    (signatureAt : targetSignature? checked.artifact.program.declarations
+      address = some signature)
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.call address arguments) index instruction next))
+    (beforeMember : before ∈ checked.artifact.trace.positions)
+    (beforeCoordinate : before.coordinateMatches source block
+      (.instruction index) input = true)
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    before.callResultMatches after input signature arguments = true := by
+  have rootMatch := checked.functionCallCapabilitiesMatch member
+  simp only [FunctionTrace.callCapabilitiesMatch,
+    Bool.and_eq_true] at rootMatch
+  exact CodeTrace.callTransition_of_capabilities_match
+    checked.artifact.trace.positions checked.artifact.program.declarations
+      functionTrace.generated.signature signatureAt
+      (descendant.callCapabilitiesMatch checked.artifact.trace.positions
+        checked.artifact.program.declarations
+        functionTrace.generated.signature rootMatch.2)
+      beforeMember beforeCoordinate afterMember afterCoordinate
+
+/-- Recover a self call's exact consume/suspend/result-bind transition. -/
+theorem callSelfTransition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount : Nat}
+    {arguments : Array IxIR1.Atom} {index : Nat} {instruction : Instr}
+    {next : CodeTrace} {before : PositionTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp source block input nextInput entryValueCount
+        (.callSelf arguments) index instruction next))
+    (beforeMember : before ∈ checked.artifact.trace.positions)
+    (beforeCoordinate : before.coordinateMatches source block
+      (.instruction index) input = true)
+    {after : PositionTrace}
+    (afterMember : after ∈ checked.artifact.trace.positions)
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true) :
+    before.callResultMatches after input
+      functionTrace.generated.signature arguments = true := by
+  have rootMatch := checked.functionCallCapabilitiesMatch member
+  simp only [FunctionTrace.callCapabilitiesMatch,
+    Bool.and_eq_true] at rootMatch
+  exact CodeTrace.callSelfTransition_of_capabilities_match
+    checked.artifact.trace.positions checked.artifact.program.declarations
+      functionTrace.generated.signature
+      (descendant.callCapabilitiesMatch checked.artifact.trace.positions
+        checked.artifact.program.declarations
+        functionTrace.generated.signature rootMatch.2)
+      beforeMember beforeCoordinate afterMember afterCoordinate
+
+/-- Recover an addressed tail call's exact all-local-owner transfer. -/
+theorem tailCallPosition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {generated : Block}
+    (signatureAt : targetSignature? checked.artifact.program.declarations
+      address = some signature)
+    (descendant : functionTrace.root.Descendant
+      (.tailCall source block input entryValueCount address arguments generated)) :
+    ∃ position, position ∈ checked.artifact.trace.positions ∧
+      position.tailCallMatches source block input signature arguments = true := by
+  have rootMatch := checked.functionCallCapabilitiesMatch member
+  simp only [FunctionTrace.callCapabilitiesMatch,
+    Bool.and_eq_true] at rootMatch
+  exact CodeTrace.tailCallPosition_of_capabilities_match
+    checked.artifact.trace.positions checked.artifact.program.declarations
+      functionTrace.generated.signature signatureAt
+      (descendant.callCapabilitiesMatch checked.artifact.trace.positions
+        checked.artifact.program.declarations
+        functionTrace.generated.signature rootMatch.2)
+
+/-- Recover result ownership agreement at an addressed tail call. -/
+theorem tailCallResult (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Address} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {generated : Block}
+    (signatureAt : targetSignature? checked.artifact.program.declarations
+      address = some signature)
+    (descendant : functionTrace.root.Descendant
+      (.tailCall source block input entryValueCount address arguments generated)) :
+    signature.result = functionTrace.generated.signature.result := by
+  have rootMatch := checked.functionCallCapabilitiesMatch member
+  simp only [FunctionTrace.callCapabilitiesMatch,
+    Bool.and_eq_true] at rootMatch
+  exact CodeTrace.tailCallResult_of_capabilities_match
+    checked.artifact.trace.positions checked.artifact.program.declarations
+      functionTrace.generated.signature signatureAt
+      (descendant.callCapabilitiesMatch checked.artifact.trace.positions
+        checked.artifact.program.declarations
+        functionTrace.generated.signature rootMatch.2)
+
+/-- Recover a self tail call's exact all-local-owner transfer. -/
+theorem tailCallSelfPosition (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {arguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf source block input entryValueCount arguments generated)) :
+    ∃ position, position ∈ checked.artifact.trace.positions ∧
+      position.tailCallMatches source block input
+        functionTrace.generated.signature arguments = true := by
+  have rootMatch := checked.functionCallCapabilitiesMatch member
+  simp only [FunctionTrace.callCapabilitiesMatch,
+    Bool.and_eq_true] at rootMatch
+  exact CodeTrace.tailCallSelfPosition_of_capabilities_match
+    checked.artifact.trace.positions checked.artifact.program.declarations
+      functionTrace.generated.signature
+      (descendant.callCapabilitiesMatch checked.artifact.trace.positions
+        checked.artifact.program.declarations
+        functionTrace.generated.signature rootMatch.2)
+
+/-- Recover the exact result-owner transfer at a retained return. -/
+theorem returnPositionMatch (checked : Checked)
+    {functionTrace : FunctionTrace}
+    (member : functionTrace ∈ checked.artifact.trace.functions)
+    {source : SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {atom : IxIR1.Atom} {target : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret source block input entryValueCount atom target generated))
+    {position : PositionTrace}
+    (positionMember : position ∈ checked.artifact.trace.positions)
+    (coordinate : position.coordinateMatches source block .terminator input =
+      true) :
+    position.returnMatches source block input
+      functionTrace.generated.signature.result atom = true := by
+  have rootMatch := checked.functionCallCapabilitiesMatch member
+  simp only [FunctionTrace.callCapabilitiesMatch,
+    Bool.and_eq_true] at rootMatch
+  exact CodeTrace.returnPositionMatch_of_capabilities_match
+    checked.artifact.trace.positions checked.artifact.program.declarations
+      functionTrace.generated.signature
+      (descendant.callCapabilitiesMatch checked.artifact.trace.positions
+        checked.artifact.program.declarations
+        functionTrace.generated.signature rootMatch.2)
+      positionMember coordinate
+
+end Checked
+
+private def sourceDeclAt?
+    (declarations : List (Address × IxIR1.Decl)) (address : Address) :
+    Option IxIR1.Decl :=
+  (declarations.find? fun entry => entry.1 == address).map (fun entry => entry.2)
+
+private def duplicateAddress? :
+    List (Address × IxIR1.Decl) → Option Address
+  | [] => none
+  | (address, _) :: rest =>
+      if rest.any fun entry => entry.1 == address then some address
+      else duplicateAddress? rest
+
+private def signatureOf (context : Context) (owner : Validate.Owner)
+    (address : Address) (definition : IxIR1.FnDef) : Except Error Signature := do
+  let worlds ← match context.parameterWorlds address with
+    | some worlds => pure worlds
+    | none => .error (.missingParameterWorlds address)
+  if worlds.size != definition.arity then
+    .error (.signature owner "parameter-world arity does not match IxIR₁")
+  else
+    let parameters := worlds.map fun world =>
+      ({ world, passing := .owned } : Param)
+    let signature : Signature :=
+      { params := parameters
+        result := definition.result
+        papSafe := definition.papSafe }
+    if signature.papSafe &&
+        !(signature.result == .shared &&
+          signature.params.all fun parameter => parameter.world == .shared) then
+      .error (.signature owner "IxIR₁ papSafe declaration is not all-shared")
+    else
+      return signature
+
+private def declarationSignature (context : Context)
+    (declarations : List (Address × IxIR1.Decl)) (site : SourceSite)
+    (address : Address) : Except Error Signature := do
+  match sourceDeclAt? declarations address with
+  | some (.fn definition) =>
+      signatureOf context (.declaration address) address definition
+  | some (.extern _) =>
+      .error (.source site "compiler call expected a function declaration")
+  | none => .error (.source site "call target is not declared")
+
+structure Binding where
+  atom : Atom
+  cap : BindingCap
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+abbrev SourceEnv := Array Binding
+
+/-- Runtime operand retained for a live compiler binding. -/
+def Binding.inputAtom (binding : Binding) : Option Atom :=
+  match binding.cap with
+  | .dead => none
+  | _ => some binding.atom
+
+def SourceEnv.inputMap (env : SourceEnv) : Array (Option Atom) :=
+  env.map Binding.inputAtom
+
+structure Local where
+  env : SourceEnv
+  valueParams : Array ValueCap
+  instructions : Array Instr := #[]
+  nextValue : Nat
+
+def Local.inputMap (cursor : Local) : Array (Option Atom) :=
+  cursor.env.inputMap
+
+private def sourceAtom (site : SourceSite) (env : SourceEnv) :
+    IxIR1.Atom → Except Error (Atom × BindingCap)
+  | .lit literal => return (.lit literal, .scalar)
+  | .erased => return (.erased, .scalar)
+  | .var index =>
+      match env[index]? with
+      | none => .error (.source site s!"unbound IxIR₁ variable {index}")
+      | some { cap := .dead, .. } =>
+          .error (.ownership site s!"IxIR₁ variable {index} was already consumed")
+      | some binding => return (binding.atom, binding.cap)
+
+private def setDead (site : SourceSite) (env : SourceEnv) (index : Nat) :
+    Except Error SourceEnv :=
+  match env[index]? with
+  | none => .error (.source site s!"unbound IxIR₁ variable {index}")
+  | some binding =>
+      let consumed := env.setIfInBounds index { binding with cap := .dead }
+      match binding.atom with
+      | .reg lender =>
+          return consumed.map fun candidate =>
+            { candidate with
+              cap := candidate.cap.retireLender lender }
+      | .lit _ | .erased => return consumed
+
+private def consumeExpected (site : SourceSite) (expected : Owned)
+    (env : SourceEnv) (source : IxIR1.Atom) :
+    Except Error (SourceEnv × Atom) := do
+  let (atom, capability) ← sourceAtom site env source
+  match source, capability with
+  | .lit _, .scalar | .erased, .scalar => return (env, atom)
+  | .var _, .scalar => return (env, atom)
+  | .var index, .owned world =>
+      if world == expected then return (← setDead site env index, atom)
+      else .error (.ownership site "operand has the wrong ownership world")
+  | .var _, .borrowed .. =>
+      .error (.ownership site "a borrowed value cannot cross an owned boundary")
+  | _, .dead =>
+      .error (.internal "dead source binding escaped sourceAtom")
+  | _, _ => .error (.ownership site "invalid scalar capability")
+
+private def consumeConcrete (site : SourceSite) (expected : Owned)
+    (env : SourceEnv) (source : IxIR1.Atom) :
+    Except Error (SourceEnv × ValueId) := do
+  let (atom, capability) ← sourceAtom site env source
+  match source, atom, capability with
+  | .var index, .reg id, .owned world =>
+      if world == expected then return (← setDead site env index, id)
+      else .error (.ownership site "constructor operand has the wrong world")
+  | .var _, _, .scalar =>
+      .error (.ownership site "a concrete constructor location was required")
+  | .var _, _, .borrowed .. =>
+      .error (.ownership site "a borrowed constructor cannot be consumed")
+  | _, _, _ =>
+      .error (.ownership site "a concrete constructor register was required")
+
+private def observeExpected (site : SourceSite) (expected : Owned)
+    (env : SourceEnv) (source : IxIR1.Atom) : Except Error Atom := do
+  let (atom, capability) ← sourceAtom site env source
+  match capability with
+  | .scalar => return atom
+  | .owned world | .borrowed world _ =>
+      if world == expected then return atom
+      else .error (.ownership site "observed operand has the wrong world")
+  | .dead => .error (.internal "dead source binding escaped sourceAtom")
+
+private def requireScalar (site : SourceSite) (env : SourceEnv)
+    (source : IxIR1.Atom) : Except Error Atom := do
+  let (atom, capability) ← sourceAtom site env source
+  match capability with
+  | .scalar => return atom
+  | _ => .error (.ownership site "extern operands must be statically scalar")
+
+private def consumeArguments (site : SourceSite) (env : SourceEnv)
+    (arguments : Array IxIR1.Atom) (worlds : Array Owned) :
+    Except Error (SourceEnv × Array Atom) := do
+  if arguments.size != worlds.size then
+    .error (.source site "operand count does not match its ownership signature")
+  else
+    let (env, reversed) ←
+      (arguments.toList.zip worlds.toList).foldlM (fun state pair => do
+        let (env, atom) ← consumeExpected site pair.2 state.1 pair.1
+        return (env, atom :: state.2)) (env, [])
+    return (env, reversed.reverse.toArray)
+
+private def consumeSharedArguments (site : SourceSite) (env : SourceEnv)
+    (arguments : Array IxIR1.Atom) : Except Error (SourceEnv × Array Atom) :=
+  consumeArguments site env arguments (Array.replicate arguments.size .shared)
+
+private def bindResult (cursor : Local) (instruction : Instr)
+    (capability : BindingCap) : Local :=
+  { cursor with
+    env := #[{ atom := .reg cursor.nextValue, cap := capability }] ++ cursor.env
+    instructions := cursor.instructions.push instruction
+    nextValue := cursor.nextValue + 1 }
+
+private def bindEffect (cursor : Local) (instruction : Instr) : Local :=
+  { cursor with
+    env := #[{ atom := .erased, cap := .scalar }] ++ cursor.env
+    instructions := cursor.instructions.push instruction }
+
+private structure EdgeView where
+  params : Array ValueCap
+  sourceInputMap : Array (Option Atom)
+  childEnv : SourceEnv
+
+private def EdgeView.arguments (view : EdgeView) : Array Atom :=
+  EdgeTrace.explicitValuesOf view.sourceInputMap
+
+private def ownerParameter? (env : SourceEnv) (lender : ValueId) : Option Nat :=
+  (List.range env.size).find? fun index =>
+    match env[index]? with
+    | some { atom := .reg id, cap := .owned _ } => id == lender
+    | _ => false
+
+private def edgeView (site : SourceSite) (env : SourceEnv) :
+    Except Error EdgeView := do
+  let rec go (index : Nat) (params : Array ValueCap)
+      (child : SourceEnv) : Except Error EdgeView :=
+    if h : index < env.size then
+      let binding := env[index]
+      match binding.cap with
+      | .dead =>
+          go (index + 1) (params.push .scalar)
+            (child.push { atom := .reg index, cap := .dead })
+      | .scalar =>
+          go (index + 1) (params.push .scalar)
+            (child.push { atom := .reg index, cap := .scalar })
+      | .owned world =>
+          go (index + 1) (params.push (.owned world))
+            (child.push { atom := .reg index, cap := .owned world })
+      | .borrowed world .caller =>
+          go (index + 1) (params.push (.borrowed world .caller))
+            (child.push { atom := .reg index, cap := .borrowed world .caller })
+      | .borrowed world (.value lender) =>
+          match ownerParameter? env lender with
+          | none =>
+              .error (.ownership site "edge borrow has no transferred lender")
+          | some targetLender =>
+              go (index + 1)
+                (params.push (.borrowed world (.value targetLender)))
+                (child.push
+                  { atom := .reg index
+                    cap := .borrowed world (.value targetLender) })
+    else
+      return { params, sourceInputMap := env.inputMap, childEnv := child }
+  go 0 #[] #[]
+
+private def shiftLender (amount : Nat) : BorrowLender → BorrowLender
+  | .caller => .caller
+  | .value id => .value (id + amount)
+
+private def shiftBinding (amount : Nat) (binding : Binding) : Binding :=
+  { atom := shiftAtom amount binding.atom
+    cap := match binding.cap with
+      | .borrowed world lender => .borrowed world (shiftLender amount lender)
+      | capability => capability }
+
+structure BuildState where
+  blocks : Array (Option Block) := #[]
+  scalarLeaves : List Validate.ScalarLeafFact := []
+  positions : List PositionTrace := []
+  edges : List EdgeTrace := []
+
+abbrev BuildM := EStateM Error BuildState
+
+private def reserveBlock : BuildM BlockId := do
+  let state ← get
+  let id := state.blocks.size
+  set { state with blocks := state.blocks.push none }
+  return id
+
+private def installBlock (id : BlockId) (block : Block) : BuildM Unit := do
+  let state ← get
+  match state.blocks[id]? with
+  | some none => set { state with blocks := state.blocks.setIfInBounds id (some block) }
+  | some (some _) => throw (.internal s!"block {id} was installed twice")
+  | none => throw (.internal s!"block {id} was never reserved")
+
+private def recordPosition (source : SourceSite) (block : BlockId)
+    (target : TargetPosition) (env : SourceEnv) : BuildM Unit :=
+  modify fun state =>
+    { state with
+      positions :=
+        { source, block, target
+          sourceCapabilities := env.map (·.cap) } :: state.positions }
+
+private def recordEdge (source : SourceSite) (sourceBlock target : BlockId)
+    (view : EdgeView) (implicitScalars : Nat := 0) : BuildM EdgeTrace := do
+  let trace : EdgeTrace :=
+    { source
+      sourceBlock
+      target
+      sourceInputMap := view.sourceInputMap
+      targetParams := view.params
+      implicitScalars }
+  modify fun state => { state with edges := trace :: state.edges }
+  return trace
+
+private def recordScalarLeaf (owner : Validate.Owner) (block : BlockId)
+    (value : ValueId) (cid : CtorId) : BuildM Unit :=
+  modify fun state =>
+    { state with scalarLeaves := { owner, block, value, cid } :: state.scalarLeaves }
+
+private def lookupSchema (context : Context) (site : SourceSite)
+    (world : Owned) (cid : CtorId) : BuildM CtorSchema :=
+  match context.schemas world cid with
+  | some schema => return schema
+  | none => throw (.schema site "missing constructor schema")
+
+private def liftExcept : Except Error α → BuildM α
+  | .ok value => return value
+  | .error error => throw error
+
+private def lowerInstruction (context : Context)
+    (declarations : List (Address × IxIR1.Decl)) (signature : Signature)
+    (block : BlockId) (site : SourceSite) (cursor : Local)
+    (operation : IxIR1.Op) : BuildM Local := do
+  match operation with
+  | .pure source =>
+      let (atom, capability) ← liftExcept (sourceAtom site cursor.env source)
+      let env ← match source, capability with
+        | .var index, .owned _ => liftExcept (setDead site cursor.env index)
+        | _, _ => pure cursor.env
+      return (bindResult { cursor with env } (.move atom) capability)
+  | .alloc world cid arguments =>
+      let schema ← lookupSchema context site world cid
+      let (env, atoms) ← liftExcept
+        (consumeArguments site cursor.env arguments schema.fields)
+      return bindResult { cursor with env } (.alloc world cid atoms) (.owned world)
+  | .reuse .. =>
+      throw (.unsupported site "raw IxIR₁ reuse is outside the baseline subset")
+  | .free target =>
+      let cid ← match context.scalarFreeCtor site with
+        | some cid => pure cid
+        | none => throw (.schema site "missing checked scalar-leaf free fact")
+      let _ ← lookupSchema context site .unique cid
+      let (env, value) ← liftExcept
+        (consumeConcrete site .unique cursor.env target)
+      recordScalarLeaf site.owner block value cid
+      return bindEffect { cursor with env } (.freeUnique (.reg value) cid)
+  | .dup target =>
+      let (atom, capability) ← liftExcept (sourceAtom site cursor.env target)
+      match capability with
+      | .scalar =>
+          return bindResult cursor (.retainShared atom) .scalar
+      | .owned .shared | .borrowed .shared _ =>
+          return bindResult cursor (.retainShared atom) (.owned .shared)
+      | .owned .unique | .borrowed .unique _ =>
+          throw (.ownership site "IxIR₁ dup requires a shared operand")
+      | .dead => throw (.internal "dead source binding escaped sourceAtom")
+  | .drop target =>
+      let (env, atom) ← liftExcept
+        (consumeExpected site .shared cursor.env target)
+      return bindEffect { cursor with env } (.releaseShared atom)
+  | .dropU target =>
+      let (env, atom) ← liftExcept
+        (consumeExpected site .unique cursor.env target)
+      return bindEffect { cursor with env } (.dropUnique atom)
+  | .fetch target field =>
+      let cid ← match context.fetchCtor site with
+        | some cid => pure cid
+        | none => throw (.schema site "missing exact fetch constructor")
+      let (atom, capability) ← liftExcept (sourceAtom site cursor.env target)
+      let (world, lender) ← match capability, atom with
+        | .owned world, .reg id => pure (world, BorrowLender.value id)
+        | .borrowed world lender, _ => pure (world, lender)
+        | .scalar, _ => throw (.ownership site "fetch requires a constructor")
+        | .owned _, _ => throw (.internal "owned source binding is not a register")
+        | .dead, _ => throw (.internal "dead source binding escaped sourceAtom")
+      let schema ← lookupSchema context site world cid
+      let fieldWorld ← match schema.fields[field]? with
+        | some fieldWorld => pure fieldWorld
+        | none => throw (.schema site s!"constructor field {field} is out of bounds")
+      return bindResult cursor (.fetch atom cid field) (.borrowed fieldWorld lender)
+  | .call address arguments =>
+      let callee ← liftExcept
+        (declarationSignature context declarations site address)
+      let worlds := callee.params.map (fun parameter => parameter.world)
+      let (env, atoms) ← liftExcept
+        (consumeArguments site cursor.env arguments worlds)
+      return bindResult { cursor with env } (.call address atoms)
+        (.owned callee.result)
+  | .callSelf arguments =>
+      let worlds := signature.params.map (fun parameter => parameter.world)
+      let (env, atoms) ← liftExcept
+        (consumeArguments site cursor.env arguments worlds)
+      return bindResult { cursor with env } (.callSelf atoms)
+        (.owned signature.result)
+  | .papp address arguments =>
+      match sourceDeclAt? declarations address with
+      | none => throw (.source site "partial-application target is not declared")
+      | some (.extern arity) =>
+          if !context.allowExtern then
+            throw (.unsupported site "extern partial applications are disabled")
+          else if arguments.size >= arity then
+            throw (.source site "partial application is not under-saturated")
+          else
+            let atoms ← arguments.toList.mapM fun argument =>
+              liftExcept (requireScalar site cursor.env argument)
+            return bindResult cursor (.papp address atoms.toArray) (.owned .shared)
+      | some (.fn _) =>
+          let callee ← liftExcept
+            (declarationSignature context declarations site address)
+          if !callee.papSafe || arguments.size >= callee.params.size then
+            throw (.source site "partial application target is not safely under-saturated")
+          else
+            let worlds := (callee.params.extract 0 arguments.size).map
+              (fun parameter => parameter.world)
+            let (env, atoms) ← liftExcept
+              (consumeArguments site cursor.env arguments worlds)
+            return bindResult { cursor with env } (.papp address atoms)
+              (.owned .shared)
+  | .apply function arguments =>
+      let (env, function) ← liftExcept
+        (consumeExpected site .shared cursor.env function)
+      let (env, atoms) ← liftExcept
+        (consumeSharedArguments site env arguments)
+      return bindResult { cursor with env } (.apply function atoms)
+        (.owned .shared)
+  | .extern address arguments =>
+      if !context.allowExtern then
+        throw (.unsupported site "extern instructions are disabled")
+      else
+        match sourceDeclAt? declarations address with
+        | some (.extern arity) =>
+            if arguments.size != arity then
+              throw (.source site "extern arity mismatch")
+            else
+              let atoms ← arguments.toList.mapM fun argument =>
+                liftExcept (requireScalar site cursor.env argument)
+              return bindResult cursor (.extern address atoms.toArray) .scalar
+        | _ => throw (.source site "extern target is not an extern declaration")
+
+private def initialEnv (signature : Signature) : SourceEnv :=
+  let size := signature.params.size
+  (List.range size).foldl (fun env sourceIndex =>
+    let targetIndex := size - 1 - sourceIndex
+    match signature.params[targetIndex]? with
+    | some parameter =>
+        env.push
+          { atom := .reg targetIndex
+            cap := match parameter.passing with
+              | .owned => .owned parameter.world
+              | .borrowed => .borrowed parameter.world .caller }
+    | none => env) #[]
+
+private def duplicateAltTag? : List IxIR1.Alt → Option Nat
+  | [] => none
+  | .mk tag _ _ :: rest =>
+      if rest.any fun
+          | .mk other _ _ => other == tag then some tag
+      else duplicateAltTag? rest
+
+private def finishBlocks (state : BuildState) : Except Error (Array Block) :=
+  state.blocks.toList.mapM (fun (candidate : Option Block) =>
+    match candidate with
+    | some block => (Except.ok block : Except Error Block)
+    | none => Except.error (Error.internal "reserved block was not installed"))
+    |>.map List.toArray
+
+/-- Fuel-bounded recursive block compiler. Exposing this worker and its state
+is the proof seam for induction over the exact instruction/block generation
+run retained by `CheckedRun`; production callers continue through `lower`. -/
+def compileCode (context : Context)
+    (declarations : List (Address × IxIR1.Decl)) (signature : Signature)
+    (fuel : Nat) (block : BlockId) (site : SourceSite)
+    (cursor : Local) (code : IxIR1.Code) : BuildM CodeTrace := do
+    match fuel with
+    | 0 => throw (.resources site)
+    | fuel + 1 =>
+      match code with
+      | .ret source =>
+          let (env, atom) ← liftExcept
+            (consumeExpected site signature.result cursor.env source)
+          recordPosition site block .terminator cursor.env
+          let generated : Block :=
+            { valueParams := cursor.valueParams
+              creditParams := #[]
+              instructions := cursor.instructions
+              terminator := .ret atom }
+          installBlock block generated
+          let _ := env
+          return .ret site block cursor.inputMap cursor.nextValue source atom
+            generated
+      | .letOp (.call address arguments) (.ret (.var 0)) =>
+          match sourceDeclAt? declarations address with
+          | some (.fn _) =>
+              let callee ← liftExcept
+                (declarationSignature context declarations site address)
+              if callee.result == signature.result then
+                let worlds := callee.params.map (fun parameter => parameter.world)
+                let (tailEnv, atoms) ← liftExcept
+                  (consumeArguments site cursor.env arguments worlds)
+                recordPosition site block .terminator cursor.env
+                let resultEnv : SourceEnv :=
+                  #[{ atom := .erased, cap := .owned callee.result }] ++ tailEnv
+                recordPosition site.next block .terminator resultEnv
+                let generated : Block :=
+                  { valueParams := cursor.valueParams
+                    creditParams := #[]
+                    instructions := cursor.instructions
+                    terminator := .tailCall address atoms }
+                installBlock block generated
+                return .tailCall site block cursor.inputMap cursor.nextValue
+                  address arguments generated
+              else
+                let inputMap := cursor.inputMap
+                let positionEnv := cursor.env
+                let entryValueCount := cursor.nextValue
+                let index := cursor.instructions.size
+                let cursor ← lowerInstruction context declarations signature block
+                  site cursor (.call address arguments)
+                let targetInstruction ← match cursor.instructions[index]? with
+                  | some instruction => pure instruction
+                  | none => throw (.internal
+                      "lowered call was not appended at its trace index")
+                recordPosition site block (.instruction index) positionEnv
+                let next ← compileCode context declarations signature fuel block
+                  site.next cursor (.ret (.var 0))
+                return .letOp site block inputMap cursor.inputMap
+                  entryValueCount (.call address arguments) index
+                    targetInstruction next
+          | _ =>
+              let inputMap := cursor.inputMap
+              let positionEnv := cursor.env
+              let entryValueCount := cursor.nextValue
+              let index := cursor.instructions.size
+              let cursor ← lowerInstruction context declarations signature block
+                site cursor (.call address arguments)
+              let targetInstruction ← match cursor.instructions[index]? with
+                | some instruction => pure instruction
+                | none => throw (.internal
+                    "lowered call was not appended at its trace index")
+              recordPosition site block (.instruction index) positionEnv
+              let next ← compileCode context declarations signature fuel block
+                site.next cursor (.ret (.var 0))
+              return .letOp site block inputMap cursor.inputMap entryValueCount
+                (.call address arguments) index targetInstruction next
+      | .letOp (.callSelf arguments) (.ret (.var 0)) =>
+          let worlds := signature.params.map (fun parameter => parameter.world)
+          let (tailEnv, atoms) ← liftExcept
+            (consumeArguments site cursor.env arguments worlds)
+          recordPosition site block .terminator cursor.env
+          let resultEnv : SourceEnv :=
+            #[{ atom := .erased, cap := .owned signature.result }] ++ tailEnv
+          recordPosition site.next block .terminator resultEnv
+          let generated : Block :=
+            { valueParams := cursor.valueParams
+              creditParams := #[]
+              instructions := cursor.instructions
+              terminator := .tailCallSelf atoms }
+          installBlock block generated
+          return .tailCallSelf site block cursor.inputMap cursor.nextValue
+            arguments generated
+      | .letOp operation rest =>
+          let inputMap := cursor.inputMap
+          let positionEnv := cursor.env
+          let entryValueCount := cursor.nextValue
+          let index := cursor.instructions.size
+          let cursor ← lowerInstruction context declarations signature block
+            site cursor operation
+          let targetInstruction ← match cursor.instructions[index]? with
+            | some instruction => pure instruction
+            | none => throw (.internal
+                "lowered instruction was not appended at its trace index")
+          recordPosition site block (.instruction index) positionEnv
+          let next ← compileCode context declarations signature fuel block
+            site.next cursor rest
+          return .letOp site block inputMap cursor.inputMap entryValueCount
+            operation index targetInstruction next
+      | .case scrutinee peelNat alternatives =>
+          if let some tag := duplicateAltTag? alternatives.toList then
+            throw (.source site s!"duplicate IxIR₁ case tag {tag}")
+          let (_, scrutineeCap) ← liftExcept
+            (sourceAtom site cursor.env scrutinee)
+          let world ← match scrutineeCap with
+            | .owned world | .borrowed world _ => pure world
+            | .scalar => pure .shared
+            | .dead => throw (.internal "dead source binding escaped sourceAtom")
+          let view ← liftExcept (edgeView site cursor.env)
+          let mut constructorTargets : Array CtorAlt := #[]
+          let mut outgoing : Array EdgeTrace := #[]
+          let mut children : Array CodeTrace := #[]
+          for pair in alternatives.toList.zipIdx do
+            let (.mk tag fieldCount altBody, altIndex) := pair
+            let caseCtors := context.caseCtors site altIndex
+            if caseCtors.isEmpty then
+              if peelNat then pure ()
+              else throw (.schema site
+                "non-Nat case alternative lacks a constructor identity")
+            for cid in caseCtors do
+                if cid.cidx != tag then
+                  throw (.schema site "case constructor tag does not match IxIR₁")
+                let schema ← lookupSchema context site world cid
+                if schema.fields.size != fieldCount then
+                  throw (.schema site "case field count does not match constructor schema")
+                let child ← reserveBlock
+                let childSite := site.alternative altIndex
+                let (scrutinee, scrutineeCapability) ← liftExcept
+                  (sourceAtom childSite view.childEnv scrutinee)
+                let lender ← match scrutineeCapability, scrutinee with
+                  | .owned _, .reg id => pure (BorrowLender.value id)
+                  | .borrowed _ lender, _ => pure lender
+                  | _, _ => throw (.ownership childSite "constructor arm lost its scrutinee")
+                let mut childLocal : Local :=
+                  { env := view.childEnv
+                    valueParams := view.params
+                    nextValue := view.params.size }
+                let mut fields : SourceEnv := #[]
+                for field in List.range fieldCount do
+                  let fieldWorld := schema.fields[field]!
+                  let resultId := childLocal.nextValue
+                  childLocal :=
+                    { childLocal with
+                      instructions := childLocal.instructions.push
+                        (.fetch scrutinee cid field)
+                      nextValue := resultId + 1 }
+                  fields := fields.push
+                    { atom := .reg resultId
+                      cap := .borrowed fieldWorld lender }
+                childLocal :=
+                  { childLocal with env := fields.reverse ++ childLocal.env }
+                let edge ← recordEdge site block child view
+                let childTrace ← compileCode context declarations signature fuel child
+                  childSite childLocal altBody
+                outgoing := outgoing.push edge
+                children := children.push childTrace
+                constructorTargets := constructorTargets.push
+                  { cid, edge := { target := child, values := view.arguments, credits := #[] } }
+          let natPeel ← if peelNat then do
+            let zero ← match sourceAlternativeAtTag? alternatives 0 with
+              | some (.mk _ 0 body, index) => pure (body, index)
+              | _ => throw (.source site "Nat peel requires a nullary zero arm")
+            let succ ← match sourceAlternativeAtTag? alternatives 1 with
+              | some (.mk _ 1 body, index) => pure (body, index)
+              | _ => throw (.source site "Nat peel requires a unary successor arm")
+            let zeroBlock ← reserveBlock
+            let zeroSite := site.alternative zero.2
+            let zeroEdge ← recordEdge site block zeroBlock view
+            let zeroTrace ← compileCode context declarations signature fuel
+              zeroBlock zeroSite
+              { env := view.childEnv
+                valueParams := view.params
+                nextValue := view.params.size } zero.1
+            outgoing := outgoing.push zeroEdge
+            children := children.push zeroTrace
+            let succBlock ← reserveBlock
+            let succSite := site.alternative succ.2
+            let shifted := view.childEnv.map (shiftBinding 1)
+            let succEnv :=
+              #[{ atom := .reg 0, cap := .scalar }] ++ shifted
+            let succParams := #[.scalar] ++ view.params
+            let succEdge ← recordEdge site block succBlock
+              { view with params := succParams } 1
+            let succTrace ← compileCode context declarations signature fuel
+              succBlock succSite
+              { env := succEnv
+                valueParams := succParams
+                nextValue := succParams.size } succ.1
+            outgoing := outgoing.push succEdge
+            children := children.push succTrace
+            pure (some
+              { zero := { target := zeroBlock, values := view.arguments, credits := #[] }
+                succ := { target := succBlock, values := view.arguments, credits := #[] } })
+          else
+            pure none
+          if constructorTargets.isEmpty && natPeel.isNone then
+            throw (.source site "case has no translated alternatives")
+          let (targetScrutinee, _) ←
+            liftExcept (sourceAtom site cursor.env scrutinee)
+          recordPosition site block .terminator cursor.env
+          let generated : Block :=
+            { valueParams := cursor.valueParams
+              creditParams := #[]
+              instructions := cursor.instructions
+              terminator :=
+                .switchValue targetScrutinee constructorTargets natPeel }
+          installBlock block generated
+          return .switchValue site block cursor.inputMap cursor.nextValue
+            scrutinee peelNat alternatives targetScrutinee generated
+              outgoing.toList children.toList
+termination_by fuel
+
+private def compileFunction (context : Context)
+    (declarations : List (Address × IxIR1.Decl)) (owner : Validate.Owner)
+    (signature : Signature) (source : IxIR1.FnDef) :
+    Except Error (Function × List Validate.ScalarLeafFact × Trace) :=
+  let action : BuildM CodeTrace := do
+    let entry ← reserveBlock
+    if entry != 0 then throw (.internal "function entry block is not zero")
+    let params := signature.params.map fun parameter =>
+      match parameter.passing with
+      | .owned => .owned parameter.world
+      | .borrowed => .borrowed parameter.world .caller
+    compileCode context declarations signature context.maxDepth entry { owner }
+      { env := initialEnv signature
+        valueParams := params
+        nextValue := params.size } source.body
+  match action.run {} with
+  | .error error _ => .error error
+  | .ok root state => do
+      let blocks ← finishBlocks state
+      let generated : Function := ⟨signature, blocks⟩
+      let expectedBlocks : List (BlockId × Block) :=
+        blocks.toList.zipIdx.map fun pair => (pair.2, pair.1)
+      if sourceCoherent : functionSourceMatches source generated root then
+        if coherent : root.blocks == expectedBlocks then
+          have blockOrder : root.blocks = expectedBlocks :=
+            beq_iff_eq.mp coherent
+          if instructionCoherent : root.instructionsMatch then
+            if inputMapsCoherent : root.inputMapsMatch then
+              if entryValueCountsCoherent : root.entryValueCountsMatch then
+                if syntaxCoherent : root.syntaxMatches then
+                  if switchCoherent : root.switchBranchesMatch then
+                    if rootSourceCoherent :
+                        root.source == ({ owner := owner } : SourceSite) then
+                      let functionTrace : FunctionTrace :=
+                        { owner, source, generated, root
+                          rootSource := beq_iff_eq.mp rootSourceCoherent
+                          sourceOrder := functionSourceMatch_of_match sourceCoherent
+                          instructionOrder := instructionCoherent
+                          inputMapOrder := inputMapsCoherent
+                          entryValueCountOrder := entryValueCountsCoherent
+                          syntaxOrder := syntaxCoherent
+                          switchBranchOrder := switchCoherent
+                          blockOrder := by
+                            simpa [generated, expectedBlocks] using blockOrder }
+                      let trace : Trace :=
+                        { positions := state.positions.reverse
+                          edges := state.edges.reverse
+                          functions := [functionTrace] }
+                      return (generated, state.scalarLeaves.reverse, trace)
+                    else
+                      throw (.internal
+                        "recursive trace root has the wrong source coordinate")
+                  else
+                    throw (.internal
+                      "recursive trace switch branches do not match generated edges")
+                else
+                  throw (.internal
+                    "recursive trace source and target syntax do not match")
+              else
+                throw (.internal
+                  "recursive trace block-entry value counts do not match block parameters")
+            else
+              throw (.internal
+                "recursive trace source maps retarget a retained slot")
+          else
+            throw (.internal
+              "recursive trace instruction coordinates do not match its blocks")
+        else
+          throw (.internal "recursive trace does not match installed block order")
+      else
+        throw (.internal
+          "recursive trace does not match its retained source function")
+
+private def appendTrace (left right : Trace) : Trace :=
+  { positions := left.positions ++ right.positions
+    edges := left.edges ++ right.edges
+    functions := left.functions ++ right.functions }
+
+/-- Syntax-directed baseline lowering. This constructs all validator sidecars
+that depend on target block/register identities, but does not hide validation;
+use `lowerChecked` at an artifact boundary. -/
+def lower (context : Context) (input : Input) : Except Error Artifact := do
+  let _ ← match duplicateAddress? input.declarations with
+    | some address => Except.error (.duplicateDeclaration address)
+    | none => Except.ok ()
+  let mut declarations : List (Address × Decl) := []
+  let mut scalarLeaves : List Validate.ScalarLeafFact := []
+  let mut trace : Trace := {}
+  for entry in input.declarations do
+    match entry.2 with
+    | .extern arity =>
+        declarations := declarations ++ [(entry.1, .extern arity)]
+    | .fn definition =>
+        let owner := Validate.Owner.declaration entry.1
+        let signature ← signatureOf context owner entry.1 definition
+        let (lowered, leaves, functionTrace) ←
+          compileFunction context input.declarations owner signature definition
+        declarations := declarations ++ [(entry.1, .fn lowered)]
+        scalarLeaves := scalarLeaves ++ leaves
+        trace := appendTrace trace functionTrace
+  let mainSignature : Signature :=
+    { params := #[], result := input.mainResult, papSafe := false }
+  let mainSource := input.mainDefinition
+  let (main, mainLeaves, mainTrace) ←
+    compileFunction context input.declarations .main mainSignature mainSource
+  let mainTraceWitness : { trace // trace ∈ mainTrace.functions } ←
+    match membersEq : mainTrace.functions with
+    | [functionTrace] =>
+        pure ⟨functionTrace, by simp [membersEq]⟩
+    | _ => throw (.internal
+        "main compiler run did not retain exactly one function trace")
+  let mainFunctionTrace := mainTraceWitness.1
+  let validationContext : Validate.Context :=
+    { schemas := context.schemas
+      scalarLeaves := scalarLeaves ++ mainLeaves
+      allowExtern := context.allowExtern }
+  let program : Program := { declarations, main }
+  let fullTrace := appendTrace trace mainTrace
+  if mainCoherent : functionTraceMatches mainFunctionTrace .main
+      input.mainDefinition program.main then
+    if functionsCoherent : programTraceMatches input.declarations
+        program.declarations fullTrace.functions input.mainDefinition
+          program.main then
+      let artifact : Artifact :=
+        { source := input
+          program
+          validationContext
+          trace := fullTrace
+          mainTrace := mainFunctionTrace
+          mainTraceMember := by
+            change mainFunctionTrace ∈ trace.functions ++ mainTrace.functions
+            exact List.mem_append_right trace.functions mainTraceWitness.2
+          mainTraceOrder := functionTraceMatch_of_match mainCoherent
+          functionTraceOrder := functionsCoherent }
+      return artifact
+    else
+      throw (.internal
+        "retained function traces do not match lowered declarations")
+  else
+    throw (.internal "retained main trace does not match the lowered artifact")
+
+/-- The validation schema oracle in a successfully lowered artifact is the
+exact oracle supplied to the lowerer. -/
+theorem validationSchemas_of_lower
+    {context : Context} {input : Input} {artifact : Artifact}
+    (produced : lower context input = .ok artifact) :
+    artifact.validationContext.schemas = context.schemas := by
+  unfold lower at produced
+  simp_all [Except.bind, bind, pure]
+  all_goals split at produced <;> try simp_all
+  all_goals split at produced <;> try simp_all
+  all_goals split at produced <;> try simp_all
+  all_goals split at produced <;> try simp_all
+  all_goals simp only [Except.pure] at produced
+  all_goals split at produced <;> try simp_all
+  all_goals split at produced <;> try simp_all
+  all_goals subst artifact
+  all_goals rfl
+
+/-- Proof-facing execution record for checked lowering. The ordinary
+`lowerChecked` API projects the same checked artifact, while simulation can
+retain the exact producer equation without executing the lowerer twice. -/
+structure CheckedRun (context : Context) (input : Input) where
+  checked : Checked
+  produced : lower context input = .ok checked.artifact
+  /-- The checked artifact retains the exact input passed to this run. -/
+  source : checked.artifact.source = input
+
+namespace CheckedRun
+
+/-- The artifact named by the retained producer equation is validator-valid. -/
+theorem valid {context : Context} {input : Input}
+    (run : CheckedRun context input) :
+    Validate.Valid run.checked.artifact.validationContext
+      run.checked.artifact.program :=
+  run.checked.valid
+
+end CheckedRun
+
+/-- Lower and validate once while retaining both exact executable equations. -/
+def lowerCheckedWithTrace (context : Context) (input : Input) :
+    Except Error (CheckedRun context input) :=
+  match produced : lower context input with
+  | .error error => .error error
+  | .ok artifact =>
+      if creditFree : CreditFree.program artifact.program then
+        match accepted : Validate.validate artifact.validationContext
+            artifact.program with
+        | .error error => .error (.validation error)
+        | .ok stats =>
+            if positionsMatched : artifact.trace.positionsMatch then
+              if parameterCapabilitiesMatched :
+                  artifact.trace.parameterCapabilitiesMatch then
+                if pureMatched : artifact.trace.pureCapabilitiesMatch then
+                  if dupMatched : artifact.trace.dupCapabilitiesMatch then
+                    if fetchMatched : artifact.trace.fetchCapabilitiesMatch then
+                      if destructionMatched :
+                          artifact.trace.destructionCapabilitiesMatch then
+                        if schemasMatched : artifact.trace.allocationSchemasMatch
+                            artifact.validationContext.schemas then
+                          if capabilitiesMatched :
+                              artifact.trace.allocationCapabilitiesMatch then
+                            if terminalAllocationsBorrowFree :
+                                artifact.trace.terminalAllocationNoBorrows then
+                              if applyMatched : artifact.trace.applyCapabilitiesMatch then
+                                if sharedPapEntriesMatched :
+                                    artifact.trace.sharedPapEntryCapabilitiesMatch then
+                                  if switchMatched : artifact.trace.switchCapabilitiesMatch
+                                      artifact.validationContext.schemas then
+                                    if callsMatched : artifact.trace.callCapabilitiesMatch
+                                        artifact.program.declarations then
+                                      if sourceMatched : inputEq artifact.source input then
+                                        .ok
+                                          { checked :=
+                                              { artifact, stats, accepted, creditFree
+                                                positionCoordinates := positionsMatched
+                                                parameterCapabilities :=
+                                                  parameterCapabilitiesMatched
+                                                pureCapabilities := pureMatched
+                                                dupCapabilities := dupMatched
+                                                fetchCapabilities := fetchMatched
+                                                destructionCapabilities := destructionMatched
+                                                allocationSchemas := schemasMatched
+                                                allocationCapabilities := capabilitiesMatched
+                                                terminalAllocationNoBorrows :=
+                                                  terminalAllocationsBorrowFree
+                                                applyCapabilities := applyMatched
+                                                sharedPapEntryCapabilities :=
+                                                  sharedPapEntriesMatched
+                                                switchCapabilities := switchMatched
+                                                callCapabilities := callsMatched }
+                                            produced
+                                            source :=
+                                              (inputEq_eq_true_iff _ _).mp sourceMatched }
+                                      else
+                                        .error (.internal
+                                          "lowered artifact retained the wrong source input")
+                                    else
+                                      .error (.internal
+                                        "call/return traces lack exact capability transitions")
+                                  else
+                                    .error (.internal
+                                      "switch traces lack exact capability transitions")
+                                else
+                                  .error (.internal
+                                    "PAP-safe functions lack shared entry capabilities")
+                              else
+                                .error (.internal
+                                  "dynamic-application traces lack exact capability transitions")
+                            else
+                              .error (.internal
+                                "terminal allocations retain borrowed capabilities")
+                          else
+                            .error (.internal
+                              "allocation/PAP traces lack exact capability transitions")
+                        else
+                          .error (.internal
+                            "validator accepted inconsistent allocation schemas")
+                      else
+                        .error (.internal
+                          "destruction traces lack exact capability transitions")
+                    else
+                      .error (.internal
+                        "fetch traces lack producer capability transitions")
+                  else
+                    .error (.internal
+                      "dup traces lack producer capability transitions")
+                else
+                  .error (.internal
+                    "pure traces lack producer capability transitions")
+              else
+                .error (.internal
+                  "source capabilities disagree with inherited block parameters")
+            else
+              .error (.internal
+                "recursive traces lack producer position coordinates")
+      else
+        .error (.internal "baseline lowering emitted a credit operation")
+
+/-- Lower and immediately validate the exact artifact returned to the caller. -/
+def lowerChecked (context : Context) (input : Input) : Except Error Checked := do
+  return (← lowerCheckedWithTrace context input).checked
+
+end Ix.Compiler.IxIR2.Lower
diff --git a/Ix/Compiler/IxIR2/LowerExamples.lean b/Ix/Compiler/IxIR2/LowerExamples.lean
new file mode 100644
index 000000000..78b60e78a
--- /dev/null
+++ b/Ix/Compiler/IxIR2/LowerExamples.lean
@@ -0,0 +1,351 @@
+import Ix.Compiler.IxIR1.Eval
+import Ix.Compiler.IxIR2.Eval
+import Ix.Compiler.IxIR2.Lower
+
+/-!
+# Executable structured-lowering witnesses
+
+These fixtures exercise producer-generated block parameters rather than
+hand-written IxIR₂. They require `lowerChecked`, inspect its CFG/trace, and
+compare successful IxIR₁ execution with logical IxIR₂ execution.
+-/
+
+namespace Ix.Compiler.IxIR2.Lower.Examples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+private def natAddress : Address := Address.replicate 0x71
+private def inspectAddress : Address := Address.replicate 0x72
+private def blockAddress : Address := Address.replicate 0x73
+private def nilLayout : LayoutId := Address.replicate 0x74
+private def consLayout : LayoutId := Address.replicate 0x75
+
+private def nilCtor : CtorId :=
+  { block := blockAddress, indIdx := 0, cidx := 0 }
+
+private def consCtor : CtorId :=
+  { block := blockAddress, indIdx := 0, cidx := 1 }
+
+private def schemas : Owned → CtorId → Option CtorSchema
+  | .shared, cid =>
+      if cid == nilCtor then
+        some { layout := nilLayout, fields := #[] }
+      else if cid == consCtor then
+        some { layout := consLayout, fields := #[.shared] }
+      else
+        none
+  | .unique, cid =>
+      if cid == nilCtor then
+        some { layout := nilLayout, fields := #[] }
+      else
+        none
+
+private def sourceContext (input : Input) : IxIR1.Ctx :=
+  { decls := IxIR1.Env.ofList input.declarations }
+
+private def targetFunction? (artifact : Artifact) (address : Address) :
+    Option Function :=
+  let declaration : Option Decl :=
+    (artifact.program.declarations.find?
+      fun entry => entry.1 == address).map (fun entry => entry.2)
+  match declaration with
+  | some (Decl.fn definition) => some definition
+  | _ => none
+
+private def targetRun (artifact : Artifact) (controlFuel heapFuel : Nat) :=
+  Eval.runMain
+    (Eval.Context.ofProgram artifact.program artifact.validationContext.schemas)
+    .logical artifact.program controlFuel heapFuel
+
+/-! ## Literal-Nat case and tail transfer -/
+
+private def natBody : IxIR1.Code :=
+  .case (.var 0) true #[
+    .mk 0 0
+      (.letOp (.drop (.var 0)) (.ret (.lit (.nat 1)))),
+    .mk 1 1
+      (.letOp (.drop (.var 1)) (.ret (.lit (.nat 0))))]
+
+private def natInput : Input :=
+  { declarations :=
+      [(natAddress,
+        .fn { arity := 1, result := .shared, papSafe := true, body := natBody })]
+    main :=
+      .letOp (.call natAddress #[.lit (.nat 7)]) (.ret (.var 0))
+    mainResult := .shared }
+
+private def natContext : Context :=
+  { parameterWorlds := fun address =>
+      if address == natAddress then some #[.shared] else none
+    schemas }
+
+private def loweredNat := lowerChecked natContext natInput
+
+#guard match loweredNat with
+  | .ok checked =>
+      checked.stats.functions == 2 && checked.stats.blocks == 4 &&
+        checked.stats.edges == 2 && checked.artifact.trace.edges.length == 2 &&
+        functionTraceMatches checked.artifact.mainTrace .main
+          natInput.mainDefinition checked.artifact.program.main &&
+        (match checked.artifact.trace.functions with
+        | [natTrace, mainTrace] =>
+            natTrace.owner == Validate.Owner.declaration natAddress &&
+              mainTrace.owner == Validate.Owner.main &&
+              functionSourceMatches natTrace.source natTrace.generated
+                natTrace.root &&
+              functionSourceMatches mainTrace.source mainTrace.generated
+                mainTrace.root &&
+              natTrace.source.arity == 1 &&
+              natTrace.source.result == .shared &&
+              natTrace.source.papSafe &&
+              mainTrace.source.arity == 0 &&
+              mainTrace.source.result == .shared &&
+              !mainTrace.source.papSafe &&
+              (match natTrace.source.body with
+              | .case (.var 0) true alternatives => alternatives.size == 2
+              | _ => false) &&
+              (match mainTrace.source.body with
+              | .letOp (.call address arguments) (.ret (.var 0)) =>
+                  address == natAddress && arguments == #[.lit (.nat 7)]
+              | _ => false) &&
+              natTrace.root.blocks.length == 3 &&
+              mainTrace.root.blocks.length == 1 &&
+              natTrace.root.switchBranchesMatch &&
+              mainTrace.root.switchBranchesMatch &&
+              match natTrace.root, mainTrace.root with
+              | .switchValue _ 0 inputMap 1 _ _ _ _ generated outgoing children,
+                  .tailCall _ 0 mainMap 0 _ _ mainGenerated =>
+                  inputMap == #[some (.reg 0)] && mainMap.isEmpty &&
+                    outgoing.length == 2 && children.length == 2 &&
+                    natTrace.generated.blocks[0]? == some generated &&
+                    mainTrace.generated.blocks[0]? == some mainGenerated
+              | _, _ => false
+        | _ => false) &&
+        (match checked.artifact.trace.edges with
+        | [zero, succ] =>
+            zero.sourceInputMap == #[some (.reg 0)] &&
+              zero.sourceMap == #[some (.reg 0)] &&
+              zero.explicitValues == #[.reg 0] &&
+              zero.implicitScalars == 0 &&
+              succ.sourceInputMap == #[some (.reg 0)] &&
+              succ.sourceMap == #[some (.reg 0), some (.reg 1)] &&
+              succ.explicitValues == #[.reg 0] &&
+              succ.implicitScalars == 1
+        | _ => false) &&
+        match targetFunction? checked.artifact natAddress with
+        | some definition =>
+            definition.blocks.size == 3 &&
+              match checked.artifact.program.main.blocks[0]? with
+              | some block =>
+                  match block.terminator with
+                  | .tailCall address arguments =>
+                      address == natAddress && arguments == #[.lit (.nat 7)]
+                  | _ => false
+              | _ => false
+        | none => false
+  | .error _ => false
+
+#guard match IxIR1.runMain (sourceContext natInput) natInput.main 20, loweredNat with
+  | .ok source, .ok checked =>
+      match targetRun checked.artifact 4 1 with
+      | .ok target =>
+          source.2 == target.value && target.value == .lit (.nat 0) &&
+            source.1.live == 0 && target.store.live == 0 &&
+            target.controlRemaining == 0 && target.heapRemaining == 0
+      | .error _ => false
+  | _, _ => false
+
+/-! ## Constructor dispatch, fetched field, and explicit join environments -/
+
+private def inspectBody : IxIR1.Code :=
+  .case (.var 0) false #[
+    .mk 0 0
+      (.letOp (.drop (.var 0)) (.ret (.lit (.nat 0)))),
+    .mk 1 1
+      (.letOp (.dup (.var 0))
+        (.letOp (.drop (.var 2)) (.ret (.var 1))))]
+
+private def constructorInput : Input :=
+  { declarations :=
+      [(inspectAddress,
+        .fn
+          { arity := 1
+            result := .shared
+            papSafe := true
+            body := inspectBody })]
+    main :=
+      .letOp (.alloc .shared nilCtor #[])
+        (.letOp (.alloc .shared consCtor #[.var 0])
+          (.letOp (.call inspectAddress #[.var 0]) (.ret (.var 0))))
+    mainResult := .shared }
+
+private def constructorContext : Context :=
+  { parameterWorlds := fun address =>
+      if address == inspectAddress then some #[.shared] else none
+    schemas
+    caseCtors := fun site alternative =>
+      if site.owner == Validate.Owner.declaration inspectAddress &&
+          site.branches.isEmpty && site.offset == 0 then
+        if alternative == 0 then [nilCtor]
+        else if alternative == 1 then [consCtor]
+        else []
+      else
+        [] }
+
+private def loweredConstructor := lowerChecked constructorContext constructorInput
+
+#guard match loweredConstructor with
+  | .ok checked =>
+        checked.stats.blocks == 4 && checked.stats.edges == 2 &&
+        checked.artifact.trace.edges.length == 2 &&
+        checked.artifact.trace.positionsMatch &&
+        checked.artifact.trace.pureCapabilitiesMatch &&
+        checked.artifact.trace.dupCapabilitiesMatch &&
+        checked.artifact.trace.fetchCapabilitiesMatch &&
+        checked.artifact.trace.allocationCapabilitiesMatch &&
+        checked.artifact.trace.positions.any fun position =>
+          position.source.owner == Validate.Owner.main &&
+            position.source.branches.isEmpty &&
+            position.source.offset == 1 && position.block == 0 &&
+            position.target == .instruction 1 &&
+            position.sourceCapabilities == #[.owned .shared] &&
+        match targetFunction? checked.artifact inspectAddress with
+        | some definition =>
+            definition.blocks.size == 3 &&
+              definition.blocks[2]!.instructions[0]? ==
+                some (.fetch (.reg 0) consCtor 0)
+        | none => false
+  | .error _ => false
+
+private def returnedCtorIxIR1 (out : IxIR1.Store × IxIR1.RVal) :
+    Option CtorId :=
+  match out.2 with
+  | .loc location =>
+      match out.1.get? location with
+      | some { node := .ctorN cid _, .. } => some cid
+      | _ => none
+  | _ => none
+
+private def returnedCtorIxIR2 (out : Eval.Result) : Option CtorId :=
+  match out.value with
+  | .loc location =>
+      match out.store.get? location with
+      | some { node := .ctorN cid _, .. } => some cid
+      | _ => none
+  | _ => none
+
+#guard match
+    IxIR1.runMain (sourceContext constructorInput) constructorInput.main 50,
+    loweredConstructor with
+  | .ok source, .ok checked =>
+      match targetRun checked.artifact 8 2 with
+      | .ok target =>
+          returnedCtorIxIR1 source == some nilCtor &&
+            returnedCtorIxIR2 target == some nilCtor &&
+            source.1.live == 1 && target.store.live == 1 &&
+            source.1.allocs == target.store.counters.allocs &&
+            source.1.frees == target.store.counters.frees &&
+            source.1.rcops == target.store.counters.rcops &&
+            target.controlRemaining == 0 && target.heapRemaining == 0
+      | .error _ => false
+  | _, _ => false
+
+/-! ## Owner-sensitive scalar-leaf facts -/
+
+private def freeInput : Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .unique nilCtor #[])
+        (.letOp (.free (.var 0)) (.ret .erased))
+    mainResult := .shared }
+
+private def freeContext : Context :=
+  { schemas
+    scalarFreeCtor := fun site =>
+      if site.owner == Validate.Owner.main && site.branches.isEmpty &&
+          site.offset == 1 then some nilCtor else none }
+
+#guard match lowerChecked freeContext freeInput with
+  | .ok checked =>
+      checked.artifact.validationContext.scalarLeaves ==
+        [{ owner := .main, block := 0, value := 0, cid := nilCtor }] &&
+        match targetRun checked.artifact 3 0 with
+        | .ok target =>
+            target.value == .erased && target.store.live == 0 &&
+              target.store.counters.allocs == 1 &&
+              target.store.counters.frees == 1
+        | .error _ => false
+  | .error _ => false
+
+/-! ## Dead ownership slots at CFG edges -/
+
+/-- `pure` moves the only owner into a new source binder. The older runtime
+slot still contains the same location in IxIR₁, but it is dead and must not
+be related to the successor's deliberately erased block parameter. -/
+private def deadEdgeInput : Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .shared nilCtor #[])
+        (.letOp (.pure (.var 0))
+          (.case (.var 0) false #[
+            .mk 0 0
+              (.letOp (.drop (.var 0)) (.ret (.lit (.nat 9))))]))
+    mainResult := .shared }
+
+private def deadEdgeContext : Context :=
+  { schemas
+    caseCtors := fun site alternative =>
+      if site.owner == Validate.Owner.main && site.branches.isEmpty &&
+          site.offset == 2 && alternative == 0 then
+        [nilCtor]
+      else
+        [] }
+
+private def loweredDeadEdge := lowerChecked deadEdgeContext deadEdgeInput
+
+#guard match loweredDeadEdge with
+  | .ok checked =>
+      match checked.artifact.trace.edges with
+      | [edge] =>
+          edge.sourceInputMap == #[some (.reg 1), none] &&
+            edge.sourceMap == #[some (.reg 0), none] &&
+            edge.explicitValues == #[.reg 1, .erased] &&
+            edge.targetParams == #[.owned .shared, .scalar] &&
+            edge.implicitScalars == 0
+      | _ => false
+  | .error _ => false
+
+#guard match
+    IxIR1.runMain (sourceContext deadEdgeInput) deadEdgeInput.main 20,
+    loweredDeadEdge with
+  | .ok source, .ok checked =>
+      match targetRun checked.artifact 5 10 with
+      | .ok target =>
+          source.2 == .lit (.nat 9) && target.value == source.2 &&
+            source.1.live == 0 && target.store.live == 0 &&
+            target.controlRemaining == 0
+      | .error _ => false
+  | _, _ => false
+
+/-! ## Fail-closed source boundaries -/
+
+private def reuseInput : Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .unique nilCtor #[])
+        (.letOp (.reuse (.var 0) nilCtor #[]) (.ret (.var 0)))
+    mainResult := .unique }
+
+#guard match lowerChecked freeContext reuseInput with
+  | .error (.unsupported { owner := .main, branches := [], offset := 1 }
+      "raw IxIR₁ reuse is outside the baseline subset") => true
+  | _ => false
+
+private def missingWorlds : Context := { schemas }
+
+#guard match lowerChecked missingWorlds natInput with
+  | .error (.missingParameterWorlds address) => address == natAddress
+  | _ => false
+
+end Ix.Compiler.IxIR2.Lower.Examples
diff --git a/Ix/Compiler/IxIR2/LowerSim.lean b/Ix/Compiler/IxIR2/LowerSim.lean
new file mode 100644
index 000000000..5ff941a17
--- /dev/null
+++ b/Ix/Compiler/IxIR2/LowerSim.lean
@@ -0,0 +1,12906 @@
+import Ix.Compiler.IxIR1.NoReuse
+import Ix.Compiler.IxIR2.Eval
+import Ix.Compiler.IxIR2.Lower
+
+/-!
+# Compositional simulation interface for structured lowering
+
+This file fixes the theorem shape before the proof is scaled over every
+instruction. Its foundation packages source allocation order and bounded
+roots into a no-reuse-preserved recursive runtime invariant, and uses partial
+source-slot maps so ownership-dead
+bindings cannot resolve across a CFG edge, discharges scalar and vector
+operand resolution, extends or safely forgets related environments across
+value and erased bindings, establishes canonical call-entry environments,
+derives canonical successor environments from actual generated-edge operand
+resolution (including implicit scalar prefixes),
+and closes the public small-step cases for IxIR₁ `pure`/IxIR₂ `move`, exact
+ordinary constructor allocation, scalar and heap-bearing shared-retain paths,
+scalar and fully recursive shared-release paths, scalar unique drop, checked
+scalar-leaf unique free, general recursive unique destruction, checked
+non-consuming projection, exact function-PAP allocation, direct/self call
+entry with exact source call equations, tail entry with its source-shell
+equations, constructor/Nat branch composition, under-saturated PAP extension,
+exact/over-saturated PAP callee entry, return-time `applyMore` redispatch, and
+both resumed and outermost returns.
+-/
+
+namespace Ix.Compiler.IxIR2.Lower.Sim
+
+open Ix.Compiler.IxIR2
+
+abbrev RVal := IxIR1.RVal
+
+/-- The structured baseline executes against exactly the IxIR₁ heap and
+does not exercise any reset/reuse-credit counters.  Peak-live accounting is a
+target-only observation and is intentionally omitted. -/
+structure StoreRel (source : IxIR1.Store) (target : Eval.Store) : Prop where
+  heap : target.heap = source
+  resetAttempts : target.resetAttempts = 0
+  hotResets : target.hotResets = 0
+  coldResets : target.coldResets = 0
+  reusedPayloadUnits : target.reusedPayloadUnits = 0
+
+/-- Fresh source and target stores satisfy the exact baseline relation. -/
+theorem StoreRel.initial :
+    StoreRel ({} : IxIR1.Store) ({} : Eval.Store) := by
+  constructor <;> rfl
+
+/-- Exact baseline heap correspondence transports the source propositional
+world predicate to the target evaluator's executable world check. -/
+theorem StoreRel.hasWorld_eq_true_iff {source : IxIR1.Store}
+    {target : Eval.Store} (relation : StoreRel source target)
+    {world : Ix.Compiler.Ixon.Owned} {value : RVal} :
+    Eval.RVal.hasWorld target world value = true ↔
+      IxIR1.Sim.HasWorld source world value := by
+  cases value with
+  | lit literal => simp [Eval.RVal.hasWorld, IxIR1.Sim.HasWorld]
+  | erased => simp [Eval.RVal.hasWorld, IxIR1.Sim.HasWorld]
+  | loc location =>
+      simp only [Eval.RVal.hasWorld, Eval.Store.get?, relation.heap,
+        IxIR1.Sim.HasWorld]
+      cases found : source.get? location with
+      | none => simp
+      | some box => simp [beq_iff_eq]
+
+/-- Uniform source-world evidence discharges the target allocation check for
+the uniform baseline schema carried by the pipeline. -/
+theorem StoreRel.fieldWorlds_replicate {source : IxIR1.Store}
+    {target : Eval.Store} (relation : StoreRel source target)
+    {schema : CtorSchema} {values : Array RVal}
+    {world : Ix.Compiler.Ixon.Owned} {count : Nat}
+    (schemaFields : schema.fields = Array.replicate count world)
+    (valueCount : values.size = count)
+    (worlds : ∀ value ∈ values.toList,
+      IxIR1.Sim.HasWorld source world value) :
+    Eval.FieldWorlds target schema values := by
+  apply Eval.FieldWorlds.of_replicate schemaFields valueCount
+  intro value member
+  exact relation.hasWorld_eq_true_iff.mpr (worlds value member)
+
+/-- Exact source ownership of the values consumed into a constructor is a
+direct sufficient premise for the target's uniform-schema field check. -/
+theorem StoreRel.fieldWorlds_replicate_of_ownership
+    {source : IxIR1.Store} {target : Eval.Store}
+    (relation : StoreRel source target)
+    {schema : CtorSchema} {values : Array RVal}
+    {world : Ix.Compiler.Ixon.Owned} {count : Nat}
+    {rest : List IxIR1.Sim.Root}
+    (schemaFields : schema.fields = Array.replicate count world)
+    (valueCount : values.size = count)
+    (ownership : IxIR1.Sim.RootOwnership source
+      (IxIR1.Sim.rootsFor world values.toList ++ rest)) :
+    Eval.FieldWorlds target schema values := by
+  apply relation.fieldWorlds_replicate schemaFields valueCount
+  intro value member
+  apply ownership.roots_world ⟨world, value⟩
+  apply List.mem_append_left
+  rw [IxIR1.Sim.rootsFor, List.mem_map]
+  exact ⟨value, member, rfl⟩
+
+/-- A checked lowering supplies the exact uniform schema and operand arity at
+one retained source allocation. Combined with source root ownership, this
+discharges the target evaluator's entire `FieldWorlds` premise. -/
+theorem StoreRel.fieldWorlds_of_checked_allocation
+    {checked : Lower.Checked} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {world : Ix.Compiler.Ixon.Owned} {identity : CtorId}
+    {sourceArguments : Array IxIR1.Atom} {instruction : Instr}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc world identity sourceArguments) index instruction next))
+    {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    (relation : StoreRel sourceStore targetStore)
+    {source : List RVal} {values : List RVal} {schema : CtorSchema}
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (schemaAt : checked.artifact.validationContext.schemas world identity =
+      some schema)
+    {rest : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership sourceStore
+      (IxIR1.Sim.rootsFor world values ++ rest)) :
+    Eval.FieldWorlds targetStore schema values.toArray := by
+  apply relation.fieldWorlds_replicate_of_ownership
+    (checked.allocationSchemaFields functionMember descendant schemaAt)
+  · simpa using IxIR1.resolveAtoms_length resolved
+  · exact ownership
+
+/-- Ordinary allocation preserves the exact baseline store relation. -/
+theorem StoreRel.alloc {source : IxIR1.Store} {target : Eval.Store}
+    (relation : StoreRel source target) (world : Ix.Compiler.Ixon.Owned)
+    (node : IxIR1.Node) :
+    StoreRel (source.allocNode world node).1
+      (target.allocNode world node).1 := by
+  constructor
+  · rw [Eval.Store.allocNode_heap, relation.heap]
+  · change target.resetAttempts = 0
+    exact relation.resetAttempts
+  · change target.hotResets = 0
+    exact relation.hotResets
+  · change target.coldResets = 0
+    exact relation.coldResets
+  · change target.reusedPayloadUnits = 0
+    exact relation.reusedPayloadUnits
+
+/-- Related stores choose the same fresh location. -/
+theorem StoreRel.alloc_location {source : IxIR1.Store}
+    {target : Eval.Store} (relation : StoreRel source target)
+    (world : Ix.Compiler.Ixon.Owned) (node : IxIR1.Node) :
+    (target.allocNode world node).2 =
+      (source.allocNode world node).2 := by
+  rw [Eval.Store.allocNode_location, relation.heap]
+
+/-- Updating the same node preserves exact heap correspondence. -/
+theorem StoreRel.setBox {source : IxIR1.Store} {target : Eval.Store}
+    (relation : StoreRel source target) (location : Nat)
+    (box : IxIR1.NodeBox) :
+    StoreRel (source.setBox location box) (target.setBox location box) := by
+  constructor
+  · rw [Eval.Store.setBox_heap, relation.heap]
+  · exact relation.resetAttempts
+  · exact relation.hotResets
+  · exact relation.coldResets
+  · exact relation.reusedPayloadUnits
+
+/-- Killing the same location preserves exact heap correspondence. -/
+theorem StoreRel.kill {source : IxIR1.Store} {target : Eval.Store}
+    (relation : StoreRel source target) (location : Nat) :
+    StoreRel (source.kill location) (target.kill location) := by
+  constructor
+  · rw [Eval.Store.kill_heap, relation.heap]
+  · exact relation.resetAttempts
+  · exact relation.hotResets
+  · exact relation.coldResets
+  · exact relation.reusedPayloadUnits
+
+/-- Charging the same RC operation preserves exact store correspondence. -/
+theorem StoreRel.rcTick {source : IxIR1.Store} {target : Eval.Store}
+    (relation : StoreRel source target) :
+    StoreRel source.rcTick target.rcTick := by
+  constructor
+  · rw [Eval.Store.rcTick_heap, relation.heap]
+  · exact relation.resetAttempts
+  · exact relation.hotResets
+  · exact relation.coldResets
+  · exact relation.reusedPayloadUnits
+
+/-! ## Source capability ownership -/
+
+/-- Dynamic interpretation of one producer-retained source capability.
+Scalars must really be non-locations; owners and borrows must name a live
+value in their static world; consumed bindings impose no pointwise fact. -/
+def CapabilityHolds (store : IxIR1.Store) (capability : Lower.BindingCap)
+    (value : RVal) : Prop :=
+  match capability with
+  | .scalar => IxIR1.Sim.rvalLocation? value = none
+  | .owned world | .borrowed world _ =>
+      IxIR1.Sim.HasWorld store world value
+  | .dead => True
+
+/-- Incrementing one shared reference count preserves every pre-existing
+capability fact. -/
+theorem CapabilityHolds.incRcStore {store : IxIR1.Store} {location rc : Nat}
+    {node : IxIR1.Node} {capability : Lower.BindingCap} {value : RVal}
+    (found : store.get? location = some ⟨.shared, rc, node⟩)
+    (holds : CapabilityHolds store capability value) :
+    CapabilityHolds
+      (IxIR1.Sim.incRcStore store location ⟨.shared, rc, node⟩)
+      capability value := by
+  cases capability with
+  | scalar => exact holds
+  | dead => trivial
+  | owned world =>
+      exact IxIR1.Sim.HasWorld.incRcStore found holds
+  | borrowed world lender =>
+      exact IxIR1.Sim.HasWorld.incRcStore found holds
+
+/-- Fresh allocation preserves every capability fact about pre-existing
+values. -/
+theorem CapabilityHolds.allocNode {store : IxIR1.Store}
+    {allocationWorld : Ix.Compiler.Ixon.Owned} {node : IxIR1.Node}
+    {capability : Lower.BindingCap} {value : RVal}
+    (holds : CapabilityHolds store capability value) :
+    CapabilityHolds (store.allocNode allocationWorld node).1 capability
+      value := by
+  cases capability with
+  | scalar => exact holds
+  | dead => trivial
+  | owned world => exact IxIR1.Sim.HasWorld.allocNode holds
+  | borrowed world lender => exact IxIR1.Sim.HasWorld.allocNode holds
+
+/-- Exact external owners selected from a capability vector. Scalars,
+borrows, and dead source slots contribute no ownership root. -/
+def rootsForCapabilities : List Lower.BindingCap → List RVal →
+    List IxIR1.Sim.Root
+  | .owned world :: capabilities, value :: values =>
+      ⟨world, value⟩ :: rootsForCapabilities capabilities values
+  | _ :: capabilities, _ :: values =>
+      rootsForCapabilities capabilities values
+  | _, _ => []
+
+/-- The world annotation on one external root may be replaced when the same
+runtime value is known in the new world. Incoming ownership multiplicity only
+depends on the root's location, so all exact count equations are unchanged. -/
+theorem RootOwnership_reworldHead
+    {store : IxIR1.Store} {oldWorld newWorld : Ix.Compiler.Ixon.Owned}
+    {value : RVal} {rest : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership store
+      (⟨oldWorld, value⟩ :: rest))
+    (world : IxIR1.Sim.HasWorld store newWorld value) :
+    IxIR1.Sim.RootOwnership store (⟨newWorld, value⟩ :: rest) := by
+  refine ⟨?_, ownership.edges_world, ownership.pap_shared, ?_⟩
+  · intro root member
+    simp only [List.mem_cons] at member
+    cases member with
+    | inl equal =>
+        subst root
+        exact world
+    | inr member =>
+        exact ownership.roots_world root (by simp [member])
+  · intro location box found
+    have incomingEq : IxIR1.Sim.incoming store
+        (⟨oldWorld, value⟩ :: rest) location =
+      IxIR1.Sim.incoming store
+        (⟨newWorld, value⟩ :: rest) location := rfl
+    rw [← incomingEq]
+    exact ownership.counts found
+
+/-- A producer borrow is supported by a retained owner when it is the owner
+itself or is reachable through zero or more node-child edges.  The relation
+retains the exact pre-state heap path so destructive simulation can rebuild
+that path in a restricted post-state from the surviving lender root. -/
+inductive BorrowSupport (store : IxIR1.Store) (root : RVal) : RVal → Prop where
+  | refl : BorrowSupport store root root
+  | child {location : Nat} {box : IxIR1.NodeBox} {value : RVal} :
+      BorrowSupport store root (.loc location) →
+      store.get? location = some box →
+      value ∈ IxIR1.Sim.nodeChildren box.node →
+      BorrowSupport store root value
+
+namespace BorrowSupport
+
+/-- Exact heap ownership propagates the lender's world along every retained
+borrow-support edge. -/
+theorem hasWorld {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership store roots)
+    {root value : RVal} {world : Ix.Compiler.Ixon.Owned}
+    (rootWorld : IxIR1.Sim.HasWorld store world root)
+    (support : BorrowSupport store root value) :
+    IxIR1.Sim.HasWorld store world value := by
+  induction support with
+  | refl => exact rootWorld
+  | @child location box value _ found member ih =>
+      obtain ⟨actualBox, actualFound, actualWorld⟩ := ih
+      have boxEq : box = actualBox :=
+        Option.some.inj (found.symm.trans actualFound)
+      subst actualBox
+      simpa [actualWorld] using ownership.edges_world found value member
+
+/-- Borrow support survives a shape-preserving store extension such as RC
+increment or append allocation. -/
+theorem monoStore {before after : IxIR1.Store}
+    (extension : IxIR1.Sim.StoreGraphExtends before after)
+    {root value : RVal} (support : BorrowSupport before root value) :
+    BorrowSupport after root value := by
+  induction support with
+  | refl => exact .refl
+  | @child location box value _ found member ih =>
+      cases box with
+      | mk world rc node =>
+          obtain ⟨afterRc, afterFound⟩ := extension found
+          exact .child ih afterFound member
+
+/-- A borrow path rooted at a value that survives a destructive restriction
+can be rebuilt in the post-state.  Post-state exact ownership supplies the
+liveness of each next child; reverse shape inclusion identifies the same
+node contents in the pre-state. -/
+theorem ofRestricts {before after : IxIR1.Store}
+    (restriction : IxIR1.Sim.StoreGraphRestricts before after)
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership after roots)
+    {root value : RVal} {world : Ix.Compiler.Ixon.Owned}
+    (rootWorld : IxIR1.Sim.HasWorld after world root)
+    (support : BorrowSupport before root value) :
+    BorrowSupport after root value ∧
+      IxIR1.Sim.HasWorld after world value := by
+  induction support with
+  | refl => exact ⟨.refl, rootWorld⟩
+  | @child location beforeBox value _ beforeFound member ih =>
+      obtain ⟨parentSupport, parentWorld⟩ := ih
+      obtain ⟨afterBox, afterFound, afterWorld⟩ := parentWorld
+      cases afterBox with
+      | mk boxWorld boxRc node =>
+          obtain ⟨beforeRc, matchingBefore⟩ := restriction afterFound
+          have beforeBoxEq :
+              beforeBox = ⟨boxWorld, beforeRc, node⟩ :=
+            Option.some.inj (beforeFound.symm.trans matchingBefore)
+          subst beforeBox
+          have valueWorld :
+              IxIR1.Sim.HasWorld after boxWorld value :=
+            ownership.edges_world afterFound value member
+          have boxWorldEq : boxWorld = world := by
+            simpa only using afterWorld
+          refine ⟨.child parentSupport afterFound member, ?_⟩
+          rw [boxWorldEq] at valueWorld
+          exact valueWorld
+
+end BorrowSupport
+
+/-- Rebinding an owned source slot at the de Bruijn head preserves the exact
+root multiset: the old occurrence is marked dead and the same root is moved
+to the front. -/
+theorem rootsForCapabilities_setDead_perm :
+    ∀ {capabilities : List Lower.BindingCap} {source : List RVal}
+      {index : Nat} {world : Ix.Compiler.Ixon.Owned} {value : RVal},
+      capabilities[index]? = some (.owned world) →
+      source[index]? = some value →
+      ((⟨world, value⟩ : IxIR1.Sim.Root) ::
+          rootsForCapabilities (capabilities.set index .dead) source).Perm
+        (rootsForCapabilities capabilities source) := by
+  intro capabilities source index
+  induction index generalizing capabilities source with
+  | zero =>
+      cases capabilities with
+      | nil => simp
+      | cons capability capabilities =>
+          cases source with
+          | nil => simp
+          | cons head tail =>
+              intro world value capabilityAt sourceAt
+              simp only [List.getElem?_cons_zero, Option.some.injEq] at capabilityAt sourceAt
+              subst capability
+              subst head
+              simp [rootsForCapabilities]
+  | succ index ih =>
+      cases capabilities with
+      | nil => simp
+      | cons capability capabilities =>
+          cases source with
+          | nil => simp
+          | cons head tail =>
+              intro world value capabilityAt sourceAt
+              simp only [List.getElem?_cons_succ] at capabilityAt sourceAt
+              have tailPerm := ih capabilityAt sourceAt
+              cases capability with
+              | owned headWorld =>
+                  exact (List.Perm.swap _ _ _).trans
+                    (List.Perm.cons (⟨headWorld, head⟩ : IxIR1.Sim.Root)
+                      tailPerm)
+              | scalar | borrowed | dead =>
+                  simpa [rootsForCapabilities] using tailPerm
+
+/-- An owned capability contributes its exact source value to the ownership
+root list. -/
+theorem rootsForCapabilities_owned_mem
+    {capabilities : Array Lower.BindingCap} {source : List RVal}
+    {index : Nat} {world : Ix.Compiler.Ixon.Owned} {value : RVal}
+    (capabilityAt : capabilities[index]? = some (.owned world))
+    (sourceAt : source[index]? = some value) :
+    (⟨world, value⟩ : IxIR1.Sim.Root) ∈
+      rootsForCapabilities capabilities.toList source := by
+  have moved := rootsForCapabilities_setDead_perm
+    (capabilities := capabilities.toList) (source := source)
+    (index := index) (world := world) (value := value)
+    (by simpa using capabilityAt) (by simpa using sourceAt)
+  exact moved.mem_iff.mp (by simp)
+
+/-- Semantic provenance for one borrowed capability.  A local borrow is
+supported by the owned source slot whose retained target atom is its exact
+SSA lender.  A caller-rooted borrow is supported by one framed external root
+that remains part of whole-machine ownership while the callee is active. -/
+def BorrowProvenance (store : IxIR1.Store) (source : List RVal)
+    (input : Array (Option Atom))
+    (capabilities : Array Lower.BindingCap)
+    (frameRoots : List IxIR1.Sim.Root)
+    (world : Ix.Compiler.Ixon.Owned) (lender : BorrowLender)
+    (value : RVal) : Prop :=
+  match lender with
+  | .caller =>
+      ∃ root, root ∈ frameRoots ∧ root.world = world ∧
+        BorrowSupport store root.value value
+  | .value lenderId =>
+      ∃ (ownerIndex : Nat) (ownerValue : RVal),
+        input[ownerIndex]? = some (some (Atom.reg lenderId)) ∧
+        capabilities[ownerIndex]? =
+          some (Lower.BindingCap.owned world) ∧
+        source[ownerIndex]? = some ownerValue ∧
+        BorrowSupport store ownerValue value
+
+/-- Every owned source slot names the SSA register that acts as a possible
+local borrow lender. -/
+def OwnedInputRegisters (input : Array (Option Atom))
+    (capabilities : Array Lower.BindingCap) : Prop :=
+  ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned},
+    capabilities[index]? = some (.owned world) →
+    ∃ id, input[index]? = some (some (.reg id))
+
+/-- Coordinate coherence supplies the owned-register condition used by
+semantic lender transport. -/
+theorem OwnedInputRegisters.ofCoordinate
+    {position : Lower.PositionTrace} {source : Lower.SourceSite}
+    {block : BlockId} {target : Lower.TargetPosition}
+    {input : Array (Option Atom)}
+    (coordinate : position.coordinateMatches source block target input =
+      true) :
+    OwnedInputRegisters input position.sourceCapabilities := by
+  intro index world capabilityAt
+  exact position.inputReg_of_owned_coordinateMatch coordinate capabilityAt
+
+namespace BorrowProvenance
+
+/-- Prefixing one result binder transports every pre-existing borrow whose
+capability tail is unchanged.  The successor's checked owned-register shape
+and proof-map forgetting relation recover the same concrete SSA lender at the
+shifted source index. -/
+private theorem prependUnchanged
+    {before after : IxIR1.Store}
+    (extension : IxIR1.Sim.StoreGraphExtends before after)
+    {source : List RVal} {input afterInput : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {headCapability : Lower.BindingCap} {headValue : RVal} {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput
+      (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput
+      (#[headCapability] ++ capabilities))
+    {world : Ix.Compiler.Ixon.Owned} {lender : BorrowLender} {value : RVal}
+    (provenance : BorrowProvenance before source input capabilities
+      frameRoots world lender value) :
+    BorrowProvenance after (headValue :: source) afterInput
+      (#[headCapability] ++ capabilities) frameRoots world lender value := by
+  cases lender with
+  | caller =>
+      obtain ⟨root, member, rootWorld, support⟩ := provenance
+      exact ⟨root, member, rootWorld, support.monoStore extension⟩
+  | value lenderId =>
+      obtain ⟨ownerIndex, ownerValue, inputAt, capabilityAt, sourceAt,
+        support⟩ := provenance
+      have shiftedCapability :
+          (#[headCapability] ++ capabilities)[ownerIndex + 1]? =
+            some (.owned world) := by
+        simpa [Array.getElem?_append] using capabilityAt
+      obtain ⟨actualId, afterInputAt⟩ :=
+        afterOwners shiftedCapability
+      have currentInputAt :
+          (#[some headAtom] ++ input)[ownerIndex + 1]? =
+            some (some (.reg actualId)) :=
+        forgets (ownerIndex + 1) (.reg actualId) afterInputAt
+      have oldActual : input[ownerIndex]? =
+          some (some (.reg actualId)) := by
+        simpa [Array.getElem?_append] using currentInputAt
+      have actualEq : actualId = lenderId := by
+        have atomEq : (Atom.reg actualId) = .reg lenderId :=
+          Option.some.inj (Option.some.inj (oldActual.symm.trans inputAt))
+        injection atomEq
+      subst actualId
+      refine ⟨ownerIndex + 1, ownerValue, afterInputAt,
+        shiftedCapability, ?_, support.monoStore extension⟩
+      simpa using sourceAt
+
+/-- When the new result is not itself borrowed, all successor borrow
+provenance comes from the unchanged capability tail. -/
+private theorem prependNonBorrowed
+    {before after : IxIR1.Store}
+    (extension : IxIR1.Sim.StoreGraphExtends before after)
+    {source : List RVal} {input afterInput : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (oldBorrows : ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      capabilities[index]? = some (.borrowed world lender) →
+      source[index]? = some value →
+      BorrowProvenance before source input capabilities frameRoots world
+        lender value)
+    {headCapability : Lower.BindingCap} {headValue : RVal} {headAtom : Atom}
+    (headNotBorrowed : ∀ world lender,
+      headCapability ≠ .borrowed world lender)
+    (forgets : Lower.InputMap.Forgets afterInput
+      (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput
+      (#[headCapability] ++ capabilities)) :
+    ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      (#[headCapability] ++ capabilities)[index]? =
+          some (.borrowed world lender) →
+      (headValue :: source)[index]? = some value →
+      BorrowProvenance after (headValue :: source) afterInput
+        (#[headCapability] ++ capabilities) frameRoots world lender value := by
+  intro index world lender value capabilityAt valueAt
+  cases index with
+  | zero =>
+      simp [Array.getElem?_append] at capabilityAt
+      exact (headNotBorrowed world lender capabilityAt).elim
+  | succ index =>
+      simp [Array.getElem?_append] at capabilityAt valueAt
+      exact prependUnchanged extension forgets afterOwners
+        (oldBorrows capabilityAt valueAt)
+
+/-- Extending a borrow by one concrete heap edge preserves its recorded
+lender while extending the semantic support path. -/
+private theorem child
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {world : Ix.Compiler.Ixon.Owned} {lender : BorrowLender}
+    {location : Nat} {box : IxIR1.NodeBox} {value : RVal}
+    (provenance : BorrowProvenance store source input capabilities frameRoots
+      world lender (.loc location))
+    (found : store.get? location = some box)
+    (member : value ∈ IxIR1.Sim.nodeChildren box.node) :
+    BorrowProvenance store source input capabilities frameRoots world lender
+      value := by
+  cases lender with
+  | caller =>
+      obtain ⟨root, rootMember, rootWorld, support⟩ := provenance
+      exact ⟨root, rootMember, rootWorld, .child support found member⟩
+  | value lenderId =>
+      obtain ⟨ownerIndex, ownerValue, ownerInput, ownerCapability,
+        ownerValueAt, support⟩ := provenance
+      exact ⟨ownerIndex, ownerValue, ownerInput, ownerCapability,
+        ownerValueAt, .child support found member⟩
+
+/-- Exact ownership turns recorded lender provenance into the dynamic world
+fact required by the borrowed capability. -/
+theorem hasWorld {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {world : Ix.Compiler.Ixon.Owned} {lender : BorrowLender}
+    {value : RVal}
+    (ownership : IxIR1.Sim.RootOwnership store
+      (rootsForCapabilities capabilities.toList source ++ frameRoots))
+    (provenance : BorrowProvenance store source input capabilities frameRoots
+      world lender value) :
+    IxIR1.Sim.HasWorld store world value := by
+  cases lender with
+  | caller =>
+      obtain ⟨root, rootMember, rootWorld, support⟩ := provenance
+      have rootHas : IxIR1.Sim.HasWorld store world root.value := by
+        simpa [rootWorld] using ownership.roots_world root
+          (List.mem_append_right _ rootMember)
+      exact support.hasWorld ownership rootHas
+  | value lenderId =>
+      obtain ⟨ownerIndex, ownerValue, ownerInput, ownerCapability,
+        ownerValueAt, support⟩ := provenance
+      have ownerHas : IxIR1.Sim.HasWorld store world ownerValue :=
+        ownership.roots_world ⟨world, ownerValue⟩
+          (List.mem_append_left _
+            (rootsForCapabilities_owned_mem ownerCapability ownerValueAt))
+      exact support.hasWorld ownership ownerHas
+
+/-- Provenance rooted at a surviving owner transports across a destructive
+store restriction. -/
+theorem ofRestricts {before after : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (restriction : IxIR1.Sim.StoreGraphRestricts before after)
+    (ownership : IxIR1.Sim.RootOwnership after
+      (rootsForCapabilities capabilities.toList source ++ frameRoots))
+    {world : Ix.Compiler.Ixon.Owned} {lender : BorrowLender}
+    {value : RVal}
+    (provenance : BorrowProvenance before source input capabilities frameRoots
+      world lender value) :
+    BorrowProvenance after source input capabilities frameRoots world lender
+      value := by
+  cases lender with
+  | caller =>
+      obtain ⟨root, rootMember, rootWorld, support⟩ := provenance
+      have rootHas : IxIR1.Sim.HasWorld after world root.value := by
+        simpa [rootWorld] using ownership.roots_world root
+          (List.mem_append_right _ rootMember)
+      exact ⟨root, rootMember, rootWorld,
+        (support.ofRestricts restriction ownership rootHas).1⟩
+  | value lenderId =>
+      obtain ⟨ownerIndex, ownerValue, ownerInput, ownerCapability,
+        ownerValueAt, support⟩ := provenance
+      have ownerHas : IxIR1.Sim.HasWorld after world ownerValue :=
+        ownership.roots_world ⟨world, ownerValue⟩
+          (List.mem_append_left _
+            (rootsForCapabilities_owned_mem ownerCapability ownerValueAt))
+      exact ⟨ownerIndex, ownerValue, ownerInput, ownerCapability,
+        ownerValueAt,
+        (support.ofRestricts restriction ownership ownerHas).1⟩
+
+end BorrowProvenance
+
+/-- Dynamic source ownership at one producer capability position.  The
+pointwise clause supplies world/scalar safety for operand checks; exact root
+ownership includes suspended caller roots, and every borrow carries an exact
+semantic path from its producer-recorded local or caller lender. -/
+structure SourceOwnershipInvariant (store : IxIR1.Store)
+    (source : List RVal) (input : Array (Option Atom))
+    (capabilities : Array Lower.BindingCap)
+    (frameRoots : List IxIR1.Sim.Root) : Prop where
+  length : source.length = capabilities.size
+  holds : ∀ {index : Nat} {capability : Lower.BindingCap} {value : RVal},
+    capabilities[index]? = some capability →
+    source[index]? = some value →
+    CapabilityHolds store capability value
+  ownership : IxIR1.Sim.RootOwnership store
+    (rootsForCapabilities capabilities.toList source ++ frameRoots)
+  borrows : ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+      {lender : BorrowLender} {value : RVal},
+    capabilities[index]? = some (.borrowed world lender) →
+    source[index]? = some value →
+    BorrowProvenance store source input capabilities frameRoots world lender
+      value
+
+/-- Trace-indexed form threaded by the recursive worker.  It is deliberately
+generic over the matching flat producer position, so switch children and
+instruction continuations can select their own capability vector. -/
+def SourceOwnershipAt (positions : List Lower.PositionTrace)
+    (trace : Lower.CodeTrace) (store : IxIR1.Store)
+    (source : List RVal) (frameRoots : List IxIR1.Sim.Root) : Prop :=
+  ∀ position,
+    position ∈ positions →
+    position.coordinateMatches trace.source trace.sourceBlock
+      trace.targetPosition trace.sourceInputMap = true →
+    SourceOwnershipInvariant store source trace.sourceInputMap
+      position.sourceCapabilities frameRoots
+
+namespace SourceOwnershipAt
+
+private theorem sourceMapOf_zero_for_ownership
+    (explicitMap : Array (Option Atom)) :
+    Lower.EdgeTrace.sourceMapOf 0 explicitMap = explicitMap := by
+  apply Array.ext
+  · simp [Lower.EdgeTrace.sourceMapOf]
+  · intro index leftBound rightBound
+    simp [Lower.EdgeTrace.sourceMapOf]
+    cases explicitMap[index] with
+    | none => rfl
+    | some atom => cases atom <;> rfl
+
+/-- Any empty-input trace begins with the exact empty dynamic ownership
+state.  In particular this constructs the invariant at the closed synthetic
+main root from the retained zero-arity input map. -/
+theorem empty {positions : List Lower.PositionTrace}
+    {trace : Lower.CodeTrace}
+    (inputEmpty : trace.sourceInputMap.size = 0) :
+    SourceOwnershipAt positions trace ({} : IxIR1.Store) [] [] := by
+  intro position _ coordinate
+  have capabilitySize :=
+    position.sourceCapabilities_size_of_coordinateMatch coordinate
+  have capabilitiesEmpty : position.sourceCapabilities = #[] :=
+    Array.eq_empty_of_size_eq_zero (capabilitySize.trans inputEmpty)
+  rw [capabilitiesEmpty]
+  have traceInputEmpty : trace.sourceInputMap = #[] :=
+    Array.eq_empty_of_size_eq_zero inputEmpty
+  rw [traceInputEmpty]
+  refine ⟨rfl, ?_, ?_, ?_⟩
+  · intro index capability value capabilityAt
+    simp at capabilityAt
+  · simpa [rootsForCapabilities] using IxIR1.Sim.RootOwnership.empty
+  · intro index world lender value capabilityAt
+    simp at capabilityAt
+
+end SourceOwnershipAt
+
+namespace SourceOwnershipInvariant
+
+/-- Empty main entry has no owned roots, framed roots, or scalar obligations. -/
+theorem empty :
+    SourceOwnershipInvariant ({} : IxIR1.Store) [] #[] #[] [] := by
+  refine ⟨rfl, ?_, ?_, ?_⟩
+  · intro index capability value capabilityAt
+    simp at capabilityAt
+  · simpa [rootsForCapabilities] using IxIR1.Sim.RootOwnership.empty
+  · intro index world lender value capabilityAt
+    simp at capabilityAt
+
+/-- Focus an arbitrary producer owner at the head of the exact root list.
+The remaining list still contains every suspended-frame root, which is the
+shape needed by physical-reuse stack-avoidance arguments. -/
+theorem focusOwned
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {index : Nat} {world : Ix.Compiler.Ixon.Owned} {value : RVal}
+    (capabilityAt : capabilities[index]? = some (.owned world))
+    (sourceAt : source[index]? = some value) :
+    ∃ rest,
+      IxIR1.Sim.RootOwnership store (⟨world, value⟩ :: rest) ∧
+        ∀ root ∈ frameRoots, root ∈ rest := by
+  have rootMember : (⟨world, value⟩ : IxIR1.Sim.Root) ∈
+      rootsForCapabilities capabilities.toList source :=
+    rootsForCapabilities_owned_mem capabilityAt sourceAt
+  obtain ⟨before, after, rootsEq⟩ := List.mem_iff_append.mp rootMember
+  let rest := (after ++ frameRoots) ++ before
+  refine ⟨rest, ?_, ?_⟩
+  · apply invariant.ownership.perm
+    rw [rootsEq]
+    simpa [rest, List.append_assoc] using
+      (List.perm_append_comm
+        (l₁ := before)
+        (l₂ := (⟨world, value⟩ : IxIR1.Sim.Root) ::
+          (after ++ frameRoots)))
+  · intro root member
+    simp [rest, member]
+
+/-- A capability accepted at an owned boundary dynamically inhabits the
+requested world. -/
+theorem hasWorld_of_canConsume {store : IxIR1.Store}
+    {capability : Lower.BindingCap} {value : RVal}
+    {world : Ix.Compiler.Ixon.Owned}
+    (holds : CapabilityHolds store capability value)
+    (accepted : capability.canConsume world = true) :
+    IxIR1.Sim.HasWorld store world value := by
+  cases capability <;> cases value <;>
+    simp_all [CapabilityHolds, Lower.BindingCap.canConsume,
+      IxIR1.Sim.rvalLocation?, IxIR1.Sim.HasWorld, beq_iff_eq]
+
+/-- Resolve one statically accepted source operand to a value in the requested
+world. -/
+theorem resolveAtom_hasWorld {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {atom : IxIR1.Atom} {capability : Lower.BindingCap}
+    {world : Ix.Compiler.Ixon.Owned} {value : RVal}
+    (capabilityAt : Lower.sourceCapability? capabilities atom =
+      some capability)
+    (accepted : capability.canConsume world = true)
+    (resolved : IxIR1.resolveAtom source atom = .ok value) :
+    IxIR1.Sim.HasWorld store world value := by
+  cases atom with
+  | lit literal =>
+      have valueEq : (.lit literal : RVal) = value := by
+        simpa [IxIR1.resolveAtom] using resolved
+      subst value
+      trivial
+  | erased =>
+      have valueEq : (.erased : RVal) = value := by
+        simpa [IxIR1.resolveAtom] using resolved
+      subst value
+      trivial
+  | var index =>
+      simp only [Lower.sourceCapability?] at capabilityAt
+      cases sourceAt : source[index]? with
+      | none => simp [IxIR1.resolveAtom, sourceAt] at resolved
+      | some found =>
+          have valueEq : found = value := by
+            simpa [IxIR1.resolveAtom, sourceAt] using resolved
+          subst found
+          exact hasWorld_of_canConsume
+            (invariant.holds capabilityAt sourceAt) accepted
+
+/-- Retiring loans rooted at one SSA lender preserves every surviving
+pointwise capability fact. -/
+private theorem retireLenderCapabilities_holds
+    {store : IxIR1.Store} {source : List RVal}
+    {capabilities : Array Lower.BindingCap} {lender : ValueId}
+    (holds : ∀ {index : Nat} {capability : Lower.BindingCap} {value : RVal},
+      capabilities[index]? = some capability →
+      source[index]? = some value →
+      CapabilityHolds store capability value) :
+    ∀ {index : Nat} {capability : Lower.BindingCap} {value : RVal},
+      (Lower.retireLenderCapabilities capabilities lender)[index]? =
+          some capability →
+      source[index]? = some value →
+      CapabilityHolds store capability value := by
+  intro index capability value capabilityAt valueAt
+  rw [Lower.retireLenderCapabilities, Array.getElem?_map] at capabilityAt
+  cases oldAt : capabilities[index]? with
+  | none => simp [oldAt] at capabilityAt
+  | some oldCapability =>
+      have oldHolds := holds oldAt valueAt
+      simp only [oldAt, Option.map_some, Option.some.injEq] at capabilityAt
+      cases oldCapability with
+      | scalar | owned | dead =>
+          subst capability
+          exact oldHolds
+      | borrowed world oldLender =>
+          cases oldLender with
+          | caller =>
+              subst capability
+              exact oldHolds
+          | value actual =>
+              by_cases same : actual = lender
+              · simp [Lower.BindingCap.retireLender, same] at capabilityAt
+                subst capability
+                trivial
+              · simp [Lower.BindingCap.retireLender, same] at capabilityAt
+                subst capability
+                exact oldHolds
+
+/-- Loan retirement does not change the exact owned-root multiset because
+borrowed and dead slots are both ownership-inert. -/
+private theorem rootsForCapabilities_retireLenderList
+    (lender : ValueId) :
+    ∀ (capabilities : List Lower.BindingCap) (source : List RVal),
+      rootsForCapabilities
+          (capabilities.map (Lower.BindingCap.retireLender lender)) source =
+        rootsForCapabilities capabilities source := by
+  intro capabilities
+  induction capabilities with
+  | nil => intro source; simp [rootsForCapabilities]
+  | cons capability capabilities ih =>
+      intro source
+      cases source with
+      | nil => simp [rootsForCapabilities]
+      | cons value values =>
+          cases capability with
+          | scalar | owned | dead =>
+              simp [Lower.BindingCap.retireLender, rootsForCapabilities, ih]
+          | borrowed world oldLender =>
+              cases oldLender with
+              | caller =>
+                  simp [Lower.BindingCap.retireLender,
+                    rootsForCapabilities, ih]
+              | value actual =>
+                  by_cases same : actual = lender <;>
+                    simp [Lower.BindingCap.retireLender, same,
+                      rootsForCapabilities, ih]
+
+private theorem rootsForCapabilities_retireLenderCapabilities
+    (capabilities : Array Lower.BindingCap) (source : List RVal)
+    (lender : ValueId) :
+    rootsForCapabilities
+        (Lower.retireLenderCapabilities capabilities lender).toList source =
+      rootsForCapabilities capabilities.toList source := by
+  simpa [Lower.retireLenderCapabilities] using
+    rootsForCapabilities_retireLenderList lender capabilities.toList source
+
+/-- Retiring one owner and its rooted loans preserves all surviving dynamic
+facts and removes exactly that owner's root. -/
+private theorem retireOwnerCapabilities_ownership
+    {store : IxIR1.Store} {source : List RVal}
+    {capabilities remaining : Array Lower.BindingCap}
+    {input : Array (Option Atom)} {sourceIndex : Nat}
+    {world : Ix.Compiler.Ixon.Owned} {value : RVal}
+    (holds : ∀ {index : Nat} {capability : Lower.BindingCap}
+        {selected : RVal},
+      capabilities[index]? = some capability →
+      source[index]? = some selected →
+      CapabilityHolds store capability selected)
+    (capabilityAt : capabilities[sourceIndex]? =
+      some (.owned world))
+    (sourceAt : source[sourceIndex]? = some value)
+    (retired : Lower.retireOwnerCapabilities? capabilities input sourceIndex =
+      some remaining) :
+    (∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+        remaining[index]? = some capability →
+        source[index]? = some selected →
+        CapabilityHolds store capability selected) ∧
+      (((⟨world, value⟩ : IxIR1.Sim.Root) ::
+          rootsForCapabilities remaining.toList source).Perm
+        (rootsForCapabilities capabilities.toList source)) := by
+  unfold Lower.retireOwnerCapabilities? at retired
+  split at retired <;> try contradiction
+  next lender inputAt =>
+    injection retired with remainingEq
+    subst remaining
+    have sourceBound : sourceIndex < capabilities.size :=
+      (Array.getElem?_eq_some_iff.mp capabilityAt).1
+    let consumed := capabilities.setIfInBounds sourceIndex .dead
+    have consumedHolds :
+        ∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+          consumed[index]? = some capability →
+          source[index]? = some selected →
+          CapabilityHolds store capability selected := by
+      intro index capability selected capabilityAt' selectedAt
+      by_cases same : sourceIndex = index
+      · subst index
+        simp [consumed, sourceBound] at capabilityAt'
+        subst capability
+        trivial
+      · have oldCapability : capabilities[index]? = some capability := by
+          simpa [consumed, Array.getElem?_setIfInBounds, same] using
+            capabilityAt'
+        exact holds oldCapability selectedAt
+    refine ⟨retireLenderCapabilities_holds consumedHolds, ?_⟩
+    rw [rootsForCapabilities_retireLenderCapabilities]
+    have movedRoot := rootsForCapabilities_setDead_perm
+      (capabilities := capabilities.toList) (source := source)
+      (index := sourceIndex) (world := world) (value := value)
+      (by simpa using capabilityAt) (by simpa using sourceAt)
+    simpa [consumed, Array.toList_setIfInBounds] using movedRoot
+
+/-- A borrow surviving exact owner retirement retains valid provenance.  A
+local surviving lender cannot be the consumed register (that loan would have
+become dead), and its distinct owned source slot is unchanged by both the
+point update and lender-retirement map. -/
+private theorem retireOwnerCapabilities_borrows
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (oldBorrows : ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      capabilities[index]? = some (.borrowed world lender) →
+      source[index]? = some value →
+      BorrowProvenance store source input capabilities frameRoots world lender
+        value)
+    {consumedIndex : Nat} {consumedWorld : Ix.Compiler.Ixon.Owned}
+    (consumedCapability : capabilities[consumedIndex]? =
+      some (.owned consumedWorld))
+    (retired : Lower.retireOwnerCapabilities? capabilities input
+      consumedIndex = some remaining)
+    {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+    {lender : BorrowLender} {value : RVal}
+    (remainingAt : remaining[index]? = some (.borrowed world lender))
+    (valueAt : source[index]? = some value) :
+    BorrowProvenance store source input remaining frameRoots world lender
+      value := by
+  unfold Lower.retireOwnerCapabilities? at retired
+  split at retired <;> try contradiction
+  next consumedLender consumedInput =>
+    injection retired with remainingEq
+    subst remaining
+    have consumedBound : consumedIndex < capabilities.size :=
+      (Array.getElem?_eq_some_iff.mp consumedCapability).1
+    by_cases sameIndex : consumedIndex = index
+    · subst index
+      have killedAt :
+          (Lower.retireLenderCapabilities
+            (capabilities.setIfInBounds consumedIndex .dead)
+            consumedLender)[consumedIndex]? = some .dead := by
+        rw [Lower.retireLenderCapabilities, Array.getElem?_map]
+        simp [consumedBound, Lower.BindingCap.retireLender]
+      rw [killedAt] at remainingAt
+      cases remainingAt
+    · have setAt :
+          (capabilities.setIfInBounds consumedIndex .dead)[index]? =
+            capabilities[index]? := by
+        simp [sameIndex]
+      rw [Lower.retireLenderCapabilities, Array.getElem?_map, setAt] at remainingAt
+      cases oldAt : capabilities[index]? with
+      | none => simp [oldAt] at remainingAt
+      | some oldCapability =>
+          cases oldCapability with
+          | scalar | owned | dead =>
+              simp [oldAt, Lower.BindingCap.retireLender] at remainingAt
+          | borrowed oldWorld oldLender =>
+              cases oldLender with
+              | caller =>
+                  simp only [oldAt, Option.map_some,
+                    Lower.BindingCap.retireLender,
+                    Option.some.injEq] at remainingAt
+                  rcases remainingAt with ⟨rfl, rfl⟩
+                  obtain ⟨root, rootMember, rootWorld, support⟩ :=
+                    oldBorrows oldAt valueAt
+                  exact ⟨root, rootMember, rootWorld, support⟩
+              | value oldLenderId =>
+                  by_cases sameLender : oldLenderId = consumedLender
+                  · simp [oldAt, Lower.BindingCap.retireLender,
+                      sameLender] at remainingAt
+                  · simp [oldAt, Lower.BindingCap.retireLender,
+                      sameLender] at remainingAt
+                    rcases remainingAt with ⟨rfl, rfl⟩
+                    obtain ⟨ownerIndex, ownerValue, ownerInput,
+                      ownerCapability, ownerValueAt, support⟩ :=
+                      oldBorrows oldAt valueAt
+                    have ownerNe : consumedIndex ≠ ownerIndex := by
+                      intro equal
+                      subst ownerIndex
+                      have atomEq :
+                          (Atom.reg consumedLender) = .reg oldLenderId :=
+                        Option.some.inj
+                          (Option.some.inj (consumedInput.symm.trans ownerInput))
+                      have lenderEq : consumedLender = oldLenderId := by
+                        injection atomEq
+                      exact sameLender lenderEq.symm
+                    have ownerSetAt :
+                        (capabilities.setIfInBounds consumedIndex .dead
+                          )[ownerIndex]? = some (.owned oldWorld) := by
+                      simpa [Array.getElem?_setIfInBounds, ownerNe] using
+                        ownerCapability
+                    have remainingOwner :
+                        (Lower.retireLenderCapabilities
+                          (capabilities.setIfInBounds consumedIndex .dead)
+                          consumedLender)[ownerIndex]? =
+                            some (.owned oldWorld) := by
+                      rw [Lower.retireLenderCapabilities, Array.getElem?_map,
+                        ownerSetAt]
+                      rfl
+                    exact ⟨ownerIndex, ownerValue, ownerInput,
+                      remainingOwner, ownerValueAt, support⟩
+
+/-- The exact producer `pure`/`move` capability effect preserves dynamic
+source ownership.  Scalars and borrows are copied without changing the root
+multiset; an owned value moves its existing root from the consumed slot to the
+new head. -/
+theorem move {store : IxIR1.Store} {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {atom : IxIR1.Atom} {value : RVal}
+    (resolved : IxIR1.resolveAtom source atom = .ok value)
+    (transition : Lower.moveCapabilities? capabilities input atom =
+      some afterCapabilities) :
+    SourceOwnershipInvariant store (value :: source) afterInput
+      afterCapabilities frameRoots := by
+  cases atom with
+  | lit literal =>
+      simp only [Lower.moveCapabilities?, Lower.sourceCapability?] at transition
+      injection transition with afterEq
+      subst afterCapabilities
+      have valueEq : value = .lit literal := by
+        simpa [IxIR1.resolveAtom] using resolved.symm
+      subst value
+      refine ⟨by simp [Array.size_append, Nat.add_comm, invariant.length],
+        ?_, ?_, ?_⟩
+      · intro index capability value capabilityAt valueAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            subst capability
+            subst value
+            trivial
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            exact invariant.holds capabilityAt valueAt
+      · simpa [rootsForCapabilities] using invariant.ownership
+      · intro index world lender selected capabilityAt selectedAt
+        cases index with
+        | zero => simp [Array.getElem?_append] at capabilityAt
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            exact BorrowProvenance.prependUnchanged
+              (IxIR1.Sim.StoreGraphExtends.refl store) forgets afterOwners
+              (invariant.borrows capabilityAt selectedAt)
+  | erased =>
+      simp only [Lower.moveCapabilities?, Lower.sourceCapability?] at transition
+      injection transition with afterEq
+      subst afterCapabilities
+      have valueEq : value = .erased := by
+        simpa [IxIR1.resolveAtom] using resolved.symm
+      subst value
+      refine ⟨by simp [Array.size_append, Nat.add_comm, invariant.length],
+        ?_, ?_, ?_⟩
+      · intro index capability value capabilityAt valueAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            subst capability
+            subst value
+            trivial
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            exact invariant.holds capabilityAt valueAt
+      · simpa [rootsForCapabilities] using invariant.ownership
+      · intro index world lender selected capabilityAt selectedAt
+        cases index with
+        | zero => simp [Array.getElem?_append] at capabilityAt
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            exact BorrowProvenance.prependUnchanged
+              (IxIR1.Sim.StoreGraphExtends.refl store) forgets afterOwners
+              (invariant.borrows capabilityAt selectedAt)
+  | var sourceIndex =>
+      cases sourceAt : source[sourceIndex]? with
+      | none => simp [IxIR1.resolveAtom, sourceAt] at resolved
+      | some found =>
+          have valueEq : found = value := by
+            simpa [IxIR1.resolveAtom, sourceAt] using resolved
+          subst found
+          cases capabilityAt : capabilities[sourceIndex]? with
+          | none =>
+              simp [Lower.moveCapabilities?, Lower.sourceCapability?,
+                capabilityAt] at transition
+          | some capability =>
+              cases capability with
+              | dead =>
+                  simp [Lower.moveCapabilities?, Lower.sourceCapability?,
+                    capabilityAt] at transition
+              | scalar =>
+                  simp only [Lower.moveCapabilities?,
+                    Lower.sourceCapability?, capabilityAt] at transition
+                  injection transition with afterEq
+                  subst afterCapabilities
+                  refine ⟨by simp [Array.size_append, Nat.add_comm,
+                    invariant.length], ?_, ?_, ?_⟩
+                  · intro index capability value capabilityAt' valueAt
+                    cases index with
+                    | zero =>
+                        simp [Array.getElem?_append] at capabilityAt' valueAt
+                        subst capability
+                        subst value
+                        exact invariant.holds capabilityAt sourceAt
+                    | succ index =>
+                        simp [Array.getElem?_append] at capabilityAt' valueAt
+                        exact invariant.holds capabilityAt' valueAt
+                  · simpa [rootsForCapabilities] using invariant.ownership
+                  · intro index world lender selected capabilityAt' selectedAt
+                    cases index with
+                    | zero => simp [Array.getElem?_append] at capabilityAt'
+                    | succ index =>
+                        simp [Array.getElem?_append] at capabilityAt' selectedAt
+                        exact BorrowProvenance.prependUnchanged
+                          (IxIR1.Sim.StoreGraphExtends.refl store) forgets
+                          afterOwners
+                          (invariant.borrows capabilityAt' selectedAt)
+              | borrowed world lender =>
+                  simp only [Lower.moveCapabilities?,
+                    Lower.sourceCapability?, capabilityAt] at transition
+                  injection transition with afterEq
+                  subst afterCapabilities
+                  refine ⟨by simp [Array.size_append, Nat.add_comm,
+                    invariant.length], ?_, ?_, ?_⟩
+                  · intro index capability value capabilityAt' valueAt
+                    cases index with
+                    | zero =>
+                        simp [Array.getElem?_append] at capabilityAt' valueAt
+                        subst capability
+                        subst value
+                        exact invariant.holds capabilityAt sourceAt
+                    | succ index =>
+                        simp [Array.getElem?_append] at capabilityAt' valueAt
+                        exact invariant.holds capabilityAt' valueAt
+                  · simpa [rootsForCapabilities] using invariant.ownership
+                  · intro index actualWorld actualLender selected
+                      capabilityAt' selectedAt
+                    cases index with
+                    | zero =>
+                        simp [Array.getElem?_append] at capabilityAt' selectedAt
+                        rcases capabilityAt' with ⟨rfl, rfl⟩
+                        subst selected
+                        exact BorrowProvenance.prependUnchanged
+                          (IxIR1.Sim.StoreGraphExtends.refl store) forgets
+                          afterOwners
+                          (invariant.borrows capabilityAt sourceAt)
+                    | succ index =>
+                        simp [Array.getElem?_append] at capabilityAt' selectedAt
+                        exact BorrowProvenance.prependUnchanged
+                          (IxIR1.Sim.StoreGraphExtends.refl store) forgets
+                          afterOwners
+                          (invariant.borrows capabilityAt' selectedAt)
+              | owned world =>
+                  simp only [Lower.moveCapabilities?,
+                    Lower.sourceCapability?, capabilityAt] at transition
+                  cases retiredEq : Lower.retireOwnerCapabilities?
+                      capabilities input sourceIndex with
+                  | none => simp [retiredEq] at transition
+                  | some remaining =>
+                      simp only [retiredEq, Option.map_some,
+                        Option.some.injEq] at transition
+                      subst afterCapabilities
+                      obtain ⟨remainingHolds, movedRoot⟩ :=
+                        retireOwnerCapabilities_ownership invariant.holds
+                          capabilityAt sourceAt retiredEq
+                      have remainingSize : remaining.size = capabilities.size :=
+                        Lower.retireOwnerCapabilities?_size retiredEq
+                      refine ⟨by simp [Array.size_append, remainingSize,
+                        invariant.length, Nat.add_comm], ?_, ?_, ?_⟩
+                      · intro index capability selected capabilityAt' selectedAt
+                        cases index with
+                        | zero =>
+                            simp [Array.getElem?_append] at capabilityAt' selectedAt
+                            subst capability
+                            subst selected
+                            exact invariant.holds capabilityAt sourceAt
+                        | succ index =>
+                            simp [Array.getElem?_append] at capabilityAt' selectedAt
+                            exact remainingHolds capabilityAt' selectedAt
+                      · apply invariant.ownership.perm
+                        simpa [rootsForCapabilities, List.append_assoc] using
+                          movedRoot.symm.append_right frameRoots
+                      · intro index actualWorld lender selected capabilityAt'
+                          selectedAt
+                        cases index with
+                        | zero =>
+                            simp [Array.getElem?_append] at capabilityAt'
+                        | succ index =>
+                            simp [Array.getElem?_append] at capabilityAt' selectedAt
+                            have remainingProvenance :=
+                              retireOwnerCapabilities_borrows invariant.borrows
+                                capabilityAt retiredEq capabilityAt' selectedAt
+                            exact BorrowProvenance.prependUnchanged
+                              (IxIR1.Sim.StoreGraphExtends.refl store) forgets
+                              afterOwners remainingProvenance
+
+/-- The exact producer `dup`/`retainShared` capability effect preserves
+dynamic source ownership. A borrowed shared value gains its first external
+root; an owned shared value gains a second root; scalars are ownership-inert.
+-/
+theorem dup {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {atom : IxIR1.Atom} {value : RVal}
+    (resolved : IxIR1.resolveAtom source atom = .ok value)
+    (transition : Lower.dupCapabilities? capabilities atom =
+      some afterCapabilities)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent store
+      source (.dup atom) = .ok (outputStore, value)) :
+    SourceOwnershipInvariant outputStore (value :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨selected, selectedResolved, selectedOutput⟩ :=
+    IxIR1.runOp_dup_success operationRun
+  have selectedEq : selected = value := by
+    exact Except.ok.inj (selectedResolved.symm.trans resolved)
+  subst selected
+  cases atom with
+  | lit literal =>
+      simp only [Lower.dupCapabilities?, Lower.sourceCapability?] at transition
+      injection transition with afterEq
+      subst afterCapabilities
+      have valueEq : value = .lit literal := by
+        simpa [IxIR1.resolveAtom] using resolved.symm
+      subst value
+      have outputEq : (outputStore, IxIR1.RVal.lit literal) =
+          (store, IxIR1.RVal.lit literal) := selectedOutput
+      have storeEq : outputStore = store := congrArg Prod.fst outputEq
+      subst outputStore
+      refine ⟨by simp [Array.size_append, Nat.add_comm, invariant.length],
+        ?_, ?_, ?_⟩
+      · intro index capability value capabilityAt valueAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            subst capability
+            subst value
+            trivial
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            exact invariant.holds capabilityAt valueAt
+      · simpa [rootsForCapabilities] using invariant.ownership
+      · exact BorrowProvenance.prependNonBorrowed
+          (IxIR1.Sim.StoreGraphExtends.refl store) invariant.borrows
+          (by intros; simp) forgets afterOwners
+  | erased =>
+      simp only [Lower.dupCapabilities?, Lower.sourceCapability?] at transition
+      injection transition with afterEq
+      subst afterCapabilities
+      have valueEq : value = .erased := by
+        simpa [IxIR1.resolveAtom] using resolved.symm
+      subst value
+      have outputEq : (outputStore, IxIR1.RVal.erased) =
+          (store, IxIR1.RVal.erased) := selectedOutput
+      have storeEq : outputStore = store := congrArg Prod.fst outputEq
+      subst outputStore
+      refine ⟨by simp [Array.size_append, Nat.add_comm, invariant.length],
+        ?_, ?_, ?_⟩
+      · intro index capability value capabilityAt valueAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            subst capability
+            subst value
+            trivial
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt valueAt
+            exact invariant.holds capabilityAt valueAt
+      · simpa [rootsForCapabilities] using invariant.ownership
+      · exact BorrowProvenance.prependNonBorrowed
+          (IxIR1.Sim.StoreGraphExtends.refl store) invariant.borrows
+          (by intros; simp) forgets afterOwners
+  | var sourceIndex =>
+      cases sourceAt : source[sourceIndex]? with
+      | none => simp [IxIR1.resolveAtom, sourceAt] at resolved
+      | some found =>
+          have valueEq : found = value := by
+            simpa [IxIR1.resolveAtom, sourceAt] using resolved
+          subst found
+          cases capabilityAt : capabilities[sourceIndex]? with
+          | none =>
+              simp [Lower.dupCapabilities?, Lower.sourceCapability?,
+                capabilityAt] at transition
+          | some capability =>
+              cases capability with
+              | dead =>
+                  simp [Lower.dupCapabilities?, Lower.sourceCapability?,
+                    capabilityAt] at transition
+              | owned world =>
+                  cases world with
+                  | unique =>
+                      simp [Lower.dupCapabilities?, Lower.sourceCapability?,
+                        capabilityAt] at transition
+                  | shared =>
+                      simp only [Lower.dupCapabilities?,
+                        Lower.sourceCapability?, capabilityAt] at transition
+                      injection transition with afterEq
+                      subst afterCapabilities
+                      have sourceBound : sourceIndex < capabilities.size :=
+                        (Array.getElem?_eq_some_iff.mp capabilityAt).1
+                      cases value with
+                      | lit literal =>
+                          have outputEq : (outputStore, IxIR1.RVal.lit literal) =
+                              (store, IxIR1.RVal.lit literal) := selectedOutput
+                          have storeEq : outputStore = store :=
+                            congrArg Prod.fst outputEq
+                          subst outputStore
+                          refine ⟨by simp [Array.size_append, Nat.add_comm,
+                            invariant.length], ?_, ?_, ?_⟩
+                          · intro index capability value capabilityAt' valueAt
+                            cases index with
+                            | zero =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                subst capability
+                                subst value
+                                trivial
+                            | succ index =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                exact invariant.holds capabilityAt' valueAt
+                          · simpa [rootsForCapabilities] using
+                              invariant.ownership.addNoLocation rfl
+                          · exact BorrowProvenance.prependNonBorrowed
+                              (IxIR1.Sim.StoreGraphExtends.refl store)
+                              invariant.borrows (by intros; simp) forgets
+                              afterOwners
+                      | erased =>
+                          have outputEq : (outputStore, IxIR1.RVal.erased) =
+                              (store, IxIR1.RVal.erased) := selectedOutput
+                          have storeEq : outputStore = store :=
+                            congrArg Prod.fst outputEq
+                          subst outputStore
+                          refine ⟨by simp [Array.size_append, Nat.add_comm,
+                            invariant.length], ?_, ?_, ?_⟩
+                          · intro index capability value capabilityAt' valueAt
+                            cases index with
+                            | zero =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                subst capability
+                                subst value
+                                trivial
+                            | succ index =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                exact invariant.holds capabilityAt' valueAt
+                          · simpa [rootsForCapabilities] using
+                              invariant.ownership.addNoLocation rfl
+                          · exact BorrowProvenance.prependNonBorrowed
+                              (IxIR1.Sim.StoreGraphExtends.refl store)
+                              invariant.borrows (by intros; simp) forgets
+                              afterOwners
+                      | loc location =>
+                          obtain ⟨box, foundBox, shared, outputEq⟩ :=
+                            selectedOutput
+                          cases box with
+                          | mk boxWorld rc node =>
+                              change boxWorld = .shared at shared
+                              subst boxWorld
+                              have storeEq : outputStore =
+                                  IxIR1.Sim.incRcStore store location
+                                    ⟨.shared, rc, node⟩ := by
+                                simpa [IxIR1.Sim.incRcStore] using
+                                  congrArg Prod.fst outputEq
+                              subst outputStore
+                              refine ⟨by simp [Array.size_append, Nat.add_comm,
+                                invariant.length], ?_, ?_, ?_⟩
+                              · intro index capability value capabilityAt' valueAt
+                                cases index with
+                                | zero =>
+                                    simp [Array.getElem?_append] at capabilityAt' valueAt
+                                    subst capability
+                                    subst value
+                                    exact IxIR1.Sim.HasWorld.incRcStore foundBox
+                                      (invariant.holds capabilityAt sourceAt)
+                                | succ index =>
+                                    simp [Array.getElem?_append] at capabilityAt' valueAt
+                                    exact (invariant.holds capabilityAt' valueAt).incRcStore
+                                      foundBox
+                              · have movedRoot := rootsForCapabilities_setDead_perm
+                                  (capabilities := capabilities.toList)
+                                  (source := source) (index := sourceIndex)
+                                      (world := .shared)
+                                      (value := IxIR1.RVal.loc location)
+                                  (by simpa using capabilityAt)
+                                  (by simpa using sourceAt)
+                                have oldFirst := invariant.ownership.perm
+                                  (by
+                                    simpa [Array.toList_setIfInBounds,
+                                      rootsForCapabilities,
+                                      List.append_assoc] using
+                                        movedRoot.symm.append_right frameRoots)
+                                have duplicated := oldFirst.dup foundBox
+                                apply duplicated.perm
+                                simpa [Array.toList_setIfInBounds,
+                                  rootsForCapabilities,
+                                  List.append_assoc] using
+                                    (List.Perm.cons
+                                      (⟨.shared, IxIR1.RVal.loc location⟩ : IxIR1.Sim.Root)
+                                      movedRoot).append_right frameRoots
+                              · exact BorrowProvenance.prependNonBorrowed
+                                  (IxIR1.Sim.StoreGraphExtends.incRcStore
+                                    foundBox) invariant.borrows
+                                  (by intros; simp) forgets afterOwners
+              | borrowed world lender =>
+                  cases world with
+                  | unique =>
+                      simp [Lower.dupCapabilities?, Lower.sourceCapability?,
+                        capabilityAt] at transition
+                  | shared =>
+                      simp only [Lower.dupCapabilities?,
+                        Lower.sourceCapability?, capabilityAt] at transition
+                      injection transition with afterEq
+                      subst afterCapabilities
+                      cases value with
+                      | lit literal =>
+                          have outputEq : (outputStore, IxIR1.RVal.lit literal) =
+                              (store, IxIR1.RVal.lit literal) := selectedOutput
+                          have storeEq : outputStore = store :=
+                            congrArg Prod.fst outputEq
+                          subst outputStore
+                          refine ⟨by simp [Array.size_append, Nat.add_comm,
+                            invariant.length], ?_, ?_, ?_⟩
+                          · intro index capability value capabilityAt' valueAt
+                            cases index with
+                            | zero =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                subst capability
+                                subst value
+                                trivial
+                            | succ index =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                exact invariant.holds capabilityAt' valueAt
+                          · simpa [rootsForCapabilities] using
+                              invariant.ownership.addNoLocation rfl
+                          · exact BorrowProvenance.prependNonBorrowed
+                              (IxIR1.Sim.StoreGraphExtends.refl store)
+                              invariant.borrows (by intros; simp) forgets
+                              afterOwners
+                      | erased =>
+                          have outputEq : (outputStore, IxIR1.RVal.erased) =
+                              (store, IxIR1.RVal.erased) := selectedOutput
+                          have storeEq : outputStore = store :=
+                            congrArg Prod.fst outputEq
+                          subst outputStore
+                          refine ⟨by simp [Array.size_append, Nat.add_comm,
+                            invariant.length], ?_, ?_, ?_⟩
+                          · intro index capability value capabilityAt' valueAt
+                            cases index with
+                            | zero =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                subst capability
+                                subst value
+                                trivial
+                            | succ index =>
+                                simp [Array.getElem?_append] at capabilityAt' valueAt
+                                exact invariant.holds capabilityAt' valueAt
+                          · simpa [rootsForCapabilities] using
+                              invariant.ownership.addNoLocation rfl
+                          · exact BorrowProvenance.prependNonBorrowed
+                              (IxIR1.Sim.StoreGraphExtends.refl store)
+                              invariant.borrows (by intros; simp) forgets
+                              afterOwners
+                      | loc location =>
+                          obtain ⟨box, foundBox, shared, outputEq⟩ :=
+                            selectedOutput
+                          cases box with
+                          | mk boxWorld rc node =>
+                              change boxWorld = .shared at shared
+                              subst boxWorld
+                              have storeEq : outputStore =
+                                  IxIR1.Sim.incRcStore store location
+                                    ⟨.shared, rc, node⟩ := by
+                                simpa [IxIR1.Sim.incRcStore] using
+                                  congrArg Prod.fst outputEq
+                              subst outputStore
+                              refine ⟨by simp [Array.size_append, Nat.add_comm,
+                                invariant.length], ?_, ?_, ?_⟩
+                              · intro index capability value capabilityAt' valueAt
+                                cases index with
+                                | zero =>
+                                    simp [Array.getElem?_append] at capabilityAt' valueAt
+                                    subst capability
+                                    subst value
+                                    exact IxIR1.Sim.HasWorld.incRcStore foundBox
+                                      (invariant.holds capabilityAt sourceAt)
+                                | succ index =>
+                                    simp [Array.getElem?_append] at capabilityAt' valueAt
+                                    exact (invariant.holds capabilityAt' valueAt).incRcStore
+                                      foundBox
+                              · simpa [rootsForCapabilities] using
+                                  invariant.ownership.retainShared foundBox
+                              · exact BorrowProvenance.prependNonBorrowed
+                                  (IxIR1.Sim.StoreGraphExtends.incRcStore
+                                    foundBox) invariant.borrows
+                                  (by intros; simp) forgets afterOwners
+              | scalar =>
+                  simp only [Lower.dupCapabilities?, Lower.sourceCapability?,
+                    capabilityAt] at transition
+                  injection transition with afterEq
+                  subst afterCapabilities
+                  have scalarHolds := invariant.holds capabilityAt sourceAt
+                  cases value with
+                  | loc location =>
+                      simp [CapabilityHolds, IxIR1.Sim.rvalLocation?] at scalarHolds
+                  | lit literal =>
+                      have outputEq : (outputStore, IxIR1.RVal.lit literal) =
+                          (store, IxIR1.RVal.lit literal) := selectedOutput
+                      have storeEq : outputStore = store :=
+                        congrArg Prod.fst outputEq
+                      subst outputStore
+                      refine ⟨by simp [Array.size_append, Nat.add_comm,
+                        invariant.length], ?_, ?_, ?_⟩
+                      · intro index capability value capabilityAt' valueAt
+                        cases index with
+                        | zero =>
+                            simp [Array.getElem?_append] at capabilityAt' valueAt
+                            subst capability
+                            subst value
+                            exact scalarHolds
+                        | succ index =>
+                            simp [Array.getElem?_append] at capabilityAt' valueAt
+                            exact invariant.holds capabilityAt' valueAt
+                      · simpa [rootsForCapabilities] using invariant.ownership
+                      · exact BorrowProvenance.prependNonBorrowed
+                          (IxIR1.Sim.StoreGraphExtends.refl store)
+                          invariant.borrows (by intros; simp) forgets
+                          afterOwners
+                  | erased =>
+                      have outputEq : (outputStore, IxIR1.RVal.erased) =
+                          (store, IxIR1.RVal.erased) := selectedOutput
+                      have storeEq : outputStore = store :=
+                        congrArg Prod.fst outputEq
+                      subst outputStore
+                      refine ⟨by simp [Array.size_append, Nat.add_comm,
+                        invariant.length], ?_, ?_, ?_⟩
+                      · intro index capability value capabilityAt' valueAt
+                        cases index with
+                        | zero =>
+                            simp [Array.getElem?_append] at capabilityAt' valueAt
+                            subst capability
+                            subst value
+                            exact scalarHolds
+                        | succ index =>
+                            simp [Array.getElem?_append] at capabilityAt' valueAt
+                            exact invariant.holds capabilityAt' valueAt
+                      · simpa [rootsForCapabilities] using invariant.ownership
+                      · exact BorrowProvenance.prependNonBorrowed
+                          (IxIR1.Sim.StoreGraphExtends.refl store)
+                          invariant.borrows (by intros; simp) forgets
+                          afterOwners
+
+/-- The baseline-compatible producer `fetch` effect preserves exact dynamic
+ownership.  The parent capability proves the selected edge inhabits the
+constructor world; the new borrowed head contributes no external root. -/
+theorem fetch {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {sourceAtom : IxIR1.Atom} {sourceField : Nat} {targetAtom : Atom}
+    {value : RVal}
+    (translated : Lower.InputMap.translateAtom input sourceAtom =
+      some targetAtom)
+    (transition : Lower.fetchCapabilities? capabilities sourceAtom targetAtom =
+      some afterCapabilities)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.fetch sourceAtom sourceField) =
+        .ok (outputStore, value)) :
+    SourceOwnershipInvariant outputStore (value :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨location, box, identity, fields, runtimeValue, sourceResolved,
+      sourceGet, node, fieldAt, outputEq⟩ :=
+    IxIR1.runOp_fetch_success operationRun
+  have storeEq : outputStore = store := congrArg Prod.fst outputEq
+  have valueEq : value = runtimeValue := congrArg Prod.snd outputEq
+  subst outputStore
+  subst runtimeValue
+  have prependBorrowed : ∀ {world lender},
+      IxIR1.Sim.HasWorld store world (.loc location) →
+      BorrowProvenance store source input capabilities frameRoots world lender
+        (.loc location) →
+      OwnedInputRegisters afterInput
+        (#[.borrowed world lender] ++ capabilities) →
+      SourceOwnershipInvariant store (value :: source)
+        afterInput (#[.borrowed world lender] ++ capabilities)
+        frameRoots := by
+    intro world lender parentWorld parentProvenance successorOwners
+    obtain ⟨parentBox, parentGet, parentWorldEq⟩ := parentWorld
+    have parentBoxEq : parentBox = box :=
+      Option.some.inj (parentGet.symm.trans sourceGet)
+    subst parentBox
+    have resultWorld : IxIR1.Sim.HasWorld store world value := by
+      have fieldMember : value ∈ fields :=
+        (Array.mem_iff_getElem?).2 ⟨sourceField, fieldAt⟩
+      have childMember : value ∈ IxIR1.Sim.nodeChildren box.node := by
+        rw [node]
+        simpa [IxIR1.Sim.nodeChildren] using fieldMember
+      have edgeWorld := invariant.ownership.edges_world sourceGet value
+        childMember
+      simpa [parentWorldEq] using edgeWorld
+    have fieldMember : value ∈ fields :=
+      (Array.mem_iff_getElem?).2 ⟨sourceField, fieldAt⟩
+    have childMember : value ∈ IxIR1.Sim.nodeChildren box.node := by
+      rw [node]
+      simpa [IxIR1.Sim.nodeChildren] using fieldMember
+    refine ⟨by simp [Array.size_append, Nat.add_comm, invariant.length],
+      ?_, ?_, ?_⟩
+    · intro index capability selectedValue capabilityAt valueAt
+      cases index with
+      | zero =>
+          simp [Array.getElem?_append] at capabilityAt valueAt
+          subst capability
+          subst selectedValue
+          exact resultWorld
+      | succ index =>
+          simp [Array.getElem?_append] at capabilityAt valueAt
+          exact invariant.holds capabilityAt valueAt
+    · simpa [rootsForCapabilities] using invariant.ownership
+    · intro index actualWorld actualLender selected capabilityAt selectedAt
+      cases index with
+      | zero =>
+          simp [Array.getElem?_append] at capabilityAt selectedAt
+          rcases capabilityAt with ⟨rfl, rfl⟩
+          subst selected
+          exact BorrowProvenance.prependUnchanged
+            (IxIR1.Sim.StoreGraphExtends.refl store) forgets successorOwners
+            (BorrowProvenance.child parentProvenance sourceGet childMember)
+      | succ index =>
+          simp [Array.getElem?_append] at capabilityAt selectedAt
+          exact BorrowProvenance.prependUnchanged
+            (IxIR1.Sim.StoreGraphExtends.refl store) forgets successorOwners
+            (invariant.borrows capabilityAt selectedAt)
+  cases sourceAtom with
+  | lit literal =>
+      simp [IxIR1.resolveAtom] at sourceResolved
+  | erased =>
+      simp [IxIR1.resolveAtom] at sourceResolved
+  | var sourceIndex =>
+      cases sourceAt : source[sourceIndex]? with
+      | none => simp [IxIR1.resolveAtom, sourceAt] at sourceResolved
+      | some found =>
+          have foundEq : found = .loc location := by
+            simpa [IxIR1.resolveAtom, sourceAt] using sourceResolved
+          subst found
+          cases capabilityAt : capabilities[sourceIndex]? with
+          | none =>
+              simp [Lower.fetchCapabilities?, Lower.sourceCapability?,
+                capabilityAt] at transition
+          | some capability =>
+              cases capability with
+              | scalar =>
+                  simp [Lower.fetchCapabilities?, Lower.sourceCapability?,
+                    capabilityAt] at transition
+              | dead =>
+                  simp [Lower.fetchCapabilities?, Lower.sourceCapability?,
+                    capabilityAt] at transition
+              | owned world =>
+                  cases targetAtom with
+                  | lit literal =>
+                      simp [Lower.fetchCapabilities?, Lower.sourceCapability?,
+                        capabilityAt] at transition
+                  | erased =>
+                      simp [Lower.fetchCapabilities?, Lower.sourceCapability?,
+                        capabilityAt] at transition
+                  | reg id =>
+                      simp only [Lower.fetchCapabilities?,
+                        Lower.sourceCapability?, capabilityAt] at transition
+                      injection transition with afterEq
+                      subst afterCapabilities
+                      have inputAt : input[sourceIndex]? =
+                          some (some (.reg id)) := by
+                        cases foundInput : input[sourceIndex]? with
+                        | none =>
+                            simp [Lower.InputMap.translateAtom, foundInput]
+                              at translated
+                        | some slot =>
+                            cases slot with
+                            | none =>
+                                simp [Lower.InputMap.translateAtom, foundInput]
+                                  at translated
+                            | some actual =>
+                                have actualEq : actual = .reg id := by
+                                  simpa [Lower.InputMap.translateAtom,
+                                    foundInput] using translated
+                                subst actual
+                                rfl
+                      have parentProvenance : BorrowProvenance store source
+                          input capabilities frameRoots world (.value id)
+                          (.loc location) :=
+                        ⟨sourceIndex, .loc location, inputAt, capabilityAt,
+                          sourceAt, .refl⟩
+                      exact prependBorrowed
+                        (invariant.holds capabilityAt sourceAt)
+                        parentProvenance afterOwners
+              | borrowed world lender =>
+                  simp only [Lower.fetchCapabilities?,
+                    Lower.sourceCapability?, capabilityAt] at transition
+                  injection transition with afterEq
+                  subst afterCapabilities
+                  exact prependBorrowed
+                    (invariant.holds capabilityAt sourceAt)
+                    (invariant.borrows capabilityAt sourceAt) afterOwners
+
+end SourceOwnershipInvariant
+
+namespace SourceOwnershipAt
+
+/-- A checked `pure`/`move` node transports the trace-indexed dynamic
+ownership invariant to its exact recursive continuation. -/
+theorem pure {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {store : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next) store source
+          frameRoots)
+    (resolved : IxIR1.resolveAtom source sourceAtom = .ok value) :
+    SourceOwnershipAt checked.artifact.trace.positions next store
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.pureTransition functionMember descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some (.reg entryValueCount)] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.moveMatches at transitionMatch
+  cases transitionEq : Lower.moveCapabilities?
+      before.sourceCapabilities input sourceAtom with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.move forgets afterOwners resolved
+      simpa [expectedEq] using transitionEq
+
+/-- A checked `dup`/`retainShared` node transports trace-indexed dynamic
+ownership to its exact recursive continuation. -/
+theorem dup {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next) store source
+          frameRoots)
+    (resolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source (.dup sourceAtom) =
+        .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.dupTransition functionMember descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some (.reg entryValueCount)] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.dupMatches at transitionMatch
+  cases transitionEq : Lower.dupCapabilities?
+      before.sourceCapabilities sourceAtom with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.dup forgets afterOwners resolved
+        (sourceFuel := sourceFuel)
+        (operationRun := operationRun)
+      simpa [expectedEq] using transitionEq
+
+/-- A checked `fetch` node transports trace-indexed dynamic ownership to its
+exact recursive continuation without an external transition premise. -/
+theorem fetch {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {sourceField : Nat}
+    {targetAtom : Atom} {targetCid : IxIR1.CtorId} {targetField : Nat}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+          (.fetch targetAtom targetCid targetField) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+          (.fetch targetAtom targetCid targetField) next) store source
+            frameRoots)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source (.fetch sourceAtom sourceField) =
+        .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.fetchTransition functionMember descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some (.reg entryValueCount)] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  have translated :=
+    (functionTrace.descendantOperationSyntax descendant).2
+  unfold Lower.PositionTrace.fetchMatches at transitionMatch
+  cases transitionEq : Lower.fetchCapabilities?
+      before.sourceCapabilities sourceAtom targetAtom with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.fetch forgets afterOwners translated
+        (sourceFuel := sourceFuel)
+        (operationRun := operationRun)
+      simpa [expectedEq] using transitionEq
+
+end SourceOwnershipAt
+
+namespace SourceOwnershipInvariant
+
+private def sourceResolveStep (source : List RVal)
+    (values : List RVal) (atom : IxIR1.Atom) :
+    Except IxIR1.Err (List RVal) := do
+  pure (values ++ [← IxIR1.resolveAtom source atom])
+
+private inductive SourceAtomsResolve (source : List RVal) :
+    List IxIR1.Atom → List RVal → Prop where
+  | nil : SourceAtomsResolve source [] []
+  | cons (head : IxIR1.resolveAtom source atom = .ok value)
+      (tail : SourceAtomsResolve source atoms values) :
+      SourceAtomsResolve source (atom :: atoms) (value :: values)
+
+namespace SourceAtomsResolve
+
+private theorem ofFoldlM {source : List RVal} :
+    ∀ atoms accumulator output,
+      atoms.foldlM (sourceResolveStep source) accumulator = .ok output →
+      ∃ values, SourceAtomsResolve source atoms values ∧
+        output = accumulator ++ values := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro accumulator output run
+      simp only [List.foldlM_nil, pure, Except.pure] at run
+      injection run with outputEq
+      subst output
+      exact ⟨[], .nil, by simp⟩
+  | cons atom atoms ih =>
+      intro accumulator output run
+      simp only [List.foldlM_cons] at run
+      cases headRun : IxIR1.resolveAtom source atom with
+      | error error =>
+          have step : sourceResolveStep source accumulator atom =
+              .error error := by
+            simp [sourceResolveStep, headRun, bind, Except.bind]
+          rw [step] at run
+          simp only [bind, Except.bind] at run
+          contradiction
+      | ok value =>
+          have step : sourceResolveStep source accumulator atom =
+              .ok (accumulator ++ [value]) := by
+            simp [sourceResolveStep, headRun, bind, Except.bind,
+              pure, Except.pure]
+          rw [step] at run
+          simp only [bind, Except.bind] at run
+          obtain ⟨values, valuesRun, outputEq⟩ :=
+            ih (accumulator ++ [value]) output run
+          refine ⟨value :: values, .cons headRun valuesRun, ?_⟩
+          rw [outputEq]
+          simp [List.append_assoc]
+
+private theorem ofResolveAtoms {source : List RVal}
+    {atoms : Array IxIR1.Atom} {values : List RVal}
+    (resolved : IxIR1.resolveAtoms source atoms = .ok values) :
+    SourceAtomsResolve source atoms.toList values := by
+  unfold IxIR1.resolveAtoms at resolved
+  rw [← Array.foldlM_toList] at resolved
+  change atoms.toList.foldlM (sourceResolveStep source) [] =
+    .ok values at resolved
+  obtain ⟨found, relation, valuesEq⟩ :=
+    ofFoldlM atoms.toList [] values resolved
+  simp only [List.nil_append] at valuesEq
+  subst found
+  exact relation
+
+private theorem length {source : List RVal} {atoms : List IxIR1.Atom}
+    {values : List RVal} (resolved : SourceAtomsResolve source atoms values) :
+    atoms.length = values.length := by
+  induction resolved with
+  | nil => rfl
+  | cons _ _ ih => simp [ih]
+
+private theorem worlds {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {world : Ix.Compiler.Ixon.Owned} :
+    ∀ {atoms values}, SourceAtomsResolve source atoms values →
+      (∀ atom ∈ atoms,
+        ∃ capability,
+          Lower.sourceCapability? capabilities atom = some capability ∧
+            capability.canConsume world = true) →
+      ∀ value ∈ values, IxIR1.Sim.HasWorld store world value := by
+  intro atoms values relation
+  induction relation with
+  | nil => simp
+  | @cons atom value atoms values head tail ih =>
+      intro accepted candidate member
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal =>
+          subst candidate
+          obtain ⟨capability, capabilityAt, canConsume⟩ :=
+            accepted atom (by simp)
+          exact invariant.resolveAtom_hasWorld capabilityAt canConsume head
+      | inr member =>
+          apply ih
+          · intro tailAtom tailMember
+            exact accepted tailAtom (by simp [tailMember])
+          · exact member
+
+end SourceAtomsResolve
+
+/-- One exact producer consumption moves the selected ownership token behind
+an arbitrary already-consumed prefix. Scalar arguments are admitted as inert
+roots; owned variables are removed from their source slot by permutation. -/
+private theorem consumeCapability_ownership
+    {store : IxIR1.Store} {source : List RVal}
+    {capabilities remaining : Array Lower.BindingCap}
+    {input : Array (Option Atom)}
+    {world : Ix.Compiler.Ixon.Owned} {atom : IxIR1.Atom} {value : RVal}
+    {consumedRoots : List IxIR1.Sim.Root}
+    {suffixRoots : List IxIR1.Sim.Root}
+    (holds : ∀ {index : Nat} {capability : Lower.BindingCap}
+        {selected : RVal},
+      capabilities[index]? = some capability →
+      source[index]? = some selected →
+      CapabilityHolds store capability selected)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (consumedRoots ++ rootsForCapabilities capabilities.toList source ++
+        suffixRoots))
+    (resolved : IxIR1.resolveAtom source atom = .ok value)
+    (consumed : Lower.consumeCapability? capabilities input world atom =
+      some remaining) :
+    (∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+        remaining[index]? = some capability →
+        source[index]? = some selected →
+        CapabilityHolds store capability selected) ∧
+      IxIR1.Sim.RootOwnership store
+        (consumedRoots ++ [(⟨world, value⟩ : IxIR1.Sim.Root)] ++
+          rootsForCapabilities remaining.toList source ++ suffixRoots) := by
+  have addScalar (scalar : IxIR1.Sim.rvalLocation? value = none) :
+      IxIR1.Sim.RootOwnership store
+        (consumedRoots ++ [(⟨world, value⟩ : IxIR1.Sim.Root)] ++
+          rootsForCapabilities capabilities.toList source ++ suffixRoots) := by
+    have added := ownership.addNoLocation (world := world) scalar
+    apply added.perm
+    simpa [List.append_assoc] using
+      (List.perm_append_comm
+        (l₁ := [(⟨world, value⟩ : IxIR1.Sim.Root)])
+        (l₂ := consumedRoots)).append_right
+          (rootsForCapabilities capabilities.toList source ++ suffixRoots)
+  cases atom with
+  | lit literal =>
+      simp only [Lower.consumeCapability?, Lower.sourceCapability?] at consumed
+      injection consumed with remainingEq
+      subst remaining
+      have valueEq : value = .lit literal := by
+        simpa [IxIR1.resolveAtom] using resolved.symm
+      subst value
+      exact ⟨holds, addScalar rfl⟩
+  | erased =>
+      simp only [Lower.consumeCapability?, Lower.sourceCapability?] at consumed
+      injection consumed with remainingEq
+      subst remaining
+      have valueEq : value = .erased := by
+        simpa [IxIR1.resolveAtom] using resolved.symm
+      subst value
+      exact ⟨holds, addScalar rfl⟩
+  | var sourceIndex =>
+      cases sourceAt : source[sourceIndex]? with
+      | none => simp [IxIR1.resolveAtom, sourceAt] at resolved
+      | some found =>
+          have foundEq : found = value := by
+            simpa [IxIR1.resolveAtom, sourceAt] using resolved
+          subst found
+          cases capabilityAt : capabilities[sourceIndex]? with
+          | none =>
+              simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                capabilityAt] at consumed
+          | some capability =>
+              cases capability with
+              | borrowed actual lender =>
+                  simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                    capabilityAt] at consumed
+              | dead =>
+                  simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                    capabilityAt] at consumed
+              | scalar =>
+                  simp only [Lower.consumeCapability?,
+                    Lower.sourceCapability?, capabilityAt] at consumed
+                  injection consumed with remainingEq
+                  subst remaining
+                  have scalarHolds := holds capabilityAt sourceAt
+                  exact ⟨holds, addScalar (by
+                    simpa [CapabilityHolds] using scalarHolds)⟩
+              | owned actual =>
+                  simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                    capabilityAt] at consumed
+                  obtain ⟨actualEq, remainingEq⟩ := consumed
+                  subst actual
+                  obtain ⟨remainingHolds, movedRoot⟩ :=
+                    retireOwnerCapabilities_ownership holds capabilityAt
+                      sourceAt remainingEq
+                  refine ⟨remainingHolds, ?_⟩
+                  apply ownership.perm
+                  simpa [List.append_assoc] using
+                    (movedRoot.symm.append_left consumedRoots).append_right
+                      suffixRoots
+
+/-- One owned-boundary capability update preserves provenance for every
+borrow that remains live after the update. -/
+private theorem consumeCapability_borrows
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (oldBorrows : ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      capabilities[index]? = some (.borrowed world lender) →
+      source[index]? = some value →
+      BorrowProvenance store source input capabilities frameRoots world lender
+        value)
+    {world : Ix.Compiler.Ixon.Owned} {atom : IxIR1.Atom}
+    (consumed : Lower.consumeCapability? capabilities input world atom =
+      some remaining) :
+    ∀ {index : Nat} {borrowWorld : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      remaining[index]? = some (.borrowed borrowWorld lender) →
+      source[index]? = some value →
+      BorrowProvenance store source input remaining frameRoots borrowWorld
+        lender value := by
+  cases atom with
+  | lit literal =>
+      simp only [Lower.consumeCapability?, Lower.sourceCapability?] at consumed
+      injection consumed with remainingEq
+      subst remaining
+      exact oldBorrows
+  | erased =>
+      simp only [Lower.consumeCapability?, Lower.sourceCapability?] at consumed
+      injection consumed with remainingEq
+      subst remaining
+      exact oldBorrows
+  | var sourceIndex =>
+      cases capabilityAt : capabilities[sourceIndex]? with
+      | none =>
+          simp [Lower.consumeCapability?, Lower.sourceCapability?,
+            capabilityAt] at consumed
+      | some capability =>
+          cases capability with
+          | scalar =>
+              simp only [Lower.consumeCapability?, Lower.sourceCapability?,
+                capabilityAt] at consumed
+              injection consumed with remainingEq
+              subst remaining
+              exact oldBorrows
+          | borrowed borrowWorld lender | dead =>
+              simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                capabilityAt] at consumed
+          | owned actual =>
+              simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                capabilityAt] at consumed
+              obtain ⟨actualEq, remainingEq⟩ := consumed
+              subst actual
+              exact retireOwnerCapabilities_borrows oldBorrows capabilityAt
+                remainingEq
+
+/-- Sequential exact producer consumption accumulates the resolved argument
+roots in source order ahead of the surviving source-owner roots. -/
+private theorem consumeCapabilitiesList_ownership
+    {store : IxIR1.Store} {source : List RVal}
+    {capabilities remaining : Array Lower.BindingCap}
+    {input : Array (Option Atom)}
+    {world : Ix.Compiler.Ixon.Owned}
+    {atoms : List IxIR1.Atom} {values : List RVal}
+    {consumedRoots : List IxIR1.Sim.Root}
+    {suffixRoots : List IxIR1.Sim.Root}
+    (holds : ∀ {index : Nat} {capability : Lower.BindingCap}
+        {selected : RVal},
+      capabilities[index]? = some capability →
+      source[index]? = some selected →
+      CapabilityHolds store capability selected)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (consumedRoots ++ rootsForCapabilities capabilities.toList source ++
+        suffixRoots))
+    (resolved : SourceAtomsResolve source atoms values)
+    (consumed : Lower.consumeCapabilitiesList? capabilities input world atoms =
+      some remaining) :
+    (∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+        remaining[index]? = some capability →
+        source[index]? = some selected →
+        CapabilityHolds store capability selected) ∧
+      IxIR1.Sim.RootOwnership store
+        (consumedRoots ++ IxIR1.Sim.rootsFor world values ++
+          rootsForCapabilities remaining.toList source ++ suffixRoots) := by
+  induction resolved generalizing capabilities consumedRoots with
+  | nil =>
+      simp only [Lower.consumeCapabilitiesList?] at consumed
+      injection consumed with remainingEq
+      subst remaining
+      refine ⟨holds, ?_⟩
+      simpa [IxIR1.Sim.rootsFor, List.append_assoc] using ownership
+  | @cons atom value atoms values head tail ih =>
+      simp only [Lower.consumeCapabilitiesList?] at consumed
+      cases step : Lower.consumeCapability? capabilities input world atom with
+      | none => simp [step] at consumed
+      | some nextCapabilities =>
+          simp only [step] at consumed
+          obtain ⟨nextHolds, nextOwnership⟩ :=
+            consumeCapability_ownership holds ownership head step
+          have recursive := ih nextHolds nextOwnership consumed
+          refine ⟨recursive.1, ?_⟩
+          simpa [IxIR1.Sim.rootsFor, List.append_assoc] using recursive.2
+
+/-- Heterogeneous call-argument consumption accumulates one exact root in
+the world of each owned parameter, ahead of the surviving caller roots. -/
+private theorem consumeCapabilitiesWorlds_ownership
+    {store : IxIR1.Store} {source : List RVal}
+    {capabilities remaining : Array Lower.BindingCap}
+    {input : Array (Option Atom)}
+    {worlds : List Ix.Compiler.Ixon.Owned}
+    {atoms : List IxIR1.Atom} {values : List RVal}
+    {consumedRoots suffixRoots : List IxIR1.Sim.Root}
+    (holds : ∀ {index : Nat} {capability : Lower.BindingCap}
+        {selected : RVal},
+      capabilities[index]? = some capability →
+      source[index]? = some selected →
+      CapabilityHolds store capability selected)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (consumedRoots ++ rootsForCapabilities capabilities.toList source ++
+        suffixRoots))
+    (resolved : SourceAtomsResolve source atoms values)
+    (consumed : Lower.consumeCapabilitiesWorlds? capabilities input worlds
+      atoms = some remaining) :
+    (∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+        remaining[index]? = some capability →
+        source[index]? = some selected →
+        CapabilityHolds store capability selected) ∧
+      IxIR1.Sim.RootOwnership store
+        (consumedRoots ++ IxIR1.Sim.rootsForWorlds worlds values ++
+          rootsForCapabilities remaining.toList source ++ suffixRoots) := by
+  induction resolved generalizing capabilities worlds consumedRoots with
+  | nil =>
+      cases worlds with
+      | nil =>
+          simp only [Lower.consumeCapabilitiesWorlds?] at consumed
+          injection consumed with remainingEq
+          subst remaining
+          exact ⟨holds, by simpa [IxIR1.Sim.rootsForWorlds,
+            List.append_assoc] using ownership⟩
+      | cons world worlds =>
+          simp [Lower.consumeCapabilitiesWorlds?] at consumed
+  | @cons atom value atoms values head tail ih =>
+      cases worlds with
+      | nil => simp [Lower.consumeCapabilitiesWorlds?] at consumed
+      | cons world worlds =>
+          simp only [Lower.consumeCapabilitiesWorlds?] at consumed
+          cases step : Lower.consumeCapability? capabilities input world atom with
+          | none => simp [step] at consumed
+          | some nextCapabilities =>
+              simp only [step] at consumed
+              obtain ⟨nextHolds, nextOwnership⟩ :=
+                consumeCapability_ownership holds ownership head step
+              have recursive := ih nextHolds nextOwnership consumed
+              refine ⟨recursive.1, ?_⟩
+              simpa [IxIR1.Sim.rootsForWorlds, List.append_assoc] using
+                recursive.2
+
+/-- Successful projection of the baseline owned call ABI identifies the
+entry capability vector as the reversed parameter-world telescope. -/
+private theorem ownedParameterWorlds?_entryCapabilities
+    {signature : Signature} {worlds : List Ix.Compiler.Ixon.Owned}
+    (projected : Lower.ownedParameterWorlds? signature.params.toList =
+      some worlds) :
+    (Lower.entryCapabilities signature).toList =
+      worlds.reverse.map Lower.BindingCap.owned := by
+  unfold Lower.entryCapabilities
+  have listShape : ∀ {parameters : List Param}
+      {parameterWorlds : List Ix.Compiler.Ixon.Owned},
+      Lower.ownedParameterWorlds? parameters = some parameterWorlds →
+      parameters.map (fun parameter =>
+        match parameter.passing with
+        | .owned => Lower.BindingCap.owned parameter.world
+        | .borrowed => Lower.BindingCap.borrowed parameter.world .caller) =
+        parameterWorlds.map Lower.BindingCap.owned := by
+    intro parameters parameterWorlds projection
+    induction parameters generalizing parameterWorlds with
+    | nil =>
+        simp [Lower.ownedParameterWorlds?] at projection
+        subst parameterWorlds
+        simp
+    | cons parameter rest ih =>
+        rcases parameter with ⟨world, passing⟩
+        cases passing with
+        | borrowed =>
+            simp [Lower.ownedParameterWorlds?] at projection
+        | owned =>
+            simp only [Lower.ownedParameterWorlds?, beq_self_eq_true,
+              if_true] at projection
+            cases restProjection : Lower.ownedParameterWorlds? rest with
+            | none => simp [restProjection] at projection
+            | some restWorlds =>
+                simp only [restProjection, Option.map_some,
+                  Option.some.injEq] at projection
+                subst parameterWorlds
+                simp [ih restProjection]
+  change (signature.params.toList.reverse.map (fun parameter =>
+      match parameter.passing with
+      | .owned => Lower.BindingCap.owned parameter.world
+      | .borrowed => Lower.BindingCap.borrowed parameter.world .caller)) =
+    worlds.reverse.map Lower.BindingCap.owned
+  calc
+    _ = (signature.params.toList.map (fun parameter =>
+        match parameter.passing with
+        | .owned => Lower.BindingCap.owned parameter.world
+        | .borrowed => Lower.BindingCap.borrowed parameter.world
+            .caller)).reverse := List.map_reverse
+    _ = (worlds.map Lower.BindingCap.owned).reverse :=
+      congrArg List.reverse (listShape projected)
+    _ = _ := List.map_reverse.symm
+
+/-- Owned capabilities and a same-length value vector denote the canonical
+heterogeneous root telescope. -/
+private theorem rootsForCapabilities_owned
+    {worlds : List Ix.Compiler.Ixon.Owned} {values : List RVal}
+    (length : worlds.length = values.length) :
+    rootsForCapabilities (worlds.map Lower.BindingCap.owned) values =
+      IxIR1.Sim.rootsForWorlds worlds values := by
+  induction worlds generalizing values with
+  | nil =>
+      cases values with
+      | nil => rfl
+      | cons value values => simp at length
+  | cons world worlds ih =>
+      cases values with
+      | nil => simp at length
+      | cons value values =>
+          simp only [List.length_cons, Nat.succ.injEq] at length
+          simp [rootsForCapabilities, IxIR1.Sim.rootsForWorlds, ih length]
+
+/-- Reversing two same-length heterogeneous telescopes reverses their root
+list without changing any world/value pairing. -/
+private theorem rootsForWorlds_reverse
+    {worlds : List Ix.Compiler.Ixon.Owned} {values : List RVal}
+    (length : worlds.length = values.length) :
+    IxIR1.Sim.rootsForWorlds worlds.reverse values.reverse =
+      (IxIR1.Sim.rootsForWorlds worlds values).reverse := by
+  induction worlds generalizing values with
+  | nil =>
+      cases values with
+      | nil => rfl
+      | cons value values => simp at length
+  | cons world worlds ih =>
+      cases values with
+      | nil => simp at length
+      | cons value values =>
+          simp only [List.length_cons, Nat.succ.injEq] at length
+          rw [List.reverse_cons, List.reverse_cons]
+          have appendShape : ∀ {leftWorlds : List Ix.Compiler.Ixon.Owned}
+              {leftValues : List RVal},
+              leftWorlds.length = leftValues.length →
+              IxIR1.Sim.rootsForWorlds (leftWorlds ++ [world])
+                  (leftValues ++ [value]) =
+                IxIR1.Sim.rootsForWorlds leftWorlds leftValues ++
+                  [⟨world, value⟩] := by
+            intro leftWorlds leftValues leftLength
+            induction leftWorlds generalizing leftValues with
+            | nil =>
+                cases leftValues with
+                | nil => rfl
+                | cons head tail => simp at leftLength
+            | cons headWorld tailWorlds appendIh =>
+                cases leftValues with
+                | nil => simp at leftLength
+                | cons headValue tailValues =>
+                    simp only [List.length_cons, Nat.succ.injEq] at leftLength
+                    simp [IxIR1.Sim.rootsForWorlds,
+                      appendIh leftLength]
+          rw [appendShape (by simpa using length), ih length]
+          simp [IxIR1.Sim.rootsForWorlds]
+
+/-- The exact entry roots are a presentation-order permutation of the
+source-order call argument roots. -/
+private theorem entryRoots_perm
+    {signature : Signature} {worlds : List Ix.Compiler.Ixon.Owned}
+    {values : List RVal}
+    (projected : Lower.ownedParameterWorlds? signature.params.toList =
+      some worlds)
+    (length : worlds.length = values.length) :
+    (rootsForCapabilities (Lower.entryCapabilities signature).toList
+      values.reverse).Perm (IxIR1.Sim.rootsForWorlds worlds values) := by
+  rw [ownedParameterWorlds?_entryCapabilities projected]
+  rw [rootsForCapabilities_owned (by simpa using length)]
+  rw [rootsForWorlds_reverse length]
+  exact List.reverse_perm _
+
+/-- If the call audit says no local owner survives, the dynamic root
+projection of that capability vector is empty for every source environment. -/
+private theorem rootsForCapabilities_eq_nil_of_noOwnedRoots
+    {capabilities : Array Lower.BindingCap} {source : List RVal}
+    (noOwners : Lower.noOwnedRoots capabilities = true) :
+    rootsForCapabilities capabilities.toList source = [] := by
+  unfold Lower.noOwnedRoots at noOwners
+  have listResult : ∀ (caps : List Lower.BindingCap) (values : List RVal),
+      caps.all (fun capability => !capability.hasOwnedRoot) = true →
+      rootsForCapabilities caps values = [] := by
+    intro caps
+    induction caps with
+    | nil => intro values _; rfl
+    | cons capability rest ih =>
+        intro values noOwners
+        cases values with
+        | nil => simp [rootsForCapabilities]
+        | cons value values =>
+            simp only [List.all_cons, Bool.and_eq_true] at noOwners
+            cases capability with
+            | owned world =>
+                simp [Lower.BindingCap.hasOwnedRoot] at noOwners
+            | scalar =>
+                simpa [rootsForCapabilities] using ih values noOwners.2
+            | borrowed world lender =>
+                simpa [rootsForCapabilities] using ih values noOwners.2
+            | dead =>
+                simpa [rootsForCapabilities] using ih values noOwners.2
+  exact listResult capabilities.toList source noOwners
+
+/-- Exact checked call consumption constructs the complete callee-entry
+ownership invariant. Surviving caller owners become the suspended frame
+suffix; transferred argument owners become the callee's canonical local
+roots. -/
+theorem callEntryInvariant
+    {store : IxIR1.Store} {source : List RVal}
+    {input calleeInput : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {values : List RVal}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (resolved : IxIR1.resolveAtoms source arguments = .ok values)
+    (consumed : Lower.callRemainingCapabilities? capabilities input signature
+      arguments = some remaining) :
+    SourceOwnershipInvariant store values.reverse calleeInput
+      (Lower.entryCapabilities signature)
+      (rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  unfold Lower.callRemainingCapabilities? at consumed
+  cases projectedEq : Lower.ownedParameterWorlds?
+      signature.params.toList with
+  | none => simp [projectedEq] at consumed
+  | some worlds =>
+      simp only [projectedEq, Option.bind_eq_bind, Option.bind_some] at consumed
+      have resolvedRelation := SourceAtomsResolve.ofResolveAtoms resolved
+      have valueLength : arguments.toList.length = values.length :=
+        SourceAtomsResolve.length resolvedRelation
+      have worldLength : worlds.length = arguments.toList.length :=
+        Lower.consumeCapabilitiesWorlds?_length consumed
+      have worldsValuesLength : worlds.length = values.length :=
+        worldLength.trans valueLength
+      obtain ⟨remainingHolds, readyOwnership⟩ :=
+        consumeCapabilitiesWorlds_ownership
+          (consumedRoots := []) (suffixRoots := frameRoots)
+          invariant.holds (by simpa using invariant.ownership)
+          resolvedRelation consumed
+      have entryShape := ownedParameterWorlds?_entryCapabilities projectedEq
+      have entrySize : (Lower.entryCapabilities signature).size =
+          worlds.length := by
+        simpa using congrArg List.length entryShape
+      have entryPerm := entryRoots_perm projectedEq worldsValuesLength
+      have entryOwnership : IxIR1.Sim.RootOwnership store
+          (rootsForCapabilities (Lower.entryCapabilities signature).toList
+              values.reverse ++
+            (rootsForCapabilities remaining.toList source ++ frameRoots)) := by
+        apply readyOwnership.perm
+        simpa [List.append_assoc] using
+          entryPerm.symm.append_right
+            (rootsForCapabilities remaining.toList source ++ frameRoots)
+      refine ⟨?_, ?_, entryOwnership, ?_⟩
+      · simpa using worldsValuesLength.symm.trans entrySize.symm
+      · intro index capability selected capabilityAt selectedAt
+        have capabilityListAt :
+            (Lower.entryCapabilities signature).toList[index]? =
+              some capability := by
+          simpa using capabilityAt
+        have capabilityMember : capability ∈
+            (Lower.entryCapabilities signature).toList :=
+          List.mem_of_getElem? capabilityListAt
+        rw [entryShape] at capabilityMember
+        simp only [List.mem_map] at capabilityMember
+        obtain ⟨world, _, capabilityEq⟩ := capabilityMember
+        subst capability
+        have rootMember := rootsForCapabilities_owned_mem capabilityAt
+          selectedAt
+        exact entryOwnership.roots_world ⟨world, selected⟩
+          (List.mem_append_left _ rootMember)
+      · intro index world lender selected capabilityAt selectedAt
+        have capabilityListAt :
+            (Lower.entryCapabilities signature).toList[index]? =
+              some (.borrowed world lender) := by
+          simpa using capabilityAt
+        have capabilityMember : (.borrowed world lender : Lower.BindingCap) ∈
+            (Lower.entryCapabilities signature).toList :=
+          List.mem_of_getElem? capabilityListAt
+        rw [entryShape] at capabilityMember
+        simp at capabilityMember
+
+/-- Ordinary-call capability consumption preserves the pointwise semantic
+meaning and array shape of every surviving caller slot. This is the exact
+fact needed to justify the caller frame while it is suspended. -/
+theorem callRemainingHolds
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {values : List RVal}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (resolved : IxIR1.resolveAtoms source arguments = .ok values)
+    (consumed : Lower.callRemainingCapabilities? capabilities input signature
+      arguments = some remaining) :
+    remaining.size = capabilities.size ∧
+      ∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+        remaining[index]? = some capability →
+        source[index]? = some selected →
+        CapabilityHolds store capability selected := by
+  unfold Lower.callRemainingCapabilities? at consumed
+  cases projectedEq : Lower.ownedParameterWorlds?
+      signature.params.toList with
+  | none => simp [projectedEq] at consumed
+  | some worlds =>
+      simp only [projectedEq, Option.bind_eq_bind, Option.bind_some] at consumed
+      have resolvedRelation := SourceAtomsResolve.ofResolveAtoms resolved
+      obtain ⟨remainingHolds, _⟩ :=
+        consumeCapabilitiesWorlds_ownership
+          (consumedRoots := []) (suffixRoots := frameRoots)
+          invariant.holds (by simpa using invariant.ownership)
+          resolvedRelation consumed
+      exact ⟨Lower.consumeCapabilitiesWorlds?_size consumed, remainingHolds⟩
+
+/-- Dynamic-application capability consumption exposes the exact shared
+root multiset consumed by the function and argument operands.  The surviving
+capability roots and framed roots remain as an explicit suffix, so evaluator
+progress can be reconstructed without assuming a source execution. -/
+theorem applyInputOwnership
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities afterFunction remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {function : IxIR1.Atom} {functionValue : RVal}
+    {arguments : Array IxIR1.Atom} {values : List RVal}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (functionResolved : IxIR1.resolveAtom source function = .ok functionValue)
+    (argumentsResolved : IxIR1.resolveAtoms source arguments = .ok values)
+    (functionConsumed : Lower.consumeCapability? capabilities input .shared
+      function = some afterFunction)
+    (argumentsConsumed : Lower.consumeCapabilitiesList? afterFunction input
+      .shared arguments.toList = some remaining) :
+    IxIR1.Sim.RootOwnership store
+      (⟨.shared, functionValue⟩ ::
+        IxIR1.Sim.rootsFor .shared values ++
+          rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  obtain ⟨afterFunctionHolds, afterFunctionOwnership⟩ :=
+    consumeCapability_ownership (consumedRoots := [])
+      (suffixRoots := frameRoots) invariant.holds
+      (by simpa using invariant.ownership) functionResolved functionConsumed
+  have resolvedRelation := SourceAtomsResolve.ofResolveAtoms
+    argumentsResolved
+  obtain ⟨_remainingHolds, readyOwnership⟩ :=
+    consumeCapabilitiesList_ownership
+      (consumedRoots := [(⟨.shared, functionValue⟩ : IxIR1.Sim.Root)])
+      (suffixRoots := frameRoots) afterFunctionHolds
+      (by simpa using afterFunctionOwnership) resolvedRelation
+      argumentsConsumed
+  simpa [List.append_assoc] using readyOwnership
+
+/-- Dynamic-application capability consumption preserves the pointwise
+semantic meaning and array shape of every surviving caller slot. This is the
+shared-function analogue of `callRemainingHolds`, used to justify a caller
+frame suspended while a PAP callee executes. -/
+theorem applyRemainingHolds
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities afterFunction remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {function : IxIR1.Atom} {functionValue : RVal}
+    {arguments : Array IxIR1.Atom} {values : List RVal}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (functionResolved : IxIR1.resolveAtom source function = .ok functionValue)
+    (argumentsResolved : IxIR1.resolveAtoms source arguments = .ok values)
+    (functionConsumed : Lower.consumeCapability? capabilities input .shared
+      function = some afterFunction)
+    (argumentsConsumed : Lower.consumeCapabilitiesList? afterFunction input
+      .shared arguments.toList = some remaining) :
+    remaining.size = capabilities.size ∧
+      ∀ {index : Nat} {capability : Lower.BindingCap} {selected : RVal},
+        remaining[index]? = some capability →
+        source[index]? = some selected →
+        CapabilityHolds store capability selected := by
+  obtain ⟨afterFunctionHolds, afterFunctionOwnership⟩ :=
+    consumeCapability_ownership (consumedRoots := [])
+      (suffixRoots := frameRoots) invariant.holds
+      (by simpa using invariant.ownership) functionResolved functionConsumed
+  have resolvedRelation := SourceAtomsResolve.ofResolveAtoms argumentsResolved
+  obtain ⟨remainingHolds, _⟩ :=
+    consumeCapabilitiesList_ownership
+      (consumedRoots := [(⟨.shared, functionValue⟩ : IxIR1.Sim.Root)])
+      (suffixRoots := frameRoots) afterFunctionHolds
+      (by simpa using afterFunctionOwnership) resolvedRelation
+      argumentsConsumed
+  exact ⟨(Lower.consumeCapabilitiesList?_size argumentsConsumed).trans
+    (Lower.consumeCapability?_size functionConsumed), remainingHolds⟩
+
+/-- A capability vector accepted by the ordinary-call suspension audit has
+no borrowed slot at any index. -/
+private theorem borrowed_impossible_of_noBorrows
+    {capabilities : Array Lower.BindingCap}
+    (noBorrows : Lower.noBorrows capabilities = true)
+    {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+    {lender : BorrowLender}
+    (capabilityAt : capabilities[index]? = some (.borrowed world lender)) :
+    False := by
+  have listAt : capabilities.toList[index]? =
+      some (.borrowed world lender) := by
+    simpa using capabilityAt
+  have member : (.borrowed world lender : Lower.BindingCap) ∈
+      capabilities.toList := List.mem_of_getElem? listAt
+  unfold Lower.noBorrows at noBorrows
+  have point := List.all_eq_true.mp noBorrows _ member
+  simp [Lower.BindingCap.isBorrowed] at point
+
+/-- Reinstall an ordinary caller after its callee returns. Scalar/dead facts
+survive independently of the heap, surviving owners are justified by the
+returned framed root ownership, and the call audit rules out suspended
+borrows. -/
+theorem callResultInvariant
+    {beforeStore afterStore : IxIR1.Store} {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root} {signature : Signature}
+    {arguments : Array IxIR1.Atom} {values : List RVal} {value : RVal}
+    (invariant : SourceOwnershipInvariant beforeStore source input capabilities
+      frameRoots)
+    (resolved : IxIR1.resolveAtoms source arguments = .ok values)
+    (consumed : Lower.callRemainingCapabilities? capabilities input signature
+      arguments = some remaining)
+    (noBorrows : Lower.noBorrows remaining = true)
+    (resultOwnership : IxIR1.Sim.RootOwnership afterStore
+      (⟨signature.result, value⟩ ::
+        (rootsForCapabilities remaining.toList source ++ frameRoots))) :
+    SourceOwnershipInvariant afterStore (value :: source) afterInput
+      (#[.owned signature.result] ++ remaining) frameRoots := by
+  unfold Lower.callRemainingCapabilities? at consumed
+  cases projectedEq : Lower.ownedParameterWorlds?
+      signature.params.toList with
+  | none => simp [projectedEq] at consumed
+  | some worlds =>
+      simp only [projectedEq, Option.bind_eq_bind, Option.bind_some] at consumed
+      have resolvedRelation := SourceAtomsResolve.ofResolveAtoms resolved
+      obtain ⟨remainingHolds, _⟩ := consumeCapabilitiesWorlds_ownership
+        (consumedRoots := []) (suffixRoots := frameRoots) invariant.holds
+        (by simpa using invariant.ownership) resolvedRelation consumed
+      have remainingSize := Lower.consumeCapabilitiesWorlds?_size consumed
+      refine ⟨?_, ?_, ?_, ?_⟩
+      · simp [Array.size_append, remainingSize, invariant.length,
+          Nat.add_comm]
+      · intro index capability selected capabilityAt selectedAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            subst capability
+            subst selected
+            exact resultOwnership.roots_world
+              ⟨signature.result, value⟩ (by simp)
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            cases capability with
+            | scalar =>
+                simpa [CapabilityHolds] using
+                  remainingHolds capabilityAt selectedAt
+            | dead => trivial
+            | borrowed world lender =>
+                exact False.elim
+                  (borrowed_impossible_of_noBorrows noBorrows capabilityAt)
+            | owned world =>
+                exact resultOwnership.roots_world ⟨world, selected⟩ (by
+                  simp [rootsForCapabilities_owned_mem capabilityAt selectedAt])
+      · simpa [rootsForCapabilities, List.append_assoc] using resultOwnership
+      · intro index world lender selected capabilityAt selectedAt
+        cases index with
+        | zero => simp [Array.getElem?_append] at capabilityAt
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            exact False.elim
+              (borrowed_impossible_of_noBorrows noBorrows capabilityAt)
+
+/-- Sequential owned-boundary consumption preserves every surviving borrow's
+exact lender provenance. -/
+private theorem consumeCapabilitiesList_borrows
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (oldBorrows : ∀ {index : Nat} {world : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      capabilities[index]? = some (.borrowed world lender) →
+      source[index]? = some value →
+      BorrowProvenance store source input capabilities frameRoots world lender
+        value)
+    {world : Ix.Compiler.Ixon.Owned} {atoms : List IxIR1.Atom}
+    (consumed : Lower.consumeCapabilitiesList? capabilities input world atoms =
+      some remaining) :
+    ∀ {index : Nat} {borrowWorld : Ix.Compiler.Ixon.Owned}
+        {lender : BorrowLender} {value : RVal},
+      remaining[index]? = some (.borrowed borrowWorld lender) →
+      source[index]? = some value →
+      BorrowProvenance store source input remaining frameRoots borrowWorld
+        lender value := by
+  induction atoms generalizing capabilities with
+  | nil =>
+      simp only [Lower.consumeCapabilitiesList?] at consumed
+      injection consumed with remainingEq
+      subst remaining
+      exact oldBorrows
+  | cons atom atoms ih =>
+      simp only [Lower.consumeCapabilitiesList?] at consumed
+      cases step : Lower.consumeCapability? capabilities input world atom with
+      | none => simp [step] at consumed
+      | some nextCapabilities =>
+          simp only [step] at consumed
+          exact ih (consumeCapability_borrows oldBorrows step) consumed
+
+/-- After one owner has been consumed, a destructive store restriction and
+the exact surviving roots suffice to bind the erased scalar result and rebuild
+all pointwise capability and borrow facts. -/
+private theorem prependScalarAfterRestriction
+    {before after : IxIR1.Store} {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant before source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput
+      (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput
+      (#[.scalar] ++ remaining))
+    {world : Ix.Compiler.Ixon.Owned} {atom : IxIR1.Atom} {value : RVal}
+    (resolved : IxIR1.resolveAtom source atom = .ok value)
+    (consumed : Lower.consumeCapability? capabilities input world atom =
+      some remaining)
+    (restriction : IxIR1.Sim.StoreGraphRestricts before after)
+    (ownership : IxIR1.Sim.RootOwnership after
+      (rootsForCapabilities remaining.toList source ++ frameRoots)) :
+    SourceOwnershipInvariant after (.erased :: source) afterInput
+      (#[.scalar] ++ remaining) frameRoots := by
+  obtain ⟨remainingHolds, _⟩ :=
+    consumeCapability_ownership (consumedRoots := [])
+      (suffixRoots := frameRoots) invariant.holds
+      (by simpa using invariant.ownership) resolved consumed
+  have remainingBorrows :
+      ∀ {index : Nat} {borrowWorld : Ix.Compiler.Ixon.Owned}
+          {lender : BorrowLender} {borrowedValue : RVal},
+        remaining[index]? = some (.borrowed borrowWorld lender) →
+        source[index]? = some borrowedValue →
+        BorrowProvenance before source input remaining frameRoots borrowWorld
+          lender borrowedValue :=
+    consumeCapability_borrows invariant.borrows consumed
+  have postBorrows :
+      ∀ {index : Nat} {borrowWorld : Ix.Compiler.Ixon.Owned}
+          {lender : BorrowLender} {borrowedValue : RVal},
+        remaining[index]? = some (.borrowed borrowWorld lender) →
+        source[index]? = some borrowedValue →
+        BorrowProvenance after source input remaining frameRoots borrowWorld
+          lender borrowedValue := by
+    intro index borrowWorld lender borrowedValue capabilityAt valueAt
+    exact BorrowProvenance.ofRestricts restriction ownership
+      (remainingBorrows capabilityAt valueAt)
+  have remainingSize : remaining.size = capabilities.size :=
+    Lower.consumeCapability?_size consumed
+  refine ⟨by
+      simp [Array.size_append, invariant.length, remainingSize, Nat.add_comm],
+    ?_, ?_, ?_⟩
+  · intro index capability selected capabilityAt selectedAt
+    cases index with
+    | zero =>
+        simp [Array.getElem?_append] at capabilityAt selectedAt
+        subst capability
+        subst selected
+        rfl
+    | succ index =>
+        simp [Array.getElem?_append] at capabilityAt selectedAt
+        cases capability with
+        | scalar => exact remainingHolds capabilityAt selectedAt
+        | dead => trivial
+        | owned actual =>
+            exact ownership.roots_world ⟨actual, selected⟩
+              (List.mem_append_left _
+                (rootsForCapabilities_owned_mem capabilityAt selectedAt))
+        | borrowed actual lender =>
+            exact (postBorrows capabilityAt selectedAt).hasWorld ownership
+  · simpa [rootsForCapabilities] using ownership
+  · exact BorrowProvenance.prependNonBorrowed
+      (IxIR1.Sim.StoreGraphExtends.refl after) postBorrows
+      (by intros; simp) forgets afterOwners
+
+/-- Exact shared destruction consumes its selected shared owner, transports all
+surviving lender paths through the restricted heap, and binds the erased
+result. -/
+theorem drop {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput
+      (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {atom : IxIR1.Atom} {result : RVal}
+    (transition : Lower.destructionCapabilities? capabilities input .shared
+      atom = some afterCapabilities)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.drop atom) = .ok (outputStore, result)) :
+    SourceOwnershipInvariant outputStore (result :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨value, resolved, _⟩ := IxIR1.runOp_drop_success operationRun
+  cases consumedEq : Lower.consumeCapability? capabilities input .shared atom with
+  | none =>
+      simp [Lower.destructionCapabilities?, consumedEq] at transition
+  | some remaining =>
+      have afterEq : #[.scalar] ++ remaining = afterCapabilities := by
+        simpa [Lower.destructionCapabilities?, consumedEq] using transition
+      subst afterCapabilities
+      obtain ⟨_, readyOwnership⟩ :=
+        consumeCapability_ownership (consumedRoots := [])
+          (suffixRoots := frameRoots) invariant.holds
+          (by simpa using invariant.ownership) resolved consumedEq
+      have readyOwnership' : IxIR1.Sim.RootOwnership store
+          (⟨.shared, value⟩ ::
+            (rootsForCapabilities remaining.toList source ++ frameRoots)) := by
+        simpa [List.append_assoc] using readyOwnership
+      obtain ⟨resultEq, restriction, postOwnership⟩ :=
+        IxIR1.Sim.runOp_drop_value_owned_restricts resolved readyOwnership'
+          operationRun
+      subst result
+      exact prependScalarAfterRestriction invariant forgets afterOwners
+        resolved consumedEq restriction postOwnership
+
+/-- Exact unique recursive destruction has the same ownership interface as
+shared destruction, specialized to a unique consumed root. -/
+theorem dropU {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput
+      (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {atom : IxIR1.Atom} {result : RVal}
+    (transition : Lower.destructionCapabilities? capabilities input .unique
+      atom = some afterCapabilities)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.dropU atom) = .ok (outputStore, result)) :
+    SourceOwnershipInvariant outputStore (result :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨value, resolved, _⟩ := IxIR1.runOp_dropU_success operationRun
+  cases consumedEq : Lower.consumeCapability? capabilities input .unique atom with
+  | none =>
+      simp [Lower.destructionCapabilities?, consumedEq] at transition
+  | some remaining =>
+      have afterEq : #[.scalar] ++ remaining = afterCapabilities := by
+        simpa [Lower.destructionCapabilities?, consumedEq] using transition
+      subst afterCapabilities
+      obtain ⟨_, readyOwnership⟩ :=
+        consumeCapability_ownership (consumedRoots := [])
+          (suffixRoots := frameRoots) invariant.holds
+          (by simpa using invariant.ownership) resolved consumedEq
+      have readyOwnership' : IxIR1.Sim.RootOwnership store
+          (⟨.unique, value⟩ ::
+            (rootsForCapabilities remaining.toList source ++ frameRoots)) := by
+        simpa [List.append_assoc] using readyOwnership
+      obtain ⟨resultEq, restriction, postOwnership⟩ :=
+        IxIR1.Sim.runOp_dropU_value_owned_restricts resolved readyOwnership'
+          operationRun
+      subst result
+      exact prependScalarAfterRestriction invariant forgets afterOwners
+        resolved consumedEq restriction postOwnership
+
+/-- Checked scalar-leaf shallow free consumes the selected unique owner.  The
+freed constructor's scalar fields contribute no surviving heap roots, while
+all unrelated owners and lender paths transport through the one-node kill. -/
+theorem free {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput
+      (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {atom : IxIR1.Atom} {location : Nat} {box : IxIR1.NodeBox}
+    {identity : CtorId} {fields : Array RVal} {result : RVal}
+    (transition : Lower.destructionCapabilities? capabilities input .unique
+      atom = some afterCapabilities)
+    (resolved : IxIR1.resolveAtom source atom = .ok (.loc location))
+    (sourceGet : store.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN identity fields)
+    (scalarFields : fields.all IxIR1.RVal.isScalar = true)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.free atom) = .ok (outputStore, result)) :
+    SourceOwnershipInvariant outputStore (result :: source) afterInput
+      afterCapabilities frameRoots := by
+  cases consumedEq : Lower.consumeCapability? capabilities input .unique atom with
+  | none =>
+      simp [Lower.destructionCapabilities?, consumedEq] at transition
+  | some remaining =>
+      have afterEq : #[.scalar] ++ remaining = afterCapabilities := by
+        simpa [Lower.destructionCapabilities?, consumedEq] using transition
+      subst afterCapabilities
+      obtain ⟨_, readyOwnership⟩ :=
+        consumeCapability_ownership (consumedRoots := [])
+          (suffixRoots := frameRoots) invariant.holds
+          (by simpa using invariant.ownership) resolved consumedEq
+      have readyOwnership' : IxIR1.Sim.RootOwnership store
+          (⟨.unique, (.loc location : RVal)⟩ ::
+            (rootsForCapabilities remaining.toList source ++ frameRoots)) := by
+        simpa [List.append_assoc] using readyOwnership
+      cases box with
+      | mk actualWorld rc actualNode =>
+          simp only at unique node sourceGet
+          subst actualWorld
+          have rcOne : rc = 1 := (readyOwnership'.counts sourceGet).1
+          subst rc
+          have killedOwnership := readyOwnership'.killUniqueOne sourceGet
+          have scalarChildren :
+              (IxIR1.Sim.nodeChildren actualNode).all IxIR1.RVal.isScalar =
+                true := by
+            rw [node]
+            simpa [IxIR1.Sim.nodeChildren] using scalarFields
+          have postOwnership : IxIR1.Sim.RootOwnership
+              (store.kill location)
+              (rootsForCapabilities remaining.toList source ++ frameRoots) :=
+            killedOwnership.dropScalars scalarChildren
+          have expectedRun := IxIR1.Sim.runOp_free
+            (ctx := sourceContext) (fuel := sourceFuel) (cur := sourceCurrent)
+            resolved sourceGet
+          have outputEq :
+              (store.kill location, (.erased : RVal)) =
+                (outputStore, result) :=
+            Except.ok.inj (expectedRun.symm.trans operationRun)
+          have outputStoreEq : store.kill location = outputStore :=
+            congrArg Prod.fst outputEq
+          have resultEq : (.erased : RVal) = result :=
+            congrArg Prod.snd outputEq
+          subst outputStore
+          subst result
+          exact prependScalarAfterRestriction invariant forgets afterOwners
+            resolved consumedEq (IxIR1.Sim.StoreGraphRestricts.kill sourceGet)
+              postOwnership
+
+/-- The checked producer capability vector and the dynamic ownership
+invariant establish every field world needed by target allocation. -/
+theorem resolveAtoms_hasWorld
+    {store : IxIR1.Store} {source : List RVal}
+    {position : Lower.PositionTrace}
+    {site : Lower.SourceSite} {block : BlockId} {index : Nat}
+    {input : Array (Option Atom)} {world : Ix.Compiler.Ixon.Owned}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input
+      position.sourceCapabilities frameRoots)
+    {arguments : Array IxIR1.Atom} {values : List RVal}
+    (positionMatch : position.allocationMatches site block index input world
+      arguments = true)
+    (resolved : IxIR1.resolveAtoms source arguments = .ok values) :
+    ∀ value ∈ values, IxIR1.Sim.HasWorld store world value := by
+  apply SourceAtomsResolve.worlds invariant
+    (SourceAtomsResolve.ofResolveAtoms resolved)
+  intro atom member
+  exact position.sourceCapability_canConsume_of_allocationMatch
+    positionMatch member
+
+/-- Before a checked allocation mutates the store, its sequential capability
+consumption already exposes the exact constructor-field roots followed by all
+surviving source and suspended-frame roots.  This is the pre-allocation
+accounting boundary used by reuse proofs that need a root partition rather
+than only the post-allocation invariant. -/
+theorem allocationReadyOwnership
+    {store : IxIR1.Store} {source values : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {world : Ix.Compiler.Ixon.Owned} {arguments : Array IxIR1.Atom}
+    (resolved : IxIR1.resolveAtoms source arguments = .ok values)
+    (transition : Lower.allocationCapabilities? capabilities input world
+      arguments = some afterCapabilities) :
+    ∃ remaining,
+      Lower.consumeCapabilitiesList? capabilities input world
+          arguments.toList = some remaining ∧
+      afterCapabilities = #[.owned world] ++ remaining ∧
+      IxIR1.Sim.RootOwnership store
+        (IxIR1.Sim.rootsFor world values ++
+          rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  cases consumeEq : Lower.consumeCapabilitiesList? capabilities input world
+      arguments.toList with
+  | none =>
+      simp [Lower.allocationCapabilities?, consumeEq] at transition
+  | some remaining =>
+      have afterEq : #[.owned world] ++ remaining = afterCapabilities := by
+        simpa [Lower.allocationCapabilities?, consumeEq] using transition
+      have resolvedRelation := SourceAtomsResolve.ofResolveAtoms resolved
+      obtain ⟨_remainingHolds, readyOwnership⟩ :=
+        consumeCapabilitiesList_ownership (consumedRoots := [])
+          (suffixRoots := frameRoots) invariant.holds
+          (by simpa using invariant.ownership) resolvedRelation consumeEq
+      exact ⟨remaining, rfl, afterEq.symm,
+        by simpa [List.append_assoc] using readyOwnership⟩
+
+/-- The exact producer ordinary-allocation transition consumes every field
+owner into the new constructor and exposes ownership of the fresh result.
+All surviving source capability facts transport across the append allocation. -/
+theorem alloc {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {world : Ix.Compiler.Ixon.Owned} {identity : CtorId}
+    {arguments : Array IxIR1.Atom} {value : RVal}
+    (transition : Lower.allocationCapabilities? capabilities input world
+      arguments =
+      some afterCapabilities)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.alloc world identity arguments) =
+        .ok (outputStore, value)) :
+    SourceOwnershipInvariant outputStore (value :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨values, resolved, outputEq⟩ :=
+    IxIR1.runOp_alloc_success operationRun
+  have outputStoreEq : outputStore =
+      (store.allocNode world (.ctorN identity values.toArray)).1 :=
+    congrArg Prod.fst outputEq
+  have valueEq : value =
+      .loc (store.allocNode world (.ctorN identity values.toArray)).2 :=
+    congrArg Prod.snd outputEq
+  subst outputStore
+  subst value
+  cases consumeEq : Lower.consumeCapabilitiesList? capabilities input world
+      arguments.toList with
+  | none =>
+      simp [Lower.allocationCapabilities?, consumeEq] at transition
+  | some remaining =>
+      have afterEq :
+          #[.owned world] ++ remaining = afterCapabilities := by
+        simpa [Lower.allocationCapabilities?, consumeEq] using transition
+      subst afterCapabilities
+      have resolvedRelation := SourceAtomsResolve.ofResolveAtoms resolved
+      obtain ⟨remainingHolds, readyOwnership⟩ :=
+        consumeCapabilitiesList_ownership (consumedRoots := [])
+          (suffixRoots := frameRoots)
+          invariant.holds (by simpa using invariant.ownership)
+            resolvedRelation consumeEq
+      have readyOwnership' : IxIR1.Sim.RootOwnership store
+          (IxIR1.Sim.rootsFor world values ++
+            rootsForCapabilities remaining.toList source ++ frameRoots) := by
+        simpa using readyOwnership
+      have allocatedOwnership :=
+        (IxIR1.Sim.runOp_alloc_owned
+          (ctx := sourceContext) (fuel := sourceFuel)
+          (cur := sourceCurrent) (cid := identity) (args := arguments)
+          resolved
+            (by simpa [List.append_assoc] using readyOwnership')).2
+      have remainingSize : remaining.size = capabilities.size :=
+        Lower.consumeCapabilitiesList?_size consumeEq
+      have remainingBorrows :
+          ∀ {index : Nat} {borrowWorld : Ix.Compiler.Ixon.Owned}
+              {lender : BorrowLender} {borrowedValue : RVal},
+            remaining[index]? = some (.borrowed borrowWorld lender) →
+            source[index]? = some borrowedValue →
+            BorrowProvenance store source input remaining frameRoots
+              borrowWorld lender borrowedValue :=
+        consumeCapabilitiesList_borrows invariant.borrows consumeEq
+      refine ⟨by
+          simp [Array.size_append, remainingSize, invariant.length,
+            Nat.add_comm], ?_, ?_, ?_⟩
+      · intro index capability selected capabilityAt selectedAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            subst capability
+            subst selected
+            exact IxIR1.Sim.HasWorld.allocNode_new store world
+              (.ctorN identity values.toArray)
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            exact (remainingHolds capabilityAt selectedAt).allocNode
+      · simpa [rootsForCapabilities] using allocatedOwnership
+      · exact BorrowProvenance.prependNonBorrowed
+          (IxIR1.Sim.StoreGraphExtends.allocNode store world
+            (.ctorN identity values.toArray)) remainingBorrows
+          (by intros; simp) forgets afterOwners
+
+/-- Function partial application consumes its shared capture owners into a
+fresh shared PAP node and exposes the fresh PAP owner. -/
+theorem papp {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {headAtom : Atom}
+    (forgets : Lower.InputMap.Forgets afterInput (#[some headAtom] ++ input))
+    (afterOwners : OwnedInputRegisters afterInput afterCapabilities)
+    {function : Ix.Compiler.Ixon.Address}
+    {arguments : Array IxIR1.Atom} {value : RVal}
+    (transition : Lower.allocationCapabilities? capabilities input .shared
+      arguments =
+      some afterCapabilities)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.papp function arguments) =
+        .ok (outputStore, value)) :
+    SourceOwnershipInvariant outputStore (value :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨values, declaration, resolved, declarationAt, under, outputEq⟩ :=
+    IxIR1.runOp_papp_success operationRun
+  have outputStoreEq : outputStore =
+      (store.allocNode .shared
+        (.papN function (IxIR1.declArity declaration) values.toArray)).1 :=
+    congrArg Prod.fst outputEq
+  have valueEq : value =
+      .loc (store.allocNode .shared
+        (.papN function (IxIR1.declArity declaration) values.toArray)).2 :=
+    congrArg Prod.snd outputEq
+  subst outputStore
+  subst value
+  cases consumeEq : Lower.consumeCapabilitiesList? capabilities input .shared
+      arguments.toList with
+  | none =>
+      simp [Lower.allocationCapabilities?, consumeEq] at transition
+  | some remaining =>
+      have afterEq :
+          #[.owned .shared] ++ remaining = afterCapabilities := by
+        simpa [Lower.allocationCapabilities?, consumeEq] using transition
+      subst afterCapabilities
+      have resolvedRelation := SourceAtomsResolve.ofResolveAtoms resolved
+      obtain ⟨remainingHolds, readyOwnership⟩ :=
+        consumeCapabilitiesList_ownership (consumedRoots := [])
+          (suffixRoots := frameRoots)
+          invariant.holds (by simpa using invariant.ownership)
+            resolvedRelation consumeEq
+      have readyOwnership' : IxIR1.Sim.RootOwnership store
+          (IxIR1.Sim.rootsFor .shared values ++
+            rootsForCapabilities remaining.toList source ++ frameRoots) := by
+        simpa using readyOwnership
+      have allocatedOwnership :=
+        (IxIR1.Sim.runOp_papp_owned
+          (ctx := sourceContext) (fuel := sourceFuel)
+          (cur := sourceCurrent) (f := function) (atoms := arguments)
+          resolved declarationAt under
+            (by simpa [List.append_assoc] using readyOwnership')).2
+      have remainingSize : remaining.size = capabilities.size :=
+        Lower.consumeCapabilitiesList?_size consumeEq
+      have remainingBorrows :
+          ∀ {index : Nat} {borrowWorld : Ix.Compiler.Ixon.Owned}
+              {lender : BorrowLender} {borrowedValue : RVal},
+            remaining[index]? = some (.borrowed borrowWorld lender) →
+            source[index]? = some borrowedValue →
+            BorrowProvenance store source input remaining frameRoots
+              borrowWorld lender borrowedValue :=
+        consumeCapabilitiesList_borrows invariant.borrows consumeEq
+      refine ⟨by
+          simp [Array.size_append, remainingSize, invariant.length,
+            Nat.add_comm], ?_, ?_, ?_⟩
+      · intro index capability selected capabilityAt selectedAt
+        cases index with
+        | zero =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            subst capability
+            subst selected
+            exact IxIR1.Sim.HasWorld.allocNode_new store .shared
+              (.papN function (IxIR1.declArity declaration) values.toArray)
+        | succ index =>
+            simp [Array.getElem?_append] at capabilityAt selectedAt
+            exact (remainingHolds capabilityAt selectedAt).allocNode
+      · simpa [rootsForCapabilities] using allocatedOwnership
+      · exact BorrowProvenance.prependNonBorrowed
+          (IxIR1.Sim.StoreGraphExtends.allocNode store .shared
+            (.papN function (IxIR1.declArity declaration) values.toArray))
+          remainingBorrows (by intros; simp) forgets afterOwners
+
+private theorem rootsForCapabilities_replicate_owned
+    (world : Ix.Compiler.Ixon.Owned) : ∀ (values : List RVal),
+    rootsForCapabilities
+        (List.replicate values.length (Lower.BindingCap.owned world)) values =
+      IxIR1.Sim.rootsFor world values := by
+  intro values
+  induction values with
+  | nil => rfl
+  | cons value values ih =>
+      simp [List.replicate_succ, rootsForCapabilities,
+        IxIR1.Sim.rootsFor, ih]
+
+/-- A same-length all-shared owned capability vector realizes the canonical
+reversed source environment at a dynamically selected PAP callee entry. -/
+theorem sharedEntry {store : IxIR1.Store} {values : List RVal}
+    {input : Array (Option Atom)} {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (shape : capabilities =
+      Array.replicate values.length (.owned .shared))
+    (ownership : IxIR1.Sim.RootOwnership store
+      (IxIR1.Sim.rootsFor .shared values ++ frameRoots)) :
+    SourceOwnershipInvariant store values.reverse input capabilities
+      frameRoots := by
+  subst capabilities
+  have rootsEq :
+      rootsForCapabilities
+          (Array.replicate values.length
+            (Lower.BindingCap.owned .shared)).toList values.reverse =
+        (IxIR1.Sim.rootsFor .shared values).reverse := by
+    calc
+      _ = IxIR1.Sim.rootsFor .shared values.reverse := by
+        simpa using rootsForCapabilities_replicate_owned .shared
+          values.reverse
+      _ = _ := by simp [IxIR1.Sim.rootsFor, List.map_reverse]
+  have entryOwnership : IxIR1.Sim.RootOwnership store
+      (rootsForCapabilities
+          (Array.replicate values.length
+            (Lower.BindingCap.owned .shared)).toList values.reverse ++
+        frameRoots) := by
+    apply ownership.perm
+    rw [rootsEq]
+    exact (List.reverse_perm (IxIR1.Sim.rootsFor .shared values)).symm
+      |>.append_right frameRoots
+  refine ⟨by simp, ?_, entryOwnership, ?_⟩
+  · intro index capability selected capabilityAt selectedAt
+    have capabilityEq : capability = .owned .shared := by
+      simp only [Array.getElem?_replicate] at capabilityAt
+      split at capabilityAt
+      next bound => exact Option.some.inj capabilityAt |>.symm
+      next bound => contradiction
+    subst capability
+    exact entryOwnership.roots_world ⟨.shared, selected⟩
+      (List.mem_append_left _
+        (rootsForCapabilities_owned_mem capabilityAt selectedAt))
+  · intro index world lender selected capabilityAt selectedAt
+    simp only [Array.getElem?_replicate] at capabilityAt
+    split at capabilityAt
+    next bound => cases capabilityAt
+    next bound => contradiction
+
+/-- Consume a dynamic PAP function and its newly supplied arguments, then
+replay the PAP retain/release prefix.  The resulting roots are split between
+the first callee entry and any residual `applyMore` arguments; surviving
+caller owners remain as the final suspended-frame suffix. -/
+theorem preparePapEntry {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store retainedStore readyStore : IxIR1.Store} {source : List RVal}
+    {input : Array (Option Atom)}
+    {capabilities afterFunction remaining : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {functionAtom : IxIR1.Atom} {argumentAtoms : Array IxIR1.Atom}
+    {location rc : Nat} {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {arguments supplied residual : List RVal}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (functionResolved : IxIR1.resolveAtom source functionAtom =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms source argumentAtoms =
+      .ok arguments)
+    (functionConsumed : Lower.consumeCapability? capabilities input .shared
+      functionAtom = some afterFunction)
+    (argumentsConsumed : Lower.consumeCapabilitiesList? afterFunction input
+      .shared argumentAtoms.toList = some remaining)
+    (papAt : store.get? location =
+      some ⟨.shared, rc, .papN address arity captured⟩)
+    (retained : IxIR1.dupVals store captured.toList = .ok retainedStore)
+    (released : IxIR1.dropVal sourceContext sourceFuel retainedStore
+      (.loc location) = .ok readyStore)
+    (split : captured.toList ++ arguments = supplied ++ residual) :
+    IxIR1.Sim.RootOwnership readyStore
+      (IxIR1.Sim.rootsFor .shared supplied ++
+        IxIR1.Sim.rootsFor .shared residual ++
+        rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  obtain ⟨afterFunctionHolds, afterFunctionOwnership⟩ :=
+    consumeCapability_ownership (consumedRoots := [])
+      (suffixRoots := frameRoots) invariant.holds
+      (by simpa using invariant.ownership) functionResolved functionConsumed
+  have resolvedRelation := SourceAtomsResolve.ofResolveAtoms argumentsResolved
+  obtain ⟨_, readyOwnership⟩ :=
+    consumeCapabilitiesList_ownership
+      (consumedRoots :=
+        [(⟨.shared, .loc location⟩ : IxIR1.Sim.Root)])
+      (suffixRoots := frameRoots) afterFunctionHolds
+      (by simpa using afterFunctionOwnership) resolvedRelation
+      argumentsConsumed
+  have papOwnership := IxIR1.Sim.applyGo_preparePap_owned papAt
+    (by simpa [List.append_assoc] using readyOwnership) retained released
+  rw [split] at papOwnership
+  simpa [IxIR1.Sim.rootsFor, List.append_assoc] using papOwnership
+
+/-- Dynamic application consumes the shared function root and every supplied
+shared argument root. A preservation law for this exact input heap returns
+one shared result root while the checked suspension rule excludes borrows
+from the surviving source frame. -/
+theorem applyFrom {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {function : IxIR1.Atom} {arguments : Array IxIR1.Atom} {value : RVal}
+    (transition : Lower.applyCapabilities? capabilities input function
+      arguments = some afterCapabilities)
+    (noBorrows : Lower.noBorrows afterCapabilities = true)
+    (preserves : IxIR1.Sim.ApplyOwnershipPreservesFrom sourceContext
+      sourceFuel store)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.apply function arguments) = .ok (outputStore, value)) :
+    SourceOwnershipInvariant outputStore (value :: source) afterInput
+      afterCapabilities frameRoots := by
+  obtain ⟨functionValue, values, functionResolved, argumentsResolved,
+      applyRun⟩ :=
+    IxIR1.runOp_apply_success operationRun
+  unfold Lower.applyCapabilities? at transition
+  cases functionConsume : Lower.consumeCapability? capabilities input .shared
+      function with
+  | none => simp [functionConsume] at transition
+  | some afterFunction =>
+      simp only [functionConsume, Option.bind_eq_bind, Option.bind_some] at transition
+      cases argumentsConsume : Lower.consumeCapabilitiesList? afterFunction
+          input .shared arguments.toList with
+      | none => simp [argumentsConsume] at transition
+      | some remaining =>
+          have afterEq :
+              #[.owned .shared] ++ remaining = afterCapabilities := by
+            simpa [argumentsConsume] using transition
+          subst afterCapabilities
+          obtain ⟨afterFunctionHolds, afterFunctionOwnership⟩ :=
+            consumeCapability_ownership (consumedRoots := [])
+              (suffixRoots := frameRoots) invariant.holds
+              (by simpa using invariant.ownership) functionResolved
+              functionConsume
+          have resolvedRelation := SourceAtomsResolve.ofResolveAtoms
+            argumentsResolved
+          obtain ⟨remainingHolds, readyOwnership⟩ :=
+            consumeCapabilitiesList_ownership
+              (consumedRoots :=
+                [(⟨.shared, functionValue⟩ : IxIR1.Sim.Root)])
+              (suffixRoots := frameRoots) afterFunctionHolds
+              (by simpa using afterFunctionOwnership) resolvedRelation
+              argumentsConsume
+          have resultOwnership : IxIR1.Sim.RootOwnership outputStore
+              (⟨.shared, value⟩ ::
+                (rootsForCapabilities remaining.toList source ++
+                  frameRoots)) := by
+            exact preserves
+              (by simpa [List.append_assoc] using readyOwnership) applyRun
+          have remainingSize : remaining.size = capabilities.size :=
+            (Lower.consumeCapabilitiesList?_size argumentsConsume).trans
+              (Lower.consumeCapability?_size functionConsume)
+          refine ⟨?_, ?_, ?_, ?_⟩
+          · simp [Array.size_append, remainingSize, invariant.length,
+              Nat.add_comm]
+          · intro index capability selected capabilityAt selectedAt
+            cases index with
+            | zero =>
+                simp [Array.getElem?_append] at capabilityAt selectedAt
+                subst capability
+                subst selected
+                exact resultOwnership.roots_world ⟨.shared, value⟩ (by simp)
+            | succ index =>
+                simp [Array.getElem?_append] at capabilityAt selectedAt
+                cases capability with
+                | scalar =>
+                    simpa [CapabilityHolds] using
+                      remainingHolds capabilityAt selectedAt
+                | dead => trivial
+                | borrowed world lender =>
+                    have fullAt :
+                        (#[.owned .shared] ++ remaining)[index + 1]? =
+                          some (.borrowed world lender) := by
+                      simp [Array.getElem?_append, capabilityAt]
+                    exact False.elim
+                      (borrowed_impossible_of_noBorrows noBorrows fullAt)
+                | owned world =>
+                    exact resultOwnership.roots_world ⟨world, selected⟩ (by
+                      simp [rootsForCapabilities_owned_mem capabilityAt
+                        selectedAt])
+          · simpa [rootsForCapabilities, List.append_assoc] using
+              resultOwnership
+          · intro index world lender selected capabilityAt selectedAt
+            exact False.elim
+              (borrowed_impossible_of_noBorrows noBorrows capabilityAt)
+
+/-- The traditional whole-context contract specializes the fixed-input rule
+used by `applyFrom`. -/
+theorem apply {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceCurrent : IxIR1.FnDef} {store outputStore : IxIR1.Store}
+    {source : List RVal}
+    {input afterInput : Array (Option Atom)}
+    {capabilities afterCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    {function : IxIR1.Atom} {arguments : Array IxIR1.Atom} {value : RVal}
+    (transition : Lower.applyCapabilities? capabilities input function
+      arguments = some afterCapabilities)
+    (noBorrows : Lower.noBorrows afterCapabilities = true)
+    (contract : IxIR1.Sim.ApplyOwnershipContract sourceContext)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent
+      store source (.apply function arguments) = .ok (outputStore, value)) :
+    SourceOwnershipInvariant outputStore (value :: source) afterInput
+      afterCapabilities frameRoots :=
+  invariant.applyFrom transition noBorrows
+    (contract.preservesFrom sourceFuel store) operationRun
+
+end SourceOwnershipInvariant
+
+namespace SourceOwnershipAt
+
+/-- A checked ordinary allocation transports trace-indexed ownership through
+its exact sequential argument consumption and fresh-result binding. -/
+theorem alloc {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceWorld targetWorld : Ix.Compiler.Ixon.Owned}
+    {sourceCid targetCid : CtorId}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+          (.alloc targetWorld targetCid targetArguments) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+          (.alloc targetWorld targetCid targetArguments) next) store source
+            frameRoots)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source
+        (.alloc sourceWorld sourceCid sourceArguments) =
+          .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.allocationTransition functionMember descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some (.reg entryValueCount)] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.allocationResultMatches at transitionMatch
+  cases transitionEq : Lower.allocationCapabilities?
+      before.sourceCapabilities input sourceWorld sourceArguments with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.alloc forgets afterOwners (sourceFuel := sourceFuel)
+        (operationRun := operationRun)
+      simpa [expectedEq] using transitionEq
+
+/-- A checked function partial application transports trace-indexed ownership
+through shared capture consumption and fresh PAP-owner binding. -/
+theorem papp {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAddress targetAddress : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+          (.papp targetAddress targetArguments) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+          (.papp targetAddress targetArguments) next) store source
+            frameRoots)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source
+        (.papp sourceAddress sourceArguments) =
+          .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.pappTransition functionMember descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some (.reg entryValueCount)] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.allocationResultMatches at transitionMatch
+  cases transitionEq : Lower.allocationCapabilities?
+      before.sourceCapabilities input .shared sourceArguments with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.papp forgets afterOwners (sourceFuel := sourceFuel)
+        (operationRun := operationRun)
+      simpa [expectedEq] using transitionEq
+
+/-- A checked dynamic application transports trace-indexed ownership through
+the shared function/argument boundary using a preservation law for its exact
+input heap, then reinstalls the surviving source frame around the returned
+shared owner. -/
+theorem applyFrom {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {sourceArguments : Array IxIR1.Atom}
+    {targetFunction : Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next)
+      store source frameRoots)
+    (preserves : IxIR1.Sim.ApplyOwnershipPreservesFrom sourceContext
+      sourceFuel store)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source
+        (.apply sourceFunction sourceArguments) = .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.applyTransition functionMember descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  unfold Lower.PositionTrace.applyResultMatches at transitionMatch
+  cases transitionEq : Lower.applyCapabilities?
+      before.sourceCapabilities input sourceFunction sourceArguments with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      simp only [transitionEq, Bool.and_eq_true, beq_iff_eq] at transitionMatch
+      have transition : Lower.applyCapabilities?
+          before.sourceCapabilities input sourceFunction sourceArguments =
+            some after.sourceCapabilities := by
+        simpa [transitionMatch.2] using transitionEq
+      have noBorrows : Lower.noBorrows after.sourceCapabilities = true := by
+        simpa [transitionMatch.2] using transitionMatch.1
+      exact beforeInvariant.applyFrom transition noBorrows preserves operationRun
+
+/-- The whole-context application contract remains a compatibility wrapper
+around the reachable-heap `applyFrom` interface. -/
+theorem apply {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {sourceArguments : Array IxIR1.Atom}
+    {targetFunction : Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next)
+      store source frameRoots)
+    (contract : IxIR1.Sim.ApplyOwnershipContract sourceContext)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source
+        (.apply sourceFunction sourceArguments) = .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots :=
+  applyFrom functionMember descendant ownership
+    (contract.preservesFrom sourceFuel store) operationRun
+
+/-- A checked dynamic PAP application constructs the first callee's exact
+entry ownership from the caller's current capability state.  Exact
+saturation uses an empty residual list; over-saturation frames the residual
+shared arguments ahead of the surviving caller roots for `applyMore`. -/
+theorem applyPapEntry {checked : Lower.Checked}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ checked.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {sourceArguments : Array IxIR1.Atom}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index instruction next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceStore retainedStore readyStore : IxIR1.Store}
+    {source : List RVal} {location rc : Nat}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {arguments supplied residual : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index instruction next)
+      sourceStore source frameRoots)
+    (functionResolved : IxIR1.resolveAtom source sourceFunction =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms source sourceArguments =
+      .ok arguments)
+    (papAt : sourceStore.get? location =
+      some ⟨.shared, rc, .papN address arity captured⟩)
+    (retained : IxIR1.dupVals sourceStore captured.toList = .ok retainedStore)
+    (released : IxIR1.dropVal sourceContext sourceFuel retainedStore
+      (.loc location) = .ok readyStore)
+    (split : captured.toList ++ arguments = supplied ++ residual)
+    (entryArity : supplied.length =
+      calleeTrace.generated.signature.params.size)
+    (papSafe : calleeTrace.generated.signature.papSafe = true) :
+    ∃ before afterFunction remaining,
+      before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches site blockId (.instruction index) input = true ∧
+      Lower.consumeCapability? before.sourceCapabilities input .shared
+          sourceFunction = some afterFunction ∧
+      Lower.consumeCapabilitiesList? afterFunction input .shared
+          sourceArguments.toList = some remaining ∧
+      Lower.noBorrows (#[.owned .shared] ++ remaining) = true ∧
+      IxIR1.Sim.RootOwnership readyStore
+        (IxIR1.Sim.rootsFor .shared supplied ++
+          IxIR1.Sim.rootsFor .shared residual ++
+          rootsForCapabilities remaining.toList source ++ frameRoots) ∧
+      SourceOwnershipAt checked.artifact.trace.positions calleeTrace.root
+        readyStore supplied.reverse
+        (IxIR1.Sim.rootsFor .shared residual ++
+          rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position callerMember nextDescendant
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    checked.applyTransition callerMember descendant afterMember afterCoordinate
+  unfold Lower.PositionTrace.applyResultMatches at transition
+  unfold Lower.applyCapabilities? at transition
+  cases functionConsumed : Lower.consumeCapability? before.sourceCapabilities
+      input .shared sourceFunction with
+  | none => simp [functionConsumed] at transition
+  | some afterFunction =>
+      simp only [functionConsumed, Option.bind_eq_bind, Option.bind_some] at transition
+      cases argumentsConsumed : Lower.consumeCapabilitiesList? afterFunction
+          input .shared sourceArguments.toList with
+      | none => simp [argumentsConsumed] at transition
+      | some remaining =>
+          simp only [argumentsConsumed, Option.bind_some] at transition
+          change (Lower.noBorrows (#[.owned .shared] ++ remaining) &&
+            (#[.owned .shared] ++ remaining ==
+              after.sourceCapabilities)) = true at transition
+          simp only [Bool.and_eq_true, beq_iff_eq] at transition
+          have beforeInvariant := ownership before beforeMember (by
+            simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+              Lower.CodeTrace.targetPosition,
+              Lower.CodeTrace.sourceInputMap] using beforeCoordinate)
+          change SourceOwnershipInvariant sourceStore source input
+            before.sourceCapabilities frameRoots at beforeInvariant
+          have readyOwnership := beforeInvariant.preparePapEntry
+            functionResolved argumentsResolved functionConsumed
+              argumentsConsumed papAt retained released split
+          have entryShape :
+              Lower.entryCapabilities calleeTrace.generated.signature =
+                Array.replicate supplied.length (.owned .shared) := by
+            simpa [entryArity] using
+              checked.papSafeEntryCapabilities calleeMember papSafe
+          have calleeOwnership : SourceOwnershipAt
+              checked.artifact.trace.positions calleeTrace.root readyStore
+              supplied.reverse
+              (IxIR1.Sim.rootsFor .shared residual ++
+                rootsForCapabilities remaining.toList source ++
+                  frameRoots) := by
+            intro entry entryMember entryCoordinate
+            rw [checked.entryCapabilities calleeMember entryMember
+              entryCoordinate]
+            exact SourceOwnershipInvariant.sharedEntry entryShape
+              (by simpa [List.append_assoc] using readyOwnership)
+          exact ⟨before, afterFunction, remaining, beforeMember,
+            beforeCoordinate, functionConsumed, argumentsConsumed,
+            transition.1, readyOwnership, calleeOwnership⟩
+
+/-- A checked scalar-leaf shallow free derives its continuation ownership from
+the exact destruction capability transition and the certified concrete leaf. -/
+theorem free {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {targetCid : CtorId}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {identity : CtorId}
+    {fields : Array RVal} {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      store source frameRoots)
+    (resolved : IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : store.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN identity fields)
+    (scalarFields : fields.all IxIR1.RVal.isScalar = true)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source (.free sourceAtom) =
+        .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.destructionTransition functionMember (by rfl) descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some .erased] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.destructionResultMatches at transitionMatch
+  cases transitionEq : Lower.destructionCapabilities?
+      before.sourceCapabilities input .unique sourceAtom with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.free forgets afterOwners
+        (sourceFuel := sourceFuel) (operationRun := operationRun)
+        (resolved := resolved) (sourceGet := sourceGet) (unique := unique)
+        (node := node) (scalarFields := scalarFields)
+      simpa [expectedEq] using transitionEq
+
+/-- A checked shared destruction derives its dynamic ownership transition from
+the producer's exact consume-and-retire capability effect. -/
+theorem drop {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next) store source
+          frameRoots)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source (.drop sourceAtom) =
+        .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.destructionTransition functionMember (by rfl) descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some .erased] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.destructionResultMatches at transitionMatch
+  cases transitionEq : Lower.destructionCapabilities?
+      before.sourceCapabilities input .shared sourceAtom with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.drop forgets afterOwners (sourceFuel := sourceFuel)
+        (operationRun := operationRun)
+      simpa [expectedEq] using transitionEq
+
+/-- A checked unique recursive destruction derives the continuation ownership
+invariant without an external semantic-transition premise. -/
+theorem dropU {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store outputStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next) store source
+          frameRoots)
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source store source (.dropU sourceAtom) =
+        .ok (outputStore, value)) :
+    SourceOwnershipAt checked.artifact.trace.positions next outputStore
+      (value :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    checked.destructionTransition functionMember (by rfl) descendant afterMember
+      afterCoordinate
+  have beforeInvariant := ownership before beforeMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          beforeCoordinate)
+  change SourceOwnershipInvariant store source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (functionTrace.descendantInputMapsMatch descendant) (by rfl)
+  have letOpMatch := functionTrace.descendantLetOpMatch descendant
+  have forgets : Lower.InputMap.Forgets next.sourceInputMap
+      (#[some .erased] ++ input) := by
+    simpa [letOpMatch.1.nextInput] using mapFacts.2.2.1
+  have afterOwners : OwnedInputRegisters next.sourceInputMap
+      after.sourceCapabilities :=
+    OwnedInputRegisters.ofCoordinate afterCoordinate
+  unfold Lower.PositionTrace.destructionResultMatches at transitionMatch
+  cases transitionEq : Lower.destructionCapabilities?
+      before.sourceCapabilities input .unique sourceAtom with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      apply beforeInvariant.dropU forgets afterOwners (sourceFuel := sourceFuel)
+        (operationRun := operationRun)
+      simpa [expectedEq] using transitionEq
+
+/-- A checked addressed call consumes its argument owners and constructs the
+callee's canonical entry invariant. The exact surviving caller roots are
+returned as the suspended frame suffix. -/
+theorem callEntry {checked : Lower.Checked}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ checked.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {instruction : Instr}
+    {next : Lower.CodeTrace}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call address sourceArguments) index instruction next))
+    (signatureAt : Lower.targetSignature?
+      checked.artifact.program.declarations address =
+        some calleeTrace.generated.signature)
+    {store : IxIR1.Store} {source values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.call address sourceArguments) index instruction next)
+      store source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values) :
+    ∃ before remaining,
+      before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches site blockId (.instruction index) input = true ∧
+      Lower.callRemainingCapabilities? before.sourceCapabilities input
+          calleeTrace.generated.signature sourceArguments = some remaining ∧
+      Lower.noBorrows remaining = true ∧
+      SourceOwnershipAt checked.artifact.trace.positions calleeTrace.root store
+        values.reverse
+        (rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  obtain ⟨before, beforeMember, beforeCoordinate⟩ :=
+    checked.position callerMember descendant
+  have beforeCoordinate' : before.coordinateMatches site blockId
+      (.instruction index) input = true := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        beforeCoordinate
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position callerMember nextDescendant
+  have transition := checked.callTransition callerMember signatureAt descendant
+    beforeMember beforeCoordinate' afterMember afterCoordinate
+  unfold Lower.PositionTrace.callResultMatches at transition
+  cases consumedEq : Lower.callRemainingCapabilities?
+      before.sourceCapabilities input calleeTrace.generated.signature
+        sourceArguments with
+  | none => simp [consumedEq] at transition
+  | some remaining =>
+      simp only [consumedEq, Bool.and_eq_true, beq_iff_eq] at transition
+      refine ⟨before, remaining, beforeMember, beforeCoordinate', consumedEq,
+        transition.1, ?_⟩
+      have beforeInvariant := ownership before beforeMember (by
+        simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+          Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+            beforeCoordinate)
+      change SourceOwnershipInvariant store source input
+        before.sourceCapabilities frameRoots at beforeInvariant
+      intro entry entryMember entryCoordinate
+      have entryEq := checked.entryCapabilities calleeMember entryMember
+        entryCoordinate
+      rw [entryEq]
+      exact beforeInvariant.callEntryInvariant resolved consumedEq
+
+/-- Recursive self-call entry has the same exact ownership transfer, using
+the current checked signature as its ABI. -/
+theorem callSelfEntry {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceArguments : Array IxIR1.Atom} {instruction : Instr}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index instruction next))
+    {store : IxIR1.Store} {source values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index instruction next)
+      store source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values) :
+    ∃ before remaining,
+      before ∈ checked.artifact.trace.positions ∧
+      before.coordinateMatches site blockId (.instruction index) input = true ∧
+      Lower.callRemainingCapabilities? before.sourceCapabilities input
+          functionTrace.generated.signature sourceArguments = some remaining ∧
+      Lower.noBorrows remaining = true ∧
+      SourceOwnershipAt checked.artifact.trace.positions functionTrace.root
+        store values.reverse
+        (rootsForCapabilities remaining.toList source ++ frameRoots) := by
+  obtain ⟨before, beforeMember, beforeCoordinate⟩ :=
+    checked.position functionMember descendant
+  have beforeCoordinate' : before.coordinateMatches site blockId
+      (.instruction index) input = true := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        beforeCoordinate
+  have nextDescendant : functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position functionMember nextDescendant
+  have transition := checked.callSelfTransition functionMember descendant
+    beforeMember beforeCoordinate' afterMember afterCoordinate
+  unfold Lower.PositionTrace.callResultMatches at transition
+  cases consumedEq : Lower.callRemainingCapabilities?
+      before.sourceCapabilities input functionTrace.generated.signature
+        sourceArguments with
+  | none => simp [consumedEq] at transition
+  | some remaining =>
+      simp only [consumedEq, Bool.and_eq_true, beq_iff_eq] at transition
+      refine ⟨before, remaining, beforeMember, beforeCoordinate', consumedEq,
+        transition.1, ?_⟩
+      have beforeInvariant := ownership before beforeMember (by
+        simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+          Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+            beforeCoordinate)
+      change SourceOwnershipInvariant store source input
+        before.sourceCapabilities frameRoots at beforeInvariant
+      intro entry entryMember entryCoordinate
+      have entryEq := checked.entryCapabilities functionMember entryMember
+        entryCoordinate
+      rw [entryEq]
+      exact beforeInvariant.callEntryInvariant resolved consumedEq
+
+/-- A checked addressed tail call transfers every local owner into the
+callee, so the enclosing suspended-frame suffix is preserved exactly. -/
+theorem tailCallEntry {checked : Lower.Checked}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ checked.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : callerTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated))
+    (signatureAt : Lower.targetSignature?
+      checked.artifact.program.declarations address =
+        some calleeTrace.generated.signature)
+    {store : IxIR1.Store} {source values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) store source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values) :
+    SourceOwnershipAt checked.artifact.trace.positions calleeTrace.root store
+      values.reverse frameRoots := by
+  obtain ⟨before, beforeMember, transition⟩ :=
+    checked.tailCallPosition callerMember signatureAt descendant
+  unfold Lower.PositionTrace.tailCallMatches at transition
+  simp only [Bool.and_eq_true] at transition
+  cases consumedEq : Lower.callRemainingCapabilities?
+      before.sourceCapabilities input calleeTrace.generated.signature
+        sourceArguments with
+  | none => simp [consumedEq] at transition
+  | some remaining =>
+      simp only [consumedEq] at transition
+      have noRoots := SourceOwnershipInvariant.rootsForCapabilities_eq_nil_of_noOwnedRoots
+        (source := source) transition.2
+      have beforeInvariant := ownership before beforeMember (by
+        simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+          Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+            transition.1)
+      change SourceOwnershipInvariant store source input
+        before.sourceCapabilities frameRoots at beforeInvariant
+      intro entry entryMember entryCoordinate
+      have entryEq := checked.entryCapabilities calleeMember entryMember
+        entryCoordinate
+      rw [entryEq]
+      simpa [noRoots] using
+        beforeInvariant.callEntryInvariant (calleeInput := calleeTrace.root.sourceInputMap)
+          resolved consumedEq
+
+/-- A checked recursive tail call likewise transfers every local owner and
+re-enters the same root with the unchanged enclosing frame suffix. -/
+theorem tailCallSelfEntry {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated))
+    {store : IxIR1.Store} {source values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) store source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values) :
+    SourceOwnershipAt checked.artifact.trace.positions functionTrace.root store
+      values.reverse frameRoots := by
+  obtain ⟨before, beforeMember, transition⟩ :=
+    checked.tailCallSelfPosition functionMember descendant
+  unfold Lower.PositionTrace.tailCallMatches at transition
+  simp only [Bool.and_eq_true] at transition
+  cases consumedEq : Lower.callRemainingCapabilities?
+      before.sourceCapabilities input functionTrace.generated.signature
+        sourceArguments with
+  | none => simp [consumedEq] at transition
+  | some remaining =>
+      simp only [consumedEq] at transition
+      have noRoots := SourceOwnershipInvariant.rootsForCapabilities_eq_nil_of_noOwnedRoots
+        (source := source) transition.2
+      have beforeInvariant := ownership before beforeMember (by
+        simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+          Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+            transition.1)
+      change SourceOwnershipInvariant store source input
+        before.sourceCapabilities frameRoots at beforeInvariant
+      intro entry entryMember entryCoordinate
+      have entryEq := checked.entryCapabilities functionMember entryMember
+        entryCoordinate
+      rw [entryEq]
+      simpa [noRoots] using
+        beforeInvariant.callEntryInvariant
+          (calleeInput := functionTrace.root.sourceInputMap) resolved consumedEq
+
+/-- At a checked return, consuming the declared result leaves exactly that
+result root followed by the suspended caller-frame roots. -/
+theorem returnRoot {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {store : IxIR1.Store} {source : List RVal} {value : RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      store source frameRoots)
+    (resolved : IxIR1.resolveAtom source sourceAtom = .ok value) :
+    IxIR1.Sim.RootOwnership store
+      (⟨functionTrace.generated.signature.result, value⟩ :: frameRoots) := by
+  obtain ⟨position, positionMember, coordinate⟩ :=
+    checked.position functionMember descendant
+  have coordinate' : position.coordinateMatches site blockId .terminator input =
+      true := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        coordinate
+  have transition := checked.returnPositionMatch functionMember descendant
+    positionMember coordinate'
+  unfold Lower.PositionTrace.returnMatches at transition
+  simp only [Bool.and_eq_true] at transition
+  cases consumedEq : Lower.consumeCapability? position.sourceCapabilities input
+      functionTrace.generated.signature.result sourceAtom with
+  | none => simp [consumedEq] at transition
+  | some remaining =>
+      simp only [consumedEq] at transition
+      have invariant := ownership position positionMember coordinate
+      change SourceOwnershipInvariant store source input
+        position.sourceCapabilities frameRoots at invariant
+      obtain ⟨_, readyOwnership⟩ :=
+        SourceOwnershipInvariant.consumeCapability_ownership
+        (consumedRoots := []) (suffixRoots := frameRoots) invariant.holds
+        (by simpa using invariant.ownership) resolved consumedEq
+      have noRoots :=
+        SourceOwnershipInvariant.rootsForCapabilities_eq_nil_of_noOwnedRoots
+          (source := source) transition.2
+      simpa [noRoots] using readyOwnership
+
+/-- Restore an addressed ordinary-call continuation directly from the
+callee's terminal framed ownership, with no caller-supplied post-call
+ownership premise. -/
+theorem callResult {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {address : Ix.Compiler.Ixon.Address} {signature : Signature}
+    {sourceArguments : Array IxIR1.Atom} {instruction : Instr}
+    {next : Lower.CodeTrace}
+    (signatureAt : Lower.targetSignature?
+      checked.artifact.program.declarations address = some signature)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call address sourceArguments) index instruction next))
+    {before : Lower.PositionTrace} {remaining : Array Lower.BindingCap}
+    (beforeMember : before ∈ checked.artifact.trace.positions)
+    (beforeCoordinate : before.coordinateMatches site blockId
+      (.instruction index) input = true)
+    {beforeStore afterStore : IxIR1.Store} {source values : List RVal}
+    {value : RVal} {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.call address sourceArguments) index instruction next)
+      beforeStore source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (consumed : Lower.callRemainingCapabilities? before.sourceCapabilities input
+      signature sourceArguments = some remaining)
+    (resultOwnership : IxIR1.Sim.RootOwnership afterStore
+      (⟨signature.result, value⟩ ::
+        (rootsForCapabilities remaining.toList source ++ frameRoots))) :
+    SourceOwnershipAt checked.artifact.trace.positions next afterStore
+      (value :: source) frameRoots := by
+  have beforeInvariant := ownership before beforeMember (by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        beforeCoordinate)
+  change SourceOwnershipInvariant beforeStore source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  intro after afterMember afterCoordinate
+  have transition := checked.callTransition functionMember signatureAt
+    descendant beforeMember beforeCoordinate afterMember afterCoordinate
+  unfold Lower.PositionTrace.callResultMatches at transition
+  simp only [consumed, Bool.and_eq_true, beq_iff_eq] at transition
+  rw [← transition.2]
+  exact beforeInvariant.callResultInvariant resolved consumed transition.1
+    resultOwnership
+
+/-- Restore a recursive ordinary-call continuation from the callee's exact
+terminal ownership. -/
+theorem callSelfResult {checked : Lower.Checked}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceArguments : Array IxIR1.Atom} {instruction : Instr}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index instruction next))
+    {before : Lower.PositionTrace} {remaining : Array Lower.BindingCap}
+    (beforeMember : before ∈ checked.artifact.trace.positions)
+    (beforeCoordinate : before.coordinateMatches site blockId
+      (.instruction index) input = true)
+    {beforeStore afterStore : IxIR1.Store} {source values : List RVal}
+    {value : RVal} {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index instruction next)
+      beforeStore source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (consumed : Lower.callRemainingCapabilities? before.sourceCapabilities input
+      functionTrace.generated.signature sourceArguments = some remaining)
+    (resultOwnership : IxIR1.Sim.RootOwnership afterStore
+      (⟨functionTrace.generated.signature.result, value⟩ ::
+        (rootsForCapabilities remaining.toList source ++ frameRoots))) :
+    SourceOwnershipAt checked.artifact.trace.positions next afterStore
+      (value :: source) frameRoots := by
+  have beforeInvariant := ownership before beforeMember (by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        beforeCoordinate)
+  change SourceOwnershipInvariant beforeStore source input
+    before.sourceCapabilities frameRoots at beforeInvariant
+  intro after afterMember afterCoordinate
+  have transition := checked.callSelfTransition functionMember descendant
+    beforeMember beforeCoordinate afterMember afterCoordinate
+  unfold Lower.PositionTrace.callResultMatches at transition
+  simp only [consumed, Bool.and_eq_true, beq_iff_eq] at transition
+  rw [← transition.2]
+  exact beforeInvariant.callResultInvariant resolved consumed transition.1
+    resultOwnership
+
+end SourceOwnershipAt
+
+/-- Checked allocation derives its target field-world evidence from the
+producer capability position and the dynamic ownership invariant at that
+recursive trace node.  No allocation-shaped root list is supplied by the
+caller. -/
+theorem StoreRel.fieldWorlds_of_checked_allocation_capabilities
+    {checked : Lower.Checked} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {world : Ix.Compiler.Ixon.Owned} {identity : CtorId}
+    {sourceArguments : Array IxIR1.Atom} {instruction : Instr}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc world identity sourceArguments) index instruction next))
+    {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    (relation : StoreRel sourceStore targetStore)
+    {source : List RVal} {values : List RVal} {schema : CtorSchema}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownershipAt : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc world identity sourceArguments) index instruction next)
+      sourceStore source frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (schemaAt : checked.artifact.validationContext.schemas world identity =
+      some schema) :
+    Eval.FieldWorlds targetStore schema values.toArray := by
+  obtain ⟨position, positionMember, positionMatch⟩ :=
+    checked.allocationPosition functionMember descendant
+  have coordinate :=
+    position.coordinateMatches_of_allocationMatch positionMatch
+  have ownership := ownershipAt position positionMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          coordinate)
+  change SourceOwnershipInvariant sourceStore source input
+    position.sourceCapabilities frameRoots at ownership
+  apply relation.fieldWorlds_replicate
+    (checked.allocationSchemaFields functionMember descendant schemaAt)
+  · simpa using IxIR1.resolveAtoms_length resolved
+  · exact ownership.resolveAtoms_hasWorld positionMatch resolved
+
+/-- The exact source-side condition needed to reconcile shared release:
+IxIR₁ historically permits decrementing a malformed live node from zero,
+whereas IxIR₂ rejects that state.  No allocation-order or ownership-graph
+assumption is needed by the recursive work-list correspondence. -/
+def PositiveSharedRC (store : IxIR1.Store) : Prop :=
+  ∀ {location box}, store.get? location = some box →
+    box.world = .shared → 0 < box.rc
+
+/-- The source runtime facts threaded by the recursive structured simulation.
+Allocation order supplies the strict live-RC premise required by destructive
+IxIR₂ steps, bounded roots prevent stale evaluator bindings from naming
+future append locations, and live PAPs retain the source evaluator's strict
+under-saturation guarantee. -/
+structure SourceRuntimeInvariant (store : IxIR1.Store)
+    (roots : List RVal) : Prop where
+  order : IxIR1.Reclamation.AllocationOrderInvariant store
+  rootsInBounds : IxIR1.Reclamation.ValuesInBounds store roots
+  papsUnder : IxIR1.Reclamation.PAPsUnder store
+
+namespace SourceRuntimeInvariant
+
+/-- The empty source machine establishes the recursive runtime invariant. -/
+theorem empty : SourceRuntimeInvariant ({} : IxIR1.Store) [] :=
+  ⟨IxIR1.Reclamation.AllocationOrderInvariant.empty,
+    IxIR1.Reclamation.ValuesInBounds.nil _,
+    IxIR1.Reclamation.PAPsUnder.empty⟩
+
+/-- Allocation order is stronger than the shared-only positivity premise used
+by the exact destructive-step simulation. -/
+theorem positiveSharedRC {store : IxIR1.Store} {roots : List RVal}
+    (invariant : SourceRuntimeInvariant store roots) :
+    PositiveSharedRC store := by
+  intro location box found _
+  exact invariant.order.rc_pos found
+
+/-- Heap-world evidence for an owned root implies that its location, when
+present, lies within the current append-only node array. -/
+private theorem hasWorld_valueInBounds {store : IxIR1.Store}
+    {world : Ix.Compiler.Ixon.Owned} {value : RVal}
+    (hasWorld : IxIR1.Sim.HasWorld store world value) :
+    IxIR1.Reclamation.ValueInBounds store value := by
+  cases value with
+  | loc location =>
+      obtain ⟨box, found, _⟩ := hasWorld
+      exact IxIR1.Reclamation.RVal.inBounds_of_get? found
+  | lit literal => trivial
+  | erased => trivial
+
+/-- Canonical shared callee-entry roots provide the bounded environment half
+of the runtime invariant; allocation order is supplied by the PAP
+retain/release prefix. -/
+theorem sharedEntry {store : IxIR1.Store} {values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (order : IxIR1.Reclamation.AllocationOrderInvariant store)
+    (papsUnder : IxIR1.Reclamation.PAPsUnder store)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (IxIR1.Sim.rootsFor .shared values ++ frameRoots)) :
+    SourceRuntimeInvariant store values.reverse := by
+  have bounds : IxIR1.Reclamation.ValuesInBounds store values := by
+    intro value member
+    apply hasWorld_valueInBounds
+    apply ownership.roots_world ⟨.shared, value⟩
+    exact List.mem_append_left _ (by
+      simpa [IxIR1.Sim.rootsFor] using member)
+  exact ⟨order, bounds.reverse, papsUnder⟩
+
+/-- Resolving one source atom cannot manufacture a future heap location. -/
+theorem resolveAtom {store : IxIR1.Store} {roots : List RVal}
+    (invariant : SourceRuntimeInvariant store roots)
+    {atom : IxIR1.Atom} {value : RVal}
+    (resolved : IxIR1.resolveAtom roots atom = .ok value) :
+    IxIR1.Reclamation.ValueInBounds store value :=
+  IxIR1.Reclamation.resolveAtom_inBounds invariant.rootsInBounds resolved
+
+/-- A resolved source argument vector is a valid root set in the unchanged
+store. -/
+theorem resolveAtoms {store : IxIR1.Store} {roots : List RVal}
+    (invariant : SourceRuntimeInvariant store roots)
+    {atoms : Array IxIR1.Atom} {values : List RVal}
+    (resolved : IxIR1.resolveAtoms roots atoms = .ok values) :
+    SourceRuntimeInvariant store values :=
+  ⟨invariant.order,
+    IxIR1.Reclamation.resolveAtoms_inBounds invariant.rootsInBounds resolved,
+    invariant.papsUnder⟩
+
+/-- Call entry reverses source arguments into the callee's de Bruijn
+environment without changing their boundedness. -/
+theorem resolveAtomsReverse {store : IxIR1.Store} {roots : List RVal}
+    (invariant : SourceRuntimeInvariant store roots)
+    {atoms : Array IxIR1.Atom} {values : List RVal}
+    (resolved : IxIR1.resolveAtoms roots atoms = .ok values) :
+    SourceRuntimeInvariant store values.reverse :=
+  ⟨invariant.order,
+    (IxIR1.Reclamation.resolveAtoms_inBounds
+      invariant.rootsInBounds resolved).reverse,
+    invariant.papsUnder⟩
+
+/-- Constructor dispatch prepends the live node's fields, in the evaluator's
+reverse field order, to the child environment. Allocation order proves every
+field is already bounded. -/
+theorem constructorBranch {store : IxIR1.Store} {roots : List RVal}
+    (invariant : SourceRuntimeInvariant store roots)
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal}
+    (found : store.get? location = some box)
+    (node : box.node = .ctorN cid fields) :
+    SourceRuntimeInvariant store (fields.toList.reverse ++ roots) := by
+  have fieldBounds :
+      IxIR1.Reclamation.ValuesInBounds store fields.toList := by
+    have children := invariant.order.childrenInBounds found
+    simpa [IxIR1.Sim.nodeChildren, node] using children
+  exact ⟨invariant.order,
+    fieldBounds.reverse.append invariant.rootsInBounds,
+    invariant.papsUnder⟩
+
+/-- Peeling a Nat successor adds only a scalar predecessor to the child
+environment, so the heap component of the invariant is unchanged. -/
+theorem natSuccessor {store : IxIR1.Store} {roots : List RVal}
+    (invariant : SourceRuntimeInvariant store roots) (predecessor : Nat) :
+    SourceRuntimeInvariant store (.lit (.nat predecessor) :: roots) :=
+  ⟨invariant.order,
+    IxIR1.Reclamation.ValuesInBounds.cons (by trivial)
+      invariant.rootsInBounds,
+    invariant.papsUnder⟩
+
+/-- A successful source code run that executes no reuse preserves allocation
+order, keeps the old environment bounded, and adds the result as a bounded
+root. -/
+theorem runCode {ctx : IxIR1.Ctx} {fuel : Nat} {cur : IxIR1.FnDef}
+    {store store' : IxIR1.Store} {env : List RVal} {code : IxIR1.Code}
+    {value : RVal} (invariant : SourceRuntimeInvariant store env)
+    (reuses : store'.reuses = store.reuses)
+    (run : IxIR1.runCode ctx fuel cur store env code = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: env) := by
+  have ordered := IxIR1.Reclamation.runCode_order_of_reuses_eq
+    invariant.order invariant.rootsInBounds reuses run
+  have oldRoots := invariant.rootsInBounds.mono
+    (IxIR1.Reclamation.runCode_footprint run).nodes_size
+  have papsUnder := IxIR1.Reclamation.runCode_papsUnder_of_reuses_eq
+    invariant.order invariant.rootsInBounds invariant.papsUnder reuses run
+  exact ⟨ordered.1,
+    IxIR1.Reclamation.ValuesInBounds.cons ordered.2 oldRoots,
+    papsUnder⟩
+
+/-- Operation-level form of `runCode`; this is the induction rule used at a
+generated nonterminal instruction. -/
+theorem runOp {ctx : IxIR1.Ctx} {fuel : Nat} {cur : IxIR1.FnDef}
+    {store store' : IxIR1.Store} {env : List RVal} {op : IxIR1.Op}
+    {value : RVal} (invariant : SourceRuntimeInvariant store env)
+    (reuses : store'.reuses = store.reuses)
+    (run : IxIR1.runOp ctx fuel cur store env op = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: env) := by
+  have ordered := IxIR1.Reclamation.runOp_order_of_reuses_eq
+    invariant.order invariant.rootsInBounds reuses run
+  have oldRoots := invariant.rootsInBounds.mono
+    (IxIR1.Reclamation.runOp_footprint run).nodes_size
+  have papsUnder := IxIR1.Reclamation.runOp_papsUnder_of_reuses_eq
+    invariant.order invariant.rootsInBounds invariant.papsUnder reuses run
+  exact ⟨ordered.1,
+    IxIR1.Reclamation.ValuesInBounds.cons ordered.2 oldRoots,
+    papsUnder⟩
+
+/-- A successful declared invocation preserves the invariant on its argument
+roots and adds the returned value. -/
+theorem invoke {ctx : IxIR1.Ctx} {fuel : Nat} {address : Ixon.Address}
+    {args : List RVal} {store store' : IxIR1.Store} {value : RVal}
+    (invariant : SourceRuntimeInvariant store args)
+    (reuses : store'.reuses = store.reuses)
+    (run : IxIR1.invoke ctx fuel address args store = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: args) := by
+  have ordered := IxIR1.Reclamation.invoke_order_of_reuses_eq
+    invariant.order invariant.rootsInBounds reuses run
+  have oldRoots := invariant.rootsInBounds.mono
+    (IxIR1.Reclamation.invoke_footprint run).nodes_size
+  have papsUnder := IxIR1.Reclamation.invoke_papsUnder_of_reuses_eq
+    invariant.order invariant.rootsInBounds invariant.papsUnder reuses run
+  exact ⟨ordered.1,
+    IxIR1.Reclamation.ValuesInBounds.cons ordered.2 oldRoots,
+    papsUnder⟩
+
+/-- A successful higher-order application preserves the function/argument
+root set and adds its result. -/
+theorem applyGo {ctx : IxIR1.Ctx} {fuel : Nat}
+    {store store' : IxIR1.Store} {function : RVal} {args : List RVal}
+    {value : RVal}
+    (invariant : SourceRuntimeInvariant store (function :: args))
+    (reuses : store'.reuses = store.reuses)
+    (run : IxIR1.applyGo ctx fuel store function args = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: function :: args) := by
+  have ordered := IxIR1.Reclamation.applyGo_order_of_reuses_eq
+    invariant.order (invariant.rootsInBounds _ (by simp))
+    (fun argument member => invariant.rootsInBounds argument (by simp [member]))
+    reuses run
+  have oldRoots := invariant.rootsInBounds.mono
+    (IxIR1.Reclamation.applyGo_footprint run).nodes_size
+  have papsUnder := IxIR1.Reclamation.applyGo_papsUnder_of_reuses_eq
+    invariant.order (invariant.rootsInBounds _ (by simp))
+    (fun argument member => invariant.rootsInBounds argument (by
+      simp [member])) invariant.papsUnder reuses run
+  exact ⟨ordered.1,
+    IxIR1.Reclamation.ValuesInBounds.cons ordered.2 oldRoots,
+    papsUnder⟩
+
+/-- Reuse-free syntax discharges the counter premise of `runCode`. -/
+theorem runCodeNoReuse {ctx : IxIR1.Ctx} {fuel : Nat} {cur : IxIR1.FnDef}
+    {store store' : IxIR1.Store} {env : List RVal} {code : IxIR1.Code}
+    {value : RVal} (invariant : SourceRuntimeInvariant store env)
+    (hctx : IxIR1.NoReuse.CtxNoReuse ctx)
+    (hcur : IxIR1.NoReuse.CodeNoReuse cur.body)
+    (hcode : IxIR1.NoReuse.CodeNoReuse code)
+    (run : IxIR1.runCode ctx fuel cur store env code = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: env) :=
+  invariant.runCode
+    (IxIR1.NoReuse.runCode_reuses_eq hctx hcur hcode run) run
+
+/-- Reuse-free syntax discharges the counter premise of `runOp`. -/
+theorem runOpNoReuse {ctx : IxIR1.Ctx} {fuel : Nat} {cur : IxIR1.FnDef}
+    {store store' : IxIR1.Store} {env : List RVal} {op : IxIR1.Op}
+    {value : RVal} (invariant : SourceRuntimeInvariant store env)
+    (hctx : IxIR1.NoReuse.CtxNoReuse ctx)
+    (hcur : IxIR1.NoReuse.CodeNoReuse cur.body)
+    (hop : IxIR1.NoReuse.OpNoReuse op)
+    (run : IxIR1.runOp ctx fuel cur store env op = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: env) :=
+  invariant.runOp
+    (IxIR1.NoReuse.runOp_reuses_eq hctx hcur hop run) run
+
+/-- Context no-reuse discharges the counter premise of declared invocation. -/
+theorem invokeNoReuse {ctx : IxIR1.Ctx} {fuel : Nat}
+    {address : Ixon.Address} {args : List RVal}
+    {store store' : IxIR1.Store} {value : RVal}
+    (invariant : SourceRuntimeInvariant store args)
+    (hctx : IxIR1.NoReuse.CtxNoReuse ctx)
+    (run : IxIR1.invoke ctx fuel address args store = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: args) :=
+  invariant.invoke (IxIR1.NoReuse.invoke_reuses_eq hctx run) run
+
+/-- Context no-reuse discharges the counter premise of higher-order
+application. -/
+theorem applyGoNoReuse {ctx : IxIR1.Ctx} {fuel : Nat}
+    {store store' : IxIR1.Store} {function : RVal} {args : List RVal}
+    {value : RVal}
+    (invariant : SourceRuntimeInvariant store (function :: args))
+    (hctx : IxIR1.NoReuse.CtxNoReuse ctx)
+    (run : IxIR1.applyGo ctx fuel store function args = .ok (store', value)) :
+    SourceRuntimeInvariant store' (value :: function :: args) :=
+  invariant.applyGo (IxIR1.NoReuse.applyGo_reuses_eq hctx run) run
+
+end SourceRuntimeInvariant
+
+private theorem sourceNodesGet_of_get {store : IxIR1.Store}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (found : store.get? location = some box) :
+    store.nodes[location]? = some (some box) := by
+  rw [IxIR1.Store.get?, Option.bind_eq_some_iff] at found
+  obtain ⟨slot, slotAt, equal⟩ := found
+  change slot = some box at equal
+  subst slot
+  exact slotAt
+
+private theorem sourceGet_setBox_same {store : IxIR1.Store}
+    {location : Nat} {old new : IxIR1.NodeBox}
+    (found : store.get? location = some old) :
+    (store.setBox location new).get? location = some new := by
+  have nodesAt := sourceNodesGet_of_get found
+  obtain ⟨inBounds, _⟩ := Array.getElem?_eq_some_iff.mp nodesAt
+  simp [IxIR1.Store.setBox, IxIR1.Store.get?,
+    Array.set!_eq_setIfInBounds, inBounds]
+
+private theorem sourceGet_of_setBox_other {store : IxIR1.Store}
+    {location other : Nat} {old new box : IxIR1.NodeBox}
+    (different : location ≠ other)
+    (live : store.get? location = some old)
+    (found : (store.setBox location new).get? other = some box) :
+    store.get? other = some box := by
+  have nodesAt := sourceNodesGet_of_get live
+  obtain ⟨inBounds, _⟩ := Array.getElem?_eq_some_iff.mp nodesAt
+  simpa [IxIR1.Store.setBox, IxIR1.Store.get?,
+    Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds,
+    inBounds, different] using found
+
+private theorem sourceGet_kill_same {store : IxIR1.Store}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (found : store.get? location = some box) :
+    (store.kill location).get? location = none := by
+  have nodesAt := sourceNodesGet_of_get found
+  obtain ⟨inBounds, _⟩ := Array.getElem?_eq_some_iff.mp nodesAt
+  simp [IxIR1.Store.kill, IxIR1.Store.get?,
+    Array.set!_eq_setIfInBounds, inBounds]
+
+private theorem sourceGet_of_kill_other {store : IxIR1.Store}
+    {location other : Nat} {old box : IxIR1.NodeBox}
+    (different : location ≠ other)
+    (live : store.get? location = some old)
+    (found : (store.kill location).get? other = some box) :
+    store.get? other = some box := by
+  have nodesAt := sourceNodesGet_of_get live
+  obtain ⟨inBounds, _⟩ := Array.getElem?_eq_some_iff.mp nodesAt
+  simpa [IxIR1.Store.kill, IxIR1.Store.get?,
+    Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds,
+    inBounds, different] using found
+
+theorem PositiveSharedRC.rcTick {store : IxIR1.Store}
+    (positive : PositiveSharedRC store) : PositiveSharedRC store.rcTick := by
+  intro location box found shared
+  exact positive (by
+    simpa [IxIR1.Store.rcTick, IxIR1.Store.get?] using found) shared
+
+theorem PositiveSharedRC.setRc {store : IxIR1.Store} {location : Nat}
+    {box : IxIR1.NodeBox} {newRC : Nat}
+    (positive : PositiveSharedRC store)
+    (found : store.get? location = some box) (newPositive : 0 < newRC) :
+    PositiveSharedRC (store.setBox location { box with rc := newRC }) := by
+  intro other otherBox otherFound otherShared
+  by_cases equal : location = other
+  · subst other
+    have updated := sourceGet_setBox_same
+      (new := { box with rc := newRC }) found
+    have boxEqual : otherBox = { box with rc := newRC } :=
+      Option.some.inj (otherFound.symm.trans updated)
+    subst otherBox
+    exact newPositive
+  · exact positive
+      (sourceGet_of_setBox_other equal found otherFound) otherShared
+
+theorem PositiveSharedRC.kill {store : IxIR1.Store} {location : Nat}
+    {box : IxIR1.NodeBox} (positive : PositiveSharedRC store)
+    (found : store.get? location = some box) :
+    PositiveSharedRC (store.kill location) := by
+  intro other otherBox otherFound otherShared
+  by_cases equal : location = other
+  · subst other
+    rw [sourceGet_kill_same found] at otherFound
+    contradiction
+  · exact positive (sourceGet_of_kill_other equal found otherFound)
+      otherShared
+
+/-- A proof-side source-slot map. `none` marks a source binding whose ownership
+has already been consumed. The target register remains physically present
+inside its current SSA block, but no later source operand may resolve through
+that slot. -/
+abbrev EnvMap := Array (Option Atom)
+
+/-- Translate one live source atom through an explicit source-slot-to-target-
+atom map. The executable compiler certificate and runtime simulation share
+this single definition; dead entries deliberately fail translation. -/
+abbrev translateAtom (mapping : EnvMap) : IxIR1.Atom → Option Atom :=
+  Lower.InputMap.translateAtom mapping
+
+/-- Every live source environment slot resolves through its generated target
+atom to the same runtime value. Dead ownership slots are deliberately absent
+from this semantic premise. -/
+def EnvRel (source : List RVal) (target : Array RVal)
+    (mapping : EnvMap) : Prop :=
+  ∀ (index : Nat) (value : RVal) (atom : Atom),
+    source[index]? = some value →
+    mapping[index]? = some (some atom) →
+    Eval.resolveAtom target atom = .ok value
+
+/-- The empty source environment is related to the empty proof map. -/
+theorem EnvRel.empty (target : Array RVal := #[]) :
+    EnvRel [] target #[] := by
+  intro index value atom sourceGet
+  simp at sourceGet
+
+/-- Two live source slots mapped to the same target register contain the same
+runtime value. -/
+private theorem EnvRel.source_eq_of_same_reg
+    {source : List RVal} {target : Array RVal} {input : EnvMap}
+    (relation : EnvRel source target input)
+    {leftIndex rightIndex register : Nat} {leftValue rightValue : RVal}
+    (leftSource : source[leftIndex]? = some leftValue)
+    (rightSource : source[rightIndex]? = some rightValue)
+    (leftInput : input[leftIndex]? = some (some (.reg register)))
+    (rightInput : input[rightIndex]? = some (some (.reg register))) :
+    leftValue = rightValue := by
+  have leftResolved := relation leftIndex leftValue (.reg register)
+    leftSource leftInput
+  have rightResolved := relation rightIndex rightValue (.reg register)
+    rightSource rightInput
+  exact Except.ok.inj (leftResolved.symm.trans rightResolved)
+
+/-- A successful static edge-owner search identifies a live owned source slot
+whose predecessor atom is exactly the requested lender register. -/
+private theorem edgeOwnerIndex?_facts
+    {capabilities : Array Lower.BindingCap} {input : EnvMap}
+    {lender ownerIndex : Nat}
+    (found : Lower.edgeOwnerIndex? capabilities input lender =
+      some ownerIndex) :
+    ∃ world,
+      capabilities[ownerIndex]? = some (.owned world) ∧
+      input[ownerIndex]? = some (some (.reg lender)) := by
+  unfold Lower.edgeOwnerIndex? at found
+  have member := List.mem_of_find?_eq_some found
+  have matched := List.find?_some found
+  have bound : ownerIndex < capabilities.size := by
+    simpa using (List.mem_range.mp member)
+  cases capabilityAt : capabilities[ownerIndex]? with
+  | none => simp [capabilityAt] at matched
+  | some capability =>
+      cases capability with
+      | scalar | borrowed | dead => simp [capabilityAt] at matched
+      | owned world =>
+          cases inputAt : input[ownerIndex]? with
+          | none => simp [capabilityAt, inputAt] at matched
+          | some slot =>
+              cases slot with
+              | none => simp [capabilityAt, inputAt] at matched
+              | some atom =>
+                  cases atom with
+                  | lit literal => simp [capabilityAt, inputAt] at matched
+                  | erased => simp [capabilityAt, inputAt] at matched
+                  | reg actual =>
+                      have actualEq : actual = lender :=
+                        beq_iff_eq.mp (by
+                          simpa [capabilityAt, inputAt] using matched)
+                      subst actual
+                      exact ⟨world, rfl, rfl⟩
+
+/-- Edge rebasing changes only borrow-lender names (or maps an invalid lender
+to `dead`); it preserves every dynamic pointwise capability fact. -/
+private theorem CapabilityHolds.rebaseEdge
+    {store : IxIR1.Store} {value : RVal}
+    {allCapabilities : Array Lower.BindingCap} {input : EnvMap}
+    {capability : Lower.BindingCap}
+    (holds : CapabilityHolds store capability value) :
+    CapabilityHolds store
+      ((capability.rebaseEdge? allCapabilities input).getD .dead) value := by
+  cases capability with
+  | scalar => simpa [Lower.BindingCap.rebaseEdge?, CapabilityHolds] using holds
+  | owned world =>
+      simpa [Lower.BindingCap.rebaseEdge?, CapabilityHolds] using holds
+  | dead => simp [Lower.BindingCap.rebaseEdge?, CapabilityHolds]
+  | borrowed world lender =>
+      cases lender with
+      | caller =>
+          simpa [Lower.BindingCap.rebaseEdge?, CapabilityHolds] using holds
+      | value lender =>
+          cases owner : Lower.edgeOwnerIndex? allCapabilities input lender with
+          | none =>
+              simp [Lower.BindingCap.rebaseEdge?, owner,
+                CapabilityHolds]
+          | some ownerIndex =>
+              simp only [Lower.BindingCap.rebaseEdge?, owner]
+              generalize lookupEq : allCapabilities[ownerIndex]? = lookup
+              cases lookup with
+              | none => simp [CapabilityHolds]
+              | some ownerCapability =>
+                  cases ownerCapability with
+                  | scalar => simp [CapabilityHolds]
+                  | borrowed ownerWorld ownerLender =>
+                      simp [CapabilityHolds]
+                  | dead => simp [CapabilityHolds]
+                  | owned ownerWorld =>
+                      by_cases same : ownerWorld = world
+                      · simpa [same, CapabilityHolds] using holds
+                      · simp [same, CapabilityHolds]
+
+/-- Edge rebasing does not change which source slots contribute ownership
+roots. -/
+private theorem rootsForCapabilities_rebaseEdge
+    (allCapabilities : Array Lower.BindingCap) (input : EnvMap) :
+    ∀ (capabilities : List Lower.BindingCap) (source : List RVal),
+      rootsForCapabilities
+          (capabilities.map fun capability =>
+            (capability.rebaseEdge? allCapabilities input).getD .dead)
+          source =
+        rootsForCapabilities capabilities source := by
+  intro capabilities
+  induction capabilities with
+  | nil => intro source; simp [rootsForCapabilities]
+  | cons capability capabilities ih =>
+      intro source
+      cases source with
+      | nil => simp [rootsForCapabilities]
+      | cons value values =>
+          cases capability with
+          | scalar =>
+              change rootsForCapabilities
+                  (capabilities.map fun capability =>
+                    (capability.rebaseEdge? allCapabilities input).getD .dead)
+                  values = rootsForCapabilities capabilities values
+              exact ih values
+          | owned world =>
+              change (⟨world, value⟩ : IxIR1.Sim.Root) ::
+                    rootsForCapabilities
+                      (capabilities.map fun capability =>
+                        (capability.rebaseEdge? allCapabilities input).getD
+                          .dead)
+                      values =
+                  ⟨world, value⟩ :: rootsForCapabilities capabilities values
+              exact congrArg (List.cons ⟨world, value⟩) (ih values)
+          | dead =>
+              change rootsForCapabilities
+                  (capabilities.map fun capability =>
+                    (capability.rebaseEdge? allCapabilities input).getD .dead)
+                  values = rootsForCapabilities capabilities values
+              exact ih values
+          | borrowed world lender =>
+              cases lender with
+              | caller =>
+                  change rootsForCapabilities
+                      (capabilities.map fun capability =>
+                        (capability.rebaseEdge? allCapabilities input).getD
+                          .dead)
+                      values = rootsForCapabilities capabilities values
+                  exact ih values
+              | value lender =>
+                  cases owner : Lower.edgeOwnerIndex? allCapabilities input
+                      lender with
+                  | none =>
+                      simpa only [List.map_cons,
+                        Lower.BindingCap.rebaseEdge?, owner,
+                        Option.getD_none,
+                        rootsForCapabilities] using ih values
+                  | some ownerIndex =>
+                      simp only [List.map_cons,
+                        Lower.BindingCap.rebaseEdge?, owner]
+                      generalize lookupEq :
+                        allCapabilities[ownerIndex]? = lookup
+                      cases lookup with
+                      | none =>
+                          change rootsForCapabilities
+                              (capabilities.map fun capability =>
+                                (capability.rebaseEdge? allCapabilities
+                                  input).getD .dead)
+                              values = rootsForCapabilities capabilities values
+                          exact ih values
+                      | some ownerCapability =>
+                          cases ownerCapability with
+                          | scalar | borrowed | dead =>
+                              change rootsForCapabilities
+                                  (capabilities.map fun capability =>
+                                    (capability.rebaseEdge? allCapabilities
+                                      input).getD .dead)
+                                  values = rootsForCapabilities capabilities values
+                              exact ih values
+                          | owned ownerWorld =>
+                              by_cases same : ownerWorld = world
+                              · have sameBool :
+                                    (ownerWorld == world) = true := by
+                                  simpa using same
+                                simpa [Lower.BindingCap.rebaseEdge?, sameBool,
+                                  rootsForCapabilities] using ih values
+                              · have different :
+                                    ¬ ((ownerWorld == world) = true) := by
+                                  simpa using same
+                                simpa [Lower.BindingCap.rebaseEdge?, different,
+                                  rootsForCapabilities] using ih values
+
+namespace SourceOwnershipInvariant
+
+/-- Crossing a canonical generated CFG edge preserves exact dynamic source
+ownership. Local borrow lenders are renamed from predecessor SSA registers to
+the same-index successor parameters selected by the checked edge audit. -/
+theorem edge
+    {store : IxIR1.Store} {source : List RVal} {target : Array RVal}
+    {input : EnvMap} {capabilities afterCapabilities :
+      Array Lower.BindingCap} {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (environments : EnvRel source target input)
+    (transition : Lower.edgeCapabilities? capabilities input =
+      some afterCapabilities) :
+    SourceOwnershipInvariant store source
+      (Lower.EdgeTrace.explicitMapOf input) afterCapabilities frameRoots := by
+  unfold Lower.edgeCapabilities? at transition
+  split at transition <;> try contradiction
+  injection transition with afterEq
+  subst afterCapabilities
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · simpa using invariant.length
+  · intro index capability value capabilityAt valueAt
+    rw [Array.getElem?_map] at capabilityAt
+    cases oldAt : capabilities[index]? with
+    | none => simp [oldAt] at capabilityAt
+    | some oldCapability =>
+        simp only [oldAt, Option.map_some, Option.some.injEq] at capabilityAt
+        subst capability
+        exact CapabilityHolds.rebaseEdge
+          (invariant.holds oldAt valueAt)
+  · simpa [Array.toList_map,
+      rootsForCapabilities_rebaseEdge] using invariant.ownership
+  · intro index world lender value capabilityAt valueAt
+    rw [Array.getElem?_map] at capabilityAt
+    cases oldAt : capabilities[index]? with
+    | none => simp [oldAt] at capabilityAt
+    | some oldCapability =>
+        simp only [oldAt, Option.map_some, Option.some.injEq] at capabilityAt
+        cases oldCapability with
+        | scalar =>
+            simp [Lower.BindingCap.rebaseEdge?] at capabilityAt
+        | owned oldWorld =>
+            simp [Lower.BindingCap.rebaseEdge?] at capabilityAt
+        | dead =>
+            simp [Lower.BindingCap.rebaseEdge?] at capabilityAt
+        | borrowed oldWorld oldLender =>
+            cases oldLender with
+            | caller =>
+                have outputEq :
+                    Lower.BindingCap.borrowed oldWorld .caller =
+                      .borrowed world lender := by
+                  simpa [Lower.BindingCap.rebaseEdge?] using capabilityAt
+                injection outputEq with worldEq lenderEq
+                subst world
+                subst lender
+                exact invariant.borrows oldAt valueAt
+            | value oldLender =>
+                cases owner : Lower.edgeOwnerIndex? capabilities input
+                    oldLender with
+                | none =>
+                    simp [Lower.BindingCap.rebaseEdge?, owner] at capabilityAt
+                | some ownerIndex =>
+                    obtain ⟨ownerWorld, ownerCapability, ownerInput⟩ :=
+                      edgeOwnerIndex?_facts owner
+                    by_cases sameWorld : ownerWorld = oldWorld
+                    · subst ownerWorld
+                      have outputEq :
+                          Lower.BindingCap.borrowed oldWorld
+                              (.value ownerIndex) =
+                            .borrowed world lender := by
+                        simpa [Lower.BindingCap.rebaseEdge?, owner,
+                          ownerCapability] using capabilityAt
+                      injection outputEq with worldEq lenderEq
+                      subst world
+                      subst lender
+                      obtain ⟨oldOwnerIndex, oldOwnerValue, oldOwnerInput,
+                        oldOwnerCapability, oldOwnerSource, support⟩ :=
+                        invariant.borrows oldAt valueAt
+                      have ownerBound : ownerIndex < capabilities.size :=
+                        (Array.getElem?_eq_some_iff.mp ownerCapability).1
+                      have sourceBound : ownerIndex < source.length := by
+                        rw [invariant.length]
+                        exact ownerBound
+                      let ownerValue := source[ownerIndex]
+                      have ownerSource :
+                          source[ownerIndex]? = some ownerValue :=
+                        List.getElem?_eq_some_iff.mpr ⟨sourceBound, rfl⟩
+                      have ownerValueEq : ownerValue = oldOwnerValue :=
+                        environments.source_eq_of_same_reg ownerSource
+                          oldOwnerSource ownerInput oldOwnerInput
+                      have successorInput :
+                          (Lower.EdgeTrace.explicitMapOf input)[ownerIndex]? =
+                            some (some (.reg ownerIndex)) := by
+                        unfold Lower.EdgeTrace.explicitMapOf
+                        rw [Array.getElem?_mapIdx]
+                        simp [ownerInput]
+                      have successorCapability :
+                          (capabilities.map fun capability =>
+                            (capability.rebaseEdge? capabilities input).getD
+                              .dead)[ownerIndex]? =
+                            some (.owned oldWorld) := by
+                        rw [Array.getElem?_map, ownerCapability]
+                        rfl
+                      refine ⟨ownerIndex, ownerValue, successorInput,
+                        successorCapability, ownerSource, ?_⟩
+                      simpa [ownerValueEq] using support
+                    · simp [Lower.BindingCap.rebaseEdge?, owner,
+                        ownerCapability, sameWorld] at capabilityAt
+
+/-- Shifting a local lender register does not change the pointwise meaning of
+its capability. -/
+private theorem CapabilityHolds.shiftLender
+    {store : IxIR1.Store} {value : RVal} {amount : Nat}
+    {capability : Lower.BindingCap}
+    (holds : CapabilityHolds store capability value) :
+    CapabilityHolds store (capability.shiftLender amount) value := by
+  cases capability with
+  | scalar | owned | dead => exact holds
+  | borrowed world lender =>
+      cases lender <;> exact holds
+
+/-- Lender-register shifts are ownership-inert. -/
+private theorem rootsForCapabilities_shiftLender (amount : Nat) :
+    ∀ (capabilities : List Lower.BindingCap) (source : List RVal),
+      rootsForCapabilities
+          (capabilities.map (Lower.BindingCap.shiftLender amount)) source =
+        rootsForCapabilities capabilities source := by
+  intro capabilities
+  induction capabilities with
+  | nil => intro source; simp [rootsForCapabilities]
+  | cons capability capabilities ih =>
+      intro source
+      cases source with
+      | nil => simp [rootsForCapabilities]
+      | cons value values =>
+          cases capability with
+          | scalar | owned | dead =>
+              simp [Lower.BindingCap.shiftLender, rootsForCapabilities, ih]
+          | borrowed world lender =>
+              cases lender <;>
+                simp [Lower.BindingCap.shiftLender, rootsForCapabilities, ih]
+
+/-- Prefixing one scalar successor parameter and shifting every local lender
+by one preserves exact dynamic source ownership. -/
+theorem prependScalarShift
+    {store : IxIR1.Store} {source : List RVal} {input : EnvMap}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root} {scalarValue : RVal}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (scalar : IxIR1.Sim.rvalLocation? scalarValue = none) :
+    SourceOwnershipInvariant store (scalarValue :: source)
+      (Lower.EdgeTrace.sourceMapOf 1 input)
+      (#[.scalar] ++ capabilities.map (Lower.BindingCap.shiftLender 1))
+      frameRoots := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · simp [invariant.length, Array.size_append, Nat.add_comm]
+  · intro index capability value capabilityAt valueAt
+    cases index with
+    | zero =>
+        simp [Array.getElem?_append] at capabilityAt valueAt
+        subst capability
+        subst value
+        exact scalar
+    | succ index =>
+        simp [Array.getElem?_append] at capabilityAt valueAt
+        cases oldAt : capabilities[index]? with
+        | none => simp [oldAt] at capabilityAt
+        | some oldCapability =>
+            simp only [oldAt, Option.some.injEq] at capabilityAt
+            obtain ⟨candidate, rfl, shifted⟩ := capabilityAt
+            subst capability
+            exact CapabilityHolds.shiftLender
+              (invariant.holds oldAt valueAt)
+  · simpa [Array.toList_append, Array.toList_map, rootsForCapabilities,
+      rootsForCapabilities_shiftLender] using invariant.ownership
+  · intro index world lender value capabilityAt valueAt
+    cases index with
+    | zero => simp [Array.getElem?_append] at capabilityAt
+    | succ index =>
+        simp [Array.getElem?_append] at capabilityAt valueAt
+        cases oldAt : capabilities[index]? with
+        | none => simp [oldAt] at capabilityAt
+        | some oldCapability =>
+            simp only [oldAt, Option.some.injEq] at capabilityAt
+            cases oldCapability with
+            | scalar => simp [Lower.BindingCap.shiftLender] at capabilityAt
+            | owned oldWorld =>
+                simp [Lower.BindingCap.shiftLender] at capabilityAt
+            | dead => simp [Lower.BindingCap.shiftLender] at capabilityAt
+            | borrowed oldWorld oldLender =>
+                cases oldLender with
+                | caller =>
+                    have outputEq :
+                        Lower.BindingCap.borrowed oldWorld .caller =
+                          .borrowed world lender := by
+                      simpa [Lower.BindingCap.shiftLender] using capabilityAt
+                    injection outputEq with worldEq lenderEq
+                    subst world
+                    subst lender
+                    exact invariant.borrows oldAt valueAt
+                | value oldLender =>
+                    have outputEq :
+                        Lower.BindingCap.borrowed oldWorld
+                            (.value (oldLender + 1)) =
+                          .borrowed world lender := by
+                      simpa [Lower.BindingCap.shiftLender] using capabilityAt
+                    injection outputEq with worldEq lenderEq
+                    subst world
+                    subst lender
+                    obtain ⟨ownerIndex, ownerValue, ownerInput,
+                      ownerCapability, ownerSource, support⟩ :=
+                      invariant.borrows oldAt valueAt
+                    have successorInput :
+                        (Lower.EdgeTrace.sourceMapOf 1 input
+                          )[ownerIndex + 1]? =
+                            some (some (.reg (oldLender + 1))) := by
+                      unfold Lower.EdgeTrace.sourceMapOf
+                      simp [Array.getElem?_append, ownerInput,
+                        Lower.shiftAtom]
+                    have successorCapability :
+                        (#[.scalar] ++ capabilities.map
+                          (Lower.BindingCap.shiftLender 1))[ownerIndex + 1]? =
+                            some (.owned oldWorld) := by
+                      simp [Array.getElem?_append, ownerCapability,
+                        Lower.BindingCap.shiftLender]
+                    have successorSource :
+                        (scalarValue :: source)[ownerIndex + 1]? =
+                          some ownerValue := by
+                      simpa [Nat.add_comm] using ownerSource
+                    exact ⟨ownerIndex + 1, ownerValue, successorInput,
+                      successorCapability, successorSource, support⟩
+
+/-- A checked Nat-zero edge is exactly the canonical edge transform. -/
+theorem natZero
+    {store : IxIR1.Store} {source : List RVal} {target : Array RVal}
+    {input : EnvMap} {capabilities afterCapabilities :
+      Array Lower.BindingCap} {frameRoots : List IxIR1.Sim.Root}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (environments : EnvRel source target input)
+    (transition : Lower.natZeroChildCapabilities? input capabilities =
+      some afterCapabilities) :
+    SourceOwnershipInvariant store source
+      (Lower.EdgeTrace.explicitMapOf input) afterCapabilities frameRoots := by
+  exact invariant.edge environments transition
+
+/-- A checked Nat-successor edge rebases predecessor lenders, prefixes the
+peeled scalar, and shifts local successor-register lenders exactly once. -/
+theorem natSucc
+    {store : IxIR1.Store} {source : List RVal} {target : Array RVal}
+    {input : EnvMap} {capabilities afterCapabilities :
+      Array Lower.BindingCap} {frameRoots : List IxIR1.Sim.Root}
+    {predecessor : Nat}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (environments : EnvRel source target input)
+    (transition : Lower.natSuccChildCapabilities? input capabilities =
+      some afterCapabilities) :
+    SourceOwnershipInvariant store (.lit (.nat predecessor) :: source)
+      (Lower.EdgeTrace.sourceMapOf 1
+        (Lower.EdgeTrace.explicitMapOf input))
+      afterCapabilities frameRoots := by
+  unfold Lower.natSuccChildCapabilities? at transition
+  cases rebasedEq : Lower.edgeCapabilities? capabilities input with
+  | none => simp [rebasedEq] at transition
+  | some rebased =>
+      simp [rebasedEq] at transition
+      subst afterCapabilities
+      apply prependScalarShift (invariant.edge environments rebasedEq)
+      rfl
+
+/-- Prefixing equally-sized source, input, and capability vectors preserves
+the provenance of every borrow in the old suffix. -/
+private theorem prependBorrowProvenancePrefix
+    {store : IxIR1.Store} {source prefixValues : List RVal}
+    {input prefixInput : EnvMap}
+    {capabilities prefixCapabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    (inputSize : prefixInput.size = prefixValues.length)
+    (capabilitySize : prefixCapabilities.size = prefixValues.length)
+    {world : Ix.Compiler.Ixon.Owned} {lender : BorrowLender} {value : RVal}
+    (provenance : BorrowProvenance store source input capabilities frameRoots
+      world lender value) :
+    BorrowProvenance store (prefixValues ++ source) (prefixInput ++ input)
+      (prefixCapabilities ++ capabilities) frameRoots world lender value := by
+  cases lender with
+  | caller => exact provenance
+  | value lenderId =>
+      obtain ⟨ownerIndex, ownerValue, ownerInput, ownerCapability,
+        ownerSource, support⟩ := provenance
+      refine ⟨prefixValues.length + ownerIndex, ownerValue, ?_, ?_, ?_,
+        support⟩
+      · simpa [Array.getElem?_append, inputSize] using ownerInput
+      · simpa [Array.getElem?_append, capabilitySize] using ownerCapability
+      · rw [List.getElem?_append_right (by omega)]
+        simpa using ownerSource
+
+/-- A uniform borrowed capability prefix contributes no ownership roots. -/
+private theorem rootsForCapabilities_borrowedPrefix
+    (world : Ix.Compiler.Ixon.Owned) (lender : BorrowLender) :
+    ∀ (prefixValues : List RVal) (capabilities : List Lower.BindingCap)
+        (source : List RVal),
+      rootsForCapabilities
+          (List.replicate prefixValues.length (.borrowed world lender) ++
+            capabilities)
+          (prefixValues ++ source) =
+        rootsForCapabilities capabilities source := by
+  intro prefixValues
+  induction prefixValues with
+  | nil => intro capabilities source; simp
+  | cons value values ih =>
+      intro capabilities source
+      rw [show (value :: values).length = Nat.succ values.length by rfl,
+        List.replicate_succ]
+      exact ih capabilities source
+
+/-- Prepending constructor fields as uniform borrows extends one retained
+scrutinee-lender path to every fetched field while leaving the exact root
+multiset unchanged. -/
+theorem constructorFields
+    {store : IxIR1.Store} {source : List RVal} {input : EnvMap}
+    {capabilities : Array Lower.BindingCap}
+    {frameRoots : List IxIR1.Sim.Root}
+    {fields : Array RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {cid : CtorId} {world : Ix.Compiler.Ixon.Owned}
+    {lender : BorrowLender} {parameterCount : Nat}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (provenance : BorrowProvenance store source input capabilities frameRoots
+      world lender (.loc location))
+    (found : store.get? location = some box)
+    (node : box.node = .ctorN cid fields) :
+    SourceOwnershipInvariant store (fields.toList.reverse ++ source)
+      (Lower.constructorChildInputMap parameterCount fields.size ++ input)
+      (Array.replicate fields.size (.borrowed world lender) ++ capabilities)
+      frameRoots := by
+  let prefixValues := fields.toList.reverse
+  let prefixInput := Lower.constructorChildInputMap parameterCount fields.size
+  let prefixCapabilities :=
+    Array.replicate fields.size (Lower.BindingCap.borrowed world lender)
+  have prefixLength : prefixValues.length = fields.size := by
+    simp [prefixValues]
+  have inputSize : prefixInput.size = prefixValues.length := by
+    simp [prefixInput, Lower.constructorChildInputMap, prefixLength]
+  have capabilitySize : prefixCapabilities.size = prefixValues.length := by
+    simp [prefixCapabilities, prefixLength]
+  have extendField : ∀ {value : RVal}, value ∈ fields.toList →
+      BorrowProvenance store (prefixValues ++ source)
+        (prefixInput ++ input) (prefixCapabilities ++ capabilities)
+        frameRoots world lender value := by
+    intro value member
+    apply prependBorrowProvenancePrefix inputSize capabilitySize
+    apply BorrowProvenance.child provenance found
+    simpa [IxIR1.Sim.nodeChildren, node] using member
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · simp [invariant.length]
+  · intro index capability value capabilityAt valueAt
+    by_cases prefixIndex : index < fields.size
+    · have prefixValueAt : prefixValues[index]? = some value := by
+        have bound : index < prefixValues.length := by
+          simpa [prefixLength] using prefixIndex
+        rw [List.getElem?_append_left bound] at valueAt
+        exact valueAt
+      have fieldMember : value ∈ fields.toList := by
+        have reverseMember : value ∈ prefixValues :=
+          List.mem_of_getElem? prefixValueAt
+        simpa [prefixValues] using reverseMember
+      have capabilityEq : capability = .borrowed world lender := by
+        have prefixBound : index < prefixCapabilities.size := by
+          simpa [prefixCapabilities] using prefixIndex
+        rw [Array.getElem?_append, if_pos prefixBound] at capabilityAt
+        simpa [prefixCapabilities, prefixIndex] using capabilityAt.symm
+      subst capability
+      exact BorrowProvenance.hasWorld invariant.ownership
+        (BorrowProvenance.child provenance found
+          (by simpa [IxIR1.Sim.nodeChildren, node] using fieldMember))
+    · let sourceIndex := index - fields.size
+      have afterPrefix : fields.size ≤ index := Nat.le_of_not_gt prefixIndex
+      have oldValueAt : source[sourceIndex]? = some value := by
+        rw [List.getElem?_append_right (by
+          simpa [prefixValues, prefixLength] using afterPrefix)] at valueAt
+        simpa [sourceIndex, prefixValues, prefixLength] using valueAt
+      have oldCapabilityAt : capabilities[sourceIndex]? =
+          some capability := by
+        rw [Array.getElem?_append] at capabilityAt
+        have notPrefix : ¬ index < prefixCapabilities.size := by
+          simpa [prefixCapabilities] using prefixIndex
+        rw [if_neg notPrefix] at capabilityAt
+        simpa [sourceIndex, prefixCapabilities] using capabilityAt
+      exact invariant.holds oldCapabilityAt oldValueAt
+  · rw [Array.toList_append]
+    have roots := rootsForCapabilities_borrowedPrefix world lender
+      prefixValues capabilities.toList source
+    rw [prefixLength] at roots
+    have rootsEq :
+        rootsForCapabilities
+            (prefixCapabilities.toList ++ capabilities.toList)
+            (prefixValues ++ source) =
+          rootsForCapabilities capabilities.toList source := by
+      simpa [prefixCapabilities] using roots
+    rw [rootsEq]
+    exact invariant.ownership
+  · intro index actualWorld actualLender value capabilityAt valueAt
+    by_cases prefixIndex : index < fields.size
+    · have prefixValueAt : prefixValues[index]? = some value := by
+        have bound : index < prefixValues.length := by
+          simpa [prefixLength] using prefixIndex
+        rw [List.getElem?_append_left bound] at valueAt
+        exact valueAt
+      have fieldMember : value ∈ fields.toList := by
+        have reverseMember : value ∈ prefixValues :=
+          List.mem_of_getElem? prefixValueAt
+        simpa [prefixValues] using reverseMember
+      have equalities : world = actualWorld ∧ lender = actualLender := by
+        have prefixBound : index < prefixCapabilities.size := by
+          simpa [prefixCapabilities] using prefixIndex
+        rw [Array.getElem?_append, if_pos prefixBound] at capabilityAt
+        simpa [prefixCapabilities, prefixIndex] using capabilityAt
+      rcases equalities with ⟨rfl, rfl⟩
+      exact extendField fieldMember
+    · let sourceIndex := index - fields.size
+      have afterPrefix : fields.size ≤ index := Nat.le_of_not_gt prefixIndex
+      have oldValueAt : source[sourceIndex]? = some value := by
+        rw [List.getElem?_append_right (by
+          simpa [prefixValues, prefixLength] using afterPrefix)] at valueAt
+        simpa [sourceIndex, prefixValues, prefixLength] using valueAt
+      have oldCapabilityAt : capabilities[sourceIndex]? =
+          some (.borrowed actualWorld actualLender) := by
+        rw [Array.getElem?_append] at capabilityAt
+        have notPrefix : ¬ index < prefixCapabilities.size := by
+          simpa [prefixCapabilities] using prefixIndex
+        rw [if_neg notPrefix] at capabilityAt
+        simpa [sourceIndex, prefixCapabilities] using capabilityAt
+      exact prependBorrowProvenancePrefix inputSize capabilitySize
+        (invariant.borrows oldCapabilityAt oldValueAt)
+
+/-- Successful translation of a source variable through the canonical edge
+map exposes its exact same-index successor register. -/
+private theorem explicitMapOf_at_of_translate_var
+    {input : EnvMap} {sourceIndex : Nat} {targetAtom : Atom}
+    (translated : Lower.InputMap.translateAtom
+      (Lower.EdgeTrace.explicitMapOf input) (.var sourceIndex) =
+        some targetAtom) :
+    (Lower.EdgeTrace.explicitMapOf input)[sourceIndex]? =
+      some (some (.reg sourceIndex)) := by
+  unfold Lower.InputMap.translateAtom at translated
+  cases mapped : (Lower.EdgeTrace.explicitMapOf input)[sourceIndex]? with
+  | none => simp [mapped] at translated
+  | some slot =>
+      cases slot with
+      | none => simp [mapped] at translated
+      | some atom =>
+          have atomEq : atom = targetAtom := by
+            simpa [mapped] using translated
+          unfold Lower.EdgeTrace.explicitMapOf at mapped
+          rw [Array.getElem?_mapIdx] at mapped
+          cases inputAt : input[sourceIndex]? with
+          | none => simp [inputAt] at mapped
+          | some slot =>
+              cases slot with
+              | none => simp [inputAt] at mapped
+              | some sourceAtom =>
+                  have registerEq : atom = .reg sourceIndex := by
+                    simpa [inputAt] using mapped.symm
+                  simp [registerEq]
+
+/-- The complete checked constructor-child transform: edge rebasing chooses
+the scrutinee lender, a uniform schema supplies the borrowed field prefix,
+and the runtime constructor supplies the concrete support edges. -/
+theorem constructor
+    {schemas : Ix.Compiler.Ixon.Owned → CtorId → Option CtorSchema}
+    {store : IxIR1.Store} {source : List RVal} {target : Array RVal}
+    {input : EnvMap} {capabilities afterCapabilities :
+      Array Lower.BindingCap} {frameRoots : List IxIR1.Sim.Root}
+    {sourceScrutinee : IxIR1.Atom} {targetScrutinee : Atom}
+    {cid : CtorId} {fields : Array RVal} {location : Nat}
+    {box : IxIR1.NodeBox} {parameterCount : Nat}
+    (invariant : SourceOwnershipInvariant store source input capabilities
+      frameRoots)
+    (environments : EnvRel source target input)
+    (transition : Lower.constructorChildCapabilities? schemas input
+      sourceScrutinee cid capabilities = some afterCapabilities)
+    (translated : Lower.InputMap.translateAtom
+      (Lower.EdgeTrace.explicitMapOf input) sourceScrutinee =
+        some targetScrutinee)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (found : store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (schemaFields : ∀ {world schema}, schemas world cid = some schema →
+      ∃ count, schema.fields = Array.replicate count world)
+    (afterSize : afterCapabilities.size =
+      fields.size + capabilities.size) :
+    SourceOwnershipInvariant store (fields.toList.reverse ++ source)
+      (Lower.constructorChildInputMap parameterCount fields.size ++
+        Lower.EdgeTrace.explicitMapOf input)
+      afterCapabilities frameRoots := by
+  unfold Lower.constructorChildCapabilities? at transition
+  cases rebasedEq : Lower.edgeCapabilities? capabilities input with
+  | none => simp [rebasedEq] at transition
+  | some rebased =>
+      have edgeInvariant := invariant.edge environments rebasedEq
+      cases sourceScrutinee with
+      | lit literal => simp [rebasedEq] at transition
+      | erased => simp [rebasedEq] at transition
+      | var sourceIndex =>
+          have successorInput :=
+            explicitMapOf_at_of_translate_var translated
+          cases sourceAt : source[sourceIndex]? with
+          | none => simp [IxIR1.resolveAtom, sourceAt] at sourceResolved
+          | some scrutineeValue =>
+              have scrutineeEq : scrutineeValue = .loc location := by
+                simpa [IxIR1.resolveAtom, sourceAt] using sourceResolved
+              subst scrutineeValue
+              cases capabilityAt : rebased[sourceIndex]? with
+              | none => simp [rebasedEq, capabilityAt] at transition
+              | some capability =>
+                  cases capability with
+                  | scalar =>
+                      simp [rebasedEq, capabilityAt] at transition
+                  | dead =>
+                      simp [rebasedEq, capabilityAt] at transition
+                  | owned world =>
+                      cases schemaAt : schemas world cid with
+                      | none =>
+                          simp [rebasedEq, capabilityAt, schemaAt] at transition
+                      | some schema =>
+                          simp [rebasedEq, capabilityAt, schemaAt] at transition
+                          subst afterCapabilities
+                          obtain ⟨count, schemaUniform⟩ :=
+                            schemaFields schemaAt
+                          have rebasedSize : rebased.size = capabilities.size :=
+                            edgeInvariant.length.symm.trans invariant.length
+                          have countEq : count = fields.size := by
+                            simp [schemaUniform, rebasedSize] at afterSize
+                            omega
+                          subst count
+                          have provenance : BorrowProvenance store source
+                              (Lower.EdgeTrace.explicitMapOf input) rebased
+                              frameRoots world (.value sourceIndex)
+                              (.loc location) :=
+                            ⟨sourceIndex, .loc location, successorInput,
+                              capabilityAt, sourceAt, .refl⟩
+                          have fieldsInvariant := constructorFields
+                            edgeInvariant provenance found node
+                            (parameterCount := parameterCount)
+                          simpa [schemaUniform] using fieldsInvariant
+                  | borrowed world lender =>
+                      cases schemaAt : schemas world cid with
+                      | none =>
+                          simp [rebasedEq, capabilityAt, schemaAt] at transition
+                      | some schema =>
+                          simp [rebasedEq, capabilityAt, schemaAt] at transition
+                          subst afterCapabilities
+                          obtain ⟨count, schemaUniform⟩ :=
+                            schemaFields schemaAt
+                          have rebasedSize : rebased.size = capabilities.size :=
+                            edgeInvariant.length.symm.trans invariant.length
+                          have countEq : count = fields.size := by
+                            simp [schemaUniform, rebasedSize] at afterSize
+                            omega
+                          subst count
+                          have provenance :=
+                            edgeInvariant.borrows capabilityAt sourceAt
+                          have fieldsInvariant := constructorFields
+                            edgeInvariant provenance found node
+                            (parameterCount := parameterCount)
+                          simpa [schemaUniform] using fieldsInvariant
+
+end SourceOwnershipInvariant
+
+namespace SourceOwnershipAt
+
+/-- Checked literal-zero branch selection transports ownership to every
+matching position in the exact recursive child. -/
+theorem switchNatZero
+    (checked : Lower.Checked) {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId} {input : EnvMap}
+    {entryValueCount : Nat} {sourceScrutinee : IxIR1.Atom}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {constructors : Array CtorAlt}
+    {peel : NatPeel}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (branches : Lower.NatBranchPairMatch site blockId input alternatives
+      constructors peel outgoing children)
+    {store : IxIR1.Store} {source : List RVal} {target : Array RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      store source frameRoots)
+    (environments : EnvRel source target input) :
+    SourceOwnershipAt checked.artifact.trace.positions branches.zeroChild
+      store source frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    checked.natZeroBranchTransition functionMember descendant terminator
+      branches.zeroChildAt branches.succChildAt afterMember afterCoordinate
+  have current := ownership before beforeMember beforeCoordinate
+  have current' : SourceOwnershipInvariant store source input
+      before.sourceCapabilities frameRoots := by
+    simpa [Lower.CodeTrace.sourceInputMap] using current
+  have next := current'.natZero environments transition
+  have childInput : branches.zeroChild.sourceInputMap =
+      Lower.EdgeTrace.explicitMapOf input := by
+    rw [branches.zero.childInput]
+    unfold Lower.EdgeTrace.sourceMap
+    rw [branches.zero.edgeImplicitScalars, sourceMapOf_zero_for_ownership,
+      branches.zero.edgeSourceInput]
+  rw [childInput]
+  exact next
+
+/-- Checked literal-successor branch selection transports ownership through
+the peeled scalar prefix and its one-register lender shift. -/
+theorem switchNatSucc
+    (checked : Lower.Checked) {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId} {input : EnvMap}
+    {entryValueCount : Nat} {sourceScrutinee : IxIR1.Atom}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {constructors : Array CtorAlt}
+    {peel : NatPeel}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (branches : Lower.NatBranchPairMatch site blockId input alternatives
+      constructors peel outgoing children)
+    {store : IxIR1.Store} {source : List RVal} {target : Array RVal}
+    {frameRoots : List IxIR1.Sim.Root} {predecessor : Nat}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      store source frameRoots)
+    (environments : EnvRel source target input) :
+    SourceOwnershipAt checked.artifact.trace.positions branches.succChild
+      store (.lit (.nat predecessor) :: source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    checked.natSuccBranchTransition functionMember descendant terminator
+      branches.zeroChildAt branches.succChildAt afterMember afterCoordinate
+  have current := ownership before beforeMember beforeCoordinate
+  have current' : SourceOwnershipInvariant store source input
+      before.sourceCapabilities frameRoots := by
+    simpa [Lower.CodeTrace.sourceInputMap] using current
+  have next := current'.natSucc
+    (predecessor := predecessor) environments transition
+  have childInput : branches.succChild.sourceInputMap =
+      Lower.EdgeTrace.sourceMapOf 1
+        (Lower.EdgeTrace.explicitMapOf input) := by
+    rw [branches.succ.childInput]
+    unfold Lower.EdgeTrace.sourceMap
+    rw [branches.succ.edgeImplicitScalars,
+      branches.succ.edgeSourceInput]
+  rw [childInput]
+  exact next
+
+/-- Checked constructor branch selection transports ownership to every
+matching child position. Coordinate sizes force the uniform pipeline schema
+arity to equal the concrete runtime field vector. -/
+theorem switchCtor
+    (checked : Lower.Checked) {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId} {input : EnvMap}
+    {entryValueCount : Nat} {sourceScrutinee : IxIR1.Atom}
+    {peelNat : Bool} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {targetBranch : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some targetBranch)
+    (childAt : children[index]? = some child)
+    (branch : Lower.ConstructorBranchMatch site blockId input
+      sourceScrutinee alternatives targetBranch edge child)
+    {store : IxIR1.Store} {source : List RVal} {targetValues : Array RVal}
+    {frameRoots : List IxIR1.Sim.Root} {location : Nat}
+    {box : IxIR1.NodeBox} {cid : CtorId} {fields : Array RVal}
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      store source frameRoots)
+    (environments : EnvRel source targetValues input)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (found : store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (targetCid : targetBranch.cid = cid)
+    (fieldArity : fields.size = branch.fieldCount)
+    (schemaFields : ∀ {world schema},
+      checked.artifact.validationContext.schemas world cid = some schema →
+        ∃ count, schema.fields = Array.replicate count world) :
+    SourceOwnershipAt checked.artifact.trace.positions child store
+      (fields.toList.reverse ++ source) frameRoots := by
+  intro after afterMember afterCoordinate
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    checked.constructorBranchTransition functionMember descendant terminator
+      targetAt childAt afterMember afterCoordinate
+  have current := ownership before beforeMember beforeCoordinate
+  have current' : SourceOwnershipInvariant store source input
+      before.sourceCapabilities frameRoots := by
+    simpa [Lower.CodeTrace.sourceInputMap] using current
+  have beforeSize : before.sourceCapabilities.size = input.size :=
+    before.sourceCapabilities_size_of_coordinateMatch beforeCoordinate
+  have afterCoordinateSize :
+      after.sourceCapabilities.size = child.sourceInputMap.size :=
+    after.sourceCapabilities_size_of_coordinateMatch afterCoordinate
+  have afterSize : after.sourceCapabilities.size =
+      fields.size + before.sourceCapabilities.size := by
+    calc
+      after.sourceCapabilities.size = child.sourceInputMap.size :=
+        afterCoordinateSize
+      _ = branch.fieldCount + input.size := by
+        rw [branch.childInput]
+        simp [Lower.constructorChildInputMap,
+          Lower.EdgeTrace.explicitMapOf, branch.edgeSourceInput]
+      _ = fields.size + before.sourceCapabilities.size := by
+        rw [← fieldArity, beforeSize]
+  rw [targetCid] at transition
+  have next := current'.constructor environments transition
+    branch.translatedScrutinee sourceResolved found node schemaFields afterSize
+    (parameterCount := edge.targetParams.size)
+  have childInput : child.sourceInputMap =
+      Lower.constructorChildInputMap edge.targetParams.size fields.size ++
+        Lower.EdgeTrace.explicitMapOf input := by
+    rw [branch.childInput, ← fieldArity, branch.edgeSourceInput]
+  rw [childInput]
+  exact next
+
+end SourceOwnershipAt
+
+/-- Runtime frame invariant at one recursive compiler-trace node. This is the
+state threaded by the block-compositional semantic induction. -/
+structure CodeStateRel (functionTrace : Lower.FunctionTrace)
+    (trace : Lower.CodeTrace) (source : List RVal)
+    (frame : Eval.Frame) : Prop where
+  definition : frame.definition = functionTrace.generated
+  block : frame.block = trace.sourceBlock
+  pc : frame.pc = trace.entryPc
+  valueCount : frame.values.size = trace.entryValueCount
+  sourceCount : source.length = trace.sourceInputMap.size
+  environments : EnvRel source frame.values trace.sourceInputMap
+
+/-- A source result-world fact is exactly the executable world check required
+by a target return from the related generated function. -/
+theorem CodeStateRel.resultWorld {functionTrace : Lower.FunctionTrace}
+    {trace : Lower.CodeTrace} {source : List RVal} {frame : Eval.Frame}
+    (state : CodeStateRel functionTrace trace source frame)
+    {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    (stores : StoreRel sourceStore targetStore) {value : RVal}
+    (world : IxIR1.Sim.HasWorld sourceStore functionTrace.source.result value) :
+    Eval.RVal.hasWorld targetStore frame.definition.signature.result value =
+      true := by
+  apply stores.hasWorld_eq_true_iff.mpr
+  rw [state.definition, functionTrace.sourceResult]
+  exact world
+
+/-- A related frame at a recursive trace descendant executes the exact head
+block certified by that function trace. -/
+theorem CodeStateRel.blockAt {functionTrace : Lower.FunctionTrace}
+    {trace : Lower.CodeTrace} {source : List RVal} {frame : Eval.Frame}
+    (state : CodeStateRel functionTrace trace source frame)
+    (descendant : functionTrace.root.Descendant trace) :
+    frame.definition.blocks[frame.block]? = some trace.headBlock.2 := by
+  have matched := functionTrace.descendantInstructionsMatch descendant
+  have blockId := Lower.CodeTrace.headBlock_eq_sourceBlock_of_match matched
+  have blockAt := functionTrace.descendantHeadBlockAt descendant
+  simpa [state.definition, state.block, blockId] using blockAt
+
+/-- A related instruction-node state points at the exact retained instruction
+inside the generated function, including the evaluator's strict PC bound. -/
+theorem CodeStateRel.instructionAt {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    {source : List RVal} {frame : Eval.Frame}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next)) :
+    frame.definition.blocks[frame.block]? = some next.headBlock.2 ∧
+      frame.pc < next.headBlock.2.instructions.size ∧
+      next.headBlock.2.instructions[frame.pc]? = some instruction := by
+  obtain ⟨localMatch, _⟩ := functionTrace.descendantLetOpMatch descendant
+  have framePc : frame.pc = index := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  obtain ⟨indexBound, _⟩ :=
+    Array.getElem?_eq_some_iff.mp localMatch.instructionAt
+  refine ⟨state.blockAt descendant, ?_, ?_⟩
+  · simpa [framePc] using indexBound
+  · simpa [framePc] using localMatch.instructionAt
+
+/-- Generic recursive-state hand-off after one retained baseline instruction.
+The operation proof supplies only the concrete successor-frame equalities and
+environment relation; the checked trace supplies definition, block, PC,
+register-count, and proof-map progression to the recursive continuation. -/
+theorem CodeStateRel.letOpNext {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    {source nextSource : List RVal} {frame nextFrame : Eval.Frame}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    (definition : nextFrame.definition = frame.definition)
+    (block : nextFrame.block = frame.block)
+    (pc : nextFrame.pc = frame.pc + 1)
+    (valueCount : nextFrame.values.size = frame.values.size +
+      (Lower.Instr.baselineValueDelta instruction).getD 0)
+    (sourceCount : nextSource.length = source.length + 1)
+    (environments : EnvRel nextSource nextFrame.values nextInput) :
+    CodeStateRel functionTrace next nextSource nextFrame := by
+  obtain ⟨localMatch, _⟩ := functionTrace.descendantLetOpMatch descendant
+  have frameBlock : frame.block = blockId := by
+    simpa [Lower.CodeTrace.sourceBlock] using state.block
+  have framePc : frame.pc = index := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  constructor
+  · exact definition.trans state.definition
+  · exact block.trans (frameBlock.trans localMatch.nextBlock.symm)
+  · calc
+      nextFrame.pc = frame.pc + 1 := pc
+      _ = index + 1 := by rw [framePc]
+      _ = next.entryPc := localMatch.nextPc.symm
+  · calc
+      nextFrame.values.size = frame.values.size +
+          (Lower.Instr.baselineValueDelta instruction).getD 0 := valueCount
+      _ = entryValueCount +
+          (Lower.Instr.baselineValueDelta instruction).getD 0 := by
+            simpa [Lower.CodeTrace.entryValueCount] using
+              congrArg (fun count => count +
+                (Lower.Instr.baselineValueDelta instruction).getD 0)
+                state.valueCount
+      _ = next.entryValueCount := localMatch.nextValueCount.symm
+  · have currentSourceCount : source.length = input.size := by
+      simpa [Lower.CodeTrace.sourceInputMap] using state.sourceCount
+    have mapsMatched := functionTrace.descendantInputMapsMatch descendant
+    have mapSize := Lower.CodeTrace.inputMapSize_of_match mapsMatched
+    calc
+      nextSource.length = source.length + 1 := sourceCount
+      _ = input.size + 1 := by rw [currentSourceCount]
+      _ = nextInput.size := mapSize.symm
+      _ = next.sourceInputMap.size := by rw [localMatch.nextInput]
+  · simpa [localMatch.nextInput] using environments
+
+/-- A successor proof map may forget live slots but cannot retarget one. This
+is the ownership-consumption step needed between the operation-local lemmas
+and the compiler's cursor relation. -/
+abbrev EnvMap.Forgets (next current : EnvMap) : Prop :=
+  Lower.InputMap.Forgets next current
+
+/-- Forgetting consumed bindings preserves the environment relation. -/
+theorem EnvRel.forget {source : List RVal} {target : Array RVal}
+    {current next : EnvMap} (relation : EnvRel source target current)
+    (forgets : EnvMap.Forgets next current) :
+    EnvRel source target next := by
+  intro index value atom sourceGet mapped
+  exact relation index value atom sourceGet (forgets index atom mapped)
+
+/-- Specialize safe forgetting to one checked recursive instruction node.
+The caller supplies the canonical binder-plus-predecessor relation produced by
+the operation lemma; the trace certificate converts it to the exact successor
+map retained by the compiler. -/
+theorem EnvRel.forgetTracedLetOp
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    {source : List RVal} {target : Array RVal} {head : Atom}
+    (relation : EnvRel source target (#[some head] ++ input))
+    (binder : Lower.Instr.baselineBinderAtom entryValueCount instruction =
+      some head) :
+    EnvRel source target nextInput := by
+  have mapsMatched := functionTrace.descendantInputMapsMatch descendant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match mapsMatched binder
+  exact relation.forget mapFacts.2.2.1
+
+/-- Value-producing specialization: rewrite the runtime append ordinal to the
+compiler-certified entry count before applying checked map forgetting. -/
+theorem EnvRel.forgetTracedValue
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    {source nextSource : List RVal} {frame : Eval.Frame}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    {target : Array RVal}
+    (relation : EnvRel nextSource target
+      (#[some (.reg frame.values.size)] ++ input))
+    (binder : Lower.Instr.baselineBinderAtom entryValueCount instruction =
+      some (.reg entryValueCount)) :
+    EnvRel nextSource target nextInput := by
+  have canonical : EnvRel nextSource target
+      (#[some (.reg entryValueCount)] ++ input) := by
+    simpa [state.valueCount, Lower.CodeTrace.entryValueCount,
+      Lower.CodeTrace.sourceInputMap] using relation
+  exact canonical.forgetTracedLetOp descendant binder
+
+/-- Effect-only specialization for instructions whose IxIR₁ result binder
+maps to the inert erased atom and does not append a target value register. -/
+theorem EnvRel.forgetTracedErased
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    {source : List RVal} {target : Array RVal}
+    (relation : EnvRel source target (#[some .erased] ++ input))
+    (binder : Lower.Instr.baselineBinderAtom entryValueCount instruction =
+      some .erased) :
+    EnvRel source target nextInput :=
+  relation.forgetTracedLetOp descendant binder
+
+/-- The proof map at a function entry reverses source de Bruijn parameter
+slots onto target call-order registers. -/
+def entryMap (arity : Nat) : EnvMap :=
+  Lower.entryInputMap arity
+
+/-- A resolved target argument vector is related to the source callee's
+reversed de Bruijn environment by the canonical entry map. -/
+theorem EnvRel.entry (values : Array RVal) :
+    EnvRel values.toList.reverse values (entryMap values.size) := by
+  intro index value atom sourceGet mapped
+  obtain ⟨indexBound, _⟩ := List.getElem?_eq_some_iff.mp sourceGet
+  have originalBound : index < values.toList.length := by
+    simpa using indexBound
+  have targetGet :
+      values[values.size - 1 - index]? = some value := by
+    rw [List.getElem?_reverse (l := values.toList) originalBound]
+      at sourceGet
+    simpa using sourceGet
+  have atomEq : atom = .reg (values.size - 1 - index) := by
+    unfold entryMap Lower.entryInputMap at mapped
+    rw [Array.getElem?_map, List.getElem?_toArray,
+      List.getElem?_range (by simpa using indexBound)] at mapped
+    simpa using Option.some.inj mapped.symm
+  subst atom
+  simp [Eval.resolveAtom, targetGet]
+
+/-- Any retained function trace starts in `CodeStateRel` when its resolved
+arguments are installed in call order and the source environment uses the
+IxIR₁ reversed de Bruijn convention. -/
+theorem functionEntryCodeState (trace : Lower.FunctionTrace)
+    (values : Array RVal)
+    (arity : values.size = trace.source.arity) :
+    CodeStateRel trace trace.root values.toList.reverse
+      { definition := trace.generated, values } := by
+  constructor
+  · rfl
+  · simpa using trace.entryBlock.symm
+  · simpa using trace.entryPc.symm
+  · simpa [trace.entryValueCount] using arity
+  · rw [trace.entryInput, ← arity]
+    simp [Lower.entryInputMap]
+  · rw [trace.entryInput, ← arity]
+    exact EnvRel.entry values
+
+/-- Exact target frame used for a lowered artifact's closed main. -/
+def initialMainFrame (artifact : Lower.Artifact) : Eval.Frame :=
+  { definition := artifact.program.main }
+
+/-- Exact target machine used for a lowered artifact's closed main. -/
+def initialMainMachine (artifact : Lower.Artifact) (heapFuel : Nat) :
+    Eval.Machine :=
+  Eval.initialMachine artifact.program.main #[] heapFuel
+
+/-- All structural and semantic relations needed by the root trace induction
+hold at the exact machine state consumed by `runMain`. -/
+theorem initialMainState (artifact : Lower.Artifact) (heapFuel : Nat) :
+    let frame := initialMainFrame artifact
+    let machine := initialMainMachine artifact heapFuel
+    machine.control = .running frame [] ∧
+      frame.definition = artifact.mainTrace.generated ∧
+      frame.block = artifact.mainTrace.root.sourceBlock ∧
+      frame.pc = artifact.mainTrace.root.entryPc ∧
+      EnvRel [] frame.values artifact.mainTrace.root.sourceInputMap ∧
+      StoreRel ({} : IxIR1.Store) machine.store ∧
+      frame.definition.blocks[frame.block]? =
+        some artifact.mainTrace.root.headBlock.2 := by
+  dsimp only
+  refine ⟨rfl, artifact.mainGenerated.symm, ?_, ?_, ?_, ?_, ?_⟩
+  · simpa [initialMainFrame] using artifact.mainTrace.entryBlock.symm
+  · simpa [initialMainFrame] using artifact.mainTrace.entryPc.symm
+  · rw [artifact.mainEntryInput]
+    exact EnvRel.empty
+  · change StoreRel ({} : IxIR1.Store)
+      (Eval.initialMachine artifact.program.main #[] heapFuel).store
+    rw [Eval.initialMachine_store_empty]
+    exact StoreRel.initial
+  · simpa [initialMainFrame] using artifact.mainHeadBlockAt
+
+/-- The exact initial main frame satisfies the recursive trace-state
+invariant at the artifact's distinguished root. -/
+theorem initialMainCodeState (artifact : Lower.Artifact) :
+    CodeStateRel artifact.mainTrace artifact.mainTrace.root []
+      (initialMainFrame artifact) := by
+  constructor
+  · exact artifact.mainGenerated.symm
+  · simpa [initialMainFrame] using artifact.mainTrace.entryBlock.symm
+  · simpa [initialMainFrame] using artifact.mainTrace.entryPc.symm
+  · rw [artifact.mainTrace.entryValueCount, artifact.mainSource]
+    rfl
+  · rw [artifact.mainEntryInput]
+    rfl
+  · rw [artifact.mainEntryInput]
+    exact EnvRel.empty
+
+/-- `runMain` starts from exactly the machine named by `initialMainState`. -/
+theorem runMain_eq_initialMainMachine (artifact : Lower.Artifact)
+    (context : Eval.Context) (interpretation : Eval.Interpretation)
+    (controlFuel heapFuel : Nat) :
+    Eval.runMain context interpretation artifact.program controlFuel heapFuel =
+      Eval.runMachine context interpretation controlFuel
+        (initialMainMachine artifact heapFuel) := by
+  exact Eval.runMain_eq_runMachine artifact.mainArity artifact.mainNonempty
+
+/-- Shifting a register operand past a value prefix preserves its resolution
+in the suffix register file. -/
+theorem resolveAtom_shift {suffix : Array RVal} {atom : Atom} {value : RVal}
+    (prefixValues : Array RVal)
+    (resolved : Eval.resolveAtom suffix atom = .ok value) :
+    Eval.resolveAtom (prefixValues ++ suffix)
+      (Lower.shiftAtom prefixValues.size atom) = .ok value := by
+  cases atom with
+  | reg index =>
+      cases found : suffix[index]? with
+      | none => simp [Eval.resolveAtom, found] at resolved
+      | some candidate =>
+        have candidateEq : candidate = value := by
+          simpa [Eval.resolveAtom, found] using resolved
+        subst candidate
+        have notPrefix :
+            ¬index + prefixValues.size < prefixValues.size :=
+          Nat.not_lt_of_ge (Nat.le_add_left prefixValues.size index)
+        have offset :
+            index + prefixValues.size - prefixValues.size = index :=
+          Nat.add_sub_cancel_right index prefixValues.size
+        simp [Lower.shiftAtom, Eval.resolveAtom, Array.getElem?_append,
+          notPrefix, offset, found]
+  | lit literal => exact resolved
+  | erased => exact resolved
+
+/-- Shifting an operand across a zero-width prefix is the identity. -/
+@[simp] theorem shiftAtom_zero (atom : Atom) :
+    Lower.shiftAtom 0 atom = atom := by
+  cases atom <;> simp [Lower.shiftAtom]
+
+/-- A zero-width implicit prefix leaves the explicit successor map
+unchanged. -/
+theorem sourceMapOf_zero (explicitMap : Array (Option Atom)) :
+    Lower.EdgeTrace.sourceMapOf 0 explicitMap = explicitMap := by
+  apply Array.ext
+  · simp [Lower.EdgeTrace.sourceMapOf]
+  · intro index leftBound rightBound
+    simp [Lower.EdgeTrace.sourceMapOf]
+    cases explicitMap[index] <;> rfl
+
+/-- Prefixing implicit scalar block parameters preserves an explicit
+successor environment relation. This is exactly the map shape emitted in an
+`EdgeTrace`, including register shifting and absent consumed slots. -/
+theorem EnvRel.sourceMapOf {source : List RVal}
+    {explicitValues : Array RVal} {explicitMap : EnvMap}
+    (relation : EnvRel source explicitValues explicitMap)
+    (implicitValues : Array RVal) :
+    EnvRel (implicitValues.toList ++ source)
+      (implicitValues ++ explicitValues)
+      (Lower.EdgeTrace.sourceMapOf implicitValues.size explicitMap) := by
+  intro index value atom sourceGet mapped
+  by_cases prefixIndex : index < implicitValues.size
+  · have valueAt : implicitValues[index]? = some value := by
+      have listAt : implicitValues.toList[index]? = some value := by
+        simpa [List.getElem?_append_left prefixIndex] using sourceGet
+      simpa using listAt
+    have atomEq : atom = .reg index := by
+      unfold Lower.EdgeTrace.sourceMapOf at mapped
+      simp only [Array.getElem?_append, Array.size_map, List.size_toArray,
+        List.length_range, prefixIndex, if_pos, Array.getElem?_map,
+        List.getElem?_toArray, List.getElem?_range prefixIndex,
+        Option.map_some, Option.some.injEq] at mapped
+      exact mapped.symm
+    subst atom
+    simp only [Eval.resolveAtom]
+    rw [Array.getElem?_append, if_pos prefixIndex, valueAt]
+  · have afterPrefix : implicitValues.size ≤ index :=
+      Nat.le_of_not_gt prefixIndex
+    let explicitIndex := index - implicitValues.size
+    have sourceAt : source[explicitIndex]? = some value := by
+      rw [List.getElem?_append_right (by simpa using afterPrefix)] at sourceGet
+      simpa [explicitIndex] using sourceGet
+    unfold Lower.EdgeTrace.sourceMapOf at mapped
+    simp only [Array.getElem?_append, Array.size_map, List.size_toArray,
+      List.length_range, prefixIndex, Array.getElem?_map] at mapped
+    cases explicitAt : explicitMap[explicitIndex]? with
+    | none => simp [explicitIndex, explicitAt] at mapped
+    | some slot =>
+      cases slot with
+      | none => simp [explicitIndex, explicitAt] at mapped
+      | some explicitAtom =>
+        have mappedAt :
+            explicitMap[explicitIndex]? = some (some explicitAtom) := explicitAt
+        have atomEq :
+            atom = Lower.shiftAtom implicitValues.size explicitAtom := by
+          simpa [explicitIndex, explicitAt] using mapped.symm
+        subst atom
+        exact resolveAtom_shift implicitValues
+          (relation explicitIndex value explicitAtom sourceAt mappedAt)
+
+/-- A generated edge trace and the baseline evaluator transfer agree on the
+exact successor frame and establish its proof-side source environment. This
+is the CFG hand-off used by constructor branches (with no implicit values)
+and Nat-successor branches (with the predecessor prefix). -/
+theorem simulate_traced_edge_transfer
+    {frame : Eval.Frame} {edge : Edge} {trace : Lower.EdgeTrace}
+    {block : Block} {source : List RVal} {explicitMap : EnvMap}
+    {implicitValues explicitValues : Array RVal}
+    (edgeTarget : edge.target = trace.target)
+    (edgeValues : edge.values = trace.explicitValues)
+    (edgeCredits : edge.credits = #[])
+    (traceMap : trace.sourceMap =
+      Lower.EdgeTrace.sourceMapOf trace.implicitScalars explicitMap)
+    (implicitCount : trace.implicitScalars = implicitValues.size)
+    (resolved : Eval.resolveAtoms frame.values trace.explicitValues =
+      .ok explicitValues)
+    (environments : EnvRel source explicitValues explicitMap)
+    (frameCredits : frame.credits = #[])
+    (blockAt : frame.definition.blocks[trace.target]? = some block)
+    (blockParams : block.valueParams = trace.targetParams)
+    (valueArity : (implicitValues ++ explicitValues).size =
+      trace.targetParams.size)
+    (blockCredits : block.creditParams = #[]) :
+    let target : Eval.Frame :=
+      { frame with
+        block := trace.target
+        pc := 0
+        values := implicitValues ++ explicitValues
+        credits := #[] }
+    Eval.EdgeTransfer frame edge implicitValues target ∧
+      EnvRel (implicitValues.toList ++ source) target.values trace.sourceMap := by
+  dsimp only
+  have targetResolved : Eval.resolveAtoms frame.values edge.values =
+      .ok explicitValues := by simpa [edgeValues] using resolved
+  have targetBlock : frame.definition.blocks[edge.target]? = some block := by
+    simpa [edgeTarget] using blockAt
+  have targetArity : (implicitValues ++ explicitValues).size =
+      block.valueParams.size := by
+    rw [blockParams]
+    exact valueArity
+  constructor
+  · simpa [edgeTarget] using Eval.EdgeTransfer.baseline targetResolved
+      frameCredits edgeCredits targetBlock targetArity blockCredits
+  · simpa [traceMap, implicitCount] using
+      environments.sourceMapOf implicitValues
+
+/-- Operand resolution is representation-independent once the generated
+environment map is related. This is the common first step of the `move`,
+memory-operation, call, return, and switch simulation cases. -/
+theorem resolveAtom_of_envRel {source : List RVal} {target : Array RVal}
+    {mapping : EnvMap} (relation : EnvRel source target mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (resolved : IxIR1.resolveAtom source sourceAtom = .ok value) :
+    Eval.resolveAtom target targetAtom = .ok value := by
+  cases sourceAtom with
+  | var index =>
+      have sourceGet : source[index]? = some value := by
+        cases found : source[index]? with
+        | none => simp [IxIR1.resolveAtom, found] at resolved
+        | some candidate =>
+            have equal : candidate = value := by
+              simpa [IxIR1.resolveAtom, found] using resolved
+            exact congrArg some equal
+      cases mappedGet : mapping[index]? with
+      | none =>
+          simp [Lower.InputMap.translateAtom, mappedGet] at translated
+      | some slot =>
+          cases slot with
+          | none =>
+              simp [Lower.InputMap.translateAtom, mappedGet] at translated
+          | some mappedAtom =>
+              have atomEq : mappedAtom = targetAtom := by
+                simpa [Lower.InputMap.translateAtom, mappedGet] using translated
+              subst mappedAtom
+              exact relation index value targetAtom sourceGet mappedGet
+  | lit literal =>
+      simp only [Lower.InputMap.translateAtom, Option.some.injEq] at translated
+      subst targetAtom
+      simp only [IxIR1.resolveAtom, Except.ok.injEq] at resolved
+      subst value
+      rfl
+  | erased =>
+      simp only [Lower.InputMap.translateAtom, Option.some.injEq] at translated
+      subst targetAtom
+      simp only [IxIR1.resolveAtom, Except.ok.injEq] at resolved
+      subst value
+      rfl
+
+/-- A translated target operand can be reflected back to its source operand
+when the checked environment map has the certified source length. -/
+theorem resolveAtom_of_envRel_target {source : List IxIR1.RVal}
+    {target : Array IxIR1.RVal} {mapping : EnvMap}
+    (relation : EnvRel source target mapping)
+    (sourceCount : source.length = mapping.size)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : IxIR1.RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (resolved : Eval.resolveAtom target targetAtom = .ok value) :
+    IxIR1.resolveAtom source sourceAtom = .ok value := by
+  cases sourceAtom with
+  | var index =>
+      cases mappedGet : mapping[index]? with
+      | none =>
+          simp [Lower.InputMap.translateAtom, mappedGet] at translated
+      | some slot =>
+          cases slot with
+          | none =>
+              simp [Lower.InputMap.translateAtom, mappedGet] at translated
+          | some mappedAtom =>
+              have atomEq : mappedAtom = targetAtom := by
+                simpa [Lower.InputMap.translateAtom, mappedGet] using translated
+              subst mappedAtom
+              have mapBound : index < mapping.size :=
+                (Array.getElem?_eq_some_iff.mp mappedGet).1
+              have sourceBound : index < source.length := by
+                rw [sourceCount]
+                exact mapBound
+              let sourceValue := source[index]
+              have sourceGet : source[index]? = some sourceValue := by
+                simp [sourceValue, sourceBound]
+              have targetSource := relation index sourceValue targetAtom
+                sourceGet mappedGet
+              have valueEq : sourceValue = value :=
+                Except.ok.inj (targetSource.symm.trans resolved)
+              simp [IxIR1.resolveAtom, sourceGet, valueEq]
+  | lit literal =>
+      simp only [Lower.InputMap.translateAtom, Option.some.injEq] at translated
+      subst targetAtom
+      simp only [Eval.resolveAtom, Except.ok.injEq] at resolved
+      subst value
+      rfl
+  | erased =>
+      simp only [Lower.InputMap.translateAtom, Option.some.injEq] at translated
+      subst targetAtom
+      simp only [Eval.resolveAtom, Except.ok.injEq] at resolved
+      subst value
+      rfl
+
+/-- Appending a new SSA value does not change resolution of any atom that was
+already valid in the frame. -/
+theorem resolveAtom_push_old {target : Array RVal} {atom : Atom}
+    {value extra : RVal}
+    (resolved : Eval.resolveAtom target atom = .ok value) :
+    Eval.resolveAtom (target.push extra) atom = .ok value := by
+  cases atom with
+  | lit literal => exact resolved
+  | erased => exact resolved
+  | reg index =>
+      have notEnd : index ≠ target.size := by
+        intro equal
+        subst index
+        simp [Eval.resolveAtom] at resolved
+      simpa [Eval.resolveAtom, Array.getElem?_push, notEnd] using resolved
+
+/-- Appending any value suffix preserves resolution of atoms that were valid
+in the original register file. -/
+theorem resolveAtom_append_old {target suffix : Array RVal} {atom : Atom}
+    {value : RVal}
+    (resolved : Eval.resolveAtom target atom = .ok value) :
+    Eval.resolveAtom (target ++ suffix) atom = .ok value := by
+  cases atom with
+  | lit literal => exact resolved
+  | erased => exact resolved
+  | reg index =>
+      cases found : target[index]? with
+      | none => simp [Eval.resolveAtom, found] at resolved
+      | some candidate =>
+          have bound : index < target.size :=
+            (Array.getElem?_eq_some_iff.mp found).1
+          simpa [Eval.resolveAtom, Array.getElem?_append, bound, found] using
+            resolved
+
+/-- Result-producing instructions prepend one source de Bruijn binding while
+appending one target SSA register. -/
+theorem EnvRel.bindValue {source : List RVal} {target : Array RVal}
+    {mapping : EnvMap} (relation : EnvRel source target mapping)
+    (value : RVal) :
+    EnvRel (value :: source) (target.push value)
+      (#[some (.reg target.size)] ++ mapping) := by
+  intro index candidate atom sourceGet mapped
+  cases index with
+  | zero =>
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at sourceGet
+      subst candidate
+      have atomEq : atom = .reg target.size := by
+        simpa [Array.getElem?_append] using mapped.symm
+      subst atom
+      simp [Eval.resolveAtom]
+  | succ index =>
+      have oldGet : source[index]? = some candidate := by
+        simpa using sourceGet
+      have oldMapped : mapping[index]? = some (some atom) := by
+        simpa [Array.getElem?_append] using mapped
+      exact resolveAtom_push_old
+        (relation index candidate atom oldGet oldMapped)
+
+/-- Generic value-producing continuation state.  This is shared by ordinary
+one-step operations, direct calls after their callee returns, and dynamic
+application after its PAP chain eventually resumes the original caller. -/
+theorem CodeStateRel.letOpValueNext
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    {source : List RVal} {frame : Eval.Frame}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    (binder : Lower.Instr.baselineBinderAtom entryValueCount instruction =
+      some (.reg entryValueCount))
+    (delta : Lower.Instr.baselineValueDelta instruction = some 1)
+    (value : RVal) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    CodeStateRel functionTrace next (value :: source) nextFrame := by
+  dsimp only
+  have canonical := state.environments.bindValue value
+  have nextEnvironments := canonical.forgetTracedValue state descendant binder
+  exact state.letOpNext descendant rfl rfl rfl
+    (by simp [delta]) rfl nextEnvironments
+
+/-- Constructor alternatives prepend source fields in reverse order while
+their generated fetch prologue appends target registers in field order. This
+is the exact environment shape retained in `constructorChildInputMap`. -/
+theorem EnvRel.constructorFields {source : List RVal}
+    {target fields : Array RVal} {mapping : EnvMap}
+    (relation : EnvRel source target mapping) :
+    EnvRel (fields.toList.reverse ++ source) (target ++ fields)
+      (Lower.constructorChildInputMap target.size fields.size ++ mapping) := by
+  intro index value atom sourceGet mapped
+  by_cases prefixIndex : index < fields.size
+  · have sourcePrefix : fields.toList.reverse[index]? = some value := by
+      have prefixIndex' : index < fields.toList.reverse.length := by
+        simpa using prefixIndex
+      rw [List.getElem?_append_left prefixIndex'] at sourceGet
+      exact sourceGet
+    have originalBound : index < fields.toList.length := by
+      simpa using prefixIndex
+    rw [List.getElem?_reverse (l := fields.toList) originalBound] at sourcePrefix
+    let fieldIndex := fields.size - 1 - index
+    have fieldAt : fields[fieldIndex]? = some value := by
+      simpa [fieldIndex] using sourcePrefix
+    have atomEq : atom = .reg (target.size + fieldIndex) := by
+      have rangeAt : (List.range fields.size).reverse[index]? =
+          some fieldIndex := by
+        rw [List.getElem?_reverse (l := List.range fields.size)
+          (by simpa using prefixIndex)]
+        have fieldIndexBound : fieldIndex < fields.size := by
+          dsimp [fieldIndex]
+          omega
+        have rangeField : (List.range fields.size)[fieldIndex]? =
+            some fieldIndex := List.getElem?_range fieldIndexBound
+        simpa [fieldIndex] using rangeField
+      have mapAt :
+          (Lower.constructorChildInputMap target.size fields.size)[index]? =
+            some (some (.reg (target.size + fieldIndex))) := by
+        unfold Lower.constructorChildInputMap
+        rw [Array.getElem?_map, List.getElem?_toArray, rangeAt]
+        rfl
+      have mapPrefix : index <
+          (Lower.constructorChildInputMap target.size fields.size).size := by
+        simpa [Lower.constructorChildInputMap] using prefixIndex
+      rw [Array.getElem?_append, if_pos mapPrefix, mapAt] at mapped
+      simpa using mapped.symm
+    subst atom
+    have afterTarget : ¬target.size + fieldIndex < target.size := by omega
+    simp [Eval.resolveAtom, Array.getElem?_append, afterTarget, fieldAt]
+  · have afterPrefix : fields.size ≤ index := Nat.le_of_not_gt prefixIndex
+    let sourceIndex := index - fields.size
+    have sourceAt : source[sourceIndex]? = some value := by
+      rw [List.getElem?_append_right (by simpa using afterPrefix)] at sourceGet
+      simpa [sourceIndex] using sourceGet
+    unfold Lower.constructorChildInputMap at mapped
+    simp only [Array.getElem?_append, Array.size_map, List.size_toArray,
+      List.length_reverse, List.length_range, prefixIndex] at mapped
+    exact resolveAtom_append_old
+      (relation sourceIndex value atom sourceAt
+        (by simpa [sourceIndex] using mapped))
+
+/-- Effect-only IxIR₂ instructions append no SSA value; their IxIR₁ result
+binder is represented directly by the erased atom. -/
+theorem EnvRel.bindErased {source : List RVal} {target : Array RVal}
+    {mapping : EnvMap} (relation : EnvRel source target mapping) :
+    EnvRel (.erased :: source) target (#[some .erased] ++ mapping) := by
+  intro index candidate atom sourceGet mapped
+  cases index with
+  | zero =>
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at sourceGet
+      subst candidate
+      have atomEq : atom = .erased := by
+        simpa [Array.getElem?_append] using mapped.symm
+      subst atom
+      rfl
+  | succ index =>
+      have oldGet : source[index]? = some candidate := by
+        simpa using sourceGet
+      have oldMapped : mapping[index]? = some (some atom) := by
+        simpa [Array.getElem?_append] using mapped
+      exact relation index candidate atom oldGet oldMapped
+
+/-- A target `move` takes exactly one public small step, preserving the store,
+stack, and credits while advancing the program counter and appending its
+resolved value.  This packages the evaluator reduction needed by the source
+`pure` instruction case. -/
+theorem step_move {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {atom : Atom} {value : RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .move atom)
+    (resolved : Eval.resolveAtom frame.values atom = .ok value) :
+    Eval.Step context interpretation machine
+      { machine with
+        control := .running
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value }
+          stack } := by
+  exact Eval.Step.move control blockAt pc instruction resolved
+
+/-- The source `pure`/target `move` boundary preserves operand meaning and the
+environment relation needed by the continuation. -/
+theorem pure_move_preserves {source : List RVal} {target : Array RVal}
+    {mapping : EnvMap} (relation : EnvRel source target mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (resolved : IxIR1.resolveAtom source sourceAtom = .ok value) :
+    Eval.resolveAtom target targetAtom = .ok value ∧
+      EnvRel (value :: source) (target.push value)
+        (#[some (.reg target.size)] ++ mapping) := by
+  exact ⟨resolveAtom_of_envRel relation translated resolved,
+    relation.bindValue value⟩
+
+/-- First instruction-level simulation case: a related IxIR₁ `pure` operand
+drives the generated IxIR₂ `move` step, and the successor environments are
+again related. -/
+theorem simulate_pure_move {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {source : List RVal} {mapping : EnvMap}
+    (relation : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .move targetAtom) :
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack } ∧
+      EnvRel (value :: source) (frame.values.push value)
+        (#[some (.reg frame.values.size)] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel relation translated sourceResolved
+  exact ⟨step_move control blockAt pc instruction targetResolved,
+    relation.bindValue value⟩
+
+/-- Trace-facing `pure`/`move` case. Recursive-trace membership supplies the
+actual generated block, instruction coordinate, and translated target
+operand; callers retain only runtime frame alignment and source resolution. -/
+theorem simulate_traced_pure_move {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {source : List RVal} {value : RVal}
+    (relation : EnvRel source frame.values input)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (definition : frame.definition = functionTrace.generated)
+    (frameBlock : frame.block = blockId)
+    (framePc : frame.pc = index)
+    (entryValues : entryValueCount = frame.values.size)
+    (sourceCount : source.length = input.size)
+    (control : machine.control = .running frame stack) :
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack } ∧
+      EnvRel (value :: source) (frame.values.push value) nextInput := by
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨localMatch, generatedBlock⟩ :=
+    functionTrace.descendantLetOpMatch descendant
+  have blockAt :
+      frame.definition.blocks[frame.block]? = some next.headBlock.2 := by
+    simpa [definition, frameBlock] using generatedBlock
+  obtain ⟨indexBound, instructionAt⟩ :=
+    Array.getElem?_eq_some_iff.mp localMatch.instructionAt
+  have pcBound : frame.pc < next.headBlock.2.instructions.size := by
+    simpa [framePc] using indexBound
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .move targetAtom := by
+    simpa [framePc] using instructionAt
+  have simulated := simulate_pure_move
+    (context := context) (interpretation := interpretation)
+    relation translated sourceResolved control blockAt pcBound instruction
+  exact ⟨simulated.1,
+    simulated.2.forgetTracedValue
+      (show CodeStateRel functionTrace
+        (.letOp site blockId input nextInput entryValueCount
+          (.pure sourceAtom) index (.move targetAtom) next) source frame from
+        { definition
+          block := by simpa [Lower.CodeTrace.sourceBlock] using frameBlock
+          pc := by simpa [Lower.CodeTrace.entryPc] using framePc
+          valueCount := by
+            simpa [Lower.CodeTrace.entryValueCount] using entryValues.symm
+          sourceCount := by
+            simpa [Lower.CodeTrace.sourceInputMap] using sourceCount
+          environments := relation })
+      descendant rfl⟩
+
+/-- Recursive-state form of the trace-facing `pure`/`move` case. Besides the
+one target step, it establishes the exact `CodeStateRel` expected by the
+continuation trace, including compiler-certified block and PC progression. -/
+theorem simulate_traced_pure_move_state {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {source : List RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next) source frame)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      CodeStateRel functionTrace next (value :: source) nextFrame := by
+  dsimp only
+  have frameBlock : frame.block = blockId := by
+    simpa [Lower.CodeTrace.sourceBlock] using state.block
+  have framePc : frame.pc = index := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  have entryValues : entryValueCount = frame.values.size := by
+    simpa [Lower.CodeTrace.entryValueCount] using state.valueCount.symm
+  have simulated := simulate_traced_pure_move
+    (context := context) (interpretation := interpretation)
+    descendant state.environments sourceResolved state.definition
+      frameBlock framePc entryValues
+      (by simpa [Lower.CodeTrace.sourceInputMap] using state.sourceCount)
+      control
+  refine ⟨simulated.1, state.letOpNext descendant rfl rfl rfl ?_ rfl
+    simulated.2⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Successful-run form of the `pure`/`move` induction case.  Source
+evaluation is inverted into its exact atom-resolution and continuation run,
+while the target takes one step into the recursive trace state.  A later
+semantic induction only has to apply its continuation hypothesis to the
+returned `runCode` equation and `CodeStateRel`. -/
+theorem simulate_traced_pure_move_success_step
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {sourceOutput : IxIR1.Store × RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      sourceCurrent sourceStore source
+        (.letOp (.pure sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (control : machine.control = .running frame stack) :
+    ∃ value nextFrame,
+      nextFrame =
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value } ∧
+        IxIR1.resolveAtom source sourceAtom = .ok value ∧
+        IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent
+          sourceStore (value :: source) next.sourceCode = .ok sourceOutput ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running nextFrame stack } ∧
+        StoreRel sourceStore
+          ({ machine with control := .running nextFrame stack } :
+            Eval.Machine).store ∧
+        CodeStateRel functionTrace next (value :: source) nextFrame := by
+  dsimp only
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨value, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_pure_success operationRun
+  have middleStoreEq : middleStore = sourceStore :=
+    congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue = value :=
+    congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  obtain ⟨targetStep, nextState⟩ :=
+    simulate_traced_pure_move_state descendant state sourceResolved control
+  exact ⟨value,
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push value },
+    rfl, sourceResolved, continuationRun, targetStep, stores, nextState⟩
+
+/-- Retaining a scalar is operationally inert. -/
+theorem retainShared_of_scalar {store : Eval.Store} {value : RVal}
+    (scalar : Eval.RVal.isScalar value = true) :
+    Eval.retainShared store value = .ok store := by
+  cases value <;> simp [Eval.RVal.isScalar, Eval.retainShared] at scalar ⊢
+
+/-- Releasing a scalar leaves the store unchanged and spends exactly the one
+heap-traversal unit used to inspect the work-list item. -/
+theorem releaseShared_of_scalar {store : Eval.Store} {value : RVal}
+    (heapFuel : Nat) (scalar : Eval.RVal.isScalar value = true) :
+    Eval.releaseShared (heapFuel + 1) store value = .ok (store, heapFuel) := by
+  cases value <;>
+    simp [Eval.RVal.isScalar, Eval.releaseShared,
+      Eval.releaseSharedWork] at scalar ⊢
+
+/-- Dropping a unique scalar has the same one-item heap-budget behavior as a
+shared scalar release. -/
+theorem dropUnique_of_scalar {store : Eval.Store} {value : RVal}
+    (heapFuel : Nat) (scalar : Eval.RVal.isScalar value = true) :
+    Eval.dropUnique (heapFuel + 1) store value = .ok (store, heapFuel) := by
+  cases value <;>
+    simp [Eval.RVal.isScalar, Eval.dropUnique,
+      Eval.dropUniqueWork] at scalar ⊢
+
+/-- IxIR₁ shared dropping is inert on one scalar whenever its recursive fuel
+is positive. -/
+theorem sourceDropVal_of_scalar {context : IxIR1.Ctx}
+    {store : IxIR1.Store} {value : RVal} (fuel : Nat)
+    (scalar : Eval.RVal.isScalar value = true) :
+    IxIR1.dropVal context (fuel + 1) store value = .ok store := by
+  cases value <;>
+    simp [Eval.RVal.isScalar, IxIR1.dropVal] at scalar ⊢
+
+/-- IxIR₁ unique dropping is likewise inert on one scalar. -/
+theorem sourceDropUVal_of_scalar {context : IxIR1.Ctx}
+    {store : IxIR1.Store} {value : RVal} (fuel : Nat)
+    (scalar : Eval.RVal.isScalar value = true) :
+    IxIR1.dropUVal context (fuel + 1) store value = .ok store := by
+  cases value <;>
+    simp [Eval.RVal.isScalar, IxIR1.dropUVal] at scalar ⊢
+
+/-- A scalar list needs one more unit of IxIR₁ recursive fuel than its length,
+because the source list worker also inspects the empty tail. -/
+theorem sourceDropMany_of_scalars {context : IxIR1.Ctx}
+    {store : IxIR1.Store} {values : List RVal}
+    (scalars : values.all Eval.RVal.isScalar = true) :
+    IxIR1.dropMany context (values.length + 1) store values = .ok store := by
+  induction values with
+  | nil => simp [IxIR1.dropMany]
+  | cons value values ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at scalars
+      have head := sourceDropVal_of_scalar (context := context)
+        (store := store) values.length scalars.1
+      rw [show (value :: values).length + 1 =
+        (values.length + 1) + 1 by simp]
+      rw [IxIR1.dropMany.eq_def]
+      simp only
+      rw [head]
+      simp only [bind, Except.bind]
+      exact ih scalars.2
+
+/-- The unique source list worker has the same scalar-list fuel equation. -/
+theorem sourceDropManyU_of_scalars {context : IxIR1.Ctx}
+    {store : IxIR1.Store} {values : List RVal}
+    (scalars : values.all Eval.RVal.isScalar = true) :
+    IxIR1.dropManyU context (values.length + 1) store values = .ok store := by
+  induction values with
+  | nil => simp [IxIR1.dropManyU]
+  | cons value values ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at scalars
+      have head := sourceDropUVal_of_scalar (context := context)
+        (store := store) values.length scalars.1
+      rw [show (value :: values).length + 1 =
+        (values.length + 1) + 1 by simp]
+      rw [IxIR1.dropManyU.eq_def]
+      simp only
+      rw [head]
+      simp only [bind, Except.bind]
+      exact ih scalars.2
+
+/-- IxIR₂ spends exactly one heap unit per scalar shared-release work item. -/
+theorem releaseSharedWork_of_scalars {store : Eval.Store}
+    {values : List RVal} (heapFuel : Nat)
+    (scalars : values.all Eval.RVal.isScalar = true) :
+    Eval.releaseSharedWork (heapFuel + values.length) store values =
+      .ok (store, heapFuel) := by
+  induction values generalizing heapFuel with
+  | nil => simp [Eval.releaseSharedWork]
+  | cons value values ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at scalars
+      rw [show heapFuel + (value :: values).length =
+        (heapFuel + values.length) + 1 by
+          simp only [List.length_cons]
+          omega]
+      cases value with
+      | loc location => simp [Eval.RVal.isScalar] at scalars
+      | lit literal =>
+          simp only [Eval.releaseSharedWork]
+          exact ih heapFuel scalars.2
+      | erased =>
+          simp only [Eval.releaseSharedWork]
+          exact ih heapFuel scalars.2
+
+/-- IxIR₂ unique destruction has the same exact scalar work-list budget. -/
+theorem dropUniqueWork_of_scalars {store : Eval.Store}
+    {values : List RVal} (heapFuel : Nat)
+    (scalars : values.all Eval.RVal.isScalar = true) :
+    Eval.dropUniqueWork (heapFuel + values.length) store values =
+      .ok (store, heapFuel) := by
+  induction values generalizing heapFuel with
+  | nil => simp [Eval.dropUniqueWork]
+  | cons value values ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at scalars
+      rw [show heapFuel + (value :: values).length =
+        (heapFuel + values.length) + 1 by
+          simp only [List.length_cons]
+          omega]
+      cases value with
+      | loc location => simp [Eval.RVal.isScalar] at scalars
+      | lit literal =>
+          simp only [Eval.dropUniqueWork]
+          exact ih heapFuel scalars.2
+      | erased =>
+          simp only [Eval.dropUniqueWork]
+          exact ih heapFuel scalars.2
+
+/-- Exact-budget shared-release work on a prefix composes with an
+independently budgeted suffix.  Recursive final-owner expansion stays in the
+prefix because the target prepends the released node's children. -/
+theorem releaseSharedWork_append {firstFuel secondFuel : Nat}
+    {store middle output : Eval.Store} {first second : List RVal}
+    {remaining : Nat}
+    (firstRun : Eval.releaseSharedWork firstFuel store first =
+      .ok (middle, 0))
+    (secondRun : Eval.releaseSharedWork secondFuel middle second =
+      .ok (output, remaining)) :
+    Eval.releaseSharedWork (firstFuel + secondFuel) store (first ++ second) =
+      .ok (output, remaining) := by
+  induction firstFuel generalizing store first middle with
+  | zero =>
+      cases first with
+      | nil =>
+          simp only [Eval.releaseSharedWork, Except.ok.injEq, Prod.mk.injEq]
+            at firstRun
+          obtain ⟨rfl, _⟩ := firstRun
+          simpa [Eval.releaseSharedWork] using secondRun
+      | cons value first => simp [Eval.releaseSharedWork] at firstRun
+  | succ firstFuel ih =>
+      cases first with
+      | nil => simp [Eval.releaseSharedWork] at firstRun
+      | cons value first =>
+          cases value with
+          | lit literal =>
+              have prefix' :
+                  Eval.releaseSharedWork firstFuel store first =
+                    .ok (middle, 0) := by
+                simpa [Eval.releaseSharedWork] using firstRun
+              have combined := ih prefix' secondRun
+              simpa [Eval.releaseSharedWork, Nat.succ_add] using combined
+          | erased =>
+              have prefix' :
+                  Eval.releaseSharedWork firstFuel store first =
+                    .ok (middle, 0) := by
+                simpa [Eval.releaseSharedWork] using firstRun
+              have combined := ih prefix' secondRun
+              simpa [Eval.releaseSharedWork, Nat.succ_add] using combined
+          | loc location =>
+              cases boxAt : store.get? location with
+              | none => simp [Eval.releaseSharedWork, boxAt] at firstRun
+              | some box =>
+                  cases world : box.world with
+                  | unique =>
+                      simp [Eval.releaseSharedWork, boxAt, world] at firstRun
+                  | shared =>
+                      by_cases zero : box.rc = 0
+                      · simp [Eval.releaseSharedWork, boxAt, world, zero]
+                          at firstRun
+                      · by_cases unit : box.rc = 1
+                        · cases node : box.node with
+                          | ctorN cid fields =>
+                              have prefix' :
+                                  Eval.releaseSharedWork firstFuel
+                                      (store.rcTick.kill location)
+                                      (fields.toList ++ first) =
+                                    .ok (middle, 0) := by
+                                simpa [Eval.releaseSharedWork, boxAt, world,
+                                  zero, unit, node] using firstRun
+                              have combined := ih prefix' secondRun
+                              simpa [Eval.releaseSharedWork, boxAt, world,
+                                zero, unit, node, Nat.succ_add,
+                                List.append_assoc] using combined
+                          | papN address arity arguments =>
+                              have prefix' :
+                                  Eval.releaseSharedWork firstFuel
+                                      (store.rcTick.kill location)
+                                      (arguments.toList ++ first) =
+                                    .ok (middle, 0) := by
+                                simpa [Eval.releaseSharedWork, boxAt, world,
+                                  zero, unit, node] using firstRun
+                              have combined := ih prefix' secondRun
+                              simpa [Eval.releaseSharedWork, boxAt, world,
+                                zero, unit, node, Nat.succ_add,
+                                List.append_assoc] using combined
+                        · have prefix' :
+                              Eval.releaseSharedWork firstFuel
+                                  (store.rcTick.setBox location
+                                    { box with rc := box.rc - 1 }) first =
+                                .ok (middle, 0) := by
+                            simpa [Eval.releaseSharedWork, boxAt, world,
+                              zero, unit] using firstRun
+                          have combined := ih prefix' secondRun
+                          simpa [Eval.releaseSharedWork, boxAt, world,
+                            zero, unit, Nat.succ_add] using combined
+
+/-- A successful shared-release work list consumes a store/value-determined
+amount of heap fuel. Different initial budgets therefore produce the same
+store and differ only by their residual suffix. -/
+theorem releaseSharedWork_success_unique
+    {leftFuel rightFuel : Nat}
+    {store leftStore rightStore : Eval.Store}
+    {values : List RVal} {leftRemaining rightRemaining : Nat}
+    (left : Eval.releaseSharedWork leftFuel store values =
+      .ok (leftStore, leftRemaining))
+    (right : Eval.releaseSharedWork rightFuel store values =
+      .ok (rightStore, rightRemaining)) :
+    leftStore = rightStore ∧
+      leftFuel + rightRemaining = rightFuel + leftRemaining := by
+  induction leftFuel generalizing rightFuel store values leftStore rightStore
+      leftRemaining rightRemaining with
+  | zero =>
+      cases values with
+      | nil =>
+          simp [Eval.releaseSharedWork] at left right
+          obtain ⟨rfl, rfl⟩ := left
+          obtain ⟨rfl, rfl⟩ := right
+          exact ⟨rfl, by omega⟩
+      | cons value values => simp [Eval.releaseSharedWork] at left
+  | succ leftFuel ih =>
+      cases values with
+      | nil =>
+          simp [Eval.releaseSharedWork] at left right
+          obtain ⟨rfl, rfl⟩ := left
+          obtain ⟨rfl, rfl⟩ := right
+          exact ⟨rfl, by omega⟩
+      | cons value values =>
+          cases rightFuel with
+          | zero => simp [Eval.releaseSharedWork] at right
+          | succ rightFuel =>
+              cases value with
+              | lit literal =>
+                  obtain ⟨storeEq, fuelEq⟩ :=
+                    ih (rightFuel := rightFuel) left right
+                  exact ⟨storeEq, by omega⟩
+              | erased =>
+                  obtain ⟨storeEq, fuelEq⟩ :=
+                    ih (rightFuel := rightFuel) left right
+                  exact ⟨storeEq, by omega⟩
+              | loc location =>
+                  cases found : store.get? location with
+                  | none => simp [Eval.releaseSharedWork, found] at left
+                  | some box =>
+                      cases world : box.world with
+                      | unique =>
+                          simp [Eval.releaseSharedWork, found, world] at left
+                      | shared =>
+                          by_cases zero : box.rc = 0
+                          · simp [Eval.releaseSharedWork, found, world, zero]
+                              at left
+                          · by_cases unit : box.rc = 1
+                            · cases node : box.node with
+                              | ctorN cid fields =>
+                                  obtain ⟨storeEq, fuelEq⟩ :=
+                                    ih (rightFuel := rightFuel)
+                                    (store := store.rcTick.kill location)
+                                    (values := fields.toList ++ values)
+                                    (by simpa [Eval.releaseSharedWork, found,
+                                      world, zero, unit, node] using left)
+                                    (by simpa [Eval.releaseSharedWork, found,
+                                      world, zero, unit, node] using right)
+                                  exact ⟨storeEq, by omega⟩
+                              | papN address arity arguments =>
+                                  obtain ⟨storeEq, fuelEq⟩ :=
+                                    ih (rightFuel := rightFuel)
+                                    (store := store.rcTick.kill location)
+                                    (values := arguments.toList ++ values)
+                                    (by simpa [Eval.releaseSharedWork, found,
+                                      world, zero, unit, node] using left)
+                                    (by simpa [Eval.releaseSharedWork, found,
+                                      world, zero, unit, node] using right)
+                                  exact ⟨storeEq, by omega⟩
+                            · obtain ⟨storeEq, fuelEq⟩ :=
+                                ih (rightFuel := rightFuel)
+                                (store := store.rcTick.setBox location
+                                  { box with rc := box.rc - 1 })
+                                (values := values)
+                                (by simpa [Eval.releaseSharedWork, found,
+                                  world, zero, unit] using left)
+                                (by simpa [Eval.releaseSharedWork, found,
+                                  world, zero, unit] using right)
+                              exact ⟨storeEq, by omega⟩
+
+/-- An exact shared-release traversal can carry any independently chosen heap
+fuel suffix through unchanged.  This is the backward-budget framing rule used
+when a destructive instruction is prefixed to an already funded continuation. -/
+theorem releaseSharedWork_add_suffix {localFuel suffix : Nat}
+    {store output : Eval.Store} {values : List RVal}
+    (run : Eval.releaseSharedWork localFuel store values = .ok (output, 0)) :
+    Eval.releaseSharedWork (localFuel + suffix) store values =
+      .ok (output, suffix) := by
+  have emptyRun : Eval.releaseSharedWork suffix output [] =
+      .ok (output, suffix) := by
+    simp [Eval.releaseSharedWork]
+  simpa using releaseSharedWork_append run emptyRun
+
+/-- Single-value wrapper of `releaseSharedWork_add_suffix`. -/
+theorem releaseShared_add_suffix {localFuel suffix : Nat}
+    {store output : Eval.Store} {value : RVal}
+    (run : Eval.releaseShared localFuel store value = .ok (output, 0)) :
+    Eval.releaseShared (localFuel + suffix) store value =
+      .ok (output, suffix) := by
+  exact releaseSharedWork_add_suffix run
+
+/-- Exact-budget unique work on a prefix composes with an independently
+budgeted suffix.  The zero remaining fuel pins the split point unambiguously. -/
+theorem dropUniqueWork_append {firstFuel secondFuel : Nat}
+    {store middle output : Eval.Store} {first second : List RVal}
+    {remaining : Nat}
+    (firstRun : Eval.dropUniqueWork firstFuel store first = .ok (middle, 0))
+    (secondRun : Eval.dropUniqueWork secondFuel middle second =
+      .ok (output, remaining)) :
+    Eval.dropUniqueWork (firstFuel + secondFuel) store (first ++ second) =
+      .ok (output, remaining) := by
+  induction firstFuel generalizing store first middle with
+  | zero =>
+      cases first with
+      | nil =>
+          simp only [Eval.dropUniqueWork, Except.ok.injEq, Prod.mk.injEq]
+            at firstRun
+          obtain ⟨rfl, _⟩ := firstRun
+          simpa [Eval.dropUniqueWork] using secondRun
+      | cons value first => simp [Eval.dropUniqueWork] at firstRun
+  | succ firstFuel ih =>
+      cases first with
+      | nil => simp [Eval.dropUniqueWork] at firstRun
+      | cons value first =>
+          cases value with
+          | lit literal =>
+              have prefix' :
+                  Eval.dropUniqueWork firstFuel store first =
+                    .ok (middle, 0) := by
+                simpa [Eval.dropUniqueWork] using firstRun
+              have combined := ih prefix' secondRun
+              simpa [Eval.dropUniqueWork, Nat.succ_add] using combined
+          | erased =>
+              have prefix' :
+                  Eval.dropUniqueWork firstFuel store first =
+                    .ok (middle, 0) := by
+                simpa [Eval.dropUniqueWork] using firstRun
+              have combined := ih prefix' secondRun
+              simpa [Eval.dropUniqueWork, Nat.succ_add] using combined
+          | loc location =>
+              cases boxAt : store.get? location with
+              | none => simp [Eval.dropUniqueWork, boxAt] at firstRun
+              | some box =>
+                  cases world : box.world with
+                  | shared =>
+                      simp [Eval.dropUniqueWork, boxAt, world] at firstRun
+                  | unique =>
+                      cases node : box.node with
+                      | papN address arity arguments =>
+                          simp [Eval.dropUniqueWork, boxAt, world, node]
+                            at firstRun
+                      | ctorN cid fields =>
+                          have prefix' :
+                              Eval.dropUniqueWork firstFuel
+                                  (store.kill location)
+                                  (fields.toList ++ first) =
+                                .ok (middle, 0) := by
+                            simpa [Eval.dropUniqueWork, boxAt, world, node]
+                              using firstRun
+                          have combined := ih prefix' secondRun
+                          simpa [Eval.dropUniqueWork, boxAt, world, node,
+                            Nat.succ_add, List.append_assoc] using combined
+
+/-- A successful unique-drop work list consumes a store/value-determined
+amount of heap fuel. Different initial budgets therefore produce the same
+store and differ only by their residual suffix. -/
+theorem dropUniqueWork_success_unique
+    {leftFuel rightFuel : Nat}
+    {store leftStore rightStore : Eval.Store}
+    {values : List RVal} {leftRemaining rightRemaining : Nat}
+    (left : Eval.dropUniqueWork leftFuel store values =
+      .ok (leftStore, leftRemaining))
+    (right : Eval.dropUniqueWork rightFuel store values =
+      .ok (rightStore, rightRemaining)) :
+    leftStore = rightStore ∧
+      leftFuel + rightRemaining = rightFuel + leftRemaining := by
+  induction leftFuel generalizing rightFuel store values leftStore rightStore
+      leftRemaining rightRemaining with
+  | zero =>
+      cases values with
+      | nil =>
+          simp [Eval.dropUniqueWork] at left right
+          obtain ⟨rfl, rfl⟩ := left
+          obtain ⟨rfl, rfl⟩ := right
+          exact ⟨rfl, by omega⟩
+      | cons value values => simp [Eval.dropUniqueWork] at left
+  | succ leftFuel ih =>
+      cases values with
+      | nil =>
+          simp [Eval.dropUniqueWork] at left right
+          obtain ⟨rfl, rfl⟩ := left
+          obtain ⟨rfl, rfl⟩ := right
+          exact ⟨rfl, by omega⟩
+      | cons value values =>
+          cases rightFuel with
+          | zero => simp [Eval.dropUniqueWork] at right
+          | succ rightFuel =>
+              cases value with
+              | lit literal =>
+                  obtain ⟨storeEq, fuelEq⟩ :=
+                    ih (rightFuel := rightFuel) left right
+                  exact ⟨storeEq, by omega⟩
+              | erased =>
+                  obtain ⟨storeEq, fuelEq⟩ :=
+                    ih (rightFuel := rightFuel) left right
+                  exact ⟨storeEq, by omega⟩
+              | loc location =>
+                  cases found : store.get? location with
+                  | none => simp [Eval.dropUniqueWork, found] at left
+                  | some box =>
+                      cases world : box.world with
+                      | shared =>
+                          simp [Eval.dropUniqueWork, found, world] at left
+                      | unique =>
+                          cases node : box.node with
+                          | papN address arity arguments =>
+                              simp [Eval.dropUniqueWork, found, world, node]
+                                at left
+                          | ctorN cid fields =>
+                              obtain ⟨storeEq, fuelEq⟩ :=
+                                ih (rightFuel := rightFuel)
+                                  (store := store.kill location)
+                                  (values := fields.toList ++ values)
+                                  (by simpa [Eval.dropUniqueWork, found,
+                                    world, node] using left)
+                                  (by simpa [Eval.dropUniqueWork, found,
+                                    world, node] using right)
+                              exact ⟨storeEq, by omega⟩
+
+/-- An exact unique-drop traversal can carry any independently chosen heap
+fuel suffix through unchanged. -/
+theorem dropUniqueWork_add_suffix {localFuel suffix : Nat}
+    {store output : Eval.Store} {values : List RVal}
+    (run : Eval.dropUniqueWork localFuel store values = .ok (output, 0)) :
+    Eval.dropUniqueWork (localFuel + suffix) store values =
+      .ok (output, suffix) := by
+  have emptyRun : Eval.dropUniqueWork suffix output [] =
+      .ok (output, suffix) := by
+    simp [Eval.dropUniqueWork]
+  simpa using dropUniqueWork_append run emptyRun
+
+/-- Single-value wrapper of `dropUniqueWork_add_suffix`. -/
+theorem dropUnique_add_suffix {localFuel suffix : Nat}
+    {store output : Eval.Store} {value : RVal}
+    (run : Eval.dropUnique localFuel store value = .ok (output, 0)) :
+    Eval.dropUnique (localFuel + suffix) store value =
+      .ok (output, suffix) := by
+  exact dropUniqueWork_add_suffix run
+
+/-- At a fixed IxIR₁ recursive fuel, successful shared release of one value
+has an exact-store IxIR₂ work-list execution.  Positivity is both the one
+extra source premise and a preserved output fact. -/
+def SharedValSimAt (context : IxIR1.Ctx) (fuel : Nat) : Prop :=
+  ∀ {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {value : RVal} {sourceOut : IxIR1.Store},
+    PositiveSharedRC sourceStore →
+    StoreRel sourceStore targetStore →
+    IxIR1.dropVal context fuel sourceStore value = .ok sourceOut →
+    ∃ targetFuel targetOut,
+      Eval.releaseSharedWork targetFuel targetStore [value] =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut ∧
+        PositiveSharedRC sourceOut
+
+/-- The list half of the mutually recursive shared-release correspondence. -/
+def SharedManySimAt (context : IxIR1.Ctx) (fuel : Nat) : Prop :=
+  ∀ {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {values : List RVal} {sourceOut : IxIR1.Store},
+    PositiveSharedRC sourceStore →
+    StoreRel sourceStore targetStore →
+    IxIR1.dropMany context fuel sourceStore values = .ok sourceOut →
+    ∃ targetFuel targetOut,
+      Eval.releaseSharedWork targetFuel targetStore values =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut ∧
+        PositiveSharedRC sourceOut
+
+/-- Successful recursive IxIR₁ shared destruction is simulated by the flat
+IxIR₂ work list.  The positivity premise excludes exactly IxIR₁'s legacy
+zero-refcount decrement case; target fuel remains independently existential. -/
+theorem sharedReleaseWork_simulation (context : IxIR1.Ctx) :
+    ∀ fuel, SharedValSimAt context fuel ∧ SharedManySimAt context fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor
+      · unfold SharedValSimAt
+        intro sourceStore targetStore value sourceOut positive stores sourceRun
+        simp [IxIR1.dropVal] at sourceRun
+      · unfold SharedManySimAt
+        intro sourceStore targetStore values sourceOut positive stores sourceRun
+        simp [IxIR1.dropMany] at sourceRun
+  | succ fuel ih =>
+      have valueIH : SharedValSimAt context fuel := ih.1
+      have manyIH : SharedManySimAt context fuel := ih.2
+      unfold SharedValSimAt at valueIH
+      unfold SharedManySimAt at manyIH
+      constructor
+      · unfold SharedValSimAt
+        intro sourceStore targetStore value sourceOut positive stores sourceRun
+        cases value with
+        | lit literal =>
+            simp only [IxIR1.dropVal] at sourceRun
+            cases sourceRun
+            refine ⟨1, targetStore, ?_, stores, positive⟩
+            simp [Eval.releaseSharedWork]
+        | erased =>
+            simp only [IxIR1.dropVal] at sourceRun
+            cases sourceRun
+            refine ⟨1, targetStore, ?_, stores, positive⟩
+            simp [Eval.releaseSharedWork]
+        | loc location =>
+            rw [IxIR1.dropVal.eq_def] at sourceRun
+            dsimp only at sourceRun
+            cases sourceGet : sourceStore.get? location with
+            | none => simp [sourceGet] at sourceRun
+            | some box =>
+                cases world : box.world with
+                | unique => simp [sourceGet, world] at sourceRun
+                | shared =>
+                    have targetGet :
+                        targetStore.get? location = some box := by
+                      unfold Eval.Store.get?
+                      rw [stores.heap]
+                      exact sourceGet
+                    have countPositive : 0 < box.rc :=
+                      positive sourceGet world
+                    have nonzero : box.rc ≠ 0 := by omega
+                    have tickGet :
+                        sourceStore.rcTick.get? location = some box := by
+                      simpa [IxIR1.Store.rcTick, IxIR1.Store.get?]
+                        using sourceGet
+                    by_cases unit : box.rc = 1
+                    · cases node : box.node with
+                      | ctorN cid fields =>
+                          have childRun :
+                              IxIR1.dropMany context fuel
+                                  (sourceStore.rcTick.kill location)
+                                  fields.toList = .ok sourceOut := by
+                            simpa [sourceGet, world, unit, node]
+                              using sourceRun
+                          have prefixPositive :
+                              PositiveSharedRC
+                                (sourceStore.rcTick.kill location) :=
+                            PositiveSharedRC.kill
+                              (PositiveSharedRC.rcTick positive) tickGet
+                          obtain ⟨targetFuel, targetOut, targetRun,
+                              outputStores, outputPositive⟩ :=
+                            manyIH prefixPositive
+                              ((stores.rcTick).kill location) childRun
+                          refine ⟨targetFuel + 1, targetOut, ?_,
+                            outputStores, outputPositive⟩
+                          simpa [Eval.releaseSharedWork, targetGet, world,
+                            nonzero, unit, node] using targetRun
+                      | papN address arity arguments =>
+                          have childRun :
+                              IxIR1.dropMany context fuel
+                                  (sourceStore.rcTick.kill location)
+                                  arguments.toList = .ok sourceOut := by
+                            simpa [sourceGet, world, unit, node]
+                              using sourceRun
+                          have prefixPositive :
+                              PositiveSharedRC
+                                (sourceStore.rcTick.kill location) :=
+                            PositiveSharedRC.kill
+                              (PositiveSharedRC.rcTick positive) tickGet
+                          obtain ⟨targetFuel, targetOut, targetRun,
+                              outputStores, outputPositive⟩ :=
+                            manyIH prefixPositive
+                              ((stores.rcTick).kill location) childRun
+                          refine ⟨targetFuel + 1, targetOut, ?_,
+                            outputStores, outputPositive⟩
+                          simpa [Eval.releaseSharedWork, targetGet, world,
+                            nonzero, unit, node] using targetRun
+                    · have unitTest : (box.rc == 1) = false := by
+                        simp [unit]
+                      have directRun :
+                          (.ok (sourceStore.rcTick.setBox location
+                            { box with rc := box.rc - 1 }) :
+                              Except IxIR1.Err IxIR1.Store) =
+                            .ok sourceOut := by
+                        simpa [sourceGet, world, unitTest] using sourceRun
+                      injection directRun with outputEqual
+                      subst sourceOut
+                      have decrementedPositive : 0 < box.rc - 1 := by omega
+                      have outputPositive :
+                          PositiveSharedRC
+                            (sourceStore.rcTick.setBox location
+                              { box with rc := box.rc - 1 }) :=
+                        PositiveSharedRC.setRc
+                          (PositiveSharedRC.rcTick positive) tickGet
+                          decrementedPositive
+                      refine ⟨1,
+                        targetStore.rcTick.setBox location
+                          { box with rc := box.rc - 1 }, ?_,
+                        (stores.rcTick).setBox location
+                          { box with rc := box.rc - 1 }, outputPositive⟩
+                      simp [Eval.releaseSharedWork, targetGet, world,
+                        nonzero, unit]
+      · unfold SharedManySimAt
+        intro sourceStore targetStore values sourceOut positive stores sourceRun
+        cases values with
+        | nil =>
+            simp only [IxIR1.dropMany] at sourceRun
+            cases sourceRun
+            refine ⟨0, targetStore, ?_, stores, positive⟩
+            simp [Eval.releaseSharedWork]
+        | cons value values =>
+            rw [IxIR1.dropMany.eq_def] at sourceRun
+            dsimp only at sourceRun
+            cases valueRun : IxIR1.dropVal context fuel sourceStore value with
+            | error error =>
+                simp [valueRun, bind, Except.bind] at sourceRun
+            | ok middleStore =>
+                simp only [valueRun, bind, Except.bind] at sourceRun
+                obtain ⟨valueFuel, targetMiddle, targetValueRun,
+                    middleStores, middlePositive⟩ :=
+                  valueIH positive stores valueRun
+                obtain ⟨valuesFuel, targetOut, targetValuesRun,
+                    outputStores, outputPositive⟩ :=
+                  manyIH middlePositive middleStores sourceRun
+                refine ⟨valueFuel + valuesFuel, targetOut, ?_,
+                  outputStores, outputPositive⟩
+                simpa using
+                  (releaseSharedWork_append targetValueRun targetValuesRun)
+
+/-- Public value projection of the mutual recursive shared-release theorem. -/
+theorem dropVal_simulates_releaseSharedWork {context : IxIR1.Ctx}
+    {fuel : Nat} {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {value : RVal} {sourceOut : IxIR1.Store}
+    (positive : PositiveSharedRC sourceStore)
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRun : IxIR1.dropVal context fuel sourceStore value = .ok sourceOut) :
+    ∃ targetFuel targetOut,
+      Eval.releaseSharedWork targetFuel targetStore [value] =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut ∧
+        PositiveSharedRC sourceOut :=
+  (sharedReleaseWork_simulation context fuel).1 positive stores sourceRun
+
+/-- Public list projection of the mutual recursive shared-release theorem. -/
+theorem dropMany_simulates_releaseSharedWork {context : IxIR1.Ctx}
+    {fuel : Nat} {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {values : List RVal} {sourceOut : IxIR1.Store}
+    (positive : PositiveSharedRC sourceStore)
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRun :
+      IxIR1.dropMany context fuel sourceStore values = .ok sourceOut) :
+    ∃ targetFuel targetOut,
+      Eval.releaseSharedWork targetFuel targetStore values =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut ∧
+        PositiveSharedRC sourceOut :=
+  (sharedReleaseWork_simulation context fuel).2 positive stores sourceRun
+
+/-- At a fixed IxIR₁ recursive fuel, one successful unique-value drop has an
+exact-store IxIR₂ work-list execution with some exact target budget. -/
+def UniqueValSimAt (context : IxIR1.Ctx) (fuel : Nat) : Prop :=
+  ∀ {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {value : RVal} {sourceOut : IxIR1.Store},
+    StoreRel sourceStore targetStore →
+    IxIR1.dropUVal context fuel sourceStore value = .ok sourceOut →
+    ∃ targetFuel targetOut,
+      Eval.dropUniqueWork targetFuel targetStore [value] =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut
+
+/-- The list half of the mutually recursive unique-drop correspondence. -/
+def UniqueManySimAt (context : IxIR1.Ctx) (fuel : Nat) : Prop :=
+  ∀ {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {values : List RVal} {sourceOut : IxIR1.Store},
+    StoreRel sourceStore targetStore →
+    IxIR1.dropManyU context fuel sourceStore values = .ok sourceOut →
+    ∃ targetFuel targetOut,
+      Eval.dropUniqueWork targetFuel targetStore values =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut
+
+/-- Successful recursive IxIR₁ unique destruction is simulated by the flat
+IxIR₂ work list.  Target fuel is existential because the source budgets tree
+depth/list recursion while the target counts visited runtime values. -/
+theorem uniqueDropWork_simulation (context : IxIR1.Ctx) :
+    ∀ fuel, UniqueValSimAt context fuel ∧ UniqueManySimAt context fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      constructor
+      · unfold UniqueValSimAt
+        intro sourceStore targetStore value sourceOut stores sourceRun
+        simp [IxIR1.dropUVal] at sourceRun
+      · unfold UniqueManySimAt
+        intro sourceStore targetStore values sourceOut stores sourceRun
+        simp [IxIR1.dropManyU] at sourceRun
+  | succ fuel ih =>
+      have valueIH : UniqueValSimAt context fuel := ih.1
+      have manyIH : UniqueManySimAt context fuel := ih.2
+      unfold UniqueValSimAt at valueIH
+      unfold UniqueManySimAt at manyIH
+      constructor
+      · unfold UniqueValSimAt
+        intro sourceStore targetStore value sourceOut stores sourceRun
+        cases value with
+        | lit literal =>
+            simp only [IxIR1.dropUVal] at sourceRun
+            cases sourceRun
+            refine ⟨1, targetStore, ?_, stores⟩
+            simp [Eval.dropUniqueWork]
+        | erased =>
+            simp only [IxIR1.dropUVal] at sourceRun
+            cases sourceRun
+            refine ⟨1, targetStore, ?_, stores⟩
+            simp [Eval.dropUniqueWork]
+        | loc location =>
+            rw [IxIR1.dropUVal.eq_def] at sourceRun
+            dsimp only at sourceRun
+            cases sourceGet : sourceStore.get? location with
+            | none => simp [sourceGet] at sourceRun
+            | some box =>
+                cases world : box.world with
+                | shared => simp [sourceGet, world] at sourceRun
+                | unique =>
+                    cases node : box.node with
+                    | papN address arity arguments =>
+                        simp [sourceGet, world, node] at sourceRun
+                    | ctorN cid fields =>
+                        simp only [sourceGet, world, node] at sourceRun
+                        have targetGet :
+                            targetStore.get? location = some box := by
+                          unfold Eval.Store.get?
+                          rw [stores.heap]
+                          exact sourceGet
+                        obtain ⟨targetFuel, targetOut, targetRun, outputStores⟩ :=
+                          manyIH (stores.kill location) sourceRun
+                        refine ⟨targetFuel + 1, targetOut, ?_, outputStores⟩
+                        simpa [Eval.dropUniqueWork, targetGet, world, node]
+                          using targetRun
+      · unfold UniqueManySimAt
+        intro sourceStore targetStore values sourceOut stores sourceRun
+        cases values with
+        | nil =>
+            simp only [IxIR1.dropManyU] at sourceRun
+            cases sourceRun
+            refine ⟨0, targetStore, ?_, stores⟩
+            simp [Eval.dropUniqueWork]
+        | cons value values =>
+            rw [IxIR1.dropManyU.eq_def] at sourceRun
+            dsimp only at sourceRun
+            cases valueRun : IxIR1.dropUVal context fuel sourceStore value with
+            | error error =>
+                simp [valueRun, bind, Except.bind] at sourceRun
+            | ok middleStore =>
+                simp only [valueRun, bind, Except.bind] at sourceRun
+                obtain ⟨valueFuel, targetMiddle, targetValueRun,
+                    middleStores⟩ := valueIH stores valueRun
+                obtain ⟨valuesFuel, targetOut, targetValuesRun,
+                    outputStores⟩ := manyIH middleStores sourceRun
+                refine ⟨valueFuel + valuesFuel, targetOut, ?_, outputStores⟩
+                simpa using
+                  (dropUniqueWork_append targetValueRun targetValuesRun)
+
+/-- Public value projection of the mutual recursive unique-drop theorem. -/
+theorem dropUVal_simulates_dropUniqueWork {context : IxIR1.Ctx}
+    {fuel : Nat} {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {value : RVal} {sourceOut : IxIR1.Store}
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRun :
+      IxIR1.dropUVal context fuel sourceStore value = .ok sourceOut) :
+    ∃ targetFuel targetOut,
+      Eval.dropUniqueWork targetFuel targetStore [value] =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut :=
+  (uniqueDropWork_simulation context fuel).1 stores sourceRun
+
+/-- Public list projection of the mutual recursive unique-drop theorem. -/
+theorem dropManyU_simulates_dropUniqueWork {context : IxIR1.Ctx}
+    {fuel : Nat} {sourceStore : IxIR1.Store} {targetStore : Eval.Store}
+    {values : List RVal} {sourceOut : IxIR1.Store}
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRun :
+      IxIR1.dropManyU context fuel sourceStore values = .ok sourceOut) :
+    ∃ targetFuel targetOut,
+      Eval.dropUniqueWork targetFuel targetStore values =
+          .ok (targetOut, 0) ∧
+        StoreRel sourceOut targetOut :=
+  (uniqueDropWork_simulation context fuel).2 stores sourceRun
+
+/-- The scalar branch of IxIR₁ `dup` and IxIR₂ `retainShared` is an
+identical store-preserving step. -/
+theorem simulate_dup_retain_scalar {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .retainShared targetAtom) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.dup sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack } ∧
+      StoreRel sourceStore machine.store ∧
+      EnvRel (value :: source) (frame.values.push value)
+        (#[some (.reg frame.values.size)] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetStep := Eval.Step.retainShared (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved (retainShared_of_scalar scalar)
+  refine ⟨?_, targetStep, stores, environments.bindValue value⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  cases value with
+  | loc location => simp [Eval.RVal.isScalar] at scalar
+  | lit literal => rfl
+  | erased => rfl
+
+/-- The heap-bearing branch increments the same shared node and RC counter in
+both exact stores before binding the retained location. -/
+theorem simulate_dup_retain_shared {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .retainShared targetAtom) :
+    let nextBox := { box with rc := box.rc + 1 }
+    let sourceStore' := (sourceStore.setBox location nextBox).rcTick
+    let targetStore' := (machine.store.setBox location nextBox).rcTick
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.dup sourceAtom) = .ok (sourceStore', .loc location) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetStore'
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc location) }
+            stack } ∧
+      StoreRel sourceStore' targetStore' ∧
+      EnvRel (.loc location :: source)
+        (frame.values.push (.loc location))
+        (#[some (.reg frame.values.size)] ++ mapping) := by
+  dsimp only
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have retained :
+      Eval.retainShared machine.store (.loc location) =
+        .ok ((machine.store.setBox location
+          { box with rc := box.rc + 1 }).rcTick) := by
+    unfold Eval.retainShared
+    simp only
+    rw [targetGet]
+    simp only
+    rw [shared]
+    rfl
+  have targetStep := Eval.Step.retainShared (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved retained
+  refine ⟨?_, targetStep,
+    (stores.setBox location { box with rc := box.rc + 1 }).rcTick,
+    environments.bindValue (.loc location)⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceGet]
+  simp only
+  rw [shared]
+
+/-- Trace-facing scalar retain transition. -/
+theorem simulate_traced_dup_retain_scalar_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.dup sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel functionTrace next (value :: source) nextFrame := by
+  dsimp only
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .retainShared targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ :=
+    simulate_dup_retain_scalar stores state.environments translated
+      sourceResolved scalar control blockAt pcBound instruction
+  have nextEnvironments := canonical.forgetTracedValue state descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.retainShared targetAtom) = some (.reg entryValueCount) by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Trace-facing heap-bearing shared retain transition. -/
+theorem simulate_traced_dup_retain_shared_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (control : machine.control = .running frame stack) :
+    let nextBox := { box with rc := box.rc + 1 }
+    let sourceStore' := (sourceStore.setBox location nextBox).rcTick
+    let targetStore' := (machine.store.setBox location nextBox).rcTick
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc location) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.dup sourceAtom) = .ok (sourceStore', .loc location) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetStore'
+          control := .running nextFrame stack } ∧
+      StoreRel sourceStore' targetStore' ∧
+      CodeStateRel functionTrace next (.loc location :: source) nextFrame := by
+  dsimp only
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .retainShared targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ :=
+    simulate_dup_retain_shared stores state.environments translated
+      sourceResolved sourceGet shared control blockAt pcBound instruction
+  have nextEnvironments := canonical.forgetTracedValue state descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.retainShared targetAtom) = some (.reg entryValueCount) by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- A scalar IxIR₁ shared drop and its effect-only IxIR₂ release leave the
+exact store and runtime environments unchanged.  The target accounts for the
+single scalar work-list visit in its independent heap budget. -/
+theorem simulate_drop_release_scalar {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .releaseShared targetAtom) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.drop sourceAtom) = .ok (sourceStore, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store
+          heapFuel := targetHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } ∧
+      StoreRel sourceStore machine.store ∧
+      EnvRel (.erased :: source) frame.values
+        (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have released :
+      Eval.releaseShared machine.heapFuel machine.store value =
+        .ok (machine.store, targetHeapFuel) := by
+    rw [heapFuel]
+    exact releaseShared_of_scalar targetHeapFuel scalar
+  have targetStep := Eval.Step.releaseShared (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved released
+  refine ⟨?_, targetStep, stores, environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  cases value with
+  | loc location => simp [Eval.RVal.isScalar] at scalar
+  | lit literal => rfl
+  | erased => rfl
+
+/-- A scalar IxIR₁ unique drop and its effect-only IxIR₂ counterpart preserve
+the exact store while spending one target heap-traversal unit. -/
+theorem simulate_dropU_dropUnique_scalar {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] = .dropUnique targetAtom) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.dropU sourceAtom) = .ok (sourceStore, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store
+          heapFuel := targetHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } ∧
+      StoreRel sourceStore machine.store ∧
+      EnvRel (.erased :: source) frame.values
+        (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have dropped :
+      Eval.dropUnique machine.heapFuel machine.store value =
+        .ok (machine.store, targetHeapFuel) := by
+    rw [heapFuel]
+    exact dropUnique_of_scalar targetHeapFuel scalar
+  have targetStep := Eval.Step.dropUnique (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved dropped
+  refine ⟨?_, targetStep, stores, environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  cases value with
+  | loc location => simp [Eval.RVal.isScalar] at scalar
+  | lit literal => rfl
+  | erased => rfl
+
+/-- Trace-facing scalar shared-drop transition. -/
+theorem simulate_traced_drop_release_scalar_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.drop sourceAtom) = .ok (sourceStore, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store
+          heapFuel := targetHeapFuel
+          control := .running nextFrame stack } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel functionTrace next (.erased :: source) nextFrame := by
+  dsimp only
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .releaseShared targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ :=
+    simulate_drop_release_scalar stores state.environments translated
+      sourceResolved scalar heapFuel control blockAt pcBound instruction
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.releaseShared targetAtom) = some .erased by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Trace-facing scalar unique-drop transition. -/
+theorem simulate_traced_dropU_dropUnique_scalar_state
+    {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.dropU sourceAtom) = .ok (sourceStore, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store
+          heapFuel := targetHeapFuel
+          control := .running nextFrame stack } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel functionTrace next (.erased :: source) nextFrame := by
+  dsimp only
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .dropUnique targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ :=
+    simulate_dropU_dropUnique_scalar stores state.environments translated
+      sourceResolved scalar heapFuel control blockAt pcBound instruction
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.dropUnique targetAtom) = some .erased by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Every successful recursive IxIR₁ unique-location drop has a sufficient
+IxIR₂ heap budget that drives one effect-only `dropUnique` step to the same
+exact heap.  The theorem exposes the locally chosen budget explicitly; later
+block composition can add slack and combine these finite witnesses. -/
+theorem simulate_dropU_dropUnique_recursive
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore sourceStore' : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {location : Nat}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropUVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .dropUnique targetAtom) :
+    ∃ targetHeapFuel targetStore,
+      IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+            source (.dropU sourceAtom) = .ok (sourceStore', .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetStore
+            heapFuel := 0
+            control := .running { frame with pc := frame.pc + 1 } stack } ∧
+        StoreRel sourceStore' targetStore ∧
+        EnvRel (.erased :: source) frame.values
+          (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  obtain ⟨targetHeapFuel, targetStore, targetRun, outputStores⟩ :=
+    dropUVal_simulates_dropUniqueWork stores sourceDropped
+  have targetDropped :
+      Eval.dropUnique targetHeapFuel machine.store (.loc location) =
+        .ok (targetStore, 0) := by
+    simpa [Eval.dropUnique] using targetRun
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame stack := by
+    simpa using control
+  have targetStep := Eval.Step.dropUnique (context := context)
+    (interpretation := interpretation) beforeControl blockAt pc instruction
+    targetResolved targetDropped
+  refine ⟨targetHeapFuel, targetStore, ?_, targetStep, outputStores,
+    environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceDropped]
+
+/-- Every successful recursive IxIR₁ shared-location drop from a positive-RC
+heap has a sufficient IxIR₂ budget for one effect-only `releaseShared` step
+to the same exact heap.  Positivity is returned for subsequent instructions. -/
+theorem simulate_drop_release_recursive
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore sourceStore' : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (positive : PositiveSharedRC sourceStore)
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {location : Nat}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .releaseShared targetAtom) :
+    ∃ targetHeapFuel targetStore,
+      IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+            source (.drop sourceAtom) = .ok (sourceStore', .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetStore
+            heapFuel := 0
+            control := .running { frame with pc := frame.pc + 1 } stack } ∧
+        StoreRel sourceStore' targetStore ∧
+        PositiveSharedRC sourceStore' ∧
+        EnvRel (.erased :: source) frame.values
+          (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  obtain ⟨targetHeapFuel, targetStore, targetRun, outputStores,
+      outputPositive⟩ :=
+    dropVal_simulates_releaseSharedWork positive stores sourceDropped
+  have targetReleased :
+      Eval.releaseShared targetHeapFuel machine.store (.loc location) =
+        .ok (targetStore, 0) := by
+    simpa [Eval.releaseShared] using targetRun
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame stack := by
+    simpa using control
+  have targetStep := Eval.Step.releaseShared (context := context)
+    (interpretation := interpretation) beforeControl blockAt pc instruction
+    targetResolved targetReleased
+  refine ⟨targetHeapFuel, targetStore, ?_, targetStep, outputStores,
+    outputPositive, environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceDropped]
+
+/-- Trace-facing recursive unique drop. A successful source recursive drop
+selects a sufficient target heap budget, while the trace supplies all target
+syntax and the exact continuation state. -/
+theorem simulate_traced_dropU_dropUnique_recursive_state
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceStore sourceStore' : IxIR1.Store} {source : List RVal}
+    {location : Nat}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropUVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack) :
+    ∃ targetHeapFuel targetStore,
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+            source (.dropU sourceAtom) = .ok (sourceStore', .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetStore
+            heapFuel := 0
+            control := .running nextFrame stack } ∧
+        StoreRel sourceStore' targetStore ∧
+        CodeStateRel functionTrace next (.erased :: source) nextFrame := by
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .dropUnique targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨targetHeapFuel, targetStore, sourceRun, targetStep,
+      nextStores, canonical⟩ :=
+    simulate_dropU_dropUnique_recursive stores state.environments translated
+      sourceResolved sourceDropped control blockAt pcBound instruction
+  refine ⟨targetHeapFuel, targetStore, ?_⟩
+  dsimp only
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.dropUnique targetAtom) = some .erased by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Trace-facing recursive shared drop, including preservation of the source
+positive-reference-count invariant needed by subsequent recursive releases. -/
+theorem simulate_traced_drop_release_recursive_state
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceStore sourceStore' : IxIR1.Store} {source : List RVal}
+    {location : Nat}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next) source frame)
+    (positive : PositiveSharedRC sourceStore)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack) :
+    ∃ targetHeapFuel targetStore,
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+            source (.drop sourceAtom) = .ok (sourceStore', .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetStore
+            heapFuel := 0
+            control := .running nextFrame stack } ∧
+        StoreRel sourceStore' targetStore ∧
+        PositiveSharedRC sourceStore' ∧
+        CodeStateRel functionTrace next (.erased :: source) nextFrame := by
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .releaseShared targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨targetHeapFuel, targetStore, sourceRun, targetStep,
+      nextStores, nextPositive, canonical⟩ :=
+    simulate_drop_release_recursive positive stores state.environments
+      translated sourceResolved sourceDropped control blockAt pcBound instruction
+  refine ⟨targetHeapFuel, targetStore, ?_⟩
+  dsimp only
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.releaseShared targetAtom) = some .erased by rfl)
+  refine ⟨sourceRun, targetStep, nextStores, nextPositive,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Releasing a shared node with more than one owner decrements the same
+refcount and charges the same RC operation in both exact stores.  This is the
+non-recursive heap-bearing branch of deep shared release. -/
+theorem simulate_drop_release_shared_nonunit {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef}
+    {sourceDropFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (nonzero : box.rc ≠ 0)
+    (nonunit : box.rc ≠ 1)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .releaseShared targetAtom) :
+    let nextBox := { box with rc := box.rc - 1 }
+    let sourceStore' := sourceStore.rcTick.setBox location nextBox
+    let targetStore' := machine.store.rcTick.setBox location nextBox
+    IxIR1.runOp sourceContext ((sourceDropFuel + 1) + 1) sourceCurrent
+          sourceStore source (.drop sourceAtom) =
+        .ok (sourceStore', .erased) ∧
+      Eval.Step context interpretation machine
+        { store := targetStore'
+          heapFuel := targetHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } ∧
+      StoreRel sourceStore' targetStore' ∧
+      EnvRel (.erased :: source) frame.values
+        (#[some .erased] ++ mapping) := by
+  dsimp only
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have released :
+      Eval.releaseShared machine.heapFuel machine.store (.loc location) =
+        .ok (machine.store.rcTick.setBox location
+          { box with rc := box.rc - 1 }, targetHeapFuel) := by
+    rw [heapFuel]
+    simp [Eval.releaseShared, Eval.releaseSharedWork, targetGet, shared,
+      nonzero, nonunit]
+  have targetStep := Eval.Step.releaseShared (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved released
+  refine ⟨?_, targetStep, (stores.rcTick).setBox location
+    { box with rc := box.rc - 1 }, environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [IxIR1.dropVal.eq_def]
+  simp only
+  rw [sourceGet]
+  simp [shared, nonunit]
+
+/-- Deep-dropping a unique constructor whose children are all scalar kills the
+same node in both stores.  IxIR₂ spends one heap unit on the constructor plus
+one per field; IxIR₁ additionally needs fuel to inspect the empty list tail. -/
+theorem simulate_dropU_dropUnique_scalar_ctor
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {cid : IxIR1.CtorId} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN cid fields)
+    (scalarFields : fields.toList.all Eval.RVal.isScalar = true)
+    (heapFuel : machine.heapFuel =
+      (targetHeapFuel + fields.toList.length) + 1)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .dropUnique targetAtom) :
+    IxIR1.runOp sourceContext ((fields.toList.length + 2) + 1)
+          sourceCurrent sourceStore source (.dropU sourceAtom) =
+        .ok (sourceStore.kill location, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store.kill location
+          heapFuel := targetHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } ∧
+      StoreRel (sourceStore.kill location)
+        (machine.store.kill location) ∧
+      EnvRel (.erased :: source) frame.values
+        (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have sourceDropped :
+      IxIR1.dropUVal sourceContext (fields.toList.length + 2) sourceStore
+          (.loc location) = .ok (sourceStore.kill location) := by
+    rw [IxIR1.dropUVal.eq_def]
+    simp only
+    rw [sourceGet]
+    simp only
+    rw [unique, node]
+    exact sourceDropManyU_of_scalars scalarFields
+  have targetDropped :
+      Eval.dropUnique machine.heapFuel machine.store (.loc location) =
+        .ok (machine.store.kill location, targetHeapFuel) := by
+    rw [heapFuel]
+    unfold Eval.dropUnique
+    simp only [Eval.dropUniqueWork]
+    rw [targetGet]
+    simp only
+    rw [unique, node]
+    simpa using (dropUniqueWork_of_scalars
+      (store := machine.store.kill location) targetHeapFuel scalarFields)
+  have targetStep := Eval.Step.dropUnique (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved targetDropped
+  refine ⟨?_, targetStep, stores.kill location,
+    environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceDropped]
+
+/-- Releasing the final owner of an all-scalar shared constructor charges one
+RC operation, kills that constructor, and traverses only inert scalar fields
+in both machines. -/
+theorem simulate_drop_release_shared_unit_scalar_ctor
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {cid : IxIR1.CtorId} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (unit : box.rc = 1)
+    (node : box.node = .ctorN cid fields)
+    (scalarFields : fields.toList.all Eval.RVal.isScalar = true)
+    (heapFuel : machine.heapFuel =
+      (targetHeapFuel + fields.toList.length) + 1)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .releaseShared targetAtom) :
+    IxIR1.runOp sourceContext ((fields.toList.length + 2) + 1)
+          sourceCurrent sourceStore source (.drop sourceAtom) =
+        .ok (sourceStore.rcTick.kill location, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store.rcTick.kill location
+          heapFuel := targetHeapFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } ∧
+      StoreRel (sourceStore.rcTick.kill location)
+        (machine.store.rcTick.kill location) ∧
+      EnvRel (.erased :: source) frame.values
+        (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have sourceDropped :
+      IxIR1.dropVal sourceContext (fields.toList.length + 2) sourceStore
+          (.loc location) =
+        .ok (sourceStore.rcTick.kill location) := by
+    rw [IxIR1.dropVal.eq_def]
+    simp only
+    rw [sourceGet]
+    simp only
+    rw [shared, unit, node]
+    exact sourceDropMany_of_scalars scalarFields
+  have targetReleased :
+      Eval.releaseShared machine.heapFuel machine.store (.loc location) =
+        .ok (machine.store.rcTick.kill location, targetHeapFuel) := by
+    rw [heapFuel]
+    unfold Eval.releaseShared
+    simp only [Eval.releaseSharedWork]
+    rw [targetGet]
+    simp only
+    rw [shared, unit, node]
+    simpa using (releaseSharedWork_of_scalars
+      (store := machine.store.rcTick.kill location) targetHeapFuel scalarFields)
+  have targetStep := Eval.Step.releaseShared (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved targetReleased
+  refine ⟨?_, targetStep, (stores.rcTick).kill location,
+    environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceDropped]
+
+/-- A checked scalar-leaf IxIR₁ free and IxIR₂ `freeUnique` kill the same
+unique constructor location and bind the source's erased effect result. -/
+theorem simulate_free_freeUnique {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {cid : IxIR1.CtorId} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN cid fields)
+    (scalarFields : fields.all Eval.RVal.isScalar = true)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .freeUnique targetAtom cid) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.free sourceAtom) =
+        .ok (sourceStore.kill location, .erased) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := machine.store.kill location
+          control := .running { frame with pc := frame.pc + 1 } stack } ∧
+      StoreRel (sourceStore.kill location)
+        (machine.store.kill location) ∧
+      EnvRel (.erased :: source) frame.values
+        (#[some .erased] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetStep := Eval.Step.freeUnique (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved targetGet unique node scalarFields
+  refine ⟨?_, targetStep, stores.kill location, environments.bindErased⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceGet]
+  simp only
+  rw [unique]
+
+/-- Trace-facing checked shallow free. The trace discharges operand and
+instruction-coordinate facts while the exact constructor/scalar-leaf runtime
+facts remain the owner-keyed provenance boundary. -/
+theorem simulate_traced_free_freeUnique_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {targetCid : IxIR1.CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {fields : Array RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN targetCid fields)
+    (scalarFields : fields.all Eval.RVal.isScalar = true)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.free sourceAtom) =
+        .ok (sourceStore.kill location, .erased) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := machine.store.kill location
+          control := .running nextFrame stack } ∧
+      StoreRel (sourceStore.kill location) (machine.store.kill location) ∧
+      CodeStateRel functionTrace next (.erased :: source) nextFrame := by
+  dsimp only
+  have translated : translateAtom input sourceAtom = some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .freeUnique targetAtom targetCid :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ :=
+    simulate_free_freeUnique stores state.environments translated
+      sourceResolved sourceGet unique node scalarFields control blockAt pcBound
+      instruction
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.freeUnique targetAtom targetCid) = some .erased by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- A checked IxIR₂ fetch refines the corresponding non-consuming IxIR₁
+projection when the owner's exact constructor sidecar identifies the runtime
+node.  Both machines keep the store unchanged and bind the same field value. -/
+theorem simulate_fetch {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {cid : IxIR1.CtorId} {field location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (fieldAt : fields[field]? = some value)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .fetch targetAtom cid field) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.fetch sourceAtom field) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value }
+            stack } ∧
+      StoreRel sourceStore machine.store ∧
+      EnvRel (value :: source) (frame.values.push value)
+        (#[some (.reg frame.values.size)] ++ mapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetStep := Eval.Step.fetch (context := context)
+    (interpretation := interpretation) control blockAt pc instruction
+    targetResolved targetGet node fieldAt
+  refine ⟨?_, targetStep, stores, environments.bindValue value⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceGet]
+  simp only
+  rw [node]
+  simp only
+  rw [fieldAt]
+
+/-- Trace-facing non-consuming projection. The checked trace supplies operand,
+field, target coordinate, continuation map, and recursive-state progression;
+the runtime constructor identity remains the provenance obligation. -/
+theorem simulate_traced_fetch_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {sourceField targetField : Nat} {targetCid : IxIR1.CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN targetCid fields)
+    (fieldAt : fields[sourceField]? = some value)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.fetch sourceAtom sourceField) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel functionTrace next (value :: source) nextFrame := by
+  dsimp only
+  have operationSyntax := functionTrace.descendantOperationSyntax descendant
+  change sourceField = targetField ∧
+    Lower.InputMap.translateAtom input sourceAtom = some targetAtom at operationSyntax
+  obtain ⟨fieldEq, translated⟩ := operationSyntax
+  subst targetField
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .fetch targetAtom targetCid sourceField :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ := simulate_fetch
+    stores state.environments translated sourceResolved sourceGet node fieldAt
+      control blockAt pcBound instruction
+  have nextEnvironments := canonical.forgetTracedValue state descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.fetch targetAtom targetCid sourceField) =
+        some (.reg entryValueCount) by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Pointwise translation of an operand vector. Keeping this relation
+separate from the executable translators makes it compose directly with
+generated instruction equations. -/
+inductive AtomsListRel (mapping : EnvMap) :
+    List IxIR1.Atom → List Atom → Prop where
+  | nil : AtomsListRel mapping [] []
+  | cons : translateAtom mapping sourceAtom = some targetAtom →
+      AtomsListRel mapping sourceAtoms targetAtoms →
+      AtomsListRel mapping (sourceAtom :: sourceAtoms)
+        (targetAtom :: targetAtoms)
+
+def AtomsRel (mapping : EnvMap) (source : Array IxIR1.Atom)
+    (target : Array Atom) : Prop :=
+  AtomsListRel mapping source.toList target.toList
+
+private theorem atomsListRel_of_mapM (mapping : EnvMap) :
+    ∀ (source : List IxIR1.Atom) (target : List Atom),
+      source.mapM (translateAtom mapping) = some target →
+      AtomsListRel mapping source target
+  | [], target, translated => by
+      simp at translated
+      subst target
+      exact .nil
+  | sourceAtom :: sourceAtoms, target, translated => by
+      cases atomEq : translateAtom mapping sourceAtom with
+      | none => simp [List.mapM_cons, atomEq] at translated
+      | some targetAtom =>
+          cases restEq : sourceAtoms.mapM (translateAtom mapping) with
+          | none => simp [List.mapM_cons, atomEq, restEq] at translated
+          | some targetAtoms =>
+              have targetEq : target = targetAtom :: targetAtoms := by
+                simpa [List.mapM_cons, atomEq, restEq] using translated.symm
+              subst target
+              exact .cons atomEq
+                (atomsListRel_of_mapM mapping sourceAtoms targetAtoms restEq)
+
+/-- Reflect the producer's executable vector translation into the
+pointwise relation consumed by the semantic operand-resolution lemmas. -/
+theorem atomsRel_of_translateAtoms {mapping : EnvMap}
+    {source : Array IxIR1.Atom} {target : Array Atom}
+    (translated : Lower.InputMap.translateAtoms mapping source = some target) :
+    AtomsRel mapping source target := by
+  unfold Lower.InputMap.translateAtoms at translated
+  cases mapped : source.toList.mapM (translateAtom mapping) with
+  | none => simp [mapped] at translated
+  | some targetAtoms =>
+      have targetEq : target = targetAtoms.toArray := by
+        simpa [mapped] using translated.symm
+      subst target
+      unfold AtomsRel
+      simpa using atomsListRel_of_mapM mapping source.toList targetAtoms mapped
+
+private theorem except_bind_eq_ok {ε α β : Type} {input : Except ε α}
+    {next : α → Except ε β} {output : β}
+    (bound : input.bind next = .ok output) :
+    ∃ value, input = .ok value ∧ next value = .ok output := by
+  cases input with
+  | error error => cases bound
+  | ok value => exact ⟨value, rfl, bound⟩
+
+/-- Pointwise account of a successful target operand-vector resolution. -/
+inductive ResolvedAtomsList (target : Array RVal) :
+    List Atom → List RVal → Prop where
+  | nil : ResolvedAtomsList target [] []
+  | cons : Eval.resolveAtom target atom = .ok value →
+      ResolvedAtomsList target atoms values →
+      ResolvedAtomsList target (atom :: atoms) (value :: values)
+
+def ResolvedAtoms (target : Array RVal) (atoms : Array Atom)
+    (values : Array RVal) : Prop :=
+  ResolvedAtomsList target atoms.toList values.toList
+
+private theorem resolveFold_rel {target : Array RVal} :
+    ∀ (atoms : List Atom) (accumulator output : Array RVal),
+      List.foldlM
+          (fun values atom => do
+            return values.push (← Eval.resolveAtom target atom))
+          accumulator atoms = .ok output →
+      ∃ values, ResolvedAtomsList target atoms values ∧
+        output = accumulator ++ values.toArray := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro accumulator output resolved
+      simp only [List.foldlM_nil] at resolved
+      change Except.ok accumulator = Except.ok output at resolved
+      have outputEqual : accumulator = output := Except.ok.inj resolved
+      subst output
+      exact ⟨[], .nil, by simp⟩
+  | cons atom atoms ih =>
+      intro accumulator output resolved
+      simp only [List.foldlM_cons] at resolved
+      obtain ⟨nextAccumulator, headResolved, tailResolved⟩ :=
+        except_bind_eq_ok resolved
+      obtain ⟨value, atomResolved, pushed⟩ :=
+        except_bind_eq_ok headResolved
+      have nextEqual : nextAccumulator = accumulator.push value := by
+        simpa using Except.ok.inj pushed.symm
+      subst nextAccumulator
+      obtain ⟨values, valuesResolved, outputEqual⟩ :=
+        ih (accumulator.push value) output tailResolved
+      refine ⟨value :: values, .cons atomResolved valuesResolved, ?_⟩
+      rw [outputEqual]
+      apply Array.ext'
+      simp
+
+/-- `resolveAtoms` retains the exact input/output order pointwise. -/
+theorem resolvedAtoms_of_resolveAtoms {target : Array RVal}
+    {atoms : Array Atom} {values : Array RVal}
+    (resolved : Eval.resolveAtoms target atoms = .ok values) :
+    ResolvedAtoms target atoms values := by
+  unfold Eval.resolveAtoms at resolved
+  rw [← Array.foldlM_toList] at resolved
+  obtain ⟨resolvedValues, pointwise, outputEqual⟩ :=
+    resolveFold_rel atoms.toList #[] values resolved
+  have valuesEqual : values = resolvedValues.toArray := by
+    simpa using outputEqual
+  subst values
+  simpa [ResolvedAtoms] using pointwise
+
+theorem ResolvedAtomsList.getElem? {target : Array RVal}
+    {atoms : List Atom} {values : List RVal}
+    (relation : ResolvedAtomsList target atoms values)
+    {index : Nat} {atom : Atom} (found : atoms[index]? = some atom) :
+    ∃ value, values[index]? = some value ∧
+      Eval.resolveAtom target atom = .ok value := by
+  induction relation generalizing index atom with
+  | nil => simp at found
+  | @cons headAtom headValue tailAtoms tailValues head tail ih =>
+      cases index with
+      | zero =>
+          have atomEqual : headAtom = atom := by simpa using found
+          subst atom
+          exact ⟨headValue, by simp, head⟩
+      | succ index =>
+          obtain ⟨value, valueAt, resolved⟩ := ih (by simpa using found)
+          exact ⟨value, by simpa using valueAt, resolved⟩
+
+private def sourceResolveTargetStep (source : List IxIR1.RVal)
+    (output : List IxIR1.RVal) (atom : IxIR1.Atom) :
+    Except IxIR1.Err (List IxIR1.RVal) := do
+  return output ++ [← IxIR1.resolveAtom source atom]
+
+private theorem resolveSourceFold_of_envRel_target
+    {source : List IxIR1.RVal} {target : Array IxIR1.RVal}
+    {mapping : EnvMap} (relation : EnvRel source target mapping)
+    (sourceCount : source.length = mapping.size) :
+    {sourceAtoms : List IxIR1.Atom} → {targetAtoms : List Atom} →
+      {values : List IxIR1.RVal} →
+      AtomsListRel mapping sourceAtoms targetAtoms →
+      ResolvedAtomsList target targetAtoms values →
+      ∀ accumulator,
+        List.foldlM (sourceResolveTargetStep source) accumulator sourceAtoms =
+          (Except.ok (accumulator ++ values) :
+            Except IxIR1.Err (List IxIR1.RVal)) := by
+  intro sourceAtoms targetAtoms values atoms resolved
+  induction atoms generalizing values with
+  | nil =>
+      cases resolved
+      intro accumulator
+      simp only [List.foldlM_nil, List.append_nil]
+      rfl
+  | @cons sourceAtom targetAtom sourceAtoms targetAtoms translated tail ih =>
+      cases resolved with
+      | @cons _ value _ values targetResolved tailResolved =>
+          intro accumulator
+          have sourceResolved := resolveAtom_of_envRel_target relation
+            sourceCount translated targetResolved
+          simp only [List.foldlM_cons]
+          simp only [sourceResolveTargetStep, sourceResolved]
+          change List.foldlM (sourceResolveTargetStep source)
+              (accumulator ++ [value]) sourceAtoms =
+            .ok (accumulator ++ (value :: values))
+          simpa [List.append_assoc] using
+            ih tailResolved (accumulator ++ [value])
+
+/-- Successful resolution of a translated target operand vector reflects to
+the exact source vector and preserves result order. -/
+theorem resolveAtoms_of_envRel_target {source : List IxIR1.RVal}
+    {target : Array IxIR1.RVal} {mapping : EnvMap}
+    (relation : EnvRel source target mapping)
+    (sourceCount : source.length = mapping.size)
+    {sourceAtoms : Array IxIR1.Atom} {targetAtoms : Array Atom}
+    (atoms : AtomsRel mapping sourceAtoms targetAtoms)
+    {values : Array IxIR1.RVal}
+    (resolved : Eval.resolveAtoms target targetAtoms = .ok values) :
+    IxIR1.resolveAtoms source sourceAtoms = .ok values.toList := by
+  have pointwise := resolvedAtoms_of_resolveAtoms resolved
+  unfold IxIR1.resolveAtoms
+  rw [← Array.foldlM_toList]
+  change List.foldlM (sourceResolveTargetStep source) [] sourceAtoms.toList =
+    .ok values.toList
+  simpa using resolveSourceFold_of_envRel_target relation sourceCount atoms
+    pointwise []
+
+/-- Structural relation emitted by `edgeView`: each live source slot becomes
+the same-position successor register and carries its current target operand;
+dead slots impose no resolution premise. -/
+def EdgeArgsRel (currentMap explicitMap : EnvMap)
+    (arguments : Array Atom) : Prop :=
+  ∀ (index : Nat) (successorAtom : Atom),
+    explicitMap[index]? = some (some successorAtom) →
+    ∃ argument,
+      successorAtom = .reg index ∧
+      currentMap[index]? = some (some argument) ∧
+      arguments[index]? = some argument
+
+/-- The three edge tables derived from one retained predecessor map satisfy
+`EdgeArgsRel` by construction. -/
+theorem EdgeArgsRel.canonical (sourceInputMap : EnvMap) :
+    EdgeArgsRel sourceInputMap
+      (Lower.EdgeTrace.explicitMapOf sourceInputMap)
+      (Lower.EdgeTrace.explicitValuesOf sourceInputMap) := by
+  intro index successorAtom mapped
+  unfold Lower.EdgeTrace.explicitMapOf at mapped
+  rw [Array.getElem?_mapIdx] at mapped
+  cases inputAt : sourceInputMap[index]? with
+  | none => simp [inputAt] at mapped
+  | some slot =>
+      cases slot with
+      | none => simp [inputAt] at mapped
+      | some argument =>
+          have successorEqual : successorAtom = .reg index := by
+            simpa [inputAt] using mapped.symm
+          refine ⟨argument, successorEqual, rfl, ?_⟩
+          unfold Lower.EdgeTrace.explicitValuesOf
+          rw [Array.getElem?_map]
+          simp [inputAt]
+
+/-- Resolving a generated edge's explicit arguments converts the parent
+environment relation into the successor's same-position register relation.
+Consumed slots remain absent and therefore require no source lookup. -/
+theorem EnvRel.of_edge_arguments {source : List RVal}
+    {target values : Array RVal} {currentMap explicitMap : EnvMap}
+    {arguments : Array Atom}
+    (environments : EnvRel source target currentMap)
+    (edgeArguments : EdgeArgsRel currentMap explicitMap arguments)
+    (resolved : Eval.resolveAtoms target arguments = .ok values) :
+    EnvRel source values explicitMap := by
+  have pointwise := resolvedAtoms_of_resolveAtoms resolved
+  intro index value successorAtom sourceAt mapped
+  obtain ⟨argument, successorEqual, currentAt, argumentAt⟩ :=
+    edgeArguments index successorAtom mapped
+  have argumentResolved : Eval.resolveAtom target argument = .ok value :=
+    environments index value argument sourceAt currentAt
+  have argumentAtList : arguments.toList[index]? = some argument := by
+    simpa using argumentAt
+  obtain ⟨resolvedValue, valueAtList, resolvedValueEq⟩ :=
+    pointwise.getElem? argumentAtList
+  have resolvedValueEqual : resolvedValue = value := by
+    rw [argumentResolved] at resolvedValueEq
+    exact (Except.ok.inj resolvedValueEq).symm
+  subst resolvedValue
+  have valueAt : values[index]? = some value := by
+    simpa using valueAtList
+  subst successorAtom
+  simp [Eval.resolveAtom, valueAt]
+
+/-- Parent-facing form of `simulate_traced_edge_transfer`. The compiler need
+only prove the structural `EdgeArgsRel`; actual operand resolution derives the
+explicit successor relation before implicit parameters are prefixed. -/
+theorem simulate_traced_edge_transfer_from_parent
+    {frame : Eval.Frame} {edge : Edge} {trace : Lower.EdgeTrace}
+    {block : Block} {source : List RVal}
+    {currentMap explicitMap : EnvMap}
+    {implicitValues explicitValues : Array RVal}
+    (edgeTarget : edge.target = trace.target)
+    (edgeValues : edge.values = trace.explicitValues)
+    (edgeCredits : edge.credits = #[])
+    (traceMap : trace.sourceMap =
+      Lower.EdgeTrace.sourceMapOf trace.implicitScalars explicitMap)
+    (implicitCount : trace.implicitScalars = implicitValues.size)
+    (environments : EnvRel source frame.values currentMap)
+    (edgeArguments :
+      EdgeArgsRel currentMap explicitMap trace.explicitValues)
+    (resolved : Eval.resolveAtoms frame.values trace.explicitValues =
+      .ok explicitValues)
+    (frameCredits : frame.credits = #[])
+    (blockAt : frame.definition.blocks[trace.target]? = some block)
+    (blockParams : block.valueParams = trace.targetParams)
+    (valueArity : (implicitValues ++ explicitValues).size =
+      trace.targetParams.size)
+    (blockCredits : block.creditParams = #[]) :
+    let target : Eval.Frame :=
+      { frame with
+        block := trace.target
+        pc := 0
+        values := implicitValues ++ explicitValues
+        credits := #[] }
+    Eval.EdgeTransfer frame edge implicitValues target ∧
+      EnvRel (implicitValues.toList ++ source) target.values trace.sourceMap := by
+  apply simulate_traced_edge_transfer edgeTarget edgeValues edgeCredits
+    traceMap implicitCount resolved
+  · exact environments.of_edge_arguments edgeArguments resolved
+  · exact frameCredits
+  · exact blockAt
+  · exact blockParams
+  · exact valueArity
+  · exact blockCredits
+
+/-- Canonical generated-edge hand-off. Both the explicit argument vector and
+the successor source map are computed projections of the trace's retained
+parent map, so the recursive compiler proof supplies only its current
+environment invariant. -/
+theorem simulate_generated_edge_transfer
+    {frame : Eval.Frame} {edge : Edge} {trace : Lower.EdgeTrace}
+    {block : Block} {source : List RVal}
+    {implicitValues explicitValues : Array RVal}
+    (edgeTarget : edge.target = trace.target)
+    (edgeValues : edge.values = trace.explicitValues)
+    (edgeCredits : edge.credits = #[])
+    (implicitCount : trace.implicitScalars = implicitValues.size)
+    (environments : EnvRel source frame.values trace.sourceInputMap)
+    (resolved : Eval.resolveAtoms frame.values trace.explicitValues =
+      .ok explicitValues)
+    (frameCredits : frame.credits = #[])
+    (blockAt : frame.definition.blocks[trace.target]? = some block)
+    (blockParams : block.valueParams = trace.targetParams)
+    (valueArity : (implicitValues ++ explicitValues).size =
+      trace.targetParams.size)
+    (blockCredits : block.creditParams = #[]) :
+    let target : Eval.Frame :=
+      { frame with
+        block := trace.target
+        pc := 0
+        values := implicitValues ++ explicitValues
+        credits := #[] }
+    Eval.EdgeTransfer frame edge implicitValues target ∧
+      EnvRel (implicitValues.toList ++ source) target.values trace.sourceMap := by
+  have edgeArguments : EdgeArgsRel trace.sourceInputMap
+      (Lower.EdgeTrace.explicitMapOf trace.sourceInputMap)
+      trace.explicitValues := by
+    simpa [Lower.EdgeTrace.explicitValues] using
+      EdgeArgsRel.canonical trace.sourceInputMap
+  apply simulate_traced_edge_transfer_from_parent edgeTarget edgeValues
+    edgeCredits (by rfl) implicitCount environments edgeArguments resolved
+      frameCredits blockAt blockParams valueArity blockCredits
+
+/-- Runtime readiness of one generated baseline edge. Operand resolution and
+the implicit/explicit value-count equation are the only dynamic facts not
+already fixed by `EdgeTrace`. -/
+def EdgeRuntimeReady (frame : Eval.Frame) (trace : Lower.EdgeTrace) : Prop :=
+  ∃ values,
+    Eval.resolveAtoms frame.values trace.explicitValues = .ok values ∧
+      trace.implicitScalars + values.size = trace.targetParams.size
+
+private theorem resolveFold_exists_of_pointwise (target : Array RVal) :
+    ∀ (atoms : List Atom) (accumulator : Array RVal),
+      (∀ (index : Nat) (atom : Atom), atoms[index]? = some atom →
+        ∃ value, Eval.resolveAtom target atom = .ok value) →
+      ∃ output,
+        List.foldlM
+            (fun values atom => do
+              return values.push (← Eval.resolveAtom target atom))
+            accumulator atoms = .ok output ∧
+          output.size = accumulator.size + atoms.length
+  | [], accumulator, _ => ⟨accumulator, rfl, by simp⟩
+  | atom :: atoms, accumulator, pointwise => by
+      obtain ⟨value, resolved⟩ := pointwise 0 atom (by rfl)
+      have tailPointwise : ∀ (index : Nat) (tailAtom : Atom),
+          atoms[index]? = some tailAtom →
+            ∃ value, Eval.resolveAtom target tailAtom = .ok value := by
+        intro index tailAtom found
+        exact pointwise (index + 1) tailAtom (by simpa using found)
+      obtain ⟨output, folded, outputSize⟩ :=
+        resolveFold_exists_of_pointwise target atoms
+          (accumulator.push value) tailPointwise
+      refine ⟨output, ?_, ?_⟩
+      · rw [List.foldlM_cons]
+        rw [resolved]
+        exact folded
+      · simp only [Array.size_push, List.length_cons] at outputSize ⊢
+        omega
+
+/-- A finite operand vector resolves whenever each indexed operand does. -/
+theorem resolveAtoms_exists_of_pointwise {target : Array RVal}
+    {atoms : Array Atom}
+    (pointwise : ∀ (index : Nat) (atom : Atom),
+      atoms[index]? = some atom →
+      ∃ value, Eval.resolveAtom target atom = .ok value) :
+    ∃ values,
+      Eval.resolveAtoms target atoms = .ok values ∧
+        values.size = atoms.size := by
+  have listPointwise : ∀ (index : Nat) (atom : Atom),
+      atoms.toList[index]? = some atom →
+      ∃ value, Eval.resolveAtom target atom = .ok value := by
+    intro index atom found
+    exact pointwise index atom (by simpa using found)
+  obtain ⟨values, resolved, valueCount⟩ :=
+    resolveFold_exists_of_pointwise target atoms.toList #[] listPointwise
+  refine ⟨values, ?_, ?_⟩
+  · unfold Eval.resolveAtoms
+    rw [← Array.foldlM_toList]
+    exact resolved
+  · simpa using valueCount
+
+/-- The canonical explicit operand vector of a generated edge is dynamically
+ready whenever its complete source environment is related. The retained edge
+arity equation supplies the implicit-prefix count. -/
+theorem edgeRuntimeReady_of_envRel {source : List RVal}
+    {frame : Eval.Frame} {trace : Lower.EdgeTrace}
+    (environments : EnvRel source frame.values trace.sourceInputMap)
+    (sourceCount : source.length = trace.sourceInputMap.size)
+    (parameterCount : trace.targetParams.size =
+      trace.implicitScalars + trace.sourceInputMap.size) :
+    EdgeRuntimeReady frame trace := by
+  obtain ⟨values, resolved, valueCount⟩ :=
+    resolveAtoms_exists_of_pointwise
+      (target := frame.values) (atoms := trace.explicitValues) (by
+        intro index atom found
+        unfold Lower.EdgeTrace.explicitValues
+          Lower.EdgeTrace.explicitValuesOf at found
+        rw [Array.getElem?_map] at found
+        cases slotAt : trace.sourceInputMap[index]? with
+        | none => simp [slotAt] at found
+        | some slot =>
+            cases slot with
+            | none =>
+                have atomEq : atom = .erased := by
+                  simpa [slotAt] using found.symm
+                subst atom
+                exact ⟨.erased, rfl⟩
+            | some mappedAtom =>
+                have atomEq : atom = mappedAtom := by
+                  simpa [slotAt] using found.symm
+                subst atom
+                have mapBound : index < trace.sourceInputMap.size :=
+                  (Array.getElem?_eq_some_iff.mp slotAt).1
+                have sourceBound : index < source.length := by
+                  rw [sourceCount]
+                  exact mapBound
+                let value := source[index]
+                have sourceAt : source[index]? = some value :=
+                  List.getElem?_eq_some_iff.mpr ⟨sourceBound, rfl⟩
+                exact ⟨value,
+                  environments index value mappedAtom sourceAt slotAt⟩)
+  refine ⟨values, resolved, ?_⟩
+  calc
+    trace.implicitScalars + values.size =
+        trace.implicitScalars + trace.sourceInputMap.size := by
+          rw [valueCount]
+          simp [Lower.EdgeTrace.explicitValues,
+            Lower.EdgeTrace.explicitValuesOf]
+    _ = trace.targetParams.size := parameterCount.symm
+
+private theorem array_eq_empty_of_isEmpty {values : Array α}
+    (empty : values.isEmpty = true) : values = #[] := by
+  apply Array.ext'
+  simpa [Array.isEmpty] using empty
+
+/-- Frame after executing the first `count` generated constructor-field
+fetches. -/
+def fetchPrefixFrame (frame : Eval.Frame) (fields : Array RVal)
+    (count : Nat) : Eval.Frame :=
+  { frame with
+    pc := count
+    values := frame.values ++ fields.extract 0 count }
+
+/-- Internal induction for the constructor fetch prologue. -/
+private theorem simulate_fetch_prologue_from
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {atom : Atom} {cid : CtorId} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid
+      fields.size = true)
+    (resolved : Eval.resolveAtom frame.values atom = .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields) :
+    ∀ (remaining index : Nat), index + remaining = fields.size →
+      Eval.Steps context interpretation remaining
+        { machine with
+          control := .running (fetchPrefixFrame frame fields index) stack }
+        { machine with
+          control := .running (fetchPrefixFrame frame fields fields.size) stack } := by
+  intro remaining
+  induction remaining with
+  | zero =>
+      intro index total
+      have indexEq : index = fields.size := by omega
+      subst index
+      exact .refl _
+  | succ remaining ih =>
+      intro index total
+      have indexBound : index < fields.size := by omega
+      have instructionAt := Lower.fetchPrologueAt_of_match prologue indexBound
+      obtain ⟨pcBound, instruction⟩ :=
+        Array.getElem?_eq_some_iff.mp instructionAt
+      have fieldAt : fields[index]? = some fields[index] :=
+        Array.getElem?_eq_some_iff.mpr ⟨indexBound, rfl⟩
+      have currentResolved :
+          Eval.resolveAtom (fetchPrefixFrame frame fields index).values atom =
+            .ok (.loc location) := by
+        simpa [fetchPrefixFrame] using
+          resolveAtom_append_old
+            (suffix := fields.extract 0 index) resolved
+      have currentBlockAt :
+          (fetchPrefixFrame frame fields index).definition.blocks[(fetchPrefixFrame
+            frame fields index).block]? = some block := by
+        simpa [fetchPrefixFrame] using blockAt
+      have currentPc :
+          (fetchPrefixFrame frame fields index).pc < block.instructions.size := by
+        simpa [fetchPrefixFrame] using pcBound
+      have currentInstruction :
+          block.instructions[(fetchPrefixFrame frame fields index).pc] =
+            .fetch atom cid index := by
+        simpa [fetchPrefixFrame] using instruction
+      have headRaw := Eval.Step.fetch
+        (context := context) (interpretation := interpretation)
+        (machine := { machine with
+          control := .running (fetchPrefixFrame frame fields index) stack })
+        (frame := fetchPrefixFrame frame fields index)
+        (value := fields[index]) rfl currentBlockAt currentPc
+          currentInstruction currentResolved boxAt node fieldAt
+      have extractSucc : fields.extract 0 (index + 1) =
+          (fields.extract 0 index).push fields[index] :=
+        Array.extract_succ_right (by omega) indexBound
+      have nextFrame :
+          { fetchPrefixFrame frame fields index with
+            pc := (fetchPrefixFrame frame fields index).pc + 1
+            values := (fetchPrefixFrame frame fields index).values.push
+              fields[index] } =
+            fetchPrefixFrame frame fields (index + 1) := by
+        cases frame
+        unfold fetchPrefixFrame
+        rw [extractSucc, Array.push_append]
+      have head : Eval.Step context interpretation
+          { machine with
+            control := .running (fetchPrefixFrame frame fields index) stack }
+          { machine with
+            control := .running (fetchPrefixFrame frame fields (index + 1)) stack } := by
+        rw [nextFrame] at headRaw
+        exact headRaw
+      have tail := ih (index + 1) (by omega)
+      exact .cons rfl head tail
+
+/-- Execute a complete certified constructor fetch prologue. The target takes
+exactly one control step per field and ends with all fields appended in source
+constructor order. -/
+theorem simulate_fetch_prologue
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {atom : Atom} {cid : CtorId} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (startPc : frame.pc = 0)
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid
+      fields.size = true)
+    (resolved : Eval.resolveAtom frame.values atom = .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields) :
+    let finalFrame : Eval.Frame :=
+      { frame with
+        pc := fields.size
+        values := frame.values ++ fields }
+    Eval.Steps context interpretation fields.size machine
+      { machine with control := .running finalFrame stack } := by
+  dsimp only
+  have steps := simulate_fetch_prologue_from
+    (context := context) (interpretation := interpretation)
+    (stack := stack)
+    blockAt prologue resolved boxAt node fields.size 0 (by simp)
+  have startFrame : fetchPrefixFrame frame fields 0 = frame := by
+    cases frame
+    simp_all [fetchPrefixFrame]
+  have startMachine :
+      { machine with control := .running frame stack } = machine := by
+    cases machine
+    simp_all
+  rw [startFrame, startMachine] at steps
+  simpa [fetchPrefixFrame] using steps
+
+/-- A certified constructor switch, generated edge transfer, and exact field
+fetch prologue compose into the recursive constructor child's `CodeStateRel`.
+The result also retains the parent runtime facts, exact edge-entry frame, and
+certified child prologue needed by downstream rewrite-aware simulation. The
+only non-trace premises are the runtime node, source alternative selected by
+that node, and its field arity. Generated-edge operand readiness follows from
+the complete source environment invariant. -/
+theorem simulate_traced_switch_ctor_state
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal}
+    (state : CodeStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child)
+    (control : machine.control = .running frame stack)
+    (frameCredits : frame.credits = #[]) :
+    ∃ finalFrame edgeFrame childScrutinee,
+      child.source = site.alternative alternativeIndex ∧
+        child.sourceCode = body ∧
+        Eval.Steps context interpretation (1 + fields.size) machine
+          { machine with control := .running finalFrame stack } ∧
+        (∀ heapFuel,
+          Eval.Steps context interpretation (1 + fields.size)
+            { machine with heapFuel }
+            { { machine with control := .running finalFrame stack } with
+              heapFuel }) ∧
+        finalFrame.credits = #[] ∧
+        StoreRel sourceStore machine.store ∧
+        CodeStateRel functionTrace child
+          (fields.toList.reverse ++ source) finalFrame ∧
+        frame.definition.blocks[frame.block]? = some generated ∧
+        frame.pc = generated.instructions.size ∧
+        Eval.resolveAtom frame.values targetScrutinee =
+          .ok (.loc location) ∧
+        machine.store.get? location = some box ∧
+        Eval.EdgeTransfer frame target.edge #[] edgeFrame ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running edgeFrame stack } ∧
+        edgeFrame.definition.blocks[edgeFrame.block]? =
+          some child.headBlock.2 ∧
+        edgeFrame.pc = 0 ∧
+        Eval.resolveAtom edgeFrame.values childScrutinee =
+          .ok (.loc location) ∧
+        Lower.fetchPrologueMatches child.headBlock.2.instructions
+          childScrutinee cid fields.size = true ∧
+        finalFrame = { edgeFrame with
+          pc := fields.size
+          values := edgeFrame.values ++ fields } := by
+  have recursiveMatched :=
+    functionTrace.descendantSwitchBranchesMatch descendant
+  have localMatched :=
+    Lower.CodeTrace.switchNodeBranchesMatch_of_match recursiveMatched
+  have branch := Lower.constructorBranchMatchAt_of_switch_match
+    localMatched terminator targetAt edgeAt childAt
+  have targetCid : target.cid = cid := by
+    have matched : (target.cid == cid) = true := Array.find?_some
+      (p := fun candidate : CtorAlt => candidate.cid == cid)
+      (a := target) (xs := constructors) targetAlternative
+    exact beq_iff_eq.mp matched
+  have branchAlternative := branch.sourceAlternative
+  rw [targetCid, sourceAlternative] at branchAlternative
+  have alternativeEqual := Option.some.inj branchAlternative
+  have sourceTag : branch.tag = tag := by
+    exact (congrArg (fun alternative : IxIR1.Alt × Nat =>
+      match alternative.1 with | .mk tag _ _ => tag) alternativeEqual).symm
+  have sourceFieldCount : branch.fieldCount = fieldCount := by
+    exact (congrArg (fun alternative : IxIR1.Alt × Nat =>
+      match alternative.1 with | .mk _ fields _ => fields) alternativeEqual).symm
+  have sourceBody : branch.body = body := by
+    exact (congrArg (fun alternative : IxIR1.Alt × Nat =>
+      match alternative.1 with | .mk _ _ body => body) alternativeEqual).symm
+  have sourceAlternativeIndex : branch.alternativeIndex = alternativeIndex :=
+    (congrArg Prod.snd alternativeEqual).symm
+  have edgeMember : edge ∈ outgoing := List.mem_of_getElem? edgeAt
+  have childMember : child ∈ children := List.mem_of_getElem? childAt
+  have childDescendant : functionTrace.root.Descendant child :=
+    .step descendant childMember
+  have ready : EdgeRuntimeReady frame edge :=
+    edgeRuntimeReady_of_envRel
+      (by simpa [Lower.CodeTrace.sourceInputMap, branch.edgeSourceInput]
+        using state.environments)
+      (by simpa [Lower.CodeTrace.sourceInputMap, branch.edgeSourceInput]
+        using state.sourceCount)
+      branch.edgeParameterCount
+  obtain ⟨explicitValues, edgeResolved, edgeArity⟩ := ready
+  let edgeFrame : Eval.Frame :=
+    { frame with
+      block := edge.target
+      pc := 0
+      values := #[] ++ explicitValues
+      credits := #[] }
+  let finalFrame : Eval.Frame :=
+    { edgeFrame with
+      pc := fields.size
+      values := edgeFrame.values ++ fields }
+  have edgeCredits : target.edge.credits = #[] :=
+    array_eq_empty_of_isEmpty branch.edgeCredits
+  have blockCredits : child.headBlock.2.creditParams = #[] :=
+    array_eq_empty_of_isEmpty branch.childCredits
+  have childBlockAt :
+      frame.definition.blocks[edge.target]? = some child.headBlock.2 := by
+    have found := functionTrace.descendantHeadBlockAt childDescendant
+    rw [state.definition]
+    simpa [branch.childHeadBlock] using found
+  have parentEnvironments : EnvRel source frame.values edge.sourceInputMap := by
+    have current : EnvRel source frame.values input := by
+      simpa [Lower.CodeTrace.sourceInputMap] using state.environments
+    simpa [branch.edgeSourceInput] using current
+  have valueArity : (#[] ++ explicitValues).size = edge.targetParams.size := by
+    simpa [branch.edgeImplicitScalars] using edgeArity
+  obtain ⟨transferred, edgeEnvironments⟩ :=
+    simulate_generated_edge_transfer branch.edgeTarget.symm branch.edgeValues
+      edgeCredits (by simpa using branch.edgeImplicitScalars)
+      parentEnvironments edgeResolved frameCredits childBlockAt
+      branch.childParams valueArity blockCredits
+  have parentBlockAt :
+      frame.definition.blocks[frame.block]? = some generated := by
+    simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+  have parentPc : frame.pc = generated.instructions.size := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨_, _, translated, _⟩ :=
+    Lower.CodeTrace.switchSyntax_of_match syntaxMatched
+  have targetResolved : Eval.resolveAtom frame.values targetScrutinee =
+      .ok (.loc location) :=
+    resolveAtom_of_envRel state.environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have switchStep : Eval.Step context interpretation machine
+      { machine with control := .running edgeFrame stack } := by
+    apply Eval.Step.switchCtor control parentBlockAt parentPc terminator
+      targetResolved targetGet node targetAlternative
+    simpa [edgeFrame] using transferred
+  have explicitEnvironments : EnvRel source edgeFrame.values
+      (Lower.EdgeTrace.explicitMapOf edge.sourceInputMap) := by
+    have sourceMapZero : edge.sourceMap =
+        Lower.EdgeTrace.explicitMapOf edge.sourceInputMap := by
+      unfold Lower.EdgeTrace.sourceMap
+      rw [branch.edgeImplicitScalars]
+      exact sourceMapOf_zero _
+    rw [sourceMapZero] at edgeEnvironments
+    simpa [edgeFrame] using edgeEnvironments
+  have childTranslated :
+      Lower.InputMap.translateAtom
+        (Lower.EdgeTrace.explicitMapOf edge.sourceInputMap) sourceScrutinee =
+          some branch.childScrutinee := by
+    simpa [branch.edgeSourceInput] using branch.translatedScrutinee
+  have childResolved : Eval.resolveAtom edgeFrame.values
+      branch.childScrutinee = .ok (.loc location) :=
+    resolveAtom_of_envRel explicitEnvironments childTranslated sourceResolved
+  have prologue : Lower.fetchPrologueMatches child.headBlock.2.instructions
+      branch.childScrutinee cid fields.size = true := by
+    simpa [targetCid, sourceFieldCount, fieldArity] using branch.fetchPrologue
+  have prologueSteps : Eval.Steps context interpretation fields.size
+      { machine with control := .running edgeFrame stack }
+      { machine with control := .running finalFrame stack } := by
+    apply simulate_fetch_prologue
+      (machine := { machine with control := .running edgeFrame stack })
+      (frame := edgeFrame) (stack := stack) rfl
+      (show edgeFrame.definition.blocks[edgeFrame.block]? =
+        some child.headBlock.2 by simpa [edgeFrame] using childBlockAt)
+      (by rfl) prologue childResolved targetGet node
+  have targetSteps : Eval.Steps context interpretation (1 + fields.size)
+      machine { machine with control := .running finalFrame stack } :=
+    (switchStep.toSteps control).trans prologueSteps
+  have targetStepsPreserving : ∀ heapFuel,
+      Eval.Steps context interpretation (1 + fields.size)
+        { machine with heapFuel }
+        { { machine with control := .running finalFrame stack } with
+          heapFuel } := by
+    intro heapFuel
+    let fundedMachine : Eval.Machine := { machine with heapFuel }
+    have fundedControl : fundedMachine.control = .running frame stack := by
+      simpa [fundedMachine] using control
+    have fundedGet : fundedMachine.store.get? location = some box := by
+      simpa [fundedMachine] using targetGet
+    have fundedSwitch : Eval.Step context interpretation fundedMachine
+        { fundedMachine with control := .running edgeFrame stack } := by
+      apply Eval.Step.switchCtor fundedControl parentBlockAt parentPc terminator
+        targetResolved fundedGet node targetAlternative
+      simpa [edgeFrame] using transferred
+    have fundedPrologue : Eval.Steps context interpretation fields.size
+        { fundedMachine with control := .running edgeFrame stack }
+        { fundedMachine with control := .running finalFrame stack } := by
+      apply simulate_fetch_prologue
+        (machine := { fundedMachine with
+          control := .running edgeFrame stack })
+        (frame := edgeFrame) (stack := stack) rfl
+        (show edgeFrame.definition.blocks[edgeFrame.block]? =
+          some child.headBlock.2 by simpa [edgeFrame] using childBlockAt)
+        (by rfl) prologue childResolved fundedGet node
+    have fundedSteps := (fundedSwitch.toSteps fundedControl).trans
+      fundedPrologue
+    simpa [fundedMachine] using fundedSteps
+  have finalEnvironments : EnvRel (fields.toList.reverse ++ source)
+      finalFrame.values child.sourceInputMap := by
+    have extended := explicitEnvironments.constructorFields (fields := fields)
+    have edgeValueCount : edgeFrame.values.size = edge.targetParams.size := by
+      simpa [edgeFrame] using valueArity
+    simpa [finalFrame, branch.childInput, edgeValueCount, sourceFieldCount,
+      fieldArity] using extended
+  have explicitValueCount : explicitValues.size = edge.targetParams.size := by
+    simpa using valueArity
+  have childState : CodeStateRel functionTrace child
+      (fields.toList.reverse ++ source) finalFrame := by
+    constructor
+    · simpa [finalFrame, edgeFrame] using state.definition
+    · simpa [finalFrame, edgeFrame] using branch.childBlock.symm
+    · simpa [finalFrame, sourceFieldCount, fieldArity] using branch.childPc.symm
+    · calc
+        finalFrame.values.size = edge.targetParams.size + fields.size := by
+          simp [finalFrame, edgeFrame, explicitValueCount]
+        _ = edge.targetParams.size + branch.fieldCount := by
+          rw [sourceFieldCount, fieldArity]
+        _ = child.entryValueCount := branch.childValueCount.symm
+    · rw [branch.childInput]
+      have currentCount : source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using state.sourceCount
+      simp [Lower.constructorChildInputMap, fieldArity,
+        Lower.EdgeTrace.explicitMapOf, sourceFieldCount,
+        branch.edgeSourceInput, currentCount]
+    · exact finalEnvironments
+  exact ⟨finalFrame, edgeFrame, branch.childScrutinee,
+    branch.childSource.trans
+      (congrArg (fun index => site.alternative index)
+        sourceAlternativeIndex),
+    branch.childCode.trans sourceBody,
+    targetSteps, targetStepsPreserving, rfl, stores, childState,
+    parentBlockAt, parentPc, targetResolved, targetGet, transferred, switchStep,
+    by simpa [edgeFrame] using childBlockAt, rfl, childResolved, prologue, rfl⟩
+
+/-- A certified literal-zero switch step enters the exact recursive child
+state. All branch/edge/body coordinates, generated-edge operand readiness,
+and the successor proof map follow from the retained trace invariant. -/
+theorem simulate_traced_switch_nat_zero_state
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    {source : List RVal}
+    (state : CodeStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children) source frame)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat 0)))
+    (control : machine.control = .running frame stack)
+    (frameCredits : frame.credits = #[]) :
+    ∃ (constructors : Array CtorAlt) (peel : NatPeel)
+        (branches : Lower.NatBranchPairMatch site blockId input alternatives
+          constructors peel outgoing children) (childFrame : Eval.Frame),
+      generated.terminator =
+          .switchValue targetScrutinee constructors (some peel) ∧
+        branches.zeroEdge ∈ outgoing ∧
+        branches.zeroChild ∈ children ∧
+        Lower.sourceAlternativeAtTag? alternatives 0 =
+          some (.mk 0 0 branches.zero.body,
+            branches.zero.alternativeIndex) ∧
+        branches.zeroChild.source =
+          site.alternative branches.zero.alternativeIndex ∧
+        branches.zeroChild.sourceCode = branches.zero.body ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running childFrame stack } ∧
+        (∀ heapFuel,
+          Eval.Step context interpretation { machine with heapFuel }
+            { { machine with control := .running childFrame stack } with
+              heapFuel }) ∧
+        childFrame.credits = #[] ∧
+        CodeStateRel functionTrace branches.zeroChild source childFrame := by
+  have recursiveMatched :=
+    functionTrace.descendantSwitchBranchesMatch descendant
+  have localMatched :=
+    Lower.CodeTrace.switchNodeBranchesMatch_of_match recursiveMatched
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨constructors, natPeel, translated, terminator⟩ :=
+    Lower.CodeTrace.switchSyntax_of_match syntaxMatched
+  cases natPeel with
+  | none =>
+      simp [Lower.switchNodeBranchesMatch, terminator] at localMatched
+  | some peel =>
+      let branches := Lower.natBranchPairMatch_of_switch_match
+        localMatched terminator
+      have edgeMember : branches.zeroEdge ∈ outgoing :=
+        List.mem_of_getElem? branches.zeroEdgeAt
+      have childMember : branches.zeroChild ∈ children :=
+        List.mem_of_getElem? branches.zeroChildAt
+      have childDescendant :
+          functionTrace.root.Descendant branches.zeroChild :=
+        .step descendant childMember
+      have ready : EdgeRuntimeReady frame branches.zeroEdge :=
+        edgeRuntimeReady_of_envRel
+          (by simpa [Lower.CodeTrace.sourceInputMap,
+              branches.zero.edgeSourceInput] using state.environments)
+          (by simpa [Lower.CodeTrace.sourceInputMap,
+              branches.zero.edgeSourceInput] using state.sourceCount)
+          branches.zero.edgeParameterCount
+      obtain ⟨explicitValues, edgeResolved, edgeArity⟩ := ready
+      let childFrame : Eval.Frame :=
+        { frame with
+          block := branches.zeroEdge.target
+          pc := 0
+          values := #[] ++ explicitValues
+          credits := #[] }
+      have edgeCredits : peel.zero.credits = #[] :=
+        array_eq_empty_of_isEmpty branches.zero.edgeCredits
+      have blockCredits :
+          branches.zeroChild.headBlock.2.creditParams = #[] :=
+        array_eq_empty_of_isEmpty branches.zero.childCredits
+      have childBlockAt :
+          frame.definition.blocks[branches.zeroEdge.target]? =
+            some branches.zeroChild.headBlock.2 := by
+        have found := functionTrace.descendantHeadBlockAt childDescendant
+        rw [state.definition]
+        simpa [branches.zero.childHeadBlock] using found
+      have parentEnvironments : EnvRel source frame.values
+          branches.zeroEdge.sourceInputMap := by
+        have current : EnvRel source frame.values input := by
+          simpa [Lower.CodeTrace.sourceInputMap] using state.environments
+        simpa [branches.zero.edgeSourceInput] using current
+      have valueArity : (#[] ++ explicitValues).size =
+          branches.zeroEdge.targetParams.size := by
+        simpa [branches.zero.edgeImplicitScalars] using edgeArity
+      obtain ⟨transferred, childEnvironments⟩ :=
+        simulate_generated_edge_transfer
+          branches.zero.edgeTarget.symm branches.zero.edgeValues edgeCredits
+          (by simpa using branches.zero.edgeImplicitScalars)
+          parentEnvironments edgeResolved frameCredits childBlockAt
+          branches.zero.childParams valueArity blockCredits
+      have parentBlockAt :
+          frame.definition.blocks[frame.block]? = some generated := by
+        simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+      have parentPc : frame.pc = generated.instructions.size := by
+        simpa [Lower.CodeTrace.entryPc] using state.pc
+      have targetResolved : Eval.resolveAtom frame.values targetScrutinee =
+          .ok (.lit (.nat 0)) :=
+        resolveAtom_of_envRel state.environments translated sourceResolved
+      have targetStep : Eval.Step context interpretation machine
+          { machine with control := .running childFrame stack } := by
+        apply Eval.Step.switchNatZero control parentBlockAt parentPc terminator
+          targetResolved
+        simpa [childFrame] using transferred
+      have targetStepPreserving : ∀ heapFuel,
+          Eval.Step context interpretation { machine with heapFuel }
+            { { machine with control := .running childFrame stack } with
+              heapFuel } := by
+        intro heapFuel
+        let fundedMachine : Eval.Machine := { machine with heapFuel }
+        have fundedControl : fundedMachine.control =
+            .running frame stack := by
+          simpa [fundedMachine] using control
+        have fundedStep : Eval.Step context interpretation fundedMachine
+            { fundedMachine with control := .running childFrame stack } := by
+          apply Eval.Step.switchNatZero fundedControl parentBlockAt parentPc
+            terminator targetResolved
+          simpa [childFrame] using transferred
+        simpa [fundedMachine] using fundedStep
+      have childState : CodeStateRel functionTrace branches.zeroChild source
+          childFrame := by
+        constructor
+        · simpa [childFrame] using state.definition
+        · simpa [childFrame] using branches.zero.childBlock.symm
+        · simpa [childFrame] using branches.zero.childPc.symm
+        · calc
+            childFrame.values.size = branches.zeroEdge.targetParams.size := by
+              simpa [childFrame] using valueArity
+            _ = branches.zeroChild.entryValueCount :=
+              branches.zero.childValueCount.symm
+        · rw [branches.zero.childInput]
+          simpa [Lower.EdgeTrace.sourceMap, Lower.EdgeTrace.sourceMapOf,
+            Lower.EdgeTrace.explicitMapOf,
+            branches.zero.edgeImplicitScalars,
+            branches.zero.edgeSourceInput, Lower.CodeTrace.sourceInputMap]
+            using state.sourceCount
+        · simpa [childFrame, branches.zero.childInput] using
+            childEnvironments
+      exact ⟨constructors, peel, branches, childFrame, terminator, edgeMember,
+        childMember, branches.zero.sourceAlternative,
+        branches.zero.childSource, branches.zero.childCode, targetStep,
+        targetStepPreserving, rfl, childState⟩
+
+/-- A certified literal-successor switch step preserves the peeled
+predecessor as the child environment's implicit leading scalar and enters the
+exact recursive child state. -/
+theorem simulate_traced_switch_nat_succ_state
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    {source : List RVal} {predecessor : Nat}
+    (state : CodeStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children) source frame)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (control : machine.control = .running frame stack)
+    (frameCredits : frame.credits = #[]) :
+    ∃ (constructors : Array CtorAlt) (peel : NatPeel)
+        (branches : Lower.NatBranchPairMatch site blockId input alternatives
+          constructors peel outgoing children) (childFrame : Eval.Frame),
+      generated.terminator =
+          .switchValue targetScrutinee constructors (some peel) ∧
+        branches.succEdge ∈ outgoing ∧
+        branches.succChild ∈ children ∧
+        Lower.sourceAlternativeAtTag? alternatives 1 =
+          some (.mk 1 1 branches.succ.body,
+            branches.succ.alternativeIndex) ∧
+        branches.succChild.source =
+          site.alternative branches.succ.alternativeIndex ∧
+        branches.succChild.sourceCode = branches.succ.body ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running childFrame stack } ∧
+        (∀ heapFuel,
+          Eval.Step context interpretation { machine with heapFuel }
+            { { machine with control := .running childFrame stack } with
+              heapFuel }) ∧
+        childFrame.credits = #[] ∧
+        CodeStateRel functionTrace branches.succChild
+          (.lit (.nat predecessor) :: source) childFrame := by
+  have recursiveMatched :=
+    functionTrace.descendantSwitchBranchesMatch descendant
+  have localMatched :=
+    Lower.CodeTrace.switchNodeBranchesMatch_of_match recursiveMatched
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨constructors, natPeel, translated, terminator⟩ :=
+    Lower.CodeTrace.switchSyntax_of_match syntaxMatched
+  cases natPeel with
+  | none =>
+      simp [Lower.switchNodeBranchesMatch, terminator] at localMatched
+  | some peel =>
+      let branches := Lower.natBranchPairMatch_of_switch_match
+        localMatched terminator
+      have edgeMember : branches.succEdge ∈ outgoing :=
+        List.mem_of_getElem? branches.succEdgeAt
+      have childMember : branches.succChild ∈ children :=
+        List.mem_of_getElem? branches.succChildAt
+      have childDescendant :
+          functionTrace.root.Descendant branches.succChild :=
+        .step descendant childMember
+      have ready : EdgeRuntimeReady frame branches.succEdge :=
+        edgeRuntimeReady_of_envRel
+          (by simpa [Lower.CodeTrace.sourceInputMap,
+              branches.succ.edgeSourceInput] using state.environments)
+          (by simpa [Lower.CodeTrace.sourceInputMap,
+              branches.succ.edgeSourceInput] using state.sourceCount)
+          branches.succ.edgeParameterCount
+      obtain ⟨explicitValues, edgeResolved, edgeArity⟩ := ready
+      let implicitValues : Array RVal := #[.lit (.nat predecessor)]
+      let childFrame : Eval.Frame :=
+        { frame with
+          block := branches.succEdge.target
+          pc := 0
+          values := implicitValues ++ explicitValues
+          credits := #[] }
+      have edgeCredits : peel.succ.credits = #[] :=
+        array_eq_empty_of_isEmpty branches.succ.edgeCredits
+      have blockCredits :
+          branches.succChild.headBlock.2.creditParams = #[] :=
+        array_eq_empty_of_isEmpty branches.succ.childCredits
+      have childBlockAt :
+          frame.definition.blocks[branches.succEdge.target]? =
+            some branches.succChild.headBlock.2 := by
+        have found := functionTrace.descendantHeadBlockAt childDescendant
+        rw [state.definition]
+        simpa [branches.succ.childHeadBlock] using found
+      have parentEnvironments : EnvRel source frame.values
+          branches.succEdge.sourceInputMap := by
+        have current : EnvRel source frame.values input := by
+          simpa [Lower.CodeTrace.sourceInputMap] using state.environments
+        simpa [branches.succ.edgeSourceInput] using current
+      have valueArity : (implicitValues ++ explicitValues).size =
+          branches.succEdge.targetParams.size := by
+        simpa [implicitValues, branches.succ.edgeImplicitScalars] using
+          edgeArity
+      obtain ⟨transferred, childEnvironments⟩ :=
+        simulate_generated_edge_transfer
+          branches.succ.edgeTarget.symm branches.succ.edgeValues edgeCredits
+          (by simpa [implicitValues] using branches.succ.edgeImplicitScalars)
+          parentEnvironments edgeResolved frameCredits childBlockAt
+          branches.succ.childParams valueArity blockCredits
+      have parentBlockAt :
+          frame.definition.blocks[frame.block]? = some generated := by
+        simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+      have parentPc : frame.pc = generated.instructions.size := by
+        simpa [Lower.CodeTrace.entryPc] using state.pc
+      have targetResolved : Eval.resolveAtom frame.values targetScrutinee =
+          .ok (.lit (.nat (predecessor + 1))) :=
+        resolveAtom_of_envRel state.environments translated sourceResolved
+      have targetStep : Eval.Step context interpretation machine
+          { machine with control := .running childFrame stack } := by
+        apply Eval.Step.switchNatSucc control parentBlockAt parentPc terminator
+          targetResolved
+        simpa [childFrame, implicitValues] using transferred
+      have targetStepPreserving : ∀ heapFuel,
+          Eval.Step context interpretation { machine with heapFuel }
+            { { machine with control := .running childFrame stack } with
+              heapFuel } := by
+        intro heapFuel
+        let fundedMachine : Eval.Machine := { machine with heapFuel }
+        have fundedControl : fundedMachine.control =
+            .running frame stack := by
+          simpa [fundedMachine] using control
+        have fundedStep : Eval.Step context interpretation fundedMachine
+            { fundedMachine with control := .running childFrame stack } := by
+          apply Eval.Step.switchNatSucc fundedControl parentBlockAt parentPc
+            terminator targetResolved
+          simpa [childFrame, implicitValues] using transferred
+        simpa [fundedMachine] using fundedStep
+      have childState : CodeStateRel functionTrace branches.succChild
+          (.lit (.nat predecessor) :: source) childFrame := by
+        constructor
+        · simpa [childFrame] using state.definition
+        · simpa [childFrame] using branches.succ.childBlock.symm
+        · simpa [childFrame] using branches.succ.childPc.symm
+        · calc
+            childFrame.values.size = branches.succEdge.targetParams.size := by
+              simpa [childFrame] using valueArity
+            _ = branches.succChild.entryValueCount :=
+              branches.succ.childValueCount.symm
+        · rw [branches.succ.childInput]
+          have currentCount : source.length = input.size := by
+            simpa [Lower.CodeTrace.sourceInputMap] using state.sourceCount
+          simp [Lower.EdgeTrace.sourceMap, Lower.EdgeTrace.sourceMapOf,
+            Lower.EdgeTrace.explicitMapOf,
+            branches.succ.edgeImplicitScalars,
+            branches.succ.edgeSourceInput, currentCount, Nat.add_comm]
+        · simpa [childFrame, implicitValues, branches.succ.childInput] using
+            childEnvironments
+      exact ⟨constructors, peel, branches, childFrame, terminator, edgeMember,
+        childMember, branches.succ.sourceAlternative,
+        branches.succ.childSource, branches.succ.childCode, targetStep,
+        targetStepPreserving, rfl, childState⟩
+
+private theorem resolveFold_of_envRel {source : List RVal}
+    {target : Array RVal} {mapping : EnvMap}
+    (relation : EnvRel source target mapping)
+    {sourceAtoms : List IxIR1.Atom} {targetAtoms : List Atom}
+    (atoms : AtomsListRel mapping sourceAtoms targetAtoms) :
+    ∀ (accumulator output : List RVal),
+      List.foldlM
+          (fun values atom => do
+            return values ++ [← IxIR1.resolveAtom source atom])
+          accumulator sourceAtoms = .ok output →
+      List.foldlM
+          (fun values atom => do
+            return values.push (← Eval.resolveAtom target atom))
+          accumulator.toArray targetAtoms = .ok output.toArray := by
+  induction atoms with
+  | nil =>
+      intro accumulator output resolved
+      simp only [List.foldlM_nil] at resolved ⊢
+      cases resolved
+      rfl
+  | @cons sourceAtom targetAtom sourceAtoms targetAtoms translated _ ih =>
+      intro accumulator output resolved
+      simp only [List.foldlM_cons] at resolved ⊢
+      obtain ⟨nextAccumulator, headResolved, tailResolved⟩ :=
+        except_bind_eq_ok resolved
+      obtain ⟨value, sourceResolved, nextResolved⟩ :=
+        except_bind_eq_ok headResolved
+      have nextEqual : nextAccumulator = accumulator ++ [value] := by
+        simpa using Except.ok.inj nextResolved.symm
+      subst nextAccumulator
+      have targetResolved :
+          Eval.resolveAtom target targetAtom = .ok value :=
+        resolveAtom_of_envRel relation translated sourceResolved
+      rw [targetResolved]
+      have appendArray :
+          (accumulator ++ [value]).toArray = accumulator.toArray.push value := by
+        apply Array.ext'
+        simp
+      change List.foldlM
+          (fun values atom => do
+            return values.push (← Eval.resolveAtom target atom))
+          (accumulator.toArray.push value) targetAtoms = .ok output.toArray
+      rw [← appendArray]
+      exact ih (accumulator ++ [value]) output tailResolved
+
+/-- Operand-vector resolution agrees pointwise, including result order. -/
+theorem resolveAtoms_of_envRel {source : List RVal} {target : Array RVal}
+    {mapping : EnvMap} (relation : EnvRel source target mapping)
+    {sourceAtoms : Array IxIR1.Atom} {targetAtoms : Array Atom}
+    (atoms : AtomsRel mapping sourceAtoms targetAtoms)
+    {values : List RVal}
+    (resolved : IxIR1.resolveAtoms source sourceAtoms = .ok values) :
+    Eval.resolveAtoms target targetAtoms = .ok values.toArray := by
+  unfold Eval.resolveAtoms
+  rw [← Array.foldlM_toList]
+  apply resolveFold_of_envRel relation atoms [] values
+  simpa only [IxIR1.resolveAtoms, Array.foldlM_toList] using resolved
+
+/-- Ordinary allocation is the first heap-changing instruction case. The
+source and target allocate the same constructor at the same fresh location
+under either interpretation, preserve the exact baseline store relation, and
+bind related result slots. -/
+theorem simulate_alloc {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {world : Ix.Compiler.Ixon.Owned} {cid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {schema : CtorSchema}
+    {values : List RVal}
+    (arguments : AtomsRel mapping sourceArguments targetArguments)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (fields : Eval.FieldWorlds machine.store schema values.toArray)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .alloc world cid targetArguments)
+    (schemaAt : context.schemas world cid = some schema) :
+    let node := IxIR1.Node.ctorN cid values.toArray
+    let sourceAllocation := sourceStore.allocNode world node
+    let targetAllocation := machine.store.allocNode world node
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.alloc world cid sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc sourceAllocation.2) }
+            stack } ∧
+      StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      EnvRel (.loc sourceAllocation.2 :: source)
+        (frame.values.push (.loc sourceAllocation.2))
+        (#[some (.reg frame.values.size)] ++ mapping) := by
+  dsimp only
+  have targetResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel environments arguments sourceResolved
+  have locationEq :
+      (machine.store.allocNode world (.ctorN cid values.toArray)).2 =
+        (sourceStore.allocNode world (.ctorN cid values.toArray)).2 :=
+    stores.alloc_location world (.ctorN cid values.toArray)
+  have targetStep := Eval.Step.alloc (interpretation := interpretation)
+    control blockAt pc instruction schemaAt targetResolved fields
+  dsimp only at targetStep
+  rw [locationEq] at targetStep
+  refine ⟨?_, targetStep,
+    stores.alloc world (.ctorN cid values.toArray), ?_⟩
+  · unfold IxIR1.runOp
+    simp only
+    rw [sourceResolved]
+    rfl
+  · exact environments.bindValue
+      (.loc (sourceStore.allocNode world (.ctorN cid values.toArray)).2)
+
+/-- Trace-facing allocation transition. Checked operation syntax supplies the
+world, constructor, and target operand vector; recursive-state helpers supply
+the instruction coordinate and exact continuation state. -/
+theorem simulate_traced_alloc_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceWorld targetWorld : Ix.Compiler.Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {schema : CtorSchema} {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (fields : Eval.FieldWorlds machine.store schema values.toArray)
+    (control : machine.control = .running frame stack)
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema) :
+    let node := IxIR1.Node.ctorN sourceCid values.toArray
+    let sourceAllocation := sourceStore.allocNode sourceWorld node
+    let targetAllocation := machine.store.allocNode sourceWorld node
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc sourceAllocation.2) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.alloc sourceWorld sourceCid sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running nextFrame stack } ∧
+      StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      CodeStateRel functionTrace next
+        (.loc sourceAllocation.2 :: source) nextFrame := by
+  dsimp only
+  have operationSyntax := functionTrace.descendantOperationSyntax descendant
+  change sourceWorld = targetWorld ∧ sourceCid = targetCid ∧
+    Lower.InputMap.translateAtoms input sourceArguments =
+      some targetArguments at operationSyntax
+  obtain ⟨worldEq, cidEq, translated⟩ := operationSyntax
+  subst targetWorld
+  subst targetCid
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms translated
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .alloc sourceWorld sourceCid targetArguments :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ := simulate_alloc
+    stores state.environments arguments sourceResolved fields control blockAt
+      pcBound instruction schemaAt
+  have nextEnvironments := canonical.forgetTracedValue state descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.alloc sourceWorld sourceCid targetArguments) =
+        some (.reg entryValueCount) by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- Checked-artifact allocation transition. The retained schema and producer
+capability certificates select the dynamic source ownership invariant, so
+recursive simulation callers supply neither a target-only `FieldWorlds`
+witness nor an allocation-shaped root list. -/
+theorem simulate_traced_alloc_checked_state
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {checked : Lower.Checked} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    (contextSchemas : context.schemas =
+      checked.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceWorld targetWorld : Ix.Compiler.Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {schema : CtorSchema} {values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (control : machine.control = .running frame stack)
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema)
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frameRoots) :
+    let node := IxIR1.Node.ctorN sourceCid values.toArray
+    let sourceAllocation := sourceStore.allocNode sourceWorld node
+    let targetAllocation := machine.store.allocNode sourceWorld node
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc sourceAllocation.2) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.alloc sourceWorld sourceCid sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running nextFrame stack } ∧
+      StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      CodeStateRel functionTrace next
+        (.loc sourceAllocation.2 :: source) nextFrame := by
+  have checkedSchemaAt : checked.artifact.validationContext.schemas
+      sourceWorld sourceCid = some schema := by
+    rw [← contextSchemas]
+    exact schemaAt
+  have fields := stores.fieldWorlds_of_checked_allocation_capabilities
+    functionMember descendant ownership sourceResolved checkedSchemaAt
+  exact simulate_traced_alloc_state descendant state stores sourceResolved
+    fields control schemaAt
+
+/-- Successful-run form of checked ordinary allocation. Source evaluation
+determines the field vector and exact fresh location; the checked schema,
+producer capabilities, and trace-indexed ownership invariant discharge
+`FieldWorlds`. -/
+theorem simulate_traced_alloc_checked_success_step
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {checked : Lower.Checked} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈ checked.artifact.trace.functions)
+    (contextSchemas : context.schemas =
+      checked.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceWorld targetWorld : Ix.Compiler.Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput : IxIR1.Store × RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      sourceCurrent sourceStore source
+        (.letOp (.alloc sourceWorld sourceCid sourceArguments)
+          next.sourceCode) = .ok sourceOutput)
+    (control : machine.control = .running frame stack)
+    {schema : CtorSchema}
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema)
+    (ownership : SourceOwnershipAt checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frameRoots) :
+    ∃ values sourceAllocation targetAllocation nextFrame,
+      sourceAllocation = sourceStore.allocNode sourceWorld
+          (.ctorN sourceCid values.toArray) ∧
+        targetAllocation = machine.store.allocNode sourceWorld
+          (.ctorN sourceCid values.toArray) ∧
+        IxIR1.resolveAtoms source sourceArguments = .ok values ∧
+        IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent
+          sourceAllocation.1 (.loc sourceAllocation.2 :: source)
+          next.sourceCode = .ok sourceOutput ∧
+        nextFrame =
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push (.loc sourceAllocation.2) } ∧
+        Eval.Step context .logical machine
+          { machine with
+            store := targetAllocation.1
+            control := .running nextFrame stack } ∧
+        StoreRel sourceAllocation.1 targetAllocation.1 ∧
+        CodeStateRel functionTrace next
+          (.loc sourceAllocation.2 :: source) nextFrame := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨values, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_alloc_success operationRun
+  have middleStoreEq : middleStore =
+      (sourceStore.allocNode sourceWorld
+        (.ctorN sourceCid values.toArray)).1 :=
+    congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue =
+      .loc (sourceStore.allocNode sourceWorld
+        (.ctorN sourceCid values.toArray)).2 :=
+    congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+    simulate_traced_alloc_checked_state
+      (sourceContext := sourceContext) (sourceCurrent := sourceCurrent)
+      (sourceFuel := sourceFuel) functionMember contextSchemas descendant state
+      stores sourceResolved control schemaAt ownership
+  exact ⟨values,
+    sourceStore.allocNode sourceWorld (.ctorN sourceCid values.toArray),
+    machine.store.allocNode sourceWorld (.ctorN sourceCid values.toArray),
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push
+        (.loc (sourceStore.allocNode sourceWorld
+          (.ctorN sourceCid values.toArray)).2) },
+    rfl, rfl, sourceResolved, continuationRun, rfl, targetStep, nextStores,
+    nextState⟩
+
+/-- Strictly under-saturated partial application allocates the same shared PAP
+node in IxIR₁ and IxIR₂.  The declaration premises are the function-level
+context correspondence that the later whole-program induction will supply. -/
+theorem simulate_papp_fn {sourceContext : IxIR1.Ctx}
+    {sourceCurrent sourceDefinition : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {targetDefinition : Function}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {values : List RVal}
+    (arguments : AtomsRel mapping sourceArguments targetArguments)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (arity :
+      targetDefinition.signature.params.size = sourceDefinition.arity)
+    (papSafe : targetDefinition.signature.papSafe = true)
+    (under : values.length < sourceDefinition.arity)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .papp address targetArguments) :
+    let node := IxIR1.Node.papN address sourceDefinition.arity values.toArray
+    let sourceAllocation := sourceStore.allocNode .shared node
+    let targetAllocation := machine.store.allocNode .shared node
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.papp address sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc sourceAllocation.2) }
+            stack } ∧
+      StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      EnvRel (.loc sourceAllocation.2 :: source)
+        (frame.values.push (.loc sourceAllocation.2))
+        (#[some (.reg frame.values.size)] ++ mapping) := by
+  dsimp only
+  have targetResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel environments arguments sourceResolved
+  have targetUnder :
+      values.toArray.size < targetDefinition.signature.params.size := by
+    simpa [arity] using under
+  have targetStep := Eval.Step.pappFn (interpretation := interpretation)
+    control blockAt pc instruction noCredits targetDeclaration papSafe
+    targetResolved targetUnder
+  rw [arity] at targetStep
+  dsimp only at targetStep
+  have locationEq :
+      (machine.store.allocNode .shared
+        (.papN address sourceDefinition.arity values.toArray)).2 =
+      (sourceStore.allocNode .shared
+        (.papN address sourceDefinition.arity values.toArray)).2 :=
+    stores.alloc_location .shared
+      (.papN address sourceDefinition.arity values.toArray)
+  rw [locationEq] at targetStep
+  refine ⟨?_, targetStep,
+    stores.alloc .shared
+      (.papN address sourceDefinition.arity values.toArray),
+    environments.bindValue
+      (.loc (sourceStore.allocNode .shared
+        (.papN address sourceDefinition.arity values.toArray)).2)⟩
+  unfold IxIR1.runOp
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [sourceDeclaration]
+  unfold IxIR1.declArity
+  simp only
+  rw [if_pos under]
+
+/-- Trace-facing function partial application. Address/argument syntax,
+instruction coordinates, successor map, and recursive state are all recovered
+from the checked derivation. -/
+theorem simulate_traced_papp_fn_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent sourceDefinition : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {targetDefinition : Function}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAddress targetAddress : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceDeclaration :
+      sourceContext.decls sourceAddress = some (.fn sourceDefinition))
+    (targetDeclaration :
+      context.declarations sourceAddress = some (.fn targetDefinition))
+    (arity : targetDefinition.signature.params.size = sourceDefinition.arity)
+    (papSafe : targetDefinition.signature.papSafe = true)
+    (under : values.length < sourceDefinition.arity)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let node := IxIR1.Node.papN sourceAddress sourceDefinition.arity
+      values.toArray
+    let sourceAllocation := sourceStore.allocNode .shared node
+    let targetAllocation := machine.store.allocNode .shared node
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc sourceAllocation.2) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.papp sourceAddress sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running nextFrame stack } ∧
+      StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      CodeStateRel functionTrace next
+        (.loc sourceAllocation.2 :: source) nextFrame := by
+  dsimp only
+  have operationSyntax := functionTrace.descendantOperationSyntax descendant
+  change sourceAddress = targetAddress ∧
+    Lower.InputMap.translateAtoms input sourceArguments =
+      some targetArguments at operationSyntax
+  obtain ⟨addressEq, translated⟩ := operationSyntax
+  subst targetAddress
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms translated
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .papp sourceAddress targetArguments :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  obtain ⟨sourceRun, targetStep, nextStores, canonical⟩ := simulate_papp_fn
+    stores state.environments arguments sourceResolved sourceDeclaration
+      targetDeclaration arity papSafe under noCredits control blockAt pcBound
+      instruction
+  have nextEnvironments := canonical.forgetTracedValue state descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.papp sourceAddress targetArguments) = some (.reg entryValueCount) by rfl)
+  refine ⟨sourceRun, targetStep, nextStores,
+    state.letOpNext descendant rfl rfl rfl ?_ rfl nextEnvironments⟩
+  simp [Lower.Instr.baselineValueDelta]
+
+/-- One captured PAP value is retained identically by the IxIR₁ and IxIR₂
+heap primitives. -/
+private theorem dupVals_single_simulates_retainShared
+    {sourceStore sourceOut : IxIR1.Store}
+    {targetStore : Eval.Store} {value : RVal}
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRun : IxIR1.dupVals sourceStore [value] = .ok sourceOut) :
+    ∃ targetOut,
+      Eval.retainShared targetStore value = .ok targetOut ∧
+        StoreRel sourceOut targetOut := by
+  cases value with
+  | lit literal =>
+      simp [IxIR1.dupVals] at sourceRun
+      subst sourceOut
+      exact ⟨targetStore, by simp [Eval.retainShared], stores⟩
+  | erased =>
+      simp [IxIR1.dupVals] at sourceRun
+      subst sourceOut
+      exact ⟨targetStore, by simp [Eval.retainShared], stores⟩
+  | loc location =>
+      cases sourceGet : sourceStore.get? location with
+      | none => simp [IxIR1.dupVals, sourceGet] at sourceRun
+      | some box =>
+          cases box with
+          | mk world rc node =>
+              cases world with
+              | unique => simp [IxIR1.dupVals, sourceGet] at sourceRun
+              | shared =>
+                  have targetGet : targetStore.get? location =
+                      some ⟨.shared, rc, node⟩ := by
+                    unfold Eval.Store.get?
+                    rw [stores.heap]
+                    exact sourceGet
+                  have sourceEq :
+                      sourceOut =
+                        (sourceStore.setBox location
+                          ⟨.shared, rc + 1, node⟩).rcTick := by
+                    simpa [IxIR1.dupVals, sourceGet] using sourceRun.symm
+                  subst sourceOut
+                  refine ⟨(targetStore.setBox location
+                    ⟨.shared, rc + 1, node⟩).rcTick, ?_,
+                    (stores.setBox location
+                      ⟨.shared, rc + 1, node⟩).rcTick⟩
+                  simp [Eval.retainShared, targetGet]
+
+private theorem dupVals_cons_ok_inv {store store' : IxIR1.Store}
+    {head : RVal} {tail : List RVal}
+    (run : IxIR1.dupVals store (head :: tail) = .ok store') :
+    ∃ middle,
+      IxIR1.dupVals store [head] = .ok middle ∧
+        IxIR1.dupVals middle tail = .ok store' := by
+  rw [show head :: tail = [head] ++ tail by rfl, IxIR1.dupVals,
+    List.foldlM_append] at run
+  change (IxIR1.dupVals store [head] >>= fun middle =>
+    IxIR1.dupVals middle tail) = .ok store' at run
+  cases middleRun : IxIR1.dupVals store [head] with
+  | error error =>
+      rw [middleRun] at run
+      simp only [bind, Except.bind] at run
+      contradiction
+  | ok middle =>
+      refine ⟨middle, rfl, ?_⟩
+      rw [middleRun] at run
+      simp only [bind, Except.bind] at run
+      exact run
+
+/-- IxIR₁'s PAP-capture duplication loop and IxIR₂'s retain loop produce
+exactly related stores for the same ordered value vector. -/
+theorem dupVals_simulates_retainSharedMany
+    {sourceStore sourceOut : IxIR1.Store}
+    {targetStore : Eval.Store} (values : List RVal)
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRun : IxIR1.dupVals sourceStore values = .ok sourceOut) :
+    ∃ targetOut,
+      Eval.RetainSharedMany targetStore values.toArray targetOut ∧
+        StoreRel sourceOut targetOut := by
+  induction values generalizing sourceStore targetStore with
+  | nil =>
+      change (.ok sourceStore : Except IxIR1.Err IxIR1.Store) =
+        .ok sourceOut at sourceRun
+      injection sourceRun with sourceEq
+      subst sourceOut
+      exact ⟨targetStore, Eval.RetainSharedMany.empty targetStore, stores⟩
+  | cons value values ih =>
+      obtain ⟨sourceMiddle, sourceFirst, sourceRest⟩ :=
+        dupVals_cons_ok_inv sourceRun
+      obtain ⟨targetMiddle, targetFirst, middleStores⟩ :=
+        dupVals_single_simulates_retainShared stores sourceFirst
+      obtain ⟨targetOut, targetRest, outStores⟩ :=
+        ih middleStores sourceRest
+      exact ⟨targetOut,
+        Eval.RetainSharedMany.cons targetFirst targetRest, outStores⟩
+
+private theorem PositiveSharedRC.dupValsSingle
+    {store out : IxIR1.Store} {value : RVal}
+    (positive : PositiveSharedRC store)
+    (run : IxIR1.dupVals store [value] = .ok out) :
+    PositiveSharedRC out := by
+  cases value with
+  | lit literal =>
+      simp [IxIR1.dupVals] at run
+      subst out
+      exact positive
+  | erased =>
+      simp [IxIR1.dupVals] at run
+      subst out
+      exact positive
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [IxIR1.dupVals, found] at run
+      | some box =>
+          cases box with
+          | mk world rc node =>
+              cases world with
+              | unique => simp [IxIR1.dupVals, found] at run
+              | shared =>
+                  have outEq : out =
+                      (store.setBox location
+                        ⟨.shared, rc + 1, node⟩).rcTick := by
+                    simpa [IxIR1.dupVals, found] using run.symm
+                  subst out
+                  have updated : PositiveSharedRC
+                      (store.setBox location
+                        ⟨.shared, rc + 1, node⟩) := by
+                    intro other otherBox otherFound otherShared
+                    exact positive.setRc
+                      (location := location)
+                      (box := (⟨.shared, rc, node⟩ : IxIR1.NodeBox))
+                      (newRC := rc + 1) found (Nat.zero_lt_succ rc)
+                      otherFound otherShared
+                  intro other otherBox otherFound otherShared
+                  exact PositiveSharedRC.rcTick updated otherFound otherShared
+
+/-- Retaining a finite PAP capture preserves positive refcounts for every
+live shared node. -/
+theorem PositiveSharedRC.dupVals {store out : IxIR1.Store}
+    (positive : PositiveSharedRC store) (values : List RVal)
+    (run : IxIR1.dupVals store values = .ok out) :
+    PositiveSharedRC out := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except IxIR1.Err IxIR1.Store) = .ok out at run
+      injection run with equal
+      subst out
+      exact positive
+  | cons value values ih =>
+      obtain ⟨middle, first, rest⟩ := dupVals_cons_ok_inv run
+      exact ih (positive.dupValsSingle first) rest
+
+/-- The heap preparation common to every shared-PAP application branch.
+IxIR₁'s ordered capture duplication and consuming PAP drop determine an exact
+IxIR₂ retain loop, sufficient heap budget, release result, and both
+intermediate store relations. -/
+theorem simulate_apply_pap_prepare
+    {sourceContext : IxIR1.Ctx} {sourceFuel location : Nat}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {captured : Array RVal}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased) :
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased := by
+  obtain ⟨targetRetained, targetRetain, retainedStores⟩ :=
+    dupVals_simulates_retainSharedMany captured.toList stores sourceRetain
+  have targetRetain' :
+      Eval.RetainSharedMany targetStore captured targetRetained := by
+    simpa using targetRetain
+  have retainedPositive : PositiveSharedRC sourceRetained := by
+    intro retainedLocation retainedBox retainedGet retainedShared
+    exact positive.dupVals captured.toList sourceRetain retainedGet
+      retainedShared
+  obtain ⟨targetHeapFuel, targetReleased, targetRelease, releasedStores,
+      _⟩ :=
+    dropVal_simulates_releaseSharedWork retainedPositive retainedStores
+      sourceRelease
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain',
+    retainedStores, targetRelease, releasedStores⟩
+
+/-- Direct simulation of the erased `applyGo` branch used after an
+`applyMore` return.  Releasing the residual source arguments determines an
+exact target release budget and immediate erased resumption. -/
+theorem simulate_applyGo_erased
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {sourceStore sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (positive : PositiveSharedRC sourceStore)
+    (stores : StoreRel sourceStore targetStore)
+    (sourceRelease : IxIR1.dropMany sourceContext sourceFuel sourceStore
+      values = .ok sourceReleased) :
+    ∃ (targetHeapFuel : Nat) (targetReleased : Eval.Store),
+      IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore .erased values =
+          .ok (sourceReleased, .erased) ∧
+        Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+          .erased values.toArray resume stack
+          { store := targetReleased
+            heapFuel := 0
+            control := .running
+              { resume with values := resume.values.push .erased } stack } ∧
+        StoreRel sourceReleased targetReleased ∧
+        PositiveSharedRC sourceReleased := by
+  obtain ⟨targetHeapFuel, targetReleased, targetRelease, releasedStores,
+      releasedPositive⟩ :=
+    dropMany_simulates_releaseSharedWork positive stores sourceRelease
+  have transferred := Eval.ApplyTransfer.erased
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack) (by simpa using targetRelease)
+  refine ⟨targetHeapFuel, targetReleased, ?_, transferred, releasedStores,
+    releasedPositive⟩
+  rw [IxIR1.applyGo.eq_def]
+  dsimp only
+  rw [sourceRelease]
+  rfl
+
+/-- Direct simulation of the under-saturated PAP `applyGo` branch.  This is
+the return-time counterpart of `simulate_apply_pap_under`: it starts from an
+already resolved function value and residual value list, as supplied by an
+`applyMore` continuation. -/
+theorem simulate_applyGo_pap_under
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity) :
+    let pap := IxIR1.Node.papN address arity (captured ++ values.toArray)
+    let sourceAllocation := sourceReleased.allocNode .shared pap
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        let targetAllocation := targetReleased.allocNode .shared pap
+        IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore
+            (.loc location) values =
+            .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+          Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+            (.loc location) values.toArray resume stack
+            { store := targetAllocation.1
+              heapFuel := 0
+              control := .running
+                { resume with
+                  values := resume.values.push (.loc sourceAllocation.2) }
+                stack } ∧
+          StoreRel sourceAllocation.1 targetAllocation.1 := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores⟩ :=
+    simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have targetGet : targetStore.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetUnder : (captured ++ values.toArray).size < arity := by
+    simpa using totalUnder
+  have transferred := Eval.ApplyTransfer.papUnder
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack) targetGet shared node capturedUnder
+      targetRetain targetRelease targetUnder
+  let pap := IxIR1.Node.papN address arity (captured ++ values.toArray)
+  let sourceAllocation := sourceReleased.allocNode .shared pap
+  let targetAllocation := targetReleased.allocNode .shared pap
+  have locationEq : targetAllocation.2 = sourceAllocation.2 := by
+    exact releasedStores.alloc_location .shared pap
+  dsimp only at transferred
+  dsimp only [targetAllocation, sourceAllocation, pap] at locationEq
+  rw [locationEq] at transferred
+  have sourceRun :
+      IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore
+          (.loc location) values =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) := by
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceRetain]
+    simp only [bind, Except.bind]
+    rw [sourceRelease]
+    simp only
+    rw [if_pos totalUnder]
+    have payloadEq :
+        (captured.toList ++ values).toArray = captured ++ values.toArray := by
+      apply Array.toList_inj.mp
+      simp
+    rw [payloadEq]
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun,
+    by simpa [targetAllocation, sourceAllocation, pap] using transferred,
+    releasedStores.alloc .shared pap⟩
+
+/-- Direct exact-saturation simulation for a resolved `applyGo`.  It enters
+the matched callee under an ordinary resume continuation and exposes the
+literal source invocation equation used by recursive `applyMore` simulation. -/
+theorem simulate_applyGo_pap_saturated_enter
+    {sourceContext : IxIR1.Ctx} {sourceDefinition : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {targetDefinition : Function} {calleeTrace : Lower.FunctionTrace}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array RVal} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let targetTotal := captured ++ values.toArray
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetTotal }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore
+            (.loc location) values =
+          IxIR1.invoke sourceContext sourceFuel address sourceTotal
+            sourceReleased ∧
+        Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+          (.loc location) values.toArray resume stack
+          { store := targetReleased
+            heapFuel := 0
+            control := .running calleeFrame (.resume resume :: stack) } ∧
+        CodeStateRel calleeTrace calleeTrace.root sourceTotal.reverse
+          calleeFrame := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores⟩ :=
+    simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have targetGet : targetStore.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  let sourceTotal := captured.toList ++ values
+  let targetTotal := captured ++ values.toArray
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have targetSize : targetTotal.size = arity := by
+    simpa [sourceTotal, targetTotal] using totalExact
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedEq : targetTotal.extract 0 arity = targetTotal := by
+    rw [← targetSize]
+    exact Array.extract_size
+  have suppliedArity :
+      (targetTotal.extract 0 arity).size =
+        targetDefinition.signature.params.size := by
+    rw [suppliedEq, targetSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have transferred := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack) targetGet shared node capturedUnder
+      targetRetain targetRelease
+      (by simpa [targetTotal] using Nat.le_of_eq targetSize.symm)
+      targetDeclaration targetPapSafe suppliedArity targetNonempty
+  dsimp only at transferred
+  have remainingEmpty :
+      (targetTotal.extract arity targetTotal.size).isEmpty = true := by
+    simp [Array.isEmpty, Array.size_extract]
+    omega
+  rw [suppliedEq, remainingEmpty] at transferred
+  simp only [if_true] at transferred
+  have sourceRun :
+      IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore
+          (.loc location) values =
+        IxIR1.invoke sourceContext sourceFuel address sourceTotal
+          sourceReleased := by
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceRetain]
+    simp only [bind, Except.bind]
+    rw [sourceRelease]
+    simp only
+    rw [if_neg (by omega)]
+    rw [if_pos (beq_iff_eq.mpr (by
+      simpa [sourceTotal] using totalExact))]
+    rw [sourceDeclaration]
+    simp [IxIR1.declPapSafe, sourcePapSafe, sourceTotal]
+  have entryArity : targetTotal.size = calleeTrace.source.arity := by
+    calc
+      targetTotal.size = arity := targetSize
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := functionEntryCodeState calleeTrace targetTotal entryArity
+  have sourceEnvironment : targetTotal.toList.reverse = sourceTotal.reverse := by
+    rw [← totalArrayEq]
+  rw [sourceEnvironment] at calleeState
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun,
+    by simpa [targetTotal] using transferred,
+    by simpa [calleeMatch.generated, sourceTotal, targetTotal] using calleeState⟩
+
+/-- Direct over-saturation simulation for a resolved `applyGo`.  It enters
+the first matched callee under a new `applyMore` continuation and proves that
+the retained target suffix is exactly the source residual argument list. -/
+theorem simulate_applyGo_pap_over_enter
+    {sourceContext : IxIR1.Ctx} {sourceDefinition : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {targetDefinition : Function} {calleeTrace : Lower.FunctionTrace}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array RVal} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let sourceSupplied := sourceTotal.take arity
+    let sourceRemaining := sourceTotal.drop arity
+    let targetTotal := captured ++ values.toArray
+    let targetSupplied := targetTotal.extract 0 arity
+    let targetRemaining := targetTotal.extract arity targetTotal.size
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetSupplied }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore
+            (.loc location) values =
+          (do
+            let (nextStore, result) ←
+              IxIR1.invoke sourceContext sourceFuel address sourceSupplied
+                sourceReleased
+            IxIR1.applyGo sourceContext sourceFuel nextStore result
+              sourceRemaining) ∧
+        Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+          (.loc location) values.toArray resume stack
+          { store := targetReleased
+            heapFuel := 0
+            control := .running calleeFrame
+              (.applyMore targetRemaining resume :: stack) } ∧
+        targetRemaining.toList = sourceRemaining ∧
+        CodeStateRel calleeTrace calleeTrace.root sourceSupplied.reverse
+          calleeFrame := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores⟩ :=
+    simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have targetGet : targetStore.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let sourceRemaining := sourceTotal.drop arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  let targetRemaining := targetTotal.extract arity targetTotal.size
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have suppliedArrayEq : targetSupplied = sourceSupplied.toArray := by
+    calc
+      targetSupplied = targetTotal.take arity := Array.take_eq_extract.symm
+      _ = sourceTotal.toArray.take arity := by rw [totalArrayEq]
+      _ = sourceSupplied.toArray := List.take_toArray
+  have remainingArrayEq : targetRemaining = sourceRemaining.toArray := by
+    calc
+      targetRemaining = targetTotal.extract arity := rfl
+      _ = sourceTotal.toArray.extract arity := by rw [totalArrayEq]
+      _ = sourceRemaining.toArray := List.toArray_drop.symm
+  have remainingListEq : targetRemaining.toList = sourceRemaining := by
+    rw [remainingArrayEq]
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have suppliedArity :
+      targetSupplied.size = targetDefinition.signature.params.size := by
+    rw [suppliedSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have transferred := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack) targetGet shared node capturedUnder
+      targetRetain targetRelease (Nat.le_of_lt targetOver) targetDeclaration
+      targetPapSafe suppliedArity targetNonempty
+  dsimp only at transferred
+  have remainingNonempty : targetRemaining.isEmpty = false := by
+    simp [Array.isEmpty, targetRemaining, Array.size_extract]
+    omega
+  rw [remainingNonempty] at transferred
+  have sourceRun :
+      IxIR1.applyGo sourceContext (sourceFuel + 1) sourceStore
+          (.loc location) values =
+        (do
+          let (nextStore, result) ←
+            IxIR1.invoke sourceContext sourceFuel address sourceSupplied
+              sourceReleased
+          IxIR1.applyGo sourceContext sourceFuel nextStore result
+            sourceRemaining) := by
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceRetain]
+    simp only [bind, Except.bind]
+    rw [sourceRelease]
+    simp only
+    rw [if_neg (by omega)]
+    rw [if_neg (by
+      intro exactGuard
+      have exactEq := beq_iff_eq.mp exactGuard
+      omega)]
+    rw [sourceDeclaration]
+    simp [IxIR1.declPapSafe, sourcePapSafe, sourceTotal, sourceSupplied,
+      sourceRemaining]
+  have entryArity : targetSupplied.size = calleeTrace.source.arity := by
+    calc
+      targetSupplied.size = arity := suppliedSize
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := functionEntryCodeState calleeTrace targetSupplied
+    entryArity
+  have sourceEnvironment :
+      targetSupplied.toList.reverse = sourceSupplied.reverse := by
+    rw [suppliedArrayEq]
+  rw [sourceEnvironment] at calleeState
+  have calleeState' : CodeStateRel calleeTrace calleeTrace.root
+      sourceSupplied.reverse
+      { definition := targetDefinition, values := targetSupplied } := by
+    simpa only [calleeMatch.generated] using calleeState
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun,
+    by simpa [targetTotal, targetSupplied, targetRemaining] using transferred,
+    remainingListEq, calleeState'⟩
+
+/-- The under-saturated dynamic-application branch is simulated without an
+opaque target heap witness.  IxIR₁'s capture duplication and PAP release
+derive the exact IxIR₂ retain/release work, after which both sides allocate
+the same longer PAP at the same fresh location. -/
+theorem simulate_apply_pap_under
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {source : List RVal}
+    {sourceFunction : IxIR1.Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity) :
+    let pap := IxIR1.Node.papN address arity (captured ++ values.toArray)
+    let sourceAllocation := sourceReleased.allocNode .shared pap
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        let targetAllocation := targetReleased.allocNode .shared pap
+        IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+            source (.apply sourceFunction sourceArguments) =
+            .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+          Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+            (.loc location) values.toArray resume stack
+            { store := targetAllocation.1
+              heapFuel := 0
+              control := .running
+                { resume with
+                  values := resume.values.push (.loc sourceAllocation.2) }
+                stack } ∧
+          StoreRel sourceAllocation.1 targetAllocation.1 := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain',
+      retainedStores, targetRelease, releasedStores⟩ :=
+    simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have targetGet : targetStore.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetUnder : (captured ++ values.toArray).size < arity := by
+    simpa using totalUnder
+  have transferred := Eval.ApplyTransfer.papUnder
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack)
+    targetGet shared node capturedUnder targetRetain' targetRelease targetUnder
+  let pap := IxIR1.Node.papN address arity (captured ++ values.toArray)
+  let sourceAllocation := sourceReleased.allocNode .shared pap
+  let targetAllocation := targetReleased.allocNode .shared pap
+  have locationEq : targetAllocation.2 = sourceAllocation.2 := by
+    exact releasedStores.alloc_location .shared pap
+  dsimp only at transferred
+  dsimp only [targetAllocation, sourceAllocation, pap] at locationEq
+  rw [locationEq] at transferred
+  have sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+          source (.apply sourceFunction sourceArguments) =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) := by
+    rw [IxIR1.runOp.eq_def]
+    dsimp only
+    rw [functionResolved]
+    simp only [bind, Except.bind]
+    rw [argumentsResolved]
+    simp only
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceRetain]
+    simp only [bind, Except.bind]
+    rw [sourceRelease]
+    simp only
+    rw [if_pos totalUnder]
+    have payloadEq :
+        (captured.toList ++ values).toArray = captured ++ values.toArray := by
+      apply Array.toList_inj.mp
+      simp
+    rw [payloadEq]
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain',
+    retainedStores, targetRelease, releasedStores, sourceRun,
+    by simpa [targetAllocation, sourceAllocation, pap] using transferred,
+    releasedStores.alloc .shared pap⟩
+
+/-- Exact saturation exposes the literal IxIR₁ invocation equation while the
+IxIR₂ dispatcher enters the matched callee root under an ordinary resume
+continuation.  PAP capture retains and the consuming old-PAP release are
+derived from the source heap operations rather than supplied as target
+witnesses. -/
+theorem simulate_apply_pap_saturated_enter
+    {sourceContext : IxIR1.Ctx}
+    {sourceCurrent sourceDefinition : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {targetDefinition : Function} {calleeTrace : Lower.FunctionTrace}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {source : List RVal}
+    {sourceFunction : IxIR1.Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array RVal} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let targetTotal := captured ++ values.toArray
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetTotal }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+            source (.apply sourceFunction sourceArguments) =
+          IxIR1.invoke sourceContext sourceFuel address sourceTotal
+            sourceReleased ∧
+        Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+          (.loc location) values.toArray resume stack
+          { store := targetReleased
+            heapFuel := 0
+            control := .running calleeFrame (.resume resume :: stack) } ∧
+        CodeStateRel calleeTrace calleeTrace.root sourceTotal.reverse
+          calleeFrame := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores⟩ :=
+    simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have targetGet : targetStore.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  let sourceTotal := captured.toList ++ values
+  let targetTotal := captured ++ values.toArray
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have targetSize : targetTotal.size = arity := by
+    simpa [sourceTotal, targetTotal] using totalExact
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedEq : targetTotal.extract 0 arity = targetTotal := by
+    rw [← targetSize]
+    exact Array.extract_size
+  have suppliedArity :
+      (targetTotal.extract 0 arity).size =
+        targetDefinition.signature.params.size := by
+    rw [suppliedEq, targetSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have transferred := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack)
+    targetGet shared node capturedUnder targetRetain targetRelease
+      (by simpa [targetTotal] using Nat.le_of_eq targetSize.symm)
+      targetDeclaration targetPapSafe suppliedArity
+      targetNonempty
+  dsimp only at transferred
+  have remainingEmpty :
+      (targetTotal.extract arity targetTotal.size).isEmpty = true := by
+    simp [Array.isEmpty, Array.size_extract]
+    omega
+  rw [suppliedEq, remainingEmpty] at transferred
+  simp only [if_true] at transferred
+  have sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+          source (.apply sourceFunction sourceArguments) =
+        IxIR1.invoke sourceContext sourceFuel address sourceTotal
+          sourceReleased := by
+    rw [IxIR1.runOp.eq_def]
+    dsimp only
+    rw [functionResolved]
+    simp only [bind, Except.bind]
+    rw [argumentsResolved]
+    simp only
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceRetain]
+    simp only [bind, Except.bind]
+    rw [sourceRelease]
+    simp only
+    rw [if_neg (by omega)]
+    rw [if_pos (beq_iff_eq.mpr (by simpa [sourceTotal] using totalExact))]
+    rw [sourceDeclaration]
+    simp [IxIR1.declPapSafe, sourcePapSafe, sourceTotal]
+  have entryArity : targetTotal.size = calleeTrace.source.arity := by
+    calc
+      targetTotal.size = arity := targetSize
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := functionEntryCodeState calleeTrace targetTotal entryArity
+  have sourceEnvironment : targetTotal.toList.reverse = sourceTotal.reverse := by
+    rw [← totalArrayEq]
+  rw [sourceEnvironment] at calleeState
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun,
+    by simpa [targetTotal] using transferred,
+    by simpa [calleeMatch.generated, sourceTotal, targetTotal] using calleeState⟩
+
+/-- Over-application exposes the IxIR₁ invoke-then-apply equation and enters
+the same matched target callee under an explicit `applyMore` continuation.
+The residual target vector is proved to be exactly the source `drop` suffix,
+which is the induction hand-off when the callee later returns. -/
+theorem simulate_apply_pap_over_enter
+    {sourceContext : IxIR1.Ctx}
+    {sourceCurrent sourceDefinition : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {targetDefinition : Function} {calleeTrace : Lower.FunctionTrace}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {targetStore : Eval.Store} {source : List RVal}
+    {sourceFunction : IxIR1.Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array RVal} {values : List RVal}
+    {resume : Eval.Frame} {stack : List Eval.Continuation}
+    (stores : StoreRel sourceStore targetStore)
+    (positive : PositiveSharedRC sourceStore)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let sourceSupplied := sourceTotal.take arity
+    let sourceRemaining := sourceTotal.drop arity
+    let targetTotal := captured ++ values.toArray
+    let targetSupplied := targetTotal.extract 0 arity
+    let targetRemaining := targetTotal.extract arity targetTotal.size
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetSupplied }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany targetStore captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+            source (.apply sourceFunction sourceArguments) =
+          (do
+            let (nextStore, result) ←
+              IxIR1.invoke sourceContext sourceFuel address sourceSupplied
+                sourceReleased
+            IxIR1.applyGo sourceContext sourceFuel nextStore result
+              sourceRemaining) ∧
+        Eval.ApplyTransfer context interpretation targetStore targetHeapFuel
+          (.loc location) values.toArray resume stack
+          { store := targetReleased
+            heapFuel := 0
+            control := .running calleeFrame
+              (.applyMore targetRemaining resume :: stack) } ∧
+        targetRemaining.toList = sourceRemaining ∧
+        CodeStateRel calleeTrace calleeTrace.root sourceSupplied.reverse
+          calleeFrame := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores⟩ :=
+    simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have targetGet : targetStore.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let sourceRemaining := sourceTotal.drop arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  let targetRemaining := targetTotal.extract arity targetTotal.size
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have suppliedArrayEq : targetSupplied = sourceSupplied.toArray := by
+    calc
+      targetSupplied = targetTotal.take arity := Array.take_eq_extract.symm
+      _ = sourceTotal.toArray.take arity := by rw [totalArrayEq]
+      _ = sourceSupplied.toArray := List.take_toArray
+  have remainingArrayEq : targetRemaining = sourceRemaining.toArray := by
+    calc
+      targetRemaining = targetTotal.extract arity := rfl
+      _ = sourceTotal.toArray.extract arity := by rw [totalArrayEq]
+      _ = sourceRemaining.toArray := List.toArray_drop.symm
+  have remainingListEq : targetRemaining.toList = sourceRemaining := by
+    rw [remainingArrayEq]
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have suppliedArity :
+      targetSupplied.size = targetDefinition.signature.params.size := by
+    rw [suppliedSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have transferred := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack)
+    targetGet shared node capturedUnder targetRetain targetRelease
+      (Nat.le_of_lt targetOver) targetDeclaration targetPapSafe suppliedArity
+      targetNonempty
+  dsimp only at transferred
+  have remainingNonempty : targetRemaining.isEmpty = false := by
+    simp [Array.isEmpty, targetRemaining, Array.size_extract]
+    omega
+  rw [remainingNonempty] at transferred
+  have sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+          source (.apply sourceFunction sourceArguments) =
+        (do
+          let (nextStore, result) ←
+            IxIR1.invoke sourceContext sourceFuel address sourceSupplied
+              sourceReleased
+          IxIR1.applyGo sourceContext sourceFuel nextStore result
+            sourceRemaining) := by
+    rw [IxIR1.runOp.eq_def]
+    dsimp only
+    rw [functionResolved]
+    simp only [bind, Except.bind]
+    rw [argumentsResolved]
+    simp only
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceRetain]
+    simp only [bind, Except.bind]
+    rw [sourceRelease]
+    simp only
+    rw [if_neg (by omega)]
+    rw [if_neg (by
+      intro exactGuard
+      have exactEq := beq_iff_eq.mp exactGuard
+      omega)]
+    rw [sourceDeclaration]
+    simp [IxIR1.declPapSafe, sourcePapSafe, sourceTotal, sourceSupplied,
+      sourceRemaining]
+  have entryArity : targetSupplied.size = calleeTrace.source.arity := by
+    calc
+      targetSupplied.size = arity := suppliedSize
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := functionEntryCodeState calleeTrace targetSupplied
+    entryArity
+  have sourceEnvironment :
+      targetSupplied.toList.reverse = sourceSupplied.reverse := by
+    rw [suppliedArrayEq]
+  rw [sourceEnvironment] at calleeState
+  have calleeState' : CodeStateRel calleeTrace calleeTrace.root
+      sourceSupplied.reverse
+      { definition := targetDefinition, values := targetSupplied } := by
+    simpa only [calleeMatch.generated] using calleeState
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun,
+    by simpa [targetTotal, targetSupplied, targetRemaining] using transferred,
+    remainingListEq,
+    calleeState'⟩
+
+/-- Trace-facing dynamic-application dispatch.  The checked derivation
+supplies both translated operand families and the exact instruction
+coordinate.  `ApplyTransfer` then selects the evaluator's immediate, exact
+call, or over-application path while the second conclusion retains the exact
+caller continuation state established whenever that path ultimately resumes
+with a value. -/
+theorem simulate_traced_apply_transfer_state
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {source : List RVal} {function : RVal} {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) source frame)
+    (sourceFunctionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok function)
+    (sourceArgumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel function values.toArray
+      { frame with pc := frame.pc + 1 } stack target) :
+    Eval.Step context interpretation machine target ∧
+      ∀ value,
+        CodeStateRel functionTrace next (value :: source)
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value } := by
+  have operationSyntax := functionTrace.descendantOperationSyntax descendant
+  change Lower.InputMap.translateAtom input sourceFunction =
+      some targetFunction ∧
+    Lower.InputMap.translateAtoms input sourceArguments =
+      some targetArguments at operationSyntax
+  obtain ⟨functionTranslated, argumentsTranslated⟩ := operationSyntax
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms argumentsTranslated
+  have targetFunctionResolved :
+      Eval.resolveAtom frame.values targetFunction = .ok function :=
+    resolveAtom_of_envRel state.environments functionTranslated
+      sourceFunctionResolved
+  have targetArgumentsResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel state.environments arguments
+      sourceArgumentsResolved
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .apply targetFunction targetArguments :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  constructor
+  · exact Eval.Step.apply control blockAt pcBound instruction noCredits
+      targetFunctionResolved targetArgumentsResolved transferred
+  · intro value
+    exact state.letOpValueNext descendant rfl rfl value
+
+/-- Trace-facing exact saturation combines the source invocation equation,
+derived PAP heap preparation, the emitted `apply` step, exact callee-root
+state, and the caller state that an ordinary resumed return must establish. -/
+theorem simulate_traced_apply_pap_saturated_enter_state
+    {sourceContext : IxIR1.Ctx}
+    {sourceCurrent sourceDefinition : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array RVal} {values : List RVal}
+    (state : CodeStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (positive : PositiveSharedRC sourceStore)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let sourceTotal := captured.toList ++ values
+    let targetTotal := captured ++ values.toArray
+    let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetTotal }
+    let targetMachine : Eval.Machine :=
+      { store := machine.store
+        heapFuel := 0
+        control := .running calleeFrame (.resume resume :: stack) }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+            source (.apply sourceFunction sourceArguments) =
+          IxIR1.invoke sourceContext sourceFuel address sourceTotal
+            sourceReleased ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { targetMachine with store := targetReleased } ∧
+        CodeStateRel calleeTrace calleeTrace.root sourceTotal.reverse
+          calleeFrame ∧
+        ∀ value,
+          CodeStateRel callerTrace next (value :: source)
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value } := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceRun, transferred,
+      calleeState⟩ :=
+    simulate_apply_pap_saturated_enter
+      (resume := { frame with pc := frame.pc + 1 }) calleeMatch stores positive
+      functionResolved argumentsResolved sourceGet shared node capturedUnder
+      sourceRetain sourceRelease totalExact papArity sourceDeclaration
+      sourcePapSafe targetDeclaration
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame stack := by
+    simpa using control
+  obtain ⟨targetStep, callerState⟩ :=
+    simulate_traced_apply_transfer_state descendant state functionResolved
+      argumentsResolved noCredits beforeControl transferred
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun, targetStep,
+    calleeState, callerState⟩
+
+/-- Trace-facing over-application combines the source invoke-then-apply
+equation with the emitted entry step, exact callee-root state, and residual
+argument identity needed by the later `retApplyMore` transition. -/
+theorem simulate_traced_apply_pap_over_enter_state
+    {sourceContext : IxIR1.Ctx}
+    {sourceCurrent sourceDefinition : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array RVal} {values : List RVal}
+    (state : CodeStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (positive : PositiveSharedRC sourceStore)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let sourceTotal := captured.toList ++ values
+    let sourceSupplied := sourceTotal.take arity
+    let sourceRemaining := sourceTotal.drop arity
+    let targetTotal := captured ++ values.toArray
+    let targetSupplied := targetTotal.extract 0 arity
+    let targetRemaining := targetTotal.extract arity targetTotal.size
+    let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetSupplied }
+    let targetMachine : Eval.Machine :=
+      { store := machine.store
+        heapFuel := 0
+        control := .running calleeFrame
+          (.applyMore targetRemaining resume :: stack) }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        StoreRel sourceReleased targetReleased ∧
+        IxIR1.runOp sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+            source (.apply sourceFunction sourceArguments) =
+          (do
+            let (nextStore, result) ←
+              IxIR1.invoke sourceContext sourceFuel address sourceSupplied
+                sourceReleased
+            IxIR1.applyGo sourceContext sourceFuel nextStore result
+              sourceRemaining) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { targetMachine with store := targetReleased } ∧
+        targetRemaining.toList = sourceRemaining ∧
+        CodeStateRel calleeTrace calleeTrace.root sourceSupplied.reverse
+          calleeFrame ∧
+        ∀ value,
+          CodeStateRel callerTrace next (value :: source)
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value } := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceRun, transferred,
+      remainingEq, calleeState⟩ :=
+    simulate_apply_pap_over_enter
+      (resume := { frame with pc := frame.pc + 1 }) calleeMatch stores positive
+      functionResolved argumentsResolved sourceGet shared node capturedUnder
+      sourceRetain sourceRelease totalOver papArity sourceDeclaration
+      sourcePapSafe targetDeclaration
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame stack := by
+    simpa using control
+  obtain ⟨targetStep, callerState⟩ :=
+    simulate_traced_apply_transfer_state descendant state functionResolved
+      argumentsResolved noCredits beforeControl transferred
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun, targetStep,
+    remainingEq, calleeState, callerState⟩
+
+/-- A saturated addressed source call reduces to argument resolution followed
+by `invoke`. Exposing this equation keeps the recursive simulation from
+unfolding `runOp` at every call site. -/
+theorem source_runOp_call_eq
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore : IxIR1.Store}
+    {source : List RVal} {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.call address sourceArguments) =
+      IxIR1.invoke sourceContext sourceFuel address values sourceStore := by
+  rw [IxIR1.runOp.eq_def]
+  simp only
+  rw [sourceResolved]
+  rfl
+
+/-- A saturated source self-call reduces to the current body and its dynamic
+result-world check. -/
+theorem source_runOp_callSelf_eq
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore : IxIR1.Store}
+    {source : List RVal}
+    {sourceArguments : Array IxIR1.Atom} {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceCurrent.arity = values.length) :
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.callSelf sourceArguments) = (do
+      let out ← IxIR1.runCode sourceContext sourceFuel sourceCurrent
+        sourceStore values.reverse sourceCurrent.body
+      IxIR1.checkResultWorld sourceCurrent.result out) := by
+  rw [IxIR1.runOp.eq_def]
+  simp only
+  rw [sourceResolved]
+  simp only [bind, Except.bind]
+  rw [argumentArity]
+  simp
+
+/-- The compiler-recognized tail-call shell is observationally just the
+addressed invocation; its trailing `ret (.var 0)` contributes no result
+change and consumes the second source fuel layer. -/
+theorem source_runCode_tail_call_eq
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore : IxIR1.Store}
+    {source : List RVal} {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values) :
+    IxIR1.runCode sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+        source (.letOp (.call address sourceArguments) (.ret (.var 0))) =
+      IxIR1.invoke sourceContext sourceFuel address values sourceStore := by
+  rw [IxIR1.runCode.eq_def]
+  simp only
+  rw [source_runOp_call_eq sourceResolved]
+  cases invokeRun :
+      IxIR1.invoke sourceContext sourceFuel address values sourceStore with
+  | error error => rfl
+  | ok output =>
+      rcases output with ⟨nextStore, value⟩
+      simp only [bind, Except.bind]
+      rw [IxIR1.runCode.eq_def]
+      rfl
+
+/-- The self-tail-call shell likewise reduces to the current function body
+and its result-world check without retaining an extra source continuation. -/
+theorem source_runCode_tail_callSelf_eq
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore : IxIR1.Store}
+    {source : List RVal}
+    {sourceArguments : Array IxIR1.Atom} {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceCurrent.arity = values.length) :
+    IxIR1.runCode sourceContext (sourceFuel + 2) sourceCurrent sourceStore
+        source (.letOp (.callSelf sourceArguments) (.ret (.var 0))) = (do
+      let out ← IxIR1.runCode sourceContext sourceFuel sourceCurrent
+        sourceStore values.reverse sourceCurrent.body
+      IxIR1.checkResultWorld sourceCurrent.result out) := by
+  rw [IxIR1.runCode.eq_def]
+  simp only
+  rw [source_runOp_callSelf_eq sourceResolved argumentArity]
+  cases callRun : (do
+      let out ← IxIR1.runCode sourceContext sourceFuel sourceCurrent
+        sourceStore values.reverse sourceCurrent.body
+      IxIR1.checkResultWorld sourceCurrent.result out) with
+  | error error => rfl
+  | ok output =>
+      rcases output with ⟨nextStore, value⟩
+      simp only [bind, Except.bind]
+      rw [IxIR1.runCode.eq_def]
+      rfl
+
+/-- A direct-call instruction resolves the same argument vector, enters the
+addressed target function in one step, and establishes its canonical reversed
+source-parameter environment. The function-body induction supplies the
+subsequent execution under the pushed continuation. -/
+theorem simulate_call_fn_enter {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {source : List RVal} {mapping : EnvMap}
+    (environments : EnvRel source frame.values mapping)
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {values : List RVal}
+    {definition : Function}
+    (arguments : AtomsRel mapping sourceArguments targetArguments)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (declaration : context.declarations address = some (.fn definition))
+    (arity : definition.signature.params.size = values.length)
+    (nonempty : definition.blocks.isEmpty = false)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .call address targetArguments) :
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { definition, values := values.toArray }
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      EnvRel values.reverse values.toArray (entryMap values.length) := by
+  have targetResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel environments arguments sourceResolved
+  have targetArity :
+      values.toArray.size = definition.signature.params.size := by
+    simp [arity]
+  exact ⟨Eval.Step.callFn control blockAt pc instruction noCredits
+      targetResolved declaration targetArity nonempty,
+    EnvRel.entry values.toArray⟩
+
+/-- A recursive self-call has the same entry relation as an addressed call. -/
+theorem simulate_call_self_enter {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {source : List RVal} {mapping : EnvMap}
+    (environments : EnvRel source frame.values mapping)
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {values : List RVal}
+    (arguments : AtomsRel mapping sourceArguments targetArguments)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (arity : frame.definition.signature.params.size = values.length)
+    (nonempty : frame.definition.blocks.isEmpty = false)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc < block.instructions.size)
+    (instruction : block.instructions[frame.pc] =
+      .callSelf targetArguments) :
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { definition := frame.definition, values := values.toArray }
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      EnvRel values.reverse values.toArray (entryMap values.length) := by
+  have targetResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel environments arguments sourceResolved
+  have targetArity :
+      values.toArray.size = frame.definition.signature.params.size := by
+    simp [arity]
+  exact ⟨Eval.Step.callSelf control blockAt pc instruction noCredits
+      targetResolved targetArity nonempty,
+    EnvRel.entry values.toArray⟩
+
+/-- Trace-facing addressed call entry. The caller trace supplies emitted call
+syntax and coordinates; an exact callee `FunctionTraceMatch` turns the target
+entry frame into the callee root `CodeStateRel`. -/
+theorem simulate_traced_call_fn_enter_state {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace calleeTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAddress targetAddress : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration sourceAddress) sourceDefinition targetDefinition)
+    {source : List RVal} {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next) source frame)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (declaration :
+      context.declarations sourceAddress = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      CodeStateRel calleeTrace calleeTrace.root values.reverse calleeFrame := by
+  dsimp only
+  have operationSyntax := functionTrace.descendantOperationSyntax descendant
+  change sourceAddress = targetAddress ∧
+    Lower.InputMap.translateAtoms input sourceArguments =
+      some targetArguments at operationSyntax
+  obtain ⟨addressEq, translated⟩ := operationSyntax
+  subst targetAddress
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms translated
+  have targetArity :
+      targetDefinition.signature.params.size = values.length := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity calleeMatch.source
+      _ = values.length := argumentArity
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .call sourceAddress targetArguments :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  have entered := simulate_call_fn_enter
+    (context := context) (interpretation := interpretation)
+    state.environments arguments
+    sourceResolved declaration targetArity targetNonempty noCredits control
+      blockAt pcBound instruction
+  have entryArity : values.toArray.size = calleeTrace.source.arity := by
+    simpa [calleeMatch.source] using argumentArity.symm
+  have calleeState := functionEntryCodeState calleeTrace values.toArray entryArity
+  exact ⟨entered.1, by
+    simpa [calleeMatch.generated] using calleeState⟩
+
+/-- Trace-facing recursive self-call entry into the same function-trace root. -/
+theorem simulate_traced_call_self_enter_state {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+    {source : List RVal} {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      source frame)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := frame.definition, values := values.toArray }
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      CodeStateRel functionTrace functionTrace.root values.reverse calleeFrame := by
+  dsimp only
+  have translated : Lower.InputMap.translateAtoms input sourceArguments =
+      some targetArguments := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms translated
+  have targetArity :
+      frame.definition.signature.params.size = values.length := by
+    calc
+      frame.definition.signature.params.size =
+          functionTrace.generated.signature.params.size := by
+            rw [state.definition]
+      _ = functionTrace.source.arity := functionTrace.sourceArity
+      _ = values.length := argumentArity
+  have targetNonempty : frame.definition.blocks.isEmpty = false := by
+    simpa [state.definition] using functionTrace.generatedNonempty
+  obtain ⟨blockAt, pcBound, instructionAt⟩ := state.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .callSelf targetArguments :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  have entered := simulate_call_self_enter
+    (context := context) (interpretation := interpretation)
+    state.environments arguments
+    sourceResolved targetArity targetNonempty noCredits control blockAt pcBound
+      instruction
+  have entryArity : values.toArray.size = functionTrace.source.arity := by
+    simpa using argumentArity.symm
+  have calleeState := functionEntryCodeState functionTrace values.toArray
+    entryArity
+  exact ⟨entered.1, by simpa [state.definition] using calleeState⟩
+
+/-- Tail calls enter the addressed callee without growing the continuation
+stack while preserving the same canonical entry relation. -/
+theorem simulate_tail_call_fn_enter {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {source : List RVal} {mapping : EnvMap}
+    (environments : EnvRel source frame.values mapping)
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {values : List RVal}
+    {definition : Function}
+    (arguments : AtomsRel mapping sourceArguments targetArguments)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (declaration : context.declarations address = some (.fn definition))
+    (arity : definition.signature.params.size = values.length)
+    (nonempty : definition.blocks.isEmpty = false)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address targetArguments) :
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { definition, values := values.toArray } stack } ∧
+      EnvRel values.reverse values.toArray (entryMap values.length) := by
+  have targetResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel environments arguments sourceResolved
+  have targetArity :
+      values.toArray.size = definition.signature.params.size := by
+    simp [arity]
+  exact ⟨Eval.Step.tailCallFn control blockAt pc terminator noCredits
+      targetResolved declaration targetArity nonempty,
+    EnvRel.entry values.toArray⟩
+
+/-- Tail-recursive self entry likewise preserves the continuation stack. -/
+theorem simulate_tail_call_self_enter {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation} {block : Block}
+    {source : List RVal} {mapping : EnvMap}
+    (environments : EnvRel source frame.values mapping)
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {values : List RVal}
+    (arguments : AtomsRel mapping sourceArguments targetArguments)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (arity : frame.definition.signature.params.size = values.length)
+    (nonempty : frame.definition.blocks.isEmpty = false)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf targetArguments) :
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running
+            { definition := frame.definition, values := values.toArray }
+            stack } ∧
+      EnvRel values.reverse values.toArray (entryMap values.length) := by
+  have targetResolved :
+      Eval.resolveAtoms frame.values targetArguments = .ok values.toArray :=
+    resolveAtoms_of_envRel environments arguments sourceResolved
+  have targetArity :
+      values.toArray.size = frame.definition.signature.params.size := by
+    simp [arity]
+  exact ⟨Eval.Step.tailCallSelf control blockAt pc terminator noCredits
+      targetResolved targetArity nonempty,
+    EnvRel.entry values.toArray⟩
+
+/-- Trace-facing addressed tail-call entry. The checked terminal trace
+provides the target argument vector, executable block, PC, and terminator. -/
+theorem simulate_traced_tail_call_fn_enter_state {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace calleeTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {source : List RVal} {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) source frame)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (declaration : context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame stack } ∧
+      CodeStateRel calleeTrace calleeTrace.root values.reverse calleeFrame := by
+  dsimp only
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨targetArguments, translated, terminator⟩ :=
+    Lower.CodeTrace.tailCallSyntax_of_match syntaxMatched
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms translated
+  have blockAt :
+      frame.definition.blocks[frame.block]? = some generated := by
+    simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+  have pc : frame.pc = generated.instructions.size := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  have targetArity :
+      targetDefinition.signature.params.size = values.length := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity calleeMatch.source
+      _ = values.length := argumentArity
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have entered := simulate_tail_call_fn_enter
+    (context := context) (interpretation := interpretation)
+    state.environments arguments sourceResolved declaration targetArity
+      targetNonempty noCredits control blockAt pc terminator
+  have entryArity : values.toArray.size = calleeTrace.source.arity := by
+    simpa [calleeMatch.source] using argumentArity.symm
+  have calleeState := functionEntryCodeState calleeTrace values.toArray entryArity
+  exact ⟨entered.1, by
+    simpa [calleeMatch.generated] using calleeState⟩
+
+/-- Trace-facing self-tail-call entry. All generated syntax and coordinates
+come from the checked recursive derivation. -/
+theorem simulate_traced_tail_call_self_enter_state {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated))
+    {source : List RVal} {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) source frame)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := frame.definition, values := values.toArray }
+    Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame stack } ∧
+      CodeStateRel functionTrace functionTrace.root values.reverse
+        calleeFrame := by
+  dsimp only
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨targetArguments, translated, terminator⟩ :=
+    Lower.CodeTrace.tailCallSelfSyntax_of_match syntaxMatched
+  have arguments : AtomsRel input sourceArguments targetArguments :=
+    atomsRel_of_translateAtoms translated
+  have blockAt :
+      frame.definition.blocks[frame.block]? = some generated := by
+    simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+  have pc : frame.pc = generated.instructions.size := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  have targetArity :
+      frame.definition.signature.params.size = values.length := by
+    calc
+      frame.definition.signature.params.size =
+          functionTrace.generated.signature.params.size := by
+            rw [state.definition]
+      _ = functionTrace.source.arity := functionTrace.sourceArity
+      _ = values.length := argumentArity
+  have targetNonempty : frame.definition.blocks.isEmpty = false := by
+    simpa [state.definition] using functionTrace.generatedNonempty
+  have entered := simulate_tail_call_self_enter
+    (context := context) (interpretation := interpretation)
+    state.environments arguments sourceResolved targetArity targetNonempty
+      noCredits control blockAt pc terminator
+  have entryArity : values.toArray.size = functionTrace.source.arity := by
+    simpa using argumentArity.symm
+  have calleeState := functionEntryCodeState functionTrace values.toArray
+    entryArity
+  exact ⟨entered.1, by simpa [state.definition] using calleeState⟩
+
+/-- Trace-facing addressed calls now expose both sides of the recursive
+induction seam: the exact IxIR₁ `invoke` equation and the genuine target entry
+step into the matched callee root. The heap relation is unchanged by entry. -/
+theorem simulate_traced_call_fn_enter_source_state
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace calleeTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAddress targetAddress : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration sourceAddress) sourceDefinition targetDefinition)
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (declaration :
+      context.declarations sourceAddress = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore source (.call sourceAddress sourceArguments) =
+        IxIR1.invoke sourceContext sourceFuel sourceAddress values sourceStore ∧
+      Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel calleeTrace calleeTrace.root values.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨targetStep, calleeState⟩ :=
+    simulate_traced_call_fn_enter_state
+      (context := context) (interpretation := interpretation)
+      descendant calleeMatch state sourceResolved argumentArity declaration
+        noCredits control
+  exact ⟨source_runOp_call_eq sourceResolved, targetStep, stores, calleeState⟩
+
+/-- Recursive self-call entry has the same paired source/target seam, with
+the source equation naming the current function body and result-world check. -/
+theorem simulate_traced_call_self_enter_source_state
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := frame.definition, values := values.toArray }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore source (.callSelf sourceArguments) = (do
+        let out ← IxIR1.runCode sourceContext sourceFuel functionTrace.source
+          sourceStore values.reverse functionTrace.source.body
+        IxIR1.checkResultWorld functionTrace.source.result out) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel functionTrace functionTrace.root values.reverse
+        calleeFrame := by
+  dsimp only
+  obtain ⟨targetStep, calleeState⟩ :=
+    simulate_traced_call_self_enter_state
+      (context := context) (interpretation := interpretation)
+      descendant state sourceResolved argumentArity noCredits control
+  exact ⟨source_runOp_callSelf_eq sourceResolved argumentArity,
+    targetStep, stores, calleeState⟩
+
+/-- A traced addressed tail call discards both source and target caller
+continuations: the compiler-recognized source shell is exactly `invoke`, and
+the target enters the same matched callee root with the existing stack. -/
+theorem simulate_traced_tail_call_fn_enter_source_state
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace calleeTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {address : Ix.Compiler.Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (declaration : context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    IxIR1.runCode sourceContext (sourceFuel + 2) functionTrace.source
+          sourceStore source
+          (.letOp (.call address sourceArguments) (.ret (.var 0))) =
+        IxIR1.invoke sourceContext sourceFuel address values sourceStore ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running calleeFrame stack } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel calleeTrace calleeTrace.root values.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨targetStep, calleeState⟩ :=
+    simulate_traced_tail_call_fn_enter_state
+      (context := context) (interpretation := interpretation)
+      descendant calleeMatch state sourceResolved argumentArity declaration
+        noCredits control
+  exact ⟨source_runCode_tail_call_eq sourceResolved,
+    targetStep, stores, calleeState⟩
+
+/-- Self-tail calls expose the analogous current-body source equation and
+enter the same trace root without growing either continuation stack. -/
+theorem simulate_traced_tail_call_self_enter_source_state
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {values : List RVal}
+    (state : CodeStateRel functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := frame.definition, values := values.toArray }
+    IxIR1.runCode sourceContext (sourceFuel + 2) functionTrace.source
+          sourceStore source
+          (.letOp (.callSelf sourceArguments) (.ret (.var 0))) = (do
+        let out ← IxIR1.runCode sourceContext sourceFuel functionTrace.source
+          sourceStore values.reverse functionTrace.source.body
+        IxIR1.checkResultWorld functionTrace.source.result out) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running calleeFrame stack } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel functionTrace functionTrace.root values.reverse
+        calleeFrame := by
+  dsimp only
+  obtain ⟨targetStep, calleeState⟩ :=
+    simulate_traced_tail_call_self_enter_state
+      (context := context) (interpretation := interpretation)
+      descendant state sourceResolved argumentArity noCredits control
+  exact ⟨source_runCode_tail_callSelf_eq sourceResolved argumentArity,
+    targetStep, stores, calleeState⟩
+
+/-- Generic instruction/continuation composition for the code induction.
+Once an operation-local theorem supplies one target step and the continuation
+hypothesis starts from its successor state, exact finite executions compose
+without equating source fuel to target control steps. -/
+theorem simulate_letOp_continuation {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine middle targetOut : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {sourceStore middleStore outStore : IxIR1.Store}
+    {source : List RVal} {operation : IxIR1.Op} {rest : IxIR1.Code}
+    {value outValue : RVal} {continuationCount : Nat}
+    (running : machine.control = .running frame stack)
+    (sourceOperation : IxIR1.runOp sourceContext sourceFuel sourceCurrent
+      sourceStore source operation = .ok (middleStore, value))
+    (targetOperation :
+      Eval.Step context interpretation machine middle)
+    (sourceContinuation : IxIR1.runCode sourceContext sourceFuel
+      sourceCurrent middleStore (value :: source) rest =
+        .ok (outStore, outValue))
+    (targetContinuation : Eval.Steps context interpretation
+      continuationCount middle targetOut) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.letOp operation rest) = .ok (outStore, outValue) ∧
+      Eval.Steps context interpretation (Nat.succ continuationCount)
+        machine targetOut := by
+  constructor
+  · rw [IxIR1.runCode.eq_def]
+    simp only
+    rw [sourceOperation]
+    exact sourceContinuation
+  · exact .cons running targetOperation targetContinuation
+
+/-- Constructor-case composition: source dispatch selects the same branch as
+the target's full-constructor switch, whose one control step composes directly
+with the branch induction hypothesis. The branch execution starts after the
+generated edge transfer (and any constructor-field fetch prologue). -/
+theorem simulate_case_ctor_branch {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine targetOut : Eval.Machine} {frame target : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore sourceOut : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceScrutinee : IxIR1.Atom} {targetScrutinee : Atom}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : IxIR1.CtorId}
+    {fields : Array RVal} {sourceAlternatives : Array IxIR1.Alt}
+    {sourcePeelNat : Bool} {tag fieldCount : Nat} {body : IxIR1.Code}
+    {value : RVal}
+    {constructors : Array CtorAlt} {targetPeelNat : Option NatPeel}
+    {alternative : CtorAlt} {branchCount : Nat}
+    (translated :
+      translateAtom mapping sourceScrutinee = some targetScrutinee)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceScrutinee = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (sourceAlternative : sourceAlternatives.find? (fun candidate =>
+      candidate.cidx == cid.cidx) =
+        some (.mk tag fieldCount body))
+    (fieldArity : fields.size = fieldCount)
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors targetPeelNat)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : Eval.EdgeTransfer frame alternative.edge #[] target)
+    (sourceBranch : IxIR1.runCode sourceContext sourceFuel sourceCurrent
+      sourceStore (fields.toList.reverse ++ source) body =
+        .ok (sourceOut, value))
+    (targetBranch : Eval.Steps context interpretation branchCount
+      { machine with control := .running target stack } targetOut) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.case sourceScrutinee sourcePeelNat sourceAlternatives) =
+          .ok (sourceOut, value) ∧
+      Eval.Steps context interpretation (Nat.succ branchCount)
+        machine targetOut := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetScrutinee = .ok (.loc location) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetGet : machine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetStep := Eval.Step.switchCtor (context := context)
+    (interpretation := interpretation) control blockAt pc terminator
+      targetResolved targetGet node targetAlternative transferred
+  constructor
+  · rw [IxIR1.runCode.eq_def]
+    simp only
+    rw [sourceResolved]
+    simp only [bind, Except.bind]
+    rw [sourceGet]
+    simp only
+    rw [node]
+    simp only
+    rw [sourceAlternative]
+    simp [fieldArity, sourceBranch]
+  · exact .cons control targetStep targetBranch
+
+/-- Literal-Nat zero dispatch composes one target switch step with the zero
+branch induction hypothesis. -/
+theorem simulate_case_nat_zero_branch {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine targetOut : Eval.Machine} {frame target : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore sourceOut : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (environments : EnvRel source frame.values mapping)
+    {sourceScrutinee : IxIR1.Atom} {targetScrutinee : Atom}
+    {sourceAlternatives : Array IxIR1.Alt} {body : IxIR1.Code}
+    {value : RVal}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {branchCount : Nat}
+    (translated :
+      translateAtom mapping sourceScrutinee = some targetScrutinee)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceScrutinee = .ok (.lit (.nat 0)))
+    (sourceAlternative : sourceAlternatives.find? (fun candidate =>
+      candidate.cidx == 0) =
+        some (.mk 0 0 body))
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (transferred : Eval.EdgeTransfer frame peel.zero #[] target)
+    (sourceBranch : IxIR1.runCode sourceContext sourceFuel sourceCurrent
+      sourceStore source body = .ok (sourceOut, value))
+    (targetBranch : Eval.Steps context interpretation branchCount
+      { machine with control := .running target stack } targetOut) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.case sourceScrutinee true sourceAlternatives) =
+          .ok (sourceOut, value) ∧
+      Eval.Steps context interpretation (Nat.succ branchCount)
+        machine targetOut := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetScrutinee = .ok (.lit (.nat 0)) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetStep := Eval.Step.switchNatZero (context := context)
+    (interpretation := interpretation) control blockAt pc terminator
+      targetResolved transferred
+  constructor
+  · rw [IxIR1.runCode.eq_def]
+    simp only
+    rw [sourceResolved]
+    simp only [bind, Except.bind]
+    rw [sourceAlternative]
+    exact sourceBranch
+  · exact .cons control targetStep targetBranch
+
+/-- Literal-Nat successor dispatch preserves the peeled predecessor and
+composes one target switch step with the successor-branch induction
+hypothesis. -/
+theorem simulate_case_nat_succ_branch {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel predecessor : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine targetOut : Eval.Machine} {frame target : Eval.Frame}
+    {stack : List Eval.Continuation} {block : Block}
+    {sourceStore sourceOut : IxIR1.Store} {source : List RVal}
+    {mapping : EnvMap}
+    (environments : EnvRel source frame.values mapping)
+    {sourceScrutinee : IxIR1.Atom} {targetScrutinee : Atom}
+    {sourceAlternatives : Array IxIR1.Alt} {body : IxIR1.Code}
+    {value : RVal}
+    {constructors : Array CtorAlt} {peel : NatPeel}
+    {branchCount : Nat}
+    (translated :
+      translateAtom mapping sourceScrutinee = some targetScrutinee)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (sourceAlternative : sourceAlternatives.find? (fun candidate =>
+      candidate.cidx == 1) =
+        some (.mk 1 1 body))
+    (control : machine.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (transferred : Eval.EdgeTransfer frame peel.succ
+      #[.lit (.nat predecessor)] target)
+    (sourceBranch : IxIR1.runCode sourceContext sourceFuel sourceCurrent
+      sourceStore (.lit (.nat predecessor) :: source) body =
+        .ok (sourceOut, value))
+    (targetBranch : Eval.Steps context interpretation branchCount
+      { machine with control := .running target stack } targetOut) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.case sourceScrutinee true sourceAlternatives) =
+          .ok (sourceOut, value) ∧
+      Eval.Steps context interpretation (Nat.succ branchCount)
+        machine targetOut := by
+  have targetResolved : Eval.resolveAtom frame.values targetScrutinee =
+      .ok (.lit (.nat (predecessor + 1))) :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetStep := Eval.Step.switchNatSucc (context := context)
+    (interpretation := interpretation) control blockAt pc terminator
+      targetResolved transferred
+  constructor
+  · rw [IxIR1.runCode.eq_def]
+    simp only
+    rw [sourceResolved]
+    simp only [bind, Except.bind]
+    rw [sourceAlternative]
+    exact sourceBranch
+  · exact .cons control targetStep targetBranch
+
+/-- A callee return under an over-application continuation performs the same
+return-value resolution as an ordinary return, then dispatches that value and
+the retained residual vector through the shared `ApplyTransfer` boundary. -/
+theorem simulate_ret_apply_more {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Eval.Machine} {frame caller : Eval.Frame}
+    {arguments : Array RVal} {rest : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal} {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control =
+      .running frame (.applyMore arguments caller :: rest))
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom)
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel value arguments caller rest target) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine target ∧
+      StoreRel sourceStore machine.store := by
+  have targetResolved : Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetStep := Eval.Step.retApplyMore (context := context)
+    (interpretation := interpretation) control blockAt pc terminator
+      targetResolved noCredits world transferred
+  refine ⟨?_, targetStep.toSteps control, stores⟩
+  unfold IxIR1.runCode
+  simp only
+  rw [sourceResolved]
+  rfl
+
+/-- Trace-facing over-application return. The retained callee derivation
+supplies its exact return syntax and coordinate; the caller supplies only the
+next dynamic `ApplyTransfer` result for the already-certified residual vector. -/
+theorem simulate_traced_ret_apply_more_state
+    {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Eval.Machine} {frame caller : Eval.Frame}
+    {arguments : Array RVal} {rest : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {sourceStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control =
+      .running frame (.applyMore arguments caller :: rest))
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel value arguments caller rest target) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine target ∧
+      StoreRel sourceStore machine.store := by
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨translated, terminator⟩ :=
+    Lower.CodeTrace.retSyntax_of_match syntaxMatched
+  have blockAt : frame.definition.blocks[frame.block]? = some generated := by
+    simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+  have pc : frame.pc = generated.instructions.size := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  exact simulate_ret_apply_more stores state.environments translated
+    sourceResolved control blockAt pc terminator noCredits world transferred
+
+/-- The non-outer return base case resumes the suspended target caller and
+establishes the source result binding relation needed by its continuation. -/
+theorem simulate_ret_resume {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame caller : Eval.Frame}
+    {rest : List Eval.Continuation} {block : Block}
+    {sourceStore : IxIR1.Store} {source callerSource : List RVal}
+    {mapping callerMapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    (callerEnvironments :
+      EnvRel callerSource caller.values callerMapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control =
+      .running frame (.resume caller :: rest))
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom)
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine
+        { machine with
+          control := .running
+            { caller with values := caller.values.push value } rest } ∧
+      StoreRel sourceStore machine.store ∧
+      EnvRel (value :: callerSource) (caller.values.push value)
+        (#[some (.reg caller.values.size)] ++ callerMapping) := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetStep := Eval.Step.retResume (context := context)
+    (interpretation := interpretation) control blockAt pc terminator
+      targetResolved noCredits world
+  refine ⟨?_, targetStep.toSteps control, stores,
+    callerEnvironments.bindValue value⟩
+  unfold IxIR1.runCode
+  simp only
+  rw [sourceResolved]
+  rfl
+
+/-- Trace-facing resumed return. As in the outermost case, recursive trace
+membership supplies the executable block, terminal PC, translated operand,
+and return terminator; the caller relation is extended with the result. -/
+theorem simulate_traced_ret_resume_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame caller : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {sourceStore : IxIR1.Store} {source callerSource : List RVal}
+    {callerMapping : EnvMap} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (callerEnvironments :
+      EnvRel callerSource caller.values callerMapping)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control =
+      .running frame (.resume caller :: rest))
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine
+        { machine with
+          control := .running
+            { caller with values := caller.values.push value } rest } ∧
+      StoreRel sourceStore machine.store ∧
+      EnvRel (value :: callerSource) (caller.values.push value)
+        (#[some (.reg caller.values.size)] ++ callerMapping) := by
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨translated, terminator⟩ :=
+    Lower.CodeTrace.retSyntax_of_match syntaxMatched
+  have blockAt :
+      frame.definition.blocks[frame.block]? = some generated := by
+    simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+  have pc : frame.pc = generated.instructions.size := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  exact simulate_ret_resume stores state.environments callerEnvironments
+    translated sourceResolved control blockAt pc terminator noCredits world
+
+/-- Complete a traced value-producing caller instruction when a traced callee
+returns. This is the call-stack hand-off needed by recursive function
+induction: the callee return step, checked caller map forgetting, and caller
+PC/register progression produce the caller continuation's `CodeStateRel`. -/
+theorem simulate_traced_return_to_letOp_state
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {calleeFrame callerFrame : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    {callSite : Lower.SourceSite} {callBlock : BlockId}
+    {callInput nextInput : EnvMap} {callEntryValueCount callIndex : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (callerDescendant : callerTrace.root.Descendant
+      (.letOp callSite callBlock callInput nextInput callEntryValueCount
+        operation callIndex instruction next))
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (calleeDescendant : calleeTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom generated))
+    {sourceStore : IxIR1.Store} {calleeSource callerSource : List RVal}
+    {value : RVal}
+    (callerState : CodeStateRel callerTrace
+      (.letOp callSite callBlock callInput nextInput callEntryValueCount
+        operation callIndex instruction next) callerSource callerFrame)
+    (calleeState : CodeStateRel calleeTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom generated) calleeSource calleeFrame)
+    (binder : Lower.Instr.baselineBinderAtom callEntryValueCount instruction =
+      some (.reg callEntryValueCount))
+    (delta : Lower.Instr.baselineValueDelta instruction = some 1)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom calleeSource sourceAtom = .ok value)
+    (control : machine.control = .running calleeFrame
+      (.resume { callerFrame with pc := callerFrame.pc + 1 } :: rest))
+    (noCredits : calleeFrame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      calleeFrame.definition.signature.result value = true) :
+    let nextCallerFrame : Eval.Frame :=
+      { callerFrame with
+        pc := callerFrame.pc + 1
+        values := callerFrame.values.push value }
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          calleeSource (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine
+        { machine with control := .running nextCallerFrame rest } ∧
+      StoreRel sourceStore machine.store ∧
+      CodeStateRel callerTrace next (value :: callerSource)
+        nextCallerFrame := by
+  dsimp only
+  have callerEnvironments : EnvRel callerSource
+      ({ callerFrame with pc := callerFrame.pc + 1 } : Eval.Frame).values
+      callInput := by
+    simpa [Lower.CodeTrace.sourceInputMap] using callerState.environments
+  obtain ⟨sourceRun, targetSteps, nextStores, canonical⟩ :=
+    simulate_traced_ret_resume_state calleeDescendant calleeState stores
+      callerEnvironments sourceResolved control noCredits world
+  have canonical' : EnvRel (value :: callerSource)
+      (callerFrame.values.push value)
+      (#[some (.reg callerFrame.values.size)] ++ callInput) := by
+    simpa using canonical
+  have nextEnvironments := canonical'.forgetTracedValue callerState
+    callerDescendant binder
+  refine ⟨sourceRun, ?_, nextStores,
+    callerState.letOpNext callerDescendant rfl rfl rfl ?_ rfl
+      nextEnvironments⟩
+  · simpa using targetSteps
+  · simp [delta]
+
+/-- Baseline logical execution preserves the exact IxIR₁ heap and value.
+Later credit insertion weakens this to heap isomorphism; keeping the stronger
+baseline relation makes that proof boundary explicit. -/
+structure OutcomeRel (source : IxIR1.Store × RVal)
+    (target : Eval.Result) extends StoreRel source.1 target.store where
+  value : target.value = source.2
+
+/-- The terminal block case: a related source return and outermost target
+return take one genuine control step to the same value and preserve the exact
+baseline store relation. -/
+theorem simulate_ret_halt {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal} {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control = .running frame [])
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom)
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine
+        { machine with control := .halted value } ∧
+      StoreRel sourceStore machine.store := by
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok value :=
+    resolveAtom_of_envRel environments translated sourceResolved
+  have targetStep := Eval.Step.retHalt (context := context)
+    (interpretation := interpretation) control blockAt pc terminator
+    targetResolved noCredits world
+  refine ⟨?_, targetStep.toSteps control, stores⟩
+  unfold IxIR1.runCode
+  simp only
+  rw [sourceResolved]
+  rfl
+
+/-- Trace-facing outermost return case. The recursive derivation supplies the
+exact executable block, terminal PC, translated operand, and retained return
+terminator, leaving only source resolution and runtime side conditions. -/
+theorem simulate_traced_ret_halt_state {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {sourceStore : IxIR1.Store} {source : List RVal} {value : RVal}
+    (state : CodeStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control = .running frame [])
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true) :
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine
+        { machine with control := .halted value } ∧
+      StoreRel sourceStore machine.store := by
+  have syntaxMatched := functionTrace.descendantSyntaxMatches descendant
+  obtain ⟨translated, terminator⟩ :=
+    Lower.CodeTrace.retSyntax_of_match syntaxMatched
+  have blockAt :
+      frame.definition.blocks[frame.block]? = some generated := by
+    simpa [Lower.CodeTrace.headBlock] using state.blockAt descendant
+  have pc : frame.pc = generated.instructions.size := by
+    simpa [Lower.CodeTrace.entryPc] using state.pc
+  exact simulate_ret_halt stores state.environments translated sourceResolved
+    control blockAt pc terminator noCredits world
+
+/-- Successful-run terminal case for the recursive semantic induction.
+Inverting source success supplies atom resolution and the unchanged store;
+the source result contract is then transported through `CodeStateRel` to
+discharge the target evaluator's executable return-world check. -/
+theorem simulate_traced_ret_halt_success
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {sourceStore : IxIR1.Store} {source : List RVal}
+    {sourceOutput : IxIR1.Store × RVal}
+    (state : CodeStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      source frame)
+    (stores : StoreRel sourceStore machine.store)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 1)
+      sourceCurrent sourceStore source (.ret sourceAtom) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame [])
+    (noCredits : frame.credits = #[]) :
+    ∃ value,
+      sourceOutput = (sourceStore, value) ∧
+        Eval.Steps context interpretation 1 machine
+          { machine with control := .halted value } ∧
+        StoreRel sourceStore machine.store := by
+  obtain ⟨value, sourceResolved, outputEq⟩ :=
+    IxIR1.runCode_ret_success sourceRun
+  subst sourceOutput
+  have targetWorld := state.resultWorld stores resultWorld
+  obtain ⟨_, targetSteps, nextStores⟩ :=
+    simulate_traced_ret_halt_state
+      (sourceContext := sourceContext) (sourceCurrent := sourceCurrent)
+      (sourceFuel := sourceFuel) descendant state stores sourceResolved control
+      noCredits targetWorld
+  exact ⟨value, rfl, targetSteps, nextStores⟩
+
+/-- Runner-facing form of the terminal block case. The exact one-step witness
+selects a control budget of one and produces the public baseline outcome. -/
+theorem simulate_ret_halt_runMachine {sourceContext : IxIR1.Ctx}
+    {sourceCurrent : IxIR1.FnDef} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame} {block : Block}
+    {sourceStore : IxIR1.Store} {source : List RVal} {mapping : EnvMap}
+    (stores : StoreRel sourceStore machine.store)
+    (environments : EnvRel source frame.values mapping)
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {value : RVal}
+    (translated : translateAtom mapping sourceAtom = some targetAtom)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control = .running frame [])
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (pc : frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom)
+    (noCredits : frame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      frame.definition.signature.result value = true) :
+    let targetOut : Eval.Result :=
+      { store := machine.store
+        value
+        controlRemaining := 0
+        heapRemaining := machine.heapFuel }
+    IxIR1.runCode sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.ret sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.runMachine context interpretation 1 machine = .ok targetOut ∧
+      OutcomeRel (sourceStore, value) targetOut := by
+  dsimp only
+  obtain ⟨sourceRun, targetSteps, _⟩ := simulate_ret_halt
+    stores environments translated sourceResolved control blockAt pc
+      terminator noCredits world
+  refine ⟨sourceRun, targetSteps.runMachine_halted, ?_⟩
+  exact { stores with value := rfl }
+
+/-- The block-compositional proof's public whole-main endpoint. Fuel is not
+equated: source success existentially obtains independent target control and
+heap-traversal budgets. -/
+def SuccessfulMainSimulation (sourceContext : IxIR1.Ctx)
+    (targetContext : Eval.Context) (sourceMain : IxIR1.Code)
+    (sourceResult : Ix.Compiler.Ixon.Owned) (targetProgram : Program) : Prop :=
+  ∀ {sourceFuel sourceOut},
+    IxIR1.runOwnedMain sourceContext sourceResult sourceMain sourceFuel =
+        .ok sourceOut →
+    ∃ controlFuel heapFuel targetOut,
+      Eval.runMain targetContext .logical targetProgram controlFuel heapFuel =
+          .ok targetOut ∧
+        OutcomeRel sourceOut targetOut
+
+end Ix.Compiler.IxIR2.Lower.Sim
diff --git a/Ix/Compiler/IxIR2/Pipeline.lean b/Ix/Compiler/IxIR2/Pipeline.lean
new file mode 100644
index 000000000..9b9201b12
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Pipeline.lean
@@ -0,0 +1,3548 @@
+import Ix.Compiler.Pipeline
+import Ix.Compiler.LoweredCompilation
+import Ix.Compiler.IxIR2.Lower
+import Ix.Compiler.Ixon.Hash
+import Ix.Compiler.IxIR1.Serialize
+import Ix.Compiler.IxIR1.NoReuse
+
+/-!
+# Validated pipeline attachment for structured IxIR₂ lowering
+
+This module consumes the proof-facing validated IxIR₁ pipeline result, carries
+function-parameter worlds through its final address map, derives baseline
+whole-value constructor schemas, and immediately runs the checked IxIR₂
+lowerer while retaining its exact producer equation.
+
+IxIR₁ erased exact constructor identities at projections, shallow frees, and
+cases. Addressed IxIR₀ mutual-block provenance recovers recursor-case
+identities exactly through the final IxIR₁ owner map. Checked HPT summaries
+and path-local transfer replay recover exact projection/free identities when
+their producers are precise; ambiguous facts still fail closed.
+-/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR
+open Ix.Compiler.IxIR2
+
+inductive Error where
+  | pipeline (error : Ix.Compiler.Pipeline.Error)
+  | hpt (message : String)
+  | parameterArity (producer : Address) (expected actual : Nat)
+  | parameterConflict (address : Address)
+  | recursorOriginConflict (address : Address)
+  | lowering (error : Lower.Error)
+  deriving Repr
+
+/-- Constructor information and exact mutual-block membership still present
+in the addressed IxIR₀ graph. -/
+structure ConstructorInfo where
+  identity : CtorId
+  arity : Nat
+  group : Option Address := none
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+/-- Exact final IxIR₁ owner to addressed IxIR₀ mutual-block origin for a
+compiler-produced recursor function. -/
+structure RecursorOrigin where
+  owner : Address
+  group : Address
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+/-- Executable erased-information tables attached to one exact IxIR₁ input. -/
+structure Sidecars where
+  input : Lower.Input
+  parameterEntries : List (Address × Array Owned)
+  constructors : List ConstructorInfo
+  recursorOrigins : List RecursorOrigin := []
+  /-- Checked HPT claims for the exact addressed IxIR₁ graph.  Hand-built
+  sidecars default to no interprocedural claims; path-local allocation facts
+  remain available without them. -/
+  hptCertificate : IxIR1.HPT.Certificate := { artifacts := [] }
+
+private def lookupParameterWorlds
+    (entries : List (Address × Array Owned)) (address : Address) :
+    Option (Array Owned) :=
+  (entries.find? fun entry => entry.1 == address).map (·.2)
+
+private def sourceDeclAt?
+    (declarations : List (Address × IxIR0.Decl)) (address : Address) :
+    Option IxIR0.Decl :=
+  (declarations.find? fun entry => entry.1 == address).map (·.2)
+
+private def parameterWorldsFor
+    (source : List (Address × IxIR0.Decl)) (producer : Address)
+    (definition : IxIR1.FnDef) : Except Error (Array Owned) := do
+  let worlds := match sourceDeclAt? source producer with
+    | some (.defn _ body) =>
+        (IxIR1.Lower.lamUses body).map IxIR1.Lower.worldOfUses |>.toArray
+    | some (.recursor arguments _ _) =>
+        Array.replicate (arguments + 1) .shared
+    | some (.extern arity) => Array.replicate arity .shared
+    | some (.ctor ..) | none => Array.replicate definition.arity .shared
+  if worlds.size = definition.arity then
+    return worlds
+  else
+    .error (.parameterArity producer definition.arity worlds.size)
+
+private def insertParameterWorlds
+    (entries : List (Address × Array Owned)) (address : Address)
+    (worlds : Array Owned) : Except Error (List (Address × Array Owned)) :=
+  match entries.find? fun entry => entry.1 == address with
+  | none => .ok (entries ++ [(address, worlds)])
+  | some entry =>
+      if entry.2 == worlds then .ok entries
+      else .error (.parameterConflict address)
+
+private def buildParameterWorlds
+    (source : List (Address × IxIR0.Decl))
+    (raw : List (Address × IxIR1.Decl))
+    (addressMap : IxIR1.ReaddressAll.Renaming) :
+    Except Error (List (Address × Array Owned)) :=
+  raw.foldlM (fun entries entry =>
+    match entry.2 with
+    | .extern _ => pure entries
+    | .fn definition => do
+        let worlds ← parameterWorldsFor source entry.1 definition
+        let address := IxIR1.Readdress.Renaming.apply addressMap entry.1
+        insertParameterWorlds entries address worlds) []
+
+private def sourceGroup?
+    (blocks : List IxIR0.MutualBlock.Result) (address : Address) :
+    Option Address := do
+  let block ← blocks.find? fun block =>
+    block.members.any fun member => member.1 == address
+  return block.blockAddress
+
+private def constructorInfos
+    (source : List (Address × IxIR0.Decl))
+    (blocks : List IxIR0.MutualBlock.Result) : List ConstructorInfo :=
+  source.filterMap fun
+    | (address, .ctor tag arity) =>
+        some
+          { identity := IxIR1.Lower.ctorIdOf address tag
+            arity
+            group := sourceGroup? blocks address }
+    | _ => none
+
+private def insertRecursorOrigin (origins : List RecursorOrigin)
+    (owner group : Address) : Except Error (List RecursorOrigin) :=
+  match origins.find? fun origin => origin.owner == owner with
+  | none => .ok (origins ++ [{ owner, group }])
+  | some origin =>
+      if origin.group == group then .ok origins
+      else .error (.recursorOriginConflict owner)
+
+/-- Derive exact recursor-owner origins from the addressed IxIR₀ block graph
+and the complete raw-to-final IxIR₁ map. Incompatible origins collapsed to
+one final owner fail closed. -/
+def deriveRecursorOrigins
+    (source : List (Address × IxIR0.Decl))
+    (blocks : List IxIR0.MutualBlock.Result)
+    (raw : List (Address × IxIR1.Decl))
+    (addressMap : IxIR1.ReaddressAll.Renaming) :
+    Except Error (List RecursorOrigin) :=
+  raw.foldlM (fun origins entry =>
+    match sourceDeclAt? source entry.1, entry.2,
+        sourceGroup? blocks entry.1 with
+    | some (.recursor ..), .fn _, some group =>
+        let owner := IxIR1.Readdress.Renaming.apply addressMap entry.1
+        insertRecursorOrigin origins owner group
+    | _, _, _ => pure origins) []
+
+/-- Baseline layouts are content-addressed independently by world and full
+constructor identity. No reuse credit is emitted by this lowering, but using
+the final representation key now prevents the two ownership worlds from being
+accidentally conflated by later passes. -/
+def baselineLayout (world : Owned) (identity : CtorId) : LayoutId :=
+  Address.blake3
+    (ByteArray.mk #[0x63, 0x78, 0x32, 0x6c, 0x61, 0x79, 0x30, 0x00] ++
+      Encoding.tag world.toBits ++ identity.bytes)
+
+private def schema? (constructors : List ConstructorInfo)
+    (world : Owned) (identity : CtorId) : Option CtorSchema := do
+  let info ← constructors.find? fun candidate =>
+    candidate.identity == identity
+  return { layout := baselineLayout world identity
+           fields := Array.replicate info.arity world }
+
+private def ownerCode? (input : Lower.Input) :
+    Validate.Owner → Option IxIR1.Code
+  | .main => some input.main
+  | .declaration address => do
+      let entry ← input.declarations.find? fun entry => entry.1 == address
+      match entry.2 with
+      | .fn definition => some definition.body
+      | .extern _ => none
+
+private def terminalCode : IxIR1.Code → IxIR1.Code
+  | .letOp _ rest => terminalCode rest
+  | code => code
+
+private theorem terminalCode_mapAddresses (rename : Address → Address)
+    (code : IxIR1.Code) :
+    terminalCode (IxIR1.Readdress.Code.mapAddresses rename code) =
+      IxIR1.Readdress.Code.mapAddresses rename (terminalCode code) := by
+  cases code with
+  | ret atom => rfl
+  | letOp operation rest => exact terminalCode_mapAddresses rename rest
+  | case scrutinee peelNat alternatives => rfl
+termination_by sizeOf code
+
+private def branchCode? : IxIR1.Code → List Nat → Option IxIR1.Code
+  | code, [] => some code
+  | code, alternative :: rest =>
+      match terminalCode code with
+      | .case _ _ alternatives => do
+          let selected ← alternatives[alternative]?
+          match selected with
+          | .mk _ _ body => branchCode? body rest
+      | _ => none
+  termination_by _ branches => branches.length
+
+private theorem branchCode?_mapAddresses (rename : Address → Address)
+    (code : IxIR1.Code) (branches : List Nat) :
+    branchCode? (IxIR1.Readdress.Code.mapAddresses rename code) branches =
+      (branchCode? code branches).map
+        (IxIR1.Readdress.Code.mapAddresses rename) := by
+  induction branches generalizing code with
+  | nil => simp [branchCode?]
+  | cons alternative rest ih =>
+      simp only [branchCode?]
+      rw [terminalCode_mapAddresses]
+      cases terminalEq : terminalCode code with
+      | ret atom => simp [IxIR1.Readdress.Code.mapAddresses]
+      | letOp operation next =>
+          simp [IxIR1.Readdress.Code.mapAddresses]
+      | case scrutinee peelNat alternatives =>
+          simp only [IxIR1.Readdress.Code.mapAddresses]
+          have mappedAlternatives :
+              (IxIR1.Readdress.AltList.mapAddresses rename
+                alternatives.toList).toArray =
+                alternatives.map
+                  (IxIR1.Readdress.Alt.mapAddresses rename) := by
+            apply Array.toList_inj.mp
+            simp only [Array.toList_map]
+            change IxIR1.Readdress.AltList.mapAddresses rename
+                alternatives.toList =
+              List.map (IxIR1.Readdress.Alt.mapAddresses rename)
+                alternatives.toList
+            induction alternatives.toList with
+            | nil => rfl
+            | cons head tail ih =>
+                simp only [IxIR1.Readdress.AltList.mapAddresses,
+                  List.map_cons, ih]
+          rw [mappedAlternatives, Array.getElem?_map]
+          cases selectedEq : alternatives[alternative]? with
+          | none => simp
+          | some selected =>
+              obtain ⟨cidx, fields, body⟩ := selected
+              simp [IxIR1.Readdress.Alt.mapAddresses, ih]
+
+/-- Syntax-only branch replay is likewise a fold over its path. -/
+private theorem branchCode?_append (code : IxIR1.Code)
+    (front back : List Nat) :
+    branchCode? code (front ++ back) =
+      (branchCode? code front).bind (fun suffix => branchCode? suffix back) := by
+  induction front generalizing code with
+  | nil =>
+      simp only [List.nil_append, branchCode?, Option.bind]
+  | cons alternative front ih =>
+      simp only [List.cons_append, branchCode?]
+      cases terminalEq : terminalCode code with
+      | ret atom =>
+          simp
+      | letOp operation rest =>
+          simp
+      | case scrutinee peelNat alternatives =>
+          cases selectedEq : alternatives[alternative]? with
+          | none =>
+              simp [selectedEq]
+          | some selected =>
+              cases selected with
+              | mk cidx fields body =>
+                  simp [selectedEq, ih]
+
+private def codeAfter? : Nat → IxIR1.Code → Option IxIR1.Code
+  | 0, code => some code
+  | offset + 1, .letOp _ rest => codeAfter? offset rest
+  | _ + 1, _ => none
+
+private theorem codeAfter?_mapAddresses (rename : Address → Address)
+    (offset : Nat) (code : IxIR1.Code) :
+    codeAfter? offset (IxIR1.Readdress.Code.mapAddresses rename code) =
+      (codeAfter? offset code).map
+        (IxIR1.Readdress.Code.mapAddresses rename) := by
+  induction offset generalizing code with
+  | zero => rfl
+  | succ offset ih =>
+      cases code with
+      | ret atom => rfl
+      | letOp operation rest => exact ih rest
+      | case scrutinee peelNat alternatives => rfl
+
+private def codeAtSite? (input : Lower.Input) (site : Lower.SourceSite) :
+    Option IxIR1.Code := do
+  let owner ← ownerCode? input site.owner
+  let branch ← branchCode? owner site.branches
+  codeAfter? site.offset branch
+
+/-- Literal IxIR₁ source suffix named by a lowering coordinate, independent
+of HPT success. -/
+def Sidecars.sourceCodeAt? (sidecars : Sidecars)
+    (site : Lower.SourceSite) : Option IxIR1.Code :=
+  codeAtSite? sidecars.input site
+
+private theorem ownerCode?_addressImage (input : Lower.Input)
+    (rename : Address → Address)
+    (mainImage : ∃ rawMain,
+      IxIR1.Readdress.Code.mapAddresses rename rawMain = input.main)
+    (declarationImage : ∀ {address definition},
+      IxIR1.Env.ofList input.declarations address = some (.fn definition) →
+        ∃ rawDefinition,
+          IxIR1.Readdress.FnDef.mapAddresses rename rawDefinition =
+            definition)
+    {owner : Validate.Owner} {code : IxIR1.Code}
+    (found : ownerCode? input owner = some code) :
+    ∃ rawCode,
+      IxIR1.Readdress.Code.mapAddresses rename rawCode = code := by
+  cases owner with
+  | main =>
+      simp only [ownerCode?, Option.some.injEq] at found
+      subst code
+      exact mainImage
+  | declaration address =>
+      cases entryEq : input.declarations.find?
+          (fun entry => entry.1 == address) with
+      | none => simp [ownerCode?, entryEq] at found
+      | some entry =>
+          cases declarationEq : entry.2 with
+          | extern arity => simp [ownerCode?, entryEq, declarationEq] at found
+          | fn definition =>
+              have lookup : IxIR1.Env.ofList input.declarations address =
+                  some (.fn definition) := by
+                simp [IxIR1.Env.ofList, entryEq, declarationEq]
+              obtain ⟨rawDefinition, definitionImage⟩ :=
+                declarationImage lookup
+              have codeEq : code = definition.body := by
+                simpa [ownerCode?, entryEq, declarationEq] using found.symm
+              subst code
+              refine ⟨rawDefinition.body, ?_⟩
+              have bodyImage := congrArg IxIR1.FnDef.body definitionImage
+              simpa [IxIR1.Readdress.FnDef.mapAddresses] using bodyImage
+
+/-- Every literal source suffix recovered from a sidecar remains in the
+image of an address action whenever the sidecar's main and selected function
+declarations are images. Branch selection and source offsets only select
+subterms; neither can manufacture a new declaration identity. -/
+theorem Sidecars.sourceCodeAt?_addressImage (sidecars : Sidecars)
+    (rename : Address → Address)
+    (mainImage : ∃ rawMain,
+      IxIR1.Readdress.Code.mapAddresses rename rawMain = sidecars.input.main)
+    (declarationImage : ∀ {address definition},
+      IxIR1.Env.ofList sidecars.input.declarations address =
+          some (.fn definition) →
+        ∃ rawDefinition,
+          IxIR1.Readdress.FnDef.mapAddresses rename rawDefinition =
+            definition)
+    {site : Lower.SourceSite} {code : IxIR1.Code}
+    (found : sidecars.sourceCodeAt? site = some code) :
+    ∃ rawCode,
+      IxIR1.Readdress.Code.mapAddresses rename rawCode = code := by
+  unfold Sidecars.sourceCodeAt? codeAtSite? at found
+  cases ownerEq : ownerCode? sidecars.input site.owner with
+  | none => simp [ownerEq] at found
+  | some ownerCode =>
+      simp only [ownerEq] at found
+      cases branchEq : branchCode? ownerCode site.branches with
+      | none => simp [branchEq] at found
+      | some branchCode =>
+          simp [branchEq] at found
+          obtain ⟨rawOwner, ownerImage⟩ := ownerCode?_addressImage
+            sidecars.input rename mainImage declarationImage ownerEq
+          have branchTransport :=
+            branchCode?_mapAddresses rename rawOwner site.branches
+          rw [ownerImage, branchEq] at branchTransport
+          cases rawBranchEq : branchCode? rawOwner site.branches with
+          | none => simp [rawBranchEq] at branchTransport
+          | some rawBranch =>
+              simp only [rawBranchEq, Option.map_some,
+                Option.some.injEq] at branchTransport
+              have codeTransport :=
+                codeAfter?_mapAddresses rename site.offset rawBranch
+              rw [← branchTransport, found] at codeTransport
+              cases rawCodeEq : codeAfter? site.offset rawBranch with
+              | none => simp [rawCodeEq] at codeTransport
+              | some rawCode =>
+                  simp only [rawCodeEq, Option.map_some,
+                    Option.some.injEq] at codeTransport
+                  exact ⟨rawCode, codeTransport.symm⟩
+
+private def nextSourceCode? : IxIR1.Code → Option IxIR1.Code
+  | .letOp _ rest => some rest
+  | _ => none
+
+private theorem codeAfter?_succ (offset : Nat) (code : IxIR1.Code) :
+    codeAfter? (offset + 1) code =
+      (codeAfter? offset code).bind nextSourceCode? := by
+  induction offset generalizing code with
+  | zero =>
+      cases code <;> rfl
+  | succ offset ih =>
+      cases code with
+      | ret atom => rfl
+      | case scrutinee peelNat alternatives => rfl
+      | letOp operation rest =>
+          exact ih rest
+
+private theorem terminalCode_of_codeAfter_case (offset : Nat)
+    (code : IxIR1.Code) (scrutinee : IxIR1.Atom) (peelNat : Bool)
+    (alternatives : Array IxIR1.Alt)
+    (found : codeAfter? offset code =
+      some (.case scrutinee peelNat alternatives)) :
+    terminalCode code = .case scrutinee peelNat alternatives := by
+  induction offset generalizing code with
+  | zero =>
+      simp only [codeAfter?] at found
+      cases found
+      rfl
+  | succ offset ih =>
+      cases code with
+      | ret atom =>
+          simp [codeAfter?] at found
+      | case scrutinee' peelNat' alternatives' =>
+          simp [codeAfter?] at found
+      | letOp operation rest =>
+          simp only [codeAfter?] at found
+          exact ih rest found
+
+/-- Literal source coordinates advance in lockstep with a `letOp` trace. -/
+theorem Sidecars.sourceCodeAt?_next (sidecars : Sidecars)
+    {site : Lower.SourceSite} {operation : IxIR1.Op} {rest : IxIR1.Code}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.letOp operation rest)) :
+    sidecars.sourceCodeAt? site.next = some rest := by
+  unfold Sidecars.sourceCodeAt? codeAtSite? at sourceAt ⊢
+  simp only [Lower.SourceSite.next]
+  cases ownerEq : ownerCode? sidecars.input site.owner with
+  | none =>
+      simp [ownerEq] at sourceAt
+  | some ownerCode =>
+      simp [ownerEq] at sourceAt ⊢
+      cases branchEq : branchCode? ownerCode site.branches with
+      | none =>
+          simp [branchEq] at sourceAt
+      | some branchCode =>
+          simp [branchEq] at sourceAt ⊢
+          rw [codeAfter?_succ]
+          cases offsetEq : codeAfter? site.offset branchCode with
+          | none =>
+              simp [offsetEq] at sourceAt
+          | some currentCode =>
+              simp [offsetEq] at sourceAt ⊢
+              have currentEq : currentCode = .letOp operation rest :=
+                sourceAt
+              subst currentCode
+              rfl
+
+/-- Literal source coordinates select the exact body stored at an appended
+case-alternative index. -/
+theorem Sidecars.sourceCodeAt?_alternative (sidecars : Sidecars)
+    {site : Lower.SourceSite} {scrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {index cidx fields : Nat}
+    {body : IxIR1.Code}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.case scrutinee peelNat alternatives))
+    (selected : alternatives[index]? = some (.mk cidx fields body)) :
+    sidecars.sourceCodeAt? (site.alternative index) = some body := by
+  unfold Sidecars.sourceCodeAt? codeAtSite? at sourceAt ⊢
+  simp only [Lower.SourceSite.alternative]
+  cases ownerEq : ownerCode? sidecars.input site.owner with
+  | none =>
+      simp [ownerEq] at sourceAt
+  | some ownerCode =>
+      simp [ownerEq] at sourceAt ⊢
+      cases branchEq : branchCode? ownerCode site.branches with
+      | none =>
+          simp [branchEq] at sourceAt
+      | some branchCode =>
+          simp [branchEq] at sourceAt
+          have terminalEq := terminalCode_of_codeAfter_case site.offset
+            branchCode scrutinee peelNat alternatives sourceAt
+          rw [branchCode?_append, branchEq]
+          simp [branchCode?, terminalEq, selected, codeAfter?]
+
+/-! ## Path-local producer facts
+
+`SourceSite` records exactly the branch path and `letOp` offset traversed by
+the structured lowerer.  Replay the checked HPT transfer along only that path
+to recover the abstract environment at the operation being lowered.  Every
+lookup remains partial: invalid coordinates, missing call summaries, and an
+HPT error all fail closed. -/
+
+private def mainAnalysisOwner : Address := Address.replicate 0
+
+private structure AnalysisRoot where
+  owner : Address
+  current : IxIR1.FnDef
+  facts : List IxIR1.HPT.Fact
+  code : IxIR1.Code
+
+private def analysisRoot? (sidecars : Sidecars) :
+    Validate.Owner → Option AnalysisRoot
+  | .main =>
+      -- A missing synthetic-owner summary makes `callSelf` fail closed and
+      -- is the semantic owner-compatibility contract used for source main.
+      match sidecars.hptCertificate.summaryEnv mainAnalysisOwner with
+      | some _ => none
+      | none => some
+          { owner := mainAnalysisOwner
+            current := sidecars.input.mainDefinition
+            facts := []
+            code := sidecars.input.main }
+  | .declaration address => do
+      let entry ← sidecars.input.declarations.find? fun entry =>
+        entry.1 == address
+      match entry.2 with
+      | .extern _ => none
+      | .fn current =>
+          some
+            ({ owner := address
+               current
+               facts := List.replicate current.arity IxIR1.HPT.Fact.top
+               code := current.body } : AnalysisRoot)
+
+/-- The exact source definition used by path-local analysis for one lowering
+owner. A missing result is the same fail-closed condition as `siteFacts?`. -/
+def Sidecars.analysisCurrent? (sidecars : Sidecars)
+    (owner : Validate.Owner) : Option IxIR1.FnDef :=
+  (analysisRoot? sidecars owner).map (fun root => root.current)
+
+/-- One retained lowering trace resolves to the exact function definition
+used by path-local HPT replay. A missing synthetic-main analysis is permitted
+because all of its facts fail closed; a missing declaration analysis is not. -/
+def Sidecars.functionTraceSourceMatches (sidecars : Sidecars)
+    (trace : Lower.FunctionTrace) : Bool :=
+  match sidecars.analysisCurrent? trace.owner with
+  | some current => Lower.functionSourceEq current trace.source
+  | none => trace.owner == .main
+
+/-- Whole-trace source/HPT owner alignment checked at attachment time. -/
+def Sidecars.traceSourcesMatch (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all sidecars.functionTraceSourceMatches
+
+/-- Reuse-freedom check over the exact final declaration environment and
+every source function retained by the lowering trace.  Checking the emitted
+graph closes the content-deduplication gap between the raw compiler theorem
+and the universally quantified evaluator context contract. -/
+def Sidecars.sourceNoReuse (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  IxIR1.NoReuse.checkDeclarations sidecars.input.declarations &&
+    trace.functions.all fun functionTrace =>
+      IxIR1.NoReuse.checkCode functionTrace.source.body
+
+/-! Every constructor allocation retained by the producer must name a
+sidecar constructor with the same field arity. This finite executable audit
+is the static half of the runtime constructor-universe invariant used by
+ambiguous switch coverage. -/
+
+def Sidecars.constructorKnown (sidecars : Sidecars) (identity : CtorId)
+    (arity : Nat) : Bool :=
+  match sidecars.constructors.find? fun info => info.identity == identity with
+  | some info => info.arity == arity
+  | none => false
+
+def Sidecars.operationConstructorsKnown (sidecars : Sidecars) :
+    IxIR1.Op → Bool
+  | .alloc _ identity arguments | .reuse _ identity arguments =>
+      sidecars.constructorKnown identity arguments.size
+  | _ => true
+
+mutual
+
+def Sidecars.codeConstructorsKnown (sidecars : Sidecars) :
+    IxIR1.Code → Bool
+  | .ret _ => true
+  | .letOp operation rest =>
+      sidecars.operationConstructorsKnown operation &&
+        sidecars.codeConstructorsKnown rest
+  | .case _ _ alternatives =>
+      sidecars.alternativesConstructorsKnown alternatives.toList
+
+private def Sidecars.alternativesConstructorsKnown (sidecars : Sidecars) :
+    List IxIR1.Alt → Bool
+  | [] => true
+  | .mk _ _ body :: alternatives =>
+      sidecars.codeConstructorsKnown body &&
+        sidecars.alternativesConstructorsKnown alternatives
+
+end
+
+private theorem Sidecars.alternativesConstructorsKnown_of_mem
+    (sidecars : Sidecars) {alternatives : List IxIR1.Alt}
+    {cidx fields : Nat} {body : IxIR1.Code}
+    (known : sidecars.alternativesConstructorsKnown alternatives = true)
+    (member : (.mk cidx fields body : IxIR1.Alt) ∈ alternatives) :
+    sidecars.codeConstructorsKnown body = true := by
+  induction alternatives with
+  | nil => simp at member
+  | cons head tail ih =>
+      cases head with
+      | mk headTag headFields headBody =>
+          simp only [Sidecars.alternativesConstructorsKnown,
+            Bool.and_eq_true] at known
+          simp only [List.mem_cons] at member
+          cases member with
+          | inl equal =>
+              cases equal
+              exact known.1
+          | inr member => exact ih known.2 member
+
+/-- A constructor-allocation audit over a case projects to every source
+alternative body. -/
+theorem Sidecars.codeConstructorsKnown_alternative (sidecars : Sidecars)
+    {scrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {cidx fields : Nat}
+    {body : IxIR1.Code}
+    (known : sidecars.codeConstructorsKnown
+      (.case scrutinee peelNat alternatives) = true)
+    (member : (.mk cidx fields body : IxIR1.Alt) ∈ alternatives) :
+    sidecars.codeConstructorsKnown body = true := by
+  exact sidecars.alternativesConstructorsKnown_of_mem known
+    (by simpa using member)
+
+mutual
+
+/-- Constructor-producing operations retained by one recursive lowering trace
+all belong to the producer's constructor universe.  This trace-shaped copy of
+the source audit makes the fact project directly to any simulated suffix. -/
+def Sidecars.codeTraceConstructorsKnown (sidecars : Sidecars) :
+    Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ operation _ _ next =>
+      sidecars.operationConstructorsKnown operation &&
+        sidecars.codeTraceConstructorsKnown next
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      sidecars.codeTraceConstructorListKnown children
+
+private def Sidecars.codeTraceConstructorListKnown (sidecars : Sidecars) :
+    List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: traces =>
+      sidecars.codeTraceConstructorsKnown trace &&
+        sidecars.codeTraceConstructorListKnown traces
+
+end
+
+def Sidecars.traceConstructorsKnown (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.codeConstructorsKnown functionTrace.source.body &&
+      sidecars.codeTraceConstructorsKnown functionTrace.root
+
+private theorem Sidecars.codeTraceConstructorListKnown_of_mem
+    (sidecars : Sidecars) {traces : List Lower.CodeTrace}
+    {trace : Lower.CodeTrace}
+    (known : sidecars.codeTraceConstructorListKnown traces = true)
+    (member : trace ∈ traces) :
+    sidecars.codeTraceConstructorsKnown trace = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.codeTraceConstructorListKnown,
+        Bool.and_eq_true] at known
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using known.1
+      | inr member => exact ih known.2 member
+
+/-- The constructor-allocation audit is inherited by an immediate recursive
+compiler call. -/
+theorem Sidecars.codeTraceConstructorsKnown_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (known : sidecars.codeTraceConstructorsKnown parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.codeTraceConstructorsKnown child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      have both : sidecars.operationConstructorsKnown operation = true ∧
+          sidecars.codeTraceConstructorsKnown next = true := by
+        simpa only [Sidecars.codeTraceConstructorsKnown,
+          Bool.and_eq_true] using known
+      exact both.2
+  | switchValue site block input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      exact sidecars.codeTraceConstructorListKnown_of_mem known member
+
+/-- The constructor-allocation audit is inherited by every recursive
+descendant of a retained compiler derivation. -/
+theorem Sidecars.codeTraceConstructorsKnown_descendant (sidecars : Sidecars)
+    {root child : Lower.CodeTrace}
+    (known : sidecars.codeTraceConstructorsKnown root = true)
+    (descendant : root.Descendant child) :
+    sidecars.codeTraceConstructorsKnown child = true := by
+  induction descendant with
+  | refl => exact known
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.codeTraceConstructorsKnown_of_child ih childMember
+
+/-- Local PAP-safety check for the one source operation that can allocate a
+partial-application node. Missing and non-function declarations fail closed. -/
+private def Sidecars.pappOperationSafe (sidecars : Sidecars) :
+    IxIR1.Op → Bool
+  | .papp address _ =>
+      match IxIR1.Env.ofList sidecars.input.declarations address with
+      | some (.fn definition) => definition.papSafe
+      | _ => false
+  | _ => true
+
+mutual
+
+/-- Recursive PAP-safety check over one retained compiler derivation. -/
+def Sidecars.pappSafeTrace (sidecars : Sidecars) : Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ operation _ _ next =>
+      sidecars.pappOperationSafe operation && sidecars.pappSafeTrace next
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      sidecars.pappSafeTraces children
+
+/-- Structural list walk beneath switch children. -/
+def Sidecars.pappSafeTraces (sidecars : Sidecars) :
+    List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: rest =>
+      sidecars.pappSafeTrace trace && sidecars.pappSafeTraces rest
+
+end
+
+/-- Whole-program PAP-safety check over all retained source derivations. -/
+def Sidecars.tracePappsSafe (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.pappSafeTrace functionTrace.root
+
+/-- A successful recursive check exposes the declaration flag required by a
+local retained `papp`. -/
+theorem Sidecars.pappSafe_of_traceMatch (sidecars : Sidecars)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {address : Address} {arguments : Array IxIR1.Atom}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    {definition : IxIR1.FnDef}
+    (matched : sidecars.pappSafeTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp address arguments) index instruction next) = true)
+    (lookup : IxIR1.Env.ofList sidecars.input.declarations address =
+      some (.fn definition)) :
+    definition.papSafe = true := by
+  simp only [Sidecars.pappSafeTrace, Bool.and_eq_true] at matched
+  simpa [Sidecars.pappOperationSafe, lookup] using matched.1
+
+private theorem Sidecars.pappSafeTraces_of_mem (sidecars : Sidecars)
+    {traces : List Lower.CodeTrace} {child : Lower.CodeTrace}
+    (matched : sidecars.pappSafeTraces traces = true)
+    (member : child ∈ traces) :
+    sidecars.pappSafeTrace child = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.pappSafeTraces, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      rcases member with rfl | member
+      · exact matched.1
+      · exact ih matched.2 member
+
+/-- PAP-safety is inherited by every immediate recursive compiler call. -/
+theorem Sidecars.pappSafeTrace_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (matched : sidecars.pappSafeTrace parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.pappSafeTrace child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput count operation index instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      simp only [Sidecars.pappSafeTrace, Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue site block input count sourceScrutinee peel alternatives
+      targetScrutinee generated outgoing children =>
+      exact sidecars.pappSafeTraces_of_mem matched member
+
+/-- Every recursive trace descendant inherits the root PAP-safety check. -/
+theorem Sidecars.pappSafeTrace_descendant (sidecars : Sidecars)
+    {root child : Lower.CodeTrace}
+    (descendant : root.Descendant child)
+    (matched : sidecars.pappSafeTrace root = true) :
+    sidecars.pappSafeTrace child = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.pappSafeTrace_of_child ih childMember
+
+/-- Reflect whole-trace alignment for one retained function whose analysis
+root is present. -/
+theorem Sidecars.functionTraceSource_eq_of_match
+    (sidecars : Sidecars) {trace : Lower.Trace}
+    (matched : sidecars.traceSourcesMatch trace = true)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ trace.functions)
+    {current : IxIR1.FnDef}
+    (currentAt : sidecars.analysisCurrent? functionTrace.owner =
+      some current) :
+    current = functionTrace.source := by
+  have localMatch := List.all_eq_true.mp matched functionTrace member
+  unfold Sidecars.functionTraceSourceMatches at localMatch
+  rw [currentAt] at localMatch
+  exact (Lower.functionSourceEq_eq_true_iff _ _).mp localMatch
+
+/-- Every recovered analysis root satisfies the owner contract required by
+operation soundness: declaration roots name their exact stored definition,
+while the synthetic main owner has no summary. -/
+private theorem analysisRoot_ownerCompatible (sidecars : Sidecars)
+    {owner : Validate.Owner} {root : AnalysisRoot}
+    (found : analysisRoot? sidecars owner = some root) :
+    IxIR1.HPT.AnalysisOwnerCompatible
+      (IxIR1.Env.ofList sidecars.input.declarations)
+      sidecars.hptCertificate.summaryEnv root.owner root.current := by
+  cases owner with
+  | main =>
+      cases summaryEq :
+          sidecars.hptCertificate.summaryEnv mainAnalysisOwner with
+      | none =>
+          simp [analysisRoot?, summaryEq] at found
+          subst root
+          exact Or.inr summaryEq
+      | some summary =>
+          simp [analysisRoot?, summaryEq] at found
+  | declaration address =>
+      cases entryEq : sidecars.input.declarations.find?
+          (fun entry => entry.1 == address) with
+      | none =>
+          simp [analysisRoot?, entryEq] at found
+      | some entry =>
+          cases declarationEq : entry.2 with
+          | extern arity =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+          | fn current =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+              subst root
+              exact Or.inl (by
+                simp [IxIR1.Env.ofList, entryEq, declarationEq])
+
+/-- Every recoverable analysis root starts from the standard top parameter
+environment.  The synthetic main is the zero-arity instance. -/
+private theorem analysisRoot_facts (sidecars : Sidecars)
+    {owner : Validate.Owner} {root : AnalysisRoot}
+    (found : analysisRoot? sidecars owner = some root) :
+    root.facts =
+      List.replicate root.current.arity IxIR1.HPT.Fact.top := by
+  cases owner with
+  | main =>
+      cases summaryEq :
+          sidecars.hptCertificate.summaryEnv mainAnalysisOwner with
+      | none =>
+          simp [analysisRoot?, summaryEq, Lower.Input.mainDefinition] at found
+          subst root
+          rfl
+      | some summary =>
+          simp [analysisRoot?, summaryEq] at found
+  | declaration address =>
+      cases entryEq : sidecars.input.declarations.find?
+          (fun entry => entry.1 == address) with
+      | none =>
+          simp [analysisRoot?, entryEq] at found
+      | some entry =>
+          cases declarationEq : entry.2 with
+          | extern arity =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+          | fn current =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+              subst root
+              rfl
+
+/-- HPT and syntax-only site replay start from the same owner body. -/
+private theorem analysisRoot_sourceCode (sidecars : Sidecars)
+    {owner : Validate.Owner} {root : AnalysisRoot}
+    (found : analysisRoot? sidecars owner = some root) :
+    ownerCode? sidecars.input owner = some root.code := by
+  cases owner with
+  | main =>
+      cases summaryEq :
+          sidecars.hptCertificate.summaryEnv mainAnalysisOwner with
+      | none =>
+          simp [analysisRoot?, summaryEq] at found
+          subst root
+          rfl
+      | some summary =>
+          simp [analysisRoot?, summaryEq] at found
+  | declaration address =>
+      cases entryEq : sidecars.input.declarations.find?
+          (fun entry => entry.1 == address) with
+      | none =>
+          simp [analysisRoot?, entryEq] at found
+      | some entry =>
+          cases declarationEq : entry.2 with
+          | extern arity =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+          | fn current =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+              subst root
+              simp [ownerCode?, entryEq, declarationEq]
+
+/-- The analysis root's retained syntax is exactly its retained definition
+body. -/
+private theorem analysisRoot_code (sidecars : Sidecars)
+    {owner : Validate.Owner} {root : AnalysisRoot}
+    (found : analysisRoot? sidecars owner = some root) :
+    root.code = root.current.body := by
+  cases owner with
+  | main =>
+      cases summaryEq :
+          sidecars.hptCertificate.summaryEnv mainAnalysisOwner with
+      | none =>
+          simp [analysisRoot?, summaryEq, Lower.Input.mainDefinition] at found
+          subst root
+          rfl
+      | some summary =>
+          simp [analysisRoot?, summaryEq] at found
+  | declaration address =>
+      cases entryEq : sidecars.input.declarations.find?
+          (fun entry => entry.1 == address) with
+      | none =>
+          simp [analysisRoot?, entryEq] at found
+      | some entry =>
+          cases declarationEq : entry.2 with
+          | extern arity =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+          | fn current =>
+              simp [analysisRoot?, entryEq, declarationEq] at found
+              subst root
+              rfl
+
+/-- A recoverable function owner names its exact literal source body at the
+empty branch path and zero offset. -/
+theorem Sidecars.sourceCodeAt?_root (sidecars : Sidecars)
+    {owner : Validate.Owner} {current : IxIR1.FnDef}
+    (currentAt : sidecars.analysisCurrent? owner = some current) :
+    sidecars.sourceCodeAt? ({ owner := owner } : Lower.SourceSite) =
+      some current.body := by
+  unfold Sidecars.analysisCurrent? at currentAt
+  cases rootEq : analysisRoot? sidecars owner with
+  | none =>
+      simp [rootEq] at currentAt
+  | some root =>
+      rw [rootEq] at currentAt
+      have currentEq : root.current = current := Option.some.inj currentAt
+      have rootCode := analysisRoot_sourceCode sidecars rootEq
+      have codeEq := analysisRoot_code sidecars rootEq
+      unfold Sidecars.sourceCodeAt? codeAtSite?
+      simp [rootCode, branchCode?, codeAfter?, codeEq, currentEq]
+
+/-- The synthetic main coordinate always names the literal input main,
+independently of whether HPT admits a root for its reserved analysis owner. -/
+theorem Sidecars.sourceCodeAt?_main (sidecars : Sidecars) :
+    sidecars.sourceCodeAt?
+      ({ owner := .main } : Lower.SourceSite) = some sidecars.input.main := by
+  simp [Sidecars.sourceCodeAt?, codeAtSite?, ownerCode?, branchCode?,
+    codeAfter?]
+
+private def advanceFacts (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (facts : List IxIR1.HPT.Fact) (operation : IxIR1.Op) :
+    Except String (List IxIR1.HPT.Fact) := do
+  let bound ← IxIR1.HPT.analyzeOp declarations summaries root.owner
+    root.current facts operation
+  return bound :: facts.map IxIR1.HPT.Fact.forgetHeap
+
+private def analyzeToTerminal (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot) :
+    List IxIR1.HPT.Fact → IxIR1.Code →
+      Except String (List IxIR1.HPT.Fact × IxIR1.Code)
+  | facts, .letOp operation rest => do
+      let facts ← advanceFacts declarations summaries root facts operation
+      analyzeToTerminal declarations summaries root facts rest
+  | facts, code => .ok (facts, code)
+  termination_by _ code => sizeOf code
+
+/-- Successful abstract transfer does not alter the literal terminal suffix. -/
+private theorem analyzeToTerminal_code
+    (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (outputFacts : List IxIR1.HPT.Fact) (outputCode : IxIR1.Code)
+    (found : analyzeToTerminal declarations summaries root facts code =
+      .ok (outputFacts, outputCode)) :
+    terminalCode code = outputCode := by
+  cases code with
+  | ret atom =>
+      simp only [analyzeToTerminal] at found
+      cases found
+      rfl
+  | case scrutinee peelNat alternatives =>
+      simp only [analyzeToTerminal] at found
+      cases found
+      rfl
+  | letOp operation rest =>
+      simp only [analyzeToTerminal] at found
+      cases advanced :
+          advanceFacts declarations summaries root facts operation with
+      | error error =>
+          simp [advanced] at found
+      | ok nextFacts =>
+          rw [advanced] at found
+          simp only [bind, Except.bind] at found
+          exact analyzeToTerminal_code declarations summaries root nextFacts
+            rest outputFacts outputCode found
+termination_by sizeOf code
+
+private def selectAlternative (facts : List IxIR1.HPT.Fact)
+    (code : IxIR1.Code) (alternative : Nat) :
+    Except String (List IxIR1.HPT.Fact × IxIR1.Code) :=
+  match code with
+  | .case scrutinee peelNat alternatives => do
+      let scrutineeFact ← IxIR1.HPT.resolveAtomFact facts scrutinee
+      let selected ← match alternatives[alternative]? with
+        | some selected => pure selected
+        | none => throw "IxIR₂ source-site alternative is absent"
+      match selected with
+      | .mk cidx fields body =>
+          .ok (scrutineeFact.caseFields peelNat cidx fields ++ facts, body)
+  | _ => throw "IxIR₂ source-site branch path does not reach a case"
+
+private def enterAlternative (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (alternative : Nat) :
+    Except String (List IxIR1.HPT.Fact × IxIR1.Code) := do
+  let (facts, terminal) ←
+    analyzeToTerminal declarations summaries root facts code
+  selectAlternative facts terminal alternative
+
+/-- Successful abstract branch entry selects the same literal child body as
+syntax-only branch replay. -/
+private theorem enterAlternative_code (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (alternative : Nat) (outputFacts : List IxIR1.HPT.Fact)
+    (outputCode : IxIR1.Code)
+    (found : enterAlternative declarations summaries root facts code
+      alternative = .ok (outputFacts, outputCode)) :
+    branchCode? code [alternative] = some outputCode := by
+  unfold enterAlternative at found
+  cases terminalEq :
+      analyzeToTerminal declarations summaries root facts code with
+  | error error =>
+      simp [terminalEq] at found
+  | ok terminalResult =>
+      obtain ⟨terminalFacts, terminal⟩ := terminalResult
+      rw [terminalEq] at found
+      simp only [bind, Except.bind] at found
+      have terminalCodeEq := analyzeToTerminal_code declarations summaries
+        root facts code terminalFacts terminal terminalEq
+      cases terminal with
+      | ret atom =>
+          simp [selectAlternative] at found
+      | letOp operation rest =>
+          simp [selectAlternative] at found
+      | case scrutinee peelNat alternatives =>
+          cases abstractEq :
+              IxIR1.HPT.resolveAtomFact terminalFacts scrutinee with
+          | error error =>
+              simp [selectAlternative, abstractEq] at found
+          | ok scrutineeFact =>
+              cases selectedEq : alternatives[alternative]? with
+              | none =>
+                  simp [selectAlternative, abstractEq, selectedEq] at found
+                  change Except.error
+                    "IxIR₂ source-site alternative is absent" =
+                      Except.ok (outputFacts, outputCode) at found
+                  contradiction
+              | some selected =>
+                  cases selected with
+                  | mk cidx fields body =>
+                      simp [selectAlternative, abstractEq, selectedEq] at found
+                      rw [← found.2]
+                      simp [branchCode?, terminalCodeEq, selectedEq]
+
+private def analyzeBranchPath (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot) :
+    List IxIR1.HPT.Fact → IxIR1.Code → List Nat →
+      Except String (List IxIR1.HPT.Fact × IxIR1.Code)
+  | facts, code, [] => .ok (facts, code)
+  | facts, code, alternative :: branches => do
+      let (facts, code) ← enterAlternative declarations summaries root facts
+        code alternative
+      analyzeBranchPath declarations summaries root facts code branches
+  termination_by _ _ branches => branches.length
+
+/-- Branch-path replay is a monadic fold over the recorded alternative
+indices, so an appended path can be replayed from the prefix result. -/
+private theorem analyzeBranchPath_append
+    (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (front back : List Nat) :
+    analyzeBranchPath declarations summaries root facts code
+        (front ++ back) =
+      (analyzeBranchPath declarations summaries root facts code front).bind
+        (fun result => analyzeBranchPath declarations summaries root
+          result.1 result.2 back) := by
+  induction front generalizing facts code with
+  | nil =>
+      simp only [List.nil_append, analyzeBranchPath, Except.bind]
+  | cons alternative front ih =>
+      simp only [List.cons_append, analyzeBranchPath]
+      cases entered : enterAlternative declarations summaries root facts code
+          alternative with
+      | error error => rfl
+      | ok result =>
+          obtain ⟨nextFacts, nextCode⟩ := result
+          simp only [bind, Except.bind]
+          exact ih nextFacts nextCode
+
+/-- Successful HPT branch replay retains the exact syntax-only child suffix. -/
+private theorem analyzeBranchPath_code
+    (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (branches : List Nat) (outputFacts : List IxIR1.HPT.Fact)
+    (outputCode : IxIR1.Code)
+    (found : analyzeBranchPath declarations summaries root facts code
+      branches = .ok (outputFacts, outputCode)) :
+    branchCode? code branches = some outputCode := by
+  induction branches generalizing facts code with
+  | nil =>
+      simp only [analyzeBranchPath] at found
+      cases found
+      simp only [branchCode?]
+  | cons alternative branches ih =>
+      simp only [analyzeBranchPath] at found
+      cases entered : enterAlternative declarations summaries root facts code
+          alternative with
+      | error error =>
+          simp [entered] at found
+      | ok enteredResult =>
+          obtain ⟨nextFacts, nextCode⟩ := enteredResult
+          rw [entered] at found
+          simp only [bind, Except.bind] at found
+          have headCode := enterAlternative_code declarations summaries root
+            facts code alternative nextFacts nextCode entered
+          have tailCode := ih nextFacts nextCode found
+          change branchCode? code ([alternative] ++ branches) = some outputCode
+          rw [branchCode?_append, headCode]
+          simp only [Option.bind]
+          exact tailCode
+
+private def analyzeOffset (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot) :
+    Nat → List IxIR1.HPT.Fact → IxIR1.Code →
+      Except String (List IxIR1.HPT.Fact × IxIR1.Code)
+  | 0, facts, code => .ok (facts, code)
+  | offset + 1, facts, .letOp operation rest => do
+      let facts ← advanceFacts declarations summaries root facts operation
+      analyzeOffset declarations summaries root offset facts rest
+  | _ + 1, _, _ => throw "IxIR₂ source-site offset exceeds its branch"
+
+/-- Successful abstract offset replay retains the exact literal source
+suffix selected by syntax-only replay. -/
+private theorem analyzeOffset_code (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (offset : Nat) (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (outputFacts : List IxIR1.HPT.Fact) (outputCode : IxIR1.Code)
+    (found : analyzeOffset declarations summaries root offset facts code =
+      .ok (outputFacts, outputCode)) :
+    codeAfter? offset code = some outputCode := by
+  induction offset generalizing facts code with
+  | zero =>
+      simp only [analyzeOffset] at found
+      cases found
+      rfl
+  | succ offset ih =>
+      cases code with
+      | ret atom =>
+          simp [analyzeOffset] at found
+      | case scrutinee peelNat alternatives =>
+          simp [analyzeOffset] at found
+      | letOp operation rest =>
+          simp only [analyzeOffset] at found
+          cases advanced :
+              advanceFacts declarations summaries root facts operation with
+          | error error =>
+              simp [advanced] at found
+          | ok nextFacts =>
+              rw [advanced] at found
+              simp only [bind, Except.bind] at found
+              exact ih nextFacts rest found
+
+/-- A syntactically valid offset splits whole-arm abstract replay at exactly
+that suffix, including preservation of any abstract failure before it. -/
+private theorem analyzeToTerminal_eq_analyzeOffset_bind
+    (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (offset : Nat) (facts : List IxIR1.HPT.Fact) (code suffix : IxIR1.Code)
+    (codeAt : codeAfter? offset code = some suffix) :
+    analyzeToTerminal declarations summaries root facts code =
+      (analyzeOffset declarations summaries root offset facts code).bind
+        (fun result => analyzeToTerminal declarations summaries root
+          result.1 result.2) := by
+  induction offset generalizing facts code with
+  | zero =>
+      simp only [analyzeOffset, Except.bind]
+  | succ offset ih =>
+      cases code with
+      | ret atom =>
+          simp [codeAfter?] at codeAt
+      | case scrutinee peelNat alternatives =>
+          simp [codeAfter?] at codeAt
+      | letOp operation rest =>
+          simp only [codeAfter?] at codeAt
+          simp only [analyzeToTerminal, analyzeOffset]
+          cases advanced :
+              advanceFacts declarations summaries root facts operation with
+          | error error =>
+              simp only [bind, Except.bind]
+          | ok nextFacts =>
+              simp only [bind, Except.bind]
+              exact ih nextFacts rest codeAt
+
+/-- If a valid offset lands on a case, advancing the whole arm to its terminal
+code produces exactly the same fact environment and case. -/
+private theorem analyzeToTerminal_of_analyzeOffset_case
+    (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (offset : Nat) (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code)
+    (currentFacts : List IxIR1.HPT.Fact) (scrutinee : IxIR1.Atom)
+    (peelNat : Bool) (alternatives : Array IxIR1.Alt)
+    (found : analyzeOffset declarations summaries root offset facts code =
+      .ok (currentFacts, .case scrutinee peelNat alternatives)) :
+    analyzeToTerminal declarations summaries root facts code =
+      .ok (currentFacts, .case scrutinee peelNat alternatives) := by
+  induction offset generalizing facts code with
+  | zero =>
+      simp only [analyzeOffset] at found
+      cases found
+      simp only [analyzeToTerminal]
+  | succ offset ih =>
+      cases code with
+      | ret atom =>
+          simp [analyzeOffset] at found
+      | case scrutinee' peelNat' alternatives' =>
+          simp [analyzeOffset] at found
+      | letOp operation rest =>
+          simp only [analyzeOffset] at found
+          cases advanced :
+              advanceFacts declarations summaries root facts operation with
+          | error error =>
+              simp [advanced] at found
+          | ok nextFacts =>
+              rw [advanced] at found
+              simp only [bind, Except.bind] at found
+              simp only [analyzeToTerminal]
+              rw [advanced]
+              simp only [bind, Except.bind]
+              exact ih nextFacts rest found
+
+private def advanceAnalyzedPair (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot) :
+    List IxIR1.HPT.Fact × IxIR1.Code →
+      Except String (List IxIR1.HPT.Fact × IxIR1.Code)
+  | (facts, .letOp operation rest) => do
+      let facts ← advanceFacts declarations summaries root facts operation
+      return (facts, rest)
+  | _ => throw "IxIR₂ source-site offset exceeds its branch"
+
+/-- Replaying one additional source offset is exactly one transfer from the
+already replayed pair. This is the executable recurrence used by the dynamic
+site-environment invariant. -/
+private theorem analyzeOffset_succ (declarations : IxIR1.HPT.DeclEnv)
+    (summaries : IxIR1.HPT.SummaryEnv) (root : AnalysisRoot)
+    (offset : Nat) (facts : List IxIR1.HPT.Fact) (code : IxIR1.Code) :
+    analyzeOffset declarations summaries root (offset + 1) facts code =
+      (analyzeOffset declarations summaries root offset facts code).bind
+        (advanceAnalyzedPair declarations summaries root) := by
+  induction offset generalizing facts code with
+  | zero =>
+      cases code <;> rfl
+  | succ offset ih =>
+      cases code with
+      | ret atom => rfl
+      | case scrutinee peelNat alternatives => rfl
+      | letOp operation rest =>
+          simp only [analyzeOffset]
+          cases advanced :
+              advanceFacts declarations summaries root facts operation with
+          | error error => rfl
+          | ok nextFacts =>
+              simp only [bind, Except.bind]
+              exact ih nextFacts rest
+
+/-- Abstract environment and exact source suffix recovered at one lowering
+coordinate by path-local HPT replay. -/
+structure SiteFacts where
+  facts : List IxIR1.HPT.Fact
+  code : IxIR1.Code
+
+/-- Select one case alternative from an already recovered terminal site.
+This is the local transfer performed when the compiler changes from `site`
+to `site.alternative index`. -/
+def SiteFacts.alternative? (analyzed : SiteFacts)
+    (index : Nat) : Option SiteFacts :=
+  match selectAlternative analyzed.facts analyzed.code index with
+  | .ok (facts, code) => some { facts, code }
+  | .error _ => none
+
+def Sidecars.siteFacts? (sidecars : Sidecars)
+    (site : Lower.SourceSite) : Option SiteFacts := do
+  let root ← analysisRoot? sidecars site.owner
+  let declarations := IxIR1.Env.ofList sidecars.input.declarations
+  let summaries := sidecars.hptCertificate.summaryEnv
+  let (branchFacts, branchCode) ←
+    match analyzeBranchPath declarations summaries root root.facts root.code
+        site.branches with
+    | .ok result => some result
+    | .error _ => none
+  let (facts, code) ←
+    match analyzeOffset declarations summaries root site.offset branchFacts
+        branchCode with
+    | .ok result => some result
+    | .error _ => none
+  return { facts, code }
+
+/-- Whenever HPT replay succeeds, its retained code is the literal source
+suffix named by the same coordinate. -/
+theorem Sidecars.siteFacts?_sourceCodeAt (sidecars : Sidecars)
+    {site : Lower.SourceSite} {analyzed : SiteFacts}
+    (found : sidecars.siteFacts? site = some analyzed) :
+    sidecars.sourceCodeAt? site = some analyzed.code := by
+  unfold Sidecars.siteFacts? at found
+  cases rootEq : analysisRoot? sidecars site.owner with
+  | none =>
+      simp [rootEq] at found
+  | some root =>
+      rw [rootEq] at found
+      have rootCode := analysisRoot_sourceCode sidecars rootEq
+      cases branchEq : analyzeBranchPath
+          (IxIR1.Env.ofList sidecars.input.declarations)
+          sidecars.hptCertificate.summaryEnv root root.facts root.code
+          site.branches with
+      | error error =>
+          simp [branchEq] at found
+      | ok branchResult =>
+          obtain ⟨branchFacts, branchCode⟩ := branchResult
+          simp [branchEq] at found
+          have branchSource := analyzeBranchPath_code
+            (IxIR1.Env.ofList sidecars.input.declarations)
+            sidecars.hptCertificate.summaryEnv root root.facts root.code
+            site.branches branchFacts branchCode branchEq
+          cases offsetEq : analyzeOffset
+              (IxIR1.Env.ofList sidecars.input.declarations)
+              sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+              branchCode with
+          | error error =>
+              simp [offsetEq] at found
+          | ok offsetResult =>
+              obtain ⟨outputFacts, outputCode⟩ := offsetResult
+              simp [offsetEq] at found
+              have analyzedEq :
+                  ({ facts := outputFacts, code := outputCode } : SiteFacts) =
+                    analyzed := found
+              subst analyzed
+              have offsetSource := analyzeOffset_code
+                (IxIR1.Env.ofList sidecars.input.declarations)
+                sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+                branchCode outputFacts outputCode offsetEq
+              unfold Sidecars.sourceCodeAt? codeAtSite?
+              simp [rootCode, branchSource, offsetSource]
+
+/-- At a valid terminal case coordinate, appending one branch index to the
+source site is exactly local alternative selection from the recovered pair. -/
+theorem Sidecars.siteFacts?_alternative (sidecars : Sidecars)
+    {site : Lower.SourceSite} {index : Nat} {current : SiteFacts}
+    {scrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt}
+    (currentFound : sidecars.siteFacts? site = some current)
+    (codeAt : current.code = .case scrutinee peelNat alternatives) :
+    sidecars.siteFacts? (site.alternative index) =
+      current.alternative? index := by
+  unfold Sidecars.siteFacts? at currentFound ⊢
+  simp only [Lower.SourceSite.alternative]
+  cases rootEq : analysisRoot? sidecars site.owner with
+  | none =>
+      simp [rootEq] at currentFound
+  | some root =>
+      rw [rootEq] at currentFound
+      cases branchEq : analyzeBranchPath
+          (IxIR1.Env.ofList sidecars.input.declarations)
+          sidecars.hptCertificate.summaryEnv root root.facts root.code
+          site.branches with
+      | error error =>
+          simp [branchEq] at currentFound
+      | ok branchResult =>
+          obtain ⟨branchFacts, branchCode⟩ := branchResult
+          simp [branchEq] at currentFound
+          cases offsetEq : analyzeOffset
+              (IxIR1.Env.ofList sidecars.input.declarations)
+              sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+              branchCode with
+          | error error =>
+              simp [offsetEq] at currentFound
+          | ok currentResult =>
+              obtain ⟨currentFacts, currentCode⟩ := currentResult
+              simp [offsetEq] at currentFound
+              have currentEq :
+                  ({ facts := currentFacts, code := currentCode } : SiteFacts) =
+                    current := currentFound
+              subst current
+              have currentCodeEq : currentCode =
+                  .case scrutinee peelNat alternatives := codeAt
+              subst currentCode
+              have terminalEq := analyzeToTerminal_of_analyzeOffset_case
+                (IxIR1.Env.ofList sidecars.input.declarations)
+                sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+                branchCode currentFacts scrutinee peelNat alternatives offsetEq
+              simp only [bind, Option.bind]
+              rw [analyzeBranchPath_append, branchEq]
+              simp only [Except.bind]
+              simp [analyzeBranchPath, enterAlternative, terminalEq,
+                analyzeOffset, SiteFacts.alternative?]
+              cases selectedEq : selectAlternative currentFacts
+                  (.case scrutinee peelNat alternatives) index with
+              | error error =>
+                  simp
+              | ok selected =>
+                  obtain ⟨selectedFacts, selectedCode⟩ := selected
+                  simp
+
+/-- If replay has failed by a syntactically valid terminal case coordinate,
+the appended branch also fails closed.  In particular, branch entry cannot
+resurrect facts lost by an earlier abstract transfer. -/
+theorem Sidecars.siteFacts?_alternative_eq_none (sidecars : Sidecars)
+    {site : Lower.SourceSite} {index : Nat} {scrutinee : IxIR1.Atom}
+    {peelNat : Bool} {alternatives : Array IxIR1.Alt}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.case scrutinee peelNat alternatives))
+    (currentNone : sidecars.siteFacts? site = none) :
+    sidecars.siteFacts? (site.alternative index) = none := by
+  unfold Sidecars.sourceCodeAt? codeAtSite? at sourceAt
+  unfold Sidecars.siteFacts? at currentNone ⊢
+  simp only [Lower.SourceSite.alternative]
+  cases rootEq : analysisRoot? sidecars site.owner with
+  | none =>
+      simp
+  | some root =>
+      rw [rootEq] at currentNone
+      have rootCode := analysisRoot_sourceCode sidecars rootEq
+      simp [rootCode] at sourceAt
+      cases branchEq : analyzeBranchPath
+          (IxIR1.Env.ofList sidecars.input.declarations)
+          sidecars.hptCertificate.summaryEnv root root.facts root.code
+          site.branches with
+      | error error =>
+          simp only [bind, Option.bind]
+          rw [analyzeBranchPath_append, branchEq]
+          simp only [Except.bind]
+      | ok branchResult =>
+          obtain ⟨branchFacts, branchCode⟩ := branchResult
+          have branchSource := analyzeBranchPath_code
+            (IxIR1.Env.ofList sidecars.input.declarations)
+            sidecars.hptCertificate.summaryEnv root root.facts root.code
+            site.branches branchFacts branchCode branchEq
+          rw [branchSource] at sourceAt
+          simp only [Option.bind] at sourceAt
+          cases offsetEq : analyzeOffset
+              (IxIR1.Env.ofList sidecars.input.declarations)
+              sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+              branchCode with
+          | ok currentResult =>
+              obtain ⟨currentFacts, currentCode⟩ := currentResult
+              simp [branchEq, offsetEq] at currentNone
+          | error error =>
+              have terminalEq := analyzeToTerminal_eq_analyzeOffset_bind
+                (IxIR1.Env.ofList sidecars.input.declarations)
+                sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+                branchCode (.case scrutinee peelNat alternatives) sourceAt
+              rw [offsetEq] at terminalEq
+              simp only [Except.bind] at terminalEq
+              simp only [bind, Option.bind]
+              rw [analyzeBranchPath_append, branchEq]
+              simp only [Except.bind]
+              simp [analyzeBranchPath, enterAlternative, terminalEq]
+
+/-- At a syntactically valid case coordinate, branch replay is total as a
+fail-closed recurrence: either the current query is already `none`, or the
+selected local transfer determines the child query. -/
+theorem Sidecars.siteFacts?_alternative_of_sourceCodeAt (sidecars : Sidecars)
+    {site : Lower.SourceSite} {index : Nat} {scrutinee : IxIR1.Atom}
+    {peelNat : Bool} {alternatives : Array IxIR1.Alt}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.case scrutinee peelNat alternatives)) :
+    sidecars.siteFacts? (site.alternative index) =
+      (sidecars.siteFacts? site).bind
+        (fun current => current.alternative? index) := by
+  cases currentEq : sidecars.siteFacts? site with
+  | none =>
+      rw [sidecars.siteFacts?_alternative_eq_none sourceAt currentEq]
+      simp only [Option.bind]
+  | some current =>
+      have recoveredSource := sidecars.siteFacts?_sourceCodeAt currentEq
+      have codeAt : current.code =
+          .case scrutinee peelNat alternatives :=
+        Option.some.inj (recoveredSource.symm.trans sourceAt)
+      rw [sidecars.siteFacts?_alternative currentEq codeAt]
+      simp only [Option.bind]
+
+/-- Advance an already recovered site result by one linear source operation.
+`none` is the fail-closed state for a terminal suffix, a missing analysis
+root, or an abstract transfer error. -/
+def Sidecars.advanceSiteFacts? (sidecars : Sidecars)
+    (site : Lower.SourceSite) (analyzed : SiteFacts) : Option SiteFacts := do
+  let root ← analysisRoot? sidecars site.owner
+  let declarations := IxIR1.Env.ofList sidecars.input.declarations
+  let summaries := sidecars.hptCertificate.summaryEnv
+  let (facts, code) ←
+    match advanceAnalyzedPair declarations summaries root
+        (analyzed.facts, analyzed.code) with
+    | .ok result => some result
+    | .error _ => none
+  return { facts, code }
+
+/-- Path-local replay commutes with the compiler's linear source coordinate:
+querying `site.next` is the same as querying `site` and advancing its recovered
+pair once. -/
+theorem Sidecars.siteFacts?_next (sidecars : Sidecars)
+    (site : Lower.SourceSite) :
+    sidecars.siteFacts? site.next =
+      (sidecars.siteFacts? site).bind
+        (sidecars.advanceSiteFacts? site) := by
+  unfold Sidecars.siteFacts? Sidecars.advanceSiteFacts?
+  simp only [Lower.SourceSite.next]
+  cases rootEq : analysisRoot? sidecars site.owner with
+  | none =>
+      simp
+  | some root =>
+      cases branchEq : analyzeBranchPath
+          (IxIR1.Env.ofList sidecars.input.declarations)
+          sidecars.hptCertificate.summaryEnv root root.facts root.code
+          site.branches with
+      | error error =>
+          simp [branchEq]
+      | ok branchResult =>
+          obtain ⟨branchFacts, branchCode⟩ := branchResult
+          simp [branchEq]
+          rw [analyzeOffset_succ]
+          cases offsetEq : analyzeOffset
+              (IxIR1.Env.ofList sidecars.input.declarations)
+              sidecars.hptCertificate.summaryEnv root site.offset branchFacts
+              branchCode with
+          | error error =>
+              simp only [Except.bind]
+              simp only [Option.bind]
+          | ok offsetResult =>
+              obtain ⟨facts, code⟩ := offsetResult
+              cases advancedEq : advanceAnalyzedPair
+                  (IxIR1.Env.ofList sidecars.input.declarations)
+                  sidecars.hptCertificate.summaryEnv root (facts, code) with
+              | error error =>
+                  simp only [Except.bind, Option.bind]
+              | ok advanced =>
+                  obtain ⟨nextFacts, nextCode⟩ := advanced
+                  simp only [Except.bind, Option.bind]
+
+/-- Concrete interpretation of every recovered fact environment at one
+source coordinate. If replay has already failed closed, the predicate is
+vacuous and remains so at later linear coordinates. -/
+def Sidecars.SiteEnvironmentHolds (sidecars : Sidecars)
+    (store : IxIR1.Store) (site : Lower.SourceSite)
+    (values : List IxIR1.RVal) : Prop :=
+  ∀ analyzed, sidecars.siteFacts? site = some analyzed →
+    IxIR1.HPT.EnvironmentHolds
+      (IxIR1.Env.ofList sidecars.input.declarations)
+      store analyzed.facts values
+
+/-- Any recoverable function root starts with a concrete environment matching
+its top parameter facts.  This includes the closed synthetic main. -/
+theorem Sidecars.siteEnvironmentHolds_root (sidecars : Sidecars)
+    {owner : Validate.Owner} {current : IxIR1.FnDef}
+    {store : IxIR1.Store} {values : List IxIR1.RVal}
+    (currentAt : sidecars.analysisCurrent? owner = some current)
+    (valueCount : values.length = current.arity) :
+    sidecars.SiteEnvironmentHolds store
+      ({ owner := owner } : Lower.SourceSite) values := by
+  intro analyzed siteFound
+  unfold Sidecars.analysisCurrent? at currentAt
+  cases rootEq : analysisRoot? sidecars owner with
+  | none =>
+      simp [rootEq] at currentAt
+  | some root =>
+      rw [rootEq] at currentAt
+      have currentEq : root.current = current := Option.some.inj currentAt
+      subst current
+      unfold Sidecars.siteFacts? at siteFound
+      simp [rootEq, analyzeBranchPath, analyzeOffset] at siteFound
+      cases siteFound
+      rw [analysisRoot_facts sidecars rootEq, ← valueCount]
+      exact IxIR1.HPT.EnvironmentHolds.top_replicate
+        (IxIR1.Env.ofList sidecars.input.declarations) store values
+
+/-- The closed synthetic main begins with the empty concrete environment.
+If its reserved analysis owner collides with a summary, replay fails closed
+and the predicate is vacuous. -/
+theorem Sidecars.siteEnvironmentHolds_main (sidecars : Sidecars)
+    {store : IxIR1.Store} :
+    sidecars.SiteEnvironmentHolds store
+      ({ owner := .main } : Lower.SourceSite) [] := by
+  intro analyzed siteFound
+  unfold Sidecars.siteFacts? at siteFound
+  cases summaryEq :
+      sidecars.hptCertificate.summaryEnv mainAnalysisOwner with
+  | none =>
+      simp [analysisRoot?, summaryEq, analyzeBranchPath, analyzeOffset]
+        at siteFound
+      cases siteFound
+      exact IxIR1.HPT.EnvironmentHolds.nil
+  | some summary =>
+      simp [analysisRoot?, summaryEq] at siteFound
+
+/-- Entering a selected constructor alternative prepends the concrete fields
+in the evaluator's binder order and preserves the enclosing environment. -/
+theorem Sidecars.siteEnvironmentHolds_alternative_ctor_of_siteFacts
+    (sidecars : Sidecars)
+    {store : IxIR1.Store} {site : Lower.SourceSite}
+    {values : List IxIR1.RVal} {current : SiteFacts}
+    {scrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {index cidx fieldCount : Nat}
+    {body : IxIR1.Code} {location : Nat} {box : IxIR1.NodeBox}
+    {identity : CtorId} {fields : Array IxIR1.RVal}
+    (currentFound : sidecars.siteFacts? site = some current)
+    (codeAt : current.code = .case scrutinee peelNat alternatives)
+    (selected : alternatives[index]? =
+      some (.mk cidx fieldCount body))
+    (environment : sidecars.SiteEnvironmentHolds store site values)
+    (resolved : IxIR1.resolveAtom values scrutinee = .ok (.loc location))
+    (sourceGet : store.get? location = some box)
+    (node : box.node = .ctorN identity fields)
+    (tag : identity.cidx = cidx)
+    (fieldCountEq : fields.size = fieldCount) :
+    sidecars.SiteEnvironmentHolds store (site.alternative index)
+      (fields.toList.reverse ++ values) := by
+  intro next nextFound
+  rw [sidecars.siteFacts?_alternative currentFound codeAt] at nextFound
+  unfold SiteFacts.alternative? at nextFound
+  rw [codeAt] at nextFound
+  cases abstractEq : IxIR1.HPT.resolveAtomFact current.facts scrutinee with
+  | error error =>
+      simp [selectAlternative, abstractEq] at nextFound
+  | ok scrutineeFact =>
+      simp [selectAlternative, abstractEq, selected] at nextFound
+      cases nextFound
+      have currentEnvironment := environment current currentFound
+      have scrutineeHolds := IxIR1.HPT.resolveAtom_sound currentEnvironment
+        abstractEq resolved
+      exact
+        (IxIR1.HPT.Fact.caseFields_ctor_holds peelNat cidx fieldCount
+          scrutineeHolds sourceGet node tag fieldCountEq).append
+          currentEnvironment
+
+/-- The selected zero Nat alternative has no new binders, so its recovered
+environment is exactly the enclosing one. -/
+theorem Sidecars.siteEnvironmentHolds_alternative_natZero_of_siteFacts
+    (sidecars : Sidecars)
+    {store : IxIR1.Store} {site : Lower.SourceSite}
+    {values : List IxIR1.RVal} {current : SiteFacts}
+    {scrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {index : Nat} {body : IxIR1.Code}
+    (currentFound : sidecars.siteFacts? site = some current)
+    (codeAt : current.code = .case scrutinee true alternatives)
+    (selected : alternatives[index]? = some (.mk 0 0 body))
+    (environment : sidecars.SiteEnvironmentHolds store site values) :
+    sidecars.SiteEnvironmentHolds store (site.alternative index) values := by
+  intro next nextFound
+  rw [sidecars.siteFacts?_alternative currentFound codeAt] at nextFound
+  unfold SiteFacts.alternative? at nextFound
+  rw [codeAt] at nextFound
+  cases abstractEq : IxIR1.HPT.resolveAtomFact current.facts scrutinee with
+  | error error =>
+      simp [selectAlternative, abstractEq] at nextFound
+  | ok scrutineeFact =>
+      simp [selectAlternative, abstractEq, selected] at nextFound
+      cases nextFound
+      have currentEnvironment := environment current currentFound
+      have binders : IxIR1.HPT.EnvironmentHolds
+          (IxIR1.Env.ofList sidecars.input.declarations) store
+          (scrutineeFact.caseFields true 0 0) [] := by
+        simpa [IxIR1.HPT.Fact.caseFields,
+          IxIR1.HPT.Fact.joinFieldVectors] using
+          (IxIR1.HPT.EnvironmentHolds.nil :
+            IxIR1.HPT.EnvironmentHolds
+              (IxIR1.Env.ofList sidecars.input.declarations) store [] [])
+      exact binders.append currentEnvironment
+
+/-- The selected successor Nat alternative prepends the exact predecessor
+fact and value before the enclosing environment. -/
+theorem Sidecars.siteEnvironmentHolds_alternative_natSucc_of_siteFacts
+    (sidecars : Sidecars)
+    {store : IxIR1.Store} {site : Lower.SourceSite}
+    {values : List IxIR1.RVal} {current : SiteFacts}
+    {scrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {index predecessor : Nat} {body : IxIR1.Code}
+    (currentFound : sidecars.siteFacts? site = some current)
+    (codeAt : current.code = .case scrutinee true alternatives)
+    (selected : alternatives[index]? = some (.mk 1 1 body))
+    (environment : sidecars.SiteEnvironmentHolds store site values)
+    (resolved : IxIR1.resolveAtom values scrutinee =
+      .ok (.lit (.nat (predecessor + 1)))) :
+    sidecars.SiteEnvironmentHolds store (site.alternative index)
+      (.lit (.nat predecessor) :: values) := by
+  intro next nextFound
+  rw [sidecars.siteFacts?_alternative currentFound codeAt] at nextFound
+  unfold SiteFacts.alternative? at nextFound
+  rw [codeAt] at nextFound
+  cases abstractEq : IxIR1.HPT.resolveAtomFact current.facts scrutinee with
+  | error error =>
+      simp [selectAlternative, abstractEq] at nextFound
+  | ok scrutineeFact =>
+      simp [selectAlternative, abstractEq, selected] at nextFound
+      cases nextFound
+      have currentEnvironment := environment current currentFound
+      have scrutineeHolds := IxIR1.HPT.resolveAtom_sound currentEnvironment
+        abstractEq resolved
+      exact
+        (IxIR1.HPT.Fact.caseFields_natSucc_holds scrutineeHolds).append
+          currentEnvironment
+
+/-- Source-facing constructor branch transport. Earlier HPT failure is
+preserved as `none`; otherwise the concrete field vector satisfies the
+selected branch facts. -/
+theorem Sidecars.siteEnvironmentHolds_alternative_ctor (sidecars : Sidecars)
+    {store : IxIR1.Store} {site : Lower.SourceSite}
+    {values : List IxIR1.RVal} {scrutinee : IxIR1.Atom}
+    {peelNat : Bool} {alternatives : Array IxIR1.Alt}
+    {index cidx fieldCount : Nat} {body : IxIR1.Code}
+    {location : Nat} {box : IxIR1.NodeBox} {identity : CtorId}
+    {fields : Array IxIR1.RVal}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.case scrutinee peelNat alternatives))
+    (selected : alternatives[index]? =
+      some (.mk cidx fieldCount body))
+    (environment : sidecars.SiteEnvironmentHolds store site values)
+    (resolved : IxIR1.resolveAtom values scrutinee = .ok (.loc location))
+    (sourceGet : store.get? location = some box)
+    (node : box.node = .ctorN identity fields)
+    (tag : identity.cidx = cidx)
+    (fieldCountEq : fields.size = fieldCount) :
+    sidecars.SiteEnvironmentHolds store (site.alternative index)
+      (fields.toList.reverse ++ values) := by
+  cases currentEq : sidecars.siteFacts? site with
+  | none =>
+      intro next nextFound
+      rw [sidecars.siteFacts?_alternative_eq_none sourceAt currentEq]
+        at nextFound
+      contradiction
+  | some current =>
+      have recoveredSource := sidecars.siteFacts?_sourceCodeAt currentEq
+      have codeAt : current.code =
+          .case scrutinee peelNat alternatives :=
+        Option.some.inj (recoveredSource.symm.trans sourceAt)
+      exact sidecars.siteEnvironmentHolds_alternative_ctor_of_siteFacts
+        currentEq codeAt selected environment resolved sourceGet node tag
+        fieldCountEq
+
+/-- Source-facing zero Nat branch transport, including the fail-closed HPT
+case. -/
+theorem Sidecars.siteEnvironmentHolds_alternative_natZero
+    (sidecars : Sidecars)
+    {store : IxIR1.Store} {site : Lower.SourceSite}
+    {values : List IxIR1.RVal} {scrutinee : IxIR1.Atom}
+    {alternatives : Array IxIR1.Alt} {index : Nat} {body : IxIR1.Code}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.case scrutinee true alternatives))
+    (selected : alternatives[index]? = some (.mk 0 0 body))
+    (environment : sidecars.SiteEnvironmentHolds store site values) :
+    sidecars.SiteEnvironmentHolds store (site.alternative index) values := by
+  cases currentEq : sidecars.siteFacts? site with
+  | none =>
+      intro next nextFound
+      rw [sidecars.siteFacts?_alternative_eq_none sourceAt currentEq]
+        at nextFound
+      contradiction
+  | some current =>
+      have recoveredSource := sidecars.siteFacts?_sourceCodeAt currentEq
+      have codeAt : current.code = .case scrutinee true alternatives :=
+        Option.some.inj (recoveredSource.symm.trans sourceAt)
+      exact sidecars.siteEnvironmentHolds_alternative_natZero_of_siteFacts
+        currentEq codeAt selected environment
+
+/-- Source-facing successor Nat branch transport, including the fail-closed
+HPT case. -/
+theorem Sidecars.siteEnvironmentHolds_alternative_natSucc
+    (sidecars : Sidecars)
+    {store : IxIR1.Store} {site : Lower.SourceSite}
+    {values : List IxIR1.RVal} {scrutinee : IxIR1.Atom}
+    {alternatives : Array IxIR1.Alt} {index predecessor : Nat}
+    {body : IxIR1.Code}
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.case scrutinee true alternatives))
+    (selected : alternatives[index]? = some (.mk 1 1 body))
+    (environment : sidecars.SiteEnvironmentHolds store site values)
+    (resolved : IxIR1.resolveAtom values scrutinee =
+      .ok (.lit (.nat (predecessor + 1)))) :
+    sidecars.SiteEnvironmentHolds store (site.alternative index)
+      (.lit (.nat predecessor) :: values) := by
+  cases currentEq : sidecars.siteFacts? site with
+  | none =>
+      intro next nextFound
+      rw [sidecars.siteFacts?_alternative_eq_none sourceAt currentEq]
+        at nextFound
+      contradiction
+  | some current =>
+      have recoveredSource := sidecars.siteFacts?_sourceCodeAt currentEq
+      have codeAt : current.code = .case scrutinee true alternatives :=
+        Option.some.inj (recoveredSource.symm.trans sourceAt)
+      exact sidecars.siteEnvironmentHolds_alternative_natSucc_of_siteFacts
+        currentEq codeAt selected environment resolved
+
+/-- One successful concrete source operation transports the recovered HPT
+environment to `site.next`. Abstract failure remains `none`; abstract success
+uses operation soundness for the new head fact and forgets heap detail from
+the preserved tail. -/
+theorem Sidecars.siteEnvironmentHolds_next (sidecars : Sidecars)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {rest : IxIR1.Code}
+    (postFixpoint : IxIR1.HPT.LocalPostFixpoint
+      (IxIR1.Env.ofList sidecars.input.declarations)
+      sidecars.hptCertificate.summaryEnv)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.Env.ofList sidecars.input.declarations)
+    (currentAt : sidecars.analysisCurrent? site.owner = some sourceCurrent)
+    (environment : sidecars.SiteEnvironmentHolds sourceStore site source)
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.letOp operation rest))
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel sourceCurrent
+      sourceStore source operation = .ok (outputStore, value)) :
+    sidecars.SiteEnvironmentHolds outputStore site.next (value :: source) := by
+  intro nextAnalyzed nextFound
+  rw [sidecars.siteFacts?_next] at nextFound
+  cases currentEq : sidecars.siteFacts? site with
+  | none =>
+      rw [currentEq] at nextFound
+      contradiction
+  | some current =>
+      have currentEnvironment := environment current currentEq
+      have recoveredSource := sidecars.siteFacts?_sourceCodeAt currentEq
+      have codeEq : current.code = .letOp operation rest :=
+        Option.some.inj (recoveredSource.symm.trans sourceAt)
+      rw [currentEq] at nextFound
+      simp only [Option.bind] at nextFound
+      unfold Sidecars.advanceSiteFacts? at nextFound
+      cases rootEq : analysisRoot? sidecars site.owner with
+      | none =>
+          simp [rootEq] at nextFound
+      | some root =>
+          have currentRoot : root.current = sourceCurrent := by
+            unfold Sidecars.analysisCurrent? at currentAt
+            rw [rootEq] at currentAt
+            exact Option.some.inj currentAt
+          subst sourceCurrent
+          have ownerCompatible := analysisRoot_ownerCompatible sidecars rootEq
+          rw [codeEq] at nextFound
+          cases abstractEq : IxIR1.HPT.analyzeOp
+              (IxIR1.Env.ofList sidecars.input.declarations)
+              sidecars.hptCertificate.summaryEnv root.owner root.current
+              current.facts operation with
+          | error error =>
+              simp [rootEq, advanceAnalyzedPair, advanceFacts, abstractEq]
+                at nextFound
+              change none = some nextAnalyzed at nextFound
+              contradiction
+          | ok bound =>
+              simp [rootEq, advanceAnalyzedPair, advanceFacts, abstractEq]
+                at nextFound
+              change some
+                ({
+                  facts := bound ::
+                    current.facts.map IxIR1.HPT.Fact.forgetHeap
+                  code := rest
+                } : SiteFacts) = some nextAnalyzed at nextFound
+              cases nextFound
+              exact IxIR1.HPT.EnvironmentHolds.cons
+                (IxIR1.HPT.analyzeOp_sound_ownerCompatible postFixpoint
+                  sourceDeclarations ownerCompatible currentEnvironment
+                  abstractEq sourceRun)
+                currentEnvironment.forgetHeap
+
+/-- Linear transport only needs the concrete evaluator's current function to
+agree when path-local analysis actually has a root. If analysis fails closed
+for the owner, every site predicate is vacuous and remains so at `site.next`.
+This form covers the synthetic main even when its reserved analysis address
+collides with a declaration summary. -/
+theorem Sidecars.siteEnvironmentHolds_next_of_currentCompatible
+    (sidecars : Sidecars)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {rest : IxIR1.Code}
+    (postFixpoint : IxIR1.HPT.LocalPostFixpoint
+      (IxIR1.Env.ofList sidecars.input.declarations)
+      sidecars.hptCertificate.summaryEnv)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.Env.ofList sidecars.input.declarations)
+    (currentCompatible : ∀ current,
+      sidecars.analysisCurrent? site.owner = some current →
+        current = sourceCurrent)
+    (environment : sidecars.SiteEnvironmentHolds sourceStore site source)
+    (sourceAt : sidecars.sourceCodeAt? site =
+      some (.letOp operation rest))
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel sourceCurrent
+      sourceStore source operation = .ok (outputStore, value)) :
+    sidecars.SiteEnvironmentHolds outputStore site.next
+      (value :: source) := by
+  cases currentEq : sidecars.analysisCurrent? site.owner with
+  | some current =>
+      have currentMatches := currentCompatible current currentEq
+      subst current
+      exact sidecars.siteEnvironmentHolds_next postFixpoint
+        sourceDeclarations currentEq environment sourceAt sourceRun
+  | none =>
+      intro analyzed nextFound
+      unfold Sidecars.analysisCurrent? at currentEq
+      cases rootEq : analysisRoot? sidecars site.owner with
+      | none =>
+          unfold Sidecars.siteFacts? at nextFound
+          simp [Lower.SourceSite.next, rootEq] at nextFound
+      | some root =>
+          rw [rootEq] at currentEq
+          simp at currentEq
+
+/-- Resolve one source operand in the recovered site environment and retain it
+only when the abstract value has one exact constructor identity. -/
+def Sidecars.exactConstructorAt? (sidecars : Sidecars)
+    (site : Lower.SourceSite) (atom : IxIR1.Atom) :
+    Option (IxIR1.HPT.Fact × CtorId) := do
+  let analyzed ← sidecars.siteFacts? site
+  let fact ← match IxIR1.HPT.resolveAtomFact analyzed.facts atom with
+    | .ok fact => some fact
+    | .error _ => none
+  let identity ← fact.exactConstructor?
+  return (fact, identity)
+
+/-- Successful exact-constructor extraction exposes every checked executable
+premise needed to connect the chosen identity to HPT soundness. -/
+theorem Sidecars.exactConstructorAt?_eq_some (sidecars : Sidecars)
+    {site : Lower.SourceSite} {atom : IxIR1.Atom}
+    {fact : IxIR1.HPT.Fact} {identity : CtorId}
+    (found : sidecars.exactConstructorAt? site atom = some (fact, identity)) :
+    ∃ analyzed,
+      sidecars.siteFacts? site = some analyzed ∧
+        IxIR1.HPT.resolveAtomFact analyzed.facts atom = .ok fact ∧
+        fact.exactConstructor? = some identity := by
+  cases analyzedEq : sidecars.siteFacts? site with
+  | none =>
+      simp [Sidecars.exactConstructorAt?, analyzedEq] at found
+  | some analyzed =>
+      cases resolvedEq : IxIR1.HPT.resolveAtomFact analyzed.facts atom with
+      | error error =>
+          simp [Sidecars.exactConstructorAt?, analyzedEq, resolvedEq] at found
+      | ok resolved =>
+          cases exactEq : resolved.exactConstructor? with
+          | none =>
+              simp [Sidecars.exactConstructorAt?, analyzedEq, resolvedEq,
+                exactEq] at found
+          | some resolvedIdentity =>
+              simp [Sidecars.exactConstructorAt?, analyzedEq, resolvedEq,
+                exactEq] at found
+              rcases found with ⟨rfl, rfl⟩
+              exact ⟨analyzed, rfl, resolvedEq, exactEq⟩
+
+/-- An exact constructor selected by a source-site sidecar is the constructor
+stored at the concrete operand location whenever the replayed abstract
+environment describes the current source environment. -/
+theorem Sidecars.exactConstructorAt?_runtime (sidecars : Sidecars)
+    {site : Lower.SourceSite} {atom : IxIR1.Atom}
+    {fact : IxIR1.HPT.Fact} {identity : CtorId}
+    {declarations : IxIR1.HPT.DeclEnv} {store : IxIR1.Store}
+    {values : List IxIR1.RVal} {location : Nat}
+    (found : sidecars.exactConstructorAt? site atom = some (fact, identity))
+    (environment : ∀ analyzed,
+      sidecars.siteFacts? site = some analyzed →
+        IxIR1.HPT.EnvironmentHolds declarations store analyzed.facts values)
+    (resolved : IxIR1.resolveAtom values atom = .ok (.loc location)) :
+    ∃ box fields,
+      store.get? location = some box ∧
+        box.node = .ctorN identity fields := by
+  obtain ⟨analyzed, siteFound, abstractResolved, exact⟩ :=
+    sidecars.exactConstructorAt?_eq_some found
+  have factHolds := IxIR1.HPT.resolveAtom_sound
+    (environment analyzed siteFound) abstractResolved resolved
+  exact IxIR1.HPT.Fact.exactConstructor?_holds_loc exact factHolds
+
+/-- The constructor identity carried by any concrete node reached by the
+selected operand agrees with the exact identity chosen by the sidecar. -/
+theorem Sidecars.exactConstructorAt?_matches_node (sidecars : Sidecars)
+    {site : Lower.SourceSite} {atom : IxIR1.Atom}
+    {fact : IxIR1.HPT.Fact} {identity runtimeIdentity : CtorId}
+    {declarations : IxIR1.HPT.DeclEnv} {store : IxIR1.Store}
+    {values : List IxIR1.RVal} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array IxIR1.RVal}
+    (found : sidecars.exactConstructorAt? site atom = some (fact, identity))
+    (environment : ∀ analyzed,
+      sidecars.siteFacts? site = some analyzed →
+        IxIR1.HPT.EnvironmentHolds declarations store analyzed.facts values)
+    (resolved : IxIR1.resolveAtom values atom = .ok (.loc location))
+    (sourceGet : store.get? location = some box)
+    (node : box.node = .ctorN runtimeIdentity fields) :
+    runtimeIdentity = identity := by
+  obtain ⟨exactBox, exactFields, exactGet, exactNode⟩ :=
+    sidecars.exactConstructorAt?_runtime found environment resolved
+  have boxEq : exactBox = box :=
+    Option.some.inj (exactGet.symm.trans sourceGet)
+  subst exactBox
+  rw [node] at exactNode
+  injection exactNode
+
+/-- Resolve one source operand in the recovered site environment and retain it
+only when HPT describes one exact constructor whose complete field vector is
+scalar.  Unlike `exactConstructorAt?`, this is strong enough to justify the
+target evaluator's shallow-free side condition. -/
+def Sidecars.scalarLeafAt? (sidecars : Sidecars)
+    (site : Lower.SourceSite) (atom : IxIR1.Atom) :
+    Option (IxIR1.HPT.Fact × CtorId) := do
+  let analyzed ← sidecars.siteFacts? site
+  let fact ← match IxIR1.HPT.resolveAtomFact analyzed.facts atom with
+    | .ok fact => some fact
+    | .error _ => none
+  let leaf ← IxIR1.HPT.Destroy.exactLeaf? fact
+  return (fact, leaf.identity)
+
+/-- Successful scalar-leaf extraction exposes the checked HPT premises used
+by its concrete soundness theorem. -/
+theorem Sidecars.scalarLeafAt?_eq_some (sidecars : Sidecars)
+    {site : Lower.SourceSite} {atom : IxIR1.Atom}
+    {fact : IxIR1.HPT.Fact} {identity : CtorId}
+    (found : sidecars.scalarLeafAt? site atom = some (fact, identity)) :
+    ∃ analyzed leaf,
+      sidecars.siteFacts? site = some analyzed ∧
+        IxIR1.HPT.resolveAtomFact analyzed.facts atom = .ok fact ∧
+        IxIR1.HPT.Destroy.exactLeaf? fact = some leaf ∧
+        leaf.identity = identity := by
+  cases analyzedEq : sidecars.siteFacts? site with
+  | none =>
+      simp [Sidecars.scalarLeafAt?, analyzedEq] at found
+  | some analyzed =>
+      cases resolvedEq : IxIR1.HPT.resolveAtomFact analyzed.facts atom with
+      | error error =>
+          simp [Sidecars.scalarLeafAt?, analyzedEq, resolvedEq] at found
+      | ok resolved =>
+          cases leafEq : IxIR1.HPT.Destroy.exactLeaf? resolved with
+          | none =>
+              simp [Sidecars.scalarLeafAt?, analyzedEq, resolvedEq,
+                leafEq] at found
+          | some leaf =>
+              simp [Sidecars.scalarLeafAt?, analyzedEq, resolvedEq,
+                leafEq] at found
+              rcases found with ⟨rfl, rfl⟩
+              exact ⟨analyzed, leaf, rfl, resolvedEq, leafEq, rfl⟩
+
+/-- A scalar leaf selected by a source-site sidecar determines both the
+constructor and the all-scalar field condition of the concrete operand. -/
+theorem Sidecars.scalarLeafAt?_runtime (sidecars : Sidecars)
+    {site : Lower.SourceSite} {atom : IxIR1.Atom}
+    {fact : IxIR1.HPT.Fact} {identity : CtorId}
+    {declarations : IxIR1.HPT.DeclEnv} {store : IxIR1.Store}
+    {values : List IxIR1.RVal} {location : Nat}
+    (found : sidecars.scalarLeafAt? site atom = some (fact, identity))
+    (environment : ∀ analyzed,
+      sidecars.siteFacts? site = some analyzed →
+        IxIR1.HPT.EnvironmentHolds declarations store analyzed.facts values)
+    (resolved : IxIR1.resolveAtom values atom = .ok (.loc location)) :
+    ∃ box fields,
+      store.get? location = some box ∧
+        box.node = .ctorN identity fields ∧
+        fields.all IxIR1.RVal.isScalar = true := by
+  obtain ⟨analyzed, leaf, siteFound, abstractResolved, exactLeaf,
+      leafIdentity⟩ := sidecars.scalarLeafAt?_eq_some found
+  have factHolds := IxIR1.HPT.resolveAtom_sound
+    (environment analyzed siteFound) abstractResolved resolved
+  obtain ⟨runtimeLocation, box, fields, valueEq, sourceGet, node,
+      scalarFields⟩ :=
+    IxIR1.HPT.Destroy.exactLeaf?_holds exactLeaf factHolds
+  injection valueEq with locationEq
+  subst runtimeLocation
+  rw [leafIdentity] at node
+  exact ⟨box, fields, sourceGet, node, by simpa using scalarFields⟩
+
+/-- The stronger scalar-leaf lookup agrees with any concrete constructor node
+at the selected operand and simultaneously proves its field vector scalar. -/
+theorem Sidecars.scalarLeafAt?_matches_node (sidecars : Sidecars)
+    {site : Lower.SourceSite} {atom : IxIR1.Atom}
+    {fact : IxIR1.HPT.Fact} {identity runtimeIdentity : CtorId}
+    {declarations : IxIR1.HPT.DeclEnv} {store : IxIR1.Store}
+    {values : List IxIR1.RVal} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array IxIR1.RVal}
+    (found : sidecars.scalarLeafAt? site atom = some (fact, identity))
+    (environment : ∀ analyzed,
+      sidecars.siteFacts? site = some analyzed →
+        IxIR1.HPT.EnvironmentHolds declarations store analyzed.facts values)
+    (resolved : IxIR1.resolveAtom values atom = .ok (.loc location))
+    (sourceGet : store.get? location = some box)
+    (node : box.node = .ctorN runtimeIdentity fields) :
+    runtimeIdentity = identity ∧ fields.all IxIR1.RVal.isScalar = true := by
+  obtain ⟨exactBox, exactFields, exactGet, exactNode, scalarFields⟩ :=
+    sidecars.scalarLeafAt?_runtime found environment resolved
+  have boxEq : exactBox = box :=
+    Option.some.inj (exactGet.symm.trans sourceGet)
+  subst exactBox
+  have constructorEq :
+      (.ctorN runtimeIdentity fields : IxIR1.Node) =
+        .ctorN identity exactFields := node.symm.trans exactNode
+  injection constructorEq with identityEq fieldsEq
+  subst identity
+  subst exactFields
+  exact ⟨rfl, scalarFields⟩
+
+private def constructorInfo? (sidecars : Sidecars) (identity : CtorId) :
+    Option ConstructorInfo :=
+  sidecars.constructors.find? fun info => info.identity == identity
+
+def Sidecars.fetchCtor? (sidecars : Sidecars)
+    (site : Lower.SourceSite) : Option CtorId := do
+  let analyzed ← sidecars.siteFacts? site
+  match analyzed.code with
+  | .letOp (.fetch target field) _ => do
+      let (_, identity) ← sidecars.exactConstructorAt? site target
+      let info ← constructorInfo? sidecars identity
+      if field < info.arity then some identity else none
+  | _ => none
+
+def Sidecars.scalarFreeCtor? (sidecars : Sidecars)
+    (site : Lower.SourceSite) : Option CtorId := do
+  let analyzed ← sidecars.siteFacts? site
+  match analyzed.code with
+  | .letOp (.free target) _ => do
+      let (_, identity) ← sidecars.scalarLeafAt? site target
+      let info ← constructorInfo? sidecars identity
+      if info.arity == 0 then some identity else none
+  | _ => none
+
+def Sidecars.caseCtors (sidecars : Sidecars) (site : Lower.SourceSite)
+    (alternative : Nat) : List CtorId :=
+  match codeAtSite? sidecars.input site with
+  | some (.case scrutinee _ alternatives) =>
+      match alternatives[alternative]? with
+      | some (.mk tag fields _) =>
+          match sidecars.exactConstructorAt? site scrutinee with
+          | some (_, identity) =>
+              match constructorInfo? sidecars identity with
+              | some info =>
+                  if identity.cidx == tag && info.arity == fields then
+                    [identity]
+                  else
+                    []
+              | none => []
+          | none =>
+              (sidecars.constructors.filter fun info =>
+                info.identity.cidx == tag && info.arity == fields).map
+                  (·.identity) |>.eraseDups
+      | none => []
+  | _ => []
+
+/-- The exact lowering context computed for this attachment. Case lowering
+prefers an exact path-local HPT identity and otherwise emits every
+producer-known full identity matching the erased source tag and arity.
+Projection and shallow-free facts remain deliberately partial and fail closed
+when their identity is ambiguous. -/
+def Sidecars.context (sidecars : Sidecars) (maxDepth : Nat := 100000) :
+    Lower.Context :=
+  { parameterWorlds := lookupParameterWorlds sidecars.parameterEntries
+    schemas := schema? sidecars.constructors
+    fetchCtor := sidecars.fetchCtor?
+    scalarFreeCtor := sidecars.scalarFreeCtor?
+    caseCtors := sidecars.caseCtors
+    allowExtern := false
+    maxDepth }
+
+/-! ## Extern-free trace coverage
+
+The attachment's lowering context disables scalar extern boundaries.  Retain
+that fail-closed decision as a recursive trace certificate so the semantic
+worker can eliminate an apparent successful source `extern` branch without
+replaying the compiler or validator. -/
+
+mutual
+
+/-- No recursive node in one compiler trace contains a source extern
+operation. -/
+def Sidecars.codeExternFree (_sidecars : Sidecars) : Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ (.extern _ _) _ _ _ => false
+  | .letOp _ _ _ _ _ _ _ _ next => _sidecars.codeExternFree next
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      _sidecars.codeExternFreeList children
+
+private def Sidecars.codeExternFreeList (sidecars : Sidecars) :
+    List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: traces =>
+      sidecars.codeExternFree trace && sidecars.codeExternFreeList traces
+
+end
+
+/-- Whole-trace extern exclusion checked at attachment time. -/
+def Sidecars.traceExternFree (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.codeExternFree functionTrace.root
+
+private theorem Sidecars.codeExternFreeList_of_mem (sidecars : Sidecars)
+    {traces : List Lower.CodeTrace} {trace : Lower.CodeTrace}
+    (matched : sidecars.codeExternFreeList traces = true)
+    (member : trace ∈ traces) :
+    sidecars.codeExternFree trace = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.codeExternFreeList, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Extern exclusion is inherited by every immediate recursive child. -/
+theorem Sidecars.codeExternFree_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (matched : sidecars.codeExternFree parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.codeExternFree child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      cases operation <;>
+        simp_all [Sidecars.codeExternFree]
+  | switchValue site block input entryValueCount scrutinee peel alternatives
+      target generated outgoing children =>
+      exact sidecars.codeExternFreeList_of_mem matched member
+
+/-- Extern exclusion is inherited by every recursive descendant. -/
+theorem Sidecars.codeExternFree_descendant (sidecars : Sidecars)
+    {root child : Lower.CodeTrace}
+    (matched : sidecars.codeExternFree root = true)
+    (descendant : root.Descendant child) :
+    sidecars.codeExternFree child = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.codeExternFree_of_child ih childMember
+
+/-- Whole-trace extern exclusion selects any retained function root. -/
+theorem Sidecars.functionCodeExternFree (sidecars : Sidecars)
+    {trace : Lower.Trace} {functionTrace : Lower.FunctionTrace}
+    (matched : sidecars.traceExternFree trace = true)
+    (member : functionTrace ∈ trace.functions) :
+    sidecars.codeExternFree functionTrace.root = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-! ## Scalar-leaf trace coverage
+
+The lowerer records a validator fact for every emitted `freeUnique`.  The
+following independent executable check ties every such recursive trace node
+back to the stronger HPT scalar-leaf lookup used by `scalarFreeCtor?`.  Its
+reflected descendant theorem lets simulation recover that semantic evidence
+from attachment membership instead of accepting it from a caller. -/
+
+private def Sidecars.scalarLeafInstructionMatches (sidecars : Sidecars)
+    (site : Lower.SourceSite) : IxIR1.Op → Instr → Bool
+  | .free source, .freeUnique _ identity =>
+      match sidecars.scalarLeafAt? site source with
+      | some (_, selectedIdentity) => selectedIdentity == identity
+      | none => false
+  | _, _ => true
+
+mutual
+
+/-- Every shallow-free node in one recursive compiler trace has exact
+all-scalar HPT evidence at its literal source coordinate. -/
+def Sidecars.codeScalarLeavesMatch (sidecars : Sidecars) :
+    Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp site _ _ _ _ operation _ instruction next =>
+      sidecars.scalarLeafInstructionMatches site operation instruction &&
+        sidecars.codeScalarLeavesMatch next
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      sidecars.codeScalarLeafListMatches children
+
+private def Sidecars.codeScalarLeafListMatches (sidecars : Sidecars) :
+    List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: traces =>
+      sidecars.codeScalarLeavesMatch trace &&
+        sidecars.codeScalarLeafListMatches traces
+
+end
+
+/-- Whole-trace scalar-leaf coverage checked at attachment time. -/
+def Sidecars.traceScalarLeavesMatch (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.codeScalarLeavesMatch functionTrace.root
+
+private theorem Sidecars.codeScalarLeafListMatch_of_mem
+    (sidecars : Sidecars) {traces : List Lower.CodeTrace}
+    {trace : Lower.CodeTrace}
+    (matched : sidecars.codeScalarLeafListMatches traces = true)
+    (member : trace ∈ traces) :
+    sidecars.codeScalarLeavesMatch trace = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.codeScalarLeafListMatches, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Scalar-leaf coverage is inherited by every immediate recursive compiler
+call. -/
+theorem Sidecars.codeScalarLeavesMatch_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (matched : sidecars.codeScalarLeavesMatch parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.codeScalarLeavesMatch child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      simp only [Sidecars.codeScalarLeavesMatch, Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue site block input entryValueCount scrutinee peel alternatives
+      target generated outgoing children =>
+      exact sidecars.codeScalarLeafListMatch_of_mem matched member
+
+/-- Scalar-leaf coverage is inherited by every recursive descendant. -/
+theorem Sidecars.codeScalarLeavesMatch_descendant (sidecars : Sidecars)
+    {root child : Lower.CodeTrace}
+    (matched : sidecars.codeScalarLeavesMatch root = true)
+    (descendant : root.Descendant child) :
+    sidecars.codeScalarLeavesMatch child = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.codeScalarLeavesMatch_of_child ih childMember
+
+/-- Whole-trace coverage selects any retained function root. -/
+theorem Sidecars.functionCodeScalarLeavesMatch (sidecars : Sidecars)
+    {trace : Lower.Trace} {functionTrace : Lower.FunctionTrace}
+    (matched : sidecars.traceScalarLeavesMatch trace = true)
+    (member : functionTrace ∈ trace.functions) :
+    sidecars.codeScalarLeavesMatch functionTrace.root = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Reflection at one shallow-free trace node recovers the exact HPT fact and
+constructor identity consumed by its target instruction. -/
+theorem Sidecars.scalarLeafAt?_of_codeScalarLeavesMatch
+    (sidecars : Sidecars)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {identity : CtorId}
+    {next : Lower.CodeTrace}
+    (matched : sidecars.codeScalarLeavesMatch
+      (.letOp site block input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom identity) next) = true) :
+    ∃ fact,
+      sidecars.scalarLeafAt? site sourceAtom = some (fact, identity) := by
+  simp only [Sidecars.codeScalarLeavesMatch, Bool.and_eq_true] at matched
+  have head := matched.1
+  unfold Sidecars.scalarLeafInstructionMatches at head
+  cases selected : sidecars.scalarLeafAt? site sourceAtom with
+  | none => simp [selected] at head
+  | some pair =>
+      obtain ⟨fact, selectedIdentity⟩ := pair
+      have identityEq : selectedIdentity = identity := by
+        exact (beq_iff_eq.mp (by simpa [selected] using head))
+      exact ⟨fact, by simp [identityEq]⟩
+
+/-! ## Exact-fetch trace coverage
+
+The lowering context selects source projections from exact HPT constructor
+facts.  This independent recursive check records that every retained source
+fetch uses that same identity, so attachment-facing simulation can recover the
+erased constructor fact from trace membership alone. -/
+
+private def Sidecars.exactFetchInstructionMatches (sidecars : Sidecars)
+    (site : Lower.SourceSite) : IxIR1.Op → Instr → Bool
+  | .fetch source _, .fetch _ identity _ =>
+      match sidecars.exactConstructorAt? site source with
+      | some (_, selectedIdentity) => selectedIdentity == identity
+      | none => false
+  | _, _ => true
+
+mutual
+
+/-- Every source-fetch node in one recursive compiler trace retains exact HPT
+constructor evidence at its literal source coordinate. -/
+def Sidecars.codeExactFetchesMatch (sidecars : Sidecars) :
+    Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp site _ _ _ _ operation _ instruction next =>
+      sidecars.exactFetchInstructionMatches site operation instruction &&
+        sidecars.codeExactFetchesMatch next
+  | .switchValue _ _ _ _ _ _ _ _ _ _ children =>
+      sidecars.codeExactFetchListMatches children
+
+private def Sidecars.codeExactFetchListMatches (sidecars : Sidecars) :
+    List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: traces =>
+      sidecars.codeExactFetchesMatch trace &&
+        sidecars.codeExactFetchListMatches traces
+
+end
+
+/-- Whole-trace exact-fetch coverage checked at attachment time. -/
+def Sidecars.traceExactFetchesMatch (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.codeExactFetchesMatch functionTrace.root
+
+private theorem Sidecars.codeExactFetchListMatch_of_mem
+    (sidecars : Sidecars) {traces : List Lower.CodeTrace}
+    {trace : Lower.CodeTrace}
+    (matched : sidecars.codeExactFetchListMatches traces = true)
+    (member : trace ∈ traces) :
+    sidecars.codeExactFetchesMatch trace = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.codeExactFetchListMatches, Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Exact-fetch coverage is inherited by every immediate recursive compiler
+call. -/
+theorem Sidecars.codeExactFetchesMatch_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (matched : sidecars.codeExactFetchesMatch parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.codeExactFetchesMatch child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      simp only [Sidecars.codeExactFetchesMatch, Bool.and_eq_true] at matched
+      exact matched.2
+  | switchValue site block input entryValueCount scrutinee peel alternatives
+      target generated outgoing children =>
+      exact sidecars.codeExactFetchListMatch_of_mem matched member
+
+/-- Exact-fetch coverage is inherited by every recursive descendant. -/
+theorem Sidecars.codeExactFetchesMatch_descendant (sidecars : Sidecars)
+    {root child : Lower.CodeTrace}
+    (matched : sidecars.codeExactFetchesMatch root = true)
+    (descendant : root.Descendant child) :
+    sidecars.codeExactFetchesMatch child = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.codeExactFetchesMatch_of_child ih childMember
+
+/-- Whole-trace exact-fetch coverage selects any retained function root. -/
+theorem Sidecars.functionCodeExactFetchesMatch (sidecars : Sidecars)
+    {trace : Lower.Trace} {functionTrace : Lower.FunctionTrace}
+    (matched : sidecars.traceExactFetchesMatch trace = true)
+    (member : functionTrace ∈ trace.functions) :
+    sidecars.codeExactFetchesMatch functionTrace.root = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Reflection at one source-fetch trace node recovers the exact HPT fact and
+constructor identity consumed by its target instruction. -/
+theorem Sidecars.exactConstructorAt?_of_codeExactFetchesMatch
+    (sidecars : Sidecars)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {sourceField : Nat}
+    {targetAtom : Atom} {targetField : Nat} {identity : CtorId}
+    {next : Lower.CodeTrace}
+    (matched : sidecars.codeExactFetchesMatch
+      (.letOp site block input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom identity targetField) next) = true) :
+    ∃ fact,
+      sidecars.exactConstructorAt? site sourceAtom =
+        some (fact, identity) := by
+  simp only [Sidecars.codeExactFetchesMatch, Bool.and_eq_true] at matched
+  have head := matched.1
+  unfold Sidecars.exactFetchInstructionMatches at head
+  cases selected : sidecars.exactConstructorAt? site sourceAtom with
+  | none => simp [selected] at head
+  | some pair =>
+      obtain ⟨fact, selectedIdentity⟩ := pair
+      have identityEq : selectedIdentity = identity := by
+        exact (beq_iff_eq.mp (by simpa [selected] using head))
+      exact ⟨fact, by simp [identityEq]⟩
+
+/-! ## Exact-constructor switch coverage
+
+When path-local HPT has already reduced a case scrutinee to one constructor,
+the emitted switch must contain that exact identity.  This check is separate
+from structural switch coherence: it connects the erased source operand fact
+to the concrete constructor table retained by the target terminator.  Cases
+whose HPT fact is not exact remain deliberately unconstrained here and are
+handled by the residual dynamic coverage contract in `PipelineSim`.
+-/
+
+private def Sidecars.exactCaseTargetMatches (sidecars : Sidecars)
+    (site : Lower.SourceSite) (sourceScrutinee : IxIR1.Atom)
+    (generated : Block) : Bool :=
+  match sidecars.exactConstructorAt? site sourceScrutinee with
+  | none => true
+  | some (_, identity) =>
+      match generated.terminator with
+      | .switchValue _ constructors _ =>
+          (constructors.find? fun target => target.cid == identity).isSome
+      | _ => false
+
+mutual
+
+/-- Every exact-HPT case in one recursive compiler trace has a target branch
+for the selected constructor identity. -/
+def Sidecars.codeExactCaseTargetsMatch (sidecars : Sidecars) :
+    Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ _ _ _ next =>
+      sidecars.codeExactCaseTargetsMatch next
+  | .switchValue site _ _ _ sourceScrutinee _ _ _ generated _ children =>
+      sidecars.exactCaseTargetMatches site sourceScrutinee generated &&
+        sidecars.codeExactCaseTargetListMatches children
+
+private def Sidecars.codeExactCaseTargetListMatches (sidecars : Sidecars) :
+    List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: traces =>
+      sidecars.codeExactCaseTargetsMatch trace &&
+        sidecars.codeExactCaseTargetListMatches traces
+
+end
+
+/-- Whole-trace exact-HPT constructor-switch coverage checked at attachment
+time. -/
+def Sidecars.traceExactCaseTargetsMatch (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.codeExactCaseTargetsMatch functionTrace.root
+
+private theorem Sidecars.codeExactCaseTargetListMatch_of_mem
+    (sidecars : Sidecars) {traces : List Lower.CodeTrace}
+    {trace : Lower.CodeTrace}
+    (matched : sidecars.codeExactCaseTargetListMatches traces = true)
+    (member : trace ∈ traces) :
+    sidecars.codeExactCaseTargetsMatch trace = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.codeExactCaseTargetListMatches,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Exact-case coverage is inherited by every immediate recursive compiler
+call. -/
+theorem Sidecars.codeExactCaseTargetsMatch_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (matched : sidecars.codeExactCaseTargetsMatch parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.codeExactCaseTargetsMatch child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      exact matched
+  | switchValue site block input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [Sidecars.codeExactCaseTargetsMatch,
+        Bool.and_eq_true] at matched
+      exact sidecars.codeExactCaseTargetListMatch_of_mem matched.2 member
+
+/-- Exact-case coverage is inherited by every recursive descendant. -/
+theorem Sidecars.codeExactCaseTargetsMatch_descendant (sidecars : Sidecars)
+    {root child : Lower.CodeTrace}
+    (matched : sidecars.codeExactCaseTargetsMatch root = true)
+    (descendant : root.Descendant child) :
+    sidecars.codeExactCaseTargetsMatch child = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.codeExactCaseTargetsMatch_of_child ih childMember
+
+/-- Whole-trace exact-case coverage selects any retained function root. -/
+theorem Sidecars.functionCodeExactCaseTargetsMatch (sidecars : Sidecars)
+    {trace : Lower.Trace} {functionTrace : Lower.FunctionTrace}
+    (matched : sidecars.traceExactCaseTargetsMatch trace = true)
+    (member : functionTrace ∈ trace.functions) :
+    sidecars.codeExactCaseTargetsMatch functionTrace.root = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Reflection at one switch node recovers an emitted target for the exact
+constructor selected by HPT. -/
+theorem Sidecars.exactCaseTarget_of_codeExactCaseTargetsMatch
+    (sidecars : Sidecars)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {fact : IxIR1.HPT.Fact}
+    {identity : CtorId} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel}
+    (matched : sidecars.codeExactCaseTargetsMatch
+      (.switchValue site block input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children) = true)
+    (selected : sidecars.exactConstructorAt? site sourceScrutinee =
+      some (fact, identity))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors natPeel) :
+    ∃ target, constructors.find? (fun candidate =>
+      candidate.cid == identity) = some target := by
+  simp only [Sidecars.codeExactCaseTargetsMatch,
+    Bool.and_eq_true] at matched
+  have localMatch := matched.1
+  unfold Sidecars.exactCaseTargetMatches at localMatch
+  rw [selected, terminator] at localMatch
+  cases found : constructors.find? (fun candidate =>
+      candidate.cid == identity) with
+  | none => simp [found] at localMatch
+  | some target => exact ⟨target, rfl⟩
+
+/-! ## Residual constructor-switch coverage
+
+When path-local HPT is not exact, IxIR₁ may still select any producer-known
+constructor with the alternative's erased tag and arity. The baseline lowerer
+emits each of those full identities. This independent attachment check records
+that coverage over the retained recursive trace. -/
+
+private def Sidecars.residualConstructorTargetMatches
+    (constructors : Array CtorAlt) (alternative : IxIR1.Alt)
+    (info : ConstructorInfo) : Bool :=
+  match alternative with
+  | .mk tag fields _ =>
+      if info.identity.cidx == tag && info.arity == fields then
+        (constructors.find? fun target => target.cid == info.identity).isSome
+      else
+        true
+
+private def Sidecars.residualCaseTargetsMatch (sidecars : Sidecars)
+    (site : Lower.SourceSite) (sourceScrutinee : IxIR1.Atom)
+    (alternatives : Array IxIR1.Alt) (generated : Block) : Bool :=
+  match sidecars.exactConstructorAt? site sourceScrutinee with
+  | some _ => true
+  | none =>
+      match generated.terminator with
+      | .switchValue _ constructors _ =>
+          alternatives.toList.all fun alternative =>
+            sidecars.constructors.all fun info =>
+              Sidecars.residualConstructorTargetMatches constructors
+                alternative info
+      | _ => false
+
+mutual
+
+/-- Every HPT-ambiguous case in one recursive compiler trace covers every
+producer-known constructor compatible with its selected IxIR₁ arm. -/
+def Sidecars.codeResidualCaseTargetsMatch (sidecars : Sidecars) :
+    Lower.CodeTrace → Bool
+  | .ret .. | .tailCall .. | .tailCallSelf .. => true
+  | .letOp _ _ _ _ _ _ _ _ next =>
+      sidecars.codeResidualCaseTargetsMatch next
+  | .switchValue site _ _ _ sourceScrutinee _ alternatives _ generated _
+      children =>
+      sidecars.residualCaseTargetsMatch site sourceScrutinee alternatives
+          generated &&
+        sidecars.codeResidualCaseTargetListMatches children
+
+private def Sidecars.codeResidualCaseTargetListMatches
+    (sidecars : Sidecars) : List Lower.CodeTrace → Bool
+  | [] => true
+  | trace :: traces =>
+      sidecars.codeResidualCaseTargetsMatch trace &&
+        sidecars.codeResidualCaseTargetListMatches traces
+
+end
+
+/-- Whole-trace residual constructor-switch coverage checked at attachment
+time. -/
+def Sidecars.traceResidualCaseTargetsMatch (sidecars : Sidecars)
+    (trace : Lower.Trace) : Bool :=
+  trace.functions.all fun functionTrace =>
+    sidecars.codeResidualCaseTargetsMatch functionTrace.root
+
+private theorem Sidecars.codeResidualCaseTargetListMatch_of_mem
+    (sidecars : Sidecars) {traces : List Lower.CodeTrace}
+    {trace : Lower.CodeTrace}
+    (matched : sidecars.codeResidualCaseTargetListMatches traces = true)
+    (member : trace ∈ traces) :
+    sidecars.codeResidualCaseTargetsMatch trace = true := by
+  induction traces with
+  | nil => simp at member
+  | cons head tail ih =>
+      simp only [Sidecars.codeResidualCaseTargetListMatches,
+        Bool.and_eq_true] at matched
+      simp only [List.mem_cons] at member
+      cases member with
+      | inl equal => simpa [equal] using matched.1
+      | inr member => exact ih matched.2 member
+
+/-- Residual-case coverage is inherited by every immediate recursive
+compiler call. -/
+theorem Sidecars.codeResidualCaseTargetsMatch_of_child (sidecars : Sidecars)
+    {parent child : Lower.CodeTrace}
+    (matched : sidecars.codeResidualCaseTargetsMatch parent = true)
+    (member : child ∈ parent.children) :
+    sidecars.codeResidualCaseTargetsMatch child = true := by
+  cases parent with
+  | ret _ _ _ _ _ _ _ | tailCall _ _ _ _ _ _ _
+  | tailCallSelf _ _ _ _ _ _ =>
+      simp [Lower.CodeTrace.children] at member
+  | letOp site block input nextInput entryValueCount operation index
+      instruction next =>
+      simp [Lower.CodeTrace.children] at member
+      subst child
+      exact matched
+  | switchValue site block input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [Sidecars.codeResidualCaseTargetsMatch,
+        Bool.and_eq_true] at matched
+      exact sidecars.codeResidualCaseTargetListMatch_of_mem matched.2 member
+
+/-- Residual-case coverage is inherited by every recursive descendant. -/
+theorem Sidecars.codeResidualCaseTargetsMatch_descendant
+    (sidecars : Sidecars) {root child : Lower.CodeTrace}
+    (matched : sidecars.codeResidualCaseTargetsMatch root = true)
+    (descendant : root.Descendant child) :
+    sidecars.codeResidualCaseTargetsMatch child = true := by
+  induction descendant with
+  | refl => exact matched
+  | @step parent child parentDescendant childMember ih =>
+      exact sidecars.codeResidualCaseTargetsMatch_of_child ih childMember
+
+/-- Whole-trace residual coverage selects any retained function root. -/
+theorem Sidecars.functionCodeResidualCaseTargetsMatch (sidecars : Sidecars)
+    {trace : Lower.Trace} {functionTrace : Lower.FunctionTrace}
+    (matched : sidecars.traceResidualCaseTargetsMatch trace = true)
+    (member : functionTrace ∈ trace.functions) :
+    sidecars.codeResidualCaseTargetsMatch functionTrace.root = true :=
+  List.all_eq_true.mp matched functionTrace member
+
+/-- Reflection at one HPT-ambiguous switch: any producer constructor matching
+the concrete source arm has a corresponding emitted target. -/
+theorem Sidecars.residualCaseTarget_of_codeResidualCaseTargetsMatch
+    (sidecars : Sidecars)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {identity : CtorId}
+    {arity alternativeIndex : Nat} {body : IxIR1.Code}
+    {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+    (matched : sidecars.codeResidualCaseTargetsMatch
+      (.switchValue site block input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children) = true)
+    (ambiguous : sidecars.exactConstructorAt? site sourceScrutinee = none)
+    (known : ∃ info ∈ sidecars.constructors,
+      info.identity = identity ∧ info.arity = arity)
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives
+      identity.cidx = some
+        (.mk identity.cidx arity body, alternativeIndex))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors natPeel) :
+    ∃ target, constructors.find? (fun candidate =>
+      candidate.cid == identity) = some target := by
+  simp only [Sidecars.codeResidualCaseTargetsMatch,
+    Bool.and_eq_true] at matched
+  have localMatch := matched.1
+  unfold Sidecars.residualCaseTargetsMatch at localMatch
+  rw [ambiguous, terminator] at localMatch
+  obtain ⟨info, infoMember, infoIdentity, infoArity⟩ := known
+  have alternativeAt : alternatives[alternativeIndex]? =
+      some (.mk identity.cidx arity body) :=
+    Lower.sourceAlternativeAtTag?_getElem? sourceAlternative
+  have alternativeMember : (.mk identity.cidx arity body : IxIR1.Alt) ∈
+      alternatives.toList := by
+    simpa using
+      (Array.mem_iff_getElem?.mpr ⟨alternativeIndex, alternativeAt⟩)
+  have alternativeMatch := List.all_eq_true.mp localMatch
+    (.mk identity.cidx arity body) alternativeMember
+  have infoMatch := List.all_eq_true.mp alternativeMatch info infoMember
+  unfold Sidecars.residualConstructorTargetMatches at infoMatch
+  rw [infoIdentity, infoArity] at infoMatch
+  simp only [beq_self_eq_true, Bool.true_and, if_true] at infoMatch
+  cases found : constructors.find? (fun candidate =>
+      candidate.cid == identity) with
+  | none => simp [found] at infoMatch
+  | some target => exact ⟨target, rfl⟩
+
+/-- Every constructor schema emitted by the baseline pipeline is uniform in
+the ownership world used to look it up. This is the static fact consumed by
+the allocation-simulation proof to discharge the evaluator's field checks. -/
+theorem Sidecars.schema_fields_replicate (sidecars : Sidecars)
+    {maxDepth : Nat} {world : Owned} {identity : CtorId}
+    {schema : CtorSchema}
+    (found : (sidecars.context maxDepth).schemas world identity =
+      some schema) :
+    ∃ count, schema.fields = Array.replicate count world := by
+  change schema? sidecars.constructors world identity = some schema at found
+  unfold schema? at found
+  cases lookup : sidecars.constructors.find?
+      (fun candidate => candidate.identity == identity) with
+  | none => simp [lookup] at found
+  | some info =>
+      simp [lookup] at found
+      subst schema
+      exact ⟨info.arity, rfl⟩
+
+/-- A constructor-universe witness and a schema lookup share the same
+identity-indexed sidecar row, so the runtime node arity is the schema arity. -/
+theorem Sidecars.schema_fields_of_constructorKnown (sidecars : Sidecars)
+    {maxDepth : Nat} {world : Owned} {identity : CtorId} {arity : Nat}
+    {schema : CtorSchema}
+    (known : sidecars.constructorKnown identity arity = true)
+    (found : (sidecars.context maxDepth).schemas world identity = some schema) :
+    schema.fields = Array.replicate arity world := by
+  change schema? sidecars.constructors world identity = some schema at found
+  unfold schema? at found
+  unfold Sidecars.constructorKnown at known
+  cases lookup : sidecars.constructors.find?
+      (fun candidate => candidate.identity == identity) with
+  | none => simp [lookup] at known
+  | some info =>
+      simp [lookup] at found known
+      subst schema
+      simpa [known]
+
+/-- Sidecars paired with the checked HPT production from which their
+interprocedural facts were taken. -/
+structure BuiltSidecars
+    {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Ix.Compiler.Pipeline.Config} {mainWorld : Owned}
+    {eraseFuel lowerFuel : Nat}
+    (compilation : Ix.Compiler.Pipeline.ValidatedCompilation constants
+      mainAddress config mainWorld eraseFuel lowerFuel) where
+  sidecars : Sidecars
+  hpt : IxIR1.HPT.Production IxIR1.HPT.defaultProducerLimits.checker
+    compilation.lowering.result.artifacts
+  certificateProduced : sidecars.hptCertificate = hpt.certificate
+  inputProduced : sidecars.input =
+    { declarations := compilation.artifact.targetDecls
+      main := compilation.artifact.main
+      mainResult := mainWorld }
+
+/-- Build the sidecars for the exact addressed graph retained by validated
+compilation. Parameter conflicts caused by IxIR₁ identities that erased
+distinct ownership signatures fail closed before IxIR₂ lowering. The HPT
+producer crosses its ordinary checked boundary before any summary is exposed
+to a site query. -/
+def buildSidecars
+    {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Ix.Compiler.Pipeline.Config} {mainWorld : Owned}
+    {eraseFuel lowerFuel : Nat}
+    (compilation : Ix.Compiler.Pipeline.ValidatedCompilation constants
+      mainAddress config mainWorld eraseFuel lowerFuel) :
+    Except Error (BuiltSidecars compilation) := do
+  let artifact := compilation.artifact
+  let hpt ← match IxIR1.HPT.produce compilation.lowering.result.artifacts with
+    | .ok production => pure production
+    | .error message => .error (.hpt message)
+  let parameterEntries ← buildParameterWorlds
+    compilation.erasure.result.declarations compilation.lowering.raw
+      compilation.lowering.result.addressMap
+  let recursorOrigins ← deriveRecursorOrigins
+    compilation.erasure.result.declarations
+      compilation.erasure.result.addressed.blocks compilation.lowering.raw
+      compilation.lowering.result.addressMap
+  let sidecars : Sidecars :=
+    { input :=
+        { declarations := artifact.targetDecls
+          main := artifact.main
+          mainResult := mainWorld }
+      parameterEntries
+      constructors := constructorInfos
+        compilation.erasure.result.declarations
+        compilation.erasure.result.addressed.blocks
+      recursorOrigins
+      hptCertificate := hpt.certificate }
+  return {
+    sidecars
+    hpt
+    certificateProduced := rfl
+    inputProduced := rfl
+  }
+
+/-- Common checked attachment for an exact ownership-lowered program. The
+Ixon frontend and checked IxIR₀ transformations share this backend boundary. -/
+structure CompiledAttachment (mainWorld : Owned) (lowerFuel : Nat) where
+  source : Ix.Compiler.Pipeline.LoweredCompilation mainWorld lowerFuel
+  sidecars : Sidecars
+  hpt : IxIR1.HPT.Production IxIR1.HPT.defaultProducerLimits.checker
+    source.lowering.result.artifacts
+  hptCertificateProduced : sidecars.hptCertificate = hpt.certificate
+  inputProduced : sidecars.input =
+    { declarations := source.targetDecls
+      main := source.lowering.result.main
+      mainResult := mainWorld }
+  maxDepth : Nat
+  loweringContext : Lower.Context
+  contextProduced : loweringContext = sidecars.context maxDepth
+  target : Lower.Checked
+  targetProduced : Lower.lower loweringContext sidecars.input = .ok target.artifact
+  targetSchemasProduced : target.artifact.validationContext.schemas = loweringContext.schemas
+  targetSourceProduced : target.artifact.source = sidecars.input
+  traceSourcesProduced : sidecars.traceSourcesMatch target.artifact.trace = true
+  traceExternFreeProduced : sidecars.traceExternFree target.artifact.trace = true
+  traceExactFetchesProduced : sidecars.traceExactFetchesMatch target.artifact.trace = true
+  traceExactCaseTargetsProduced : sidecars.traceExactCaseTargetsMatch target.artifact.trace = true
+  traceResidualCaseTargetsProduced : sidecars.traceResidualCaseTargetsMatch target.artifact.trace = true
+  traceScalarLeavesProduced : sidecars.traceScalarLeavesMatch target.artifact.trace = true
+  sourceNoReuseProduced : sidecars.sourceNoReuse target.artifact.trace = true
+  sourceConstructorsProduced : sidecars.traceConstructorsKnown target.artifact.trace = true
+  pappSafeProduced : sidecars.tracePappsSafe target.artifact.trace = true
+
+/-- A validated source/IxIR₁ compilation paired with the exact checked IxIR₂
+artifact produced from it. -/
+structure Attached
+    (constants : List (Address × Ixon.Constant)) (mainAddress : Address)
+    (config : Ix.Compiler.Pipeline.Config) (mainWorld : Owned)
+    (eraseFuel lowerFuel : Nat) where
+  source : Ix.Compiler.Pipeline.ValidatedCompilation constants mainAddress
+    config mainWorld eraseFuel lowerFuel
+  sidecars : Sidecars
+  hpt : IxIR1.HPT.Production IxIR1.HPT.defaultProducerLimits.checker
+    source.lowering.result.artifacts
+  hptCertificateProduced : sidecars.hptCertificate = hpt.certificate
+  inputProduced : sidecars.input =
+    { declarations := source.artifact.targetDecls
+      main := source.artifact.main
+      mainResult := mainWorld }
+  maxDepth : Nat
+  loweringContext : Lower.Context
+  contextProduced : loweringContext = sidecars.context maxDepth
+  target : Lower.Checked
+  targetProduced :
+    Lower.lower loweringContext sidecars.input = .ok target.artifact
+  targetSchemasProduced :
+    target.artifact.validationContext.schemas = loweringContext.schemas
+  targetSourceProduced : target.artifact.source = sidecars.input
+  traceSourcesProduced :
+    sidecars.traceSourcesMatch target.artifact.trace = true
+  traceExternFreeProduced :
+    sidecars.traceExternFree target.artifact.trace = true
+  traceExactFetchesProduced :
+    sidecars.traceExactFetchesMatch target.artifact.trace = true
+  traceExactCaseTargetsProduced :
+    sidecars.traceExactCaseTargetsMatch target.artifact.trace = true
+  traceResidualCaseTargetsProduced :
+    sidecars.traceResidualCaseTargetsMatch target.artifact.trace = true
+  traceScalarLeavesProduced :
+    sidecars.traceScalarLeavesMatch target.artifact.trace = true
+  sourceNoReuseProduced :
+    sidecars.sourceNoReuse target.artifact.trace = true
+  sourceConstructorsProduced :
+    sidecars.traceConstructorsKnown target.artifact.trace = true
+  pappSafeProduced :
+    sidecars.tracePappsSafe target.artifact.trace = true
+
+/-- Preserve the public Ixon attachment while projecting the common backend
+certificate. No compiler, analysis, or validator is rerun. -/
+def Attached.compiled
+    {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Ix.Compiler.Pipeline.Config} {mainWorld : Owned}
+    {eraseFuel lowerFuel : Nat}
+    (attached : Attached constants mainAddress config mainWorld eraseFuel lowerFuel) :
+    CompiledAttachment mainWorld lowerFuel :=
+  { source := attached.source.lowered
+    sidecars := attached.sidecars
+    hpt := attached.hpt
+    hptCertificateProduced := attached.hptCertificateProduced
+    inputProduced := attached.inputProduced
+    maxDepth := attached.maxDepth
+    loweringContext := attached.loweringContext
+    contextProduced := attached.contextProduced
+    target := attached.target
+    targetProduced := attached.targetProduced
+    targetSchemasProduced := attached.targetSchemasProduced
+    targetSourceProduced := attached.targetSourceProduced
+    traceSourcesProduced := attached.traceSourcesProduced
+    traceExternFreeProduced := attached.traceExternFreeProduced
+    traceExactFetchesProduced := attached.traceExactFetchesProduced
+    traceExactCaseTargetsProduced := attached.traceExactCaseTargetsProduced
+    traceResidualCaseTargetsProduced := attached.traceResidualCaseTargetsProduced
+    traceScalarLeavesProduced := attached.traceScalarLeavesProduced
+    sourceNoReuseProduced := attached.sourceNoReuseProduced
+    sourceConstructorsProduced := attached.sourceConstructorsProduced
+    pappSafeProduced := attached.pappSafeProduced }
+
+instance {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Ix.Compiler.Pipeline.Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat} :
+    CoeOut (Attached constants mainAddress config mainWorld eraseFuel lowerFuel)
+      (CompiledAttachment mainWorld lowerFuel) := ⟨Attached.compiled⟩
+
+/-- Whenever path-local HPT admits the synthetic main owner, its retained
+definition is the exact main function named by the checked lowering trace.
+If the reserved analysis address collides with a declaration summary, the
+premise is impossible and linear transport remains fail closed. -/
+theorem CompiledAttachment.mainAnalysisCurrentCompatible
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    ∀ current,
+      attached.sidecars.analysisCurrent? .main = some current →
+        current = attached.target.artifact.mainTrace.source := by
+  intro current currentAt
+  unfold Sidecars.analysisCurrent? at currentAt
+  cases summaryEq : attached.sidecars.hptCertificate.summaryEnv
+      mainAnalysisOwner with
+  | none =>
+      simp [analysisRoot?, summaryEq] at currentAt
+      rw [attached.target.artifact.mainSource,
+        attached.targetSourceProduced]
+      exact currentAt.symm
+  | some summary =>
+      simp [analysisRoot?, summaryEq] at currentAt
+
+/-- Every retained declaration/function trace in an attachment agrees with
+the function used by HPT replay whenever that replay root is present. -/
+theorem CompiledAttachment.functionTraceAnalysisCurrentCompatible
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions) :
+    ∀ current,
+      attached.sidecars.analysisCurrent? functionTrace.owner = some current →
+        current = functionTrace.source := by
+  intro current currentAt
+  exact attached.sidecars.functionTraceSource_eq_of_match
+    attached.traceSourcesProduced member currentAt
+
+/-- Every retained non-main function has a recovered HPT analysis root naming
+its exact retained source definition.  The whole-trace alignment check permits
+a missing root only for the distinguished synthetic main. -/
+theorem CompiledAttachment.functionTraceAnalysisCurrent
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    (notMain : functionTrace.owner ≠ .main) :
+    attached.sidecars.analysisCurrent? functionTrace.owner =
+      some functionTrace.source := by
+  have localMatch := List.all_eq_true.mp attached.traceSourcesProduced
+    functionTrace member
+  cases currentEq : attached.sidecars.analysisCurrent? functionTrace.owner with
+  | none =>
+      unfold Sidecars.functionTraceSourceMatches at localMatch
+      rw [currentEq] at localMatch
+      exact False.elim (notMain (beq_iff_eq.mp localMatch))
+  | some current =>
+      have currentSource :=
+        attached.functionTraceAnalysisCurrentCompatible member current currentEq
+      exact congrArg some currentSource
+
+/-- No retained descendant can be a source extern operation.  The executable
+attachment check turns the lowerer's disabled extern boundary into the exact
+contradiction used by the exhaustive evaluator inversion. -/
+theorem CompiledAttachment.sourceExtern_impossible
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {address : Address} {arguments : Array IxIR1.Atom}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site block input nextInput entryValueCount
+        (.extern address arguments) index instruction next)) : False := by
+  have rootMatch := attached.sidecars.functionCodeExternFree
+    attached.traceExternFreeProduced member
+  have localMatch := attached.sidecars.codeExternFree_descendant rootMatch
+    descendant
+  simp [Sidecars.codeExternFree] at localMatch
+
+/-- Every retained source-fetch descendant of an attachment recovers the
+exact constructor HPT evidence selected by the lowering context. -/
+theorem CompiledAttachment.exactConstructorAt?_of_fetch_descendant
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {sourceField : Nat}
+    {targetAtom : Atom} {targetField : Nat} {identity : CtorId}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site block input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom identity targetField) next)) :
+    ∃ fact,
+      attached.sidecars.exactConstructorAt? site sourceAtom =
+        some (fact, identity) := by
+  have rootMatch := attached.sidecars.functionCodeExactFetchesMatch
+    attached.traceExactFetchesProduced member
+  have childMatch := attached.sidecars.codeExactFetchesMatch_descendant
+    rootMatch descendant
+  exact attached.sidecars.exactConstructorAt?_of_codeExactFetchesMatch
+    childMatch
+
+/-- Every exact constructor fact at a retained switch names an actual emitted
+constructor target. Structural trace coherence supplies the parallel edge and
+child coordinates later; this theorem supplies the formerly erased identity
+lookup. -/
+theorem CompiledAttachment.exactCaseTarget_of_switch_descendant
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input : Array (Option Atom)} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {fact : IxIR1.HPT.Fact}
+    {identity : CtorId} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site block input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    (selected : attached.sidecars.exactConstructorAt? site sourceScrutinee =
+      some (fact, identity))
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors natPeel) :
+    ∃ target, constructors.find? (fun candidate =>
+      candidate.cid == identity) = some target := by
+  have rootMatch := attached.sidecars.functionCodeExactCaseTargetsMatch
+    attached.traceExactCaseTargetsProduced member
+  have childMatch :=
+    attached.sidecars.codeExactCaseTargetsMatch_descendant rootMatch descendant
+  exact attached.sidecars.exactCaseTarget_of_codeExactCaseTargetsMatch
+    childMatch selected terminator
+
+/-- Every retained shallow-free descendant of an attachment recovers the
+exact scalar-leaf HPT evidence selected by the lowering context. -/
+theorem CompiledAttachment.scalarLeafAt?_of_free_descendant
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {block : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {identity : CtorId}
+    {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site block input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom identity) next)) :
+    ∃ fact,
+      attached.sidecars.scalarLeafAt? site sourceAtom =
+        some (fact, identity) := by
+  have rootMatch := attached.sidecars.functionCodeScalarLeavesMatch
+    attached.traceScalarLeavesProduced member
+  have childMatch := attached.sidecars.codeScalarLeavesMatch_descendant
+    rootMatch descendant
+  exact attached.sidecars.scalarLeafAt?_of_codeScalarLeavesMatch childMatch
+
+/-- An attached artifact retains the exact sidecar-produced context, so its
+schema lookups expose the pipeline's uniform ownership-world invariant. -/
+theorem CompiledAttachment.schema_fields_replicate
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {world : Owned} {identity : CtorId} {schema : CtorSchema}
+    (found : attached.loweringContext.schemas world identity = some schema) :
+    ∃ count, schema.fields = Array.replicate count world := by
+  rw [attached.contextProduced] at found
+  exact attached.sidecars.schema_fields_replicate found
+
+/-- Attachment-facing form of the exact constructor/schema arity bridge. -/
+theorem CompiledAttachment.schema_fields_of_constructorKnown
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {world : Owned} {identity : CtorId} {arity : Nat}
+    {schema : CtorSchema}
+    (known : attached.sidecars.constructorKnown identity arity = true)
+    (found : attached.loweringContext.schemas world identity = some schema) :
+    schema.fields = Array.replicate arity world := by
+  rw [attached.contextProduced] at found
+  exact attached.sidecars.schema_fields_of_constructorKnown known found
+
+/-- The HPT facts consulted by this attachment are the exact claims admitted
+by the ordinary post-fixpoint checker for its retained IxIR₁ artifact graph. -/
+theorem CompiledAttachment.hptPostFixpoint
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    attached.sidecars.hptCertificate.postFixpoint
+      attached.source.lowering.result.artifacts = true := by
+  rw [attached.hptCertificateProduced]
+  exact attached.hpt.postFixpoint
+
+/-- Propositional local form consumed by operation and code soundness. -/
+theorem CompiledAttachment.hptLocalPostFixpoint
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    IxIR1.HPT.LocalPostFixpoint
+      (IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+      attached.sidecars.hptCertificate.summaryEnv :=
+  IxIR1.HPT.localPostFixpoint_of_postFixpoint attached.hptPostFixpoint
+
+/-- The sidecar lookup environment is exactly the declaration environment
+checked by its HPT production, not merely an extensionally compatible input. -/
+theorem CompiledAttachment.sidecarDeclarationEnvironment
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    IxIR1.Env.ofList attached.sidecars.input.declarations =
+      IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts := by
+  rw [attached.inputProduced]
+  change IxIR1.Env.ofList
+      (IxIR1.HPT.declarationEntries
+        attached.source.lowering.result.artifacts) =
+    IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts
+  exact IxIR1.HPT.OptimizeProgram.envOfList_declarationEntries
+    attached.source.lowering.result.artifacts
+
+/-- The fail-closed attachment check discharges reuse-freedom for any source
+evaluator context pinned to the attached declaration environment. -/
+theorem CompiledAttachment.sourceContextNoReuse
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts) :
+    IxIR1.NoReuse.CtxNoReuse sourceContext := by
+  have declarationCheck : IxIR1.NoReuse.checkDeclarations
+      attached.sidecars.input.declarations = true := by
+    have checked := attached.sourceNoReuseProduced
+    simp only [Sidecars.sourceNoReuse, Bool.and_eq_true] at checked
+    exact checked.1
+  have declarationsNoReuse : IxIR1.NoReuse.DeclListNoReuse
+      attached.sidecars.input.declarations :=
+    (IxIR1.NoReuse.checkDeclarations_eq_true_iff _).mp declarationCheck
+  have canonical : IxIR1.NoReuse.CtxNoReuse
+      ({ decls := IxIR1.Env.ofList attached.sidecars.input.declarations
+         oracle := sourceContext.oracle } : IxIR1.Ctx) :=
+    IxIR1.NoReuse.ctxOfList_noReuse declarationsNoReuse
+  intro address definition lookup
+  apply canonical
+  rw [attached.sidecarDeclarationEnvironment, ← sourceDeclarations]
+  exact lookup
+
+/-- Every retained source function has passed the executable reuse-freedom
+check carried by the attachment. -/
+theorem CompiledAttachment.functionTraceNoReuse
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions) :
+    IxIR1.NoReuse.CodeNoReuse functionTrace.source.body := by
+  have traceCheck : attached.target.artifact.trace.functions.all
+      (fun trace => IxIR1.NoReuse.checkCode trace.source.body) = true := by
+    have checked := attached.sourceNoReuseProduced
+    simp only [Sidecars.sourceNoReuse, Bool.and_eq_true] at checked
+    exact checked.2
+  have functionCheck := List.all_eq_true.mp traceCheck functionTrace member
+  exact (IxIR1.NoReuse.checkCode_eq_true_iff _).mp functionCheck
+
+/-- Every retained partial-application site resolves to a declaration whose
+source PAP-safety flag is true. The context identity premise is the same one
+used by the simulation worker. -/
+theorem CompiledAttachment.pappSafe
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts)
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Array (Option Atom)} {entryValueCount index : Nat}
+    {address : Address} {arguments : Array IxIR1.Atom}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    {definition : IxIR1.FnDef}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp address arguments) index instruction next))
+    (lookup : sourceContext.decls address = some (.fn definition)) :
+    definition.papSafe = true := by
+  have rootCheck : attached.sidecars.pappSafeTrace functionTrace.root = true :=
+    List.all_eq_true.mp attached.pappSafeProduced functionTrace functionMember
+  have localCheck := attached.sidecars.pappSafeTrace_descendant descendant
+    rootCheck
+  apply attached.sidecars.pappSafe_of_traceMatch localCheck
+  rw [attached.sidecarDeclarationEnvironment, ← sourceDeclarations]
+  exact lookup
+
+/-- Local HPT post-fixpoint in the exact environment consumed by source-site
+replay and its dynamic environment invariant. -/
+theorem CompiledAttachment.hptSidecarLocalPostFixpoint
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    IxIR1.HPT.LocalPostFixpoint
+      (IxIR1.Env.ofList attached.sidecars.input.declarations)
+      attached.sidecars.hptCertificate.summaryEnv := by
+  rw [attached.sidecarDeclarationEnvironment]
+  exact attached.hptLocalPostFixpoint
+
+/-- Artifact-facing linear transport: the attachment discharges both the HPT
+post-fixpoint and the identity of the declaration environment checked by it. -/
+theorem CompiledAttachment.siteEnvironmentHolds_next
+     {mainWorld : Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {rest : IxIR1.Code}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (currentAt : attached.sidecars.analysisCurrent? site.owner =
+      some sourceCurrent)
+    (environment : attached.sidecars.SiteEnvironmentHolds sourceStore site
+      source)
+    (sourceAt : attached.sidecars.sourceCodeAt? site =
+      some (.letOp operation rest))
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel sourceCurrent
+      sourceStore source operation = .ok (outputStore, value)) :
+    attached.sidecars.SiteEnvironmentHolds outputStore site.next
+      (value :: source) := by
+  exact attached.sidecars.siteEnvironmentHolds_next
+    attached.hptSidecarLocalPostFixpoint
+    (sourceDeclarations.trans attached.sidecarDeclarationEnvironment.symm)
+    currentAt environment sourceAt sourceRun
+
+
+/-! Existing theorem names remain available for direct application. -/
+namespace Attached
+export CompiledAttachment (
+  mainAnalysisCurrentCompatible
+  functionTraceAnalysisCurrentCompatible
+  functionTraceAnalysisCurrent
+  sourceExtern_impossible
+  exactConstructorAt?_of_fetch_descendant
+  exactCaseTarget_of_switch_descendant
+  scalarLeafAt?_of_free_descendant
+  schema_fields_replicate
+  schema_fields_of_constructorKnown
+  hptPostFixpoint
+  hptLocalPostFixpoint
+  sidecarDeclarationEnvironment
+  sourceContextNoReuse
+  functionTraceNoReuse
+  pappSafe
+  hptSidecarLocalPostFixpoint
+  siteEnvironmentHolds_next)
+end Attached
+
+/-- Sidecars and HPT evidence for the common ownership-lowered boundary. -/
+structure BuiltCompiledSidecars {mainWorld : Owned} {lowerFuel : Nat}
+    (source : Ix.Compiler.Pipeline.LoweredCompilation mainWorld lowerFuel) where
+  sidecars : Sidecars
+  hpt : IxIR1.HPT.Production IxIR1.HPT.defaultProducerLimits.checker
+    source.lowering.result.artifacts
+  certificateProduced : sidecars.hptCertificate = hpt.certificate
+  inputProduced : sidecars.input =
+    { declarations := source.targetDecls
+      main := source.lowering.result.main
+      mainResult := mainWorld }
+
+/-- The returned attachment names the exact checked compiler input supplied
+to this invocation, even when a frontend has transformed the literal erasure. -/
+abbrev CompiledRun {mainWorld : Owned} {lowerFuel : Nat}
+    (source : Ix.Compiler.Pipeline.LoweredCompilation mainWorld lowerFuel) :=
+  { attached : CompiledAttachment mainWorld lowerFuel // attached.source = source }
+
+/-- Attach and validate structured baseline IxIR₂ in one fail-closed step. -/
+def attachCompiled {mainWorld : Owned} {lowerFuel : Nat}
+    (compilation : Ix.Compiler.Pipeline.LoweredCompilation mainWorld lowerFuel)
+    (built : BuiltCompiledSidecars compilation)
+    (maxDepth : Nat := 100000) :
+    Except Error (CompiledRun compilation) := do
+  let sidecars := built.sidecars
+  let loweringContext := sidecars.context maxDepth
+  let targetRun ← match Lower.lowerCheckedWithTrace loweringContext
+      sidecars.input with
+    | .ok checked => pure checked
+    | .error error => .error (.lowering error)
+  if traceSourcesCoherent :
+      sidecars.traceSourcesMatch targetRun.checked.artifact.trace then
+    if traceExternFree :
+        sidecars.traceExternFree targetRun.checked.artifact.trace then
+      if traceExactFetchesCoherent :
+          sidecars.traceExactFetchesMatch targetRun.checked.artifact.trace then
+        if traceExactCaseTargetsCoherent :
+            sidecars.traceExactCaseTargetsMatch
+              targetRun.checked.artifact.trace then
+          if traceResidualCaseTargetsCoherent :
+              sidecars.traceResidualCaseTargetsMatch
+                targetRun.checked.artifact.trace then
+            if traceScalarLeavesCoherent :
+                sidecars.traceScalarLeavesMatch targetRun.checked.artifact.trace then
+              if sourceNoReuse :
+                  sidecars.sourceNoReuse targetRun.checked.artifact.trace then
+                if sourceConstructorsKnown :
+                    sidecars.traceConstructorsKnown
+                      targetRun.checked.artifact.trace then
+                  if pappsSafe :
+                      sidecars.tracePappsSafe targetRun.checked.artifact.trace then
+                    return ⟨
+                      { source := compilation
+                        sidecars
+                        hpt := built.hpt
+                        hptCertificateProduced := built.certificateProduced
+                        inputProduced := built.inputProduced
+                        maxDepth
+                        loweringContext
+                        contextProduced := rfl
+                        target := targetRun.checked
+                        targetProduced := targetRun.produced
+                        targetSchemasProduced := Lower.validationSchemas_of_lower targetRun.produced
+                        targetSourceProduced := targetRun.source
+                        traceSourcesProduced := traceSourcesCoherent
+                        traceExternFreeProduced := traceExternFree
+                        traceExactFetchesProduced := traceExactFetchesCoherent
+                        traceExactCaseTargetsProduced := traceExactCaseTargetsCoherent
+                        traceResidualCaseTargetsProduced := traceResidualCaseTargetsCoherent
+                        traceScalarLeavesProduced := traceScalarLeavesCoherent
+                        sourceNoReuseProduced := sourceNoReuse
+                        sourceConstructorsProduced := sourceConstructorsKnown
+                        pappSafeProduced := pappsSafe }, rfl⟩
+                  else
+                    throw (.lowering (.internal
+                      "partial application targets a PAP-unsafe declaration"))
+                else
+                  throw (.lowering (.internal
+                    "source constructor allocation escaped the producer universe"))
+              else
+                throw (.lowering (.internal
+                  "source artifact unexpectedly contains a reuse operation"))
+            else
+              throw (.lowering (.internal
+                "shallow-free traces lack exact scalar-leaf HPT evidence"))
+          else
+            throw (.lowering (.internal
+              "ambiguous-HPT case traces lack producer constructor coverage"))
+        else
+          throw (.lowering (.internal
+            "exact-HPT case traces lack their constructor target"))
+      else
+        throw (.lowering (.internal
+          "fetch traces lack exact-constructor HPT evidence"))
+    else
+      throw (.lowering (.internal
+        "extern operation escaped the disabled lowering boundary"))
+  else
+    throw (.lowering (.internal
+      "function traces do not match path-local HPT owners"))
+
+/-- Restore the public source-facing record from the exact common attachment.
+The identity proof transports only dependent certificates; executable fields
+are the same compiler and analysis results. -/
+def Attached.ofCompiled
+    {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Ix.Compiler.Pipeline.Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (source : Ix.Compiler.Pipeline.ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (run : CompiledRun source.lowered) :
+    Attached constants mainAddress config mainWorld eraseFuel lowerFuel := by
+  rcases run with ⟨attached, produced⟩
+  rcases attached with ⟨compiler, sidecars, hpt, hptProduced, inputProduced, maxDepth,
+    loweringContext, contextProduced, target, targetProduced, targetSchemasProduced,
+    targetSourceProduced, traceSourcesProduced, traceExternFreeProduced,
+    traceExactFetchesProduced, traceExactCaseTargetsProduced, traceResidualCaseTargetsProduced,
+    traceScalarLeavesProduced, sourceNoReuseProduced, sourceConstructorsProduced, pappSafeProduced⟩
+  cases produced
+  exact {
+    source, sidecars, hpt, hptCertificateProduced := hptProduced, inputProduced,
+    maxDepth, loweringContext, contextProduced, target, targetProduced, targetSchemasProduced,
+    targetSourceProduced, traceSourcesProduced, traceExternFreeProduced, traceExactFetchesProduced,
+    traceExactCaseTargetsProduced, traceResidualCaseTargetsProduced, traceScalarLeavesProduced,
+    sourceNoReuseProduced, sourceConstructorsProduced, pappSafeProduced }
+
+def attach
+    {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Ix.Compiler.Pipeline.Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : Ix.Compiler.Pipeline.ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (maxDepth : Nat := 100000) :
+    Except Error (Attached constants mainAddress config mainWorld eraseFuel lowerFuel) := do
+  let built ← buildSidecars compilation
+  let run ← attachCompiled compilation.lowered
+    { sidecars := built.sidecars, hpt := built.hpt
+      certificateProduced := built.certificateProduced, inputProduced := built.inputProduced }
+    maxDepth
+  return Attached.ofCompiled compilation run
+
+/-- Validator-gated source compilation and checked structured IxIR₂
+attachment as one executable endpoint. The ordinary production API remains
+IxIR₁ while exact source-provenance coverage is still being generalized. -/
+def compileValidated (constants : List (Address × Ixon.Constant))
+    (mainAddress : Address) (config : Ix.Compiler.Pipeline.Config := {})
+    (mainWorld : Owned := .shared)
+    (checkFuel : Nat := Ixon.UsageCheck.defaultFuel)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel)
+    (lowerFuel : Nat := 10000) (maxDepth : Nat := 100000) :
+    Except Error (Attached constants mainAddress config mainWorld
+      eraseFuel lowerFuel) := do
+  let compilation ←
+    match Ix.Compiler.Pipeline.compileValidatedWithTrace constants mainAddress
+        config mainWorld checkFuel eraseFuel validateFuel lowerFuel with
+    | .ok compilation => pure compilation
+    | .error error => .error (.pipeline error)
+  attach compilation maxDepth
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelineAllocation.lean b/Ix/Compiler/IxIR2/PipelineAllocation.lean
new file mode 100644
index 000000000..85fd6ad66
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelineAllocation.lean
@@ -0,0 +1,124 @@
+import Ix.Compiler.IxIR2.PipelineResources
+import Ix.Compiler.IxIR2.ReuseAllocation
+
+/-!
+# Allocation and free laws for the selected shared-main compiler
+
+The owned source execution and checked attachment derive the baseline's zero
+reuse count. The actual rewrite execution supplies allocation-event equality;
+R2 supplies terminal accounting and shared-result reclamation. No comparative
+counter or compiler-state invariant is a caller premise.
+-/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+/-- The actual owned execution of a compiled shared main performs no baseline
+reuse. This is derived from the lowering trace and transported by exact
+baseline heap correspondence. -/
+theorem CompiledAttachment.baselineNoReuses
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    {sourceFuel : Nat} {store : IxIR1.Store} {value : IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok (store, value))
+    {baseline : Eval.Result} (related : Lower.Sim.OutcomeRel (store, value) baseline) :
+    baseline.store.heap.reuses = 0 := by
+  have mainWorld : attached.target.artifact.source.mainResult = .shared := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+  have bodyRun := (IxIR1.Sim.runOwnedMain_ok ownedRun).1
+  rw [mainWorld] at bodyRun
+  have noReuse := attached.functionTraceNoReuse attached.target.artifact.mainTraceMember
+  rw [attached.target.artifact.mainSource] at noReuse
+  rw [related.heap]
+  exact IxIR1.NoReuse.runMain_reuses_eq_zero
+    (attached.sourceContextNoReuse rfl) noReuse bodyRun
+
+/-- Both physical executions and their exact allocation/free laws, including
+complete reclamation of both shared results. Optimized and checked baseline
+selection use the same public theorem. -/
+theorem CompiledAttachment.selectedPhysicalMainAllocationLaws
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut) :
+    ∃ baselineControl selectedControl heapFuel baseline selected locRel,
+      Eval.runMain attached.simulationTargetContext .physical
+        attached.target.artifact.program baselineControl heapFuel = .ok baseline ∧
+      Eval.runMain
+        (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+        .physical selection.target selectedControl heapFuel = .ok selected ∧
+      Lower.Sim.OutcomeRel sourceOut baseline ∧
+      ReuseSim.StableHeapRel baseline.store selected.store locRel ∧
+      IxIR1.Sim.RValIso locRel baseline.value selected.value ∧
+      baseline.SharedResources ∧ selected.SharedResources ∧
+      baseline.AllocationLaws selected ∧ baseline.ReclaimedAllocationLaws selected := by
+  obtain ⟨baselineControl, heapFuel, baseline, baselineRun, baselineRelation⟩ :=
+    attached.successfulPhysicalMainSimulation ownedRun
+  obtain ⟨selectedControl, selected, locRel, selectedRun, heaps, values, _budget, events⟩ :=
+    ReuseLiveSim.selectedPhysicalMainSimulationWithAllocationEvents selection baselineRun
+  have baselineAccounted := Eval.runMain_allocationAccounting
+    attached.target.artifact.mainArity attached.target.artifact.mainNonempty baselineRun
+  have selectedAccounted := attached.selectedAllocationAccounting selection selectedRun
+  obtain ⟨releaseFuel, baselineReleased, baselineRelease, baselineEmpty⟩ :=
+    attached.baselineSharedReclamation ownedRun baselineRelation
+  obtain ⟨selectedReleased, selectedRelease, selectedEmpty⟩ :=
+    heaps.sharedReclamation values baselineRelease baselineEmpty
+  have baselineResources := Eval.Result.sharedResources_of_release
+    baselineAccounted baselineRelease baselineEmpty
+  have selectedResources := Eval.Result.sharedResources_of_release
+    selectedAccounted selectedRelease selectedEmpty
+  have laws := Eval.Result.AllocationLaws.of_accounting heaps events
+    (attached.baselineNoReuses ownedRun baselineRelation) baselineAccounted selectedAccounted
+  exact ⟨baselineControl, selectedControl, heapFuel, baseline, selected, locRel,
+    baselineRun, selectedRun, baselineRelation, heaps, values,
+    baselineResources, selectedResources, laws,
+    laws.reclaimed heaps values baselineResources selectedResources⟩
+
+/-- The laws concern any actual successful runs of the baseline and selected
+programs, including independent sufficient choices of control and heap fuel. -/
+theorem CompiledAttachment.successfulPhysicalAllocationLaws
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut)
+    {baselineControl baselineHeap selectedControl selectedHeap : Nat}
+    {baseline selected : Eval.Result}
+    (baselineRun : Eval.runMain attached.simulationTargetContext .physical
+      attached.target.artifact.program baselineControl baselineHeap = .ok baseline)
+    (selectedRun : Eval.runMain
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target selectedControl selectedHeap = .ok selected) :
+    baseline.AllocationLaws selected ∧ baseline.ReclaimedAllocationLaws selected := by
+  obtain ⟨witnessBaselineControl, witnessSelectedControl, witnessHeap, witnessBaseline,
+      witnessSelected, locRel, witnessBaselineRun, witnessSelectedRun,
+      _baselineRelation, _heaps, _values, _baselineResources, _selectedResources,
+      laws, reclaimed⟩ := attached.selectedPhysicalMainAllocationLaws selection ownedRun
+  obtain ⟨baselineStores, baselineValues⟩ := Eval.runMain_success_unique
+    attached.target.artifact.mainArity attached.target.artifact.mainNonempty
+    witnessBaselineRun baselineRun
+  obtain ⟨selectedStores, selectedValues⟩ := Eval.runMain_success_unique
+    (attached.selectedMainEntry selection).1 (attached.selectedMainEntry selection).2
+    witnessSelectedRun selectedRun
+  refine ⟨⟨?_, ?_⟩, ?_⟩
+  · simpa only [baselineStores, selectedStores] using laws.allocations
+  · simpa only [baselineStores, selectedStores] using laws.frees
+  · simpa only [Eval.Result.ReclaimedAllocationLaws, baselineStores, baselineValues,
+      selectedStores, selectedValues] using reclaimed
+
+/-- A selected result is compared with an actual physical run of the checked
+baseline, retaining its resources and both pre- and post-release laws. -/
+def CompiledAttachment.AllocationComparison
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel) (selected : Eval.Result) : Prop :=
+  ∃ baselineControl baselineHeap baseline,
+    Eval.runMain attached.simulationTargetContext .physical attached.target.artifact.program
+      baselineControl baselineHeap = .ok baseline ∧
+    baseline.SharedResources ∧ baseline.AllocationLaws selected ∧
+    baseline.ReclaimedAllocationLaws selected
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelineCallReuse.lean b/Ix/Compiler/IxIR2/PipelineCallReuse.lean
new file mode 100644
index 000000000..dcf913bab
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelineCallReuse.lean
@@ -0,0 +1,168 @@
+import Ix.Compiler.IxIR2.PipelineCosts
+import Ix.Compiler.IxIR2.CallReuseMain
+import Ix.Compiler.IxIR2.CallResources
+
+/-!
+# Compiler costs and reclamation with suspended call credits
+
+The common checked lowering trace derives endpoint closure and a live result.
+The actual selected execution supplies the unchanged semantic heap relation,
+allocation events, RC and peak bounds. Physical accounting and shared release
+then give R4's complete resource laws for both policy selection branches.
+-/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+theorem CompiledAttachment.baselineClosed
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    {sourceFuel : Nat} {store : IxIR1.Store} {value : IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok (store, value))
+    {baseline : Eval.Result} (related : Lower.Sim.OutcomeRel (store, value) baseline) :
+    IxIR1.Sim.StoreClosed baseline.store.heap ∧
+      IxIR1.Sim.LiveRVal baseline.store.heap baseline.value := by
+  have mainWorld : attached.target.artifact.source.mainResult = .shared := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+  have bodyRun := (IxIR1.Sim.runOwnedMain_ok ownedRun).1
+  rw [mainWorld] at bodyRun
+  have run : IxIR1.runMain attached.simulationSourceContext
+      attached.target.artifact.source.main sourceFuel = .ok (store, value) := bodyRun
+  rw [attached.simulationSourceContext_eq_addressedCtx,
+    attached.targetSourceProduced, attached.inputProduced] at run
+  have ownership := attached.source.owned (fun _ _ => none) run
+  rw [related.heap, related.value]
+  refine ⟨ownership.storeClosed, ?_⟩
+  have world := ownership.roots_world ⟨.shared, value⟩ (by simp)
+  cases value with
+  | loc location => exact ⟨world.choose, world.choose_spec.1⟩
+  | lit literal => trivial
+  | erased => trivial
+
+def CompiledAttachment.CallPrefixCostBounds
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : CallReuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    (heapFuel : Nat) (baseline : Eval.Result) : Prop :=
+  ∀ {count : Nat} {middle : Eval.Machine},
+    Eval.Policy.Steps selection.policy
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical count (Eval.initialMachine selection.target.main #[] heapFuel) middle →
+    middle.store.heap.rcops ≤ baseline.store.heap.rcops ∧
+    middle.store.peakLiveNodes ≤ baseline.store.peakLiveNodes ∧
+    middle.store.live ≤ baseline.store.peakLiveNodes
+
+theorem CompiledAttachment.selectedCallPrefixCostBounds
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : CallReuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {controlFuel heapFuel : Nat} {baseline selected : Eval.Result}
+    (selectedRun : Eval.Policy.runMain selection.policy
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target controlFuel heapFuel = .ok selected)
+    (costs : baseline.CostBounds selected) : attached.CallPrefixCostBounds selection heapFuel baseline := by
+  have entry := selection.mainEntry attached.target.artifact.mainArity attached.target.artifact.mainNonempty
+  rw [Eval.Policy.runMain_eq_runMachine entry.1 entry.2] at selectedRun
+  intro count middle prefixSteps
+  have observed := Eval.Policy.runMachine_prefix_costs selectedRun prefixSteps (Nat.le_refl 0)
+  exact ⟨Nat.le_trans observed.1 costs.rcops,
+    Nat.le_trans observed.2.1 costs.peakLive, Nat.le_trans observed.2.2 costs.peakLive⟩
+
+/-- All compiler-state, heap, and cost invariants are reconstructed internally
+from successful owned execution and the exact checked selection. -/
+theorem CompiledAttachment.selectedCallPhysicalMainCostLaws
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : CallReuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut) :
+    ∃ baselineControl selectedControl heapFuel baseline selected locRel,
+      Eval.runMain attached.simulationTargetContext .physical
+        attached.target.artifact.program baselineControl heapFuel = .ok baseline ∧
+      Eval.Policy.runMain selection.policy
+        (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+        .physical selection.target selectedControl heapFuel = .ok selected ∧
+      Lower.Sim.OutcomeRel sourceOut baseline ∧
+      ReuseSim.StableHeapRel baseline.store selected.store locRel ∧
+      IxIR1.Sim.RValIso locRel baseline.value selected.value ∧
+      baseline.SharedResources ∧ selected.SharedResources ∧
+      baseline.AllocationLaws selected ∧ baseline.CostBounds selected ∧
+      baseline.ReclaimedCostLaws selected ∧ attached.CallPrefixCostBounds selection heapFuel baseline := by
+  obtain ⟨baselineControl, heapFuel, baseline, baselineRun, baselineRelation⟩ :=
+    attached.successfulPhysicalMainSimulation ownedRun
+  have closure := attached.baselineClosed ownedRun baselineRelation
+  obtain ⟨selectedControl, selected, locRel, selectedRun, heaps, values, _budget, events, costs⟩ :=
+    selection.mainSimulation attached.target.artifact.mainArity attached.target.artifact.mainNonempty
+      baselineRun closure.1 closure.2
+  have baselineAccounted := Eval.runMain_allocationAccounting
+    attached.target.artifact.mainArity attached.target.artifact.mainNonempty baselineRun
+  have entry := selection.mainEntry attached.target.artifact.mainArity attached.target.artifact.mainNonempty
+  have selectedAccounted := Eval.Policy.runMain_allocationAccounting entry.1 entry.2 selectedRun
+  obtain ⟨releaseFuel, baselineReleased, baselineRelease, baselineEmpty⟩ :=
+    attached.baselineSharedReclamation ownedRun baselineRelation
+  obtain ⟨selectedReleased, selectedRelease, selectedEmpty⟩ :=
+    heaps.sharedReclamation values baselineRelease baselineEmpty
+  have baselineResources := Eval.Result.sharedResources_of_release
+    baselineAccounted baselineRelease baselineEmpty
+  have selectedResources := Eval.Result.sharedResources_of_release
+    selectedAccounted selectedRelease selectedEmpty
+  have allocations := Eval.Result.AllocationLaws.of_accounting heaps events
+    (attached.baselineNoReuses ownedRun baselineRelation) baselineAccounted selectedAccounted
+  have reclaimed := allocations.reclaimed heaps values baselineResources selectedResources
+  exact ⟨baselineControl, selectedControl, heapFuel, baseline, selected, locRel,
+    baselineRun, selectedRun, baselineRelation, heaps, values, baselineResources,
+    selectedResources, allocations, costs, costs.reclaimed heaps reclaimed,
+    attached.selectedCallPrefixCostBounds selection selectedRun costs⟩
+
+/-- The laws apply to actual successful runs with independent sufficient
+control and heap budgets, including every prefix of the selected run. -/
+theorem CompiledAttachment.successfulCallPhysicalCostLaws
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : CallReuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut)
+    {baselineControl baselineHeap selectedControl selectedHeap : Nat}
+    {baseline selected : Eval.Result}
+    (baselineRun : Eval.runMain attached.simulationTargetContext .physical
+      attached.target.artifact.program baselineControl baselineHeap = .ok baseline)
+    (selectedRun : Eval.Policy.runMain selection.policy
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target selectedControl selectedHeap = .ok selected) :
+    selected.SharedResources ∧ baseline.AllocationLaws selected ∧ baseline.CostBounds selected ∧
+    baseline.ReclaimedCostLaws selected ∧ attached.CallPrefixCostBounds selection selectedHeap baseline := by
+  obtain ⟨witnessBaselineControl, witnessSelectedControl, witnessHeap, witnessBaseline,
+    witnessSelected, locRel, witnessBaselineRun, witnessSelectedRun,
+    _baselineRelation, _heaps, _values, _baselineResources, resources,
+    allocations, costs, reclaimed, _prefixes⟩ := attached.selectedCallPhysicalMainCostLaws selection ownedRun
+  obtain ⟨baselineStores, baselineValues⟩ := Eval.runMain_success_unique
+    attached.target.artifact.mainArity attached.target.artifact.mainNonempty witnessBaselineRun baselineRun
+  have entry := selection.mainEntry attached.target.artifact.mainArity attached.target.artifact.mainNonempty
+  obtain ⟨selectedStores, selectedValues⟩ := Eval.Policy.runMain_success_unique
+    entry.1 entry.2 witnessSelectedRun selectedRun
+  have actualCosts : baseline.CostBounds selected := by
+    simpa only [Eval.Result.CostBounds, baselineStores, selectedStores] using costs
+  refine ⟨?_, ⟨?_, ?_⟩, actualCosts, ?_,
+    attached.selectedCallPrefixCostBounds selection selectedRun actualCosts⟩
+  · simpa only [Eval.Result.SharedResources, selectedStores, selectedValues] using resources
+  · simpa only [baselineStores, selectedStores] using allocations.allocations
+  · simpa only [baselineStores, selectedStores] using allocations.frees
+  · simpa only [Eval.Result.ReclaimedCostLaws, baselineStores, baselineValues,
+      selectedStores, selectedValues] using reclaimed
+
+def CompiledAttachment.CallCostComparison
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : CallReuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    (selectedHeap : Nat) (selected : Eval.Result) : Prop :=
+  ∃ baselineControl baselineHeap baseline,
+    Eval.runMain attached.simulationTargetContext .physical attached.target.artifact.program
+      baselineControl baselineHeap = .ok baseline ∧
+    baseline.SharedResources ∧ baseline.AllocationLaws selected ∧ baseline.CostBounds selected ∧
+    baseline.ReclaimedCostLaws selected ∧ attached.CallPrefixCostBounds selection selectedHeap baseline
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelineCosts.lean b/Ix/Compiler/IxIR2/PipelineCosts.lean
new file mode 100644
index 000000000..5584fcb46
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelineCosts.lean
@@ -0,0 +1,177 @@
+import Ix.Compiler.IxIR2.PipelineAllocation
+
+/-!
+# Comparative costs for the actual selected shared-main compiler
+
+RC and peak bounds cover both selection branches and independent sufficient
+execution budgets. All intermediate selected states are bounded by the actual
+baseline's final counters. Shared reclamation retains the same cost bounds and
+R3's allocation/free laws.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+theorem Result.ReclaimedCostLaws.allocations {baseline selected : Result}
+    (laws : baseline.ReclaimedCostLaws selected) : baseline.ReclaimedAllocationLaws selected := by
+  obtain ⟨fuel, baselineReleased, selectedReleased, remaining, baselineRun, selectedRun,
+    baselineEmpty, selectedEmpty, baselineBalance, selectedBalance, frees, _costs⟩ := laws
+  exact ⟨fuel, baselineReleased, selectedReleased, remaining, baselineRun, selectedRun,
+    baselineEmpty, selectedEmpty, baselineBalance, selectedBalance, frees⟩
+
+/-- Extend the exact R3 reclamation witnesses with RC and peak bounds. -/
+theorem Result.CostBounds.reclaimed {baseline selected : Result} {locRel : Nat → Nat → Prop}
+    (costs : baseline.CostBounds selected)
+    (heaps : ReuseSim.StableHeapRel baseline.store selected.store locRel)
+    (allocations : baseline.ReclaimedAllocationLaws selected) :
+    baseline.ReclaimedCostLaws selected := by
+  obtain ⟨fuel, baselineReleased, selectedReleased, remaining, baselineRun, selectedRun,
+    baselineEmpty, selectedEmpty, baselineBalance, selectedBalance, frees⟩ := allocations
+  exact ⟨fuel, baselineReleased, selectedReleased, remaining, baselineRun, selectedRun,
+    baselineEmpty, selectedEmpty, baselineBalance, selectedBalance, frees,
+    costs.releaseShared heaps baselineRun selectedRun baselineEmpty selectedEmpty⟩
+
+end Ix.Compiler.IxIR2.Eval
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+/-- The RC and peak bounds concern any two actual successful physical runs,
+with independent choices of sufficient control and heap fuel. -/
+theorem CompiledAttachment.successfulPhysicalCostBounds
+    {world : Ixon.Owned} {fuel : Nat} (attached : CompiledAttachment world fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {baselineControl baselineHeap selectedControl selectedHeap : Nat}
+    {baseline selected : Eval.Result}
+    (baselineRun : Eval.runMain attached.simulationTargetContext .physical
+      attached.target.artifact.program baselineControl baselineHeap = .ok baseline)
+    (selectedRun : Eval.runMain
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target selectedControl selectedHeap = .ok selected) :
+    baseline.CostBounds selected := by
+  obtain ⟨control, result, locRel, run, _heaps, _values, _fuel, _events, costs⟩ :=
+    ReuseLiveSim.selectedPhysicalMainSimulationWithCosts selection baselineRun
+  obtain ⟨stores, _values⟩ := Eval.runMain_success_unique
+    (attached.selectedMainEntry selection).1 (attached.selectedMainEntry selection).2 run selectedRun
+  simpa only [Eval.Result.CostBounds, stores] using costs
+
+/-- Every actual selected prefix, including all internal macro states, fits
+within the physical baseline's terminal RC count and peak-live count. -/
+def CompiledAttachment.PrefixCostBounds
+    {world : Ixon.Owned} {fuel : Nat} (attached : CompiledAttachment world fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    (heapFuel : Nat) (baseline : Eval.Result) : Prop :=
+  ∀ {count : Nat} {middle : Eval.Machine},
+    Eval.Steps (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical count (Eval.initialMachine selection.target.main #[] heapFuel) middle →
+    middle.store.heap.rcops ≤ baseline.store.heap.rcops ∧
+    middle.store.peakLiveNodes ≤ baseline.store.peakLiveNodes ∧
+    middle.store.live ≤ baseline.store.peakLiveNodes
+
+theorem CompiledAttachment.selectedPrefixCostBounds
+    {world : Ixon.Owned} {fuel : Nat} (attached : CompiledAttachment world fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {controlFuel heapFuel : Nat} {baseline selected : Eval.Result}
+    (selectedRun : Eval.runMain
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target controlFuel heapFuel = .ok selected)
+    (costs : baseline.CostBounds selected) : attached.PrefixCostBounds selection heapFuel baseline := by
+  rw [Eval.runMain_eq_runMachine (attached.selectedMainEntry selection).1
+    (attached.selectedMainEntry selection).2] at selectedRun
+  intro count middle prefixSteps
+  have observed := Eval.runMachine_prefix_costs selectedRun prefixSteps (Nat.le_refl 0)
+  exact ⟨Nat.le_trans observed.1 costs.rcops,
+    Nat.le_trans observed.2.1 costs.peakLive, Nat.le_trans observed.2.2 costs.peakLive⟩
+
+/-- Owned execution derives the same semantic and resource endpoints as R3,
+and the compiler trace supplies RC and peak bounds without new caller premises. -/
+theorem CompiledAttachment.selectedPhysicalMainCostLaws
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut) :
+    ∃ baselineControl selectedControl heapFuel baseline selected locRel,
+      Eval.runMain attached.simulationTargetContext .physical
+        attached.target.artifact.program baselineControl heapFuel = .ok baseline ∧
+      Eval.runMain
+        (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+        .physical selection.target selectedControl heapFuel = .ok selected ∧
+      Lower.Sim.OutcomeRel sourceOut baseline ∧
+      ReuseSim.StableHeapRel baseline.store selected.store locRel ∧
+      IxIR1.Sim.RValIso locRel baseline.value selected.value ∧
+      baseline.SharedResources ∧ selected.SharedResources ∧
+      baseline.AllocationLaws selected ∧ baseline.CostBounds selected ∧
+      baseline.ReclaimedCostLaws selected ∧ attached.PrefixCostBounds selection heapFuel baseline := by
+  obtain ⟨baselineControl, selectedControl, heapFuel, baseline, selected, locRel,
+    baselineRun, selectedRun, baselineRelation, heaps, values, baselineResources,
+    selectedResources, allocations, reclaimed⟩ := attached.selectedPhysicalMainAllocationLaws selection ownedRun
+  have costs := attached.successfulPhysicalCostBounds selection baselineRun selectedRun
+  exact ⟨baselineControl, selectedControl, heapFuel, baseline, selected, locRel,
+    baselineRun, selectedRun, baselineRelation, heaps, values, baselineResources,
+    selectedResources, allocations, costs, costs.reclaimed heaps reclaimed,
+    attached.selectedPrefixCostBounds selection selectedRun costs⟩
+
+/-- Full counter and reclamation laws for arbitrary actual successful runs;
+the prefix bound uses the selected run's own traversal budget. -/
+theorem CompiledAttachment.successfulPhysicalCostLaws
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut)
+    {baselineControl baselineHeap selectedControl selectedHeap : Nat}
+    {baseline selected : Eval.Result}
+    (baselineRun : Eval.runMain attached.simulationTargetContext .physical
+      attached.target.artifact.program baselineControl baselineHeap = .ok baseline)
+    (selectedRun : Eval.runMain
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target selectedControl selectedHeap = .ok selected) :
+    baseline.AllocationLaws selected ∧ baseline.CostBounds selected ∧
+    baseline.ReclaimedCostLaws selected ∧ attached.PrefixCostBounds selection selectedHeap baseline := by
+  obtain ⟨witnessBaselineControl, witnessSelectedControl, witnessHeap, witnessBaseline,
+    witnessSelected, locRel, witnessBaselineRun, witnessSelectedRun,
+    _baselineRelation, _heaps, _values, _baselineResources, _selectedResources,
+    allocations, costs, reclaimed, _prefixes⟩ := attached.selectedPhysicalMainCostLaws selection ownedRun
+  obtain ⟨baselineStores, baselineValues⟩ := Eval.runMain_success_unique
+    attached.target.artifact.mainArity attached.target.artifact.mainNonempty witnessBaselineRun baselineRun
+  obtain ⟨selectedStores, selectedValues⟩ := Eval.runMain_success_unique
+    (attached.selectedMainEntry selection).1 (attached.selectedMainEntry selection).2
+    witnessSelectedRun selectedRun
+  have actualCosts : baseline.CostBounds selected := by
+    simpa only [Eval.Result.CostBounds, baselineStores, selectedStores] using costs
+  refine ⟨⟨?_, ?_⟩, actualCosts, ?_, attached.selectedPrefixCostBounds selection selectedRun actualCosts⟩
+  · simpa only [baselineStores, selectedStores] using allocations.allocations
+  · simpa only [baselineStores, selectedStores] using allocations.frees
+  · simpa only [Eval.Result.ReclaimedCostLaws, baselineStores, baselineValues,
+      selectedStores, selectedValues] using reclaimed
+
+/-- Compare the selected result and every prefix of its execution with one
+actual checked baseline, preserving both R2 resources and R3's counter laws. -/
+def CompiledAttachment.CostComparison
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    (selectedHeap : Nat) (selected : Eval.Result) : Prop :=
+  ∃ baselineControl baselineHeap baseline,
+    Eval.runMain attached.simulationTargetContext .physical attached.target.artifact.program
+      baselineControl baselineHeap = .ok baseline ∧
+    baseline.SharedResources ∧ baseline.AllocationLaws selected ∧ baseline.CostBounds selected ∧
+    baseline.ReclaimedCostLaws selected ∧ attached.PrefixCostBounds selection selectedHeap baseline
+
+theorem CompiledAttachment.CostComparison.allocations
+    {fuel : Nat} {attached : CompiledAttachment .shared fuel}
+    {selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program}
+    {heapFuel : Nat} {selected : Eval.Result}
+    (comparison : attached.CostComparison selection heapFuel selected) :
+    attached.AllocationComparison selected := by
+  obtain ⟨control, heap, baseline, run, resources, allocations, _costs, reclaimed, _prefixes⟩ := comparison
+  exact ⟨control, heap, baseline, run, resources, allocations, reclaimed.allocations⟩
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelineInvoke.lean b/Ix/Compiler/IxIR2/PipelineInvoke.lean
new file mode 100644
index 000000000..7510b5bf0
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelineInvoke.lean
@@ -0,0 +1,84 @@
+import Ix.Compiler.IxIR2.PipelinePhysical
+
+/-! Successful runtime invocation through the actual structured lowering.
+Entry ownership, reachable-heap provenance, and runtime invariants are the
+usual semantic ABI obligations; all callee simulations come from the checked
+attachment's existing recursive trace worker. -/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+theorem CompiledAttachment.successfulFunctionSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {address : Ixon.Address} {definition : Function}
+    (declared : attached.simulationTargetContext.declarations address = some (.fn definition))
+    (papSafe : definition.signature.papSafe = true)
+    (values : Array IxIR1.RVal)
+    {sourceFuel : Nat} {store : IxIR1.Store} {output : IxIR1.Store × IxIR1.RVal}
+    (run : IxIR1.invoke attached.simulationSourceContext sourceFuel address values.toList store = .ok output)
+    (ownership : IxIR1.Sim.RootOwnership store (IxIR1.Sim.rootsFor .shared values.toList))
+    (runtime : Lower.Sim.SourceRuntimeInvariant store values.toList.reverse)
+    (image : attached.SourceStoreImage store) :
+    ∃ controlFuel heapFuel targetOutput,
+      Eval.runFunction attached.simulationTargetContext .physical definition values controlFuel heapFuel
+        { heap := store } = .ok targetOutput ∧
+      Lower.Sim.OutcomeRel output targetOutput := by
+  obtain ⟨bodyFuel, _, invoked⟩ := IxIR1.invoke_success run
+  cases invoked with
+  | extern found _ _ _ =>
+    exact False.elim (attached.sourceDeclaration_not_extern rfl found)
+  | @fn sourceDefinition bodyOutput found arity bodyRun checked =>
+    obtain ⟨targetDefinition, trace, member, matched, targetAt⟩ :=
+      attached.functionTrace_of_source_declaration rfl rfl found
+    have same : targetDefinition = definition :=
+      Decl.fn.inj (Option.some.inj (targetAt.symm.trans declared))
+    subst targetDefinition
+    obtain ⟨outputEq, world⟩ := IxIR1.Sim.checkResultWorld_ok checked
+    subst bodyOutput
+    have sourceArity : values.size = trace.source.arity := by
+      simpa [matched.source] using arity
+    have targetArity : values.size = definition.signature.params.size := by
+      simpa [matched.generated] using sourceArity.trans trace.sourceArity.symm
+    have nonempty : definition.blocks.isEmpty = false := by
+      have head := trace.headBlockAt
+      rw [trace.rootHeadBlock, matched.generated] at head
+      obtain ⟨bound, _⟩ := Array.getElem?_eq_some_iff.mp head
+      simpa [Array.isEmpty] using (Nat.ne_of_gt bound)
+    let frame : Eval.Frame := { definition, values }
+    let machine := Eval.initialMachine definition values 0 { heap := store }
+    have state : attached.sidecars.TraceStateRel trace trace.root store values.toList.reverse frame := by
+      simpa [frame, matched.generated] using attached.functionEntryTraceState member values sourceArity
+    have stores : Lower.Sim.StoreRel store machine.store := by constructor <;> rfl
+    have entryOwnership : Lower.Sim.SourceOwnershipAt attached.target.artifact.trace.positions
+        trace.root store values.toList.reverse [] := by
+      intro position positionMember coordinate
+      rw [attached.target.entryCapabilities member positionMember coordinate]
+      have shape := attached.target.papSafeEntryCapabilities member (by simpa [matched.generated] using papSafe)
+      apply Lower.Sim.SourceOwnershipInvariant.sharedEntry
+      · simpa [matched.generated, targetArity] using shape
+      · simpa using ownership
+    have executed : IxIR1.runCode attached.simulationSourceContext bodyFuel trace.source store
+        values.toList.reverse trace.root.sourceCode = .ok output := by
+      simpa [trace.rootSourceCode, matched.source] using bodyRun
+    have resultWorld : IxIR1.Sim.HasWorld output.1 trace.source.result output.2 := by
+      simpa [matched.source] using world
+    have reached := (attached.successfulTraceSimulation attached.simulationSourceContext
+      attached.simulationTargetContext attached.successfulSimulationContracts bodyFuel)
+      member Lower.CodeTrace.Descendant.refl state stores runtime entryOwnership executed resultWorld
+      (show machine.control = .running frame [] from rfl) (show frame.credits = #[] from rfl) image
+      (attached.haltReturnHandler attached.simulationSourceContext attached.simulationTargetContext .logical trace output)
+    obtain ⟨heapFuel, controlFuel, final, steps, halted, finalStores⟩ := reached
+    cases final with
+    | mk targetStore heapRemaining finalControl =>
+      dsimp only at halted
+      subst finalControl
+      let targetOutput : Eval.Result := { store := targetStore, value := output.2, controlRemaining := 0, heapRemaining }
+      have logical : Eval.runFunction attached.simulationTargetContext .logical definition values controlFuel heapFuel
+          { heap := store } = .ok targetOutput := by
+        rw [Eval.runFunction_eq_runMachine targetArity nonempty]
+        simpa [machine, targetOutput, Eval.initialMachine] using steps.runMachine_halted
+      exact ⟨controlFuel, heapFuel, targetOutput,
+        Eval.runFunction_creditFree attached.target.creditFree declared targetArity nonempty logical,
+        { finalStores with value := rfl }⟩
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelinePhysical.lean b/Ix/Compiler/IxIR2/PipelinePhysical.lean
new file mode 100644
index 000000000..9e634114b
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelinePhysical.lean
@@ -0,0 +1,48 @@
+import Ix.Compiler.IxIR2.PipelineSim
+import Ix.Compiler.IxIR2.Interpretation
+
+/-! The validated baseline's exact logical-to-physical execution boundary. -/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+/-- The emitted baseline has identical successful main runs under both
+interpretations. The attachment supplies the complete instruction inventory
+and entry facts; callers supply only the run being transported. -/
+theorem CompiledAttachment.mainInterpretation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {first second : Eval.Interpretation} {controlFuel heapFuel : Nat}
+    {result : Eval.Result}
+    (run : Eval.runMain attached.simulationTargetContext first
+      attached.target.artifact.program controlFuel heapFuel = .ok result) :
+    Eval.runMain attached.simulationTargetContext second
+      attached.target.artifact.program controlFuel heapFuel = .ok result :=
+  Eval.runMain_creditFree attached.target.creditFree
+    attached.target.artifact.mainArity attached.target.artifact.mainNonempty run
+
+/-- Compose the existing logical whole-main theorem with exact baseline
+interpretation independence. The source heap and value remain unchanged. -/
+theorem CompiledAttachment.successfulPhysicalMainSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (run : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult
+      attached.target.artifact.source.main sourceFuel = .ok sourceOut) :
+    ∃ controlFuel heapFuel targetOut,
+      Eval.runMain attached.simulationTargetContext .physical
+        attached.target.artifact.program controlFuel heapFuel = .ok targetOut ∧
+      Lower.Sim.OutcomeRel sourceOut targetOut := by
+  obtain ⟨controlFuel, heapFuel, targetOut, logicalRun, related⟩ :=
+    attached.successfulCanonicalMainSimulation run
+  exact ⟨controlFuel, heapFuel, targetOut, attached.mainInterpretation logicalRun, related⟩
+
+
+/-! Existing theorem names remain available for direct application. -/
+namespace Attached
+export CompiledAttachment (
+  mainInterpretation
+  successfulPhysicalMainSimulation)
+end Attached
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelineResources.lean b/Ix/Compiler/IxIR2/PipelineResources.lean
new file mode 100644
index 000000000..60974d15f
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelineResources.lean
@@ -0,0 +1,140 @@
+import Ix.Compiler.IxIR2.PipelinePhysical
+import Ix.Compiler.IxIR2.ReuseLiveSim
+import Ix.Compiler.IxIR2.ReuseResources
+import Ix.Compiler.IxIR2.EvalFuel
+
+/-!
+# Terminal resources for the selected compiler output
+
+The common checked shared-main attachment supplies reclamation for its owned
+IxIR₁ execution. Exact baseline lowering and the existing selected semantic
+relation transport the release; actual physical execution supplies allocation
+accounting independently of that relation.
+-/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+open Ix.Compiler.Ixon (Owned)
+
+theorem CompiledAttachment.selectedMainEntry
+    {world : Owned} {fuel : Nat} (attached : CompiledAttachment world fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program) :
+    selection.target.main.signature.params.size = 0 ∧
+      selection.target.main.blocks.isEmpty = false := by
+  cases selection with
+  | optimized output produced =>
+      change output.target.main.signature.params.size = 0 ∧
+        output.target.main.blocks.isEmpty = false
+      rw [← output.trace_target]
+      exact ⟨by rw [output.trace.target_main_signature]; exact attached.target.artifact.mainArity,
+        output.trace.main.definition_blocks_nonempty attached.target.artifact.mainNonempty⟩
+  | baseline error rejected =>
+      exact ⟨attached.target.artifact.mainArity, attached.target.artifact.mainNonempty⟩
+
+/-- Successful owned execution of the exact shared compiler input supplies a
+release for any exactly related baseline result. No heap premise is supplied. -/
+theorem CompiledAttachment.baselineSharedReclamation
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    {sourceFuel : Nat} {store : IxIR1.Store} {value : IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok (store, value))
+    {baseline : Eval.Result} (related : Lower.Sim.OutcomeRel (store, value) baseline) :
+    ∃ releaseFuel released,
+      Eval.releaseShared releaseFuel baseline.store baseline.value = .ok (released, 0) ∧
+      released.live = 0 := by
+  have mainWorld : attached.target.artifact.source.mainResult = .shared := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+  have bodyRun := (IxIR1.Sim.runOwnedMain_ok ownedRun).1
+  rw [mainWorld] at bodyRun
+  have run : IxIR1.runMain attached.simulationSourceContext
+      attached.target.artifact.source.main sourceFuel = .ok (store, value) := bodyRun
+  have noReuse := attached.functionTraceNoReuse attached.target.artifact.mainTraceMember
+  rw [attached.target.artifact.mainSource] at noReuse
+  have reuses := IxIR1.NoReuse.runMain_reuses_eq_zero
+    (attached.sourceContextNoReuse rfl) noReuse run
+  have order := (IxIR1.Reclamation.runMain_order_of_reuses_eq_zero run reuses).1
+  have positive : Lower.Sim.PositiveSharedRC store := by
+    intro location box found shared
+    exact order.rc_pos found
+  have addressedRun : IxIR1.runMain
+      (attached.source.lowering.result.addressedCtx (fun _ _ => none))
+      attached.source.lowering.result.main sourceFuel = .ok (store, value) := by
+    rw [attached.simulationSourceContext_eq_addressedCtx, attached.targetSourceProduced,
+      attached.inputProduced] at run
+    exact run
+  obtain ⟨sourceReleaseFuel, sourceReleased, sourceRelease, sourceEmpty⟩ :=
+    attached.source.reclamation (fun _ _ => none) addressedRun
+  obtain ⟨releaseFuel, released, release, stores, positiveOut⟩ :=
+    Lower.Sim.dropVal_simulates_releaseSharedWork positive related.toStoreRel sourceRelease
+  refine ⟨releaseFuel, released, ?_, ?_⟩
+  · rw [related.value]
+    exact release
+  · change released.heap.live = 0
+    rw [stores.heap]
+    exact sourceEmpty
+
+/-- Every actual successful physical main of the selected program accounts
+for all allocations, including checked fallback to the baseline. -/
+theorem CompiledAttachment.selectedAllocationAccounting
+    {world : Owned} {fuel : Nat} (attached : CompiledAttachment world fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {context : Eval.Context} {controlFuel heapFuel : Nat} {result : Eval.Result}
+    (run : Eval.runMain context .physical selection.target controlFuel heapFuel = .ok result) :
+    result.store.live + result.store.heap.frees = result.store.heap.allocs :=
+  Eval.runMain_allocationAccounting (attached.selectedMainEntry selection).1
+    (attached.selectedMainEntry selection).2 run
+
+/-- The existing baseline simulation plus selected reuse preserves semantics
+and derives terminal resources for the same actual selected execution. -/
+theorem CompiledAttachment.selectedPhysicalMainResources
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut) :
+    ∃ controlFuel heapFuel result baseline locRel,
+      Eval.runMain
+        (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+        .physical selection.target controlFuel heapFuel = .ok result ∧
+      Lower.Sim.OutcomeRel sourceOut baseline ∧
+      ReuseSim.StableHeapRel baseline.store result.store locRel ∧
+      IxIR1.Sim.RValIso locRel baseline.value result.value ∧
+      result.SharedResources := by
+  obtain ⟨baselineControl, heapFuel, baseline, baselineRun, baselineRelation⟩ :=
+    attached.successfulPhysicalMainSimulation ownedRun
+  obtain ⟨releaseFuel, released, release, empty⟩ :=
+    attached.baselineSharedReclamation ownedRun baselineRelation
+  obtain ⟨controlFuel, result, locRel, run, heaps, values, budget⟩ :=
+    ReuseLiveSim.selectedPhysicalMainSimulation selection baselineRun
+  obtain ⟨output, outputRelease, outputEmpty⟩ := heaps.sharedReclamation values release empty
+  exact ⟨controlFuel, heapFuel, result, baseline, locRel, run, baselineRelation, heaps, values,
+    Eval.Result.sharedResources_of_release
+      (attached.selectedAllocationAccounting selection run) outputRelease outputEmpty⟩
+
+/-- The resource guarantee applies to any successful execution of the actual
+selection, including a different sufficient choice of control and heap fuel. -/
+theorem CompiledAttachment.selectedSuccessfulSharedResources
+    {fuel : Nat} (attached : CompiledAttachment .shared fuel)
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceOut : IxIR1.Store × IxIR1.RVal}
+    (ownedRun : IxIR1.runOwnedMain attached.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main
+      sourceFuel = .ok sourceOut)
+    {controlFuel heapFuel : Nat} {result : Eval.Result}
+    (run : Eval.runMain
+      (Eval.Context.ofProgram selection.target attached.target.artifact.validationContext.schemas)
+      .physical selection.target controlFuel heapFuel = .ok result) : result.SharedResources := by
+  obtain ⟨witnessControl, witnessHeap, witness, baseline, locRel, witnessRun,
+      baselineRelation, heaps, values, resources⟩ :=
+    attached.selectedPhysicalMainResources selection ownedRun
+  obtain ⟨stores, values⟩ := Eval.runMain_success_unique
+    (attached.selectedMainEntry selection).1 (attached.selectedMainEntry selection).2 witnessRun run
+  simpa only [Eval.Result.SharedResources, stores, values] using resources
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/PipelineSim.lean b/Ix/Compiler/IxIR2/PipelineSim.lean
new file mode 100644
index 000000000..2ae39cb78
--- /dev/null
+++ b/Ix/Compiler/IxIR2/PipelineSim.lean
@@ -0,0 +1,11102 @@
+import Ix.Compiler.IxIR2.LowerSim
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR1.EvalHistory
+import Ix.Compiler.IxIR1.ReaddressOwnership
+import Ix.Compiler.LoweredCompilationSim
+
+/-!
+# HPT-backed simulation adapters for the structured IxIR₂ pipeline
+
+This module composes the executable source-site sidecars with the local
+IxIR₁-to-IxIR₂ simulation rules.  Keeping the adapters here avoids making
+the executable pipeline depend on the full simulation development.
+-/
+
+namespace Ix.Compiler.IxIR2.Pipeline
+
+open Ix.Compiler.IxIR2
+
+/-- The recursive IxIR₂ trace state paired with the two source-side facts
+needed by the HPT-backed simulation: its retained coordinate names the exact
+IxIR₁ suffix, and the concrete source environment satisfies the facts
+replayed at that coordinate. -/
+structure Sidecars.TraceStateRel (sidecars : Sidecars)
+    (functionTrace : Lower.FunctionTrace) (trace : Lower.CodeTrace)
+    (sourceStore : IxIR1.Store) (source : List IxIR1.RVal)
+    (frame : Eval.Frame) : Prop where
+  sourceCode : sidecars.sourceCodeAt? trace.source = some trace.sourceCode
+  owner : trace.source.owner = functionTrace.owner
+  environment : sidecars.SiteEnvironmentHolds sourceStore trace.source source
+  target : Lower.Sim.CodeStateRel functionTrace trace source frame
+
+/-- The compiler's root-coordinate certificate and retained function syntax
+identify the same source body recovered by the sidecar. -/
+theorem Sidecars.sourceCodeAt?_functionRoot (sidecars : Sidecars)
+    {functionTrace : Lower.FunctionTrace}
+    (currentAt : sidecars.analysisCurrent? functionTrace.owner =
+      some functionTrace.source) :
+    sidecars.sourceCodeAt? functionTrace.root.source =
+      some functionTrace.root.sourceCode := by
+  rw [functionTrace.rootSource, functionTrace.rootSourceCode]
+  exact sidecars.sourceCodeAt?_root currentAt
+
+/-- Any retained function begins in the combined trace/HPT state when its
+resolved arguments are installed in call order. -/
+theorem Sidecars.functionEntryTraceState (sidecars : Sidecars)
+    {functionTrace : Lower.FunctionTrace} {sourceStore : IxIR1.Store}
+    (currentAt : sidecars.analysisCurrent? functionTrace.owner =
+      some functionTrace.source)
+    (values : Array IxIR1.RVal)
+    (arity : values.size = functionTrace.source.arity) :
+    sidecars.TraceStateRel functionTrace functionTrace.root sourceStore
+      values.toList.reverse
+      { definition := functionTrace.generated, values } := by
+  constructor
+  · exact sidecars.sourceCodeAt?_functionRoot currentAt
+  · rw [functionTrace.rootSource]
+  · rw [functionTrace.rootSource]
+    apply sidecars.siteEnvironmentHolds_root currentAt
+    simpa using arity
+  · exact Lower.Sim.functionEntryCodeState functionTrace values arity
+
+/-- Every retained declaration trace starts in the combined state.  Attachment
+alignment supplies the exact HPT analysis root, so recursive call simulation
+needs no separately reconstructed source function. -/
+theorem CompiledAttachment.declarationFunctionEntryTraceState
+     {mainWorld : Ixon.Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace} {sourceStore : IxIR1.Store}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (notMain : functionTrace.owner ≠ .main)
+    (values : Array IxIR1.RVal)
+    (arity : values.size = functionTrace.source.arity) :
+    attached.sidecars.TraceStateRel functionTrace functionTrace.root
+      sourceStore values.toList.reverse
+      { definition := functionTrace.generated, values } := by
+  exact attached.sidecars.functionEntryTraceState
+    (attached.functionTraceAnalysisCurrent functionMember notMain) values arity
+
+/-- A retained synthetic-main trace also has a combined entry state at any
+store.  Whole-program trace order identifies its literal closed source body;
+its zero arity reduces the argument environment to the empty main root. -/
+theorem CompiledAttachment.mainFunctionEntryTraceState
+     {mainWorld : Ixon.Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace} {sourceStore : IxIR1.Store}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (owner : functionTrace.owner = .main)
+    (values : Array IxIR1.RVal)
+    (arity : values.size = functionTrace.source.arity) :
+    attached.sidecars.TraceStateRel functionTrace functionTrace.root
+      sourceStore values.toList.reverse
+      { definition := functionTrace.generated, values } := by
+  have mainMatch := attached.target.artifact.functionTraceOrderProof
+    |>.main_of_mem_owner functionMember owner
+  have sourceArityZero : functionTrace.source.arity = 0 := by
+    rw [mainMatch.source, attached.targetSourceProduced]
+    rfl
+  have valuesEmpty : values = #[] :=
+    Array.eq_empty_of_size_eq_zero (arity.trans sourceArityZero)
+  subst values
+  constructor
+  · simpa [functionTrace.rootSource, owner, functionTrace.rootSourceCode,
+      mainMatch.source, attached.targetSourceProduced,
+      Lower.Input.mainDefinition] using
+      attached.sidecars.sourceCodeAt?_main
+  · rw [functionTrace.rootSource]
+  · rw [functionTrace.rootSource, owner]
+    exact attached.sidecars.siteEnvironmentHolds_main
+  · exact Lower.Sim.functionEntryCodeState functionTrace #[] (by
+      simp [sourceArityZero])
+
+/-- Every retained function, including the fail-closed synthetic main, starts
+in the combined state for its canonical reversed argument environment. -/
+theorem CompiledAttachment.functionEntryTraceState
+     {mainWorld : Ixon.Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace} {sourceStore : IxIR1.Store}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (values : Array IxIR1.RVal)
+    (arity : values.size = functionTrace.source.arity) :
+    attached.sidecars.TraceStateRel functionTrace functionTrace.root
+      sourceStore values.toList.reverse
+      { definition := functionTrace.generated, values } := by
+  by_cases owner : functionTrace.owner = .main
+  · exact attached.mainFunctionEntryTraceState functionMember owner values arity
+  · exact attached.declarationFunctionEntryTraceState functionMember owner
+      values arity
+
+/-- The exact checked target main starts in the combined source/HPT/target
+trace state with empty source store and environment. -/
+theorem CompiledAttachment.initialMainTraceState
+     {mainWorld : Ixon.Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    attached.sidecars.TraceStateRel
+      attached.target.artifact.mainTrace
+      attached.target.artifact.mainTrace.root ({} : IxIR1.Store) []
+      (Lower.Sim.initialMainFrame attached.target.artifact) := by
+  constructor
+  · rw [attached.target.artifact.mainTrace.rootSource,
+      attached.target.artifact.mainOwner,
+      attached.target.artifact.mainRootSourceCode,
+      attached.targetSourceProduced]
+    exact attached.sidecars.sourceCodeAt?_main
+  · rw [attached.target.artifact.mainTrace.rootSource]
+  · rw [attached.target.artifact.mainTrace.rootSource,
+      attached.target.artifact.mainOwner]
+    exact attached.sidecars.siteEnvironmentHolds_main
+  · exact Lower.Sim.initialMainCodeState attached.target.artifact
+
+/-- The checked synthetic main also starts with the exact trace-indexed
+ownership state: both its source environment and retained input map are
+empty, so there are no external owner tokens to account for. -/
+theorem CompiledAttachment.initialMainSourceOwnership
+     {mainWorld : Ixon.Owned}
+    {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      attached.target.artifact.mainTrace.root ({} : IxIR1.Store) [] [] := by
+  apply Lower.Sim.SourceOwnershipAt.empty
+  rw [attached.target.artifact.mainEntryInput]
+  rfl
+
+/-- Generic linear induction step for the combined state. The operation's
+target simulation supplies only the next target `CodeStateRel`; source syntax
+and the HPT environment advance from the retained trace and successful source
+operation. -/
+theorem Sidecars.TraceStateRel.next
+    {sidecars : Sidecars} {functionTrace : Lower.FunctionTrace}
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    {frame nextFrame : Eval.Frame}
+    (state : sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    (postFixpoint : IxIR1.HPT.LocalPostFixpoint
+      (IxIR1.Env.ofList sidecars.input.declarations)
+      sidecars.hptCertificate.summaryEnv)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.Env.ofList sidecars.input.declarations)
+    (currentCompatible : ∀ current,
+      sidecars.analysisCurrent? site.owner = some current →
+        current = sourceCurrent)
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel sourceCurrent
+      sourceStore source operation = .ok (outputStore, value))
+    (nextTarget : Lower.Sim.CodeStateRel functionTrace next
+      (value :: source) nextFrame) :
+    sidecars.TraceStateRel functionTrace next outputStore
+      (value :: source) nextFrame := by
+  have continuation := (functionTrace.descendantLetOpMatch descendant).1
+  have sourceAt : sidecars.sourceCodeAt? site =
+      some (.letOp operation next.sourceCode) := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceCode] using
+      state.sourceCode
+  have nextSourceAt := sidecars.sourceCodeAt?_next sourceAt
+  have nextEnvironment :=
+    sidecars.siteEnvironmentHolds_next_of_currentCompatible postFixpoint
+      sourceDeclarations currentCompatible state.environment sourceAt sourceRun
+  constructor
+  · rw [continuation.nextSource]
+    exact nextSourceAt
+  · rw [continuation.nextSource]
+    exact state.owner
+  · rw [continuation.nextSource]
+    exact nextEnvironment
+  · exact nextTarget
+
+/-- Attachment-facing linear transport. The attachment supplies the checked
+HPT post-fixpoint and rewrites the source evaluator's declaration environment
+to the exact sidecar environment; callers retain only function-owner
+compatibility and the local successful operation. -/
+theorem CompiledAttachment.traceState_next
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    {frame nextFrame : Eval.Frame} {functionTrace : Lower.FunctionTrace}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (currentCompatible : ∀ current,
+      attached.sidecars.analysisCurrent? functionTrace.owner = some current →
+        current = sourceCurrent)
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel sourceCurrent
+      sourceStore source operation = .ok (outputStore, value))
+    (nextTarget : Lower.Sim.CodeStateRel functionTrace next
+      (value :: source) nextFrame) :
+    attached.sidecars.TraceStateRel functionTrace next outputStore
+      (value :: source) nextFrame := by
+  apply state.next descendant attached.hptSidecarLocalPostFixpoint
+    (sourceDeclarations.trans attached.sidecarDeclarationEnvironment.symm)
+  · intro current currentAt
+    apply currentCompatible current
+    rw [← state.owner]
+    exact currentAt
+  · exact sourceRun
+  · exact nextTarget
+
+/-- Declaration-trace specialization: the attachment's whole-trace alignment
+discharges current-function compatibility for any retained function member. -/
+theorem CompiledAttachment.traceState_next_of_member
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    {frame nextFrame : Eval.Frame} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frame)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel functionTrace.source
+      sourceStore source operation = .ok (outputStore, value))
+    (nextTarget : Lower.Sim.CodeStateRel functionTrace next
+      (value :: source) nextFrame) :
+    attached.sidecars.TraceStateRel functionTrace next outputStore
+      (value :: source) nextFrame := by
+  exact attached.traceState_next state descendant sourceDeclarations
+    (attached.functionTraceAnalysisCurrentCompatible functionMember)
+    sourceRun nextTarget
+
+/-- Distinguished-main specialization. It remains valid when main analysis
+fails closed, and otherwise uses the producer-certified main source. -/
+theorem CompiledAttachment.mainTraceState_next
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal} {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {instruction : Instr} {next : Lower.CodeTrace}
+    {frame nextFrame : Eval.Frame}
+    (state : attached.sidecars.TraceStateRel
+      attached.target.artifact.mainTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frame)
+    (descendant : attached.target.artifact.mainTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel
+      attached.target.artifact.mainTrace.source sourceStore source operation =
+        .ok (outputStore, value))
+    (nextTarget : Lower.Sim.CodeStateRel
+      attached.target.artifact.mainTrace next (value :: source) nextFrame) :
+    attached.sidecars.TraceStateRel attached.target.artifact.mainTrace next
+      outputStore (value :: source) nextFrame := by
+  apply attached.traceState_next state descendant sourceDeclarations
+  · intro current currentAt
+    apply attached.mainAnalysisCurrentCompatible current
+    rw [← attached.target.artifact.mainOwner]
+    exact currentAt
+  · exact sourceRun
+  · exact nextTarget
+
+/-- The traced `pure`/`move` operation advances the attachment's combined
+source/HPT/target state in one target step. -/
+theorem CompiledAttachment.simulate_traced_pure_move_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.pure sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceStore
+        (value :: source) nextFrame := by
+  dsimp only
+  have sourceOperation :
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+        source (.pure sourceAtom) = .ok (sourceStore, value) := by
+    unfold IxIR1.runOp
+    simp [sourceResolved]
+  obtain ⟨targetStep, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_pure_move_state descendant state.target
+      sourceResolved control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceOperation nextTarget
+  exact ⟨sourceOperation, targetStep, stores, nextState⟩
+
+/-- Successful-source-run induction form of `pure`/`move`: invert the source
+`letOp`, take the target step, and return the smaller-fuel continuation with
+the combined trace state. -/
+theorem CompiledAttachment.simulate_traced_pure_move_success_step
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat} {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {sourceOutput : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.pure sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (control : machine.control = .running frame stack) :
+    ∃ value nextFrame,
+      nextFrame =
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push value } ∧
+        IxIR1.resolveAtom source sourceAtom = .ok value ∧
+        IxIR1.runCode sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore (value :: source) next.sourceCode = .ok sourceOutput ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running nextFrame stack } ∧
+        Lower.Sim.StoreRel sourceStore
+          ({ machine with control := .running nextFrame stack } :
+            Eval.Machine).store ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceStore
+          (value :: source) nextFrame := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨value, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_pure_success operationRun
+  have middleStoreEq : middleStore = sourceStore :=
+    congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue = value :=
+    congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+    attached.simulate_traced_pure_move_state (sourceFuel := sourceFuel)
+      functionMember descendant state stores
+      sourceDeclarations sourceResolved control
+  exact ⟨value,
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push value },
+    rfl, sourceResolved, continuationRun, targetStep, nextStores, nextState⟩
+
+/-- Checked ordinary allocation advances the attachment's combined state.
+Function membership supplies the schema/capability certificates and exact
+HPT owner/current compatibility for the recursive continuation. -/
+theorem CompiledAttachment.simulate_traced_alloc_checked_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceWorld targetWorld : Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {schema : CtorSchema} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (control : machine.control = .running frame stack)
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frameRoots) :
+    let node := IxIR1.Node.ctorN sourceCid values.toArray
+    let sourceAllocation := sourceStore.allocNode sourceWorld node
+    let targetAllocation := machine.store.allocNode sourceWorld node
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc sourceAllocation.2) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.alloc sourceWorld sourceCid sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceAllocation.1
+        (.loc sourceAllocation.2 :: source) nextFrame := by
+  dsimp only
+  obtain ⟨sourceRun, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_alloc_checked_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := functionTrace.source) (sourceFuel := sourceFuel)
+      (interpretation := interpretation)
+      (checked := attached.target) functionMember contextSchemas descendant
+      state.target stores sourceResolved control schemaAt ownership
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Successful-source-run form of attached checked allocation. Source
+evaluation determines the exact field vector and fresh location; the result
+contains the smaller-fuel continuation and combined recursive state. -/
+theorem CompiledAttachment.simulate_traced_alloc_checked_success_step
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {machine : Eval.Machine}
+    {frame : Eval.Frame} {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceWorld targetWorld : Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.alloc sourceWorld sourceCid sourceArguments)
+          next.sourceCode) = .ok sourceOutput)
+    (control : machine.control = .running frame stack)
+    {schema : CtorSchema}
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frameRoots) :
+    ∃ values sourceAllocation targetAllocation nextFrame,
+      sourceAllocation = sourceStore.allocNode sourceWorld
+          (.ctorN sourceCid values.toArray) ∧
+        targetAllocation = machine.store.allocNode sourceWorld
+          (.ctorN sourceCid values.toArray) ∧
+        IxIR1.resolveAtoms source sourceArguments = .ok values ∧
+        IxIR1.runCode sourceContext (sourceFuel + 1) functionTrace.source
+          sourceAllocation.1 (.loc sourceAllocation.2 :: source)
+          next.sourceCode = .ok sourceOutput ∧
+        nextFrame =
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push (.loc sourceAllocation.2) } ∧
+        Eval.Step context .logical machine
+          { machine with
+            store := targetAllocation.1
+            control := .running nextFrame stack } ∧
+        Lower.Sim.StoreRel sourceAllocation.1 targetAllocation.1 ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceAllocation.1
+          (.loc sourceAllocation.2 :: source) nextFrame := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨values, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_alloc_success operationRun
+  have middleStoreEq : middleStore =
+      (sourceStore.allocNode sourceWorld
+        (.ctorN sourceCid values.toArray)).1 :=
+    congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue =
+      .loc (sourceStore.allocNode sourceWorld
+        (.ctorN sourceCid values.toArray)).2 :=
+    congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+    attached.simulate_traced_alloc_checked_state
+      (sourceFuel := sourceFuel) functionMember contextSchemas descendant state
+      stores sourceDeclarations sourceResolved control schemaAt ownership
+  exact ⟨values,
+    sourceStore.allocNode sourceWorld (.ctorN sourceCid values.toArray),
+    machine.store.allocNode sourceWorld (.ctorN sourceCid values.toArray),
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push
+        (.loc (sourceStore.allocNode sourceWorld
+          (.ctorN sourceCid values.toArray)).2) },
+    rfl, rfl, sourceResolved, continuationRun, rfl, targetStep, nextStores,
+    nextState⟩
+
+/-- Scalar `dup`/`retainShared` advances the combined attachment state without
+changing either heap. -/
+theorem CompiledAttachment.simulate_traced_dup_retain_scalar_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.dup sourceAtom) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceStore
+        (value :: source) nextFrame := by
+  dsimp only
+  obtain ⟨sourceRun, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_dup_retain_scalar_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := functionTrace.source) (sourceFuel := sourceFuel)
+      descendant state.target stores sourceResolved scalar control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Heap-bearing shared `dup`/`retainShared` advances the combined attachment
+state through the matched reference-count update. -/
+theorem CompiledAttachment.simulate_traced_dup_retain_shared_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (control : machine.control = .running frame stack) :
+    let nextBox := { box with rc := box.rc + 1 }
+    let sourceStore' := (sourceStore.setBox location nextBox).rcTick
+    let targetStore' := (machine.store.setBox location nextBox).rcTick
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc location) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.dup sourceAtom) = .ok (sourceStore', .loc location) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetStore'
+          control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore' targetStore' ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceStore'
+        (.loc location :: source) nextFrame := by
+  dsimp only
+  obtain ⟨sourceRun, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_dup_retain_shared_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := functionTrace.source) (sourceFuel := sourceFuel)
+      descendant state.target stores sourceResolved sourceGet shared control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Scalar shared release advances the combined state while consuming one
+unit of target heap work and leaving both heaps unchanged. -/
+theorem CompiledAttachment.simulate_traced_drop_release_scalar_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.drop sourceAtom) = .ok (sourceStore, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store
+          heapFuel := targetHeapFuel
+          control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceStore
+        (.erased :: source) nextFrame := by
+  dsimp only
+  obtain ⟨sourceRun, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_drop_release_scalar_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := functionTrace.source) (sourceFuel := sourceFuel)
+      descendant state.target stores sourceResolved scalar heapFuel control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Scalar unique drop advances the combined state while consuming one unit
+of target heap work and leaving both heaps unchanged. -/
+theorem CompiledAttachment.simulate_traced_dropU_dropUnique_scalar_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.dropU sourceAtom) = .ok (sourceStore, .erased) ∧
+      Eval.Step context interpretation machine
+        { store := machine.store
+          heapFuel := targetHeapFuel
+          control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceStore
+        (.erased :: source) nextFrame := by
+  dsimp only
+  obtain ⟨sourceRun, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_dropU_dropUnique_scalar_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := functionTrace.source) (sourceFuel := sourceFuel)
+      descendant state.target stores sourceResolved scalar heapFuel control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Recursive unique destruction selects a sufficient target heap budget and
+advances the combined attachment state to the exact post-drop heap. -/
+theorem CompiledAttachment.simulate_traced_dropU_dropUnique_recursive_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceStore sourceStore' : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropUVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack) :
+    ∃ targetHeapFuel targetStore,
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+            sourceStore source (.dropU sourceAtom) =
+          .ok (sourceStore', .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetStore
+            heapFuel := 0
+            control := .running nextFrame stack } ∧
+        Lower.Sim.StoreRel sourceStore' targetStore ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceStore'
+          (.erased :: source) nextFrame := by
+  obtain ⟨targetHeapFuel, targetStore, sourceRun, targetStep, nextStores,
+      nextTarget⟩ :=
+    Lower.Sim.simulate_traced_dropU_dropUnique_recursive_state
+      (sourceCurrent := functionTrace.source) descendant state.target stores
+      sourceResolved sourceDropped control
+  refine ⟨targetHeapFuel, targetStore, ?_⟩
+  dsimp only
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Framed recursive unique destruction.  Its locally sufficient traversal
+budget can be prefixed to any independently funded continuation. -/
+theorem CompiledAttachment.simulate_traced_dropU_dropUnique_recursive_state_framed
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceStore sourceStore' : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropUVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack) :
+    ∃ localFuel targetStore,
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+            sourceStore source (.dropU sourceAtom) =
+          .ok (sourceStore', .erased) ∧
+        Eval.dropUnique localFuel machine.store (.loc location) =
+          .ok (targetStore, 0) ∧
+        (∀ suffixFuel,
+          Eval.Step context interpretation
+            { machine with heapFuel := localFuel + suffixFuel }
+            { store := targetStore
+              heapFuel := suffixFuel
+              control := .running nextFrame stack }) ∧
+        Lower.Sim.StoreRel sourceStore' targetStore ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceStore'
+          (.erased :: source) nextFrame := by
+  have translated : Lower.Sim.translateAtom input sourceAtom =
+      some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ :=
+    state.target.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] = .dropUnique targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    Lower.Sim.resolveAtom_of_envRel state.target.environments translated
+      sourceResolved
+  obtain ⟨localFuel, targetStore, targetRun, nextStores⟩ :=
+    Lower.Sim.dropUVal_simulates_dropUniqueWork stores sourceDropped
+  have exactDrop :
+      Eval.dropUnique localFuel machine.store (.loc location) =
+        .ok (targetStore, 0) := by
+    simpa [Eval.dropUnique] using targetRun
+  have targetStep : ∀ suffixFuel,
+      Eval.Step context interpretation
+        { machine with heapFuel := localFuel + suffixFuel }
+        { store := targetStore
+          heapFuel := suffixFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } := by
+    intro suffixFuel
+    have framedDrop :
+        Eval.dropUnique (localFuel + suffixFuel) machine.store
+            (.loc location) = .ok (targetStore, suffixFuel) :=
+      Lower.Sim.dropUnique_add_suffix exactDrop
+    have beforeControl :
+        ({ machine with heapFuel := localFuel + suffixFuel } :
+          Eval.Machine).control = .running frame stack := by
+      simpa using control
+    exact Eval.Step.dropUnique (context := context)
+      (interpretation := interpretation) beforeControl blockAt pcBound
+      instruction targetResolved framedDrop
+  have sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore source (.dropU sourceAtom) =
+        .ok (sourceStore', .erased) := by
+    unfold IxIR1.runOp
+    simp only
+    rw [sourceResolved]
+    simp only [bind, Except.bind]
+    rw [sourceDropped]
+  have canonical := state.target.environments.bindErased
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.dropUnique targetAtom) = some .erased by rfl)
+  have nextTarget : Lower.Sim.CodeStateRel functionTrace next
+      (.erased :: source) { frame with pc := frame.pc + 1 } := by
+    refine state.target.letOpNext descendant rfl rfl rfl ?_ rfl
+      nextEnvironments
+    simp [Lower.Instr.baselineValueDelta]
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨localFuel, targetStore, sourceRun, exactDrop, targetStep, nextStores,
+    nextState⟩
+
+/-- Recursive shared destruction selects a sufficient target heap budget,
+preserves positive shared reference counts, and advances the combined state. -/
+theorem CompiledAttachment.simulate_traced_drop_release_recursive_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceStore sourceStore' : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      sourceStore source frame)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack) :
+    ∃ targetHeapFuel targetStore,
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+            sourceStore source (.drop sourceAtom) =
+          .ok (sourceStore', .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetStore
+            heapFuel := 0
+            control := .running nextFrame stack } ∧
+        Lower.Sim.StoreRel sourceStore' targetStore ∧
+        Lower.Sim.PositiveSharedRC sourceStore' ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceStore'
+          (.erased :: source) nextFrame := by
+  obtain ⟨targetHeapFuel, targetStore, sourceRun, targetStep, nextStores,
+      nextPositive, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_drop_release_recursive_state
+      (sourceCurrent := functionTrace.source) descendant state.target positive
+      stores sourceResolved sourceDropped control
+  refine ⟨targetHeapFuel, targetStore, ?_⟩
+  dsimp only
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextPositive, nextState⟩
+
+/-- Framed recursive shared destruction.  The local traversal budget is
+selected from the successful source drop, while an arbitrary continuation
+budget passes through the target work list unchanged. -/
+theorem CompiledAttachment.simulate_traced_drop_release_recursive_state_framed
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceStore sourceStore' : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      sourceStore source frame)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceDropped :
+      IxIR1.dropVal sourceContext sourceFuel sourceStore (.loc location) =
+        .ok sourceStore')
+    (control : machine.control = .running frame stack) :
+    ∃ localFuel targetStore,
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+            sourceStore source (.drop sourceAtom) =
+          .ok (sourceStore', .erased) ∧
+        Eval.releaseShared localFuel machine.store (.loc location) =
+          .ok (targetStore, 0) ∧
+        (∀ suffixFuel,
+          Eval.Step context interpretation
+            { machine with heapFuel := localFuel + suffixFuel }
+            { store := targetStore
+              heapFuel := suffixFuel
+              control := .running nextFrame stack }) ∧
+        Lower.Sim.StoreRel sourceStore' targetStore ∧
+        Lower.Sim.PositiveSharedRC sourceStore' ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceStore'
+          (.erased :: source) nextFrame := by
+  have translated : Lower.Sim.translateAtom input sourceAtom =
+      some targetAtom := by
+    simpa [Lower.OperationSyntax] using
+      functionTrace.descendantOperationSyntax descendant
+  obtain ⟨blockAt, pcBound, instructionAt⟩ :=
+    state.target.instructionAt descendant
+  have instruction :
+      next.headBlock.2.instructions[frame.pc] =
+        .releaseShared targetAtom :=
+    (Array.getElem?_eq_some_iff.mp instructionAt).2
+  have targetResolved :
+      Eval.resolveAtom frame.values targetAtom = .ok (.loc location) :=
+    Lower.Sim.resolveAtom_of_envRel state.target.environments translated
+      sourceResolved
+  obtain ⟨localFuel, targetStore, targetRun, nextStores, nextPositive⟩ :=
+    Lower.Sim.dropVal_simulates_releaseSharedWork positive stores sourceDropped
+  have exactRelease :
+      Eval.releaseShared localFuel machine.store (.loc location) =
+        .ok (targetStore, 0) := by
+    simpa [Eval.releaseShared] using targetRun
+  have targetStep : ∀ suffixFuel,
+      Eval.Step context interpretation
+        { machine with heapFuel := localFuel + suffixFuel }
+        { store := targetStore
+          heapFuel := suffixFuel
+          control := .running { frame with pc := frame.pc + 1 } stack } := by
+    intro suffixFuel
+    have framedRelease :
+        Eval.releaseShared (localFuel + suffixFuel) machine.store
+            (.loc location) = .ok (targetStore, suffixFuel) :=
+      Lower.Sim.releaseShared_add_suffix exactRelease
+    have beforeControl :
+        ({ machine with heapFuel := localFuel + suffixFuel } :
+          Eval.Machine).control = .running frame stack := by
+      simpa using control
+    exact Eval.Step.releaseShared (context := context)
+      (interpretation := interpretation) beforeControl blockAt pcBound
+      instruction targetResolved framedRelease
+  have sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore source (.drop sourceAtom) =
+        .ok (sourceStore', .erased) := by
+    unfold IxIR1.runOp
+    simp only
+    rw [sourceResolved]
+    simp only [bind, Except.bind]
+    rw [sourceDropped]
+  have canonical := state.target.environments.bindErased
+  have nextEnvironments := canonical.forgetTracedErased descendant
+    (show Lower.Instr.baselineBinderAtom entryValueCount
+      (.releaseShared targetAtom) = some .erased by rfl)
+  have nextTarget : Lower.Sim.CodeStateRel functionTrace next
+      (.erased :: source) { frame with pc := frame.pc + 1 } := by
+    refine state.target.letOpNext descendant rfl rfl rfl ?_ rfl
+      nextEnvironments
+    simp [Lower.Instr.baselineValueDelta]
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨localFuel, targetStore, sourceRun, exactRelease, targetStep, nextStores,
+    nextPositive, nextState⟩
+
+/-- A strictly under-saturated function partial application allocates the
+matched PAP node and advances the attachment's combined recursive state. -/
+theorem CompiledAttachment.simulate_traced_papp_fn_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {targetDefinition : Function}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {sourceDefinition : IxIR1.FnDef}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceDeclaration :
+      sourceContext.decls sourceAddress = some (.fn sourceDefinition))
+    (targetDeclaration :
+      context.declarations sourceAddress = some (.fn targetDefinition))
+    (arity :
+      targetDefinition.signature.params.size = sourceDefinition.arity)
+    (papSafe : targetDefinition.signature.papSafe = true)
+    (under : values.length < sourceDefinition.arity)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let node := IxIR1.Node.papN sourceAddress sourceDefinition.arity
+      values.toArray
+    let sourceAllocation := sourceStore.allocNode .shared node
+    let targetAllocation := machine.store.allocNode .shared node
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push (.loc sourceAllocation.2) }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.papp sourceAddress sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := targetAllocation.1
+          control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceAllocation.1 targetAllocation.1 ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceAllocation.1
+        (.loc sourceAllocation.2 :: source) nextFrame := by
+  dsimp only
+  obtain ⟨sourceRun, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_papp_fn_state
+      (sourceCurrent := functionTrace.source) descendant state.target stores
+      sourceResolved sourceDeclaration targetDeclaration arity papSafe under
+      noCredits control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-! ## Combined dynamic-application transitions -/
+
+/-- Any successful dynamic-application transfer advances the attachment's
+combined caller continuation.  The target dispatcher supplies the emitted
+step and its future caller `CodeStateRel`; the completed source operation
+advances the exact HPT coordinate and environment. -/
+theorem CompiledAttachment.simulate_traced_apply_transfer_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {function : IxIR1.RVal}
+    {values : List IxIR1.RVal} {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceFunctionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok function)
+    (sourceArgumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceRun : IxIR1.runOp sourceContext sourceFuel functionTrace.source
+      sourceStore source (.apply sourceFunction sourceArguments) =
+        .ok (outputStore, value))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel function values.toArray
+      { frame with pc := frame.pc + 1 } stack target) :
+    Eval.Step context interpretation machine target ∧
+      attached.sidecars.TraceStateRel functionTrace next outputStore
+        (value :: source)
+        { frame with
+          pc := frame.pc + 1
+          values := frame.values.push value } := by
+  obtain ⟨targetStep, nextTargets⟩ :=
+    Lower.Sim.simulate_traced_apply_transfer_state descendant state.target
+      sourceFunctionResolved sourceArgumentsResolved noCredits control
+      transferred
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun (nextTargets value)
+  exact ⟨targetStep, nextState⟩
+
+/-- Applying an erased function releases the resolved residual arguments and
+advances the emitted `apply` instruction directly to the combined caller
+continuation with an erased result. -/
+theorem CompiledAttachment.simulate_traced_apply_erased_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceStore sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok .erased)
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceRelease : IxIR1.dropMany sourceContext sourceFuel sourceStore
+      values = .ok sourceReleased)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    ∃ (targetHeapFuel : Nat) (targetReleased : Eval.Store),
+      IxIR1.runOp sourceContext (sourceFuel + 2) functionTrace.source
+          sourceStore source (.apply sourceFunction sourceArguments) =
+          .ok (sourceReleased, .erased) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetReleased
+            heapFuel := 0
+            control := .running
+              { frame with
+                pc := frame.pc + 1
+                values := frame.values.push .erased } stack } ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        Lower.Sim.PositiveSharedRC sourceReleased ∧
+        attached.sidecars.TraceStateRel functionTrace next sourceReleased
+          (.erased :: source)
+          { frame with
+            pc := frame.pc + 1
+            values := frame.values.push .erased } := by
+  obtain ⟨targetHeapFuel, targetReleased, sourceApply, transferred,
+      nextStores, nextPositive⟩ :=
+    Lower.Sim.simulate_applyGo_erased
+      (resume := { frame with pc := frame.pc + 1 }) (stack := stack)
+      positive stores sourceRelease
+  have sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 2) functionTrace.source
+          sourceStore source (.apply sourceFunction sourceArguments) =
+          .ok (sourceReleased, .erased) := by
+    rw [IxIR1.runOp.eq_def]
+    dsimp only
+    rw [functionResolved]
+    simp only [bind, Except.bind]
+    rw [argumentsResolved]
+    exact sourceApply
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame stack := by
+    simpa using control
+  obtain ⟨targetStep, nextState⟩ :=
+    attached.simulate_traced_apply_transfer_state functionMember descendant
+      state sourceDeclarations functionResolved argumentsResolved sourceRun
+      noCredits beforeControl transferred
+  exact ⟨targetHeapFuel, targetReleased, sourceRun, targetStep, nextStores,
+    nextPositive, nextState⟩
+
+/-- Under-saturating a shared PAP completes in the dispatcher itself and
+therefore advances directly to the caller's combined continuation state. -/
+theorem CompiledAttachment.simulate_traced_apply_pap_under_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let pap := IxIR1.Node.papN address arity (captured ++ values.toArray)
+    let sourceAllocation := sourceReleased.allocNode .shared pap
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Lower.Sim.StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        let targetAllocation := targetReleased.allocNode .shared pap
+        IxIR1.runOp sourceContext (sourceFuel + 2) functionTrace.source
+            sourceStore source (.apply sourceFunction sourceArguments) =
+            .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+          Eval.Step context interpretation
+            { machine with heapFuel := targetHeapFuel }
+            { store := targetAllocation.1
+              heapFuel := 0
+              control := .running
+                { frame with
+                  pc := frame.pc + 1
+                  values := frame.values.push (.loc sourceAllocation.2) }
+                stack } ∧
+          Lower.Sim.StoreRel sourceAllocation.1 targetAllocation.1 ∧
+          attached.sidecars.TraceStateRel functionTrace next
+            sourceAllocation.1 (.loc sourceAllocation.2 :: source)
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push (.loc sourceAllocation.2) } := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceRun, transferred,
+      nextStores⟩ :=
+    Lower.Sim.simulate_apply_pap_under
+      (sourceCurrent := functionTrace.source)
+      (resume := { frame with pc := frame.pc + 1 })
+      (stack := stack) stores positive functionResolved argumentsResolved
+        sourceGet shared node capturedUnder sourceRetain sourceRelease
+        totalUnder
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame stack := by
+    simpa using control
+  obtain ⟨targetStep, nextState⟩ :=
+    attached.simulate_traced_apply_transfer_state functionMember descendant
+      state sourceDeclarations functionResolved argumentsResolved sourceRun
+      noCredits beforeControl transferred
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceRun, targetStep,
+    nextStores, nextState⟩
+
+/-- Exact PAP saturation enters the retained callee in the combined state.
+The suspended caller continuation is returned as a builder indexed by the
+eventual successful source application, which is precisely the recursive
+callee-result handoff needed by the whole-code induction. -/
+theorem CompiledAttachment.simulate_traced_apply_pap_saturated_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let sourceTotal := captured.toList ++ values
+    let targetTotal := captured ++ values.toArray
+    let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetTotal }
+    let targetMachine : Eval.Machine :=
+      { store := machine.store
+        heapFuel := 0
+        control := .running calleeFrame (.resume resume :: stack) }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Lower.Sim.StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        IxIR1.runOp sourceContext (sourceFuel + 2) callerTrace.source
+            sourceStore source (.apply sourceFunction sourceArguments) =
+          IxIR1.invoke sourceContext sourceFuel address sourceTotal
+            sourceReleased ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { targetMachine with store := targetReleased } ∧
+        attached.sidecars.TraceStateRel calleeTrace calleeTrace.root
+          sourceReleased sourceTotal.reverse calleeFrame ∧
+        ∀ (outputStore : IxIR1.Store) (value : IxIR1.RVal),
+          IxIR1.runOp sourceContext (sourceFuel + 2) callerTrace.source
+              sourceStore source (.apply sourceFunction sourceArguments) =
+              .ok (outputStore, value) →
+            attached.sidecars.TraceStateRel callerTrace next outputStore
+              (value :: source)
+              { frame with
+                pc := frame.pc + 1
+                values := frame.values.push value } := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceEquation,
+      targetStep, _, callerTargets⟩ :=
+    Lower.Sim.simulate_traced_apply_pap_saturated_enter_state
+      (sourceCurrent := callerTrace.source) descendant calleeMatch state.target
+      stores positive functionResolved argumentsResolved sourceGet shared node
+      capturedUnder sourceRetain sourceRelease totalExact papArity
+      sourceDeclaration sourcePapSafe targetDeclaration noCredits control
+  have entryArity :
+      (captured ++ values.toArray).size = calleeTrace.source.arity := by
+    calc
+      (captured ++ values.toArray).size =
+          (captured.toList ++ values).length := by simp
+      _ = arity := totalExact
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceReleased) calleeMember
+      (captured ++ values.toArray) entryArity
+  have combinedCallee : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased (captured.toList ++ values).reverse
+      { definition := targetDefinition
+        values := captured ++ values.toArray } := by
+    simpa [calleeMatch.generated] using calleeState
+  have callerContinuation :
+      ∀ (outputStore : IxIR1.Store) (value : IxIR1.RVal),
+        IxIR1.runOp sourceContext (sourceFuel + 2) callerTrace.source
+            sourceStore source (.apply sourceFunction sourceArguments) =
+            .ok (outputStore, value) →
+          attached.sidecars.TraceStateRel callerTrace next outputStore
+            (value :: source)
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value } := by
+    intro outputStore value sourceRun
+    exact attached.traceState_next_of_member callerMember state descendant
+      sourceDeclarations sourceRun (callerTargets value)
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceEquation, targetStep,
+    combinedCallee, callerContinuation⟩
+
+/-- Over-saturating a shared PAP enters the first retained callee in the
+combined state and preserves the exact residual argument vector for the
+`applyMore` continuation.  As in exact saturation, successful completion of
+the whole source operation builds the original caller's combined successor. -/
+theorem CompiledAttachment.simulate_traced_apply_pap_over_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let sourceTotal := captured.toList ++ values
+    let sourceSupplied := sourceTotal.take arity
+    let sourceRemaining := sourceTotal.drop arity
+    let targetTotal := captured ++ values.toArray
+    let targetSupplied := targetTotal.extract 0 arity
+    let targetRemaining := targetTotal.extract arity targetTotal.size
+    let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetSupplied }
+    let targetMachine : Eval.Machine :=
+      { store := machine.store
+        heapFuel := 0
+        control := .running calleeFrame
+          (.applyMore targetRemaining resume :: stack) }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Lower.Sim.StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        IxIR1.runOp sourceContext (sourceFuel + 2) callerTrace.source
+            sourceStore source (.apply sourceFunction sourceArguments) =
+          (do
+            let (nextStore, result) ←
+              IxIR1.invoke sourceContext sourceFuel address sourceSupplied
+                sourceReleased
+            IxIR1.applyGo sourceContext sourceFuel nextStore result
+              sourceRemaining) ∧
+        Eval.Step context interpretation
+          { machine with heapFuel := targetHeapFuel }
+          { targetMachine with store := targetReleased } ∧
+        targetRemaining.toList = sourceRemaining ∧
+        attached.sidecars.TraceStateRel calleeTrace calleeTrace.root
+          sourceReleased sourceSupplied.reverse calleeFrame ∧
+        ∀ (outputStore : IxIR1.Store) (value : IxIR1.RVal),
+          IxIR1.runOp sourceContext (sourceFuel + 2) callerTrace.source
+              sourceStore source (.apply sourceFunction sourceArguments) =
+              .ok (outputStore, value) →
+            attached.sidecars.TraceStateRel callerTrace next outputStore
+              (value :: source)
+              { frame with
+                pc := frame.pc + 1
+                values := frame.values.push value } := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceEquation,
+      targetStep, remainingEq, _, callerTargets⟩ :=
+    Lower.Sim.simulate_traced_apply_pap_over_enter_state
+      (sourceCurrent := callerTrace.source) descendant calleeMatch state.target
+      stores positive functionResolved argumentsResolved sourceGet shared node
+      capturedUnder sourceRetain sourceRelease totalOver papArity
+      sourceDeclaration sourcePapSafe targetDeclaration noCredits control
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have suppliedArrayEq : targetSupplied = sourceSupplied.toArray := by
+    calc
+      targetSupplied = targetTotal.take arity := Array.take_eq_extract.symm
+      _ = sourceTotal.toArray.take arity := by rw [totalArrayEq]
+      _ = sourceSupplied.toArray := List.take_toArray
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have suppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have entryArity : targetSupplied.size = calleeTrace.source.arity := by
+    calc
+      targetSupplied.size = arity := suppliedSize
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceReleased) calleeMember targetSupplied entryArity
+  have sourceEnvironment :
+      targetSupplied.toList.reverse = sourceSupplied.reverse := by
+    rw [suppliedArrayEq]
+  rw [sourceEnvironment] at calleeState
+  have combinedCallee : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased sourceSupplied.reverse
+      { definition := targetDefinition, values := targetSupplied } := by
+    simpa [calleeMatch.generated] using calleeState
+  have callerContinuation :
+      ∀ (outputStore : IxIR1.Store) (value : IxIR1.RVal),
+        IxIR1.runOp sourceContext (sourceFuel + 2) callerTrace.source
+            sourceStore source (.apply sourceFunction sourceArguments) =
+            .ok (outputStore, value) →
+          attached.sidecars.TraceStateRel callerTrace next outputStore
+            (value :: source)
+            { frame with
+              pc := frame.pc + 1
+              values := frame.values.push value } := by
+    intro outputStore value sourceRun
+    exact attached.traceState_next_of_member callerMember state descendant
+      sourceDeclarations sourceRun (callerTargets value)
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceEquation, targetStep,
+    remainingEq, combinedCallee, callerContinuation⟩
+
+/-! ## Combined call-stack transitions -/
+
+/-- An addressed source call enters the matched retained declaration in the
+combined source/HPT/target state.  Whole-trace attachment alignment recovers
+the callee's exact HPT root. -/
+theorem CompiledAttachment.simulate_traced_call_fn_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration sourceAddress) sourceDefinition targetDefinition)
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (declaration :
+      context.declarations sourceAddress = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore source (.call sourceAddress sourceArguments) =
+        IxIR1.invoke sourceContext sourceFuel sourceAddress values sourceStore ∧
+      Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel calleeTrace calleeTrace.root sourceStore
+        values.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨sourceEquation, targetStep, nextStores, _⟩ :=
+    Lower.Sim.simulate_traced_call_fn_enter_source_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      descendant calleeMatch state.target stores sourceResolved argumentArity
+        declaration noCredits control
+  have entryArity : values.toArray.size = calleeTrace.source.arity := by
+    simpa [calleeMatch.source] using argumentArity.symm
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceStore) calleeMember values.toArray entryArity
+  exact ⟨sourceEquation, targetStep, nextStores, by
+    simpa [calleeMatch.generated] using calleeState⟩
+
+/-- A recursive self-call in any retained function enters the same trace root
+in the combined state while preserving the suspended caller continuation. -/
+theorem CompiledAttachment.simulate_traced_call_self_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := frame.definition, values := values.toArray }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source
+          sourceStore source (.callSelf sourceArguments) = (do
+        let out ← IxIR1.runCode sourceContext sourceFuel functionTrace.source
+          sourceStore values.reverse functionTrace.source.body
+        IxIR1.checkResultWorld functionTrace.source.result out) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          control := .running calleeFrame
+            (.resume { frame with pc := frame.pc + 1 } :: stack) } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace functionTrace.root
+        sourceStore values.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨sourceEquation, targetStep, nextStores, _⟩ :=
+    Lower.Sim.simulate_traced_call_self_enter_source_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      descendant state.target stores sourceResolved argumentArity noCredits
+        control
+  have entryArity : values.toArray.size = functionTrace.source.arity := by
+    simpa using argumentArity.symm
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceStore) functionMember values.toArray entryArity
+  exact ⟨sourceEquation, targetStep, nextStores, by
+    simpa [state.target.definition] using calleeState⟩
+
+/-- An addressed tail call transfers directly into the matched declaration's
+combined root state without retaining a caller continuation. -/
+theorem CompiledAttachment.simulate_traced_tail_call_fn_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {address : Ixon.Address} {sourceArguments : Array IxIR1.Atom}
+    {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (declaration :
+      context.declarations address = some (.fn targetDefinition))
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    IxIR1.runCode sourceContext (sourceFuel + 2) functionTrace.source
+          sourceStore source
+          (.letOp (.call address sourceArguments) (.ret (.var 0))) =
+        IxIR1.invoke sourceContext sourceFuel address values sourceStore ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running calleeFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel calleeTrace calleeTrace.root sourceStore
+        values.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨sourceEquation, targetStep, nextStores, _⟩ :=
+    Lower.Sim.simulate_traced_tail_call_fn_enter_source_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      descendant calleeMatch state.target stores sourceResolved argumentArity
+        declaration noCredits control
+  have entryArity : values.toArray.size = calleeTrace.source.arity := by
+    simpa [calleeMatch.source] using argumentArity.symm
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceStore) calleeMember values.toArray entryArity
+  exact ⟨sourceEquation, targetStep, nextStores, by
+    simpa [calleeMatch.generated] using calleeState⟩
+
+/-- A self-tail-call in any retained function re-enters its own combined root
+state while preserving the existing continuation stack. -/
+theorem CompiledAttachment.simulate_traced_tail_call_self_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (noCredits : frame.credits = #[])
+    (control : machine.control = .running frame stack) :
+    let calleeFrame : Eval.Frame :=
+      { definition := frame.definition, values := values.toArray }
+    IxIR1.runCode sourceContext (sourceFuel + 2) functionTrace.source
+          sourceStore source
+          (.letOp (.callSelf sourceArguments) (.ret (.var 0))) = (do
+        let out ← IxIR1.runCode sourceContext sourceFuel functionTrace.source
+          sourceStore values.reverse functionTrace.source.body
+        IxIR1.checkResultWorld functionTrace.source.result out) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running calleeFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace functionTrace.root
+        sourceStore values.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨sourceEquation, targetStep, nextStores, _⟩ :=
+    Lower.Sim.simulate_traced_tail_call_self_enter_source_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      descendant state.target stores sourceResolved argumentArity noCredits
+        control
+  have entryArity : values.toArray.size = functionTrace.source.arity := by
+    simpa using argumentArity.symm
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceStore) functionMember values.toArray entryArity
+  exact ⟨sourceEquation, targetStep, nextStores, by
+    simpa [state.target.definition] using calleeState⟩
+
+/-- A successful callee return under `applyMore` performs one target
+redispatch step from the combined callee state.  Source return inversion and
+the retained result contract discharge atom resolution and the evaluator's
+dynamic world check; the supplied `ApplyTransfer` selects the next PAP branch. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_success
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Eval.Machine} {frame caller : Eval.Frame}
+    {arguments : Array IxIR1.RVal} {rest : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {sourceOutput : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 1)
+      functionTrace.source sourceStore source (.ret sourceAtom) =
+        .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control =
+      .running frame (.applyMore arguments caller :: rest))
+    (noCredits : frame.credits = #[])
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel sourceOutput.2 arguments caller rest target) :
+    ∃ value,
+      sourceOutput = (sourceStore, value) ∧
+        Eval.Steps context interpretation 1 machine target ∧
+        Lower.Sim.StoreRel sourceStore machine.store := by
+  obtain ⟨value, sourceResolved, outputEq⟩ :=
+    IxIR1.runCode_ret_success sourceRun
+  subst sourceOutput
+  have targetWorld := state.target.resultWorld stores resultWorld
+  obtain ⟨_, targetSteps, nextStores⟩ :=
+    Lower.Sim.simulate_traced_ret_apply_more_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := functionTrace.source) (sourceFuel := sourceFuel)
+      descendant state.target stores sourceResolved control noCredits
+        targetWorld transferred
+  exact ⟨value, rfl, targetSteps, nextStores⟩
+
+/-- Returning a PAP into `applyMore` at exact saturation enters the next
+retained callee in one target step and establishes its full combined root
+state.  This is the recursive exact-saturation handoff for over-application
+chains. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_pap_saturated_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {returnFuel applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame caller : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {returningTrace calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result (.loc location))
+    (control : machine.control =
+      .running frame (.applyMore values.toArray caller :: rest))
+    (noCredits : frame.credits = #[])
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let targetTotal := captured ++ values.toArray
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetTotal }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Lower.Sim.StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        IxIR1.runCode sourceContext (returnFuel + 1) returningTrace.source
+            sourceStore source (.ret sourceAtom) =
+            .ok (sourceStore, .loc location) ∧
+        IxIR1.applyGo sourceContext (applyFuel + 1) sourceStore
+            (.loc location) values =
+          IxIR1.invoke sourceContext applyFuel address sourceTotal
+            sourceReleased ∧
+        Eval.Steps context interpretation 1
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetReleased
+            heapFuel := 0
+            control := .running calleeFrame (.resume caller :: rest) } ∧
+        attached.sidecars.TraceStateRel calleeTrace calleeTrace.root
+          sourceReleased sourceTotal.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceApply, transferred,
+      _⟩ :=
+    Lower.Sim.simulate_applyGo_pap_saturated_enter
+      (resume := caller) (stack := rest) calleeMatch stores positive sourceGet
+      shared node capturedUnder sourceRetain sourceRelease totalExact papArity
+      sourceDeclaration sourcePapSafe targetDeclaration
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame (.applyMore values.toArray caller :: rest) := by
+    simpa using control
+  have targetWorld := state.target.resultWorld stores resultWorld
+  obtain ⟨sourceReturn, targetSteps, _⟩ :=
+    Lower.Sim.simulate_traced_ret_apply_more_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := returningTrace.source) (sourceFuel := returnFuel)
+      (machine := { machine with heapFuel := targetHeapFuel })
+      returnDescendant state.target stores sourceResolved beforeControl
+        noCredits targetWorld transferred
+  have entryArity :
+      (captured ++ values.toArray).size = calleeTrace.source.arity := by
+    calc
+      (captured ++ values.toArray).size =
+          (captured.toList ++ values).length := by simp
+      _ = arity := totalExact
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceReleased) calleeMember
+      (captured ++ values.toArray) entryArity
+  have combinedCallee : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased (captured.toList ++ values).reverse
+      { definition := targetDefinition
+        values := captured ++ values.toArray } := by
+    simpa [calleeMatch.generated] using calleeState
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceReturn, sourceApply,
+    targetSteps, combinedCallee⟩
+
+/-- Returning a PAP into `applyMore` with excess residual arguments enters
+the next retained callee in the combined state and installs another exact
+`applyMore` suffix.  This is the recursive over-saturation handoff. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_pap_over_enter_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {returnFuel applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame caller : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {returningTrace calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result (.loc location))
+    (control : machine.control =
+      .running frame (.applyMore values.toArray caller :: rest))
+    (noCredits : frame.credits = #[])
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let sourceSupplied := sourceTotal.take arity
+    let sourceRemaining := sourceTotal.drop arity
+    let targetTotal := captured ++ values.toArray
+    let targetSupplied := targetTotal.extract 0 arity
+    let targetRemaining := targetTotal.extract arity targetTotal.size
+    let calleeFrame : Eval.Frame :=
+      { definition := targetDefinition, values := targetSupplied }
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Lower.Sim.StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        IxIR1.runCode sourceContext (returnFuel + 1) returningTrace.source
+            sourceStore source (.ret sourceAtom) =
+            .ok (sourceStore, .loc location) ∧
+        IxIR1.applyGo sourceContext (applyFuel + 1) sourceStore
+            (.loc location) values =
+          (do
+            let (nextStore, result) ←
+              IxIR1.invoke sourceContext applyFuel address sourceSupplied
+                sourceReleased
+            IxIR1.applyGo sourceContext applyFuel nextStore result
+              sourceRemaining) ∧
+        Eval.Steps context interpretation 1
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetReleased
+            heapFuel := 0
+            control := .running calleeFrame
+              (.applyMore targetRemaining caller :: rest) } ∧
+        targetRemaining.toList = sourceRemaining ∧
+        attached.sidecars.TraceStateRel calleeTrace calleeTrace.root
+          sourceReleased sourceSupplied.reverse calleeFrame := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceApply, transferred,
+      remainingEq, _⟩ :=
+    Lower.Sim.simulate_applyGo_pap_over_enter
+      (resume := caller) (stack := rest) calleeMatch stores positive sourceGet
+      shared node capturedUnder sourceRetain sourceRelease totalOver papArity
+      sourceDeclaration sourcePapSafe targetDeclaration
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame (.applyMore values.toArray caller :: rest) := by
+    simpa using control
+  have targetWorld := state.target.resultWorld stores resultWorld
+  obtain ⟨sourceReturn, targetSteps, _⟩ :=
+    Lower.Sim.simulate_traced_ret_apply_more_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := returningTrace.source) (sourceFuel := returnFuel)
+      (machine := { machine with heapFuel := targetHeapFuel })
+      returnDescendant state.target stores sourceResolved beforeControl
+        noCredits targetWorld transferred
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have suppliedArrayEq : targetSupplied = sourceSupplied.toArray := by
+    calc
+      targetSupplied = targetTotal.take arity := Array.take_eq_extract.symm
+      _ = sourceTotal.toArray.take arity := by rw [totalArrayEq]
+      _ = sourceSupplied.toArray := List.take_toArray
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have suppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have entryArity : targetSupplied.size = calleeTrace.source.arity := by
+    calc
+      targetSupplied.size = arity := suppliedSize
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+  have calleeState := attached.functionEntryTraceState
+    (sourceStore := sourceReleased) calleeMember targetSupplied entryArity
+  have sourceEnvironment :
+      targetSupplied.toList.reverse = sourceSupplied.reverse := by
+    rw [suppliedArrayEq]
+  rw [sourceEnvironment] at calleeState
+  have combinedCallee : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased sourceSupplied.reverse
+      { definition := targetDefinition, values := targetSupplied } := by
+    simpa [calleeMatch.generated] using calleeState
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceReturn, sourceApply,
+    targetSteps, remainingEq, combinedCallee⟩
+
+/-- Returning a PAP into `applyMore` below saturation extends the PAP and
+resumes the waiting caller immediately.  The source and target allocate the
+same longer PAP at the related fresh location. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_pap_under_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {returnFuel applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame caller : Eval.Frame}
+    {rest : List Eval.Continuation} {returningTrace : Lower.FunctionTrace}
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result (.loc location))
+    (control : machine.control =
+      .running frame (.applyMore values.toArray caller :: rest))
+    (noCredits : frame.credits = #[])
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity) :
+    let pap := IxIR1.Node.papN address arity (captured ++ values.toArray)
+    let sourceAllocation := sourceReleased.allocNode .shared pap
+    ∃ (targetRetained targetReleased : Eval.Store) (targetHeapFuel : Nat),
+      Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Lower.Sim.StoreRel sourceRetained targetRetained ∧
+        Eval.releaseSharedWork targetHeapFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        let targetAllocation := targetReleased.allocNode .shared pap
+        IxIR1.runCode sourceContext (returnFuel + 1) returningTrace.source
+            sourceStore source (.ret sourceAtom) =
+            .ok (sourceStore, .loc location) ∧
+          IxIR1.applyGo sourceContext (applyFuel + 1) sourceStore
+              (.loc location) values =
+              .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+          Eval.Steps context interpretation 1
+            { machine with heapFuel := targetHeapFuel }
+            { store := targetAllocation.1
+              heapFuel := 0
+              control := .running
+                { caller with
+                  values := caller.values.push (.loc sourceAllocation.2) }
+                rest } ∧
+          Lower.Sim.StoreRel sourceAllocation.1 targetAllocation.1 := by
+  dsimp only
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceApply, transferred,
+      nextStores⟩ :=
+    Lower.Sim.simulate_applyGo_pap_under
+      (resume := caller) (stack := rest) stores positive sourceGet shared node
+      capturedUnder sourceRetain sourceRelease totalUnder
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame (.applyMore values.toArray caller :: rest) := by
+    simpa using control
+  have targetWorld := state.target.resultWorld stores resultWorld
+  obtain ⟨sourceReturn, targetSteps, _⟩ :=
+    Lower.Sim.simulate_traced_ret_apply_more_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := returningTrace.source) (sourceFuel := returnFuel)
+      (machine := { machine with heapFuel := targetHeapFuel })
+      returnDescendant state.target stores sourceResolved beforeControl
+        noCredits targetWorld transferred
+  exact ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+    retainedStores, targetRelease, releasedStores, sourceReturn, sourceApply,
+    targetSteps, nextStores⟩
+
+/-- Returning `erased` into `applyMore` releases every residual shared
+argument and resumes the waiting caller with `erased`, preserving the exact
+store relation and positive shared-reference-count invariant. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_erased_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {returnFuel applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame caller : Eval.Frame}
+    {rest : List Eval.Continuation} {returningTrace : Lower.FunctionTrace}
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceStore sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceResolved : IxIR1.resolveAtom source sourceAtom = .ok .erased)
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result .erased)
+    (control : machine.control =
+      .running frame (.applyMore values.toArray caller :: rest))
+    (noCredits : frame.credits = #[])
+    (sourceRelease : IxIR1.dropMany sourceContext applyFuel sourceStore
+      values = .ok sourceReleased) :
+    ∃ (targetHeapFuel : Nat) (targetReleased : Eval.Store),
+      IxIR1.runCode sourceContext (returnFuel + 1) returningTrace.source
+          sourceStore source (.ret sourceAtom) = .ok (sourceStore, .erased) ∧
+        IxIR1.applyGo sourceContext (applyFuel + 1) sourceStore .erased values =
+          .ok (sourceReleased, .erased) ∧
+        Eval.Steps context interpretation 1
+          { machine with heapFuel := targetHeapFuel }
+          { store := targetReleased
+            heapFuel := 0
+            control := .running
+              { caller with values := caller.values.push .erased } rest } ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased ∧
+        Lower.Sim.PositiveSharedRC sourceReleased := by
+  obtain ⟨targetHeapFuel, targetReleased, sourceApply, transferred,
+      nextStores, nextPositive⟩ :=
+    Lower.Sim.simulate_applyGo_erased
+      (resume := caller) (stack := rest) positive stores sourceRelease
+  have beforeControl :
+      ({ machine with heapFuel := targetHeapFuel } : Eval.Machine).control =
+        .running frame (.applyMore values.toArray caller :: rest) := by
+    simpa using control
+  have targetWorld := state.target.resultWorld stores resultWorld
+  obtain ⟨sourceReturn, targetSteps, _⟩ :=
+    Lower.Sim.simulate_traced_ret_apply_more_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := returningTrace.source) (sourceFuel := returnFuel)
+      (machine := { machine with heapFuel := targetHeapFuel })
+      returnDescendant state.target stores sourceResolved beforeControl
+        noCredits targetWorld transferred
+  exact ⟨targetHeapFuel, targetReleased, sourceReturn, sourceApply,
+    targetSteps, nextStores, nextPositive⟩
+
+/-- A callee return under an ordinary resume continuation restores the exact
+caller continuation in the combined state.  The completed source operation
+advances the suspended caller's HPT environment across its `letOp`, while the
+target return theorem supplies checked map forgetting and frame progression. -/
+theorem CompiledAttachment.simulate_traced_return_to_letOp_state
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel operationFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {calleeFrame callerFrame : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    {callSite : Lower.SourceSite} {callBlock : BlockId}
+    {callInput nextInput : Lower.Sim.EnvMap}
+    {callEntryValueCount callIndex : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (callerDescendant : callerTrace.root.Descendant
+      (.letOp callSite callBlock callInput nextInput callEntryValueCount
+        operation callIndex instruction next))
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (calleeDescendant : calleeTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom generated))
+    {callerStore outputStore : IxIR1.Store}
+    {calleeSource callerSource : List IxIR1.RVal} {value : IxIR1.RVal}
+    (callerState : attached.sidecars.TraceStateRel callerTrace
+      (.letOp callSite callBlock callInput nextInput callEntryValueCount
+        operation callIndex instruction next)
+      callerStore callerSource callerFrame)
+    (calleeState : attached.sidecars.TraceStateRel calleeTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom generated) outputStore calleeSource calleeFrame)
+    (binder : Lower.Instr.baselineBinderAtom callEntryValueCount instruction =
+      some (.reg callEntryValueCount))
+    (delta : Lower.Instr.baselineValueDelta instruction = some 1)
+    (stores : Lower.Sim.StoreRel outputStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceOperation : IxIR1.runOp sourceContext operationFuel
+      callerTrace.source callerStore callerSource operation =
+        .ok (outputStore, value))
+    (sourceResolved :
+      IxIR1.resolveAtom calleeSource sourceAtom = .ok value)
+    (control : machine.control = .running calleeFrame
+      (.resume { callerFrame with pc := callerFrame.pc + 1 } :: rest))
+    (noCredits : calleeFrame.credits = #[])
+    (world : Eval.RVal.hasWorld machine.store
+      calleeFrame.definition.signature.result value = true) :
+    let nextCallerFrame : Eval.Frame :=
+      { callerFrame with
+        pc := callerFrame.pc + 1
+        values := callerFrame.values.push value }
+    IxIR1.runCode sourceContext (sourceFuel + 1) calleeTrace.source outputStore
+          calleeSource (.ret sourceAtom) = .ok (outputStore, value) ∧
+      Eval.Steps context interpretation 1 machine
+        { machine with control := .running nextCallerFrame rest } ∧
+      Lower.Sim.StoreRel outputStore machine.store ∧
+      attached.sidecars.TraceStateRel callerTrace next outputStore
+        (value :: callerSource) nextCallerFrame := by
+  dsimp only
+  obtain ⟨sourceReturn, targetSteps, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_return_to_letOp_state
+      (sourceContext := sourceContext) (sourceCurrent := calleeTrace.source)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) callerDescendant calleeDescendant
+      callerState.target calleeState.target binder delta stores sourceResolved
+        control noCredits world
+  have nextState := attached.traceState_next_of_member callerMember callerState
+    callerDescendant sourceDeclarations sourceOperation nextTarget
+  exact ⟨sourceReturn, targetSteps, nextStores, nextState⟩
+
+/-- An attached terminal source return halts the target in one step.  The
+combined state carries the exact target trace relation and its retained source
+result contract supplies the executable target-world check. -/
+theorem CompiledAttachment.simulate_traced_ret_halt_success
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {sourceOutput : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 1)
+      functionTrace.source sourceStore source (.ret sourceAtom) =
+        .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame [])
+    (noCredits : frame.credits = #[]) :
+    ∃ value,
+      sourceOutput = (sourceStore, value) ∧
+        Eval.Steps context interpretation 1 machine
+          { machine with control := .halted value } ∧
+        Lower.Sim.StoreRel sourceStore machine.store := by
+  exact Lower.Sim.simulate_traced_ret_halt_success
+    (sourceContext := sourceContext) (sourceCurrent := functionTrace.source)
+    (sourceFuel := sourceFuel) (context := context)
+    (interpretation := interpretation) descendant state.target stores
+      sourceRun resultWorld control noCredits
+
+/-- Successful source-case execution expressed in the indexed alternative
+vocabulary retained by the compiler trace. -/
+inductive IndexedCaseSuccess (ctx : IxIR1.Ctx) (fuel : Nat)
+    (cur : IxIR1.FnDef) (store : IxIR1.Store) (env : List IxIR1.RVal)
+    (scrutinee : IxIR1.Atom) (peelNat : Bool)
+    (alternatives : Array IxIR1.Alt)
+    (output : IxIR1.Store × IxIR1.RVal) : Prop
+  | ctorBranch {location : Nat} {box : IxIR1.NodeBox}
+      {cid : IxIR1.CtorId} {fields : Array IxIR1.RVal}
+      {fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+      (resolved : IxIR1.resolveAtom env scrutinee = .ok (.loc location))
+      (found : store.get? location = some box)
+      (node : box.node = .ctorN cid fields)
+      (selected : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+        some (.mk cid.cidx fieldCount body, alternativeIndex))
+      (fieldArity : fields.size = fieldCount)
+      (branchRun : IxIR1.runCode ctx fuel cur store
+        (fields.toList.reverse ++ env) body = .ok output)
+  | natZero {alternativeIndex : Nat} {body : IxIR1.Code}
+      (peels : peelNat = true)
+      (resolved : IxIR1.resolveAtom env scrutinee =
+        .ok (.lit (.nat 0)))
+      (selected : Lower.sourceAlternativeAtTag? alternatives 0 =
+        some (.mk 0 0 body, alternativeIndex))
+      (branchRun : IxIR1.runCode ctx fuel cur store env body = .ok output)
+  | natSucc {predecessor alternativeIndex : Nat} {body : IxIR1.Code}
+      (peels : peelNat = true)
+      (resolved : IxIR1.resolveAtom env scrutinee =
+        .ok (.lit (.nat (predecessor + 1))))
+      (selected : Lower.sourceAlternativeAtTag? alternatives 1 =
+        some (.mk 1 1 body, alternativeIndex))
+      (branchRun : IxIR1.runCode ctx fuel cur store
+        (.lit (.nat predecessor) :: env) body = .ok output)
+
+/-- The exact target-side coordinates needed to enter one emitted
+constructor branch.  Keeping the terminator, constructor, edge, and child
+lookups in one witness prevents the exhaustive worker from carrying four
+independently quantified but necessarily parallel indices. -/
+structure ConstructorSwitchSelection (targetScrutinee : Atom)
+    (generated : Block) (outgoing : List Lower.EdgeTrace)
+    (children : List Lower.CodeTrace) (cid : CtorId) : Type where
+  constructors : Array CtorAlt
+  targetPeel : Option NatPeel
+  index : Nat
+  target : CtorAlt
+  edge : Lower.EdgeTrace
+  child : Lower.CodeTrace
+  terminator : generated.terminator =
+    .switchValue targetScrutinee constructors targetPeel
+  targetAt : constructors[index]? = some target
+  targetAlternative : constructors.find? (fun candidate =>
+    candidate.cid == cid) = some target
+  edgeAt : outgoing[index]? = some edge
+  childAt : children[index]? = some child
+
+/-- An exact path-local HPT constructor fact determines a complete emitted
+switch selection. Attachment checks provide the identity lookup; recursive
+trace coherence supplies the parallel target, edge, and child ordinals. -/
+theorem CompiledAttachment.constructorSwitchSelection_of_exactHPT_nonempty
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {fact : IxIR1.HPT.Fact}
+    {identity : CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    (selected : attached.sidecars.exactConstructorAt? site sourceScrutinee =
+      some (fact, identity)) :
+    Nonempty (ConstructorSwitchSelection targetScrutinee generated outgoing
+      children identity) := by
+  obtain ⟨constructors, targetPeel, _, terminator⟩ :=
+    Lower.CodeTrace.switchSyntax_of_match
+      (functionTrace.descendantSyntaxMatches descendant)
+  obtain ⟨target, targetAlternative⟩ :=
+    attached.exactCaseTarget_of_switch_descendant functionMember descendant
+      selected terminator
+  have targetMember : target ∈ constructors :=
+    Array.mem_of_find?_eq_some targetAlternative
+  obtain ⟨index, targetAt⟩ :=
+    (Array.mem_iff_getElem?).mp targetMember
+  have branchMatch := Lower.CodeTrace.switchNodeBranchesMatch_of_match
+    (functionTrace.descendantSwitchBranchesMatch descendant)
+  have branchMatch' := branchMatch
+  unfold Lower.switchNodeBranchesMatch at branchMatch'
+  rw [terminator] at branchMatch'
+  simp only [Bool.and_eq_true] at branchMatch'
+  obtain ⟨⟨⟨outgoingLength, childrenLength⟩, _⟩, _⟩ := branchMatch'
+  have targetBound : index < constructors.size :=
+    (Array.getElem?_eq_some_iff.mp targetAt).1
+  have edgeBound : index < outgoing.length := by
+    have lengthEq := beq_iff_eq.mp outgoingLength
+    omega
+  have childBound : index < children.length := by
+    have lengthEq := beq_iff_eq.mp childrenLength
+    omega
+  let edge := outgoing[index]'edgeBound
+  let child := children[index]'childBound
+  have edgeAt : outgoing[index]? = some edge :=
+    List.getElem?_eq_some_iff.mpr ⟨edgeBound, rfl⟩
+  have childAt : children[index]? = some child :=
+    List.getElem?_eq_some_iff.mpr ⟨childBound, rfl⟩
+  exact ⟨
+    { constructors
+      targetPeel
+      index
+      target
+      edge
+      child
+      terminator
+      targetAt
+      targetAlternative
+      edgeAt
+      childAt }⟩
+
+/-- Proof-relevant form of
+`constructorSwitchSelection_of_exactHPT_nonempty`. The executable attachment
+check determines a unique first matching target; classical choice only
+forgets the implementation details of extracting its parallel trace index. -/
+noncomputable def CompiledAttachment.constructorSwitchSelection_of_exactHPT
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {fact : IxIR1.HPT.Fact}
+    {identity : CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    (selected : attached.sidecars.exactConstructorAt? site sourceScrutinee =
+      some (fact, identity)) :
+    ConstructorSwitchSelection targetScrutinee generated outgoing children
+      identity :=
+  Classical.choice
+    (attached.constructorSwitchSelection_of_exactHPT_nonempty functionMember
+      descendant selected)
+
+/-- At runtime, the exact HPT identity is the concrete constructor stored at
+the resolved source location. Consequently the static attachment selection is
+already the selection required by constructor dispatch. -/
+noncomputable def CompiledAttachment.constructorSwitchSelection_of_exactHPT_runtime
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {fact : IxIR1.HPT.Fact}
+    {identity cid : CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frame : Eval.Frame} {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (selected : attached.sidecars.exactConstructorAt? site sourceScrutinee =
+      some (fact, identity))
+    (resolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields) :
+    ConstructorSwitchSelection targetScrutinee generated outgoing children
+      cid := by
+  have identityEq : cid = identity :=
+    attached.sidecars.exactConstructorAt?_matches_node selected
+      state.environment resolved sourceGet node
+  simpa [identityEq] using
+    attached.constructorSwitchSelection_of_exactHPT functionMember descendant
+      selected
+
+/-- Source `case` success immediately selects the exact source ordinal used by
+the lowering trace, in addition to exposing the smaller-fuel branch run. -/
+theorem indexedCaseSuccess_of_run
+    {ctx : IxIR1.Ctx} {fuel : Nat} {cur : IxIR1.FnDef}
+    {store : IxIR1.Store} {env : List IxIR1.RVal}
+    {scrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt}
+    {output : IxIR1.Store × IxIR1.RVal}
+    (run : IxIR1.runCode ctx (fuel + 1) cur store env
+      (.case scrutinee peelNat alternatives) = .ok output) :
+    IndexedCaseSuccess ctx fuel cur store env scrutinee peelNat alternatives
+      output := by
+  cases IxIR1.runCode_case_success run with
+  | @ctorBranch location box cid fields fieldCount body resolved found node
+      selected fieldArity branchRun =>
+      have predicateEq :
+          (fun alternative : IxIR1.Alt =>
+            alternative.cidx == cid.cidx) =
+          (fun alternative =>
+            match alternative with
+            | .mk candidate _ _ => candidate == cid.cidx) := by
+        funext alternative
+        cases alternative
+        rfl
+      have evaluatorSelected :
+          alternatives.find? (fun alternative =>
+            match alternative with
+            | .mk candidate _ _ => candidate == cid.cidx) =
+              some (.mk cid.cidx fieldCount body) := by
+        rw [← predicateEq]
+        exact selected
+      obtain ⟨alternativeIndex, indexed⟩ :=
+        Lower.sourceAlternativeAtTag?_of_find? evaluatorSelected
+      exact .ctorBranch resolved found node indexed fieldArity branchRun
+  | @natZero body peels resolved selected branchRun =>
+      have predicateEq :
+          (fun alternative : IxIR1.Alt => alternative.cidx == 0) =
+          (fun alternative =>
+            match alternative with
+            | .mk candidate _ _ => candidate == 0) := by
+        funext alternative
+        cases alternative
+        rfl
+      have evaluatorSelected :
+          alternatives.find? (fun alternative =>
+            match alternative with
+            | .mk candidate _ _ => candidate == 0) =
+              some (.mk 0 0 body) := by
+        rw [← predicateEq]
+        exact selected
+      obtain ⟨alternativeIndex, indexed⟩ :=
+        Lower.sourceAlternativeAtTag?_of_find? evaluatorSelected
+      exact .natZero peels resolved indexed branchRun
+  | @natSucc predecessor body peels resolved selected branchRun =>
+      have predicateEq :
+          (fun alternative : IxIR1.Alt => alternative.cidx == 1) =
+          (fun alternative =>
+            match alternative with
+            | .mk candidate _ _ => candidate == 1) := by
+        funext alternative
+        cases alternative
+        rfl
+      have evaluatorSelected :
+          alternatives.find? (fun alternative =>
+            match alternative with
+            | .mk candidate _ _ => candidate == 1) =
+              some (.mk 1 1 body) := by
+        rw [← predicateEq]
+        exact selected
+      obtain ⟨alternativeIndex, indexed⟩ :=
+        Lower.sourceAlternativeAtTag?_of_find? evaluatorSelected
+      exact .natSucc peels resolved indexed branchRun
+
+/-- Enter a constructor switch child while advancing source syntax, the HPT
+environment, and the target recursive state together. -/
+theorem Sidecars.TraceStateRel.constructorChild
+    {sidecars : Sidecars} {functionTrace : Lower.FunctionTrace}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {frame childFrame : Eval.Frame}
+    {identity : CtorId} {tag fieldCount alternativeIndex : Nat}
+    {body : IxIR1.Code} {child : Lower.CodeTrace}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array IxIR1.RVal}
+    (state : sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives
+      identity.cidx = some (.mk tag fieldCount body, alternativeIndex))
+    (childSource : child.source = site.alternative alternativeIndex)
+    (childCode : child.sourceCode = body)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN identity fields)
+    (fieldArity : fields.size = fieldCount)
+    (childTarget : Lower.Sim.CodeStateRel functionTrace child
+      (fields.toList.reverse ++ source) childFrame) :
+    sidecars.TraceStateRel functionTrace child sourceStore
+      (fields.toList.reverse ++ source) childFrame := by
+  have sourceAt : sidecars.sourceCodeAt? site =
+      some (.case sourceScrutinee peelNat alternatives) := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceCode] using
+      state.sourceCode
+  have selected :=
+    Lower.sourceAlternativeAtTag?_getElem? sourceAlternative
+  have sourceTag := Lower.sourceAlternativeAtTag?_tag sourceAlternative
+  have childSourceAt := sidecars.sourceCodeAt?_alternative sourceAt selected
+  have childEnvironment := sidecars.siteEnvironmentHolds_alternative_ctor
+    sourceAt selected state.environment sourceResolved sourceGet node
+      sourceTag.symm fieldArity
+  constructor
+  · rw [childSource, childCode]
+    exact childSourceAt
+  · rw [childSource]
+    exact state.owner
+  · rw [childSource]
+    exact childEnvironment
+  · exact childTarget
+
+/-- Enter the zero branch of a literal-Nat switch in the combined recursive
+state. -/
+theorem Sidecars.TraceStateRel.natZeroChild
+    {sidecars : Sidecars} {functionTrace : Lower.FunctionTrace}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    {frame childFrame : Eval.Frame} {alternativeIndex : Nat}
+    {body : IxIR1.Code} {child : Lower.CodeTrace}
+    (state : sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives 0 =
+      some (.mk 0 0 body, alternativeIndex))
+    (childSource : child.source = site.alternative alternativeIndex)
+    (childCode : child.sourceCode = body)
+    (childTarget : Lower.Sim.CodeStateRel functionTrace child source
+      childFrame) :
+    sidecars.TraceStateRel functionTrace child sourceStore source
+      childFrame := by
+  have sourceAt : sidecars.sourceCodeAt? site =
+      some (.case sourceScrutinee true alternatives) := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceCode] using
+      state.sourceCode
+  have selected :=
+    Lower.sourceAlternativeAtTag?_getElem? sourceAlternative
+  have childSourceAt := sidecars.sourceCodeAt?_alternative sourceAt selected
+  have childEnvironment := sidecars.siteEnvironmentHolds_alternative_natZero
+    sourceAt selected state.environment
+  constructor
+  · rw [childSource, childCode]
+    exact childSourceAt
+  · rw [childSource]
+    exact state.owner
+  · rw [childSource]
+    exact childEnvironment
+  · exact childTarget
+
+/-- Enter the successor branch of a literal-Nat switch, preserving the peeled
+predecessor in the combined recursive state. -/
+theorem Sidecars.TraceStateRel.natSuccChild
+    {sidecars : Sidecars} {functionTrace : Lower.FunctionTrace}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    {frame childFrame : Eval.Frame} {alternativeIndex predecessor : Nat}
+    {body : IxIR1.Code} {child : Lower.CodeTrace}
+    (state : sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives 1 =
+      some (.mk 1 1 body, alternativeIndex))
+    (childSource : child.source = site.alternative alternativeIndex)
+    (childCode : child.sourceCode = body)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (childTarget : Lower.Sim.CodeStateRel functionTrace child
+      (.lit (.nat predecessor) :: source) childFrame) :
+    sidecars.TraceStateRel functionTrace child sourceStore
+      (.lit (.nat predecessor) :: source) childFrame := by
+  have sourceAt : sidecars.sourceCodeAt? site =
+      some (.case sourceScrutinee true alternatives) := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceCode] using
+      state.sourceCode
+  have selected :=
+    Lower.sourceAlternativeAtTag?_getElem? sourceAlternative
+  have childSourceAt := sidecars.sourceCodeAt?_alternative sourceAt selected
+  have childEnvironment := sidecars.siteEnvironmentHolds_alternative_natSucc
+    sourceAt selected state.environment sourceResolved
+  constructor
+  · rw [childSource, childCode]
+    exact childSourceAt
+  · rw [childSource]
+    exact state.owner
+  · rw [childSource]
+    exact childEnvironment
+  · exact childTarget
+
+/-- Constructor dispatch composed with source-site/HPT transport. The result
+enters the exact recursive child in the combined simulation state. -/
+theorem Sidecars.simulate_traced_switch_ctor_state_hpt
+    (sidecars : Sidecars)
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array IxIR1.RVal}
+    (state : sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child)
+    (control : machine.control = .running frame stack)
+    (frameCredits : frame.credits = #[]) :
+    ∃ finalFrame,
+      child.source = site.alternative alternativeIndex ∧
+        child.sourceCode = body ∧
+        Eval.Steps context interpretation (1 + fields.size) machine
+          { machine with control := .running finalFrame stack } ∧
+        Lower.Sim.StoreRel sourceStore machine.store ∧
+        sidecars.TraceStateRel functionTrace child sourceStore
+          (fields.toList.reverse ++ source) finalFrame := by
+  obtain ⟨finalFrame, _edgeFrame, _childScrutinee, childSource, childCode,
+      targetSteps, _, _, nextStores, childTarget, _parentBlockAt, _parentPc,
+      _targetResolved, _targetGet, _transferred, _switchStep, _childBlockAt,
+      _childPc, _childResolved, _prologue⟩ :=
+    Lower.Sim.simulate_traced_switch_ctor_state descendant state.target stores
+      sourceResolved sourceGet node sourceAlternative fieldArity terminator
+      targetAt targetAlternative edgeAt childAt control frameCredits
+  have childState := state.constructorChild sourceAlternative childSource
+    childCode sourceResolved sourceGet node fieldArity childTarget
+  exact ⟨finalFrame, childSource, childCode, targetSteps, nextStores,
+    childState⟩
+
+/-- Literal-zero dispatch composed with source-site/HPT transport. -/
+theorem Sidecars.simulate_traced_switch_nat_zero_state_hpt
+    (sidecars : Sidecars)
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    (state : sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat 0)))
+    (control : machine.control = .running frame stack)
+    (frameCredits : frame.credits = #[]) :
+    ∃ alternativeIndex body edge child childFrame,
+      edge ∈ outgoing ∧ child ∈ children ∧
+        Lower.sourceAlternativeAtTag? alternatives 0 =
+          some (.mk 0 0 body, alternativeIndex) ∧
+        child.source = site.alternative alternativeIndex ∧
+        child.sourceCode = body ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running childFrame stack } ∧
+        sidecars.TraceStateRel functionTrace child sourceStore source
+          childFrame := by
+  obtain ⟨constructors, peel, branches, childFrame, _, edgeMember,
+      childMember, sourceAlternative, childSource, childCode, targetStep,
+      _, _, childTarget⟩ :=
+    Lower.Sim.simulate_traced_switch_nat_zero_state descendant state.target
+      sourceResolved control frameCredits
+  have childState := state.natZeroChild sourceAlternative childSource
+    childCode childTarget
+  exact ⟨branches.zero.alternativeIndex, branches.zero.body,
+    branches.zeroEdge, branches.zeroChild, childFrame, edgeMember,
+    childMember, sourceAlternative, childSource, childCode, targetStep,
+    childState⟩
+
+/-- Literal-successor dispatch composed with source-site/HPT transport. -/
+theorem Sidecars.simulate_traced_switch_nat_succ_state_hpt
+    (sidecars : Sidecars)
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {predecessor : Nat}
+    (state : sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (control : machine.control = .running frame stack)
+    (frameCredits : frame.credits = #[]) :
+    ∃ alternativeIndex body edge child childFrame,
+      edge ∈ outgoing ∧ child ∈ children ∧
+        Lower.sourceAlternativeAtTag? alternatives 1 =
+          some (.mk 1 1 body, alternativeIndex) ∧
+        child.source = site.alternative alternativeIndex ∧
+        child.sourceCode = body ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running childFrame stack } ∧
+        sidecars.TraceStateRel functionTrace child sourceStore
+          (.lit (.nat predecessor) :: source) childFrame := by
+  obtain ⟨constructors, peel, branches, childFrame, _, edgeMember,
+      childMember, sourceAlternative, childSource, childCode, targetStep,
+      _, _, childTarget⟩ :=
+    Lower.Sim.simulate_traced_switch_nat_succ_state descendant state.target
+      sourceResolved control frameCredits
+  have childState := state.natSuccChild sourceAlternative childSource
+    childCode sourceResolved childTarget
+  exact ⟨branches.succ.alternativeIndex, branches.succ.body,
+    branches.succEdge, branches.succChild, childFrame, edgeMember,
+    childMember, sourceAlternative, childSource, childCode, targetStep,
+    childState⟩
+
+/-- HPT discharges both erased premises of the traced shallow-free simulation:
+the concrete constructor identity and its all-scalar field vector. -/
+theorem Sidecars.simulate_traced_free_freeUnique_state_hpt
+    (sidecars : Sidecars)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {targetCid runtimeCid : IxIR1.CtorId} {fact : IxIR1.HPT.Fact}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {fields : Array IxIR1.RVal}
+    (selected : sidecars.scalarLeafAt? site sourceAtom =
+      some (fact, targetCid))
+    (environment : sidecars.SiteEnvironmentHolds sourceStore site source)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next))
+    (state : Lower.Sim.CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN runtimeCid fields)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.free sourceAtom) =
+        .ok (sourceStore.kill location, .erased) ∧
+      Eval.Step context interpretation machine
+        { machine with
+          store := machine.store.kill location
+          control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel (sourceStore.kill location)
+        (machine.store.kill location) ∧
+      Lower.Sim.CodeStateRel functionTrace next (.erased :: source)
+        nextFrame := by
+  obtain ⟨identity, scalarFields⟩ :=
+    sidecars.scalarLeafAt?_matches_node selected environment sourceResolved
+      sourceGet node
+  subst runtimeCid
+  exact Lower.Sim.simulate_traced_free_freeUnique_state descendant state
+    stores sourceResolved sourceGet unique node scalarFields control
+
+/-- HPT discharges the constructor-identity premise of the traced fetch
+simulation.  A successful source fetch inversion supplies the remaining
+generic node and field premises without trusting the emitted identity. -/
+theorem Sidecars.simulate_traced_fetch_state_hpt
+    (sidecars : Sidecars)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {sourceField targetField : Nat}
+    {targetCid runtimeCid : IxIR1.CtorId} {fact : IxIR1.HPT.Fact}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array IxIR1.RVal} {value : IxIR1.RVal}
+    (selected : sidecars.exactConstructorAt? site sourceAtom =
+      some (fact, targetCid))
+    (environment : sidecars.SiteEnvironmentHolds sourceStore site source)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next))
+    (state : Lower.Sim.CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next) source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN runtimeCid fields)
+    (fieldAt : fields[sourceField]? = some value)
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.fetch sourceAtom sourceField) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      Lower.Sim.CodeStateRel functionTrace next (value :: source)
+        nextFrame := by
+  have identity := sidecars.exactConstructorAt?_matches_node selected
+    environment sourceResolved sourceGet node
+  subst runtimeCid
+  exact Lower.Sim.simulate_traced_fetch_state descendant state stores
+    sourceResolved sourceGet node fieldAt control
+
+/-- Successful source execution plus a held site environment supplies every
+runtime fetch premise, including the constructor identity erased from IxIR₁. -/
+theorem Sidecars.simulate_traced_fetch_state_of_run_hpt
+    (sidecars : Sidecars)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {sourceField targetField : Nat}
+    {targetCid : IxIR1.CtorId} {fact : IxIR1.HPT.Fact}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (selected : sidecars.exactConstructorAt? site sourceAtom =
+      some (fact, targetCid))
+    (environment : sidecars.SiteEnvironmentHolds sourceStore site source)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next))
+    (state : Lower.Sim.CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next) source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.fetch sourceAtom sourceField) = .ok (sourceStore, value))
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+          source (.fetch sourceAtom sourceField) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      Lower.Sim.CodeStateRel functionTrace next (value :: source)
+        nextFrame := by
+  obtain ⟨location, box, runtimeCid, fields, runtimeValue,
+      sourceResolved, sourceGet, node, fieldAt, output⟩ :=
+    IxIR1.runOp_fetch_success sourceRun
+  have valueEq : value = runtimeValue := by
+    exact congrArg Prod.snd output
+  subst runtimeValue
+  exact sidecars.simulate_traced_fetch_state_hpt selected environment
+    descendant state stores sourceResolved sourceGet node fieldAt control
+
+/-- A successful source shallow free determines its killed location.  The
+strong scalar-leaf HPT selection supplies both erased safety checks required
+by `freeUnique`. -/
+theorem Sidecars.simulate_traced_free_freeUnique_state_of_run_hpt
+    (sidecars : Sidecars)
+    {sourceContext : IxIR1.Ctx} {sourceCurrent : IxIR1.FnDef}
+    {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {targetCid : IxIR1.CtorId} {fact : IxIR1.HPT.Fact}
+    {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal}
+    (selected : sidecars.scalarLeafAt? site sourceAtom =
+      some (fact, targetCid))
+    (environment : sidecars.SiteEnvironmentHolds sourceStore site source)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next))
+    (state : Lower.Sim.CodeStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 1) sourceCurrent sourceStore
+        source (.free sourceAtom) = .ok (outputStore, .erased))
+    (control : machine.control = .running frame stack) :
+    ∃ location,
+      outputStore = sourceStore.kill location ∧
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      Eval.Step context interpretation machine
+          { machine with
+            store := machine.store.kill location
+            control := .running nextFrame stack } ∧
+        Lower.Sim.StoreRel (sourceStore.kill location)
+          (machine.store.kill location) ∧
+        Lower.Sim.CodeStateRel functionTrace next (.erased :: source)
+          nextFrame := by
+  obtain ⟨location, box, sourceResolved, sourceGet, unique, output⟩ :=
+    IxIR1.runOp_free_success sourceRun
+  obtain ⟨exactBox, fields, exactGet, node, scalarFields⟩ :=
+    sidecars.scalarLeafAt?_runtime selected environment sourceResolved
+  have boxEq : exactBox = box :=
+    Option.some.inj (exactGet.symm.trans sourceGet)
+  subst exactBox
+  obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+    Lower.Sim.simulate_traced_free_freeUnique_state
+      (sourceContext := sourceContext) (sourceCurrent := sourceCurrent)
+      (sourceFuel := sourceFuel) descendant state stores sourceResolved
+      sourceGet unique node scalarFields control
+  exact ⟨location, congrArg Prod.fst output, targetStep, nextStores,
+    nextState⟩
+
+/-- Attachment-facing fetch induction step. Trace membership recovers the
+attachment-checked exact-constructor HPT evidence; the identity adapter
+performs the target transition, and the checked post-fixpoint advances the
+combined state to the recursive continuation. -/
+theorem CompiledAttachment.simulate_traced_fetch_state_of_run_hpt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {sourceField targetField : Nat}
+    {targetCid : IxIR1.CtorId}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next))
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+        source (.fetch sourceAtom sourceField) = .ok (sourceStore, value))
+    (control : machine.control = .running frame stack) :
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push value }
+    IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+          source (.fetch sourceAtom sourceField) = .ok (sourceStore, value) ∧
+      Eval.Step context interpretation machine
+        { machine with control := .running nextFrame stack } ∧
+      Lower.Sim.StoreRel sourceStore machine.store ∧
+      attached.sidecars.TraceStateRel functionTrace next sourceStore
+        (value :: source) nextFrame := by
+  obtain ⟨fact, selected⟩ :=
+    attached.exactConstructorAt?_of_fetch_descendant functionMember descendant
+  obtain ⟨_, targetStep, nextStores, nextTarget⟩ :=
+    attached.sidecars.simulate_traced_fetch_state_of_run_hpt selected
+      state.environment descendant state.target stores sourceRun control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨sourceRun, targetStep, nextStores, nextState⟩
+
+/-- Attachment-facing shallow-free induction step. Trace membership recovers
+the attachment-checked scalar-leaf HPT evidence, so all erased target safety,
+source-coordinate, and continuation-state obligations are internal. -/
+theorem CompiledAttachment.simulate_traced_free_freeUnique_state_of_run_hpt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {targetCid : IxIR1.CtorId}
+    {sourceStore outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next))
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun :
+      IxIR1.runOp sourceContext (sourceFuel + 1) functionTrace.source sourceStore
+        source (.free sourceAtom) = .ok (outputStore, .erased))
+    (control : machine.control = .running frame stack) :
+    ∃ location,
+      outputStore = sourceStore.kill location ∧
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      Eval.Step context interpretation machine
+          { machine with
+            store := machine.store.kill location
+            control := .running nextFrame stack } ∧
+        Lower.Sim.StoreRel (sourceStore.kill location)
+          (machine.store.kill location) ∧
+        attached.sidecars.TraceStateRel functionTrace next outputStore
+          (.erased :: source) nextFrame := by
+  obtain ⟨fact, selected⟩ :=
+    attached.scalarLeafAt?_of_free_descendant functionMember descendant
+  obtain ⟨location, outputStoreEq, targetStep, nextStores, nextTarget⟩ :=
+    attached.sidecars.simulate_traced_free_freeUnique_state_of_run_hpt
+      selected state.environment descendant state.target stores
+      sourceRun control
+  subst outputStore
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations sourceRun nextTarget
+  exact ⟨location, rfl, targetStep, nextStores, nextState⟩
+
+/-! ## Continuation-passing recursive simulation interface -/
+
+/-- A target-machine postcondition indexed by the source store and value that
+the current IxIR₁ computation has produced.  Keeping those indices explicit
+lets a callee-return handler resume the suspended source continuation before
+the eventual whole-main postcondition is discharged. -/
+abbrev SourceMachinePost :=
+  IxIR1.Store → IxIR1.RVal → Eval.Machine → Prop
+
+/-- Finite target execution from `machine` to a state satisfying the supplied
+source-indexed postcondition.  The exact control-step count remains available
+for the final `runMachine`/`runMain` budget witness. -/
+def ReachesPost (context : Eval.Context)
+    (interpretation : Eval.Interpretation) (post : SourceMachinePost)
+    (sourceStore : IxIR1.Store) (value : IxIR1.RVal)
+    (machine : Eval.Machine) : Prop :=
+  ∃ count final,
+    Eval.Steps context interpretation count machine final ∧
+      post sourceStore value final
+
+/-- A postcondition already true at the current machine needs no target
+control step. -/
+theorem ReachesPost.refl {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {post : SourceMachinePost}
+    {sourceStore : IxIR1.Store} {value : IxIR1.RVal}
+    {machine : Eval.Machine} (holds : post sourceStore value machine) :
+    ReachesPost context interpretation post sourceStore value machine := by
+  exact ⟨0, machine, .refl machine, holds⟩
+
+/-- Prefix a finite postcondition witness by another finite target execution.
+This is the CPS composition rule used after every emitted instruction, switch
+transfer, call entry, and return transition. -/
+theorem ReachesPost.prepend {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {post : SourceMachinePost}
+    {sourceStore : IxIR1.Store} {value : IxIR1.RVal}
+    {before middle : Eval.Machine} {prefixCount : Nat}
+    (initial : Eval.Steps context interpretation prefixCount before middle)
+    (tail : ReachesPost context interpretation post sourceStore value middle) :
+    ReachesPost context interpretation post sourceStore value before := by
+  obtain ⟨tailCount, final, tailSteps, finalPost⟩ := tail
+  exact ⟨prefixCount + tailCount, final, initial.trans tailSteps, finalPost⟩
+
+/-- One genuine running target step followed by a successful CPS tail. -/
+theorem ReachesPost.step {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {post : SourceMachinePost}
+    {sourceStore : IxIR1.Store} {value : IxIR1.RVal}
+    {before middle : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    (running : before.control = .running frame stack)
+    (head : Eval.Step context interpretation before middle)
+    (tail : ReachesPost context interpretation post sourceStore value middle) :
+    ReachesPost context interpretation post sourceStore value before := by
+  exact tail.prepend (head.toSteps running)
+
+/-- A machine control/store shape admits some sufficient initial heap budget
+for a finite execution satisfying `post`.  Heap fuel is selected backward
+from the continuation: non-destructive steps preserve the chosen suffix,
+while recursive release/drop steps prepend their own exact traversal cost. -/
+def BudgetedReachesPost (context : Eval.Context)
+    (interpretation : Eval.Interpretation) (post : SourceMachinePost)
+    (sourceStore : IxIR1.Store) (value : IxIR1.RVal)
+    (machine : Eval.Machine) : Prop :=
+  ∃ heapFuel,
+    ReachesPost context interpretation post sourceStore value
+      { machine with heapFuel }
+
+/-- Prefix an already funded continuation by target steps that preserve every
+chosen heap budget. -/
+theorem BudgetedReachesPost.prependPreserving {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {post : SourceMachinePost}
+    {sourceStore : IxIR1.Store} {value : IxIR1.RVal}
+    {before middle : Eval.Machine} {prefixCount : Nat}
+    (initial : ∀ heapFuel,
+      Eval.Steps context interpretation prefixCount
+        { before with heapFuel } { middle with heapFuel })
+    (tail : BudgetedReachesPost context interpretation post sourceStore value
+      middle) :
+    BudgetedReachesPost context interpretation post sourceStore value
+      before := by
+  obtain ⟨heapFuel, tail⟩ := tail
+  exact ⟨heapFuel, tail.prepend (initial heapFuel)⟩
+
+/-- Prefix an already funded continuation by a target execution whose local
+heap cost is framed over the continuation's chosen suffix. -/
+theorem BudgetedReachesPost.prependFramed {context : Eval.Context}
+    {interpretation : Eval.Interpretation} {post : SourceMachinePost}
+    {sourceStore : IxIR1.Store} {value : IxIR1.RVal}
+    {before middle : Eval.Machine} {prefixCount localFuel : Nat}
+    (initial : ∀ suffixFuel,
+      Eval.Steps context interpretation prefixCount
+        { before with heapFuel := localFuel + suffixFuel }
+        { middle with heapFuel := suffixFuel })
+    (tail : BudgetedReachesPost context interpretation post sourceStore value
+      middle) :
+    BudgetedReachesPost context interpretation post sourceStore value
+      before := by
+  obtain ⟨suffixFuel, tail⟩ := tail
+  exact ⟨localFuel + suffixFuel, tail.prepend (initial suffixFuel)⟩
+
+/-! ## Runtime constructor-universe closure
+
+Ambiguous IxIR₁ cases erase the inductive block component of constructor
+identity and dispatch only on `cidx`.  The lowerer therefore emits every
+producer-known full identity compatible with an arm.  The following invariant
+is the dynamic half of that argument: every live source constructor was
+allocated by a statically audited operation in the attached program. -/
+
+/-- Every live constructor node belongs to the producer's finite constructor
+universe, with the arity recorded by the sidecar. -/
+structure Sidecars.SourceConstructorsValid (sidecars : Sidecars)
+    (store : IxIR1.Store) : Prop where
+  constructorKnown : ∀ {location world rc identity fields},
+    store.get? location =
+        some ⟨world, rc, .ctorN identity fields⟩ →
+      sidecars.constructorKnown identity fields.size = true
+
+/-- Every callable source definition has passed the constructor-allocation
+audit. -/
+def Sidecars.ContextConstructorsKnown (sidecars : Sidecars)
+    (context : IxIR1.Ctx) : Prop :=
+  ∀ {address definition},
+    context.decls address = some (.fn definition) →
+      sidecars.codeConstructorsKnown definition.body = true
+
+namespace Sidecars.SourceConstructorsValid
+
+/-- The empty source heap contains no constructor outside the universe. -/
+theorem empty (sidecars : Sidecars) :
+    sidecars.SourceConstructorsValid ({} : IxIR1.Store) := by
+  constructor
+  intro location world rc identity fields found
+  simp [IxIR1.Store.get?] at found
+
+/-- Removing nodes or changing only reference counts preserves membership in
+the constructor universe. -/
+theorem ofRestricts {sidecars : Sidecars} {before after : IxIR1.Store}
+    (valid : sidecars.SourceConstructorsValid before)
+    (restricts : IxIR1.Sim.StoreGraphRestricts before after) :
+    sidecars.SourceConstructorsValid after := by
+  constructor
+  intro location world rc identity fields found
+  obtain ⟨beforeRc, beforeFound⟩ := restricts found
+  exact valid.constructorKnown beforeFound
+
+/-- Appending a constructor whose identity/arity is audited preserves the
+global invariant. -/
+theorem allocCtor {sidecars : Sidecars} {store : IxIR1.Store}
+    (valid : sidecars.SourceConstructorsValid store)
+    (world : Ixon.Owned) (identity : CtorId)
+    (fields : Array IxIR1.RVal)
+    (known : sidecars.constructorKnown identity fields.size = true) :
+    sidecars.SourceConstructorsValid
+      (store.allocNode world (.ctorN identity fields)).1 := by
+  constructor
+  intro location boxWorld rc foundIdentity foundFields found
+  by_cases fresh : location = store.nodes.size
+  · subst location
+    have allocated := IxIR1.Sim.HeapIso.get?_allocNode_new store world
+      (.ctorN identity fields)
+    have boxEq :
+        (⟨boxWorld, rc, .ctorN foundIdentity foundFields⟩ : IxIR1.NodeBox) =
+          ⟨world, 1, .ctorN identity fields⟩ :=
+      Option.some.inj (found.symm.trans allocated)
+    cases boxEq
+    exact known
+  · exact valid.constructorKnown
+      (IxIR1.Sim.HeapIso.get?_of_allocNode_old fresh found)
+
+/-- Appending a PAP introduces no constructor node. -/
+theorem allocPap {sidecars : Sidecars} {store : IxIR1.Store}
+    (valid : sidecars.SourceConstructorsValid store)
+    (world : Ixon.Owned) (address : Ixon.Address) (arity : Nat)
+    (captured : Array IxIR1.RVal) :
+    sidecars.SourceConstructorsValid
+      (store.allocNode world (.papN address arity captured)).1 := by
+  constructor
+  intro location boxWorld rc identity fields found
+  by_cases fresh : location = store.nodes.size
+  · subst location
+    have allocated := IxIR1.Sim.HeapIso.get?_allocNode_new store world
+      (.papN address arity captured)
+    have impossible :
+        (⟨boxWorld, rc, .ctorN identity fields⟩ : IxIR1.NodeBox) =
+          ⟨world, 1, .papN address arity captured⟩ :=
+      Option.some.inj (found.symm.trans allocated)
+    cases impossible
+  · exact valid.constructorKnown
+      (IxIR1.Sim.HeapIso.get?_of_allocNode_old fresh found)
+
+/-- Replacing a live slot by a known constructor preserves the invariant.
+The result shape includes the evaluator's reuse-counter tick. -/
+theorem reuseCtor {sidecars : Sidecars} {store : IxIR1.Store}
+    (valid : sidecars.SourceConstructorsValid store)
+    {location : Nat} {old : IxIR1.NodeBox}
+    (live : store.get? location = some old)
+    (identity : CtorId) (fields : Array IxIR1.RVal)
+    (known : sidecars.constructorKnown identity fields.size = true) :
+    sidecars.SourceConstructorsValid
+      { store.setBox location
+          ⟨.unique, 1, .ctorN identity fields⟩ with
+        reuses :=
+          (store.setBox location
+            ⟨.unique, 1, .ctorN identity fields⟩).reuses + 1 } := by
+  constructor
+  intro other world rc foundIdentity foundFields found
+  change (store.setBox location
+      ⟨.unique, 1, .ctorN identity fields⟩).get? other =
+        some ⟨world, rc, .ctorN foundIdentity foundFields⟩ at found
+  by_cases same : location = other
+  · subst other
+    have updated := IxIR1.Sim.get?_setBox_same
+      (new := (⟨.unique, 1, .ctorN identity fields⟩ : IxIR1.NodeBox)) live
+    have boxEq :
+        (⟨world, rc, .ctorN foundIdentity foundFields⟩ : IxIR1.NodeBox) =
+          ⟨.unique, 1, .ctorN identity fields⟩ :=
+      Option.some.inj (found.symm.trans updated)
+    cases boxEq
+    exact known
+  · exact valid.constructorKnown
+      (IxIR1.Sim.get?_of_setBox_other same live found)
+
+/-- Retaining shared roots changes reference counts only. -/
+theorem dupVals {sidecars : Sidecars} {store store' : IxIR1.Store}
+    {values : List IxIR1.RVal}
+    (valid : sidecars.SourceConstructorsValid store)
+    (run : IxIR1.dupVals store values = .ok store') :
+    sidecars.SourceConstructorsValid store' := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except IxIR1.Err IxIR1.Store) = .ok store' at run
+      injection run with storeEq
+      subst store'
+      exact valid
+  | cons head tail ih =>
+      cases head with
+      | lit literal =>
+          simp only [IxIR1.dupVals, List.foldlM_cons] at run
+          exact ih valid run
+      | erased =>
+          simp only [IxIR1.dupVals, List.foldlM_cons] at run
+          exact ih valid run
+      | loc location =>
+          simp only [IxIR1.dupVals, List.foldlM_cons] at run
+          cases found : store.get? location with
+          | none => simp [found] at run
+          | some box =>
+              cases box with
+              | mk world rc node =>
+                  cases world with
+                  | unique => simp [found] at run
+                  | shared =>
+                      simp only [found] at run
+                      exact ih
+                        (valid.ofRestricts
+                          (IxIR1.Sim.StoreGraphRestricts.incRcStore found))
+                        run
+
+/-- Shared destruction can only remove nodes or alter reference counts. -/
+theorem dropVal {sidecars : Sidecars} {context : IxIR1.Ctx} {fuel : Nat}
+    {store store' : IxIR1.Store} {value : IxIR1.RVal}
+    (valid : sidecars.SourceConstructorsValid store)
+    (run : IxIR1.dropVal context fuel store value = .ok store') :
+    sidecars.SourceConstructorsValid store' :=
+  valid.ofRestricts (IxIR1.Sim.dropVal_restricts run)
+
+/-- Dropping a list likewise cannot introduce a constructor. -/
+theorem dropMany {sidecars : Sidecars} {context : IxIR1.Ctx} {fuel : Nat}
+    {store store' : IxIR1.Store} {values : List IxIR1.RVal}
+    (valid : sidecars.SourceConstructorsValid store)
+    (run : IxIR1.dropMany context fuel store values = .ok store') :
+    sidecars.SourceConstructorsValid store' :=
+  valid.ofRestricts (IxIR1.Sim.dropMany_restricts run)
+
+/-- Unique destruction also only removes nodes. -/
+theorem dropUVal {sidecars : Sidecars} {context : IxIR1.Ctx} {fuel : Nat}
+    {store store' : IxIR1.Store} {value : IxIR1.RVal}
+    (valid : sidecars.SourceConstructorsValid store)
+    (run : IxIR1.dropUVal context fuel store value = .ok store') :
+    sidecars.SourceConstructorsValid store' :=
+  valid.ofRestricts (IxIR1.Sim.dropUVal_restricts run)
+
+end Sidecars.SourceConstructorsValid
+
+/-- Reflect a successful finite-universe lookup into the constructor-info
+witness consumed by residual switch coverage. -/
+theorem Sidecars.constructorKnown_witness (sidecars : Sidecars)
+    {identity : CtorId} {arity : Nat}
+    (known : sidecars.constructorKnown identity arity = true) :
+    ∃ info ∈ sidecars.constructors,
+      info.identity = identity ∧ info.arity = arity := by
+  unfold Sidecars.constructorKnown at known
+  cases found : sidecars.constructors.find?
+      (fun info => info.identity == identity) with
+  | none => simp [found] at known
+  | some info =>
+      have matched := List.find?_some found
+      have identityEq : info.identity = identity := beq_iff_eq.mp matched
+      exact ⟨info, List.mem_of_find?_eq_some found, identityEq,
+        beq_iff_eq.mp (by simpa [found] using known)⟩
+
+/-- The source-body half of the attachment audit selects any retained
+function. -/
+theorem CompiledAttachment.functionCodeConstructorsKnown
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions) :
+    attached.sidecars.codeConstructorsKnown
+      functionTrace.source.body = true := by
+  have functionKnown := List.all_eq_true.mp
+    attached.sourceConstructorsProduced functionTrace member
+  simp only [Bool.and_eq_true] at functionKnown
+  exact functionKnown.1
+
+/-- The trace-shaped half of the attachment audit selects any retained
+function root. -/
+theorem CompiledAttachment.functionTraceConstructorsKnown
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions) :
+    attached.sidecars.codeTraceConstructorsKnown functionTrace.root = true := by
+  have functionKnown := List.all_eq_true.mp
+    attached.sourceConstructorsProduced functionTrace member
+  simp only [Bool.and_eq_true] at functionKnown
+  exact functionKnown.2
+
+/-- Every operation at a retained simulated suffix passed the producer
+constructor audit. -/
+theorem CompiledAttachment.descendantOperationConstructorsKnown
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next)) :
+    attached.sidecars.operationConstructorsKnown operation = true := by
+  have localKnown := attached.sidecars.codeTraceConstructorsKnown_descendant
+    (attached.functionTraceConstructorsKnown member) descendant
+  simp only [Sidecars.codeTraceConstructorsKnown,
+    Bool.and_eq_true] at localKnown
+  exact localKnown.1
+
+/-- A declaration-compatible source evaluator context inherits the audited
+constructor-allocation property from the attached function trace. -/
+theorem CompiledAttachment.sourceContextConstructorsKnown
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts) :
+    attached.sidecars.ContextConstructorsKnown sourceContext := by
+  intro address definition lookup
+  have sidecarLookup : IxIR1.Env.ofList
+      attached.sidecars.input.declarations address =
+        some (.fn definition) := by
+    rw [attached.sidecarDeclarationEnvironment, ← sourceDeclarations]
+    exact lookup
+  have artifactLookup : IxIR1.Env.ofList
+      attached.target.artifact.source.declarations address =
+        some (.fn definition) := by
+    rw [attached.targetSourceProduced]
+    exact sidecarLookup
+  obtain ⟨targetDefinition, functionTrace, targetLookup, member, matched⟩ :=
+    attached.target.artifact.functionTrace_of_source_lookup artifactLookup
+  simpa [matched.source] using
+    attached.functionCodeConstructorsKnown member
+
+private def EvalConstructorsValidAt (sidecars : Sidecars)
+    (fuel : Nat) : Prop :=
+  (∀ context current store environment code store' value,
+    sidecars.ContextConstructorsKnown context →
+    sidecars.codeConstructorsKnown current.body = true →
+    sidecars.codeConstructorsKnown code = true →
+    sidecars.SourceConstructorsValid store →
+    IxIR1.runCode context fuel current store environment code =
+        .ok (store', value) →
+      sidecars.SourceConstructorsValid store') ∧
+  (∀ context current store environment operation store' value,
+    sidecars.ContextConstructorsKnown context →
+    sidecars.codeConstructorsKnown current.body = true →
+    sidecars.operationConstructorsKnown operation = true →
+    sidecars.SourceConstructorsValid store →
+    IxIR1.runOp context fuel current store environment operation =
+        .ok (store', value) →
+      sidecars.SourceConstructorsValid store') ∧
+  (∀ context address arguments store store' value,
+    sidecars.ContextConstructorsKnown context →
+    sidecars.SourceConstructorsValid store →
+    IxIR1.invoke context fuel address arguments store = .ok (store', value) →
+      sidecars.SourceConstructorsValid store') ∧
+  (∀ context store function arguments store' value,
+    sidecars.ContextConstructorsKnown context →
+    sidecars.SourceConstructorsValid store →
+    IxIR1.applyGo context fuel store function arguments =
+        .ok (store', value) →
+      sidecars.SourceConstructorsValid store')
+
+private theorem constructorsBindOk {error α β : Type} (value : α)
+    (next : α → Except error β) :
+    ((Except.ok value : Except error α) >>= next) = next value := rfl
+
+private theorem constructorsBindError {error α β : Type} (failure : error)
+    (next : α → Except error β) :
+    ((Except.error failure : Except error α) >>= next) = .error failure := rfl
+
+/-- Source evaluation preserves the producer constructor universe.  The
+induction follows calls and higher-order application; fresh constructor and
+reuse sites are the only branches that need their local executable audit. -/
+private theorem evalConstructorsValidAt (sidecars : Sidecars) :
+    ∀ fuel, EvalConstructorsValidAt sidecars fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro context current store environment code store' value contextKnown
+        currentKnown codeKnown valid run
+      rw [IxIR1.runCode.eq_def] at run
+      simp at run
+    · intro context current store environment operation store' value
+        contextKnown currentKnown operationKnown valid run
+      rw [IxIR1.runOp.eq_def] at run
+      simp at run
+    · intro context address arguments store store' value contextKnown valid run
+      rw [IxIR1.invoke.eq_def] at run
+      simp at run
+    · intro context store function arguments store' value contextKnown valid run
+      rw [IxIR1.applyGo.eq_def] at run
+      simp at run
+  | succ fuel ih =>
+    obtain ⟨ihCode, ihOperation, ihInvoke, ihApply⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · intro context current store environment code store' value contextKnown
+        currentKnown codeKnown valid run
+      cases code with
+      | ret atom =>
+          rw [IxIR1.runCode.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment atom with
+          | error error => simp [resolved] at run
+          | ok result =>
+              rw [resolved, constructorsBindOk] at run
+              have pair := Except.ok.inj run
+              cases pair
+              exact valid
+      | letOp operation rest =>
+          simp only [Sidecars.codeConstructorsKnown,
+            Bool.and_eq_true] at codeKnown
+          rw [IxIR1.runCode.eq_def] at run
+          dsimp only at run
+          cases operationRun : IxIR1.runOp context fuel current store
+              environment operation with
+          | error error => simp [operationRun] at run
+          | ok result =>
+              rcases result with ⟨middle, operationValue⟩
+              rw [operationRun, constructorsBindOk] at run
+              exact ihCode _ _ _ _ _ _ _ contextKnown currentKnown
+                codeKnown.2
+                (ihOperation _ _ _ _ _ _ _ contextKnown currentKnown
+                  codeKnown.1 valid operationRun)
+                run
+      | case scrutinee peelNat alternatives =>
+          rw [IxIR1.runCode.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment scrutinee with
+          | error error => simp [resolved] at run
+          | ok scrutineeValue =>
+              rw [resolved, constructorsBindOk] at run
+              cases scrutineeValue with
+              | loc location =>
+                  cases found : store.get? location with
+                  | none => simp [found] at run
+                  | some box =>
+                      simp only [found] at run
+                      cases box with
+                      | mk world rc node =>
+                          cases node with
+                          | papN address arity captured => simp at run
+                          | ctorN identity fields =>
+                              cases selected : alternatives.find?
+                                  (fun alternative =>
+                                    alternative.cidx == identity.cidx) with
+                              | none => simp [selected] at run
+                              | some alternative =>
+                                  have alternativeMember : alternative ∈
+                                      alternatives :=
+                                    Array.mem_of_find?_eq_some selected
+                                  cases alternative with
+                                  | mk cidx fieldCount body =>
+                                      have bodyKnown :=
+                                        sidecars.codeConstructorsKnown_alternative
+                                          codeKnown alternativeMember
+                                      cases sizeMismatch :
+                                          fields.size != fieldCount
+                                      · simp only [selected, sizeMismatch,
+                                            Bool.false_eq_true, if_false] at run
+                                        exact ihCode _ _ _ _ _ _ _ contextKnown
+                                          currentKnown bodyKnown valid run
+                                      · simp [selected, sizeMismatch] at run
+              | lit literal =>
+                  cases literal with
+                  | str string => simp at run
+                  | nat n =>
+                      cases peel : peelNat with
+                      | false => simp [peel] at run
+                      | true =>
+                          cases n with
+                          | zero =>
+                              cases selected : alternatives.find?
+                                  (fun alternative =>
+                                    alternative.cidx == 0) with
+                              | none => simp [peel, selected] at run
+                              | some alternative =>
+                                  have alternativeMember : alternative ∈
+                                      alternatives :=
+                                    Array.mem_of_find?_eq_some selected
+                                  cases alternative with
+                                  | mk cidx fieldCount body =>
+                                      have bodyKnown :=
+                                        sidecars.codeConstructorsKnown_alternative
+                                          codeKnown alternativeMember
+                                      cases fieldCount with
+                                      | zero =>
+                                          simp only [peel, selected] at run
+                                          exact ihCode _ _ _ _ _ _ _
+                                            contextKnown currentKnown bodyKnown
+                                            valid run
+                                      | succ fieldCount =>
+                                          simp [peel, selected] at run
+                          | succ n =>
+                              cases selected : alternatives.find?
+                                  (fun alternative =>
+                                    alternative.cidx == 1) with
+                              | none => simp [peel, selected] at run
+                              | some alternative =>
+                                  have alternativeMember : alternative ∈
+                                      alternatives :=
+                                    Array.mem_of_find?_eq_some selected
+                                  cases alternative with
+                                  | mk cidx fieldCount body =>
+                                      have bodyKnown :=
+                                        sidecars.codeConstructorsKnown_alternative
+                                          codeKnown alternativeMember
+                                      cases fieldCount with
+                                      | zero => simp [peel, selected] at run
+                                      | succ fieldCount =>
+                                          cases fieldCount with
+                                          | zero =>
+                                              simp only [peel, selected] at run
+                                              exact ihCode _ _ _ _ _ _ _
+                                                contextKnown currentKnown
+                                                bodyKnown valid run
+                                          | succ fieldCount =>
+                                              simp [peel, selected] at run
+              | erased => simp at run
+    · intro context current store environment operation store' value
+        contextKnown currentKnown operationKnown valid run
+      cases operation with
+      | pure atom =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment atom with
+          | error error => simp [resolved] at run
+          | ok result =>
+              rw [resolved, constructorsBindOk] at run
+              have pair := Except.ok.inj run
+              cases pair
+              exact valid
+      | alloc world identity atoms =>
+          simp only [Sidecars.operationConstructorsKnown] at operationKnown
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtoms environment atoms with
+          | error error => simp [resolved] at run
+          | ok values =>
+              rw [resolved, constructorsBindOk] at run
+              have pair := Except.ok.inj run
+              cases pair
+              have size : values.toArray.size = atoms.size := by
+                simpa using IxIR1.resolveAtoms_length resolved
+              exact valid.allocCtor world identity values.toArray
+                (by simpa [size] using operationKnown)
+      | reuse target identity atoms =>
+          simp only [Sidecars.operationConstructorsKnown] at operationKnown
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases argumentsResolved : IxIR1.resolveAtoms environment atoms with
+          | error error => simp [argumentsResolved] at run
+          | ok values =>
+              rw [argumentsResolved, constructorsBindOk] at run
+              cases targetResolved : IxIR1.resolveAtom environment target with
+              | error error => simp [targetResolved] at run
+              | ok targetValue =>
+                  rw [targetResolved, constructorsBindOk] at run
+                  cases targetValue with
+                  | lit literal => simp at run
+                  | erased => simp at run
+                  | loc location =>
+                      cases found : store.get? location with
+                      | none => simp [found] at run
+                      | some box =>
+                          simp only [found] at run
+                          cases box with
+                          | mk world rc node =>
+                              cases world with
+                              | shared => simp at run
+                              | unique =>
+                                  have pair := Except.ok.inj run
+                                  cases pair
+                                  have size : values.toArray.size = atoms.size :=
+                                    by
+                                      simpa using
+                                        IxIR1.resolveAtoms_length
+                                          argumentsResolved
+                                  exact valid.reuseCtor found identity
+                                    values.toArray
+                                    (by simpa [size] using operationKnown)
+      | free target =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment target with
+          | error error => simp [resolved] at run
+          | ok targetValue =>
+              rw [resolved, constructorsBindOk] at run
+              cases targetValue with
+              | lit literal => simp at run
+              | erased => simp at run
+              | loc location =>
+                  cases found : store.get? location with
+                  | none => simp [found] at run
+                  | some box =>
+                      simp only [found] at run
+                      cases box with
+                      | mk world rc node =>
+                          cases world with
+                          | shared => simp at run
+                          | unique =>
+                              have pair := Except.ok.inj run
+                              cases pair
+                              exact valid.ofRestricts
+                                (IxIR1.Sim.StoreGraphRestricts.kill found)
+      | dup target =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment target with
+          | error error => simp [resolved] at run
+          | ok targetValue =>
+              rw [resolved, constructorsBindOk] at run
+              cases targetValue with
+              | lit literal =>
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+              | erased =>
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+              | loc location =>
+                  cases found : store.get? location with
+                  | none => simp [found] at run
+                  | some box =>
+                      simp only [found] at run
+                      cases box with
+                      | mk world rc node =>
+                          cases world with
+                          | unique => simp at run
+                          | shared =>
+                              have pair := Except.ok.inj run
+                              cases pair
+                              simpa [IxIR1.Sim.incRcStore] using
+                                valid.ofRestricts
+                                  (IxIR1.Sim.StoreGraphRestricts.incRcStore
+                                    found)
+      | drop target =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment target with
+          | error error => simp [resolved] at run
+          | ok targetValue =>
+              rw [resolved, constructorsBindOk] at run
+              cases targetValue with
+              | lit literal =>
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+              | erased =>
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+              | loc location =>
+                  dsimp only at run
+                  cases dropped : IxIR1.dropVal context fuel store
+                      (.loc location) with
+                  | error error => simp [dropped] at run
+                  | ok droppedStore =>
+                      rw [dropped, constructorsBindOk] at run
+                      have pair := Except.ok.inj run
+                      cases pair
+                      exact valid.dropVal dropped
+      | dropU target =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment target with
+          | error error => simp [resolved] at run
+          | ok targetValue =>
+              rw [resolved, constructorsBindOk] at run
+              cases targetValue with
+              | lit literal =>
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+              | erased =>
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+              | loc location =>
+                  dsimp only at run
+                  cases dropped : IxIR1.dropUVal context fuel store
+                      (.loc location) with
+                  | error error => simp [dropped] at run
+                  | ok droppedStore =>
+                      rw [dropped, constructorsBindOk] at run
+                      have pair := Except.ok.inj run
+                      cases pair
+                      exact valid.dropUVal dropped
+      | fetch target field =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtom environment target with
+          | error error => simp [resolved] at run
+          | ok targetValue =>
+              rw [resolved, constructorsBindOk] at run
+              cases targetValue with
+              | lit literal => simp at run
+              | erased => simp at run
+              | loc location =>
+                  cases found : store.get? location with
+                  | none => simp [found] at run
+                  | some box =>
+                      simp only [found] at run
+                      cases box with
+                      | mk world rc node =>
+                          cases node with
+                          | papN address arity captured => simp at run
+                          | ctorN identity fields =>
+                              cases fieldFound : fields[field]? with
+                              | none => simp [fieldFound] at run
+                              | some result =>
+                                  simp only [fieldFound] at run
+                                  have pair := Except.ok.inj run
+                                  cases pair
+                                  exact valid
+      | call address atoms =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtoms environment atoms with
+          | error error => simp [resolved] at run
+          | ok values =>
+              rw [resolved, constructorsBindOk] at run
+              exact ihInvoke _ _ _ _ _ _ contextKnown valid run
+      | callSelf atoms =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtoms environment atoms with
+          | error error => simp [resolved] at run
+          | ok values =>
+              rw [resolved, constructorsBindOk] at run
+              cases arityMismatch : values.length != current.arity
+              · have sameArity : values.length = current.arity := by
+                  simpa using arityMismatch
+                simp [sameArity] at run
+                cases bodyRun : IxIR1.runCode context fuel current store
+                    values.reverse current.body with
+                | error error =>
+                    rw [bodyRun, constructorsBindError] at run
+                    contradiction
+                | ok result =>
+                    rcases result with ⟨bodyStore, bodyValue⟩
+                    rw [bodyRun, constructorsBindOk] at run
+                    obtain ⟨resultEq, _⟩ := IxIR1.Sim.checkResultWorld_ok run
+                    cases resultEq
+                    exact ihCode _ _ _ _ _ _ _ contextKnown currentKnown
+                      currentKnown valid bodyRun
+              · have different : values.length ≠ current.arity :=
+                  bne_iff_ne.mp arityMismatch
+                simp [different] at run
+      | papp address atoms =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtoms environment atoms with
+          | error error => simp [resolved] at run
+          | ok values =>
+              rw [resolved, constructorsBindOk] at run
+              cases declarationFound : context.decls address with
+              | none => simp [declarationFound] at run
+              | some declaration =>
+                  simp only [declarationFound] at run
+                  by_cases under : values.length < IxIR1.declArity declaration
+                  · simp only [under, if_true] at run
+                    have pair := Except.ok.inj run
+                    cases pair
+                    exact valid.allocPap .shared address
+                      (IxIR1.declArity declaration) values.toArray
+                  · simp [under] at run
+      | apply function atoms =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases functionResolved : IxIR1.resolveAtom environment function with
+          | error error => simp [functionResolved] at run
+          | ok functionValue =>
+              rw [functionResolved, constructorsBindOk] at run
+              cases argumentsResolved : IxIR1.resolveAtoms environment atoms with
+              | error error => simp [argumentsResolved] at run
+              | ok values =>
+                  rw [argumentsResolved, constructorsBindOk] at run
+                  exact ihApply _ _ _ _ _ _ contextKnown valid run
+      | extern address atoms =>
+          rw [IxIR1.runOp.eq_def] at run
+          dsimp only at run
+          cases resolved : IxIR1.resolveAtoms environment atoms with
+          | error error => simp [resolved] at run
+          | ok values =>
+              rw [resolved, constructorsBindOk] at run
+              cases called : IxIR1.callScalarOracle context address values with
+              | error error => simp [called] at run
+              | ok result =>
+                  rw [called, constructorsBindOk] at run
+                  have pair := Except.ok.inj run
+                  cases pair
+                  exact valid
+    · intro context address arguments store store' value contextKnown valid run
+      rw [IxIR1.invoke.eq_def] at run
+      dsimp only at run
+      cases declarationFound : context.decls address with
+      | none => simp [declarationFound] at run
+      | some declaration =>
+          simp only [declarationFound] at run
+          cases declaration with
+          | extern arity =>
+              cases arityMismatch : arguments.length != arity
+              · simp only [arityMismatch, Bool.false_eq_true, if_false] at run
+                cases called : IxIR1.callScalarOracle context address
+                    arguments with
+                | error error => simp [called] at run
+                | ok result =>
+                    simp only [called] at run
+                    have pair := Except.ok.inj run
+                    cases pair
+                    exact valid
+              · simp [arityMismatch] at run
+          | fn definition =>
+              cases arityMismatch : arguments.length != definition.arity
+              · simp only [arityMismatch, Bool.false_eq_true, if_false] at run
+                cases bodyRun : IxIR1.runCode context fuel definition store
+                    arguments.reverse definition.body with
+                | error error => simp [bodyRun] at run
+                | ok result =>
+                    rcases result with ⟨bodyStore, bodyValue⟩
+                    rw [bodyRun, constructorsBindOk] at run
+                    obtain ⟨resultEq, _⟩ := IxIR1.Sim.checkResultWorld_ok run
+                    cases resultEq
+                    have bodyKnown := contextKnown declarationFound
+                    exact ihCode _ _ _ _ _ _ _ contextKnown bodyKnown
+                      bodyKnown valid bodyRun
+              · simp [arityMismatch] at run
+    · intro context store function arguments store' value contextKnown valid run
+      rw [IxIR1.applyGo.eq_def] at run
+      dsimp only at run
+      cases function with
+      | lit literal => simp at run
+      | erased =>
+          cases dropped : IxIR1.dropMany context fuel store arguments with
+          | error error => simp [dropped] at run
+          | ok droppedStore =>
+              rw [dropped, constructorsBindOk] at run
+              have pair := Except.ok.inj run
+              cases pair
+              exact valid.dropMany dropped
+      | loc location =>
+          cases found : store.get? location with
+          | none => simp [found] at run
+          | some box =>
+              simp only [found] at run
+              cases box with
+              | mk world rc node =>
+                  cases node with
+                  | ctorN identity fields => simp at run
+                  | papN address arity captured =>
+                      dsimp only at run
+                      cases retained : IxIR1.dupVals store captured.toList with
+                      | error error => simp [retained] at run
+                      | ok retainedStore =>
+                          rw [retained, constructorsBindOk] at run
+                          cases released : IxIR1.dropVal context fuel
+                              retainedStore (.loc location) with
+                          | error error => simp [released] at run
+                          | ok readyStore =>
+                              rw [released, constructorsBindOk] at run
+                              have readyValid :=
+                                (valid.dupVals retained).dropVal released
+                              by_cases under :
+                                  (captured.toList ++ arguments).length < arity
+                              · simp only [under, if_true] at run
+                                have pair := Except.ok.inj run
+                                cases pair
+                                exact readyValid.allocPap .shared address arity
+                                  (captured.toList ++ arguments).toArray
+                              · simp only [under, if_false] at run
+                                by_cases exactArity :
+                                    (captured.toList ++ arguments).length = arity
+                                · simp only [exactArity, beq_self_eq_true,
+                                      if_true] at run
+                                  cases declarationFound :
+                                      context.decls address with
+                                  | none => simp [declarationFound] at run
+                                  | some declaration =>
+                                      cases papSafe :
+                                          IxIR1.declPapSafe declaration with
+                                      | false =>
+                                          simp [declarationFound, papSafe] at run
+                                      | true =>
+                                          simp only [declarationFound, papSafe,
+                                            if_true] at run
+                                          exact ihInvoke _ _ _ _ _ _
+                                            contextKnown readyValid run
+                                · have notExact :
+                                      ((captured.toList ++ arguments).length ==
+                                          arity) = false :=
+                                    beq_eq_false_iff_ne.mpr exactArity
+                                  simp only [notExact, Bool.false_eq_true,
+                                    if_false] at run
+                                  cases declarationFound :
+                                      context.decls address with
+                                  | none => simp [declarationFound] at run
+                                  | some declaration =>
+                                      cases papSafe :
+                                          IxIR1.declPapSafe declaration with
+                                      | false =>
+                                          simp [declarationFound, papSafe] at run
+                                      | true =>
+                                          simp only [declarationFound, papSafe,
+                                            if_true] at run
+                                          cases invoked : IxIR1.invoke context
+                                              fuel address
+                                              ((captured.toList ++ arguments).take
+                                                arity) readyStore with
+                                          | error error => simp [invoked] at run
+                                          | ok called =>
+                                              rcases called with
+                                                ⟨calledStore, calledValue⟩
+                                              simp only [invoked] at run
+                                              exact ihApply _ _ _ _ _ _
+                                                contextKnown
+                                                (ihInvoke _ _ _ _ _ _
+                                                  contextKnown readyValid invoked)
+                                                run
+
+/-- Operation-level projection of constructor-universe preservation. -/
+theorem Sidecars.SourceConstructorsValid.runOp
+    {sidecars : Sidecars} {context : IxIR1.Ctx} {fuel : Nat}
+    {current : IxIR1.FnDef} {store store' : IxIR1.Store}
+    {environment : List IxIR1.RVal} {operation : IxIR1.Op}
+    {value : IxIR1.RVal}
+    (contextKnown : sidecars.ContextConstructorsKnown context)
+    (currentKnown : sidecars.codeConstructorsKnown current.body = true)
+    (operationKnown : sidecars.operationConstructorsKnown operation = true)
+    (valid : sidecars.SourceConstructorsValid store)
+    (run : IxIR1.runOp context fuel current store environment operation =
+      .ok (store', value)) :
+    sidecars.SourceConstructorsValid store' :=
+  (evalConstructorsValidAt sidecars fuel).2.1 _ _ _ _ _ _ _ contextKnown
+    currentKnown operationKnown valid run
+
+/-- Higher-order application projection of constructor-universe
+preservation. -/
+theorem Sidecars.SourceConstructorsValid.applyGo
+    {sidecars : Sidecars} {context : IxIR1.Ctx} {fuel : Nat}
+    {store store' : IxIR1.Store} {function : IxIR1.RVal}
+    {arguments : List IxIR1.RVal} {value : IxIR1.RVal}
+    (contextKnown : sidecars.ContextConstructorsKnown context)
+    (valid : sidecars.SourceConstructorsValid store)
+    (run : IxIR1.applyGo context fuel store function arguments =
+      .ok (store', value)) :
+    sidecars.SourceConstructorsValid store' :=
+  (evalConstructorsValidAt sidecars fuel).2.2.2 _ _ _ _ _ _ contextKnown
+    valid run
+
+/-- A final source heap is reachable through the attachment's certified
+raw-to-emitted address action. This is deliberately an image predicate rather
+than an injectivity requirement: several raw declarations may share one
+content address. -/
+def CompiledAttachment.SourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) (store : IxIR1.Store) : Prop :=
+  ∃ sourceStore,
+    IxIR1.Readdress.Store.mapAddresses
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) sourceStore = store ∧
+      attached.sidecars.SourceConstructorsValid store
+
+/-- CPS boundary for a function return under one exact target continuation
+stack.  A handler is deliberately universal over the returning function and
+terminal trace coordinates: the recursive worker discovers the actual `ret`
+leaf, while the handler owns what happens after that return (halt, ordinary
+resume, or `applyMore`).  This lets tail calls reuse the enclosing handler
+without rebuilding the unchanged target stack. -/
+def SuccessfulReturnHandler
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context)
+    (interpretation : Eval.Interpretation)
+    (_functionTrace : Lower.FunctionTrace)
+    (frameRoots : List IxIR1.Sim.Root)
+    (stack : List Eval.Continuation)
+    (expected : IxIR1.Store × IxIR1.RVal)
+    (outcome : IxIR1.Store × IxIR1.RVal)
+    (post : SourceMachinePost) : Prop :=
+  ∀ {returningTrace : Lower.FunctionTrace}
+      {sourceFuel : Nat} {site : Lower.SourceSite} {blockId : BlockId}
+      {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+      {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+      {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+      {frame : Eval.Frame} {machine : Eval.Machine},
+    returningTrace ∈ attached.target.artifact.trace.functions →
+    returningTrace.root.Descendant
+        (.ret site blockId input entryValueCount sourceAtom targetAtom
+          generated) →
+    attached.sidecars.TraceStateRel returningTrace
+        (.ret site blockId input entryValueCount sourceAtom targetAtom
+          generated) sourceStore source frame →
+    Lower.Sim.StoreRel sourceStore machine.store →
+    Lower.Sim.SourceRuntimeInvariant sourceStore source →
+    Lower.Sim.SourceOwnershipAt attached.target.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frameRoots →
+    IxIR1.runCode sourceContext (sourceFuel + 1) returningTrace.source
+        sourceStore source (.ret sourceAtom) = .ok expected →
+    IxIR1.Sim.HasWorld expected.1 returningTrace.source.result expected.2 →
+    machine.control = .running frame stack →
+    frame.credits = #[] →
+    attached.SourceStoreImage sourceStore →
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine
+
+/-- The exact-fuel semantic worker property.  Its source recursion is
+continuation-passing: local trace steps keep the handler, ordinary calls build
+a `.resume` handler for their callee, and over-application builds an
+`applyMore` handler.  This is the induction predicate whose closure at every
+fuel yields `SuccessfulMainSimulation`. -/
+def SuccessfulTraceSimulationAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context)
+    (interpretation : Eval.Interpretation) (fuel : Nat) : Prop :=
+  ∀ {functionTrace : Lower.FunctionTrace} {trace : Lower.CodeTrace}
+      {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+      {frameRoots : List IxIR1.Sim.Root}
+      {sourceOutput : IxIR1.Store × IxIR1.RVal}
+      {outcome : IxIR1.Store × IxIR1.RVal}
+      {frame : Eval.Frame} {machine : Eval.Machine}
+      {stack : List Eval.Continuation} {post : SourceMachinePost},
+    functionTrace ∈ attached.target.artifact.trace.functions →
+    functionTrace.root.Descendant trace →
+    attached.sidecars.TraceStateRel functionTrace trace sourceStore source
+      frame →
+    Lower.Sim.StoreRel sourceStore machine.store →
+    Lower.Sim.SourceRuntimeInvariant sourceStore source →
+    Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions trace sourceStore source
+        frameRoots →
+    IxIR1.runCode sourceContext fuel functionTrace.source sourceStore source
+        trace.sourceCode = .ok sourceOutput →
+    IxIR1.Sim.HasWorld sourceOutput.1 functionTrace.source.result
+        sourceOutput.2 →
+    machine.control = .running frame stack →
+    frame.credits = #[] →
+    attached.SourceStoreImage sourceStore →
+    SuccessfulReturnHandler attached sourceContext context interpretation
+      functionTrace frameRoots stack sourceOutput outcome post →
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine
+
+/-- Canonical IxIR₁ evaluator context named by an attached source artifact. -/
+def CompiledAttachment.simulationSourceContext
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) : IxIR1.Ctx :=
+  { decls :=
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts }
+
+/-- The canonical source context used by the IxIR₂ simulation is exactly
+the final emitted IxIR₁ context with its closed-world oracle. -/
+theorem CompiledAttachment.simulationSourceContext_eq_addressedCtx
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    attached.simulationSourceContext =
+      attached.source.lowering.result.addressedCtx (fun _ _ => none) := by
+  unfold CompiledAttachment.simulationSourceContext
+    IxIR1.ReaddressAll.Result.addressedCtx
+    IxIR1.ReaddressAll.Result.asReaddressResult
+    IxIR1.ReaddressAll.Result.declarations
+    IxIR1.Readdress.Result.addressedCtx
+    IxIR1.Readdress.Result.declarations
+  simp only [List.append_nil]
+  congr 1
+  change IxIR1.HPT.programDeclEnv
+      attached.source.lowering.result.artifacts =
+    IxIR1.Env.ofList (IxIR1.HPT.declarationEntries
+      attached.source.lowering.result.artifacts)
+  exact (IxIR1.HPT.OptimizeProgram.envOfList_declarationEntries
+    attached.source.lowering.result.artifacts).symm
+
+/-- The successful fully addressed lowering retained by an attachment exposes
+the executable exact-source audit used by all raw-to-emitted provenance
+arguments. -/
+theorem CompiledAttachment.sourceRebuildSemanticAudit
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    attached.source.lowering.result.rebuildSemanticAudit
+      attached.source.lowering.raw attached.source.lowering.mainCode = true := by
+  have hrun :=
+    IxIR1.Lower.readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      attached.source.lowering.lowerRun
+      attached.source.lowering.addressedRun
+  exact IxIR1.ReaddressAll.rebuildSemanticAudit_of_run_eq_ok hrun
+
+/-- The rebuild audit supplies the exact context relation from the raw
+lowerer output to the final emitted source context used by IxIR₂. -/
+theorem CompiledAttachment.sourceContextRenames
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    IxIR1.Readdress.Ctx.Renames
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw)
+      (attached.source.exactTargetCtx (fun _ _ => none))
+      attached.simulationSourceContext := by
+  rw [attached.simulationSourceContext_eq_addressedCtx]
+  unfold Ix.Compiler.Pipeline.LoweredCompilation.exactTargetCtx
+  exact attached.source.lowering.result.renames_rebuildSourceCtx
+    attached.sourceRebuildSemanticAudit
+    (fun _ _ => none)
+
+/-- Declaration equality is enough to instantiate the raw-to-emitted context
+relation for an arbitrary final oracle. The raw oracle is pulled back through
+the same total address action. -/
+theorem CompiledAttachment.sourceContextRenamesOfDeclarations
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts) :
+    IxIR1.Readdress.Ctx.Renames
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw)
+      (attached.source.exactTargetCtx sourceContext.oracle) sourceContext := by
+  have contexts :=
+    attached.source.lowering.result.renames_rebuildSourceCtx
+      attached.sourceRebuildSemanticAudit sourceContext.oracle
+  unfold Ix.Compiler.Pipeline.LoweredCompilation.exactTargetCtx
+  have targetEq : attached.source.lowering.result.addressedCtx
+      sourceContext.oracle = sourceContext := by
+    cases sourceContext with
+    | mk declarations oracle =>
+        simp only at sourceDeclarations
+        unfold IxIR1.ReaddressAll.Result.addressedCtx
+          IxIR1.ReaddressAll.Result.asReaddressResult
+          IxIR1.ReaddressAll.Result.declarations
+          IxIR1.Readdress.Result.addressedCtx
+          IxIR1.Readdress.Result.declarations
+        simp only [List.append_nil]
+        congr 1
+        rw [sourceDeclarations]
+        exact IxIR1.HPT.OptimizeProgram.envOfList_declarationEntries
+          attached.source.lowering.result.artifacts
+  rw [targetEq] at contexts
+  exact contexts
+
+/-- Every literal source suffix retained by the checked IxIR₂ sidecar has an
+exact raw IxIR₁ syntax preimage. The proof combines source-site traversal with
+the rebuild audit's selected-declaration producer witness, so it remains valid
+when content addressing merges equal declarations. -/
+theorem CompiledAttachment.sourceCodeAddressImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {site : Lower.SourceSite} {code : IxIR1.Code}
+    (found : attached.sidecars.sourceCodeAt? site = some code) :
+    ∃ rawCode,
+      IxIR1.Readdress.Code.mapAddresses
+        (attached.source.lowering.result.rebuildRename
+          attached.source.lowering.raw) rawCode = code := by
+  refine attached.sidecars.sourceCodeAt?_addressImage
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) ?_ ?_ found
+  · refine ⟨attached.source.lowering.mainCode, ?_⟩
+    rw [attached.inputProduced]
+    exact (attached.source.lowering.result.main_eq_rebuildMapAddresses
+      attached.sourceRebuildSemanticAudit).symm
+  · intro address definition lookup
+    rw [attached.inputProduced] at lookup
+    change IxIR1.Env.ofList attached.source.lowering.result.declarations
+      address = some (.fn definition) at lookup
+    obtain ⟨sourceAddress, sourceDeclaration, sourceLookup, renameEq,
+        declarationImage⟩ :=
+      attached.source.lowering.result
+        |>.declaration_preimage_of_lookup_of_rebuildSemanticAudit
+          attached.sourceRebuildSemanticAudit lookup
+    cases sourceDeclaration with
+    | extern arity =>
+        simp [IxIR1.Readdress.Decl.mapAddresses] at declarationImage
+    | fn sourceDefinition =>
+        simp only [IxIR1.Readdress.Decl.mapAddresses,
+          IxIR1.Decl.fn.injEq] at declarationImage
+        exact ⟨sourceDefinition, declarationImage⟩
+
+/-- Every retained IxIR₂ function trace names a final IxIR₁ function whose
+body has an exact raw syntax preimage. Signature metadata is unchanged by
+readdressing, so the body witness lifts to the complete function record. -/
+theorem CompiledAttachment.functionSourceAddressImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions) :
+    ∃ rawDefinition,
+      IxIR1.Readdress.FnDef.mapAddresses
+        (attached.source.lowering.result.rebuildRename
+          attached.source.lowering.raw) rawDefinition = functionTrace.source := by
+  have rootFound : attached.sidecars.sourceCodeAt?
+      functionTrace.root.source = some functionTrace.root.sourceCode := by
+    by_cases owner : functionTrace.owner = .main
+    · have mainMatch := attached.target.artifact.functionTraceOrderProof
+        |>.main_of_mem_owner functionMember owner
+      simpa [functionTrace.rootSource, owner, functionTrace.rootSourceCode,
+        mainMatch.source, attached.targetSourceProduced,
+        Lower.Input.mainDefinition] using
+        attached.sidecars.sourceCodeAt?_main
+    · exact attached.sidecars.sourceCodeAt?_functionRoot
+        (attached.functionTraceAnalysisCurrent functionMember owner)
+  obtain ⟨rawBody, bodyImage⟩ := attached.sourceCodeAddressImage rootFound
+  rw [functionTrace.rootSourceCode] at bodyImage
+  cases sourceEq : functionTrace.source with
+  | mk arity result papSafe body =>
+      have bodyImage' : IxIR1.Readdress.Code.mapAddresses
+        (attached.source.lowering.result.rebuildRename
+          attached.source.lowering.raw) rawBody = body := by
+        simpa [sourceEq] using bodyImage
+      refine ⟨⟨arity, result, papSafe, rawBody⟩, ?_⟩
+      simpa [IxIR1.Readdress.FnDef.mapAddresses] using bodyImage'
+
+/-- At a retained `letOp`, both the current function and the exact operation
+are raw syntax images. This packages the two syntax premises consumed by
+single-operation evaluator reflection. -/
+theorem CompiledAttachment.letOpAddressImages
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frame : Eval.Frame}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frame) :
+    ∃ rawCurrent rawOperation,
+      IxIR1.Readdress.FnDef.mapAddresses
+          (attached.source.lowering.result.rebuildRename
+            attached.source.lowering.raw) rawCurrent = functionTrace.source ∧
+        IxIR1.Readdress.Op.mapAddresses
+          (attached.source.lowering.result.rebuildRename
+            attached.source.lowering.raw) rawOperation = operation := by
+  obtain ⟨rawCurrent, currentImage⟩ :=
+    attached.functionSourceAddressImage functionMember
+  have sourceAt : attached.sidecars.sourceCodeAt? site =
+      some (.letOp operation next.sourceCode) := by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceCode] using
+      state.sourceCode
+  obtain ⟨rawCode, codeImage⟩ := attached.sourceCodeAddressImage sourceAt
+  cases rawCode with
+  | ret atom =>
+      simp [IxIR1.Readdress.Code.mapAddresses] at codeImage
+  | case scrutinee peelNat alternatives =>
+      simp [IxIR1.Readdress.Code.mapAddresses] at codeImage
+  | letOp rawOperation rawNext =>
+      simp only [IxIR1.Readdress.Code.mapAddresses,
+        IxIR1.Code.letOp.injEq] at codeImage
+      exact ⟨rawCurrent, rawOperation, currentImage, codeImage.1⟩
+
+/-- The validated IxIR₁ compiler constructs the higher-order ownership
+contract on the exact raw context, before final declaration readdressing. -/
+theorem CompiledAttachment.rawApplyOwnership
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    IxIR1.Sim.ApplyOwnershipContract
+      (attached.source.exactTargetCtx (fun _ _ => none)) :=
+  (attached.source.exactCompilerContracts (fun _ _ => none)).1.apply
+
+/-- The empty source heap is an exact image for every attachment. -/
+theorem CompiledAttachment.sourceStoreImage_empty
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    attached.SourceStoreImage ({} : IxIR1.Store) := by
+  exact ⟨{}, by simp [IxIR1.Readdress.Store.mapAddresses],
+    Sidecars.SourceConstructorsValid.empty attached.sidecars⟩
+
+/-- Every successful retained source operation preserves exact raw heap-image
+provenance. The sidecar supplies raw preimages for the current function and
+operation, while evaluator reflection supplies the output heap witness. -/
+theorem CompiledAttachment.runOp_preservesSourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    {store store' : IxIR1.Store} {source : List IxIR1.RVal}
+    {frame : Eval.Frame} {fuel : Nat} {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) store source frame)
+    (image : attached.SourceStoreImage store)
+    (run : IxIR1.runOp sourceContext fuel
+      functionTrace.source store source operation = .ok (store', value)) :
+    attached.SourceStoreImage store' := by
+  obtain ⟨rawStore, storeImage, constructorsValid⟩ := image
+  have outputConstructors :
+      attached.sidecars.SourceConstructorsValid store' :=
+    constructorsValid.runOp
+      (attached.sourceContextConstructorsKnown sourceDeclarations)
+      (attached.functionCodeConstructorsKnown functionMember)
+      (attached.descendantOperationConstructorsKnown functionMember descendant)
+      run
+  obtain ⟨rawCurrent, rawOperation, currentImage, operationImage⟩ :=
+    attached.letOpAddressImages functionMember state
+  rw [← storeImage, ← currentImage, ← operationImage] at run
+  obtain ⟨rawStore', rawRun, outputImage⟩ :=
+    IxIR1.Readdress.runOp_success_preimage
+      (attached.sourceContextRenamesOfDeclarations sourceContext
+        sourceDeclarations) run
+  exact ⟨rawStore', outputImage.symm, outputConstructors⟩
+
+/-- Reference-count duplication preserves the attachment's exact heap-image
+predicate, including the intermediate stores used to enter PAP callees. -/
+theorem CompiledAttachment.dupVals_preservesSourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {store store' : IxIR1.Store} {values : List IxIR1.RVal}
+    (image : attached.SourceStoreImage store)
+    (run : IxIR1.dupVals store values = .ok store') :
+    attached.SourceStoreImage store' := by
+  obtain ⟨rawStore, storeImage, constructorsValid⟩ := image
+  have outputConstructors := constructorsValid.dupVals run
+  subst store
+  obtain ⟨rawStore', rawRun, outputImage⟩ :=
+    IxIR1.Readdress.dupVals_success_preimage run
+  exact ⟨rawStore', outputImage.symm, outputConstructors⟩
+
+/-- Shared destruction preserves exact heap-image provenance in every final
+context whose declarations agree with the attached source artifact. -/
+theorem CompiledAttachment.dropVal_preservesSourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {fuel : Nat} {store store' : IxIR1.Store} {value : IxIR1.RVal}
+    (image : attached.SourceStoreImage store)
+    (run : IxIR1.dropVal sourceContext fuel store value = .ok store') :
+    attached.SourceStoreImage store' := by
+  obtain ⟨rawStore, storeImage, constructorsValid⟩ := image
+  have outputConstructors := constructorsValid.dropVal run
+  subst store
+  obtain ⟨rawStore', rawRun, outputImage⟩ :=
+    IxIR1.Readdress.dropVal_success_preimage
+      (attached.sourceContextRenamesOfDeclarations sourceContext
+        sourceDeclarations) run
+  exact ⟨rawStore', outputImage.symm, outputConstructors⟩
+
+/-- List destruction preserves exact heap-image provenance in every compatible
+final source context. -/
+theorem CompiledAttachment.dropMany_preservesSourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {fuel : Nat} {store store' : IxIR1.Store} {values : List IxIR1.RVal}
+    (image : attached.SourceStoreImage store)
+    (run : IxIR1.dropMany sourceContext fuel store values = .ok store') :
+    attached.SourceStoreImage store' := by
+  obtain ⟨rawStore, storeImage, constructorsValid⟩ := image
+  have outputConstructors := constructorsValid.dropMany run
+  subst store
+  obtain ⟨rawStore', rawRun, outputImage⟩ :=
+    IxIR1.Readdress.dropMany_success_preimage
+      (attached.sourceContextRenamesOfDeclarations sourceContext
+        sourceDeclarations) run
+  exact ⟨rawStore', outputImage.symm, outputConstructors⟩
+
+/-- A successful application from the compiler-certified raw context has an
+identical run in the emitted context on the address-renamed heap, and the
+renamed output retains exact root ownership. This is the forward image needed
+by compiled executions; it deliberately makes no claim about arbitrary final
+heaps that are not images of raw heaps. -/
+theorem CompiledAttachment.applyGo_exactImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {fuel : Nat} {store store' : IxIR1.Store}
+    {function : IxIR1.RVal} {args : List IxIR1.RVal}
+    {value : IxIR1.RVal} {rest : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership store
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest))
+    (run : IxIR1.applyGo
+      (attached.source.exactTargetCtx (fun _ _ => none))
+      fuel store function args = .ok (store', value)) :
+    IxIR1.applyGo attached.simulationSourceContext fuel
+        (IxIR1.Readdress.Store.mapAddresses
+          (attached.source.lowering.result.rebuildRename
+            attached.source.lowering.raw) store)
+        function args =
+      .ok
+        (IxIR1.Readdress.Store.mapAddresses
+          (attached.source.lowering.result.rebuildRename
+            attached.source.lowering.raw) store', value) ∧
+    IxIR1.Sim.RootOwnership
+      (IxIR1.Readdress.Store.mapAddresses
+        (attached.source.lowering.result.rebuildRename
+          attached.source.lowering.raw) store')
+      (⟨.shared, value⟩ :: rest) := by
+  constructor
+  · rw [IxIR1.Readdress.applyGo_mapAddresses
+      attached.sourceContextRenames, run]
+    rfl
+  · apply (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) store'
+      (⟨.shared, value⟩ :: rest)).mpr
+    exact attached.rawApplyOwnership.preserves ownership run
+
+/-- On an exact source-heap image, every successful emitted-context
+application both preserves the image invariant and obtains its ownership
+postcondition from the compiler-certified raw contract. This is the
+worker-facing direction of `applyGo_exactImage`. -/
+theorem CompiledAttachment.applyGo_owned_of_sourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {fuel : Nat} {store store' : IxIR1.Store}
+    {function : IxIR1.RVal} {args : List IxIR1.RVal}
+    {value : IxIR1.RVal} {rest : List IxIR1.Sim.Root}
+    (image : attached.SourceStoreImage store)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest))
+    (run : IxIR1.applyGo attached.simulationSourceContext fuel store
+      function args = .ok (store', value)) :
+    attached.SourceStoreImage store' ∧
+      IxIR1.Sim.RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨sourceStore, sourceStoreEq, constructorsValid⟩ := image
+  have outputConstructors :
+      attached.sidecars.SourceConstructorsValid store' :=
+    constructorsValid.applyGo
+      (attached.sourceContextConstructorsKnown (sourceDeclarations := rfl)) run
+  subst store
+  obtain ⟨sourceStore', sourceRun, outputStoreEq⟩ :=
+    IxIR1.Readdress.applyGo_success_preimage
+      attached.sourceContextRenames run
+  have sourceOwnership : IxIR1.Sim.RootOwnership sourceStore
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest) :=
+    (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) sourceStore
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest)).mp ownership
+  have sourceOutputOwnership : IxIR1.Sim.RootOwnership sourceStore'
+      (⟨.shared, value⟩ :: rest) :=
+    attached.rawApplyOwnership.preserves sourceOwnership sourceRun
+  constructor
+  · exact ⟨sourceStore', outputStoreEq.symm, outputConstructors⟩
+  · rw [outputStoreEq]
+    exact (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) sourceStore'
+      (⟨.shared, value⟩ :: rest)).mpr sourceOutputOwnership
+
+/-- Declaration-compatible source contexts obtain the same image-restricted
+application theorem for their own oracle. This is the generic trace-worker
+form; certified programs contain no externs, but retaining the oracle exactly
+keeps the evaluator transport statement total. -/
+theorem CompiledAttachment.applyGo_owned_of_sourceStoreImage_of_declarations
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {fuel : Nat} {store store' : IxIR1.Store}
+    {function : IxIR1.RVal} {args : List IxIR1.RVal}
+    {value : IxIR1.RVal} {rest : List IxIR1.Sim.Root}
+    (image : attached.SourceStoreImage store)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest))
+    (run : IxIR1.applyGo sourceContext fuel store function args =
+      .ok (store', value)) :
+    attached.SourceStoreImage store' ∧
+      IxIR1.Sim.RootOwnership store' (⟨.shared, value⟩ :: rest) := by
+  obtain ⟨sourceStore, sourceStoreEq, constructorsValid⟩ := image
+  have outputConstructors :
+      attached.sidecars.SourceConstructorsValid store' :=
+    constructorsValid.applyGo
+      (attached.sourceContextConstructorsKnown sourceDeclarations) run
+  subst store
+  let contexts := attached.sourceContextRenamesOfDeclarations sourceContext
+    sourceDeclarations
+  obtain ⟨sourceStore', sourceRun, outputStoreEq⟩ :=
+    IxIR1.Readdress.applyGo_success_preimage contexts run
+  have sourceOwnership : IxIR1.Sim.RootOwnership sourceStore
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest) :=
+    (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) sourceStore
+      (⟨.shared, function⟩ ::
+        IxIR1.Sim.rootsFor .shared args ++ rest)).mp ownership
+  have rawContract : IxIR1.Sim.ApplyOwnershipContract
+      (attached.source.exactTargetCtx sourceContext.oracle) :=
+    (attached.source.exactCompilerContracts sourceContext.oracle).1.apply
+  have sourceOutputOwnership : IxIR1.Sim.RootOwnership sourceStore'
+      (⟨.shared, value⟩ :: rest) :=
+    rawContract.preserves sourceOwnership sourceRun
+  constructor
+  · exact ⟨sourceStore', outputStoreEq.symm, outputConstructors⟩
+  · rw [outputStoreEq]
+    exact (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename
+        attached.source.lowering.raw) sourceStore'
+      (⟨.shared, value⟩ :: rest)).mpr sourceOutputOwnership
+
+/-- The generic image theorem exposes precisely the fixed-input law required
+by checked trace ownership. -/
+theorem CompiledAttachment.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {fuel : Nat} {store : IxIR1.Store}
+    (image : attached.SourceStoreImage store) :
+    IxIR1.Sim.ApplyOwnershipPreservesFrom sourceContext fuel store := by
+  intro store' function args value rest ownership run
+  exact (attached.applyGo_owned_of_sourceStoreImage_of_declarations
+    sourceDeclarations image ownership run).2
+
+/-- Exact heap-image provenance specializes the raw compiler theorem to the
+fixed-input ownership interface consumed by trace simulation. -/
+theorem CompiledAttachment.applyOwnershipPreservesFrom_sourceStoreImage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {fuel : Nat} {store : IxIR1.Store}
+    (image : attached.SourceStoreImage store) :
+    IxIR1.Sim.ApplyOwnershipPreservesFrom
+      attached.simulationSourceContext fuel store := by
+  intro store' function args value rest ownership run
+  exact (attached.applyGo_owned_of_sourceStoreImage image ownership run).2
+
+/-- At an HPT-ambiguous case, exact source-heap provenance identifies the
+runtime constructor as a member of the producer universe.  The attachment's
+residual coverage audit therefore supplies the complete parallel target
+branch selection. -/
+theorem CompiledAttachment.constructorSwitchSelection_of_residual_nonempty
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {location : Nat} {box : IxIR1.NodeBox}
+    {identity : CtorId} {fields : Array IxIR1.RVal}
+    {fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (ambiguous : attached.sidecars.exactConstructorAt? site sourceScrutinee =
+      none)
+    (image : attached.SourceStoreImage sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN identity fields)
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives
+      identity.cidx =
+        some (.mk identity.cidx fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount) :
+    Nonempty (ConstructorSwitchSelection targetScrutinee generated outgoing
+      children identity) := by
+  obtain ⟨rawStore, storeImage, constructorsValid⟩ := image
+  have runtimeKnown : attached.sidecars.constructorKnown identity
+      fields.size = true := by
+    cases box with
+    | mk world rc boxNode =>
+        change boxNode = .ctorN identity fields at node
+        subst boxNode
+        exact constructorsValid.constructorKnown sourceGet
+  have known : ∃ info ∈ attached.sidecars.constructors,
+      info.identity = identity ∧ info.arity = fieldCount :=
+    attached.sidecars.constructorKnown_witness
+      (by simpa [fieldArity] using runtimeKnown)
+  obtain ⟨constructors, targetPeel, _, terminator⟩ :=
+    Lower.CodeTrace.switchSyntax_of_match
+      (functionTrace.descendantSyntaxMatches descendant)
+  have rootCoverage :=
+    attached.sidecars.functionCodeResidualCaseTargetsMatch
+      attached.traceResidualCaseTargetsProduced functionMember
+  have localCoverage :=
+    attached.sidecars.codeResidualCaseTargetsMatch_descendant rootCoverage
+      descendant
+  obtain ⟨target, targetAlternative⟩ :=
+    attached.sidecars.residualCaseTarget_of_codeResidualCaseTargetsMatch
+      localCoverage ambiguous known sourceAlternative terminator
+  have targetMember : target ∈ constructors :=
+    Array.mem_of_find?_eq_some targetAlternative
+  obtain ⟨index, targetAt⟩ := (Array.mem_iff_getElem?).mp targetMember
+  have branchMatch := Lower.CodeTrace.switchNodeBranchesMatch_of_match
+    (functionTrace.descendantSwitchBranchesMatch descendant)
+  have branchMatch' := branchMatch
+  unfold Lower.switchNodeBranchesMatch at branchMatch'
+  rw [terminator] at branchMatch'
+  simp only [Bool.and_eq_true] at branchMatch'
+  obtain ⟨⟨⟨outgoingLength, childrenLength⟩, _⟩, _⟩ := branchMatch'
+  have targetBound : index < constructors.size :=
+    (Array.getElem?_eq_some_iff.mp targetAt).1
+  have edgeBound : index < outgoing.length := by
+    have lengthEq := beq_iff_eq.mp outgoingLength
+    omega
+  have childBound : index < children.length := by
+    have lengthEq := beq_iff_eq.mp childrenLength
+    omega
+  let edge := outgoing[index]'edgeBound
+  let child := children[index]'childBound
+  have edgeAt : outgoing[index]? = some edge :=
+    List.getElem?_eq_some_iff.mpr ⟨edgeBound, rfl⟩
+  have childAt : children[index]? = some child :=
+    List.getElem?_eq_some_iff.mpr ⟨childBound, rfl⟩
+  exact ⟨
+    { constructors
+      targetPeel
+      index
+      target
+      edge
+      child
+      terminator
+      targetAt
+      targetAlternative
+      edgeAt
+      childAt }⟩
+
+/-- Proof-relevant residual constructor selection derived wholly from an
+attached producer artifact and its reachable source-heap image. -/
+noncomputable def CompiledAttachment.constructorSwitchSelection_of_residual
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {location : Nat} {box : IxIR1.NodeBox}
+    {identity : CtorId} {fields : Array IxIR1.RVal}
+    {fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (ambiguous : attached.sidecars.exactConstructorAt? site sourceScrutinee =
+      none)
+    (image : attached.SourceStoreImage sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN identity fields)
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives
+      identity.cidx =
+        some (.mk identity.cidx fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount) :
+    ConstructorSwitchSelection targetScrutinee generated outgoing children
+      identity :=
+  Classical.choice
+    (attached.constructorSwitchSelection_of_residual_nonempty functionMember
+      descendant ambiguous image sourceGet node sourceAlternative fieldArity)
+
+/-- Canonical IxIR₂ evaluator context named by an attached target artifact. -/
+def CompiledAttachment.simulationTargetContext
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) : Eval.Context :=
+  Eval.Context.ofProgram attached.target.artifact.program
+    attached.target.artifact.validationContext.schemas
+
+/-- Semantic/environment obligations shared by every branch of the exhaustive
+fuel worker. Declaration and schema identities pin both evaluators to the
+attached artifact. Reuse freedom and reachable-heap application ownership are
+derived from the attachment, as are exact and ambiguous-HPT constructor
+selections. -/
+structure SuccessfulSimulationContracts
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) (sourceContext : IxIR1.Ctx) (context : Eval.Context) : Type
+    where
+  sourceDeclarations : sourceContext.decls =
+    IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts
+  targetDeclarations : context.declarations =
+    (Eval.Context.ofProgram attached.target.artifact.program
+      attached.target.artifact.validationContext.schemas).declarations
+  targetSchemas : context.schemas =
+    attached.target.artifact.validationContext.schemas
+
+/-- Construct the worker contract over the exact contexts carried by an
+attachment, discharging all identity fields definitionally. -/
+def CompiledAttachment.successfulSimulationContracts
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    SuccessfulSimulationContracts attached attached.simulationSourceContext
+      attached.simulationTargetContext :=
+  { sourceDeclarations := rfl
+    targetDeclarations := rfl
+    targetSchemas := rfl }
+
+/-- Fuel zero is the vacuous base of the recursive trace worker: no IxIR₁
+code shape can return successfully without one control-fuel constructor. -/
+theorem successfulTraceSimulationAt_zero
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context)
+    (interpretation : Eval.Interpretation) :
+    SuccessfulTraceSimulationAt attached sourceContext context interpretation
+      0 := by
+  intro functionTrace trace sourceStore source frameRoots sourceOutput outcome
+    frame machine stack post member descendant state stores runtime ownership
+    sourceRun
+  rw [IxIR1.runCode.eq_def] at sourceRun
+  contradiction
+
+/-- The outermost empty continuation is a concrete successful-return handler:
+one checked target return halts with the same value and exact related heap. -/
+theorem CompiledAttachment.haltReturnHandler
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context)
+    (interpretation : Eval.Interpretation)
+    (functionTrace : Lower.FunctionTrace)
+    (sourceOutput : IxIR1.Store × IxIR1.RVal) :
+    SuccessfulReturnHandler attached sourceContext context interpretation
+      functionTrace [] [] sourceOutput sourceOutput
+      (fun sourceStore value machine =>
+        machine.control = .halted value ∧
+          Lower.Sim.StoreRel sourceStore machine.store) := by
+  intro returningTrace sourceFuel site blockId input entryValueCount sourceAtom
+    targetAtom generated sourceStore source frame machine returningMember
+    descendant state stores runtime ownership sourceRun resultWorld control
+    noCredits image
+  obtain ⟨value, outputEq, targetSteps, nextStores⟩ :=
+    attached.simulate_traced_ret_halt_success descendant state stores sourceRun
+      resultWorld control noCredits
+  cases outputEq
+  have reached : ReachesPost context interpretation
+      (fun sourceStore value machine =>
+        machine.control = .halted value ∧
+          Lower.Sim.StoreRel sourceStore machine.store)
+      sourceStore value machine :=
+    ⟨1, { machine with control := .halted value }, targetSteps, rfl,
+      nextStores⟩
+  exact ⟨machine.heapFuel, by simpa using reached⟩
+
+/-- Turn the smaller-fuel caller worker into the return handler for an
+ordinary callee.  The callee's terminal step restores the exact suspended
+caller trace state; the caller worker then consumes its source continuation.
+This lemma is the central `.resume` knot of the CPS induction. -/
+private theorem resumeReturnHandlerWithOwnership
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callerFuel operationFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    {callSite : Lower.SourceSite} {callBlock : BlockId}
+    {callInput nextInput : Lower.Sim.EnvMap}
+    {callEntryValueCount callIndex : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (callerDescendant : callerTrace.root.Descendant
+      (.letOp callSite callBlock callInput nextInput callEntryValueCount
+        operation callIndex instruction next))
+    {callerStore outputStore finalStore : IxIR1.Store}
+    {callerSource : List IxIR1.RVal} {value finalValue : IxIR1.RVal}
+    {calleeFrameRoots callerFrameRoots : List IxIR1.Sim.Root}
+    {callerFrame : Eval.Frame} {rest : List Eval.Continuation}
+    (callerState : attached.sidecars.TraceStateRel callerTrace
+      (.letOp callSite callBlock callInput nextInput callEntryValueCount
+        operation callIndex instruction next)
+      callerStore callerSource callerFrame)
+    (binder : Lower.Instr.baselineBinderAtom callEntryValueCount instruction =
+      some (.reg callEntryValueCount))
+    (delta : Lower.Instr.baselineValueDelta instruction = some 1)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceOperation : IxIR1.runOp sourceContext operationFuel
+      callerTrace.source callerStore callerSource operation =
+        .ok (outputStore, value))
+    (callerRuntime : Lower.Sim.SourceRuntimeInvariant outputStore
+      (value :: callerSource))
+    (callerOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next outputStore
+        (value :: callerSource) callerFrameRoots)
+    (callerRun : IxIR1.runCode sourceContext callerFuel callerTrace.source
+      outputStore (value :: callerSource) next.sourceCode =
+        .ok (finalStore, finalValue))
+    (callerResultWorld : IxIR1.Sim.HasWorld finalStore
+      callerTrace.source.result finalValue)
+    (callerNoCredits : callerFrame.credits = #[])
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation callerTrace callerFrameRoots rest
+        (finalStore, finalValue) outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation callerFuel) :
+    SuccessfulReturnHandler attached sourceContext context interpretation
+      calleeTrace calleeFrameRoots
+      (.resume { callerFrame with pc := callerFrame.pc + 1 } :: rest)
+      (outputStore, value) outcome post := by
+  intro returningTrace returnFuel returnSite returnBlock returnInput
+    returnEntryValueCount sourceAtom targetAtom returnGenerated sourceStore
+    calleeSource calleeFrame machine returningMember calleeDescendant
+    calleeState stores calleeRuntime calleeOwnership sourceReturn resultWorld
+    control noCredits calleeImage
+  obtain ⟨returnedValue, sourceResolved, outputEq⟩ :=
+    IxIR1.runCode_ret_success sourceReturn
+  have storeEq : sourceStore = outputStore := by
+    exact (congrArg Prod.fst outputEq).symm
+  have valueEq : returnedValue = value := by
+    exact (congrArg Prod.snd outputEq).symm
+  subst sourceStore
+  subst returnedValue
+  let nextCallerFrame : Eval.Frame :=
+    { callerFrame with
+      pc := callerFrame.pc + 1
+      values := callerFrame.values.push value }
+  obtain ⟨_, returnSteps, nextStores, nextState⟩ :=
+    attached.simulate_traced_return_to_letOp_state
+      (sourceFuel := returnFuel) (context := context)
+      (interpretation := interpretation) callerMember
+      callerDescendant calleeDescendant callerState calleeState binder delta
+      stores sourceDeclarations sourceOperation sourceResolved control noCredits
+      (calleeState.target.resultWorld stores resultWorld)
+  have nextDescendant : callerTrace.root.Descendant next := by
+    exact .step callerDescendant (by simp [Lower.CodeTrace.children])
+  have nextControl :
+      ({ machine with control := .running nextCallerFrame rest } :
+        Eval.Machine).control = .running nextCallerFrame rest := rfl
+  have nextNoCredits : nextCallerFrame.credits = #[] := by
+    simpa [nextCallerFrame] using callerNoCredits
+  have tail := worker (machine :=
+      { machine with control := .running nextCallerFrame rest })
+    (stack := rest) callerMember nextDescendant nextState nextStores
+      callerRuntime callerOwnership callerRun callerResultWorld nextControl
+      nextNoCredits calleeImage finish
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel outputStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running calleeFrame
+      (.resume { callerFrame with pc := callerFrame.pc + 1 } :: rest) := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedReturnSteps, _, _⟩ :=
+    attached.simulate_traced_return_to_letOp_state
+      (machine := fundedMachine) (sourceFuel := returnFuel)
+      (context := context) (interpretation := interpretation) callerMember
+      callerDescendant calleeDescendant callerState calleeState binder delta
+      fundedStores sourceDeclarations sourceOperation sourceResolved
+      fundedControl noCredits
+      (calleeState.target.resultWorld fundedStores resultWorld)
+  refine ⟨tailHeapFuel, ?_⟩
+  simpa [fundedMachine] using tail.prepend fundedReturnSteps
+
+/-- An exact source result can resume one suspended target frame and then
+reach the enclosing postcondition.  This is the target-facing tail shared by
+immediate `applyMore` results and by the ordinary return of an exactly
+saturated recursive callee. -/
+def SuccessfulResumeContinuation
+    (context : Eval.Context) (interpretation : Eval.Interpretation)
+    (caller : Eval.Frame) (rest : List Eval.Continuation)
+    (sourceOutput outcome : IxIR1.Store × IxIR1.RVal)
+    (post : SourceMachinePost) : Prop :=
+  ∀ {machine : Eval.Machine},
+    Lower.Sim.StoreRel sourceOutput.1 machine.store →
+    machine.control = .running
+      { caller with values := caller.values.push sourceOutput.2 } rest →
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine
+
+/-- A successful resume continuation induces the universal return handler
+for any retained callee on the corresponding `.resume` stack.  The terminal
+target step preserves heap fuel, so the continuation chooses its own suffix
+budget unchanged. -/
+private theorem resumeReturnHandlerOfContinuation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (functionTrace : Lower.FunctionTrace)
+    (frameRoots : List IxIR1.Sim.Root)
+    (caller : Eval.Frame) (rest : List Eval.Continuation)
+    (sourceOutput outcome : IxIR1.Store × IxIR1.RVal)
+    (post : SourceMachinePost)
+    (continuation : SuccessfulResumeContinuation context interpretation
+      caller rest sourceOutput outcome post) :
+    SuccessfulReturnHandler attached sourceContext context interpretation
+      functionTrace frameRoots (.resume caller :: rest) sourceOutput outcome
+      post := by
+  intro returningTrace returnFuel site blockId input entryValueCount sourceAtom
+    targetAtom generated sourceStore source frame machine returningMember
+    descendant state stores runtime ownership sourceRun resultWorld control
+    noCredits image
+  obtain ⟨returnedValue, sourceResolved, outputEq⟩ :=
+    IxIR1.runCode_ret_success sourceRun
+  have storeEq : sourceStore = sourceOutput.1 := by
+    exact (congrArg Prod.fst outputEq).symm
+  have valueEq : returnedValue = sourceOutput.2 := by
+    exact (congrArg Prod.snd outputEq).symm
+  subst sourceStore
+  subst returnedValue
+  let nextMachine : Eval.Machine :=
+    { machine with
+      control := .running
+        { caller with values := caller.values.push sourceOutput.2 } rest }
+  have nextStores : Lower.Sim.StoreRel sourceOutput.1 nextMachine.store := by
+    simpa [nextMachine] using stores
+  have nextControl : nextMachine.control = .running
+      { caller with values := caller.values.push sourceOutput.2 } rest := rfl
+  have tail := continuation nextStores nextControl
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  let fundedNext : Eval.Machine := { nextMachine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceOutput.1
+      fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control =
+      .running frame (.resume caller :: rest) := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, returnSteps, _, _⟩ :=
+    Lower.Sim.simulate_traced_ret_resume_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := returningTrace.source) (sourceFuel := returnFuel)
+      (context := context) (interpretation := interpretation)
+      (machine := fundedMachine)
+      (callerSource := caller.values.toList.reverse)
+      (callerMapping := Lower.Sim.entryMap caller.values.size)
+      descendant state.target fundedStores (Lower.Sim.EnvRel.entry caller.values)
+      sourceResolved fundedControl noCredits
+      (state.target.resultWorld fundedStores resultWorld)
+  refine ⟨tailHeapFuel, ?_⟩
+  have tail' : ReachesPost context interpretation post outcome.1 outcome.2
+      fundedNext := by
+    simpa [fundedNext, nextMachine] using tail
+  simpa [fundedMachine, fundedNext, nextMachine] using
+    tail'.prepend returnSteps
+
+/-- Package a recursive caller worker as the exact resumed-frame continuation
+consumed by every terminal `applyMore` branch. -/
+private theorem resumeContinuationOfWorker
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callerFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {callerTrace : Lower.FunctionTrace} {next : Lower.CodeTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (nextDescendant : callerTrace.root.Descendant next)
+    {outputStore finalStore : IxIR1.Store}
+    {callerSource : List IxIR1.RVal} {value finalValue : IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {resumeFrame nextFrame : Eval.Frame} {stack : List Eval.Continuation}
+    (nextFrameEq : nextFrame =
+      { resumeFrame with values := resumeFrame.values.push value })
+    (nextState : attached.sidecars.TraceStateRel callerTrace next outputStore
+      (value :: callerSource) nextFrame)
+    (runtime : Lower.Sim.SourceRuntimeInvariant outputStore
+      (value :: callerSource))
+    (image : attached.SourceStoreImage outputStore)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next outputStore
+        (value :: callerSource) frameRoots)
+    (callerRun : IxIR1.runCode sourceContext callerFuel callerTrace.source
+      outputStore (value :: callerSource) next.sourceCode =
+        .ok (finalStore, finalValue))
+    (resultWorld : IxIR1.Sim.HasWorld finalStore
+      callerTrace.source.result finalValue)
+    (noCredits : nextFrame.credits = #[])
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation callerTrace frameRoots stack
+        (finalStore, finalValue) outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation callerFuel) :
+    SuccessfulResumeContinuation context interpretation resumeFrame stack
+      (outputStore, value) outcome post := by
+  intro machine stores control
+  apply worker callerMember nextDescendant nextState stores runtime ownership
+    callerRun resultWorld ?_ noCredits image finish
+  simpa [nextFrameEq] using control
+
+/-- A source-success decomposition of one dynamic `applyGo` chain aligned to
+the checked target declarations and retained function traces.  The recursive
+over-saturated constructor stores the residual plan at the evaluator's
+strictly smaller fuel; the other constructors are terminal dispatcher
+outcomes. -/
+inductive ApplyMorePlan
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context) :
+    Nat → IxIR1.Store → IxIR1.RVal → List IxIR1.RVal →
+      IxIR1.Store → IxIR1.RVal → Prop where
+  | erased {fuel : Nat} {sourceStore sourceReleased : IxIR1.Store}
+      {values : List IxIR1.RVal}
+      (sourceRelease : IxIR1.dropMany sourceContext fuel sourceStore values =
+        .ok sourceReleased) :
+      ApplyMorePlan attached sourceContext context (fuel + 1) sourceStore
+        .erased values sourceReleased .erased
+  | papUnder {fuel : Nat}
+      {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+      {location : Nat} {box : IxIR1.NodeBox}
+      {address : Ixon.Address} {arity : Nat}
+      {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+      (sourceGet : sourceStore.get? location = some box)
+      (node : box.node = .papN address arity captured)
+      (sourceRetain : IxIR1.dupVals sourceStore captured.toList =
+        .ok sourceRetained)
+      (sourceRelease : IxIR1.dropVal sourceContext fuel sourceRetained
+        (.loc location) = .ok sourceReleased)
+      (totalUnder : (captured.toList ++ values).length < arity) :
+      ApplyMorePlan attached sourceContext context (fuel + 1) sourceStore
+        (.loc location) values
+        (sourceReleased.allocNode .shared
+          (.papN address arity (captured ++ values.toArray))).1
+        (.loc (sourceReleased.allocNode .shared
+          (.papN address arity (captured ++ values.toArray))).2)
+  | papSaturatedFn {fuel calleeFuel : Nat}
+      {sourceStore sourceRetained sourceReleased outputStore : IxIR1.Store}
+      {location : Nat} {box : IxIR1.NodeBox}
+      {address : Ixon.Address} {arity : Nat}
+      {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+      {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+      {calleeTrace : Lower.FunctionTrace} {value : IxIR1.RVal}
+      (calleeMember : calleeTrace ∈
+        attached.target.artifact.trace.functions)
+      (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+        (.declaration address) sourceDefinition targetDefinition)
+      (sourceGet : sourceStore.get? location = some box)
+      (node : box.node = .papN address arity captured)
+      (sourceRetain : IxIR1.dupVals sourceStore captured.toList =
+        .ok sourceRetained)
+      (sourceRelease : IxIR1.dropVal sourceContext fuel sourceRetained
+        (.loc location) = .ok sourceReleased)
+      (totalExact : (captured.toList ++ values).length = arity)
+      (papArity : arity = sourceDefinition.arity)
+      (sourceDeclaration : sourceContext.decls address =
+        some (.fn sourceDefinition))
+      (sourcePapSafe : sourceDefinition.papSafe = true)
+      (targetDeclaration : context.declarations address =
+        some (.fn targetDefinition))
+      (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+        sourceReleased (captured.toList ++ values).reverse
+          sourceDefinition.body = .ok (outputStore, value))
+      (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+        sourceDefinition.result value)
+      (calleeSmaller : calleeFuel < fuel + 1) :
+      ApplyMorePlan attached sourceContext context (fuel + 1) sourceStore
+        (.loc location) values outputStore value
+  | papOverFn {fuel calleeFuel : Nat}
+      {sourceStore sourceRetained sourceReleased calledStore outputStore :
+        IxIR1.Store}
+      {location : Nat} {box : IxIR1.NodeBox}
+      {address : Ixon.Address} {arity : Nat}
+      {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+      {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+      {calleeTrace : Lower.FunctionTrace}
+      {calledValue outputValue : IxIR1.RVal}
+      (calleeMember : calleeTrace ∈
+        attached.target.artifact.trace.functions)
+      (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+        (.declaration address) sourceDefinition targetDefinition)
+      (sourceGet : sourceStore.get? location = some box)
+      (node : box.node = .papN address arity captured)
+      (sourceRetain : IxIR1.dupVals sourceStore captured.toList =
+        .ok sourceRetained)
+      (sourceRelease : IxIR1.dropVal sourceContext fuel sourceRetained
+        (.loc location) = .ok sourceReleased)
+      (totalOver : arity < (captured.toList ++ values).length)
+      (papArity : arity = sourceDefinition.arity)
+      (sourceDeclaration : sourceContext.decls address =
+        some (.fn sourceDefinition))
+      (sourcePapSafe : sourceDefinition.papSafe = true)
+      (targetDeclaration : context.declarations address =
+        some (.fn targetDefinition))
+      (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+        sourceReleased ((captured.toList ++ values).take arity).reverse
+          sourceDefinition.body = .ok (calledStore, calledValue))
+      (calleeResultWorld : IxIR1.Sim.HasWorld calledStore
+        sourceDefinition.result calledValue)
+      (calleeSmaller : calleeFuel < fuel + 1)
+      (residual : ApplyMorePlan attached sourceContext context fuel calledStore
+        calledValue ((captured.toList ++ values).drop arity) outputStore
+        outputValue) :
+      ApplyMorePlan attached sourceContext context (fuel + 1) sourceStore
+        (.loc location) values outputStore outputValue
+
+/-- Every residual plan describes a finite successful source application.
+The evaluator bound can exceed the plan's induction index: each stored callee
+and release is raised to a common bound when their runs are composed. -/
+theorem ApplyMorePlan.sourceRun
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {context : Eval.Context}
+    {planFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {function value : IxIR1.RVal} {arguments : List IxIR1.RVal}
+    (plan : ApplyMorePlan attached sourceContext context planFuel
+      sourceStore function arguments outputStore value) :
+    ∃ fuel, IxIR1.applyGo sourceContext fuel sourceStore function arguments =
+      .ok (outputStore, value) := by
+  induction plan with
+  | @erased fuel store released values sourceRelease =>
+      exact ⟨fuel + 1, by
+        simp [IxIR1.applyGo, sourceRelease, bind, Except.bind]⟩
+  | @papUnder fuel store retained released location box address arity captured
+      values sourceGet node sourceRetain sourceRelease totalUnder =>
+      refine ⟨fuel + 1, ?_⟩
+      simp only [IxIR1.applyGo, sourceGet, node, sourceRetain, sourceRelease,
+        totalUnder, if_true, bind, Except.bind]
+      have argumentsEq : (captured.toList ++ values).toArray =
+          captured ++ values.toArray := by
+        apply Array.toList_inj.mp
+        simp
+      rw [argumentsEq]
+  | papSaturatedFn _calleeMember _calleeMatch sourceGet node sourceRetain
+      sourceRelease totalExact papArity sourceDeclaration sourcePapSafe
+      _targetDeclaration calleeRun calleeResultWorld _calleeSmaller =>
+      have called := IxIR1.invoke_of_body_run sourceDeclaration
+        (totalExact.trans papArity) calleeRun calleeResultWorld
+      obtain ⟨fuel, run⟩ := IxIR1.applyGo_exact_of_invoke sourceGet node
+        sourceRetain sourceRelease totalExact sourceDeclaration sourcePapSafe
+        called
+      exact ⟨fuel + 1, run⟩
+  | papOverFn _calleeMember _calleeMatch sourceGet node sourceRetain
+      sourceRelease totalOver papArity sourceDeclaration sourcePapSafe
+      _targetDeclaration calleeRun calleeResultWorld _calleeSmaller
+      _residual ih =>
+      have called := IxIR1.invoke_of_body_run (run := calleeRun)
+        sourceDeclaration (by
+          simpa only [List.length_take,
+            Nat.min_eq_left (Nat.le_of_lt totalOver)] using papArity)
+        calleeResultWorld
+      obtain ⟨residualFuel, residualRun⟩ := ih
+      obtain ⟨fuel, run⟩ := IxIR1.applyGo_over_of_invoke sourceGet node
+        sourceRetain sourceRelease totalOver sourceDeclaration sourcePapSafe
+        called residualRun
+      exact ⟨fuel + 1, run⟩
+
+/-- Recover the two dynamic heap facts needed by a target PAP dispatch from
+the invariants available at any retained source trace position.  Keeping
+these facts out of `ApplyMorePlan` makes the plan a pure decomposition of
+`applyGo`; recursive return handlers re-establish them for their current
+heap. -/
+private theorem CompiledAttachment.livePapFacts
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {functionTrace : Lower.FunctionTrace} {trace : Lower.CodeTrace}
+    {store : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (member : functionTrace ∈ attached.target.artifact.trace.functions)
+    (descendant : functionTrace.root.Descendant trace)
+    (runtime : Lower.Sim.SourceRuntimeInvariant store source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions trace store source frameRoots)
+    {location : Nat} {box : IxIR1.NodeBox} {address : Ixon.Address}
+    {arity : Nat} {captured : Array IxIR1.RVal}
+    (sourceGet : store.get? location = some box)
+    (node : box.node = .papN address arity captured) :
+    box.world = .shared ∧ captured.size < arity := by
+  obtain ⟨position, positionMember, coordinate⟩ :=
+    attached.target.position member descendant
+  have exactOwnership := ownership position positionMember coordinate
+  refine ⟨exactOwnership.ownership.pap_shared sourceGet node, ?_⟩
+  cases box with
+  | mk world rc actualNode =>
+      simp only at node
+      subst actualNode
+      exact runtime.papsUnder.captured_lt sourceGet
+
+/-- A source declaration selected by the evaluator's first-match environment
+selects the correspondingly retained target declaration and function trace.
+The lookup-facing whole-program trace theorem handles duplicate raw keys in
+the same way as both evaluator contexts. -/
+theorem CompiledAttachment.functionTrace_of_source_declaration
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {context : Eval.Context}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {address : Ixon.Address} {sourceDefinition : IxIR1.FnDef}
+    (sourceDeclaration : sourceContext.decls address =
+      some (.fn sourceDefinition)) :
+    ∃ targetDefinition calleeTrace,
+      calleeTrace ∈ attached.target.artifact.trace.functions ∧
+        Lower.FunctionTraceMatch calleeTrace (.declaration address)
+          sourceDefinition targetDefinition ∧
+        context.declarations address = some (.fn targetDefinition) := by
+  have artifactLookup :
+      IxIR1.Env.ofList attached.target.artifact.source.declarations address =
+        some (.fn sourceDefinition) := by
+    rw [attached.targetSourceProduced]
+    rw [attached.sidecarDeclarationEnvironment]
+    rw [← sourceDeclarations]
+    exact sourceDeclaration
+  obtain ⟨targetDefinition, calleeTrace, targetLookup, calleeMember,
+      calleeMatch⟩ :=
+    attached.target.artifact.functionTrace_of_source_lookup artifactLookup
+  refine ⟨targetDefinition, calleeTrace, calleeMember, calleeMatch, ?_⟩
+  rw [targetDeclarations]
+  exact targetLookup
+
+/-- Inverse lookup-facing form of
+`CompiledAttachment.functionTrace_of_source_declaration`.  A concrete target function
+selected by the evaluator determines the exact source declaration and
+retained callee trace at the same address, including first-binding-wins
+behavior for repeated raw declaration keys. -/
+theorem CompiledAttachment.functionTrace_of_target_declaration
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {context : Eval.Context}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {address : Ixon.Address} {targetDefinition : Function}
+    (targetDeclaration : context.declarations address =
+      some (.fn targetDefinition)) :
+    ∃ sourceDefinition calleeTrace,
+      calleeTrace ∈ attached.target.artifact.trace.functions ∧
+        Lower.FunctionTraceMatch calleeTrace (.declaration address)
+          sourceDefinition targetDefinition ∧
+        sourceContext.decls address = some (.fn sourceDefinition) := by
+  have artifactLookup :
+      (attached.target.artifact.program.declarations.find? fun entry =>
+        entry.1 == address).map (·.2) = some (.fn targetDefinition) := by
+    simpa [Eval.Context.ofProgram] using
+      (congrFun targetDeclarations address).symm.trans targetDeclaration
+  obtain ⟨sourceDefinition, calleeTrace, sourceLookup, calleeMember,
+      calleeMatch⟩ :=
+    attached.target.artifact.functionTrace_of_target_lookup artifactLookup
+  refine ⟨sourceDefinition, calleeTrace, calleeMember, calleeMatch, ?_⟩
+  rw [sourceDeclarations]
+  rw [← attached.sidecarDeclarationEnvironment]
+  rw [← attached.targetSourceProduced]
+  exact sourceLookup
+
+/-- Certified pipeline source environments contain no executable extern
+declarations.  This is the contradiction used when successful `invoke`
+inversion exposes its scalar branch. -/
+theorem CompiledAttachment.sourceDeclaration_not_extern
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {address : Ixon.Address} {arity : Nat}
+    (sourceDeclaration : sourceContext.decls address =
+      some (.extern arity)) : False := by
+  apply attached.source.targetDeclEnv_ne_extern
+  change IxIR1.HPT.programDeclEnv
+      attached.source.lowering.result.artifacts address =
+    some (.extern arity)
+  rw [← sourceDeclarations]
+  exact sourceDeclaration
+
+/-- A successful target extern lookup is impossible for a certified pipeline
+attachment.  Declaration-order alignment reflects it to the source side,
+whose emitted environment is closed to extern declarations. -/
+theorem CompiledAttachment.targetDeclaration_not_extern
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {context : Eval.Context}
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {address : Ixon.Address} {arity : Nat}
+    (targetDeclaration : context.declarations address =
+      some (.extern arity)) : False := by
+  have artifactLookup :
+      (attached.target.artifact.program.declarations.find? fun entry =>
+        entry.1 == address).map (·.2) = some (.extern arity) := by
+    simpa [Eval.Context.ofProgram] using
+      (congrFun targetDeclarations address).symm.trans targetDeclaration
+  have sourceLookup :=
+    attached.target.artifact.sourceExtern_of_target_lookup artifactLookup
+  apply attached.source.targetDeclEnv_ne_extern
+  change IxIR1.HPT.programDeclEnv
+      attached.source.lowering.result.artifacts address =
+    some (.extern arity)
+  rw [← attached.sidecarDeclarationEnvironment]
+  rw [← attached.targetSourceProduced]
+  exact sourceLookup
+
+/-- Every successful source `applyGo` computation admits exactly the
+evaluator-aligned plan consumed by `applyMoreReturnHandler_of_plan`.  The
+recursive over-application case follows the evaluator's predecessor fuel;
+function invocation is inverted to expose the body run and result-world
+check, while certified source/target declaration lookup supplies the retained
+callee trace. -/
+theorem CompiledAttachment.applyMorePlan_of_applyGo
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {context : Eval.Context}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {applyFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {function outputValue : IxIR1.RVal} {values : List IxIR1.RVal}
+    (run : IxIR1.applyGo sourceContext applyFuel sourceStore function values =
+      .ok (outputStore, outputValue)) :
+    ApplyMorePlan attached sourceContext context applyFuel sourceStore function
+      values outputStore outputValue := by
+  induction applyFuel generalizing sourceStore function values outputStore
+      outputValue with
+  | zero =>
+      rw [IxIR1.applyGo.eq_def] at run
+      contradiction
+  | succ fuel ih =>
+      rw [IxIR1.applyGo.eq_def] at run
+      dsimp only at run
+      cases function with
+      | lit literal => simp at run
+      | erased =>
+          cases sourceRelease :
+              IxIR1.dropMany sourceContext fuel sourceStore values with
+          | error error =>
+              rw [sourceRelease] at run
+              simp only [bind, Except.bind] at run
+              contradiction
+          | ok sourceReleased =>
+              rw [sourceRelease] at run
+              simp only [bind, Except.bind] at run
+              have outputEq :
+                  (sourceReleased, IxIR1.RVal.erased) =
+                    (outputStore, outputValue) :=
+                Except.ok.inj run
+              cases outputEq
+              exact .erased sourceRelease
+      | loc location =>
+          cases sourceGet : sourceStore.get? location with
+          | none => simp [sourceGet] at run
+          | some box =>
+              simp only [sourceGet] at run
+              cases node : box.node with
+              | ctorN identity fields =>
+                  rw [node] at run
+                  contradiction
+              | papN address arity captured =>
+                  rw [node] at run
+                  dsimp only at run
+                  cases sourceRetain :
+                      IxIR1.dupVals sourceStore captured.toList with
+                  | error error =>
+                      rw [sourceRetain] at run
+                      simp only [bind, Except.bind] at run
+                      contradiction
+                  | ok sourceRetained =>
+                      rw [sourceRetain] at run
+                      simp only [bind, Except.bind] at run
+                      cases sourceRelease : IxIR1.dropVal sourceContext fuel
+                          sourceRetained (.loc location) with
+                      | error error =>
+                          rw [sourceRelease] at run
+                          contradiction
+                      | ok sourceReleased =>
+                          rw [sourceRelease] at run
+                          let total := captured.toList ++ values
+                          by_cases totalUnder : total.length < arity
+                          · have totalUnderRaw :
+                                (captured.toList ++ values).length < arity := by
+                              simpa [total] using totalUnder
+                            simp only [totalUnderRaw, if_true] at run
+                            have totalArrayEq :
+                                (captured.toList ++ values).toArray =
+                                  captured ++ values.toArray := by
+                              apply Array.toList_inj.mp
+                              simp
+                            rw [totalArrayEq] at run
+                            have outputEq :
+                                (outputStore, outputValue) =
+                                  ((sourceReleased.allocNode .shared
+                                    (.papN address arity
+                                      (captured ++ values.toArray))).1,
+                                    .loc (sourceReleased.allocNode .shared
+                                      (.papN address arity
+                                        (captured ++ values.toArray))).2) := by
+                              symm
+                              simpa using Except.ok.inj run
+                            cases outputEq
+                            exact .papUnder sourceGet node sourceRetain
+                              sourceRelease totalUnderRaw
+                          · have totalNotUnderRaw :
+                                ¬(captured.toList ++ values).length < arity := by
+                              simpa [total] using totalUnder
+                            simp only [totalNotUnderRaw, if_false] at run
+                            cases totalExactBool :
+                                (captured.toList ++ values).length == arity with
+                            | false =>
+                                simp only [totalExactBool, Bool.false_eq_true,
+                                  if_false] at run
+                                have totalNotExact : total.length ≠ arity := by
+                                  simpa [total] using totalExactBool
+                                have totalOver : arity < total.length := by
+                                  omega
+                                cases sourceDeclarationRaw :
+                                    sourceContext.decls address with
+                                | none => simp [sourceDeclarationRaw] at run
+                                | some declaration =>
+                                    cases sourcePapSafeRaw :
+                                        IxIR1.declPapSafe declaration with
+                                    | false =>
+                                        simp [sourceDeclarationRaw,
+                                          sourcePapSafeRaw] at run
+                                    | true =>
+                                        simp only [sourceDeclarationRaw,
+                                          sourcePapSafeRaw, if_true] at run
+                                        cases invocationRun : IxIR1.invoke
+                                            sourceContext fuel address
+                                            ((captured.toList ++ values).take
+                                              arity) sourceReleased with
+                                        | error error =>
+                                            rw [invocationRun] at run
+                                            contradiction
+                                        | ok called =>
+                                            rcases called with
+                                              ⟨calledStore, calledValue⟩
+                                            rw [invocationRun] at run
+                                            obtain ⟨calleeFuel, fuelEq,
+                                                invocation⟩ :=
+                                              IxIR1.invoke_success invocationRun
+                                            cases invocation with
+                                            | @fn sourceDefinition bodyOutput
+                                                sourceDeclaration argumentArity
+                                                calleeRun resultRun =>
+                                                have declarationEq : declaration =
+                                                    .fn sourceDefinition := by
+                                                  exact Option.some.inj
+                                                    (sourceDeclarationRaw.symm.trans
+                                                      sourceDeclaration)
+                                                subst declaration
+                                                have sourcePapSafe :
+                                                    sourceDefinition.papSafe =
+                                                      true := by
+                                                  simpa [IxIR1.declPapSafe] using
+                                                    sourcePapSafeRaw
+                                                obtain ⟨bodyOutputEq,
+                                                    calleeResultWorld⟩ :=
+                                                  IxIR1.Sim.checkResultWorld_ok
+                                                    resultRun
+                                                cases bodyOutputEq
+                                                obtain ⟨targetDefinition,
+                                                    calleeTrace, calleeMember,
+                                                    calleeMatch,
+                                                    targetDeclaration⟩ :=
+                                                  attached.functionTrace_of_source_declaration
+                                                    sourceDeclarations
+                                                    targetDeclarations
+                                                    sourceDeclaration
+                                                have suppliedLength :
+                                                    (total.take arity).length =
+                                                      arity := by
+                                                  simp [List.length_take,
+                                                    Nat.min_eq_left
+                                                      (Nat.le_of_lt totalOver)]
+                                                have papArity : arity =
+                                                    sourceDefinition.arity :=
+                                                  suppliedLength.symm.trans (by
+                                                    simpa [total] using
+                                                      argumentArity)
+                                                have residual := ih
+                                                  (sourceStore := calledStore)
+                                                  (function := calledValue)
+                                                  (values := total.drop arity)
+                                                  (outputStore := outputStore)
+                                                  (outputValue := outputValue)
+                                                  (by simpa [total] using run)
+                                                exact .papOverFn calleeMember
+                                                  calleeMatch sourceGet node
+                                                  sourceRetain sourceRelease
+                                                  (by simpa [total] using
+                                                    totalOver)
+                                                  papArity sourceDeclaration
+                                                  sourcePapSafe
+                                                  targetDeclaration
+                                                  (by simpa [total] using
+                                                    calleeRun)
+                                                  calleeResultWorld (by omega)
+                                                  (by simpa [total] using
+                                                    residual)
+                                            | @extern externArity externValue
+                                                sourceDeclaration _ _ _ =>
+                                                exact False.elim
+                                                  (attached.sourceDeclaration_not_extern
+                                                    sourceDeclarations
+                                                    sourceDeclaration)
+                            | true =>
+                                simp only [totalExactBool, if_true] at run
+                                have totalExact : total.length = arity := by
+                                  simpa [total] using totalExactBool
+                                cases sourceDeclarationRaw :
+                                    sourceContext.decls address with
+                                | none => simp [sourceDeclarationRaw] at run
+                                | some declaration =>
+                                    cases sourcePapSafeRaw :
+                                        IxIR1.declPapSafe declaration with
+                                    | false =>
+                                        simp [sourceDeclarationRaw,
+                                          sourcePapSafeRaw] at run
+                                    | true =>
+                                        simp only [sourceDeclarationRaw,
+                                          sourcePapSafeRaw, if_true] at run
+                                        obtain ⟨calleeFuel, fuelEq,
+                                            invocation⟩ :=
+                                          IxIR1.invoke_success run
+                                        cases invocation with
+                                        | @fn sourceDefinition bodyOutput
+                                            sourceDeclaration argumentArity
+                                            calleeRun resultRun =>
+                                            have declarationEq : declaration =
+                                                .fn sourceDefinition := by
+                                              exact Option.some.inj
+                                                (sourceDeclarationRaw.symm.trans
+                                                  sourceDeclaration)
+                                            subst declaration
+                                            have sourcePapSafe :
+                                                sourceDefinition.papSafe =
+                                                  true := by
+                                              simpa [IxIR1.declPapSafe] using
+                                                sourcePapSafeRaw
+                                            obtain ⟨bodyOutputEq,
+                                                calleeResultWorld⟩ :=
+                                              IxIR1.Sim.checkResultWorld_ok
+                                                resultRun
+                                            cases bodyOutputEq
+                                            obtain ⟨targetDefinition,
+                                                calleeTrace, calleeMember,
+                                                calleeMatch,
+                                                targetDeclaration⟩ :=
+                                              attached.functionTrace_of_source_declaration
+                                                sourceDeclarations
+                                                targetDeclarations
+                                                sourceDeclaration
+                                            have papArity : arity =
+                                                sourceDefinition.arity :=
+                                              totalExact.symm.trans (by
+                                                simpa [total] using
+                                                  argumentArity)
+                                            exact .papSaturatedFn calleeMember
+                                              calleeMatch sourceGet node
+                                              sourceRetain sourceRelease
+                                              (by simpa [total] using totalExact)
+                                              papArity sourceDeclaration
+                                              sourcePapSafe targetDeclaration
+                                              (by simpa [total] using calleeRun)
+                                              calleeResultWorld (by omega)
+                                        | @extern externArity externValue
+                                            sourceDeclaration _ _ _ =>
+                                            exact False.elim
+                                              (attached.sourceDeclaration_not_extern
+                                                sourceDeclarations
+                                                sourceDeclaration)
+
+/-- Complete CPS composition for the `pure`/`move` trace branch.  Source
+success is inverted once, the generated target instruction takes one genuine
+step, and the exact smaller-fuel worker continues from the retained child
+trace with the same return handler. -/
+theorem CompiledAttachment.simulate_traced_pure_move_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom}
+    {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.pure sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨value, nextFrame, nextFrameEq, sourceResolved, continuationRun,
+      _, nextStores, nextState⟩ :=
+    attached.simulate_traced_pure_move_success_step
+      (context := context) (interpretation := interpretation) functionMember
+      descendant state stores sourceDeclarations sourceRun control
+  subst nextFrame
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+      (value :: source) :=
+    ⟨runtime.order,
+      IxIR1.Reclamation.ValuesInBounds.cons
+        (runtime.resolveAtom sourceResolved) runtime.rootsInBounds,
+      runtime.papsUnder⟩
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceStore
+        (value :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.pure (checked := attached.target)
+      functionMember descendant ownership sourceResolved
+  let nextFrame : Eval.Frame :=
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push value }
+  let nextMachine : Eval.Machine :=
+    { machine with control := .running nextFrame stack }
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState nextStores nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits image
+      finish
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_pure_move_state
+      (sourceFuel := sourceFuel) (machine := fundedMachine) functionMember
+      descendant state fundedStores sourceDeclarations sourceResolved
+      fundedControl
+  refine ⟨tailHeapFuel, ?_⟩
+  simpa [fundedMachine, nextMachine, nextFrame] using
+    tail.prepend (fundedStep.toSteps fundedControl)
+
+/-- Complete CPS composition for shared duplication.  Both inert scalars and
+live shared locations take one heap-fuel-preserving target step. -/
+theorem CompiledAttachment.simulate_traced_dup_retain_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom}
+    {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.dup sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  obtain ⟨value, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_dup_success operationRun
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have scalarCase (selected : IxIR1.RVal)
+      (selectedResolved :
+        IxIR1.resolveAtom source sourceAtom = .ok selected)
+      (scalar : Eval.RVal.isScalar selected = true)
+      (outputEq : (middleStore, operationValue) =
+        (sourceStore, selected)) :
+      BudgetedReachesPost context interpretation post outcome.1 outcome.2
+        machine := by
+    have middleStoreEq : middleStore = sourceStore :=
+      congrArg Prod.fst outputEq
+    have operationValueEq : operationValue = selected :=
+      congrArg Prod.snd outputEq
+    subst middleStore
+    subst operationValue
+    obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+      attached.simulate_traced_dup_retain_scalar_state
+        (sourceFuel := sourceFuel) (context := context)
+        (interpretation := interpretation) functionMember descendant state
+        stores sourceDeclarations selectedResolved scalar control
+    have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+        (selected :: source) :=
+      runtime.runOp rfl operationRun
+    have nextOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions next sourceStore
+          (selected :: source) frameRoots :=
+      Lower.Sim.SourceOwnershipAt.dup (checked := attached.target)
+        functionMember descendant ownership selectedResolved operationRun
+    let nextFrame : Eval.Frame :=
+      { frame with
+        pc := frame.pc + 1
+        values := frame.values.push selected }
+    let nextMachine : Eval.Machine :=
+      { machine with control := .running nextFrame stack }
+    have nextControl : nextMachine.control =
+        .running nextFrame stack := rfl
+    have nextNoCredits : nextFrame.credits = #[] := by
+      simpa [nextFrame] using noCredits
+    have tail := worker (machine := nextMachine) (stack := stack)
+      functionMember nextDescendant nextState nextStores nextRuntime
+        nextOwnership continuationRun resultWorld nextControl nextNoCredits
+        middleImage finish
+    refine BudgetedReachesPost.prependPreserving
+      (before := machine) (middle := nextMachine) (prefixCount := 1) ?_ tail
+    intro heapFuel
+    let fundedMachine : Eval.Machine := { machine with heapFuel }
+    have fundedStores :
+        Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+      simpa [fundedMachine] using stores
+    have fundedControl : fundedMachine.control = .running frame stack := by
+      simpa [fundedMachine] using control
+    obtain ⟨_, fundedStep, _, _⟩ :=
+      attached.simulate_traced_dup_retain_scalar_state
+        (sourceFuel := sourceFuel) (context := context)
+        (interpretation := interpretation) (machine := fundedMachine)
+        functionMember descendant state fundedStores sourceDeclarations
+        selectedResolved scalar fundedControl
+    simpa [fundedMachine, nextMachine, nextFrame] using
+      fundedStep.toSteps fundedControl
+  cases value with
+  | lit literal =>
+      exact scalarCase (.lit literal) sourceResolved (by rfl) operationOutput
+  | erased =>
+      exact scalarCase .erased sourceResolved (by rfl) operationOutput
+  | loc location =>
+      obtain ⟨box, sourceGet, shared, outputEq⟩ := operationOutput
+      let nextBox : IxIR1.NodeBox := { box with rc := box.rc + 1 }
+      let sourceStore' : IxIR1.Store :=
+        (sourceStore.setBox location nextBox).rcTick
+      let targetStore' : Eval.Store :=
+        (machine.store.setBox location nextBox).rcTick
+      have middleStoreEq : middleStore = sourceStore' := by
+        simpa [sourceStore', nextBox] using congrArg Prod.fst outputEq
+      have operationValueEq : operationValue = .loc location :=
+        congrArg Prod.snd outputEq
+      subst middleStore
+      subst operationValue
+      obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+        attached.simulate_traced_dup_retain_shared_state
+          (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) functionMember descendant state
+          stores sourceDeclarations sourceResolved sourceGet shared control
+      have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore'
+          (.loc location :: source) := by
+        apply runtime.runOp
+          (run := operationRun)
+        simp [sourceStore', nextBox, IxIR1.Store.setBox, IxIR1.Store.rcTick]
+      have nextOwnership : Lower.Sim.SourceOwnershipAt
+          attached.target.artifact.trace.positions next sourceStore'
+            (.loc location :: source) frameRoots :=
+        Lower.Sim.SourceOwnershipAt.dup (checked := attached.target)
+          functionMember descendant ownership sourceResolved operationRun
+      let nextFrame : Eval.Frame :=
+        { frame with
+          pc := frame.pc + 1
+          values := frame.values.push (.loc location) }
+      let nextMachine : Eval.Machine :=
+        { machine with
+          store := targetStore'
+          control := .running nextFrame stack }
+      have nextControl : nextMachine.control =
+          .running nextFrame stack := rfl
+      have nextNoCredits : nextFrame.credits = #[] := by
+        simpa [nextFrame] using noCredits
+      have nextStores' :
+          Lower.Sim.StoreRel sourceStore' nextMachine.store := by
+        simpa [nextMachine, targetStore', sourceStore', nextBox] using nextStores
+      have tail := worker (machine := nextMachine) (stack := stack)
+        functionMember nextDescendant nextState nextStores' nextRuntime
+          nextOwnership continuationRun resultWorld nextControl nextNoCredits
+          middleImage finish
+      refine BudgetedReachesPost.prependPreserving
+        (before := machine) (middle := nextMachine) (prefixCount := 1) ?_ tail
+      intro heapFuel
+      let fundedMachine : Eval.Machine := { machine with heapFuel }
+      have fundedStores :
+          Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+        simpa [fundedMachine] using stores
+      have fundedControl : fundedMachine.control = .running frame stack := by
+        simpa [fundedMachine] using control
+      obtain ⟨_, fundedStep, _, _⟩ :=
+        attached.simulate_traced_dup_retain_shared_state
+          (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) (machine := fundedMachine)
+          functionMember descendant state fundedStores sourceDeclarations
+          sourceResolved sourceGet shared fundedControl
+      simpa [fundedMachine, nextMachine, nextFrame, targetStore', nextBox] using
+        fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for an HPT-certified constructor projection. -/
+theorem CompiledAttachment.simulate_traced_fetch_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom}
+    {targetAtom : Atom} {sourceField targetField : Nat}
+    {targetCid : IxIR1.CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.fetch sourceAtom sourceField) next.sourceCode) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  obtain ⟨location, box, identity, fields, value, sourceResolved, sourceGet,
+      node, fieldAt, outputEq⟩ :=
+    IxIR1.runOp_fetch_success operationRun
+  have middleStoreEq : middleStore = sourceStore :=
+    congrArg Prod.fst outputEq
+  have operationValueEq : operationValue = value :=
+    congrArg Prod.snd outputEq
+  subst middleStore
+  subst operationValue
+  obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+    attached.simulate_traced_fetch_state_of_run_hpt
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) functionMember descendant state stores
+      sourceDeclarations operationRun control
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+      (value :: source) :=
+    runtime.runOp rfl operationRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceStore
+        (value :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.fetch (checked := attached.target)
+      functionMember descendant ownership operationRun
+  let nextFrame : Eval.Frame :=
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push value }
+  let nextMachine : Eval.Machine :=
+    { machine with control := .running nextFrame stack }
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState nextStores nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits
+      middleImage finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := nextMachine) (prefixCount := 1) ?_ tail
+  intro heapFuel
+  let fundedMachine : Eval.Machine := { machine with heapFuel }
+  have fundedStores :
+      Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_fetch_state_of_run_hpt
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) (machine := fundedMachine)
+      functionMember descendant state fundedStores sourceDeclarations
+      operationRun fundedControl
+  simpa [fundedMachine, nextMachine, nextFrame] using
+    fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for an HPT-certified scalar-leaf shallow free. -/
+theorem CompiledAttachment.simulate_traced_free_freeUnique_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom}
+    {targetAtom : Atom} {targetCid : IxIR1.CtorId}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.free sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  obtain ⟨location, box, sourceResolved, sourceGet, unique, outputEq⟩ :=
+    IxIR1.runOp_free_success operationRun
+  have middleStoreEq : middleStore = sourceStore.kill location :=
+    congrArg Prod.fst outputEq
+  have operationValueEq : operationValue = .erased :=
+    congrArg Prod.snd outputEq
+  subst middleStore
+  subst operationValue
+  obtain ⟨fact, selected⟩ :=
+    attached.scalarLeafAt?_of_free_descendant functionMember descendant
+  obtain ⟨exactBox, fields, exactGet, node, scalarFields⟩ :=
+    attached.sidecars.scalarLeafAt?_runtime selected state.environment
+      sourceResolved
+  have boxEq : exactBox = box :=
+    Option.some.inj (exactGet.symm.trans sourceGet)
+  subst exactBox
+  obtain ⟨_, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_free_freeUnique_state
+      (sourceContext := sourceContext) (sourceCurrent := functionTrace.source)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) descendant state.target stores
+      sourceResolved sourceGet unique node scalarFields control
+  have nextState := attached.traceState_next_of_member functionMember state
+    descendant sourceDeclarations operationRun nextTarget
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant
+      (sourceStore.kill location) (.erased :: source) := by
+    apply runtime.runOp
+      (run := operationRun)
+    simp [IxIR1.Store.kill]
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next
+        (sourceStore.kill location) (.erased :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.free (checked := attached.target)
+      functionMember descendant ownership sourceResolved sourceGet unique node
+        scalarFields operationRun
+  let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+  let nextMachine : Eval.Machine :=
+    { machine with
+      store := machine.store.kill location
+      control := .running nextFrame stack }
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have nextStores' : Lower.Sim.StoreRel (sourceStore.kill location)
+      nextMachine.store := by
+    simpa [nextMachine] using nextStores
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState nextStores' nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits
+      middleImage finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := nextMachine) (prefixCount := 1) ?_ tail
+  intro heapFuel
+  let fundedMachine : Eval.Machine := { machine with heapFuel }
+  have fundedStores :
+      Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    Lower.Sim.simulate_traced_free_freeUnique_state
+      (sourceContext := sourceContext) (sourceCurrent := functionTrace.source)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) (machine := fundedMachine)
+      descendant state.target fundedStores sourceResolved sourceGet unique node
+      scalarFields fundedControl
+  simpa [fundedMachine, nextMachine, nextFrame] using
+    fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for shared destruction.  Scalar releases reserve
+one heap unit ahead of the continuation; recursive location releases use the
+framed work-list plan to reserve exactly their local traversal cost plus the
+continuation's independently selected budget. -/
+theorem CompiledAttachment.simulate_traced_drop_release_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom}
+    {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.drop sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  obtain ⟨value, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_drop_success operationRun
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have scalarCase (selected : IxIR1.RVal)
+      (selectedResolved :
+        IxIR1.resolveAtom source sourceAtom = .ok selected)
+      (scalar : Eval.RVal.isScalar selected = true)
+      (outputEq : (middleStore, operationValue) =
+        (sourceStore, .erased)) :
+      BudgetedReachesPost context interpretation post outcome.1 outcome.2
+        machine := by
+    have middleStoreEq : middleStore = sourceStore :=
+      congrArg Prod.fst outputEq
+    have operationValueEq : operationValue = .erased :=
+      congrArg Prod.snd outputEq
+    subst middleStore
+    subst operationValue
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    let probeMachine : Eval.Machine := { machine with heapFuel := 1 }
+    have probeStores : Lower.Sim.StoreRel sourceStore probeMachine.store := by
+      simpa [probeMachine] using stores
+    have probeControl : probeMachine.control = .running frame stack := by
+      simpa [probeMachine] using control
+    obtain ⟨_, _, nextStores, nextState⟩ :=
+      attached.simulate_traced_drop_release_scalar_state
+        (sourceFuel := sourceFuel) (targetHeapFuel := 0)
+        (context := context) (interpretation := interpretation)
+        (machine := probeMachine) functionMember descendant state probeStores
+        sourceDeclarations selectedResolved scalar
+        (heapFuel := by simp [probeMachine]) probeControl
+    let nextMachine : Eval.Machine :=
+      { machine with control := .running nextFrame stack }
+    have nextStores' :
+        Lower.Sim.StoreRel sourceStore nextMachine.store := by
+      simpa [nextMachine, probeMachine] using nextStores
+    have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+        (.erased :: source) :=
+      runtime.runOp rfl operationRun
+    have nextOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions next sourceStore
+          (.erased :: source) frameRoots :=
+      Lower.Sim.SourceOwnershipAt.drop (checked := attached.target)
+        functionMember descendant ownership operationRun
+    have nextControl : nextMachine.control =
+        .running nextFrame stack := rfl
+    have nextNoCredits : nextFrame.credits = #[] := by
+      simpa [nextFrame] using noCredits
+    have tail := worker (machine := nextMachine) (stack := stack)
+      functionMember nextDescendant nextState nextStores' nextRuntime
+        nextOwnership continuationRun resultWorld nextControl nextNoCredits
+        middleImage finish
+    obtain ⟨tailHeapFuel, tail⟩ := tail
+    let fundedMachine : Eval.Machine :=
+      { machine with heapFuel := tailHeapFuel + 1 }
+    have fundedStores :
+        Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+      simpa [fundedMachine] using stores
+    have fundedControl : fundedMachine.control = .running frame stack := by
+      simpa [fundedMachine] using control
+    obtain ⟨_, fundedStep, _, _⟩ :=
+      attached.simulate_traced_drop_release_scalar_state
+        (sourceFuel := sourceFuel) (targetHeapFuel := tailHeapFuel)
+        (context := context) (interpretation := interpretation)
+        (machine := fundedMachine) functionMember descendant state
+        fundedStores sourceDeclarations selectedResolved scalar
+        (heapFuel := by simp [fundedMachine]) fundedControl
+    refine ⟨tailHeapFuel + 1, ?_⟩
+    simpa [fundedMachine, nextMachine, nextFrame] using
+      tail.prepend (fundedStep.toSteps fundedControl)
+  cases value with
+  | lit literal =>
+      exact scalarCase (.lit literal) sourceResolved (by rfl) operationOutput
+  | erased =>
+      exact scalarCase .erased sourceResolved (by rfl) operationOutput
+  | loc location =>
+      obtain ⟨sourceStore', sourceDropped, outputEq⟩ := operationOutput
+      have middleStoreEq : middleStore = sourceStore' :=
+        congrArg Prod.fst outputEq
+      have operationValueEq : operationValue = .erased :=
+        congrArg Prod.snd outputEq
+      subst middleStore
+      subst operationValue
+      have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore'
+          (.erased :: source) :=
+        runtime.runOp (IxIR1.NoReuse.dropVal_reuses sourceDropped)
+          operationRun
+      have nextOwnership : Lower.Sim.SourceOwnershipAt
+          attached.target.artifact.trace.positions next sourceStore'
+            (.erased :: source) frameRoots :=
+        Lower.Sim.SourceOwnershipAt.drop (checked := attached.target)
+          functionMember descendant ownership operationRun
+      obtain ⟨localFuel, targetStore, _, _, stepForSuffix, nextStores,
+          _, nextState⟩ :=
+        attached.simulate_traced_drop_release_recursive_state_framed
+          (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) functionMember descendant state
+          runtime.positiveSharedRC stores sourceDeclarations sourceResolved
+          sourceDropped control
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      let nextMachine : Eval.Machine :=
+        { store := targetStore
+          heapFuel := 0
+          control := .running nextFrame stack }
+      have nextControl : nextMachine.control =
+          .running nextFrame stack := rfl
+      have nextNoCredits : nextFrame.credits = #[] := by
+        simpa [nextFrame] using noCredits
+      have tail := worker (machine := nextMachine) (stack := stack)
+        functionMember nextDescendant nextState nextStores nextRuntime
+          nextOwnership continuationRun resultWorld nextControl nextNoCredits
+          middleImage finish
+      obtain ⟨tailHeapFuel, tail⟩ := tail
+      have prefixControl :
+          ({ machine with heapFuel := localFuel + tailHeapFuel } :
+            Eval.Machine).control = .running frame stack := by
+        simpa using control
+      refine ⟨localFuel + tailHeapFuel, ?_⟩
+      simpa [nextMachine, nextFrame] using
+        tail.prepend ((stepForSuffix tailHeapFuel).toSteps prefixControl)
+
+/-- Complete CPS composition for unique destruction, with the same backward
+heap-budget discipline as shared release. -/
+theorem CompiledAttachment.simulate_traced_dropU_dropUnique_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom}
+    {targetAtom : Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.dropU sourceAtom) next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  obtain ⟨value, sourceResolved, operationOutput⟩ :=
+    IxIR1.runOp_dropU_success operationRun
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have scalarCase (selected : IxIR1.RVal)
+      (selectedResolved :
+        IxIR1.resolveAtom source sourceAtom = .ok selected)
+      (scalar : Eval.RVal.isScalar selected = true)
+      (outputEq : (middleStore, operationValue) =
+        (sourceStore, .erased)) :
+      BudgetedReachesPost context interpretation post outcome.1 outcome.2
+        machine := by
+    have middleStoreEq : middleStore = sourceStore :=
+      congrArg Prod.fst outputEq
+    have operationValueEq : operationValue = .erased :=
+      congrArg Prod.snd outputEq
+    subst middleStore
+    subst operationValue
+    let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+    let probeMachine : Eval.Machine := { machine with heapFuel := 1 }
+    have probeStores : Lower.Sim.StoreRel sourceStore probeMachine.store := by
+      simpa [probeMachine] using stores
+    have probeControl : probeMachine.control = .running frame stack := by
+      simpa [probeMachine] using control
+    obtain ⟨_, _, nextStores, nextState⟩ :=
+      attached.simulate_traced_dropU_dropUnique_scalar_state
+        (sourceFuel := sourceFuel) (targetHeapFuel := 0)
+        (context := context) (interpretation := interpretation)
+        (machine := probeMachine) functionMember descendant state probeStores
+        sourceDeclarations selectedResolved scalar
+        (heapFuel := by simp [probeMachine]) probeControl
+    let nextMachine : Eval.Machine :=
+      { machine with control := .running nextFrame stack }
+    have nextStores' :
+        Lower.Sim.StoreRel sourceStore nextMachine.store := by
+      simpa [nextMachine, probeMachine] using nextStores
+    have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+        (.erased :: source) :=
+      runtime.runOp rfl operationRun
+    have nextOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions next sourceStore
+          (.erased :: source) frameRoots :=
+      Lower.Sim.SourceOwnershipAt.dropU (checked := attached.target)
+        functionMember descendant ownership operationRun
+    have nextControl : nextMachine.control =
+        .running nextFrame stack := rfl
+    have nextNoCredits : nextFrame.credits = #[] := by
+      simpa [nextFrame] using noCredits
+    have tail := worker (machine := nextMachine) (stack := stack)
+      functionMember nextDescendant nextState nextStores' nextRuntime
+        nextOwnership continuationRun resultWorld nextControl nextNoCredits
+        middleImage finish
+    obtain ⟨tailHeapFuel, tail⟩ := tail
+    let fundedMachine : Eval.Machine :=
+      { machine with heapFuel := tailHeapFuel + 1 }
+    have fundedStores :
+        Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+      simpa [fundedMachine] using stores
+    have fundedControl : fundedMachine.control = .running frame stack := by
+      simpa [fundedMachine] using control
+    obtain ⟨_, fundedStep, _, _⟩ :=
+      attached.simulate_traced_dropU_dropUnique_scalar_state
+        (sourceFuel := sourceFuel) (targetHeapFuel := tailHeapFuel)
+        (context := context) (interpretation := interpretation)
+        (machine := fundedMachine) functionMember descendant state
+        fundedStores sourceDeclarations selectedResolved scalar
+        (heapFuel := by simp [fundedMachine]) fundedControl
+    refine ⟨tailHeapFuel + 1, ?_⟩
+    simpa [fundedMachine, nextMachine, nextFrame] using
+      tail.prepend (fundedStep.toSteps fundedControl)
+  cases value with
+  | lit literal =>
+      exact scalarCase (.lit literal) sourceResolved (by rfl) operationOutput
+  | erased =>
+      exact scalarCase .erased sourceResolved (by rfl) operationOutput
+  | loc location =>
+      obtain ⟨sourceStore', sourceDropped, outputEq⟩ := operationOutput
+      have middleStoreEq : middleStore = sourceStore' :=
+        congrArg Prod.fst outputEq
+      have operationValueEq : operationValue = .erased :=
+        congrArg Prod.snd outputEq
+      subst middleStore
+      subst operationValue
+      have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore'
+          (.erased :: source) :=
+        runtime.runOp (IxIR1.NoReuse.dropUVal_reuses sourceDropped)
+          operationRun
+      have nextOwnership : Lower.Sim.SourceOwnershipAt
+          attached.target.artifact.trace.positions next sourceStore'
+            (.erased :: source) frameRoots :=
+        Lower.Sim.SourceOwnershipAt.dropU (checked := attached.target)
+          functionMember descendant ownership operationRun
+      obtain ⟨localFuel, targetStore, _, _exactDrop, stepForSuffix, nextStores,
+          nextState⟩ :=
+        attached.simulate_traced_dropU_dropUnique_recursive_state_framed
+          (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) functionMember descendant state
+          stores sourceDeclarations sourceResolved sourceDropped control
+      let nextFrame : Eval.Frame := { frame with pc := frame.pc + 1 }
+      let nextMachine : Eval.Machine :=
+        { store := targetStore
+          heapFuel := 0
+          control := .running nextFrame stack }
+      have nextControl : nextMachine.control =
+          .running nextFrame stack := rfl
+      have nextNoCredits : nextFrame.credits = #[] := by
+        simpa [nextFrame] using noCredits
+      have tail := worker (machine := nextMachine) (stack := stack)
+        functionMember nextDescendant nextState nextStores nextRuntime
+          nextOwnership continuationRun resultWorld nextControl nextNoCredits
+          middleImage finish
+      obtain ⟨tailHeapFuel, tail⟩ := tail
+      have prefixControl :
+          ({ machine with heapFuel := localFuel + tailHeapFuel } :
+            Eval.Machine).control = .running frame stack := by
+        simpa using control
+      refine ⟨localFuel + tailHeapFuel, ?_⟩
+      simpa [nextMachine, nextFrame] using
+        tail.prepend ((stepForSuffix tailHeapFuel).toSteps prefixControl)
+
+/-- CPS composition for checked ordinary allocation.  The checked trace
+recovers the exact uniform schema and producer capabilities; the trace-indexed
+source ownership invariant justifies the target field worlds.  Allocation then
+preserves the continuation's chosen heap budget. -/
+theorem CompiledAttachment.simulate_traced_alloc_checked_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceWorld targetWorld : Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.alloc sourceWorld sourceCid sourceArguments)
+          next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      .logical functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      .logical (sourceFuel + 1)) :
+    BudgetedReachesPost context .logical post outcome.1 outcome.2
+      machine := by
+  obtain ⟨schema, checkedSchemaAt, _⟩ :=
+    attached.target.allocationSchema functionMember descendant
+  have schemaAt : context.schemas sourceWorld sourceCid = some schema := by
+    rw [contextSchemas]
+    exact checkedSchemaAt
+  obtain ⟨values, sourceAllocation, targetAllocation, nextFrame,
+      sourceAllocationEq, targetAllocationEq, sourceResolved,
+      continuationRun, nextFrameEq, targetStep, nextStores, nextState⟩ :=
+    attached.simulate_traced_alloc_checked_success_step
+      (context := context) (machine := machine) functionMember contextSchemas
+      descendant state stores sourceDeclarations sourceRun control schemaAt
+      ownership
+  subst sourceAllocation
+  subst targetAllocation
+  subst nextFrame
+  let node : IxIR1.Node := .ctorN sourceCid values.toArray
+  let sourceAllocation := sourceStore.allocNode sourceWorld node
+  let targetAllocation := machine.store.allocNode sourceWorld node
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      functionTrace.source sourceStore source
+        (.alloc sourceWorld sourceCid sourceArguments) =
+        .ok (sourceAllocation.1, .loc sourceAllocation.2) := by
+    unfold IxIR1.runOp
+    simp only
+    rw [sourceResolved]
+    rfl
+  have nextImage : attached.SourceStoreImage sourceAllocation.1 :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceAllocation.1
+      (.loc sourceAllocation.2 :: source) := by
+    apply runtime.runOp (run := operationRun)
+    simp [sourceAllocation, node, IxIR1.Store.allocNode]
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceAllocation.1
+        (.loc sourceAllocation.2 :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.alloc (checked := attached.target)
+      functionMember descendant ownership operationRun
+  let nextFrame : Eval.Frame :=
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push (.loc sourceAllocation.2) }
+  let nextMachine : Eval.Machine :=
+    { machine with
+      store := targetAllocation.1
+      control := .running nextFrame stack }
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have nextStores' : Lower.Sim.StoreRel sourceAllocation.1
+      nextMachine.store := by
+    simpa [nextMachine, targetAllocation, sourceAllocation, node] using
+      nextStores
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState nextStores' nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits
+      nextImage finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := nextMachine) (prefixCount := 1) ?_ tail
+  intro heapFuel
+  let fundedMachine : Eval.Machine := { machine with heapFuel }
+  have fundedStores :
+      Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_alloc_checked_state
+      (sourceFuel := sourceFuel) (context := context)
+      (machine := fundedMachine) functionMember contextSchemas descendant
+      state fundedStores sourceDeclarations sourceResolved fundedControl
+      schemaAt ownership
+  simpa [fundedMachine, nextMachine, nextFrame, targetAllocation,
+    sourceAllocation, node] using fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for strictly under-saturated function PAP
+allocation.  Source success fixes the captured vector and fresh node; the
+generated target allocation preserves the continuation's chosen heap budget. -/
+theorem CompiledAttachment.simulate_traced_papp_fn_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceDeclaration : sourceContext.decls sourceAddress =
+      some (.fn sourceDefinition))
+    (targetDeclaration : context.declarations sourceAddress =
+      some (.fn targetDefinition))
+    (arity : targetDefinition.signature.params.size = sourceDefinition.arity)
+    (papSafe : targetDefinition.signature.papSafe = true)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.papp sourceAddress sourceArguments) next.sourceCode) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 1)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun
+  obtain ⟨values, declaration, sourceResolved, declarationAt, under,
+      operationOutput⟩ := IxIR1.runOp_papp_success operationRun
+  have declarationEq : declaration = .fn sourceDefinition := by
+    exact Option.some.inj (declarationAt.symm.trans sourceDeclaration)
+  subst declaration
+  have under' : values.length < sourceDefinition.arity := by
+    simpa [IxIR1.declArity] using under
+  let node : IxIR1.Node :=
+    .papN sourceAddress sourceDefinition.arity values.toArray
+  let sourceAllocation := sourceStore.allocNode .shared node
+  let targetAllocation := machine.store.allocNode .shared node
+  have middleStoreEq : middleStore = sourceAllocation.1 := by
+    simpa [sourceAllocation, node, IxIR1.declArity] using
+      congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue = .loc sourceAllocation.2 := by
+    simpa [sourceAllocation, node, IxIR1.declArity] using
+      congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  obtain ⟨_, targetStep, nextStores, nextState⟩ :=
+    attached.simulate_traced_papp_fn_state
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) functionMember descendant state
+      stores sourceDeclarations sourceResolved sourceDeclaration
+      targetDeclaration arity papSafe under' noCredits control
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceAllocation.1
+      (.loc sourceAllocation.2 :: source) := by
+    apply runtime.runOp (run := operationRun)
+    simp [sourceAllocation, node, IxIR1.Store.allocNode]
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceAllocation.1
+        (.loc sourceAllocation.2 :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.papp (checked := attached.target)
+      functionMember descendant ownership operationRun
+  let nextFrame : Eval.Frame :=
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push (.loc sourceAllocation.2) }
+  let nextMachine : Eval.Machine :=
+    { machine with
+      store := targetAllocation.1
+      control := .running nextFrame stack }
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have nextStores' : Lower.Sim.StoreRel sourceAllocation.1
+      nextMachine.store := by
+    simpa [nextMachine, targetAllocation, sourceAllocation, node] using
+      nextStores
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState nextStores' nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits
+      middleImage finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := nextMachine) (prefixCount := 1) ?_ tail
+  intro heapFuel
+  let fundedMachine : Eval.Machine := { machine with heapFuel }
+  have fundedStores :
+      Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_papp_fn_state
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) (machine := fundedMachine)
+      functionMember descendant state fundedStores sourceDeclarations
+      sourceResolved sourceDeclaration targetDeclaration arity papSafe under'
+      noCredits fundedControl
+  simpa [fundedMachine, nextMachine, nextFrame, targetAllocation,
+    sourceAllocation, node] using fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for the erased dynamic-application branch.
+Residual shared arguments are released with an exact locally framed heap
+budget, after which the smaller-fuel caller worker runs on the erased result.
+-/
+theorem CompiledAttachment.simulate_traced_apply_erased_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceStore sourceReleased : IxIR1.Store}
+    {source values : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok .erased)
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceRelease : IxIR1.dropMany sourceContext sourceFuel sourceStore
+      values = .ok sourceReleased)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 3)
+      functionTrace.source sourceStore source
+        (.letOp (.apply sourceFunction sourceArguments) next.sourceCode) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 2)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have sourceOperation : IxIR1.runOp sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.apply sourceFunction sourceArguments) =
+          .ok (sourceReleased, .erased) := by
+    rw [IxIR1.runOp.eq_def]
+    dsimp only
+    rw [functionResolved]
+    simp only [bind, Except.bind]
+    rw [argumentsResolved]
+    simp only
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceRelease]
+    rfl
+  have nextImage : attached.SourceStoreImage sourceReleased :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image sourceOperation
+  have operationOutput : (middleStore, operationValue) =
+      (sourceReleased, .erased) :=
+    Except.ok.inj (operationRun.symm.trans sourceOperation)
+  have middleStoreEq : middleStore = sourceReleased :=
+    congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue = .erased :=
+    congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  obtain ⟨targetHeapFuel, targetReleased, targetRelease, nextStores,
+      _⟩ :=
+    Lower.Sim.dropMany_simulates_releaseSharedWork
+      runtime.positiveSharedRC stores sourceRelease
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      (.erased :: source) :=
+    runtime.runOp (IxIR1.NoReuse.dropMany_reuses sourceRelease)
+      sourceOperation
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceReleased
+        (.erased :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      functionMember descendant ownership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          sourceDeclarations image) sourceOperation
+  let nextFrame : Eval.Frame :=
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push .erased }
+  let nextMachine : Eval.Machine :=
+    { store := targetReleased
+      heapFuel := 0
+      control := .running nextFrame stack }
+  let exactMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel }
+  have exactControl : exactMachine.control = .running frame stack := by
+    simpa [exactMachine] using control
+  have exactTransfer : Eval.ApplyTransfer context interpretation
+      exactMachine.store exactMachine.heapFuel .erased values.toArray
+      { frame with pc := frame.pc + 1 } stack nextMachine := by
+    simpa [exactMachine, nextMachine, nextFrame] using
+      (Eval.ApplyTransfer.erased
+        (context := context) (interpretation := interpretation)
+        (resume := { frame with pc := frame.pc + 1 }) (stack := stack)
+        (by simpa using targetRelease))
+  obtain ⟨_, nextState⟩ :=
+    attached.simulate_traced_apply_transfer_state
+      (machine := exactMachine) (target := nextMachine) functionMember
+      descendant state sourceDeclarations functionResolved argumentsResolved
+      sourceOperation noCredits exactControl exactTransfer
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState nextStores nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits
+      nextImage finish
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := nextMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedNext : Eval.Machine :=
+    { nextMachine with heapFuel := suffixFuel }
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have fundedTransfer : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel .erased values.toArray
+      { frame with pc := frame.pc + 1 } stack fundedNext := by
+    simpa [fundedMachine, fundedNext, nextMachine, nextFrame] using
+      (Eval.ApplyTransfer.erased
+        (context := context) (interpretation := interpretation)
+        (resume := { frame with pc := frame.pc + 1 }) (stack := stack)
+        (by simpa using fundedRelease))
+  obtain ⟨fundedStep, _⟩ :=
+    attached.simulate_traced_apply_transfer_state
+      (machine := fundedMachine) (target := fundedNext) functionMember
+      descendant state sourceDeclarations functionResolved argumentsResolved
+      sourceOperation noCredits fundedControl fundedTransfer
+  simpa [fundedMachine, fundedNext] using
+    fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for under-saturated dynamic PAP application.
+Captured values are retained, the old PAP is released, and the extended PAP
+is allocated before the smaller-fuel caller worker resumes. -/
+theorem CompiledAttachment.simulate_traced_apply_pap_under_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity)
+    (sourceRun : IxIR1.runCode sourceContext (sourceFuel + 3)
+      functionTrace.source sourceStore source
+        (.letOp (.apply sourceFunction sourceArguments) next.sourceCode) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation (sourceFuel + 2)) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  let pap : IxIR1.Node :=
+    .papN address arity (captured ++ values.toArray)
+  let sourceAllocation := sourceReleased.allocNode .shared pap
+  let targetPap : IxIR1.Node :=
+    .papN address arity (captured ++ values.toArray)
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      retainedStores, targetRelease, releasedStores, sourceOperation, _,
+      nextStores, nextState⟩ :=
+    attached.simulate_traced_apply_pap_under_state
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) functionMember descendant state
+      stores runtime.positiveSharedRC sourceDeclarations functionResolved
+      argumentsResolved sourceGet shared node capturedUnder sourceRetain
+      sourceRelease totalUnder noCredits control
+  have operationRun' : IxIR1.runOp sourceContext (sourceFuel + 2)
+      functionTrace.source sourceStore source
+        (.apply sourceFunction sourceArguments) =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) := by
+    simpa [sourceAllocation, pap] using sourceOperation
+  have nextImage : attached.SourceStoreImage sourceAllocation.1 :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations functionMember
+      descendant state image operationRun'
+  have operationOutput : (middleStore, operationValue) =
+      (sourceAllocation.1, .loc sourceAllocation.2) := by
+    apply Except.ok.inj (operationRun.symm.trans ?_)
+    simpa [sourceAllocation, pap] using sourceOperation
+  have middleStoreEq : middleStore = sourceAllocation.1 :=
+    congrArg Prod.fst operationOutput
+  have operationValueEq : operationValue = .loc sourceAllocation.2 :=
+    congrArg Prod.snd operationOutput
+  subst middleStore
+  subst operationValue
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  have reuseEq : sourceAllocation.1.reuses = sourceStore.reuses := by
+    change sourceReleased.reuses = sourceStore.reuses
+    exact (IxIR1.NoReuse.dropVal_reuses sourceRelease).trans
+      (IxIR1.NoReuse.dupVals_reuses sourceRetain)
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceAllocation.1
+      (.loc sourceAllocation.2 :: source) :=
+    runtime.runOp reuseEq operationRun'
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceAllocation.1
+        (.loc sourceAllocation.2 :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      functionMember descendant ownership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          sourceDeclarations image) operationRun'
+  let targetAllocation := targetReleased.allocNode .shared targetPap
+  let nextFrame : Eval.Frame :=
+    { frame with
+      pc := frame.pc + 1
+      values := frame.values.push (.loc sourceAllocation.2) }
+  let nextMachine : Eval.Machine :=
+    { store := targetAllocation.1
+      heapFuel := 0
+      control := .running nextFrame stack }
+  have nextControl : nextMachine.control = .running nextFrame stack := rfl
+  have nextNoCredits : nextFrame.credits = #[] := by
+    simpa [nextFrame] using noCredits
+  have nextStores' : Lower.Sim.StoreRel sourceAllocation.1
+      nextMachine.store := by
+    simpa [nextMachine, targetAllocation, targetPap, sourceAllocation, pap]
+      using nextStores
+  have nextState' : attached.sidecars.TraceStateRel functionTrace next
+      sourceAllocation.1 (.loc sourceAllocation.2 :: source) nextFrame := by
+    simpa [sourceAllocation, pap, nextFrame] using nextState
+  have tail := worker (machine := nextMachine) (stack := stack)
+    functionMember nextDescendant nextState' nextStores' nextRuntime
+      nextOwnership continuationRun resultWorld nextControl nextNoCredits
+      nextImage finish
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := nextMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedNext : Eval.Machine :=
+    { nextMachine with heapFuel := suffixFuel }
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetUnder : (captured ++ values.toArray).size < arity := by
+    simpa using totalUnder
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have locationEq : targetAllocation.2 = sourceAllocation.2 := by
+    exact releasedStores.alloc_location .shared pap
+  have fundedTransfer := Eval.ApplyTransfer.papUnder
+    (context := context) (interpretation := interpretation)
+    (resume := { frame with pc := frame.pc + 1 }) (stack := stack)
+    targetGet shared node capturedUnder targetRetain fundedRelease targetUnder
+  dsimp only at fundedTransfer
+  rw [locationEq] at fundedTransfer
+  have fundedTransfer' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location) values.toArray
+      { frame with pc := frame.pc + 1 } stack fundedNext := by
+    simpa [fundedMachine, fundedNext, nextMachine, nextFrame,
+      targetAllocation, targetPap, sourceAllocation, pap] using fundedTransfer
+  obtain ⟨fundedStep, _⟩ :=
+    attached.simulate_traced_apply_transfer_state
+      (machine := fundedMachine) (target := fundedNext) functionMember
+      descendant state sourceDeclarations functionResolved argumentsResolved
+      (by simpa [sourceAllocation, pap] using sourceOperation) noCredits
+      fundedControl fundedTransfer'
+  simpa [fundedMachine, fundedNext] using
+    fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for exact dynamic PAP saturation.  The checked
+apply capability transition constructs the all-shared callee entry and the
+exact suspended caller roots; the callee worker returns through an ordinary
+resume handler and the caller worker consumes the successful continuation. -/
+theorem CompiledAttachment.simulate_traced_apply_pap_saturated_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {applyFuel calleeFuel callerFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased outputStore finalStore :
+      IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {value finalValue : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (sourceOperation : IxIR1.runOp sourceContext (applyFuel + 2)
+      callerTrace.source sourceStore source
+        (.apply sourceFunction sourceArguments) = .ok (outputStore, value))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+      sourceReleased (captured.toList ++ values).reverse
+        sourceDefinition.body = .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      sourceDefinition.result value)
+    (callerRuntime : Lower.Sim.SourceRuntimeInvariant outputStore
+      (value :: source))
+    (callerRun : IxIR1.runCode sourceContext callerFuel callerTrace.source
+      outputStore (value :: source) next.sourceCode =
+        .ok (finalStore, finalValue))
+    (callerResultWorld : IxIR1.Sim.HasWorld finalStore
+      callerTrace.source.result finalValue)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation callerTrace frameRoots stack
+        (finalStore, finalValue) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel)
+    (callerWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation callerFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let sourceTotal := captured.toList ++ values
+  let targetTotal := captured ++ values.toArray
+  let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+  let calleeFrame : Eval.Frame :=
+    { definition := targetDefinition, values := targetTotal }
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      _, targetRelease, releasedStores, _, _, calleeState, _⟩ :=
+    attached.simulate_traced_apply_pap_saturated_enter_state
+      (sourceFuel := applyFuel) (context := context)
+      (interpretation := interpretation) callerMember calleeMember
+      descendant calleeMatch state stores runtime.positiveSharedRC
+      sourceDeclarations functionResolved argumentsResolved sourceGet shared
+      node capturedUnder sourceRetain sourceRelease totalExact papArity
+      sourceDeclaration sourcePapSafe targetDeclaration noCredits control
+  have papAt : sourceStore.get? location =
+      some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+    simpa only [← shared, ← node] using sourceGet
+  have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+    calc
+      calleeTrace.generated.signature.papSafe =
+          calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have entryArity : sourceTotal.length =
+      calleeTrace.generated.signature.params.size := by
+    calc
+      sourceTotal.length = arity := by simpa [sourceTotal] using totalExact
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+  obtain ⟨_, _, remaining, _, _, _, _, _, readyOwnership,
+      entryOwnership⟩ :=
+    Lower.Sim.SourceOwnershipAt.applyPapEntry
+      (checked := attached.target) (sourceContext := sourceContext)
+      (sourceFuel := applyFuel) (supplied := sourceTotal) (residual := [])
+      callerMember calleeMember descendant ownership functionResolved
+      argumentsResolved papAt sourceRetain sourceRelease
+      (by simp [sourceTotal]) entryArity calleePapSafe
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList source ++ frameRoots
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+        sourceTotal.reverse suspendedRoots := by
+    simpa [suspendedRoots, IxIR1.Sim.rootsFor] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      sourceTotal.reverse :=
+    Lower.Sim.SourceRuntimeInvariant.sharedEntry
+      ((runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+      ((runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease)
+      (by simpa [suspendedRoots, List.append_assoc] using readyOwnership)
+  have retainedImage : attached.SourceStoreImage sourceRetained :=
+    attached.dupVals_preservesSourceStoreImage image sourceRetain
+  have calleeImage : attached.SourceStoreImage sourceReleased :=
+    attached.dropVal_preservesSourceStoreImage sourceDeclarations retainedImage
+      sourceRelease
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel
+      calleeTrace.source sourceReleased sourceTotal.reverse
+        calleeTrace.root.sourceCode = .ok (outputStore, value) := by
+    rw [calleeTrace.rootSourceCode, calleeMatch.source]
+    simpa [sourceTotal] using calleeRun
+  have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+      calleeTrace.source.result value := by
+    simpa [calleeMatch.source] using calleeResultWorld
+  have callerOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next outputStore
+        (value :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      callerMember descendant ownership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          sourceDeclarations image) sourceOperation
+  let calleeMachine : Eval.Machine :=
+    { store := targetReleased
+      heapFuel := 0
+      control := .running calleeFrame (.resume resume :: stack) }
+  have calleeStores : Lower.Sim.StoreRel sourceReleased
+      calleeMachine.store := by
+    simpa [calleeMachine] using releasedStores
+  have calleeState' : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased sourceTotal.reverse calleeFrame := by
+    simpa [sourceTotal, targetTotal, calleeFrame] using calleeState
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame (.resume resume :: stack) := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have returnHandler : SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace suspendedRoots (.resume resume :: stack)
+      (outputStore, value) outcome post := by
+    intro returningTrace returnFuel returnSite returnBlock returnInput
+      returnEntryValueCount returnAtom returnTarget returnGenerated returnStore
+      returnSource returnFrame returnMachine returningMember returnDescendant
+      returnState returnStores returnRuntime returnOwnership returnRun returnWorld
+      returnControl returnNoCredits returnImage
+    obtain ⟨returnedValue, _, returnOutputEq⟩ :=
+      IxIR1.runCode_ret_success returnRun
+    have returnStoreEq : returnStore = outputStore :=
+      (congrArg Prod.fst returnOutputEq).symm
+    have returnedValueEq : returnedValue = value :=
+      (congrArg Prod.snd returnOutputEq).symm
+    subst returnStore
+    subst returnedValue
+    have handler : SuccessfulReturnHandler attached sourceContext context
+        interpretation returningTrace suspendedRoots
+        (.resume { frame with pc := frame.pc + 1 } :: stack)
+        (outputStore, value) outcome post :=
+      resumeReturnHandlerWithOwnership attached
+        (sourceContext := sourceContext) (callerFuel := callerFuel)
+        (operationFuel := applyFuel + 2) (context := context)
+        (interpretation := interpretation) (calleeTrace := returningTrace)
+        (outcome := outcome) (post := post) callerMember descendant state
+        (binder := by rfl) (delta := by rfl) sourceDeclarations
+        sourceOperation callerRuntime callerOwnership callerRun
+        callerResultWorld noCredits finish callerWorker
+    apply handler returningMember returnDescendant returnState returnStores
+      returnRuntime returnOwnership returnRun returnWorld
+    · simpa [resume] using returnControl
+    · exact returnNoCredits
+    · exact returnImage
+  have tail := calleeWorker (machine := calleeMachine)
+    (stack := .resume resume :: stack) calleeMember
+      Lower.CodeTrace.Descendant.refl calleeState' calleeStores calleeRuntime
+      calleeOwnership calleeRun' calleeResultWorld' calleeControl
+      calleeNoCredits calleeImage returnHandler
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := calleeMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedCallee : Eval.Machine :=
+    { calleeMachine with heapFuel := suffixFuel }
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have targetSize : targetTotal.size = arity := by
+    simpa [sourceTotal, targetTotal] using totalExact
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = true := calleePapSafe
+  have targetParamArity : targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedEq : targetTotal.extract 0 arity = targetTotal := by
+    rw [← targetSize]
+    exact Array.extract_size
+  have suppliedArity : (targetTotal.extract 0 arity).size =
+      targetDefinition.signature.params.size := by
+    rw [suppliedEq, targetSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have fundedTransfer := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack) targetGet shared node capturedUnder
+      targetRetain fundedRelease
+      (by simpa [targetTotal] using Nat.le_of_eq targetSize.symm)
+      targetDeclaration targetPapSafe suppliedArity targetNonempty
+  dsimp only at fundedTransfer
+  have remainingEmpty :
+      (targetTotal.extract arity targetTotal.size).isEmpty = true := by
+    simp [Array.isEmpty, Array.size_extract]
+    omega
+  rw [suppliedEq, remainingEmpty] at fundedTransfer
+  simp only [if_true] at fundedTransfer
+  have fundedTransfer' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location)
+      values.toArray resume stack fundedCallee := by
+    simpa [fundedMachine, fundedCallee, calleeMachine, calleeFrame,
+      sourceTotal, targetTotal] using fundedTransfer
+  obtain ⟨fundedStep, _⟩ :=
+    attached.simulate_traced_apply_transfer_state
+      (machine := fundedMachine) (target := fundedCallee) callerMember
+      descendant state sourceDeclarations functionResolved argumentsResolved
+      sourceOperation noCredits fundedControl fundedTransfer'
+  simpa [fundedMachine, fundedCallee] using
+    fundedStep.toSteps fundedControl
+
+/-- Complete CPS composition for an erased return-time `applyMore` result.
+Residual arguments are released with an exact local heap budget, and that
+budget is framed over the already funded resumed-caller continuation. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_erased_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {returnFuel applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {returnFrame caller : Eval.Frame}
+    {rest : List Eval.Continuation} {returningTrace : Lower.FunctionTrace}
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceStore sourceReleased : IxIR1.Store}
+    {source values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source returnFrame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result .erased)
+    (sourceRun : IxIR1.runCode sourceContext (returnFuel + 1)
+      returningTrace.source sourceStore source (.ret sourceAtom) =
+        .ok (sourceStore, .erased))
+    (control : machine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest))
+    (noCredits : returnFrame.credits = #[])
+    (sourceRelease : IxIR1.dropMany sourceContext applyFuel sourceStore
+      values = .ok sourceReleased)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (continuation : SuccessfulResumeContinuation context interpretation
+      caller rest (sourceReleased, .erased) outcome post) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨targetHeapFuel, targetReleased, targetRelease, nextStores, _⟩ :=
+    Lower.Sim.dropMany_simulates_releaseSharedWork runtime.positiveSharedRC
+      stores sourceRelease
+  let nextMachine : Eval.Machine :=
+    { store := targetReleased
+      heapFuel := 0
+      control := .running
+        { caller with values := caller.values.push .erased } rest }
+  have nextStores' : Lower.Sim.StoreRel sourceReleased
+      nextMachine.store := by
+    simpa [nextMachine] using nextStores
+  have nextControl : nextMachine.control = .running
+      { caller with values := caller.values.push .erased } rest := rfl
+  have tail := continuation nextStores' nextControl
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := nextMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedNext : Eval.Machine :=
+    { nextMachine with heapFuel := suffixFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest) := by
+    simpa [fundedMachine] using control
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have fundedTransfer : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel .erased values.toArray caller
+      rest fundedNext := by
+    simpa [fundedMachine, fundedNext, nextMachine] using
+      (Eval.ApplyTransfer.erased
+        (context := context) (interpretation := interpretation)
+        (resume := caller) (stack := rest) fundedRelease)
+  obtain ⟨_, _, fundedSteps, _⟩ :=
+    attached.simulate_traced_ret_apply_more_success
+      (machine := fundedMachine) (target := fundedNext) returnDescendant state
+      fundedStores sourceRun resultWorld fundedControl noCredits fundedTransfer
+  simpa [fundedMachine, fundedNext] using fundedSteps
+
+/-- Complete CPS composition for an under-saturated PAP returned to
+`applyMore`.  The longer PAP allocation resumes the caller immediately, while
+the old PAP's exact release cost is framed over the resumed continuation. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_pap_under_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {returnFuel applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {returnFrame caller : Eval.Frame}
+    {rest : List Eval.Continuation} {returningTrace : Lower.FunctionTrace}
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceStore sourceRetained sourceReleased : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source returnFrame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result (.loc location))
+    (sourceRun : IxIR1.runCode sourceContext (returnFuel + 1)
+      returningTrace.source sourceStore source (.ret sourceAtom) =
+        .ok (sourceStore, .loc location))
+    (control : machine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest))
+    (noCredits : returnFrame.credits = #[])
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (continuation : SuccessfulResumeContinuation context interpretation
+      caller rest
+      ((sourceReleased.allocNode .shared
+          (.papN address arity (captured ++ values.toArray))).1,
+        .loc (sourceReleased.allocNode .shared
+          (.papN address arity (captured ++ values.toArray))).2)
+      outcome post) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let pap : IxIR1.Node :=
+    .papN address arity (captured ++ values.toArray)
+  let sourceAllocation := sourceReleased.allocNode .shared pap
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      _, targetRelease, releasedStores, _, _, _, nextStores⟩ :=
+    attached.simulate_traced_ret_apply_more_pap_under_state
+      (returnFuel := returnFuel) (applyFuel := applyFuel)
+      (context := context) (interpretation := interpretation) returnDescendant
+      state stores runtime.positiveSharedRC sourceResolved resultWorld control
+      noCredits sourceGet shared node capturedUnder sourceRetain sourceRelease
+      totalUnder
+  let actualTargetAllocation := targetReleased.allocNode .shared pap
+  have nextStores' : Lower.Sim.StoreRel sourceAllocation.1
+      actualTargetAllocation.1 := by
+    simpa [sourceAllocation, pap, actualTargetAllocation] using nextStores
+  have locationEq : actualTargetAllocation.2 = sourceAllocation.2 :=
+    releasedStores.alloc_location .shared pap
+  let nextMachine : Eval.Machine :=
+    { store := actualTargetAllocation.1
+      heapFuel := 0
+      control := .running
+        { caller with values := caller.values.push (.loc sourceAllocation.2) }
+        rest }
+  have nextStores'' : Lower.Sim.StoreRel sourceAllocation.1
+      nextMachine.store := by
+    simpa [nextMachine] using nextStores'
+  have nextControl : nextMachine.control = .running
+      { caller with values := caller.values.push (.loc sourceAllocation.2) }
+      rest := rfl
+  have continuation' : SuccessfulResumeContinuation context interpretation
+      caller rest (sourceAllocation.1, .loc sourceAllocation.2) outcome post := by
+    change SuccessfulResumeContinuation context interpretation caller rest
+      (sourceAllocation.1, .loc sourceAllocation.2) outcome post at continuation
+    exact continuation
+  have tail := continuation' nextStores'' nextControl
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := nextMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedNext : Eval.Machine :=
+    { nextMachine with heapFuel := suffixFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest) := by
+    simpa [fundedMachine] using control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have targetUnder : (captured ++ values.toArray).size < arity := by
+    simpa using totalUnder
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have fundedTransfer := Eval.ApplyTransfer.papUnder
+    (context := context) (interpretation := interpretation)
+    (resume := caller) (stack := rest) targetGet shared node capturedUnder
+      targetRetain fundedRelease targetUnder
+  dsimp only at fundedTransfer
+  rw [locationEq] at fundedTransfer
+  have fundedTransfer' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location)
+      values.toArray caller rest fundedNext := by
+    simpa [fundedMachine, fundedNext, nextMachine, actualTargetAllocation,
+      sourceAllocation, pap] using fundedTransfer
+  obtain ⟨_, _, fundedSteps, _⟩ :=
+    attached.simulate_traced_ret_apply_more_success
+      (machine := fundedMachine) (target := fundedNext) returnDescendant state
+      fundedStores sourceRun resultWorld fundedControl noCredits fundedTransfer'
+  simpa [fundedMachine, fundedNext] using fundedSteps
+
+/-- Complete CPS composition for an exactly saturated return-time `applyMore`
+redispatch.  Terminal ownership is reworlded to the shared PAP root, the PAP
+retain/release prefix constructs the next callee's canonical entry, and the
+local heap cost is framed over that callee's ordinary resume handler. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_pap_saturated_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {returnFuel applyFuel calleeFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {returnFrame caller : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {returningTrace calleeTrace : Lower.FunctionTrace}
+    (returningMember : returningTrace ∈
+      attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈
+      attached.target.artifact.trace.functions)
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    {suspendedRoots : List IxIR1.Sim.Root}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source returnFrame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated)
+      sourceStore source
+        (IxIR1.Sim.rootsFor .shared values ++ suspendedRoots))
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result (.loc location))
+    (sourceRun : IxIR1.runCode sourceContext (returnFuel + 1)
+      returningTrace.source sourceStore source (.ret sourceAtom) =
+        .ok (sourceStore, .loc location))
+    (control : machine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest))
+    (noCredits : returnFrame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+      sourceReleased (captured.toList ++ values).reverse
+        sourceDefinition.body = .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      sourceDefinition.result value)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (nextHandler : SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace suspendedRoots (.resume caller :: rest)
+      (outputStore, value) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let sourceTotal := captured.toList ++ values
+  let targetTotal := captured ++ values.toArray
+  let calleeFrame : Eval.Frame :=
+    { definition := targetDefinition, values := targetTotal }
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      _, targetRelease, releasedStores, _, _, _, calleeState⟩ :=
+    attached.simulate_traced_ret_apply_more_pap_saturated_enter_state
+      (returnFuel := returnFuel) (applyFuel := applyFuel)
+      (context := context) (interpretation := interpretation) calleeMember
+      returnDescendant calleeMatch state stores runtime.positiveSharedRC
+      sourceResolved resultWorld control noCredits sourceGet shared node
+      capturedUnder sourceRetain sourceRelease totalExact papArity
+      sourceDeclaration sourcePapSafe targetDeclaration
+  have papAt : sourceStore.get? location =
+      some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+    simpa only [← shared, ← node] using sourceGet
+  have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) returningMember returnDescendant ownership
+      sourceResolved
+  have sharedResult : IxIR1.Sim.HasWorld sourceStore .shared
+      (.loc location) := ⟨box, sourceGet, shared⟩
+  have returnedOwnership : IxIR1.Sim.RootOwnership sourceStore
+      (⟨.shared, .loc location⟩ ::
+        IxIR1.Sim.rootsFor .shared values ++ suspendedRoots) :=
+    Lower.Sim.RootOwnership_reworldHead terminalOwnership sharedResult
+  have readyOwnership : IxIR1.Sim.RootOwnership sourceReleased
+      (IxIR1.Sim.rootsFor .shared sourceTotal ++ suspendedRoots) := by
+    simpa [sourceTotal] using IxIR1.Sim.applyGo_preparePap_owned papAt
+      returnedOwnership sourceRetain sourceRelease
+  have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+    calc
+      calleeTrace.generated.signature.papSafe =
+          calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have entryArity : sourceTotal.length =
+      calleeTrace.generated.signature.params.size := by
+    calc
+      sourceTotal.length = arity := by simpa [sourceTotal] using totalExact
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+  have entryShape :
+      Lower.entryCapabilities calleeTrace.generated.signature =
+        Array.replicate sourceTotal.length (.owned .shared) := by
+    simpa [entryArity] using
+      attached.target.papSafeEntryCapabilities calleeMember calleePapSafe
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+        sourceTotal.reverse suspendedRoots := by
+    intro entry entryMember entryCoordinate
+    rw [attached.target.entryCapabilities calleeMember entryMember
+      entryCoordinate]
+    exact Lower.Sim.SourceOwnershipInvariant.sharedEntry entryShape
+      readyOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      sourceTotal.reverse :=
+    Lower.Sim.SourceRuntimeInvariant.sharedEntry
+      ((runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+      ((runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease)
+      readyOwnership
+  have retainedImage : attached.SourceStoreImage sourceRetained :=
+    attached.dupVals_preservesSourceStoreImage image sourceRetain
+  have calleeImage : attached.SourceStoreImage sourceReleased :=
+    attached.dropVal_preservesSourceStoreImage sourceDeclarations retainedImage
+      sourceRelease
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel
+      calleeTrace.source sourceReleased sourceTotal.reverse
+        calleeTrace.root.sourceCode = .ok (outputStore, value) := by
+    rw [calleeTrace.rootSourceCode, calleeMatch.source]
+    simpa [sourceTotal] using calleeRun
+  have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+      calleeTrace.source.result value := by
+    simpa [calleeMatch.source] using calleeResultWorld
+  let calleeMachine : Eval.Machine :=
+    { store := targetReleased
+      heapFuel := 0
+      control := .running calleeFrame (.resume caller :: rest) }
+  have calleeStores : Lower.Sim.StoreRel sourceReleased
+      calleeMachine.store := by
+    simpa [calleeMachine] using releasedStores
+  have calleeState' : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased sourceTotal.reverse calleeFrame := by
+    simpa [sourceTotal, targetTotal, calleeFrame] using calleeState
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame (.resume caller :: rest) := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have tail := calleeWorker (machine := calleeMachine)
+    (stack := .resume caller :: rest) calleeMember
+      Lower.CodeTrace.Descendant.refl calleeState' calleeStores calleeRuntime
+      calleeOwnership calleeRun' calleeResultWorld' calleeControl
+      calleeNoCredits calleeImage nextHandler
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := calleeMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedCallee : Eval.Machine :=
+    { calleeMachine with heapFuel := suffixFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest) := by
+    simpa [fundedMachine] using control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have targetSize : targetTotal.size = arity := by
+    simpa [sourceTotal, targetTotal] using totalExact
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = true := calleePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedEq : targetTotal.extract 0 arity = targetTotal := by
+    rw [← targetSize]
+    exact Array.extract_size
+  have suppliedArity : (targetTotal.extract 0 arity).size =
+      targetDefinition.signature.params.size := by
+    rw [suppliedEq, targetSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have fundedTransfer := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := caller) (stack := rest) targetGet shared node capturedUnder
+      targetRetain fundedRelease
+      (by simpa [targetTotal] using Nat.le_of_eq targetSize.symm)
+      targetDeclaration targetPapSafe suppliedArity targetNonempty
+  dsimp only at fundedTransfer
+  have remainingEmpty :
+      (targetTotal.extract arity targetTotal.size).isEmpty = true := by
+    simp [Array.isEmpty, Array.size_extract]
+    omega
+  rw [suppliedEq, remainingEmpty] at fundedTransfer
+  simp only [if_true] at fundedTransfer
+  have fundedTransfer' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location)
+      values.toArray caller rest fundedCallee := by
+    simpa [fundedMachine, fundedCallee, calleeMachine, calleeFrame,
+      sourceTotal, targetTotal] using fundedTransfer
+  obtain ⟨_, _, fundedSteps, _⟩ :=
+    attached.simulate_traced_ret_apply_more_success
+      (machine := fundedMachine) (target := fundedCallee) returnDescendant
+      state fundedStores sourceRun resultWorld fundedControl noCredits
+      fundedTransfer'
+  simpa [fundedMachine, fundedCallee] using fundedSteps
+
+/-- Complete CPS composition for an over-saturated return-time `applyMore`
+redispatch.  The returning callee's terminal ownership exposes the shared PAP
+and residual arguments, the PAP preparation splits the next callee's supplied
+and residual roots, and the local retain/release cost is framed over the next
+callee worker and its recursive `applyMore` handler. -/
+theorem CompiledAttachment.simulate_traced_ret_apply_more_pap_over_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {returnFuel applyFuel calleeFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {returnFrame caller : Eval.Frame}
+    {rest : List Eval.Continuation}
+    {returningTrace calleeTrace : Lower.FunctionTrace}
+    (returningMember : returningTrace ∈
+      attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈
+      attached.target.artifact.trace.functions)
+    {returnSite : Lower.SourceSite} {returnBlock : BlockId}
+    {returnInput : Lower.Sim.EnvMap} {returnEntryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {returnGenerated : Block}
+    (returnDescendant : returningTrace.root.Descendant
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    {suspendedRoots : List IxIR1.Sim.Root}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel returningTrace
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated) sourceStore source returnFrame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret returnSite returnBlock returnInput returnEntryValueCount sourceAtom
+        targetAtom returnGenerated)
+      sourceStore source
+        (IxIR1.Sim.rootsFor .shared values ++ suspendedRoots))
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtom source sourceAtom = .ok (.loc location))
+    (resultWorld : IxIR1.Sim.HasWorld sourceStore
+      returningTrace.source.result (.loc location))
+    (sourceRun : IxIR1.runCode sourceContext (returnFuel + 1)
+      returningTrace.source sourceStore source (.ret sourceAtom) =
+        .ok (sourceStore, .loc location))
+    (control : machine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest))
+    (noCredits : returnFrame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+      sourceReleased ((captured.toList ++ values).take arity).reverse
+        sourceDefinition.body = .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      sourceDefinition.result value)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (nextHandler : SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace
+      (IxIR1.Sim.rootsFor .shared
+          ((captured.toList ++ values).drop arity) ++ suspendedRoots)
+      (.applyMore
+          ((captured ++ values.toArray).extract arity
+            (captured ++ values.toArray).size)
+          caller :: rest)
+      (outputStore, value) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let sourceRemaining := sourceTotal.drop arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  let targetRemaining := targetTotal.extract arity targetTotal.size
+  let calleeFrame : Eval.Frame :=
+    { definition := targetDefinition, values := targetSupplied }
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      _, targetRelease, releasedStores, _, _, _, remainingEq, calleeState⟩ :=
+    attached.simulate_traced_ret_apply_more_pap_over_enter_state
+      (returnFuel := returnFuel) (applyFuel := applyFuel)
+      (context := context) (interpretation := interpretation) calleeMember
+      returnDescendant calleeMatch state stores runtime.positiveSharedRC
+      sourceResolved resultWorld control noCredits sourceGet shared node
+      capturedUnder sourceRetain sourceRelease totalOver papArity
+      sourceDeclaration sourcePapSafe targetDeclaration
+  have papAt : sourceStore.get? location =
+      some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+    simpa only [← shared, ← node] using sourceGet
+  have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) returningMember returnDescendant ownership
+      sourceResolved
+  have sharedResult : IxIR1.Sim.HasWorld sourceStore .shared
+      (.loc location) := ⟨box, sourceGet, shared⟩
+  have returnedOwnership : IxIR1.Sim.RootOwnership sourceStore
+      (⟨.shared, .loc location⟩ ::
+        IxIR1.Sim.rootsFor .shared values ++ suspendedRoots) :=
+    Lower.Sim.RootOwnership_reworldHead terminalOwnership sharedResult
+  have preparedOwnership := IxIR1.Sim.applyGo_preparePap_owned papAt
+    returnedOwnership sourceRetain sourceRelease
+  have readyOwnership : IxIR1.Sim.RootOwnership sourceReleased
+      (IxIR1.Sim.rootsFor .shared sourceSupplied ++
+        IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots) := by
+    simpa [sourceTotal, sourceSupplied, sourceRemaining,
+      IxIR1.Sim.rootsFor, List.append_assoc] using preparedOwnership
+  have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+    calc
+      calleeTrace.generated.signature.papSafe =
+          calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have suppliedArity : sourceSupplied.length =
+      calleeTrace.generated.signature.params.size := by
+    have sourceOver : arity < sourceTotal.length := by
+      simpa [sourceTotal] using totalOver
+    calc
+      sourceSupplied.length = arity := by
+        simp [sourceSupplied, Nat.min_eq_left (Nat.le_of_lt sourceOver)]
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+  have entryShape :
+      Lower.entryCapabilities calleeTrace.generated.signature =
+        Array.replicate sourceSupplied.length (.owned .shared) := by
+    simpa [suppliedArity] using
+      attached.target.papSafeEntryCapabilities calleeMember calleePapSafe
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+        sourceSupplied.reverse
+        (IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots) := by
+    intro entry entryMember entryCoordinate
+    rw [attached.target.entryCapabilities calleeMember entryMember
+      entryCoordinate]
+    exact Lower.Sim.SourceOwnershipInvariant.sharedEntry entryShape
+      (by simpa [List.append_assoc] using readyOwnership)
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      sourceSupplied.reverse :=
+    Lower.Sim.SourceRuntimeInvariant.sharedEntry
+      ((runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+      ((runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease)
+      (by simpa [List.append_assoc] using readyOwnership)
+  have retainedImage : attached.SourceStoreImage sourceRetained :=
+    attached.dupVals_preservesSourceStoreImage image sourceRetain
+  have calleeImage : attached.SourceStoreImage sourceReleased :=
+    attached.dropVal_preservesSourceStoreImage sourceDeclarations retainedImage
+      sourceRelease
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel
+      calleeTrace.source sourceReleased sourceSupplied.reverse
+        calleeTrace.root.sourceCode = .ok (outputStore, value) := by
+    rw [calleeTrace.rootSourceCode, calleeMatch.source]
+    simpa [sourceTotal, sourceSupplied] using calleeRun
+  have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+      calleeTrace.source.result value := by
+    simpa [calleeMatch.source] using calleeResultWorld
+  let calleeMachine : Eval.Machine :=
+    { store := targetReleased
+      heapFuel := 0
+      control := .running calleeFrame
+        (.applyMore targetRemaining caller :: rest) }
+  have calleeStores : Lower.Sim.StoreRel sourceReleased
+      calleeMachine.store := by
+    simpa [calleeMachine] using releasedStores
+  have calleeState' : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased sourceSupplied.reverse calleeFrame := by
+    simpa [sourceTotal, sourceSupplied, targetTotal, targetSupplied,
+      calleeFrame] using calleeState
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame (.applyMore targetRemaining caller :: rest) := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have nextHandler' : SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace
+      (IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots)
+      (.applyMore targetRemaining caller :: rest)
+      (outputStore, value) outcome post := by
+    change SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace
+      (IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots)
+      (.applyMore targetRemaining caller :: rest)
+      (outputStore, value) outcome post at nextHandler
+    exact nextHandler
+  have tail := calleeWorker (machine := calleeMachine)
+    (stack := .applyMore targetRemaining caller :: rest) calleeMember
+      Lower.CodeTrace.Descendant.refl calleeState' calleeStores calleeRuntime
+      calleeOwnership calleeRun' calleeResultWorld' calleeControl
+      calleeNoCredits calleeImage nextHandler'
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := calleeMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedCallee : Eval.Machine :=
+    { calleeMachine with heapFuel := suffixFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control =
+      .running returnFrame (.applyMore values.toArray caller :: rest) := by
+    simpa [fundedMachine] using control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = true := calleePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have targetSuppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have targetSuppliedArity : targetSupplied.size =
+      targetDefinition.signature.params.size := by
+    rw [targetSuppliedSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have fundedTransfer := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := caller) (stack := rest) targetGet shared node capturedUnder
+      targetRetain fundedRelease (Nat.le_of_lt targetOver) targetDeclaration
+      targetPapSafe targetSuppliedArity targetNonempty
+  dsimp only at fundedTransfer
+  have remainingNonempty : targetRemaining.isEmpty = false := by
+    simp [targetRemaining, Array.isEmpty, Array.size_extract]
+    omega
+  rw [remainingNonempty] at fundedTransfer
+  have fundedTransfer' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location)
+      values.toArray caller rest fundedCallee := by
+    simpa [fundedMachine, fundedCallee, calleeMachine, calleeFrame,
+      targetTotal, targetSupplied, targetRemaining] using fundedTransfer
+  obtain ⟨_, _, fundedSteps, _⟩ :=
+    attached.simulate_traced_ret_apply_more_success
+      (machine := fundedMachine) (target := fundedCallee) returnDescendant
+      state fundedStores sourceRun resultWorld fundedControl noCredits
+      fundedTransfer'
+  simpa [fundedMachine, fundedCallee] using fundedSteps
+
+/-- Complete CPS composition for an over-saturated dynamic PAP application.
+The checked apply transition partitions the source roots between the first
+callee and its residual `applyMore` continuation; the first callee worker then
+runs under the supplied recursively constructed return handler. -/
+theorem CompiledAttachment.simulate_traced_apply_pap_over_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {applyFuel calleeFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceStore sourceRetained sourceReleased outputStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {captured : Array IxIR1.RVal} {values : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {value : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved :
+      IxIR1.resolveAtom source sourceFunction = .ok (.loc location))
+    (argumentsResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain :
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+      sourceReleased ((captured.toList ++ values).take arity).reverse
+        sourceDefinition.body = .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      sourceDefinition.result value)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (nextHandler : ∀ remaining : Array Lower.BindingCap,
+      SuccessfulReturnHandler attached sourceContext context interpretation
+        calleeTrace
+        (IxIR1.Sim.rootsFor .shared
+            ((captured.toList ++ values).drop arity) ++
+          Lower.Sim.rootsForCapabilities remaining.toList source ++ frameRoots)
+        (.applyMore
+            ((captured ++ values.toArray).extract arity
+              (captured ++ values.toArray).size)
+            { frame with pc := frame.pc + 1 } :: stack)
+        (outputStore, value) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let sourceRemaining := sourceTotal.drop arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  let targetRemaining := targetTotal.extract arity targetTotal.size
+  let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+  let calleeFrame : Eval.Frame :=
+    { definition := targetDefinition, values := targetSupplied }
+  obtain ⟨targetRetained, targetReleased, targetHeapFuel, targetRetain,
+      _, targetRelease, releasedStores, _, _, _, calleeState, _⟩ :=
+    attached.simulate_traced_apply_pap_over_enter_state
+      (sourceFuel := applyFuel) (context := context)
+      (interpretation := interpretation) callerMember calleeMember descendant
+      calleeMatch state stores runtime.positiveSharedRC sourceDeclarations
+      functionResolved argumentsResolved sourceGet shared node capturedUnder
+      sourceRetain sourceRelease totalOver papArity sourceDeclaration
+      sourcePapSafe targetDeclaration noCredits control
+  have papAt : sourceStore.get? location =
+      some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+    simpa only [← shared, ← node] using sourceGet
+  have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+    calc
+      calleeTrace.generated.signature.papSafe =
+          calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have suppliedArity : sourceSupplied.length =
+      calleeTrace.generated.signature.params.size := by
+    have sourceOver : arity < sourceTotal.length := by
+      simpa [sourceTotal] using totalOver
+    calc
+      sourceSupplied.length = arity := by
+        simp [sourceSupplied, Nat.min_eq_left (Nat.le_of_lt sourceOver)]
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+  obtain ⟨_, _, remaining, _, _, _, _, _, readyOwnership,
+      entryOwnership⟩ :=
+    Lower.Sim.SourceOwnershipAt.applyPapEntry
+      (checked := attached.target) (sourceContext := sourceContext)
+      (sourceFuel := applyFuel) (supplied := sourceSupplied)
+      (residual := sourceRemaining) callerMember calleeMember descendant
+      ownership functionResolved argumentsResolved papAt sourceRetain
+      sourceRelease (by
+        exact (List.take_append_drop arity sourceTotal).symm)
+      suppliedArity calleePapSafe
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList source ++ frameRoots
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+        sourceSupplied.reverse
+        (IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots) := by
+    simpa [suspendedRoots] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      sourceSupplied.reverse :=
+    Lower.Sim.SourceRuntimeInvariant.sharedEntry
+      ((runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+      ((runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease)
+      (by simpa [suspendedRoots, List.append_assoc] using readyOwnership)
+  have retainedImage : attached.SourceStoreImage sourceRetained :=
+    attached.dupVals_preservesSourceStoreImage image sourceRetain
+  have calleeImage : attached.SourceStoreImage sourceReleased :=
+    attached.dropVal_preservesSourceStoreImage sourceDeclarations retainedImage
+      sourceRelease
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel
+      calleeTrace.source sourceReleased sourceSupplied.reverse
+        calleeTrace.root.sourceCode = .ok (outputStore, value) := by
+    rw [calleeTrace.rootSourceCode, calleeMatch.source]
+    simpa [sourceTotal, sourceSupplied] using calleeRun
+  have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+      calleeTrace.source.result value := by
+    simpa [calleeMatch.source] using calleeResultWorld
+  let calleeMachine : Eval.Machine :=
+    { store := targetReleased
+      heapFuel := 0
+      control := .running calleeFrame
+        (.applyMore targetRemaining resume :: stack) }
+  have calleeStores : Lower.Sim.StoreRel sourceReleased
+      calleeMachine.store := by
+    simpa [calleeMachine] using releasedStores
+  have calleeState' : attached.sidecars.TraceStateRel calleeTrace
+      calleeTrace.root sourceReleased sourceSupplied.reverse calleeFrame := by
+    simpa [sourceTotal, sourceSupplied, targetTotal, targetSupplied,
+      calleeFrame] using calleeState
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame (.applyMore targetRemaining resume :: stack) := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have nextHandler' : SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace
+      (IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots)
+      (.applyMore targetRemaining resume :: stack)
+      (outputStore, value) outcome post := by
+    intro returningTrace returnFuel returnSite returnBlock returnInput
+      returnEntryValueCount returnAtom returnTarget returnGenerated returnStore
+      returnSource returnFrame returnMachine returningMember returnDescendant
+      returnState returnStores returnRuntime returnOwnership returnRun returnWorld
+      returnControl returnNoCredits returnImage
+    exact nextHandler remaining returningMember returnDescendant returnState
+      returnStores returnRuntime
+      (by simpa [sourceTotal, sourceRemaining, suspendedRoots,
+          List.append_assoc] using returnOwnership)
+      returnRun returnWorld
+      (by simpa [targetTotal, targetRemaining, resume] using returnControl)
+      returnNoCredits returnImage
+  have tail := calleeWorker (machine := calleeMachine)
+    (stack := .applyMore targetRemaining resume :: stack) calleeMember
+      Lower.CodeTrace.Descendant.refl calleeState' calleeStores calleeRuntime
+      calleeOwnership calleeRun' calleeResultWorld' calleeControl
+      calleeNoCredits calleeImage nextHandler'
+  refine BudgetedReachesPost.prependFramed
+    (before := machine) (middle := calleeMachine) (prefixCount := 1)
+    (localFuel := targetHeapFuel) ?_ tail
+  intro suffixFuel
+  let fundedMachine : Eval.Machine :=
+    { machine with heapFuel := targetHeapFuel + suffixFuel }
+  let fundedCallee : Eval.Machine :=
+    { calleeMachine with heapFuel := suffixFuel }
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [stores.heap]
+    exact sourceGet
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = true := calleePapSafe
+  have targetParamArity :
+      targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have targetSuppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have targetSuppliedArity : targetSupplied.size =
+      targetDefinition.signature.params.size := by
+    rw [targetSuppliedSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have fundedTransfer := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := stack) targetGet shared node capturedUnder
+      targetRetain fundedRelease (Nat.le_of_lt targetOver) targetDeclaration
+      targetPapSafe targetSuppliedArity targetNonempty
+  dsimp only at fundedTransfer
+  have remainingNonempty : targetRemaining.isEmpty = false := by
+    simp [targetRemaining, Array.isEmpty, Array.size_extract]
+    omega
+  rw [remainingNonempty] at fundedTransfer
+  have fundedTransfer' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location)
+      values.toArray resume stack fundedCallee := by
+    simpa [fundedMachine, fundedCallee, calleeMachine, calleeFrame,
+      targetTotal, targetSupplied, targetRemaining] using fundedTransfer
+  obtain ⟨fundedStep, _⟩ :=
+    Lower.Sim.simulate_traced_apply_transfer_state
+      (machine := fundedMachine) (target := fundedCallee) descendant
+      state.target functionResolved argumentsResolved noCredits fundedControl
+      fundedTransfer'
+  simpa [fundedMachine, fundedCallee] using
+    fundedStep.toSteps fundedControl
+
+/-- Interpret an aligned successful `applyGo` plan as the universal
+`applyMore` return handler required by the trace worker.  Recursion follows
+the plan's residual over-application edge, while every invoked function body
+uses the corresponding strictly smaller source-fuel worker. -/
+theorem CompiledAttachment.applyMoreReturnHandler_of_plan
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {applyFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {function outputValue : IxIR1.RVal} {values : List IxIR1.RVal}
+    (plan : ApplyMorePlan attached sourceContext context applyFuel sourceStore
+      function values outputStore outputValue)
+    (workers : ∀ fuel, fuel < applyFuel →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel)
+    {caller : Eval.Frame} {rest : List Eval.Continuation}
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (continuation : SuccessfulResumeContinuation context interpretation
+      caller rest (outputStore, outputValue) outcome post)
+    (functionTrace : Lower.FunctionTrace)
+    (suspendedRoots : List IxIR1.Sim.Root) :
+    SuccessfulReturnHandler attached sourceContext context interpretation
+      functionTrace (IxIR1.Sim.rootsFor .shared values ++ suspendedRoots)
+      (.applyMore values.toArray caller :: rest) (sourceStore, function)
+      outcome post := by
+  induction plan generalizing functionTrace suspendedRoots caller rest outcome
+      post with
+  | @erased fuel planStore planReleased planValues sourceRelease =>
+      intro returningTrace returnFuel site blockId input entryValueCount
+        sourceAtom targetAtom generated returnStore source returnFrame machine
+        returningMember descendant state stores runtime ownership returnRun
+        resultWorld control noCredits image
+      obtain ⟨returnedValue, sourceResolved, outputEq⟩ :=
+        IxIR1.runCode_ret_success returnRun
+      have storeEq : returnStore = planStore := by
+        simpa using (congrArg Prod.fst outputEq).symm
+      have valueEq : returnedValue = IxIR1.RVal.erased :=
+        (congrArg Prod.snd outputEq).symm
+      subst returnStore
+      subst returnedValue
+      exact attached.simulate_traced_ret_apply_more_erased_cps
+        (sourceContext := sourceContext) (applyFuel := fuel) descendant state
+        stores runtime resultWorld returnRun control noCredits sourceRelease
+        continuation
+  | @papUnder fuel planStore retainedStore releasedStore location box address
+      arity captured planValues sourceGet node sourceRetain sourceRelease
+      totalUnder =>
+      intro returningTrace returnFuel site blockId input entryValueCount
+        sourceAtom targetAtom generated returnStore source returnFrame machine
+        returningMember descendant state stores runtime ownership returnRun
+        resultWorld control noCredits image
+      obtain ⟨returnedValue, sourceResolved, outputEq⟩ :=
+        IxIR1.runCode_ret_success returnRun
+      have storeEq : returnStore = planStore := by
+        simpa using (congrArg Prod.fst outputEq).symm
+      have valueEq : returnedValue = IxIR1.RVal.loc location :=
+        (congrArg Prod.snd outputEq).symm
+      subst returnStore
+      subst returnedValue
+      obtain ⟨shared, capturedUnder⟩ := attached.livePapFacts returningMember
+        descendant runtime ownership sourceGet node
+      exact attached.simulate_traced_ret_apply_more_pap_under_cps
+        (sourceContext := sourceContext) (applyFuel := fuel) descendant state
+        stores runtime sourceResolved resultWorld returnRun control noCredits
+        sourceGet shared node capturedUnder sourceRetain sourceRelease totalUnder
+        continuation
+  | @papSaturatedFn fuel calleeFuel planStore retainedStore releasedStore
+      planOutputStore location box address arity captured planValues
+      sourceDefinition targetDefinition calleeTrace planOutputValue calleeMember
+      calleeMatch sourceGet node sourceRetain sourceRelease
+      totalExact papArity sourceDeclaration sourcePapSafe targetDeclaration
+      calleeRun calleeResultWorld calleeSmaller =>
+      intro returningTrace returnFuel site blockId input entryValueCount
+        sourceAtom targetAtom generated returnStore source returnFrame machine
+        returningMember descendant state stores runtime ownership returnRun
+        resultWorld control noCredits image
+      obtain ⟨returnedValue, sourceResolved, outputEq⟩ :=
+        IxIR1.runCode_ret_success returnRun
+      have storeEq : returnStore = planStore := by
+        simpa using (congrArg Prod.fst outputEq).symm
+      have valueEq : returnedValue = IxIR1.RVal.loc location :=
+        (congrArg Prod.snd outputEq).symm
+      subst returnStore
+      subst returnedValue
+      obtain ⟨shared, capturedUnder⟩ := attached.livePapFacts returningMember
+        descendant runtime ownership sourceGet node
+      have nextHandler : SuccessfulReturnHandler attached sourceContext context
+          interpretation calleeTrace suspendedRoots (.resume caller :: rest)
+          (planOutputStore, planOutputValue) outcome post :=
+        resumeReturnHandlerOfContinuation attached calleeTrace suspendedRoots
+          caller rest (planOutputStore, planOutputValue) outcome post
+          continuation
+      exact attached.simulate_traced_ret_apply_more_pap_saturated_cps
+        (sourceContext := sourceContext) (applyFuel := fuel)
+        (calleeFuel := calleeFuel)
+        returningMember calleeMember descendant calleeMatch state stores runtime
+        ownership sourceDeclarations sourceResolved resultWorld returnRun control
+        noCredits image
+        sourceGet shared node capturedUnder sourceRetain sourceRelease totalExact
+        papArity sourceDeclaration sourcePapSafe targetDeclaration calleeRun
+        calleeResultWorld nextHandler (workers calleeFuel calleeSmaller)
+  | @papOverFn fuel calleeFuel planStore retainedStore releasedStore calledStore
+      planOutputStore location box address arity captured planValues
+      sourceDefinition targetDefinition calleeTrace calledValue planOutputValue
+      calleeMember calleeMatch sourceGet node sourceRetain sourceRelease
+      totalOver papArity sourceDeclaration sourcePapSafe
+      targetDeclaration calleeRun calleeResultWorld calleeSmaller residual ih =>
+      intro returningTrace returnFuel site blockId input entryValueCount
+        sourceAtom targetAtom generated returnStore source returnFrame machine
+        returningMember descendant state stores runtime ownership returnRun
+        resultWorld control noCredits image
+      obtain ⟨returnedValue, sourceResolved, outputEq⟩ :=
+        IxIR1.runCode_ret_success returnRun
+      have storeEq : returnStore = planStore := by
+        simpa using (congrArg Prod.fst outputEq).symm
+      have valueEq : returnedValue = IxIR1.RVal.loc location :=
+        (congrArg Prod.snd outputEq).symm
+      subst returnStore
+      subst returnedValue
+      obtain ⟨shared, capturedUnder⟩ := attached.livePapFacts returningMember
+        descendant runtime ownership sourceGet node
+      have residualWorkers : ∀ recursiveFuel, recursiveFuel < fuel →
+          SuccessfulTraceSimulationAt attached sourceContext context
+            interpretation recursiveFuel := by
+        intro recursiveFuel smaller
+        exact workers recursiveFuel (Nat.lt_trans smaller (Nat.lt_succ_self fuel))
+      have residualHandler : SuccessfulReturnHandler attached sourceContext
+          context interpretation calleeTrace
+          (IxIR1.Sim.rootsFor .shared
+              ((captured.toList ++ planValues).drop arity) ++ suspendedRoots)
+          (.applyMore
+              ((captured ++ planValues.toArray).extract arity
+                (captured ++ planValues.toArray).size)
+              caller :: rest)
+          (calledStore, calledValue) outcome post := by
+        have handler : SuccessfulReturnHandler attached sourceContext context
+            interpretation calleeTrace
+            (IxIR1.Sim.rootsFor .shared
+                ((captured.toList ++ planValues).drop arity) ++
+              suspendedRoots)
+            (.applyMore
+                ((captured.toList ++ planValues).drop arity).toArray caller ::
+              rest)
+            (calledStore, calledValue) outcome post :=
+          ih residualWorkers continuation calleeTrace suspendedRoots
+        intro recursiveTrace recursiveReturnFuel recursiveSite recursiveBlock
+          recursiveInput recursiveEntryValueCount recursiveAtom recursiveTarget
+          recursiveGenerated recursiveStore recursiveSource recursiveFrame
+          recursiveMachine recursiveMember recursiveDescendant recursiveState
+          recursiveStores recursiveRuntime recursiveOwnership recursiveRun
+          recursiveWorld recursiveControl recursiveNoCredits recursiveImage
+        apply handler recursiveMember recursiveDescendant recursiveState
+          recursiveStores recursiveRuntime recursiveOwnership recursiveRun
+          recursiveWorld ?_ recursiveNoCredits recursiveImage
+        have remainingArrayEq :
+            ((captured ++ planValues.toArray).extract arity
+              (captured ++ planValues.toArray).size) =
+              ((captured.toList ++ planValues).drop arity).toArray := by
+          rw [show captured ++ planValues.toArray =
+              (captured.toList ++ planValues).toArray by
+            apply Array.toList_inj.mp
+            simp]
+          exact List.toArray_drop.symm
+        rw [← remainingArrayEq]
+        exact recursiveControl
+      exact attached.simulate_traced_ret_apply_more_pap_over_cps
+        (sourceContext := sourceContext) (applyFuel := fuel)
+        (calleeFuel := calleeFuel)
+        returningMember calleeMember descendant calleeMatch state stores runtime
+        ownership sourceDeclarations sourceResolved resultWorld returnRun control
+        noCredits image
+        sourceGet shared node capturedUnder sourceRetain sourceRelease totalOver
+        papArity sourceDeclaration sourcePapSafe targetDeclaration calleeRun
+        calleeResultWorld residualHandler (workers calleeFuel calleeSmaller)
+
+/-- Direct worker-facing form of `applyMoreReturnHandler_of_plan`: successful
+source evaluation selects its exhaustive plan internally, so callers need
+only the two installed declaration environments and the usual smaller-fuel
+workers. -/
+theorem CompiledAttachment.applyMoreReturnHandler_of_applyGo
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {applyFuel : Nat} {sourceStore outputStore : IxIR1.Store}
+    {function outputValue : IxIR1.RVal} {values : List IxIR1.RVal}
+    (run : IxIR1.applyGo sourceContext applyFuel sourceStore function values =
+      .ok (outputStore, outputValue))
+    (workers : ∀ fuel, fuel < applyFuel →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel)
+    {caller : Eval.Frame} {rest : List Eval.Continuation}
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (continuation : SuccessfulResumeContinuation context interpretation
+      caller rest (outputStore, outputValue) outcome post)
+    (functionTrace : Lower.FunctionTrace)
+    (suspendedRoots : List IxIR1.Sim.Root) :
+    SuccessfulReturnHandler attached sourceContext context interpretation
+      functionTrace (IxIR1.Sim.rootsFor .shared values ++ suspendedRoots)
+      (.applyMore values.toArray caller :: rest) (sourceStore, function)
+      outcome post := by
+  exact attached.applyMoreReturnHandler_of_plan
+    sourceDeclarations
+    (attached.applyMorePlan_of_applyGo sourceDeclarations targetDeclarations
+      run)
+    workers continuation functionTrace suspendedRoots
+
+/-- Complete CPS composition for an addressed ordinary function call.  The
+target enters the retained callee root in one step, the smaller-fuel callee
+worker runs under an exact `.resume` handler, and that handler restores and
+runs the caller's successful continuation. -/
+theorem CompiledAttachment.simulate_traced_call_fn_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel calleeFuel callerFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration sourceAddress) sourceDefinition targetDefinition)
+    {sourceStore outputStore finalStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {values : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {value finalValue : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (sourceOperation : IxIR1.runOp sourceContext (callFuel + 1)
+      callerTrace.source sourceStore source
+        (.call sourceAddress sourceArguments) = .ok (outputStore, value))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+      sourceStore values.reverse sourceDefinition.body =
+        .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      sourceDefinition.result value)
+    (callerRuntime : Lower.Sim.SourceRuntimeInvariant outputStore
+      (value :: source))
+    (callerRun : IxIR1.runCode sourceContext callerFuel callerTrace.source
+      outputStore (value :: source) next.sourceCode =
+        .ok (finalStore, finalValue))
+    (callerResultWorld : IxIR1.Sim.HasWorld finalStore
+      callerTrace.source.result finalValue)
+    (targetDeclaration : context.declarations sourceAddress =
+      some (.fn targetDefinition))
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation callerTrace frameRoots stack
+        (finalStore, finalValue) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel)
+    (callerWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation callerFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+  let calleeFrame : Eval.Frame :=
+    { definition := targetDefinition, values := values.toArray }
+  let calleeMachine : Eval.Machine :=
+    { machine with
+      control := .running calleeFrame (.resume resume :: stack) }
+  obtain ⟨_, _, entryStores, calleeState⟩ :=
+    attached.simulate_traced_call_fn_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation)
+      calleeMember descendant
+      calleeMatch state stores sourceResolved argumentArity targetDeclaration
+      noCredits control
+  have signatureAt := attached.target.targetSignature calleeMember
+    calleeMatch.owner
+  obtain ⟨callPosition, remaining, callPositionMember,
+      callPositionCoordinate, consumed, _, entryOwnership⟩ :=
+    Lower.Sim.SourceOwnershipAt.callEntry (checked := attached.target)
+      callerMember calleeMember descendant signatureAt ownership sourceResolved
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList source ++ frameRoots
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceStore
+        values.reverse suspendedRoots := by
+    simpa [suspendedRoots] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+      values.reverse := runtime.resolveAtomsReverse sourceResolved
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel calleeTrace.source
+      sourceStore values.reverse calleeTrace.root.sourceCode =
+        .ok (outputStore, value) := by
+    rw [calleeTrace.rootSourceCode, calleeMatch.source]
+    exact calleeRun
+  have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+      calleeTrace.source.result value := by
+    simpa [calleeMatch.source] using calleeResultWorld
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame (.resume resume :: stack) := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have returnHandler : SuccessfulReturnHandler attached sourceContext context
+      interpretation calleeTrace suspendedRoots (.resume resume :: stack)
+      (outputStore, value) outcome post := by
+    intro returningTrace returnFuel returnSite returnBlock returnInput
+      returnEntryValueCount returnAtom returnTarget returnGenerated returnStore
+      returnSource returnFrame returnMachine returningMember returnDescendant
+      returnState returnStores returnRuntime returnOwnership returnRun returnWorld
+      returnControl returnNoCredits returnImage
+    obtain ⟨returnedValue, returnResolved, returnOutputEq⟩ :=
+      IxIR1.runCode_ret_success returnRun
+    have returnStoreEq : returnStore = outputStore :=
+      (congrArg Prod.fst returnOutputEq).symm
+    have returnedValueEq : returnedValue = value :=
+      (congrArg Prod.snd returnOutputEq).symm
+    subst returnStore
+    subst returnedValue
+    have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+      (checked := attached.target) returningMember returnDescendant
+        returnOwnership returnResolved
+    have calleeResultWorld'' : IxIR1.Sim.HasWorld outputStore
+        calleeTrace.generated.signature.result value := by
+      simpa [calleeTrace.sourceOrder.result] using calleeResultWorld'
+    have returnedOwnership : IxIR1.Sim.RootOwnership outputStore
+        (⟨calleeTrace.generated.signature.result, value⟩ :: suspendedRoots) :=
+      Lower.Sim.RootOwnership_reworldHead terminalOwnership calleeResultWorld''
+    have callerOwnership := Lower.Sim.SourceOwnershipAt.callResult
+      (checked := attached.target) callerMember signatureAt descendant
+      callPositionMember callPositionCoordinate ownership sourceResolved
+      consumed (by simpa [suspendedRoots] using returnedOwnership)
+    have handler : SuccessfulReturnHandler attached sourceContext context
+        interpretation returningTrace suspendedRoots
+        (.resume { frame with pc := frame.pc + 1 } :: stack)
+        (outputStore, value) outcome post :=
+      resumeReturnHandlerWithOwnership attached
+        (sourceContext := sourceContext) (callerFuel := callerFuel)
+        (operationFuel := callFuel + 1) (context := context)
+        (interpretation := interpretation) (calleeTrace := returningTrace)
+        (outcome := outcome) (post := post) callerMember descendant state
+        (binder := by rfl) (delta := by rfl) sourceDeclarations
+        sourceOperation callerRuntime callerOwnership callerRun
+        callerResultWorld noCredits finish callerWorker
+    apply handler returningMember returnDescendant returnState returnStores
+      returnRuntime returnOwnership returnRun returnWorld
+    · simpa [resume] using returnControl
+    · exact returnNoCredits
+    · exact returnImage
+  have tail := calleeWorker (machine := calleeMachine)
+    (stack := .resume resume :: stack) calleeMember
+      Lower.CodeTrace.Descendant.refl
+      calleeState entryStores calleeRuntime calleeOwnership calleeRun'
+      calleeResultWorld' calleeControl calleeNoCredits image returnHandler
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_call_fn_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation)
+      (machine := fundedMachine) calleeMember descendant calleeMatch state
+      fundedStores sourceResolved argumentArity targetDeclaration noCredits
+      fundedControl
+  refine ⟨tailHeapFuel, ?_⟩
+  simpa [fundedMachine, calleeMachine, calleeFrame, resume] using
+    tail.prepend (fundedStep.toSteps fundedControl)
+
+/-- Complete CPS composition for a recursive self-call.  The target enters
+the same retained function root, the smaller-fuel worker executes that root
+under an exact `.resume` handler, and the handler restores the caller's
+successful continuation. -/
+theorem CompiledAttachment.simulate_traced_call_self_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel calleeFuel callerFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+    {sourceStore outputStore finalStore : IxIR1.Store}
+    {source : List IxIR1.RVal} {values : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {value finalValue : IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (sourceOperation : IxIR1.runOp sourceContext (callFuel + 1)
+      functionTrace.source sourceStore source (.callSelf sourceArguments) =
+        .ok (outputStore, value))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel
+      functionTrace.source sourceStore values.reverse
+        functionTrace.source.body = .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      functionTrace.source.result value)
+    (callerRuntime : Lower.Sim.SourceRuntimeInvariant outputStore
+      (value :: source))
+    (callerRun : IxIR1.runCode sourceContext callerFuel functionTrace.source
+      outputStore (value :: source) next.sourceCode =
+        .ok (finalStore, finalValue))
+    (callerResultWorld : IxIR1.Sim.HasWorld finalStore
+      functionTrace.source.result finalValue)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack
+        (finalStore, finalValue) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel)
+    (callerWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation callerFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+  let calleeFrame : Eval.Frame :=
+    { definition := frame.definition, values := values.toArray }
+  let calleeMachine : Eval.Machine :=
+    { machine with
+      control := .running calleeFrame (.resume resume :: stack) }
+  obtain ⟨_, _, entryStores, calleeState⟩ :=
+    attached.simulate_traced_call_self_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation)
+      functionMember descendant state stores sourceResolved argumentArity
+      noCredits control
+  obtain ⟨callPosition, remaining, callPositionMember,
+      callPositionCoordinate, consumed, _, entryOwnership⟩ :=
+    Lower.Sim.SourceOwnershipAt.callSelfEntry (checked := attached.target)
+      functionMember descendant ownership sourceResolved
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList source ++ frameRoots
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions functionTrace.root sourceStore
+        values.reverse suspendedRoots := by
+    simpa [suspendedRoots] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+      values.reverse := runtime.resolveAtomsReverse sourceResolved
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel
+      functionTrace.source sourceStore values.reverse
+        functionTrace.root.sourceCode = .ok (outputStore, value) := by
+    rw [functionTrace.rootSourceCode]
+    exact calleeRun
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame (.resume resume :: stack) := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have returnHandler : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace suspendedRoots (.resume resume :: stack)
+      (outputStore, value) outcome post := by
+    intro returningTrace returnFuel returnSite returnBlock returnInput
+      returnEntryValueCount returnAtom returnTarget returnGenerated returnStore
+      returnSource returnFrame returnMachine returningMember returnDescendant
+      returnState returnStores returnRuntime returnOwnership returnRun returnWorld
+      returnControl returnNoCredits returnImage
+    obtain ⟨returnedValue, returnResolved, returnOutputEq⟩ :=
+      IxIR1.runCode_ret_success returnRun
+    have returnStoreEq : returnStore = outputStore :=
+      (congrArg Prod.fst returnOutputEq).symm
+    have returnedValueEq : returnedValue = value :=
+      (congrArg Prod.snd returnOutputEq).symm
+    subst returnStore
+    subst returnedValue
+    have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+      (checked := attached.target) returningMember returnDescendant
+        returnOwnership returnResolved
+    have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+        functionTrace.generated.signature.result value := by
+      simpa [functionTrace.sourceOrder.result] using calleeResultWorld
+    have returnedOwnership : IxIR1.Sim.RootOwnership outputStore
+        (⟨functionTrace.generated.signature.result, value⟩ :: suspendedRoots) :=
+      Lower.Sim.RootOwnership_reworldHead terminalOwnership calleeResultWorld'
+    have callerOwnership := Lower.Sim.SourceOwnershipAt.callSelfResult
+      (checked := attached.target) functionMember descendant
+      callPositionMember callPositionCoordinate ownership sourceResolved
+      consumed (by simpa [suspendedRoots] using returnedOwnership)
+    have handler : SuccessfulReturnHandler attached sourceContext context
+        interpretation returningTrace suspendedRoots
+        (.resume { frame with pc := frame.pc + 1 } :: stack)
+        (outputStore, value) outcome post :=
+      resumeReturnHandlerWithOwnership attached
+        (sourceContext := sourceContext) (callerFuel := callerFuel)
+        (operationFuel := callFuel + 1) (context := context)
+        (interpretation := interpretation) (calleeTrace := returningTrace)
+        (outcome := outcome) (post := post) functionMember descendant state
+        (binder := by rfl) (delta := by rfl) sourceDeclarations
+        sourceOperation callerRuntime callerOwnership callerRun
+        callerResultWorld noCredits finish callerWorker
+    apply handler returningMember returnDescendant returnState returnStores
+      returnRuntime returnOwnership returnRun returnWorld
+    · simpa [resume] using returnControl
+    · exact returnNoCredits
+    · exact returnImage
+  have tail := calleeWorker (machine := calleeMachine)
+    (stack := .resume resume :: stack) functionMember
+      Lower.CodeTrace.Descendant.refl calleeState entryStores calleeRuntime
+      calleeOwnership calleeRun' calleeResultWorld calleeControl
+      calleeNoCredits image returnHandler
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_call_self_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation)
+      (machine := fundedMachine) functionMember descendant state fundedStores
+      sourceResolved argumentArity noCredits fundedControl
+  refine ⟨tailHeapFuel, ?_⟩
+  simpa [fundedMachine, calleeMachine, calleeFrame, resume] using
+    tail.prepend (fundedStep.toSteps fundedControl)
+
+/-- Complete CPS composition for an addressed tail call.  Because the target
+keeps the continuation stack unchanged, the stack-generic return handler is
+passed directly to the retained callee worker. -/
+theorem CompiledAttachment.simulate_traced_tail_call_fn_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel calleeFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation}
+    {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {address : Ixon.Address} {sourceArguments : Array IxIR1.Atom}
+    {generated : Block}
+    (descendant : callerTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated))
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    {sourceStore outputStore : IxIR1.Store}
+    {source values : List IxIR1.RVal} {value : IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (state : attached.sidecars.TraceStateRel callerTrace
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) sourceStore source frameRoots)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (sourceRun : IxIR1.runCode sourceContext (callFuel + 2)
+      callerTrace.source sourceStore source
+        (.letOp (.call address sourceArguments) (.ret (.var 0))) =
+          .ok (outputStore, value))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel sourceDefinition
+      sourceStore values.reverse sourceDefinition.body =
+        .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      sourceDefinition.result value)
+    (targetDeclaration : context.declarations address =
+      some (.fn targetDefinition))
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation callerTrace frameRoots stack
+        (outputStore, value) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let calleeFrame : Eval.Frame :=
+    { definition := targetDefinition, values := values.toArray }
+  let calleeMachine : Eval.Machine :=
+    { machine with control := .running calleeFrame stack }
+  obtain ⟨sourceEquation, targetStep, entryStores, calleeState⟩ :=
+    attached.simulate_traced_tail_call_fn_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation) calleeMember
+      descendant calleeMatch state stores sourceResolved argumentArity
+      targetDeclaration noCredits control
+  have signatureAt := attached.target.targetSignature calleeMember
+    calleeMatch.owner
+  have calleeOwnership := Lower.Sim.SourceOwnershipAt.tailCallEntry
+    (checked := attached.target) callerMember calleeMember descendant
+      signatureAt ownership sourceResolved
+  have invokeRun : IxIR1.invoke sourceContext callFuel address values
+      sourceStore = .ok (outputStore, value) := by
+    rw [← sourceEquation]
+    exact sourceRun
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+      values.reverse := runtime.resolveAtomsReverse sourceResolved
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel calleeTrace.source
+      sourceStore values.reverse calleeTrace.root.sourceCode =
+        .ok (outputStore, value) := by
+    rw [calleeTrace.rootSourceCode, calleeMatch.source]
+    exact calleeRun
+  have calleeResultWorld' : IxIR1.Sim.HasWorld outputStore
+      calleeTrace.source.result value := by
+    simpa [calleeMatch.source] using calleeResultWorld
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame stack := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have tail := calleeWorker (machine := calleeMachine) (stack := stack)
+    calleeMember Lower.CodeTrace.Descendant.refl calleeState entryStores
+      calleeRuntime calleeOwnership calleeRun' calleeResultWorld' calleeControl
+      calleeNoCredits image finish
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_tail_call_fn_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation)
+      (machine := fundedMachine) calleeMember descendant calleeMatch state
+      fundedStores sourceResolved argumentArity targetDeclaration noCredits
+      fundedControl
+  refine ⟨tailHeapFuel, ?_⟩
+  simpa [fundedMachine, calleeMachine, calleeFrame] using
+    tail.prepend (fundedStep.toSteps fundedControl)
+
+/-- Complete CPS composition for a recursive self tail call.  The same trace
+root is re-entered with the existing continuation stack and return handler. -/
+theorem CompiledAttachment.simulate_traced_tail_call_self_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel calleeFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated))
+    {sourceStore outputStore : IxIR1.Store}
+    {source values : List IxIR1.RVal} {value : IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) sourceStore source frameRoots)
+    (sourceResolved :
+      IxIR1.resolveAtoms source sourceArguments = .ok values)
+    (argumentArity : functionTrace.source.arity = values.length)
+    (sourceRun : IxIR1.runCode sourceContext (callFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.callSelf sourceArguments) (.ret (.var 0))) =
+          .ok (outputStore, value))
+    (calleeRun : IxIR1.runCode sourceContext calleeFuel
+      functionTrace.source sourceStore values.reverse
+        functionTrace.source.body = .ok (outputStore, value))
+    (calleeResultWorld : IxIR1.Sim.HasWorld outputStore
+      functionTrace.source.result value)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {outcome : IxIR1.Store × IxIR1.RVal} {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack
+        (outputStore, value) outcome post)
+    (calleeWorker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation calleeFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  let calleeFrame : Eval.Frame :=
+    { definition := frame.definition, values := values.toArray }
+  let calleeMachine : Eval.Machine :=
+    { machine with control := .running calleeFrame stack }
+  obtain ⟨sourceEquation, targetStep, entryStores, calleeState⟩ :=
+    attached.simulate_traced_tail_call_self_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation) functionMember
+      descendant state stores sourceResolved argumentArity noCredits control
+  have calleeOwnership := Lower.Sim.SourceOwnershipAt.tailCallSelfEntry
+    (checked := attached.target) functionMember descendant ownership
+      sourceResolved
+  have sourceEquationRun : (do
+      let out ← IxIR1.runCode sourceContext callFuel functionTrace.source
+        sourceStore values.reverse functionTrace.source.body
+      IxIR1.checkResultWorld functionTrace.source.result out) =
+        .ok (outputStore, value) := by
+    rw [← sourceEquation]
+    exact sourceRun
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+      values.reverse := runtime.resolveAtomsReverse sourceResolved
+  have calleeRun' : IxIR1.runCode sourceContext calleeFuel
+      functionTrace.source sourceStore values.reverse
+        functionTrace.root.sourceCode = .ok (outputStore, value) := by
+    rw [functionTrace.rootSourceCode]
+    exact calleeRun
+  have calleeControl : calleeMachine.control =
+      .running calleeFrame stack := rfl
+  have calleeNoCredits : calleeFrame.credits = #[] := rfl
+  have tail := calleeWorker (machine := calleeMachine) (stack := stack)
+    functionMember Lower.CodeTrace.Descendant.refl calleeState entryStores
+      calleeRuntime calleeOwnership calleeRun' calleeResultWorld calleeControl
+      calleeNoCredits image finish
+  obtain ⟨tailHeapFuel, tail⟩ := tail
+  let fundedMachine : Eval.Machine := { machine with heapFuel := tailHeapFuel }
+  have fundedStores : Lower.Sim.StoreRel sourceStore fundedMachine.store := by
+    simpa [fundedMachine] using stores
+  have fundedControl : fundedMachine.control = .running frame stack := by
+    simpa [fundedMachine] using control
+  obtain ⟨_, fundedStep, _, _⟩ :=
+    attached.simulate_traced_tail_call_self_enter_state
+      (sourceContext := sourceContext) (sourceFuel := callFuel)
+      (context := context) (interpretation := interpretation)
+      (machine := fundedMachine) functionMember descendant state fundedStores
+      sourceResolved argumentArity noCredits fundedControl
+  refine ⟨tailHeapFuel, ?_⟩
+  simpa [fundedMachine, calleeMachine, calleeFrame] using
+    tail.prepend (fundedStep.toSteps fundedControl)
+
+/-- Worker-facing addressed tail-call rule.  Successful source evaluation is
+inverted here to recover the retained callee, its smaller body fuel, and its
+checked result world; the exhaustive induction only supplies workers below
+the current outer fuel. -/
+theorem CompiledAttachment.simulate_traced_tail_call_cps_of_run
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (contracts : SuccessfulSimulationContracts attached sourceContext context)
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {address : Ixon.Address} {sourceArguments : Array IxIR1.Atom}
+    {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (callFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.call address sourceArguments) (.ret (.var 0))) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (workers : ∀ fuel, fuel < callFuel + 2 →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨values, sourceResolved, invokeRun⟩ :=
+    IxIR1.runOp_call_success operationRun
+  obtain ⟨calleeFuel, callFuelEq, invoked⟩ :=
+    IxIR1.invoke_success invokeRun
+  obtain ⟨returnedValue, returnedResolved, sourceOutputEq⟩ :=
+    IxIR1.runCode_ret_success continuationRun
+  have returnedValueEq : returnedValue = operationValue := by
+    simpa [IxIR1.resolveAtom] using returnedResolved.symm
+  subst returnedValue
+  subst sourceOutput
+  cases invoked with
+  | @fn sourceDefinition bodyOutput sourceDeclaration argumentArity calleeRun
+      resultRun =>
+      obtain ⟨bodyOutputEq, calleeResultWorld⟩ :=
+        IxIR1.Sim.checkResultWorld_ok resultRun
+      cases bodyOutputEq
+      obtain ⟨targetDefinition, calleeTrace, calleeMember, calleeMatch,
+          targetDeclaration⟩ :=
+        attached.functionTrace_of_source_declaration
+          contracts.sourceDeclarations contracts.targetDeclarations
+            sourceDeclaration
+      exact attached.simulate_traced_tail_call_fn_cps functionMember
+        calleeMember descendant calleeMatch state stores runtime ownership
+          sourceResolved argumentArity.symm sourceRun calleeRun
+          calleeResultWorld targetDeclaration control noCredits image finish
+          (workers calleeFuel (by omega))
+  | @extern arity value sourceDeclaration _ _ _ =>
+      exact False.elim (attached.sourceDeclaration_not_extern
+        contracts.sourceDeclarations sourceDeclaration)
+
+/-- Worker-facing self-tail-call rule, with evaluator inversion and result
+checking discharged before entering the existing CPS adapter. -/
+theorem CompiledAttachment.simulate_traced_tail_call_self_cps_of_run
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (descendant : functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (callFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.callSelf sourceArguments) (.ret (.var 0))) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (workers : ∀ fuel, fuel < callFuel + 2 →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨values, bodyOutput, sourceResolved, argumentArity, calleeRun,
+      resultRun⟩ := IxIR1.runOp_callSelf_success operationRun
+  obtain ⟨returnedValue, returnedResolved, sourceOutputEq⟩ :=
+    IxIR1.runCode_ret_success continuationRun
+  have returnedValueEq : returnedValue = operationValue := by
+    simpa [IxIR1.resolveAtom] using returnedResolved.symm
+  subst returnedValue
+  subst sourceOutput
+  obtain ⟨bodyOutputEq, calleeResultWorld⟩ :=
+    IxIR1.Sim.checkResultWorld_ok resultRun
+  cases bodyOutputEq
+  exact attached.simulate_traced_tail_call_self_cps functionMember descendant
+    state stores runtime ownership sourceResolved argumentArity.symm sourceRun
+      calleeRun calleeResultWorld control noCredits image finish
+      (workers callFuel (by omega))
+
+/-- Worker-facing addressed call rule for an ordinary `letOp`.  Source
+evaluation determines the retained callee and both recursive fuels; the
+shared no-reuse contract transports the caller runtime across invocation. -/
+theorem CompiledAttachment.simulate_traced_call_cps_of_run
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (contracts : SuccessfulSimulationContracts attached sourceContext context)
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (callFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.call sourceAddress sourceArguments) next.sourceCode) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (workers : ∀ fuel, fuel < callFuel + 2 →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨values, sourceResolved, invokeRun⟩ :=
+    IxIR1.runOp_call_success operationRun
+  obtain ⟨calleeFuel, callFuelEq, invoked⟩ :=
+    IxIR1.invoke_success invokeRun
+  cases invoked with
+  | @fn sourceDefinition bodyOutput sourceDeclaration argumentArity calleeRun
+      resultRun =>
+      obtain ⟨bodyOutputEq, calleeResultWorld⟩ :=
+        IxIR1.Sim.checkResultWorld_ok resultRun
+      cases bodyOutputEq
+      obtain ⟨targetDefinition, calleeTrace, calleeMember, calleeMatch,
+          targetDeclaration⟩ :=
+        attached.functionTrace_of_source_declaration
+          contracts.sourceDeclarations contracts.targetDeclarations
+            sourceDeclaration
+      have callerRuntime : Lower.Sim.SourceRuntimeInvariant middleStore
+          (operationValue :: source) :=
+        runtime.runOp
+          (IxIR1.NoReuse.invoke_reuses_eq
+            (attached.sourceContextNoReuse contracts.sourceDeclarations)
+            invokeRun)
+          operationRun
+      exact attached.simulate_traced_call_fn_cps functionMember calleeMember
+        descendant calleeMatch state stores runtime ownership
+          contracts.sourceDeclarations sourceResolved argumentArity.symm
+          operationRun calleeRun calleeResultWorld callerRuntime
+          continuationRun resultWorld targetDeclaration control noCredits
+          image finish (workers calleeFuel (by omega))
+          (workers (callFuel + 1) (by omega))
+  | @extern arity value sourceDeclaration _ _ _ =>
+      exact False.elim (attached.sourceDeclaration_not_extern
+        contracts.sourceDeclarations sourceDeclaration)
+
+/-- Worker-facing recursive self-call rule for an ordinary `letOp`.  The
+function-level no-reuse certificate supplies the caller runtime invariant
+after the checked callee result is returned. -/
+theorem CompiledAttachment.simulate_traced_call_self_cps_of_run
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {callFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (contracts : SuccessfulSimulationContracts attached sourceContext context)
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (callFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp (.callSelf sourceArguments) next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (workers : ∀ fuel, fuel < callFuel + 2 →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  obtain ⟨values, bodyOutput, sourceResolved, argumentArity, calleeRun,
+      resultRun⟩ := IxIR1.runOp_callSelf_success operationRun
+  obtain ⟨bodyOutputEq, calleeResultWorld⟩ :=
+    IxIR1.Sim.checkResultWorld_ok resultRun
+  cases bodyOutputEq
+  have callerRuntime : Lower.Sim.SourceRuntimeInvariant middleStore
+      (operationValue :: source) :=
+    runtime.runOp
+      (IxIR1.NoReuse.runOp_reuses_eq
+        (attached.sourceContextNoReuse contracts.sourceDeclarations)
+        (attached.functionTraceNoReuse functionMember) (by trivial)
+        operationRun)
+      operationRun
+  exact attached.simulate_traced_call_self_cps functionMember descendant state
+    stores runtime ownership contracts.sourceDeclarations sourceResolved
+      argumentArity.symm operationRun calleeRun calleeResultWorld callerRuntime
+      continuationRun resultWorld control noCredits image finish
+      (workers callFuel (by omega)) (workers (callFuel + 1) (by omega))
+
+/-- Worker-facing dynamic-application rule.  The successful evaluator run is
+decomposed into the erased, under-saturated, exactly saturated, or
+over-saturated PAP plan; each plan constructor feeds the corresponding CPS
+adapter, including the recursive `applyMore` return handler. -/
+theorem CompiledAttachment.simulate_traced_apply_cps_of_run
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    (contracts : SuccessfulSimulationContracts attached sourceContext context)
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceFunction : IxIR1.Atom}
+    {targetFunction : Atom} {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (applyFuel + 3)
+      functionTrace.source sourceStore source
+        (.letOp (.apply sourceFunction sourceArguments) next.sourceCode) =
+          .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (workers : ∀ fuel, fuel < applyFuel + 3 →
+      SuccessfulTraceSimulationAt attached sourceContext context
+        interpretation fuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+    IxIR1.runCode_letOp_success sourceRun
+  have middleImage : attached.SourceStoreImage middleStore :=
+    attached.runOp_preservesSourceStoreImage contracts.sourceDeclarations
+      functionMember descendant state image operationRun
+  obtain ⟨functionValue, values, functionResolved, argumentsResolved,
+      applyRun⟩ := IxIR1.runOp_apply_success operationRun
+  have plan := attached.applyMorePlan_of_applyGo
+    contracts.sourceDeclarations contracts.targetDeclarations applyRun
+  have callerRuntime : Lower.Sim.SourceRuntimeInvariant middleStore
+      (operationValue :: source) :=
+    runtime.runOp
+      (IxIR1.NoReuse.applyGo_reuses_eq
+        (attached.sourceContextNoReuse contracts.sourceDeclarations)
+        applyRun)
+      operationRun
+  have callerOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next middleStore
+        (operationValue :: source) frameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      functionMember descendant ownership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          contracts.sourceDeclarations image) operationRun
+  have nextDescendant : functionTrace.root.Descendant next := by
+    exact .step descendant (by simp [Lower.CodeTrace.children])
+  cases plan with
+  | @erased fuel planStore planReleased planValues sourceRelease =>
+      exact attached.simulate_traced_apply_erased_cps functionMember descendant
+        state stores runtime ownership contracts.sourceDeclarations
+          functionResolved argumentsResolved sourceRelease
+          sourceRun resultWorld control noCredits image finish
+          (workers (applyFuel + 2) (by omega))
+  | @papUnder fuel planStore retainedStore releasedStore location box address
+      arity captured planValues sourceGet node sourceRetain sourceRelease
+      totalUnder =>
+      obtain ⟨shared, capturedUnder⟩ := attached.livePapFacts functionMember
+        descendant runtime ownership sourceGet node
+      exact attached.simulate_traced_apply_pap_under_cps functionMember
+        descendant state stores runtime ownership contracts.sourceDeclarations
+          functionResolved argumentsResolved sourceGet shared node capturedUnder
+          sourceRetain sourceRelease totalUnder sourceRun resultWorld control
+          noCredits image finish
+          (workers (applyFuel + 2) (by omega))
+  | @papSaturatedFn fuel calleeFuel planStore retainedStore releasedStore
+      planOutputStore location box address arity captured planValues
+      sourceDefinition targetDefinition calleeTrace planOutputValue calleeMember
+      calleeMatch sourceGet node sourceRetain sourceRelease totalExact papArity
+      sourceDeclaration sourcePapSafe targetDeclaration calleeRun
+      calleeResultWorld calleeSmaller =>
+      obtain ⟨shared, capturedUnder⟩ := attached.livePapFacts functionMember
+        descendant runtime ownership sourceGet node
+      exact attached.simulate_traced_apply_pap_saturated_cps functionMember
+        calleeMember descendant calleeMatch state stores runtime ownership
+          contracts.sourceDeclarations functionResolved argumentsResolved
+          sourceGet shared node capturedUnder sourceRetain sourceRelease
+          totalExact papArity sourceDeclaration sourcePapSafe targetDeclaration
+          operationRun calleeRun calleeResultWorld callerRuntime continuationRun
+          resultWorld control noCredits image finish
+          (workers calleeFuel (by omega))
+          (workers (applyFuel + 2) (by omega))
+  | @papOverFn fuel calleeFuel planStore retainedStore releasedStore calledStore
+      planOutputStore location box address arity captured planValues
+      sourceDefinition targetDefinition calleeTrace calledValue planOutputValue
+      calleeMember calleeMatch sourceGet node sourceRetain sourceRelease
+      totalOver papArity sourceDeclaration sourcePapSafe targetDeclaration
+      calleeRun calleeResultWorld calleeSmaller residual =>
+      obtain ⟨shared, capturedUnder⟩ := attached.livePapFacts functionMember
+        descendant runtime ownership sourceGet node
+      obtain ⟨_, _, _, _, _, _, _, _, _, _, _, callerTargets⟩ :=
+        attached.simulate_traced_apply_pap_over_enter_state
+          (context := context) (interpretation := interpretation)
+          functionMember calleeMember descendant calleeMatch state stores
+          runtime.positiveSharedRC contracts.sourceDeclarations
+          functionResolved argumentsResolved sourceGet shared node
+          capturedUnder sourceRetain sourceRelease totalOver papArity
+          sourceDeclaration sourcePapSafe targetDeclaration noCredits control
+      let resume : Eval.Frame := { frame with pc := frame.pc + 1 }
+      let nextFrame : Eval.Frame :=
+        { frame with
+          pc := frame.pc + 1
+          values := frame.values.push operationValue }
+      have nextState : attached.sidecars.TraceStateRel functionTrace next
+          middleStore (operationValue :: source) nextFrame := by
+        simpa [nextFrame] using
+          (callerTargets middleStore operationValue operationRun)
+      have nextNoCredits : nextFrame.credits = #[] := by
+        simpa [nextFrame] using noCredits
+      have continuation : SuccessfulResumeContinuation context interpretation
+        resume stack (middleStore, operationValue) outcome post :=
+        resumeContinuationOfWorker attached functionMember nextDescendant
+          (by rfl) nextState callerRuntime middleImage callerOwnership continuationRun
+          resultWorld nextNoCredits finish
+          (workers (applyFuel + 2) (by omega))
+      have nextHandler : ∀ remaining : Array Lower.BindingCap,
+          SuccessfulReturnHandler attached sourceContext context interpretation
+            calleeTrace
+            (IxIR1.Sim.rootsFor .shared
+                ((captured.toList ++ values).drop arity) ++
+              Lower.Sim.rootsForCapabilities remaining.toList source ++
+                frameRoots)
+            (.applyMore
+                ((captured ++ values.toArray).extract arity
+                  (captured ++ values.toArray).size)
+                { frame with pc := frame.pc + 1 } :: stack)
+            (calledStore, calledValue) outcome post := by
+        intro remaining
+        have handler : SuccessfulReturnHandler attached sourceContext context
+            interpretation calleeTrace
+            (IxIR1.Sim.rootsFor .shared
+                ((captured.toList ++ values).drop arity) ++
+              (Lower.Sim.rootsForCapabilities remaining.toList source ++
+                frameRoots))
+            (.applyMore ((captured.toList ++ values).drop arity).toArray
+              resume :: stack)
+          (calledStore, calledValue) outcome post :=
+          attached.applyMoreReturnHandler_of_plan contracts.sourceDeclarations
+            residual
+            (fun recursiveFuel smaller =>
+              workers recursiveFuel (by omega))
+            continuation calleeTrace
+            (Lower.Sim.rootsForCapabilities remaining.toList source ++
+              frameRoots)
+        intro returningTrace returnFuel returnSite returnBlock returnInput
+          returnEntryValueCount returnAtom returnTarget returnGenerated
+          returnStore returnSource returnFrame returnMachine returningMember
+          returnDescendant returnState returnStores returnRuntime
+          returnOwnership returnRun returnWorld returnControl returnNoCredits
+          returnImage
+        apply handler returningMember returnDescendant returnState returnStores
+          returnRuntime
+        · simpa [List.append_assoc] using returnOwnership
+        · exact returnRun
+        · exact returnWorld
+        · have remainingArrayEq :
+              ((captured ++ values.toArray).extract arity
+                (captured ++ values.toArray).size) =
+                ((captured.toList ++ values).drop arity).toArray := by
+            rw [show captured ++ values.toArray =
+                (captured.toList ++ values).toArray by
+              apply Array.toList_inj.mp
+              simp]
+            exact List.toArray_drop.symm
+          rw [← remainingArrayEq]
+          simpa [resume] using returnControl
+        · exact returnNoCredits
+        · exact returnImage
+      exact attached.simulate_traced_apply_pap_over_cps functionMember
+        calleeMember descendant calleeMatch state stores runtime ownership
+          contracts.sourceDeclarations functionResolved argumentsResolved
+          sourceGet shared node capturedUnder sourceRetain sourceRelease
+          totalOver papArity sourceDeclaration sourcePapSafe targetDeclaration
+          calleeRun calleeResultWorld control noCredits image nextHandler
+          (workers calleeFuel (by omega))
+
+/-- Exhaustive worker-facing rule for a traced source operation.  Checked
+operation syntax leaves exactly one target instruction in every executable
+case.  Reuse has no legal IxIR₂ syntax, retained extern operations are ruled
+out by attachment, and dynamic apply consumes one additional evaluator fuel
+constructor before entering its complete PAP plan. -/
+theorem CompiledAttachment.simulate_traced_letOp_cps_of_run
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {operationFuel : Nat}
+    {context : Eval.Context}
+    (contracts : SuccessfulSimulationContracts attached sourceContext context)
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) sourceStore source frameRoots)
+    (sourceRun : IxIR1.runCode sourceContext (operationFuel + 2)
+      functionTrace.source sourceStore source
+        (.letOp operation next.sourceCode) = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context .logical
+      functionTrace frameRoots stack sourceOutput outcome post)
+    (workers : ∀ fuel, fuel < operationFuel + 2 →
+      SuccessfulTraceSimulationAt attached sourceContext context .logical fuel) :
+    BudgetedReachesPost context .logical post outcome.1 outcome.2 machine := by
+  have operationSyntax :=
+    functionTrace.descendantOperationSyntax descendant
+  cases operation with
+  | pure sourceAtom =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case move targetAtom =>
+        exact attached.simulate_traced_pure_move_cps functionMember descendant
+          state stores runtime ownership contracts.sourceDeclarations sourceRun
+          resultWorld control noCredits image finish
+          (workers (operationFuel + 1) (by omega))
+  | alloc sourceWorld sourceCid sourceArguments =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case alloc targetWorld targetCid targetArguments =>
+        exact attached.simulate_traced_alloc_checked_cps functionMember
+          contracts.targetSchemas descendant state stores runtime
+          contracts.sourceDeclarations ownership sourceRun resultWorld control
+          noCredits image finish (workers (operationFuel + 1) (by omega))
+  | reuse sourceTarget sourceCid sourceArguments =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case freeUnique targetAtom targetCid =>
+        exact attached.simulate_traced_free_freeUnique_cps functionMember
+          descendant state stores runtime ownership
+          contracts.sourceDeclarations sourceRun resultWorld control noCredits
+          image finish (workers (operationFuel + 1) (by omega))
+  | dup sourceAtom =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case retainShared targetAtom =>
+        exact attached.simulate_traced_dup_retain_cps functionMember descendant
+          state stores runtime ownership contracts.sourceDeclarations sourceRun
+          resultWorld control noCredits image finish
+          (workers (operationFuel + 1) (by omega))
+  | drop sourceAtom =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case releaseShared targetAtom =>
+        exact attached.simulate_traced_drop_release_cps functionMember
+          descendant state stores runtime ownership
+          contracts.sourceDeclarations sourceRun resultWorld control noCredits
+          image finish (workers (operationFuel + 1) (by omega))
+  | dropU sourceAtom =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case dropUnique targetAtom =>
+        exact attached.simulate_traced_dropU_dropUnique_cps functionMember
+          descendant state stores runtime ownership
+          contracts.sourceDeclarations sourceRun resultWorld control noCredits
+          image finish (workers (operationFuel + 1) (by omega))
+  | fetch sourceAtom sourceField =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case fetch targetAtom targetCid targetField =>
+        exact attached.simulate_traced_fetch_cps functionMember descendant state
+          stores runtime ownership contracts.sourceDeclarations sourceRun
+          resultWorld control noCredits image finish
+          (workers (operationFuel + 1) (by omega))
+  | call sourceAddress sourceArguments =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case call targetAddress targetArguments =>
+        exact attached.simulate_traced_call_cps_of_run contracts functionMember
+          descendant state stores runtime ownership sourceRun resultWorld
+          control noCredits image finish workers
+  | callSelf sourceArguments =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case callSelf targetArguments =>
+        exact attached.simulate_traced_call_self_cps_of_run contracts
+          functionMember descendant state stores runtime ownership sourceRun
+          resultWorld control noCredits image finish workers
+  | papp sourceAddress sourceArguments =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case papp targetAddress targetArguments =>
+        obtain ⟨middleStore, operationValue, operationRun, continuationRun⟩ :=
+          IxIR1.runCode_letOp_success sourceRun
+        obtain ⟨values, declaration, sourceResolved, sourceDeclaration,
+            under, operationOutput⟩ :=
+          IxIR1.runOp_papp_success operationRun
+        cases declaration with
+        | extern arity =>
+            exact False.elim (attached.sourceDeclaration_not_extern
+              contracts.sourceDeclarations sourceDeclaration)
+        | fn sourceDefinition =>
+            obtain ⟨targetDefinition, calleeTrace, calleeMember, calleeMatch,
+                targetDeclaration⟩ :=
+              attached.functionTrace_of_source_declaration
+                contracts.sourceDeclarations contracts.targetDeclarations
+                  sourceDeclaration
+            have sourcePapSafe : sourceDefinition.papSafe = true :=
+              attached.pappSafe contracts.sourceDeclarations functionMember
+                descendant sourceDeclaration
+            have targetArity : targetDefinition.signature.params.size =
+                sourceDefinition.arity := by
+              calc
+                targetDefinition.signature.params.size =
+                    calleeTrace.generated.signature.params.size := by
+                  rw [calleeMatch.generated]
+                _ = calleeTrace.source.arity := calleeTrace.sourceArity
+                _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+                  calleeMatch.source
+            have targetPapSafe : targetDefinition.signature.papSafe = true := by
+              calc
+                targetDefinition.signature.papSafe =
+                    calleeTrace.generated.signature.papSafe := by
+                  rw [calleeMatch.generated]
+                _ = calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+                _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+                  calleeMatch.source
+                _ = true := sourcePapSafe
+            exact attached.simulate_traced_papp_fn_cps functionMember
+              descendant state stores runtime ownership
+                contracts.sourceDeclarations sourceDeclaration
+                targetDeclaration targetArity targetPapSafe sourceRun
+                resultWorld control noCredits image finish
+                (workers (operationFuel + 1) (by omega))
+  | apply sourceFunction sourceArguments =>
+      cases instruction <;>
+        simp only [Lower.OperationSyntax] at operationSyntax
+      case apply targetFunction targetArguments =>
+        cases operationFuel with
+        | zero =>
+            obtain ⟨middleStore, operationValue, operationRun,
+                continuationRun⟩ := IxIR1.runCode_letOp_success sourceRun
+            obtain ⟨functionValue, values, functionResolved,
+                argumentsResolved, applyRun⟩ :=
+              IxIR1.runOp_apply_success operationRun
+            have impossible := attached.applyMorePlan_of_applyGo
+              contracts.sourceDeclarations contracts.targetDeclarations
+                applyRun
+            cases impossible
+        | succ applyFuel =>
+            exact attached.simulate_traced_apply_cps_of_run contracts
+              functionMember descendant state stores runtime ownership
+              sourceRun resultWorld control noCredits image finish
+              (fun fuel smaller => workers fuel (by omega))
+  | extern sourceAddress sourceArguments =>
+      exact False.elim
+        (attached.sourceExtern_impossible functionMember descendant)
+
+/-- Complete CPS composition for a literal-zero switch branch. The checked
+branch certificate supplies both the exact recursive child and a target step
+that preserves the continuation's chosen heap budget. -/
+theorem CompiledAttachment.simulate_traced_switch_nat_zero_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frameRoots)
+    {alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat 0)))
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives 0 =
+      some (.mk 0 0 body, alternativeIndex))
+    (branchRun : IxIR1.runCode sourceContext sourceFuel functionTrace.source
+      sourceStore source body = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation sourceFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨constructors, peel, branches, childFrame, terminator, edgeMember,
+      childMember, selected, childSource, childCode, targetStep,
+      targetPreserving, childNoCredits, childTarget⟩ :=
+    Lower.Sim.simulate_traced_switch_nat_zero_state descendant state.target
+      sourceResolved control noCredits
+  have selectedEq :
+      (IxIR1.Alt.mk 0 0 branches.zero.body,
+          branches.zero.alternativeIndex) =
+        (.mk 0 0 body, alternativeIndex) :=
+    Option.some.inj (selected.symm.trans sourceAlternative)
+  have bodyEq : branches.zero.body = body :=
+    congrArg (fun pair : IxIR1.Alt × Nat =>
+      match pair.1 with | .mk _ _ code => code) selectedEq
+  have childRun : IxIR1.runCode sourceContext sourceFuel
+      functionTrace.source sourceStore source
+        branches.zeroChild.sourceCode = .ok sourceOutput := by
+    rw [childCode, bodyEq]
+    exact branchRun
+  have childState := state.natZeroChild selected childSource childCode
+    childTarget
+  have childDescendant :
+      functionTrace.root.Descendant branches.zeroChild :=
+    .step descendant childMember
+  have parentEnvironments : Lower.Sim.EnvRel source frame.values input := by
+    simpa [Lower.CodeTrace.sourceInputMap] using state.target.environments
+  have childOwnership := Lower.Sim.SourceOwnershipAt.switchNatZero
+    attached.target functionMember descendant terminator branches ownership
+      parentEnvironments
+  let childMachine : Eval.Machine :=
+    { machine with control := .running childFrame stack }
+  have childStores : Lower.Sim.StoreRel sourceStore childMachine.store := by
+    simpa [childMachine] using stores
+  have childControl : childMachine.control =
+      .running childFrame stack := rfl
+  have tail := worker (machine := childMachine) (stack := stack)
+    functionMember childDescendant childState childStores runtime childOwnership
+      childRun resultWorld childControl childNoCredits image finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := childMachine) (prefixCount := 1) ?_ tail
+  intro heapFuel
+  have fundedControl : ({ machine with heapFuel } : Eval.Machine).control =
+      .running frame stack := by
+    simpa using control
+  simpa [childMachine] using
+    (targetPreserving heapFuel).toSteps fundedControl
+
+/-- Complete CPS composition for a literal-successor switch branch. The
+peeled predecessor becomes the child's scalar head and ownership lenders are
+shifted in lockstep with the target parameter prefix. -/
+theorem CompiledAttachment.simulate_traced_switch_nat_succ_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {predecessor : Nat} {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frameRoots)
+    {alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives 1 =
+      some (.mk 1 1 body, alternativeIndex))
+    (branchRun : IxIR1.runCode sourceContext sourceFuel functionTrace.source
+      sourceStore (.lit (.nat predecessor) :: source) body =
+        .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation sourceFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨constructors, peel, branches, childFrame, terminator, edgeMember,
+      childMember, selected, childSource, childCode, targetStep,
+      targetPreserving, childNoCredits, childTarget⟩ :=
+    Lower.Sim.simulate_traced_switch_nat_succ_state descendant state.target
+      sourceResolved control noCredits
+  have selectedEq :
+      (IxIR1.Alt.mk 1 1 branches.succ.body,
+          branches.succ.alternativeIndex) =
+        (.mk 1 1 body, alternativeIndex) :=
+    Option.some.inj (selected.symm.trans sourceAlternative)
+  have bodyEq : branches.succ.body = body :=
+    congrArg (fun pair : IxIR1.Alt × Nat =>
+      match pair.1 with | .mk _ _ code => code) selectedEq
+  have childRun : IxIR1.runCode sourceContext sourceFuel
+      functionTrace.source sourceStore
+        (.lit (.nat predecessor) :: source)
+        branches.succChild.sourceCode = .ok sourceOutput := by
+    rw [childCode, bodyEq]
+    exact branchRun
+  have childState := state.natSuccChild selected childSource childCode
+    sourceResolved childTarget
+  have childDescendant :
+      functionTrace.root.Descendant branches.succChild :=
+    .step descendant childMember
+  have parentEnvironments : Lower.Sim.EnvRel source frame.values input := by
+    simpa [Lower.CodeTrace.sourceInputMap] using state.target.environments
+  have childOwnership := Lower.Sim.SourceOwnershipAt.switchNatSucc
+    attached.target functionMember descendant terminator branches ownership
+      parentEnvironments (predecessor := predecessor)
+  have childRuntime := runtime.natSuccessor predecessor
+  let childMachine : Eval.Machine :=
+    { machine with control := .running childFrame stack }
+  have childStores : Lower.Sim.StoreRel sourceStore childMachine.store := by
+    simpa [childMachine] using stores
+  have childControl : childMachine.control =
+      .running childFrame stack := rfl
+  have tail := worker (machine := childMachine) (stack := stack)
+    functionMember childDescendant childState childStores childRuntime
+      childOwnership childRun resultWorld childControl childNoCredits image finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := childMachine) (prefixCount := 1) ?_ tail
+  intro heapFuel
+  have fundedControl : ({ machine with heapFuel } : Eval.Machine).control =
+      .running frame stack := by
+    simpa using control
+  simpa [childMachine] using
+    (targetPreserving heapFuel).toSteps fundedControl
+
+/-- Complete CPS composition for a constructor switch branch. The target
+dispatch and certified fetch prologue enter the exact recursive child, while
+the attached schema invariant turns every fetched field into a borrow from
+the selected constructor root. -/
+theorem CompiledAttachment.simulate_traced_switch_ctor_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array IxIR1.RVal} {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frameRoots)
+    (sourceResolved : IxIR1.resolveAtom source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child)
+    (branchRun : IxIR1.runCode sourceContext sourceFuel functionTrace.source
+      sourceStore (fields.toList.reverse ++ source) body = .ok sourceOutput)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation sourceFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  obtain ⟨childFrame, _edgeFrame, _childScrutinee, childSource, childCode,
+      targetSteps, targetPreserving, childNoCredits, nextStores, childTarget,
+      _parentBlockAt, _parentPc, _targetResolved, _targetGet, _transferred,
+      _switchStep, _childBlockAt, _childPc, _childResolved, _prologue⟩ :=
+    Lower.Sim.simulate_traced_switch_ctor_state descendant state.target stores
+      sourceResolved sourceGet node sourceAlternative fieldArity terminator
+      targetAt targetAlternative edgeAt childAt control noCredits
+  have recursiveMatched :=
+    functionTrace.descendantSwitchBranchesMatch descendant
+  have localMatched :=
+    Lower.CodeTrace.switchNodeBranchesMatch_of_match recursiveMatched
+  have branch := Lower.constructorBranchMatchAt_of_switch_match
+    localMatched terminator targetAt edgeAt childAt
+  have targetCid : target.cid = cid := by
+    have matched : (target.cid == cid) = true := Array.find?_some
+      (p := fun candidate : CtorAlt => candidate.cid == cid)
+      (a := target) (xs := constructors) targetAlternative
+    exact beq_iff_eq.mp matched
+  have branchAlternative := branch.sourceAlternative
+  rw [targetCid, sourceAlternative] at branchAlternative
+  have alternativeEqual := Option.some.inj branchAlternative
+  have sourceFieldCount : branch.fieldCount = fieldCount := by
+    exact (congrArg (fun alternative : IxIR1.Alt × Nat =>
+      match alternative.1 with | .mk _ fields _ => fields)
+        alternativeEqual).symm
+  have branchFieldArity : fields.size = branch.fieldCount := by
+    rw [sourceFieldCount]
+    exact fieldArity
+  have childRun : IxIR1.runCode sourceContext sourceFuel
+      functionTrace.source sourceStore (fields.toList.reverse ++ source)
+        child.sourceCode = .ok sourceOutput := by
+    rw [childCode]
+    exact branchRun
+  have childState := state.constructorChild sourceAlternative childSource
+    childCode sourceResolved sourceGet node fieldArity childTarget
+  have childMember : child ∈ children := List.mem_of_getElem? childAt
+  have childDescendant : functionTrace.root.Descendant child :=
+    .step descendant childMember
+  have parentEnvironments : Lower.Sim.EnvRel source frame.values input := by
+    simpa [Lower.CodeTrace.sourceInputMap] using state.target.environments
+  have schemaFields : ∀ {world schema},
+      attached.target.artifact.validationContext.schemas world cid =
+        some schema →
+      ∃ count, schema.fields = Array.replicate count world := by
+    intro world schema found
+    rw [attached.targetSchemasProduced] at found
+    exact attached.schema_fields_replicate found
+  have childOwnership := Lower.Sim.SourceOwnershipAt.switchCtor
+    attached.target functionMember descendant terminator targetAt childAt
+      branch ownership parentEnvironments sourceResolved sourceGet node
+      targetCid branchFieldArity schemaFields
+  have childRuntime := runtime.constructorBranch sourceGet node
+  let childMachine : Eval.Machine :=
+    { machine with control := .running childFrame stack }
+  have childStores : Lower.Sim.StoreRel sourceStore childMachine.store := by
+    simpa [childMachine] using nextStores
+  have childControl : childMachine.control =
+      .running childFrame stack := rfl
+  have tail := worker (machine := childMachine) (stack := stack)
+    functionMember childDescendant childState childStores childRuntime
+      childOwnership childRun resultWorld childControl childNoCredits image finish
+  refine BudgetedReachesPost.prependPreserving
+    (before := machine) (middle := childMachine)
+      (prefixCount := 1 + fields.size) ?_ tail
+  intro heapFuel
+  simpa [childMachine] using targetPreserving heapFuel
+
+/-- Exhaustive CPS composition for a successful source `case`.  The source
+evaluator has already reduced the dispatch to one indexed constructor,
+literal-zero, or literal-successor branch.  Nat branches are selected wholly
+from the retained lowering certificate.  Constructor dispatch consumes one
+focused witness for the corresponding emitted target; establishing that
+witness from the attached source typing/constructor universe is deliberately
+kept separate from the trace/fuel induction. -/
+theorem CompiledAttachment.simulate_traced_switch_cps
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Eval.Machine} {frame : Eval.Frame}
+    {stack : List Eval.Continuation} {functionTrace : Lower.FunctionTrace}
+    (functionMember : functionTrace ∈
+      attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (descendant : functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children))
+    {sourceStore : IxIR1.Store} {source : List IxIR1.RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    {sourceOutput outcome : IxIR1.Store × IxIR1.RVal}
+    (state : attached.sidecars.TraceStateRel functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frame)
+    (stores : Lower.Sim.StoreRel sourceStore machine.store)
+    (runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source)
+    (ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      sourceStore source frameRoots)
+    (selected : IndexedCaseSuccess sourceContext sourceFuel
+      functionTrace.source sourceStore source sourceScrutinee peelNat
+        alternatives sourceOutput)
+    (constructorSelection :
+      ∀ {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+          {fields : Array IxIR1.RVal} {fieldCount alternativeIndex : Nat}
+          {body : IxIR1.Code},
+        IxIR1.resolveAtom source sourceScrutinee = .ok (.loc location) →
+        sourceStore.get? location = some box →
+        box.node = .ctorN cid fields →
+        Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+          some (.mk cid.cidx fieldCount body, alternativeIndex) →
+        fields.size = fieldCount →
+        ConstructorSwitchSelection targetScrutinee generated outgoing children
+          cid)
+    (resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      functionTrace.source.result sourceOutput.2)
+    (control : machine.control = .running frame stack)
+    (noCredits : frame.credits = #[])
+    (image : attached.SourceStoreImage sourceStore)
+    {post : SourceMachinePost}
+    (finish : SuccessfulReturnHandler attached sourceContext context
+      interpretation functionTrace frameRoots stack sourceOutput outcome post)
+    (worker : SuccessfulTraceSimulationAt attached sourceContext context
+      interpretation sourceFuel) :
+    BudgetedReachesPost context interpretation post outcome.1 outcome.2
+      machine := by
+  cases selected with
+  | ctorBranch resolved found node sourceAlternative fieldArity branchRun =>
+      let target := constructorSelection resolved found node sourceAlternative
+        fieldArity
+      exact attached.simulate_traced_switch_ctor_cps functionMember descendant
+        state stores runtime ownership resolved found node sourceAlternative
+          fieldArity target.terminator target.targetAt target.targetAlternative
+          target.edgeAt target.childAt branchRun resultWorld control noCredits
+          image finish worker
+  | natZero peels resolved sourceAlternative branchRun =>
+      subst peelNat
+      exact attached.simulate_traced_switch_nat_zero_cps functionMember
+        descendant state stores runtime ownership resolved sourceAlternative
+          branchRun resultWorld control noCredits image finish worker
+  | natSucc peels resolved sourceAlternative branchRun =>
+      subst peelNat
+      exact attached.simulate_traced_switch_nat_succ_cps functionMember
+        descendant state stores runtime ownership resolved sourceAlternative
+          branchRun resultWorld control noCredits image finish worker
+
+/-- Every successful retained source trace is simulated by the checked IxIR₂
+machine under logical extern interpretation.  Strong induction is solely on
+source evaluator fuel: local operations and switches recurse at the immediate
+predecessor, calls recurse into both the strictly smaller callee and caller
+continuation, and over-application follows its strictly descending plan. -/
+theorem CompiledAttachment.successfulTraceSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context)
+    (contracts : SuccessfulSimulationContracts attached sourceContext context) :
+    ∀ fuel, SuccessfulTraceSimulationAt attached sourceContext context
+      .logical fuel := by
+  intro fuel
+  induction fuel using Nat.strongRecOn with
+  | ind fuel smallerWorkers =>
+      cases fuel with
+      | zero =>
+          exact successfulTraceSimulationAt_zero attached sourceContext context
+            .logical
+      | succ sourceFuel =>
+          intro functionTrace trace sourceStore source frameRoots sourceOutput
+            outcome frame machine stack post functionMember descendant state
+            stores runtime ownership sourceRun resultWorld control noCredits
+            image finish
+          cases trace with
+          | ret site blockId input entryValueCount sourceAtom targetAtom
+              generated =>
+              exact finish functionMember descendant state stores runtime
+                ownership sourceRun resultWorld control noCredits image
+          | tailCall site blockId input entryValueCount address sourceArguments
+              generated =>
+              cases sourceFuel with
+              | zero =>
+                  obtain ⟨middleStore, operationValue, operationRun,
+                      continuationRun⟩ :=
+                    IxIR1.runCode_letOp_success sourceRun
+                  rw [IxIR1.runOp.eq_def] at operationRun
+                  contradiction
+              | succ callFuel =>
+                  exact attached.simulate_traced_tail_call_cps_of_run contracts
+                    functionMember descendant state stores runtime ownership
+                    sourceRun resultWorld control noCredits image finish
+                    (fun recursiveFuel smaller =>
+                      smallerWorkers recursiveFuel (by omega))
+          | tailCallSelf site blockId input entryValueCount sourceArguments
+              generated =>
+              cases sourceFuel with
+              | zero =>
+                  obtain ⟨middleStore, operationValue, operationRun,
+                      continuationRun⟩ :=
+                    IxIR1.runCode_letOp_success sourceRun
+                  rw [IxIR1.runOp.eq_def] at operationRun
+                  contradiction
+              | succ callFuel =>
+                  exact attached.simulate_traced_tail_call_self_cps_of_run
+                    functionMember descendant state stores runtime ownership
+                    sourceRun resultWorld control noCredits image finish
+                    (fun recursiveFuel smaller =>
+                      smallerWorkers recursiveFuel (by omega))
+          | letOp site blockId input nextInput entryValueCount operation index
+              instruction next =>
+              cases sourceFuel with
+              | zero =>
+                  obtain ⟨middleStore, operationValue, operationRun,
+                      continuationRun⟩ :=
+                    IxIR1.runCode_letOp_success sourceRun
+                  rw [IxIR1.runOp.eq_def] at operationRun
+                  contradiction
+              | succ operationFuel =>
+                  exact attached.simulate_traced_letOp_cps_of_run contracts
+                    functionMember descendant state stores runtime ownership
+                    sourceRun resultWorld control noCredits image finish
+                    (fun recursiveFuel smaller =>
+                      smallerWorkers recursiveFuel (by omega))
+          | switchValue site blockId input entryValueCount sourceScrutinee
+              peelNat alternatives targetScrutinee generated outgoing
+              children =>
+              have selected := indexedCaseSuccess_of_run sourceRun
+              exact attached.simulate_traced_switch_cps functionMember
+                descendant state stores runtime ownership selected
+                (fun resolved found node sourceAlternative fieldArity =>
+                  match exactEq : attached.sidecars.exactConstructorAt?
+                      site sourceScrutinee with
+                  | none =>
+                      attached.constructorSwitchSelection_of_residual
+                        functionMember descendant exactEq image found node
+                        sourceAlternative fieldArity
+                  | some (fact, identity) =>
+                      attached.constructorSwitchSelection_of_exactHPT_runtime
+                        functionMember descendant state exactEq resolved found
+                        node)
+                resultWorld control noCredits image finish
+                (smallerWorkers sourceFuel (Nat.lt_succ_self sourceFuel))
+
+/-- Public whole-main successful-run preservation for an attached baseline
+lowering.  The source and target budgets are intentionally independent: the
+trace worker selects sufficient heap fuel backwards from recursive
+destruction, while its finite step witness supplies the exact control fuel
+accepted by `runMain`. -/
+theorem CompiledAttachment.successfulMainSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel)
+    (sourceContext : IxIR1.Ctx) (context : Eval.Context)
+    (contracts : SuccessfulSimulationContracts attached sourceContext context) :
+    Lower.Sim.SuccessfulMainSimulation sourceContext context
+      attached.target.artifact.source.main
+      attached.target.artifact.source.mainResult
+      attached.target.artifact.program := by
+  intro sourceFuel sourceOutput sourceRun
+  obtain ⟨mainBodyRun, mainResultWorld⟩ :=
+    IxIR1.Sim.runOwnedMain_ok sourceRun
+  have mainRun : IxIR1.runCode sourceContext sourceFuel
+      attached.target.artifact.mainTrace.source ({} : IxIR1.Store) []
+        attached.target.artifact.mainTrace.root.sourceCode = .ok sourceOutput := by
+    rw [attached.target.artifact.mainSource,
+      attached.target.artifact.mainRootSourceCode]
+    exact mainBodyRun
+  have resultWorld : IxIR1.Sim.HasWorld sourceOutput.1
+      attached.target.artifact.mainTrace.source.result sourceOutput.2 := by
+    rw [attached.target.artifact.mainSource]
+    exact mainResultWorld
+  let frame := Lower.Sim.initialMainFrame attached.target.artifact
+  let machine := Lower.Sim.initialMainMachine attached.target.artifact 0
+  have state : attached.sidecars.TraceStateRel
+      attached.target.artifact.mainTrace
+      attached.target.artifact.mainTrace.root ({} : IxIR1.Store) [] frame := by
+    simpa [frame] using attached.initialMainTraceState
+  have stores : Lower.Sim.StoreRel ({} : IxIR1.Store) machine.store := by
+    simpa [machine, Lower.Sim.initialMainMachine] using
+      Lower.Sim.StoreRel.initial
+  have control : machine.control = .running frame [] := by
+    rfl
+  have noCredits : frame.credits = #[] := by
+    rfl
+  have reached :=
+    (attached.successfulTraceSimulation sourceContext context contracts
+      sourceFuel)
+      attached.target.artifact.mainTraceMember
+      Lower.CodeTrace.Descendant.refl state stores
+      Lower.Sim.SourceRuntimeInvariant.empty
+      attached.initialMainSourceOwnership mainRun resultWorld control noCredits
+      attached.sourceStoreImage_empty
+      (attached.haltReturnHandler sourceContext context .logical
+        attached.target.artifact.mainTrace sourceOutput)
+  obtain ⟨heapFuel, controlFuel, final, steps, halted, finalStores⟩ := reached
+  cases final with
+  | mk targetStore heapRemaining finalControl =>
+      dsimp only at halted
+      subst finalControl
+      let targetOutput : Eval.Result :=
+        { store := targetStore
+          value := sourceOutput.2
+          controlRemaining := 0
+          heapRemaining }
+      refine ⟨controlFuel, heapFuel, targetOutput, ?_, ?_⟩
+      · rw [Lower.Sim.runMain_eq_initialMainMachine]
+        have targetRun := steps.runMachine_halted
+        simpa [machine, targetOutput, Lower.Sim.initialMainMachine,
+          Eval.initialMachine] using targetRun
+      · exact { finalStores with value := rfl }
+
+/-- Canonical end-to-end entry point: the checked attachment alone simulates
+every successful owned main run in its exact emitted evaluator contexts. -/
+theorem CompiledAttachment.successfulCanonicalMainSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : CompiledAttachment mainWorld lowerFuel) :
+    Lower.Sim.SuccessfulMainSimulation attached.simulationSourceContext
+      attached.simulationTargetContext attached.target.artifact.source.main
+      attached.target.artifact.source.mainResult
+      attached.target.artifact.program :=
+  attached.successfulMainSimulation attached.simulationSourceContext
+    attached.simulationTargetContext
+    attached.successfulSimulationContracts
+
+
+/-! Existing theorem names remain available for direct application. -/
+namespace Attached
+export CompiledAttachment (
+  declarationFunctionEntryTraceState
+  mainFunctionEntryTraceState
+  functionEntryTraceState
+  initialMainTraceState
+  initialMainSourceOwnership
+  traceState_next
+  traceState_next_of_member
+  mainTraceState_next
+  simulate_traced_pure_move_state
+  simulate_traced_pure_move_success_step
+  simulate_traced_alloc_checked_state
+  simulate_traced_alloc_checked_success_step
+  simulate_traced_dup_retain_scalar_state
+  simulate_traced_dup_retain_shared_state
+  simulate_traced_drop_release_scalar_state
+  simulate_traced_dropU_dropUnique_scalar_state
+  simulate_traced_dropU_dropUnique_recursive_state
+  simulate_traced_dropU_dropUnique_recursive_state_framed
+  simulate_traced_drop_release_recursive_state
+  simulate_traced_drop_release_recursive_state_framed
+  simulate_traced_papp_fn_state
+  simulate_traced_apply_transfer_state
+  simulate_traced_apply_erased_state
+  simulate_traced_apply_pap_under_state
+  simulate_traced_apply_pap_saturated_enter_state
+  simulate_traced_apply_pap_over_enter_state
+  simulate_traced_call_fn_enter_state
+  simulate_traced_call_self_enter_state
+  simulate_traced_tail_call_fn_enter_state
+  simulate_traced_tail_call_self_enter_state
+  simulate_traced_ret_apply_more_success
+  simulate_traced_ret_apply_more_pap_saturated_enter_state
+  simulate_traced_ret_apply_more_pap_over_enter_state
+  simulate_traced_ret_apply_more_pap_under_state
+  simulate_traced_ret_apply_more_erased_state
+  simulate_traced_return_to_letOp_state
+  simulate_traced_ret_halt_success
+  constructorSwitchSelection_of_exactHPT_nonempty
+  constructorSwitchSelection_of_exactHPT
+  constructorSwitchSelection_of_exactHPT_runtime
+  simulate_traced_fetch_state_of_run_hpt
+  simulate_traced_free_freeUnique_state_of_run_hpt
+  functionCodeConstructorsKnown
+  functionTraceConstructorsKnown
+  descendantOperationConstructorsKnown
+  sourceContextConstructorsKnown
+  SourceStoreImage
+  simulationSourceContext
+  simulationSourceContext_eq_addressedCtx
+  sourceRebuildSemanticAudit
+  sourceContextRenames
+  sourceContextRenamesOfDeclarations
+  sourceCodeAddressImage
+  functionSourceAddressImage
+  letOpAddressImages
+  rawApplyOwnership
+  sourceStoreImage_empty
+  runOp_preservesSourceStoreImage
+  dupVals_preservesSourceStoreImage
+  dropVal_preservesSourceStoreImage
+  dropMany_preservesSourceStoreImage
+  applyGo_exactImage
+  applyGo_owned_of_sourceStoreImage
+  applyGo_owned_of_sourceStoreImage_of_declarations
+  applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+  applyOwnershipPreservesFrom_sourceStoreImage
+  constructorSwitchSelection_of_residual_nonempty
+  constructorSwitchSelection_of_residual
+  simulationTargetContext
+  successfulSimulationContracts
+  haltReturnHandler
+  functionTrace_of_source_declaration
+  functionTrace_of_target_declaration
+  sourceDeclaration_not_extern
+  targetDeclaration_not_extern
+  applyMorePlan_of_applyGo
+  simulate_traced_pure_move_cps
+  simulate_traced_dup_retain_cps
+  simulate_traced_fetch_cps
+  simulate_traced_free_freeUnique_cps
+  simulate_traced_drop_release_cps
+  simulate_traced_dropU_dropUnique_cps
+  simulate_traced_alloc_checked_cps
+  simulate_traced_papp_fn_cps
+  simulate_traced_apply_erased_cps
+  simulate_traced_apply_pap_under_cps
+  simulate_traced_apply_pap_saturated_cps
+  simulate_traced_ret_apply_more_erased_cps
+  simulate_traced_ret_apply_more_pap_under_cps
+  simulate_traced_ret_apply_more_pap_saturated_cps
+  simulate_traced_ret_apply_more_pap_over_cps
+  simulate_traced_apply_pap_over_cps
+  applyMoreReturnHandler_of_plan
+  applyMoreReturnHandler_of_applyGo
+  simulate_traced_call_fn_cps
+  simulate_traced_call_self_cps
+  simulate_traced_tail_call_fn_cps
+  simulate_traced_tail_call_self_cps
+  simulate_traced_tail_call_cps_of_run
+  simulate_traced_tail_call_self_cps_of_run
+  simulate_traced_call_cps_of_run
+  simulate_traced_call_self_cps_of_run
+  simulate_traced_apply_cps_of_run
+  simulate_traced_letOp_cps_of_run
+  simulate_traced_switch_nat_zero_cps
+  simulate_traced_switch_nat_succ_cps
+  simulate_traced_switch_ctor_cps
+  simulate_traced_switch_cps
+  successfulTraceSimulation
+  successfulMainSimulation
+  successfulCanonicalMainSimulation)
+end Attached
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/ReservationHeap.lean b/Ix/Compiler/IxIR2/ReservationHeap.lean
new file mode 100644
index 000000000..7ed33d6f7
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReservationHeap.lean
@@ -0,0 +1,233 @@
+import Ix.Compiler.IxIR2.HeapAccounting
+
+/-!
+# Heap exclusion for reserved slots
+
+Ordinary allocation and destruction preserve every existing empty slot. The
+only operation that fills such a slot is `reuseReservation`, at the location
+named by its consumed credit. These facts apply throughout a callee, including
+recursive destruction and dynamic application.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1 (RVal Node NodeBox)
+
+def Store.EmptySlot (store : Store) (location : Nat) : Prop :=
+  store.heap.nodes[location]? = some none
+
+def EmptySlotsPreserved (before after : Store) : Prop :=
+  ∀ location, before.EmptySlot location → after.EmptySlot location
+
+namespace EmptySlotsPreserved
+
+theorem refl (store : Store) : EmptySlotsPreserved store store := fun _ empty => empty
+
+theorem trans {first second third : Store}
+    (left : EmptySlotsPreserved first second) (right : EmptySlotsPreserved second third) :
+    EmptySlotsPreserved first third := fun location empty => right location (left location empty)
+
+theorem of_nodes {before after : Store} (same : after.heap.nodes = before.heap.nodes) :
+    EmptySlotsPreserved before after := by
+  intro location empty
+  simpa only [Store.EmptySlot, same] using empty
+
+theorem allocNode (store : Store) (world : Owned) (node : Node) :
+    EmptySlotsPreserved store (store.allocNode world node).1 := by
+  intro location empty
+  have bound := (Array.getElem?_eq_some_iff.mp empty).1
+  simpa only [Store.EmptySlot, Store.allocNode_heap, IxIR1.Store.allocNode,
+    Array.getElem?_push_lt bound, Array.getElem?_eq_getElem bound] using empty
+
+theorem setBox {store : Store} {location : Nat} {old new : NodeBox}
+    (found : store.get? location = some old) :
+    EmptySlotsPreserved store (store.setBox location new) := by
+  intro reserved empty
+  have occupied := IxIR1.Sim.nodes_get?_of_get? found
+  have different : location ≠ reserved := by
+    intro same
+    subst reserved
+    rw [empty] at occupied
+    cases occupied
+  simpa only [Store.EmptySlot, Store.setBox, IxIR1.Store.setBox,
+    Array.set!_eq_setIfInBounds,
+    Array.getElem?_setIfInBounds_ne different] using empty
+
+theorem reserve (store : Store) (location : Nat) :
+    EmptySlotsPreserved store (store.reserve location) := by
+  intro reserved empty
+  by_cases same : location = reserved
+  · subst reserved
+    exact Array.getElem?_setIfInBounds_self_of_lt
+      (Array.getElem?_eq_some_iff.mp empty).1
+  · simpa only [Store.EmptySlot, Store.reserve,
+      Array.getElem?_setIfInBounds_ne same] using empty
+
+theorem kill (store : Store) (location : Nat) :
+    EmptySlotsPreserved store (store.kill location) :=
+  reserve store location
+
+theorem rcTick (store : Store) : EmptySlotsPreserved store store.rcTick := refl _
+
+end EmptySlotsPreserved
+
+theorem Store.EmptySlot.not_live {store : Store} {location : Nat}
+    (empty : store.EmptySlot location) : store.get? location = none := by
+  change IxIR1.Store.get? store.heap location = none
+  unfold IxIR1.Store.get?
+  rw [empty]
+  rfl
+
+theorem Store.reserve_empty {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) : (store.reserve location).EmptySlot location := by
+  have occupied := IxIR1.Sim.nodes_get?_of_get? found
+  exact Array.getElem?_setIfInBounds_self_of_lt
+    (Array.getElem?_eq_some_iff.mp occupied).1
+
+theorem retainShared_preservesEmpty {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) : EmptySlotsPreserved store output := by
+  cases value with
+  | lit literal => cases run; exact .refl _
+  | erased => cases run; exact .refl _
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp [retainShared, found, shared] at run
+            subst output
+            exact (EmptySlotsPreserved.setBox found).trans (.rcTick _)
+          · simp [retainShared, found, shared] at run
+
+theorem RetainSharedMany.preservesEmpty {store output : Store} {values : Array RVal}
+    (run : RetainSharedMany store values output) : EmptySlotsPreserved store output := by
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  have loop : ∀ (values : List RVal) {store output : Store},
+      values.foldlM retainShared store = .ok output → EmptySlotsPreserved store output := by
+    intro values
+    induction values with
+    | nil => intro store output run; cases run; exact .refl _
+    | cons value rest ih =>
+        intro store output run
+        rw [List.foldlM_cons] at run
+        cases head : retainShared store value with
+        | error error => simp [head, bind, Except.bind] at run
+        | ok middle =>
+            simp only [head, bind, Except.bind] at run
+            exact (retainShared_preservesEmpty head).trans (ih run)
+  exact loop values.toList run
+
+theorem releaseSharedWork_preservesEmpty {fuel remaining : Nat} {store output : Store}
+    {values : List RVal}
+    (run : releaseSharedWork fuel store values = .ok (output, remaining)) :
+    EmptySlotsPreserved store output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true] at run
+                        exact (EmptySlotsPreserved.rcTick store).trans
+                          ((EmptySlotsPreserved.kill _ location).trans (ih run))
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        have tickAt : store.rcTick.get? location = some box := found
+                        exact (EmptySlotsPreserved.rcTick store).trans
+                          ((EmptySlotsPreserved.setBox tickAt).trans (ih run))
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem dropUniqueWork_preservesEmpty {fuel remaining : Nat} {store output : Store}
+    {values : List RVal}
+    (run : dropUniqueWork fuel store values = .ok (output, remaining)) :
+    EmptySlotsPreserved store output := by
+  induction fuel generalizing store values with
+  | zero =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases values with
+      | nil => cases run; exact .refl _
+      | cons value rest =>
+          cases value with
+          | lit literal => exact ih run
+          | erased => exact ih run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · cases node : box.node with
+                    | papN address arity captured => simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        exact (EmptySlotsPreserved.kill store location).trans (ih run)
+                  · simp [dropUniqueWork, found, unique] at run
+
+theorem Store.releaseReservation_preservesEmpty {store output : Store} {location : Nat}
+    (run : store.releaseReservation location = .ok output) : EmptySlotsPreserved store output := by
+  unfold Store.releaseReservation at run
+  split at run
+  · cases run
+    exact .refl _
+  · cases run
+
+/-- Filling one reservation cannot affect any other reserved slot. The
+machine credit invariant supplies the inequality from unique ownership. -/
+theorem Store.reuseReservation_preservesOther {store output : Store}
+    {location other payload : Nat} {world : Owned} {node : Node}
+    (run : store.reuseReservation location world node payload = .ok output)
+    (different : location ≠ other) (empty : store.EmptySlot other) :
+    output.EmptySlot other := by
+  unfold Store.reuseReservation at run
+  split at run
+  · cases run
+    simpa only [Store.EmptySlot, Store.withPeak_heap,
+      Array.getElem?_setIfInBounds_ne different] using empty
+  · cases run
+
+theorem ApplyTransferCase.preservesEmpty {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) : EmptySlotsPreserved store target.store := by
+  cases classified with
+  | erased released => exact releaseSharedWork_preservesEmpty released
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      exact (retained.preservesEmpty.trans (releaseSharedWork_preservesEmpty released)).trans
+        (EmptySlotsPreserved.allocNode _ _ _)
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      exact retained.preservesEmpty.trans (releaseSharedWork_preservesEmpty released)
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      exact retained.preservesEmpty.trans (releaseSharedWork_preservesEmpty released)
+
+theorem ApplyTransfer.preservesEmpty {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target) : EmptySlotsPreserved store target.store :=
+  transferred.classify.preservesEmpty
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/ReservationOwnership.lean b/Ix/Compiler/IxIR2/ReservationOwnership.lean
new file mode 100644
index 000000000..e45f8c65b
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReservationOwnership.lean
@@ -0,0 +1,187 @@
+import Ix.Compiler.IxIR2.ReservationHeap
+import Ix.Compiler.IxIR2.CallResources
+
+/-!
+# Linear ownership of physical reservations
+
+Credit consumption removes exactly one entry from a frame. Edge transfer moves
+the complete remaining credit file. Reservations are unique across the active
+frame and every continuation, and each names an existing empty heap slot.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+def Credit.reservation? (credit : Credit) : Option Nat :=
+  match credit.presence with
+  | .present location => location
+  | .absent => none
+
+def Frame.liveCredits (frame : Frame) : List Credit := frame.credits.toList.filterMap id
+
+def Frame.reservations (frame : Frame) : List Nat :=
+  frame.liveCredits.filterMap Credit.reservation?
+
+def Continuation.reservations : Continuation → List Nat
+  | .resume frame | .applyMore _ frame => frame.reservations
+
+def Machine.reservations (machine : Machine) : List Nat :=
+  match machine.control with
+  | .halted _ => []
+  | .running frame stack => frame.reservations ++ stack.flatMap Continuation.reservations
+
+private theorem filterMap_set_none_perm {α : Type} {slots : List (Option α)}
+    {index : Nat} {value : α} (found : slots[index]? = some (some value)) :
+    (slots.filterMap id).Perm (value :: (slots.set index none).filterMap id) := by
+  induction slots generalizing index with
+  | nil => simp at found
+  | cons head tail ih =>
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero, Option.some.injEq] at found
+          subst head
+          simp
+      | succ index =>
+          simp only [List.getElem?_cons_succ] at found
+          cases head with
+          | none => simpa using ih found
+          | some head =>
+              simpa using ((ih found).cons head).trans (List.Perm.swap _ _ _)
+
+theorem CreditTake.liveCredits {frame target : Frame} {index : Nat} {credit : Credit}
+    (taken : CreditTake frame index target credit) :
+    frame.liveCredits.Perm (credit :: target.liveCredits) := by
+  obtain ⟨rfl, found⟩ := taken.target_eq
+  simpa only [Frame.liveCredits, Array.toList_setIfInBounds] using
+    filterMap_set_none_perm (slots := frame.credits.toList) (by simpa using found)
+
+theorem CreditTake.reservations {frame target : Frame} {index : Nat} {credit : Credit}
+    (taken : CreditTake frame index target credit) :
+    frame.reservations.Perm (credit.reservation?.toList ++ target.reservations) := by
+  cases present : credit.reservation? <;>
+    simpa [Frame.reservations, List.filterMap_cons, present] using
+      taken.liveCredits.filterMap Credit.reservation?
+
+theorem CreditTakeSequence.liveCredits {frame target : Frame} {indices : List Nat}
+    {credits : List Credit} (taken : CreditTakeSequence frame indices target credits) :
+    frame.liveCredits.Perm (credits ++ target.liveCredits) := by
+  induction taken with
+  | nil => exact .refl _
+  | cons head tail ih => exact head.liveCredits.trans (ih.cons _)
+
+theorem CreditTakeMany.liveCredits {frame target : Frame} {indices : Array Nat}
+    {credits : Array Credit} (taken : CreditTakeMany frame indices target credits) :
+    frame.liveCredits.Perm (credits.toList ++ target.liveCredits) :=
+  taken.sequence.liveCredits
+
+theorem NoLiveCredits.liveCredits_nil {frame : Frame} (cleared : NoLiveCredits frame) :
+    frame.liveCredits = [] := by
+  apply List.filterMap_eq_nil_iff.mpr
+  intro credit member
+  have absent := Array.any_eq_false'.mp cleared credit (by simpa using member)
+  cases credit <;> simp_all
+
+theorem NoLiveCredits.reservations_nil {frame : Frame} (cleared : NoLiveCredits frame) :
+    frame.reservations = [] := by
+  simp [Frame.reservations, cleared.liveCredits_nil]
+
+theorem EdgeTransfer.liveCredits {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal} (transferred : EdgeTransfer frame edge implicitValues target) :
+    frame.liveCredits.Perm target.liveCredits := by
+  obtain ⟨values, credits, after, block, _, taken, cleared, _, _, _, rfl⟩ := transferred.parts
+  have permuted := taken.liveCredits
+  rw [cleared.liveCredits_nil, List.append_nil] at permuted
+  simpa [Frame.liveCredits] using permuted
+
+theorem EdgeTransfer.reservations {frame target : Frame} {edge : Edge}
+    {implicitValues : Array RVal} (transferred : EdgeTransfer frame edge implicitValues target) :
+    frame.reservations.Perm target.reservations :=
+  transferred.liveCredits.filterMap Credit.reservation?
+
+@[simp] theorem Frame.reservations_empty (definition : Function) (block pc : Nat)
+    (values : Array RVal) :
+    ({ definition, block, pc, values, credits := #[] } : Frame).reservations = [] := rfl
+
+@[simp] theorem Frame.reservations_push (frame : Frame) (credit : Credit) :
+    ({ frame with credits := frame.credits.push (some credit) } : Frame).reservations =
+      frame.reservations ++ credit.reservation?.toList := by
+  cases present : credit.reservation? <;>
+    simp [Frame.reservations, Frame.liveCredits, List.filterMap_append, present]
+
+structure ReservationsOwned (store : Store) (locations : List Nat) : Prop where
+  unique : locations.Nodup
+  empty : ∀ location ∈ locations, store.EmptySlot location
+
+namespace ReservationsOwned
+
+theorem nil (store : Store) : ReservationsOwned store [] := ⟨by simp, by simp⟩
+
+theorem perm {store : Store} {left right : List Nat}
+    (owned : ReservationsOwned store left) (permuted : left.Perm right) :
+    ReservationsOwned store right :=
+  ⟨permuted.nodup_iff.mp owned.unique,
+    fun location member => owned.empty location (permuted.mem_iff.mpr member)⟩
+
+theorem preserve {before after : Store} {locations : List Nat}
+    (owned : ReservationsOwned before locations) (preserved : EmptySlotsPreserved before after) :
+    ReservationsOwned after locations :=
+  ⟨owned.unique, fun location member => preserved location (owned.empty location member)⟩
+
+theorem congr_nodes {before after : Store} {locations : List Nat}
+    (owned : ReservationsOwned before locations)
+    (same : after.heap.nodes = before.heap.nodes) : ReservationsOwned after locations :=
+  owned.preserve (.of_nodes same)
+
+theorem cons_parts {store : Store} {location : Nat} {locations : List Nat}
+    (owned : ReservationsOwned store (location :: locations)) :
+    location ∉ locations ∧ store.EmptySlot location ∧ ReservationsOwned store locations := by
+  have unique := List.nodup_cons.mp owned.unique
+  exact ⟨unique.1, owned.empty location (by simp), unique.2,
+    fun other member => owned.empty other (by simp [member])⟩
+
+theorem not_live {store : Store} {locations : List Nat} {location : Nat}
+    (owned : ReservationsOwned store locations) (member : location ∈ locations) :
+    store.get? location = none := (owned.empty location member).not_live
+
+theorem live_not_owned {store : Store} {locations : List Nat} {location : Nat}
+    {box : IxIR1.NodeBox} (owned : ReservationsOwned store locations)
+    (live : store.get? location = some box) : location ∉ locations := by
+  intro member
+  rw [owned.not_live member] at live
+  cases live
+
+theorem reserve {store : Store} {locations : List Nat} {location : Nat}
+    {box : IxIR1.NodeBox} (owned : ReservationsOwned store locations)
+    (live : store.get? location = some box) :
+    ReservationsOwned (store.reserve location) (locations ++ [location]) := by
+  have fresh := owned.live_not_owned live
+  refine ⟨?_, ?_⟩
+  · rw [List.nodup_append]
+    refine ⟨owned.unique, by simp, ?_⟩
+    intro other member last lastMember same
+    have lastEq : last = location := by simpa using lastMember
+    exact fresh ((same.trans lastEq) ▸ member)
+  · intro other member
+    simp only [List.mem_append, List.mem_singleton] at member
+    rcases member with member | rfl
+    · exact EmptySlotsPreserved.reserve store location other (owned.empty other member)
+    · exact Store.reserve_empty live
+
+theorem reuse {store output : Store} {location payload : Nat} {locations : List Nat}
+    {world : Ixon.Owned} {node : IxIR1.Node}
+    (owned : ReservationsOwned store (location :: locations))
+    (reused : store.reuseReservation location world node payload = .ok output) :
+    ReservationsOwned output locations := by
+  obtain ⟨absent, _, rest⟩ := owned.cons_parts
+  exact ⟨rest.unique, fun other member => Store.reuseReservation_preservesOther reused
+    (fun same => absent (same ▸ member)) (rest.empty other member)⟩
+
+end ReservationsOwned
+
+def Machine.ReservationOwnership (machine : Machine) : Prop :=
+  ReservationsOwned machine.store machine.reservations
+
+theorem Machine.ReservationOwnership.callee_exclusion {machine : Machine} {location : Nat}
+    (owned : machine.ReservationOwnership) (reserved : location ∈ machine.reservations) :
+    machine.store.get? location = none := owned.not_live reserved
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/ReservationSteps.lean b/Ix/Compiler/IxIR2/ReservationSteps.lean
new file mode 100644
index 000000000..553767fe6
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReservationSteps.lean
@@ -0,0 +1,230 @@
+import Ix.Compiler.IxIR2.ReservationOwnership
+
+/-!
+# Reservation ownership through actual executions
+
+Every successful physical step preserves a unique owning credit for each
+reserved slot. Calls move those credits into one continuation; returns restore
+them, and allocation/discard consumes them. The invariant is derived from an
+initial machine, so callers do not supply a callee-exclusion assumption.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+theorem Machine.ReservationOwnership.of_preserved {before after : Machine}
+    (owned : before.ReservationOwnership)
+    (preserved : EmptySlotsPreserved before.store after.store)
+    (credits : before.reservations.Perm after.reservations) : after.ReservationOwnership :=
+  (owned.perm credits).preserve preserved
+
+theorem ApplyTransferCase.reservations {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal}
+    {resume : Frame} {stack : List Continuation} {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target) :
+    target.reservations = resume.reservations ++ stack.flatMap Continuation.reservations := by
+  cases classified with
+  | erased => rfl
+  | papUnder => rfl
+  | papExtern => rfl
+  | papFn =>
+      simp only [Machine.reservations, Frame.reservations_empty, List.nil_append,
+        List.flatMap_cons]
+      split <;> rfl
+
+theorem ApplyTransfer.reservationOwnership {context : Context} {interpretation : Interpretation}
+    {store : Store} {heapFuel : Nat} {arguments : Array RVal}
+    {resume : Frame} {stack : List Continuation} {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target)
+    (owned : (Machine.mk store heapFuel (.running resume stack)).ReservationOwnership) :
+    target.ReservationOwnership :=
+  owned.of_preserved transferred.preservesEmpty (by rw [transferred.classify.reservations]; rfl)
+
+private theorem takeNoReservation {frame target : Frame} {index : Nat} {credit : Credit}
+    (taken : CreditTake frame index target credit) (absent : credit.reservation? = none)
+    (stack : List Continuation) :
+    (frame.reservations ++ stack.flatMap Continuation.reservations).Perm
+      (target.reservations ++ stack.flatMap Continuation.reservations) := by
+  simpa [absent] using taken.reservations.append_right (stack.flatMap Continuation.reservations)
+
+private theorem takeReservation {store : Store} {frame target : Frame} {index location : Nat}
+    {credit : Credit} {stack : List Continuation}
+    (owned : ReservationsOwned store
+      (frame.reservations ++ stack.flatMap Continuation.reservations))
+    (taken : CreditTake frame index target credit)
+    (present : credit.presence = .present (some location)) :
+    ReservationsOwned store (location ::
+      (target.reservations ++ stack.flatMap Continuation.reservations)) := by
+  apply owned.perm
+  simpa [Credit.reservation?, present, List.append_assoc] using
+    taken.reservations.append_right (stack.flatMap Continuation.reservations)
+
+private theorem reserveAtFrame {store : Store} {frame : Frame} {stack : List Continuation}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (owned : ReservationsOwned store
+      (frame.reservations ++ stack.flatMap Continuation.reservations))
+    (found : store.get? location = some box) :
+    ReservationsOwned (store.reserve location)
+      ((frame.reservations ++ [location]) ++ stack.flatMap Continuation.reservations) := by
+  apply (owned.reserve found).perm
+  simpa only [List.append_assoc] using
+    (List.perm_append_comm (l₁ := stack.flatMap Continuation.reservations)
+      (l₂ := [location])).append_left frame.reservations
+
+theorem InstructionTransferCase.reservationOwnership {context : Context}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context .physical store heapFuel frame
+      stack instruction target)
+    (owned : (Machine.mk store heapFuel (.running frame stack)).ReservationOwnership) :
+    target.ReservationOwnership := by
+  cases classified with
+  | move resolved => exact owned
+  | alloc schemaAt resolved fields =>
+      exact owned.of_preserved (EmptySlotsPreserved.allocNode _ _ _) (.refl _)
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      exact owned.of_preserved (EmptySlotsPreserved.allocNode _ _ _)
+        (takeNoReservation taken (by simp [Credit.reservation?, absent]) stack)
+  | allocWithLogical mode => cases mode
+  | allocWithPhysical mode schemaAt resolved fields taken layout present reused =>
+      exact (takeReservation (frame := { frame with pc := frame.pc + 1 })
+        owned taken present).reuse reused
+  | discardAbsent taken absent =>
+      exact owned.of_preserved (.refl _)
+        (takeNoReservation taken (by simp [Credit.reservation?, absent]) stack)
+  | discardLogical mode => cases mode
+  | discardPhysical mode taken present released =>
+      exact (takeReservation (frame := { frame with pc := frame.pc + 1 })
+        owned taken present).cons_parts.2.2.preserve
+        (Store.releaseReservation_preservesEmpty released)
+  | takeUniqueLogical mode => cases mode
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      have reserved := reserveAtFrame owned viewed.parts.1
+      simpa [Machine.ReservationOwnership, Machine.reservations,
+        Frame.reservations, Frame.liveCredits, Credit.reservation?] using reserved
+  | resetSharedLogicalHot mode => cases mode
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      have reserved := reserveAtFrame owned viewed.parts.1
+      have reserved' := reserved.congr_nodes
+        (after := ((store.tickResetAttempt).reserve _).tickHotReset) rfl
+      simpa [Machine.ReservationOwnership, Machine.reservations,
+        Frame.reservations, Frame.liveCredits, Credit.reservation?] using reserved'
+  | resetSharedCold schemaAt resolved viewed shared retained =>
+      have preserved : EmptySlotsPreserved store _ :=
+        (EmptySlotsPreserved.setBox viewed.parts.1).trans
+          (retained.preservesEmpty)
+      exact owned.of_preserved preserved (by
+        simp [Machine.reservations, Frame.reservations, Frame.liveCredits]
+        rfl)
+  | retainShared resolved retained =>
+      exact owned.of_preserved (retainShared_preservesEmpty retained) (.refl _)
+  | releaseShared resolved released =>
+      exact owned.of_preserved (releaseSharedWork_preservesEmpty released) (.refl _)
+  | dropUnique resolved dropped =>
+      exact owned.of_preserved (dropUniqueWork_preservesEmpty dropped) (.refl _)
+  | freeUnique resolved viewed scalarFields =>
+      exact owned.of_preserved (EmptySlotsPreserved.kill _ _) (.refl _)
+  | fetch resolved boxAt node fieldAt => exact owned
+  | callFn noCredits resolved declaration arity nonempty =>
+      exact owned.of_preserved (.refl _) (by
+        simp [Machine.reservations, Frame.reservations, Frame.liveCredits, Continuation.reservations])
+  | callSelf noCredits resolved arity nonempty =>
+      exact owned.of_preserved (.refl _) (by
+        simp [Machine.reservations, Frame.reservations, Frame.liveCredits, Continuation.reservations])
+  | pappFn noCredits declaration papSafe resolved under =>
+      exact owned.of_preserved (EmptySlotsPreserved.allocNode _ _ _) (.refl _)
+  | pappExtern noCredits declaration resolved under =>
+      exact owned.of_preserved (EmptySlotsPreserved.allocNode _ _ _) (.refl _)
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact transferred.reservationOwnership owned
+  | extern noCredits resolved declaration argumentArity called => exact owned
+
+theorem TerminatorTransferCase.reservationOwnership {context : Context}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context .physical store heapFuel frame
+      stack terminator target)
+    (owned : (Machine.mk store heapFuel (.running frame stack)).ReservationOwnership) :
+    target.ReservationOwnership := by
+  cases classified with
+  | jump transferred =>
+      exact owned.of_preserved (.refl _) (transferred.reservations.append_right _)
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      exact owned.of_preserved (.refl _) (transferred.reservations.append_right _)
+  | switchNatZero resolved transferred =>
+      exact owned.of_preserved (.refl _) (transferred.reservations.append_right _)
+  | switchNatSucc resolved transferred =>
+      exact owned.of_preserved (.refl _) (transferred.reservations.append_right _)
+  | branchPresent lookedUp present transferred =>
+      exact owned.of_preserved (.refl _) (transferred.reservations.append_right _)
+  | branchAbsent lookedUp absent transferred =>
+      exact owned.of_preserved (.refl _) (transferred.reservations.append_right _)
+  | retResume resolved noCredits world =>
+      exact owned.of_preserved (.refl _) (by
+        simp only [Machine.reservations, noCredits.reservations_nil,
+          List.nil_append, List.flatMap_cons, Continuation.reservations]
+        rfl)
+  | retHalt resolved noCredits world => exact .nil _
+  | retApplyMore resolved noCredits world transferred =>
+      apply transferred.reservationOwnership
+      simpa only [Machine.ReservationOwnership, Machine.reservations, List.flatMap_cons,
+        Continuation.reservations, noCredits.reservations_nil, List.nil_append] using owned
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      exact owned.of_preserved (.refl _) (by
+        simp [Machine.reservations, noCredits.reservations_nil])
+  | tailCallSelf noCredits resolved arity nonempty =>
+      exact owned.of_preserved (.refl _) (by
+        simp [Machine.reservations, noCredits.reservations_nil])
+
+theorem Step.reservationOwnership {context : Context} {before after : Machine}
+    (stepped : Step context .physical before after) (owned : before.ReservationOwnership) :
+    after.ReservationOwnership := by
+  cases stepped.classify with
+  | halted => exact owned
+  | instruction blockAt pc instructionAt classified => exact classified.reservationOwnership owned
+  | terminator blockAt pc terminatorAt classified => exact classified.reservationOwnership owned
+
+namespace Policy
+
+theorem suspendCall_reservations {context : Context} {before after : Machine}
+    {frame : Frame} {stack : List Continuation} {call : DirectCall}
+    (running : before.control = .running frame stack)
+    (called : suspendCall context before frame stack call = .ok after) :
+    after.reservations = before.reservations := by
+  obtain ⟨values, definition, _, _, _, _, rfl⟩ := suspendCall_iff.mp called
+  simp [Machine.reservations, running, Frame.reservations, Frame.liveCredits,
+    Continuation.reservations]
+
+theorem Step.reservationOwnership {policy : CreditPolicy} {context : Context}
+    {before after : Machine} (stepped : Step policy context .physical before after)
+    (owned : before.ReservationOwnership) : after.ReservationOwnership := by
+  rcases stepped.classify with original | ⟨frame, stack, call, _, running, _, called⟩
+  · exact original.reservationOwnership owned
+  · exact owned.of_preserved (.of_nodes (by rw [(suspendCall_resources running called).1]))
+      (by rw [suspendCall_reservations running called])
+
+theorem Steps.reservationOwnership {policy : CreditPolicy} {context : Context}
+    {count : Nat} {before after : Machine}
+    (steps : Steps policy context .physical count before after)
+    (owned : before.ReservationOwnership) : after.ReservationOwnership := by
+  induction steps with
+  | refl => exact owned
+  | cons running head tail ih => exact ih (head.reservationOwnership owned)
+
+theorem initialMachine_reservationOwnership (definition : Function)
+    (arguments : Array RVal) (heapFuel : Nat) (store : Store := {}) :
+    (initialMachine definition arguments heapFuel store).ReservationOwnership := .nil _
+
+/-- Every reservation in every actual execution prefix has exactly one owning
+credit and is excluded from the live heap, even through nested calls. -/
+theorem runMain_prefix_reservationOwnership {policy : CreditPolicy} {context : Context}
+    {program : Program} {heapFuel count : Nat} {middle : Machine}
+    (prefixSteps : Steps policy context .physical count
+      (initialMachine program.main #[] heapFuel) middle) :
+    middle.ReservationOwnership :=
+  prefixSteps.reservationOwnership (initialMachine_reservationOwnership ..)
+
+end Policy
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/Resources.lean b/Ix/Compiler/IxIR2/Resources.lean
new file mode 100644
index 000000000..2cba948ac
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Resources.lean
@@ -0,0 +1,286 @@
+import Ix.Compiler.IxIR2.HeapAccounting
+
+/-!
+# Resource accounting for actual physical executions
+
+Every allocated slot is either live, freed, or represented by a present credit
+in the current frame or its continuations. Successful physical steps preserve
+this balance. A successful main execution therefore has no outstanding
+allocation beyond its live heap; reclamation reduces that heap to zero.
+-/
+
+namespace Ix.Compiler.IxIR2.Eval
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1 (Node NodeBox RVal)
+
+/-- Allocation accounting includes reservations held anywhere in the machine. -/
+def Machine.AllocationAccounting (machine : Machine) : Prop :=
+  machine.store.live + machine.store.heap.frees + machine.presentCredits =
+    machine.store.heap.allocs
+
+theorem Machine.AllocationAccounting.of_heapBalance {before after : Machine}
+    (accounted : before.AllocationAccounting)
+    (balanced : HeapBalance before.store after.store)
+    (credits : after.presentCredits = before.presentCredits) :
+    after.AllocationAccounting := by
+  unfold Machine.AllocationAccounting at *
+  unfold HeapBalance at balanced
+  omega
+
+theorem ApplyTransferCase.allocationAccounting {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {function : RVal} {target : Machine}
+    (classified : ApplyTransferCase context interpretation store heapFuel
+      arguments resume stack function target)
+    (accounted : (Machine.mk store heapFuel (.running resume stack)).AllocationAccounting) :
+    target.AllocationAccounting := by
+  cases classified with
+  | erased released =>
+      exact accounted.of_heapBalance (releaseSharedWork_heapBalance released) rfl
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      exact accounted.of_heapBalance
+        ((retained.heapBalance.trans (releaseSharedWork_heapBalance released)).trans
+          (.allocNode ..)) rfl
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact retained.heapBalance.trans (releaseSharedWork_heapBalance released)
+      simp only [Machine.presentCredits_running, List.map_cons, List.sum_cons,
+        Frame.presentCredits, creditPresentCount_empty, Nat.zero_add]
+      split <;> rfl
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      exact accounted.of_heapBalance
+        (retained.heapBalance.trans (releaseSharedWork_heapBalance released)) rfl
+
+theorem ApplyTransfer.allocationAccounting {context : Context}
+    {interpretation : Interpretation} {store : Store} {heapFuel : Nat}
+    {arguments : Array RVal} {resume : Frame} {stack : List Continuation}
+    {function : RVal} {target : Machine}
+    (transferred : ApplyTransfer context interpretation store heapFuel function
+      arguments resume stack target)
+    (accounted : (Machine.mk store heapFuel (.running resume stack)).AllocationAccounting) :
+    target.AllocationAccounting := transferred.classify.allocationAccounting accounted
+
+theorem InstructionTransferCase.allocationAccounting {context : Context}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {instruction : Instr} {target : Machine}
+    (classified : InstructionTransferCase context .physical store heapFuel frame
+      stack instruction target)
+    (accounted : (Machine.mk store heapFuel (.running frame stack)).AllocationAccounting) :
+    target.AllocationAccounting := by
+  cases classified with
+  | move resolved => exact accounted
+  | alloc schemaAt resolved fields =>
+      exact accounted.of_heapBalance (.allocNode ..) rfl
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .allocNode ..
+      have count := taken.presentCredits
+      simpa [Machine.presentCredits_running, Frame.presentCredits,
+        Credit.weight_absent absent] using
+        congrArg (· + (stack.map Continuation.presentCredits).sum) count
+  | allocWithLogical mode => cases mode
+  | allocWithPhysical mode schemaAt resolved fields taken layout present reused =>
+      have count := taken.presentCredits
+      have heap := Store.reuseReservation_accounting reused
+      simp only [Frame.presentCredits, Credit.weight_present present] at count
+      simp only [Machine.AllocationAccounting, Machine.presentCredits_running,
+        Frame.presentCredits] at accounted ⊢
+      omega
+  | discardAbsent taken absent =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      have count := taken.presentCredits
+      simpa [Machine.presentCredits_running, Frame.presentCredits,
+        Credit.weight_absent absent] using
+        congrArg (· + (stack.map Continuation.presentCredits).sum) count
+  | discardLogical mode => cases mode
+  | discardPhysical mode taken present released =>
+      have count := taken.presentCredits
+      have heap := Store.releaseReservation_accounting released
+      simp only [Frame.presentCredits, Credit.weight_present present] at count
+      simp only [Machine.AllocationAccounting, Machine.presentCredits_running,
+        Frame.presentCredits] at accounted ⊢
+      omega
+  | takeUniqueLogical mode => cases mode
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      have live := Store.live_reserve viewed.parts.1
+      simp only [Machine.AllocationAccounting, Machine.presentCredits_running,
+        Frame.presentCredits, creditPresentCount_push, Credit.weight,
+        Credit.isPresent] at accounted ⊢
+      change _ + _ + (_ + (if true then 1 else 0) + _) = _
+      simp only [↓reduceIte]
+      change _ + store.heap.frees + _ = store.heap.allocs
+      omega
+  | resetSharedLogicalHot mode => cases mode
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      have live := Store.live_reserve viewed.parts.1
+      simp only [Machine.AllocationAccounting, Machine.presentCredits_running,
+        Frame.presentCredits, creditPresentCount_push, Credit.weight,
+        Credit.isPresent] at accounted ⊢
+      change (store.reserve _).live + store.heap.frees +
+        (creditPresentCount frame.credits + 1 + _) = store.heap.allocs
+      omega
+  | @resetSharedCold target cid schema location box fields outStore
+      schemaAt resolved viewed shared retained =>
+      have updated := HeapBalance.setBox (new := { box with rc := box.rc - 1 }) viewed.parts.1
+      have balanced : HeapBalance store outStore := updated.trans retained.heapBalance
+      refine accounted.of_heapBalance ?_ ?_
+      · exact balanced
+      simp [Machine.presentCredits_running, Frame.presentCredits,
+        Credit.weight, Credit.isPresent]
+  | retainShared resolved retained =>
+      exact accounted.of_heapBalance (retainShared_heapBalance retained) rfl
+  | releaseShared resolved released =>
+      exact accounted.of_heapBalance (releaseShared_heapBalance released) rfl
+  | dropUnique resolved dropped =>
+      exact accounted.of_heapBalance (dropUnique_heapBalance dropped) rfl
+  | freeUnique resolved viewed scalarFields =>
+      exact accounted.of_heapBalance (.kill viewed.parts.1) rfl
+  | fetch resolved boxAt node fieldAt => exact accounted
+  | callFn noCredits resolved declaration arity nonempty =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp [Machine.presentCredits_running, Frame.presentCredits,
+        Continuation.presentCredits]
+  | callSelf noCredits resolved arity nonempty =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp [Machine.presentCredits_running, Frame.presentCredits,
+        Continuation.presentCredits]
+  | pappFn noCredits declaration papSafe resolved under =>
+      exact accounted.of_heapBalance (.allocNode ..) rfl
+  | pappExtern noCredits declaration resolved under =>
+      exact accounted.of_heapBalance (.allocNode ..) rfl
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact transferred.allocationAccounting accounted
+  | extern noCredits resolved declaration argumentArity called => exact accounted
+
+theorem TerminatorTransferCase.allocationAccounting {context : Context}
+    {store : Store} {heapFuel : Nat} {frame : Frame} {stack : List Continuation}
+    {terminator : Terminator} {target : Machine}
+    (classified : TerminatorTransferCase context .physical store heapFuel frame
+      stack terminator target)
+    (accounted : (Machine.mk store heapFuel (.running frame stack)).AllocationAccounting) :
+    target.AllocationAccounting := by
+  cases classified with
+  | jump transferred =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp only [Machine.presentCredits_running, transferred.presentCredits]
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp only [Machine.presentCredits_running, transferred.presentCredits]
+  | switchNatZero resolved transferred =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp only [Machine.presentCredits_running, transferred.presentCredits]
+  | switchNatSucc resolved transferred =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp only [Machine.presentCredits_running, transferred.presentCredits]
+  | branchPresent lookedUp present transferred =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp only [Machine.presentCredits_running, transferred.presentCredits]
+  | branchAbsent lookedUp absent transferred =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      simp only [Machine.presentCredits_running, transferred.presentCredits]
+  | retResume resolved noCredits world =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      have cleared := noCredits.presentCredits
+      change creditPresentCount frame.credits = 0 at cleared
+      simp [Machine.presentCredits_running, Frame.presentCredits,
+        Continuation.presentCredits, cleared]
+  | retHalt resolved noCredits world =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      change 0 = frame.presentCredits + 0
+      rw [noCredits.presentCredits]
+  | retApplyMore resolved noCredits world transferred =>
+      apply transferred.allocationAccounting
+      simpa only [Machine.AllocationAccounting, Machine.presentCredits_running,
+        List.map_cons, List.sum_cons, Continuation.presentCredits,
+        noCredits.presentCredits, Nat.zero_add] using accounted
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      have cleared := noCredits.presentCredits
+      change creditPresentCount frame.credits = 0 at cleared
+      simp [Machine.presentCredits_running, Frame.presentCredits, cleared]
+  | tailCallSelf noCredits resolved arity nonempty =>
+      refine accounted.of_heapBalance ?_ ?_
+      · exact .refl _
+      have cleared := noCredits.presentCredits
+      change creditPresentCount frame.credits = 0 at cleared
+      simp [Machine.presentCredits_running, Frame.presentCredits, cleared]
+
+/-- Every actual successful physical step preserves allocation accounting. -/
+theorem Step.allocationAccounting {context : Context} {before after : Machine}
+    (stepped : Step context .physical before after)
+    (accounted : before.AllocationAccounting) : after.AllocationAccounting := by
+  cases stepped.classify with
+  | halted => exact accounted
+  | instruction blockAt pc instructionAt classified =>
+      exact classified.allocationAccounting accounted
+  | terminator blockAt pc terminatorAt classified =>
+      exact classified.allocationAccounting accounted
+
+theorem Steps.allocationAccounting {context : Context} {count : Nat}
+    {before after : Machine} (steps : Steps context .physical count before after)
+    (accounted : before.AllocationAccounting) : after.AllocationAccounting := by
+  induction steps with
+  | refl => exact accounted
+  | cons running head tail ih => exact ih (head.allocationAccounting accounted)
+
+/-- A successful physical runner has accounted for every reservation at halt. -/
+theorem runMachine_allocationAccounting {context : Context} {controlFuel : Nat}
+    {machine : Machine} {result : Result}
+    (run : runMachine context .physical controlFuel machine = .ok result)
+    (accounted : machine.AllocationAccounting) :
+    result.store.live + result.store.heap.frees = result.store.heap.allocs := by
+  obtain ⟨count, budget, steps⟩ := runMachine_steps run
+  simpa [Machine.AllocationAccounting, Machine.presentCredits] using
+    steps.allocationAccounting accounted
+
+theorem initialMachine_allocationAccounting (definition : Function)
+    (arguments : Array RVal) (heapFuel : Nat) :
+    (initialMachine definition arguments heapFuel).AllocationAccounting := rfl
+
+/-- The successful physical main has no outstanding allocation beyond its live
+nodes. The entry facts are checked by the evaluator and also certified by the
+compiler attachment. -/
+theorem runMain_allocationAccounting {context : Context} {program : Program}
+    {controlFuel heapFuel : Nat} {result : Result}
+    (arity : program.main.signature.params.size = 0)
+    (nonempty : program.main.blocks.isEmpty = false)
+    (run : runMain context .physical program controlFuel heapFuel = .ok result) :
+    result.store.live + result.store.heap.frees = result.store.heap.allocs := by
+  rw [runMain_eq_runMachine arity nonempty] at run
+  exact runMachine_allocationAccounting run (initialMachine_allocationAccounting ..)
+
+/-- Terminal resource contract for a shared result: the main has no unaccounted
+reservation, and releasing its returned root empties the heap and balances all
+fresh allocations with frees. Release fuel is independent of execution fuel. -/
+def Result.SharedResources (result : Result) : Prop :=
+  result.store.live + result.store.heap.frees = result.store.heap.allocs ∧
+    ∃ releaseFuel released remaining,
+      releaseShared releaseFuel result.store result.value = .ok (released, remaining) ∧
+      released.live = 0 ∧ released.heap.allocs = released.heap.frees
+
+theorem Result.sharedResources_of_release {result : Result}
+    (accounted : result.store.live + result.store.heap.frees = result.store.heap.allocs)
+    {releaseFuel remaining : Nat} {released : Store}
+    (release : releaseShared releaseFuel result.store result.value = .ok (released, remaining))
+    (empty : released.live = 0) : result.SharedResources := by
+  have balance := releaseShared_heapBalance release
+  unfold HeapBalance at balance
+  exact ⟨accounted, releaseFuel, released, remaining, release, empty, by omega⟩
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/Reuse.lean b/Ix/Compiler/IxIR2/Reuse.lean
new file mode 100644
index 000000000..04f930223
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Reuse.lean
@@ -0,0 +1,1747 @@
+import Ix.Compiler.IxIR2.EvalCounter
+import Ix.Compiler.IxIR2.Liveness
+
+/-!
+# Checked dynamic shared reuse insertion
+
+The optimizer recognizes the compiler-emitted consuming-case prefix produced
+by `IxIR1.Lower.lowerRecursor`: every shared field is fetched and retained,
+the shared parent is released at its checked last use, a compatible cell is
+allocated, and the function tail-calls itself.  Constructor arity, source
+parameter position, allocation argument order, and tail argument order are
+recovered from the block rather than fixed to the first reversal benchmark.
+
+The rewrite fuses those heap operations into `resetShared`, splits the
+optional credit with `branchCredit`, and consumes the credit with `allocWith`
+on both hot and cold paths.  Existing blocks retain their IDs; the two credit
+blocks are appended, so unrelated CFG edges need no renumbering.  Both the
+input and output cross the ordinary bounded IxIR₂ validator.  The executable
+traversal also retains a typed decision trace: every source block records the
+exact shape, liveness, representation, and operand-mapping decision that
+justified its rewrite or left it unchanged.  That trace is the proof-facing
+input to block/function/program simulation; this module does not yet claim
+the completed semantic lifting theorem.
+-/
+
+namespace Ix.Compiler.IxIR2.Reuse
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR2
+
+/-- Stable counters for the deliberately narrow first insertion pass. -/
+structure Report where
+  scannedBlocks : Nat := 0
+  shapeCandidates : Nat := 0
+  livenessRejected : Nat := 0
+  rewritten : Nat := 0
+  incompatibleLayouts : Nat := 0
+  unmappableOperands : Nat := 0
+  helperBlocks : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Report.add (left right : Report) : Report :=
+  { scannedBlocks := left.scannedBlocks + right.scannedBlocks
+    shapeCandidates := left.shapeCandidates + right.shapeCandidates
+    livenessRejected := left.livenessRejected + right.livenessRejected
+    rewritten := left.rewritten + right.rewritten
+    incompatibleLayouts :=
+      left.incompatibleLayouts + right.incompatibleLayouts
+    unmappableOperands := left.unmappableOperands + right.unmappableOperands
+    helperBlocks := left.helperBlocks + right.helperBlocks }
+
+/-- A proof-carrying candidate position.  Coverage is checked independently
+of inference, and exactness at the proposed position supplies the local fact
+needed before moving a consuming reset there. -/
+structure Placement (block : Block) where
+  value : ValueId
+  position : Nat
+  liveness : Liveness.CheckedBlock block
+  exact : liveness.summary.lastUse? value = some position
+
+namespace Placement
+
+theorem noUseAfter {block : Block} (placement : Placement block) :
+    ∀ index, (bound : index < (Liveness.blockUses block).size) →
+      (Liveness.blockUses block)[index].value = placement.value →
+      (Liveness.blockUses block)[index].position ≤ placement.position :=
+  placement.liveness.no_use_after placement.exact
+
+end Placement
+
+/-- Infer a local solution, check it under the caller's resource policy, and
+retain a placement only when the requested position is the exact last use. -/
+def inferPlacementWith (limits : Validate.Limits) (block : Block)
+    (value : ValueId) (position : Nat) :
+    Except Liveness.Error (Option (Placement block)) :=
+  match Liveness.inferCheckedWith limits block with
+  | .error error => .error error
+  | .ok liveness =>
+      if exact : liveness.summary.lastUse? value = some position then
+        .ok (some { value, position, liveness, exact })
+      else
+        .ok none
+
+def inferPlacement (block : Block) (value : ValueId) (position : Nat) :
+    Except Liveness.Error (Option (Placement block)) :=
+  inferPlacementWith Validate.defaultLimits block value position
+
+/-- A successful liveness placement retains the exact requested register and
+instruction position. -/
+theorem inferPlacementWith_sound {limits : Validate.Limits} {block : Block}
+    {value position : Nat} {placement : Placement block}
+    (found : inferPlacementWith limits block value position =
+      .ok (some placement)) :
+    placement.value = value ∧ placement.position = position := by
+  unfold inferPlacementWith at found
+  split at found
+  · cases found
+  · split at found
+    · simp only [Except.ok.injEq, Option.some.injEq] at found
+      subst placement
+      exact ⟨rfl, rfl⟩
+    · cases found
+
+/-- Information recovered from a general compiler-emitted consuming-case
+prefix before consulting the representation schema. -/
+structure Shape where
+  parameterCount : Nat
+  source : ValueId
+  sourceConstructor : CtorId
+  fieldCount : Nat
+  releasePosition : Nat
+  allocationConstructor : CtorId
+  allocationArguments : Array Atom
+  tailArguments : Array Atom
+
+/-- Recognize the complete generic prefix
+`fetchⁿ; retainSharedⁿ; releaseShared; alloc; tailCallSelf`.  Result register
+numbers follow directly from IxIR₂'s append-only block register discipline. -/
+def reuseShape? (block : Block) : Option Shape :=
+  let instructionCount := block.instructions.size
+  if instructionCount < 4 then
+    none
+  else
+    let fieldCount := (instructionCount - 2) / 2
+    let parameterCount := block.valueParams.size
+    match block.instructions[0]? with
+    | some (Instr.fetch (Atom.reg source) sourceConstructor 0) =>
+        let fetchesMatch := (List.range fieldCount).all fun field =>
+          block.instructions[field]? ==
+            some (.fetch (.reg source) sourceConstructor field)
+        let retainsMatch := (List.range fieldCount).all fun field =>
+          block.instructions[fieldCount + field]? ==
+            some (.retainShared (.reg (parameterCount + field)))
+        if fieldCount == 0 || instructionCount != 2 * fieldCount + 2 ||
+            source ≥ parameterCount ||
+            block.valueParams[source]? != some (.owned .shared) ||
+            !block.creditParams.isEmpty || !fetchesMatch || !retainsMatch then
+          none
+        else
+          match block.instructions[2 * fieldCount]?,
+              block.instructions[2 * fieldCount + 1]?, block.terminator with
+          | some (.releaseShared (.reg released)),
+              some (.alloc .shared allocationConstructor allocationArguments),
+              .tailCallSelf tailArguments =>
+              if released == source then
+                some {
+                  parameterCount
+                  source
+                  sourceConstructor
+                  fieldCount
+                  releasePosition := 2 * fieldCount
+                  allocationConstructor
+                  allocationArguments
+                  tailArguments }
+              else
+                none
+          | _, _, _ => none
+    | _ => none
+
+namespace Shape
+
+/-- Exact baseline syntax certified by a successful generic-prefix match. -/
+structure Fits (block : Block) (shape : Shape) : Prop where
+  instructionCountAtLeastFour : 4 ≤ block.instructions.size
+  fieldCountPositive : 0 < shape.fieldCount
+  instructionCount :
+    block.instructions.size = 2 * shape.fieldCount + 2
+  parameterCount : shape.parameterCount = block.valueParams.size
+  sourceBound : shape.source < shape.parameterCount
+  sourceOwned :
+    block.valueParams[shape.source]? = some (.owned .shared)
+  noCredits : block.creditParams = #[]
+  fetches : ∀ field, field < shape.fieldCount →
+    block.instructions[field]? = some
+      (.fetch (.reg shape.source) shape.sourceConstructor field)
+  retains : ∀ field, field < shape.fieldCount →
+    block.instructions[shape.fieldCount + field]? = some
+      (.retainShared (.reg (shape.parameterCount + field)))
+  release : block.instructions[shape.releasePosition]? =
+    some (.releaseShared (.reg shape.source))
+  releasePosition : shape.releasePosition = 2 * shape.fieldCount
+  allocation : block.instructions[shape.releasePosition + 1]? =
+    some (.alloc .shared shape.allocationConstructor
+      shape.allocationArguments)
+  terminator : block.terminator = .tailCallSelf shape.tailArguments
+
+end Shape
+
+/-- Invert the executable recognizer into its exact generalized baseline
+prefix.  This is the structural induction interface used by block simulation. -/
+theorem reuseShape?_sound {block : Block} {shape : Shape}
+    (found : reuseShape? block = some shape) : Shape.Fits block shape := by
+  unfold reuseShape? at found
+  split at found
+  · simp at found
+    · rcases found with ⟨minSize, checks, final⟩
+      split at final
+      · split at final
+        · simp only [Option.some.injEq] at final
+          rename_i _ source sourceConstructor firstAt _ _ _ released
+            allocationConstructor allocationArguments tailArguments
+            releaseAt allocationAt terminatorAt releaseEq
+          subst shape
+          rcases checks with
+            ⟨⟨⟨⟨⟨⟨two, instructionCount⟩, sourceBound⟩, sourceOwned⟩,
+              noCredits⟩, fetches⟩, retains⟩
+          constructor
+          · exact minSize
+          · exact Nat.div_pos two (by omega)
+          · exact instructionCount
+          · rfl
+          · exact sourceBound
+          · exact sourceOwned
+          · exact noCredits
+          · exact fetches
+          · exact retains
+          · dsimp
+            rw [← releaseEq]
+            exact releaseAt
+          · rfl
+          · dsimp
+            exact allocationAt
+          · dsimp
+            exact terminatorAt
+        · simp at final
+      · simp at final
+  · simp at found
+
+structure Representation where
+  layout : LayoutId
+
+/-- Exact-layout eligibility.  Layout identity alone is not allowed to hide
+an inconsistent schema table: source and target field worlds must also agree,
+and this dynamic lane currently consumes compiler-emitted shared retains. -/
+def representation? (context : Validate.Context) (shape : Shape) :
+    Option Representation := do
+  let sourceSchema ← context.schemas .shared shape.sourceConstructor
+  let allocationSchema ← context.schemas .shared shape.allocationConstructor
+  let expectedFields := Array.replicate shape.fieldCount .shared
+  if sourceSchema.fields == expectedFields &&
+      allocationSchema.fields == sourceSchema.fields &&
+      sourceSchema.layout == allocationSchema.layout then
+    some { layout := sourceSchema.layout }
+  else
+    none
+
+/-- Invert an accepted representation decision into the two exact schema
+lookups and all three compatibility equations used by reset/allocation
+simulation. -/
+theorem representation?_sound {context : Validate.Context} {shape : Shape}
+    {representation : Representation}
+    (found : representation? context shape = some representation) :
+    ∃ sourceSchema allocationSchema,
+      context.schemas .shared shape.sourceConstructor = some sourceSchema ∧
+      context.schemas .shared shape.allocationConstructor =
+        some allocationSchema ∧
+      sourceSchema.fields = Array.replicate shape.fieldCount .shared ∧
+      allocationSchema.fields = sourceSchema.fields ∧
+      sourceSchema.layout = allocationSchema.layout ∧
+      representation.layout = sourceSchema.layout := by
+  unfold representation? at found
+  cases sourceAt : context.schemas .shared shape.sourceConstructor with
+  | none => simp [sourceAt] at found
+  | some sourceSchema =>
+      cases allocationAt :
+          context.schemas .shared shape.allocationConstructor with
+      | none => simp [sourceAt, allocationAt] at found
+      | some allocationSchema =>
+          refine ⟨sourceSchema, allocationSchema, rfl, rfl, ?_⟩
+          simp [sourceAt, allocationAt] at found
+          rcases found with
+            ⟨⟨⟨sourceFields, allocationFields⟩, layouts⟩,
+              representationEq⟩
+          subst representation
+          exact ⟨sourceFields, allocationFields, layouts, rfl⟩
+
+def translateRegister? (shape : Shape) (value : ValueId) :
+    Option ValueId :=
+  if value < shape.parameterCount then
+    if value == shape.source then
+      none
+    else if value < shape.source then
+      some (shape.fieldCount + value)
+    else
+      some (shape.fieldCount + (value - 1))
+  else if value < shape.parameterCount + shape.fieldCount then
+    none
+  else if value < shape.parameterCount + 2 * shape.fieldCount then
+    some (value - (shape.parameterCount + shape.fieldCount))
+  else if value == shape.parameterCount + 2 * shape.fieldCount then
+    some (shape.fieldCount + (shape.parameterCount - 1))
+  else
+    none
+
+def translateAtom? (shape : Shape) : Atom → Option Atom
+  | .reg value => (translateRegister? shape value).map .reg
+  | .lit literal => some (.lit literal)
+  | .erased => some .erased
+
+def translateAtoms? (shape : Shape) (values : Array Atom) :
+    Option (Array Atom) :=
+  (values.toList.mapM (translateAtom? shape)).map List.toArray
+
+def branchValues (shape : Shape) : Array Atom :=
+  let fields := (List.range shape.fieldCount).map fun field =>
+    .reg (shape.parameterCount + field)
+  let parameters := ((List.range shape.parameterCount).filter fun value =>
+    value != shape.source).map fun value => .reg value
+  (fields ++ parameters).toArray
+
+structure Candidate (block : Block) where
+  placement : Placement block
+  sourceConstructor : CtorId
+  allocationConstructor : CtorId
+  layout : LayoutId
+  helperValueParams : Array ValueCap
+  resetValues : Array Atom
+  allocationArguments : Array Atom
+  tailArguments : Array Atom
+
+def candidate? (block : Block) (shape : Shape)
+    (representation : Representation) (placement : Placement block) :
+    Option (Candidate block) := do
+  let allocationArguments ←
+    translateAtoms? shape shape.allocationArguments
+  let tailArguments ← translateAtoms? shape shape.tailArguments
+  let helperValueParams :=
+    Array.replicate shape.fieldCount (.owned .shared) ++
+      (block.valueParams.toList.eraseIdx shape.source).toArray
+  some {
+    placement
+    sourceConstructor := shape.sourceConstructor
+    allocationConstructor := shape.allocationConstructor
+    layout := representation.layout
+    helperValueParams
+    resetValues := branchValues shape
+    allocationArguments
+    tailArguments }
+
+/-- Invert successful operand translation once, exposing the exact helper
+operands and every structural field copied into the accepted candidate. -/
+theorem candidate?_sound {block : Block} {shape : Shape}
+    {representation : Representation} {placement : Placement block}
+    {candidate : Candidate block}
+    (found : candidate? block shape representation placement =
+      some candidate) :
+    translateAtoms? shape shape.allocationArguments =
+        some candidate.allocationArguments ∧
+    translateAtoms? shape shape.tailArguments =
+        some candidate.tailArguments ∧
+    candidate.placement = placement ∧
+    candidate.sourceConstructor = shape.sourceConstructor ∧
+    candidate.allocationConstructor = shape.allocationConstructor ∧
+    candidate.layout = representation.layout ∧
+    candidate.helperValueParams =
+      Array.replicate shape.fieldCount (.owned .shared) ++
+        (block.valueParams.toList.eraseIdx shape.source).toArray ∧
+    candidate.resetValues = branchValues shape := by
+  unfold candidate? at found
+  cases allocationAt : translateAtoms? shape shape.allocationArguments with
+  | none => simp [allocationAt] at found
+  | some allocationArguments =>
+      cases tailAt : translateAtoms? shape shape.tailArguments with
+      | none => simp [allocationAt, tailAt] at found
+      | some tailArguments =>
+          simp [allocationAt, tailAt] at found
+          subst candidate
+          exact ⟨rfl, rfl, rfl, rfl, rfl, rfl, rfl, rfl⟩
+
+def creditBlock {block : Block} (candidate : Candidate block)
+    (credit : CreditCap) : Block :=
+  { valueParams := candidate.helperValueParams
+    creditParams := #[credit]
+    instructions := #[
+      .allocWith 0 .shared candidate.allocationConstructor
+        candidate.allocationArguments]
+    terminator := .tailCallSelf candidate.tailArguments }
+
+def resetBlock {block : Block} (candidate : Candidate block)
+    (hot cold : BlockId) : Block :=
+  { valueParams := block.valueParams
+    creditParams := #[]
+    instructions := #[.resetShared (.reg candidate.placement.value)
+      candidate.sourceConstructor]
+    terminator := .branchCredit 0
+      { target := hot
+        values := candidate.resetValues
+        credits := #[0] }
+      { target := cold
+        values := candidate.resetValues
+        credits := #[0] } }
+
+/-- Every premise used to accept one block rewrite, retained at the exact
+source block.  Proof consumers can recover the recognized baseline syntax,
+the checked last-use placement, exact layout compatibility, and the translated
+operand vectors without rerunning or inverting the optimizer. -/
+structure Site (limits : Validate.Limits) (context : Validate.Context)
+    (block : Block) where
+  shape : Shape
+  shapeFound : reuseShape? block = some shape
+  placement : Placement block
+  placementFound : inferPlacementWith limits block shape.source
+    shape.releasePosition = .ok (some placement)
+  representation : Representation
+  representationFound : representation? context shape = some representation
+  candidate : Candidate block
+  candidateFound : candidate? block shape representation placement =
+    some candidate
+
+namespace Site
+
+/-- The exact generalized baseline prefix retained by an accepted site. -/
+theorem fits {limits : Validate.Limits} {context : Validate.Context}
+    {block : Block} (site : Site limits context block) :
+    Shape.Fits block site.shape :=
+  reuseShape?_sound site.shapeFound
+
+/-- The liveness witness is attached to the recognized source register at its
+exact baseline release instruction. -/
+theorem placementCoordinates {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    site.placement.value = site.shape.source ∧
+      site.placement.position = site.shape.releasePosition :=
+  inferPlacementWith_sound site.placementFound
+
+/-- No use of the recognized source occurs after the release position selected
+by the accepted site. -/
+theorem noUseAfter {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    ∀ index, (bound : index < (Liveness.blockUses block).size) →
+      (Liveness.blockUses block)[index].value = site.shape.source →
+      (Liveness.blockUses block)[index].position ≤
+        site.shape.releasePosition := by
+  intro index bound sourceUse
+  have checked := site.placement.noUseAfter index bound
+  rw [site.placementCoordinates.1, site.placementCoordinates.2] at checked
+  exact checked sourceUse
+
+/-- Every instruction in an accepted source block belongs to its recognized
+fetch/retain/release/allocation prefix. This inversion is useful outside the
+local macro proof, where a suspended caller's call instruction rules out that
+its block was accepted by the reuse pass. -/
+theorem instructionCases {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat} {instruction : Instr}
+    (found : block.instructions[position]? = some instruction) :
+    (∃ field, field < site.shape.fieldCount ∧
+      instruction = .fetch (.reg site.shape.source)
+        site.shape.sourceConstructor field) ∨
+    (∃ field, field < site.shape.fieldCount ∧
+      instruction = .retainShared
+        (.reg (site.shape.parameterCount + field))) ∨
+    instruction = .releaseShared (.reg site.shape.source) ∨
+    instruction = .alloc .shared site.shape.allocationConstructor
+      site.shape.allocationArguments := by
+  have positionBound : position < block.instructions.size :=
+    (Array.getElem?_eq_some_iff.mp found).1
+  have positionLimit : position < 2 * site.shape.fieldCount + 2 := by
+    simpa [site.fits.instructionCount] using positionBound
+  by_cases fetchRange : position < site.shape.fieldCount
+  · left
+    exact ⟨position, fetchRange,
+      Option.some.inj (found.symm.trans
+        (site.fits.fetches position fetchRange))⟩
+  by_cases retainRange : position < 2 * site.shape.fieldCount
+  · right
+    left
+    let field := position - site.shape.fieldCount
+    have fieldBound : field < site.shape.fieldCount := by
+      dsimp [field]
+      omega
+    have positionEq : position = site.shape.fieldCount + field := by
+      dsimp [field]
+      omega
+    have retained := site.fits.retains field fieldBound
+    have found' : block.instructions[site.shape.fieldCount + field]? =
+        some instruction := by
+      simpa [positionEq] using found
+    exact ⟨field, fieldBound, Option.some.inj (found'.symm.trans retained)⟩
+  have finalCases : position = 2 * site.shape.fieldCount ∨
+      position = 2 * site.shape.fieldCount + 1 := by
+    omega
+  cases finalCases with
+  | inl releasePosition =>
+      right
+      right
+      left
+      have positionEq : position = site.shape.releasePosition := by
+        rw [site.fits.releasePosition]
+        exact releasePosition
+      have found' : block.instructions[site.shape.releasePosition]? =
+          some instruction := by
+        simpa [positionEq] using found
+      exact Option.some.inj (found'.symm.trans site.fits.release)
+  | inr allocationPosition =>
+      right
+      right
+      right
+      have positionEq : position = site.shape.releasePosition + 1 := by
+        rw [site.fits.releasePosition]
+        exact allocationPosition
+      have found' : block.instructions[site.shape.releasePosition + 1]? =
+          some instruction := by
+        simpa [positionEq] using found
+      exact Option.some.inj (found'.symm.trans site.fits.allocation)
+
+/-- Accepted source blocks contain no addressed call instruction. -/
+theorem noCall {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat}
+    {address : Ixon.Address} {arguments : Array Atom}
+    (found : block.instructions[position]? = some (.call address arguments)) :
+    False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no recursive call instruction. -/
+theorem noCallSelf {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat}
+    {arguments : Array Atom}
+    (found : block.instructions[position]? = some (.callSelf arguments)) :
+    False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no dynamic application instruction. -/
+theorem noApply {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat}
+    {function : Atom} {arguments : Array Atom}
+    (found : block.instructions[position]? = some (.apply function arguments)) :
+    False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no ordinary move instruction. -/
+theorem noMove {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat} {atom : Atom}
+    (found : block.instructions[position]? = some (.move atom)) : False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no unique-free instruction. -/
+theorem noFreeUnique {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat} {atom : Atom}
+    {identity : CtorId}
+    (found : block.instructions[position]? =
+      some (.freeUnique atom identity)) : False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no function-partial-application
+instruction. -/
+theorem noPapp {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat}
+    {address : Ixon.Address} {arguments : Array Atom}
+    (found : block.instructions[position]? =
+      some (.papp address arguments)) : False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no unique-drop instruction. -/
+theorem noDropUnique {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat} {atom : Atom}
+    (found : block.instructions[position]? = some (.dropUnique atom)) :
+    False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Accepted source blocks contain no unique allocation instruction. -/
+theorem noAllocUnique {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) {position : Nat} {identity : CtorId}
+    {arguments : Array Atom}
+    (found : block.instructions[position]? =
+      some (.alloc .unique identity arguments)) : False := by
+  rcases site.instructionCases found with
+    ⟨field, bound, impossible⟩ | ⟨field, bound, impossible⟩ |
+      impossible | impossible <;> cases impossible
+
+/-- Core candidate fields are copied exactly from the recognized site; the
+reset target additionally agrees with the liveness-checked source register. -/
+theorem candidateCore {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    site.candidate.placement.value = site.shape.source ∧
+      site.candidate.sourceConstructor = site.shape.sourceConstructor ∧
+      site.candidate.allocationConstructor =
+        site.shape.allocationConstructor ∧
+      site.candidate.layout = site.representation.layout := by
+  rcases candidate?_sound site.candidateFound with
+    ⟨_, _, placement, sourceConstructor, allocationConstructor, layout,
+      _, _⟩
+  have sourceValue := congrArg (fun selected => selected.value) placement
+  exact ⟨sourceValue.trans site.placementCoordinates.1, sourceConstructor,
+    allocationConstructor, layout⟩
+
+/-- Helper ABI and branch operands are copied from the recognized shape. -/
+theorem candidateVectors {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    site.candidate.helperValueParams =
+        Array.replicate site.shape.fieldCount (.owned .shared) ++
+          (block.valueParams.toList.eraseIdx site.shape.source).toArray ∧
+      site.candidate.resetValues = branchValues site.shape := by
+  rcases candidate?_sound site.candidateFound with
+    ⟨_, _, _, _, _, _, helperValueParams, resetValues⟩
+  exact ⟨helperValueParams, resetValues⟩
+
+/-- Fully exposed syntax of the replacement block emitted for this site. -/
+theorem resetBlock_eq {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) (hot cold : BlockId) :
+    resetBlock site.candidate hot cold =
+      { valueParams := block.valueParams
+        creditParams := #[]
+        instructions := #[.resetShared (.reg site.shape.source)
+          site.shape.sourceConstructor]
+        terminator := .branchCredit 0
+          { target := hot
+            values := branchValues site.shape
+            credits := #[0] }
+          { target := cold
+            values := branchValues site.shape
+            credits := #[0] } } := by
+  simp [resetBlock, site.candidateCore.1, site.candidateCore.2.1,
+    site.candidateVectors.2]
+
+/-- An accepted source block is never literally its reset replacement. The
+recognized source begins with a field fetch (and has positive field count),
+whereas the replacement begins with `resetShared`. -/
+theorem ne_resetBlock {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) (hot cold : BlockId) :
+    block ≠ resetBlock site.candidate hot cold := by
+  intro equal
+  have sizes := congrArg (fun selected => selected.instructions.size) equal
+  have resetSize : (resetBlock site.candidate hot cold).instructions.size = 1 :=
+    by rfl
+  rw [resetSize] at sizes
+  rw [site.fits.instructionCount] at sizes
+  omega
+
+/-- Fully exposed syntax of either required- or optional-credit helper. -/
+theorem creditBlock_eq {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) (credit : CreditCap) :
+    creditBlock site.candidate credit =
+      { valueParams :=
+          Array.replicate site.shape.fieldCount (.owned .shared) ++
+            (block.valueParams.toList.eraseIdx site.shape.source).toArray
+        creditParams := #[credit]
+        instructions := #[.allocWith 0 .shared
+          site.shape.allocationConstructor
+          site.candidate.allocationArguments]
+        terminator := .tailCallSelf site.candidate.tailArguments } := by
+  simp [creditBlock, site.candidateCore.2.2.1,
+    site.candidateVectors.1]
+
+/-- The exact source/allocation schemas and compatibility equations retained
+by an accepted site. -/
+theorem schemas {limits : Validate.Limits} {context : Validate.Context}
+    {block : Block} (site : Site limits context block) :
+    ∃ sourceSchema allocationSchema,
+      context.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema ∧
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema ∧
+      sourceSchema.fields =
+        Array.replicate site.shape.fieldCount .shared ∧
+      allocationSchema.fields = sourceSchema.fields ∧
+      sourceSchema.layout = allocationSchema.layout ∧
+      site.representation.layout = sourceSchema.layout :=
+  representation?_sound site.representationFound
+
+/-- Schema facts in the exact form consumed by reset and `allocWith`: both
+lookups succeed, both field vectors are uniformly shared, and the emitted
+credit layout matches both constructors. -/
+theorem runtimeSchemas {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    ∃ sourceSchema allocationSchema,
+      context.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema ∧
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema ∧
+      sourceSchema.fields =
+        Array.replicate site.shape.fieldCount .shared ∧
+      allocationSchema.fields = sourceSchema.fields ∧
+      site.candidate.layout = sourceSchema.layout ∧
+      site.candidate.layout = allocationSchema.layout := by
+  obtain ⟨sourceSchema, allocationSchema, sourceAt, allocationAt,
+      sourceFields, allocationFields, layouts, representationLayout⟩ :=
+    site.schemas
+  have candidateRepresentation := site.candidateCore.2.2.2
+  have candidateSource := candidateRepresentation.trans representationLayout
+  exact ⟨sourceSchema, allocationSchema, sourceAt, allocationAt,
+    sourceFields, allocationFields, candidateSource,
+    candidateSource.trans layouts⟩
+
+/-- Accepted allocation operands are the successful register translation of
+the recognized baseline allocation operands. -/
+theorem allocationArgumentsFound {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    translateAtoms? site.shape site.shape.allocationArguments =
+      some site.candidate.allocationArguments :=
+  (candidate?_sound site.candidateFound).1
+
+/-- Accepted tail operands are the successful register translation of the
+recognized baseline tail operands. -/
+theorem tailArgumentsFound {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Site limits context block) :
+    translateAtoms? site.shape site.shape.tailArguments =
+      some site.candidate.tailArguments :=
+  (candidate?_sound site.candidateFound).2.1
+
+end Site
+
+/-- Exhaustive checked decision for one source block.  Rejection constructors
+retain the exact failed phase as well, so an unchanged block is justified by
+the same computation that produced the output rather than by a later Boolean
+audit. -/
+inductive Decision (limits : Validate.Limits) (context : Validate.Context)
+    (block : Block) : Type where
+  | noShape (notFound : reuseShape? block = none)
+  | livenessError (shape : Shape)
+      (shapeFound : reuseShape? block = some shape)
+      (error : Liveness.Error)
+      (rejected : inferPlacementWith limits block shape.source
+        shape.releasePosition = .error error)
+  | livenessMiss (shape : Shape)
+      (shapeFound : reuseShape? block = some shape)
+      (rejected : inferPlacementWith limits block shape.source
+        shape.releasePosition = .ok none)
+  | representationMiss (shape : Shape)
+      (shapeFound : reuseShape? block = some shape)
+      (placement : Placement block)
+      (placementFound : inferPlacementWith limits block shape.source
+        shape.releasePosition = .ok (some placement))
+      (notFound : representation? context shape = none)
+  | operandMiss (shape : Shape)
+      (shapeFound : reuseShape? block = some shape)
+      (placement : Placement block)
+      (placementFound : inferPlacementWith limits block shape.source
+        shape.releasePosition = .ok (some placement))
+      (representation : Representation)
+      (representationFound : representation? context shape =
+        some representation)
+      (notFound : candidate? block shape representation placement = none)
+  | accepted (site : Site limits context block)
+
+/-- Run the recognizer exactly once and retain its dependent decision. -/
+def classifyBlock (limits : Validate.Limits) (context : Validate.Context)
+    (block : Block) : Decision limits context block := by
+  match shapeFound : reuseShape? block with
+  | none => exact .noShape shapeFound
+  | some shape =>
+      match placementFound : inferPlacementWith limits block shape.source
+          shape.releasePosition with
+      | .error error =>
+          exact .livenessError shape shapeFound error placementFound
+      | .ok none =>
+          exact .livenessMiss shape shapeFound placementFound
+      | .ok (some placement) =>
+          match representationFound : representation? context shape with
+          | none =>
+              exact .representationMiss shape shapeFound placement
+                placementFound representationFound
+          | some representation =>
+              match candidateFound :
+                  candidate? block shape representation placement with
+              | none =>
+                  exact .operandMiss shape shapeFound placement placementFound
+                    representation representationFound candidateFound
+              | some candidate =>
+                  exact .accepted {
+                    shape
+                    shapeFound
+                    placement
+                    placementFound
+                    representation
+                    representationFound
+                    candidate
+                    candidateFound }
+
+def Decision.report {limits : Validate.Limits} {context : Validate.Context}
+    {block : Block} (decision : Decision limits context block) : Report :=
+  match decision with
+  | .noShape _ => { scannedBlocks := 1 }
+  | .livenessError .. | .livenessMiss .. =>
+      { scannedBlocks := 1, shapeCandidates := 1, livenessRejected := 1 }
+  | .representationMiss .. =>
+      { scannedBlocks := 1, shapeCandidates := 1,
+        incompatibleLayouts := 1 }
+  | .operandMiss .. =>
+      { scannedBlocks := 1, shapeCandidates := 1,
+        unmappableOperands := 1 }
+  | .accepted _ =>
+      { scannedBlocks := 1, shapeCandidates := 1, rewritten := 1,
+        helperBlocks := 2 }
+
+/-- Replacement occupying the source block's old ID. -/
+def Decision.replacement {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (decision : Decision limits context block) (originalCount helperOffset : Nat) :
+    Block :=
+  match decision with
+  | .accepted site =>
+      resetBlock site.candidate (originalCount + helperOffset)
+        (originalCount + helperOffset + 1)
+  | _ => block
+
+/-- Helper blocks appended for this decision, in hot/required then
+cold/optional order. -/
+def Decision.helpers {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (decision : Decision limits context block) : List Block :=
+  match decision with
+  | .accepted site =>
+      [creditBlock site.candidate (.required site.candidate.layout),
+       creditBlock site.candidate (.optional site.candidate.layout)]
+  | _ => []
+
+/-- Replacing an accepted block preserves its externally visible value
+parameter ABI; rejected blocks are literal identities. -/
+theorem Decision.replacement_valueParams {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (decision : Decision limits context block) (originalCount helperOffset : Nat) :
+    (decision.replacement originalCount helperOffset).valueParams =
+      block.valueParams := by
+  cases decision with
+  | noShape => rfl
+  | livenessError => rfl
+  | livenessMiss => rfl
+  | representationMiss => rfl
+  | operandMiss => rfl
+  | accepted site =>
+      simpa [Decision.replacement] using congrArg Block.valueParams
+          (site.resetBlock_eq (originalCount + helperOffset)
+            (originalCount + helperOffset + 1))
+
+/-- The replacement also preserves the credit-parameter ABI.  Accepted
+source blocks are certified credit-free and reset blocks have the same empty
+credit vector. -/
+theorem Decision.replacement_creditParams {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (decision : Decision limits context block) (originalCount helperOffset : Nat) :
+    (decision.replacement originalCount helperOffset).creditParams =
+      block.creditParams := by
+  cases decision with
+  | noShape => rfl
+  | livenessError => rfl
+  | livenessMiss => rfl
+  | representationMiss => rfl
+  | operandMiss => rfl
+  | accepted site =>
+      calc
+        (Decision.replacement (.accepted site) originalCount
+          helperOffset).creditParams = #[] := by
+            simpa [Decision.replacement] using congrArg Block.creditParams
+                (site.resetBlock_eq (originalCount + helperOffset)
+                  (originalCount + helperOffset + 1))
+        _ = block.creditParams := site.fits.noCredits.symm
+
+/-- Heterogeneous decision list indexed by the exact source block list. -/
+inductive FunctionDecisions (limits : Validate.Limits)
+    (context : Validate.Context) : List Block → Type where
+  | nil : FunctionDecisions limits context []
+  | cons {block : Block} {blocks : List Block}
+      (head : Decision limits context block)
+      (tail : FunctionDecisions limits context blocks) :
+      FunctionDecisions limits context (block :: blocks)
+
+def classifyBlocks (limits : Validate.Limits) (context : Validate.Context) :
+    (blocks : List Block) → FunctionDecisions limits context blocks
+  | [] => .nil
+  | block :: blocks =>
+      .cons (classifyBlock limits context block)
+        (classifyBlocks limits context blocks)
+
+structure Realization where
+  originals : List Block := []
+  helpers : List Block := []
+  report : Report := {}
+
+namespace FunctionDecisions
+
+/-- Materialize a decision list while threading the number of helpers already
+assigned IDs.  Because every accepted site contributes its two helpers before
+the tail is realized, their IDs agree with the append-only executable pass. -/
+def realize {limits : Validate.Limits} {context : Validate.Context}
+    (originalCount : Nat) : {blocks : List Block} →
+      FunctionDecisions limits context blocks → Nat → Realization
+  | [], .nil, _ => {}
+  | _ :: _, .cons head tail, helperOffset =>
+      let generated := head.helpers
+      let rest := realize originalCount tail (helperOffset + generated.length)
+      { originals := head.replacement originalCount helperOffset ::
+          rest.originals
+        helpers := generated ++ rest.helpers
+        report := head.report.add rest.report }
+
+/-- Locate a block decision by its source block ID.  `helperOffset` is the
+number of helper blocks contributed by preceding source blocks. -/
+inductive At {limits : Validate.Limits} {context : Validate.Context} :
+    {blocks : List Block} → FunctionDecisions limits context blocks →
+      (index helperOffset : Nat) → (block : Block) →
+      Decision limits context block → Prop where
+  | zero {block : Block} {blocks : List Block}
+      {head : Decision limits context block}
+      {tail : FunctionDecisions limits context blocks} :
+      At (.cons head tail) 0 0 block head
+  | succ {headBlock block : Block} {blocks : List Block}
+      {head : Decision limits context headBlock}
+      {tail : FunctionDecisions limits context blocks}
+      {index helperOffset : Nat}
+      {decision : Decision limits context block}
+      (found : At tail index helperOffset block decision) :
+      At (.cons head tail) (index + 1)
+        (head.helpers.length + helperOffset) block decision
+
+theorem exists_at {limits : Validate.Limits} {context : Validate.Context}
+    {blocks : List Block} (decisions : FunctionDecisions limits context blocks)
+    (index : Nat) (bound : index < blocks.length) :
+    ∃ helperOffset block decision,
+      At decisions index helperOffset block decision := by
+  induction decisions generalizing index with
+  | nil => simp at bound
+  | @cons block blocks head tail ih =>
+      cases index with
+      | zero => exact ⟨0, block, head, .zero⟩
+      | succ index =>
+          have tailBound : index < blocks.length := by
+            simpa using bound
+          obtain ⟨helperOffset, foundBlock, decision, found⟩ :=
+            ih index tailBound
+          exact ⟨head.helpers.length + helperOffset, foundBlock, decision,
+            .succ found⟩
+
+theorem At.source_get? {limits : Validate.Limits}
+    {context : Validate.Context} {blocks : List Block}
+    {decisions : FunctionDecisions limits context blocks}
+    {index helperOffset : Nat} {block : Block}
+    {decision : Decision limits context block}
+    (found : At decisions index helperOffset block decision) :
+    blocks[index]? = some block := by
+  induction found with
+  | zero => simp
+  | succ _ ih => simpa using ih
+
+@[simp] theorem realize_originals_length {limits : Validate.Limits}
+    {context : Validate.Context} {blocks : List Block}
+    (decisions : FunctionDecisions limits context blocks)
+    (originalCount helperOffset : Nat) :
+    (decisions.realize originalCount helperOffset).originals.length =
+      blocks.length := by
+  induction decisions generalizing helperOffset with
+  | nil => rfl
+  | cons head tail ih =>
+      simp [realize, ih]
+
+theorem At.original_get? {limits : Validate.Limits}
+    {context : Validate.Context} {blocks : List Block}
+    {decisions : FunctionDecisions limits context blocks}
+    {index helperOffset : Nat} {block : Block}
+    {decision : Decision limits context block}
+    (found : At decisions index helperOffset block decision)
+    (originalCount startOffset : Nat) :
+    (decisions.realize originalCount startOffset).originals[index]? =
+      some (decision.replacement originalCount
+        (startOffset + helperOffset)) := by
+  induction found generalizing startOffset with
+  | zero => simp [realize]
+  | @succ headBlock block blocks head tail index helperOffset decision
+      found ih =>
+      simpa [realize, Nat.add_assoc] using
+        ih (startOffset + head.helpers.length)
+
+theorem At.helper_get? {limits : Validate.Limits}
+    {context : Validate.Context} {blocks : List Block}
+    {decisions : FunctionDecisions limits context blocks}
+    {index helperOffset : Nat} {block : Block}
+    {decision : Decision limits context block}
+    (found : At decisions index helperOffset block decision)
+    {inside : Nat} {helper : Block}
+    (insideAt : decision.helpers[inside]? = some helper)
+    (originalCount startOffset : Nat) :
+    (decisions.realize originalCount startOffset).helpers[
+        helperOffset + inside]? = some helper := by
+  induction found generalizing startOffset with
+  | zero =>
+      simp only [realize, Nat.zero_add]
+      rw [List.getElem?_append_left]
+      · exact insideAt
+      · exact (List.getElem?_eq_some_iff.mp insideAt).choose
+  | @succ headBlock block blocks head tail index helperOffset decision
+      found ih =>
+      simp only [realize]
+      rw [List.getElem?_append_right (by omega)]
+      simpa [Nat.add_assoc] using
+        ih insideAt (startOffset + head.helpers.length)
+
+theorem At.hot_helper_get? {limits : Validate.Limits}
+    {context : Validate.Context} {blocks : List Block}
+    {decisions : FunctionDecisions limits context blocks}
+    {index helperOffset : Nat} {block : Block}
+    {site : Site limits context block}
+    (found : At decisions index helperOffset block (.accepted site))
+    (originalCount startOffset : Nat) :
+    (decisions.realize originalCount startOffset).helpers[helperOffset]? =
+      some (creditBlock site.candidate
+        (.required site.candidate.layout)) := by
+  simpa using found.helper_get?
+    (inside := 0) (by simp [Decision.helpers]) originalCount startOffset
+
+theorem At.cold_helper_get? {limits : Validate.Limits}
+    {context : Validate.Context} {blocks : List Block}
+    {decisions : FunctionDecisions limits context blocks}
+    {index helperOffset : Nat} {block : Block}
+    {site : Site limits context block}
+    (found : At decisions index helperOffset block (.accepted site))
+    (originalCount startOffset : Nat) :
+    (decisions.realize originalCount startOffset).helpers[helperOffset + 1]? =
+      some (creditBlock site.candidate
+        (.optional site.candidate.layout)) := by
+  exact found.helper_get?
+    (inside := 1) (by simp [Decision.helpers]) originalCount startOffset
+
+end FunctionDecisions
+
+/-- Complete proof-carrying rewrite of one function. -/
+structure FunctionRewrite (limits : Validate.Limits)
+    (context : Validate.Context) (source : Function) where
+  decisions : FunctionDecisions limits context source.blocks.toList
+
+namespace FunctionRewrite
+
+def realization {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source) :
+    Realization :=
+  rewrite.decisions.realize source.blocks.size 0
+
+def definition {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source) :
+    Function :=
+  { source with blocks :=
+      (rewrite.realization.originals ++ rewrite.realization.helpers).toArray }
+
+def report {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source) :
+    Report :=
+  rewrite.realization.report
+
+@[simp] theorem definition_signature {limits : Validate.Limits}
+    {context : Validate.Context} {source : Function}
+    (rewrite : FunctionRewrite limits context source) :
+    rewrite.definition.signature = source.signature := by
+  rfl
+
+/-- Every original block ID has one exhaustive source decision and resolves to
+that decision's replacement at the same target ID. -/
+theorem decisionAt {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source)
+    (index : Nat) (bound : index < source.blocks.size) :
+    ∃ helperOffset block decision,
+      FunctionDecisions.At rewrite.decisions index helperOffset block
+        decision ∧
+      source.blocks[index]? = some block ∧
+      rewrite.definition.blocks[index]? =
+        some (decision.replacement source.blocks.size helperOffset) := by
+  have listBound : index < source.blocks.toList.length := by
+    simpa using bound
+  obtain ⟨helperOffset, block, decision, found⟩ :=
+    FunctionDecisions.exists_at rewrite.decisions index listBound
+  have sourceAt : source.blocks[index]? = some block := by
+    simpa only [Array.getElem?_toList] using found.source_get?
+  let realized := rewrite.realization
+  have originalsLength : realized.originals.length = source.blocks.size := by
+    simp [realized, realization]
+  have originalAt : realized.originals[index]? =
+      some (decision.replacement source.blocks.size helperOffset) := by
+    simpa [realized, realization] using
+      found.original_get? source.blocks.size 0
+  have originalBound : index < realized.originals.length := by
+    simpa [originalsLength] using bound
+  have targetAt : rewrite.definition.blocks[index]? =
+      some (decision.replacement source.blocks.size helperOffset) := by
+    change (realized.originals ++ realized.helpers).toArray[index]? = _
+    rw [List.getElem?_toArray, List.getElem?_append_left originalBound]
+    exact originalAt
+  exact ⟨helperOffset, block, decision, found, sourceAt, targetAt⟩
+
+/-- An accepted decision exposes all three target block lookups needed by the
+semantic diamond: the reset replacement at the old ID and the appended hot
+and cold credit blocks. -/
+theorem acceptedAt {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Site limits context block}
+    (found : FunctionDecisions.At rewrite.decisions index helperOffset block
+      (.accepted site)) :
+    source.blocks[index]? = some block ∧
+    rewrite.definition.blocks[index]? =
+      some (resetBlock site.candidate
+        (source.blocks.size + helperOffset)
+        (source.blocks.size + helperOffset + 1)) ∧
+    rewrite.definition.blocks[source.blocks.size + helperOffset]? =
+      some (creditBlock site.candidate
+        (.required site.candidate.layout)) ∧
+    rewrite.definition.blocks[source.blocks.size + helperOffset + 1]? =
+      some (creditBlock site.candidate
+        (.optional site.candidate.layout)) := by
+  let realized := rewrite.realization
+  have sourceAt : source.blocks[index]? = some block := by
+    simpa only [Array.getElem?_toList] using found.source_get?
+  have originalsLength : realized.originals.length = source.blocks.size := by
+    simp [realized, realization]
+  have originalAt : realized.originals[index]? =
+      some (resetBlock site.candidate
+        (source.blocks.size + helperOffset)
+        (source.blocks.size + helperOffset + 1)) := by
+    simpa [realized, realization, Decision.replacement] using
+      found.original_get? source.blocks.size 0
+  have originalBound : index < realized.originals.length := by
+    rw [originalsLength]
+    simpa using (List.getElem?_eq_some_iff.mp found.source_get?).choose
+  have targetOriginal : rewrite.definition.blocks[index]? =
+      some (resetBlock site.candidate
+        (source.blocks.size + helperOffset)
+        (source.blocks.size + helperOffset + 1)) := by
+    change (realized.originals ++ realized.helpers).toArray[index]? = _
+    rw [List.getElem?_toArray, List.getElem?_append_left originalBound]
+    exact originalAt
+  have hotAt : realized.helpers[helperOffset]? =
+      some (creditBlock site.candidate
+        (.required site.candidate.layout)) := by
+    simpa [realized, realization] using
+      found.hot_helper_get? source.blocks.size 0
+  have coldAt : realized.helpers[helperOffset + 1]? =
+      some (creditBlock site.candidate
+        (.optional site.candidate.layout)) := by
+    simpa [realized, realization] using
+      found.cold_helper_get? source.blocks.size 0
+  have targetHot :
+      rewrite.definition.blocks[source.blocks.size + helperOffset]? =
+        some (creditBlock site.candidate
+          (.required site.candidate.layout)) := by
+    change (realized.originals ++ realized.helpers).toArray[
+      source.blocks.size + helperOffset]? = _
+    rw [List.getElem?_toArray, ← originalsLength,
+      List.getElem?_append_right (by omega)]
+    simpa using hotAt
+  have targetCold :
+      rewrite.definition.blocks[source.blocks.size + helperOffset + 1]? =
+        some (creditBlock site.candidate
+          (.optional site.candidate.layout)) := by
+    change (realized.originals ++ realized.helpers).toArray[
+      source.blocks.size + helperOffset + 1]? = _
+    rw [List.getElem?_toArray, ← originalsLength,
+      List.getElem?_append_right (by omega)]
+    simpa [Nat.add_assoc] using coldAt
+  exact ⟨sourceAt, targetOriginal, targetHot, targetCold⟩
+
+/-- At an accepted original block ID, the rewritten block cannot remain the
+literal source block. This is the decision-level disjointness fact used to
+show that unchanged synchronized blocks have no accepted-entry phase
+obligation. -/
+theorem accepted_target_ne_source {limits : Validate.Limits}
+    {context : Validate.Context} {source : Function}
+    (rewrite : FunctionRewrite limits context source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Site limits context block}
+    (found : FunctionDecisions.At rewrite.decisions index helperOffset block
+      (.accepted site)) :
+    rewrite.definition.blocks[index]? ≠ some block := by
+  intro unchanged
+  have target := (rewrite.acceptedAt found).2.1
+  have equal : resetBlock site.candidate
+      (source.blocks.size + helperOffset)
+      (source.blocks.size + helperOffset + 1) = block :=
+    Option.some.inj (target.symm.trans unchanged)
+  exact site.ne_resetBlock _ _ equal.symm
+
+/-- Exhaustive proof-facing classification of one original block ID.  A
+rejected decision exposes literal source/target block equality; an accepted
+decision retains the dependent site witness from which `acceptedAt` recovers
+the reset and both helper blocks. -/
+inductive BlockCase {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source)
+    (index : Nat) : Prop where
+  | unchanged {block : Block}
+      (sourceAt : source.blocks[index]? = some block)
+      (targetAt : rewrite.definition.blocks[index]? = some block) :
+      BlockCase rewrite index
+  | accepted {helperOffset : Nat} {block : Block}
+      {site : Site limits context block}
+      (found : FunctionDecisions.At rewrite.decisions index helperOffset
+        block (.accepted site)) :
+      BlockCase rewrite index
+
+/-- Every original block ID is either preserved literally or carries the
+accepted-site witness needed by the semantic reset/reuse diamond. -/
+theorem blockCase {limits : Validate.Limits} {context : Validate.Context}
+    {source : Function} (rewrite : FunctionRewrite limits context source)
+    (index : Nat) (bound : index < source.blocks.size) :
+    BlockCase rewrite index := by
+  obtain ⟨helperOffset, block, decision, found, sourceAt, targetAt⟩ :=
+    rewrite.decisionAt index bound
+  cases decision with
+  | noShape notFound =>
+      exact .unchanged sourceAt
+        (by simpa [Decision.replacement] using targetAt)
+  | livenessError shape shapeFound error rejected =>
+      exact .unchanged sourceAt
+        (by simpa [Decision.replacement] using targetAt)
+  | livenessMiss shape shapeFound rejected =>
+      exact .unchanged sourceAt
+        (by simpa [Decision.replacement] using targetAt)
+  | representationMiss shape shapeFound placement placementFound notFound =>
+      exact .unchanged sourceAt
+        (by simpa [Decision.replacement] using targetAt)
+  | operandMiss shape shapeFound placement placementFound representation
+      representationFound notFound =>
+      exact .unchanged sourceAt
+        (by simpa [Decision.replacement] using targetAt)
+  | accepted site =>
+      exact .accepted found
+
+/-- A successful source lookup supplies the bound needed for exhaustive
+decision dispatch. -/
+theorem blockCaseOfLookup {limits : Validate.Limits}
+    {context : Validate.Context} {source : Function}
+    (rewrite : FunctionRewrite limits context source)
+    {index : Nat} {block : Block}
+    (found : source.blocks[index]? = some block) :
+    BlockCase rewrite index := by
+  have bound : index < source.blocks.size :=
+    (Array.getElem?_eq_some_iff.mp found).choose
+  exact rewrite.blockCase index bound
+
+/-- Every original target ID retains the source block's incoming value and
+credit ABI, even when its body is replaced by an accepted reset block. -/
+theorem targetBlockAbi {limits : Validate.Limits}
+    {context : Validate.Context} {source : Function}
+    (rewrite : FunctionRewrite limits context source)
+    {index : Nat} {block : Block}
+    (found : source.blocks[index]? = some block) :
+    ∃ targetBlock,
+      rewrite.definition.blocks[index]? = some targetBlock ∧
+      targetBlock.valueParams = block.valueParams ∧
+      targetBlock.creditParams = block.creditParams := by
+  have bound : index < source.blocks.size :=
+    (Array.getElem?_eq_some_iff.mp found).choose
+  obtain ⟨helperOffset, selectedBlock, decision, _selected,
+      sourceAt, targetAt⟩ := rewrite.decisionAt index bound
+  have blockEq : selectedBlock = block :=
+    Option.some.inj (sourceAt.symm.trans found)
+  subst selectedBlock
+  exact ⟨decision.replacement source.blocks.size helperOffset, targetAt,
+    decision.replacement_valueParams source.blocks.size helperOffset,
+    decision.replacement_creditParams source.blocks.size helperOffset⟩
+
+/-- Rewriting cannot turn an executable function into an empty one: every
+source block keeps an original target coordinate. -/
+theorem definition_blocks_nonempty {limits : Validate.Limits}
+    {context : Validate.Context} {source : Function}
+    (rewrite : FunctionRewrite limits context source)
+    (nonempty : source.blocks.isEmpty = false) :
+    rewrite.definition.blocks.isEmpty = false := by
+  have sourceEntryBound : 0 < source.blocks.size := by
+    apply Nat.pos_of_ne_zero
+    intro sizeZero
+    exact (Array.isEmpty_eq_false_iff.mp nonempty)
+      (Array.size_eq_zero_iff.mp sizeZero)
+  have sourceEntry : source.blocks[0]? = some source.blocks[0] :=
+    Array.getElem?_eq_getElem sourceEntryBound
+  obtain ⟨targetEntry, targetEntryAt, _valueParams, _creditParams⟩ :=
+    rewrite.targetBlockAbi sourceEntry
+  apply Array.isEmpty_eq_false_iff.mpr
+  intro targetEmpty
+  rw [targetEmpty] at targetEntryAt
+  simp at targetEntryAt
+
+end FunctionRewrite
+
+/-- Rewrite every independent matching block in one function while retaining
+the exact ordered decision trace. -/
+def rewriteFunction (limits : Validate.Limits) (context : Validate.Context)
+    (definition : Function) : FunctionRewrite limits context definition :=
+  { decisions := classifyBlocks limits context definition.blocks.toList }
+
+/-- Pure rewrite output, separated from validation so its exact result can be
+retained in the checked API. -/
+structure Rewrite where
+  program : Program
+  report : Report
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Ordered function traces indexed by the literal declaration list.  Extern
+entries are preserved exactly; function entries carry their dependent block
+decision trace. -/
+inductive DeclarationDecisions (limits : Validate.Limits)
+    (context : Validate.Context) :
+    List (Ix.Compiler.Ixon.Address × Decl) → Type where
+  | nil : DeclarationDecisions limits context []
+  | extern (address : Ix.Compiler.Ixon.Address) (arity : Nat)
+      {rest : List (Ix.Compiler.Ixon.Address × Decl)}
+      (tail : DeclarationDecisions limits context rest) :
+      DeclarationDecisions limits context
+        ((address, .extern arity) :: rest)
+  | fn (address : Ix.Compiler.Ixon.Address) (definition : Function)
+      {rest : List (Ix.Compiler.Ixon.Address × Decl)}
+      (head : FunctionRewrite limits context definition)
+      (tail : DeclarationDecisions limits context rest) :
+      DeclarationDecisions limits context
+        ((address, .fn definition) :: rest)
+
+def rewriteDeclarations (limits : Validate.Limits)
+    (context : Validate.Context) :
+    (declarations : List (Ix.Compiler.Ixon.Address × Decl)) →
+      DeclarationDecisions limits context declarations
+  | [] => .nil
+  | (address, .extern arity) :: rest =>
+      .extern address arity (rewriteDeclarations limits context rest)
+  | (address, .fn definition) :: rest =>
+      .fn address definition (rewriteFunction limits context definition)
+        (rewriteDeclarations limits context rest)
+
+namespace DeclarationDecisions
+
+def target {limits : Validate.Limits} {context : Validate.Context} :
+    {source : List (Ix.Compiler.Ixon.Address × Decl)} →
+      DeclarationDecisions limits context source →
+      List (Ix.Compiler.Ixon.Address × Decl)
+  | [], .nil => []
+  | _, .extern address arity tail =>
+      (address, .extern arity) :: target tail
+  | _, .fn address _ head tail =>
+      (address, .fn head.definition) :: target tail
+
+def report {limits : Validate.Limits} {context : Validate.Context} :
+    {source : List (Ix.Compiler.Ixon.Address × Decl)} →
+      DeclarationDecisions limits context source → Report
+  | [], .nil => {}
+  | _, .extern _ _ tail => report tail
+  | _, .fn _ _ head tail => head.report.add (report tail)
+
+end DeclarationDecisions
+
+/-- Declaration-level relation exported by the rewrite trace. -/
+inductive DeclarationRel (limits : Validate.Limits)
+    (context : Validate.Context) : Decl → Decl → Prop where
+  | extern (arity : Nat) : DeclarationRel limits context
+      (.extern arity) (.extern arity)
+  | fn {source : Function}
+      (rewrite : FunctionRewrite limits context source) :
+      DeclarationRel limits context (.fn source) (.fn rewrite.definition)
+
+inductive DeclarationsRel (limits : Validate.Limits)
+    (context : Validate.Context) :
+    List (Ix.Compiler.Ixon.Address × Decl) →
+      List (Ix.Compiler.Ixon.Address × Decl) → Prop where
+  | nil : DeclarationsRel limits context [] []
+  | extern (address : Ix.Compiler.Ixon.Address) (arity : Nat)
+      {sourceTarget : List (Ix.Compiler.Ixon.Address × Decl)}
+      {targetTail : List (Ix.Compiler.Ixon.Address × Decl)}
+      (tail : DeclarationsRel limits context sourceTarget targetTail) :
+      DeclarationsRel limits context
+        ((address, .extern arity) :: sourceTarget)
+        ((address, .extern arity) :: targetTail)
+  | fn (address : Ix.Compiler.Ixon.Address) {source : Function}
+      (rewrite : FunctionRewrite limits context source)
+      {sourceTail targetTail : List (Ix.Compiler.Ixon.Address × Decl)}
+      (tail : DeclarationsRel limits context sourceTail targetTail) :
+      DeclarationsRel limits context
+        ((address, .fn source) :: sourceTail)
+        ((address, .fn rewrite.definition) :: targetTail)
+
+theorem DeclarationDecisions.related {limits : Validate.Limits}
+    {context : Validate.Context}
+    {source : List (Ix.Compiler.Ixon.Address × Decl)}
+    (decisions : DeclarationDecisions limits context source) :
+    DeclarationsRel limits context source decisions.target := by
+  induction decisions with
+  | nil => exact .nil
+  | extern address arity tail ih =>
+      exact .extern address arity ih
+  | fn address definition head tail ih =>
+      exact .fn address head ih
+
+/-- Address lookup preserves extern declarations exactly. -/
+theorem DeclarationsRel.find?_extern {limits : Validate.Limits}
+    {context : Validate.Context}
+    {source target : List (Ix.Compiler.Ixon.Address × Decl)}
+    (related : DeclarationsRel limits context source target)
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (found : source.find? (fun entry => entry.1 == address) =
+      some (address, .extern arity)) :
+    target.find? (fun entry => entry.1 == address) =
+      some (address, .extern arity) := by
+  induction related with
+  | nil => simp at found
+  | extern current currentArity tail ih =>
+      by_cases same : current = address
+      · subst current
+        simpa using found
+      · simpa [same] using ih (by simpa [same] using found)
+  | fn current rewrite tail ih =>
+      by_cases same : current = address
+      · subst current
+        simp at found
+      · simpa [same] using ih (by simpa [same] using found)
+
+/-- A source function lookup selects the exact function rewrite retained at
+the same target address. -/
+theorem DeclarationsRel.find?_fn {limits : Validate.Limits}
+    {context : Validate.Context}
+    {source target : List (Ix.Compiler.Ixon.Address × Decl)}
+    (related : DeclarationsRel limits context source target)
+    {address : Ix.Compiler.Ixon.Address} {definition : Function}
+    (found : source.find? (fun entry => entry.1 == address) =
+      some (address, .fn definition)) :
+    ∃ rewrite : FunctionRewrite limits context definition,
+      target.find? (fun entry => entry.1 == address) =
+        some (address, .fn rewrite.definition) := by
+  induction related with
+  | nil => simp at found
+  | extern current arity tail ih =>
+      by_cases same : current = address
+      · subst current
+        simp at found
+      · obtain ⟨selected, selectedAt⟩ :=
+          ih (by simpa [same] using found)
+        exact ⟨selected, by simpa [same] using selectedAt⟩
+  | @fn current currentDefinition rewrite sourceTail targetTail tail ih =>
+      by_cases same : current = address
+      · subst current
+        simp at found
+        subst definition
+        exact ⟨rewrite, by simp⟩
+      · obtain ⟨selected, selectedAt⟩ :=
+          ih (by simpa [same] using found)
+        exact ⟨selected, by simpa [same] using selectedAt⟩
+
+/-- Complete typed trace for one program rewrite. -/
+structure Trace (limits : Validate.Limits) (context : Validate.Context)
+    (source : Program) where
+  declarations : DeclarationDecisions limits context source.declarations
+  main : FunctionRewrite limits context source.main
+
+namespace Trace
+
+def target {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (trace : Trace limits context source) : Program :=
+  { declarations := trace.declarations.target
+    main := trace.main.definition }
+
+def report {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (trace : Trace limits context source) : Report :=
+  trace.declarations.report.add trace.main.report
+
+def rewrite {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (trace : Trace limits context source) : Rewrite :=
+  { program := trace.target, report := trace.report }
+
+theorem declarations_related {limits : Validate.Limits}
+    {context : Validate.Context} {source : Program}
+    (trace : Trace limits context source) :
+    DeclarationsRel limits context source.declarations
+      trace.target.declarations :=
+  trace.declarations.related
+
+@[simp] theorem target_main_signature {limits : Validate.Limits}
+    {context : Validate.Context} {source : Program}
+    (trace : Trace limits context source) :
+    trace.target.main.signature = source.main.signature := by
+  exact trace.main.definition_signature
+
+/-- Function lookup in the executable evaluator context selects the exact
+function trace at the same address. -/
+theorem context_fn {limits : Validate.Limits}
+    {context : Validate.Context} {source : Program}
+    (trace : Trace limits context source)
+    {oracle : Ix.Compiler.Ixon.Address → List Eval.RVal → Option Eval.RVal}
+    {address : Ix.Compiler.Ixon.Address} {definition : Function}
+    (found : (Eval.Context.ofProgram source context.schemas oracle).declarations
+      address = some (.fn definition)) :
+    ∃ rewrite : FunctionRewrite limits context definition,
+      (Eval.Context.ofProgram trace.target context.schemas oracle).declarations
+        address = some (.fn rewrite.definition) := by
+  change (source.declarations.find? (fun entry => entry.1 == address)).map
+      (fun entry => entry.2) = some (.fn definition) at found
+  cases sourceFind :
+      source.declarations.find? (fun entry => entry.1 == address) with
+  | none => simp [sourceFind] at found
+  | some entry =>
+      obtain ⟨entryAddress, entryDecl⟩ := entry
+      have addressEq : entryAddress = address := by
+        apply beq_iff_eq.mp
+        exact List.find?_some
+          (p := fun entry : Ix.Compiler.Ixon.Address × Decl =>
+            entry.1 == address) sourceFind
+      subst entryAddress
+      have declarationEq : entryDecl = .fn definition := by
+        simpa [sourceFind] using found
+      subst entryDecl
+      obtain ⟨rewrite, targetFind⟩ :=
+        trace.declarations_related.find?_fn sourceFind
+      exact ⟨rewrite, by
+        change (trace.target.declarations.find?
+          (fun entry => entry.1 == address)).map (fun entry => entry.2) = _
+        simp [targetFind]⟩
+
+/-- Extern lookup is preserved literally in the rewritten evaluator
+context. -/
+theorem context_extern {limits : Validate.Limits}
+    {context : Validate.Context} {source : Program}
+    (trace : Trace limits context source)
+    {oracle : Ix.Compiler.Ixon.Address → List Eval.RVal → Option Eval.RVal}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    (found : (Eval.Context.ofProgram source context.schemas oracle).declarations
+      address = some (.extern arity)) :
+    (Eval.Context.ofProgram trace.target context.schemas oracle).declarations
+      address = some (.extern arity) := by
+  change (source.declarations.find? (fun entry => entry.1 == address)).map
+      (fun entry => entry.2) = some (.extern arity) at found
+  cases sourceFind :
+      source.declarations.find? (fun entry => entry.1 == address) with
+  | none => simp [sourceFind] at found
+  | some entry =>
+      obtain ⟨entryAddress, entryDecl⟩ := entry
+      have addressEq : entryAddress = address := by
+        apply beq_iff_eq.mp
+        exact List.find?_some
+          (p := fun entry : Ix.Compiler.Ixon.Address × Decl =>
+            entry.1 == address) sourceFind
+      subst entryAddress
+      have declarationEq : entryDecl = .extern arity := by
+        simpa [sourceFind] using found
+      subst entryDecl
+      have targetFind :=
+        trace.declarations_related.find?_extern sourceFind
+      change (trace.target.declarations.find?
+        (fun entry => entry.1 == address)).map (fun entry => entry.2) = _
+      simp [targetFind]
+
+end Trace
+
+/-- Produce the target and the proof-facing decision trace in one traversal. -/
+def traceProgramWith (limits : Validate.Limits) (context : Validate.Context)
+    (program : Program) : Trace limits context program :=
+  { declarations := rewriteDeclarations limits context program.declarations
+    main := rewriteFunction limits context program.main }
+
+def rewriteProgramWith (limits : Validate.Limits) (context : Validate.Context)
+    (program : Program) : Rewrite :=
+  (traceProgramWith limits context program).rewrite
+
+def rewriteProgram (context : Validate.Context) (program : Program) : Rewrite :=
+  rewriteProgramWith Validate.defaultLimits context program
+
+inductive Error where
+  | invalidSource (error : Validate.Error)
+  | invalidTarget (error : Validate.Error)
+  deriving BEq, Repr
+
+/-- A rewrite whose source and target both passed the same bounded ownership,
+credit, call, schema, and CFG checker. -/
+structure Output (limits : Validate.Limits) (context : Validate.Context)
+    (source : Program) where
+  rewrite : Rewrite
+  trace : Trace limits context source
+  traceProduces : trace.rewrite = rewrite
+  sourceStats : Validate.Stats
+  targetStats : Validate.Stats
+  sourceAccepted :
+    Validate.validateWith limits context source = .ok sourceStats
+  targetAccepted :
+    Validate.validateWith limits context rewrite.program = .ok targetStats
+
+namespace Output
+
+def target {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (output : Output limits context source) : Program :=
+  output.rewrite.program
+
+def report {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (output : Output limits context source) : Report :=
+  output.rewrite.report
+
+/-- The retained decision trace materializes the exact validated target. -/
+theorem trace_target {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (output : Output limits context source) :
+    output.trace.target = output.target := by
+  exact congrArg Rewrite.program output.traceProduces
+
+/-- Report counters are computed from the same exhaustive trace. -/
+theorem trace_report {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (output : Output limits context source) :
+    output.trace.report = output.report := by
+  exact congrArg Rewrite.report output.traceProduces
+
+theorem sourceValid {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (output : Output limits context source) :
+    Validate.ValidWith limits context source :=
+  ⟨output.sourceStats, output.sourceAccepted⟩
+
+theorem targetValid {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (output : Output limits context source) :
+    Validate.ValidWith limits context output.target :=
+  ⟨output.targetStats, output.targetAccepted⟩
+
+end Output
+
+/-- Validate, rewrite, and validate again under one explicit resource policy. -/
+def optimizeWith (limits : Validate.Limits) (context : Validate.Context)
+    (source : Program) : Except Error (Output limits context source) :=
+  match sourceAccepted : Validate.validateWith limits context source with
+  | .error error => .error (.invalidSource error)
+  | .ok sourceStats =>
+      let trace := traceProgramWith limits context source
+      let rewrite := trace.rewrite
+      match targetAccepted :
+          Validate.validateWith limits context rewrite.program with
+      | .error error => .error (.invalidTarget error)
+      | .ok targetStats =>
+          .ok { rewrite, trace, traceProduces := rfl, sourceStats, targetStats,
+                sourceAccepted, targetAccepted }
+
+def optimize (context : Validate.Context) (source : Program) :
+    Except Error (Output Validate.defaultLimits context source) :=
+  optimizeWith Validate.defaultLimits context source
+
+/-- A target-validation failure can occur only after the source passed the
+same validator. This checked baseline is the fallback for an optional rewrite. -/
+theorem sourceValid_of_invalidTarget {limits : Validate.Limits}
+    {context : Validate.Context} {source : Program} {error : Validate.Error}
+    (rejected : optimizeWith limits context source = .error (.invalidTarget error)) :
+    Validate.ValidWith limits context source := by
+  unfold optimizeWith at rejected
+  split at rejected
+  next sourceError _sourceRejected => cases rejected
+  next stats accepted => exact ⟨stats, accepted⟩
+
+/-- Invalid source input remains a compilation error; it is never a usable
+fallback merely because optimization was optional. -/
+theorem sourceRejected_of_invalidSource {limits : Validate.Limits}
+    {context : Validate.Context} {source : Program} {error : Validate.Error}
+    (rejected : optimizeWith limits context source = .error (.invalidSource error)) :
+    Validate.validateWith limits context source = .error error := by
+  unfold optimizeWith at rejected
+  split at rejected
+  next sourceError accepted =>
+    cases rejected
+    exact accepted
+  next _stats _accepted =>
+    dsimp only at rejected
+    split at rejected <;> cases rejected
+
+/-- The production outcome names either the exact validated rewrite or the
+exact rejected attempt which selects the already-validated baseline. -/
+inductive Selection (limits : Validate.Limits) (context : Validate.Context)
+    (source : Program) where
+  | optimized (output : Output limits context source)
+      (produced : optimizeWith limits context source = .ok output)
+  | baseline (error : Validate.Error)
+      (rejected : optimizeWith limits context source = .error (.invalidTarget error))
+
+/-- A skipped optimization reports its target-validation error explicitly. -/
+inductive SelectionReport where
+  | applied (report : Report)
+  | skipped (error : Validate.Error)
+  deriving BEq, Repr
+
+namespace Selection
+
+def target {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} : Selection limits context source → Program
+  | .optimized output _ => output.target
+  | .baseline _ _ => source
+
+def report {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} : Selection limits context source → SelectionReport
+  | .optimized output _ => .applied output.report
+  | .baseline error _ => .skipped error
+
+/-- Production selection always returns a program accepted by the requested
+bounded validator, including when the optional rewrite was rejected. -/
+theorem valid {limits : Validate.Limits} {context : Validate.Context}
+    {source : Program} (selection : Selection limits context source) :
+    Validate.ValidWith limits context selection.target := by
+  cases selection with
+  | optimized output _ => exact output.targetValid
+  | baseline _ rejected => exact sourceValid_of_invalidTarget rejected
+
+end Selection
+
+/-- Attempt dynamic reuse while preserving a checked baseline on target
+rejection. Source-validation errors retain the diagnostic API's error type. -/
+def selectWith (limits : Validate.Limits) (context : Validate.Context)
+    (source : Program) : Except Error (Selection limits context source) :=
+  match produced : optimizeWith limits context source with
+  | .ok output => .ok (.optimized output produced)
+  | .error (.invalidTarget error) => .ok (.baseline error produced)
+  | .error (.invalidSource error) => .error (.invalidSource error)
+
+def select (context : Validate.Context) (source : Program) :
+    Except Error (Selection Validate.defaultLimits context source) :=
+  selectWith Validate.defaultLimits context source
+
+/-- Selection is total once the baseline is checked. The proof argument is
+erased at runtime, and the optional optimizer still records its exact outcome. -/
+def selectCheckedWith (limits : Validate.Limits) (context : Validate.Context)
+    (source : Program) (valid : Validate.ValidWith limits context source) :
+    Selection limits context source :=
+  match produced : optimizeWith limits context source with
+  | .ok output => .optimized output produced
+  | .error (.invalidTarget error) => .baseline error produced
+  | .error (.invalidSource error) => False.elim (by
+      obtain ⟨stats, accepted⟩ := valid
+      have rejected := sourceRejected_of_invalidSource produced
+      rw [accepted] at rejected
+      cases rejected)
+
+def selectChecked (context : Validate.Context) (source : Program)
+    (valid : Validate.ValidWith Validate.defaultLimits context source) :
+    Selection Validate.defaultLimits context source :=
+  selectCheckedWith Validate.defaultLimits context source valid
+
+
+end Ix.Compiler.IxIR2.Reuse
diff --git a/Ix/Compiler/IxIR2/ReuseAllocation.lean b/Ix/Compiler/IxIR2/ReuseAllocation.lean
new file mode 100644
index 000000000..b64e6ca94
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseAllocation.lean
@@ -0,0 +1,73 @@
+import Ix.Compiler.IxIR2.ReuseCost
+import Ix.Compiler.IxIR2.AllocationEvents
+import Ix.Compiler.IxIR2.ReuseResources
+
+/-!
+# Comparative allocation and free observations
+
+Semantic heap correspondence preserves live-node counts. Combining this fact
+with actual execution accounting and the separate allocation-event equation
+yields both counter laws at halt.
+-/
+
+
+
+namespace Ix.Compiler.IxIR2.Eval
+
+/-- Comparative counters at successful physical halt. Each executed reuse
+saves one fresh allocation and one terminal free relative to the baseline. -/
+structure Result.AllocationLaws (baseline selected : Result) : Prop where
+  allocations : baseline.store.heap.allocs =
+    selected.store.heap.allocs + selected.store.heap.reuses
+  frees : baseline.store.heap.frees =
+    selected.store.heap.frees + selected.store.heap.reuses
+
+theorem Result.AllocationLaws.of_accounting {baseline selected : Result}
+    {locRel : Nat → Nat → Prop}
+    (heaps : ReuseSim.StableHeapRel baseline.store selected.store locRel)
+    (events : baseline.store.allocationEvents = selected.store.allocationEvents)
+    (noReuse : baseline.store.heap.reuses = 0)
+    (baselineAccounted : baseline.store.live + baseline.store.heap.frees = baseline.store.heap.allocs)
+    (selectedAccounted : selected.store.live + selected.store.heap.frees = selected.store.heap.allocs) :
+    baseline.AllocationLaws selected := by
+  have live := heaps.live_eq
+  unfold Store.allocationEvents at events
+  constructor <;> omega
+
+/-- Both actual shared-result releases, with the same sufficient traversal
+budget, retain the comparative free law after the heaps are empty. -/
+def Result.ReclaimedAllocationLaws (baseline selected : Result) : Prop :=
+  ∃ releaseFuel baselineReleased selectedReleased remaining,
+    releaseShared releaseFuel baseline.store baseline.value = .ok (baselineReleased, remaining) ∧
+    releaseShared releaseFuel selected.store selected.value = .ok (selectedReleased, remaining) ∧
+    baselineReleased.live = 0 ∧ selectedReleased.live = 0 ∧
+    baselineReleased.heap.allocs = baselineReleased.heap.frees ∧
+    selectedReleased.heap.allocs = selectedReleased.heap.frees ∧
+    baselineReleased.heap.frees = selectedReleased.heap.frees + selectedReleased.heap.reuses
+
+theorem Result.AllocationLaws.reclaimed {baseline selected : Result}
+    {locRel : Nat → Nat → Prop}
+    (laws : baseline.AllocationLaws selected)
+    (heaps : ReuseSim.StableHeapRel baseline.store selected.store locRel)
+    (values : IxIR1.Sim.RValIso locRel baseline.value selected.value)
+    (baselineResources : baseline.SharedResources)
+    (selectedResources : selected.SharedResources) :
+    baseline.ReclaimedAllocationLaws selected := by
+  obtain ⟨releaseFuel, baselineReleased, remaining, baselineRelease, baselineEmpty,
+      baselineBalance⟩ := baselineResources.2
+  obtain ⟨selectedReleased, selectedRelease, selectedEmpty⟩ :=
+    heaps.sharedReclamation values baselineRelease baselineEmpty
+  have selectedHeapBalance := releaseShared_heapBalance selectedRelease
+  have selectedBalance : selectedReleased.heap.allocs = selectedReleased.heap.frees := by
+    have accounted := selectedResources.1
+    unfold HeapBalance at selectedHeapBalance
+    omega
+  have baselineCounters := releaseShared_allocationCounters baselineRelease
+  have selectedCounters := releaseShared_allocationCounters selectedRelease
+  refine ⟨releaseFuel, baselineReleased, selectedReleased, remaining,
+    baselineRelease, selectedRelease, baselineEmpty, selectedEmpty,
+    baselineBalance, selectedBalance, ?_⟩
+  have allocations := laws.allocations
+  omega
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/ReuseCost.lean b/Ix/Compiler/IxIR2/ReuseCost.lean
new file mode 100644
index 000000000..c81464452
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseCost.lean
@@ -0,0 +1,287 @@
+import Ix.Compiler.IxIR2.CostSteps
+import Ix.Compiler.IxIR2.ReuseSim
+
+/-!
+# Heap correspondence and separate comparative costs
+
+Live nodes and outstanding references depend only on semantic heap contents.
+RC and peak costs are kept in independent, compositional certificates.
+-/
+
+namespace Ix.Compiler.IxIR2.ReuseSim
+
+open Eval
+
+private theorem history_live_eq {baseline rewritten : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.heap rewritten.heap) :
+    baseline.live = rewritten.live := by
+  classical
+  by_cases empty : baseline.live = 0
+  · exact empty.trans (heap.right_live_eq_zero empty).symm
+  have present : ∃ box, some box ∈ baseline.heap.nodes := by
+    apply Classical.byContradiction
+    intro absent
+    simp only [not_exists] at absent
+    exact empty ((IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot baseline.heap).2 absent)
+  obtain ⟨box, member⟩ := present
+  obtain ⟨location, slot⟩ := Array.mem_iff_getElem?.mp member
+  have found : baseline.get? location = some box := by
+    simp [Store.get?, IxIR1.Store.get?, slot]
+  obtain ⟨rewrittenLocation, locations⟩ := heap.left_total found
+  obtain ⟨rewrittenBox, rewrittenAt, _boxes⟩ := heap.boxes locations found
+  have baselineCount := Store.live_kill found
+  have rewrittenCount := Store.live_kill (store := rewritten) rewrittenAt
+  have remaining := history_live_eq
+    (baseline := baseline.kill location) (rewritten := rewritten.kill rewrittenLocation)
+    (heap.kill locations found rewrittenAt)
+  omega
+termination_by baseline.live
+decreasing_by
+  have _removed := Store.live_kill found
+  omega
+
+/-- Allocation-history renaming preserves the number of live nodes even
+though dead slots, fresh-allocation counters, and physical addresses differ. -/
+theorem StableHeapRel.live_eq {baseline rewritten : Store}
+    {locRel : Nat → Nat → Prop} (heap : StableHeapRel baseline rewritten locRel) :
+    baseline.live = rewritten.live := by
+  cases heap with
+  | contents same => simp only [Store.live_eq_countP, same.nodes]
+  | isomorphic history => exact (history_live_eq history).symm
+
+end Ix.Compiler.IxIR2.ReuseSim
+
+namespace Ix.Compiler.IxIR2.ReuseSim
+
+open Eval
+open Ix.Compiler.IxIR1.CostTrace
+
+/-- An empty live heap carries no outstanding reference-count work. -/
+theorem pendingRC_empty {store : Store} (empty : store.live = 0) :
+    store.pendingRC = 0 := by
+  have absent := (IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot store.heap).1 empty
+  have loop : ∀ (slots : List (Option IxIR1.NodeBox)),
+      (∀ box, some box ∉ slots) → sharedRcPotentialList slots = 0 := by
+    intro slots
+    induction slots with
+    | nil => intro absent; rfl
+    | cons slot rest ih =>
+        intro absent
+        cases slot with
+        | some box => exact False.elim (absent box (by simp))
+        | none =>
+            simpa [sharedRcPotentialList, slotSharedRcPotential] using
+              ih (fun box member => absent box (by simp [member]))
+  exact loop store.heap.nodes.toList (by simpa using absent)
+
+/-- Allocation-history renaming preserves all pending shared RC work. -/
+theorem history_pendingRC_eq {baseline rewritten : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.heap rewritten.heap) :
+    baseline.pendingRC = rewritten.pendingRC := by
+  classical
+  by_cases empty : baseline.live = 0
+  · rw [pendingRC_empty empty, pendingRC_empty (heap.right_live_eq_zero empty)]
+  have present : ∃ box, some box ∈ baseline.heap.nodes := by
+    apply Classical.byContradiction
+    intro absent
+    simp only [not_exists] at absent
+    exact empty ((IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot baseline.heap).2 absent)
+  obtain ⟨box, member⟩ := present
+  obtain ⟨location, slot⟩ := Array.mem_iff_getElem?.mp member
+  have found : baseline.get? location = some box := by
+    simp [Store.get?, IxIR1.Store.get?, slot]
+  obtain ⟨rewrittenLocation, locations⟩ := heap.left_total found
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations found
+  have leftRemoved := sharedRcPotential_kill (store := baseline.heap) found
+  have rightRemoved := sharedRcPotential_kill (store := rewritten.heap) rewrittenAt
+  have weights : slotSharedRcPotential (some box) = slotSharedRcPotential (some rewrittenBox) := by
+    rcases box with ⟨world, rc, node⟩
+    rcases rewrittenBox with ⟨rewrittenWorld, rewrittenRC, rewrittenNode⟩
+    have worlds := boxes.world
+    have counts := boxes.rc
+    dsimp at worlds counts
+    subst rewrittenWorld
+    subst rewrittenRC
+    cases world <;> rfl
+  have remaining := history_pendingRC_eq
+    (baseline := baseline.kill location) (rewritten := rewritten.kill rewrittenLocation)
+    (heap.kill locations found rewrittenAt)
+  change sharedRcPotential (baseline.heap.kill location) =
+    sharedRcPotential (rewritten.heap.kill rewrittenLocation) at remaining
+  unfold Store.pendingRC
+  omega
+termination_by baseline.live
+decreasing_by
+  have removed := Store.live_kill found
+  omega
+
+theorem StableHeapRel.pendingRC_eq {baseline rewritten : Store}
+    {locRel : Nat → Nat → Prop} (heap : StableHeapRel baseline rewritten locRel) :
+    baseline.pendingRC = rewritten.pendingRC := by
+  cases heap with
+  | contents same => simp only [Store.pendingRC, sharedRcPotential, same.nodes]
+  | isomorphic history => exact (history_pendingRC_eq history).symm
+
+end Ix.Compiler.IxIR2.ReuseSim
+
+namespace Ix.Compiler.IxIR2.Eval
+
+/-- Comparative observations, independent of the semantic heap relation. -/
+structure Store.CostBounds (baseline selected : Store) : Prop where
+  rcops : selected.heap.rcops ≤ baseline.heap.rcops
+  peakLive : selected.peakLiveNodes ≤ baseline.peakLiveNodes
+
+theorem Store.CostBounds.refl (store : Store) : store.CostBounds store :=
+  ⟨Nat.le_refl _, Nat.le_refl _⟩
+
+/-- RC increments compare additively; peak comparisons transport any incoming
+peak bound. The peak counter already records every intermediate allocation. -/
+structure CostDelta (baselineBefore baselineAfter selectedBefore selectedAfter : Store) : Prop where
+  rcops : selectedAfter.heap.rcops + baselineBefore.heap.rcops ≤
+    baselineAfter.heap.rcops + selectedBefore.heap.rcops
+  peakLive : selectedBefore.peakLiveNodes ≤ baselineBefore.peakLiveNodes →
+    selectedAfter.peakLiveNodes ≤ baselineAfter.peakLiveNodes
+
+namespace CostDelta
+
+theorem refl (baseline selected : Store) : CostDelta baseline baseline selected selected :=
+  ⟨by omega, fun bound => bound⟩
+
+theorem preserves {b₀ b₁ r₀ r₁ : Store} (delta : CostDelta b₀ b₁ r₀ r₁)
+    (before : b₀.CostBounds r₀) : b₁.CostBounds r₁ :=
+  ⟨by have _ := delta.rcops; have _ := before.rcops; omega, delta.peakLive before.peakLive⟩
+
+theorem trans {b₀ b₁ b₂ r₀ r₁ r₂ : Store}
+    (first : CostDelta b₀ b₁ r₀ r₁) (second : CostDelta b₁ b₂ r₁ r₂) :
+    CostDelta b₀ b₂ r₀ r₂ :=
+  ⟨by have _ := first.rcops; have _ := second.rcops; omega,
+    fun bound => second.peakLive (first.peakLive bound)⟩
+
+/-- Equal RC charges and allocation events in corresponding heaps imply
+equal raw RC increments and preservation of the peak comparison. -/
+theorem of_observations {b₀ b₁ r₀ r₁ : Store} {events : Nat} {charge : Int}
+    (pendingBefore : b₀.pendingRC = r₀.pendingRC)
+    (pendingAfter : b₁.pendingRC = r₁.pendingRC)
+    (liveAfter : b₁.live = r₁.live)
+    (baselineRC : (b₁.amortizedRC : Int) = b₀.amortizedRC + charge)
+    (selectedRC : (r₁.amortizedRC : Int) = r₀.amortizedRC + charge)
+    (baselinePeak : b₁.peakLiveNodes =
+      if events = 0 then b₀.peakLiveNodes else max b₀.peakLiveNodes b₁.live)
+    (selectedPeak : r₁.peakLiveNodes =
+      if events = 0 then r₀.peakLiveNodes else max r₀.peakLiveNodes r₁.live) :
+    CostDelta b₀ b₁ r₀ r₁ := by
+  constructor
+  · change ((b₁.heap.rcops + b₁.pendingRC : Nat) : Int) =
+      (b₀.heap.rcops + b₀.pendingRC : Nat) + charge at baselineRC
+    change ((r₁.heap.rcops + r₁.pendingRC : Nat) : Int) =
+      (r₀.heap.rcops + r₀.pendingRC : Nat) + charge at selectedRC
+    omega
+  · intro bound
+    rw [baselinePeak, selectedPeak, liveAfter]
+    split
+    · exact bound
+    · omega
+
+/-- A physical hot reset performs no RC work. Both allocation endpoints
+record their complete peaks after the retained baseline fields are released. -/
+theorem hot {baseline selected retained released physical : Store}
+    {fields : Array RVal} {location baselineLocation fuel remaining payloadUnits : Nat}
+    {baselineNode selectedNode : Node}
+    (retains : RetainSharedMany baseline fields retained)
+    (releases : releaseShared fuel retained (.loc baselineLocation) = .ok (released, remaining))
+    (reuses : (ReuseSim.physicalHotResetStore selected location).reuseReservation
+      location .shared selectedNode payloadUnits = .ok physical)
+    (live : (released.allocNode .shared baselineNode).1.live = physical.live) :
+    CostDelta baseline (released.allocNode .shared baselineNode).1 selected physical := by
+  have retainedCosts := retains.observations
+  have releasedCosts := releaseShared_observations releases
+  have reusedCosts := Store.reuseReservation_observations reuses
+  constructor
+  · have retainedRC := retainedCosts.1
+    have releasedRC := releasedCosts.1
+    have selectedRC : physical.heap.rcops = selected.heap.rcops := reusedCosts.1
+    simp only [Store.rcops_allocNode]
+    omega
+  · intro before
+    rw [Store.peakLive_allocNode, releasedCosts.2.2.1, retainedCosts.2.2.1, reusedCosts.2.2.1]
+    change max selected.peakLiveNodes physical.live ≤ max baseline.peakLiveNodes _
+    omega
+
+/-- Cold reset retains the same fields and performs the same root decrement
+as the baseline, including aliased fields and arbitrary prior counters. -/
+theorem cold {baseline selected baselineRetained selectedRetained : Store}
+    {baselineFields selectedFields : Array RVal} {baselineLocation selectedLocation : Nat}
+    {baselineBox selectedBox : NodeBox} {baselineNode selectedNode : Node}
+    (retains : RetainSharedMany baseline baselineFields baselineRetained)
+    (selectedRetains : RetainSharedMany
+      (ReuseSim.coldResetStartStore selected selectedLocation selectedBox) selectedFields selectedRetained)
+    (fields : referenceCountList baselineFields.toList = referenceCountList selectedFields.toList)
+    (live : ((ReuseSim.baselineDecrementStore baselineRetained baselineLocation baselineBox).allocNode
+      .shared baselineNode).1.live = (selectedRetained.allocNode .shared selectedNode).1.live) :
+    CostDelta baseline
+      ((ReuseSim.baselineDecrementStore baselineRetained baselineLocation baselineBox).allocNode
+        .shared baselineNode).1 selected (selectedRetained.allocNode .shared selectedNode).1 := by
+  have retainedCosts := retains.observations
+  have selectedCosts := selectedRetains.observations
+  constructor
+  · have baselineRC := retainedCosts.1
+    have selectedRC := selectedCosts.1
+    change selectedRetained.heap.rcops = selected.heap.rcops + 1 + _ at selectedRC
+    change selectedRetained.heap.rcops + baseline.heap.rcops ≤
+      baselineRetained.heap.rcops + 1 + selected.heap.rcops
+    omega
+  · intro before
+    have baselinePeak := retainedCosts.2.2.1
+    have selectedPeak : selectedRetained.peakLiveNodes = selected.peakLiveNodes := selectedCosts.2.2.1
+    simp only [Store.peakLive_allocNode, selectedPeak]
+    change max selected.peakLiveNodes _ ≤ max baselineRetained.peakLiveNodes _
+    rw [baselinePeak]
+    omega
+
+end CostDelta
+
+def Result.CostBounds (baseline selected : Result) : Prop :=
+  baseline.store.CostBounds selected.store
+
+/-- Complete shared-result release preserves the comparative RC and peak
+bounds, even with independent sufficient traversal budgets. -/
+theorem Store.CostBounds.releaseShared {baseline selected baselineReleased selectedReleased : Store}
+    {baselineValue selectedValue : RVal} {baselineFuel selectedFuel baselineRemaining selectedRemaining : Nat}
+    {locRel : Nat → Nat → Prop} (costs : baseline.CostBounds selected)
+    (heaps : ReuseSim.StableHeapRel baseline selected locRel)
+    (baselineRelease : Eval.releaseShared baselineFuel baseline baselineValue =
+      .ok (baselineReleased, baselineRemaining))
+    (selectedRelease : Eval.releaseShared selectedFuel selected selectedValue =
+      .ok (selectedReleased, selectedRemaining))
+    (baselineEmpty : baselineReleased.live = 0) (selectedEmpty : selectedReleased.live = 0) :
+    baselineReleased.CostBounds selectedReleased := by
+  have baselineObserved := releaseShared_observations baselineRelease
+  have selectedObserved := releaseShared_observations selectedRelease
+  constructor
+  · have baselineRC := baselineObserved.2.1
+    have selectedRC := selectedObserved.2.1
+    change baselineReleased.heap.rcops + baselineReleased.pendingRC =
+      baseline.heap.rcops + baseline.pendingRC at baselineRC
+    change selectedReleased.heap.rcops + selectedReleased.pendingRC =
+      selected.heap.rcops + selected.pendingRC at selectedRC
+    have pending := heaps.pendingRC_eq
+    have baselineZero := ReuseSim.pendingRC_empty baselineEmpty
+    have selectedZero := ReuseSim.pendingRC_empty selectedEmpty
+    have bound := costs.rcops
+    omega
+  · rw [baselineObserved.2.2.1, selectedObserved.2.2.1]
+    exact costs.peakLive
+
+/-- The same two actual reclamations carry R3's accounting and free law,
+together with the comparative RC and peak bounds. -/
+def Result.ReclaimedCostLaws (baseline selected : Result) : Prop :=
+  ∃ releaseFuel baselineReleased selectedReleased remaining,
+    releaseShared releaseFuel baseline.store baseline.value = .ok (baselineReleased, remaining) ∧
+    releaseShared releaseFuel selected.store selected.value = .ok (selectedReleased, remaining) ∧
+    baselineReleased.live = 0 ∧ selectedReleased.live = 0 ∧
+    baselineReleased.heap.allocs = baselineReleased.heap.frees ∧
+    selectedReleased.heap.allocs = selectedReleased.heap.frees ∧
+    baselineReleased.heap.frees = selectedReleased.heap.frees + selectedReleased.heap.reuses ∧
+    baselineReleased.CostBounds selectedReleased
+
+end Ix.Compiler.IxIR2.Eval
diff --git a/Ix/Compiler/IxIR2/ReuseExamples.lean b/Ix/Compiler/IxIR2/ReuseExamples.lean
new file mode 100644
index 000000000..d29a4139f
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseExamples.lean
@@ -0,0 +1,977 @@
+import Ix.Compiler.IxIR1.Lower
+import Ix.Compiler.IxIR2.Lower
+import Ix.Compiler.IxIR2.Reuse
+
+/-!
+# First compiler-emitted dynamic-reuse benchmark
+
+This fixture begins with a hand-written IxIR₀ recursor declaration, not an
+IxIR₁ or IxIR₂ loop.  The ordinary IxIR₀→IxIR₁ compiler emits the shared
+field-retain/release/allocation recursion shape, the baseline IxIR₁→IxIR₂
+lowerer emits and validates its CFG, and `IxIR2.Reuse.optimize` recognizes and
+validates the reset/reuse diamond.
+
+The unaliased run takes the hot branch for every cons and performs no fresh
+loop allocation.  A second source main deliberately retains the original
+list in a returned pair; ownership propagation makes every reset cold and
+leaves allocation counts equal to the baseline.  Both cases compare the
+IxIR₀ source observation, baseline IxIR₂ observation, rewritten logical
+observation, and rewritten physical observation before reclaiming every
+returned target heap.
+-/
+
+namespace Ix.Compiler.IxIR2.Reuse.Examples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+def nilAddress : Address := Address.replicate 0xd1
+def consAddress : Address := Address.replicate 0xd2
+def reverseAddress : Address := Address.replicate 0xd3
+def pairAddress : Address := Address.replicate 0xd4
+def otherConsAddress : Address := Address.replicate 0xd5
+
+def nilId : CtorId := IxIR1.Lower.ctorIdOf nilAddress 0
+def consId : CtorId := IxIR1.Lower.ctorIdOf consAddress 1
+def pairId : CtorId := IxIR1.Lower.ctorIdOf pairAddress 0
+def otherConsId : CtorId := IxIR1.Lower.ctorIdOf otherConsAddress 1
+
+def nilLayout : LayoutId := Address.replicate 0xe1
+def consLayout : LayoutId := Address.replicate 0xe2
+def pairLayout : LayoutId := Address.replicate 0xe3
+def otherConsLayout : LayoutId := Address.replicate 0xe4
+
+private def app2 (fn left right : IxIR0.Expr) : IxIR0.Expr :=
+  .app (.app fn left) right
+
+private def cons (head tail : IxIR0.Expr) : IxIR0.Expr :=
+  app2 (.ref consAddress) head tail
+
+private def pair (left right : IxIR0.Expr) : IxIR0.Expr :=
+  app2 (.ref pairAddress) left right
+
+private def list (values : List Nat) : IxIR0.Expr :=
+  values.foldr (fun value tail => cons (.lit (.nat value)) tail)
+    (.ref nilAddress)
+
+/-- Rule environment: tail, head, accumulator, recursive self. -/
+def reverseConsRule : IxIR0.RecRule :=
+  { fields := 2
+    rhs := app2 (.var 3) (cons (.var 1) (.var 2)) (.var 0) }
+
+/-- The source declaration inventory.  Reversal is a genuine IxIR₀
+recursor with the accumulator before the major premise. -/
+def sourceDeclarations : List (Address × IxIR0.Decl) :=
+  [(nilAddress, .ctor 0 0),
+   (consAddress, .ctor 1 2),
+   (pairAddress, .ctor 0 2),
+   (reverseAddress, .recursor 1 false #[
+      { fields := 0, rhs := .var 0 },
+      reverseConsRule])]
+
+def unaliasedMain : IxIR0.Expr :=
+  app2 (.ref reverseAddress) (.ref nilAddress) (list [1, 2, 3])
+
+/-- `xs` is consumed once by reversal and once by the result pair.  The
+IxIR₀→IxIR₁ compiler inserts the root retain; cold resets propagate that
+second ownership through the tail. -/
+def aliasedMain : IxIR0.Expr :=
+  .letE .many (list [1, 2, 3])
+    (.letE .many
+      (app2 (.ref reverseAddress) (.ref nilAddress) (.var 0))
+      (pair (.var 0) (.var 1)))
+
+def loweringContext : Ix.Compiler.IxIR2.Lower.Context :=
+  { parameterWorlds := fun address =>
+      if address == reverseAddress then some #[.shared, .shared]
+      else none
+    schemas := fun world identity =>
+      if world != .shared then none
+      else if identity == nilId then
+        some { layout := nilLayout, fields := #[] }
+      else if identity == consId then
+        some { layout := consLayout, fields := #[.shared, .shared] }
+      else if identity == pairId then
+        some { layout := pairLayout, fields := #[.shared, .shared] }
+      else
+        none
+    caseCtors := fun _ alternative =>
+      if alternative == 0 then [nilId]
+      else if alternative == 1 then [consId]
+      else [] }
+
+inductive CompileError where
+  | ixir1 (message : String)
+  | baseline (error : Ix.Compiler.IxIR2.Lower.Error)
+  | reuse (error : Reuse.Error)
+  deriving Repr
+
+/-- All retained target artifacts come from executable compiler/checker APIs;
+the structure contains no hand-written IxIR₁ or IxIR₂ code. -/
+structure Compiled (source : IxIR0.Expr) where
+  input : Ix.Compiler.IxIR2.Lower.Input
+  baseline : Ix.Compiler.IxIR2.Lower.Checked
+  optimized : Reuse.Output Validate.defaultLimits
+    baseline.artifact.validationContext baseline.artifact.program
+
+def compile (source : IxIR0.Expr) : Except CompileError (Compiled source) :=
+  match IxIR1.Lower.lowerAll sourceDeclarations source .shared with
+  | .error message => .error (.ixir1 message)
+  | .ok (declarations, main) =>
+      let input : Ix.Compiler.IxIR2.Lower.Input :=
+        { declarations, main, mainResult := .shared }
+      match Ix.Compiler.IxIR2.Lower.lowerChecked loweringContext input with
+      | .error error => .error (.baseline error)
+      | .ok baseline =>
+          match Reuse.optimize baseline.artifact.validationContext
+              baseline.artifact.program with
+          | .error error => .error (.reuse error)
+          | .ok optimized => .ok { input, baseline, optimized }
+
+private def sourceNats? : Nat → IxIR0.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctor address tag values =>
+      if address == nilAddress && tag == 0 && values.isEmpty then
+        some []
+      else if address == consAddress && tag == 1 then
+        match values with
+        | [.lit (.nat head), tail] =>
+            (sourceNats? fuel tail).map (head :: ·)
+        | _ => none
+      else
+        none
+  | _, _ => none
+
+private def sourcePair? (fuel : Nat) : IxIR0.Value →
+    Option (List Nat × List Nat)
+  | .ctor address tag [left, right] =>
+      if address == pairAddress && tag == 0 then do
+        return (← sourceNats? fuel left, ← sourceNats? fuel right)
+      else
+        none
+  | _ => none
+
+private def targetNats? : Nat → Eval.Store → Eval.RVal →
+    Option (List Nat)
+  | 0, _, _ => none
+  | fuel + 1, store, .loc location => do
+      let box ← store.get? location
+      match box.node with
+      | .ctorN identity values =>
+          if identity == nilId && values.isEmpty then
+            some []
+          else if identity == consId then
+            match values.toList with
+            | [.lit (.nat head), tail] =>
+                (targetNats? fuel store tail).map (head :: ·)
+            | _ => none
+          else
+            none
+      | .papN .. => none
+  | _, _, _ => none
+
+private def targetPair? (fuel : Nat) (store : Eval.Store) : Eval.RVal →
+    Option (List Nat × List Nat)
+  | .loc location => do
+      let box ← store.get? location
+      match box.node with
+      | .ctorN identity values =>
+          if identity == pairId then
+            match values.toList with
+            | [left, right] =>
+                return (← targetNats? fuel store left,
+                  ← targetNats? fuel store right)
+            | _ => none
+          else
+            none
+      | .papN .. => none
+  | _ => none
+
+private def sourceContext : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList sourceDeclarations }
+
+private def targetContext (context : Validate.Context)
+    (program : Program) : Eval.Context :=
+  Eval.Context.ofProgram program context.schemas
+
+private def released (result : Eval.Result) : Bool :=
+  match Eval.releaseShared 1000 result.store result.value with
+  | .ok (store, _) => store.live == 0
+  | .error _ => false
+
+private def terminalCounterLaw (logical physical : Eval.Result) : Bool :=
+  let left := logical.store.counters
+  let right := physical.store.counters
+  left.allocs == right.allocs + right.reuses &&
+    left.frees == right.frees + right.reuses &&
+    left.rcops == right.rcops &&
+    logical.store.live == physical.store.live &&
+    left.resetAttempts == right.resetAttempts &&
+    left.hotResets == right.hotResets &&
+    left.coldResets == right.coldResets
+
+private def expectedReport : Reuse.Report :=
+  { scannedBlocks := 4
+    shapeCandidates := 1
+    rewritten := 1
+    incompatibleLayouts := 0
+    helperBlocks := 2 }
+
+def ternarySourceAddress : Address := Address.replicate 0xd6
+def ternaryAllocationAddress : Address := Address.replicate 0xd7
+def ternaryFunctionAddress : Address := Address.replicate 0xd8
+def ternaryLayout : LayoutId := Address.replicate 0xe6
+
+def ternarySourceId : CtorId :=
+  IxIR1.Lower.ctorIdOf ternarySourceAddress 0
+
+def ternaryAllocationId : CtorId :=
+  IxIR1.Lower.ctorIdOf ternaryAllocationAddress 0
+
+private def ownedSharedParam : Param :=
+  { world := .shared, passing := .owned }
+
+/-- A valid non-benchmark shape with three fields and the consumed source in
+parameter register one.  Allocation and tail arguments are both permuted. -/
+def ternaryBlock : Block :=
+  { valueParams := #[.owned .shared, .owned .shared, .owned .shared]
+    creditParams := #[]
+    instructions := #[
+      .fetch (.reg 1) ternarySourceId 0,
+      .fetch (.reg 1) ternarySourceId 1,
+      .fetch (.reg 1) ternarySourceId 2,
+      .retainShared (.reg 3),
+      .retainShared (.reg 4),
+      .retainShared (.reg 5),
+      .releaseShared (.reg 1),
+      .alloc .shared ternaryAllocationId #[.reg 8, .reg 0, .reg 6]]
+    terminator := .tailCallSelf #[.reg 2, .reg 9, .reg 7] }
+
+def ternaryFunction : Function :=
+  { signature :=
+      { params := #[ownedSharedParam, ownedSharedParam, ownedSharedParam]
+        result := .shared
+        papSafe := false }
+    blocks := #[ternaryBlock] }
+
+private def trivialMain : Function :=
+  { signature := { params := #[], result := .shared, papSafe := false }
+    blocks := #[
+      { valueParams := #[]
+        creditParams := #[]
+        instructions := #[.alloc .shared nilId #[]]
+        terminator := .ret (.reg 0) }] }
+
+def ternaryProgram : Program :=
+  { declarations := [(ternaryFunctionAddress, .fn ternaryFunction)]
+    main := trivialMain }
+
+def ternaryContext : Validate.Context :=
+  { schemas := fun world identity =>
+      if world != .shared then none
+      else if identity == ternarySourceId then
+        some { layout := ternaryLayout,
+               fields := #[.shared, .shared, .shared] }
+      else if identity == ternaryAllocationId then
+        some { layout := ternaryLayout,
+               fields := #[.shared, .shared, .shared] }
+      else if identity == nilId then
+        some { layout := nilLayout, fields := #[] }
+      else
+        none }
+
+/-- The generalized matcher consumes checked liveness and preserves register
+meaning across a nonzero source parameter, three fields, and permutations. -/
+def generalizedShapeAccepted : Bool :=
+  match Reuse.optimize ternaryContext ternaryProgram with
+  | .error _ => false
+  | .ok output =>
+      output.report ==
+        { scannedBlocks := 2
+          shapeCandidates := 1
+          rewritten := 1
+          helperBlocks := 2 } &&
+      match output.target.declarations with
+      | [(_, .fn definition)] =>
+          match definition.blocks[0]?, definition.blocks[1]?,
+              definition.blocks[2]? with
+          | some reset, some hot, some cold =>
+              reset.instructions == #[
+                .resetShared (.reg 1) ternarySourceId] &&
+              reset.terminator == .branchCredit 0
+                { target := 1
+                  values := #[.reg 3, .reg 4, .reg 5, .reg 0, .reg 2]
+                  credits := #[0] }
+                { target := 2
+                  values := #[.reg 3, .reg 4, .reg 5, .reg 0, .reg 2]
+                  credits := #[0] } &&
+              hot.valueParams == Array.replicate 5 (.owned .shared) &&
+              hot.creditParams == #[.required ternaryLayout] &&
+              hot.instructions == #[
+                .allocWith 0 .shared ternaryAllocationId
+                  #[.reg 2, .reg 3, .reg 0]] &&
+              hot.terminator == .tailCallSelf #[.reg 4, .reg 5, .reg 1] &&
+              cold.valueParams == hot.valueParams &&
+              cold.creditParams == #[.optional ternaryLayout] &&
+              cold.instructions == hot.instructions &&
+              cold.terminator == hot.terminator
+          | _, _, _ => false
+      | _ => false
+
+def ternaryRewrite :
+    Reuse.FunctionRewrite Validate.defaultLimits ternaryContext ternaryFunction :=
+  Reuse.rewriteFunction Validate.defaultLimits ternaryContext ternaryFunction
+
+/-- The proof-facing traversal retains an accepted dependent site for the
+generalized three-field block, not merely a positive report counter.  The
+general `FunctionRewrite.acceptedAt` theorem turns this constructor into exact
+reset/hot/cold target-block lookups. -/
+def generalizedDecisionTraceAccepted : Bool :=
+  match ternaryRewrite.decisions with
+  | .cons (.accepted _) .nil => true
+  | _ => false
+
+/-- Even a syntactic prefix is left untouched when its source appears after
+the proposed release.  This exercises the liveness gate independently of the
+whole-program validator, which would also reject this malformed ownership
+flow. -/
+def lateSourceUseRejected : Bool :=
+  let lateBlock : Block :=
+    { ternaryBlock with
+      terminator := .tailCallSelf #[.reg 1, .reg 9, .reg 7] }
+  let lateFunction : Function :=
+    { ternaryFunction with blocks := #[lateBlock] }
+  let source : Program :=
+    { ternaryProgram with declarations :=
+        [(ternaryFunctionAddress, .fn lateFunction)] }
+  let rewrite := Reuse.rewriteProgram ternaryContext source
+  rewrite.program == source &&
+    rewrite.report ==
+      { scannedBlocks := 2
+        shapeCandidates := 1
+        livenessRejected := 1 }
+
+/-- Structural evidence that the optimizer consumed the baseline compiler
+shape and emitted the optional-credit diamond, rather than benchmarking a
+prewritten reset program. -/
+def compilerShapeAndDiamond (compiled : Compiled source) : Bool :=
+  let baselineShape :=
+    match compiled.baseline.artifact.program.declarations.find? fun entry =>
+        entry.1 == reverseAddress with
+    | some (_, .fn definition) =>
+        match definition.blocks[2]? with
+        | some block =>
+            block.instructions == #[
+              .fetch (.reg 0) consId 0,
+              .fetch (.reg 0) consId 1,
+              .retainShared (.reg 2),
+              .retainShared (.reg 3),
+              .releaseShared (.reg 0),
+              .alloc .shared consId #[.reg 4, .reg 1]] &&
+              block.terminator == .tailCallSelf #[.reg 6, .reg 5]
+        | none => false
+    | _ => false
+  let targetShape :=
+    match compiled.optimized.target.declarations.find? fun entry =>
+        entry.1 == reverseAddress with
+    | some (_, .fn definition) =>
+        match definition.blocks[2]?, definition.blocks[3]?,
+            definition.blocks[4]? with
+        | some reset, some hot, some cold =>
+            reset.instructions == #[.resetShared (.reg 0) consId] &&
+              reset.terminator == .branchCredit 0
+                { target := 3
+                  values := #[.reg 2, .reg 3, .reg 1]
+                  credits := #[0] }
+                { target := 4
+                  values := #[.reg 2, .reg 3, .reg 1]
+                  credits := #[0] } &&
+              hot.creditParams == #[.required consLayout] &&
+              hot.instructions == #[
+                .allocWith 0 .shared consId #[.reg 0, .reg 2]] &&
+              cold.creditParams == #[.optional consLayout] &&
+              cold.instructions == #[
+                .allocWith 0 .shared consId #[.reg 0, .reg 2]]
+        | _, _, _ => false
+    | _ => false
+  baselineShape && targetShape &&
+    compiled.optimized.report == expectedReport &&
+    let rerun := Reuse.rewriteProgram
+      compiled.baseline.artifact.validationContext compiled.optimized.target
+    rerun.program == compiled.optimized.target && rerun.report.rewritten == 0
+
+private def runTargets (compiled : Compiled source) :
+    Except Eval.Error (Eval.Result × Eval.Result × Eval.Result) := do
+  let baselineProgram := compiled.baseline.artifact.program
+  let context := compiled.baseline.artifact.validationContext
+  let optimizedProgram := compiled.optimized.target
+  let baseline ← Eval.runMain (targetContext context baselineProgram)
+    .logical baselineProgram 100 100
+  let logical ← Eval.runMain (targetContext context optimizedProgram)
+    .logical optimizedProgram 100 100
+  let physical ← Eval.runMain (targetContext context optimizedProgram)
+    .physical optimizedProgram 100 100
+  return (baseline, logical, physical)
+
+/-- Hot-path benchmark: source/baseline/logical/physical results all reverse
+the list, all returned heaps reclaim fully, and the physical loop turns all
+three replacement allocations into reuse. -/
+def unaliasedBenchmark : Bool :=
+  match sourceContext.run unaliasedMain 1000, compile unaliasedMain with
+  | .ok source, .ok compiled =>
+      compilerShapeAndDiamond compiled &&
+        match runTargets compiled with
+        | .ok (baseline, logical, physical) =>
+            sourceNats? 100 source == some [3, 2, 1] &&
+              targetNats? 100 baseline.store baseline.value ==
+                some [3, 2, 1] &&
+              targetNats? 100 logical.store logical.value ==
+                some [3, 2, 1] &&
+              targetNats? 100 physical.store physical.value ==
+                some [3, 2, 1] &&
+              baseline.store.counters.allocs == 8 &&
+              baseline.store.counters.reuses == 0 &&
+              baseline.store.counters.frees == 4 &&
+              baseline.store.counters.rcops == 10 &&
+              baseline.store.counters.resetAttempts == 0 &&
+              baseline.store.peakLiveNodes == 5 &&
+              logical.store.counters.allocs == 8 &&
+              logical.store.counters.reuses == 0 &&
+              logical.store.counters.frees == 4 &&
+              logical.store.counters.rcops == 1 &&
+              physical.store.counters.allocs == 5 &&
+              physical.store.counters.reuses == 3 &&
+              physical.store.counters.frees == 1 &&
+              physical.store.counters.rcops == 1 &&
+              physical.store.counters.resetAttempts == 3 &&
+              physical.store.counters.hotResets == 3 &&
+              physical.store.counters.coldResets == 0 &&
+              physical.store.counters.reusedPayloadUnits == 6 &&
+              physical.store.peakLiveNodes == 5 &&
+              terminalCounterLaw logical physical &&
+              released baseline && released logical && released physical
+        | .error _ => false
+  | _, _ => false
+
+/-- Cold-path benchmark: retaining the original list makes every attempt
+cold.  The rewritten program allocates exactly as much as the baseline,
+returns both lists unchanged, and fully reclaims both result graphs. -/
+def aliasedBenchmark : Bool :=
+  match sourceContext.run aliasedMain 1000, compile aliasedMain with
+  | .ok source, .ok compiled =>
+      compilerShapeAndDiamond compiled &&
+        match runTargets compiled with
+        | .ok (baseline, logical, physical) =>
+            sourcePair? 100 source == some ([3, 2, 1], [1, 2, 3]) &&
+              targetPair? 100 baseline.store baseline.value ==
+                some ([3, 2, 1], [1, 2, 3]) &&
+              targetPair? 100 logical.store logical.value ==
+                some ([3, 2, 1], [1, 2, 3]) &&
+              targetPair? 100 physical.store physical.value ==
+                some ([3, 2, 1], [1, 2, 3]) &&
+              baseline.store.counters.allocs == 9 &&
+              baseline.store.counters.reuses == 0 &&
+              baseline.store.counters.frees == 0 &&
+              baseline.store.counters.rcops == 8 &&
+              baseline.store.counters.resetAttempts == 0 &&
+              baseline.store.peakLiveNodes == 9 &&
+              logical.store.counters.allocs == 9 &&
+              logical.store.counters.reuses == 0 &&
+              logical.store.counters.frees == 0 &&
+              logical.store.counters.rcops == 8 &&
+              physical.store.counters.allocs == baseline.store.counters.allocs &&
+              physical.store.counters.reuses == 0 &&
+              physical.store.counters.frees == 0 &&
+              physical.store.counters.rcops == 8 &&
+              physical.store.counters.resetAttempts == 3 &&
+              physical.store.counters.hotResets == 0 &&
+              physical.store.counters.coldResets == 3 &&
+              physical.store.peakLiveNodes == 9 &&
+              terminalCounterLaw logical physical &&
+              released baseline && released logical && released physical
+        | .error _ => false
+  | _, _ => false
+
+private def zeroFieldChildAddress : Address := Address.replicate 0xd9
+
+/-- The nil branch has no generated fetches. Its accepted prefix instead
+consumes the second inherited parameter; the recursive call swaps the result
+into the scrutinee position and exits through the cons branch. -/
+private def zeroFieldChildBody : IxIR1.Code :=
+  .case (.var 0) false #[
+    .mk 0 0
+      (.letOp (.fetch (.var 1) 0)
+        (.letOp (.fetch (.var 2) 1)
+          (.letOp (.dup (.var 1))
+            (.letOp (.dup (.var 1))
+              (.letOp (.drop (.var 5))
+                (.letOp (.alloc .shared consId #[.var 2, .var 1])
+                  (.letOp (.callSelf #[.var 6, .var 0])
+                    (.ret (.var 0))))))))),
+    .mk 1 2 (.letOp (.drop (.var 3)) (.ret (.var 3)))]
+
+private def zeroFieldChildMain (aliased : Bool) : IxIR1.Code :=
+  .letOp (.alloc .shared nilId #[])
+    (.letOp (.alloc .shared nilId #[])
+      (.letOp (.alloc .shared consId #[.lit (.nat 42), .var 0])
+        (if aliased then
+          .letOp (.dup (.var 0))
+            (.letOp (.call zeroFieldChildAddress #[.var 0, .var 3])
+              (.letOp (.alloc .shared pairId #[.var 0, .var 2])
+                (.ret (.var 0))))
+        else
+          .letOp (.call zeroFieldChildAddress #[.var 0, .var 2])
+            (.ret (.var 0)))))
+
+private def zeroFieldChildInput (aliased : Bool) : Lower.Input :=
+  { declarations :=
+      [(zeroFieldChildAddress,
+        .fn { arity := 2, result := .shared, papSafe := false,
+              body := zeroFieldChildBody })]
+    main := zeroFieldChildMain aliased
+    mainResult := .shared }
+
+private def zeroFieldChildContext : Lower.Context :=
+  { loweringContext with
+    parameterWorlds := fun address =>
+      if address == zeroFieldChildAddress then some #[.shared, .shared]
+      else none
+    fetchCtor := fun site =>
+      if site.owner == .declaration zeroFieldChildAddress &&
+          site.branches == [0] && site.offset < 2 then some consId
+      else none }
+
+/-- This bounded fixture starts at IxIR₁. Both compiler checks and the reuse
+validator must accept its empty generated prologue before runtime comparison. -/
+private def zeroFieldChildCompile (aliased : Bool) : Except CompileError
+    (Sigma fun baseline : Lower.Checked =>
+      Reuse.Output Validate.defaultLimits baseline.artifact.validationContext
+        baseline.artifact.program) := do
+  let baseline ← (Lower.lowerChecked zeroFieldChildContext
+    (zeroFieldChildInput aliased)).mapError CompileError.baseline
+  let optimized ← (Reuse.optimize baseline.artifact.validationContext
+    baseline.artifact.program).mapError CompileError.reuse
+  return ⟨baseline, optimized⟩
+
+private def zeroFieldChildShape (baseline : Lower.Checked)
+    (optimized : Reuse.Output Validate.defaultLimits
+      baseline.artifact.validationContext baseline.artifact.program) : Bool :=
+  optimized.report == expectedReport &&
+    match baseline.artifact.trace.functions.find? (fun trace =>
+        trace.owner == .declaration zeroFieldChildAddress),
+      optimized.target.declarations.find? (fun entry =>
+        entry.1 == zeroFieldChildAddress) with
+    | some trace, some (_, .fn definition) =>
+        trace.root.switchBranchesMatch &&
+          match trace.root, definition.blocks[1]? with
+          | .switchValue _ _ _ _ _ _ _ _ parent _ children, some reset =>
+              (match parent.terminator, children[0]? with
+              | .switchValue _ alternatives _, some child =>
+                  child.targetPosition == .instruction 0 && child.headBlock.1 == 1 &&
+                    (match alternatives[0]? with
+                    | some alternative => alternative.cid == nilId &&
+                        alternative.edge.target == 1
+                    | none => false) &&
+                    child.headBlock.2.instructions[0]? ==
+                      some (.fetch (.reg 1) consId 0)
+              | _, _ => false) &&
+                reset.instructions == #[.resetShared (.reg 1) consId]
+          | _, _ => false
+    | _, _ => false
+
+/-- Empty constructor prologues can lead to hot or cold reuse of a different
+inherited node. Compare both observations and reclaim every returned heap. -/
+def zeroFieldChildBenchmark (aliased : Bool) : Bool :=
+  match zeroFieldChildCompile aliased with
+  | .error _ => false
+  | .ok ⟨baseline, optimized⟩ =>
+      zeroFieldChildShape baseline optimized &&
+        let baselineProgram := baseline.artifact.program
+        let context := baseline.artifact.validationContext
+        match Eval.runMain (targetContext context baselineProgram)
+            .physical baselineProgram 100 100,
+          Eval.runMain (targetContext context optimized.target)
+            .logical optimized.target 100 100,
+          Eval.runMain (targetContext context optimized.target)
+            .physical optimized.target 100 100 with
+        | .ok baseline, .ok logical, .ok physical =>
+            let observed (result : Eval.Result) :=
+              if aliased then
+                targetPair? 100 result.store result.value ==
+                  some ([42], [42])
+              else
+                targetNats? 100 result.store result.value == some [42]
+            observed baseline && observed logical && observed physical &&
+              baseline.store.counters.allocs == (if aliased then 5 else 4) &&
+              baseline.store.counters.resetAttempts == 0 &&
+              physical.store.counters.allocs == (if aliased then 5 else 3) &&
+              physical.store.counters.reuses == (if aliased then 0 else 1) &&
+              physical.store.counters.resetAttempts == 1 &&
+              physical.store.counters.hotResets == (if aliased then 0 else 1) &&
+              physical.store.counters.coldResets == (if aliased then 1 else 0) &&
+              terminalCounterLaw logical physical &&
+              released baseline && released logical && released physical
+        | _, _, _ => false
+
+private def incompatibleProgram (program : Program) : Program :=
+  { program with
+    declarations := program.declarations.map fun entry =>
+      if entry.1 != reverseAddress then entry
+      else
+        match entry.2 with
+        | .extern _ => entry
+        | .fn definition =>
+            match definition.blocks[2]? with
+            | none => entry
+            | some block =>
+                let instructions := block.instructions.setIfInBounds 5
+                  (.alloc .shared otherConsId #[.reg 4, .reg 1])
+                let replacement : Block := { block with instructions }
+                (entry.1, .fn { definition with blocks :=
+                  definition.blocks.setIfInBounds 2 replacement }) }
+
+/-- Exact layout identity is a hard gate.  A separately valid same-arity
+allocation with another layout is reported and left structurally unchanged;
+the validator is run on both sides of that no-op result. -/
+def incompatibleLayoutRejected : Bool :=
+  match compile unaliasedMain with
+  | .error _ => false
+  | .ok compiled =>
+      let source := incompatibleProgram compiled.baseline.artifact.program
+      let baselineContext := compiled.baseline.artifact.validationContext
+      let context : Validate.Context :=
+        { baselineContext with
+          schemas := fun world identity =>
+            if world == .shared && identity == otherConsId then
+              some { layout := otherConsLayout,
+                     fields := #[.shared, .shared] }
+            else
+              baselineContext.schemas world identity }
+      match Reuse.optimize context source with
+      | .error _ => false
+      | .ok output =>
+          output.target == source &&
+            output.report ==
+              { scannedBlocks := 4
+                shapeCandidates := 1
+                rewritten := 0
+                incompatibleLayouts := 1
+                helperBlocks := 0 }
+
+private def relayAddress : Address := Address.replicate 0xda
+private def relayFactoryAddress : Address := Address.replicate 0xdb
+private def factoryFactoryAddress : Address := Address.replicate 0xdc
+
+/-- Small IxIR₁ adapters around the IxIR₀-derived reversal. Saturating the
+relay enters an addressed tail call, followed by reversal's self tail calls.
+The two factories add nested over-application before reaching that relay. -/
+private def papReturnDeclarations : List (Address × IxIR1.Decl) :=
+  [(relayAddress, .fn
+      { arity := 2, result := .shared, papSafe := true
+        body := .letOp (.call reverseAddress #[.var 1, .var 0])
+          (.ret (.var 0)) }),
+   (relayFactoryAddress, .fn
+      { arity := 1, result := .shared, papSafe := true
+        body := .letOp (.papp relayAddress #[.var 0]) (.ret (.var 0)) }),
+   (factoryFactoryAddress, .fn
+      { arity := 1, result := .shared, papSafe := true
+        body := .letOp (.drop (.var 0))
+          (.letOp (.papp relayFactoryAddress #[]) (.ret (.var 0))) })]
+
+private def papReturnMain (overApplied aliased : Bool) : IxIR1.Code :=
+  let finish := if aliased then
+    .letOp (.alloc .shared pairId #[.var 0, .var 3]) (.ret (.var 0))
+    else .ret (.var 0)
+  let application := if overApplied then
+    .letOp (.papp factoryFactoryAddress #[])
+      (.letOp (.apply (.var 0)
+        #[.erased, .var (if aliased then 6 else 5), .var 1]) finish)
+    else
+      .letOp (.papp relayAddress #[.var (if aliased then 5 else 4)])
+        (.letOp (.apply (.var 0) #[.var 1]) finish)
+  .letOp (.alloc .shared nilId #[])
+    (.letOp (.alloc .shared nilId #[])
+      (.letOp (.alloc .shared consId #[.lit (.nat 3), .var 0])
+        (.letOp (.alloc .shared consId #[.lit (.nat 2), .var 0])
+          (.letOp (.alloc .shared consId #[.lit (.nat 1), .var 0])
+            (if aliased then .letOp (.dup (.var 0)) application
+             else application)))))
+
+private def papReturnCompile (overApplied aliased : Bool) : Except CompileError
+    (Sigma fun baseline : Lower.Checked =>
+      Reuse.Output Validate.defaultLimits baseline.artifact.validationContext
+        baseline.artifact.program) := do
+  let (declarations, _) ← (IxIR1.Lower.lowerAll sourceDeclarations unaliasedMain
+    .shared).mapError CompileError.ixir1
+  let context : Lower.Context :=
+    { loweringContext with
+      parameterWorlds := fun address =>
+        if address == relayAddress then some #[.shared, .shared]
+        else if address == relayFactoryAddress || address == factoryFactoryAddress
+          then some #[.shared]
+        else loweringContext.parameterWorlds address }
+  let baseline ← (Lower.lowerChecked context
+    { declarations := papReturnDeclarations ++ declarations
+      main := papReturnMain overApplied aliased
+      mainResult := .shared }).mapError CompileError.baseline
+  let optimized ← (Reuse.optimize baseline.artifact.validationContext
+    baseline.artifact.program).mapError CompileError.reuse
+  return ⟨baseline, optimized⟩
+
+/-- A PAP caller survives both kinds of tail call and, optionally, nested
+over-application. Every route compares all target interpretations, pins the
+PAP ownership overhead, and fully reclaims both the result and any alias. -/
+def papTailReturnBenchmark (overApplied aliased : Bool) : Bool :=
+  match papReturnCompile overApplied aliased with
+  | .error _ => false
+  | .ok ⟨baseline, optimized⟩ =>
+      let baselineProgram := baseline.artifact.program
+      let context := baseline.artifact.validationContext
+      let relayTail := match baselineProgram.declarations.find? (fun entry =>
+          entry.1 == relayAddress) with
+        | some (_, .fn definition) =>
+            match definition.blocks[0]? with
+            | some block => block.instructions.isEmpty &&
+                block.terminator == .tailCall reverseAddress #[.reg 0, .reg 1]
+            | none => false
+        | _ => false
+      relayTail && optimized.report == { expectedReport with scannedBlocks := 7 } &&
+        match Eval.runMain (targetContext context baselineProgram)
+            .logical baselineProgram 1000 1000,
+          Eval.runMain (targetContext context baselineProgram)
+            .physical baselineProgram 1000 1000,
+          Eval.runMain (targetContext context optimized.target)
+            .logical optimized.target 1000 1000,
+          Eval.runMain (targetContext context optimized.target)
+            .physical optimized.target 1000 1000 with
+        | .ok baselineLogical, .ok baselinePhysical, .ok logical, .ok physical =>
+            let observed := fun result : Eval.Result =>
+              if aliased then targetPair? 100 result.store result.value ==
+                some ([3, 2, 1], [1, 2, 3])
+              else targetNats? 100 result.store result.value == some [3, 2, 1]
+            let papCount := if overApplied then 3 else 1
+            let papRCOps := if overApplied then 5 else 3
+            observed baselineLogical && observed baselinePhysical &&
+              observed logical && observed physical &&
+              baselineLogical.store.counters == baselinePhysical.store.counters &&
+              baselinePhysical.store.counters.allocs ==
+                (if aliased then 9 else 8) + papCount &&
+              baselinePhysical.store.counters.frees ==
+                (if aliased then 0 else 4) + papCount &&
+              baselinePhysical.store.counters.rcops ==
+                (if aliased then 8 else 10) + papRCOps &&
+              physical.store.counters.allocs ==
+                (if aliased then 9 else 5) + papCount &&
+              physical.store.counters.frees ==
+                (if aliased then 0 else 1) + papCount &&
+              physical.store.counters.rcops ==
+                (if aliased then 8 else 1) + papRCOps &&
+              physical.store.counters.reuses == (if aliased then 0 else 3) &&
+              physical.store.counters.hotResets == (if aliased then 0 else 3) &&
+              physical.store.counters.coldResets == (if aliased then 3 else 0) &&
+              terminalCounterLaw logical physical &&
+              released baselineLogical && released baselinePhysical &&
+              released logical && released physical
+        | _, _, _, _ => false
+
+#guard papTailReturnBenchmark false false
+#guard papTailReturnBenchmark false true
+#guard papTailReturnBenchmark true false
+#guard papTailReturnBenchmark true true
+#guard zeroFieldChildBenchmark false
+#guard zeroFieldChildBenchmark true
+#guard unaliasedBenchmark
+#guard aliasedBenchmark
+#guard incompatibleLayoutRejected
+#guard generalizedShapeAccepted
+#guard generalizedDecisionTraceAccepted
+#guard lateSourceUseRejected
+
+private def returnedPapAddress : Address := Address.replicate 0xdd
+private def terminalFactoryAddress : Address := Address.replicate 0xde
+
+/-- Small hand-written IxIR₁ functions force the two immediate residual
+dispatcher outcomes: erased return or a PAP which still needs one argument. -/
+private def terminalReturnCompile (underApplied : Bool) : Except CompileError
+    (Sigma fun baseline : Lower.Checked =>
+      Reuse.Output Validate.defaultLimits baseline.artifact.validationContext
+        baseline.artifact.program) := do
+  let returnedFunction : IxIR1.FnDef :=
+    { arity := 3, result := .shared, papSafe := true
+      body := .letOp (.drop (.var 2))
+        (.letOp (.drop (.var 2)) (.ret (.var 2))) }
+  let factory : IxIR1.FnDef :=
+    { arity := 1, result := .shared, papSafe := true
+      body := if underApplied then
+          .letOp (.papp returnedPapAddress #[.var 0]) (.ret (.var 0))
+        else .letOp (.drop (.var 0)) (.ret .erased) }
+  let context : Lower.Context :=
+    { loweringContext with
+      parameterWorlds := fun address =>
+        if address == terminalFactoryAddress then some #[.shared]
+        else if address == returnedPapAddress then some #[.shared, .shared, .shared]
+        else none }
+  let baseline ← (Lower.lowerChecked context
+    { declarations := [(terminalFactoryAddress, .fn factory),
+        (returnedPapAddress, .fn returnedFunction)]
+      main := .letOp (.alloc .shared nilId #[])
+        (.letOp (.alloc .shared nilId #[])
+          (.letOp (.papp terminalFactoryAddress #[])
+            (.letOp (.apply (.var 0) #[.var 2, .var 1]) (.ret (.var 0)))))
+      mainResult := .shared }).mapError CompileError.baseline
+  let optimized ← (Reuse.optimize baseline.artifact.validationContext
+    baseline.artifact.program).mapError CompileError.reuse
+  return ⟨baseline, optimized⟩
+
+private def terminalReturnObserved (underApplied : Bool) (result : Eval.Result) : Bool :=
+  if !underApplied then result.value == .erased
+  else match result.value with
+    | .loc location => match result.store.get? location with
+      | some ⟨.shared, 1, .papN address 3 captured⟩ =>
+          address == returnedPapAddress && captured.size == 2 &&
+            captured[0]? != captured[1]? && captured.all (fun value =>
+              match value with
+              | .loc child => match result.store.get? child with
+                | some ⟨.shared, 1, .ctorN identity fields⟩ =>
+                    identity == nilId && fields.isEmpty
+                | _ => false
+              | _ => false)
+      | _ => false
+    | _ => false
+
+/-- Residual application releases every erased argument or retains two
+distinct captured owners in an extended PAP. All four interpretations agree
+on the result, exact ownership overhead, and complete final reclamation. -/
+def immediateApplyMoreBenchmark (underApplied : Bool) : Bool :=
+  match terminalReturnCompile underApplied with
+  | .error _ => false
+  | .ok ⟨baseline, optimized⟩ =>
+      let baselineProgram := baseline.artifact.program
+      let context := baseline.artifact.validationContext
+      match Eval.runMain (targetContext context baselineProgram)
+          .logical baselineProgram 100 100,
+        Eval.runMain (targetContext context baselineProgram)
+          .physical baselineProgram 100 100,
+        Eval.runMain (targetContext context optimized.target)
+          .logical optimized.target 100 100,
+        Eval.runMain (targetContext context optimized.target)
+          .physical optimized.target 100 100 with
+      | .ok baselineLogical, .ok baselinePhysical, .ok logical, .ok physical =>
+          optimized.report.rewritten == 0 &&
+            ([baselineLogical, baselinePhysical, logical, physical].all fun result =>
+              terminalReturnObserved underApplied result && released result &&
+                result.store.counters.allocs == (if underApplied then 5 else 3) &&
+                result.store.counters.frees == (if underApplied then 2 else 3) &&
+                result.store.counters.rcops == (if underApplied then 4 else 3) &&
+                result.store.live == (if underApplied then 3 else 0)) &&
+            baselineLogical.store.counters == baselinePhysical.store.counters &&
+            terminalCounterLaw logical physical
+      | _, _, _, _ => false
+
+/-- The normal selector uses the validated rewrite; constraining the number
+of blocks to the baseline's three forces a real target-validation rejection
+and executes the unchanged checked baseline with an explicit skip report. -/
+def productionSelectionBenchmark (fallback : Bool) : Bool :=
+  match compile unaliasedMain with
+  | .error _ => false
+  | .ok compiled =>
+      let source := compiled.baseline.artifact.program
+      let context := compiled.baseline.artifact.validationContext
+      let limits : Validate.Limits :=
+        if fallback then { maxBlocksPerFunction := 3 } else Validate.defaultLimits
+      match Reuse.selectWith limits context source with
+      | .error _ => false
+      | .ok selected =>
+          let expected : Reuse.SelectionReport := if fallback then
+            .skipped (.limit { owner := .declaration reverseAddress, block := 0 }
+              .blocksPerFunction 5 3)
+            else .applied expectedReport
+          selected.report == expected &&
+            selected.target == (if fallback then source else compiled.optimized.target) &&
+            match Eval.runMain (targetContext context selected.target)
+                .physical selected.target 1000 1000 with
+            | .error _ => false
+            | .ok result =>
+                targetNats? 100 result.store result.value == some [3, 2, 1] &&
+                  result.store.counters.allocs == (if fallback then 8 else 5) &&
+                  result.store.counters.reuses == (if fallback then 0 else 3) &&
+                  released result
+
+/-- The production selector never turns rejected source input into a
+successful baseline selection. -/
+def productionSelectionRejectsSource : Bool :=
+  match compile unaliasedMain with
+  | .error _ => false
+  | .ok compiled =>
+      match Reuse.selectWith { maxBlocksPerFunction := 0 }
+          compiled.baseline.artifact.validationContext
+          compiled.baseline.artifact.program with
+      | .error (.invalidSource error) =>
+          error == .limit { owner := .declaration reverseAddress, block := 0 }
+            .blocksPerFunction 3 0
+      | _ => false
+
+#guard immediateApplyMoreBenchmark false
+#guard immediateApplyMoreBenchmark true
+#guard productionSelectionBenchmark false
+#guard productionSelectionBenchmark true
+#guard productionSelectionRejectsSource
+
+
+/-- Proof-carrying result of an ordinary executable benchmark check. -/
+structure CheckedBenchmark (benchmark : Bool) : Type where
+  accepted : benchmark = true
+
+def checkBenchmark (name : String) (benchmark : Bool) :
+    Except String (CheckedBenchmark benchmark) :=
+  if accepted : benchmark = true then
+    .ok { accepted }
+  else
+    .error s!"{name} failed"
+
+def checkUnaliased : Except String (CheckedBenchmark unaliasedBenchmark) :=
+  checkBenchmark "all-hot compiler-emitted reversal" unaliasedBenchmark
+
+def checkAliased : Except String (CheckedBenchmark aliasedBenchmark) :=
+  checkBenchmark "all-cold compiler-emitted reversal" aliasedBenchmark
+
+def checkPapTailReturn (overApplied aliased : Bool) :
+    Except String (CheckedBenchmark (papTailReturnBenchmark overApplied aliased)) :=
+  checkBenchmark
+    s!"PAP return through addressed/self tail calls (over={overApplied}, alias={aliased})"
+    (papTailReturnBenchmark overApplied aliased)
+
+def checkImmediateApplyMore (underApplied : Bool) :
+    Except String (CheckedBenchmark (immediateApplyMoreBenchmark underApplied)) :=
+  checkBenchmark s!"immediate residual application (under={underApplied})"
+    (immediateApplyMoreBenchmark underApplied)
+
+def checkProductionSelection (fallback : Bool) :
+    Except String (CheckedBenchmark (productionSelectionBenchmark fallback)) :=
+  checkBenchmark s!"production reuse selection (fallback={fallback})"
+    (productionSelectionBenchmark fallback)
+
+def checkProductionSourceRejection :
+    Except String (CheckedBenchmark productionSelectionRejectsSource) :=
+  checkBenchmark "production reuse preserves source rejection" productionSelectionRejectsSource
+
+def checkZeroFieldChild (aliased : Bool) :
+    Except String (CheckedBenchmark (zeroFieldChildBenchmark aliased)) :=
+  checkBenchmark (if aliased then "cold reuse after an empty constructor prologue"
+    else "hot reuse after an empty constructor prologue")
+    (zeroFieldChildBenchmark aliased)
+
+def checkIncompatibleLayout :
+    Except String (CheckedBenchmark incompatibleLayoutRejected) :=
+  checkBenchmark "incompatible-layout rejection" incompatibleLayoutRejected
+
+def checkGeneralizedShape :
+    Except String (CheckedBenchmark generalizedShapeAccepted) :=
+  checkBenchmark "generalized checked-liveness reuse shape"
+    generalizedShapeAccepted
+
+def checkLateSourceUse :
+    Except String (CheckedBenchmark lateSourceUseRejected) :=
+  checkBenchmark "post-release source-use rejection" lateSourceUseRejected
+
+end Ix.Compiler.IxIR2.Reuse.Examples
diff --git a/Ix/Compiler/IxIR2/ReuseHeapMap.lean b/Ix/Compiler/IxIR2/ReuseHeapMap.lean
new file mode 100644
index 000000000..b729834b4
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseHeapMap.lean
@@ -0,0 +1,274 @@
+import Ix.Compiler.IxIR2.ReservationHeap
+
+/-!
+# Allocation history for suspended reuse
+
+The map retains every baseline allocation, including dead registers in saved
+callers. Physical reuse may give a dead allocation and a later allocation the
+same image. Injectivity is required only for currently live baseline nodes.
+This keeps saved registers stable while reserving and later refilling a slot.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.IxIR1.Sim (NodeBoxIso RValIso RValsIso)
+
+def MapRel (mapping : Array Nat) (left right : Nat) : Prop := mapping[left]? = some right
+
+theorem MapRel.functional {mapping : Array Nat} {left first second : Nat}
+    (one : MapRel mapping left first) (two : MapRel mapping left second) : first = second :=
+  Option.some.inj (one.symm.trans two)
+
+theorem MapRel.bound {mapping : Array Nat} {left right : Nat}
+    (related : MapRel mapping left right) : left < mapping.size :=
+  (Array.getElem?_eq_some_iff.mp related).1
+
+theorem MapRel.push {mapping : Array Nat} {left right : Nat}
+    (related : MapRel mapping left right) (location : Nat) :
+    MapRel (mapping.push location) left right := by
+  simpa only [MapRel, Array.getElem?_push_lt related.bound,
+    Array.getElem?_eq_getElem related.bound] using related
+
+theorem MapRel.fresh (mapping : Array Nat) (location : Nat) :
+    MapRel (mapping.push location) mapping.size location := Array.getElem?_push_size
+
+structure HeapMap (left right : Store) (mapping : Array Nat) : Prop where
+  size : mapping.size = left.heap.nodes.size
+  imageBound : ∀ {l r}, MapRel mapping l r → r < right.heap.nodes.size
+  forward : ∀ {l r box}, MapRel mapping l r → left.get? l = some box →
+    ∃ targetBox, right.get? r = some targetBox ∧ NodeBoxIso (MapRel mapping) box targetBox
+  injectiveLive : ∀ {first second target firstBox secondBox},
+    MapRel mapping first target → MapRel mapping second target →
+    left.get? first = some firstBox → left.get? second = some secondBox → first = second
+  backward : ∀ {r box}, right.get? r = some box →
+    ∃ l sourceBox, MapRel mapping l r ∧ left.get? l = some sourceBox
+
+namespace HeapMap
+
+theorem empty : HeapMap ({} : Store) ({} : Store) #[] := by
+  constructor
+  · rfl
+  · intro l r related; simp [MapRel] at related
+  · intro l r box related; simp [MapRel] at related
+  · intro l k r box other related; simp [MapRel] at related
+  · intro r box found; simp [Store.get?, IxIR1.Store.get?] at found
+
+theorem left_total {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {location : Nat} {box : NodeBox}
+    (found : left.get? location = some box) : ∃ target, MapRel mapping location target := by
+  have bound := (Array.getElem?_eq_some_iff.mp (IxIR1.Sim.nodes_get?_of_get? found)).1
+  rw [← heap.size] at bound
+  exact ⟨mapping[location], Array.getElem?_eq_getElem bound⟩
+
+theorem get {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {location : Nat} {box : NodeBox}
+    (found : left.get? location = some box) :
+    ∃ target targetBox, MapRel mapping location target ∧ right.get? target = some targetBox ∧
+      NodeBoxIso (MapRel mapping) box targetBox := by
+  obtain ⟨target, mapped⟩ := heap.left_total found
+  obtain ⟨targetBox, targetAt, boxes⟩ := heap.forward mapped found
+  exact ⟨target, targetBox, mapped, targetAt, boxes⟩
+
+theorem different_images {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {first second x y : Nat} {a b : NodeBox}
+    (one : MapRel mapping first x) (two : MapRel mapping second y)
+    (firstAt : left.get? first = some a) (secondAt : left.get? second = some b)
+    (different : first ≠ second) : x ≠ y := by
+  intro same
+  exact different (heap.injectiveLive one (same ▸ two) firstAt secondAt)
+
+theorem congr {left right left' right' : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping)
+    (leftNodes : left'.heap.nodes = left.heap.nodes)
+    (rightNodes : right'.heap.nodes = right.heap.nodes) : HeapMap left' right' mapping := by
+  have leftGet : ∀ location, left'.get? location = left.get? location := by
+    intro location; simp only [Store.get?, IxIR1.Store.get?, leftNodes]
+  have rightGet : ∀ location, right'.get? location = right.get? location := by
+    intro location; simp only [Store.get?, IxIR1.Store.get?, rightNodes]
+  exact {
+    size := by simpa only [leftNodes] using heap.size
+    imageBound := fun related => by simpa only [rightNodes] using heap.imageBound related
+    forward := fun related found => by
+      rw [leftGet] at found
+      simpa only [rightGet] using heap.forward related found
+    injectiveLive := fun one two firstAt secondAt => by
+      rw [leftGet] at firstAt secondAt
+      exact heap.injectiveLive one two firstAt secondAt
+    backward := fun found => by
+      rw [rightGet] at found
+      simpa only [leftGet] using heap.backward found }
+
+end HeapMap
+
+inductive SlotIso (mapping : Array Nat) : Option NodeBox → Option NodeBox → Prop where
+  | absent : SlotIso mapping none none
+  | present {left right : NodeBox} (boxes : NodeBoxIso (MapRel mapping) left right) :
+      SlotIso mapping (some left) (some right)
+
+theorem SlotIso.left {mapping : Array Nat} {left right : Option NodeBox} {box : NodeBox}
+    (related : SlotIso mapping left right) (found : left = some box) :
+    ∃ target, right = some target ∧ NodeBoxIso (MapRel mapping) box target := by
+  cases related with
+  | absent => cases found
+  | present boxes => cases found; exact ⟨_, rfl, boxes⟩
+
+theorem SlotIso.right {mapping : Array Nat} {left right : Option NodeBox} {box : NodeBox}
+    (related : SlotIso mapping left right) (found : right = some box) :
+    ∃ source, left = some source ∧ NodeBoxIso (MapRel mapping) source box := by
+  cases related with
+  | absent => cases found
+  | present boxes => cases found; exact ⟨_, rfl, boxes⟩
+
+/-- Change corresponding live slots, or remove both. The history array stays
+unchanged, so all saved registers keep their original correspondence. -/
+theorem HeapMap.replace {left right left' right' : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {l r : Nat} {oldLeft : NodeBox}
+    {newLeft newRight : Option NodeBox} (mapped : MapRel mapping l r)
+    (leftAt : left.get? l = some oldLeft)
+    (slots : SlotIso mapping newLeft newRight)
+    (leftSize : left'.heap.nodes.size = left.heap.nodes.size)
+    (rightSize : right'.heap.nodes.size = right.heap.nodes.size)
+    (leftGet : ∀ location, left'.get? location =
+      if location = l then newLeft else left.get? location)
+    (rightGet : ∀ location, right'.get? location =
+      if location = r then newRight else right.get? location) :
+    HeapMap left' right' mapping := by
+  have oldLive {location : Nat} {box : NodeBox} (found : left'.get? location = some box) :
+      ∃ old, left.get? location = some old := by
+    by_cases same : location = l
+    · exact ⟨oldLeft, same ▸ leftAt⟩
+    · exact ⟨box, by simpa only [leftGet, same, ↓reduceIte] using found⟩
+  refine {
+    size := heap.size.trans leftSize.symm
+    imageBound := fun related => by rw [rightSize]; exact heap.imageBound related
+    forward := ?_
+    injectiveLive := ?_
+    backward := ?_ }
+  · intro source target box related found
+    by_cases same : source = l
+    · subst source
+      have targetEq := related.functional mapped
+      subst target
+      have newAt : newLeft = some box := by simpa only [leftGet, ↓reduceIte] using found
+      obtain ⟨targetBox, targetAt, boxes⟩ := slots.left newAt
+      exact ⟨targetBox, by simpa only [rightGet, ↓reduceIte] using targetAt, boxes⟩
+    · have oldAt : left.get? source = some box := by
+        simpa only [leftGet, same, ↓reduceIte] using found
+      obtain ⟨targetBox, targetAt, boxes⟩ := heap.forward related oldAt
+      have different := heap.different_images related mapped oldAt leftAt same
+      exact ⟨targetBox, by simpa only [rightGet, different, ↓reduceIte] using targetAt, boxes⟩
+  · intro first second target a b one two firstAt secondAt
+    obtain ⟨oldA, oldFirst⟩ := oldLive firstAt
+    obtain ⟨oldB, oldSecond⟩ := oldLive secondAt
+    exact heap.injectiveLive one two oldFirst oldSecond
+  · intro target box found
+    by_cases same : target = r
+    · subst target
+      have newAt : newRight = some box := by simpa only [rightGet, ↓reduceIte] using found
+      obtain ⟨sourceBox, sourceAt, _⟩ := slots.right newAt
+      exact ⟨l, sourceBox, mapped, by simpa only [leftGet, ↓reduceIte] using sourceAt⟩
+    · have oldAt : right.get? target = some box := by
+        simpa only [rightGet, same, ↓reduceIte] using found
+      obtain ⟨source, sourceBox, related, sourceAt⟩ := heap.backward oldAt
+      have different : source ≠ l := by
+        intro equal
+        subst source
+        exact same (related.functional mapped)
+      exact ⟨source, sourceBox, related,
+        by simpa only [leftGet, different, ↓reduceIte] using sourceAt⟩
+
+/-- Append a new baseline allocation and map it to either a fresh or a
+reserved physical slot. Old history entries are retained, even when dead
+entries already name this physical location. Live injectivity follows from
+the physical slot's exclusion from the live heap before it is filled. -/
+theorem HeapMap.extend {left right left' right' : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {target : Nat} {newLeft newRight : NodeBox}
+    (empty : right.get? target = none)
+    (boxes : NodeBoxIso (MapRel mapping) newLeft newRight)
+    (leftSize : left'.heap.nodes.size = left.heap.nodes.size + 1)
+    (rightSize : right.heap.nodes.size ≤ right'.heap.nodes.size)
+    (targetBound : target < right'.heap.nodes.size)
+    (leftGet : ∀ location, left'.get? location =
+      if location = left.heap.nodes.size then some newLeft else left.get? location)
+    (rightGet : ∀ location, right'.get? location =
+      if location = target then some newRight else right.get? location) :
+    HeapMap left' right' (mapping.push target) := by
+  have oldMap {l r : Nat} (related : MapRel (mapping.push target) l r)
+      (old : l ≠ mapping.size) : MapRel mapping l r := by
+    simpa only [MapRel, Array.getElem?_push, old, ↓reduceIte] using related
+  have freshMap {r : Nat} (related : MapRel (mapping.push target) mapping.size r) :
+      r = target := (related.functional (MapRel.fresh mapping target))
+  have oldLive {l : Nat} {box : NodeBox} (found : left.get? l = some box) :
+      l ≠ left.heap.nodes.size :=
+    Nat.ne_of_lt (Array.getElem?_eq_some_iff.mp (IxIR1.Sim.nodes_get?_of_get? found)).1
+  have oldImage {l r : Nat} {box : NodeBox} (mapped : MapRel mapping l r)
+      (found : left.get? l = some box) : r ≠ target := by
+    obtain ⟨rightBox, rightAt, _⟩ := heap.forward mapped found
+    intro same
+    subst r
+    rw [empty] at rightAt
+    cases rightAt
+  have lift : ∀ {l r}, MapRel mapping l r → MapRel (mapping.push target) l r :=
+    fun related => related.push target
+  refine {
+    size := by simp only [Array.size_push, heap.size, leftSize]
+    imageBound := ?_
+    forward := ?_
+    injectiveLive := ?_
+    backward := ?_ }
+  · intro l r related
+    by_cases fresh : l = mapping.size
+    · subst l
+      rw [freshMap related]
+      exact targetBound
+    · exact Nat.lt_of_lt_of_le (heap.imageBound (oldMap related fresh)) rightSize
+  · intro l r box related found
+    by_cases fresh : l = mapping.size
+    · subst l
+      have boxEq : box = newLeft := by
+        simpa only [leftGet, heap.size, ↓reduceIte, Option.some.injEq] using found.symm
+      subst box
+      have targetEq := freshMap related
+      subst r
+      exact ⟨newRight, by simp only [rightGet, ↓reduceIte], boxes.mono lift⟩
+    · have leftOld : l ≠ left.heap.nodes.size := by simpa only [heap.size] using fresh
+      have before : left.get? l = some box := by
+        simpa only [leftGet, leftOld, ↓reduceIte] using found
+      have mapped := oldMap related fresh
+      obtain ⟨rightBox, rightAt, boxes⟩ := heap.forward mapped before
+      have different := oldImage mapped before
+      exact ⟨rightBox, by simpa only [rightGet, different, ↓reduceIte] using rightAt,
+        boxes.mono lift⟩
+  · intro first second r a b one two firstAt secondAt
+    by_cases firstFresh : first = mapping.size
+    · by_cases secondFresh : second = mapping.size
+      · exact firstFresh.trans secondFresh.symm
+      · have oldSecond : left.get? second = some b := by
+          simpa only [leftGet, ← heap.size, secondFresh, ↓reduceIte] using secondAt
+        have impossible := oldImage (oldMap two secondFresh) oldSecond
+        subst first
+        exact False.elim (impossible (freshMap one))
+    · by_cases secondFresh : second = mapping.size
+      · have oldFirst : left.get? first = some a := by
+          simpa only [leftGet, ← heap.size, firstFresh, ↓reduceIte] using firstAt
+        have impossible := oldImage (oldMap one firstFresh) oldFirst
+        subst second
+        exact False.elim (impossible (freshMap two))
+      · have oldFirst : left.get? first = some a := by
+          simpa only [leftGet, ← heap.size, firstFresh, ↓reduceIte] using firstAt
+        have oldSecond : left.get? second = some b := by
+          simpa only [leftGet, ← heap.size, secondFresh, ↓reduceIte] using secondAt
+        exact heap.injectiveLive (oldMap one firstFresh) (oldMap two secondFresh) oldFirst oldSecond
+  · intro r box found
+    by_cases fresh : r = target
+    · subst r
+      exact ⟨mapping.size, newLeft, MapRel.fresh mapping target,
+        by simp only [leftGet, heap.size, ↓reduceIte]⟩
+    · have before : right.get? r = some box := by
+        simpa only [rightGet, fresh, ↓reduceIte] using found
+      obtain ⟨l, leftBox, related, leftAt⟩ := heap.backward before
+      exact ⟨l, leftBox, related.push target,
+        by simpa only [leftGet, oldLive leftAt, ↓reduceIte] using leftAt⟩
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/ReuseHeapMapOps.lean b/Ix/Compiler/IxIR2/ReuseHeapMapOps.lean
new file mode 100644
index 000000000..3dba41836
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseHeapMapOps.lean
@@ -0,0 +1,385 @@
+import Ix.Compiler.IxIR2.ReuseHeapMap
+import Ix.Compiler.IxIR1.EvalIso
+
+/-!
+# Executable heap operations under allocation history
+
+Successful baseline observations transport through the live part of the
+history map. Destruction retains old names; allocation appends one name,
+whether the target uses fresh storage or fills a suspended reservation.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim (NodeIso NodeBoxIso RValIso RValsIso)
+
+private theorem get_setBox {store : Store} {location : Nat} {old new : NodeBox}
+    (found : store.get? location = some old) (other : Nat) :
+    (store.setBox location new).get? other =
+      if other = location then some new else store.get? other := by
+  have bound := (Array.getElem?_eq_some_iff.mp (IxIR1.Sim.nodes_get?_of_get? found)).1
+  by_cases same : other = location
+  · subst other
+    simp [Store.setBox, Store.get?, IxIR1.Store.setBox, IxIR1.Store.get?,
+      Array.set!_eq_setIfInBounds, bound]
+  · simp [Store.setBox, Store.get?, IxIR1.Store.setBox, IxIR1.Store.get?,
+      Array.set!_eq_setIfInBounds, same, Ne.symm same]
+
+private theorem get_kill (store : Store) (location other : Nat) :
+    (store.kill location).get? other =
+      if other = location then none else store.get? other := by
+  by_cases same : other = location
+  · subst other
+    simp [Store.kill, Store.get?, IxIR1.Store.kill, IxIR1.Store.get?,
+      Array.set!_eq_setIfInBounds, Array.getElem?_setIfInBounds]
+  · simp [Store.kill, Store.get?, IxIR1.Store.kill, IxIR1.Store.get?,
+      Array.set!_eq_setIfInBounds, same, Ne.symm same]
+
+private theorem get_alloc (store : Store) (world : Owned) (node : Node) (location : Nat) :
+    (store.allocNode world node).1.get? location =
+      if location = store.heap.nodes.size then some ⟨world, 1, node⟩
+      else store.get? location := by
+  simp only [Store.get?, Store.allocNode_heap, IxIR1.Store.allocNode,
+    IxIR1.Store.get?, Array.getElem?_push]
+  split <;> rfl
+
+theorem setRc_world {store : Store} {location rc : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (world : Owned) (value : RVal) :
+    RVal.hasWorld (store.setBox location { box with rc }) world value =
+      RVal.hasWorld store world value := by
+  cases value with
+  | lit => rfl
+  | erased => rfl
+  | loc other =>
+      by_cases same : other = location
+      · subst other
+        simp only [RVal.hasWorld, get_setBox found, ↓reduceIte, found]
+      · simp only [RVal.hasWorld, get_setBox found, same, ↓reduceIte]
+
+theorem retain_world {store output : Store} {value : RVal}
+    (run : retainShared store value = .ok output) :
+    RVal.hasWorld store .shared value = true ∧
+      ∀ world observed, RVal.hasWorld output world observed = RVal.hasWorld store world observed := by
+  cases value with
+  | lit => cases run; exact ⟨rfl, fun _ _ => rfl⟩
+  | erased => cases run; exact ⟨rfl, fun _ _ => rfl⟩
+  | loc location =>
+      cases found : store.get? location with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp only [retainShared, found, shared, bne_self_eq_false, Bool.false_eq_true,
+              ↓reduceIte, Except.ok.injEq] at run
+            subst output
+            refine ⟨by simp [RVal.hasWorld, found, shared], ?_⟩
+            intro world observed
+            change RVal.hasWorld (store.setBox location _) world observed = _
+            simpa only [shared] using setRc_world (rc := box.rc + 1) found world observed
+          · simp [retainShared, found, shared] at run
+
+theorem retainMany_world {store output : Store} {values : Array RVal}
+    (run : RetainSharedMany store values output) :
+    ∀ value ∈ values.toList, RVal.hasWorld store .shared value = true := by
+  have loop : ∀ (values : List RVal) {store output : Store},
+      values.foldlM retainShared store = .ok output →
+      ∀ value ∈ values, RVal.hasWorld store .shared value = true := by
+    intro values
+    induction values with
+    | nil => simp
+    | cons head tail ih =>
+        intro store output run value member
+        rw [List.foldlM_cons] at run
+        cases first : retainShared store head with
+        | error error => simp [first, bind, Except.bind] at run
+        | ok middle =>
+            simp only [first, bind, Except.bind] at run
+            have worlds := retain_world first
+            simp only [List.mem_cons] at member
+            rcases member with rfl | member
+            · exact worlds.1
+            · rw [← worlds.2 .shared value]
+              exact ih run value member
+  change values.foldlM retainShared store = .ok output at run
+  rw [← Array.foldlM_toList] at run
+  exact loop values.toList run
+
+namespace HeapMap
+
+theorem rcTick {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) : HeapMap left.rcTick right.rcTick mapping :=
+  heap.congr rfl rfl
+
+theorem setBox {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {l r : Nat} {oldLeft newLeft newRight : NodeBox}
+    (mapped : MapRel mapping l r) (leftAt : left.get? l = some oldLeft)
+    (boxes : NodeBoxIso (MapRel mapping) newLeft newRight) :
+    HeapMap (left.setBox l newLeft) (right.setBox r newRight) mapping := by
+  obtain ⟨oldRight, rightAt, _⟩ := heap.forward mapped leftAt
+  exact heap.replace mapped leftAt (.present boxes)
+    (by simp [Store.setBox, IxIR1.Store.setBox])
+    (by simp [Store.setBox, IxIR1.Store.setBox])
+    (get_setBox leftAt) (get_setBox rightAt)
+
+theorem kill {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {l r : Nat} {oldLeft : NodeBox}
+    (mapped : MapRel mapping l r) (leftAt : left.get? l = some oldLeft) :
+    HeapMap (left.kill l) (right.kill r) mapping :=
+  heap.replace mapped leftAt .absent
+    (by simp [Store.kill, IxIR1.Store.kill])
+    (by simp [Store.kill, IxIR1.Store.kill])
+    (get_kill left l) (get_kill right r)
+
+theorem reserve {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {l r : Nat} {oldLeft : NodeBox}
+    (mapped : MapRel mapping l r) (leftAt : left.get? l = some oldLeft) :
+    HeapMap (left.kill l) (right.reserve r) mapping :=
+  (heap.kill mapped leftAt).congr rfl (by
+    simp only [Store.reserve, Store.kill, IxIR1.Store.kill, Array.set!_eq_setIfInBounds])
+
+theorem alloc {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {world : Owned} {leftNode rightNode : Node}
+    (nodes : NodeIso (MapRel mapping) leftNode rightNode) :
+    HeapMap (left.allocNode world leftNode).1 (right.allocNode world rightNode).1
+      (mapping.push right.heap.nodes.size) := by
+  apply heap.extend (target := right.heap.nodes.size) (newLeft := ⟨world, 1, leftNode⟩)
+    (newRight := ⟨world, 1, rightNode⟩)
+  · simp [Store.get?, IxIR1.Store.get?]
+  · exact ⟨rfl, rfl, nodes⟩
+  · simp [IxIR1.Store.allocNode]
+  · simp [IxIR1.Store.allocNode]
+  · simp [IxIR1.Store.allocNode]
+  · exact get_alloc left world leftNode
+  · exact get_alloc right world rightNode
+
+theorem reuse {left right rightOut : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {target payload : Nat} {world : Owned}
+    {leftNode rightNode : Node} (nodes : NodeIso (MapRel mapping) leftNode rightNode)
+    (run : right.reuseReservation target world rightNode payload = .ok rightOut) :
+    HeapMap (left.allocNode world leftNode).1 rightOut (mapping.push target) := by
+  unfold Store.reuseReservation at run
+  split at run
+  · rename_i empty
+    cases run
+    have bound := (Array.getElem?_eq_some_iff.mp empty).1
+    apply heap.extend (newLeft := ⟨world, 1, leftNode⟩)
+      (newRight := ⟨world, 1, rightNode⟩)
+    · exact Store.EmptySlot.not_live empty
+    · exact ⟨rfl, rfl, nodes⟩
+    · simp [IxIR1.Store.allocNode]
+    · simp only [Store.withPeak_heap, Array.size_setIfInBounds, Nat.le_refl]
+    · simpa only [Store.withPeak_heap, Array.size_setIfInBounds] using bound
+    · exact get_alloc left world leftNode
+    · intro location
+      by_cases same : location = target
+      · subst location
+        simp [Store.get?, Store.withPeak_heap, IxIR1.Store.get?, bound]
+      · simp [Store.get?, Store.withPeak_heap, IxIR1.Store.get?, same, Ne.symm same]
+  · cases run
+
+/-- Only successful source observations are required. A dead historical name
+may now refer to reused storage, but successful source code cannot inspect it. -/
+theorem hasWorld {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {leftValue rightValue : RVal} {world : Owned}
+    (related : RValIso (MapRel mapping) leftValue rightValue)
+    (valid : RVal.hasWorld left world leftValue = true) :
+    RVal.hasWorld right world rightValue = true := by
+  cases related with
+  | lit => exact valid
+  | erased => exact valid
+  | @loc l r mapped =>
+      cases found : left.get? l with
+      | none => simp [RVal.hasWorld, found] at valid
+      | some box =>
+          obtain ⟨targetBox, rightAt, boxes⟩ := heap.forward mapped found
+          simpa only [RVal.hasWorld, found, rightAt, ← boxes.world] using valid
+
+theorem constructorView {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {l r : Nat} {world : Owned} {cid : CtorId}
+    {leftBox : NodeBox} {leftFields : Array RVal} (mapped : MapRel mapping l r)
+    (view : ConstructorView left l world cid leftBox leftFields) :
+    ∃ rightBox rightFields,
+      ConstructorView right r world cid rightBox rightFields ∧
+      NodeBoxIso (MapRel mapping) leftBox rightBox ∧
+      RValsIso (MapRel mapping) leftFields.toList rightFields.toList := by
+  obtain ⟨leftAt, leftWorld, leftNode⟩ := view.parts
+  obtain ⟨rightBox, rightAt, boxes⟩ := heap.forward mapped leftAt
+  have nodes := boxes.node
+  rw [leftNode] at nodes
+  cases rightNode : rightBox.node with
+  | papN address arity arguments => rw [rightNode] at nodes; cases nodes
+  | ctorN targetCid rightFields =>
+      rw [rightNode] at nodes
+      cases nodes with
+      | ctor fields =>
+          exact ⟨rightBox, rightFields,
+            .of_box rightAt (boxes.world.symm.trans leftWorld) rightNode, boxes, fields⟩
+
+theorem retain {left right leftOut : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {leftValue rightValue : RVal}
+    (related : RValIso (MapRel mapping) leftValue rightValue)
+    (run : retainShared left leftValue = .ok leftOut) :
+    ∃ rightOut, retainShared right rightValue = .ok rightOut ∧
+      HeapMap leftOut rightOut mapping := by
+  cases related with
+  | lit => cases run; exact ⟨right, rfl, heap⟩
+  | erased => cases run; exact ⟨right, rfl, heap⟩
+  | @loc l r mapped =>
+      cases found : left.get? l with
+      | none => simp [retainShared, found] at run
+      | some box =>
+          by_cases shared : box.world = .shared
+          · simp [retainShared, found, shared] at run
+            subst leftOut
+            obtain ⟨targetBox, rightAt, boxes⟩ := heap.forward mapped found
+            refine ⟨(right.setBox r { targetBox with rc := targetBox.rc + 1 }).rcTick, ?_, ?_⟩
+            · simp [retainShared, rightAt, ← boxes.world, shared]
+            · apply HeapMap.rcTick
+              apply heap.setBox mapped found
+              exact ⟨shared.symm.trans boxes.world, by simp only [boxes.rc], boxes.node⟩
+          · simp [retainShared, found, shared] at run
+
+theorem retainMany {left right leftOut : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) {leftValues rightValues : Array RVal}
+    (related : RValsIso (MapRel mapping) leftValues.toList rightValues.toList)
+    (run : RetainSharedMany left leftValues leftOut) :
+    ∃ rightOut, RetainSharedMany right rightValues rightOut ∧
+      HeapMap leftOut rightOut mapping := by
+  have loop : ∀ {leftValues rightValues : List RVal},
+      RValsIso (MapRel mapping) leftValues rightValues →
+      ∀ {left right leftOut : Store}, HeapMap left right mapping →
+      leftValues.foldlM retainShared left = .ok leftOut →
+      ∃ rightOut, rightValues.foldlM retainShared right = .ok rightOut ∧
+        HeapMap leftOut rightOut mapping := by
+    intro leftValues rightValues related
+    induction related with
+    | nil => intro left right leftOut heap run; cases run; exact ⟨right, rfl, heap⟩
+    | @cons lval rval ls rs head tail ih =>
+        intro left right leftOut heap run
+        rw [List.foldlM_cons] at run
+        cases first : retainShared left lval with
+        | error error => simp [first, bind, Except.bind] at run
+        | ok middle =>
+            simp only [first, bind, Except.bind] at run
+            obtain ⟨rightMiddle, rightFirst, middleHeap⟩ := heap.retain head first
+            obtain ⟨rightOut, rest, final⟩ := ih middleHeap run
+            exact ⟨rightOut, by simpa only [List.foldlM_cons, rightFirst, bind, Except.bind]
+              using rest, final⟩
+  change leftValues.foldlM retainShared left = .ok leftOut at run
+  rw [← Array.foldlM_toList] at run
+  obtain ⟨rightOut, rightRun, final⟩ := loop related heap run
+  refine ⟨rightOut, ?_, final⟩
+  change rightValues.foldlM retainShared right = .ok rightOut
+  simpa only [← Array.foldlM_toList] using rightRun
+
+end HeapMap
+
+theorem nodeChildren_iso {mapping : Array Nat} {left right : Node}
+    (nodes : NodeIso (MapRel mapping) left right) :
+    RValsIso (MapRel mapping) (IxIR1.Sim.nodeChildren left) (IxIR1.Sim.nodeChildren right) := by
+  cases nodes <;> assumption
+
+theorem HeapMap.releaseWork {fuel remaining : Nat} {left right leftOut : Store}
+    {mapping : Array Nat} (heap : HeapMap left right mapping)
+    {leftValues rightValues : List RVal}
+    (related : RValsIso (MapRel mapping) leftValues rightValues)
+    (run : releaseSharedWork fuel left leftValues = .ok (leftOut, remaining)) :
+    ∃ rightOut, releaseSharedWork fuel right rightValues = .ok (rightOut, remaining) ∧
+      HeapMap leftOut rightOut mapping := by
+  induction fuel generalizing left right leftValues rightValues with
+  | zero =>
+      cases related with
+      | nil => cases run; exact ⟨right, rfl, heap⟩
+      | cons head tail => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      cases related with
+      | nil => cases run; exact ⟨right, rfl, heap⟩
+      | @cons lval rval ls rs head tail =>
+          cases head with
+          | lit => exact ih heap tail run
+          | erased => exact ih heap tail run
+          | @loc l r mapped =>
+              cases found : left.get? l with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  by_cases shared : box.world = .shared
+                  · obtain ⟨targetBox, rightAt, boxes⟩ := heap.forward mapped found
+                    by_cases zero : box.rc = 0
+                    · simp [releaseSharedWork, found, shared, zero] at run
+                    · by_cases unitRC : box.rc = 1
+                      · simp only [releaseSharedWork, found, shared, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, unitRC, beq_self_eq_true] at run
+                        have bothKilled := heap.rcTick.kill mapped (show left.rcTick.get? l =
+                          some box from found)
+                        have children := (nodeChildren_iso boxes.node).append tail
+                        obtain ⟨rightOut, rightRun, output⟩ := ih bothKilled children run
+                        refine ⟨rightOut, ?_, output⟩
+                        cases targetNode : targetBox.node <;>
+                          simpa only [releaseSharedWork, rightAt, ← boxes.world, shared,
+                            bne_self_eq_false, Bool.false_eq_true, ↓reduceIte, ← boxes.rc,
+                            unitRC, beq_self_eq_true, Nat.reduceBEq,
+                            IxIR1.Sim.nodeChildren, targetNode] using rightRun
+                      · simp [releaseSharedWork, found, shared, zero, unitRC] at run
+                        have bothSet := heap.rcTick.setBox mapped
+                          (show left.rcTick.get? l = some box from found)
+                          (show NodeBoxIso (MapRel mapping)
+                            { box with rc := box.rc - 1 }
+                            { targetBox with rc := targetBox.rc - 1 } from
+                            ⟨boxes.world, congrArg (· - 1) boxes.rc, boxes.node⟩)
+                        obtain ⟨rightOut, rightRun, output⟩ := ih bothSet tail (by
+                          simpa only [shared] using run)
+                        refine ⟨rightOut, ?_, output⟩
+                        simpa only [releaseSharedWork, rightAt, ← boxes.world, shared,
+                          bne_self_eq_false, Bool.false_eq_true, ↓reduceIte, ← boxes.rc,
+                          beq_iff_eq, zero, unitRC] using rightRun
+                  · simp [releaseSharedWork, found, shared] at run
+
+theorem HeapMap.dropWork {fuel remaining : Nat} {left right leftOut : Store}
+    {mapping : Array Nat} (heap : HeapMap left right mapping)
+    {leftValues rightValues : List RVal}
+    (related : RValsIso (MapRel mapping) leftValues rightValues)
+    (run : dropUniqueWork fuel left leftValues = .ok (leftOut, remaining)) :
+    ∃ rightOut, dropUniqueWork fuel right rightValues = .ok (rightOut, remaining) ∧
+      HeapMap leftOut rightOut mapping := by
+  induction fuel generalizing left right leftValues rightValues with
+  | zero =>
+      cases related with
+      | nil => cases run; exact ⟨right, rfl, heap⟩
+      | cons head tail => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      cases related with
+      | nil => cases run; exact ⟨right, rfl, heap⟩
+      | @cons lval rval ls rs head tail =>
+          cases head with
+          | lit => exact ih heap tail run
+          | erased => exact ih heap tail run
+          | @loc l r mapped =>
+              cases found : left.get? l with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  by_cases unique : box.world = .unique
+                  · obtain ⟨targetBox, rightAt, boxes⟩ := heap.forward mapped found
+                    have nodes := boxes.node
+                    cases node : box.node with
+                    | papN address arity arguments =>
+                        simp [dropUniqueWork, found, unique, node] at run
+                    | ctorN cid fields =>
+                        simp only [dropUniqueWork, found, unique, bne_self_eq_false,
+                          Bool.false_eq_true, ↓reduceIte, node] at run
+                        rw [node] at nodes
+                        cases targetNode : targetBox.node with
+                        | papN address arity arguments => rw [targetNode] at nodes; cases nodes
+                        | ctorN targetCid targetFields =>
+                            rw [targetNode] at nodes
+                            cases nodes with
+                            | ctor children =>
+                                obtain ⟨rightOut, rightRun, output⟩ :=
+                                  ih (heap.kill mapped found) (children.append tail) run
+                                refine ⟨rightOut, ?_, output⟩
+                                simpa only [dropUniqueWork, rightAt, ← boxes.world, unique,
+                                  bne_self_eq_false, Bool.false_eq_true, ↓reduceIte, targetNode]
+                                  using rightRun
+                  · simp [dropUniqueWork, found, unique] at run
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/ReuseHeapMapResults.lean b/Ix/Compiler/IxIR2/ReuseHeapMapResults.lean
new file mode 100644
index 000000000..05b3ab8d6
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseHeapMapResults.lean
@@ -0,0 +1,182 @@
+import Ix.Compiler.IxIR2.ReuseHeapMapOps
+import Ix.Compiler.IxIR2.ReuseCost
+
+/-!
+# Semantic and cost observations of allocation history
+
+The history map has exactly the established live-heap meaning at closed
+endpoints. Live-node counts and pending RC agree even during heap traversal,
+when the work list temporarily owns children of an already removed node.
+-/
+
+namespace Ix.Compiler.IxIR2.CallReuse.Sim
+
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.IxIR1.Sim (NodeIso NodeBoxIso RValIso RValsIso LiveRVal StoreClosed HeapIso)
+open Ix.Compiler.IxIR1.CostTrace
+
+def LiveMapRel (left : Store) (mapping : Array Nat) (l r : Nat) : Prop :=
+  MapRel mapping l r ∧ LiveRVal left.heap (.loc l)
+
+theorem values_liveMap {left : Store} {mapping : Array Nat} {leftValues rightValues : List RVal}
+    (related : RValsIso (MapRel mapping) leftValues rightValues)
+    (live : ∀ value ∈ leftValues, LiveRVal left.heap value) :
+    RValsIso (LiveMapRel left mapping) leftValues rightValues := by
+  induction related with
+  | nil => exact .nil
+  | @cons lval rval ls rs head tail ih =>
+      refine .cons ?_ (ih (fun value member => live value (by simp [member])))
+      cases head with
+      | @loc l r mapped => exact .loc ⟨mapped, live (.loc l) (by simp)⟩
+      | lit => exact .lit
+      | erased => exact .erased
+
+theorem node_liveMap {left : Store} {mapping : Array Nat} {leftNode rightNode : Node}
+    (related : NodeIso (MapRel mapping) leftNode rightNode)
+    (live : ∀ value ∈ IxIR1.Sim.nodeChildren leftNode, LiveRVal left.heap value) :
+    NodeIso (LiveMapRel left mapping) leftNode rightNode := by
+  cases related with
+  | ctor fields => exact .ctor (values_liveMap fields live)
+  | pap arguments => exact .pap (values_liveMap arguments live)
+
+def HeapMap.toHeapIso {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) (closed : StoreClosed left.heap) :
+    HeapIso left.heap right.heap where
+  locRel := LiveMapRel left mapping
+  left_unique := fun one two => one.1.functional two.1
+  right_unique := by
+    intro l k r one two
+    obtain ⟨a, firstAt⟩ := one.2
+    obtain ⟨b, secondAt⟩ := two.2
+    exact heap.injectiveLive one.1 two.1 firstAt secondAt
+  left_total := by
+    intro l box found
+    obtain ⟨r, related⟩ := heap.left_total found
+    exact ⟨r, related, box, found⟩
+  right_total := by
+    intro r box found
+    obtain ⟨l, leftBox, related, leftAt⟩ := heap.backward found
+    exact ⟨l, related, leftBox, leftAt⟩
+  related_live := by
+    intro l r related
+    obtain ⟨mapped, leftBox, leftAt⟩ := related
+    obtain ⟨rightBox, rightAt, boxes⟩ := heap.forward mapped leftAt
+    refine ⟨leftBox, rightBox, leftAt, rightAt, boxes.world, boxes.rc, ?_⟩
+    exact node_liveMap boxes.node (closed leftAt)
+
+theorem HeapMap.toHeapIso_value {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) (closed : StoreClosed left.heap)
+    {leftValue rightValue : RVal} (related : RValIso (MapRel mapping) leftValue rightValue)
+    (live : LiveRVal left.heap leftValue) :
+    RValIso (heap.toHeapIso closed).locRel leftValue rightValue := by
+  cases related with
+  | loc mapped => exact .loc ⟨mapped, live⟩
+  | lit => exact .lit
+  | erased => exact .erased
+
+/-- Live isomorphism is a valid history relation with no dead rows. -/
+def liveHistory {left right : IxIR1.Store} (iso : HeapIso left right) :
+    IxIR1.Sim.HeapHistoryIso left right where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro l r related
+    obtain ⟨leftBox, _, leftAt, _, _⟩ := iso.related_live related
+    exact (Array.getElem?_eq_some_iff.mp (IxIR1.Sim.nodes_get?_of_get? leftAt)).1
+  right_bound := by
+    intro l r related
+    obtain ⟨_, rightBox, _, rightAt, _⟩ := iso.related_live related
+    exact (Array.getElem?_eq_some_iff.mp (IxIR1.Sim.nodes_get?_of_get? rightAt)).1
+  left_total := iso.left_total
+  right_total := iso.right_total
+  related := fun related => .inr (iso.related_live related)
+
+theorem HeapMap.toStable {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) (closed : StoreClosed left.heap) :
+    ReuseSim.StableHeapRel left right (LiveMapRel left mapping) :=
+  .isomorphic (liveHistory (heap.toHeapIso closed)).symm
+
+theorem HeapMap.right_empty {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) (empty : left.live = 0) : right.live = 0 := by
+  apply (IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot right.heap).2
+  intro box member
+  obtain ⟨r, slot⟩ := Array.mem_iff_getElem?.mp member
+  have found : right.get? r = some box := by simp [Store.get?, IxIR1.Store.get?, slot]
+  obtain ⟨l, leftBox, _, leftAt⟩ := heap.backward found
+  have leftMember := Array.mem_iff_getElem?.mpr
+    ⟨l, IxIR1.Sim.nodes_get?_of_get? leftAt⟩
+  exact (IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot left.heap).1 empty
+    leftBox leftMember
+
+theorem HeapMap.live_eq {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) : left.live = right.live := by
+  classical
+  by_cases empty : left.live = 0
+  · exact empty.trans (heap.right_empty empty).symm
+  have present : ∃ box, some box ∈ left.heap.nodes := by
+    apply Classical.byContradiction
+    intro absent
+    simp only [not_exists] at absent
+    exact empty ((IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot left.heap).2 absent)
+  obtain ⟨box, member⟩ := present
+  obtain ⟨l, slot⟩ := Array.mem_iff_getElem?.mp member
+  have found : left.get? l = some box := by simp [Store.get?, IxIR1.Store.get?, slot]
+  obtain ⟨r, rightBox, mapped, rightAt, _⟩ := heap.get found
+  have leftCount := Store.live_kill found
+  have rightCount := Store.live_kill rightAt
+  have remaining := (heap.kill mapped found).live_eq
+  omega
+termination_by left.live
+decreasing_by
+  have _removed := Store.live_kill found
+  omega
+
+theorem HeapMap.pendingRC_eq {left right : Store} {mapping : Array Nat}
+    (heap : HeapMap left right mapping) : left.pendingRC = right.pendingRC := by
+  classical
+  by_cases empty : left.live = 0
+  · rw [ReuseSim.pendingRC_empty empty, ReuseSim.pendingRC_empty (heap.right_empty empty)]
+  have present : ∃ box, some box ∈ left.heap.nodes := by
+    apply Classical.byContradiction
+    intro absent
+    simp only [not_exists] at absent
+    exact empty ((IxIR1.Reclamation.Store.live_eq_zero_iff_no_live_slot left.heap).2 absent)
+  obtain ⟨box, member⟩ := present
+  obtain ⟨l, slot⟩ := Array.mem_iff_getElem?.mp member
+  have found : left.get? l = some box := by simp [Store.get?, IxIR1.Store.get?, slot]
+  obtain ⟨r, rightBox, mapped, rightAt, boxes⟩ := heap.get found
+  have leftRemoved := sharedRcPotential_kill (store := left.heap) found
+  have rightRemoved := sharedRcPotential_kill (store := right.heap) rightAt
+  have weights : slotSharedRcPotential (some box) = slotSharedRcPotential (some rightBox) := by
+    rcases box with ⟨world, rc, node⟩
+    rcases rightBox with ⟨rightWorld, rightRC, rightNode⟩
+    have worlds := boxes.world
+    have counts := boxes.rc
+    dsimp at worlds counts
+    subst rightWorld
+    subst rightRC
+    cases world <;> rfl
+  have remaining := (heap.kill mapped found).pendingRC_eq
+  change sharedRcPotential (left.heap.kill l) = sharedRcPotential (right.heap.kill r) at remaining
+  unfold Store.pendingRC
+  omega
+termination_by left.live
+decreasing_by
+  have _removed := Store.live_kill found
+  omega
+
+theorem HeapMap.costDelta {beforeLeft beforeRight afterLeft afterRight : Store}
+    {beforeMap afterMap : Array Nat} (before : HeapMap beforeLeft beforeRight beforeMap)
+    (after : HeapMap afterLeft afterRight afterMap) {events : Nat} {charge : Int}
+    (leftRC : (afterLeft.amortizedRC : Int) = beforeLeft.amortizedRC + charge)
+    (rightRC : (afterRight.amortizedRC : Int) = beforeRight.amortizedRC + charge)
+    (leftPeak : afterLeft.peakLiveNodes = if events = 0 then beforeLeft.peakLiveNodes
+      else max beforeLeft.peakLiveNodes afterLeft.live)
+    (rightPeak : afterRight.peakLiveNodes = if events = 0 then beforeRight.peakLiveNodes
+      else max beforeRight.peakLiveNodes afterRight.live) :
+    CostDelta beforeLeft afterLeft beforeRight afterRight :=
+  .of_observations before.pendingRC_eq after.pendingRC_eq after.live_eq
+    leftRC rightRC leftPeak rightPeak
+
+end Ix.Compiler.IxIR2.CallReuse.Sim
diff --git a/Ix/Compiler/IxIR2/ReuseLiveSim.lean b/Ix/Compiler/IxIR2/ReuseLiveSim.lean
new file mode 100644
index 000000000..9dd753c0e
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseLiveSim.lean
@@ -0,0 +1,27547 @@
+import Ix.Compiler.IxIR2.ReuseSim
+import Ix.Compiler.IxIR2.PipelineSim
+import Ix.Compiler.IxIR1.EvalHistory
+import Ix.Compiler.IxIR2.AllocationEvents
+import Ix.Compiler.IxIR2.ReuseCost
+
+/-!
+# Liveness-indexed stable states for dynamic reuse
+
+`ReuseSim.StableFrameIso` relates every append-only value register.  That is
+convenient for local lockstep proofs, but it is too strong at a call boundary:
+the evaluator suspends the complete caller frame, including dead registers
+whose owners were transferred to the callee.  A physical reset in that callee
+may reuse such an address.  The dead caller register is never read again, but
+an all-register relation would nevertheless require its obsolete allocation
+epoch to remain related to the new payload at the reused address.
+
+This module introduces the proof relation needed at the compiler boundary.
+Only registers with a syntactic use at or after the frame's current program
+counter are related.  Pending `applyMore` arguments remain fully related,
+because all of them are semantically live.  The existing stronger relation
+embeds into this one, while relation transport after physical reuse asks for
+avoidance only of live slots.
+-/
+
+namespace Ix.Compiler.IxIR2.ReuseLiveSim
+
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.IxIR2.Reuse
+open Ix.Compiler.IxIR2.ReuseSim
+open Ix.Compiler.Ixon (Owned)
+
+private theorem blocks_nonempty_of_getElem {blocks : Array Block}
+    {index : Nat} {block : Block} (found : blocks[index]? = some block) :
+    blocks.isEmpty = false := by
+  apply Bool.eq_false_iff.mpr
+  intro empty
+  have blocksEmpty : blocks = #[] := Array.isEmpty_iff.mp empty
+  subst blocks
+  simp at found
+
+private theorem nodeIso_ctor_left {locRel : Nat → Nat → Prop}
+    {cid : CtorId} {baselineFields : Array RVal}
+    {rewrittenNode : IxIR1.Node}
+    (related : IxIR1.Sim.NodeIso locRel (.ctorN cid baselineFields)
+      rewrittenNode) :
+    ∃ rewrittenFields : Array RVal,
+      rewrittenNode = .ctorN cid rewrittenFields ∧
+        IxIR1.Sim.RValsIso locRel baselineFields.toList
+          rewrittenFields.toList := by
+  cases related with
+  | ctor fields => exact ⟨_, rfl, fields⟩
+
+private theorem nodeIso_pap_left {locRel : Nat → Nat → Prop}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {baselineArguments : Array RVal} {rewrittenNode : IxIR1.Node}
+    (related : IxIR1.Sim.NodeIso locRel
+      (.papN address arity baselineArguments) rewrittenNode) :
+    ∃ rewrittenArguments : Array RVal,
+      rewrittenNode = .papN address arity rewrittenArguments ∧
+        IxIR1.Sim.RValsIso locRel baselineArguments.toList
+          rewrittenArguments.toList := by
+  cases related with
+  | pap arguments => exact ⟨_, rfl, arguments⟩
+
+private theorem rvalsIso_array_extract {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel baseline.toList rewritten.toList)
+    (start stop : Nat) :
+    IxIR1.Sim.RValsIso locRel
+      (baseline.extract start stop).toList
+      (rewritten.extract start stop).toList := by
+  simpa [List.extract_eq_take_drop] using
+    (related.drop start).take (stop - start)
+
+private theorem rvalsIso_length_eq {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel baseline rewritten) :
+    baseline.length = rewritten.length := by
+  induction related with
+  | nil => rfl
+  | cons _ _ ih => simp [ih]
+
+private theorem rvalsIso_symm {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel baseline rewritten) :
+    IxIR1.Sim.RValsIso
+      (fun rewrittenLocation baselineLocation =>
+        locRel baselineLocation rewrittenLocation)
+      rewritten baseline := by
+  induction related with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons head.symm ih
+
+private theorem rvalsIso_append_pair {locRel : Nat → Nat → Prop}
+    {baseline₁ rewritten₁ baseline₂ rewritten₂ : List RVal}
+    (first : IxIR1.Sim.RValsIso locRel baseline₁ rewritten₁)
+    (second : IxIR1.Sim.RValsIso locRel baseline₂ rewritten₂) :
+    IxIR1.Sim.RValsIso locRel
+      (baseline₁ ++ baseline₂) (rewritten₁ ++ rewritten₂) := by
+  induction first with
+  | nil => exact second
+  | cons head tail ih => exact .cons head ih
+
+private theorem rvalsIso_mono_rel {oldRel newRel : Nat → Nat → Prop}
+    (lift : ∀ {baseline rewritten},
+      oldRel baseline rewritten → newRel baseline rewritten) :
+    ∀ {baseline rewritten : List RVal},
+      IxIR1.Sim.RValsIso oldRel baseline rewritten →
+        IxIR1.Sim.RValsIso newRel baseline rewritten
+  | _, _, .nil => .nil
+  | _, _, .cons head tail =>
+      .cons (head.mono lift) (rvalsIso_mono_rel lift tail)
+
+private theorem rvalsIso_getElem? {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel baseline rewritten)
+    {index : Nat} {baselineValue : RVal}
+    (found : baseline[index]? = some baselineValue) :
+    ∃ rewrittenValue,
+      rewritten[index]? = some rewrittenValue ∧
+        IxIR1.Sim.RValIso locRel baselineValue rewrittenValue := by
+  induction related generalizing index baselineValue with
+  | nil => simp at found
+  | @cons baselineHead rewrittenHead baselineTail rewrittenTail head tail ih =>
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero, Option.some.injEq] at found
+          subst baselineValue
+          exact ⟨rewrittenHead, by simp, head⟩
+      | succ index =>
+          simp only [List.getElem?_cons_succ] at found ⊢
+          exact ih found
+
+private theorem rvalsIso_array_getElem? {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel baseline.toList rewritten.toList)
+    {index : Nat} {baselineValue : RVal}
+    (found : baseline[index]? = some baselineValue) :
+    ∃ rewrittenValue,
+      rewritten[index]? = some rewrittenValue ∧
+        IxIR1.Sim.RValIso locRel baselineValue rewrittenValue := by
+  have listFound : baseline.toList[index]? = some baselineValue := by
+    simpa using found
+  obtain ⟨rewrittenValue, rewrittenFound, valueRelated⟩ :=
+    rvalsIso_getElem? related listFound
+  exact ⟨rewrittenValue, by simpa using rewrittenFound, valueRelated⟩
+
+private theorem rvalsIso_restrict_left {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List RVal} {removed : Nat}
+    (related : IxIR1.Sim.RValsIso locRel baseline rewritten)
+    (avoids : ∀ value ∈ baseline, value ≠ .loc removed) :
+    IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        locRel baselineLocation rewrittenLocation ∧
+          baselineLocation ≠ removed)
+      baseline rewritten := by
+  induction related with
+  | nil => exact .nil
+  | @cons baselineValue rewrittenValue baselineTail rewrittenTail head tail ih =>
+      have headAvoids : baselineValue ≠ .loc removed :=
+        avoids baselineValue (by simp)
+      have tailAvoids : ∀ value ∈ baselineTail, value ≠ .loc removed := by
+        intro value member
+        exact avoids value (by simp [member])
+      refine .cons ?_ (ih tailAvoids)
+      cases head with
+      | loc locationRelated =>
+          exact .loc ⟨locationRelated, by
+            intro same
+            apply headAvoids
+            cases same
+            rfl⟩
+      | lit => exact .lit
+      | erased => exact .erased
+
+private theorem rvalsIso_right_avoids_of_left
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore baselineStore)
+    {baselineRemoved rewrittenRemoved : Nat}
+    (removedRelated : iso.locRel rewrittenRemoved baselineRemoved)
+    {baseline rewritten : List RVal}
+    (related : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baseline rewritten)
+    (baselineAvoids : ∀ value ∈ baseline,
+      value ≠ .loc baselineRemoved) :
+    ∀ value ∈ rewritten, value ≠ .loc rewrittenRemoved := by
+  induction related with
+  | nil => simp
+  | @cons baselineValue rewrittenValue baselineTail rewrittenTail head tail ih =>
+      have headAvoids : baselineValue ≠ .loc baselineRemoved :=
+        baselineAvoids baselineValue (by simp)
+      have tailAvoids : ∀ value ∈ baselineTail,
+          value ≠ .loc baselineRemoved := by
+        intro value member
+        exact baselineAvoids value (by simp [member])
+      intro value member
+      simp only [List.mem_cons] at member
+      rcases member with rfl | member
+      · cases head with
+        | loc locationRelated =>
+            intro same
+            cases same
+            have baselineSame :=
+              iso.left_unique locationRelated removedRelated
+            apply headAvoids
+            cases baselineSame
+            rfl
+        | lit => intro impossible; cases impossible
+        | erased => intro impossible; cases impossible
+      · exact ih tailAvoids value member
+
+/-- Register `value` has a syntactic use in the current source block at or
+after `pc`.  `Liveness.blockUses` includes the terminator and all outgoing
+edge operands, so this also covers values needed by a future transfer. -/
+def ValueLiveFrom (source : Function) (blockId pc value : Nat) : Prop :=
+  ∃ block,
+    source.blocks[blockId]? = some block ∧
+      ∃ use ∈ Liveness.blockUses block,
+        use.value = value ∧ pc ≤ use.position
+
+/-- Every register operand of `atom` remains observable from this source
+coordinate.  Literals and erased operands require no register fact. -/
+def AtomLiveFrom (source : Function) (blockId pc : Nat) : Atom → Prop
+  | .reg value => ValueLiveFrom source blockId pc value
+  | .lit _ | .erased => True
+
+/-- Pointwise liveness for an operand vector. -/
+def AtomsLiveFrom (source : Function) (blockId pc : Nat)
+    (atoms : Array Atom) : Prop :=
+  ∀ atom ∈ atoms.toList, AtomLiveFrom source blockId pc atom
+
+namespace AtomLiveFrom
+
+/-- Liveness at a later source coordinate implies liveness at every earlier
+coordinate in the same block. -/
+theorem mono {source : Function} {blockId earlier later : Nat} {atom : Atom}
+    (live : AtomLiveFrom source blockId later atom)
+    (before : earlier ≤ later) :
+    AtomLiveFrom source blockId earlier atom := by
+  cases atom with
+  | reg value =>
+      obtain ⟨block, blockAt, use, member, valueEq, position⟩ := live
+      exact ⟨block, blockAt, use, member, valueEq,
+        Nat.le_trans before position⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- An instruction operand is live at that instruction's coordinate. -/
+theorem instruction {source : Function} {blockId position : Nat}
+    {block : Block} {instruction : Instr} {atom : Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (instructionAt : block.instructions[position]? = some instruction)
+    (operand : Liveness.InstrUsesAtom instruction atom) :
+    AtomLiveFrom source blockId position atom := by
+  cases atom with
+  | reg value =>
+      exact ⟨block, blockAt, ⟨value, position⟩,
+        Liveness.instruction_reg_mem_blockUses instructionAt operand rfl,
+        rfl, Nat.le_refl position⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- A direct terminator operand is live at the terminator coordinate. -/
+theorem terminator {source : Function} {blockId position : Nat}
+    {block : Block} {atom : Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (atTerminator : position = block.instructions.size)
+    (operand : Liveness.TerminatorUsesAtom block.terminator atom) :
+    AtomLiveFrom source blockId position atom := by
+  cases atom with
+  | reg value =>
+      exact ⟨block, blockAt, ⟨value, block.instructions.size⟩,
+        Liveness.terminator_reg_mem_blockUses operand rfl, rfl,
+        Nat.le_of_eq atTerminator⟩
+  | lit literal => trivial
+  | erased => trivial
+
+end AtomLiveFrom
+
+namespace AtomsLiveFrom
+
+/-- Pointwise operand liveness is monotone toward earlier coordinates. -/
+theorem mono {source : Function} {blockId earlier later : Nat}
+    {atoms : Array Atom}
+    (live : AtomsLiveFrom source blockId later atoms)
+    (before : earlier ≤ later) :
+    AtomsLiveFrom source blockId earlier atoms := by
+  intro atom member
+  exact (live atom member).mono before
+
+/-- Lift a proof that every vector element is an instruction operand into the
+live-vector predicate at that instruction's coordinate. -/
+theorem instruction {source : Function} {blockId position : Nat}
+    {block : Block} {instruction : Instr} {atoms : Array Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (instructionAt : block.instructions[position]? = some instruction)
+    (operands : ∀ atom ∈ atoms.toList,
+      Liveness.InstrUsesAtom instruction atom) :
+    AtomsLiveFrom source blockId position atoms := by
+  intro atom member
+  exact AtomLiveFrom.instruction blockAt instructionAt
+    (operands atom member)
+
+/-- Lift a proof that every edge atom is a terminator operand into the
+live-vector predicate at the terminator coordinate. -/
+theorem terminatorEdge {source : Function} {blockId position : Nat}
+    {block : Block} {edge : Edge}
+    (blockAt : source.blocks[blockId]? = some block)
+    (atTerminator : position = block.instructions.size)
+    (operands : ∀ atom ∈ edge.values.toList,
+      Liveness.TerminatorUsesAtom block.terminator atom) :
+    AtomsLiveFrom source blockId position edge.values := by
+  intro atom member
+  exact AtomLiveFrom.terminator blockAt atTerminator
+    (operands atom member)
+
+theorem call {source : Function} {blockId position : Nat}
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (bound : position < block.instructions.size)
+    (instruction : block.instructions[position] = .call address arguments) :
+    AtomsLiveFrom source blockId position arguments := by
+  intro atom member
+  have instructionAt : block.instructions[position]? =
+      some (.call address arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem bound
+  exact AtomLiveFrom.instruction blockAt instructionAt
+    (Liveness.InstrUsesAtom.call member)
+
+theorem callSelf {source : Function} {blockId position : Nat}
+    {block : Block} {arguments : Array Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (bound : position < block.instructions.size)
+    (instruction : block.instructions[position] = .callSelf arguments) :
+    AtomsLiveFrom source blockId position arguments := by
+  intro atom member
+  have instructionAt : block.instructions[position]? =
+      some (.callSelf arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem bound
+  exact AtomLiveFrom.instruction blockAt instructionAt
+    (Liveness.InstrUsesAtom.callSelf member)
+
+theorem tailCall {source : Function} {blockId position : Nat}
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (atTerminator : position = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments) :
+    AtomsLiveFrom source blockId position arguments := by
+  intro atom member
+  apply AtomLiveFrom.terminator blockAt atTerminator
+  rw [terminator]
+  exact Liveness.TerminatorUsesAtom.tailCall member
+
+theorem tailCallSelf {source : Function} {blockId position : Nat}
+    {block : Block} {arguments : Array Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (atTerminator : position = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf arguments) :
+    AtomsLiveFrom source blockId position arguments := by
+  intro atom member
+  apply AtomLiveFrom.terminator blockAt atTerminator
+  rw [terminator]
+  exact Liveness.TerminatorUsesAtom.tailCallSelf member
+
+end AtomsLiveFrom
+
+/-- A return operand is live at the terminator coordinate. -/
+theorem AtomLiveFrom.ret {source : Function} {blockId position : Nat}
+    {block : Block} {atom : Atom}
+    (blockAt : source.blocks[blockId]? = some block)
+    (atTerminator : position = block.instructions.size)
+    (terminator : block.terminator = .ret atom) :
+    AtomLiveFrom source blockId position atom := by
+  apply AtomLiveFrom.terminator blockAt atTerminator
+  rw [terminator]
+  exact Liveness.TerminatorUsesAtom.ret
+
+/-- Every register the accepted planner can observe is live when the
+recognized allocation executes. Allocation operands are used immediately;
+recursive-tail operands remain live through the block terminator. -/
+theorem plannerValueLiveAtAllocation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function} {blockId : Nat}
+    {block : Block} (site : Reuse.Site limits validation block)
+    (blockAt : source.blocks[blockId]? = some block) {sourceId : ValueId}
+    (relevant : PlannerValueRelevant site.shape sourceId) :
+    ValueLiveFrom source blockId (site.shape.releasePosition + 1) sourceId := by
+  rcases relevant with allocationMember | tailMember
+  · exact AtomLiveFrom.instruction blockAt site.fits.allocation
+      (Liveness.InstrUsesAtom.alloc allocationMember)
+  · have live : AtomLiveFrom source blockId block.instructions.size
+        (.reg sourceId) := by
+      apply AtomLiveFrom.terminator blockAt rfl
+      rw [site.fits.terminator]
+      exact Liveness.TerminatorUsesAtom.tailCallSelf tailMember
+    have allocationBound : site.shape.releasePosition + 1 <
+        block.instructions.size :=
+      (Array.getElem?_eq_some_iff.mp site.fits.allocation).1
+    exact live.mono (Nat.le_of_lt allocationBound)
+
+/-- Every register the accepted planner can observe is live at entry to the
+recognized source block. -/
+theorem plannerValueLiveAtEntry {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function} {blockId : Nat}
+    {block : Block} (site : Reuse.Site limits validation block)
+    (blockAt : source.blocks[blockId]? = some block) {sourceId : ValueId}
+    (relevant : PlannerValueRelevant site.shape sourceId) :
+    ValueLiveFrom source blockId 0 sourceId := by
+  have live : AtomLiveFrom source blockId (site.shape.releasePosition + 1)
+      (.reg sourceId) :=
+    plannerValueLiveAtAllocation site blockAt relevant
+  exact live.mono (Nat.zero_le _)
+
+private theorem fetch_operand_eq {target atom : Atom} {cid : CtorId}
+    {field : Nat}
+    (operand : Liveness.InstrUsesAtom (.fetch target cid field) atom) :
+    atom = target := by
+  cases operand
+  rfl
+
+private theorem retainShared_operand_eq {target atom : Atom}
+    (operand : Liveness.InstrUsesAtom (.retainShared target) atom) :
+    atom = target := by
+  cases operand
+  rfl
+
+private theorem releaseShared_operand_eq {target atom : Atom}
+    (operand : Liveness.InstrUsesAtom (.releaseShared target) atom) :
+    atom = target := by
+  cases operand
+  rfl
+
+/-- Every accepted-block parameter that is live at entry is either the
+distinguished reset source or an allocation/tail operand visible to the
+planner.  Retained fetched fields use append-only result registers, so they
+cannot alias an inherited parameter slot. -/
+theorem Reuse.Site.entryLiveParameterCases {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function} {blockId : Nat}
+    {block : Block} (site : Reuse.Site limits validation block)
+    (blockAt : source.blocks[blockId]? = some block)
+    {index : Nat}
+    (live : ValueLiveFrom source blockId 0 index)
+    (bound : index < site.shape.parameterCount) :
+    index = site.shape.source ∨ PlannerValueRelevant site.shape index := by
+  obtain ⟨actualBlock, actualAt, use, member, valueEq, _position⟩ := live
+  have blockEq : actualBlock = block :=
+    Option.some.inj (actualAt.symm.trans blockAt)
+  subst actualBlock
+  have useValue : use.value = index := valueEq
+  cases Liveness.mem_blockUses member with
+  | inl instructionUse =>
+      obtain ⟨instruction, instructionAt, operand⟩ := instructionUse
+      rcases site.instructionCases instructionAt with
+        ⟨field, fieldBound, instructionEq⟩ |
+        ⟨field, fieldBound, instructionEq⟩ | instructionEq | instructionEq
+      · rw [instructionEq] at operand
+        have atomEq := fetch_operand_eq operand
+        left
+        simpa [useValue] using atomEq
+      · rw [instructionEq] at operand
+        have atomEq := retainShared_operand_eq operand
+        have indexEq : index = site.shape.parameterCount + field := by
+          simpa [useValue] using atomEq
+        omega
+      · rw [instructionEq] at operand
+        have atomEq := releaseShared_operand_eq operand
+        left
+        simpa [useValue] using atomEq
+      · rw [instructionEq] at operand
+        cases operand with
+        | alloc atomMember =>
+            right
+            left
+            have atomEq : (Atom.reg index) = .reg use.value := by
+              simp [useValue]
+            simpa [atomEq] using atomMember
+  | inr terminatorUse =>
+      obtain ⟨_positionEq, operand⟩ := terminatorUse
+      rw [site.fits.terminator] at operand
+      cases operand with
+      | tailCallSelf atomMember =>
+          right
+          right
+          simpa [useValue] using atomMember
+
+/-- An inherited register used at accepted-block entry remains observable
+until the parent release. Fetches only inspect the parent, and every other
+inherited use belongs to the later allocation or tail call. -/
+theorem Reuse.Site.entryLiveParameterBeforeRelease {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function} {blockId : Nat}
+    {block : Block} (site : Reuse.Site limits validation block)
+    (blockAt : source.blocks[blockId]? = some block)
+    {index pc : Nat}
+    (live : ValueLiveFrom source blockId 0 index)
+    (bound : index < site.shape.parameterCount)
+    (beforeRelease : pc ≤ site.shape.releasePosition) :
+    ValueLiveFrom source blockId pc index := by
+  rcases Reuse.Site.entryLiveParameterCases site blockAt live bound with
+    sourceEq | relevant
+  · subst index
+    exact (AtomLiveFrom.instruction blockAt site.fits.release
+      Liveness.InstrUsesAtom.releaseShared).mono beforeRelease
+  · exact (show AtomLiveFrom source blockId (site.shape.releasePosition + 1)
+        (.reg index) from plannerValueLiveAtAllocation site blockAt relevant).mono
+      (by omega)
+
+/-- A constructor prologue inside an accepted block cannot extend into the
+recognized retain batch. -/
+theorem Reuse.Site.fetchPrologueBound {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block)
+    {atom : Atom} {cid : CtorId} {count : Nat}
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid count =
+      true) :
+    count ≤ site.shape.fieldCount := by
+  by_cases bound : count ≤ site.shape.fieldCount
+  · exact bound
+  · have fetchAt := Lower.fetchPrologueAt_of_match prologue
+      (show site.shape.fieldCount < count by omega)
+    have retainAt := site.fits.retains 0 site.fits.fieldCountPositive
+    simp only [Nat.add_zero] at retainAt
+    have impossible := Option.some.inj (fetchAt.symm.trans retainAt)
+    cases impossible
+
+/-- A nonempty constructor prologue in an accepted block identifies exactly
+its reset source operand and full constructor identity. -/
+theorem Reuse.Site.fetchPrologueHead {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block)
+    {atom : Atom} {cid : CtorId} {count : Nat}
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid count =
+      true)
+    (positive : 0 < count) :
+    atom = .reg site.shape.source ∧ cid = site.shape.sourceConstructor := by
+  have fetchAt := Lower.fetchPrologueAt_of_match prologue positive
+  have expected := site.fits.fetches 0 site.fits.fieldCountPositive
+  have same := Option.some.inj (fetchAt.symm.trans expected)
+  simpa only [Instr.fetch.injEq, and_true] using same
+
+/-- Pointwise location agreement restricted to values that can still be
+observed by the source frame.  Array length remains structural: both
+executions retain the same append-only register numbering even when dead
+payloads no longer agree. -/
+structure LiveValuesIso (source : Function) (blockId pc : Nat)
+    (locRel : Nat → Nat → Prop) (baseline rewritten : Array RVal) : Prop where
+  length : baseline.size = rewritten.size
+  related : ∀ {index : Nat} {baselineValue : RVal},
+    ValueLiveFrom source blockId pc index →
+    baseline[index]? = some baselineValue →
+    ∃ rewrittenValue,
+      rewritten[index]? = some rewrittenValue ∧
+        IxIR1.Sim.RValIso locRel baselineValue rewrittenValue
+
+namespace LiveValuesIso
+
+private theorem rvals_getElem? {locRel : Nat → Nat → Prop} :
+    ∀ {baseline rewritten : List RVal},
+      IxIR1.Sim.RValsIso locRel baseline rewritten →
+      ∀ {index : Nat} {baselineValue : RVal},
+        baseline[index]? = some baselineValue →
+        ∃ rewrittenValue,
+          rewritten[index]? = some rewrittenValue ∧
+            IxIR1.Sim.RValIso locRel baselineValue rewrittenValue
+  | _, _, .nil, index, baselineValue, found => by simp at found
+  | _, _, .cons head tail, 0, baselineValue, found => by
+      simp only [List.getElem?_cons_zero, Option.some.injEq] at found
+      subst baselineValue
+      exact ⟨_, rfl, head⟩
+  | _, _, .cons head tail, index + 1, baselineValue, found => by
+      simp only [List.getElem?_cons_succ] at found
+      exact rvals_getElem? tail found
+
+/-- The original all-register relation is a strengthening of live-register
+agreement. -/
+theorem ofRValsIso {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Array RVal}
+    (values : IxIR1.Sim.RValsIso locRel baseline.toList rewritten.toList) :
+    LiveValuesIso source blockId pc locRel baseline rewritten := by
+  refine ⟨?_, ?_⟩
+  · simpa using values.lengths
+  · intro index baselineValue _live found
+    have listFound : baseline.toList[index]? = some baselineValue := by
+      simpa using found
+    obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+      rvals_getElem? values listFound
+    exact ⟨rewrittenValue, by simpa using rewrittenAt, related⟩
+
+/-- Future liveness is monotone when a frame advances. -/
+theorem advance {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc locRel baseline rewritten) :
+    LiveValuesIso source blockId (pc + 1) locRel baseline rewritten := by
+  refine ⟨values.length, ?_⟩
+  intro index baselineValue live found
+  apply values.related ?_ found
+  obtain ⟨block, blockAt, use, member, valueEq, position⟩ := live
+  exact ⟨block, blockAt, use, member, valueEq, Nat.le_trans
+    (Nat.le_add_right pc 1) position⟩
+
+/-- Widening the location relation preserves live-register agreement. -/
+theorem mono {source : Function} {blockId pc : Nat}
+    {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    LiveValuesIso source blockId pc newRel baseline rewritten := by
+  refine ⟨values.length, ?_⟩
+  intro index baselineValue live found
+  obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+    values.related live found
+  exact ⟨rewrittenValue, rewrittenAt, related.mono lift⟩
+
+private theorem rvalsIso_append_one {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List RVal}
+    (values : IxIR1.Sim.RValsIso locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    IxIR1.Sim.RValsIso locRel
+      (baseline ++ [baselineValue]) (rewritten ++ [rewrittenValue]) := by
+  induction values with
+  | nil => exact .cons value .nil
+  | cons head tail ih => exact .cons head ih
+
+/-- Appending a related value preserves live-register agreement.  The new
+slot may itself be live; every prior slot uses the original relation. -/
+theorem push {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    LiveValuesIso source blockId pc locRel
+      (baseline.push baselineValue) (rewritten.push rewrittenValue) := by
+  refine ⟨by simp [values.length], ?_⟩
+  intro index foundValue live found
+  rw [Array.getElem?_push] at found
+  by_cases last : index = baseline.size
+  · rw [if_pos last] at found
+    cases Option.some.inj found
+    refine ⟨rewrittenValue, ?_, value⟩
+    rw [Array.getElem?_push, if_pos (last.trans values.length)]
+  · rw [if_neg last] at found
+    obtain ⟨targetValue, targetAt, related⟩ :=
+      values.related live found
+    have targetNotLast : index ≠ rewritten.size := by
+      simpa [values.length] using last
+    refine ⟨targetValue, ?_, related⟩
+    simpa [Array.getElem?_push, targetNotLast] using targetAt
+
+/-- Appending pointwise-related suffixes preserves live-register agreement. -/
+theorem append {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc locRel baseline rewritten)
+    {baselineSuffix rewrittenSuffix : Array RVal}
+    (suffix : IxIR1.Sim.RValsIso locRel
+      baselineSuffix.toList rewrittenSuffix.toList) :
+    LiveValuesIso source blockId pc locRel
+      (baseline ++ baselineSuffix) (rewritten ++ rewrittenSuffix) := by
+  have suffixLength : baselineSuffix.size = rewrittenSuffix.size := by
+    simpa using suffix.lengths
+  refine ⟨by simp [values.length, suffixLength], ?_⟩
+  intro index baselineValue live found
+  rw [Array.getElem?_append] at found
+  by_cases inPrefix : index < baseline.size
+  · rw [if_pos inPrefix] at found
+    obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+      values.related live found
+    have targetPrefix : index < rewritten.size := by
+      simpa [values.length] using inPrefix
+    refine ⟨rewrittenValue, ?_, related⟩
+    simpa [Array.getElem?_append, targetPrefix] using rewrittenAt
+  · rw [if_neg inPrefix] at found
+    have listFound : baselineSuffix.toList[index - baseline.size]? =
+        some baselineValue := by
+      simpa using found
+    obtain ⟨rewrittenValue, rewrittenListAt, related⟩ :=
+      suffix.get? listFound
+    have targetPrefix : ¬index < rewritten.size := by
+      simpa [values.length] using inPrefix
+    have rewrittenAt : rewrittenSuffix[index - rewritten.size]? =
+        some rewrittenValue := by
+      simpa [values.length] using rewrittenListAt
+    refine ⟨rewrittenValue, ?_, related⟩
+    simpa [Array.getElem?_append, targetPrefix] using rewrittenAt
+
+/-- Resolve a live operand in two liveness-related register files. -/
+theorem resolveAtom {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc locRel baseline rewritten)
+    {atom : Atom} (live : AtomLiveFrom source blockId pc atom)
+    {baselineValue : RVal}
+    (resolved : Eval.resolveAtom baseline atom = .ok baselineValue) :
+    ∃ rewrittenValue,
+      Eval.resolveAtom rewritten atom = .ok rewrittenValue ∧
+        IxIR1.Sim.RValIso locRel baselineValue rewrittenValue := by
+  cases atom with
+  | reg index =>
+      cases found : baseline[index]? with
+      | none => simp [Eval.resolveAtom, found] at resolved
+      | some actual =>
+          simp [Eval.resolveAtom, found] at resolved
+          subst actual
+          obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+            values.related live found
+          exact ⟨rewrittenValue,
+            by simp [Eval.resolveAtom, rewrittenAt], related⟩
+  | lit literal =>
+      simp [Eval.resolveAtom] at resolved
+      subst baselineValue
+      exact ⟨.lit literal, by simp [Eval.resolveAtom], .lit⟩
+  | erased =>
+      simp [Eval.resolveAtom] at resolved
+      subst baselineValue
+      exact ⟨.erased, by simp [Eval.resolveAtom], .erased⟩
+
+private theorem resolveList {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc locRel baseline rewritten) :
+    ∀ {atoms : List Atom},
+      (∀ atom ∈ atoms, AtomLiveFrom source blockId pc atom) →
+      ∀ {baselineInitial baselineResult : Array RVal},
+        atoms.foldlM (fun output atom => do
+            return output.push (← Eval.resolveAtom baseline atom))
+            baselineInitial = .ok baselineResult →
+        ∀ {rewrittenInitial : Array RVal},
+          IxIR1.Sim.RValsIso locRel baselineInitial.toList
+            rewrittenInitial.toList →
+          ∃ rewrittenResult,
+            atoms.foldlM (fun output atom => do
+                return output.push (← Eval.resolveAtom rewritten atom))
+                rewrittenInitial = .ok rewrittenResult ∧
+              IxIR1.Sim.RValsIso locRel baselineResult.toList
+                rewrittenResult.toList := by
+  intro atoms live
+  induction atoms with
+  | nil =>
+      intro baselineInitial baselineResult resolved rewrittenInitial related
+      change (Except.ok baselineInitial : Except Eval.Error (Array RVal)) =
+        .ok baselineResult at resolved
+      cases Except.ok.inj resolved
+      exact ⟨rewrittenInitial, rfl, related⟩
+  | cons atom atoms ih =>
+      intro baselineInitial baselineResult resolved rewrittenInitial related
+      rw [List.foldlM_cons] at resolved
+      cases baselineResolved : Eval.resolveAtom baseline atom with
+      | error error =>
+          simp only [baselineResolved, bind, Except.bind] at resolved
+          cases resolved
+      | ok baselineValue =>
+          simp only [baselineResolved, bind, Except.bind] at resolved
+          obtain ⟨rewrittenValue, rewrittenResolved, valueRelated⟩ :=
+            values.resolveAtom (live atom (by simp)) baselineResolved
+          have tailLive : ∀ tailAtom ∈ atoms,
+              AtomLiveFrom source blockId pc tailAtom := by
+            intro tailAtom member
+            exact live tailAtom (by simp [member])
+          have pushedRelated : IxIR1.Sim.RValsIso locRel
+              (baselineInitial.push baselineValue).toList
+              (rewrittenInitial.push rewrittenValue).toList := by
+            simpa using rvalsIso_append_one related valueRelated
+          obtain ⟨rewrittenResult, rewrittenRun, resultRelated⟩ :=
+            ih tailLive resolved pushedRelated
+          refine ⟨rewrittenResult, ?_, resultRelated⟩
+          rw [List.foldlM_cons, rewrittenResolved]
+          exact rewrittenRun
+
+/-- Resolve a vector whose register operands are live at the current source
+coordinate. -/
+theorem resolveAtoms {source : Function} {blockId pc : Nat}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineValues : Array RVal}
+    (values : LiveValuesIso source blockId pc locRel baseline rewritten)
+    {atoms : Array Atom} (live : AtomsLiveFrom source blockId pc atoms)
+    (resolved : Eval.resolveAtoms baseline atoms = .ok baselineValues) :
+    ∃ rewrittenValues,
+      Eval.resolveAtoms rewritten atoms = .ok rewrittenValues ∧
+        IxIR1.Sim.RValsIso locRel baselineValues.toList
+          rewrittenValues.toList := by
+  unfold Eval.resolveAtoms at resolved ⊢
+  rw [← Array.foldlM_toList]
+  apply resolveList values live
+    (by simpa only [Array.foldlM_toList] using resolved)
+  exact .nil
+
+end LiveValuesIso
+
+namespace MappedValuesInRoots
+
+theorem mono {shape : Reuse.Shape} {values : Array RVal}
+    {before after : List IxIR1.Sim.Root}
+    (mapped : MappedValuesInRoots shape values before)
+    (subset : ∀ root ∈ before, root ∈ after) :
+    MappedValuesInRoots shape values after := by
+  intro sourceId targetId sourceValue relevant translated found
+  have supported := mapped sourceId targetId sourceValue relevant translated
+    found
+  cases sourceValue with
+  | loc location =>
+      obtain ⟨world, member⟩ := supported
+      exact ⟨world, subset _ member⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- Planner root support pulls back through a target-to-baseline heap
+isomorphism when the planner-observable register file is live-related. -/
+theorem preimage {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function} {blockId : Nat} {block : Block}
+    (site : Reuse.Site limits validation block)
+    (blockAt : source.blocks[blockId]? = some block)
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore baselineStore)
+    {baselineValues rewrittenValues : Array RVal}
+    (values : LiveValuesIso source blockId 0
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baselineValues rewrittenValues)
+    {baselineRoots rewrittenRoots : List IxIR1.Sim.Root}
+    (roots : IxIR1.Sim.RootsIso iso.locRel rewrittenRoots baselineRoots)
+    (mapped : MappedValuesInRoots site.shape baselineValues baselineRoots) :
+    MappedValuesInRoots site.shape rewrittenValues rewrittenRoots := by
+  intro sourceId targetId rewrittenValue relevant translated rewrittenAt
+  have rewrittenBound : sourceId < rewrittenValues.size :=
+    (Array.getElem?_eq_some_iff.mp rewrittenAt).1
+  have baselineBound : sourceId < baselineValues.size := by
+    rw [values.length]
+    exact rewrittenBound
+  obtain ⟨baselineValue, baselineAt⟩ :
+      ∃ baselineValue, baselineValues[sourceId]? = some baselineValue :=
+    ⟨baselineValues[sourceId], by simp⟩
+  obtain ⟨actualRewritten, actualRewrittenAt, related⟩ :=
+    values.related (plannerValueLiveAtEntry site blockAt relevant) baselineAt
+  have rewrittenEq : actualRewritten = rewrittenValue :=
+    Option.some.inj (actualRewrittenAt.symm.trans rewrittenAt)
+  subst actualRewritten
+  have baselineSupported := mapped sourceId targetId baselineValue relevant
+    translated baselineAt
+  cases baselineValue with
+  | loc baselineLocation =>
+      obtain ⟨baselineWorld, baselineMember⟩ := baselineSupported
+      obtain ⟨rewrittenRoot, rewrittenMember, rootRelated⟩ :=
+        roots.left_of_right_mem baselineMember
+      rcases rewrittenRoot with ⟨rewrittenWorld, rewrittenRootValue⟩
+      cases rootRelated.value with
+      | loc rootLocationRelated =>
+          cases related with
+          | loc valueLocationRelated =>
+              have locationEq :=
+                iso.right_unique rootLocationRelated valueLocationRelated
+              subst_vars
+              exact ⟨rewrittenWorld, rewrittenMember⟩
+  | lit literal => cases related; trivial
+  | erased => cases related; trivial
+
+end MappedValuesInRoots
+
+/-- Only source-live registers in a rewritten frame must avoid an address
+whose allocation epoch is about to be replaced. -/
+def LiveValuesAvoidLocation (source : Function) (blockId pc location : Nat)
+    (values : Array RVal) : Prop :=
+  ∀ {index : Nat} {value : RVal},
+    ValueLiveFrom source blockId pc index →
+    values[index]? = some value →
+    value ≠ .loc location
+
+/-- A source frame and its rewritten counterpart agree at the same stable
+control coordinate, but only future-observable value registers are related.
+Credits remain fully related because their presence is checked at every call,
+return, and CFG transfer boundary. -/
+structure StableLiveFrameIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    (locRel : Nat → Nat → Prop) (baseline rewritten : Frame) : Prop where
+  baselineDefinition : baseline.definition = source
+  rewrittenDefinition : rewritten.definition = rewrite.definition
+  block : baseline.block = rewritten.block
+  pc : baseline.pc = rewritten.pc
+  values : LiveValuesIso source baseline.block baseline.pc locRel
+    baseline.values rewritten.values
+  credits : StableCreditsIso locRel
+    baseline.credits.toList rewritten.credits.toList
+
+namespace StableLiveFrameIso
+
+/-- Entry frames retain the stronger pointwise relation supplied by argument
+resolution. -/
+theorem entry {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop}
+    {baselineValues rewrittenValues : Array RVal}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList) :
+    StableLiveFrameIso rewrite locRel
+      { definition := source, values := baselineValues }
+      { definition := rewrite.definition, values := rewrittenValues } := by
+  exact ⟨rfl, rfl, rfl, rfl, LiveValuesIso.ofRValsIso values, .nil⟩
+
+/-- Every old stable frame is also a live-indexed stable frame. -/
+theorem ofStable {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten) :
+    StableLiveFrameIso rewrite locRel baseline rewritten :=
+  ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block, frame.pc,
+    LiveValuesIso.ofRValsIso frame.values, frame.credits⟩
+
+/-- Suspending an advanced caller preserves every value that can still be
+read when that caller resumes. -/
+theorem advance {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten) :
+    StableLiveFrameIso rewrite locRel
+      { baseline with pc := baseline.pc + 1 }
+      { rewritten with pc := rewritten.pc + 1 } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    congrArg (fun pc => pc + 1) frame.pc, ?_, frame.credits⟩
+  simpa using frame.values.advance
+
+/-- Advancing a frame and appending a related result preserves the
+live-indexed relation. -/
+theorem advancePush {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    StableLiveFrameIso rewrite locRel
+      { baseline with
+        pc := baseline.pc + 1
+        values := baseline.values.push baselineValue }
+      { rewritten with
+        pc := rewritten.pc + 1
+        values := rewritten.values.push rewrittenValue } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    congrArg (fun pc => pc + 1) frame.pc, ?_, frame.credits⟩
+  simpa using frame.values.advance.push value
+
+/-- Appending a related return result at an already-advanced caller
+coordinate preserves live-register agreement. -/
+theorem push {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    StableLiveFrameIso rewrite locRel
+      { baseline with values := baseline.values.push baselineValue }
+      { rewritten with values := rewritten.values.push rewrittenValue } := by
+  exact ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    frame.pc, frame.values.push value, frame.credits⟩
+
+/-- A successful current-block lookup dispatches through the retained rewrite
+decision even though dead value slots are not related. -/
+theorem blockCase {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {block : Block}
+    (found : baseline.definition.blocks[baseline.block]? = some block) :
+    Reuse.FunctionRewrite.BlockCase rewrite baseline.block := by
+  have sourceAt : source.blocks[baseline.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact found
+  exact rewrite.blockCaseOfLookup sourceAt
+
+/-- Widening the heap-location relation preserves a live-indexed frame. -/
+theorem mono {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {oldRel newRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveFrameIso rewrite newRel baseline rewritten :=
+  ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block, frame.pc,
+    frame.values.mono lift, frame.credits.mono lift⟩
+
+/-- Credit lookup is unchanged: credit slots remain related pointwise. -/
+theorem creditLookup {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {id : CreditId} {baselineCredit : Credit}
+    (lookedUp : CreditLookup baseline id baselineCredit) :
+    ∃ rewrittenCredit,
+      CreditLookup rewritten id rewrittenCredit ∧
+        StableCreditIso locRel (some baselineCredit)
+          (some rewrittenCredit) := by
+  have baselineFound : baseline.credits[id]? = some (some baselineCredit) :=
+    (CreditTake.of_lookup lookedUp).target_eq.2
+  have baselineListFound : baseline.credits.toList[id]? =
+      some (some baselineCredit) := by
+    simpa using baselineFound
+  obtain ⟨rewrittenSlot, rewrittenListFound, related⟩ :=
+    frame.credits.get? baselineListFound
+  cases rewrittenSlot with
+  | none => cases related
+  | some rewrittenCredit =>
+      have rewrittenFound : rewritten.credits[id]? =
+          some (some rewrittenCredit) := by
+        simpa using rewrittenListFound
+      exact ⟨rewrittenCredit, CreditLookup.of_getElem rewrittenFound, related⟩
+
+/-- No-live-credit checks transport independently of dead value slots. -/
+theorem noLiveCredits {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    (cleared : NoLiveCredits baseline) : NoLiveCredits rewritten := by
+  unfold NoLiveCredits at cleared ⊢
+  rw [← Array.any_toList] at cleared ⊢
+  rw [← frame.credits.any_isSome_eq]
+  exact cleared
+
+/-- Consume corresponding credit slots without changing the live value
+coordinate. -/
+theorem takeIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineNext : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {id : CreditId} {baselineCredit : Credit}
+    (taken : CreditTake baseline id baselineNext baselineCredit) :
+    ∃ rewrittenNext rewrittenCredit,
+      CreditTake rewritten id rewrittenNext rewrittenCredit ∧
+        StableCreditIso locRel (some baselineCredit)
+          (some rewrittenCredit) ∧
+        StableLiveFrameIso rewrite locRel baselineNext rewrittenNext := by
+  obtain ⟨baselineNextEq, baselineFound⟩ := taken.target_eq
+  have baselineLookup : CreditLookup baseline id baselineCredit :=
+    CreditLookup.of_getElem baselineFound
+  obtain ⟨rewrittenCredit, rewrittenLookup, creditRelated⟩ :=
+    frame.creditLookup baselineLookup
+  let rewrittenNext : Frame :=
+    { rewritten with
+      credits := rewritten.credits.setIfInBounds id none }
+  have rewrittenTaken : CreditTake rewritten id rewrittenNext
+      rewrittenCredit := CreditTake.of_lookup rewrittenLookup
+  refine ⟨rewrittenNext, rewrittenCredit, rewrittenTaken, creditRelated, ?_⟩
+  subst baselineNext
+  exact ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    frame.pc, frame.values, frame.credits.array_set_none id⟩
+
+/-- Batch credit consumption is equivariant under a live-indexed frame
+relation because credit files remain pointwise related. -/
+theorem takeManyIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineNext : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {ids : Array CreditId} {baselineCredits : Array Credit}
+    (taken : CreditTakeMany baseline ids baselineNext baselineCredits) :
+    ∃ rewrittenNext rewrittenCredits,
+      CreditTakeMany rewritten ids rewrittenNext rewrittenCredits ∧
+        StableCreditsIso locRel
+          (baselineCredits.map some).toList
+          (rewrittenCredits.map some).toList ∧
+        StableLiveFrameIso rewrite locRel baselineNext rewrittenNext := by
+  have follow : ∀ {baselineCurrent : Frame} {remaining : List CreditId}
+      {baselineTarget : Frame} {baselineOutput : List Credit},
+      CreditTakeSequence baselineCurrent remaining baselineTarget
+          baselineOutput →
+      ∀ {rewrittenCurrent : Frame},
+        StableLiveFrameIso rewrite locRel baselineCurrent rewrittenCurrent →
+        ∃ rewrittenTarget rewrittenOutput,
+          CreditTakeSequence rewrittenCurrent remaining rewrittenTarget
+              rewrittenOutput ∧
+            StableCreditsIso locRel (baselineOutput.map some)
+              (rewrittenOutput.map some) ∧
+            StableLiveFrameIso rewrite locRel baselineTarget
+              rewrittenTarget := by
+    intro baselineCurrent remaining baselineTarget baselineOutput sequence
+    induction sequence with
+    | nil current =>
+        intro rewrittenCurrent related
+        exact ⟨rewrittenCurrent, [], .nil rewrittenCurrent, .nil, related⟩
+    | @cons current middle target id remaining credit credits head tail ih =>
+        intro rewrittenCurrent related
+        obtain ⟨rewrittenMiddle, rewrittenCredit, rewrittenHead,
+            creditRelated, middleRelated⟩ := related.takeIso head
+        obtain ⟨rewrittenTarget, rewrittenCredits, rewrittenTail,
+            creditsRelated, targetRelated⟩ := ih middleRelated
+        exact ⟨rewrittenTarget, rewrittenCredit :: rewrittenCredits,
+          .cons rewrittenHead rewrittenTail,
+          .cons creditRelated creditsRelated, targetRelated⟩
+  obtain ⟨rewrittenNext, rewrittenOutput, rewrittenSequence,
+      outputRelated, nextRelated⟩ := follow taken.sequence frame
+  let rewrittenCredits : Array Credit := rewrittenOutput.toArray
+  have rewrittenTaken : CreditTakeMany rewritten ids rewrittenNext
+      rewrittenCredits := by
+    simpa [rewrittenCredits] using rewrittenSequence.toMany
+  refine ⟨rewrittenNext, rewrittenCredits, rewrittenTaken, ?_, nextRelated⟩
+  simpa [rewrittenCredits] using outputRelated
+
+/-- Consume corresponding credit slots after advancing the instruction
+coordinate. -/
+theorem advanceTakeIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineNext : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {id : CreditId} {baselineCredit : Credit}
+    (taken : CreditTake { baseline with pc := baseline.pc + 1 }
+      id baselineNext baselineCredit) :
+    ∃ rewrittenNext rewrittenCredit,
+      CreditTake { rewritten with pc := rewritten.pc + 1 }
+          id rewrittenNext rewrittenCredit ∧
+        StableCreditIso locRel (some baselineCredit)
+          (some rewrittenCredit) ∧
+        StableLiveFrameIso rewrite locRel baselineNext rewrittenNext := by
+  obtain ⟨baselineNextEq, baselineFound⟩ := taken.target_eq
+  have baselineLookup : CreditLookup baseline id baselineCredit :=
+    CreditLookup.of_getElem baselineFound
+  obtain ⟨rewrittenCredit, rewrittenLookup, creditRelated⟩ :=
+    frame.creditLookup baselineLookup
+  let rewrittenNext : Frame :=
+    { rewritten with
+      pc := rewritten.pc + 1
+      credits := rewritten.credits.setIfInBounds id none }
+  have rewrittenTaken : CreditTake
+      { rewritten with pc := rewritten.pc + 1 }
+      id rewrittenNext rewrittenCredit := by
+    exact CreditTake.of_lookup (rewrittenLookup.congrDefinition
+      rewritten.definition)
+  refine ⟨rewrittenNext, rewrittenCredit, rewrittenTaken, creditRelated, ?_⟩
+  subst baselineNext
+  exact ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    congrArg (fun pc => pc + 1) frame.pc, frame.values.advance,
+    frame.credits.array_set_none id⟩
+
+/-- Advance while appending related field vectors and one related credit. -/
+theorem advanceAppendCreditIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {baselineFields rewrittenFields : Array RVal}
+    (fields : IxIR1.Sim.RValsIso locRel
+      baselineFields.toList rewrittenFields.toList)
+    {baselineCredit rewrittenCredit : Credit}
+    (credit : StableCreditIso locRel (some baselineCredit)
+      (some rewrittenCredit)) :
+    StableLiveFrameIso rewrite locRel
+      { baseline with
+        pc := baseline.pc + 1
+        values := baseline.values ++ baselineFields
+        credits := baseline.credits.push (some baselineCredit) }
+      { rewritten with
+        pc := rewritten.pc + 1
+        values := rewritten.values ++ rewrittenFields
+        credits := rewritten.credits.push (some rewrittenCredit) } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    congrArg (fun pc => pc + 1) frame.pc, ?_, ?_⟩
+  · simpa using frame.values.advance.append fields
+  · simpa using frame.credits.append (.cons credit .nil)
+
+/-- A checked edge transfer resolves only the edge operands, consumes the
+fully related credit vector, and enters a target frame whose fresh ABI is
+pointwise related. -/
+theorem edgeTransferIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineTarget : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    {edge : Edge}
+    (edgeLive : AtomsLiveFrom source baseline.block baseline.pc edge.values)
+    {baselineImplicit rewrittenImplicit : Array RVal}
+    (implicitValues : IxIR1.Sim.RValsIso locRel
+      baselineImplicit.toList rewrittenImplicit.toList)
+    (transferred : EdgeTransfer baseline edge baselineImplicit
+      baselineTarget) :
+    ∃ rewrittenTarget,
+      EdgeTransfer rewritten edge rewrittenImplicit rewrittenTarget ∧
+        StableLiveFrameIso rewrite locRel baselineTarget rewrittenTarget := by
+  obtain ⟨baselineValues, baselineCredits, baselineAfter, sourceBlock,
+      baselineResolved, baselineTaken, baselineCleared, sourceBlockAt,
+      baselineValueArity, baselineCreditArity, baselineTargetEq⟩ :=
+    transferred.parts
+  obtain ⟨rewrittenValues, rewrittenResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms edgeLive baselineResolved
+  obtain ⟨rewrittenAfter, rewrittenCredits, rewrittenTaken,
+      creditsRelated, afterRelated⟩ := frame.takeManyIso baselineTaken
+  have rewrittenCleared : NoLiveCredits rewrittenAfter :=
+    afterRelated.noLiveCredits baselineCleared
+  have sourceBlockAt' : source.blocks[edge.target]? = some sourceBlock := by
+    rw [← afterRelated.baselineDefinition]
+    exact sourceBlockAt
+  obtain ⟨rewrittenBlock, rewrittenBlockAt, valueParams, creditParams⟩ :=
+    rewrite.targetBlockAbi sourceBlockAt'
+  have rewrittenBlockAt' :
+      rewrittenAfter.definition.blocks[edge.target]? =
+        some rewrittenBlock := by
+    rw [afterRelated.rewrittenDefinition]
+    exact rewrittenBlockAt
+  have allValuesRelated : IxIR1.Sim.RValsIso locRel
+      (baselineImplicit ++ baselineValues).toList
+      (rewrittenImplicit ++ rewrittenValues).toList := by
+    simpa using implicitValues.append valuesRelated
+  have valueSizes : (baselineImplicit ++ baselineValues).size =
+      (rewrittenImplicit ++ rewrittenValues).size := by
+    simpa using allValuesRelated.lengths
+  have rewrittenValueArity :
+      (rewrittenImplicit ++ rewrittenValues).size =
+        rewrittenBlock.valueParams.size :=
+    valueSizes.symm.trans <| baselineValueArity.trans <|
+      (congrArg Array.size valueParams).symm
+  have creditSizes : baselineCredits.size = rewrittenCredits.size := by
+    simpa using creditsRelated.length_eq
+  have rewrittenCreditArity : rewrittenCredits.size =
+      rewrittenBlock.creditParams.size :=
+    creditSizes.symm.trans <| baselineCreditArity.trans <|
+      (congrArg Array.size creditParams).symm
+  let rewrittenTarget : Frame :=
+    { rewrittenAfter with
+      block := edge.target
+      pc := 0
+      values := rewrittenImplicit ++ rewrittenValues
+      credits := rewrittenCredits.map some }
+  have rewrittenTransferred : EdgeTransfer rewritten edge rewrittenImplicit
+      rewrittenTarget := by
+    exact EdgeTransfer.of_parts rewrittenResolved rewrittenTaken
+      rewrittenCleared rewrittenBlockAt' rewrittenValueArity
+      rewrittenCreditArity
+  refine ⟨rewrittenTarget, rewrittenTransferred, ?_⟩
+  subst baselineTarget
+  exact ⟨afterRelated.baselineDefinition, afterRelated.rewrittenDefinition,
+    rfl, rfl, LiveValuesIso.ofRValsIso allValuesRelated, creditsRelated⟩
+
+/-- Replace a heap-location relation while preserving only the live register
+pairs.  Dead append-only slots may still contain the reused address and impose
+no premise. -/
+theorem transportRelation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite oldRel baseline rewritten)
+    (avoids : LiveValuesAvoidLocation source rewritten.block rewritten.pc
+      removed rewritten.values)
+    (creditsAvoid : FrameCreditsAvoidLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveFrameIso rewrite newRel baseline rewritten := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    frame.pc, ⟨frame.values.length, ?_⟩,
+    frame.credits.transportRelation creditsAvoid lift⟩
+  intro index baselineValue live found
+  obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+    frame.values.related live found
+  have targetLive : ValueLiveFrom source rewritten.block rewritten.pc index := by
+    simpa [frame.block, frame.pc] using live
+  have targetAvoid : rewrittenValue ≠ .loc removed :=
+    avoids targetLive rewrittenAt
+  refine ⟨rewrittenValue, rewrittenAt, ?_⟩
+  cases related with
+  | loc locationRelated =>
+      exact .loc (lift locationRelated (by
+        intro same
+        apply targetAvoid
+        cases same
+        rfl))
+  | lit => exact .lit
+  | erased => exact .erased
+
+end StableLiveFrameIso
+
+/-- Existential function selection for a live-indexed stable frame. -/
+inductive StableLiveFrameRel (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    Frame → Frame → Prop where
+  | rewritten {source : Function}
+      (rewrite : Reuse.FunctionRewrite limits validation source)
+      {baseline rewritten : Frame}
+      (frame : StableLiveFrameIso rewrite locRel baseline rewritten) :
+      StableLiveFrameRel limits validation locRel baseline rewritten
+
+/-- Continuations use live-indexed caller frames.  Every pending
+over-application argument remains fully related. -/
+inductive StableLiveContinuationIso (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    Continuation → Continuation → Prop where
+  | resume {baseline rewritten : Frame}
+      (frame : StableLiveFrameRel limits validation locRel baseline rewritten) :
+      StableLiveContinuationIso limits validation locRel
+        (.resume baseline) (.resume rewritten)
+  | applyMore {baselineArguments rewrittenArguments : Array RVal}
+      {baseline rewritten : Frame}
+      (arguments : IxIR1.Sim.RValsIso locRel
+        baselineArguments.toList rewrittenArguments.toList)
+      (frame : StableLiveFrameRel limits validation locRel baseline rewritten) :
+      StableLiveContinuationIso limits validation locRel
+        (.applyMore baselineArguments baseline)
+        (.applyMore rewrittenArguments rewritten)
+
+inductive StableLiveStackIso (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    List Continuation → List Continuation → Prop where
+  | nil : StableLiveStackIso limits validation locRel [] []
+  | cons {baseline rewritten : Continuation}
+      {baselineTail rewrittenTail : List Continuation}
+      (head : StableLiveContinuationIso limits validation locRel
+        baseline rewritten)
+      (tail : StableLiveStackIso limits validation locRel
+        baselineTail rewrittenTail) :
+      StableLiveStackIso limits validation locRel
+        (baseline :: baselineTail) (rewritten :: rewrittenTail)
+
+/-- Related argument vectors enter a related rewritten callee. -/
+theorem StableLiveFrameRel.entry {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop}
+    {baselineValues rewrittenValues : Array RVal}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList) :
+    StableLiveFrameRel limits validation locRel
+      { definition := source, values := baselineValues }
+      { definition := rewrite.definition, values := rewrittenValues } :=
+  .rewritten rewrite (StableLiveFrameIso.entry rewrite values)
+
+/-- Widen the location relation of an existentially selected frame rewrite. -/
+theorem StableLiveFrameRel.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : Frame}
+    (frame : StableLiveFrameRel limits validation oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveFrameRel limits validation newRel baseline rewritten := by
+  cases frame with
+  | rewritten rewrite related => exact .rewritten rewrite (related.mono lift)
+
+/-- Append a related return value to an existentially selected suspended
+caller frame. -/
+theorem StableLiveFrameRel.push {limits : Validate.Limits}
+    {validation : Validate.Context} {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Frame}
+    (frame : StableLiveFrameRel limits validation locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    StableLiveFrameRel limits validation locRel
+      { baseline with values := baseline.values.push baselineValue }
+      { rewritten with values := rewritten.values.push rewrittenValue } := by
+  cases frame with
+  | rewritten rewrite related => exact .rewritten rewrite (related.push value)
+
+/-- Widen the location relation through one continuation. -/
+theorem StableLiveContinuationIso.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : Continuation}
+    (continuation : StableLiveContinuationIso limits validation oldRel
+      baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveContinuationIso limits validation newRel baseline rewritten := by
+  cases continuation with
+  | resume frame => exact .resume (frame.mono lift)
+  | applyMore arguments frame =>
+      exact .applyMore (arguments.mono lift) (frame.mono lift)
+
+/-- Choose matching resume or `applyMore` continuations from related excess
+argument vectors. -/
+theorem StableLiveContinuationIso.applyMoreOrResumeIso
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {locRel : Nat → Nat → Prop}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baseline rewritten : Frame}
+    (arguments : IxIR1.Sim.RValsIso locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (frame : StableLiveFrameRel limits validation locRel baseline rewritten) :
+    StableLiveContinuationIso limits validation locRel
+      (if baselineArguments.isEmpty then .resume baseline
+        else .applyMore baselineArguments baseline)
+      (if rewrittenArguments.isEmpty then .resume rewritten
+        else .applyMore rewrittenArguments rewritten) := by
+  have sizes : baselineArguments.size = rewrittenArguments.size := by
+    simpa using arguments.lengths
+  have emptyEq : baselineArguments.isEmpty = rewrittenArguments.isEmpty := by
+    simp [Array.isEmpty, sizes]
+  by_cases empty : baselineArguments.isEmpty
+  · have rewrittenEmpty : rewrittenArguments.isEmpty := by
+      simpa [emptyEq] using empty
+    simp only [empty, rewrittenEmpty]
+    exact .resume frame
+  · have rewrittenNonempty : ¬ rewrittenArguments.isEmpty := by
+      simpa [emptyEq] using empty
+    simp only [empty, rewrittenNonempty]
+    exact .applyMore arguments frame
+
+/-- Widen the location relation through a suspended stack. -/
+theorem StableLiveStackIso.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : List Continuation}
+    (stack : StableLiveStackIso limits validation oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveStackIso limits validation newRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (head.mono lift) ih
+
+/-! ## Compiler roots for observable suspended values -/
+
+/-- Exact heap ownership makes a vector of shared values executable by the
+batch retain primitive.  Besides constructing the evaluator run, this records
+one new external root per retained value in source order.  Scalar values are
+admitted as inert roots, while location retains increment the matching shared
+node and preserve every remaining value's world. -/
+theorem retainSharedMany_of_rootOwnership
+    {store : Store} {values : List RVal} {roots : List IxIR1.Sim.Root}
+    (worlds : ∀ value ∈ values,
+      IxIR1.Sim.HasWorld store.heap .shared value)
+    (ownership : IxIR1.Sim.RootOwnership store.heap roots) :
+    ∃ target,
+      RetainSharedMany store values.toArray target ∧
+      IxIR1.Sim.RootOwnership target.heap
+          (IxIR1.Sim.rootsFor .shared values ++ roots) ∧
+      IxIR1.Sim.StoreGraphExtends store.heap target.heap := by
+  induction values generalizing store roots with
+  | nil =>
+      exact ⟨store, RetainSharedMany.empty store, by
+        simpa [IxIR1.Sim.rootsFor] using ownership,
+        IxIR1.Sim.StoreGraphExtends.refl store.heap⟩
+  | cons value values ih =>
+      have valueWorld := worlds value (by simp)
+      have tailWorlds : ∀ child ∈ values,
+          IxIR1.Sim.HasWorld store.heap .shared child := by
+        intro child member
+        exact worlds child (by simp [member])
+      cases value with
+      | lit literal =>
+          have headRun : retainShared store (.lit literal) = .ok store := rfl
+          have headOwnership : IxIR1.Sim.RootOwnership store.heap
+              (⟨.shared, .lit literal⟩ :: roots) :=
+            ownership.addNoLocation rfl
+          obtain ⟨target, tailRun, targetOwnership, extension⟩ :=
+            ih tailWorlds headOwnership
+          refine ⟨target, RetainSharedMany.cons headRun tailRun, ?_,
+            extension⟩
+          · apply targetOwnership.perm
+            simp [IxIR1.Sim.rootsFor]
+      | erased =>
+          have headRun : retainShared store .erased = .ok store := rfl
+          have headOwnership : IxIR1.Sim.RootOwnership store.heap
+              (⟨.shared, .erased⟩ :: roots) :=
+            ownership.addNoLocation rfl
+          obtain ⟨target, tailRun, targetOwnership, extension⟩ :=
+            ih tailWorlds headOwnership
+          refine ⟨target, RetainSharedMany.cons headRun tailRun, ?_,
+            extension⟩
+          · apply targetOwnership.perm
+            simp [IxIR1.Sim.rootsFor]
+      | loc location =>
+          obtain ⟨box, found, boxWorld⟩ := valueWorld
+          cases box with
+          | mk world rc node =>
+              simp only at boxWorld
+              subst world
+              let middle := incrementSharedStore store location
+                ⟨.shared, rc, node⟩
+              have headRun : retainShared store (.loc location) =
+                  .ok middle := by
+                have found' : store.get? location =
+                    some ⟨.shared, rc, node⟩ := by
+                  simpa [Store.get?] using found
+                simp [retainShared, found', middle, incrementSharedStore]
+              have headOwnership : IxIR1.Sim.RootOwnership middle.heap
+                  (⟨.shared, .loc location⟩ :: roots) := by
+                simpa [middle] using ownership.retainShared found
+              have tailWorldsMiddle : ∀ child ∈ values,
+                  IxIR1.Sim.HasWorld middle.heap .shared child := by
+                intro child member
+                exact (tailWorlds child member).monoStore
+                  (IxIR1.Sim.StoreGraphExtends.incRcStore found)
+              obtain ⟨target, tailRun, targetOwnership, tailExtension⟩ :=
+                ih tailWorldsMiddle headOwnership
+              refine ⟨target, RetainSharedMany.cons headRun tailRun, ?_,
+                IxIR1.Sim.StoreGraphExtends.trans
+                  (IxIR1.Sim.StoreGraphExtends.incRcStore found)
+                  tailExtension⟩
+              · apply targetOwnership.perm
+                simp [IxIR1.Sim.rootsFor]
+
+/-- Opening the fields of an owned shared constructor therefore always has a
+successful batch-retain execution.  The output ownership is the exact
+old-field/source/ambient root list needed by accepted reset accounting. -/
+theorem retainCtorFields_of_rootOwnership
+    {store : Store} {location rc : Nat} {cid : CtorId}
+    {fields : Array RVal} {rest : List IxIR1.Sim.Root}
+    (sourceAt : store.get? location =
+      some ⟨.shared, rc, .ctorN cid fields⟩)
+    (ownership : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc location⟩ :: rest)) :
+    ∃ target,
+      RetainSharedMany store fields target ∧
+      IxIR1.Sim.RootOwnership target.heap
+        (IxIR1.Sim.rootsFor .shared fields.toList ++
+          ⟨.shared, .loc location⟩ :: rest) ∧
+      IxIR1.Sim.StoreGraphExtends store.heap target.heap := by
+  apply retainSharedMany_of_rootOwnership
+  · intro value member
+    exact ownership.edges_world sourceAt value (by
+      simpa [IxIR1.Sim.nodeChildren] using member)
+  · exact ownership
+
+/-- Address-bearing roots retain both the ownership world and the concrete
+heap slot.  Scalars are omitted because they contribute no incoming edge. -/
+private def rootAddress? : IxIR1.Sim.Root → Option (Ixon.Owned × Nat)
+  | ⟨world, .loc location⟩ => some (world, location)
+  | ⟨_, .lit _⟩ | ⟨_, .erased⟩ => none
+
+private def addressedRoots
+    (roots : List IxIR1.Sim.Root) : List IxIR1.Sim.Root :=
+  (roots.filterMap rootAddress?).map fun (world, location) =>
+    ⟨world, .loc location⟩
+
+/-- An inert root carries a scalar value and therefore contributes no heap
+ownership count. -/
+def inertRoot : IxIR1.Sim.Root → Bool
+  | ⟨_, .loc _⟩ => false
+  | ⟨_, .lit _⟩ | ⟨_, .erased⟩ => true
+
+def inertRoots (roots : List IxIR1.Sim.Root) : List IxIR1.Sim.Root :=
+  roots.filter inertRoot
+
+private theorem address_count_eq_location_count
+    {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    (worlds : ∀ root ∈ roots,
+      IxIR1.Sim.HasWorld store root.world root.value)
+    {world : Ixon.Owned} {location rc : Nat} {node : IxIR1.Node}
+    (found : store.get? location = some ⟨world, rc, node⟩) :
+    List.count (world, location) (roots.filterMap rootAddress?) =
+      List.count location (roots.filterMap IxIR1.Sim.rootLocation?) := by
+  induction roots with
+  | nil => simp
+  | cons root roots ih =>
+      have headWorld := worlds root (by simp)
+      have tailWorlds : ∀ candidate ∈ roots,
+          IxIR1.Sim.HasWorld store candidate.world candidate.value := by
+        intro candidate member
+        exact worlds candidate (by simp [member])
+      have tail := ih tailWorlds
+      rcases root with ⟨rootWorld, value⟩
+      cases value with
+      | lit literal =>
+          change List.count (world, location)
+              (roots.filterMap rootAddress?) =
+            List.count location
+              (roots.filterMap IxIR1.Sim.rootLocation?)
+          exact tail
+      | erased =>
+          change List.count (world, location)
+              (roots.filterMap rootAddress?) =
+            List.count location
+              (roots.filterMap IxIR1.Sim.rootLocation?)
+          exact tail
+      | loc rootLocation =>
+          by_cases same : rootLocation = location
+          · subst rootLocation
+            obtain ⟨box, boxAt, boxWorld⟩ := headWorld
+            have boxEq : box = ⟨world, rc, node⟩ :=
+              Option.some.inj (boxAt.symm.trans found)
+            subst box
+            have rootWorldEq : rootWorld = world := boxWorld.symm
+            subst rootWorld
+            change List.count (world, location)
+                ((world, location) :: roots.filterMap rootAddress?) =
+              List.count location
+                (location :: roots.filterMap IxIR1.Sim.rootLocation?)
+            simp [tail]
+          · have addressNe : (rootWorld, rootLocation) ≠
+                (world, location) := by
+              intro equal
+              exact same (congrArg Prod.snd equal)
+            change List.count (world, location)
+                ((rootWorld, rootLocation) ::
+                  roots.filterMap rootAddress?) =
+              List.count location
+                (rootLocation ::
+                  roots.filterMap IxIR1.Sim.rootLocation?)
+            simp [addressNe, same, tail]
+
+private theorem address_absent_of_dead
+    {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    (worlds : ∀ root ∈ roots,
+      IxIR1.Sim.HasWorld store root.world root.value)
+    {world : Ixon.Owned} {location : Nat}
+    (dead : store.get? location = none) :
+    (world, location) ∉ roots.filterMap rootAddress? := by
+  intro member
+  rw [List.mem_filterMap] at member
+  obtain ⟨root, rootMember, address⟩ := member
+  rcases root with ⟨rootWorld, value⟩
+  cases value with
+  | lit literal => simp [rootAddress?] at address
+  | erased => simp [rootAddress?] at address
+  | loc rootLocation =>
+      simp only [rootAddress?, Option.some.injEq, Prod.mk.injEq] at address
+      obtain ⟨worldEq, locationEq⟩ := address
+      subst rootWorld
+      subst rootLocation
+      obtain ⟨box, boxAt, _⟩ := worlds _ rootMember
+      rw [dead] at boxAt
+      contradiction
+
+private theorem address_absent_of_world_ne
+    {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    (worlds : ∀ root ∈ roots,
+      IxIR1.Sim.HasWorld store root.world root.value)
+    {world actualWorld : Ixon.Owned} {location rc : Nat}
+    {node : IxIR1.Node}
+    (found : store.get? location = some ⟨actualWorld, rc, node⟩)
+    (different : world ≠ actualWorld) :
+    (world, location) ∉ roots.filterMap rootAddress? := by
+  intro member
+  rw [List.mem_filterMap] at member
+  obtain ⟨root, rootMember, address⟩ := member
+  rcases root with ⟨rootWorld, value⟩
+  cases value with
+  | lit literal => simp [rootAddress?] at address
+  | erased => simp [rootAddress?] at address
+  | loc rootLocation =>
+      simp only [rootAddress?, Option.some.injEq, Prod.mk.injEq] at address
+      obtain ⟨worldEq, locationEq⟩ := address
+      subst rootWorld
+      subst rootLocation
+      obtain ⟨box, boxAt, boxWorld⟩ := worlds _ rootMember
+      have boxEq : box = ⟨actualWorld, rc, node⟩ :=
+        Option.some.inj (boxAt.symm.trans found)
+      subst box
+      exact different boxWorld.symm
+
+private theorem rootOwnership_addressCount_eq
+    {store : IxIR1.Store} {left right : List IxIR1.Sim.Root}
+    (leftOwned : IxIR1.Sim.RootOwnership store left)
+    (rightOwned : IxIR1.Sim.RootOwnership store right)
+    (address : Ixon.Owned × Nat) :
+    List.count address (left.filterMap rootAddress?) =
+      List.count address (right.filterMap rootAddress?) := by
+  rcases address with ⟨world, location⟩
+  cases found : store.get? location with
+  | none =>
+      rw [List.count_eq_zero.mpr
+        (address_absent_of_dead leftOwned.roots_world found),
+        List.count_eq_zero.mpr
+          (address_absent_of_dead rightOwned.roots_world found)]
+  | some box =>
+      rcases box with ⟨actualWorld, rc, node⟩
+      by_cases worldEq : world = actualWorld
+      · subst world
+        rw [address_count_eq_location_count leftOwned.roots_world found,
+          address_count_eq_location_count rightOwned.roots_world found]
+        have incomingEq : IxIR1.Sim.incoming store left location =
+            IxIR1.Sim.incoming store right location := by
+          cases actualWorld with
+          | shared =>
+              exact (leftOwned.counts found).symm.trans
+                (rightOwned.counts found)
+          | unique =>
+              exact (leftOwned.counts found).2.trans
+                (rightOwned.counts found).2.symm
+        simp only [IxIR1.Sim.incoming, List.count_append] at incomingEq
+        omega
+      · rw [List.count_eq_zero.mpr
+          (address_absent_of_world_ne leftOwned.roots_world found worldEq),
+          List.count_eq_zero.mpr
+            (address_absent_of_world_ne rightOwned.roots_world found worldEq)]
+
+private theorem addressedRoots_perm
+    {store : IxIR1.Store} {left right : List IxIR1.Sim.Root}
+    (leftOwned : IxIR1.Sim.RootOwnership store left)
+    (rightOwned : IxIR1.Sim.RootOwnership store right) :
+    (addressedRoots left).Perm (addressedRoots right) := by
+  have addresses : (left.filterMap rootAddress?).Perm
+      (right.filterMap rootAddress?) := by
+    rw [List.perm_iff_count]
+    exact rootOwnership_addressCount_eq leftOwned rightOwned
+  exact addresses.map fun (world, location) =>
+    (⟨world, .loc location⟩ : IxIR1.Sim.Root)
+
+private theorem mem_addressedRoots_loc_iff
+    {roots : List IxIR1.Sim.Root} {world : Ixon.Owned} {location : Nat} :
+    (⟨world, .loc location⟩ : IxIR1.Sim.Root) ∈ addressedRoots roots ↔
+      (⟨world, .loc location⟩ : IxIR1.Sim.Root) ∈ roots := by
+  constructor
+  · intro member
+    rw [addressedRoots, List.mem_map] at member
+    obtain ⟨⟨actualWorld, actualLocation⟩, addressMember,
+      rootEq⟩ := member
+    cases rootEq
+    rw [List.mem_filterMap] at addressMember
+    obtain ⟨root, rootMember, addressEq⟩ := addressMember
+    rcases root with ⟨rootWorld, value⟩
+    cases value with
+    | loc rootLocation =>
+        simp only [rootAddress?, Option.some.injEq, Prod.mk.injEq] at addressEq
+        obtain ⟨rootWorldEq, rootLocationEq⟩ := addressEq
+        subst rootWorld
+        subst rootLocation
+        exact rootMember
+    | lit literal => simp [rootAddress?] at addressEq
+    | erased => simp [rootAddress?] at addressEq
+  · intro member
+    rw [addressedRoots, List.mem_map]
+    refine ⟨(world, location), ?_, rfl⟩
+    rw [List.mem_filterMap]
+    exact ⟨⟨world, .loc location⟩, member, rfl⟩
+
+/-- Exact ownership transports support for every address-bearing planner
+value between root presentations of the same heap. Scalar planner values do
+not require a root witness, so differences in inert scalar padding are
+irrelevant. -/
+theorem MappedValuesInRoots.transportOwnership
+    {shape : Reuse.Shape} {values : Array RVal} {store : IxIR1.Store}
+    {before after : List IxIR1.Sim.Root}
+    (mapped : MappedValuesInRoots shape values before)
+    (beforeOwned : IxIR1.Sim.RootOwnership store before)
+    (afterOwned : IxIR1.Sim.RootOwnership store after) :
+    MappedValuesInRoots shape values after := by
+  intro sourceId targetId sourceValue relevant translated found
+  have supported := mapped sourceId targetId sourceValue relevant translated
+    found
+  cases sourceValue with
+  | lit literal => trivial
+  | erased => trivial
+  | loc location =>
+      obtain ⟨world, member⟩ := supported
+      have addressedMember :
+          (⟨world, .loc location⟩ : IxIR1.Sim.Root) ∈
+            addressedRoots before := by
+        exact mem_addressedRoots_loc_iff.mpr member
+      have transported :
+          (⟨world, .loc location⟩ : IxIR1.Sim.Root) ∈
+            addressedRoots after :=
+        (addressedRoots_perm beforeOwned afterOwned).mem_iff.mp
+          addressedMember
+      exact ⟨world, by
+        exact mem_addressedRoots_loc_iff.mp transported⟩
+
+private theorem addressed_inert_perm (roots : List IxIR1.Sim.Root) :
+    (addressedRoots roots ++ inertRoots roots).Perm roots := by
+  induction roots with
+  | nil => simp [addressedRoots, inertRoots]
+  | cons root roots ih =>
+      rcases root with ⟨world, value⟩
+      cases value with
+      | loc location =>
+          change
+            (⟨world, .loc location⟩ ::
+                (addressedRoots roots ++ inertRoots roots)).Perm
+              (⟨world, .loc location⟩ :: roots)
+          exact ih.cons _
+      | lit literal =>
+          change
+            (addressedRoots roots ++
+                ⟨world, .lit literal⟩ :: inertRoots roots).Perm
+              (⟨world, .lit literal⟩ :: roots)
+          exact List.perm_middle.trans (ih.cons _)
+      | erased =>
+          change
+            (addressedRoots roots ++
+                ⟨world, .erased⟩ :: inertRoots roots).Perm
+              (⟨world, .erased⟩ :: roots)
+          exact List.perm_middle.trans (ih.cons _)
+
+/-- Exact ownership uniquely determines the multiset of address-bearing
+roots.  Consequently two valid presentations can be balanced into an exact
+`List.Perm` by appending only the other presentation's inert scalar roots.
+This is the ownership-level bridge from compiler capability lists to the
+field/root partitions consumed by physical reuse. -/
+theorem balanceInertRoots
+    {store : IxIR1.Store} {left right : List IxIR1.Sim.Root}
+    (leftOwned : IxIR1.Sim.RootOwnership store left)
+    (rightOwned : IxIR1.Sim.RootOwnership store right) :
+    (left ++ inertRoots right).Perm (right ++ inertRoots left) := by
+  have locations := addressedRoots_perm leftOwned rightOwned
+  have leftSplit := addressed_inert_perm left
+  have rightSplit := addressed_inert_perm right
+  have first : (left ++ inertRoots right).Perm
+      ((addressedRoots left ++ inertRoots left) ++ inertRoots right) :=
+    leftSplit.symm.append_right _
+  have locationStep :
+      ((addressedRoots left ++ inertRoots left) ++ inertRoots right).Perm
+        ((addressedRoots right ++ inertRoots left) ++ inertRoots right) := by
+    simpa [List.append_assoc] using
+      locations.append_right (inertRoots left ++ inertRoots right)
+  have inertStep :
+      ((addressedRoots right ++ inertRoots left) ++ inertRoots right).Perm
+        ((addressedRoots right ++ inertRoots right) ++ inertRoots left) := by
+    simpa [List.append_assoc] using
+      (List.perm_append_comm
+        (l₁ := inertRoots left) (l₂ := inertRoots right)).append_left
+          (addressedRoots right)
+  exact first.trans (locationStep.trans
+    (inertStep.trans (rightSplit.append_right _)))
+
+/-- Any scalar padding may be appended to an exact ownership presentation
+without changing the heap's incoming-owner equations. -/
+theorem addInertRoots
+    {store : IxIR1.Store} {roots extra : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership store roots) :
+    IxIR1.Sim.RootOwnership store (roots ++ inertRoots extra) := by
+  induction extra with
+  | nil => simpa [inertRoots] using ownership
+  | cons root extra ih =>
+      rcases root with ⟨world, value⟩
+      cases value with
+      | loc location => simpa [inertRoots, inertRoot] using ih
+      | lit literal =>
+          have added := ih.addNoLocation
+            (world := world) (value := (.lit literal : RVal)) rfl
+          apply added.perm
+          exact List.perm_middle.symm
+      | erased =>
+          have added := ih.addNoLocation
+            (world := world) (value := (.erased : RVal)) rfl
+          apply added.perm
+          exact List.perm_middle.symm
+
+/-- Two exact pre-allocation ownership presentations induce the physical
+reuse partition once each ambient tail is padded by the other side's inert
+roots.  Address-bearing roots are matched by exact incoming counts; scalar
+padding supplies only the syntactic multiset balance required by `List.Perm`.
+-/
+theorem fieldRootPartition
+    {store : IxIR1.Store} {oldFields newFields : List RVal}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    (oldOwned : IxIR1.Sim.RootOwnership store
+      (IxIR1.Sim.rootsFor .shared oldFields ++ oldRest))
+    (newOwned : IxIR1.Sim.RootOwnership store
+      (IxIR1.Sim.rootsFor .shared newFields ++ newRest)) :
+    (IxIR1.Sim.rootsFor .shared oldFields ++
+        (oldRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared newFields ++ newRest))).Perm
+      (IxIR1.Sim.rootsFor .shared newFields ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared oldFields ++ oldRest))) := by
+  simpa [List.append_assoc] using balanceInertRoots oldOwned newOwned
+
+/-- The successful hot baseline retain/release prefix converts the accepted
+parent owner into the old-field ownership presentation on the allocation
+heap.  Comparing it with any exact checked pre-allocation presentation yields
+the physical-reuse partition; inert scalar roots are added symmetrically
+because they have no representation in the heap's incoming counts. -/
+theorem hotPrefixFieldRootPartition
+    {store retained released : Store} {location : Nat} {cid : CtorId}
+    {oldFields newFields : Array RVal} {fieldFuel remaining : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    (sourceAt : store.get? location =
+      some ⟨.shared, 1, .ctorN cid oldFields⟩)
+    (sourceOwned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc location⟩ :: oldRest))
+    (retainedRun : RetainSharedMany store oldFields retained)
+    (releasedRun : releaseShared (fieldFuel + 1) retained
+      (.loc location) = .ok (released, remaining))
+    (newOwned : IxIR1.Sim.RootOwnership released.heap
+      (IxIR1.Sim.rootsFor .shared newFields.toList ++ newRest)) :
+    (IxIR1.Sim.rootsFor .shared oldFields.toList ++
+        (oldRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared newFields.toList ++ newRest))).Perm
+      (IxIR1.Sim.rootsFor .shared newFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest))) := by
+  have killedOwned : IxIR1.Sim.RootOwnership (store.heap.kill location)
+      (IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest) := by
+    simpa [IxIR1.Sim.nodeChildren] using
+      sourceOwned.killSharedOne sourceAt
+  have logicalOwned : IxIR1.Sim.RootOwnership
+      (logicalHotResetStore store location).heap
+      (IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest) := by
+    rw [logicalHotResetStore_heap]
+    exact killedOwned
+  have contents : HeapContentsEq released
+      (logicalHotResetStore store location) :=
+    hotPrefix_contents sourceAt sourceOwned retainedRun releasedRun
+  have oldOwned : IxIR1.Sim.RootOwnership released.heap
+      (IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest) :=
+    contents.symm.rootOwnership logicalOwned
+  exact fieldRootPartition oldOwned newOwned
+
+/-- Full ownership package induced by `hotPrefixFieldRootPartition`.  The
+ambient lists chosen for the physical macro contain all original roots and
+only add inert scalar padding; consequently both the entry ownership and the
+checked allocation ownership remain exact. -/
+theorem hotPrefixFieldRootAccounting
+    {store retained released : Store} {location : Nat} {cid : CtorId}
+    {oldFields newFields : Array RVal} {fieldFuel remaining : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    (sourceAt : store.get? location =
+      some ⟨.shared, 1, .ctorN cid oldFields⟩)
+    (sourceOwned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc location⟩ :: oldRest))
+    (retainedRun : RetainSharedMany store oldFields retained)
+    (releasedRun : releaseShared (fieldFuel + 1) retained
+      (.loc location) = .ok (released, remaining))
+    (newOwned : IxIR1.Sim.RootOwnership released.heap
+      (IxIR1.Sim.rootsFor .shared newFields.toList ++ newRest)) :
+    IxIR1.Sim.RootOwnership store.heap
+        (⟨.shared, .loc location⟩ ::
+          (oldRest ++ inertRoots
+            (IxIR1.Sim.rootsFor .shared newFields.toList ++ newRest))) ∧
+      IxIR1.Sim.RootOwnership released.heap
+        (IxIR1.Sim.rootsFor .shared newFields.toList ++
+          (newRest ++ inertRoots
+            (IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest))) ∧
+      (IxIR1.Sim.rootsFor .shared oldFields.toList ++
+          (oldRest ++ inertRoots
+            (IxIR1.Sim.rootsFor .shared newFields.toList ++ newRest))).Perm
+        (IxIR1.Sim.rootsFor .shared newFields.toList ++
+          (newRest ++ inertRoots
+            (IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest))) := by
+  have entryOwned := addInertRoots sourceOwned
+    (extra := IxIR1.Sim.rootsFor .shared newFields.toList ++ newRest)
+  have allocationOwned := addInertRoots newOwned
+    (extra := IxIR1.Sim.rootsFor .shared oldFields.toList ++ oldRest)
+  refine ⟨?_, ?_, hotPrefixFieldRootPartition sourceAt sourceOwned
+    retainedRun releasedRun newOwned⟩
+  · simpa [List.append_assoc] using entryOwned
+  · simpa [List.append_assoc] using allocationOwned
+
+/-- Transport the complete padded hot-prefix accounting package through an
+incoming target-to-baseline heap isomorphism. The rewritten root permutation
+is induced by the baseline permutation and pointwise root isomorphisms; it is
+not an independent premise. -/
+theorem hotPrefixFieldRootAccountingIso
+    {baselineStore rewrittenStore retained released : Store}
+    {baselineLocation rewrittenLocation : Nat} {cid : CtorId}
+    {baselineFields rewrittenFields baselineNewFields rewrittenNewFields :
+      Array RVal}
+    {fieldFuel remaining : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (baselineAt : baselineStore.get? baselineLocation =
+      some ⟨.shared, 1, .ctorN cid baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation =
+      some ⟨.shared, 1, .ctorN cid rewrittenFields⟩)
+    (oldFieldsRelated : IxIR1.Sim.RValsIso inputIso.locRel
+      rewrittenFields.toList baselineFields.toList)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (retainedRun : RetainSharedMany baselineStore baselineFields retained)
+    (releasedRun : releaseShared (fieldFuel + 1) retained
+      (.loc baselineLocation) = .ok (released, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership released.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (newFieldsRelated : IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList) :
+    let baselineBefore := oldRest ++ inertRoots
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest)
+    let baselineAfter := newRest ++ inertRoots
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest)
+    ∃ rewrittenBefore rewrittenAfter : List IxIR1.Sim.Root,
+      IxIR1.Sim.RootsIso inputIso.locRel
+          (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore)
+          (⟨.shared, .loc baselineLocation⟩ :: baselineBefore) ∧
+      IxIR1.Sim.RootOwnership baselineStore.heap
+          (⟨.shared, .loc baselineLocation⟩ :: baselineBefore) ∧
+      IxIR1.Sim.RootOwnership rewrittenStore.heap
+          (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore) ∧
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+          baselineBefore).Perm
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter) ∧
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+          rewrittenBefore).Perm
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter) ∧
+      IxIR1.Sim.RootsIso
+        (fun rewrittenCandidate baselineCandidate =>
+          inputIso.locRel rewrittenCandidate baselineCandidate ∧
+            rewrittenCandidate ≠ rewrittenLocation)
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter)
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter) := by
+  dsimp only
+  obtain ⟨baselineEntryOwned, baselineAllocationOwned,
+      baselinePartition⟩ :=
+    hotPrefixFieldRootAccounting baselineAt baselineOwned retainedRun
+      releasedRun baselineNewOwned
+  let baselineBefore := oldRest ++ inertRoots
+    (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest)
+  let baselineAfter := newRest ++ inertRoots
+    (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest)
+  let sourceRoot : IxIR1.Sim.RootIso inputIso.locRel
+      ⟨.shared, .loc rewrittenLocation⟩
+      ⟨.shared, .loc baselineLocation⟩ :=
+    ⟨rfl, .loc locations⟩
+  obtain ⟨rewrittenBefore, entryRoots, rewrittenOwned⟩ :=
+    inputIso.rootOwnershipPreimageCons sourceRoot baselineEntryOwned
+  have prefixContents : HeapContentsEq released
+      (logicalHotResetStore baselineStore baselineLocation) :=
+    hotPrefix_contents baselineAt baselineOwned retainedRun releasedRun
+  have baselineKilledNewOwned : IxIR1.Sim.RootOwnership
+      (baselineStore.heap.kill baselineLocation)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        baselineAfter) := by
+    have logicalOwned := prefixContents.rootOwnership baselineAllocationOwned
+    simpa [logicalHotResetStore_heap] using logicalOwned
+  let killedIso := heapIsoKillShared inputIso locations rewrittenAt baselineAt
+    rewrittenOwned
+  have newFieldRoots : IxIR1.Sim.RootsIso killedIso.locRel
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList) := by
+    apply IxIR1.Sim.RootsIso.rootsFor
+    change IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList
+    exact newFieldsRelated
+  obtain ⟨rewrittenAfter, allocationRoots, _rewrittenKilledNewOwned⟩ :=
+    killedIso.rootOwnershipPreimageAppend newFieldRoots
+      baselineKilledNewOwned
+  have oldRoots : IxIR1.Sim.RootsIso inputIso.locRel
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+        rewrittenBefore)
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+        baselineBefore) :=
+    (IxIR1.Sim.RootsIso.rootsFor .shared oldFieldsRelated).append
+      entryRoots.tail
+  have newRoots : IxIR1.Sim.RootsIso inputIso.locRel
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        baselineAfter) := by
+    apply allocationRoots.mono
+    intro left right related
+    exact related.1
+  obtain ⟨permutedRoots, rewrittenPartition, relatedPermutedRoots⟩ :=
+    oldRoots.permuteRight baselinePartition
+  have permutedEq : permutedRoots =
+      IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter :=
+    IxIR1.Sim.RootsIso.left_eq_of_right inputIso relatedPermutedRoots newRoots
+  subst permutedRoots
+  exact ⟨rewrittenBefore, rewrittenAfter, entryRoots,
+    baselineEntryOwned, rewrittenOwned, baselinePartition,
+    rewrittenPartition, by simpa [killedIso, heapIsoKillShared] using
+      allocationRoots⟩
+
+/-- A suspended runtime value is either scalar or is represented by one of
+the exact source roots framed around the active callee. -/
+def ValueSupportedByRoots (roots : List IxIR1.Sim.Root) : RVal → Prop
+  | .loc location =>
+      ∃ world, (⟨world, .loc location⟩ : IxIR1.Sim.Root) ∈ roots
+  | .lit _ | .erased => True
+
+namespace ValueSupportedByRoots
+
+/-- Root support is monotone when an enclosing call adds more framed roots. -/
+theorem mono {before after : List IxIR1.Sim.Root} {value : RVal}
+    (supported : ValueSupportedByRoots before value)
+    (subset : ∀ root ∈ before, root ∈ after) :
+    ValueSupportedByRoots after value := by
+  cases value with
+  | loc location =>
+      obtain ⟨world, member⟩ := supported
+      exact ⟨world, subset _ member⟩
+  | lit literal => trivial
+  | erased => trivial
+
+/-- A root-supported value cannot name a future append location. -/
+theorem inBounds {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    {value : RVal} (supported : ValueSupportedByRoots roots value)
+    (ownership : IxIR1.Sim.RootOwnership store roots) :
+    IxIR1.Reclamation.ValueInBounds store value := by
+  cases value with
+  | loc location =>
+      obtain ⟨world, member⟩ := supported
+      obtain ⟨box, found, _boxWorld⟩ := ownership.roots_world
+        ⟨world, .loc location⟩ member
+      exact IxIR1.Reclamation.RVal.inBounds_of_get? found
+  | lit literal => trivial
+  | erased => trivial
+
+/-- A framed root cannot name a unit-refcount shared node already accounted
+for by the distinguished consuming root. -/
+theorem avoidsUnitShared {store : IxIR1.Store} {roots rest : List IxIR1.Sim.Root}
+    {value : RVal} {location : Nat} {node : IxIR1.Node}
+    (supported : ValueSupportedByRoots roots value)
+    (rootsInRest : ∀ root ∈ roots, root ∈ rest)
+    (found : store.get? location = some ⟨.shared, 1, node⟩)
+    (ownership : IxIR1.Sim.RootOwnership store
+      (⟨.shared, .loc location⟩ :: rest)) :
+    value ≠ .loc location := by
+  cases value with
+  | loc actual =>
+      obtain ⟨world, member⟩ := supported
+      exact ownership.sole_root_ne found (rootsInRest _ member)
+  | lit literal => intro impossible; cases impossible
+  | erased => intro impossible; cases impossible
+
+end ValueSupportedByRoots
+
+/-- Every future-observable register of a suspended frame is represented by
+the framed source roots. Calls suspend only frames with no live credits. -/
+structure LiveFrameSupportedByRoots (roots : List IxIR1.Sim.Root)
+    (frame : Frame) : Prop where
+  values : ∀ {index : Nat} {value : RVal},
+    ValueLiveFrom frame.definition frame.block frame.pc index →
+    frame.values[index]? = some value →
+    ValueSupportedByRoots roots value
+  noCredits : frame.credits = #[]
+
+/-- The proof-side source input map covers every currently allocated target
+register that can still be observed. The bound excludes a not-yet-pushed
+result register when a caller frame is suspended around a call. -/
+def LiveFrameInputCoverage (input : Lower.Sim.EnvMap) (frame : Frame) : Prop :=
+  ∀ {index : Nat},
+    ValueLiveFrom frame.definition frame.block frame.pc index →
+    index < frame.values.size →
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg index))
+
+private theorem inputContainsReg_of_translateAtom
+    {input : Lower.Sim.EnvMap} {source : IxIR1.Atom} {value : Nat}
+    (translated : Lower.InputMap.translateAtom input source =
+      some (.reg value)) :
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg value)) := by
+  cases source with
+  | var sourceIndex =>
+      cases found : input[sourceIndex]? with
+      | none => simp [Lower.InputMap.translateAtom, found] at translated
+      | some slot =>
+          cases slot with
+          | none => simp [Lower.InputMap.translateAtom, found] at translated
+          | some atom =>
+              have atomEq : atom = .reg value := by
+                simpa [Lower.InputMap.translateAtom, found] using translated
+              subst atom
+              exact ⟨sourceIndex, found⟩
+  | lit literal => simp [Lower.InputMap.translateAtom] at translated
+  | erased => simp [Lower.InputMap.translateAtom] at translated
+
+private theorem atomsListRel_inputContainsReg
+    {input : Lower.Sim.EnvMap} {source : List IxIR1.Atom}
+    {target : List Atom} {value : Nat}
+    (related : Lower.Sim.AtomsListRel input source target)
+    (member : Atom.reg value ∈ target) :
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg value)) := by
+  induction related with
+  | nil => simp at member
+  | @cons sourceAtom targetAtom sourceAtoms targetAtoms translated rest ih =>
+      cases List.mem_cons.mp member with
+      | inl same =>
+          subst targetAtom
+          exact inputContainsReg_of_translateAtom translated
+      | inr member => exact ih member
+
+private theorem inputContainsReg_of_translateAtoms
+    {input : Lower.Sim.EnvMap} {source : Array IxIR1.Atom}
+    {target : Array Atom} {value : Nat}
+    (translated : Lower.InputMap.translateAtoms input source = some target)
+    (member : Atom.reg value ∈ target.toList) :
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg value)) :=
+  atomsListRel_inputContainsReg
+    (Lower.Sim.atomsRel_of_translateAtoms translated) member
+
+private theorem inputContainsReg_of_operationSyntax
+    {input : Lower.Sim.EnvMap} {source : IxIR1.Op} {target : Instr}
+    {value : Nat} (matchedSyntax : Lower.OperationSyntax input source target)
+    (operand : Liveness.InstrUsesAtom target (.reg value)) :
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg value)) := by
+  cases operand with
+  | move =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax
+  | alloc member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtoms matchedSyntax.2.2 member
+  | allocWith member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+  | takeUnique =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+  | resetShared =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+  | retainShared =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax
+  | releaseShared =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax
+  | dropUnique =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax
+  | freeUnique =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax
+  | fetch =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax.2
+  | call member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtoms matchedSyntax.2 member
+  | callSelf member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtoms matchedSyntax member
+  | papp member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtoms matchedSyntax.2 member
+  | applyFunction =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtom matchedSyntax.1
+  | applyArgument member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtoms matchedSyntax.2 member
+  | extern member =>
+      cases source <;> simp [Lower.OperationSyntax] at matchedSyntax
+      exact inputContainsReg_of_translateAtoms matchedSyntax.2 member
+
+private theorem inputContainsReg_of_explicitValues
+    {input : Lower.Sim.EnvMap} {value : Nat}
+    (member : Atom.reg value ∈
+      (Lower.EdgeTrace.explicitValuesOf input).toList) :
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg value)) := by
+  simp only [Lower.EdgeTrace.explicitValuesOf, Array.toList_map] at member
+  obtain ⟨slot, slotMem, mappedEq⟩ := List.mem_map.mp member
+  have slotArrayMem : slot ∈ input := by simpa using slotMem
+  obtain ⟨sourceIndex, inputAt⟩ :=
+    (Array.mem_iff_getElem?).mp slotArrayMem
+  cases slot with
+  | none => simp at mappedEq
+  | some atom =>
+      simp only at mappedEq
+      subst atom
+      exact ⟨sourceIndex, inputAt⟩
+
+private theorem inputContainsReg_of_switchTerminator
+    {site : Lower.SourceSite} {block : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace} {value : Nat}
+    (syntaxMatched : (Lower.CodeTrace.switchValue site block input
+      entryValueCount sourceScrutinee peelNat alternatives targetScrutinee
+      generated outgoing children).syntaxMatches = true)
+    (branchesMatched : (Lower.CodeTrace.switchValue site block input
+      entryValueCount sourceScrutinee peelNat alternatives targetScrutinee
+      generated outgoing children).switchBranchesMatch = true)
+    (operand : Liveness.TerminatorUsesAtom generated.terminator
+      (.reg value)) :
+    ∃ sourceIndex : Nat,
+      input[sourceIndex]? = some (some (Atom.reg value)) := by
+  obtain ⟨constructors, targetPeel, translated, terminator⟩ :=
+    Lower.CodeTrace.switchSyntax_of_match syntaxMatched
+  have localBranches :=
+    Lower.CodeTrace.switchNodeBranchesMatch_of_match branchesMatched
+  rw [terminator] at operand
+  cases operand with
+  | switchScrutinee =>
+      exact inputContainsReg_of_translateAtom translated
+  | @switchCtor _ _ _ alternative _ alternativeMem edgeOperand =>
+      obtain ⟨index, targetListAt⟩ :=
+        List.mem_iff_getElem?.mp alternativeMem
+      have targetAt : constructors[index]? = some alternative := by
+        simpa using targetListAt
+      have localCopy := localBranches
+      unfold Lower.switchNodeBranchesMatch at localCopy
+      rw [terminator] at localCopy
+      simp only [Bool.and_eq_true] at localCopy
+      obtain ⟨⟨⟨outgoingLength, childrenLength⟩, _⟩, _⟩ := localCopy
+      have targetBound : index < constructors.size :=
+        (Array.getElem?_eq_some_iff.mp targetAt).1
+      have edgeBound : index < outgoing.length := by
+        have lengthEq := beq_iff_eq.mp outgoingLength
+        omega
+      have childBound : index < children.length := by
+        have lengthEq := beq_iff_eq.mp childrenLength
+        omega
+      let edge := outgoing[index]'edgeBound
+      let child := children[index]'childBound
+      have edgeAt : outgoing[index]? = some edge :=
+        List.getElem?_eq_some_iff.mpr ⟨edgeBound, rfl⟩
+      have childAt : children[index]? = some child :=
+        List.getElem?_eq_some_iff.mpr ⟨childBound, rfl⟩
+      have branch := Lower.constructorBranchMatchAt_of_switch_match
+        localBranches terminator targetAt edgeAt childAt
+      cases edgeOperand with
+      | value valueMember =>
+          apply inputContainsReg_of_explicitValues (input := input)
+          have explicitMember : Atom.reg value ∈ edge.explicitValues.toList := by
+            rw [← branch.edgeValues]
+            exact valueMember
+          simpa [Lower.EdgeTrace.explicitValues,
+            branch.edgeSourceInput] using explicitMember
+  | switchNatZero edgeOperand =>
+      cases peelNat with
+      | false =>
+          have localCopy := localBranches
+          unfold Lower.switchNodeBranchesMatch at localCopy
+          rw [terminator] at localCopy
+          simp at localCopy
+      | true =>
+          let branches := Lower.natBranchPairMatch_of_switch_match
+            localBranches terminator
+          cases edgeOperand with
+          | value valueMember =>
+              apply inputContainsReg_of_explicitValues (input := input)
+              have explicitMember : Atom.reg value ∈
+                  branches.zeroEdge.explicitValues.toList := by
+                rw [← branches.zero.edgeValues]
+                exact valueMember
+              simpa [Lower.EdgeTrace.explicitValues,
+                branches.zero.edgeSourceInput] using explicitMember
+  | switchNatSucc edgeOperand =>
+      cases peelNat with
+      | false =>
+          have localCopy := localBranches
+          unfold Lower.switchNodeBranchesMatch at localCopy
+          rw [terminator] at localCopy
+          simp at localCopy
+      | true =>
+          let branches := Lower.natBranchPairMatch_of_switch_match
+            localBranches terminator
+          cases edgeOperand with
+          | value valueMember =>
+              apply inputContainsReg_of_explicitValues (input := input)
+              have explicitMember : Atom.reg value ∈
+                  branches.succEdge.explicitValues.toList := by
+                rw [← branches.succ.edgeValues]
+                exact valueMember
+              simpa [Lower.EdgeTrace.explicitValues,
+                branches.succ.edgeSourceInput] using explicitMember
+
+private theorem baselineBinderAtom_ne_reg_of_lt
+    {entryValueCount value : Nat} {instruction : Instr} {head : Atom}
+    (binder : Lower.Instr.baselineBinderAtom entryValueCount instruction =
+      some head)
+    (bound : value < entryValueCount) :
+    head ≠ .reg value := by
+  cases instruction <;>
+    simp [Lower.Instr.baselineBinderAtom] at binder
+  all_goals subst head
+  all_goals simp_all
+  all_goals exact Nat.ne_of_gt bound
+
+private theorem inputContainsReg_of_singletonAppend
+    {input : Lower.Sim.EnvMap} {head : Atom} {value sourceIndex : Nat}
+    (different : head ≠ .reg value)
+    (found : (#[some head] ++ input)[sourceIndex]? =
+      some (some (Atom.reg value))) :
+    ∃ inputIndex : Nat,
+      input[inputIndex]? = some (some (Atom.reg value)) := by
+  cases sourceIndex with
+  | zero =>
+      have same : head = .reg value := by
+        simpa [Array.getElem?_append] using found
+      exact (different same).elim
+  | succ inputIndex =>
+      exact ⟨inputIndex, by
+        simpa [Array.getElem?_append] using found⟩
+
+private theorem codeTrace_inputCoversFutureUse (trace : Lower.CodeTrace) :
+    trace.instructionsMatch = true →
+    trace.inputMapsMatch = true →
+    trace.syntaxMatches = true →
+    trace.switchBranchesMatch = true →
+    ∀ {value position : Nat},
+      value < trace.entryValueCount →
+      (⟨value, position⟩ : Liveness.Use) ∈
+        Liveness.blockUses trace.headBlock.2 →
+      trace.entryPc ≤ position →
+      ∃ sourceIndex : Nat,
+        trace.sourceInputMap[sourceIndex]? =
+          some (some (Atom.reg value)) := by
+  induction trace using Lower.CodeTrace.inductTree with
+  | retCase site block input entryValueCount sourceAtom targetAtom generated =>
+      intro _ _ syntaxMatched _ value position _ member future
+      simp only [Lower.CodeTrace.headBlock] at member
+      simp only [Lower.CodeTrace.entryPc] at future
+      cases Liveness.mem_blockUses member with
+      | inl instructionUse =>
+          obtain ⟨instruction, found, _⟩ := instructionUse
+          have positionBound : position < generated.instructions.size :=
+            (Array.getElem?_eq_some_iff.mp found).1
+          omega
+      | inr terminatorUse =>
+          have syntaxFacts := Lower.CodeTrace.retSyntax_of_match syntaxMatched
+          rw [syntaxFacts.2] at terminatorUse
+          cases terminatorUse.2 with
+          | ret => exact inputContainsReg_of_translateAtom syntaxFacts.1
+  | tailCallCase site block input entryValueCount address arguments generated =>
+      intro _ _ syntaxMatched _ value position _ member future
+      simp only [Lower.CodeTrace.headBlock] at member
+      simp only [Lower.CodeTrace.entryPc] at future
+      cases Liveness.mem_blockUses member with
+      | inl instructionUse =>
+          obtain ⟨instruction, found, _⟩ := instructionUse
+          have positionBound : position < generated.instructions.size :=
+            (Array.getElem?_eq_some_iff.mp found).1
+          omega
+      | inr terminatorUse =>
+          obtain ⟨targetArguments, translated, terminator⟩ :=
+            Lower.CodeTrace.tailCallSyntax_of_match syntaxMatched
+          rw [terminator] at terminatorUse
+          cases terminatorUse.2 with
+          | tailCall member =>
+              exact inputContainsReg_of_translateAtoms translated member
+  | tailCallSelfCase site block input entryValueCount arguments generated =>
+      intro _ _ syntaxMatched _ value position _ member future
+      simp only [Lower.CodeTrace.headBlock] at member
+      simp only [Lower.CodeTrace.entryPc] at future
+      cases Liveness.mem_blockUses member with
+      | inl instructionUse =>
+          obtain ⟨instruction, found, _⟩ := instructionUse
+          have positionBound : position < generated.instructions.size :=
+            (Array.getElem?_eq_some_iff.mp found).1
+          omega
+      | inr terminatorUse =>
+          obtain ⟨targetArguments, translated, terminator⟩ :=
+            Lower.CodeTrace.tailCallSelfSyntax_of_match syntaxMatched
+          rw [terminator] at terminatorUse
+          cases terminatorUse.2 with
+          | tailCallSelf member =>
+              exact inputContainsReg_of_translateAtoms translated member
+  | letOpCase site block input nextInput entryValueCount operation targetIndex
+      targetInstruction next ih =>
+      intro instructionsMatched mapsMatched syntaxMatched branchesMatched
+        value position valueBound member future
+      simp only [Lower.CodeTrace.entryValueCount] at valueBound
+      simp only [Lower.CodeTrace.headBlock] at member
+      simp only [Lower.CodeTrace.entryPc] at future
+      have localMatch :=
+        Lower.CodeTrace.letOpMatch_of_match instructionsMatched
+      have operationSyntax :=
+        Lower.CodeTrace.letOpOperationSyntax_of_match syntaxMatched
+      by_cases current : position = targetIndex
+      · subst position
+        cases Liveness.mem_blockUses member with
+        | inl instructionUse =>
+            obtain ⟨instruction, found, operand⟩ := instructionUse
+            have instructionEq : instruction = targetInstruction :=
+              Option.some.inj (found.symm.trans localMatch.instructionAt)
+            subst instruction
+            exact inputContainsReg_of_operationSyntax operationSyntax operand
+        | inr terminatorUse =>
+            have positionBound : targetIndex <
+                next.headBlock.2.instructions.size :=
+              (Array.getElem?_eq_some_iff.mp localMatch.instructionAt).1
+            have terminatorPosition : targetIndex =
+                next.headBlock.2.instructions.size := terminatorUse.1
+            omega
+      · cases binderEq :
+          Lower.Instr.baselineBinderAtom entryValueCount targetInstruction with
+        | none =>
+            simp [Lower.CodeTrace.inputMapsMatch, binderEq] at mapsMatched
+        | some head =>
+            have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+              mapsMatched binderEq
+            have nextSyntax :=
+              (Lower.CodeTrace.letOpSyntax_of_match syntaxMatched).2
+            have nextBranches : next.switchBranchesMatch = true := by
+              simpa [Lower.CodeTrace.switchBranchesMatch] using branchesMatched
+            have nextValueBound : value < next.entryValueCount := by
+              rw [localMatch.nextValueCount]
+              omega
+            have nextFuture : next.entryPc ≤ position := by
+              rw [localMatch.nextPc]
+              omega
+            obtain ⟨sourceIndex, nextAt⟩ := ih localMatch.nextInstructions
+              mapFacts.2.2.2 nextSyntax nextBranches nextValueBound member
+                nextFuture
+            have nextInputAt : nextInput[sourceIndex]? =
+                some (some (Atom.reg value)) := by
+              simpa [localMatch.nextInput] using nextAt
+            have extendedAt := mapFacts.2.2.1 sourceIndex (.reg value)
+              nextInputAt
+            exact inputContainsReg_of_singletonAppend
+              (baselineBinderAtom_ne_reg_of_lt binderEq valueBound) extendedAt
+  | switchCase site block input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children _ =>
+      intro _ _ syntaxMatched branchesMatched value position _ member future
+      simp only [Lower.CodeTrace.headBlock] at member
+      simp only [Lower.CodeTrace.entryPc] at future
+      cases Liveness.mem_blockUses member with
+      | inl instructionUse =>
+          obtain ⟨instruction, found, _⟩ := instructionUse
+          have positionBound : position < generated.instructions.size :=
+            (Array.getElem?_eq_some_iff.mp found).1
+          omega
+      | inr terminatorUse =>
+          exact inputContainsReg_of_switchTerminator syntaxMatched
+            branchesMatched terminatorUse.2
+
+/-- Checked lowering traces account for every target register that remains
+observable at a related runtime frame. This is the static coverage fact used
+when a call turns that frame into framed source roots. -/
+theorem LiveFrameInputCoverage.ofCodeState
+    {functionTrace : Lower.FunctionTrace} {trace : Lower.CodeTrace}
+    {source : List RVal} {frame : Frame}
+    (state : Lower.Sim.CodeStateRel functionTrace trace source frame)
+    (descendant : functionTrace.root.Descendant trace) :
+    LiveFrameInputCoverage trace.sourceInputMap frame := by
+  intro index live indexBound
+  obtain ⟨block, blockAt, ⟨useValue, usePosition⟩, member, same, future⟩ :=
+    live
+  simp only at same
+  subst useValue
+  have exactBlock := state.blockAt descendant
+  have blockEq : block = trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  subst block
+  have valueBound : index < trace.entryValueCount := by
+    simpa [state.valueCount] using indexBound
+  have traceFuture : trace.entryPc ≤ usePosition := by
+    simpa [state.pc] using future
+  exact codeTrace_inputCoversFutureUse trace
+    (functionTrace.descendantInstructionsMatch descendant)
+    (functionTrace.descendantInputMapsMatch descendant)
+    (functionTrace.descendantSyntaxMatches descendant)
+    (functionTrace.descendantSwitchBranchesMatch descendant)
+    valueBound member traceFuture
+
+/-- Pending over-application arguments are all observable; a resume frame
+needs only its future-live registers. -/
+inductive LiveContinuationSupportedByRoots (roots : List IxIR1.Sim.Root) :
+    Continuation → Prop where
+  | resume {frame : Frame} :
+      LiveFrameSupportedByRoots roots frame →
+      LiveContinuationSupportedByRoots roots (.resume frame)
+  | applyMore {arguments : Array RVal} {frame : Frame} :
+      (∀ value ∈ arguments.toList, ValueSupportedByRoots roots value) →
+      LiveFrameSupportedByRoots roots frame →
+      LiveContinuationSupportedByRoots roots (.applyMore arguments frame)
+
+/-- The aggregate framed-root suffix supports every observable value in the
+target continuation stack. -/
+inductive LiveStackSupportedByRoots (roots : List IxIR1.Sim.Root) :
+    List Continuation → Prop where
+  | nil : LiveStackSupportedByRoots roots []
+  | cons {continuation : Continuation} {stack : List Continuation} :
+      LiveContinuationSupportedByRoots roots continuation →
+      LiveStackSupportedByRoots roots stack →
+      LiveStackSupportedByRoots roots (continuation :: stack)
+
+namespace LiveFrameSupportedByRoots
+
+private theorem ownedRoot_mem
+    {capabilities : Array Lower.BindingCap} {source : List RVal}
+    {index : Nat} {world : Ixon.Owned} {value : RVal}
+    (capabilityAt : capabilities[index]? = some (.owned world))
+    (sourceAt : source[index]? = some value) :
+    (⟨world, value⟩ : IxIR1.Sim.Root) ∈
+      Lower.Sim.rootsForCapabilities capabilities.toList source := by
+  have moved := Lower.Sim.rootsForCapabilities_setDead_perm
+    (capabilities := capabilities.toList) (source := source)
+    (index := index) (world := world) (value := value)
+    (by simpa using capabilityAt) (by simpa using sourceAt)
+  exact moved.mem_iff.mp (by simp)
+
+/-- At a checked no-borrow suspension point, environment correspondence and
+live-input coverage turn the producer's surviving capability vector into
+root support for the suspended target frame. -/
+theorem ofNoBorrows
+    {position : Lower.PositionTrace} {site : Lower.SourceSite}
+    {block : BlockId} {target : Lower.TargetPosition}
+    {store : IxIR1.Store} {source : List RVal}
+    {input : Lower.Sim.EnvMap} {frameRoots : List IxIR1.Sim.Root}
+    {frame : Frame}
+    (coordinate : position.coordinateMatches site block target input = true)
+    (environments : Lower.Sim.EnvRel source frame.values input)
+    (invariant : Lower.Sim.SourceOwnershipInvariant store source input
+      position.sourceCapabilities frameRoots)
+    (noBorrows : Lower.noBorrows position.sourceCapabilities = true)
+    (coverage : LiveFrameInputCoverage input frame)
+    (noCredits : frame.credits = #[]) :
+    LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities position.sourceCapabilities.toList
+        source)
+      frame := by
+  refine ⟨?_, noCredits⟩
+  intro index value live valueAt
+  cases value with
+  | lit literal => trivial
+  | erased => trivial
+  | loc location =>
+      have registerBound : index < frame.values.size :=
+        (Array.getElem?_eq_some_iff.mp valueAt).1
+      obtain ⟨sourceIndex, inputAt⟩ := coverage live registerBound
+      have inputBound : sourceIndex < input.size :=
+        (Array.getElem?_eq_some_iff.mp inputAt).1
+      have capabilitySize :=
+        position.sourceCapabilities_size_of_coordinateMatch coordinate
+      have capabilityBound : sourceIndex < position.sourceCapabilities.size :=
+        by simpa [capabilitySize] using inputBound
+      generalize capabilityEq :
+        position.sourceCapabilities[sourceIndex] = capability
+      have capabilityAt : position.sourceCapabilities[sourceIndex]? =
+          some capability := by
+        have found := Array.getElem?_eq_getElem capabilityBound
+        rw [capabilityEq] at found
+        exact found
+      have sourceBound : sourceIndex < source.length := by
+        rw [invariant.length, capabilitySize]
+        exact inputBound
+      let sourceValue := source[sourceIndex]
+      have sourceAt : source[sourceIndex]? = some sourceValue := by
+        simp [sourceValue]
+      have sourceResolved := environments sourceIndex sourceValue (.reg index)
+        sourceAt inputAt
+      have targetResolved : Eval.resolveAtom frame.values (.reg index) =
+          .ok (.loc location) := by
+        simp [Eval.resolveAtom, valueAt]
+      have sourceValueEq : sourceValue = .loc location :=
+        Except.ok.inj (sourceResolved.symm.trans targetResolved)
+      have capabilityMatches :
+          capability.matchesInput (some (.reg index)) = true := by
+        unfold Lower.PositionTrace.coordinateMatches at coordinate
+        simp only [Bool.and_eq_true] at coordinate
+        have point := List.all_eq_true.mp coordinate.2 sourceIndex
+          (List.mem_range.mpr inputBound)
+        simpa [capabilityAt, inputAt] using point
+      cases capability with
+      | scalar =>
+          have holds := invariant.holds capabilityAt sourceAt
+          rw [sourceValueEq] at holds
+          simp [Lower.Sim.CapabilityHolds, IxIR1.Sim.rvalLocation?] at holds
+      | owned world =>
+          refine ⟨world, ?_⟩
+          rw [← sourceValueEq]
+          exact ownedRoot_mem capabilityAt sourceAt
+      | borrowed world lender =>
+          have listAt : position.sourceCapabilities.toList[sourceIndex]? =
+              some (.borrowed world lender) := by
+            simpa using capabilityAt
+          have member : (.borrowed world lender : Lower.BindingCap) ∈
+              position.sourceCapabilities.toList :=
+            List.mem_of_getElem? listAt
+          unfold Lower.noBorrows at noBorrows
+          have point := List.all_eq_true.mp noBorrows _ member
+          simp [Lower.BindingCap.isBorrowed] at point
+      | dead =>
+          simp [Lower.BindingCap.matchesInput] at capabilityMatches
+
+/-- A value-producing suspension whose checked successor prepends one owned
+result capability supports every register that is live in the suspended
+caller. Call and self-call audits instantiate this common trace argument. -/
+private theorem ofSuspensionCore
+    {callerTrace : Lower.FunctionTrace}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next))
+    {after : Lower.PositionTrace}
+    (afterCoordinate : after.coordinateMatches next.source next.sourceBlock
+      next.targetPosition next.sourceInputMap = true)
+    {store : IxIR1.Store} {source : List RVal}
+    {remaining : Array Lower.BindingCap} {resultWorld : Ixon.Owned}
+    (afterCapabilities :
+      #[.owned resultWorld] ++ remaining = after.sourceCapabilities)
+    (remainingSize : remaining.size = input.size)
+    (remainingHolds :
+      ∀ {sourceIndex : Nat} {capability : Lower.BindingCap}
+        {selected : RVal},
+        remaining[sourceIndex]? = some capability →
+        source[sourceIndex]? = some selected →
+        Lower.Sim.CapabilityHolds store capability selected)
+    (noBorrows : Lower.noBorrows remaining = true)
+    {frame : Frame}
+    (state : Lower.Sim.CodeStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) source frame)
+    (binder : Lower.Instr.baselineBinderAtom entryValueCount instruction =
+      some (.reg entryValueCount))
+    (delta : Lower.Instr.baselineValueDelta instruction = some 1)
+    (noCredits : frame.credits = #[]) :
+    LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities remaining.toList source)
+      { frame with pc := frame.pc + 1 } := by
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have localMatch := callerTrace.descendantLetOpMatch descendant
+  have mapFacts := Lower.CodeTrace.inputMapForgets_of_match
+    (callerTrace.descendantInputMapsMatch descendant) binder
+  refine ⟨?_, by simpa using noCredits⟩
+  intro targetValue runtimeValue live valueAt
+  change ValueLiveFrom frame.definition frame.block (frame.pc + 1)
+    targetValue at live
+  change frame.values[targetValue]? = some runtimeValue at valueAt
+  have targetBound : targetValue < frame.values.size :=
+    (Array.getElem?_eq_some_iff.mp valueAt).1
+  have entryBound : targetValue < entryValueCount := by
+    simpa [Lower.CodeTrace.entryValueCount, state.valueCount] using targetBound
+  obtain ⟨liveBlock, liveBlockAt, ⟨useValue, usePosition⟩, useMember,
+      useValueEq, liveFuture⟩ := live
+  simp only at useValueEq
+  subst useValue
+  have exactBlock := state.blockAt descendant
+  have liveBlockEq : liveBlock = next.headBlock.2 := by
+    apply Option.some.inj
+    exact liveBlockAt.symm.trans (by
+      simpa [Lower.CodeTrace.headBlock] using exactBlock)
+  subst liveBlock
+  have nextFuture : next.entryPc ≤ usePosition := by
+    rw [localMatch.1.nextPc]
+    have framePc : frame.pc = index := by
+      simpa [Lower.CodeTrace.entryPc] using state.pc
+    simpa [framePc] using liveFuture
+  have nextValueBound : targetValue < next.entryValueCount := by
+    rw [localMatch.1.nextValueCount, delta]
+    simp only [Option.getD]
+    omega
+  obtain ⟨sourceMapIndex, nextAt⟩ := codeTrace_inputCoversFutureUse next
+    (callerTrace.descendantInstructionsMatch nextDescendant)
+    (callerTrace.descendantInputMapsMatch nextDescendant)
+    (callerTrace.descendantSyntaxMatches nextDescendant)
+    (callerTrace.descendantSwitchBranchesMatch nextDescendant)
+    nextValueBound useMember nextFuture
+  have nextInputAt : nextInput[sourceMapIndex]? =
+      some (some (Atom.reg targetValue)) := by
+    simpa [localMatch.1.nextInput] using nextAt
+  cases sourceMapIndex with
+  | zero =>
+      have resultRegister : nextInput[0]? =
+          some (some (Atom.reg entryValueCount)) := by
+        simpa using mapFacts.2.1
+      have impossible : entryValueCount = targetValue := by
+        simpa using resultRegister.symm.trans nextInputAt
+      omega
+  | succ sourceIndex =>
+      have extendedAt := mapFacts.2.2.1 (sourceIndex + 1)
+        (.reg targetValue) nextInputAt
+      have inputAt : input[sourceIndex]? =
+          some (some (Atom.reg targetValue)) := by
+        simpa [Array.getElem?_append] using extendedAt
+      have inputBound : sourceIndex < input.size :=
+        (Array.getElem?_eq_some_iff.mp inputAt).1
+      have remainingBound : sourceIndex < remaining.size := by
+        rw [remainingSize]
+        exact inputBound
+      generalize capabilityEq : remaining[sourceIndex] = capability
+      have capabilityAt : remaining[sourceIndex]? = some capability := by
+        have found := Array.getElem?_eq_getElem remainingBound
+        rw [capabilityEq] at found
+        exact found
+      have afterCapabilityAt : after.sourceCapabilities[sourceIndex + 1]? =
+          some capability := by
+        rw [← afterCapabilities]
+        simpa [Array.getElem?_append] using capabilityAt
+      have nextInputBound : sourceIndex + 1 < next.sourceInputMap.size :=
+        (Array.getElem?_eq_some_iff.mp nextAt).1
+      have capabilityMatches :
+          capability.matchesInput (some (.reg targetValue)) = true := by
+        unfold Lower.PositionTrace.coordinateMatches at afterCoordinate
+        simp only [Bool.and_eq_true] at afterCoordinate
+        have point := List.all_eq_true.mp afterCoordinate.2
+          (sourceIndex + 1) (List.mem_range.mpr nextInputBound)
+        simpa [afterCapabilityAt, nextAt] using point
+      have sourceCount : source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using state.sourceCount
+      have sourceBound : sourceIndex < source.length := by
+        rw [sourceCount]
+        exact inputBound
+      let sourceValue := source[sourceIndex]
+      have sourceAt : source[sourceIndex]? = some sourceValue := by
+        simp [sourceValue]
+      have sourceResolved := state.environments sourceIndex sourceValue
+        (.reg targetValue) sourceAt inputAt
+      have targetResolved : Eval.resolveAtom frame.values (.reg targetValue) =
+          .ok runtimeValue := by
+        simp [Eval.resolveAtom, valueAt]
+      have sourceValueEq : sourceValue = runtimeValue :=
+        Except.ok.inj (sourceResolved.symm.trans targetResolved)
+      cases runtimeValue with
+      | lit literal => trivial
+      | erased => trivial
+      | loc location =>
+          cases capability with
+          | scalar =>
+              have holds := remainingHolds capabilityAt sourceAt
+              rw [sourceValueEq] at holds
+              simp [Lower.Sim.CapabilityHolds,
+                IxIR1.Sim.rvalLocation?] at holds
+          | owned world =>
+              refine ⟨world, ?_⟩
+              rw [← sourceValueEq]
+              exact ownedRoot_mem capabilityAt sourceAt
+          | borrowed world lender =>
+              have listAt : remaining.toList[sourceIndex]? =
+                  some (.borrowed world lender) := by
+                simpa using capabilityAt
+              have member : (.borrowed world lender : Lower.BindingCap) ∈
+                  remaining.toList := List.mem_of_getElem? listAt
+              unfold Lower.noBorrows at noBorrows
+              have point := List.all_eq_true.mp noBorrows _ member
+              simp [Lower.BindingCap.isBorrowed] at point
+          | dead =>
+              simp [Lower.BindingCap.matchesInput] at capabilityMatches
+
+/-- At an ordinary call, checked map progression and the audited
+consume/result transition make the caller frame's future-live registers
+exactly the roots framed around the callee. The not-yet-returned result slot
+is excluded by the suspended frame's old value bound. -/
+theorem ofCallSuspension
+    {checked : Lower.Checked} {callerTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace} {signature : Signature}
+    (signatureAt : Lower.targetSignature?
+      checked.artifact.program.declarations sourceAddress = some signature)
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next))
+    {before : Lower.PositionTrace}
+    (beforeMember : before ∈ checked.artifact.trace.positions)
+    (beforeCoordinate : before.coordinateMatches site blockId
+      (.instruction index) input = true)
+    {store : IxIR1.Store} {source values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : Lower.Sim.SourceOwnershipInvariant store source input
+      before.sourceCapabilities frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values)
+    {remaining : Array Lower.BindingCap}
+    (consumed : Lower.callRemainingCapabilities? before.sourceCapabilities
+      input signature sourceArguments = some remaining)
+    (noBorrows : Lower.noBorrows remaining = true)
+    {frame : Frame}
+    (state : Lower.Sim.CodeStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next) source frame)
+    (noCredits : frame.credits = #[]) :
+    LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities remaining.toList source)
+      { frame with pc := frame.pc + 1 } := by
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position callerMember nextDescendant
+  have transition := checked.callTransition callerMember signatureAt descendant
+    beforeMember beforeCoordinate afterMember afterCoordinate
+  unfold Lower.PositionTrace.callResultMatches at transition
+  rw [consumed] at transition
+  simp only [Bool.and_eq_true, beq_iff_eq] at transition
+  have remainingFacts := invariant.callRemainingHolds resolved consumed
+  have capabilitySize : before.sourceCapabilities.size = input.size :=
+    before.sourceCapabilities_size_of_coordinateMatch beforeCoordinate
+  have remainingSize : remaining.size = input.size :=
+    remainingFacts.1.trans capabilitySize
+  exact ofSuspensionCore descendant afterCoordinate transition.2 remainingSize
+    remainingFacts.2 noBorrows state (by rfl) (by rfl) noCredits
+
+/-- A recursive self-call has the same suspended-caller root guarantee as an
+addressed call, with the retained function's own signature supplying the
+argument and result worlds. -/
+theorem ofCallSelfSuspension
+    {checked : Lower.Checked} {callerTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+    {before : Lower.PositionTrace}
+    (beforeMember : before ∈ checked.artifact.trace.positions)
+    (beforeCoordinate : before.coordinateMatches site blockId
+      (.instruction index) input = true)
+    {store : IxIR1.Store} {source values : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (invariant : Lower.Sim.SourceOwnershipInvariant store source input
+      before.sourceCapabilities frameRoots)
+    (resolved : IxIR1.resolveAtoms source sourceArguments = .ok values)
+    {remaining : Array Lower.BindingCap}
+    (consumed : Lower.callRemainingCapabilities? before.sourceCapabilities
+      input callerTrace.generated.signature sourceArguments = some remaining)
+    (noBorrows : Lower.noBorrows remaining = true)
+    {frame : Frame}
+    (state : Lower.Sim.CodeStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      source frame)
+    (noCredits : frame.credits = #[]) :
+    LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities remaining.toList source)
+      { frame with pc := frame.pc + 1 } := by
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position callerMember nextDescendant
+  have transition := checked.callSelfTransition callerMember descendant
+    beforeMember beforeCoordinate afterMember afterCoordinate
+  unfold Lower.PositionTrace.callResultMatches at transition
+  rw [consumed] at transition
+  simp only [Bool.and_eq_true, beq_iff_eq] at transition
+  have remainingFacts := invariant.callRemainingHolds resolved consumed
+  have capabilitySize : before.sourceCapabilities.size = input.size :=
+    before.sourceCapabilities_size_of_coordinateMatch beforeCoordinate
+  have remainingSize : remaining.size = input.size :=
+    remainingFacts.1.trans capabilitySize
+  exact ofSuspensionCore descendant afterCoordinate transition.2 remainingSize
+    remainingFacts.2 noBorrows state (by rfl) (by rfl) noCredits
+
+/-- A checked PAP application derives the first callee's ownership and the
+caller resume frame's live-root support from one common producer position.
+Keeping the two facts indexed by the same residual capability vector is what
+lets a compiler stack witness remember the dynamic call precisely. -/
+theorem applyPapEntry
+    {checked : Lower.Checked} {callerTrace calleeTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ checked.artifact.trace.functions)
+    (calleeMember : calleeTrace ∈ checked.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {sourceArguments : Array IxIR1.Atom}
+    {targetFunction : Atom} {targetArguments : Array Atom}
+    {next : Lower.CodeTrace}
+    (descendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {store retainedStore readyStore : IxIR1.Store}
+    {source : List RVal} {location rc : Nat}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {arguments supplied residual : List RVal}
+    {frameRoots : List IxIR1.Sim.Root}
+    (ownership : Lower.Sim.SourceOwnershipAt
+      checked.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      store source frameRoots)
+    (functionResolved : IxIR1.resolveAtom source sourceFunction =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms source sourceArguments =
+      .ok arguments)
+    (papAt : store.get? location =
+      some ⟨.shared, rc, .papN address arity captured⟩)
+    (retained : IxIR1.dupVals store captured.toList = .ok retainedStore)
+    (released : IxIR1.dropVal sourceContext sourceFuel retainedStore
+      (.loc location) = .ok readyStore)
+    (split : captured.toList ++ arguments = supplied ++ residual)
+    (entryArity : supplied.length =
+      calleeTrace.generated.signature.params.size)
+    (papSafe : calleeTrace.generated.signature.papSafe = true)
+    {frame : Frame}
+    (state : Lower.Sim.CodeStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) source frame)
+    (noCredits : frame.credits = #[]) :
+    ∃ remaining : Array Lower.BindingCap,
+      IxIR1.Sim.RootOwnership readyStore
+          (IxIR1.Sim.rootsFor .shared supplied ++
+            IxIR1.Sim.rootsFor .shared residual ++
+            Lower.Sim.rootsForCapabilities remaining.toList source ++
+              frameRoots) ∧
+        Lower.Sim.SourceOwnershipAt checked.artifact.trace.positions
+          calleeTrace.root readyStore supplied.reverse
+          (IxIR1.Sim.rootsFor .shared residual ++
+            Lower.Sim.rootsForCapabilities remaining.toList source ++
+              frameRoots) ∧
+        LiveFrameSupportedByRoots
+          (Lower.Sim.rootsForCapabilities remaining.toList source)
+          { frame with pc := frame.pc + 1 } := by
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    checked.position callerMember nextDescendant
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    checked.applyTransition callerMember descendant afterMember afterCoordinate
+  unfold Lower.PositionTrace.applyResultMatches at transition
+  unfold Lower.applyCapabilities? at transition
+  cases functionConsumed : Lower.consumeCapability?
+      before.sourceCapabilities input .shared sourceFunction with
+  | none => simp [functionConsumed] at transition
+  | some afterFunction =>
+      simp only [functionConsumed, Option.bind_eq_bind,
+        Option.bind_some] at transition
+      cases argumentsConsumed : Lower.consumeCapabilitiesList? afterFunction
+          input .shared sourceArguments.toList with
+      | none => simp [argumentsConsumed] at transition
+      | some remaining =>
+          simp only [argumentsConsumed, Option.bind_some] at transition
+          change (Lower.noBorrows (#[.owned .shared] ++ remaining) &&
+            (#[.owned .shared] ++ remaining ==
+              after.sourceCapabilities)) = true at transition
+          simp only [Bool.and_eq_true, beq_iff_eq] at transition
+          have beforeInvariant := ownership before beforeMember (by
+            simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+              Lower.CodeTrace.targetPosition,
+              Lower.CodeTrace.sourceInputMap] using beforeCoordinate)
+          change Lower.Sim.SourceOwnershipInvariant store source input
+            before.sourceCapabilities frameRoots at beforeInvariant
+          have readyOwnership := beforeInvariant.preparePapEntry
+            functionResolved argumentsResolved functionConsumed
+              argumentsConsumed papAt retained released split
+          have entryShape : Lower.entryCapabilities
+              calleeTrace.generated.signature =
+                Array.replicate supplied.length (.owned .shared) := by
+            simpa [entryArity] using
+              checked.papSafeEntryCapabilities calleeMember papSafe
+          have calleeOwnership : Lower.Sim.SourceOwnershipAt
+              checked.artifact.trace.positions calleeTrace.root readyStore
+              supplied.reverse
+              (IxIR1.Sim.rootsFor .shared residual ++
+                Lower.Sim.rootsForCapabilities remaining.toList source ++
+                  frameRoots) := by
+            intro entry entryMember entryCoordinate
+            rw [checked.entryCapabilities calleeMember entryMember
+              entryCoordinate]
+            exact Lower.Sim.SourceOwnershipInvariant.sharedEntry entryShape
+              (by simpa [List.append_assoc] using readyOwnership)
+          have remainingFacts := beforeInvariant.applyRemainingHolds
+            functionResolved argumentsResolved functionConsumed
+              argumentsConsumed
+          have capabilitySize : before.sourceCapabilities.size = input.size :=
+            before.sourceCapabilities_size_of_coordinateMatch beforeCoordinate
+          have remainingSize : remaining.size = input.size :=
+            remainingFacts.1.trans capabilitySize
+          have remainingNoBorrows : Lower.noBorrows remaining = true := by
+            have fullNoBorrows := transition.1
+            simp [Lower.noBorrows] at fullNoBorrows
+            simpa [Lower.noBorrows] using fullNoBorrows.2
+          have suspended := ofSuspensionCore descendant afterCoordinate
+            transition.2 remainingSize remainingFacts.2 remainingNoBorrows
+              state (by rfl) (by rfl) noCredits
+          exact ⟨remaining, readyOwnership, calleeOwnership, suspended⟩
+
+theorem mono {before after : List IxIR1.Sim.Root} {frame : Frame}
+    (supported : LiveFrameSupportedByRoots before frame)
+    (subset : ∀ root ∈ before, root ∈ after) :
+    LiveFrameSupportedByRoots after frame := by
+  exact ⟨fun live found => (supported.values live found).mono subset,
+    supported.noCredits⟩
+
+/-- Live-frame root support discharges the reuse planner's mapped-value
+obligation whenever every planner-observable register is live at the current
+coordinate. Only location values consume the root-support evidence. -/
+theorem mappedValuesInRoots {shape : Reuse.Shape}
+    {roots : List IxIR1.Sim.Root} {frame : Frame}
+    (supported : LiveFrameSupportedByRoots roots frame)
+    (live : ∀ {sourceId : ValueId}, PlannerValueRelevant shape sourceId →
+      ValueLiveFrom frame.definition frame.block frame.pc sourceId) :
+    MappedValuesInRoots shape frame.values roots := by
+  intro sourceId targetId sourceValue relevant _translated found
+  have valueSupported := supported.values (live relevant) found
+  cases sourceValue with
+  | loc location => exact valueSupported
+  | lit literal => trivial
+  | erased => trivial
+
+/-- At the accepted allocation coordinate, syntax alone supplies the
+planner-liveness premise needed to turn active-frame root support into the
+physical macro's mapped-value evidence. -/
+theorem mappedValuesAtPlannerAllocation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function} {blockId : Nat}
+    {block : Block} (site : Reuse.Site limits validation block)
+    (blockAt : source.blocks[blockId]? = some block)
+    {roots : List IxIR1.Sim.Root} {frame : Frame}
+    (supported : LiveFrameSupportedByRoots roots frame)
+    (definition : frame.definition = source)
+    (frameBlock : frame.block = blockId)
+    (pc : frame.pc = site.shape.releasePosition + 1) :
+    MappedValuesInRoots site.shape frame.values roots := by
+  apply supported.mappedValuesInRoots
+  intro sourceId relevant
+  simpa [definition, frameBlock, pc] using
+    plannerValueLiveAtAllocation site blockAt relevant
+
+end LiveFrameSupportedByRoots
+
+namespace LiveContinuationSupportedByRoots
+
+theorem mono {before after : List IxIR1.Sim.Root}
+    {continuation : Continuation}
+    (supported : LiveContinuationSupportedByRoots before continuation)
+    (subset : ∀ root ∈ before, root ∈ after) :
+    LiveContinuationSupportedByRoots after continuation := by
+  cases supported with
+  | resume frame => exact .resume (frame.mono subset)
+  | applyMore arguments frame =>
+      exact .applyMore
+        (fun value member => (arguments value member).mono subset)
+        (frame.mono subset)
+
+end LiveContinuationSupportedByRoots
+
+namespace LiveStackSupportedByRoots
+
+theorem mono {before after : List IxIR1.Sim.Root}
+    {stack : List Continuation}
+    (supported : LiveStackSupportedByRoots before stack)
+    (subset : ∀ root ∈ before, root ∈ after) :
+    LiveStackSupportedByRoots after stack := by
+  induction supported with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (head.mono subset) ih
+
+end LiveStackSupportedByRoots
+
+namespace ValueSupportedByRoots
+
+/-- Root support and exact ownership make a supported value live. -/
+theorem liveRVal {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    {value : RVal} (supported : ValueSupportedByRoots roots value)
+    (ownership : IxIR1.Sim.RootOwnership store roots) :
+    IxIR1.Sim.LiveRVal store value := by
+  cases value with
+  | loc location =>
+      obtain ⟨world, member⟩ := supported
+      obtain ⟨box, found, _world⟩ := ownership.roots_world
+        ⟨world, .loc location⟩ member
+      exact ⟨box, found⟩
+  | lit literal => trivial
+  | erased => trivial
+
+end ValueSupportedByRoots
+
+private theorem rValIso_toHeapIso_of_live
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {baselineValue rewrittenValue : RVal}
+    (related : IxIR1.Sim.RValIso history.locRel baselineValue rewrittenValue)
+    (live : IxIR1.Sim.LiveRVal baselineStore baselineValue) :
+    IxIR1.Sim.RValIso (history.toHeapIso closed).locRel
+      baselineValue rewrittenValue := by
+  cases related with
+  | @loc baselineLocation rewrittenLocation locations =>
+      obtain ⟨box, found⟩ := live
+      exact .loc (history.toHeapIso_rel closed locations found)
+  | lit => exact .lit
+  | erased => exact .erased
+
+private theorem rvalsIso_toHeapIso_of_supported
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership baselineStore roots) :
+    ∀ {baselineValues rewrittenValues : List RVal},
+      IxIR1.Sim.RValsIso history.locRel baselineValues rewrittenValues →
+      (∀ value ∈ baselineValues, ValueSupportedByRoots roots value) →
+      IxIR1.Sim.RValsIso (history.toHeapIso closed).locRel
+        baselineValues rewrittenValues
+  | _, _, .nil, _ => .nil
+  | _, _, .cons head tail, supported => by
+      exact .cons
+        (rValIso_toHeapIso_of_live history closed head
+          ((supported _ (by simp)).liveRVal ownership))
+        (rvalsIso_toHeapIso_of_supported history closed ownership tail
+          fun value member => supported value (by simp [member]))
+
+namespace LiveValuesIso
+
+/-- Drop historical dead rows from a live-register relation when every
+future-observable baseline value is known to denote a live heap slot (or is a
+scalar).  This is the direct adapter used when liveness comes from producer
+capabilities rather than membership in the external root multiset. -/
+theorem toHeapIsoOfLive
+    {source : Function} {blockId pc : Nat}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc history.locRel
+      baseline rewritten)
+    (valueLive : ∀ {index : Nat} {value : RVal},
+      ValueLiveFrom source blockId pc index →
+      baseline[index]? = some value →
+      IxIR1.Sim.LiveRVal baselineStore value) :
+    LiveValuesIso source blockId pc (history.toHeapIso closed).locRel
+      baseline rewritten := by
+  refine ⟨values.length, ?_⟩
+  intro index baselineValue live found
+  obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+    values.related live found
+  exact ⟨rewrittenValue, rewrittenAt,
+    rValIso_toHeapIso_of_live history closed related (valueLive live found)⟩
+
+/-- Drop historical dead rows from a live-register relation when the
+baseline values observed by the frame are supported by exact roots. -/
+theorem toHeapIsoOfSupported
+    {source : Function} {blockId pc : Nat}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership baselineStore roots)
+    {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc history.locRel
+      baseline rewritten)
+    (supported : ∀ {index : Nat} {value : RVal},
+      ValueLiveFrom source blockId pc index →
+      baseline[index]? = some value →
+      ValueSupportedByRoots roots value) :
+    LiveValuesIso source blockId pc (history.toHeapIso closed).locRel
+      baseline rewritten := by
+  exact values.toHeapIsoOfLive history closed fun live found =>
+    (supported live found).liveRVal ownership
+
+end LiveValuesIso
+
+namespace StableLiveFrameIso
+
+/-- Root-supported live registers and an empty credit file allow a frame to
+forget historical dead rows. -/
+theorem toHeapIsoOfSupported
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership baselineStore roots)
+    {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite history.locRel baseline rewritten)
+    (supported : LiveFrameSupportedByRoots roots baseline) :
+    StableLiveFrameIso rewrite (history.toHeapIso closed).locRel
+      baseline rewritten := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    frame.pc, frame.values.toHeapIsoOfSupported history closed ownership
+      (fun live found => supported.values (by
+        simpa [frame.baselineDefinition] using live) found), ?_⟩
+  have rewrittenCreditsSize : rewritten.credits.size = 0 := by
+    simpa [supported.noCredits] using frame.credits.length_eq.symm
+  have rewrittenCredits : rewritten.credits = #[] :=
+    Array.eq_empty_of_size_eq_zero rewrittenCreditsSize
+  rw [supported.noCredits, rewrittenCredits]
+  exact .nil
+
+end StableLiveFrameIso
+
+namespace StableLiveContinuationIso
+
+/-- Root-supported continuation values retain their relation after history
+is restricted to live heap locations. -/
+theorem toHeapIsoOfSupported
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership baselineStore roots)
+    {baseline rewritten : Continuation}
+    (continuation : StableLiveContinuationIso limits validation
+      history.locRel baseline rewritten)
+    (supported : LiveContinuationSupportedByRoots roots baseline) :
+    StableLiveContinuationIso limits validation
+      (history.toHeapIso closed).locRel baseline rewritten := by
+  cases continuation with
+  | resume frame =>
+      cases supported with
+      | resume frameSupported =>
+          cases frame with
+          | rewritten rewrite related =>
+              exact .resume (.rewritten rewrite
+                (related.toHeapIsoOfSupported history closed ownership
+                  frameSupported))
+  | applyMore arguments frame =>
+      cases supported with
+      | applyMore argumentsSupported frameSupported =>
+          cases frame with
+          | rewritten rewrite related =>
+              exact .applyMore
+                (rvalsIso_toHeapIso_of_supported history closed ownership
+                  arguments argumentsSupported)
+                (.rewritten rewrite
+                  (related.toHeapIsoOfSupported history closed ownership
+                    frameSupported))
+
+end StableLiveContinuationIso
+
+namespace StableLiveStackIso
+
+/-- Exact compiler root support lets a suspended-stack relation forget every
+dead/dead allocation-history row and retain only the live heap bijection. -/
+theorem toHeapIsoOfSupported
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso baselineStore rewrittenStore)
+    (closed : IxIR1.Sim.StoreClosed baselineStore)
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership baselineStore roots)
+    {baseline rewritten : List Continuation}
+    (stack : StableLiveStackIso limits validation history.locRel
+      baseline rewritten)
+    (supported : LiveStackSupportedByRoots roots baseline) :
+    StableLiveStackIso limits validation
+      (history.toHeapIso closed).locRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih =>
+      cases supported with
+      | cons headSupported tailSupported =>
+          exact .cons
+            (head.toHeapIsoOfSupported history closed ownership headSupported)
+            (ih tailSupported)
+
+end StableLiveStackIso
+
+private theorem rvalsIso_identity_of_inBounds
+    {store : IxIR1.Store} {locRel : Nat → Nat → Prop}
+    (self : ∀ {location : Nat}, location < store.nodes.size →
+      locRel location location) :
+    ∀ {values : List RVal},
+      IxIR1.Reclamation.ValuesInBounds store values →
+      IxIR1.Sim.RValsIso locRel values values
+  | [], _ => .nil
+  | value :: values, bounds => by
+      have tailBounds : IxIR1.Reclamation.ValuesInBounds store values := by
+        intro found member
+        exact bounds found (by simp [member])
+      have tail := rvalsIso_identity_of_inBounds self tailBounds
+      cases value with
+      | loc location =>
+          exact .cons (.loc (self (bounds (.loc location) (by simp)))) tail
+      | lit literal => exact .cons .lit tail
+      | erased => exact .cons .erased tail
+
+/-- Re-index an equality-related live register file by any identity relation
+that covers the baseline's already-allocated locations. -/
+theorem LiveValuesIso.identityOfInBounds
+    {source : Function} {blockId pc : Nat}
+    {store : IxIR1.Store} {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Array RVal}
+    (values : LiveValuesIso source blockId pc
+      (fun left right => left = right) baseline rewritten)
+    (self : ∀ {location : Nat}, location < store.nodes.size →
+      locRel location location)
+    (bounds : ∀ {index : Nat} {value : RVal},
+      ValueLiveFrom source blockId pc index →
+      baseline[index]? = some value →
+      IxIR1.Reclamation.ValueInBounds store value) :
+    LiveValuesIso source blockId pc locRel baseline rewritten := by
+  refine ⟨values.length, ?_⟩
+  intro index baselineValue live found
+  obtain ⟨rewrittenValue, rewrittenAt, related⟩ :=
+    values.related live found
+  have valueEq := related.eq_of_location_eq
+  subst rewrittenValue
+  refine ⟨baselineValue, rewrittenAt, ?_⟩
+  cases baselineValue with
+  | loc location => exact .loc (self (bounds live found))
+  | lit literal => exact .lit
+  | erased => exact .erased
+
+/-- Re-index an equality-related frame when its future-live baseline values
+are in bounds and its compiler-produced credit file is empty. -/
+theorem StableLiveFrameIso.identityOfInBounds
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {store : IxIR1.Store} {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite (fun left right => left = right)
+      baseline rewritten)
+    (self : ∀ {location : Nat}, location < store.nodes.size →
+      locRel location location)
+    (bounds : ∀ {index : Nat} {value : RVal},
+      ValueLiveFrom source baseline.block baseline.pc index →
+      baseline.values[index]? = some value →
+      IxIR1.Reclamation.ValueInBounds store value)
+    (noCredits : baseline.credits = #[]) :
+    StableLiveFrameIso rewrite locRel baseline rewritten := by
+  have creditsEq : baseline.credits.toList = rewritten.credits.toList :=
+    frame.credits.eq_of_location_eq
+  have baselineCredits : baseline.credits.toList = [] := by
+    simp [noCredits]
+  have rewrittenCredits : rewritten.credits.toList = [] := by
+    rw [← creditsEq]
+    exact baselineCredits
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    frame.pc, frame.values.identityOfInBounds self bounds, ?_⟩
+  rw [baselineCredits, rewrittenCredits]
+  exact .nil
+
+/-- Re-index an equality-related suspended continuation using compiler root
+support for every observable baseline value. -/
+theorem StableLiveContinuationIso.identityOfSupported
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    {locRel : Nat → Nat → Prop}
+    (self : ∀ {location : Nat}, location < store.nodes.size →
+      locRel location location)
+    (ownership : IxIR1.Sim.RootOwnership store roots)
+    {baseline rewritten : Continuation}
+    (continuation : StableLiveContinuationIso limits validation
+      (fun left right => left = right) baseline rewritten)
+    (supported : LiveContinuationSupportedByRoots roots baseline) :
+    StableLiveContinuationIso limits validation locRel baseline rewritten := by
+  cases continuation with
+  | resume frame =>
+      cases supported with
+      | resume support =>
+          cases frame with
+          | rewritten rewrite related =>
+              exact .resume (.rewritten rewrite
+                (related.identityOfInBounds self
+                  (fun live found =>
+                    (support.values (by
+                      simpa [related.baselineDefinition] using live)
+                      found).inBounds ownership)
+                  support.noCredits))
+  | applyMore arguments frame =>
+      cases supported with
+      | applyMore argumentSupport frameSupport =>
+          cases frame with
+          | rewritten rewrite related =>
+              exact .applyMore (by
+                rw [← arguments.eq_of_location_eq]
+                apply rvalsIso_identity_of_inBounds self
+                intro value member
+                exact (argumentSupport value member).inBounds ownership)
+                (.rewritten rewrite
+                (related.identityOfInBounds self
+                  (fun live found =>
+                    (frameSupport.values (by
+                      simpa [related.baselineDefinition] using live)
+                      found).inBounds ownership)
+                  frameSupport.noCredits))
+
+/-- Re-index an equality-related suspended stack using the aggregate compiler
+root ownership that supports all of its observable baseline values. -/
+theorem StableLiveStackIso.identityOfSupported
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    {locRel : Nat → Nat → Prop}
+    (self : ∀ {location : Nat}, location < store.nodes.size →
+      locRel location location)
+    (ownership : IxIR1.Sim.RootOwnership store roots)
+    {baseline rewritten : List Continuation}
+    (stack : StableLiveStackIso limits validation
+      (fun left right => left = right) baseline rewritten)
+    (supported : LiveStackSupportedByRoots roots baseline) :
+    StableLiveStackIso limits validation locRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih =>
+      cases supported with
+      | cons supportedHead supportedTail =>
+          exact .cons
+            (head.identityOfSupported self ownership supportedHead)
+            (ih supportedTail)
+
+/-! The indexed avoidance predicates retain each continuation's source
+function alongside the stable proof. -/
+
+inductive StableLiveContinuationAvoids (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop)
+    (location : Nat) : Continuation → Continuation → Prop where
+  | resume {source : Function}
+      {rewrite : Reuse.FunctionRewrite limits validation source}
+      {baseline rewritten : Frame}
+      (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+      (avoids : LiveValuesAvoidLocation source rewritten.block rewritten.pc
+        location rewritten.values)
+      (credits : FrameCreditsAvoidLocation location rewritten) :
+      StableLiveContinuationAvoids limits validation locRel location
+        (.resume baseline)
+        (.resume rewritten)
+  | applyMore {source : Function}
+      {rewrite : Reuse.FunctionRewrite limits validation source}
+      {baselineArguments rewrittenArguments : Array RVal}
+      {baseline rewritten : Frame}
+      (arguments : IxIR1.Sim.RValsIso locRel
+        baselineArguments.toList rewrittenArguments.toList)
+      (argumentAvoids : ∀ value ∈ rewrittenArguments.toList,
+        value ≠ .loc location)
+      (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+      (avoids : LiveValuesAvoidLocation source rewritten.block rewritten.pc
+        location rewritten.values)
+      (credits : FrameCreditsAvoidLocation location rewritten) :
+      StableLiveContinuationAvoids limits validation locRel location
+        (.applyMore baselineArguments baseline)
+        (.applyMore rewrittenArguments rewritten)
+
+inductive StableLiveStackAvoids (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop)
+    (location : Nat) : List Continuation → List Continuation → Prop where
+  | nil : StableLiveStackAvoids limits validation locRel location [] []
+  | cons {baseline rewritten : Continuation}
+      {baselineTail rewrittenTail : List Continuation}
+      (head : StableLiveContinuationAvoids limits validation locRel location
+        baseline rewritten)
+      (tail : StableLiveStackAvoids limits validation locRel location
+        baselineTail rewrittenTail) :
+      StableLiveStackAvoids limits validation locRel location
+        (baseline :: baselineTail) (rewritten :: rewrittenTail)
+
+namespace StableLiveFrameIso
+
+/-- Exact unit-refcount ownership of the active source excludes its target
+counterpart from every related future-live register and credit slot in a
+suspended frame. -/
+private theorem avoidsOfSupportedUnit {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore baselineStore)
+    {baselineLocation rewrittenLocation : Nat} {node : IxIR1.Node}
+    {roots rest : List IxIR1.Sim.Root}
+    (locations : iso.locRel rewrittenLocation baselineLocation)
+    (found : baselineStore.get? baselineLocation =
+      some ⟨.shared, 1, node⟩)
+    (ownership : IxIR1.Sim.RootOwnership baselineStore
+      (⟨.shared, .loc baselineLocation⟩ :: rest))
+    (rootsInRest : ∀ root ∈ roots, root ∈ rest)
+    {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baseline rewritten)
+    (supported : LiveFrameSupportedByRoots roots baseline) :
+    LiveValuesAvoidLocation source rewritten.block rewritten.pc
+        rewrittenLocation rewritten.values ∧
+      FrameCreditsAvoidLocation rewrittenLocation rewritten := by
+  have baselineAvoids : LiveValuesAvoidLocation source baseline.block
+      baseline.pc baselineLocation baseline.values := by
+    intro index value live valueAt
+    apply (supported.values (by
+      simpa [frame.baselineDefinition] using live) valueAt).avoidsUnitShared
+      rootsInRest found ownership
+  constructor
+  · intro index rewrittenValue live rewrittenAt
+    have rewrittenBound : index < rewritten.values.size :=
+      (Array.getElem?_eq_some_iff.mp rewrittenAt).1
+    have baselineBound : index < baseline.values.size := by
+      rw [frame.values.length]
+      exact rewrittenBound
+    let baselineValue := baseline.values[index]
+    have baselineAt : baseline.values[index]? = some baselineValue := by
+      simp [baselineValue]
+    have baselineLive : ValueLiveFrom source baseline.block baseline.pc index :=
+      by simpa [frame.block, frame.pc] using live
+    obtain ⟨actualRewritten, actualAt, related⟩ :=
+      frame.values.related baselineLive baselineAt
+    have actualEq : actualRewritten = rewrittenValue :=
+      Option.some.inj (actualAt.symm.trans rewrittenAt)
+    subst actualRewritten
+    have baselineDifferent : baselineValue ≠ .loc baselineLocation :=
+      baselineAvoids baselineLive baselineAt
+    have singletonRelated : IxIR1.Sim.RValsIso
+        (fun baselineLocation rewrittenLocation =>
+          iso.locRel rewrittenLocation baselineLocation)
+        [baselineValue] [rewrittenValue] := .cons related .nil
+    exact rvalsIso_right_avoids_of_left iso locations singletonRelated
+      (by
+        intro value member
+        have same : value = baselineValue := by simpa using member
+        subst value
+        exact baselineDifferent)
+      rewrittenValue (by simp)
+  · have rewrittenCreditSize : rewritten.credits.size = 0 := by
+      simpa [supported.noCredits] using frame.credits.length_eq.symm
+    have rewrittenCredits : rewritten.credits = #[] :=
+      Array.eq_empty_of_size_eq_zero rewrittenCreditSize
+    unfold FrameCreditsAvoidLocation
+    rw [rewrittenCredits]
+    trivial
+
+end StableLiveFrameIso
+
+namespace StableLiveContinuationIso
+
+/-- Upgrade one related continuation to the avoidance relation using only
+its baseline framed-root support. -/
+private theorem avoidsOfSupportedUnit {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore baselineStore)
+    {baselineLocation rewrittenLocation : Nat} {node : IxIR1.Node}
+    {roots rest : List IxIR1.Sim.Root}
+    (locations : iso.locRel rewrittenLocation baselineLocation)
+    (found : baselineStore.get? baselineLocation =
+      some ⟨.shared, 1, node⟩)
+    (ownership : IxIR1.Sim.RootOwnership baselineStore
+      (⟨.shared, .loc baselineLocation⟩ :: rest))
+    (rootsInRest : ∀ root ∈ roots, root ∈ rest)
+    {baseline rewritten : Continuation}
+    (continuation : StableLiveContinuationIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baseline rewritten)
+    (supported : LiveContinuationSupportedByRoots roots baseline) :
+    StableLiveContinuationAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation baseline rewritten := by
+  cases continuation with
+  | resume frame =>
+      cases supported with
+      | resume supportedFrame =>
+          cases frame with
+          | rewritten rewrite related =>
+              obtain ⟨valuesAvoid, creditsAvoid⟩ :=
+                related.avoidsOfSupportedUnit iso locations found ownership
+                  rootsInRest supportedFrame
+              exact .resume related valuesAvoid creditsAvoid
+  | applyMore arguments frame =>
+      cases supported with
+      | applyMore supportedArguments supportedFrame =>
+          cases frame with
+          | rewritten rewrite related =>
+              have baselineArgumentAvoids := fun value member =>
+                (supportedArguments value member).avoidsUnitShared
+                  rootsInRest found ownership
+              have rewrittenArgumentAvoids :=
+                rvalsIso_right_avoids_of_left iso locations arguments
+                  baselineArgumentAvoids
+              obtain ⟨valuesAvoid, creditsAvoid⟩ :=
+                related.avoidsOfSupportedUnit iso locations found ownership
+                  rootsInRest supportedFrame
+              exact .applyMore arguments rewrittenArgumentAvoids related
+                valuesAvoid creditsAvoid
+
+end StableLiveContinuationIso
+
+namespace StableLiveStackIso
+
+/-- Turn compiler framed-root support into the precise avoidance witness
+needed to replace one allocation-history pair during physical reuse. Dead
+append-only registers remain outside both the premise and conclusion. -/
+theorem avoidsOfSupportedUnit {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineStore rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore baselineStore)
+    {baselineLocation rewrittenLocation : Nat} {node : IxIR1.Node}
+    {roots rest : List IxIR1.Sim.Root}
+    (locations : iso.locRel rewrittenLocation baselineLocation)
+    (found : baselineStore.get? baselineLocation =
+      some ⟨.shared, 1, node⟩)
+    (ownership : IxIR1.Sim.RootOwnership baselineStore
+      (⟨.shared, .loc baselineLocation⟩ :: rest))
+    (rootsInRest : ∀ root ∈ roots, root ∈ rest)
+    {baseline rewritten : List Continuation}
+    (stack : StableLiveStackIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baseline rewritten)
+    (supported : LiveStackSupportedByRoots roots baseline) :
+    StableLiveStackAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih =>
+      cases supported with
+      | cons supportedHead supportedTail =>
+          exact .cons
+            (head.avoidsOfSupportedUnit iso locations found ownership
+              rootsInRest supportedHead)
+            (ih supportedTail)
+
+end StableLiveStackIso
+
+namespace StableLiveContinuationAvoids
+
+private theorem rvals_transportRelation
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    {baseline rewritten : List RVal}
+    (related : IxIR1.Sim.RValsIso oldRel baseline rewritten)
+    (avoids : ∀ value ∈ rewritten, value ≠ .loc removed)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    IxIR1.Sim.RValsIso newRel baseline rewritten := by
+  induction related with
+  | nil => exact .nil
+  | @cons baselineValue rewrittenValue baselineTail rewrittenTail head tail ih =>
+      have tailAvoid : ∀ value ∈ rewrittenTail,
+          value ≠ IxIR1.RVal.loc removed := by
+        intro value member
+        exact avoids value (by simp [member])
+      have newTail := ih tailAvoid
+      cases head with
+      | @loc baselineLocation rewrittenLocation locationRelated =>
+          have headAvoid : (IxIR1.RVal.loc rewrittenLocation) ≠
+              IxIR1.RVal.loc removed :=
+            avoids _ (by simp)
+          have different : rewrittenLocation ≠ removed := by
+            intro same
+            apply headAvoid
+            cases same
+            rfl
+          exact .cons (.loc (lift locationRelated different)) newTail
+      | lit => exact .cons .lit newTail
+      | erased => exact .cons .erased newTail
+
+/-- Transport one continuation after a physical address is assigned a new
+allocation epoch. -/
+theorem transportRelation {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {removed : Nat} {baseline rewritten : Continuation}
+    (continuation : StableLiveContinuationAvoids limits validation oldRel
+      removed baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveContinuationIso limits validation newRel baseline rewritten := by
+  cases continuation with
+  | resume frame avoids credits =>
+      exact .resume (.rewritten _
+        (frame.transportRelation avoids credits lift))
+  | applyMore arguments argumentAvoids frame avoids credits =>
+      have transportedArguments :=
+        rvals_transportRelation arguments argumentAvoids lift
+      exact .applyMore transportedArguments (.rewritten _
+        (frame.transportRelation avoids credits lift))
+
+end StableLiveContinuationAvoids
+
+namespace StableLiveStackAvoids
+
+/-- Transport a whole suspended stack while imposing no condition on dead
+append-only caller registers. -/
+theorem transportRelation {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {removed : Nat} {baseline rewritten : List Continuation}
+    (stack : StableLiveStackAvoids limits validation oldRel removed baseline
+      rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableLiveStackIso limits validation newRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih =>
+      exact .cons (head.transportRelation lift) ih
+
+end StableLiveStackAvoids
+
+/-- The original all-register continuation relation embeds into the
+live-indexed relation. -/
+theorem StableContinuationIso.toLive {limits : Validate.Limits}
+    {validation : Validate.Context} {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Continuation}
+    (continuation : StableContinuationIso limits validation locRel
+      baseline rewritten) :
+    StableLiveContinuationIso limits validation locRel baseline rewritten := by
+  cases continuation with
+  | resume frame =>
+      cases frame with
+      | rewritten rewrite related =>
+          exact .resume (.rewritten rewrite
+            (StableLiveFrameIso.ofStable related))
+  | applyMore arguments frame =>
+      cases frame with
+      | rewritten rewrite related =>
+          exact .applyMore arguments (.rewritten rewrite
+            (StableLiveFrameIso.ofStable related))
+
+/-- The original all-register stack relation embeds into the live-indexed
+relation. -/
+theorem StableStackIso.toLive {limits : Validate.Limits}
+    {validation : Validate.Context} {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List Continuation}
+    (stack : StableStackIso limits validation locRel baseline rewritten) :
+    StableLiveStackIso limits validation locRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih =>
+      exact .cons (StableContinuationIso.toLive head) ih
+
+/-- Live-indexed stable control states. -/
+inductive StableLiveControlIso (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    Control → Control → Prop where
+  | running {baselineFrame rewrittenFrame : Frame}
+      {baselineStack rewrittenStack : List Continuation}
+      (frame : StableLiveFrameRel limits validation locRel
+        baselineFrame rewrittenFrame)
+      (stack : StableLiveStackIso limits validation locRel
+        baselineStack rewrittenStack) :
+      StableLiveControlIso limits validation locRel
+        (.running baselineFrame baselineStack)
+        (.running rewrittenFrame rewrittenStack)
+  | halted {baselineValue rewrittenValue : RVal}
+      (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+      StableLiveControlIso limits validation locRel
+        (.halted baselineValue) (.halted rewrittenValue)
+
+/-- Machine relation that is stable under physical address reuse in the
+presence of dead suspended registers. -/
+inductive StableLiveMachineRel (limits : Validate.Limits)
+    (validation : Validate.Context) (baseline rewritten : Machine) : Prop where
+  | related (locRel : Nat → Nat → Prop)
+      (heap : StableHeapRel baseline.store rewritten.store locRel)
+      (fuel : baseline.heapFuel ≤ rewritten.heapFuel)
+      (control : StableLiveControlIso limits validation locRel
+        baseline.control rewritten.control) :
+      StableLiveMachineRel limits validation baseline rewritten
+
+theorem StableLiveMachineRel.live_eq {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Machine} (related : StableLiveMachineRel limits validation baseline rewritten) :
+    baseline.store.live = rewritten.store.live := by
+  cases related with
+  | related locRel heap fuel control => exact heap.live_eq
+
+/-- The four instruction forms that may occur inside a recognized baseline
+reuse prefix. They require a block-decision split: an unchanged block advances
+one instruction, while an accepted block is consumed only by its whole macro. -/
+inductive AcceptedPrefixInstruction : Instr → Prop where
+  | fetch (target : Atom) (cid : CtorId) (field : Nat) :
+      AcceptedPrefixInstruction (.fetch target cid field)
+  | retainShared (target : Atom) :
+      AcceptedPrefixInstruction (.retainShared target)
+  | releaseShared (target : Atom) :
+      AcceptedPrefixInstruction (.releaseShared target)
+  | allocShared (cid : CtorId) (arguments : Array Atom) :
+      AcceptedPrefixInstruction (.alloc .shared cid arguments)
+
+/-- A concrete running machine is poised at one instruction belonging to the
+recognized-prefix instruction family. This packages the evaluator-facing
+syntax needed by compiler-aware dispatch without assuming the block itself
+was accepted by the optimizer. -/
+structure AcceptedPrefixInstructionAt (machine : Machine) where
+  frame : Frame
+  stack : List Continuation
+  block : Block
+  instruction : Instr
+  control : machine.control = .running frame stack
+  blockAt : frame.definition.blocks[frame.block]? = some block
+  pc : frame.pc < block.instructions.size
+  instructionAt : block.instructions[frame.pc] = instruction
+  acceptedPrefix : AcceptedPrefixInstruction instruction
+
+/-- At a synchronized frame selected by an accepted rewrite decision, the
+baseline evaluator is still at block entry. This phase condition deliberately
+belongs to synchronization boundaries rather than `StableLiveFrameIso`:
+accepted-prefix proofs relate internal nonzero program counters locally. -/
+def StableLiveFrameIso.AcceptedEntry {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (_frame : StableLiveFrameIso rewrite locRel baseline rewritten) : Prop :=
+  ∀ {helperOffset : Nat} {block : Block}
+      {site : Reuse.Site limits validation block},
+    Reuse.FunctionDecisions.At rewrite.decisions baseline.block
+        helperOffset block (.accepted site) →
+      baseline.pc = 0
+
+/-- Every live frame decomposition of a synchronized machine pair places an
+accepted source block at entry. Quantifying over the decomposition keeps the
+phase fact independent of proof identity while tying its rewrite to both
+concrete controls through `StableLiveFrameIso`. -/
+def StableLiveAcceptedEntry (limits : Validate.Limits)
+    (validation : Validate.Context) (baseline rewritten : Machine) : Prop :=
+  ∀ {locRel : Nat → Nat → Prop} {source : Function}
+      {rewrite : Reuse.FunctionRewrite limits validation source}
+      {baselineFrame rewrittenFrame : Frame}
+      {baselineStack rewrittenStack : List Continuation},
+    baseline.control = .running baselineFrame baselineStack →
+    rewritten.control = .running rewrittenFrame rewrittenStack →
+    (frame : StableLiveFrameIso rewrite locRel baselineFrame rewrittenFrame) →
+    frame.AcceptedEntry
+
+/-- A synchronized pair whose baseline control is at program counter zero
+satisfies the accepted-entry phase independently of its current block. -/
+theorem StableLiveAcceptedEntry.ofPcZero {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation}
+    (control : baseline.control = .running frame stack)
+    (pc : frame.pc = 0) :
+    StableLiveAcceptedEntry limits validation baseline rewritten := by
+  intro locRel source rewrite baselineFrame rewrittenFrame baselineStack
+    rewrittenStack baselineControl _rewrittenControl _related
+  intro helperOffset block site found
+  have controls : Control.running frame stack =
+      .running baselineFrame baselineStack := control.symm.trans baselineControl
+  injection controls with frameEq _stackEq
+  simpa [← frameEq] using pc
+
+/-- A halted baseline has no running accepted-site phase obligation. -/
+theorem StableLiveAcceptedEntry.halted {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {value : RVal} (control : baseline.control = .halted value) :
+    StableLiveAcceptedEntry limits validation baseline rewritten := by
+  intro locRel source rewrite baselineFrame rewrittenFrame baselineStack
+    rewrittenStack baselineControl
+  rw [control] at baselineControl
+  cases baselineControl
+
+/-- A synchronized running pair whose current source and rewritten blocks are
+literally the same has no accepted-site obligation. An accepted decision
+necessarily installs a reset block different from its recognized source
+block. This covers nonzero ordinary successors inside unchanged blocks. -/
+theorem StableLiveAcceptedEntry.ofSameBlock {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation} {block : Block}
+    (baselineControl : baseline.control =
+      .running baselineFrame baselineStack)
+    (rewrittenControl : rewritten.control =
+      .running rewrittenFrame rewrittenStack)
+    (baselineAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (rewrittenAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block) :
+    StableLiveAcceptedEntry limits validation baseline rewritten := by
+  intro locRel source rewrite currentBaseline currentRewritten currentStack
+    currentRewrittenStack currentBaselineControl currentRewrittenControl frame
+  have baselineControls : Control.running baselineFrame baselineStack =
+      .running currentBaseline currentStack :=
+    baselineControl.symm.trans currentBaselineControl
+  have rewrittenControls : Control.running rewrittenFrame rewrittenStack =
+      .running currentRewritten currentRewrittenStack :=
+    rewrittenControl.symm.trans currentRewrittenControl
+  injection baselineControls with baselineFrameEq _baselineStackEq
+  injection rewrittenControls with rewrittenFrameEq _rewrittenStackEq
+  subst currentBaseline
+  subst currentRewritten
+  intro helperOffset selectedBlock site found
+  have sourceAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact baselineAt
+  have targetAt : rewrite.definition.blocks[baselineFrame.block]? =
+      some block := by
+    rw [← frame.rewrittenDefinition, frame.block]
+    exact rewrittenAt
+  have selectedSource := (rewrite.acceptedAt found).1
+  have blockEq : block = selectedBlock :=
+    Option.some.inj (sourceAt.symm.trans selectedSource)
+  have selectedTarget : rewrite.definition.blocks[baselineFrame.block]? =
+      some selectedBlock := by
+    simpa [blockEq] using targetAt
+  exact False.elim (rewrite.accepted_target_ne_source found selectedTarget)
+
+/-- If the current source block admits no accepted-site witness, its program
+counter is irrelevant to the accepted-entry phase. This form is used for
+resumed callers: the instruction that created their continuation is a call or
+dynamic application, none of which can occur in an accepted reset source. -/
+theorem StableLiveAcceptedEntry.ofSourceBlockExcluded
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    (excluded : ∀ _site : Reuse.Site limits validation block, False) :
+    StableLiveAcceptedEntry limits validation baseline rewritten := by
+  intro locRel source rewrite currentBaseline currentRewritten currentStack
+    currentRewrittenStack currentControl _rewrittenControl related
+  have controls : Control.running frame stack =
+      .running currentBaseline currentStack := control.symm.trans currentControl
+  injection controls with frameEq _stackEq
+  subst currentBaseline
+  intro helperOffset selectedBlock site found
+  have sourceAt : source.blocks[frame.block]? = some block := by
+    rw [← related.baselineDefinition]
+    exact blockAt
+  have selectedSource := (rewrite.acceptedAt found).1
+  have blockEq : block = selectedBlock :=
+    Option.some.inj (sourceAt.symm.trans selectedSource)
+  subst selectedBlock
+  exact False.elim (excluded site)
+
+/-- A frame resumed after an addressed call cannot be an accepted block at a
+nonzero program counter, because accepted source prefixes contain no call. -/
+theorem StableLiveAcceptedEntry.ofCallResume {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {address : Ixon.Address} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.call address arguments)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noCall instructionAt
+
+/-- A frame resumed after a recursive call likewise cannot be an accepted
+block at a nonzero program counter. -/
+theorem StableLiveAcceptedEntry.ofCallSelfResume {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.callSelf arguments)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noCallSelf instructionAt
+
+/-- A frame resumed after dynamic over-application cannot be an accepted
+block at a nonzero program counter. -/
+theorem StableLiveAcceptedEntry.ofApplyResume {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {function : Atom} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.apply function arguments)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noApply instructionAt
+
+/-- Advancing past an ordinary move cannot leave a synchronized pair inside
+an accepted source block, because accepted reset prefixes contain no move. -/
+theorem StableLiveAcceptedEntry.ofMoveAdvance {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {atom : Atom}
+    (instructionAt : block.instructions[position]? = some (.move atom)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noMove instructionAt
+
+/-- Advancing past a unique-free instruction preserves accepted-entry phase
+by excluding the current source block from the reuse recognizer. -/
+theorem StableLiveAcceptedEntry.ofFreeUniqueAdvance
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {atom : Atom} {identity : CtorId}
+    (instructionAt : block.instructions[position]? =
+      some (.freeUnique atom identity)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noFreeUnique instructionAt
+
+/-- Advancing past a function partial application preserves phase because
+that instruction cannot occur in a recognized reset source. -/
+theorem StableLiveAcceptedEntry.ofPappAdvance {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {address : Ixon.Address} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.papp address arguments)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noPapp instructionAt
+
+/-- Advancing past a unique drop preserves phase because accepted reset
+prefixes contain only shared release. -/
+theorem StableLiveAcceptedEntry.ofDropUniqueAdvance
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {atom : Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.dropUnique atom)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noDropUnique instructionAt
+
+/-- Advancing past a unique allocation preserves phase because recognized
+reset sources allocate only shared constructors. -/
+theorem StableLiveAcceptedEntry.ofAllocUniqueAdvance
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Machine} {frame : Frame}
+    {stack : List Continuation} {block : Block}
+    (control : baseline.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {identity : CtorId} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.alloc .unique identity arguments)) :
+    StableLiveAcceptedEntry limits validation baseline rewritten :=
+  StableLiveAcceptedEntry.ofSourceBlockExcluded control blockAt fun site =>
+    site.noAllocUnique instructionAt
+
+/-- At an accepted synchronized block, the phase invariant exposes both the
+zero program counter and exactly the entry-live parameter relation consumed by
+the physical reuse macro. Dead entry slots remain outside that relation. -/
+theorem StableLiveAcceptedEntry.valuesAtEntry {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    (phase : StableLiveAcceptedEntry limits validation baseline rewritten)
+    {locRel : Nat → Nat → Prop} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (baselineControl : baseline.control =
+      .running baselineFrame baselineStack)
+    (rewrittenControl : rewritten.control =
+      .running rewrittenFrame rewrittenStack)
+    (frame : StableLiveFrameIso rewrite locRel baselineFrame rewrittenFrame)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions
+      baselineFrame.block helperOffset block (.accepted site)) :
+    baselineFrame.pc = 0 ∧
+      LiveValuesIso source baselineFrame.block 0 locRel
+        baselineFrame.values rewrittenFrame.values := by
+  have pc := phase baselineControl rewrittenControl frame found
+  exact ⟨pc, by simpa [pc] using frame.values⟩
+
+/-- Construct a live-indexed machine relation from a baseline-to-rewritten
+allocation history. -/
+theorem StableLiveMachineRel.history {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.store.heap
+      rewritten.store.heap)
+    (fuel : baseline.heapFuel ≤ rewritten.heapFuel)
+    (control : StableLiveControlIso limits validation heap.locRel
+      baseline.control rewritten.control) :
+    StableLiveMachineRel limits validation baseline rewritten := by
+  exact .related heap.locRel (.isomorphic heap.symm) fuel control
+
+/-- Related recursive arguments and a live-related suspended stack form the
+control state reached after an accepted reset macro. -/
+theorem StableLiveControlIso.recursiveCall {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop}
+    {baselineValues rewrittenValues : Array RVal}
+    {baselineStack rewrittenStack : List Continuation}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList)
+    (stack : StableLiveStackIso limits validation locRel
+      baselineStack rewrittenStack) :
+    StableLiveControlIso limits validation locRel
+      (.running { definition := source, values := baselineValues }
+        baselineStack)
+      (.running { definition := rewrite.definition, values := rewrittenValues }
+        rewrittenStack) :=
+  .running (StableLiveFrameRel.entry rewrite values) stack
+
+/-- Exact-content accepted endpoints need only live agreement in suspended
+frames. -/
+theorem StableLiveMachineRel.contentsRecursiveCall {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineValues rewrittenValues : Array RVal}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (values : IxIR1.Sim.RValsIso (fun left right => left = right)
+      baselineValues.toList rewrittenValues.toList)
+    (stack : StableLiveStackIso limits validation
+      (fun left right => left = right) baselineStack rewrittenStack) :
+    StableLiveMachineRel limits validation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running
+          { definition := source, values := baselineValues } baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := rewrittenValues }
+          rewrittenStack } :=
+  .related (fun left right => left = right) (.contents heap) fuel
+    (StableLiveControlIso.recursiveCall rewrite values stack)
+
+/-- Isomorphic accepted endpoints likewise retain only future-observable
+suspended registers. -/
+theorem StableLiveMachineRel.isomorphicRecursiveCall
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineValues rewrittenValues : Array RVal}
+    {baselineStack rewrittenStack : List Continuation}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (values : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baselineValues.toList rewrittenValues.toList)
+    (stack : StableLiveStackIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baselineStack rewrittenStack) :
+    StableLiveMachineRel limits validation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running
+          { definition := source, values := baselineValues } baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := rewrittenValues }
+          rewrittenStack } :=
+  .related
+    (fun baselineLocation rewrittenLocation =>
+      iso.locRel rewrittenLocation baselineLocation)
+    (.isomorphic (heapIsoToHistory iso)) fuel
+    (StableLiveControlIso.recursiveCall rewrite values stack)
+
+/-- Invert a live-indexed relation whose baseline endpoint has halted. -/
+theorem StableLiveMachineRel.haltedParts {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineStore : Store} {baselineFuel : Nat} {baselineValue : RVal}
+    {rewritten : Machine}
+    (relation : StableLiveMachineRel limits validation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .halted baselineValue }
+      rewritten) :
+    ∃ rewrittenStore rewrittenFuel rewrittenValue locRel,
+      rewritten =
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .halted rewrittenValue } ∧
+        StableHeapRel baselineStore rewrittenStore locRel ∧
+        baselineFuel ≤ rewrittenFuel ∧
+        IxIR1.Sim.RValIso locRel baselineValue rewrittenValue := by
+  cases rewritten with
+  | mk rewrittenStore rewrittenFuel rewrittenControl =>
+      cases relation with
+      | related locRel heap fuel control =>
+          cases control with
+          | halted value =>
+              exact ⟨rewrittenStore, rewrittenFuel, _, locRel, rfl, heap,
+                fuel, value⟩
+
+/-- Every old stable machine relation is a strengthening of the new
+live-indexed relation. -/
+theorem StableMachineRel.toLive {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    (machine : StableMachineRel limits validation baseline rewritten) :
+    StableLiveMachineRel limits validation baseline rewritten := by
+  cases baseline with
+  | mk baselineStore baselineFuel baselineControl =>
+      cases rewritten with
+      | mk rewrittenStore rewrittenFuel rewrittenControl =>
+          cases machine with
+          | related locRel heap fuel control =>
+              refine .related locRel heap fuel ?_
+              cases control with
+              | running frame stack =>
+                  cases frame with
+                  | rewritten rewrite related =>
+                      exact .running (.rewritten rewrite
+                        (StableLiveFrameIso.ofStable related))
+                        (StableStackIso.toLive stack)
+              | halted value => exact .halted value
+
+/-! ## Unchanged call and return boundaries -/
+
+/-- An unchanged move observes only its current operand and appends a related
+result. -/
+theorem unchangedMoveStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] = .move atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          baselineStack }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push rewrittenValue }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.move atom) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have atomLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.move
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .move atom := by
+    simpa only [← frame.pc] using instruction
+  refine ⟨rewrittenValue,
+    Step.move rfl sourceAt pc instruction resolved,
+    Step.move rfl targetAt targetPc targetInstruction targetResolved, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (.rewritten rewrite (frame.advancePush valueRelated)) stack)
+
+/-- Constructor projection follows a related live source location and appends
+the corresponding field value. -/
+theorem unchangedFetchStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId} {field : Nat}
+    {baselineLocation : Nat} {baselineBox : IxIR1.NodeBox}
+    {baselineFields : Array RVal} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .fetch atom cid field)
+    (resolved : Eval.resolveAtom baselineFrame.values atom =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (node : baselineBox.node = .ctorN cid baselineFields)
+    (fieldAt : baselineFields[field]? = some baselineValue) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          baselineStack }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push rewrittenValue }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext ∧
+        StableLiveFrameIso rewrite heap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push rewrittenValue } := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.fetch atom cid field) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have atomLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.fetch
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact boxAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← node] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have baselineListAt : baselineFields.toList[field]? =
+          some baselineValue := by
+        simpa using fieldAt
+      obtain ⟨rewrittenValue, rewrittenListAt, valueRelated⟩ :=
+        fieldsRelated.get? baselineListAt
+      have rewrittenFieldAt : rewrittenFields[field]? =
+          some rewrittenValue := by
+        simpa using rewrittenListAt
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .fetch atom cid field := by
+        simpa only [← frame.pc] using instruction
+      have nextFrame := frame.advancePush valueRelated
+      refine ⟨rewrittenValue,
+        Step.fetch rfl sourceAt pc instruction resolved boxAt node fieldAt,
+        Step.fetch rfl targetAt targetPc targetInstruction targetResolved
+          ?_ rewrittenNode rewrittenFieldAt, ?_, nextFrame⟩
+      · change rewrittenStore.heap.get? rewrittenLocation =
+          some rewrittenBox
+        exact rewrittenAt
+      · exact StableLiveMachineRel.history heap fuel
+          (.running (.rewritten rewrite nextFrame) stack)
+
+/-- Internal lockstep induction for a constructor child's generated fetch
+prologue when that child block is preserved literally by the reuse pass. The
+successor-frame witness returned by `unchangedFetchStepLiveIso` keeps the same
+rewrite and heap history available at every field. -/
+private theorem unchangedFetchPrologueFromLiveIso
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId}
+    {baselineLocation : Nat} {baselineBox : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (blockAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetDefinitionAt :
+      rewrite.definition.blocks[baselineFrame.block]? = some block)
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid
+      fields.size = true)
+    (resolved : Eval.resolveAtom baselineFrame.values atom =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (node : baselineBox.node = .ctorN cid fields) :
+    ∀ (remaining index : Nat), index + remaining = fields.size →
+      ∀ {rewrittenFrame : Frame},
+        StableLiveFrameIso rewrite heap.locRel
+            (Lower.Sim.fetchPrefixFrame baselineFrame fields index)
+            rewrittenFrame →
+          ∃ rewrittenFinalFrame,
+            Steps baselineContext interpretation remaining
+                { store := baselineStore
+                  heapFuel := baselineFuel
+                  control := .running
+                    (Lower.Sim.fetchPrefixFrame baselineFrame fields index)
+                    baselineStack }
+                { store := baselineStore
+                  heapFuel := baselineFuel
+                  control := .running
+                    (Lower.Sim.fetchPrefixFrame baselineFrame fields
+                      fields.size)
+                    baselineStack } ∧
+              Steps rewrittenContext interpretation remaining
+                { store := rewrittenStore
+                  heapFuel := rewrittenFuel
+                  control := .running rewrittenFrame rewrittenStack }
+                { store := rewrittenStore
+                  heapFuel := rewrittenFuel
+                  control := .running rewrittenFinalFrame rewrittenStack } ∧
+              StableLiveMachineRel limits validation
+                { store := baselineStore
+                  heapFuel := baselineFuel
+                  control := .running
+                    (Lower.Sim.fetchPrefixFrame baselineFrame fields
+                      fields.size)
+                    baselineStack }
+                { store := rewrittenStore
+                  heapFuel := rewrittenFuel
+                  control := .running rewrittenFinalFrame rewrittenStack } ∧
+              StableLiveFrameIso rewrite heap.locRel
+                (Lower.Sim.fetchPrefixFrame baselineFrame fields fields.size)
+                rewrittenFinalFrame := by
+  intro remaining
+  induction remaining with
+  | zero =>
+      intro index total rewrittenFrame currentFrame
+      have indexEq : index = fields.size := by omega
+      subst index
+      exact ⟨rewrittenFrame, .refl _, .refl _,
+        StableLiveMachineRel.history heap fuel
+          (.running (.rewritten rewrite currentFrame) stack),
+        currentFrame⟩
+  | succ remaining ih =>
+      intro index total rewrittenFrame currentFrame
+      have indexBound : index < fields.size := by omega
+      have instructionAt :=
+        Lower.fetchPrologueAt_of_match prologue indexBound
+      obtain ⟨pcBound, instruction⟩ :=
+        Array.getElem?_eq_some_iff.mp instructionAt
+      have fieldAt : fields[index]? = some fields[index] :=
+        Array.getElem?_eq_some_iff.mpr ⟨indexBound, rfl⟩
+      have currentResolved :
+          Eval.resolveAtom
+              (Lower.Sim.fetchPrefixFrame baselineFrame fields index).values
+              atom = .ok (.loc baselineLocation) := by
+        simpa [Lower.Sim.fetchPrefixFrame] using
+          Lower.Sim.resolveAtom_append_old
+            (suffix := fields.extract 0 index) resolved
+      have currentBlockAt :
+          (Lower.Sim.fetchPrefixFrame baselineFrame fields index).definition.blocks[
+              (Lower.Sim.fetchPrefixFrame baselineFrame fields index).block]? =
+            some block := by
+        simpa [Lower.Sim.fetchPrefixFrame] using blockAt
+      have currentTargetAt :
+          rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+            some block := by
+        rw [currentFrame.rewrittenDefinition, ← currentFrame.block]
+        simpa [Lower.Sim.fetchPrefixFrame] using targetDefinitionAt
+      have currentPc :
+          (Lower.Sim.fetchPrefixFrame baselineFrame fields index).pc <
+            block.instructions.size := by
+        simpa [Lower.Sim.fetchPrefixFrame] using pcBound
+      have currentInstruction :
+          block.instructions[
+              (Lower.Sim.fetchPrefixFrame baselineFrame fields index).pc] =
+            .fetch atom cid index := by
+        simpa [Lower.Sim.fetchPrefixFrame] using instruction
+      obtain ⟨rewrittenValue, baselineStep, rewrittenStep, _headRelated,
+          nextFrame⟩ :=
+        unchangedFetchStepLiveIso rewrite heap fuel currentFrame stack
+          currentBlockAt currentTargetAt currentPc currentInstruction
+          currentResolved boxAt node fieldAt
+      have extractSucc : fields.extract 0 (index + 1) =
+          (fields.extract 0 index).push fields[index] :=
+        Array.extract_succ_right (by omega) indexBound
+      have nextBaselineFrame :
+          { Lower.Sim.fetchPrefixFrame baselineFrame fields index with
+            pc := (Lower.Sim.fetchPrefixFrame baselineFrame fields index).pc + 1
+            values :=
+              (Lower.Sim.fetchPrefixFrame baselineFrame fields index).values.push
+                fields[index] } =
+            Lower.Sim.fetchPrefixFrame baselineFrame fields (index + 1) := by
+        cases baselineFrame
+        unfold Lower.Sim.fetchPrefixFrame
+        rw [extractSucc, Array.push_append]
+      rw [nextBaselineFrame] at baselineStep nextFrame
+      obtain ⟨rewrittenFinalFrame, baselineTail, rewrittenTail, finalRelated,
+          finalFrame⟩ :=
+        ih (index + 1) (by omega) nextFrame
+      exact ⟨rewrittenFinalFrame,
+        .cons rfl baselineStep baselineTail,
+        .cons rfl rewrittenStep rewrittenTail,
+        finalRelated, finalFrame⟩
+
+/-- A complete generated constructor-field prologue stays in lockstep across
+an allocation history when its child block is unchanged. Besides the related
+endpoint, the theorem returns accepted-entry phase from literal block identity,
+so constructor dispatch need not claim phase at an accepted child's internal
+post-fetch program counter. -/
+theorem unchangedFetchPrologueStepsLiveIso
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId}
+    {baselineLocation : Nat} {baselineBox : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (startPc : baselineFrame.pc = 0)
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid
+      fields.size = true)
+    (resolved : Eval.resolveAtom baselineFrame.values atom =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (node : baselineBox.node = .ctorN cid fields) :
+    let baselineFinalFrame : Frame :=
+      { baselineFrame with
+        pc := fields.size
+        values := baselineFrame.values ++ fields }
+    ∃ rewrittenFinalFrame,
+      Steps baselineContext interpretation fields.size
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFinalFrame baselineStack } ∧
+        Steps rewrittenContext interpretation fields.size
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFinalFrame rewrittenStack } ∧
+        StableLiveMachineRel limits validation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFinalFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFinalFrame rewrittenStack } ∧
+        StableLiveAcceptedEntry limits validation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFinalFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFinalFrame rewrittenStack } := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have targetDefinitionAt :
+      rewrite.definition.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.rewrittenDefinition, frame.block]
+    exact targetAt
+  have startFrame :
+      Lower.Sim.fetchPrefixFrame baselineFrame fields 0 = baselineFrame := by
+    cases baselineFrame with
+    | mk definition blockId pc values credits =>
+        dsimp only at startPc ⊢
+        subst pc
+        simp [Lower.Sim.fetchPrefixFrame]
+  obtain ⟨rewrittenFinalFrame, baselineSteps, rewrittenSteps, related,
+      finalFrame⟩ :=
+    unchangedFetchPrologueFromLiveIso
+      (baselineContext := baselineContext)
+      (rewrittenContext := rewrittenContext)
+      (interpretation := interpretation) rewrite heap fuel stack sourceAt
+      targetDefinitionAt prologue resolved boxAt node fields.size 0 (by simp)
+      (rewrittenFrame := rewrittenFrame) (by rw [startFrame]; exact frame)
+  have finalBaselineFrame :
+      Lower.Sim.fetchPrefixFrame baselineFrame fields fields.size =
+        { baselineFrame with
+          pc := fields.size
+          values := baselineFrame.values ++ fields } := by
+    cases baselineFrame
+    simp [Lower.Sim.fetchPrefixFrame]
+  rw [startFrame, finalBaselineFrame] at baselineSteps
+  rw [finalBaselineFrame] at related finalFrame
+  have rewrittenFinalAt :
+      rewrittenFinalFrame.definition.blocks[rewrittenFinalFrame.block]? =
+        some block := by
+    rw [finalFrame.rewrittenDefinition, ← finalFrame.block]
+    simpa using targetDefinitionAt
+  exact ⟨rewrittenFinalFrame, baselineSteps, rewrittenSteps, related,
+    StableLiveAcceptedEntry.ofSameBlock rfl rfl
+      (by simpa using sourceAt) rewrittenFinalAt⟩
+
+/-- Shallow unique reclamation follows a live source operand and preserves
+the history row after killing both corresponding locations. -/
+theorem unchangedFreeUniqueStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId}
+    {baselineLocation : Nat} {baselineBox : IxIR1.NodeBox}
+    {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .freeUnique atom cid)
+    (resolved : Eval.resolveAtom baselineFrame.values atom =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (unique : baselineBox.world = .unique)
+    (node : baselineBox.node = .ctorN cid baselineFields)
+    (scalarFields : baselineFields.all RVal.isScalar = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        store := baselineStore.kill baselineLocation
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenLocation,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          store := rewrittenStore.kill rewrittenLocation
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.freeUnique atom cid) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have atomLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.freeUnique
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact boxAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← node] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have fieldsEq : baselineFields = rewrittenFields := by
+        apply Array.toList_inj.mp
+        apply fieldsRelated.eq_of_allScalar
+        rw [Array.all_toList]
+        exact scalarFields
+      have rewrittenScalar : rewrittenFields.all RVal.isScalar = true := by
+        rw [← fieldsEq]
+        exact scalarFields
+      have rewrittenUnique : rewrittenBox.world = .unique :=
+        boxes.world.symm.trans unique
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .freeUnique atom cid := by
+        simpa only [← frame.pc] using instruction
+      let outputHeap : IxIR1.Sim.HeapHistoryIso
+          (baselineStore.kill baselineLocation).heap
+          (rewrittenStore.kill rewrittenLocation).heap :=
+        heap.kill locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact boxAt) rewrittenAt
+      refine ⟨rewrittenLocation,
+        Step.freeUnique rfl sourceAt pc instruction resolved boxAt unique node
+          scalarFields,
+        Step.freeUnique rfl targetAt targetPc targetInstruction targetResolved
+          ?_ rewrittenUnique rewrittenNode rewrittenScalar, ?_⟩
+      · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+        exact rewrittenAt
+      · have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+            { baselineFrame with pc := baselineFrame.pc + 1 }
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 } := by
+          change StableLiveFrameIso rewrite heap.locRel _ _
+          exact frame.advance
+        have outputStack : StableLiveStackIso limits validation
+            outputHeap.locRel baselineStack rewrittenStack := by
+          change StableLiveStackIso limits validation heap.locRel _ _
+          exact stack
+        exact StableLiveMachineRel.history outputHeap fuel
+          (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Fresh allocation resolves only the constructor's live argument operands,
+then extends the heap history and appends the related fresh locations. -/
+theorem unchangedAllocStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema}
+    {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .alloc world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation :=
+      baselineStore.allocNode world (.ctorN cid baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenValues,
+      let rewrittenAllocation :=
+        rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.alloc world cid arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.alloc member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .alloc world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  let baselineAllocation :=
+    baselineStore.allocNode world (.ctorN cid baselineValues)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap :=
+    heap.alloc (.ctor valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) := by
+    exact .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (frame.mono oldExtends).advancePush resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues,
+    by simpa [baselineAllocation] using
+      (Step.alloc (context := baselineContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction schemaAt resolved fieldWorlds),
+    by simpa [rewrittenAllocation] using
+      (Step.alloc (context := rewrittenContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetFieldWorlds), ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- An absent `allocWith` credit is consumed after resolving the live
+constructor operands; both executions then allocate related fresh nodes. -/
+theorem unchangedAllocWithAbsentStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (absent : credit.presence = .absent) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation :=
+      baselineStore.allocNode world (.ctorN cid baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ (rewrittenValues : Array RVal) (rewrittenTaken : Frame),
+      let rewrittenAllocation :=
+        rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.allocWith creditId world cid arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.allocWith member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨layoutRelated, targetAbsent⟩ :=
+    creditRelated.absent_parts absent
+  have targetLayout : rewrittenCredit.layout = schema.layout :=
+    layoutRelated.symm.trans layout
+  let baselineAllocation :=
+    baselineStore.allocNode world (.ctorN cid baselineValues)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap :=
+    heap.alloc (.ctor valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (takenFrame.mono oldExtends).push resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues, rewrittenTaken,
+    by simpa [baselineAllocation] using
+      (Step.allocWithAbsent (context := baselineContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+          absent),
+    by simpa [rewrittenAllocation] using
+      (Step.allocWithAbsent (context := rewrittenContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+          targetFieldWorlds targetTaken targetLayout targetAbsent), ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A logical `allocWith` credit is consumed after resolving the live
+constructor operands; both executions allocate related fresh nodes. -/
+theorem unchangedAllocWithLogicalStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present none) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation :=
+      baselineStore.allocNode world (.ctorN cid baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ (rewrittenValues : Array RVal) (rewrittenTaken : Frame),
+      let rewrittenAllocation :=
+        rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.allocWith creditId world cid arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.allocWith member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨layoutRelated, targetPresent⟩ :=
+    creditRelated.logical_parts present
+  have targetLayout : rewrittenCredit.layout = schema.layout :=
+    layoutRelated.symm.trans layout
+  let baselineAllocation :=
+    baselineStore.allocNode world (.ctorN cid baselineValues)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap :=
+    heap.alloc (.ctor valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (takenFrame.mono oldExtends).push resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues, rewrittenTaken,
+    by simpa [baselineAllocation] using
+      (Step.allocWithLogical (context := baselineContext)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+          present),
+    by simpa [rewrittenAllocation] using
+      (Step.allocWithLogical (context := rewrittenContext)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+          targetFieldWorlds targetTaken targetLayout targetPresent), ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Physical `allocWith` resolves its live operands, consumes corresponding
+reservations, and revives their history row with related constructor nodes. -/
+theorem unchangedAllocWithPhysicalStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {baselineValues : Array RVal}
+    {baselineLocation : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present (some baselineLocation))
+    (reused : baselineStore.reuseReservation baselineLocation world
+      (.ctorN cid baselineValues) schema.fields.size = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineLocation) }
+          baselineStack }
+    ∃ (rewrittenValues : Array RVal) (rewrittenTaken : Frame)
+        (rewrittenLocation : Nat) (rewrittenOut : Store),
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push (.loc rewrittenLocation) }
+            rewrittenStack }
+      rewrittenStore.reuseReservation rewrittenLocation world
+          (.ctorN cid rewrittenValues) schema.fields.size = .ok rewrittenOut ∧
+        Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.allocWith creditId world cid arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.allocWith member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨rewrittenLocation, layoutRelated, targetPresent, locations⟩ :=
+    creditRelated.physical_parts present
+  have targetLayout : rewrittenCredit.layout = schema.layout :=
+    layoutRelated.symm.trans layout
+  obtain ⟨rewrittenOut, outputHeap, targetReused, outputRelation⟩ :=
+    reuseReservation_historyIso heap locations (.ctor valuesRelated) reused
+  have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+      { baselineTaken with
+        values := baselineTaken.values.push (.loc baselineLocation) }
+      { rewrittenTaken with
+        values := rewrittenTaken.values.push (.loc rewrittenLocation) } := by
+    rw [outputRelation]
+    exact takenFrame.push (.loc locations)
+  have outputStack : StableLiveStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValues, rewrittenTaken, rewrittenLocation, rewrittenOut,
+    targetReused,
+    Step.allocWithPhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+        present reused,
+    Step.allocWithPhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetFieldWorlds targetTaken targetLayout targetPresent targetReused,
+    ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Logical unique extraction follows its live constructor root, kills both
+locations, and appends related fields with matching logical credits. -/
+theorem unchangedTakeUniqueLogicalStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .takeUnique target cid)
+    (schemaAt : baselineContext.schemas .unique cid = some schema)
+    (resolved : Eval.resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .unique cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present none }
+    let baselineNext : Machine :=
+      { store := baselineStore.kill baselineLocation
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore.kill rewrittenLocation
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.takeUnique target cid) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have targetLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.takeUnique
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom targetLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨baselineAt, baselineWorld, baselineNode⟩ := viewed.parts
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact baselineAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← baselineNode] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have rewrittenWorld : rewrittenBox.world = .unique :=
+        boxes.world.symm.trans baselineWorld
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetViewed : ConstructorView rewrittenStore rewrittenLocation
+          .unique cid rewrittenBox rewrittenFields := by
+        apply ConstructorView.of_box
+        · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt
+        · exact rewrittenWorld
+        · exact rewrittenNode
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .takeUnique target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .unique cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let outputHeap := heap.kill locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) rewrittenAt
+      have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) } := by
+        change StableLiveFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.logical schema.layout)
+      have outputStack : StableLiveStackIso limits validation
+          outputHeap.locRel baselineStack rewrittenStack := by
+        change StableLiveStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.takeUniqueLogical
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.takeUniqueLogical
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableLiveMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Physical unique extraction follows its live constructor root, reserves
+both locations, and appends related fields with physical credits. -/
+theorem unchangedTakeUniquePhysicalStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .takeUnique target cid)
+    (schemaAt : baselineContext.schemas .unique cid = some schema)
+    (resolved : Eval.resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .unique cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineCredit : Credit :=
+      { layout := schema.layout,
+        presence := .present (some baselineLocation) }
+    let baselineNext : Machine :=
+      { store := baselineStore.reserve baselineLocation
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some baselineCredit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenCredit : Credit :=
+        { layout := schema.layout,
+          presence := .present (some rewrittenLocation) }
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore.reserve rewrittenLocation
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some rewrittenCredit) }
+            rewrittenStack }
+      Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.takeUnique target cid) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have targetLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.takeUnique
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom targetLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨baselineAt, baselineWorld, baselineNode⟩ := viewed.parts
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact baselineAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← baselineNode] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have rewrittenWorld : rewrittenBox.world = .unique :=
+        boxes.world.symm.trans baselineWorld
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetViewed : ConstructorView rewrittenStore rewrittenLocation
+          .unique cid rewrittenBox rewrittenFields := by
+        apply ConstructorView.of_box
+        · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt
+        · exact rewrittenWorld
+        · exact rewrittenNode
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .takeUnique target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .unique cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let outputHeap := reserve_historyIso heap locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) rewrittenAt
+      have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some baselineLocation) }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some rewrittenLocation) }) } := by
+        change StableLiveFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.physical locations)
+      have outputStack : StableLiveStackIso limits validation
+          outputHeap.locRel baselineStack rewrittenStack := by
+        change StableLiveStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.takeUniquePhysical
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.takeUniquePhysical
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableLiveMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A logical hot shared reset follows its live unit-refcount root, kills both
+locations, and appends related fields with logical credits. -/
+theorem unchangedResetSharedLogicalHotStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : Eval.resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .shared cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present none }
+    let baselineNext : Machine :=
+      { store := ((baselineStore.tickResetAttempt).kill
+          baselineLocation).tickHotReset
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenNext : Machine :=
+        { store := ((rewrittenStore.tickResetAttempt).kill
+            rewrittenLocation).tickHotReset
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.resetShared target cid) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have targetLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.resetShared
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom targetLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt, targetViewed,
+          boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations viewed
+      obtain ⟨baselineAt, _, _⟩ := viewed.parts
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .resetShared target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .shared cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let killed := heap.kill locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) (by
+          change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt)
+      let outputHeap : IxIR1.Sim.HeapHistoryIso
+          (((baselineStore.tickResetAttempt).kill
+            baselineLocation).tickHotReset).heap
+          (((rewrittenStore.tickResetAttempt).kill
+            rewrittenLocation).tickHotReset).heap := by
+        simpa [Eval.Store.tickResetAttempt, Eval.Store.tickHotReset] using killed
+      have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) } := by
+        change StableLiveFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.logical schema.layout)
+      have outputStack : StableLiveStackIso limits validation
+          outputHeap.locRel baselineStack rewrittenStack := by
+        change StableLiveStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.resetSharedLogicalHot
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.resetSharedLogicalHot
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableLiveMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A physical hot shared reset follows its live unit-refcount root, reserves
+both locations, and appends related fields with physical credits. -/
+theorem unchangedResetSharedPhysicalHotStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : Eval.resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .shared cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineCredit : Credit :=
+      { layout := schema.layout,
+        presence := .present (some baselineLocation) }
+    let baselineNext : Machine :=
+      { store := ((baselineStore.tickResetAttempt).reserve
+          baselineLocation).tickHotReset
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some baselineCredit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenCredit : Credit :=
+        { layout := schema.layout,
+          presence := .present (some rewrittenLocation) }
+      let rewrittenNext : Machine :=
+        { store := ((rewrittenStore.tickResetAttempt).reserve
+            rewrittenLocation).tickHotReset
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some rewrittenCredit) }
+            rewrittenStack }
+      Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.resetShared target cid) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have targetLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.resetShared
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom targetLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt, targetViewed,
+          boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations viewed
+      obtain ⟨baselineAt, _, _⟩ := viewed.parts
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .resetShared target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .shared cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let reserved := reserve_historyIso
+        (left := baselineStore.tickResetAttempt)
+        (right := rewrittenStore.tickResetAttempt) heap locations (by
+          simpa [Eval.Store.tickResetAttempt, Eval.Store.get?] using
+            baselineAt) (by
+          simpa [Eval.Store.tickResetAttempt, Eval.Store.get?] using
+            rewrittenAt)
+      let outputHeap : IxIR1.Sim.HeapHistoryIso
+          (((baselineStore.tickResetAttempt).reserve
+            baselineLocation).tickHotReset).heap
+          (((rewrittenStore.tickResetAttempt).reserve
+            rewrittenLocation).tickHotReset).heap := by
+        simpa [Eval.Store.tickHotReset] using reserved
+      have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some baselineLocation) }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some rewrittenLocation) }) } := by
+        change StableLiveFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.physical locations)
+      have outputStack : StableLiveStackIso limits validation
+          outputHeap.locRel baselineStack rewrittenStack := by
+        change StableLiveStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.resetSharedPhysicalHot
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.resetSharedPhysicalHot
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableLiveMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A cold shared reset follows its live shared root, transports the parent
+decrement and field-retain loop, and appends an absent credit. -/
+theorem unchangedResetSharedColdStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : Eval.resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .shared cid
+      baselineBox baselineFields)
+    (shared : 1 < baselineBox.rc)
+    (retained : RetainSharedMany
+      ((((baselineStore.tickResetAttempt).setBox baselineLocation
+        { baselineBox with rc := baselineBox.rc - 1 }).rcTick).tickColdReset)
+      baselineFields baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .absent }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ (rewrittenFields : Array RVal) (rewrittenOut : Store),
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.resetShared target cid) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have targetLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.resetShared
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    frame.values.resolveAtom targetLive resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt, targetViewed,
+          boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations viewed
+      obtain ⟨baselineAt, _, _⟩ := viewed.parts
+      have rewrittenShared : 1 < rewrittenBox.rc := by
+        rw [← boxes.rc]
+        exact shared
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .resetShared target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .shared cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let updated := heap.setBox locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) (by
+          change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt)
+        (show IxIR1.Sim.NodeBoxIso heap.locRel
+            { baselineBox with rc := baselineBox.rc - 1 }
+            { rewrittenBox with rc := rewrittenBox.rc - 1 } from
+          ⟨boxes.world, congrArg (fun rc => rc - 1) boxes.rc, boxes.node⟩)
+      let beforeHistory : IxIR1.Sim.HeapHistoryIso
+          ((((baselineStore.tickResetAttempt).setBox baselineLocation
+            { baselineBox with rc := baselineBox.rc - 1 }).rcTick).tickColdReset).heap
+          ((((rewrittenStore.tickResetAttempt).setBox rewrittenLocation
+            { rewrittenBox with rc := rewrittenBox.rc - 1 }).rcTick).tickColdReset).heap := by
+        simpa [Eval.Store.tickResetAttempt, Eval.Store.tickColdReset] using
+          updated.rcTick
+      have retainedFields : IxIR1.Sim.RValsIso beforeHistory.locRel
+          baselineFields.toList rewrittenFields.toList := by
+        change IxIR1.Sim.RValsIso heap.locRel _ _
+        exact fieldsRelated
+      obtain ⟨rewrittenOut, outputHeap, targetRetained, outputRelation⟩ :=
+        retainSharedMany_historyIso beforeHistory retainedFields retained
+      have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence := .absent }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence := .absent }) } := by
+        rw [outputRelation]
+        change StableLiveFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.absent schema.layout)
+      have outputStack : StableLiveStackIso limits validation
+          outputHeap.locRel baselineStack rewrittenStack := by
+        rw [outputRelation]
+        change StableLiveStackIso limits validation beforeHistory.locRel _ _
+        change StableLiveStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenFields, rewrittenOut,
+        Step.resetSharedCold
+          (context := baselineContext) (interpretation := interpretation)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed shared retained,
+        Step.resetSharedCold
+          (context := rewrittenContext) (interpretation := interpretation)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenShared targetRetained, ?_⟩
+      exact StableLiveMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Shared retain resolves its live operand, updates corresponding refcounts,
+and appends the related values. -/
+theorem unchangedRetainSharedStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .retainShared atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (retained : retainShared baselineStore baselineValue = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          baselineStack }
+    ∃ rewrittenValue rewrittenOut,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push rewrittenValue }
+            rewrittenStack }
+      retainShared rewrittenStore rewrittenValue = .ok rewrittenOut ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.retainShared atom) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have atomLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.retainShared
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  obtain ⟨rewrittenOut, outputHeap, targetRetained, outputRelation⟩ :=
+    retainShared_historyIso heap valueRelated retained
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .retainShared atom := by
+    simpa only [← frame.pc] using instruction
+  have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+      { baselineFrame with
+        pc := baselineFrame.pc + 1
+        values := baselineFrame.values.push baselineValue }
+      { rewrittenFrame with
+        pc := rewrittenFrame.pc + 1
+        values := rewrittenFrame.values.push rewrittenValue } := by
+    rw [outputRelation]
+    exact frame.advancePush valueRelated
+  have outputStack : StableLiveStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValue, rewrittenOut, targetRetained,
+    Step.retainShared rfl sourceAt pc instruction resolved retained,
+    Step.retainShared rfl targetAt targetPc targetInstruction targetResolved
+      targetRetained, ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Deep shared release follows the graph rooted at its live operand and
+preserves the target's traversal-fuel advantage. -/
+theorem unchangedReleaseSharedStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .releaseShared atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (released : releaseShared baselineFuel baselineStore baselineValue =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenValue rewrittenOut rewrittenRemaining,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      releaseShared rewrittenFuel rewrittenStore rewrittenValue =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.releaseShared atom) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have atomLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.releaseShared
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  obtain ⟨rewrittenOut, rewrittenRemaining, outputHeap, targetReleased,
+      outputFuel, outputRelation⟩ :=
+    releaseSharedWork_historyIso heap fuel
+      (.cons valueRelated .nil) (by
+        unfold releaseShared at released
+        exact released)
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .releaseShared atom := by
+    simpa only [← frame.pc] using instruction
+  have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } := by
+    rw [outputRelation]
+    exact frame.advance
+  have outputStack : StableLiveStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+    by simpa [releaseShared] using targetReleased,
+    Step.releaseShared rfl sourceAt pc instruction resolved released,
+    Step.releaseShared rfl targetAt targetPc targetInstruction targetResolved
+      (by simpa [releaseShared] using targetReleased), ?_⟩
+  exact StableLiveMachineRel.history outputHeap outputFuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Deep unique destruction follows the graph rooted at its live operand and
+preserves the target's traversal-fuel advantage. -/
+theorem unchangedDropUniqueStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .dropUnique atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (dropped : dropUnique baselineFuel baselineStore baselineValue =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenValue rewrittenOut rewrittenRemaining,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      dropUnique rewrittenFuel rewrittenStore rewrittenValue =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.dropUnique atom) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have atomLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.dropUnique
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  obtain ⟨rewrittenOut, rewrittenRemaining, outputHeap, targetDropped,
+      outputFuel, outputRelation⟩ :=
+    dropUniqueWork_historyIso heap fuel (.cons valueRelated .nil) (by
+      unfold dropUnique at dropped
+      exact dropped)
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .dropUnique atom := by
+    simpa only [← frame.pc] using instruction
+  have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } := by
+    rw [outputRelation]
+    exact frame.advance
+  have outputStack : StableLiveStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+    by simpa [dropUnique] using targetDropped,
+    Step.dropUnique rfl sourceAt pc instruction resolved dropped,
+    Step.dropUnique rfl targetAt targetPc targetInstruction targetResolved
+      (by simpa [dropUnique] using targetDropped), ?_⟩
+  exact StableLiveMachineRel.history outputHeap outputFuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Discarding an absent credit advances and consumes corresponding credit
+slots without imposing any value-register premise. -/
+theorem unchangedDiscardCreditAbsentStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (absent : credit.presence = .absent) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ rewrittenTaken : Frame,
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← frame.pc] using instruction
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨_, targetAbsent⟩ := creditRelated.absent_parts absent
+  refine ⟨rewrittenTaken,
+    Step.discardCreditAbsent
+      (context := baselineContext) (interpretation := interpretation)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken absent,
+    Step.discardCreditAbsent
+      (context := rewrittenContext) (interpretation := interpretation)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken targetAbsent, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Discarding a logical credit consumes corresponding slots and leaves the
+heap history unchanged. -/
+theorem unchangedDiscardCreditLogicalStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (present : credit.presence = .present none) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ rewrittenTaken : Frame,
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← frame.pc] using instruction
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨_, targetPresent⟩ := creditRelated.logical_parts present
+  refine ⟨rewrittenTaken,
+    Step.discardCreditLogical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken present,
+    Step.discardCreditLogical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken targetPresent, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Discarding a physical credit releases corresponding reserved locations
+and transports the live frame across the unchanged location relation. -/
+theorem unchangedDiscardCreditPhysicalStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {baselineLocation : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (present : credit.presence = .present (some baselineLocation))
+    (released : baselineStore.releaseReservation baselineLocation =
+      .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ (rewrittenTaken : Frame) (rewrittenLocation : Nat)
+        (rewrittenOut : Store),
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      rewrittenStore.releaseReservation rewrittenLocation = .ok rewrittenOut ∧
+        Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← frame.pc] using instruction
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨rewrittenLocation, _, targetPresent, locations⟩ :=
+    creditRelated.physical_parts present
+  obtain ⟨rewrittenOut, outputHeap, targetReleased, outputRelation⟩ :=
+    releaseReservation_historyIso heap locations released
+  have outputFrame : StableLiveFrameIso rewrite outputHeap.locRel
+      baselineTaken rewrittenTaken := by
+    rw [outputRelation]
+    exact takenFrame
+  have outputStack : StableLiveStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenTaken, rewrittenLocation, rewrittenOut, targetReleased,
+    Step.discardCreditPhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken present released,
+    Step.discardCreditPhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken targetPresent
+        targetReleased, ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Function PAP construction resolves only its live captures and extends the
+allocation history with related PAP nodes. -/
+theorem unchangedPappFnStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso callerRewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .papp address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (papSafe : calleeSource.signature.papSafe = true)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (under : baselineValues.size < calleeSource.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode .shared
+      (.papN address calleeSource.signature.params.size baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenValues : Array RVal,
+      let rewrittenAllocation := rewrittenStore.allocNode .shared
+        (.papN address calleeSource.signature.params.size rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : callerSource.blocks[baselineFrame.block]? =
+      some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.papp address arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom callerSource baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.papp member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .papp address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have targetPapSafe : calleeRewrite.definition.signature.papSafe = true := by
+    simpa using papSafe
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using valuesRelated.lengths
+  have targetUnder :
+      rewrittenValues.size < calleeRewrite.definition.signature.params.size := by
+    rw [← sizeEq, calleeRewrite.definition_signature]
+    exact under
+  let baselineAllocation := baselineStore.allocNode .shared
+    (.papN address calleeSource.signature.params.size baselineValues)
+  let rewrittenAllocation := rewrittenStore.allocNode .shared
+    (.papN address calleeSource.signature.params.size rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap := heap.alloc (.pap valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (frame.mono oldExtends).advancePush resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues,
+    by simpa [baselineAllocation] using
+      (Step.pappFnCleared
+        (context := baselineContext) (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction noCredits baselineDeclaration papSafe
+          resolved under),
+    by simpa [rewrittenAllocation, calleeRewrite.definition_signature] using
+      (Step.pappFnCleared
+        (context := rewrittenContext) (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetNoCredits
+          rewrittenDeclaration targetPapSafe targetResolved targetUnder), ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten callerRewrite outputFrame) outputStack)
+
+/-- Extern PAP construction resolves only its live captures and extends the
+allocation history with related PAP nodes. -/
+theorem unchangedPappExternStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal} {arity : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .papp address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern arity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern arity))
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (under : baselineValues.size < arity) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode .shared
+      (.papN address arity baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenValues : Array RVal,
+      let rewrittenAllocation := rewrittenStore.allocNode .shared
+        (.papN address arity rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.papp address arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.papp member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .papp address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using valuesRelated.lengths
+  have targetUnder : rewrittenValues.size < arity := by
+    rw [← sizeEq]
+    exact under
+  let baselineAllocation := baselineStore.allocNode .shared
+    (.papN address arity baselineValues)
+  let rewrittenAllocation := rewrittenStore.allocNode .shared
+    (.papN address arity rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap := heap.alloc (.pap valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (frame.mono oldExtends).advancePush resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues,
+    by simpa [baselineAllocation] using
+      (Step.pappExternCleared
+        (context := baselineContext) (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction noCredits baselineDeclaration resolved
+          under),
+    by simpa [rewrittenAllocation] using
+      (Step.pappExternCleared
+        (context := rewrittenContext) (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetNoCredits
+          rewrittenDeclaration targetResolved targetUnder), ?_⟩
+  exact StableLiveMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A scalar extern call resolves only its live argument operands; related
+scalar vectors and the common oracle result are literally equal. -/
+theorem unchangedExternStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (oracles : baselineContext.oracle = rewrittenContext.oracle)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    {arity : Nat} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .extern address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern arity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern arity))
+    (argumentArity : baselineValues.size = arity)
+    (called : ScalarOracleCall baselineContext address baselineValues value) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push value }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push value }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.extern address arguments) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc arguments :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.extern member)
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  obtain ⟨argumentsScalar, valueScalar⟩ := called.scalar
+  have listEq : baselineValues.toList = rewrittenValues.toList := by
+    apply valuesRelated.eq_of_allScalar
+    rw [Array.all_toList]
+    exact argumentsScalar
+  have valuesEq : baselineValues = rewrittenValues :=
+    Array.toList_inj.mp listEq
+  subst rewrittenValues
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .extern address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have targetCalled :
+      ScalarOracleCall rewrittenContext address baselineValues value :=
+    called.congrOracle oracles
+  refine ⟨
+    Step.externCleared rfl sourceAt pc instruction noCredits resolved
+      baselineDeclaration argumentArity called,
+    Step.externCleared rfl targetAt targetPc targetInstruction targetNoCredits
+      targetResolved rewrittenDeclaration argumentArity targetCalled, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running
+      (.rewritten rewrite
+        (frame.advancePush
+          (IxIR1.Sim.RValIso.refl_of_scalar valueScalar)))
+      stack)
+
+/-- A recursive call only needs agreement for its syntactically live argument
+registers.  The complete caller is suspended after advancing its program
+counter, at which point newly dead transferred registers cease to constrain
+the relation. -/
+theorem unchangedCallSelfStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {arguments : Array Atom}
+    {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .callSelf arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (arity : baselineValues.size =
+      baselineFrame.definition.signature.params.size)
+    (nonempty : baselineFrame.definition.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := baselineFrame.definition, values := baselineValues }
+          (.resume { baselineFrame with pc := baselineFrame.pc + 1 } ::
+            baselineStack) }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := rewrittenFrame.definition,
+              values := rewrittenValues }
+            (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 } ::
+              rewrittenStack) }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have argumentsLive := AtomsLiveFrom.callSelf sourceBlockAt pc instruction
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .callSelf arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using valuesRelated.lengths
+  have sourceArity : baselineValues.size = source.signature.params.size := by
+    simpa [frame.baselineDefinition] using arity
+  have targetArity : rewrittenValues.size =
+      rewrittenFrame.definition.signature.params.size := by
+    rw [← sizeEq, frame.rewrittenDefinition, rewrite.definition_signature]
+    exact sourceArity
+  have targetNonempty : rewrittenFrame.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem targetAt
+  refine ⟨rewrittenValues,
+    Step.callSelfCleared rfl sourceAt pc instruction noCredits resolved arity
+      nonempty,
+    Step.callSelfCleared rfl targetAt targetPc targetInstruction
+      targetNoCredits targetResolved targetArity targetNonempty, ?_⟩
+  have callee : StableLiveFrameRel limits validation heap.locRel
+      { definition := baselineFrame.definition, values := baselineValues }
+      { definition := rewrittenFrame.definition, values := rewrittenValues } := by
+    rw [frame.baselineDefinition, frame.rewrittenDefinition]
+    exact StableLiveFrameRel.entry rewrite valuesRelated
+  have resume : StableLiveContinuationIso limits validation heap.locRel
+      (.resume { baselineFrame with pc := baselineFrame.pc + 1 })
+      (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 }) :=
+    .resume (.rewritten rewrite frame.advance)
+  exact StableLiveMachineRel.history heap fuel
+    (.running callee (.cons resume stack))
+
+/-- A direct call selects the related callee rewrite while preserving the
+live-indexed suspended caller. -/
+theorem unchangedCallFnStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso callerRewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .call address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (arity : baselineValues.size = calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := calleeSource, values := baselineValues }
+          (.resume { baselineFrame with pc := baselineFrame.pc + 1 } ::
+            baselineStack) }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := calleeRewrite.definition,
+              values := rewrittenValues }
+            (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 } ::
+              rewrittenStack) }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : callerSource.blocks[baselineFrame.block]? =
+      some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have argumentsLive := AtomsLiveFrom.call sourceBlockAt pc instruction
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .call address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using valuesRelated.lengths
+  have targetArity : rewrittenValues.size =
+      calleeRewrite.definition.signature.params.size := by
+    rw [← sizeEq, calleeRewrite.definition_signature]
+    exact arity
+  have targetNonempty : calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  refine ⟨rewrittenValues,
+    Step.callFnCleared rfl sourceAt pc instruction noCredits resolved
+      baselineDeclaration arity nonempty,
+    Step.callFnCleared rfl targetAt targetPc targetInstruction
+      targetNoCredits targetResolved rewrittenDeclaration targetArity
+      targetNonempty, ?_⟩
+  have callee : StableLiveFrameRel limits validation heap.locRel
+      { definition := calleeSource, values := baselineValues }
+      { definition := calleeRewrite.definition, values := rewrittenValues } :=
+    StableLiveFrameRel.entry calleeRewrite valuesRelated
+  have resume : StableLiveContinuationIso limits validation heap.locRel
+      (.resume { baselineFrame with pc := baselineFrame.pc + 1 })
+      (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 }) :=
+    .resume (.rewritten callerRewrite frame.advance)
+  exact StableLiveMachineRel.history heap fuel
+    (.running callee (.cons resume stack))
+
+/-- An unchanged jump relates exactly the selected edge operands and enters a
+fresh pointwise-related target ABI. -/
+theorem unchangedJumpStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {edge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .jump edge)
+    (transferred : EdgeTransfer baselineFrame edge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have edgeLive : AtomsLiveFrom source baselineFrame.block baselineFrame.pc
+      edge.values :=
+    AtomsLiveFrom.terminatorEdge sourceBlockAt pc (by
+      intro atom member
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.jump
+        (Liveness.EdgeUsesAtom.value member))
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransferIso edgeLive (.nil) transferred
+  refine ⟨rewrittenTarget,
+    Step.jump rfl sourceAt pc terminator transferred,
+    Step.jump rfl targetAt targetPc terminator rewrittenTransfer, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- The zero arm observes the live scrutinee and relates the selected edge
+operands. -/
+theorem unchangedSwitchNatZeroStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {peel : NatPeel}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : Eval.resolveAtom baselineFrame.values scrutinee =
+      .ok (.lit (.nat 0)))
+    (transferred : EdgeTransfer baselineFrame peel.zero #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have scrutineeLive : AtomLiveFrom source baselineFrame.block
+      baselineFrame.pc scrutinee :=
+    AtomLiveFrom.terminator sourceBlockAt pc (by
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.switchScrutinee)
+  have edgeLive : AtomsLiveFrom source baselineFrame.block baselineFrame.pc
+      peel.zero.values :=
+    AtomsLiveFrom.terminatorEdge sourceBlockAt pc (by
+      intro atom member
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.switchNatZero
+        (Liveness.EdgeUsesAtom.value member))
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom scrutineeLive resolved
+  cases valueRelated with
+  | lit =>
+      have targetPc : rewrittenFrame.pc = block.instructions.size :=
+        frame.pc.symm.trans pc
+      obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+        frame.edgeTransferIso edgeLive (.nil) transferred
+      refine ⟨rewrittenTarget,
+        Step.switchNatZero rfl sourceAt pc terminator resolved transferred,
+        Step.switchNatZero rfl targetAt targetPc terminator targetResolved
+          rewrittenTransfer, ?_⟩
+      exact StableLiveMachineRel.history heap fuel
+        (.running (.rewritten rewrite targetFrame) stack)
+
+/-- The successor arm additionally prepends the same scalar predecessor to
+the related edge values. -/
+theorem unchangedSwitchNatSuccStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {peel : NatPeel} {predecessor : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : Eval.resolveAtom baselineFrame.values scrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (transferred : EdgeTransfer baselineFrame peel.succ
+      #[.lit (.nat predecessor)] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have scrutineeLive : AtomLiveFrom source baselineFrame.block
+      baselineFrame.pc scrutinee :=
+    AtomLiveFrom.terminator sourceBlockAt pc (by
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.switchScrutinee)
+  have edgeLive : AtomsLiveFrom source baselineFrame.block baselineFrame.pc
+      peel.succ.values :=
+    AtomsLiveFrom.terminatorEdge sourceBlockAt pc (by
+      intro atom member
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.switchNatSucc
+        (Liveness.EdgeUsesAtom.value member))
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom scrutineeLive resolved
+  cases valueRelated with
+  | lit =>
+      have targetPc : rewrittenFrame.pc = block.instructions.size :=
+        frame.pc.symm.trans pc
+      obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+        frame.edgeTransferIso edgeLive (.cons .lit .nil) transferred
+      refine ⟨rewrittenTarget,
+        Step.switchNatSucc rfl sourceAt pc terminator resolved transferred,
+        Step.switchNatSucc rfl targetAt targetPc terminator targetResolved
+          rewrittenTransfer, ?_⟩
+      exact StableLiveMachineRel.history heap fuel
+        (.running (.rewritten rewrite targetFrame) stack)
+
+/-- Constructor dispatch follows the related scrutinee location and relates
+the chosen alternative's edge operands. -/
+theorem unchangedSwitchCtorStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {baselineLocation : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : Eval.resolveAtom baselineFrame.values scrutinee =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer baselineFrame alternative.edge #[]
+      baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext ∧
+        StableLiveFrameIso rewrite heap.locRel baselineTarget
+          rewrittenTarget := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have scrutineeLive : AtomLiveFrom source baselineFrame.block
+      baselineFrame.pc scrutinee :=
+    AtomLiveFrom.terminator sourceBlockAt pc (by
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.switchScrutinee)
+  have alternativeMember : alternative ∈ constructors.toList := by
+    simpa using Array.mem_of_find?_eq_some alternativeAt
+  have edgeLive : AtomsLiveFrom source baselineFrame.block baselineFrame.pc
+      alternative.edge.values :=
+    AtomsLiveFrom.terminatorEdge sourceBlockAt pc (by
+      intro atom member
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.switchCtor alternativeMember
+        (Liveness.EdgeUsesAtom.value member))
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom scrutineeLive resolved
+  cases valueRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, targetBoxAt, boxesRelated⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some box
+          exact boxAt)
+      have nodesRelated : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid fields) rewrittenBox.node := by
+        rw [← node]
+        exact boxesRelated.node
+      obtain ⟨rewrittenFields, targetNode, _fieldsRelated⟩ :=
+        nodeIso_ctor_left nodesRelated
+      have targetPc : rewrittenFrame.pc = block.instructions.size :=
+        frame.pc.symm.trans pc
+      obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+        frame.edgeTransferIso edgeLive (.nil) transferred
+      refine ⟨rewrittenTarget,
+        Step.switchCtor rfl sourceAt pc terminator resolved boxAt node
+          alternativeAt transferred,
+        Step.switchCtor rfl targetAt targetPc terminator targetResolved
+          (by
+            change rewrittenStore.heap.get? rewrittenLocation =
+              some rewrittenBox
+            exact targetBoxAt)
+          targetNode alternativeAt rewrittenTransfer, ?_, targetFrame⟩
+      exact StableLiveMachineRel.history heap fuel
+        (.running (.rewritten rewrite targetFrame) stack)
+
+/-- A constructor switch followed by its complete generated field-fetch
+prologue synchronizes automatically when both the parent and selected child
+blocks are preserved literally. The child decision is checked at entry, and
+accepted-entry phase is established only at the post-prologue endpoint. -/
+theorem unchangedSwitchCtorPrologueStepsLiveIso
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineChildFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {parentBlock : Block} {scrutinee childScrutinee : Atom}
+    {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+    {baselineLocation : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some parentBlock)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some parentBlock)
+    (pc : baselineFrame.pc = parentBlock.instructions.size)
+    (terminator : parentBlock.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : Eval.resolveAtom baselineFrame.values scrutinee =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer baselineFrame alternative.edge #[]
+      baselineChildFrame)
+    {childBlock : Block}
+    (childAt : baselineChildFrame.definition.blocks[baselineChildFrame.block]? =
+      some childBlock)
+    (childTargetAt :
+      rewrite.definition.blocks[baselineChildFrame.block]? = some childBlock)
+    (childPc : baselineChildFrame.pc = 0)
+    (prologue : Lower.fetchPrologueMatches childBlock.instructions
+      childScrutinee cid fields.size = true)
+    (childResolved : Eval.resolveAtom baselineChildFrame.values
+      childScrutinee = .ok (.loc baselineLocation)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineFinalFrame : Frame :=
+      { baselineChildFrame with
+        pc := fields.size
+        values := baselineChildFrame.values ++ fields }
+    let baselineFinal : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFinalFrame baselineStack }
+    ∃ rewrittenFinalFrame,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFinalFrame rewrittenStack }
+      Steps baselineContext interpretation (1 + fields.size)
+          baselineMachine baselineFinal ∧
+        Steps rewrittenContext interpretation (1 + fields.size)
+          rewrittenMachine rewrittenFinal ∧
+        StableLiveMachineRel limits validation baselineFinal rewrittenFinal ∧
+        StableLiveAcceptedEntry limits validation baselineFinal
+          rewrittenFinal := by
+  dsimp only
+  obtain ⟨rewrittenChildFrame, baselineSwitch, rewrittenSwitch,
+      _childRelated, childFrame⟩ :=
+    unchangedSwitchCtorStepLiveIso rewrite heap fuel frame stack sourceAt
+      targetAt pc terminator resolved boxAt node alternativeAt transferred
+  have rewrittenChildAt :
+      rewrittenChildFrame.definition.blocks[rewrittenChildFrame.block]? =
+        some childBlock := by
+    rw [childFrame.rewrittenDefinition, ← childFrame.block]
+    exact childTargetAt
+  obtain ⟨rewrittenFinalFrame, baselinePrologue, rewrittenPrologue, related,
+      acceptedEntry⟩ :=
+    unchangedFetchPrologueStepsLiveIso rewrite heap fuel childFrame stack
+      childAt rewrittenChildAt childPc prologue childResolved boxAt node
+  exact ⟨rewrittenFinalFrame,
+    (baselineSwitch.toSteps rfl).trans baselinePrologue,
+    (rewrittenSwitch.toSteps rfl).trans rewrittenPrologue,
+    related, acceptedEntry⟩
+
+/-- A present optional credit selects its branch while only the selected
+edge's value operands need to be related. -/
+theorem unchangedBranchCreditPresentStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {someEdge noneEdge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup baselineFrame creditId credit)
+    (present : credit.isPresent = true)
+    (transferred : EdgeTransfer baselineFrame someEdge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have edgeLive : AtomsLiveFrom source baselineFrame.block baselineFrame.pc
+      someEdge.values :=
+    AtomsLiveFrom.terminatorEdge sourceBlockAt pc (by
+      intro atom member
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.branchSome
+        (Liveness.EdgeUsesAtom.value member))
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenCredit, targetLookup, creditRelated⟩ :=
+    frame.creditLookup lookedUp
+  have targetPresent : rewrittenCredit.isPresent = true := by
+    rw [← creditRelated.present_parts.2]
+    exact present
+  obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransferIso edgeLive (.nil) transferred
+  refine ⟨rewrittenTarget,
+    Step.branchCreditPresent rfl sourceAt pc terminator lookedUp present
+      transferred,
+    Step.branchCreditPresent rfl targetAt targetPc terminator targetLookup
+      targetPresent rewrittenTransfer, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- An absent optional credit selects the fallback branch while only that
+edge's value operands need to be related. -/
+theorem unchangedBranchCreditAbsentStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {someEdge noneEdge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup baselineFrame creditId credit)
+    (absent : credit.isPresent = false)
+    (transferred : EdgeTransfer baselineFrame noneEdge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have edgeLive : AtomsLiveFrom source baselineFrame.block baselineFrame.pc
+      noneEdge.values :=
+    AtomsLiveFrom.terminatorEdge sourceBlockAt pc (by
+      intro atom member
+      rw [terminator]
+      exact Liveness.TerminatorUsesAtom.branchNone
+        (Liveness.EdgeUsesAtom.value member))
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenCredit, targetLookup, creditRelated⟩ :=
+    frame.creditLookup lookedUp
+  have targetAbsent : rewrittenCredit.isPresent = false := by
+    rw [← creditRelated.present_parts.2]
+    exact absent
+  obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransferIso edgeLive (.nil) transferred
+  refine ⟨rewrittenTarget,
+    Step.branchCreditAbsent rfl sourceAt pc terminator lookedUp absent
+      transferred,
+    Step.branchCreditAbsent rfl targetAt targetPc terminator targetLookup
+      targetAbsent rewrittenTransfer, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- A recursive tail call resolves only live terminator operands and re-enters
+the two versions of the current function. -/
+theorem unchangedTailCallSelfStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {arguments : Array Atom}
+    {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (arity : baselineValues.size =
+      baselineFrame.definition.signature.params.size)
+    (nonempty : baselineFrame.definition.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := baselineFrame.definition, values := baselineValues }
+          baselineStack }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := rewrittenFrame.definition,
+              values := rewrittenValues }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have argumentsLive :=
+    AtomsLiveFrom.tailCallSelf sourceBlockAt pc terminator
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using valuesRelated.lengths
+  have sourceArity : baselineValues.size = source.signature.params.size := by
+    simpa [frame.baselineDefinition] using arity
+  have targetArity : rewrittenValues.size =
+      rewrittenFrame.definition.signature.params.size := by
+    rw [← sizeEq, frame.rewrittenDefinition, rewrite.definition_signature]
+    exact sourceArity
+  have targetNonempty : rewrittenFrame.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem targetAt
+  refine ⟨rewrittenValues,
+    Step.tailCallSelfCleared rfl sourceAt pc terminator noCredits resolved
+      arity nonempty,
+    Step.tailCallSelfCleared rfl targetAt targetPc terminator targetNoCredits
+      targetResolved targetArity targetNonempty, ?_⟩
+  have callee : StableLiveFrameRel limits validation heap.locRel
+      { definition := baselineFrame.definition, values := baselineValues }
+      { definition := rewrittenFrame.definition, values := rewrittenValues } := by
+    rw [frame.baselineDefinition, frame.rewrittenDefinition]
+    exact StableLiveFrameRel.entry rewrite valuesRelated
+  exact StableLiveMachineRel.history heap fuel (.running callee stack)
+
+/-- A direct tail call enters the retained rewrite of the selected callee. -/
+theorem unchangedTailCallFnStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso callerRewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : Eval.resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (arity : baselineValues.size = calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := calleeSource, values := baselineValues }
+          baselineStack }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := calleeRewrite.definition,
+              values := rewrittenValues }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : callerSource.blocks[baselineFrame.block]? =
+      some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have argumentsLive := AtomsLiveFrom.tailCall sourceBlockAt pc terminator
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using valuesRelated.lengths
+  have targetArity : rewrittenValues.size =
+      calleeRewrite.definition.signature.params.size := by
+    rw [← sizeEq, calleeRewrite.definition_signature]
+    exact arity
+  have targetNonempty : calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  refine ⟨rewrittenValues,
+    Step.tailCallFnCleared rfl sourceAt pc terminator noCredits resolved
+      baselineDeclaration arity nonempty,
+    Step.tailCallFnCleared rfl targetAt targetPc terminator targetNoCredits
+      targetResolved rewrittenDeclaration targetArity targetNonempty, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (StableLiveFrameRel.entry calleeRewrite valuesRelated) stack)
+
+/-- Returning to a suspended caller appends the related result at the caller's
+already-advanced coordinate. -/
+theorem unchangedRetResumeStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {baselineRest rewrittenRest : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (caller : StableLiveFrameRel limits validation heap.locRel
+      baselineCaller rewrittenCaller)
+    (rest : StableLiveStackIso limits validation heap.locRel
+      baselineRest rewrittenRest)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : baselineValue.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame
+          (.resume baselineCaller :: baselineRest) }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame
+          (.resume rewrittenCaller :: rewrittenRest) }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineCaller with
+            values := baselineCaller.values.push baselineValue }
+          baselineRest }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { rewrittenCaller with
+              values := rewrittenCaller.values.push rewrittenValue }
+            rewrittenRest }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have atomLive := AtomLiveFrom.ret sourceBlockAt pc terminator
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : rewrittenValue.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq,
+      ← Ix.Compiler.IxIR2.ReuseSim.heapHistoryIso_rvalHasWorld_eq heap
+        valueRelated]
+    exact world
+  refine ⟨rewrittenValue,
+    Step.retResumeCleared rfl sourceAt pc terminator resolved noCredits world,
+    Step.retResumeCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld, ?_⟩
+  exact StableLiveMachineRel.history heap fuel
+    (.running (caller.push valueRelated) rest)
+
+/-- An outermost return halts with a related result under live-only register
+agreement. -/
+theorem unchangedRetHaltStepLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : baselineValue.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame [] }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame [] }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .halted baselineValue }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with control := .halted rewrittenValue }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableLiveMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have atomLive := AtomLiveFrom.ret sourceBlockAt pc terminator
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : rewrittenValue.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq,
+      ← Ix.Compiler.IxIR2.ReuseSim.heapHistoryIso_rvalHasWorld_eq heap
+        valueRelated]
+    exact world
+  refine ⟨rewrittenValue,
+    Step.retHaltCleared rfl sourceAt pc terminator resolved noCredits world,
+    Step.retHaltCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld, ?_⟩
+  exact StableLiveMachineRel.history heap fuel (.halted valueRelated)
+
+/-! ## Live accepted macros from exact-content states -/
+
+/-- The live logical-hot accepted macro is compositional over exact semantic heap
+contents and heap-fuel dominance.  In particular, source and target stores
+may already differ in every observational counter; only their live node array
+must agree. -/
+theorem acceptedHotLogicalStableLiveSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel remaining rewrittenFuel : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {ambient : List IxIR1.Sim.Root} {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (owned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc location⟩ :: ambient))
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    let rewrittenAllocation :=
+      (logicalHotResetStore rewrittenStore location).allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+    let baselineTarget : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := callValues } baselineStack }
+    let rewrittenTarget : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := callValues }
+          rewrittenStack }
+    Steps baselineContext .logical (2 * site.shape.fieldCount + 3)
+        baselineMachine baselineTarget ∧
+      Steps rewrittenContext .logical 4 rewrittenMachine rewrittenTarget ∧
+      StableLiveMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have rewrittenBoxAt : rewrittenStore.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← heap.get?_eq location]
+    exact sourceBoxAt
+  have baselineResetContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore baselineStore location) :=
+    hotPrefix_contents sourceBoxAt owned retained released
+  have resetCongruence : HeapContentsEq
+      (logicalHotResetStore baselineStore location)
+      (logicalHotResetStore rewrittenStore location) := by
+    simpa [logicalHotResetStore] using
+      (((heap.tickResetAttempt).kill location).tickHotReset)
+  have resetContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore rewrittenStore location) :=
+    baselineResetContents.trans resetCongruence
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let rewrittenAllocation :=
+    (logicalHotResetStore rewrittenStore location).allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+  have allocationContents : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have allocationLocation : baselineAllocation.2 =
+      rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode_location .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have rewrittenFieldWorlds : FieldWorlds
+      (logicalHotResetStore rewrittenStore location)
+      allocationSchema newFields :=
+    resetContents.fieldWorlds baselineFieldWorlds
+  have rewrittenTailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc rewrittenAllocation.2))
+      site.shape.tailArguments = .ok callValues := by
+    rw [← allocationLocation]
+    simpa [baselineAllocation] using tailResolved
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have rewrittenArity : callValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  let baselineMachine : Machine :=
+    { store := baselineStore
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store := rewrittenStore
+      heapFuel := rewrittenFuel
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  have baselineExecution : Steps baselineContext .logical
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := callValues } baselineStack } := by
+    simpa [baselineMachine, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := .logical)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := remaining)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt (by rfl) parameterCount fieldCount sourceResolved sourceBoxAt
+        rfl retained released allocationSchemaAt allocationResolved
+        baselineFieldWorlds tailResolved arity sourceNonempty
+  have rewrittenExecution : Steps rewrittenContext .logical 4
+      rewrittenMachine
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := callValues }
+          rewrittenStack } := by
+    simpa [rewrittenMachine, rewrittenAllocation, logicalHotResetStore] using
+      hotLogicalAcceptedControl site
+        (context := rewrittenContext) (definition := rewrite.definition)
+        (resetId := index) (hotId := source.blocks.size + helperOffset)
+        (coldId := source.blocks.size + helperOffset + 1)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location)
+        (box := ⟨.shared, 1,
+          .ctorN site.shape.sourceConstructor fields⟩)
+        (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+        (machine := rewrittenMachine) (stack := rewrittenStack)
+        resetAt hotAt rewrittenSourceSchemaAt rewrittenAllocationSchemaAt
+        sourceLayout allocationLayout (by rfl) parameterCount fieldCount
+        sourceResolved (ConstructorView.of_box rewrittenBoxAt rfl rfl) rfl
+        allocationResolved
+        (by simpa [logicalHotResetStore] using rewrittenFieldWorlds)
+        (by simpa [rewrittenAllocation, logicalHotResetStore] using
+          rewrittenTailResolved)
+        rewrittenArity rewrittenNonempty
+  have outputFuel : remaining ≤ rewrittenFuel :=
+    Nat.le_trans (releaseShared_remaining_le released) fuel
+  exact ⟨by simpa [baselineMachine, baselineAllocation] using baselineExecution,
+    by simpa [rewrittenMachine, rewrittenAllocation] using rewrittenExecution,
+    StableLiveMachineRel.contentsRecursiveCall rewrite allocationContents outputFuel
+      (IxIR1.Sim.RValsIso.refl callValues.toList) stack⟩
+
+/-- The live cold accepted macro is likewise compositional over exact semantic
+contents.  The baseline retain batch is transported to the rewritten store;
+the two parent decrements then agree in contents while the rewritten reset
+adds only observational counters. -/
+theorem acceptedColdStableLiveSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (retainedAt : baselineRetained.get? location = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc ((baselineDecrementStore baselineRetained location
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩).allocNode .shared
+              (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineReleased := baselineDecrementStore baselineRetained location
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    ∃ rewrittenRetained,
+      let rewrittenReleased := baselineDecrementStore rewrittenRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩
+      let rewrittenReset := rewrittenReleased.tickResetAttempt.tickColdReset
+      let rewrittenAllocation := rewrittenReset.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+      let baselineTarget : Machine :=
+        { store := baselineAllocation.1
+          heapFuel := fieldFuel
+          control := .running
+            { definition := source, values := callValues } baselineStack }
+      let rewrittenTarget : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition, values := callValues }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore fields rewrittenRetained ∧
+        Steps baselineContext interpretation
+          (2 * site.shape.fieldCount + 3) baselineMachine baselineTarget ∧
+        Steps rewrittenContext interpretation 4 rewrittenMachine
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, _hotAt, coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have rewrittenBoxAt : rewrittenStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← heap.get?_eq location]
+    exact sourceBoxAt
+  obtain ⟨rewrittenRetained, rewrittenRetainedRun, retainedContents⟩ :=
+    heap.retainSharedMany retained
+  have rewrittenRetainedAt : rewrittenRetained.get? location = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← retainedContents.get?_eq location]
+    exact retainedAt
+  obtain ⟨actualRetainedRc, actualRetainedAt, baselineReleasedRun,
+      _baselineResetRetained, _baselineHeapEq⟩ :=
+    coldPrefix_commutes (heapFuel := fieldFuel) sourceBoxAt shared retained
+  have actualBoxEq :
+      (⟨.shared, actualRetainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) =
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ :=
+    Option.some.inj (actualRetainedAt.symm.trans retainedAt)
+  have actualRcEq : actualRetainedRc = retainedRc := by
+    cases actualBoxEq
+    rfl
+  subst actualRetainedRc
+  obtain ⟨rewrittenActualRc, rewrittenActualAt, _rewrittenReleasedRun,
+      rewrittenResetRetained, _rewrittenHeapEq⟩ :=
+    coldPrefix_commutes (heapFuel := fieldFuel) rewrittenBoxAt shared
+      rewrittenRetainedRun
+  have rewrittenBoxEq :
+      (⟨.shared, rewrittenActualRc,
+          .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) =
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ :=
+    Option.some.inj (rewrittenActualAt.symm.trans rewrittenRetainedAt)
+  have rewrittenRcEq : rewrittenActualRc = retainedRc := by
+    cases rewrittenBoxEq
+    rfl
+  subst rewrittenActualRc
+  let baselineReleased := baselineDecrementStore baselineRetained location
+    ⟨.shared, retainedRc,
+      .ctorN site.shape.sourceConstructor fields⟩
+  let rewrittenReleased := baselineDecrementStore rewrittenRetained location
+    ⟨.shared, retainedRc,
+      .ctorN site.shape.sourceConstructor fields⟩
+  let rewrittenReset := rewrittenReleased.tickResetAttempt.tickColdReset
+  have releasedContents : HeapContentsEq baselineReleased
+      rewrittenReleased := by
+    simpa [baselineReleased, rewrittenReleased, baselineDecrementStore] using
+      (retainedContents.rcTick.setBox location
+        { (⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) with
+          rc := retainedRc - 1 })
+  have resetContents : HeapContentsEq baselineReleased rewrittenReset := by
+    apply releasedContents.trans
+    exact ⟨rfl⟩
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let rewrittenAllocation := rewrittenReset.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have allocationContents : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have allocationLocation : baselineAllocation.2 =
+      rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode_location .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have rewrittenFieldWorlds :
+      FieldWorlds rewrittenReset allocationSchema newFields :=
+    resetContents.fieldWorlds baselineFieldWorlds
+  have rewrittenTailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc rewrittenAllocation.2))
+      site.shape.tailArguments = .ok callValues := by
+    rw [← allocationLocation]
+    simpa [baselineReleased, baselineAllocation] using tailResolved
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have rewrittenArity : callValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  let baselineMachine : Machine :=
+    { store := baselineStore
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store := rewrittenStore
+      heapFuel := rewrittenFuel
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  have baselineExecution : Steps baselineContext interpretation
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := fieldFuel
+        control := .running
+          { definition := source, values := callValues } baselineStack } := by
+    simpa [baselineMachine, baselineReleased, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := interpretation)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := fieldFuel)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt (by rfl) parameterCount fieldCount sourceResolved sourceBoxAt
+        rfl retained (by simpa [baselineReleased] using baselineReleasedRun)
+        allocationSchemaAt allocationResolved
+        (by simpa [baselineReleased] using baselineFieldWorlds)
+        (by simpa [baselineReleased, baselineAllocation] using tailResolved)
+        arity sourceNonempty
+  have rewrittenExecution : Steps rewrittenContext interpretation 4
+      rewrittenMachine
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := callValues }
+          rewrittenStack } := by
+    simpa [rewrittenMachine, rewrittenReset, rewrittenReleased,
+      rewrittenAllocation] using
+      coldAcceptedControl site
+        (context := rewrittenContext) (interpretation := interpretation)
+        (definition := rewrite.definition) (resetId := index)
+        (hotId := source.blocks.size + helperOffset)
+        (coldId := source.blocks.size + helperOffset + 1)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location)
+        (box := ⟨.shared, rc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+        (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+        (machine := rewrittenMachine) (resetStore := rewrittenReset)
+        (stack := rewrittenStack) resetAt coldAt rewrittenSourceSchemaAt
+        rewrittenAllocationSchemaAt sourceLayout allocationLayout (by rfl)
+        parameterCount fieldCount sourceResolved
+        (ConstructorView.of_box rewrittenBoxAt rfl rfl) shared
+        (by simpa [rewrittenMachine, coldResetStartStore, rewrittenReset,
+          rewrittenReleased] using
+          rewrittenResetRetained)
+        allocationResolved
+        (by simpa [rewrittenReset] using rewrittenFieldWorlds)
+        (by simpa [rewrittenAllocation] using rewrittenTailResolved)
+        rewrittenArity rewrittenNonempty
+  have outputFuel : fieldFuel ≤ rewrittenFuel := by omega
+  refine ⟨rewrittenRetained, rewrittenRetainedRun, ?_, ?_, ?_⟩
+  · simpa [baselineMachine, baselineReleased, baselineAllocation] using
+      baselineExecution
+  · simpa [rewrittenMachine, rewrittenReleased, rewrittenReset,
+      rewrittenAllocation] using rewrittenExecution
+  · exact StableLiveMachineRel.contentsRecursiveCall rewrite allocationContents
+      outputFuel (IxIR1.Sim.RValsIso.refl callValues.toList) stack
+
+/-! ## Live accepted physical macro from an isomorphic state -/
+
+/-- A physical hot accepted block composes with an existing live-location
+bijection. Baseline and rewritten register files, constructor fields, and
+continuations may already use different locations. The consumed source pair
+is replaced by the reused-target/fresh-baseline pair, all surviving pairs are
+preserved, and both executions rejoin at a stable recursive-call state. -/
+theorem acceptedHotPhysicalStableLiveSimulationIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    {baselineParameters rewrittenParameters baselineFields rewrittenFields
+      baselineNewFields rewrittenNewFields baselineCallValues : Array RVal}
+    {baselineLocation rewrittenLocation fieldFuel remaining rewrittenFuel :
+      Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source index 0
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineParameters rewrittenParameters)
+    (stackAvoids : StableLiveStackAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation baselineStack rewrittenStack)
+    {baselineBefore baselineAfter rewrittenBefore rewrittenAfter :
+      List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (rewrittenSourceResolved :
+      resolveAtom rewrittenParameters (.reg site.shape.source) =
+        .ok (.loc rewrittenLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: baselineBefore))
+    (rewrittenOwned : IxIR1.Sim.RootOwnership rewrittenStore.heap
+      (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselinePartition :
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+          baselineBefore).Perm
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter))
+    (rewrittenPartition :
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+          rewrittenBefore).Perm
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter))
+    (mapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (rewrittenAllocationResolved : resolveAtoms
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      site.shape.allocationArguments = .ok rewrittenNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (rewrittenFieldWorlds : FieldWorlds
+      (physicalHotResetStore rewrittenStore rewrittenLocation)
+      allocationSchema rewrittenNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor baselineNewFields)
+    ∃ physical : Store,
+      ∃ outputIso : IxIR1.Sim.HeapIso physical.heap
+          baselineAllocation.1.heap,
+      ∃ physicalCallValues : Array RVal,
+      physicalHotReuseStore rewrittenStore rewrittenLocation
+          (.ctorN site.shape.allocationConstructor rewrittenNewFields)
+          allocationSchema.fields.size = .ok physical ∧
+      IxIR1.Sim.RootOwnership physical.heap
+          (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenAfter) ∧
+      IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+          (⟨.shared, .loc baselineAllocation.2⟩ :: baselineAfter) ∧
+      outputIso.locRel rewrittenLocation baselineAllocation.2 ∧
+      (∀ {rewrittenCandidate baselineCandidate : Nat},
+        inputIso.locRel rewrittenCandidate baselineCandidate →
+        rewrittenCandidate ≠ rewrittenLocation →
+        outputIso.locRel rewrittenCandidate baselineCandidate) ∧
+      Steps baselineContext .physical (2 * site.shape.fieldCount + 3)
+        baselineMachine
+        { store := baselineAllocation.1
+          heapFuel := remaining
+          control := .running
+            { definition := source, values := baselineCallValues }
+            baselineStack } ∧
+      Steps rewrittenContext .physical 4 rewrittenMachine
+        { store := physical
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition, values := physicalCallValues }
+            rewrittenStack } ∧
+      IxIR1.Sim.RValsIso
+          (fun baselineCandidate rewrittenCandidate =>
+            outputIso.locRel rewrittenCandidate baselineCandidate)
+          baselineCallValues.toList physicalCallValues.toList ∧
+      StableLiveStackIso limits validation
+          (fun baselineCandidate rewrittenCandidate =>
+            outputIso.locRel rewrittenCandidate baselineCandidate)
+          baselineStack rewrittenStack ∧
+      StableLiveMachineRel limits validation
+        { store := baselineAllocation.1
+          heapFuel := remaining
+          control := .running
+            { definition := source, values := baselineCallValues }
+            baselineStack }
+        { store := physical
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition, values := physicalCallValues }
+            rewrittenStack } := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, sourceSchemaFields, allocationSchemaFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have uniformAllocationFields : allocationSchema.fields =
+      Array.replicate site.shape.fieldCount .shared :=
+    allocationSchemaFields.trans sourceSchemaFields
+  have parameterSizes : baselineParameters.size = rewrittenParameters.size := by
+    exact parameters.length
+  have rewrittenParameterCount : rewrittenParameters.size =
+      site.shape.parameterCount := parameterSizes.symm.trans parameterCount
+  obtain ⟨leftBox, rightBox, leftLive, rightLive, boxesRelated⟩ :=
+    inputIso.related_live locations
+  have leftBoxEq : leftBox =
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩ :=
+    Option.some.inj (leftLive.symm.trans rewrittenAt)
+  have rightBoxEq : rightBox =
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩ :=
+    Option.some.inj (rightLive.symm.trans baselineAt)
+  subst leftBox
+  subst rightBox
+  have rewrittenToBaselineFields : IxIR1.Sim.RValsIso inputIso.locRel
+      rewrittenFields.toList baselineFields.toList := by
+    cases boxesRelated.node with
+    | ctor related => exact related
+  have fieldsRelated : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineFields.toList rewrittenFields.toList :=
+    rvalsIso_symm rewrittenToBaselineFields
+  have fieldSizes : baselineFields.size = rewrittenFields.size := by
+    simpa using rvalsIso_length_eq fieldsRelated
+  have rewrittenFieldCount : rewrittenFields.size = site.shape.fieldCount :=
+    fieldSizes.symm.trans fieldCount
+  have prefixLive : LiveValuesIso source index 0
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      (baselinePrefixValues baselineParameters baselineFields)
+      (baselinePrefixValues rewrittenParameters rewrittenFields) := by
+    simpa [baselinePrefixValues] using
+      (parameters.append fieldsRelated).append fieldsRelated
+  have allocationLiveAt : AtomsLiveFrom source index
+      (site.shape.releasePosition + 1)
+      site.shape.allocationArguments :=
+    AtomsLiveFrom.instruction sourceAt site.fits.allocation (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.alloc member)
+  have allocationLive : AtomsLiveFrom source index 0
+      site.shape.allocationArguments :=
+    allocationLiveAt.mono (Nat.zero_le _)
+  obtain ⟨actualRewrittenNewFields, actualRewrittenResolved,
+      newFieldsRelated⟩ :=
+    prefixLive.resolveAtoms allocationLive baselineAllocationResolved
+  have actualNewFieldsEq : actualRewrittenNewFields = rewrittenNewFields :=
+    Except.ok.inj
+      (actualRewrittenResolved.symm.trans rewrittenAllocationResolved)
+  subst actualRewrittenNewFields
+  have prefixContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore baselineStore baselineLocation) :=
+    hotPrefix_contents baselineAt baselineOwned retained released
+  have baselineMissing : baselineReleased.get? baselineLocation = none := by
+    rw [prefixContents.get?_eq baselineLocation]
+    change (logicalHotResetStore baselineStore baselineLocation).heap.get?
+      baselineLocation = none
+    rw [logicalHotResetStore_heap]
+    exact IxIR1.Sim.get?_kill_same baselineAt
+  have baselineNewFieldsAvoid : ∀ value ∈ baselineNewFields.toList,
+      value ≠ .loc baselineLocation :=
+    FieldWorlds.avoidsMissing uniformAllocationFields baselineFieldWorlds
+      baselineMissing
+  have rewrittenNewFieldsAvoid : ∀ value ∈ rewrittenNewFields.toList,
+      value ≠ .loc rewrittenLocation :=
+    rvalsIso_right_avoids_of_left inputIso locations newFieldsRelated
+      baselineNewFieldsAvoid
+  have restrictedNewFields : IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList :=
+    rvalsIso_restrict_left (rvalsIso_symm newFieldsRelated)
+      rewrittenNewFieldsAvoid
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor baselineNewFields)
+  obtain ⟨physical, reused, outputIso, physicalOwned,
+      baselineAllocationOwned, outputResult, outputExtends⟩ :=
+    hotPrefixReuse_sound_under_iso
+      (baselineStore := baselineStore) (rewrittenStore := rewrittenStore)
+      (baselineRetained := baselineRetained)
+      (baselineReleased := baselineReleased)
+      (baselineLocation := baselineLocation)
+      (rewrittenLocation := rewrittenLocation)
+      (oldCid := site.shape.sourceConstructor)
+      (newCid := site.shape.allocationConstructor)
+      (baselineFields := baselineFields) (rewrittenFields := rewrittenFields)
+      (baselineNewFields := baselineNewFields)
+      (rewrittenNewFields := rewrittenNewFields) (fieldFuel := fieldFuel)
+      (remaining := remaining) (baselineBefore := baselineBefore)
+      (baselineAfter := baselineAfter) (rewrittenBefore := rewrittenBefore)
+      (rewrittenAfter := rewrittenAfter) allocationSchema.fields.size inputIso
+      locations baselineAt rewrittenAt baselineOwned rewrittenOwned retained
+      released baselinePartition rewrittenPartition restrictedNewFields
+  obtain ⟨physicalAgain, reusedAgain, physicalHeap⟩ :=
+    physicalHotReuseStore_ok
+      (.ctorN site.shape.allocationConstructor rewrittenNewFields)
+      allocationSchema.fields.size rewrittenAt
+  have physicalEq : physicalAgain = physical :=
+    Except.ok.inj (reusedAgain.symm.trans reused)
+  subst physicalAgain
+  have physicalAt : physical.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.allocationConstructor rewrittenNewFields⟩ := by
+    change physical.heap.get? rewrittenLocation = _
+    rw [physicalHeap]
+    exact IxIR1.Sim.get?_reuseSharedNodeStore_same rewrittenAt
+  let outputRel : Nat → Nat → Prop :=
+    fun baselineCandidate rewrittenCandidate =>
+      outputIso.locRel rewrittenCandidate baselineCandidate
+  have translatedPrefix : TranslatedValuesIso site.shape outputRel
+      (baselinePrefixValues baselineParameters baselineFields)
+      (helperEntryValues site.shape.source rewrittenParameters
+        rewrittenFields) := by
+    intro sourceId targetId baselineValue relevant translated baselineValueAt
+    obtain ⟨rewrittenValue, rewrittenValueAt, inputValueRelated⟩ :=
+      prefixLive.related
+        (plannerValueLiveAtEntry site sourceAt relevant) baselineValueAt
+    have helperValueAt :=
+      valuesRel_helperEntry rewrittenParameterCount rewrittenFieldCount
+        site.fits.sourceBound sourceId targetId translated
+    rw [rewrittenValueAt] at helperValueAt
+    have supported :=
+      mapped sourceId targetId rewrittenValue relevant translated
+        rewrittenValueAt
+    have rewrittenValueAvoid : rewrittenValue ≠ .loc rewrittenLocation :=
+      by
+        cases rewrittenValue with
+        | loc location =>
+            obtain ⟨world, member⟩ := supported
+            rcases List.mem_append.mp member with fieldMember | survivorMember
+            · rw [IxIR1.Sim.rootsFor, List.mem_map] at fieldMember
+              obtain ⟨field, fieldMem, rootEq⟩ := fieldMember
+              have fieldEq : field = .loc location :=
+                congrArg IxIR1.Sim.Root.value rootEq
+              subst field
+              exact rewrittenNewFieldsAvoid _ fieldMem
+            · exact physicalOwned.sole_root_ne physicalAt survivorMember
+        | lit literal => intro impossible; cases impossible
+        | erased => intro impossible; cases impossible
+    have outputValueRelated : IxIR1.Sim.RValIso outputRel
+        baselineValue rewrittenValue := by
+      cases inputValueRelated with
+      | loc locationRelated =>
+          apply IxIR1.Sim.RValIso.loc
+          apply outputExtends locationRelated
+          intro same
+          apply rewrittenValueAvoid
+          cases same
+          rfl
+      | lit => exact .lit
+      | erased => exact .erased
+    exact ⟨rewrittenValue, helperValueAt.symm, outputValueRelated⟩
+  have baselinePrefixSize :
+      (baselinePrefixValues baselineParameters baselineFields).size =
+        site.shape.parameterCount + 2 * site.shape.fieldCount := by
+    simp [baselinePrefixValues, parameterCount, fieldCount, Nat.two_mul]
+  have rewrittenHelperSize :
+      (helperEntryValues site.shape.source rewrittenParameters
+        rewrittenFields).size =
+        site.shape.fieldCount + (site.shape.parameterCount - 1) := by
+    simp [helperEntryValues, List.length_eraseIdx, rewrittenParameterCount,
+      rewrittenFieldCount, site.fits.sourceBound]
+  have translatedAfterAllocation : TranslatedValuesIso site.shape outputRel
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc baselineAllocation.2))
+      ((helperEntryValues site.shape.source rewrittenParameters
+        rewrittenFields).push (.loc rewrittenLocation)) :=
+    TranslatedValuesIso.pushResult translatedPrefix (.loc outputResult)
+      baselinePrefixSize rewrittenHelperSize site.fits.sourceBound
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have rewrittenArity : baselineCallValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  let baselineMachine : Machine :=
+    { store := baselineStore
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := baselineParameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store := rewrittenStore
+      heapFuel := rewrittenFuel
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := rewrittenParameters
+          credits := #[] }
+        rewrittenStack }
+  have baselineExecution : Steps baselineContext .physical
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := baselineCallValues }
+          baselineStack } := by
+    simpa [baselineMachine, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := .physical)
+        (definition := source) (blockId := index)
+        (parameters := baselineParameters) (fields := baselineFields)
+        (newFields := baselineNewFields) (callValues := baselineCallValues)
+        (location := baselineLocation) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := remaining)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt (by rfl) parameterCount fieldCount baselineSourceResolved
+        baselineAt rfl retained released allocationSchemaAt
+        baselineAllocationResolved baselineFieldWorlds tailResolved arity
+        sourceNonempty
+  obtain ⟨physicalCallValues, rewrittenExecution, callsRelated⟩ :=
+    hotPhysicalAcceptedControlTranslated site
+      (context := rewrittenContext) (definition := rewrite.definition)
+      (resetId := index) (hotId := source.blocks.size + helperOffset)
+      (coldId := source.blocks.size + helperOffset + 1)
+      (parameters := rewrittenParameters) (fields := rewrittenFields)
+      (newFields := rewrittenNewFields)
+      (baselineTailValues :=
+        (baselinePrefixValues baselineParameters baselineFields).push
+          (.loc baselineAllocation.2))
+      (baselineCallValues := baselineCallValues)
+      (location := rewrittenLocation)
+      (box := ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+      (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+      (machine := rewrittenMachine) (stack := rewrittenStack)
+      (store := physical) (locRel := outputRel) resetAt hotAt
+      rewrittenSourceSchemaAt rewrittenAllocationSchemaAt sourceLayout
+      allocationLayout (by rfl) rewrittenParameterCount rewrittenFieldCount
+      rewrittenSourceResolved
+      (ConstructorView.of_box rewrittenAt rfl rfl) rfl
+      rewrittenAllocationResolved
+      (by simpa [physicalHotResetStore] using rewrittenFieldWorlds)
+      (by simpa [physicalHotReuseStore, physicalHotResetStore] using reused)
+      translatedAfterAllocation
+      (by simpa [baselineAllocation] using tailResolved) rewrittenArity
+      rewrittenNonempty
+  have outputStack : StableLiveStackIso limits validation outputRel
+      baselineStack rewrittenStack :=
+    stackAvoids.transportRelation (by
+      intro baselineCandidate rewrittenCandidate related different
+      exact outputExtends related different)
+  have outputFuel : remaining ≤ rewrittenFuel :=
+    Nat.le_trans (releaseShared_remaining_le released) fuel
+  have relatedMachine : StableLiveMachineRel limits validation
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := baselineCallValues }
+          baselineStack }
+      { store := physical
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := physicalCallValues }
+          rewrittenStack } :=
+    StableLiveMachineRel.isomorphicRecursiveCall rewrite outputIso outputFuel
+      callsRelated outputStack
+  exact ⟨physical, outputIso, physicalCallValues, reused, physicalOwned,
+    by simpa [baselineAllocation] using baselineAllocationOwned,
+    by simpa [baselineAllocation] using outputResult,
+    outputExtends,
+    by simpa [baselineMachine, baselineAllocation] using baselineExecution,
+    by simpa [rewrittenMachine] using rewrittenExecution,
+    callsRelated, outputStack, relatedMachine⟩
+
+/-! ## Liveness-indexed dynamic application -/
+
+/-- Erased dynamic application releases corresponding arguments and resumes
+live-related callers with the common erased value. -/
+theorem unchangedApplyTransferErasedLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableLiveFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (released : releaseSharedWork baselineFuel baselineStore
+      baselineArguments.toList = .ok (baselineOut, baselineRemaining)) :
+    let baselineTarget : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push .erased }
+          baselineStack }
+    ∃ rewrittenOut rewrittenRemaining,
+      let rewrittenTarget : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push .erased }
+            rewrittenStack }
+      releaseSharedWork rewrittenFuel rewrittenStore
+          rewrittenArguments.toList = .ok (rewrittenOut, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel .erased baselineArguments baselineResume baselineStack
+          baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel .erased rewrittenArguments rewrittenResume
+          rewrittenStack rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenOut, rewrittenRemaining, outputHeap, targetReleased,
+      outputFuel, outputRelation⟩ :=
+    releaseSharedWork_historyIso heap fuel arguments released
+  have outputResume : StableLiveFrameRel limits validation outputHeap.locRel
+      { baselineResume with values := baselineResume.values.push .erased }
+      { rewrittenResume with values := rewrittenResume.values.push .erased } := by
+    rw [outputRelation]
+    exact resume.push .erased
+  have outputStack : StableLiveStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+    ApplyTransfer.erased released, ApplyTransfer.erased targetReleased, ?_⟩
+  exact StableLiveMachineRel.history outputHeap outputFuel
+    (.running outputResume outputStack)
+
+/-- Under-saturated PAP application preserves live caller frames while
+retaining captures, releasing the old PAP, and allocating related extensions. -/
+theorem unchangedApplyTransferPapUnderLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineLocation rewrittenLocation : Nat}
+    {baselineBox : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {baselineCaptured baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (locations : heap.locRel baselineLocation rewrittenLocation)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableLiveFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (shared : baselineBox.world = .shared)
+    (node : baselineBox.node = .papN address arity baselineCaptured)
+    (capturedUnder : baselineCaptured.size < arity)
+    (retained : RetainSharedMany baselineStore baselineCaptured
+      baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc baselineLocation] = .ok (baselineReleased, baselineRemaining))
+    (totalUnder : (baselineCaptured ++ baselineArguments).size < arity) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.papN address arity (baselineCaptured ++ baselineArguments))
+    let baselineTarget : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ (rewrittenCaptured : Array RVal)
+        (rewrittenRetained rewrittenReleased : Store)
+        (rewrittenRemaining : Nat),
+      let rewrittenAllocation := rewrittenReleased.allocNode .shared
+        (.papN address arity (rewrittenCaptured ++ rewrittenArguments))
+      let rewrittenTarget : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore rewrittenCaptured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained
+            [.loc rewrittenLocation] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc baselineLocation) baselineArguments baselineResume
+          baselineStack baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc rewrittenLocation) rewrittenArguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations (by
+    change baselineStore.heap.get? baselineLocation = some baselineBox
+    exact boxAt)
+  have papNodes : IxIR1.Sim.NodeIso heap.locRel
+      (.papN address arity baselineCaptured) rewrittenBox.node := by
+    simpa only [← node] using boxes.node
+  obtain ⟨rewrittenCaptured, rewrittenNode, capturedRelated⟩ :=
+    nodeIso_pap_left papNodes
+  have rewrittenShared : rewrittenBox.world = .shared :=
+    boxes.world.symm.trans shared
+  have rewrittenCapturedUnder : rewrittenCaptured.size < arity := by
+    have sizes : baselineCaptured.size = rewrittenCaptured.size := by
+      simpa using capturedRelated.lengths
+    rw [← sizes]
+    exact capturedUnder
+  have totalRelated : IxIR1.Sim.RValsIso heap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    simpa using capturedRelated.append arguments
+  have rewrittenTotalUnder :
+      (rewrittenCaptured ++ rewrittenArguments).size < arity := by
+    have sizes : (baselineCaptured ++ baselineArguments).size =
+        (rewrittenCaptured ++ rewrittenArguments).size := by
+      simpa using totalRelated.lengths
+    rw [← sizes]
+    exact totalUnder
+  obtain ⟨rewrittenRetained, retainedHeap, targetRetained,
+      retainedRelation⟩ :=
+    retainSharedMany_historyIso heap capturedRelated retained
+  have retainedLocation : retainedHeap.locRel baselineLocation
+      rewrittenLocation := by
+    rw [retainedRelation]
+    exact locations
+  obtain ⟨rewrittenReleased, rewrittenRemaining, releasedHeap,
+      targetReleased, outputFuel, releasedRelation⟩ :=
+    releaseSharedWork_historyIso retainedHeap fuel
+      (.cons (.loc retainedLocation) .nil) released
+  have totalReleased : IxIR1.Sim.RValsIso releasedHeap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    rw [releasedRelation, retainedRelation]
+    exact totalRelated
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.papN address arity (baselineCaptured ++ baselineArguments))
+  let rewrittenAllocation := rewrittenReleased.allocNode .shared
+    (.papN address arity (rewrittenCaptured ++ rewrittenArguments))
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap := releasedHeap.alloc (.pap totalReleased)
+  have oldExtends : ∀ {leftLocation rightLocation},
+      heap.locRel leftLocation rightLocation →
+      outputHeap.locRel leftLocation rightLocation := by
+    intro leftLocation rightLocation related
+    apply Or.inr
+    rw [releasedRelation, retainedRelation]
+    exact related
+  have outputResume := (resume.mono oldExtends).push
+    (IxIR1.Sim.RValIso.loc (Or.inl ⟨rfl, rfl⟩))
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+    rewrittenRemaining, targetRetained, targetReleased,
+    ApplyTransfer.papUnder boxAt shared node capturedUnder retained released
+      totalUnder,
+    ApplyTransfer.papUnder (by
+      change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+      exact rewrittenAt) rewrittenShared rewrittenNode rewrittenCapturedUnder
+      targetRetained targetReleased rewrittenTotalUnder, ?_⟩
+  exact StableLiveMachineRel.history outputHeap outputFuel
+    (.running outputResume outputStack)
+
+/-- Saturated or over-saturated PAP application preserves the live caller,
+relates supplied and excess slices, and enters the selected callee rewrite. -/
+theorem unchangedApplyTransferPapFnLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {calleeSource : Function}
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineLocation rewrittenLocation : Nat}
+    {baselineBox : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {baselineCaptured baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (locations : heap.locRel baselineLocation rewrittenLocation)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableLiveFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (shared : baselineBox.world = .shared)
+    (node : baselineBox.node = .papN address arity baselineCaptured)
+    (capturedUnder : baselineCaptured.size < arity)
+    (retained : RetainSharedMany baselineStore baselineCaptured
+      baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc baselineLocation] = .ok (baselineReleased, baselineRemaining))
+    (totalEnough : arity ≤ (baselineCaptured ++ baselineArguments).size)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (papSafe : calleeSource.signature.papSafe = true)
+    (suppliedArity :
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+        calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineTotal := baselineCaptured ++ baselineArguments
+    let baselineSupplied := baselineTotal.extract 0 arity
+    let baselineExcess := baselineTotal.extract arity baselineTotal.size
+    let baselineContinuation : Continuation :=
+      if baselineExcess.isEmpty then .resume baselineResume
+      else .applyMore baselineExcess baselineResume
+    let baselineTarget : Machine :=
+      { store := baselineReleased
+        heapFuel := baselineRemaining
+        control := .running
+          { definition := calleeSource, values := baselineSupplied }
+          (baselineContinuation :: baselineStack) }
+    ∃ (rewrittenCaptured : Array RVal)
+        (rewrittenRetained rewrittenReleased : Store)
+        (rewrittenRemaining : Nat),
+      let rewrittenTotal := rewrittenCaptured ++ rewrittenArguments
+      let rewrittenSupplied := rewrittenTotal.extract 0 arity
+      let rewrittenExcess := rewrittenTotal.extract arity rewrittenTotal.size
+      let rewrittenContinuation : Continuation :=
+        if rewrittenExcess.isEmpty then .resume rewrittenResume
+        else .applyMore rewrittenExcess rewrittenResume
+      let rewrittenTarget : Machine :=
+        { store := rewrittenReleased
+          heapFuel := rewrittenRemaining
+          control := .running
+            { definition := calleeRewrite.definition,
+              values := rewrittenSupplied }
+            (rewrittenContinuation :: rewrittenStack) }
+      RetainSharedMany rewrittenStore rewrittenCaptured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained
+            [.loc rewrittenLocation] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc baselineLocation) baselineArguments baselineResume
+          baselineStack baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc rewrittenLocation) rewrittenArguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations (by
+    change baselineStore.heap.get? baselineLocation = some baselineBox
+    exact boxAt)
+  have papNodes : IxIR1.Sim.NodeIso heap.locRel
+      (.papN address arity baselineCaptured) rewrittenBox.node := by
+    simpa only [← node] using boxes.node
+  obtain ⟨rewrittenCaptured, rewrittenNode, capturedRelated⟩ :=
+    nodeIso_pap_left papNodes
+  have rewrittenShared : rewrittenBox.world = .shared :=
+    boxes.world.symm.trans shared
+  have rewrittenCapturedUnder : rewrittenCaptured.size < arity := by
+    have sizes : baselineCaptured.size = rewrittenCaptured.size := by
+      simpa using capturedRelated.lengths
+    rw [← sizes]
+    exact capturedUnder
+  have totalRelated : IxIR1.Sim.RValsIso heap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    simpa using capturedRelated.append arguments
+  have totalSizes : (baselineCaptured ++ baselineArguments).size =
+      (rewrittenCaptured ++ rewrittenArguments).size := by
+    simpa using totalRelated.lengths
+  have rewrittenTotalEnough :
+      arity ≤ (rewrittenCaptured ++ rewrittenArguments).size := by
+    rw [← totalSizes]
+    exact totalEnough
+  have suppliedRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList :=
+    rvalsIso_array_extract totalRelated 0 arity
+  have excessRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).toList := by
+    have extracted := rvalsIso_array_extract totalRelated arity
+      (baselineCaptured ++ baselineArguments).size
+    simpa [totalSizes] using extracted
+  have targetPapSafe :
+      calleeRewrite.definition.signature.papSafe = true := by
+    simpa using papSafe
+  have targetSuppliedArity :
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size =
+        calleeRewrite.definition.signature.params.size := by
+    have sizes :
+        ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+          ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size := by
+      simpa using suppliedRelated.lengths
+    rw [← sizes, calleeRewrite.definition_signature]
+    exact suppliedArity
+  have targetNonempty :
+      calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  obtain ⟨rewrittenRetained, retainedHeap, targetRetained,
+      retainedRelation⟩ :=
+    retainSharedMany_historyIso heap capturedRelated retained
+  have retainedLocation : retainedHeap.locRel baselineLocation
+      rewrittenLocation := by
+    rw [retainedRelation]
+    exact locations
+  obtain ⟨rewrittenReleased, rewrittenRemaining, releasedHeap,
+      targetReleased, outputFuel, releasedRelation⟩ :=
+    releaseSharedWork_historyIso retainedHeap fuel
+      (.cons (.loc retainedLocation) .nil) released
+  have suppliedReleased : IxIR1.Sim.RValsIso releasedHeap.locRel
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList := by
+    rw [releasedRelation, retainedRelation]
+    exact suppliedRelated
+  have excessReleased : IxIR1.Sim.RValsIso releasedHeap.locRel
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).toList := by
+    rw [releasedRelation, retainedRelation]
+    exact excessRelated
+  have resumeReleased : StableLiveFrameRel limits validation
+      releasedHeap.locRel baselineResume rewrittenResume := by
+    rw [releasedRelation, retainedRelation]
+    exact resume
+  have stackReleased : StableLiveStackIso limits validation
+      releasedHeap.locRel baselineStack rewrittenStack := by
+    rw [releasedRelation, retainedRelation]
+    exact stack
+  let continuation := StableLiveContinuationIso.applyMoreOrResumeIso
+    excessReleased resumeReleased
+  refine ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+    rewrittenRemaining, targetRetained, targetReleased,
+    ApplyTransfer.papFn boxAt shared node capturedUnder retained released
+      totalEnough baselineDeclaration papSafe suppliedArity nonempty,
+    ApplyTransfer.papFn (by
+      change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+      exact rewrittenAt) rewrittenShared rewrittenNode rewrittenCapturedUnder
+      targetRetained targetReleased rewrittenTotalEnough rewrittenDeclaration
+      targetPapSafe targetSuppliedArity targetNonempty, ?_⟩
+  exact StableLiveMachineRel.history releasedHeap outputFuel
+    (.running (StableLiveFrameRel.entry calleeRewrite suppliedReleased)
+      (.cons continuation stackReleased))
+
+/-- Exactly saturated application of a related extern PAP transports its
+ownership work and resumes live callers with the common scalar result. -/
+theorem unchangedApplyTransferPapExternLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineLocation rewrittenLocation : Nat}
+    {baselineBox : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity expectedArity : Nat}
+    {baselineCaptured baselineArguments rewrittenArguments : Array RVal}
+    {value : RVal} {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (locations : heap.locRel baselineLocation rewrittenLocation)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableLiveFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (oracles : baselineContext.oracle = rewrittenContext.oracle)
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (shared : baselineBox.world = .shared)
+    (node : baselineBox.node = .papN address arity baselineCaptured)
+    (capturedUnder : baselineCaptured.size < arity)
+    (retained : RetainSharedMany baselineStore baselineCaptured
+      baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc baselineLocation] = .ok (baselineReleased, baselineRemaining))
+    (totalEnough : arity ≤ (baselineCaptured ++ baselineArguments).size)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern expectedArity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern expectedArity))
+    (suppliedArity :
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+        expectedArity)
+    (remainingEmpty :
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).isEmpty = true)
+    (called : ScalarOracleCall baselineContext address
+      ((baselineCaptured ++ baselineArguments).extract 0 arity) value) :
+    let baselineTarget : Machine :=
+      { store := baselineReleased
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push value }
+          baselineStack }
+    ∃ (rewrittenCaptured : Array RVal)
+        (rewrittenRetained rewrittenReleased : Store)
+        (rewrittenRemaining : Nat),
+      let rewrittenTarget : Machine :=
+        { store := rewrittenReleased
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push value }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore rewrittenCaptured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained
+            [.loc rewrittenLocation] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc baselineLocation) baselineArguments baselineResume
+          baselineStack baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc rewrittenLocation) rewrittenArguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations (by
+    change baselineStore.heap.get? baselineLocation = some baselineBox
+    exact boxAt)
+  have papNodes : IxIR1.Sim.NodeIso heap.locRel
+      (.papN address arity baselineCaptured) rewrittenBox.node := by
+    simpa only [← node] using boxes.node
+  obtain ⟨rewrittenCaptured, rewrittenNode, capturedRelated⟩ :=
+    nodeIso_pap_left papNodes
+  have rewrittenShared : rewrittenBox.world = .shared :=
+    boxes.world.symm.trans shared
+  have rewrittenCapturedUnder : rewrittenCaptured.size < arity := by
+    have sizes : baselineCaptured.size = rewrittenCaptured.size := by
+      simpa using capturedRelated.lengths
+    rw [← sizes]
+    exact capturedUnder
+  have totalRelated : IxIR1.Sim.RValsIso heap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    simpa using capturedRelated.append arguments
+  have totalSizes : (baselineCaptured ++ baselineArguments).size =
+      (rewrittenCaptured ++ rewrittenArguments).size := by
+    simpa using totalRelated.lengths
+  have rewrittenTotalEnough :
+      arity ≤ (rewrittenCaptured ++ rewrittenArguments).size := by
+    rw [← totalSizes]
+    exact totalEnough
+  have suppliedRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList :=
+    rvalsIso_array_extract totalRelated 0 arity
+  have excessRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).toList := by
+    have extracted := rvalsIso_array_extract totalRelated arity
+      (baselineCaptured ++ baselineArguments).size
+    simpa [totalSizes] using extracted
+  have targetSuppliedArity :
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size =
+        expectedArity := by
+    have sizes :
+        ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+          ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size := by
+      simpa using suppliedRelated.lengths
+    rw [← sizes]
+    exact suppliedArity
+  have targetRemainingEmpty :
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).isEmpty = true := by
+    have lengths := excessRelated.lengths
+    have sizes :
+        ((baselineCaptured ++ baselineArguments).extract arity
+          (baselineCaptured ++ baselineArguments).size).size =
+        ((rewrittenCaptured ++ rewrittenArguments).extract arity
+          (rewrittenCaptured ++ rewrittenArguments).size).size := by
+      simpa only [Array.length_toList] using lengths
+    have emptyEq :
+        ((baselineCaptured ++ baselineArguments).extract arity
+          (baselineCaptured ++ baselineArguments).size).isEmpty =
+        ((rewrittenCaptured ++ rewrittenArguments).extract arity
+          (rewrittenCaptured ++ rewrittenArguments).size).isEmpty := by
+      simp only [Array.isEmpty]
+      rw [sizes]
+    rw [← emptyEq]
+    exact remainingEmpty
+  obtain ⟨argumentsScalar, valueScalar⟩ := called.scalar
+  have suppliedListsEq :
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList =
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList := by
+    apply suppliedRelated.eq_of_allScalar
+    rw [Array.all_toList]
+    exact argumentsScalar
+  have suppliedEq :
+      (baselineCaptured ++ baselineArguments).extract 0 arity =
+      (rewrittenCaptured ++ rewrittenArguments).extract 0 arity :=
+    Array.toList_inj.mp suppliedListsEq
+  have targetCalled : ScalarOracleCall rewrittenContext address
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity) value := by
+    rw [← suppliedEq]
+    exact called.congrOracle oracles
+  obtain ⟨rewrittenRetained, retainedHeap, targetRetained,
+      retainedRelation⟩ :=
+    retainSharedMany_historyIso heap capturedRelated retained
+  have retainedLocation : retainedHeap.locRel baselineLocation
+      rewrittenLocation := by
+    rw [retainedRelation]
+    exact locations
+  obtain ⟨rewrittenReleased, rewrittenRemaining, releasedHeap,
+      targetReleased, outputFuel, releasedRelation⟩ :=
+    releaseSharedWork_historyIso retainedHeap fuel
+      (.cons (.loc retainedLocation) .nil) released
+  have outputResume : StableLiveFrameRel limits validation
+      releasedHeap.locRel
+      { baselineResume with values := baselineResume.values.push value }
+      { rewrittenResume with values := rewrittenResume.values.push value } := by
+    rw [releasedRelation, retainedRelation]
+    exact resume.push (IxIR1.Sim.RValIso.refl_of_scalar valueScalar)
+  have outputStack : StableLiveStackIso limits validation releasedHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [releasedRelation, retainedRelation]
+    exact stack
+  refine ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+    rewrittenRemaining, targetRetained, targetReleased,
+    ApplyTransfer.papExtern boxAt shared node capturedUnder retained released
+      totalEnough baselineDeclaration suppliedArity remainingEmpty called,
+    ApplyTransfer.papExtern (by
+      change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+      exact rewrittenAt) rewrittenShared rewrittenNode rewrittenCapturedUnder
+      targetRetained targetReleased rewrittenTotalEnough rewrittenDeclaration
+      targetSuppliedArity targetRemainingEmpty targetCalled, ?_⟩
+  exact StableLiveMachineRel.history releasedHeap outputFuel
+    (.running outputResume outputStack)
+
+/-- Exhaustive allocation-history simulation of dynamic application over
+live-indexed resume frames and stacks. -/
+theorem unchangedApplyTransferLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFunction rewrittenFunction : RVal}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (function : IxIR1.Sim.RValIso heap.locRel
+      baselineFunction rewrittenFunction)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableLiveFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFunction
+      baselineArguments baselineResume baselineStack baselineTarget) :
+    ∃ rewrittenTarget,
+      ApplyTransfer
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation rewrittenStore rewrittenFuel rewrittenFunction
+          rewrittenArguments rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  have classified := transferred.classify
+  cases classified with
+  | erased released =>
+      cases function with
+      | erased =>
+          obtain ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferErasedLiveIso
+              (baselineContext := Eval.Context.ofProgram sourceProgram
+                validation.schemas oracle)
+              (rewrittenContext := Eval.Context.ofProgram trace.target
+                validation.schemas oracle)
+              heap fuel arguments resume stack released
+          exact ⟨_, targetTransfer, related⟩
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      cases function with
+      | @loc _ rewrittenLocation locations =>
+          obtain ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+              rewrittenRemaining, targetRetained, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferPapUnderLiveIso
+              (baselineContext := Eval.Context.ofProgram sourceProgram
+                validation.schemas oracle)
+              (rewrittenContext := Eval.Context.ofProgram trace.target
+                validation.schemas oracle)
+              heap fuel locations arguments resume stack boxAt shared node
+                capturedUnder retained released totalUnder
+          exact ⟨_, targetTransfer, related⟩
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      cases function with
+      | @loc _ rewrittenLocation locations =>
+          obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+            trace.context_fn declaration
+          obtain ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+              rewrittenRemaining, targetRetained, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferPapFnLiveIso calleeRewrite heap fuel locations
+              arguments resume stack boxAt shared node capturedUnder retained
+              released totalEnough declaration targetDeclaration papSafe
+              suppliedArity nonempty
+          exact ⟨_, targetTransfer, related⟩
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      cases function with
+      | @loc _ rewrittenLocation locations =>
+          have targetDeclaration := trace.context_extern declaration
+          obtain ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+              rewrittenRemaining, targetRetained, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferPapExternLiveIso
+              (baselineContext := Eval.Context.ofProgram sourceProgram
+                validation.schemas oracle)
+              (rewrittenContext := Eval.Context.ofProgram trace.target
+                validation.schemas oracle)
+              heap fuel locations arguments resume stack rfl boxAt shared node
+              capturedUnder retained released totalEnough declaration
+              targetDeclaration suppliedArity remainingEmpty called
+          exact ⟨_, targetTransfer, related⟩
+
+/-- A source `apply` instruction determines a matching target transfer from
+syntax-derived liveness of its function and argument operands. -/
+theorem unchangedApplyStepOfTraceLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {functionAtom : Atom} {argumentAtoms : Array Atom}
+    {baselineFunction : RVal} {baselineArguments : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .apply functionAtom argumentAtoms)
+    (noCredits : NoLiveCredits baselineFrame)
+    (functionResolved : Eval.resolveAtom baselineFrame.values functionAtom =
+      .ok baselineFunction)
+    (argumentsResolved : Eval.resolveAtoms baselineFrame.values argumentAtoms =
+      .ok baselineArguments)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFunction
+      baselineArguments { baselineFrame with pc := baselineFrame.pc + 1 }
+      baselineStack baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have instructionAt : block.instructions[baselineFrame.pc]? =
+      some (.apply functionAtom argumentAtoms) := by
+    simpa [instruction] using Array.getElem?_eq_getElem pc
+  have functionLive := AtomLiveFrom.instruction sourceBlockAt instructionAt
+    Liveness.InstrUsesAtom.applyFunction
+  have argumentsLive : AtomsLiveFrom source baselineFrame.block
+      baselineFrame.pc argumentAtoms :=
+    AtomsLiveFrom.instruction sourceBlockAt instructionAt (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.applyArgument member)
+  obtain ⟨rewrittenFunction, targetFunctionResolved, functionRelated⟩ :=
+    frame.values.resolveAtom functionLive functionResolved
+  obtain ⟨rewrittenArguments, targetArgumentsResolved, argumentsRelated⟩ :=
+    frame.values.resolveAtoms argumentsLive argumentsResolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .apply functionAtom argumentAtoms := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resume : StableLiveFrameRel limits validation heap.locRel
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } :=
+    .rewritten rewrite frame.advance
+  obtain ⟨rewrittenTarget, targetTransferred, related⟩ :=
+    unchangedApplyTransferLiveIso trace heap fuel functionRelated
+      argumentsRelated resume stack transferred
+  refine ⟨rewrittenTarget,
+    Step.applyCleared rfl sourceAt pc instruction noCredits functionResolved
+      argumentsResolved transferred,
+    Step.applyCleared rfl targetAt targetPc targetInstruction targetNoCredits
+      targetFunctionResolved targetArgumentsResolved targetTransferred,
+    related⟩
+
+/-- A return through `applyMore` resolves the live return operand and feeds
+the fully related pending argument vectors through dynamic application. -/
+theorem unchangedRetApplyMoreStepOfTraceLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baselineRest rewrittenRest : List Continuation}
+    {baselineTarget : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (caller : StableLiveFrameRel limits validation heap.locRel
+      baselineCaller rewrittenCaller)
+    (rest : StableLiveStackIso limits validation heap.locRel
+      baselineRest rewrittenRest)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : Eval.resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : baselineValue.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineValue
+      baselineArguments baselineCaller baselineRest baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame
+              (.applyMore baselineArguments baselineCaller :: baselineRest) }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame
+              (.applyMore rewrittenArguments rewrittenCaller ::
+                rewrittenRest) }
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget := by
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact sourceAt
+  have atomLive := AtomLiveFrom.ret sourceBlockAt pc terminator
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    frame.values.resolveAtom atomLive resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : rewrittenValue.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq,
+      ← Ix.Compiler.IxIR2.ReuseSim.heapHistoryIso_rvalHasWorld_eq heap
+        valueRelated]
+    exact world
+  obtain ⟨rewrittenTarget, targetTransferred, related⟩ :=
+    unchangedApplyTransferLiveIso trace heap fuel valueRelated arguments caller
+      rest transferred
+  refine ⟨rewrittenTarget,
+    Step.retApplyMoreCleared rfl sourceAt pc terminator resolved noCredits
+      world transferred,
+    Step.retApplyMoreCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld targetTransferred,
+    related⟩
+
+/-! ## Exhaustive liveness-indexed unchanged-block dispatch -/
+
+set_option maxHeartbeats 1000000 in
+/-- Every successful instruction in an unchanged block is equivariant under
+an arbitrary allocation-history isomorphism using only future-live registers. -/
+theorem unchangedInstructionStepOfTraceLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {instruction : Instr} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instructionAt : block.instructions[baselineFrame.pc] = instruction)
+    (classified : InstructionTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      instruction baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases classified with
+  | move resolved =>
+      obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+        unchangedMoveStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | alloc schemaAt resolved fields =>
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedAllocStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      obtain ⟨rewrittenValues, rewrittenTaken, sourceStep, targetStep,
+          related⟩ :=
+        unchangedAllocWithAbsentStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout absent
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithLogical mode schemaAt resolved fields taken layout present =>
+      cases mode
+      obtain ⟨rewrittenValues, rewrittenTaken, sourceStep, targetStep,
+          related⟩ :=
+        unchangedAllocWithLogicalStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout present
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithPhysical mode schemaAt resolved fields taken layout present
+      reused =>
+      cases mode
+      obtain ⟨rewrittenValues, rewrittenTaken, rewrittenLocation,
+          rewrittenOut, targetReused, sourceStep, targetStep, related⟩ :=
+        unchangedAllocWithPhysicalStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout present reused
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardAbsent taken absent =>
+      obtain ⟨rewrittenTaken, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditAbsentStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken absent
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardLogical mode taken present =>
+      cases mode
+      obtain ⟨rewrittenTaken, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditLogicalStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken present
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardPhysical mode taken present released =>
+      cases mode
+      obtain ⟨rewrittenTaken, rewrittenLocation, rewrittenOut,
+          targetReleased, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditPhysicalStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken present released
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | takeUniqueLogical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedTakeUniqueLogicalStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedTakeUniquePhysicalStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | resetSharedLogicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedResetSharedLogicalHotStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedResetSharedPhysicalHotStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | resetSharedCold schemaAt resolved viewed shared retained =>
+      obtain ⟨rewrittenFields, rewrittenOut, sourceStep, targetStep,
+          related⟩ :=
+        unchangedResetSharedColdStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          shared retained
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retainShared resolved retained =>
+      obtain ⟨rewrittenValue, rewrittenOut, targetRetained, sourceStep,
+          targetStep, related⟩ :=
+        unchangedRetainSharedStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved retained
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | releaseShared resolved released =>
+      obtain ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+          targetReleased, sourceStep, targetStep, related⟩ :=
+        unchangedReleaseSharedStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved released
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | dropUnique resolved dropped =>
+      obtain ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+          targetDropped, sourceStep, targetStep, related⟩ :=
+        unchangedDropUniqueStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved dropped
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | freeUnique resolved viewed scalarFields =>
+      obtain ⟨boxAt, unique, node⟩ := viewed.parts
+      obtain ⟨rewrittenLocation, sourceStep, targetStep, related⟩ :=
+        unchangedFreeUniqueStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved boxAt unique node
+          scalarFields
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | fetch resolved boxAt node fieldAt =>
+      obtain ⟨rewrittenValue, sourceStep, targetStep, related, _nextFrame⟩ :=
+        unchangedFetchStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved boxAt node fieldAt
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | callFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedCallFnStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+          frame stack sourceAt targetAt pc instructionAt noCredits resolved
+          declaration targetDeclaration arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | callSelf noCredits resolved arity nonempty =>
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedCallSelfStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt noCredits resolved arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | pappFn noCredits declaration papSafe resolved under =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedPappFnStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+          frame stack sourceAt targetAt pc instructionAt noCredits declaration
+          targetDeclaration papSafe resolved under
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | pappExtern noCredits declaration resolved under =>
+      have targetDeclaration := trace.context_extern declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedPappExternStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt noCredits declaration
+          targetDeclaration resolved under
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact unchangedApplyStepOfTraceLiveIso trace rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt noCredits functionResolved
+        argumentsResolved transferred
+  | extern noCredits resolved declaration argumentArity called =>
+      have targetDeclaration := trace.context_extern declaration
+      obtain ⟨sourceStep, targetStep, related⟩ :=
+        unchangedExternStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          rfl sourceAt targetAt pc instructionAt noCredits resolved declaration
+          targetDeclaration argumentArity called
+      exact ⟨_, sourceStep, targetStep, related⟩
+
+/-- An unchanged instruction from the accepted-prefix family advances both
+machines inside the same literal block. The related endpoint therefore
+satisfies accepted-entry phase without requiring a syntax exclusion: an
+accepted decision could not have left that target block unchanged. -/
+theorem unchangedAcceptedPrefixInstructionStepOfTraceLiveIso
+    {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {instruction : Instr} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instructionAt : block.instructions[baselineFrame.pc] = instruction)
+    (classified : InstructionTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      instruction baselineTarget)
+    (acceptedPrefix : AcceptedPrefixInstruction instruction) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget
+          rewrittenTarget ∧
+        StableLiveAcceptedEntry limits validation baselineTarget
+          rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases acceptedPrefix with
+  | fetch target cid field =>
+      cases classified with
+      | fetch resolved boxAt node fieldAt =>
+          obtain ⟨rewrittenValue, sourceStep, targetStep, related,
+              _nextFrame⟩ :=
+            unchangedFetchStepLiveIso (baselineContext := baselineContext)
+              (rewrittenContext := rewrittenContext) rewrite heap fuel frame
+              stack sourceAt targetAt pc instructionAt resolved boxAt node
+              fieldAt
+          exact ⟨_, sourceStep, targetStep, related,
+            StableLiveAcceptedEntry.ofSameBlock rfl rfl
+              (by simpa using sourceAt) (by simpa using targetAt)⟩
+  | retainShared target =>
+      cases classified with
+      | retainShared resolved retained =>
+          obtain ⟨rewrittenValue, rewrittenOut, targetRetained, sourceStep,
+              targetStep, related⟩ :=
+            unchangedRetainSharedStepLiveIso
+              (baselineContext := baselineContext)
+              (rewrittenContext := rewrittenContext) rewrite heap fuel frame
+              stack sourceAt targetAt pc instructionAt resolved retained
+          exact ⟨_, sourceStep, targetStep, related,
+            StableLiveAcceptedEntry.ofSameBlock rfl rfl
+              (by simpa using sourceAt) (by simpa using targetAt)⟩
+  | releaseShared target =>
+      cases classified with
+      | releaseShared resolved released =>
+          obtain ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+              targetReleased, sourceStep, targetStep, related⟩ :=
+            unchangedReleaseSharedStepLiveIso
+              (baselineContext := baselineContext)
+              (rewrittenContext := rewrittenContext) rewrite heap fuel frame
+              stack sourceAt targetAt pc instructionAt resolved released
+          exact ⟨_, sourceStep, targetStep, related,
+            StableLiveAcceptedEntry.ofSameBlock rfl rfl
+              (by simpa using sourceAt) (by simpa using targetAt)⟩
+  | allocShared cid arguments =>
+      cases classified with
+      | alloc schemaAt resolved fields =>
+          obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+            unchangedAllocStepLiveIso (baselineContext := baselineContext)
+              (rewrittenContext := rewrittenContext) rewrite rfl heap fuel
+              frame stack sourceAt targetAt pc instructionAt schemaAt resolved
+              fields
+          exact ⟨_, sourceStep, targetStep, related,
+            StableLiveAcceptedEntry.ofSameBlock rfl rfl
+              (by simpa using sourceAt) (by simpa using targetAt)⟩
+
+set_option maxHeartbeats 1000000 in
+/-- Every successful terminator in an unchanged block is equivariant under
+an arbitrary allocation-history isomorphism using only future-live registers. -/
+theorem unchangedTerminatorStepOfTraceLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {terminator : Terminator} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    (classified : TerminatorTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      terminator baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases classified with
+  | jump transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedJumpStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related,
+          _targetFrame⟩ :=
+        unchangedSwitchCtorStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt resolved boxAt node alternativeAt
+          transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | switchNatZero resolved transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedSwitchNatZeroStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt resolved transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | switchNatSucc resolved transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedSwitchNatSuccStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt resolved transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | branchPresent lookedUp present transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedBranchCreditPresentStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt lookedUp present transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | branchAbsent lookedUp absent transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedBranchCreditAbsentStepLiveIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt lookedUp absent transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retResume resolved noCredits world =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | resume caller =>
+              obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+                unchangedRetResumeStepLiveIso
+                  (baselineContext := baselineContext)
+                  (rewrittenContext := rewrittenContext) rewrite heap fuel
+                  frame caller rest sourceAt targetAt pc terminatorAt resolved
+                  noCredits world
+              exact ⟨_, sourceStep, targetStep, related⟩
+  | retHalt resolved noCredits world =>
+      cases stack
+      obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+        unchangedRetHaltStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame
+          sourceAt targetAt pc terminatorAt resolved noCredits world
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retApplyMore resolved noCredits world transferred =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | applyMore arguments caller =>
+              exact unchangedRetApplyMoreStepOfTraceLiveIso trace rewrite heap
+                fuel frame arguments caller rest sourceAt targetAt pc
+                terminatorAt resolved noCredits world transferred
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedTailCallFnStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+          frame stack sourceAt targetAt pc terminatorAt noCredits resolved
+          declaration targetDeclaration arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | tailCallSelf noCredits resolved arity nonempty =>
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedTailCallSelfStepLiveIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt noCredits resolved arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+
+/-- A source step at a literally preserved block is matched under any
+allocation-history isomorphism.  Instruction and terminator classification
+remain entirely behind the public evaluator interfaces. -/
+theorem unchangedStepOfTraceLiveIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableLiveMachineRel limits validation baselineTarget rewrittenTarget := by
+  have classified := stepped.classify
+  cases classified with
+  | instruction classifiedAt pc instructionAt instructionCase =>
+      have blockEq := Option.some.inj (classifiedAt.symm.trans sourceAt)
+      cases blockEq
+      obtain ⟨rewrittenTarget, _sourceStep, targetStep, related⟩ :=
+        unchangedInstructionStepOfTraceLiveIso trace rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt instructionCase
+      exact ⟨rewrittenTarget, targetStep, related⟩
+  | terminator classifiedAt pc terminatorAt terminatorCase =>
+      have blockEq := Option.some.inj (classifiedAt.symm.trans sourceAt)
+      cases blockEq
+      obtain ⟨rewrittenTarget, _sourceStep, targetStep, related⟩ :=
+        unchangedTerminatorStepOfTraceLiveIso trace rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt terminatorCase
+      exact ⟨rewrittenTarget, targetStep, related⟩
+
+theorem instructionAllocationEvents_history
+    {limits : Validate.Limits} {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineFrame rewrittenFrame : Frame}
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    {block : Block} {instruction : Instr}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? = some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instructionAt : block.instructions[baselineFrame.pc] = instruction)
+    {context : Eval.Context} {interpretation : Interpretation} {heapFuel : Nat}
+    {stack : List Continuation} {target : Machine}
+    (classified : InstructionTransferCase context interpretation baselineStore heapFuel
+      baselineFrame stack instruction target) :
+    instructionAllocationEvents baselineStore baselineFrame instruction =
+      instructionAllocationEvents rewrittenStore rewrittenFrame instruction := by
+  cases instruction <;> try rfl
+  case apply functionAtom argumentAtoms =>
+    cases classified with
+    | apply noCredits functionResolved argumentsResolved transferred =>
+        have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+          rwa [frame.baselineDefinition] at sourceAt
+        have atIndex : block.instructions[baselineFrame.pc]? =
+            some (.apply functionAtom argumentAtoms) := by
+          simpa [instructionAt] using Array.getElem?_eq_getElem pc
+        have functionLive := AtomLiveFrom.instruction sourceBlockAt atIndex
+          Liveness.InstrUsesAtom.applyFunction
+        have argumentsLive := AtomsLiveFrom.instruction sourceBlockAt atIndex
+          (atoms := argumentAtoms) (by
+            intro atom member
+            exact Liveness.InstrUsesAtom.applyArgument member)
+        obtain ⟨rewrittenFunction, targetFunction, functions⟩ :=
+          frame.values.resolveAtom functionLive functionResolved
+        obtain ⟨rewrittenArguments, targetArguments, arguments⟩ :=
+          frame.values.resolveAtoms argumentsLive argumentsResolved
+        simp only [instructionAllocationEvents, functionResolved, argumentsResolved,
+          targetFunction, targetArguments]
+        exact applyAllocationEvents_history heap functions (by simpa using arguments.lengths)
+
+theorem terminatorAllocationEvents_history
+    {limits : Validate.Limits} {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineFrame rewrittenFrame : Frame}
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation heap.locRel baselineStack rewrittenStack)
+    {block : Block} {terminator : Terminator}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? = some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    {context : Eval.Context} {interpretation : Interpretation} {heapFuel : Nat}
+    {target : Machine}
+    (classified : TerminatorTransferCase context interpretation baselineStore heapFuel
+      baselineFrame baselineStack terminator target) :
+    terminatorAllocationEvents baselineStore baselineFrame baselineStack terminator =
+      terminatorAllocationEvents rewrittenStore rewrittenFrame rewrittenStack terminator := by
+  cases terminator <;> try rfl
+  case ret atom =>
+    cases stack with
+    | nil => rfl
+    | cons head tail =>
+        cases head with
+        | resume caller => rfl
+        | applyMore arguments caller =>
+            cases classified with
+            | retApplyMore resolved noCredits world transferred =>
+                have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+                  rwa [frame.baselineDefinition] at sourceAt
+                obtain ⟨rewrittenValue, targetResolved, values⟩ :=
+                  frame.values.resolveAtom
+                    (AtomLiveFrom.ret sourceBlockAt pc terminatorAt) resolved
+                simp only [terminatorAllocationEvents, resolved, targetResolved]
+                exact applyAllocationEvents_history heap values (by simpa using arguments.lengths)
+
+/-- Two successful steps in the same unchanged block have equal allocation
+event increments. Operand liveness and the history relation also cover
+dynamic partial application and returns through pending arguments. -/
+theorem unchangedStep_allocationDelta
+    {limits : Validate.Limits} {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineFrame rewrittenFrame : Frame}
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation heap.locRel baselineStack rewrittenStack)
+    {block : Block}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? = some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? = some block)
+    {baselineContext rewrittenContext : Eval.Context} {interpretation : Interpretation}
+    {baselineFuel rewrittenFuel : Nat} {baselineTarget rewrittenTarget : Machine}
+    (baselineStep : Step baselineContext interpretation
+      ⟨baselineStore, baselineFuel, .running baselineFrame baselineStack⟩ baselineTarget)
+    (rewrittenStep : Step rewrittenContext interpretation
+      ⟨rewrittenStore, rewrittenFuel, .running rewrittenFrame rewrittenStack⟩ rewrittenTarget) :
+    AllocationDelta baselineStore baselineTarget.store rewrittenStore rewrittenTarget.store := by
+  cases baselineStep.classify with
+  | instruction found pc instructionAt classified =>
+      have blockEq := Option.some.inj (found.symm.trans sourceAt)
+      subst block
+      have targetPc := pc
+      rw [frame.pc] at targetPc
+      have targetInstruction := instructionAt
+      simp only [frame.pc] at targetInstruction
+      have baseline := classified.allocationEvents
+      have rewritten := rewrittenStep.instructionAllocationEvents targetAt targetPc targetInstruction
+      have cost := instructionAllocationEvents_history heap frame sourceAt pc instructionAt classified
+      rw [← cost] at rewritten
+      exact AllocationDelta.of_increments baseline rewritten
+  | terminator found pc terminatorAt classified =>
+      have blockEq := Option.some.inj (found.symm.trans sourceAt)
+      subst block
+      have targetPc : rewrittenFrame.pc = _ := frame.pc.symm.trans pc
+      have baseline := classified.allocationEvents
+      have rewritten := rewrittenStep.terminatorAllocationEvents targetAt targetPc terminatorAt
+      have cost := terminatorAllocationEvents_history heap frame stack sourceAt pc terminatorAt classified
+      rw [← cost] at rewritten
+      exact AllocationDelta.of_increments baseline rewritten
+
+
+theorem instructionRCCharge_history
+    {limits : Validate.Limits} {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineFrame rewrittenFrame : Frame}
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    {block : Block} {instruction : Instr}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? = some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instructionAt : block.instructions[baselineFrame.pc] = instruction)
+    {context : Eval.Context} {interpretation : Interpretation} {heapFuel : Nat}
+    {stack : List Continuation} {target : Machine}
+    (classified : InstructionTransferCase context interpretation baselineStore heapFuel
+      baselineFrame stack instruction target) :
+    instructionRCCharge baselineStore baselineFrame instruction =
+      instructionRCCharge rewrittenStore rewrittenFrame instruction := by
+  have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+    rwa [frame.baselineDefinition] at sourceAt
+  have atIndex : block.instructions[baselineFrame.pc]? = some instruction := by
+    simpa [instructionAt] using Array.getElem?_eq_getElem pc
+  cases instruction <;> try rfl
+  case retainShared atom =>
+    cases classified with
+    | retainShared resolved retained =>
+        obtain ⟨rewrittenValue, targetResolved, values⟩ := frame.values.resolveAtom
+          (AtomLiveFrom.instruction sourceBlockAt atIndex Liveness.InstrUsesAtom.retainShared) resolved
+        simp only [instructionRCCharge, resolved, targetResolved]
+        cases values <;> rfl
+  case resetShared atom cid =>
+    have lift : ∀ {value}, resolveAtom baselineFrame.values atom = .ok value →
+        instructionRCCharge baselineStore baselineFrame (.resetShared atom cid) =
+          instructionRCCharge rewrittenStore rewrittenFrame (.resetShared atom cid) := by
+      intro value resolved
+      obtain ⟨rewrittenValue, targetResolved, values⟩ := frame.values.resolveAtom
+        (AtomLiveFrom.instruction sourceBlockAt atIndex Liveness.InstrUsesAtom.resetShared) resolved
+      simpa only [instructionRCCharge, resolved, targetResolved] using resetRCCharge_history heap values
+    cases classified <;> exact lift (by assumption)
+  case apply functionAtom argumentAtoms =>
+    cases classified with
+    | apply noCredits functionResolved argumentsResolved transferred =>
+        obtain ⟨rewrittenFunction, targetFunction, functions⟩ := frame.values.resolveAtom
+          (AtomLiveFrom.instruction sourceBlockAt atIndex Liveness.InstrUsesAtom.applyFunction)
+          functionResolved
+        obtain ⟨rewrittenArguments, targetArguments, arguments⟩ := frame.values.resolveAtoms
+          (AtomsLiveFrom.instruction sourceBlockAt atIndex (atoms := argumentAtoms) (by
+            intro atom member; exact Liveness.InstrUsesAtom.applyArgument member)) argumentsResolved
+        simp only [instructionRCCharge, functionResolved, argumentsResolved,
+          targetFunction, targetArguments]
+        exact applyRCCharge_history heap functions (by simpa using arguments.lengths)
+
+theorem terminatorRCCharge_history
+    {limits : Validate.Limits} {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineFrame rewrittenFrame : Frame}
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation heap.locRel baselineStack rewrittenStack)
+    {block : Block} {terminator : Terminator}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? = some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    {context : Eval.Context} {interpretation : Interpretation} {heapFuel : Nat}
+    {target : Machine}
+    (classified : TerminatorTransferCase context interpretation baselineStore heapFuel
+      baselineFrame baselineStack terminator target) :
+    terminatorRCCharge baselineStore baselineFrame baselineStack terminator =
+      terminatorRCCharge rewrittenStore rewrittenFrame rewrittenStack terminator := by
+  cases terminator <;> try rfl
+  case ret atom =>
+    cases stack with
+    | nil => rfl
+    | cons head tail =>
+        cases head with
+        | resume caller => rfl
+        | applyMore arguments caller =>
+            cases classified with
+            | retApplyMore resolved noCredits world transferred =>
+                have sourceBlockAt : source.blocks[baselineFrame.block]? = some block := by
+                  rwa [frame.baselineDefinition] at sourceAt
+                obtain ⟨rewrittenValue, targetResolved, values⟩ := frame.values.resolveAtom
+                  (AtomLiveFrom.ret sourceBlockAt pc terminatorAt) resolved
+                simp only [terminatorRCCharge, resolved, targetResolved]
+                exact applyRCCharge_history heap values (by simpa using arguments.lengths)
+
+/-- Ordinary matched steps compare their exact RC charges and recorded peaks.
+The independent cost certificate does not alter the semantic relation. -/
+theorem unchangedStep_costDelta
+    {limits : Validate.Limits} {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baselineStore rewrittenStore : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineFrame rewrittenFrame : Frame}
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation heap.locRel baselineStack rewrittenStack)
+    {block : Block}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? = some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? = some block)
+    {baselineContext rewrittenContext : Eval.Context} {interpretation : Interpretation}
+    {baselineFuel rewrittenFuel : Nat} {baselineTarget rewrittenTarget : Machine}
+    (baselineStep : Step baselineContext interpretation
+      ⟨baselineStore, baselineFuel, .running baselineFrame baselineStack⟩ baselineTarget)
+    (rewrittenStep : Step rewrittenContext interpretation
+      ⟨rewrittenStore, rewrittenFuel, .running rewrittenFrame rewrittenStack⟩ rewrittenTarget)
+    (related : StableLiveMachineRel limits validation baselineTarget rewrittenTarget) :
+    CostDelta baselineStore baselineTarget.store rewrittenStore rewrittenTarget.store := by
+  obtain ⟨locRel, outputHeaps, _fuel, _control⟩ := related
+  cases baselineStep.classify with
+  | instruction found pc instructionAt classified =>
+      have blockEq := Option.some.inj (found.symm.trans sourceAt)
+      subst block
+      have targetPc := pc
+      rw [frame.pc] at targetPc
+      have targetInstruction := instructionAt
+      simp only [frame.pc] at targetInstruction
+      have rewritten := rewrittenStep.instructionCosts targetAt targetPc targetInstruction
+      have charge := instructionRCCharge_history heap frame sourceAt pc instructionAt classified
+      have events := instructionAllocationEvents_history heap frame sourceAt pc instructionAt classified
+      rw [← charge, ← events] at rewritten
+      exact CostDelta.of_observations (history_pendingRC_eq heap) outputHeaps.pendingRC_eq
+        outputHeaps.live_eq classified.rcCharge rewritten.1 classified.peakLive rewritten.2
+  | terminator found pc terminatorAt classified =>
+      have blockEq := Option.some.inj (found.symm.trans sourceAt)
+      subst block
+      have targetPc : rewrittenFrame.pc = _ := frame.pc.symm.trans pc
+      have rewritten := rewrittenStep.terminatorCosts targetAt targetPc terminatorAt
+      have charge := terminatorRCCharge_history heap frame stack sourceAt pc terminatorAt classified
+      have events := terminatorAllocationEvents_history heap frame stack sourceAt pc terminatorAt classified
+      rw [← charge, ← events] at rewritten
+      exact CostDelta.of_observations (history_pendingRC_eq heap) outputHeaps.pendingRC_eq
+        outputHeaps.live_eq classified.rcCharge rewritten.1 classified.peakLive rewritten.2
+
+
+/-! ## Liveness-indexed macro and whole-run lifting -/
+
+/-- A synchronization macro whose endpoints use the live-indexed machine
+relation. -/
+inductive StableLiveMacroSimulation (limits : Validate.Limits)
+    (validation : Validate.Context) (baselineContext rewrittenContext :
+      Eval.Context) (interpretation : Interpretation)
+    (baselineStart rewrittenStart : Machine) : Prop where
+  | intro (baselineCount rewrittenCount : Nat)
+      (baselinePositive : 0 < baselineCount)
+      (rewrittenPositive : 0 < rewrittenCount)
+      (baselineTarget rewrittenTarget : Machine)
+      (baselineSteps : Steps baselineContext interpretation baselineCount
+        baselineStart baselineTarget)
+      (rewrittenSteps : Steps rewrittenContext interpretation rewrittenCount
+        rewrittenStart rewrittenTarget)
+      (related : StableLiveMachineRel limits validation baselineTarget
+        rewrittenTarget)
+
+/-- A live-indexed synchronization macro whose baseline length remains visible
+in its type.  Accepted-site attachment uses this index to identify the
+semantic baseline endpoint with the independently reconstructed compiler
+endpoint by fixed-length determinism. Separate certificates record equal
+allocation events and compare RC/peak costs without strengthening the semantic
+relation. -/
+inductive StableLiveMacroSimulationAt (limits : Validate.Limits)
+    (validation : Validate.Context) (baselineContext rewrittenContext :
+      Eval.Context) (interpretation : Interpretation)
+    (baselineCount : Nat) (baselineStart rewrittenStart : Machine) : Prop where
+  | intro (baselinePositive : 0 < baselineCount)
+      (rewrittenCount : Nat) (rewrittenPositive : 0 < rewrittenCount)
+      (baselineTarget rewrittenTarget : Machine)
+      (baselineSteps : Steps baselineContext interpretation baselineCount
+        baselineStart baselineTarget)
+      (rewrittenSteps : Steps rewrittenContext interpretation rewrittenCount
+        rewrittenStart rewrittenTarget)
+      (related : StableLiveMachineRel limits validation baselineTarget
+        rewrittenTarget)
+      (allocationDelta : AllocationDelta baselineStart.store baselineTarget.store
+        rewrittenStart.store rewrittenTarget.store)
+      (costDelta : CostDelta baselineStart.store baselineTarget.store
+        rewrittenStart.store rewrittenTarget.store)
+
+/-- Forget the visible baseline length of an indexed synchronization macro. -/
+theorem StableLiveMacroSimulationAt.simulation {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation} {baselineCount : Nat}
+    {baselineStart rewrittenStart : Machine}
+    (step : StableLiveMacroSimulationAt limits validation baselineContext
+      rewrittenContext interpretation baselineCount baselineStart
+      rewrittenStart) :
+    StableLiveMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart := by
+  cases step with
+  | intro baselinePositive rewrittenCount rewrittenPositive baselineTarget
+      rewrittenTarget baselineSteps rewrittenSteps related _allocationDelta _costDelta =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related
+
+/-- A live-indexed synchronization macro together with preservation of the
+compiler/runtime invariant chosen by its caller. -/
+inductive StableLiveMacroInvariantStep (limits : Validate.Limits)
+    (validation : Validate.Context) (baselineContext rewrittenContext :
+      Eval.Context) (interpretation : Interpretation)
+    (invariant : Machine → Machine → Prop)
+    (baselineStart rewrittenStart : Machine) : Prop where
+  | intro (baselineCount rewrittenCount : Nat)
+      (baselinePositive : 0 < baselineCount)
+      (rewrittenPositive : 0 < rewrittenCount)
+      (baselineTarget rewrittenTarget : Machine)
+      (baselineSteps : Steps baselineContext interpretation baselineCount
+        baselineStart baselineTarget)
+      (rewrittenSteps : Steps rewrittenContext interpretation rewrittenCount
+        rewrittenStart rewrittenTarget)
+      (related : StableLiveMachineRel limits validation baselineTarget
+        rewrittenTarget)
+      (preserved : invariant baselineTarget rewrittenTarget)
+
+/-- Forget invariant preservation while retaining the live-indexed endpoint
+relation. -/
+theorem StableLiveMacroInvariantStep.simulation {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {invariant : Machine → Machine → Prop}
+    {baselineStart rewrittenStart : Machine}
+    (step : StableLiveMacroInvariantStep limits validation baselineContext
+      rewrittenContext interpretation invariant baselineStart
+      rewrittenStart) :
+    StableLiveMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart := by
+  cases step with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related
+      _preserved =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related
+
+/-- Strengthen a live-indexed synchronization macro after proving the global
+invariant at its endpoint. -/
+theorem StableLiveMacroSimulation.preserveInvariant
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {invariant : Machine → Machine → Prop}
+    {baselineStart rewrittenStart : Machine}
+    (simulation : StableLiveMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart)
+    (preserved : ∀ {baselineCount rewrittenCount : Nat}
+        {baselineTarget rewrittenTarget : Machine},
+      Steps baselineContext interpretation baselineCount baselineStart
+          baselineTarget →
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenTarget →
+      StableLiveMachineRel limits validation baselineTarget rewrittenTarget →
+      invariant baselineTarget rewrittenTarget) :
+    StableLiveMacroInvariantStep limits validation baselineContext
+      rewrittenContext interpretation invariant baselineStart
+      rewrittenStart := by
+  cases simulation with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related (preserved baselineSteps rewrittenSteps related)
+
+/-- Package two related one-step transitions as a live-indexed unchanged
+macro. -/
+theorem StableLiveMacroSimulation.ofStepsOne {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineTarget rewrittenTarget : Machine}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (baselineRunning : baselineStart.control =
+      .running baselineFrame baselineStack)
+    (rewrittenRunning : rewrittenStart.control =
+      .running rewrittenFrame rewrittenStack)
+    (baselineStep : Step baselineContext interpretation baselineStart
+      baselineTarget)
+    (rewrittenStep : Step rewrittenContext interpretation rewrittenStart
+      rewrittenTarget)
+    (related : StableLiveMachineRel limits validation baselineTarget
+      rewrittenTarget) :
+    StableLiveMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart := by
+  exact .intro 1 1 (by omega) (by omega) baselineTarget rewrittenTarget
+    (baselineStep.toSteps baselineRunning)
+    (rewrittenStep.toSteps rewrittenRunning) related
+
+/-- Every macro proved under the older all-register endpoint relation also
+provides a live-indexed macro. -/
+theorem StableMacroSimulation.toLive {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart : Machine}
+    (simulation : StableMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart) :
+    StableLiveMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart := by
+  cases simulation with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps
+          (Ix.Compiler.IxIR2.ReuseLiveSim.StableMachineRel.toLive related)
+
+/-- Package the live logical-hot accepted-site theorem as a synchronization macro.
+The premises are the runtime facts needed by the optimization, rather than an
+already-packaged simulation result. -/
+theorem acceptedHotLogicalStableLiveMacroSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel remaining rewrittenFuel : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {ambient : List IxIR1.Sim.Root} {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (owned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc location⟩ :: ambient))
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation limits validation baselineContext rewrittenContext
+      .logical baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨baselineSteps, rewrittenSteps, related⟩ :=
+    acceptedHotLogicalStableLiveSimulation rewrite found baselineSchemas
+      rewrittenSchemas heap stack fuel allocationSchemaAt parameterCount
+      fieldCount sourceResolved sourceBoxAt owned retained released
+      allocationResolved baselineFieldWorlds tailResolved arity
+  exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega) _ _
+    baselineSteps rewrittenSteps related
+
+/-- Package the live cold accepted-site theorem as a synchronization macro.  The
+cold branch is common to logical and physical interpretations. -/
+theorem acceptedColdStableLiveMacroSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (retainedAt : baselineRetained.get? location = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc ((baselineDecrementStore baselineRetained location
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩).allocNode .shared
+              (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation limits validation baselineContext rewrittenContext
+      interpretation baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨_rewrittenRetained, _retained, baselineSteps, rewrittenSteps,
+      related⟩ :=
+    acceptedColdStableLiveSimulation rewrite found baselineSchemas
+      rewrittenSchemas heap stack fuel allocationSchemaAt parameterCount
+      fieldCount sourceResolved sourceBoxAt shared retained retainedAt
+      allocationResolved baselineFieldWorlds tailResolved arity
+  exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega) _ _
+    baselineSteps rewrittenSteps related
+
+/-- Package the live physical-hot accepted-site theorem as a synchronization
+macro.  Unlike the exact-content wrappers, the input registers and suspended
+continuations may already be related by a nontrivial allocation-history
+bijection; the wrapped theorem replaces that relation at the reused location
+and preserves it everywhere else that remains reachable. -/
+theorem acceptedHotPhysicalStableLiveMacroSimulationIso
+    {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    {baselineParameters rewrittenParameters baselineFields rewrittenFields
+      baselineNewFields rewrittenNewFields baselineCallValues : Array RVal}
+    {baselineLocation rewrittenLocation fieldFuel remaining rewrittenFuel :
+      Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source index 0
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineParameters rewrittenParameters)
+    (stackAvoids : StableLiveStackAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation baselineStack rewrittenStack)
+    {baselineBefore baselineAfter rewrittenBefore rewrittenAfter :
+      List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (rewrittenSourceResolved :
+      resolveAtom rewrittenParameters (.reg site.shape.source) =
+        .ok (.loc rewrittenLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: baselineBefore))
+    (rewrittenOwned : IxIR1.Sim.RootOwnership rewrittenStore.heap
+      (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselinePartition :
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+          baselineBefore).Perm
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter))
+    (rewrittenPartition :
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+          rewrittenBefore).Perm
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter))
+    (mapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      rewrittenAfter)
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (rewrittenAllocationResolved : resolveAtoms
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      site.shape.allocationArguments = .ok rewrittenNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (rewrittenFieldWorlds : FieldWorlds
+      (physicalHotResetStore rewrittenStore rewrittenLocation)
+      allocationSchema rewrittenNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation limits validation baselineContext rewrittenContext
+      .physical baselineMachine rewrittenMachine := by
+  dsimp only
+  have mappedFull : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter) :=
+    MappedValuesInRoots.mono mapped (by
+      intro root member
+      exact List.mem_append_right _ member)
+  obtain ⟨_physical, _outputIso, _physicalCallValues, _reused,
+      _physicalOwned, _baselineOwned, _outputResult, _outputExtends,
+      baselineSteps, rewrittenSteps, _callsRelated, _outputStack, related⟩ :=
+    acceptedHotPhysicalStableLiveSimulationIso rewrite found baselineSchemas
+      rewrittenSchemas inputIso parameters stackAvoids fuel locations allocationSchemaAt parameterCount
+      fieldCount baselineSourceResolved rewrittenSourceResolved baselineAt
+      rewrittenAt baselineOwned rewrittenOwned retained released
+      baselinePartition rewrittenPartition mappedFull
+      baselineAllocationResolved
+      rewrittenAllocationResolved baselineFieldWorlds rewrittenFieldWorlds
+      tailResolved arity
+  exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega) _ _
+    baselineSteps rewrittenSteps related
+
+/-- Physical-hot synchronization derived from baseline ownership accounting.
+The incoming isomorphism supplies rewritten ownership, root permutation, and
+planner-root support. -/
+theorem acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccountingAt
+    {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    {baselineParameters rewrittenParameters baselineFields rewrittenFields
+      baselineNewFields rewrittenNewFields baselineCallValues : Array RVal}
+    {baselineLocation rewrittenLocation fieldFuel remaining rewrittenFuel :
+      Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source index 0
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineParameters rewrittenParameters)
+    (stackAvoids : StableLiveStackAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation baselineStack rewrittenStack)
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (rewrittenSourceResolved :
+      resolveAtom rewrittenParameters (.reg site.shape.source) =
+        .ok (.loc rewrittenLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues baselineParameters baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (rewrittenAllocationResolved : resolveAtoms
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      site.shape.allocationArguments = .ok rewrittenNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (rewrittenFieldWorlds : FieldWorlds
+      (physicalHotResetStore rewrittenStore rewrittenLocation)
+      allocationSchema rewrittenNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulationAt limits validation baselineContext
+      rewrittenContext .physical (2 * site.shape.fieldCount + 3)
+      baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨sourceAt, _resetAt, _hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨leftBox, rightBox, leftLive, rightLive, boxesRelated⟩ :=
+    inputIso.related_live locations
+  have leftBoxEq : leftBox =
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩ :=
+    Option.some.inj (leftLive.symm.trans rewrittenAt)
+  have rightBoxEq : rightBox =
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩ :=
+    Option.some.inj (rightLive.symm.trans baselineAt)
+  subst leftBox
+  subst rightBox
+  have oldFieldsRelated : IxIR1.Sim.RValsIso inputIso.locRel
+      rewrittenFields.toList baselineFields.toList := by
+    cases boxesRelated.node with
+    | ctor related => exact related
+  have fieldsRelated : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineFields.toList rewrittenFields.toList :=
+    rvalsIso_symm oldFieldsRelated
+  have prefixLive : LiveValuesIso source index 0
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      (baselinePrefixValues baselineParameters baselineFields)
+      (baselinePrefixValues rewrittenParameters rewrittenFields) := by
+    simpa [baselinePrefixValues] using
+      (parameters.append fieldsRelated).append fieldsRelated
+  have allocationLiveAt : AtomsLiveFrom source index
+      (site.shape.releasePosition + 1)
+      site.shape.allocationArguments :=
+    AtomsLiveFrom.instruction sourceAt site.fits.allocation (by
+      intro atom member
+      exact Liveness.InstrUsesAtom.alloc member)
+  have allocationLive : AtomsLiveFrom source index 0
+      site.shape.allocationArguments :=
+    allocationLiveAt.mono (Nat.zero_le _)
+  obtain ⟨actualRewrittenNewFields, actualRewrittenResolved,
+      newFieldsRelated⟩ :=
+    prefixLive.resolveAtoms allocationLive baselineAllocationResolved
+  have actualNewFieldsEq : actualRewrittenNewFields = rewrittenNewFields :=
+    Except.ok.inj
+      (actualRewrittenResolved.symm.trans rewrittenAllocationResolved)
+  subst actualRewrittenNewFields
+  have prefixContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore baselineStore baselineLocation) :=
+    hotPrefix_contents baselineAt baselineOwned retained released
+  have baselineMissing : baselineReleased.get? baselineLocation = none := by
+    rw [prefixContents.get?_eq baselineLocation]
+    change (logicalHotResetStore baselineStore baselineLocation).heap.get?
+      baselineLocation = none
+    rw [logicalHotResetStore_heap]
+    exact IxIR1.Sim.get?_kill_same baselineAt
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, sourceSchemaFields, allocationSchemaFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have uniformAllocationFields : allocationSchema.fields =
+      Array.replicate site.shape.fieldCount .shared :=
+    allocationSchemaFields.trans sourceSchemaFields
+  have baselineNewFieldsAvoid : ∀ value ∈ baselineNewFields.toList,
+      value ≠ .loc baselineLocation :=
+    FieldWorlds.avoidsMissing uniformAllocationFields baselineFieldWorlds
+      baselineMissing
+  have rewrittenNewFieldsAvoid : ∀ value ∈ rewrittenNewFields.toList,
+      value ≠ .loc rewrittenLocation :=
+    rvalsIso_right_avoids_of_left inputIso locations newFieldsRelated
+      baselineNewFieldsAvoid
+  have restrictedNewFields : IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList :=
+    rvalsIso_restrict_left (rvalsIso_symm newFieldsRelated)
+      rewrittenNewFieldsAvoid
+  obtain ⟨rewrittenBefore, rewrittenAfter, _entryRoots,
+      baselineEntryOwned, rewrittenOwned, baselinePartition,
+      rewrittenPartition, allocationRoots⟩ :=
+    hotPrefixFieldRootAccountingIso inputIso locations baselineAt rewrittenAt
+      oldFieldsRelated baselineOwned retained released baselineNewOwned
+      restrictedNewFields
+  have fullRoots : IxIR1.Sim.RootsIso inputIso.locRel
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))) := by
+    simpa using allocationRoots.mono (fun {_ _} related => related.1)
+  have rewrittenMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter) :=
+    MappedValuesInRoots.preimage site sourceAt inputIso prefixLive fullRoots
+      baselineMapped
+  obtain ⟨_physical, _outputIso, _physicalCallValues, _reused,
+      _physicalOwned, _baselineOwned, _outputResult, _outputExtends,
+      baselineSteps, rewrittenSteps, _callsRelated, _outputStack, related⟩ :=
+    acceptedHotPhysicalStableLiveSimulationIso rewrite found baselineSchemas
+      rewrittenSchemas inputIso parameters stackAvoids fuel locations
+      allocationSchemaAt parameterCount fieldCount baselineSourceResolved
+      rewrittenSourceResolved baselineAt rewrittenAt baselineEntryOwned
+      rewrittenOwned retained released baselinePartition rewrittenPartition
+      rewrittenMapped baselineAllocationResolved rewrittenAllocationResolved
+      baselineFieldWorlds rewrittenFieldWorlds tailResolved arity
+  refine .intro (by omega) 4 (by omega) _ _ baselineSteps rewrittenSteps
+    related (AllocationDelta.of_increments (count := 1) ?_ ?_)
+      (CostDelta.hot retained released _reused related.live_eq)
+  · dsimp only
+    rw [Store.allocationEvents_allocNode, releaseShared_allocationEvents released,
+      retained.allocationEvents]
+  · simpa [physicalHotResetStore] using Store.reuseReservation_allocationEvents _reused
+
+/-- Compatibility wrapper that forgets the baseline-length index. -/
+theorem acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccounting
+    {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    {baselineParameters rewrittenParameters baselineFields rewrittenFields
+      baselineNewFields rewrittenNewFields baselineCallValues : Array RVal}
+    {baselineLocation rewrittenLocation fieldFuel remaining rewrittenFuel :
+      Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source index 0
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineParameters rewrittenParameters)
+    (stackAvoids : StableLiveStackAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation baselineStack rewrittenStack)
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (rewrittenSourceResolved :
+      resolveAtom rewrittenParameters (.reg site.shape.source) =
+        .ok (.loc rewrittenLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues baselineParameters baselineFields)
+      (newRest ++ inertRoots
+        (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest)))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (rewrittenAllocationResolved : resolveAtoms
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      site.shape.allocationArguments = .ok rewrittenNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (rewrittenFieldWorlds : FieldWorlds
+      (physicalHotResetStore rewrittenStore rewrittenLocation)
+      allocationSchema rewrittenNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation limits validation baselineContext rewrittenContext
+      .physical baselineMachine rewrittenMachine := by
+  have baselineMappedFull : MappedValuesInRoots site.shape
+      (baselinePrefixValues baselineParameters baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))) :=
+    MappedValuesInRoots.mono baselineMapped (by
+      intro root member
+      exact List.mem_append_right _ member)
+  exact (acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccountingAt
+    rewrite found baselineSchemas rewrittenSchemas inputIso parameters
+    stackAvoids fuel locations allocationSchemaAt parameterCount fieldCount
+    baselineSourceResolved rewrittenSourceResolved baselineAt rewrittenAt
+    baselineOwned retained released baselineNewOwned baselineMappedFull
+    baselineAllocationResolved rewrittenAllocationResolved
+    baselineFieldWorlds rewrittenFieldWorlds tailResolved arity).simulation
+
+/-- A live cold accepted site remains a synchronization macro after an earlier
+physical reuse has changed concrete locations.  The source retain/release
+prefix is first commuted into the cold-reset order, that order is transported
+through the incoming allocation history, and corresponding fresh allocations
+extend the history for the recursive call. -/
+theorem acceptedColdStableLiveMacroSimulationIsoAt
+    {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineParameters rewrittenParameters baselineFields
+      baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source index 0 heap.locRel
+      baselineParameters rewrittenParameters)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained baselineLocation
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor baselineFields⟩)
+      allocationSchema baselineNewFields)
+    (baselineTailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc ((baselineDecrementStore baselineRetained baselineLocation
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩).allocNode
+              .shared
+              (.ctorN site.shape.allocationConstructor
+                baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulationAt limits validation baselineContext
+      rewrittenContext interpretation (2 * site.shape.fieldCount + 3)
+      baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, _hotAt, coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj
+      (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have sourceLiveAtRelease : AtomLiveFrom source index
+      site.shape.releasePosition (.reg site.shape.source) :=
+    AtomLiveFrom.instruction sourceAt site.fits.release
+      Liveness.InstrUsesAtom.releaseShared
+  have sourceLive : AtomLiveFrom source index 0 (.reg site.shape.source) :=
+    sourceLiveAtRelease.mono (Nat.zero_le _)
+  obtain ⟨rewrittenSourceValue, rewrittenSourceResolved,
+      sourceValueRelated⟩ :=
+    parameters.resolveAtom sourceLive baselineSourceResolved
+  cases sourceValueRelated with
+  | @loc _ rewrittenLocation locations =>
+      have baselineViewed : ConstructorView baselineStore baselineLocation
+          .shared site.shape.sourceConstructor
+          ⟨.shared, rc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩
+          baselineFields :=
+        ConstructorView.of_box baselineAt rfl rfl
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt,
+          rewrittenViewed, boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations baselineViewed
+      have rewrittenShared : 1 < rewrittenBox.rc := by
+        rw [← boxes.rc]
+        exact shared
+      have parameterSizes : baselineParameters.size =
+          rewrittenParameters.size := parameters.length
+      have rewrittenParameterCount : rewrittenParameters.size =
+          site.shape.parameterCount :=
+        parameterSizes.symm.trans parameterCount
+      have fieldSizes : baselineFields.size = rewrittenFields.size := by
+        simpa using rvalsIso_length_eq fieldsRelated
+      have rewrittenFieldCount : rewrittenFields.size =
+          site.shape.fieldCount := fieldSizes.symm.trans fieldCount
+      have prefixLive : LiveValuesIso source index 0 heap.locRel
+          (baselinePrefixValues baselineParameters baselineFields)
+          (baselinePrefixValues rewrittenParameters rewrittenFields) := by
+        simpa [baselinePrefixValues] using
+          (parameters.append fieldsRelated).append fieldsRelated
+      have allocationLiveAt : AtomsLiveFrom source index
+          (site.shape.releasePosition + 1)
+          site.shape.allocationArguments :=
+        AtomsLiveFrom.instruction sourceAt site.fits.allocation (by
+          intro atom member
+          exact Liveness.InstrUsesAtom.alloc member)
+      have allocationLive : AtomsLiveFrom source index 0
+          site.shape.allocationArguments :=
+        allocationLiveAt.mono (Nat.zero_le _)
+      obtain ⟨rewrittenNewFields, rewrittenAllocationResolved,
+          newFieldsRelated⟩ :=
+        prefixLive.resolveAtoms allocationLive baselineAllocationResolved
+      obtain ⟨actualRetainedRc, actualRetainedAt, baselineReleasedRun,
+          baselineResetRetained, baselineResetHeapEq⟩ :=
+        coldPrefix_commutes (heapFuel := fieldFuel) baselineAt shared retained
+      have retainedBoxesEqual :
+          (⟨.shared, actualRetainedRc,
+              .ctorN site.shape.sourceConstructor baselineFields⟩ :
+              IxIR1.NodeBox) =
+            ⟨.shared, retainedRc,
+              .ctorN site.shape.sourceConstructor baselineFields⟩ :=
+        Option.some.inj (actualRetainedAt.symm.trans retainedAt)
+      have retainedRcEqual : actualRetainedRc = retainedRc := by
+        cases retainedBoxesEqual
+        rfl
+      subst actualRetainedRc
+      let baselineReleased :=
+        baselineDecrementStore baselineRetained baselineLocation
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩
+      let baselineResetStore :=
+        baselineReleased.tickResetAttempt.tickColdReset
+      let baselineBox : IxIR1.NodeBox :=
+        ⟨.shared, rc,
+          .ctorN site.shape.sourceConstructor baselineFields⟩
+      let updated := heap.setBox locations
+        (show baselineStore.heap.get? baselineLocation = some baselineBox from
+          baselineAt)
+        (show rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          from rewrittenAt)
+        (show IxIR1.Sim.NodeBoxIso heap.locRel
+            { baselineBox with rc := baselineBox.rc - 1 }
+            { rewrittenBox with rc := rewrittenBox.rc - 1 } from
+          ⟨boxes.world,
+            congrArg (fun count => count - 1) boxes.rc, boxes.node⟩)
+      let beforeRetains : IxIR1.Sim.HeapHistoryIso
+          (coldResetStartStore baselineStore baselineLocation
+            baselineBox).heap
+          (coldResetStartStore rewrittenStore rewrittenLocation
+            rewrittenBox).heap := by
+        simpa [coldResetStartStore, Eval.Store.tickResetAttempt,
+          Eval.Store.tickColdReset] using updated.rcTick
+      have relatedRetainedFields : IxIR1.Sim.RValsIso
+          beforeRetains.locRel baselineFields.toList rewrittenFields.toList :=
+        by
+          change IxIR1.Sim.RValsIso heap.locRel _ _
+          exact fieldsRelated
+      obtain ⟨rewrittenResetStore, afterRetains,
+          rewrittenResetRetained, afterRetainsRelation⟩ :=
+        retainSharedMany_historyIso beforeRetains relatedRetainedFields
+          (by
+            simpa [baselineBox, baselineReleased, baselineResetStore] using
+              baselineResetRetained)
+      have baselineResetHeapEq' : baselineReleased.heap =
+          baselineResetStore.heap := by
+        simpa [baselineReleased, baselineResetStore] using
+          baselineResetHeapEq
+      let afterCold : IxIR1.Sim.HeapHistoryIso baselineReleased.heap
+          rewrittenResetStore.heap :=
+        afterRetains.nodesEq
+          (congrArg IxIR1.Store.nodes baselineResetHeapEq') rfl
+      have afterColdRelation : afterCold.locRel = heap.locRel := by
+        calc
+          afterCold.locRel = afterRetains.locRel := rfl
+          _ = beforeRetains.locRel := afterRetainsRelation
+          _ = heap.locRel := rfl
+      have newFieldsAfterCold : IxIR1.Sim.RValsIso afterCold.locRel
+          baselineNewFields.toList rewrittenNewFields.toList := by
+        rw [afterColdRelation]
+        exact newFieldsRelated
+      have rewrittenFieldWorlds : FieldWorlds rewrittenResetStore
+          allocationSchema rewrittenNewFields :=
+        baselineFieldWorlds.transport
+          (heapHistoryIso_fieldValuesWorldEq afterCold newFieldsAfterCold)
+      let baselineAllocation := baselineReleased.allocNode .shared
+        (.ctorN site.shape.allocationConstructor baselineNewFields)
+      let rewrittenAllocation := rewrittenResetStore.allocNode .shared
+        (.ctorN site.shape.allocationConstructor rewrittenNewFields)
+      let allocationHistory : IxIR1.Sim.HeapHistoryIso
+          baselineAllocation.1.heap rewrittenAllocation.1.heap :=
+        afterCold.alloc (.ctor newFieldsAfterCold)
+      have oldExtends : ∀ {baselineCandidate rewrittenCandidate : Nat},
+          heap.locRel baselineCandidate rewrittenCandidate →
+            allocationHistory.locRel baselineCandidate rewrittenCandidate :=
+        by
+          intro baselineCandidate rewrittenCandidate related
+          apply Or.inr
+          rw [afterColdRelation]
+          exact related
+      have prefixAfterAllocation : LiveValuesIso source index 0
+          allocationHistory.locRel
+          (baselinePrefixValues baselineParameters baselineFields)
+          (baselinePrefixValues rewrittenParameters rewrittenFields) :=
+        prefixLive.mono oldExtends
+      have resultRelated : IxIR1.Sim.RValIso allocationHistory.locRel
+          (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+        .loc (.inl ⟨rfl, rfl⟩)
+      have tailInputsRelated : LiveValuesIso source index 0
+          allocationHistory.locRel
+          ((baselinePrefixValues baselineParameters baselineFields).push
+            (.loc baselineAllocation.2))
+          ((baselinePrefixValues rewrittenParameters rewrittenFields).push
+            (.loc rewrittenAllocation.2)) :=
+        prefixAfterAllocation.push resultRelated
+      have tailLiveAt : AtomsLiveFrom source index block.instructions.size
+          site.shape.tailArguments :=
+        AtomsLiveFrom.tailCallSelf sourceAt rfl site.fits.terminator
+      have tailLive : AtomsLiveFrom source index 0
+          site.shape.tailArguments :=
+        tailLiveAt.mono (Nat.zero_le _)
+      obtain ⟨rewrittenCallValues, rewrittenTailResolved,
+          callValuesRelated⟩ :=
+        tailInputsRelated.resolveAtoms tailLive
+          (by simpa [baselineAllocation, baselineReleased] using
+            baselineTailResolved)
+      have callSizes : baselineCallValues.size = rewrittenCallValues.size := by
+        simpa using rvalsIso_length_eq callValuesRelated
+      have rewrittenArity : rewrittenCallValues.size =
+          rewrite.definition.signature.params.size := by
+        simpa using callSizes.symm.trans arity
+      have sourceNonempty : source.blocks.isEmpty = false :=
+        blocks_nonempty_of_getElem sourceAt
+      have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+        blocks_nonempty_of_getElem resetAt
+      let baselineMachine : Machine :=
+        { store := baselineStore
+          heapFuel := fieldFuel + 1
+          control := .running
+            { definition := source
+              block := index
+              values := baselineParameters
+              credits := #[] }
+            baselineStack }
+      let rewrittenMachine : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition
+              block := index
+              values := rewrittenParameters
+              credits := #[] }
+            rewrittenStack }
+      have baselineExecution : Steps baselineContext interpretation
+          (2 * site.shape.fieldCount + 3) baselineMachine
+          { store := baselineAllocation.1
+            heapFuel := fieldFuel
+            control := .running
+              { definition := source, values := baselineCallValues }
+              baselineStack } := by
+        simpa [baselineMachine, baselineAllocation, baselineReleased] using
+          baselineAcceptedControl site
+            (context := baselineContext) (interpretation := interpretation)
+            (definition := source) (blockId := index)
+            (parameters := baselineParameters) (fields := baselineFields)
+            (newFields := baselineNewFields)
+            (callValues := baselineCallValues)
+            (location := baselineLocation) (machine := baselineMachine)
+            (retainedStore := baselineRetained)
+            (releasedStore := baselineReleased) (remaining := fieldFuel)
+            (allocationSchema := allocationSchema) (stack := baselineStack)
+            sourceAt (by rfl) parameterCount fieldCount
+            baselineSourceResolved baselineAt rfl retained
+            (by simpa [baselineReleased] using baselineReleasedRun)
+            allocationSchemaAt baselineAllocationResolved
+            (by simpa [baselineReleased] using baselineFieldWorlds)
+            (by simpa [baselineAllocation, baselineReleased] using
+              baselineTailResolved)
+            arity sourceNonempty
+      have rewrittenExecution : Steps rewrittenContext interpretation 4
+          rewrittenMachine
+          { store := rewrittenAllocation.1
+            heapFuel := rewrittenFuel
+            control := .running
+              { definition := rewrite.definition,
+                values := rewrittenCallValues }
+              rewrittenStack } := by
+        simpa [rewrittenMachine, rewrittenAllocation] using
+          coldAcceptedControl site
+            (context := rewrittenContext)
+            (interpretation := interpretation)
+            (definition := rewrite.definition) (resetId := index)
+            (hotId := source.blocks.size + helperOffset)
+            (coldId := source.blocks.size + helperOffset + 1)
+            (parameters := rewrittenParameters) (fields := rewrittenFields)
+            (newFields := rewrittenNewFields)
+            (callValues := rewrittenCallValues)
+            (location := rewrittenLocation) (box := rewrittenBox)
+            (sourceSchema := sourceSchema)
+            (allocationSchema := allocationSchema)
+            (machine := rewrittenMachine) (resetStore := rewrittenResetStore)
+            (stack := rewrittenStack) resetAt coldAt rewrittenSourceSchemaAt
+            rewrittenAllocationSchemaAt sourceLayout allocationLayout
+            (by rfl) rewrittenParameterCount rewrittenFieldCount
+            (by simpa using rewrittenSourceResolved) rewrittenViewed
+            rewrittenShared
+            (by
+              simpa [rewrittenMachine, coldResetStartStore] using
+                rewrittenResetRetained)
+            rewrittenAllocationResolved rewrittenFieldWorlds
+            (by simpa [rewrittenAllocation] using rewrittenTailResolved)
+            rewrittenArity rewrittenNonempty
+      have outputStack : StableLiveStackIso limits validation
+          allocationHistory.locRel baselineStack rewrittenStack :=
+        stack.mono oldExtends
+      have outputFuel : fieldFuel ≤ rewrittenFuel := by omega
+      have related : StableLiveMachineRel limits validation
+          { store := baselineAllocation.1
+            heapFuel := fieldFuel
+            control := .running
+              { definition := source, values := baselineCallValues }
+              baselineStack }
+          { store := rewrittenAllocation.1
+            heapFuel := rewrittenFuel
+            control := .running
+              { definition := rewrite.definition,
+                values := rewrittenCallValues }
+              rewrittenStack } :=
+        StableLiveMachineRel.history allocationHistory outputFuel
+          (.running
+            (.rewritten rewrite
+              (StableLiveFrameIso.entry rewrite callValuesRelated))
+            outputStack)
+      refine .intro (by omega) 4 (by omega) _ _ baselineExecution
+        rewrittenExecution related (AllocationDelta.of_increments (count := 1) ?_ ?_)
+          (CostDelta.cold retained rewrittenResetRetained
+            (referenceCountList_iso fieldsRelated) related.live_eq)
+      · change baselineAllocation.1.allocationEvents = baselineStore.allocationEvents + 1
+        simp only [baselineAllocation, baselineReleased, baselineDecrementStore,
+          Store.allocationEvents_allocNode, Store.allocationEvents_setBox,
+          Store.allocationEvents_rcTick, retained.allocationEvents]
+      · change rewrittenAllocation.1.allocationEvents = rewrittenStore.allocationEvents + 1
+        simp only [rewrittenAllocation, Store.allocationEvents_allocNode]
+        have events := rewrittenResetRetained.allocationEvents
+        simpa [coldResetStartStore] using events
+
+/-- Compatibility wrapper that forgets the baseline-length index. -/
+theorem acceptedColdStableLiveMacroSimulationIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineParameters rewrittenParameters baselineFields
+      baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source index 0 heap.locRel
+      baselineParameters rewrittenParameters)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained baselineLocation
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor baselineFields⟩)
+      allocationSchema baselineNewFields)
+    (baselineTailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc ((baselineDecrementStore baselineRetained baselineLocation
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩).allocNode
+              .shared
+              (.ctorN site.shape.allocationConstructor
+                baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation limits validation baselineContext rewrittenContext
+      interpretation baselineMachine rewrittenMachine := by
+  exact (acceptedColdStableLiveMacroSimulationIsoAt rewrite found
+    baselineSchemas rewrittenSchemas heap parameters stack fuel
+    allocationSchemaAt parameterCount fieldCount baselineSourceResolved
+    baselineAt shared retained retainedAt baselineAllocationResolved
+    baselineFieldWorlds baselineTailResolved arity).simulation
+
+/-- Exhaustive synchronization dispatch from an allocation-history-related
+live state. Ordinary blocks use the relation-aware one-step theorem; accepted
+blocks remain a single macro obligation for the global invariant. -/
+theorem stableLiveMacroStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site limits validation block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        StableLiveMacroSimulation limits validation
+          (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    StableLiveMacroSimulation limits validation
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      (Eval.Context.ofProgram trace.target validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have dispatch : ∀ {block : Block},
+      baselineFrame.definition.blocks[baselineFrame.block]? = some block →
+      StableLiveMacroSimulation limits validation
+        (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+        (Eval.Context.ofProgram trace.target validation.schemas oracle)
+        interpretation
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack } := by
+    intro block blockAt
+    cases frame.blockCase blockAt with
+    | unchanged sourceAt targetAt =>
+        have sourceBlockAt : source.blocks[baselineFrame.block]? =
+            some block := by
+          rw [← frame.baselineDefinition]
+          exact blockAt
+        have blockEq := Option.some.inj (sourceAt.symm.trans sourceBlockAt)
+        cases blockEq
+        have rewrittenBlockAt :
+            rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+              some block := by
+          rw [frame.rewrittenDefinition, ← frame.block]
+          exact targetAt
+        obtain ⟨rewrittenTarget, rewrittenStep, related⟩ :=
+          unchangedStepOfTraceLiveIso trace rewrite heap fuel frame stack blockAt
+            rewrittenBlockAt stepped
+        exact StableLiveMacroSimulation.ofStepsOne rfl rfl stepped rewrittenStep
+          related
+    | accepted found =>
+        exact accepted found
+  cases stepped.classify with
+  | instruction blockAt _pc _instructionAt _instructionCase =>
+      exact dispatch blockAt
+  | terminator blockAt _pc _terminatorAt _terminatorCase =>
+      exact dispatch blockAt
+
+/-- Strong induction over invariant-preserving live-indexed macros. -/
+theorem stableLiveFiniteExecutionOfMacroInvariant
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (invariant : Machine → Machine → Prop)
+    (related : ∀ {baseline rewritten}, invariant baseline rewritten →
+      StableLiveMachineRel limits validation baseline rewritten)
+    (advance : ∀ {baseline rewritten baselineNext : Machine}
+        {frame : Frame} {stack : List Continuation},
+      invariant baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      StableLiveMacroInvariantStep limits validation baselineContext
+        rewrittenContext interpretation invariant baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart baselineFinal :
+      Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : invariant baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenFinal,
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        invariant baselineFinal rewrittenFinal ∧
+        StableLiveMachineRel limits validation baselineFinal rewrittenFinal := by
+  induction baselineCount using Nat.strongRecOn generalizing baselineStart
+      rewrittenStart baselineFinal with
+  | ind baselineCount smaller =>
+      cases baselineSteps with
+      | refl =>
+          exact ⟨0, rewrittenStart, .refl rewrittenStart, initial,
+            related initial⟩
+      | @cons count before middle after frame stack running head tail =>
+          have synchronizedStep := advance initial running head
+          cases synchronizedStep with
+          | intro macroBaselineCount macroRewrittenCount baselinePositive
+              rewrittenPositive macroBaselineTarget macroRewrittenTarget
+              macroBaselineSteps macroRewrittenSteps macroRelated preserved =>
+              obtain ⟨suffixCount, totalCount, suffixSteps⟩ :=
+                macroBaselineSteps.cancelPrefixToHalted
+                  (Steps.cons running head tail) halted
+              have suffixSmaller : suffixCount < Nat.succ count := by
+                omega
+              obtain ⟨suffixRewrittenCount, rewrittenFinal,
+                  suffixRewrittenSteps, finalInvariant, finalRelated⟩ :=
+                smaller suffixCount suffixSmaller preserved suffixSteps halted
+              exact ⟨macroRewrittenCount + suffixRewrittenCount,
+                rewrittenFinal,
+                macroRewrittenSteps.trans suffixRewrittenSteps,
+                finalInvariant, finalRelated⟩
+
+/-- Strong induction over invariant-preserving live-indexed macros where the
+local dispatcher may inspect the actual remaining baseline execution.  This
+is strictly stronger than `stableLiveFiniteExecutionOfMacroInvariant`: it is
+needed by multi-step rewrites whose first evaluator step is fuel-preserving,
+while a later step in the same recognized prefix consumes heap fuel.  The
+remaining execution is evidence, not an oracle for the rewritten run; prefix
+cancellation still checks every macro returned by the dispatcher against the
+unique baseline execution. -/
+theorem stableLiveFiniteExecutionOfGuidedMacroInvariant
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (invariant : Machine → Machine → Prop)
+    (related : ∀ {baseline rewritten}, invariant baseline rewritten →
+      StableLiveMachineRel limits validation baseline rewritten)
+    (advance : ∀ {baseline rewritten baselineNext baselineFinal : Machine}
+        {frame : Frame} {stack : List Continuation} {suffixCount : Nat}
+        {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal},
+      invariant baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      Steps baselineContext interpretation suffixCount baselineNext
+        baselineFinal →
+      baselineFinal =
+        { store := finalStore
+          heapFuel := finalHeapFuel
+          control := .halted finalValue } →
+      StableLiveMacroInvariantStep limits validation baselineContext
+        rewrittenContext interpretation invariant baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart baselineFinal :
+      Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : invariant baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenFinal,
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        invariant baselineFinal rewrittenFinal ∧
+        StableLiveMachineRel limits validation baselineFinal rewrittenFinal := by
+  induction baselineCount using Nat.strongRecOn generalizing baselineStart
+      rewrittenStart baselineFinal with
+  | ind baselineCount smaller =>
+      cases baselineSteps with
+      | refl =>
+          exact ⟨0, rewrittenStart, .refl rewrittenStart, initial,
+            related initial⟩
+      | @cons count before middle after frame stack running head tail =>
+          have synchronizedStep := advance initial running head tail halted
+          cases synchronizedStep with
+          | intro macroBaselineCount macroRewrittenCount baselinePositive
+              rewrittenPositive macroBaselineTarget macroRewrittenTarget
+              macroBaselineSteps macroRewrittenSteps macroRelated preserved =>
+              obtain ⟨suffixCount, totalCount, suffixSteps⟩ :=
+                macroBaselineSteps.cancelPrefixToHalted
+                  (Steps.cons running head tail) halted
+              have suffixSmaller : suffixCount < Nat.succ count := by
+                omega
+              obtain ⟨suffixRewrittenCount, rewrittenFinal,
+                  suffixRewrittenSteps, finalInvariant, finalRelated⟩ :=
+                smaller suffixCount suffixSmaller preserved suffixSteps halted
+              exact ⟨macroRewrittenCount + suffixRewrittenCount,
+                rewrittenFinal,
+                macroRewrittenSteps.trans suffixRewrittenSteps,
+                finalInvariant, finalRelated⟩
+
+/-- Exact runner corollary for the liveness-indexed whole-execution lift. -/
+theorem stableLiveRunMachineOfMacroInvariant
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (invariant : Machine → Machine → Prop)
+    (related : ∀ {baseline rewritten}, invariant baseline rewritten →
+      StableLiveMachineRel limits validation baseline rewritten)
+    (advance : ∀ {baseline rewritten baselineNext : Machine}
+        {frame : Frame} {stack : List Continuation},
+      invariant baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      StableLiveMacroInvariantStep limits validation baselineContext
+        rewrittenContext interpretation invariant baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart : Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : invariant baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenStore rewrittenHeapFuel rewrittenValue locRel,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenHeapFuel
+          control := .halted rewrittenValue }
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        invariant
+          { store := finalStore
+            heapFuel := finalHeapFuel
+            control := .halted finalValue }
+          rewrittenFinal ∧
+        StableHeapRel finalStore rewrittenStore locRel ∧
+        finalHeapFuel ≤ rewrittenHeapFuel ∧
+        IxIR1.Sim.RValIso locRel finalValue rewrittenValue ∧
+        Eval.runMachine rewrittenContext interpretation rewrittenCount
+            rewrittenStart =
+          .ok
+            { store := rewrittenStore
+              value := rewrittenValue
+              controlRemaining := 0
+              heapRemaining := rewrittenHeapFuel } := by
+  obtain ⟨rewrittenCount, rewrittenFinal, rewrittenSteps, finalInvariant,
+      finalRelated⟩ :=
+    stableLiveFiniteExecutionOfMacroInvariant invariant related advance initial
+      baselineSteps rfl
+  obtain ⟨rewrittenStore, rewrittenHeapFuel, rewrittenValue, locRel,
+      rewrittenFinalEq, finalHeap, finalFuel, finalValueRelated⟩ :=
+    finalRelated.haltedParts
+  subst rewrittenFinal
+  refine ⟨rewrittenCount, rewrittenStore, rewrittenHeapFuel, rewrittenValue,
+    locRel, rewrittenSteps, finalInvariant, finalHeap, finalFuel,
+    finalValueRelated, ?_⟩
+  exact rewrittenSteps.runMachine_halted
+
+/-- Exact runner corollary for execution-guided live-indexed macros.  The
+dispatcher receives the concrete suffix to the halted baseline endpoint, so
+it can invert later resource-consuming steps in a recognized prefix without
+strengthening the machine invariant with a global fuel bound. -/
+theorem stableLiveRunMachineOfGuidedMacroInvariant
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (invariant : Machine → Machine → Prop)
+    (related : ∀ {baseline rewritten}, invariant baseline rewritten →
+      StableLiveMachineRel limits validation baseline rewritten)
+    (advance : ∀ {baseline rewritten baselineNext baselineFinal : Machine}
+        {frame : Frame} {stack : List Continuation} {suffixCount : Nat}
+        {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal},
+      invariant baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      Steps baselineContext interpretation suffixCount baselineNext
+        baselineFinal →
+      baselineFinal =
+        { store := finalStore
+          heapFuel := finalHeapFuel
+          control := .halted finalValue } →
+      StableLiveMacroInvariantStep limits validation baselineContext
+        rewrittenContext interpretation invariant baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart : Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : invariant baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenStore rewrittenHeapFuel rewrittenValue locRel,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenHeapFuel
+          control := .halted rewrittenValue }
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        invariant
+          { store := finalStore
+            heapFuel := finalHeapFuel
+            control := .halted finalValue }
+          rewrittenFinal ∧
+        StableHeapRel finalStore rewrittenStore locRel ∧
+        finalHeapFuel ≤ rewrittenHeapFuel ∧
+        IxIR1.Sim.RValIso locRel finalValue rewrittenValue ∧
+        Eval.runMachine rewrittenContext interpretation rewrittenCount
+            rewrittenStart =
+          .ok
+            { store := rewrittenStore
+              value := rewrittenValue
+              controlRemaining := 0
+              heapRemaining := rewrittenHeapFuel } := by
+  obtain ⟨rewrittenCount, rewrittenFinal, rewrittenSteps, finalInvariant,
+      finalRelated⟩ :=
+    stableLiveFiniteExecutionOfGuidedMacroInvariant invariant related advance
+      initial baselineSteps rfl
+  obtain ⟨rewrittenStore, rewrittenHeapFuel, rewrittenValue, locRel,
+      rewrittenFinalEq, finalHeap, finalFuel, finalValueRelated⟩ :=
+    finalRelated.haltedParts
+  subst rewrittenFinal
+  refine ⟨rewrittenCount, rewrittenStore, rewrittenHeapFuel, rewrittenValue,
+    locRel, rewrittenSteps, finalInvariant, finalHeap, finalFuel,
+    finalValueRelated, ?_⟩
+  exact rewrittenSteps.runMachine_halted
+
+/-! ## Compiler-attachment state -/
+
+/-- A checked lowering attachment paired with the exact validated dynamic
+reuse output produced from its IxIR₂ program.  Retaining the executable
+equation makes the optimizer invocation, its dependent trace, and the
+compiler attachment one proof-facing artifact. -/
+structure OptimizedAttachment
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) where
+  output : Reuse.Output Validate.defaultLimits
+    attached.target.artifact.validationContext
+    attached.target.artifact.program
+  produced : Reuse.optimize attached.target.artifact.validationContext
+    attached.target.artifact.program = .ok output
+
+/-- Run reuse insertion at the exact checked compiler boundary. -/
+def optimizeAttachment
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) :
+    Except Reuse.Error (OptimizedAttachment attached) :=
+  match produced : Reuse.optimize
+      attached.target.artifact.validationContext
+      attached.target.artifact.program with
+  | .error error => .error error
+  | .ok output => .ok { output, produced }
+
+/-- Production selection at the checked compiler boundary is total. A
+rejected optional rewrite retains the exact baseline and a typed skip report. -/
+def selectAttachment
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) :
+    Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program :=
+  Reuse.selectChecked attached.target.artifact.validationContext
+    attached.target.artifact.program attached.target.valid
+
+/-- Source-side restoration data aligned with the target's ordinary-call
+continuation stack. Each resume frame remembers the exact checked call site,
+pre-call semantic state, and surviving capability vector needed to rebuild
+the caller after a return. Tail calls leave this stack unchanged. -/
+inductive CompilerStackState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) :
+    List IxIR1.Sim.Root → List Continuation → Type where
+  | nil : CompilerStackState attached [] []
+  | addressed
+      {callerTrace : Lower.FunctionTrace}
+      (callerMember : callerTrace ∈
+        attached.target.artifact.trace.functions)
+      {site : Lower.SourceSite} {blockId : BlockId}
+      {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+      {sourceAddress targetAddress : Ixon.Address}
+      {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+      {next : Lower.CodeTrace}
+      {calleeTrace : Lower.FunctionTrace}
+      (calleeMember : calleeTrace ∈
+        attached.target.artifact.trace.functions)
+      {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+      (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+        (.declaration sourceAddress) sourceDefinition targetDefinition)
+      (callerDescendant : callerTrace.root.Descendant
+        (.letOp site blockId input nextInput entryValueCount
+          (.call sourceAddress sourceArguments) index
+          (.call targetAddress targetArguments) next))
+      {callerStore : IxIR1.Store} {callerSource values : List RVal}
+      {callerFrameRoots : List IxIR1.Sim.Root}
+      {callerFrame : Frame} {callerStack : List Continuation}
+      (callerState : attached.sidecars.TraceStateRel callerTrace
+        (.letOp site blockId input nextInput entryValueCount
+          (.call sourceAddress sourceArguments) index
+          (.call targetAddress targetArguments) next)
+        callerStore callerSource callerFrame)
+      (callerRuntime : Lower.Sim.SourceRuntimeInvariant callerStore
+        callerSource)
+      (callerOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions
+        (.letOp site blockId input nextInput entryValueCount
+          (.call sourceAddress sourceArguments) index
+          (.call targetAddress targetArguments) next)
+        callerStore callerSource callerFrameRoots)
+      (callerStackRoots : LiveStackSupportedByRoots callerFrameRoots
+        callerStack)
+      (callerImage : attached.SourceStoreImage callerStore)
+      (callerNoCredits : callerFrame.credits = #[])
+      (resolved : IxIR1.resolveAtoms callerSource sourceArguments = .ok values)
+      {before : Lower.PositionTrace} {remaining : Array Lower.BindingCap}
+      (signatureAt : Lower.targetSignature?
+        attached.target.artifact.program.declarations sourceAddress =
+          some calleeTrace.generated.signature)
+      (beforeMember : before ∈ attached.target.artifact.trace.positions)
+      (beforeCoordinate : before.coordinateMatches site blockId
+        (.instruction index) input = true)
+      (consumed : Lower.callRemainingCapabilities? before.sourceCapabilities
+        input calleeTrace.generated.signature sourceArguments = some remaining)
+      (tail : CompilerStackState attached callerFrameRoots callerStack) :
+      CompilerStackState attached
+        (Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+          callerFrameRoots)
+        (.resume { callerFrame with pc := callerFrame.pc + 1 } :: callerStack)
+  | applyExact
+      {callerTrace : Lower.FunctionTrace}
+      (callerMember : callerTrace ∈
+        attached.target.artifact.trace.functions)
+      {site : Lower.SourceSite} {blockId : BlockId}
+      {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+      {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+      {sourceArguments : Array IxIR1.Atom}
+      {targetArguments : Array Atom} {next : Lower.CodeTrace}
+      (callerDescendant : callerTrace.root.Descendant
+        (.letOp site blockId input nextInput entryValueCount
+          (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next))
+      {callerStore : IxIR1.Store} {callerSource : List RVal}
+      {callerFrameRoots : List IxIR1.Sim.Root}
+      {callerFrame : Frame} {callerStack : List Continuation}
+      (callerState : attached.sidecars.TraceStateRel callerTrace
+        (.letOp site blockId input nextInput entryValueCount
+          (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next)
+        callerStore callerSource callerFrame)
+      (callerRuntime : Lower.Sim.SourceRuntimeInvariant callerStore
+        callerSource)
+      (callerOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions
+        (.letOp site blockId input nextInput entryValueCount
+          (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next)
+        callerStore callerSource callerFrameRoots)
+      (callerStackRoots : LiveStackSupportedByRoots callerFrameRoots
+        callerStack)
+      (callerImage : attached.SourceStoreImage callerStore)
+      (callerNoCredits : callerFrame.credits = #[])
+      {remaining : Array Lower.BindingCap}
+      (tail : CompilerStackState attached callerFrameRoots callerStack) :
+      CompilerStackState attached
+        (Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+          callerFrameRoots)
+        (.resume { callerFrame with pc := callerFrame.pc + 1 } :: callerStack)
+  | applyMore
+      {callerTrace : Lower.FunctionTrace}
+      (callerMember : callerTrace ∈
+        attached.target.artifact.trace.functions)
+      {site : Lower.SourceSite} {blockId : BlockId}
+      {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+      {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+      {sourceArguments : Array IxIR1.Atom}
+      {targetArguments : Array Atom} {next : Lower.CodeTrace}
+      (callerDescendant : callerTrace.root.Descendant
+        (.letOp site blockId input nextInput entryValueCount
+          (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next))
+      {callerStore : IxIR1.Store} {callerSource : List RVal}
+      {callerFrameRoots : List IxIR1.Sim.Root}
+      {callerFrame : Frame} {callerStack : List Continuation}
+      (callerState : attached.sidecars.TraceStateRel callerTrace
+        (.letOp site blockId input nextInput entryValueCount
+          (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next)
+        callerStore callerSource callerFrame)
+      (callerRuntime : Lower.Sim.SourceRuntimeInvariant callerStore
+        callerSource)
+      (callerOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions
+        (.letOp site blockId input nextInput entryValueCount
+          (.apply sourceFunction sourceArguments) index
+          (.apply targetFunction targetArguments) next)
+        callerStore callerSource callerFrameRoots)
+      (callerStackRoots : LiveStackSupportedByRoots callerFrameRoots
+        callerStack)
+      (callerImage : attached.SourceStoreImage callerStore)
+      (callerNoCredits : callerFrame.credits = #[])
+      {remaining : Array Lower.BindingCap}
+      (callerFrameSupported : LiveFrameSupportedByRoots
+        (Lower.Sim.rootsForCapabilities remaining.toList callerSource)
+        { callerFrame with pc := callerFrame.pc + 1 })
+      {sourceResidual : List RVal} {targetResidual : Array RVal}
+      (residuals : targetResidual.toList = sourceResidual)
+      (tail : CompilerStackState attached callerFrameRoots callerStack) :
+      CompilerStackState attached
+        (IxIR1.Sim.rootsFor .shared sourceResidual ++
+          (Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+            callerFrameRoots))
+        (.applyMore targetResidual
+          { callerFrame with pc := callerFrame.pc + 1 } :: callerStack)
+  | self
+      {callerTrace : Lower.FunctionTrace}
+      (callerMember : callerTrace ∈
+        attached.target.artifact.trace.functions)
+      {site : Lower.SourceSite} {blockId : BlockId}
+      {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+      {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+      {next : Lower.CodeTrace}
+      (callerDescendant : callerTrace.root.Descendant
+        (.letOp site blockId input nextInput entryValueCount
+          (.callSelf sourceArguments) index (.callSelf targetArguments) next))
+      {callerStore : IxIR1.Store} {callerSource values : List RVal}
+      {callerFrameRoots : List IxIR1.Sim.Root}
+      {callerFrame : Frame} {callerStack : List Continuation}
+      (callerState : attached.sidecars.TraceStateRel callerTrace
+        (.letOp site blockId input nextInput entryValueCount
+          (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+        callerStore callerSource callerFrame)
+      (callerRuntime : Lower.Sim.SourceRuntimeInvariant callerStore
+        callerSource)
+      (callerOwnership : Lower.Sim.SourceOwnershipAt
+        attached.target.artifact.trace.positions
+        (.letOp site blockId input nextInput entryValueCount
+          (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+        callerStore callerSource callerFrameRoots)
+      (callerStackRoots : LiveStackSupportedByRoots callerFrameRoots
+        callerStack)
+      (callerImage : attached.SourceStoreImage callerStore)
+      (callerNoCredits : callerFrame.credits = #[])
+      (resolved : IxIR1.resolveAtoms callerSource sourceArguments = .ok values)
+      {before : Lower.PositionTrace} {remaining : Array Lower.BindingCap}
+      (beforeMember : before ∈ attached.target.artifact.trace.positions)
+      (beforeCoordinate : before.coordinateMatches site blockId
+        (.instruction index) input = true)
+      (consumed : Lower.callRemainingCapabilities? before.sourceCapabilities
+        input callerTrace.generated.signature sourceArguments = some remaining)
+      (tail : CompilerStackState attached callerFrameRoots callerStack) :
+      CompilerStackState attached
+        (Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+          callerFrameRoots)
+        (.resume { callerFrame with pc := callerFrame.pc + 1 } :: callerStack)
+
+/-- Executable source completion evidence for the ordinary call at the head
+of a compiler stack. Its dependent match recovers the exact suspended caller,
+operation, and output store/value while ruling out an empty continuation. -/
+def CompilerStackReturn
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (sourceContext : IxIR1.Ctx) :
+    {roots : List IxIR1.Sim.Root} → {stack : List Continuation} →
+      CompilerStackState attached roots stack → IxIR1.Store → RVal → Prop
+  | _, _, .nil, _, _ => False
+  | _, _, .addressed
+      (callerTrace := callerTrace) (sourceAddress := sourceAddress)
+      (sourceArguments := sourceArguments)
+      (sourceDefinition := sourceDefinition) (callerStore := callerStore)
+      (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _, outputStore, value =>
+      ∃ callFuel,
+        sourceContext.decls =
+            IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts ∧
+          sourceContext.decls sourceAddress = some (.fn sourceDefinition) ∧
+          IxIR1.runOp sourceContext (callFuel + 1) callerTrace.source
+            callerStore callerSource (.call sourceAddress sourceArguments) =
+              .ok (outputStore, value)
+  | _, _, .self
+      (callerTrace := callerTrace) (sourceArguments := sourceArguments)
+      (callerStore := callerStore) (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ _ _ _ _ _, outputStore, value =>
+      ∃ callFuel,
+        sourceContext.decls =
+            IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts ∧
+          IxIR1.runOp sourceContext (callFuel + 1) callerTrace.source
+            callerStore callerSource (.callSelf sourceArguments) =
+              .ok (outputStore, value)
+  | _, _, .applyExact
+      (callerTrace := callerTrace) (sourceFunction := sourceFunction)
+      (sourceArguments := sourceArguments) (callerStore := callerStore)
+      (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ _, outputStore, value =>
+      ∃ applyFuel,
+        sourceContext.decls =
+            IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts ∧
+          IxIR1.runOp sourceContext (applyFuel + 2) callerTrace.source
+            callerStore callerSource (.apply sourceFunction sourceArguments) =
+              .ok (outputStore, value)
+  | _, _, .applyMore _ _ _ _ _ _ _ _ _ _ _, _, _ => False
+
+/-- A successful residual plan for an `applyMore` continuation. The current
+callee result is the function fed to this dispatcher; source history separately
+reconstructs the original suspended application from the plan's result. -/
+def CompilerApplyMoreReturn
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (sourceContext : IxIR1.Ctx)
+    (context : Eval.Context) :
+    {roots : List IxIR1.Sim.Root} → {stack : List Continuation} →
+      CompilerStackState attached roots stack → IxIR1.Store → RVal → Prop
+  | _, _, .applyMore (sourceResidual := sourceResidual)
+      _ _ _ _ _ _ _ _ _ _ _, sourceStore, function =>
+      ∃ applyFuel outputStore outputValue,
+        sourceContext.decls =
+            IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts ∧
+          Pipeline.ApplyMorePlan attached sourceContext context applyFuel
+            sourceStore function sourceResidual outputStore outputValue
+  | _, _, _, _, _ => False
+
+/-- What the active source computation must reconstruct for its suspended
+caller. For over-application, the first callee contributes a prefix which
+accepts any later successful residual application. -/
+def CompilerStackCompletion
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (sourceContext : IxIR1.Ctx) :
+    {roots : List IxIR1.Sim.Root} → {stack : List Continuation} →
+      CompilerStackState attached roots stack → IxIR1.Store → RVal → Prop
+  | _, _, .nil, _, _ => True
+  | _, _, .applyMore
+      (callerTrace := callerTrace) (sourceFunction := sourceFunction)
+      (sourceArguments := sourceArguments) (callerStore := callerStore)
+      (callerSource := callerSource) (sourceResidual := sourceResidual)
+      _ _ _ _ _ _ _ _ _ _ _, sourceStore, function =>
+      ∀ {fuel : Nat} {out : IxIR1.Store × RVal},
+        IxIR1.applyGo sourceContext fuel sourceStore function sourceResidual =
+          .ok out →
+        ∃ operationFuel,
+          IxIR1.runOp sourceContext (operationFuel + 1) callerTrace.source
+            callerStore callerSource (.apply sourceFunction sourceArguments) =
+              .ok out
+  | _, _, callStack, sourceStore, value =>
+      CompilerStackReturn attached sourceContext callStack sourceStore value
+
+/-- Composable source history for every suspended caller. The active
+completion implication follows the current frame through tail calls; the
+recursive half retains the history to restore when this caller resumes. -/
+def CompilerStackHistory
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (sourceContext : IxIR1.Ctx)
+    {roots : List IxIR1.Sim.Root} {stack : List Continuation}
+    (callStack : CompilerStackState attached roots stack)
+    (point : IxIR1.CodePoint) : Prop :=
+  (∀ {out : IxIR1.Store × RVal}, point.Runs sourceContext out →
+    IxIR1.Sim.HasWorld out.1 point.current.result out.2 →
+      CompilerStackCompletion attached sourceContext callStack out.1 out.2) ∧
+  match callStack with
+  | .nil => True
+  | .addressed
+      (callerTrace := callerTrace) (sourceAddress := sourceAddress)
+      (sourceArguments := sourceArguments) (next := next)
+      (callerStore := callerStore) (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ tail =>
+      CompilerStackHistory attached sourceContext tail
+        ⟨callerTrace.source, callerStore, callerSource,
+          .letOp (.call sourceAddress sourceArguments) next.sourceCode⟩
+  | .self
+      (callerTrace := callerTrace) (sourceArguments := sourceArguments)
+      (next := next) (callerStore := callerStore) (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ _ _ _ _ tail =>
+      CompilerStackHistory attached sourceContext tail
+        ⟨callerTrace.source, callerStore, callerSource,
+          .letOp (.callSelf sourceArguments) next.sourceCode⟩
+  | .applyExact
+      (callerTrace := callerTrace) (sourceFunction := sourceFunction)
+      (sourceArguments := sourceArguments) (next := next)
+      (callerStore := callerStore) (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ tail =>
+      CompilerStackHistory attached sourceContext tail
+        ⟨callerTrace.source, callerStore, callerSource,
+          .letOp (.apply sourceFunction sourceArguments) next.sourceCode⟩
+  | .applyMore
+      (callerTrace := callerTrace) (sourceFunction := sourceFunction)
+      (sourceArguments := sourceArguments) (next := next)
+      (callerStore := callerStore) (callerSource := callerSource)
+      _ _ _ _ _ _ _ _ _ _ tail =>
+      CompilerStackHistory attached sourceContext tail
+        ⟨callerTrace.source, callerStore, callerSource,
+          .letOp (.apply sourceFunction sourceArguments) next.sourceCode⟩
+
+/-- Advance the active source history while retaining all suspended callers. -/
+theorem CompilerStackHistory.advance
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {sourceContext : IxIR1.Ctx}
+    {roots : List IxIR1.Sim.Root} {stack : List Continuation}
+    {callStack : CompilerStackState attached roots stack}
+    {before after : IxIR1.CodePoint}
+    (history : CompilerStackHistory attached sourceContext callStack before)
+    (step : IxIR1.ExecutionHistory sourceContext before after) :
+    CompilerStackHistory attached sourceContext callStack after := by
+  cases callStack <;> simp only [CompilerStackHistory] at history ⊢
+  all_goals exact ⟨fun run world => history.1 (step.complete run world)
+    (step.resultWorld.symm ▸ world), history.2⟩
+
+/-- Complete the active source computation, leaving its caller evidence in
+the exact form selected by the typed continuation stack. -/
+theorem CompilerStackHistory.complete
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {sourceContext : IxIR1.Ctx}
+    {roots : List IxIR1.Sim.Root} {stack : List Continuation}
+    {callStack : CompilerStackState attached roots stack}
+    {point : IxIR1.CodePoint} {out : IxIR1.Store × RVal}
+    (history : CompilerStackHistory attached sourceContext callStack point)
+    (run : point.Runs sourceContext out)
+    (world : IxIR1.Sim.HasWorld out.1 point.current.result out.2) :
+    CompilerStackCompletion attached sourceContext callStack out.1 out.2 := by
+  cases callStack <;> simp only [CompilerStackHistory] at history
+  all_goals exact history.1 run world
+
+/-- An ordinary target resume selects ordinary source completion evidence. -/
+theorem CompilerStackCompletion.ordinary
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {sourceContext : IxIR1.Ctx}
+    {roots : List IxIR1.Sim.Root} {stack : List Continuation}
+    {callStack : CompilerStackState attached roots stack}
+    {sourceStore : IxIR1.Store} {value : RVal}
+    (completed : CompilerStackCompletion attached sourceContext callStack
+      sourceStore value)
+    {caller : Frame} {rest : List Continuation}
+    (stackEq : stack = .resume caller :: rest) :
+    CompilerStackReturn attached sourceContext callStack sourceStore value := by
+  cases callStack <;> simp only [CompilerStackCompletion] at completed
+  all_goals first | exact completed | cases stackEq
+
+/-- Source/HPT/ownership evidence at one running baseline IxIR₂ machine.
+This is the machine-local state already threaded by `PipelineSim`, separated
+from a particular successful source result so it can serve as the baseline
+half of the reuse invariant. -/
+structure CompilerRunningState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (machine : Machine) where
+  functionTrace : Lower.FunctionTrace
+  trace : Lower.CodeTrace
+  sourceStore : IxIR1.Store
+  source : List RVal
+  frameRoots : List IxIR1.Sim.Root
+  frame : Frame
+  stack : List Continuation
+  member : functionTrace ∈ attached.target.artifact.trace.functions
+  descendant : functionTrace.root.Descendant trace
+  traceState : attached.sidecars.TraceStateRel functionTrace trace sourceStore
+    source frame
+  stores : Lower.Sim.StoreRel sourceStore machine.store
+  runtime : Lower.Sim.SourceRuntimeInvariant sourceStore source
+  ownership : Lower.Sim.SourceOwnershipAt
+    attached.target.artifact.trace.positions trace sourceStore source
+      frameRoots
+  stackRoots : LiveStackSupportedByRoots frameRoots stack
+  callStack : CompilerStackState attached frameRoots stack
+  history : CompilerStackHistory attached attached.simulationSourceContext
+    callStack ⟨functionTrace.source, sourceStore, source, trace.sourceCode⟩
+  image : attached.SourceStoreImage sourceStore
+  control : machine.control = .running frame stack
+  noCredits : frame.credits = #[]
+
+/-- Compiler state at a synchronization boundary. Halted states need no
+further accepted-site evidence; running states retain the full attachment
+witness above. -/
+inductive CompilerState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) : Machine → Prop where
+  | running {machine : Machine} : CompilerRunningState attached machine →
+      CompilerState attached machine
+  | halted {machine : Machine} {value : RVal} :
+      machine.control = .halted value → CompilerState attached machine
+
+/-- A positive baseline execution whose endpoint carries the concrete
+compiler invariant.  This is the baseline half of a synchronization macro;
+constructor switching uses it because its recursive trace state appears only
+after edge transfer and the generated field-fetch prologue. -/
+inductive CompilerMacroStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (context : Eval.Context)
+    (interpretation : Interpretation) (start : Machine) : Prop where
+  | intro (count : Nat) (positive : 0 < count) (target : Machine)
+      (steps : Steps context interpretation count start target)
+      (compiler : CompilerState attached target) :
+      CompilerMacroStep attached context interpretation start
+
+/-- A fixed-length compiler macro whose endpoint is also known to be a legal
+synchronization boundary for every related rewritten endpoint.  Accepted
+reuse prefixes produce this stronger object at their recursive self-entry. -/
+inductive CompilerAcceptedMacroStepAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (context : Eval.Context)
+    (interpretation : Interpretation) (count : Nat)
+    (start : Machine) : Prop where
+  | intro (positive : 0 < count) (target : Machine)
+      (steps : Steps context interpretation count start target)
+      (compiler : CompilerState attached target)
+      (acceptedEntry : ∀ {rewrittenTarget : Machine},
+        StableLiveMachineRel Validate.defaultLimits
+            attached.target.artifact.validationContext target
+              rewrittenTarget →
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext target
+              rewrittenTarget) :
+      CompilerAcceptedMacroStepAt attached context interpretation count start
+
+/-- Forget the fixed length and synchronization phase of a compiler macro. -/
+theorem CompilerAcceptedMacroStepAt.compilerMacro
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {context : Eval.Context}
+    {interpretation : Interpretation} {count : Nat} {start : Machine}
+    (step : CompilerAcceptedMacroStepAt attached context interpretation count
+      start) :
+    CompilerMacroStep attached context interpretation start := by
+  cases step with
+  | intro positive target steps compiler _acceptedEntry =>
+      exact .intro count positive target steps compiler
+
+/-- Two running-step sequences of the same length from the same machine have
+the same endpoint. This lifts one-step evaluator determinism to the fixed
+length macros used by compiler reconstruction. -/
+theorem Steps.deterministic {context : Eval.Context}
+    {interpretation : Interpretation} {count : Nat}
+    {start leftTarget rightTarget : Machine}
+    (left : Steps context interpretation count start leftTarget)
+    (right : Steps context interpretation count start rightTarget) :
+    leftTarget = rightTarget := by
+  induction left generalizing rightTarget with
+  | refl =>
+      cases right
+      rfl
+  | @cons count before middle leftTarget frame stack running head tail ih =>
+      cases right with
+      | @cons _ _ rightMiddle rightTarget _ _ _ rightHead rightTail =>
+          have middleEq : middle = rightMiddle :=
+            head.deterministic rightHead
+          subst rightMiddle
+          exact ih rightTail
+
+/-- Forget the retained ordinal and recover the evaluator's exact tag lookup. -/
+private theorem sourceAlternativeFind
+    {alternatives : Array IxIR1.Alt} {tag index : Nat}
+    {alternative : IxIR1.Alt}
+    (found : Lower.sourceAlternativeAtTag? alternatives tag =
+      some (alternative, index)) :
+    alternatives.find? (fun candidate => candidate.cidx == tag) =
+      some alternative := by
+  calc
+    alternatives.find? (fun candidate => candidate.cidx == tag) =
+        (Lower.sourceAlternativeAtTag? alternatives tag).map Prod.fst := by
+      rw [Lower.sourceAlternativeAtTag?_map_fst]
+      apply congrArg (fun predicate : IxIR1.Alt → Bool => alternatives.find? predicate)
+      funext candidate
+      cases candidate
+      rfl
+    _ = some alternative := by rw [found]; rfl
+
+namespace CompilerRunningState
+
+/-- Record a completed source operation in the suspended caller histories. -/
+theorem historyStepOp
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (traceEq : state.trace = .letOp site blockId input nextInput entryValueCount
+      operation index instruction next)
+    {fuel : Nat} {nextStore : IxIR1.Store} {value : RVal}
+    (run : IxIR1.runOp attached.simulationSourceContext fuel
+      state.functionTrace.source state.sourceStore state.source operation =
+        .ok (nextStore, value)) :
+    CompilerStackHistory attached attached.simulationSourceContext state.callStack
+      ⟨state.functionTrace.source, nextStore, value :: state.source,
+        next.sourceCode⟩ := by
+  apply state.history.advance
+  simpa [traceEq, Lower.CodeTrace.sourceCode] using
+    (IxIR1.ExecutionHistory.stepOp (next := next.sourceCode) run)
+
+/-- Immediate operations use the same source history under any compatible
+declaration context, including callers with a different scalar oracle. -/
+theorem historyImmediateOp
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (traceEq : state.trace = .letOp site blockId input nextInput entryValueCount
+      operation index instruction next)
+    (declarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {fuel : Nat} {nextStore : IxIR1.Store} {value : RVal}
+    (run : IxIR1.runOp sourceContext fuel state.functionTrace.source
+      state.sourceStore state.source operation = .ok (nextStore, value))
+    (immediate : operation.isImmediate = true) :
+    CompilerStackHistory attached attached.simulationSourceContext state.callStack
+      ⟨state.functionTrace.source, nextStore, value :: state.source,
+        next.sourceCode⟩ := by
+  apply state.historyStepOp traceEq
+  rw [IxIR1.runOp_immediate_ctx_eq sourceContext
+    attached.simulationSourceContext declarations.symm _ _ _ _ _ immediate]
+  exact run
+
+/-- Rebuild the original dynamic-application caller once an `applyMore`
+dispatcher reaches an immediate result.  This factors the caller-side HPT,
+ownership, runtime, heap-image, and live-stack reconstruction shared by the
+erased and under-saturated return branches. -/
+private def resumedApplyCaller
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {operationFuel : Nat}
+    {callerTrace : Lower.FunctionTrace}
+    (callerMember : callerTrace ∈ attached.target.artifact.trace.functions)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {next : Lower.CodeTrace}
+    (callerDescendant : callerTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next))
+    {callerStore outputStore : IxIR1.Store} {callerSource : List RVal}
+    {callerFrameRoots : List IxIR1.Sim.Root}
+    {callerFrame : Frame} {callerStack : List Continuation}
+    (callerState : attached.sidecars.TraceStateRel callerTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      callerStore callerSource callerFrame)
+    (callerRuntime : Lower.Sim.SourceRuntimeInvariant callerStore callerSource)
+    (callerOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      callerStore callerSource callerFrameRoots)
+    (callerStackRoots : LiveStackSupportedByRoots callerFrameRoots callerStack)
+    (callerImage : attached.SourceStoreImage callerStore)
+    (callerNoCredits : callerFrame.credits = #[])
+    (tail : CompilerStackState attached callerFrameRoots callerStack)
+    (callerHistory : CompilerStackHistory attached attached.simulationSourceContext
+      tail ⟨callerTrace.source, callerStore, callerSource,
+        .letOp (.apply sourceFunction sourceArguments) next.sourceCode⟩)
+    (sourceDeclarations : attached.simulationSourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {value : RVal}
+    (operationRun : IxIR1.runOp attached.simulationSourceContext (operationFuel + 1)
+      callerTrace.source
+      callerStore callerSource (.apply sourceFunction sourceArguments) =
+        .ok (outputStore, value))
+    {targetStore : Store} {heapFuel : Nat}
+    (stores : Lower.Sim.StoreRel outputStore targetStore) :
+    let nextCallerFrame : Frame :=
+      { callerFrame with
+        pc := callerFrame.pc + 1
+        values := callerFrame.values.push value }
+    CompilerRunningState attached
+      { store := targetStore
+        heapFuel := heapFuel
+        control := .running nextCallerFrame callerStack } := by
+  dsimp only
+  let nextCallerFrame : Frame :=
+    { callerFrame with
+      pc := callerFrame.pc + 1
+      values := callerFrame.values.push value }
+  have nextTarget : Lower.Sim.CodeStateRel callerTrace next
+      (value :: callerSource) nextCallerFrame := by
+    simpa [nextCallerFrame] using
+      (callerState.target.letOpValueNext callerDescendant (by rfl) (by rfl)
+        value)
+  have nextTraceState := attached.traceState_next_of_member callerMember
+    callerState callerDescendant sourceDeclarations operationRun nextTarget
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant outputStore
+      (value :: callerSource) :=
+    callerRuntime.runOp
+      (IxIR1.NoReuse.runOp_reuses_eq
+        (attached.sourceContextNoReuse sourceDeclarations)
+        (attached.functionTraceNoReuse callerMember) (by trivial) operationRun)
+      operationRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next outputStore
+        (value :: callerSource) callerFrameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      callerMember callerDescendant callerOwnership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          sourceDeclarations callerImage) operationRun
+  have nextImage : attached.SourceStoreImage outputStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations callerMember
+      callerDescendant callerState callerImage operationRun
+  have nextDescendant : callerTrace.root.Descendant next :=
+    .step callerDescendant (by simp [Lower.CodeTrace.children])
+  exact
+    { functionTrace := callerTrace
+      trace := next
+      sourceStore := outputStore
+      source := value :: callerSource
+      frameRoots := callerFrameRoots
+      frame := nextCallerFrame
+      stack := callerStack
+      member := callerMember
+      descendant := nextDescendant
+      traceState := nextTraceState
+      stores := stores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := callerStackRoots
+      callStack := tail
+      history := callerHistory.advance (IxIR1.ExecutionHistory.stepOp operationRun)
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextCallerFrame] using callerNoCredits }
+
+/-- Select the exact producer capability vector and dynamic root ownership
+at the running trace coordinate. -/
+theorem currentOwnership
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine) :
+    ∃ position,
+      position ∈ attached.target.artifact.trace.positions ∧
+      position.coordinateMatches state.trace.source state.trace.sourceBlock
+          state.trace.targetPosition state.trace.sourceInputMap = true ∧
+      Lower.Sim.SourceOwnershipInvariant state.sourceStore state.source
+        state.trace.sourceInputMap position.sourceCapabilities
+          state.frameRoots := by
+  obtain ⟨position, member, coordinate⟩ :=
+    attached.target.position state.member state.descendant
+  exact ⟨position, member, coordinate,
+    state.ownership position member coordinate⟩
+
+/-- Current-frame coverage is a static consequence of the checked lowering
+trace retained by the compiler state, rather than an independently preserved
+runtime assumption. -/
+theorem coverage
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine) :
+    LiveFrameInputCoverage state.trace.sourceInputMap state.frame :=
+  LiveFrameInputCoverage.ofCodeState state.traceState.target state.descendant
+
+/-- At an accepted compiler-produced block entry, the runtime value-vector
+length is the site's parameter ABI. This is reconstructed from the recursive
+lowering trace rather than supplied by a semantic caller. -/
+theorem acceptedSiteParameterCount
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0) :
+    state.frame.values.size = site.shape.parameterCount := by
+  obtain ⟨sourceAt, _resetAt, _hotAt, _coldAt⟩ :=
+    rewrite.acceptedAt accepted
+  have currentBlockAt :
+      state.frame.definition.blocks[state.frame.block]? = some block := by
+    rw [baselineDefinition]
+    exact sourceAt
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (currentBlockAt.symm.trans exactBlock)
+  have tracePc : state.trace.entryPc = 0 :=
+    state.traceState.target.pc.symm.trans pc
+  calc
+    state.frame.values.size = state.trace.entryValueCount :=
+      state.traceState.target.valueCount
+    _ = state.trace.headBlock.2.valueParams.size :=
+      state.functionTrace.descendantEntryValueCount state.descendant tracePc
+    _ = block.valueParams.size := by rw [blockEq]
+    _ = site.shape.parameterCount := site.fits.parameterCount.symm
+
+/-- Recover the exact source owner behind a future-live inherited target
+parameter and focus it at the head of the dynamic root list.  The residual
+roots retain every suspended-frame root, so the result feeds both the
+logical accepted macros and the physical stack-avoidance bridge. -/
+theorem ownedParameterRoot
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    {index : Nat} {world : Ixon.Owned} {value : RVal}
+    (parameterAt : block.valueParams[index]? = some (ValueCap.owned world))
+    (live : ValueLiveFrom state.frame.definition state.frame.block
+      state.frame.pc index)
+    (valueAt : state.frame.values[index]? = some value) :
+    ∃ (position : Lower.PositionTrace) (sourceIndex : Nat)
+        (rest : List IxIR1.Sim.Root),
+      position ∈ attached.target.artifact.trace.positions ∧
+      position.coordinateMatches state.trace.source state.trace.sourceBlock
+          state.trace.targetPosition state.trace.sourceInputMap = true ∧
+      state.trace.sourceInputMap[sourceIndex]? =
+          some (some (Atom.reg index)) ∧
+      state.source[sourceIndex]? = some value ∧
+      position.sourceCapabilities[sourceIndex]? =
+          some (Lower.BindingCap.owned world) ∧
+      IxIR1.Sim.RootOwnership state.sourceStore
+          (⟨world, value⟩ :: rest) ∧
+      ∀ root ∈ state.frameRoots, root ∈ rest := by
+  obtain ⟨position, member, coordinate, ownership⟩ :=
+    state.currentOwnership
+  have valueBound : index < state.frame.values.size :=
+    (Array.getElem?_eq_some_iff.mp valueAt).1
+  obtain ⟨sourceIndex, inputAt⟩ := state.coverage live valueBound
+  have inputBound : sourceIndex < state.trace.sourceInputMap.size :=
+    (Array.getElem?_eq_some_iff.mp inputAt).1
+  have capabilitySize :=
+    position.sourceCapabilities_size_of_coordinateMatch coordinate
+  have sourceBound : sourceIndex < state.source.length := by
+    rw [ownership.length, capabilitySize]
+    exact inputBound
+  let sourceValue := state.source[sourceIndex]
+  have sourceAt : state.source[sourceIndex]? = some sourceValue := by
+    simp [sourceValue]
+  have sourceResolved := state.traceState.target.environments sourceIndex
+    sourceValue (Atom.reg index) sourceAt inputAt
+  have targetResolved : Eval.resolveAtom state.frame.values (Atom.reg index) =
+      .ok value := by
+    simp [Eval.resolveAtom, valueAt]
+  have sourceValueEq : sourceValue = value :=
+    Except.ok.inj (sourceResolved.symm.trans targetResolved)
+  have sourceAtValue : state.source[sourceIndex]? = some value :=
+    sourceAt.trans (congrArg some sourceValueEq)
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  subst block
+  have capabilityAt := attached.target.ownedParameterCapability state.member
+    state.descendant member coordinate inputAt parameterAt
+  obtain ⟨rest, focused, rootsInRest⟩ :=
+    ownership.focusOwned capabilityAt sourceAtValue
+  exact ⟨position, sourceIndex, rest, member, coordinate, inputAt,
+    sourceAtValue, capabilityAt, focused, rootsInRest⟩
+
+/-- At any point up to the recognized release, an accepted site's source
+parameter is the distinguished shared owner in the compiler's exact dynamic
+root multiset.  This specializes `ownedParameterRoot` to the syntax and
+liveness facts retained by `Reuse.Site`. -/
+theorem acceptedSiteSourceRoot
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {location : Nat}
+    (resolved : Eval.resolveAtom state.frame.values
+      (.reg site.shape.source) = .ok (.loc location)) :
+    ∃ rest : List IxIR1.Sim.Root,
+      IxIR1.Sim.RootOwnership state.sourceStore
+          (⟨.shared, .loc location⟩ :: rest) ∧
+      ∀ root ∈ state.frameRoots, root ∈ rest := by
+  have sourceAt := (rewrite.acceptedAt found).1
+  have blockAt : state.frame.definition.blocks[state.frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact sourceAt
+  have sourceLiveAtRelease : AtomLiveFrom source state.frame.block
+      site.shape.releasePosition (.reg site.shape.source) :=
+    AtomLiveFrom.instruction sourceAt site.fits.release
+      Liveness.InstrUsesAtom.releaseShared
+  have sourceLive : ValueLiveFrom state.frame.definition state.frame.block
+      state.frame.pc site.shape.source := by
+    have earlier := sourceLiveAtRelease.mono pc
+    simpa [baselineDefinition, AtomLiveFrom] using earlier
+  have valueAt : state.frame.values[site.shape.source]? =
+      some (.loc location) := by
+    cases foundValue : state.frame.values[site.shape.source]? with
+    | none => simp [Eval.resolveAtom, foundValue] at resolved
+    | some value =>
+        have valueEq : value = .loc location := by
+          simpa [Eval.resolveAtom, foundValue] using resolved
+        subst value
+        rfl
+  obtain ⟨_position, _sourceIndex, rest, _member, _coordinate, _inputAt,
+      _sourceValueAt, _capabilityAt, ownership, rootsInRest⟩ :=
+    state.ownedParameterRoot blockAt site.fits.sourceOwned sourceLive valueAt
+  exact ⟨rest, ownership, rootsInRest⟩
+
+/-- At an accepted source root, an incoming live-heap isomorphism determines
+an exact rewritten ownership presentation with the related source root fixed
+at its head. -/
+theorem acceptedSiteSourceRootIso
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {baselineLocation rewrittenLocation : Nat}
+    (resolved : Eval.resolveAtom state.frame.values
+      (.reg site.shape.source) = .ok (.loc baselineLocation))
+    {rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore state.sourceStore)
+    (locations : iso.locRel rewrittenLocation baselineLocation) :
+    ∃ baselineRest rewrittenRest : List IxIR1.Sim.Root,
+      IxIR1.Sim.RootOwnership state.sourceStore
+          (⟨.shared, .loc baselineLocation⟩ :: baselineRest) ∧
+      IxIR1.Sim.RootsIso iso.locRel
+          (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenRest)
+          (⟨.shared, .loc baselineLocation⟩ :: baselineRest) ∧
+      IxIR1.Sim.RootOwnership rewrittenStore
+          (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenRest) ∧
+      ∀ root ∈ state.frameRoots, root ∈ baselineRest := by
+  obtain ⟨baselineRest, baselineOwned, rootsInRest⟩ :=
+    state.acceptedSiteSourceRoot rewrite baselineDefinition accepted pc
+      resolved
+  let head : IxIR1.Sim.RootIso iso.locRel
+      ⟨.shared, .loc rewrittenLocation⟩
+      ⟨.shared, .loc baselineLocation⟩ :=
+    ⟨rfl, .loc locations⟩
+  obtain ⟨rewrittenRest, roots, rewrittenOwned⟩ :=
+    iso.rootOwnershipPreimageCons head baselineOwned
+  exact ⟨baselineRest, rewrittenRest, baselineOwned, roots,
+    rewrittenOwned, rootsInRest⟩
+
+/-- At a borrow-free checked position for the current trace coordinate, the
+compiler's environment, ownership, and liveness facts support every
+future-observable value in the active frame by the position's exact owned
+roots. Borrowed capabilities are intentionally excluded here: their dynamic
+invariant supplies a reachability path from a lender, not a direct root for
+the borrowed value itself. -/
+theorem activeFrameSupportedAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {position : Lower.PositionTrace}
+    (member : position ∈ attached.target.artifact.trace.positions)
+    (coordinate : position.coordinateMatches state.trace.source
+      state.trace.sourceBlock state.trace.targetPosition
+        state.trace.sourceInputMap = true)
+    (noBorrows : Lower.noBorrows position.sourceCapabilities = true) :
+    LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities position.sourceCapabilities.toList
+        state.source)
+      state.frame :=
+  LiveFrameSupportedByRoots.ofNoBorrows coordinate
+    state.traceState.target.environments
+    (state.ownership position member coordinate) noBorrows state.coverage
+      state.noCredits
+
+/-- Specialize active-frame support at an accepted planner allocation. Once
+the producer audit supplies a borrow-free current capability vector, static
+planner liveness discharges the mapped-value root premise used by physical
+reuse. -/
+theorem mappedValuesAtPlannerAllocationOfNoBorrows
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {position : Lower.PositionTrace}
+    (member : position ∈ attached.target.artifact.trace.positions)
+    (coordinate : position.coordinateMatches state.trace.source
+      state.trace.sourceBlock state.trace.targetPosition
+        state.trace.sourceInputMap = true)
+    (noBorrows : Lower.noBorrows position.sourceCapabilities = true)
+    {block : Block}
+    (site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block)
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = site.shape.releasePosition + 1) :
+    MappedValuesInRoots site.shape state.frame.values
+      (Lower.Sim.rootsForCapabilities position.sourceCapabilities.toList
+        state.source) :=
+  LiveFrameSupportedByRoots.mappedValuesAtPlannerAllocation site blockAt
+    (state.activeFrameSupportedAt member coordinate noBorrows) rfl rfl pc
+
+/-- Changing only the target evaluator's heap budget preserves every
+source/compiler fact in a running state. This is the transport used to fund
+recursive release before composing it with a suffix execution. -/
+def withHeapFuel
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (heapFuel : Nat) :
+    CompilerRunningState attached { machine with heapFuel := heapFuel } :=
+  { state with
+    stores := by simpa using state.stores
+    control := by simpa using state.control }
+
+/-- A reconstructed running endpoint is also the compiler state at any other
+endpoint of the same evaluator step. This is the bridge from the specialized
+transition lemmas below back to a caller-supplied baseline step. -/
+theorem compilerStateOfStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {before generated actual : Machine}
+    (state : CompilerRunningState attached generated)
+    (generatedStep : Eval.Step context interpretation before generated)
+    (actualStep : Eval.Step context interpretation before actual) :
+    CompilerState attached actual := by
+  have targetEq : generated = actual :=
+    generatedStep.deterministic actualStep
+  subst actual
+  exact .running state
+
+/-- Recover the evaluator-facing prefix instruction at the current compiler
+trace node. This is the common packaging bridge for fetch, shared retain,
+shared release, and shared allocation transitions: their compiler step lemmas
+already carry the same `letOp` equation, so no endpoint phase proof is needed
+to select the prefix-dispatch arm. -/
+def acceptedPrefixInstructionAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount operation index
+        instruction next)
+    (acceptedPrefix : AcceptedPrefixInstruction instruction) :
+    AcceptedPrefixInstructionAt machine := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  obtain ⟨blockAt, pc, instructionAt⟩ :=
+    traceState.target.instructionAt descendant
+  exact
+    { frame := state.frame
+      stack := state.stack
+      block := next.headBlock.2
+      instruction := instruction
+      control := state.control
+      blockAt := blockAt
+      pc := pc
+      instructionAt := (Array.getElem?_eq_some_iff.mp instructionAt).2
+      acceptedPrefix := acceptedPrefix }
+
+/-- Advance a compiler running state across a traced source `pure` operation
+and its generated target `move`. The heap is unchanged, while the resolved
+value is pushed on both environments. -/
+theorem stepPure
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {value : RVal}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok value) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push value }
+    let nextMachine : Machine :=
+      { machine with control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.pure sourceAtom) = .ok (state.sourceStore, value) ∧
+        Eval.Step context interpretation machine nextMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.pure sourceAtom) index (.move targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push value }
+  let nextMachine : Machine :=
+    { machine with control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_pure_move_state
+      (sourceFuel := sourceFuel) state.member descendant traceState state.stores
+      sourceDeclarations sourceResolved state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      (value :: state.source) :=
+    state.runtime.runOpNoReuse
+      (attached.sourceContextNoReuse sourceDeclarations)
+      (attached.functionTraceNoReuse state.member) (by trivial) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next state.sourceStore
+        (value :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.pure (checked := attached.target)
+      state.member descendant ownership sourceResolved
+  have nextImage : attached.SourceStoreImage state.sourceStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := state.sourceStore
+      source := value :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, moveAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨nextState, sourceRun,
+    by simpa [nextMachine, nextFrame] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofMoveAdvance rfl nextBlockAt
+      (by simpa [nextFrame] using moveAt)⟩
+
+/-- Advance a compiler running state across one HPT-certified constructor
+projection. The source heap is unchanged, while the fetched value is pushed
+on both environments. -/
+theorem stepFetch
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {sourceField targetField : Nat} {targetCid : IxIR1.CtorId}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {value : RVal}
+    (operationRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      state.functionTrace.source state.sourceStore state.source
+        (.fetch sourceAtom sourceField) = .ok (state.sourceStore, value)) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push value }
+    let nextMachine : Machine :=
+      { machine with control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.fetch sourceAtom sourceField) =
+          .ok (state.sourceStore, value) ∧
+        Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.fetch sourceAtom sourceField) index
+        (.fetch targetAtom targetCid targetField) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push value }
+  let nextMachine : Machine :=
+    { machine with control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_fetch_state_of_run_hpt state.member descendant
+      traceState state.stores sourceDeclarations operationRun state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      (value :: state.source) :=
+    state.runtime.runOpNoReuse
+      (attached.sourceContextNoReuse sourceDeclarations)
+      (attached.functionTraceNoReuse state.member) (by trivial) operationRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next state.sourceStore
+        (value :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.fetch (checked := attached.target)
+      state.member descendant ownership operationRun
+  have nextImage : attached.SourceStoreImage state.sourceStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image operationRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := state.sourceStore
+      source := value :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  exact ⟨nextState, sourceRun,
+    by simpa [nextMachine, nextFrame] using targetStep⟩
+
+/-- Advance a compiler running state across an HPT-certified shallow unique
+free. The erased constructor identity and scalar-field condition are recovered
+from the attachment, and the matching location is killed in both heaps. -/
+theorem stepFreeUnique
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    {targetCid : IxIR1.CtorId}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {outputStore : IxIR1.Store}
+    (sourceRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+      state.functionTrace.source state.sourceStore state.source
+        (.free sourceAtom) = .ok (outputStore, .erased)) :
+    ∃ location,
+      outputStore = state.sourceStore.kill location ∧
+      let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+      let nextMachine : Machine :=
+        { machine with
+          store := machine.store.kill location
+          control := .running nextFrame state.stack }
+      ∃ _ : CompilerRunningState attached nextMachine,
+        Eval.Step context interpretation machine nextMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.free sourceAtom) index (.freeUnique targetAtom targetCid) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  obtain ⟨location, box, sourceResolved, sourceGet, unique, output⟩ :=
+    IxIR1.runOp_free_success sourceRun
+  have outputStoreEq : outputStore = state.sourceStore.kill location :=
+    congrArg Prod.fst output
+  subst outputStore
+  obtain ⟨fact, selected⟩ :=
+    attached.scalarLeafAt?_of_free_descendant state.member descendant
+  obtain ⟨exactBox, fields, exactGet, node, scalarFields⟩ :=
+    attached.sidecars.scalarLeafAt?_runtime selected traceState.environment
+      sourceResolved
+  have boxEq : exactBox = box :=
+    Option.some.inj (exactGet.symm.trans sourceGet)
+  subst exactBox
+  let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let nextMachine : Machine :=
+    { machine with
+      store := machine.store.kill location
+      control := .running nextFrame state.stack }
+  obtain ⟨_, targetStep, nextStores, nextTarget⟩ :=
+    Lower.Sim.simulate_traced_free_freeUnique_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := state.functionTrace.source)
+      (sourceFuel := sourceFuel) descendant traceState.target state.stores
+      sourceResolved sourceGet unique node scalarFields state.control
+  have nextTraceState := attached.traceState_next_of_member state.member
+    traceState descendant sourceDeclarations sourceRun nextTarget
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant
+      (state.sourceStore.kill location) (.erased :: state.source) :=
+    state.runtime.runOp (by rfl) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next
+        (state.sourceStore.kill location) (.erased :: state.source)
+          state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.free (checked := attached.target)
+      state.member descendant ownership sourceResolved sourceGet unique node
+        scalarFields sourceRun
+  have nextImage : attached.SourceStoreImage
+      (state.sourceStore.kill location) :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := state.sourceStore.kill location
+      source := .erased :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, freeAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨location, rfl, nextState,
+    by simpa [nextMachine, nextFrame] using targetStep,
+    fun _rewritten =>
+      StableLiveAcceptedEntry.ofFreeUniqueAdvance rfl nextBlockAt
+        (by simpa [nextFrame] using freeAt)⟩
+
+/-- Advance a compiler running state across scalar duplication. Both heaps
+remain unchanged, while the duplicated scalar is pushed on both environments. -/
+theorem stepRetainScalar
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {value : RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push value }
+    let nextMachine : Machine :=
+      { machine with control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.dup sourceAtom) = .ok (state.sourceStore, value) ∧
+        Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push value }
+  let nextMachine : Machine :=
+    { machine with control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_dup_retain_scalar_state
+      (sourceFuel := sourceFuel) state.member descendant traceState state.stores
+      sourceDeclarations sourceResolved scalar state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      (value :: state.source) :=
+    state.runtime.runOpNoReuse
+      (attached.sourceContextNoReuse sourceDeclarations)
+      (attached.functionTraceNoReuse state.member) (by trivial) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next state.sourceStore
+        (value :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.dup (checked := attached.target)
+      state.member descendant ownership sourceResolved sourceRun
+  have nextImage : attached.SourceStoreImage state.sourceStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := state.sourceStore
+      source := value :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  exact ⟨nextState, sourceRun,
+    by simpa [nextMachine, nextFrame] using targetStep⟩
+
+/-- Advance a compiler running state across shared duplication/retention.
+The matching source and target boxes receive the same incremented refcount,
+and the retained location is pushed on both environments. -/
+theorem stepRetainShared
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {location : Nat} {box : IxIR1.NodeBox}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok (.loc location))
+    (sourceGet : state.sourceStore.get? location = some box)
+    (shared : box.world = .shared) :
+    let nextBox : IxIR1.NodeBox := { box with rc := box.rc + 1 }
+    let sourceStore' := (state.sourceStore.setBox location nextBox).rcTick
+    let targetStore' := (machine.store.setBox location nextBox).rcTick
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push (.loc location) }
+    let nextMachine : Machine :=
+      { machine with
+        store := targetStore'
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.dup sourceAtom) = .ok (sourceStore', .loc location) ∧
+        Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dup sourceAtom) index (.retainShared targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let nextBox : IxIR1.NodeBox := { box with rc := box.rc + 1 }
+  let sourceStore' := (state.sourceStore.setBox location nextBox).rcTick
+  let targetStore' := (machine.store.setBox location nextBox).rcTick
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push (.loc location) }
+  let nextMachine : Machine :=
+    { machine with
+      store := targetStore'
+      control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_dup_retain_shared_state
+      (sourceFuel := sourceFuel) state.member descendant traceState state.stores
+      sourceDeclarations sourceResolved sourceGet shared state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore'
+      (.loc location :: state.source) :=
+    state.runtime.runOpNoReuse
+      (attached.sourceContextNoReuse sourceDeclarations)
+      (attached.functionTraceNoReuse state.member) (by trivial) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceStore'
+        (.loc location :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.dup (checked := attached.target)
+      state.member descendant ownership sourceResolved sourceRun
+  have nextImage : attached.SourceStoreImage sourceStore' :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceStore'
+      source := .loc location :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by
+        simpa [nextMachine, targetStore', sourceStore', nextBox] using
+          nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  exact ⟨nextState, sourceRun,
+    by simpa [nextMachine, nextFrame, targetStore', nextBox] using targetStep⟩
+
+/-- A checked terminal allocation exposes a borrow-free producer vector at
+every matching current position.  The proof is the focused recursive audit
+retained by lowering, not a semantic caller assumption. -/
+theorem terminalAllocationNoBorrows
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceWorld : Ixon.Owned} {sourceCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom} {targetInstruction : Instr}
+    {tailSite : Lower.SourceSite} {tailBlockId : BlockId}
+    {tailInput : Lower.Sim.EnvMap} {tailEntryValueCount : Nat}
+    {tailSourceArguments : Array IxIR1.Atom} {generated : Block}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index targetInstruction
+        (.tailCallSelf tailSite tailBlockId tailInput tailEntryValueCount
+          tailSourceArguments generated))
+    {position : Lower.PositionTrace}
+    (member : position ∈ attached.target.artifact.trace.positions)
+    (coordinate : position.coordinateMatches site blockId
+      (.instruction index) input = true) :
+    Lower.noBorrows position.sourceCapabilities = true := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index targetInstruction
+        (.tailCallSelf tailSite tailBlockId tailInput tailEntryValueCount
+          tailSourceArguments generated)) := by
+    rw [← traceEq]
+    exact state.descendant
+  exact attached.target.terminalAllocationPositionNoBorrows state.member
+    descendant member coordinate
+
+/-- Recover the exact pre-allocation root accounting at a checked constructor
+allocation.  The retained continuation position certifies that sequential
+capability consumption succeeds; the dynamic source invariant then exposes
+the consumed field roots followed by every surviving source and suspended
+frame root.  The result is stated on the evaluator heap so accepted-site
+proofs do not need to reopen the compiler's exact store relation. -/
+theorem allocationReadyOwnership
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceWorld targetWorld : Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+    {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values) :
+    ∃ (before after : Lower.PositionTrace)
+        (remaining : Array Lower.BindingCap),
+      before ∈ attached.target.artifact.trace.positions ∧
+      after ∈ attached.target.artifact.trace.positions ∧
+      before.coordinateMatches site blockId (.instruction index) input =
+        true ∧
+      after.coordinateMatches next.source next.sourceBlock
+        next.targetPosition next.sourceInputMap = true ∧
+      Lower.consumeCapabilitiesList? before.sourceCapabilities input
+        sourceWorld sourceArguments.toList = some remaining ∧
+      after.sourceCapabilities = #[.owned sourceWorld] ++ remaining ∧
+      IxIR1.Sim.RootOwnership machine.store.heap
+        (IxIR1.Sim.rootsFor sourceWorld values ++
+          Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+            state.frameRoots) := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    attached.target.position state.member nextDescendant
+  obtain ⟨before, beforeMember, beforeCoordinate, transitionMatch⟩ :=
+    attached.target.allocationTransition state.member descendant afterMember
+      afterCoordinate
+  have ownershipAt : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  have invariant := ownershipAt before beforeMember (by
+    simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+      Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+        beforeCoordinate)
+  change Lower.Sim.SourceOwnershipInvariant state.sourceStore state.source
+    input before.sourceCapabilities state.frameRoots at invariant
+  unfold Lower.PositionTrace.allocationResultMatches at transitionMatch
+  cases transitionEq : Lower.allocationCapabilities?
+      before.sourceCapabilities input sourceWorld sourceArguments with
+  | none => simp [transitionEq] at transitionMatch
+  | some expected =>
+      have expectedEq : expected = after.sourceCapabilities := by
+        simpa [transitionEq, beq_iff_eq] using transitionMatch
+      obtain ⟨remaining, consumed, expectedCapabilities, ownership⟩ :=
+        invariant.allocationReadyOwnership sourceResolved transitionEq
+      refine ⟨before, after, remaining, beforeMember, afterMember,
+        beforeCoordinate, afterCoordinate, consumed, ?_, ?_⟩
+      · rw [← expectedEq]
+        exact expectedCapabilities
+      · rw [state.stores.heap]
+        exact ownership
+
+/-- Recover the evaluator field-world evidence at a checked allocation directly
+from the running compiler witness. This is the accepted-site boundary form of
+the ownership fact already used internally by `stepAlloc`: callers supply only
+the traced source resolution and the schema selected by the evaluator context. -/
+theorem allocationFieldWorlds
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceWorld targetWorld : Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+    {schema : CtorSchema} {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema) :
+    Eval.FieldWorlds machine.store schema values.toArray := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  have checkedSchemaAt :
+      attached.target.artifact.validationContext.schemas sourceWorld sourceCid =
+        some schema := by
+    rw [← contextSchemas]
+    exact schemaAt
+  exact state.stores.fieldWorlds_of_checked_allocation_capabilities
+    state.member descendant ownership sourceResolved checkedSchemaAt
+
+/-- Advance a compiler running state across a checked constructor allocation
+under either evaluator interpretation. The checked schema and source ownership
+justify the target field worlds, and both stores allocate the same node at
+corresponding locations. -/
+theorem stepAlloc
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceWorld targetWorld : Ixon.Owned}
+    {sourceCid targetCid : IxIR1.CtorId}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {schema : CtorSchema} {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (schemaAt : context.schemas sourceWorld sourceCid = some schema) :
+    let node : IxIR1.Node := .ctorN sourceCid values.toArray
+    let sourceAllocation := state.sourceStore.allocNode sourceWorld node
+    let targetAllocation := machine.store.allocNode sourceWorld node
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push (.loc sourceAllocation.2) }
+    let nextMachine : Machine :=
+      { machine with
+        store := targetAllocation.1
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.alloc sourceWorld sourceCid sourceArguments) =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+        Eval.Step context interpretation machine nextMachine ∧
+          (targetWorld = .unique →
+            ∀ rewritten,
+              StableLiveAcceptedEntry Validate.defaultLimits
+                attached.target.artifact.validationContext nextMachine
+                  rewritten) := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.alloc sourceWorld sourceCid sourceArguments) index
+        (.alloc targetWorld targetCid targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let node : IxIR1.Node := .ctorN sourceCid values.toArray
+  let sourceAllocation := state.sourceStore.allocNode sourceWorld node
+  let targetAllocation := machine.store.allocNode sourceWorld node
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push (.loc sourceAllocation.2) }
+  let nextMachine : Machine :=
+    { machine with
+      store := targetAllocation.1
+      control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_alloc_checked_state
+      (sourceFuel := sourceFuel) state.member contextSchemas descendant traceState
+      state.stores sourceDeclarations sourceResolved state.control schemaAt
+      ownership
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceAllocation.1
+      (.loc sourceAllocation.2 :: state.source) :=
+    state.runtime.runOpNoReuse
+      (attached.sourceContextNoReuse sourceDeclarations)
+      (attached.functionTraceNoReuse state.member) (by trivial) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceAllocation.1
+        (.loc sourceAllocation.2 :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.alloc (checked := attached.target)
+      state.member descendant ownership sourceRun
+  have nextImage : attached.SourceStoreImage sourceAllocation.1 :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceAllocation.1
+      source := .loc sourceAllocation.2 :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by
+        simpa [nextMachine, targetAllocation, sourceAllocation, node] using
+          nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, allocAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨nextState, sourceRun,
+    by
+      simpa [nextMachine, nextFrame, targetAllocation, sourceAllocation,
+        node] using targetStep,
+    fun targetUnique _rewritten =>
+      StableLiveAcceptedEntry.ofAllocUniqueAdvance rfl nextBlockAt
+        (by simpa [nextFrame, targetUnique] using allocAt)⟩
+
+/-- Advance a compiler running state across a strictly under-saturated
+function partial application. The captured shared arguments are installed in
+matching fresh PAP nodes and the fresh location is pushed on both environments. -/
+theorem stepPapp
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {targetDefinition : Function}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {sourceDefinition : IxIR1.FnDef}
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (sourceDeclaration :
+      sourceContext.decls sourceAddress = some (.fn sourceDefinition))
+    (targetDeclaration :
+      context.declarations sourceAddress = some (.fn targetDefinition))
+    (arity :
+      targetDefinition.signature.params.size = sourceDefinition.arity)
+    (papSafe : targetDefinition.signature.papSafe = true)
+    (under : values.length < sourceDefinition.arity) :
+    let node := IxIR1.Node.papN sourceAddress sourceDefinition.arity
+      values.toArray
+    let sourceAllocation := state.sourceStore.allocNode .shared node
+    let targetAllocation := machine.store.allocNode .shared node
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push (.loc sourceAllocation.2) }
+    let nextMachine : Machine :=
+      { machine with
+        store := targetAllocation.1
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.papp sourceAddress sourceArguments) =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+        Eval.Step context interpretation machine nextMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.papp sourceAddress sourceArguments) index
+        (.papp targetAddress targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let node := IxIR1.Node.papN sourceAddress sourceDefinition.arity
+    values.toArray
+  let sourceAllocation := state.sourceStore.allocNode .shared node
+  let targetAllocation := machine.store.allocNode .shared node
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push (.loc sourceAllocation.2) }
+  let nextMachine : Machine :=
+    { machine with
+      store := targetAllocation.1
+      control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_papp_fn_state
+      (sourceFuel := sourceFuel) state.member descendant traceState state.stores
+      sourceDeclarations sourceResolved sourceDeclaration targetDeclaration
+      arity papSafe under state.noCredits state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceAllocation.1
+      (.loc sourceAllocation.2 :: state.source) := by
+    apply state.runtime.runOp (run := sourceRun)
+    simp [IxIR1.Store.allocNode]
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceAllocation.1
+        (.loc sourceAllocation.2 :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.papp (checked := attached.target)
+      state.member descendant ownership sourceRun
+  have nextImage : attached.SourceStoreImage sourceAllocation.1 :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceAllocation.1
+      source := .loc sourceAllocation.2 :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by
+        simpa [nextMachine, targetAllocation, sourceAllocation, node] using
+          nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, pappAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨nextState, sourceRun,
+    by
+      simpa [nextMachine, nextFrame, targetAllocation, sourceAllocation,
+        node] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPappAdvance rfl nextBlockAt
+      (by simpa [nextFrame] using pappAt)⟩
+
+/-- Advance a compiler running state across scalar unique drop. One unit of
+heap work is consumed, but neither source nor target heap changes. -/
+theorem stepDropUniqueScalar
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {value : RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1) :
+    let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let nextMachine : Machine :=
+      { store := machine.store
+        heapFuel := targetHeapFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.dropU sourceAtom) = .ok (state.sourceStore, .erased) ∧
+        Eval.Step context interpretation machine nextMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let nextMachine : Machine :=
+    { store := machine.store
+      heapFuel := targetHeapFuel
+      control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_dropU_dropUnique_scalar_state
+      (sourceFuel := sourceFuel) state.member descendant traceState state.stores
+      sourceDeclarations sourceResolved scalar heapFuel state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      (.erased :: state.source) :=
+    state.runtime.runOp rfl sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next state.sourceStore
+        (.erased :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.dropU (checked := attached.target)
+      state.member descendant ownership sourceRun
+  have nextImage : attached.SourceStoreImage state.sourceStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := state.sourceStore
+      source := .erased :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, dropAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨nextState, sourceRun,
+    by simpa [nextMachine, nextFrame] using targetStep,
+    fun _rewritten =>
+      StableLiveAcceptedEntry.ofDropUniqueAdvance rfl nextBlockAt
+        (by simpa [nextFrame] using dropAt)⟩
+
+/-- Advance a compiler running state across recursive unique destruction. The
+locally sufficient traversal budget is exposed additively, allowing any
+independently funded suffix to follow the destructive step. -/
+theorem stepDropUnique
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {sourceStore' : IxIR1.Store} {location : Nat}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok (.loc location))
+    (sourceDropped : IxIR1.dropUVal sourceContext sourceFuel
+      state.sourceStore (.loc location) = .ok sourceStore') :
+    ∃ localFuel targetStore,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.dropU sourceAtom) = .ok (sourceStore', .erased) ∧
+        Eval.dropUnique localFuel machine.store (.loc location) =
+          .ok (targetStore, 0) ∧
+        ∀ suffixFuel,
+          let fundedMachine : Machine :=
+            { machine with heapFuel := localFuel + suffixFuel }
+          let nextFrame : Frame :=
+            { state.frame with pc := state.frame.pc + 1 }
+          let nextMachine : Machine :=
+            { store := targetStore
+              heapFuel := suffixFuel
+              control := .running nextFrame state.stack }
+          ∃ _ : CompilerRunningState attached fundedMachine,
+            ∃ _ : CompilerRunningState attached nextMachine,
+              Eval.Step context interpretation fundedMachine nextMachine ∧
+                ∀ rewritten,
+                  StableLiveAcceptedEntry Validate.defaultLimits
+                    attached.target.artifact.validationContext nextMachine
+                      rewritten := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.dropU sourceAtom) index (.dropUnique targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  obtain ⟨localFuel, targetStore, sourceRun, exactDrop, stepForSuffix,
+      nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_dropU_dropUnique_recursive_state_framed
+      state.member descendant traceState state.stores sourceDeclarations
+      sourceResolved sourceDropped state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore'
+      (.erased :: state.source) :=
+    state.runtime.runOp (IxIR1.NoReuse.dropUVal_reuses sourceDropped) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceStore'
+        (.erased :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.dropU (checked := attached.target)
+      state.member descendant ownership sourceRun
+  have nextImage : attached.SourceStoreImage sourceStore' :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  refine ⟨localFuel, targetStore, sourceRun, exactDrop, ?_⟩
+  intro suffixFuel
+  dsimp only
+  let fundedMachine : Machine :=
+    { machine with heapFuel := localFuel + suffixFuel }
+  let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let nextMachine : Machine :=
+    { store := targetStore
+      heapFuel := suffixFuel
+      control := .running nextFrame state.stack }
+  have fundedState : CompilerRunningState attached fundedMachine :=
+    withHeapFuel state (localFuel + suffixFuel)
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceStore'
+      source := .erased :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, dropAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨fundedState, nextState,
+    by
+      simpa [fundedMachine, nextMachine, nextFrame] using
+        stepForSuffix suffixFuel,
+    fun _rewritten =>
+      StableLiveAcceptedEntry.ofDropUniqueAdvance rfl nextBlockAt
+        (by simpa [nextFrame] using dropAt)⟩
+
+/-- Advance a compiler running state across scalar shared release. One unit of
+heap work is consumed, but neither source nor target heap changes. -/
+theorem stepReleaseScalar
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel targetHeapFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {value : RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceAtom = .ok value)
+    (scalar : Eval.RVal.isScalar value = true)
+    (heapFuel : machine.heapFuel = targetHeapFuel + 1) :
+    let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let nextMachine : Machine :=
+      { store := machine.store
+        heapFuel := targetHeapFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.drop sourceAtom) = .ok (state.sourceStore, .erased) ∧
+        Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let nextMachine : Machine :=
+    { store := machine.store
+      heapFuel := targetHeapFuel
+      control := .running nextFrame state.stack }
+  obtain ⟨sourceRun, targetStep, nextStores, nextTraceState⟩ :=
+    attached.simulate_traced_drop_release_scalar_state
+      (sourceFuel := sourceFuel) state.member descendant traceState state.stores
+      sourceDeclarations sourceResolved scalar heapFuel state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      (.erased :: state.source) :=
+    state.runtime.runOp rfl sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next state.sourceStore
+        (.erased :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.drop (checked := attached.target)
+      state.member descendant ownership sourceRun
+  have nextImage : attached.SourceStoreImage state.sourceStore :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := state.sourceStore
+      source := .erased :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  exact ⟨nextState, sourceRun,
+    by simpa [nextMachine, nextFrame] using targetStep⟩
+
+/-- Advance a compiler running state across recursive shared release. The
+local fuel consumed by recursive reclamation is exposed additively, so every
+chosen suffix budget has both a funded predecessor compiler state and a
+successor compiler state with exactly that suffix budget. -/
+theorem stepReleaseShared
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAtom : IxIR1.Atom} {targetAtom : Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {sourceStore' : IxIR1.Store} {location : Nat}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok (.loc location))
+    (sourceDropped : IxIR1.dropVal sourceContext sourceFuel
+      state.sourceStore (.loc location) = .ok sourceStore') :
+    ∃ localFuel targetStore,
+      IxIR1.runOp sourceContext (sourceFuel + 1)
+            state.functionTrace.source state.sourceStore state.source
+              (.drop sourceAtom) = .ok (sourceStore', .erased) ∧
+        Eval.releaseShared localFuel machine.store (.loc location) =
+          .ok (targetStore, 0) ∧
+        ∀ suffixFuel,
+          let fundedMachine : Machine :=
+            { machine with heapFuel := localFuel + suffixFuel }
+          let nextFrame : Frame :=
+            { state.frame with pc := state.frame.pc + 1 }
+          let nextMachine : Machine :=
+            { store := targetStore
+              heapFuel := suffixFuel
+              control := .running nextFrame state.stack }
+          ∃ _ : CompilerRunningState attached fundedMachine,
+            ∃ _ : CompilerRunningState attached nextMachine,
+              Eval.Step context interpretation fundedMachine nextMachine := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.drop sourceAtom) index (.releaseShared targetAtom) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  obtain ⟨localFuel, targetStore, sourceRun, exactRelease, stepForSuffix, nextStores,
+      _, nextTraceState⟩ :=
+    attached.simulate_traced_drop_release_recursive_state_framed
+      (sourceFuel := sourceFuel) state.member descendant traceState
+      state.runtime.positiveSharedRC state.stores sourceDeclarations
+      sourceResolved sourceDropped state.control
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore'
+      (.erased :: state.source) :=
+    state.runtime.runOp (IxIR1.NoReuse.dropVal_reuses sourceDropped) sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceStore'
+        (.erased :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.drop (checked := attached.target)
+      state.member descendant ownership sourceRun
+  have nextImage : attached.SourceStoreImage sourceStore' :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  refine ⟨localFuel, targetStore, sourceRun, exactRelease, ?_⟩
+  intro suffixFuel
+  dsimp only
+  let fundedMachine : Machine :=
+    { machine with heapFuel := localFuel + suffixFuel }
+  let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let nextMachine : Machine :=
+    { store := targetStore
+      heapFuel := suffixFuel
+      control := .running nextFrame state.stack }
+  have fundedState : CompilerRunningState attached fundedMachine :=
+    withHeapFuel state (localFuel + suffixFuel)
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceStore'
+      source := .erased :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := state.historyImmediateOp traceEq sourceDeclarations sourceRun rfl
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  exact ⟨fundedState, nextState, by
+    simpa [fundedMachine, nextMachine, nextFrame] using
+      stepForSuffix suffixFuel⟩
+
+/-- A related running compiler state whose program counter is inside its head
+instruction array must be at a retained source operation node. -/
+theorem traceLetOp_of_pc_lt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    (pc : state.frame.pc < state.trace.headBlock.2.instructions.size) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input nextInput : Lower.Sim.EnvMap) (entryValueCount : Nat)
+        (operation : IxIR1.Op) (index : Nat) (instruction : Instr)
+        (next : Lower.CodeTrace),
+      state.trace = .letOp site blockId input nextInput entryValueCount
+        operation index instruction next := by
+  generalize traceEq : state.trace = trace
+  cases trace with
+  | ret site blockId input entryValueCount sourceAtom targetAtom generated =>
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at pc statePc
+      simp only [Lower.CodeTrace.headBlock, Lower.CodeTrace.entryPc] at pc statePc
+      omega
+  | tailCall site blockId input entryValueCount address arguments generated =>
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at pc statePc
+      simp only [Lower.CodeTrace.headBlock, Lower.CodeTrace.entryPc] at pc statePc
+      omega
+  | tailCallSelf site blockId input entryValueCount arguments generated =>
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at pc statePc
+      simp only [Lower.CodeTrace.headBlock, Lower.CodeTrace.entryPc] at pc statePc
+      omega
+  | letOp site blockId input nextInput entryValueCount operation index
+      instruction next =>
+      exact ⟨site, blockId, input, nextInput, entryValueCount, operation,
+        index, instruction, next, rfl⟩
+  | switchValue site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at pc statePc
+      simp only [Lower.CodeTrace.headBlock, Lower.CodeTrace.entryPc] at pc statePc
+      omega
+
+/-- Recover the exact source operation and checked source/target syntax at a
+concrete instruction of the running target frame. -/
+theorem currentLetOp
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {targetInstruction : Instr}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] = targetInstruction) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input nextInput : Lower.Sim.EnvMap) (entryValueCount : Nat)
+        (operation : IxIR1.Op) (index : Nat) (next : Lower.CodeTrace),
+      state.trace = .letOp site blockId input nextInput entryValueCount
+          operation index targetInstruction next ∧
+        Lower.OperationSyntax input operation targetInstruction := by
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  have headPc : state.frame.pc <
+      state.trace.headBlock.2.instructions.size := by
+    simpa [← blockEq] using pc
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, actualInstruction, next, traceEq⟩ :=
+    state.traceLetOp_of_pc_lt headPc
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        actualInstruction next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        actualInstruction next) state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  obtain ⟨traceBlockAt, _tracePc, traceInstructionAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockEq : block = next.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans traceBlockAt)
+  have targetInstructionAt : next.headBlock.2.instructions[state.frame.pc]? =
+      some targetInstruction := by
+    rw [← nextBlockEq]
+    exact Array.getElem?_eq_some_iff.mpr ⟨pc, instruction⟩
+  have instructionEq : actualInstruction = targetInstruction :=
+    Option.some.inj (traceInstructionAt.symm.trans targetInstructionAt)
+  subst actualInstruction
+  exact ⟨site, blockId, input, nextInput, entryValueCount, operation,
+    index, next, traceEq,
+    state.functionTrace.descendantOperationSyntax descendant⟩
+
+/-- Reconstruct the compiler successor for a concrete target `move`.  The
+checked environment map reflects the resolved target operand back to the
+source `pure`, after which the existing transition supplies both the running
+compiler state and the accepted-entry exclusion for a move-containing block. -/
+theorem stepPureOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetAtom : Atom} {value : RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] = .move targetAtom)
+    (targetResolved : Eval.resolveAtom state.frame.values targetAtom =
+      .ok value) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push value }
+    let nextMachine : Machine :=
+      { machine with control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.move targetAtom) next) state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | pure sourceAtom =>
+      change Lower.InputMap.translateAtom input sourceAtom =
+        some targetAtom at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok value :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount operationSyntax
+            targetResolved
+      obtain ⟨nextState, _sourceRun, targetStep, acceptedEntry⟩ :=
+        state.stepPure (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) traceEq sourceDeclarations
+          sourceResolved
+      exact ⟨nextState, targetStep, acceptedEntry⟩
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Focus the owner consumed by the current checked destruction operation.
+The flat producer trace certifies a successful consume transition; a concrete
+location result rules out its scalar alternative, leaving the exact owner in
+the requested world. -/
+theorem destructionOwnedRoot
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    {world : Ixon.Owned} {sourceAtom : IxIR1.Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount operation index
+        instruction next)
+    (destruction : Lower.destructionSpec? operation =
+      some (world, sourceAtom))
+    {location : Nat}
+    (resolved : IxIR1.resolveAtom state.source sourceAtom =
+      .ok (.loc location)) :
+    ∃ rest : List IxIR1.Sim.Root,
+      IxIR1.Sim.RootOwnership state.sourceStore
+        (⟨world, .loc location⟩ :: rest) := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        instruction next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    attached.target.position state.member nextDescendant
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    attached.target.destructionTransition state.member destruction descendant
+      afterMember afterCoordinate
+  have ownership : Lower.Sim.SourceOwnershipInvariant state.sourceStore
+      state.source input before.sourceCapabilities state.frameRoots := by
+    have selected := state.ownership before beforeMember
+    rw [traceEq] at selected
+    exact selected (by simpa [Lower.CodeTrace.source,
+      Lower.CodeTrace.sourceBlock, Lower.CodeTrace.targetPosition,
+      Lower.CodeTrace.sourceInputMap] using beforeCoordinate)
+  unfold Lower.PositionTrace.destructionResultMatches at transition
+  cases consumedResult : Lower.destructionCapabilities?
+      before.sourceCapabilities input world sourceAtom with
+  | none => simp [consumedResult] at transition
+  | some afterCapabilities =>
+      unfold Lower.destructionCapabilities? at consumedResult
+      cases consumed : Lower.consumeCapability? before.sourceCapabilities
+          input world sourceAtom with
+      | none => simp [consumed] at consumedResult
+      | some remaining =>
+          cases sourceAtom with
+          | lit literal => simp [IxIR1.resolveAtom] at resolved
+          | erased => simp [IxIR1.resolveAtom] at resolved
+          | var sourceIndex =>
+              cases sourceAt : state.source[sourceIndex]? with
+              | none => simp [IxIR1.resolveAtom, sourceAt] at resolved
+              | some sourceValue =>
+                  have sourceValueEq : sourceValue = .loc location := by
+                    simpa [IxIR1.resolveAtom, sourceAt] using resolved
+                  subst sourceValue
+                  cases capabilityAt : before.sourceCapabilities[sourceIndex]?
+                  <;> simp [Lower.consumeCapability?, Lower.sourceCapability?,
+                    capabilityAt] at consumed
+                  case some capability =>
+                    cases capability with
+                    | scalar =>
+                        have scalar := ownership.holds capabilityAt sourceAt
+                        simp [Lower.Sim.CapabilityHolds,
+                          IxIR1.Sim.rvalLocation?] at scalar
+                    | dead => simp at consumed
+                    | borrowed borrowWorld lender => simp at consumed
+                    | owned actualWorld =>
+                        by_cases worldEq : actualWorld = world
+                        · subst actualWorld
+                          obtain ⟨rest, focused, _rootsInRest⟩ :=
+                            ownership.focusOwned capabilityAt sourceAt
+                          exact ⟨rest, focused⟩
+                        · simp [worldEq] at consumed
+
+/-- Reconstruct a compiler transition from the concrete target-side fetch at
+the current trace coordinate. -/
+theorem stepFetchOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetAtom : Atom} {targetCid : CtorId}
+    {field location rc : Nat} {world : Owned} {fields : Array RVal}
+    {value : RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .fetch targetAtom targetCid field)
+    (targetResolved : Eval.resolveAtom state.frame.values targetAtom =
+      .ok (.loc location))
+    (targetGet : machine.store.get? location =
+      some ⟨world, rc, .ctorN targetCid fields⟩)
+    (fieldAt : fields[field]? = some value) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push value }
+    let nextMachine : Machine :=
+      { machine with control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.fetch targetAtom targetCid field) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | fetch sourceAtom sourceField =>
+      change sourceField = field ∧
+        Lower.InputMap.translateAtom input sourceAtom = some targetAtom
+          at operationSyntax
+      obtain ⟨fieldEq, translated⟩ := operationSyntax
+      subst sourceField
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok (.loc location) :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount translated targetResolved
+      have sourceGet : state.sourceStore.get? location =
+          some ⟨world, rc, .ctorN targetCid fields⟩ := by
+        unfold Eval.Store.get? at targetGet
+        rw [state.stores.heap] at targetGet
+        exact targetGet
+      have sourceRun := IxIR1.Sim.runOp_fetch
+        (ctx := sourceContext) (fuel := sourceFuel)
+        (cur := state.functionTrace.source) sourceResolved sourceGet fieldAt
+      obtain ⟨nextState, _sourceRun, targetStep⟩ :=
+        state.stepFetch (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) traceEq sourceDeclarations
+          sourceRun
+      exact ⟨nextState, targetStep⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct a shallow unique-free compiler transition from its concrete
+target runtime case. The lowering environment reflects the selected location
+back to the source `free`; evaluator determinism then identifies the checked
+compiler endpoint with the caller's concrete target endpoint. -/
+theorem stepFreeUniqueOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetAtom : Atom} {targetCid : CtorId}
+    {location : Nat} {box : NodeBox} {fields : Array RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .freeUnique targetAtom targetCid)
+    (targetResolved : Eval.resolveAtom state.frame.values targetAtom =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .unique targetCid box
+      fields)
+    (scalarFields : fields.all RVal.isScalar = true) :
+    let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let nextMachine : Machine :=
+      { machine with
+        store := machine.store.kill location
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.freeUnique targetAtom targetCid) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | free sourceAtom =>
+      change Lower.InputMap.translateAtom input sourceAtom =
+        some targetAtom at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok (.loc location) :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount operationSyntax
+            targetResolved
+      obtain ⟨targetGet, unique, _node⟩ := viewed.parts
+      have sourceGet : state.sourceStore.get? location = some box := by
+        unfold Eval.Store.get? at targetGet
+        rw [state.stores.heap] at targetGet
+        exact targetGet
+      rcases box with ⟨boxWorld, boxRc, boxNode⟩
+      dsimp only at unique
+      subst boxWorld
+      have sourceRun : IxIR1.runOp sourceContext (sourceFuel + 1)
+          state.functionTrace.source state.sourceStore state.source
+            (.free sourceAtom) =
+        .ok (state.sourceStore.kill location, .erased) := by
+        apply IxIR1.Sim.runOp_free sourceResolved
+        exact sourceGet
+      obtain ⟨generatedLocation, outputStoreEq, generatedState,
+          generatedStep, generatedEntry⟩ :=
+        state.stepFreeUnique (context := context)
+          (interpretation := interpretation) traceEq sourceDeclarations
+          sourceRun
+      have concreteStep : Eval.Step context interpretation machine
+          { machine with
+            store := machine.store.kill location
+            control := .running
+              { state.frame with pc := state.frame.pc + 1 } state.stack } :=
+        by
+          simpa only [← state.control] using
+            (InstructionTransferCase.freeUnique
+              (context := context) (interpretation := interpretation)
+              (store := machine.store) (heapFuel := machine.heapFuel)
+              (frame := state.frame) (stack := state.stack)
+              targetResolved viewed scalarFields).step blockAt pc instruction
+      have targetEq := generatedStep.deterministic concreteStep
+      rw [targetEq] at generatedState generatedStep generatedEntry
+      exact ⟨generatedState, generatedStep, generatedEntry⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct a compiler transition from a concrete target shared-retain,
+including the scalar no-op branch. -/
+theorem stepRetainOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetAtom : Atom} {value : RVal} {targetStore : Store}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .retainShared targetAtom)
+    (targetResolved : Eval.resolveAtom state.frame.values targetAtom =
+      .ok value)
+    (retained : Eval.retainShared machine.store value = .ok targetStore) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push value }
+    let nextMachine : Machine :=
+      { store := targetStore
+        heapFuel := machine.heapFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.retainShared targetAtom) next) state.sourceStore state.source
+          state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | dup sourceAtom =>
+      change Lower.InputMap.translateAtom input sourceAtom =
+        some targetAtom at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok value :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount operationSyntax
+            targetResolved
+      cases value with
+      | lit literal =>
+          have storeEq : targetStore = machine.store := by
+            have reverse : machine.store = targetStore := by
+              simpa [Eval.retainShared] using retained
+            exact reverse.symm
+          subst targetStore
+          obtain ⟨nextState, _sourceRun, targetStep⟩ :=
+            state.stepRetainScalar (sourceFuel := sourceFuel)
+              (context := context) (interpretation := interpretation) traceEq
+              sourceDeclarations sourceResolved rfl
+          exact ⟨nextState, targetStep⟩
+      | erased =>
+          have storeEq : targetStore = machine.store := by
+            have reverse : machine.store = targetStore := by
+              simpa [Eval.retainShared] using retained
+            exact reverse.symm
+          subst targetStore
+          obtain ⟨nextState, _sourceRun, targetStep⟩ :=
+            state.stepRetainScalar (sourceFuel := sourceFuel)
+              (context := context) (interpretation := interpretation) traceEq
+              sourceDeclarations sourceResolved rfl
+          exact ⟨nextState, targetStep⟩
+      | loc location =>
+          cases targetGet : machine.store.get? location with
+          | none => simp [Eval.retainShared, targetGet] at retained
+          | some box =>
+              cases boxWorld : box.world with
+              | unique =>
+                  simp [Eval.retainShared, targetGet, boxWorld] at retained
+              | shared =>
+                  have storeEq : targetStore =
+                      (machine.store.setBox location
+                        { box with rc := box.rc + 1 }).rcTick := by
+                    have reverse :
+                        (machine.store.setBox location
+                          { box with rc := box.rc + 1 }).rcTick =
+                            targetStore := by
+                      simpa [Eval.retainShared, targetGet, boxWorld] using
+                        retained
+                    exact reverse.symm
+                  subst targetStore
+                  have sourceGet : state.sourceStore.get? location =
+                      some box := by
+                    unfold Eval.Store.get? at targetGet
+                    rw [state.stores.heap] at targetGet
+                    exact targetGet
+                  obtain ⟨nextState, _sourceRun, targetStep⟩ :=
+                    state.stepRetainShared (sourceFuel := sourceFuel)
+                      (context := context) (interpretation := interpretation)
+                      traceEq sourceDeclarations sourceResolved sourceGet
+                        boxWorld
+                  exact ⟨nextState, targetStep⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField => simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct an arbitrary checked shared release from its concrete target
+runtime result. Scalars are the one-unit no-op case. For a location, the
+producer destruction audit focuses the consumed shared owner, source progress
+constructs a deep drop, and release uniqueness aligns its local budget with
+the target step's actual remaining heap fuel. -/
+theorem stepReleaseOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetAtom : Atom} {value : RVal}
+    {targetStore : Store} {remaining : Nat}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .releaseShared targetAtom)
+    (targetResolved : Eval.resolveAtom state.frame.values targetAtom =
+      .ok value)
+    (released : Eval.releaseShared machine.heapFuel machine.store value =
+      .ok (targetStore, remaining)) :
+    let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let nextMachine : Machine :=
+      { store := targetStore
+        heapFuel := remaining
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.releaseShared targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | drop sourceAtom =>
+      change Lower.InputMap.translateAtom input sourceAtom =
+        some targetAtom at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok value :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount operationSyntax
+            targetResolved
+      cases value with
+      | lit literal =>
+          cases fuelEq : machine.heapFuel with
+          | zero =>
+              simp [fuelEq, Eval.releaseShared, Eval.releaseSharedWork]
+                at released
+          | succ targetHeapFuel =>
+              have outputEq : (machine.store, targetHeapFuel) =
+                  (targetStore, remaining) := by
+                simpa [fuelEq, Eval.releaseShared, Eval.releaseSharedWork]
+                  using released
+              injection outputEq with storeEq remainingEq
+              subst targetStore
+              subst remaining
+              obtain ⟨nextState, _sourceRun, targetStep⟩ :=
+                state.stepReleaseScalar (sourceContext := sourceContext)
+                  (sourceFuel := 0) (context := context)
+                  (interpretation := interpretation) traceEq
+                  sourceDeclarations sourceResolved rfl fuelEq
+              exact ⟨nextState, targetStep⟩
+      | erased =>
+          cases fuelEq : machine.heapFuel with
+          | zero =>
+              simp [fuelEq, Eval.releaseShared, Eval.releaseSharedWork]
+                at released
+          | succ targetHeapFuel =>
+              have outputEq : (machine.store, targetHeapFuel) =
+                  (targetStore, remaining) := by
+                simpa [fuelEq, Eval.releaseShared, Eval.releaseSharedWork]
+                  using released
+              injection outputEq with storeEq remainingEq
+              subst targetStore
+              subst remaining
+              obtain ⟨nextState, _sourceRun, targetStep⟩ :=
+                state.stepReleaseScalar (sourceContext := sourceContext)
+                  (sourceFuel := 0) (context := context)
+                  (interpretation := interpretation) traceEq
+                  sourceDeclarations sourceResolved rfl fuelEq
+              exact ⟨nextState, targetStep⟩
+      | loc location =>
+          obtain ⟨rest, sourceOwned⟩ :=
+            state.destructionOwnedRoot traceEq rfl sourceResolved
+          obtain ⟨sourceFuel, sourceStore', sourceDropped,
+              _nextOwned⟩ :=
+            IxIR1.dropVal_progress (ctx := sourceContext) sourceOwned
+          obtain ⟨localFuel, localStore, _sourceRun, exactLocalRelease,
+              stepForSuffix⟩ :=
+            state.stepReleaseShared (context := context)
+              (interpretation := interpretation) traceEq sourceDeclarations
+              sourceResolved sourceDropped
+          have localWork : Eval.releaseSharedWork localFuel machine.store
+              [.loc location] = .ok (localStore, 0) := by
+            simpa [Eval.releaseShared] using exactLocalRelease
+          have actualWork : Eval.releaseSharedWork machine.heapFuel
+              machine.store [.loc location] = .ok (targetStore, remaining) := by
+            simpa [Eval.releaseShared] using released
+          obtain ⟨storeEq, fuelEq⟩ :=
+            Lower.Sim.releaseSharedWork_success_unique localWork actualWork
+          subst localStore
+          have fundedEq : localFuel + remaining = machine.heapFuel := by
+            simpa using fuelEq
+          obtain ⟨_fundedState, nextState, targetStep⟩ :=
+            stepForSuffix remaining
+          have machineEq : ({ machine with
+              heapFuel := localFuel + remaining } : Machine) = machine := by
+            cases machine
+            simp_all
+          rw [machineEq] at targetStep
+          exact ⟨nextState, targetStep⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct an arbitrary checked unique drop from its concrete target
+runtime result. The proof mirrors shared release: scalar drops consume one
+unit directly, while a focused unique source owner produces an exact local
+traversal whose store and residual budget are fixed by success uniqueness. -/
+theorem stepDropUniqueOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetAtom : Atom} {value : RVal}
+    {targetStore : Store} {remaining : Nat}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .dropUnique targetAtom)
+    (targetResolved : Eval.resolveAtom state.frame.values targetAtom =
+      .ok value)
+    (dropped : Eval.dropUnique machine.heapFuel machine.store value =
+      .ok (targetStore, remaining)) :
+    let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let nextMachine : Machine :=
+      { store := targetStore
+        heapFuel := remaining
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.dropUnique targetAtom) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | dropU sourceAtom =>
+      change Lower.InputMap.translateAtom input sourceAtom =
+        some targetAtom at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok value :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount operationSyntax
+            targetResolved
+      cases value with
+      | lit literal =>
+          cases fuelEq : machine.heapFuel with
+          | zero =>
+              simp [fuelEq, Eval.dropUnique, Eval.dropUniqueWork] at dropped
+          | succ targetHeapFuel =>
+              have outputEq : (machine.store, targetHeapFuel) =
+                  (targetStore, remaining) := by
+                simpa [fuelEq, Eval.dropUnique, Eval.dropUniqueWork]
+                  using dropped
+              injection outputEq with storeEq remainingEq
+              subst targetStore
+              subst remaining
+              obtain ⟨nextState, _sourceRun, targetStep, acceptedEntry⟩ :=
+                state.stepDropUniqueScalar (sourceContext := sourceContext)
+                  (sourceFuel := 0) (context := context)
+                  (interpretation := interpretation) traceEq
+                  sourceDeclarations sourceResolved rfl fuelEq
+              exact ⟨nextState, targetStep, acceptedEntry⟩
+      | erased =>
+          cases fuelEq : machine.heapFuel with
+          | zero =>
+              simp [fuelEq, Eval.dropUnique, Eval.dropUniqueWork] at dropped
+          | succ targetHeapFuel =>
+              have outputEq : (machine.store, targetHeapFuel) =
+                  (targetStore, remaining) := by
+                simpa [fuelEq, Eval.dropUnique, Eval.dropUniqueWork]
+                  using dropped
+              injection outputEq with storeEq remainingEq
+              subst targetStore
+              subst remaining
+              obtain ⟨nextState, _sourceRun, targetStep, acceptedEntry⟩ :=
+                state.stepDropUniqueScalar (sourceContext := sourceContext)
+                  (sourceFuel := 0) (context := context)
+                  (interpretation := interpretation) traceEq
+                  sourceDeclarations sourceResolved rfl fuelEq
+              exact ⟨nextState, targetStep, acceptedEntry⟩
+      | loc location =>
+          obtain ⟨rest, sourceOwned⟩ :=
+            state.destructionOwnedRoot traceEq rfl sourceResolved
+          obtain ⟨sourceFuel, sourceStore', sourceDropped,
+              _nextOwned⟩ :=
+            IxIR1.dropUVal_progress (ctx := sourceContext) sourceOwned
+          obtain ⟨localFuel, localStore, _sourceRun, exactLocalDrop,
+              stepForSuffix⟩ :=
+            state.stepDropUnique (context := context)
+              (interpretation := interpretation) traceEq sourceDeclarations
+              sourceResolved sourceDropped
+          have localWork : Eval.dropUniqueWork localFuel machine.store
+              [.loc location] = .ok (localStore, 0) := by
+            simpa [Eval.dropUnique] using exactLocalDrop
+          have actualWork : Eval.dropUniqueWork machine.heapFuel
+              machine.store [.loc location] = .ok (targetStore, remaining) := by
+            simpa [Eval.dropUnique] using dropped
+          obtain ⟨storeEq, fuelEq⟩ :=
+            Lower.Sim.dropUniqueWork_success_unique localWork actualWork
+          subst localStore
+          have fundedEq : localFuel + remaining = machine.heapFuel := by
+            simpa using fuelEq
+          obtain ⟨_fundedState, nextState, targetStep, acceptedEntry⟩ :=
+            stepForSuffix remaining
+          have machineEq : ({ machine with
+              heapFuel := localFuel + remaining } : Machine) = machine := by
+            cases machine
+            simp_all
+          rw [machineEq] at targetStep
+          exact ⟨nextState, targetStep, acceptedEntry⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct the accepted site's shared release from the concrete target
+transition. Exact producer ownership supplies a successful source drop; the
+release uniqueness law then aligns its synthesized local budget with the
+caller's actual budget and residual suffix. -/
+theorem stepAcceptedReleaseOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = site.shape.releasePosition)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {location remaining : Nat} {targetStore : Store}
+    (targetResolved :
+      Eval.resolveAtom state.frame.values (.reg site.shape.source) =
+        .ok (.loc location))
+    (released :
+      Eval.releaseShared machine.heapFuel machine.store (.loc location) =
+        .ok (targetStore, remaining)) :
+    let nextFrame : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let nextMachine : Machine :=
+      { store := targetStore
+        heapFuel := remaining
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine := by
+  dsimp only
+  have sourceAt := (rewrite.acceptedAt accepted).1
+  have blockAt : state.frame.definition.blocks[state.frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact sourceAt
+  have releaseAt : block.instructions[state.frame.pc]? =
+      some (.releaseShared (.reg site.shape.source)) := by
+    rw [pc]
+    exact site.fits.release
+  obtain ⟨pcBound, instruction⟩ :=
+    Array.getElem?_eq_some_iff.mp releaseAt
+  obtain ⟨traceSite, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pcBound instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp traceSite blockId input nextInput entryValueCount operation index
+        (.releaseShared (.reg site.shape.source)) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | drop sourceAtom =>
+      change Lower.InputMap.translateAtom input sourceAtom =
+        some (.reg site.shape.source) at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+          .ok (.loc location) :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount operationSyntax
+            targetResolved
+      obtain ⟨rest, sourceOwned, _rootsInRest⟩ :=
+        state.acceptedSiteSourceRoot rewrite baselineDefinition accepted
+          (by omega) targetResolved
+      obtain ⟨sourceFuel, sourceStore', sourceDropped, _nextOwned⟩ :=
+        IxIR1.dropVal_progress (ctx := sourceContext) sourceOwned
+      obtain ⟨localFuel, localStore, _sourceRun, exactLocalRelease,
+          stepForSuffix⟩ :=
+        state.stepReleaseShared (context := context)
+          (interpretation := interpretation) traceEq sourceDeclarations
+          sourceResolved sourceDropped
+      have localWork : Eval.releaseSharedWork localFuel machine.store
+          [.loc location] = .ok (localStore, 0) := by
+        simpa [Eval.releaseShared] using exactLocalRelease
+      have actualWork : Eval.releaseSharedWork machine.heapFuel machine.store
+          [.loc location] = .ok (targetStore, remaining) := by
+        simpa [Eval.releaseShared] using released
+      obtain ⟨storeEq, fuelEq⟩ :=
+        Lower.Sim.releaseSharedWork_success_unique localWork actualWork
+      subst localStore
+      have fundedEq : localFuel + remaining = machine.heapFuel := by
+        simpa using fuelEq
+      obtain ⟨_fundedState, nextState, targetStep⟩ :=
+        stepForSuffix remaining
+      have machineEq : ({ machine with heapFuel := localFuel + remaining } :
+          Machine) = machine := by
+        cases machine
+        simp_all
+      rw [machineEq] at targetStep
+      exact ⟨nextState, targetStep⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField => simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Recover the exact retained source return and translated operand from a
+concrete target return coordinate. -/
+theorem currentReturn
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {targetAtom : Atom}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input : Lower.Sim.EnvMap) (entryValueCount : Nat)
+        (sourceAtom : IxIR1.Atom) (generated : Block),
+      state.trace = .ret site blockId input entryValueCount sourceAtom
+          targetAtom generated ∧
+        Lower.InputMap.translateAtom input sourceAtom = some targetAtom := by
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  generalize traceEq : state.trace = trace at blockEq
+  cases trace with
+  | ret site blockId input entryValueCount sourceAtom actualTarget generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.ret site blockId input entryValueCount sourceAtom actualTarget
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.retSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      have targetEq : actualTarget = targetAtom := by injection terminator
+      subst actualTarget
+      exact ⟨site, blockId, input, entryValueCount, sourceAtom, generated,
+        rfl, translated⟩
+  | tailCall site blockId input entryValueCount address sourceArguments
+      generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCall site blockId input entryValueCount address sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.tailCallSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+  | tailCallSelf site blockId input entryValueCount sourceArguments generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCallSelf site blockId input entryValueCount sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.tailCallSelfSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+  | letOp site blockId input nextInput entryValueCount operation index
+      instruction next =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.letOp site blockId input nextInput entryValueCount operation index
+            instruction next) := by
+        rw [← traceEq]
+        exact state.descendant
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at statePc
+      simp only [Lower.CodeTrace.entryPc] at statePc
+      have instructionAt :=
+        (state.functionTrace.descendantLetOpMatch descendant).1.instructionAt
+      have instructionBound :=
+        (Array.getElem?_eq_some_iff.mp instructionAt).1
+      rw [← blockEq] at instructionBound
+      omega
+  | switchValue site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨constructors, natPeel, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.switchSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+
+/-- Recover the exact retained source switch, translated scrutinee, and Nat
+peel-shape agreement from a concrete target switch coordinate. -/
+theorem currentSwitchValue
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors natPeel) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input : Lower.Sim.EnvMap) (entryValueCount : Nat)
+        (sourceScrutinee : IxIR1.Atom) (peelNat : Bool)
+        (alternatives : Array IxIR1.Alt) (generated : Block)
+        (outgoing : List Lower.EdgeTrace) (children : List Lower.CodeTrace),
+      state.trace =
+          .switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing children ∧
+        Lower.InputMap.translateAtom input sourceScrutinee =
+          some targetScrutinee ∧
+        generated.terminator =
+          .switchValue targetScrutinee constructors natPeel ∧
+        peelNat = natPeel.isSome := by
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  generalize traceEq : state.trace = trace at blockEq
+  cases trace with
+  | ret site blockId input entryValueCount sourceAtom targetAtom generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.ret site blockId input entryValueCount sourceAtom targetAtom
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      have emitted := (Lower.CodeTrace.retSyntax_of_match
+        (state.functionTrace.descendantSyntaxMatches descendant)).2
+      rw [blockEq, emitted] at terminator
+      cases terminator
+  | tailCall site blockId input entryValueCount address sourceArguments
+      generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCall site blockId input entryValueCount address sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, _translated, emitted⟩ :=
+        Lower.CodeTrace.tailCallSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, emitted] at terminator
+      cases terminator
+  | tailCallSelf site blockId input entryValueCount sourceArguments generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCallSelf site blockId input entryValueCount sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, _translated, emitted⟩ :=
+        Lower.CodeTrace.tailCallSelfSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, emitted] at terminator
+      cases terminator
+  | letOp site blockId input nextInput entryValueCount operation index
+      instruction next =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.letOp site blockId input nextInput entryValueCount operation index
+            instruction next) := by
+        rw [← traceEq]
+        exact state.descendant
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at statePc
+      simp only [Lower.CodeTrace.entryPc] at statePc
+      have instructionAt :=
+        (state.functionTrace.descendantLetOpMatch descendant).1.instructionAt
+      have instructionBound :=
+        (Array.getElem?_eq_some_iff.mp instructionAt).1
+      rw [← blockEq] at instructionBound
+      omega
+  | switchValue site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives actualScrutinee generated outgoing children =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives actualScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualConstructors, actualNatPeel, translated, emitted⟩ :=
+        Lower.CodeTrace.switchSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, emitted] at terminator
+      have scrutineeEq : actualScrutinee = targetScrutinee := by
+        injection terminator
+      have constructorsEq : actualConstructors = constructors := by
+        injection terminator
+      have natPeelEq : actualNatPeel = natPeel := by
+        injection terminator
+      subst actualScrutinee
+      subst actualConstructors
+      subst actualNatPeel
+      have recursiveMatched :=
+        state.functionTrace.descendantSwitchBranchesMatch descendant
+      have localMatched :=
+        Lower.CodeTrace.switchNodeBranchesMatch_of_match recursiveMatched
+      obtain ⟨_shapeScrutinee, _shapeConstructors, _shapeNatPeel,
+          shapeTerminator, _outgoingLength, _childrenLength, peelShape⟩ :=
+        Lower.switchBranchShape_of_match localMatched
+      have peelEq : peelNat = natPeel.isSome := by
+        have shapeEq := shapeTerminator.symm.trans emitted
+        injection shapeEq with _ _ natEq
+        simpa [natEq] using peelShape
+      exact ⟨site, blockId, input, entryValueCount, sourceScrutinee,
+        peelNat, alternatives, generated, outgoing, children, rfl,
+        translated, emitted, peelEq⟩
+
+/-- Recover the exact retained addressed-tail-call node and its translated
+source arguments from a concrete terminator coordinate. -/
+theorem currentTailCall
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {targetAddress : Ixon.Address}
+    {targetArguments : Array Atom}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .tailCall targetAddress targetArguments) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input : Lower.Sim.EnvMap) (entryValueCount : Nat)
+        (sourceAddress : Ixon.Address)
+        (sourceArguments : Array IxIR1.Atom) (generated : Block),
+      state.trace = .tailCall site blockId input entryValueCount
+          sourceAddress sourceArguments generated ∧
+        sourceAddress = targetAddress ∧
+        Lower.InputMap.translateAtoms input sourceArguments =
+          some targetArguments := by
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  generalize traceEq : state.trace = trace at blockEq
+  cases trace with
+  | ret site blockId input entryValueCount sourceAtom targetAtom generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.ret site blockId input entryValueCount sourceAtom targetAtom
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      have syntaxFacts := Lower.CodeTrace.retSyntax_of_match
+        (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, syntaxFacts.2] at terminator
+      cases terminator
+  | tailCall site blockId input entryValueCount sourceAddress sourceArguments
+      generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCall site blockId input entryValueCount sourceAddress
+            sourceArguments generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.tailCallSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      have addressEq : sourceAddress = targetAddress := by
+        injection terminator
+      have argumentsEq : actualArguments = targetArguments := by
+        injection terminator
+      subst actualArguments
+      exact ⟨site, blockId, input, entryValueCount, sourceAddress,
+        sourceArguments, generated, rfl, addressEq, translated⟩
+  | tailCallSelf site blockId input entryValueCount sourceArguments generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCallSelf site blockId input entryValueCount sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.tailCallSelfSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+  | letOp site blockId input nextInput entryValueCount operation index
+      instruction next =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.letOp site blockId input nextInput entryValueCount operation index
+            instruction next) := by
+        rw [← traceEq]
+        exact state.descendant
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at statePc
+      simp only [Lower.CodeTrace.entryPc] at statePc
+      have instructionAt :=
+        (state.functionTrace.descendantLetOpMatch descendant).1.instructionAt
+      have instructionBound :=
+        (Array.getElem?_eq_some_iff.mp instructionAt).1
+      rw [← blockEq] at instructionBound
+      omega
+  | switchValue site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨constructors, natPeel, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.switchSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+
+/-- Recover the exact retained self-tail-call node and its translated source
+arguments from a concrete terminator coordinate. -/
+theorem currentTailCallSelf
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {targetArguments : Array Atom}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf targetArguments) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input : Lower.Sim.EnvMap) (entryValueCount : Nat)
+        (sourceArguments : Array IxIR1.Atom) (generated : Block),
+      state.trace = .tailCallSelf site blockId input entryValueCount
+          sourceArguments generated ∧
+        Lower.InputMap.translateAtoms input sourceArguments =
+          some targetArguments := by
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  generalize traceEq : state.trace = trace at blockEq
+  cases trace with
+  | ret site blockId input entryValueCount sourceAtom targetAtom generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.ret site blockId input entryValueCount sourceAtom targetAtom
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      have syntaxFacts := Lower.CodeTrace.retSyntax_of_match
+        (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, syntaxFacts.2] at terminator
+      cases terminator
+  | tailCall site blockId input entryValueCount address sourceArguments
+      generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCall site blockId input entryValueCount address sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨target, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.tailCallSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+  | tailCallSelf site blockId input entryValueCount sourceArguments generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCallSelf site blockId input entryValueCount sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨actualArguments, translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.tailCallSelfSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      have argumentsEq : actualArguments = targetArguments := by
+        injection terminator
+      subst actualArguments
+      exact ⟨site, blockId, input, entryValueCount, sourceArguments,
+        generated, rfl, translated⟩
+  | letOp site blockId input nextInput entryValueCount operation index
+      instruction next =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.letOp site blockId input nextInput entryValueCount operation index
+            instruction next) := by
+        rw [← traceEq]
+        exact state.descendant
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at statePc
+      simp only [Lower.CodeTrace.entryPc] at statePc
+      have instructionAt :=
+        (state.functionTrace.descendantLetOpMatch descendant).1.instructionAt
+      have instructionBound :=
+        (Array.getElem?_eq_some_iff.mp instructionAt).1
+      rw [← blockEq] at instructionBound
+      omega
+  | switchValue site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq terminator
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨constructors, natPeel, _translated, generatedTerminator⟩ :=
+        Lower.CodeTrace.switchSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, generatedTerminator] at terminator
+      cases terminator
+
+/-- Recover a terminal source allocation and its immediately following
+self-tail trace from the last concrete target instruction.  This packages the
+structural facts needed by allocation ownership and the focused no-borrow
+audit without requiring callers to reconstruct the recursive trace shape. -/
+theorem currentTerminalAllocation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {targetWorld : Ixon.Owned} {targetCid : CtorId}
+    {targetArguments tailArguments : Array Atom}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (last : state.frame.pc + 1 = block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .alloc targetWorld targetCid targetArguments)
+    (terminator : block.terminator = .tailCallSelf tailArguments) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input nextInput : Lower.Sim.EnvMap) (entryValueCount index : Nat)
+        (sourceWorld : Ixon.Owned) (sourceCid : IxIR1.CtorId)
+        (sourceArguments : Array IxIR1.Atom)
+        (tailSite : Lower.SourceSite) (tailBlockId : BlockId)
+        (tailInput : Lower.Sim.EnvMap) (tailEntryValueCount : Nat)
+        (tailSourceArguments : Array IxIR1.Atom) (generated : Block),
+      state.trace =
+          .letOp site blockId input nextInput entryValueCount
+            (.alloc sourceWorld sourceCid sourceArguments) index
+            (.alloc targetWorld targetCid targetArguments)
+            (.tailCallSelf tailSite tailBlockId tailInput tailEntryValueCount
+              tailSourceArguments generated) ∧
+        sourceWorld = targetWorld ∧
+        Lower.InputMap.translateAtoms input sourceArguments =
+          some targetArguments ∧
+        Lower.InputMap.translateAtoms tailInput tailSourceArguments =
+          some tailArguments := by
+  have pcBound : state.frame.pc < block.instructions.size := by omega
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pcBound instruction
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.alloc targetWorld targetCid targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have letMatch := state.functionTrace.descendantLetOpMatch descendant
+  have nextSyntax :=
+    (Lower.CodeTrace.letOpSyntax_of_match
+      (state.functionTrace.descendantSyntaxMatches descendant)).2
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = next.headBlock.2 := by
+    rw [traceEq] at exactBlock
+    exact Option.some.inj (blockAt.symm.trans exactBlock)
+  have statePc := state.traceState.target.pc
+  rw [traceEq] at statePc
+  simp only [Lower.CodeTrace.entryPc] at statePc
+  have nextTerminalPc : next.entryPc = next.headBlock.2.instructions.size := by
+    calc
+      next.entryPc = index + 1 := letMatch.1.nextPc
+      _ = state.frame.pc + 1 := by rw [statePc]
+      _ = block.instructions.size := last
+      _ = next.headBlock.2.instructions.size := by rw [blockEq]
+  have nextTerminator : next.headBlock.2.terminator =
+      .tailCallSelf tailArguments := by
+    rw [← blockEq]
+    exact terminator
+  obtain ⟨tailSite, tailBlockId, tailInput, tailEntryValueCount,
+      tailSourceArguments, generated, nextEq, tailTranslated⟩ :=
+    next.tailCallSelf_of_terminal nextSyntax letMatch.1.nextInstructions
+      nextTerminalPc nextTerminator
+  subst next
+  cases operation with
+  | alloc sourceWorld sourceCid sourceArguments =>
+      change sourceWorld = targetWorld ∧ sourceCid = targetCid ∧
+        Lower.InputMap.translateAtoms input sourceArguments =
+          some targetArguments at operationSyntax
+      obtain ⟨rfl, rfl, translated⟩ := operationSyntax
+      exact ⟨site, blockId, input, nextInput, entryValueCount, index,
+        sourceWorld, sourceCid, sourceArguments, tailSite, tailBlockId,
+        tailInput, tailEntryValueCount, tailSourceArguments, generated,
+        traceEq, rfl, translated, tailTranslated⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct a checked ordinary allocation from the concrete target
+instruction, reflecting its operand vector back through the compiler's exact
+environment map. -/
+theorem stepAllocOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema} {values : Array RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .alloc world cid arguments)
+    (schemaAt : context.schemas world cid = some schema)
+    (resolved : Eval.resolveAtoms state.frame.values arguments = .ok values) :
+    let node : IxIR1.Node := .ctorN cid values
+    let allocation := machine.store.allocNode world node
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push (.loc allocation.2) }
+    let nextMachine : Machine :=
+      { machine with
+        store := allocation.1
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        (world = .unique →
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten) := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.alloc world cid arguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | alloc sourceWorld sourceCid sourceArguments =>
+      change sourceWorld = world ∧ sourceCid = cid ∧
+        Lower.InputMap.translateAtoms input sourceArguments = some arguments
+          at operationSyntax
+      obtain ⟨worldEq, cidEq, translated⟩ := operationSyntax
+      subst sourceWorld
+      subst sourceCid
+      have atoms := Lower.Sim.atomsRel_of_translateAtoms translated
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceResolved :
+          IxIR1.resolveAtoms state.source sourceArguments =
+            .ok values.toList :=
+        Lower.Sim.resolveAtoms_of_envRel_target
+          traceState.target.environments sourceCount atoms resolved
+      obtain ⟨nextState, _sourceRun, targetStep, acceptedEntry⟩ :=
+        state.stepAlloc (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) contextSchemas traceEq
+          sourceDeclarations sourceResolved schemaAt
+      have locationEq :
+          (state.sourceStore.allocNode world (.ctorN cid values)).2 =
+            (machine.store.allocNode world (.ctorN cid values)).2 := by
+        exact (state.stores.alloc_location world (.ctorN cid values)).symm
+      rw [locationEq] at nextState targetStep acceptedEntry
+      exact ⟨by simpa using nextState, by simpa using targetStep,
+        by simpa using acceptedEntry⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField => simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reconstruct a checked function partial application from the concrete
+target instruction.  Target declaration lookup selects the exact retained
+source callee, while the checked environment map reflects the captured
+arguments back to the source evaluator. -/
+theorem stepPappOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {block : Block} {address : Ixon.Address} {arguments : Array Atom}
+    {values : Array RVal} {definition : Function}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .papp address arguments)
+    (targetDeclaration : context.declarations address = some (.fn definition))
+    (papSafe : definition.signature.papSafe = true)
+    (resolved : Eval.resolveAtoms state.frame.values arguments = .ok values)
+    (under : values.size < definition.signature.params.size) :
+    let allocation := machine.store.allocNode .shared
+      (.papN address definition.signature.params.size values)
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push (.loc allocation.2) }
+    let nextMachine : Machine :=
+      { machine with
+        store := allocation.1
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.papp address arguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | papp sourceAddress sourceArguments =>
+      change sourceAddress = address ∧
+        Lower.InputMap.translateAtoms input sourceArguments = some arguments
+          at operationSyntax
+      obtain ⟨rfl, translated⟩ := operationSyntax
+      obtain ⟨sourceDefinition, calleeTrace, _calleeMember, calleeMatch,
+          sourceDeclaration⟩ :=
+        attached.functionTrace_of_target_declaration sourceDeclarations
+          targetDeclarations targetDeclaration
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have atoms := Lower.Sim.atomsRel_of_translateAtoms translated
+      have sourceResolved :
+          IxIR1.resolveAtoms state.source sourceArguments = .ok values.toList :=
+        Lower.Sim.resolveAtoms_of_envRel_target
+          traceState.target.environments sourceCount atoms resolved
+      have arity : definition.signature.params.size =
+          sourceDefinition.arity := by
+        calc
+          definition.signature.params.size =
+              calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+          _ = calleeTrace.source.arity := calleeTrace.sourceArity
+          _ = sourceDefinition.arity :=
+            congrArg IxIR1.FnDef.arity calleeMatch.source
+      have sourceUnder : values.toList.length < sourceDefinition.arity := by
+        simpa [arity] using under
+      obtain ⟨nextState, _sourceRun, targetStep, acceptedEntry⟩ :=
+        state.stepPapp (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) traceEq sourceDeclarations
+          sourceResolved sourceDeclaration targetDeclaration arity papSafe
+          sourceUnder
+      have locationEq :
+          (state.sourceStore.allocNode .shared
+            (.papN sourceAddress sourceDefinition.arity values)).2 =
+          (machine.store.allocNode .shared
+            (.papN sourceAddress sourceDefinition.arity values)).2 :=
+        (state.stores.alloc_location .shared
+          (.papN sourceAddress sourceDefinition.arity values)).symm
+      rw [locationEq] at nextState targetStep acceptedEntry
+      exact ⟨by simpa [arity] using nextState,
+        by simpa [arity] using targetStep,
+        by simpa [arity] using acceptedEntry⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Reflect the concrete function and argument values of a target dynamic
+application back through the checked lowering environment. -/
+theorem currentApply
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetFunction : Atom}
+    {targetArguments : Array Atom} {function : RVal}
+    {arguments : Array RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .apply targetFunction targetArguments)
+    (functionResolved : Eval.resolveAtom state.frame.values targetFunction =
+      .ok function)
+    (argumentsResolved : Eval.resolveAtoms state.frame.values
+      targetArguments = .ok arguments) :
+    ∃ (site : Lower.SourceSite) (blockId : BlockId)
+        (input nextInput : Lower.Sim.EnvMap) (entryValueCount index : Nat)
+        (sourceFunction : IxIR1.Atom)
+        (sourceArguments : Array IxIR1.Atom) (next : Lower.CodeTrace),
+      state.trace =
+          .letOp site blockId input nextInput entryValueCount
+            (.apply sourceFunction sourceArguments) index
+            (.apply targetFunction targetArguments) next ∧
+        IxIR1.resolveAtom state.source sourceFunction = .ok function ∧
+        IxIR1.resolveAtoms state.source sourceArguments =
+          .ok arguments.toList := by
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | apply sourceFunction sourceArguments =>
+      change Lower.InputMap.translateAtom input sourceFunction =
+          some targetFunction ∧
+        Lower.InputMap.translateAtoms input sourceArguments =
+          some targetArguments at operationSyntax
+      obtain ⟨functionTranslated, argumentsTranslated⟩ := operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have sourceFunctionResolved :
+          IxIR1.resolveAtom state.source sourceFunction = .ok function :=
+        Lower.Sim.resolveAtom_of_envRel_target
+          traceState.target.environments sourceCount functionTranslated
+            functionResolved
+      have atoms := Lower.Sim.atomsRel_of_translateAtoms argumentsTranslated
+      have sourceArgumentsResolved :
+          IxIR1.resolveAtoms state.source sourceArguments =
+            .ok arguments.toList :=
+        Lower.Sim.resolveAtoms_of_envRel_target
+          traceState.target.environments sourceCount atoms argumentsResolved
+      exact ⟨site, blockId, input, nextInput, entryValueCount, index,
+        sourceFunction, sourceArguments, next, traceEq,
+        sourceFunctionResolved, sourceArgumentsResolved⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Focus the exact shared roots consumed at a checked dynamic-application
+coordinate.  The suffix records the surviving source capabilities and framed
+roots, but callers need not inspect it to establish evaluator progress. -/
+theorem applyInputOwnership
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {next : Lower.CodeTrace}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+    {function : RVal} {arguments : List RVal}
+    (functionResolved : IxIR1.resolveAtom state.source sourceFunction =
+      .ok function)
+    (argumentsResolved : IxIR1.resolveAtoms state.source sourceArguments =
+      .ok arguments) :
+    ∃ remaining : Array Lower.BindingCap,
+      IxIR1.Sim.RootOwnership state.sourceStore
+        (⟨.shared, function⟩ :: IxIR1.Sim.rootsFor .shared arguments ++
+          Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+            state.frameRoots) := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  obtain ⟨after, afterMember, afterCoordinate⟩ :=
+    attached.target.position state.member nextDescendant
+  obtain ⟨before, beforeMember, beforeCoordinate, transition⟩ :=
+    attached.target.applyTransition state.member descendant afterMember
+      afterCoordinate
+  unfold Lower.PositionTrace.applyResultMatches at transition
+  unfold Lower.applyCapabilities? at transition
+  cases functionConsumed : Lower.consumeCapability?
+      before.sourceCapabilities input .shared sourceFunction with
+  | none => simp [functionConsumed] at transition
+  | some afterFunction =>
+      simp only [functionConsumed, Option.bind_eq_bind, Option.bind_some]
+        at transition
+      cases argumentsConsumed : Lower.consumeCapabilitiesList? afterFunction
+          input .shared sourceArguments.toList with
+      | none => simp [argumentsConsumed] at transition
+      | some remaining =>
+          have beforeInvariant : Lower.Sim.SourceOwnershipInvariant
+              state.sourceStore state.source input
+                before.sourceCapabilities state.frameRoots :=
+            ownership before beforeMember (by
+              simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+                Lower.CodeTrace.targetPosition,
+                Lower.CodeTrace.sourceInputMap] using beforeCoordinate)
+          exact ⟨remaining, beforeInvariant.applyInputOwnership
+            functionResolved argumentsResolved functionConsumed
+              argumentsConsumed⟩
+
+/-- Checked ownership also makes the common PAP preparation prefix total:
+retain every captured shared value, then release the consumed PAP root with
+some finite source budget. -/
+theorem applyPapPreparation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom} {next : Lower.CodeTrace}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat} {captured : Array RVal}
+    {arguments : List RVal}
+    (functionResolved : IxIR1.resolveAtom state.source sourceFunction =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms state.source sourceArguments =
+      .ok arguments)
+    (sourceGet : state.sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (sourceContext : IxIR1.Ctx) :
+    ∃ sourceFuel sourceRetained sourceReleased,
+      IxIR1.dupVals state.sourceStore captured.toList = .ok sourceRetained ∧
+        IxIR1.dropVal sourceContext sourceFuel sourceRetained
+          (.loc location) = .ok sourceReleased := by
+  obtain ⟨remaining, inputOwnership⟩ :=
+    state.applyInputOwnership traceEq functionResolved argumentsResolved
+  have capturedWorlds : ∀ value ∈ captured.toList,
+      IxIR1.Sim.HasWorld state.sourceStore .shared value := by
+    intro value member
+    have world := inputOwnership.edges_world sourceGet value (by
+      rw [node]
+      simpa [IxIR1.Sim.nodeChildren] using member)
+    simpa [shared] using world
+  obtain ⟨sourceRetained, sourceRetain⟩ :=
+    IxIR1.LowerSim.dupVals_progress_of_hasWorld capturedWorlds
+  have retainedOwnership : IxIR1.Sim.RootOwnership sourceRetained
+      (IxIR1.Sim.rootsFor .shared captured.toList ++
+        ⟨.shared, .loc location⟩ ::
+          IxIR1.Sim.rootsFor .shared arguments ++
+            Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+              state.frameRoots) := by
+    simpa [List.append_assoc] using
+      IxIR1.Sim.dupVals_borrowedMany_preserves inputOwnership
+        capturedWorlds sourceRetain
+  have papFirst : IxIR1.Sim.RootOwnership sourceRetained
+      (⟨.shared, .loc location⟩ ::
+        IxIR1.Sim.rootsFor .shared captured.toList ++
+          IxIR1.Sim.rootsFor .shared arguments ++
+            Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+              state.frameRoots) := by
+    apply retainedOwnership.perm
+    simp [List.append_assoc]
+  obtain ⟨sourceFuel, sourceReleased, sourceRelease,
+      _releasedOwnership⟩ :=
+    IxIR1.dropVal_progress (ctx := sourceContext) papFirst
+  exact ⟨sourceFuel, sourceRetained, sourceReleased, sourceRetain,
+    sourceRelease⟩
+
+/-- Advance a compiler running state across erased dynamic application.
+Releasing the residual shared arguments may consume an input-dependent heap
+budget, so the transition exposes that budget additively and carries any
+independently chosen suffix fuel through the single dispatcher step. -/
+theorem stepApplyErased
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {sourceReleased : IxIR1.Store} {values : List RVal}
+    (functionResolved :
+      IxIR1.resolveAtom state.source sourceFunction = .ok .erased)
+    (argumentsResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (sourceRelease : IxIR1.dropMany sourceContext sourceFuel
+      state.sourceStore values = .ok sourceReleased) :
+    ∃ localFuel targetStore,
+      IxIR1.runOp sourceContext (sourceFuel + 2)
+            state.functionTrace.source state.sourceStore state.source
+              (.apply sourceFunction sourceArguments) =
+          .ok (sourceReleased, .erased) ∧
+        Eval.releaseSharedWork localFuel machine.store values =
+          .ok (targetStore, 0) ∧
+        ∀ suffixFuel,
+          let fundedMachine : Machine :=
+            { machine with heapFuel := localFuel + suffixFuel }
+          let nextFrame : Frame :=
+            { state.frame with
+              pc := state.frame.pc + 1
+              values := state.frame.values.push .erased }
+          let nextMachine : Machine :=
+            { store := targetStore
+              heapFuel := suffixFuel
+              control := .running nextFrame state.stack }
+          ∃ _ : CompilerRunningState attached fundedMachine,
+            ∃ _ : CompilerRunningState attached nextMachine,
+              Eval.Step context interpretation fundedMachine nextMachine ∧
+                ∀ rewritten,
+                  StableLiveAcceptedEntry Validate.defaultLimits
+                    attached.target.artifact.validationContext nextMachine
+                      rewritten := by
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  have sourceRun : IxIR1.runOp sourceContext (sourceFuel + 2)
+      state.functionTrace.source state.sourceStore state.source
+        (.apply sourceFunction sourceArguments) =
+          .ok (sourceReleased, .erased) := by
+    rw [IxIR1.runOp.eq_def]
+    dsimp only
+    rw [functionResolved]
+    simp only [bind, Except.bind]
+    rw [argumentsResolved]
+    simp only
+    rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [sourceRelease]
+    rfl
+  obtain ⟨localFuel, targetStore, targetRelease, nextStores, _⟩ :=
+    Lower.Sim.dropMany_simulates_releaseSharedWork
+      state.runtime.positiveSharedRC state.stores sourceRelease
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      (.erased :: state.source) :=
+    state.runtime.runOp (IxIR1.NoReuse.dropMany_reuses sourceRelease)
+      sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceReleased
+        (.erased :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      state.member descendant ownership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          sourceDeclarations state.image) sourceRun
+  have nextImage : attached.SourceStoreImage sourceReleased :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  refine ⟨localFuel, targetStore, sourceRun, targetRelease, ?_⟩
+  intro suffixFuel
+  dsimp only
+  let fundedMachine : Machine :=
+    { machine with heapFuel := localFuel + suffixFuel }
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push .erased }
+  let nextMachine : Machine :=
+    { store := targetStore
+      heapFuel := suffixFuel
+      control := .running nextFrame state.stack }
+  have fundedState : CompilerRunningState attached fundedMachine :=
+    withHeapFuel state (localFuel + suffixFuel)
+  have fundedControl : fundedMachine.control =
+      .running state.frame state.stack := by
+    simpa [fundedMachine] using state.control
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have transferred : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel .erased values.toArray
+      { state.frame with pc := state.frame.pc + 1 } state.stack nextMachine := by
+    simpa [fundedMachine, nextMachine, nextFrame] using
+      (Eval.ApplyTransfer.erased
+        (context := context) (interpretation := interpretation)
+        (resume := { state.frame with pc := state.frame.pc + 1 })
+        (stack := state.stack) (by simpa using fundedRelease))
+  obtain ⟨targetStep, nextTraceState⟩ :=
+    attached.simulate_traced_apply_transfer_state
+      (machine := fundedMachine) (target := nextMachine) state.member
+      descendant traceState sourceDeclarations functionResolved
+      argumentsResolved sourceRun state.noCredits fundedControl transferred
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceReleased
+      source := .erased :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.historyStepOp traceEq
+        rw [IxIR1.runOp_apply_erased_ctx_eq sourceContext
+          attached.simulationSourceContext _ _ _ _ _ _ functionResolved]
+        exact sourceRun
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, applyAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨fundedState, nextState, by
+    simpa [fundedMachine, nextMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofApplyResume rfl nextBlockAt
+      (by simpa [nextFrame] using applyAt)⟩
+
+/-- Reconstruct erased dynamic application from its concrete target work
+result.  Checked input ownership makes the source argument release total;
+work-list uniqueness then recovers the exact residual target budget. -/
+theorem stepApplyErasedOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetFunction : Atom}
+    {targetArguments : Array Atom} {arguments : Array RVal}
+    {targetStore : Store} {remainingFuel : Nat}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .apply targetFunction targetArguments)
+    (functionResolved : Eval.resolveAtom state.frame.values targetFunction =
+      .ok .erased)
+    (argumentsResolved : Eval.resolveAtoms state.frame.values
+      targetArguments = .ok arguments)
+    (released : Eval.releaseSharedWork machine.heapFuel machine.store
+      arguments.toList = .ok (targetStore, remainingFuel)) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push .erased }
+    let nextMachine : Machine :=
+      { store := targetStore
+        heapFuel := remainingFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, index,
+      sourceFunction, sourceArguments, next, traceEq,
+      sourceFunctionResolved, sourceArgumentsResolved⟩ :=
+    state.currentApply blockAt pc instruction functionResolved
+      argumentsResolved
+  obtain ⟨remaining, inputOwnership⟩ :=
+    state.applyInputOwnership traceEq sourceFunctionResolved
+      sourceArgumentsResolved
+  have argumentOwnership : IxIR1.Sim.RootOwnership state.sourceStore
+      (IxIR1.Sim.rootsFor .shared arguments.toList ++
+        Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+          state.frameRoots) := by
+    exact inputOwnership.dropNoLocation rfl
+  obtain ⟨sourceFuel, sourceReleased, sourceRelease,
+      _releasedOwnership⟩ :=
+    IxIR1.dropMany_progress (ctx := sourceContext)
+      (values := arguments.toList)
+      (rest := Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+        state.frameRoots)
+      (by simpa [List.append_assoc] using argumentOwnership)
+  obtain ⟨localFuel, localStore, _sourceRun, localRelease,
+      stepForSuffix⟩ :=
+    state.stepApplyErased (context := context)
+      (interpretation := interpretation) traceEq sourceDeclarations
+      sourceFunctionResolved sourceArgumentsResolved sourceRelease
+  obtain ⟨_storeEq, fuelEq⟩ :=
+    Lower.Sim.releaseSharedWork_success_unique localRelease released
+  have fundedEq : localFuel + remainingFuel = machine.heapFuel := by
+    simpa using fuelEq
+  obtain ⟨_fundedState, nextState, generatedStep, acceptedEntry⟩ :=
+    stepForSuffix remainingFuel
+  have fundedMachineEq :
+      ({ machine with heapFuel := localFuel + remainingFuel } : Machine) =
+        machine := by
+    cases machine
+    simp_all
+  rw [fundedMachineEq] at generatedStep
+  have concreteTransfer : Eval.ApplyTransfer context interpretation
+      machine.store machine.heapFuel .erased arguments
+      { state.frame with pc := state.frame.pc + 1 } state.stack
+      { store := targetStore
+        heapFuel := remainingFuel
+        control := .running
+          { state.frame with
+            pc := state.frame.pc + 1
+            values := state.frame.values.push .erased }
+          state.stack } :=
+    Eval.ApplyTransfer.erased released
+  have concreteStep : Eval.Step context interpretation machine
+      { store := targetStore
+        heapFuel := remainingFuel
+        control := .running
+          { state.frame with
+            pc := state.frame.pc + 1
+            values := state.frame.values.push .erased }
+          state.stack } :=
+    Eval.Step.applyCleared state.control blockAt pc instruction
+      (by simp [Eval.NoLiveCredits, state.noCredits]) functionResolved
+      argumentsResolved concreteTransfer
+  have targetEq := generatedStep.deterministic concreteStep
+  rw [targetEq] at nextState generatedStep acceptedEntry
+  exact ⟨nextState, generatedStep, acceptedEntry⟩
+
+/-- A compiler running state from the validator-gated attachment cannot be
+positioned at a source extern operation: that boundary rejects externs before
+IxIR₂ lowering. This closes the apparent extern successor case by
+contradiction rather than by assuming an oracle contract. -/
+theorem externImpossible
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.extern sourceAddress sourceArguments) index
+        (.extern targetAddress targetArguments) next) : False := by
+  apply attached.sourceExtern_impossible state.member
+  rw [← traceEq]
+  exact state.descendant
+
+/-- Advance a compiler running state across an under-saturated dynamic PAP
+application. The dispatcher retains the captured values, releases the old PAP,
+allocates the extended PAP, and preserves an arbitrary suffix heap budget. -/
+theorem stepApplyPapUnder
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {sourceRetained sourceReleased : IxIR1.Store}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {values : List RVal}
+    (functionResolved : IxIR1.resolveAtom state.source sourceFunction =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms state.source sourceArguments =
+      .ok values)
+    (sourceGet : state.sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain : IxIR1.dupVals state.sourceStore captured.toList =
+      .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext sourceFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalUnder : (captured.toList ++ values).length < arity) :
+    let pap : IxIR1.Node :=
+      .papN address arity (captured ++ values.toArray)
+    let sourceAllocation := sourceReleased.allocNode .shared pap
+    ∃ localFuel targetRetained targetReleased,
+      IxIR1.runOp sourceContext (sourceFuel + 2)
+            state.functionTrace.source state.sourceStore state.source
+              (.apply sourceFunction sourceArguments) =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) ∧
+        Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Eval.releaseSharedWork localFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        ∀ suffixFuel,
+          let fundedMachine : Machine :=
+            { machine with heapFuel := localFuel + suffixFuel }
+          let nextFrame : Frame :=
+            { state.frame with
+              pc := state.frame.pc + 1
+              values := state.frame.values.push (.loc sourceAllocation.2) }
+          let nextMachine : Machine :=
+            { store := (targetReleased.allocNode .shared pap).1
+              heapFuel := suffixFuel
+              control := .running nextFrame state.stack }
+          ∃ _ : CompilerRunningState attached fundedMachine,
+            ∃ _ : CompilerRunningState attached nextMachine,
+              Eval.Step context interpretation fundedMachine nextMachine ∧
+                ∀ rewritten,
+                  StableLiveAcceptedEntry Validate.defaultLimits
+                    attached.target.artifact.validationContext nextMachine
+                      rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let pap : IxIR1.Node :=
+    .papN address arity (captured ++ values.toArray)
+  let sourceAllocation := sourceReleased.allocNode .shared pap
+  obtain ⟨targetRetained, targetReleased, localFuel, targetRetain,
+      _retainedStores, targetRelease, releasedStores, sourceOperation, _,
+      nextStores, _⟩ :=
+    attached.simulate_traced_apply_pap_under_state
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) state.member descendant traceState
+      state.stores state.runtime.positiveSharedRC sourceDeclarations
+      functionResolved argumentsResolved sourceGet shared node capturedUnder
+      sourceRetain sourceRelease totalUnder state.noCredits state.control
+  have sourceRun : IxIR1.runOp sourceContext (sourceFuel + 2)
+      state.functionTrace.source state.sourceStore state.source
+        (.apply sourceFunction sourceArguments) =
+          .ok (sourceAllocation.1, .loc sourceAllocation.2) := by
+    simpa [sourceAllocation, pap] using sourceOperation
+  have reuseEq : sourceAllocation.1.reuses = state.sourceStore.reuses := by
+    change sourceReleased.reuses = state.sourceStore.reuses
+    exact (IxIR1.NoReuse.dropVal_reuses sourceRelease).trans
+      (IxIR1.NoReuse.dupVals_reuses sourceRetain)
+  have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceAllocation.1
+      (.loc sourceAllocation.2 :: state.source) :=
+    state.runtime.runOp reuseEq sourceRun
+  have nextOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions next sourceAllocation.1
+        (.loc sourceAllocation.2 :: state.source) state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+      state.member descendant ownership
+        (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+          sourceDeclarations state.image) sourceRun
+  have nextImage : attached.SourceStoreImage sourceAllocation.1 :=
+    attached.runOp_preservesSourceStoreImage sourceDeclarations state.member
+      descendant traceState state.image sourceRun
+  have nextDescendant : state.functionTrace.root.Descendant next :=
+    .step descendant (by simp [Lower.CodeTrace.children])
+  let targetAllocation := targetReleased.allocNode .shared pap
+  have locationEq : targetAllocation.2 = sourceAllocation.2 := by
+    exact releasedStores.alloc_location .shared pap
+  refine ⟨localFuel, targetRetained, targetReleased, sourceRun,
+    targetRetain, targetRelease, ?_⟩
+  intro suffixFuel
+  let fundedMachine : Machine :=
+    { machine with heapFuel := localFuel + suffixFuel }
+  let nextFrame : Frame :=
+    { state.frame with
+      pc := state.frame.pc + 1
+      values := state.frame.values.push (.loc sourceAllocation.2) }
+  let nextMachine : Machine :=
+    { store := targetAllocation.1
+      heapFuel := suffixFuel
+      control := .running nextFrame state.stack }
+  have fundedState : CompilerRunningState attached fundedMachine :=
+    withHeapFuel state (localFuel + suffixFuel)
+  have fundedControl : fundedMachine.control =
+      .running state.frame state.stack := by
+    simpa [fundedMachine] using state.control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [state.stores.heap]
+    exact sourceGet
+  have targetUnder : (captured ++ values.toArray).size < arity := by
+    simpa using totalUnder
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have transferred := Eval.ApplyTransfer.papUnder
+    (context := context) (interpretation := interpretation)
+    (resume := { state.frame with pc := state.frame.pc + 1 })
+    (stack := state.stack) targetGet shared node capturedUnder targetRetain
+      fundedRelease targetUnder
+  dsimp only at transferred
+  rw [locationEq] at transferred
+  have transferred' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location) values.toArray
+      { state.frame with pc := state.frame.pc + 1 } state.stack nextMachine := by
+    simpa [fundedMachine, nextMachine, nextFrame, targetAllocation,
+      sourceAllocation, pap] using transferred
+  obtain ⟨targetStep, nextTraceState⟩ :=
+    attached.simulate_traced_apply_transfer_state
+      (machine := fundedMachine) (target := nextMachine) state.member
+      descendant traceState sourceDeclarations functionResolved
+      argumentsResolved sourceRun state.noCredits fundedControl transferred'
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := next
+      sourceStore := sourceAllocation.1
+      source := .loc sourceAllocation.2 :: state.source
+      frameRoots := state.frameRoots
+      frame := nextFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := by simpa [nextFrame] using nextTraceState
+      stores := by
+        simpa [nextMachine, targetAllocation, sourceAllocation, pap] using
+          nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.historyStepOp traceEq
+        rw [IxIR1.runOp_apply_under_ctx_eq sourceContext
+          attached.simulationSourceContext _ _ _ _ _ _ functionResolved
+          argumentsResolved sourceGet node totalUnder]
+        exact sourceRun
+      image := nextImage
+      control := by rfl
+      noCredits := by simpa [nextFrame] using state.noCredits }
+  obtain ⟨currentBlockAt, _currentPcBound, applyAt⟩ :=
+    traceState.target.instructionAt descendant
+  have nextBlockAt : nextFrame.definition.blocks[nextFrame.block]? =
+      some next.headBlock.2 := by
+    simpa [nextFrame] using currentBlockAt
+  exact ⟨fundedState, nextState, by
+    simpa [fundedMachine, nextMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofApplyResume rfl nextBlockAt
+      (by simpa [nextFrame] using applyAt)⟩
+
+/-- Reconstruct an under-saturated PAP application from the concrete target
+transfer.  Source ownership supplies the retain/release prefix, while
+determinism aligns the newly allocated PAP location with the target result. -/
+theorem stepApplyPapUnderOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block} {targetFunction : Atom}
+    {targetArguments : Array Atom} {arguments : Array RVal}
+    {location : Nat} {box : NodeBox} {address : Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {retainedStore releasedStore : Store}
+    {remainingFuel : Nat}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .apply targetFunction targetArguments)
+    (functionResolved : Eval.resolveAtom state.frame.values targetFunction =
+      .ok (.loc location))
+    (argumentsResolved : Eval.resolveAtoms state.frame.values
+      targetArguments = .ok arguments)
+    (targetGet : machine.store.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : Eval.RetainSharedMany machine.store captured retainedStore)
+    (released : Eval.releaseSharedWork machine.heapFuel retainedStore
+      [.loc location] = .ok (releasedStore, remainingFuel))
+    (totalUnder : (captured ++ arguments).size < arity) :
+    let allocation := releasedStore.allocNode .shared
+      (.papN address arity (captured ++ arguments))
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := state.frame.pc + 1
+        values := state.frame.values.push (.loc allocation.2) }
+    let nextMachine : Machine :=
+      { store := allocation.1
+        heapFuel := remainingFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, index,
+      sourceFunction, sourceArguments, next, traceEq,
+      sourceFunctionResolved, sourceArgumentsResolved⟩ :=
+    state.currentApply blockAt pc instruction functionResolved
+      argumentsResolved
+  have sourceGet : state.sourceStore.get? location = some box := by
+    have found := targetGet
+    unfold Eval.Store.get? at found
+    rw [state.stores.heap] at found
+    exact found
+  obtain ⟨sourceFuel, sourceRetained, sourceReleased, sourceRetain,
+      sourceRelease⟩ :=
+    state.applyPapPreparation traceEq sourceFunctionResolved
+      sourceArgumentsResolved sourceGet shared node sourceContext
+  have sourceTotalUnder :
+      (captured.toList ++ arguments.toList).length < arity := by
+    simpa using totalUnder
+  obtain ⟨localFuel, generatedRetained, generatedReleased, _sourceRun,
+      generatedRetain, generatedRelease, stepForSuffix⟩ :=
+    state.stepApplyPapUnder (context := context)
+      (interpretation := interpretation) traceEq sourceDeclarations
+      sourceFunctionResolved sourceArgumentsResolved sourceGet shared node
+      capturedUnder sourceRetain sourceRelease sourceTotalUnder
+  have retainedEq : generatedRetained = retainedStore := by
+    unfold Eval.RetainSharedMany at generatedRetain retained
+    rw [generatedRetain] at retained
+    injection retained
+  rw [retainedEq] at generatedRelease
+  obtain ⟨_releasedEq, fuelEq⟩ :=
+    Lower.Sim.releaseSharedWork_success_unique generatedRelease released
+  have fundedEq : localFuel + remainingFuel = machine.heapFuel := by
+    simpa using fuelEq
+  obtain ⟨_fundedState, nextState, generatedStep, acceptedEntry⟩ :=
+    stepForSuffix remainingFuel
+  have fundedMachineEq :
+      ({ machine with heapFuel := localFuel + remainingFuel } : Machine) =
+        machine := by
+    cases machine
+    simp_all
+  rw [fundedMachineEq] at generatedStep
+  have concreteTransfer : Eval.ApplyTransfer context interpretation
+      machine.store machine.heapFuel (.loc location) arguments
+      { state.frame with pc := state.frame.pc + 1 } state.stack
+      (let allocation := releasedStore.allocNode .shared
+        (.papN address arity (captured ++ arguments))
+      { store := allocation.1
+        heapFuel := remainingFuel
+        control := .running
+          { state.frame with
+            pc := state.frame.pc + 1
+            values := state.frame.values.push (.loc allocation.2) }
+          state.stack }) :=
+    Eval.ApplyTransfer.papUnder targetGet shared node capturedUnder retained
+      released totalUnder
+  have concreteStep : Eval.Step context interpretation machine
+      (let allocation := releasedStore.allocNode .shared
+        (.papN address arity (captured ++ arguments))
+      { store := allocation.1
+        heapFuel := remainingFuel
+        control := .running
+          { state.frame with
+            pc := state.frame.pc + 1
+            values := state.frame.values.push (.loc allocation.2) }
+          state.stack }) :=
+    Eval.Step.applyCleared state.control blockAt pc instruction
+      (by simp [Eval.NoLiveCredits, state.noCredits]) functionResolved
+      argumentsResolved concreteTransfer
+  have targetEq := generatedStep.deterministic concreteStep
+  rw [targetEq] at nextState generatedStep acceptedEntry
+  exact ⟨nextState, generatedStep, acceptedEntry⟩
+
+/-- Enter the callee selected by an exactly saturated shared PAP. The
+compiler stack records the suspended dynamic-application site, while one
+common residual capability vector supports both the callee ownership suffix
+and the caller resume frame. -/
+theorem enterApplyPapExact
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+    {calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceRetained sourceReleased : IxIR1.Store}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {values : List RVal}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved : IxIR1.resolveAtom state.source sourceFunction =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms state.source sourceArguments =
+      .ok values)
+    (sourceGet : state.sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain : IxIR1.dupVals state.sourceStore captured.toList =
+      .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalExact : (captured.toList ++ values).length = arity)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let targetTotal := captured ++ values.toArray
+    let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let calleeFrame : Frame :=
+      { definition := targetDefinition, values := targetTotal }
+    ∃ localFuel targetRetained targetReleased,
+      IxIR1.runOp sourceContext (applyFuel + 2)
+            state.functionTrace.source state.sourceStore state.source
+              (.apply sourceFunction sourceArguments) =
+          IxIR1.invoke sourceContext applyFuel address sourceTotal
+            sourceReleased ∧
+        Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Eval.releaseSharedWork localFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        ∀ suffixFuel,
+          let fundedMachine : Machine :=
+            { machine with heapFuel := localFuel + suffixFuel }
+          let calleeMachine : Machine :=
+            { store := targetReleased
+              heapFuel := suffixFuel
+              control := .running calleeFrame
+                (.resume resume :: state.stack) }
+          ∃ _ : CompilerRunningState attached fundedMachine,
+            ∃ _ : CompilerRunningState attached calleeMachine,
+              Eval.Step context interpretation fundedMachine calleeMachine ∧
+                ∀ rewritten,
+                  StableLiveAcceptedEntry Validate.defaultLimits
+                    attached.target.artifact.validationContext calleeMachine
+                      rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have callerOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let sourceTotal := captured.toList ++ values
+  let targetTotal := captured ++ values.toArray
+  let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let calleeFrame : Frame :=
+    { definition := targetDefinition, values := targetTotal }
+  obtain ⟨targetRetained, targetReleased, localFuel, targetRetain,
+      _retainedStores, targetRelease, releasedStores, sourceEquation, _,
+      calleeTraceState, _⟩ :=
+    attached.simulate_traced_apply_pap_saturated_enter_state
+      (sourceFuel := applyFuel) (context := context)
+      (interpretation := interpretation) state.member calleeMember descendant
+      calleeMatch traceState state.stores state.runtime.positiveSharedRC
+      sourceDeclarations functionResolved argumentsResolved sourceGet shared
+      node capturedUnder sourceRetain sourceRelease totalExact papArity
+      sourceDeclaration sourcePapSafe targetDeclaration state.noCredits
+      state.control
+  have papAt : state.sourceStore.get? location =
+      some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+    simpa only [← shared, ← node] using sourceGet
+  have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+    calc
+      calleeTrace.generated.signature.papSafe =
+          calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have entryArity : sourceTotal.length =
+      calleeTrace.generated.signature.params.size := by
+    calc
+      sourceTotal.length = arity := by
+        simpa [sourceTotal] using totalExact
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+  obtain ⟨remaining, readyOwnership, entryOwnership, suspendedFrame⟩ :=
+    LiveFrameSupportedByRoots.applyPapEntry
+      (checked := attached.target) (sourceContext := sourceContext)
+      (sourceFuel := applyFuel) (supplied := sourceTotal) (residual := [])
+      state.member calleeMember descendant callerOwnership functionResolved
+      argumentsResolved papAt sourceRetain sourceRelease
+      (by simp [sourceTotal]) entryArity calleePapSafe traceState.target
+      state.noCredits
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+      state.frameRoots
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+      sourceTotal.reverse suspendedRoots := by
+    simpa [suspendedRoots, IxIR1.Sim.rootsFor] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      sourceTotal.reverse :=
+    Lower.Sim.SourceRuntimeInvariant.sharedEntry
+      ((state.runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+      ((state.runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease)
+      (by simpa [suspendedRoots, IxIR1.Sim.rootsFor, List.append_assoc] using
+        readyOwnership)
+  have retainedImage : attached.SourceStoreImage sourceRetained :=
+    attached.dupVals_preservesSourceStoreImage state.image sourceRetain
+  have calleeImage : attached.SourceStoreImage sourceReleased :=
+    attached.dropVal_preservesSourceStoreImage sourceDeclarations retainedImage
+      sourceRelease
+  have suspendedFrame' : LiveFrameSupportedByRoots suspendedRoots resume :=
+    suspendedFrame.mono (fun root member =>
+      List.mem_append_left state.frameRoots member)
+  have oldStack : LiveStackSupportedByRoots suspendedRoots state.stack :=
+    state.stackRoots.mono (fun root member =>
+      List.mem_append_right
+        (Lower.Sim.rootsForCapabilities remaining.toList state.source) member)
+  have calleeStack : LiveStackSupportedByRoots suspendedRoots
+      (.resume resume :: state.stack) :=
+    .cons (.resume suspendedFrame') oldStack
+  refine ⟨localFuel, targetRetained, targetReleased, sourceEquation,
+    targetRetain, targetRelease, ?_⟩
+  intro suffixFuel
+  let fundedMachine : Machine :=
+    { machine with heapFuel := localFuel + suffixFuel }
+  let calleeMachine : Machine :=
+    { store := targetReleased
+      heapFuel := suffixFuel
+      control := .running calleeFrame (.resume resume :: state.stack) }
+  have fundedState : CompilerRunningState attached fundedMachine :=
+    withHeapFuel state (localFuel + suffixFuel)
+  have fundedControl : fundedMachine.control =
+      .running state.frame state.stack := by
+    simpa [fundedMachine] using state.control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [state.stores.heap]
+    exact sourceGet
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have totalArrayEq : sourceTotal.toArray = targetTotal := by
+    apply Array.toList_inj.mp
+    simp [sourceTotal, targetTotal]
+  have targetSize : targetTotal.size = arity := by
+    simpa [sourceTotal, targetTotal] using totalExact
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = true := calleePapSafe
+  have targetParamArity : targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have suppliedEq : targetTotal.extract 0 arity = targetTotal := by
+    rw [← targetSize]
+    exact Array.extract_size
+  have suppliedArity : (targetTotal.extract 0 arity).size =
+      targetDefinition.signature.params.size := by
+    rw [suppliedEq, targetSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have transferred := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := state.stack) targetGet shared node
+      capturedUnder targetRetain fundedRelease
+      (by simpa [targetTotal] using Nat.le_of_eq targetSize.symm)
+      targetDeclaration targetPapSafe suppliedArity targetNonempty
+  dsimp only at transferred
+  have remainingEmpty :
+      (targetTotal.extract arity targetTotal.size).isEmpty = true := by
+    simp [Array.isEmpty, Array.size_extract]
+    omega
+  rw [suppliedEq, remainingEmpty] at transferred
+  simp only [if_true] at transferred
+  have transferred' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location) values.toArray
+      resume state.stack calleeMachine := by
+    simpa [fundedMachine, calleeMachine, calleeFrame, sourceTotal,
+      targetTotal] using transferred
+  obtain ⟨targetStep, _⟩ :=
+    Lower.Sim.simulate_traced_apply_transfer_state descendant traceState.target
+      functionResolved argumentsResolved state.noCredits fundedControl
+      transferred'
+  have calleeState : CompilerRunningState attached calleeMachine :=
+    { functionTrace := calleeTrace
+      trace := calleeTrace.root
+      sourceStore := sourceReleased
+      source := sourceTotal.reverse
+      frameRoots := suspendedRoots
+      frame := calleeFrame
+      stack := .resume resume :: state.stack
+      member := calleeMember
+      descendant := .refl
+      traceState := by
+        simpa [sourceTotal, targetTotal, calleeFrame] using calleeTraceState
+      stores := by simpa [calleeMachine] using releasedStores
+      runtime := calleeRuntime
+      ownership := calleeOwnership
+      stackRoots := calleeStack
+      callStack := .applyExact state.member descendant traceState state.runtime
+        callerOwnership state.stackRoots state.image state.noCredits
+        state.callStack
+      history := by
+        simp only [CompilerStackHistory]
+        refine ⟨?_, ?_⟩
+        · rintro out ⟨bodyFuel, bodyRun⟩ world
+          simp only [CompilerStackCompletion, CompilerStackReturn]
+          have bodyRun' : IxIR1.runCode attached.simulationSourceContext
+              bodyFuel sourceDefinition sourceReleased sourceTotal.reverse
+                sourceDefinition.body = .ok out := by
+            simpa only [calleeTrace.rootSourceCode, calleeMatch.source] using bodyRun
+          have world' : IxIR1.Sim.HasWorld out.1 sourceDefinition.result out.2 := by
+            simpa only [calleeMatch.source] using world
+          have canonicalDeclaration : attached.simulationSourceContext.decls
+              address = some (.fn sourceDefinition) := by
+            change IxIR1.HPT.programDeclEnv
+              attached.source.lowering.result.artifacts address = _
+            rw [← sourceDeclarations]
+            exact sourceDeclaration
+          have canonicalRelease : IxIR1.dropVal attached.simulationSourceContext
+              applyFuel sourceRetained (.loc location) = .ok sourceReleased := by
+            rw [IxIR1.Sim.dropVal_ctx_eq sourceContext]
+            exact sourceRelease
+          have called := IxIR1.invoke_of_body_run canonicalDeclaration
+            (totalExact.trans papArity) bodyRun' world'
+          obtain ⟨operationFuel, operationRun⟩ :=
+            IxIR1.runOp_apply_exact_of_invoke
+              (current := state.functionTrace.source) functionResolved
+              argumentsResolved sourceGet node sourceRetain canonicalRelease
+              totalExact canonicalDeclaration sourcePapSafe called
+          exact ⟨operationFuel, rfl, operationRun⟩
+        · simpa [traceEq, Lower.CodeTrace.sourceCode] using state.history
+      image := calleeImage
+      control := by rfl
+      noCredits := by rfl }
+  exact ⟨fundedState, calleeState, by
+    simpa [fundedMachine, calleeMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl rfl⟩
+
+/-- Enter the first callee selected by an over-saturated shared PAP.  The
+compiler stack records both the suspended application site and the exact
+residual argument vector observed by `applyMore`; those residual values are
+framed as shared roots around the active callee. -/
+theorem enterApplyPapOver
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {applyFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceFunction : IxIR1.Atom} {targetFunction : Atom}
+    {sourceArguments : Array IxIR1.Atom}
+    {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+    {calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    {sourceRetained sourceReleased : IxIR1.Store}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat}
+    {captured : Array RVal} {values : List RVal}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (functionResolved : IxIR1.resolveAtom state.source sourceFunction =
+      .ok (.loc location))
+    (argumentsResolved : IxIR1.resolveAtoms state.source sourceArguments =
+      .ok values)
+    (sourceGet : state.sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (sourceRetain : IxIR1.dupVals state.sourceStore captured.toList =
+      .ok sourceRetained)
+    (sourceRelease : IxIR1.dropVal sourceContext applyFuel sourceRetained
+      (.loc location) = .ok sourceReleased)
+    (totalOver : arity < (captured.toList ++ values).length)
+    (papArity : arity = sourceDefinition.arity)
+    (sourceDeclaration :
+      sourceContext.decls address = some (.fn sourceDefinition))
+    (sourcePapSafe : sourceDefinition.papSafe = true)
+    (targetDeclaration :
+      context.declarations address = some (.fn targetDefinition)) :
+    let sourceTotal := captured.toList ++ values
+    let sourceSupplied := sourceTotal.take arity
+    let sourceRemaining := sourceTotal.drop arity
+    let targetTotal := captured ++ values.toArray
+    let targetSupplied := targetTotal.extract 0 arity
+    let targetRemaining := targetTotal.extract arity targetTotal.size
+    let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let calleeFrame : Frame :=
+      { definition := targetDefinition, values := targetSupplied }
+    ∃ localFuel targetRetained targetReleased,
+      IxIR1.runOp sourceContext (applyFuel + 2)
+            state.functionTrace.source state.sourceStore state.source
+              (.apply sourceFunction sourceArguments) =
+          (do
+            let (nextStore, result) ←
+              IxIR1.invoke sourceContext applyFuel address sourceSupplied
+                sourceReleased
+            IxIR1.applyGo sourceContext applyFuel nextStore result
+              sourceRemaining) ∧
+        Eval.RetainSharedMany machine.store captured targetRetained ∧
+        Eval.releaseSharedWork localFuel targetRetained [.loc location] =
+          .ok (targetReleased, 0) ∧
+        ∀ suffixFuel,
+          let fundedMachine : Machine :=
+            { machine with heapFuel := localFuel + suffixFuel }
+          let calleeMachine : Machine :=
+            { store := targetReleased
+              heapFuel := suffixFuel
+              control := .running calleeFrame
+                (.applyMore targetRemaining resume :: state.stack) }
+          ∃ _ : CompilerRunningState attached fundedMachine,
+            ∃ _ : CompilerRunningState attached calleeMachine,
+              Eval.Step context interpretation fundedMachine calleeMachine ∧
+                ∀ rewritten,
+                  StableLiveAcceptedEntry Validate.defaultLimits
+                    attached.target.artifact.validationContext calleeMachine
+                      rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have callerOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.apply sourceFunction sourceArguments) index
+        (.apply targetFunction targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let sourceTotal := captured.toList ++ values
+  let sourceSupplied := sourceTotal.take arity
+  let sourceRemaining := sourceTotal.drop arity
+  let targetTotal := captured ++ values.toArray
+  let targetSupplied := targetTotal.extract 0 arity
+  let targetRemaining := targetTotal.extract arity targetTotal.size
+  let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let calleeFrame : Frame :=
+    { definition := targetDefinition, values := targetSupplied }
+  obtain ⟨targetRetained, targetReleased, localFuel, targetRetain,
+      _retainedStores, targetRelease, releasedStores, sourceEquation, _,
+      remainingEq, calleeTraceState, _⟩ :=
+    attached.simulate_traced_apply_pap_over_enter_state
+      (sourceFuel := applyFuel) (context := context)
+      (interpretation := interpretation) state.member calleeMember descendant
+      calleeMatch traceState state.stores state.runtime.positiveSharedRC
+      sourceDeclarations functionResolved argumentsResolved sourceGet shared
+      node capturedUnder sourceRetain sourceRelease totalOver papArity
+      sourceDeclaration sourcePapSafe targetDeclaration state.noCredits
+      state.control
+  change targetRemaining.toList = sourceRemaining at remainingEq
+  change attached.sidecars.TraceStateRel calleeTrace calleeTrace.root
+    sourceReleased sourceSupplied.reverse calleeFrame at calleeTraceState
+  have papAt : state.sourceStore.get? location =
+      some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+    simpa only [← shared, ← node] using sourceGet
+  have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+    calc
+      calleeTrace.generated.signature.papSafe =
+          calleeTrace.source.papSafe := calleeTrace.sourcePapSafe
+      _ = sourceDefinition.papSafe := congrArg IxIR1.FnDef.papSafe
+        calleeMatch.source
+      _ = true := sourcePapSafe
+  have suppliedLength : sourceSupplied.length = arity := by
+    have bound : arity ≤ sourceTotal.length := by
+      simpa [sourceTotal] using Nat.le_of_lt totalOver
+    simp [sourceSupplied, bound]
+  have entryArity : sourceSupplied.length =
+      calleeTrace.generated.signature.params.size := by
+    calc
+      sourceSupplied.length = arity := suppliedLength
+      _ = sourceDefinition.arity := papArity
+      _ = calleeTrace.source.arity := by rw [calleeMatch.source]
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+  obtain ⟨remaining, readyOwnership, entryOwnership, suspendedFrame⟩ :=
+    LiveFrameSupportedByRoots.applyPapEntry
+      (checked := attached.target) (sourceContext := sourceContext)
+      (sourceFuel := applyFuel) (supplied := sourceSupplied)
+      (residual := sourceRemaining) state.member calleeMember descendant
+      callerOwnership functionResolved argumentsResolved papAt sourceRetain
+      sourceRelease (by simp [sourceTotal, sourceSupplied, sourceRemaining])
+      entryArity calleePapSafe traceState.target state.noCredits
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+      state.frameRoots
+  let calleeRoots : List IxIR1.Sim.Root :=
+    IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+      sourceSupplied.reverse calleeRoots := by
+    simpa [calleeRoots, suspendedRoots] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+      sourceSupplied.reverse :=
+    Lower.Sim.SourceRuntimeInvariant.sharedEntry
+      ((state.runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+      ((state.runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease)
+      (by
+        simpa [calleeRoots, suspendedRoots, IxIR1.Sim.rootsFor,
+          List.append_assoc] using readyOwnership)
+  have retainedImage : attached.SourceStoreImage sourceRetained :=
+    attached.dupVals_preservesSourceStoreImage state.image sourceRetain
+  have calleeImage : attached.SourceStoreImage sourceReleased :=
+    attached.dropVal_preservesSourceStoreImage sourceDeclarations retainedImage
+      sourceRelease
+  have suspendedFrame' : LiveFrameSupportedByRoots suspendedRoots resume :=
+    suspendedFrame.mono (fun root member =>
+      List.mem_append_left state.frameRoots member)
+  have callerFrameSupported : LiveFrameSupportedByRoots calleeRoots resume :=
+    suspendedFrame'.mono (fun root member =>
+      List.mem_append_right (IxIR1.Sim.rootsFor .shared sourceRemaining) member)
+  have residualSupported : ∀ value ∈ targetRemaining.toList,
+      ValueSupportedByRoots calleeRoots value := by
+    intro value member
+    have sourceMember : value ∈ sourceRemaining := by
+      exact remainingEq ▸ member
+    cases value with
+    | loc location =>
+        exact ⟨.shared, List.mem_append_left suspendedRoots (by
+          simp [IxIR1.Sim.rootsFor, sourceMember])⟩
+    | lit literal => trivial
+    | erased => trivial
+  have oldStack : LiveStackSupportedByRoots calleeRoots state.stack :=
+    state.stackRoots.mono (fun root member =>
+      List.mem_append_right (IxIR1.Sim.rootsFor .shared sourceRemaining)
+        (List.mem_append_right
+          (Lower.Sim.rootsForCapabilities remaining.toList state.source)
+          member))
+  have calleeStack : LiveStackSupportedByRoots calleeRoots
+      (.applyMore targetRemaining resume :: state.stack) :=
+    .cons (.applyMore residualSupported callerFrameSupported) oldStack
+  refine ⟨localFuel, targetRetained, targetReleased, sourceEquation,
+    targetRetain, targetRelease, ?_⟩
+  intro suffixFuel
+  let fundedMachine : Machine :=
+    { machine with heapFuel := localFuel + suffixFuel }
+  let calleeMachine : Machine :=
+    { store := targetReleased
+      heapFuel := suffixFuel
+      control := .running calleeFrame
+        (.applyMore targetRemaining resume :: state.stack) }
+  have fundedState : CompilerRunningState attached fundedMachine :=
+    withHeapFuel state (localFuel + suffixFuel)
+  have fundedControl : fundedMachine.control =
+      .running state.frame state.stack := by
+    simpa [fundedMachine] using state.control
+  have targetGet : fundedMachine.store.get? location = some box := by
+    unfold Eval.Store.get?
+    rw [state.stores.heap]
+    exact sourceGet
+  have fundedRelease := Lower.Sim.releaseSharedWork_add_suffix
+    (suffix := suffixFuel) targetRelease
+  have targetOver : arity < targetTotal.size := by
+    simpa [sourceTotal, targetTotal] using totalOver
+  have targetPapSafe : targetDefinition.signature.papSafe = true := by
+    calc
+      targetDefinition.signature.papSafe =
+          calleeTrace.generated.signature.papSafe := by
+            rw [calleeMatch.generated]
+      _ = true := calleePapSafe
+  have targetParamArity : targetDefinition.signature.params.size = arity := by
+    calc
+      targetDefinition.signature.params.size =
+          calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+      _ = calleeTrace.source.arity := calleeTrace.sourceArity
+      _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+        calleeMatch.source
+      _ = arity := papArity.symm
+  have targetSuppliedSize : targetSupplied.size = arity := by
+    simp [targetSupplied, Array.size_extract]
+    omega
+  have targetSuppliedArity : targetSupplied.size =
+      targetDefinition.signature.params.size := by
+    rw [targetSuppliedSize, targetParamArity]
+  have targetNonempty : targetDefinition.blocks.isEmpty = false := by
+    simpa [calleeMatch.generated] using calleeTrace.generatedNonempty
+  have transferred := Eval.ApplyTransfer.papFn
+    (context := context) (interpretation := interpretation)
+    (resume := resume) (stack := state.stack) targetGet shared node
+      capturedUnder targetRetain fundedRelease (Nat.le_of_lt targetOver)
+      targetDeclaration targetPapSafe targetSuppliedArity targetNonempty
+  dsimp only at transferred
+  have remainingNonempty : targetRemaining.isEmpty = false := by
+    simp [targetRemaining, Array.isEmpty, Array.size_extract]
+    omega
+  rw [remainingNonempty] at transferred
+  have transferred' : Eval.ApplyTransfer context interpretation
+      fundedMachine.store fundedMachine.heapFuel (.loc location) values.toArray
+      resume state.stack calleeMachine := by
+    simpa [fundedMachine, calleeMachine, calleeFrame, targetTotal,
+      targetSupplied, targetRemaining] using transferred
+  obtain ⟨targetStep, _⟩ :=
+    Lower.Sim.simulate_traced_apply_transfer_state descendant traceState.target
+      functionResolved argumentsResolved state.noCredits fundedControl
+      transferred'
+  have calleeState : CompilerRunningState attached calleeMachine :=
+    { functionTrace := calleeTrace
+      trace := calleeTrace.root
+      sourceStore := sourceReleased
+      source := sourceSupplied.reverse
+      frameRoots := calleeRoots
+      frame := calleeFrame
+      stack := .applyMore targetRemaining resume :: state.stack
+      member := calleeMember
+      descendant := .refl
+      traceState := calleeTraceState
+      stores := by simpa [calleeMachine] using releasedStores
+      runtime := calleeRuntime
+      ownership := calleeOwnership
+      stackRoots := calleeStack
+      callStack := .applyMore state.member descendant traceState state.runtime
+        callerOwnership state.stackRoots state.image state.noCredits
+        suspendedFrame remainingEq (remaining := remaining) state.callStack
+      history := by
+        simp only [CompilerStackHistory]
+        refine ⟨?_, ?_⟩
+        · rintro out ⟨bodyFuel, bodyRun⟩ world
+          simp only [CompilerStackCompletion]
+          have bodyRun' : IxIR1.runCode attached.simulationSourceContext
+              bodyFuel sourceDefinition sourceReleased sourceSupplied.reverse
+                sourceDefinition.body = .ok out := by
+            simpa only [calleeTrace.rootSourceCode, calleeMatch.source] using bodyRun
+          have world' : IxIR1.Sim.HasWorld out.1 sourceDefinition.result out.2 := by
+            simpa only [calleeMatch.source] using world
+          have canonicalDeclaration : attached.simulationSourceContext.decls
+              address = some (.fn sourceDefinition) := by
+            change IxIR1.HPT.programDeclEnv
+              attached.source.lowering.result.artifacts address = _
+            rw [← sourceDeclarations]
+            exact sourceDeclaration
+          have canonicalRelease : IxIR1.dropVal attached.simulationSourceContext
+              applyFuel sourceRetained (.loc location) = .ok sourceReleased := by
+            rw [IxIR1.Sim.dropVal_ctx_eq sourceContext]
+            exact sourceRelease
+          have called := IxIR1.invoke_of_body_run canonicalDeclaration
+            (suppliedLength.trans papArity) bodyRun' world'
+          intro residualFuel final residualRun
+          obtain ⟨operationFuel, operationRun⟩ :=
+            IxIR1.runOp_apply_over_of_invoke
+              (current := state.functionTrace.source) functionResolved
+              argumentsResolved sourceGet node sourceRetain canonicalRelease
+              totalOver canonicalDeclaration sourcePapSafe called residualRun
+          exact ⟨operationFuel + 1, operationRun⟩
+        · simpa [traceEq, Lower.CodeTrace.sourceCode] using state.history
+      image := calleeImage
+      control := by rfl
+      noCredits := by rfl }
+  exact ⟨fundedState, calleeState, targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl rfl⟩
+
+/-- Reconstruct every concrete dynamic-application transfer.  Erased and
+under-saturated cases resume locally; function PAPs enter either an exact or
+over-saturated callee; extern PAPs are impossible for an attached closed
+program. -/
+theorem stepApplyOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Machine}
+    (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {block : Block} {targetFunction : Atom}
+    {targetArguments : Array Atom} {function : RVal}
+    {arguments : Array RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .apply targetFunction targetArguments)
+    (functionResolved : Eval.resolveAtom state.frame.values targetFunction =
+      .ok function)
+    (argumentsResolved : Eval.resolveAtoms state.frame.values
+      targetArguments = .ok arguments)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel function arguments
+      { state.frame with pc := state.frame.pc + 1 } state.stack target) :
+    ∃ _ : CompilerRunningState attached target,
+      Eval.Step context interpretation machine target ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext target rewritten := by
+  have noCredits : Eval.NoLiveCredits state.frame := by
+    simp [Eval.NoLiveCredits, state.noCredits]
+  have concreteStep : Eval.Step context interpretation machine target :=
+    Eval.Step.applyCleared state.control blockAt pc instruction noCredits
+      functionResolved argumentsResolved transferred
+  cases transferred.classify with
+  | erased released =>
+      exact state.stepApplyErasedOfTarget sourceDeclarations blockAt pc
+        instruction functionResolved argumentsResolved released
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      exact state.stepApplyPapUnderOfTarget sourceDeclarations blockAt pc
+        instruction functionResolved argumentsResolved boxAt shared node
+        capturedUnder retained released totalUnder
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      exact (attached.targetDeclaration_not_extern targetDeclarations
+        declaration).elim
+  | @papFn location box address arity captured retainedStore releasedStore
+      remainingFuel definition boxAt shared node capturedUnder retained
+      released totalEnough declaration papSafe suppliedArity nonempty =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount, index,
+          sourceFunction, sourceArguments, next, traceEq,
+          sourceFunctionResolved, sourceArgumentsResolved⟩ :=
+        state.currentApply blockAt pc instruction functionResolved
+          argumentsResolved
+      have sourceGet : state.sourceStore.get? location = some box := by
+        have found := boxAt
+        unfold Eval.Store.get? at found
+        rw [state.stores.heap] at found
+        exact found
+      obtain ⟨sourceFuel, sourceRetained, sourceReleased, sourceRetain,
+          sourceRelease⟩ :=
+        state.applyPapPreparation traceEq sourceFunctionResolved
+          sourceArgumentsResolved sourceGet shared node sourceContext
+      obtain ⟨sourceDefinition, calleeTrace, calleeMember, calleeMatch,
+          sourceDeclaration⟩ :=
+        attached.functionTrace_of_target_declaration sourceDeclarations
+          targetDeclarations declaration
+      have targetExtractSize :
+          ((captured ++ arguments).extract 0 arity).size = arity := by
+        rw [Array.size_extract, Nat.sub_zero,
+          Nat.min_eq_left totalEnough]
+      have papArity : arity = sourceDefinition.arity := by
+        calc
+          arity = definition.signature.params.size :=
+            targetExtractSize.symm.trans suppliedArity
+          _ = calleeTrace.generated.signature.params.size := by
+            rw [calleeMatch.generated]
+          _ = calleeTrace.source.arity := calleeTrace.sourceArity
+          _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity
+            calleeMatch.source
+      have sourcePapSafe : sourceDefinition.papSafe = true := by
+        calc
+          sourceDefinition.papSafe = calleeTrace.source.papSafe :=
+            congrArg IxIR1.FnDef.papSafe calleeMatch.source.symm
+          _ = calleeTrace.generated.signature.papSafe :=
+            calleeTrace.sourcePapSafe.symm
+          _ = definition.signature.papSafe := by rw [calleeMatch.generated]
+          _ = true := papSafe
+      have sourceEnough : arity ≤
+          (captured.toList ++ arguments.toList).length := by
+        simpa using totalEnough
+      by_cases totalExact :
+          (captured.toList ++ arguments.toList).length = arity
+      · obtain ⟨localFuel, generatedRetained, generatedReleased,
+            _sourceEquation, generatedRetain, generatedRelease,
+            stepForSuffix⟩ :=
+          state.enterApplyPapExact traceEq calleeMember calleeMatch
+            sourceDeclarations sourceFunctionResolved sourceArgumentsResolved
+            sourceGet shared node capturedUnder sourceRetain sourceRelease
+            totalExact papArity sourceDeclaration sourcePapSafe declaration
+        have retainedEq : generatedRetained = retainedStore := by
+          unfold Eval.RetainSharedMany at generatedRetain retained
+          rw [generatedRetain] at retained
+          injection retained
+        rw [retainedEq] at generatedRelease
+        obtain ⟨_releasedEq, fuelEq⟩ :=
+          Lower.Sim.releaseSharedWork_success_unique generatedRelease released
+        have fundedEq : localFuel + remainingFuel = machine.heapFuel := by
+          simpa using fuelEq
+        obtain ⟨_fundedState, nextState, generatedStep, acceptedEntry⟩ :=
+          stepForSuffix remainingFuel
+        have fundedMachineEq :
+            ({ machine with heapFuel := localFuel + remainingFuel } :
+              Machine) = machine := by
+          cases machine
+          simp_all
+        rw [fundedMachineEq] at generatedStep
+        have targetEq := generatedStep.deterministic concreteStep
+        rw [targetEq] at nextState generatedStep acceptedEntry
+        exact ⟨nextState, generatedStep, acceptedEntry⟩
+      · have totalOver : arity <
+            (captured.toList ++ arguments.toList).length := by omega
+        obtain ⟨localFuel, generatedRetained, generatedReleased,
+            _sourceEquation, generatedRetain, generatedRelease,
+            stepForSuffix⟩ :=
+          state.enterApplyPapOver traceEq calleeMember calleeMatch
+            sourceDeclarations sourceFunctionResolved sourceArgumentsResolved
+            sourceGet shared node capturedUnder sourceRetain sourceRelease
+            totalOver papArity sourceDeclaration sourcePapSafe declaration
+        have retainedEq : generatedRetained = retainedStore := by
+          unfold Eval.RetainSharedMany at generatedRetain retained
+          rw [generatedRetain] at retained
+          injection retained
+        rw [retainedEq] at generatedRelease
+        obtain ⟨_releasedEq, fuelEq⟩ :=
+          Lower.Sim.releaseSharedWork_success_unique generatedRelease released
+        have fundedEq : localFuel + remainingFuel = machine.heapFuel := by
+          simpa using fuelEq
+        obtain ⟨_fundedState, nextState, generatedStep, acceptedEntry⟩ :=
+          stepForSuffix remainingFuel
+        have fundedMachineEq :
+            ({ machine with heapFuel := localFuel + remainingFuel } :
+              Machine) = machine := by
+          cases machine
+          simp_all
+        rw [fundedMachineEq] at generatedStep
+        have targetEq := generatedStep.deterministic concreteStep
+        rw [targetEq] at nextState generatedStep acceptedEntry
+        exact ⟨nextState, generatedStep, acceptedEntry⟩
+
+/-- Enter an addressed ordinary call while preserving the full compiler
+running invariant. The checked capability transition supplies both the
+callee's framed roots and semantic support for the newly suspended caller. -/
+theorem enterCall
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace} {sourceAddress targetAddress : Ixon.Address}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+    {calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration sourceAddress) sourceDefinition targetDefinition)
+    (sourceDeclaration : attached.simulationSourceContext.decls
+      sourceAddress = some (.fn sourceDefinition))
+    {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (targetDeclaration : context.declarations sourceAddress =
+      some (.fn targetDefinition)) :
+    let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let calleeFrame : Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    let calleeMachine : Machine :=
+      { machine with
+        control := .running calleeFrame (.resume resume :: state.stack) }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1) state.functionTrace.source
+            state.sourceStore state.source
+              (.call sourceAddress sourceArguments) =
+          IxIR1.invoke sourceContext sourceFuel sourceAddress values
+            state.sourceStore ∧
+        Eval.Step context interpretation machine calleeMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext calleeMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.call sourceAddress sourceArguments) index
+        (.call targetAddress targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let calleeFrame : Frame :=
+    { definition := targetDefinition, values := values.toArray }
+  let calleeMachine : Machine :=
+    { machine with
+      control := .running calleeFrame (.resume resume :: state.stack) }
+  obtain ⟨sourceEquation, targetStep, entryStores, calleeState⟩ :=
+    attached.simulate_traced_call_fn_enter_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      calleeMember descendant calleeMatch traceState state.stores
+      sourceResolved argumentArity targetDeclaration state.noCredits
+      state.control
+  have signatureAt := attached.target.targetSignature calleeMember
+    calleeMatch.owner
+  obtain ⟨callPosition, remaining, callPositionMember,
+      callPositionCoordinate, consumed, noBorrows, entryOwnership⟩ :=
+    Lower.Sim.SourceOwnershipAt.callEntry (checked := attached.target)
+      state.member calleeMember descendant signatureAt ownership sourceResolved
+  have callInvariant : Lower.Sim.SourceOwnershipInvariant state.sourceStore
+      state.source input callPosition.sourceCapabilities state.frameRoots :=
+    ownership callPosition callPositionMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          callPositionCoordinate)
+  have suspendedFrame : LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities remaining.toList state.source)
+      resume := by
+    simpa [resume] using LiveFrameSupportedByRoots.ofCallSuspension
+      state.member signatureAt descendant callPositionMember
+      callPositionCoordinate callInvariant sourceResolved consumed noBorrows
+      traceState.target state.noCredits
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+      state.frameRoots
+  have suspendedFrame' : LiveFrameSupportedByRoots suspendedRoots resume :=
+    suspendedFrame.mono (fun root member =>
+      List.mem_append_left state.frameRoots member)
+  have oldStack : LiveStackSupportedByRoots suspendedRoots state.stack :=
+    state.stackRoots.mono (fun root member =>
+      List.mem_append_right
+        (Lower.Sim.rootsForCapabilities remaining.toList state.source)
+        member)
+  have nextStack : LiveStackSupportedByRoots suspendedRoots
+      (.resume resume :: state.stack) :=
+    .cons (.resume suspendedFrame') oldStack
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root
+      state.sourceStore values.reverse suspendedRoots := by
+    simpa [suspendedRoots] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      values.reverse := state.runtime.resolveAtomsReverse sourceResolved
+  have nextState : CompilerRunningState attached calleeMachine :=
+    { functionTrace := calleeTrace
+      trace := calleeTrace.root
+      sourceStore := state.sourceStore
+      source := values.reverse
+      frameRoots := suspendedRoots
+      frame := calleeFrame
+      stack := .resume resume :: state.stack
+      member := calleeMember
+      descendant := .refl
+      traceState := by simpa [calleeFrame] using calleeState
+      stores := by simpa [calleeMachine] using entryStores
+      runtime := calleeRuntime
+      ownership := calleeOwnership
+      stackRoots := nextStack
+      callStack := .addressed state.member calleeMember calleeMatch descendant
+        traceState state.runtime ownership state.stackRoots state.image
+        state.noCredits sourceResolved signatureAt callPositionMember
+        callPositionCoordinate consumed state.callStack
+      history := by
+        simp only [CompilerStackHistory]
+        refine ⟨?_, ?_⟩
+        · rintro out ⟨bodyFuel, bodyRun⟩ world
+          simp only [CompilerStackCompletion, CompilerStackReturn]
+          have bodyRun' : IxIR1.runCode attached.simulationSourceContext
+              bodyFuel sourceDefinition state.sourceStore values.reverse
+                sourceDefinition.body = .ok out := by
+            simpa only [calleeTrace.rootSourceCode, calleeMatch.source] using bodyRun
+          have world' : IxIR1.Sim.HasWorld out.1 sourceDefinition.result out.2 := by
+            simpa only [calleeMatch.source] using world
+          exact ⟨bodyFuel + 1, rfl, sourceDeclaration,
+            IxIR1.runOp_call_of_body_run sourceResolved sourceDeclaration
+              argumentArity.symm bodyRun' world'⟩
+        · simpa [traceEq, Lower.CodeTrace.sourceCode] using state.history
+      image := state.image
+      control := by rfl
+      noCredits := by rfl }
+  exact ⟨nextState, sourceEquation,
+    by simpa [calleeMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl rfl⟩
+
+/-- Reconstruct addressed call entry from a concrete target instruction.
+The inverse declaration lookup identifies the retained source callee, and
+the checked input map reflects the target argument vector to its source
+counterpart. -/
+theorem enterCallOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {block : Block} {address : Ixon.Address} {arguments : Array Atom}
+    {values : Array RVal} {definition : Function}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .call address arguments)
+    (resolved : Eval.resolveAtoms state.frame.values arguments = .ok values)
+    (targetDeclaration : context.declarations address = some (.fn definition))
+    (arity : values.size = definition.signature.params.size) :
+    let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let calleeFrame : Frame := { definition, values }
+    let calleeMachine : Machine :=
+      { machine with
+        control := .running calleeFrame (.resume resume :: state.stack) }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      Eval.Step context interpretation machine calleeMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext calleeMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.call address arguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | call sourceAddress sourceArguments =>
+      change sourceAddress = address ∧
+        Lower.InputMap.translateAtoms input sourceArguments = some arguments
+          at operationSyntax
+      obtain ⟨rfl, translated⟩ := operationSyntax
+      obtain ⟨sourceDefinition, calleeTrace, calleeMember, calleeMatch,
+          sourceDeclaration⟩ :=
+        attached.functionTrace_of_target_declaration sourceDeclarations
+          targetDeclarations targetDeclaration
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have atoms := Lower.Sim.atomsRel_of_translateAtoms translated
+      have sourceResolved :
+          IxIR1.resolveAtoms state.source sourceArguments = .ok values.toList :=
+        Lower.Sim.resolveAtoms_of_envRel_target
+          traceState.target.environments sourceCount atoms resolved
+      have sourceArity : sourceDefinition.arity = values.toList.length := by
+        calc
+          sourceDefinition.arity = calleeTrace.source.arity :=
+            congrArg IxIR1.FnDef.arity calleeMatch.source.symm
+          _ = calleeTrace.generated.signature.params.size :=
+            calleeTrace.sourceArity.symm
+          _ = definition.signature.params.size := by
+            rw [calleeMatch.generated]
+          _ = values.size := arity.symm
+          _ = values.toList.length := by simp
+      obtain ⟨nextState, _sourceEquation, targetStep, acceptedEntry⟩ :=
+        state.enterCall (sourceContext := sourceContext)
+          (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) traceEq calleeMember calleeMatch
+          (by
+            change IxIR1.HPT.programDeclEnv
+              attached.source.lowering.result.artifacts _ = _
+            rw [← sourceDeclarations]
+            exact sourceDeclaration)
+          sourceResolved sourceArity targetDeclaration
+      exact ⟨by simpa using nextState, by simpa using targetStep,
+        by simpa using acceptedEntry⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | callSelf sourceArguments => simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Enter a recursive ordinary call while preserving the full compiler
+running invariant and adding the supported caller frame to the root suffix. -/
+theorem enterCallSelf
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {next : Lower.CodeTrace}
+    {sourceArguments : Array IxIR1.Atom} {targetArguments : Array Atom}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+    {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (argumentArity : state.functionTrace.source.arity = values.length) :
+    let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let calleeFrame : Frame :=
+      { definition := state.frame.definition, values := values.toArray }
+    let calleeMachine : Machine :=
+      { machine with
+        control := .running calleeFrame (.resume resume :: state.stack) }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      IxIR1.runOp sourceContext (sourceFuel + 1) state.functionTrace.source
+            state.sourceStore state.source (.callSelf sourceArguments) = (do
+          let out ← IxIR1.runCode sourceContext sourceFuel
+            state.functionTrace.source state.sourceStore values.reverse
+              state.functionTrace.source.body
+          IxIR1.checkResultWorld state.functionTrace.source.result out) ∧
+        Eval.Step context interpretation machine calleeMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext calleeMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.letOp site blockId input nextInput entryValueCount
+        (.callSelf sourceArguments) index (.callSelf targetArguments) next)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+  let calleeFrame : Frame :=
+    { definition := state.frame.definition, values := values.toArray }
+  let calleeMachine : Machine :=
+    { machine with
+      control := .running calleeFrame (.resume resume :: state.stack) }
+  obtain ⟨sourceEquation, targetStep, entryStores, calleeState⟩ :=
+    attached.simulate_traced_call_self_enter_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      state.member descendant traceState state.stores sourceResolved
+      argumentArity state.noCredits state.control
+  obtain ⟨callPosition, remaining, callPositionMember,
+      callPositionCoordinate, consumed, noBorrows, entryOwnership⟩ :=
+    Lower.Sim.SourceOwnershipAt.callSelfEntry (checked := attached.target)
+      state.member descendant ownership sourceResolved
+  have callInvariant : Lower.Sim.SourceOwnershipInvariant state.sourceStore
+      state.source input callPosition.sourceCapabilities state.frameRoots :=
+    ownership callPosition callPositionMember (by
+      simpa [Lower.CodeTrace.source, Lower.CodeTrace.sourceBlock,
+        Lower.CodeTrace.targetPosition, Lower.CodeTrace.sourceInputMap] using
+          callPositionCoordinate)
+  have suspendedFrame : LiveFrameSupportedByRoots
+      (Lower.Sim.rootsForCapabilities remaining.toList state.source)
+      resume := by
+    simpa [resume] using LiveFrameSupportedByRoots.ofCallSelfSuspension
+      state.member descendant callPositionMember callPositionCoordinate
+      callInvariant sourceResolved consumed noBorrows traceState.target
+      state.noCredits
+  let suspendedRoots : List IxIR1.Sim.Root :=
+    Lower.Sim.rootsForCapabilities remaining.toList state.source ++
+      state.frameRoots
+  have suspendedFrame' : LiveFrameSupportedByRoots suspendedRoots resume :=
+    suspendedFrame.mono (fun root member =>
+      List.mem_append_left state.frameRoots member)
+  have oldStack : LiveStackSupportedByRoots suspendedRoots state.stack :=
+    state.stackRoots.mono (fun root member =>
+      List.mem_append_right
+        (Lower.Sim.rootsForCapabilities remaining.toList state.source)
+        member)
+  have nextStack : LiveStackSupportedByRoots suspendedRoots
+      (.resume resume :: state.stack) :=
+    .cons (.resume suspendedFrame') oldStack
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions state.functionTrace.root
+      state.sourceStore values.reverse suspendedRoots := by
+    simpa [suspendedRoots] using entryOwnership
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      values.reverse := state.runtime.resolveAtomsReverse sourceResolved
+  have nextState : CompilerRunningState attached calleeMachine :=
+    { functionTrace := state.functionTrace
+      trace := state.functionTrace.root
+      sourceStore := state.sourceStore
+      source := values.reverse
+      frameRoots := suspendedRoots
+      frame := calleeFrame
+      stack := .resume resume :: state.stack
+      member := state.member
+      descendant := .refl
+      traceState := by simpa [calleeFrame] using calleeState
+      stores := by simpa [calleeMachine] using entryStores
+      runtime := calleeRuntime
+      ownership := calleeOwnership
+      stackRoots := nextStack
+      callStack := .self state.member descendant traceState state.runtime
+        ownership state.stackRoots state.image state.noCredits sourceResolved
+        callPositionMember callPositionCoordinate consumed state.callStack
+      history := by
+        simp only [CompilerStackHistory]
+        refine ⟨?_, ?_⟩
+        · rintro out ⟨bodyFuel, bodyRun⟩ world
+          simp only [CompilerStackCompletion, CompilerStackReturn]
+          have bodyRun' : IxIR1.runCode attached.simulationSourceContext
+              bodyFuel state.functionTrace.source state.sourceStore values.reverse
+                state.functionTrace.source.body = .ok out := by
+            simpa only [state.functionTrace.rootSourceCode] using bodyRun
+          exact ⟨bodyFuel, rfl, IxIR1.runOp_callSelf_of_body_run sourceResolved
+            argumentArity.symm bodyRun' world⟩
+        · simpa [traceEq, Lower.CodeTrace.sourceCode] using state.history
+      image := state.image
+      control := by rfl
+      noCredits := by rfl }
+  exact ⟨nextState, sourceEquation,
+    by simpa [calleeMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl rfl⟩
+
+/-- Reconstruct recursive ordinary-call entry from a concrete target
+instruction and its resolved argument vector. -/
+theorem enterCallSelfOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {arguments : Array Atom} {values : Array RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instruction : block.instructions[state.frame.pc] =
+      .callSelf arguments)
+    (resolved : Eval.resolveAtoms state.frame.values arguments = .ok values)
+    (arity : values.size = state.frame.definition.signature.params.size) :
+    let resume : Frame := { state.frame with pc := state.frame.pc + 1 }
+    let calleeFrame : Frame :=
+      { definition := state.frame.definition, values }
+    let calleeMachine : Machine :=
+      { machine with
+        control := .running calleeFrame (.resume resume :: state.stack) }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      Eval.Step context interpretation machine calleeMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext calleeMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, nextInput, entryValueCount, operation,
+      index, next, traceEq, operationSyntax⟩ :=
+    state.currentLetOp blockAt pc instruction
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.letOp site blockId input nextInput entryValueCount operation index
+        (.callSelf arguments) next)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  cases operation with
+  | callSelf sourceArguments =>
+      change Lower.InputMap.translateAtoms input sourceArguments =
+        some arguments at operationSyntax
+      have sourceCount : state.source.length = input.size := by
+        simpa [Lower.CodeTrace.sourceInputMap] using
+          traceState.target.sourceCount
+      have atoms := Lower.Sim.atomsRel_of_translateAtoms operationSyntax
+      have sourceResolved :
+          IxIR1.resolveAtoms state.source sourceArguments = .ok values.toList :=
+        Lower.Sim.resolveAtoms_of_envRel_target
+          traceState.target.environments sourceCount atoms resolved
+      have sourceArity : state.functionTrace.source.arity =
+          values.toList.length := by
+        calc
+          state.functionTrace.source.arity =
+              state.functionTrace.generated.signature.params.size :=
+            state.functionTrace.sourceArity.symm
+          _ = state.frame.definition.signature.params.size := by
+            rw [traceState.target.definition]
+          _ = values.size := arity.symm
+          _ = values.toList.length := by simp
+      obtain ⟨nextState, _sourceEquation, targetStep, acceptedEntry⟩ :=
+        state.enterCallSelf (sourceContext := sourceContext)
+          (sourceFuel := sourceFuel) (context := context)
+          (interpretation := interpretation) traceEq sourceResolved sourceArity
+      exact ⟨by simpa using nextState, by simpa using targetStep,
+        by simpa using acceptedEntry⟩
+  | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | alloc sourceWorld sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | reuse sourceAtom sourceCid sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+  | fetch sourceAtom sourceField =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | call sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | papp sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | apply sourceFunction sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+  | extern sourceAddress sourceArguments =>
+      simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Enter an addressed tail call without growing the continuation stack. All
+local owners transfer to the callee, so the existing framed-root suffix and
+its live stack support are preserved exactly. -/
+theorem enterTailCall
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {address : Ixon.Address} {sourceArguments : Array IxIR1.Atom}
+    {generated : Block}
+    (traceEq : state.trace =
+      .tailCall site blockId input entryValueCount address sourceArguments
+        generated)
+    {calleeTrace : Lower.FunctionTrace}
+    (calleeMember : calleeTrace ∈ attached.target.artifact.trace.functions)
+    {sourceDefinition : IxIR1.FnDef} {targetDefinition : Function}
+    (calleeMatch : Lower.FunctionTraceMatch calleeTrace
+      (.declaration address) sourceDefinition targetDefinition)
+    (sourceDeclaration : attached.simulationSourceContext.decls
+      address = some (.fn sourceDefinition))
+    {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (argumentArity : sourceDefinition.arity = values.length)
+    (targetDeclaration : context.declarations address =
+      some (.fn targetDefinition)) :
+    let calleeFrame : Frame :=
+      { definition := targetDefinition, values := values.toArray }
+    let calleeMachine : Machine :=
+      { machine with control := .running calleeFrame state.stack }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      IxIR1.runCode sourceContext (sourceFuel + 2) state.functionTrace.source
+            state.sourceStore state.source
+              (.letOp (.call address sourceArguments) (.ret (.var 0))) =
+          IxIR1.invoke sourceContext sourceFuel address values
+            state.sourceStore ∧
+        Eval.Step context interpretation machine calleeMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext calleeMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.tailCall site blockId input entryValueCount address sourceArguments
+        generated) state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let calleeFrame : Frame :=
+    { definition := targetDefinition, values := values.toArray }
+  let calleeMachine : Machine :=
+    { machine with control := .running calleeFrame state.stack }
+  obtain ⟨sourceEquation, targetStep, entryStores, calleeState⟩ :=
+    attached.simulate_traced_tail_call_fn_enter_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      calleeMember descendant calleeMatch traceState state.stores
+      sourceResolved argumentArity targetDeclaration state.noCredits
+      state.control
+  have signatureAt := attached.target.targetSignature calleeMember
+    calleeMatch.owner
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions calleeTrace.root
+      state.sourceStore values.reverse state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.tailCallEntry (checked := attached.target)
+      state.member calleeMember descendant signatureAt ownership sourceResolved
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      values.reverse := state.runtime.resolveAtomsReverse sourceResolved
+  have nextState : CompilerRunningState attached calleeMachine :=
+    { functionTrace := calleeTrace
+      trace := calleeTrace.root
+      sourceStore := state.sourceStore
+      source := values.reverse
+      frameRoots := state.frameRoots
+      frame := calleeFrame
+      stack := state.stack
+      member := calleeMember
+      descendant := .refl
+      traceState := by simpa [calleeFrame] using calleeState
+      stores := by simpa [calleeMachine] using entryStores
+      runtime := calleeRuntime
+      ownership := calleeOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.history.advance
+        have resultWorld : state.functionTrace.source.result =
+            sourceDefinition.result := by
+          calc
+            state.functionTrace.source.result =
+                state.functionTrace.generated.signature.result :=
+              state.functionTrace.sourceResult.symm
+            _ = calleeTrace.generated.signature.result :=
+              (attached.target.tailCallResult state.member signatureAt
+                descendant).symm
+            _ = sourceDefinition.result := calleeTrace.sourceResult.trans
+              (congrArg IxIR1.FnDef.result calleeMatch.source)
+        simpa only [traceEq, Lower.CodeTrace.sourceCode,
+          calleeTrace.rootSourceCode, calleeMatch.source] using
+          (IxIR1.ExecutionHistory.tailCall sourceResolved sourceDeclaration
+            argumentArity.symm resultWorld)
+      image := state.image
+      control := by rfl
+      noCredits := by rfl }
+  exact ⟨nextState, sourceEquation,
+    by simpa [calleeMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl rfl⟩
+
+/-- Reconstruct addressed tail-call entry from a concrete target terminator.
+The checked terminal syntax, inverse declaration lookup, and exact input map
+together recover the source tail call and retained callee. -/
+theorem enterTailCallOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {block : Block} {address : Ixon.Address} {arguments : Array Atom}
+    {values : Array RVal} {definition : Function}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments)
+    (resolved : Eval.resolveAtoms state.frame.values arguments = .ok values)
+    (targetDeclaration : context.declarations address = some (.fn definition))
+    (arity : values.size = definition.signature.params.size) :
+    let calleeFrame : Frame := { definition, values }
+    let calleeMachine : Machine :=
+      { machine with control := .running calleeFrame state.stack }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      Eval.Step context interpretation machine calleeMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext calleeMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, entryValueCount, sourceAddress,
+      sourceArguments, generated, traceEq, addressEq, translated⟩ :=
+    state.currentTailCall blockAt pc terminator
+  subst address
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.tailCall site blockId input entryValueCount sourceAddress
+        sourceArguments generated)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  obtain ⟨sourceDefinition, calleeTrace, calleeMember, calleeMatch,
+      sourceDeclaration⟩ :=
+    attached.functionTrace_of_target_declaration sourceDeclarations
+      targetDeclarations targetDeclaration
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.sourceCount
+  have atoms := Lower.Sim.atomsRel_of_translateAtoms translated
+  have sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values.toList :=
+    Lower.Sim.resolveAtoms_of_envRel_target
+      traceState.target.environments sourceCount atoms resolved
+  have sourceArity : sourceDefinition.arity = values.toList.length := by
+    calc
+      sourceDefinition.arity = calleeTrace.source.arity :=
+        congrArg IxIR1.FnDef.arity calleeMatch.source.symm
+      _ = calleeTrace.generated.signature.params.size :=
+        calleeTrace.sourceArity.symm
+      _ = definition.signature.params.size := by rw [calleeMatch.generated]
+      _ = values.size := arity.symm
+      _ = values.toList.length := by simp
+  obtain ⟨nextState, _sourceEquation, targetStep, acceptedEntry⟩ :=
+    state.enterTailCall (sourceContext := sourceContext)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) traceEq calleeMember calleeMatch
+      (by
+            change IxIR1.HPT.programDeclEnv
+              attached.source.lowering.result.artifacts _ = _
+            rw [← sourceDeclarations]
+            exact sourceDeclaration)
+          sourceResolved sourceArity targetDeclaration
+  exact ⟨by simpa using nextState, by simpa using targetStep,
+    by simpa using acceptedEntry⟩
+
+/-- Enter a recursive tail call with the existing continuation stack and
+framed-root suffix unchanged. -/
+theorem enterTailCallSelf
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceArguments : Array IxIR1.Atom} {generated : Block}
+    (traceEq : state.trace =
+      .tailCallSelf site blockId input entryValueCount sourceArguments
+        generated)
+    {values : List RVal}
+    (sourceResolved :
+      IxIR1.resolveAtoms state.source sourceArguments = .ok values)
+    (argumentArity : state.functionTrace.source.arity = values.length) :
+    let calleeFrame : Frame :=
+      { definition := state.frame.definition, values := values.toArray }
+    let calleeMachine : Machine :=
+      { machine with control := .running calleeFrame state.stack }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      IxIR1.runCode sourceContext (sourceFuel + 2) state.functionTrace.source
+            state.sourceStore state.source
+              (.letOp (.callSelf sourceArguments) (.ret (.var 0))) = (do
+          let out ← IxIR1.runCode sourceContext sourceFuel
+            state.functionTrace.source state.sourceStore values.reverse
+              state.functionTrace.source.body
+          IxIR1.checkResultWorld state.functionTrace.source.result out) ∧
+        Eval.Step context interpretation machine calleeMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext calleeMachine
+                rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  let calleeFrame : Frame :=
+    { definition := state.frame.definition, values := values.toArray }
+  let calleeMachine : Machine :=
+    { machine with control := .running calleeFrame state.stack }
+  obtain ⟨sourceEquation, targetStep, entryStores, calleeState⟩ :=
+    attached.simulate_traced_tail_call_self_enter_state
+      (sourceContext := sourceContext) (sourceFuel := sourceFuel)
+      (context := context) (interpretation := interpretation)
+      state.member descendant traceState state.stores sourceResolved
+      argumentArity state.noCredits state.control
+  have calleeOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions state.functionTrace.root
+      state.sourceStore values.reverse state.frameRoots :=
+    Lower.Sim.SourceOwnershipAt.tailCallSelfEntry
+      (checked := attached.target) state.member descendant ownership
+      sourceResolved
+  have calleeRuntime : Lower.Sim.SourceRuntimeInvariant state.sourceStore
+      values.reverse := state.runtime.resolveAtomsReverse sourceResolved
+  have nextState : CompilerRunningState attached calleeMachine :=
+    { functionTrace := state.functionTrace
+      trace := state.functionTrace.root
+      sourceStore := state.sourceStore
+      source := values.reverse
+      frameRoots := state.frameRoots
+      frame := calleeFrame
+      stack := state.stack
+      member := state.member
+      descendant := .refl
+      traceState := by simpa [calleeFrame] using calleeState
+      stores := by simpa [calleeMachine] using entryStores
+      runtime := calleeRuntime
+      ownership := calleeOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.history.advance
+        simpa only [traceEq, Lower.CodeTrace.sourceCode,
+          state.functionTrace.rootSourceCode] using
+          (IxIR1.ExecutionHistory.tailCallSelf sourceResolved argumentArity.symm)
+      image := state.image
+      control := by rfl
+      noCredits := by rfl }
+  exact ⟨nextState, sourceEquation,
+    by simpa [calleeMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl rfl⟩
+
+/-- Reconstruct recursive self-tail entry from the concrete target
+terminator. Checked syntax and the exact environment map reflect the target
+argument vector back to the source call. -/
+theorem enterTailCallSelfOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetArguments : Array Atom} {values : Array RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf targetArguments)
+    (resolved : Eval.resolveAtoms state.frame.values targetArguments =
+      .ok values)
+    (argumentArity : values.size =
+      state.frame.definition.signature.params.size) :
+    let calleeFrame : Frame :=
+      { definition := state.frame.definition, values := values }
+    let calleeMachine : Machine :=
+      { machine with control := .running calleeFrame state.stack }
+    ∃ _ : CompilerRunningState attached calleeMachine,
+      Eval.Step context interpretation machine calleeMachine := by
+  dsimp only
+  obtain ⟨site, blockId, input, entryValueCount, sourceArguments, generated,
+      traceEq, translated⟩ :=
+    state.currentTailCallSelf blockAt pc terminator
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.tailCallSelf site blockId input entryValueCount sourceArguments
+        generated) state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.sourceCount
+  have atoms := Lower.Sim.atomsRel_of_translateAtoms translated
+  have sourceResolved : IxIR1.resolveAtoms state.source sourceArguments =
+      .ok values.toList :=
+    Lower.Sim.resolveAtoms_of_envRel_target traceState.target.environments
+      sourceCount atoms resolved
+  have sourceArity : state.functionTrace.source.arity = values.toList.length := by
+    calc
+      state.functionTrace.source.arity =
+          state.functionTrace.generated.signature.params.size :=
+        state.functionTrace.sourceArity.symm
+      _ = state.frame.definition.signature.params.size := by
+        rw [traceState.target.definition]
+      _ = values.size := argumentArity.symm
+      _ = values.toList.length := by simp
+  obtain ⟨nextState, _sourceEquation, targetStep, _acceptedEntry⟩ :=
+    state.enterTailCallSelf (sourceContext := sourceContext)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) traceEq sourceResolved sourceArity
+  exact ⟨by simpa using nextState, by simpa using targetStep⟩
+
+private theorem fetchedPrefixValues_succ
+    {parameters fields : Array RVal} {count : Nat}
+    (bound : count < fields.size) :
+    (fetchedPrefixValues parameters fields count).push fields[count] =
+      fetchedPrefixValues parameters fields (count + 1) := by
+  apply Array.toList_inj.mp
+  simp only [fetchedPrefixValues, Array.toList_push, Array.toList_append]
+  rw [← List.take_append_getElem (l := fields.toList)
+    (i := count) (by simpa using bound)]
+  simp [List.append_assoc]
+
+/-- Thread the compiler invariant through every recognized field fetch of an
+accepted baseline prefix. -/
+theorem fetchPrefixState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block}
+    (site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block)
+    {parameters fields : Array RVal} {location : Nat}
+    {box : IxIR1.NodeBox}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = 0)
+    (frameValues : state.frame.values = parameters)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN site.shape.sourceConstructor fields) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := site.shape.fieldCount
+        values := parameters ++ fields }
+    let nextMachine : Machine :=
+      { machine with control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Steps context interpretation site.shape.fieldCount machine nextMachine := by
+  dsimp only
+  rcases box with ⟨boxWorld, boxRc, boxNode⟩
+  dsimp only at node
+  subst boxNode
+  have initialFrameEq :
+      ({ state.frame with pc := 0, values := parameters } : Frame) =
+        state.frame := by
+    generalize state.frame = original at pc frameValues ⊢
+    cases original
+    simp only [Frame.mk.injEq, true_and]
+    exact ⟨pc.symm, frameValues.symm, True.intro⟩
+  let atCount (count : Nat) : Machine :=
+    { machine with
+      control := .running
+        { state.frame with
+          pc := count
+          values := fetchedPrefixValues parameters fields count }
+        state.stack }
+  have loop : ∀ count, count ≤ site.shape.fieldCount →
+      ∃ _ : CompilerRunningState attached (atCount count),
+        Steps context interpretation count machine (atCount count) := by
+    intro count countLe
+    induction count with
+    | zero =>
+        have atZero : atCount 0 = machine := by
+          have controlEq : (atCount 0).control = machine.control := by
+            simpa [atCount, fetchedPrefixValues, initialFrameEq] using
+              state.control.symm
+          cases machine
+          simpa [atCount] using controlEq
+        rw [atZero]
+        exact ⟨state, Steps.refl machine⟩
+    | succ count ih =>
+        have countBound : count < site.shape.fieldCount := by omega
+        obtain ⟨prefixState, prefixSteps⟩ := ih (by omega)
+        let currentFrame : Frame :=
+          { state.frame with
+            pc := count
+            values := fetchedPrefixValues parameters fields count }
+        have controlEq :
+            (.running prefixState.frame prefixState.stack : Control) =
+              .running currentFrame state.stack := by
+          calc
+            _ = (atCount count).control := prefixState.control.symm
+            _ = _ := by rfl
+        have prefixFrameEq : prefixState.frame = currentFrame := by
+          injection controlEq
+        have prefixStackEq : prefixState.stack = state.stack := by
+          injection controlEq
+        have currentBlockAt :
+            prefixState.frame.definition.blocks[prefixState.frame.block]? =
+              some block := by
+          simpa [prefixFrameEq, currentFrame] using blockAt
+        have instructionAt := site.fits.fetches count countBound
+        obtain ⟨pcBound, instruction⟩ :=
+          Array.getElem?_eq_some_iff.mp instructionAt
+        have currentPcBound :
+            prefixState.frame.pc < block.instructions.size := by
+          simpa [prefixFrameEq, currentFrame] using pcBound
+        have currentInstruction :
+            block.instructions[prefixState.frame.pc] =
+              .fetch (.reg site.shape.source)
+                site.shape.sourceConstructor count := by
+          simpa [prefixFrameEq, currentFrame] using instruction
+        have resolved : resolveAtom prefixState.frame.values
+            (.reg site.shape.source) = .ok (.loc location) := by
+          simpa [prefixFrameEq, currentFrame, fetchedPrefixValues,
+            resolveAtom, Array.getElem?_append, parameterCount,
+            site.fits.sourceBound] using sourceResolved
+        have currentBoxAt : (atCount count).store.get? location =
+            some ⟨boxWorld, boxRc,
+              .ctorN site.shape.sourceConstructor fields⟩ := by
+          simpa [atCount] using boxAt
+        have fieldBound : count < fields.size := by
+          simpa [fieldCount] using countBound
+        have fieldAt : fields[count]? = some fields[count] :=
+          Array.getElem?_eq_some_iff.mpr ⟨fieldBound, rfl⟩
+        obtain ⟨nextState, targetStep⟩ :=
+          prefixState.stepFetchOfTarget (sourceContext := sourceContext)
+            (sourceFuel := 0) (context := context)
+            (interpretation := interpretation) sourceDeclarations
+            currentBlockAt currentPcBound currentInstruction resolved
+            currentBoxAt fieldAt
+        have nextMachineEq :
+            ({ atCount count with
+              control := .running
+                { prefixState.frame with
+                  pc := prefixState.frame.pc + 1
+                  values := prefixState.frame.values.push fields[count] }
+                prefixState.stack } : Machine) = atCount (count + 1) := by
+          simp [atCount, prefixFrameEq, prefixStackEq, currentFrame,
+            fetchedPrefixValues_succ fieldBound]
+        rw [nextMachineEq] at nextState targetStep
+        exact ⟨nextState, by
+          simpa [Nat.succ_eq_add_one] using
+            prefixSteps.trans (targetStep.toSteps prefixState.control)⟩
+  obtain ⟨nextState, steps⟩ :=
+    loop site.shape.fieldCount (Nat.le_refl _)
+  have allFields :
+      (fields.toList.take site.shape.fieldCount).toArray = fields := by
+    rw [← fieldCount]
+    change (fields.toList.take fields.toList.length).toArray = fields
+    rw [List.take_length]
+  have atFinal : atCount site.shape.fieldCount =
+      { machine with
+        control := .running
+          { state.frame with
+            pc := site.shape.fieldCount
+            values := parameters ++ fields }
+          state.stack } := by
+    simp [atCount, fetchedPrefixValues, allFields]
+  rw [atFinal] at nextState steps
+  exact ⟨nextState, steps⟩
+
+/-- Thread the compiler invariant through an arbitrary suffix of recognized
+shared retains after the field-fetch phase. -/
+theorem retainSuffixState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block}
+    (site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block)
+    {parameters fields : Array RVal} {processed remaining : List RVal}
+    {finalStore : Store}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (split : fields.toList = processed ++ remaining)
+    (pc : state.frame.pc = site.shape.fieldCount + processed.length)
+    (frameValues : state.frame.values =
+      parameters ++ fields ++ processed.toArray)
+    (retained : RetainSharedMany machine.store remaining.toArray finalStore) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := site.shape.fieldCount + (processed ++ remaining).length
+        values := parameters ++ fields ++
+          (processed ++ remaining).toArray }
+    let nextMachine : Machine :=
+      { store := finalStore
+        heapFuel := machine.heapFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Steps context interpretation remaining.length machine nextMachine := by
+  dsimp only
+  induction remaining generalizing processed machine with
+  | nil =>
+      change (.ok machine.store : Except Eval.Error Store) = .ok finalStore
+        at retained
+      have finalStoreEq : finalStore = machine.store :=
+        (Except.ok.inj retained).symm
+      subst finalStore
+      have nextFrameEq :
+          ({ state.frame with
+            pc := site.shape.fieldCount + (processed ++ []).length
+            values := parameters ++ fields ++
+              (processed ++ []).toArray } : Frame) = state.frame := by
+        generalize state.frame = original at pc frameValues ⊢
+        cases original
+        simp only [List.append_nil, Frame.mk.injEq, true_and]
+        exact ⟨pc.symm, frameValues.symm, True.intro⟩
+      have targetEq :
+          ({ store := machine.store
+             heapFuel := machine.heapFuel
+             control := .running
+               { state.frame with
+                 pc := site.shape.fieldCount + (processed ++ []).length
+                 values := parameters ++ fields ++
+                   (processed ++ []).toArray }
+               state.stack } : Machine) = machine := by
+        rw [nextFrameEq]
+        cases machine
+        simpa using state.control.symm
+      rw [targetEq]
+      exact ⟨state, Steps.refl machine⟩
+  | cons value remaining ih =>
+      obtain ⟨middle, headRetained, tailRetained⟩ :=
+        RetainSharedMany.cons_inv retained
+      have fieldIndexBound : processed.length < site.shape.fieldCount := by
+        have lengths := congrArg List.length split
+        simp only [List.length_append, List.length_cons] at lengths
+        have fieldsLength : fields.toList.length = site.shape.fieldCount := by
+          simp [fieldCount]
+        omega
+      have fieldAt : fields[processed.length]? = some value := by
+        rw [Array.getElem?_eq_some_iff]
+        refine ⟨?_, ?_⟩
+        · simpa [fieldCount] using fieldIndexBound
+        · have listAt : fields.toList[processed.length]? = some value := by
+            rw [split, List.getElem?_append_right (Nat.le_refl _)]
+            simp
+          exact Option.some.inj
+            ((List.getElem?_eq_getElem (l := fields.toList)
+              (i := processed.length) (by simpa [fieldCount] using
+                fieldIndexBound)).symm.trans listAt)
+      have fieldEq : fields[processed.length] = value :=
+        (Array.getElem?_eq_some_iff.mp fieldAt).2
+      have resolved : resolveAtom state.frame.values
+          (.reg (site.shape.parameterCount + processed.length)) =
+          .ok value := by
+        simp [frameValues, resolveAtom, Array.getElem?_append,
+          parameterCount, fieldCount, fieldIndexBound, fieldEq,
+          show ¬site.shape.parameterCount + processed.length <
+            site.shape.parameterCount by omega]
+      have instructionAt := site.fits.retains processed.length fieldIndexBound
+      obtain ⟨pcBound, instruction⟩ :=
+        Array.getElem?_eq_some_iff.mp instructionAt
+      have currentPcBound : state.frame.pc < block.instructions.size := by
+        simpa [pc] using pcBound
+      have currentInstruction : block.instructions[state.frame.pc] =
+          .retainShared
+            (.reg (site.shape.parameterCount + processed.length)) := by
+        simpa [pc] using instruction
+      obtain ⟨headState, headStep⟩ :=
+        state.stepRetainOfTarget (sourceContext := sourceContext)
+          (sourceFuel := 0) (context := context)
+          (interpretation := interpretation) sourceDeclarations blockAt
+          currentPcBound currentInstruction resolved headRetained
+      let headFrame : Frame :=
+        { state.frame with
+          pc := state.frame.pc + 1
+          values := state.frame.values.push value }
+      let headMachine : Machine :=
+        { store := middle
+          heapFuel := machine.heapFuel
+          control := .running headFrame state.stack }
+      have headControlEq :
+          (.running headState.frame headState.stack : Control) =
+            .running headFrame state.stack := by
+        calc
+          _ = headMachine.control := headState.control.symm
+          _ = _ := by rfl
+      have headFrameEq : headState.frame = headFrame := by
+        injection headControlEq
+      have headStackEq : headState.stack = state.stack := by
+        injection headControlEq
+      have nextBlockAt :
+          headState.frame.definition.blocks[headState.frame.block]? =
+            some block := by
+        simpa [headFrameEq, headFrame] using blockAt
+      have nextPc : headState.frame.pc =
+          site.shape.fieldCount + (processed ++ [value]).length := by
+        simp [headFrameEq, headFrame, pc, Nat.add_assoc]
+      have nextValues : headState.frame.values =
+          parameters ++ fields ++ (processed ++ [value]).toArray := by
+        simp [headFrameEq, headFrame, frameValues]
+      have nextSplit : fields.toList =
+          (processed ++ [value]) ++ remaining := by
+        simpa [List.append_assoc] using split
+      obtain ⟨nextState, tailSteps⟩ :=
+        ih headState nextBlockAt nextSplit nextPc nextValues tailRetained
+      rw [headFrameEq, headStackEq] at nextState tailSteps
+      have headStep' : Step context interpretation machine headMachine := by
+        simpa [headMachine, headFrame] using headStep
+      exact ⟨by simpa [headMachine, headFrame, Nat.add_assoc] using nextState,
+        by
+          simpa [headMachine, headFrame, Nat.add_assoc, Nat.add_comm] using
+            (headStep'.toSteps state.control).trans tailSteps⟩
+
+/-- Execute every recognized shared retain after the accepted field-fetch
+prefix while retaining the compiler witness at the exact endpoint. -/
+theorem retainPrefixState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {block : Block}
+    (site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block)
+    {parameters fields : Array RVal} {retainedStore : Store}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (pc : state.frame.pc = site.shape.fieldCount)
+    (frameValues : state.frame.values = parameters ++ fields)
+    (retained : RetainSharedMany machine.store fields retainedStore) :
+    let nextFrame : Frame :=
+      { state.frame with
+        pc := 2 * site.shape.fieldCount
+        values := baselinePrefixValues parameters fields }
+    let nextMachine : Machine :=
+      { store := retainedStore
+        heapFuel := machine.heapFuel
+        control := .running nextFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Steps context interpretation site.shape.fieldCount machine
+        nextMachine := by
+  dsimp only
+  have result := state.retainSuffixState
+    (sourceContext := sourceContext) (context := context)
+    (interpretation := interpretation) sourceDeclarations site blockAt
+    parameterCount fieldCount (processed := []) (remaining := fields.toList)
+    (by simp) (by simpa using pc) (by simpa using frameValues)
+    (by simpa using retained)
+  obtain ⟨nextState, steps⟩ := result
+  simp at nextState steps
+  have pcEq : site.shape.fieldCount + fields.size =
+      2 * site.shape.fieldCount := by
+    rw [fieldCount, Nat.two_mul]
+  rw [pcEq] at nextState
+  exact ⟨by simpa [baselinePrefixValues] using nextState,
+    by simpa [baselinePrefixValues, fieldCount, Nat.two_mul,
+      Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using steps⟩
+
+/-- The complete accepted baseline prefix preserves the compiler invariant
+through every fetch, retain, recursive release, allocation, and recursive
+self-tail entry. Its endpoint is packaged as the positive compiler macro used
+to attach the semantic reuse simulation. -/
+theorem acceptedPrefixCompilerMacroAtOfFetched
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (frame : Frame) (stack : List Continuation)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions frame.block
+      helperOffset block (.accepted site))
+    {parameters fields newFields callValues : Array RVal}
+    {location remaining : Nat}
+    {retainedStore releasedStore : Store}
+    {allocationSchema : CtorSchema}
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (retained : RetainSharedMany machine.store fields retainedStore)
+    (released : releaseShared machine.heapFuel retainedStore
+      (.loc location) = .ok (releasedStore, remaining))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (releasedStore.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size)
+    (fetchState : CompilerRunningState attached
+      { machine with
+        control := .running
+          { frame with
+            pc := site.shape.fieldCount
+            values := parameters ++ fields }
+          stack })
+    (fetchSteps : Steps context interpretation site.shape.fieldCount machine
+      { machine with
+        control := .running
+          { frame with
+            pc := site.shape.fieldCount
+            values := parameters ++ fields }
+          stack }) :
+    CompilerAcceptedMacroStepAt attached context interpretation
+      (2 * site.shape.fieldCount + 3) machine := by
+  obtain ⟨sourceAt, _resetAt, _hotAt, _coldAt⟩ :=
+    rewrite.acceptedAt accepted
+  have blockAt : frame.definition.blocks[frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact sourceAt
+  let afterFetchFrame : Frame :=
+    { frame with
+      pc := site.shape.fieldCount
+      values := parameters ++ fields }
+  let afterFetch : Machine :=
+    { machine with control := .running afterFetchFrame stack }
+  have fetchControlEq :
+      (.running fetchState.frame fetchState.stack : Control) =
+        .running afterFetchFrame stack := by
+    calc
+      _ = afterFetch.control := fetchState.control.symm
+      _ = _ := by rfl
+  have fetchFrameEq : fetchState.frame = afterFetchFrame := by
+    injection fetchControlEq
+  have fetchStackEq : fetchState.stack = stack := by
+    injection fetchControlEq
+  have fetchBlockAt :
+      fetchState.frame.definition.blocks[fetchState.frame.block]? =
+        some block := by
+    simpa [fetchFrameEq, afterFetchFrame] using blockAt
+  let afterRetainFrame : Frame :=
+    { frame with
+      pc := 2 * site.shape.fieldCount
+      values := baselinePrefixValues parameters fields }
+  let afterRetains : Machine :=
+    { store := retainedStore
+      heapFuel := machine.heapFuel
+      control := .running afterRetainFrame stack }
+  obtain ⟨retainStateRaw, retainStepsRaw⟩ :=
+    fetchState.retainPrefixState (sourceContext := sourceContext)
+      (context := context) (interpretation := interpretation)
+      sourceDeclarations site fetchBlockAt parameterCount fieldCount
+      (by simp [fetchFrameEq, afterFetchFrame])
+      (by simp [fetchFrameEq, afterFetchFrame])
+      (by simpa [afterFetch] using retained)
+  have retainMachineEq :
+      ({ store := retainedStore
+         heapFuel := afterFetch.heapFuel
+         control := .running
+           { fetchState.frame with
+             pc := 2 * site.shape.fieldCount
+             values := baselinePrefixValues parameters fields }
+           fetchState.stack } : Machine) = afterRetains := by
+    simp [afterFetch, afterRetains, fetchFrameEq, fetchStackEq,
+      afterFetchFrame, afterRetainFrame]
+  rw [retainMachineEq] at retainStateRaw retainStepsRaw
+  let retainState : CompilerRunningState attached afterRetains := retainStateRaw
+  have retainControlEq :
+      (.running retainState.frame retainState.stack : Control) =
+        .running afterRetainFrame stack := by
+    calc
+      _ = afterRetains.control := retainState.control.symm
+      _ = _ := by rfl
+  have retainFrameEq : retainState.frame = afterRetainFrame := by
+    injection retainControlEq
+  have retainStackEq : retainState.stack = stack := by
+    injection retainControlEq
+  have retainedSourceResolved : resolveAtom retainState.frame.values
+      (.reg site.shape.source) = .ok (.loc location) := by
+    simpa [retainFrameEq, afterRetainFrame, baselinePrefixValues,
+      resolveAtom, Array.getElem?_append, parameterCount,
+      site.fits.sourceBound] using sourceResolved
+  have retainBaselineDefinition : retainState.frame.definition = source := by
+    simpa [retainFrameEq, afterRetainFrame] using baselineDefinition
+  have retainAccepted : Reuse.FunctionDecisions.At rewrite.decisions
+      retainState.frame.block helperOffset block (.accepted site) := by
+    simpa [retainFrameEq, afterRetainFrame] using accepted
+  have retainPc : retainState.frame.pc = site.shape.releasePosition := by
+    simp [retainFrameEq, afterRetainFrame, site.fits.releasePosition]
+  let afterReleaseFrame : Frame :=
+    { frame with
+      pc := 2 * site.shape.fieldCount + 1
+      values := baselinePrefixValues parameters fields }
+  let afterRelease : Machine :=
+    { store := releasedStore
+      heapFuel := remaining
+      control := .running afterReleaseFrame stack }
+  obtain ⟨releaseStateRaw, releaseStepRaw⟩ :=
+    retainState.stepAcceptedReleaseOfTarget
+      (sourceContext := sourceContext) (context := context)
+      (interpretation := interpretation) rewrite retainBaselineDefinition
+      retainAccepted retainPc sourceDeclarations retainedSourceResolved
+      (by simpa [afterRetains] using released)
+  have releaseMachineEq :
+      ({ store := releasedStore
+         heapFuel := remaining
+         control := .running
+           { retainState.frame with pc := retainState.frame.pc + 1 }
+           retainState.stack } : Machine) = afterRelease := by
+    simp [afterRelease, afterReleaseFrame, retainFrameEq, retainStackEq,
+      afterRetainFrame]
+  rw [releaseMachineEq] at releaseStateRaw releaseStepRaw
+  let releaseState : CompilerRunningState attached afterRelease :=
+    releaseStateRaw
+  have releaseControlEq :
+      (.running releaseState.frame releaseState.stack : Control) =
+        .running afterReleaseFrame stack := by
+    calc
+      _ = afterRelease.control := releaseState.control.symm
+      _ = _ := by rfl
+  have releaseFrameEq : releaseState.frame = afterReleaseFrame := by
+    injection releaseControlEq
+  have releaseStackEq : releaseState.stack = stack := by
+    injection releaseControlEq
+  have releaseBlockAt :
+      releaseState.frame.definition.blocks[releaseState.frame.block]? =
+        some block := by
+    simpa [releaseFrameEq, afterReleaseFrame] using blockAt
+  have allocationAt := site.fits.allocation
+  rw [site.fits.releasePosition] at allocationAt
+  obtain ⟨allocationPcBound, allocationInstruction⟩ :=
+    Array.getElem?_eq_some_iff.mp allocationAt
+  have releasePcBound : releaseState.frame.pc < block.instructions.size := by
+    simpa [releaseFrameEq, afterReleaseFrame] using allocationPcBound
+  have releaseInstruction : block.instructions[releaseState.frame.pc] =
+      .alloc .shared site.shape.allocationConstructor
+        site.shape.allocationArguments := by
+    simpa [releaseFrameEq, afterReleaseFrame] using allocationInstruction
+  have releaseAllocationResolved : resolveAtoms releaseState.frame.values
+      site.shape.allocationArguments = .ok newFields := by
+    simpa [releaseFrameEq, afterReleaseFrame] using allocationResolved
+  let allocation := releasedStore.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let afterAllocationFrame : Frame :=
+    { frame with
+      pc := 2 * site.shape.fieldCount + 2
+      values := (baselinePrefixValues parameters fields).push
+        (.loc allocation.2) }
+  let afterAllocation : Machine :=
+    { store := allocation.1
+      heapFuel := remaining
+      control := .running afterAllocationFrame stack }
+  obtain ⟨allocationStateRaw, allocationStepRaw, _allocationEntry⟩ :=
+    releaseState.stepAllocOfTarget (sourceContext := sourceContext)
+      (sourceFuel := 0) (context := context)
+      (interpretation := interpretation) contextSchemas sourceDeclarations
+      releaseBlockAt releasePcBound releaseInstruction schemaAt
+      releaseAllocationResolved
+  have allocationMachineEq :
+      ({ store := allocation.1
+         heapFuel := afterRelease.heapFuel
+         control := .running
+           { releaseState.frame with
+             pc := releaseState.frame.pc + 1
+             values := releaseState.frame.values.push (.loc allocation.2) }
+           releaseState.stack } : Machine) = afterAllocation := by
+    simp [afterRelease, afterAllocation, afterAllocationFrame,
+      releaseFrameEq, releaseStackEq, afterReleaseFrame, allocation]
+  rw [allocationMachineEq] at allocationStateRaw allocationStepRaw
+  let allocationState : CompilerRunningState attached afterAllocation :=
+    allocationStateRaw
+  have allocationControlEq :
+      (.running allocationState.frame allocationState.stack : Control) =
+        .running afterAllocationFrame stack := by
+    calc
+      _ = afterAllocation.control := allocationState.control.symm
+      _ = _ := by rfl
+  have allocationFrameEq : allocationState.frame = afterAllocationFrame := by
+    injection allocationControlEq
+  have allocationStackEq : allocationState.stack = stack := by
+    injection allocationControlEq
+  have allocationBlockAt :
+      allocationState.frame.definition.blocks[allocationState.frame.block]? =
+        some block := by
+    simpa [allocationFrameEq, afterAllocationFrame] using blockAt
+  have allocationPc : allocationState.frame.pc = block.instructions.size := by
+    simpa [allocationFrameEq, afterAllocationFrame] using
+      site.fits.instructionCount.symm
+  have allocationTerminator : block.terminator =
+      .tailCallSelf site.shape.tailArguments := site.fits.terminator
+  have allocationTailResolved : resolveAtoms allocationState.frame.values
+      site.shape.tailArguments = .ok callValues := by
+    simpa [allocationFrameEq, afterAllocationFrame, allocation] using
+      tailResolved
+  have allocationArity : callValues.size =
+      allocationState.frame.definition.signature.params.size := by
+    simpa [allocationFrameEq, afterAllocationFrame, baselineDefinition] using
+      arity
+  let finalFrame : Frame :=
+    { definition := source, values := callValues }
+  let finalMachine : Machine :=
+    { store := allocation.1
+      heapFuel := remaining
+      control := .running finalFrame stack }
+  obtain ⟨finalStateRaw, tailStepRaw⟩ :=
+    allocationState.enterTailCallSelfOfTarget
+      (sourceContext := sourceContext) (sourceFuel := 0)
+      (context := context) (interpretation := interpretation)
+      allocationBlockAt allocationPc allocationTerminator
+      allocationTailResolved allocationArity
+  have finalMachineEq :
+      ({ afterAllocation with
+         control := .running
+           { definition := allocationState.frame.definition
+             values := callValues }
+           allocationState.stack } : Machine) = finalMachine := by
+    simp [afterAllocation, finalMachine, finalFrame, allocationFrameEq,
+      allocationStackEq, afterAllocationFrame, baselineDefinition]
+  rw [finalMachineEq] at finalStateRaw tailStepRaw
+  have fetchRetainSteps : Steps context interpretation
+      (2 * site.shape.fieldCount) machine afterRetains := by
+    simpa [Nat.two_mul] using fetchSteps.trans retainStepsRaw
+  have allSteps : Steps context interpretation
+      (2 * site.shape.fieldCount + 3) machine finalMachine := by
+    have releaseOne := releaseStepRaw.toSteps retainState.control
+    have allocationOne := allocationStepRaw.toSteps releaseState.control
+    have tailOne := tailStepRaw.toSteps allocationState.control
+    simpa [Nat.add_assoc] using
+      (((fetchRetainSteps.trans releaseOne).trans allocationOne).trans tailOne)
+  exact .intro (by omega) finalMachine allSteps (.running finalStateRaw)
+    (fun {_rewrittenTarget} _related =>
+      StableLiveAcceptedEntry.ofPcZero rfl rfl)
+
+/-- At a traced zero-PC entry, construct the fetched compiler state and
+reuse the same retain/release/allocation/tail composition as a case child. -/
+theorem acceptedPrefixCompilerMacroAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {parameters fields newFields callValues : Array RVal}
+    {location rc remaining : Nat}
+    {retainedStore releasedStore : Store}
+    {allocationSchema : CtorSchema}
+    (frameValues : state.frame.values = parameters)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (retained : RetainSharedMany machine.store fields retainedStore)
+    (released : releaseShared machine.heapFuel retainedStore
+      (.loc location) = .ok (releasedStore, remaining))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (releasedStore.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    CompilerAcceptedMacroStepAt attached context interpretation
+      (2 * site.shape.fieldCount + 3) machine := by
+  have blockAt : state.frame.definition.blocks[state.frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact (rewrite.acceptedAt accepted).1
+  obtain ⟨fetchState, fetchSteps⟩ :=
+    state.fetchPrefixState (sourceContext := sourceContext)
+      (context := context) (interpretation := interpretation)
+      sourceDeclarations site blockAt pc frameValues parameterCount fieldCount
+      sourceResolved boxAt rfl
+  exact acceptedPrefixCompilerMacroAtOfFetched state.frame state.stack
+    contextSchemas sourceDeclarations rewrite baselineDefinition accepted
+    parameterCount fieldCount sourceResolved retained released schemaAt
+    allocationResolved tailResolved arity fetchState fetchSteps
+
+/-- Compatibility wrapper that forgets the fixed length and accepted-entry
+phase while retaining the original compiler-macro API. -/
+theorem acceptedPrefixCompilerMacro
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    (contextSchemas : context.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (sourceDeclarations : sourceContext.decls =
+      IxIR1.HPT.programDeclEnv attached.source.lowering.result.artifacts)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {parameters fields newFields callValues : Array RVal}
+    {location rc remaining : Nat}
+    {retainedStore releasedStore : Store}
+    {allocationSchema : CtorSchema}
+    (frameValues : state.frame.values = parameters)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (retained : RetainSharedMany machine.store fields retainedStore)
+    (released : releaseShared machine.heapFuel retainedStore
+      (.loc location) = .ok (releasedStore, remaining))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (releasedStore.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    CompilerMacroStep attached context interpretation machine := by
+  exact (state.acceptedPrefixCompilerMacroAt contextSchemas
+    sourceDeclarations rewrite baselineDefinition accepted pc frameValues
+    parameterCount fieldCount sourceResolved boxAt retained released schemaAt
+    allocationResolved tailResolved arity).compilerMacro
+
+/-- Advance a compiler running state through the zero arm of a checked Nat
+switch. The generated edge transfer and exact recursive child are recovered
+entirely from the lowering trace. -/
+theorem stepSwitchNatZero
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (traceEq : state.trace =
+      .switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+    (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.lit (.nat 0))) :
+    ∃ childFrame,
+      let nextMachine : Machine :=
+        { machine with control := .running childFrame state.stack }
+      ∃ _ : CompilerRunningState attached nextMachine,
+        Eval.Step context interpretation machine nextMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  have descendant : state.functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  obtain ⟨constructors, peel, branches, childFrame, terminator, _edgeMember,
+      childMember, sourceAlternative, childSource, childCode, targetStep,
+      _targetPreserving, childNoCredits, childTarget⟩ :=
+    Lower.Sim.simulate_traced_switch_nat_zero_state descendant
+      traceState.target sourceResolved state.control state.noCredits
+  have nextTraceState := traceState.natZeroChild sourceAlternative childSource
+    childCode childTarget
+  have parentEnvironments : Lower.Sim.EnvRel state.source
+      state.frame.values input := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.environments
+  have nextOwnership := Lower.Sim.SourceOwnershipAt.switchNatZero
+    attached.target state.member descendant terminator branches ownership
+      parentEnvironments
+  have nextDescendant : state.functionTrace.root.Descendant
+      branches.zeroChild :=
+    .step descendant childMember
+  let nextMachine : Machine :=
+    { machine with control := .running childFrame state.stack }
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := branches.zeroChild
+      sourceStore := state.sourceStore
+      source := state.source
+      frameRoots := state.frameRoots
+      frame := childFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := nextTraceState
+      stores := by simpa [nextMachine] using state.stores
+      runtime := state.runtime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.history.advance
+        simpa [traceEq, Lower.CodeTrace.sourceCode, childCode] using
+          (IxIR1.ExecutionHistory.caseNatZero (tag := 0) sourceResolved
+            (sourceAlternativeFind sourceAlternative))
+      image := state.image
+      control := by rfl
+      noCredits := childNoCredits }
+  have nextPc : childFrame.pc = 0 :=
+    nextTraceState.target.pc.trans branches.zero.childPc
+  exact ⟨childFrame, nextState,
+    by simpa [nextMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl nextPc⟩
+
+/-- Advance a compiler running state through the successor arm of a checked
+Nat switch. The peeled predecessor becomes the scalar head of the recursive
+source environment and the checked ownership vector shifts with it. -/
+theorem stepSwitchNatSucc
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount predecessor : Nat}
+    {sourceScrutinee : IxIR1.Atom} {alternatives : Array IxIR1.Alt}
+    {targetScrutinee : Atom} {generated : Block}
+    {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+    (traceEq : state.trace =
+      .switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+    (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1)))) :
+    ∃ childFrame,
+      let nextMachine : Machine :=
+        { machine with control := .running childFrame state.stack }
+      ∃ _ : CompilerRunningState attached nextMachine,
+        Eval.Step context interpretation machine nextMachine ∧
+          ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  have descendant : state.functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  obtain ⟨constructors, peel, branches, childFrame, terminator, _edgeMember,
+      childMember, sourceAlternative, childSource, childCode, targetStep,
+      _targetPreserving, childNoCredits, childTarget⟩ :=
+    Lower.Sim.simulate_traced_switch_nat_succ_state descendant
+      traceState.target sourceResolved state.control state.noCredits
+  have nextTraceState := traceState.natSuccChild sourceAlternative childSource
+    childCode sourceResolved childTarget
+  have parentEnvironments : Lower.Sim.EnvRel state.source
+      state.frame.values input := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.environments
+  have nextOwnership := Lower.Sim.SourceOwnershipAt.switchNatSucc
+    attached.target state.member descendant terminator branches ownership
+      parentEnvironments (predecessor := predecessor)
+  have nextRuntime := state.runtime.natSuccessor predecessor
+  have nextDescendant : state.functionTrace.root.Descendant
+      branches.succChild :=
+    .step descendant childMember
+  let nextMachine : Machine :=
+    { machine with control := .running childFrame state.stack }
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := branches.succChild
+      sourceStore := state.sourceStore
+      source := .lit (.nat predecessor) :: state.source
+      frameRoots := state.frameRoots
+      frame := childFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := nextTraceState
+      stores := by simpa [nextMachine] using state.stores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.history.advance
+        simpa [traceEq, Lower.CodeTrace.sourceCode, childCode] using
+          (IxIR1.ExecutionHistory.caseNatSucc (tag := 1) sourceResolved
+            (sourceAlternativeFind sourceAlternative))
+      image := state.image
+      control := by rfl
+      noCredits := childNoCredits }
+  have nextPc : childFrame.pc = 0 :=
+    nextTraceState.target.pc.trans branches.succ.childPc
+  exact ⟨childFrame, nextState,
+    by simpa [nextMachine] using targetStep,
+    fun _rewritten => StableLiveAcceptedEntry.ofPcZero rfl nextPc⟩
+
+/-- Reconstruct the checked Nat-zero branch from the concrete target switch
+transfer and align its edge-selected endpoint by evaluator determinism. -/
+theorem stepSwitchNatZeroOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {peel : NatPeel} {targetFrame : Frame}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (resolved : Eval.resolveAtom state.frame.values targetScrutinee =
+      .ok (.lit (.nat 0)))
+    (transferred : Eval.EdgeTransfer state.frame peel.zero #[] targetFrame) :
+    let nextMachine : Machine :=
+      { machine with control := .running targetFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, entryValueCount, sourceScrutinee,
+      peelNat, alternatives, generated, outgoing, children, traceEq,
+      translated, _generatedTerminator, peelShape⟩ :=
+    state.currentSwitchValue blockAt pc terminator
+  have peelTrue : peelNat = true := by simpa using peelShape
+  subst peelNat
+  simp only [Option.isSome] at traceEq
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.sourceCount
+  have sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.lit (.nat 0)) :=
+    Lower.Sim.resolveAtom_of_envRel_target traceState.target.environments
+      sourceCount translated resolved
+  obtain ⟨childFrame, nextState, generatedStep, acceptedEntry⟩ :=
+    state.stepSwitchNatZero (context := context)
+      (interpretation := interpretation) traceEq sourceResolved
+  have canonicalEq :
+      ({ store := machine.store
+         heapFuel := machine.heapFuel
+         control := .running state.frame state.stack } : Machine) = machine := by
+    simpa only using congrArg
+      (fun control => ({ machine with control } : Machine)) state.control.symm
+  have actualStep : Eval.Step context interpretation machine
+      { machine with control := .running targetFrame state.stack } := by
+    have step := (Eval.TerminatorTransferCase.switchNatZero
+      (context := context) (interpretation := interpretation)
+      (store := machine.store) (heapFuel := machine.heapFuel)
+      (frame := state.frame) (stack := state.stack) resolved transferred).step
+        blockAt pc terminator
+    rw [canonicalEq] at step
+    exact step
+  have targetEq :
+      ({ machine with control := .running childFrame state.stack } : Machine) =
+        { machine with control := .running targetFrame state.stack } :=
+    generatedStep.deterministic actualStep
+  rw [targetEq] at nextState generatedStep acceptedEntry
+  exact ⟨nextState, generatedStep, acceptedEntry⟩
+
+/-- Reconstruct the checked Nat-successor branch from the concrete target
+switch transfer, including the peeled predecessor binding. -/
+theorem stepSwitchNatSuccOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {peel : NatPeel} {predecessor : Nat}
+    {targetFrame : Frame}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors (some peel))
+    (resolved : Eval.resolveAtom state.frame.values targetScrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (transferred : Eval.EdgeTransfer state.frame peel.succ
+      #[.lit (.nat predecessor)] targetFrame) :
+    let nextMachine : Machine :=
+      { machine with control := .running targetFrame state.stack }
+    ∃ _ : CompilerRunningState attached nextMachine,
+      Eval.Step context interpretation machine nextMachine ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, entryValueCount, sourceScrutinee,
+      peelNat, alternatives, generated, outgoing, children, traceEq,
+      translated, _generatedTerminator, peelShape⟩ :=
+    state.currentSwitchValue blockAt pc terminator
+  have peelTrue : peelNat = true := by simpa using peelShape
+  subst peelNat
+  simp only [Option.isSome] at traceEq
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee true
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.sourceCount
+  have sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.lit (.nat (predecessor + 1))) :=
+    Lower.Sim.resolveAtom_of_envRel_target traceState.target.environments
+      sourceCount translated resolved
+  obtain ⟨childFrame, nextState, generatedStep, acceptedEntry⟩ :=
+    state.stepSwitchNatSucc (context := context)
+      (interpretation := interpretation) traceEq sourceResolved
+  have canonicalEq :
+      ({ store := machine.store
+         heapFuel := machine.heapFuel
+         control := .running state.frame state.stack } : Machine) = machine := by
+    simpa only using congrArg
+      (fun control => ({ machine with control } : Machine)) state.control.symm
+  have actualStep : Eval.Step context interpretation machine
+      { machine with control := .running targetFrame state.stack } := by
+    have step := (Eval.TerminatorTransferCase.switchNatSucc
+      (context := context) (interpretation := interpretation)
+      (store := machine.store) (heapFuel := machine.heapFuel)
+      (frame := state.frame) (stack := state.stack) resolved transferred).step
+        blockAt pc terminator
+    rw [canonicalEq] at step
+    exact step
+  have targetEq :
+      ({ machine with control := .running childFrame state.stack } : Machine) =
+        { machine with control := .running targetFrame state.stack } :=
+    generatedStep.deterministic actualStep
+  rw [targetEq] at nextState generatedStep acceptedEntry
+  exact ⟨nextState, generatedStep, acceptedEntry⟩
+
+/-- Advance a compiler running state through a checked constructor switch,
+its generated edge transfer, and the child's certified field-fetch prologue.
+This is necessarily a positive macro rather than a single step: the recursive
+trace child begins only after all constructor fields have been installed. The
+result retains both the edge-entry bridge and the complete parent/child facts
+needed to classify the selected child independently in the reuse trace. -/
+theorem stepsSwitchCtor
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (traceEq : state.trace =
+      .switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : state.sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child) :
+    ∃ finalFrame edgeFrame childScrutinee,
+      let nextMachine : Machine :=
+        { machine with control := .running finalFrame state.stack }
+      ∃ _ : CompilerRunningState attached nextMachine,
+        Eval.Steps context interpretation (1 + fields.size) machine
+          nextMachine ∧
+        state.frame.definition.blocks[state.frame.block]? = some generated ∧
+        state.frame.pc = generated.instructions.size ∧
+        Eval.resolveAtom state.frame.values targetScrutinee =
+          .ok (.loc location) ∧
+        machine.store.get? location = some box ∧
+        Eval.EdgeTransfer state.frame target.edge #[] edgeFrame ∧
+        Eval.Step context interpretation machine
+          { machine with control := .running edgeFrame state.stack } ∧
+        edgeFrame.definition.blocks[edgeFrame.block]? =
+          some child.headBlock.2 ∧
+        edgeFrame.pc = 0 ∧
+        Eval.resolveAtom edgeFrame.values childScrutinee =
+          .ok (.loc location) ∧
+        Lower.fetchPrologueMatches child.headBlock.2.instructions
+          childScrutinee cid fields.size = true ∧
+        finalFrame = { edgeFrame with
+          pc := fields.size
+          values := edgeFrame.values ++ fields } := by
+  have descendant : state.functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  obtain ⟨finalFrame, edgeFrame, childScrutinee, childSource, childCode,
+      targetSteps, _targetPreserving, childNoCredits, nextStores, childTarget,
+      parentBlockAt, parentPc, targetResolved, targetGet, transferred,
+      switchStep, childBlockAt, childPc, childResolved, prologue,
+      finalFrameEq⟩ :=
+    Lower.Sim.simulate_traced_switch_ctor_state descendant traceState.target
+      state.stores sourceResolved sourceGet node sourceAlternative fieldArity
+      terminator targetAt targetAlternative edgeAt childAt state.control
+      state.noCredits
+  have recursiveMatched :=
+    state.functionTrace.descendantSwitchBranchesMatch descendant
+  have localMatched :=
+    Lower.CodeTrace.switchNodeBranchesMatch_of_match recursiveMatched
+  have branch := Lower.constructorBranchMatchAt_of_switch_match
+    localMatched terminator targetAt edgeAt childAt
+  have targetCid : target.cid = cid := by
+    have matched : (target.cid == cid) = true := Array.find?_some
+      (p := fun candidate : CtorAlt => candidate.cid == cid)
+      (a := target) (xs := constructors) targetAlternative
+    exact beq_iff_eq.mp matched
+  have branchAlternative := branch.sourceAlternative
+  rw [targetCid, sourceAlternative] at branchAlternative
+  have alternativeEqual := Option.some.inj branchAlternative
+  have sourceFieldCount : branch.fieldCount = fieldCount := by
+    exact (congrArg (fun alternative : IxIR1.Alt × Nat =>
+      match alternative.1 with | .mk _ fields _ => fields)
+        alternativeEqual).symm
+  have branchFieldArity : fields.size = branch.fieldCount := by
+    rw [sourceFieldCount]
+    exact fieldArity
+  have nextTraceState := traceState.constructorChild sourceAlternative
+    childSource childCode sourceResolved sourceGet node fieldArity childTarget
+  have parentEnvironments : Lower.Sim.EnvRel state.source
+      state.frame.values input := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.environments
+  have schemaFields : ∀ {world schema},
+      attached.target.artifact.validationContext.schemas world cid =
+        some schema →
+      ∃ count, schema.fields = Array.replicate count world := by
+    intro world schema found
+    rw [attached.targetSchemasProduced] at found
+    exact attached.schema_fields_replicate found
+  have nextOwnership := Lower.Sim.SourceOwnershipAt.switchCtor
+    attached.target state.member descendant terminator targetAt childAt branch
+      ownership parentEnvironments sourceResolved sourceGet node targetCid
+      branchFieldArity schemaFields
+  have nextRuntime := state.runtime.constructorBranch sourceGet node
+  have childMember : child ∈ children := List.mem_of_getElem? childAt
+  have nextDescendant : state.functionTrace.root.Descendant child :=
+    .step descendant childMember
+  let nextMachine : Machine :=
+    { machine with control := .running finalFrame state.stack }
+  have nextState : CompilerRunningState attached nextMachine :=
+    { functionTrace := state.functionTrace
+      trace := child
+      sourceStore := state.sourceStore
+      source := fields.toList.reverse ++ state.source
+      frameRoots := state.frameRoots
+      frame := finalFrame
+      stack := state.stack
+      member := state.member
+      descendant := nextDescendant
+      traceState := nextTraceState
+      stores := by simpa [nextMachine] using nextStores
+      runtime := nextRuntime
+      ownership := nextOwnership
+      stackRoots := state.stackRoots
+      callStack := state.callStack
+      history := by
+        apply state.history.advance
+        have selected : alternatives.find? (fun alt => alt.cidx == cid.cidx) =
+            some (.mk tag fieldCount body) := by
+          exact sourceAlternativeFind sourceAlternative
+        simpa [traceEq, Lower.CodeTrace.sourceCode, childCode] using
+          (IxIR1.ExecutionHistory.caseCtor sourceResolved sourceGet node
+            selected fieldArity)
+      image := state.image
+      control := by rfl
+      noCredits := childNoCredits }
+  exact ⟨finalFrame, edgeFrame, childScrutinee, nextState,
+    by simpa [nextMachine] using targetSteps,
+    parentBlockAt, parentPc, targetResolved, targetGet, transferred,
+    switchStep, childBlockAt, childPc, childResolved, prologue, finalFrameEq⟩
+
+/-- Package checked constructor switching as the baseline half of a positive
+compiler-aware synchronization macro.  Unlike the literal switch successor,
+the endpoint after edge transfer and field fetching is a recursive compiler
+boundary. -/
+theorem switchCtorMacro
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (traceEq : state.trace =
+      .switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : state.sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child) :
+    CompilerMacroStep attached context interpretation machine := by
+  obtain ⟨finalFrame, _edgeFrame, _childScrutinee, nextState, targetSteps,
+      _parentBlockAt, _parentPc, _targetResolved, _targetGet, _transferred,
+      _switchStep, _childBlockAt, _childPc, _childResolved, _prologue,
+      _finalFrameEq⟩ :=
+    state.stepsSwitchCtor traceEq sourceResolved sourceGet node
+      sourceAlternative fieldArity terminator targetAt targetAlternative
+      edgeAt childAt
+  exact .intro (1 + fields.size) (by omega)
+    { machine with control := .running finalFrame state.stack }
+    targetSteps (.running nextState)
+
+/-- Proof-relevant lowering data recovered from one concrete target
+constructor selection. It names the exact retained source alternative and
+parallel edge/child trace entries needed by both the compiler-only and paired
+reuse macros. -/
+inductive CompilerSwitchCtorCase
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    (targetScrutinee : Atom) (constructors : Array CtorAlt)
+    (targetPeel : Option NatPeel) (location : Nat) (box : IxIR1.NodeBox)
+    (cid : CtorId) (fields : Array RVal) (alternative : CtorAlt) : Prop where
+  | intro {site : Lower.SourceSite} {blockId : BlockId}
+      {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+      {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+      {alternatives : Array IxIR1.Alt} {generated : Block}
+      {outgoing : List Lower.EdgeTrace} {children : List Lower.CodeTrace}
+      {tag fieldCount alternativeIndex index : Nat} {body : IxIR1.Code}
+      {edge : Lower.EdgeTrace} {child : Lower.CodeTrace}
+      (traceEq : state.trace =
+        .switchValue site blockId input entryValueCount sourceScrutinee peelNat
+          alternatives targetScrutinee generated outgoing children)
+      (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+        .ok (.loc location))
+      (sourceGet : state.sourceStore.get? location = some box)
+      (node : box.node = .ctorN cid fields)
+      (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+        some (.mk tag fieldCount body, alternativeIndex))
+      (fieldArity : fields.size = fieldCount)
+      (terminator : generated.terminator =
+        .switchValue targetScrutinee constructors targetPeel)
+      (targetAt : constructors[index]? = some alternative)
+      (alternativeAt : constructors.find? (fun candidate =>
+        candidate.cid == cid) = some alternative)
+      (edgeAt : outgoing[index]? = some edge)
+      (childAt : children[index]? = some child) :
+      CompilerSwitchCtorCase state targetScrutinee constructors targetPeel
+        location box cid fields alternative
+
+/-- Forget a reconstructed constructor case to its positive compiler macro. -/
+theorem CompilerSwitchCtorCase.compilerMacro
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    {state : CompilerRunningState attached machine}
+    {targetScrutinee : Atom} {constructors : Array CtorAlt}
+    {targetPeel : Option NatPeel} {location : Nat} {box : IxIR1.NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (selected : CompilerSwitchCtorCase state targetScrutinee constructors
+      targetPeel location box cid fields alternative)
+    {context : Eval.Context} {interpretation : Eval.Interpretation} :
+    CompilerMacroStep attached context interpretation machine := by
+  cases selected with
+  | intro traceEq sourceResolved sourceGet node sourceAlternative fieldArity
+      terminator targetAt alternativeAt edgeAt childAt =>
+      exact state.switchCtorMacro traceEq sourceResolved sourceGet node
+        sourceAlternative fieldArity terminator targetAt alternativeAt edgeAt
+        childAt
+
+/-- Reconstruct the complete checked constructor case from the concrete
+target switch selection. The checked capability transition fixes the selected
+source alternative's schema arity, while reachable-heap provenance fixes the
+runtime constructor's arity against that same schema. -/
+theorem switchCtorCaseOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal} {alternative : CtorAlt}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (resolved : Eval.resolveAtom state.frame.values targetScrutinee =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative) :
+    CompilerSwitchCtorCase state targetScrutinee constructors targetPeel
+      location box cid fields alternative := by
+  obtain ⟨site, blockId, input, entryValueCount, sourceScrutinee,
+      peelNat, alternatives, generated, outgoing, children, traceEq,
+      translated, generatedTerminator, _peelShape⟩ :=
+    state.currentSwitchValue blockAt pc terminator
+  have descendant : state.functionTrace.root.Descendant
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.sourceCount
+  have sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.loc location) :=
+    Lower.Sim.resolveAtom_of_envRel_target traceState.target.environments
+      sourceCount translated resolved
+  have sourceGet : state.sourceStore.get? location = some box := by
+    simpa [Eval.Store.get?, state.stores.heap] using boxAt
+  have targetMember : alternative ∈ constructors :=
+    Array.mem_of_find?_eq_some alternativeAt
+  obtain ⟨index, targetAt⟩ := (Array.mem_iff_getElem?).mp targetMember
+  have localMatched := Lower.CodeTrace.switchNodeBranchesMatch_of_match
+    (state.functionTrace.descendantSwitchBranchesMatch descendant)
+  have localCopy := localMatched
+  unfold Lower.switchNodeBranchesMatch at localCopy
+  rw [generatedTerminator] at localCopy
+  simp only [Bool.and_eq_true] at localCopy
+  obtain ⟨⟨⟨outgoingLength, childrenLength⟩, _⟩, _⟩ := localCopy
+  have targetBound : index < constructors.size :=
+    (Array.getElem?_eq_some_iff.mp targetAt).1
+  have edgeBound : index < outgoing.length := by
+    have lengthEq := beq_iff_eq.mp outgoingLength
+    omega
+  have childBound : index < children.length := by
+    have lengthEq := beq_iff_eq.mp childrenLength
+    omega
+  let edge := outgoing[index]'edgeBound
+  let child := children[index]'childBound
+  have edgeAt : outgoing[index]? = some edge :=
+    List.getElem?_eq_some_iff.mpr ⟨edgeBound, rfl⟩
+  have childAt : children[index]? = some child :=
+    List.getElem?_eq_some_iff.mpr ⟨childBound, rfl⟩
+  have branch := Lower.constructorBranchMatchAt_of_switch_match
+    localMatched generatedTerminator targetAt edgeAt childAt
+  have targetCid : alternative.cid = cid := by
+    have matched : (alternative.cid == cid) = true := Array.find?_some
+      (p := fun candidate : CtorAlt => candidate.cid == cid)
+      (a := alternative) (xs := constructors) alternativeAt
+    exact beq_iff_eq.mp matched
+  have sourceAlternative := branch.sourceAlternative
+  rw [targetCid] at sourceAlternative
+  obtain ⟨world, schema, schemaAt, schemaArity⟩ :=
+    attached.target.constructorBranchSchemaArity state.member descendant
+      generatedTerminator targetAt childAt branch
+  have targetSchemaAt :
+      attached.target.artifact.validationContext.schemas world cid =
+        some schema := by
+    rw [← targetCid]
+    exact schemaAt
+  obtain ⟨_rawStore, _imageEq, constructorsValid⟩ := state.image
+  have known : attached.sidecars.constructorKnown cid fields.size = true := by
+    cases box with
+    | mk boxWorld rc boxNode =>
+        change boxNode = .ctorN cid fields at node
+        subst boxNode
+        exact constructorsValid.constructorKnown sourceGet
+  have loweringSchemaAt : attached.loweringContext.schemas world cid =
+      some schema := by
+    rw [← attached.targetSchemasProduced]
+    exact targetSchemaAt
+  have runtimeFields : schema.fields = Array.replicate fields.size world :=
+    attached.schema_fields_of_constructorKnown known loweringSchemaAt
+  have runtimeArity : schema.fields.size = fields.size := by
+    rw [runtimeFields]
+    simp
+  have fieldArity : fields.size = branch.fieldCount :=
+    runtimeArity.symm.trans schemaArity
+  exact .intro traceEq sourceResolved sourceGet node sourceAlternative
+    fieldArity generatedTerminator targetAt alternativeAt edgeAt childAt
+
+/-- Compiler-macro projection of `switchCtorCaseOfTarget`. -/
+theorem switchCtorMacroOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal} {alternative : CtorAlt}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (resolved : Eval.resolveAtom state.frame.values targetScrutinee =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative) :
+    CompilerMacroStep attached context interpretation machine :=
+  (state.switchCtorCaseOfTarget blockAt pc terminator resolved boxAt node
+    alternativeAt).compilerMacro
+
+/-- A return with an empty continuation stack reaches a halted compiler state.
+The checked return capability audit derives the result-world fact required by
+the target evaluator, so it is not an external premise. -/
+theorem returnHalt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (traceEq : state.trace =
+      .ret site blockId input entryValueCount sourceAtom targetAtom generated)
+    (stackEq : state.stack = []) {value : RVal}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok value) :
+    let haltedMachine : Machine :=
+      { machine with control := .halted value }
+    IxIR1.runCode sourceContext (sourceFuel + 1)
+          state.functionTrace.source state.sourceStore state.source
+            (.ret sourceAtom) = .ok (state.sourceStore, value) ∧
+      Eval.Steps context interpretation 1 machine haltedMachine ∧
+      CompilerState attached haltedMachine ∧
+      ∀ rewritten,
+        StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext haltedMachine
+            rewritten := by
+  dsimp only
+  have descendant : state.functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom
+        generated) := by
+    rw [← traceEq]
+    exact state.descendant
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) state.member descendant ownership
+      sourceResolved
+  have generatedWorld : IxIR1.Sim.HasWorld state.sourceStore
+      state.functionTrace.generated.signature.result value :=
+    terminalOwnership.roots_world
+      ⟨state.functionTrace.generated.signature.result, value⟩ (by simp)
+  have sourceWorld : IxIR1.Sim.HasWorld state.sourceStore
+      state.functionTrace.source.result value := by
+    simpa [state.functionTrace.sourceResult] using generatedWorld
+  have targetWorld := traceState.target.resultWorld state.stores sourceWorld
+  have control : machine.control = .running state.frame [] := by
+    simpa [stackEq] using state.control
+  obtain ⟨sourceRun, targetSteps, _⟩ :=
+    Lower.Sim.simulate_traced_ret_halt_state
+      (sourceContext := sourceContext)
+      (sourceCurrent := state.functionTrace.source)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) descendant traceState.target
+      state.stores sourceResolved control state.noCredits targetWorld
+  exact ⟨sourceRun, targetSteps, .halted rfl,
+    fun _rewritten => StableLiveAcceptedEntry.halted rfl⟩
+
+/-- Reconstruct an empty-stack compiler return directly from the concrete
+target return operand.  The checked environment map supplies the source
+operand, while terminal ownership derives the result-world check. -/
+theorem returnHaltOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {sourceContext : IxIR1.Ctx} {sourceFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetAtom : Atom} {value : RVal}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom)
+    (stackEq : state.stack = [])
+    (resolved : Eval.resolveAtom state.frame.values targetAtom = .ok value) :
+    let haltedMachine : Machine := { machine with control := .halted value }
+    Eval.Step context interpretation machine haltedMachine ∧
+      CompilerState attached haltedMachine ∧
+      ∀ rewritten,
+        StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext haltedMachine
+            rewritten := by
+  dsimp only
+  obtain ⟨site, blockId, input, entryValueCount, sourceAtom, generated,
+      traceEq, translated⟩ :=
+    state.currentReturn blockAt pc terminator
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using
+      traceState.target.sourceCount
+  have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+      .ok value :=
+    Lower.Sim.resolveAtom_of_envRel_target traceState.target.environments
+      sourceCount translated resolved
+  obtain ⟨_sourceRun, targetSteps, compiler, acceptedEntry⟩ :=
+    state.returnHalt (sourceContext := sourceContext)
+      (sourceFuel := sourceFuel) (context := context)
+      (interpretation := interpretation) traceEq stackEq sourceResolved
+  have targetStep : Eval.Step context interpretation machine
+      { machine with control := .halted value } := by
+    cases targetSteps with
+    | cons _running head tail =>
+        cases tail
+        exact head
+  exact ⟨targetStep, compiler, acceptedEntry⟩
+
+/-- A checked source return closes the active history, even when intervening
+tail calls have replaced the frame originally entered by the caller. -/
+theorem returnCompletion
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (traceEq : state.trace =
+      .ret site blockId input entryValueCount sourceAtom targetAtom generated)
+    {value : RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceAtom = .ok value) :
+    CompilerStackCompletion attached attached.simulationSourceContext
+      state.callStack state.sourceStore value := by
+  have descendant : state.functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated) := by
+    rw [← traceEq]
+    exact state.descendant
+  have ownership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      state.sourceStore state.source state.frameRoots := by
+    rw [← traceEq]
+    exact state.ownership
+  have terminal := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) state.member descendant ownership sourceResolved
+  have world : IxIR1.Sim.HasWorld state.sourceStore
+      state.functionTrace.source.result value := by
+    have generatedWorld := terminal.roots_world
+      ⟨state.functionTrace.generated.signature.result, value⟩ (by simp)
+    simpa [state.functionTrace.sourceResult] using generatedWorld
+  apply state.history.complete (out := (state.sourceStore, value)) _ world
+  refine ⟨1, ?_⟩
+  simp [traceEq, Lower.CodeTrace.sourceCode, IxIR1.runCode,
+    sourceResolved, bind, Except.bind]
+
+/-- A checked callee return pops one
+ordinary-call continuation and reconstruct the full compiler running state of
+the suspended caller. The indexed stack witness restores the caller trace,
+ownership suffix, live-stack support, heap image, and recursive stack tail. -/
+theorem returnResume
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {returnFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (traceEq : state.trace =
+      .ret site blockId input entryValueCount sourceAtom targetAtom generated)
+    {value : RVal}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok value)
+    {caller : Frame} {rest : List Continuation}
+    (stackEq : state.stack = .resume caller :: rest) :
+    ∃ nextMachine : Machine,
+      ∃ _ : CompilerRunningState attached nextMachine,
+        IxIR1.runCode attached.simulationSourceContext (returnFuel + 1)
+              state.functionTrace.source state.sourceStore state.source
+                (.ret sourceAtom) = .ok (state.sourceStore, value) ∧
+          Eval.Steps context interpretation 1 machine nextMachine ∧
+          ∀ {rewritten : Machine},
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext nextMachine
+                rewritten := by
+  have completed := (state.returnCompletion traceEq sourceResolved).ordinary stackEq
+  rcases state with ⟨functionTrace, trace, sourceStore, source, frameRoots,
+    frame, stack, member, descendant, traceState, stores, runtime, ownership,
+    stackRoots, callStack, history, image, control, noCredits⟩
+  dsimp only at traceEq sourceResolved completed ⊢
+  have returnDescendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom
+        generated) := by
+    rw [← traceEq]
+    exact descendant
+  have returnState : attached.sidecars.TraceStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frame := by
+    rw [← traceEq]
+    exact traceState
+  have returnOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frameRoots := by
+    rw [← traceEq]
+    exact ownership
+  have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) member returnDescendant returnOwnership
+      sourceResolved
+  have generatedWorld : IxIR1.Sim.HasWorld sourceStore
+      functionTrace.generated.signature.result value :=
+    terminalOwnership.roots_world
+      ⟨functionTrace.generated.signature.result, value⟩ (by simp)
+  have sourceWorld : IxIR1.Sim.HasWorld sourceStore
+      functionTrace.source.result value := by
+    simpa [functionTrace.sourceResult] using generatedWorld
+  have targetWorld := returnState.target.resultWorld stores sourceWorld
+  cases callStack with
+  | nil =>
+      simp [CompilerStackReturn] at completed
+  | @addressed callerTrace callerMember callSite callBlock callInput nextInput
+      callEntryValueCount callIndex sourceAddress targetAddress sourceArguments
+      targetArguments next calleeTrace calleeMember sourceDefinition
+      targetDefinition calleeMatch callerDescendant callerStore callerSource
+      values callerFrameRoots callerFrame callerStack callerState callerRuntime
+      callerOwnership callerStackRoots callerImage callerNoCredits resolved
+      before remaining signatureAt beforeMember beforeCoordinate consumed tail =>
+      simp only [CompilerStackReturn] at completed
+      simp only [CompilerStackHistory] at history
+      obtain ⟨callFuel, sourceDeclarations, sourceDeclaration, operationRun⟩ :=
+        completed
+      have expectedWorld : IxIR1.Sim.HasWorld sourceStore
+          calleeTrace.generated.signature.result value := by
+        have declaredWorld := IxIR1.Sim.runOp_call_result_hasWorld resolved
+          sourceDeclaration operationRun
+        simpa [calleeTrace.sourceResult, calleeMatch.source] using declaredWorld
+      have returnedOwnership : IxIR1.Sim.RootOwnership sourceStore
+          (⟨calleeTrace.generated.signature.result, value⟩ ::
+            (Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+              callerFrameRoots)) :=
+        Lower.Sim.RootOwnership_reworldHead terminalOwnership expectedWorld
+      have nextOwnership := Lower.Sim.SourceOwnershipAt.callResult
+        (checked := attached.target) callerMember signatureAt callerDescendant
+        beforeMember beforeCoordinate callerOwnership resolved consumed
+        returnedOwnership
+      let nextCallerFrame : Frame :=
+        { callerFrame with
+          pc := callerFrame.pc + 1
+          values := callerFrame.values.push value }
+      let nextMachine : Machine :=
+        { machine with control := .running nextCallerFrame callerStack }
+      obtain ⟨sourceReturn, targetSteps, nextStores, nextTraceState⟩ :=
+        attached.simulate_traced_return_to_letOp_state
+          (sourceFuel := returnFuel) (operationFuel := callFuel + 1)
+          (context := context) (interpretation := interpretation)
+          callerMember callerDescendant returnDescendant callerState returnState
+          (binder := by rfl) (delta := by rfl) stores sourceDeclarations
+          operationRun sourceResolved control noCredits targetWorld
+      have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+          (value :: callerSource) :=
+        callerRuntime.runOp
+          (IxIR1.NoReuse.runOp_reuses_eq
+            (attached.sourceContextNoReuse sourceDeclarations)
+            (attached.functionTraceNoReuse callerMember) (by trivial)
+            operationRun)
+          operationRun
+      have nextImage : attached.SourceStoreImage sourceStore :=
+        attached.runOp_preservesSourceStoreImage sourceDeclarations
+          callerMember callerDescendant callerState callerImage operationRun
+      have nextDescendant : callerTrace.root.Descendant next :=
+        .step callerDescendant (by simp [Lower.CodeTrace.children])
+      have nextState : CompilerRunningState attached nextMachine :=
+        { functionTrace := callerTrace
+          trace := next
+          sourceStore := sourceStore
+          source := value :: callerSource
+          frameRoots := callerFrameRoots
+          frame := nextCallerFrame
+          stack := callerStack
+          member := callerMember
+          descendant := nextDescendant
+          traceState := by simpa [nextCallerFrame] using nextTraceState
+          stores := by simpa [nextMachine] using nextStores
+          runtime := nextRuntime
+          ownership := nextOwnership
+          stackRoots := callerStackRoots
+          callStack := tail
+          history := history.2.advance (IxIR1.ExecutionHistory.stepOp operationRun)
+          image := nextImage
+          control := by rfl
+          noCredits := by
+            simpa [nextCallerFrame] using callerNoCredits }
+      obtain ⟨callerBlockAt, _callerPcBound, callAt⟩ :=
+        callerState.target.instructionAt callerDescendant
+      have nextBlockAt : nextCallerFrame.definition.blocks[
+          nextCallerFrame.block]? = some next.headBlock.2 := by
+        simpa [nextCallerFrame] using callerBlockAt
+      have acceptedEntry : ∀ {rewritten : Machine},
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+        intro rewritten
+        exact StableLiveAcceptedEntry.ofCallResume rfl nextBlockAt
+          (by simpa [nextCallerFrame] using callAt)
+      exact ⟨nextMachine, nextState, sourceReturn,
+        by simpa [nextMachine, nextCallerFrame] using targetSteps,
+        acceptedEntry⟩
+  | @self callerTrace callerMember callSite callBlock callInput nextInput
+      callEntryValueCount callIndex sourceArguments targetArguments next
+      callerDescendant callerStore callerSource values callerFrameRoots
+      callerFrame callerStack callerState callerRuntime callerOwnership
+      callerStackRoots callerImage callerNoCredits resolved before remaining
+      beforeMember beforeCoordinate consumed tail =>
+      simp only [CompilerStackReturn] at completed
+      simp only [CompilerStackHistory] at history
+      obtain ⟨callFuel, sourceDeclarations, operationRun⟩ := completed
+      have expectedWorld : IxIR1.Sim.HasWorld sourceStore
+          callerTrace.generated.signature.result value := by
+        have declaredWorld := IxIR1.Sim.runOp_callSelf_result_hasWorld resolved
+          operationRun
+        simpa [callerTrace.sourceResult] using declaredWorld
+      have returnedOwnership : IxIR1.Sim.RootOwnership sourceStore
+          (⟨callerTrace.generated.signature.result, value⟩ ::
+            (Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+              callerFrameRoots)) :=
+        Lower.Sim.RootOwnership_reworldHead terminalOwnership expectedWorld
+      have nextOwnership := Lower.Sim.SourceOwnershipAt.callSelfResult
+        (checked := attached.target) callerMember callerDescendant beforeMember
+        beforeCoordinate callerOwnership resolved consumed returnedOwnership
+      let nextCallerFrame : Frame :=
+        { callerFrame with
+          pc := callerFrame.pc + 1
+          values := callerFrame.values.push value }
+      let nextMachine : Machine :=
+        { machine with control := .running nextCallerFrame callerStack }
+      obtain ⟨sourceReturn, targetSteps, nextStores, nextTraceState⟩ :=
+        attached.simulate_traced_return_to_letOp_state
+          (sourceFuel := returnFuel) (operationFuel := callFuel + 1)
+          (context := context) (interpretation := interpretation)
+          callerMember callerDescendant returnDescendant callerState returnState
+          (binder := by rfl) (delta := by rfl) stores sourceDeclarations
+          operationRun sourceResolved control noCredits targetWorld
+      have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+          (value :: callerSource) :=
+        callerRuntime.runOp
+          (IxIR1.NoReuse.runOp_reuses_eq
+            (attached.sourceContextNoReuse sourceDeclarations)
+            (attached.functionTraceNoReuse callerMember) (by trivial)
+            operationRun)
+          operationRun
+      have nextImage : attached.SourceStoreImage sourceStore :=
+        attached.runOp_preservesSourceStoreImage sourceDeclarations
+          callerMember callerDescendant callerState callerImage operationRun
+      have nextDescendant : callerTrace.root.Descendant next :=
+        .step callerDescendant (by simp [Lower.CodeTrace.children])
+      have nextState : CompilerRunningState attached nextMachine :=
+        { functionTrace := callerTrace
+          trace := next
+          sourceStore := sourceStore
+          source := value :: callerSource
+          frameRoots := callerFrameRoots
+          frame := nextCallerFrame
+          stack := callerStack
+          member := callerMember
+          descendant := nextDescendant
+          traceState := by simpa [nextCallerFrame] using nextTraceState
+          stores := by simpa [nextMachine] using nextStores
+          runtime := nextRuntime
+          ownership := nextOwnership
+          stackRoots := callerStackRoots
+          callStack := tail
+          history := history.2.advance (IxIR1.ExecutionHistory.stepOp operationRun)
+          image := nextImage
+          control := by rfl
+          noCredits := by
+            simpa [nextCallerFrame] using callerNoCredits }
+      obtain ⟨callerBlockAt, _callerPcBound, callAt⟩ :=
+        callerState.target.instructionAt callerDescendant
+      have nextBlockAt : nextCallerFrame.definition.blocks[
+          nextCallerFrame.block]? = some next.headBlock.2 := by
+        simpa [nextCallerFrame] using callerBlockAt
+      have acceptedEntry : ∀ {rewritten : Machine},
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+        intro rewritten
+        exact StableLiveAcceptedEntry.ofCallSelfResume rfl nextBlockAt
+          (by simpa [nextCallerFrame] using callAt)
+      exact ⟨nextMachine, nextState, sourceReturn,
+        by simpa [nextMachine, nextCallerFrame] using targetSteps,
+        acceptedEntry⟩
+  | @applyExact callerTrace callerMember applySite applyBlock applyInput
+      nextInput applyEntryValueCount applyIndex sourceFunction targetFunction
+      sourceArguments targetArguments next callerDescendant callerStore
+      callerSource callerFrameRoots callerFrame callerStack callerState
+      callerRuntime callerOwnership callerStackRoots callerImage
+      callerNoCredits remaining tail =>
+      simp only [CompilerStackReturn] at completed
+      simp only [CompilerStackHistory] at history
+      obtain ⟨applyFuel, sourceDeclarations, operationRun⟩ := completed
+      have nextOwnership : Lower.Sim.SourceOwnershipAt
+          attached.target.artifact.trace.positions next sourceStore
+            (value :: callerSource) callerFrameRoots :=
+        Lower.Sim.SourceOwnershipAt.applyFrom (checked := attached.target)
+          callerMember callerDescendant callerOwnership
+            (attached.applyOwnershipPreservesFrom_sourceStoreImage_of_declarations
+              sourceDeclarations callerImage) operationRun
+      let nextCallerFrame : Frame :=
+        { callerFrame with
+          pc := callerFrame.pc + 1
+          values := callerFrame.values.push value }
+      let nextMachine : Machine :=
+        { machine with control := .running nextCallerFrame callerStack }
+      obtain ⟨sourceReturn, targetSteps, nextStores, nextTraceState⟩ :=
+        attached.simulate_traced_return_to_letOp_state
+          (sourceFuel := returnFuel) (operationFuel := applyFuel + 2)
+          (context := context) (interpretation := interpretation)
+          callerMember callerDescendant returnDescendant callerState returnState
+          (binder := by rfl) (delta := by rfl) stores sourceDeclarations
+          operationRun sourceResolved control noCredits targetWorld
+      have nextRuntime : Lower.Sim.SourceRuntimeInvariant sourceStore
+          (value :: callerSource) :=
+        callerRuntime.runOp
+          (IxIR1.NoReuse.runOp_reuses_eq
+            (attached.sourceContextNoReuse sourceDeclarations)
+            (attached.functionTraceNoReuse callerMember) (by trivial)
+            operationRun)
+          operationRun
+      have nextImage : attached.SourceStoreImage sourceStore :=
+        attached.runOp_preservesSourceStoreImage sourceDeclarations
+          callerMember callerDescendant callerState callerImage operationRun
+      have nextDescendant : callerTrace.root.Descendant next :=
+        .step callerDescendant (by simp [Lower.CodeTrace.children])
+      have nextState : CompilerRunningState attached nextMachine :=
+        { functionTrace := callerTrace
+          trace := next
+          sourceStore := sourceStore
+          source := value :: callerSource
+          frameRoots := callerFrameRoots
+          frame := nextCallerFrame
+          stack := callerStack
+          member := callerMember
+          descendant := nextDescendant
+          traceState := by simpa [nextCallerFrame] using nextTraceState
+          stores := by simpa [nextMachine] using nextStores
+          runtime := nextRuntime
+          ownership := nextOwnership
+          stackRoots := callerStackRoots
+          callStack := tail
+          history := history.2.advance (IxIR1.ExecutionHistory.stepOp operationRun)
+          image := nextImage
+          control := by rfl
+          noCredits := by
+            simpa [nextCallerFrame] using callerNoCredits }
+      obtain ⟨callerBlockAt, _callerPcBound, applyAt⟩ :=
+        callerState.target.instructionAt callerDescendant
+      have nextBlockAt : nextCallerFrame.definition.blocks[
+          nextCallerFrame.block]? = some next.headBlock.2 := by
+        simpa [nextCallerFrame] using callerBlockAt
+      have acceptedEntry : ∀ {rewritten : Machine},
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext nextMachine
+              rewritten := by
+        intro rewritten
+        exact StableLiveAcceptedEntry.ofApplyResume rfl nextBlockAt
+          (by simpa [nextCallerFrame] using applyAt)
+      exact ⟨nextMachine, nextState, sourceReturn,
+        by simpa [nextMachine, nextCallerFrame] using targetSteps,
+        acceptedEntry⟩
+  | applyMore _ _ _ _ _ _ _ _ _ _ _ =>
+      simp [CompilerStackReturn] at completed
+
+/-- Reconstruct an ordinary return from a concrete target step. The source
+operand is reflected from the checked environment, and source completion
+comes entirely from the compiler history. -/
+theorem returnResumeOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Machine} (state : CompilerRunningState attached machine)
+    {block : Block} {targetAtom : Atom} {value : RVal}
+    {caller : Frame} {rest : List Continuation}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret targetAtom)
+    (stackEq : state.stack = .resume caller :: rest)
+    (resolved : Eval.resolveAtom state.frame.values targetAtom = .ok value)
+    (actualStep : Eval.Step context interpretation machine target) :
+    ∃ _ : CompilerRunningState attached target,
+      Eval.Step context interpretation machine target ∧
+        ∀ rewritten,
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext target rewritten := by
+  obtain ⟨site, blockId, input, entryValueCount, sourceAtom, generated,
+      traceEq, translated⟩ := state.currentReturn blockAt pc terminator
+  have traceState : attached.sidecars.TraceStateRel state.functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using traceState.target.sourceCount
+  have sourceResolved : IxIR1.resolveAtom state.source sourceAtom =
+      .ok value := Lower.Sim.resolveAtom_of_envRel_target
+    traceState.target.environments sourceCount translated resolved
+  obtain ⟨nextMachine, nextState, _sourceReturn, targetSteps, acceptedEntry⟩ :=
+    state.returnResume (returnFuel := 0) (context := context)
+      (interpretation := interpretation) traceEq sourceResolved stackEq
+  have generatedStep : Eval.Step context interpretation machine nextMachine := by
+    cases targetSteps with
+    | cons _running head tail =>
+        cases tail
+        exact head
+  have targetEq := generatedStep.deterministic actualStep
+  subst nextMachine
+  exact ⟨nextState, actualStep, fun _ => acceptedEntry⟩
+
+/-- Reconstruct the source PAP preparation from an owned return value and
+the concrete target retain/release prefix. The resulting store relation uses
+the target's actual remaining heap budget. -/
+private theorem returnedPapPreparation
+    {sourceContext : IxIR1.Ctx}
+    {sourceStore : IxIR1.Store} {targetStore targetRetained targetReleased : Store}
+    {heapFuel remainingFuel location : Nat} {box : IxIR1.NodeBox}
+    {address : Ixon.Address} {arity : Nat} {captured : Array RVal}
+    {roots : List IxIR1.Sim.Root}
+    (ownership : IxIR1.Sim.RootOwnership sourceStore
+      (⟨.shared, .loc location⟩ :: roots))
+    (stores : Lower.Sim.StoreRel sourceStore targetStore)
+    (positive : Lower.Sim.PositiveSharedRC sourceStore)
+    (sourceGet : sourceStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (retained : Eval.RetainSharedMany targetStore captured targetRetained)
+    (released : Eval.releaseSharedWork heapFuel targetRetained [.loc location] =
+      .ok (targetReleased, remainingFuel)) :
+    ∃ sourceFuel sourceRetained sourceReleased,
+      IxIR1.dupVals sourceStore captured.toList = .ok sourceRetained ∧
+        IxIR1.dropVal sourceContext sourceFuel sourceRetained (.loc location) =
+          .ok sourceReleased ∧
+        Lower.Sim.StoreRel sourceReleased targetReleased := by
+  have capturedWorlds : ∀ value ∈ captured.toList,
+      IxIR1.Sim.HasWorld sourceStore .shared value := by
+    intro value member
+    have world := ownership.edges_world sourceGet value (by
+      rw [node]
+      simpa [IxIR1.Sim.nodeChildren] using member)
+    simpa [shared] using world
+  obtain ⟨sourceRetained, sourceRetain⟩ :=
+    IxIR1.LowerSim.dupVals_progress_of_hasWorld capturedWorlds
+  have retainedOwnership := IxIR1.Sim.dupVals_borrowedMany_preserves
+    ownership capturedWorlds sourceRetain
+  have papFirst : IxIR1.Sim.RootOwnership sourceRetained
+      (⟨.shared, .loc location⟩ ::
+        IxIR1.Sim.rootsFor .shared captured.toList ++ roots) := by
+    apply retainedOwnership.perm
+    simp
+  obtain ⟨sourceFuel, sourceReleased, sourceRelease, _⟩ :=
+    IxIR1.dropVal_progress (ctx := sourceContext) papFirst
+  obtain ⟨generatedRetained, generatedReleased, _localFuel, generatedRetain,
+      _retainedStores, generatedRelease, releasedStores⟩ :=
+    Lower.Sim.simulate_apply_pap_prepare stores positive sourceRetain sourceRelease
+  have retainedEq : generatedRetained = targetRetained := by
+    unfold Eval.RetainSharedMany at generatedRetain retained
+    rw [generatedRetain] at retained
+    injection retained
+  rw [retainedEq] at generatedRelease
+  obtain ⟨releasedEq, _fuelEq⟩ :=
+    Lower.Sim.releaseSharedWork_success_unique generatedRelease released
+  exact ⟨sourceFuel, sourceRetained, sourceReleased, sourceRetain,
+    sourceRelease, releasedEq ▸ releasedStores⟩
+
+/-- Advance residual application directly from the successful target
+dispatcher. Immediate results restore the original caller; saturation enters
+the next callee with the same saved caller and a composed source history. -/
+theorem returnApplyMoreTransfer
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Machine} (state : CompilerRunningState attached machine)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (traceEq : state.trace =
+      .ret site blockId input entryValueCount sourceAtom targetAtom generated)
+    {value : RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceAtom = .ok value)
+    {caller : Frame} {arguments : Array RVal} {rest : List Continuation}
+    (stackEq : state.stack = .applyMore arguments caller :: rest)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel value arguments caller rest target) :
+    ∃ _ : CompilerRunningState attached target,
+      ∀ rewritten,
+        StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext target rewritten := by
+  have completed := state.returnCompletion traceEq sourceResolved
+  rcases state with ⟨functionTrace, trace, sourceStore, source, frameRoots,
+    frame, stack, member, descendant, traceState, stores, runtime, ownership,
+    stackRoots, callStack, history, image, control, noCredits⟩
+  dsimp only at traceEq sourceResolved stackEq completed
+  have returnDescendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated) := by
+    rw [← traceEq]
+    exact descendant
+  have returnOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frameRoots := by
+    rw [← traceEq]
+    exact ownership
+  have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) member returnDescendant returnOwnership sourceResolved
+  cases callStack with
+  | nil => cases stackEq
+  | addressed => cases stackEq
+  | self => cases stackEq
+  | applyExact => cases stackEq
+  | @applyMore callerTrace callerMember applySite applyBlock applyInput
+      nextInput applyEntryValueCount applyIndex sourceFunction targetFunction
+      sourceArguments targetArguments next callerDescendant callerStore
+      callerSource callerFrameRoots callerFrame callerStack callerState
+      callerRuntime callerOwnership callerStackRoots callerImage
+      callerNoCredits remaining callerFrameSupported sourceResidual
+      targetResidual residuals tail =>
+      obtain ⟨headEq, restEq⟩ := List.cons.inj stackEq
+      obtain ⟨rfl, rfl⟩ := Continuation.applyMore.inj headEq
+      subst rest
+      simp only [CompilerStackCompletion] at completed
+      simp only [CompilerStackHistory] at history
+      let resume : Frame := { callerFrame with pc := callerFrame.pc + 1 }
+      let suspendedRoots :=
+        Lower.Sim.rootsForCapabilities remaining.toList callerSource ++ callerFrameRoots
+      obtain ⟨callerBlockAt, _callerPcBound, applyAt⟩ :=
+        callerState.target.instructionAt callerDescendant
+      have resumeResult : ∀ {outputStore : IxIR1.Store} {outputValue : RVal}
+          {targetStore : Store} {remainingFuel fuel : Nat},
+          IxIR1.applyGo attached.simulationSourceContext fuel sourceStore value
+            sourceResidual = .ok (outputStore, outputValue) →
+          Lower.Sim.StoreRel outputStore targetStore →
+          ∃ _ : CompilerRunningState attached
+            { store := targetStore
+              heapFuel := remainingFuel
+              control := .running
+                { resume with values := resume.values.push outputValue } callerStack },
+            ∀ rewritten,
+              StableLiveAcceptedEntry Validate.defaultLimits
+                attached.target.artifact.validationContext
+                { store := targetStore
+                  heapFuel := remainingFuel
+                  control := .running
+                    { resume with values := resume.values.push outputValue } callerStack }
+                rewritten := by
+        intro outputStore outputValue targetStore remainingFuel fuel applied outputStores
+        obtain ⟨operationFuel, operationRun⟩ := completed applied
+        refine ⟨?_, ?_⟩
+        · simpa [resume] using resumedApplyCaller callerMember callerDescendant
+            callerState callerRuntime callerOwnership callerStackRoots callerImage
+            callerNoCredits tail history.2 rfl operationRun
+            (heapFuel := remainingFuel) outputStores
+        · intro rewritten
+          exact StableLiveAcceptedEntry.ofApplyResume rfl
+            (by simpa [resume] using callerBlockAt)
+            (by simpa [resume] using applyAt)
+      cases transferred.classify with
+      | @erased outStore outHeapFuel released =>
+          have argumentsOwnership : IxIR1.Sim.RootOwnership sourceStore
+              (IxIR1.Sim.rootsFor .shared sourceResidual ++ suspendedRoots) :=
+            terminalOwnership.dropNoLocation rfl
+          obtain ⟨sourceFuel, sourceReleased, sourceRelease, _⟩ :=
+            IxIR1.dropMany_progress (ctx := attached.simulationSourceContext)
+              argumentsOwnership
+          obtain ⟨_localFuel, generatedReleased, generatedRelease,
+              releasedStores, _⟩ :=
+            Lower.Sim.dropMany_simulates_releaseSharedWork runtime.positiveSharedRC
+              stores sourceRelease
+          rw [residuals] at released
+          obtain ⟨releasedEq, _fuelEq⟩ :=
+            Lower.Sim.releaseSharedWork_success_unique generatedRelease released
+          have sourceApply : IxIR1.applyGo attached.simulationSourceContext
+              (sourceFuel + 1) sourceStore .erased sourceResidual =
+                .ok (sourceReleased, .erased) := by
+            simp [IxIR1.applyGo, sourceRelease, bind, Except.bind]
+          exact resumeResult sourceApply (releasedEq ▸ releasedStores)
+      | papExtern _ _ _ _ _ _ _ declaration _ _ _ =>
+          exact (attached.targetDeclaration_not_extern targetDeclarations declaration).elim
+      | @papUnder location box address arity captured targetRetained targetReleased
+          remainingFuel boxAt shared node _capturedUnder retained released totalUnder =>
+          have sourceGet : sourceStore.get? location = some box := by
+            simpa [Eval.Store.get?, stores.heap] using boxAt
+          have sharedWorld : IxIR1.Sim.HasWorld sourceStore .shared (.loc location) :=
+            ⟨box, sourceGet, shared⟩
+          have returnedOwnership :=
+            Lower.Sim.RootOwnership_reworldHead terminalOwnership sharedWorld
+          obtain ⟨sourceFuel, sourceRetained, sourceReleased, sourceRetain,
+              sourceRelease, releasedStores⟩ :=
+            returnedPapPreparation (sourceContext := attached.simulationSourceContext)
+              returnedOwnership stores runtime.positiveSharedRC sourceGet shared node
+              retained released
+          let pap := IxIR1.Node.papN address arity (captured ++ targetResidual)
+          have sourceUnder : captured.size + sourceResidual.length < arity := by
+            simpa [← residuals] using totalUnder
+          have payloadEq : (captured.toList ++ sourceResidual).toArray =
+              captured ++ targetResidual := by
+            apply Array.toList_inj.mp
+            simp [residuals]
+          have sourceApply : IxIR1.applyGo attached.simulationSourceContext
+              (sourceFuel + 1) sourceStore (.loc location) sourceResidual =
+                .ok ((sourceReleased.allocNode .shared pap).1,
+                  .loc (sourceReleased.allocNode .shared pap).2) := by
+            simp [IxIR1.applyGo, sourceGet, node, sourceRetain, sourceRelease,
+              sourceUnder, payloadEq, pap, bind, Except.bind]
+          have locationEq := releasedStores.alloc_location .shared pap
+          obtain ⟨resumedState, resumedEntry⟩ :=
+            resumeResult sourceApply (releasedStores.alloc .shared pap)
+              (remainingFuel := remainingFuel)
+          rw [← locationEq] at resumedState resumedEntry
+          exact ⟨resumedState, resumedEntry⟩
+      | @papFn location box address arity captured targetRetained targetReleased
+          remainingFuel definition boxAt shared node _capturedUnder retained
+          released totalEnough declaration papSafe suppliedArity _nonempty =>
+          have sourceGet : sourceStore.get? location = some box := by
+            simpa [Eval.Store.get?, stores.heap] using boxAt
+          have sharedWorld : IxIR1.Sim.HasWorld sourceStore .shared (.loc location) :=
+            ⟨box, sourceGet, shared⟩
+          have returnedOwnership :=
+            Lower.Sim.RootOwnership_reworldHead terminalOwnership sharedWorld
+          obtain ⟨sourceFuel, sourceRetained, sourceReleased, sourceRetain,
+              sourceRelease, releasedStores⟩ :=
+            returnedPapPreparation (sourceContext := attached.simulationSourceContext)
+              returnedOwnership stores runtime.positiveSharedRC sourceGet shared node
+              retained released
+          obtain ⟨sourceDefinition, calleeTrace, calleeMember, calleeMatch,
+              sourceDeclaration⟩ :=
+            attached.functionTrace_of_target_declaration
+              (sourceContext := attached.simulationSourceContext) rfl
+              targetDeclarations declaration
+          let sourceTotal := captured.toList ++ sourceResidual
+          let sourceSupplied := sourceTotal.take arity
+          let sourceRemaining := sourceTotal.drop arity
+          let targetTotal := captured ++ targetResidual
+          let targetSupplied := targetTotal.extract 0 arity
+          let targetRemaining := targetTotal.extract arity targetTotal.size
+          let calleeFrame : Frame := { definition, values := targetSupplied }
+          let calleeRoots := IxIR1.Sim.rootsFor .shared sourceRemaining ++ suspendedRoots
+          have totalValues : targetTotal.toList = sourceTotal := by
+            simp [targetTotal, sourceTotal, residuals]
+          have totalLength : targetTotal.size = sourceTotal.length := by
+            simpa using congrArg List.length totalValues
+          have suppliedValues : targetSupplied.toList = sourceSupplied := by
+            change (targetTotal.extract 0 arity).toList = sourceSupplied
+            rw [Array.toList_extract, List.extract_eq_take_drop, totalValues]
+            simp [sourceSupplied]
+          have remainingValues : targetRemaining.toList = sourceRemaining := by
+            change (targetTotal.extract arity targetTotal.size).toList = sourceRemaining
+            rw [Array.toList_extract, List.extract_eq_take_drop, totalValues, totalLength]
+            exact List.take_of_length_le (by simp)
+          have sourceEnough : arity ≤ sourceTotal.length := by
+            simpa [sourceTotal, ← residuals] using totalEnough
+          have suppliedLength : sourceSupplied.length = arity := by
+            simp [sourceSupplied, sourceEnough]
+          have targetLength : targetSupplied.size = arity := by
+            have lengthEq := congrArg List.length suppliedValues
+            simpa [suppliedLength] using lengthEq
+          have papArity : arity = sourceDefinition.arity := by
+            calc
+              arity = definition.signature.params.size := targetLength.symm.trans suppliedArity
+              _ = calleeTrace.generated.signature.params.size := by rw [calleeMatch.generated]
+              _ = calleeTrace.source.arity := calleeTrace.sourceArity
+              _ = sourceDefinition.arity := congrArg IxIR1.FnDef.arity calleeMatch.source
+          have calleePapSafe : calleeTrace.generated.signature.papSafe = true := by
+            simpa [calleeMatch.generated] using papSafe
+          have sourcePapSafe : sourceDefinition.papSafe = true := by
+            simpa [calleeTrace.sourcePapSafe, calleeMatch.source] using calleePapSafe
+          have entryArity : sourceSupplied.length =
+              calleeTrace.generated.signature.params.size := by
+            rw [suppliedLength, papArity, calleeTrace.sourceArity, calleeMatch.source]
+          have papAt : sourceStore.get? location =
+              some ⟨.shared, box.rc, .papN address arity captured⟩ := by
+            simpa only [← shared, ← node] using sourceGet
+          have preparedOwnership := IxIR1.Sim.applyGo_preparePap_owned papAt
+            returnedOwnership sourceRetain sourceRelease
+          have readyOwnership : IxIR1.Sim.RootOwnership sourceReleased
+              (IxIR1.Sim.rootsFor .shared sourceSupplied ++ calleeRoots) := by
+            change IxIR1.Sim.RootOwnership sourceReleased
+              (IxIR1.Sim.rootsFor .shared sourceTotal ++ suspendedRoots) at preparedOwnership
+            have splitTotal : sourceTotal = sourceSupplied ++ sourceRemaining :=
+              (List.take_append_drop arity sourceTotal).symm
+            rw [splitTotal] at preparedOwnership
+            simpa only [IxIR1.Sim.rootsFor, List.map_append, List.append_assoc,
+              calleeRoots] using preparedOwnership
+          have entryShape : Lower.entryCapabilities calleeTrace.generated.signature =
+              Array.replicate sourceSupplied.length (.owned .shared) := by
+            simpa [entryArity] using
+              attached.target.papSafeEntryCapabilities calleeMember calleePapSafe
+          have calleeOwnership : Lower.Sim.SourceOwnershipAt
+              attached.target.artifact.trace.positions calleeTrace.root sourceReleased
+                sourceSupplied.reverse calleeRoots := by
+            intro entry entryMember entryCoordinate
+            rw [attached.target.entryCapabilities calleeMember entryMember entryCoordinate]
+            exact Lower.Sim.SourceOwnershipInvariant.sharedEntry entryShape readyOwnership
+          have calleeRuntime : Lower.Sim.SourceRuntimeInvariant sourceReleased
+              sourceSupplied.reverse :=
+            Lower.Sim.SourceRuntimeInvariant.sharedEntry
+              ((runtime.order.dupVals sourceRetain).dropVal sourceRelease)
+              ((runtime.papsUnder.dupVals sourceRetain).dropVal sourceRelease) readyOwnership
+          have calleeImage : attached.SourceStoreImage sourceReleased :=
+            attached.dropVal_preservesSourceStoreImage rfl
+              (attached.dupVals_preservesSourceStoreImage image sourceRetain) sourceRelease
+          have calleeTraceState : attached.sidecars.TraceStateRel calleeTrace
+              calleeTrace.root sourceReleased sourceSupplied.reverse calleeFrame := by
+            have entry := attached.functionEntryTraceState (sourceStore := sourceReleased)
+              calleeMember targetSupplied (by
+                rw [targetLength, papArity, calleeMatch.source])
+            simpa only [suppliedValues, calleeMatch.generated, calleeFrame] using entry
+          have suspendedFrame : LiveFrameSupportedByRoots suspendedRoots resume :=
+            callerFrameSupported.mono (fun root member =>
+              List.mem_append_left callerFrameRoots member)
+          have suspendedStack : LiveStackSupportedByRoots suspendedRoots callerStack :=
+            callerStackRoots.mono (fun root member =>
+              List.mem_append_right
+                (Lower.Sim.rootsForCapabilities remaining.toList callerSource) member)
+          by_cases totalExact : sourceTotal.length = arity
+          · have suppliedExact : sourceSupplied = sourceTotal := by
+              exact List.take_of_length_le (Nat.le_of_eq totalExact)
+            have remainingNil : sourceRemaining = [] := by
+              simp [sourceRemaining, totalExact]
+            have remainingEmpty : targetRemaining.isEmpty = true := by
+              apply Array.isEmpty_iff.mpr
+              apply Array.toList_inj.mp
+              simpa [remainingNil] using remainingValues
+            let calleeMachine : Machine :=
+              { store := targetReleased
+                heapFuel := remainingFuel
+                control := .running calleeFrame (.resume resume :: callerStack) }
+            have nextState : CompilerRunningState attached calleeMachine :=
+              { functionTrace := calleeTrace
+                trace := calleeTrace.root
+                sourceStore := sourceReleased
+                source := sourceSupplied.reverse
+                frameRoots := suspendedRoots
+                frame := calleeFrame
+                stack := .resume resume :: callerStack
+                member := calleeMember
+                descendant := .refl
+                traceState := calleeTraceState
+                stores := releasedStores
+                runtime := calleeRuntime
+                ownership := by simpa [calleeRoots, remainingNil, IxIR1.Sim.rootsFor] using calleeOwnership
+                stackRoots := .cons (.resume suspendedFrame) suspendedStack
+                callStack := .applyExact callerMember callerDescendant callerState callerRuntime
+                  callerOwnership callerStackRoots callerImage callerNoCredits tail
+                history := by
+                  simp only [CompilerStackHistory]
+                  refine ⟨?_, history.2⟩
+                  rintro out ⟨bodyFuel, bodyRun⟩ world
+                  simp only [CompilerStackCompletion, CompilerStackReturn]
+                  have bodyRun' : IxIR1.runCode attached.simulationSourceContext bodyFuel
+                      sourceDefinition sourceReleased sourceTotal.reverse sourceDefinition.body =
+                        .ok out := by
+                    simpa only [calleeTrace.rootSourceCode, calleeMatch.source, suppliedExact] using bodyRun
+                  have called := IxIR1.invoke_of_body_run sourceDeclaration
+                    (totalExact.trans papArity) bodyRun'
+                    (by simpa only [calleeMatch.source] using world)
+                  obtain ⟨applyFuel, applied⟩ := IxIR1.applyGo_exact_of_invoke
+                    sourceGet node sourceRetain sourceRelease totalExact
+                    sourceDeclaration sourcePapSafe called
+                  obtain ⟨operationFuel, operationRun⟩ := completed applied
+                  exact ⟨operationFuel, rfl, IxIR1.runOp_mono (by omega) operationRun⟩
+                image := calleeImage
+                control := rfl
+                noCredits := rfl }
+            refine ⟨?_, ?_⟩
+            · simpa only [calleeMachine, calleeFrame, targetSupplied, targetRemaining,
+                targetTotal, remainingEmpty, if_true, resume] using nextState
+            · intro rewritten
+              exact StableLiveAcceptedEntry.ofPcZero rfl rfl
+          · have totalOver : arity < sourceTotal.length := by omega
+            have remainingNonempty : targetRemaining.isEmpty = false := by
+              have remainingSize : targetRemaining.size = sourceTotal.length - arity := by
+                simpa [sourceRemaining] using congrArg List.length remainingValues
+              simp [Array.isEmpty, remainingSize]
+              omega
+            have framedCaller : LiveFrameSupportedByRoots calleeRoots resume :=
+              suspendedFrame.mono (fun root member =>
+                List.mem_append_right (IxIR1.Sim.rootsFor .shared sourceRemaining) member)
+            have framedStack : LiveStackSupportedByRoots calleeRoots callerStack :=
+              suspendedStack.mono (fun root member =>
+                List.mem_append_right (IxIR1.Sim.rootsFor .shared sourceRemaining) member)
+            have residualSupported : ∀ value ∈ targetRemaining.toList,
+                ValueSupportedByRoots calleeRoots value := by
+              intro value member
+              have sourceMember : value ∈ sourceRemaining := remainingValues ▸ member
+              cases value with
+              | loc location =>
+                  exact ⟨.shared, List.mem_append_left suspendedRoots (by
+                    simp [IxIR1.Sim.rootsFor, sourceMember])⟩
+              | lit literal => trivial
+              | erased => trivial
+            let calleeMachine : Machine :=
+              { store := targetReleased
+                heapFuel := remainingFuel
+                control := .running calleeFrame
+                  (.applyMore targetRemaining resume :: callerStack) }
+            have nextState : CompilerRunningState attached calleeMachine :=
+              { functionTrace := calleeTrace
+                trace := calleeTrace.root
+                sourceStore := sourceReleased
+                source := sourceSupplied.reverse
+                frameRoots := calleeRoots
+                frame := calleeFrame
+                stack := .applyMore targetRemaining resume :: callerStack
+                member := calleeMember
+                descendant := .refl
+                traceState := calleeTraceState
+                stores := releasedStores
+                runtime := calleeRuntime
+                ownership := calleeOwnership
+                stackRoots := .cons (.applyMore residualSupported framedCaller) framedStack
+                callStack := .applyMore callerMember callerDescendant callerState callerRuntime
+                  callerOwnership callerStackRoots callerImage callerNoCredits
+                  callerFrameSupported remainingValues tail
+                history := by
+                  simp only [CompilerStackHistory]
+                  refine ⟨?_, history.2⟩
+                  rintro middle ⟨bodyFuel, bodyRun⟩ world
+                  simp only [CompilerStackCompletion]
+                  intro residualFuel out residualRun
+                  have bodyRun' : IxIR1.runCode attached.simulationSourceContext bodyFuel
+                      sourceDefinition sourceReleased sourceSupplied.reverse sourceDefinition.body =
+                        .ok middle := by
+                    simpa only [calleeTrace.rootSourceCode, calleeMatch.source] using bodyRun
+                  have called := IxIR1.invoke_of_body_run sourceDeclaration
+                    (suppliedLength.trans papArity) bodyRun'
+                    (by simpa only [calleeMatch.source] using world)
+                  obtain ⟨applyFuel, applied⟩ := IxIR1.applyGo_over_of_invoke
+                    sourceGet node sourceRetain sourceRelease totalOver
+                    sourceDeclaration sourcePapSafe called residualRun
+                  exact completed applied
+                image := calleeImage
+                control := rfl
+                noCredits := rfl }
+            refine ⟨?_, ?_⟩
+            · simpa only [calleeMachine, calleeFrame, targetSupplied, targetRemaining,
+                targetTotal, remainingNonempty, Bool.false_eq_true, if_false, resume] using nextState
+            · intro rewritten
+              exact StableLiveAcceptedEntry.ofPcZero rfl rfl
+
+/-- Reconstruct every `applyMore` return from its target operands and actual
+transfer, without a successful source suffix or callee simulation worker. -/
+theorem returnApplyMoreOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine target : Machine} (state : CompilerRunningState attached machine)
+    (targetDeclarations : context.declarations =
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas).declarations)
+    {block : Block} {atom : Atom} {value : RVal}
+    {caller : Frame} {arguments : Array RVal} {rest : List Continuation}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (stackEq : state.stack = .applyMore arguments caller :: rest)
+    (resolved : Eval.resolveAtom state.frame.values atom = .ok value)
+    (transferred : Eval.ApplyTransfer context interpretation machine.store
+      machine.heapFuel value arguments caller rest target) :
+    ∃ _ : CompilerRunningState attached target,
+      ∀ rewritten,
+        StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext target rewritten := by
+  obtain ⟨site, blockId, input, entryValueCount, sourceAtom, generated,
+      traceEq, translated⟩ := state.currentReturn blockAt pc terminator
+  have returnState : attached.sidecars.TraceStateRel state.functionTrace
+      (.ret site blockId input entryValueCount sourceAtom atom generated)
+      state.sourceStore state.source state.frame := by
+    rw [← traceEq]
+    exact state.traceState
+  have sourceCount : state.source.length = input.size := by
+    simpa [Lower.CodeTrace.sourceInputMap] using returnState.target.sourceCount
+  have sourceResolved : IxIR1.resolveAtom state.source sourceAtom = .ok value :=
+    Lower.Sim.resolveAtom_of_envRel_target returnState.target.environments
+      sourceCount translated resolved
+  exact state.returnApplyMoreTransfer targetDeclarations traceEq sourceResolved
+    stackEq transferred
+
+
+/-- A return into the typed `applyMore` stack executes the complete residual
+dynamic-application chain and reconstructs the original suspended compiler
+caller.  The evaluator-aligned `ApplyMorePlan` selects erased, under-, exact-,
+and recursively over-saturated redispatches; the existing strong-fuel workers
+run every newly entered callee, while the final continuation restores the
+source runtime, ownership, image, live stack, and typed stack tail. -/
+theorem returnApplyMore
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {returnFuel : Nat}
+    {context : Eval.Context} {interpretation : Eval.Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceAtom : IxIR1.Atom} {targetAtom : Atom} {generated : Block}
+    (traceEq : state.trace =
+      .ret site blockId input entryValueCount sourceAtom targetAtom generated)
+    {value : RVal}
+    (sourceResolved :
+      IxIR1.resolveAtom state.source sourceAtom = .ok value)
+    (completed : CompilerApplyMoreReturn attached attached.simulationSourceContext context
+      state.callStack state.sourceStore value)
+    (workers : ∀ fuel,
+      Pipeline.SuccessfulTraceSimulationAt attached attached.simulationSourceContext context
+        interpretation fuel) :
+    IxIR1.runCode attached.simulationSourceContext (returnFuel + 1)
+          state.functionTrace.source state.sourceStore state.source
+            (.ret sourceAtom) = .ok (state.sourceStore, value) ∧
+      ∃ outputStore outputValue,
+        Pipeline.BudgetedReachesPost context interpretation
+          (fun _ _ final =>
+            Nonempty (CompilerRunningState attached final) ∧
+              ∀ rewritten,
+                StableLiveAcceptedEntry Validate.defaultLimits
+                  attached.target.artifact.validationContext final rewritten)
+          outputStore outputValue machine := by
+  have sourceCompletion := state.returnCompletion traceEq sourceResolved
+  rcases state with ⟨functionTrace, trace, sourceStore, source, frameRoots,
+    frame, stack, member, descendant, traceState, stores, runtime, ownership,
+    stackRoots, callStack, history, image, control, noCredits⟩
+  dsimp only at traceEq sourceResolved completed sourceCompletion ⊢
+  have returnDescendant : functionTrace.root.Descendant
+      (.ret site blockId input entryValueCount sourceAtom targetAtom
+        generated) := by
+    rw [← traceEq]
+    exact descendant
+  have returnState : attached.sidecars.TraceStateRel functionTrace
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frame := by
+    rw [← traceEq]
+    exact traceState
+  have returnOwnership : Lower.Sim.SourceOwnershipAt
+      attached.target.artifact.trace.positions
+      (.ret site blockId input entryValueCount sourceAtom targetAtom generated)
+      sourceStore source frameRoots := by
+    rw [← traceEq]
+    exact ownership
+  have terminalOwnership := Lower.Sim.SourceOwnershipAt.returnRoot
+    (checked := attached.target) member returnDescendant returnOwnership
+      sourceResolved
+  have generatedWorld : IxIR1.Sim.HasWorld sourceStore
+      functionTrace.generated.signature.result value :=
+    terminalOwnership.roots_world
+      ⟨functionTrace.generated.signature.result, value⟩ (by simp)
+  have sourceWorld : IxIR1.Sim.HasWorld sourceStore
+      functionTrace.source.result value := by
+    simpa [functionTrace.sourceResult] using generatedWorld
+  have sourceReturn : IxIR1.runCode attached.simulationSourceContext (returnFuel + 1)
+      functionTrace.source sourceStore source (.ret sourceAtom) =
+        .ok (sourceStore, value) := by
+    rw [IxIR1.runCode.eq_def]
+    dsimp only
+    rw [sourceResolved]
+    rfl
+  refine ⟨sourceReturn, ?_⟩
+  cases callStack with
+  | nil => simp [CompilerApplyMoreReturn] at completed
+  | addressed _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ =>
+      simp [CompilerApplyMoreReturn] at completed
+  | applyExact _ _ _ _ _ _ _ _ _ =>
+      simp [CompilerApplyMoreReturn] at completed
+  | self _ _ _ _ _ _ _ _ _ _ _ _ _ =>
+      simp [CompilerApplyMoreReturn] at completed
+  | @applyMore callerTrace callerMember applySite applyBlock applyInput
+      nextInput applyEntryValueCount applyIndex sourceFunction targetFunction
+      sourceArguments targetArguments next callerDescendant callerStore
+      callerSource callerFrameRoots callerFrame callerStack callerState
+      callerRuntime callerOwnership callerStackRoots callerImage
+      callerNoCredits remaining callerFrameSupported sourceResidual
+      targetResidual residuals tail =>
+      simp only [CompilerApplyMoreReturn] at completed
+      simp only [CompilerStackHistory] at history
+      obtain ⟨applyFuel, outputStore, outputValue,
+        sourceDeclarations, plan⟩ := completed
+      simp only [CompilerStackCompletion] at sourceCompletion
+      obtain ⟨residualFuel, residualRun⟩ := plan.sourceRun
+      obtain ⟨operationFuel, operationRun⟩ := sourceCompletion residualRun
+      let resume : Frame :=
+        { callerFrame with pc := callerFrame.pc + 1 }
+      let suspendedRoots : List IxIR1.Sim.Root :=
+        Lower.Sim.rootsForCapabilities remaining.toList callerSource ++
+          callerFrameRoots
+      obtain ⟨callerBlockAt, _callerPcBound, applyAt⟩ :=
+        callerState.target.instructionAt callerDescendant
+      have residualArray : targetResidual = sourceResidual.toArray := by
+        apply Array.toList_inj.mp
+        simpa using residuals
+      have framedOwnership : Lower.Sim.SourceOwnershipAt
+          attached.target.artifact.trace.positions
+          (.ret site blockId input entryValueCount sourceAtom targetAtom
+            generated) sourceStore source
+          (IxIR1.Sim.rootsFor .shared sourceResidual ++ suspendedRoots) := by
+        simpa [suspendedRoots] using returnOwnership
+      have applyControl : machine.control = .running frame
+          (.applyMore sourceResidual.toArray resume :: callerStack) := by
+        simpa [resume, residualArray] using control
+      let post : Pipeline.SourceMachinePost :=
+        fun _ _ final =>
+          Nonempty (CompilerRunningState attached final) ∧
+            ∀ rewritten,
+              StableLiveAcceptedEntry Validate.defaultLimits
+                attached.target.artifact.validationContext final rewritten
+      have continuation : Pipeline.SuccessfulResumeContinuation context
+          interpretation resume callerStack (outputStore, outputValue)
+          (outputStore, outputValue) post := by
+        intro finalMachine finalStores finalControl
+        have finalState : CompilerRunningState attached
+            { store := finalMachine.store
+              heapFuel := finalMachine.heapFuel
+              control := .running
+                { resume with values := resume.values.push outputValue }
+                callerStack } := by
+          simpa [resume] using
+            (resumedApplyCaller callerMember callerDescendant callerState
+              callerRuntime callerOwnership callerStackRoots callerImage
+              callerNoCredits tail history.2 sourceDeclarations operationRun
+              (heapFuel := finalMachine.heapFuel) finalStores)
+        have exactState : CompilerRunningState attached finalMachine := by
+          change CompilerRunningState attached
+            { finalMachine with
+              control := .running
+                { resume with values := resume.values.push outputValue }
+                callerStack } at finalState
+          rw [← finalControl] at finalState
+          simpa using finalState
+        have finalBlockAt :
+            ({ resume with values := resume.values.push outputValue } :
+                Frame).definition.blocks[
+                  ({ resume with values := resume.values.push outputValue } :
+                    Frame).block]? = some next.headBlock.2 := by
+          simpa [resume] using callerBlockAt
+        have finalAcceptedEntry : ∀ rewritten,
+            StableLiveAcceptedEntry Validate.defaultLimits
+              attached.target.artifact.validationContext finalMachine
+                rewritten := by
+          intro rewritten
+          exact StableLiveAcceptedEntry.ofApplyResume finalControl finalBlockAt
+            (by simpa [resume] using applyAt)
+        refine ⟨finalMachine.heapFuel, ?_⟩
+        simpa [post] using
+          (Pipeline.ReachesPost.refl (post := post)
+            (And.intro ⟨exactState⟩ finalAcceptedEntry))
+      have handler : Pipeline.SuccessfulReturnHandler attached attached.simulationSourceContext
+          context interpretation functionTrace
+          (IxIR1.Sim.rootsFor .shared sourceResidual ++ suspendedRoots)
+          (.applyMore sourceResidual.toArray resume :: callerStack)
+          (sourceStore, value) (outputStore, outputValue) post :=
+        attached.applyMoreReturnHandler_of_plan sourceDeclarations plan
+          (fun fuel _ => workers fuel) continuation functionTrace
+          suspendedRoots
+      have reaches := handler member returnDescendant returnState stores
+        runtime framedOwnership sourceReturn sourceWorld applyControl noCredits
+        image
+      exact ⟨outputStore, outputValue, reaches⟩
+
+/-- The baseline evaluator heap is literally the source heap named by the
+compiler state. -/
+theorem heap_eq
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine) :
+    machine.store.heap = state.sourceStore :=
+  state.stores.heap
+
+/-- A concrete source constructor selected by an accepted site has exactly
+the field count recorded by the reuse shape.  Runtime constructor provenance
+and the accepted validator schema both resolve through the same first
+identity-indexed sidecar row, so duplicate sidecar entries cannot make the
+two arities disagree. -/
+theorem acceptedSiteSourceFieldCount
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block}
+    (site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block)
+    {location rc : Nat} {fields : Array RVal}
+    (sourceAt : machine.store.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩) :
+    fields.size = site.shape.fieldCount := by
+  have sourceStoreAt : state.sourceStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← state.heap_eq]
+    exact sourceAt
+  obtain ⟨_sourceStore, _image, constructorsValid⟩ := state.image
+  have known : attached.sidecars.constructorKnown
+      site.shape.sourceConstructor fields.size = true :=
+    constructorsValid.constructorKnown sourceStoreAt
+  obtain ⟨sourceSchema, _allocationSchema, sourceSchemaAt,
+      _allocationSchemaAt, sourceFields, _allocationFields,
+      _sourceLayout, _allocationLayout⟩ := site.runtimeSchemas
+  have loweringSourceSchemaAt : attached.loweringContext.schemas .shared
+      site.shape.sourceConstructor = some sourceSchema := by
+    rw [← attached.targetSchemasProduced]
+    exact sourceSchemaAt
+  have runtimeFields : sourceSchema.fields =
+      Array.replicate fields.size Ixon.Owned.shared :=
+    attached.schema_fields_of_constructorKnown known loweringSourceSchemaAt
+  have repeated : Array.replicate fields.size Ixon.Owned.shared =
+      Array.replicate site.shape.fieldCount Ixon.Owned.shared :=
+    runtimeFields.symm.trans sourceFields
+  have sizes := congrArg Array.size repeated
+  simpa using sizes
+
+/-- A nonempty constructor-child prologue identifies the accepted reset
+source. Producer ownership fixes its shared world, and the checked schema
+makes the generated prologue exactly the recognized fetch prefix. -/
+theorem acceptedCtorChildSource
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {store : Store} {heapFuel : Nat}
+    (frame : Frame) (stack : List Continuation)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (definition : frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions frame.block
+      helperOffset block (.accepted site))
+    {fields : Array RVal}
+    (parameterCount : frame.values.size = site.shape.parameterCount)
+    (state : CompilerRunningState attached
+      { store
+        heapFuel
+        control := .running
+          { frame with
+            pc := fields.size
+            values := frame.values ++ fields } stack })
+    {atom : Atom} {cid : CtorId} {location : Nat} {box : NodeBox}
+    (prologue : Lower.fetchPrologueMatches block.instructions atom cid
+      fields.size = true)
+    (positive : 0 < fields.size)
+    (resolved : resolveAtom frame.values atom = .ok (.loc location))
+    (boxAt : store.get? location = some box)
+    (node : box.node = .ctorN cid fields) :
+    ∃ rc,
+      fields.size = site.shape.fieldCount ∧
+      resolveAtom frame.values (.reg site.shape.source) =
+        .ok (.loc location) ∧
+      store.get? location = some
+        ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩ := by
+  obtain ⟨atomEq, cidEq⟩ := Reuse.Site.fetchPrologueHead site prologue positive
+  subst atom
+  subst cid
+  have bound := Reuse.Site.fetchPrologueBound site prologue
+  have controlEq :
+      (.running state.frame state.stack : Control) =
+        .running
+          { frame with
+            pc := fields.size
+            values := frame.values ++ fields } stack := state.control.symm
+  have stateFrameEq : state.frame =
+      { frame with
+        pc := fields.size
+        values := frame.values ++ fields } := by
+    injection controlEq
+  have stateDefinition : state.frame.definition = source := by
+    simpa [stateFrameEq] using definition
+  have stateAccepted : Reuse.FunctionDecisions.At rewrite.decisions
+      state.frame.block helperOffset block (.accepted site) := by
+    simpa [stateFrameEq] using accepted
+  have pcBound : state.frame.pc ≤ site.shape.releasePosition := by
+    simp only [stateFrameEq, site.fits.releasePosition]
+    omega
+  have stateResolved : resolveAtom state.frame.values
+      (.reg site.shape.source) = .ok (.loc location) := by
+    simpa [stateFrameEq, resolveAtom, Array.getElem?_append, parameterCount,
+      site.fits.sourceBound] using resolved
+  obtain ⟨rest, ownership, _rootsInRest⟩ :=
+    state.acceptedSiteSourceRoot rewrite stateDefinition stateAccepted pcBound
+      stateResolved
+  have sourceBoxAt : state.sourceStore.get? location = some box := by
+    rw [← state.heap_eq]
+    exact boxAt
+  obtain ⟨worldBox, worldAt, worldEq⟩ :=
+    ownership.roots_world ⟨.shared, .loc location⟩ (by simp)
+  have worldBoxEq : worldBox = box :=
+    Option.some.inj (worldAt.symm.trans sourceBoxAt)
+  have boxWorld : box.world = .shared := by
+    rw [← worldBoxEq]
+    exact worldEq
+  cases box with
+  | mk world rc actualNode =>
+      simp only at boxWorld
+      subst world
+      change actualNode = .ctorN site.shape.sourceConstructor fields at node
+      subst actualNode
+      exact ⟨rc, state.acceptedSiteSourceFieldCount site boxAt,
+        resolved, boxAt⟩
+
+/-- The first successful evaluator step at an accepted block entry must be
+the shape's zeroth fetch.  Compiler ownership refines the fetched constructor
+box to the shared world expected by the accepted schema. -/
+theorem acceptedEntrySourceOfStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {acceptedBlock : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext acceptedBlock}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset acceptedBlock (.accepted site))
+    (pc : state.frame.pc = 0)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {target : Machine}
+    (stepped : Step context interpretation machine target) :
+    ∃ (location rc : Nat) (fields : Array RVal),
+      resolveAtom state.frame.values (.reg site.shape.source) =
+          .ok (.loc location) ∧
+        machine.store.get? location = some
+          ⟨.shared, rc,
+            .ctorN site.shape.sourceConstructor fields⟩ := by
+  have sourceAt := (rewrite.acceptedAt accepted).1
+  have acceptedBlockAt : state.frame.definition.blocks[state.frame.block]? =
+      some acceptedBlock := by
+    rw [baselineDefinition]
+    exact sourceAt
+  have canonicalEq :
+      ({ store := machine.store
+         heapFuel := machine.heapFuel
+         control := .running state.frame state.stack } : Machine) = machine := by
+    simpa only using congrArg
+      (fun control => ({ machine with control } : Machine)) state.control.symm
+  have canonicalStep : Step context interpretation
+      { store := machine.store
+        heapFuel := machine.heapFuel
+        control := .running state.frame state.stack }
+      target := by
+    rw [canonicalEq]
+    exact stepped
+  cases canonicalStep.classify with
+  | instruction blockAt stepPc instructionAt classified =>
+      have blockEq : acceptedBlock = _ :=
+        Option.some.inj (acceptedBlockAt.symm.trans blockAt)
+      subst_vars
+      have firstAt := site.fits.fetches 0 site.fits.fieldCountPositive
+      obtain ⟨_firstBound, firstInstruction⟩ :=
+        Array.getElem?_eq_some_iff.mp firstAt
+      have stepPcZero : state.frame.pc = 0 := pc
+      have classifiedFetch : InstructionTransferCase context interpretation
+          machine.store machine.heapFuel state.frame state.stack
+          (Instr.fetch (.reg site.shape.source)
+            site.shape.sourceConstructor 0) target := by
+        simpa [stepPcZero, firstInstruction] using classified
+      cases classifiedFetch with
+      | @fetch targetAtom cid field location box fields value resolved boxAt
+          node fieldAt =>
+          have sourceBoxAt : state.sourceStore.get? location = some box := by
+            unfold Eval.Store.get? at boxAt
+            rw [state.heap_eq] at boxAt
+            exact boxAt
+          obtain ⟨rest, ownership, _rootsInRest⟩ :=
+            state.acceptedSiteSourceRoot rewrite rfl accepted
+              (by omega) resolved
+          obtain ⟨worldBox, worldAt, worldEq⟩ :=
+            ownership.roots_world
+              ⟨Ixon.Owned.shared, .loc location⟩ (by simp)
+          have worldBoxEq : worldBox = box :=
+            Option.some.inj (worldAt.symm.trans sourceBoxAt)
+          have boxWorld : box.world = .shared := by
+            rw [← worldBoxEq]
+            exact worldEq
+          cases box with
+          | mk world rc actualNode =>
+              simp only at boxWorld
+              subst world
+              change actualNode =
+                .ctorN site.shape.sourceConstructor fields at node
+              subst actualNode
+              exact ⟨location, rc, fields, resolved, boxAt⟩
+  | terminator blockAt terminal _terminatorAt _classified =>
+      have blockEq : acceptedBlock = _ :=
+        Option.some.inj (acceptedBlockAt.symm.trans blockAt)
+      subst_vars
+      have minimum := site.fits.instructionCountAtLeastFour
+      omega
+
+/-- Dynamic ownership closes the baseline heap named by every compiler
+running state. -/
+theorem heapClosed
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine) :
+    IxIR1.Sim.StoreClosed machine.store.heap := by
+  obtain ⟨_position, _member, _coordinate, current⟩ :=
+    state.currentOwnership
+  rw [state.heap_eq]
+  exact current.ownership.storeClosed
+
+/-- At an accepted site, exact producer ownership makes the entire baseline
+field-retain prefix executable before any branch-specific reasoning.  The
+result exposes both the retained root multiset and the parent's post-retain
+box, while preserving every suspended-frame root inside the ambient tail. -/
+theorem acceptedSiteRetainedFields
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {location rc : Nat} {fields : Array RVal}
+    (resolved : Eval.resolveAtom state.frame.values
+      (.reg site.shape.source) = .ok (.loc location))
+    (sourceAt : machine.store.get? location =
+      some ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩) :
+    ∃ (rest : List IxIR1.Sim.Root) (retained : Store) (retainedRc : Nat),
+      IxIR1.Sim.RootOwnership machine.store.heap
+          (⟨.shared, .loc location⟩ :: rest) ∧
+      (∀ root ∈ state.frameRoots, root ∈ rest) ∧
+      RetainSharedMany machine.store fields retained ∧
+      retained.get? location = some
+        ⟨.shared, retainedRc, .ctorN site.shape.sourceConstructor fields⟩ ∧
+      IxIR1.Sim.RootOwnership retained.heap
+        (IxIR1.Sim.rootsFor .shared fields.toList ++
+          ⟨.shared, .loc location⟩ :: rest) := by
+  obtain ⟨rest, sourceOwnership, rootsInRest⟩ :=
+    state.acceptedSiteSourceRoot rewrite baselineDefinition accepted pc
+      resolved
+  have ownership : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc location⟩ :: rest) := by
+    rw [state.heap_eq]
+    exact sourceOwnership
+  obtain ⟨retained, retainedRun, retainedOwnership, extension⟩ :=
+    retainCtorFields_of_rootOwnership sourceAt ownership
+  have sourceHeapAt : machine.store.heap.get? location =
+      some ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩ :=
+    sourceAt
+  obtain ⟨retainedRc, retainedAt⟩ := extension sourceHeapAt
+  exact ⟨rest, retained, retainedRc, ownership, rootsInRest, retainedRun,
+    retainedAt, retainedOwnership⟩
+
+/-- Every future-observable value in the active compiler frame names an
+already allocated baseline slot. The checked input-map coverage finds its
+source value, and the source runtime invariant supplies the bound. -/
+theorem liveValueInBounds
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {index : Nat} {value : RVal}
+    (live : ValueLiveFrom state.frame.definition state.frame.block
+      state.frame.pc index)
+    (found : state.frame.values[index]? = some value) :
+    IxIR1.Reclamation.ValueInBounds machine.store.heap value := by
+  have targetBound : index < state.frame.values.size :=
+    (Array.getElem?_eq_some_iff.mp found).1
+  obtain ⟨sourceIndex, inputAt⟩ := state.coverage live targetBound
+  have inputBound : sourceIndex < state.trace.sourceInputMap.size :=
+    (Array.getElem?_eq_some_iff.mp inputAt).1
+  have sourceBound : sourceIndex < state.source.length := by
+    rw [state.traceState.target.sourceCount]
+    exact inputBound
+  let sourceValue := state.source[sourceIndex]
+  have sourceAt : state.source[sourceIndex]? = some sourceValue := by
+    simp [sourceValue]
+  have sourceResolved := state.traceState.target.environments sourceIndex
+    sourceValue (.reg index) sourceAt inputAt
+  have targetResolved : Eval.resolveAtom state.frame.values (.reg index) =
+      .ok value := by
+    simp [Eval.resolveAtom, found]
+  have valueEq : sourceValue = value :=
+    Except.ok.inj (sourceResolved.symm.trans targetResolved)
+  subst value
+  have sourceInBounds := state.runtime.rootsInBounds sourceValue
+    (List.mem_of_getElem? sourceAt)
+  simpa [state.heap_eq] using sourceInBounds
+
+/-- Every future-observable inherited value at an accepted block entry is
+live in the baseline heap.  Checked input-map coverage identifies the source
+slot, and the parameter-capability audit rules out a dead producer binding;
+owners and borrows carry `HasWorld`, while scalar bindings cannot contain a
+location. -/
+theorem acceptedParameterValueLive
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {index : Nat} {value : RVal}
+    (inherited : index < site.shape.parameterCount)
+    (live : ValueLiveFrom source state.frame.block 0 index)
+    (found : state.frame.values[index]? = some value) :
+    IxIR1.Sim.LiveRVal machine.store.heap value := by
+  have targetBound : index < state.frame.values.size :=
+    (Array.getElem?_eq_some_iff.mp found).1
+  have parameterBound : index < block.valueParams.size := by
+    rw [← site.fits.parameterCount]
+    exact inherited
+  let parameter := block.valueParams[index]
+  have parameterAt : block.valueParams[index]? = some parameter := by
+    simp [parameter, parameterBound]
+  have currentBlockAt : state.frame.definition.blocks[state.frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact (rewrite.acceptedAt accepted).1
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (currentBlockAt.symm.trans exactBlock)
+  have traceParameterAt :
+      state.trace.headBlock.2.valueParams[index]? = some parameter := by
+    rw [← blockEq]
+    exact parameterAt
+  obtain ⟨position, member, coordinate, ownership⟩ :=
+    state.currentOwnership
+  have stateLive : ValueLiveFrom state.frame.definition state.frame.block
+      state.frame.pc index := by
+    rw [baselineDefinition]
+    exact Reuse.Site.entryLiveParameterBeforeRelease site
+      (rewrite.acceptedAt accepted).1 live inherited pc
+  obtain ⟨sourceIndex, inputAt⟩ := state.coverage stateLive targetBound
+  have inputBound : sourceIndex < state.trace.sourceInputMap.size :=
+    (Array.getElem?_eq_some_iff.mp inputAt).1
+  have sourceBound : sourceIndex < state.source.length := by
+    rw [state.traceState.target.sourceCount]
+    exact inputBound
+  let sourceValue := state.source[sourceIndex]
+  have sourceAt : state.source[sourceIndex]? = some sourceValue := by
+    simp [sourceValue, sourceBound]
+  have sourceResolved := state.traceState.target.environments sourceIndex
+    sourceValue (.reg index) sourceAt inputAt
+  have targetResolved : Eval.resolveAtom state.frame.values (.reg index) =
+      .ok value := by
+    simp [Eval.resolveAtom, found]
+  have valueEq : sourceValue = value :=
+    Except.ok.inj (sourceResolved.symm.trans targetResolved)
+  obtain ⟨capability, capabilityAt, capabilityMatch⟩ :=
+    attached.target.parameterCapability state.member state.descendant member
+      coordinate inputAt traceParameterAt
+  have holds := ownership.holds capabilityAt sourceAt
+  have holdsValue : Lower.Sim.CapabilityHolds state.sourceStore capability
+      value := by
+    rwa [valueEq] at holds
+  rw [state.heap_eq]
+  cases capability with
+  | scalar =>
+      cases value with
+      | loc location =>
+          simp [Lower.Sim.CapabilityHolds,
+            IxIR1.Sim.rvalLocation?] at holdsValue
+      | lit literal => trivial
+      | erased => trivial
+  | owned world =>
+      cases value with
+      | loc location =>
+          obtain ⟨box, boxAt, _world⟩ := holdsValue
+          exact ⟨box, boxAt⟩
+      | lit literal => trivial
+      | erased => trivial
+  | borrowed world lender =>
+      cases value with
+      | loc location =>
+          obtain ⟨box, boxAt, _world⟩ := holdsValue
+          exact ⟨box, boxAt⟩
+      | lit literal => trivial
+      | erased => trivial
+  | dead => simp [Lower.BindingCap.matchesParameter] at capabilityMatch
+
+/-- Specialize inherited-parameter liveness to a traced zero-PC entry. -/
+theorem acceptedEntryValueLive
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {index : Nat} {value : RVal}
+    (live : ValueLiveFrom source state.frame.block 0 index)
+    (found : state.frame.values[index]? = some value) :
+    IxIR1.Sim.LiveRVal machine.store.heap value := by
+  have parameterCount :=
+    state.acceptedSiteParameterCount rewrite baselineDefinition accepted pc
+  have inherited : index < site.shape.parameterCount := by
+    rw [← parameterCount]
+    exact (Array.getElem?_eq_some_iff.mp found).1
+  exact state.acceptedParameterValueLive rewrite baselineDefinition accepted
+    (by omega) inherited live found
+
+/-- A compiler state's framed-root invariant supplies enough support to
+discard dead allocation-history rows from any related suspended stack. -/
+theorem stackToHeapIso
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {rewrittenStore : IxIR1.Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap rewrittenStore)
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation history.locRel
+      state.stack rewrittenStack) :
+    StableLiveStackIso limits validation
+      (history.toHeapIso state.heapClosed).locRel
+      state.stack rewrittenStack := by
+  obtain ⟨position, _member, _coordinate, current⟩ :=
+    state.currentOwnership
+  let roots := Lower.Sim.rootsForCapabilities
+      position.sourceCapabilities.toList state.source ++ state.frameRoots
+  have ownership : IxIR1.Sim.RootOwnership machine.store.heap roots := by
+    rw [state.heap_eq]
+    exact current.ownership
+  have supported : LiveStackSupportedByRoots roots state.stack :=
+    state.stackRoots.mono (fun root member =>
+      List.mem_append_right _ member)
+  exact stack.toHeapIsoOfSupported history state.heapClosed ownership supported
+
+/-- Exact-content live states admitted by the compiler can be re-indexed by
+the canonical allocation history. Bounds are required only for the active
+frame's future-live registers and the suspended stack's observable values;
+dead append-only registers remain unconstrained. -/
+theorem historyOfContents
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {rewrittenStore : Store} {source : Function}
+    {rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source}
+    {rewrittenFrame : Frame}
+    {rewrittenStack : List Continuation}
+    (heap : HeapContentsEq machine.store rewrittenStore)
+    (frame : StableLiveFrameIso rewrite (fun left right => left = right)
+      state.frame rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext
+      (fun left right => left = right) state.stack rewrittenStack) :
+    ∃ history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+        rewrittenStore.heap,
+      StableLiveFrameIso rewrite history.locRel state.frame rewrittenFrame ∧
+        StableLiveStackIso Validate.defaultLimits
+          attached.target.artifact.validationContext history.locRel
+          state.stack rewrittenStack := by
+  obtain ⟨position, _member, _coordinate, current⟩ :=
+    state.currentOwnership
+  let roots := Lower.Sim.rootsForCapabilities
+      position.sourceCapabilities.toList state.source ++ state.frameRoots
+  have ownership : IxIR1.Sim.RootOwnership machine.store.heap roots := by
+    rw [state.heap_eq]
+    exact current.ownership
+  have supported : LiveStackSupportedByRoots roots state.stack :=
+    state.stackRoots.mono (fun root member =>
+      List.mem_append_right _ member)
+  let base := IxIR1.Sim.HeapHistoryIso.refl machine.store.heap
+    state.heapClosed
+  let history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap :=
+    base.nodesEq rfl heap.nodes.symm
+  have self : ∀ {location : Nat},
+      location < machine.store.heap.nodes.size →
+      history.locRel location location := by
+    intro location bound
+    exact ⟨rfl, bound⟩
+  refine ⟨history, frame.identityOfInBounds self ?_ state.noCredits,
+    stack.identityOfSupported self ownership supported⟩
+  intro index value live found
+  exact state.liveValueInBounds
+    (by simpa [frame.baselineDefinition] using live) found
+
+/-- Exact ownership of a unit-refcount current root turns the compiler's
+framed-root support and an existing live stack relation into the physical
+reuse stack-avoidance witness. -/
+theorem stackAvoidsOfSupportedUnit
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore state.sourceStore)
+    {baselineLocation rewrittenLocation : Nat} {node : IxIR1.Node}
+    {rest : List IxIR1.Sim.Root}
+    (locations : iso.locRel rewrittenLocation baselineLocation)
+    (found : state.sourceStore.get? baselineLocation =
+      some ⟨.shared, 1, node⟩)
+    (ownership : IxIR1.Sim.RootOwnership state.sourceStore
+      (⟨.shared, .loc baselineLocation⟩ :: rest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ rest)
+    {rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      state.stack rewrittenStack) :
+    StableLiveStackAvoids limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation state.stack rewrittenStack :=
+  stack.avoidsOfSupportedUnit iso locations found ownership rootsInRest
+    state.stackRoots
+
+/-- An accepted unit-refcount source parameter automatically avoids every
+observable location in the related rewritten continuation stack.  The
+accepted-site syntax supplies liveness, the checked parameter audit supplies
+the source owner, and the compiler's framed-root invariant supplies stack
+support. -/
+theorem acceptedSiteStackAvoidsOfUnit
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {baselineLocation rewrittenLocation : Nat}
+    (resolved : Eval.resolveAtom state.frame.values
+      (.reg site.shape.source) = .ok (.loc baselineLocation))
+    {rewrittenStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore state.sourceStore)
+    (locations : iso.locRel rewrittenLocation baselineLocation)
+    {node : IxIR1.Node}
+    (sourceAt : state.sourceStore.get? baselineLocation =
+      some ⟨.shared, 1, node⟩)
+    {rewrittenStack : List Continuation}
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      state.stack rewrittenStack) :
+    StableLiveStackAvoids Validate.defaultLimits
+      attached.target.artifact.validationContext
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      rewrittenLocation state.stack rewrittenStack := by
+  obtain ⟨rest, ownership, rootsInRest⟩ :=
+    state.acceptedSiteSourceRoot rewrite baselineDefinition accepted pc
+      resolved
+  exact state.stackAvoidsOfSupportedUnit iso locations sourceAt ownership
+    rootsInRest stack
+
+/-- Restrict an incoming allocation history to its live heap and discharge
+the target-side obligations of a physical-hot accepted macro from baseline
+producer accounting.  In particular, the compiler invariant proves every
+entry-live parameter is allocated, supports the suspended stack away from
+the consumed source, and transports allocation field worlds across the
+post-kill history. -/
+theorem acceptedHotPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {baselineParameters : Array RVal}
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (parameterValues : ∀ {index : Nat}, index < site.shape.parameterCount →
+      state.frame.values[index]? = baselineParameters[index]?)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      baselineParameters rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues baselineParameters baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := baselineParameters
+            credits := #[] }
+          state.stack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulationAt Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical (2 * site.shape.fieldCount + 3)
+      baselineMachine rewrittenMachine := by
+  dsimp only
+  let live := history.toHeapIso state.heapClosed
+  let inputIso := live.symm
+  have liveParameters : LiveValuesIso source state.frame.block 0 live.locRel
+      baselineParameters rewrittenParameters :=
+    parameters.toHeapIsoOfLive history state.heapClosed
+      (by
+        intro index value live found
+        have inherited : index < site.shape.parameterCount := by
+          rw [← parameterCount]
+          exact (Array.getElem?_eq_some_iff.mp found).1
+        exact state.acceptedParameterValueLive rewrite baselineDefinition
+          accepted pc inherited live ((parameterValues inherited).trans found))
+  have liveStack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext live.locRel
+      state.stack rewrittenStack :=
+    state.stackToHeapIso history stack
+  obtain ⟨sourceAt, _resetAt, _hotAt, _coldAt⟩ :=
+    rewrite.acceptedAt accepted
+  have sourceLiveAtRelease : AtomLiveFrom source state.frame.block
+      site.shape.releasePosition (.reg site.shape.source) :=
+    AtomLiveFrom.instruction sourceAt site.fits.release
+      Liveness.InstrUsesAtom.releaseShared
+  have sourceLive : AtomLiveFrom source state.frame.block 0
+      (.reg site.shape.source) :=
+    sourceLiveAtRelease.mono (Nat.zero_le _)
+  obtain ⟨rewrittenSourceValue, rewrittenSourceResolved,
+      sourceValueRelated⟩ :=
+    liveParameters.resolveAtom sourceLive baselineSourceResolved
+  cases sourceValueRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨baselineBox, rewrittenBox, baselineLive, rewrittenLive,
+          boxesRelated⟩ := live.related_live locations
+      have baselineBoxEq : baselineBox =
+          ⟨.shared, 1,
+            .ctorN site.shape.sourceConstructor baselineFields⟩ :=
+        Option.some.inj (baselineLive.symm.trans baselineAt)
+      subst baselineBox
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left boxesRelated.node
+      have rewrittenBoxEq : rewrittenBox =
+          ⟨.shared, 1,
+            .ctorN site.shape.sourceConstructor rewrittenFields⟩ := by
+        cases rewrittenBox
+        cases boxesRelated.world
+        cases boxesRelated.rc
+        cases rewrittenNode
+        rfl
+      subst rewrittenBox
+      have rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+          ⟨.shared, 1,
+            .ctorN site.shape.sourceConstructor rewrittenFields⟩ :=
+        rewrittenLive
+      have prefixLive : LiveValuesIso source state.frame.block 0
+          live.locRel
+          (baselinePrefixValues baselineParameters baselineFields)
+          (baselinePrefixValues rewrittenParameters rewrittenFields) := by
+        simpa [baselinePrefixValues] using
+          (liveParameters.append fieldsRelated).append fieldsRelated
+      have allocationLiveAt : AtomsLiveFrom source state.frame.block
+          (site.shape.releasePosition + 1)
+          site.shape.allocationArguments :=
+        AtomsLiveFrom.instruction sourceAt site.fits.allocation (by
+          intro atom member
+          exact Liveness.InstrUsesAtom.alloc member)
+      have allocationLive : AtomsLiveFrom source state.frame.block 0
+          site.shape.allocationArguments :=
+        allocationLiveAt.mono (Nat.zero_le _)
+      obtain ⟨rewrittenNewFields, rewrittenAllocationResolved,
+          newFieldsRelated⟩ :=
+        prefixLive.resolveAtoms allocationLive baselineAllocationResolved
+      let head : IxIR1.Sim.RootIso inputIso.locRel
+          ⟨.shared, .loc rewrittenLocation⟩
+          ⟨.shared, .loc baselineLocation⟩ :=
+        ⟨rfl, .loc locations⟩
+      obtain ⟨rewrittenRest, _rootsRelated, rewrittenOwned⟩ :=
+        inputIso.rootOwnershipPreimageCons head baselineOwned
+      have stackAvoids : StableLiveStackAvoids Validate.defaultLimits
+          attached.target.artifact.validationContext live.locRel
+          rewrittenLocation state.stack rewrittenStack := by
+        exact liveStack.avoidsOfSupportedUnit inputIso locations baselineAt
+          baselineOwned rootsInRest state.stackRoots
+      have prefixContents : HeapContentsEq baselineReleased
+          (logicalHotResetStore machine.store baselineLocation) :=
+        hotPrefix_contents baselineAt baselineOwned retained released
+      have baselineResetWorlds : FieldWorlds
+          (logicalHotResetStore machine.store baselineLocation)
+          allocationSchema baselineNewFields :=
+        prefixContents.fieldWorlds baselineFieldWorlds
+      obtain ⟨_sourceSchema, siteAllocationSchema, _sourceSchemaAt,
+          siteAllocationSchemaAt, sourceSchemaFields,
+          allocationSchemaFields, _sourceLayout, _allocationLayout⟩ :=
+        evalRuntimeSchemas site baselineSchemas
+      have allocationSchemaEq : siteAllocationSchema = allocationSchema :=
+        Option.some.inj
+          (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+      subst siteAllocationSchema
+      have uniformAllocationFields : allocationSchema.fields =
+          Array.replicate site.shape.fieldCount .shared :=
+        allocationSchemaFields.trans sourceSchemaFields
+      have baselineMissing : baselineReleased.get? baselineLocation =
+          none := by
+        rw [prefixContents.get?_eq baselineLocation]
+        change (logicalHotResetStore machine.store baselineLocation).heap.get?
+          baselineLocation = none
+        rw [logicalHotResetStore_heap]
+        exact IxIR1.Sim.get?_kill_same baselineAt
+      have baselineNewFieldsAvoid :
+          ∀ value ∈ baselineNewFields.toList,
+            value ≠ .loc baselineLocation :=
+        FieldWorlds.avoidsMissing uniformAllocationFields
+          baselineFieldWorlds baselineMissing
+      have rewrittenNewFieldsAvoid :
+          ∀ value ∈ rewrittenNewFields.toList,
+            value ≠ .loc rewrittenLocation :=
+        rvalsIso_right_avoids_of_left inputIso locations
+          newFieldsRelated baselineNewFieldsAvoid
+      have restrictedNewFields : IxIR1.Sim.RValsIso
+          (fun rewrittenCandidate baselineCandidate =>
+            inputIso.locRel rewrittenCandidate baselineCandidate ∧
+              rewrittenCandidate ≠ rewrittenLocation)
+          rewrittenNewFields.toList baselineNewFields.toList :=
+        rvalsIso_restrict_left
+          (IxIR1.Sim.RValsIso.symm newFieldsRelated)
+          rewrittenNewFieldsAvoid
+      let killed := heapIsoKillShared inputIso locations rewrittenAt
+        baselineAt rewrittenOwned
+      let killedHistory := heapIsoToHistory killed
+      have physicalNodes :
+          (physicalHotResetStore rewrittenStore rewrittenLocation).heap.nodes =
+            (rewrittenStore.heap.kill rewrittenLocation).nodes := by
+        rw [physicalHotResetStore_nodes]
+        rfl
+      have logicalNodes :
+          (logicalHotResetStore machine.store baselineLocation).heap.nodes =
+            (machine.store.heap.kill baselineLocation).nodes := by
+        rw [logicalHotResetStore_heap]
+      let resetHistory : IxIR1.Sim.HeapHistoryIso
+          (physicalHotResetStore rewrittenStore rewrittenLocation).heap
+          (logicalHotResetStore machine.store baselineLocation).heap :=
+        killedHistory.nodesEq physicalNodes logicalNodes
+      have baselineToRewrittenNewFields : IxIR1.Sim.RValsIso
+          resetHistory.symm.locRel baselineNewFields.toList
+            rewrittenNewFields.toList := by
+        exact IxIR1.Sim.RValsIso.symm restrictedNewFields
+      have rewrittenFieldWorlds : FieldWorlds
+          (physicalHotResetStore rewrittenStore rewrittenLocation)
+          allocationSchema rewrittenNewFields :=
+        baselineResetWorlds.transport
+          (heapHistoryIso_fieldValuesWorldEq resetHistory.symm
+            baselineToRewrittenNewFields)
+      exact acceptedHotPhysicalStableLiveMacroSimulationIsoOfAccountingAt
+        rewrite accepted baselineSchemas rewrittenSchemas inputIso
+        liveParameters stackAvoids fuel locations allocationSchemaAt
+        parameterCount fieldCount baselineSourceResolved
+        rewrittenSourceResolved baselineAt rewrittenAt baselineOwned
+        retained released baselineNewOwned baselineMapped
+        baselineAllocationResolved rewrittenAllocationResolved
+        baselineFieldWorlds rewrittenFieldWorlds tailResolved arity
+
+
+/-- Specialize the inherited-parameter macro to a traced zero-PC entry. -/
+theorem acceptedHotPhysicalStableLiveMacroSimulationHistoryAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      state.frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom state.frame.values (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues state.frame.values baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues state.frame.values baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := state.frame.values
+            credits := #[] }
+          state.stack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulationAt Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical (2 * site.shape.fieldCount + 3)
+      baselineMachine rewrittenMachine := by
+  exact state.acceptedHotPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+    rewrite baselineDefinition accepted (by omega)
+    (state.acceptedSiteParameterCount rewrite baselineDefinition accepted pc)
+    (by intro index bound; rfl) baselineSchemas rewrittenSchemas history
+    parameters stack fuel allocationSchemaAt fieldCount baselineSourceResolved
+    baselineAt baselineOwned rootsInRest retained released baselineNewOwned
+    baselineMapped baselineAllocationResolved baselineFieldWorlds tailResolved
+    arity
+
+/-- Compatibility wrapper that forgets the baseline-length index. -/
+theorem acceptedHotPhysicalStableLiveMacroSimulationHistory
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      state.frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom state.frame.values (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (newRest ++ inertRoots
+        (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest)))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues state.frame.values baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues state.frame.values baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := state.frame.values
+            credits := #[] }
+          state.stack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical baselineMachine rewrittenMachine := by
+  have baselineMappedFull : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))) :=
+    MappedValuesInRoots.mono baselineMapped (by
+      intro root member
+      exact List.mem_append_right _ member)
+  exact (state.acceptedHotPhysicalStableLiveMacroSimulationHistoryAt rewrite
+    baselineDefinition accepted pc baselineSchemas rewrittenSchemas history
+    parameters stack fuel allocationSchemaAt fieldCount
+    baselineSourceResolved baselineAt baselineOwned rootsInRest retained
+    released baselineNewOwned baselineMappedFull baselineAllocationResolved
+    baselineFieldWorlds tailResolved arity).simulation
+
+/-- Dispatch an accepted physical-runtime site from allocation history using
+only baseline producer facts. Exact ownership rules out a zero refcount.  A
+unit count enters the live-heap physical reuse adapter above; every larger
+count is the history-aware cold macro after identifying the non-final release
+store and residual fuel. -/
+theorem acceptedPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc ≤ site.shape.releasePosition)
+    {baselineParameters : Array RVal}
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (parameterValues : ∀ {index : Nat}, index < site.shape.parameterCount →
+      state.frame.values[index]? = baselineParameters[index]?)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      baselineParameters rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel rc retainedRc : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues baselineParameters baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := baselineParameters
+            credits := #[] }
+          state.stack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulationAt Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical (2 * site.shape.fieldCount + 3)
+      baselineMachine rewrittenMachine := by
+  have positive : 0 < rc := baselineOwned.shared_rc_pos baselineAt
+  by_cases unit : rc = 1
+  · subst rc
+    exact state.acceptedHotPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+      rewrite baselineDefinition accepted pc parameterCount parameterValues
+      baselineSchemas rewrittenSchemas history
+      parameters stack fuel allocationSchemaAt fieldCount
+      baselineSourceResolved baselineAt baselineOwned rootsInRest retained
+      released baselineNewOwned baselineMapped baselineAllocationResolved
+      baselineFieldWorlds tailResolved arity
+  · have shared : 1 < rc := by omega
+    obtain ⟨actualRetainedRc, actualRetainedAt, expectedReleased,
+        _resetRetained, _heapEq⟩ :=
+      coldPrefix_commutes (heapFuel := fieldFuel) baselineAt shared retained
+    have retainedRcEq : actualRetainedRc = retainedRc := by
+      have boxesEq := Option.some.inj
+        (actualRetainedAt.symm.trans retainedAt)
+      exact congrArg IxIR1.NodeBox.rc boxesEq
+    subst actualRetainedRc
+    have outputsEq :
+        (baselineDecrementStore baselineRetained baselineLocation
+            ⟨.shared, retainedRc,
+              .ctorN site.shape.sourceConstructor baselineFields⟩,
+          fieldFuel) = (baselineReleased, remaining) :=
+      Except.ok.inj (expectedReleased.symm.trans released)
+    injection outputsEq with storeEq fuelEq
+    subst baselineReleased
+    subst remaining
+    exact acceptedColdStableLiveMacroSimulationIsoAt rewrite accepted
+      baselineSchemas rewrittenSchemas history parameters stack fuel
+      allocationSchemaAt parameterCount fieldCount baselineSourceResolved
+      baselineAt shared retained retainedAt baselineAllocationResolved
+      baselineFieldWorlds tailResolved arity
+
+
+/-- Specialize the inherited-parameter macro to a traced zero-PC entry. -/
+theorem acceptedPhysicalStableLiveMacroSimulationHistoryAt
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      state.frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel rc retainedRc : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom state.frame.values (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues state.frame.values baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues state.frame.values baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := state.frame.values
+            credits := #[] }
+          state.stack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulationAt Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical (2 * site.shape.fieldCount + 3)
+      baselineMachine rewrittenMachine := by
+  exact state.acceptedPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+    rewrite baselineDefinition accepted (by omega)
+    (state.acceptedSiteParameterCount rewrite baselineDefinition accepted pc)
+    (by intro index bound; rfl) baselineSchemas rewrittenSchemas history
+    parameters stack fuel allocationSchemaAt fieldCount baselineSourceResolved
+    baselineAt baselineOwned rootsInRest retained retainedAt released
+    baselineNewOwned baselineMapped baselineAllocationResolved
+    baselineFieldWorlds tailResolved arity
+
+/-- Compatibility wrapper that forgets the baseline-length index. -/
+theorem acceptedPhysicalStableLiveMacroSimulationHistory
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      state.frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel rc retainedRc : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom state.frame.values (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (newRest ++ inertRoots
+        (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest)))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues state.frame.values baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues state.frame.values baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := state.frame.values
+            credits := #[] }
+          state.stack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableLiveMacroSimulation Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical baselineMachine rewrittenMachine := by
+  have baselineMappedFull : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))) :=
+    MappedValuesInRoots.mono baselineMapped (by
+      intro root member
+      exact List.mem_append_right _ member)
+  exact (state.acceptedPhysicalStableLiveMacroSimulationHistoryAt rewrite
+    baselineDefinition accepted pc baselineSchemas rewrittenSchemas history
+    parameters stack fuel allocationSchemaAt fieldCount
+    baselineSourceResolved baselineAt baselineOwned rootsInRest retained
+    retainedAt released baselineNewOwned baselineMappedFull
+    baselineAllocationResolved baselineFieldWorlds tailResolved arity).simulation
+
+/-- The attached closed main establishes every field of the compiler runtime
+state at the exact machine consumed by `runMain`. -/
+def initial
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    (attached : Pipeline.CompiledAttachment mainWorld lowerFuel) (heapFuel : Nat) :
+    CompilerRunningState attached
+      (Lower.Sim.initialMainMachine attached.target.artifact heapFuel) := by
+  let frame := Lower.Sim.initialMainFrame attached.target.artifact
+  let machine := Lower.Sim.initialMainMachine attached.target.artifact heapFuel
+  refine
+    { functionTrace := attached.target.artifact.mainTrace
+      trace := attached.target.artifact.mainTrace.root
+      sourceStore := {}
+      source := []
+      frameRoots := []
+      frame := frame
+      stack := []
+      member := attached.target.artifact.mainTraceMember
+      descendant := .refl
+      traceState := by
+        simpa [frame] using attached.initialMainTraceState
+      stores := by
+        simpa [machine, Lower.Sim.initialMainMachine] using
+          Lower.Sim.StoreRel.initial
+      runtime := Lower.Sim.SourceRuntimeInvariant.empty
+      ownership := attached.initialMainSourceOwnership
+      stackRoots := .nil
+      callStack := .nil
+      history := by simp [CompilerStackHistory, CompilerStackCompletion]
+      image := attached.sourceStoreImage_empty
+      control := by rfl
+      noCredits := by rfl }
+
+end CompilerRunningState
+
+/-- Global invariant for the compiler/reuse composition: the
+baseline state is justified by the lowering attachment and the two machines
+are related modulo only future-observable registers. Allocation-event equality
+and RC/peak bounds are separate components. Compiler-aware macros preserve the invariant, with
+accepted-site runtime premises reconstructed from actual execution. -/
+structure AttachedStableState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    (baseline rewritten : Machine) : Prop where
+  compiler : CompilerState attached baseline
+  related : StableLiveMachineRel Validate.defaultLimits
+    attached.target.artifact.validationContext baseline rewritten
+  acceptedEntry : StableLiveAcceptedEntry Validate.defaultLimits
+    attached.target.artifact.validationContext baseline rewritten
+  allocations : baseline.store.allocationEvents = rewritten.store.allocationEvents
+  costs : baseline.store.CostBounds rewritten.store
+
+
+/-- A synchronization macro paired with the concrete compiler state at its
+baseline endpoint and separate allocation and cost deltas. This is the local
+preservation object consumed by the whole-execution compiler/reuse invariant. -/
+inductive AttachedStableMacroStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    (baselineContext rewrittenContext : Eval.Context)
+    (interpretation : Interpretation)
+    (baselineStart rewrittenStart : Machine) : Prop where
+  | intro (baselineCount rewrittenCount : Nat)
+      (baselinePositive : 0 < baselineCount)
+      (rewrittenPositive : 0 < rewrittenCount)
+      (baselineTarget rewrittenTarget : Machine)
+      (baselineSteps : Steps baselineContext interpretation baselineCount
+        baselineStart baselineTarget)
+      (rewrittenSteps : Steps rewrittenContext interpretation rewrittenCount
+        rewrittenStart rewrittenTarget)
+      (related : StableLiveMachineRel Validate.defaultLimits
+        attached.target.artifact.validationContext baselineTarget
+        rewrittenTarget)
+      (acceptedEntry : StableLiveAcceptedEntry Validate.defaultLimits
+        attached.target.artifact.validationContext baselineTarget
+        rewrittenTarget)
+      (compiler : CompilerState attached baselineTarget)
+      (allocationDelta : AllocationDelta baselineStart.store baselineTarget.store
+        rewrittenStart.store rewrittenTarget.store)
+      (costDelta : CostDelta baselineStart.store baselineTarget.store
+        rewrittenStart.store rewrittenTarget.store) :
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation baselineStart rewrittenStart
+
+/-- Forget the compiler endpoint while retaining both positive executions and
+their live-indexed machine relation. -/
+theorem AttachedStableMacroStep.simulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart : Machine}
+    (step : AttachedStableMacroStep optimized baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart) :
+    StableLiveMacroSimulation Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart := by
+  cases step with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related _ _ _ _ =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related
+
+/-- Join fixed-length semantic reuse with the independently reconstructed
+compiler prefix.  Since both baseline executions have the same start and
+length, evaluator determinism identifies their endpoints; the compiler state
+and accepted-entry phase can therefore be attached without assuming a
+generic macro-length uniqueness principle. -/
+theorem CompilerAcceptedMacroStepAt.attach
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation} {count : Nat}
+    {baselineStart rewrittenStart : Machine}
+    (compilerMacro : CompilerAcceptedMacroStepAt attached baselineContext
+      interpretation count baselineStart)
+    (semantic : StableLiveMacroSimulationAt Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext interpretation count baselineStart rewrittenStart) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart := by
+  cases compilerMacro with
+  | intro baselinePositive compilerTarget compilerSteps compiler
+      acceptedEntry =>
+      cases semantic with
+      | intro _semanticPositive rewrittenCount rewrittenPositive
+          baselineTarget rewrittenTarget baselineSteps rewrittenSteps
+          related allocationDelta costDelta =>
+          have targetEq : baselineTarget = compilerTarget :=
+            Ix.Compiler.IxIR2.ReuseLiveSim.Steps.deterministic baselineSteps
+              compilerSteps
+          subst compilerTarget
+          exact .intro count rewrittenCount baselinePositive
+            rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+            rewrittenSteps related (acceptedEntry related) compiler allocationDelta costDelta
+
+/-- Normalize a heap-budget update at a running frame after exposing the
+fields fixed by an accepted block entry. -/
+private theorem machineWithHeapFuel_eq_runningEntry
+    {machine : Machine} {frame : Frame} {stack : List Continuation}
+    {source : Function} {heapFuel : Nat}
+    (control : machine.control = .running frame stack)
+    (definition : frame.definition = source)
+    (pc : frame.pc = 0) (credits : frame.credits = #[]) :
+    ({ machine with heapFuel := heapFuel } : Machine) =
+      { store := machine.store
+        heapFuel := heapFuel
+        control := .running
+          { definition := source
+            block := frame.block
+            values := frame.values
+            credits := #[] }
+          stack } := by
+  cases frame
+  simp_all
+
+/-- Attach the complete compiler-certified accepted prefix to the physical
+hot/cold semantic dispatcher.  The semantic theorem and compiler theorem see
+the same funded baseline machine and the same visible prefix length, so their
+recursive-call endpoints are identified by `Steps.deterministic`. -/
+theorem CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetched
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (frame : Frame) (baselineStack : List Continuation)
+    (control : machine.control = .running frame baselineStack)
+    (optimized : OptimizedAttachment attached)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions frame.block
+      helperOffset block (.accepted site))
+    (pc : frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {baselineFields : Array RVal}
+    (parameterCount : frame.values.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (fetchState : CompilerRunningState attached
+      { machine with
+        control := .running
+          { frame with
+            pc := site.shape.fieldCount
+            values := frame.values ++ baselineFields } baselineStack })
+    (fetchSteps : Steps baselineContext .physical site.shape.fieldCount machine
+      { machine with
+        control := .running
+          { frame with
+            pc := site.shape.fieldCount
+            values := frame.values ++ baselineFields } baselineStack })
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source frame.block 0 history.locRel
+      frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      baselineStack rewrittenStack)
+    {baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel rc retainedRc : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (budget : machine.heapFuel = fieldFuel + 1)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (baselineSourceResolved :
+      resolveAtom frame.values (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ fetchState.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues frame.values baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues frame.values baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues frame.values baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine := machine
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      .physical baselineMachine rewrittenMachine := by
+  dsimp only
+  let afterFetchFrame : Frame :=
+    { frame with
+      pc := site.shape.fieldCount
+      values := frame.values ++ baselineFields }
+  have fetchControlEq :
+      (.running fetchState.frame fetchState.stack : Control) =
+        .running afterFetchFrame baselineStack := fetchState.control.symm
+  have fetchFrameEq : fetchState.frame = afterFetchFrame := by
+    injection fetchControlEq
+  have fetchStackEq : fetchState.stack = baselineStack := by
+    injection fetchControlEq
+  have fetchedDefinition : fetchState.frame.definition = source := by
+    simpa [fetchFrameEq, afterFetchFrame] using baselineDefinition
+  have fetchedAccepted : Reuse.FunctionDecisions.At rewrite.decisions
+      fetchState.frame.block helperOffset block (.accepted site) := by
+    simpa [fetchFrameEq, afterFetchFrame] using accepted
+  have fetchedPc : fetchState.frame.pc ≤ site.shape.releasePosition := by
+    simp [fetchFrameEq, afterFetchFrame, site.fits.releasePosition]
+    omega
+  have parameterValues : ∀ {index : Nat}, index < site.shape.parameterCount →
+      fetchState.frame.values[index]? = frame.values[index]? := by
+    intro index bound
+    simp [fetchFrameEq, afterFetchFrame, Array.getElem?_append,
+      parameterCount, bound]
+  have fetchedParameters : LiveValuesIso source fetchState.frame.block 0
+      history.locRel frame.values rewrittenParameters := by
+    simpa [fetchFrameEq, afterFetchFrame] using parameters
+  have fetchedStack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      fetchState.stack rewrittenStack := by
+    simpa [fetchStackEq] using stack
+  let sourceContext : IxIR1.Ctx :=
+    { decls := IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts }
+  have compilerMacro : CompilerAcceptedMacroStepAt attached baselineContext
+      .physical (2 * site.shape.fieldCount + 3) machine :=
+    CompilerRunningState.acceptedPrefixCompilerMacroAtOfFetched frame
+      baselineStack (sourceContext := sourceContext) baselineSchemas rfl
+      rewrite baselineDefinition accepted parameterCount fieldCount
+      baselineSourceResolved retained (by simpa [budget] using released)
+      allocationSchemaAt baselineAllocationResolved tailResolved arity
+      fetchState fetchSteps
+  have semanticCanonical :=
+    fetchState.acceptedPhysicalStableLiveMacroSimulationHistoryAtOfParameters
+      rewrite fetchedDefinition fetchedAccepted fetchedPc parameterCount
+      parameterValues baselineSchemas rewrittenSchemas history
+      fetchedParameters fetchedStack fuel allocationSchemaAt fieldCount
+      baselineSourceResolved baselineAt baselineOwned rootsInRest retained
+      retainedAt released baselineNewOwned baselineMapped
+      baselineAllocationResolved baselineFieldWorlds tailResolved arity
+  dsimp only at semanticCanonical
+  have noCredits : frame.credits = #[] := by
+    simpa [fetchFrameEq, afterFetchFrame] using fetchState.noCredits
+  have baselineEq : machine =
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := frame.block
+            values := frame.values
+            credits := #[] }
+          baselineStack } := by
+    have funded := machineWithHeapFuel_eq_runningEntry
+      (heapFuel := fieldFuel + 1) control baselineDefinition pc noCredits
+    have machineEq : ({ machine with heapFuel := fieldFuel + 1 } : Machine) =
+        machine := by
+      exact congrArg (fun heapFuel => ({ machine with heapFuel } : Machine))
+        budget.symm
+    exact machineEq.symm.trans funded
+  apply compilerMacro.attach
+  rw [baselineEq]
+  simpa only [fetchFrameEq, fetchStackEq, afterFetchFrame] using
+    semanticCanonical
+
+/-- Specialize the fetched-state bridge to an ordinary traced entry. -/
+theorem CompilerRunningState.acceptedPhysicalStableMacroStepHistory
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    (optimized : OptimizedAttachment attached)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore baselineRetained baselineReleased : Store}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      state.frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    {baselineFields baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel remaining rewrittenFuel rc retainedRc : Nat}
+    {oldRest newRest : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom state.frame.values (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : machine.store.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc baselineLocation⟩ :: oldRest))
+    (rootsInRest : ∀ root ∈ state.frameRoots, root ∈ oldRest)
+    (retained : RetainSharedMany machine.store baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselineNewOwned : IxIR1.Sim.RootOwnership baselineReleased.heap
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++ newRest))
+    (baselineMapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues state.frame.values baselineFields)
+      (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+        (newRest ++ inertRoots
+          (IxIR1.Sim.rootsFor .shared baselineFields.toList ++ oldRest))))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues state.frame.values baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues state.frame.values baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine := { machine with heapFuel := fieldFuel + 1 }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      .physical baselineMachine rewrittenMachine := by
+  dsimp only
+  have parameterCount :=
+    state.acceptedSiteParameterCount rewrite baselineDefinition accepted pc
+  let baselineMachine : Machine := { machine with heapFuel := fieldFuel + 1 }
+  let baselineState : CompilerRunningState attached baselineMachine :=
+    state.withHeapFuel (fieldFuel + 1)
+  let sourceContext : IxIR1.Ctx :=
+    { decls := IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts }
+  have compilerMacro : CompilerAcceptedMacroStepAt attached baselineContext
+      .physical (2 * site.shape.fieldCount + 3) baselineMachine := by
+    exact baselineState.acceptedPrefixCompilerMacroAt
+      (sourceContext := sourceContext) baselineSchemas rfl rewrite
+      baselineDefinition accepted pc rfl parameterCount fieldCount
+      baselineSourceResolved (by simpa [baselineMachine] using baselineAt)
+      (by simpa [baselineMachine] using retained)
+      (by simpa [baselineMachine] using released) allocationSchemaAt
+      baselineAllocationResolved tailResolved arity
+  have semanticCanonical :=
+    state.acceptedPhysicalStableLiveMacroSimulationHistoryAt rewrite
+      baselineDefinition accepted pc baselineSchemas rewrittenSchemas history
+      parameters stack fuel allocationSchemaAt fieldCount
+      baselineSourceResolved baselineAt baselineOwned rootsInRest retained
+      retainedAt released baselineNewOwned baselineMapped
+      baselineAllocationResolved baselineFieldWorlds tailResolved arity
+  dsimp only at semanticCanonical
+  have baselineEq : baselineMachine =
+      { store := machine.store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := state.frame.block
+            values := state.frame.values
+            credits := #[] }
+          state.stack } := by
+    exact machineWithHeapFuel_eq_runningEntry state.control
+      baselineDefinition pc state.noCredits
+  have semantic : StableLiveMacroSimulationAt Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext .physical (2 * site.shape.fieldCount + 3)
+      baselineMachine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack } := by
+    rw [baselineEq]
+    exact semanticCanonical
+  exact compilerMacro.attach semantic
+
+/-- Invert the concrete baseline suffix at an accepted entry.  The actual
+execution supplies the release budget, allocation operands/worlds, and
+recursive tail arguments; compiler reconstruction supplies the matching
+source trace and exact ownership accounting. -/
+theorem CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetchedExecution
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (frame : Frame) (baselineStack : List Continuation)
+    (control : machine.control = .running frame baselineStack)
+    (optimized : OptimizedAttachment attached)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions frame.block
+      helperOffset block (.accepted site))
+    (pc : frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {fields : Array RVal} {location rc : Nat}
+    (parameterCount : frame.values.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom frame.values (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceAt : machine.store.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (fetchState : CompilerRunningState attached
+      { machine with
+        control := .running
+          { frame with
+            pc := site.shape.fieldCount
+            values := frame.values ++ fields } baselineStack })
+    (fetchSteps : Steps baselineContext .physical site.shape.fieldCount machine
+      { machine with
+        control := .running
+          { frame with
+            pc := site.shape.fieldCount
+            values := frame.values ++ fields } baselineStack })
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source frame.block 0 history.locRel
+      frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      baselineStack rewrittenStack)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    {baselineNext baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (stepped : Step baselineContext .physical machine baselineNext)
+    (suffix : Steps baselineContext .physical suffixCount baselineNext
+      baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      .physical machine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack } := by
+  obtain ⟨sourceAtBlock, _resetAt, _hotAt, _coldAt⟩ :=
+    rewrite.acceptedAt accepted
+  have blockAt : frame.definition.blocks[frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact sourceAtBlock
+  let sourceContext : IxIR1.Ctx :=
+    { decls := IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts }
+  let afterFetchFrame : Frame :=
+    { frame with
+      pc := site.shape.fieldCount
+      values := frame.values ++ fields }
+  let afterFetch : Machine :=
+    { machine with control := .running afterFetchFrame baselineStack }
+  have fetchControlEq :
+      (.running fetchState.frame fetchState.stack : Control) =
+        .running afterFetchFrame baselineStack := by
+    calc
+      _ = afterFetch.control := fetchState.control.symm
+      _ = _ := by rfl
+  have fetchFrameEq : fetchState.frame = afterFetchFrame := by
+    injection fetchControlEq
+  have fetchStackEq : fetchState.stack = baselineStack := by
+    injection fetchControlEq
+  have fetchBlockAt :
+      fetchState.frame.definition.blocks[fetchState.frame.block]? =
+        some block := by
+    simpa [fetchFrameEq, afterFetchFrame] using blockAt
+  have fetchedDefinition : fetchState.frame.definition = source := by
+    simpa [fetchFrameEq, afterFetchFrame] using baselineDefinition
+  have fetchedAccepted : Reuse.FunctionDecisions.At rewrite.decisions
+      fetchState.frame.block helperOffset block (.accepted site) := by
+    simpa [fetchFrameEq, afterFetchFrame] using accepted
+  have fetchedPc : fetchState.frame.pc ≤ site.shape.releasePosition := by
+    simp [fetchFrameEq, afterFetchFrame, site.fits.releasePosition]
+    omega
+  have fetchedSourceResolved : resolveAtom fetchState.frame.values
+      (.reg site.shape.source) = .ok (.loc location) := by
+    simpa [fetchFrameEq, afterFetchFrame, resolveAtom, Array.getElem?_append,
+      parameterCount, site.fits.sourceBound] using sourceResolved
+  obtain ⟨oldRest, retainedStore, retainedRc, baselineOwned, rootsInRest,
+      retained, retainedAt, _retainedOwned⟩ :=
+    fetchState.acceptedSiteRetainedFields rewrite fetchedDefinition
+      fetchedAccepted fetchedPc fetchedSourceResolved sourceAt
+  let afterRetainFrame : Frame :=
+    { frame with
+      pc := 2 * site.shape.fieldCount
+      values := baselinePrefixValues frame.values fields }
+  let afterRetains : Machine :=
+    { store := retainedStore
+      heapFuel := machine.heapFuel
+      control := .running afterRetainFrame baselineStack }
+  obtain ⟨retainStateRaw, retainStepsRaw⟩ :=
+    fetchState.retainPrefixState (sourceContext := sourceContext)
+      (context := baselineContext) (interpretation := .physical) rfl site
+      fetchBlockAt parameterCount fieldCount
+      (by simp [fetchFrameEq, afterFetchFrame])
+      (by simp [fetchFrameEq, afterFetchFrame])
+      (by simpa [afterFetch] using retained)
+  have retainMachineEq :
+      ({ store := retainedStore
+         heapFuel := afterFetch.heapFuel
+         control := .running
+           { fetchState.frame with
+             pc := 2 * site.shape.fieldCount
+             values := baselinePrefixValues frame.values fields }
+           fetchState.stack } : Machine) = afterRetains := by
+    simp [afterFetch, afterRetains, fetchFrameEq, fetchStackEq,
+      afterFetchFrame, afterRetainFrame]
+  rw [retainMachineEq] at retainStateRaw retainStepsRaw
+  let retainState : CompilerRunningState attached afterRetains :=
+    retainStateRaw
+  have retainControlEq :
+      (.running retainState.frame retainState.stack : Control) =
+        .running afterRetainFrame baselineStack := by
+    calc
+      _ = afterRetains.control := retainState.control.symm
+      _ = _ := by rfl
+  have retainFrameEq : retainState.frame = afterRetainFrame := by
+    injection retainControlEq
+  have retainStackEq : retainState.stack = baselineStack := by
+    injection retainControlEq
+  have fetchRetainSteps : Steps baselineContext .physical
+      (2 * site.shape.fieldCount) machine afterRetains := by
+    simpa [Nat.two_mul] using fetchSteps.trans retainStepsRaw
+  have total : Steps baselineContext .physical (1 + suffixCount) machine
+      baselineFinal := (stepped.toSteps control).trans suffix
+  obtain ⟨remainingCount, _countEq, remainingSteps⟩ :=
+    fetchRetainSteps.cancelPrefixToHalted total halted
+  generalize finalEq : baselineFinal = actualFinal at remainingSteps halted
+  cases remainingSteps with
+  | refl =>
+      have impossible := congrArg Machine.control halted
+      simp [afterRetains] at impossible
+  | @cons releaseTailCount _ releaseTarget _ releaseFrame releaseStack
+      releaseRunning releaseStep releaseTail =>
+      have retainBaselineDefinition : retainState.frame.definition = source := by
+        simpa [retainFrameEq, afterRetainFrame] using baselineDefinition
+      have retainAccepted : Reuse.FunctionDecisions.At rewrite.decisions
+          retainState.frame.block helperOffset block (.accepted site) := by
+        simpa [retainFrameEq, afterRetainFrame] using accepted
+      have retainPc : retainState.frame.pc = site.shape.releasePosition := by
+        simp [retainFrameEq, afterRetainFrame, site.fits.releasePosition]
+      have retainSourceResolved : resolveAtom retainState.frame.values
+          (.reg site.shape.source) = .ok (.loc location) := by
+        simpa [retainFrameEq, afterRetainFrame, baselinePrefixValues,
+          resolveAtom, Array.getElem?_append, parameterCount,
+          site.fits.sourceBound] using sourceResolved
+      change Step baselineContext .physical
+        { store := retainedStore
+          heapFuel := machine.heapFuel
+          control := .running afterRetainFrame baselineStack }
+        releaseTarget at releaseStep
+      cases releaseStep.classify with
+      | instruction actualBlockAt actualPc instructionAt transfer =>
+          have canonicalBlockAt : afterRetainFrame.definition.blocks[
+              afterRetainFrame.block]? = some block := by
+            simpa [afterRetainFrame] using blockAt
+          have actualBlockEq : block = _ := Option.some.inj
+            (canonicalBlockAt.symm.trans actualBlockAt)
+          cases actualBlockEq
+          have expectedRelease :
+              block.instructions[afterRetainFrame.pc] =
+                .releaseShared (.reg site.shape.source) := by
+            obtain ⟨_releaseBound, releaseInstruction⟩ :=
+              Array.getElem?_eq_some_iff.mp site.fits.release
+            simpa [afterRetainFrame, site.fits.releasePosition] using
+              releaseInstruction
+          have instructionEq := instructionAt.symm.trans expectedRelease
+          cases instructionEq
+          cases transfer with
+          | @releaseShared _ value releasedStore remainingFuel
+              actualResolved actualReleased =>
+              have canonicalResolved : resolveAtom afterRetainFrame.values
+                  (.reg site.shape.source) = .ok (.loc location) := by
+                simpa [retainFrameEq] using retainSourceResolved
+              have valueEq : value = .loc location :=
+                Except.ok.inj (actualResolved.symm.trans canonicalResolved)
+              subst value
+              let afterReleaseFrame : Frame :=
+                { frame with
+                  pc := 2 * site.shape.fieldCount + 1
+                  values := baselinePrefixValues frame.values fields }
+              let afterRelease : Machine :=
+                { store := releasedStore
+                  heapFuel := remainingFuel
+                  control := .running afterReleaseFrame baselineStack }
+              obtain ⟨releaseStateRaw, generatedReleaseStepRaw⟩ :=
+                retainState.stepAcceptedReleaseOfTarget
+                  (sourceContext := sourceContext)
+                  (context := baselineContext) (interpretation := .physical)
+                  rewrite retainBaselineDefinition retainAccepted retainPc rfl
+                  retainSourceResolved
+                  (by simpa [afterRetains] using actualReleased)
+              have releaseMachineEq :
+                  ({ store := releasedStore
+                     heapFuel := remainingFuel
+                     control := .running
+                       { retainState.frame with
+                         pc := retainState.frame.pc + 1 }
+                       retainState.stack } : Machine) = afterRelease := by
+                simp [afterRelease, afterReleaseFrame, retainFrameEq,
+                  retainStackEq, afterRetainFrame]
+              rw [releaseMachineEq] at releaseStateRaw generatedReleaseStepRaw
+              have actualReleaseMachineEq :
+                  ({ store := releasedStore
+                     heapFuel := remainingFuel
+                     control := .running
+                       { afterRetainFrame with
+                         pc := afterRetainFrame.pc + 1 }
+                       baselineStack } : Machine) = afterRelease := by
+                simp [afterRelease, afterReleaseFrame, afterRetainFrame]
+              rw [actualReleaseMachineEq] at releaseTail
+              let releaseState : CompilerRunningState attached afterRelease :=
+                releaseStateRaw
+              have releaseControlEq :
+                  (.running releaseState.frame releaseState.stack : Control) =
+                    .running afterReleaseFrame baselineStack := by
+                calc
+                  _ = afterRelease.control := releaseState.control.symm
+                  _ = _ := by rfl
+              have releaseFrameEq : releaseState.frame = afterReleaseFrame := by
+                injection releaseControlEq
+              have releaseStackEq : releaseState.stack = baselineStack := by
+                injection releaseControlEq
+              have releaseBlockAt : releaseState.frame.definition.blocks[
+                  releaseState.frame.block]? = some block := by
+                simpa [releaseFrameEq, afterReleaseFrame] using blockAt
+              have releasePc : releaseState.frame.pc =
+                  site.shape.releasePosition + 1 := by
+                simp [releaseFrameEq, afterReleaseFrame,
+                  site.fits.releasePosition]
+              generalize tailFinalEq : actualFinal = tailFinal at releaseTail halted
+              cases releaseTail with
+              | refl =>
+                  have impossible := congrArg Machine.control halted
+                  simp [afterRelease] at impossible
+              | @cons allocationTailCount _ allocationTarget _
+                  allocationFrame allocationStack allocationRunning
+                  allocationStep allocationTail =>
+                  change Step baselineContext .physical
+                    { store := releasedStore
+                      heapFuel := remainingFuel
+                      control := .running afterReleaseFrame baselineStack }
+                    allocationTarget at allocationStep
+                  cases allocationStep.classify with
+                  | instruction actualBlockAt actualPc instructionAt transfer =>
+                      have canonicalBlockAt :
+                          afterReleaseFrame.definition.blocks[
+                            afterReleaseFrame.block]? = some block := by
+                        simpa [afterReleaseFrame] using blockAt
+                      have actualBlockEq : block = _ := Option.some.inj
+                        (canonicalBlockAt.symm.trans actualBlockAt)
+                      cases actualBlockEq
+                      have expectedAllocation :
+                          block.instructions[afterReleaseFrame.pc] =
+                            .alloc .shared
+                              site.shape.allocationConstructor
+                              site.shape.allocationArguments := by
+                        obtain ⟨_allocationBound, allocationInstruction⟩ :=
+                          Array.getElem?_eq_some_iff.mp site.fits.allocation
+                        simpa [afterReleaseFrame,
+                          site.fits.releasePosition] using
+                          allocationInstruction
+                      have instructionEq :=
+                        instructionAt.symm.trans expectedAllocation
+                      cases instructionEq
+                      cases transfer with
+                      | @alloc _ _ _ allocationSchema newFields schemaAt
+                          actualAllocationResolved allocationWorlds =>
+                          have releaseAllocationResolved : resolveAtoms
+                              releaseState.frame.values
+                                site.shape.allocationArguments =
+                              .ok newFields := by
+                            simpa [releaseFrameEq] using
+                              actualAllocationResolved
+                          have releasePcBound : releaseState.frame.pc <
+                              block.instructions.size := by
+                            simpa [releaseFrameEq] using actualPc
+                          have releaseInstruction :
+                              block.instructions[releaseState.frame.pc] =
+                                .alloc .shared
+                                  site.shape.allocationConstructor
+                                  site.shape.allocationArguments := by
+                            simpa [releaseFrameEq] using expectedAllocation
+                          have allocationLast : releaseState.frame.pc + 1 =
+                              block.instructions.size := by
+                            rw [releasePc, site.fits.releasePosition,
+                              site.fits.instructionCount]
+                          obtain ⟨traceSite, traceBlockId, input, nextInput,
+                              entryValueCount, traceIndex, sourceWorld,
+                              sourceCid, sourceArguments, tailSite,
+                              tailBlockId, tailInput, tailEntryValueCount,
+                              tailSourceArguments, generated, traceEq,
+                              sourceWorldEq,
+                              allocationTranslated, tailTranslated⟩ :=
+                            releaseState.currentTerminalAllocation
+                              releaseBlockAt allocationLast releaseInstruction
+                              site.fits.terminator
+                          have exactTraceState := releaseState.traceState
+                          rw [traceEq] at exactTraceState
+                          have sourceCount : releaseState.source.length =
+                              input.size := by
+                            simpa [Lower.CodeTrace.sourceInputMap] using
+                              exactTraceState.target.sourceCount
+                          have sourceAtoms :=
+                            Lower.Sim.atomsRel_of_translateAtoms
+                              allocationTranslated
+                          have sourceAllocationResolved :
+                              IxIR1.resolveAtoms releaseState.source
+                                  sourceArguments = .ok newFields.toList :=
+                            Lower.Sim.resolveAtoms_of_envRel_target
+                              exactTraceState.target.environments sourceCount
+                              sourceAtoms releaseAllocationResolved
+                          obtain ⟨beforePosition, afterPosition,
+                              remainingCapabilities, beforeMember, afterMember,
+                              beforeCoordinate, afterCoordinate, consumed,
+                              afterCapabilities, allocationReadyOwned⟩ :=
+                            releaseState.allocationReadyOwnership traceEq
+                              sourceAllocationResolved
+                          have noBorrows :=
+                            releaseState.terminalAllocationNoBorrows traceEq
+                              beforeMember beforeCoordinate
+                          have plannerCoordinate :
+                              beforePosition.coordinateMatches
+                                releaseState.trace.source
+                                releaseState.trace.sourceBlock
+                                releaseState.trace.targetPosition
+                                releaseState.trace.sourceInputMap = true := by
+                            simpa [traceEq, Lower.CodeTrace.source,
+                              Lower.CodeTrace.sourceBlock,
+                              Lower.CodeTrace.targetPosition,
+                              Lower.CodeTrace.sourceInputMap] using
+                                beforeCoordinate
+                          have mappedBefore :=
+                            releaseState.mappedValuesAtPlannerAllocationOfNoBorrows
+                              beforeMember plannerCoordinate noBorrows site
+                              releaseBlockAt releasePc
+                          have beforeInvariant := releaseState.ownership
+                            beforePosition beforeMember plannerCoordinate
+                          have beforeOwned : IxIR1.Sim.RootOwnership
+                              releasedStore.heap
+                              (Lower.Sim.rootsForCapabilities
+                                  beforePosition.sourceCapabilities.toList
+                                  releaseState.source ++
+                                releaseState.frameRoots) := by
+                            change IxIR1.Sim.RootOwnership
+                              afterRelease.store.heap _
+                            rw [releaseState.heap_eq]
+                            exact beforeInvariant.ownership
+                          have mappedFramed : MappedValuesInRoots site.shape
+                              releaseState.frame.values
+                              (Lower.Sim.rootsForCapabilities
+                                  beforePosition.sourceCapabilities.toList
+                                  releaseState.source ++
+                                releaseState.frameRoots) :=
+                            MappedValuesInRoots.mono mappedBefore (by
+                              intro root member
+                              exact List.mem_append_left _ member)
+                          let newRest : List IxIR1.Sim.Root :=
+                            Lower.Sim.rootsForCapabilities
+                                remainingCapabilities.toList
+                                releaseState.source ++
+                              releaseState.frameRoots
+                          subst sourceWorld
+                          have baselineNewOwned : IxIR1.Sim.RootOwnership
+                              releasedStore.heap
+                              (IxIR1.Sim.rootsFor .shared newFields.toList ++
+                                newRest) := by
+                            simpa [afterRelease, newRest] using
+                              allocationReadyOwned
+                          have mappedNew : MappedValuesInRoots site.shape
+                              releaseState.frame.values
+                              (IxIR1.Sim.rootsFor .shared newFields.toList ++
+                                newRest) :=
+                            MappedValuesInRoots.transportOwnership mappedFramed
+                              beforeOwned baselineNewOwned
+                          have mappedCanonical : MappedValuesInRoots site.shape
+                              (baselinePrefixValues frame.values fields)
+                              (IxIR1.Sim.rootsFor .shared newFields.toList ++
+                                newRest) := by
+                            simpa [releaseFrameEq, afterReleaseFrame] using
+                              mappedNew
+                          have baselineMapped : MappedValuesInRoots site.shape
+                              (baselinePrefixValues frame.values fields)
+                              (IxIR1.Sim.rootsFor .shared newFields.toList ++
+                                (newRest ++ inertRoots
+                                  (IxIR1.Sim.rootsFor .shared fields.toList ++
+                                    oldRest))) := by
+                            apply MappedValuesInRoots.mono mappedCanonical
+                            intro root member
+                            rcases List.mem_append.mp member with member | member
+                            · exact List.mem_append_left _ member
+                            · exact List.mem_append_right _
+                                (List.mem_append_left _ member)
+                          let allocation := releasedStore.allocNode .shared
+                            (.ctorN site.shape.allocationConstructor newFields)
+                          let afterAllocationFrame : Frame :=
+                            { frame with
+                              pc := 2 * site.shape.fieldCount + 2
+                              values :=
+                                (baselinePrefixValues frame.values
+                                  fields).push (.loc allocation.2) }
+                          let afterAllocation : Machine :=
+                            { store := allocation.1
+                              heapFuel := remainingFuel
+                              control := .running afterAllocationFrame
+                                baselineStack }
+                          obtain ⟨allocationStateRaw,
+                              generatedAllocationStepRaw,
+                              _allocationEntry⟩ :=
+                            releaseState.stepAllocOfTarget
+                              (sourceContext := sourceContext) (sourceFuel := 0)
+                              (context := baselineContext)
+                              (interpretation := .physical) baselineSchemas rfl
+                              releaseBlockAt releasePcBound releaseInstruction
+                              schemaAt releaseAllocationResolved
+                          have allocationMachineEq :
+                              ({ store := allocation.1
+                                 heapFuel := afterRelease.heapFuel
+                                 control := .running
+                                   { releaseState.frame with
+                                     pc := releaseState.frame.pc + 1
+                                     values := releaseState.frame.values.push
+                                       (.loc allocation.2) }
+                                   releaseState.stack } : Machine) =
+                                afterAllocation := by
+                            simp [afterRelease, afterAllocation,
+                              afterAllocationFrame, releaseFrameEq,
+                              releaseStackEq, afterReleaseFrame, allocation]
+                          rw [allocationMachineEq] at allocationStateRaw generatedAllocationStepRaw
+                          have actualAllocationMachineEq :
+                              (let actualAllocation :=
+                                  releasedStore.allocNode .shared
+                                    (.ctorN site.shape.allocationConstructor
+                                      newFields);
+                                ({ store := actualAllocation.1
+                                   heapFuel := remainingFuel
+                                   control := .running
+                                     { afterReleaseFrame with
+                                       pc := afterReleaseFrame.pc + 1
+                                       values := afterReleaseFrame.values.push
+                                         (.loc actualAllocation.2) }
+                                     baselineStack } : Machine)) =
+                                afterAllocation := by
+                            simp [afterAllocation, afterAllocationFrame,
+                              afterReleaseFrame, allocation]
+                          rw [actualAllocationMachineEq] at allocationTail
+                          let allocationState : CompilerRunningState attached
+                              afterAllocation := allocationStateRaw
+                          have allocationControlEq :
+                              (.running allocationState.frame
+                                  allocationState.stack : Control) =
+                                .running afterAllocationFrame baselineStack := by
+                            calc
+                              _ = afterAllocation.control :=
+                                allocationState.control.symm
+                              _ = _ := by rfl
+                          have allocationFrameEq : allocationState.frame =
+                              afterAllocationFrame := by
+                            injection allocationControlEq
+                          have allocationStackEq : allocationState.stack =
+                              baselineStack := by
+                            injection allocationControlEq
+                          have allocationBlockAt :
+                              allocationState.frame.definition.blocks[
+                                allocationState.frame.block]? = some block := by
+                            simpa [allocationFrameEq, afterAllocationFrame]
+                              using blockAt
+                          have allocationPc : allocationState.frame.pc =
+                              block.instructions.size := by
+                            simpa [allocationFrameEq, afterAllocationFrame]
+                              using site.fits.instructionCount.symm
+                          generalize allocationFinalEq : tailFinal =
+                            allocationFinal at allocationTail halted
+                          cases allocationTail with
+                          | refl =>
+                              have impossible := congrArg Machine.control halted
+                              simp [afterAllocation] at impossible
+                          | @cons tailCount _ tailTarget _ tailFrame tailStack
+                              tailRunning tailStep tailSuffix =>
+                              change Step baselineContext .physical
+                                { store := allocation.1
+                                  heapFuel := remainingFuel
+                                  control := .running afterAllocationFrame
+                                    baselineStack }
+                                tailTarget at tailStep
+                              generalize stackEq : baselineStack = actualStack
+                                at tailStep
+                              cases tailStep.classify with
+                              | instruction actualBlockAt actualPc
+                                  instructionAt transfer =>
+                                  have canonicalBlockAt :
+                                      afterAllocationFrame.definition.blocks[
+                                        afterAllocationFrame.block]? =
+                                          some block := by
+                                    simpa [afterAllocationFrame] using blockAt
+                                  have actualBlockEq : block = _ :=
+                                    Option.some.inj
+                                      (canonicalBlockAt.symm.trans
+                                        actualBlockAt)
+                                  cases actualBlockEq
+                                  have allocationPcEq :
+                                      afterAllocationFrame.pc =
+                                        block.instructions.size := by
+                                    simpa [allocationFrameEq] using
+                                      allocationPc
+                                  omega
+                              | terminator actualBlockAt actualPc terminatorAt
+                                  transfer =>
+                                  have canonicalBlockAt :
+                                      afterAllocationFrame.definition.blocks[
+                                        afterAllocationFrame.block]? =
+                                          some block := by
+                                    simpa [afterAllocationFrame] using blockAt
+                                  have actualBlockEq : block = _ :=
+                                    Option.some.inj
+                                      (canonicalBlockAt.symm.trans
+                                        actualBlockAt)
+                                  cases actualBlockEq
+                                  have expectedTerminator :
+                                      block.terminator =
+                                        .tailCallSelf
+                                          site.shape.tailArguments :=
+                                    site.fits.terminator
+                                  have terminatorEq :=
+                                    terminatorAt.symm.trans expectedTerminator
+                                  cases terminatorEq
+                                  cases transfer with
+                                  | @tailCallSelf _ _ callValues noCredits
+                                      actualTailResolved actualArity nonempty =>
+                                      have canonicalAllocationResolved :
+                                          resolveAtoms
+                                            (baselinePrefixValues
+                                              frame.values fields)
+                                            site.shape.allocationArguments =
+                                              .ok newFields := by
+                                        simpa [afterReleaseFrame] using
+                                          actualAllocationResolved
+                                      have canonicalTailResolved :
+                                          resolveAtoms
+                                            ((baselinePrefixValues
+                                                frame.values fields).push
+                                              (.loc
+                                                (releasedStore.allocNode
+                                                  .shared
+                                                  (.ctorN
+                                                    site.shape.allocationConstructor
+                                                    newFields)).2))
+                                            site.shape.tailArguments =
+                                              .ok callValues := by
+                                        simpa [afterAllocationFrame,
+                                          allocation] using
+                                            actualTailResolved
+                                      have canonicalArity : callValues.size =
+                                          source.signature.params.size := by
+                                        simpa [afterAllocationFrame,
+                                          baselineDefinition] using
+                                            actualArity
+                                      cases fuelEq : machine.heapFuel with
+                                      | zero =>
+                                          simp [fuelEq, Eval.releaseShared,
+                                            Eval.releaseSharedWork] at actualReleased
+                                      | succ fieldFuel =>
+                                          have funded : fieldFuel + 1 ≤
+                                              rewrittenFuel := by
+                                            simpa [fuelEq,
+                                              Nat.succ_eq_add_one] using fuel
+                                          have canonicalReleased :
+                                              releaseShared (fieldFuel + 1)
+                                                retainedStore (.loc location) =
+                                                  .ok (releasedStore,
+                                                    remainingFuel) := by
+                                            simpa [fuelEq,
+                                              Nat.succ_eq_add_one] using
+                                                actualReleased
+                                          have ready :=
+                                            CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetched
+                                              frame baselineStack control
+                                              optimized rewrite
+                                              baselineDefinition accepted pc
+                                              baselineSchemas rewrittenSchemas
+                                              parameterCount fieldCount
+                                              fetchState fetchSteps
+                                              history parameters stack funded
+                                              (by simp [fuelEq])
+                                              schemaAt sourceResolved sourceAt
+                                              baselineOwned rootsInRest
+                                              retained retainedAt
+                                              canonicalReleased
+                                              baselineNewOwned baselineMapped
+                                              canonicalAllocationResolved
+                                              allocationWorlds
+                                              canonicalTailResolved
+                                              canonicalArity
+                                          exact ready
+                  | terminator actualBlockAt actualPc terminatorAt transfer =>
+                      have canonicalBlockAt :
+                          afterReleaseFrame.definition.blocks[
+                            afterReleaseFrame.block]? = some block := by
+                        simpa [afterReleaseFrame] using blockAt
+                      have actualBlockEq : block = _ := Option.some.inj
+                        (canonicalBlockAt.symm.trans actualBlockAt)
+                      cases actualBlockEq
+                      have allocationBound :=
+                        (Array.getElem?_eq_some_iff.mp site.fits.allocation).1
+                      have allocationPcEq : afterReleaseFrame.pc =
+                          site.shape.releasePosition + 1 := by
+                        simp [afterReleaseFrame, site.fits.releasePosition]
+                      rw [allocationPcEq] at actualPc
+                      omega
+      | terminator actualBlockAt actualPc terminatorAt transfer =>
+          have releaseBound :=
+            (Array.getElem?_eq_some_iff.mp site.fits.release).1
+          have canonicalBlockAt : afterRetainFrame.definition.blocks[
+              afterRetainFrame.block]? = some block := by
+            simpa [afterRetainFrame] using blockAt
+          have actualBlockEq : block = _ := Option.some.inj
+            (canonicalBlockAt.symm.trans actualBlockAt)
+          cases actualBlockEq
+          have releasePcEq : afterRetainFrame.pc =
+              site.shape.releasePosition := by
+            simp [afterRetainFrame, site.fits.releasePosition]
+          rw [releasePcEq] at actualPc
+          omega
+
+
+/-- Reconstruct fetched compiler evidence at an ordinary accepted entry,
+then use the shared successful-suffix proof. -/
+theorem CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfExecution
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    (optimized : OptimizedAttachment attached)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (baselineDefinition : state.frame.definition = source)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions state.frame.block
+      helperOffset block (.accepted site))
+    (pc : state.frame.pc = 0)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    (history : IxIR1.Sim.HeapHistoryIso machine.store.heap
+      rewrittenStore.heap)
+    {rewrittenParameters : Array RVal}
+    {rewrittenStack : List Continuation}
+    (parameters : LiveValuesIso source state.frame.block 0 history.locRel
+      state.frame.values rewrittenParameters)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext history.locRel
+      state.stack rewrittenStack)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    {baselineNext baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (stepped : Step baselineContext .physical machine baselineNext)
+    (suffix : Steps baselineContext .physical suffixCount baselineNext
+      baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      .physical machine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := state.frame.block
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack } := by
+  obtain ⟨location, rc, fields, sourceResolved, sourceAt⟩ :=
+    state.acceptedEntrySourceOfStep rewrite baselineDefinition accepted pc
+      stepped
+  have fieldCount := state.acceptedSiteSourceFieldCount site sourceAt
+  have blockAt : state.frame.definition.blocks[state.frame.block]? =
+      some block := by
+    rw [baselineDefinition]
+    exact (rewrite.acceptedAt accepted).1
+  have parameterCount :=
+    state.acceptedSiteParameterCount rewrite baselineDefinition accepted pc
+  let sourceContext : IxIR1.Ctx :=
+    { decls := IxIR1.HPT.programDeclEnv
+        attached.source.lowering.result.artifacts }
+  obtain ⟨fetchState, fetchSteps⟩ :=
+    state.fetchPrefixState (sourceContext := sourceContext)
+      (context := baselineContext) (interpretation := .physical) rfl site
+      blockAt pc rfl parameterCount fieldCount sourceResolved sourceAt rfl
+  exact CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetchedExecution
+    state.frame state.stack state.control optimized rewrite baselineDefinition
+    accepted pc baselineSchemas rewrittenSchemas parameterCount fieldCount
+    sourceResolved sourceAt fetchState fetchSteps history parameters stack
+    fuel stepped suffix halted
+
+/-- Pair two related single steps with the compiler state reconstructed at the
+baseline successor. -/
+theorem AttachedStableMacroStep.ofStepsOne
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineTarget rewrittenTarget : Machine}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (baselineRunning : baselineStart.control =
+      .running baselineFrame baselineStack)
+    (rewrittenRunning : rewrittenStart.control =
+      .running rewrittenFrame rewrittenStack)
+    (baselineStep : Step baselineContext interpretation baselineStart
+      baselineTarget)
+    (rewrittenStep : Step rewrittenContext interpretation rewrittenStart
+      rewrittenTarget)
+    (related : StableLiveMachineRel Validate.defaultLimits
+      attached.target.artifact.validationContext baselineTarget
+      rewrittenTarget)
+    (acceptedEntry : StableLiveAcceptedEntry Validate.defaultLimits
+      attached.target.artifact.validationContext baselineTarget
+      rewrittenTarget)
+    (compiler : CompilerState attached baselineTarget)
+    (allocationDelta : AllocationDelta baselineStart.store baselineTarget.store
+      rewrittenStart.store rewrittenTarget.store)
+    (costDelta : CostDelta baselineStart.store baselineTarget.store
+      rewrittenStart.store rewrittenTarget.store) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart :=
+  .intro 1 1 (by omega) (by omega) baselineTarget rewrittenTarget
+    (baselineStep.toSteps baselineRunning)
+    (rewrittenStep.toSteps rewrittenRunning) related acceptedEntry compiler allocationDelta costDelta
+
+/-- At a synchronized accepted entry, the rewritten frame is literally the
+canonical frame used by the accepted-prefix macro.  The live relation fixes
+its definition, block, and program counter; exact credit-file length turns
+the compiler's empty baseline credit file into an empty rewritten one. -/
+private theorem StableLiveFrameIso.rewritten_eq_entry
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableLiveFrameIso rewrite locRel baseline rewritten)
+    (pc : baseline.pc = 0) (noCredits : baseline.credits = #[]) :
+    rewritten =
+      { definition := rewrite.definition
+        block := baseline.block
+        values := rewritten.values
+        credits := #[] } := by
+  have rewrittenCreditSize : rewritten.credits.size = 0 := by
+    simpa [noCredits] using frame.credits.length_eq.symm
+  have rewrittenCredits : rewritten.credits = #[] :=
+    Array.eq_empty_of_size_eq_zero rewrittenCreditSize
+  have rewrittenPc : rewritten.pc = 0 := frame.pc.symm.trans pc
+  cases baseline
+  cases rewritten
+  simp only [Frame.mk.injEq]
+  exact ⟨frame.rewrittenDefinition, frame.block.symm, rewrittenPc,
+    True.intro, rewrittenCredits⟩
+
+/-- Compose an accepted constructor child's actual successful suffix with the
+compiler state after its generated fetch prologue. Empty prologues already
+start at a compiler entry; nonempty prologues coincide with the recognized
+fetch batch and use the shared fetched-state macro. -/
+theorem acceptedCtorChildPhysicalMacroOfExecution
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel baselineFrame
+      rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel baselineStack
+      rewrittenStack)
+    {helperOffset : Nat} {block : Block}
+    {site : Reuse.Site Validate.defaultLimits
+      attached.target.artifact.validationContext block}
+    (accepted : Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+      helperOffset block (.accepted site))
+    (pc : baselineFrame.pc = 0)
+    (parameterCount : baselineFrame.values.size = site.shape.parameterCount)
+    {fields : Array RVal}
+    (childState : CompilerRunningState attached
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := fields.size
+            values := baselineFrame.values ++ fields } baselineStack })
+    {childScrutinee : Atom} {cid : CtorId} {location : Nat} {box : NodeBox}
+    (prologue : Lower.fetchPrologueMatches block.instructions childScrutinee cid
+      fields.size = true)
+    (resolved : resolveAtom baselineFrame.values childScrutinee =
+      .ok (.loc location))
+    (boxAt : baselineStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {baselineNext baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (stepped : Step baselineContext .physical
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack } baselineNext)
+    (suffix : Steps baselineContext .physical suffixCount baselineNext
+      baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext .physical
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have childControlEq :
+      (.running childState.frame childState.stack : Control) =
+        .running
+          { baselineFrame with
+            pc := fields.size
+            values := baselineFrame.values ++ fields } baselineStack :=
+    childState.control.symm
+  have childFrameEq : childState.frame =
+      { baselineFrame with
+        pc := fields.size
+        values := baselineFrame.values ++ fields } := by
+    injection childControlEq
+  have noCredits : baselineFrame.credits = #[] := by
+    simpa [childFrameEq] using childState.noCredits
+  have rewrittenEq := frame.rewritten_eq_entry pc noCredits
+  have parameters : LiveValuesIso source baselineFrame.block 0 heap.locRel
+      baselineFrame.values rewrittenFrame.values := by
+    simpa [pc] using frame.values
+  rw [rewrittenEq]
+  by_cases empty : fields.size = 0
+  · have fieldsEmpty : fields = #[] := Array.eq_empty_of_size_eq_zero empty
+    have entryEq :
+        { baselineFrame with
+          pc := fields.size
+          values := baselineFrame.values ++ fields } = baselineFrame := by
+      simp [fieldsEmpty, ← pc]
+    have entryState : CompilerRunningState attached
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack } := by
+      simpa only [entryEq] using childState
+    have entryControlEq :
+        (.running entryState.frame entryState.stack : Control) =
+          .running baselineFrame baselineStack := entryState.control.symm
+    have entryFrameEq : entryState.frame = baselineFrame := by
+      injection entryControlEq
+    have entryStackEq : entryState.stack = baselineStack := by
+      injection entryControlEq
+    have ready := entryState.acceptedPhysicalStableMacroStepHistoryOfExecution
+      optimized rewrite
+      (by simpa [entryFrameEq] using frame.baselineDefinition)
+      (by simpa [entryFrameEq] using accepted)
+      (by simpa [entryFrameEq] using pc)
+      baselineSchemas rewrittenSchemas heap
+      (by simpa [entryFrameEq] using parameters)
+      (by simpa [entryStackEq] using stack) fuel stepped suffix halted
+    simpa only [entryFrameEq, entryStackEq] using ready
+  · obtain ⟨rc, fieldCount, sourceResolved, sourceAt⟩ :=
+      CompilerRunningState.acceptedCtorChildSource baselineFrame baselineStack
+        rewrite frame.baselineDefinition accepted parameterCount childState
+        prologue (by omega) resolved boxAt node
+    have fetchState : CompilerRunningState attached
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running
+            { baselineFrame with
+              pc := site.shape.fieldCount
+              values := baselineFrame.values ++ fields } baselineStack } := by
+      simpa only [fieldCount] using childState
+    have blockAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+        some block := by
+      rw [frame.baselineDefinition]
+      exact (rewrite.acceptedAt accepted).1
+    have fetchSteps : Steps baselineContext .physical site.shape.fieldCount
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack }
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running
+            { baselineFrame with
+              pc := site.shape.fieldCount
+              values := baselineFrame.values ++ fields } baselineStack } := by
+      have steps := Lower.Sim.simulate_fetch_prologue
+        (context := baselineContext) (interpretation := .physical)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl blockAt pc prologue resolved boxAt node
+      simpa only [fieldCount] using steps
+    exact CompilerRunningState.acceptedPhysicalStableMacroStepHistoryOfFetchedExecution
+      baselineFrame baselineStack rfl optimized rewrite frame.baselineDefinition
+      accepted pc baselineSchemas rewrittenSchemas parameterCount fieldCount
+      sourceResolved sourceAt fetchState fetchSteps heap parameters stack fuel
+      stepped suffix halted
+
+/-- Prefix one related evaluator step to an existing compiler-aware macro.
+This is the composition used when an unchanged constructor switch enters a
+child whose own block decision is accepted. -/
+theorem AttachedStableMacroStep.prependStepsOne
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineMiddle rewrittenMiddle : Machine}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (tail : AttachedStableMacroStep optimized baselineContext
+      rewrittenContext interpretation baselineMiddle rewrittenMiddle)
+    (baselineRunning : baselineStart.control =
+      .running baselineFrame baselineStack)
+    (rewrittenRunning : rewrittenStart.control =
+      .running rewrittenFrame rewrittenStack)
+    (baselineStep : Step baselineContext interpretation baselineStart
+      baselineMiddle)
+    (rewrittenStep : Step rewrittenContext interpretation rewrittenStart
+      rewrittenMiddle)
+    (allocationDelta : AllocationDelta baselineStart.store baselineMiddle.store
+      rewrittenStart.store rewrittenMiddle.store)
+    (costDelta : CostDelta baselineStart.store baselineMiddle.store
+      rewrittenStart.store rewrittenMiddle.store) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart := by
+  cases tail with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related
+      acceptedEntry compiler tailDelta tailCosts =>
+      exact .intro (1 + baselineCount) (1 + rewrittenCount) (by omega)
+        (by omega) baselineTarget rewrittenTarget
+        ((baselineStep.toSteps baselineRunning).trans baselineSteps)
+        ((rewrittenStep.toSteps rewrittenRunning).trans rewrittenSteps)
+        related acceptedEntry compiler (allocationDelta.trans tailDelta) (costDelta.trans tailCosts)
+
+/-- Attach the compiler endpoint to a constructor switch whose selected child
+block is preserved literally.  The semantic proof executes the switch and the
+whole generated fetch prologue on both machines; fixed-length determinism
+identifies its baseline endpoint with the independently reconstructed compiler
+endpoint. -/
+theorem AttachedStableMacroStep.ofUnchangedSwitchCtorPrologue
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineChildFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel baselineStack
+      rewrittenStack)
+    {parentBlock : Block} {scrutinee childScrutinee : Atom}
+    {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+    {baselineLocation : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some parentBlock)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some parentBlock)
+    (pc : baselineFrame.pc = parentBlock.instructions.size)
+    (terminator : parentBlock.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : Eval.resolveAtom baselineFrame.values scrutinee =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer baselineFrame alternative.edge #[]
+      baselineChildFrame)
+    {childBlock : Block}
+    (childAt : baselineChildFrame.definition.blocks[
+      baselineChildFrame.block]? = some childBlock)
+    (childTargetAt : rewrite.definition.blocks[baselineChildFrame.block]? =
+      some childBlock)
+    (childPc : baselineChildFrame.pc = 0)
+    (prologue : Lower.fetchPrologueMatches childBlock.instructions
+      childScrutinee cid fields.size = true)
+    (childResolved : Eval.resolveAtom baselineChildFrame.values
+      childScrutinee = .ok (.loc baselineLocation))
+    {compilerTarget : Machine}
+    (compilerSteps : Steps baselineContext interpretation (1 + fields.size)
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      compilerTarget)
+    (compiler : CompilerState attached compilerTarget) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  obtain ⟨rewrittenFinalFrame, baselineSteps, rewrittenSteps, related,
+      acceptedEntry⟩ :=
+    unchangedSwitchCtorPrologueStepsLiveIso rewrite heap fuel frame stack
+      (baselineContext := baselineContext)
+      (rewrittenContext := rewrittenContext)
+      (interpretation := interpretation)
+      sourceAt targetAt pc terminator resolved boxAt node alternativeAt
+      transferred childAt childTargetAt childPc prologue childResolved
+  have targetEq :=
+    Ix.Compiler.IxIR2.ReuseLiveSim.Steps.deterministic baselineSteps
+      compilerSteps
+  subst compilerTarget
+  exact .intro (1 + fields.size) (1 + fields.size) (by omega) (by omega)
+    _ _ baselineSteps rewrittenSteps related acceptedEntry compiler (.refl _ _) (.refl _ _)
+
+/-- An unchanged parent constructor switch dispatches on the selected child
+block's own rewrite decision.  A preserved child executes its complete fetch
+prologue in lockstep.  An accepted child delegates at entry, then prefixes the
+related constructor-switch step to that child macro. -/
+theorem AttachedStableMacroStep.ofSwitchCtorChildBlockCase
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineChildFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel baselineStack
+      rewrittenStack)
+    {parentBlock : Block} {scrutinee childScrutinee : Atom}
+    {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+    {baselineLocation : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some parentBlock)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some parentBlock)
+    (pc : baselineFrame.pc = parentBlock.instructions.size)
+    (terminator : parentBlock.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : Eval.resolveAtom baselineFrame.values scrutinee =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer baselineFrame alternative.edge #[]
+      baselineChildFrame)
+    {childBlock : Block}
+    (childAt : baselineChildFrame.definition.blocks[
+      baselineChildFrame.block]? = some childBlock)
+    (childPc : baselineChildFrame.pc = 0)
+    (prologue : Lower.fetchPrologueMatches childBlock.instructions
+      childScrutinee cid fields.size = true)
+    (childResolved : Eval.resolveAtom baselineChildFrame.values
+      childScrutinee = .ok (.loc baselineLocation))
+    {compilerTarget : Machine}
+    (compilerSteps : Steps baselineContext interpretation (1 + fields.size)
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      compilerTarget)
+    (compiler : CompilerState attached compilerTarget)
+    (accepted : ∀ {rewrittenChildFrame : Frame} {helperOffset : Nat}
+        {selectedBlock : Block}
+        {site : Reuse.Site Validate.defaultLimits
+          attached.target.artifact.validationContext selectedBlock},
+      StableLiveFrameIso rewrite heap.locRel baselineChildFrame
+          rewrittenChildFrame →
+      Reuse.FunctionDecisions.At rewrite.decisions baselineChildFrame.block
+          helperOffset selectedBlock (.accepted site) →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineChildFrame baselineStack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenChildFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have childSourceAt : source.blocks[baselineChildFrame.block]? =
+      some childBlock := by
+    rw [← frame.baselineDefinition, ← transferred.definition]
+    exact childAt
+  obtain ⟨rewrittenChildFrame, baselineSwitch, rewrittenSwitch,
+      _childRelated, childFrame⟩ :=
+    unchangedSwitchCtorStepLiveIso rewrite heap fuel frame stack
+      (baselineContext := baselineContext)
+      (rewrittenContext := rewrittenContext)
+      (interpretation := interpretation)
+      sourceAt targetAt pc terminator resolved boxAt node alternativeAt
+      transferred
+  cases rewrite.blockCaseOfLookup childSourceAt with
+  | unchanged selectedSourceAt childTargetAt =>
+      have blockEq := Option.some.inj
+        (selectedSourceAt.symm.trans childSourceAt)
+      cases blockEq
+      exact AttachedStableMacroStep.ofUnchangedSwitchCtorPrologue rewrite
+        heap fuel frame stack sourceAt targetAt pc terminator resolved boxAt
+        node alternativeAt transferred childAt childTargetAt childPc prologue
+        childResolved compilerSteps compiler
+  | accepted found =>
+      exact (accepted childFrame found).prependStepsOne rfl rfl
+        baselineSwitch rewrittenSwitch (.refl _ _) (.refl _ _)
+
+/-- Turn the lowering compiler's constructor reconstruction into the complete
+reuse-aware macro for an unchanged parent block.  The lowering witness fixes
+the exact child entry and fetch prologue; the preceding child-block dispatcher
+then chooses lockstep execution or an accepted-site macro at that entry. -/
+theorem attachedStableSwitchCtorMacroOfCompilerState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    {rewrittenFrame : Frame}
+    {rewrittenStack : List Continuation}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (heap : IxIR1.Sim.HeapHistoryIso machine.store.heap rewrittenStore.heap)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel state.frame
+      rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel state.stack
+      rewrittenStack)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (traceEq : state.trace =
+      .switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : state.sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child)
+    (rewrittenParentAt : rewrite.definition.blocks[state.frame.block]? =
+      some generated)
+    (accepted : ∀ {baselineChildFrame rewrittenChildFrame : Frame}
+        {helperOffset : Nat} {selectedBlock : Block}
+        {acceptedSite : Reuse.Site Validate.defaultLimits
+          attached.target.artifact.validationContext selectedBlock},
+      StableLiveFrameIso rewrite heap.locRel baselineChildFrame
+          rewrittenChildFrame →
+      Reuse.FunctionDecisions.At rewrite.decisions baselineChildFrame.block
+          helperOffset selectedBlock (.accepted acceptedSite) →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation
+        { store := machine.store
+          heapFuel := machine.heapFuel
+          control := .running baselineChildFrame state.stack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenChildFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation machine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  obtain ⟨finalFrame, edgeFrame, childScrutinee, nextState, targetSteps,
+      parentBlockAt, parentPc, targetResolved, targetGet, transferred,
+      _switchStep, childBlockAt, childPc, childResolved, prologue,
+      _finalFrameEq⟩ :=
+    state.stepsSwitchCtor traceEq sourceResolved sourceGet node
+      sourceAlternative fieldArity terminator targetAt targetAlternative
+      edgeAt childAt
+  have rewrittenBlockAt : rewrittenFrame.definition.blocks[
+      rewrittenFrame.block]? = some generated := by
+    rw [frame.rewrittenDefinition, ← frame.block]
+    exact rewrittenParentAt
+  have canonicalEq :
+      ({ store := machine.store
+         heapFuel := machine.heapFuel
+         control := .running state.frame state.stack } : Machine) =
+        machine := by
+    simpa only using congrArg
+      (fun control => ({ machine with control } : Machine)) state.control.symm
+  have canonicalSteps : Steps baselineContext interpretation
+      (1 + fields.size)
+      { store := machine.store
+        heapFuel := machine.heapFuel
+        control := .running state.frame state.stack }
+      { machine with control := .running finalFrame state.stack } := by
+    rw [canonicalEq]
+    exact targetSteps
+  have ready := AttachedStableMacroStep.ofSwitchCtorChildBlockCase rewrite
+    heap fuel frame stack parentBlockAt rewrittenBlockAt parentPc terminator
+    targetResolved targetGet node targetAlternative transferred childBlockAt
+    childPc prologue childResolved canonicalSteps (.running nextState) accepted
+  rw [canonicalEq] at ready
+  exact ready
+
+/-- Resolve the selected constructor child's reuse decision using the exact
+lowering endpoint and successful baseline suffix. Both preserved and accepted
+children produce their compiler-aware physical macro internally. -/
+theorem attachedPhysicalSwitchCtorMacroOfCompilerState
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    {rewrittenFrame : Frame}
+    {rewrittenStack : List Continuation}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (heap : IxIR1.Sim.HeapHistoryIso machine.store.heap rewrittenStore.heap)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel state.frame
+      rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel state.stack
+      rewrittenStack)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input : Lower.Sim.EnvMap} {entryValueCount : Nat}
+    {sourceScrutinee : IxIR1.Atom} {peelNat : Bool}
+    {alternatives : Array IxIR1.Alt} {targetScrutinee : Atom}
+    {generated : Block} {outgoing : List Lower.EdgeTrace}
+    {children : List Lower.CodeTrace}
+    (traceEq : state.trace =
+      .switchValue site blockId input entryValueCount sourceScrutinee peelNat
+        alternatives targetScrutinee generated outgoing children)
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal}
+    (sourceResolved : IxIR1.resolveAtom state.source sourceScrutinee =
+      .ok (.loc location))
+    (sourceGet : state.sourceStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    {tag fieldCount alternativeIndex : Nat} {body : IxIR1.Code}
+    (sourceAlternative : Lower.sourceAlternativeAtTag? alternatives cid.cidx =
+      some (.mk tag fieldCount body, alternativeIndex))
+    (fieldArity : fields.size = fieldCount)
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {index : Nat} {target : CtorAlt} {edge : Lower.EdgeTrace}
+    {child : Lower.CodeTrace}
+    (terminator : generated.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (targetAt : constructors[index]? = some target)
+    (targetAlternative : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some target)
+    (edgeAt : outgoing[index]? = some edge)
+    (childAt : children[index]? = some child)
+    (rewrittenParentAt : rewrite.definition.blocks[state.frame.block]? =
+      some generated)
+    {baselineNext baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (stepped : Step baselineContext .physical machine baselineNext)
+    (suffix : Steps baselineContext .physical suffixCount baselineNext
+      baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      .physical machine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  obtain ⟨finalFrame, edgeFrame, childScrutinee, nextState, targetSteps,
+      parentBlockAt, parentPc, targetResolved, targetGet, transferred,
+      switchStep, childBlockAt, childPc, childResolved, prologue,
+      finalFrameEq⟩ :=
+    state.stepsSwitchCtor (context := baselineContext)
+      (interpretation := .physical) traceEq sourceResolved sourceGet node
+      sourceAlternative fieldArity terminator targetAt targetAlternative
+      edgeAt childAt
+  have rewrittenBlockAt : rewrittenFrame.definition.blocks[
+      rewrittenFrame.block]? = some generated := by
+    rw [frame.rewrittenDefinition, ← frame.block]
+    exact rewrittenParentAt
+  have canonicalEq :
+      ({ store := machine.store
+         heapFuel := machine.heapFuel
+         control := .running state.frame state.stack } : Machine) =
+        machine := by
+    simpa only using congrArg
+      (fun control => ({ machine with control } : Machine)) state.control.symm
+  have canonicalSteps : Steps baselineContext .physical (1 + fields.size)
+      { store := machine.store
+        heapFuel := machine.heapFuel
+        control := .running state.frame state.stack }
+      { machine with control := .running finalFrame state.stack } := by
+    rw [canonicalEq]
+    exact targetSteps
+  have childSourceAt : source.blocks[edgeFrame.block]? =
+      some child.headBlock.2 := by
+    rw [← frame.baselineDefinition, ← transferred.definition]
+    exact childBlockAt
+  cases rewrite.blockCaseOfLookup childSourceAt with
+  | unchanged selectedSourceAt childTargetAt =>
+      have blockEq := Option.some.inj
+        (selectedSourceAt.symm.trans childSourceAt)
+      cases blockEq
+      have ready := AttachedStableMacroStep.ofUnchangedSwitchCtorPrologue rewrite
+        (optimized := optimized) (rewrittenContext := rewrittenContext)
+        heap fuel frame stack parentBlockAt rewrittenBlockAt parentPc terminator
+        targetResolved targetGet node targetAlternative transferred childBlockAt
+        childTargetAt childPc prologue childResolved canonicalSteps
+        (.running nextState)
+      rw [canonicalEq] at ready
+      exact ready
+  | @accepted helperOffset selectedBlock acceptedSite found =>
+      have selectedSourceAt := (rewrite.acceptedAt found).1
+      have selectedBlockEq : selectedBlock = child.headBlock.2 :=
+        Option.some.inj (selectedSourceAt.symm.trans childSourceAt)
+      subst selectedBlock
+      obtain ⟨rewrittenChildFrame, baselineSwitch, rewrittenSwitch,
+          _childRelated, childFrame⟩ :=
+        unchangedSwitchCtorStepLiveIso rewrite heap fuel frame stack
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext)
+          (interpretation := .physical)
+          parentBlockAt rewrittenBlockAt parentPc terminator targetResolved
+          targetGet node targetAlternative transferred
+      obtain ⟨values, credits, after, edgeBlock, _edgeResolved, _creditsTaken,
+          _noCredits, edgeBlockAt, valueArity, _creditArity, edgeFrameEq⟩ :=
+        transferred.parts
+      have edgeBlockAt' : edgeFrame.definition.blocks[edgeFrame.block]? =
+          some edgeBlock := by
+        simpa [edgeFrameEq] using edgeBlockAt
+      have edgeBlockEq : edgeBlock = child.headBlock.2 :=
+        Option.some.inj (edgeBlockAt'.symm.trans childBlockAt)
+      have parameterCount : edgeFrame.values.size =
+          acceptedSite.shape.parameterCount := by
+        rw [acceptedSite.fits.parameterCount, ← edgeBlockEq]
+        simpa [edgeFrameEq] using valueArity
+      have childCompiler : CompilerRunningState attached
+          { store := machine.store
+            heapFuel := machine.heapFuel
+            control := .running
+              { edgeFrame with
+                pc := fields.size
+                values := edgeFrame.values ++ fields } state.stack } := by
+        simpa only [finalFrameEq] using nextState
+      have total : Steps baselineContext .physical (1 + suffixCount) machine
+          baselineFinal := (stepped.toSteps state.control).trans suffix
+      obtain ⟨remainingCount, _countEq, childSuffix⟩ :=
+        (switchStep.toSteps state.control).cancelPrefixToHalted total halted
+      generalize finalEq : baselineFinal = actualFinal at childSuffix halted
+      cases childSuffix with
+      | refl =>
+          have impossible := congrArg Machine.control halted
+          simp at impossible
+      | @cons count _ childNext _ actualFrame actualStack running childStep
+          childTail =>
+          have childMacro := acceptedCtorChildPhysicalMacroOfExecution optimized
+            baselineSchemas rewrittenSchemas rewrite heap fuel childFrame stack
+            found childPc parameterCount childCompiler prologue childResolved
+            targetGet node childStep childTail halted
+          have ready := childMacro.prependStepsOne rfl rfl
+            baselineSwitch rewrittenSwitch (.refl _ _) (.refl _ _)
+          rw [canonicalEq] at ready
+          exact ready
+
+/-- Turn a concrete target constructor selection into the complete paired
+reuse macro. The reconstructed lowering witness chooses the exact recursive
+child; the current parent cannot itself be an accepted reset block because
+accepted source blocks terminate in `tailCallSelf`, so its switch is preserved
+literally. Only an independently accepted child remains delegated. -/
+theorem attachedStableSwitchCtorMacroOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    {rewrittenFrame : Frame} {rewrittenStack : List Continuation}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (heap : IxIR1.Sim.HeapHistoryIso machine.store.heap rewrittenStore.heap)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel state.frame
+      rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel state.stack
+      rewrittenStack)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal} {alternative : CtorAlt}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (resolved : Eval.resolveAtom state.frame.values targetScrutinee =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (accepted : ∀ {baselineChildFrame rewrittenChildFrame : Frame}
+        {helperOffset : Nat} {selectedBlock : Block}
+        {acceptedSite : Reuse.Site Validate.defaultLimits
+          attached.target.artifact.validationContext selectedBlock},
+      StableLiveFrameIso rewrite heap.locRel baselineChildFrame
+          rewrittenChildFrame →
+      Reuse.FunctionDecisions.At rewrite.decisions baselineChildFrame.block
+          helperOffset selectedBlock (.accepted acceptedSite) →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation
+        { store := machine.store
+          heapFuel := machine.heapFuel
+          control := .running baselineChildFrame state.stack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenChildFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation machine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have selected := state.switchCtorCaseOfTarget blockAt pc terminator resolved
+    boxAt node alternativeAt
+  cases selected with
+  | @intro site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives generated outgoing children tag fieldCount alternativeIndex
+      index body edge child traceEq sourceResolved sourceGet node
+      sourceAlternative fieldArity generatedTerminator targetAt alternativeAt
+      edgeAt childAt =>
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      have generatedAt : state.frame.definition.blocks[state.frame.block]? =
+          some generated := by
+        have exactBlock := state.traceState.target.blockAt state.descendant
+        rw [traceEq] at exactBlock
+        exact exactBlock
+      cases frame.blockCase generatedAt with
+      | unchanged sourceAt rewrittenParentAt =>
+          have generatedSourceAt : source.blocks[state.frame.block]? =
+              some generated := by
+            rw [← frame.baselineDefinition]
+            exact generatedAt
+          have sourceBlockEq : _ = generated :=
+            Option.some.inj (sourceAt.symm.trans generatedSourceAt)
+          cases sourceBlockEq
+          exact attachedStableSwitchCtorMacroOfCompilerState optimized state
+            rewrite heap fuel frame stack traceEq sourceResolved sourceGet node
+            sourceAlternative fieldArity generatedTerminator targetAt
+            alternativeAt edgeAt childAt rewrittenParentAt accepted
+      | @accepted helperOffset selectedBlock acceptedSite found =>
+          have generatedSourceAt : source.blocks[state.frame.block]? =
+              some generated := by
+            rw [← frame.baselineDefinition]
+            exact generatedAt
+          have selectedSourceAt := (rewrite.acceptedAt found).1
+          have selectedBlockEq : selectedBlock = generated :=
+            Option.some.inj (selectedSourceAt.symm.trans generatedSourceAt)
+          subst selectedBlock
+          have expected := acceptedSite.fits.terminator
+          rw [generatedTerminator] at expected
+          cases expected
+
+/-- A successful physical constructor selection determines its own paired
+macro, including an accepted child, from checked lowering data and the actual
+remaining baseline execution. -/
+theorem attachedPhysicalSwitchCtorMacroOfTarget
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas =
+      attached.target.artifact.validationContext.schemas)
+    {machine : Machine} (state : CompilerRunningState attached machine)
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    {rewrittenFrame : Frame} {rewrittenStack : List Continuation}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (heap : IxIR1.Sim.HeapHistoryIso machine.store.heap rewrittenStore.heap)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel state.frame
+      rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel state.stack
+      rewrittenStack)
+    {block : Block} {targetScrutinee : Atom}
+    {constructors : Array CtorAlt} {targetPeel : Option NatPeel}
+    {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+    {fields : Array RVal} {alternative : CtorAlt}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue targetScrutinee constructors targetPeel)
+    (resolved : Eval.resolveAtom state.frame.values targetScrutinee =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    {baselineNext baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (stepped : Step baselineContext .physical machine baselineNext)
+    (suffix : Steps baselineContext .physical suffixCount baselineNext
+      baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      .physical machine
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have selected := state.switchCtorCaseOfTarget blockAt pc terminator resolved
+    boxAt node alternativeAt
+  cases selected with
+  | @intro site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives generated outgoing children tag fieldCount alternativeIndex
+      index body edge child traceEq sourceResolved sourceGet node
+      sourceAlternative fieldArity generatedTerminator targetAt alternativeAt
+      edgeAt childAt =>
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      have generatedAt : state.frame.definition.blocks[state.frame.block]? =
+          some generated := by
+        have exactBlock := state.traceState.target.blockAt state.descendant
+        rw [traceEq] at exactBlock
+        exact exactBlock
+      cases frame.blockCase generatedAt with
+      | unchanged sourceAt rewrittenParentAt =>
+          have generatedSourceAt : source.blocks[state.frame.block]? =
+              some generated := by
+            rw [← frame.baselineDefinition]
+            exact generatedAt
+          have sourceBlockEq : _ = generated :=
+            Option.some.inj (sourceAt.symm.trans generatedSourceAt)
+          cases sourceBlockEq
+          exact attachedPhysicalSwitchCtorMacroOfCompilerState optimized
+            baselineSchemas rewrittenSchemas state
+            rewrite heap fuel frame stack traceEq sourceResolved sourceGet node
+            sourceAlternative fieldArity generatedTerminator targetAt
+            alternativeAt edgeAt childAt rewrittenParentAt stepped suffix halted
+      | @accepted helperOffset selectedBlock acceptedSite found =>
+          have generatedSourceAt : source.blocks[state.frame.block]? =
+              some generated := by
+            rw [← frame.baselineDefinition]
+            exact generatedAt
+          have selectedSourceAt := (rewrite.acceptedAt found).1
+          have selectedBlockEq : selectedBlock = generated :=
+            Option.some.inj (selectedSourceAt.symm.trans generatedSourceAt)
+          subst selectedBlock
+          have expected := acceptedSite.fits.terminator
+          rw [generatedTerminator] at expected
+          cases expected
+
+/-- Compiler progress available at one trace-dispatch boundary. Most source
+steps expose a compiler state and accepted-entry phase at their literal
+one-step successor. Recognized-prefix instructions defer that phase to the
+current block-decision split, while larger synchronization gaps expose an
+already-assembled positive compiler-aware macro. -/
+inductive AttachedCompilerAdvance
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    (baselineContext rewrittenContext : Eval.Context)
+    (interpretation : Interpretation)
+    (baselineStart rewrittenStart baselineStepTarget : Machine) : Prop where
+  | step (compiler : CompilerState attached baselineStepTarget)
+      (acceptedEntry : ∀ {rewrittenTarget : Machine},
+        StableLiveMachineRel Validate.defaultLimits
+            attached.target.artifact.validationContext baselineStepTarget
+              rewrittenTarget →
+          StableLiveAcceptedEntry Validate.defaultLimits
+            attached.target.artifact.validationContext baselineStepTarget
+              rewrittenTarget) :
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        interpretation baselineStart rewrittenStart baselineStepTarget
+  | prefixStep (compiler : CompilerState attached baselineStepTarget)
+      (prefixAt : AcceptedPrefixInstructionAt baselineStart) :
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        interpretation baselineStart rewrittenStart baselineStepTarget
+  | macro (ready : AttachedStableMacroStep optimized baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart) :
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        interpretation baselineStart rewrittenStart baselineStepTarget
+
+/-- Package a concrete compiler successor for any retained `letOp` whose
+target instruction belongs to the accepted-prefix family. The current
+compiler trace reconstructs the exact instruction witness consumed by the
+block-decision dispatcher. -/
+theorem AttachedCompilerAdvance.prefixStepOfLetOp
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (state : CompilerRunningState attached baselineStart)
+    (compiler : CompilerState attached baselineStepTarget)
+    {site : Lower.SourceSite} {blockId : BlockId}
+    {input nextInput : Lower.Sim.EnvMap} {entryValueCount index : Nat}
+    {operation : IxIR1.Op} {instruction : Instr} {next : Lower.CodeTrace}
+    (traceEq : state.trace =
+      .letOp site blockId input nextInput entryValueCount operation index
+        instruction next)
+    (acceptedPrefix : AcceptedPrefixInstruction instruction) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget :=
+  .prefixStep compiler
+    (state.acceptedPrefixInstructionAt traceEq acceptedPrefix)
+
+/-- Package an ordinary compiler successor known to be at block entry. The
+accepted-entry obligation is independent of the rewritten endpoint relation
+once the baseline program counter is zero. -/
+theorem AttachedCompilerAdvance.stepOfPcZero
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (compiler : CompilerState attached baselineStepTarget)
+    {frame : Frame} {stack : List Continuation}
+    (control : baselineStepTarget.control = .running frame stack)
+    (pc : frame.pc = 0) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget := by
+  apply AttachedCompilerAdvance.step compiler
+  intro rewrittenTarget _related
+  exact StableLiveAcceptedEntry.ofPcZero control pc
+
+/-- Package an ordinary halted compiler successor. It has no running
+accepted-site phase obligation. -/
+theorem AttachedCompilerAdvance.stepOfHalted
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (compiler : CompilerState attached baselineStepTarget)
+    {value : RVal} (control : baselineStepTarget.control = .halted value) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget := by
+  apply AttachedCompilerAdvance.step compiler
+  intro rewrittenTarget _related
+  exact StableLiveAcceptedEntry.halted control
+
+/-- Package a compiler successor resumed after an addressed call. Accepted
+source blocks contain no such suspending instruction, so the resumed program
+counter may be nonzero without violating the synchronization phase. -/
+theorem AttachedCompilerAdvance.stepOfCallResume
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (compiler : CompilerState attached baselineStepTarget)
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baselineStepTarget.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {address : Ixon.Address} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.call address arguments)) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget := by
+  apply AttachedCompilerAdvance.step compiler
+  intro rewrittenTarget _related
+  exact StableLiveAcceptedEntry.ofCallResume control blockAt instructionAt
+
+/-- Package a compiler successor resumed after a recursive call. -/
+theorem AttachedCompilerAdvance.stepOfCallSelfResume
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (compiler : CompilerState attached baselineStepTarget)
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baselineStepTarget.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.callSelf arguments)) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget := by
+  apply AttachedCompilerAdvance.step compiler
+  intro rewrittenTarget _related
+  exact StableLiveAcceptedEntry.ofCallSelfResume control blockAt instructionAt
+
+/-- Package a compiler successor resumed after a dynamic application,
+including the final endpoint of a recursive `applyMore` chain. -/
+theorem AttachedCompilerAdvance.stepOfApplyResume
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (compiler : CompilerState attached baselineStepTarget)
+    {frame : Frame} {stack : List Continuation} {block : Block}
+    (control : baselineStepTarget.control = .running frame stack)
+    (blockAt : frame.definition.blocks[frame.block]? = some block)
+    {position : Nat} {function : Atom} {arguments : Array Atom}
+    (instructionAt : block.instructions[position]? =
+      some (.apply function arguments)) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget := by
+  apply AttachedCompilerAdvance.step compiler
+  intro rewrittenTarget _related
+  exact StableLiveAcceptedEntry.ofApplyResume control blockAt instructionAt
+
+/-- Complete baseline compiler-macro evidence with a positive rewritten run
+and a stable live endpoint relation, producing the positive arm consumed by
+trace dispatch. -/
+theorem CompilerMacroStep.attach
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineStepTarget : Machine}
+    (compilerMacro : CompilerMacroStep attached baselineContext interpretation
+      baselineStart)
+    (rewritten : ∀ {baselineCount : Nat} {baselineTarget : Machine},
+      Steps baselineContext interpretation baselineCount baselineStart
+          baselineTarget →
+        CompilerState attached baselineTarget →
+          ∃ rewrittenCount rewrittenTarget,
+            0 < rewrittenCount ∧
+              Steps rewrittenContext interpretation rewrittenCount
+                  rewrittenStart rewrittenTarget ∧
+                StableLiveMachineRel Validate.defaultLimits
+                  attached.target.artifact.validationContext baselineTarget
+                    rewrittenTarget ∧
+                StableLiveAcceptedEntry Validate.defaultLimits
+                  attached.target.artifact.validationContext baselineTarget
+                    rewrittenTarget ∧
+                AllocationDelta baselineStart.store baselineTarget.store
+                  rewrittenStart.store rewrittenTarget.store ∧
+                CostDelta baselineStart.store baselineTarget.store
+                  rewrittenStart.store rewrittenTarget.store) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart baselineStepTarget := by
+  cases compilerMacro with
+  | intro baselineCount baselinePositive baselineTarget baselineSteps compiler =>
+      obtain ⟨rewrittenCount, rewrittenTarget, rewrittenPositive,
+        rewrittenSteps, related, acceptedEntry, allocationDelta, costDelta⟩ :=
+        rewritten baselineSteps compiler
+      exact AttachedCompilerAdvance.«macro»
+        (.intro baselineCount rewrittenCount baselinePositive
+          rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+          rewrittenSteps related acceptedEntry compiler allocationDelta costDelta)
+
+/-- Compiler-side classification of one concrete physical instruction.
+Every non-apply constructor carries complete compiler progress.  Dynamic
+application retains its exact transfer evidence as the only residual seam. -/
+inductive AttachedCompilerInstructionCase
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    (baselineContext rewrittenContext : Eval.Context)
+    (machine rewritten baselineNext : Machine)
+    (state : CompilerRunningState attached machine)
+    (instruction : Instr) : Prop where
+  | advance (ready : AttachedCompilerAdvance optimized baselineContext
+      rewrittenContext .physical machine rewritten baselineNext) :
+      AttachedCompilerInstructionCase optimized baselineContext
+        rewrittenContext machine rewritten baselineNext state instruction
+  | apply {functionAtom : Atom} {argumentAtoms : Array Atom}
+      {function : RVal} {arguments : Array RVal}
+      (instructionEq : instruction = .apply functionAtom argumentAtoms)
+      (functionResolved :
+        Eval.resolveAtom state.frame.values functionAtom = .ok function)
+      (argumentsResolved :
+        Eval.resolveAtoms state.frame.values argumentAtoms = .ok arguments)
+      (transferred : Eval.ApplyTransfer baselineContext .physical
+        machine.store machine.heapFuel function arguments
+        { state.frame with pc := state.frame.pc + 1 } state.stack
+        baselineNext) :
+      AttachedCompilerInstructionCase optimized baselineContext
+        rewrittenContext machine rewritten baselineNext state instruction
+
+/-- Classify every concrete baseline instruction using the checked compiler
+trace.  Reuse-only instructions cannot occur in lowered code, and target
+extern declarations are excluded by the closed-world attachment. -/
+theorem attachedPhysicalInstructionCase
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {machine rewritten baselineNext : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {instruction : Instr}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instructionAt : block.instructions[state.frame.pc] = instruction)
+    (classified : InstructionTransferCase
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine.store machine.heapFuel state.frame state.stack
+      instruction baselineNext) :
+    AttachedCompilerInstructionCase optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      machine rewritten baselineNext state instruction := by
+  let sourceContext := attached.simulationSourceContext
+  cases classified with
+  | move resolved =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepPureOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl blockAt pc instructionAt resolved
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | @alloc world cid arguments schema values schemaAt resolved fields =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepAllocOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl rfl blockAt pc instructionAt
+          schemaAt resolved
+      cases world with
+      | unique =>
+          exact .advance (.step (.running nextState)
+            (fun _related => acceptedEntry rfl _))
+      | shared =>
+          obtain ⟨site, blockId, input, nextInput, entryValueCount,
+              operation, index, next, traceEq, _operationSyntax⟩ :=
+            state.currentLetOp blockAt pc instructionAt
+          exact .advance (AttachedCompilerAdvance.prefixStepOfLetOp state
+            (.running nextState) traceEq (by constructor))
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | allocWithLogical mode schemaAt resolved fields taken layout present =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | allocWithPhysical mode schemaAt resolved fields taken layout present
+      reused =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | discardAbsent taken absent =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | discardLogical mode taken present =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | discardPhysical mode taken present released =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | takeUniqueLogical mode schemaAt resolved viewed unitRC =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | resetSharedLogicalHot mode schemaAt resolved viewed unitRC =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | resetSharedCold schemaAt resolved viewed shared retained =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation <;> simp [Lower.OperationSyntax] at operationSyntax
+  | retainShared resolved retained =>
+      obtain ⟨nextState, _targetStep⟩ := state.stepRetainOfTarget
+        (sourceContext := sourceContext) (sourceFuel := 0)
+        (context := Eval.Context.ofProgram
+          attached.target.artifact.program
+          attached.target.artifact.validationContext.schemas oracle)
+        (interpretation := .physical) rfl blockAt pc instructionAt resolved
+        retained
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, _operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      exact .advance (AttachedCompilerAdvance.prefixStepOfLetOp state
+        (.running nextState) traceEq (by constructor))
+  | releaseShared resolved released =>
+      obtain ⟨nextState, _targetStep⟩ := state.stepReleaseOfTarget
+        (sourceContext := sourceContext)
+        (context := Eval.Context.ofProgram
+          attached.target.artifact.program
+          attached.target.artifact.validationContext.schemas oracle)
+        (interpretation := .physical) rfl blockAt pc instructionAt resolved
+        released
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, _operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      exact .advance (AttachedCompilerAdvance.prefixStepOfLetOp state
+        (.running nextState) traceEq (by constructor))
+  | dropUnique resolved dropped =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepDropUniqueOfTarget
+          (sourceContext := sourceContext)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl blockAt pc instructionAt resolved
+          dropped
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | freeUnique resolved viewed scalarFields =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepFreeUniqueOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl blockAt pc instructionAt resolved
+          viewed scalarFields
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | @fetch target cid field location box fields value resolved boxAt node
+      fieldAt =>
+      rcases box with ⟨world, rc, targetNode⟩
+      change targetNode = .ctorN cid fields at node
+      subst targetNode
+      obtain ⟨nextState, _targetStep⟩ := state.stepFetchOfTarget
+        (sourceContext := sourceContext) (sourceFuel := 0)
+        (context := Eval.Context.ofProgram
+          attached.target.artifact.program
+          attached.target.artifact.validationContext.schemas oracle)
+        (interpretation := .physical) rfl blockAt pc instructionAt resolved
+        boxAt fieldAt
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, _operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      exact .advance (AttachedCompilerAdvance.prefixStepOfLetOp state
+        (.running nextState) traceEq (by constructor))
+  | callFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.enterCallOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl rfl blockAt pc instructionAt
+          resolved declaration arity
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | callSelf noCredits resolved arity nonempty =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.enterCallSelfOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) blockAt pc instructionAt resolved arity
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | pappFn noCredits declaration papSafe resolved under =>
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepPappOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl rfl blockAt pc instructionAt
+          declaration papSafe resolved under
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | pappExtern noCredits declaration resolved under =>
+      exact (attached.targetDeclaration_not_extern rfl declaration).elim
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact .apply rfl functionResolved argumentsResolved transferred
+  | extern noCredits resolved declaration argumentArity called =>
+      obtain ⟨site, blockId, input, nextInput, entryValueCount,
+          operation, index, next, traceEq, operationSyntax⟩ :=
+        state.currentLetOp blockAt pc instructionAt
+      cases operation with
+      | extern sourceAddress sourceArguments =>
+          exact (state.externImpossible traceEq).elim
+      | pure sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+      | alloc sourceWorld sourceCid sourceArguments =>
+          simp [Lower.OperationSyntax] at operationSyntax
+      | reuse sourceAtom sourceCid sourceArguments =>
+          simp [Lower.OperationSyntax] at operationSyntax
+      | free sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+      | dup sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+      | drop sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+      | dropU sourceAtom => simp [Lower.OperationSyntax] at operationSyntax
+      | fetch sourceAtom sourceField =>
+          simp [Lower.OperationSyntax] at operationSyntax
+      | call sourceAddress sourceArguments =>
+          simp [Lower.OperationSyntax] at operationSyntax
+      | callSelf sourceArguments =>
+          simp [Lower.OperationSyntax] at operationSyntax
+      | papp sourceAddress sourceArguments =>
+          simp [Lower.OperationSyntax] at operationSyntax
+      | apply sourceFunction sourceArguments =>
+          simp [Lower.OperationSyntax] at operationSyntax
+
+/-- Discharge the residual dynamic-apply arm of an instruction
+classification.  This separates exhaustive syntactic reconstruction from the
+semantic application proof used by the callback-free wrapper below. -/
+theorem AttachedCompilerInstructionCase.resolve
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {machine rewritten baselineNext : Machine}
+    {state : CompilerRunningState attached machine}
+    {instruction : Instr}
+    (classified : AttachedCompilerInstructionCase optimized baselineContext
+      rewrittenContext machine rewritten baselineNext state instruction)
+    (applyAdvance : ∀ {functionAtom : Atom}
+        {argumentAtoms : Array Atom} {function : RVal}
+        {arguments : Array RVal},
+      instruction = .apply functionAtom argumentAtoms →
+      Eval.resolveAtom state.frame.values functionAtom = .ok function →
+      Eval.resolveAtoms state.frame.values argumentAtoms = .ok arguments →
+      Eval.ApplyTransfer baselineContext .physical machine.store
+          machine.heapFuel function arguments
+          { state.frame with pc := state.frame.pc + 1 } state.stack
+          baselineNext →
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        .physical machine rewritten baselineNext) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      .physical machine rewritten baselineNext := by
+  cases classified with
+  | advance ready => exact ready
+  | apply instructionEq functionResolved argumentsResolved transferred =>
+      exact applyAdvance instructionEq functionResolved argumentsResolved
+        transferred
+
+/-- Every successful physical instruction in an attached baseline program
+has callback-free compiler progress.  The intermediate instruction
+classification isolates dynamic application, and `stepApplyOfTarget`
+discharges that final semantic branch from checked ownership. -/
+theorem attachedPhysicalInstructionAdvance
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {machine rewritten baselineNext : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {instruction : Instr}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc < block.instructions.size)
+    (instructionAt : block.instructions[state.frame.pc] = instruction)
+    (classified : InstructionTransferCase
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine.store machine.heapFuel state.frame state.stack
+      instruction baselineNext) :
+    AttachedCompilerAdvance optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine rewritten baselineNext := by
+  apply (attachedPhysicalInstructionCase optimized state blockAt pc
+    instructionAt classified).resolve
+  intro functionAtom argumentAtoms function arguments instructionEq
+    functionResolved argumentsResolved transferred
+  rw [instructionEq] at instructionAt
+  obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+    state.stepApplyOfTarget
+      (sourceContext := attached.simulationSourceContext)
+      (context := Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (interpretation := .physical) rfl rfl blockAt pc instructionAt
+      functionResolved argumentsResolved transferred
+  exact .step (.running nextState)
+    (fun _related => acceptedEntry _)
+
+/-- The four terminator families emitted by structured lowering. -/
+inductive CompilerTerminatorSyntax : Terminator → Prop where
+  | ret (atom : Atom) : CompilerTerminatorSyntax (.ret atom)
+  | tailCall (address : Ixon.Address) (arguments : Array Atom) :
+      CompilerTerminatorSyntax (.tailCall address arguments)
+  | tailCallSelf (arguments : Array Atom) :
+      CompilerTerminatorSyntax (.tailCallSelf arguments)
+  | switchValue (scrutinee : Atom) (constructors : Array CtorAlt)
+      (natPeel : Option NatPeel) :
+      CompilerTerminatorSyntax (.switchValue scrutinee constructors natPeel)
+
+/-- A checked compiler trace cannot expose reuse-only jump or credit-branch
+terminators at a source synchronization coordinate. -/
+theorem CompilerRunningState.currentTerminatorSyntax
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} {machine : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size) :
+    CompilerTerminatorSyntax block.terminator := by
+  have exactBlock := state.traceState.target.blockAt state.descendant
+  have blockEq : block = state.trace.headBlock.2 :=
+    Option.some.inj (blockAt.symm.trans exactBlock)
+  generalize traceEq : state.trace = trace at blockEq
+  cases trace with
+  | ret site blockId input entryValueCount sourceAtom targetAtom generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq
+      have descendant : state.functionTrace.root.Descendant
+          (.ret site blockId input entryValueCount sourceAtom targetAtom
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      have emitted := (Lower.CodeTrace.retSyntax_of_match
+        (state.functionTrace.descendantSyntaxMatches descendant)).2
+      rw [blockEq, emitted]
+      exact .ret _
+  | tailCall site blockId input entryValueCount address sourceArguments
+      generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCall site blockId input entryValueCount address sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨arguments, _translated, emitted⟩ :=
+        Lower.CodeTrace.tailCallSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, emitted]
+      exact .tailCall _ _
+  | tailCallSelf site blockId input entryValueCount sourceArguments generated =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq
+      have descendant : state.functionTrace.root.Descendant
+          (.tailCallSelf site blockId input entryValueCount sourceArguments
+            generated) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨arguments, _translated, emitted⟩ :=
+        Lower.CodeTrace.tailCallSelfSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, emitted]
+      exact .tailCallSelf _
+  | letOp site blockId input nextInput entryValueCount operation index
+      instruction next =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq
+      have descendant : state.functionTrace.root.Descendant
+          (.letOp site blockId input nextInput entryValueCount operation index
+            instruction next) := by
+        rw [← traceEq]
+        exact state.descendant
+      have statePc := state.traceState.target.pc
+      rw [traceEq] at statePc
+      simp only [Lower.CodeTrace.entryPc] at statePc
+      have instructionAt :=
+        (state.functionTrace.descendantLetOpMatch descendant).1.instructionAt
+      have instructionBound :=
+        (Array.getElem?_eq_some_iff.mp instructionAt).1
+      rw [← blockEq] at instructionBound
+      omega
+  | switchValue site blockId input entryValueCount sourceScrutinee peelNat
+      alternatives targetScrutinee generated outgoing children =>
+      simp only [Lower.CodeTrace.headBlock] at blockEq
+      have descendant : state.functionTrace.root.Descendant
+          (.switchValue site blockId input entryValueCount sourceScrutinee
+            peelNat alternatives targetScrutinee generated outgoing
+              children) := by
+        rw [← traceEq]
+        exact state.descendant
+      obtain ⟨constructors, natPeel, _translated, emitted⟩ :=
+        Lower.CodeTrace.switchSyntax_of_match
+          (state.functionTrace.descendantSyntaxMatches descendant)
+      rw [blockEq, emitted]
+      exact .switchValue _ _ _
+
+/-- Compiler progress for a target terminator, with only constructor macros
+and nonterminal returns retained as typed residuals. -/
+inductive AttachedCompilerTerminatorCase
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    (baselineContext rewrittenContext : Eval.Context)
+    (machine rewritten : Machine)
+    (state : CompilerRunningState attached machine) :
+    Terminator → Machine → Prop where
+  | advance {terminator baselineNext}
+      (ready : AttachedCompilerAdvance optimized baselineContext
+        rewrittenContext .physical machine rewritten baselineNext) :
+      AttachedCompilerTerminatorCase optimized baselineContext
+        rewrittenContext machine rewritten state terminator baselineNext
+  | switchCtor {scrutinee : Atom} {constructors : Array CtorAlt}
+      {natPeel : Option NatPeel} {location : Nat} {box : IxIR1.NodeBox}
+      {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+      {target : Frame}
+      (compilerMacro : CompilerMacroStep attached baselineContext .physical
+        machine)
+      (resolved : Eval.resolveAtom state.frame.values scrutinee =
+        .ok (.loc location))
+      (boxAt : machine.store.get? location = some box)
+      (node : box.node = .ctorN cid fields)
+      (alternativeAt : constructors.find? (fun candidate =>
+        candidate.cid == cid) = some alternative)
+      (transferred : Eval.EdgeTransfer state.frame alternative.edge #[] target) :
+      AttachedCompilerTerminatorCase optimized baselineContext
+        rewrittenContext machine rewritten state
+        (.switchValue scrutinee constructors natPeel)
+        { machine with control := .running target state.stack }
+  | retResume {caller : Frame} {rest : List Continuation}
+      {atom : Atom} {value : RVal}
+      (stackEq : state.stack = .resume caller :: rest)
+      (resolved : Eval.resolveAtom state.frame.values atom = .ok value)
+      (noCredits : Eval.NoLiveCredits state.frame)
+      (world : value.hasWorld machine.store
+        state.frame.definition.signature.result = true) :
+      AttachedCompilerTerminatorCase optimized baselineContext
+        rewrittenContext machine rewritten state (.ret atom)
+        { store := machine.store
+          heapFuel := machine.heapFuel
+          control := .running
+            { caller with values := caller.values.push value } rest }
+  | retApplyMore {caller : Frame} {arguments : Array RVal}
+      {rest : List Continuation} {atom : Atom} {value : RVal}
+      {target : Machine}
+      (stackEq : state.stack = .applyMore arguments caller :: rest)
+      (resolved : Eval.resolveAtom state.frame.values atom = .ok value)
+      (noCredits : Eval.NoLiveCredits state.frame)
+      (world : value.hasWorld machine.store
+        state.frame.definition.signature.result = true)
+      (transferred : Eval.ApplyTransfer baselineContext .physical
+        machine.store machine.heapFuel value arguments caller rest target) :
+      AttachedCompilerTerminatorCase optimized baselineContext
+        rewrittenContext machine rewritten state (.ret atom) target
+
+/-- Exhaustively reconstruct compiler progress for all target terminators
+except constructor macros and returns that cross a continuation boundary. -/
+theorem attachedPhysicalTerminatorCase
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {machine rewritten baselineNext : Machine}
+    (state : CompilerRunningState attached machine)
+    {block : Block} {terminator : Terminator}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    (classified : Eval.TerminatorTransferCase
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine.store machine.heapFuel state.frame state.stack
+      terminator baselineNext) :
+    AttachedCompilerTerminatorCase optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      machine rewritten state terminator baselineNext := by
+  let sourceContext := attached.simulationSourceContext
+  generalize stackEq : state.stack = currentStack at classified
+  cases classified with
+  | jump transferred =>
+      have shape := state.currentTerminatorSyntax blockAt pc
+      rw [terminatorAt] at shape
+      cases shape
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      rw [← stackEq]
+      exact .switchCtor
+        (state.switchCtorMacroOfTarget blockAt pc terminatorAt resolved boxAt
+          node alternativeAt)
+        resolved boxAt node alternativeAt transferred
+  | switchNatZero resolved transferred =>
+      rw [← stackEq]
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepSwitchNatZeroOfTarget
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) blockAt pc terminatorAt resolved
+          transferred
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | switchNatSucc resolved transferred =>
+      rw [← stackEq]
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.stepSwitchNatSuccOfTarget
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) blockAt pc terminatorAt resolved
+          transferred
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | branchPresent lookedUp present transferred =>
+      have shape := state.currentTerminatorSyntax blockAt pc
+      rw [terminatorAt] at shape
+      cases shape
+  | branchAbsent lookedUp absent transferred =>
+      have shape := state.currentTerminatorSyntax blockAt pc
+      rw [terminatorAt] at shape
+      cases shape
+  | retResume resolved noCredits world =>
+      exact .retResume stackEq resolved noCredits world
+  | retHalt resolved noCredits world =>
+      obtain ⟨_targetStep, compiler, acceptedEntry⟩ :=
+        state.returnHaltOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) blockAt pc terminatorAt stackEq resolved
+      exact .advance
+        (.step compiler (fun _related => acceptedEntry _))
+  | retApplyMore resolved noCredits world transferred =>
+      exact .retApplyMore stackEq resolved noCredits world transferred
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      rw [← stackEq]
+      obtain ⟨nextState, _targetStep, acceptedEntry⟩ :=
+        state.enterTailCallOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) rfl rfl blockAt pc terminatorAt
+          resolved declaration arity
+      exact .advance
+        (.step (.running nextState) (fun _related => acceptedEntry _))
+  | tailCallSelf noCredits resolved arity nonempty =>
+      rw [← stackEq]
+      obtain ⟨nextState, _targetStep⟩ :=
+        state.enterTailCallSelfOfTarget
+          (sourceContext := sourceContext) (sourceFuel := 0)
+          (context := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (interpretation := .physical) blockAt pc terminatorAt resolved arity
+      exact .advance
+        (.stepOfPcZero (.running nextState) rfl rfl)
+
+/-- Resolve the three semantic residuals left by exhaustive terminator
+classification. Constructor handlers receive the already reconstructed
+positive compiler macro; return handlers retain only the continuation history
+that is not recoverable from the current leaf state alone. -/
+theorem AttachedCompilerTerminatorCase.resolve
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {machine rewritten baselineNext : Machine}
+    {state : CompilerRunningState attached machine}
+    {terminator : Terminator}
+    (classified : AttachedCompilerTerminatorCase optimized baselineContext
+      rewrittenContext machine rewritten state terminator baselineNext)
+    (switchCtorAdvance : ∀ {scrutinee : Atom}
+        {constructors : Array CtorAlt} {natPeel : Option NatPeel}
+        {location : Nat} {box : IxIR1.NodeBox} {cid : CtorId}
+        {fields : Array RVal} {alternative : CtorAlt} {target : Frame},
+      terminator = .switchValue scrutinee constructors natPeel →
+      CompilerMacroStep attached baselineContext .physical machine →
+      Eval.resolveAtom state.frame.values scrutinee = .ok (.loc location) →
+      machine.store.get? location = some box →
+      box.node = .ctorN cid fields →
+      constructors.find? (fun candidate => candidate.cid == cid) =
+          some alternative →
+      Eval.EdgeTransfer state.frame alternative.edge #[] target →
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        .physical machine rewritten
+          { machine with control := .running target state.stack })
+    (retResumeAdvance : ∀ {caller : Frame} {rest : List Continuation}
+        {atom : Atom} {value : RVal},
+      terminator = .ret atom →
+      state.stack = .resume caller :: rest →
+      Eval.resolveAtom state.frame.values atom = .ok value →
+      Eval.NoLiveCredits state.frame →
+      value.hasWorld machine.store state.frame.definition.signature.result =
+          true →
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        .physical machine rewritten
+          { store := machine.store
+            heapFuel := machine.heapFuel
+            control := .running
+              { caller with values := caller.values.push value } rest })
+    (retApplyMoreAdvance : ∀ {caller : Frame} {arguments : Array RVal}
+        {rest : List Continuation} {atom : Atom} {value : RVal}
+        {target : Machine},
+      terminator = .ret atom →
+      state.stack = .applyMore arguments caller :: rest →
+      Eval.resolveAtom state.frame.values atom = .ok value →
+      Eval.NoLiveCredits state.frame →
+      value.hasWorld machine.store state.frame.definition.signature.result =
+          true →
+      Eval.ApplyTransfer baselineContext .physical machine.store
+          machine.heapFuel value arguments caller rest target →
+      AttachedCompilerAdvance optimized baselineContext rewrittenContext
+        .physical machine rewritten target) :
+    AttachedCompilerAdvance optimized baselineContext rewrittenContext
+      .physical machine rewritten baselineNext := by
+  cases classified with
+  | advance ready => exact ready
+  | switchCtor compilerMacro resolved boxAt node alternativeAt transferred =>
+      exact switchCtorAdvance rfl compilerMacro resolved boxAt node
+        alternativeAt transferred
+  | retResume stackEq resolved noCredits world =>
+      exact retResumeAdvance rfl stackEq resolved noCredits world
+  | retApplyMore stackEq resolved noCredits world transferred =>
+      exact retApplyMoreAdvance rfl stackEq resolved noCredits world
+        transferred
+
+/-- Resolve constructor terminators all the way to a paired positive macro
+under a concrete allocation history and successful baseline suffix. The
+selected child's compiler and physical reuse macro and ordinary caller
+resumption are reconstructed internally. Only residual `applyMore` dispatch
+remains explicit. -/
+theorem attachedPhysicalTerminatorAdvanceHistory
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {machine baselineNext : Machine}
+    (state : CompilerRunningState attached machine)
+    {rewrittenStore : Store} {rewrittenFuel : Nat}
+    {rewrittenFrame : Frame} {rewrittenStack : List Continuation}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    (heap : IxIR1.Sim.HeapHistoryIso machine.store.heap rewrittenStore.heap)
+    (fuel : machine.heapFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel state.frame
+      rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel state.stack
+      rewrittenStack)
+    {block : Block} {terminator : Terminator}
+    (blockAt : state.frame.definition.blocks[state.frame.block]? = some block)
+    (pc : state.frame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    (classified : Eval.TerminatorTransferCase
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine.store machine.heapFuel state.frame state.stack
+      terminator baselineNext)
+    {baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (suffix : Steps
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical suffixCount baselineNext baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedCompilerAdvance optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack }
+        baselineNext := by
+  have canonicalEq :
+      ({ store := machine.store
+         heapFuel := machine.heapFuel
+         control := .running state.frame state.stack } : Machine) =
+        machine := by
+    simpa only using congrArg
+      (fun control => ({ machine with control } : Machine)) state.control.symm
+  have stepped : Step
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical machine baselineNext := by
+    have head := classified.step blockAt pc terminatorAt
+    rwa [canonicalEq] at head
+  apply (attachedPhysicalTerminatorCase optimized state blockAt pc terminatorAt
+    classified).resolve
+  · intro scrutinee constructors natPeel location box cid fields alternative
+      target terminatorEq _compilerMacro resolved boxAt node alternativeAt
+      _transferred
+    exact .macro
+      (attachedPhysicalSwitchCtorMacroOfTarget optimized rfl rfl state rewrite
+        heap fuel frame stack blockAt pc (terminatorAt.trans terminatorEq)
+        resolved boxAt node alternativeAt stepped suffix halted)
+  · intro caller rest atom value terminatorEq stackEq resolved noCredits world
+    have returnStep : Eval.Step
+        (Eval.Context.ofProgram attached.target.artifact.program
+          attached.target.artifact.validationContext.schemas oracle)
+        .physical machine
+        { machine with
+          control := .running
+            { caller with values := caller.values.push value } rest } :=
+      Eval.Step.retResumeCleared (by rw [state.control, stackEq]) blockAt pc
+        (terminatorAt.trans terminatorEq) resolved noCredits world
+    obtain ⟨nextState, _step, acceptedEntry⟩ :=
+      state.returnResumeOfTarget blockAt pc (terminatorAt.trans terminatorEq)
+        stackEq resolved returnStep
+    exact .step (.running nextState) (fun _ => acceptedEntry _)
+  · intro caller arguments rest atom value target terminatorEq stackEq
+      resolved _noCredits _world transferred
+    obtain ⟨nextState, acceptedEntry⟩ :=
+      state.returnApplyMoreOfTarget
+        (context := Eval.Context.ofProgram attached.target.artifact.program
+          attached.target.artifact.validationContext.schemas oracle)
+        (interpretation := .physical) (target := target) rfl blockAt pc
+        (terminatorAt.trans terminatorEq) stackEq resolved transferred
+    exact .step (.running nextState) (fun _ => acceptedEntry _)
+
+/-- Exhaustive compiler-aware synchronization dispatch from an
+allocation-history-related live state. Literally preserved blocks carry the
+compiler state at the ordinary one-step successor; accepted blocks remain one
+local compiler-aware macro obligation. -/
+theorem attachedStableMacroStepOfTraceIsoOfStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {sourceProgram : Program}
+    (trace : Reuse.Trace Validate.defaultLimits
+      attached.target.artifact.validationContext sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (compilerNext : CompilerState attached baselineStepTarget)
+    (acceptedEntryNext : ∀ {rewrittenTarget : Machine},
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baselineStepTarget
+            rewrittenTarget →
+        StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baselineStepTarget
+            rewrittenTarget)
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site Validate.defaultLimits
+          attached.target.artifact.validationContext block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        AttachedStableMacroStep optimized
+          (Eval.Context.ofProgram sourceProgram
+            attached.target.artifact.validationContext.schemas oracle)
+          (Eval.Context.ofProgram trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have dispatch : ∀ {block : Block},
+      baselineFrame.definition.blocks[baselineFrame.block]? = some block →
+      AttachedStableMacroStep optimized
+        (Eval.Context.ofProgram sourceProgram
+          attached.target.artifact.validationContext.schemas oracle)
+        (Eval.Context.ofProgram trace.target
+          attached.target.artifact.validationContext.schemas oracle)
+        interpretation
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack } := by
+    intro block blockAt
+    cases frame.blockCase blockAt with
+    | unchanged sourceAt targetAt =>
+        have sourceBlockAt : source.blocks[baselineFrame.block]? =
+            some block := by
+          rw [← frame.baselineDefinition]
+          exact blockAt
+        have blockEq := Option.some.inj (sourceAt.symm.trans sourceBlockAt)
+        cases blockEq
+        have rewrittenBlockAt :
+            rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+              some block := by
+          rw [frame.rewrittenDefinition, ← frame.block]
+          exact targetAt
+        obtain ⟨rewrittenTarget, rewrittenStep, related⟩ :=
+          unchangedStepOfTraceLiveIso trace rewrite heap fuel frame stack blockAt
+            rewrittenBlockAt stepped
+        exact AttachedStableMacroStep.ofStepsOne rfl rfl stepped rewrittenStep
+          related (acceptedEntryNext related) compilerNext
+          (unchangedStep_allocationDelta heap frame stack blockAt rewrittenBlockAt
+            stepped rewrittenStep)
+          (unchangedStep_costDelta heap frame stack blockAt rewrittenBlockAt
+            stepped rewrittenStep related)
+    | accepted found =>
+        exact accepted found
+  cases stepped.classify with
+  | instruction blockAt _pc _instructionAt _instructionCase =>
+      exact dispatch blockAt
+  | terminator blockAt _pc _terminatorAt _terminatorCase =>
+      exact dispatch blockAt
+
+/-- Dispatch one baseline instruction from the syntactic family used by a
+recognized reuse prefix.  If the enclosing block was left unchanged, both
+machines take the same literal instruction and the resulting same-block
+relation supplies accepted-entry phase.  If the block was accepted, the
+intermediate prefix state is deliberately skipped and the whole-site macro
+owns synchronization. -/
+theorem attachedStableMacroStepOfTraceIsoOfPrefixStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {sourceProgram : Program}
+    (trace : Reuse.Trace Validate.defaultLimits
+      attached.target.artifact.validationContext sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (compilerNext : CompilerState attached baselineStepTarget)
+    (prefixAt : AcceptedPrefixInstructionAt
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site Validate.defaultLimits
+          attached.target.artifact.validationContext block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        AttachedStableMacroStep optimized
+          (Eval.Context.ofProgram sourceProgram
+            attached.target.artifact.validationContext.schemas oracle)
+          (Eval.Context.ofProgram trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  obtain ⟨prefixFrame, prefixStack, block, instruction, control, blockAt,
+      pc, instructionAt, acceptedPrefix⟩ := prefixAt
+  change (.running baselineFrame baselineStack : Control) =
+    .running prefixFrame prefixStack at control
+  injection control with frameEq stackEq
+  subst prefixFrame
+  subst prefixStack
+  cases frame.blockCase blockAt with
+  | unchanged sourceAt targetAt =>
+      have sourceBlockAt : source.blocks[baselineFrame.block]? =
+          some block := by
+        rw [← frame.baselineDefinition]
+        exact blockAt
+      have blockEq := Option.some.inj (sourceAt.symm.trans sourceBlockAt)
+      cases blockEq
+      have rewrittenBlockAt :
+          rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+            some block := by
+        rw [frame.rewrittenDefinition, ← frame.block]
+        exact targetAt
+      cases stepped.classify with
+      | instruction classifiedBlockAt _classifiedPc classifiedInstructionAt
+          classified =>
+          have classifiedBlockEq :=
+            Option.some.inj (classifiedBlockAt.symm.trans blockAt)
+          cases classifiedBlockEq
+          have classifiedInstructionEq :=
+            classifiedInstructionAt.symm.trans instructionAt
+          cases classifiedInstructionEq
+          obtain ⟨rewrittenTarget, baselineStep, rewrittenStep, related,
+              acceptedEntry⟩ :=
+            unchangedAcceptedPrefixInstructionStepOfTraceLiveIso trace rewrite
+              heap fuel frame stack blockAt rewrittenBlockAt pc instructionAt
+              classified acceptedPrefix
+          exact AttachedStableMacroStep.ofStepsOne rfl rfl baselineStep
+            rewrittenStep related acceptedEntry compilerNext
+            (unchangedStep_allocationDelta heap frame stack blockAt rewrittenBlockAt
+              baselineStep rewrittenStep)
+            (unchangedStep_costDelta heap frame stack blockAt rewrittenBlockAt
+              baselineStep rewrittenStep related)
+      | terminator classifiedBlockAt terminal _terminatorAt _classified =>
+          have classifiedBlockEq :=
+            Option.some.inj (classifiedBlockAt.symm.trans blockAt)
+          cases classifiedBlockEq
+          omega
+  | accepted found =>
+      exact accepted found
+
+/-- Trace dispatch with an explicit positive-macro arm.  This removes the
+false requirement that every compiler trace boundary coincide with the
+evaluator's immediate successor: a constructor switch can supply its
+edge-plus-fetch macro directly, while ordinary steps reuse the exhaustive
+one-step dispatcher above. -/
+theorem attachedStableMacroStepOfTraceIso
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {sourceProgram : Program}
+    (trace : Reuse.Trace Validate.defaultLimits
+      attached.target.artifact.validationContext sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+      attached.target.artifact.validationContext source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableLiveFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext heap.locRel
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (advance : AttachedCompilerAdvance optimized
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+      baselineStepTarget)
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site Validate.defaultLimits
+          attached.target.artifact.validationContext block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        AttachedStableMacroStep optimized
+          (Eval.Context.ofProgram sourceProgram
+            attached.target.artifact.validationContext.schemas oracle)
+          (Eval.Context.ofProgram trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized
+      (Eval.Context.ofProgram sourceProgram
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  cases advance with
+  | step compilerNext acceptedEntryNext =>
+      exact attachedStableMacroStepOfTraceIsoOfStep optimized trace rewrite
+        heap fuel frame stack stepped compilerNext acceptedEntryNext accepted
+  | prefixStep compilerNext prefixAt =>
+      exact attachedStableMacroStepOfTraceIsoOfPrefixStep optimized trace
+        rewrite heap fuel frame stack stepped compilerNext prefixAt accepted
+  | «macro» ready => exact ready
+
+/-- Uniform compiler-aware synchronization over either arm of
+`StableHeapRel`. Allocation-history states dispatch directly. Exact-content
+states are first re-indexed by the compiler's bounded canonical history, so
+ordinary steps stay automatic while accepted sites retain their original
+exact-content premises. -/
+theorem attachedStableMacroStepOfTraceRel
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (compiler : CompilerRunningState attached
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    (relation : StableLiveMachineRel Validate.defaultLimits
+      attached.target.artifact.validationContext
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    (acceptedEntry : StableLiveAcceptedEntry Validate.defaultLimits
+      attached.target.artifact.validationContext
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (advance : AttachedCompilerAdvance optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+      baselineStepTarget)
+    (accepted : ∀ {locRel : Nat → Nat → Prop}
+        {source : Function}
+        {rewrite : Reuse.FunctionRewrite Validate.defaultLimits
+          attached.target.artifact.validationContext source},
+      StableHeapRel baselineStore rewrittenStore locRel →
+      StableLiveFrameIso rewrite locRel baselineFrame rewrittenFrame →
+      StableLiveStackIso Validate.defaultLimits
+          attached.target.artifact.validationContext locRel
+          baselineStack rewrittenStack →
+      ∀ {helperOffset : Nat} {block : Block}
+          {site : Reuse.Site Validate.defaultLimits
+            attached.target.artifact.validationContext block},
+        Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+            helperOffset block (.accepted site) →
+          baselineFrame.pc = 0 →
+          LiveValuesIso source baselineFrame.block 0 locRel
+            baselineFrame.values rewrittenFrame.values →
+          AttachedStableMacroStep optimized
+            (Eval.Context.ofProgram attached.target.artifact.program
+              attached.target.artifact.validationContext.schemas oracle)
+            (Eval.Context.ofProgram optimized.output.trace.target
+              attached.target.artifact.validationContext.schemas oracle)
+            interpretation
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack }
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack }) :
+    AttachedStableMacroStep optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  cases relation with
+  | related locRel heap fuel control =>
+      cases control with
+      | running frames stack =>
+          cases frames with
+          | rewritten rewrite frame =>
+              cases heap with
+              | isomorphic iso =>
+                  apply attachedStableMacroStepOfTraceIso optimized
+                    optimized.output.trace rewrite iso.symm fuel frame stack
+                    stepped advance
+                  intro helperOffset block site found
+                  obtain ⟨pc, parameters⟩ :=
+                    acceptedEntry.valuesAtEntry rfl rfl frame found
+                  exact accepted (.isomorphic iso) frame stack found pc
+                    parameters
+              | contents same =>
+                  have controlEq :
+                      Control.running baselineFrame baselineStack =
+                        .running compiler.frame compiler.stack := by
+                    simpa using compiler.control
+                  injection controlEq with frameEq stackEq
+                  have compilerFrame : StableLiveFrameIso rewrite
+                      (fun left right => left = right) compiler.frame
+                        rewrittenFrame := by
+                    simpa [← frameEq] using frame
+                  have compilerStack : StableLiveStackIso
+                      Validate.defaultLimits
+                      attached.target.artifact.validationContext
+                      (fun left right => left = right) compiler.stack
+                        rewrittenStack := by
+                    simpa [← stackEq] using stack
+                  obtain ⟨history, historyFrame, historyStack⟩ :=
+                    compiler.historyOfContents same compilerFrame compilerStack
+                  apply attachedStableMacroStepOfTraceIso optimized
+                    optimized.output.trace rewrite history fuel
+                    (by simpa [frameEq] using historyFrame)
+                    (by simpa [stackEq] using historyStack)
+                    stepped advance
+                  intro helperOffset block site found
+                  obtain ⟨pc, parameters⟩ :=
+                    acceptedEntry.valuesAtEntry rfl rfl frame found
+                  exact accepted (.contents same) frame stack found pc
+                    parameters
+
+/-- Physical trace dispatch with the accepted-site arm synthesized from the
+actual remaining baseline execution.  Exact-content relations are first
+re-indexed by the compiler's canonical live allocation history; history arms
+use their existing orientation directly.  Thus the only accepted-site
+callback reaching the trace dispatcher is the concrete suffix inversion
+above. -/
+theorem attachedPhysicalStableMacroStepOfTraceRelGuided
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (compiler : CompilerRunningState attached
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    (relation : StableLiveMachineRel Validate.defaultLimits
+      attached.target.artifact.validationContext
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    (acceptedEntry : StableLiveAcceptedEntry Validate.defaultLimits
+      attached.target.artifact.validationContext
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    {baselineStepTarget baselineFinal : Machine} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (stepped : Step
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (suffix : Steps
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical suffixCount baselineStepTarget baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue })
+    (advance : AttachedCompilerAdvance optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+      baselineStepTarget) :
+    AttachedStableMacroStep optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have compilerControl :
+      (.running baselineFrame baselineStack : Control) =
+        .running compiler.frame compiler.stack := by
+    simpa using compiler.control
+  injection compilerControl with baselineFrameEq baselineStackEq
+  have fuel : baselineFuel ≤ rewrittenFuel := by
+    cases relation with
+    | related _ _ fuel _ => exact fuel
+  apply attachedStableMacroStepOfTraceRel optimized compiler relation
+    acceptedEntry stepped advance
+  intro locRel source rewrite heap frame stack helperOffset block site found
+    _pc _parameters
+  have compilerFrame : StableLiveFrameIso rewrite locRel compiler.frame
+      rewrittenFrame := by
+    simpa [← baselineFrameEq] using frame
+  have compilerStack : StableLiveStackIso Validate.defaultLimits
+      attached.target.artifact.validationContext locRel compiler.stack
+        rewrittenStack := by
+    simpa [← baselineStackEq] using stack
+  have compilerFound : Reuse.FunctionDecisions.At rewrite.decisions
+      compiler.frame.block helperOffset block (.accepted site) := by
+    simpa [← baselineFrameEq] using found
+  obtain ⟨compilerPc, compilerParameters⟩ :=
+    acceptedEntry.valuesAtEntry compiler.control rfl compilerFrame
+      compilerFound
+  cases heap with
+  | isomorphic iso =>
+      have ready :=
+        compiler.acceptedPhysicalStableMacroStepHistoryOfExecution
+          (baselineContext := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (rewrittenContext := Eval.Context.ofProgram
+            optimized.output.trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          optimized rewrite compilerFrame.baselineDefinition compilerFound
+          compilerPc rfl rfl iso.symm compilerParameters compilerStack fuel
+          stepped suffix halted
+      have rewrittenFrameEq :=
+        compilerFrame.rewritten_eq_entry compilerPc compiler.noCredits
+      rw [← rewrittenFrameEq] at ready
+      exact ready
+
+  | contents same =>
+      obtain ⟨history, historyFrame, historyStack⟩ :=
+        compiler.historyOfContents same compilerFrame compilerStack
+      obtain ⟨historyPc, historyParameters⟩ :=
+        acceptedEntry.valuesAtEntry compiler.control rfl historyFrame
+          compilerFound
+      have ready :=
+        compiler.acceptedPhysicalStableMacroStepHistoryOfExecution
+          (baselineContext := Eval.Context.ofProgram
+            attached.target.artifact.program
+            attached.target.artifact.validationContext.schemas oracle)
+          (rewrittenContext := Eval.Context.ofProgram
+            optimized.output.trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          optimized rewrite historyFrame.baselineDefinition compilerFound
+          historyPc rfl rfl history historyParameters historyStack fuel stepped
+          suffix halted
+      have rewrittenFrameEq :=
+        historyFrame.rewritten_eq_entry historyPc compiler.noCredits
+      rw [← rewrittenFrameEq] at ready
+      exact ready
+
+/-- A live-related rewritten machine is running whenever its baseline is.
+This small inversion keeps the generalized guided dispatcher independent of
+the concrete frame decomposition chosen by its caller. -/
+theorem StableLiveMachineRel.rewrittenRunning
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Machine} {baselineFrame : Frame}
+    {baselineStack : List Continuation}
+    (relation : StableLiveMachineRel limits validation baseline rewritten)
+    (running : baseline.control =
+      .running baselineFrame baselineStack) :
+    ∃ rewrittenFrame rewrittenStack,
+      rewritten.control = .running rewrittenFrame rewrittenStack := by
+  cases relation with
+  | related locRel heap fuel control =>
+      rw [running] at control
+      generalize rewrittenControlEq : rewritten.control = rewrittenControl
+        at control
+      cases control with
+      | running frame stack => exact ⟨_, _, rfl⟩
+
+/-- Reconstruct compiler progress for every successful physical baseline
+head. Constructor macros use the actual halted suffix; all other instructions
+and returns reconstruct their next compiler state directly. -/
+theorem attachedPhysicalCompilerAdvance
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {baseline rewritten baselineNext baselineFinal : Machine}
+    {suffixCount : Nat} {finalStore : Store} {finalHeapFuel : Nat}
+    {finalValue : RVal}
+    (compiler : CompilerRunningState attached baseline)
+    (relation : StableLiveMachineRel Validate.defaultLimits
+      attached.target.artifact.validationContext baseline rewritten)
+    (stepped : Step
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical baseline baselineNext)
+    (suffix : Steps
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical suffixCount baselineNext baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedCompilerAdvance optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical baseline rewritten baselineNext := by
+  have canonicalEq :
+      ({ store := baseline.store
+         heapFuel := baseline.heapFuel
+         control := .running compiler.frame compiler.stack } : Machine) =
+        baseline := by
+    simpa only using congrArg
+      (fun control => ({ baseline with control } : Machine)) compiler.control.symm
+  have canonicalStep : Step
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical
+      { store := baseline.store
+        heapFuel := baseline.heapFuel
+        control := .running compiler.frame compiler.stack } baselineNext := by
+    rwa [canonicalEq]
+  cases canonicalStep.classify with
+  | instruction blockAt pc instructionAt classified =>
+      exact attachedPhysicalInstructionAdvance optimized compiler blockAt pc
+        instructionAt classified
+  | terminator blockAt pc terminatorAt classified =>
+      cases relation with
+      | related locRel heap fuel control =>
+          rw [compiler.control] at control
+          generalize rewrittenControlEq : rewritten.control = rewrittenControl at control
+          cases control with
+          | @running _ rewrittenFrame _ rewrittenStack frames stack =>
+              cases frames with
+              | @rewritten source rewrite _ _ frame =>
+                  have rewrittenEq :
+                      ({ store := rewritten.store
+                         heapFuel := rewritten.heapFuel
+                         control := .running rewrittenFrame rewrittenStack } : Machine) = rewritten := by
+                    simpa only using congrArg
+                      (fun control => ({ rewritten with control } : Machine))
+                      rewrittenControlEq.symm
+                  rw [← rewrittenEq]
+                  cases heap with
+                  | isomorphic iso =>
+                      exact attachedPhysicalTerminatorAdvanceHistory optimized compiler
+                        rewrite iso.symm fuel frame stack blockAt pc terminatorAt
+                        classified suffix halted
+                  | contents same =>
+                      obtain ⟨history, historyFrame, historyStack⟩ :=
+                        compiler.historyOfContents same frame stack
+                      exact attachedPhysicalTerminatorAdvanceHistory optimized compiler
+                        rewrite history fuel historyFrame historyStack blockAt pc
+                        terminatorAt classified suffix halted
+
+
+/-- Physical guided dispatch reconstructs compiler progress and accepted
+macros internally. The live control relation recovers the rewritten running
+frame from the abstract current machines. -/
+theorem attachedPhysicalStableMacroStepGuided
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {baseline rewritten baselineNext baselineFinal : Machine}
+    {frame : Frame} {stack : List Continuation} {suffixCount : Nat}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (compiler : CompilerRunningState attached baseline)
+    (relation : StableLiveMachineRel Validate.defaultLimits
+      attached.target.artifact.validationContext baseline rewritten)
+    (acceptedEntry : StableLiveAcceptedEntry Validate.defaultLimits
+      attached.target.artifact.validationContext baseline rewritten)
+    (running : baseline.control = .running frame stack)
+    (stepped : Step
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical baseline baselineNext)
+    (suffix : Steps
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical suffixCount baselineNext baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    AttachedStableMacroStep optimized
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      (Eval.Context.ofProgram optimized.output.trace.target
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical baseline rewritten := by
+  have advance := attachedPhysicalCompilerAdvance optimized compiler relation
+    stepped suffix halted
+  obtain ⟨rewrittenFrame, rewrittenStack, rewrittenRunning⟩ :=
+    relation.rewrittenRunning running
+  have baselineEq : baseline =
+      { store := baseline.store
+        heapFuel := baseline.heapFuel
+        control := .running frame stack } := by
+    cases baseline
+    simpa only [Machine.mk.injEq, true_and] using running
+  have rewrittenEq : rewritten =
+      { store := rewritten.store
+        heapFuel := rewritten.heapFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+    cases rewritten
+    simpa only [Machine.mk.injEq, true_and] using rewrittenRunning
+  rw [baselineEq] at compiler relation acceptedEntry stepped advance ⊢
+  rw [rewrittenEq] at relation acceptedEntry advance ⊢
+  exact attachedPhysicalStableMacroStepOfTraceRelGuided optimized compiler
+    relation acceptedEntry stepped suffix halted advance
+
+/-- Every compiler-aware macro is exactly an invariant-preserving macro for
+`AttachedStableState`. -/
+theorem AttachedStableMacroStep.invariantStep
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart : Machine}
+    (step : AttachedStableMacroStep optimized baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart)
+    (allocations : baselineStart.store.allocationEvents =
+      rewrittenStart.store.allocationEvents)
+    (costs : baselineStart.store.CostBounds rewrittenStart.store) :
+    StableLiveMacroInvariantStep Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext interpretation (AttachedStableState optimized)
+      baselineStart rewrittenStart := by
+  cases step with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related
+      acceptedEntry compiler allocationDelta costDelta =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related
+        ⟨compiler, related, acceptedEntry, allocationDelta.preserves allocations,
+          costDelta.preserves costs⟩
+
+/-- Upgrade an existing live macro after reconstructing the compiler state at
+the baseline endpoint selected by that macro. -/
+theorem StableLiveMacroSimulation.preserveCompiler
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart : Machine}
+    (simulation : StableLiveMacroSimulation Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart)
+    (preserved : ∀ {baselineCount rewrittenCount : Nat}
+        {baselineTarget rewrittenTarget : Machine},
+      Steps baselineContext interpretation baselineCount baselineStart
+          baselineTarget →
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenTarget →
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baselineTarget
+          rewrittenTarget →
+      CompilerState attached baselineTarget ∧
+        StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baselineTarget
+            rewrittenTarget ∧
+        AllocationDelta baselineStart.store baselineTarget.store
+          rewrittenStart.store rewrittenTarget.store ∧
+        CostDelta baselineStart.store baselineTarget.store
+          rewrittenStart.store rewrittenTarget.store) :
+    AttachedStableMacroStep optimized baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart := by
+  cases simulation with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related =>
+      obtain ⟨compiler, acceptedEntry, allocationDelta, costDelta⟩ :=
+        preserved baselineSteps rewrittenSteps related
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related acceptedEntry compiler allocationDelta costDelta
+
+/-- Eliminate the halted compiler alternative at a running baseline state and
+turn a local compiler-aware macro into preservation of the paired invariant. -/
+theorem AttachedStableState.advanceInvariant
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    {optimized : OptimizedAttachment attached}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baseline rewritten : Machine}
+    {frame : Frame} {stack : List Continuation}
+    (state : AttachedStableState optimized baseline rewritten)
+    (running : baseline.control = .running frame stack)
+    (advance : CompilerRunningState attached baseline →
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation baseline rewritten) :
+    StableLiveMacroInvariantStep Validate.defaultLimits
+      attached.target.artifact.validationContext baselineContext
+      rewrittenContext interpretation (AttachedStableState optimized)
+      baseline rewritten := by
+  cases state.compiler with
+  | running compiler =>
+      exact (advance compiler state.related state.acceptedEntry).invariantStep state.allocations state.costs
+  | halted stopped =>
+      have impossible : False := by
+        rw [stopped] at running
+        cases running
+      exact impossible.elim
+
+/-- Strong finite-execution induction specialized to the concrete
+compiler/reuse invariant. Its only local obligation receives the full running
+compiler witness, current live machine relation, and accepted-entry phase. -/
+theorem attachedStableFiniteExecution
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (advance : ∀ {baseline rewritten baselineNext : Machine}
+        {frame : Frame} {stack : List Continuation},
+      CompilerRunningState attached baseline →
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart baselineFinal :
+      Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : AttachedStableState optimized baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenFinal,
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        AttachedStableState optimized baselineFinal rewrittenFinal ∧
+        StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baselineFinal
+          rewrittenFinal := by
+  apply stableLiveFiniteExecutionOfMacroInvariant
+    (AttachedStableState optimized) (fun state => state.related) ?_ initial
+      baselineSteps halted
+  intro baseline rewritten baselineNext frame stack state running stepped
+  exact state.advanceInvariant running fun compiler related acceptedEntry =>
+    advance compiler related acceptedEntry running stepped
+
+/-- Execution-guided specialization of the concrete compiler/reuse
+invariant.  Besides the current compiler state and head step, the local
+obligation receives the real suffix to the halted baseline endpoint.  This is
+the sound dispatch interface for accepted reuse prefixes whose later release
+step, but not their first fetch step, witnesses sufficient heap fuel. -/
+theorem attachedStableFiniteExecutionGuided
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (advance : ∀ {baseline rewritten baselineNext baselineFinal : Machine}
+        {frame : Frame} {stack : List Continuation} {suffixCount : Nat}
+        {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal},
+      CompilerRunningState attached baseline →
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      Steps baselineContext interpretation suffixCount baselineNext
+        baselineFinal →
+      baselineFinal =
+        { store := finalStore
+          heapFuel := finalHeapFuel
+          control := .halted finalValue } →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart baselineFinal :
+      Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : AttachedStableState optimized baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenFinal,
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        AttachedStableState optimized baselineFinal rewrittenFinal ∧
+        StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baselineFinal
+          rewrittenFinal := by
+  apply stableLiveFiniteExecutionOfGuidedMacroInvariant
+    (AttachedStableState optimized) (fun state => state.related) ?_ initial
+      baselineSteps halted
+  intro baseline rewritten baselineNext baselineFinal frame stack suffixCount
+    finalStore finalHeapFuel finalValue state running stepped suffix halted
+  exact state.advanceInvariant running fun compiler related acceptedEntry =>
+    advance compiler related acceptedEntry running stepped suffix halted
+
+/-- Exact `runMachine` corollary for compiler-aware live macros. In addition to
+the related halted observation, the result retains the compiler state at the
+baseline terminal machine. -/
+theorem attachedStableRunMachine
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (advance : ∀ {baseline rewritten baselineNext : Machine}
+        {frame : Frame} {stack : List Continuation},
+      CompilerRunningState attached baseline →
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart : Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : AttachedStableState optimized baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenStore rewrittenHeapFuel rewrittenValue locRel,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenHeapFuel
+          control := .halted rewrittenValue }
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        AttachedStableState optimized
+          { store := finalStore
+            heapFuel := finalHeapFuel
+            control := .halted finalValue }
+          rewrittenFinal ∧
+        ReuseSim.StableHeapRel finalStore rewrittenStore locRel ∧
+        finalHeapFuel ≤ rewrittenHeapFuel ∧
+        IxIR1.Sim.RValIso locRel finalValue rewrittenValue ∧
+        Eval.runMachine rewrittenContext interpretation rewrittenCount
+            rewrittenStart =
+          .ok
+            { store := rewrittenStore
+              value := rewrittenValue
+              controlRemaining := 0
+              heapRemaining := rewrittenHeapFuel } := by
+  apply stableLiveRunMachineOfMacroInvariant
+    (AttachedStableState optimized) (fun state => state.related) ?_ initial
+      baselineSteps
+  intro baseline rewritten baselineNext frame stack state running stepped
+  exact state.advanceInvariant running fun compiler related acceptedEntry =>
+    advance compiler related acceptedEntry running stepped
+
+/-- Exact `runMachine` corollary for the execution-guided concrete
+compiler/reuse invariant. -/
+theorem attachedStableRunMachineGuided
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (advance : ∀ {baseline rewritten baselineNext baselineFinal : Machine}
+        {frame : Frame} {stack : List Continuation} {suffixCount : Nat}
+        {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal},
+      CompilerRunningState attached baseline →
+      StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      StableLiveAcceptedEntry Validate.defaultLimits
+          attached.target.artifact.validationContext baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      Steps baselineContext interpretation suffixCount baselineNext
+        baselineFinal →
+      baselineFinal =
+        { store := finalStore
+          heapFuel := finalHeapFuel
+          control := .halted finalValue } →
+      AttachedStableMacroStep optimized baselineContext rewrittenContext
+        interpretation baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart : Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : AttachedStableState optimized baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenStore rewrittenHeapFuel rewrittenValue locRel,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenHeapFuel
+          control := .halted rewrittenValue }
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        AttachedStableState optimized
+          { store := finalStore
+            heapFuel := finalHeapFuel
+            control := .halted finalValue }
+          rewrittenFinal ∧
+        ReuseSim.StableHeapRel finalStore rewrittenStore locRel ∧
+        finalHeapFuel ≤ rewrittenHeapFuel ∧
+        IxIR1.Sim.RValIso locRel finalValue rewrittenValue ∧
+        Eval.runMachine rewrittenContext interpretation rewrittenCount
+            rewrittenStart =
+          .ok
+            { store := rewrittenStore
+              value := rewrittenValue
+              controlRemaining := 0
+              heapRemaining := rewrittenHeapFuel } := by
+  apply stableLiveRunMachineOfGuidedMacroInvariant
+    (AttachedStableState optimized) (fun state => state.related) ?_ initial
+      baselineSteps
+  intro baseline rewritten baselineNext baselineFinal frame stack suffixCount
+    finalStore finalHeapFuel finalValue state running stepped suffix halted
+  exact state.advanceInvariant running fun compiler related acceptedEntry =>
+    advance compiler related acceptedEntry running stepped suffix halted
+
+/-- Whole physical finite execution from the compiler/reuse invariant.
+Compiler progress and accepted-site macros are reconstructed internally from
+the concrete baseline execution through its halted endpoint. -/
+theorem attachedPhysicalStableFiniteExecution
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {baselineCount : Nat} {baselineStart rewrittenStart baselineFinal :
+      Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : AttachedStableState optimized baselineStart rewrittenStart)
+    (baselineSteps : Steps
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical baselineCount baselineStart baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenFinal,
+      Steps
+          (Eval.Context.ofProgram optimized.output.trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical rewrittenCount rewrittenStart rewrittenFinal ∧
+        AttachedStableState optimized baselineFinal rewrittenFinal ∧
+        StableLiveMachineRel Validate.defaultLimits
+          attached.target.artifact.validationContext baselineFinal
+            rewrittenFinal := by
+  apply attachedStableFiniteExecutionGuided optimized ?_ initial baselineSteps
+    halted
+  intro baseline rewritten baselineNext baselineFinal frame stack suffixCount
+    finalStore finalHeapFuel finalValue compiler relation acceptedEntry running
+    stepped suffix halted
+  exact attachedPhysicalStableMacroStepGuided optimized compiler relation
+    acceptedEntry running stepped suffix halted
+
+/-- Exact rewritten `runMachine` result for a successful physical baseline
+execution. The initial compiler/reuse invariant supplies all progress; callers
+need no operation, return, or accepted-site callbacks. -/
+theorem attachedPhysicalStableRunMachine
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {baselineCount : Nat} {baselineStart rewrittenStart : Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : AttachedStableState optimized baselineStart rewrittenStart)
+    (baselineSteps : Steps
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical baselineCount baselineStart
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenStore rewrittenHeapFuel rewrittenValue locRel,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenHeapFuel
+          control := .halted rewrittenValue }
+      Steps
+          (Eval.Context.ofProgram optimized.output.trace.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical rewrittenCount rewrittenStart rewrittenFinal ∧
+        AttachedStableState optimized
+          { store := finalStore
+            heapFuel := finalHeapFuel
+            control := .halted finalValue }
+          rewrittenFinal ∧
+        ReuseSim.StableHeapRel finalStore rewrittenStore locRel ∧
+        finalHeapFuel ≤ rewrittenHeapFuel ∧
+        IxIR1.Sim.RValIso locRel finalValue rewrittenValue ∧
+        Eval.runMachine
+            (Eval.Context.ofProgram optimized.output.trace.target
+              attached.target.artifact.validationContext.schemas oracle)
+            .physical rewrittenCount rewrittenStart =
+          .ok
+            { store := rewrittenStore
+              value := rewrittenValue
+              controlRemaining := 0
+              heapRemaining := rewrittenHeapFuel } := by
+  apply attachedStableRunMachineGuided optimized ?_ initial baselineSteps
+  intro baseline rewritten baselineNext baselineFinal frame stack suffixCount
+    finalStore finalHeapFuel finalValue compiler relation acceptedEntry running
+    stepped suffix halted
+  exact attachedPhysicalStableMacroStepGuided optimized compiler relation
+    acceptedEntry running stepped suffix halted
+
+
+namespace OptimizedAttachment
+
+def baselineInitialMachine
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} (_optimized : OptimizedAttachment attached)
+    (heapFuel : Nat) : Machine :=
+  Lower.Sim.initialMainMachine attached.target.artifact heapFuel
+
+def rewrittenInitialMachine
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} (optimized : OptimizedAttachment attached)
+    (heapFuel : Nat) : Machine :=
+  Eval.initialMachine optimized.output.trace.target.main #[] heapFuel
+
+/-- The concrete compiler/reuse relation holds at the two exact initial main
+machines. -/
+theorem initial
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel} (optimized : OptimizedAttachment attached)
+    {baselineFuel rewrittenFuel : Nat}
+    (fuel : baselineFuel ≤ rewrittenFuel) :
+    AttachedStableState optimized
+      (optimized.baselineInitialMachine baselineFuel)
+      (optimized.rewrittenInitialMachine rewrittenFuel) := by
+  refine ⟨CompilerState.running
+      (CompilerRunningState.initial attached baselineFuel), ?_, ?_, rfl, .refl _⟩
+  · apply StableLiveMachineRel.history IxIR1.Sim.HeapHistoryIso.empty fuel
+    exact .running
+      (.rewritten optimized.output.trace.main
+        (StableLiveFrameIso.entry optimized.output.trace.main
+          IxIR1.Sim.RValsIso.nil))
+      .nil
+  · apply StableLiveAcceptedEntry.ofPcZero
+      (frame := Lower.Sim.initialMainFrame attached.target.artifact)
+      (stack := [])
+    · rfl
+    · rfl
+
+/-- The exact validated reuse output preserves every successful physical
+baseline main run. Both programs start with the same heap budget; the rewritten
+run returns a related heap and value with at least as much heap fuel remaining.
+Independent counter invariants preserve allocation events and compare RC work
+and all recorded live-node peaks. -/
+theorem physicalMainSimulationWithCosts
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {controlFuel heapFuel : Nat} {baselineResult : Eval.Result}
+    (baselineRun : Eval.runMain
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical attached.target.artifact.program controlFuel heapFuel =
+        .ok baselineResult) :
+    ∃ rewrittenControlFuel rewrittenResult locRel,
+      Eval.runMain
+          (Eval.Context.ofProgram optimized.output.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical optimized.output.target rewrittenControlFuel heapFuel =
+            .ok rewrittenResult ∧
+        StableHeapRel baselineResult.store rewrittenResult.store locRel ∧
+        IxIR1.Sim.RValIso locRel baselineResult.value rewrittenResult.value ∧
+        baselineResult.heapRemaining ≤ rewrittenResult.heapRemaining ∧
+        rewrittenResult.controlRemaining = 0 ∧
+        baselineResult.store.allocationEvents = rewrittenResult.store.allocationEvents ∧
+        baselineResult.CostBounds rewrittenResult := by
+  have baselineMachineRun : Eval.runMachine
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical controlFuel (optimized.baselineInitialMachine heapFuel) =
+        .ok baselineResult := by
+    rwa [Lower.Sim.runMain_eq_initialMainMachine] at baselineRun
+  obtain ⟨baselineCount, _controlBudget, baselineSteps⟩ :=
+    Eval.runMachine_steps baselineMachineRun
+  obtain ⟨rewrittenCount, rewrittenStore, rewrittenHeapFuel, rewrittenValue,
+      locRel, _rewrittenSteps, finalInvariant, heap, fuel, value, rewrittenRun⟩ :=
+    attachedPhysicalStableRunMachine optimized (optimized.initial (Nat.le_refl heapFuel))
+      baselineSteps
+  let rewrittenResult : Eval.Result :=
+    { store := rewrittenStore
+      value := rewrittenValue
+      controlRemaining := 0
+      heapRemaining := rewrittenHeapFuel }
+  refine ⟨rewrittenCount, rewrittenResult, locRel, ?_, heap, value, fuel, rfl,
+    finalInvariant.allocations, finalInvariant.costs⟩
+  rw [← optimized.output.trace_target]
+  have mainArity : optimized.output.trace.target.main.signature.params.size = 0 := by
+    rw [optimized.output.trace.target_main_signature]
+    exact attached.target.artifact.mainArity
+  have mainNonempty : optimized.output.trace.target.main.blocks.isEmpty = false :=
+    optimized.output.trace.main.definition_blocks_nonempty attached.target.artifact.mainNonempty
+  rw [Eval.runMain_eq_runMachine mainArity mainNonempty]
+  exact rewrittenRun
+
+/-- Compatibility projection retaining R3's allocation-event endpoint. -/
+theorem physicalMainSimulationWithAllocationEvents
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {controlFuel heapFuel : Nat} {baselineResult : Eval.Result}
+    (baselineRun : Eval.runMain
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical attached.target.artifact.program controlFuel heapFuel = .ok baselineResult) :
+    ∃ rewrittenControlFuel rewrittenResult locRel,
+      Eval.runMain
+          (Eval.Context.ofProgram optimized.output.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical optimized.output.target rewrittenControlFuel heapFuel = .ok rewrittenResult ∧
+        StableHeapRel baselineResult.store rewrittenResult.store locRel ∧
+        IxIR1.Sim.RValIso locRel baselineResult.value rewrittenResult.value ∧
+        baselineResult.heapRemaining ≤ rewrittenResult.heapRemaining ∧
+        rewrittenResult.controlRemaining = 0 ∧
+        baselineResult.store.allocationEvents = rewrittenResult.store.allocationEvents := by
+  obtain ⟨count, result, locRel, run, heap, value, fuel, control, events, _costs⟩ :=
+    optimized.physicalMainSimulationWithCosts baselineRun
+  exact ⟨count, result, locRel, run, heap, value, fuel, control, events⟩
+
+/-- Compatibility projection retaining the original semantic endpoint. -/
+theorem physicalMainSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (optimized : OptimizedAttachment attached)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {controlFuel heapFuel : Nat} {baselineResult : Eval.Result}
+    (baselineRun : Eval.runMain
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical attached.target.artifact.program controlFuel heapFuel = .ok baselineResult) :
+    ∃ rewrittenControlFuel rewrittenResult locRel,
+      Eval.runMain
+          (Eval.Context.ofProgram optimized.output.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical optimized.output.target rewrittenControlFuel heapFuel = .ok rewrittenResult ∧
+        StableHeapRel baselineResult.store rewrittenResult.store locRel ∧
+        IxIR1.Sim.RValIso locRel baselineResult.value rewrittenResult.value ∧
+        baselineResult.heapRemaining ≤ rewrittenResult.heapRemaining ∧
+        rewrittenResult.controlRemaining = 0 := by
+  obtain ⟨count, result, locRel, run, heap, value, fuel, control, _events⟩ :=
+    optimized.physicalMainSimulationWithAllocationEvents baselineRun
+  exact ⟨count, result, locRel, run, heap, value, fuel, control⟩
+
+
+end OptimizedAttachment
+
+/-- RC and peak bounds hold on both actual selection branches, together with
+R3's allocation events and the unchanged semantic heap and value relations. -/
+theorem selectedPhysicalMainSimulationWithCosts
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {controlFuel heapFuel : Nat} {baselineResult : Eval.Result}
+    (baselineRun : Eval.runMain
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical attached.target.artifact.program controlFuel heapFuel = .ok baselineResult) :
+    ∃ selectedControlFuel selectedResult locRel,
+      Eval.runMain
+          (Eval.Context.ofProgram selection.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical selection.target selectedControlFuel heapFuel = .ok selectedResult ∧
+        StableHeapRel baselineResult.store selectedResult.store locRel ∧
+        IxIR1.Sim.RValIso locRel baselineResult.value selectedResult.value ∧
+        baselineResult.heapRemaining ≤ selectedResult.heapRemaining ∧
+        baselineResult.store.allocationEvents = selectedResult.store.allocationEvents ∧
+        baselineResult.CostBounds selectedResult := by
+  cases selection with
+  | optimized output produced =>
+      let optimized : OptimizedAttachment attached := { output, produced }
+      obtain ⟨count, result, locRel, run, heap, value, fuel, _control, events, costs⟩ :=
+        optimized.physicalMainSimulationWithCosts baselineRun
+      exact ⟨count, result, locRel, run, heap, value, fuel, events, costs⟩
+  | baseline _error _rejected =>
+      exact ⟨controlFuel, baselineResult, (fun left right => left = right),
+        baselineRun, .contents (HeapContentsEq.refl baselineResult.store),
+        IxIR1.Sim.RValIso.refl baselineResult.value, Nat.le_refl _, rfl, .refl _⟩
+
+/-- Both selection branches preserve allocation-event totals along the actual
+physical execution. The checked baseline branch uses the identical run. -/
+theorem selectedPhysicalMainSimulationWithAllocationEvents
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {controlFuel heapFuel : Nat} {baselineResult : Eval.Result}
+    (baselineRun : Eval.runMain
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical attached.target.artifact.program controlFuel heapFuel = .ok baselineResult) :
+    ∃ selectedControlFuel selectedResult locRel,
+      Eval.runMain
+          (Eval.Context.ofProgram selection.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical selection.target selectedControlFuel heapFuel = .ok selectedResult ∧
+        StableHeapRel baselineResult.store selectedResult.store locRel ∧
+        IxIR1.Sim.RValIso locRel baselineResult.value selectedResult.value ∧
+        baselineResult.heapRemaining ≤ selectedResult.heapRemaining ∧
+        baselineResult.store.allocationEvents = selectedResult.store.allocationEvents := by
+  cases selection with
+  | optimized output produced =>
+      let optimized : OptimizedAttachment attached := { output, produced }
+      obtain ⟨count, result, locRel, run, heap, value, fuel, _control, events⟩ :=
+        optimized.physicalMainSimulationWithAllocationEvents baselineRun
+      exact ⟨count, result, locRel, run, heap, value, fuel, events⟩
+  | baseline _error _rejected =>
+      exact ⟨controlFuel, baselineResult, (fun left right => left = right),
+        baselineRun, .contents (HeapContentsEq.refl baselineResult.store),
+        IxIR1.Sim.RValIso.refl baselineResult.value, Nat.le_refl _, rfl⟩
+
+/-- Production selection preserves a successful physical baseline main run
+whether reuse succeeds or falls back. `selectAttachment` supplies this
+selection directly from the checked compiler artifact. -/
+theorem selectedPhysicalMainSimulation
+    {mainWorld : Ixon.Owned} {lowerFuel : Nat}
+    {attached : Pipeline.CompiledAttachment mainWorld lowerFuel}
+    (selection : Reuse.Selection Validate.defaultLimits
+      attached.target.artifact.validationContext attached.target.artifact.program)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {controlFuel heapFuel : Nat} {baselineResult : Eval.Result}
+    (baselineRun : Eval.runMain
+      (Eval.Context.ofProgram attached.target.artifact.program
+        attached.target.artifact.validationContext.schemas oracle)
+      .physical attached.target.artifact.program controlFuel heapFuel =
+        .ok baselineResult) :
+    ∃ selectedControlFuel selectedResult locRel,
+      Eval.runMain
+          (Eval.Context.ofProgram selection.target
+            attached.target.artifact.validationContext.schemas oracle)
+          .physical selection.target selectedControlFuel heapFuel =
+            .ok selectedResult ∧
+        StableHeapRel baselineResult.store selectedResult.store locRel ∧
+        IxIR1.Sim.RValIso locRel baselineResult.value selectedResult.value ∧
+        baselineResult.heapRemaining ≤ selectedResult.heapRemaining := by
+  cases selection with
+  | optimized output produced =>
+      let optimized : OptimizedAttachment attached := { output, produced }
+      obtain ⟨count, result, locRel, run, heap, value, fuel, _control⟩ :=
+        optimized.physicalMainSimulation baselineRun
+      exact ⟨count, result, locRel, run, heap, value, fuel⟩
+  | baseline _error _rejected =>
+      exact ⟨controlFuel, baselineResult, (fun left right => left = right),
+        baselineRun, .contents (HeapContentsEq.refl baselineResult.store),
+        IxIR1.Sim.RValIso.refl baselineResult.value, Nat.le_refl _⟩
+
+
+end Ix.Compiler.IxIR2.ReuseLiveSim
diff --git a/Ix/Compiler/IxIR2/ReuseResources.lean b/Ix/Compiler/IxIR2/ReuseResources.lean
new file mode 100644
index 000000000..35136a0ec
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseResources.lean
@@ -0,0 +1,40 @@
+import Ix.Compiler.IxIR2.Resources
+import Ix.Compiler.IxIR2.ReuseSim
+
+/-! Shared-result reclamation transported through the existing semantic heap
+relation. Allocation accounting is proved separately from actual physical
+execution; it is not added to `StableHeapRel`. -/
+
+namespace Ix.Compiler.IxIR2.ReuseSim
+
+open Eval
+
+/-- Releasing related roots at the same traversal budget preserves successful
+reclamation across exact contents and allocation-history isomorphisms. -/
+theorem StableHeapRel.sharedReclamation {baseline rewritten released : Store}
+    {locRel : Nat → Nat → Prop} {baselineValue rewrittenValue : RVal}
+    (heaps : StableHeapRel baseline rewritten locRel)
+    (values : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue)
+    {fuel remaining : Nat}
+    (release : releaseShared fuel baseline baselineValue = .ok (released, remaining))
+    (empty : released.live = 0) :
+    ∃ output,
+      releaseShared fuel rewritten rewrittenValue = .ok (output, remaining) ∧
+      output.live = 0 := by
+  cases heaps with
+  | contents same =>
+      have equal : baselineValue = rewrittenValue := by
+        cases values with
+        | loc related => exact congrArg IxIR1.RVal.loc related
+        | lit => rfl
+        | erased => rfl
+      subst rewrittenValue
+      obtain ⟨output, run, outputHeaps⟩ := same.releaseShared release
+      refine ⟨output, run, ?_⟩
+      simpa only [Store.live_eq_countP, ← outputHeaps.nodes] using empty
+  | isomorphic iso =>
+      obtain ⟨output, outputHeap, run, relation⟩ :=
+        releaseSharedWork_historyIso_sameFuel iso.symm (.cons values .nil) release
+      exact ⟨output, run, outputHeap.right_live_eq_zero empty⟩
+
+end Ix.Compiler.IxIR2.ReuseSim
diff --git a/Ix/Compiler/IxIR2/ReuseSim.lean b/Ix/Compiler/IxIR2/ReuseSim.lean
new file mode 100644
index 000000000..845ee1ba8
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseSim.lean
@@ -0,0 +1,19042 @@
+import Ix.Compiler.IxIR1.EvalIso
+import Ix.Compiler.IxIR2.Reuse
+
+/-!
+# Semantic seam for dynamic shared reuse
+
+This module connects the concrete IxIR₂ hot-reset stores to the exact
+ownership and live-heap isomorphism developed for IxIR₁ heaps.  The local
+theorem is deliberately independent of a particular CFG: physical
+reservation/reuse is related to logical shallow-free/fresh-allocation for an
+arbitrary shared constructor replacement and arbitrary surrounding roots.
+-/
+
+namespace Ix.Compiler.IxIR2.ReuseSim
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.IxIR2.Reuse
+  (Shape translateRegister? translateAtom? translateAtoms? branchValues)
+
+/-! ## Operand-translation semantics -/
+
+/-- Runtime value files agree at every register mapping accepted by the reuse
+planner.  Registers deliberately rejected by `translateRegister?` need no
+target counterpart. -/
+def ValuesRel (shape : Shape) (source target : Array RVal) : Prop :=
+  ∀ sourceId targetId,
+    translateRegister? shape sourceId = some targetId →
+    source[sourceId]? = target[targetId]?
+
+/-- Every successful register translation is either the distinguished
+allocation-result mapping at both file ends, or lies strictly before both
+ends. -/
+theorem translateRegister?_range {shape : Shape} {sourceId targetId : Nat}
+    (sourceBound : shape.source < shape.parameterCount)
+    (translated : translateRegister? shape sourceId = some targetId) :
+    (sourceId = shape.parameterCount + 2 * shape.fieldCount ∧
+      targetId = shape.fieldCount + (shape.parameterCount - 1)) ∨
+    (sourceId < shape.parameterCount + 2 * shape.fieldCount ∧
+      targetId < shape.fieldCount + (shape.parameterCount - 1)) := by
+  have parameterPositive : 0 < shape.parameterCount :=
+    Nat.lt_of_le_of_lt (Nat.zero_le shape.source) sourceBound
+  unfold translateRegister? at translated
+  split at translated
+  · have sourceParameter : sourceId < shape.parameterCount := by assumption
+    split at translated
+    · cases translated
+    · split at translated
+      · simp only [Option.some.injEq] at translated
+        subst targetId
+        have beforeSource : sourceId < shape.source := by assumption
+        have targetBound : sourceId < shape.parameterCount - 1 :=
+          Nat.lt_of_lt_of_le beforeSource
+            (Nat.le_sub_one_of_lt sourceBound)
+        right
+        constructor
+        · omega
+        · exact Nat.add_lt_add_left targetBound shape.fieldCount
+      · simp only [Option.some.injEq] at translated
+        subst targetId
+        have notBefore : ¬sourceId < shape.source := by assumption
+        have notSourceBool : ¬(sourceId == shape.source) = true := by
+          assumption
+        have sourceNe : sourceId ≠ shape.source := by
+          intro same
+          subst sourceId
+          exact notSourceBool (by simp)
+        have sourceLt : shape.source < sourceId :=
+          Nat.lt_of_le_of_ne (Nat.le_of_not_gt notBefore) sourceNe.symm
+        have oneLe : 1 ≤ sourceId :=
+          Nat.succ_le_iff.mpr
+            (Nat.lt_of_le_of_lt (Nat.zero_le shape.source) sourceLt)
+        have targetBound : sourceId - 1 < shape.parameterCount - 1 :=
+          Nat.sub_lt_sub_right oneLe sourceParameter
+        right
+        constructor
+        · omega
+        · exact Nat.add_lt_add_left targetBound shape.fieldCount
+  · split at translated
+    · cases translated
+    · split at translated
+      · have retainedEnd :
+            sourceId < shape.parameterCount + 2 * shape.fieldCount := by
+          assumption
+        have retainedStart :
+            ¬sourceId < shape.parameterCount + shape.fieldCount := by
+          assumption
+        simp only [Option.some.injEq] at translated
+        subst targetId
+        right
+        constructor
+        · exact retainedEnd
+        · have start : shape.parameterCount + shape.fieldCount ≤ sourceId :=
+            Nat.le_of_not_gt retainedStart
+          have fieldIndex : sourceId -
+              (shape.parameterCount + shape.fieldCount) <
+                shape.fieldCount := by
+            apply (Nat.sub_lt_iff_lt_add start).2
+            rw [Nat.two_mul] at retainedEnd
+            simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+              retainedEnd
+          exact Nat.lt_of_lt_of_le fieldIndex
+            (Nat.le_add_right shape.fieldCount (shape.parameterCount - 1))
+      · split at translated
+        · have sourceEq : sourceId =
+              shape.parameterCount + 2 * shape.fieldCount :=
+            beq_iff_eq.mp (by assumption)
+          simp only [Option.some.injEq] at translated
+          subst targetId
+          exact Or.inl ⟨sourceEq, rfl⟩
+        · cases translated
+
+/-- Appending the same freshly allocated value to both register files extends
+the relation across the planner's distinguished result-register mapping. -/
+theorem ValuesRel.pushResult {shape : Shape} {source target : Array RVal}
+    {result : RVal} (related : ValuesRel shape source target)
+    (sourceSize : source.size =
+      shape.parameterCount + 2 * shape.fieldCount)
+    (targetSize : target.size =
+      shape.fieldCount + (shape.parameterCount - 1))
+    (sourceBound : shape.source < shape.parameterCount) :
+    ValuesRel shape (source.push result) (target.push result) := by
+  intro sourceId targetId translated
+  rcases translateRegister?_range sourceBound translated with
+    ⟨sourceEnd, targetEnd⟩ | ⟨sourceBefore, targetBefore⟩
+  · subst sourceId
+    subst targetId
+    rw [← sourceSize, ← targetSize]
+    simp
+  · have sourceNe : sourceId ≠ source.size := by
+      rw [sourceSize]
+      exact Nat.ne_of_lt sourceBefore
+    have targetNe : targetId ≠ target.size := by
+      rw [targetSize]
+      exact Nat.ne_of_lt targetBefore
+    simpa [Array.getElem?_push, sourceNe, targetNe] using
+      related sourceId targetId translated
+
+/-- Runtime register file after the recognized baseline fetch/retain prefix. -/
+def baselinePrefixValues (parameters fields : Array RVal) : Array RVal :=
+  parameters ++ fields ++ fields
+
+/-- Runtime register file entering either generated credit helper: reset fields
+first, followed by the original parameters with the consumed source removed. -/
+def helperEntryValues (source : ValueId) (parameters fields : Array RVal) :
+    Array RVal :=
+  fields ++ (parameters.toList.eraseIdx source).toArray
+
+/-- The planner's register translation exactly relates the concrete baseline
+prefix file to the concrete helper-entry file.  This includes the not-yet-
+allocated result register: both sides are out of bounds at its mapped index. -/
+theorem valuesRel_helperEntry {shape : Shape}
+    {parameters fields : Array RVal}
+    (parameterCount : parameters.size = shape.parameterCount)
+    (fieldCount : fields.size = shape.fieldCount)
+    (sourceBound : shape.source < shape.parameterCount) :
+    ValuesRel shape (baselinePrefixValues parameters fields)
+      (helperEntryValues shape.source parameters fields) := by
+  intro sourceId targetId translated
+  unfold translateRegister? at translated
+  split at translated
+  · have sourceParameter : sourceId < shape.parameterCount := by assumption
+    split at translated
+    · cases translated
+    · have notSourceBool : ¬(sourceId == shape.source) = true := by assumption
+      split at translated
+      · have beforeSource : sourceId < shape.source := by assumption
+        simp only [Option.some.injEq] at translated
+        subst targetId
+        simp [baselinePrefixValues, helperEntryValues,
+          Array.getElem?_append, parameterCount, fieldCount,
+          List.getElem?_eraseIdx, sourceParameter, beforeSource]
+      · have notBeforeSource : ¬sourceId < shape.source := by assumption
+        have sourceNe : sourceId ≠ shape.source := by
+          intro same
+          subst sourceId
+          exact notSourceBool (by simp)
+        have sourceLt : shape.source < sourceId :=
+          Nat.lt_of_le_of_ne (Nat.le_of_not_gt notBeforeSource) sourceNe.symm
+        simp only [Option.some.injEq] at translated
+        subst targetId
+        have eraseSide : ¬sourceId - 1 < shape.source := by
+          rw [← Nat.pred_eq_sub_one]
+          exact Nat.not_lt_of_ge (Nat.le_pred_of_lt sourceLt)
+        have oneLe : 1 ≤ sourceId :=
+          Nat.succ_le_iff.mpr
+            (Nat.lt_of_le_of_lt (Nat.zero_le shape.source) sourceLt)
+        have indexEq : sourceId - 1 + 1 = sourceId :=
+          Nat.sub_add_cancel oneLe
+        simp [baselinePrefixValues, helperEntryValues,
+          Array.getElem?_append, parameterCount, fieldCount,
+          List.getElem?_eraseIdx, sourceParameter, eraseSide, indexEq]
+  · have afterParameters : ¬sourceId < shape.parameterCount := by assumption
+    split at translated
+    · cases translated
+    · have afterFetched :
+          ¬sourceId < shape.parameterCount + shape.fieldCount := by
+        assumption
+      split at translated
+      · have beforeRetainedEnd :
+            sourceId < shape.parameterCount + 2 * shape.fieldCount := by
+          assumption
+        simp only [Option.some.injEq] at translated
+        subst targetId
+        have retainedStart :
+            shape.parameterCount + shape.fieldCount ≤ sourceId :=
+          Nat.le_of_not_gt afterFetched
+        have fieldIndexShape :
+            sourceId - (shape.parameterCount + shape.fieldCount) <
+              shape.fieldCount := by
+          apply (Nat.sub_lt_iff_lt_add retainedStart).2
+          rw [Nat.two_mul] at beforeRetainedEnd
+          simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+            beforeRetainedEnd
+        have sourceMiddle :
+            ¬sourceId - shape.parameterCount < shape.fieldCount := by
+          intro middle
+          have parameterLe : shape.parameterCount ≤ sourceId :=
+            Nat.le_trans (Nat.le_add_right _ _) retainedStart
+          have upper := (Nat.sub_lt_iff_lt_add parameterLe).1 middle
+          omega
+        have indexEq :
+            sourceId - shape.parameterCount - shape.fieldCount =
+              sourceId - (shape.parameterCount + shape.fieldCount) :=
+          (Nat.sub_add_eq sourceId shape.parameterCount
+            shape.fieldCount).symm
+        simp [baselinePrefixValues, helperEntryValues,
+          Array.getElem?_append, parameterCount, fieldCount,
+          afterParameters, sourceMiddle, fieldIndexShape, indexEq]
+      · split at translated
+        · have sourceEq : sourceId =
+              shape.parameterCount + 2 * shape.fieldCount :=
+            beq_iff_eq.mp (by assumption)
+          simp only [Option.some.injEq] at translated
+          subst targetId
+          subst sourceId
+          have sourceNone :
+              (baselinePrefixValues parameters fields)[
+                shape.parameterCount + 2 * shape.fieldCount]? = none := by
+            apply Array.getElem?_eq_none_iff.mpr
+            simp [baselinePrefixValues, parameterCount, fieldCount,
+              Nat.two_mul]
+          have targetNone :
+              (helperEntryValues shape.source parameters fields)[
+                shape.fieldCount + (shape.parameterCount - 1)]? = none := by
+            apply Array.getElem?_eq_none_iff.mpr
+            simp [helperEntryValues, List.length_eraseIdx, parameterCount,
+              fieldCount, sourceBound]
+          rw [sourceNone, targetNone]
+        · cases translated
+
+/-- After both allocation instructions append the same result value, the
+canonical baseline/helper register files remain related for tail operands. -/
+theorem valuesRel_afterAllocation {shape : Shape}
+    {parameters fields : Array RVal} {result : RVal}
+    (parameterCount : parameters.size = shape.parameterCount)
+    (fieldCount : fields.size = shape.fieldCount)
+    (sourceBound : shape.source < shape.parameterCount) :
+    ValuesRel shape
+      ((baselinePrefixValues parameters fields).push result)
+      ((helperEntryValues shape.source parameters fields).push result) := by
+  apply ValuesRel.pushResult
+    (valuesRel_helperEntry parameterCount fieldCount sourceBound)
+  · simp [baselinePrefixValues, parameterCount, fieldCount, Nat.two_mul]
+  · simp [helperEntryValues, List.length_eraseIdx, parameterCount,
+      fieldCount, sourceBound]
+  · exact sourceBound
+
+/-- The concrete helper-entry value vector has exactly the ABI length emitted
+for either helper block. -/
+theorem helperEntryValues_size {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Reuse.Site limits context block)
+    {parameters fields : Array RVal}
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount) :
+    (helperEntryValues site.shape.source parameters fields).size =
+      site.candidate.helperValueParams.size := by
+  rw [site.candidateVectors.1]
+  simp [helperEntryValues, List.length_eraseIdx, parameterCount, fieldCount,
+    site.fits.parameterCount]
+
+private theorem eraseIdx_map {α β : Type} (f : α → β) :
+    ∀ (values : List α) (index : Nat),
+      (values.map f).eraseIdx index = (values.eraseIdx index).map f := by
+  intro values
+  induction values with
+  | nil => intro index; cases index <;> rfl
+  | cons value values ih =>
+      intro index
+      cases index with
+      | zero => rfl
+      | succ index =>
+          simp only [List.map_cons, List.eraseIdx_cons_succ]
+          rw [ih]
+
+private theorem filter_range_ne_eq_eraseIdx (count source : Nat)
+    (bound : source < count) :
+    (List.range count).filter (fun value => value != source) =
+      (List.range count).eraseIdx source := by
+  induction count generalizing source with
+  | zero => omega
+  | succ count ih =>
+      cases source with
+      | zero =>
+          rw [show count + 1 = Nat.succ count by omega,
+            List.range_succ_eq_map]
+          simp only [List.filter_cons, List.filter_map, List.eraseIdx_zero,
+            List.tail_cons]
+          have keepAll :
+              List.filter ((fun value => value != 0) ∘ Nat.succ)
+                  (List.range count) = List.range count := by
+            apply List.filter_eq_self.mpr
+            intro value member
+            simp [Function.comp_apply]
+          rw [keepAll]
+          simp
+      | succ source =>
+          have tailBound : source < count := by omega
+          rw [show count + 1 = Nat.succ count by omega,
+            List.range_succ_eq_map]
+          simp only [List.filter_cons, bne_iff_ne, ne_eq,
+            Nat.zero_ne_add_one, not_false_eq_true, ↓reduceIte,
+            List.filter_map, List.eraseIdx_cons_succ]
+          rw [eraseIdx_map]
+          have predicate :
+              ((fun value => value != source + 1) ∘ Nat.succ) =
+                (fun value => value != source) := by
+            funext value
+            simp [Function.comp_apply]
+          rw [predicate]
+          rw [ih source tailBound]
+
+private theorem mapM_eq_ok_of_getElem {ε α β : Type}
+    (f : α → Except ε β) :
+    ∀ (input : List α) (output : List β),
+      input.length = output.length →
+      (∀ (index : Nat) (source : α) (target : β),
+        input[index]? = some source →
+        output[index]? = some target →
+        f source = .ok target) →
+      input.mapM f = .ok output := by
+  intro input
+  induction input with
+  | nil =>
+      intro output lengths pointwise
+      cases output with
+      | nil => rfl
+      | cons target output => simp at lengths
+  | cons source input ih =>
+      intro output lengths pointwise
+      cases output with
+      | nil => simp at lengths
+      | cons target output =>
+          have head := pointwise 0 source target (by rfl) (by rfl)
+          have tailPointwise : ∀ (index : Nat) (tailSource : α)
+              (tailTarget : β),
+              input[index]? = some tailSource →
+              output[index]? = some tailTarget →
+              f tailSource = .ok tailTarget := by
+            intro index tailSource tailTarget sourceAt targetAt
+            exact pointwise (index + 1) tailSource tailTarget
+              (by simpa using sourceAt) (by simpa using targetAt)
+          simp only [List.length_cons] at lengths
+          simp [List.mapM_cons, head, ih output (Nat.succ.inj lengths)
+            tailPointwise]
+          rfl
+
+private theorem resolveFold_of_mapM {values : Array RVal} :
+    ∀ {atoms : List Atom} {output : List RVal},
+      atoms.mapM (resolveAtom values) = .ok output →
+      ∀ initial : Array RVal,
+        atoms.foldlM (fun current atom => do
+          return current.push (← resolveAtom values atom)) initial =
+            .ok (initial ++ output.toArray) := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro output resolved initial
+      change Except.ok [] = Except.ok output at resolved
+      injection resolved with outputEq
+      subst output
+      simp [List.foldlM_nil, pure, Except.pure]
+  | cons atom atoms ih =>
+      intro output resolved initial
+      cases headAt : resolveAtom values atom with
+      | error error =>
+          simp [List.mapM_cons, headAt, bind, Except.bind] at resolved
+      | ok value =>
+          cases tailAt : atoms.mapM (resolveAtom values) with
+          | error error =>
+              simp [List.mapM_cons, headAt, tailAt, bind, Except.bind] at resolved
+          | ok tail =>
+              simp [List.mapM_cons, headAt, tailAt, bind, Except.bind,
+                pure, Except.pure] at resolved
+              subst output
+              rw [List.foldlM_cons]
+              simp only [headAt, bind, Except.bind, pure, Except.pure]
+              change atoms.foldlM (fun current atom => do
+                return current.push (← resolveAtom values atom))
+                  (initial.push value) =
+                    .ok (initial ++ (value :: tail).toArray)
+              rw [ih tailAt]
+              congr 1
+              apply Array.ext'
+              simp
+
+private theorem resolveAtoms_of_mapM {values : Array RVal}
+    {atoms : Array Atom} {output : List RVal}
+    (resolved : atoms.toList.mapM (resolveAtom values) = .ok output) :
+    resolveAtoms values atoms = .ok output.toArray := by
+  unfold resolveAtoms
+  rw [← Array.foldlM_toList]
+  simpa using resolveFold_of_mapM resolved #[]
+
+private theorem resolveAtom_reg_of_getElem {values : Array RVal}
+    {index : Nat} {value : RVal}
+    (found : values[index]? = some value) :
+    resolveAtom values (.reg index) = .ok value := by
+  simp [resolveAtom, found]
+
+/-- The generated branch operand vector resolves to exactly the canonical
+helper-entry register file.  This is the runtime half of the reset-to-helper
+CFG transfer and holds for any constructor arity and source parameter slot. -/
+theorem branchValues_resolve {shape : Shape}
+    {parameters fields : Array RVal}
+    (parameterCount : parameters.size = shape.parameterCount)
+    (fieldCount : fields.size = shape.fieldCount)
+    (sourceBound : shape.source < shape.parameterCount) :
+    resolveAtoms (parameters ++ fields) (branchValues shape) =
+      .ok (helperEntryValues shape.source parameters fields) := by
+  let fieldAtoms : List Atom :=
+    (List.range shape.fieldCount).map fun field =>
+      .reg (shape.parameterCount + field)
+  let parameterAtoms : List Atom :=
+    ((List.range shape.parameterCount).filter fun value =>
+      value != shape.source).map fun value => .reg value
+  have fieldsMapped :
+      fieldAtoms.mapM (resolveAtom (parameters ++ fields)) =
+        .ok fields.toList := by
+    apply mapM_eq_ok_of_getElem
+    · simp [fieldAtoms, fieldCount]
+    · intro index atom value atomAt valueAt
+      have indexBound : index < shape.fieldCount := by
+        have := (List.getElem?_eq_some_iff.mp atomAt).choose
+        simpa [fieldAtoms] using this
+      simp only [fieldAtoms, List.getElem?_map,
+        List.getElem?_range indexBound, Option.map_some,
+        Option.some.injEq] at atomAt
+      subst atom
+      have fieldAt : fields[index]? = some value := by
+        simpa only [Array.getElem?_toList] using valueAt
+      have afterParameters :
+          ¬shape.parameterCount + index < parameters.size := by
+        rw [parameterCount]
+        omega
+      have indexEq : shape.parameterCount + index - parameters.size =
+          index := by
+        rw [parameterCount]
+        omega
+      apply resolveAtom_reg_of_getElem
+      rw [Array.getElem?_append, if_neg afterParameters, indexEq]
+      exact fieldAt
+  have parametersMapped :
+      parameterAtoms.mapM (resolveAtom (parameters ++ fields)) =
+        .ok (parameters.toList.eraseIdx shape.source) := by
+    unfold parameterAtoms
+    rw [filter_range_ne_eq_eraseIdx _ _ sourceBound]
+    apply mapM_eq_ok_of_getElem
+    · simp [List.length_eraseIdx, sourceBound, parameterCount]
+    · intro index atom value atomAt valueAt
+      have erasedBound :
+          index < (parameters.toList.eraseIdx shape.source).length :=
+        (List.getElem?_eq_some_iff.mp valueAt).choose
+      rw [List.getElem?_map, List.getElem?_eraseIdx] at atomAt
+      rw [List.getElem?_eraseIdx] at valueAt
+      split at atomAt <;> split at valueAt
+      · rename_i beforeSource _
+        have rangeBound : index < shape.parameterCount :=
+          Nat.lt_trans beforeSource sourceBound
+        rw [List.getElem?_range rangeBound] at atomAt
+        simp only [Option.map_some, Option.some.injEq] at atomAt
+        subst atom
+        have parameterAt : parameters[index]? = some value := by
+          simpa only [Array.getElem?_toList] using valueAt
+        have parameterIndex : index < parameters.size := by
+          rw [parameterCount]
+          exact rangeBound
+        apply resolveAtom_reg_of_getElem
+        rw [Array.getElem?_append, if_pos parameterIndex]
+        exact parameterAt
+      · rename_i beforeSource notBeforeSource
+        omega
+      · rename_i notBeforeSource beforeSource
+        omega
+      · rename_i notBeforeSource _
+        have rangeBound : index + 1 < shape.parameterCount := by
+          simp [List.length_eraseIdx, sourceBound, parameterCount] at erasedBound
+          omega
+        rw [List.getElem?_range rangeBound] at atomAt
+        simp only [Option.map_some, Option.some.injEq] at atomAt
+        subst atom
+        have parameterAt : parameters[index + 1]? = some value := by
+          simpa only [Array.getElem?_toList] using valueAt
+        have parameterIndex : index + 1 < parameters.size := by
+          rw [parameterCount]
+          exact rangeBound
+        apply resolveAtom_reg_of_getElem
+        rw [Array.getElem?_append, if_pos parameterIndex]
+        exact parameterAt
+  have mapped :
+      (fieldAtoms ++ parameterAtoms).mapM
+          (resolveAtom (parameters ++ fields)) =
+        .ok (fields.toList ++ parameters.toList.eraseIdx shape.source) := by
+    simp [List.mapM_append, fieldsMapped, parametersMapped, bind,
+      Except.bind, pure, Except.pure]
+  have resolved := resolveAtoms_of_mapM mapped
+  have atomsEq : (fieldAtoms ++ parameterAtoms).toArray =
+      branchValues shape := by
+    simp [branchValues, fieldAtoms, parameterAtoms]
+  have outputEq :
+      (fields.toList ++ parameters.toList.eraseIdx shape.source).toArray =
+        helperEntryValues shape.source parameters fields := by
+    apply Array.ext'
+    simp [helperEntryValues]
+  change resolveAtoms (parameters ++ fields)
+      (fieldAtoms ++ parameterAtoms).toArray =
+        .ok (fields.toList ++
+          parameters.toList.eraseIdx shape.source).toArray at resolved
+  rw [atomsEq, outputEq] at resolved
+  exact resolved
+
+/-- A reset successor transfers its one linear credit and the canonical
+branch value vector into either generated helper block. -/
+theorem helperEdgeTransfer {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Reuse.Site limits context block)
+    {frame : Frame} {target : BlockId} {capability : CreditCap}
+    {credit : Credit} {parameters fields : Array RVal}
+    (frameValues : frame.values = parameters ++ fields)
+    (frameCredits : frame.credits = #[some credit])
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (blockAt : frame.definition.blocks[target]? =
+      some (Reuse.creditBlock site.candidate capability)) :
+    EdgeTransfer frame
+      { target
+        values := site.candidate.resetValues
+        credits := #[0] }
+      #[]
+      { frame with
+        block := target
+        pc := 0
+        values := helperEntryValues site.shape.source parameters fields
+        credits := #[some credit] } := by
+  let after : Frame :=
+    { frame with credits := frame.credits.setIfInBounds 0 none }
+  have creditAt : frame.credits[0]? = some (some credit) := by
+    simp [frameCredits]
+  have taken : CreditTake frame 0 after credit := by
+    simpa [after] using CreditTake.of_lookup
+      (CreditLookup.of_getElem creditAt)
+  have takenMany : CreditTakeMany frame #[0] after #[credit] :=
+    CreditTakeMany.single taken
+  have afterCredits : after.credits = #[none] := by
+    simp [after, frameCredits, Array.setIfInBounds]
+  have cleared : NoLiveCredits after := by
+    simp [NoLiveCredits, afterCredits]
+  have resolved : resolveAtoms frame.values site.candidate.resetValues =
+      .ok (helperEntryValues site.shape.source parameters fields) := by
+    rw [frameValues, site.candidateVectors.2]
+    exact branchValues_resolve parameterCount fieldCount site.fits.sourceBound
+  have transferred := EdgeTransfer.of_parts
+    (frame := frame) (after := after)
+    (edge := { target, values := site.candidate.resetValues, credits := #[0] })
+    (implicitValues := #[])
+    (values := helperEntryValues site.shape.source parameters fields)
+    (credits := #[credit])
+    (block := Reuse.creditBlock site.candidate capability)
+    resolved takenMany cleared blockAt
+    (by simpa [Reuse.creditBlock] using
+      helperEntryValues_size site parameterCount fieldCount)
+    (by simp [Reuse.creditBlock])
+  simpa [after] using transferred
+
+/-- A unit-refcount logical reset and its present-credit branch reach the
+required helper in exactly two machine steps.  All operand reordering and
+linear credit transfer are discharged from the accepted site. -/
+theorem hotLogicalControlPrefix {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields : Array RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (resolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (unitRC : box.rc = 1) :
+    Steps context .logical 2 machine
+      { machine with
+        store := ((machine.store.tickResetAttempt).kill location).tickHotReset
+        control := .running
+          { definition
+            block := hotId
+            pc := 0
+            values := helperEntryValues site.shape.source parameters fields
+            credits := #[some
+              { layout := sourceSchema.layout
+                presence := .present none }] }
+          stack } := by
+  let initial : Frame :=
+    { definition
+      block := resetId
+      pc := 0
+      values := parameters
+      credits := #[] }
+  let credit : Credit :=
+    { layout := sourceSchema.layout, presence := .present none }
+  let middle : Frame :=
+    { initial with
+      pc := 1
+      values := parameters ++ fields
+      credits := #[some credit] }
+  let target : Frame :=
+    { definition
+      block := hotId
+      pc := 0
+      values := helperEntryValues site.shape.source parameters fields
+      credits := #[some credit] }
+  have resetStep : Step context .logical machine
+      { machine with
+        store := ((machine.store.tickResetAttempt).kill location).tickHotReset
+        control := .running middle stack } := by
+    have step := Step.resetSharedLogicalHot
+      (context := context) (machine := machine)
+      (frame := initial) (stack := stack)
+      (block := Reuse.resetBlock site.candidate hotId coldId)
+      (target := .reg site.shape.source)
+      (cid := site.shape.sourceConstructor)
+      (schema := sourceSchema) (location := location) (box := box)
+      (fields := fields)
+      (by simpa [initial] using control) resetAt
+      (by simp [initial, site.resetBlock_eq])
+      (by simp [initial, site.resetBlock_eq]) schemaAt
+      (by simpa [initial] using resolved) viewed unitRC
+    simpa [initial, middle, credit] using step
+  have transferred : EdgeTransfer middle
+      { target := hotId
+        values := site.candidate.resetValues
+        credits := #[0] }
+      #[] target := by
+    simpa [middle, target, credit] using
+      helperEdgeTransfer site (frame := middle) (target := hotId)
+        (capability := .required site.candidate.layout) (credit := credit)
+        (parameters := parameters) (fields := fields)
+        (by simp [middle]) (by simp [middle]) parameterCount
+        fieldCount (by simpa [middle, initial] using hotAt)
+  have branchStep : Step context .logical
+      { machine with
+        store := ((machine.store.tickResetAttempt).kill location).tickHotReset
+        control := .running middle stack }
+      { machine with
+        store := ((machine.store.tickResetAttempt).kill location).tickHotReset
+        control := .running target stack } := by
+    apply Step.branchCreditPresent
+      (frame := middle) (target := target)
+      (block := Reuse.resetBlock site.candidate hotId coldId)
+      (creditId := 0)
+      (credit := credit)
+      (someEdge :=
+        { target := hotId
+          values := site.candidate.resetValues
+          credits := #[0] })
+      (noneEdge :=
+        { target := coldId
+          values := site.candidate.resetValues
+          credits := #[0] })
+    · rfl
+    · simpa [middle, initial] using resetAt
+    · simp [middle, Reuse.resetBlock]
+    · rfl
+    · apply CreditLookup.of_getElem
+      simp [middle, credit]
+    · rfl
+    · exact transferred
+  have first := resetStep.toSteps (by simpa [initial] using control)
+  have second := branchStep.toSteps (by rfl)
+  simpa [target, credit] using first.trans second
+
+/-- The physical unit-refcount arm reaches the same required helper/value
+file in two steps while its credit carries the reserved source location. -/
+theorem hotPhysicalControlPrefix {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields : Array RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (resolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (unitRC : box.rc = 1) :
+    Steps context .physical 2 machine
+      { machine with
+        store :=
+          ((machine.store.tickResetAttempt).reserve location).tickHotReset
+        control := .running
+          { definition
+            block := hotId
+            pc := 0
+            values := helperEntryValues site.shape.source parameters fields
+            credits := #[some
+              { layout := sourceSchema.layout
+                presence := .present (some location) }] }
+          stack } := by
+  let initial : Frame :=
+    { definition
+      block := resetId
+      pc := 0
+      values := parameters
+      credits := #[] }
+  let credit : Credit :=
+    { layout := sourceSchema.layout, presence := .present (some location) }
+  let middle : Frame :=
+    { initial with
+      pc := 1
+      values := parameters ++ fields
+      credits := #[some credit] }
+  let target : Frame :=
+    { definition
+      block := hotId
+      pc := 0
+      values := helperEntryValues site.shape.source parameters fields
+      credits := #[some credit] }
+  have resetStep : Step context .physical machine
+      { machine with
+        store :=
+          ((machine.store.tickResetAttempt).reserve location).tickHotReset
+        control := .running middle stack } := by
+    have step := Step.resetSharedPhysicalHot
+      (context := context) (machine := machine)
+      (frame := initial) (stack := stack)
+      (block := Reuse.resetBlock site.candidate hotId coldId)
+      (target := .reg site.shape.source)
+      (cid := site.shape.sourceConstructor)
+      (schema := sourceSchema) (location := location) (box := box)
+      (fields := fields)
+      (by simpa [initial] using control) resetAt
+      (by simp [initial, site.resetBlock_eq])
+      (by simp [initial, site.resetBlock_eq]) schemaAt
+      (by simpa [initial] using resolved) viewed unitRC
+    simpa [initial, middle, credit] using step
+  have transferred : EdgeTransfer middle
+      { target := hotId
+        values := site.candidate.resetValues
+        credits := #[0] }
+      #[] target := by
+    simpa [middle, target, credit] using
+      helperEdgeTransfer site (frame := middle) (target := hotId)
+        (capability := .required site.candidate.layout) (credit := credit)
+        (parameters := parameters) (fields := fields)
+        (by simp [middle]) (by simp [middle]) parameterCount
+        fieldCount (by simpa [middle, initial] using hotAt)
+  have branchStep : Step context .physical
+      { machine with
+        store :=
+          ((machine.store.tickResetAttempt).reserve location).tickHotReset
+        control := .running middle stack }
+      { machine with
+        store :=
+          ((machine.store.tickResetAttempt).reserve location).tickHotReset
+        control := .running target stack } := by
+    apply Step.branchCreditPresent
+      (frame := middle) (target := target)
+      (block := Reuse.resetBlock site.candidate hotId coldId)
+      (creditId := 0)
+      (credit := credit)
+      (someEdge :=
+        { target := hotId
+          values := site.candidate.resetValues
+          credits := #[0] })
+      (noneEdge :=
+        { target := coldId
+          values := site.candidate.resetValues
+          credits := #[0] })
+    · rfl
+    · simpa [middle, initial] using resetAt
+    · simp [middle, Reuse.resetBlock]
+    · rfl
+    · apply CreditLookup.of_getElem
+      simp [middle, credit]
+    · rfl
+    · exact transferred
+  have first := resetStep.toSteps (by simpa [initial] using control)
+  have second := branchStep.toSteps (by rfl)
+  simpa [target, credit] using first.trans second
+
+/-- The multiply-referenced reset arm reaches the optional-credit helper in
+two steps under either interpretation.  The evaluator's exact retained store
+is threaded unchanged through the CFG branch. -/
+theorem coldControlPrefix {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {resetId hotId coldId : BlockId}
+    {parameters fields : Array RVal} {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema : CtorSchema} {machine : Machine} {store : Store}
+    {stack : List Continuation}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (coldAt : definition.blocks[coldId]? = some
+      (Reuse.creditBlock site.candidate
+        (.optional site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (resolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (shared : 1 < box.rc)
+    (retained : RetainSharedMany
+      ((((machine.store.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+      fields store) :
+    Steps context interpretation 2 machine
+      { machine with
+        store
+        control := .running
+          { definition
+            block := coldId
+            pc := 0
+            values := helperEntryValues site.shape.source parameters fields
+            credits := #[some
+              { layout := sourceSchema.layout
+                presence := .absent }] }
+          stack } := by
+  let initial : Frame :=
+    { definition
+      block := resetId
+      pc := 0
+      values := parameters
+      credits := #[] }
+  let credit : Credit :=
+    { layout := sourceSchema.layout, presence := .absent }
+  let middle : Frame :=
+    { initial with
+      pc := 1
+      values := parameters ++ fields
+      credits := #[some credit] }
+  let target : Frame :=
+    { definition
+      block := coldId
+      pc := 0
+      values := helperEntryValues site.shape.source parameters fields
+      credits := #[some credit] }
+  have resetStep : Step context interpretation machine
+      { machine with store, control := .running middle stack } := by
+    have step := Step.resetSharedCold
+      (context := context) (interpretation := interpretation)
+      (machine := machine) (frame := initial) (stack := stack)
+      (block := Reuse.resetBlock site.candidate hotId coldId)
+      (target := .reg site.shape.source)
+      (cid := site.shape.sourceConstructor)
+      (schema := sourceSchema) (location := location) (box := box)
+      (fields := fields) (store := store)
+      (by simpa [initial] using control) resetAt
+      (by simp [initial, site.resetBlock_eq])
+      (by simp [initial, site.resetBlock_eq]) schemaAt
+      (by simpa [initial] using resolved) viewed shared retained
+    simpa [initial, middle, credit] using step
+  have transferred : EdgeTransfer middle
+      { target := coldId
+        values := site.candidate.resetValues
+        credits := #[0] }
+      #[] target := by
+    simpa [middle, target, credit] using
+      helperEdgeTransfer site (frame := middle) (target := coldId)
+        (capability := .optional site.candidate.layout) (credit := credit)
+        (parameters := parameters) (fields := fields)
+        (by simp [middle]) (by simp [middle]) parameterCount
+        fieldCount (by simpa [middle, initial] using coldAt)
+  have branchStep : Step context interpretation
+      { machine with store, control := .running middle stack }
+      { machine with store, control := .running target stack } := by
+    apply Step.branchCreditAbsent
+      (frame := middle) (target := target)
+      (block := Reuse.resetBlock site.candidate hotId coldId)
+      (creditId := 0)
+      (credit := credit)
+      (someEdge :=
+        { target := hotId
+          values := site.candidate.resetValues
+          credits := #[0] })
+      (noneEdge :=
+        { target := coldId
+          values := site.candidate.resetValues
+          credits := #[0] })
+    · rfl
+    · simpa [middle, initial] using resetAt
+    · simp [middle, Reuse.resetBlock]
+    · rfl
+    · apply CreditLookup.of_getElem
+      simp [middle, credit]
+    · rfl
+    · exact transferred
+  have first := resetStep.toSteps (by simpa [initial] using control)
+  have second := branchStep.toSteps (by rfl)
+  simpa [target, credit] using first.trans second
+
+/-- Successful resolution of a translated atom returns the same runtime
+value.  The premise is intentionally success-directed: missing source and
+target registers carry register-specific diagnostic strings. -/
+theorem resolveAtom_translate {shape : Shape} {source target : Array RVal}
+    {atom translated : Atom} {value : RVal}
+    (related : ValuesRel shape source target)
+    (translation : translateAtom? shape atom = some translated)
+    (resolved : resolveAtom source atom = .ok value) :
+    resolveAtom target translated = .ok value := by
+  cases atom with
+  | reg sourceId =>
+      cases translatedAt : translateRegister? shape sourceId with
+      | none => simp [translateAtom?, translatedAt] at translation
+      | some targetId =>
+          simp [translateAtom?, translatedAt] at translation
+          subst translated
+          cases sourceAt : source[sourceId]? with
+          | none => simp [resolveAtom, sourceAt] at resolved
+          | some actual =>
+              simp [resolveAtom, sourceAt] at resolved
+              subst actual
+              have targetAt := related sourceId targetId translatedAt
+              rw [sourceAt] at targetAt
+              have targetAt' : target[targetId]? = some value := targetAt.symm
+              simp [resolveAtom, targetAt']
+  | lit literal =>
+      simp [translateAtom?] at translation
+      subst translated
+      simpa [resolveAtom] using resolved
+  | erased =>
+      simp [translateAtom?] at translation
+      subst translated
+      simpa [resolveAtom] using resolved
+
+private theorem resolveList_translate {shape : Shape}
+    {source target : Array RVal} (related : ValuesRel shape source target) :
+    ∀ {atoms translated : List Atom},
+      atoms.mapM (translateAtom? shape) = some translated →
+      ∀ (initial result : Array RVal),
+        atoms.foldlM (fun output atom => do
+            return output.push (← resolveAtom source atom)) initial =
+              .ok result →
+        translated.foldlM (fun output atom => do
+            return output.push (← resolveAtom target atom)) initial =
+              .ok result := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro translated translation initial result resolved
+      simp at translation
+      subst translated
+      simpa using resolved
+  | cons atom atoms ih =>
+      intro translated translation initial result resolved
+      cases atomAt : translateAtom? shape atom with
+      | none => simp [List.mapM_cons, atomAt] at translation
+      | some translatedAtom =>
+          cases tailAt : atoms.mapM (translateAtom? shape) with
+          | none => simp [List.mapM_cons, atomAt, tailAt] at translation
+          | some translatedAtoms =>
+              simp [List.mapM_cons, atomAt, tailAt] at translation
+              subst translated
+              rw [List.foldlM_cons]
+              rw [List.foldlM_cons] at resolved
+              cases sourceResolved : resolveAtom source atom with
+              | error error =>
+                  simp only [sourceResolved, bind, Except.bind] at resolved
+                  cases resolved
+              | ok value =>
+                  simp only [sourceResolved, bind, Except.bind] at resolved
+                  have targetResolved :
+                      resolveAtom target translatedAtom = .ok value :=
+                    resolveAtom_translate related atomAt sourceResolved
+                  rw [targetResolved]
+                  simp only [bind, Except.bind]
+                  apply ih tailAt (initial.push value) result
+                  exact resolved
+
+/-- Successful batch resolution is preserved by the planner's accepted atom
+translation, with both sides producing the identical value vector. -/
+theorem resolveAtoms_translate {shape : Shape}
+    {source target : Array RVal} (related : ValuesRel shape source target)
+    {atoms translated : Array Atom} {values : Array RVal}
+    (translation : translateAtoms? shape atoms = some translated)
+    (resolved : resolveAtoms source atoms = .ok values) :
+    resolveAtoms target translated = .ok values := by
+  unfold translateAtoms? at translation
+  cases mappedAt : atoms.toList.mapM (translateAtom? shape) with
+  | none => simp [mappedAt] at translation
+  | some translatedAtoms =>
+      simp [mappedAt] at translation
+      subst translated
+      unfold resolveAtoms at resolved ⊢
+      rw [← Array.foldlM_toList]
+      apply resolveList_translate related mappedAt #[] values
+      simpa only [Array.foldlM_toList] using resolved
+
+/-- The accepted-site trace turns successful baseline allocation-operand
+resolution into the exact helper-block operand resolution. -/
+theorem resolveAllocationArguments {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Reuse.Site limits context block)
+    {source target values : Array RVal}
+    (related : ValuesRel site.shape source target)
+    (resolved : resolveAtoms source site.shape.allocationArguments =
+      .ok values) :
+    resolveAtoms target site.candidate.allocationArguments = .ok values :=
+  resolveAtoms_translate related site.allocationArgumentsFound resolved
+
+/-- The same accepted-site mapping preserves the tail-call argument vector
+after baseline and helper allocation states have been related. -/
+theorem resolveTailArguments {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Reuse.Site limits context block)
+    {source target values : Array RVal}
+    (related : ValuesRel site.shape source target)
+    (resolved : resolveAtoms source site.shape.tailArguments = .ok values) :
+    resolveAtoms target site.candidate.tailArguments = .ok values :=
+  resolveAtoms_translate related site.tailArgumentsFound resolved
+
+/-- Accepted validator schemas are also the evaluator schemas whenever the
+enclosing execution context carries the checked schema table. -/
+theorem evalRuntimeSchemas {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block) {context : Eval.Context}
+    (schemas : context.schemas = validation.schemas) :
+    ∃ sourceSchema allocationSchema,
+      context.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema ∧
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema ∧
+      sourceSchema.fields =
+        Array.replicate site.shape.fieldCount .shared ∧
+      allocationSchema.fields = sourceSchema.fields ∧
+      site.candidate.layout = sourceSchema.layout ∧
+      site.candidate.layout = allocationSchema.layout := by
+  rw [schemas]
+  exact site.runtimeSchemas
+
+private theorem blocks_nonempty_of_getElem {blocks : Array Block}
+    {index : Nat} {block : Block} (found : blocks[index]? = some block) :
+    blocks.isEmpty = false := by
+  apply Bool.eq_false_iff.mpr
+  intro empty
+  have blocksEmpty : blocks = #[] := Array.isEmpty_iff.mp empty
+  subst blocks
+  simp at found
+
+/-- A baseline register remains observable to an accepted rewrite exactly when
+the recognized allocation or recursive tail call reads it. The reset block may
+forward additional ABI slots, but helper-local liveness is allowed to forget
+those values immediately. -/
+def PlannerValueRelevant (shape : Shape) (sourceId : ValueId) : Prop :=
+  .reg sourceId ∈ shape.allocationArguments.toList ∨
+    .reg sourceId ∈ shape.tailArguments.toList
+
+def PlannerAtomRelevant (shape : Shape) : Atom → Prop
+  | .reg sourceId => PlannerValueRelevant shape sourceId
+  | .lit _ | .erased => True
+
+/-- Observable register values selected by the planner agree modulo a location
+relation. The implication form is sufficient for operand resolution and
+permits both dead forwarded parameters and the distinguished, not-yet-allocated
+result mapping to be out of bounds. -/
+def TranslatedValuesIso (shape : Shape) (locRel : Nat → Nat → Prop)
+    (source target : Array RVal) : Prop :=
+  ∀ sourceId targetId sourceValue,
+    PlannerValueRelevant shape sourceId →
+    translateRegister? shape sourceId = some targetId →
+    source[sourceId]? = some sourceValue →
+    ∃ targetValue,
+      target[targetId]? = some targetValue ∧
+      IxIR1.Sim.RValIso locRel sourceValue targetValue
+
+/-- A location value is represented by one of the surrounding semantic
+roots. Scalars require no heap-root witness. -/
+def PlannerValueInRoots (roots : List IxIR1.Sim.Root) : RVal → Prop
+  | .loc location =>
+      ∃ world, (⟨world, .loc location⟩ : IxIR1.Sim.Root) ∈ roots
+  | .lit _ | .erased => True
+
+/-- Every observable source register that the reuse planner preserves has
+the root support needed by physical address replacement. The consumed source
+register, discarded fetch temporaries, dead forwarded parameters, and scalar
+values are deliberately outside the heap-root obligation. -/
+def MappedValuesInRoots (shape : Shape) (values : Array RVal)
+    (roots : List IxIR1.Sim.Root) : Prop :=
+  ∀ sourceId targetId sourceValue,
+    PlannerValueRelevant shape sourceId →
+    translateRegister? shape sourceId = some targetId →
+    values[sourceId]? = some sourceValue →
+    PlannerValueInRoots roots sourceValue
+
+/-- Root-level self-relatedness discharges self-relatedness for every
+planner-preserved register. -/
+theorem MappedValuesInRoots.selfRelated {shape : Shape}
+    {values : Array RVal} {roots : List IxIR1.Sim.Root}
+    {locRel : Nat → Nat → Prop}
+    (mapped : MappedValuesInRoots shape values roots)
+    (rootsRelated : ∀ root ∈ roots,
+      IxIR1.Sim.RValIso locRel root.value root.value) :
+    ∀ sourceId targetId sourceValue,
+      PlannerValueRelevant shape sourceId →
+      translateRegister? shape sourceId = some targetId →
+      values[sourceId]? = some sourceValue →
+      IxIR1.Sim.RValIso locRel sourceValue sourceValue := by
+  intro sourceId targetId sourceValue relevant translated sourceAt
+  have supported :=
+    mapped sourceId targetId sourceValue relevant translated sourceAt
+  cases sourceValue with
+  | loc location =>
+      obtain ⟨world, member⟩ := supported
+      exact rootsRelated ⟨world, .loc location⟩ member
+  | lit literal => exact .lit
+  | erased => exact .erased
+
+/-- Exact planner register agreement lifts to location-renaming agreement
+when each live source value is self-related. -/
+theorem ValuesRel.toTranslatedValuesIso {shape : Shape}
+    {source target : Array RVal} {locRel : Nat → Nat → Prop}
+    (related : ValuesRel shape source target)
+    (selfRelated : ∀ (sourceId targetId : Nat) (sourceValue : RVal),
+      PlannerValueRelevant shape sourceId →
+      translateRegister? shape sourceId = some targetId →
+      source[sourceId]? = some sourceValue →
+      IxIR1.Sim.RValIso locRel sourceValue sourceValue) :
+    TranslatedValuesIso shape locRel source target := by
+  intro sourceId targetId sourceValue relevant translated sourceAt
+  have targetAt := related sourceId targetId translated
+  rw [sourceAt] at targetAt
+  exact ⟨sourceValue, targetAt.symm,
+    selfRelated sourceId targetId sourceValue relevant translated sourceAt⟩
+
+private theorem rvalsIso_append {locRel : Nat → Nat → Prop}
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel left right)
+    {leftValue rightValue : RVal}
+    (valueRelated : IxIR1.Sim.RValIso locRel leftValue rightValue) :
+    IxIR1.Sim.RValsIso locRel
+      (left ++ [leftValue]) (right ++ [rightValue]) := by
+  induction related with
+  | nil => exact .cons valueRelated .nil
+  | cons head tail ih => exact .cons head ih
+
+/-- Appending a common suffix preserves an identity-location value relation. -/
+private theorem rvalsIso_append_refl
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso (fun l r => l = r) left right)
+    (suffix : List RVal) :
+    IxIR1.Sim.RValsIso (fun l r => l = r)
+      (left ++ suffix) (right ++ suffix) := by
+  induction related with
+  | nil => simpa using IxIR1.Sim.RValsIso.refl suffix
+  | cons head tail ih => exact .cons head ih
+
+private theorem rvalsIso_length_eq {locRel : Nat → Nat → Prop}
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel left right) :
+    left.length = right.length := by
+  induction related with
+  | nil => rfl
+  | cons _ _ ih => simp [ih]
+
+private theorem rvalsIso_symm {locRel : Nat → Nat → Prop}
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel left right) :
+    IxIR1.Sim.RValsIso (fun rightLocation leftLocation =>
+      locRel leftLocation rightLocation) right left := by
+  induction related with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons head.symm ih
+
+private theorem rvalsIso_append_pair {locRel : Nat → Nat → Prop}
+    {left₁ right₁ left₂ right₂ : List RVal}
+    (first : IxIR1.Sim.RValsIso locRel left₁ right₁)
+    (second : IxIR1.Sim.RValsIso locRel left₂ right₂) :
+    IxIR1.Sim.RValsIso locRel (left₁ ++ left₂) (right₁ ++ right₂) := by
+  induction first with
+  | nil => exact second
+  | cons head tail ih => exact .cons head ih
+
+/-- Pointwise enlargement of a runtime-location relation preserves related
+value vectors.  This local public-proof helper is used when corresponding
+fresh allocations extend an existing allocation history. -/
+private theorem rvalsIso_mono_rel {oldRel newRel : Nat → Nat → Prop}
+    (lift : ∀ {left right}, oldRel left right → newRel left right) :
+    ∀ {left right : List RVal},
+      IxIR1.Sim.RValsIso oldRel left right →
+        IxIR1.Sim.RValsIso newRel left right
+  | _, _, .nil => .nil
+  | _, _, .cons head tail => .cons (head.mono lift) (rvalsIso_mono_rel lift tail)
+
+private theorem rvalsIso_array_extract {locRel : Nat → Nat → Prop}
+    {left right : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel left.toList right.toList)
+    (start stop : Nat) :
+    IxIR1.Sim.RValsIso locRel
+      (left.extract start stop).toList (right.extract start stop).toList := by
+  simpa [List.extract_eq_take_drop] using
+    (related.drop start).take (stop - start)
+
+private theorem rvalsIso_transport_avoiding_right
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    (lift : ∀ {leftLocation rightLocation},
+      oldRel leftLocation rightLocation →
+      rightLocation ≠ removed →
+      newRel leftLocation rightLocation)
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso oldRel left right)
+    (avoids : ∀ value ∈ right, value ≠ .loc removed) :
+    IxIR1.Sim.RValsIso newRel left right := by
+  induction related with
+  | nil => exact .nil
+  | @cons leftValue rightValue lefts rights head tail ih =>
+      have headAvoids : rightValue ≠ .loc removed :=
+        avoids rightValue (by simp)
+      have tailAvoids : ∀ value ∈ rights, value ≠ .loc removed := by
+        intro value member
+        exact avoids value (by simp [member])
+      refine .cons ?_ (ih tailAvoids)
+      cases head with
+      | loc locationRelated =>
+          apply IxIR1.Sim.RValIso.loc
+          apply lift locationRelated
+          intro same
+          apply headAvoids
+          cases same
+          rfl
+      | lit => exact .lit
+      | erased => exact .erased
+
+private theorem rvalsIso_getElem? {locRel : Nat → Nat → Prop}
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso locRel left right)
+    {index : Nat} {leftValue : RVal}
+    (found : left[index]? = some leftValue) :
+    ∃ rightValue,
+      right[index]? = some rightValue ∧
+        IxIR1.Sim.RValIso locRel leftValue rightValue := by
+  induction related generalizing index leftValue with
+  | nil => simp at found
+  | @cons leftHead rightHead leftTail rightTail head tail ih =>
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero, Option.some.injEq] at found
+          subst leftValue
+          exact ⟨rightHead, by simp, head⟩
+      | succ index =>
+          simp only [List.getElem?_cons_succ] at found ⊢
+          exact ih found
+
+private theorem rvalsIso_array_getElem? {locRel : Nat → Nat → Prop}
+    {left right : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel left.toList right.toList)
+    {index : Nat} {leftValue : RVal}
+    (found : left[index]? = some leftValue) :
+    ∃ rightValue,
+      right[index]? = some rightValue ∧
+        IxIR1.Sim.RValIso locRel leftValue rightValue := by
+  have listFound : left.toList[index]? = some leftValue := by
+    simpa using found
+  obtain ⟨rightValue, rightFound, valueRelated⟩ :=
+    rvalsIso_getElem? related listFound
+  exact ⟨rightValue, by simpa using rightFound, valueRelated⟩
+
+/-- Resolving the same atom in pointwise-related register files produces
+related runtime values. -/
+theorem resolveAtom_iso {locRel : Nat → Nat → Prop}
+    {left right : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel left.toList right.toList)
+    {atom : Atom} {leftValue : RVal}
+    (resolved : resolveAtom left atom = .ok leftValue) :
+    ∃ rightValue,
+      resolveAtom right atom = .ok rightValue ∧
+        IxIR1.Sim.RValIso locRel leftValue rightValue := by
+  cases atom with
+  | reg index =>
+      cases found : left[index]? with
+      | none => simp [resolveAtom, found] at resolved
+      | some actual =>
+          simp [resolveAtom, found] at resolved
+          subst actual
+          obtain ⟨rightValue, rightFound, valueRelated⟩ :=
+            rvalsIso_array_getElem? related found
+          exact ⟨rightValue, by simp [resolveAtom, rightFound], valueRelated⟩
+  | lit literal =>
+      simp [resolveAtom] at resolved
+      subst leftValue
+      exact ⟨.lit literal, by simp [resolveAtom], .lit⟩
+  | erased =>
+      simp [resolveAtom] at resolved
+      subst leftValue
+      exact ⟨.erased, by simp [resolveAtom], .erased⟩
+
+private theorem resolveList_iso {locRel : Nat → Nat → Prop}
+    {left right : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel left.toList right.toList) :
+    ∀ {atoms : List Atom} {leftInitial leftResult : Array RVal},
+      atoms.foldlM (fun output atom => do
+          return output.push (← resolveAtom left atom)) leftInitial =
+        .ok leftResult →
+      ∀ {rightInitial : Array RVal},
+        IxIR1.Sim.RValsIso locRel leftInitial.toList rightInitial.toList →
+        ∃ rightResult,
+          atoms.foldlM (fun output atom => do
+              return output.push (← resolveAtom right atom)) rightInitial =
+            .ok rightResult ∧
+          IxIR1.Sim.RValsIso locRel leftResult.toList
+            rightResult.toList := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro leftInitial leftResult resolved rightInitial initialRelated
+      change (Except.ok leftInitial : Except Error (Array RVal)) =
+        .ok leftResult at resolved
+      have same : leftInitial = leftResult := Except.ok.inj resolved
+      subst leftResult
+      exact ⟨rightInitial, rfl, initialRelated⟩
+  | cons atom atoms ih =>
+      intro leftInitial leftResult resolved rightInitial initialRelated
+      rw [List.foldlM_cons] at resolved
+      cases leftResolved : resolveAtom left atom with
+      | error error =>
+          simp only [leftResolved, bind, Except.bind] at resolved
+          cases resolved
+      | ok leftValue =>
+          simp only [leftResolved, bind, Except.bind] at resolved
+          obtain ⟨rightValue, rightResolved, valueRelated⟩ :=
+            resolveAtom_iso related leftResolved
+          have pushedRelated : IxIR1.Sim.RValsIso locRel
+              (leftInitial.push leftValue).toList
+              (rightInitial.push rightValue).toList := by
+            simpa using rvalsIso_append initialRelated valueRelated
+          obtain ⟨rightResult, rightRun, resultRelated⟩ :=
+            ih resolved pushedRelated
+          refine ⟨rightResult, ?_, resultRelated⟩
+          rw [List.foldlM_cons, rightResolved]
+          exact rightRun
+
+/-- Batch resolution of an unchanged atom vector is equivariant under any
+pointwise runtime-location relation. -/
+theorem resolveAtoms_iso {locRel : Nat → Nat → Prop}
+    {left right leftValues : Array RVal}
+    (related : IxIR1.Sim.RValsIso locRel left.toList right.toList)
+    {atoms : Array Atom}
+    (resolved : resolveAtoms left atoms = .ok leftValues) :
+    ∃ rightValues,
+      resolveAtoms right atoms = .ok rightValues ∧
+        IxIR1.Sim.RValsIso locRel leftValues.toList rightValues.toList := by
+  unfold resolveAtoms at resolved ⊢
+  rw [← Array.foldlM_toList]
+  apply resolveList_iso related
+    (by simpa only [Array.foldlM_toList] using resolved)
+  exact .nil
+
+/-- Appending related result values extends the planner's translated register
+relation across its distinguished result-register mapping. -/
+theorem TranslatedValuesIso.pushResult {shape : Shape}
+    {source target : Array RVal} {locRel : Nat → Nat → Prop}
+    {sourceResult targetResult : RVal}
+    (related : TranslatedValuesIso shape locRel source target)
+    (resultRelated : IxIR1.Sim.RValIso locRel sourceResult targetResult)
+    (sourceSize : source.size =
+      shape.parameterCount + 2 * shape.fieldCount)
+    (targetSize : target.size =
+      shape.fieldCount + (shape.parameterCount - 1))
+    (sourceBound : shape.source < shape.parameterCount) :
+    TranslatedValuesIso shape locRel
+      (source.push sourceResult) (target.push targetResult) := by
+  intro sourceId targetId sourceValue relevant translated sourceAt
+  rcases translateRegister?_range sourceBound translated with
+    ⟨sourceEnd, targetEnd⟩ | ⟨sourceBefore, targetBefore⟩
+  · subst sourceId
+    subst targetId
+    rw [← sourceSize] at sourceAt
+    simp at sourceAt
+    subst sourceValue
+    refine ⟨targetResult, ?_, resultRelated⟩
+    rw [← targetSize]
+    simp
+  · have sourceNe : sourceId ≠ source.size := by
+      rw [sourceSize]
+      exact Nat.ne_of_lt sourceBefore
+    have targetNe : targetId ≠ target.size := by
+      rw [targetSize]
+      exact Nat.ne_of_lt targetBefore
+    have sourceAtOld : source[sourceId]? = some sourceValue := by
+      simpa [Array.getElem?_push, sourceNe] using sourceAt
+    obtain ⟨targetValue, targetAt, valueRelated⟩ :=
+      related sourceId targetId sourceValue relevant translated sourceAtOld
+    refine ⟨targetValue, ?_, valueRelated⟩
+    simpa [Array.getElem?_push, targetNe] using targetAt
+
+/-- Resolving one translated atom preserves its runtime value modulo the
+chosen location relation. -/
+theorem resolveAtom_translate_iso {shape : Shape}
+    {locRel : Nat → Nat → Prop} {source target : Array RVal}
+    (related : TranslatedValuesIso shape locRel source target)
+    {atom translated : Atom} {sourceValue : RVal}
+    (relevant : PlannerAtomRelevant shape atom)
+    (translation : translateAtom? shape atom = some translated)
+    (resolved : resolveAtom source atom = .ok sourceValue) :
+    ∃ targetValue,
+      resolveAtom target translated = .ok targetValue ∧
+      IxIR1.Sim.RValIso locRel sourceValue targetValue := by
+  cases atom with
+  | reg sourceId =>
+      cases translatedAt : translateRegister? shape sourceId with
+      | none => simp [translateAtom?, translatedAt] at translation
+      | some targetId =>
+          simp [translateAtom?, translatedAt] at translation
+          subst translated
+          cases sourceAt : source[sourceId]? with
+          | none => simp [resolveAtom, sourceAt] at resolved
+          | some actual =>
+              simp [resolveAtom, sourceAt] at resolved
+              subst actual
+              obtain ⟨targetValue, targetAt, valueRelated⟩ :=
+                related sourceId targetId sourceValue relevant translatedAt
+                  sourceAt
+              exact
+                ⟨targetValue, by simp [resolveAtom, targetAt], valueRelated⟩
+  | lit literal =>
+      simp [translateAtom?] at translation
+      subst translated
+      simp [resolveAtom] at resolved
+      subst sourceValue
+      exact ⟨.lit literal, by simp [resolveAtom], .lit⟩
+  | erased =>
+      simp [translateAtom?] at translation
+      subst translated
+      simp [resolveAtom] at resolved
+      subst sourceValue
+      exact ⟨.erased, by simp [resolveAtom], .erased⟩
+
+private theorem resolveList_translate_iso {shape : Shape}
+    {locRel : Nat → Nat → Prop} {source target : Array RVal}
+    (related : TranslatedValuesIso shape locRel source target) :
+    ∀ {atoms translated : List Atom},
+      (∀ atom ∈ atoms, PlannerAtomRelevant shape atom) →
+      atoms.mapM (translateAtom? shape) = some translated →
+      ∀ {sourceInitial sourceResult : Array RVal},
+        atoms.foldlM (fun output atom => do
+            return output.push (← resolveAtom source atom)) sourceInitial =
+              .ok sourceResult →
+        ∀ {targetInitial : Array RVal},
+          IxIR1.Sim.RValsIso locRel sourceInitial.toList
+            targetInitial.toList →
+          ∃ targetResult,
+            translated.foldlM (fun output atom => do
+                return output.push (← resolveAtom target atom)) targetInitial =
+              .ok targetResult ∧
+            IxIR1.Sim.RValsIso locRel sourceResult.toList
+              targetResult.toList := by
+  intro atoms
+  induction atoms with
+  | nil =>
+      intro translated _relevant translation sourceInitial sourceResult resolved
+        targetInitial initialRelated
+      simp at translation
+      subst translated
+      change (Except.ok sourceInitial : Except Error (Array RVal)) =
+        .ok sourceResult at resolved
+      have sourceEq : sourceInitial = sourceResult := Except.ok.inj resolved
+      subst sourceResult
+      exact ⟨targetInitial, rfl, initialRelated⟩
+  | cons atom atoms ih =>
+      intro translated relevant translation sourceInitial sourceResult resolved
+        targetInitial initialRelated
+      cases atomAt : translateAtom? shape atom with
+      | none => simp [List.mapM_cons, atomAt] at translation
+      | some translatedAtom =>
+          cases tailAt : atoms.mapM (translateAtom? shape) with
+          | none => simp [List.mapM_cons, atomAt, tailAt] at translation
+          | some translatedAtoms =>
+              simp [List.mapM_cons, atomAt, tailAt] at translation
+              subst translated
+              rw [List.foldlM_cons] at resolved
+              cases sourceResolved : resolveAtom source atom with
+              | error error =>
+                  simp only [sourceResolved, bind, Except.bind] at resolved
+                  cases resolved
+              | ok sourceValue =>
+                  simp only [sourceResolved, bind, Except.bind] at resolved
+                  obtain ⟨targetValue, targetResolved, valueRelated⟩ :=
+                    resolveAtom_translate_iso related
+                      (relevant atom (by simp)) atomAt sourceResolved
+                  have pushedRelated : IxIR1.Sim.RValsIso locRel
+                      (sourceInitial.push sourceValue).toList
+                      (targetInitial.push targetValue).toList := by
+                    simpa using rvalsIso_append initialRelated valueRelated
+                  obtain ⟨targetResult, targetRun, resultRelated⟩ :=
+                    ih (fun tailAtom member =>
+                      relevant tailAtom (by simp [member])) tailAt resolved
+                      pushedRelated
+                  refine ⟨targetResult, ?_, resultRelated⟩
+                  rw [List.foldlM_cons, targetResolved]
+                  change translatedAtoms.foldlM (fun output atom => do
+                      return output.push (← resolveAtom target atom))
+                    (targetInitial.push targetValue) = .ok targetResult
+                  exact targetRun
+
+/-- Batch operand resolution commutes with the planner translation modulo an
+arbitrary runtime-location relation. -/
+theorem resolveAtoms_translate_iso {shape : Shape}
+    {locRel : Nat → Nat → Prop} {source target : Array RVal}
+    (related : TranslatedValuesIso shape locRel source target)
+    {atoms translated : Array Atom} {sourceValues : Array RVal}
+    (relevant : ∀ atom ∈ atoms.toList,
+      PlannerAtomRelevant shape atom)
+    (translation : translateAtoms? shape atoms = some translated)
+    (resolved : resolveAtoms source atoms = .ok sourceValues) :
+    ∃ targetValues,
+      resolveAtoms target translated = .ok targetValues ∧
+      IxIR1.Sim.RValsIso locRel sourceValues.toList targetValues.toList := by
+  unfold translateAtoms? at translation
+  cases mappedAt : atoms.toList.mapM (translateAtom? shape) with
+  | none => simp [mappedAt] at translation
+  | some translatedAtoms =>
+      simp [mappedAt] at translation
+      subst translated
+      unfold resolveAtoms at resolved ⊢
+      rw [← Array.foldlM_toList]
+      apply resolveList_translate_iso related relevant mappedAt
+        (by simpa only [Array.foldlM_toList] using resolved)
+      exact .nil
+
+/-- Accepted allocation operands resolve on the helper side to values related
+to the baseline operands by the chosen location relation. -/
+theorem resolveAllocationArguments_iso {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Reuse.Site limits context block)
+    {locRel : Nat → Nat → Prop} {source target sourceValues : Array RVal}
+    (related : TranslatedValuesIso site.shape locRel source target)
+    (resolved : resolveAtoms source site.shape.allocationArguments =
+      .ok sourceValues) :
+    ∃ targetValues,
+      resolveAtoms target site.candidate.allocationArguments =
+        .ok targetValues ∧
+      IxIR1.Sim.RValsIso locRel sourceValues.toList targetValues.toList :=
+  resolveAtoms_translate_iso related (by
+    intro atom member
+    cases atom with
+    | reg sourceId => exact .inl member
+    | lit | erased => trivial) site.allocationArgumentsFound resolved
+
+/-- Accepted tail operands resolve on the helper side to values related to
+the baseline operands by the chosen location relation. -/
+theorem resolveTailArguments_iso {limits : Validate.Limits}
+    {context : Validate.Context} {block : Block}
+    (site : Reuse.Site limits context block)
+    {locRel : Nat → Nat → Prop} {source target sourceValues : Array RVal}
+    (related : TranslatedValuesIso site.shape locRel source target)
+    (resolved : resolveAtoms source site.shape.tailArguments =
+      .ok sourceValues) :
+    ∃ targetValues,
+      resolveAtoms target site.candidate.tailArguments = .ok targetValues ∧
+      IxIR1.Sim.RValsIso locRel sourceValues.toList targetValues.toList :=
+  resolveAtoms_translate_iso related (by
+    intro atom member
+    cases atom with
+    | reg sourceId => exact .inr member
+    | lit | erased => trivial) site.tailArgumentsFound resolved
+
+/-- The concrete canonical baseline/helper entry files are related modulo any
+location relation that self-relates the surviving baseline values. -/
+theorem translatedValuesIso_helperEntry {shape : Shape}
+    {parameters fields : Array RVal} {locRel : Nat → Nat → Prop}
+    (parameterCount : parameters.size = shape.parameterCount)
+    (fieldCount : fields.size = shape.fieldCount)
+    (sourceBound : shape.source < shape.parameterCount)
+    (selfRelated : ∀ (sourceId targetId : Nat) (sourceValue : RVal),
+      PlannerValueRelevant shape sourceId →
+      translateRegister? shape sourceId = some targetId →
+      (baselinePrefixValues parameters fields)[sourceId]? =
+        some sourceValue →
+      IxIR1.Sim.RValIso locRel sourceValue sourceValue) :
+    TranslatedValuesIso shape locRel
+      (baselinePrefixValues parameters fields)
+      (helperEntryValues shape.source parameters fields) :=
+  (valuesRel_helperEntry parameterCount fieldCount sourceBound).toTranslatedValuesIso
+    selfRelated
+
+/-- Appending two related allocation results to the canonical baseline and
+helper files yields the location-renaming relation required by tail operand
+resolution. -/
+theorem translatedValuesIso_afterAllocation {shape : Shape}
+    {parameters fields : Array RVal} {locRel : Nat → Nat → Prop}
+    {sourceResult targetResult : RVal}
+    (parameterCount : parameters.size = shape.parameterCount)
+    (fieldCount : fields.size = shape.fieldCount)
+    (sourceBound : shape.source < shape.parameterCount)
+    (selfRelated : ∀ (sourceId targetId : Nat) (sourceValue : RVal),
+      PlannerValueRelevant shape sourceId →
+      translateRegister? shape sourceId = some targetId →
+      (baselinePrefixValues parameters fields)[sourceId]? =
+        some sourceValue →
+      IxIR1.Sim.RValIso locRel sourceValue sourceValue)
+    (resultRelated :
+      IxIR1.Sim.RValIso locRel sourceResult targetResult) :
+    TranslatedValuesIso shape locRel
+      ((baselinePrefixValues parameters fields).push sourceResult)
+      ((helperEntryValues shape.source parameters fields).push
+        targetResult) := by
+  apply TranslatedValuesIso.pushResult
+    (translatedValuesIso_helperEntry parameterCount fieldCount sourceBound
+      selfRelated) resultRelated
+  · simp [baselinePrefixValues, parameterCount, fieldCount, Nat.two_mul]
+  · simp [helperEntryValues, List.length_eraseIdx, parameterCount,
+      fieldCount, sourceBound]
+  · exact sourceBound
+
+/-- An absent optional credit performs fresh allocation and then the helper's
+self tail call in exactly two steps.  Allocation and tail operand resolution
+are transported from the recognized baseline register files. -/
+theorem absentHelperControl {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {helperId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation}
+    (helperAt : definition.blocks[helperId]? = some
+      (Reuse.creditBlock site.candidate
+        (.optional site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (layout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := helperId
+        pc := 0
+        values := helperEntryValues site.shape.source parameters fields
+        credits := #[some
+          { layout := site.candidate.layout
+            presence := .absent }] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds machine.store allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (machine.store.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let allocation := machine.store.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps context interpretation 2 machine
+      { machine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+  dsimp only
+  let credit : Credit :=
+    { layout := site.candidate.layout, presence := .absent }
+  let initial : Frame :=
+    { definition
+      block := helperId
+      pc := 0
+      values := helperEntryValues site.shape.source parameters fields
+      credits := #[some credit] }
+  let advanced : Frame :=
+    { initial with pc := 1, credits := #[none] }
+  let allocation := machine.store.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let afterAllocation : Frame :=
+    { advanced with
+      values := (helperEntryValues site.shape.source parameters fields).push
+        (.loc allocation.2) }
+  have helperResolved : resolveAtoms initial.values
+      site.candidate.allocationArguments = .ok newFields := by
+    apply resolveAllocationArguments site
+      (valuesRel_helperEntry parameterCount fieldCount site.fits.sourceBound)
+    simpa [initial] using allocationResolved
+  have creditAt : ({ initial with pc := initial.pc + 1 } : Frame).credits[0]? =
+      some (some credit) := by
+    simp [initial, credit]
+  have taken : CreditTake { initial with pc := initial.pc + 1 } 0
+      advanced credit := by
+    have := CreditTake.of_lookup (CreditLookup.of_getElem creditAt)
+    simpa [initial, advanced, Array.setIfInBounds] using this
+  have allocationStep : Step context interpretation machine
+      { machine with
+        store := allocation.1
+        control := .running afterAllocation stack } := by
+    have step := Step.allocWithAbsent
+      (context := context) (interpretation := interpretation)
+      (machine := machine) (frame := initial) (next := advanced)
+      (stack := stack)
+      (block := Reuse.creditBlock site.candidate
+        (.optional site.candidate.layout))
+      (creditId := 0) (credit := credit) (world := .shared)
+      (cid := site.shape.allocationConstructor)
+      (arguments := site.candidate.allocationArguments)
+      (schema := allocationSchema) (values := newFields)
+      (by simpa [initial] using control) helperAt
+      (by simp [initial, site.creditBlock_eq])
+      (by simp [initial, site.creditBlock_eq]) schemaAt helperResolved
+      fieldWorlds taken layout rfl
+    simpa [allocation, afterAllocation, advanced, initial, credit] using step
+  have helperTailResolved : resolveAtoms afterAllocation.values
+      site.candidate.tailArguments = .ok callValues := by
+    apply resolveTailArguments site
+      (valuesRel_afterAllocation parameterCount fieldCount
+        site.fits.sourceBound)
+    simpa [afterAllocation, advanced, initial, allocation] using tailResolved
+  have noCredits : NoLiveCredits afterAllocation := by
+    simp [NoLiveCredits, afterAllocation, advanced]
+  have tailStep : Step context interpretation
+      { machine with
+        store := allocation.1
+        control := .running afterAllocation stack }
+      { machine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+    apply Step.tailCallSelfCleared
+      (frame := afterAllocation) (stack := stack)
+      (block := Reuse.creditBlock site.candidate
+        (.optional site.candidate.layout))
+      (arguments := site.candidate.tailArguments) (values := callValues)
+    · rfl
+    · simpa [afterAllocation, advanced, initial] using helperAt
+    · simp [afterAllocation, advanced, Reuse.creditBlock]
+    · rfl
+    · exact noCredits
+    · exact helperTailResolved
+    · simpa [afterAllocation, advanced, initial] using arity
+    · simpa [afterAllocation, advanced, initial] using nonempty
+  have first := allocationStep.toSteps (by simpa [initial] using control)
+  have second := tailStep.toSteps (by rfl)
+  simpa [allocation] using first.trans second
+
+/-- A present logical credit records a reuse opportunity, performs the same
+fresh semantic allocation as the baseline, and then enters the recursive
+self call in exactly two steps. -/
+theorem logicalPresentHelperControl {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function} {helperId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation}
+    (helperAt : definition.blocks[helperId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (layout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := helperId
+        pc := 0
+        values := helperEntryValues site.shape.source parameters fields
+        credits := #[some
+          { layout := site.candidate.layout
+            presence := .present none }] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds machine.store allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (machine.store.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let allocation := machine.store.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps context .logical 2 machine
+      { machine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+  dsimp only
+  let credit : Credit :=
+    { layout := site.candidate.layout, presence := .present none }
+  let initial : Frame :=
+    { definition
+      block := helperId
+      pc := 0
+      values := helperEntryValues site.shape.source parameters fields
+      credits := #[some credit] }
+  let advanced : Frame :=
+    { initial with pc := 1, credits := #[none] }
+  let allocation := machine.store.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let afterAllocation : Frame :=
+    { advanced with
+      values := (helperEntryValues site.shape.source parameters fields).push
+        (.loc allocation.2) }
+  have helperResolved : resolveAtoms initial.values
+      site.candidate.allocationArguments = .ok newFields := by
+    apply resolveAllocationArguments site
+      (valuesRel_helperEntry parameterCount fieldCount site.fits.sourceBound)
+    simpa [initial] using allocationResolved
+  have creditAt : ({ initial with pc := initial.pc + 1 } : Frame).credits[0]? =
+      some (some credit) := by
+    simp [initial, credit]
+  have taken : CreditTake { initial with pc := initial.pc + 1 } 0
+      advanced credit := by
+    have := CreditTake.of_lookup (CreditLookup.of_getElem creditAt)
+    simpa [initial, advanced, Array.setIfInBounds] using this
+  have allocationStep : Step context .logical machine
+      { machine with
+        store := allocation.1
+        control := .running afterAllocation stack } := by
+    have step := Step.allocWithLogical
+      (context := context) (machine := machine) (frame := initial)
+      (next := advanced) (stack := stack)
+      (block := Reuse.creditBlock site.candidate
+        (.required site.candidate.layout))
+      (creditId := 0) (credit := credit) (world := .shared)
+      (cid := site.shape.allocationConstructor)
+      (arguments := site.candidate.allocationArguments)
+      (schema := allocationSchema) (values := newFields)
+      (by simpa [initial] using control) helperAt
+      (by simp [initial, site.creditBlock_eq])
+      (by simp [initial, site.creditBlock_eq]) schemaAt helperResolved
+      fieldWorlds taken layout rfl
+    simpa [allocation, afterAllocation, advanced, initial, credit] using step
+  have helperTailResolved : resolveAtoms afterAllocation.values
+      site.candidate.tailArguments = .ok callValues := by
+    apply resolveTailArguments site
+      (valuesRel_afterAllocation parameterCount fieldCount
+        site.fits.sourceBound)
+    simpa [afterAllocation, advanced, initial, allocation] using tailResolved
+  have noCredits : NoLiveCredits afterAllocation := by
+    simp [NoLiveCredits, afterAllocation, advanced]
+  have tailStep : Step context .logical
+      { machine with
+        store := allocation.1
+        control := .running afterAllocation stack }
+      { machine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+    apply Step.tailCallSelfCleared
+      (frame := afterAllocation) (stack := stack)
+      (block := Reuse.creditBlock site.candidate
+        (.required site.candidate.layout))
+      (arguments := site.candidate.tailArguments) (values := callValues)
+    · rfl
+    · simpa [afterAllocation, advanced, initial] using helperAt
+    · simp [afterAllocation, advanced, Reuse.creditBlock]
+    · rfl
+    · exact noCredits
+    · exact helperTailResolved
+    · simpa [afterAllocation, advanced, initial] using arity
+    · simpa [afterAllocation, advanced, initial] using nonempty
+  have first := allocationStep.toSteps (by simpa [initial] using control)
+  have second := tailStep.toSteps (by rfl)
+  simpa [allocation] using first.trans second
+
+/-- The accepted logical hot arm reaches its recursive self call in four
+genuine steps: reset, credit branch, fresh allocation, and tail call. -/
+theorem hotLogicalAcceptedControl {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (unitRC : box.rc = 1)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds
+      (((machine.store.tickResetAttempt).kill location).tickHotReset)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc ((((machine.store.tickResetAttempt).kill location).tickHotReset
+          ).allocNode .shared
+            (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let resetStore :=
+      ((machine.store.tickResetAttempt).kill location).tickHotReset
+    let allocation := resetStore.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps context .logical 4 machine
+      { machine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+  dsimp only
+  let resetStore :=
+    ((machine.store.tickResetAttempt).kill location).tickHotReset
+  let helperMachine : Machine :=
+    { machine with
+      store := resetStore
+      control := .running
+        { definition
+          block := hotId
+          pc := 0
+          values := helperEntryValues site.shape.source parameters fields
+          credits := #[some
+            { layout := site.candidate.layout
+              presence := .present none }] }
+        stack }
+  let allocation := resetStore.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have prefixSteps : Steps context .logical 2 machine helperMachine := by
+    simpa [helperMachine, resetStore, sourceLayout] using
+      hotLogicalControlPrefix site resetAt hotAt sourceSchemaAt control
+        parameterCount fieldCount sourceResolved viewed unitRC
+  have helperSteps : Steps context .logical 2 helperMachine
+      { helperMachine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+    simpa [helperMachine, allocation, resetStore] using
+      logicalPresentHelperControl site (machine := helperMachine) hotAt
+        allocationSchemaAt allocationLayout (by rfl) parameterCount fieldCount
+        allocationResolved (by simpa [helperMachine, resetStore] using
+          fieldWorlds)
+        (by simpa [helperMachine, allocation, resetStore] using tailResolved)
+        arity nonempty
+  simpa [helperMachine, allocation, resetStore] using
+    prefixSteps.trans helperSteps
+
+/-- The accepted cold arm reaches its recursive self call in four genuine
+steps under either credit interpretation. -/
+theorem coldAcceptedControl {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {resetId hotId coldId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema allocationSchema : CtorSchema} {machine : Machine}
+    {resetStore : Store} {stack : List Continuation}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (coldAt : definition.blocks[coldId]? = some
+      (Reuse.creditBlock site.candidate
+        (.optional site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (shared : 1 < box.rc)
+    (retained : RetainSharedMany
+      ((((machine.store.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+      fields resetStore)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds resetStore allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (resetStore.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let allocation := resetStore.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps context interpretation 4 machine
+      { machine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+  dsimp only
+  let helperMachine : Machine :=
+    { machine with
+      store := resetStore
+      control := .running
+        { definition
+          block := coldId
+          pc := 0
+          values := helperEntryValues site.shape.source parameters fields
+          credits := #[some
+            { layout := site.candidate.layout
+              presence := .absent }] }
+        stack }
+  let allocation := resetStore.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have prefixSteps : Steps context interpretation 2 machine helperMachine := by
+    simpa [helperMachine, sourceLayout] using
+      coldControlPrefix site resetAt coldAt sourceSchemaAt control
+        parameterCount fieldCount sourceResolved viewed shared retained
+  have helperSteps : Steps context interpretation 2 helperMachine
+      { helperMachine with
+        store := allocation.1
+        control := .running { definition, values := callValues } stack } := by
+    simpa [helperMachine, allocation] using
+      absentHelperControl site (machine := helperMachine) coldAt
+        allocationSchemaAt allocationLayout (by rfl) parameterCount fieldCount
+        allocationResolved (by simpa [helperMachine] using fieldWorlds)
+        (by simpa [helperMachine, allocation] using tailResolved)
+        arity nonempty
+  simpa [helperMachine, allocation] using prefixSteps.trans helperSteps
+
+/-- A present physical credit rewrites the reserved source slot and then
+enters the recursive self call in exactly two steps.  Unlike the logical
+theorem, the tail operands are stated in the physical register file: relating
+its reused location to the baseline's fresh location is the heap-isomorphism
+obligation of the surrounding simulation. -/
+theorem physicalPresentHelperControl {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function} {helperId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation} {location : Nat} {store : Store}
+    (helperAt : definition.blocks[helperId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (layout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := helperId
+        pc := 0
+        values := helperEntryValues site.shape.source parameters fields
+        credits := #[some
+          { layout := site.candidate.layout
+            presence := .present (some location) }] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds machine.store allocationSchema newFields)
+    (reused : machine.store.reuseReservation location .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+      allocationSchema.fields.size = .ok store)
+    (tailResolved : resolveAtoms
+      ((helperEntryValues site.shape.source parameters fields).push
+        (.loc location))
+      site.candidate.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    Steps context .physical 2 machine
+      { machine with
+        store
+        control := .running { definition, values := callValues } stack } := by
+  let credit : Credit :=
+    { layout := site.candidate.layout,
+      presence := .present (some location) }
+  let initial : Frame :=
+    { definition
+      block := helperId
+      pc := 0
+      values := helperEntryValues site.shape.source parameters fields
+      credits := #[some credit] }
+  let advanced : Frame :=
+    { initial with pc := 1, credits := #[none] }
+  let afterAllocation : Frame :=
+    { advanced with
+      values := (helperEntryValues site.shape.source parameters fields).push
+        (.loc location) }
+  have helperResolved : resolveAtoms initial.values
+      site.candidate.allocationArguments = .ok newFields := by
+    apply resolveAllocationArguments site
+      (valuesRel_helperEntry parameterCount fieldCount site.fits.sourceBound)
+    simpa [initial] using allocationResolved
+  have creditAt : ({ initial with pc := initial.pc + 1 } : Frame).credits[0]? =
+      some (some credit) := by
+    simp [initial, credit]
+  have taken : CreditTake { initial with pc := initial.pc + 1 } 0
+      advanced credit := by
+    have := CreditTake.of_lookup (CreditLookup.of_getElem creditAt)
+    simpa [initial, advanced, Array.setIfInBounds] using this
+  have allocationStep : Step context .physical machine
+      { machine with
+        store
+        control := .running afterAllocation stack } := by
+    have step := Step.allocWithPhysical
+      (context := context) (machine := machine) (frame := initial)
+      (next := advanced) (stack := stack)
+      (block := Reuse.creditBlock site.candidate
+        (.required site.candidate.layout))
+      (creditId := 0) (credit := credit) (world := .shared)
+      (cid := site.shape.allocationConstructor)
+      (arguments := site.candidate.allocationArguments)
+      (schema := allocationSchema) (values := newFields)
+      (location := location) (store := store)
+      (by simpa [initial] using control) helperAt
+      (by simp [initial, site.creditBlock_eq])
+      (by simp [initial, site.creditBlock_eq]) schemaAt helperResolved
+      fieldWorlds taken layout rfl reused
+    simpa [afterAllocation, advanced, initial, credit] using step
+  have noCredits : NoLiveCredits afterAllocation := by
+    simp [NoLiveCredits, afterAllocation, advanced]
+  have tailStep : Step context .physical
+      { machine with
+        store
+        control := .running afterAllocation stack }
+      { machine with
+        store
+        control := .running { definition, values := callValues } stack } := by
+    apply Step.tailCallSelfCleared
+      (frame := afterAllocation) (stack := stack)
+      (block := Reuse.creditBlock site.candidate
+        (.required site.candidate.layout))
+      (arguments := site.candidate.tailArguments) (values := callValues)
+    · rfl
+    · simpa [afterAllocation, advanced, initial] using helperAt
+    · simp [afterAllocation, advanced, Reuse.creditBlock]
+    · rfl
+    · exact noCredits
+    · simpa [afterAllocation, advanced, initial] using tailResolved
+    · simpa [afterAllocation, advanced, initial] using arity
+    · simpa [afterAllocation, advanced, initial] using nonempty
+  have first := allocationStep.toSteps (by simpa [initial] using control)
+  have second := tailStep.toSteps (by rfl)
+  simpa using first.trans second
+
+/-- Physical helper execution transported from baseline tail resolution.
+The recursive argument vectors are related by the post-reuse heap
+isomorphism rather than equated. -/
+theorem physicalPresentHelperControlIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function} {helperId : BlockId}
+    {parameters fields newFields baselineCallValues : Array RVal}
+    {allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation} {location baselineLocation : Nat}
+    {store : Store} {baselineHeap : IxIR1.Store}
+    (helperAt : definition.blocks[helperId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (layout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := helperId
+        pc := 0
+        values := helperEntryValues site.shape.source parameters fields
+        credits := #[some
+          { layout := site.candidate.layout
+            presence := .present (some location) }] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds machine.store allocationSchema newFields)
+    (reused : machine.store.reuseReservation location .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+      allocationSchema.fields.size = .ok store)
+    (iso : IxIR1.Sim.HeapIso store.heap baselineHeap)
+    (selfRelated : ∀ (sourceId targetId : Nat) (sourceValue : RVal),
+      PlannerValueRelevant site.shape sourceId →
+      translateRegister? site.shape sourceId = some targetId →
+      (baselinePrefixValues parameters fields)[sourceId]? =
+        some sourceValue →
+      IxIR1.Sim.RValIso (fun baseline physical =>
+        iso.locRel physical baseline) sourceValue sourceValue)
+    (resultRelated : iso.locRel location baselineLocation)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc baselineLocation))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    ∃ physicalCallValues,
+      Steps context .physical 2 machine
+        { machine with
+          store
+          control := .running
+            { definition, values := physicalCallValues } stack } ∧
+      IxIR1.Sim.RValsIso (fun baseline physical =>
+        iso.locRel physical baseline)
+        baselineCallValues.toList physicalCallValues.toList := by
+  have registerRelation : TranslatedValuesIso site.shape
+      (fun baseline physical => iso.locRel physical baseline)
+      ((baselinePrefixValues parameters fields).push
+        (.loc baselineLocation))
+      ((helperEntryValues site.shape.source parameters fields).push
+        (.loc location)) :=
+    translatedValuesIso_afterAllocation parameterCount fieldCount
+      site.fits.sourceBound selfRelated (.loc resultRelated)
+  obtain ⟨physicalCallValues, physicalTailResolved, callsRelated⟩ :=
+    resolveTailArguments_iso site registerRelation tailResolved
+  have sizeEq : baselineCallValues.size = physicalCallValues.size := by
+    simpa using rvalsIso_length_eq callsRelated
+  have physicalArity : physicalCallValues.size =
+      definition.signature.params.size := sizeEq.symm.trans arity
+  refine ⟨physicalCallValues, ?_, callsRelated⟩
+  exact physicalPresentHelperControl site helperAt schemaAt layout control
+    parameterCount fieldCount allocationResolved fieldWorlds reused
+    physicalTailResolved physicalArity nonempty
+
+/-- Physical helper execution from an arbitrary translated baseline register
+file.  Unlike `physicalPresentHelperControlIso`, this interface does not
+require the preserved operands to be literally equal on both sides, so it can
+consume a location relation inherited from an earlier physical reuse. -/
+theorem physicalPresentHelperControlTranslated {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function} {helperId : BlockId}
+    {parameters fields newFields baselineTailValues baselineCallValues :
+      Array RVal}
+    {allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation} {location : Nat}
+    {store : Store} {locRel : Nat → Nat → Prop}
+    (helperAt : definition.blocks[helperId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (layout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := helperId
+        pc := 0
+        values := helperEntryValues site.shape.source parameters fields
+        credits := #[some
+          { layout := site.candidate.layout
+            presence := .present (some location) }] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds machine.store allocationSchema newFields)
+    (reused : machine.store.reuseReservation location .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+      allocationSchema.fields.size = .ok store)
+    (registerRelation : TranslatedValuesIso site.shape locRel
+      baselineTailValues
+      ((helperEntryValues site.shape.source parameters fields).push
+        (.loc location)))
+    (tailResolved : resolveAtoms baselineTailValues
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    ∃ physicalCallValues,
+      Steps context .physical 2 machine
+        { machine with
+          store
+          control := .running
+            { definition, values := physicalCallValues } stack } ∧
+      IxIR1.Sim.RValsIso locRel baselineCallValues.toList
+        physicalCallValues.toList := by
+  obtain ⟨physicalCallValues, physicalTailResolved, callsRelated⟩ :=
+    resolveTailArguments_iso site registerRelation tailResolved
+  have sizeEq : baselineCallValues.size = physicalCallValues.size := by
+    simpa using rvalsIso_length_eq callsRelated
+  have physicalArity : physicalCallValues.size =
+      definition.signature.params.size := sizeEq.symm.trans arity
+  refine ⟨physicalCallValues, ?_, callsRelated⟩
+  exact physicalPresentHelperControl site helperAt schemaAt layout control
+    parameterCount fieldCount allocationResolved fieldWorlds reused
+    physicalTailResolved physicalArity nonempty
+
+/-- The accepted physical hot arm reaches a recursively related call in four
+genuine target steps: reset, credit branch, reserved-slot allocation, and
+self tail call. -/
+theorem hotPhysicalAcceptedControlIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields newFields baselineCallValues : Array RVal}
+    {location baselineLocation : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation} {store : Store}
+    {baselineHeap : IxIR1.Store}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (unitRC : box.rc = 1)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds
+      (((machine.store.tickResetAttempt).reserve location).tickHotReset)
+      allocationSchema newFields)
+    (reused : Eval.Store.reuseReservation
+      (((machine.store.tickResetAttempt).reserve location).tickHotReset)
+      location .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+      allocationSchema.fields.size = Except.ok store)
+    (iso : IxIR1.Sim.HeapIso store.heap baselineHeap)
+    (selfRelated : ∀ (sourceId targetId : Nat) (sourceValue : RVal),
+      PlannerValueRelevant site.shape sourceId →
+      translateRegister? site.shape sourceId = some targetId →
+      (baselinePrefixValues parameters fields)[sourceId]? =
+        some sourceValue →
+      IxIR1.Sim.RValIso (fun baseline physical =>
+        iso.locRel physical baseline) sourceValue sourceValue)
+    (resultRelated : iso.locRel location baselineLocation)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc baselineLocation))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    ∃ physicalCallValues,
+      Steps context .physical 4 machine
+        { machine with
+          store
+          control := .running
+            { definition, values := physicalCallValues } stack } ∧
+      IxIR1.Sim.RValsIso (fun baseline physical =>
+        iso.locRel physical baseline)
+        baselineCallValues.toList physicalCallValues.toList := by
+  let helperMachine : Machine :=
+    { machine with
+      store := ((machine.store.tickResetAttempt).reserve location).tickHotReset
+      control := .running
+        { definition
+          block := hotId
+          pc := 0
+          values := helperEntryValues site.shape.source parameters fields
+          credits := #[some
+            { layout := site.candidate.layout
+              presence := .present (some location) }] }
+        stack }
+  have prefixSteps : Steps context .physical 2 machine helperMachine := by
+    simpa [helperMachine, sourceLayout] using
+      hotPhysicalControlPrefix site resetAt hotAt sourceSchemaAt control
+        parameterCount fieldCount sourceResolved viewed unitRC
+  obtain ⟨physicalCallValues, helperSteps, callsRelated⟩ :=
+    physicalPresentHelperControlIso site
+      (machine := helperMachine) (store := store)
+      (baselineHeap := baselineHeap) hotAt allocationSchemaAt
+      allocationLayout (by rfl) parameterCount fieldCount
+      allocationResolved (by simpa [helperMachine] using fieldWorlds)
+      (by simpa [helperMachine] using reused) iso selfRelated resultRelated
+      tailResolved arity nonempty
+  refine ⟨physicalCallValues, ?_, callsRelated⟩
+  simpa [helperMachine] using prefixSteps.trans helperSteps
+
+/-- Four-step physical accepted execution from an arbitrary translated
+baseline tail register file.  This is the control half of composing physical
+reuse with an already-isomorphic input state. -/
+theorem hotPhysicalAcceptedControlTranslated {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields newFields baselineTailValues baselineCallValues :
+      Array RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema allocationSchema : CtorSchema} {machine : Machine}
+    {stack : List Continuation} {store : Store}
+    {locRel : Nat → Nat → Prop}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (unitRC : box.rc = 1)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds
+      (((machine.store.tickResetAttempt).reserve location).tickHotReset)
+      allocationSchema newFields)
+    (reused : Eval.Store.reuseReservation
+      (((machine.store.tickResetAttempt).reserve location).tickHotReset)
+      location .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+      allocationSchema.fields.size = Except.ok store)
+    (registerRelation : TranslatedValuesIso site.shape locRel
+      baselineTailValues
+      ((helperEntryValues site.shape.source parameters fields).push
+        (.loc location)))
+    (tailResolved : resolveAtoms baselineTailValues
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    ∃ physicalCallValues,
+      Steps context .physical 4 machine
+        { machine with
+          store
+          control := .running
+            { definition, values := physicalCallValues } stack } ∧
+      IxIR1.Sim.RValsIso locRel baselineCallValues.toList
+        physicalCallValues.toList := by
+  let helperMachine : Machine :=
+    { machine with
+      store := ((machine.store.tickResetAttempt).reserve location).tickHotReset
+      control := .running
+        { definition
+          block := hotId
+          pc := 0
+          values := helperEntryValues site.shape.source parameters fields
+          credits := #[some
+            { layout := site.candidate.layout
+              presence := .present (some location) }] }
+        stack }
+  have prefixSteps : Steps context .physical 2 machine helperMachine := by
+    simpa [helperMachine, sourceLayout] using
+      hotPhysicalControlPrefix site resetAt hotAt sourceSchemaAt control
+        parameterCount fieldCount sourceResolved viewed unitRC
+  obtain ⟨physicalCallValues, helperSteps, callsRelated⟩ :=
+    physicalPresentHelperControlTranslated site
+      (machine := helperMachine) (store := store) hotAt allocationSchemaAt
+      allocationLayout (by rfl) parameterCount fieldCount allocationResolved
+      (by simpa [helperMachine] using fieldWorlds)
+      (by simpa [helperMachine] using reused) registerRelation tailResolved
+      arity nonempty
+  refine ⟨physicalCallValues, ?_, callsRelated⟩
+  simpa [helperMachine] using prefixSteps.trans helperSteps
+
+/-! ## Recognized baseline-block control -/
+
+/-- Values after fetching the first `count` constructor fields. -/
+def fetchedPrefixValues (parameters fields : Array RVal) (count : Nat) :
+    Array RVal :=
+  parameters ++ (fields.toList.take count).toArray
+
+private theorem fetchedPrefixValues_succ {parameters fields : Array RVal}
+    {count : Nat} (bound : count < fields.size) :
+    (fetchedPrefixValues parameters fields count).push fields[count] =
+      fetchedPrefixValues parameters fields (count + 1) := by
+  apply Array.toList_inj.mp
+  simp only [fetchedPrefixValues, Array.toList_push, Array.toList_append]
+  rw [← List.take_append_getElem (l := fields.toList)
+    (i := count) (by simpa using bound)]
+  simp [List.append_assoc]
+
+/-- Execute all recognized fetches from an accepted baseline block. -/
+theorem fetchPrefixControl {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {blockId : BlockId}
+    {parameters fields : Array RVal} {location : Nat}
+    {box : IxIR1.NodeBox} {machine : Machine}
+    {stack : List Continuation}
+    (blockAt : definition.blocks[blockId]? = some block)
+    (control : machine.control = .running
+      { definition
+        block := blockId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN site.shape.sourceConstructor fields) :
+    Steps context interpretation site.shape.fieldCount machine
+      { machine with
+        control := .running
+          { definition
+            block := blockId
+            pc := site.shape.fieldCount
+            values := parameters ++ fields
+            credits := #[] }
+          stack } := by
+  have loop : ∀ count, count ≤ site.shape.fieldCount →
+      Steps context interpretation count machine
+        { machine with
+          control := .running
+            { definition
+              block := blockId
+              pc := count
+              values := fetchedPrefixValues parameters fields count
+              credits := #[] }
+            stack } := by
+    intro count countLe
+    induction count with
+    | zero =>
+        simpa [fetchedPrefixValues, ← control] using Steps.refl machine
+    | succ count ih =>
+        have countBound : count < site.shape.fieldCount := by omega
+        have prefixSteps := ih (by omega)
+        let before : Machine :=
+          { machine with
+            control := .running
+              { definition
+                block := blockId
+                pc := count
+                values := fetchedPrefixValues parameters fields count
+                credits := #[] }
+              stack }
+        have instructionAt := site.fits.fetches count countBound
+        obtain ⟨pcBound, instruction⟩ :=
+          Array.getElem?_eq_some_iff.mp instructionAt
+        have resolved : resolveAtom
+            (fetchedPrefixValues parameters fields count)
+            (.reg site.shape.source) = .ok (.loc location) := by
+          simpa [fetchedPrefixValues, resolveAtom,
+            Array.getElem?_append, parameterCount,
+            site.fits.sourceBound] using sourceResolved
+        have fieldBound : count < fields.size := by
+          simpa [fieldCount] using countBound
+        have fieldAt : fields[count]? = some fields[count] :=
+          Array.getElem?_eq_some_iff.mpr ⟨fieldBound, rfl⟩
+        have step : Step context interpretation before
+            { before with
+              control := .running
+                { definition
+                  block := blockId
+                  pc := count + 1
+                  values := fetchedPrefixValues parameters fields (count + 1)
+                  credits := #[] }
+                stack } := by
+          have fetched := Step.fetch
+            (context := context) (interpretation := interpretation)
+            (machine := before)
+            (frame :=
+              { definition
+                block := blockId
+                pc := count
+                values := fetchedPrefixValues parameters fields count
+                credits := #[] })
+            (stack := stack) (block := block)
+            (atom := .reg site.shape.source)
+            (cid := site.shape.sourceConstructor) (field := count)
+            (location := location) (box := box) (fields := fields)
+            (value := fields[count]) rfl blockAt pcBound instruction resolved
+            (by simpa [before] using boxAt) node fieldAt
+          simpa [fetchedPrefixValues_succ fieldBound] using fetched
+        have one := step.toSteps (by rfl)
+        simpa [before, Nat.succ_eq_add_one] using prefixSteps.trans one
+  have result := loop site.shape.fieldCount (Nat.le_refl _)
+  have allFields : (fields.toList.take site.shape.fieldCount).toArray =
+      fields := by
+    rw [← fieldCount]
+    change (fields.toList.take fields.toList.length).toArray = fields
+    rw [List.take_length]
+  simpa [fetchedPrefixValues, allFields] using result
+
+private theorem retainedPrefix_push {parameters fields : Array RVal}
+    (processed : List RVal) (value : RVal) :
+    (parameters ++ fields ++ processed.toArray).push value =
+      parameters ++ fields ++ (processed ++ [value]).toArray := by
+  apply Array.toList_inj.mp
+  simp
+
+private theorem retainSuffixControl {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {blockId : BlockId}
+    {parameters fields : Array RVal} {processed remaining : List RVal}
+    {startStore finalStore : Store} {heapFuel : Nat}
+    {stack : List Continuation}
+    (blockAt : definition.blocks[blockId]? = some block)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (split : fields.toList = processed ++ remaining)
+    (retained : RetainSharedMany startStore remaining.toArray finalStore) :
+    Steps context interpretation remaining.length
+      { store := startStore
+        heapFuel
+        control := .running
+          { definition
+            block := blockId
+            pc := site.shape.fieldCount + processed.length
+            values := parameters ++ fields ++ processed.toArray
+            credits := #[] }
+          stack }
+      { store := finalStore
+        heapFuel
+        control := .running
+          { definition
+            block := blockId
+            pc := site.shape.fieldCount + (processed ++ remaining).length
+            values := parameters ++ fields ++
+              (processed ++ remaining).toArray
+            credits := #[] }
+          stack } := by
+  induction remaining generalizing processed startStore with
+  | nil =>
+      change (.ok startStore : Except Error Store) = .ok finalStore at retained
+      have storeEq := Except.ok.inj retained
+      subst finalStore
+      simpa using (Steps.refl
+        ({ store := startStore
+           heapFuel
+           control := .running
+             { definition
+               block := blockId
+               pc := site.shape.fieldCount + processed.length
+               values := parameters ++ fields ++ processed.toArray
+               credits := #[] }
+             stack } : Machine))
+  | cons value remaining ih =>
+      obtain ⟨middle, headRetained, tailRetained⟩ :=
+        RetainSharedMany.cons_inv retained
+      have fieldIndexBound : processed.length < site.shape.fieldCount := by
+        have lengths := congrArg List.length split
+        simp only [List.length_append, List.length_cons] at lengths
+        have fieldsLength : fields.toList.length = site.shape.fieldCount := by
+          simp [fieldCount]
+        omega
+      have fieldAt : fields[processed.length]? = some value := by
+        rw [Array.getElem?_eq_some_iff]
+        refine ⟨?_, ?_⟩
+        · simpa [fieldCount] using fieldIndexBound
+        · have listAt : fields.toList[processed.length]? = some value := by
+            rw [split, List.getElem?_append_right (Nat.le_refl _)]
+            simp
+          exact Option.some.inj
+            ((List.getElem?_eq_getElem (l := fields.toList)
+              (i := processed.length) (by simpa [fieldCount] using
+                fieldIndexBound)).symm.trans listAt)
+      have fieldEq : fields[processed.length] = value :=
+        (Array.getElem?_eq_some_iff.mp fieldAt).2
+      have resolved : resolveAtom
+          (parameters ++ fields ++ processed.toArray)
+          (.reg (site.shape.parameterCount + processed.length)) =
+          .ok value := by
+        simp [resolveAtom, Array.getElem?_append, parameterCount,
+          fieldCount, fieldIndexBound, fieldEq,
+          show ¬site.shape.parameterCount + processed.length <
+            site.shape.parameterCount by omega]
+      have instructionAt := site.fits.retains processed.length fieldIndexBound
+      obtain ⟨pcBound, instruction⟩ :=
+        Array.getElem?_eq_some_iff.mp instructionAt
+      let before : Machine :=
+        { store := startStore
+          heapFuel
+          control := .running
+            { definition
+              block := blockId
+              pc := site.shape.fieldCount + processed.length
+              values := parameters ++ fields ++ processed.toArray
+              credits := #[] }
+            stack }
+      let afterHead : Machine :=
+        { store := middle
+          heapFuel
+          control := .running
+            { definition
+              block := blockId
+              pc := site.shape.fieldCount + (processed ++ [value]).length
+              values := parameters ++ fields ++
+                (processed ++ [value]).toArray
+              credits := #[] }
+            stack }
+      have headStep : Step context interpretation before afterHead := by
+        have step := Step.retainShared
+          (context := context) (interpretation := interpretation)
+          (machine := before)
+          (frame :=
+            { definition
+              block := blockId
+              pc := site.shape.fieldCount + processed.length
+              values := parameters ++ fields ++ processed.toArray
+              credits := #[] })
+          (stack := stack) (block := block)
+          (atom := .reg (site.shape.parameterCount + processed.length))
+          (value := value) (store := middle) rfl blockAt pcBound instruction
+          resolved headRetained
+        simpa [before, afterHead, retainedPrefix_push, List.length_append,
+          Nat.add_assoc] using step
+      have tailSteps := ih (processed := processed ++ [value])
+        (startStore := middle) (by simpa [List.append_assoc] using split)
+        tailRetained
+      have one := headStep.toSteps (by rfl)
+      simpa [before, afterHead, List.append_assoc, Nat.add_comm] using
+        one.trans tailSteps
+
+/-- Execute every recognized retain after all fields have been fetched. -/
+theorem retainPrefixControl {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {blockId : BlockId}
+    {parameters fields : Array RVal} {store retainedStore : Store}
+    {heapFuel : Nat} {stack : List Continuation}
+    (blockAt : definition.blocks[blockId]? = some block)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (retained : RetainSharedMany store fields retainedStore) :
+    Steps context interpretation site.shape.fieldCount
+      { store
+        heapFuel
+        control := .running
+          { definition
+            block := blockId
+            pc := site.shape.fieldCount
+            values := parameters ++ fields
+            credits := #[] }
+          stack }
+      { store := retainedStore
+        heapFuel
+        control := .running
+          { definition
+            block := blockId
+            pc := 2 * site.shape.fieldCount
+            values := baselinePrefixValues parameters fields
+            credits := #[] }
+          stack } := by
+  have steps := retainSuffixControl site
+    (context := context) (interpretation := interpretation)
+    (definition := definition) (blockId := blockId)
+    (parameters := parameters) (fields := fields)
+    (processed := []) (remaining := fields.toList)
+    (startStore := store) (finalStore := retainedStore)
+    (heapFuel := heapFuel) (stack := stack) blockAt parameterCount
+    fieldCount (by simp) (by simpa using retained)
+  simpa [baselinePrefixValues, fieldCount, Nat.two_mul,
+    Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using steps
+
+/-- Execute the entire arbitrary-arity baseline block recognized at an
+accepted reuse site. -/
+theorem baselineAcceptedControl {limits : Validate.Limits}
+    {validation : Validate.Context} {block : Block}
+    (site : Reuse.Site limits validation block)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {blockId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {location : Nat} {box : IxIR1.NodeBox} {machine : Machine}
+    {retainedStore releasedStore : Store} {remaining : Nat}
+    {allocationSchema : CtorSchema} {stack : List Continuation}
+    (blockAt : definition.blocks[blockId]? = some block)
+    (control : machine.control = .running
+      { definition
+        block := blockId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (boxAt : machine.store.get? location = some box)
+    (node : box.node = .ctorN site.shape.sourceConstructor fields)
+    (retained : RetainSharedMany machine.store fields retainedStore)
+    (released : releaseShared machine.heapFuel retainedStore (.loc location) =
+      .ok (releasedStore, remaining))
+    (schemaAt : context.schemas .shared site.shape.allocationConstructor =
+      some allocationSchema)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds releasedStore allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (releasedStore.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let allocation := releasedStore.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps context interpretation (2 * site.shape.fieldCount + 3) machine
+      { store := allocation.1
+        heapFuel := remaining
+        control := .running { definition, values := callValues } stack } := by
+  dsimp only
+  let afterFetches : Machine :=
+    { machine with
+      control := .running
+        { definition
+          block := blockId
+          pc := site.shape.fieldCount
+          values := parameters ++ fields
+          credits := #[] }
+        stack }
+  let afterRetains : Machine :=
+    { store := retainedStore
+      heapFuel := machine.heapFuel
+      control := .running
+        { definition
+          block := blockId
+          pc := 2 * site.shape.fieldCount
+          values := baselinePrefixValues parameters fields
+          credits := #[] }
+        stack }
+  let afterRelease : Machine :=
+    { store := releasedStore
+      heapFuel := remaining
+      control := .running
+        { definition
+          block := blockId
+          pc := 2 * site.shape.fieldCount + 1
+          values := baselinePrefixValues parameters fields
+          credits := #[] }
+        stack }
+  let allocation := releasedStore.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let afterAllocation : Machine :=
+    { store := allocation.1
+      heapFuel := remaining
+      control := .running
+        { definition
+          block := blockId
+          pc := 2 * site.shape.fieldCount + 2
+          values := (baselinePrefixValues parameters fields).push
+            (.loc allocation.2)
+          credits := #[] }
+        stack }
+  have fetches : Steps context interpretation site.shape.fieldCount machine
+      afterFetches := by
+    simpa [afterFetches] using
+      fetchPrefixControl site blockAt control parameterCount fieldCount
+        sourceResolved boxAt node
+  have retains : Steps context interpretation site.shape.fieldCount
+      afterFetches afterRetains := by
+    simpa [afterFetches, afterRetains] using
+      retainPrefixControl site (context := context)
+        (interpretation := interpretation) (definition := definition)
+        (blockId := blockId) (parameters := parameters) (fields := fields)
+        (store := machine.store) (retainedStore := retainedStore)
+        (heapFuel := machine.heapFuel) (stack := stack) blockAt parameterCount
+        fieldCount retained
+  have prefixSteps : Steps context interpretation (2 * site.shape.fieldCount)
+      machine afterRetains := by
+    simpa [Nat.two_mul] using fetches.trans retains
+  have sourceResolvedAfter : resolveAtom
+      (baselinePrefixValues parameters fields) (.reg site.shape.source) =
+      .ok (.loc location) := by
+    simpa [baselinePrefixValues, resolveAtom, Array.getElem?_append,
+      parameterCount, site.fits.sourceBound] using sourceResolved
+  have releaseAt := site.fits.release
+  rw [site.fits.releasePosition] at releaseAt
+  obtain ⟨releasePc, releaseInstruction⟩ :=
+    Array.getElem?_eq_some_iff.mp releaseAt
+  have releaseStep : Step context interpretation afterRetains afterRelease := by
+    have step := Step.releaseShared
+      (context := context) (interpretation := interpretation)
+      (machine := afterRetains)
+      (frame :=
+        { definition
+          block := blockId
+          pc := 2 * site.shape.fieldCount
+          values := baselinePrefixValues parameters fields
+          credits := #[] })
+      (stack := stack) (block := block)
+      (atom := .reg site.shape.source) (value := .loc location)
+      (store := releasedStore) (heapFuel := remaining) rfl blockAt releasePc
+      releaseInstruction sourceResolvedAfter (by simpa [afterRetains] using
+        released)
+    simpa [afterRetains, afterRelease] using step
+  have allocationAt := site.fits.allocation
+  rw [site.fits.releasePosition] at allocationAt
+  obtain ⟨allocationPc, allocationInstruction⟩ :=
+    Array.getElem?_eq_some_iff.mp allocationAt
+  have allocationStep : Step context interpretation afterRelease
+      afterAllocation := by
+    have step := Step.alloc
+      (context := context) (interpretation := interpretation)
+      (machine := afterRelease)
+      (frame :=
+        { definition
+          block := blockId
+          pc := 2 * site.shape.fieldCount + 1
+          values := baselinePrefixValues parameters fields
+          credits := #[] })
+      (stack := stack) (block := block) (world := .shared)
+      (cid := site.shape.allocationConstructor)
+      (arguments := site.shape.allocationArguments)
+      (schema := allocationSchema) (values := newFields) rfl blockAt
+      allocationPc allocationInstruction schemaAt allocationResolved
+      (by simpa [afterRelease] using fieldWorlds)
+    simpa [afterRelease, afterAllocation, allocation] using step
+  have tailStep : Step context interpretation afterAllocation
+      { store := allocation.1
+        heapFuel := remaining
+        control := .running { definition, values := callValues } stack } := by
+    apply Step.tailCallSelf
+      (frame :=
+        { definition
+          block := blockId
+          pc := 2 * site.shape.fieldCount + 2
+          values := (baselinePrefixValues parameters fields).push
+            (.loc allocation.2)
+          credits := #[] })
+      (stack := stack) (block := block)
+      (arguments := site.shape.tailArguments) (values := callValues)
+    · rfl
+    · simpa [afterAllocation] using blockAt
+    · exact site.fits.instructionCount.symm
+    · exact site.fits.terminator
+    · rfl
+    · simpa [allocation] using tailResolved
+    · exact arity
+    · exact nonempty
+  have releaseOne := releaseStep.toSteps (by rfl)
+  have allocationOne := allocationStep.toSteps (by rfl)
+  have tailOne := tailStep.toSteps (by rfl)
+  simpa [allocation] using
+    ((prefixSteps.trans releaseOne).trans allocationOne).trans tailOne
+
+/-! ## Concrete hot-path stores -/
+
+/-- Store produced by the logical unit-refcount arm of `resetShared`. -/
+def logicalHotResetStore (store : Store) (location : Nat) : Store :=
+  ((store.tickResetAttempt).kill location).tickHotReset
+
+/-- Store produced by the physical unit-refcount arm of `resetShared`. -/
+def physicalHotResetStore (store : Store) (location : Nat) : Store :=
+  ((store.tickResetAttempt).reserve location).tickHotReset
+
+/-- Logical consumption of a present credit allocates the replacement at a
+fresh location. -/
+def logicalHotReuseStore (store : Store) (location : Nat)
+    (node : IxIR1.Node) : Store × Nat :=
+  (logicalHotResetStore store location).allocNode .shared node
+
+/-- Physical consumption of a present credit revives the reserved source
+slot. -/
+def physicalHotReuseStore (store : Store) (location : Nat)
+    (node : IxIR1.Node) (payloadUnits : Nat) : Except Error Store :=
+  (physicalHotResetStore store location).reuseReservation location .shared
+    node payloadUnits
+
+/-! ## Baseline shared-release algebra -/
+
+/-- The store update performed when a shared release sees more than one
+owner.  Keeping this operation explicit lets the cold-reset proof commute a
+parent decrement with the batch of field retains. -/
+def baselineDecrementStore (store : Store) (location : Nat)
+    (box : IxIR1.NodeBox) : Store :=
+  store.rcTick.setBox location { box with rc := box.rc - 1 }
+
+/-- The successful location branch of one shared retain. -/
+def incrementSharedStore (store : Store) (location : Nat)
+    (box : IxIR1.NodeBox) : Store :=
+  (store.setBox location { box with rc := box.rc + 1 }).rcTick
+
+@[simp] theorem baselineDecrementStore_heap (store : Store)
+    (location : Nat) (box : IxIR1.NodeBox) :
+    (baselineDecrementStore store location box).heap =
+      IxIR1.Sim.decRcStore store.heap location box := by
+  rfl
+
+@[simp] theorem incrementSharedStore_heap (store : Store)
+    (location : Nat) (box : IxIR1.NodeBox) :
+    (incrementSharedStore store location box).heap =
+      IxIR1.Sim.incRcStore store.heap location box := by
+  rfl
+
+theorem get?_baselineDecrementStore_same {store : Store} {location : Nat}
+    {box : IxIR1.NodeBox} (hget : store.get? location = some box) :
+    (baselineDecrementStore store location box).get? location =
+      some { box with rc := box.rc - 1 } := by
+  exact IxIR1.Sim.get?_decRcStore_same hget
+
+theorem get?_baselineDecrementStore_other {store : Store}
+    {location other : Nat} {box otherBox : IxIR1.NodeBox}
+    (hne : location ≠ other) (hlive : store.get? location = some box)
+    (hget : store.get? other = some otherBox) :
+    (baselineDecrementStore store location box).get? other =
+      some otherBox := by
+  exact IxIR1.Sim.get?_decRcStore_other hne hlive hget
+
+theorem get?_incrementSharedStore_same {store : Store} {location : Nat}
+    {box : IxIR1.NodeBox} (hget : store.get? location = some box) :
+    (incrementSharedStore store location box).get? location =
+      some { box with rc := box.rc + 1 } := by
+  exact IxIR1.Sim.get?_incRcStore_same hget
+
+theorem get?_incrementSharedStore_other {store : Store}
+    {location other : Nat} {box otherBox : IxIR1.NodeBox}
+    (hne : location ≠ other) (hlive : store.get? location = some box)
+    (hget : store.get? other = some otherBox) :
+    (incrementSharedStore store location box).get? other = some otherBox := by
+  exact IxIR1.Sim.get?_incRcStore_other hne hlive hget
+
+theorem get?_of_incrementSharedStore_other {store : Store}
+    {location other : Nat} {box otherBox : IxIR1.NodeBox}
+    (hne : location ≠ other) (hlive : store.get? location = some box)
+    (hget : (incrementSharedStore store location box).get? other =
+      some otherBox) :
+    store.get? other = some otherBox := by
+  exact IxIR1.Sim.get?_of_incRcStore_other hne hlive hget
+
+private theorem increment_increment_other (store : Store)
+    (first second : Nat) (firstBox secondBox : IxIR1.NodeBox)
+    (hne : first ≠ second) :
+    incrementSharedStore
+        (incrementSharedStore store first firstBox) second secondBox =
+      incrementSharedStore
+        (incrementSharedStore store second secondBox) first firstBox := by
+  cases store with
+  | mk heap resetAttempts hotResets coldResets reusedPayloadUnits peakLiveNodes =>
+      cases heap with
+      | mk nodes allocs reuses frees rcops =>
+          simp only [incrementSharedStore, Eval.Store.rcTick,
+            Eval.Store.setBox, IxIR1.Store.rcTick, IxIR1.Store.setBox,
+            Array.set!_eq_setIfInBounds]
+          congr 2
+          exact Array.setIfInBounds_comm _ _ hne
+
+private theorem decrement_increment_other (store : Store)
+    (target child : Nat) (targetBox childBox : IxIR1.NodeBox)
+    (hne : child ≠ target) :
+    baselineDecrementStore
+        (incrementSharedStore store child childBox) target targetBox =
+      incrementSharedStore
+        (baselineDecrementStore store target targetBox) child childBox := by
+  cases store with
+  | mk heap resetAttempts hotResets coldResets reusedPayloadUnits peakLiveNodes =>
+      cases heap with
+      | mk nodes allocs reuses frees rcops =>
+          simp only [baselineDecrementStore, incrementSharedStore,
+            Eval.Store.rcTick, Eval.Store.setBox, IxIR1.Store.rcTick,
+            IxIR1.Store.setBox, Array.set!_eq_setIfInBounds]
+          congr 2
+          exact Array.setIfInBounds_comm _ _ hne
+
+private theorem decrement_increment_same (store : Store) (target rc : Nat)
+    (node : IxIR1.Node) (hmany : 1 < rc) :
+    baselineDecrementStore
+        (incrementSharedStore store target ⟨.shared, rc, node⟩) target
+        ⟨.shared, rc + 1, node⟩ =
+      incrementSharedStore
+        (baselineDecrementStore store target ⟨.shared, rc, node⟩) target
+        ⟨.shared, rc - 1, node⟩ := by
+  cases store with
+  | mk heap resetAttempts hotResets coldResets reusedPayloadUnits peakLiveNodes =>
+      cases heap with
+      | mk nodes allocs reuses frees rcops =>
+          simp only [baselineDecrementStore, incrementSharedStore,
+            Eval.Store.rcTick, Eval.Store.setBox, IxIR1.Store.rcTick,
+            IxIR1.Store.setBox, Array.set!_eq_setIfInBounds,
+            Array.setIfInBounds_setIfInBounds]
+          have hsub : rc - 1 + 1 = rc := Nat.sub_add_cancel (by omega)
+          simp [hsub]
+
+/-- Successful shared retains commute.  Besides supporting the hot-prefix
+cancellation proof, this records that the compiler may retain projected
+fields in any order without changing the resulting store. -/
+theorem retainShared_commute {store afterFirst final : Store}
+    {first second : RVal}
+    (firstRun : retainShared store first = .ok afterFirst)
+    (secondRun : retainShared afterFirst second = .ok final) :
+    ∃ afterSecond,
+      retainShared store second = .ok afterSecond ∧
+      retainShared afterSecond first = .ok final := by
+  cases first with
+  | lit literal =>
+      have storeEq : store = afterFirst := by
+        simpa [retainShared] using firstRun
+      subst afterFirst
+      exact ⟨final, secondRun, by simp [retainShared]⟩
+  | erased =>
+      have storeEq : store = afterFirst := by
+        simpa [retainShared] using firstRun
+      subst afterFirst
+      exact ⟨final, secondRun, by simp [retainShared]⟩
+  | loc firstLocation =>
+      cases firstAt : store.get? firstLocation with
+      | none => simp [retainShared, firstAt] at firstRun
+      | some firstBox =>
+          cases firstBox with
+          | mk firstWorld firstRc firstNode =>
+              cases firstWorld with
+              | unique => simp [retainShared, firstAt] at firstRun
+              | shared =>
+                  have afterFirstEq :
+                      incrementSharedStore store firstLocation
+                        ⟨.shared, firstRc, firstNode⟩ = afterFirst := by
+                    simpa [retainShared, firstAt, incrementSharedStore] using
+                      firstRun
+                  subst afterFirst
+                  cases second with
+                  | lit literal =>
+                      have finalEq :
+                          incrementSharedStore store firstLocation
+                            ⟨.shared, firstRc, firstNode⟩ = final := by
+                        simpa [retainShared] using secondRun
+                      subst final
+                      exact ⟨store, by simp [retainShared], firstRun⟩
+                  | erased =>
+                      have finalEq :
+                          incrementSharedStore store firstLocation
+                            ⟨.shared, firstRc, firstNode⟩ = final := by
+                        simpa [retainShared] using secondRun
+                      subst final
+                      exact ⟨store, by simp [retainShared], firstRun⟩
+                  | loc secondLocation =>
+                      by_cases same : firstLocation = secondLocation
+                      · subst secondLocation
+                        exact ⟨incrementSharedStore store firstLocation
+                            ⟨.shared, firstRc, firstNode⟩,
+                          firstRun, secondRun⟩
+                      · cases secondAt :
+                            (incrementSharedStore store firstLocation
+                              ⟨.shared, firstRc, firstNode⟩).get?
+                                secondLocation with
+                        | none => simp [retainShared, secondAt] at secondRun
+                        | some secondBox =>
+                            cases secondBox with
+                            | mk secondWorld secondRc secondNode =>
+                                cases secondWorld with
+                                | unique =>
+                                    simp [retainShared, secondAt] at secondRun
+                                | shared =>
+                                    have finalEq :
+                                        incrementSharedStore
+                                            (incrementSharedStore store
+                                              firstLocation
+                                              ⟨.shared, firstRc, firstNode⟩)
+                                            secondLocation
+                                            ⟨.shared, secondRc, secondNode⟩ =
+                                          final := by
+                                      simp only [retainShared] at secondRun
+                                      rw [secondAt] at secondRun
+                                      simpa [incrementSharedStore] using secondRun
+                                    subst final
+                                    have secondOriginal :=
+                                      get?_of_incrementSharedStore_other same
+                                        firstAt secondAt
+                                    let afterSecond :=
+                                      incrementSharedStore store secondLocation
+                                        ⟨.shared, secondRc, secondNode⟩
+                                    have runSecond :
+                                        retainShared store (.loc secondLocation) =
+                                          .ok afterSecond := by
+                                      simp [retainShared, secondOriginal,
+                                        afterSecond, incrementSharedStore]
+                                    have firstAfterSecond :=
+                                      get?_incrementSharedStore_other
+                                        (Ne.symm same) secondOriginal firstAt
+                                    refine ⟨afterSecond, runSecond, ?_⟩
+                                    have runFirst :
+                                        retainShared afterSecond
+                                            (.loc firstLocation) =
+                                          .ok (incrementSharedStore afterSecond
+                                            firstLocation
+                                            ⟨.shared, firstRc, firstNode⟩) := by
+                                      simp only [retainShared]
+                                      rw [firstAfterSecond]
+                                      rfl
+                                    rw [runFirst]
+                                    exact congrArg Except.ok
+                                      (increment_increment_other store
+                                        firstLocation secondLocation
+                                        ⟨.shared, firstRc, firstNode⟩
+                                        ⟨.shared, secondRc, secondNode⟩
+                                        same).symm
+
+/-- Rotate the first retain of a successful batch to the end.  This is the
+algebraic normalization used by the hot proof to place one retain directly
+beside the matching release. -/
+theorem RetainSharedMany.rotate_head {store target : Store}
+    {head : RVal} {tail : List RVal}
+    (run : RetainSharedMany store (head :: tail).toArray target) :
+    ∃ middle,
+      RetainSharedMany store tail.toArray middle ∧
+      retainShared middle head = .ok target := by
+  induction tail generalizing store target head with
+  | nil =>
+      obtain ⟨afterHead, headRun, emptyRun⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      change (.ok afterHead : Except Error Store) = .ok target at emptyRun
+      injection emptyRun with targetEq
+      subst target
+      exact ⟨store, RetainSharedMany.empty _, headRun⟩
+  | cons second rest ih =>
+      obtain ⟨afterHead, headRun, tailRun⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      obtain ⟨afterBoth, secondRun, restRun⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := tailRun)
+      obtain ⟨afterSecond, secondFirst, headSecond⟩ :=
+        retainShared_commute headRun secondRun
+      have rotatedInput :
+          RetainSharedMany afterSecond (head :: rest).toArray target :=
+        RetainSharedMany.cons headSecond restRun
+      obtain ⟨middle, restFirst, headLast⟩ := ih rotatedInput
+      exact ⟨middle, RetainSharedMany.cons secondFirst restFirst, headLast⟩
+
+/-- Retaining a value other than `target` leaves the target box exactly
+unchanged. -/
+theorem retainShared_preserves_box {store retained : Store}
+    {target : Nat} {targetBox : IxIR1.NodeBox} {value : RVal}
+    (targetAt : store.get? target = some targetBox)
+    (different : value ≠ .loc target)
+    (run : retainShared store value = .ok retained) :
+    retained.get? target = some targetBox := by
+  cases value with
+  | lit literal =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      exact targetAt
+  | erased =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      exact targetAt
+  | loc location =>
+      have locationNe : location ≠ target := by
+        intro same
+        subst location
+        exact different rfl
+      cases valueAt : store.get? location with
+      | none => simp [retainShared, valueAt] at run
+      | some valueBox =>
+          cases valueBox with
+          | mk world rc node =>
+              cases world with
+              | unique => simp [retainShared, valueAt] at run
+              | shared =>
+                  have retainedEq :
+                      incrementSharedStore store location
+                        ⟨.shared, rc, node⟩ = retained := by
+                    simpa [retainShared, valueAt, incrementSharedStore] using run
+                  subst retained
+                  exact get?_incrementSharedStore_other locationNe valueAt
+                    targetAt
+
+/-- A batch of retains leaves an unrelated box exactly unchanged. -/
+theorem RetainSharedMany.preserves_box {store retained : Store}
+    {target : Nat} {targetBox : IxIR1.NodeBox} {values : List RVal}
+    (targetAt : store.get? target = some targetBox)
+    (different : ∀ value ∈ values, value ≠ .loc target)
+    (run : RetainSharedMany store values.toArray retained) :
+    retained.get? target = some targetBox := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except Error Store) = .ok retained at run
+      injection run with storeEq
+      subst retained
+      exact targetAt
+  | cons value values ih =>
+      obtain ⟨middle, head, tail⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      have middleAt := retainShared_preserves_box targetAt
+        (different value (by simp)) head
+      exact ih middleAt (fun candidate member =>
+        different candidate (by simp [member])) tail
+
+private theorem kill_increment_other (store : Store) (target child : Nat)
+    (box : IxIR1.NodeBox) (hne : child ≠ target) :
+    (incrementSharedStore store child box).kill target =
+      incrementSharedStore (store.kill target) child box := by
+  cases store with
+  | mk heap resetAttempts hotResets coldResets reusedPayloadUnits peakLiveNodes =>
+      cases heap with
+      | mk nodes allocs reuses frees rcops =>
+          simp only [incrementSharedStore, Eval.Store.kill,
+            Eval.Store.setBox, Eval.Store.rcTick, IxIR1.Store.kill,
+            IxIR1.Store.setBox, IxIR1.Store.rcTick,
+            Array.set!_eq_setIfInBounds]
+          congr 2
+          exact Array.setIfInBounds_comm _ _ hne
+
+/-- A retain of a non-parent value commutes with killing the parent. -/
+theorem retainShared_kill_commute {store retained : Store}
+    {target : Nat} {targetBox : IxIR1.NodeBox} {value : RVal}
+    (targetAt : store.get? target = some targetBox)
+    (different : value ≠ .loc target)
+    (run : retainShared store value = .ok retained) :
+    retainShared (store.kill target) value = .ok (retained.kill target) := by
+  cases value with
+  | lit literal =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      rfl
+  | erased =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      rfl
+  | loc location =>
+      have locationNe : location ≠ target := by
+        intro same
+        subst location
+        exact different rfl
+      cases valueAt : store.get? location with
+      | none => simp [retainShared, valueAt] at run
+      | some valueBox =>
+          cases valueBox with
+          | mk world rc node =>
+              cases world with
+              | unique => simp [retainShared, valueAt] at run
+              | shared =>
+                  have retainedEq :
+                      incrementSharedStore store location
+                        ⟨.shared, rc, node⟩ = retained := by
+                    simpa [retainShared, valueAt, incrementSharedStore] using run
+                  subst retained
+                  have valueAfterKill : (store.kill target).get? location =
+                      some ⟨.shared, rc, node⟩ :=
+                    IxIR1.Sim.get?_kill_other (Ne.symm locationNe) targetAt
+                      valueAt
+                  rw [show retainShared (store.kill target) (.loc location) =
+                      .ok (incrementSharedStore (store.kill target) location
+                        ⟨.shared, rc, node⟩) by
+                    simp [retainShared, valueAfterKill, incrementSharedStore]]
+                  exact congrArg Except.ok
+                    (kill_increment_other store target location
+                      ⟨.shared, rc, node⟩ locationNe).symm
+
+/-- Batch field retention commutes with killing an unrelated parent. -/
+theorem RetainSharedMany.kill_commute {store retained : Store}
+    {target : Nat} {targetBox : IxIR1.NodeBox} {values : List RVal}
+    (targetAt : store.get? target = some targetBox)
+    (different : ∀ value ∈ values, value ≠ .loc target)
+    (run : RetainSharedMany store values.toArray retained) :
+    RetainSharedMany (store.kill target) values.toArray
+      (retained.kill target) := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except Error Store) = .ok retained at run
+      injection run with storeEq
+      subst retained
+      exact RetainSharedMany.empty _
+  | cons value values ih =>
+      obtain ⟨middle, head, tail⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      have valueDifferent := different value (by simp)
+      have headKilled := retainShared_kill_commute targetAt valueDifferent head
+      have middleAt := retainShared_preserves_box targetAt valueDifferent head
+      have tailKilled := ih middleAt (fun candidate member =>
+        different candidate (by simp [member])) tail
+      exact RetainSharedMany.cons headKilled tailKilled
+
+/-- One successful field retain commutes with the non-final decrement of a
+shared parent.  The result also exposes the parent's updated box so the
+statement can be iterated when a field aliases the parent. -/
+theorem retainShared_decrement_commute {store retained : Store}
+    {target rc : Nat} {node : IxIR1.Node} {value : RVal}
+    (hget : store.get? target = some ⟨.shared, rc, node⟩)
+    (hmany : 1 < rc)
+    (hretain : retainShared store value = .ok retained) :
+    ∃ retainedRc,
+      retained.get? target = some ⟨.shared, retainedRc, node⟩ ∧
+      1 < retainedRc ∧
+      retainShared
+          (baselineDecrementStore store target ⟨.shared, rc, node⟩)
+          value =
+        .ok (baselineDecrementStore retained target
+          ⟨.shared, retainedRc, node⟩) := by
+  cases value with
+  | lit literal =>
+      simp [retainShared] at hretain
+      subst retained
+      exact ⟨rc, hget, hmany, rfl⟩
+  | erased =>
+      simp [retainShared] at hretain
+      subst retained
+      exact ⟨rc, hget, hmany, rfl⟩
+  | loc child =>
+      cases hchild : store.get? child with
+      | none => simp [retainShared, hchild] at hretain
+      | some childBox =>
+          cases childBox with
+          | mk childWorld childRc childNode =>
+              cases childWorld with
+              | unique => simp [retainShared, hchild] at hretain
+              | shared =>
+                  have retainedEq :
+                      incrementSharedStore store child
+                          ⟨.shared, childRc, childNode⟩ = retained := by
+                    simpa [retainShared, hchild, incrementSharedStore] using
+                      hretain
+                  subst retained
+                  by_cases heq : child = target
+                  · subst child
+                    have boxEq :
+                        (⟨.shared, childRc, childNode⟩ : IxIR1.NodeBox) =
+                          ⟨.shared, rc, node⟩ :=
+                      Option.some.inj (hchild.symm.trans hget)
+                    cases boxEq
+                    refine ⟨rc + 1,
+                      get?_incrementSharedStore_same hget,
+                      by omega, ?_⟩
+                    have decremented := get?_baselineDecrementStore_same hget
+                    rw [show retainShared
+                        (baselineDecrementStore store target
+                          ⟨.shared, rc, node⟩) (.loc target) =
+                        .ok (incrementSharedStore
+                          (baselineDecrementStore store target
+                            ⟨.shared, rc, node⟩) target
+                          ⟨.shared, rc - 1, node⟩) by
+                      simp [retainShared, decremented, incrementSharedStore]]
+                    exact congrArg Except.ok
+                      (decrement_increment_same store target rc node hmany).symm
+                  · refine ⟨rc,
+                      get?_incrementSharedStore_other heq hchild hget,
+                      hmany, ?_⟩
+                    have childAfter := get?_baselineDecrementStore_other
+                      (Ne.symm heq) hget hchild
+                    rw [show retainShared
+                        (baselineDecrementStore store target
+                          ⟨.shared, rc, node⟩) (.loc child) =
+                        .ok (incrementSharedStore
+                          (baselineDecrementStore store target
+                            ⟨.shared, rc, node⟩) child
+                          ⟨.shared, childRc, childNode⟩) by
+                      simp [retainShared, childAfter, incrementSharedStore]]
+                    exact congrArg Except.ok
+                      (decrement_increment_other store target child
+                        ⟨.shared, rc, node⟩
+                        ⟨.shared, childRc, childNode⟩ heq).symm
+
+/-- A whole successful field-retain prefix commutes with a non-final parent
+decrement.  The theorem permits repeated fields and even a parent-valued
+field; the updated parent box is threaded explicitly through the induction. -/
+theorem RetainSharedMany.decrement_commute {store retained : Store}
+    {target rc : Nat} {node : IxIR1.Node} {values : List RVal}
+    (hget : store.get? target = some ⟨.shared, rc, node⟩)
+    (hmany : 1 < rc)
+    (run : RetainSharedMany store values.toArray retained) :
+    ∃ retainedRc,
+      retained.get? target = some ⟨.shared, retainedRc, node⟩ ∧
+      1 < retainedRc ∧
+      RetainSharedMany
+        (baselineDecrementStore store target ⟨.shared, rc, node⟩)
+        values.toArray
+        (baselineDecrementStore retained target
+          ⟨.shared, retainedRc, node⟩) := by
+  induction values generalizing store retained rc node with
+  | nil =>
+      change (.ok store : Except Error Store) = .ok retained at run
+      injection run with storeEq
+      subst retained
+      exact ⟨rc, hget, hmany, RetainSharedMany.empty _⟩
+  | cons value values ih =>
+      obtain ⟨middle, head, tail⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      obtain ⟨middleRc, middleAt, middleMany, headCommutes⟩ :=
+        retainShared_decrement_commute hget hmany head
+      obtain ⟨retainedRc, retainedAt, retainedMany, tailCommutes⟩ :=
+        ih middleAt middleMany tail
+      exact ⟨retainedRc, retainedAt, retainedMany,
+        RetainSharedMany.cons headCommutes tailCommutes⟩
+
+/-- Reset-attempt accounting commutes with a successful shared retain. -/
+theorem retainShared_tickResetAttempt {store retained : Store}
+    {value : RVal} (run : retainShared store value = .ok retained) :
+    retainShared store.tickResetAttempt value =
+      .ok retained.tickResetAttempt := by
+  cases value with
+  | lit literal =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      rfl
+  | erased =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      rfl
+  | loc location =>
+      cases hget : store.get? location with
+      | none => simp [retainShared, hget] at run
+      | some box =>
+          cases box with
+          | mk world rc node =>
+              cases world with
+              | unique => simp [retainShared, hget] at run
+              | shared =>
+                  have retainedEq :
+                      incrementSharedStore store location
+                        ⟨.shared, rc, node⟩ = retained := by
+                    simpa [retainShared, hget, incrementSharedStore] using run
+                  subst retained
+                  have heapGet : store.heap.get? location =
+                      some ⟨.shared, rc, node⟩ := hget
+                  simp [retainShared, heapGet, incrementSharedStore,
+                    Eval.Store.tickResetAttempt, Eval.Store.get?,
+                    Eval.Store.setBox, Eval.Store.rcTick]
+
+/-- Cold-reset accounting commutes with a successful shared retain. -/
+theorem retainShared_tickColdReset {store retained : Store}
+    {value : RVal} (run : retainShared store value = .ok retained) :
+    retainShared store.tickColdReset value =
+      .ok retained.tickColdReset := by
+  cases value with
+  | lit literal =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      rfl
+  | erased =>
+      have storeEq : store = retained := by
+        simpa [retainShared] using run
+      subst retained
+      rfl
+  | loc location =>
+      cases hget : store.get? location with
+      | none => simp [retainShared, hget] at run
+      | some box =>
+          cases box with
+          | mk world rc node =>
+              cases world with
+              | unique => simp [retainShared, hget] at run
+              | shared =>
+                  have retainedEq :
+                      incrementSharedStore store location
+                        ⟨.shared, rc, node⟩ = retained := by
+                    simpa [retainShared, hget, incrementSharedStore] using run
+                  subst retained
+                  have heapGet : store.heap.get? location =
+                      some ⟨.shared, rc, node⟩ := hget
+                  simp [retainShared, heapGet, incrementSharedStore,
+                    Eval.Store.tickColdReset, Eval.Store.get?,
+                    Eval.Store.setBox, Eval.Store.rcTick]
+
+/-- Batch field retention is insensitive to when reset-attempt accounting is
+recorded. -/
+theorem RetainSharedMany.tickResetAttempt {store retained : Store}
+    {values : List RVal}
+    (run : RetainSharedMany store values.toArray retained) :
+    RetainSharedMany store.tickResetAttempt values.toArray
+      retained.tickResetAttempt := by
+  induction values generalizing store retained with
+  | nil =>
+      change (.ok store : Except Error Store) = .ok retained at run
+      injection run with storeEq
+      subst retained
+      exact RetainSharedMany.empty _
+  | cons value values ih =>
+      obtain ⟨middle, head, tail⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      exact RetainSharedMany.cons
+        (retainShared_tickResetAttempt head) (ih tail)
+
+/-- Batch field retention is insensitive to when cold-reset accounting is
+recorded. -/
+theorem RetainSharedMany.tickColdReset {store retained : Store}
+    {values : List RVal}
+    (run : RetainSharedMany store values.toArray retained) :
+    RetainSharedMany store.tickColdReset values.toArray
+      retained.tickColdReset := by
+  induction values generalizing store retained with
+  | nil =>
+      change (.ok store : Except Error Store) = .ok retained at run
+      injection run with storeEq
+      subst retained
+      exact RetainSharedMany.empty _
+  | cons value values ih =>
+      obtain ⟨middle, head, tail⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      exact RetainSharedMany.cons
+        (retainShared_tickColdReset head) (ih tail)
+
+/-! ## Counter-insensitive heap congruence -/
+
+/-- Exact semantic heap state, deliberately forgetting allocation/reset cost
+counters.  Unlike `HeapIso`, this relation keeps location identities fixed;
+it is the right intermediate relation for cancellation of baseline RC
+traffic. -/
+structure HeapContentsEq (left right : Store) : Prop where
+  nodes : left.heap.nodes = right.heap.nodes
+
+namespace HeapContentsEq
+
+theorem refl (store : Store) : HeapContentsEq store store := ⟨rfl⟩
+
+theorem symm {left right : Store} (h : HeapContentsEq left right) :
+    HeapContentsEq right left := ⟨h.nodes.symm⟩
+
+theorem trans {first second third : Store}
+    (h₁ : HeapContentsEq first second) (h₂ : HeapContentsEq second third) :
+    HeapContentsEq first third := ⟨h₁.nodes.trans h₂.nodes⟩
+
+theorem get?_eq {left right : Store} (h : HeapContentsEq left right)
+    (location : Nat) : left.get? location = right.get? location := by
+  simp [Eval.Store.get?, IxIR1.Store.get?, h.nodes]
+
+/-- Exact heap contents make dynamic ownership-world checks identical at a
+fixed runtime value. -/
+theorem rvalHasWorld_eq {left right : Store} (h : HeapContentsEq left right)
+    (world : Owned) (value : RVal) :
+    RVal.hasWorld left world value = RVal.hasWorld right world value := by
+  cases value with
+  | loc location =>
+      simp [RVal.hasWorld, h.get?_eq location]
+  | lit literal => rfl
+  | erased => rfl
+
+/-- Field validation transports across counter-insensitive exact heap
+contents without a second executable checker premise. -/
+theorem fieldWorlds {left right : Store} (h : HeapContentsEq left right)
+    {schema : CtorSchema} {values : Array RVal}
+    (worlds : FieldWorlds left schema values) :
+    FieldWorlds right schema values :=
+  FieldWorlds.congrStore
+    (fun world value => h.rvalHasWorld_eq world value) worlds
+
+theorem fieldWorlds_iff {left right : Store} (h : HeapContentsEq left right)
+    {schema : CtorSchema} {values : Array RVal} :
+    FieldWorlds left schema values ↔ FieldWorlds right schema values :=
+  ⟨h.fieldWorlds, h.symm.fieldWorlds⟩
+
+/-- Constructor views are preserved at fixed locations. -/
+theorem constructorView {left right : Store} (h : HeapContentsEq left right)
+    {location : Nat} {world : Owned} {cid : CtorId}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (viewed : ConstructorView left location world cid box fields) :
+    ConstructorView right location world cid box fields :=
+  ConstructorView.congrStore (h.get?_eq location) viewed
+
+/-- One successful shared retain is congruent under exact semantic heap
+contents, including its refcount update. -/
+theorem retainShared {left right leftOut : Store}
+    (h : HeapContentsEq left right) {value : RVal}
+    (run : Eval.retainShared left value = .ok leftOut) :
+    ∃ rightOut,
+      Eval.retainShared right value = .ok rightOut ∧
+      HeapContentsEq leftOut rightOut := by
+  cases value with
+  | lit literal =>
+      have leftEq : left = leftOut := by
+        simpa [Eval.retainShared] using run
+      subst leftOut
+      exact ⟨right, by simp [Eval.retainShared], h⟩
+  | erased =>
+      have leftEq : left = leftOut := by
+        simpa [Eval.retainShared] using run
+      subst leftOut
+      exact ⟨right, by simp [Eval.retainShared], h⟩
+  | loc location =>
+      cases leftAt : left.get? location with
+      | none => simp [Eval.retainShared, leftAt] at run
+      | some box =>
+          have rightAt : right.get? location = some box := by
+            rw [← h.get?_eq location]
+            exact leftAt
+          cases box with
+          | mk boxWorld rc node =>
+              cases boxWorld with
+              | unique => simp [Eval.retainShared, leftAt] at run
+              | shared =>
+                  have leftOutEq :
+                      (left.setBox location
+                        ⟨.shared, rc + 1, node⟩).rcTick = leftOut := by
+                    simpa [Eval.retainShared, leftAt] using run
+                  subst leftOut
+                  refine ⟨(right.setBox location
+                    ⟨.shared, rc + 1, node⟩).rcTick, ?_, ?_⟩
+                  · simp [Eval.retainShared, rightAt]
+                  · constructor
+                    simp [Eval.Store.setBox, Eval.Store.rcTick,
+                      IxIR1.Store.setBox, IxIR1.Store.rcTick, h.nodes]
+
+/-- Batch shared retain is congruent under exact semantic heap contents. -/
+theorem retainSharedMany {left right leftOut : Store}
+    (h : HeapContentsEq left right) {values : Array RVal}
+    (run : RetainSharedMany left values leftOut) :
+    ∃ rightOut,
+      RetainSharedMany right values rightOut ∧
+      HeapContentsEq leftOut rightOut := by
+  have loop : ∀ (entries : List RVal) {left right leftOut : Store},
+      HeapContentsEq left right →
+      RetainSharedMany left entries.toArray leftOut →
+      ∃ rightOut,
+        RetainSharedMany right entries.toArray rightOut ∧
+        HeapContentsEq leftOut rightOut := by
+    intro entries
+    induction entries with
+    | nil =>
+        intro left right leftOut contents retained
+        change (.ok left : Except Error Store) = .ok leftOut at retained
+        injection retained with leftEq
+        subst leftOut
+        exact ⟨right, rfl, contents⟩
+    | cons head tail ih =>
+        intro left right leftOut contents retained
+        obtain ⟨leftMiddle, headRun, tailRun⟩ :=
+          Eval.RetainSharedMany.cons_inv (run := retained)
+        obtain ⟨rightMiddle, rightHead, middleContents⟩ :=
+          contents.retainShared headRun
+        obtain ⟨rightOut, rightTail, finalContents⟩ :=
+          ih middleContents tailRun
+        exact ⟨rightOut,
+          Eval.RetainSharedMany.cons rightHead rightTail, finalContents⟩
+  have normalized :
+      RetainSharedMany left values.toList.toArray leftOut := by
+    simpa using run
+  obtain ⟨rightOut, rightRun, contents⟩ :=
+    loop values.toList h normalized
+  exact ⟨rightOut, by simpa using rightRun, contents⟩
+
+theorem rcTick {left right : Store} (h : HeapContentsEq left right) :
+    HeapContentsEq left.rcTick right.rcTick := by
+  exact ⟨h.nodes⟩
+
+theorem setBox {left right : Store} (h : HeapContentsEq left right)
+    (location : Nat) (box : IxIR1.NodeBox) :
+    HeapContentsEq (left.setBox location box) (right.setBox location box) := by
+  constructor
+  simp [Eval.Store.setBox, IxIR1.Store.setBox, h.nodes]
+
+theorem kill {left right : Store} (h : HeapContentsEq left right)
+    (location : Nat) :
+    HeapContentsEq (left.kill location) (right.kill location) := by
+  constructor
+  simp [Eval.Store.kill, IxIR1.Store.kill, h.nodes]
+
+theorem reserve {left right : Store} (h : HeapContentsEq left right)
+    (location : Nat) :
+    HeapContentsEq (left.reserve location) (right.reserve location) := by
+  constructor
+  simp [Eval.Store.reserve, h.nodes]
+
+theorem tickResetAttempt {left right : Store}
+    (h : HeapContentsEq left right) :
+    HeapContentsEq left.tickResetAttempt right.tickResetAttempt :=
+  ⟨h.nodes⟩
+
+theorem tickHotReset {left right : Store} (h : HeapContentsEq left right) :
+    HeapContentsEq left.tickHotReset right.tickHotReset :=
+  ⟨h.nodes⟩
+
+theorem tickColdReset {left right : Store} (h : HeapContentsEq left right) :
+    HeapContentsEq left.tickColdReset right.tickColdReset :=
+  ⟨h.nodes⟩
+
+/-- Releasing the same reserved slot succeeds congruently in exact-content
+stores; only observational free counters may differ. -/
+theorem releaseReservation {left right leftOut : Store}
+    (h : HeapContentsEq left right) {location : Nat}
+    (run : left.releaseReservation location = .ok leftOut) :
+    ∃ rightOut,
+      right.releaseReservation location = .ok rightOut ∧
+      HeapContentsEq leftOut rightOut := by
+  cases found : left.heap.nodes[location]? with
+  | none =>
+      simp [Eval.Store.releaseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box =>
+          simp [Eval.Store.releaseReservation, found] at run
+      | none =>
+          have rightAt : right.heap.nodes[location]? = some none := by
+            rw [← h.nodes]
+            exact found
+          have leftOutEq :
+              { left with
+                heap := { left.heap with frees := left.heap.frees + 1 } } =
+                leftOut := by
+            simpa [Eval.Store.releaseReservation, found] using run
+          subst leftOut
+          refine ⟨
+            { right with
+              heap := { right.heap with frees := right.heap.frees + 1 } },
+            ?_, ⟨h.nodes⟩⟩
+          simp [Eval.Store.releaseReservation, rightAt]
+
+/-- Reusing the same reserved slot with the same payload is congruent under
+exact heap contents. -/
+theorem reuseReservation {left right leftOut : Store}
+    (h : HeapContentsEq left right) {location : Nat} {world : Owned}
+    {node : IxIR1.Node} {payloadUnits : Nat}
+    (run : left.reuseReservation location world node payloadUnits =
+      .ok leftOut) :
+    ∃ rightOut,
+      right.reuseReservation location world node payloadUnits = .ok rightOut ∧
+      HeapContentsEq leftOut rightOut := by
+  cases found : left.heap.nodes[location]? with
+  | none =>
+      simp [Eval.Store.reuseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box =>
+          simp [Eval.Store.reuseReservation, found] at run
+      | none =>
+          have rightAt : right.heap.nodes[location]? = some none := by
+            rw [← h.nodes]
+            exact found
+          cases rightRun :
+              right.reuseReservation location world node payloadUnits with
+          | error error =>
+              simp [Eval.Store.reuseReservation, rightAt] at rightRun
+          | ok rightOut =>
+              refine ⟨rightOut, rfl, ?_⟩
+              have leftNodes := congrArg
+                (fun result : Except Error Store =>
+                  result.map (fun output => output.heap.nodes)) run
+              have rightNodes := congrArg
+                (fun result : Except Error Store =>
+                  result.map (fun output => output.heap.nodes)) rightRun
+              have leftNodes' :
+                  left.heap.nodes.setIfInBounds location
+                      (some { world, rc := 1, node }) =
+                    leftOut.heap.nodes := by
+                simpa [Eval.Store.reuseReservation, found, Except.map]
+                  using leftNodes
+              have rightNodes' :
+                  right.heap.nodes.setIfInBounds location
+                      (some { world, rc := 1, node }) =
+                    rightOut.heap.nodes := by
+                simpa [Eval.Store.reuseReservation, rightAt, Except.map]
+                  using rightNodes
+              constructor
+              exact leftNodes'.symm.trans
+                ((congrArg
+                  (fun nodes => nodes.setIfInBounds location
+                    (some { world, rc := 1, node })) h.nodes).trans
+                  rightNodes')
+
+theorem allocNode {left right : Store} (h : HeapContentsEq left right)
+    (world : Owned) (node : IxIR1.Node) :
+    HeapContentsEq (left.allocNode world node).1
+      (right.allocNode world node).1 := by
+  constructor
+  simp [Eval.Store.allocNode, IxIR1.Store.allocNode, h.nodes]
+
+theorem allocNode_location {left right : Store}
+    (h : HeapContentsEq left right) (world : Owned) (node : IxIR1.Node) :
+    (left.allocNode world node).2 = (right.allocNode world node).2 := by
+  simp [Eval.Store.allocNode, IxIR1.Store.allocNode, h.nodes]
+
+theorem hasWorld {left right : Store} (h : HeapContentsEq left right)
+    {world : Owned} {value : RVal}
+    (live : IxIR1.Sim.HasWorld left.heap world value) :
+    IxIR1.Sim.HasWorld right.heap world value := by
+  cases value with
+  | lit literal => trivial
+  | erased => trivial
+  | loc location =>
+      obtain ⟨box, boxAt, boxWorld⟩ := live
+      refine ⟨box, ?_, boxWorld⟩
+      change right.get? location = some box
+      rw [← h.get?_eq location]
+      exact boxAt
+
+/-- Exact node-array equality transports exact ownership without changing
+the root list. -/
+theorem rootOwnership {left right : Store} (h : HeapContentsEq left right)
+    {roots : List IxIR1.Sim.Root}
+    (owned : IxIR1.Sim.RootOwnership left.heap roots) :
+    IxIR1.Sim.RootOwnership right.heap roots := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root member
+    exact h.hasWorld (owned.roots_world root member)
+  · intro location box boxAt child member
+    have leftAt : left.heap.get? location = some box := by
+      change left.get? location = some box
+      rw [h.get?_eq location]
+      exact boxAt
+    exact h.hasWorld (owned.edges_world leftAt child member)
+  · intro location box address arity arguments boxAt node
+    have leftAt : left.heap.get? location = some box := by
+      change left.get? location = some box
+      rw [h.get?_eq location]
+      exact boxAt
+    exact owned.pap_shared leftAt node
+  · intro location box boxAt
+    have leftAt : left.heap.get? location = some box := by
+      change left.get? location = some box
+      rw [h.get?_eq location]
+      exact boxAt
+    simpa [IxIR1.Sim.incoming, IxIR1.Sim.edgeLocations, h.nodes] using
+      owned.counts leftAt
+
+/-- Fixed-location heap contents induce a live-heap isomorphism; cost
+counters and dead-slot metadata remain unobservable. -/
+def toHeapIso {left right : Store} (h : HeapContentsEq left right)
+    (closed : IxIR1.Sim.StoreClosed left.heap) :
+    IxIR1.Sim.HeapIso left.heap right.heap :=
+  let identity := IxIR1.Sim.HeapIso.refl left.heap closed
+  { locRel := identity.locRel
+    left_unique := identity.left_unique
+    right_unique := identity.right_unique
+    left_total := identity.left_total
+    right_total := by
+      intro location box rightAt
+      have leftAt : left.heap.get? location = some box := by
+        change left.get? location = some box
+        rw [h.get?_eq location]
+        exact rightAt
+      exact identity.right_total leftAt
+    related_live := by
+      intro leftLocation rightLocation related
+      obtain ⟨leftBox, rightBox, leftAt, rightAt, boxes⟩ :=
+        identity.related_live related
+      have rightAt' : right.heap.get? rightLocation = some rightBox := by
+        change right.get? rightLocation = some rightBox
+        rw [← h.get?_eq rightLocation]
+        exact rightAt
+      exact ⟨leftBox, rightBox, leftAt, rightAt', boxes⟩ }
+
+theorem toHeapIso_rel_self {left right : Store}
+    (h : HeapContentsEq left right)
+    (closed : IxIR1.Sim.StoreClosed left.heap) {location : Nat}
+    {box : IxIR1.NodeBox} (live : left.get? location = some box) :
+    (h.toHeapIso closed).locRel location location := by
+  change location = location ∧ ∃ box, left.heap.get? location = some box
+  exact ⟨rfl, box, live⟩
+
+end HeapContentsEq
+
+/-- A live-heap isomorphism is a valid initial allocation-history
+isomorphism.  It simply has no dead/dead rows yet; later reclamation steps
+may retain those rows so stale, unreachable register slots remain related. -/
+def heapIsoToHistory {left right : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso left right) :
+    IxIR1.Sim.HeapHistoryIso left right where
+  locRel := iso.locRel
+  left_unique := iso.left_unique
+  right_unique := iso.right_unique
+  left_bound := by
+    intro leftLocation rightLocation related
+    obtain ⟨leftBox, _rightBox, leftAt, _rightAt, _boxes⟩ :=
+      iso.related_live related
+    exact (Array.getElem?_eq_some_iff.mp
+      (IxIR1.Sim.nodes_get?_of_get? leftAt)).1
+  right_bound := by
+    intro leftLocation rightLocation related
+    obtain ⟨_leftBox, rightBox, _leftAt, rightAt, _boxes⟩ :=
+      iso.related_live related
+    exact (Array.getElem?_eq_some_iff.mp
+      (IxIR1.Sim.nodes_get?_of_get? rightAt)).1
+  left_total := iso.left_total
+  right_total := iso.right_total
+  related := by
+    intro leftLocation rightLocation related
+    exact .inr (iso.related_live related)
+
+private theorem nodeIso_ctor_left {locRel : Nat → Nat → Prop}
+    {cid : CtorId} {leftFields : Array RVal} {rightNode : IxIR1.Node}
+    (related : IxIR1.Sim.NodeIso locRel (.ctorN cid leftFields) rightNode) :
+    ∃ rightFields : Array RVal,
+      rightNode = .ctorN cid rightFields ∧
+        IxIR1.Sim.RValsIso locRel leftFields.toList rightFields.toList := by
+  cases related with
+  | ctor fields => exact ⟨_, rfl, fields⟩
+
+private theorem nodeIso_pap_left {locRel : Nat → Nat → Prop}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {leftArguments : Array RVal} {rightNode : IxIR1.Node}
+    (related : IxIR1.Sim.NodeIso locRel
+      (.papN address arity leftArguments) rightNode) :
+    ∃ rightArguments : Array RVal,
+      rightNode = .papN address arity rightArguments ∧
+        IxIR1.Sim.RValsIso locRel
+          leftArguments.toList rightArguments.toList := by
+  cases related with
+  | pap arguments => exact ⟨_, rfl, arguments⟩
+
+/-! ## Removing a related hot-reset source -/
+
+private theorem rvalsIso_restrict_left {locRel : Nat → Nat → Prop}
+    {left right : List RVal} {removed : Nat}
+    (related : IxIR1.Sim.RValsIso locRel left right)
+    (avoids : ∀ value ∈ left, value ≠ .loc removed) :
+    IxIR1.Sim.RValsIso
+      (fun leftLocation rightLocation =>
+        locRel leftLocation rightLocation ∧ leftLocation ≠ removed)
+      left right := by
+  induction related with
+  | nil => exact .nil
+  | @cons leftValue rightValue lefts rights head tail ih =>
+      have headAvoids : leftValue ≠ .loc removed :=
+        avoids leftValue (by simp)
+      have tailAvoids : ∀ value ∈ lefts, value ≠ .loc removed := by
+        intro value member
+        exact avoids value (by simp [member])
+      refine .cons ?_ (ih tailAvoids)
+      cases head with
+      | loc locationRelated =>
+          apply IxIR1.Sim.RValIso.loc
+          refine ⟨locationRelated, ?_⟩
+          intro same
+          apply headAvoids
+          cases same
+          rfl
+      | lit => exact .lit
+      | erased => exact .erased
+
+private theorem rvalsIso_right_avoids_of_left
+    {leftStore rightStore : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso rightStore leftStore)
+    {leftRemoved rightRemoved : Nat}
+    (removedRelated : iso.locRel rightRemoved leftRemoved)
+    {left right : List RVal}
+    (related : IxIR1.Sim.RValsIso
+      (fun leftLocation rightLocation =>
+        iso.locRel rightLocation leftLocation) left right)
+    (leftAvoids : ∀ value ∈ left, value ≠ .loc leftRemoved) :
+    ∀ value ∈ right, value ≠ .loc rightRemoved := by
+  induction related with
+  | nil => simp
+  | @cons leftValue rightValue lefts rights head tail ih =>
+      have headAvoids : leftValue ≠ .loc leftRemoved :=
+        leftAvoids leftValue (by simp)
+      have tailAvoids : ∀ value ∈ lefts, value ≠ .loc leftRemoved := by
+        intro value member
+        exact leftAvoids value (by simp [member])
+      intro value member
+      simp only [List.mem_cons] at member
+      rcases member with rfl | member
+      · cases head with
+        | loc locationRelated =>
+            intro same
+            cases same
+            have leftSame := iso.left_unique locationRelated removedRelated
+            apply headAvoids
+            cases leftSame
+            rfl
+        | lit => intro impossible; cases impossible
+        | erased => intro impossible; cases impossible
+      · exact ih tailAvoids value member
+
+private theorem nodeIso_restrict_left {locRel : Nat → Nat → Prop}
+    {left right : IxIR1.Node} {removed : Nat}
+    (related : IxIR1.Sim.NodeIso locRel left right)
+    (avoids : ∀ value ∈ IxIR1.Sim.nodeChildren left,
+      value ≠ .loc removed) :
+    IxIR1.Sim.NodeIso
+      (fun leftLocation rightLocation =>
+        locRel leftLocation rightLocation ∧ leftLocation ≠ removed)
+      left right := by
+  cases related with
+  | ctor values =>
+      apply IxIR1.Sim.NodeIso.ctor
+      apply rvalsIso_restrict_left values
+      simpa [IxIR1.Sim.nodeChildren] using avoids
+  | pap values =>
+      apply IxIR1.Sim.NodeIso.pap
+      apply rvalsIso_restrict_left values
+      simpa [IxIR1.Sim.nodeChildren] using avoids
+
+/-- Removing two related unit-refcount shared nodes preserves the existing
+live-heap bijection on every surviving location. Exact ownership on the left
+excludes hidden incoming heap edges to the consumed node, which is precisely
+what permits the location pair to be removed from the relation. -/
+def heapIsoKillShared {left right : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso left right)
+    {leftLocation rightLocation : Nat}
+    {leftNode rightNode : IxIR1.Node} {leftRest : List IxIR1.Sim.Root}
+    (locations : iso.locRel leftLocation rightLocation)
+    (leftAt : left.get? leftLocation =
+      some ⟨.shared, 1, leftNode⟩)
+    (rightAt : right.get? rightLocation =
+      some ⟨.shared, 1, rightNode⟩)
+    (leftOwned : IxIR1.Sim.RootOwnership left
+      (⟨.shared, .loc leftLocation⟩ :: leftRest)) :
+    IxIR1.Sim.HeapIso (left.kill leftLocation)
+      (right.kill rightLocation) := by
+  let kept : Nat → Nat → Prop := fun leftCandidate rightCandidate =>
+    iso.locRel leftCandidate rightCandidate ∧
+      leftCandidate ≠ leftLocation
+  refine
+    { locRel := kept
+      left_unique := ?_
+      right_unique := ?_
+      left_total := ?_
+      right_total := ?_
+      related_live := ?_ }
+  · intro leftCandidate right₁ right₂ first second
+    exact iso.left_unique first.1 second.1
+  · intro left₁ left₂ rightCandidate first second
+    exact iso.right_unique first.1 second.1
+  · intro leftCandidate box live
+    have different : leftLocation ≠ leftCandidate := by
+      intro same
+      subst leftCandidate
+      rw [IxIR1.Sim.get?_kill_same leftAt] at live
+      contradiction
+    have original : left.get? leftCandidate = some box :=
+      IxIR1.Sim.get?_of_kill_other different leftAt live
+    obtain ⟨rightCandidate, related⟩ := iso.left_total original
+    exact ⟨rightCandidate, related, Ne.symm different⟩
+  · intro rightCandidate box live
+    have different : rightLocation ≠ rightCandidate := by
+      intro same
+      subst rightCandidate
+      rw [IxIR1.Sim.get?_kill_same rightAt] at live
+      contradiction
+    have original : right.get? rightCandidate = some box :=
+      IxIR1.Sim.get?_of_kill_other different rightAt live
+    obtain ⟨leftCandidate, related⟩ := iso.right_total original
+    have leftDifferent : leftCandidate ≠ leftLocation := by
+      intro same
+      subst leftCandidate
+      exact different (iso.left_unique locations related)
+    exact ⟨leftCandidate, related, leftDifferent⟩
+  · intro leftCandidate rightCandidate related
+    obtain ⟨leftBox, rightBox, leftLive, rightLive, boxes⟩ :=
+      iso.related_live related.1
+    have rightDifferent : rightLocation ≠ rightCandidate := by
+      intro same
+      subst rightCandidate
+      exact related.2 (iso.right_unique related.1 locations)
+    have leftKilled : (left.kill leftLocation).get? leftCandidate =
+        some leftBox :=
+      IxIR1.Sim.get?_kill_other (Ne.symm related.2) leftAt leftLive
+    have rightKilled : (right.kill rightLocation).get? rightCandidate =
+        some rightBox :=
+      IxIR1.Sim.get?_kill_other rightDifferent rightAt rightLive
+    refine ⟨leftBox, rightBox, leftKilled, rightKilled,
+      boxes.world, boxes.rc, ?_⟩
+    apply nodeIso_restrict_left boxes.node
+    intro child member
+    exact leftOwned.sole_child_ne leftAt leftLive member
+
+/-- The restricted post-kill relation contains every old related pair whose
+left endpoint is not the consumed source location. -/
+theorem heapIsoKillShared_rel {left right : IxIR1.Store}
+    (iso : IxIR1.Sim.HeapIso left right)
+    {leftLocation rightLocation : Nat}
+    {leftNode rightNode : IxIR1.Node} {leftRest : List IxIR1.Sim.Root}
+    (locations : iso.locRel leftLocation rightLocation)
+    (leftAt : left.get? leftLocation =
+      some ⟨.shared, 1, leftNode⟩)
+    (rightAt : right.get? rightLocation =
+      some ⟨.shared, 1, rightNode⟩)
+    (leftOwned : IxIR1.Sim.RootOwnership left
+      (⟨.shared, .loc leftLocation⟩ :: leftRest))
+    {leftCandidate rightCandidate : Nat}
+    (related : iso.locRel leftCandidate rightCandidate)
+    (different : leftCandidate ≠ leftLocation) :
+    (heapIsoKillShared iso locations leftAt rightAt leftOwned).locRel
+      leftCandidate rightCandidate := by
+  exact ⟨related, different⟩
+
+/-! ## Field worlds under live-heap isomorphism -/
+
+/-- Related runtime values have the same dynamic ownership observation under
+an allocation-history isomorphism.  A historical dead/dead pair reports
+`false` on both sides. -/
+theorem heapHistoryIso_rvalHasWorld_eq {left right : Store}
+    (iso : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftValue rightValue : RVal}
+    (related : IxIR1.Sim.RValIso iso.locRel leftValue rightValue)
+    (world : Owned) :
+    RVal.hasWorld left world leftValue =
+      RVal.hasWorld right world rightValue := by
+  cases related with
+  | loc locationRelated =>
+      rcases iso.related locationRelated with dead | live
+      · simp [RVal.hasWorld, Eval.Store.get?, dead.1, dead.2]
+      · obtain ⟨leftBox, rightBox, leftAt, rightAt, boxes⟩ := live
+        simp [RVal.hasWorld, Eval.Store.get?, leftAt, rightAt, boxes.world]
+  | lit => rfl
+  | erased => rfl
+
+theorem heapHistoryIso_fieldValuesWorldEq {left right : Store}
+    (iso : IxIR1.Sim.HeapHistoryIso left.heap right.heap) :
+    ∀ {leftValues rightValues : List RVal},
+      IxIR1.Sim.RValsIso iso.locRel leftValues rightValues →
+      FieldValuesWorldEq left right leftValues rightValues
+  | _, _, .nil => .nil
+  | _, _, .cons head tail =>
+      .cons (fun world => heapHistoryIso_rvalHasWorld_eq iso head world)
+        (heapHistoryIso_fieldValuesWorldEq iso tail)
+
+/-- Constructor inspection transports across corresponding live locations,
+returning the related target box and field vector. -/
+theorem constructorView_historyIso {left right : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftLocation rightLocation : Nat}
+    (locations : heap.locRel leftLocation rightLocation)
+    {world : Owned} {cid : CtorId} {leftBox : IxIR1.NodeBox}
+    {leftFields : Array RVal}
+    (viewed : ConstructorView left leftLocation world cid leftBox leftFields) :
+    ∃ (rightBox : IxIR1.NodeBox) (rightFields : Array RVal),
+      right.get? rightLocation = some rightBox ∧
+        ConstructorView right rightLocation world cid rightBox rightFields ∧
+        IxIR1.Sim.NodeBoxIso heap.locRel leftBox rightBox ∧
+        IxIR1.Sim.RValsIso heap.locRel
+          leftFields.toList rightFields.toList := by
+  obtain ⟨leftAt, leftWorld, leftNode⟩ := viewed.parts
+  obtain ⟨rightBox, rightAt, boxes⟩ := heap.boxes locations (by
+    change left.heap.get? leftLocation = some leftBox
+    exact leftAt)
+  have nodes : IxIR1.Sim.NodeIso heap.locRel
+      (.ctorN cid leftFields) rightBox.node := by
+    simpa only [← leftNode] using boxes.node
+  obtain ⟨rightFields, rightNode, fields⟩ := nodeIso_ctor_left nodes
+  have rightWorld : rightBox.world = world :=
+    boxes.world.symm.trans leftWorld
+  have rightViewed : ConstructorView right rightLocation world cid rightBox
+      rightFields := ConstructorView.of_box rightAt rightWorld rightNode
+  exact ⟨rightBox, rightFields, rightAt, rightViewed, boxes, fields⟩
+
+/-- An in-bounds location whose live-node lookup is empty is an actual dead
+slot, rather than an out-of-bounds address. -/
+private theorem reservedSlot_of_bound {heap : IxIR1.Store} {location : Nat}
+    (bound : location < heap.nodes.size)
+    (dead : heap.get? location = none) :
+    heap.nodes[location]? = some none := by
+  obtain ⟨slot, slotAt⟩ : ∃ slot, heap.nodes[location]? = some slot := by
+    refine ⟨heap.nodes[location], ?_⟩
+    exact Array.getElem?_eq_some_iff.mpr ⟨bound, rfl⟩
+  cases slot with
+  | none => exact slotAt
+  | some box =>
+      have live : heap.get? location = some box := by
+        simp [IxIR1.Store.get?, slotAt]
+      rw [dead] at live
+      contradiction
+
+/-- Reserving corresponding live locations preserves allocation history.
+The IxIR₂ reservation does not count a free, so only its node-array effect
+is compared with the history-level kill operation. -/
+def reserve_historyIso {left right : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftLocation rightLocation : Nat}
+    (locations : heap.locRel leftLocation rightLocation)
+    {leftBox rightBox : IxIR1.NodeBox}
+    (leftAt : left.get? leftLocation = some leftBox)
+    (rightAt : right.get? rightLocation = some rightBox) :
+    IxIR1.Sim.HeapHistoryIso
+      (left.reserve leftLocation).heap
+      (right.reserve rightLocation).heap := by
+  let killed := heap.kill locations leftAt rightAt
+  exact killed.nodesEq
+    (by
+      simp [Eval.Store.reserve, IxIR1.Store.kill,
+        Array.set!_eq_setIfInBounds])
+    (by
+      simp [Eval.Store.reserve, IxIR1.Store.kill,
+        Array.set!_eq_setIfInBounds])
+
+/-- Releasing corresponding physical reservations succeeds on both sides and
+does not change their allocation-history relation. -/
+theorem releaseReservation_historyIso {left right leftOut : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftLocation rightLocation : Nat}
+    (locations : heap.locRel leftLocation rightLocation)
+    (run : left.releaseReservation leftLocation = .ok leftOut) :
+    ∃ rightOut,
+      ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+        right.releaseReservation rightLocation = .ok rightOut ∧
+          outputHeap.locRel = heap.locRel := by
+  cases found : left.heap.nodes[leftLocation]? with
+  | none =>
+      simp [Eval.Store.releaseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box =>
+          simp [Eval.Store.releaseReservation, found] at run
+      | none =>
+          have leftDead : left.heap.get? leftLocation = none := by
+            simp [IxIR1.Store.get?, found]
+          have rightDead : right.heap.get? rightLocation = none := by
+            rcases heap.related locations with dead | live
+            · exact dead.2
+            · obtain ⟨leftBox, rightBox, leftLive, _, _⟩ := live
+              rw [leftDead] at leftLive
+              contradiction
+          have rightReserved : right.heap.nodes[rightLocation]? = some none :=
+            reservedSlot_of_bound (heap.right_bound locations) rightDead
+          have leftOutEq :
+              { left with
+                heap := { left.heap with frees := left.heap.frees + 1 } } =
+                leftOut := by
+            simpa [Eval.Store.releaseReservation, found] using run
+          subst leftOut
+          let rightOut : Store :=
+            { right with
+              heap := { right.heap with frees := right.heap.frees + 1 } }
+          let outputHeap := heap.nodesEq (nextLeft :=
+            { left.heap with frees := left.heap.frees + 1 })
+            (nextRight :=
+              { right.heap with frees := right.heap.frees + 1 }) rfl rfl
+          refine ⟨rightOut, outputHeap, ?_, rfl⟩
+          simp [rightOut, Eval.Store.releaseReservation, rightReserved]
+
+/-- Reusing corresponding physical reservations with related payload nodes
+revives their dead history row.  The two concrete locations may differ. -/
+theorem reuseReservation_historyIso {left right leftOut : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftLocation rightLocation : Nat}
+    (locations : heap.locRel leftLocation rightLocation)
+    {world : Owned} {leftNode rightNode : IxIR1.Node}
+    (nodes : IxIR1.Sim.NodeIso heap.locRel leftNode rightNode)
+    {payloadUnits : Nat}
+    (run : left.reuseReservation leftLocation world leftNode payloadUnits =
+      .ok leftOut) :
+    ∃ rightOut,
+      ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+        right.reuseReservation rightLocation world rightNode payloadUnits =
+            .ok rightOut ∧
+          outputHeap.locRel = heap.locRel := by
+  cases found : left.heap.nodes[leftLocation]? with
+  | none =>
+      simp [Eval.Store.reuseReservation, found] at run
+  | some slot =>
+      cases slot with
+      | some box =>
+          simp [Eval.Store.reuseReservation, found] at run
+      | none =>
+          have leftDead : left.heap.get? leftLocation = none := by
+            simp [IxIR1.Store.get?, found]
+          have rightDead : right.heap.get? rightLocation = none := by
+            rcases heap.related locations with dead | live
+            · exact dead.2
+            · obtain ⟨leftBox, rightBox, leftLive, _, _⟩ := live
+              rw [leftDead] at leftLive
+              contradiction
+          have rightReserved : right.heap.nodes[rightLocation]? = some none :=
+            reservedSlot_of_bound (heap.right_bound locations) rightDead
+          cases targetRun : right.reuseReservation rightLocation world
+              rightNode payloadUnits with
+          | error error =>
+              simp [Eval.Store.reuseReservation, rightReserved] at targetRun
+          | ok rightOut =>
+              have leftNodes := congrArg
+                (fun result : Except Error Store =>
+                  result.map (fun output => output.heap.nodes)) run
+              have rightNodes := congrArg
+                (fun result : Except Error Store =>
+                  result.map (fun output => output.heap.nodes)) targetRun
+              have leftNodes' :
+                  left.heap.nodes.setIfInBounds leftLocation
+                      (some { world, rc := 1, node := leftNode }) =
+                    leftOut.heap.nodes := by
+                simpa [Eval.Store.reuseReservation, found, Except.map]
+                  using leftNodes
+              have rightNodes' :
+                  right.heap.nodes.setIfInBounds rightLocation
+                      (some { world, rc := 1, node := rightNode }) =
+                    rightOut.heap.nodes := by
+                simpa [Eval.Store.reuseReservation, rightReserved, Except.map]
+                  using rightNodes
+              let revived := heap.revive locations leftDead rightDead
+                (show IxIR1.Sim.NodeBoxIso heap.locRel
+                    ⟨world, 1, leftNode⟩ ⟨world, 1, rightNode⟩ from
+                  ⟨rfl, rfl, nodes⟩)
+              let outputHeap := revived.nodesEq
+                (by
+                  simpa [IxIR1.Store.setBox,
+                    Array.set!_eq_setIfInBounds] using leftNodes'.symm)
+                (by
+                  simpa [IxIR1.Store.setBox,
+                    Array.set!_eq_setIfInBounds] using rightNodes'.symm)
+              exact ⟨rightOut, outputHeap, rfl, rfl⟩
+
+/-- One shared retain is equivariant under allocation history.  Its output
+history keeps every entry relation, including any pre-existing dead rows. -/
+theorem retainShared_historyIso {left right leftOut : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftValue rightValue : RVal}
+    (value : IxIR1.Sim.RValIso heap.locRel leftValue rightValue)
+    (run : retainShared left leftValue = .ok leftOut) :
+    ∃ rightOut,
+      ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+        retainShared right rightValue = .ok rightOut ∧
+          outputHeap.locRel = heap.locRel := by
+  cases value with
+  | lit =>
+      simp [retainShared] at run
+      subst leftOut
+      exact ⟨right, heap, rfl, rfl⟩
+  | erased =>
+      simp [retainShared] at run
+      subst leftOut
+      exact ⟨right, heap, rfl, rfl⟩
+  | @loc leftLocation rightLocation related =>
+      cases leftAt : left.get? leftLocation with
+      | none => simp [retainShared, leftAt] at run
+      | some leftBox =>
+          obtain ⟨rightBox, rightAt, boxes⟩ := heap.boxes related (by
+            change left.heap.get? leftLocation = some leftBox
+            exact leftAt)
+          cases leftBox with
+          | mk leftWorld leftRc leftNode =>
+              cases leftWorld with
+              | unique => simp [retainShared, leftAt] at run
+              | shared =>
+                  have rightWorld : rightBox.world = .shared := by
+                    exact boxes.world.symm
+                  simp [retainShared, leftAt] at run
+                  subst leftOut
+                  let rightOut :=
+                    (right.setBox rightLocation
+                      { rightBox with rc := rightBox.rc + 1 }).rcTick
+                  have rightAtStore : right.get? rightLocation =
+                      some rightBox := by
+                    exact rightAt
+                  have rightRun : retainShared right (.loc rightLocation) =
+                      .ok rightOut := by
+                    simp [retainShared, rightAtStore, rightWorld, rightOut]
+                  let setHistory := heap.setBox related
+                    (by
+                      change left.heap.get? leftLocation =
+                        some ⟨.shared, leftRc, leftNode⟩
+                      exact leftAt)
+                    rightAt
+                    (show IxIR1.Sim.NodeBoxIso heap.locRel
+                        { (⟨.shared, leftRc, leftNode⟩ : IxIR1.NodeBox) with
+                          rc := leftRc + 1 }
+                        { rightBox with rc := rightBox.rc + 1 } from
+                      ⟨boxes.world, congrArg (fun rc => rc + 1) boxes.rc,
+                        boxes.node⟩)
+                  let outputHistory := setHistory.rcTick
+                  exact ⟨rightOut, outputHistory, rightRun, rfl⟩
+
+private theorem retainSharedMany_historyIso_rel
+    {rel : Nat → Nat → Prop} {leftValues rightValues : List RVal}
+    (values : IxIR1.Sim.RValsIso rel leftValues rightValues) :
+    ∀ {left right leftOut : Store}
+      (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap),
+      heap.locRel = rel →
+      RetainSharedMany left leftValues.toArray leftOut →
+      ∃ rightOut,
+        ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+          RetainSharedMany right rightValues.toArray rightOut ∧
+            outputHeap.locRel = rel := by
+  induction values with
+  | nil =>
+      intro left right leftOut heap heapRelation run
+      have leftEmpty : RetainSharedMany left #[] left :=
+        RetainSharedMany.empty left
+      have leftOutEq : leftOut = left := by
+        unfold RetainSharedMany at run leftEmpty
+        exact Except.ok.inj (run.symm.trans leftEmpty)
+      subst leftOut
+      exact ⟨right, heap, RetainSharedMany.empty right, heapRelation⟩
+  | @cons leftHead rightHead leftTail rightTail head tail ih =>
+      intro left right leftOut heap heapRelation run
+      obtain ⟨leftMiddle, leftHeadRun, leftTailRun⟩ := run.cons_inv
+      have headRelated : IxIR1.Sim.RValIso heap.locRel
+          leftHead rightHead := by
+        rw [heapRelation]
+        exact head
+      obtain ⟨rightMiddle, middleHeap, rightHeadRun, middleRelation⟩ :=
+        retainShared_historyIso heap headRelated leftHeadRun
+      obtain ⟨rightOut, outputHeap, rightTailRun, outputRelation⟩ :=
+        ih middleHeap (middleRelation.trans heapRelation) leftTailRun
+      refine ⟨rightOut, outputHeap,
+        RetainSharedMany.cons rightHeadRun rightTailRun, outputRelation⟩
+
+/-- Batch shared retain preserves the allocation-history relation while
+allowing each side to update the corresponding concrete locations. -/
+theorem retainSharedMany_historyIso {left right leftOut : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftValues rightValues : List RVal}
+    (values : IxIR1.Sim.RValsIso heap.locRel leftValues rightValues)
+    (run : RetainSharedMany left leftValues.toArray leftOut) :
+    ∃ rightOut,
+      ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+        RetainSharedMany right rightValues.toArray rightOut ∧
+          outputHeap.locRel = heap.locRel :=
+  retainSharedMany_historyIso_rel values heap rfl run
+
+/-- Deep shared release is equivariant at a common traversal-fuel index.
+Corresponding kills retain dead/dead history rows, and corresponding
+decrements preserve the same location relation. -/
+theorem releaseSharedWork_historyIso_sameFuel :
+    ∀ {fuel : Nat} {left right leftOut : Store}
+      {leftValues rightValues : List RVal} {remaining : Nat}
+      (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap),
+      IxIR1.Sim.RValsIso heap.locRel leftValues rightValues →
+      releaseSharedWork fuel left leftValues = .ok (leftOut, remaining) →
+      ∃ rightOut,
+        ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+          releaseSharedWork fuel right rightValues =
+              .ok (rightOut, remaining) ∧
+            outputHeap.locRel = heap.locRel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro left right leftOut leftValues rightValues remaining heap values run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run ⊢
+          have pairEq : (left, 0) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, heap, rfl, rfl⟩
+      | cons head tail => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      intro left right leftOut leftValues rightValues remaining heap values run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run ⊢
+          have pairEq : (left, fuel + 1) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, heap, rfl, rfl⟩
+      | @cons leftValue rightValue leftRest rightRest head tail =>
+          cases head with
+          | lit =>
+              simp only [releaseSharedWork] at run ⊢
+              exact ih heap tail run
+          | erased =>
+              simp only [releaseSharedWork] at run ⊢
+              exact ih heap tail run
+          | @loc leftLocation rightLocation locations =>
+              cases leftAt : left.get? leftLocation with
+              | none => simp [releaseSharedWork, leftAt] at run
+              | some leftBox =>
+                  obtain ⟨rightBox, rightAt, boxes⟩ :=
+                    heap.boxes locations (by
+                      change left.heap.get? leftLocation = some leftBox
+                      exact leftAt)
+                  cases leftBox with
+                  | mk leftWorld leftRc leftNode =>
+                      cases leftWorld with
+                      | unique => simp [releaseSharedWork, leftAt] at run
+                      | shared =>
+                          cases rightBox with
+                          | mk rightWorld rightRc rightNode =>
+                              have worldEq := boxes.world
+                              have rcEq := boxes.rc
+                              simp only at worldEq rcEq
+                              subst rightWorld
+                              subst rightRc
+                              have rightAtStore : right.get? rightLocation =
+                                  some ⟨.shared, leftRc, rightNode⟩ := by
+                                exact rightAt
+                              have nodes : IxIR1.Sim.NodeIso heap.locRel
+                                  leftNode rightNode := boxes.node
+                              by_cases zero : leftRc = 0
+                              · subst leftRc
+                                simp [releaseSharedWork, leftAt] at run
+                              · by_cases unit : leftRc = 1
+                                · subst leftRc
+                                  cases leftNode with
+                                  | ctorN cid leftFields =>
+                                      obtain ⟨rightFields, rightNodeEq,
+                                          fieldsRelated⟩ :=
+                                        nodeIso_ctor_left nodes
+                                      let nextHeap :=
+                                        (heap.rcTick).kill locations
+                                          (by
+                                            change left.heap.rcTick.get?
+                                              leftLocation = some
+                                                ⟨.shared, 1,
+                                                  .ctorN cid leftFields⟩
+                                            exact leftAt)
+                                          (by
+                                            change right.heap.rcTick.get?
+                                              rightLocation = some
+                                                ⟨.shared, 1, rightNode⟩
+                                            exact rightAt)
+                                      have nextValues : IxIR1.Sim.RValsIso
+                                          nextHeap.locRel
+                                          (leftFields.toList ++ leftRest)
+                                          (rightFields.toList ++ rightRest) :=
+                                        fieldsRelated.append tail
+                                      simp [releaseSharedWork, leftAt,
+                                        rightAtStore, rightNodeEq] at run ⊢
+                                      obtain ⟨rightOut, outputHeap, rightRun,
+                                          outputRelation⟩ := ih
+                                        (left := left.rcTick.kill leftLocation)
+                                        (right := right.rcTick.kill
+                                          rightLocation)
+                                        nextHeap nextValues run
+                                      refine ⟨rightOut, rightRun, outputHeap, ?_⟩
+                                      exact outputRelation.trans (by rfl)
+                                  | papN address arity leftArguments =>
+                                      obtain ⟨rightArguments, rightNodeEq,
+                                          argumentsRelated⟩ :=
+                                        nodeIso_pap_left nodes
+                                      let nextHeap :=
+                                        (heap.rcTick).kill locations
+                                          (by
+                                            change left.heap.rcTick.get?
+                                              leftLocation = some
+                                                ⟨.shared, 1, .papN address
+                                                  arity leftArguments⟩
+                                            exact leftAt)
+                                          (by
+                                            change right.heap.rcTick.get?
+                                              rightLocation = some
+                                                ⟨.shared, 1, rightNode⟩
+                                            exact rightAt)
+                                      have nextValues : IxIR1.Sim.RValsIso
+                                          nextHeap.locRel
+                                          (leftArguments.toList ++ leftRest)
+                                          (rightArguments.toList ++
+                                            rightRest) :=
+                                        argumentsRelated.append tail
+                                      simp [releaseSharedWork, leftAt,
+                                        rightAtStore, rightNodeEq] at run ⊢
+                                      obtain ⟨rightOut, outputHeap, rightRun,
+                                          outputRelation⟩ := ih
+                                        (left := left.rcTick.kill leftLocation)
+                                        (right := right.rcTick.kill
+                                          rightLocation)
+                                        nextHeap nextValues run
+                                      refine ⟨rightOut, rightRun, outputHeap, ?_⟩
+                                      exact outputRelation.trans (by rfl)
+                                · have nonzero : (leftRc == 0) = false :=
+                                    beq_eq_false_iff_ne.mpr zero
+                                  have nonunit : (leftRc == 1) = false :=
+                                    beq_eq_false_iff_ne.mpr unit
+                                  let nextHeap :=
+                                    (heap.rcTick).setBox locations
+                                      (by
+                                        change left.heap.rcTick.get?
+                                          leftLocation = some
+                                            ⟨.shared, leftRc, leftNode⟩
+                                        exact leftAt)
+                                      (by
+                                        change right.heap.rcTick.get?
+                                          rightLocation = some
+                                            ⟨.shared, leftRc, rightNode⟩
+                                        exact rightAt)
+                                      (show IxIR1.Sim.NodeBoxIso heap.locRel
+                                          ⟨.shared, leftRc - 1, leftNode⟩
+                                          ⟨.shared, leftRc - 1, rightNode⟩
+                                        from ⟨rfl, rfl, nodes⟩)
+                                  simp [releaseSharedWork, leftAt,
+                                    rightAtStore, nonzero, nonunit] at run ⊢
+                                  obtain ⟨rightOut, outputHeap, rightRun,
+                                      outputRelation⟩ := ih
+                                    (left := left.rcTick.setBox leftLocation
+                                      ⟨.shared, leftRc - 1, leftNode⟩)
+                                    (right := right.rcTick.setBox rightLocation
+                                      ⟨.shared, leftRc - 1, rightNode⟩)
+                                    nextHeap tail run
+                                  refine ⟨rightOut, rightRun, outputHeap, ?_⟩
+                                  exact outputRelation.trans (by rfl)
+
+/-- Deep unique destruction is allocation-history equivariant at a common
+fuel index. -/
+theorem dropUniqueWork_historyIso_sameFuel :
+    ∀ {fuel : Nat} {left right leftOut : Store}
+      {leftValues rightValues : List RVal} {remaining : Nat}
+      (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap),
+      IxIR1.Sim.RValsIso heap.locRel leftValues rightValues →
+      dropUniqueWork fuel left leftValues = .ok (leftOut, remaining) →
+      ∃ rightOut,
+        ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+          dropUniqueWork fuel right rightValues =
+              .ok (rightOut, remaining) ∧
+            outputHeap.locRel = heap.locRel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro left right leftOut leftValues rightValues remaining heap values run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run ⊢
+          have pairEq : (left, 0) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, heap, rfl, rfl⟩
+      | cons head tail => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      intro left right leftOut leftValues rightValues remaining heap values run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run ⊢
+          have pairEq : (left, fuel + 1) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, heap, rfl, rfl⟩
+      | @cons leftValue rightValue leftRest rightRest head tail =>
+          cases head with
+          | lit =>
+              simp only [dropUniqueWork] at run ⊢
+              exact ih heap tail run
+          | erased =>
+              simp only [dropUniqueWork] at run ⊢
+              exact ih heap tail run
+          | @loc leftLocation rightLocation locations =>
+              cases leftAt : left.get? leftLocation with
+              | none => simp [dropUniqueWork, leftAt] at run
+              | some leftBox =>
+                  obtain ⟨rightBox, rightAt, boxes⟩ :=
+                    heap.boxes locations (by
+                      change left.heap.get? leftLocation = some leftBox
+                      exact leftAt)
+                  cases leftBox with
+                  | mk leftWorld leftRc leftNode =>
+                      cases leftWorld with
+                      | shared => simp [dropUniqueWork, leftAt] at run
+                      | unique =>
+                          cases rightBox with
+                          | mk rightWorld rightRc rightNode =>
+                              have worldEq := boxes.world
+                              have rcEq := boxes.rc
+                              simp only at worldEq rcEq
+                              subst rightWorld
+                              subst rightRc
+                              have rightAtStore : right.get? rightLocation =
+                                  some ⟨.unique, leftRc, rightNode⟩ := by
+                                exact rightAt
+                              have nodes : IxIR1.Sim.NodeIso heap.locRel
+                                  leftNode rightNode := boxes.node
+                              cases leftNode with
+                              | papN address arity arguments =>
+                                  simp [dropUniqueWork, leftAt] at run
+                              | ctorN cid leftFields =>
+                                  obtain ⟨rightFields, rightNodeEq,
+                                      fieldsRelated⟩ := nodeIso_ctor_left nodes
+                                  let nextHeap := heap.kill locations
+                                    (by
+                                      change left.heap.get? leftLocation = some
+                                        ⟨.unique, leftRc,
+                                          .ctorN cid leftFields⟩
+                                      exact leftAt)
+                                    (by
+                                      change right.heap.get? rightLocation =
+                                        some ⟨.unique, leftRc, rightNode⟩
+                                      exact rightAt)
+                                  have nextValues : IxIR1.Sim.RValsIso
+                                      nextHeap.locRel
+                                      (leftFields.toList ++ leftRest)
+                                      (rightFields.toList ++ rightRest) :=
+                                    fieldsRelated.append tail
+                                  simp [dropUniqueWork, leftAt, rightAtStore,
+                                    rightNodeEq] at run ⊢
+                                  obtain ⟨rightOut, outputHeap, rightRun,
+                                      outputRelation⟩ := ih
+                                    (left := left.kill leftLocation)
+                                    (right := right.kill rightLocation)
+                                    nextHeap nextValues run
+                                  refine ⟨rightOut, rightRun, outputHeap, ?_⟩
+                                  exact outputRelation.trans (by rfl)
+
+/-- Related runtime values report the same dynamic ownership world in
+isomorphic evaluator heaps. -/
+theorem heapIso_rvalHasWorld_eq {left right : Store}
+    (iso : IxIR1.Sim.HeapIso left.heap right.heap)
+    {leftValue rightValue : RVal}
+    (related : IxIR1.Sim.RValIso iso.locRel leftValue rightValue)
+    (world : Owned) :
+    RVal.hasWorld left world leftValue =
+      RVal.hasWorld right world rightValue := by
+  cases related with
+  | loc locationRelated =>
+      obtain ⟨leftBox, rightBox, leftAt, rightAt, boxes⟩ :=
+        iso.related_live locationRelated
+      simp [RVal.hasWorld, Eval.Store.get?, leftAt, rightAt, boxes.world]
+  | lit => rfl
+  | erased => rfl
+
+/-- Uniform constructor-field validation transports pointwise across a live
+heap isomorphism and its related value vector. -/
+theorem heapIso_fieldWorlds_of_replicate {left right : Store}
+    (iso : IxIR1.Sim.HeapIso left.heap right.heap)
+    {schema : CtorSchema} {leftValues rightValues : Array RVal}
+    {world : Owned} {count : Nat}
+    (schemaFields : schema.fields = Array.replicate count world)
+    (related : IxIR1.Sim.RValsIso iso.locRel
+      leftValues.toList rightValues.toList)
+    (fieldWorlds : FieldWorlds left schema leftValues) :
+    FieldWorlds right schema rightValues := by
+  obtain ⟨leftCount, leftWorlds⟩ :=
+    fieldWorlds.to_replicate schemaFields
+  have valueCounts : leftValues.size = rightValues.size := by
+    simpa using rvalsIso_length_eq related
+  have rightCount : rightValues.size = count :=
+    valueCounts.symm.trans leftCount
+  have transfer : ∀ {lefts rights : List RVal},
+      IxIR1.Sim.RValsIso iso.locRel lefts rights →
+      (∀ value ∈ lefts, RVal.hasWorld left world value = true) →
+      ∀ value ∈ rights, RVal.hasWorld right world value = true := by
+    intro lefts rights valuesRelated
+    induction valuesRelated with
+    | nil => simp
+    | @cons leftValue rightValue lefts rights head tail ih =>
+        intro sourceWorlds value member
+        simp only [List.mem_cons] at member
+        rcases member with rfl | member
+        · rw [← heapIso_rvalHasWorld_eq iso head world]
+          exact sourceWorlds leftValue (by simp)
+        · apply ih
+          · intro sourceValue sourceMember
+            exact sourceWorlds sourceValue (by simp [sourceMember])
+          · exact member
+  exact FieldWorlds.of_replicate schemaFields rightCount
+    (transfer related leftWorlds)
+
+/-- Values accepted by a uniform field schema cannot name a missing heap
+location.  This is the local freshness fact used when restricting an existing
+heap bijection after a hot reset consumes its source node. -/
+theorem FieldWorlds.avoidsMissing {store : Store} {schema : CtorSchema}
+    {values : Array RVal} {world : Owned} {count location : Nat}
+    (schemaFields : schema.fields = Array.replicate count world)
+    (worlds : FieldWorlds store schema values)
+    (missing : store.get? location = none) :
+    ∀ value ∈ values.toList, value ≠ .loc location := by
+  obtain ⟨_count, valuesWorld⟩ := worlds.to_replicate schemaFields
+  intro value member
+  have valueWorld := valuesWorld value member
+  cases value with
+  | loc actual =>
+      intro same
+      cases same
+      simp [RVal.hasWorld, missing] at valueWorld
+  | lit literal => intro impossible; cases impossible
+  | erased => intro impossible; cases impossible
+
+/-- A scalar, or a live shared location with a positive refcount.  This is
+the local safety fact needed to show that releasing a freshly retained field
+takes the non-final branch. -/
+def SharedPositive (store : Store) : RVal → Prop
+  | .loc location =>
+      ∃ rc node, store.get? location = some ⟨.shared, rc, node⟩ ∧ 0 < rc
+  | .lit _ | .erased => True
+
+/-- Every field edge of an exactly owned shared node points to a positive
+shared value (or is scalar). -/
+theorem sharedChild_positive {store : Store} {parent parentRc : Nat}
+    {node : IxIR1.Node} {roots : List IxIR1.Sim.Root} {child : RVal}
+    (parentAt : store.get? parent =
+      some ⟨.shared, parentRc, node⟩)
+    (owned : IxIR1.Sim.RootOwnership store.heap roots)
+    (member : child ∈ IxIR1.Sim.nodeChildren node) :
+    SharedPositive store child := by
+  cases child with
+  | lit literal => trivial
+  | erased => trivial
+  | loc childLocation =>
+      have childWorld := owned.edges_world parentAt (.loc childLocation) member
+      obtain ⟨childBox, childAt, childBoxWorld⟩ := childWorld
+      cases childBox with
+      | mk world rc childNode =>
+          change world = .shared at childBoxWorld
+          subst world
+          have count := owned.counts childAt
+          change rc = IxIR1.Sim.incoming store.heap roots childLocation at count
+          have edge : childLocation ∈ IxIR1.Sim.edgeLocations store.heap :=
+            IxIR1.Sim.child_location_mem_edgeLocations parentAt member
+          have positiveIncoming :
+              0 < IxIR1.Sim.incoming store.heap roots childLocation := by
+            rw [IxIR1.Sim.incoming, List.count_pos_iff]
+            exact List.mem_append_right _ edge
+          exact ⟨rc, childNode, childAt, by omega⟩
+
+/-- Killing a different live slot preserves positivity. -/
+theorem SharedPositive.kill {store : Store} {value : RVal}
+    {target : Nat} {targetBox : IxIR1.NodeBox}
+    (positive : SharedPositive store value)
+    (targetAt : store.get? target = some targetBox)
+    (different : value ≠ .loc target) :
+    SharedPositive (store.kill target) value := by
+  cases value with
+  | lit literal => trivial
+  | erased => trivial
+  | loc location =>
+      obtain ⟨rc, node, valueAt, rcPositive⟩ := positive
+      have targetNe : target ≠ location := by
+        intro same
+        subst location
+        exact different rfl
+      exact ⟨rc, node,
+        IxIR1.Sim.get?_kill_other targetNe targetAt valueAt, rcPositive⟩
+
+/-- Retaining any value preserves positivity of every already-positive shared
+value. -/
+theorem SharedPositive.retain {store retained : Store}
+    {preserved changed : RVal}
+    (positive : SharedPositive store preserved)
+    (run : retainShared store changed = .ok retained) :
+    SharedPositive retained preserved := by
+  cases preserved with
+  | lit literal => trivial
+  | erased => trivial
+  | loc protectedLocation =>
+      obtain ⟨protectedRc, protectedNode, protectedAt, protectedPositive⟩ :=
+        positive
+      cases changed with
+      | lit literal =>
+          have storeEq : store = retained := by
+            simpa [retainShared] using run
+          subst retained
+          exact ⟨protectedRc, protectedNode, protectedAt, protectedPositive⟩
+      | erased =>
+          have storeEq : store = retained := by
+            simpa [retainShared] using run
+          subst retained
+          exact ⟨protectedRc, protectedNode, protectedAt, protectedPositive⟩
+      | loc changedLocation =>
+          cases changedAt : store.get? changedLocation with
+          | none => simp [retainShared, changedAt] at run
+          | some changedBox =>
+              cases changedBox with
+              | mk changedWorld changedRc changedNode =>
+                  cases changedWorld with
+                  | unique => simp [retainShared, changedAt] at run
+                  | shared =>
+                      have retainedEq :
+                          incrementSharedStore store changedLocation
+                            ⟨.shared, changedRc, changedNode⟩ = retained := by
+                        simpa [retainShared, changedAt, incrementSharedStore]
+                          using run
+                      subst retained
+                      by_cases same : changedLocation = protectedLocation
+                      · subst changedLocation
+                        have boxEq :
+                            (⟨.shared, changedRc, changedNode⟩ :
+                              IxIR1.NodeBox) =
+                              ⟨.shared, protectedRc, protectedNode⟩ :=
+                          Option.some.inj (changedAt.symm.trans protectedAt)
+                        cases boxEq
+                        exact ⟨protectedRc + 1, protectedNode,
+                          get?_incrementSharedStore_same protectedAt, by omega⟩
+                      · exact ⟨protectedRc, protectedNode,
+                          get?_incrementSharedStore_other same changedAt
+                            protectedAt,
+                          protectedPositive⟩
+
+/-- A successful batch of retains preserves positivity of every previously
+positive shared value. -/
+theorem RetainSharedMany.preserve_positive {store retained : Store}
+    {values : List RVal} {preserved : RVal}
+    (run : RetainSharedMany store values.toArray retained)
+    (positive : SharedPositive store preserved) :
+    SharedPositive retained preserved := by
+  induction values generalizing store with
+  | nil =>
+      change (.ok store : Except Error Store) = .ok retained at run
+      injection run with storeEq
+      subst retained
+      exact positive
+  | cons value values ih =>
+      obtain ⟨middle, head, tail⟩ :=
+        Eval.RetainSharedMany.cons_inv (run := run)
+      exact ih tail (positive.retain head)
+
+private theorem setIfInBounds_existing {entries : Array (Option IxIR1.NodeBox)}
+    {location : Nat} {box : IxIR1.NodeBox}
+    (found : entries[location]? = some (some box)) :
+    entries.setIfInBounds location (some box) = entries := by
+  apply Array.ext_getElem?
+  intro other
+  by_cases same : location = other
+  · subst other
+    obtain ⟨bound, atLocation⟩ := Array.getElem?_eq_some_iff.mp found
+    simp [bound, atLocation]
+  · simp [same]
+
+/-- Releasing a just-retained positive shared value cancels its refcount
+increment in the semantic heap, even when the release starts from a store
+whose accounting counters differ.  The remaining work list and heap-fuel
+suffix are exposed unchanged. -/
+theorem releaseRetainedHead {base retained releaseStart : Store}
+    {value : RVal} {rest : List RVal} {heapFuel : Nat}
+    (positive : SharedPositive base value)
+    (retainedRun : retainShared base value = .ok retained)
+    (contents : HeapContentsEq releaseStart retained) :
+    ∃ afterHead,
+      releaseSharedWork (heapFuel + 1) releaseStart (value :: rest) =
+        releaseSharedWork heapFuel afterHead rest ∧
+      HeapContentsEq afterHead base := by
+  cases value with
+  | lit literal =>
+      have baseEq : base = retained := by
+        simpa [retainShared] using retainedRun
+      subst retained
+      exact ⟨releaseStart, rfl, contents⟩
+  | erased =>
+      have baseEq : base = retained := by
+        simpa [retainShared] using retainedRun
+      subst retained
+      exact ⟨releaseStart, rfl, contents⟩
+  | loc location =>
+      obtain ⟨rc, node, baseAt, rcPositive⟩ := positive
+      have retainedEq :
+          incrementSharedStore base location ⟨.shared, rc, node⟩ =
+            retained := by
+        simpa [retainShared, baseAt, incrementSharedStore] using retainedRun
+      subst retained
+      have retainedAt := get?_incrementSharedStore_same baseAt
+      have releaseAt : releaseStart.get? location =
+          some ⟨.shared, rc + 1, node⟩ := by
+        rw [contents.get?_eq location]
+        exact retainedAt
+      let afterHead := baselineDecrementStore releaseStart location
+        ⟨.shared, rc + 1, node⟩
+      refine ⟨afterHead, ?_, ?_⟩
+      · have nonzero : (rc + 1 == 0) = false :=
+          beq_eq_false_iff_ne.mpr (by omega)
+        have nonunit : (rc + 1 == 1) = false :=
+          beq_eq_false_iff_ne.mpr (by omega)
+        simp [releaseSharedWork, releaseAt, nonzero, nonunit,
+          afterHead, baselineDecrementStore]
+      · constructor
+        have baseNodesAt : base.heap.nodes[location]? =
+            some (some ⟨.shared, rc, node⟩) :=
+          IxIR1.Sim.nodes_get?_of_get? baseAt
+        have restored := setIfInBounds_existing baseNodesAt
+        simpa [afterHead, baselineDecrementStore, incrementSharedStore,
+          Eval.Store.setBox, Eval.Store.rcTick, IxIR1.Store.setBox,
+          IxIR1.Store.rcTick, Array.set!_eq_setIfInBounds, contents.nodes]
+          using restored
+
+/-- Retaining a vector of positive shared fields and subsequently releasing
+the same vector restores the exact node array.  The release may start from a
+counter-different store, which is needed after the parent's hot shallow
+free. -/
+theorem retainedFields_release_roundtrip :
+    ∀ {base retained releaseStart output : Store} {values : List RVal}
+      {heapFuel remaining : Nat},
+      (∀ value ∈ values, SharedPositive base value) →
+      RetainSharedMany base values.toArray retained →
+      HeapContentsEq releaseStart retained →
+      releaseSharedWork heapFuel releaseStart values =
+        .ok (output, remaining) →
+      HeapContentsEq output base := by
+  intro base retained releaseStart output values
+  induction values generalizing base retained releaseStart output with
+  | nil =>
+      intro heapFuel remaining _ retainedRun contents releaseRun
+      change (.ok base : Except Error Store) = .ok retained at retainedRun
+      injection retainedRun with retainedEq
+      subst retained
+      have releaseEq :
+          (.ok (releaseStart, heapFuel) : Except Error (Store × Nat)) =
+            .ok (output, remaining) := by
+        cases heapFuel <;> simpa [releaseSharedWork] using releaseRun
+      have pairEq : (releaseStart, heapFuel) = (output, remaining) :=
+        Except.ok.inj releaseEq
+      cases pairEq
+      exact contents
+  | cons head tail ih =>
+      intro heapFuel remaining positives retainedRun contents releaseRun
+      cases heapFuel with
+      | zero => simp [releaseSharedWork] at releaseRun
+      | succ heapFuel =>
+          obtain ⟨middle, tailRetained, headRetained⟩ :=
+            RetainSharedMany.rotate_head retainedRun
+          have headPositive : SharedPositive base head :=
+            positives head (by simp)
+          have headPositiveMiddle : SharedPositive middle head :=
+            RetainSharedMany.preserve_positive tailRetained headPositive
+          obtain ⟨afterHead, releaseHead, afterHeadContents⟩ :=
+            releaseRetainedHead headPositiveMiddle headRetained contents
+          rw [releaseHead] at releaseRun
+          apply ih
+          · intro value member
+            exact positives value (by simp [member])
+          · exact tailRetained
+          · exact afterHeadContents
+          · exact releaseRun
+
+/-- The compiler-emitted hot baseline prefix—retain every projected field,
+then deep-release the unit-refcount parent—has exactly the same node array as
+the logical hot reset's shallow parent kill.
+
+The premise is the baseline evaluator's successful release equation.  The
+proof derives its child-work suffix, cancels every retain/release pair, and
+uses exact ownership to rule out a self-field pointing back to the unit
+parent. -/
+theorem hotPrefix_contents {store baselineRetained output : Store}
+    {target : Nat} {cid : CtorId} {fields : Array RVal}
+    {fieldFuel remaining : Nat} {ambient : List IxIR1.Sim.Root}
+    (targetAt : store.get? target =
+      some ⟨.shared, 1, .ctorN cid fields⟩)
+    (owned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc target⟩ :: ambient))
+    (retained : RetainSharedMany store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc target) = .ok (output, remaining)) :
+    HeapContentsEq output (logicalHotResetStore store target) := by
+  have different : ∀ value ∈ fields.toList, value ≠ .loc target := by
+    intro value member
+    apply owned.sole_child_ne targetAt targetAt
+    simpa [IxIR1.Sim.nodeChildren] using member
+  have retainedList :
+      RetainSharedMany store fields.toList.toArray baselineRetained := by
+    simpa using retained
+  have retainedTarget : baselineRetained.get? target =
+      some ⟨.shared, 1, .ctorN cid fields⟩ :=
+    RetainSharedMany.preserves_box targetAt different retainedList
+  have childRelease :
+      releaseSharedWork fieldFuel
+          (baselineRetained.rcTick.kill target) fields.toList =
+        .ok (output, remaining) := by
+    unfold releaseShared at released
+    simpa [releaseSharedWork, retainedTarget] using released
+  have retainedAfterKill :
+      RetainSharedMany (store.kill target) fields.toList.toArray
+        (baselineRetained.kill target) :=
+    RetainSharedMany.kill_commute targetAt different retainedList
+  have positives : ∀ value ∈ fields.toList,
+      SharedPositive (store.kill target) value := by
+    intro value member
+    exact (sharedChild_positive targetAt owned
+      (by simpa [IxIR1.Sim.nodeChildren] using member)).kill targetAt
+        (different value member)
+  have releaseStartContents :
+      HeapContentsEq (baselineRetained.rcTick.kill target)
+        (baselineRetained.kill target) := ⟨rfl⟩
+  have restored : HeapContentsEq output (store.kill target) :=
+    retainedFields_release_roundtrip positives retainedAfterKill
+      releaseStartContents childRelease
+  exact restored.trans ⟨rfl⟩
+
+/-- Deep shared release is congruent under exact node-array equality.  It
+therefore cannot observe the reset and RC accounting differences intentionally
+forgotten by `HeapContentsEq`. -/
+theorem releaseSharedWork_contents_congr :
+    ∀ {fuel : Nat} {left right : Store} {values : List RVal}
+      {leftOut : Store} {remaining : Nat},
+      HeapContentsEq left right →
+      releaseSharedWork fuel left values = .ok (leftOut, remaining) →
+      ∃ rightOut,
+        releaseSharedWork fuel right values = .ok (rightOut, remaining) ∧
+        HeapContentsEq leftOut rightOut := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro left right values leftOut remaining heaps run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run ⊢
+          have pairEq : (left, 0) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, rfl, heaps⟩
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      intro left right values leftOut remaining heaps run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run ⊢
+          have pairEq : (left, fuel + 1) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, rfl, heaps⟩
+      | cons value rest =>
+          cases value with
+          | lit literal =>
+              simp only [releaseSharedWork] at run ⊢
+              exact ih heaps run
+          | erased =>
+              simp only [releaseSharedWork] at run ⊢
+              exact ih heaps run
+          | loc location =>
+              have lookup := heaps.get?_eq location
+              cases leftAt : left.get? location with
+              | none => simp [releaseSharedWork, leftAt] at run
+              | some box =>
+                  have rightAt : right.get? location = some box := by
+                    rw [← lookup]
+                    exact leftAt
+                  cases box with
+                  | mk world rc node =>
+                      cases world with
+                      | unique =>
+                          simp [releaseSharedWork, leftAt] at run
+                      | shared =>
+                          by_cases zero : rc = 0
+                          · subst rc
+                            simp [releaseSharedWork, leftAt] at run
+                          · by_cases unit : rc = 1
+                            · subst rc
+                              simp [releaseSharedWork, leftAt, rightAt]
+                                at run ⊢
+                              exact ih (heaps.rcTick.kill location) run
+                            · have nonzero : (rc == 0) = false :=
+                                beq_eq_false_iff_ne.mpr zero
+                              have nonunit : (rc == 1) = false :=
+                                beq_eq_false_iff_ne.mpr unit
+                              simp [releaseSharedWork, leftAt, rightAt,
+                                nonzero, nonunit] at run ⊢
+                              exact ih
+                                ((heaps.rcTick).setBox location
+                                  ⟨.shared, rc - 1, node⟩) run
+
+/-- The public single-value release operation inherits exact-content
+congruence from its work-list implementation. -/
+theorem HeapContentsEq.releaseShared {left right leftOut : Store}
+    (heaps : HeapContentsEq left right) {fuel remaining : Nat}
+    {value : RVal}
+    (run : releaseShared fuel left value = .ok (leftOut, remaining)) :
+    ∃ rightOut,
+      releaseShared fuel right value = .ok (rightOut, remaining) ∧
+      HeapContentsEq leftOut rightOut := by
+  unfold Eval.releaseShared at run ⊢
+  exact releaseSharedWork_contents_congr heaps run
+
+/-- Extra heap fuel is preserved as extra remainder by a successful shared
+release traversal. -/
+theorem releaseSharedWork_addFuel :
+    ∀ {fuel : Nat} {store output : Store} {values : List RVal}
+      {remaining : Nat} (extra : Nat),
+      releaseSharedWork fuel store values = .ok (output, remaining) →
+      releaseSharedWork (fuel + extra) store values =
+        .ok (output, remaining + extra) := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro store output values remaining extra run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run ⊢
+          have pairEq : (store, 0) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          rfl
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      intro store output values remaining extra run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run ⊢
+          have pairEq : (store, fuel + 1) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          rfl
+      | cons value rest =>
+          rw [show fuel + 1 + extra = (fuel + extra) + 1 by omega]
+          cases value with
+          | lit literal =>
+              simp only [releaseSharedWork] at run ⊢
+              exact ih extra run
+          | erased =>
+              simp only [releaseSharedWork] at run ⊢
+              exact ih extra run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  cases box with
+                  | mk world rc node =>
+                      cases world with
+                      | unique => simp [releaseSharedWork, found] at run
+                      | shared =>
+                          by_cases zero : rc = 0
+                          · subst rc
+                            simp [releaseSharedWork, found] at run
+                          · by_cases unit : rc = 1
+                            · subst rc
+                              simp [releaseSharedWork, found] at run ⊢
+                              exact ih extra run
+                            · have nonzero : (rc == 0) = false :=
+                                beq_eq_false_iff_ne.mpr zero
+                              have nonunit : (rc == 1) = false :=
+                                beq_eq_false_iff_ne.mpr unit
+                              simp [releaseSharedWork, found, nonzero,
+                                nonunit] at run ⊢
+                              exact ih extra run
+
+/-- Deep shared release with extra target fuel preserves fuel dominance; the
+additional target budget remains as an equal additive suffix. -/
+theorem releaseSharedWork_historyIso {left right leftOut : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftFuel rightFuel remaining : Nat}
+    {leftValues rightValues : List RVal}
+    (fuel : leftFuel ≤ rightFuel)
+    (values : IxIR1.Sim.RValsIso heap.locRel leftValues rightValues)
+    (run : releaseSharedWork leftFuel left leftValues =
+      .ok (leftOut, remaining)) :
+    ∃ rightOut rightRemaining,
+      ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+        releaseSharedWork rightFuel right rightValues =
+            .ok (rightOut, rightRemaining) ∧
+          remaining ≤ rightRemaining ∧
+          outputHeap.locRel = heap.locRel := by
+  obtain ⟨rightOut, outputHeap, sameFuelRun, outputRelation⟩ :=
+    releaseSharedWork_historyIso_sameFuel heap values run
+  let extra := rightFuel - leftFuel
+  have extended := releaseSharedWork_addFuel extra sameFuelRun
+  have fuelEq : leftFuel + extra = rightFuel := Nat.add_sub_of_le fuel
+  refine ⟨rightOut, remaining + extra, outputHeap, ?_,
+    Nat.le_add_right remaining extra, outputRelation⟩
+  simpa [fuelEq] using extended
+
+/-- A successful shared release cannot increase its heap-fuel remainder. -/
+theorem releaseSharedWork_remaining_le :
+    ∀ {fuel : Nat} {store output : Store} {values : List RVal}
+      {remaining : Nat},
+      releaseSharedWork fuel store values = .ok (output, remaining) →
+      remaining ≤ fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro store output values remaining run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run
+          have pairEq : (store, 0) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact Nat.le_refl 0
+      | cons value rest => simp [releaseSharedWork] at run
+  | succ fuel ih =>
+      intro store output values remaining run
+      cases values with
+      | nil =>
+          simp only [releaseSharedWork] at run
+          have pairEq : (store, fuel + 1) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact Nat.le_refl _
+      | cons value rest =>
+          have finish : remaining ≤ fuel → remaining ≤ fuel + 1 :=
+            Nat.le_succ_of_le
+          cases value with
+          | lit literal =>
+              simp only [releaseSharedWork] at run
+              exact finish (ih run)
+          | erased =>
+              simp only [releaseSharedWork] at run
+              exact finish (ih run)
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [releaseSharedWork, found] at run
+              | some box =>
+                  cases box with
+                  | mk world rc node =>
+                      cases world with
+                      | unique => simp [releaseSharedWork, found] at run
+                      | shared =>
+                          by_cases zero : rc = 0
+                          · subst rc
+                            simp [releaseSharedWork, found] at run
+                          · by_cases unit : rc = 1
+                            · subst rc
+                              simp [releaseSharedWork, found] at run
+                              exact finish (ih run)
+                            · have nonzero : (rc == 0) = false :=
+                                beq_eq_false_iff_ne.mpr zero
+                              have nonunit : (rc == 1) = false :=
+                                beq_eq_false_iff_ne.mpr unit
+                              simp [releaseSharedWork, found, nonzero,
+                                nonunit] at run
+                              exact finish (ih run)
+
+/-- Batch shared release transports across exact heap contents while allowing
+the rewritten machine to start with additional traversal fuel. -/
+theorem HeapContentsEq.releaseSharedWork_of_le {left right leftOut : Store}
+    (heaps : HeapContentsEq left right)
+    {baselineFuel rewrittenFuel remaining : Nat} {values : List RVal}
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (run : releaseSharedWork baselineFuel left values =
+      .ok (leftOut, remaining)) :
+    ∃ rightOut rightRemaining,
+      releaseSharedWork rewrittenFuel right values =
+        .ok (rightOut, rightRemaining) ∧
+      HeapContentsEq leftOut rightOut ∧
+      remaining ≤ rightRemaining := by
+  obtain ⟨rightOut, sameFuelRun, outputHeaps⟩ :=
+    releaseSharedWork_contents_congr heaps run
+  let extra := rewrittenFuel - baselineFuel
+  have extended := releaseSharedWork_addFuel extra sameFuelRun
+  have fuelEq : baselineFuel + extra = rewrittenFuel := by
+    exact Nat.add_sub_of_le fuel
+  refine ⟨rightOut, remaining + extra, ?_, outputHeaps,
+    Nat.le_add_right remaining extra⟩
+  simpa [fuelEq] using extended
+
+theorem releaseShared_remaining_le {fuel remaining : Nat}
+    {store output : Store} {value : RVal}
+    (run : Eval.releaseShared fuel store value = .ok (output, remaining)) :
+    remaining ≤ fuel := by
+  unfold Eval.releaseShared at run
+  exact releaseSharedWork_remaining_le run
+
+theorem releaseShared_addFuel {fuel remaining : Nat}
+    {store output : Store} {value : RVal} (extra : Nat)
+    (run : Eval.releaseShared fuel store value = .ok (output, remaining)) :
+    Eval.releaseShared (fuel + extra) store value =
+      .ok (output, remaining + extra) := by
+  unfold Eval.releaseShared at run ⊢
+  exact releaseSharedWork_addFuel extra run
+
+/-- Exact-content release simulation permits the rewritten machine to carry
+additional heap fuel, as it does after replacing deep release by reset. -/
+theorem HeapContentsEq.releaseShared_of_le {left right leftOut : Store}
+    (heaps : HeapContentsEq left right)
+    {baselineFuel rewrittenFuel remaining : Nat} {value : RVal}
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (run : Eval.releaseShared baselineFuel left value =
+      .ok (leftOut, remaining)) :
+    ∃ rightOut rightRemaining,
+      Eval.releaseShared rewrittenFuel right value =
+        .ok (rightOut, rightRemaining) ∧
+      HeapContentsEq leftOut rightOut ∧
+      remaining ≤ rightRemaining := by
+  obtain ⟨rightOut, sameFuelRun, outputHeaps⟩ :=
+    heaps.releaseShared run
+  let extra := rewrittenFuel - baselineFuel
+  have extended := releaseShared_addFuel extra sameFuelRun
+  have fuelEq : baselineFuel + extra = rewrittenFuel := by
+    exact Nat.add_sub_of_le fuel
+  refine ⟨rightOut, remaining + extra, ?_, outputHeaps,
+    Nat.le_add_right remaining extra⟩
+  simpa [fuelEq] using extended
+
+/-- Deep unique destruction is likewise insensitive to accounting counters
+when the semantic node arrays agree. -/
+theorem dropUniqueWork_contents_congr :
+    ∀ {fuel : Nat} {left right : Store} {values : List RVal}
+      {leftOut : Store} {remaining : Nat},
+      HeapContentsEq left right →
+      dropUniqueWork fuel left values = .ok (leftOut, remaining) →
+      ∃ rightOut,
+        dropUniqueWork fuel right values = .ok (rightOut, remaining) ∧
+        HeapContentsEq leftOut rightOut := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro left right values leftOut remaining heaps run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run ⊢
+          have pairEq : (left, 0) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, rfl, heaps⟩
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      intro left right values leftOut remaining heaps run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run ⊢
+          have pairEq : (left, fuel + 1) = (leftOut, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact ⟨right, rfl, heaps⟩
+      | cons value rest =>
+          cases value with
+          | lit literal =>
+              simp only [dropUniqueWork] at run ⊢
+              exact ih heaps run
+          | erased =>
+              simp only [dropUniqueWork] at run ⊢
+              exact ih heaps run
+          | loc location =>
+              have lookup := heaps.get?_eq location
+              cases leftAt : left.get? location with
+              | none => simp [dropUniqueWork, leftAt] at run
+              | some box =>
+                  have rightAt : right.get? location = some box := by
+                    rw [← lookup]
+                    exact leftAt
+                  cases box with
+                  | mk world rc node =>
+                      cases world with
+                      | shared => simp [dropUniqueWork, leftAt] at run
+                      | unique =>
+                          cases node with
+                          | papN address arity arguments =>
+                              simp [dropUniqueWork, leftAt] at run
+                          | ctorN cid fields =>
+                              simp [dropUniqueWork, leftAt, rightAt] at run ⊢
+                              exact ih (heaps.kill location) run
+
+/-- The public single-value unique drop inherits exact-content congruence. -/
+theorem HeapContentsEq.dropUnique {left right leftOut : Store}
+    (heaps : HeapContentsEq left right) {fuel remaining : Nat}
+    {value : RVal}
+    (run : Eval.dropUnique fuel left value = .ok (leftOut, remaining)) :
+    ∃ rightOut,
+      Eval.dropUnique fuel right value = .ok (rightOut, remaining) ∧
+      HeapContentsEq leftOut rightOut := by
+  unfold Eval.dropUnique at run ⊢
+  exact dropUniqueWork_contents_congr heaps run
+
+/-- Extra heap fuel is preserved as extra remainder by successful unique
+destruction. -/
+theorem dropUniqueWork_addFuel :
+    ∀ {fuel : Nat} {store output : Store} {values : List RVal}
+      {remaining : Nat} (extra : Nat),
+      dropUniqueWork fuel store values = .ok (output, remaining) →
+      dropUniqueWork (fuel + extra) store values =
+        .ok (output, remaining + extra) := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro store output values remaining extra run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run ⊢
+          have pairEq : (store, 0) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          rfl
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      intro store output values remaining extra run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run ⊢
+          have pairEq : (store, fuel + 1) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          rfl
+      | cons value rest =>
+          rw [show fuel + 1 + extra = (fuel + extra) + 1 by omega]
+          cases value with
+          | lit literal =>
+              simp only [dropUniqueWork] at run ⊢
+              exact ih extra run
+          | erased =>
+              simp only [dropUniqueWork] at run ⊢
+              exact ih extra run
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  cases box with
+                  | mk world rc node =>
+                      cases world with
+                      | shared => simp [dropUniqueWork, found] at run
+                      | unique =>
+                          cases node with
+                          | papN address arity arguments =>
+                              simp [dropUniqueWork, found] at run
+                          | ctorN cid fields =>
+                              simp [dropUniqueWork, found] at run ⊢
+                              exact ih extra run
+
+/-- Unique destruction with extra target fuel preserves the history relation
+and leaves the extra budget as an additive suffix. -/
+theorem dropUniqueWork_historyIso {left right leftOut : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso left.heap right.heap)
+    {leftFuel rightFuel remaining : Nat}
+    {leftValues rightValues : List RVal}
+    (fuel : leftFuel ≤ rightFuel)
+    (values : IxIR1.Sim.RValsIso heap.locRel leftValues rightValues)
+    (run : dropUniqueWork leftFuel left leftValues =
+      .ok (leftOut, remaining)) :
+    ∃ rightOut rightRemaining,
+      ∃ outputHeap : IxIR1.Sim.HeapHistoryIso leftOut.heap rightOut.heap,
+        dropUniqueWork rightFuel right rightValues =
+            .ok (rightOut, rightRemaining) ∧
+          remaining ≤ rightRemaining ∧
+          outputHeap.locRel = heap.locRel := by
+  obtain ⟨rightOut, outputHeap, sameFuelRun, outputRelation⟩ :=
+    dropUniqueWork_historyIso_sameFuel heap values run
+  let extra := rightFuel - leftFuel
+  have extended := dropUniqueWork_addFuel extra sameFuelRun
+  have fuelEq : leftFuel + extra = rightFuel := Nat.add_sub_of_le fuel
+  refine ⟨rightOut, remaining + extra, outputHeap, ?_,
+    Nat.le_add_right remaining extra, outputRelation⟩
+  simpa [fuelEq] using extended
+
+theorem dropUniqueWork_remaining_le :
+    ∀ {fuel : Nat} {store output : Store} {values : List RVal}
+      {remaining : Nat},
+      dropUniqueWork fuel store values = .ok (output, remaining) →
+      remaining ≤ fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+      intro store output values remaining run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run
+          have pairEq : (store, 0) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact Nat.le_refl 0
+      | cons value rest => simp [dropUniqueWork] at run
+  | succ fuel ih =>
+      intro store output values remaining run
+      cases values with
+      | nil =>
+          simp only [dropUniqueWork] at run
+          have pairEq : (store, fuel + 1) = (output, remaining) :=
+            Except.ok.inj run
+          cases pairEq
+          exact Nat.le_refl _
+      | cons value rest =>
+          have finish : remaining ≤ fuel → remaining ≤ fuel + 1 :=
+            Nat.le_succ_of_le
+          cases value with
+          | lit literal =>
+              simp only [dropUniqueWork] at run
+              exact finish (ih run)
+          | erased =>
+              simp only [dropUniqueWork] at run
+              exact finish (ih run)
+          | loc location =>
+              cases found : store.get? location with
+              | none => simp [dropUniqueWork, found] at run
+              | some box =>
+                  cases box with
+                  | mk world rc node =>
+                      cases world with
+                      | shared => simp [dropUniqueWork, found] at run
+                      | unique =>
+                          cases node with
+                          | papN address arity arguments =>
+                              simp [dropUniqueWork, found] at run
+                          | ctorN cid fields =>
+                              simp [dropUniqueWork, found] at run
+                              exact finish (ih run)
+
+theorem dropUnique_addFuel {fuel remaining : Nat}
+    {store output : Store} {value : RVal} (extra : Nat)
+    (run : Eval.dropUnique fuel store value = .ok (output, remaining)) :
+    Eval.dropUnique (fuel + extra) store value =
+      .ok (output, remaining + extra) := by
+  unfold Eval.dropUnique at run ⊢
+  exact dropUniqueWork_addFuel extra run
+
+theorem HeapContentsEq.dropUnique_of_le {left right leftOut : Store}
+    (heaps : HeapContentsEq left right)
+    {baselineFuel rewrittenFuel remaining : Nat} {value : RVal}
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (run : Eval.dropUnique baselineFuel left value =
+      .ok (leftOut, remaining)) :
+    ∃ rightOut rightRemaining,
+      Eval.dropUnique rewrittenFuel right value =
+        .ok (rightOut, rightRemaining) ∧
+      HeapContentsEq leftOut rightOut ∧
+      remaining ≤ rightRemaining := by
+  obtain ⟨rightOut, sameFuelRun, outputHeaps⟩ := heaps.dropUnique run
+  let extra := rewrittenFuel - baselineFuel
+  have extended := dropUnique_addFuel extra sameFuelRun
+  have fuelEq : baselineFuel + extra = rewrittenFuel := by
+    exact Nat.add_sub_of_le fuel
+  refine ⟨rightOut, remaining + extra, ?_, outputHeaps,
+    Nat.le_add_right remaining extra⟩
+  simpa [fuelEq] using extended
+
+/-- The store at which the executable cold reset begins retaining projected
+fields. -/
+def coldResetStartStore (store : Store) (location : Nat)
+    (box : IxIR1.NodeBox) : Store :=
+  ((((store.tickResetAttempt).setBox location
+    { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+
+theorem coldResetStartStore_eq (store : Store) (location : Nat)
+    (box : IxIR1.NodeBox) :
+    coldResetStartStore store location box =
+      (baselineDecrementStore store location box).tickResetAttempt.tickColdReset := by
+  cases store with
+  | mk heap resetAttempts hotResets coldResets reusedPayloadUnits peakLiveNodes =>
+      cases heap with
+      | mk nodes allocs reuses frees rcops =>
+          rfl
+
+/-- The compiler's baseline cold prefix and `resetShared`'s cold operation
+produce the same semantic heap.  More precisely, from the baseline batch of
+field retains this theorem constructs both the subsequent non-final parent
+release and the exact batch retain required by the reset evaluator.  Their
+stores differ only by reset-observation counters, so their heap components
+are definitionally equal.
+
+No distinctness premise is needed: repeated fields and a field that aliases
+the parent are covered by `RetainSharedMany.decrement_commute`. -/
+theorem coldPrefix_commutes {store baselineRetained : Store}
+    {target rc : Nat} {cid : CtorId} {fields : Array RVal}
+    {heapFuel : Nat}
+    (hget : store.get? target =
+      some ⟨.shared, rc, .ctorN cid fields⟩)
+    (hmany : 1 < rc)
+    (retained : RetainSharedMany store fields baselineRetained) :
+    ∃ retainedRc,
+      baselineRetained.get? target =
+        some ⟨.shared, retainedRc, .ctorN cid fields⟩ ∧
+      releaseShared (heapFuel + 1) baselineRetained (.loc target) =
+        .ok (baselineDecrementStore baselineRetained target
+          ⟨.shared, retainedRc, .ctorN cid fields⟩, heapFuel) ∧
+      RetainSharedMany
+        (coldResetStartStore store target
+          ⟨.shared, rc, .ctorN cid fields⟩)
+        fields
+        ((baselineDecrementStore baselineRetained target
+          ⟨.shared, retainedRc, .ctorN cid fields⟩).tickResetAttempt.tickColdReset) ∧
+      (baselineDecrementStore baselineRetained target
+          ⟨.shared, retainedRc, .ctorN cid fields⟩).heap =
+        ((baselineDecrementStore baselineRetained target
+          ⟨.shared, retainedRc, .ctorN cid fields⟩).tickResetAttempt.tickColdReset).heap := by
+  have retainedList :
+      RetainSharedMany store fields.toList.toArray baselineRetained := by
+    simpa using retained
+  obtain ⟨retainedRc, retainedAt, retainedMany, commuted⟩ :=
+    RetainSharedMany.decrement_commute hget hmany retainedList
+  have released :
+      releaseShared (heapFuel + 1) baselineRetained (.loc target) =
+        .ok (baselineDecrementStore baselineRetained target
+          ⟨.shared, retainedRc, .ctorN cid fields⟩, heapFuel) := by
+    simp [releaseShared, releaseSharedWork, retainedAt,
+      baselineDecrementStore,
+      show (retainedRc == 0) = false by
+        exact beq_eq_false_iff_ne.mpr (by omega),
+      show (retainedRc == 1) = false by
+        exact beq_eq_false_iff_ne.mpr (by omega)]
+  have resetAttemptRetained :=
+    RetainSharedMany.tickResetAttempt commuted
+  have resetRetained :=
+    RetainSharedMany.tickColdReset resetAttemptRetained
+  rw [← coldResetStartStore_eq] at resetRetained
+  simpa using ⟨retainedRc, retainedAt, released, resetRetained, rfl⟩
+
+/-- A non-final shared release performs exactly one refcount decrement and
+spends exactly one unit of heap fuel. -/
+theorem releaseShared_nonfinal {store : Store} {location rc : Nat}
+    {node : IxIR1.Node} {heapFuel : Nat}
+    (hget : store.get? location = some ⟨.shared, rc, node⟩)
+    (hmany : 1 < rc) :
+    releaseShared (heapFuel + 1) store (.loc location) =
+      .ok (baselineDecrementStore store location
+        ⟨.shared, rc, node⟩, heapFuel) := by
+  simp [releaseShared, releaseSharedWork, hget, baselineDecrementStore,
+    show (rc == 0) = false by exact beq_eq_false_iff_ne.mpr (by omega),
+    show (rc == 1) = false by exact beq_eq_false_iff_ne.mpr (by omega)]
+
+@[simp] theorem logicalHotResetStore_heap (store : Store) (location : Nat) :
+    (logicalHotResetStore store location).heap = store.heap.kill location :=
+  rfl
+
+@[simp] theorem physicalHotResetStore_nodes (store : Store)
+    (location : Nat) :
+    (physicalHotResetStore store location).heap.nodes =
+      store.heap.nodes.setIfInBounds location none :=
+  rfl
+
+@[simp] theorem logicalHotReuseStore_heap (store : Store) (location : Nat)
+    (node : IxIR1.Node) :
+    (logicalHotReuseStore store location node).1.heap =
+      ((store.heap.kill location).allocNode .shared node).1 :=
+  rfl
+
+@[simp] theorem logicalHotReuseStore_location (store : Store)
+    (location : Nat) (node : IxIR1.Node) :
+    (logicalHotReuseStore store location node).2 =
+      ((store.heap.kill location).allocNode .shared node).2 :=
+  rfl
+
+/-- A live source slot becomes the empty in-bounds reservation expected by
+the physical credit. -/
+theorem physicalHotResetStore_reserved {store : Store} {location : Nat}
+    {box : IxIR1.NodeBox} (hget : store.get? location = some box) :
+    (physicalHotResetStore store location).heap.nodes[location]? =
+      some none := by
+  have hnodes : store.heap.nodes[location]? = some (some box) :=
+    IxIR1.Sim.nodes_get?_of_get? hget
+  obtain ⟨hlt, _⟩ := Array.getElem?_eq_some_iff.mp hnodes
+  simp [physicalHotResetStore, Eval.Store.tickResetAttempt,
+    Eval.Store.tickHotReset, Eval.Store.reserve,
+    hlt]
+
+/-- Successful concrete physical credit consumption has exactly the IxIR₁
+shared in-place-reuse heap.  IxIR₂-only reset and payload counters remain
+outside that semantic heap equation. -/
+theorem physicalHotReuseStore_ok {store : Store} {location : Nat}
+    {oldBox : IxIR1.NodeBox} (node : IxIR1.Node) (payloadUnits : Nat)
+    (hget : store.get? location = some oldBox) :
+    ∃ result,
+      physicalHotReuseStore store location node payloadUnits = .ok result ∧
+      result.heap =
+        IxIR1.Sim.reuseSharedNodeStore store.heap location node := by
+  unfold physicalHotReuseStore Eval.Store.reuseReservation
+  rw [physicalHotResetStore_reserved hget]
+  refine ⟨_, rfl, ?_⟩
+  rw [IxIR1.Sim.reuseSharedNodeStore_eq_direct]
+  simp [physicalHotResetStore, Eval.Store.tickResetAttempt,
+    Eval.Store.tickHotReset, Eval.Store.reserve,
+    IxIR1.Store.setBox, Array.set!_eq_setIfInBounds]
+
+/-! ## Hot shared-reuse soundness -/
+
+/-- Concrete physical hot reuse and concrete logical hot reuse preserve exact
+ownership and are related by a live-location bijection.  The reused physical
+slot corresponds to the logical allocator's fresh append location; every
+other live location corresponds to itself.
+
+This is the heap-algebra leaf needed by the block simulation.  Its
+`List.Perm` premise is the compositional ownership interface for arbitrary
+field and tail-argument permutations recovered by the checked planner. -/
+theorem hotReuse_sound {store : Store} {target : Nat}
+    {oldNode newNode : IxIR1.Node} {before after : List IxIR1.Sim.Root}
+    (payloadUnits : Nat)
+    (hget : store.get? target = some ⟨.shared, 1, oldNode⟩)
+    (hown : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc target⟩ :: before))
+    (hpartition :
+      (IxIR1.Sim.rootsFor .shared (IxIR1.Sim.nodeChildren oldNode) ++
+          before).Perm
+        (IxIR1.Sim.rootsFor .shared (IxIR1.Sim.nodeChildren newNode) ++
+          after))
+    (hworld : IxIR1.Sim.NodeWorld .shared newNode) :
+    ∃ physical,
+      physicalHotReuseStore store target newNode payloadUnits = .ok physical ∧
+      ∃ iso : IxIR1.Sim.HeapIso physical.heap
+          (logicalHotReuseStore store target newNode).1.heap,
+        IxIR1.Sim.RootOwnership physical.heap
+            (⟨.shared, .loc target⟩ :: after) ∧
+        IxIR1.Sim.RootOwnership
+            (logicalHotReuseStore store target newNode).1.heap
+            (⟨.shared,
+              .loc (logicalHotReuseStore store target newNode).2⟩ :: after) ∧
+        iso.locRel target (logicalHotReuseStore store target newNode).2 := by
+  obtain ⟨physical, reused, physicalHeap⟩ :=
+    physicalHotReuseStore_ok newNode payloadUnits hget
+  obtain ⟨iso, physicalOwned, logicalOwned, resultRelated⟩ :=
+    IxIR1.Sim.reuse_shared_sound hget hown hpartition hworld
+  refine ⟨physical, reused, ?_⟩
+  rw [physicalHeap]
+  exact ⟨iso, physicalOwned, logicalOwned, resultRelated⟩
+
+/-- Concrete hot reuse additionally self-relates every surviving external
+root.  This is the value-transport interface needed when the recursive
+continuation retains locations other than the replaced result. -/
+theorem hotReuse_sound_with_survivors {store : Store} {target : Nat}
+    {oldNode newNode : IxIR1.Node} {before after : List IxIR1.Sim.Root}
+    (payloadUnits : Nat)
+    (hget : store.get? target = some ⟨.shared, 1, oldNode⟩)
+    (hown : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc target⟩ :: before))
+    (hpartition :
+      (IxIR1.Sim.rootsFor .shared (IxIR1.Sim.nodeChildren oldNode) ++
+          before).Perm
+        (IxIR1.Sim.rootsFor .shared (IxIR1.Sim.nodeChildren newNode) ++
+          after))
+    (hworld : IxIR1.Sim.NodeWorld .shared newNode) :
+    ∃ physical,
+      physicalHotReuseStore store target newNode payloadUnits = .ok physical ∧
+      ∃ iso : IxIR1.Sim.HeapIso physical.heap
+          (logicalHotReuseStore store target newNode).1.heap,
+        IxIR1.Sim.RootOwnership physical.heap
+            (⟨.shared, .loc target⟩ :: after) ∧
+        IxIR1.Sim.RootOwnership
+            (logicalHotReuseStore store target newNode).1.heap
+            (⟨.shared,
+              .loc (logicalHotReuseStore store target newNode).2⟩ :: after) ∧
+        iso.locRel target (logicalHotReuseStore store target newNode).2 ∧
+        ∀ root ∈ after,
+          IxIR1.Sim.RValIso iso.locRel root.value root.value := by
+  obtain ⟨physical, reused, physicalHeap⟩ :=
+    physicalHotReuseStore_ok newNode payloadUnits hget
+  obtain ⟨iso, physicalOwned, logicalOwned, resultRelated,
+      survivorsRelated⟩ :=
+    IxIR1.Sim.reuse_shared_sound_with_survivors hget hown hpartition hworld
+  refine ⟨physical, reused, ?_⟩
+  rw [physicalHeap]
+  exact ⟨iso, physicalOwned, logicalOwned, resultRelated,
+    survivorsRelated⟩
+
+/-- End-to-end hot-prefix leaf for the insertion proof.  Starting from the
+actual successful baseline retain/release prefix, ordinary fresh allocation
+is related to physical reset/reuse by a live-location bijection.  Thus this
+theorem combines the previously separate baseline-prefix cancellation and
+physical/logical reuse leaves at the first point where the rewritten block
+can rejoin its tail call. -/
+theorem hotPrefixReuse_sound {store baselineRetained baselineReleased : Store}
+    {target : Nat} {oldCid newCid : CtorId}
+    {fields newFields : Array RVal} {fieldFuel remaining : Nat}
+    {before after : List IxIR1.Sim.Root}
+    (payloadUnits : Nat)
+    (targetAt : store.get? target =
+      some ⟨.shared, 1, .ctorN oldCid fields⟩)
+    (owned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc target⟩ :: before))
+    (retained : RetainSharedMany store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc target) = .ok (baselineReleased, remaining))
+    (partition :
+      (IxIR1.Sim.rootsFor .shared fields.toList ++ before).Perm
+        (IxIR1.Sim.rootsFor .shared newFields.toList ++ after))
+    (newWorld : IxIR1.Sim.NodeWorld .shared (.ctorN newCid newFields)) :
+    let baselineAllocation :=
+      baselineReleased.allocNode .shared (.ctorN newCid newFields)
+    ∃ physical,
+      physicalHotReuseStore store target (.ctorN newCid newFields)
+          payloadUnits = .ok physical ∧
+      ∃ iso : IxIR1.Sim.HeapIso physical.heap baselineAllocation.1.heap,
+        IxIR1.Sim.RootOwnership physical.heap
+            (⟨.shared, .loc target⟩ :: after) ∧
+        IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+            (⟨.shared, .loc baselineAllocation.2⟩ :: after) ∧
+        iso.locRel target baselineAllocation.2 := by
+  dsimp only
+  have prefixContents :
+      HeapContentsEq baselineReleased (logicalHotResetStore store target) :=
+    hotPrefix_contents targetAt owned retained released
+  have allocationContents :
+      HeapContentsEq
+        (baselineReleased.allocNode .shared (.ctorN newCid newFields)).1
+        (logicalHotReuseStore store target
+          (.ctorN newCid newFields)).1 := by
+    simpa [logicalHotReuseStore] using
+      prefixContents.allocNode .shared (.ctorN newCid newFields)
+  have allocationLocation :
+      (baselineReleased.allocNode .shared (.ctorN newCid newFields)).2 =
+        (logicalHotReuseStore store target
+          (.ctorN newCid newFields)).2 := by
+    simpa [logicalHotReuseStore] using
+      prefixContents.allocNode_location .shared (.ctorN newCid newFields)
+  obtain ⟨physical, reused, logicalIso, physicalOwned, logicalOwned,
+      resultRelated⟩ :=
+    hotReuse_sound (store := store) (target := target)
+      (oldNode := .ctorN oldCid fields)
+      (newNode := .ctorN newCid newFields)
+      (before := before) (after := after) payloadUnits targetAt owned
+      partition newWorld
+  have baselineOwned :
+      IxIR1.Sim.RootOwnership
+        (baselineReleased.allocNode .shared
+          (.ctorN newCid newFields)).1.heap
+        (⟨.shared,
+          .loc (baselineReleased.allocNode .shared
+            (.ctorN newCid newFields)).2⟩ :: after) := by
+    apply allocationContents.symm.rootOwnership
+    rw [allocationLocation]
+    exact logicalOwned
+  have logicalClosed : IxIR1.Sim.StoreClosed
+      (logicalHotReuseStore store target
+        (.ctorN newCid newFields)).1.heap :=
+    IxIR1.Sim.RootOwnership.storeClosed logicalOwned
+  let logicalToBaseline := allocationContents.symm.toHeapIso logicalClosed
+  let iso := logicalIso.trans logicalToBaseline
+  have logicalResultLive := logicalOwned.roots_world
+    (⟨.shared,
+      .loc (logicalHotReuseStore store target
+        (.ctorN newCid newFields)).2⟩ : IxIR1.Sim.Root) (by simp)
+  obtain ⟨logicalResultBox, logicalResultAt, _⟩ := logicalResultLive
+  have logicalToBaselineResult :
+      logicalToBaseline.locRel
+        (logicalHotReuseStore store target (.ctorN newCid newFields)).2
+        (baselineReleased.allocNode .shared
+          (.ctorN newCid newFields)).2 := by
+    have selfRelated := allocationContents.symm.toHeapIso_rel_self
+      logicalClosed logicalResultAt
+    rw [allocationLocation]
+    exact selfRelated
+  refine ⟨physical, reused, iso, physicalOwned, baselineOwned, ?_⟩
+  exact ⟨_, resultRelated, logicalToBaselineResult⟩
+
+/-- The complete hot-prefix theorem additionally transports every surviving
+external root through the composed physical-to-baseline heap isomorphism.
+The reused result maps to the fresh baseline allocation, while all other
+continuation roots remain self-related. -/
+theorem hotPrefixReuse_sound_with_survivors
+    {store baselineRetained baselineReleased : Store}
+    {target : Nat} {oldCid newCid : CtorId}
+    {fields newFields : Array RVal} {fieldFuel remaining : Nat}
+    {before after : List IxIR1.Sim.Root}
+    (payloadUnits : Nat)
+    (targetAt : store.get? target =
+      some ⟨.shared, 1, .ctorN oldCid fields⟩)
+    (owned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc target⟩ :: before))
+    (retained : RetainSharedMany store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc target) = .ok (baselineReleased, remaining))
+    (partition :
+      (IxIR1.Sim.rootsFor .shared fields.toList ++ before).Perm
+        (IxIR1.Sim.rootsFor .shared newFields.toList ++ after))
+    (newWorld : IxIR1.Sim.NodeWorld .shared (.ctorN newCid newFields)) :
+    let baselineAllocation :=
+      baselineReleased.allocNode .shared (.ctorN newCid newFields)
+    ∃ physical,
+      physicalHotReuseStore store target (.ctorN newCid newFields)
+          payloadUnits = .ok physical ∧
+      ∃ iso : IxIR1.Sim.HeapIso physical.heap baselineAllocation.1.heap,
+        IxIR1.Sim.RootOwnership physical.heap
+            (⟨.shared, .loc target⟩ :: after) ∧
+        IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+            (⟨.shared, .loc baselineAllocation.2⟩ :: after) ∧
+        iso.locRel target baselineAllocation.2 ∧
+        ∀ root ∈ after,
+          IxIR1.Sim.RValIso iso.locRel root.value root.value := by
+  dsimp only
+  have prefixContents :
+      HeapContentsEq baselineReleased (logicalHotResetStore store target) :=
+    hotPrefix_contents targetAt owned retained released
+  have allocationContents :
+      HeapContentsEq
+        (baselineReleased.allocNode .shared (.ctorN newCid newFields)).1
+        (logicalHotReuseStore store target
+          (.ctorN newCid newFields)).1 := by
+    simpa [logicalHotReuseStore] using
+      prefixContents.allocNode .shared (.ctorN newCid newFields)
+  have allocationLocation :
+      (baselineReleased.allocNode .shared (.ctorN newCid newFields)).2 =
+        (logicalHotReuseStore store target
+          (.ctorN newCid newFields)).2 := by
+    simpa [logicalHotReuseStore] using
+      prefixContents.allocNode_location .shared (.ctorN newCid newFields)
+  obtain ⟨physical, reused, logicalIso, physicalOwned, logicalOwned,
+      resultRelated, survivorsRelated⟩ :=
+    hotReuse_sound_with_survivors (store := store) (target := target)
+      (oldNode := .ctorN oldCid fields)
+      (newNode := .ctorN newCid newFields)
+      (before := before) (after := after) payloadUnits targetAt owned
+      partition newWorld
+  have baselineOwned :
+      IxIR1.Sim.RootOwnership
+        (baselineReleased.allocNode .shared
+          (.ctorN newCid newFields)).1.heap
+        (⟨.shared,
+          .loc (baselineReleased.allocNode .shared
+            (.ctorN newCid newFields)).2⟩ :: after) := by
+    apply allocationContents.symm.rootOwnership
+    rw [allocationLocation]
+    exact logicalOwned
+  have logicalClosed : IxIR1.Sim.StoreClosed
+      (logicalHotReuseStore store target
+        (.ctorN newCid newFields)).1.heap :=
+    IxIR1.Sim.RootOwnership.storeClosed logicalOwned
+  let logicalToBaseline := allocationContents.symm.toHeapIso logicalClosed
+  let iso := logicalIso.trans logicalToBaseline
+  have logicalResultLive := logicalOwned.roots_world
+    (⟨.shared,
+      .loc (logicalHotReuseStore store target
+        (.ctorN newCid newFields)).2⟩ : IxIR1.Sim.Root) (by simp)
+  obtain ⟨logicalResultBox, logicalResultAt, _⟩ := logicalResultLive
+  have logicalToBaselineResult :
+      logicalToBaseline.locRel
+        (logicalHotReuseStore store target (.ctorN newCid newFields)).2
+        (baselineReleased.allocNode .shared
+          (.ctorN newCid newFields)).2 := by
+    have selfRelated := allocationContents.symm.toHeapIso_rel_self
+      logicalClosed logicalResultAt
+    rw [allocationLocation]
+    exact selfRelated
+  refine ⟨physical, reused, iso, physicalOwned, baselineOwned,
+    ⟨_, resultRelated, logicalToBaselineResult⟩, ?_⟩
+  intro root member
+  have logicalSelf := survivorsRelated root member
+  have logicalToBaselineSelf : IxIR1.Sim.RValIso
+      logicalToBaseline.locRel root.value root.value := by
+    cases root with
+    | mk world value =>
+        cases value with
+        | lit literal => exact .lit
+        | erased => exact .erased
+        | loc location =>
+            obtain ⟨box, live, _⟩ := logicalOwned.roots_world
+              ⟨world, .loc location⟩ (by simp [member])
+            exact .loc (allocationContents.symm.toHeapIso_rel_self
+              logicalClosed live)
+  exact logicalSelf.trans logicalToBaselineSelf
+
+/-- Physical hot reuse composes with an already-existing target-to-baseline
+heap bijection.  The consumed location pair is removed, corresponding fresh
+allocations extend the restricted relation, and physical in-place reuse is
+then composed on the target side.  Every old related pair except the consumed
+one remains related by the resulting bijection. -/
+theorem hotPrefixReuse_sound_under_iso
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineLocation rewrittenLocation : Nat}
+    {oldCid newCid : CtorId}
+    {baselineFields rewrittenFields baselineNewFields rewrittenNewFields :
+      Array RVal}
+    {fieldFuel remaining : Nat}
+    {baselineBefore baselineAfter rewrittenBefore rewrittenAfter :
+      List IxIR1.Sim.Root}
+    (payloadUnits : Nat)
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1, .ctorN oldCid baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1, .ctorN oldCid rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: baselineBefore))
+    (rewrittenOwned : IxIR1.Sim.RootOwnership rewrittenStore.heap
+      (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselinePartition :
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+          baselineBefore).Perm
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter))
+    (rewrittenPartition :
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+          rewrittenBefore).Perm
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter))
+    (newFieldsRelated : IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN newCid baselineNewFields)
+    ∃ physical,
+      physicalHotReuseStore rewrittenStore rewrittenLocation
+          (.ctorN newCid rewrittenNewFields) payloadUnits = .ok physical ∧
+      ∃ outputIso : IxIR1.Sim.HeapIso physical.heap
+          baselineAllocation.1.heap,
+        IxIR1.Sim.RootOwnership physical.heap
+            (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenAfter) ∧
+        IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+            (⟨.shared, .loc baselineAllocation.2⟩ :: baselineAfter) ∧
+        outputIso.locRel rewrittenLocation baselineAllocation.2 ∧
+        ∀ {rewrittenCandidate baselineCandidate : Nat},
+          inputIso.locRel rewrittenCandidate baselineCandidate →
+          rewrittenCandidate ≠ rewrittenLocation →
+          outputIso.locRel rewrittenCandidate baselineCandidate := by
+  dsimp only
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN newCid baselineNewFields)
+  let baselineLogicalAllocation :=
+    logicalHotReuseStore baselineStore baselineLocation
+      (.ctorN newCid baselineNewFields)
+  let rewrittenLogicalAllocation :=
+    logicalHotReuseStore rewrittenStore rewrittenLocation
+      (.ctorN newCid rewrittenNewFields)
+  have prefixContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore baselineStore baselineLocation) :=
+    hotPrefix_contents baselineAt baselineOwned retained released
+  have allocationContents : HeapContentsEq baselineAllocation.1
+      baselineLogicalAllocation.1 := by
+    simpa [baselineAllocation, baselineLogicalAllocation,
+      logicalHotReuseStore] using
+      prefixContents.allocNode .shared (.ctorN newCid baselineNewFields)
+  have allocationLocation : baselineAllocation.2 =
+      baselineLogicalAllocation.2 := by
+    simpa [baselineAllocation, baselineLogicalAllocation,
+      logicalHotReuseStore] using
+      prefixContents.allocNode_location .shared
+        (.ctorN newCid baselineNewFields)
+  obtain ⟨_baselinePhysical, _baselineReused, _baselineIso,
+      _baselinePhysicalOwned, baselineAllocationOwned, _baselineResult⟩ :=
+    hotPrefixReuse_sound
+      (store := baselineStore) (baselineRetained := baselineRetained)
+      (baselineReleased := baselineReleased) (target := baselineLocation)
+      (oldCid := oldCid) (newCid := newCid) (fields := baselineFields)
+      (newFields := baselineNewFields) (fieldFuel := fieldFuel)
+      (remaining := remaining) (before := baselineBefore)
+      (after := baselineAfter) payloadUnits baselineAt baselineOwned retained
+      released baselinePartition trivial
+  have baselineLogicalOwned : IxIR1.Sim.RootOwnership
+      baselineLogicalAllocation.1.heap
+      (⟨.shared, .loc baselineLogicalAllocation.2⟩ :: baselineAfter) := by
+    rw [← allocationLocation]
+    exact allocationContents.rootOwnership
+      (by simpa [baselineAllocation] using baselineAllocationOwned)
+  have baselineLogicalClosed : IxIR1.Sim.StoreClosed
+      baselineLogicalAllocation.1.heap :=
+    IxIR1.Sim.RootOwnership.storeClosed baselineLogicalOwned
+  let baselineExactIso :=
+    allocationContents.symm.toHeapIso baselineLogicalClosed
+  obtain ⟨physical, reused, physicalHeap⟩ :=
+    physicalHotReuseStore_ok (.ctorN newCid rewrittenNewFields) payloadUnits
+      rewrittenAt
+  have rewrittenPhysicalOwnedRaw : IxIR1.Sim.RootOwnership
+      (IxIR1.Sim.reuseSharedNodeStore rewrittenStore.heap rewrittenLocation
+        (.ctorN newCid rewrittenNewFields))
+      (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenAfter) :=
+    rewrittenOwned.reuseSharedNode rewrittenAt rewrittenPartition trivial
+  let killedIso := heapIsoKillShared inputIso locations rewrittenAt baselineAt
+    rewrittenOwned
+  have newNodesRelated : IxIR1.Sim.NodeIso killedIso.locRel
+      (.ctorN newCid rewrittenNewFields) (.ctorN newCid baselineNewFields) := by
+    apply IxIR1.Sim.NodeIso.ctor
+    change IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList
+    exact newFieldsRelated
+  let crossRaw : IxIR1.Sim.HeapIso
+      ((rewrittenStore.heap.kill rewrittenLocation).allocNode .shared
+        (.ctorN newCid rewrittenNewFields)).1
+      ((baselineStore.heap.kill baselineLocation).allocNode .shared
+        (.ctorN newCid baselineNewFields)).1 :=
+    killedIso.alloc (world := .shared) newNodesRelated
+  let localRaw := IxIR1.Sim.HeapIso.reuseShared rewrittenAt
+    rewrittenPhysicalOwnedRaw
+  let outputIso := (localRaw.trans crossRaw).trans baselineExactIso
+  have localResultRaw : localRaw.locRel rewrittenLocation
+      ((rewrittenStore.heap.kill rewrittenLocation).allocNode .shared
+        (.ctorN newCid rewrittenNewFields)).2 := by
+    change IxIR1.Sim.reuseRel rewrittenStore.heap rewrittenLocation
+      rewrittenLocation
+      ((rewrittenStore.heap.kill rewrittenLocation).allocNode .shared
+        (.ctorN newCid rewrittenNewFields)).2
+    exact .inl ⟨rfl, by simp [IxIR1.Store.kill, IxIR1.Store.allocNode]⟩
+  have crossResultRaw : crossRaw.locRel
+      ((rewrittenStore.heap.kill rewrittenLocation).allocNode .shared
+        (.ctorN newCid rewrittenNewFields)).2
+      ((baselineStore.heap.kill baselineLocation).allocNode .shared
+        (.ctorN newCid baselineNewFields)).2 := by
+    exact .inl ⟨rfl, rfl⟩
+  have baselineLogicalResultAt : baselineLogicalAllocation.1.get?
+      baselineLogicalAllocation.2 =
+        some ⟨.shared, 1, .ctorN newCid baselineNewFields⟩ := by
+    exact IxIR1.Sim.HeapIso.get?_allocNode_new
+      (logicalHotResetStore baselineStore baselineLocation).heap .shared
+      (.ctorN newCid baselineNewFields)
+  have exactResultSelf : baselineExactIso.locRel
+      baselineLogicalAllocation.2 baselineLogicalAllocation.2 := by
+    exact allocationContents.symm.toHeapIso_rel_self baselineLogicalClosed
+      baselineLogicalResultAt
+  have exactResult : baselineExactIso.locRel
+      baselineLogicalAllocation.2 baselineAllocation.2 := by
+    rw [allocationLocation]
+    exact exactResultSelf
+  have outputResult : outputIso.locRel rewrittenLocation
+      baselineAllocation.2 := by
+    exact ⟨baselineLogicalAllocation.2,
+      ⟨rewrittenLogicalAllocation.2, localResultRaw, crossResultRaw⟩,
+      exactResult⟩
+  refine ⟨physical, reused, ?_⟩
+  rw [physicalHeap]
+  refine ⟨outputIso, rewrittenPhysicalOwnedRaw,
+    by simpa [baselineAllocation] using baselineAllocationOwned,
+    outputResult, ?_⟩
+  intro rewrittenCandidate baselineCandidate related different
+  obtain ⟨rewrittenBox, baselineBox, rewrittenLive, baselineLive, _boxes⟩ :=
+    inputIso.related_live related
+  have localSelfRaw : localRaw.locRel rewrittenCandidate
+      rewrittenCandidate := by
+    change IxIR1.Sim.reuseRel rewrittenStore.heap rewrittenLocation
+      rewrittenCandidate rewrittenCandidate
+    exact .inr ⟨rfl, different, rewrittenBox, rewrittenLive⟩
+  have killedRelated : killedIso.locRel rewrittenCandidate
+      baselineCandidate :=
+    heapIsoKillShared_rel inputIso locations rewrittenAt baselineAt
+      rewrittenOwned related different
+  have crossOldRaw : crossRaw.locRel rewrittenCandidate
+      baselineCandidate :=
+    .inr killedRelated
+  have baselineDifferent : baselineLocation ≠ baselineCandidate := by
+    intro same
+    subst baselineCandidate
+    exact different (inputIso.right_unique related locations)
+  have baselineKilledLive :
+      (baselineStore.heap.kill baselineLocation).get? baselineCandidate =
+        some baselineBox :=
+    IxIR1.Sim.get?_kill_other baselineDifferent baselineAt baselineLive
+  have baselineLogicalLive : baselineLogicalAllocation.1.get?
+      baselineCandidate = some baselineBox := by
+    exact IxIR1.Sim.HeapIso.get?_allocNode_old
+      (world := .shared) (node := .ctorN newCid baselineNewFields)
+      baselineKilledLive
+  have exactOld : baselineExactIso.locRel baselineCandidate
+      baselineCandidate :=
+    allocationContents.symm.toHeapIso_rel_self baselineLogicalClosed
+      baselineLogicalLive
+  exact ⟨baselineCandidate,
+    ⟨rewrittenCandidate, localSelfRaw, crossOldRaw⟩, exactOld⟩
+
+/-- The complete accepted logical hot rewrite agrees with the concrete
+baseline retain/release/allocation prefix and reaches the same recursive
+argument vector. -/
+theorem hotLogicalAcceptedPrefix {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {location : Nat} {sourceSchema allocationSchema : CtorSchema}
+    {machine : Machine} {baselineRetained baselineReleased : Store}
+    {stack : List Continuation} {fieldFuel remaining : Nat}
+    {ambient : List IxIR1.Sim.Root}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (targetAt : machine.store.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (owned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc location⟩ :: ambient))
+    (retained : RetainSharedMany machine.store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    let logicalAllocation :=
+      (logicalHotResetStore machine.store location).allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+    Steps context .logical 4 machine
+        { machine with
+          store := logicalAllocation.1
+          control := .running { definition, values := callValues } stack } ∧
+      HeapContentsEq baselineAllocation.1 logicalAllocation.1 ∧
+      baselineAllocation.2 = logicalAllocation.2 := by
+  dsimp only
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let logicalAllocation :=
+    (logicalHotResetStore machine.store location).allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+  have prefixContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore machine.store location) :=
+    hotPrefix_contents targetAt owned retained released
+  have allocationContents :
+      HeapContentsEq baselineAllocation.1 logicalAllocation.1 := by
+    simpa [baselineAllocation, logicalAllocation] using
+      prefixContents.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have allocationLocation :
+      baselineAllocation.2 = logicalAllocation.2 := by
+    simpa [baselineAllocation, logicalAllocation] using
+      prefixContents.allocNode_location .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have logicalFieldWorlds : FieldWorlds
+      (logicalHotResetStore machine.store location)
+      allocationSchema newFields :=
+    prefixContents.fieldWorlds fieldWorlds
+  have logicalTailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc logicalAllocation.2))
+      site.shape.tailArguments = .ok callValues := by
+    rw [← allocationLocation]
+    simpa [baselineAllocation] using tailResolved
+  have viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩ fields :=
+    ConstructorView.of_box targetAt rfl rfl
+  have execution : Steps context .logical 4 machine
+      { machine with
+        store := logicalAllocation.1
+        control := .running { definition, values := callValues } stack } := by
+    simpa [logicalAllocation, logicalHotResetStore] using
+      hotLogicalAcceptedControl site resetAt hotAt sourceSchemaAt
+        allocationSchemaAt sourceLayout allocationLayout control
+        parameterCount fieldCount sourceResolved viewed rfl
+        allocationResolved
+        (by simpa [logicalHotResetStore] using logicalFieldWorlds)
+        (by simpa [logicalAllocation, logicalHotResetStore] using
+          logicalTailResolved)
+        arity nonempty
+  exact ⟨execution, allocationContents, allocationLocation⟩
+
+/-- The complete accepted cold rewrite reaches the same recursive argument
+vector as any baseline prefix with equal semantic heap contents. -/
+theorem coldAcceptedPrefix {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {interpretation : Interpretation}
+    {definition : Function} {resetId hotId coldId : BlockId}
+    {parameters fields newFields callValues : Array RVal}
+    {location : Nat} {box : IxIR1.NodeBox}
+    {sourceSchema allocationSchema : CtorSchema} {machine : Machine}
+    {resetStore baselineReleased : Store} {stack : List Continuation}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (coldAt : definition.blocks[coldId]? = some
+      (Reuse.creditBlock site.candidate
+        (.optional site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor box fields)
+    (shared : 1 < box.rc)
+    (retained : RetainSharedMany
+      ((((machine.store.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+      fields resetStore)
+    (contents : HeapContentsEq baselineReleased resetStore)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    let resetAllocation := resetStore.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps context interpretation 4 machine
+        { machine with
+          store := resetAllocation.1
+          control := .running { definition, values := callValues } stack } ∧
+      HeapContentsEq baselineAllocation.1 resetAllocation.1 ∧
+      baselineAllocation.2 = resetAllocation.2 := by
+  dsimp only
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let resetAllocation := resetStore.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have allocationContents :
+      HeapContentsEq baselineAllocation.1 resetAllocation.1 := by
+    simpa [baselineAllocation, resetAllocation] using
+      contents.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have allocationLocation :
+      baselineAllocation.2 = resetAllocation.2 := by
+    simpa [baselineAllocation, resetAllocation] using
+      contents.allocNode_location .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have resetTailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc resetAllocation.2))
+      site.shape.tailArguments = .ok callValues := by
+    rw [← allocationLocation]
+    simpa [baselineAllocation] using tailResolved
+  have resetFieldWorlds :
+      FieldWorlds resetStore allocationSchema newFields :=
+    contents.fieldWorlds fieldWorlds
+  have execution : Steps context interpretation 4 machine
+      { machine with
+        store := resetAllocation.1
+        control := .running { definition, values := callValues } stack } := by
+    simpa [resetAllocation] using
+      coldAcceptedControl site resetAt coldAt sourceSchemaAt
+        allocationSchemaAt sourceLayout allocationLayout control
+        parameterCount fieldCount sourceResolved viewed shared retained
+        allocationResolved resetFieldWorlds
+        (by simpa [resetAllocation] using resetTailResolved) arity nonempty
+  exact ⟨execution, allocationContents, allocationLocation⟩
+
+/-- The complete physical hot rewrite at one accepted site, from reset-block
+entry through a recursive call whose argument vector is related to the
+baseline call by the resulting heap isomorphism. -/
+theorem hotPhysicalAcceptedPrefixIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceBlock : Block}
+    (site : Reuse.Site limits validation sourceBlock)
+    {context : Eval.Context} {definition : Function}
+    {resetId hotId coldId : BlockId}
+    {parameters fields newFields baselineCallValues : Array RVal}
+    {location : Nat} {sourceSchema allocationSchema : CtorSchema}
+    {machine : Machine} {baselineRetained baselineReleased : Store}
+    {stack : List Continuation} {fieldFuel remaining : Nat}
+    {before after : List IxIR1.Sim.Root}
+    (resetAt : definition.blocks[resetId]? =
+      some (Reuse.resetBlock site.candidate hotId coldId))
+    (hotAt : definition.blocks[hotId]? = some
+      (Reuse.creditBlock site.candidate
+        (.required site.candidate.layout)))
+    (sourceSchemaAt : context.schemas .shared site.shape.sourceConstructor =
+      some sourceSchema)
+    (allocationSchemaAt :
+      context.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (sourceLayout : site.candidate.layout = sourceSchema.layout)
+    (allocationLayout : site.candidate.layout = allocationSchema.layout)
+    (control : machine.control = .running
+      { definition
+        block := resetId
+        pc := 0
+        values := parameters
+        credits := #[] } stack)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (targetAt : machine.store.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (retained : RetainSharedMany machine.store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (owned : IxIR1.Sim.RootOwnership machine.store.heap
+      (⟨.shared, .loc location⟩ :: before))
+    (partition :
+      (IxIR1.Sim.rootsFor .shared fields.toList ++ before).Perm
+        (IxIR1.Sim.rootsFor .shared newFields.toList ++ after))
+    (newWorld : IxIR1.Sim.NodeWorld .shared
+      (.ctorN site.shape.allocationConstructor newFields))
+    (mapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues parameters fields) after)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (fieldWorlds : FieldWorlds
+      (((machine.store.tickResetAttempt).reserve location).tickHotReset)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = definition.signature.params.size)
+    (nonempty : definition.blocks.isEmpty = false) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    ∃ physical,
+      physicalHotReuseStore machine.store location
+        (.ctorN site.shape.allocationConstructor newFields)
+        allocationSchema.fields.size = .ok physical ∧
+      ∃ iso : IxIR1.Sim.HeapIso physical.heap baselineAllocation.1.heap,
+        IxIR1.Sim.RootOwnership physical.heap
+            (⟨.shared, .loc location⟩ :: after) ∧
+        IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+            (⟨.shared, .loc baselineAllocation.2⟩ :: after) ∧
+        iso.locRel location baselineAllocation.2 ∧
+        ∃ physicalCallValues,
+          Steps context .physical 4 machine
+            { machine with
+              store := physical
+              control := .running
+                { definition, values := physicalCallValues } stack } ∧
+          IxIR1.Sim.RValsIso (fun baseline physicalLocation =>
+            iso.locRel physicalLocation baseline)
+            baselineCallValues.toList physicalCallValues.toList := by
+  dsimp only
+  obtain ⟨physical, reused, iso, physicalOwned, baselineOwned,
+      resultRelated, survivorsRelated⟩ :=
+    hotPrefixReuse_sound_with_survivors
+      (store := machine.store)
+      (baselineRetained := baselineRetained)
+      (baselineReleased := baselineReleased)
+      (target := location)
+      (oldCid := site.shape.sourceConstructor)
+      (newCid := site.shape.allocationConstructor)
+      (fields := fields) (newFields := newFields)
+      (fieldFuel := fieldFuel) (remaining := remaining)
+      (before := before) (after := after)
+      allocationSchema.fields.size targetAt owned retained released partition
+      newWorld
+  have rootsReverse : ∀ root ∈ after,
+      IxIR1.Sim.RValIso
+        (fun baseline physicalLocation => iso.locRel physicalLocation baseline)
+        root.value root.value := by
+    intro root member
+    exact (survivorsRelated root member).symm
+  have selfRelated := mapped.selfRelated rootsReverse
+  have viewed : ConstructorView machine.store location .shared
+      site.shape.sourceConstructor
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩ fields :=
+    ConstructorView.of_box targetAt rfl rfl
+  obtain ⟨physicalCallValues, execution, callsRelated⟩ :=
+    hotPhysicalAcceptedControlIso site resetAt hotAt sourceSchemaAt
+      allocationSchemaAt sourceLayout allocationLayout control parameterCount
+      fieldCount sourceResolved viewed rfl allocationResolved fieldWorlds
+      (by simpa [physicalHotReuseStore, physicalHotResetStore] using reused)
+      iso selfRelated resultRelated tailResolved arity nonempty
+  exact ⟨physical, reused, iso, physicalOwned, baselineOwned, resultRelated,
+    physicalCallValues, execution, callsRelated⟩
+
+/-! ## Accepted function-rewrite simulations -/
+
+/-- At an accepted function-rewrite decision, the original baseline block and
+the logical hot replacement both reach the same recursive argument vector.
+The theorem obtains every CFG lookup and both constructor layouts from the
+proof-carrying rewrite rather than requiring callers to restate them. -/
+theorem acceptedHotLogicalSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {store baselineRetained baselineReleased : Store}
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel remaining : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    {ambient : List IxIR1.Sim.Root} {allocationSchema : CtorSchema}
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (targetAt : store.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (owned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc location⟩ :: ambient))
+    (retained : RetainSharedMany store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    let logicalAllocation :=
+      (logicalHotResetStore store location).allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+    Steps baselineContext .logical (2 * site.shape.fieldCount + 3)
+        baselineMachine
+        { store := baselineAllocation.1
+          heapFuel := remaining
+          control := .running
+            { definition := source, values := callValues } baselineStack } ∧
+      Steps rewrittenContext .logical 4 rewrittenMachine
+        { rewrittenMachine with
+          store := logicalAllocation.1
+          control := .running
+            { definition := rewrite.definition, values := callValues }
+              rewrittenStack } ∧
+      HeapContentsEq baselineAllocation.1 logicalAllocation.1 ∧
+      baselineAllocation.2 = logicalAllocation.2 := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  let baselineMachine : Machine :=
+    { store
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let logicalAllocation :=
+    (logicalHotResetStore store location).allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have targetNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have targetArity :
+      callValues.size = rewrite.definition.signature.params.size := by
+    simpa using arity
+  have baselineControl : baselineMachine.control = .running
+      { definition := source
+        block := index
+        pc := 0
+        values := parameters
+        credits := #[] }
+      baselineStack := by
+    rfl
+  have rewrittenControl : rewrittenMachine.control = .running
+      { definition := rewrite.definition
+        block := index
+        pc := 0
+        values := parameters
+        credits := #[] }
+      rewrittenStack := by
+    rfl
+  have baselineExecution : Steps baselineContext .logical
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := callValues } baselineStack } := by
+    simpa [baselineMachine, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := .logical)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := remaining)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt baselineControl parameterCount fieldCount sourceResolved
+        targetAt rfl retained released allocationSchemaAt allocationResolved
+        baselineFieldWorlds tailResolved arity sourceNonempty
+  obtain ⟨logicalExecution, contents, allocationLocation⟩ :=
+    hotLogicalAcceptedPrefix site
+      (context := rewrittenContext) (definition := rewrite.definition)
+      (resetId := index) (hotId := source.blocks.size + helperOffset)
+      (coldId := source.blocks.size + helperOffset + 1)
+      (parameters := parameters) (fields := fields)
+      (newFields := newFields) (callValues := callValues)
+      (location := location) (sourceSchema := sourceSchema)
+      (allocationSchema := allocationSchema) (machine := rewrittenMachine)
+      (baselineRetained := baselineRetained)
+      (baselineReleased := baselineReleased) (stack := rewrittenStack)
+      (fieldFuel := fieldFuel) (remaining := remaining) (ambient := ambient)
+      resetAt hotAt rewrittenSourceSchemaAt rewrittenAllocationSchemaAt
+      sourceLayout
+      allocationLayout rewrittenControl parameterCount fieldCount
+      sourceResolved targetAt owned retained released allocationResolved
+      baselineFieldWorlds tailResolved targetArity targetNonempty
+  exact ⟨baselineExecution,
+    by simpa [rewrittenMachine, logicalAllocation] using logicalExecution,
+    by simpa [baselineAllocation, logicalAllocation] using contents,
+    by simpa [baselineAllocation, logicalAllocation] using
+      allocationLocation⟩
+
+/-- At an accepted decision whose source has more than one shared owner, the
+baseline retain/release prefix and the rewritten cold reset commute.  Thus
+both actual CFGs reach the same call arguments and heaps with identical live
+contents, although reset-observation counters may differ. -/
+theorem acceptedColdSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {store baselineRetained : Store}
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    {allocationSchema : CtorSchema}
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (targetAt : store.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany store fields baselineRetained)
+    (retainedAt : baselineRetained.get? location = some
+      ⟨.shared, retainedRc, .ctorN site.shape.sourceConstructor fields⟩)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc ((baselineDecrementStore baselineRetained location
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩).allocNode .shared
+              (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineReleased := baselineDecrementStore baselineRetained location
+      ⟨.shared, retainedRc, .ctorN site.shape.sourceConstructor fields⟩
+    let resetStore := baselineReleased.tickResetAttempt.tickColdReset
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    let resetAllocation := resetStore.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps baselineContext interpretation (2 * site.shape.fieldCount + 3)
+        baselineMachine
+        { store := baselineAllocation.1
+          heapFuel := fieldFuel
+          control := .running
+            { definition := source, values := callValues } baselineStack } ∧
+      Steps rewrittenContext interpretation 4 rewrittenMachine
+        { rewrittenMachine with
+          store := resetAllocation.1
+          control := .running
+            { definition := rewrite.definition, values := callValues }
+              rewrittenStack } ∧
+      HeapContentsEq baselineAllocation.1 resetAllocation.1 ∧
+      baselineAllocation.2 = resetAllocation.2 := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, _hotAt, coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  obtain ⟨actualRetainedRc, actualRetainedAt, released,
+      resetRetained, heapsEqual⟩ :=
+    coldPrefix_commutes (heapFuel := fieldFuel) targetAt shared retained
+  have retainedBoxesEqual :
+      (⟨.shared, actualRetainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) =
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ :=
+    Option.some.inj (actualRetainedAt.symm.trans retainedAt)
+  have retainedRcEqual : actualRetainedRc = retainedRc := by
+    cases retainedBoxesEqual
+    rfl
+  subst actualRetainedRc
+  let baselineMachine : Machine :=
+    { store
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  let baselineReleased := baselineDecrementStore baselineRetained location
+    ⟨.shared, retainedRc, .ctorN site.shape.sourceConstructor fields⟩
+  let resetStore := baselineReleased.tickResetAttempt.tickColdReset
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let resetAllocation := resetStore.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have targetNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have targetArity :
+      callValues.size = rewrite.definition.signature.params.size := by
+    simpa using arity
+  have baselineControl : baselineMachine.control = .running
+      { definition := source
+        block := index
+        pc := 0
+        values := parameters
+        credits := #[] }
+      baselineStack := by
+    rfl
+  have rewrittenControl : rewrittenMachine.control = .running
+      { definition := rewrite.definition
+        block := index
+        pc := 0
+        values := parameters
+        credits := #[] }
+      rewrittenStack := by
+    rfl
+  have contents : HeapContentsEq baselineReleased resetStore := by
+    refine ⟨?_⟩
+    simpa [baselineReleased, resetStore] using
+      congrArg IxIR1.Store.nodes heapsEqual
+  have viewed : ConstructorView rewrittenMachine.store location .shared
+      site.shape.sourceConstructor
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩ fields :=
+    ConstructorView.of_box targetAt rfl rfl
+  have baselineExecution : Steps baselineContext interpretation
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := fieldFuel
+        control := .running
+          { definition := source, values := callValues } baselineStack } := by
+    simpa [baselineMachine, baselineReleased, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := interpretation)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := fieldFuel)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt baselineControl parameterCount fieldCount sourceResolved
+        targetAt rfl retained (by simpa [baselineReleased] using released)
+        allocationSchemaAt allocationResolved
+        (by simpa [baselineReleased] using baselineFieldWorlds)
+        (by simpa [baselineReleased] using tailResolved) arity
+        sourceNonempty
+  obtain ⟨coldExecution, allocationContents, allocationLocation⟩ :=
+    coldAcceptedPrefix site
+      (context := rewrittenContext) (interpretation := interpretation)
+      (definition := rewrite.definition) (resetId := index)
+      (hotId := source.blocks.size + helperOffset)
+      (coldId := source.blocks.size + helperOffset + 1)
+      (parameters := parameters) (fields := fields)
+      (newFields := newFields) (callValues := callValues)
+      (location := location)
+      (box := ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor fields⟩)
+      (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+      (machine := rewrittenMachine) (resetStore := resetStore)
+      (baselineReleased := baselineReleased) (stack := rewrittenStack)
+      resetAt coldAt rewrittenSourceSchemaAt rewrittenAllocationSchemaAt
+      sourceLayout
+      allocationLayout rewrittenControl parameterCount fieldCount
+      sourceResolved viewed shared
+      (by simpa [coldResetStartStore, resetStore, baselineReleased] using
+        resetRetained)
+      contents allocationResolved
+      (by simpa [baselineReleased] using baselineFieldWorlds)
+      (by simpa [baselineReleased] using tailResolved) targetArity
+      targetNonempty
+  exact ⟨baselineExecution,
+    by simpa [rewrittenMachine, resetStore, baselineReleased,
+      resetAllocation] using coldExecution,
+    by simpa [baselineAllocation, resetAllocation, baselineReleased,
+      resetStore] using
+      allocationContents,
+    by simpa [baselineAllocation, resetAllocation, baselineReleased,
+      resetStore] using
+      allocationLocation⟩
+
+/-- At an accepted unit-refcount decision, the original baseline block and
+the physical hot replacement both execute to recursive calls.  The resulting
+heaps and argument vectors are related by the concrete reuse location
+bijection, so this statement does not assume that fresh allocation happened
+to choose the reused address. -/
+theorem acceptedHotPhysicalSimulationIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {store baselineRetained baselineReleased : Store}
+    {parameters fields newFields baselineCallValues : Array RVal}
+    {location fieldFuel remaining : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    {before after : List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (targetAt : store.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (retained : RetainSharedMany store fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (owned : IxIR1.Sim.RootOwnership store.heap
+      (⟨.shared, .loc location⟩ :: before))
+    (partition :
+      (IxIR1.Sim.rootsFor .shared fields.toList ++ before).Perm
+        (IxIR1.Sim.rootsFor .shared newFields.toList ++ after))
+    (newWorld : IxIR1.Sim.NodeWorld .shared
+      (.ctorN site.shape.allocationConstructor newFields))
+    (mapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues parameters fields) after)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema newFields)
+    (physicalFieldWorlds : FieldWorlds
+      (physicalHotResetStore store location) allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    Steps baselineContext .physical (2 * site.shape.fieldCount + 3)
+        baselineMachine
+        { store := baselineAllocation.1
+          heapFuel := remaining
+          control := .running
+            { definition := source, values := baselineCallValues }
+              baselineStack } ∧
+      ∃ physical,
+        physicalHotReuseStore store location
+            (.ctorN site.shape.allocationConstructor newFields)
+            allocationSchema.fields.size = .ok physical ∧
+        ∃ iso : IxIR1.Sim.HeapIso physical.heap baselineAllocation.1.heap,
+          IxIR1.Sim.RootOwnership physical.heap
+              (⟨.shared, .loc location⟩ :: after) ∧
+          IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+              (⟨.shared, .loc baselineAllocation.2⟩ :: after) ∧
+          iso.locRel location baselineAllocation.2 ∧
+          ∃ physicalCallValues,
+            Steps rewrittenContext .physical 4 rewrittenMachine
+              { rewrittenMachine with
+                store := physical
+                control := .running
+                  { definition := rewrite.definition
+                    values := physicalCallValues }
+                  rewrittenStack } ∧
+            IxIR1.Sim.RValsIso (fun baseline physicalLocation =>
+              iso.locRel physicalLocation baseline)
+              baselineCallValues.toList physicalCallValues.toList := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  let baselineMachine : Machine :=
+    { store
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have targetNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have targetArity : baselineCallValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  have baselineControl : baselineMachine.control = .running
+      { definition := source
+        block := index
+        pc := 0
+        values := parameters
+        credits := #[] }
+      baselineStack := by
+    rfl
+  have rewrittenControl : rewrittenMachine.control = .running
+      { definition := rewrite.definition
+        block := index
+        pc := 0
+        values := parameters
+        credits := #[] }
+      rewrittenStack := by
+    rfl
+  have baselineExecution : Steps baselineContext .physical
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := baselineCallValues }
+            baselineStack } := by
+    simpa [baselineMachine, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := .physical)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := baselineCallValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := remaining)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt baselineControl parameterCount fieldCount sourceResolved
+        targetAt rfl retained released allocationSchemaAt allocationResolved
+        baselineFieldWorlds tailResolved arity sourceNonempty
+  obtain ⟨physical, reused, iso, physicalOwned, baselineOwned,
+      resultRelated, physicalCallValues, physicalExecution, callsRelated⟩ :=
+    hotPhysicalAcceptedPrefixIso site
+      (context := rewrittenContext) (definition := rewrite.definition)
+      (resetId := index) (hotId := source.blocks.size + helperOffset)
+      (coldId := source.blocks.size + helperOffset + 1)
+      (parameters := parameters) (fields := fields)
+      (newFields := newFields) (baselineCallValues := baselineCallValues)
+      (location := location) (sourceSchema := sourceSchema)
+      (allocationSchema := allocationSchema) (machine := rewrittenMachine)
+      (baselineRetained := baselineRetained)
+      (baselineReleased := baselineReleased) (stack := rewrittenStack)
+      (fieldFuel := fieldFuel) (remaining := remaining)
+      (before := before) (after := after)
+      resetAt hotAt rewrittenSourceSchemaAt rewrittenAllocationSchemaAt
+      sourceLayout
+      allocationLayout rewrittenControl parameterCount fieldCount
+      sourceResolved targetAt retained released owned partition newWorld mapped
+      allocationResolved physicalFieldWorlds tailResolved targetArity
+      targetNonempty
+  exact ⟨baselineExecution, physical, reused, iso,
+    by simpa [baselineAllocation] using physicalOwned,
+    by simpa [baselineAllocation] using baselineOwned,
+    by simpa [baselineAllocation] using resultRelated,
+    physicalCallValues,
+    by simpa [rewrittenMachine] using physicalExecution,
+    callsRelated⟩
+
+/-! ## Stable whole-program relation -/
+
+/-- Credits in two executions agree modulo the same location relation as
+ordinary runtime values.  Logical reservations carry no address; physical
+reservations carry corresponding (possibly numerically different) dead heap
+slots. -/
+inductive StableCreditIso (locRel : Nat → Nat → Prop) :
+    Option Credit → Option Credit → Prop where
+  | consumed : StableCreditIso locRel none none
+  | absent (layout : LayoutId) : StableCreditIso locRel
+      (some { layout, presence := .absent })
+      (some { layout, presence := .absent })
+  | logical (layout : LayoutId) : StableCreditIso locRel
+      (some { layout, presence := .present none })
+      (some { layout, presence := .present none })
+  | physical {layout : LayoutId} {baselineLocation rewrittenLocation : Nat}
+      (location : locRel baselineLocation rewrittenLocation) :
+      StableCreditIso locRel
+        (some { layout, presence := .present (some baselineLocation) })
+        (some { layout, presence := .present (some rewrittenLocation) })
+
+/-- Pointwise credit-file isomorphism. -/
+inductive StableCreditsIso (locRel : Nat → Nat → Prop) :
+    List (Option Credit) → List (Option Credit) → Prop where
+  | nil : StableCreditsIso locRel [] []
+  | cons {baseline rewritten : Option Credit}
+      {baselineTail rewrittenTail : List (Option Credit)}
+      (head : StableCreditIso locRel baseline rewritten)
+      (tail : StableCreditsIso locRel baselineTail rewrittenTail) :
+      StableCreditsIso locRel (baseline :: baselineTail)
+        (rewritten :: rewrittenTail)
+
+namespace StableCreditIso
+
+theorem mono {oldRel newRel : Nat → Nat → Prop}
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation)
+    {baseline rewritten : Option Credit}
+    (credit : StableCreditIso oldRel baseline rewritten) :
+    StableCreditIso newRel baseline rewritten := by
+  cases credit with
+  | consumed => exact .consumed
+  | absent layout => exact .absent layout
+  | logical layout => exact .logical layout
+  | physical location => exact .physical (lift location)
+
+theorem refl : ∀ credit : Option Credit,
+    StableCreditIso (fun left right => left = right) credit credit
+  | none => .consumed
+  | some ⟨layout, .absent⟩ => .absent layout
+  | some ⟨layout, .present none⟩ => .logical layout
+  | some ⟨_layout, .present (some _location)⟩ => .physical rfl
+
+theorem eq_of_location_eq {baseline rewritten : Option Credit}
+    (credit : StableCreditIso (fun left right => left = right)
+      baseline rewritten) : baseline = rewritten := by
+  cases credit with
+  | consumed => rfl
+  | absent layout => rfl
+  | logical layout => rfl
+  | physical location => cases location; rfl
+
+theorem isSome_eq {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Option Credit}
+    (credit : StableCreditIso locRel baseline rewritten) :
+    baseline.isSome = rewritten.isSome := by
+  cases credit <;> rfl
+
+theorem present_parts {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Credit}
+    (credit : StableCreditIso locRel (some baseline) (some rewritten)) :
+    baseline.layout = rewritten.layout ∧
+      baseline.isPresent = rewritten.isPresent := by
+  cases credit with
+  | absent layout => exact ⟨rfl, rfl⟩
+  | logical layout => exact ⟨rfl, rfl⟩
+  | physical location => exact ⟨rfl, rfl⟩
+
+theorem absent_parts {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Credit}
+    (credit : StableCreditIso locRel (some baseline) (some rewritten))
+    (absent : baseline.presence = .absent) :
+    baseline.layout = rewritten.layout ∧
+      rewritten.presence = .absent := by
+  cases credit <;> simp_all
+
+theorem logical_parts {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Credit}
+    (credit : StableCreditIso locRel (some baseline) (some rewritten))
+    (logical : baseline.presence = .present none) :
+    baseline.layout = rewritten.layout ∧
+      rewritten.presence = .present none := by
+  cases credit <;> simp_all
+
+theorem physical_parts {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Credit} {baselineLocation : Nat}
+    (credit : StableCreditIso locRel (some baseline) (some rewritten))
+    (physical : baseline.presence = .present (some baselineLocation)) :
+    ∃ rewrittenLocation,
+      baseline.layout = rewritten.layout ∧
+        rewritten.presence = .present (some rewrittenLocation) ∧
+        locRel baselineLocation rewrittenLocation := by
+  cases credit <;> simp_all
+
+end StableCreditIso
+
+namespace StableCreditsIso
+
+theorem mono {oldRel newRel : Nat → Nat → Prop}
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    ∀ {baseline rewritten : List (Option Credit)},
+      StableCreditsIso oldRel baseline rewritten →
+      StableCreditsIso newRel baseline rewritten
+  | _, _, .nil => .nil
+  | _, _, .cons head tail => .cons (head.mono lift) (mono lift tail)
+
+theorem refl : ∀ credits : List (Option Credit),
+    StableCreditsIso (fun left right => left = right) credits credits
+  | [] => .nil
+  | credit :: rest => .cons (StableCreditIso.refl credit) (refl rest)
+
+theorem eq_of_location_eq {baseline rewritten : List (Option Credit)}
+    (credits : StableCreditsIso (fun left right => left = right)
+      baseline rewritten) : baseline = rewritten := by
+  induction credits with
+  | nil => rfl
+  | cons head tail ih => rw [head.eq_of_location_eq, ih]
+
+theorem length_eq {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List (Option Credit)}
+    (credits : StableCreditsIso locRel baseline rewritten) :
+    baseline.length = rewritten.length := by
+  induction credits with
+  | nil => rfl
+  | cons _ _ ih => simp [ih]
+
+theorem append {locRel : Nat → Nat → Prop}
+    {baseline₁ rewritten₁ baseline₂ rewritten₂ : List (Option Credit)}
+    (first : StableCreditsIso locRel baseline₁ rewritten₁)
+    (second : StableCreditsIso locRel baseline₂ rewritten₂) :
+    StableCreditsIso locRel (baseline₁ ++ baseline₂)
+      (rewritten₁ ++ rewritten₂) := by
+  induction first with
+  | nil => exact second
+  | cons head tail ih => exact .cons head ih
+
+theorem get? {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List (Option Credit)}
+    (credits : StableCreditsIso locRel baseline rewritten)
+    {index : Nat} {baselineCredit : Option Credit}
+    (found : baseline[index]? = some baselineCredit) :
+    ∃ rewrittenCredit,
+      rewritten[index]? = some rewrittenCredit ∧
+        StableCreditIso locRel baselineCredit rewrittenCredit := by
+  induction credits generalizing index baselineCredit with
+  | nil => simp at found
+  | cons head tail ih =>
+      cases index with
+      | zero =>
+          simp only [List.getElem?_cons_zero] at found ⊢
+          cases found
+          exact ⟨_, rfl, head⟩
+      | succ index =>
+          simp only [List.getElem?_cons_succ] at found ⊢
+          exact ih found
+
+theorem set_none {locRel : Nat → Nat → Prop} :
+    ∀ {baseline rewritten : List (Option Credit)},
+      StableCreditsIso locRel baseline rewritten →
+      ∀ index,
+        StableCreditsIso locRel (baseline.set index none)
+          (rewritten.set index none)
+  | [], [], .nil, _ => .nil
+  | _ :: _, _ :: _, .cons _head tail, 0 => .cons .consumed tail
+  | _ :: _, _ :: _, .cons head tail, index + 1 =>
+      .cons head (set_none tail index)
+
+theorem array_set_none {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Array (Option Credit)}
+    (credits : StableCreditsIso locRel baseline.toList rewritten.toList)
+    (index : Nat) :
+    StableCreditsIso locRel
+      (baseline.setIfInBounds index none).toList
+      (rewritten.setIfInBounds index none).toList := by
+  simpa [Array.toList_setIfInBounds] using credits.set_none index
+
+theorem any_isSome_eq {locRel : Nat → Nat → Prop}
+    {baseline rewritten : List (Option Credit)}
+    (credits : StableCreditsIso locRel baseline rewritten) :
+    baseline.any Option.isSome = rewritten.any Option.isSome := by
+  induction credits with
+  | nil => rfl
+  | cons head tail ih =>
+      simp only [List.any_cons, head.isSome_eq, ih]
+
+end StableCreditsIso
+
+/-- A physical credit does not reserve the distinguished location.  Logical,
+absent, and consumed credits contain no concrete heap address. -/
+def CreditAvoidsLocation (location : Nat) : Option Credit → Prop
+  | some { presence := .present (some reserved), .. } => reserved ≠ location
+  | _ => True
+
+def CreditsAvoidLocation (location : Nat) : List (Option Credit) → Prop
+  | [] => True
+  | credit :: rest =>
+      CreditAvoidsLocation location credit ∧ CreditsAvoidLocation location rest
+
+theorem StableCreditIso.transportRelation
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    {baseline rewritten : Option Credit}
+    (credit : StableCreditIso oldRel baseline rewritten)
+    (avoids : CreditAvoidsLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableCreditIso newRel baseline rewritten := by
+  cases credit with
+  | consumed => exact .consumed
+  | absent layout => exact .absent layout
+  | logical layout => exact .logical layout
+  | physical location => exact .physical (lift location avoids)
+
+theorem StableCreditsIso.transportRelation
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    {baseline rewritten : List (Option Credit)}
+    (credits : StableCreditsIso oldRel baseline rewritten)
+    (avoids : CreditsAvoidLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableCreditsIso newRel baseline rewritten := by
+  induction credits with
+  | nil => exact .nil
+  | cons head tail ih =>
+      exact .cons (head.transportRelation avoids.1 lift)
+        (ih avoids.2)
+
+/-- A source frame and its rewritten counterpart occupy the same control
+position and carry pointwise related runtime values.  Stable boundaries have
+pointwise related credit files; the generated reset/helper diamond is treated
+as the four-step macro transition proved above. -/
+structure StableFrameIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    (locRel : Nat → Nat → Prop) (baseline rewritten : Frame) : Prop where
+  baselineDefinition : baseline.definition = source
+  rewrittenDefinition : rewritten.definition = rewrite.definition
+  block : baseline.block = rewritten.block
+  pc : baseline.pc = rewritten.pc
+  values : IxIR1.Sim.RValsIso locRel
+    baseline.values.toList rewritten.values.toList
+  credits : StableCreditsIso locRel
+    baseline.credits.toList rewritten.credits.toList
+
+/-- Existentially select the retained function rewrite governing a stable
+frame pair.  Direct-call lookup in `Reuse.Trace` constructs exactly this
+witness for callees. -/
+inductive StableFrameRel (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    Frame → Frame → Prop where
+  | rewritten {source : Function}
+      (rewrite : Reuse.FunctionRewrite limits validation source)
+      {baseline rewritten : Frame}
+      (frame : StableFrameIso rewrite locRel baseline rewritten) :
+      StableFrameRel limits validation locRel baseline rewritten
+
+inductive StableContinuationIso (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    Continuation → Continuation → Prop where
+  | resume {baseline rewritten : Frame}
+      (frame : StableFrameRel limits validation locRel baseline rewritten) :
+      StableContinuationIso limits validation locRel
+        (.resume baseline) (.resume rewritten)
+  | applyMore {baselineArguments rewrittenArguments : Array RVal}
+      {baseline rewritten : Frame}
+      (arguments : IxIR1.Sim.RValsIso locRel
+        baselineArguments.toList rewrittenArguments.toList)
+      (frame : StableFrameRel limits validation locRel baseline rewritten) :
+      StableContinuationIso limits validation locRel
+        (.applyMore baselineArguments baseline)
+        (.applyMore rewrittenArguments rewritten)
+
+inductive StableStackIso (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    List Continuation → List Continuation → Prop where
+  | nil : StableStackIso limits validation locRel [] []
+  | cons {baseline rewritten : Continuation}
+      {baselineTail rewrittenTail : List Continuation}
+      (head : StableContinuationIso limits validation locRel
+        baseline rewritten)
+      (tail : StableStackIso limits validation locRel
+        baselineTail rewrittenTail) :
+      StableStackIso limits validation locRel
+        (baseline :: baselineTail) (rewritten :: rewrittenTail)
+
+/-- Runtime values retained in a suspended frame avoid one location.  Credit
+reservations are controlled separately by the no-live-credit invariant and do
+not denote ordinary live heap roots. -/
+def FrameValuesAvoidLocation (location : Nat) (frame : Frame) : Prop :=
+  ∀ value ∈ frame.values.toList, value ≠ .loc location
+
+def FrameCreditsAvoidLocation (location : Nat) (frame : Frame) : Prop :=
+  CreditsAvoidLocation location frame.credits.toList
+
+def ContinuationValuesAvoidLocation (location : Nat) :
+    Continuation → Prop
+  | .resume frame => FrameValuesAvoidLocation location frame
+  | .applyMore arguments frame =>
+      (∀ value ∈ arguments.toList, value ≠ .loc location) ∧
+        FrameValuesAvoidLocation location frame
+
+def ContinuationCreditsAvoidLocation (location : Nat) :
+    Continuation → Prop
+  | .resume frame => FrameCreditsAvoidLocation location frame
+  | .applyMore _ frame => FrameCreditsAvoidLocation location frame
+
+def StackValuesAvoidLocation (location : Nat) :
+    List Continuation → Prop
+  | [] => True
+  | continuation :: rest =>
+      ContinuationValuesAvoidLocation location continuation ∧
+        StackValuesAvoidLocation location rest
+
+def StackCreditsAvoidLocation (location : Nat) :
+    List Continuation → Prop
+  | [] => True
+  | continuation :: rest =>
+      ContinuationCreditsAvoidLocation location continuation ∧
+        StackCreditsAvoidLocation location rest
+
+theorem StableFrameIso.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {oldRel newRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableFrameIso rewrite newRel baseline rewritten :=
+  ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block, frame.pc,
+    frame.values.mono lift, frame.credits.mono lift⟩
+
+theorem StableFrameRel.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : Frame}
+    (frame : StableFrameRel limits validation oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableFrameRel limits validation newRel baseline rewritten := by
+  cases frame with
+  | rewritten rewrite related => exact .rewritten rewrite (related.mono lift)
+
+theorem StableContinuationIso.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : Continuation}
+    (continuation : StableContinuationIso limits validation oldRel
+      baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableContinuationIso limits validation newRel baseline rewritten := by
+  cases continuation with
+  | resume frame => exact .resume (frame.mono lift)
+  | applyMore arguments frame =>
+      exact .applyMore (arguments.mono lift) (frame.mono lift)
+
+theorem StableStackIso.mono {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {baseline rewritten : List Continuation}
+    (stack : StableStackIso limits validation oldRel baseline rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      newRel baselineLocation rewrittenLocation) :
+    StableStackIso limits validation newRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (head.mono lift) ih
+
+/-- Change the location relation of a stable frame when every rewritten value
+survives and each old related location pair embeds into the new relation. -/
+theorem StableFrameIso.transportRelation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite oldRel baseline rewritten)
+    (avoids : FrameValuesAvoidLocation removed rewritten)
+    (creditsAvoid : FrameCreditsAvoidLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableFrameIso rewrite newRel baseline rewritten :=
+  ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block, frame.pc,
+    rvalsIso_transport_avoiding_right lift frame.values avoids,
+    frame.credits.transportRelation creditsAvoid lift⟩
+
+theorem StableFrameRel.transportRelation {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {removed : Nat} {baseline rewritten : Frame}
+    (frame : StableFrameRel limits validation oldRel baseline rewritten)
+    (avoids : FrameValuesAvoidLocation removed rewritten)
+    (creditsAvoid : FrameCreditsAvoidLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableFrameRel limits validation newRel baseline rewritten := by
+  cases frame with
+  | rewritten rewrite related =>
+      exact .rewritten rewrite
+        (related.transportRelation avoids creditsAvoid lift)
+
+theorem StableContinuationIso.transportRelation
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {oldRel newRel : Nat → Nat → Prop} {removed : Nat}
+    {baseline rewritten : Continuation}
+    (continuation : StableContinuationIso limits validation oldRel
+      baseline rewritten)
+    (avoids : ContinuationValuesAvoidLocation removed rewritten)
+    (creditsAvoid : ContinuationCreditsAvoidLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableContinuationIso limits validation newRel baseline rewritten := by
+  cases continuation with
+  | resume frame =>
+      exact .resume (frame.transportRelation avoids creditsAvoid lift)
+  | applyMore arguments frame =>
+      exact .applyMore
+        (rvalsIso_transport_avoiding_right lift arguments avoids.1)
+        (frame.transportRelation avoids.2 creditsAvoid lift)
+
+/-- An already-related suspended stack remains related after physical reuse
+when its rewritten values do not mention the consumed source location. -/
+theorem StableStackIso.transportRelation {limits : Validate.Limits}
+    {validation : Validate.Context} {oldRel newRel : Nat → Nat → Prop}
+    {removed : Nat} {baseline rewritten : List Continuation}
+    (stack : StableStackIso limits validation oldRel baseline rewritten)
+    (avoids : StackValuesAvoidLocation removed rewritten)
+    (creditsAvoid : StackCreditsAvoidLocation removed rewritten)
+    (lift : ∀ {baselineLocation rewrittenLocation},
+      oldRel baselineLocation rewrittenLocation →
+      rewrittenLocation ≠ removed →
+      newRel baselineLocation rewrittenLocation) :
+    StableStackIso limits validation newRel baseline rewritten := by
+  induction stack with
+  | nil => exact .nil
+  | cons head tail ih =>
+      exact .cons
+        (head.transportRelation avoids.1 creditsAvoid.1 lift)
+        (ih avoids.2 creditsAvoid.2)
+
+inductive StableControlIso (limits : Validate.Limits)
+    (validation : Validate.Context) (locRel : Nat → Nat → Prop) :
+    Control → Control → Prop where
+  | running {baselineFrame rewrittenFrame : Frame}
+      {baselineStack rewrittenStack : List Continuation}
+      (frame : StableFrameRel limits validation locRel
+        baselineFrame rewrittenFrame)
+      (stack : StableStackIso limits validation locRel
+        baselineStack rewrittenStack) :
+      StableControlIso limits validation locRel
+        (.running baselineFrame baselineStack)
+        (.running rewrittenFrame rewrittenStack)
+  | halted {baselineValue rewrittenValue : RVal}
+      (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+      StableControlIso limits validation locRel
+        (.halted baselineValue) (.halted rewrittenValue)
+
+/-- Stable heaps are either fixed-address equal in semantic contents or
+related by a physical-to-baseline allocation-history bijection.  Historical
+dead/dead rows keep stale but unreachable register and credit locations
+compositional across ordinary reclamation steps. -/
+inductive StableHeapRel (baseline rewritten : Store) :
+    (Nat → Nat → Prop) → Prop where
+  | contents (same : HeapContentsEq baseline rewritten) :
+      StableHeapRel baseline rewritten (fun left right => left = right)
+  | isomorphic
+      (iso : IxIR1.Sim.HeapHistoryIso rewritten.heap baseline.heap) :
+      StableHeapRel baseline rewritten
+        (fun baselineLocation rewrittenLocation =>
+          iso.locRel rewrittenLocation baselineLocation)
+
+/-- Stable machine states combine heap and control relations.  The rewritten
+machine retains at least the baseline heap budget because reset/reuse removes
+baseline traversal work; observational counters remain outside this semantic
+relation. -/
+inductive StableMachineRel (limits : Validate.Limits)
+    (validation : Validate.Context) (baseline rewritten : Machine) : Prop where
+  | related (locRel : Nat → Nat → Prop)
+      (heap : StableHeapRel baseline.store rewritten.store locRel)
+      (fuel : baseline.heapFuel ≤ rewritten.heapFuel)
+      (control : StableControlIso limits validation locRel
+        baseline.control rewritten.control) :
+      StableMachineRel limits validation baseline rewritten
+
+/-- Build the stable machine relation from a baseline-to-rewritten allocation
+history.  `StableHeapRel` stores the symmetric orientation so its public
+location relation continues to run from baseline values to rewritten values. -/
+theorem StableMachineRel.history {limits : Validate.Limits}
+    {validation : Validate.Context} {baseline rewritten : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baseline.store.heap
+      rewritten.store.heap)
+    (fuel : baseline.heapFuel ≤ rewritten.heapFuel)
+    (control : StableControlIso limits validation heap.locRel
+      baseline.control rewritten.control) :
+    StableMachineRel limits validation baseline rewritten := by
+  exact .related heap.locRel (.isomorphic heap.symm) fuel control
+
+/-- Inversion of the uniform machine relation at a halted baseline state.
+The rewritten state must also be halted, with a related result value and the
+same heap/fuel witnesses retained for the runner-level theorem. -/
+theorem StableMachineRel.haltedParts {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineStore : Store} {baselineFuel : Nat} {baselineValue : RVal}
+    {rewritten : Machine}
+    (relation : StableMachineRel limits validation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .halted baselineValue }
+      rewritten) :
+    ∃ rewrittenStore rewrittenFuel rewrittenValue locRel,
+      rewritten =
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .halted rewrittenValue } ∧
+        StableHeapRel baselineStore rewrittenStore locRel ∧
+        baselineFuel ≤ rewrittenFuel ∧
+        IxIR1.Sim.RValIso locRel baselineValue rewrittenValue := by
+  cases rewritten with
+  | mk rewrittenStore rewrittenFuel rewrittenControl =>
+      cases relation with
+      | related locRel heap fuel control =>
+          cases control with
+          | halted value =>
+              exact ⟨rewrittenStore, rewrittenFuel, _, locRel, rfl, heap,
+                fuel, value⟩
+
+theorem StableFrameIso.entry {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop}
+    {baselineValues rewrittenValues : Array RVal}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList) :
+    StableFrameIso rewrite locRel
+      { definition := source, values := baselineValues }
+      { definition := rewrite.definition, values := rewrittenValues } := by
+  exact ⟨rfl, rfl, rfl, rfl, values, .nil⟩
+
+theorem StableFrameIso.atPosition {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop} {block pc : Nat}
+    {baselineValues rewrittenValues : Array RVal}
+    {credits : Array (Option Credit)}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList)
+    (creditsRelated : StableCreditsIso locRel
+      credits.toList credits.toList) :
+    StableFrameIso rewrite locRel
+      { definition := source
+        block
+        pc
+        values := baselineValues
+        credits }
+      { definition := rewrite.definition
+        block
+        pc
+        values := rewrittenValues
+        credits } := by
+  exact ⟨rfl, rfl, rfl, rfl, values, creditsRelated⟩
+
+/-- A successful current-block lookup in a related source frame dispatches
+through the rewrite's exhaustive unchanged/accepted decision. -/
+theorem StableFrameIso.blockCase {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {block : Block}
+    (found : baseline.definition.blocks[baseline.block]? = some block) :
+    Reuse.FunctionRewrite.BlockCase rewrite baseline.block := by
+  have sourceAt : source.blocks[baseline.block]? = some block := by
+    rw [← frame.baselineDefinition]
+    exact found
+  exact rewrite.blockCaseOfLookup sourceAt
+
+/-- Advancing related frames and appending related results preserves the
+stable frame relation. -/
+theorem StableFrameIso.advancePush {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    StableFrameIso rewrite locRel
+      { baseline with
+        pc := baseline.pc + 1
+        values := baseline.values.push baselineValue }
+      { rewritten with
+        pc := rewritten.pc + 1
+        values := rewritten.values.push rewrittenValue } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition,
+    frame.block, congrArg (fun pc => pc + 1) frame.pc, ?_, frame.credits⟩
+  simpa using rvalsIso_append frame.values value
+
+/-- Appending a result to related value files, without advancing control, is
+the frame operation performed when an ordinary return resumes its caller. -/
+theorem StableFrameIso.push {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    StableFrameIso rewrite locRel
+      { baseline with values := baseline.values.push baselineValue }
+      { rewritten with values := rewritten.values.push rewrittenValue } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition,
+    frame.block, frame.pc, ?_, frame.credits⟩
+  simpa using rvalsIso_append frame.values value
+
+theorem StableFrameIso.advance {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten) :
+    StableFrameIso rewrite locRel
+      { baseline with pc := baseline.pc + 1 }
+      { rewritten with pc := rewritten.pc + 1 } := by
+  exact ⟨frame.baselineDefinition, frame.rewrittenDefinition,
+    frame.block, congrArg (fun pc => pc + 1) frame.pc,
+    frame.values, frame.credits⟩
+
+/-- A successful credit lookup in one related frame finds a related credit in
+the other frame. -/
+theorem StableFrameIso.creditLookup {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {id : CreditId} {baselineCredit : Credit}
+    (lookedUp : CreditLookup baseline id baselineCredit) :
+    ∃ rewrittenCredit,
+      CreditLookup rewritten id rewrittenCredit ∧
+        StableCreditIso locRel (some baselineCredit)
+          (some rewrittenCredit) := by
+  have baselineFound : baseline.credits[id]? =
+      some (some baselineCredit) :=
+    (CreditTake.of_lookup lookedUp).target_eq.2
+  have baselineListFound : baseline.credits.toList[id]? =
+      some (some baselineCredit) := by
+    simpa using baselineFound
+  obtain ⟨rewrittenSlot, rewrittenListFound, related⟩ :=
+    frame.credits.get? baselineListFound
+  cases rewrittenSlot with
+  | none => cases related
+  | some rewrittenCredit =>
+      have rewrittenFound : rewritten.credits[id]? =
+          some (some rewrittenCredit) := by
+        simpa using rewrittenListFound
+      exact ⟨rewrittenCredit, CreditLookup.of_getElem rewrittenFound, related⟩
+
+theorem StableFrameIso.noLiveCredits {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    (cleared : NoLiveCredits baseline) : NoLiveCredits rewritten := by
+  unfold NoLiveCredits at cleared ⊢
+  rw [← Array.any_toList] at cleared ⊢
+  rw [← frame.credits.any_isSome_eq]
+  exact cleared
+
+/-- Consuming corresponding credit slots without changing control preserves
+the frame relation and returns related authorities. -/
+theorem StableFrameIso.takeIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineNext : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {id : CreditId} {baselineCredit : Credit}
+    (taken : CreditTake baseline id baselineNext baselineCredit) :
+    ∃ rewrittenNext rewrittenCredit,
+      CreditTake rewritten id rewrittenNext rewrittenCredit ∧
+        StableCreditIso locRel (some baselineCredit)
+          (some rewrittenCredit) ∧
+        StableFrameIso rewrite locRel baselineNext rewrittenNext := by
+  obtain ⟨baselineNextEq, baselineFound⟩ := taken.target_eq
+  have baselineLookup : CreditLookup baseline id baselineCredit :=
+    CreditLookup.of_getElem baselineFound
+  obtain ⟨rewrittenCredit, rewrittenLookup, creditRelated⟩ :=
+    frame.creditLookup baselineLookup
+  let rewrittenNext : Frame :=
+    { rewritten with
+      credits := rewritten.credits.setIfInBounds id none }
+  have rewrittenTaken : CreditTake rewritten id rewrittenNext
+      rewrittenCredit := CreditTake.of_lookup rewrittenLookup
+  refine ⟨rewrittenNext, rewrittenCredit, rewrittenTaken, creditRelated, ?_⟩
+  subst baselineNext
+  exact ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    frame.pc, frame.values, frame.credits.array_set_none id⟩
+
+/-- Batch edge-credit consumption is equivariant under the stable frame
+relation.  The transferred credit vector is related pointwise, including
+transport of physical reservation locations. -/
+theorem StableFrameIso.takeManyIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineNext : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {ids : Array CreditId} {baselineCredits : Array Credit}
+    (taken : CreditTakeMany baseline ids baselineNext baselineCredits) :
+    ∃ rewrittenNext rewrittenCredits,
+      CreditTakeMany rewritten ids rewrittenNext rewrittenCredits ∧
+        StableCreditsIso locRel
+          (baselineCredits.map some).toList
+          (rewrittenCredits.map some).toList ∧
+        StableFrameIso rewrite locRel baselineNext rewrittenNext := by
+  have follow : ∀ {baselineCurrent : Frame} {remaining : List CreditId}
+      {baselineTarget : Frame} {baselineOutput : List Credit},
+      CreditTakeSequence baselineCurrent remaining baselineTarget
+          baselineOutput →
+      ∀ {rewrittenCurrent : Frame},
+        StableFrameIso rewrite locRel baselineCurrent rewrittenCurrent →
+        ∃ rewrittenTarget rewrittenOutput,
+          CreditTakeSequence rewrittenCurrent remaining rewrittenTarget
+              rewrittenOutput ∧
+            StableCreditsIso locRel (baselineOutput.map some)
+              (rewrittenOutput.map some) ∧
+            StableFrameIso rewrite locRel baselineTarget rewrittenTarget := by
+    intro baselineCurrent remaining baselineTarget baselineOutput sequence
+    induction sequence with
+    | nil current =>
+        intro rewrittenCurrent related
+        exact ⟨rewrittenCurrent, [], .nil rewrittenCurrent, .nil, related⟩
+    | @cons current middle target id remaining credit credits head tail ih =>
+        intro rewrittenCurrent related
+        obtain ⟨rewrittenMiddle, rewrittenCredit, rewrittenHead,
+            creditRelated, middleRelated⟩ := related.takeIso head
+        obtain ⟨rewrittenTarget, rewrittenCredits, rewrittenTail,
+            creditsRelated, targetRelated⟩ := ih middleRelated
+        exact ⟨rewrittenTarget, rewrittenCredit :: rewrittenCredits,
+          .cons rewrittenHead rewrittenTail,
+          .cons creditRelated creditsRelated, targetRelated⟩
+  obtain ⟨rewrittenNext, rewrittenOutput, rewrittenSequence,
+      outputRelated, nextRelated⟩ := follow taken.sequence frame
+  let rewrittenCredits : Array Credit := rewrittenOutput.toArray
+  have rewrittenTaken : CreditTakeMany rewritten ids rewrittenNext
+      rewrittenCredits := by
+    simpa [rewrittenCredits] using rewrittenSequence.toMany
+  refine ⟨rewrittenNext, rewrittenCredits, rewrittenTaken, ?_, nextRelated⟩
+  simpa [rewrittenCredits] using outputRelated
+
+/-- Consuming corresponding credit slots preserves the frame relation and
+returns related logical or physical authorities. -/
+theorem StableFrameIso.advanceTakeIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineNext : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {id : CreditId} {baselineCredit : Credit}
+    (taken : CreditTake { baseline with pc := baseline.pc + 1 }
+      id baselineNext baselineCredit) :
+    ∃ rewrittenNext rewrittenCredit,
+      CreditTake { rewritten with pc := rewritten.pc + 1 }
+          id rewrittenNext rewrittenCredit ∧
+        StableCreditIso locRel (some baselineCredit)
+          (some rewrittenCredit) ∧
+        StableFrameIso rewrite locRel baselineNext rewrittenNext := by
+  obtain ⟨baselineNextEq, baselineFound⟩ := taken.target_eq
+  have baselineLookup : CreditLookup baseline id baselineCredit :=
+    CreditLookup.of_getElem baselineFound
+  obtain ⟨rewrittenCredit, rewrittenLookup, creditRelated⟩ :=
+    frame.creditLookup baselineLookup
+  let rewrittenNext : Frame :=
+    { rewritten with
+      pc := rewritten.pc + 1
+      credits := rewritten.credits.setIfInBounds id none }
+  have rewrittenTaken : CreditTake
+      { rewritten with pc := rewritten.pc + 1 }
+      id rewrittenNext rewrittenCredit := by
+    exact CreditTake.of_lookup (rewrittenLookup.congrDefinition
+      rewritten.definition)
+  refine ⟨rewrittenNext, rewrittenCredit, rewrittenTaken, creditRelated, ?_⟩
+  subst baselineNext
+  exact ⟨frame.baselineDefinition, frame.rewrittenDefinition, frame.block,
+    congrArg (fun pc => pc + 1) frame.pc, frame.values,
+    frame.credits.array_set_none id⟩
+
+/-- Consuming a constructor appends corresponding field vectors and credits
+while advancing otherwise-related frames. -/
+theorem StableFrameIso.advanceAppendCreditIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {baselineFields rewrittenFields : Array RVal}
+    (fields : IxIR1.Sim.RValsIso locRel
+      baselineFields.toList rewrittenFields.toList)
+    {baselineCredit rewrittenCredit : Credit}
+    (credit : StableCreditIso locRel (some baselineCredit)
+      (some rewrittenCredit)) :
+    StableFrameIso rewrite locRel
+      { baseline with
+        pc := baseline.pc + 1
+        values := baseline.values ++ baselineFields
+        credits := baseline.credits.push (some baselineCredit) }
+      { rewritten with
+        pc := rewritten.pc + 1
+        values := rewritten.values ++ rewrittenFields
+        credits := rewritten.credits.push (some rewrittenCredit) } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition,
+    frame.block, congrArg (fun pc => pc + 1) frame.pc, ?_, ?_⟩
+  · simpa using rvalsIso_append_pair frame.values fields
+  · simpa using frame.credits.append (.cons credit .nil)
+
+/-- Consuming a constructor appends its common field vector and a common
+credit while advancing otherwise-related exact-location frames. -/
+theorem StableFrameIso.advanceAppendCredit {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baseline rewritten)
+    (fields : Array RVal) (credit : Credit) :
+    StableFrameIso rewrite (fun left right => left = right)
+      { baseline with
+        pc := baseline.pc + 1
+        values := baseline.values ++ fields
+        credits := baseline.credits.push (some credit) }
+      { rewritten with
+        pc := rewritten.pc + 1
+        values := rewritten.values ++ fields
+        credits := rewritten.credits.push (some credit) } := by
+  refine ⟨frame.baselineDefinition, frame.rewrittenDefinition,
+    frame.block, congrArg (fun pc => pc + 1) frame.pc, ?_, ?_⟩
+  · simpa using rvalsIso_append_refl frame.values fields.toList
+  · simpa using frame.credits.append
+      (.cons (StableCreditIso.refl (some credit)) .nil)
+
+/-- Under identity location transport, related frame value files are
+literally equal. -/
+theorem StableFrameIso.values_eq {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baseline rewritten) :
+    baseline.values = rewritten.values := by
+  apply Array.toList_inj.mp
+  exact frame.values.eq_of_location_eq
+
+/-- Under identity location transport, related credit files are literally
+equal. -/
+theorem StableFrameIso.credits_eq {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baseline rewritten) :
+    baseline.credits = rewritten.credits := by
+  apply Array.toList_inj.mp
+  exact frame.credits.eq_of_location_eq
+
+theorem StableFrameIso.rewritten_eq {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baseline rewritten : Frame}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baseline rewritten) :
+    rewritten = { baseline with definition := rewrite.definition } := by
+  have definitionEq := frame.rewrittenDefinition
+  have blockEq := frame.block
+  have pcEq := frame.pc
+  have valuesEq := frame.values_eq
+  have creditsEq := frame.credits_eq
+  cases baseline with
+  | mk baselineDefinition baselineBlock baselinePc baselineValues
+      baselineCredits =>
+      cases rewritten with
+      | mk rewrittenDefinition rewrittenBlock rewrittenPc rewrittenValues
+          rewrittenCredits =>
+          simp only at definitionEq blockEq pcEq valuesEq creditsEq ⊢
+          rw [definitionEq, ← blockEq, ← pcEq, ← valuesEq,
+            ← creditsEq]
+
+/-- Consuming one credit after advancing control is definition-insensitive.
+The rewritten frame consumes the same slot and lands in the canonical frame
+obtained by replacing only the source definition. -/
+theorem StableFrameIso.advanceTake {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baseline rewritten baselineNext : Frame}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baseline rewritten)
+    {id : CreditId} {credit : Credit}
+    (taken : CreditTake { baseline with pc := baseline.pc + 1 }
+      id baselineNext credit) :
+    CreditTake { rewritten with pc := rewritten.pc + 1 }
+        id { baselineNext with definition := rewrite.definition } credit ∧
+      StableFrameIso rewrite (fun left right => left = right)
+        baselineNext { baselineNext with definition := rewrite.definition } := by
+  have rewrittenTaken := taken.congrDefinition rewrite.definition
+  have startEq :
+      ({ rewritten with pc := rewritten.pc + 1 } : Frame) =
+        { { baseline with pc := baseline.pc + 1 } with
+          definition := rewrite.definition } := by
+    rw [frame.rewritten_eq]
+  rw [startEq]
+  refine ⟨rewrittenTaken, ?_⟩
+  obtain ⟨nextEq, _⟩ := taken.target_eq
+  subst baselineNext
+  exact ⟨frame.baselineDefinition, rfl, rfl, rfl,
+    IxIR1.Sim.RValsIso.refl baseline.values.toList,
+    StableCreditsIso.refl _⟩
+
+/-- A checked edge transfer is equivariant under related value registers and
+credit files.  The target-block ABI theorem supplies the only rewrite-specific
+fact needed at the destination. -/
+theorem StableFrameIso.edgeTransferIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {locRel : Nat → Nat → Prop} {baseline rewritten baselineTarget : Frame}
+    (frame : StableFrameIso rewrite locRel baseline rewritten)
+    {edge : Edge}
+    {baselineImplicit rewrittenImplicit : Array RVal}
+    (implicitValues : IxIR1.Sim.RValsIso locRel
+      baselineImplicit.toList rewrittenImplicit.toList)
+    (transferred : EdgeTransfer baseline edge baselineImplicit
+      baselineTarget) :
+    ∃ rewrittenTarget,
+      EdgeTransfer rewritten edge rewrittenImplicit rewrittenTarget ∧
+        StableFrameIso rewrite locRel baselineTarget rewrittenTarget := by
+  obtain ⟨baselineValues, baselineCredits, baselineAfter, sourceBlock,
+      baselineResolved, baselineTaken, baselineCleared, sourceBlockAt,
+      baselineValueArity, baselineCreditArity, baselineTargetEq⟩ :=
+    transferred.parts
+  obtain ⟨rewrittenValues, rewrittenResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values baselineResolved
+  obtain ⟨rewrittenAfter, rewrittenCredits, rewrittenTaken,
+      creditsRelated, afterRelated⟩ := frame.takeManyIso baselineTaken
+  have rewrittenCleared : NoLiveCredits rewrittenAfter :=
+    afterRelated.noLiveCredits baselineCleared
+  have sourceBlockAt' : source.blocks[edge.target]? = some sourceBlock := by
+    rw [← afterRelated.baselineDefinition]
+    exact sourceBlockAt
+  obtain ⟨rewrittenBlock, rewrittenBlockAt, valueParams, creditParams⟩ :=
+    rewrite.targetBlockAbi sourceBlockAt'
+  have rewrittenBlockAt' :
+      rewrittenAfter.definition.blocks[edge.target]? =
+        some rewrittenBlock := by
+    rw [afterRelated.rewrittenDefinition]
+    exact rewrittenBlockAt
+  have allValuesRelated : IxIR1.Sim.RValsIso locRel
+      (baselineImplicit ++ baselineValues).toList
+      (rewrittenImplicit ++ rewrittenValues).toList := by
+    simpa using rvalsIso_append_pair implicitValues valuesRelated
+  have valueSizes : (baselineImplicit ++ baselineValues).size =
+      (rewrittenImplicit ++ rewrittenValues).size := by
+    simpa using rvalsIso_length_eq allValuesRelated
+  have rewrittenValueArity :
+      (rewrittenImplicit ++ rewrittenValues).size =
+        rewrittenBlock.valueParams.size :=
+    valueSizes.symm.trans <| baselineValueArity.trans <|
+      (congrArg Array.size valueParams).symm
+  have creditSizes : baselineCredits.size = rewrittenCredits.size := by
+    simpa using creditsRelated.length_eq
+  have rewrittenCreditArity : rewrittenCredits.size =
+      rewrittenBlock.creditParams.size :=
+    creditSizes.symm.trans <| baselineCreditArity.trans <|
+      (congrArg Array.size creditParams).symm
+  let rewrittenTarget : Frame :=
+    { rewrittenAfter with
+      block := edge.target
+      pc := 0
+      values := rewrittenImplicit ++ rewrittenValues
+      credits := rewrittenCredits.map some }
+  have rewrittenTransferred : EdgeTransfer rewritten edge rewrittenImplicit
+      rewrittenTarget := by
+    exact EdgeTransfer.of_parts rewrittenResolved rewrittenTaken
+      rewrittenCleared rewrittenBlockAt' rewrittenValueArity
+      rewrittenCreditArity
+  refine ⟨rewrittenTarget, rewrittenTransferred, ?_⟩
+  subst baselineTarget
+  exact ⟨afterRelated.baselineDefinition, afterRelated.rewrittenDefinition,
+    rfl, rfl, allValuesRelated, creditsRelated⟩
+
+/-- A checked edge out of a stable source frame executes in the rewritten
+definition at the same block ID.  `FunctionRewrite.targetBlockAbi` supplies
+exactly the target-block compatibility required by `EdgeTransfer`. -/
+theorem StableFrameIso.edgeTransfer {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    {rewrite : Reuse.FunctionRewrite limits validation source}
+    {baseline rewritten baselineTarget : Frame}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baseline rewritten)
+    {edge : Edge} {implicitValues : Array RVal}
+    (transferred : EdgeTransfer baseline edge implicitValues baselineTarget) :
+    EdgeTransfer rewritten edge implicitValues
+        { baselineTarget with definition := rewrite.definition } ∧
+      StableFrameIso rewrite (fun left right => left = right)
+        baselineTarget
+        { baselineTarget with definition := rewrite.definition } := by
+  obtain ⟨sourceTargetBlock, sourceTargetAt⟩ := transferred.targetBlock
+  have sourceTargetAt' : source.blocks[edge.target]? =
+      some sourceTargetBlock := by
+    rw [← frame.baselineDefinition]
+    exact sourceTargetAt
+  obtain ⟨rewrittenTargetBlock, rewrittenTargetAt, valueParams,
+      creditParams⟩ := rewrite.targetBlockAbi sourceTargetAt'
+  have rewrittenTransfer := transferred.congrDefinition sourceTargetAt
+    rewrittenTargetAt valueParams creditParams
+  rw [← frame.rewritten_eq] at rewrittenTransfer
+  have baselineTargetDefinition : baselineTarget.definition = source :=
+    transferred.definition.trans frame.baselineDefinition
+  refine ⟨rewrittenTransfer, ?_⟩
+  exact ⟨baselineTargetDefinition, rfl, rfl, rfl,
+    IxIR1.Sim.RValsIso.refl baselineTarget.values.toList,
+    StableCreditsIso.refl baselineTarget.credits.toList⟩
+
+theorem StableFrameRel.entry {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop}
+    {baselineValues rewrittenValues : Array RVal}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList) :
+    StableFrameRel limits validation locRel
+      { definition := source, values := baselineValues }
+      { definition := rewrite.definition, values := rewrittenValues } :=
+  .rewritten rewrite (StableFrameIso.entry rewrite values)
+
+theorem StableFrameRel.push {limits : Validate.Limits}
+    {validation : Validate.Context} {locRel : Nat → Nat → Prop}
+    {baseline rewritten : Frame}
+    (frame : StableFrameRel limits validation locRel baseline rewritten)
+    {baselineValue rewrittenValue : RVal}
+    (value : IxIR1.Sim.RValIso locRel baselineValue rewrittenValue) :
+    StableFrameRel limits validation locRel
+      { baseline with values := baseline.values.push baselineValue }
+      { rewritten with values := rewritten.values.push rewrittenValue } := by
+  cases frame with
+  | rewritten rewrite related =>
+      exact .rewritten rewrite (related.push value)
+
+/-- Related recursive arguments and an already-related continuation stack
+form the stable control state reached by every accepted-site theorem. -/
+theorem StableControlIso.recursiveCall {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {locRel : Nat → Nat → Prop}
+    {baselineValues rewrittenValues : Array RVal}
+    {baselineStack rewrittenStack : List Continuation}
+    (values : IxIR1.Sim.RValsIso locRel
+      baselineValues.toList rewrittenValues.toList)
+    (stack : StableStackIso limits validation locRel
+      baselineStack rewrittenStack) :
+    StableControlIso limits validation locRel
+      (.running { definition := source, values := baselineValues }
+        baselineStack)
+      (.running { definition := rewrite.definition, values := rewrittenValues }
+        rewrittenStack) :=
+  .running (StableFrameRel.entry rewrite values) stack
+
+/-- Exact-content recursive-call states inhabit the uniform machine relation
+with identity location transport. -/
+theorem StableMachineRel.contentsRecursiveCall {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineValues rewrittenValues : Array RVal}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (values : IxIR1.Sim.RValsIso (fun left right => left = right)
+      baselineValues.toList rewrittenValues.toList)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack) :
+    StableMachineRel limits validation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running
+          { definition := source, values := baselineValues } baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := rewrittenValues }
+          rewrittenStack } :=
+  .related (fun left right => left = right) (.contents heap) fuel
+    (StableControlIso.recursiveCall rewrite values stack)
+
+/-- Physical recursive-call states inhabit the same relation using the
+target-to-baseline heap bijection produced by reuse soundness. -/
+theorem StableMachineRel.isomorphicRecursiveCall
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineValues rewrittenValues : Array RVal}
+    {baselineStack rewrittenStack : List Continuation}
+    (iso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (values : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baselineValues.toList rewrittenValues.toList)
+    (stack : StableStackIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        iso.locRel rewrittenLocation baselineLocation)
+      baselineStack rewrittenStack) :
+    StableMachineRel limits validation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running
+          { definition := source, values := baselineValues } baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := rewrittenValues }
+          rewrittenStack } :=
+  .related
+    (fun baselineLocation rewrittenLocation =>
+      iso.locRel rewrittenLocation baselineLocation)
+    (.isomorphic (heapIsoToHistory iso))
+    fuel
+    (StableControlIso.recursiveCall rewrite values stack)
+
+theorem StableContinuationIso.applyMoreOrResume
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {baseline rewritten : Frame}
+    (arguments : Array RVal)
+    (frame : StableFrameRel limits validation (fun left right => left = right)
+      baseline rewritten) :
+    StableContinuationIso limits validation (fun left right => left = right)
+      (if arguments.isEmpty then .resume baseline
+        else .applyMore arguments baseline)
+      (if arguments.isEmpty then .resume rewritten
+        else .applyMore arguments rewritten) := by
+  by_cases empty : arguments.isEmpty
+  · simp only [empty]
+    exact .resume frame
+  · simp only [empty]
+    exact .applyMore (IxIR1.Sim.RValsIso.refl arguments.toList) frame
+
+theorem StableContinuationIso.applyMoreOrResumeIso
+    {limits : Validate.Limits} {validation : Validate.Context}
+    {locRel : Nat → Nat → Prop}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baseline rewritten : Frame}
+    (arguments : IxIR1.Sim.RValsIso locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (frame : StableFrameRel limits validation locRel baseline rewritten) :
+    StableContinuationIso limits validation locRel
+      (if baselineArguments.isEmpty then .resume baseline
+        else .applyMore baselineArguments baseline)
+      (if rewrittenArguments.isEmpty then .resume rewritten
+        else .applyMore rewrittenArguments rewritten) := by
+  have sizes : baselineArguments.size = rewrittenArguments.size := by
+    simpa using rvalsIso_length_eq arguments
+  have emptyEq : baselineArguments.isEmpty = rewrittenArguments.isEmpty := by
+    simp [Array.isEmpty, sizes]
+  by_cases empty : baselineArguments.isEmpty
+  · have rewrittenEmpty : rewrittenArguments.isEmpty := by
+      simpa [emptyEq] using empty
+    simp only [empty, rewrittenEmpty]
+    exact .resume frame
+  · have rewrittenNonempty : ¬rewrittenArguments.isEmpty := by
+      simpa [emptyEq] using empty
+    simp only [empty, rewrittenNonempty]
+    exact .applyMore arguments frame
+
+/-! ## Accepted macros from exact-content states -/
+
+/-- The logical hot accepted macro is compositional over exact semantic heap
+contents and heap-fuel dominance.  In particular, source and target stores
+may already differ in every observational counter; only their live node array
+must agree. -/
+theorem acceptedHotLogicalStableSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel remaining rewrittenFuel : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {ambient : List IxIR1.Sim.Root} {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (owned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc location⟩ :: ambient))
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    let rewrittenAllocation :=
+      (logicalHotResetStore rewrittenStore location).allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+    let baselineTarget : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := callValues } baselineStack }
+    let rewrittenTarget : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := callValues }
+          rewrittenStack }
+    Steps baselineContext .logical (2 * site.shape.fieldCount + 3)
+        baselineMachine baselineTarget ∧
+      Steps rewrittenContext .logical 4 rewrittenMachine rewrittenTarget ∧
+      StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have rewrittenBoxAt : rewrittenStore.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← heap.get?_eq location]
+    exact sourceBoxAt
+  have baselineResetContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore baselineStore location) :=
+    hotPrefix_contents sourceBoxAt owned retained released
+  have resetCongruence : HeapContentsEq
+      (logicalHotResetStore baselineStore location)
+      (logicalHotResetStore rewrittenStore location) := by
+    simpa [logicalHotResetStore] using
+      (((heap.tickResetAttempt).kill location).tickHotReset)
+  have resetContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore rewrittenStore location) :=
+    baselineResetContents.trans resetCongruence
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let rewrittenAllocation :=
+    (logicalHotResetStore rewrittenStore location).allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+  have allocationContents : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have allocationLocation : baselineAllocation.2 =
+      rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode_location .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have rewrittenFieldWorlds : FieldWorlds
+      (logicalHotResetStore rewrittenStore location)
+      allocationSchema newFields :=
+    resetContents.fieldWorlds baselineFieldWorlds
+  have rewrittenTailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc rewrittenAllocation.2))
+      site.shape.tailArguments = .ok callValues := by
+    rw [← allocationLocation]
+    simpa [baselineAllocation] using tailResolved
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have rewrittenArity : callValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  let baselineMachine : Machine :=
+    { store := baselineStore
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store := rewrittenStore
+      heapFuel := rewrittenFuel
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  have baselineExecution : Steps baselineContext .logical
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := callValues } baselineStack } := by
+    simpa [baselineMachine, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := .logical)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := remaining)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt (by rfl) parameterCount fieldCount sourceResolved sourceBoxAt
+        rfl retained released allocationSchemaAt allocationResolved
+        baselineFieldWorlds tailResolved arity sourceNonempty
+  have rewrittenExecution : Steps rewrittenContext .logical 4
+      rewrittenMachine
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := callValues }
+          rewrittenStack } := by
+    simpa [rewrittenMachine, rewrittenAllocation, logicalHotResetStore] using
+      hotLogicalAcceptedControl site
+        (context := rewrittenContext) (definition := rewrite.definition)
+        (resetId := index) (hotId := source.blocks.size + helperOffset)
+        (coldId := source.blocks.size + helperOffset + 1)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location)
+        (box := ⟨.shared, 1,
+          .ctorN site.shape.sourceConstructor fields⟩)
+        (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+        (machine := rewrittenMachine) (stack := rewrittenStack)
+        resetAt hotAt rewrittenSourceSchemaAt rewrittenAllocationSchemaAt
+        sourceLayout allocationLayout (by rfl) parameterCount fieldCount
+        sourceResolved (ConstructorView.of_box rewrittenBoxAt rfl rfl) rfl
+        allocationResolved
+        (by simpa [logicalHotResetStore] using rewrittenFieldWorlds)
+        (by simpa [rewrittenAllocation, logicalHotResetStore] using
+          rewrittenTailResolved)
+        rewrittenArity rewrittenNonempty
+  have outputFuel : remaining ≤ rewrittenFuel :=
+    Nat.le_trans (releaseShared_remaining_le released) fuel
+  exact ⟨by simpa [baselineMachine, baselineAllocation] using baselineExecution,
+    by simpa [rewrittenMachine, rewrittenAllocation] using rewrittenExecution,
+    StableMachineRel.contentsRecursiveCall rewrite allocationContents outputFuel
+      (IxIR1.Sim.RValsIso.refl callValues.toList) stack⟩
+
+/-- The cold accepted macro is likewise compositional over exact semantic
+contents.  The baseline retain batch is transported to the rewritten store;
+the two parent decrements then agree in contents while the rewritten reset
+adds only observational counters. -/
+theorem acceptedColdStableSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (retainedAt : baselineRetained.get? location = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc ((baselineDecrementStore baselineRetained location
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩).allocNode .shared
+              (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineReleased := baselineDecrementStore baselineRetained location
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor newFields)
+    ∃ rewrittenRetained,
+      let rewrittenReleased := baselineDecrementStore rewrittenRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩
+      let rewrittenReset := rewrittenReleased.tickResetAttempt.tickColdReset
+      let rewrittenAllocation := rewrittenReset.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+      let baselineTarget : Machine :=
+        { store := baselineAllocation.1
+          heapFuel := fieldFuel
+          control := .running
+            { definition := source, values := callValues } baselineStack }
+      let rewrittenTarget : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition, values := callValues }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore fields rewrittenRetained ∧
+        Steps baselineContext interpretation
+          (2 * site.shape.fieldCount + 3) baselineMachine baselineTarget ∧
+        Steps rewrittenContext interpretation 4 rewrittenMachine
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, _hotAt, coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have rewrittenBoxAt : rewrittenStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← heap.get?_eq location]
+    exact sourceBoxAt
+  obtain ⟨rewrittenRetained, rewrittenRetainedRun, retainedContents⟩ :=
+    heap.retainSharedMany retained
+  have rewrittenRetainedAt : rewrittenRetained.get? location = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩ := by
+    rw [← retainedContents.get?_eq location]
+    exact retainedAt
+  obtain ⟨actualRetainedRc, actualRetainedAt, baselineReleasedRun,
+      _baselineResetRetained, _baselineHeapEq⟩ :=
+    coldPrefix_commutes (heapFuel := fieldFuel) sourceBoxAt shared retained
+  have actualBoxEq :
+      (⟨.shared, actualRetainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) =
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ :=
+    Option.some.inj (actualRetainedAt.symm.trans retainedAt)
+  have actualRcEq : actualRetainedRc = retainedRc := by
+    cases actualBoxEq
+    rfl
+  subst actualRetainedRc
+  obtain ⟨rewrittenActualRc, rewrittenActualAt, _rewrittenReleasedRun,
+      rewrittenResetRetained, _rewrittenHeapEq⟩ :=
+    coldPrefix_commutes (heapFuel := fieldFuel) rewrittenBoxAt shared
+      rewrittenRetainedRun
+  have rewrittenBoxEq :
+      (⟨.shared, rewrittenActualRc,
+          .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) =
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩ :=
+    Option.some.inj (rewrittenActualAt.symm.trans rewrittenRetainedAt)
+  have rewrittenRcEq : rewrittenActualRc = retainedRc := by
+    cases rewrittenBoxEq
+    rfl
+  subst rewrittenActualRc
+  let baselineReleased := baselineDecrementStore baselineRetained location
+    ⟨.shared, retainedRc,
+      .ctorN site.shape.sourceConstructor fields⟩
+  let rewrittenReleased := baselineDecrementStore rewrittenRetained location
+    ⟨.shared, retainedRc,
+      .ctorN site.shape.sourceConstructor fields⟩
+  let rewrittenReset := rewrittenReleased.tickResetAttempt.tickColdReset
+  have releasedContents : HeapContentsEq baselineReleased
+      rewrittenReleased := by
+    simpa [baselineReleased, rewrittenReleased, baselineDecrementStore] using
+      (retainedContents.rcTick.setBox location
+        { (⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩ : IxIR1.NodeBox) with
+          rc := retainedRc - 1 })
+  have resetContents : HeapContentsEq baselineReleased rewrittenReset := by
+    apply releasedContents.trans
+    exact ⟨rfl⟩
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  let rewrittenAllocation := rewrittenReset.allocNode .shared
+    (.ctorN site.shape.allocationConstructor newFields)
+  have allocationContents : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have allocationLocation : baselineAllocation.2 =
+      rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      resetContents.allocNode_location .shared
+        (.ctorN site.shape.allocationConstructor newFields)
+  have rewrittenFieldWorlds :
+      FieldWorlds rewrittenReset allocationSchema newFields :=
+    resetContents.fieldWorlds baselineFieldWorlds
+  have rewrittenTailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc rewrittenAllocation.2))
+      site.shape.tailArguments = .ok callValues := by
+    rw [← allocationLocation]
+    simpa [baselineReleased, baselineAllocation] using tailResolved
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have rewrittenArity : callValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  let baselineMachine : Machine :=
+    { store := baselineStore
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := parameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store := rewrittenStore
+      heapFuel := rewrittenFuel
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := parameters
+          credits := #[] }
+        rewrittenStack }
+  have baselineExecution : Steps baselineContext interpretation
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := fieldFuel
+        control := .running
+          { definition := source, values := callValues } baselineStack } := by
+    simpa [baselineMachine, baselineReleased, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := interpretation)
+        (definition := source) (blockId := index)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := fieldFuel)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt (by rfl) parameterCount fieldCount sourceResolved sourceBoxAt
+        rfl retained (by simpa [baselineReleased] using baselineReleasedRun)
+        allocationSchemaAt allocationResolved
+        (by simpa [baselineReleased] using baselineFieldWorlds)
+        (by simpa [baselineReleased, baselineAllocation] using tailResolved)
+        arity sourceNonempty
+  have rewrittenExecution : Steps rewrittenContext interpretation 4
+      rewrittenMachine
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := callValues }
+          rewrittenStack } := by
+    simpa [rewrittenMachine, rewrittenReset, rewrittenReleased,
+      rewrittenAllocation] using
+      coldAcceptedControl site
+        (context := rewrittenContext) (interpretation := interpretation)
+        (definition := rewrite.definition) (resetId := index)
+        (hotId := source.blocks.size + helperOffset)
+        (coldId := source.blocks.size + helperOffset + 1)
+        (parameters := parameters) (fields := fields)
+        (newFields := newFields) (callValues := callValues)
+        (location := location)
+        (box := ⟨.shared, rc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+        (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+        (machine := rewrittenMachine) (resetStore := rewrittenReset)
+        (stack := rewrittenStack) resetAt coldAt rewrittenSourceSchemaAt
+        rewrittenAllocationSchemaAt sourceLayout allocationLayout (by rfl)
+        parameterCount fieldCount sourceResolved
+        (ConstructorView.of_box rewrittenBoxAt rfl rfl) shared
+        (by simpa [rewrittenMachine, coldResetStartStore, rewrittenReset,
+          rewrittenReleased] using
+          rewrittenResetRetained)
+        allocationResolved
+        (by simpa [rewrittenReset] using rewrittenFieldWorlds)
+        (by simpa [rewrittenAllocation] using rewrittenTailResolved)
+        rewrittenArity rewrittenNonempty
+  have outputFuel : fieldFuel ≤ rewrittenFuel := by omega
+  refine ⟨rewrittenRetained, rewrittenRetainedRun, ?_, ?_, ?_⟩
+  · simpa [baselineMachine, baselineReleased, baselineAllocation] using
+      baselineExecution
+  · simpa [rewrittenMachine, rewrittenReleased, rewrittenReset,
+      rewrittenAllocation] using rewrittenExecution
+  · exact StableMachineRel.contentsRecursiveCall rewrite allocationContents
+      outputFuel (IxIR1.Sim.RValsIso.refl callValues.toList) stack
+
+/-! ## Accepted physical macro from an isomorphic state -/
+
+/-- A physical hot accepted block composes with an existing live-location
+bijection. Baseline and rewritten register files, constructor fields, and
+continuations may already use different locations. The consumed source pair
+is replaced by the reused-target/fresh-baseline pair, all surviving pairs are
+preserved, and both executions rejoin at a stable recursive-call state. -/
+theorem acceptedHotPhysicalStableSimulationIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    {baselineParameters rewrittenParameters baselineFields rewrittenFields
+      baselineNewFields rewrittenNewFields baselineCallValues : Array RVal}
+    {baselineLocation rewrittenLocation fieldFuel remaining rewrittenFuel :
+      Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineParameters.toList rewrittenParameters.toList)
+    (stack : StableStackIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineStack rewrittenStack)
+    (stackAvoids : StackValuesAvoidLocation rewrittenLocation rewrittenStack)
+    (stackCreditsAvoids :
+      StackCreditsAvoidLocation rewrittenLocation rewrittenStack)
+    {baselineBefore baselineAfter rewrittenBefore rewrittenAfter :
+      List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (rewrittenSourceResolved :
+      resolveAtom rewrittenParameters (.reg site.shape.source) =
+        .ok (.loc rewrittenLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: baselineBefore))
+    (rewrittenOwned : IxIR1.Sim.RootOwnership rewrittenStore.heap
+      (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselinePartition :
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+          baselineBefore).Perm
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter))
+    (rewrittenPartition :
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+          rewrittenBefore).Perm
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter))
+    (mapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter))
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (rewrittenAllocationResolved : resolveAtoms
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      site.shape.allocationArguments = .ok rewrittenNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (rewrittenFieldWorlds : FieldWorlds
+      (physicalHotResetStore rewrittenStore rewrittenLocation)
+      allocationSchema rewrittenNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.ctorN site.shape.allocationConstructor baselineNewFields)
+    ∃ physical : Store,
+      ∃ outputIso : IxIR1.Sim.HeapIso physical.heap
+          baselineAllocation.1.heap,
+      ∃ physicalCallValues : Array RVal,
+      physicalHotReuseStore rewrittenStore rewrittenLocation
+          (.ctorN site.shape.allocationConstructor rewrittenNewFields)
+          allocationSchema.fields.size = .ok physical ∧
+      IxIR1.Sim.RootOwnership physical.heap
+          (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenAfter) ∧
+      IxIR1.Sim.RootOwnership baselineAllocation.1.heap
+          (⟨.shared, .loc baselineAllocation.2⟩ :: baselineAfter) ∧
+      outputIso.locRel rewrittenLocation baselineAllocation.2 ∧
+      (∀ {rewrittenCandidate baselineCandidate : Nat},
+        inputIso.locRel rewrittenCandidate baselineCandidate →
+        rewrittenCandidate ≠ rewrittenLocation →
+        outputIso.locRel rewrittenCandidate baselineCandidate) ∧
+      Steps baselineContext .physical (2 * site.shape.fieldCount + 3)
+        baselineMachine
+        { store := baselineAllocation.1
+          heapFuel := remaining
+          control := .running
+            { definition := source, values := baselineCallValues }
+            baselineStack } ∧
+      Steps rewrittenContext .physical 4 rewrittenMachine
+        { store := physical
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition, values := physicalCallValues }
+            rewrittenStack } ∧
+      IxIR1.Sim.RValsIso
+          (fun baselineCandidate rewrittenCandidate =>
+            outputIso.locRel rewrittenCandidate baselineCandidate)
+          baselineCallValues.toList physicalCallValues.toList ∧
+      StableStackIso limits validation
+          (fun baselineCandidate rewrittenCandidate =>
+            outputIso.locRel rewrittenCandidate baselineCandidate)
+          baselineStack rewrittenStack ∧
+      StableMachineRel limits validation
+        { store := baselineAllocation.1
+          heapFuel := remaining
+          control := .running
+            { definition := source, values := baselineCallValues }
+            baselineStack }
+        { store := physical
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition, values := physicalCallValues }
+            rewrittenStack } := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, hotAt, _coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, sourceSchemaFields, allocationSchemaFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  have uniformAllocationFields : allocationSchema.fields =
+      Array.replicate site.shape.fieldCount .shared :=
+    allocationSchemaFields.trans sourceSchemaFields
+  have parameterSizes : baselineParameters.size = rewrittenParameters.size := by
+    simpa using rvalsIso_length_eq parameters
+  have rewrittenParameterCount : rewrittenParameters.size =
+      site.shape.parameterCount := parameterSizes.symm.trans parameterCount
+  obtain ⟨leftBox, rightBox, leftLive, rightLive, boxesRelated⟩ :=
+    inputIso.related_live locations
+  have leftBoxEq : leftBox =
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩ :=
+    Option.some.inj (leftLive.symm.trans rewrittenAt)
+  have rightBoxEq : rightBox =
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩ :=
+    Option.some.inj (rightLive.symm.trans baselineAt)
+  subst leftBox
+  subst rightBox
+  have rewrittenToBaselineFields : IxIR1.Sim.RValsIso inputIso.locRel
+      rewrittenFields.toList baselineFields.toList := by
+    cases boxesRelated.node with
+    | ctor related => exact related
+  have fieldsRelated : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineFields.toList rewrittenFields.toList :=
+    rvalsIso_symm rewrittenToBaselineFields
+  have fieldSizes : baselineFields.size = rewrittenFields.size := by
+    simpa using rvalsIso_length_eq fieldsRelated
+  have rewrittenFieldCount : rewrittenFields.size = site.shape.fieldCount :=
+    fieldSizes.symm.trans fieldCount
+  have prefixRelated : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      (baselinePrefixValues baselineParameters baselineFields).toList
+      (baselinePrefixValues rewrittenParameters rewrittenFields).toList := by
+    simpa [baselinePrefixValues] using
+      rvalsIso_append_pair
+        (rvalsIso_append_pair parameters fieldsRelated) fieldsRelated
+  obtain ⟨actualRewrittenNewFields, actualRewrittenResolved,
+      newFieldsRelated⟩ :=
+    resolveAtoms_iso prefixRelated baselineAllocationResolved
+  have actualNewFieldsEq : actualRewrittenNewFields = rewrittenNewFields :=
+    Except.ok.inj
+      (actualRewrittenResolved.symm.trans rewrittenAllocationResolved)
+  subst actualRewrittenNewFields
+  have prefixContents : HeapContentsEq baselineReleased
+      (logicalHotResetStore baselineStore baselineLocation) :=
+    hotPrefix_contents baselineAt baselineOwned retained released
+  have baselineMissing : baselineReleased.get? baselineLocation = none := by
+    rw [prefixContents.get?_eq baselineLocation]
+    change (logicalHotResetStore baselineStore baselineLocation).heap.get?
+      baselineLocation = none
+    rw [logicalHotResetStore_heap]
+    exact IxIR1.Sim.get?_kill_same baselineAt
+  have baselineNewFieldsAvoid : ∀ value ∈ baselineNewFields.toList,
+      value ≠ .loc baselineLocation :=
+    FieldWorlds.avoidsMissing uniformAllocationFields baselineFieldWorlds
+      baselineMissing
+  have rewrittenNewFieldsAvoid : ∀ value ∈ rewrittenNewFields.toList,
+      value ≠ .loc rewrittenLocation :=
+    rvalsIso_right_avoids_of_left inputIso locations newFieldsRelated
+      baselineNewFieldsAvoid
+  have restrictedNewFields : IxIR1.Sim.RValsIso
+      (fun rewrittenCandidate baselineCandidate =>
+        inputIso.locRel rewrittenCandidate baselineCandidate ∧
+          rewrittenCandidate ≠ rewrittenLocation)
+      rewrittenNewFields.toList baselineNewFields.toList :=
+    rvalsIso_restrict_left (rvalsIso_symm newFieldsRelated)
+      rewrittenNewFieldsAvoid
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.ctorN site.shape.allocationConstructor baselineNewFields)
+  obtain ⟨physical, reused, outputIso, physicalOwned,
+      baselineAllocationOwned, outputResult, outputExtends⟩ :=
+    hotPrefixReuse_sound_under_iso
+      (baselineStore := baselineStore) (rewrittenStore := rewrittenStore)
+      (baselineRetained := baselineRetained)
+      (baselineReleased := baselineReleased)
+      (baselineLocation := baselineLocation)
+      (rewrittenLocation := rewrittenLocation)
+      (oldCid := site.shape.sourceConstructor)
+      (newCid := site.shape.allocationConstructor)
+      (baselineFields := baselineFields) (rewrittenFields := rewrittenFields)
+      (baselineNewFields := baselineNewFields)
+      (rewrittenNewFields := rewrittenNewFields) (fieldFuel := fieldFuel)
+      (remaining := remaining) (baselineBefore := baselineBefore)
+      (baselineAfter := baselineAfter) (rewrittenBefore := rewrittenBefore)
+      (rewrittenAfter := rewrittenAfter) allocationSchema.fields.size inputIso
+      locations baselineAt rewrittenAt baselineOwned rewrittenOwned retained
+      released baselinePartition rewrittenPartition restrictedNewFields
+  obtain ⟨physicalAgain, reusedAgain, physicalHeap⟩ :=
+    physicalHotReuseStore_ok
+      (.ctorN site.shape.allocationConstructor rewrittenNewFields)
+      allocationSchema.fields.size rewrittenAt
+  have physicalEq : physicalAgain = physical :=
+    Except.ok.inj (reusedAgain.symm.trans reused)
+  subst physicalAgain
+  have physicalAt : physical.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.allocationConstructor rewrittenNewFields⟩ := by
+    change physical.heap.get? rewrittenLocation = _
+    rw [physicalHeap]
+    exact IxIR1.Sim.get?_reuseSharedNodeStore_same rewrittenAt
+  let outputRel : Nat → Nat → Prop :=
+    fun baselineCandidate rewrittenCandidate =>
+      outputIso.locRel rewrittenCandidate baselineCandidate
+  have translatedPrefix : TranslatedValuesIso site.shape outputRel
+      (baselinePrefixValues baselineParameters baselineFields)
+      (helperEntryValues site.shape.source rewrittenParameters
+        rewrittenFields) := by
+    intro sourceId targetId baselineValue relevant translated baselineValueAt
+    obtain ⟨rewrittenValue, rewrittenValueAt, inputValueRelated⟩ :=
+      rvalsIso_array_getElem? prefixRelated baselineValueAt
+    have helperValueAt :=
+      valuesRel_helperEntry rewrittenParameterCount rewrittenFieldCount
+        site.fits.sourceBound sourceId targetId translated
+    rw [rewrittenValueAt] at helperValueAt
+    have supported :=
+      mapped sourceId targetId rewrittenValue relevant translated
+        rewrittenValueAt
+    have rewrittenValueAvoid : rewrittenValue ≠ .loc rewrittenLocation :=
+      by
+        cases rewrittenValue with
+        | loc location =>
+            obtain ⟨world, member⟩ := supported
+            rcases List.mem_append.mp member with fieldMember | survivorMember
+            · rw [IxIR1.Sim.rootsFor, List.mem_map] at fieldMember
+              obtain ⟨field, fieldMem, rootEq⟩ := fieldMember
+              have fieldEq : field = .loc location :=
+                congrArg IxIR1.Sim.Root.value rootEq
+              subst field
+              exact rewrittenNewFieldsAvoid _ fieldMem
+            · exact physicalOwned.sole_root_ne physicalAt survivorMember
+        | lit literal => intro impossible; cases impossible
+        | erased => intro impossible; cases impossible
+    have outputValueRelated : IxIR1.Sim.RValIso outputRel
+        baselineValue rewrittenValue := by
+      cases inputValueRelated with
+      | loc locationRelated =>
+          apply IxIR1.Sim.RValIso.loc
+          apply outputExtends locationRelated
+          intro same
+          apply rewrittenValueAvoid
+          cases same
+          rfl
+      | lit => exact .lit
+      | erased => exact .erased
+    exact ⟨rewrittenValue, helperValueAt.symm, outputValueRelated⟩
+  have baselinePrefixSize :
+      (baselinePrefixValues baselineParameters baselineFields).size =
+        site.shape.parameterCount + 2 * site.shape.fieldCount := by
+    simp [baselinePrefixValues, parameterCount, fieldCount, Nat.two_mul]
+  have rewrittenHelperSize :
+      (helperEntryValues site.shape.source rewrittenParameters
+        rewrittenFields).size =
+        site.shape.fieldCount + (site.shape.parameterCount - 1) := by
+    simp [helperEntryValues, List.length_eraseIdx, rewrittenParameterCount,
+      rewrittenFieldCount, site.fits.sourceBound]
+  have translatedAfterAllocation : TranslatedValuesIso site.shape outputRel
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc baselineAllocation.2))
+      ((helperEntryValues site.shape.source rewrittenParameters
+        rewrittenFields).push (.loc rewrittenLocation)) :=
+    TranslatedValuesIso.pushResult translatedPrefix (.loc outputResult)
+      baselinePrefixSize rewrittenHelperSize site.fits.sourceBound
+  have sourceNonempty : source.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem sourceAt
+  have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem resetAt
+  have rewrittenArity : baselineCallValues.size =
+      rewrite.definition.signature.params.size := by
+    simpa using arity
+  let baselineMachine : Machine :=
+    { store := baselineStore
+      heapFuel := fieldFuel + 1
+      control := .running
+        { definition := source
+          block := index
+          values := baselineParameters
+          credits := #[] }
+        baselineStack }
+  let rewrittenMachine : Machine :=
+    { store := rewrittenStore
+      heapFuel := rewrittenFuel
+      control := .running
+        { definition := rewrite.definition
+          block := index
+          values := rewrittenParameters
+          credits := #[] }
+        rewrittenStack }
+  have baselineExecution : Steps baselineContext .physical
+      (2 * site.shape.fieldCount + 3) baselineMachine
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := baselineCallValues }
+          baselineStack } := by
+    simpa [baselineMachine, baselineAllocation] using
+      baselineAcceptedControl site
+        (context := baselineContext) (interpretation := .physical)
+        (definition := source) (blockId := index)
+        (parameters := baselineParameters) (fields := baselineFields)
+        (newFields := baselineNewFields) (callValues := baselineCallValues)
+        (location := baselineLocation) (machine := baselineMachine)
+        (retainedStore := baselineRetained)
+        (releasedStore := baselineReleased) (remaining := remaining)
+        (allocationSchema := allocationSchema) (stack := baselineStack)
+        sourceAt (by rfl) parameterCount fieldCount baselineSourceResolved
+        baselineAt rfl retained released allocationSchemaAt
+        baselineAllocationResolved baselineFieldWorlds tailResolved arity
+        sourceNonempty
+  obtain ⟨physicalCallValues, rewrittenExecution, callsRelated⟩ :=
+    hotPhysicalAcceptedControlTranslated site
+      (context := rewrittenContext) (definition := rewrite.definition)
+      (resetId := index) (hotId := source.blocks.size + helperOffset)
+      (coldId := source.blocks.size + helperOffset + 1)
+      (parameters := rewrittenParameters) (fields := rewrittenFields)
+      (newFields := rewrittenNewFields)
+      (baselineTailValues :=
+        (baselinePrefixValues baselineParameters baselineFields).push
+          (.loc baselineAllocation.2))
+      (baselineCallValues := baselineCallValues)
+      (location := rewrittenLocation)
+      (box := ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+      (sourceSchema := sourceSchema) (allocationSchema := allocationSchema)
+      (machine := rewrittenMachine) (stack := rewrittenStack)
+      (store := physical) (locRel := outputRel) resetAt hotAt
+      rewrittenSourceSchemaAt rewrittenAllocationSchemaAt sourceLayout
+      allocationLayout (by rfl) rewrittenParameterCount rewrittenFieldCount
+      rewrittenSourceResolved
+      (ConstructorView.of_box rewrittenAt rfl rfl) rfl
+      rewrittenAllocationResolved
+      (by simpa [physicalHotResetStore] using rewrittenFieldWorlds)
+      (by simpa [physicalHotReuseStore, physicalHotResetStore] using reused)
+      translatedAfterAllocation
+      (by simpa [baselineAllocation] using tailResolved) rewrittenArity
+      rewrittenNonempty
+  have outputStack : StableStackIso limits validation outputRel
+      baselineStack rewrittenStack :=
+    stack.transportRelation stackAvoids stackCreditsAvoids (by
+      intro baselineCandidate rewrittenCandidate related different
+      exact outputExtends related different)
+  have outputFuel : remaining ≤ rewrittenFuel :=
+    Nat.le_trans (releaseShared_remaining_le released) fuel
+  have relatedMachine : StableMachineRel limits validation
+      { store := baselineAllocation.1
+        heapFuel := remaining
+        control := .running
+          { definition := source, values := baselineCallValues }
+          baselineStack }
+      { store := physical
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition, values := physicalCallValues }
+          rewrittenStack } :=
+    StableMachineRel.isomorphicRecursiveCall rewrite outputIso outputFuel
+      callsRelated outputStack
+  exact ⟨physical, outputIso, physicalCallValues, reused, physicalOwned,
+    by simpa [baselineAllocation] using baselineAllocationOwned,
+    by simpa [baselineAllocation] using outputResult,
+    outputExtends,
+    by simpa [baselineMachine, baselineAllocation] using baselineExecution,
+    by simpa [rewrittenMachine] using rewrittenExecution,
+    callsRelated, outputStack, relatedMachine⟩
+
+/-! ## Allocation-history unchanged execution -/
+
+/-- An unchanged `move` is equivariant under an arbitrary allocation-history
+isomorphism.  Unlike the exact-content theorem below, the target register may
+contain a numerically different but related location. -/
+theorem unchangedMoveStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] = .move atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          baselineStack }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push rewrittenValue }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .move atom := by
+    simpa only [← frame.pc] using instruction
+  refine ⟨rewrittenValue,
+    Step.move rfl sourceAt pc instruction resolved,
+    Step.move rfl targetAt targetPc targetInstruction targetResolved, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (.rewritten rewrite (frame.advancePush valueRelated)) stack)
+
+/-- Constructor projection follows corresponding locations and fields through
+an allocation-history isomorphism. -/
+theorem unchangedFetchStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId} {field : Nat}
+    {baselineLocation : Nat} {baselineBox : IxIR1.NodeBox}
+    {baselineFields : Array RVal} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .fetch atom cid field)
+    (resolved : resolveAtom baselineFrame.values atom =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (node : baselineBox.node = .ctorN cid baselineFields)
+    (fieldAt : baselineFields[field]? = some baselineValue) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          baselineStack }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push rewrittenValue }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact boxAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← node] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      obtain ⟨rewrittenValue, rewrittenFieldAt, valueRelated⟩ :=
+        rvalsIso_array_getElem? fieldsRelated fieldAt
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .fetch atom cid field := by
+        simpa only [← frame.pc] using instruction
+      refine ⟨rewrittenValue,
+        Step.fetch rfl sourceAt pc instruction resolved boxAt node fieldAt,
+        Step.fetch rfl targetAt targetPc targetInstruction targetResolved
+          ?_ rewrittenNode rewrittenFieldAt, ?_⟩
+      · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+        exact rewrittenAt
+      · exact StableMachineRel.history heap fuel
+          (.running
+            (.rewritten rewrite (frame.advancePush valueRelated)) stack)
+
+/-- Shallow unique reclamation kills corresponding live locations while
+retaining their pair as a dead/dead history row.  This is the first unchanged
+case that cannot be expressed compositionally with a live-only `HeapIso`. -/
+theorem unchangedFreeUniqueStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId}
+    {baselineLocation : Nat} {baselineBox : IxIR1.NodeBox}
+    {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .freeUnique atom cid)
+    (resolved : resolveAtom baselineFrame.values atom =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (unique : baselineBox.world = .unique)
+    (node : baselineBox.node = .ctorN cid baselineFields)
+    (scalarFields : baselineFields.all RVal.isScalar = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        store := baselineStore.kill baselineLocation
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenLocation,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          store := rewrittenStore.kill rewrittenLocation
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact boxAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← node] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have fieldsEq : baselineFields = rewrittenFields := by
+        apply Array.toList_inj.mp
+        apply fieldsRelated.eq_of_allScalar
+        rw [Array.all_toList]
+        exact scalarFields
+      have rewrittenScalar : rewrittenFields.all RVal.isScalar = true := by
+        rw [← fieldsEq]
+        exact scalarFields
+      have rewrittenUnique : rewrittenBox.world = .unique :=
+        boxes.world.symm.trans unique
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .freeUnique atom cid := by
+        simpa only [← frame.pc] using instruction
+      let outputHeap : IxIR1.Sim.HeapHistoryIso
+          (baselineStore.kill baselineLocation).heap
+          (rewrittenStore.kill rewrittenLocation).heap :=
+        heap.kill locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact boxAt) rewrittenAt
+      refine ⟨rewrittenLocation,
+        Step.freeUnique rfl sourceAt pc instruction resolved boxAt unique node
+          scalarFields,
+        Step.freeUnique rfl targetAt targetPc targetInstruction targetResolved
+          ?_ rewrittenUnique rewrittenNode rewrittenScalar, ?_⟩
+      · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+        exact rewrittenAt
+      · have outputFrame : StableFrameIso rewrite outputHeap.locRel
+            { baselineFrame with pc := baselineFrame.pc + 1 }
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 } := by
+          change StableFrameIso rewrite heap.locRel _ _
+          exact frame.advance
+        have outputStack : StableStackIso limits validation outputHeap.locRel
+            baselineStack rewrittenStack := by
+          change StableStackIso limits validation heap.locRel _ _
+          exact stack
+        exact StableMachineRel.history outputHeap fuel
+          (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Fresh constructor allocation extends the history with the two fresh
+locations and transports the schema check across related field vectors. -/
+theorem unchangedAllocStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema}
+    {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .alloc world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation :=
+      baselineStore.allocNode world (.ctorN cid baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenValues,
+      let rewrittenAllocation :=
+        rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .alloc world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  let baselineAllocation :=
+    baselineStore.allocNode world (.ctorN cid baselineValues)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap :=
+    heap.alloc (.ctor valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) := by
+    exact .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (frame.mono oldExtends).advancePush resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues,
+    by simpa [baselineAllocation] using
+      (Step.alloc (context := baselineContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction schemaAt resolved fieldWorlds),
+    by simpa [rewrittenAllocation] using
+      (Step.alloc (context := rewrittenContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetFieldWorlds), ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- An absent `allocWith` credit is consumed at corresponding frame slots;
+both executions then make related fresh allocations. -/
+theorem unchangedAllocWithAbsentStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (absent : credit.presence = .absent) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation :=
+      baselineStore.allocNode world (.ctorN cid baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ (rewrittenValues : Array RVal) (rewrittenTaken : Frame),
+      let rewrittenAllocation :=
+        rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨layoutRelated, targetAbsent⟩ :=
+    creditRelated.absent_parts absent
+  have targetLayout : rewrittenCredit.layout = schema.layout :=
+    layoutRelated.symm.trans layout
+  let baselineAllocation :=
+    baselineStore.allocNode world (.ctorN cid baselineValues)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap :=
+    heap.alloc (.ctor valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (takenFrame.mono oldExtends).push resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues, rewrittenTaken,
+    by simpa [baselineAllocation] using
+      (Step.allocWithAbsent (context := baselineContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+          absent),
+    by simpa [rewrittenAllocation] using
+      (Step.allocWithAbsent (context := rewrittenContext)
+        (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+          targetFieldWorlds targetTaken targetLayout targetAbsent), ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A logical `allocWith` credit is consumed at corresponding frame slots;
+both executions then make related fresh allocations. -/
+theorem unchangedAllocWithLogicalStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present none) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation :=
+      baselineStore.allocNode world (.ctorN cid baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ (rewrittenValues : Array RVal) (rewrittenTaken : Frame),
+      let rewrittenAllocation :=
+        rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨layoutRelated, targetPresent⟩ :=
+    creditRelated.logical_parts present
+  have targetLayout : rewrittenCredit.layout = schema.layout :=
+    layoutRelated.symm.trans layout
+  let baselineAllocation :=
+    baselineStore.allocNode world (.ctorN cid baselineValues)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap :=
+    heap.alloc (.ctor valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (takenFrame.mono oldExtends).push resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues, rewrittenTaken,
+    by simpa [baselineAllocation] using
+      (Step.allocWithLogical (context := baselineContext)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+          present),
+    by simpa [rewrittenAllocation] using
+      (Step.allocWithLogical (context := rewrittenContext)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+          targetFieldWorlds targetTaken targetLayout targetPresent), ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Physical `allocWith` consumes corresponding (possibly differently
+numbered) reservations and revives their history row with related nodes. -/
+theorem unchangedAllocWithPhysicalStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {baselineValues : Array RVal}
+    {baselineLocation : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (fieldWorlds : FieldWorlds baselineStore schema baselineValues)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present (some baselineLocation))
+    (reused : baselineStore.reuseReservation baselineLocation world
+      (.ctorN cid baselineValues) schema.fields.size = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineLocation) }
+          baselineStack }
+    ∃ (rewrittenValues : Array RVal) (rewrittenTaken : Frame)
+        (rewrittenLocation : Nat) (rewrittenOut : Store),
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push (.loc rewrittenLocation) }
+            rewrittenStack }
+      rewrittenStore.reuseReservation rewrittenLocation world
+          (.ctorN cid rewrittenValues) schema.fields.size = .ok rewrittenOut ∧
+        Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema rewrittenValues :=
+    fieldWorlds.transport (heapHistoryIso_fieldValuesWorldEq heap valuesRelated)
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨rewrittenLocation, layoutRelated, targetPresent, locations⟩ :=
+    creditRelated.physical_parts present
+  have targetLayout : rewrittenCredit.layout = schema.layout :=
+    layoutRelated.symm.trans layout
+  obtain ⟨rewrittenOut, outputHeap, targetReused, outputRelation⟩ :=
+    reuseReservation_historyIso heap locations (.ctor valuesRelated) reused
+  have outputFrame : StableFrameIso rewrite outputHeap.locRel
+      { baselineTaken with
+        values := baselineTaken.values.push (.loc baselineLocation) }
+      { rewrittenTaken with
+        values := rewrittenTaken.values.push (.loc rewrittenLocation) } := by
+    rw [outputRelation]
+    exact takenFrame.push (.loc locations)
+  have outputStack : StableStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValues, rewrittenTaken, rewrittenLocation, rewrittenOut,
+    targetReused,
+    Step.allocWithPhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+        present reused,
+    Step.allocWithPhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetFieldWorlds targetTaken targetLayout targetPresent targetReused,
+    ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Discarding related absent credits consumes corresponding frame slots and
+leaves the allocation history unchanged. -/
+theorem unchangedDiscardCreditAbsentStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (absent : credit.presence = .absent) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ rewrittenTaken : Frame,
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← frame.pc] using instruction
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨_, targetAbsent⟩ := creditRelated.absent_parts absent
+  refine ⟨rewrittenTaken,
+    Step.discardCreditAbsent
+      (context := baselineContext) (interpretation := interpretation)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken absent,
+    Step.discardCreditAbsent
+      (context := rewrittenContext) (interpretation := interpretation)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken targetAbsent, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Discarding related logical credits consumes corresponding frame slots and
+leaves the allocation history unchanged. -/
+theorem unchangedDiscardCreditLogicalStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (present : credit.presence = .present none) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ rewrittenTaken : Frame,
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← frame.pc] using instruction
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨_, targetPresent⟩ := creditRelated.logical_parts present
+  refine ⟨rewrittenTaken,
+    Step.discardCreditLogical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken present,
+    Step.discardCreditLogical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken targetPresent, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Discarding related physical credits releases corresponding reserved
+slots, which may have different concrete addresses. -/
+theorem unchangedDiscardCreditPhysicalStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {baselineLocation : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (present : credit.presence = .present (some baselineLocation))
+    (released : baselineStore.releaseReservation baselineLocation =
+      .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ (rewrittenTaken : Frame) (rewrittenLocation : Nat)
+        (rewrittenOut : Store),
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      rewrittenStore.releaseReservation rewrittenLocation = .ok rewrittenOut ∧
+        Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← frame.pc] using instruction
+  obtain ⟨rewrittenTaken, rewrittenCredit, targetTaken, creditRelated,
+      takenFrame⟩ := frame.advanceTakeIso taken
+  obtain ⟨rewrittenLocation, _, targetPresent, locations⟩ :=
+    creditRelated.physical_parts present
+  obtain ⟨rewrittenOut, outputHeap, targetReleased, outputRelation⟩ :=
+    releaseReservation_historyIso heap locations released
+  have outputFrame : StableFrameIso rewrite outputHeap.locRel
+      baselineTaken rewrittenTaken := by
+    rw [outputRelation]
+    exact takenFrame
+  have outputStack : StableStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenTaken, rewrittenLocation, rewrittenOut, targetReleased,
+    Step.discardCreditPhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken present released,
+    Step.discardCreditPhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken targetPresent
+        targetReleased, ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Logical unique extraction follows a related constructor, kills both
+locations, and appends related fields plus matching logical credits. -/
+theorem unchangedTakeUniqueLogicalStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .takeUnique target cid)
+    (schemaAt : baselineContext.schemas .unique cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .unique cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present none }
+    let baselineNext : Machine :=
+      { store := baselineStore.kill baselineLocation
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore.kill rewrittenLocation
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨baselineAt, baselineWorld, baselineNode⟩ := viewed.parts
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact baselineAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← baselineNode] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have rewrittenWorld : rewrittenBox.world = .unique :=
+        boxes.world.symm.trans baselineWorld
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetViewed : ConstructorView rewrittenStore rewrittenLocation
+          .unique cid rewrittenBox rewrittenFields := by
+        apply ConstructorView.of_box
+        · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt
+        · exact rewrittenWorld
+        · exact rewrittenNode
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .takeUnique target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .unique cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let outputHeap := heap.kill locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) rewrittenAt
+      have outputFrame : StableFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) } := by
+        change StableFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.logical schema.layout)
+      have outputStack : StableStackIso limits validation outputHeap.locRel
+          baselineStack rewrittenStack := by
+        change StableStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.takeUniqueLogical
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.takeUniqueLogical
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Physical unique extraction reserves corresponding constructor slots and
+records location-related physical credits. -/
+theorem unchangedTakeUniquePhysicalStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .takeUnique target cid)
+    (schemaAt : baselineContext.schemas .unique cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .unique cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineCredit : Credit :=
+      { layout := schema.layout,
+        presence := .present (some baselineLocation) }
+    let baselineNext : Machine :=
+      { store := baselineStore.reserve baselineLocation
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some baselineCredit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenCredit : Credit :=
+        { layout := schema.layout,
+          presence := .present (some rewrittenLocation) }
+      let rewrittenNext : Machine :=
+        { store := rewrittenStore.reserve rewrittenLocation
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some rewrittenCredit) }
+            rewrittenStack }
+      Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨baselineAt, baselineWorld, baselineNode⟩ := viewed.parts
+      obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some baselineBox
+          exact baselineAt)
+      have nodes : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid baselineFields) rewrittenBox.node := by
+        simpa only [← baselineNode] using boxes.node
+      obtain ⟨rewrittenFields, rewrittenNode, fieldsRelated⟩ :=
+        nodeIso_ctor_left nodes
+      have rewrittenWorld : rewrittenBox.world = .unique :=
+        boxes.world.symm.trans baselineWorld
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetViewed : ConstructorView rewrittenStore rewrittenLocation
+          .unique cid rewrittenBox rewrittenFields := by
+        apply ConstructorView.of_box
+        · change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt
+        · exact rewrittenWorld
+        · exact rewrittenNode
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .takeUnique target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .unique cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let outputHeap := reserve_historyIso heap locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) rewrittenAt
+      have outputFrame : StableFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some baselineLocation) }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some rewrittenLocation) }) } := by
+        change StableFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.physical locations)
+      have outputStack : StableStackIso limits validation outputHeap.locRel
+          baselineStack rewrittenStack := by
+        change StableStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.takeUniquePhysical
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.takeUniquePhysical
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A logical hot shared reset follows a related unit-refcount constructor,
+kills both locations, and records matching logical credits. -/
+theorem unchangedResetSharedLogicalHotStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .shared cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present none }
+    let baselineNext : Machine :=
+      { store := ((baselineStore.tickResetAttempt).kill
+          baselineLocation).tickHotReset
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenNext : Machine :=
+        { store := ((rewrittenStore.tickResetAttempt).kill
+            rewrittenLocation).tickHotReset
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      Step baselineContext .logical baselineMachine baselineNext ∧
+        Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt, targetViewed,
+          boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations viewed
+      obtain ⟨baselineAt, _, _⟩ := viewed.parts
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .resetShared target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .shared cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let killed := heap.kill locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) (by
+          change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt)
+      let outputHeap : IxIR1.Sim.HeapHistoryIso
+          (((baselineStore.tickResetAttempt).kill
+            baselineLocation).tickHotReset).heap
+          (((rewrittenStore.tickResetAttempt).kill
+            rewrittenLocation).tickHotReset).heap := by
+        simpa [Eval.Store.tickResetAttempt, Eval.Store.tickHotReset] using killed
+      have outputFrame : StableFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence := .present none }) } := by
+        change StableFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.logical schema.layout)
+      have outputStack : StableStackIso limits validation outputHeap.locRel
+          baselineStack rewrittenStack := by
+        change StableStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.resetSharedLogicalHot
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.resetSharedLogicalHot
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A physical hot shared reset reserves corresponding constructor slots and
+records location-related physical credits. -/
+theorem unchangedResetSharedPhysicalHotStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .shared cid
+      baselineBox baselineFields)
+    (unitRC : baselineBox.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineCredit : Credit :=
+      { layout := schema.layout,
+        presence := .present (some baselineLocation) }
+    let baselineNext : Machine :=
+      { store := ((baselineStore.tickResetAttempt).reserve
+          baselineLocation).tickHotReset
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some baselineCredit) }
+          baselineStack }
+    ∃ (rewrittenLocation : Nat) (rewrittenFields : Array RVal),
+      let rewrittenCredit : Credit :=
+        { layout := schema.layout,
+          presence := .present (some rewrittenLocation) }
+      let rewrittenNext : Machine :=
+        { store := ((rewrittenStore.tickResetAttempt).reserve
+            rewrittenLocation).tickHotReset
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some rewrittenCredit) }
+            rewrittenStack }
+      Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt, targetViewed,
+          boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations viewed
+      obtain ⟨baselineAt, _, _⟩ := viewed.parts
+      have rewrittenRc : rewrittenBox.rc = 1 :=
+        boxes.rc.symm.trans unitRC
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .resetShared target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .shared cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let reserved := reserve_historyIso
+        (left := baselineStore.tickResetAttempt)
+        (right := rewrittenStore.tickResetAttempt) heap locations (by
+          simpa [Eval.Store.tickResetAttempt, Eval.Store.get?] using
+            baselineAt) (by
+          simpa [Eval.Store.tickResetAttempt, Eval.Store.get?] using
+            rewrittenAt)
+      let outputHeap : IxIR1.Sim.HeapHistoryIso
+          (((baselineStore.tickResetAttempt).reserve
+            baselineLocation).tickHotReset).heap
+          (((rewrittenStore.tickResetAttempt).reserve
+            rewrittenLocation).tickHotReset).heap := by
+        simpa [Eval.Store.tickHotReset] using reserved
+      have outputFrame : StableFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some baselineLocation) }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence :=
+                .present (some rewrittenLocation) }) } := by
+        change StableFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.physical locations)
+      have outputStack : StableStackIso limits validation outputHeap.locRel
+          baselineStack rewrittenStack := by
+        change StableStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenLocation, rewrittenFields,
+        Step.resetSharedPhysicalHot
+          (context := baselineContext)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+        Step.resetSharedPhysicalHot
+          (context := rewrittenContext)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenRc, ?_⟩
+      exact StableMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A cold shared reset transports the parent decrement and field-retain loop
+through allocation history, then appends related fields and absent credits. -/
+theorem unchangedResetSharedColdStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {baselineLocation : Nat}
+    {baselineBox : IxIR1.NodeBox} {baselineFields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target =
+      .ok (.loc baselineLocation))
+    (viewed : ConstructorView baselineStore baselineLocation .shared cid
+      baselineBox baselineFields)
+    (shared : 1 < baselineBox.rc)
+    (retained : RetainSharedMany
+      ((((baselineStore.tickResetAttempt).setBox baselineLocation
+        { baselineBox with rc := baselineBox.rc - 1 }).rcTick).tickColdReset)
+      baselineFields baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .absent }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ (rewrittenFields : Array RVal) (rewrittenOut : Store),
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ rewrittenFields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenResolved, targetResolved, resolvedRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases resolvedRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt, targetViewed,
+          boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations viewed
+      obtain ⟨baselineAt, _, _⟩ := viewed.parts
+      have rewrittenShared : 1 < rewrittenBox.rc := by
+        rw [← boxes.rc]
+        exact shared
+      have targetPc : rewrittenFrame.pc < block.instructions.size := by
+        rw [← frame.pc]
+        exact pc
+      have targetInstruction : block.instructions[rewrittenFrame.pc] =
+          .resetShared target cid := by
+        simpa only [← frame.pc] using instruction
+      have targetSchemaAt : rewrittenContext.schemas .shared cid =
+          some schema := by
+        rw [← schemas]
+        exact schemaAt
+      let updated := heap.setBox locations (by
+        change baselineStore.heap.get? baselineLocation = some baselineBox
+        exact baselineAt) (by
+          change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          exact rewrittenAt)
+        (show IxIR1.Sim.NodeBoxIso heap.locRel
+            { baselineBox with rc := baselineBox.rc - 1 }
+            { rewrittenBox with rc := rewrittenBox.rc - 1 } from
+          ⟨boxes.world, congrArg (fun rc => rc - 1) boxes.rc, boxes.node⟩)
+      let beforeHistory : IxIR1.Sim.HeapHistoryIso
+          ((((baselineStore.tickResetAttempt).setBox baselineLocation
+            { baselineBox with rc := baselineBox.rc - 1 }).rcTick).tickColdReset).heap
+          ((((rewrittenStore.tickResetAttempt).setBox rewrittenLocation
+            { rewrittenBox with rc := rewrittenBox.rc - 1 }).rcTick).tickColdReset).heap := by
+        simpa [Eval.Store.tickResetAttempt, Eval.Store.tickColdReset] using
+          updated.rcTick
+      have retainedFields : IxIR1.Sim.RValsIso beforeHistory.locRel
+          baselineFields.toList rewrittenFields.toList := by
+        change IxIR1.Sim.RValsIso heap.locRel _ _
+        exact fieldsRelated
+      obtain ⟨rewrittenOut, outputHeap, targetRetained, outputRelation⟩ :=
+        retainSharedMany_historyIso beforeHistory retainedFields retained
+      have outputFrame : StableFrameIso rewrite outputHeap.locRel
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ baselineFields
+            credits := baselineFrame.credits.push
+              (some { layout := schema.layout, presence := .absent }) }
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ rewrittenFields
+            credits := rewrittenFrame.credits.push
+              (some { layout := schema.layout, presence := .absent }) } := by
+        rw [outputRelation]
+        change StableFrameIso rewrite heap.locRel _ _
+        exact frame.advanceAppendCreditIso fieldsRelated
+          (.absent schema.layout)
+      have outputStack : StableStackIso limits validation outputHeap.locRel
+          baselineStack rewrittenStack := by
+        rw [outputRelation]
+        change StableStackIso limits validation beforeHistory.locRel _ _
+        change StableStackIso limits validation heap.locRel _ _
+        exact stack
+      refine ⟨rewrittenFields, rewrittenOut,
+        Step.resetSharedCold
+          (context := baselineContext) (interpretation := interpretation)
+          (machine :=
+            { store := baselineStore
+              heapFuel := baselineFuel
+              control := .running baselineFrame baselineStack })
+          rfl sourceAt pc instruction schemaAt resolved viewed shared retained,
+        Step.resetSharedCold
+          (context := rewrittenContext) (interpretation := interpretation)
+          (machine :=
+            { store := rewrittenStore
+              heapFuel := rewrittenFuel
+              control := .running rewrittenFrame rewrittenStack })
+          rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+            targetViewed rewrittenShared targetRetained, ?_⟩
+      exact StableMachineRel.history outputHeap fuel
+        (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Shared retain updates corresponding refcounts and appends the related
+resolved values to the two frames. -/
+theorem unchangedRetainSharedStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .retainShared atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (retained : retainShared baselineStore baselineValue = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push baselineValue }
+          baselineStack }
+    ∃ rewrittenValue rewrittenOut,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push rewrittenValue }
+            rewrittenStack }
+      retainShared rewrittenStore rewrittenValue = .ok rewrittenOut ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  obtain ⟨rewrittenOut, outputHeap, targetRetained, outputRelation⟩ :=
+    retainShared_historyIso heap valueRelated retained
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .retainShared atom := by
+    simpa only [← frame.pc] using instruction
+  have outputFrame : StableFrameIso rewrite outputHeap.locRel
+      { baselineFrame with
+        pc := baselineFrame.pc + 1
+        values := baselineFrame.values.push baselineValue }
+      { rewrittenFrame with
+        pc := rewrittenFrame.pc + 1
+        values := rewrittenFrame.values.push rewrittenValue } := by
+    rw [outputRelation]
+    exact frame.advancePush valueRelated
+  have outputStack : StableStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValue, rewrittenOut, targetRetained,
+    Step.retainShared rfl sourceAt pc instruction resolved retained,
+    Step.retainShared rfl targetAt targetPc targetInstruction targetResolved
+      targetRetained, ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Deep shared release follows related child graphs, retains reclaimed pairs
+as history rows, and preserves the rewritten machine's fuel advantage. -/
+theorem unchangedReleaseSharedStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .releaseShared atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (released : releaseShared baselineFuel baselineStore baselineValue =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenValue rewrittenOut rewrittenRemaining,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      releaseShared rewrittenFuel rewrittenStore rewrittenValue =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  obtain ⟨rewrittenOut, rewrittenRemaining, outputHeap, targetReleased,
+      outputFuel, outputRelation⟩ :=
+    releaseSharedWork_historyIso heap fuel
+      (.cons valueRelated .nil) (by
+        unfold releaseShared at released
+        exact released)
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .releaseShared atom := by
+    simpa only [← frame.pc] using instruction
+  have outputFrame : StableFrameIso rewrite outputHeap.locRel
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } := by
+    rw [outputRelation]
+    exact frame.advance
+  have outputStack : StableStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+    by simpa [releaseShared] using targetReleased,
+    Step.releaseShared rfl sourceAt pc instruction resolved released,
+    Step.releaseShared rfl targetAt targetPc targetInstruction targetResolved
+      (by simpa [releaseShared] using targetReleased), ?_⟩
+  exact StableMachineRel.history outputHeap outputFuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- Deep unique destruction follows corresponding constructor trees and
+preserves the rewritten traversal-fuel advantage. -/
+theorem unchangedDropUniqueStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .dropUnique atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (dropped : dropUnique baselineFuel baselineStore baselineValue =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenValue rewrittenOut rewrittenRemaining,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      dropUnique rewrittenFuel rewrittenStore rewrittenValue =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  obtain ⟨rewrittenOut, rewrittenRemaining, outputHeap, targetDropped,
+      outputFuel, outputRelation⟩ :=
+    dropUniqueWork_historyIso heap fuel (.cons valueRelated .nil) (by
+      unfold dropUnique at dropped
+      exact dropped)
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .dropUnique atom := by
+    simpa only [← frame.pc] using instruction
+  have outputFrame : StableFrameIso rewrite outputHeap.locRel
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } := by
+    rw [outputRelation]
+    exact frame.advance
+  have outputStack : StableStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+    by simpa [dropUnique] using targetDropped,
+    Step.dropUnique rfl sourceAt pc instruction resolved dropped,
+    Step.dropUnique rfl targetAt targetPc targetInstruction targetResolved
+      (by simpa [dropUnique] using targetDropped), ?_⟩
+  exact StableMachineRel.history outputHeap outputFuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A recursive call resolves related argument vectors, enters the two
+versions of the current function, and suspends related callers. -/
+theorem unchangedCallSelfStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {arguments : Array Atom}
+    {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .callSelf arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (arity : baselineValues.size =
+      baselineFrame.definition.signature.params.size)
+    (nonempty : baselineFrame.definition.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := baselineFrame.definition, values := baselineValues }
+          (.resume { baselineFrame with pc := baselineFrame.pc + 1 } ::
+            baselineStack) }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := rewrittenFrame.definition,
+              values := rewrittenValues }
+            (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 } ::
+              rewrittenStack) }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .callSelf arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using rvalsIso_length_eq valuesRelated
+  have sourceArity : baselineValues.size = source.signature.params.size := by
+    simpa [frame.baselineDefinition] using arity
+  have targetArity : rewrittenValues.size =
+      rewrittenFrame.definition.signature.params.size := by
+    rw [← sizeEq, frame.rewrittenDefinition, rewrite.definition_signature]
+    exact sourceArity
+  have targetNonempty : rewrittenFrame.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem targetAt
+  refine ⟨rewrittenValues,
+    Step.callSelfCleared rfl sourceAt pc instruction noCredits resolved arity
+      nonempty,
+    Step.callSelfCleared rfl targetAt targetPc targetInstruction
+      targetNoCredits targetResolved targetArity targetNonempty, ?_⟩
+  have callee : StableFrameRel limits validation heap.locRel
+      { definition := baselineFrame.definition, values := baselineValues }
+      { definition := rewrittenFrame.definition, values := rewrittenValues } := by
+    rw [frame.baselineDefinition, frame.rewrittenDefinition]
+    exact StableFrameRel.entry rewrite valuesRelated
+  have resume : StableContinuationIso limits validation heap.locRel
+      (.resume { baselineFrame with pc := baselineFrame.pc + 1 })
+      (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 }) :=
+    .resume (.rewritten rewrite frame.advance)
+  exact StableMachineRel.history heap fuel
+    (.running callee (.cons resume stack))
+
+/-- A direct call follows the declaration rewrite selected at the same
+address and enters related callee argument vectors. -/
+theorem unchangedCallFnStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso callerRewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .call address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (arity : baselineValues.size = calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := calleeSource, values := baselineValues }
+          (.resume { baselineFrame with pc := baselineFrame.pc + 1 } ::
+            baselineStack) }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := calleeRewrite.definition,
+              values := rewrittenValues }
+            (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 } ::
+              rewrittenStack) }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .call address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using rvalsIso_length_eq valuesRelated
+  have targetArity : rewrittenValues.size =
+      calleeRewrite.definition.signature.params.size := by
+    rw [← sizeEq, calleeRewrite.definition_signature]
+    exact arity
+  have targetNonempty : calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  refine ⟨rewrittenValues,
+    Step.callFnCleared rfl sourceAt pc instruction noCredits resolved
+      baselineDeclaration arity nonempty,
+    Step.callFnCleared rfl targetAt targetPc targetInstruction
+      targetNoCredits targetResolved rewrittenDeclaration targetArity
+      targetNonempty, ?_⟩
+  have callee : StableFrameRel limits validation heap.locRel
+      { definition := calleeSource, values := baselineValues }
+      { definition := calleeRewrite.definition, values := rewrittenValues } :=
+    StableFrameRel.entry calleeRewrite valuesRelated
+  have resume : StableContinuationIso limits validation heap.locRel
+      (.resume { baselineFrame with pc := baselineFrame.pc + 1 })
+      (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 }) :=
+    .resume (.rewritten callerRewrite frame.advance)
+  exact StableMachineRel.history heap fuel
+    (.running callee (.cons resume stack))
+
+/-- Partial application of a function resolves related captures and extends
+the allocation history with related PAP nodes. -/
+theorem unchangedPappFnStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso callerRewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .papp address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (papSafe : calleeSource.signature.papSafe = true)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (under : baselineValues.size < calleeSource.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode .shared
+      (.papN address calleeSource.signature.params.size baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenValues : Array RVal,
+      let rewrittenAllocation := rewrittenStore.allocNode .shared
+        (.papN address calleeSource.signature.params.size rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .papp address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have targetPapSafe : calleeRewrite.definition.signature.papSafe = true := by
+    simpa using papSafe
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using rvalsIso_length_eq valuesRelated
+  have targetUnder :
+      rewrittenValues.size < calleeRewrite.definition.signature.params.size := by
+    rw [← sizeEq, calleeRewrite.definition_signature]
+    exact under
+  let baselineAllocation := baselineStore.allocNode .shared
+    (.papN address calleeSource.signature.params.size baselineValues)
+  let rewrittenAllocation := rewrittenStore.allocNode .shared
+    (.papN address calleeSource.signature.params.size rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap := heap.alloc (.pap valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (frame.mono oldExtends).advancePush resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues,
+    by simpa [baselineAllocation] using
+      (Step.pappFnCleared
+        (context := baselineContext) (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction noCredits baselineDeclaration papSafe
+          resolved under),
+    by simpa [rewrittenAllocation, calleeRewrite.definition_signature] using
+      (Step.pappFnCleared
+        (context := rewrittenContext) (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetNoCredits
+          rewrittenDeclaration targetPapSafe targetResolved targetUnder), ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten callerRewrite outputFrame) outputStack)
+
+/-- Partial application of an extern resolves related captures and extends
+the allocation history with related PAP nodes. -/
+theorem unchangedPappExternStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal} {arity : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .papp address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern arity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern arity))
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (under : baselineValues.size < arity) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode .shared
+      (.papN address arity baselineValues)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenValues : Array RVal,
+      let rewrittenAllocation := rewrittenStore.allocNode .shared
+        (.papN address arity rewrittenValues)
+      let rewrittenNext : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .papp address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using rvalsIso_length_eq valuesRelated
+  have targetUnder : rewrittenValues.size < arity := by
+    rw [← sizeEq]
+    exact under
+  let baselineAllocation := baselineStore.allocNode .shared
+    (.papN address arity baselineValues)
+  let rewrittenAllocation := rewrittenStore.allocNode .shared
+    (.papN address arity rewrittenValues)
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap := heap.alloc (.pap valuesRelated)
+  have oldExtends : ∀ {baselineLocation rewrittenLocation},
+      heap.locRel baselineLocation rewrittenLocation →
+      outputHeap.locRel baselineLocation rewrittenLocation := by
+    intro baselineLocation rewrittenLocation related
+    exact .inr related
+  have resultRelated : IxIR1.Sim.RValIso outputHeap.locRel
+      (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+    .loc (.inl ⟨rfl, rfl⟩)
+  have outputFrame := (frame.mono oldExtends).advancePush resultRelated
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenValues,
+    by simpa [baselineAllocation] using
+      (Step.pappExternCleared
+        (context := baselineContext) (interpretation := interpretation)
+        (machine :=
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack })
+        rfl sourceAt pc instruction noCredits baselineDeclaration resolved
+          under),
+    by simpa [rewrittenAllocation] using
+      (Step.pappExternCleared
+        (context := rewrittenContext) (interpretation := interpretation)
+        (machine :=
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack })
+        rfl targetAt targetPc targetInstruction targetNoCredits
+          rewrittenDeclaration targetResolved targetUnder), ?_⟩
+  exact StableMachineRel.history outputHeap fuel
+    (.running (.rewritten rewrite outputFrame) outputStack)
+
+/-- A successful extern call forces related arguments to be literally equal
+scalars, so the shared oracle returns the same scalar result on both sides. -/
+theorem unchangedExternStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (oracles : baselineContext.oracle = rewrittenContext.oracle)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    {arity : Nat} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .extern address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern arity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern arity))
+    (argumentArity : baselineValues.size = arity)
+    (called : ScalarOracleCall baselineContext address baselineValues value) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push value }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push value }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  obtain ⟨argumentsScalar, valueScalar⟩ := called.scalar
+  have listEq : baselineValues.toList = rewrittenValues.toList := by
+    apply valuesRelated.eq_of_allScalar
+    rw [Array.all_toList]
+    exact argumentsScalar
+  have valuesEq : baselineValues = rewrittenValues :=
+    Array.toList_inj.mp listEq
+  subst rewrittenValues
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .extern address arguments := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have targetCalled :
+      ScalarOracleCall rewrittenContext address baselineValues value :=
+    called.congrOracle oracles
+  refine ⟨
+    Step.externCleared rfl sourceAt pc instruction noCredits resolved
+      baselineDeclaration argumentArity called,
+    Step.externCleared rfl targetAt targetPc targetInstruction targetNoCredits
+      targetResolved rewrittenDeclaration argumentArity targetCalled, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running
+      (.rewritten rewrite
+        (frame.advancePush
+          (IxIR1.Sim.RValIso.refl_of_scalar valueScalar)))
+      stack)
+
+/-! ## Allocation-history dynamic application -/
+
+/-- Erased dynamic application releases corresponding argument vectors and
+resumes related callers with the common erased value. -/
+theorem unchangedApplyTransferErasedIso {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (released : releaseSharedWork baselineFuel baselineStore
+      baselineArguments.toList = .ok (baselineOut, baselineRemaining)) :
+    let baselineTarget : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push .erased }
+          baselineStack }
+    ∃ rewrittenOut rewrittenRemaining,
+      let rewrittenTarget : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push .erased }
+            rewrittenStack }
+      releaseSharedWork rewrittenFuel rewrittenStore
+          rewrittenArguments.toList = .ok (rewrittenOut, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel .erased baselineArguments baselineResume baselineStack
+          baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel .erased rewrittenArguments rewrittenResume
+          rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenOut, rewrittenRemaining, outputHeap, targetReleased,
+      outputFuel, outputRelation⟩ :=
+    releaseSharedWork_historyIso heap fuel arguments released
+  have outputResume : StableFrameRel limits validation outputHeap.locRel
+      { baselineResume with values := baselineResume.values.push .erased }
+      { rewrittenResume with values := rewrittenResume.values.push .erased } := by
+    rw [outputRelation]
+    exact resume.push .erased
+  have outputStack : StableStackIso limits validation outputHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [outputRelation]
+    exact stack
+  refine ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+    ApplyTransfer.erased released, ApplyTransfer.erased targetReleased, ?_⟩
+  exact StableMachineRel.history outputHeap outputFuel
+    (.running outputResume outputStack)
+
+/-- Under-saturated PAP application follows a related PAP, performs
+corresponding retain/release work, and allocates related extended PAPs. -/
+theorem unchangedApplyTransferPapUnderIso {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineLocation rewrittenLocation : Nat}
+    {baselineBox : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {baselineCaptured baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (locations : heap.locRel baselineLocation rewrittenLocation)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (shared : baselineBox.world = .shared)
+    (node : baselineBox.node = .papN address arity baselineCaptured)
+    (capturedUnder : baselineCaptured.size < arity)
+    (retained : RetainSharedMany baselineStore baselineCaptured
+      baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc baselineLocation] = .ok (baselineReleased, baselineRemaining))
+    (totalUnder : (baselineCaptured ++ baselineArguments).size < arity) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.papN address arity (baselineCaptured ++ baselineArguments))
+    let baselineTarget : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ (rewrittenCaptured : Array RVal)
+        (rewrittenRetained rewrittenReleased : Store)
+        (rewrittenRemaining : Nat),
+      let rewrittenAllocation := rewrittenReleased.allocNode .shared
+        (.papN address arity (rewrittenCaptured ++ rewrittenArguments))
+      let rewrittenTarget : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore rewrittenCaptured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained
+            [.loc rewrittenLocation] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc baselineLocation) baselineArguments baselineResume
+          baselineStack baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc rewrittenLocation) rewrittenArguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations (by
+    change baselineStore.heap.get? baselineLocation = some baselineBox
+    exact boxAt)
+  have papNodes : IxIR1.Sim.NodeIso heap.locRel
+      (.papN address arity baselineCaptured) rewrittenBox.node := by
+    simpa only [← node] using boxes.node
+  obtain ⟨rewrittenCaptured, rewrittenNode, capturedRelated⟩ :=
+    nodeIso_pap_left papNodes
+  have rewrittenShared : rewrittenBox.world = .shared :=
+    boxes.world.symm.trans shared
+  have rewrittenCapturedUnder : rewrittenCaptured.size < arity := by
+    have sizes : baselineCaptured.size = rewrittenCaptured.size := by
+      simpa using rvalsIso_length_eq capturedRelated
+    rw [← sizes]
+    exact capturedUnder
+  have totalRelated : IxIR1.Sim.RValsIso heap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    simpa using capturedRelated.append arguments
+  have rewrittenTotalUnder :
+      (rewrittenCaptured ++ rewrittenArguments).size < arity := by
+    have sizes : (baselineCaptured ++ baselineArguments).size =
+        (rewrittenCaptured ++ rewrittenArguments).size := by
+      simpa using rvalsIso_length_eq totalRelated
+    rw [← sizes]
+    exact totalUnder
+  obtain ⟨rewrittenRetained, retainedHeap, targetRetained,
+      retainedRelation⟩ :=
+    retainSharedMany_historyIso heap capturedRelated retained
+  have retainedLocation : retainedHeap.locRel baselineLocation
+      rewrittenLocation := by
+    rw [retainedRelation]
+    exact locations
+  obtain ⟨rewrittenReleased, rewrittenRemaining, releasedHeap,
+      targetReleased, outputFuel, releasedRelation⟩ :=
+    releaseSharedWork_historyIso retainedHeap fuel
+      (.cons (.loc retainedLocation) .nil) released
+  have totalReleased : IxIR1.Sim.RValsIso releasedHeap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    rw [releasedRelation, retainedRelation]
+    exact totalRelated
+  let baselineAllocation := baselineReleased.allocNode .shared
+    (.papN address arity (baselineCaptured ++ baselineArguments))
+  let rewrittenAllocation := rewrittenReleased.allocNode .shared
+    (.papN address arity (rewrittenCaptured ++ rewrittenArguments))
+  let outputHeap : IxIR1.Sim.HeapHistoryIso baselineAllocation.1.heap
+      rewrittenAllocation.1.heap := releasedHeap.alloc (.pap totalReleased)
+  have oldExtends : ∀ {leftLocation rightLocation},
+      heap.locRel leftLocation rightLocation →
+      outputHeap.locRel leftLocation rightLocation := by
+    intro leftLocation rightLocation related
+    apply Or.inr
+    rw [releasedRelation, retainedRelation]
+    exact related
+  have outputResume := (resume.mono oldExtends).push
+    (IxIR1.Sim.RValIso.loc (Or.inl ⟨rfl, rfl⟩))
+  have outputStack := stack.mono oldExtends
+  refine ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+    rewrittenRemaining,
+    targetRetained, targetReleased,
+    ApplyTransfer.papUnder boxAt shared node capturedUnder retained released
+      totalUnder,
+    ApplyTransfer.papUnder (by
+      change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+      exact rewrittenAt) rewrittenShared rewrittenNode rewrittenCapturedUnder
+      targetRetained targetReleased rewrittenTotalUnder, ?_⟩
+  exact StableMachineRel.history outputHeap outputFuel
+    (.running outputResume outputStack)
+
+/-- Saturated or over-saturated application follows a related PAP, performs
+corresponding ownership traffic, and enters related callee rewrites with
+related supplied and excess argument slices. -/
+theorem unchangedApplyTransferPapFnIso {limits : Validate.Limits}
+    {validation : Validate.Context} {calleeSource : Function}
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineLocation rewrittenLocation : Nat}
+    {baselineBox : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {baselineCaptured baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (locations : heap.locRel baselineLocation rewrittenLocation)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (shared : baselineBox.world = .shared)
+    (node : baselineBox.node = .papN address arity baselineCaptured)
+    (capturedUnder : baselineCaptured.size < arity)
+    (retained : RetainSharedMany baselineStore baselineCaptured
+      baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc baselineLocation] = .ok (baselineReleased, baselineRemaining))
+    (totalEnough : arity ≤ (baselineCaptured ++ baselineArguments).size)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (papSafe : calleeSource.signature.papSafe = true)
+    (suppliedArity :
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+        calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineTotal := baselineCaptured ++ baselineArguments
+    let baselineSupplied := baselineTotal.extract 0 arity
+    let baselineExcess := baselineTotal.extract arity baselineTotal.size
+    let baselineContinuation : Continuation :=
+      if baselineExcess.isEmpty then .resume baselineResume
+      else .applyMore baselineExcess baselineResume
+    let baselineTarget : Machine :=
+      { store := baselineReleased
+        heapFuel := baselineRemaining
+        control := .running
+          { definition := calleeSource, values := baselineSupplied }
+          (baselineContinuation :: baselineStack) }
+    ∃ (rewrittenCaptured : Array RVal)
+        (rewrittenRetained rewrittenReleased : Store)
+        (rewrittenRemaining : Nat),
+      let rewrittenTotal := rewrittenCaptured ++ rewrittenArguments
+      let rewrittenSupplied := rewrittenTotal.extract 0 arity
+      let rewrittenExcess := rewrittenTotal.extract arity rewrittenTotal.size
+      let rewrittenContinuation : Continuation :=
+        if rewrittenExcess.isEmpty then .resume rewrittenResume
+        else .applyMore rewrittenExcess rewrittenResume
+      let rewrittenTarget : Machine :=
+        { store := rewrittenReleased
+          heapFuel := rewrittenRemaining
+          control := .running
+            { definition := calleeRewrite.definition,
+              values := rewrittenSupplied }
+            (rewrittenContinuation :: rewrittenStack) }
+      RetainSharedMany rewrittenStore rewrittenCaptured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained
+            [.loc rewrittenLocation] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc baselineLocation) baselineArguments baselineResume
+          baselineStack baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc rewrittenLocation) rewrittenArguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations (by
+    change baselineStore.heap.get? baselineLocation = some baselineBox
+    exact boxAt)
+  have papNodes : IxIR1.Sim.NodeIso heap.locRel
+      (.papN address arity baselineCaptured) rewrittenBox.node := by
+    simpa only [← node] using boxes.node
+  obtain ⟨rewrittenCaptured, rewrittenNode, capturedRelated⟩ :=
+    nodeIso_pap_left papNodes
+  have rewrittenShared : rewrittenBox.world = .shared :=
+    boxes.world.symm.trans shared
+  have rewrittenCapturedUnder : rewrittenCaptured.size < arity := by
+    have sizes : baselineCaptured.size = rewrittenCaptured.size := by
+      simpa using rvalsIso_length_eq capturedRelated
+    rw [← sizes]
+    exact capturedUnder
+  have totalRelated : IxIR1.Sim.RValsIso heap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    simpa using capturedRelated.append arguments
+  have totalSizes : (baselineCaptured ++ baselineArguments).size =
+      (rewrittenCaptured ++ rewrittenArguments).size := by
+    simpa using rvalsIso_length_eq totalRelated
+  have rewrittenTotalEnough :
+      arity ≤ (rewrittenCaptured ++ rewrittenArguments).size := by
+    rw [← totalSizes]
+    exact totalEnough
+  have suppliedRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList :=
+    rvalsIso_array_extract totalRelated 0 arity
+  have excessRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).toList := by
+    have extracted := rvalsIso_array_extract totalRelated arity
+      (baselineCaptured ++ baselineArguments).size
+    simpa [totalSizes] using extracted
+  have targetPapSafe :
+      calleeRewrite.definition.signature.papSafe = true := by
+    simpa using papSafe
+  have targetSuppliedArity :
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size =
+        calleeRewrite.definition.signature.params.size := by
+    have sizes :
+        ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+          ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size := by
+      simpa using rvalsIso_length_eq suppliedRelated
+    rw [← sizes, calleeRewrite.definition_signature]
+    exact suppliedArity
+  have targetNonempty :
+      calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  obtain ⟨rewrittenRetained, retainedHeap, targetRetained,
+      retainedRelation⟩ :=
+    retainSharedMany_historyIso heap capturedRelated retained
+  have retainedLocation : retainedHeap.locRel baselineLocation
+      rewrittenLocation := by
+    rw [retainedRelation]
+    exact locations
+  obtain ⟨rewrittenReleased, rewrittenRemaining, releasedHeap,
+      targetReleased, outputFuel, releasedRelation⟩ :=
+    releaseSharedWork_historyIso retainedHeap fuel
+      (.cons (.loc retainedLocation) .nil) released
+  have suppliedReleased : IxIR1.Sim.RValsIso releasedHeap.locRel
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList := by
+    rw [releasedRelation, retainedRelation]
+    exact suppliedRelated
+  have excessReleased : IxIR1.Sim.RValsIso releasedHeap.locRel
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).toList := by
+    rw [releasedRelation, retainedRelation]
+    exact excessRelated
+  have resumeReleased : StableFrameRel limits validation releasedHeap.locRel
+      baselineResume rewrittenResume := by
+    rw [releasedRelation, retainedRelation]
+    exact resume
+  have stackReleased : StableStackIso limits validation releasedHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [releasedRelation, retainedRelation]
+    exact stack
+  let continuation := StableContinuationIso.applyMoreOrResumeIso
+    excessReleased resumeReleased
+  refine ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+    rewrittenRemaining, targetRetained, targetReleased,
+    ApplyTransfer.papFn boxAt shared node capturedUnder retained released
+      totalEnough baselineDeclaration papSafe suppliedArity nonempty,
+    ApplyTransfer.papFn (by
+      change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+      exact rewrittenAt) rewrittenShared rewrittenNode rewrittenCapturedUnder
+      targetRetained targetReleased rewrittenTotalEnough rewrittenDeclaration
+      targetPapSafe targetSuppliedArity targetNonempty, ?_⟩
+  exact StableMachineRel.history releasedHeap outputFuel
+    (.running (StableFrameRel.entry calleeRewrite suppliedReleased)
+      (.cons continuation stackReleased))
+
+/-- Exactly saturated application of a related PAP to an extern transports
+the ownership work, proves the supplied slices are the same scalars, and
+resumes related callers with the common scalar result. -/
+theorem unchangedApplyTransferPapExternIso {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineLocation rewrittenLocation : Nat}
+    {baselineBox : IxIR1.NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity expectedArity : Nat}
+    {baselineCaptured baselineArguments rewrittenArguments : Array RVal}
+    {value : RVal} {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (locations : heap.locRel baselineLocation rewrittenLocation)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (oracles : baselineContext.oracle = rewrittenContext.oracle)
+    (boxAt : baselineStore.get? baselineLocation = some baselineBox)
+    (shared : baselineBox.world = .shared)
+    (node : baselineBox.node = .papN address arity baselineCaptured)
+    (capturedUnder : baselineCaptured.size < arity)
+    (retained : RetainSharedMany baselineStore baselineCaptured
+      baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc baselineLocation] = .ok (baselineReleased, baselineRemaining))
+    (totalEnough : arity ≤ (baselineCaptured ++ baselineArguments).size)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern expectedArity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern expectedArity))
+    (suppliedArity :
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+        expectedArity)
+    (remainingEmpty :
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).isEmpty = true)
+    (called : ScalarOracleCall baselineContext address
+      ((baselineCaptured ++ baselineArguments).extract 0 arity) value) :
+    let baselineTarget : Machine :=
+      { store := baselineReleased
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push value }
+          baselineStack }
+    ∃ (rewrittenCaptured : Array RVal)
+        (rewrittenRetained rewrittenReleased : Store)
+        (rewrittenRemaining : Nat),
+      let rewrittenTarget : Machine :=
+        { store := rewrittenReleased
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push value }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore rewrittenCaptured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained
+            [.loc rewrittenLocation] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc baselineLocation) baselineArguments baselineResume
+          baselineStack baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc rewrittenLocation) rewrittenArguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenBox, rewrittenAt, boxes⟩ := heap.boxes locations (by
+    change baselineStore.heap.get? baselineLocation = some baselineBox
+    exact boxAt)
+  have papNodes : IxIR1.Sim.NodeIso heap.locRel
+      (.papN address arity baselineCaptured) rewrittenBox.node := by
+    simpa only [← node] using boxes.node
+  obtain ⟨rewrittenCaptured, rewrittenNode, capturedRelated⟩ :=
+    nodeIso_pap_left papNodes
+  have rewrittenShared : rewrittenBox.world = .shared :=
+    boxes.world.symm.trans shared
+  have rewrittenCapturedUnder : rewrittenCaptured.size < arity := by
+    have sizes : baselineCaptured.size = rewrittenCaptured.size := by
+      simpa using rvalsIso_length_eq capturedRelated
+    rw [← sizes]
+    exact capturedUnder
+  have totalRelated : IxIR1.Sim.RValsIso heap.locRel
+      (baselineCaptured ++ baselineArguments).toList
+      (rewrittenCaptured ++ rewrittenArguments).toList := by
+    simpa using capturedRelated.append arguments
+  have totalSizes : (baselineCaptured ++ baselineArguments).size =
+      (rewrittenCaptured ++ rewrittenArguments).size := by
+    simpa using rvalsIso_length_eq totalRelated
+  have rewrittenTotalEnough :
+      arity ≤ (rewrittenCaptured ++ rewrittenArguments).size := by
+    rw [← totalSizes]
+    exact totalEnough
+  have suppliedRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList :=
+    rvalsIso_array_extract totalRelated 0 arity
+  have excessRelated : IxIR1.Sim.RValsIso heap.locRel
+      ((baselineCaptured ++ baselineArguments).extract arity
+        (baselineCaptured ++ baselineArguments).size).toList
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).toList := by
+    have extracted := rvalsIso_array_extract totalRelated arity
+      (baselineCaptured ++ baselineArguments).size
+    simpa [totalSizes] using extracted
+  have targetSuppliedArity :
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size =
+        expectedArity := by
+    have sizes :
+        ((baselineCaptured ++ baselineArguments).extract 0 arity).size =
+          ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).size := by
+      simpa using rvalsIso_length_eq suppliedRelated
+    rw [← sizes]
+    exact suppliedArity
+  have targetRemainingEmpty :
+      ((rewrittenCaptured ++ rewrittenArguments).extract arity
+        (rewrittenCaptured ++ rewrittenArguments).size).isEmpty = true := by
+    have lengths := rvalsIso_length_eq excessRelated
+    have sizes :
+        ((baselineCaptured ++ baselineArguments).extract arity
+          (baselineCaptured ++ baselineArguments).size).size =
+        ((rewrittenCaptured ++ rewrittenArguments).extract arity
+          (rewrittenCaptured ++ rewrittenArguments).size).size := by
+      simpa only [Array.length_toList] using lengths
+    have emptyEq :
+        ((baselineCaptured ++ baselineArguments).extract arity
+          (baselineCaptured ++ baselineArguments).size).isEmpty =
+        ((rewrittenCaptured ++ rewrittenArguments).extract arity
+          (rewrittenCaptured ++ rewrittenArguments).size).isEmpty := by
+      simp only [Array.isEmpty]
+      rw [sizes]
+    rw [← emptyEq]
+    exact remainingEmpty
+  obtain ⟨argumentsScalar, valueScalar⟩ := called.scalar
+  have suppliedListsEq :
+      ((baselineCaptured ++ baselineArguments).extract 0 arity).toList =
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity).toList := by
+    apply suppliedRelated.eq_of_allScalar
+    rw [Array.all_toList]
+    exact argumentsScalar
+  have suppliedEq :
+      (baselineCaptured ++ baselineArguments).extract 0 arity =
+      (rewrittenCaptured ++ rewrittenArguments).extract 0 arity :=
+    Array.toList_inj.mp suppliedListsEq
+  have targetCalled : ScalarOracleCall rewrittenContext address
+      ((rewrittenCaptured ++ rewrittenArguments).extract 0 arity) value := by
+    rw [← suppliedEq]
+    exact called.congrOracle oracles
+  obtain ⟨rewrittenRetained, retainedHeap, targetRetained,
+      retainedRelation⟩ :=
+    retainSharedMany_historyIso heap capturedRelated retained
+  have retainedLocation : retainedHeap.locRel baselineLocation
+      rewrittenLocation := by
+    rw [retainedRelation]
+    exact locations
+  obtain ⟨rewrittenReleased, rewrittenRemaining, releasedHeap,
+      targetReleased, outputFuel, releasedRelation⟩ :=
+    releaseSharedWork_historyIso retainedHeap fuel
+      (.cons (.loc retainedLocation) .nil) released
+  have outputResume : StableFrameRel limits validation releasedHeap.locRel
+      { baselineResume with values := baselineResume.values.push value }
+      { rewrittenResume with values := rewrittenResume.values.push value } := by
+    rw [releasedRelation, retainedRelation]
+    exact resume.push (IxIR1.Sim.RValIso.refl_of_scalar valueScalar)
+  have outputStack : StableStackIso limits validation releasedHeap.locRel
+      baselineStack rewrittenStack := by
+    rw [releasedRelation, retainedRelation]
+    exact stack
+  refine ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+    rewrittenRemaining, targetRetained, targetReleased,
+    ApplyTransfer.papExtern boxAt shared node capturedUnder retained released
+      totalEnough baselineDeclaration suppliedArity remainingEmpty called,
+    ApplyTransfer.papExtern (by
+      change rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+      exact rewrittenAt) rewrittenShared rewrittenNode rewrittenCapturedUnder
+      targetRetained targetReleased rewrittenTotalEnough rewrittenDeclaration
+      targetSuppliedArity targetRemainingEmpty targetCalled, ?_⟩
+  exact StableMachineRel.history releasedHeap outputFuel
+    (.running outputResume outputStack)
+
+/-- Exhaustive allocation-history simulation of dynamic application.  The
+source transfer selects its runtime branch; related values select the
+corresponding target function and argument payloads. -/
+theorem unchangedApplyTransferIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFunction rewrittenFunction : RVal}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (function : IxIR1.Sim.RValIso heap.locRel
+      baselineFunction rewrittenFunction)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (resume : StableFrameRel limits validation heap.locRel
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFunction
+      baselineArguments baselineResume baselineStack baselineTarget) :
+    ∃ rewrittenTarget,
+      ApplyTransfer
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation rewrittenStore rewrittenFuel rewrittenFunction
+          rewrittenArguments rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  have classified := transferred.classify
+  cases classified with
+  | erased released =>
+      cases function with
+      | erased =>
+          obtain ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferErasedIso
+              (baselineContext := Eval.Context.ofProgram sourceProgram
+                validation.schemas oracle)
+              (rewrittenContext := Eval.Context.ofProgram trace.target
+                validation.schemas oracle)
+              heap fuel arguments resume stack released
+          exact ⟨_, targetTransfer, related⟩
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      cases function with
+      | @loc _ rewrittenLocation locations =>
+          obtain ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+              rewrittenRemaining, targetRetained, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferPapUnderIso
+              (baselineContext := Eval.Context.ofProgram sourceProgram
+                validation.schemas oracle)
+              (rewrittenContext := Eval.Context.ofProgram trace.target
+                validation.schemas oracle)
+              heap fuel locations arguments resume stack boxAt shared node
+                capturedUnder retained released totalUnder
+          exact ⟨_, targetTransfer, related⟩
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      cases function with
+      | @loc _ rewrittenLocation locations =>
+          obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+            trace.context_fn declaration
+          obtain ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+              rewrittenRemaining, targetRetained, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferPapFnIso calleeRewrite heap fuel locations
+              arguments resume stack boxAt shared node capturedUnder retained
+              released totalEnough declaration targetDeclaration papSafe
+              suppliedArity nonempty
+          exact ⟨_, targetTransfer, related⟩
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      cases function with
+      | @loc _ rewrittenLocation locations =>
+          have targetDeclaration := trace.context_extern declaration
+          obtain ⟨rewrittenCaptured, rewrittenRetained, rewrittenReleased,
+              rewrittenRemaining, targetRetained, targetReleased,
+              sourceTransfer, targetTransfer, related⟩ :=
+            unchangedApplyTransferPapExternIso
+              (baselineContext := Eval.Context.ofProgram sourceProgram
+                validation.schemas oracle)
+              (rewrittenContext := Eval.Context.ofProgram trace.target
+                validation.schemas oracle)
+              heap fuel locations arguments resume stack rfl boxAt shared node
+              capturedUnder retained released totalEnough declaration
+              targetDeclaration suppliedArity remainingEmpty called
+          exact ⟨_, targetTransfer, related⟩
+
+/-- A source dynamic application in an unchanged block determines a target
+application over related function and argument values. -/
+theorem unchangedApplyStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {functionAtom : Atom} {argumentAtoms : Array Atom}
+    {baselineFunction : RVal} {baselineArguments : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .apply functionAtom argumentAtoms)
+    (noCredits : NoLiveCredits baselineFrame)
+    (functionResolved : resolveAtom baselineFrame.values functionAtom =
+      .ok baselineFunction)
+    (argumentsResolved : resolveAtoms baselineFrame.values argumentAtoms =
+      .ok baselineArguments)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFunction
+      baselineArguments { baselineFrame with pc := baselineFrame.pc + 1 }
+      baselineStack baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  obtain ⟨rewrittenFunction, targetFunctionResolved, functionRelated⟩ :=
+    resolveAtom_iso frame.values functionResolved
+  obtain ⟨rewrittenArguments, targetArgumentsResolved, argumentsRelated⟩ :=
+    resolveAtoms_iso frame.values argumentsResolved
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    rw [← frame.pc]
+    exact pc
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .apply functionAtom argumentAtoms := by
+    simpa only [← frame.pc] using instruction
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resume : StableFrameRel limits validation heap.locRel
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } :=
+    .rewritten rewrite frame.advance
+  obtain ⟨rewrittenTarget, targetTransferred, related⟩ :=
+    unchangedApplyTransferIso trace heap fuel functionRelated argumentsRelated
+      resume stack transferred
+  refine ⟨rewrittenTarget,
+    Step.applyCleared rfl sourceAt pc instruction noCredits functionResolved
+      argumentsResolved transferred,
+    Step.applyCleared rfl targetAt targetPc targetInstruction targetNoCredits
+      targetFunctionResolved targetArgumentsResolved targetTransferred,
+    related⟩
+
+/-! ## Exact-content dynamic application -/
+
+/-- Erased dynamic application releases the same argument vector in both
+machines, consuming at most the rewritten machine's additional heap fuel. -/
+theorem unchangedApplyTransferErased {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {arguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (resume : StableFrameRel limits validation (fun left right => left = right)
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    (released : releaseSharedWork baselineFuel baselineStore arguments.toList =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineTarget : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push .erased }
+          baselineStack }
+    ∃ rewrittenOut rewrittenRemaining,
+      let rewrittenTarget : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push .erased }
+            rewrittenStack }
+      releaseSharedWork rewrittenFuel rewrittenStore arguments.toList =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel .erased arguments baselineResume baselineStack
+          baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel .erased arguments rewrittenResume rewrittenStack
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+      outputHeap, outputFuel⟩ :=
+    heap.releaseSharedWork_of_le fuel released
+  refine ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+    ApplyTransfer.erased released, ApplyTransfer.erased targetReleased, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap)
+    outputFuel
+    (.running (resume.push (IxIR1.Sim.RValIso.refl .erased)) stack)
+
+/-- Under-saturated PAP application performs congruent retain/release work,
+allocates the same extended PAP payload, and resumes related callers with the
+corresponding fresh location. -/
+theorem unchangedApplyTransferPapUnder {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {location : Nat} {box : NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {captured arguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (resume : StableFrameRel limits validation (fun left right => left = right)
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    (boxAt : baselineStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : RetainSharedMany baselineStore captured baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc location] = .ok (baselineReleased, baselineRemaining))
+    (totalUnder : (captured ++ arguments).size < arity) :
+    let baselineAllocation := baselineReleased.allocNode .shared
+      (.papN address arity (captured ++ arguments))
+    let baselineTarget : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    ∃ rewrittenRetained rewrittenReleased rewrittenRemaining,
+      let rewrittenAllocation := rewrittenReleased.allocNode .shared
+        (.papN address arity (captured ++ arguments))
+      let rewrittenTarget : Machine :=
+        { store := rewrittenAllocation.1
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push
+                (.loc rewrittenAllocation.2) }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore captured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained [.loc location] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc location) arguments baselineResume baselineStack
+          baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc location) arguments rewrittenResume
+          rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  have targetBoxAt : rewrittenStore.get? location = some box := by
+    rw [← heap.get?_eq location]
+    exact boxAt
+  obtain ⟨rewrittenRetained, targetRetained, retainedHeap⟩ :=
+    heap.retainSharedMany retained
+  obtain ⟨rewrittenReleased, rewrittenRemaining, targetReleased,
+      releasedHeap, outputFuel⟩ :=
+    retainedHeap.releaseSharedWork_of_le fuel released
+  have locationEq :
+      (baselineReleased.allocNode .shared
+        (.papN address arity (captured ++ arguments))).2 =
+      (rewrittenReleased.allocNode .shared
+        (.papN address arity (captured ++ arguments))).2 :=
+    releasedHeap.allocNode_location .shared
+      (.papN address arity (captured ++ arguments))
+  have outputHeap : HeapContentsEq
+      (baselineReleased.allocNode .shared
+        (.papN address arity (captured ++ arguments))).1
+      (rewrittenReleased.allocNode .shared
+        (.papN address arity (captured ++ arguments))).1 :=
+    releasedHeap.allocNode .shared
+      (.papN address arity (captured ++ arguments))
+  refine ⟨rewrittenRetained, rewrittenReleased, rewrittenRemaining,
+    targetRetained, targetReleased, ?_, ?_, ?_⟩
+  · exact ApplyTransfer.papUnder boxAt shared node capturedUnder retained
+      released totalUnder
+  · exact ApplyTransfer.papUnder targetBoxAt shared node capturedUnder
+      targetRetained targetReleased totalUnder
+  · exact .related (fun left right => left = right) (.contents outputHeap)
+      outputFuel
+      (.running (resume.push (IxIR1.Sim.RValIso.loc locationEq)) stack)
+
+/-- Saturated and over-saturated PAP application enter related declaration
+rewrites.  The shared captured vector is retained/released congruently, while
+the common excess vector selects related `resume` or `applyMore`
+continuations. -/
+theorem unchangedApplyTransferPapFn {limits : Validate.Limits}
+    {validation : Validate.Context} {calleeSource : Function}
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {location : Nat} {box : NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity : Nat}
+    {captured arguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (resume : StableFrameRel limits validation (fun left right => left = right)
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    (boxAt : baselineStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : RetainSharedMany baselineStore captured baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc location] = .ok (baselineReleased, baselineRemaining))
+    (totalEnough : arity ≤ (captured ++ arguments).size)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (papSafe : calleeSource.signature.papSafe = true)
+    (suppliedArity :
+      ((captured ++ arguments).extract 0 arity).size =
+        calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let total := captured ++ arguments
+    let supplied := total.extract 0 arity
+    let remaining := total.extract arity total.size
+    let baselineContinuation : Continuation :=
+      if remaining.isEmpty then .resume baselineResume
+      else .applyMore remaining baselineResume
+    let rewrittenContinuation : Continuation :=
+      if remaining.isEmpty then .resume rewrittenResume
+      else .applyMore remaining rewrittenResume
+    let baselineTarget : Machine :=
+      { store := baselineReleased
+        heapFuel := baselineRemaining
+        control := .running
+          { definition := calleeSource, values := supplied }
+          (baselineContinuation :: baselineStack) }
+    ∃ rewrittenRetained rewrittenReleased rewrittenRemaining,
+      let rewrittenTarget : Machine :=
+        { store := rewrittenReleased
+          heapFuel := rewrittenRemaining
+          control := .running
+            { definition := calleeRewrite.definition, values := supplied }
+            (rewrittenContinuation :: rewrittenStack) }
+      RetainSharedMany rewrittenStore captured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained [.loc location] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc location) arguments baselineResume baselineStack
+          baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc location) arguments rewrittenResume
+          rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  have targetBoxAt : rewrittenStore.get? location = some box := by
+    rw [← heap.get?_eq location]
+    exact boxAt
+  obtain ⟨rewrittenRetained, targetRetained, retainedHeap⟩ :=
+    heap.retainSharedMany retained
+  obtain ⟨rewrittenReleased, rewrittenRemaining, targetReleased,
+      releasedHeap, outputFuel⟩ :=
+    retainedHeap.releaseSharedWork_of_le fuel released
+  have targetPapSafe :
+      calleeRewrite.definition.signature.papSafe = true := by
+    simpa using papSafe
+  have targetSuppliedArity :
+      ((captured ++ arguments).extract 0 arity).size =
+        calleeRewrite.definition.signature.params.size := by
+    simpa using suppliedArity
+  have targetNonempty :
+      calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  let supplied := (captured ++ arguments).extract 0 arity
+  let remaining := (captured ++ arguments).extract arity
+    (captured ++ arguments).size
+  have continuation : StableContinuationIso limits validation
+      (fun left right => left = right)
+      (if remaining.isEmpty then .resume baselineResume
+        else .applyMore remaining baselineResume)
+      (if remaining.isEmpty then .resume rewrittenResume
+        else .applyMore remaining rewrittenResume) :=
+    StableContinuationIso.applyMoreOrResume remaining resume
+  refine ⟨rewrittenRetained, rewrittenReleased, rewrittenRemaining,
+    targetRetained, targetReleased, ?_, ?_, ?_⟩
+  · exact ApplyTransfer.papFn boxAt shared node capturedUnder retained released
+      totalEnough baselineDeclaration papSafe suppliedArity nonempty
+  · exact ApplyTransfer.papFn targetBoxAt shared node capturedUnder
+      targetRetained targetReleased totalEnough rewrittenDeclaration
+      targetPapSafe targetSuppliedArity targetNonempty
+  · exact .related (fun left right => left = right) (.contents releasedHeap)
+      outputFuel
+      (.running
+        (StableFrameRel.entry calleeRewrite
+          (IxIR1.Sim.RValsIso.refl supplied.toList))
+        (.cons continuation stack))
+
+/-- Exactly saturated PAP application to a scalar extern observes the same
+oracle value in both contexts and resumes related callers immediately. -/
+theorem unchangedApplyTransferPapExtern {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {location : Nat} {box : NodeBox}
+    {address : Ix.Compiler.Ixon.Address} {arity expectedArity : Nat}
+    {captured arguments : Array RVal} {value : RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (resume : StableFrameRel limits validation (fun left right => left = right)
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    (oracles : baselineContext.oracle = rewrittenContext.oracle)
+    (boxAt : baselineStore.get? location = some box)
+    (shared : box.world = .shared)
+    (node : box.node = .papN address arity captured)
+    (capturedUnder : captured.size < arity)
+    (retained : RetainSharedMany baselineStore captured baselineRetained)
+    (released : releaseSharedWork baselineFuel baselineRetained
+      [.loc location] = .ok (baselineReleased, baselineRemaining))
+    (totalEnough : arity ≤ (captured ++ arguments).size)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern expectedArity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern expectedArity))
+    (suppliedArity :
+      ((captured ++ arguments).extract 0 arity).size = expectedArity)
+    (remainingEmpty :
+      ((captured ++ arguments).extract arity
+        (captured ++ arguments).size).isEmpty = true)
+    (called : ScalarOracleCall baselineContext address
+      ((captured ++ arguments).extract 0 arity) value) :
+    let baselineTarget : Machine :=
+      { store := baselineReleased
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineResume with
+            values := baselineResume.values.push value }
+          baselineStack }
+    ∃ rewrittenRetained rewrittenReleased rewrittenRemaining,
+      let rewrittenTarget : Machine :=
+        { store := rewrittenReleased
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenResume with
+              values := rewrittenResume.values.push value }
+            rewrittenStack }
+      RetainSharedMany rewrittenStore captured rewrittenRetained ∧
+        releaseSharedWork rewrittenFuel rewrittenRetained [.loc location] =
+          .ok (rewrittenReleased, rewrittenRemaining) ∧
+        ScalarOracleCall rewrittenContext address
+          ((captured ++ arguments).extract 0 arity) value ∧
+        ApplyTransfer baselineContext interpretation baselineStore
+          baselineFuel (.loc location) arguments baselineResume baselineStack
+          baselineTarget ∧
+        ApplyTransfer rewrittenContext interpretation rewrittenStore
+          rewrittenFuel (.loc location) arguments rewrittenResume
+          rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  have targetBoxAt : rewrittenStore.get? location = some box := by
+    rw [← heap.get?_eq location]
+    exact boxAt
+  obtain ⟨rewrittenRetained, targetRetained, retainedHeap⟩ :=
+    heap.retainSharedMany retained
+  obtain ⟨rewrittenReleased, rewrittenRemaining, targetReleased,
+      releasedHeap, outputFuel⟩ :=
+    retainedHeap.releaseSharedWork_of_le fuel released
+  have targetCalled : ScalarOracleCall rewrittenContext address
+      ((captured ++ arguments).extract 0 arity) value :=
+    called.congrOracle oracles
+  refine ⟨rewrittenRetained, rewrittenReleased, rewrittenRemaining,
+    targetRetained, targetReleased, targetCalled, ?_, ?_, ?_⟩
+  · exact ApplyTransfer.papExtern boxAt shared node capturedUnder retained
+      released totalEnough baselineDeclaration suppliedArity remainingEmpty
+      called
+  · exact ApplyTransfer.papExtern targetBoxAt shared node capturedUnder
+      targetRetained targetReleased totalEnough rewrittenDeclaration
+      suppliedArity remainingEmpty targetCalled
+  · exact .related (fun left right => left = right) (.contents releasedHeap)
+      outputFuel
+      (.running (resume.push (IxIR1.Sim.RValIso.refl value)) stack)
+
+/-- Exhaustive exact-content simulation of an arbitrary successful dynamic
+dispatch.  The evaluator's case witness selects the corresponding branch
+proof, while the program rewrite trace supplies the related function or
+preserved extern declaration at a PAP target. -/
+theorem unchangedApplyTransfer {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {function : RVal} {arguments : Array RVal}
+    {baselineResume rewrittenResume : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget : Machine}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (resume : StableFrameRel limits validation (fun left right => left = right)
+      baselineResume rewrittenResume)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel function arguments
+      baselineResume baselineStack baselineTarget) :
+    ∃ rewrittenTarget,
+      ApplyTransfer
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation rewrittenStore rewrittenFuel function arguments
+          rewrittenResume rewrittenStack rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  have classified := transferred.classify
+  cases classified with
+  | erased released =>
+      obtain ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+          sourceTransfer, targetTransfer, related⟩ :=
+        unchangedApplyTransferErased
+          (baselineContext :=
+            Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (rewrittenContext :=
+            Eval.Context.ofProgram trace.target validation.schemas oracle)
+          (interpretation := interpretation)
+          heap fuel resume stack released
+      exact ⟨_, targetTransfer, related⟩
+  | papUnder boxAt shared node capturedUnder retained released totalUnder =>
+      obtain ⟨rewrittenRetained, rewrittenReleased, rewrittenRemaining,
+          targetRetained, targetReleased, sourceTransfer, targetTransfer,
+          related⟩ :=
+        unchangedApplyTransferPapUnder
+          (baselineContext :=
+            Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (rewrittenContext :=
+            Eval.Context.ofProgram trace.target validation.schemas oracle)
+          (interpretation := interpretation)
+          heap fuel resume stack boxAt shared node capturedUnder retained
+          released totalUnder
+      exact ⟨_, targetTransfer, related⟩
+  | papFn boxAt shared node capturedUnder retained released totalEnough
+      declaration papSafe suppliedArity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ := trace.context_fn declaration
+      obtain ⟨rewrittenRetained, rewrittenReleased, rewrittenRemaining,
+          targetRetained, targetReleased, sourceTransfer, targetTransfer,
+          related⟩ :=
+        unchangedApplyTransferPapFn calleeRewrite heap fuel resume stack boxAt
+          shared node capturedUnder retained released totalEnough declaration
+          targetDeclaration papSafe suppliedArity nonempty
+      exact ⟨_, targetTransfer, related⟩
+  | papExtern boxAt shared node capturedUnder retained released totalEnough
+      declaration suppliedArity remainingEmpty called =>
+      have targetDeclaration := trace.context_extern declaration
+      obtain ⟨rewrittenRetained, rewrittenReleased, rewrittenRemaining,
+          targetRetained, targetReleased, targetCalled, sourceTransfer,
+          targetTransfer, related⟩ :=
+        unchangedApplyTransferPapExtern
+          (baselineContext :=
+            Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (rewrittenContext :=
+            Eval.Context.ofProgram trace.target validation.schemas oracle)
+          (interpretation := interpretation)
+          heap fuel resume stack rfl boxAt shared node capturedUnder retained
+          released totalEnough declaration targetDeclaration suppliedArity
+          remainingEmpty called
+      exact ⟨_, targetTransfer, related⟩
+
+/-- Lift any already-related dynamic dispatch through an unchanged `apply`
+instruction.  Branch-specific transfer theorems discharge the three
+successful runtime shapes without duplicating instruction decoding. -/
+theorem unchangedApplyStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget rewrittenTarget : Machine}
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    {block : Block} {functionAtom : Atom} {argumentAtoms : Array Atom}
+    {function : RVal} {arguments : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .apply functionAtom argumentAtoms)
+    (noCredits : NoLiveCredits baselineFrame)
+    (functionResolved : resolveAtom baselineFrame.values functionAtom =
+      .ok function)
+    (argumentsResolved : resolveAtoms baselineFrame.values argumentAtoms =
+      .ok arguments)
+    (baselineTransferred : ApplyTransfer baselineContext interpretation
+      baselineStore baselineFuel function arguments
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      baselineStack baselineTarget)
+    (rewrittenTransferred : ApplyTransfer rewrittenContext interpretation
+      rewrittenStore rewrittenFuel function arguments
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+      rewrittenStack rewrittenTarget)
+    (related : StableMachineRel limits validation baselineTarget
+      rewrittenTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineTarget ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenTarget ∧
+      StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .apply functionAtom argumentAtoms := by
+    simpa only [← pcs] using instruction
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetFunctionResolved :
+      resolveAtom rewrittenFrame.values functionAtom = .ok function := by
+    rw [← frame.values_eq]
+    exact functionResolved
+  have targetArgumentsResolved :
+      resolveAtoms rewrittenFrame.values argumentAtoms = .ok arguments := by
+    rw [← frame.values_eq]
+    exact argumentsResolved
+  exact ⟨
+    Step.applyCleared rfl sourceAt pc instruction noCredits functionResolved
+      argumentsResolved baselineTransferred,
+    Step.applyCleared rfl targetAt targetPc targetInstruction targetNoCredits
+      targetFunctionResolved targetArgumentsResolved rewrittenTransferred,
+    related⟩
+
+/-- A source `apply` transfer in an unchanged block is enough to produce the
+rewritten transfer and stable successor.  Runtime-case inversion and
+declaration selection are discharged internally from the whole-program
+rewrite trace. -/
+theorem unchangedApplyStepOfTrace {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {baselineTarget : Machine}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {functionAtom : Atom} {argumentAtoms : Array Atom}
+    {function : RVal} {arguments : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .apply functionAtom argumentAtoms)
+    (noCredits : NoLiveCredits baselineFrame)
+    (functionResolved : resolveAtom baselineFrame.values functionAtom =
+      .ok function)
+    (argumentsResolved : resolveAtoms baselineFrame.values argumentAtoms =
+      .ok arguments)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel function arguments
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      baselineStack baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation baselineMachine baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation rewrittenMachine rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  have resume : StableFrameRel limits validation
+      (fun left right => left = right)
+      { baselineFrame with pc := baselineFrame.pc + 1 }
+      { rewrittenFrame with pc := rewrittenFrame.pc + 1 } :=
+    .rewritten rewrite frame.advance
+  obtain ⟨rewrittenTarget, targetTransferred, related⟩ :=
+    unchangedApplyTransfer trace heap fuel resume stack transferred
+  refine ⟨rewrittenTarget, ?_⟩
+  exact unchangedApplyStep rewrite frame sourceAt targetAt pc instruction
+    noCredits functionResolved argumentsResolved transferred targetTransferred
+    related
+
+/-- Lift any already-related dynamic dispatch through an unchanged return-time
+`applyMore` continuation.  The active callee's result-world check transports
+through exact heap contents and its preserved signature. -/
+theorem unchangedRetApplyMoreStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {arguments : Array RVal}
+    {baselineRest rewrittenRest : List Continuation}
+    {baselineTarget rewrittenTarget : Machine}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : value.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true)
+    (baselineTransferred : ApplyTransfer baselineContext interpretation
+      baselineStore baselineFuel value arguments baselineCaller baselineRest
+      baselineTarget)
+    (rewrittenTransferred : ApplyTransfer rewrittenContext interpretation
+      rewrittenStore rewrittenFuel value arguments rewrittenCaller rewrittenRest
+      rewrittenTarget)
+    (related : StableMachineRel limits validation baselineTarget
+      rewrittenTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame
+          (.applyMore arguments baselineCaller :: baselineRest) }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame
+          (.applyMore arguments rewrittenCaller :: rewrittenRest) }
+    Step baselineContext interpretation baselineMachine baselineTarget ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenTarget ∧
+      StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : value.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq, ← heap.rvalHasWorld_eq]
+    exact world
+  exact ⟨
+    Step.retApplyMoreCleared rfl sourceAt pc terminator resolved noCredits world
+      baselineTransferred,
+    Step.retApplyMoreCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld rewrittenTransferred,
+    related⟩
+
+/-- A source return-time `applyMore` transfer likewise determines the target
+transfer exhaustively from the rewrite trace. -/
+theorem unchangedRetApplyMoreStepOfTrace {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {arguments : Array RVal}
+    {baselineRest rewrittenRest : List Continuation}
+    {baselineTarget : Machine}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (caller : StableFrameRel limits validation (fun left right => left = right)
+      baselineCaller rewrittenCaller)
+    (rest : StableStackIso limits validation (fun left right => left = right)
+      baselineRest rewrittenRest)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : value.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel value arguments baselineCaller
+      baselineRest baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame
+          (.applyMore arguments baselineCaller :: baselineRest) }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame
+          (.applyMore arguments rewrittenCaller :: rewrittenRest) }
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation baselineMachine baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation rewrittenMachine rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  dsimp only
+  obtain ⟨rewrittenTarget, targetTransferred, related⟩ :=
+    unchangedApplyTransfer trace heap fuel caller rest transferred
+  refine ⟨rewrittenTarget, ?_⟩
+  exact unchangedRetApplyMoreStep rewrite heap frame sourceAt targetAt pc
+    terminator resolved noCredits world transferred targetTransferred related
+
+/-! ## Unchanged-block lockstep cases -/
+
+/-- The first unchanged instruction case: identical `move` code advances
+both related frames in lockstep and preserves exact semantic heap contents.
+This is the template consumed by the exhaustive no-op block induction. -/
+theorem unchangedMoveStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] = .move atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push value }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push value }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction :
+      block.instructions[rewrittenFrame.pc] = .move atom := by
+    simpa only [← pcs] using instruction
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  refine ⟨Step.move rfl sourceAt pc instruction resolved,
+    Step.move rfl targetAt targetPc targetInstruction targetResolved, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running
+      (.rewritten rewrite (frame.advancePush (IxIR1.Sim.RValIso.refl value)))
+      stack)
+
+/-- Constructor projection from an unchanged block observes the same node and
+appends the same field value on exact-content heaps. -/
+theorem unchangedFetchStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId} {field location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .fetch atom cid field)
+    (resolved : resolveAtom baselineFrame.values atom = .ok (.loc location))
+    (boxAt : baselineStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (fieldAt : fields[field]? = some value) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push value }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push value }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .fetch atom cid field := by
+    simpa only [← pcs] using instruction
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetBoxAt : rewrittenStore.get? location = some box := by
+    rw [← heap.get?_eq location]
+    exact boxAt
+  refine ⟨Step.fetch rfl sourceAt pc instruction resolved boxAt node fieldAt,
+    Step.fetch rfl targetAt targetPc targetInstruction targetResolved
+      targetBoxAt node fieldAt, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running
+      (.rewritten rewrite (frame.advancePush (IxIR1.Sim.RValIso.refl value)))
+      stack)
+
+/-- An unchanged shallow unique free kills the same fixed location on both
+exact-content heaps. -/
+theorem unchangedFreeUniqueStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {cid : CtorId} {location : Nat}
+    {box : IxIR1.NodeBox} {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .freeUnique atom cid)
+    (resolved : resolveAtom baselineFrame.values atom = .ok (.loc location))
+    (boxAt : baselineStore.get? location = some box)
+    (unique : box.world = .unique)
+    (node : box.node = .ctorN cid fields)
+    (scalarFields : fields.all RVal.isScalar = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        store := baselineStore.kill location
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        store := rewrittenStore.kill location
+        control := .running
+          { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .freeUnique atom cid := by
+    simpa only [← pcs] using instruction
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetBoxAt : rewrittenStore.get? location = some box := by
+    rw [← heap.get?_eq location]
+    exact boxAt
+  refine ⟨Step.freeUnique rfl sourceAt pc instruction resolved boxAt unique
+      node scalarFields,
+    Step.freeUnique rfl targetAt targetPc targetInstruction targetResolved
+      targetBoxAt unique node scalarFields, ?_⟩
+  exact .related (fun left right => left = right)
+    (.contents (heap.kill location)) fuel
+    (.running (.rewritten rewrite frame.advance) stack)
+
+/-- Ordinary allocation in an unchanged block chooses corresponding fresh
+locations and preserves exact heap contents. -/
+theorem unchangedAllocStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {world : Owned} {cid : CtorId}
+    {arguments : Array Atom} {schema : CtorSchema}
+    {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .alloc world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (fieldWorlds : FieldWorlds baselineStore schema values) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode world (.ctorN cid values)
+    let rewrittenAllocation :=
+      rewrittenStore.allocNode world (.ctorN cid values)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push (.loc rewrittenAllocation.2) }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  let baselineAllocation := baselineStore.allocNode world (.ctorN cid values)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid values)
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .alloc world cid arguments := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema values :=
+    heap.fieldWorlds fieldWorlds
+  have locationEq : baselineAllocation.2 = rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode_location world (.ctorN cid values)
+  have outputHeap : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode world (.ctorN cid values)
+  have sourceStep := Step.alloc
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction schemaAt resolved fieldWorlds
+  have targetStep := Step.alloc
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+      targetFieldWorlds
+  refine ⟨by simpa [baselineAllocation] using sourceStep,
+    by simpa [rewrittenAllocation] using targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite
+        (frame.advancePush (IxIR1.Sim.RValIso.loc locationEq)))
+      stack)
+
+/-- An unchanged `allocWith` fed an absent credit consumes the same slot and
+falls back to corresponding fresh allocations on exact-content heaps. -/
+theorem unchangedAllocWithAbsentStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (fieldWorlds : FieldWorlds baselineStore schema values)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (absent : credit.presence = .absent) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode world (.ctorN cid values)
+    let rewrittenAllocation :=
+      rewrittenStore.allocNode world (.ctorN cid values)
+    let rewrittenTaken :=
+      { baselineTaken with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenTaken with
+            values := rewrittenTaken.values.push (.loc rewrittenAllocation.2) }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  let baselineAllocation := baselineStore.allocNode world (.ctorN cid values)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid values)
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema values :=
+    heap.fieldWorlds fieldWorlds
+  obtain ⟨targetTaken, takenFrame⟩ := frame.advanceTake taken
+  have locationEq : baselineAllocation.2 = rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode_location world (.ctorN cid values)
+  have outputHeap : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode world (.ctorN cid values)
+  have sourceStep := Step.allocWithAbsent
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+      absent
+  have targetStep := Step.allocWithAbsent
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+      targetFieldWorlds targetTaken layout absent
+  refine ⟨by simpa [baselineAllocation] using sourceStep,
+    by simpa [rewrittenAllocation] using targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite
+        (takenFrame.push (IxIR1.Sim.RValIso.loc locationEq)))
+      stack)
+
+/-- A present logical credit records the same opportunity in both runs;
+semantic allocation remains fresh and lockstep. -/
+theorem unchangedAllocWithLogicalStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (fieldWorlds : FieldWorlds baselineStore schema values)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present none) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode world (.ctorN cid values)
+    let rewrittenAllocation :=
+      rewrittenStore.allocNode world (.ctorN cid values)
+    let rewrittenTaken :=
+      { baselineTaken with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenTaken with
+            values := rewrittenTaken.values.push (.loc rewrittenAllocation.2) }
+          rewrittenStack }
+    Step baselineContext .logical baselineMachine baselineNext ∧
+      Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  let baselineAllocation := baselineStore.allocNode world (.ctorN cid values)
+  let rewrittenAllocation :=
+    rewrittenStore.allocNode world (.ctorN cid values)
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema values :=
+    heap.fieldWorlds fieldWorlds
+  obtain ⟨targetTaken, takenFrame⟩ := frame.advanceTake taken
+  have locationEq : baselineAllocation.2 = rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode_location world (.ctorN cid values)
+  have outputHeap : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode world (.ctorN cid values)
+  have sourceStep := Step.allocWithLogical
+    (context := baselineContext)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+      present
+  have targetStep := Step.allocWithLogical
+    (context := rewrittenContext)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+      targetFieldWorlds targetTaken layout present
+  refine ⟨by simpa [baselineAllocation] using sourceStep,
+    by simpa [rewrittenAllocation] using targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite
+        (takenFrame.push (IxIR1.Sim.RValIso.loc locationEq)))
+      stack)
+
+/-- Physical `allocWith` reuses the same reserved fixed location in both
+exact-content heaps and appends that location to related frames. -/
+theorem unchangedAllocWithPhysicalStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {world : Owned} {cid : CtorId} {arguments : Array Atom}
+    {schema : CtorSchema} {values : Array RVal} {location : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .allocWith creditId world cid arguments)
+    (schemaAt : baselineContext.schemas world cid = some schema)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (fieldWorlds : FieldWorlds baselineStore schema values)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (layout : credit.layout = schema.layout)
+    (present : credit.presence = .present (some location))
+    (reused : baselineStore.reuseReservation location world
+      (.ctorN cid values) schema.fields.size = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTaken :=
+      { baselineTaken with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineTaken with
+            values := baselineTaken.values.push (.loc location) }
+          baselineStack }
+    ∃ rewrittenOut,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenTaken with
+              values := rewrittenTaken.values.push (.loc location) }
+            rewrittenStack }
+      rewrittenStore.reuseReservation location world (.ctorN cid values)
+          schema.fields.size = .ok rewrittenOut ∧
+        Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .allocWith creditId world cid arguments := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas world cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetFieldWorlds : FieldWorlds rewrittenStore schema values :=
+    heap.fieldWorlds fieldWorlds
+  obtain ⟨targetTaken, takenFrame⟩ := frame.advanceTake taken
+  obtain ⟨rewrittenOut, targetReused, outputHeap⟩ :=
+    heap.reuseReservation reused
+  refine ⟨rewrittenOut, targetReused,
+    Step.allocWithPhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved fieldWorlds taken layout
+        present reused,
+    Step.allocWithPhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetFieldWorlds targetTaken layout present targetReused, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite
+        (takenFrame.push (IxIR1.Sim.RValIso.refl (.loc location))))
+      stack)
+
+/-- Discarding an absent credit consumes the same frame slot and leaves both
+exact-content heaps untouched. -/
+theorem unchangedDiscardCreditAbsentStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (absent : credit.presence = .absent) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTaken :=
+      { baselineTaken with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenTaken rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← pcs] using instruction
+  obtain ⟨targetTaken, takenFrame⟩ := frame.advanceTake taken
+  refine ⟨
+    Step.discardCreditAbsent
+      (context := baselineContext) (interpretation := interpretation)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken absent,
+    Step.discardCreditAbsent
+      (context := rewrittenContext) (interpretation := interpretation)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken absent, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Discarding a present logical credit consumes the same slot without a
+physical heap action. -/
+theorem unchangedDiscardCreditLogicalStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (present : credit.presence = .present none) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTaken :=
+      { baselineTaken with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenTaken rewrittenStack }
+    Step baselineContext .logical baselineMachine baselineNext ∧
+      Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← pcs] using instruction
+  obtain ⟨targetTaken, takenFrame⟩ := frame.advanceTake taken
+  refine ⟨
+    Step.discardCreditLogical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken present,
+    Step.discardCreditLogical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken present, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Discarding a physical credit releases the same reserved fixed location
+in both exact-content heaps. -/
+theorem unchangedDiscardCreditPhysicalStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTaken : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {location : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .discardCredit creditId)
+    (taken : CreditTake { baselineFrame with
+      pc := baselineFrame.pc + 1 } creditId baselineTaken credit)
+    (present : credit.presence = .present (some location))
+    (released : baselineStore.releaseReservation location = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTaken :=
+      { baselineTaken with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running baselineTaken baselineStack }
+    ∃ rewrittenOut,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running rewrittenTaken rewrittenStack }
+      rewrittenStore.releaseReservation location = .ok rewrittenOut ∧
+        Step baselineContext .physical baselineMachine baselineNext ∧
+        Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .discardCredit creditId := by
+    simpa only [← pcs] using instruction
+  obtain ⟨targetTaken, takenFrame⟩ := frame.advanceTake taken
+  obtain ⟨rewrittenOut, targetReleased, outputHeap⟩ :=
+    heap.releaseReservation released
+  refine ⟨rewrittenOut, targetReleased,
+    Step.discardCreditPhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction taken present released,
+    Step.discardCreditPhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetTaken present
+        targetReleased, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running (.rewritten rewrite takenFrame) stack)
+
+/-- Logical unique extraction observes the same constructor, kills the same
+fixed slot, and appends identical fields and required credit. -/
+theorem unchangedTakeUniqueLogicalStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .takeUnique target cid)
+    (schemaAt : baselineContext.schemas .unique cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target = .ok (.loc location))
+    (viewed : ConstructorView baselineStore location .unique cid box fields)
+    (unitRC : box.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present none }
+    let baselineNext : Machine :=
+      { store := baselineStore.kill location
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ fields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenStore.kill location
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ fields
+            credits := rewrittenFrame.credits.push (some credit) }
+          rewrittenStack }
+    Step baselineContext .logical baselineMachine baselineNext ∧
+      Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .takeUnique target cid := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas .unique cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtom rewrittenFrame.values target = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetViewed :
+      ConstructorView rewrittenStore location .unique cid box fields :=
+    heap.constructorView viewed
+  refine ⟨
+    Step.takeUniqueLogical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+    Step.takeUniqueLogical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetViewed unitRC, ?_⟩
+  exact .related (fun left right => left = right)
+    (.contents (heap.kill location)) fuel
+    (.running
+      (.rewritten rewrite (frame.advanceAppendCredit fields
+        { layout := schema.layout, presence := .present none }))
+      stack)
+
+/-- Physical unique extraction reserves the same fixed slot and appends the
+same location-bearing required credit in both runs. -/
+theorem unchangedTakeUniquePhysicalStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .takeUnique target cid)
+    (schemaAt : baselineContext.schemas .unique cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target = .ok (.loc location))
+    (viewed : ConstructorView baselineStore location .unique cid box fields)
+    (unitRC : box.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present (some location) }
+    let baselineNext : Machine :=
+      { store := baselineStore.reserve location
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ fields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenStore.reserve location
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ fields
+            credits := rewrittenFrame.credits.push (some credit) }
+          rewrittenStack }
+    Step baselineContext .physical baselineMachine baselineNext ∧
+      Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .takeUnique target cid := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas .unique cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtom rewrittenFrame.values target = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetViewed :
+      ConstructorView rewrittenStore location .unique cid box fields :=
+    heap.constructorView viewed
+  refine ⟨
+    Step.takeUniquePhysical
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+    Step.takeUniquePhysical
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetViewed unitRC, ?_⟩
+  exact .related (fun left right => left = right)
+    (.contents (heap.reserve location)) fuel
+    (.running
+      (.rewritten rewrite (frame.advanceAppendCredit fields
+        { layout := schema.layout,
+          presence := .present (some location) }))
+      stack)
+
+/-- A hot logical shared reset kills the same fixed slot, records the same
+counter-insensitive heap contents, and appends an identical present credit. -/
+theorem unchangedResetSharedLogicalHotStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target = .ok (.loc location))
+    (viewed : ConstructorView baselineStore location .shared cid box fields)
+    (unitRC : box.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present none }
+    let baselineNext : Machine :=
+      { store := ((baselineStore.tickResetAttempt).kill location).tickHotReset
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ fields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := ((rewrittenStore.tickResetAttempt).kill location).tickHotReset
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ fields
+            credits := rewrittenFrame.credits.push (some credit) }
+          rewrittenStack }
+    Step baselineContext .logical baselineMachine baselineNext ∧
+      Step rewrittenContext .logical rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .resetShared target cid := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas .shared cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtom rewrittenFrame.values target = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetViewed :
+      ConstructorView rewrittenStore location .shared cid box fields :=
+    heap.constructorView viewed
+  refine ⟨
+    Step.resetSharedLogicalHot
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+    Step.resetSharedLogicalHot
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetViewed unitRC, ?_⟩
+  exact .related (fun left right => left = right)
+    (.contents (((heap.tickResetAttempt).kill location).tickHotReset)) fuel
+    (.running
+      (.rewritten rewrite (frame.advanceAppendCredit fields
+        { layout := schema.layout, presence := .present none }))
+      stack)
+
+/-- A hot physical shared reset reserves the same fixed slot and appends the
+same location-bearing present credit in both runs. -/
+theorem unchangedResetSharedPhysicalHotStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target = .ok (.loc location))
+    (viewed : ConstructorView baselineStore location .shared cid box fields)
+    (unitRC : box.rc = 1) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .present (some location) }
+    let baselineNext : Machine :=
+      { store :=
+          ((baselineStore.tickResetAttempt).reserve location).tickHotReset
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ fields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store :=
+          ((rewrittenStore.tickResetAttempt).reserve location).tickHotReset
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values ++ fields
+            credits := rewrittenFrame.credits.push (some credit) }
+          rewrittenStack }
+    Step baselineContext .physical baselineMachine baselineNext ∧
+      Step rewrittenContext .physical rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .resetShared target cid := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas .shared cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtom rewrittenFrame.values target = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetViewed :
+      ConstructorView rewrittenStore location .shared cid box fields :=
+    heap.constructorView viewed
+  refine ⟨
+    Step.resetSharedPhysicalHot
+      (context := baselineContext)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved viewed unitRC,
+    Step.resetSharedPhysicalHot
+      (context := rewrittenContext)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetViewed unitRC, ?_⟩
+  exact .related (fun left right => left = right)
+    (.contents (((heap.tickResetAttempt).reserve location).tickHotReset)) fuel
+    (.running
+      (.rewritten rewrite (frame.advanceAppendCredit fields
+        { layout := schema.layout,
+          presence := .present (some location) }))
+      stack)
+
+/-- A cold shared reset transports the parent decrement and the entire field
+retain loop across exact-content heaps, then appends the common absent credit. -/
+theorem unchangedResetSharedColdStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (schemas : baselineContext.schemas = rewrittenContext.schemas)
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {target : Atom} {cid : CtorId}
+    {schema : CtorSchema} {location : Nat} {box : IxIR1.NodeBox}
+    {fields : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .resetShared target cid)
+    (schemaAt : baselineContext.schemas .shared cid = some schema)
+    (resolved : resolveAtom baselineFrame.values target = .ok (.loc location))
+    (viewed : ConstructorView baselineStore location .shared cid box fields)
+    (shared : 1 < box.rc)
+    (retained : RetainSharedMany
+      ((((baselineStore.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+      fields baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let credit : Credit :=
+      { layout := schema.layout, presence := .absent }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values ++ fields
+            credits := baselineFrame.credits.push (some credit) }
+          baselineStack }
+    ∃ rewrittenOut,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values ++ fields
+              credits := rewrittenFrame.credits.push (some credit) }
+            rewrittenStack }
+      RetainSharedMany
+          ((((rewrittenStore.tickResetAttempt).setBox location
+            { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+          fields rewrittenOut ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .resetShared target cid := by
+    simpa only [← pcs] using instruction
+  have targetSchemaAt : rewrittenContext.schemas .shared cid = some schema := by
+    rw [← schemas]
+    exact schemaAt
+  have targetResolved :
+      resolveAtom rewrittenFrame.values target = .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetViewed :
+      ConstructorView rewrittenStore location .shared cid box fields :=
+    heap.constructorView viewed
+  have beforeRetain : HeapContentsEq
+      ((((baselineStore.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+      ((((rewrittenStore.tickResetAttempt).setBox location
+        { box with rc := box.rc - 1 }).rcTick).tickColdReset) :=
+    ((((heap.tickResetAttempt).setBox location
+      { box with rc := box.rc - 1 }).rcTick).tickColdReset)
+  obtain ⟨rewrittenOut, targetRetained, outputHeap⟩ :=
+    beforeRetain.retainSharedMany retained
+  refine ⟨rewrittenOut, targetRetained,
+    Step.resetSharedCold
+      (context := baselineContext) (interpretation := interpretation)
+      (machine :=
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack })
+      rfl sourceAt pc instruction schemaAt resolved viewed shared retained,
+    Step.resetSharedCold
+      (context := rewrittenContext) (interpretation := interpretation)
+      (machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack })
+      rfl targetAt targetPc targetInstruction targetSchemaAt targetResolved
+        targetViewed shared targetRetained, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite (frame.advanceAppendCredit fields
+        { layout := schema.layout, presence := .absent }))
+      stack)
+
+/-- An unchanged recursive call enters the two versions of the same function
+and pushes related advanced caller frames. -/
+theorem unchangedCallSelfStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {arguments : Array Atom} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .callSelf arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (arity : values.size =
+      baselineFrame.definition.signature.params.size)
+    (nonempty : baselineFrame.definition.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := baselineFrame.definition, values }
+          (.resume { baselineFrame with pc := baselineFrame.pc + 1 } ::
+            baselineStack) }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { definition := rewrittenFrame.definition, values }
+          (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 } ::
+            rewrittenStack) }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .callSelf arguments := by
+    simpa only [← pcs] using instruction
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have sourceArity : values.size = source.signature.params.size := by
+    simpa [frame.baselineDefinition] using arity
+  have targetArity : values.size =
+      rewrittenFrame.definition.signature.params.size := by
+    simpa [frame.rewrittenDefinition] using sourceArity
+  have targetNonempty : rewrittenFrame.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem targetAt
+  have sourceStep := Step.callSelfCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction noCredits resolved arity nonempty
+  have targetStep := Step.callSelfCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetNoCredits targetResolved
+      targetArity targetNonempty
+  refine ⟨sourceStep, targetStep, ?_⟩
+  have callee : StableFrameRel limits validation
+      (fun left right => left = right)
+      { definition := baselineFrame.definition, values }
+      { definition := rewrittenFrame.definition, values } := by
+    rw [frame.baselineDefinition, frame.rewrittenDefinition]
+    exact StableFrameRel.entry rewrite (IxIR1.Sim.RValsIso.refl values.toList)
+  have resume : StableContinuationIso limits validation
+      (fun left right => left = right)
+      (.resume { baselineFrame with pc := baselineFrame.pc + 1 })
+      (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 }) :=
+    .resume (.rewritten rewrite frame.advance)
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running callee (.cons resume stack))
+
+/-- An unchanged direct call follows the declaration rewrite selected at the
+same address and pushes related advanced caller frames. -/
+theorem unchangedCallFnStep {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso callerRewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .call address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (arity : values.size = calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running { definition := calleeSource, values }
+          (.resume { baselineFrame with pc := baselineFrame.pc + 1 } ::
+            baselineStack) }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { definition := calleeRewrite.definition, values }
+          (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 } ::
+            rewrittenStack) }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .call address arguments := by
+    simpa only [← pcs] using instruction
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetArity : values.size =
+      calleeRewrite.definition.signature.params.size := by
+    simpa using arity
+  have targetNonempty : calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  have sourceStep := Step.callFnCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction noCredits resolved baselineDeclaration arity
+      nonempty
+  have targetStep := Step.callFnCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetNoCredits targetResolved
+      rewrittenDeclaration targetArity targetNonempty
+  refine ⟨sourceStep, targetStep, ?_⟩
+  have callee : StableFrameRel limits validation
+      (fun left right => left = right)
+      { definition := calleeSource, values }
+      { definition := calleeRewrite.definition, values } :=
+    StableFrameRel.entry calleeRewrite (IxIR1.Sim.RValsIso.refl values.toList)
+  have resume : StableContinuationIso limits validation
+      (fun left right => left = right)
+      (.resume { baselineFrame with pc := baselineFrame.pc + 1 })
+      (.resume { rewrittenFrame with pc := rewrittenFrame.pc + 1 }) :=
+    .resume (.rewritten callerRewrite frame.advance)
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running callee (.cons resume stack))
+
+/-- An unchanged partial application allocates equal PAP payloads in
+exact-content heaps; the declaration rewrite preserves the target signature
+and PAP-safety bit used by the runtime check. -/
+theorem unchangedPappFnStep {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso callerRewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .papp address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (papSafe : calleeSource.signature.papSafe = true)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (under : values.size < calleeSource.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode .shared
+      (.papN address calleeSource.signature.params.size values)
+    let rewrittenAllocation := rewrittenStore.allocNode .shared
+      (.papN address calleeSource.signature.params.size values)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push (.loc rewrittenAllocation.2) }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  let baselineAllocation := baselineStore.allocNode .shared
+    (.papN address calleeSource.signature.params.size values)
+  let rewrittenAllocation := rewrittenStore.allocNode .shared
+    (.papN address calleeSource.signature.params.size values)
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .papp address arguments := by
+    simpa only [← pcs] using instruction
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetPapSafe : calleeRewrite.definition.signature.papSafe = true := by
+    simpa using papSafe
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetUnder :
+      values.size < calleeRewrite.definition.signature.params.size := by
+    simpa using under
+  have locationEq : baselineAllocation.2 = rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode_location .shared
+        (.papN address calleeSource.signature.params.size values)
+  have outputHeap : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode .shared
+        (.papN address calleeSource.signature.params.size values)
+  have sourceStep := Step.pappFnCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction noCredits baselineDeclaration papSafe resolved
+      under
+  have targetStep := Step.pappFnCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetNoCredits
+      rewrittenDeclaration targetPapSafe targetResolved targetUnder
+  refine ⟨by simpa [baselineAllocation] using sourceStep,
+    by simpa [rewrittenAllocation] using targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten callerRewrite
+        (frame.advancePush (IxIR1.Sim.RValIso.loc locationEq)))
+      stack)
+
+/-- An unchanged partial application of an extern allocates the same PAP in
+exact-content heaps.  Extern declarations are preserved literally by a
+whole-program reuse trace, so unlike the function-targeted case there is no
+callee rewrite to enter. -/
+theorem unchangedPappExternStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {values : Array RVal} {arity : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .papp address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern arity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern arity))
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (under : values.size < arity) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineAllocation := baselineStore.allocNode .shared
+      (.papN address arity values)
+    let rewrittenAllocation := rewrittenStore.allocNode .shared
+      (.papN address arity values)
+    let baselineNext : Machine :=
+      { store := baselineAllocation.1
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push (.loc baselineAllocation.2) }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { store := rewrittenAllocation.1
+        heapFuel := rewrittenFuel
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push (.loc rewrittenAllocation.2) }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  let baselineAllocation := baselineStore.allocNode .shared
+    (.papN address arity values)
+  let rewrittenAllocation := rewrittenStore.allocNode .shared
+    (.papN address arity values)
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .papp address arguments := by
+    simpa only [← pcs] using instruction
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have locationEq : baselineAllocation.2 = rewrittenAllocation.2 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode_location .shared (.papN address arity values)
+  have outputHeap : HeapContentsEq baselineAllocation.1
+      rewrittenAllocation.1 := by
+    simpa [baselineAllocation, rewrittenAllocation] using
+      heap.allocNode .shared (.papN address arity values)
+  have sourceStep := Step.pappExternCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc instruction noCredits baselineDeclaration resolved under
+  have targetStep := Step.pappExternCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc targetInstruction targetNoCredits
+      rewrittenDeclaration targetResolved under
+  refine ⟨by simpa [baselineAllocation] using sourceStep,
+    by simpa [rewrittenAllocation] using targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite
+        (frame.advancePush (IxIR1.Sim.RValIso.loc locationEq)))
+      stack)
+
+/-- An unchanged scalar extern instruction resolves the same preserved extern
+declaration and observes the same oracle result. -/
+theorem unchangedExternStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    (oracles : baselineContext.oracle = rewrittenContext.oracle)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {values : Array RVal}
+    {arity : Nat} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .extern address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.extern arity))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.extern arity))
+    (argumentArity : values.size = arity)
+    (called : ScalarOracleCall baselineContext address values value) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push value }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { rewrittenFrame with
+            pc := rewrittenFrame.pc + 1
+            values := rewrittenFrame.values.push value }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .extern address arguments := by
+    simpa only [← pcs] using instruction
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetCalled :
+      ScalarOracleCall rewrittenContext address values value :=
+    called.congrOracle oracles
+  refine ⟨Step.externCleared rfl sourceAt pc instruction noCredits resolved
+      baselineDeclaration argumentArity called,
+    Step.externCleared rfl targetAt targetPc targetInstruction targetNoCredits
+      targetResolved rewrittenDeclaration argumentArity targetCalled, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running
+      (.rewritten rewrite
+        (frame.advancePush (IxIR1.Sim.RValIso.refl value)))
+      stack)
+
+/-- An unchanged tail-recursive call re-enters the two versions of the
+current function without changing either continuation stack. -/
+theorem unchangedTailCallSelfStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {arguments : Array Atom} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (arity : values.size =
+      baselineFrame.definition.signature.params.size)
+    (nonempty : baselineFrame.definition.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := baselineFrame.definition, values } baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { definition := rewrittenFrame.definition, values } rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have sourceArity : values.size = source.signature.params.size := by
+    simpa [frame.baselineDefinition] using arity
+  have targetArity : values.size =
+      rewrittenFrame.definition.signature.params.size := by
+    simpa [frame.rewrittenDefinition] using sourceArity
+  have targetNonempty : rewrittenFrame.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem targetAt
+  have sourceStep := Step.tailCallSelfCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc terminator noCredits resolved arity nonempty
+  have targetStep := Step.tailCallSelfCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc terminator targetNoCredits targetResolved
+      targetArity targetNonempty
+  refine ⟨sourceStep, targetStep, ?_⟩
+  have callee : StableFrameRel limits validation
+      (fun left right => left = right)
+      { definition := baselineFrame.definition, values }
+      { definition := rewrittenFrame.definition, values } := by
+    rw [frame.baselineDefinition, frame.rewrittenDefinition]
+    exact StableFrameRel.entry rewrite (IxIR1.Sim.RValsIso.refl values.toList)
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running callee stack)
+
+/-- An unchanged direct tail call selects related source/target declarations
+at the same address and enters the rewritten callee with the existing related
+stacks. -/
+theorem unchangedTailCallFnStep {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso callerRewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {values : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments = .ok values)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (arity : values.size = calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running { definition := calleeSource, values }
+          baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { definition := calleeRewrite.definition, values }
+          rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have targetResolved :
+      resolveAtoms rewrittenFrame.values arguments = .ok values := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetArity : values.size =
+      calleeRewrite.definition.signature.params.size := by
+    simpa using arity
+  have targetNonempty : calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  have sourceStep := Step.tailCallFnCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack })
+    rfl sourceAt pc terminator noCredits resolved baselineDeclaration arity
+      nonempty
+  have targetStep := Step.tailCallFnCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack })
+    rfl targetAt targetPc terminator targetNoCredits targetResolved
+      rewrittenDeclaration targetArity targetNonempty
+  refine ⟨sourceStep, targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running
+      (StableFrameRel.entry calleeRewrite
+        (IxIR1.Sim.RValsIso.refl values.toList))
+      stack)
+
+/-- An unchanged return through an ordinary continuation pushes the same
+value into related suspended callers.  Exact heap contents also transport
+the result-world check used by the return boundary. -/
+theorem unchangedRetResumeStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {baselineRest rewrittenRest : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (caller : StableFrameRel limits validation (fun left right => left = right)
+      baselineCaller rewrittenCaller)
+    (rest : StableStackIso limits validation (fun left right => left = right)
+      baselineRest rewrittenRest)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : value.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame
+          (.resume baselineCaller :: baselineRest) }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame
+          (.resume rewrittenCaller :: rewrittenRest) }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineCaller with
+            values := baselineCaller.values.push value }
+          baselineRest }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running
+          { rewrittenCaller with
+            values := rewrittenCaller.values.push value }
+          rewrittenRest }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : value.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq, ← heap.rvalHasWorld_eq]
+    exact world
+  have sourceStep := Step.retResumeCleared
+    (context := baselineContext) (interpretation := interpretation)
+    (machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame
+          (.resume baselineCaller :: baselineRest) })
+    rfl sourceAt pc terminator resolved noCredits world
+  have targetStep := Step.retResumeCleared
+    (context := rewrittenContext) (interpretation := interpretation)
+    (machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame
+          (.resume rewrittenCaller :: rewrittenRest) })
+    rfl targetAt targetPc terminator targetResolved targetNoCredits targetWorld
+  refine ⟨sourceStep, targetStep, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (caller.push (IxIR1.Sim.RValIso.refl value)) rest)
+
+/-- The outermost unchanged return halts both machines with the same value. -/
+theorem unchangedRetHaltStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : value.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame [] }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame [] }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .halted value }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with control := .halted value }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetNoCredits : NoLiveCredits rewrittenFrame := by
+    unfold NoLiveCredits at noCredits ⊢
+    rw [← frame.credits_eq]
+    exact noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : value.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq, ← heap.rvalHasWorld_eq]
+    exact world
+  refine ⟨Step.retHaltCleared rfl sourceAt pc terminator resolved noCredits world,
+    Step.retHaltCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.halted (IxIR1.Sim.RValIso.refl value))
+
+/-- An unchanged jump transports its checked edge through the rewritten
+function's preserved target-block ABI. -/
+theorem unchangedJumpStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {edge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .jump edge)
+    (transferred : EdgeTransfer baselineFrame edge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTarget :=
+      { baselineTarget with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running rewrittenTarget rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenTransfer, targetFrame⟩ := frame.edgeTransfer transferred
+  refine ⟨Step.jump rfl sourceAt pc terminator transferred,
+    Step.jump rfl targetAt targetPc terminator rewrittenTransfer, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- Constructor dispatch observes the same node in exact-content heaps and
+then transports the selected edge through the rewritten target ABI. -/
+theorem unchangedSwitchCtorStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {location : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : resolveAtom baselineFrame.values scrutinee =
+      .ok (.loc location))
+    (boxAt : baselineStore.get? location = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer baselineFrame alternative.edge #[]
+      baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTarget :=
+      { baselineTarget with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running rewrittenTarget rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetResolved : resolveAtom rewrittenFrame.values scrutinee =
+      .ok (.loc location) := by
+    rw [← frame.values_eq]
+    exact resolved
+  have targetBoxAt : rewrittenStore.get? location = some box := by
+    rw [← heap.get?_eq]
+    exact boxAt
+  obtain ⟨rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransfer transferred
+  refine ⟨Step.switchCtor rfl sourceAt pc terminator resolved boxAt node
+      alternativeAt transferred,
+    Step.switchCtor rfl targetAt targetPc terminator targetResolved
+      targetBoxAt node alternativeAt rewrittenTransfer, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- The zero arm of an unchanged literal-Nat switch follows the corresponding
+rewritten edge. -/
+theorem unchangedSwitchNatZeroStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {peel : NatPeel}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : resolveAtom baselineFrame.values scrutinee =
+      .ok (.lit (.nat 0)))
+    (transferred : EdgeTransfer baselineFrame peel.zero #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTarget :=
+      { baselineTarget with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running rewrittenTarget rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetResolved : resolveAtom rewrittenFrame.values scrutinee =
+      .ok (.lit (.nat 0)) := by
+    rw [← frame.values_eq]
+    exact resolved
+  obtain ⟨rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransfer transferred
+  refine ⟨Step.switchNatZero rfl sourceAt pc terminator resolved transferred,
+    Step.switchNatZero rfl targetAt targetPc terminator targetResolved
+      rewrittenTransfer, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- The successor arm of an unchanged literal-Nat switch preserves its
+implicit predecessor value while transporting the explicit edge. -/
+theorem unchangedSwitchNatSuccStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {peel : NatPeel} {predecessor : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : resolveAtom baselineFrame.values scrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (transferred : EdgeTransfer baselineFrame peel.succ
+      #[.lit (.nat predecessor)] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTarget :=
+      { baselineTarget with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running rewrittenTarget rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetResolved : resolveAtom rewrittenFrame.values scrutinee =
+      .ok (.lit (.nat (predecessor + 1))) := by
+    rw [← frame.values_eq]
+    exact resolved
+  obtain ⟨rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransfer transferred
+  refine ⟨Step.switchNatSucc rfl sourceAt pc terminator resolved transferred,
+    Step.switchNatSucc rfl targetAt targetPc terminator targetResolved
+      rewrittenTransfer, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- A present optional credit selects the same unchanged branch and carries
+its checked edge into the rewritten definition. -/
+theorem unchangedBranchCreditPresentStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {someEdge noneEdge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup baselineFrame creditId credit)
+    (present : credit.isPresent = true)
+    (transferred : EdgeTransfer baselineFrame someEdge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTarget :=
+      { baselineTarget with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running rewrittenTarget rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetLookup := lookedUp.congrDefinition rewrite.definition
+  rw [← frame.rewritten_eq] at targetLookup
+  obtain ⟨rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransfer transferred
+  refine ⟨Step.branchCreditPresent rfl sourceAt pc terminator lookedUp
+      present transferred,
+    Step.branchCreditPresent rfl targetAt targetPc terminator targetLookup
+      present rewrittenTransfer, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- An absent optional credit selects and transports the same fallback edge. -/
+theorem unchangedBranchCreditAbsentStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {someEdge noneEdge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup baselineFrame creditId credit)
+    (absent : credit.isPresent = false)
+    (transferred : EdgeTransfer baselineFrame noneEdge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let rewrittenTarget :=
+      { baselineTarget with definition := rewrite.definition }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    let rewrittenNext : Machine :=
+      { rewrittenMachine with
+        control := .running rewrittenTarget rewrittenStack }
+    Step baselineContext interpretation baselineMachine baselineNext ∧
+      Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+      StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetLookup := lookedUp.congrDefinition rewrite.definition
+  rw [← frame.rewritten_eq] at targetLookup
+  obtain ⟨rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransfer transferred
+  refine ⟨Step.branchCreditAbsent rfl sourceAt pc terminator lookedUp
+      absent transferred,
+    Step.branchCreditAbsent rfl targetAt targetPc terminator targetLookup
+      absent rewrittenTransfer, ?_⟩
+  exact .related (fun left right => left = right) (.contents heap) fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- An unchanged shared retain executes on both exact-content heaps and
+preserves the stable relation. -/
+theorem unchangedRetainSharedStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .retainShared atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (retained : Eval.retainShared baselineStore value = .ok baselineOut) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineFuel
+        control := .running
+          { baselineFrame with
+            pc := baselineFrame.pc + 1
+            values := baselineFrame.values.push value }
+          baselineStack }
+    ∃ rewrittenOut,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenFuel
+          control := .running
+            { rewrittenFrame with
+              pc := rewrittenFrame.pc + 1
+              values := rewrittenFrame.values.push value }
+            rewrittenStack }
+      Eval.retainShared rewrittenStore value = .ok rewrittenOut ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .retainShared atom := by
+    simpa only [← pcs] using instruction
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  obtain ⟨rewrittenOut, targetRetained, outputHeap⟩ :=
+    heap.retainShared retained
+  refine ⟨rewrittenOut, targetRetained,
+    Step.retainShared rfl sourceAt pc instruction resolved retained,
+    Step.retainShared rfl targetAt targetPc targetInstruction
+      targetResolved targetRetained, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap) fuel
+    (.running
+      (.rewritten rewrite (frame.advancePush (IxIR1.Sim.RValIso.refl value)))
+      stack)
+
+/-- An unchanged deep shared release remains executable when the rewritten
+machine has at least the baseline heap fuel.  Any saved fuel is carried into
+the rewritten remainder. -/
+theorem unchangedReleaseSharedStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] =
+      .releaseShared atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (released : Eval.releaseShared baselineFuel baselineStore value =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenOut rewrittenRemaining,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      Eval.releaseShared rewrittenFuel rewrittenStore value =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .releaseShared atom := by
+    simpa only [← pcs] using instruction
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  obtain ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+      outputHeap, outputFuel⟩ :=
+    heap.releaseShared_of_le fuel released
+  refine ⟨rewrittenOut, rewrittenRemaining, targetReleased,
+    Step.releaseShared rfl sourceAt pc instruction resolved released,
+    Step.releaseShared rfl targetAt targetPc targetInstruction
+      targetResolved targetReleased, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap)
+    outputFuel
+    (.running (.rewritten rewrite frame.advance) stack)
+
+/-- The unchanged unique-drop case has the same fuel-dominance behavior as
+shared release. -/
+theorem unchangedDropUniqueStep {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore baselineOut : Store}
+    {baselineFuel rewrittenFuel baselineRemaining : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {atom : Atom} {value : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instruction : block.instructions[baselineFrame.pc] = .dropUnique atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok value)
+    (dropped : Eval.dropUnique baselineFuel baselineStore value =
+      .ok (baselineOut, baselineRemaining)) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { store := baselineOut
+        heapFuel := baselineRemaining
+        control := .running
+          { baselineFrame with pc := baselineFrame.pc + 1 }
+          baselineStack }
+    ∃ rewrittenOut rewrittenRemaining,
+      let rewrittenNext : Machine :=
+        { store := rewrittenOut
+          heapFuel := rewrittenRemaining
+          control := .running
+            { rewrittenFrame with pc := rewrittenFrame.pc + 1 }
+            rewrittenStack }
+      Eval.dropUnique rewrittenFuel rewrittenStore value =
+          .ok (rewrittenOut, rewrittenRemaining) ∧
+        Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have pcs : baselineFrame.pc = rewrittenFrame.pc := frame.pc
+  have targetPc : rewrittenFrame.pc < block.instructions.size := by
+    omega
+  have targetInstruction : block.instructions[rewrittenFrame.pc] =
+      .dropUnique atom := by
+    simpa only [← pcs] using instruction
+  have targetResolved :
+      resolveAtom rewrittenFrame.values atom = .ok value := by
+    rw [← frame.values_eq]
+    exact resolved
+  obtain ⟨rewrittenOut, rewrittenRemaining, targetDropped,
+      outputHeap, outputFuel⟩ := heap.dropUnique_of_le fuel dropped
+  refine ⟨rewrittenOut, rewrittenRemaining, targetDropped,
+    Step.dropUnique rfl sourceAt pc instruction resolved dropped,
+    Step.dropUnique rfl targetAt targetPc targetInstruction
+      targetResolved targetDropped, ?_⟩
+  exact .related (fun left right => left = right) (.contents outputHeap)
+    outputFuel
+    (.running (.rewritten rewrite frame.advance) stack)
+
+/-! ## Exhaustive unchanged-block dispatch -/
+
+set_option maxHeartbeats 1000000 in
+/-- Every successful instruction in an unchanged block is equivariant under
+an arbitrary allocation-history isomorphism. -/
+theorem unchangedInstructionStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {instruction : Instr} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instructionAt : block.instructions[baselineFrame.pc] = instruction)
+    (classified : InstructionTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      instruction baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases classified with
+  | move resolved =>
+      obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+        unchangedMoveStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | alloc schemaAt resolved fields =>
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedAllocStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      obtain ⟨rewrittenValues, rewrittenTaken, sourceStep, targetStep,
+          related⟩ :=
+        unchangedAllocWithAbsentStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout absent
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithLogical mode schemaAt resolved fields taken layout present =>
+      cases mode
+      obtain ⟨rewrittenValues, rewrittenTaken, sourceStep, targetStep,
+          related⟩ :=
+        unchangedAllocWithLogicalStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout present
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithPhysical mode schemaAt resolved fields taken layout present
+      reused =>
+      cases mode
+      obtain ⟨rewrittenValues, rewrittenTaken, rewrittenLocation,
+          rewrittenOut, targetReused, sourceStep, targetStep, related⟩ :=
+        unchangedAllocWithPhysicalStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout present reused
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardAbsent taken absent =>
+      obtain ⟨rewrittenTaken, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditAbsentStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken absent
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardLogical mode taken present =>
+      cases mode
+      obtain ⟨rewrittenTaken, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditLogicalStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken present
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardPhysical mode taken present released =>
+      cases mode
+      obtain ⟨rewrittenTaken, rewrittenLocation, rewrittenOut,
+          targetReleased, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditPhysicalStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken present released
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | takeUniqueLogical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedTakeUniqueLogicalStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedTakeUniquePhysicalStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | resetSharedLogicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedResetSharedLogicalHotStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      obtain ⟨rewrittenLocation, rewrittenFields, sourceStep, targetStep,
+          related⟩ :=
+        unchangedResetSharedPhysicalHotStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          unitRC
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | resetSharedCold schemaAt resolved viewed shared retained =>
+      obtain ⟨rewrittenFields, rewrittenOut, sourceStep, targetStep,
+          related⟩ :=
+        unchangedResetSharedColdStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          shared retained
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retainShared resolved retained =>
+      obtain ⟨rewrittenValue, rewrittenOut, targetRetained, sourceStep,
+          targetStep, related⟩ :=
+        unchangedRetainSharedStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved retained
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | releaseShared resolved released =>
+      obtain ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+          targetReleased, sourceStep, targetStep, related⟩ :=
+        unchangedReleaseSharedStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved released
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | dropUnique resolved dropped =>
+      obtain ⟨rewrittenValue, rewrittenOut, rewrittenRemaining,
+          targetDropped, sourceStep, targetStep, related⟩ :=
+        unchangedDropUniqueStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved dropped
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | freeUnique resolved viewed scalarFields =>
+      obtain ⟨boxAt, unique, node⟩ := viewed.parts
+      obtain ⟨rewrittenLocation, sourceStep, targetStep, related⟩ :=
+        unchangedFreeUniqueStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved boxAt unique node
+          scalarFields
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | fetch resolved boxAt node fieldAt =>
+      obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+        unchangedFetchStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved boxAt node fieldAt
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | callFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedCallFnStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+          frame stack sourceAt targetAt pc instructionAt noCredits resolved
+          declaration targetDeclaration arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | callSelf noCredits resolved arity nonempty =>
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedCallSelfStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt noCredits resolved arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | pappFn noCredits declaration papSafe resolved under =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedPappFnStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+          frame stack sourceAt targetAt pc instructionAt noCredits declaration
+          targetDeclaration papSafe resolved under
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | pappExtern noCredits declaration resolved under =>
+      have targetDeclaration := trace.context_extern declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedPappExternStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt noCredits declaration
+          targetDeclaration resolved under
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact unchangedApplyStepOfTraceIso trace rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt noCredits functionResolved
+        argumentsResolved transferred
+  | extern noCredits resolved declaration argumentArity called =>
+      have targetDeclaration := trace.context_extern declaration
+      obtain ⟨sourceStep, targetStep, related⟩ :=
+        unchangedExternStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          rfl sourceAt targetAt pc instructionAt noCredits resolved declaration
+          targetDeclaration argumentArity called
+      exact ⟨_, sourceStep, targetStep, related⟩
+
+set_option maxHeartbeats 1000000 in
+/-- Every successful instruction in an unchanged block has a matching target
+step and a stable exact-content successor.  The public evaluator case witness
+is exhaustive; the whole-program trace supplies any rewritten function or
+preserved extern declaration selected dynamically. -/
+theorem unchangedInstructionStepOfTrace {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {instruction : Instr} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc < block.instructions.size)
+    (instructionAt : block.instructions[baselineFrame.pc] = instruction)
+    (classified : InstructionTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      instruction baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases classified with
+  | move resolved =>
+      exact ⟨_, unchangedMoveStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt resolved⟩
+  | alloc schemaAt resolved fields =>
+      obtain ⟨sourceStep, targetStep, related⟩ :=
+        unchangedAllocStep (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | allocWithAbsent schemaAt resolved fields taken layout absent =>
+      exact ⟨_, unchangedAllocWithAbsentStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+        stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+        taken layout absent⟩
+  | allocWithLogical mode schemaAt resolved fields taken layout present =>
+      cases mode
+      exact ⟨_, unchangedAllocWithLogicalStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+        stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+        taken layout present⟩
+  | allocWithPhysical mode schemaAt resolved fields taken layout present
+      reused =>
+      cases mode
+      obtain ⟨rewrittenOut, targetReused, sourceStep, targetStep, related⟩ :=
+        unchangedAllocWithPhysicalStep (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved fields
+          taken layout present reused
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | discardAbsent taken absent =>
+      exact ⟨_, unchangedDiscardCreditAbsentStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt taken absent⟩
+  | discardLogical mode taken present =>
+      cases mode
+      exact ⟨_, unchangedDiscardCreditLogicalStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt taken present⟩
+  | discardPhysical mode taken present released =>
+      cases mode
+      obtain ⟨rewrittenOut, targetReleased, sourceStep, targetStep, related⟩ :=
+        unchangedDiscardCreditPhysicalStep
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt taken present released
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | takeUniqueLogical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact ⟨_, unchangedTakeUniqueLogicalStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+        stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+        unitRC⟩
+  | takeUniquePhysical mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact ⟨_, unchangedTakeUniquePhysicalStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+        stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+        unitRC⟩
+  | resetSharedLogicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact ⟨_, unchangedResetSharedLogicalHotStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+        stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+        unitRC⟩
+  | resetSharedPhysicalHot mode schemaAt resolved viewed unitRC =>
+      cases mode
+      exact ⟨_, unchangedResetSharedPhysicalHotStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+        stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+        unitRC⟩
+  | resetSharedCold schemaAt resolved viewed shared retained =>
+      obtain ⟨rewrittenOut, targetRetained, sourceStep, targetStep, related⟩ :=
+        unchangedResetSharedColdStep (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite rfl heap fuel frame
+          stack sourceAt targetAt pc instructionAt schemaAt resolved viewed
+          shared retained
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retainShared resolved retained =>
+      obtain ⟨rewrittenOut, targetRetained, sourceStep, targetStep, related⟩ :=
+        unchangedRetainSharedStep (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved retained
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | releaseShared resolved released =>
+      obtain ⟨rewrittenOut, rewrittenRemaining, targetReleased, sourceStep,
+          targetStep, related⟩ :=
+        unchangedReleaseSharedStep (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved released
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | dropUnique resolved dropped =>
+      obtain ⟨rewrittenOut, rewrittenRemaining, targetDropped, sourceStep,
+          targetStep, related⟩ :=
+        unchangedDropUniqueStep (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt resolved dropped
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | freeUnique resolved viewed scalarFields =>
+      obtain ⟨boxAt, unique, node⟩ := viewed.parts
+      exact ⟨_, unchangedFreeUniqueStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt resolved boxAt unique node
+        scalarFields⟩
+  | fetch resolved boxAt node fieldAt =>
+      exact ⟨_, unchangedFetchStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt resolved boxAt node fieldAt⟩
+  | callFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      exact ⟨_, unchangedCallFnStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+        frame stack sourceAt targetAt pc instructionAt noCredits resolved
+        declaration targetDeclaration arity nonempty⟩
+  | callSelf noCredits resolved arity nonempty =>
+      exact ⟨_, unchangedCallSelfStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt noCredits resolved arity nonempty⟩
+  | pappFn noCredits declaration papSafe resolved under =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      exact ⟨_, unchangedPappFnStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+        frame stack sourceAt targetAt pc instructionAt noCredits declaration
+        targetDeclaration papSafe resolved under⟩
+  | pappExtern noCredits declaration resolved under =>
+      have targetDeclaration := trace.context_extern declaration
+      exact ⟨_, unchangedPappExternStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt noCredits declaration
+        targetDeclaration resolved under⟩
+  | apply noCredits functionResolved argumentsResolved transferred =>
+      exact unchangedApplyStepOfTrace trace rewrite heap fuel frame stack
+        sourceAt targetAt pc instructionAt noCredits functionResolved
+        argumentsResolved transferred
+  | extern noCredits resolved declaration argumentArity called =>
+      have targetDeclaration := trace.context_extern declaration
+      exact ⟨_, unchangedExternStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        rfl sourceAt targetAt pc instructionAt noCredits resolved declaration
+        targetDeclaration argumentArity called⟩
+
+/-! ## Allocation-history unchanged terminators -/
+
+/-- An unchanged jump transports related explicit values and linear credits
+through the selected target-block ABI. -/
+theorem unchangedJumpStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {edge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .jump edge)
+    (transferred : EdgeTransfer baselineFrame edge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransferIso (.nil) transferred
+  refine ⟨rewrittenTarget,
+    Step.jump rfl sourceAt pc terminator transferred,
+    Step.jump rfl targetAt targetPc terminator rewrittenTransfer, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- The zero arm of a Nat switch preserves its literal observation and
+transports the selected edge under the heap history. -/
+theorem unchangedSwitchNatZeroStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {peel : NatPeel}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : resolveAtom baselineFrame.values scrutinee =
+      .ok (.lit (.nat 0)))
+    (transferred : EdgeTransfer baselineFrame peel.zero #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases valueRelated with
+  | lit =>
+      have targetPc : rewrittenFrame.pc = block.instructions.size :=
+        frame.pc.symm.trans pc
+      obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+        frame.edgeTransferIso (.nil) transferred
+      refine ⟨rewrittenTarget,
+        Step.switchNatZero rfl sourceAt pc terminator resolved transferred,
+        Step.switchNatZero rfl targetAt targetPc terminator targetResolved
+          rewrittenTransfer, ?_⟩
+      exact StableMachineRel.history heap fuel
+        (.running (.rewritten rewrite targetFrame) stack)
+
+/-- The successor arm preserves its scalar predecessor and transports the
+selected edge under the heap history. -/
+theorem unchangedSwitchNatSuccStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {peel : NatPeel} {predecessor : Nat}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors (some peel))
+    (resolved : resolveAtom baselineFrame.values scrutinee =
+      .ok (.lit (.nat (predecessor + 1))))
+    (transferred : EdgeTransfer baselineFrame peel.succ
+      #[.lit (.nat predecessor)] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases valueRelated with
+  | lit =>
+      have targetPc : rewrittenFrame.pc = block.instructions.size :=
+        frame.pc.symm.trans pc
+      obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+        frame.edgeTransferIso (.cons .lit .nil) transferred
+      refine ⟨rewrittenTarget,
+        Step.switchNatSucc rfl sourceAt pc terminator resolved transferred,
+        Step.switchNatSucc rfl targetAt targetPc terminator targetResolved
+          rewrittenTransfer, ?_⟩
+      exact StableMachineRel.history heap fuel
+        (.running (.rewritten rewrite targetFrame) stack)
+
+/-- Constructor dispatch follows the related scrutinee location, observes a
+constructor with the same identity, and transports its selected edge. -/
+theorem unchangedSwitchCtorStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {scrutinee : Atom} {constructors : Array CtorAlt}
+    {natPeel : Option NatPeel} {baselineLocation : Nat} {box : NodeBox}
+    {cid : CtorId} {fields : Array RVal} {alternative : CtorAlt}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .switchValue scrutinee constructors natPeel)
+    (resolved : resolveAtom baselineFrame.values scrutinee =
+      .ok (.loc baselineLocation))
+    (boxAt : baselineStore.get? baselineLocation = some box)
+    (node : box.node = .ctorN cid fields)
+    (alternativeAt : constructors.find? (fun candidate =>
+      candidate.cid == cid) = some alternative)
+    (transferred : EdgeTransfer baselineFrame alternative.edge #[]
+      baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  cases valueRelated with
+  | @loc _ rewrittenLocation locations =>
+      obtain ⟨rewrittenBox, targetBoxAt, boxesRelated⟩ :=
+        heap.boxes locations (by
+          change baselineStore.heap.get? baselineLocation = some box
+          exact boxAt)
+      have nodesRelated : IxIR1.Sim.NodeIso heap.locRel
+          (.ctorN cid fields) rewrittenBox.node := by
+        rw [← node]
+        exact boxesRelated.node
+      obtain ⟨rewrittenFields, targetNode, _fieldsRelated⟩ :=
+        nodeIso_ctor_left nodesRelated
+      have targetPc : rewrittenFrame.pc = block.instructions.size :=
+        frame.pc.symm.trans pc
+      obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+        frame.edgeTransferIso (.nil) transferred
+      refine ⟨rewrittenTarget,
+        Step.switchCtor rfl sourceAt pc terminator resolved boxAt node
+          alternativeAt transferred,
+        Step.switchCtor rfl targetAt targetPc terminator targetResolved
+          (by
+            change rewrittenStore.heap.get? rewrittenLocation =
+              some rewrittenBox
+            exact targetBoxAt)
+          targetNode alternativeAt rewrittenTransfer, ?_⟩
+      exact StableMachineRel.history heap fuel
+        (.running (.rewritten rewrite targetFrame) stack)
+
+/-- A present optional credit selects the corresponding target branch; the
+credit itself and all credits transferred by the edge may carry related
+physical addresses. -/
+theorem unchangedBranchCreditPresentStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {someEdge noneEdge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup baselineFrame creditId credit)
+    (present : credit.isPresent = true)
+    (transferred : EdgeTransfer baselineFrame someEdge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenCredit, targetLookup, creditRelated⟩ :=
+    frame.creditLookup lookedUp
+  have targetPresent : rewrittenCredit.isPresent = true := by
+    rw [← creditRelated.present_parts.2]
+    exact present
+  obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransferIso (.nil) transferred
+  refine ⟨rewrittenTarget,
+    Step.branchCreditPresent rfl sourceAt pc terminator lookedUp present
+      transferred,
+    Step.branchCreditPresent rfl targetAt targetPc terminator targetLookup
+      targetPresent rewrittenTransfer, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- An absent optional credit selects the fallback target branch under the
+same relation-aware edge transfer. -/
+theorem unchangedBranchCreditAbsentStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineTarget : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {creditId : CreditId} {credit : Credit}
+    {someEdge noneEdge : Edge}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator =
+      .branchCredit creditId someEdge noneEdge)
+    (lookedUp : CreditLookup baselineFrame creditId credit)
+    (absent : credit.isPresent = false)
+    (transferred : EdgeTransfer baselineFrame noneEdge #[] baselineTarget) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .running baselineTarget baselineStack }
+    ∃ rewrittenTarget : Frame,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running rewrittenTarget rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  obtain ⟨rewrittenCredit, targetLookup, creditRelated⟩ :=
+    frame.creditLookup lookedUp
+  have targetAbsent : rewrittenCredit.isPresent = false := by
+    rw [← creditRelated.present_parts.2]
+    exact absent
+  obtain ⟨rewrittenTarget, rewrittenTransfer, targetFrame⟩ :=
+    frame.edgeTransferIso (.nil) transferred
+  refine ⟨rewrittenTarget,
+    Step.branchCreditAbsent rfl sourceAt pc terminator lookedUp absent
+      transferred,
+    Step.branchCreditAbsent rfl targetAt targetPc terminator targetLookup
+      targetAbsent rewrittenTransfer, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (.rewritten rewrite targetFrame) stack)
+
+/-- A recursive tail call resolves a related argument vector and re-enters
+the two versions of the current function without changing the related stack. -/
+theorem unchangedTailCallSelfStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {arguments : Array Atom}
+    {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCallSelf arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (arity : baselineValues.size =
+      baselineFrame.definition.signature.params.size)
+    (nonempty : baselineFrame.definition.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := baselineFrame.definition, values := baselineValues }
+          baselineStack }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := rewrittenFrame.definition,
+              values := rewrittenValues }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using rvalsIso_length_eq valuesRelated
+  have sourceArity : baselineValues.size = source.signature.params.size := by
+    simpa [frame.baselineDefinition] using arity
+  have targetArity : rewrittenValues.size =
+      rewrittenFrame.definition.signature.params.size := by
+    rw [← sizeEq, frame.rewrittenDefinition, rewrite.definition_signature]
+    exact sourceArity
+  have targetNonempty : rewrittenFrame.definition.blocks.isEmpty = false :=
+    blocks_nonempty_of_getElem targetAt
+  refine ⟨rewrittenValues,
+    Step.tailCallSelfCleared rfl sourceAt pc terminator noCredits resolved
+      arity nonempty,
+    Step.tailCallSelfCleared rfl targetAt targetPc terminator targetNoCredits
+      targetResolved targetArity targetNonempty, ?_⟩
+  have callee : StableFrameRel limits validation heap.locRel
+      { definition := baselineFrame.definition, values := baselineValues }
+      { definition := rewrittenFrame.definition, values := rewrittenValues } := by
+    rw [frame.baselineDefinition, frame.rewrittenDefinition]
+    exact StableFrameRel.entry rewrite valuesRelated
+  exact StableMachineRel.history heap fuel (.running callee stack)
+
+/-- A direct tail call follows the declaration rewrite at the same address
+and enters the related callee argument vectors. -/
+theorem unchangedTailCallFnStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {callerSource calleeSource : Function}
+    (callerRewrite : Reuse.FunctionRewrite limits validation callerSource)
+    (calleeRewrite : Reuse.FunctionRewrite limits validation calleeSource)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso callerRewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {address : Ix.Compiler.Ixon.Address}
+    {arguments : Array Atom} {baselineValues : Array RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .tailCall address arguments)
+    (noCredits : NoLiveCredits baselineFrame)
+    (resolved : resolveAtoms baselineFrame.values arguments =
+      .ok baselineValues)
+    (baselineDeclaration : baselineContext.declarations address =
+      some (.fn calleeSource))
+    (rewrittenDeclaration : rewrittenContext.declarations address =
+      some (.fn calleeRewrite.definition))
+    (arity : baselineValues.size = calleeSource.signature.params.size)
+    (nonempty : calleeSource.blocks.isEmpty = false) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { definition := calleeSource, values := baselineValues }
+          baselineStack }
+    ∃ rewrittenValues,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { definition := calleeRewrite.definition,
+              values := rewrittenValues }
+            rewrittenStack }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValues, targetResolved, valuesRelated⟩ :=
+    resolveAtoms_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have sizeEq : baselineValues.size = rewrittenValues.size := by
+    simpa using rvalsIso_length_eq valuesRelated
+  have targetArity : rewrittenValues.size =
+      calleeRewrite.definition.signature.params.size := by
+    rw [← sizeEq]
+    simpa using arity
+  have targetNonempty : calleeRewrite.definition.blocks.isEmpty = false :=
+    calleeRewrite.definition_blocks_nonempty nonempty
+  refine ⟨rewrittenValues,
+    Step.tailCallFnCleared rfl sourceAt pc terminator noCredits resolved
+      baselineDeclaration arity nonempty,
+    Step.tailCallFnCleared rfl targetAt targetPc terminator targetNoCredits
+      targetResolved rewrittenDeclaration targetArity targetNonempty, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (StableFrameRel.entry calleeRewrite valuesRelated) stack)
+
+/-- An ordinary return resolves related results, transports the result-world
+check through the heap history, and pushes them into related suspended
+callers. -/
+theorem unchangedRetResumeStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {baselineRest rewrittenRest : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (caller : StableFrameRel limits validation heap.locRel
+      baselineCaller rewrittenCaller)
+    (rest : StableStackIso limits validation heap.locRel
+      baselineRest rewrittenRest)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : baselineValue.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame
+          (.resume baselineCaller :: baselineRest) }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame
+          (.resume rewrittenCaller :: rewrittenRest) }
+    let baselineNext : Machine :=
+      { baselineMachine with
+        control := .running
+          { baselineCaller with
+            values := baselineCaller.values.push baselineValue }
+          baselineRest }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with
+          control := .running
+            { rewrittenCaller with
+              values := rewrittenCaller.values.push rewrittenValue }
+            rewrittenRest }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : rewrittenValue.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq,
+      ← heapHistoryIso_rvalHasWorld_eq heap valueRelated]
+    exact world
+  refine ⟨rewrittenValue,
+    Step.retResumeCleared rfl sourceAt pc terminator resolved noCredits world,
+    Step.retResumeCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld, ?_⟩
+  exact StableMachineRel.history heap fuel
+    (.running (caller.push valueRelated) rest)
+
+/-- An outermost return halts with related results after transporting the
+callee result-world check through the heap history. -/
+theorem unchangedRetHaltStepIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : baselineValue.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame [] }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame [] }
+    let baselineNext : Machine :=
+      { baselineMachine with control := .halted baselineValue }
+    ∃ rewrittenValue,
+      let rewrittenNext : Machine :=
+        { rewrittenMachine with control := .halted rewrittenValue }
+      Step baselineContext interpretation baselineMachine baselineNext ∧
+        Step rewrittenContext interpretation rewrittenMachine rewrittenNext ∧
+        StableMachineRel limits validation baselineNext rewrittenNext := by
+  dsimp only
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : rewrittenValue.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq,
+      ← heapHistoryIso_rvalHasWorld_eq heap valueRelated]
+    exact world
+  refine ⟨rewrittenValue,
+    Step.retHaltCleared rfl sourceAt pc terminator resolved noCredits world,
+    Step.retHaltCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld, ?_⟩
+  exact StableMachineRel.history heap fuel (.halted valueRelated)
+
+/-- A return through `applyMore` resolves related return values and feeds the
+related saved argument vectors through the exhaustive dynamic application
+simulation. -/
+theorem unchangedRetApplyMoreStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame baselineCaller rewrittenCaller : Frame}
+    {baselineArguments rewrittenArguments : Array RVal}
+    {baselineRest rewrittenRest : List Continuation}
+    {baselineTarget : Machine}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (arguments : IxIR1.Sim.RValsIso heap.locRel
+      baselineArguments.toList rewrittenArguments.toList)
+    (caller : StableFrameRel limits validation heap.locRel
+      baselineCaller rewrittenCaller)
+    (rest : StableStackIso limits validation heap.locRel
+      baselineRest rewrittenRest)
+    {block : Block} {atom : Atom} {baselineValue : RVal}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminator : block.terminator = .ret atom)
+    (resolved : resolveAtom baselineFrame.values atom = .ok baselineValue)
+    (noCredits : NoLiveCredits baselineFrame)
+    (world : baselineValue.hasWorld baselineStore
+      baselineFrame.definition.signature.result = true)
+    (transferred : ApplyTransfer
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineValue
+      baselineArguments baselineCaller baselineRest baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame
+              (.applyMore baselineArguments baselineCaller :: baselineRest) }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame
+              (.applyMore rewrittenArguments rewrittenCaller ::
+                rewrittenRest) }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  obtain ⟨rewrittenValue, targetResolved, valueRelated⟩ :=
+    resolveAtom_iso frame.values resolved
+  have targetPc : rewrittenFrame.pc = block.instructions.size :=
+    frame.pc.symm.trans pc
+  have targetNoCredits := frame.noLiveCredits noCredits
+  have resultWorldEq : rewrittenFrame.definition.signature.result =
+      baselineFrame.definition.signature.result := by
+    rw [frame.rewrittenDefinition, rewrite.definition_signature,
+      frame.baselineDefinition]
+  have targetWorld : rewrittenValue.hasWorld rewrittenStore
+      rewrittenFrame.definition.signature.result = true := by
+    rw [resultWorldEq,
+      ← heapHistoryIso_rvalHasWorld_eq heap valueRelated]
+    exact world
+  obtain ⟨rewrittenTarget, targetTransferred, related⟩ :=
+    unchangedApplyTransferIso trace heap fuel valueRelated arguments caller
+      rest transferred
+  refine ⟨rewrittenTarget,
+    Step.retApplyMoreCleared rfl sourceAt pc terminator resolved noCredits
+      world transferred,
+    Step.retApplyMoreCleared rfl targetAt targetPc terminator targetResolved
+      targetNoCredits targetWorld targetTransferred,
+    related⟩
+
+set_option maxHeartbeats 1000000 in
+/-- Every successful terminator in an unchanged block is equivariant under
+an arbitrary allocation-history isomorphism. -/
+theorem unchangedTerminatorStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {terminator : Terminator} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    (classified : TerminatorTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      terminator baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases classified with
+  | jump transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedJumpStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedSwitchCtorStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt resolved boxAt node alternativeAt
+          transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | switchNatZero resolved transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedSwitchNatZeroStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt resolved transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | switchNatSucc resolved transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedSwitchNatSuccStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt resolved transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | branchPresent lookedUp present transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedBranchCreditPresentStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt lookedUp present transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | branchAbsent lookedUp absent transferred =>
+      obtain ⟨rewrittenFrameTarget, sourceStep, targetStep, related⟩ :=
+        unchangedBranchCreditAbsentStepIso
+          (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt lookedUp absent transferred
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retResume resolved noCredits world =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | resume caller =>
+              obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+                unchangedRetResumeStepIso
+                  (baselineContext := baselineContext)
+                  (rewrittenContext := rewrittenContext) rewrite heap fuel
+                  frame caller rest sourceAt targetAt pc terminatorAt resolved
+                  noCredits world
+              exact ⟨_, sourceStep, targetStep, related⟩
+  | retHalt resolved noCredits world =>
+      cases stack
+      obtain ⟨rewrittenValue, sourceStep, targetStep, related⟩ :=
+        unchangedRetHaltStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame
+          sourceAt targetAt pc terminatorAt resolved noCredits world
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | retApplyMore resolved noCredits world transferred =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | applyMore arguments caller =>
+              exact unchangedRetApplyMoreStepOfTraceIso trace rewrite heap
+                fuel frame arguments caller rest sourceAt targetAt pc
+                terminatorAt resolved noCredits world transferred
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedTailCallFnStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+          frame stack sourceAt targetAt pc terminatorAt noCredits resolved
+          declaration targetDeclaration arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+  | tailCallSelf noCredits resolved arity nonempty =>
+      obtain ⟨rewrittenValues, sourceStep, targetStep, related⟩ :=
+        unchangedTailCallSelfStepIso (baselineContext := baselineContext)
+          (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt noCredits resolved arity nonempty
+      exact ⟨_, sourceStep, targetStep, related⟩
+
+/-- A source step at a literally preserved block is matched under any
+allocation-history isomorphism.  Instruction and terminator classification
+remain entirely behind the public evaluator interfaces. -/
+theorem unchangedStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {block : Block} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  have classified := stepped.classify
+  cases classified with
+  | instruction classifiedAt pc instructionAt instructionCase =>
+      have blockEq := Option.some.inj (classifiedAt.symm.trans sourceAt)
+      cases blockEq
+      obtain ⟨rewrittenTarget, _sourceStep, targetStep, related⟩ :=
+        unchangedInstructionStepOfTraceIso trace rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt instructionCase
+      exact ⟨rewrittenTarget, targetStep, related⟩
+  | terminator classifiedAt pc terminatorAt terminatorCase =>
+      have blockEq := Option.some.inj (classifiedAt.symm.trans sourceAt)
+      cases blockEq
+      obtain ⟨rewrittenTarget, _sourceStep, targetStep, related⟩ :=
+        unchangedTerminatorStepOfTraceIso trace rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt terminatorCase
+      exact ⟨rewrittenTarget, targetStep, related⟩
+
+/-- Every successful terminator in an unchanged block has a matching target
+step and stable successor.  Indexed stack cases expose ordinary returns,
+outermost returns, and over-application returns without any private evaluator
+unfolding. -/
+theorem unchangedTerminatorStepOfTrace {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {terminator : Terminator} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (pc : baselineFrame.pc = block.instructions.size)
+    (terminatorAt : block.terminator = terminator)
+    (classified : TerminatorTransferCase
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation baselineStore baselineFuel baselineFrame baselineStack
+      terminator baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          baselineTarget ∧
+        Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  let baselineContext :=
+    Eval.Context.ofProgram sourceProgram validation.schemas oracle
+  let rewrittenContext :=
+    Eval.Context.ofProgram trace.target validation.schemas oracle
+  cases classified with
+  | jump transferred =>
+      exact ⟨_, unchangedJumpStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt transferred⟩
+  | switchCtor resolved boxAt node alternativeAt transferred =>
+      exact ⟨_, unchangedSwitchCtorStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt resolved boxAt node alternativeAt
+        transferred⟩
+  | switchNatZero resolved transferred =>
+      exact ⟨_, unchangedSwitchNatZeroStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt resolved transferred⟩
+  | switchNatSucc resolved transferred =>
+      exact ⟨_, unchangedSwitchNatSuccStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt resolved transferred⟩
+  | branchPresent lookedUp present transferred =>
+      exact ⟨_, unchangedBranchCreditPresentStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt lookedUp present transferred⟩
+  | branchAbsent lookedUp absent transferred =>
+      exact ⟨_, unchangedBranchCreditAbsentStep
+        (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt lookedUp absent transferred⟩
+  | retResume resolved noCredits world =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | resume caller =>
+              exact ⟨_, unchangedRetResumeStep
+                (baselineContext := baselineContext)
+                (rewrittenContext := rewrittenContext) rewrite heap fuel frame
+                caller rest sourceAt targetAt pc terminatorAt resolved
+                noCredits world⟩
+  | retHalt resolved noCredits world =>
+      cases stack
+      exact ⟨_, unchangedRetHaltStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame sourceAt
+        targetAt pc terminatorAt resolved noCredits world⟩
+  | retApplyMore resolved noCredits world transferred =>
+      cases stack with
+      | cons head rest =>
+          cases head with
+          | applyMore arguments caller =>
+              have argumentsEq := arguments.eq_of_location_eq
+              have arraysEq := Array.toList_inj.mp argumentsEq
+              subst_vars
+              exact unchangedRetApplyMoreStepOfTrace trace rewrite heap fuel
+                frame caller rest sourceAt targetAt pc terminatorAt resolved
+                noCredits world transferred
+  | tailCallFn noCredits resolved declaration arity nonempty =>
+      obtain ⟨calleeRewrite, targetDeclaration⟩ :=
+        trace.context_fn declaration
+      exact ⟨_, unchangedTailCallFnStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite calleeRewrite heap fuel
+        frame stack sourceAt targetAt pc terminatorAt noCredits resolved
+        declaration targetDeclaration arity nonempty⟩
+  | tailCallSelf noCredits resolved arity nonempty =>
+      exact ⟨_, unchangedTailCallSelfStep (baselineContext := baselineContext)
+        (rewrittenContext := rewrittenContext) rewrite heap fuel frame stack
+        sourceAt targetAt pc terminatorAt noCredits resolved arity nonempty⟩
+
+/-- A single public source step at a literally preserved block is matched by
+one target step.  This is the whole-step unchanged arm: evaluator inversion,
+instruction/terminator dispatch, declarations, heap effects, fuel, frames,
+and continuation stacks are all discharged below this interface. -/
+theorem unchangedStepOfTrace {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {block : Block} {baselineTarget : Machine}
+    (sourceAt : baselineFrame.definition.blocks[baselineFrame.block]? =
+      some block)
+    (targetAt : rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+      some block)
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineTarget) :
+    ∃ rewrittenTarget,
+      Step (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }
+          rewrittenTarget ∧
+        StableMachineRel limits validation baselineTarget rewrittenTarget := by
+  have classified := stepped.classify
+  cases classified with
+  | instruction classifiedAt pc instructionAt instructionCase =>
+      have blockEq := Option.some.inj (classifiedAt.symm.trans sourceAt)
+      cases blockEq
+      obtain ⟨rewrittenTarget, _sourceStep, targetStep, related⟩ :=
+        unchangedInstructionStepOfTrace trace rewrite heap fuel frame stack
+          sourceAt targetAt pc instructionAt instructionCase
+      exact ⟨rewrittenTarget, targetStep, related⟩
+  | terminator classifiedAt pc terminatorAt terminatorCase =>
+      have blockEq := Option.some.inj (classifiedAt.symm.trans sourceAt)
+      cases blockEq
+      obtain ⟨rewrittenTarget, _sourceStep, targetStep, related⟩ :=
+        unchangedTerminatorStepOfTrace trace rewrite heap fuel frame stack
+          sourceAt targetAt pc terminatorAt terminatorCase
+      exact ⟨rewrittenTarget, targetStep, related⟩
+
+/-- A synchronization-sized transition: each machine takes a positive finite
+number of genuine running steps and the two endpoints satisfy the uniform
+stable relation.  Unchanged blocks use one step on each side; an accepted
+reset/reuse block uses its complete source and replacement macros. -/
+inductive StableMacroSimulation (limits : Validate.Limits)
+    (validation : Validate.Context) (baselineContext rewrittenContext :
+      Eval.Context) (interpretation : Interpretation)
+    (baselineStart rewrittenStart : Machine) : Prop where
+  | intro (baselineCount rewrittenCount : Nat)
+      (baselinePositive : 0 < baselineCount)
+      (rewrittenPositive : 0 < rewrittenCount)
+      (baselineTarget rewrittenTarget : Machine)
+      (baselineSteps : Steps baselineContext interpretation baselineCount
+        baselineStart baselineTarget)
+      (rewrittenSteps : Steps rewrittenContext interpretation rewrittenCount
+        rewrittenStart rewrittenTarget)
+      (related : StableMachineRel limits validation baselineTarget
+        rewrittenTarget)
+
+/-- One synchronization macro together with preservation of a caller-chosen
+global runtime invariant.  Keeping the concrete endpoints in this relation
+lets finite-run induction cancel the multi-step baseline prefix and recurse
+from the exact synchronized states. -/
+inductive StableMacroInvariantStep (limits : Validate.Limits)
+    (validation : Validate.Context) (baselineContext rewrittenContext :
+      Eval.Context) (interpretation : Interpretation)
+    (invariant : Machine → Machine → Prop)
+    (baselineStart rewrittenStart : Machine) : Prop where
+  | intro (baselineCount rewrittenCount : Nat)
+      (baselinePositive : 0 < baselineCount)
+      (rewrittenPositive : 0 < rewrittenCount)
+      (baselineTarget rewrittenTarget : Machine)
+      (baselineSteps : Steps baselineContext interpretation baselineCount
+        baselineStart baselineTarget)
+      (rewrittenSteps : Steps rewrittenContext interpretation rewrittenCount
+        rewrittenStart rewrittenTarget)
+      (related : StableMachineRel limits validation baselineTarget
+        rewrittenTarget)
+      (preserved : invariant baselineTarget rewrittenTarget)
+
+/-- Forget invariant preservation and recover the ordinary synchronization
+macro consumed by local simulation clients. -/
+theorem StableMacroInvariantStep.simulation {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {invariant : Machine → Machine → Prop}
+    {baselineStart rewrittenStart : Machine}
+    (step : StableMacroInvariantStep limits validation baselineContext
+      rewrittenContext interpretation invariant baselineStart
+      rewrittenStart) :
+    StableMacroSimulation limits validation baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart := by
+  cases step with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related
+      _preserved =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related
+
+/-- Strengthen a synchronization macro once the global invariant has been
+proved at every endpoint exposed by that macro. -/
+theorem StableMacroSimulation.preserveInvariant {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {invariant : Machine → Machine → Prop}
+    {baselineStart rewrittenStart : Machine}
+    (simulation : StableMacroSimulation limits validation baselineContext
+      rewrittenContext interpretation baselineStart rewrittenStart)
+    (preserved : ∀ {baselineCount rewrittenCount : Nat}
+        {baselineTarget rewrittenTarget : Machine},
+      Steps baselineContext interpretation baselineCount baselineStart
+          baselineTarget →
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenTarget →
+      StableMachineRel limits validation baselineTarget rewrittenTarget →
+      invariant baselineTarget rewrittenTarget) :
+    StableMacroInvariantStep limits validation baselineContext
+      rewrittenContext interpretation invariant baselineStart
+      rewrittenStart := by
+  cases simulation with
+  | intro baselineCount rewrittenCount baselinePositive rewrittenPositive
+      baselineTarget rewrittenTarget baselineSteps rewrittenSteps related =>
+      exact .intro baselineCount rewrittenCount baselinePositive
+        rewrittenPositive baselineTarget rewrittenTarget baselineSteps
+        rewrittenSteps related (preserved baselineSteps rewrittenSteps related)
+
+/-- Package a pair of related running one-step transitions as the degenerate
+unchanged macro. -/
+theorem StableMacroSimulation.ofStepsOne {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    {baselineStart rewrittenStart baselineTarget rewrittenTarget : Machine}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (baselineRunning : baselineStart.control =
+      .running baselineFrame baselineStack)
+    (rewrittenRunning : rewrittenStart.control =
+      .running rewrittenFrame rewrittenStack)
+    (baselineStep : Step baselineContext interpretation baselineStart
+      baselineTarget)
+    (rewrittenStep : Step rewrittenContext interpretation rewrittenStart
+      rewrittenTarget)
+    (related : StableMachineRel limits validation baselineTarget
+      rewrittenTarget) :
+    StableMacroSimulation limits validation baselineContext rewrittenContext
+      interpretation baselineStart rewrittenStart := by
+  exact .intro 1 1 (by omega) (by omega) baselineTarget rewrittenTarget
+    (baselineStep.toSteps baselineRunning)
+    (rewrittenStep.toSteps rewrittenRunning) related
+
+/-- Package the logical-hot accepted-site theorem as a synchronization macro.
+The premises are the runtime facts needed by the optimization, rather than an
+already-packaged simulation result. -/
+theorem acceptedHotLogicalStableMacroSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel remaining rewrittenFuel : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {ambient : List IxIR1.Sim.Root} {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, 1, .ctorN site.shape.sourceConstructor fields⟩)
+    (owned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc location⟩ :: ambient))
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc location) = .ok (baselineReleased, remaining))
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    StableMacroSimulation limits validation baselineContext rewrittenContext
+      .logical baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨baselineSteps, rewrittenSteps, related⟩ :=
+    acceptedHotLogicalStableSimulation rewrite found baselineSchemas
+      rewrittenSchemas heap stack fuel allocationSchemaAt parameterCount
+      fieldCount sourceResolved sourceBoxAt owned retained released
+      allocationResolved baselineFieldWorlds tailResolved arity
+  exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega) _ _
+    baselineSteps rewrittenSteps related
+
+/-- Package the cold accepted-site theorem as a synchronization macro.  The
+cold branch is common to logical and physical interpretations. -/
+theorem acceptedColdStableMacroSimulation {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    {parameters fields newFields callValues : Array RVal}
+    {location fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : parameters.size = site.shape.parameterCount)
+    (fieldCount : fields.size = site.shape.fieldCount)
+    (sourceResolved : resolveAtom parameters (.reg site.shape.source) =
+      .ok (.loc location))
+    (sourceBoxAt : baselineStore.get? location = some
+      ⟨.shared, rc, .ctorN site.shape.sourceConstructor fields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore fields baselineRetained)
+    (retainedAt : baselineRetained.get? location = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor fields⟩)
+    (allocationResolved : resolveAtoms
+      (baselinePrefixValues parameters fields)
+      site.shape.allocationArguments = .ok newFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained location
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor fields⟩)
+      allocationSchema newFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues parameters fields).push
+        (.loc ((baselineDecrementStore baselineRetained location
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor fields⟩).allocNode .shared
+              (.ctorN site.shape.allocationConstructor newFields)).2))
+      site.shape.tailArguments = .ok callValues)
+    (arity : callValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := parameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := parameters
+            credits := #[] }
+          rewrittenStack }
+    StableMacroSimulation limits validation baselineContext rewrittenContext
+      interpretation baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨_rewrittenRetained, _retained, baselineSteps, rewrittenSteps,
+      related⟩ :=
+    acceptedColdStableSimulation rewrite found baselineSchemas
+      rewrittenSchemas heap stack fuel allocationSchemaAt parameterCount
+      fieldCount sourceResolved sourceBoxAt shared retained retainedAt
+      allocationResolved baselineFieldWorlds tailResolved arity
+  exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega) _ _
+    baselineSteps rewrittenSteps related
+
+/-- Package the physical-hot accepted-site theorem as a synchronization
+macro.  Unlike the exact-content wrappers, the input registers and suspended
+continuations may already be related by a nontrivial allocation-history
+bijection; the wrapped theorem replaces that relation at the reused location
+and preserves it everywhere else that remains reachable. -/
+theorem acceptedHotPhysicalStableMacroSimulationIso
+    {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained baselineReleased : Store}
+    (inputIso : IxIR1.Sim.HeapIso rewrittenStore.heap baselineStore.heap)
+    {baselineParameters rewrittenParameters baselineFields rewrittenFields
+      baselineNewFields rewrittenNewFields baselineCallValues : Array RVal}
+    {baselineLocation rewrittenLocation fieldFuel remaining rewrittenFuel :
+      Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : IxIR1.Sim.RValsIso
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineParameters.toList rewrittenParameters.toList)
+    (stack : StableStackIso limits validation
+      (fun baselineLocation rewrittenLocation =>
+        inputIso.locRel rewrittenLocation baselineLocation)
+      baselineStack rewrittenStack)
+    (stackAvoids : StackValuesAvoidLocation rewrittenLocation rewrittenStack)
+    (stackCreditsAvoids :
+      StackCreditsAvoidLocation rewrittenLocation rewrittenStack)
+    {baselineBefore baselineAfter rewrittenBefore rewrittenAfter :
+      List IxIR1.Sim.Root}
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (locations : inputIso.locRel rewrittenLocation baselineLocation)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (rewrittenSourceResolved :
+      resolveAtom rewrittenParameters (.reg site.shape.source) =
+        .ok (.loc rewrittenLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (rewrittenAt : rewrittenStore.get? rewrittenLocation = some
+      ⟨.shared, 1,
+        .ctorN site.shape.sourceConstructor rewrittenFields⟩)
+    (baselineOwned : IxIR1.Sim.RootOwnership baselineStore.heap
+      (⟨.shared, .loc baselineLocation⟩ :: baselineBefore))
+    (rewrittenOwned : IxIR1.Sim.RootOwnership rewrittenStore.heap
+      (⟨.shared, .loc rewrittenLocation⟩ :: rewrittenBefore))
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (released : releaseShared (fieldFuel + 1) baselineRetained
+      (.loc baselineLocation) = .ok (baselineReleased, remaining))
+    (baselinePartition :
+      (IxIR1.Sim.rootsFor .shared baselineFields.toList ++
+          baselineBefore).Perm
+        (IxIR1.Sim.rootsFor .shared baselineNewFields.toList ++
+          baselineAfter))
+    (rewrittenPartition :
+      (IxIR1.Sim.rootsFor .shared rewrittenFields.toList ++
+          rewrittenBefore).Perm
+        (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+          rewrittenAfter))
+    (mapped : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      rewrittenAfter)
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (rewrittenAllocationResolved : resolveAtoms
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      site.shape.allocationArguments = .ok rewrittenNewFields)
+    (baselineFieldWorlds :
+      FieldWorlds baselineReleased allocationSchema baselineNewFields)
+    (rewrittenFieldWorlds : FieldWorlds
+      (physicalHotResetStore rewrittenStore rewrittenLocation)
+      allocationSchema rewrittenNewFields)
+    (tailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc (baselineReleased.allocNode .shared
+          (.ctorN site.shape.allocationConstructor baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableMacroSimulation limits validation baselineContext rewrittenContext
+      .physical baselineMachine rewrittenMachine := by
+  dsimp only
+  have mappedFull : MappedValuesInRoots site.shape
+      (baselinePrefixValues rewrittenParameters rewrittenFields)
+      (IxIR1.Sim.rootsFor .shared rewrittenNewFields.toList ++
+        rewrittenAfter) := by
+    intro sourceId targetId sourceValue relevant translated found
+    have supported := mapped sourceId targetId sourceValue relevant translated
+      found
+    cases sourceValue with
+    | loc location =>
+        obtain ⟨world, member⟩ := supported
+        exact ⟨world, List.mem_append_right _ member⟩
+    | lit literal => trivial
+    | erased => trivial
+  obtain ⟨_physical, _outputIso, _physicalCallValues, _reused,
+      _physicalOwned, _baselineOwned, _outputResult, _outputExtends,
+      baselineSteps, rewrittenSteps, _callsRelated, _outputStack, related⟩ :=
+    acceptedHotPhysicalStableSimulationIso rewrite found baselineSchemas
+      rewrittenSchemas inputIso parameters stack stackAvoids
+      stackCreditsAvoids fuel locations allocationSchemaAt parameterCount
+      fieldCount baselineSourceResolved rewrittenSourceResolved baselineAt
+      rewrittenAt baselineOwned rewrittenOwned retained released
+      baselinePartition rewrittenPartition mappedFull
+      baselineAllocationResolved
+      rewrittenAllocationResolved baselineFieldWorlds rewrittenFieldWorlds
+      tailResolved arity
+  exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega) _ _
+    baselineSteps rewrittenSteps related
+
+/-- A cold accepted site remains a synchronization macro after an earlier
+physical reuse has changed concrete locations.  The source retain/release
+prefix is first commuted into the cold-reset order, that order is transported
+through the incoming allocation history, and corresponding fresh allocations
+extend the history for the recursive call. -/
+theorem acceptedColdStableMacroSimulationIso {limits : Validate.Limits}
+    {validation : Validate.Context} {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {index helperOffset : Nat} {block : Block}
+    {site : Reuse.Site limits validation block}
+    (found : Reuse.FunctionDecisions.At rewrite.decisions index helperOffset
+      block (.accepted site))
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (baselineSchemas : baselineContext.schemas = validation.schemas)
+    (rewrittenSchemas : rewrittenContext.schemas = validation.schemas)
+    {baselineStore rewrittenStore baselineRetained : Store}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    {baselineParameters rewrittenParameters baselineFields
+      baselineNewFields baselineCallValues : Array RVal}
+    {baselineLocation fieldFuel rewrittenFuel rc retainedRc : Nat}
+    {baselineStack rewrittenStack : List Continuation}
+    (parameters : IxIR1.Sim.RValsIso heap.locRel
+      baselineParameters.toList rewrittenParameters.toList)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {allocationSchema : CtorSchema}
+    (fuel : fieldFuel + 1 ≤ rewrittenFuel)
+    (allocationSchemaAt :
+      baselineContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema)
+    (parameterCount : baselineParameters.size = site.shape.parameterCount)
+    (fieldCount : baselineFields.size = site.shape.fieldCount)
+    (baselineSourceResolved :
+      resolveAtom baselineParameters (.reg site.shape.source) =
+        .ok (.loc baselineLocation))
+    (baselineAt : baselineStore.get? baselineLocation = some
+      ⟨.shared, rc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (shared : 1 < rc)
+    (retained : RetainSharedMany baselineStore baselineFields
+      baselineRetained)
+    (retainedAt : baselineRetained.get? baselineLocation = some
+      ⟨.shared, retainedRc,
+        .ctorN site.shape.sourceConstructor baselineFields⟩)
+    (baselineAllocationResolved : resolveAtoms
+      (baselinePrefixValues baselineParameters baselineFields)
+      site.shape.allocationArguments = .ok baselineNewFields)
+    (baselineFieldWorlds : FieldWorlds
+      (baselineDecrementStore baselineRetained baselineLocation
+        ⟨.shared, retainedRc,
+          .ctorN site.shape.sourceConstructor baselineFields⟩)
+      allocationSchema baselineNewFields)
+    (baselineTailResolved : resolveAtoms
+      ((baselinePrefixValues baselineParameters baselineFields).push
+        (.loc ((baselineDecrementStore baselineRetained baselineLocation
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩).allocNode
+              .shared
+              (.ctorN site.shape.allocationConstructor
+                baselineNewFields)).2))
+      site.shape.tailArguments = .ok baselineCallValues)
+    (arity : baselineCallValues.size = source.signature.params.size) :
+    let baselineMachine : Machine :=
+      { store := baselineStore
+        heapFuel := fieldFuel + 1
+        control := .running
+          { definition := source
+            block := index
+            values := baselineParameters
+            credits := #[] }
+          baselineStack }
+    let rewrittenMachine : Machine :=
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running
+          { definition := rewrite.definition
+            block := index
+            values := rewrittenParameters
+            credits := #[] }
+          rewrittenStack }
+    StableMacroSimulation limits validation baselineContext rewrittenContext
+      interpretation baselineMachine rewrittenMachine := by
+  dsimp only
+  obtain ⟨sourceAt, resetAt, _hotAt, coldAt⟩ := rewrite.acceptedAt found
+  obtain ⟨sourceSchema, siteAllocationSchema, sourceSchemaAt,
+      siteAllocationSchemaAt, _sourceFields, _allocationFields,
+      sourceLayout, allocationLayout⟩ :=
+    evalRuntimeSchemas site baselineSchemas
+  have allocationSchemaEq : siteAllocationSchema = allocationSchema := by
+    exact Option.some.inj
+      (siteAllocationSchemaAt.symm.trans allocationSchemaAt)
+  subst siteAllocationSchema
+  have rewrittenSourceSchemaAt :
+      rewrittenContext.schemas .shared site.shape.sourceConstructor =
+        some sourceSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using sourceSchemaAt
+  have rewrittenAllocationSchemaAt :
+      rewrittenContext.schemas .shared site.shape.allocationConstructor =
+        some allocationSchema := by
+    simpa [baselineSchemas, rewrittenSchemas] using allocationSchemaAt
+  obtain ⟨rewrittenSourceValue, rewrittenSourceResolved,
+      sourceValueRelated⟩ :=
+    resolveAtom_iso parameters baselineSourceResolved
+  cases sourceValueRelated with
+  | @loc _ rewrittenLocation locations =>
+      have baselineViewed : ConstructorView baselineStore baselineLocation
+          .shared site.shape.sourceConstructor
+          ⟨.shared, rc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩
+          baselineFields :=
+        ConstructorView.of_box baselineAt rfl rfl
+      obtain ⟨rewrittenBox, rewrittenFields, rewrittenAt,
+          rewrittenViewed, boxes, fieldsRelated⟩ :=
+        constructorView_historyIso heap locations baselineViewed
+      have rewrittenShared : 1 < rewrittenBox.rc := by
+        rw [← boxes.rc]
+        exact shared
+      have parameterSizes : baselineParameters.size =
+          rewrittenParameters.size := by
+        simpa using rvalsIso_length_eq parameters
+      have rewrittenParameterCount : rewrittenParameters.size =
+          site.shape.parameterCount :=
+        parameterSizes.symm.trans parameterCount
+      have fieldSizes : baselineFields.size = rewrittenFields.size := by
+        simpa using rvalsIso_length_eq fieldsRelated
+      have rewrittenFieldCount : rewrittenFields.size =
+          site.shape.fieldCount := fieldSizes.symm.trans fieldCount
+      have prefixRelated : IxIR1.Sim.RValsIso heap.locRel
+          (baselinePrefixValues baselineParameters baselineFields).toList
+          (baselinePrefixValues rewrittenParameters rewrittenFields).toList :=
+        by
+          simpa [baselinePrefixValues] using
+            rvalsIso_append_pair
+              (rvalsIso_append_pair parameters fieldsRelated) fieldsRelated
+      obtain ⟨rewrittenNewFields, rewrittenAllocationResolved,
+          newFieldsRelated⟩ :=
+        resolveAtoms_iso prefixRelated baselineAllocationResolved
+      obtain ⟨actualRetainedRc, actualRetainedAt, baselineReleasedRun,
+          baselineResetRetained, baselineResetHeapEq⟩ :=
+        coldPrefix_commutes (heapFuel := fieldFuel) baselineAt shared retained
+      have retainedBoxesEqual :
+          (⟨.shared, actualRetainedRc,
+              .ctorN site.shape.sourceConstructor baselineFields⟩ :
+              IxIR1.NodeBox) =
+            ⟨.shared, retainedRc,
+              .ctorN site.shape.sourceConstructor baselineFields⟩ :=
+        Option.some.inj (actualRetainedAt.symm.trans retainedAt)
+      have retainedRcEqual : actualRetainedRc = retainedRc := by
+        cases retainedBoxesEqual
+        rfl
+      subst actualRetainedRc
+      let baselineReleased :=
+        baselineDecrementStore baselineRetained baselineLocation
+          ⟨.shared, retainedRc,
+            .ctorN site.shape.sourceConstructor baselineFields⟩
+      let baselineResetStore :=
+        baselineReleased.tickResetAttempt.tickColdReset
+      let baselineBox : IxIR1.NodeBox :=
+        ⟨.shared, rc,
+          .ctorN site.shape.sourceConstructor baselineFields⟩
+      let updated := heap.setBox locations
+        (show baselineStore.heap.get? baselineLocation = some baselineBox from
+          baselineAt)
+        (show rewrittenStore.heap.get? rewrittenLocation = some rewrittenBox
+          from rewrittenAt)
+        (show IxIR1.Sim.NodeBoxIso heap.locRel
+            { baselineBox with rc := baselineBox.rc - 1 }
+            { rewrittenBox with rc := rewrittenBox.rc - 1 } from
+          ⟨boxes.world,
+            congrArg (fun count => count - 1) boxes.rc, boxes.node⟩)
+      let beforeRetains : IxIR1.Sim.HeapHistoryIso
+          (coldResetStartStore baselineStore baselineLocation
+            baselineBox).heap
+          (coldResetStartStore rewrittenStore rewrittenLocation
+            rewrittenBox).heap := by
+        simpa [coldResetStartStore, Eval.Store.tickResetAttempt,
+          Eval.Store.tickColdReset] using updated.rcTick
+      have relatedRetainedFields : IxIR1.Sim.RValsIso
+          beforeRetains.locRel baselineFields.toList rewrittenFields.toList :=
+        by
+          change IxIR1.Sim.RValsIso heap.locRel _ _
+          exact fieldsRelated
+      obtain ⟨rewrittenResetStore, afterRetains,
+          rewrittenResetRetained, afterRetainsRelation⟩ :=
+        retainSharedMany_historyIso beforeRetains relatedRetainedFields
+          (by
+            simpa [baselineBox, baselineReleased, baselineResetStore] using
+              baselineResetRetained)
+      have baselineResetHeapEq' : baselineReleased.heap =
+          baselineResetStore.heap := by
+        simpa [baselineReleased, baselineResetStore] using
+          baselineResetHeapEq
+      let afterCold : IxIR1.Sim.HeapHistoryIso baselineReleased.heap
+          rewrittenResetStore.heap :=
+        afterRetains.nodesEq
+          (congrArg IxIR1.Store.nodes baselineResetHeapEq') rfl
+      have afterColdRelation : afterCold.locRel = heap.locRel := by
+        calc
+          afterCold.locRel = afterRetains.locRel := rfl
+          _ = beforeRetains.locRel := afterRetainsRelation
+          _ = heap.locRel := rfl
+      have newFieldsAfterCold : IxIR1.Sim.RValsIso afterCold.locRel
+          baselineNewFields.toList rewrittenNewFields.toList := by
+        rw [afterColdRelation]
+        exact newFieldsRelated
+      have rewrittenFieldWorlds : FieldWorlds rewrittenResetStore
+          allocationSchema rewrittenNewFields :=
+        baselineFieldWorlds.transport
+          (heapHistoryIso_fieldValuesWorldEq afterCold newFieldsAfterCold)
+      let baselineAllocation := baselineReleased.allocNode .shared
+        (.ctorN site.shape.allocationConstructor baselineNewFields)
+      let rewrittenAllocation := rewrittenResetStore.allocNode .shared
+        (.ctorN site.shape.allocationConstructor rewrittenNewFields)
+      let allocationHistory : IxIR1.Sim.HeapHistoryIso
+          baselineAllocation.1.heap rewrittenAllocation.1.heap :=
+        afterCold.alloc (.ctor newFieldsAfterCold)
+      have oldExtends : ∀ {baselineCandidate rewrittenCandidate : Nat},
+          heap.locRel baselineCandidate rewrittenCandidate →
+            allocationHistory.locRel baselineCandidate rewrittenCandidate :=
+        by
+          intro baselineCandidate rewrittenCandidate related
+          apply Or.inr
+          rw [afterColdRelation]
+          exact related
+      have prefixAfterAllocation : IxIR1.Sim.RValsIso
+          allocationHistory.locRel
+          (baselinePrefixValues baselineParameters baselineFields).toList
+          (baselinePrefixValues rewrittenParameters rewrittenFields).toList :=
+        rvalsIso_mono_rel oldExtends prefixRelated
+      have resultRelated : IxIR1.Sim.RValIso allocationHistory.locRel
+          (.loc baselineAllocation.2) (.loc rewrittenAllocation.2) :=
+        .loc (.inl ⟨rfl, rfl⟩)
+      have tailInputsRelated : IxIR1.Sim.RValsIso allocationHistory.locRel
+          ((baselinePrefixValues baselineParameters baselineFields).push
+            (.loc baselineAllocation.2)).toList
+          ((baselinePrefixValues rewrittenParameters rewrittenFields).push
+            (.loc rewrittenAllocation.2)).toList := by
+        simpa using rvalsIso_append prefixAfterAllocation resultRelated
+      obtain ⟨rewrittenCallValues, rewrittenTailResolved,
+          callValuesRelated⟩ :=
+        resolveAtoms_iso tailInputsRelated
+          (by simpa [baselineAllocation, baselineReleased] using
+            baselineTailResolved)
+      have callSizes : baselineCallValues.size = rewrittenCallValues.size := by
+        simpa using rvalsIso_length_eq callValuesRelated
+      have rewrittenArity : rewrittenCallValues.size =
+          rewrite.definition.signature.params.size := by
+        simpa using callSizes.symm.trans arity
+      have sourceNonempty : source.blocks.isEmpty = false :=
+        blocks_nonempty_of_getElem sourceAt
+      have rewrittenNonempty : rewrite.definition.blocks.isEmpty = false :=
+        blocks_nonempty_of_getElem resetAt
+      let baselineMachine : Machine :=
+        { store := baselineStore
+          heapFuel := fieldFuel + 1
+          control := .running
+            { definition := source
+              block := index
+              values := baselineParameters
+              credits := #[] }
+            baselineStack }
+      let rewrittenMachine : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running
+            { definition := rewrite.definition
+              block := index
+              values := rewrittenParameters
+              credits := #[] }
+            rewrittenStack }
+      have baselineExecution : Steps baselineContext interpretation
+          (2 * site.shape.fieldCount + 3) baselineMachine
+          { store := baselineAllocation.1
+            heapFuel := fieldFuel
+            control := .running
+              { definition := source, values := baselineCallValues }
+              baselineStack } := by
+        simpa [baselineMachine, baselineAllocation, baselineReleased] using
+          baselineAcceptedControl site
+            (context := baselineContext) (interpretation := interpretation)
+            (definition := source) (blockId := index)
+            (parameters := baselineParameters) (fields := baselineFields)
+            (newFields := baselineNewFields)
+            (callValues := baselineCallValues)
+            (location := baselineLocation) (machine := baselineMachine)
+            (retainedStore := baselineRetained)
+            (releasedStore := baselineReleased) (remaining := fieldFuel)
+            (allocationSchema := allocationSchema) (stack := baselineStack)
+            sourceAt (by rfl) parameterCount fieldCount
+            baselineSourceResolved baselineAt rfl retained
+            (by simpa [baselineReleased] using baselineReleasedRun)
+            allocationSchemaAt baselineAllocationResolved
+            (by simpa [baselineReleased] using baselineFieldWorlds)
+            (by simpa [baselineAllocation, baselineReleased] using
+              baselineTailResolved)
+            arity sourceNonempty
+      have rewrittenExecution : Steps rewrittenContext interpretation 4
+          rewrittenMachine
+          { store := rewrittenAllocation.1
+            heapFuel := rewrittenFuel
+            control := .running
+              { definition := rewrite.definition,
+                values := rewrittenCallValues }
+              rewrittenStack } := by
+        simpa [rewrittenMachine, rewrittenAllocation] using
+          coldAcceptedControl site
+            (context := rewrittenContext)
+            (interpretation := interpretation)
+            (definition := rewrite.definition) (resetId := index)
+            (hotId := source.blocks.size + helperOffset)
+            (coldId := source.blocks.size + helperOffset + 1)
+            (parameters := rewrittenParameters) (fields := rewrittenFields)
+            (newFields := rewrittenNewFields)
+            (callValues := rewrittenCallValues)
+            (location := rewrittenLocation) (box := rewrittenBox)
+            (sourceSchema := sourceSchema)
+            (allocationSchema := allocationSchema)
+            (machine := rewrittenMachine) (resetStore := rewrittenResetStore)
+            (stack := rewrittenStack) resetAt coldAt rewrittenSourceSchemaAt
+            rewrittenAllocationSchemaAt sourceLayout allocationLayout
+            (by rfl) rewrittenParameterCount rewrittenFieldCount
+            (by simpa using rewrittenSourceResolved) rewrittenViewed
+            rewrittenShared
+            (by
+              simpa [rewrittenMachine, coldResetStartStore] using
+                rewrittenResetRetained)
+            rewrittenAllocationResolved rewrittenFieldWorlds
+            (by simpa [rewrittenAllocation] using rewrittenTailResolved)
+            rewrittenArity rewrittenNonempty
+      have outputStack : StableStackIso limits validation
+          allocationHistory.locRel baselineStack rewrittenStack :=
+        stack.mono oldExtends
+      have outputFuel : fieldFuel ≤ rewrittenFuel := by omega
+      have related : StableMachineRel limits validation
+          { store := baselineAllocation.1
+            heapFuel := fieldFuel
+            control := .running
+              { definition := source, values := baselineCallValues }
+              baselineStack }
+          { store := rewrittenAllocation.1
+            heapFuel := rewrittenFuel
+            control := .running
+              { definition := rewrite.definition,
+                values := rewrittenCallValues }
+              rewrittenStack } :=
+        StableMachineRel.history allocationHistory outputFuel
+          (.running
+            (.rewritten rewrite
+              (StableFrameIso.entry rewrite callValuesRelated))
+            outputStack)
+      exact .intro (2 * site.shape.fieldCount + 3) 4 (by omega) (by omega)
+        _ _ baselineExecution rewrittenExecution related
+
+/-- Exhaustive synchronization dispatch from an exact-content stable state.
+The rewrite's dependent block decision chooses either the proved public
+one-step dispatcher or the accepted-site macro supplied by the global runtime
+invariant.  Thus later whole-run induction has exactly one accepted-site
+obligation, rather than one obligation per ordinary instruction/terminator
+shape. -/
+theorem stableMacroStepOfTrace {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : HeapContentsEq baselineStore rewrittenStore)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite (fun left right => left = right)
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation (fun left right => left = right)
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site limits validation block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        StableMacroSimulation limits validation
+          (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    StableMacroSimulation limits validation
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      (Eval.Context.ofProgram trace.target validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have dispatch : ∀ {block : Block},
+      baselineFrame.definition.blocks[baselineFrame.block]? = some block →
+      StableMacroSimulation limits validation
+        (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+        (Eval.Context.ofProgram trace.target validation.schemas oracle)
+        interpretation
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack } := by
+    intro block blockAt
+    cases frame.blockCase blockAt with
+    | unchanged sourceAt targetAt =>
+        have sourceBlockAt : source.blocks[baselineFrame.block]? =
+            some block := by
+          rw [← frame.baselineDefinition]
+          exact blockAt
+        have blockEq := Option.some.inj (sourceAt.symm.trans sourceBlockAt)
+        cases blockEq
+        have rewrittenBlockAt :
+            rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+              some block := by
+          rw [frame.rewrittenDefinition, ← frame.block]
+          exact targetAt
+        obtain ⟨rewrittenTarget, rewrittenStep, related⟩ :=
+          unchangedStepOfTrace trace rewrite heap fuel frame stack blockAt
+            rewrittenBlockAt stepped
+        exact StableMacroSimulation.ofStepsOne rfl rfl stepped rewrittenStep
+          related
+    | accepted found =>
+        exact accepted found
+  cases stepped.classify with
+  | instruction blockAt _pc _instructionAt _instructionCase =>
+      exact dispatch blockAt
+  | terminator blockAt _pc _terminatorAt _terminatorCase =>
+      exact dispatch blockAt
+
+/-- Exhaustive synchronization dispatch from an allocation-history-related
+stable state.  Ordinary blocks use the relation-aware one-step theorem;
+accepted blocks remain a single macro obligation for the global invariant. -/
+theorem stableMacroStepOfTraceIso {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    (heap : IxIR1.Sim.HeapHistoryIso baselineStore.heap rewrittenStore.heap)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite heap.locRel
+      baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation heap.locRel
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site limits validation block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        StableMacroSimulation limits validation
+          (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    StableMacroSimulation limits validation
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      (Eval.Context.ofProgram trace.target validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  have dispatch : ∀ {block : Block},
+      baselineFrame.definition.blocks[baselineFrame.block]? = some block →
+      StableMacroSimulation limits validation
+        (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+        (Eval.Context.ofProgram trace.target validation.schemas oracle)
+        interpretation
+        { store := baselineStore
+          heapFuel := baselineFuel
+          control := .running baselineFrame baselineStack }
+        { store := rewrittenStore
+          heapFuel := rewrittenFuel
+          control := .running rewrittenFrame rewrittenStack } := by
+    intro block blockAt
+    cases frame.blockCase blockAt with
+    | unchanged sourceAt targetAt =>
+        have sourceBlockAt : source.blocks[baselineFrame.block]? =
+            some block := by
+          rw [← frame.baselineDefinition]
+          exact blockAt
+        have blockEq := Option.some.inj (sourceAt.symm.trans sourceBlockAt)
+        cases blockEq
+        have rewrittenBlockAt :
+            rewrittenFrame.definition.blocks[rewrittenFrame.block]? =
+              some block := by
+          rw [frame.rewrittenDefinition, ← frame.block]
+          exact targetAt
+        obtain ⟨rewrittenTarget, rewrittenStep, related⟩ :=
+          unchangedStepOfTraceIso trace rewrite heap fuel frame stack blockAt
+            rewrittenBlockAt stepped
+        exact StableMacroSimulation.ofStepsOne rfl rfl stepped rewrittenStep
+          related
+    | accepted found =>
+        exact accepted found
+  cases stepped.classify with
+  | instruction blockAt _pc _instructionAt _instructionCase =>
+      exact dispatch blockAt
+  | terminator blockAt _pc _terminatorAt _terminatorCase =>
+      exact dispatch blockAt
+
+/-- Uniform synchronization dispatch over either arm of `StableHeapRel`.
+This is the macro-level interface consumed by a future whole-run induction:
+the heap representation is no longer exposed to the caller. -/
+theorem stableMacroStepOfTraceRel {limits : Validate.Limits}
+    {validation : Validate.Context} {sourceProgram : Program}
+    (trace : Reuse.Trace limits validation sourceProgram)
+    {source : Function}
+    (rewrite : Reuse.FunctionRewrite limits validation source)
+    {oracle : Ix.Compiler.Ixon.Address → List RVal → Option RVal}
+    {interpretation : Interpretation}
+    {baselineStore rewrittenStore : Store}
+    {baselineFuel rewrittenFuel : Nat}
+    {baselineFrame rewrittenFrame : Frame}
+    {baselineStack rewrittenStack : List Continuation}
+    {locRel : Nat → Nat → Prop}
+    (heap : StableHeapRel baselineStore rewrittenStore locRel)
+    (fuel : baselineFuel ≤ rewrittenFuel)
+    (frame : StableFrameIso rewrite locRel baselineFrame rewrittenFrame)
+    (stack : StableStackIso limits validation locRel
+      baselineStack rewrittenStack)
+    {baselineStepTarget : Machine}
+    (stepped : Step
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      baselineStepTarget)
+    (accepted : ∀ {helperOffset : Nat} {block : Block}
+        {site : Reuse.Site limits validation block},
+      Reuse.FunctionDecisions.At rewrite.decisions baselineFrame.block
+          helperOffset block (.accepted site) →
+        StableMacroSimulation limits validation
+          (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+          (Eval.Context.ofProgram trace.target validation.schemas oracle)
+          interpretation
+          { store := baselineStore
+            heapFuel := baselineFuel
+            control := .running baselineFrame baselineStack }
+          { store := rewrittenStore
+            heapFuel := rewrittenFuel
+            control := .running rewrittenFrame rewrittenStack }) :
+    StableMacroSimulation limits validation
+      (Eval.Context.ofProgram sourceProgram validation.schemas oracle)
+      (Eval.Context.ofProgram trace.target validation.schemas oracle)
+      interpretation
+      { store := baselineStore
+        heapFuel := baselineFuel
+        control := .running baselineFrame baselineStack }
+      { store := rewrittenStore
+        heapFuel := rewrittenFuel
+        control := .running rewrittenFrame rewrittenStack } := by
+  cases heap with
+  | contents same =>
+      exact stableMacroStepOfTrace trace rewrite same fuel frame stack stepped
+        accepted
+  | isomorphic iso =>
+      exact stableMacroStepOfTraceIso trace rewrite iso.symm fuel frame stack
+        stepped accepted
+
+/-! ## Finite whole-machine synchronization -/
+
+/-- A global invariant whose synchronized running states always admit one
+invariant-preserving macro lifts every finite baseline execution ending in a
+halt to a finite rewritten execution.  Baseline macro prefixes are cancelled
+from the unique small-step path, and strict positivity supplies the decreasing
+measure for strong induction even though accepted sites consume more than one
+baseline instruction. -/
+theorem stableFiniteExecutionOfMacroInvariant {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (invariant : Machine → Machine → Prop)
+    (related : ∀ {baseline rewritten}, invariant baseline rewritten →
+      StableMachineRel limits validation baseline rewritten)
+    (advance : ∀ {baseline rewritten baselineNext : Machine}
+        {frame : Frame} {stack : List Continuation},
+      invariant baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      StableMacroInvariantStep limits validation baselineContext
+        rewrittenContext interpretation invariant baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart baselineFinal :
+      Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : invariant baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart baselineFinal)
+    (halted : baselineFinal =
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenFinal,
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        invariant baselineFinal rewrittenFinal ∧
+        StableMachineRel limits validation baselineFinal rewrittenFinal := by
+  induction baselineCount using Nat.strongRecOn generalizing baselineStart
+      rewrittenStart baselineFinal with
+  | ind baselineCount smaller =>
+      cases baselineSteps with
+      | refl =>
+          exact ⟨0, rewrittenStart, .refl rewrittenStart, initial,
+            related initial⟩
+      | @cons count before middle after frame stack running head tail =>
+          have synchronizedStep := advance initial running head
+          cases synchronizedStep with
+          | intro macroBaselineCount macroRewrittenCount baselinePositive
+              rewrittenPositive macroBaselineTarget macroRewrittenTarget
+              macroBaselineSteps macroRewrittenSteps macroRelated preserved =>
+              obtain ⟨suffixCount, totalCount, suffixSteps⟩ :=
+                macroBaselineSteps.cancelPrefixToHalted
+                  (Steps.cons running head tail) halted
+              have suffixSmaller : suffixCount < Nat.succ count := by
+                omega
+              obtain ⟨suffixRewrittenCount, rewrittenFinal,
+                  suffixRewrittenSteps, finalInvariant, finalRelated⟩ :=
+                smaller suffixCount suffixSmaller preserved suffixSteps halted
+              exact ⟨macroRewrittenCount + suffixRewrittenCount,
+                rewrittenFinal,
+                macroRewrittenSteps.trans suffixRewrittenSteps,
+                finalInvariant, finalRelated⟩
+
+/-- Runner-level form of `stableFiniteExecutionOfMacroInvariant`.  A finite
+halted baseline execution yields an exact rewritten control budget, a halted
+rewritten result related through the final heap relation, and the corresponding
+successful `runMachine` equation. -/
+theorem stableRunMachineOfMacroInvariant {limits : Validate.Limits}
+    {validation : Validate.Context}
+    {baselineContext rewrittenContext : Eval.Context}
+    {interpretation : Interpretation}
+    (invariant : Machine → Machine → Prop)
+    (related : ∀ {baseline rewritten}, invariant baseline rewritten →
+      StableMachineRel limits validation baseline rewritten)
+    (advance : ∀ {baseline rewritten baselineNext : Machine}
+        {frame : Frame} {stack : List Continuation},
+      invariant baseline rewritten →
+      baseline.control = .running frame stack →
+      Step baselineContext interpretation baseline baselineNext →
+      StableMacroInvariantStep limits validation baselineContext
+        rewrittenContext interpretation invariant baseline rewritten)
+    {baselineCount : Nat} {baselineStart rewrittenStart : Machine}
+    {finalStore : Store} {finalHeapFuel : Nat} {finalValue : RVal}
+    (initial : invariant baselineStart rewrittenStart)
+    (baselineSteps : Steps baselineContext interpretation baselineCount
+      baselineStart
+      { store := finalStore
+        heapFuel := finalHeapFuel
+        control := .halted finalValue }) :
+    ∃ rewrittenCount rewrittenStore rewrittenHeapFuel rewrittenValue locRel,
+      let rewrittenFinal : Machine :=
+        { store := rewrittenStore
+          heapFuel := rewrittenHeapFuel
+          control := .halted rewrittenValue }
+      Steps rewrittenContext interpretation rewrittenCount rewrittenStart
+          rewrittenFinal ∧
+        invariant
+          { store := finalStore
+            heapFuel := finalHeapFuel
+            control := .halted finalValue }
+          rewrittenFinal ∧
+        StableHeapRel finalStore rewrittenStore locRel ∧
+        finalHeapFuel ≤ rewrittenHeapFuel ∧
+        IxIR1.Sim.RValIso locRel finalValue rewrittenValue ∧
+        Eval.runMachine rewrittenContext interpretation rewrittenCount
+            rewrittenStart =
+          .ok
+            { store := rewrittenStore
+              value := rewrittenValue
+              controlRemaining := 0
+              heapRemaining := rewrittenHeapFuel } := by
+  obtain ⟨rewrittenCount, rewrittenFinal, rewrittenSteps, finalInvariant,
+      finalRelated⟩ :=
+    stableFiniteExecutionOfMacroInvariant invariant related advance initial
+      baselineSteps rfl
+  obtain ⟨rewrittenStore, rewrittenHeapFuel, rewrittenValue, locRel,
+      rewrittenFinalEq, finalHeap, finalFuel, finalValueRelated⟩ :=
+    finalRelated.haltedParts
+  subst rewrittenFinal
+  refine ⟨rewrittenCount, rewrittenStore, rewrittenHeapFuel, rewrittenValue,
+    locRel, rewrittenSteps, finalInvariant, finalHeap, finalFuel,
+    finalValueRelated, ?_⟩
+  exact rewrittenSteps.runMachine_halted
+
+end Ix.Compiler.IxIR2.ReuseSim
diff --git a/Ix/Compiler/IxIR2/ReuseSimExamples.lean b/Ix/Compiler/IxIR2/ReuseSimExamples.lean
new file mode 100644
index 000000000..0d0673695
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ReuseSimExamples.lean
@@ -0,0 +1,197 @@
+import Ix.Compiler.IxIR2.ReuseSim
+
+/-!
+# Dynamic shared-reuse simulation fixtures
+
+The fixtures keep the semantic theorems honest without coupling them to the
+larger reversal benchmark.  The leaf case exercises physical reuse directly;
+the linked case also runs the baseline retain/deep-release prefix and verifies
+that its child refcount traffic cancels before the replacement is allocated.
+-/
+
+namespace Ix.Compiler.IxIR2.ReuseSim.Examples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2.Eval
+
+private def blockAddress : Address := Address.replicate 0xa1
+
+private def oldNode : IxIR1.Node :=
+  .ctorN { block := blockAddress, indIdx := 0, cidx := 0 } #[]
+
+private def newNode : IxIR1.Node :=
+  .ctorN { block := blockAddress, indIdx := 0, cidx := 1 } #[]
+
+private def childNode : IxIR1.Node :=
+  .ctorN { block := blockAddress, indIdx := 1, cidx := 0 } #[]
+
+private def childHeap : IxIR1.Store :=
+  (({} : IxIR1.Store).allocNode .shared childNode).1
+
+private def childLocation : Nat :=
+  (({} : IxIR1.Store).allocNode .shared childNode).2
+
+private def linkedOldNode : IxIR1.Node :=
+  .ctorN { block := blockAddress, indIdx := 2, cidx := 0 }
+    #[.loc childLocation]
+
+private def linkedNewNode : IxIR1.Node :=
+  .ctorN { block := blockAddress, indIdx := 2, cidx := 1 }
+    #[.loc childLocation]
+
+private def linkedHeap : IxIR1.Store :=
+  (childHeap.allocNode .shared linkedOldNode).1
+
+private def linkedTarget : Nat :=
+  (childHeap.allocNode .shared linkedOldNode).2
+
+private def linkedStore : Store :=
+  { heap := linkedHeap }
+
+private def initialHeap : IxIR1.Store :=
+  (({} : IxIR1.Store).allocNode .shared oldNode).1
+
+private def target : Nat :=
+  (({} : IxIR1.Store).allocNode .shared oldNode).2
+
+private def initialStore : Store :=
+  { heap := initialHeap }
+
+private theorem target_live :
+    initialStore.get? target = some ⟨.shared, 1, oldNode⟩ := by
+  exact IxIR1.Sim.HeapIso.get?_allocNode_new
+    ({} : IxIR1.Store) .shared oldNode
+
+private theorem initial_owned :
+    IxIR1.Sim.RootOwnership initialStore.heap
+      [⟨.shared, .loc target⟩] := by
+  apply IxIR1.Sim.RootOwnership.allocNode (store := ({} : IxIR1.Store))
+  · simpa [oldNode, IxIR1.Sim.nodeChildren, IxIR1.Sim.rootsFor] using
+      IxIR1.Sim.RootOwnership.empty
+  · trivial
+
+private theorem child_live :
+    linkedStore.get? childLocation = some ⟨.shared, 1, childNode⟩ := by
+  apply IxIR1.Sim.HeapIso.get?_allocNode_old
+  exact IxIR1.Sim.HeapIso.get?_allocNode_new
+    ({} : IxIR1.Store) .shared childNode
+
+private theorem linked_target_live :
+    linkedStore.get? linkedTarget =
+      some ⟨.shared, 1, linkedOldNode⟩ := by
+  exact IxIR1.Sim.HeapIso.get?_allocNode_new
+    childHeap .shared linkedOldNode
+
+private theorem child_owned :
+    IxIR1.Sim.RootOwnership childHeap
+      [⟨.shared, .loc childLocation⟩] := by
+  apply IxIR1.Sim.RootOwnership.allocNode (store := ({} : IxIR1.Store))
+  · simpa [childNode, IxIR1.Sim.nodeChildren,
+      IxIR1.Sim.rootsFor] using IxIR1.Sim.RootOwnership.empty
+  · trivial
+
+private theorem linked_owned :
+    IxIR1.Sim.RootOwnership linkedStore.heap
+      [⟨.shared, .loc linkedTarget⟩] := by
+  apply IxIR1.Sim.RootOwnership.allocNode (store := childHeap)
+  · simpa [linkedOldNode, IxIR1.Sim.nodeChildren,
+      IxIR1.Sim.rootsFor] using child_owned
+  · trivial
+
+private def linkedRetainedStore : Store :=
+  incrementSharedStore linkedStore childLocation
+    ⟨.shared, 1, childNode⟩
+
+private theorem linked_retained :
+    RetainSharedMany linkedStore #[.loc childLocation]
+      linkedRetainedStore := by
+  refine RetainSharedMany.cons (middle := linkedRetainedStore) ?_
+    (RetainSharedMany.empty _)
+  simp [retainShared, child_live, linkedRetainedStore,
+    incrementSharedStore]
+
+private theorem linkedRetained_child_live :
+    linkedRetainedStore.get? childLocation =
+      some ⟨.shared, 2, childNode⟩ := by
+  exact get?_incrementSharedStore_same child_live
+
+private theorem linkedRetained_target_live :
+    linkedRetainedStore.get? linkedTarget =
+      some ⟨.shared, 1, linkedOldNode⟩ := by
+  apply get?_incrementSharedStore_other
+  · decide
+  · exact child_live
+  · exact linked_target_live
+
+private def linkedReleaseStart : Store :=
+  linkedRetainedStore.rcTick.kill linkedTarget
+
+private theorem linkedReleaseStart_child_live :
+    linkedReleaseStart.get? childLocation =
+      some ⟨.shared, 2, childNode⟩ := by
+  apply IxIR1.Sim.get?_kill_other
+  · decide
+  · exact linkedRetained_target_live
+  · exact linkedRetained_child_live
+
+private def linkedReleasedStore : Store :=
+  baselineDecrementStore linkedReleaseStart childLocation
+    ⟨.shared, 2, childNode⟩
+
+private theorem linked_released :
+    releaseShared 2 linkedRetainedStore (.loc linkedTarget) =
+      .ok (linkedReleasedStore, 0) := by
+  simp only [releaseShared, releaseSharedWork, linkedRetained_target_live,
+    linkedOldNode]
+  change releaseSharedWork 1 linkedReleaseStart [.loc childLocation] = _
+  simp [releaseSharedWork, linkedReleaseStart_child_live,
+    linkedReleasedStore, baselineDecrementStore]
+
+/-- The concrete physical operation succeeds, and its heap is related to the
+logical operation's heap by the same live-location bijection exported to the
+general block proof. -/
+theorem leafHotReuseProducesRelatedHeaps :
+    ∃ physical logical,
+      physicalHotReuseStore initialStore target newNode 0 = .ok physical ∧
+      logical = (logicalHotReuseStore initialStore target newNode).1 ∧
+      Nonempty (IxIR1.Sim.HeapIso physical.heap logical.heap) := by
+  obtain ⟨physical, reused, iso, _, _, _⟩ :=
+    hotReuse_sound (store := initialStore) (target := target)
+      (oldNode := oldNode) (newNode := newNode)
+      (before := []) (after := []) 0 target_live initial_owned
+      (by simp [oldNode, newNode, IxIR1.Sim.nodeChildren,
+        IxIR1.Sim.rootsFor])
+      (by trivial)
+  exact ⟨physical, (logicalHotReuseStore initialStore target newNode).1,
+    reused, rfl, ⟨iso⟩⟩
+
+/-- A one-child constructor exercises the whole baseline-prefix theorem:
+retain the projected child, deep-release the unit parent, then allocate the
+replacement.  Physical reset/reuse reaches a heap isomorphic to that concrete
+baseline execution. -/
+theorem linkedHotPrefixProducesRelatedHeaps :
+    ∃ physical,
+      physicalHotReuseStore linkedStore linkedTarget linkedNewNode 1 =
+          .ok physical ∧
+      Nonempty (IxIR1.Sim.HeapIso physical.heap
+        (linkedReleasedStore.allocNode .shared linkedNewNode).1.heap) := by
+  obtain ⟨physical, reused, iso, _, _, _⟩ :=
+    hotPrefixReuse_sound
+      (store := linkedStore)
+      (baselineRetained := linkedRetainedStore)
+      (baselineReleased := linkedReleasedStore)
+      (target := linkedTarget)
+      (oldCid := { block := blockAddress, indIdx := 2, cidx := 0 })
+      (newCid := { block := blockAddress, indIdx := 2, cidx := 1 })
+      (fields := #[.loc childLocation])
+      (newFields := #[.loc childLocation])
+      (fieldFuel := 1)
+      (remaining := 0)
+      (before := [])
+      (after := [])
+      1 linked_target_live linked_owned linked_retained linked_released
+      (by simp [IxIR1.Sim.rootsFor])
+      (by trivial)
+  exact ⟨physical, reused, ⟨iso⟩⟩
+
+end Ix.Compiler.IxIR2.ReuseSim.Examples
diff --git a/Ix/Compiler/IxIR2/SourcePipelineSim.lean b/Ix/Compiler/IxIR2/SourcePipelineSim.lean
new file mode 100644
index 000000000..acf0669cf
--- /dev/null
+++ b/Ix/Compiler/IxIR2/SourcePipelineSim.lean
@@ -0,0 +1,119 @@
+import Ix.Compiler.IxIR2.PipelinePhysical
+
+/-! General source-to-physical composition, retaining constructor-valued
+observations and the complete heap graph. Scalar and closed Nat native
+endpoints can share this source boundary. -/
+namespace Ix.Compiler.IxIR2.Pipeline
+open Ix.Compiler Ix.Compiler.Pipeline Ix.Compiler.IxIR1.Lower Ix.Compiler.IxIR1.LowerSim
+
+theorem Attached.sourcePhysical
+    {constants : List (Ixon.Address × Ixon.Constant)}
+    {mainAddress : Ixon.Address} {config : Ix.Compiler.Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (attached : Attached constants mainAddress config .shared eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource = .ok sourceValue) :
+    ∃ rawValue ir1Fuel ir1Store ir1Value controlFuel heapFuel physicalResult,
+      @Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+        sourceValue rawValue attached.source.memberScope ∧
+      MutualAddressedValueGraph
+        (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap)
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw)
+        attached.source.functionRel ir1Store rawValue ir1Value ∧
+      IxIR1.runOwnedMain attached.compiled.simulationSourceContext .shared
+        attached.target.artifact.source.main ir1Fuel = .ok (ir1Store, ir1Value) ∧
+      IxIR2.Eval.runMain attached.compiled.simulationTargetContext .physical
+        attached.target.artifact.program controlFuel heapFuel = .ok physicalResult ∧
+      IxIR2.Lower.Sim.OutcomeRel (ir1Store, ir1Value) physicalResult := by
+  letI : Sim.MemberScope := attached.source.memberScope
+  have hframe : (validatedMainFrame mainAddress).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [validatedMainFrame] at found
+  have hbelow : Ixon.Sharing.sharesBelow
+      (validatedMainFrame mainAddress).sharing.size validatedMainSource = true := rfl
+  have herase : EraseAddressed.run
+      (EraseValidator.eraseCtxOf (validatedEvalCtx constants config))
+      constants attached.source.entry.target eraseFuel = .ok attached.source.erasure.result := by
+    rw [attached.source.entryTarget]
+    exact attached.source.erasure.runEq
+  obtain ⟨traceFuel, addressedValue, trace, sourceRelation⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members
+      (fun _ _ => none)
+      (IxIR0.Readdress.Oracle.readdress attached.source.erasure.result.addressMap (fun _ _ => none))
+      attached.source.members attached.source.entry herase
+      (IxIR0.Readdress.Oracle.readdress_compatible
+        (IxIR0.Readdress.Oracle.Readdressable.empty attached.source.erasure.result.addressMap))
+      horacles hctx hframe hbelow hsource
+  obtain ⟨rawValue, sourceRelation, addressedValueEq⟩ := sourceRelation
+  subst addressedValue
+  have lowered : (lowerAllAction attached.source.erasure.result.declarations
+      attached.source.erasure.result.main .shared lowerFuel).run {} =
+      .ok (attached.source.lowering.raw, attached.source.lowering.mainCode)
+        attached.source.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using attached.source.lowering.lowerRun
+  have progress := lowerAllAction_main_progress_of_trace_sealed rfl lowered
+    (fun member => attached.source.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+    (attached.source.exactExtraRepresented (fun _ _ => none))
+    (attached.source.exactCompilerContracts (fun _ _ => none)).1
+    (attached.source.externValueContract (fun _ _ => none))
+    (attached.source.externTraceProgressContract (fun _ _ => none)) trace
+  have simulation : SemanticForwardSimulation attached.source.addressedSourceCtx
+      (attached.source.exactTargetCtx (fun _ _ => none))
+      attached.source.erasure.result.main attached.source.lowering.mainCode
+      attached.source.functionRel := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed rfl lowered
+      (fun member => attached.source.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+      (attached.source.exactExtraRepresented (fun _ _ => none))
+      (attached.source.exactCompilerContracts (fun _ _ => none)).1
+      (attached.source.externValueContract (fun _ _ => none))
+    intro _ _ _
+    exact progress
+  obtain ⟨ir1Fuel, rawStore, ir1Value, rawRun, graph⟩ := simulation trace.run
+  let rename := attached.source.lowering.result.rebuildRename attached.source.lowering.raw
+  let ir1Store := IxIR1.Readdress.Store.mapAddresses rename rawStore
+  have ownership := lowerAllAction_main_owned lowered
+    (attached.source.exactExtraRepresented (fun _ _ => none))
+    (attached.source.exactCompilerContracts (fun _ _ => none)).1 rawRun
+  have rawWorld : IxIR1.Sim.HasWorld rawStore .shared ir1Value :=
+    ownership.roots_world ⟨.shared, ir1Value⟩ (by simp)
+  have finalWorld : IxIR1.Sim.HasWorld ir1Store .shared ir1Value :=
+    (IxIR1.Sim.hasWorld_mapAddresses_iff rename rawStore .shared ir1Value).mpr rawWorld
+  have sourceRun : IxIR1.runMain attached.compiled.simulationSourceContext
+      attached.source.lowering.result.main ir1Fuel = .ok (ir1Store, ir1Value) := by
+    have audit : attached.source.lowering.result.rebuildSemanticAudit
+        attached.source.lowering.raw attached.source.lowering.mainCode = true :=
+      attached.compiled.sourceRebuildSemanticAudit
+    have renames : IxIR1.Readdress.Ctx.Renames rename
+        (attached.source.exactTargetCtx (fun _ _ => none))
+        attached.compiled.simulationSourceContext := attached.compiled.sourceContextRenames
+    rw [attached.source.lowering.result.main_eq_rebuildMapAddresses audit]
+    rw [IxIR1.Readdress.runMain_mapAddresses renames
+      attached.source.lowering.mainCode ir1Fuel, rawRun]
+    rfl
+  have mainEq : attached.target.artifact.source.main = attached.source.lowering.result.main := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+    rfl
+  have resultEq : attached.target.artifact.source.mainResult = .shared := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+  have ownedRun : IxIR1.runOwnedMain attached.compiled.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main ir1Fuel =
+      .ok (ir1Store, ir1Value) := by
+    rw [mainEq, resultEq]
+    unfold IxIR1.runOwnedMain
+    change (IxIR1.runMain attached.compiled.simulationSourceContext
+      attached.source.lowering.result.main ir1Fuel >>= IxIR1.checkResultWorld .shared) = _
+    rw [sourceRun]
+    simp [IxIR1.checkResultWorld, IxIR1.Sim.rval_hasWorld_eq_true_iff.mpr finalWorld]
+  obtain ⟨controlFuel, heapFuel, physicalResult, physicalRun, related⟩ :=
+    attached.compiled.successfulPhysicalMainSimulation ownedRun
+  refine ⟨rawValue, ir1Fuel, ir1Store, ir1Value, controlFuel, heapFuel, physicalResult,
+    sourceRelation, ⟨rawStore, rfl, graph⟩, ?_, physicalRun, related⟩
+  simpa only [resultEq] using ownedRun
+
+end Ix.Compiler.IxIR2.Pipeline
diff --git a/Ix/Compiler/IxIR2/UniqueLower.lean b/Ix/Compiler/IxIR2/UniqueLower.lean
new file mode 100644
index 000000000..db1c281bf
--- /dev/null
+++ b/Ix/Compiler/IxIR2/UniqueLower.lean
@@ -0,0 +1,140 @@
+import Ix.Compiler.UniqueReuse.Lower
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR2.Reuse
+
+/-! A separate consuming translation rule for a checked unique recursor.
+The ordinary lowerer's non-scalar shallow-free rejection remains intact.
+Here the complete case/field/free shape is known: `takeUnique` transfers every
+field, and `discardCredit` implements the original shallow free. Every output
+crosses the ordinary call-local v0 validator before optional static reuse. -/
+
+namespace Ix.Compiler.IxIR2.UniqueLower
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+open Ix.Compiler.UniqueReuse (nilId consId functionAddress)
+
+def policyTag : String := "consuming-unique-recursor/1"
+def reusePolicyTag : String := "static-unique-reuse/1"
+
+def schemas (schema : Schema) : Owned → CtorId → Option CtorSchema
+  | .unique, identity =>
+      if identity == nilId schema then
+        some { layout := Pipeline.baselineLayout .unique identity, fields := #[] }
+      else if identity == consId schema then
+        some { layout := Pipeline.baselineLayout .unique identity, fields := #[.unique, .unique] }
+      else none
+  | .shared, _ => none
+
+def signature : Signature :=
+  { params := #[{ world := .unique, passing := .owned }, { world := .unique, passing := .owned }]
+    result := .unique, papSafe := false }
+
+def entryBlock (schema : Schema) : Block :=
+  { valueParams := #[.owned .unique, .owned .unique], creditParams := #[], instructions := #[]
+    terminator := .switchValue (.reg 1) #[
+      { cid := nilId schema, edge := { target := 1, values := #[.reg 0, .reg 1], credits := #[] } },
+      { cid := consId schema, edge := { target := 2, values := #[.reg 0, .reg 1], credits := #[] } }] none }
+
+def nilBlock (schema : Schema) : Block :=
+  { valueParams := #[.owned .unique, .owned .unique], creditParams := #[]
+    instructions := #[.takeUnique (.reg 1) (nilId schema), .discardCredit 0]
+    terminator := .ret (.reg 0) }
+
+def consBlock (schema : Schema) (reuse : Bool) : Block :=
+  { valueParams := #[.owned .unique, .owned .unique], creditParams := #[]
+    instructions := #[.takeUnique (.reg 1) (consId schema)] ++
+      (if reuse then #[.allocWith 0 .unique (consId schema) #[.reg 2, .reg 0]]
+       else #[.discardCredit 0, .alloc .unique (consId schema) #[.reg 2, .reg 0]])
+    terminator := .tailCallSelf #[.reg 4, .reg 3] }
+
+def function (schema : Schema) (reuse : Bool) : Function :=
+  { signature, blocks := #[entryBlock schema, nilBlock schema, consBlock schema reuse] }
+
+def inputInstructions (plan : Plan) : Array Instr :=
+  #[.alloc .unique (nilId plan.schema) #[]] ++
+    (plan.values.reverse.mapIdx fun index value =>
+      .alloc .unique (consId plan.schema) #[.lit (.nat value), .reg index]).toArray ++
+    #[.alloc .unique (nilId plan.schema) #[]]
+
+def mainFunction (plan : Plan) : Function :=
+  { signature := { params := #[], result := .unique, papSafe := false }
+    blocks := #[
+      { valueParams := #[], creditParams := #[], instructions := inputInstructions plan
+        terminator := .tailCall (functionAddress plan.schema)
+          #[.reg (plan.values.length + 1), .reg plan.values.length] }] }
+
+def program (plan : Plan) (reuse : Bool) : Program :=
+  { declarations := [(functionAddress plan.schema, .fn (function plan.schema reuse))]
+    main := mainFunction plan }
+
+def context (schema : Schema) : Validate.Context := { schemas := schemas schema }
+
+def input (plan : Plan) : Lower.Input :=
+  { declarations := Ix.Compiler.UniqueReuse.declarations plan.schema
+    main := Ix.Compiler.UniqueReuse.mainCode plan, mainResult := .unique }
+
+structure Translation (source : Lower.Input) (plan : Plan) (limits : Validate.Limits) where
+  sourceEq : source = input plan
+  checked : Validate.Checked limits (context plan.schema) (program plan false)
+
+def translate (plan : Plan) (limits : Validate.Limits := Validate.defaultLimits) :
+    Except String (Translation (input plan) plan limits) :=
+  match hc : Validate.validateWith limits (context plan.schema) (program plan false) with
+  | .error error => .error s!"consuming target rejected: {repr error}"
+  | .ok stats => .ok { sourceEq := rfl, checked := { stats, accepted := hc } }
+
+inductive Skip where
+  | disabled
+  | rewriteBudget
+  | liveness (detail : String)
+  | layout
+  | validation (error : Validate.Error)
+  deriving Repr
+
+structure ReusePolicy where
+  enabled : Bool := true
+  maxRewrites : Nat := 1
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+inductive Selection (plan : Plan) (limits : Validate.Limits) where
+  | baseline (reason : Skip) (checked : Validate.Checked limits (context plan.schema) (program plan false))
+  | optimized (placement : Reuse.Placement (consBlock plan.schema false))
+      (valueEq : placement.value = 1) (positionEq : placement.position = 0)
+      (checked : Validate.Checked limits (context plan.schema) (program plan true))
+
+def Selection.reused {plan : Plan} {limits : Validate.Limits} : Selection plan limits → Bool
+  | .baseline .. => false
+  | .optimized .. => true
+
+def Selection.program {plan : Plan} {limits : Validate.Limits} (selection : Selection plan limits) : Program :=
+  UniqueLower.program plan selection.reused
+
+def Selection.checked {plan : Plan} {limits : Validate.Limits} (selection : Selection plan limits) :
+    Validate.Checked limits (context plan.schema) selection.program := by
+  cases selection with
+  | baseline _ checked => exact checked
+  | optimized _ _ _ checked => exact checked
+
+/-- The source instance fixes both constructors of this reuse site. Liveness
+still certifies the actual consumed register, and complete validation checks
+the target credit and field transfers. Any optional failure retains the exact
+checked consuming baseline. -/
+def select (plan : Plan) (limits : Validate.Limits)
+    (baseline : Validate.Checked limits (context plan.schema) (program plan false))
+    (policy : ReusePolicy := {}) : Selection plan limits :=
+  if !policy.enabled then .baseline .disabled baseline
+  else if policy.maxRewrites == 0 then .baseline .rewriteBudget baseline
+  else match hp : Reuse.inferPlacementWith limits (consBlock plan.schema false) 1 0 with
+    | .error error => .baseline (.liveness s!"{repr error}") baseline
+    | .ok none => .baseline (.liveness "unique source has a later use") baseline
+    | .ok (some placement) =>
+        have hm := Reuse.inferPlacementWith_sound hp
+        match schemas plan.schema .unique (consId plan.schema) with
+        | none => .baseline .layout baseline
+        | some _ =>
+            match hc : Validate.validateWith limits (context plan.schema) (program plan true) with
+            | .error error => .baseline (.validation error) baseline
+            | .ok stats => .optimized placement hm.1 hm.2 { stats, accepted := hc }
+
+end Ix.Compiler.IxIR2.UniqueLower
diff --git a/Ix/Compiler/IxIR2/Validate.lean b/Ix/Compiler/IxIR2/Validate.lean
new file mode 100644
index 000000000..f9a8305ca
--- /dev/null
+++ b/Ix/Compiler/IxIR2/Validate.lean
@@ -0,0 +1,1093 @@
+import Ix.Compiler.IxIR2.CreditPolicy
+import Std.Data.HashMap
+
+/-!
+# Bounded executable validation for IxIR₂
+
+The checker treats the CFG and its capability annotations as untrusted input.
+It reconstructs ownership flow within every block, checks complete transfer at
+every edge, validates borrow/lender remapping, and keeps reuse credits linear
+in a register file separate from ordinary values.
+
+All traversals are structurally finite, and explicit limits reject oversized
+artifacts before they can make certificate checking unexpectedly expensive.
+-/
+
+namespace Ix.Compiler.IxIR2.Validate
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+/-- Stable identity for the function currently being checked. -/
+inductive Owner where
+  | main
+  | declaration (address : Address)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Site where
+  owner : Owner
+  block : BlockId
+  instruction : Option Nat := none
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- A checked fact permitting the deliberately narrow v0 shallow-free rule. -/
+structure ScalarLeafFact where
+  owner : Owner
+  block : BlockId
+  value : ValueId
+  cid : CtorId
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Trusted inputs selected by the enclosing certificate boundary.  Constructor
+schemas are keyed by world because unique and shared layouts may differ. -/
+structure Context where
+  schemas : Owned → CtorId → Option CtorSchema := fun _ _ => none
+  scalarLeaves : List ScalarLeafFact := []
+  /-- Generic tooling may opt in; validator-gated compilation leaves this off. -/
+  allowExtern : Bool := false
+
+/-- Explicit denial-of-service bounds for untrusted CFGs and sidecars. -/
+structure Limits where
+  maxDeclarations : Nat := 4096
+  maxBlocks : Nat := 16384
+  maxBlocksPerFunction : Nat := 4096
+  maxInstructionsPerBlock : Nat := 65536
+  maxValueParams : Nat := 4096
+  maxCreditParams : Nat := 4096
+  maxOperands : Nat := 4096
+  maxAlternatives : Nat := 4096
+  maxValueRegisters : Nat := 262144
+  maxCreditRegisters : Nat := 262144
+  maxScalarLeafFacts : Nat := 65536
+  maxFlowWork : Nat := 16777216
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def defaultLimits : Limits := {}
+
+inductive Resource where
+  | declarations
+  | blocks
+  | blocksPerFunction
+  | instructionsPerBlock
+  | valueParameters
+  | creditParameters
+  | operands
+  | alternatives
+  | valueRegisters
+  | creditRegisters
+  | scalarLeafFacts
+  | flowWork
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Coarse, stable rejection classes.  Human-readable detail remains free to
+improve without making callers parse strings. -/
+inductive Violation where
+  | signature
+  | schema
+  | register
+  | ownership
+  | borrow
+  | credit
+  | call
+  | controlFlow
+  | resources
+  | externBoundary
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Error where
+  | limit (site : Site) (resource : Resource) (actual maximum : Nat)
+  | duplicateDeclaration (address : Address)
+  | invalid (site : Site) (violation : Violation) (detail : String)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Structural work accepted by a successful validation. -/
+structure Stats where
+  declarations : Nat := 0
+  functions : Nat := 0
+  blocks : Nat := 0
+  instructions : Nat := 0
+  edges : Nat := 0
+  flowWork : Nat := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Stats.add (left right : Stats) : Stats :=
+  { declarations := left.declarations + right.declarations
+    functions := left.functions + right.functions
+    blocks := left.blocks + right.blocks
+    instructions := left.instructions + right.instructions
+    edges := left.edges + right.edges
+    flowWork := left.flowWork + right.flowWork }
+
+private abbrev Check := Except Error
+
+private def failAt (site : Site) (violation : Violation) (detail : String) :
+    Check α :=
+  .error (.invalid site violation detail)
+
+private def checkLimit (site : Site) (resource : Resource)
+    (actual maximum : Nat) : Check Unit :=
+  if actual ≤ maximum then
+    return ()
+  else
+    .error (.limit site resource actual maximum)
+
+private def instructionSite (site : Site) (index : Nat) : Site :=
+  { site with instruction := some index }
+
+private def foldIdxM (xs : List α) (initial : σ)
+    (step : Nat → σ → α → Check σ) : Check σ :=
+  let rec go (index : Nat) (state : σ) : List α → Check σ
+    | [] => return state
+    | value :: rest => do
+        let state ← step index state value
+        go (index + 1) state rest
+  go 0 initial xs
+
+/-! ## Sparse last-use indexing for non-lexical borrow death -/
+
+private abbrev LastUses := Std.HashMap ValueId Nat
+
+private def recordAtomUse (position : Nat) (uses : LastUses) : Atom → LastUses
+  | .reg id => uses.insert id position
+  | .lit _ | .erased => uses
+
+private def recordAtomUses (position : Nat) (uses : LastUses)
+    (atoms : Array Atom) : LastUses :=
+  atoms.foldl (recordAtomUse position) uses
+
+private def recordEdgeUses (position : Nat) (uses : LastUses)
+    (edge : Edge) : LastUses :=
+  recordAtomUses position uses edge.values
+
+private def recordInstrUses (position : Nat) (uses : LastUses) :
+    Instr → LastUses
+  | .move value => recordAtomUse position uses value
+  | .alloc _ _ args | .allocWith _ _ _ args =>
+      recordAtomUses position uses args
+  | .discardCredit _ => uses
+  | .takeUnique target _ | .resetShared target _ |
+      .retainShared target | .releaseShared target | .dropUnique target |
+      .freeUnique target _ | .fetch target _ _ =>
+      recordAtomUse position uses target
+  | .call _ args | .callSelf args | .papp _ args | .extern _ args =>
+      recordAtomUses position uses args
+  | .apply function args =>
+      recordAtomUses position (recordAtomUse position uses function) args
+
+private def recordTerminatorUses (position : Nat) (uses : LastUses) :
+    Terminator → LastUses
+  | .jump edge => recordEdgeUses position uses edge
+  | .switchValue scrutinee constructors natPeel =>
+      let uses := recordAtomUse position uses scrutinee
+      let uses := constructors.foldl
+        (fun current alternative => recordEdgeUses position current alternative.edge) uses
+      match natPeel with
+      | none => uses
+      | some peel =>
+          recordEdgeUses position (recordEdgeUses position uses peel.zero) peel.succ
+  | .branchCredit _ someEdge noneEdge =>
+      recordEdgeUses position (recordEdgeUses position uses someEdge) noneEdge
+  | .ret value => recordAtomUse position uses value
+  | .tailCall _ args | .tailCallSelf args => recordAtomUses position uses args
+
+private def lastUses (block : Block) : LastUses :=
+  let rec go (position : Nat) (uses : LastUses) : List Instr → LastUses
+    | [] => recordTerminatorUses position uses block.terminator
+    | instruction :: rest =>
+        go (position + 1) (recordInstrUses position uses instruction) rest
+  go 0 {} block.instructions.toList
+
+/-! ## Capability-flow state -/
+
+private structure Flow where
+  values : Array ValueCap
+  valueLive : Array Bool
+  credits : Array CreditCap
+  creditLive : Array Bool
+  lastUses : LastUses
+  loanLastUses : LastUses
+  position : Nat
+
+private def valueCapIsOwner : ValueCap → Bool
+  | .owned _ => true
+  | _ => false
+
+private def recordLoanLastUse (uses : LastUses) (loans : LastUses)
+    (id : ValueId) (capability : ValueCap) : LastUses :=
+  match capability, uses.get? id with
+  | .borrowed _ (.value lender), some finalUse =>
+      let previous := (loans.get? lender).getD 0
+      loans.insert lender (max previous finalUse)
+  | _, _ => loans
+
+private def Flow.ofBlock (block : Block) (uses : LastUses) : Flow :=
+  let loans := (List.range block.valueParams.size).foldl (fun current id =>
+    match (block.valueParams)[id]? with
+    | some capability => recordLoanLastUse uses current id capability
+    | none => current) {}
+  { values := block.valueParams
+    valueLive := block.valueParams.map valueCapIsOwner
+    credits := block.creditParams
+    creditLive := block.creditParams.map fun _ => true
+    lastUses := uses
+    loanLastUses := loans
+    position := 0 }
+
+private def Flow.pushValue (limits : Limits) (site : Site)
+    (flow : Flow) (capability : ValueCap) : Check Flow := do
+  let size := flow.values.size + 1
+  checkLimit site .valueRegisters size limits.maxValueRegisters
+  let id := flow.values.size
+  return { flow with
+    values := flow.values.push capability
+    valueLive := flow.valueLive.push (valueCapIsOwner capability)
+    loanLastUses := recordLoanLastUse flow.lastUses flow.loanLastUses id capability }
+
+private def Flow.pushCredit (limits : Limits) (site : Site)
+    (flow : Flow) (capability : CreditCap) : Check Flow := do
+  let size := flow.credits.size + 1
+  checkLimit site .creditRegisters size limits.maxCreditRegisters
+  return { flow with
+    credits := flow.credits.push capability
+    creditLive := flow.creditLive.push true }
+
+private def Flow.liveValue (flow : Flow) (id : ValueId) : Bool :=
+  ((flow.valueLive)[id]?).getD false
+
+private def Flow.liveCredit (flow : Flow) (id : CreditId) : Bool :=
+  ((flow.creditLive)[id]?).getD false
+
+private def Flow.killValue (flow : Flow) (id : ValueId) : Flow :=
+  { flow with valueLive := flow.valueLive.setIfInBounds id false }
+
+private def Flow.killCredit (flow : Flow) (id : CreditId) : Flow :=
+  { flow with creditLive := flow.creditLive.setIfInBounds id false }
+
+private def readReg (site : Site) (flow : Flow) (id : ValueId) :
+    Check ValueCap := do
+  let capability ← match (flow.values)[id]? with
+    | none => failAt site .register s!"unknown value register {id}"
+    | some capability => pure capability
+  match capability with
+  | .scalar => return .scalar
+  | .owned world =>
+      if flow.liveValue id then
+        return .owned world
+      else
+        failAt site .ownership s!"value register {id} has already been consumed"
+  | .borrowed world .caller => return .borrowed world .caller
+  | .borrowed world (.value lender) =>
+      match (flow.values)[lender]? with
+      | some (.owned lenderWorld) =>
+          if lenderWorld != world then
+            failAt site .borrow
+              s!"borrow {id} and lender {lender} have different worlds"
+          else if flow.liveValue lender then
+            return .borrowed world (.value lender)
+          else
+            failAt site .borrow s!"borrow {id} outlives lender {lender}"
+      | _ => failAt site .borrow s!"borrow {id} has no owning lender {lender}"
+
+private def readAtom (site : Site) (flow : Flow) : Atom → Check ValueCap
+  | .reg id => readReg site flow id
+  | .lit _ | .erased => return .scalar
+
+private def ensureNoLiveLoans (site : Site) (flow : Flow) (lender : ValueId)
+    (_remaining : List Instr) (_terminator : Terminator) : Check Unit :=
+  if (flow.loanLastUses.get? lender).any fun finalUse => flow.position < finalUse then
+    failAt site .borrow s!"owner {lender} is consumed before its last loan use"
+  else
+    return ()
+
+/-- Consume an argument for an owned interface.  Scalars dynamically satisfy
+either world and therefore carry no token. -/
+private def consumeExpected (site : Site) (flow : Flow) (value : Atom)
+    (expected : Owned) (remaining : List Instr) (terminator : Terminator) :
+    Check Flow := do
+  match value with
+  | .lit _ | .erased => return flow
+  | .reg id =>
+      match ← readReg site flow id with
+      | .scalar => return flow
+      | .owned world =>
+          if world != expected then
+            failAt site .ownership s!"value {id} has the wrong ownership world"
+          else
+            ensureNoLiveLoans site flow id remaining terminator
+            return flow.killValue id
+      | .borrowed _ _ =>
+          failAt site .ownership s!"borrowed value {id} cannot transfer ownership"
+
+/-- Consume a concrete heap owner; unlike an interface argument, a scalar is
+not accepted. -/
+private def consumeConcrete (site : Site) (flow : Flow) (value : Atom)
+    (expected : Owned) (remaining : List Instr) (terminator : Terminator) :
+    Check (Flow × ValueId) := do
+  match value with
+  | .reg id =>
+      match ← readReg site flow id with
+      | .owned world =>
+          if world != expected then
+            failAt site .ownership s!"value {id} has the wrong ownership world"
+          else
+            ensureNoLiveLoans site flow id remaining terminator
+            return (flow.killValue id, id)
+      | .scalar => failAt site .ownership "a constructor location was required"
+      | .borrowed _ _ => failAt site .ownership "a borrowed constructor cannot be consumed"
+  | .lit _ | .erased => failAt site .ownership "a constructor location was required"
+
+private def observeExpected (site : Site) (flow : Flow) (value : Atom)
+    (expected : Owned) : Check Unit := do
+  match ← readAtom site flow value with
+  | .scalar => return ()
+  | .owned world | .borrowed world _ =>
+      if world == expected then
+        return ()
+      else
+        failAt site .ownership "observed value has the wrong ownership world"
+
+private def requireStaticScalar (site : Site) (flow : Flow)
+    (value : Atom) : Check Unit := do
+  match ← readAtom site flow value with
+  | .scalar => return ()
+  | _ => failAt site .externBoundary "extern operands must be statically scalar"
+
+private def getCredit (site : Site) (flow : Flow) (id : CreditId) :
+    Check CreditCap := do
+  match (flow.credits)[id]? with
+  | none => failAt site .register s!"unknown credit register {id}"
+  | some capability =>
+      if flow.liveCredit id then
+        return capability
+      else
+        failAt site .credit s!"credit register {id} has already been consumed"
+
+private def consumeCredit (site : Site) (flow : Flow) (id : CreditId)
+    (layout : Option LayoutId := none) : Check Flow := do
+  let capability ← getCredit site flow id
+  match layout with
+  | none => return flow.killCredit id
+  | some expected =>
+      let actual := match capability with
+        | .required found | .optional found => found
+      if actual == expected then
+        return flow.killCredit id
+      else
+        failAt site .credit "reuse credit has an incompatible layout"
+
+private def lookupSchema (limits : Limits) (context : Context) (site : Site)
+    (world : Owned) (cid : CtorId) : Check CtorSchema := do
+  let schema ← match context.schemas world cid with
+    | none => failAt site .schema "missing constructor schema"
+    | some schema => pure schema
+  checkLimit site .operands schema.fields.size limits.maxOperands
+  if schema.fields.all fun fieldWorld => fieldWorld == world then
+    return schema
+  else
+    failAt site .schema "v0 constructor fields do not agree with their representation world"
+
+private def appendFields (limits : Limits) (site : Site) (flow : Flow)
+    (fields : Array Owned) : Check Flow :=
+  fields.toList.foldlM
+    (fun current world => current.pushValue limits site (.owned world)) flow
+
+private abbrev DeclarationIndex := Std.HashMap Address Decl
+
+private def declarationIndex (declarations : List (Address × Decl)) :
+    DeclarationIndex :=
+  declarations.foldl (fun index entry => index.insert entry.1 entry.2) {}
+
+private def declarationAt? (index : DeclarationIndex) (address : Address) :
+    Option Decl :=
+  index.get? address
+
+private def duplicateAddress? : List (Address × Decl) → Option Address :=
+  let rec go (seen : Std.HashMap Address Unit) :
+      List (Address × Decl) → Option Address
+    | [] => none
+    | (address, _) :: rest =>
+        if (seen.get? address).isSome then some address
+        else go (seen.insert address ()) rest
+  go {}
+
+/-! ## Instruction transfer -/
+
+private def checkOperandCount (limits : Limits) (site : Site)
+    (operands : Array α) : Check Unit :=
+  checkLimit site .operands operands.size limits.maxOperands
+
+private def edgeSyntaxWork (edge : Edge) : Nat :=
+  1 + edge.values.size + edge.credits.size
+
+private def instructionSyntaxWork : Instr → Nat
+  | .alloc _ _ arguments | .allocWith _ _ _ arguments |
+      .call _ arguments | .callSelf arguments | .papp _ arguments |
+      .extern _ arguments => 1 + arguments.size
+  | .apply _ arguments => 2 + arguments.size
+  | _ => 2
+
+private def terminatorSyntaxWork : Terminator → Nat
+  | .jump edge => edgeSyntaxWork edge
+  | .switchValue _ constructors natPeel =>
+      2 + constructors.size * constructors.size +
+        constructors.foldl (fun total alternative =>
+          total + edgeSyntaxWork alternative.edge) 0 +
+        match natPeel with
+        | none => 0
+        | some peel => edgeSyntaxWork peel.zero + edgeSyntaxWork peel.succ
+  | .branchCredit _ someEdge noneEdge =>
+      1 + edgeSyntaxWork someEdge + edgeSyntaxWork noneEdge
+  | .ret _ => 2
+  | .tailCall _ arguments | .tailCallSelf arguments => 1 + arguments.size
+
+private def checkEdgeSyntaxBounds (limits : Limits) (site : Site)
+    (edge : Edge) : Check Unit := do
+  checkOperandCount limits site edge.values
+  checkOperandCount limits site edge.credits
+
+private def checkInstructionSyntaxBounds (limits : Limits) (site : Site) :
+    Instr → Check Unit
+  | .alloc _ _ arguments | .allocWith _ _ _ arguments |
+      .call _ arguments | .callSelf arguments | .papp _ arguments |
+      .extern _ arguments | .apply _ arguments =>
+      checkOperandCount limits site arguments
+  | _ => return ()
+
+private def checkTerminatorSyntaxBounds (limits : Limits) (site : Site) :
+    Terminator → Check Unit
+  | .jump edge => checkEdgeSyntaxBounds limits site edge
+  | .switchValue _ constructors natPeel => do
+      let alternatives := constructors.size + if natPeel.isSome then 2 else 0
+      checkLimit site .alternatives alternatives limits.maxAlternatives
+      for alternative in constructors do
+        checkEdgeSyntaxBounds limits site alternative.edge
+      match natPeel with
+      | none => return ()
+      | some peel =>
+          checkEdgeSyntaxBounds limits site peel.zero
+          checkEdgeSyntaxBounds limits site peel.succ
+  | .branchCredit _ someEdge noneEdge => do
+      checkEdgeSyntaxBounds limits site someEdge
+      checkEdgeSyntaxBounds limits site noneEdge
+  | .ret _ => return ()
+  | .tailCall _ arguments | .tailCallSelf arguments =>
+      checkOperandCount limits site arguments
+
+private def checkBlockSyntaxBounds (limits : Limits) (site : Site)
+    (block : Block) : Check Nat := do
+  for instruction in block.instructions do
+    checkInstructionSyntaxBounds limits site instruction
+  checkTerminatorSyntaxBounds limits site block.terminator
+  let work := block.instructions.foldl
+    (fun total instruction => total + instructionSyntaxWork instruction) 0 +
+      terminatorSyntaxWork block.terminator
+  checkLimit site .flowWork work limits.maxFlowWork
+  return work
+
+private def consumeFieldArguments (limits : Limits) (site : Site)
+    (flow : Flow) (arguments : Array Atom) (fields : Array Owned)
+    (remaining : List Instr) (terminator : Terminator) : Check Flow := do
+  checkOperandCount limits site arguments
+  if arguments.size != fields.size then
+    failAt site .schema "constructor argument count does not match its schema"
+  else
+    (arguments.toList.zip fields.toList).foldlM
+      (fun current pair =>
+        consumeExpected site current pair.1 pair.2 remaining terminator) flow
+
+private def checkCallArity (limits : Limits) (site : Site)
+    (arguments : Array Atom) (signature : Signature) : Check Unit := do
+  checkOperandCount limits site arguments
+  if arguments.size == signature.params.size then
+    return ()
+  else
+    failAt site .call "call arity does not match the addressed signature"
+
+/-- Owned arguments are processed before borrowed arguments.  Thus passing an
+owner and one of its loans to the same call is rejected regardless of their
+parameter order. -/
+private def checkCallArguments (limits : Limits) (site : Site) (flow : Flow)
+    (arguments : Array Atom) (signature : Signature)
+    (remaining : List Instr) (terminator : Terminator) : Check Flow := do
+  checkCallArity limits site arguments signature
+  let pairs := arguments.toList.zip signature.params.toList
+  let flow ← pairs.foldlM (fun current pair =>
+    match pair.2.passing with
+    | .owned =>
+        consumeExpected site current pair.1 pair.2.world remaining terminator
+    | .borrowed => return current) flow
+  pairs.foldlM (fun current pair => do
+    match pair.2.passing with
+    | .owned => return current
+    | .borrowed =>
+        observeExpected site current pair.1 pair.2.world
+        return current) flow
+
+private def checkPapSignature (site : Site) (signature : Signature) :
+    Check Unit :=
+  if signature.papSafe && signature.result == .shared &&
+      signature.params.all fun parameter =>
+        parameter.passing == .owned && parameter.world == .shared then
+    return ()
+  else
+    failAt site .call "partial application target is not papSafe"
+
+private def consumePapArguments (limits : Limits) (site : Site) (flow : Flow)
+    (arguments : Array Atom) (signature : Signature)
+    (remaining : List Instr) (terminator : Terminator) : Check Flow := do
+  checkOperandCount limits site arguments
+  checkPapSignature site signature
+  if arguments.size < signature.params.size then
+    arguments.toList.foldlM
+      (fun current argument =>
+        consumeExpected site current argument .shared remaining terminator) flow
+  else
+    failAt site .call "partial application must be strictly under-saturated"
+
+private def consumeApplyArguments (limits : Limits) (site : Site) (flow : Flow)
+    (function : Atom) (arguments : Array Atom) (remaining : List Instr)
+    (terminator : Terminator) : Check Flow := do
+  checkOperandCount limits site arguments
+  let flow ← consumeExpected site flow function .shared remaining terminator
+  arguments.toList.foldlM
+    (fun current argument =>
+      consumeExpected site current argument .shared remaining terminator) flow
+
+private def ensureNoLiveCallCredit (site : Site) (flow : Flow) : Check Unit :=
+  if flow.creditLive.any id then
+    failAt site .credit "reuse credits cannot remain live across a call boundary"
+  else
+    return ()
+
+private def appendCallResult (limits : Limits) (site : Site) (flow : Flow)
+    (signature : Signature) : Check Flow :=
+  flow.pushValue limits site (.owned signature.result)
+
+private def validateInstruction (policy : CreditPolicy)
+    (limits : Limits) (context : Context)
+    (declarations : DeclarationIndex) (signature : Signature) (site : Site)
+    (flow : Flow) (instruction : Instr) (remaining : List Instr)
+    (terminator : Terminator) : Check Flow := do
+  match instruction with
+  | .move value =>
+      match value with
+      | .lit _ | .erased => flow.pushValue limits site .scalar
+      | .reg id =>
+          match ← readReg site flow id with
+          | .scalar => flow.pushValue limits site .scalar
+          | .borrowed world lender =>
+              flow.pushValue limits site (.borrowed world lender)
+          | .owned world =>
+              ensureNoLiveLoans site flow id remaining terminator
+              (flow.killValue id).pushValue limits site (.owned world)
+  | .alloc world cid arguments =>
+      let schema ← lookupSchema limits context site world cid
+      let flow ← consumeFieldArguments limits site flow arguments schema.fields
+        remaining terminator
+      flow.pushValue limits site (.owned world)
+  | .allocWith credit world cid arguments =>
+      let schema ← lookupSchema limits context site world cid
+      let flow ← consumeCredit site flow credit (some schema.layout)
+      let flow ← consumeFieldArguments limits site flow arguments schema.fields
+        remaining terminator
+      flow.pushValue limits site (.owned world)
+  | .discardCredit credit => consumeCredit site flow credit
+  | .takeUnique target cid =>
+      let schema ← lookupSchema limits context site .unique cid
+      let (flow, _) ← consumeConcrete site flow target .unique remaining terminator
+      let flow ← appendFields limits site flow schema.fields
+      flow.pushCredit limits site (.required schema.layout)
+  | .resetShared target cid =>
+      let schema ← lookupSchema limits context site .shared cid
+      let (flow, _) ← consumeConcrete site flow target .shared remaining terminator
+      let flow ← appendFields limits site flow schema.fields
+      flow.pushCredit limits site (.optional schema.layout)
+  | .retainShared target =>
+      match ← readAtom site flow target with
+      | .scalar => flow.pushValue limits site .scalar
+      | .owned .shared | .borrowed .shared _ =>
+          flow.pushValue limits site (.owned .shared)
+      | .owned .unique | .borrowed .unique _ =>
+          failAt site .ownership "retainShared requires a shared value"
+  | .releaseShared target =>
+      consumeExpected site flow target .shared remaining terminator
+  | .dropUnique target =>
+      consumeExpected site flow target .unique remaining terminator
+  | .freeUnique target cid =>
+      let _ ← lookupSchema limits context site .unique cid
+      let (flow, id) ← consumeConcrete site flow target .unique remaining terminator
+      if context.scalarLeaves.any fun fact =>
+          fact.owner == site.owner && fact.block == site.block &&
+            fact.value == id && fact.cid == cid then
+        return flow
+      else
+        failAt site .schema "freeUnique requires an exact checked scalar-leaf fact"
+  | .fetch target cid field =>
+      let capability ← readAtom site flow target
+      let (world, lender) ← match capability, target with
+        | .owned world, .reg id => pure (world, BorrowLender.value id)
+        | .borrowed world lender, _ => pure (world, lender)
+        | .scalar, _ => failAt site .ownership "fetch requires a constructor location"
+        | .owned _, _ => failAt site .register "an owned fetch target must be a register"
+      let schema ← lookupSchema limits context site world cid
+      match (schema.fields)[field]? with
+      | none => failAt site .schema s!"constructor field {field} is out of bounds"
+      | some fieldWorld =>
+          flow.pushValue limits site (.borrowed fieldWorld lender)
+  | .call function arguments =>
+      if policy == .callLocalV0 then ensureNoLiveCallCredit site flow
+      match declarationAt? declarations function with
+      | some (.fn definition) =>
+          let flow ← checkCallArguments limits site flow arguments
+            definition.signature remaining terminator
+          appendCallResult limits site flow definition.signature
+      | some (.extern _) =>
+          failAt site .call "extern declarations must use the extern instruction"
+      | none => failAt site .call "call target is not declared"
+  | .callSelf arguments =>
+      if policy == .callLocalV0 then ensureNoLiveCallCredit site flow
+      let flow ← checkCallArguments limits site flow arguments
+        signature remaining terminator
+      appendCallResult limits site flow signature
+  | .papp function arguments =>
+      ensureNoLiveCallCredit site flow
+      match declarationAt? declarations function with
+      | some (.fn definition) =>
+          let flow ← consumePapArguments limits site flow arguments
+            definition.signature remaining terminator
+          flow.pushValue limits site (.owned .shared)
+      | some (.extern arity) =>
+          if !context.allowExtern then
+            failAt site .externBoundary "extern partial applications are forbidden"
+          else if arguments.size >= arity then
+            failAt site .call "extern partial application must be under-saturated"
+          else
+            checkOperandCount limits site arguments
+            for argument in arguments do
+              requireStaticScalar site flow argument
+            flow.pushValue limits site (.owned .shared)
+      | none => failAt site .call "partial-application target is not declared"
+  | .apply function arguments =>
+      ensureNoLiveCallCredit site flow
+      let flow ← consumeApplyArguments limits site flow function arguments
+        remaining terminator
+      flow.pushValue limits site (.owned .shared)
+  | .extern function arguments =>
+      ensureNoLiveCallCredit site flow
+      if !context.allowExtern then
+        failAt site .externBoundary "extern instructions are forbidden"
+      else
+        match declarationAt? declarations function with
+        | some (.extern arity) =>
+            checkOperandCount limits site arguments
+            if arguments.size != arity then
+              failAt site .call "extern arity does not match its declaration"
+            else
+              for argument in arguments do
+                requireStaticScalar site flow argument
+              flow.pushValue limits site .scalar
+        | some (.fn _) => failAt site .call "extern target is a compiler function"
+        | none => failAt site .call "extern target is not declared"
+
+/-! ## Edge transfer and terminators -/
+
+private inductive IncomingValue where
+  | implicitScalar
+  | explicit (value : Atom)
+
+private inductive SourceRoot where
+  | caller
+  | local (id : ValueId)
+  deriving BEq
+
+private def incomingCapability (site : Site) (flow : Flow) :
+    IncomingValue → Check ValueCap
+  | .implicitScalar => return .scalar
+  | .explicit value => readAtom site flow value
+
+private def incomingSourceRoot (incoming : IncomingValue)
+    (capability : ValueCap) : Option SourceRoot :=
+  match incoming, capability with
+  | .explicit (.reg id), .owned _ => some (.local id)
+  | _, .borrowed _ .caller => some .caller
+  | _, .borrowed _ (.value lender) => some (.local lender)
+  | _, _ => none
+
+private def validateBorrowMapping (site : Site) (flow : Flow)
+    (incoming : List IncomingValue) (parameters : Array ValueCap)
+    (argument : IncomingValue) (world : Owned) (lender : BorrowLender) :
+    Check Unit := do
+  let capability ← incomingCapability site flow argument
+  match capability with
+  | .scalar => return ()
+  | .owned sourceWorld | .borrowed sourceWorld _ =>
+      if sourceWorld != world then
+        failAt site .borrow "borrowed edge argument has the wrong world"
+      else
+        match lender with
+        | .caller =>
+            match incomingSourceRoot argument capability with
+            | some .caller => return ()
+            | _ => failAt site .borrow "a caller-rooted target borrow requires a caller-rooted source borrow"
+        | .value targetLender =>
+            match (parameters)[targetLender]?, incoming[targetLender]? with
+            | some (.owned lenderWorld), some lenderArgument =>
+                if lenderWorld != world then
+                  failAt site .borrow "target borrow and lender parameters have different worlds"
+                else
+                  let lenderCapability ← incomingCapability site flow lenderArgument
+                  match incomingSourceRoot lenderArgument lenderCapability,
+                      incomingSourceRoot argument capability with
+                  | some (.local expected), some (.local actual) =>
+                      if expected == actual then return ()
+                      else failAt site .borrow "edge borrow does not map to its transferred lender"
+                  | _, _ => failAt site .borrow "edge borrow requires a concrete transferred local lender"
+            | _, _ => failAt site .borrow "target borrow names a non-owning or missing parameter"
+
+private def validateIncomingValue (site : Site) (flow : Flow)
+    (incoming : List IncomingValue) (parameters : Array ValueCap)
+    (argument : IncomingValue) (parameter : ValueCap) : Check Unit := do
+  match argument, parameter with
+  | .implicitScalar, .scalar => return ()
+  | .implicitScalar, _ =>
+      failAt site .controlFlow "the Nat successor predecessor requires a scalar parameter"
+  | .explicit _, _ =>
+      let capability ← incomingCapability site flow argument
+      match parameter with
+      | .scalar =>
+          match capability with
+          | .scalar => return ()
+          | _ => failAt site .controlFlow "a possibly heap-bearing value cannot enter a scalar block parameter"
+      | .owned world =>
+          match capability with
+          | .scalar => return ()
+          | .owned sourceWorld =>
+              if sourceWorld == world then return ()
+              else failAt site .ownership "edge owner has the wrong world"
+          | .borrowed _ _ => failAt site .ownership "a borrowed edge value cannot enter an owning parameter"
+      | .borrowed world lender =>
+          validateBorrowMapping site flow incoming parameters argument world lender
+
+private def consumeIncomingOwner (site : Site) (flow : Flow)
+    (argument : IncomingValue) (parameter : ValueCap) : Check Flow := do
+  match parameter, argument with
+  | .owned _, .implicitScalar => return flow
+  | .owned world, .explicit value =>
+      match value with
+      | .lit _ | .erased => return flow
+      | .reg id =>
+          match ← readReg site flow id with
+          | .scalar => return flow
+          | .owned sourceWorld =>
+              if sourceWorld == world then return flow.killValue id
+              else failAt site .ownership "edge owner has the wrong world"
+          | .borrowed _ _ => failAt site .ownership "a borrowed edge value cannot transfer ownership"
+  | _, _ => return flow
+
+private def consumeIncomingCredit (site : Site) (flow : Flow)
+    (id : CreditId) (parameter : CreditCap) : Check Flow := do
+  let source ← getCredit site flow id
+  match parameter, source with
+  | .required targetLayout, .required sourceLayout =>
+      if targetLayout == sourceLayout then return flow.killCredit id
+      else failAt site .credit "required edge credit has the wrong layout"
+  | .required _, .optional _ =>
+      failAt site .credit "an optional credit cannot narrow to required"
+  | .optional targetLayout, .required sourceLayout
+  | .optional targetLayout, .optional sourceLayout =>
+      if targetLayout == sourceLayout then return flow.killCredit id
+      else failAt site .credit "optional edge credit has the wrong layout"
+
+private def ensureExhausted (site : Site) (flow : Flow) : Check Unit :=
+  if flow.valueLive.any id then
+    failAt site .resources "control transfer leaves an owned value behind"
+  else if flow.creditLive.any id then
+    failAt site .resources "control transfer leaves a reuse credit behind"
+  else
+    return ()
+
+private def validateEdge (limits : Limits) (site : Site) (blocks : Array Block)
+    (flow : Flow) (edge : Edge) (implicit : List IncomingValue := []) :
+    Check Unit := do
+  checkOperandCount limits site edge.values
+  checkOperandCount limits site edge.credits
+  let target ← match (blocks)[edge.target]? with
+    | none => failAt site .controlFlow s!"edge targets missing block {edge.target}"
+    | some block => pure block
+  let incoming := implicit ++ edge.values.toList.map IncomingValue.explicit
+  if incoming.length != target.valueParams.size then
+    failAt site .controlFlow "edge value arity does not match target parameters"
+  else if edge.credits.size != target.creditParams.size then
+    failAt site .controlFlow "edge credit arity does not match target parameters"
+  else
+    let valuePairs := incoming.zip target.valueParams.toList
+    for pair in valuePairs do
+      validateIncomingValue site flow incoming target.valueParams pair.1 pair.2
+    let flow ← valuePairs.foldlM
+      (fun current pair => consumeIncomingOwner site current pair.1 pair.2) flow
+    let creditPairs := edge.credits.toList.zip target.creditParams.toList
+    let flow ← creditPairs.foldlM
+      (fun current pair => consumeIncomingCredit site current pair.1 pair.2) flow
+    ensureExhausted site flow
+
+private def duplicateCtor? : List CtorId → Option CtorId :=
+  let rec go (seen : List CtorId) : List CtorId → Option CtorId
+    | [] => none
+    | cid :: rest =>
+        if seen.any (· == cid) then some cid else go (cid :: seen) rest
+  go []
+
+private def checkTailArguments (limits : Limits) (site : Site) (flow : Flow)
+    (arguments : Array Atom) (signature : Signature)
+    (remaining : List Instr) (terminator : Terminator) : Check Flow := do
+  checkCallArity limits site arguments signature
+  let pairs := arguments.toList.zip signature.params.toList
+  let flow ← pairs.foldlM (fun current pair =>
+    match pair.2.passing with
+    | .owned =>
+        consumeExpected site current pair.1 pair.2.world remaining terminator
+    | .borrowed => return current) flow
+  pairs.foldlM (fun current pair => do
+    match pair.2.passing with
+    | .owned => return current
+    | .borrowed =>
+        match ← readAtom site current pair.1 with
+        | .scalar => return current
+        | .borrowed world .caller =>
+            if world == pair.2.world then return current
+            else failAt site .borrow "tail borrow has the wrong world"
+        | .borrowed _ (.value _) => failAt site .borrow "a borrow rooted in a local owner cannot escape through a tail call"
+        | .owned _ => failAt site .borrow "an owned local value cannot enter a borrowed tail parameter") flow
+
+private def validateTerminator (limits : Limits) (context : Context)
+    (declarations : DeclarationIndex) (signature : Signature) (site : Site)
+    (blocks : Array Block) (flow : Flow) (terminator : Terminator) :
+    Check Nat := do
+  match terminator with
+  | .jump edge =>
+      validateEdge limits site blocks flow edge
+      return 1
+  | .switchValue scrutinee constructors natPeel =>
+      let alternatives := constructors.size + if natPeel.isSome then 2 else 0
+      checkLimit site .alternatives alternatives limits.maxAlternatives
+      if alternatives == 0 then
+        failAt site .controlFlow "switchValue requires at least one alternative"
+      else
+        match duplicateCtor? (constructors.toList.map (·.cid)) with
+        | some _ => failAt site .controlFlow "switchValue repeats a constructor identity"
+        | none =>
+            let capability ← readAtom site flow scrutinee
+            match capability with
+            | .owned world | .borrowed world _ =>
+                for alternative in constructors do
+                  let _ ← lookupSchema limits context site world alternative.cid
+                  pure ()
+            | .scalar => pure ()
+            for alternative in constructors do
+              validateEdge limits site blocks flow alternative.edge
+            match natPeel with
+            | none => pure ()
+            | some peel =>
+                validateEdge limits site blocks flow peel.zero
+                validateEdge limits site blocks flow peel.succ [.implicitScalar]
+            return alternatives
+  | .branchCredit credit someEdge noneEdge =>
+      match ← getCredit site flow credit with
+      | .required _ => failAt site .credit "branchCredit requires an optional credit"
+      | .optional layout =>
+          let someFlow :=
+            { flow with credits := flow.credits.setIfInBounds credit (.required layout) }
+          validateEdge limits site blocks someFlow someEdge
+          validateEdge limits site blocks flow noneEdge
+          return 2
+  | .ret value =>
+      let flow ← consumeExpected site flow value signature.result [] terminator
+      ensureExhausted site flow
+      return 0
+  | .tailCall function arguments =>
+      ensureNoLiveCallCredit site flow
+      match declarationAt? declarations function with
+      | some (.fn definition) =>
+          if definition.signature.result != signature.result then
+            failAt site .call "tail-call result world does not match the caller"
+          else
+            let flow ← checkTailArguments limits site flow arguments
+              definition.signature [] terminator
+            ensureExhausted site flow
+            return 0
+      | some (.extern _) => failAt site .call "tailCall cannot target an extern"
+      | none => failAt site .call "tail-call target is not declared"
+  | .tailCallSelf arguments =>
+      ensureNoLiveCallCredit site flow
+      let flow ← checkTailArguments limits site flow arguments signature [] terminator
+      ensureExhausted site flow
+      return 0
+
+/-! ## Blocks, functions, and whole programs -/
+
+private def expectedEntryParams (signature : Signature) : Array ValueCap :=
+  signature.params.map fun parameter =>
+    match parameter.passing with
+    | .owned => .owned parameter.world
+    | .borrowed => .borrowed parameter.world .caller
+
+private def validateBlockParams (limits : Limits) (site : Site)
+    (block : Block) : Check Unit := do
+  checkLimit site .valueParameters block.valueParams.size limits.maxValueParams
+  checkLimit site .creditParameters block.creditParams.size limits.maxCreditParams
+  for parameter in block.valueParams do
+    match parameter with
+    | .borrowed world (.value lender) =>
+        match (block.valueParams)[lender]? with
+        | some (.owned lenderWorld) =>
+            if lenderWorld == world then pure ()
+            else failAt site .borrow "block borrow and lender have different worlds"
+        | _ => failAt site .borrow "block borrow names a non-owning parameter"
+    | _ => pure ()
+
+private def validateBlock (policy : CreditPolicy)
+    (limits : Limits) (context : Context)
+    (declarations : DeclarationIndex) (signature : Signature) (owner : Owner)
+    (blocks : Array Block) (blockId : BlockId) (block : Block) : Check Stats := do
+  let site : Site := { owner, block := blockId }
+  validateBlockParams limits site block
+  checkLimit site .instructionsPerBlock block.instructions.size
+    limits.maxInstructionsPerBlock
+  checkLimit site .valueRegisters block.valueParams.size limits.maxValueRegisters
+  checkLimit site .creditRegisters block.creditParams.size limits.maxCreditRegisters
+  let syntaxWork ← checkBlockSyntaxBounds limits site block
+  let uses := lastUses block
+  let rec instructions (index : Nat) (flow : Flow) : List Instr → Check Flow
+    | [] => return flow
+    | instruction :: remaining => do
+        let flow := { flow with position := index }
+        let flow ← validateInstruction policy limits context declarations signature
+          (instructionSite site index) flow instruction remaining block.terminator
+        instructions (index + 1) flow remaining
+  let flow ← instructions 0 (Flow.ofBlock block uses) block.instructions.toList
+  let flow := { flow with position := block.instructions.size }
+  let flowWork := syntaxWork + flow.values.size + flow.credits.size
+  checkLimit site .flowWork flowWork limits.maxFlowWork
+  let edges ← validateTerminator limits context declarations signature site blocks flow
+    block.terminator
+  let stats : Stats :=
+    { blocks := 1
+      instructions := block.instructions.size
+      edges := edges
+      flowWork := flowWork }
+  return stats
+
+private def validateSignature (limits : Limits) (site : Site)
+    (signature : Signature) : Check Unit := do
+  checkLimit site .valueParameters signature.params.size limits.maxValueParams
+  if signature.papSafe then
+    checkPapSignature site signature
+  else
+    return ()
+
+private def validateFunction (policy : CreditPolicy)
+    (limits : Limits) (context : Context)
+    (declarations : DeclarationIndex) (owner : Owner)
+    (definition : Function) : Check Stats := do
+  let entrySite : Site := { owner, block := 0 }
+  validateSignature limits entrySite definition.signature
+  if definition.blocks.isEmpty then
+    failAt entrySite .controlFlow "function has no entry block"
+  else
+    checkLimit entrySite .blocksPerFunction definition.blocks.size
+      limits.maxBlocksPerFunction
+    let entry := definition.blocks[0]!
+    if entry.valueParams != expectedEntryParams definition.signature then
+      failAt entrySite .signature "entry value parameters do not match the function signature"
+    else if !entry.creditParams.isEmpty then
+      failAt entrySite .signature "function entry cannot accept reuse credits"
+    else
+      let stats ← foldIdxM definition.blocks.toList ({} : Stats) fun blockId current block => do
+        let blockStats ← validateBlock policy limits context declarations definition.signature owner
+          definition.blocks blockId block
+        let current := Stats.add current blockStats
+        checkLimit entrySite .flowWork current.flowWork limits.maxFlowWork
+        return current
+      return { stats with functions := stats.functions + 1 }
+
+private def structuralBlockCount (program : Program) : Nat :=
+  program.main.blocks.size + program.declarations.foldl (fun total entry =>
+    match entry.2 with
+    | .fn definition => total + definition.blocks.size
+    | .extern _ => total) 0
+
+/-- Validate under an explicit, versioned credit boundary. Suspended credits
+remain in the caller's flow, so its continuation must consume or discard them
+and every outgoing edge must transfer them linearly. Function entries accept
+no credits under either policy. -/
+def validateWithPolicy (policy : CreditPolicy)
+    (limits : Limits) (context : Context) (program : Program) :
+    Except Error Stats := do
+  let programSite : Site := { owner := .main, block := 0 }
+  checkLimit programSite .declarations program.declarations.length
+    limits.maxDeclarations
+  checkLimit programSite .scalarLeafFacts context.scalarLeaves.length
+    limits.maxScalarLeafFacts
+  checkLimit programSite .blocks (structuralBlockCount program) limits.maxBlocks
+  let declarationWork := program.declarations.length * 2
+  checkLimit programSite .flowWork declarationWork limits.maxFlowWork
+  if !program.main.signature.params.isEmpty then
+    failAt programSite .signature "the distinguished main function must be nullary"
+  else match duplicateAddress? program.declarations with
+  | some address => .error (.duplicateDeclaration address)
+  | none =>
+      let declarations := declarationIndex program.declarations
+      let declarationStats ← program.declarations.foldlM (fun current entry => do
+        let next ← match entry.2 with
+          | .fn definition =>
+              validateFunction policy limits context declarations (.declaration entry.1) definition
+          | .extern arity =>
+              if !context.allowExtern then
+                failAt { owner := .declaration entry.1, block := 0 }
+                  .externBoundary "extern declarations are forbidden"
+              else
+                checkLimit programSite .operands arity limits.maxOperands
+                return {}
+        let current := Stats.add current next
+        checkLimit programSite .flowWork current.flowWork limits.maxFlowWork
+        return current) ({} : Stats)
+      let mainStats ← validateFunction policy limits context declarations .main program.main
+      let overhead : Stats :=
+        { declarations := program.declarations.length
+          flowWork := declarationWork }
+      let stats := Stats.add (Stats.add declarationStats mainStats) overhead
+      checkLimit programSite .flowWork stats.flowWork limits.maxFlowWork
+      return stats
+
+/-- The existing checker retains the original call-local contract. -/
+def validateWith (limits : Limits) (context : Context) (program : Program) :
+    Except Error Stats :=
+  validateWithPolicy .callLocalV0 limits context program
+
+def validate (context : Context) (program : Program) : Except Error Stats :=
+  validateWith defaultLimits context program
+
+/-- Proof-facing acceptance predicate for an explicitly bounded check. -/
+def ValidWith (limits : Limits) (context : Context) (program : Program) : Prop :=
+  ∃ stats, validateWith limits context program = .ok stats
+
+def Valid (context : Context) (program : Program) : Prop :=
+  ValidWith defaultLimits context program
+
+/-- A checker result packaged with the equation consumed by later proofs. -/
+structure Checked (limits : Limits) (context : Context) (program : Program) where
+  stats : Stats
+  accepted : validateWith limits context program = .ok stats
+
+/-- Versioned acceptance retains the exact policy as part of its type. -/
+structure CheckedWithPolicy (policy : CreditPolicy) (limits : Limits)
+    (context : Context) (program : Program) where
+  stats : Stats
+  accepted : validateWithPolicy policy limits context program = .ok stats
+
+def Checked.withPolicy {limits : Limits} {context : Context} {program : Program}
+    (checked : Checked limits context program) :
+    CheckedWithPolicy .callLocalV0 limits context program :=
+  ⟨checked.stats, checked.accepted⟩
+
+end Ix.Compiler.IxIR2.Validate
diff --git a/Ix/Compiler/IxIR2/ValidateExamples.lean b/Ix/Compiler/IxIR2/ValidateExamples.lean
new file mode 100644
index 000000000..198cb3373
--- /dev/null
+++ b/Ix/Compiler/IxIR2/ValidateExamples.lean
@@ -0,0 +1,530 @@
+import Ix.Compiler.IxIR2.Validate
+
+/-!
+# Executable IxIR₂ validator fixtures
+
+These guards are intentionally small enough to audit by eye.  Together they
+pin the accepted credit paths and the major fail-closed ownership boundaries.
+-/
+
+namespace Ix.Compiler.IxIR2.Validate.Examples
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR2
+
+private def blockAddress : Address := Address.replicate 0x21
+private def functionAddress : Address := Address.replicate 0x31
+private def harnessAddress : Address := Address.replicate 0x32
+private def externAddress : Address := Address.replicate 0x41
+private def uniqueLayout : LayoutId := Address.replicate 0x51
+private def sharedLayout : LayoutId := Address.replicate 0x52
+private def otherLayout : LayoutId := Address.replicate 0x53
+
+private def nodeCtor : CtorId :=
+  { block := blockAddress, indIdx := 0, cidx := 0 }
+
+private def otherCtor : CtorId :=
+  { block := blockAddress, indIdx := 0, cidx := 1 }
+
+private def schemas : Owned → CtorId → Option CtorSchema
+  | .unique, cid =>
+      if cid == nodeCtor then
+        some { layout := uniqueLayout, fields := #[.unique] }
+      else if cid == otherCtor then
+        some { layout := otherLayout, fields := #[.unique] }
+      else
+        none
+  | .shared, cid =>
+      if cid == nodeCtor then
+        some { layout := sharedLayout, fields := #[.shared] }
+      else
+        none
+
+private def context : Context := { schemas }
+
+private def unarySignature (world : Owned) : Signature :=
+  { params := #[{ world, passing := .owned }]
+    result := world
+    papSafe := false }
+
+private def nullarySignature (result : Owned := .shared) : Signature :=
+  { params := #[], result, papSafe := false }
+
+/-- Keep the inner ownership fixtures unary and auditably small while checking
+them as genuine nullary-main programs. -/
+private def closeFixture (program : Program) : Program :=
+  match program.main.signature.params with
+  | #[{ world, passing := .owned }] =>
+      { declarations := (harnessAddress, .fn program.main) :: program.declarations
+        main :=
+          { signature := nullarySignature program.main.signature.result
+            blocks := #[
+              { valueParams := #[]
+                creditParams := #[]
+                instructions := #[
+                  .alloc world nodeCtor #[.lit (.nat 0)],
+                  .call harnessAddress #[.reg 0]]
+                terminator := .ret (.reg 1) }] } }
+  | _ => program
+
+private def accepts (program : Program) : Bool :=
+  match validate context (closeFixture program) with
+  | .ok _ => true
+  | .error _ => false
+
+private def rejectsAs (violation : Violation) (program : Program) : Bool :=
+  match validate context (closeFixture program) with
+  | .error (.invalid _ actual _) => actual == violation
+  | _ => false
+
+/-! A complete owner transfer across an ordinary two-block edge. -/
+
+private def simpleJump : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .jump
+              { target := 1, values := #[.reg 0], credits := #[] } },
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .ret (.reg 0) }] } }
+
+#guard accepts simpleJump
+
+#guard match validate context simpleJump with
+  | .error (.invalid _ .signature _) => true
+  | _ => false
+
+/-! Required credit: destructive take, exact-layout reuse, return. -/
+
+private def requiredReuse : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .takeUnique (.reg 0) nodeCtor,
+              .allocWith 0 .unique nodeCtor #[.reg 1]]
+            terminator := .ret (.reg 2) }] } }
+
+#guard accepts requiredReuse
+
+private def discardTakenCredit : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .takeUnique (.reg 0) nodeCtor,
+              .discardCredit 0]
+            terminator := .ret (.reg 1) }] } }
+
+#guard accepts discardTakenCredit
+
+/-! Optional shared reset: the some branch refines to required, both paths
+widen at the join, and `allocWith` consumes the joined optional credit. -/
+
+private def optionalDiamond : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .shared
+        blocks := #[
+          { valueParams := #[.owned .shared]
+            creditParams := #[]
+            instructions := #[.resetShared (.reg 0) nodeCtor]
+            terminator := .branchCredit 0
+              { target := 1, values := #[.reg 1], credits := #[0] }
+              { target := 2, values := #[.reg 1], credits := #[0] } },
+          { valueParams := #[.owned .shared]
+            creditParams := #[.required sharedLayout]
+            instructions := #[]
+            terminator := .jump
+              { target := 3, values := #[.reg 0], credits := #[0] } },
+          { valueParams := #[.owned .shared]
+            creditParams := #[.optional sharedLayout]
+            instructions := #[]
+            terminator := .jump
+              { target := 3, values := #[.reg 0], credits := #[0] } },
+          { valueParams := #[.owned .shared]
+            creditParams := #[.optional sharedLayout]
+            instructions := #[.allocWith 0 .shared nodeCtor #[.reg 0]]
+            terminator := .ret (.reg 1) }] } }
+
+#guard accepts optionalDiamond
+
+/-! One dynamic IxIR₁ scrutinee can select a constructor edge or a peeled Nat
+edge.  The successor block receives its implicit predecessor first. -/
+
+private def combinedSwitch : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .switchValue (.reg 0)
+              #[{ cid := nodeCtor
+                  edge := { target := 1, values := #[.reg 0], credits := #[] } }]
+              (some
+                { zero := { target := 1, values := #[.reg 0], credits := #[] }
+                  succ := { target := 2, values := #[.reg 0], credits := #[] } }) },
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .ret (.reg 0) },
+          { valueParams := #[.scalar, .owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .ret (.reg 1) }] } }
+
+#guard accepts combinedSwitch
+
+/-! Self calls use the containing signature, and tail-self transfer leaves no
+local owner behind. -/
+
+private def selfCall : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.callSelf #[.reg 0]]
+            terminator := .ret (.reg 1) }] } }
+
+private def tailSelf : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .tailCallSelf #[.reg 0] }] } }
+
+#guard accepts selfCall
+#guard accepts tailSelf
+
+private def loopAndTailSelf : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .jump
+              { target := 1, values := #[.reg 0], credits := #[] } },
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .switchValue (.reg 0)
+              #[{ cid := nodeCtor
+                  edge := { target := 1, values := #[.reg 0], credits := #[] } }]
+              (some
+                { zero := { target := 2, values := #[.reg 0], credits := #[] }
+                  succ := { target := 3, values := #[.reg 0], credits := #[] } }) },
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .tailCallSelf #[.reg 0] },
+          { valueParams := #[.scalar, .owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .tailCallSelf #[.reg 1] }] } }
+
+#guard accepts loopAndTailSelf
+
+private def borrowedCallee : Function :=
+  { signature :=
+      { params := #[{ world := .unique, passing := .borrowed }]
+        result := .unique
+        papSafe := false }
+    blocks := #[
+      { valueParams := #[.borrowed .unique .caller]
+        creditParams := #[]
+        instructions := #[]
+        terminator := .ret (.lit (.nat 0)) }] }
+
+private def directBorrowedCall : Program :=
+  { declarations := [(functionAddress, .fn borrowedCallee)]
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .call functionAddress #[.reg 0],
+              .dropUnique (.reg 0)]
+            terminator := .ret (.reg 1) }] } }
+
+#guard accepts directBorrowedCall
+
+/-! The leaf sidecar is exact in owner, block, value, and constructor. -/
+
+private def scalarLeafContext : Context :=
+  { schemas
+    scalarLeaves :=
+      [{ owner := .declaration harnessAddress
+         block := 0
+         value := 0
+         cid := nodeCtor }] }
+
+private def scalarLeafFree : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.freeUnique (.reg 0) nodeCtor]
+            terminator := .ret (.lit (.nat 0)) }] } }
+
+#guard match validate scalarLeafContext (closeFixture scalarLeafFree) with
+  | .ok _ => true
+  | .error _ => false
+
+/-! ## Fail-closed fixtures -/
+
+private def duplicateCredit : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.takeUnique (.reg 0) nodeCtor]
+            terminator := .jump
+              { target := 1, values := #[.reg 1], credits := #[0, 0] } },
+          { valueParams := #[.owned .unique]
+            creditParams := #[.required uniqueLayout, .required uniqueLayout]
+            instructions := #[.discardCredit 0, .discardCredit 1]
+            terminator := .ret (.reg 0) }] } }
+
+#guard rejectsAs .credit duplicateCredit
+
+private def liveCreditAtReturn : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.takeUnique (.reg 0) nodeCtor]
+            terminator := .ret (.reg 1) }] } }
+
+#guard rejectsAs .resources liveCreditAtReturn
+
+private def liveCreditAtCall : Program :=
+  { declarations :=
+      [(functionAddress,
+        .fn
+          { signature := unarySignature .unique
+            blocks := #[
+              { valueParams := #[.owned .unique]
+                creditParams := #[]
+                instructions := #[]
+                terminator := .ret (.reg 0) }] })]
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .takeUnique (.reg 0) nodeCtor,
+              .call functionAddress #[.reg 1]]
+            terminator := .ret (.reg 2) }] } }
+
+#guard rejectsAs .credit liveCreditAtCall
+
+private def useAfterTake : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .takeUnique (.reg 0) nodeCtor,
+              .move (.reg 0)]
+            terminator := .ret (.reg 1) }] } }
+
+#guard rejectsAs .ownership useAfterTake
+
+private def consumeLiveLender : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .fetch (.reg 0) nodeCtor 0,
+              .dropUnique (.reg 0),
+              .move (.reg 1)]
+            terminator := .ret (.lit (.nat 0)) }] } }
+
+#guard rejectsAs .borrow consumeLiveLender
+
+private def incompatibleLayout : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[
+              .takeUnique (.reg 0) nodeCtor,
+              .allocWith 0 .unique otherCtor #[.reg 1]]
+            terminator := .ret (.reg 2) }] } }
+
+#guard rejectsAs .credit incompatibleLayout
+
+private def optionalToRequired : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .shared
+        blocks := #[
+          { valueParams := #[.owned .shared]
+            creditParams := #[]
+            instructions := #[.resetShared (.reg 0) nodeCtor]
+            terminator := .jump
+              { target := 1, values := #[.reg 1], credits := #[0] } },
+          { valueParams := #[.owned .shared]
+            creditParams := #[.required sharedLayout]
+            instructions := #[.discardCredit 0]
+            terminator := .ret (.reg 0) }] } }
+
+#guard rejectsAs .credit optionalToRequired
+
+private def missingTarget : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .jump
+              { target := 7, values := #[.reg 0], credits := #[] } }] } }
+
+#guard rejectsAs .controlFlow missingTarget
+
+private def malformedNatSuccessor : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .switchValue (.reg 0) #[]
+              (some
+                { zero := { target := 1, values := #[.reg 0], credits := #[] }
+                  succ := { target := 2, values := #[.reg 0], credits := #[] } }) },
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .ret (.reg 0) },
+          { valueParams := #[.owned .unique, .owned .unique]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .ret (.reg 1) }] } }
+
+#guard rejectsAs .controlFlow malformedNatSuccessor
+
+private def borrowedTailEscape : Program :=
+  { declarations :=
+      [(functionAddress,
+        .fn
+          { signature :=
+              { params := #[{ world := .unique, passing := .borrowed }]
+                result := .unique
+                papSafe := false }
+            blocks := #[
+              { valueParams := #[.borrowed .unique .caller]
+                creditParams := #[]
+                instructions := #[]
+                terminator := .ret (.lit (.nat 0)) }] })]
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.fetch (.reg 0) nodeCtor 0]
+            terminator := .tailCall functionAddress #[.reg 1] }] } }
+
+#guard rejectsAs .borrow borrowedTailEscape
+
+private def mismatchedTailResult : Program :=
+  { declarations :=
+      [(functionAddress,
+        .fn
+          { signature := nullarySignature .unique
+            blocks := #[
+              { valueParams := #[]
+                creditParams := #[]
+                instructions := #[]
+                terminator := .ret .erased }] })]
+    main :=
+      { signature := nullarySignature .shared
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[]
+            terminator := .tailCall functionAddress #[] }] } }
+
+#guard rejectsAs .call mismatchedTailResult
+
+private def borrowedDynamicEntry : Program :=
+  { declarations := [(functionAddress, .fn borrowedCallee)]
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.papp functionAddress #[]]
+            terminator := .ret (.reg 1) }] } }
+
+#guard rejectsAs .call borrowedDynamicEntry
+
+private def borrowedReturn : Program :=
+  { declarations := []
+    main :=
+      { signature := unarySignature .unique
+        blocks := #[
+          { valueParams := #[.owned .unique]
+            creditParams := #[]
+            instructions := #[.fetch (.reg 0) nodeCtor 0]
+            terminator := .ret (.reg 1) }] } }
+
+#guard rejectsAs .ownership borrowedReturn
+
+private def forbiddenExtern : Program :=
+  { declarations := [(externAddress, .extern 0)]
+    main :=
+      { signature := nullarySignature
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[.extern externAddress #[]]
+            terminator := .ret (.reg 0) }] } }
+
+#guard rejectsAs .externBoundary forbiddenExtern
+
+#guard match validateWith { defaultLimits with maxBlocks := 1 } context
+    (closeFixture simpleJump) with
+  | .error (.limit _ .blocks 3 1) => true
+  | _ => false
+
+end Ix.Compiler.IxIR2.Validate.Examples
diff --git a/Ix/Compiler/Ixon/Address.lean b/Ix/Compiler/Ixon/Address.lean
new file mode 100644
index 000000000..b52a47557
--- /dev/null
+++ b/Ix/Compiler/Ixon/Address.lean
@@ -0,0 +1,214 @@
+import Ix.Compiler.Ixon.Serialize
+
+/-!
+# Content addresses
+
+32-byte blake3 hashes of canonical artifact serializations. Ixon identity
+follows ix's `docs/Ixon.md` and `docs/kernel_identity.md`; backend IRs have
+independently versioned domains. This module is the pure data side;
+`Ix.Compiler.Ixon.Hash` supplies BLAKE3 computation through the current FFI
+ledger entry.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-- A content address whose 32-byte wire invariant is enforced by the type. -/
+structure Address where
+  hash : ByteArray
+  hash_size : hash.size = 32
+  deriving DecidableEq
+
+namespace Address
+
+/-- Construct an address from a function over its 32 byte positions. -/
+def ofFn (f : Fin 32 → UInt8) : Address :=
+  ⟨⟨Array.ofFn f⟩, by simp [ByteArray.size]⟩
+
+/-- Construct a test/scaffolding address by repeating one byte. -/
+def replicate (b : UInt8) : Address :=
+  ofFn fun _ => b
+
+/-- Read one of an address's 32 bytes. -/
+def get (a : Address) (i : Fin 32) : UInt8 :=
+  a.hash[i.val]'(a.hash_size.symm ▸ i.isLt)
+
+/-- Synthetic address for member `idx` of a mutual block. This is shared by
+the source evaluator's opaque-member oracle identity and the erased program's
+environment key. It remains v1 scaffolding until members receive real content
+addresses. -/
+def memberAddr (block : Address) (idx : Nat) : Address :=
+  ofFn fun i =>
+    if i.val < 24 then block.get i
+    else block.get i ^^^
+      UInt8.ofNat (((idx + 1) >>> (8 * (i.val - 24))) % 256)
+
+/-- Lowercase fixed-width hexadecimal, matching ix's catalog/report spelling. -/
+def toHex (a : Address) : String :=
+  a.hash.data.foldl (fun output byte =>
+    output ++ hexDigitRepr (byte.toNat / 16) ++
+      hexDigitRepr (byte.toNat % 16)) ""
+
+@[simp] theorem data_ofFn (f : Fin 32 → UInt8) :
+    (ofFn f).hash.data = Array.ofFn f := by
+  rfl
+
+@[simp] theorem get_mk (data : Array UInt8) (h : data.size = 32)
+    (i : Fin 32) :
+    (Address.mk ⟨data⟩ h).get i = data[i.val]'(by omega) := by
+  rfl
+
+@[simp] theorem get_ofFn (f : Fin 32 → UInt8) (i : Fin 32) :
+    (ofFn f).get i = f i := by
+  rw [show ofFn f = Address.mk ⟨Array.ofFn f⟩
+      (by simp [ByteArray.size]) from rfl]
+  rw [get_mk]
+  rw [Array.getElem_ofFn]
+
+@[simp] theorem memberAddr_get (block : Address) (idx : Nat) (i : Fin 32) :
+    (memberAddr block idx).get i =
+      if i.val < 24 then block.get i
+      else block.get i ^^^
+        UInt8.ofNat (((idx + 1) >>> (8 * (i.val - 24))) % 256) := by
+  simp [memberAddr]
+
+@[simp] theorem get_replicate (b : UInt8) (i : Fin 32) :
+    (replicate b).get i = b := by
+  rw [show replicate b =
+      Address.mk ⟨Array.ofFn (fun _ : Fin 32 => b)⟩
+        (by simp [ByteArray.size]) from rfl]
+  rw [get_mk]
+  rw [Array.getElem_ofFn]
+
+/-- Construct from a byte array, checking the length. -/
+def ofBytes? (bytes : ByteArray) : Option Address :=
+  if h : bytes.size = 32 then some ⟨bytes, h⟩ else none
+
+end Address
+
+instance : Inhabited Address := ⟨Address.replicate 0⟩
+
+instance : BEq Address := ⟨fun a b => a.hash.data == b.hash.data⟩
+
+instance : Hashable Address := ⟨fun a => hash a.hash.data⟩
+
+instance : Repr Address :=
+  ⟨fun a _ => "Address " ++ repr a.hash.data⟩
+
+instance : ToString Address := ⟨Address.toHex⟩
+
+instance : Serialize Address where
+  put a := putBytes a.hash
+  get := do
+    let bytes ← getBytes 32
+    match Address.ofBytes? bytes with
+    | some a => return a
+    | none => throw "internal: getBytes returned a non-32-byte address"
+
+namespace Address
+
+/-- Address equality reflected by the compact byte-array `BEq` instance. -/
+theorem eq_of_beq {a b : Address} (h : (a == b) = true) : a = b := by
+  cases a with
+  | mk ah ahs =>
+    cases b with
+    | mk bh bhs =>
+      simp only [BEq.beq] at h
+      have hab : ah.data = bh.data := (beq_iff_eq).mp h
+      have : ah = bh := ByteArray.ext hab
+      cases this
+      rfl
+
+instance : ReflBEq Address where
+  rfl := by
+    intro address
+    change (address.hash.data == address.hash.data) = true
+    exact (beq_iff_eq).mpr rfl
+
+instance : LawfulBEq Address where
+  eq_of_beq := Address.eq_of_beq
+
+theorem ofBytes?_hash (a : Address) : Address.ofBytes? a.hash = some a := by
+  cases a with
+  | mk hash hash_size =>
+    simp [Address.ofBytes?, hash_size]
+
+theorem put_spec (a : Address) :
+    PutSpec (Serialize.put a) a.hash := by
+  exact putBytes_spec a.hash
+
+theorem get_spec (a : Address) :
+    GetSpec (Serialize.get (self := inferInstance) : GetM Address) a.hash a := by
+  intro pre suffix
+  change (do
+    let bytes ← getBytes 32
+    match Address.ofBytes? bytes with
+    | some a => return a
+    | none => throw "internal: getBytes returned a non-32-byte address").run
+      ⟨pre ++ a.hash ++ suffix, pre.size⟩ = _
+  simp only [StateT.run_bind]
+  have hread := getBytes_spec a.hash pre suffix
+  rw [a.hash_size] at hread
+  rw [hread]
+  simp only [bind, Except.bind]
+  rw [ofBytes?_hash]
+  simp [a.hash_size]
+  rfl
+
+/-- The fixed-width address codec decodes every address it encodes. -/
+theorem roundtripLaw : Ixon.RoundtripLaw Address := by
+  intro a
+  change runGet Serialize.get (runPut (Serialize.put a)) = .ok a
+  rw [runPut_eq_of_spec (put_spec a)]
+  exact runGet_eq_ok_of_spec (get_spec a)
+
+/-- Every accepted address byte string is its unique 32-byte spelling. -/
+theorem canonicalLaw : Ixon.CanonicalLaw Address := by
+  intro input a h
+  change runPut (Serialize.put a) = input
+  rw [runPut_eq_of_spec (put_spec a)]
+  change runGet (do
+    let bytes ← getBytes 32
+    match Address.ofBytes? bytes with
+    | some a => return a
+    | none => throw "internal: getBytes returned a non-32-byte address") input = .ok a at h
+  by_cases hlen : 32 ≤ input.size
+  · have hextract : (input.extract 0 32).size = 32 := by
+      simp [ByteArray.size_extract, hlen]
+    simp [runGet, getBytes, hlen, Address.ofBytes?, hextract] at h
+    by_cases hfull : 32 = input.size
+    · simp only [hfull, if_pos] at h
+      change Except.ok _ = Except.ok a at h
+      cases h
+      have hall := ByteArray.extract_append_eq_right
+        (a := ByteArray.empty) (b := input) (i := 0) (j := input.size)
+        (by simp) (by simp)
+      exact hall
+    · simp only [hfull] at h
+      change (Except.error _ : Except String Address) = Except.ok a at h
+      contradiction
+  · simp [runGet, getBytes, hlen] at h
+    change (Except.error _ : Except String Address) = Except.ok a at h
+    contradiction
+
+end Address
+
+/-! Elaboration-time invariant and codec checks. -/
+
+private def bytes (n : Nat) (b : UInt8) : ByteArray :=
+  ⟨(List.replicate n b).toArray⟩
+
+#guard (Address.ofBytes? (bytes 31 0xAA)).isNone
+#guard (Address.ofBytes? (bytes 32 0xAA)).isSome
+#guard (Address.ofBytes? (bytes 33 0xAA)).isNone
+
+#guard ser (Address.replicate 0xAB) == bytes 32 0xAB
+
+private def rejects (input : ByteArray) : Bool :=
+  match (de input : Except String Address) with
+  | .ok _ => false
+  | .error _ => true
+
+#guard rejects (bytes 31 0xAB)
+#guard rejects (bytes 33 0xAB)
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/Catalog.lean b/Ix/Compiler/Ixon/Catalog.lean
new file mode 100644
index 000000000..7aeec9a6f
--- /dev/null
+++ b/Ix/Compiler/Ixon/Catalog.lean
@@ -0,0 +1,770 @@
+import Ix.Compiler.Ixon.Merkle
+import Ix.Compiler.Ixon.Sharing
+import Ix.Compiler.AddressEnv
+
+/-!
+# Resource-bounded ix catalog ingress
+
+An ix `.ixc` is a directory containing a binary `manifest` and either one
+`<label>.ixe` per member (fat profile) or ordered
+`<label>.chunkN.ixe` units (chunked profile).  Filesystem traversal is kept out
+of this pure boundary: callers supply the manifest bytes and the piece bytes in
+manifest order.
+
+The loader mirrors ix's v1 manifest and the anonymous `.ixe` prefix.  It
+performs deep verification unconditionally: fixed framing, file size/hash,
+blob and constant hashes, checked v2 decoding, exact pinned-ix compressor
+image and semantic addresses, piece/member/content Merkle roots,
+profile-specific duplicate policy, and store-wide projection/member/
+constructor coherence.  Metadata after `.ixe` section 3 is intentionally
+opaque, exactly like ix's anonymous reader; it is not consulted by
+Ix.Compiler's nameless pipeline.
+-/
+
+namespace Ix.Compiler.Ixon.Catalog
+
+def magic : ByteArray :=
+  String.toUTF8 "IXC" ++ ByteArray.mk #[0, 0, 0, 0, 0]
+
+def version : UInt32 := 1
+def flagChunked : UInt32 := 1
+/-- Exact anonymous `.ixe` header carried by ix's `ixon-v2` environment. -/
+def envFlag : UInt8 := 0xE
+def envVersion : UInt64 := 2
+
+structure Member where
+  envRoot : Address
+  constCount : UInt64
+  label : String
+  toolchain : String
+  sourcePin : String
+  deps : Array UInt32
+  preimage : Option Address
+  deriving BEq, Repr, Inhabited
+
+structure FatPiece where
+  fileHash : Address
+  fileBytes : UInt64
+  deriving BEq, Repr, Inhabited
+
+structure Chunk where
+  chunkRoot : Address
+  fileHash : Address
+  fileBytes : UInt64
+  owner : UInt32
+  deriving BEq, Repr, Inhabited
+
+inductive Storage where
+  | fat (pieces : Array FatPiece)
+  | chunked (chunks : Array Chunk)
+  deriving BEq, Repr
+
+structure Manifest where
+  membersRoot : Address
+  contentRoot : Address
+  members : Array Member
+  storage : Storage
+  /-- Future manifest sections are committed by the file bytes but opaque to
+  this version, matching ix's forward-compatible manifest parser. -/
+  trailing : ByteArray := .empty
+  deriving BEq
+
+/-- The identity of one piece in diagnostics and in the positional input API. -/
+inductive UnitRef where
+  | fat (member : Nat)
+  | chunk (index owner : Nat)
+  deriving BEq, DecidableEq, Repr
+
+inductive ParseSource where
+  | manifest
+  | piece (unit : UnitRef)
+  deriving BEq, DecidableEq, Repr
+
+inductive MemberKind where
+  | definition
+  | inductive
+  | recursor
+  deriving BEq, DecidableEq, Repr
+
+/-- Every failure at the catalog boundary is data-bearing.  Only low-level
+canonical tag/EOF/UTF-8 diagnostics remain wrapped in `syntax`. -/
+inductive Error where
+  | syntax (source : ParseSource) (message : String)
+  | resource (exceeded : Work.Exceeded)
+  | badMagic
+  | unsupportedVersion (actual expected : UInt32)
+  | unknownFlags (flags : UInt32)
+  | invalidLabel (member : Nat) (label : String)
+  | dependencyOrder (member dependency : Nat)
+  | invalidPreimageTag (member : Nat) (tag : UInt8)
+  | membersRootMismatch (stored computed : Address)
+  | pieceArity (expected actual : Nat)
+  | fileSize (unit : UnitRef) (actual expected : Nat)
+  | fileHash (unit : UnitRef) (actual expected : Address)
+  | envHeader (unit : UnitRef) (flag : UInt8) (version : UInt64)
+  | invalidMainTag (unit : UnitRef) (tag : UInt8)
+  | unorderedAssumption (unit : UnitRef) (index : Nat)
+  | blobHash (unit : UnitRef) (index : Nat)
+      (stored computed : Address)
+  | unorderedConstant (unit : UnitRef) (index : Nat)
+  | constantHash (unit : UnitRef) (index : Nat)
+      (stored computed : Address)
+  | invalidConstant (unit : UnitRef) (address : Address)
+      (error : DecodeCheck.Error)
+  | unaddressableConstant (unit : UnitRef) (address : Address)
+      (error : Constant.AddressError)
+  | constantAddress (unit : UnitRef) (stored computed : Address)
+  | mainMissing (unit : UnitRef) (main : Address)
+  | hintCount (unit : UnitRef) (actual constants : Nat)
+  | hintDelta (unit : UnitRef) (entry : Nat)
+  | hintIndex (unit : UnitRef) (entry index constants : Nat)
+  | hintValue (unit : UnitRef) (entry : Nat) (value : UInt64)
+  | envRootMismatch (unit : UnitRef) (stored computed : Address)
+  | fatMemberRoot (member : Nat) (stored computed : Address)
+  | fatMemberCount (member : Nat) (stored : UInt64) (computed : Nat)
+  | fatMemberAssumptions (member count : Nat)
+  | chunkRoot (chunk : Nat) (stored computed : Address)
+  | chunkMemberRoot (member : Nat) (stored computed : Address)
+  | chunkMemberCount (member : Nat) (stored : UInt64) (computed : Nat)
+  | duplicateChunkAddress (address : Address) (first second : Nat)
+  | conflictingConstant (address : Address) (first second : Nat)
+  | conflictingBlob (address : Address) (first second : Nat)
+  | contentRootMismatch (stored computed : Address)
+  | constructorOrdinal (block : Address) (member constructor : Nat)
+      (actual : UInt64)
+  | projectionBlockMissing (projection block : Address)
+  | projectionBlockNotMutual (projection block : Address)
+  | projectionMemberIndex (projection block : Address)
+      (index bound : Nat)
+  | projectionMemberKind (projection block : Address) (index : Nat)
+      (expected actual : MemberKind)
+  | projectionConstructorIndex (projection block : Address)
+      (member constructor bound : Nat)
+  deriving BEq, Repr
+
+/-- Aggregate limits bound work over *all storage entries*, including repeated
+fat-profile closure constants.  The final union has its own constant limit,
+aligned by default with `Pipeline.Limits.maxConstants`. -/
+structure Limits where
+  ingress : DecodeCheck.Limits := {}
+  sharing : Sharing.ResourceLimits := {}
+  maxManifestBytes : Nat := 16 * 1024 * 1024
+  maxMembers : Nat := 4096
+  maxDependencyEdges : Nat := 64 * 1024
+  maxStorageUnits : Nat := 16 * 1024
+  maxPieceBytes : Nat := 1024 * 1024 * 1024
+  maxConstantEntries : Nat := 32 * 1024
+  maxConstantBytes : Nat := 1024 * 1024 * 1024
+  maxBlobEntries : Nat := 32 * 1024
+  maxBlobBytes : Nat := 1024 * 1024 * 1024
+  maxAssumptions : Nat := 64 * 1024
+  maxHints : Nat := 32 * 1024
+  maxExpressionUnits : Nat := 2 * 1024 * 1024
+  maxExpandedExpressionUnits : Nat := 2 * 1024 * 1024
+  maxLayer1NodeVisits : Nat := 128 * 1024 * 1024
+  maxUnionConstants : Nat := 16 * 1024
+  deriving BEq, Repr
+
+def defaultLimits : Limits := {}
+
+structure Stats where
+  manifestBytes : Nat := 0
+  members : Nat := 0
+  dependencyEdges : Nat := 0
+  storageUnits : Nat := 0
+  pieceBytes : Nat := 0
+  constantEntries : Nat := 0
+  constantBytes : Nat := 0
+  blobEntries : Nat := 0
+  blobBytes : Nat := 0
+  assumptions : Nat := 0
+  hints : Nat := 0
+  expressionUnits : Nat := 0
+  expandedExpressionUnits : Nat := 0
+  layer1NodeVisits : Nat := 0
+  unionConstants : Nat := 0
+  deriving BEq, Repr
+
+structure StoredConstant where
+  address : Address
+  bytes : ByteArray
+  constant : Constant
+  deriving BEq, Inhabited
+
+structure StoredBlob where
+  address : Address
+  bytes : ByteArray
+  deriving BEq, Inhabited
+
+structure Piece where
+  envRoot : Address
+  main : Option Address
+  assumptions : Array Address
+  blobs : Array StoredBlob
+  constants : Array StoredConstant
+  /-- Sections 4-6, if present, are deliberately retained as opaque bytes. -/
+  metadata : ByteArray
+  deriving BEq, Inhabited
+
+structure Loaded where
+  manifest : Manifest
+  pieces : Array Piece
+  /-- Sorted, deduplicated semantic union used by the compiler pipeline. -/
+  constants : List (Address × Constant)
+  /-- Sorted raw blob union.  Literal interpretation remains a caller policy. -/
+  blobs : List (Address × ByteArray)
+  stats : Stats
+
+private def enforce (metric : Work.Metric) (actual limit : Nat) :
+    Except Error Unit :=
+  match Work.ensure metric actual limit with
+  | .ok _ => .ok ()
+  | .error exceeded => .error (.resource exceeded)
+
+/-! ## Exact manifest parser -/
+
+private abbrev ParseM := StateT GetState (Except Error)
+
+private def liftWire (source : ParseSource) (decoder : GetM α) : ParseM α :=
+  fun state =>
+    match decoder.run state with
+    | .ok result => .ok result
+    | .error message => .error (.syntax source message)
+
+private def getBytesE (source : ParseSource) (count : Nat) : ParseM ByteArray :=
+  liftWire source (getBytes count)
+
+private def getU8E (source : ParseSource) : ParseM UInt8 :=
+  liftWire source getU8
+
+private def getTag0E (source : ParseSource) : ParseM UInt64 := do
+  return (← liftWire source getTag0).size
+
+private def getTag4E (source : ParseSource) : ParseM Tag4 :=
+  liftWire source getTag4
+
+private def getAddressE (source : ParseSource) : ParseM Address := do
+  let bytes ← getBytesE source 32
+  match Address.ofBytes? bytes with
+  | some address => return address
+  | none => throw (.syntax source "internal: address width")
+
+private def getU16LE (source : ParseSource) : ParseM UInt16 := do
+  let a ← getU8E source
+  let b ← getU8E source
+  return a.toUInt16 ||| (b.toUInt16 <<< 8)
+
+private def getU32LE (source : ParseSource) : ParseM UInt32 := do
+  let a ← getU8E source
+  let b ← getU8E source
+  let c ← getU8E source
+  let d ← getU8E source
+  return a.toUInt32 ||| (b.toUInt32 <<< 8) |||
+    (c.toUInt32 <<< 16) ||| (d.toUInt32 <<< 24)
+
+private def getU64LE (source : ParseSource) : ParseM UInt64 := do
+  let lo ← getU32LE source
+  let hi ← getU32LE source
+  return lo.toUInt64 ||| (hi.toUInt64 <<< 32)
+
+private def getString16 (source : ParseSource) : ParseM String := do
+  let length ← getU16LE source
+  let bytes ← getBytesE source length.toNat
+  match String.fromUTF8? bytes with
+  | some value => return value
+  | none => throw (.syntax source "invalid UTF-8 string in .ixc")
+
+def validLabel (label : String) : Bool :=
+  !label.isEmpty && label != "." && label != ".." &&
+    !label.any (fun character =>
+      character == '/' || character == '\\' || character == '\x00')
+
+def membersRootOf (members : Array Member) : Address :=
+  Merkle.rootCanonical (members.map (·.envRoot))
+
+private def parseMember (limits : Limits) (index : Nat)
+    (dependencyTotal : Nat) : ParseM (Member × Nat) := do
+  let source := ParseSource.manifest
+  let envRoot ← getAddressE source
+  let constCount ← getU64LE source
+  let label ← getString16 source
+  if !validLabel label then
+    throw (.invalidLabel index label)
+  let toolchain ← getString16 source
+  let sourcePin ← getString16 source
+  let dependencyCount := (← getU32LE source).toNat
+  let nextDependencyTotal := dependencyTotal + dependencyCount
+  match enforce .catalogDependencyEdges nextDependencyTotal
+      limits.maxDependencyEdges with
+  | .error error => throw error
+  | .ok _ => pure ()
+  let mut deps := #[]
+  for _ in [:dependencyCount] do
+    let dependency ← getU32LE source
+    if dependency.toNat ≥ index then
+      throw (.dependencyOrder index dependency.toNat)
+    deps := deps.push dependency
+  let preimageTag ← getU8E source
+  let preimage ← match preimageTag with
+    | 0 => pure none
+    | 1 => some <$> getAddressE source
+    | tag => throw (.invalidPreimageTag index tag)
+  return (⟨envRoot, constCount, label, toolchain, sourcePin, deps,
+    preimage⟩, nextDependencyTotal)
+
+/-- Parse and structurally validate an ix v1 manifest, preserving future
+trailing bytes. -/
+def decodeManifestWith (limits : Limits) (bytes : ByteArray) :
+    Except Error Manifest := do
+  enforce .catalogManifestBytes bytes.size limits.maxManifestBytes
+  let parser : ParseM (Manifest × Nat) := do
+    let source := ParseSource.manifest
+    let actualMagic ← getBytesE source 8
+    if actualMagic != magic then throw .badMagic
+    let actualVersion ← getU32LE source
+    if actualVersion != version then
+      throw (.unsupportedVersion actualVersion version)
+    let flags ← getU32LE source
+    if flags &&& (~~~flagChunked) != 0 then
+      throw (.unknownFlags flags)
+    let membersRoot ← getAddressE source
+    let contentRoot ← getAddressE source
+    let memberCount := (← getU32LE source).toNat
+    match enforce .catalogMembers memberCount limits.maxMembers with
+    | .error error => throw error
+    | .ok _ => pure ()
+    let mut members := #[]
+    let mut dependencyTotal := 0
+    for index in [:memberCount] do
+      let (member, nextTotal) ← parseMember limits index dependencyTotal
+      members := members.push member
+      dependencyTotal := nextTotal
+    let storage ←
+      if flags &&& flagChunked == 0 then
+        let mut pieces := #[]
+        for _ in [:memberCount] do
+          pieces := pieces.push
+            { fileHash := (← getAddressE source)
+              fileBytes := (← getU64LE source) }
+        pure (.fat pieces)
+      else
+        let chunkCount := (← getU32LE source).toNat
+        match enforce .catalogStorageUnits chunkCount
+            limits.maxStorageUnits with
+        | .error error => throw error
+        | .ok _ => pure ()
+        let mut chunks := #[]
+        for chunkIndex in [:chunkCount] do
+          let chunkRoot ← getAddressE source
+          let fileHash ← getAddressE source
+          let fileBytes ← getU64LE source
+          let owner ← getU32LE source
+          if owner.toNat ≥ memberCount then
+            throw (.syntax source
+              s!"chunk {chunkIndex} owner {owner} is out of range")
+          chunks := chunks.push { chunkRoot, fileHash, fileBytes, owner }
+        pure (.chunked chunks)
+    let storageUnits := match storage with
+      | .fat pieces => pieces.size
+      | .chunked chunks => chunks.size
+    match enforce .catalogStorageUnits storageUnits limits.maxStorageUnits with
+    | .error error => throw error
+    | .ok _ => pure ()
+    let computedMembersRoot := membersRootOf members
+    if computedMembersRoot != membersRoot then
+      throw (.membersRootMismatch membersRoot computedMembersRoot)
+    let consumed := (← get).idx
+    return (⟨membersRoot, contentRoot, members, storage, .empty⟩, consumed)
+  let (result, _) ← parser.run ⟨bytes, 0⟩
+  let manifest := result.1
+  let consumed := result.2
+  return { manifest with trailing := bytes.extract consumed bytes.size }
+
+def decodeManifest (bytes : ByteArray) : Except Error Manifest :=
+  decodeManifestWith defaultLimits bytes
+
+/-! ## Anonymous `.ixe` piece parser -/
+
+private def cumulative (metric : Work.Metric) (prior delta limit : Nat) :
+    Except Error Nat := do
+  let actual := prior + delta
+  enforce metric actual limit
+  return actual
+
+private def parsePieceWith (limits : Limits) (unit : UnitRef)
+    (prior : Stats) (bytes : ByteArray) : Except Error (Piece × Stats) := do
+  let source := ParseSource.piece unit
+  let parser : ParseM (Piece × Stats) := do
+    let tag ← getTag4E source
+    if tag.flag != envFlag || tag.size != envVersion then
+      throw (.envHeader unit tag.flag tag.size)
+    let storedRoot ← getAddressE source
+    let mainTag ← getU8E source
+    let main ← match mainTag with
+      | 0 => pure none
+      | 1 => some <$> getAddressE source
+      | tag => throw (.invalidMainTag unit tag)
+
+    let assumptionCount := (← getTag0E source).toNat
+    let totalAssumptions ← match cumulative .catalogAssumptions
+        prior.assumptions assumptionCount limits.maxAssumptions with
+      | .ok total => pure total
+      | .error error => throw error
+    let mut assumptions := #[]
+    for index in [:assumptionCount] do
+      let address ← getAddressE source
+      if let some previous := assumptions.back? then
+        if !Merkle.addressLT previous address then
+          throw (.unorderedAssumption unit index)
+      assumptions := assumptions.push address
+
+    let blobCount := (← getTag0E source).toNat
+    let totalBlobEntries ← match cumulative .catalogBlobEntries
+        prior.blobEntries blobCount limits.maxBlobEntries with
+      | .ok total => pure total
+      | .error error => throw error
+    let mut totalBlobBytes := prior.blobBytes
+    let mut blobs := #[]
+    for index in [:blobCount] do
+      let address ← getAddressE source
+      let length := (← getTag0E source).toNat
+      totalBlobBytes ← match cumulative .catalogBlobBytes
+          totalBlobBytes length limits.maxBlobBytes with
+        | .ok total => pure total
+        | .error error => throw error
+      let payload ← getBytesE source length
+      let computed := Address.blake3 payload
+      if computed != address then
+        throw (.blobHash unit index address computed)
+      blobs := blobs.push ⟨address, payload⟩
+
+    let constantCount := (← getTag0E source).toNat
+    let totalConstantEntries ← match cumulative .catalogConstantEntries
+        prior.constantEntries constantCount limits.maxConstantEntries with
+      | .ok total => pure total
+      | .error error => throw error
+    let mut totalConstantBytes := prior.constantBytes
+    let mut expressionUnits := prior.expressionUnits
+    let mut expandedExpressionUnits := prior.expandedExpressionUnits
+    let mut layer1NodeVisits := prior.layer1NodeVisits
+    let mut constants := #[]
+    for index in [:constantCount] do
+      let address ← getAddressE source
+      if let some previous := constants.back? then
+        if !Merkle.addressLT previous.address address then
+          throw (.unorderedConstant unit index)
+      let length := (← getTag0E source).toNat
+      totalConstantBytes ← match cumulative .catalogConstantBytes
+          totalConstantBytes length limits.maxConstantBytes with
+        | .ok total => pure total
+        | .error error => throw error
+      let payload ← getBytesE source length
+      let computedRaw := Address.blake3 payload
+      if computedRaw != address then
+        throw (.constantHash unit index address computedRaw)
+      let constant ← match DecodeCheck.decodeIxonV2CheckedWith limits.ingress payload with
+        | .ok constant => pure constant
+        | .error error => throw (.invalidConstant unit address error)
+      let bodies := constant.info.exprs.toArray
+      let objectExpressionUnits := Work.exprArrayUnits bodies +
+        Work.exprArrayUnits constant.sharing
+      let objectExpandedUnits :=
+        (Work.expandedUnits? constant.sharing bodies).getD
+          (Work.exprArrayUnits bodies)
+      let objectLayer1 := Work.layer1NodeVisits constant.sharing bodies
+      expressionUnits ← match cumulative .programExpressionUnits
+          expressionUnits objectExpressionUnits limits.maxExpressionUnits with
+        | .ok total => pure total
+        | .error error => throw error
+      expandedExpressionUnits ← match cumulative
+          .programExpandedExpressionUnits expandedExpressionUnits
+          objectExpandedUnits limits.maxExpandedExpressionUnits with
+        | .ok total => pure total
+        | .error error => throw error
+      layer1NodeVisits ← match cumulative .layer1NodeVisits
+          layer1NodeVisits objectLayer1 limits.maxLayer1NodeVisits with
+        | .ok total => pure total
+        | .error error => throw error
+      let addressLimits : Constant.AddressLimits :=
+        { ingress := limits.ingress, sharing := limits.sharing }
+      let computedSemantic ← match constant.addressIxonV2CheckedWith
+          addressLimits with
+        | .ok computed => pure computed
+        | .error error =>
+          throw (.unaddressableConstant unit address error)
+      if computedSemantic != address then
+        throw (.constantAddress unit address computedSemantic)
+      constants := constants.push ⟨address, payload, constant⟩
+
+    if let some mainAddress := main then
+      if !constants.any (fun stored => stored.address == mainAddress) then
+        throw (.mainMissing unit mainAddress)
+
+    let hintCount := (← getTag0E source).toNat
+    if hintCount > constants.size then
+      throw (.hintCount unit hintCount constants.size)
+    let totalHints ← match cumulative .catalogHints prior.hints hintCount
+        limits.maxHints with
+      | .ok total => pure total
+      | .error error => throw error
+    let mut hintCursor := 0
+    for entry in [:hintCount] do
+      let delta := (← getTag0E source).toNat
+      if delta == 0 then throw (.hintDelta unit entry)
+      let index := hintCursor + delta - 1
+      if index ≥ constants.size then
+        throw (.hintIndex unit entry index constants.size)
+      let value ← getTag0E source
+      if value ≥ 2 && value - 2 > (4294967295 : UInt64) then
+        throw (.hintValue unit entry value)
+      hintCursor := index + 1
+
+    let computedRoot := Merkle.rootCanonical
+      (constants.map (·.address))
+    if computedRoot != storedRoot then
+      throw (.envRootMismatch unit storedRoot computedRoot)
+    let consumed := (← get).idx
+    let nextStats : Stats :=
+      { prior with
+        constantEntries := totalConstantEntries
+        constantBytes := totalConstantBytes
+        blobEntries := totalBlobEntries
+        blobBytes := totalBlobBytes
+        assumptions := totalAssumptions
+        hints := totalHints
+        expressionUnits
+        expandedExpressionUnits
+        layer1NodeVisits }
+    return (⟨storedRoot, main, assumptions, blobs, constants,
+      bytes.extract consumed bytes.size⟩, nextStats)
+  let (result, _) ← parser.run ⟨bytes, 0⟩
+  return result
+
+/-! ## Store-wide coherence -/
+
+private def kindOfMember : MutConst → MemberKind
+  | .defn _ => .definition
+  | .indc _ => .inductive
+  | .recr _ => .recursor
+
+private def checkMember (resolve : Address → Option Constant)
+    (projection block : Address) (index : Nat) (expected : MemberKind) :
+    Except Error MutConst := do
+  let blockConstant ← match resolve block with
+    | some constant => pure constant
+    | none => throw (.projectionBlockMissing projection block)
+  let members ← match blockConstant.info with
+    | .muts members => pure members
+    | _ => throw (.projectionBlockNotMutual projection block)
+  let member ← match members[index]? with
+    | some member => pure member
+    | none => throw (.projectionMemberIndex projection block index members.size)
+  let actual := kindOfMember member
+  if actual != expected then
+    throw (.projectionMemberKind projection block index expected actual)
+  return member
+
+/-- Validate invariants which cannot be checked while decoding one object:
+constructor ordinals and projection targets in the complete store. -/
+def validateStore (constants : List (Address × Constant)) : Except Error Unit := do
+  let index := AddressEnv.build constants
+  let resolve := AddressEnv.lookup index
+  for (blockAddress, constant) in constants do
+    match constant.info with
+    | .muts members =>
+      for memberIndex in [:members.size] do
+        match members[memberIndex]! with
+        | .indc ind =>
+          for constructorIndex in [:ind.ctors.size] do
+            let constructor := ind.ctors[constructorIndex]!
+            if constructor.cidx.toNat != constructorIndex then
+              throw (.constructorOrdinal blockAddress memberIndex
+                constructorIndex constructor.cidx)
+        | _ => pure ()
+    | _ => pure ()
+  for (projectionAddress, constant) in constants do
+    match constant.info with
+    | .iPrj projection =>
+      let _ ← checkMember resolve projectionAddress projection.block
+        projection.idx.toNat .inductive
+      pure ()
+    | .cPrj projection =>
+      let member ← checkMember resolve projectionAddress projection.block
+        projection.idx.toNat .inductive
+      match member with
+      | .indc ind =>
+        if projection.cidx.toNat ≥ ind.ctors.size then
+          throw (.projectionConstructorIndex projectionAddress
+            projection.block projection.idx.toNat projection.cidx.toNat
+            ind.ctors.size)
+      | _ => pure ()
+    | .rPrj projection =>
+      let _ ← checkMember resolve projectionAddress projection.block
+        projection.idx.toNat .recursor
+      pure ()
+    | .dPrj projection =>
+      let _ ← checkMember resolve projectionAddress projection.block
+        projection.idx.toNat .definition
+      pure ()
+    | _ => pure ()
+
+private def sortedConstants (constants : Array StoredConstant) :
+    Array StoredConstant :=
+  constants.qsort fun left right =>
+    Merkle.addressLT left.address right.address
+
+private def sortedBlobs (blobs : Array StoredBlob) : Array StoredBlob :=
+  blobs.qsort fun left right => Merkle.addressLT left.address right.address
+
+private def storageUnits : Storage → Nat
+  | .fat pieces => pieces.size
+  | .chunked chunks => chunks.size
+
+private def declaredPieceBytes : Storage → Nat
+  | .fat pieces => pieces.foldl
+      (fun total piece => total + piece.fileBytes.toNat) 0
+  | .chunked chunks => chunks.foldl
+      (fun total chunk => total + chunk.fileBytes.toNat) 0
+
+/-- Deep-load a manifest and its positionally corresponding `.ixe` bytes.
+
+For `.fat`, `pieceBytes[i]` is `<members[i].label>.ixe`.  For `.chunked`,
+`pieceBytes[i]` is `<members[chunks[i].owner].label>.chunk<i>.ixe`.
+-/
+def loadWith (limits : Limits) (manifestBytes : ByteArray)
+    (pieceBytes : Array ByteArray) : Except Error Loaded := do
+  let manifest ← decodeManifestWith limits manifestBytes
+  let expectedUnits := storageUnits manifest.storage
+  if pieceBytes.size != expectedUnits then
+    throw (.pieceArity expectedUnits pieceBytes.size)
+  let declaredBytes := declaredPieceBytes manifest.storage
+  enforce .catalogPieceBytes declaredBytes limits.maxPieceBytes
+  let actualBytes := pieceBytes.foldl (fun total bytes => total + bytes.size) 0
+  enforce .catalogPieceBytes actualBytes limits.maxPieceBytes
+  let dependencyEdges := manifest.members.foldl
+    (fun total member => total + member.deps.size) 0
+  let mut stats : Stats :=
+    { manifestBytes := manifestBytes.size
+      members := manifest.members.size
+      dependencyEdges
+      storageUnits := expectedUnits
+      pieceBytes := actualBytes }
+  let mut parsedPieces : Array Piece := #[]
+  match manifest.storage with
+  | .fat rows =>
+    for index in [:rows.size] do
+      let unit := UnitRef.fat index
+      let bytes := pieceBytes[index]!
+      let row := rows[index]!
+      if bytes.size != row.fileBytes.toNat then
+        throw (.fileSize unit bytes.size row.fileBytes.toNat)
+      let actualHash := Address.blake3 bytes
+      if actualHash != row.fileHash then
+        throw (.fileHash unit actualHash row.fileHash)
+      let (piece, nextStats) ← parsePieceWith limits unit stats bytes
+      let member := manifest.members[index]!
+      if piece.envRoot != member.envRoot then
+        throw (.fatMemberRoot index member.envRoot piece.envRoot)
+      if piece.constants.size != member.constCount.toNat then
+        throw (.fatMemberCount index member.constCount piece.constants.size)
+      if !piece.assumptions.isEmpty then
+        throw (.fatMemberAssumptions index piece.assumptions.size)
+      parsedPieces := parsedPieces.push piece
+      stats := nextStats
+  | .chunked rows =>
+    for index in [:rows.size] do
+      let row := rows[index]!
+      let unit := UnitRef.chunk index row.owner.toNat
+      let bytes := pieceBytes[index]!
+      if bytes.size != row.fileBytes.toNat then
+        throw (.fileSize unit bytes.size row.fileBytes.toNat)
+      let actualHash := Address.blake3 bytes
+      if actualHash != row.fileHash then
+        throw (.fileHash unit actualHash row.fileHash)
+      let (piece, nextStats) ← parsePieceWith limits unit stats bytes
+      if piece.envRoot != row.chunkRoot then
+        throw (.chunkRoot index row.chunkRoot piece.envRoot)
+      parsedPieces := parsedPieces.push piece
+      stats := nextStats
+
+  let chunked := match manifest.storage with
+    | .fat _ => false
+    | .chunked _ => true
+
+  -- Disjointness is the first cross-piece invariant for the chunked profile.
+  -- Check it before member coverage so a duplicate is always diagnosed as the
+  -- profile violation, rather than incidentally as a member-count mismatch.
+  if chunked then
+    let mut seen : Std.HashMap Address Nat := {}
+    for pieceIndex in [:parsedPieces.size] do
+      for stored in parsedPieces[pieceIndex]!.constants do
+        match seen.get? stored.address with
+        | none => seen := seen.insert stored.address pieceIndex
+        | some first =>
+          throw (.duplicateChunkAddress stored.address first pieceIndex)
+
+  -- Chunk rows are storage partitions; their owner-wise unions must recover
+  -- each manifest member exactly, not merely the catalog-wide union.
+  match manifest.storage with
+  | .fat _ => pure ()
+  | .chunked rows =>
+    let mut ownerAddresses : Array (Array Address) :=
+      Array.replicate manifest.members.size #[]
+    for index in [:rows.size] do
+      let owner := rows[index]!.owner.toNat
+      let addresses := parsedPieces[index]!.constants.map (·.address)
+      ownerAddresses := ownerAddresses.set! owner
+        (ownerAddresses[owner]!.append addresses)
+    for memberIndex in [:manifest.members.size] do
+      let member := manifest.members[memberIndex]!
+      let addresses := ownerAddresses[memberIndex]!
+      let computedRoot := Merkle.rootCanonical addresses
+      if computedRoot != member.envRoot then
+        throw (.chunkMemberRoot memberIndex member.envRoot computedRoot)
+      if addresses.size != member.constCount.toNat then
+        throw (.chunkMemberCount memberIndex member.constCount addresses.size)
+
+  let mut constantIndex : Std.HashMap Address (Nat × StoredConstant) := {}
+  let mut unionConstants : Array StoredConstant := #[]
+  let mut blobIndex : Std.HashMap Address (Nat × StoredBlob) := {}
+  let mut unionBlobs : Array StoredBlob := #[]
+  for pieceIndex in [:parsedPieces.size] do
+    let piece := parsedPieces[pieceIndex]!
+    for stored in piece.constants do
+      match constantIndex.get? stored.address with
+      | none =>
+        constantIndex := constantIndex.insert stored.address
+          (pieceIndex, stored)
+        unionConstants := unionConstants.push stored
+      | some (first, previous) =>
+        if chunked then
+          throw (.duplicateChunkAddress stored.address first pieceIndex)
+        if previous.bytes != stored.bytes then
+          throw (.conflictingConstant stored.address first pieceIndex)
+    for stored in piece.blobs do
+      match blobIndex.get? stored.address with
+      | none =>
+        blobIndex := blobIndex.insert stored.address (pieceIndex, stored)
+        unionBlobs := unionBlobs.push stored
+      | some (first, previous) =>
+        if previous.bytes != stored.bytes then
+          throw (.conflictingBlob stored.address first pieceIndex)
+
+  enforce .programConstants unionConstants.size limits.maxUnionConstants
+  let computedContentRoot := Merkle.rootCanonical
+    (unionConstants.map (·.address))
+  if computedContentRoot != manifest.contentRoot then
+    throw (.contentRootMismatch manifest.contentRoot computedContentRoot)
+  let constants := (sortedConstants unionConstants).toList.map
+    (fun stored => (stored.address, stored.constant))
+  validateStore constants
+  let blobs := (sortedBlobs unionBlobs).toList.map
+    (fun stored => (stored.address, stored.bytes))
+  return Loaded.mk manifest parsedPieces constants blobs
+    { stats with unionConstants := unionConstants.size }
+
+def load (manifestBytes : ByteArray) (pieceBytes : Array ByteArray) :
+    Except Error Loaded :=
+  loadWith defaultLimits manifestBytes pieceBytes
+
+end Ix.Compiler.Ixon.Catalog
diff --git a/Ix/Compiler/Ixon/CatalogIO.lean b/Ix/Compiler/Ixon/CatalogIO.lean
new file mode 100644
index 000000000..47e4db9e5
--- /dev/null
+++ b/Ix/Compiler/Ixon/CatalogIO.lean
@@ -0,0 +1,133 @@
+import Ix.Compiler.Ixon.Catalog
+
+/-!
+# Filesystem adapter for ix catalogs
+
+`Catalog.loadWith` is deliberately a pure byte boundary.  This module adds the
+small positional directory adapter needed by corpus tooling.  It parses the
+manifest before resolving any member filenames, rejects non-regular files,
+checks declared and observed sizes before each full-file read, and then hands
+the exact bytes to the pure deep loader.
+
+This remains an in-memory adapter.  A directory concurrently mutated between
+metadata inspection and reading is still detected by the pure size/hash gate,
+but avoiding the transient allocation in that race requires the future
+streaming/mmap boundary.
+-/
+
+namespace Ix.Compiler.Ixon.CatalogIO
+
+open System (FilePath)
+
+inductive Error where
+  | io (operation path message : String)
+  | notRegularFile (path : String) (actual : IO.FS.FileType)
+  | catalog (error : Catalog.Error)
+  deriving Repr
+
+structure PieceSpec where
+  unit : Catalog.UnitRef
+  filename : String
+  expectedBytes : Nat
+  deriving BEq, Repr
+
+/-- Resolve the positional byte API into ix's exact on-disk filenames.  Member
+labels have already passed `Catalog.decodeManifestWith`'s bare-name gate. -/
+def pieceSpecs (manifest : Catalog.Manifest) : Array PieceSpec := Id.run do
+  let mut specs := #[]
+  match manifest.storage with
+  | .fat rows =>
+    for index in [:rows.size] do
+      let row := rows[index]!
+      let label := manifest.members[index]!.label
+      specs := specs.push
+        { unit := .fat index
+          filename := s!"{label}.ixe"
+          expectedBytes := row.fileBytes.toNat }
+  | .chunked rows =>
+    for index in [:rows.size] do
+      let row := rows[index]!
+      let label := manifest.members[row.owner.toNat]!.label
+      specs := specs.push
+        { unit := .chunk index row.owner.toNat
+          filename := s!"{label}.chunk{index}.ixe"
+          expectedBytes := row.fileBytes.toNat }
+  return specs
+
+private def resource (metric : Work.Metric) (actual limit : Nat) : Error :=
+  .catalog (.resource ⟨metric, actual, limit⟩)
+
+private def readManifest (limits : Catalog.Limits) (path : FilePath) :
+    IO (Except Error ByteArray) := do
+  try
+    let metadata ← path.symlinkMetadata
+    if metadata.type != .file then
+      return .error (.notRegularFile path.toString metadata.type)
+    let observed := metadata.byteSize.toNat
+    if observed > limits.maxManifestBytes then
+      return .error
+        (resource .catalogManifestBytes observed limits.maxManifestBytes)
+    let bytes ← IO.FS.readBinFile path
+    if bytes.size > limits.maxManifestBytes then
+      return .error
+        (resource .catalogManifestBytes bytes.size limits.maxManifestBytes)
+    return .ok bytes
+  catch error =>
+    return .error (.io "read manifest" path.toString error.toString)
+
+private def readPiece (limits : Catalog.Limits) (directory : FilePath)
+    (priorBytes : Nat) (spec : PieceSpec) :
+    IO (Except Error ByteArray) := do
+  let path := directory / spec.filename
+  try
+    let metadata ← path.symlinkMetadata
+    if metadata.type != .file then
+      return .error (.notRegularFile path.toString metadata.type)
+    let observed := metadata.byteSize.toNat
+    if observed != spec.expectedBytes then
+      return .error
+        (.catalog (.fileSize spec.unit observed spec.expectedBytes))
+    let total := priorBytes + observed
+    if total > limits.maxPieceBytes then
+      return .error (resource .catalogPieceBytes total limits.maxPieceBytes)
+    let bytes ← IO.FS.readBinFile path
+    if bytes.size != spec.expectedBytes then
+      return .error
+        (.catalog (.fileSize spec.unit bytes.size spec.expectedBytes))
+    let total := priorBytes + bytes.size
+    if total > limits.maxPieceBytes then
+      return .error (resource .catalogPieceBytes total limits.maxPieceBytes)
+    return .ok bytes
+  catch error =>
+    return .error (.io "read storage unit" path.toString error.toString)
+
+/-- Load and deeply validate one self-contained `.ixc` directory. -/
+def loadDirWith (limits : Catalog.Limits) (directory : FilePath) :
+    IO (Except Error Catalog.Loaded) := do
+  let manifestPath := directory / "manifest"
+  let manifestBytes ← match ← readManifest limits manifestPath with
+    | .ok bytes => pure bytes
+    | .error error => return .error error
+  let manifest ← match Catalog.decodeManifestWith limits manifestBytes with
+    | .ok manifest => pure manifest
+    | .error error => return .error (.catalog error)
+  let specs := pieceSpecs manifest
+  let declaredBytes := specs.foldl
+    (fun total spec => total + spec.expectedBytes) 0
+  if declaredBytes > limits.maxPieceBytes then
+    return .error
+      (resource .catalogPieceBytes declaredBytes limits.maxPieceBytes)
+  let mut bytes := #[]
+  let mut priorBytes := 0
+  for spec in specs do
+    match ← readPiece limits directory priorBytes spec with
+    | .error error => return .error error
+    | .ok pieceBytes =>
+      bytes := bytes.push pieceBytes
+      priorBytes := priorBytes + pieceBytes.size
+  return (Catalog.loadWith limits manifestBytes bytes).mapError Error.catalog
+
+def loadDir (directory : FilePath) : IO (Except Error Catalog.Loaded) :=
+  loadDirWith Catalog.defaultLimits directory
+
+end Ix.Compiler.Ixon.CatalogIO
diff --git a/Ix/Compiler/Ixon/Const.lean b/Ix/Compiler/Ixon/Const.lean
new file mode 100644
index 000000000..8f009bb09
--- /dev/null
+++ b/Ix/Compiler/Ixon/Const.lean
@@ -0,0 +1,2784 @@
+import Ix.Compiler.Ixon.Serialize
+import Ix.Compiler.Ixon.Address
+import Ix.Compiler.Ixon.Univ
+import Ix.Compiler.Ixon.Expr
+import Ix.Compiler.Ixon.Sharing.Basic
+
+/-!
+# Ixon constants, v2
+
+The addressable unit: `Constant` = `ConstantInfo` payload + sharing,
+refs, and univs tables. Mirrors ix's structures and wire format (modes
+ride inside `Expr`; constants themselves are unchanged in v2 — per-field
+constructor usages are deferred to modal inductives).
+
+Object-level tag space: `ConstantInfo` serializes with Tag4 flag `0xD`
+(variant index in the size field) or `0xC` for mutual blocks — shared
+with the `Expr` flag namespace (`0x0`–`0xB`), leaving `0xE`/`0xF` free.
+
+Strictness upgrades over ix's decoder (candidates for the upstream
+delta): `DefKind`/`DefinitionSafety` bytes are validated exactly
+(ix's unpack has catch-all arms), packed-bool bytes must have no stray
+high bits, standalone `Bool` bytes must be `0` or `1`, and sharing tables
+must be acyclic/backward-only, non-aliasing, body-bounded, and free of dead
+or singleton entries.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-! ## Kind enums -/
+
+/-- Distinguish kinds of definitions. -/
+inductive DefKind where
+  | defn
+  | opaq
+  | thm
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+namespace DefKind
+
+def toBits : DefKind → UInt8
+  | .defn => 0
+  | .opaq => 1
+  | .thm => 2
+
+def ofBits? : UInt8 → Option DefKind
+  | 0 => some .defn
+  | 1 => some .opaq
+  | 2 => some .thm
+  | _ => none
+
+protected theorem ofBits?_toBits (k : DefKind) : ofBits? k.toBits = some k := by
+  cases k <;> rfl
+
+end DefKind
+
+inductive DefinitionSafety where
+  | unsaf
+  | safe
+  | part
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+namespace DefinitionSafety
+
+def toBits : DefinitionSafety → UInt8
+  | .unsaf => 0
+  | .safe => 1
+  | .part => 2
+
+def ofBits? : UInt8 → Option DefinitionSafety
+  | 0 => some .unsaf
+  | 1 => some .safe
+  | 2 => some .part
+  | _ => none
+
+protected theorem ofBits?_toBits (s : DefinitionSafety) :
+    ofBits? s.toBits = some s := by
+  cases s <;> rfl
+
+end DefinitionSafety
+
+/-- Mirrors `Lean.QuotKind`. -/
+inductive QuotKind where
+  | type
+  | ctor
+  | lift
+  | ind
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+namespace QuotKind
+
+def toBits : QuotKind → UInt8
+  | .type => 0
+  | .ctor => 1
+  | .lift => 2
+  | .ind => 3
+
+def ofBits? : UInt8 → Option QuotKind
+  | 0 => some .type
+  | 1 => some .ctor
+  | 2 => some .lift
+  | 3 => some .ind
+  | _ => none
+
+protected theorem ofBits?_toBits (q : QuotKind) : ofBits? q.toBits = some q := by
+  cases q <;> rfl
+
+end QuotKind
+
+/-! ## Constant structures -/
+
+structure Definition where
+  kind : DefKind
+  safety : DefinitionSafety
+  lvls : UInt64
+  typ : Expr
+  value : Expr
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure RecursorRule where
+  fields : UInt64
+  rhs : Expr
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure Recursor where
+  k : Bool
+  isUnsafe : Bool
+  lvls : UInt64
+  params : UInt64
+  indices : UInt64
+  motives : UInt64
+  minors : UInt64
+  typ : Expr
+  rules : Array RecursorRule
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure Axiom where
+  isUnsafe : Bool
+  lvls : UInt64
+  typ : Expr
+  deriving BEq, Repr, Inhabited
+
+structure Quotient where
+  kind : QuotKind
+  lvls : UInt64
+  typ : Expr
+  deriving BEq, Repr, Inhabited
+
+structure Constructor where
+  isUnsafe : Bool
+  lvls : UInt64
+  cidx : UInt64
+  params : UInt64
+  fields : UInt64
+  typ : Expr
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure Inductive where
+  isUnsafe : Bool
+  lvls : UInt64
+  params : UInt64
+  indices : UInt64
+  typ : Expr
+  ctors : Array Constructor
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+structure InductiveProj where
+  idx : UInt64
+  block : Address
+  deriving BEq, Repr, Inhabited
+
+structure ConstructorProj where
+  idx : UInt64
+  cidx : UInt64
+  block : Address
+  deriving BEq, Repr, Inhabited
+
+structure RecursorProj where
+  idx : UInt64
+  block : Address
+  deriving BEq, Repr, Inhabited
+
+structure DefinitionProj where
+  idx : UInt64
+  block : Address
+  deriving BEq, Repr, Inhabited
+
+inductive MutConst where
+  | defn : Definition → MutConst
+  | indc : Inductive → MutConst
+  | recr : Recursor → MutConst
+  deriving BEq, DecidableEq, Repr, Inhabited
+
+inductive ConstantInfo where
+  | defn : Definition → ConstantInfo
+  | recr : Recursor → ConstantInfo
+  | axio : Axiom → ConstantInfo
+  | quot : Quotient → ConstantInfo
+  | cPrj : ConstructorProj → ConstantInfo
+  | rPrj : RecursorProj → ConstantInfo
+  | iPrj : InductiveProj → ConstantInfo
+  | dPrj : DefinitionProj → ConstantInfo
+  | muts : Array MutConst → ConstantInfo
+  deriving BEq, Repr, Inhabited
+
+namespace ConstantInfo
+
+def CONST_DEFN : UInt64 := 0
+def CONST_RECR : UInt64 := 1
+def CONST_AXIO : UInt64 := 2
+def CONST_QUOT : UInt64 := 3
+def CONST_CPRJ : UInt64 := 4
+def CONST_RPRJ : UInt64 := 5
+def CONST_IPRJ : UInt64 := 6
+def CONST_DPRJ : UInt64 := 7
+
+end ConstantInfo
+
+/-- Recover the member table used when a constant is entered as its own
+evaluation/checking frame. Standalone definitions and recursors behave as
+singleton blocks; projections, axioms, quotients, and inductive projections
+have no local `recur` members.
+
+This belongs to the constant layer because both the evaluator and the usage
+checker interpret the same serialized `ConstantInfo` shape. -/
+def selfMutsOf : ConstantInfo → Array MutConst
+  | .muts members => members
+  | .defn definition => #[.defn definition]
+  | .recr recursor => #[.recr recursor]
+  | _ => #[]
+
+/-- A top-level constant with sharing, refs, and univs tables. -/
+structure Constant where
+  info : ConstantInfo
+  sharing : Array Expr
+  refs : Array Address
+  univs : Array Univ
+  deriving BEq, Repr, Inhabited
+
+namespace Constant
+
+def FLAG_MUTS : UInt8 := 0xC
+def FLAG : UInt8 := 0xD
+
+end Constant
+
+/-! ## Embedded expression enumeration
+
+This is the authoritative body order consumed by the sharing-table checker.
+It covers every expression in a constant payload; projections contain none. -/
+
+def Definition.exprs (d : Definition) : List Expr := [d.typ, d.value]
+
+def Recursor.exprs (r : Recursor) : List Expr :=
+  r.typ :: r.rules.toList.map (·.rhs)
+
+def Axiom.exprs (a : Axiom) : List Expr := [a.typ]
+
+def Quotient.exprs (q : Quotient) : List Expr := [q.typ]
+
+def Constructor.exprs (c : Constructor) : List Expr := [c.typ]
+
+def Inductive.exprs (i : Inductive) : List Expr :=
+  i.typ :: i.ctors.toList.flatMap Constructor.exprs
+
+def MutConst.exprs : MutConst → List Expr
+  | .defn d => d.exprs
+  | .indc i => i.exprs
+  | .recr r => r.exprs
+
+def ConstantInfo.exprs : ConstantInfo → List Expr
+  | .defn d => d.exprs
+  | .recr r => r.exprs
+  | .axio a => a.exprs
+  | .quot q => q.exprs
+  | .cPrj _ | .rPrj _ | .iPrj _ | .dPrj _ => []
+  | .muts ms => ms.toList.flatMap MutConst.exprs
+
+/-- The cheap, decoder-enforced sharing invariant for a complete constant. -/
+def Constant.sharingWF (c : Constant) : Bool :=
+  Sharing.layer1WF c.sharing c.info.exprs.toArray
+
+/-! ## Wire representability
+
+Counted arrays are mathematical `Array`s in Lean but carry `UInt64` lengths
+on the wire. These predicates state exactly the recursive fragment whose
+encoder counts do not wrap. -/
+
+def Definition.wireWF (d : Definition) : Prop :=
+  d.typ.wireWF ∧ d.value.wireWF
+
+def RecursorRule.wireWF (r : RecursorRule) : Prop :=
+  r.rhs.wireWF
+
+def Recursor.wireWF (r : Recursor) : Prop :=
+  r.typ.wireWF ∧
+    r.rules.size < UInt64.size ∧
+    ∀ rule ∈ r.rules, rule.wireWF
+
+def Axiom.wireWF (a : Axiom) : Prop :=
+  a.typ.wireWF
+
+def Quotient.wireWF (q : Quotient) : Prop :=
+  q.typ.wireWF
+
+def Constructor.wireWF (c : Constructor) : Prop :=
+  c.typ.wireWF
+
+def Inductive.wireWF (i : Inductive) : Prop :=
+  i.typ.wireWF ∧
+    i.ctors.size < UInt64.size ∧
+    ∀ ctor ∈ i.ctors, ctor.wireWF
+
+def MutConst.wireWF : MutConst → Prop
+  | .defn d => d.wireWF
+  | .indc i => i.wireWF
+  | .recr r => r.wireWF
+
+def ConstantInfo.wireWF : ConstantInfo → Prop
+  | .defn d => d.wireWF
+  | .recr r => r.wireWF
+  | .axio a => a.wireWF
+  | .quot q => q.wireWF
+  | .cPrj _ | .rPrj _ | .iPrj _ | .dPrj _ => True
+  | .muts ms =>
+    ms.size < UInt64.size ∧ ∀ member ∈ ms, member.wireWF
+
+def Constant.wireWF (c : Constant) : Prop :=
+  c.info.wireWF ∧
+    c.sharing.size < UInt64.size ∧
+    (∀ e ∈ c.sharing, e.wireWF) ∧
+    c.refs.size < UInt64.size ∧
+    c.univs.size < UInt64.size
+
+/-! ## Serialization -/
+
+def encodedListBytes (encode : α → ByteArray) : List α → ByteArray
+  | [] => ByteArray.empty
+  | value :: values => encode value ++ encodedListBytes encode values
+
+def encodedArrayBytes (encode : α → ByteArray) (values : Array α) : ByteArray :=
+  encodedListBytes encode values.toList
+
+def countedArrayBytes (encode : α → ByteArray) (values : Array α) : ByteArray :=
+  tag0Bytes ⟨values.size.toUInt64⟩ ++ encodedArrayBytes encode values
+
+def getListN (getOne : GetM α) : Nat → GetM (List α)
+  | 0 => pure []
+  | count + 1 => do
+    let value ← getOne
+    return value :: (← getListN getOne count)
+
+def getArrayN (getOne : GetM α) (count : Nat) : GetM (Array α) := do
+  return (← getListN getOne count).toArray
+
+def getPairM (getLeft : GetM α) (getRight : GetM β) : GetM (α × β) := do
+  let left ← getLeft
+  let right ← getRight
+  return (left, right)
+
+def getCountedArray (getOne : GetM α) : GetM (Array α) := do
+  let count ← getTag0
+  getArrayN getOne count.size.toNat
+
+def definitionModeByte (kind : DefKind) (safety : DefinitionSafety) : UInt8 :=
+  (kind.toBits <<< 2) ||| safety.toBits
+
+def recursorModeByte (k isUnsafe : Bool) : UInt8 :=
+  (if k then 1 else 0) ||| (if isUnsafe then 2 else 0)
+
+def boolBytes (value : Bool) : ByteArray :=
+  u8Bytes (if value then 1 else 0)
+
+def definitionModeOfByte? (b : UInt8) : Option (DefKind × DefinitionSafety) :=
+  match DefKind.ofBits? (b >>> 2), DefinitionSafety.ofBits? (b &&& 0x3) with
+  | some kind, some safety => some (kind, safety)
+  | _, _ => none
+
+def recursorModeOfByte? (b : UInt8) : Option (Bool × Bool) :=
+  if b >= 4 then none else some (b &&& 1 != 0, b &&& 2 != 0)
+
+def boolOfByte? : UInt8 → Option Bool
+  | 0 => some false
+  | 1 => some true
+  | _ => none
+
+def getDecodedU8 (what : String) (decode : UInt8 → Option α) : GetM α := do
+  let b ← getU8
+  match decode b with
+  | some value => return value
+  | none => throw s!"{what}: invalid byte {b}"
+
+def definitionBytes (d : Definition) : ByteArray :=
+  u8Bytes (definitionModeByte d.kind d.safety) ++
+    tag0Bytes ⟨d.lvls⟩ ++ exprBytes d.typ ++ exprBytes d.value
+
+def recursorRuleBytes (r : RecursorRule) : ByteArray :=
+  tag0Bytes ⟨r.fields⟩ ++ exprBytes r.rhs
+
+def recursorBytes (r : Recursor) : ByteArray :=
+  u8Bytes (recursorModeByte r.k r.isUnsafe) ++
+    tag0Bytes ⟨r.lvls⟩ ++ tag0Bytes ⟨r.params⟩ ++
+    tag0Bytes ⟨r.indices⟩ ++ tag0Bytes ⟨r.motives⟩ ++
+    tag0Bytes ⟨r.minors⟩ ++ exprBytes r.typ ++
+    countedArrayBytes recursorRuleBytes r.rules
+
+def axiomBytes (a : Axiom) : ByteArray :=
+  boolBytes a.isUnsafe ++
+    tag0Bytes ⟨a.lvls⟩ ++ exprBytes a.typ
+
+def quotientBytes (q : Quotient) : ByteArray :=
+  u8Bytes q.kind.toBits ++ tag0Bytes ⟨q.lvls⟩ ++ exprBytes q.typ
+
+def constructorBytes (c : Constructor) : ByteArray :=
+  boolBytes c.isUnsafe ++
+    tag0Bytes ⟨c.lvls⟩ ++ tag0Bytes ⟨c.cidx⟩ ++
+    tag0Bytes ⟨c.params⟩ ++ tag0Bytes ⟨c.fields⟩ ++ exprBytes c.typ
+
+def inductiveBytes (i : Inductive) : ByteArray :=
+  boolBytes i.isUnsafe ++
+    tag0Bytes ⟨i.lvls⟩ ++ tag0Bytes ⟨i.params⟩ ++
+    tag0Bytes ⟨i.indices⟩ ++ exprBytes i.typ ++
+    countedArrayBytes constructorBytes i.ctors
+
+def inductiveProjBytes (p : InductiveProj) : ByteArray :=
+  tag0Bytes ⟨p.idx⟩ ++ p.block.hash
+
+def constructorProjBytes (p : ConstructorProj) : ByteArray :=
+  tag0Bytes ⟨p.idx⟩ ++ tag0Bytes ⟨p.cidx⟩ ++ p.block.hash
+
+def recursorProjBytes (p : RecursorProj) : ByteArray :=
+  tag0Bytes ⟨p.idx⟩ ++ p.block.hash
+
+def definitionProjBytes (p : DefinitionProj) : ByteArray :=
+  tag0Bytes ⟨p.idx⟩ ++ p.block.hash
+
+def mutConstPayloadBytes : MutConst → ByteArray
+  | .defn d => definitionBytes d
+  | .indc i => inductiveBytes i
+  | .recr r => recursorBytes r
+
+def mutConstTag : MutConst → UInt8
+  | .defn _ => 0
+  | .indc _ => 1
+  | .recr _ => 2
+
+def mutConstBytes (m : MutConst) : ByteArray :=
+  u8Bytes (mutConstTag m) ++ mutConstPayloadBytes m
+
+def constantInfoTag : ConstantInfo → Tag4
+  | .defn _ => ⟨Constant.FLAG, ConstantInfo.CONST_DEFN⟩
+  | .recr _ => ⟨Constant.FLAG, ConstantInfo.CONST_RECR⟩
+  | .axio _ => ⟨Constant.FLAG, ConstantInfo.CONST_AXIO⟩
+  | .quot _ => ⟨Constant.FLAG, ConstantInfo.CONST_QUOT⟩
+  | .cPrj _ => ⟨Constant.FLAG, ConstantInfo.CONST_CPRJ⟩
+  | .rPrj _ => ⟨Constant.FLAG, ConstantInfo.CONST_RPRJ⟩
+  | .iPrj _ => ⟨Constant.FLAG, ConstantInfo.CONST_IPRJ⟩
+  | .dPrj _ => ⟨Constant.FLAG, ConstantInfo.CONST_DPRJ⟩
+  | .muts ms => ⟨Constant.FLAG_MUTS, ms.size.toUInt64⟩
+
+def constantInfoPayloadBytes : ConstantInfo → ByteArray
+  | .defn d => definitionBytes d
+  | .recr r => recursorBytes r
+  | .axio a => axiomBytes a
+  | .quot q => quotientBytes q
+  | .cPrj p => constructorProjBytes p
+  | .rPrj p => recursorProjBytes p
+  | .iPrj p => inductiveProjBytes p
+  | .dPrj p => definitionProjBytes p
+  | .muts ms => encodedArrayBytes mutConstBytes ms
+
+def constantInfoBytes (info : ConstantInfo) : ByteArray :=
+  tag4Bytes (constantInfoTag info) ++ constantInfoPayloadBytes info
+
+def constantTablesBytes (c : Constant) : ByteArray :=
+  countedArrayBytes exprBytes c.sharing ++
+    countedArrayBytes (fun a : Address => a.hash) c.refs ++
+    countedArrayBytes univBytes c.univs
+
+def constantBytes (c : Constant) : ByteArray :=
+  constantInfoBytes c.info ++ constantTablesBytes c
+
+def putDefinition (d : Definition) : PutM Unit := putBytes (definitionBytes d)
+def putRecursorRule (r : RecursorRule) : PutM Unit := putBytes (recursorRuleBytes r)
+def putRecursor (r : Recursor) : PutM Unit := putBytes (recursorBytes r)
+def putAxiom (a : Axiom) : PutM Unit := putBytes (axiomBytes a)
+def putQuotient (q : Quotient) : PutM Unit := putBytes (quotientBytes q)
+def putConstructor (c : Constructor) : PutM Unit := putBytes (constructorBytes c)
+def putInductive (i : Inductive) : PutM Unit := putBytes (inductiveBytes i)
+def putInductiveProj (p : InductiveProj) : PutM Unit :=
+  putBytes (inductiveProjBytes p)
+def putConstructorProj (p : ConstructorProj) : PutM Unit :=
+  putBytes (constructorProjBytes p)
+def putRecursorProj (p : RecursorProj) : PutM Unit :=
+  putBytes (recursorProjBytes p)
+def putDefinitionProj (p : DefinitionProj) : PutM Unit :=
+  putBytes (definitionProjBytes p)
+def putMutConst (m : MutConst) : PutM Unit := putBytes (mutConstBytes m)
+def putConstantInfo (info : ConstantInfo) : PutM Unit :=
+  putBytes (constantInfoBytes info)
+def putConstant (c : Constant) : PutM Unit := putBytes (constantBytes c)
+
+theorem putDefinition_spec (d : Definition) :
+    PutSpec (putDefinition d) (definitionBytes d) := putBytes_spec _
+theorem putRecursorRule_spec (r : RecursorRule) :
+    PutSpec (putRecursorRule r) (recursorRuleBytes r) := putBytes_spec _
+theorem putRecursor_spec (r : Recursor) :
+    PutSpec (putRecursor r) (recursorBytes r) := putBytes_spec _
+theorem putAxiom_spec (a : Axiom) :
+    PutSpec (putAxiom a) (axiomBytes a) := putBytes_spec _
+theorem putQuotient_spec (q : Quotient) :
+    PutSpec (putQuotient q) (quotientBytes q) := putBytes_spec _
+theorem putConstructor_spec (c : Constructor) :
+    PutSpec (putConstructor c) (constructorBytes c) := putBytes_spec _
+theorem putInductive_spec (i : Inductive) :
+    PutSpec (putInductive i) (inductiveBytes i) := putBytes_spec _
+theorem putInductiveProj_spec (p : InductiveProj) :
+    PutSpec (putInductiveProj p) (inductiveProjBytes p) := putBytes_spec _
+theorem putConstructorProj_spec (p : ConstructorProj) :
+    PutSpec (putConstructorProj p) (constructorProjBytes p) := putBytes_spec _
+theorem putRecursorProj_spec (p : RecursorProj) :
+    PutSpec (putRecursorProj p) (recursorProjBytes p) := putBytes_spec _
+theorem putDefinitionProj_spec (p : DefinitionProj) :
+    PutSpec (putDefinitionProj p) (definitionProjBytes p) := putBytes_spec _
+theorem putMutConst_spec (m : MutConst) :
+    PutSpec (putMutConst m) (mutConstBytes m) := putBytes_spec _
+theorem putConstantInfo_spec (info : ConstantInfo) :
+    PutSpec (putConstantInfo info) (constantInfoBytes info) := putBytes_spec _
+theorem putConstant_spec (c : Constant) :
+    PutSpec (putConstant c) (constantBytes c) := putBytes_spec _
+
+def getDefinitionMode : GetM (DefKind × DefinitionSafety) := do
+  getDecodedU8 "getDefinition" definitionModeOfByte?
+
+def getRecursorMode : GetM (Bool × Bool) := do
+  getDecodedU8 "getRecursor" recursorModeOfByte?
+
+def getQuotKind : GetM QuotKind := do
+  getDecodedU8 "getQuotient" QuotKind.ofBits?
+
+def getStrictBool (what : String) : GetM Bool := do
+  getDecodedU8 what boolOfByte?
+
+def getDefinition : GetM Definition :=
+  (fun raw =>
+    ⟨raw.1.1, raw.1.2, raw.2.1.size, raw.2.2.1, raw.2.2.2⟩) <$>
+    getPairM getDefinitionMode
+      (getPairM getTag0 (getPairM getExpr getExpr))
+
+def getRecursorRule : GetM RecursorRule :=
+  (fun raw => ⟨raw.1.size, raw.2⟩) <$> getPairM getTag0 getExpr
+
+def getRecursor : GetM Recursor :=
+  (fun raw =>
+    ⟨raw.1.1, raw.1.2, raw.2.1.size, raw.2.2.1.size,
+      raw.2.2.2.1.size, raw.2.2.2.2.1.size, raw.2.2.2.2.2.1.size,
+      raw.2.2.2.2.2.2.1, raw.2.2.2.2.2.2.2⟩) <$>
+    getPairM getRecursorMode
+      (getPairM getTag0
+        (getPairM getTag0
+          (getPairM getTag0
+            (getPairM getTag0
+              (getPairM getTag0
+                (getPairM getExpr (getCountedArray getRecursorRule)))))))
+
+def getAxiom : GetM Axiom :=
+  (fun raw => ⟨raw.1, raw.2.1.size, raw.2.2⟩) <$>
+    getPairM (getStrictBool "getAxiom") (getPairM getTag0 getExpr)
+
+def getQuotient : GetM Quotient :=
+  (fun raw => ⟨raw.1, raw.2.1.size, raw.2.2⟩) <$>
+    getPairM getQuotKind (getPairM getTag0 getExpr)
+
+def getConstructor : GetM Constructor :=
+  (fun raw =>
+    ⟨raw.1, raw.2.1.size, raw.2.2.1.size, raw.2.2.2.1.size,
+      raw.2.2.2.2.1.size, raw.2.2.2.2.2⟩) <$>
+    getPairM (getStrictBool "getConstructor")
+      (getPairM getTag0
+        (getPairM getTag0 (getPairM getTag0 (getPairM getTag0 getExpr))))
+
+def getInductive : GetM Inductive :=
+  (fun raw =>
+    ⟨raw.1, raw.2.1.size, raw.2.2.1.size, raw.2.2.2.1.size,
+      raw.2.2.2.2.1, raw.2.2.2.2.2⟩) <$>
+    getPairM (getStrictBool "getInductive")
+      (getPairM getTag0
+        (getPairM getTag0
+          (getPairM getTag0
+            (getPairM getExpr (getCountedArray getConstructor)))))
+
+def getInductiveProj : GetM InductiveProj :=
+  (fun raw => ⟨raw.1.size, raw.2⟩) <$>
+    getPairM getTag0 Serialize.get
+
+def getConstructorProj : GetM ConstructorProj :=
+  (fun raw => ⟨raw.1.size, raw.2.1.size, raw.2.2⟩) <$>
+    getPairM getTag0 (getPairM getTag0 Serialize.get)
+
+def getRecursorProj : GetM RecursorProj :=
+  (fun raw => ⟨raw.1.size, raw.2⟩) <$>
+    getPairM getTag0 Serialize.get
+
+def getDefinitionProj : GetM DefinitionProj :=
+  (fun raw => ⟨raw.1.size, raw.2⟩) <$>
+    getPairM getTag0 Serialize.get
+
+def getMutConstTag (tag : UInt8) : GetM MutConst := do
+  match tag with
+  | 0 => .defn <$> getDefinition
+  | 1 => .indc <$> getInductive
+  | 2 => .recr <$> getRecursor
+  | t => throw s!"getMutConst: invalid tag {t}"
+
+def getMutConst : GetM MutConst := do
+  getMutConstTag (← getU8)
+
+def getConstantInfoVariant (variant : UInt64) : GetM ConstantInfo := do
+  if variant == ConstantInfo.CONST_DEFN then .defn <$> getDefinition
+  else if variant == ConstantInfo.CONST_RECR then .recr <$> getRecursor
+  else if variant == ConstantInfo.CONST_AXIO then .axio <$> getAxiom
+  else if variant == ConstantInfo.CONST_QUOT then .quot <$> getQuotient
+  else if variant == ConstantInfo.CONST_CPRJ then .cPrj <$> getConstructorProj
+  else if variant == ConstantInfo.CONST_RPRJ then .rPrj <$> getRecursorProj
+  else if variant == ConstantInfo.CONST_IPRJ then .iPrj <$> getInductiveProj
+  else if variant == ConstantInfo.CONST_DPRJ then .dPrj <$> getDefinitionProj
+  else throw s!"getConstantInfo: invalid variant {variant}"
+
+def getConstantInfoTag (tag : Tag4) : GetM ConstantInfo := do
+  if tag.flag == Constant.FLAG_MUTS then
+    return .muts (← getArrayN getMutConst tag.size.toNat)
+  else if tag.flag == Constant.FLAG then
+    getConstantInfoVariant tag.size
+  else
+    throw s!"getConstantInfo: invalid flag {tag.flag}"
+
+def getConstantInfo : GetM ConstantInfo := do
+  getConstantInfoTag (← getTag4)
+
+instance : Serialize ConstantInfo where
+  put := putConstantInfo
+  get := getConstantInfo
+
+def checkConstantSharing (info : ConstantInfo) (sharing : Array Expr) : GetM Unit := do
+  if !Sharing.tableWF sharing then
+    throw "getConstant: sharing table must be backward-only, in-bounds, and non-aliasing"
+  let bodies := info.exprs.toArray
+  if !bodies.all (Sharing.sharesBelow sharing.size) then
+    throw "getConstant: sharing reference in a body is out of bounds"
+  if !Sharing.entriesUsedTwice sharing bodies then
+    throw "getConstant: sharing entries must each have at least two uses"
+
+def getConstantRefsUnivs : GetM (Array Address × Array Univ) :=
+  getPairM (getCountedArray Serialize.get) (getCountedArray getUniv)
+
+abbrev ConstantRaw :=
+  ConstantInfo × (Array Expr × (Array Address × Array Univ))
+
+def getConstantAfterSharing (info : ConstantInfo)
+    (sharing : Array Expr) : GetM (Array Expr × (Array Address × Array Univ)) := do
+  checkConstantSharing info sharing
+  return (sharing, ← getConstantRefsUnivs)
+
+def getConstantAfterInfo
+    (info : ConstantInfo) : GetM (Array Expr × (Array Address × Array Univ)) := do
+  let sharing ← getCountedArray getExpr
+  getConstantAfterSharing info sharing
+
+def getConstantRaw : GetM ConstantRaw := do
+  let info ← getConstantInfo
+  return (info, ← getConstantAfterInfo info)
+
+def buildConstant (raw : ConstantRaw) : Constant :=
+  ⟨raw.1, raw.2.1, raw.2.2.1, raw.2.2.2⟩
+
+def getConstant : GetM Constant :=
+  buildConstant <$> getConstantRaw
+
+instance : Serialize Constant where
+  put := putConstant
+  get := getConstant
+
+namespace ConstLaws
+
+attribute [local simp] encodedListBytes encodedArrayBytes
+attribute [local simp] Constant.FLAG Constant.FLAG_MUTS
+  ConstantInfo.CONST_DEFN ConstantInfo.CONST_RECR ConstantInfo.CONST_AXIO
+  ConstantInfo.CONST_QUOT ConstantInfo.CONST_CPRJ ConstantInfo.CONST_RPRJ
+  ConstantInfo.CONST_IPRJ ConstantInfo.CONST_DPRJ
+
+theorem getListN_spec (getOne : GetM α) (encode : α → ByteArray)
+    (hone : ∀ value, GetSpec getOne (encode value) value)
+    (values : List α) :
+    GetSpec (getListN getOne values.length)
+      (encodedListBytes encode values) values := by
+  induction values with
+  | nil => exact GetSpec.pure []
+  | cons value values ih =>
+    intro pre suffix
+    simp only [List.length_cons, getListN, StateT.run_bind]
+    have hbytes :
+        pre ++ encodedListBytes encode (value :: values) ++ suffix =
+          pre ++ encode value ++ (encodedListBytes encode values ++ suffix) := by
+      simp [ByteArray.append_assoc]
+    rw [hbytes, hone value pre (encodedListBytes encode values ++ suffix)]
+    simp only [bind, Except.bind]
+    have htail := ih (pre ++ encode value) suffix
+    have htail' :
+        (getListN getOne values.length).run
+            ⟨pre ++ encode value ++ (encodedListBytes encode values ++ suffix),
+              pre.size + (encode value).size⟩ =
+          .ok (values,
+            ⟨pre ++ encode value ++ (encodedListBytes encode values ++ suffix),
+              pre.size + (encode value).size +
+                (encodedListBytes encode values).size⟩) := by
+      simpa [ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc] using htail
+    rw [htail']
+    simp [ByteArray.size_append, Nat.add_assoc]
+    rfl
+
+theorem getListN_spec_of (getOne : GetM α) (encode : α → ByteArray)
+    (property : α → Prop)
+    (hone : ∀ value, property value → GetSpec getOne (encode value) value)
+    (values : List α) (hvalues : ∀ value ∈ values, property value) :
+    GetSpec (getListN getOne values.length)
+      (encodedListBytes encode values) values := by
+  induction values with
+  | nil => exact GetSpec.pure []
+  | cons value values ih =>
+    have hvalue : property value := hvalues value (by simp)
+    have htail : ∀ item ∈ values, property item := by
+      intro item hitem
+      exact hvalues item (by simp [hitem])
+    intro pre suffix
+    simp only [List.length_cons, getListN, StateT.run_bind]
+    have hbytes :
+        pre ++ encodedListBytes encode (value :: values) ++ suffix =
+          pre ++ encode value ++ (encodedListBytes encode values ++ suffix) := by
+      simp [ByteArray.append_assoc]
+    rw [hbytes, hone value hvalue pre (encodedListBytes encode values ++ suffix)]
+    simp only [bind, Except.bind]
+    have hrun := ih htail (pre ++ encode value) suffix
+    have hrun' :
+        (getListN getOne values.length).run
+            ⟨pre ++ encode value ++ (encodedListBytes encode values ++ suffix),
+              pre.size + (encode value).size⟩ =
+          .ok (values,
+            ⟨pre ++ encode value ++ (encodedListBytes encode values ++ suffix),
+              pre.size + (encode value).size +
+                (encodedListBytes encode values).size⟩) := by
+      simpa [ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc] using hrun
+    rw [hrun']
+    simp [ByteArray.size_append, Nat.add_assoc]
+    rfl
+
+theorem getListN_canonical (getOne : GetM α) (encode : α → ByteArray)
+    (hone : GetCanonical getOne encode) (count : Nat) :
+    GetCanonical (getListN getOne count) (encodedListBytes encode) := by
+  induction count with
+  | zero =>
+    intro pre rest values st' h
+    simp [getListN] at h
+    cases h
+    exact ⟨rest, by simp, by simp⟩
+  | succ count ih =>
+    intro pre rest values st' h
+    simp only [getListN, StateT.run_bind] at h
+    cases hh : getOne.run ⟨pre ++ rest, pre.size⟩ with
+    | error err => rw [hh] at h; contradiction
+    | ok headState =>
+      rcases headState with ⟨head, afterHead⟩
+      rw [hh] at h
+      simp only [bind, Except.bind] at h
+      obtain ⟨afterHeadBytes, hrestHead, hafterHead⟩ :=
+        hone pre rest hh
+      let headPre := pre ++ encode head
+      have hafterHead' :
+          afterHead = ⟨headPre ++ afterHeadBytes, headPre.size⟩ := by
+        rw [hafterHead]
+        simp [headPre, hrestHead, ByteArray.append_assoc]
+      rw [hafterHead'] at h
+      cases ht : (getListN getOne count).run
+          ⟨headPre ++ afterHeadBytes, headPre.size⟩ with
+      | error err => rw [ht] at h; contradiction
+      | ok tailState =>
+        rcases tailState with ⟨tail, afterTail⟩
+        rw [ht] at h
+        simp at h
+        cases h
+        obtain ⟨suffix, hrestTail, hafterTail⟩ :=
+          ih headPre afterHeadBytes ht
+        refine ⟨suffix, ?_, ?_⟩
+        · rw [hrestHead, hrestTail]
+          simp [ByteArray.append_assoc]
+        · simpa [headPre, hrestHead, hrestTail,
+            ByteArray.append_assoc, ByteArray.size_append,
+            Nat.add_assoc] using hafterTail
+
+theorem getListN_success_length (getOne : GetM α) (count : Nat) :
+    ∀ (initial : GetState) {values : List α} {st' : GetState},
+      (getListN getOne count).run initial = .ok (values, st') →
+      values.length = count := by
+  induction count with
+  | zero =>
+    intro initial values st' h
+    simp [getListN] at h
+    cases h
+    rfl
+  | succ count ih =>
+    intro initial values st' h
+    simp only [getListN, StateT.run_bind] at h
+    cases hh : getOne.run initial with
+    | error err => rw [hh] at h; contradiction
+    | ok headState =>
+      rcases headState with ⟨head, afterHead⟩
+      rw [hh] at h
+      simp only [bind, Except.bind] at h
+      cases ht : (getListN getOne count).run afterHead with
+      | error err => rw [ht] at h; contradiction
+      | ok tailState =>
+        rcases tailState with ⟨tail, afterTail⟩
+        rw [ht] at h
+        simp at h
+        cases h
+        simp [ih afterHead ht]
+
+theorem getArrayN_spec (getOne : GetM α) (encode : α → ByteArray)
+    (hone : ∀ value, GetSpec getOne (encode value) value)
+    (values : Array α) :
+    GetSpec (getArrayN getOne values.size)
+      (encodedArrayBytes encode values) values := by
+  have hlist := getListN_spec getOne encode hone values.toList
+  have hmapped := ExprLaws.GetSpec.map hlist List.toArray
+  simpa [getArrayN] using hmapped
+
+theorem getArrayN_spec_of (getOne : GetM α) (encode : α → ByteArray)
+    (property : α → Prop)
+    (hone : ∀ value, property value → GetSpec getOne (encode value) value)
+    (values : Array α) (hvalues : ∀ value ∈ values.toList, property value) :
+    GetSpec (getArrayN getOne values.size)
+      (encodedArrayBytes encode values) values := by
+  have hlist := getListN_spec_of getOne encode property hone values.toList hvalues
+  have hmapped := ExprLaws.GetSpec.map hlist List.toArray
+  simpa [getArrayN] using hmapped
+
+theorem getArrayN_canonical (getOne : GetM α) (encode : α → ByteArray)
+    (hone : GetCanonical getOne encode) (count : Nat) :
+    GetCanonical (getArrayN getOne count) (encodedArrayBytes encode) := by
+  intro pre rest values st' h
+  change (getListN getOne count >>= fun list => pure list.toArray).run
+    ⟨pre ++ rest, pre.size⟩ = .ok (values, st') at h
+  obtain ⟨list, after, hrest, hnext⟩ :=
+    ExprLaws.GetCanonical.bind_inv
+      (getListN_canonical getOne encode hone count) pre rest h
+  simp at hnext
+  cases hnext
+  exact ⟨after, by simpa using hrest,
+    by simp [hrest, ByteArray.append_assoc]⟩
+
+theorem getArrayN_success_size (getOne : GetM α) (count : Nat) :
+    ∀ (initial : GetState) {values : Array α} {st' : GetState},
+      (getArrayN getOne count).run initial = .ok (values, st') →
+      values.size = count := by
+  intro initial values st' h
+  change (getListN getOne count >>= fun list => pure list.toArray).run initial =
+    .ok (values, st') at h
+  simp only [StateT.run_bind] at h
+  cases hl : (getListN getOne count).run initial with
+  | error err => rw [hl] at h; contradiction
+  | ok listState =>
+    rcases listState with ⟨list, afterList⟩
+    rw [hl] at h
+    simp at h
+    cases h
+    simpa using getListN_success_length getOne count initial hl
+
+theorem getCountedArray_spec (getOne : GetM α) (encode : α → ByteArray)
+    (hone : ∀ value, GetSpec getOne (encode value) value)
+    (values : Array α) (hsize : values.size < UInt64.size) :
+    GetSpec (getCountedArray getOne) (countedArrayBytes encode values) values := by
+  have hround : values.size.toUInt64.toNat = values.size :=
+    UInt64.toNat_ofNat_of_lt hsize
+  let afterCount : Tag0 → GetM (Array α) := fun count =>
+    getArrayN getOne count.size.toNat
+  have hafter : GetSpec (afterCount ⟨values.size.toUInt64⟩)
+      (encodedArrayBytes encode values) values := by
+    simpa [afterCount, hround] using getArrayN_spec getOne encode hone values
+  have htotal := GetSpec.bind (next := afterCount)
+    (getTag0_encoded_spec ⟨values.size.toUInt64⟩) hafter
+  simpa [getCountedArray, countedArrayBytes, afterCount] using htotal
+
+theorem getCountedArray_spec_of (getOne : GetM α) (encode : α → ByteArray)
+    (property : α → Prop)
+    (hone : ∀ value, property value → GetSpec getOne (encode value) value)
+    (values : Array α) (hsize : values.size < UInt64.size)
+    (hvalues : ∀ value ∈ values.toList, property value) :
+    GetSpec (getCountedArray getOne) (countedArrayBytes encode values) values := by
+  have hround : values.size.toUInt64.toNat = values.size :=
+    UInt64.toNat_ofNat_of_lt hsize
+  let afterCount : Tag0 → GetM (Array α) := fun count =>
+    getArrayN getOne count.size.toNat
+  have hafter : GetSpec (afterCount ⟨values.size.toUInt64⟩)
+      (encodedArrayBytes encode values) values := by
+    simpa [afterCount, hround] using
+      getArrayN_spec_of getOne encode property hone values hvalues
+  have htotal := GetSpec.bind (next := afterCount)
+    (getTag0_encoded_spec ⟨values.size.toUInt64⟩) hafter
+  simpa [getCountedArray, countedArrayBytes, afterCount] using htotal
+
+theorem getCountedArray_canonical (getOne : GetM α)
+    (encode : α → ByteArray) (hone : GetCanonical getOne encode) :
+    GetCanonical (getCountedArray getOne) (countedArrayBytes encode) := by
+  intro pre rest values st' h
+  let afterCount : Tag0 → GetM (Array α) := fun count =>
+    getArrayN getOne count.size.toNat
+  change (getTag0 >>= afterCount).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (values, st') at h
+  obtain ⟨count, afterCountBytes, hrestCount, hafterCount⟩ :=
+    ExprLaws.GetCanonical.bind_inv getTag0_canonical pre rest h
+  let countPre := pre ++ tag0Bytes count
+  have hafterCount' :
+      (getArrayN getOne count.size.toNat).run
+        ⟨countPre ++ afterCountBytes, countPre.size⟩ = .ok (values, st') := by
+    simpa [afterCount, countPre] using hafterCount
+  obtain ⟨suffix, hrestValues, hstate⟩ :=
+    getArrayN_canonical getOne encode hone count.size.toNat
+      countPre afterCountBytes hafterCount'
+  have hsize := getArrayN_success_size getOne count.size.toNat
+    ⟨countPre ++ afterCountBytes, countPre.size⟩ hafterCount'
+  have hcount : values.size.toUInt64 = count.size := by
+    rw [hsize]
+    exact UInt64.ofNat_toNat
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestCount, hrestValues]
+    simp [countedArrayBytes, hcount, ByteArray.append_assoc]
+  · simpa [countPre, hrestCount, hrestValues, countedArrayBytes, hcount,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc] using hstate
+
+theorem getDecodedU8_spec (what : String) (decode : UInt8 → Option α)
+    (encode : α → UInt8) (hdecode : ∀ value, decode (encode value) = some value)
+    (value : α) :
+    GetSpec (getDecodedU8 what decode) (u8Bytes (encode value)) value := by
+  intro pre suffix
+  simp only [getDecodedU8, StateT.run_bind]
+  rw [getU8_spec (encode value) pre suffix]
+  simp only [bind, Except.bind]
+  rw [hdecode value]
+  rfl
+
+theorem getDecodedU8_canonical (what : String) (decode : UInt8 → Option α)
+    (encode : α → UInt8)
+    (hinv : ∀ {byte value}, decode byte = some value → byte = encode value) :
+    GetCanonical (getDecodedU8 what decode) (fun value => u8Bytes (encode value)) := by
+  intro pre rest value st' h
+  simp only [getDecodedU8, StateT.run_bind] at h
+  cases hb : getU8.run ⟨pre ++ rest, pre.size⟩ with
+  | error err => rw [hb] at h; contradiction
+  | ok byteState =>
+    rcases byteState with ⟨byte, afterByte⟩
+    rw [hb] at h
+    simp only [bind, Except.bind] at h
+    cases hd : decode byte with
+    | none => rw [hd] at h; contradiction
+    | some decoded =>
+      rw [hd] at h
+      simp at h
+      cases h
+      have hbyte := hinv hd
+      subst byte
+      exact getU8_canonical pre rest hb
+
+namespace ModeBits
+
+private theorem nat_lt_eight_cases {i : Nat} (h : i < 8) :
+    i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 ∨ i = 4 ∨ i = 5 ∨ i = 6 ∨ i = 7 := by
+  omega
+
+theorem split_low2 (byte : UInt8) :
+    ((byte >>> 2) <<< 2) ||| (byte &&& 0x3) = byte := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_or, UInt8.toBitVec_and,
+    UInt8.toBitVec_shiftLeft, UInt8.toBitVec_shiftRight,
+    BitVec.getElem_or, BitVec.getElem_and, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+private theorem reconstruct_low2 (byte : UInt8) (h : byte < 4) :
+    byte = (byte &&& 1) ||| (byte &&& 2) := by
+  have hbn : byte.toNat < 2 ^ 2 := by
+    simpa [UInt8.lt_iff_toNat_lt] using h
+  have hbit (i : Nat) (hi : i < 8) (h2 : 2 ≤ i) :
+      byte.toBitVec[i] = false := by
+    rw [BitVec.getElem_eq_testBit_toNat]
+    apply Nat.testBit_lt_two_pow
+    exact Nat.lt_of_lt_of_le hbn
+      (Nat.pow_le_pow_of_le (by decide : 1 < 2) h2)
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_or, UInt8.toBitVec_and,
+    BitVec.getElem_or, BitVec.getElem_and, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  all_goals exact hbit _ (by omega) (by omega)
+
+private theorem and_one_cases (byte : UInt8) :
+    byte &&& 1 = 0 ∨ byte &&& 1 = 1 := by
+  by_cases hb : byte.toBitVec[0] = true
+  · right
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb]
+  · left
+    have hb' : byte.toBitVec[0] = false := by
+      cases hbit : byte.toBitVec[0] <;> simp_all
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb']
+
+private theorem and_two_cases (byte : UInt8) :
+    byte &&& 2 = 0 ∨ byte &&& 2 = 2 := by
+  by_cases hb : byte.toBitVec[1] = true
+  · right
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb]
+  · left
+    have hb' : byte.toBitVec[1] = false := by
+      cases hbit : byte.toBitVec[1] <;> simp_all
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb']
+
+theorem recursor_inverse (byte : UInt8) (k isUnsafe : Bool)
+    (hlt : byte < 4)
+    (hk : (byte &&& 1 != 0) = k)
+    (hu : (byte &&& 2 != 0) = isUnsafe) :
+    byte = recursorModeByte k isUnsafe := by
+  have hr := reconstruct_low2 byte hlt
+  cases k <;> cases isUnsafe
+  · simp at hk hu
+    calc
+      byte = (byte &&& 1) ||| (byte &&& 2) := hr
+      _ = 0 := by rw [hk, hu]; rfl
+      _ = recursorModeByte false false := by rfl
+  · simp at hk hu
+    have htwo := (and_two_cases byte).resolve_left hu
+    calc
+      byte = (byte &&& 1) ||| (byte &&& 2) := hr
+      _ = 2 := by rw [hk, htwo]; rfl
+      _ = recursorModeByte false true := by rfl
+  · simp at hk hu
+    have hone := (and_one_cases byte).resolve_left hk
+    calc
+      byte = (byte &&& 1) ||| (byte &&& 2) := hr
+      _ = 1 := by rw [hone, hu]; rfl
+      _ = recursorModeByte true false := by rfl
+  · simp at hk hu
+    have hone := (and_one_cases byte).resolve_left hk
+    have htwo := (and_two_cases byte).resolve_left hu
+    calc
+      byte = (byte &&& 1) ||| (byte &&& 2) := hr
+      _ = 1 ||| 2 := by rw [hone, htwo]
+      _ = recursorModeByte true true := by rfl
+
+end ModeBits
+
+theorem definitionMode_decode (kind : DefKind) (safety : DefinitionSafety) :
+    definitionModeOfByte? (definitionModeByte kind safety) =
+      some (kind, safety) := by
+  cases kind <;> cases safety <;> rfl
+
+theorem definitionMode_inverse {byte : UInt8}
+    {mode : DefKind × DefinitionSafety}
+    (h : definitionModeOfByte? byte = some mode) :
+    byte = definitionModeByte mode.1 mode.2 := by
+  simp only [definitionModeOfByte?] at h
+  split at h
+  next kind safety hkind hsafety =>
+    simp at h
+    cases h
+    have hkind' : byte >>> 2 = kind.toBits := by
+      cases kind <;> simp only [DefKind.ofBits?] at hkind
+      all_goals split at hkind <;> simp_all [DefKind.toBits]
+    have hsafety' : byte &&& 0x3 = safety.toBits := by
+      cases safety <;> simp only [DefinitionSafety.ofBits?] at hsafety
+      all_goals split at hsafety <;> simp_all [DefinitionSafety.toBits]
+    change byte = definitionModeByte kind safety
+    simp only [definitionModeByte]
+    rw [← hkind', ← hsafety']
+    exact (ModeBits.split_low2 byte).symm
+  next => contradiction
+
+theorem recursorMode_decode (k isUnsafe : Bool) :
+    recursorModeOfByte? (recursorModeByte k isUnsafe) = some (k, isUnsafe) := by
+  cases k <;> cases isUnsafe <;> decide
+
+theorem recursorMode_inverse {byte : UInt8} {mode : Bool × Bool}
+    (h : recursorModeOfByte? byte = some mode) :
+    byte = recursorModeByte mode.1 mode.2 := by
+  rcases mode with ⟨k, isUnsafe⟩
+  cases k <;> cases isUnsafe <;>
+    simp only [recursorModeOfByte?] at h
+  all_goals split at h <;> simp_all [recursorModeByte]
+  all_goals
+    first
+    | exact ModeBits.recursor_inverse byte false false (by assumption)
+        (by simp_all) (by simp_all)
+    | exact ModeBits.recursor_inverse byte false true (by assumption)
+        (by simp_all) (by simp_all)
+    | exact ModeBits.recursor_inverse byte true false (by assumption)
+        (by simp_all) (by simp_all)
+    | exact ModeBits.recursor_inverse byte true true (by assumption)
+        (by simp_all) (by simp_all)
+
+theorem bool_decode (value : Bool) :
+    boolOfByte? (if value then 1 else 0) = some value := by
+  cases value <;> rfl
+
+theorem bool_inverse {byte : UInt8} {value : Bool}
+    (h : boolOfByte? byte = some value) :
+    byte = if value then 1 else 0 := by
+  cases value <;> simp only [boolOfByte?] at h ⊢
+  all_goals split at h <;> simp_all
+
+theorem quotKind_decode (kind : QuotKind) :
+    QuotKind.ofBits? kind.toBits = some kind :=
+  QuotKind.ofBits?_toBits kind
+
+theorem quotKind_inverse {byte : UInt8} {kind : QuotKind}
+    (h : QuotKind.ofBits? byte = some kind) : byte = kind.toBits := by
+  cases kind <;> simp only [QuotKind.ofBits?] at h
+  all_goals split at h <;> simp_all [QuotKind.toBits]
+
+theorem getDefinitionMode_spec (kind : DefKind) (safety : DefinitionSafety) :
+    GetSpec getDefinitionMode
+      (u8Bytes (definitionModeByte kind safety)) (kind, safety) := by
+  simpa only [getDefinitionMode] using
+    getDecodedU8_spec "getDefinition" definitionModeOfByte?
+      (fun mode => definitionModeByte mode.1 mode.2)
+      (fun mode => definitionMode_decode mode.1 mode.2) (kind, safety)
+
+theorem getDefinitionMode_canonical :
+    GetCanonical getDefinitionMode
+      (fun mode => u8Bytes (definitionModeByte mode.1 mode.2)) := by
+  simpa only [getDefinitionMode] using
+    getDecodedU8_canonical "getDefinition" definitionModeOfByte?
+      (fun mode => definitionModeByte mode.1 mode.2) definitionMode_inverse
+
+theorem getRecursorMode_spec (k isUnsafe : Bool) :
+    GetSpec getRecursorMode
+      (u8Bytes (recursorModeByte k isUnsafe)) (k, isUnsafe) := by
+  simpa only [getRecursorMode] using
+    getDecodedU8_spec "getRecursor" recursorModeOfByte?
+      (fun mode => recursorModeByte mode.1 mode.2)
+      (fun mode => recursorMode_decode mode.1 mode.2) (k, isUnsafe)
+
+theorem getRecursorMode_canonical :
+    GetCanonical getRecursorMode
+      (fun mode => u8Bytes (recursorModeByte mode.1 mode.2)) := by
+  simpa only [getRecursorMode] using
+    getDecodedU8_canonical "getRecursor" recursorModeOfByte?
+      (fun mode => recursorModeByte mode.1 mode.2) recursorMode_inverse
+
+theorem getStrictBool_spec (what : String) (value : Bool) :
+    GetSpec (getStrictBool what) (boolBytes value) value := by
+  exact getDecodedU8_spec _ _ _ bool_decode value
+
+theorem getStrictBool_canonical (what : String) :
+    GetCanonical (getStrictBool what) boolBytes := by
+  exact getDecodedU8_canonical _ _ _ bool_inverse
+
+theorem getQuotKind_spec (kind : QuotKind) :
+    GetSpec getQuotKind (u8Bytes kind.toBits) kind := by
+  exact getDecodedU8_spec _ _ _ quotKind_decode kind
+
+theorem getQuotKind_canonical :
+    GetCanonical getQuotKind (fun kind => u8Bytes kind.toBits) := by
+  exact getDecodedU8_canonical _ _ _ quotKind_inverse
+
+def pairBytes (encodeLeft : α → ByteArray) (encodeRight : β → ByteArray)
+    (value : α × β) : ByteArray :=
+  encodeLeft value.1 ++ encodeRight value.2
+
+def getPair (getLeft : GetM α) (getRight : GetM β) : GetM (α × β) := do
+  getPairM getLeft getRight
+
+theorem getPair_spec (getLeft : GetM α) (getRight : GetM β)
+    (encodeLeft : α → ByteArray) (encodeRight : β → ByteArray)
+    {left : α} {right : β}
+    (hleft : GetSpec getLeft (encodeLeft left) left)
+    (hright : GetSpec getRight (encodeRight right) right) :
+    GetSpec (getPair getLeft getRight)
+      (pairBytes encodeLeft encodeRight (left, right)) (left, right) := by
+  let finish : β → GetM (α × β) := fun decodedRight =>
+    pure (left, decodedRight)
+  have hfinish : GetSpec (finish right) ByteArray.empty (left, right) :=
+    GetSpec.pure _
+  have hright' := GetSpec.bind (next := finish) hright hfinish
+  simp only [ByteArray.append_empty] at hright'
+  let afterLeft : α → GetM (α × β) := fun decodedLeft => do
+    let decodedRight ← getRight
+    return (decodedLeft, decodedRight)
+  have hafter : GetSpec (afterLeft left) (encodeRight right) (left, right) := by
+    simpa [afterLeft, finish] using hright'
+  have htotal := GetSpec.bind (next := afterLeft) hleft hafter
+  simpa [getPair, getPairM, pairBytes, afterLeft, finish] using htotal
+
+theorem getPair_canonical (getLeft : GetM α) (getRight : GetM β)
+    (encodeLeft : α → ByteArray) (encodeRight : β → ByteArray)
+    (hleft : GetCanonical getLeft encodeLeft)
+    (hright : GetCanonical getRight encodeRight) :
+    GetCanonical (getPair getLeft getRight)
+      (pairBytes encodeLeft encodeRight) := by
+  intro pre rest value st' h
+  let afterLeft : α → GetM (α × β) := fun left => do
+    let right ← getRight
+    return (left, right)
+  change (getLeft >>= afterLeft).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨left, afterLeftBytes, hrestLeft, hafterLeft⟩ :=
+    ExprLaws.GetCanonical.bind_inv hleft pre rest h
+  let leftPre := pre ++ encodeLeft left
+  let finish : β → GetM (α × β) := fun right => pure (left, right)
+  have hafterLeft' :
+      (getRight >>= finish).run
+        ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ = .ok (value, st') := by
+    simpa [afterLeft, finish, leftPre] using hafterLeft
+  obtain ⟨right, suffix, hrestRight, hfinish⟩ :=
+    ExprLaws.GetCanonical.bind_inv hright leftPre afterLeftBytes hafterLeft'
+  simp [finish] at hfinish
+  cases hfinish
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestLeft, hrestRight]
+    simp [pairBytes, ByteArray.append_assoc]
+  · simp [pairBytes, leftPre, hrestLeft, hrestRight,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc]
+
+theorem GetCanonical.map {get : GetM α} {encode : α → ByteArray}
+    (hget : GetCanonical get encode) (f : α → β) (encodeResult : β → ByteArray)
+    (hencode : ∀ value, encodeResult (f value) = encode value) :
+    GetCanonical (f <$> get) encodeResult := by
+  intro pre rest result st' h
+  change (get >>= fun value => pure (f value)).run
+    ⟨pre ++ rest, pre.size⟩ = .ok (result, st') at h
+  obtain ⟨value, suffix, hrest, hfinish⟩ :=
+    ExprLaws.GetCanonical.bind_inv hget pre rest h
+  simp at hfinish
+  cases hfinish
+  rw [hencode value] at ⊢
+  exact ⟨suffix, hrest, by simp [hrest, ByteArray.append_assoc]⟩
+
+theorem address_ofBytes_inverse {bytes : ByteArray} {address : Address}
+    (h : Address.ofBytes? bytes = some address) : bytes = address.hash := by
+  unfold Address.ofBytes? at h
+  split at h
+  · simp at h
+    cases h
+    rfl
+  · contradiction
+
+theorem getAddress_canonical :
+    GetCanonical (Serialize.get (self := inferInstance) : GetM Address)
+      (fun address => address.hash) := by
+  intro pre rest address st' h
+  change (do
+    let bytes ← getBytes 32
+    match Address.ofBytes? bytes with
+    | some decoded => return decoded
+    | none => throw "internal: getBytes returned a non-32-byte address").run
+      ⟨pre ++ rest, pre.size⟩ = .ok (address, st') at h
+  obtain ⟨bytes, suffix, hrest, hfinish⟩ :=
+    ExprLaws.GetCanonical.bind_inv (getBytes_canonical 32) pre rest h
+  cases ha : Address.ofBytes? bytes with
+  | none =>
+    simp [ha] at hfinish
+    change (Except.error _) = Except.ok (address, st') at hfinish
+    contradiction
+  | some decoded =>
+    simp [ha] at hfinish
+    cases hfinish
+    have hbytes := address_ofBytes_inverse ha
+    subst bytes
+    exact ⟨suffix, hrest,
+      by simp [hrest, ByteArray.append_assoc, address.hash_size]⟩
+
+def DefinitionRaw :=
+  (DefKind × DefinitionSafety) × (Tag0 × (Expr × Expr))
+
+def getDefinitionRaw : GetM DefinitionRaw :=
+  getPairM getDefinitionMode
+    (getPairM getTag0 (getPairM getExpr getExpr))
+
+def definitionRawBytes : DefinitionRaw → ByteArray :=
+  pairBytes
+    (fun mode => u8Bytes (definitionModeByte mode.1 mode.2))
+    (pairBytes tag0Bytes (pairBytes exprBytes exprBytes))
+
+def buildDefinition (raw : DefinitionRaw) : Definition :=
+  ⟨raw.1.1, raw.1.2, raw.2.1.size, raw.2.2.1, raw.2.2.2⟩
+
+theorem getDefinition_eq :
+    getDefinition = buildDefinition <$> getDefinitionRaw := by
+  rfl
+
+theorem definitionRawBytes_build (raw : DefinitionRaw) :
+    definitionBytes (buildDefinition raw) = definitionRawBytes raw := by
+  rcases raw with ⟨⟨kind, safety⟩, ⟨lvls, typ, value⟩⟩
+  simp [definitionBytes, definitionRawBytes, buildDefinition, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getDefinition_spec (d : Definition) (hwf : d.wireWF) :
+    GetSpec getDefinition (definitionBytes d) d := by
+  rcases d with ⟨kind, safety, lvls, typ, value⟩
+  rcases hwf with ⟨htyp, hvalue⟩
+  let raw : DefinitionRaw := ((kind, safety), (⟨lvls⟩, (typ, value)))
+  have hexprTyp := ExprLaws.getExpr_spec typ htyp
+  have hexprValue := ExprLaws.getExpr_spec value hvalue
+  have hraw : GetSpec getDefinitionRaw (definitionRawBytes raw) raw := by
+    apply getPair_spec
+    · exact getDefinitionMode_spec kind safety
+    · apply getPair_spec
+      · exact getTag0_encoded_spec ⟨lvls⟩
+      · exact getPair_spec _ _ _ _ hexprTyp hexprValue
+  rw [getDefinition_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildDefinition
+  simpa [raw, definitionBytes, definitionRawBytes, buildDefinition,
+    pairBytes, ByteArray.append_assoc] using hmapped
+
+theorem getDefinition_canonical :
+    GetCanonical getDefinition definitionBytes := by
+  have hraw : GetCanonical getDefinitionRaw definitionRawBytes := by
+    apply getPair_canonical
+    · exact getDefinitionMode_canonical
+    · apply getPair_canonical
+      · exact getTag0_canonical
+      · exact getPair_canonical _ _ _ _
+          ExprLaws.getExpr_canonical ExprLaws.getExpr_canonical
+  rw [getDefinition_eq]
+  exact GetCanonical.map hraw buildDefinition definitionBytes
+    definitionRawBytes_build
+
+def RecursorRuleRaw := Tag0 × Expr
+
+def getRecursorRuleRaw : GetM RecursorRuleRaw :=
+  getPairM getTag0 getExpr
+
+def recursorRuleRawBytes : RecursorRuleRaw → ByteArray :=
+  pairBytes tag0Bytes exprBytes
+
+def buildRecursorRule (raw : RecursorRuleRaw) : RecursorRule :=
+  ⟨raw.1.size, raw.2⟩
+
+theorem getRecursorRule_eq :
+    getRecursorRule = buildRecursorRule <$> getRecursorRuleRaw := by
+  rfl
+
+theorem recursorRuleRawBytes_build (raw : RecursorRuleRaw) :
+    recursorRuleBytes (buildRecursorRule raw) = recursorRuleRawBytes raw := by
+  rcases raw with ⟨fields, rhs⟩
+  rfl
+
+theorem getRecursorRule_spec (r : RecursorRule) (hwf : r.wireWF) :
+    GetSpec getRecursorRule (recursorRuleBytes r) r := by
+  rcases r with ⟨fields, rhs⟩
+  let raw : RecursorRuleRaw := (⟨fields⟩, rhs)
+  have hraw : GetSpec getRecursorRuleRaw (recursorRuleRawBytes raw) raw :=
+    getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨fields⟩)
+      (ExprLaws.getExpr_spec rhs hwf)
+  rw [getRecursorRule_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildRecursorRule
+  simpa [getRecursorRuleRaw, raw, recursorRuleBytes,
+    recursorRuleRawBytes, buildRecursorRule, pairBytes] using hmapped
+
+theorem getRecursorRule_canonical :
+    GetCanonical getRecursorRule recursorRuleBytes := by
+  have hraw : GetCanonical getRecursorRuleRaw recursorRuleRawBytes :=
+    getPair_canonical _ _ _ _ getTag0_canonical ExprLaws.getExpr_canonical
+  rw [getRecursorRule_eq]
+  exact GetCanonical.map hraw buildRecursorRule recursorRuleBytes
+    recursorRuleRawBytes_build
+
+def AxiomRaw := Bool × (Tag0 × Expr)
+
+def getAxiomRaw : GetM AxiomRaw :=
+  getPairM (getStrictBool "getAxiom") (getPairM getTag0 getExpr)
+
+def axiomRawBytes : AxiomRaw → ByteArray :=
+  pairBytes boolBytes (pairBytes tag0Bytes exprBytes)
+
+def buildAxiom (raw : AxiomRaw) : Axiom :=
+  ⟨raw.1, raw.2.1.size, raw.2.2⟩
+
+theorem getAxiom_eq : getAxiom = buildAxiom <$> getAxiomRaw := by
+  rfl
+
+theorem axiomRawBytes_build (raw : AxiomRaw) :
+    axiomBytes (buildAxiom raw) = axiomRawBytes raw := by
+  rcases raw with ⟨isUnsafe, lvls, typ⟩
+  simp [axiomBytes, axiomRawBytes, buildAxiom, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getAxiom_spec (a : Axiom) (hwf : a.wireWF) :
+    GetSpec getAxiom (axiomBytes a) a := by
+  rcases a with ⟨isUnsafe, lvls, typ⟩
+  let raw : AxiomRaw := (isUnsafe, (⟨lvls⟩, typ))
+  have hraw : GetSpec getAxiomRaw (axiomRawBytes raw) raw := by
+    apply getPair_spec
+    · exact getStrictBool_spec "getAxiom" isUnsafe
+    · exact getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨lvls⟩)
+        (ExprLaws.getExpr_spec typ hwf)
+  rw [getAxiom_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildAxiom
+  simpa [getAxiomRaw, raw, axiomBytes, axiomRawBytes,
+    buildAxiom, pairBytes, ByteArray.append_assoc] using hmapped
+
+theorem getAxiom_canonical : GetCanonical getAxiom axiomBytes := by
+  have hraw : GetCanonical getAxiomRaw axiomRawBytes := by
+    apply getPair_canonical
+    · exact getStrictBool_canonical "getAxiom"
+    · exact getPair_canonical _ _ _ _ getTag0_canonical
+        ExprLaws.getExpr_canonical
+  rw [getAxiom_eq]
+  exact GetCanonical.map hraw buildAxiom axiomBytes axiomRawBytes_build
+
+def QuotientRaw := QuotKind × (Tag0 × Expr)
+
+def getQuotientRaw : GetM QuotientRaw :=
+  getPairM getQuotKind (getPairM getTag0 getExpr)
+
+def quotientRawBytes : QuotientRaw → ByteArray :=
+  pairBytes (fun kind => u8Bytes kind.toBits)
+    (pairBytes tag0Bytes exprBytes)
+
+def buildQuotient (raw : QuotientRaw) : Quotient :=
+  ⟨raw.1, raw.2.1.size, raw.2.2⟩
+
+theorem getQuotient_eq :
+    getQuotient = buildQuotient <$> getQuotientRaw := by
+  rfl
+
+theorem quotientRawBytes_build (raw : QuotientRaw) :
+    quotientBytes (buildQuotient raw) = quotientRawBytes raw := by
+  rcases raw with ⟨kind, lvls, typ⟩
+  simp [quotientBytes, quotientRawBytes, buildQuotient, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getQuotient_spec (q : Quotient) (hwf : q.wireWF) :
+    GetSpec getQuotient (quotientBytes q) q := by
+  rcases q with ⟨kind, lvls, typ⟩
+  let raw : QuotientRaw := (kind, (⟨lvls⟩, typ))
+  have hraw : GetSpec getQuotientRaw (quotientRawBytes raw) raw := by
+    apply getPair_spec
+    · exact getQuotKind_spec kind
+    · exact getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨lvls⟩)
+        (ExprLaws.getExpr_spec typ hwf)
+  rw [getQuotient_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildQuotient
+  simpa [getQuotientRaw, raw, quotientBytes,
+    quotientRawBytes, buildQuotient, pairBytes,
+    ByteArray.append_assoc] using hmapped
+
+theorem getQuotient_canonical : GetCanonical getQuotient quotientBytes := by
+  have hraw : GetCanonical getQuotientRaw quotientRawBytes := by
+    apply getPair_canonical
+    · exact getQuotKind_canonical
+    · exact getPair_canonical _ _ _ _ getTag0_canonical
+        ExprLaws.getExpr_canonical
+  rw [getQuotient_eq]
+  exact GetCanonical.map hraw buildQuotient quotientBytes
+    quotientRawBytes_build
+
+def ConstructorRaw :=
+  Bool × (Tag0 × (Tag0 × (Tag0 × (Tag0 × Expr))))
+
+def getConstructorRaw : GetM ConstructorRaw :=
+  getPairM (getStrictBool "getConstructor")
+    (getPairM getTag0
+      (getPairM getTag0 (getPairM getTag0 (getPairM getTag0 getExpr))))
+
+def constructorRawBytes : ConstructorRaw → ByteArray :=
+  pairBytes boolBytes
+    (pairBytes tag0Bytes
+      (pairBytes tag0Bytes
+        (pairBytes tag0Bytes (pairBytes tag0Bytes exprBytes))))
+
+def buildConstructor (raw : ConstructorRaw) : Constructor :=
+  ⟨raw.1, raw.2.1.size, raw.2.2.1.size, raw.2.2.2.1.size,
+    raw.2.2.2.2.1.size, raw.2.2.2.2.2⟩
+
+theorem getConstructor_eq :
+    getConstructor = buildConstructor <$> getConstructorRaw := by
+  rfl
+
+theorem constructorRawBytes_build (raw : ConstructorRaw) :
+    constructorBytes (buildConstructor raw) = constructorRawBytes raw := by
+  rcases raw with ⟨isUnsafe, lvls, cidx, params, fields, typ⟩
+  simp [constructorBytes, constructorRawBytes, buildConstructor, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getConstructor_spec (c : Constructor) (hwf : c.wireWF) :
+    GetSpec getConstructor (constructorBytes c) c := by
+  rcases c with ⟨isUnsafe, lvls, cidx, params, fields, typ⟩
+  let raw : ConstructorRaw :=
+    (isUnsafe, (⟨lvls⟩, (⟨cidx⟩, (⟨params⟩, (⟨fields⟩, typ)))))
+  have hraw : GetSpec getConstructorRaw (constructorRawBytes raw) raw := by
+    apply getPair_spec
+    · exact getStrictBool_spec "getConstructor" isUnsafe
+    · apply getPair_spec
+      · exact getTag0_encoded_spec ⟨lvls⟩
+      · apply getPair_spec
+        · exact getTag0_encoded_spec ⟨cidx⟩
+        · apply getPair_spec
+          · exact getTag0_encoded_spec ⟨params⟩
+          · exact getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨fields⟩)
+              (ExprLaws.getExpr_spec typ hwf)
+  rw [getConstructor_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildConstructor
+  simpa [raw, constructorBytes, constructorRawBytes, buildConstructor,
+    pairBytes, ByteArray.append_assoc] using hmapped
+
+theorem getConstructor_canonical :
+    GetCanonical getConstructor constructorBytes := by
+  have hraw : GetCanonical getConstructorRaw constructorRawBytes := by
+    apply getPair_canonical
+    · exact getStrictBool_canonical "getConstructor"
+    · apply getPair_canonical
+      · exact getTag0_canonical
+      · apply getPair_canonical
+        · exact getTag0_canonical
+        · apply getPair_canonical
+          · exact getTag0_canonical
+          · exact getPair_canonical _ _ _ _ getTag0_canonical
+              ExprLaws.getExpr_canonical
+  rw [getConstructor_eq]
+  exact GetCanonical.map hraw buildConstructor constructorBytes
+    constructorRawBytes_build
+
+def OneProjRaw := Tag0 × Address
+
+def getOneProjRaw : GetM OneProjRaw :=
+  getPairM getTag0 Serialize.get
+
+def oneProjRawBytes : OneProjRaw → ByteArray :=
+  pairBytes tag0Bytes (fun address => address.hash)
+
+theorem getOneProjRaw_spec (idx : UInt64) (block : Address) :
+    GetSpec getOneProjRaw (oneProjRawBytes (⟨idx⟩, block)) (⟨idx⟩, block) :=
+  getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨idx⟩) (Address.get_spec block)
+
+theorem getOneProjRaw_canonical :
+    GetCanonical getOneProjRaw oneProjRawBytes :=
+  getPair_canonical _ _ _ _ getTag0_canonical getAddress_canonical
+
+def buildInductiveProj (raw : OneProjRaw) : InductiveProj :=
+  ⟨raw.1.size, raw.2⟩
+
+def buildRecursorProj (raw : OneProjRaw) : RecursorProj :=
+  ⟨raw.1.size, raw.2⟩
+
+def buildDefinitionProj (raw : OneProjRaw) : DefinitionProj :=
+  ⟨raw.1.size, raw.2⟩
+
+theorem getInductiveProj_eq :
+    getInductiveProj = buildInductiveProj <$> getOneProjRaw := by rfl
+
+theorem getRecursorProj_eq :
+    getRecursorProj = buildRecursorProj <$> getOneProjRaw := by rfl
+
+theorem getDefinitionProj_eq :
+    getDefinitionProj = buildDefinitionProj <$> getOneProjRaw := by rfl
+
+theorem inductiveProjRawBytes_build (raw : OneProjRaw) :
+    inductiveProjBytes (buildInductiveProj raw) = oneProjRawBytes raw := by
+  rcases raw with ⟨idx, block⟩
+  rfl
+
+theorem recursorProjRawBytes_build (raw : OneProjRaw) :
+    recursorProjBytes (buildRecursorProj raw) = oneProjRawBytes raw := by
+  rcases raw with ⟨idx, block⟩
+  rfl
+
+theorem definitionProjRawBytes_build (raw : OneProjRaw) :
+    definitionProjBytes (buildDefinitionProj raw) = oneProjRawBytes raw := by
+  rcases raw with ⟨idx, block⟩
+  rfl
+
+theorem getInductiveProj_spec (p : InductiveProj) :
+    GetSpec getInductiveProj (inductiveProjBytes p) p := by
+  rcases p with ⟨idx, block⟩
+  rw [getInductiveProj_eq]
+  have hmapped := ExprLaws.GetSpec.map (getOneProjRaw_spec idx block)
+    buildInductiveProj
+  exact hmapped
+
+theorem getRecursorProj_spec (p : RecursorProj) :
+    GetSpec getRecursorProj (recursorProjBytes p) p := by
+  rcases p with ⟨idx, block⟩
+  rw [getRecursorProj_eq]
+  exact ExprLaws.GetSpec.map (getOneProjRaw_spec idx block) buildRecursorProj
+
+theorem getDefinitionProj_spec (p : DefinitionProj) :
+    GetSpec getDefinitionProj (definitionProjBytes p) p := by
+  rcases p with ⟨idx, block⟩
+  rw [getDefinitionProj_eq]
+  exact ExprLaws.GetSpec.map (getOneProjRaw_spec idx block)
+    buildDefinitionProj
+
+theorem getInductiveProj_canonical :
+    GetCanonical getInductiveProj inductiveProjBytes := by
+  rw [getInductiveProj_eq]
+  exact GetCanonical.map getOneProjRaw_canonical buildInductiveProj
+    inductiveProjBytes inductiveProjRawBytes_build
+
+theorem getRecursorProj_canonical :
+    GetCanonical getRecursorProj recursorProjBytes := by
+  rw [getRecursorProj_eq]
+  exact GetCanonical.map getOneProjRaw_canonical buildRecursorProj
+    recursorProjBytes recursorProjRawBytes_build
+
+theorem getDefinitionProj_canonical :
+    GetCanonical getDefinitionProj definitionProjBytes := by
+  rw [getDefinitionProj_eq]
+  exact GetCanonical.map getOneProjRaw_canonical buildDefinitionProj
+    definitionProjBytes definitionProjRawBytes_build
+
+def ConstructorProjRaw := Tag0 × (Tag0 × Address)
+
+def getConstructorProjRaw : GetM ConstructorProjRaw :=
+  getPairM getTag0 (getPairM getTag0 Serialize.get)
+
+def constructorProjRawBytes : ConstructorProjRaw → ByteArray :=
+  pairBytes tag0Bytes
+    (pairBytes tag0Bytes (fun address => address.hash))
+
+def buildConstructorProj (raw : ConstructorProjRaw) : ConstructorProj :=
+  ⟨raw.1.size, raw.2.1.size, raw.2.2⟩
+
+theorem getConstructorProj_eq :
+    getConstructorProj = buildConstructorProj <$> getConstructorProjRaw := by
+  rfl
+
+theorem constructorProjRawBytes_build (raw : ConstructorProjRaw) :
+    constructorProjBytes (buildConstructorProj raw) =
+      constructorProjRawBytes raw := by
+  rcases raw with ⟨idx, cidx, block⟩
+  simp [constructorProjBytes, constructorProjRawBytes, buildConstructorProj,
+    pairBytes, ByteArray.append_assoc]
+
+theorem getConstructorProj_spec (p : ConstructorProj) :
+    GetSpec getConstructorProj (constructorProjBytes p) p := by
+  rcases p with ⟨idx, cidx, block⟩
+  let raw : ConstructorProjRaw := (⟨idx⟩, (⟨cidx⟩, block))
+  have hraw : GetSpec getConstructorProjRaw
+      (constructorProjRawBytes raw) raw := by
+    exact getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨idx⟩)
+      (getPair_spec _ _ _ _ (getTag0_encoded_spec ⟨cidx⟩)
+        (Address.get_spec block))
+  rw [getConstructorProj_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildConstructorProj
+  simpa [raw, constructorProjBytes, constructorProjRawBytes,
+    buildConstructorProj, pairBytes, ByteArray.append_assoc] using hmapped
+
+theorem getConstructorProj_canonical :
+    GetCanonical getConstructorProj constructorProjBytes := by
+  have hraw : GetCanonical getConstructorProjRaw constructorProjRawBytes :=
+    getPair_canonical _ _ _ _ getTag0_canonical
+      (getPair_canonical _ _ _ _ getTag0_canonical getAddress_canonical)
+  rw [getConstructorProj_eq]
+  exact GetCanonical.map hraw buildConstructorProj constructorProjBytes
+    constructorProjRawBytes_build
+
+def RecursorRaw :=
+  (Bool × Bool) ×
+    (Tag0 × (Tag0 × (Tag0 × (Tag0 × (Tag0 × (Expr × Array RecursorRule))))))
+
+def getRecursorRaw : GetM RecursorRaw :=
+  getPairM getRecursorMode
+    (getPairM getTag0
+      (getPairM getTag0
+        (getPairM getTag0
+          (getPairM getTag0
+            (getPairM getTag0
+              (getPairM getExpr (getCountedArray getRecursorRule)))))))
+
+def recursorRawBytes : RecursorRaw → ByteArray :=
+  pairBytes
+    (fun mode => u8Bytes (recursorModeByte mode.1 mode.2))
+    (pairBytes tag0Bytes
+      (pairBytes tag0Bytes
+        (pairBytes tag0Bytes
+          (pairBytes tag0Bytes
+            (pairBytes tag0Bytes
+              (pairBytes exprBytes
+                (countedArrayBytes recursorRuleBytes)))))))
+
+def buildRecursor (raw : RecursorRaw) : Recursor :=
+  ⟨raw.1.1, raw.1.2, raw.2.1.size, raw.2.2.1.size,
+    raw.2.2.2.1.size, raw.2.2.2.2.1.size, raw.2.2.2.2.2.1.size,
+    raw.2.2.2.2.2.2.1, raw.2.2.2.2.2.2.2⟩
+
+theorem getRecursor_eq : getRecursor = buildRecursor <$> getRecursorRaw := by
+  rfl
+
+theorem recursorRawBytes_build (raw : RecursorRaw) :
+    recursorBytes (buildRecursor raw) = recursorRawBytes raw := by
+  rcases raw with ⟨⟨k, isUnsafe⟩, lvls, params, indices, motives, minors,
+    typ, rules⟩
+  simp [recursorBytes, recursorRawBytes, buildRecursor, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getRecursor_spec (r : Recursor) (hwf : r.wireWF) :
+    GetSpec getRecursor (recursorBytes r) r := by
+  rcases r with
+    ⟨k, isUnsafe, lvls, params, indices, motives, minors, typ, rules⟩
+  rcases hwf with ⟨htyp, hrulesSize, hrules⟩
+  have hrulesList : ∀ rule ∈ rules.toList, rule.wireWF := by
+    intro rule hrule
+    exact hrules rule (by simpa using hrule)
+  let raw : RecursorRaw :=
+    ((k, isUnsafe),
+      (⟨lvls⟩, (⟨params⟩, (⟨indices⟩, (⟨motives⟩, (⟨minors⟩,
+        (typ, rules)))))))
+  have hrulesSpec : GetSpec (getCountedArray getRecursorRule)
+      (countedArrayBytes recursorRuleBytes rules) rules :=
+    getCountedArray_spec_of getRecursorRule recursorRuleBytes
+      RecursorRule.wireWF getRecursorRule_spec rules hrulesSize hrulesList
+  have hraw : GetSpec getRecursorRaw (recursorRawBytes raw) raw := by
+    apply getPair_spec
+    · exact getRecursorMode_spec k isUnsafe
+    · apply getPair_spec
+      · exact getTag0_encoded_spec ⟨lvls⟩
+      · apply getPair_spec
+        · exact getTag0_encoded_spec ⟨params⟩
+        · apply getPair_spec
+          · exact getTag0_encoded_spec ⟨indices⟩
+          · apply getPair_spec
+            · exact getTag0_encoded_spec ⟨motives⟩
+            · apply getPair_spec
+              · exact getTag0_encoded_spec ⟨minors⟩
+              · exact getPair_spec _ _ _ _
+                  (ExprLaws.getExpr_spec typ htyp) hrulesSpec
+  rw [getRecursor_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildRecursor
+  simpa [raw, recursorBytes, recursorRawBytes, buildRecursor, pairBytes,
+    ByteArray.append_assoc] using hmapped
+
+theorem getRecursor_canonical : GetCanonical getRecursor recursorBytes := by
+  have hraw : GetCanonical getRecursorRaw recursorRawBytes := by
+    apply getPair_canonical
+    · exact getRecursorMode_canonical
+    · apply getPair_canonical
+      · exact getTag0_canonical
+      · apply getPair_canonical
+        · exact getTag0_canonical
+        · apply getPair_canonical
+          · exact getTag0_canonical
+          · apply getPair_canonical
+            · exact getTag0_canonical
+            · apply getPair_canonical
+              · exact getTag0_canonical
+              · exact getPair_canonical _ _ _ _
+                  ExprLaws.getExpr_canonical
+                  (getCountedArray_canonical getRecursorRule
+                    recursorRuleBytes getRecursorRule_canonical)
+  rw [getRecursor_eq]
+  exact GetCanonical.map hraw buildRecursor recursorBytes
+    recursorRawBytes_build
+
+def InductiveRaw :=
+  Bool × (Tag0 × (Tag0 × (Tag0 × (Expr × Array Constructor))))
+
+def getInductiveRaw : GetM InductiveRaw :=
+  getPairM (getStrictBool "getInductive")
+    (getPairM getTag0
+      (getPairM getTag0
+        (getPairM getTag0
+          (getPairM getExpr (getCountedArray getConstructor)))))
+
+def inductiveRawBytes : InductiveRaw → ByteArray :=
+  pairBytes boolBytes
+    (pairBytes tag0Bytes
+      (pairBytes tag0Bytes
+        (pairBytes tag0Bytes
+          (pairBytes exprBytes (countedArrayBytes constructorBytes)))))
+
+def buildInductive (raw : InductiveRaw) : Inductive :=
+  ⟨raw.1, raw.2.1.size, raw.2.2.1.size, raw.2.2.2.1.size,
+    raw.2.2.2.2.1, raw.2.2.2.2.2⟩
+
+theorem getInductive_eq :
+    getInductive = buildInductive <$> getInductiveRaw := by
+  rfl
+
+theorem inductiveRawBytes_build (raw : InductiveRaw) :
+    inductiveBytes (buildInductive raw) = inductiveRawBytes raw := by
+  rcases raw with ⟨isUnsafe, lvls, params, indices, typ, ctors⟩
+  simp [inductiveBytes, inductiveRawBytes, buildInductive, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getInductive_spec (i : Inductive) (hwf : i.wireWF) :
+    GetSpec getInductive (inductiveBytes i) i := by
+  rcases i with ⟨isUnsafe, lvls, params, indices, typ, ctors⟩
+  rcases hwf with ⟨htyp, hctorsSize, hctors⟩
+  have hctorsList : ∀ ctor ∈ ctors.toList, ctor.wireWF := by
+    intro ctor hctor
+    exact hctors ctor (by simpa using hctor)
+  let raw : InductiveRaw :=
+    (isUnsafe, (⟨lvls⟩, (⟨params⟩, (⟨indices⟩, (typ, ctors)))))
+  have hctorsSpec : GetSpec (getCountedArray getConstructor)
+      (countedArrayBytes constructorBytes ctors) ctors :=
+    getCountedArray_spec_of getConstructor constructorBytes
+      Constructor.wireWF getConstructor_spec ctors hctorsSize hctorsList
+  have hraw : GetSpec getInductiveRaw (inductiveRawBytes raw) raw := by
+    apply getPair_spec
+    · exact getStrictBool_spec "getInductive" isUnsafe
+    · apply getPair_spec
+      · exact getTag0_encoded_spec ⟨lvls⟩
+      · apply getPair_spec
+        · exact getTag0_encoded_spec ⟨params⟩
+        · apply getPair_spec
+          · exact getTag0_encoded_spec ⟨indices⟩
+          · exact getPair_spec _ _ _ _
+              (ExprLaws.getExpr_spec typ htyp) hctorsSpec
+  rw [getInductive_eq]
+  have hmapped := ExprLaws.GetSpec.map hraw buildInductive
+  simpa [raw, inductiveBytes, inductiveRawBytes, buildInductive, pairBytes,
+    ByteArray.append_assoc] using hmapped
+
+theorem getInductive_canonical : GetCanonical getInductive inductiveBytes := by
+  have hraw : GetCanonical getInductiveRaw inductiveRawBytes := by
+    apply getPair_canonical
+    · exact getStrictBool_canonical "getInductive"
+    · apply getPair_canonical
+      · exact getTag0_canonical
+      · apply getPair_canonical
+        · exact getTag0_canonical
+        · apply getPair_canonical
+          · exact getTag0_canonical
+          · exact getPair_canonical _ _ _ _
+              ExprLaws.getExpr_canonical
+              (getCountedArray_canonical getConstructor constructorBytes
+                getConstructor_canonical)
+  rw [getInductive_eq]
+  exact GetCanonical.map hraw buildInductive inductiveBytes
+    inductiveRawBytes_build
+
+theorem getMutConstTag_spec (m : MutConst) (hwf : m.wireWF) :
+    GetSpec (getMutConstTag (mutConstTag m)) (mutConstPayloadBytes m) m := by
+  cases m with
+  | defn d =>
+    simpa [getMutConstTag, mutConstTag, mutConstPayloadBytes] using
+      ExprLaws.GetSpec.map (getDefinition_spec d hwf) MutConst.defn
+  | indc i =>
+    simpa [getMutConstTag, mutConstTag, mutConstPayloadBytes] using
+      ExprLaws.GetSpec.map (getInductive_spec i hwf) MutConst.indc
+  | recr r =>
+    simpa [getMutConstTag, mutConstTag, mutConstPayloadBytes] using
+      ExprLaws.GetSpec.map (getRecursor_spec r hwf) MutConst.recr
+
+theorem getMutConst_spec (m : MutConst) (hwf : m.wireWF) :
+    GetSpec getMutConst (mutConstBytes m) m := by
+  let afterTag : UInt8 → GetM MutConst := getMutConstTag
+  have htotal := GetSpec.bind (next := afterTag)
+    (getU8_spec (mutConstTag m)) (getMutConstTag_spec m hwf)
+  simpa [getMutConst, mutConstBytes, afterTag] using htotal
+
+theorem getMutConstTag_canonical (tag : UInt8) :
+    GetCanonical (getMutConstTag tag) mutConstPayloadBytes := by
+  by_cases h0 : tag = 0
+  · subst tag
+    simpa [getMutConstTag, mutConstPayloadBytes] using
+      GetCanonical.map getDefinition_canonical MutConst.defn
+        mutConstPayloadBytes (by intro d; rfl)
+  by_cases h1 : tag = 1
+  · subst tag
+    simpa [getMutConstTag, mutConstPayloadBytes] using
+      GetCanonical.map getInductive_canonical MutConst.indc
+        mutConstPayloadBytes (by intro i; rfl)
+  by_cases h2 : tag = 2
+  · subst tag
+    simpa [getMutConstTag, mutConstPayloadBytes] using
+      GetCanonical.map getRecursor_canonical MutConst.recr
+        mutConstPayloadBytes (by intro r; rfl)
+  · intro pre rest value st' h
+    simp [getMutConstTag] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getMutConstTag_success_tag (tag : UInt8) :
+    ∀ (initial : GetState) {value : MutConst} {st' : GetState},
+      (getMutConstTag tag).run initial = .ok (value, st') →
+      tag = mutConstTag value := by
+  intro initial value st' h
+  by_cases h0 : tag = 0
+  · subst tag
+    simp [getMutConstTag] at h
+    cases hd : getDefinition.run initial with
+    | error err => rw [hd] at h; contradiction
+    | ok result =>
+      rcases result with ⟨d, after⟩
+      rw [hd] at h
+      cases h
+      rfl
+  by_cases h1 : tag = 1
+  · subst tag
+    simp [getMutConstTag] at h
+    cases hi : getInductive.run initial with
+    | error err => rw [hi] at h; contradiction
+    | ok result =>
+      rcases result with ⟨i, after⟩
+      rw [hi] at h
+      cases h
+      rfl
+  by_cases h2 : tag = 2
+  · subst tag
+    simp [getMutConstTag] at h
+    cases hr : getRecursor.run initial with
+    | error err => rw [hr] at h; contradiction
+    | ok result =>
+      rcases result with ⟨r, after⟩
+      rw [hr] at h
+      cases h
+      rfl
+  · simp [getMutConstTag] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getMutConst_canonical : GetCanonical getMutConst mutConstBytes := by
+  intro pre rest value st' h
+  change (getU8 >>= getMutConstTag).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨tag, afterTagBytes, hrestTag, hafterTag⟩ :=
+    ExprLaws.GetCanonical.bind_inv getU8_canonical pre rest h
+  let tagPre := pre ++ u8Bytes tag
+  have hafterTag' :
+      (getMutConstTag tag).run ⟨tagPre ++ afterTagBytes, tagPre.size⟩ =
+        .ok (value, st') := by
+    simpa [tagPre] using hafterTag
+  obtain ⟨suffix, hrestPayload, hstate⟩ :=
+    getMutConstTag_canonical tag tagPre afterTagBytes hafterTag'
+  have htag := getMutConstTag_success_tag tag
+    ⟨tagPre ++ afterTagBytes, tagPre.size⟩ hafterTag'
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestTag, hrestPayload, htag]
+    simp [mutConstBytes, ByteArray.append_assoc]
+  · simpa [tagPre, hrestTag, hrestPayload, htag, mutConstBytes,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc] using hstate
+
+theorem getConstantInfoTag_spec (info : ConstantInfo) (hwf : info.wireWF) :
+    GetSpec (getConstantInfoTag (constantInfoTag info))
+      (constantInfoPayloadBytes info) info := by
+  cases info with
+  | defn d =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_DEFN] using
+      ExprLaws.GetSpec.map (getDefinition_spec d hwf) ConstantInfo.defn
+  | recr r =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_RECR] using
+      ExprLaws.GetSpec.map (getRecursor_spec r hwf) ConstantInfo.recr
+  | axio a =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_AXIO] using
+      ExprLaws.GetSpec.map (getAxiom_spec a hwf) ConstantInfo.axio
+  | quot q =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_QUOT] using
+      ExprLaws.GetSpec.map (getQuotient_spec q hwf) ConstantInfo.quot
+  | cPrj p =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_CPRJ] using
+      ExprLaws.GetSpec.map (getConstructorProj_spec p) ConstantInfo.cPrj
+  | rPrj p =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_RPRJ] using
+      ExprLaws.GetSpec.map (getRecursorProj_spec p) ConstantInfo.rPrj
+  | iPrj p =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_IPRJ] using
+      ExprLaws.GetSpec.map (getInductiveProj_spec p) ConstantInfo.iPrj
+  | dPrj p =>
+    simpa [getConstantInfoTag, getConstantInfoVariant, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, ConstantInfo.CONST_DPRJ] using
+      ExprLaws.GetSpec.map (getDefinitionProj_spec p) ConstantInfo.dPrj
+  | muts members =>
+    rcases hwf with ⟨hsize, hmembers⟩
+    have hround : members.size.toUInt64.toNat = members.size :=
+      UInt64.toNat_ofNat_of_lt hsize
+    have hmembersList : ∀ member ∈ members.toList, member.wireWF := by
+      intro member hmember
+      exact hmembers member (by simpa using hmember)
+    have harray := getArrayN_spec_of getMutConst mutConstBytes
+      MutConst.wireWF getMutConst_spec members hmembersList
+    have hmapped := ExprLaws.GetSpec.map harray ConstantInfo.muts
+    simpa [getConstantInfoTag, constantInfoTag, constantInfoPayloadBytes,
+      Constant.FLAG, Constant.FLAG_MUTS, hround] using hmapped
+
+theorem getConstantInfo_spec (info : ConstantInfo) (hwf : info.wireWF) :
+    GetSpec getConstantInfo (constantInfoBytes info) info := by
+  let afterTag : Tag4 → GetM ConstantInfo := getConstantInfoTag
+  have htotal := GetSpec.bind (next := afterTag)
+    (getTag4_encoded_spec (constantInfoTag info) (by
+      cases info <;> simp [constantInfoTag, Constant.FLAG, Constant.FLAG_MUTS]))
+    (getConstantInfoTag_spec info hwf)
+  simpa [getConstantInfo, constantInfoBytes, afterTag] using htotal
+
+theorem getConstantInfoTag_canonical (tag : Tag4) :
+    GetCanonical (getConstantInfoTag tag) constantInfoPayloadBytes := by
+  rcases tag with ⟨flag, size⟩
+  by_cases hm : flag = Constant.FLAG_MUTS
+  · subst flag
+    have harray := getArrayN_canonical getMutConst mutConstBytes
+      getMutConst_canonical size.toNat
+    simpa [getConstantInfoTag, Constant.FLAG_MUTS,
+      constantInfoPayloadBytes] using
+        GetCanonical.map harray ConstantInfo.muts
+          constantInfoPayloadBytes (by intro members; rfl)
+  by_cases hc : flag = Constant.FLAG
+  · subst flag
+    by_cases h0 : size = ConstantInfo.CONST_DEFN
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_DEFN, constantInfoPayloadBytes] using
+          GetCanonical.map getDefinition_canonical ConstantInfo.defn
+            constantInfoPayloadBytes (by intro d; rfl)
+    by_cases h1 : size = ConstantInfo.CONST_RECR
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_RECR, constantInfoPayloadBytes] using
+          GetCanonical.map getRecursor_canonical ConstantInfo.recr
+            constantInfoPayloadBytes (by intro r; rfl)
+    by_cases h2 : size = ConstantInfo.CONST_AXIO
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_AXIO, constantInfoPayloadBytes] using
+          GetCanonical.map getAxiom_canonical ConstantInfo.axio
+            constantInfoPayloadBytes (by intro a; rfl)
+    by_cases h3 : size = ConstantInfo.CONST_QUOT
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_QUOT, constantInfoPayloadBytes] using
+          GetCanonical.map getQuotient_canonical ConstantInfo.quot
+            constantInfoPayloadBytes (by intro q; rfl)
+    by_cases h4 : size = ConstantInfo.CONST_CPRJ
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_CPRJ, constantInfoPayloadBytes] using
+          GetCanonical.map getConstructorProj_canonical ConstantInfo.cPrj
+            constantInfoPayloadBytes (by intro p; rfl)
+    by_cases h5 : size = ConstantInfo.CONST_RPRJ
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_RPRJ, constantInfoPayloadBytes] using
+          GetCanonical.map getRecursorProj_canonical ConstantInfo.rPrj
+            constantInfoPayloadBytes (by intro p; rfl)
+    by_cases h6 : size = ConstantInfo.CONST_IPRJ
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_IPRJ, constantInfoPayloadBytes] using
+          GetCanonical.map getInductiveProj_canonical ConstantInfo.iPrj
+            constantInfoPayloadBytes (by intro p; rfl)
+    by_cases h7 : size = ConstantInfo.CONST_DPRJ
+    · subst size
+      simpa [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_DPRJ, constantInfoPayloadBytes] using
+          GetCanonical.map getDefinitionProj_canonical ConstantInfo.dPrj
+            constantInfoPayloadBytes (by intro p; rfl)
+    · intro pre rest value st' h
+      have hn0 : size ≠ 0 := by simpa using h0
+      have hn1 : size ≠ 1 := by simpa using h1
+      have hn2 : size ≠ 2 := by simpa using h2
+      have hn3 : size ≠ 3 := by simpa using h3
+      have hn4 : size ≠ 4 := by simpa using h4
+      have hn5 : size ≠ 5 := by simpa using h5
+      have hn6 : size ≠ 6 := by simpa using h6
+      have hn7 : size ≠ 7 := by simpa using h7
+      simp [getConstantInfoTag, getConstantInfoVariant, Constant.FLAG, Constant.FLAG_MUTS,
+        ConstantInfo.CONST_DEFN, ConstantInfo.CONST_RECR,
+        ConstantInfo.CONST_AXIO, ConstantInfo.CONST_QUOT,
+        ConstantInfo.CONST_CPRJ, ConstantInfo.CONST_RPRJ,
+        ConstantInfo.CONST_IPRJ, ConstantInfo.CONST_DPRJ,
+        hn0, hn1, hn2, hn3, hn4, hn5, hn6, hn7] at h
+      change (Except.error _) = Except.ok (value, st') at h
+      contradiction
+  · intro pre rest value st' h
+    have hnm : flag ≠ 12 := by simpa using hm
+    have hnc : flag ≠ 13 := by simpa using hc
+    simp [getConstantInfoTag,
+      Constant.FLAG, Constant.FLAG_MUTS, hnm, hnc] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem map_success_inv (get : GetM α) (f : α → β)
+    (initial : GetState) {value : β} {st' : GetState}
+    (h : (f <$> get).run initial = .ok (value, st')) :
+    ∃ source afterSource,
+      get.run initial = .ok (source, afterSource) ∧
+      value = f source ∧ st' = afterSource := by
+  change (get >>= fun source => pure (f source)).run initial =
+    .ok (value, st') at h
+  simp only [StateT.run_bind] at h
+  cases hg : get.run initial with
+  | error err => rw [hg] at h; contradiction
+  | ok sourceState =>
+    rcases sourceState with ⟨source, afterSource⟩
+    rw [hg] at h
+    simp at h
+    cases h
+    exact ⟨source, afterSource, rfl, rfl, rfl⟩
+
+theorem map_success_exists (get : GetM α) (f : α → β)
+    (initial : GetState) {value : β} {st' : GetState}
+    (h : (f <$> get).run initial = .ok (value, st')) :
+    ∃ source, value = f source := by
+  obtain ⟨source, afterSource, hsource, hvalue, hstate⟩ :=
+    map_success_inv get f initial h
+  exact ⟨source, hvalue⟩
+
+theorem getConstantInfoVariant_success_tag (variant : UInt64) :
+    ∀ (initial : GetState) {value : ConstantInfo} {st' : GetState},
+      (getConstantInfoVariant variant).run initial = .ok (value, st') →
+      ⟨Constant.FLAG, variant⟩ = constantInfoTag value := by
+  intro initial value st' h
+  by_cases h0 : variant = 0
+  · subst variant
+    have h' : (ConstantInfo.defn <$> getDefinition).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨d, rfl⟩ := map_success_exists getDefinition ConstantInfo.defn
+      initial h'
+    rfl
+  by_cases h1 : variant = 1
+  · subst variant
+    have h' : (ConstantInfo.recr <$> getRecursor).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨r, rfl⟩ := map_success_exists getRecursor ConstantInfo.recr
+      initial h'
+    rfl
+  by_cases h2 : variant = 2
+  · subst variant
+    have h' : (ConstantInfo.axio <$> getAxiom).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨a, rfl⟩ := map_success_exists getAxiom ConstantInfo.axio
+      initial h'
+    rfl
+  by_cases h3 : variant = 3
+  · subst variant
+    have h' : (ConstantInfo.quot <$> getQuotient).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨q, rfl⟩ := map_success_exists getQuotient ConstantInfo.quot
+      initial h'
+    rfl
+  by_cases h4 : variant = 4
+  · subst variant
+    have h' : (ConstantInfo.cPrj <$> getConstructorProj).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨p, rfl⟩ := map_success_exists getConstructorProj ConstantInfo.cPrj
+      initial h'
+    rfl
+  by_cases h5 : variant = 5
+  · subst variant
+    have h' : (ConstantInfo.rPrj <$> getRecursorProj).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨p, rfl⟩ := map_success_exists getRecursorProj ConstantInfo.rPrj
+      initial h'
+    rfl
+  by_cases h6 : variant = 6
+  · subst variant
+    have h' : (ConstantInfo.iPrj <$> getInductiveProj).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨p, rfl⟩ := map_success_exists getInductiveProj ConstantInfo.iPrj
+      initial h'
+    rfl
+  by_cases h7 : variant = 7
+  · subst variant
+    have h' : (ConstantInfo.dPrj <$> getDefinitionProj).run initial =
+        .ok (value, st') := by simpa [getConstantInfoVariant] using h
+    obtain ⟨p, rfl⟩ := map_success_exists getDefinitionProj ConstantInfo.dPrj
+      initial h'
+    rfl
+  · have hn0 : variant ≠ 0 := h0
+    have hn1 : variant ≠ 1 := h1
+    have hn2 : variant ≠ 2 := h2
+    have hn3 : variant ≠ 3 := h3
+    have hn4 : variant ≠ 4 := h4
+    have hn5 : variant ≠ 5 := h5
+    have hn6 : variant ≠ 6 := h6
+    have hn7 : variant ≠ 7 := h7
+    simp [getConstantInfoVariant, hn0, hn1, hn2, hn3,
+      hn4, hn5, hn6, hn7] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getConstantInfoTag_success_tag (tag : Tag4) :
+    ∀ (initial : GetState) {value : ConstantInfo} {st' : GetState},
+      (getConstantInfoTag tag).run initial = .ok (value, st') →
+      tag = constantInfoTag value := by
+  rcases tag with ⟨flag, size⟩
+  intro initial value st' h
+  by_cases hm : flag = Constant.FLAG_MUTS
+  · subst flag
+    have h' : (ConstantInfo.muts <$> getArrayN getMutConst size.toNat).run
+        initial = .ok (value, st') := by
+      simpa [getConstantInfoTag] using h
+    obtain ⟨members, afterMembers, ha, hvalue, hstate⟩ :=
+      map_success_inv (getArrayN getMutConst size.toNat)
+        ConstantInfo.muts initial h'
+    subst value
+    have hsize := getArrayN_success_size getMutConst size.toNat initial ha
+    have hcount : members.size.toUInt64 = size := by
+      rw [hsize]
+      exact UInt64.ofNat_toNat
+    simp [constantInfoTag, hcount]
+  by_cases hc : flag = Constant.FLAG
+  · subst flag
+    have h' : (getConstantInfoVariant size).run initial =
+        .ok (value, st') := by simpa [getConstantInfoTag] using h
+    exact getConstantInfoVariant_success_tag size initial h'
+  · have hnm : flag ≠ 12 := by simpa using hm
+    have hnc : flag ≠ 13 := by simpa using hc
+    simp [getConstantInfoTag, hnm, hnc] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getConstantInfo_canonical :
+    GetCanonical getConstantInfo constantInfoBytes := by
+  intro pre rest value st' h
+  change (getTag4 >>= getConstantInfoTag).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨tag, afterTagBytes, hrestTag, hafterTag⟩ :=
+    ExprLaws.GetCanonical.bind_inv getTag4_canonical pre rest h
+  let tagPre := pre ++ tag4Bytes tag
+  have hafterTag' :
+      (getConstantInfoTag tag).run
+        ⟨tagPre ++ afterTagBytes, tagPre.size⟩ = .ok (value, st') := by
+    simpa [tagPre] using hafterTag
+  obtain ⟨suffix, hrestPayload, hstate⟩ :=
+    getConstantInfoTag_canonical tag tagPre afterTagBytes hafterTag'
+  have htag := getConstantInfoTag_success_tag tag
+    ⟨tagPre ++ afterTagBytes, tagPre.size⟩ hafterTag'
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestTag, hrestPayload, htag]
+    simp [constantInfoBytes, ByteArray.append_assoc]
+  · simpa [tagPre, hrestTag, hrestPayload, htag, constantInfoBytes,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc] using hstate
+
+theorem canonicalLaw_of_getCanonical [Serialize α]
+    (encode : α → ByteArray)
+    (hput : ∀ value, PutSpec (Serialize.put value) (encode value))
+    (hget : GetCanonical (Serialize.get (self := inferInstance)) encode) :
+    CanonicalLaw α := by
+  intro input value h
+  change runPut (Serialize.put value) = input
+  rw [runPut_eq_of_spec (hput value)]
+  simp only [de, runGet] at h
+  cases hg : (Serialize.get (self := inferInstance) : GetM α).run
+      ⟨input, 0⟩ with
+  | error err => rw [hg] at h; contradiction
+  | ok result =>
+    rcases result with ⟨decoded, st⟩
+    rw [hg] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨suffix, hinput, hst⟩ :=
+      hget ByteArray.empty input hg
+    by_cases hfull : st.idx = st.bytes.size
+    · simp [hfull] at h
+      cases h
+      have hsize : (encode value).size = input.size := by
+        have hidx := congrArg GetState.idx hst
+        have hbytes := congrArg GetState.bytes hst
+        simp at hidx hbytes
+        rw [hfull, hbytes] at hidx
+        exact hidx.symm
+      have hsuffix : suffix = ByteArray.empty := by
+        have hsizes := congrArg ByteArray.size hinput
+        simpa [ByteArray.size_append, hsize] using hsizes
+      simpa [hsuffix] using hinput.symm
+    · simp [hfull] at h
+
+theorem checkConstantSharing_spec (info : ConstantInfo)
+    (sharing : Array Expr)
+    (hwf : Sharing.layer1WF sharing info.exprs.toArray = true) :
+    GetSpec (checkConstantSharing info sharing) ByteArray.empty () := by
+  have hlayer := (Sharing.layer1WF_iff sharing info.exprs.toArray).mp hwf
+  intro pre suffix
+  simp only [checkConstantSharing]
+  rw [hlayer.tableOk, hlayer.bodiesOk, hlayer.usedTwice]
+  simp
+  rfl
+
+theorem checkConstantSharing_canonical (info : ConstantInfo)
+    (sharing : Array Expr) :
+    GetCanonical (checkConstantSharing info sharing)
+      (fun _ => ByteArray.empty) := by
+  intro pre rest value st' h
+  simp only [checkConstantSharing] at h
+  split at h
+  · change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  · split at h
+    · change (Except.error _) = Except.ok (value, st') at h
+      contradiction
+    · split at h
+      · change (Except.error _) = Except.ok (value, st') at h
+        contradiction
+      · simp at h
+        cases h
+        exact ⟨rest, by simp, by simp⟩
+
+def refsUnivsBytes (tables : Array Address × Array Univ) : ByteArray :=
+  pairBytes (countedArrayBytes (fun address : Address => address.hash))
+    (countedArrayBytes univBytes) tables
+
+theorem getConstantRefsUnivs_spec (refs : Array Address) (univs : Array Univ)
+    (hrefsSize : refs.size < UInt64.size)
+    (hunivsSize : univs.size < UInt64.size) :
+    GetSpec getConstantRefsUnivs (refsUnivsBytes (refs, univs))
+      (refs, univs) := by
+  exact getPair_spec _ _ _ _
+    (getCountedArray_spec Serialize.get (fun address : Address => address.hash)
+      Address.get_spec refs hrefsSize)
+    (getCountedArray_spec getUniv univBytes UnivLaws.getUniv_spec
+      univs hunivsSize)
+
+theorem getConstantRefsUnivs_canonical :
+    GetCanonical getConstantRefsUnivs refsUnivsBytes := by
+  exact getPair_canonical _ _ _ _
+    (getCountedArray_canonical Serialize.get
+      (fun address : Address => address.hash) getAddress_canonical)
+    (getCountedArray_canonical getUniv univBytes UnivLaws.getUniv_canonical)
+
+def constantAfterInfoBytes
+    (tail : Array Expr × (Array Address × Array Univ)) : ByteArray :=
+  countedArrayBytes exprBytes tail.1 ++ refsUnivsBytes tail.2
+
+def constantRawBytes (raw : ConstantRaw) : ByteArray :=
+  constantInfoBytes raw.1 ++ constantAfterInfoBytes raw.2
+
+theorem getConstantRaw_eq :
+    getConstantRaw = getConstantInfo >>= fun info =>
+      (fun tail => (info, tail)) <$> getConstantAfterInfo info := by
+  rfl
+
+theorem getConstantAfterSharing_spec (info : ConstantInfo)
+    (sharing : Array Expr) (refs : Array Address) (univs : Array Univ)
+    (hsharing : Sharing.layer1WF sharing info.exprs.toArray = true)
+    (hrefsSize : refs.size < UInt64.size)
+    (hunivsSize : univs.size < UInt64.size) :
+    GetSpec (getConstantAfterSharing info sharing)
+      (refsUnivsBytes (refs, univs)) (sharing, (refs, univs)) := by
+  have hcheck := checkConstantSharing_spec info sharing hsharing
+  have htables := getConstantRefsUnivs_spec refs univs hrefsSize hunivsSize
+  let finish : Array Address × Array Univ →
+      GetM (Array Expr × (Array Address × Array Univ)) := fun tables =>
+    pure (sharing, tables)
+  have hfinish : GetSpec (finish (refs, univs)) ByteArray.empty
+      (sharing, (refs, univs)) := GetSpec.pure _
+  have htables' := GetSpec.bind (next := finish) htables hfinish
+  simp only [ByteArray.append_empty] at htables'
+  let afterCheck : Unit → GetM (Array Expr × (Array Address × Array Univ)) :=
+    fun _ => do
+      let tables ← getConstantRefsUnivs
+      return (sharing, tables)
+  have hafter : GetSpec (afterCheck ()) (refsUnivsBytes (refs, univs))
+      (sharing, (refs, univs)) := by
+    simpa [afterCheck, finish] using htables'
+  have htotal := GetSpec.bind (next := afterCheck) hcheck hafter
+  simpa [getConstantAfterSharing, afterCheck] using htotal
+
+theorem getConstantAfterInfo_spec (info : ConstantInfo)
+    (sharing : Array Expr) (refs : Array Address) (univs : Array Univ)
+    (hsharingSize : sharing.size < UInt64.size)
+    (hsharingExprs : ∀ e ∈ sharing, e.wireWF)
+    (hrefsSize : refs.size < UInt64.size)
+    (hunivsSize : univs.size < UInt64.size)
+    (hsharing : Sharing.layer1WF sharing info.exprs.toArray = true) :
+    GetSpec (getConstantAfterInfo info)
+      (constantAfterInfoBytes (sharing, (refs, univs)))
+      (sharing, (refs, univs)) := by
+  have hsharingList : ∀ e ∈ sharing.toList, e.wireWF := by
+    intro e he
+    exact hsharingExprs e (by simpa using he)
+  have hsharingSpec : GetSpec (getCountedArray getExpr)
+      (countedArrayBytes exprBytes sharing) sharing :=
+    getCountedArray_spec_of getExpr exprBytes Expr.wireWF
+      ExprLaws.getExpr_spec sharing hsharingSize hsharingList
+  have hafter := getConstantAfterSharing_spec info sharing refs univs
+    hsharing hrefsSize hunivsSize
+  let afterSharing : Array Expr →
+      GetM (Array Expr × (Array Address × Array Univ)) :=
+    getConstantAfterSharing info
+  have htotal := GetSpec.bind (next := afterSharing) hsharingSpec hafter
+  simpa [getConstantAfterInfo, constantAfterInfoBytes, afterSharing,
+    ByteArray.append_assoc] using htotal
+
+theorem getConstantRaw_spec (c : Constant) (hwf : c.wireWF)
+    (hsharing : c.sharingWF = true) :
+    GetSpec getConstantRaw
+      (constantRawBytes (c.info, (c.sharing, (c.refs, c.univs))))
+      (c.info, (c.sharing, (c.refs, c.univs))) := by
+  rcases c with ⟨info, sharing, refs, univs⟩
+  rcases hwf with
+    ⟨hinfo, hsharingSize, hsharingExprs, hrefsSize, hunivsSize⟩
+  have htail := getConstantAfterInfo_spec info sharing refs univs
+    hsharingSize hsharingExprs hrefsSize hunivsSize hsharing
+  have hfinish : GetSpec
+      ((fun tail => (info, tail)) <$> getConstantAfterInfo info)
+      (constantAfterInfoBytes (sharing, (refs, univs)))
+      (info, (sharing, (refs, univs))) := by
+    simpa using ExprLaws.GetSpec.map htail (fun tail => (info, tail))
+  have htotal := GetSpec.bind
+    (next := fun decodedInfo =>
+      (fun tail => (decodedInfo, tail)) <$> getConstantAfterInfo decodedInfo)
+    (getConstantInfo_spec info hinfo) hfinish
+  rw [getConstantRaw_eq]
+  simpa [constantRawBytes] using htotal
+
+theorem constantBytes_buildConstant (raw : ConstantRaw) :
+    constantBytes (buildConstant raw) = constantRawBytes raw := by
+  rcases raw with ⟨info, sharing, refs, univs⟩
+  simp [constantBytes, constantTablesBytes, constantRawBytes,
+    constantAfterInfoBytes, refsUnivsBytes, buildConstant, pairBytes,
+    ByteArray.append_assoc]
+
+theorem getConstant_spec (c : Constant) (hwf : c.wireWF)
+    (hsharing : c.sharingWF = true) :
+    GetSpec getConstant (constantBytes c) c := by
+  let raw : ConstantRaw := (c.info, (c.sharing, (c.refs, c.univs)))
+  have hraw := getConstantRaw_spec c hwf hsharing
+  have hmapped := ExprLaws.GetSpec.map hraw buildConstant
+  simpa [getConstant, raw, buildConstant, constantRawBytes,
+    constantBytes, constantTablesBytes, constantAfterInfoBytes,
+    refsUnivsBytes, pairBytes, ByteArray.append_assoc] using hmapped
+
+theorem getConstantAfterSharing_canonical (info : ConstantInfo)
+    (sharing : Array Expr) :
+    GetCanonical (getConstantAfterSharing info sharing)
+      (fun result => refsUnivsBytes result.2) := by
+  have htables : GetCanonical
+      ((fun tables => (sharing, tables)) <$> getConstantRefsUnivs)
+      (fun result => refsUnivsBytes result.2) := by
+    exact GetCanonical.map getConstantRefsUnivs_canonical
+      (fun tables => (sharing, tables))
+      (fun result => refsUnivsBytes result.2) (by intro tables; rfl)
+  intro pre rest result st' h
+  let afterCheck : Unit →
+      GetM (Array Expr × (Array Address × Array Univ)) :=
+    fun _ => (fun tables => (sharing, tables)) <$> getConstantRefsUnivs
+  change (checkConstantSharing info sharing >>= afterCheck).run
+    ⟨pre ++ rest, pre.size⟩ = .ok (result, st') at h
+  obtain ⟨checked, afterCheckBytes, hrestCheck, hafterCheck⟩ :=
+    ExprLaws.GetCanonical.bind_inv
+      (checkConstantSharing_canonical info sharing) pre rest h
+  have hchecked : checked = () := Subsingleton.elim _ _
+  subst checked
+  have hafterCheck' :
+      ((fun tables => (sharing, tables)) <$> getConstantRefsUnivs).run
+        ⟨(pre ++ ByteArray.empty) ++ afterCheckBytes,
+          (pre ++ ByteArray.empty).size⟩ = .ok (result, st') := by
+    simpa [afterCheck] using hafterCheck
+  obtain ⟨suffix, hrestTables, hstate⟩ :=
+    htables (pre ++ ByteArray.empty) afterCheckBytes hafterCheck'
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestCheck, hrestTables]
+    simp
+  · simpa [hrestCheck, hrestTables, ByteArray.append_assoc,
+      ByteArray.size_append, Nat.add_assoc] using hstate
+
+theorem getConstantAfterSharing_success_fst (info : ConstantInfo)
+    (sharing : Array Expr) (initial : GetState)
+    {result : Array Expr × (Array Address × Array Univ)} {st' : GetState}
+    (h : (getConstantAfterSharing info sharing).run initial =
+      .ok (result, st')) :
+    result.1 = sharing := by
+  simp only [getConstantAfterSharing, StateT.run_bind] at h
+  cases hc : (checkConstantSharing info sharing).run initial with
+  | error err => rw [hc] at h; contradiction
+  | ok checkedState =>
+    rcases checkedState with ⟨checked, afterCheck⟩
+    rw [hc] at h
+    simp only [bind, Except.bind] at h
+    cases ht : getConstantRefsUnivs.run afterCheck with
+    | error err => rw [ht] at h; contradiction
+    | ok tablesState =>
+      rcases tablesState with ⟨tables, afterTables⟩
+      rw [ht] at h
+      simp at h
+      cases h
+      rfl
+
+theorem getConstantAfterInfo_canonical (info : ConstantInfo) :
+    GetCanonical (getConstantAfterInfo info) constantAfterInfoBytes := by
+  intro pre rest result st' h
+  let afterSharing : Array Expr →
+      GetM (Array Expr × (Array Address × Array Univ)) :=
+    getConstantAfterSharing info
+  change (getCountedArray getExpr >>= afterSharing).run
+    ⟨pre ++ rest, pre.size⟩ = .ok (result, st') at h
+  obtain ⟨sharing, afterSharingBytes, hrestSharing, hafterSharing⟩ :=
+    ExprLaws.GetCanonical.bind_inv
+      (getCountedArray_canonical getExpr exprBytes
+        ExprLaws.getExpr_canonical) pre rest h
+  let sharingPre := pre ++ countedArrayBytes exprBytes sharing
+  have hafterSharing' :
+      (getConstantAfterSharing info sharing).run
+        ⟨sharingPre ++ afterSharingBytes, sharingPre.size⟩ =
+          .ok (result, st') := by
+    simpa [afterSharing, sharingPre] using hafterSharing
+  obtain ⟨suffix, hrestTables, hstate⟩ :=
+    getConstantAfterSharing_canonical info sharing
+      sharingPre afterSharingBytes hafterSharing'
+  have hshape := getConstantAfterSharing_success_fst info sharing
+    ⟨sharingPre ++ afterSharingBytes, sharingPre.size⟩ hafterSharing'
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestSharing, hrestTables, ← hshape]
+    simp [constantAfterInfoBytes, ByteArray.append_assoc]
+  · simpa [sharingPre, hrestSharing, hrestTables, ← hshape,
+      constantAfterInfoBytes, ByteArray.append_assoc,
+      ByteArray.size_append, Nat.add_assoc] using hstate
+
+theorem getConstantRaw_canonical :
+    GetCanonical getConstantRaw constantRawBytes := by
+  intro pre rest result st' h
+  let afterInfo : ConstantInfo → GetM ConstantRaw := fun info =>
+    (fun tail => (info, tail)) <$> getConstantAfterInfo info
+  change (getConstantInfo >>= afterInfo).run
+    ⟨pre ++ rest, pre.size⟩ = .ok (result, st') at h
+  obtain ⟨info, afterInfoBytes, hrestInfo, hafterInfo⟩ :=
+    ExprLaws.GetCanonical.bind_inv getConstantInfo_canonical pre rest h
+  let infoPre := pre ++ constantInfoBytes info
+  have hafterInfo' :
+      ((fun tail => (info, tail)) <$> getConstantAfterInfo info).run
+        ⟨infoPre ++ afterInfoBytes, infoPre.size⟩ = .ok (result, st') := by
+    change ((fun tail => (info, tail)) <$> getConstantAfterInfo info).run
+      ⟨(pre ++ constantInfoBytes info) ++ afterInfoBytes,
+        (pre ++ constantInfoBytes info).size⟩ = .ok (result, st') at hafterInfo
+    exact hafterInfo
+  have hmapped : GetCanonical
+      ((fun tail => (info, tail)) <$> getConstantAfterInfo info)
+      (fun raw => constantAfterInfoBytes raw.2) :=
+    GetCanonical.map (getConstantAfterInfo_canonical info)
+      (fun tail => (info, tail))
+      (fun raw => constantAfterInfoBytes raw.2) (by intro tail; rfl)
+  obtain ⟨suffix, hrestTail, hstate⟩ :=
+    hmapped infoPre afterInfoBytes hafterInfo'
+  obtain ⟨tail, hresult⟩ :=
+    map_success_exists (getConstantAfterInfo info)
+      (fun decodedTail => (info, decodedTail))
+      ⟨infoPre ++ afterInfoBytes, infoPre.size⟩ hafterInfo'
+  subst result
+  refine ⟨suffix, ?_, ?_⟩
+  · rw [hrestInfo, hrestTail]
+    simp [constantRawBytes, ByteArray.append_assoc]
+  · simpa [infoPre, hrestInfo, hrestTail, constantRawBytes,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc] using hstate
+
+theorem getConstant_canonical :
+    GetCanonical getConstant constantBytes := by
+  change GetCanonical (buildConstant <$> getConstantRaw) constantBytes
+  exact GetCanonical.map getConstantRaw_canonical buildConstant constantBytes
+    constantBytes_buildConstant
+
+end ConstLaws
+
+namespace ConstantInfo
+
+/-- Roundtrip on the exact recursively u64-count-representable domain. -/
+def RoundtripLaw : Prop :=
+  ∀ info : ConstantInfo, info.wireWF → de (ser info) = .ok info
+
+theorem roundtripLaw : RoundtripLaw := by
+  intro info hwf
+  change runGet getConstantInfo (runPut (putConstantInfo info)) = .ok info
+  rw [runPut_eq_of_spec (putConstantInfo_spec info)]
+  exact runGet_eq_ok_of_spec (ConstLaws.getConstantInfo_spec info hwf)
+
+/-- Every accepted constant-info payload has one canonical byte spelling. -/
+theorem canonicalLaw : Ixon.CanonicalLaw ConstantInfo :=
+  ConstLaws.canonicalLaw_of_getCanonical constantInfoBytes
+    putConstantInfo_spec ConstLaws.getConstantInfo_canonical
+
+end ConstantInfo
+
+/-- Roundtrip is intentionally stated on the accepted and wire-representable
+constant fragment. Raw `Constant` remains useful for constructing rejection
+fixtures, and mathematical arrays may exceed their u64 wire counts. -/
+def Constant.RoundtripLaw : Prop :=
+  ∀ c : Constant, c.wireWF → c.sharingWF = true → de (ser c) = .ok c
+
+namespace Constant
+
+/-- Every accepted, count-representable constant survives strict decoding. -/
+theorem roundtripLaw : RoundtripLaw := by
+  intro c hwf hsharing
+  change runGet getConstant (runPut (putConstant c)) = .ok c
+  rw [runPut_eq_of_spec (putConstant_spec c)]
+  exact runGet_eq_ok_of_spec (ConstLaws.getConstant_spec c hwf hsharing)
+
+/-- Every byte string accepted as a constant is its canonical encoding. -/
+theorem canonicalLaw : Ixon.CanonicalLaw Constant :=
+  ConstLaws.canonicalLaw_of_getCanonical constantBytes
+    putConstant_spec ConstLaws.getConstant_canonical
+
+end Constant
+
+/-! Elaboration-time roundtrip and canonicity checks. -/
+
+private def constRoundtrips (c : Constant) : Bool :=
+  match (de (ser c) : Except String Constant) with
+  | .ok c' => c' == c
+  | .error _ => false
+
+private def addr (b : UInt8) : Address :=
+  Address.replicate b
+
+/-! A format-freezing v2 fixture. It deliberately covers all four
+usage modes in both Π/λ telescopes, both result ownership modes, an
+eight-element application and universe-instantiation spine, the
+large form of Tag0/Tag2/Tag4, and every `Univ` constructor. Public
+(not `private`): the compiled `Tests.lean` executable pins its raw bytes and
+BLAKE3 digest through the real FFI hash path. Its deliberately synthetic local
+indices make it a wire fixture, not a value admitted by the semantic
+`address?` gate. -/
+
+def goldenV2 : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 128
+        typ :=
+          .all .erased .unique (.sort 0)
+            (.all .linear .shared (.sort 31)
+              (.all .affine .unique (.sort 32)
+                (.all .many .shared (.sort 128) (.sort 3))))
+        value :=
+          .lam .erased (.sort 0)
+            (.lam .linear (.sort 31)
+              (.lam .affine (.sort 32)
+                (.lam .many (.sort 128)
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.app (.ref 0 #[0, 1, 2, 3, 4, 0, 1, 2])
+                                  (.var 3))
+                                (.var 2))
+                              (.var 1))
+                            (.var 0))
+                          (.share 0))
+                        (.share 0))
+                      (.str 0))
+                    (.sort 256))))) }
+    sharing := #[.app (.app (.recur 0 #[4]) (.prj 0 1 (.var 0))) (.var 0)]
+    refs := #[addr 0xAB]
+    univs := #[
+      .zero,
+      .succ .zero,
+      .max (.var 0) (.succ (.var 1)),
+      .imax (.var 2) (.max .zero (.var 3)),
+      .var 256
+    ] }
+
+private def goldenV2Bytes : ByteArray := ByteArray.mk #[
+  208, 1, 128, 128, 148, 0, 0, 5, 8, 31, 2, 8, 32, 7, 8, 128,
+  3, 132, 0, 0, 1, 8, 31, 2, 8, 32, 3, 8, 128, 120, 8, 40,
+  8, 0, 0, 1, 2, 3, 4, 0, 1, 2, 19, 18, 17, 16, 176, 176,
+  80, 9, 0, 1, 1, 114, 49, 0, 4, 65, 0, 16, 16, 1, 171, 171,
+  171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171,
+  171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171,
+  171, 171, 5, 0, 1, 0, 64, 192, 1, 193, 128, 194,
+  64, 0, 195, 225, 0, 1
+]
+
+#guard ser goldenV2 == goldenV2Bytes
+#guard constRoundtrips goldenV2
+
+#guard constRoundtrips
+  { info := .defn
+      { kind := .thm, safety := .safe, lvls := 2
+        typ := .all .many .shared (.sort 1) (.sort 1)
+        value := .lam .linear (.var 0) (.app (.share 0) (.share 0)) }
+    sharing := #[.app (.var 0) (.var 1)]
+    refs := #[addr 0xAB]
+    univs := #[.var 0, .succ (.var 1)] }
+
+#guard constRoundtrips
+  { info := .axio { isUnsafe := false, lvls := 1, typ := .sort 3 }
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+#guard constRoundtrips
+  { info := .quot { kind := .lift, lvls := 0, typ := .var 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+#guard constRoundtrips
+  { info := .cPrj { idx := 1, cidx := 2, block := addr 0x01 }
+    sharing := #[], refs := #[], univs := #[] }
+
+#guard constRoundtrips
+  { info := .muts #[
+      .defn { kind := .defn, safety := .part, lvls := 0
+              typ := .sort 0, value := .nat 0 },
+      .indc { isUnsafe := false, lvls := 1, params := 1, indices := 0
+              typ := .all .many .shared (.sort 1) (.sort 1)
+              ctors := #[{ isUnsafe := false, lvls := 1, cidx := 0
+                           params := 1, fields := 2, typ := .var 0 }] },
+      .recr { k := true, isUnsafe := false, lvls := 1, params := 1
+              indices := 0, motives := 1, minors := 2, typ := .sort 0
+              rules := #[{ fields := 2, rhs := .var 1 }] }]
+    sharing := #[]
+    refs := #[addr 0x02, addr 0x03]
+    univs := #[.imax (.var 0) .zero] }
+
+private def constRejects (bytes : Array UInt8) : Bool :=
+  match (de (ByteArray.mk bytes) : Except String Constant) with
+  | .ok _ => false
+  | .error _ => true
+
+private def sharingAxiom (typ : Expr) (sharing : Array Expr) : Constant :=
+  { info := .axio { isUnsafe := false, lvls := 0, typ }
+    sharing, refs := #[], univs := #[] }
+
+private def invalidConstantRejected (c : Constant) : Bool :=
+  match (de (ser c) : Except String Constant) with
+  | .ok _ => false
+  | .error _ => true
+
+/-! Layer-1 sharing strictness. The positive fixture has a nested backward
+reference: entry 0 is used twice by entry 1, then entry 1 twice by the body. -/
+
+#guard constRoundtrips (sharingAxiom
+  (.app (.share 1) (.share 1))
+  #[.sort 0, .app (.share 0) (.share 0)])
+
+-- body reference out of bounds
+#guard invalidConstantRejected (sharingAxiom (.share 0) #[])
+-- entry 0 self-reference (cycle)
+#guard invalidConstantRejected (sharingAxiom
+  (.app (.share 0) (.share 0))
+  #[.app (.share 0) (.share 0)])
+-- entry 0 forward-reference to entry 1
+#guard invalidConstantRejected (sharingAxiom
+  (.app (.share 1) (.share 1))
+  #[.app (.share 1) (.share 1), .sort 0])
+-- bare alias entry
+#guard invalidConstantRejected (sharingAxiom
+  (.app (.share 1) (.share 1))
+  #[.sort 0, .share 0])
+-- dead and singleton entries
+#guard invalidConstantRejected (sharingAxiom (.sort 1) #[.sort 0])
+#guard invalidConstantRejected (sharingAxiom (.share 0) #[.sort 0])
+
+-- ConstantInfo variant 8 (out of range; large-form Tag4 size)
+#guard constRejects #[0xD8, 0x08]
+-- defn with invalid kind bits (0x0F: kind = 3)
+#guard constRejects #[0xD0, 0x0F]
+-- recursor with stray high bits in the packed-bool byte
+#guard constRejects #[0xD1, 0x04]
+-- axiom with non-canonical Bool byte 2
+#guard constRejects #[0xD2, 0x02]
+-- quotient with invalid quot-kind byte 4 (valid kinds are 0-3)
+#guard constRejects #[0xD3, 0x04]
+-- muts block whose first member carries invalid mut tag 3 (valid tags are 0-2)
+#guard constRejects #[0xC1, 0x03]
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/DecodeCheck.lean b/Ix/Compiler/Ixon/DecodeCheck.lean
new file mode 100644
index 000000000..db3990bdd
--- /dev/null
+++ b/Ix/Compiler/Ixon/DecodeCheck.lean
@@ -0,0 +1,768 @@
+import Ix.Compiler.Ixon.Work
+
+/-!
+# Structured local validation for decoded Ixon constants
+
+The byte codec deliberately remains a small, proof-oriented parser.  This
+module is the resource-bounded ingress layer: it turns syntax failures into a
+structured error and rejects table indices that the evaluator would otherwise
+interpret as missing or (for universe variables) silently default to zero.
+
+Validation is local to one constant.  Foreign declaration arities and
+cross-constant projection/member metadata still belong to store ingestion.
+The raw `de` API remains available for codec laws and wire-format fixtures;
+untrusted constant bytes should enter through `decodeChecked`.
+-/
+
+namespace Ix.Compiler.Ixon.DecodeCheck
+
+/-- The authoritative expression slot currently being validated. -/
+inductive Root where
+  | definitionType
+  | definitionValue
+  | recursorType
+  | recursorRule (index : Nat)
+  | axiomType
+  | quotientType
+  | inductiveType
+  | constructorType (index : Nat)
+  deriving BEq, DecidableEq, Repr
+
+/-- A root is either in a standalone declaration or in one member of a
+mutual block. -/
+structure Site where
+  member : Option Nat
+  root : Root
+  deriving BEq, DecidableEq, Repr
+
+/-- The four expression forms whose payload indexes the local refs table. -/
+inductive RefKind where
+  | constant
+  | string
+  | natural
+  | projectionType
+  deriving BEq, DecidableEq, Repr
+
+/-- Counted regions whose declared length is checked before any loop or
+allocation begins. -/
+inductive Sequence where
+  | universeArguments
+  | applicationSpine
+  | lambdaTelescope
+  | forallTelescope
+  | recursorRules
+  | constructors
+  | mutualMembers
+  | sharingTable
+  | references
+  | universes
+  | universeSuccessors
+  deriving BEq, DecidableEq, Repr
+
+/-- Resource policy for untrusted constant bytes.  The defaults are per
+constant (not per environment) and deliberately configurable so a corpus can
+record a tighter budget without changing the wire format. -/
+structure Limits where
+  maxObjectBytes : Nat := 64 * 1024 * 1024
+  maxExpressionDepth : Nat := 512
+  maxUniverseDepth : Nat := 512
+  maxSequenceLength : Nat := 4096
+  /-- Inclusive charge for the quadratic layer-1 sharing scan. -/
+  maxLayer1NodeVisits : Nat := 16 * 1024 * 1024
+  deriving BEq, DecidableEq, Repr
+
+def defaultLimits : Limits := {}
+
+/-- Structured failures produced at the checked-ingress boundary.  `syntax`
+wraps the existing proof-oriented parser diagnostics; all post-decode
+semantic failures have data-bearing constructors. -/
+inductive Error where
+  | syntax (message : String)
+  | objectTooLarge (actual limit : Nat)
+  | expressionDepth (limit : Nat)
+  | universeDepth (limit : Nat)
+  | sequenceTooLong (sequence : Sequence) (actual limit : Nat)
+  | resource (exceeded : Work.Exceeded)
+  | sharingInvariant
+  | refIndex (site : Site) (kind : RefKind) (index bound : Nat)
+  | universeIndex (site : Site) (index bound : Nat)
+  | universeVariable (site : Site) (index levels : Nat)
+  | recurIndex (site : Site) (index bound : Nat)
+  | unresolvedShare (site : Site) (index : Nat)
+  | recursorTypeArity (site : Site) (expected actual : Nat)
+  | recursorRuleArity (site : Site) (expected actual : Nat)
+  deriving BEq, DecidableEq, Repr
+
+inductive EncodeError where
+  | wireNotRepresentable
+  | invalid (error : Error)
+  deriving BEq, DecidableEq, Repr
+
+abbrev CheckM := Except Error
+
+/-! ## Executable encoder domain
+
+The theorem-facing `wireWF` predicates live in `Prop`; these boolean mirrors
+are the executable guard used by the checked writer below. -/
+
+def wireExprWF : Expr → Bool
+  | .sort _ | .var _ | .str _ | .nat _ | .share _ => true
+  | .ref _ indices | .recur _ indices =>
+    decide (indices.size < UInt64.size)
+  | .prj _ _ value => wireExprWF value
+  | .app fn arg =>
+    wireExprWF fn && wireExprWF arg &&
+      decide (fn.appCount + 1 < UInt64.size)
+  | .lam _ type body =>
+    wireExprWF type && wireExprWF body &&
+      decide (body.lamCount + 1 < UInt64.size)
+  | .all _ _ domain codomain =>
+    wireExprWF domain && wireExprWF codomain &&
+      decide (codomain.allCount + 1 < UInt64.size)
+  | .letE _ type value body =>
+    wireExprWF type && wireExprWF value && wireExprWF body
+
+theorem wireExprWF_eq_true_iff (e : Expr) :
+    wireExprWF e = true ↔ e.wireWF := by
+  induction e <;> simp_all [wireExprWF, Expr.wireWF, and_assoc]
+
+def wireDefinitionWF (d : Definition) : Bool :=
+  wireExprWF d.typ && wireExprWF d.value
+
+def wireRecursorRuleWF (r : RecursorRule) : Bool :=
+  wireExprWF r.rhs
+
+def wireRecursorWF (r : Recursor) : Bool :=
+  wireExprWF r.typ && decide (r.rules.size < UInt64.size) &&
+    r.rules.all wireRecursorRuleWF
+
+def wireAxiomWF (a : Axiom) : Bool := wireExprWF a.typ
+
+def wireQuotientWF (q : Quotient) : Bool := wireExprWF q.typ
+
+def wireConstructorWF (c : Constructor) : Bool := wireExprWF c.typ
+
+def wireInductiveWF (i : Inductive) : Bool :=
+  wireExprWF i.typ && decide (i.ctors.size < UInt64.size) &&
+    i.ctors.all wireConstructorWF
+
+def wireMutConstWF : MutConst → Bool
+  | .defn d => wireDefinitionWF d
+  | .indc i => wireInductiveWF i
+  | .recr r => wireRecursorWF r
+
+def wireConstantInfoWF : ConstantInfo → Bool
+  | .defn d => wireDefinitionWF d
+  | .recr r => wireRecursorWF r
+  | .axio a => wireAxiomWF a
+  | .quot q => wireQuotientWF q
+  | .cPrj _ | .rPrj _ | .iPrj _ | .dPrj _ => true
+  | .muts members =>
+    decide (members.size < UInt64.size) &&
+      members.all wireMutConstWF
+
+def wireConstantWF (c : Constant) : Bool :=
+  wireConstantInfoWF c.info &&
+    decide (c.sharing.size < UInt64.size) &&
+    c.sharing.all wireExprWF &&
+    decide (c.refs.size < UInt64.size) &&
+    decide (c.univs.size < UInt64.size)
+
+private theorem forall_getElem_iff_forall_mem [BEq α]
+    (values : Array α) (property : α → Prop) :
+    (∀ (index : Nat) (h : index < values.size),
+      property values[index]) ↔
+      ∀ value, value ∈ values → property value := by
+  constructor
+  · intro h value hmem
+    rcases Array.mem_iff_getElem.mp hmem with ⟨index, hi, heq⟩
+    subst value
+    exact h index hi
+  · intro h index hi
+    exact h values[index] (Array.getElem_mem hi)
+
+theorem wireDefinitionWF_eq_true_iff (d : Definition) :
+    wireDefinitionWF d = true ↔ d.wireWF := by
+  simp [wireDefinitionWF, Definition.wireWF, wireExprWF_eq_true_iff]
+
+theorem wireRecursorRuleWF_eq_true_iff (r : RecursorRule) :
+    wireRecursorRuleWF r = true ↔ r.wireWF := by
+  simp [wireRecursorRuleWF, RecursorRule.wireWF, wireExprWF_eq_true_iff]
+
+theorem wireRecursorWF_eq_true_iff (r : Recursor) :
+    wireRecursorWF r = true ↔ r.wireWF := by
+  simp [wireRecursorWF, Recursor.wireWF, wireExprWF_eq_true_iff,
+    wireRecursorRuleWF_eq_true_iff, forall_getElem_iff_forall_mem,
+    and_assoc]
+
+theorem wireAxiomWF_eq_true_iff (a : Axiom) :
+    wireAxiomWF a = true ↔ a.wireWF := by
+  simp [wireAxiomWF, Axiom.wireWF, wireExprWF_eq_true_iff]
+
+theorem wireQuotientWF_eq_true_iff (q : Quotient) :
+    wireQuotientWF q = true ↔ q.wireWF := by
+  simp [wireQuotientWF, Quotient.wireWF, wireExprWF_eq_true_iff]
+
+theorem wireConstructorWF_eq_true_iff (c : Constructor) :
+    wireConstructorWF c = true ↔ c.wireWF := by
+  simp [wireConstructorWF, Constructor.wireWF, wireExprWF_eq_true_iff]
+
+theorem wireInductiveWF_eq_true_iff (i : Inductive) :
+    wireInductiveWF i = true ↔ i.wireWF := by
+  simp [wireInductiveWF, Inductive.wireWF, wireExprWF_eq_true_iff,
+    wireConstructorWF_eq_true_iff, forall_getElem_iff_forall_mem,
+    and_assoc]
+
+theorem wireMutConstWF_eq_true_iff (m : MutConst) :
+    wireMutConstWF m = true ↔ m.wireWF := by
+  cases m <;> simp [wireMutConstWF, MutConst.wireWF,
+    wireDefinitionWF_eq_true_iff, wireInductiveWF_eq_true_iff,
+    wireRecursorWF_eq_true_iff]
+
+theorem wireConstantInfoWF_eq_true_iff (info : ConstantInfo) :
+    wireConstantInfoWF info = true ↔ info.wireWF := by
+  cases info <;> simp [wireConstantInfoWF, ConstantInfo.wireWF,
+    wireDefinitionWF_eq_true_iff, wireRecursorWF_eq_true_iff,
+    wireAxiomWF_eq_true_iff, wireQuotientWF_eq_true_iff,
+    wireMutConstWF_eq_true_iff, forall_getElem_iff_forall_mem]
+
+theorem wireConstantWF_eq_true_iff (c : Constant) :
+    wireConstantWF c = true ↔ c.wireWF := by
+  simp [wireConstantWF, Constant.wireWF,
+    wireConstantInfoWF_eq_true_iff, wireExprWF_eq_true_iff,
+    forall_getElem_iff_forall_mem, and_assoc]
+
+/-! ## Resource-bounded syntax decoder
+
+The law-facing codec in `Const` remains unchanged.  This ingress decoder uses
+the same strict primitive readers, but makes recursion and every input-driven
+loop explicit.  Arrays and flattened expression spines are accumulated by
+iteration, so their input counts do not become native call-stack depth. -/
+
+private abbrev DecodeM := StateT GetState (Except Error)
+
+private def liftSyntax (get : GetM α) : DecodeM α := fun state =>
+  match get.run state with
+  | .ok result => .ok result
+  | .error message => .error (.syntax message)
+
+private def guardSequence (limits : Limits) (sequence : Sequence)
+    (count : Nat) : DecodeM Unit :=
+  if count ≤ limits.maxSequenceLength then pure ()
+  else throw (.sequenceTooLong sequence count limits.maxSequenceLength)
+
+private def getArrayBounded (limits : Limits) (sequence : Sequence)
+    (getOne : DecodeM α) (count : Nat) : DecodeM (Array α) := do
+  guardSequence limits sequence count
+  let mut values := #[]
+  for _ in [:count] do
+    values := values.push (← getOne)
+  return values
+
+private def getCountedArrayBounded (limits : Limits) (sequence : Sequence)
+    (getOne : DecodeM α) : DecodeM (Array α) := do
+  let count := (← liftSyntax getTag0).size.toNat
+  getArrayBounded limits sequence getOne count
+
+private def getUniverseArguments (limits : Limits)
+    (count : Nat) : DecodeM (Array UInt64) := do
+  guardSequence limits .universeArguments count
+  let mut indices := #[]
+  for _ in [:count] do
+    indices := indices.push (← liftSyntax getTag0).size
+  return indices
+
+private def getExprBounded (limits : Limits) : Nat → DecodeM Expr
+  | 0 => throw (.expressionDepth limits.maxExpressionDepth)
+  | depth + 1 => do
+    let tag ← liftSyntax getTag4
+    let recur := getExprBounded limits depth
+    match tag.flag with
+    | 0x0 => return .sort tag.size
+    | 0x1 => return .var tag.size
+    | 0x2 => do
+      let refIndex := (← liftSyntax getTag0).size
+      return .ref refIndex
+        (← getUniverseArguments limits tag.size.toNat)
+    | 0x3 => do
+      let recurIndex := (← liftSyntax getTag0).size
+      return .recur recurIndex
+        (← getUniverseArguments limits tag.size.toNat)
+    | 0x4 => do
+      let typeRefIndex := (← liftSyntax getTag0).size
+      return .prj typeRefIndex tag.size (← recur)
+    | 0x5 => return .str tag.size
+    | 0x6 => return .nat tag.size
+    | 0x7 => do
+      let count := tag.size.toNat
+      if count == 0 then throw (.syntax "getExpr: empty app spine")
+      guardSequence limits .applicationSpine count
+      let base ← recur
+      match base with
+      | .app .. => throw (.syntax "getExpr: non-canonical app base")
+      | _ =>
+        let mut result := base
+        for _ in [:count] do
+          result := .app result (← recur)
+        return result
+    | 0x8 => do
+      let count := tag.size.toNat
+      if count == 0 then throw (.syntax "getExpr: empty lam telescope")
+      guardSequence limits .lambdaTelescope count
+      let mut binders : List (Uses × Expr) := []
+      for _ in [:count] do
+        let mode ← liftSyntax getLamMode
+        let type ← recur
+        binders := (mode, type) :: binders
+      let body ← recur
+      match body with
+      | .lam .. => throw (.syntax "getExpr: non-canonical lam telescope")
+      | _ =>
+        let mut result := body
+        for binder in binders do
+          result := .lam binder.1 binder.2 result
+        return result
+    | 0x9 => do
+      let count := tag.size.toNat
+      if count == 0 then throw (.syntax "getExpr: empty all telescope")
+      guardSequence limits .forallTelescope count
+      let mut binders : List (Uses × Owned × Expr) := []
+      for _ in [:count] do
+        let mode ← liftSyntax getAllMode
+        let type ← recur
+        binders := (mode.1, mode.2, type) :: binders
+      let body ← recur
+      match body with
+      | .all .. => throw (.syntax "getExpr: non-canonical all telescope")
+      | _ =>
+        let mut result := body
+        for binder in binders do
+          result := .all binder.1 binder.2.1 binder.2.2 result
+        return result
+    | 0xA => do
+      if tag.size > 1 then
+        throw (.syntax s!"getExpr: invalid letE nonDep {tag.size}")
+      let type ← recur
+      let value ← recur
+      return .letE (tag.size == 1) type value (← recur)
+    | 0xB => return .share tag.size
+    | flag => throw (.syntax s!"getExpr: invalid flag {flag}")
+
+private def getUnivBounded (limits : Limits) : Nat → DecodeM Univ
+  | 0 => throw (.universeDepth limits.maxUniverseDepth)
+  | depth + 1 => do
+    let tag ← liftSyntax getTag2
+    let recur := getUnivBounded limits depth
+    match tag.flag with
+    | 0 =>
+      if tag.size == 0 then return .zero
+      else do
+        let count := tag.size.toNat
+        if count > maxSuccExpansion then
+          throw (.sequenceTooLong .universeSuccessors count maxSuccExpansion)
+        let base ← recur
+        match base with
+        | .succ _ =>
+          if count == maxSuccExpansion then
+            return Univ.addSucc count base
+          else
+            throw (.syntax "getUniv: non-canonical short succ chunk")
+        | _ => return Univ.addSucc count base
+    | 1 => do
+      if tag.size != 0 then
+        throw (.syntax s!"getUniv: non-canonical max size {tag.size}")
+      return .max (← recur) (← recur)
+    | 2 => do
+      if tag.size != 0 then
+        throw (.syntax s!"getUniv: non-canonical imax size {tag.size}")
+      return .imax (← recur) (← recur)
+    | 3 => return .var tag.size
+    | flag => throw (.syntax s!"getUniv: invalid flag {flag}")
+
+private def getDefinitionBounded (limits : Limits) : DecodeM Definition := do
+  let mode ← liftSyntax getDefinitionMode
+  let levels := (← liftSyntax getTag0).size
+  let type ← getExprBounded limits limits.maxExpressionDepth
+  let value ← getExprBounded limits limits.maxExpressionDepth
+  return ⟨mode.1, mode.2, levels, type, value⟩
+
+private def getRecursorRuleBounded (limits : Limits) : DecodeM RecursorRule := do
+  let fields := (← liftSyntax getTag0).size
+  let rhs ← getExprBounded limits limits.maxExpressionDepth
+  return ⟨fields, rhs⟩
+
+private def getRecursorBounded (limits : Limits) : DecodeM Recursor := do
+  let mode ← liftSyntax getRecursorMode
+  let levels := (← liftSyntax getTag0).size
+  let params := (← liftSyntax getTag0).size
+  let indices := (← liftSyntax getTag0).size
+  let motives := (← liftSyntax getTag0).size
+  let minors := (← liftSyntax getTag0).size
+  let type ← getExprBounded limits limits.maxExpressionDepth
+  let rules ← getCountedArrayBounded limits .recursorRules
+    (getRecursorRuleBounded limits)
+  return ⟨mode.1, mode.2, levels, params, indices, motives, minors,
+    type, rules⟩
+
+private def getAxiomBounded (limits : Limits) : DecodeM Axiom := do
+  let isUnsafe ← liftSyntax (getStrictBool "getAxiom")
+  let levels := (← liftSyntax getTag0).size
+  let type ← getExprBounded limits limits.maxExpressionDepth
+  return ⟨isUnsafe, levels, type⟩
+
+private def getQuotientBounded (limits : Limits) : DecodeM Quotient := do
+  let kind ← liftSyntax getQuotKind
+  let levels := (← liftSyntax getTag0).size
+  let type ← getExprBounded limits limits.maxExpressionDepth
+  return ⟨kind, levels, type⟩
+
+private def getConstructorBounded (limits : Limits) : DecodeM Constructor := do
+  let isUnsafe ← liftSyntax (getStrictBool "getConstructor")
+  let levels := (← liftSyntax getTag0).size
+  let cidx := (← liftSyntax getTag0).size
+  let params := (← liftSyntax getTag0).size
+  let fields := (← liftSyntax getTag0).size
+  let type ← getExprBounded limits limits.maxExpressionDepth
+  return ⟨isUnsafe, levels, cidx, params, fields, type⟩
+
+private def getInductiveBounded (limits : Limits) : DecodeM Inductive := do
+  let isUnsafe ← liftSyntax (getStrictBool "getInductive")
+  let levels := (← liftSyntax getTag0).size
+  let params := (← liftSyntax getTag0).size
+  let indices := (← liftSyntax getTag0).size
+  let type ← getExprBounded limits limits.maxExpressionDepth
+  let constructors ← getCountedArrayBounded limits .constructors
+    (getConstructorBounded limits)
+  return ⟨isUnsafe, levels, params, indices, type, constructors⟩
+
+private def getMutConstBounded (limits : Limits) : DecodeM MutConst := do
+  match ← liftSyntax getU8 with
+  | 0 => return .defn (← getDefinitionBounded limits)
+  | 1 => return .indc (← getInductiveBounded limits)
+  | 2 => return .recr (← getRecursorBounded limits)
+  | tag => throw (.syntax s!"getMutConst: invalid tag {tag}")
+
+private def getConstantInfoVariantBounded (limits : Limits)
+    (variant : UInt64) : DecodeM ConstantInfo := do
+  if variant == ConstantInfo.CONST_DEFN then
+    return .defn (← getDefinitionBounded limits)
+  else if variant == ConstantInfo.CONST_RECR then
+    return .recr (← getRecursorBounded limits)
+  else if variant == ConstantInfo.CONST_AXIO then
+    return .axio (← getAxiomBounded limits)
+  else if variant == ConstantInfo.CONST_QUOT then
+    return .quot (← getQuotientBounded limits)
+  else if variant == ConstantInfo.CONST_CPRJ then
+    return .cPrj (← liftSyntax getConstructorProj)
+  else if variant == ConstantInfo.CONST_RPRJ then
+    return .rPrj (← liftSyntax getRecursorProj)
+  else if variant == ConstantInfo.CONST_IPRJ then
+    return .iPrj (← liftSyntax getInductiveProj)
+  else if variant == ConstantInfo.CONST_DPRJ then
+    return .dPrj (← liftSyntax getDefinitionProj)
+  else
+    throw (.syntax s!"getConstantInfo: invalid variant {variant}")
+
+private def getConstantInfoBounded (limits : Limits) : DecodeM ConstantInfo := do
+  let tag ← liftSyntax getTag4
+  if tag.flag == Constant.FLAG_MUTS then
+    return .muts (← getArrayBounded limits .mutualMembers
+      (getMutConstBounded limits) tag.size.toNat)
+  else if tag.flag == Constant.FLAG then
+    getConstantInfoVariantBounded limits tag.size
+  else
+    throw (.syntax s!"getConstantInfo: invalid flag {tag.flag}")
+
+private def checkSharing (requireUsedTwice : Bool) (info : ConstantInfo)
+    (sharing : Array Expr) : DecodeM Unit := do
+  unless Sharing.tableWF sharing do throw .sharingInvariant
+  let bodies := info.exprs.toArray
+  unless bodies.all (Sharing.sharesBelow sharing.size) do
+    throw .sharingInvariant
+  if requireUsedTwice then
+    unless Sharing.entriesUsedTwice sharing bodies do
+      throw .sharingInvariant
+
+private def getConstantBoundedWith (requireUsedTwice : Bool)
+    (limits : Limits) : DecodeM Constant := do
+  let info ← getConstantInfoBounded limits
+  let sharing ← getCountedArrayBounded limits .sharingTable
+    (getExprBounded limits limits.maxExpressionDepth)
+  checkSharing requireUsedTwice info sharing
+  let refs ← getCountedArrayBounded limits .references
+    (liftSyntax (Serialize.get : GetM Address))
+  let univs ← getCountedArrayBounded limits .universes
+    (getUnivBounded limits limits.maxUniverseDepth)
+  return ⟨info, sharing, refs, univs⟩
+
+private def getConstantBounded (limits : Limits) : DecodeM Constant :=
+  getConstantBoundedWith true limits
+
+private def getIxonV2ConstantBounded (limits : Limits) : DecodeM Constant :=
+  getConstantBoundedWith false limits
+
+private def runDecodeM (get : DecodeM α) (bytes : ByteArray) :
+    Except Error α := do
+  let (value, state) ← get.run ⟨bytes, 0⟩
+  if state.idx != state.bytes.size then
+    throw (.syntax s!"trailing bytes: consumed {state.idx} of {state.bytes.size}")
+  return value
+
+private def checkRefIndex (site : Site) (kind : RefKind)
+    (bound : Nat) (index : UInt64) : CheckM Unit :=
+  if index.toNat < bound then .ok ()
+  else .error (.refIndex site kind index.toNat bound)
+
+/-- Validate every declaration-level universe variable in one local universe
+expression.  This closes the evaluator's `getD 0` fallback for malformed
+`Univ.var` indices. -/
+private def checkUniv (site : Site) (levels : Nat) : Univ → CheckM Unit
+  | .zero => .ok ()
+  | .succ u => checkUniv site levels u
+  | .max left right | .imax left right => do
+    checkUniv site levels left
+    checkUniv site levels right
+  | .var index =>
+    if index.toNat < levels then .ok ()
+    else .error (.universeVariable site index.toNat levels)
+
+private def checkUnivIndex (c : Constant) (site : Site) (levels : Nat)
+    (index : UInt64) : CheckM Unit :=
+  match c.univs[index.toNat]? with
+  | none => .error (.universeIndex site index.toNat c.univs.size)
+  | some u => checkUniv site levels u
+
+private def checkUnivArgs (c : Constant) (site : Site) (levels : Nat)
+    (indices : Array UInt64) : CheckM Unit := do
+  for index in indices do
+    checkUnivIndex c site levels index
+
+/-- Check all evaluator-visible local table indices in one fully inlined
+expression.  Term-variable scope and foreign declaration arities are separate
+typing/store concerns and intentionally do not appear here. -/
+private def checkExpr (c : Constant) (selfBound levels : Nat)
+    (site : Site) : Expr → CheckM Unit
+  | .sort index => checkUnivIndex c site levels index
+  | .var _ => .ok ()
+  | .ref index univIndices => do
+    checkRefIndex site .constant c.refs.size index
+    checkUnivArgs c site levels univIndices
+  | .recur index univIndices => do
+    if index.toNat < selfBound then pure ()
+    else throw (.recurIndex site index.toNat selfBound)
+    checkUnivArgs c site levels univIndices
+  | .prj typeRefIndex _ value => do
+    checkRefIndex site .projectionType c.refs.size typeRefIndex
+    checkExpr c selfBound levels site value
+  | .str index => checkRefIndex site .string c.refs.size index
+  | .nat index => checkRefIndex site .natural c.refs.size index
+  | .app fn arg => do
+    checkExpr c selfBound levels site fn
+    checkExpr c selfBound levels site arg
+  | .lam _ type body => do
+    checkExpr c selfBound levels site type
+    checkExpr c selfBound levels site body
+  | .all _ _ domain codomain => do
+    checkExpr c selfBound levels site domain
+    checkExpr c selfBound levels site codomain
+  | .letE _ type value body => do
+    checkExpr c selfBound levels site type
+    checkExpr c selfBound levels site value
+    checkExpr c selfBound levels site body
+  | .share index => .error (.unresolvedShare site index.toNat)
+
+private def inlinedRoot (c : Constant) (e : Expr) : Expr :=
+  Sharing.inlineExpr c.sharing e
+
+private def checkRoot (c : Constant) (selfBound : Nat) (levels : UInt64)
+    (site : Site) (e : Expr) : CheckM Unit :=
+  checkExpr c selfBound levels.toNat site (inlinedRoot c e)
+
+private def checkDefinition (c : Constant) (selfBound : Nat)
+    (member : Option Nat) (d : Definition) : CheckM Unit := do
+  checkRoot c selfBound d.lvls ⟨member, .definitionType⟩ d.typ
+  checkRoot c selfBound d.lvls ⟨member, .definitionValue⟩ d.value
+
+/-- Check the evaluator's recursor slicing contract.  The stored type exposes
+all params, motives, minors, indices, and the major premise.  A rule captures
+the evaluator's params/motives/minors prefix followed by its constructor
+fields; indices are intentionally absent from that rule environment. -/
+private def checkRecursor (c : Constant) (selfBound : Nat)
+    (member : Option Nat) (r : Recursor) : CheckM Unit := do
+  let typeSite : Site := ⟨member, .recursorType⟩
+  let typ := inlinedRoot c r.typ
+  checkExpr c selfBound r.lvls.toNat typeSite typ
+  let expectedType := r.params.toNat + r.motives.toNat + r.minors.toNat +
+    r.indices.toNat + 1
+  unless typ.allCount == expectedType do
+    throw (.recursorTypeArity typeSite expectedType typ.allCount)
+  for ruleIndex in [:r.rules.size] do
+    let rule := r.rules[ruleIndex]!
+    let ruleSite : Site := ⟨member, .recursorRule ruleIndex⟩
+    let rhs := inlinedRoot c rule.rhs
+    checkExpr c selfBound r.lvls.toNat ruleSite rhs
+    let expectedRule := r.params.toNat + r.motives.toNat +
+      r.minors.toNat + rule.fields.toNat
+    unless rhs.lamCount == expectedRule do
+      throw (.recursorRuleArity ruleSite expectedRule rhs.lamCount)
+
+private def checkInductive (c : Constant) (selfBound : Nat)
+    (member : Option Nat) (i : Inductive) : CheckM Unit := do
+  checkRoot c selfBound i.lvls ⟨member, .inductiveType⟩ i.typ
+  for ctorIndex in [:i.ctors.size] do
+    let ctor := i.ctors[ctorIndex]!
+    checkRoot c selfBound ctor.lvls
+      ⟨member, .constructorType ctorIndex⟩ ctor.typ
+
+private def checkMutConst (c : Constant) (selfBound memberIndex : Nat) :
+    MutConst → CheckM Unit
+  | .defn d => checkDefinition c selfBound (some memberIndex) d
+  | .indc i => checkInductive c selfBound (some memberIndex) i
+  | .recr r => checkRecursor c selfBound (some memberIndex) r
+
+private def checkConstantCore (c : Constant) : CheckM Unit := do
+  match c.info with
+  -- ix collapses singleton recursive blocks to standalone Defn/Recr values,
+  -- retaining `.recur 0` as the self reference.
+  | .defn d => checkDefinition c 1 none d
+  | .recr r => checkRecursor c 1 none r
+  | .axio a => checkRoot c 0 a.lvls ⟨none, .axiomType⟩ a.typ
+  | .quot q => checkRoot c 0 q.lvls ⟨none, .quotientType⟩ q.typ
+  | .cPrj _ | .rPrj _ | .iPrj _ | .dPrj _ => pure ()
+  | .muts members =>
+    for memberIndex in [:members.size] do
+      checkMutConst c members.size memberIndex members[memberIndex]!
+
+/-- Validate every local semantic index and recursor slicing count in a
+decoded constant.  This function is also useful for programmatically-built
+constants; malformed sharing is rejected before inlining. -/
+def checkConstant (c : Constant) : CheckM Unit := do
+  unless c.sharingWF do
+    throw .sharingInvariant
+  checkConstantCore c
+
+/-- Local semantic validation under the safety-critical sharing invariant
+used by the pinned upstream ixon-v2 compressor.  Exact external compressor
+image is checked separately at the address boundary. -/
+def checkIxonV2Constant (c : Constant) : CheckM Unit := do
+  unless Sharing.structuralWF c.sharing c.info.exprs.toArray do
+    throw .sharingInvariant
+  checkConstantCore c
+
+/-- Resource-gated local validation.  The linear counter runs before the
+quadratic sharing predicate, so an over-budget object is rejected without
+entering `entriesUsedTwice`. -/
+def checkConstantWith (limits : Limits) (c : Constant) : CheckM Unit := do
+  let work := Work.layer1NodeVisits c.sharing c.info.exprs.toArray
+  match Work.ensure .layer1NodeVisits work limits.maxLayer1NodeVisits with
+  | .error exceeded => throw (.resource exceeded)
+  | .ok _ => checkConstant c
+
+def checkIxonV2ConstantWith (limits : Limits) (c : Constant) : CheckM Unit := do
+  let work := Work.layer1NodeVisits c.sharing c.info.exprs.toArray
+  match Work.ensure .layer1NodeVisits work limits.maxLayer1NodeVisits with
+  | .error exceeded => throw (.resource exceeded)
+  | .ok _ => checkIxonV2Constant c
+
+theorem checkConstant_of_checkConstantWith {limits : Limits} {c : Constant}
+    (h : checkConstantWith limits c = .ok ()) :
+    checkConstant c = .ok () := by
+  unfold checkConstantWith at h
+  cases hwork : Work.ensure .layer1NodeVisits
+      (Work.layer1NodeVisits c.sharing c.info.exprs.toArray)
+      limits.maxLayer1NodeVisits with
+  | error exceeded => simp [hwork] at h
+  | ok result =>
+    cases result
+    simpa [hwork] using h
+
+theorem checkIxonV2Constant_of_checkIxonV2ConstantWith
+    {limits : Limits} {c : Constant}
+    (h : checkIxonV2ConstantWith limits c = .ok ()) :
+    checkIxonV2Constant c = .ok () := by
+  unfold checkIxonV2ConstantWith at h
+  cases hwork : Work.ensure .layer1NodeVisits
+      (Work.layer1NodeVisits c.sharing c.info.exprs.toArray)
+      limits.maxLayer1NodeVisits with
+  | error exceeded => simp [hwork] at h
+  | ok result =>
+    cases result
+    simpa [hwork] using h
+
+def localWF (c : Constant) : Bool :=
+  match checkConstant c with
+  | .ok _ => true
+  | .error _ => false
+
+/-- Exact executable predicate for constants accepted by the checked writer:
+the proved wire-representability domain plus local semantic validation. -/
+def checkedWF (c : Constant) : Bool :=
+  wireConstantWF c && localWF c
+
+theorem wireWF_of_checkedWF {c : Constant} (h : checkedWF c = true) :
+    c.wireWF := by
+  have hwire : wireConstantWF c = true := (Bool.and_eq_true_iff.mp h).1
+  exact (wireConstantWF_eq_true_iff c).mp hwire
+
+/-- Resource-bounded checked counterpart of raw `ser`.  It cannot silently
+truncate a source count and it refuses malformed sharing/local evaluator
+indices before serialization. -/
+def encodeCheckedWith (limits : Limits) (c : Constant) :
+    Except EncodeError ByteArray :=
+  if wireConstantWF c then
+    match checkConstantWith limits c with
+    | .ok _ => .ok (ser c)
+    | .error error => .error (.invalid error)
+  else
+    .error .wireNotRepresentable
+
+def encodeChecked (c : Constant) : Except EncodeError ByteArray :=
+  encodeCheckedWith defaultLimits c
+
+theorem encodeChecked_sound {c : Constant} {bytes : ByteArray}
+    (h : encodeChecked c = .ok bytes) :
+    c.wireWF ∧ checkConstant c = .ok () ∧ bytes = ser c := by
+  unfold encodeChecked at h
+  unfold encodeCheckedWith at h
+  split at h
+  · rename_i hwire
+    cases hlocal : checkConstantWith defaultLimits c with
+    | error error => simp [hlocal] at h
+    | ok result =>
+      cases result
+      simp [hlocal] at h
+      exact ⟨(wireConstantWF_eq_true_iff c).mp hwire,
+        checkConstant_of_checkConstantWith hlocal, h.symm⟩
+  · contradiction
+
+/-- Resource-bounded strict byte decode followed by local semantic
+validation. Parser errors are retained verbatim inside `Error.syntax`;
+post-decode errors are structured and never depend on diagnostic strings. -/
+def decodeCheckedWith (limits : Limits) (bytes : ByteArray) :
+    Except Error Constant := do
+  if bytes.size > limits.maxObjectBytes then
+    throw (.objectTooLarge bytes.size limits.maxObjectBytes)
+  let c ← runDecodeM (getConstantBounded limits) bytes
+  checkConstantWith limits c
+  return c
+
+def decodeChecked (bytes : ByteArray) : Except Error Constant :=
+  decodeCheckedWith defaultLimits bytes
+
+/-- Strict resource-bounded decode for external bytes produced by the pinned
+ixon-v2 writer.  It accepts the writer's deterministic nested-sharing shape
+while retaining structural sharing safety and every local semantic check.
+Callers establishing content identity must additionally use
+`Constant.addressIxonV2CheckedWith`. -/
+def decodeIxonV2CheckedWith (limits : Limits) (bytes : ByteArray) :
+    Except Error Constant := do
+  if bytes.size > limits.maxObjectBytes then
+    throw (.objectTooLarge bytes.size limits.maxObjectBytes)
+  let c ← runDecodeM (getIxonV2ConstantBounded limits) bytes
+  checkIxonV2ConstantWith limits c
+  return c
+
+def decodeIxonV2Checked (bytes : ByteArray) : Except Error Constant :=
+  decodeIxonV2CheckedWith defaultLimits bytes
+
+end Ix.Compiler.Ixon.DecodeCheck
diff --git a/Ix/Compiler/Ixon/Eval.lean b/Ix/Compiler/Ixon/Eval.lean
new file mode 100644
index 000000000..7e3182420
--- /dev/null
+++ b/Ix/Compiler/Ixon/Eval.lean
@@ -0,0 +1,1918 @@
+import Ix.Compiler.Fuel
+import Ix.Compiler.Ixon.Const
+
+/-!
+# The Ixon reference evaluator
+
+The **source-side** semantics for the erasure simulation: the unerased
+twin of `Ix/Compiler/IxIR0/Eval.lean`, in the same house style
+(functional big-step, uniform fuel decrement across the mutual
+functions, `∃ fuel` termination statements). This is the runtime
+anchor for Ixon terms — NOT a defeq/whnf engine (that is Ix.Kernel's and
+lean4ix's job).
+
+Semantics choices:
+
+- **Weak CBV**: `lam` and `all` are closure values (no evaluation
+  under binders, domains stay lazy); lets are strict; application is
+  left-to-right. Types compute for real when they sit in term
+  position: `sort` evaluates its level to a natural (closed levels
+  always reduce to one), `all` becomes a `piV` closure.
+- **Frames**: an expression only means something against its
+  constant's tables, so every closure carries a `Frame` (sharing,
+  refs, univs, block members, universe instantiation). Entering a
+  `ref` switches frames, evaluating the reference's universe
+  arguments in the caller's frame to build the callee's `uinst`.
+  Universe arities are checked at every reference.
+- **Recursor ι is kernel-shaped**: at a saturated recursor, the
+  selected rule's (closed) right-hand side is evaluated in the
+  recursor's frame and applied to `params ++ motives ++ minors ++
+  fields` — indices and the major are not passed, and the ctor
+  value's leading params are dropped. Self-reference inside rules is
+  ordinary `recur` through the block frame (IxIR₀'s recSelf binding
+  is the *erased* target's trick; the source needs none).
+- **Unfolding policy**: `defn` and `thm` definitions unfold; `opaq`
+  and `partial` do not. Authorized opaque/axiom addresses use the external
+  oracle. For an opaque mutual member, the oracle identity is the same
+  synthetic `(block, index)` address emitted into IxIR₀. Unconfigured
+  quotients, opaque definitions, axioms, and inductive types are **neutral**:
+  applying them accumulates a `papV` that never fires — a value, not a stuck
+  state.
+- **Literals**: `.nat`/`.str` carry refs-table indices; the address
+  resolves through a store-blob oracle (`EvalCtx.blobs`). This pins
+  the v2 "blob table" reading: the blob table IS the refs table, and
+  literal payloads are content-addressed store blobs. Byte-level blob
+  canonicalization (trimmed-LE nats, UTF-8) belongs to the store
+  layer; the oracle hands back interpreted values.
+- **Nat identity by address**: literal ι-peeling (`0 ↦ ctor 0`,
+  `n+1 ↦ ctor 1 [lit n]`) activates when `EvalCtx.natBlock` is set —
+  in a nameless world, "this recursor is `Nat.rec`" is a well-known-
+  address configuration, not a name check. Recursor firing checks that its
+  block is that configured address and rejects literal majors for recursors
+  with parameters.
+- **Modes are inert**: `lam`/`all` modes ride in closure values and
+  are never consulted — the source half of "modes don't change
+  semantics".
+
+Configured quotient primitives reduce `Quot.lift/ind` on `Quot.mk` while
+unconfigured quotient addresses retain the neutral behavior. In opt-in open
+evaluation mode, neutral projections and saturated recursor applications
+preserve their elimination spine rather than becoming stuck; strict mode is
+the default and is required by certified erasure. Mutual-member neutral
+identities include their block. Projection reduction also resolves and
+cross-checks its encoded inductive-type reference. Address-configured String
+literal majors expand through the upstream `String.ofList` / `List.cons.{0}` /
+`Char.ofNat` term, with every representation detail evaluated through ordinary
+resolved constants; certified strict mode excludes that source-only extension
+until IxIR₀ represents it. K-like reduction remains deferred because it is a
+defeq rule rather than a runtime one. Recursor firing checks constructor-block
+agreement (and zero parameters for Nat-literal majors):
+besides rejecting malformed untyped runs, that runtime fact is the layout
+equality used when erasure drops constructor parameters and recursor indices.
+-/
+
+namespace Ix.Compiler.Ixon.Eval
+
+/-! ## Universe evaluation -/
+
+/-- Evaluate a level under an instantiation of its variables. Closed
+levels always reduce to a natural. Out-of-range variables read as 0
+(reachable only from a malformed univs table; arities at references
+are checked). -/
+def evalUniv (uinst : List Nat) : Univ → Nat
+  | .zero => 0
+  | .succ u => evalUniv uinst u + 1
+  | .max a b => Nat.max (evalUniv uinst a) (evalUniv uinst b)
+  | .imax a b =>
+    let vb := evalUniv uinst b
+    if vb == 0 then 0 else Nat.max (evalUniv uinst a) vb
+  | .var i => (uinst[i.toNat]?).getD 0
+
+/-! ## Frames, literals, errors -/
+
+/-- The tables an expression is read against, plus the universe
+instantiation of the constant it came from. Closures capture their
+frame; entering a reference builds the callee's. `selfAddr` is the
+address of the mutual block `selfMuts` belongs to (set when the frame
+is built through a block projection) — it gives `recur`-built
+recursor heads their block identity, which literal ι-peeling keys
+on. -/
+structure Frame where
+  sharing : Array Expr := #[]
+  refs : Array Address := #[]
+  univs : Array Univ := #[]
+  selfMuts : Array MutConst := #[]
+  uinst : List Nat := []
+  selfAddr : Option Address := none
+
+def Frame.ofConst (c : Constant) (uinst : List Nat := [])
+    (selfAddr : Option Address := none) : Frame :=
+  { sharing := c.sharing, refs := c.refs, univs := c.univs
+    selfMuts := selfMutsOf c.info, uinst, selfAddr }
+
+inductive Lit where
+  | natL (n : Nat)
+  | strL (s : String)
+  deriving BEq, Repr
+
+/-- A store blob, pre-interpreted (the byte-level codec is the store
+layer's concern). -/
+inductive Blob where
+  | natB (n : Nat)
+  | strB (s : String)
+  deriving BEq, Repr
+
+/-- Well-known constants used by the kernel's String-literal constructor
+expansion.  The evaluator deliberately stores addresses rather than a baked-in
+constructor layout: `String.ofList`, `Char.ofNat`, and the current `String`
+representation remain ordinary resolved constants, so a toolchain address roll
+or representation change is supplied by the caller's environment.
+
+The generated application is exactly
+
+`String.ofList (List.cons.{0} Char (Char.ofNat c) ... (List.nil.{0} Char))`.
+-/
+structure StringLiteralConfig where
+  charType : Address
+  charOfNat : Address
+  stringOfList : Address
+  listNil : Address
+  listCons : Address
+  deriving BEq, Repr
+
+inductive Err where
+  | fuel
+  | stuck (msg : String)
+  | unknownRef (adr : Address)
+  | unknownBlob (adr : Address)
+  | oracleMissing (adr : Address)
+  deriving BEq, Repr
+
+/-! ## Values -/
+
+inductive NeutralId where
+  | const (adr : Address)
+  | member (block : Address) (idx : Nat)
+  /-- A stuck projection elimination. The projected neutral is the first
+  argument of the enclosing `papV`; later applications extend that spine. -/
+  | projection (type : Address) (field : Nat)
+  deriving BEq, Repr
+
+/-- Pre-major arity of a recursor (params + motives + minors +
+indices), plus one for the major premise. -/
+def recArity (r : Recursor) : Nat :=
+  r.params.toNat + r.motives.toNat + r.minors.toNat + r.indices.toNat + 1
+
+/-- Source arities of Lean's four quotient primitives, before erasure. -/
+def quotArity : QuotKind → Nat
+  | .type => 2
+  | .ctor => 3
+  | .lift => 6
+  | .ind => 5
+
+inductive Head where
+  | ctorH (block : Address) (indIdx cidx arity : Nat)
+  /-- `block` is the recursor's mutual-block address when known —
+  literal ι-peeling fires only when it equals the configured
+  `natBlock` (the erased `natLit` flag is set by exactly the same
+  comparison, so the two semantics peel in lockstep). -/
+  | recH (block : Option Address) (recr : Recursor) (F : Frame)
+  /-- Configured opaque/axiom runtime primitive. The explicit arity keeps
+  partial application aligned with the erased `Decl.extern`. -/
+  | extH (address : Address) (arity : Nat)
+  /-- Configured quotient primitive. Saturated `.ctor` applications produce
+  a distinct quotient wrapper; `.lift` and `.ind` inspect that value. -/
+  | quotH (address : Address) (kind : QuotKind)
+  | neuH (id : NeutralId)
+
+def Head.arity? : Head → Option Nat
+  | .ctorH _ _ _ a => some a
+  | .recH _ r _ => some (recArity r)
+  | .extH _ arity => some arity
+  | .quotH _ kind => some (quotArity kind)
+  | .neuH _ => none
+
+inductive Value where
+  | sortV (lvl : Nat)
+  | piV (uses : Uses) (owned : Owned) (F : Frame) (env : List Value)
+      (dom cod : Expr)
+  | closV (uses : Uses) (F : Frame) (env : List Value) (dom body : Expr)
+  | papV (h : Head) (args : List Value)
+  /-- A saturated configured `Quot.mk`. Keeping the wrapper distinct from a
+  pap makes accidental over-application stuck, while eliminators can recover
+  the representative without relying on a hand-constructed argument list. -/
+  | quotV (address : Address) (representative : Value)
+  /-- Constructor application: `args` = param values ++ field values,
+  in application order. -/
+  | ctorV (block : Address) (indIdx cidx : Nat) (args : List Value)
+  | litV (l : Lit)
+
+/-- Runtime-neutral values. A recursor head becomes neutral only after it has
+reached saturation and failed to expose a constructor because its major was
+itself neutral; under-applied recursors remain ordinary function values. -/
+def Value.isNeutral : Value → Bool
+  | .papV (.neuH _) _ => true
+  | .papV (.recH _ r _) args => recArity r ≤ args.length
+  | _ => false
+
+/-- Source extern semantics: pure, partial, and keyed by the same address as
+the erased oracle. A separate simulation witness relates successful source
+and target calls; merely installing an oracle grants no theorem. -/
+abbrev Oracle := Address → List Value → Option Value
+
+structure EvalCtx where
+  resolve : Address → Option Constant
+  blobs : Address → Option Blob := fun _ => none
+  /-- Open-evaluation mode preserves neutral projection and recursor
+  eliminations. Certified erasure uses `false`: its target-side projection
+  safety theorem deliberately covers only strict runtime eliminations. -/
+  preserveNeutralElims : Bool := false
+  /-- Well-known address of the `Nat` mutual block; enables literal
+  ι-peeling at recursors. -/
+  natBlock : Option Address := none
+  /-- Addresses for the kernel's String-literal constructor expansion.  When
+  absent, String literals remain atomic runtime values and cannot be recursor
+  majors.  Certified erasure currently requires this field to be absent. -/
+  stringLiteral : Option StringLiteralConfig := none
+  /-- Trusted identity map for the four quotient primitives. A resolved
+  `.quot` constant computes only when this map assigns its address the same
+  kind stored in the constant; unconfigured quotient constants stay neutral. -/
+  quotientKind : Address → Option QuotKind := fun _ => none
+  /-- Ledger-authorized arity for opaque definitions and axioms. Opaque mutual
+  members use `Address.memberAddr block idx`, exactly matching their erased
+  extern key. An address absent from this map retains the source evaluator's
+  neutral behavior. -/
+  externArity : Address → Option Nat := fun _ => none
+  /-- Pure source oracle. It is called only by an authorized `extH` at exact
+  saturation; semantic correspondence is an explicit simulation premise. -/
+  oracle : Oracle := fun _ _ => none
+
+/-- The source-evaluation mode admitted by certified erasure.  Open neutral
+eliminations and String-literal constructor expansion both add successful
+source behaviors that IxIR₀ does not yet represent, so the proof boundary
+seals both switches together. -/
+structure EvalCtx.Strict (ctx : EvalCtx) : Prop where
+  neutralElims : ctx.preserveNeutralElims = false
+  stringLiterals : ctx.stringLiteral = none
+
+/-! ## Non-recursive helpers -/
+
+def unfoldable (d : Definition) : Bool :=
+  d.kind != .opaq && d.safety != .part
+
+/-- Check that a universe instantiation has the declaration's expected arity.
+Public so semantic-preservation proofs can follow evaluator dispatch exactly. -/
+def guardLvls (lvls : UInt64) (uinst : List Nat) :
+    Except Err Unit :=
+  if uinst.length == lvls.toNat then .ok ()
+  else .error (.stuck
+    s!"universe arity mismatch: expected {lvls.toNat}, got {uinst.length}")
+
+def resolveMut (ctx : EvalCtx) (block : Address) (idx : Nat) :
+    Except Err (Constant × MutConst) :=
+  match ctx.resolve block with
+  | none => .error (.unknownRef block)
+  | some bc =>
+    match (selfMutsOf bc.info)[idx]? with
+    | some m => .ok (bc, m)
+    | none => .error (.stuck s!"mutual block member {idx} out of range")
+
+/-- Resolve the type-reference carried by a projection to the exact inductive
+member it names. This turns the wire-level local index into a runtime layout
+identity before either selecting a constructor field or constructing a neutral
+projection spine. -/
+def resolveProjectionTarget (ctx : EvalCtx) (F : Frame)
+    (typeRefIdx : UInt64) : Except Err (Address × InductiveProj × Inductive) :=
+  match F.refs[typeRefIdx.toNat]? with
+  | none => .error (.stuck
+      s!"projection type ref index {typeRefIdx.toNat} out of range")
+  | some typeAddress =>
+    match ctx.resolve typeAddress with
+    | none => .error (.unknownRef typeAddress)
+    | some typeConstant =>
+      match typeConstant.info with
+      | .iPrj projection =>
+        match resolveMut ctx projection.block projection.idx.toNat with
+        | .ok (_, .indc ind) => .ok (typeAddress, projection, ind)
+        | .ok _ => .error
+            (.stuck "projection type ref targets a non-inductive member")
+        | .error err => .error err
+      | _ => .error
+          (.stuck "projection type ref is not an inductive projection")
+
+/-- Construct a block-qualified neutral mutual-member head. A frame without a
+block address cannot mint a globally meaningful member identity. -/
+def neutralMember (block : Option Address) (idx : Nat) : Except Err Value :=
+  match block with
+  | some address => .ok (.papV (.neuH (.member address idx)) [])
+  | none => .error (.stuck "neutral mutual member has no block identity")
+
+/-- Reduce one projection after its value has been evaluated. Constructor
+selection is guarded by the encoded type identity; neutral inputs retain the
+projection as an explicit elimination head. -/
+def projectValue (ctx : EvalCtx) (F : Frame) (typeRefIdx fieldIdx : UInt64)
+    (value : Value) : Except Err Value :=
+  match resolveProjectionTarget ctx F typeRefIdx with
+  | .error err => .error err
+  | .ok (typeAddress, projection, ind) =>
+    match value with
+    | .ctorV block indIdx _ args =>
+      if block == projection.block && indIdx == projection.idx.toNat then
+        match args[ind.params.toNat + fieldIdx.toNat]? with
+        | some result => .ok result
+        | none => .error
+            (.stuck s!"projection {fieldIdx.toNat} out of range")
+      else
+        .error (.stuck "projection value does not match its type ref")
+    | value =>
+      if value.isNeutral && ctx.preserveNeutralElims then
+        .ok (.papV (.neuH
+          (.projection typeAddress fieldIdx.toNat)) [value])
+      else if let .litV _ := value then
+        .error (.stuck "projection from a literal")
+      else
+        .error (.stuck "projection from a non-constructor value")
+
+/-- In strict runtime mode, every successful projection came from a
+constructor whose block/member identity was cross-checked through the encoded
+type reference. This is the precise boundary consumed by erasure's
+constructor-only projection-safety proof. -/
+theorem projectValue_ok_of_strict {ctx : EvalCtx} {F : Frame}
+    {typeRefIdx fieldIdx : UInt64} {value result : Value}
+    (hstrict : ctx.preserveNeutralElims = false)
+    (hproject : projectValue ctx F typeRefIdx fieldIdx value = .ok result) :
+    ∃ ind blockConstant block indIdx cidx args,
+      resolveMut ctx block indIdx = .ok (blockConstant, .indc ind) ∧
+      value = .ctorV block indIdx cidx args ∧
+      args[ind.params.toNat + fieldIdx.toNat]? = some result := by
+  unfold projectValue resolveProjectionTarget at hproject
+  cases href : F.refs[typeRefIdx.toNat]? with
+  | none =>
+    rw [href] at hproject
+    dsimp only at hproject
+    contradiction
+  | some typeAddress =>
+    rw [href] at hproject
+    dsimp only at hproject
+    cases htype : ctx.resolve typeAddress with
+    | none =>
+      rw [htype] at hproject
+      contradiction
+    | some typeConstant =>
+      rw [htype] at hproject
+      dsimp only at hproject
+      cases hinfo : typeConstant.info with
+      | iPrj projection =>
+        rw [hinfo] at hproject
+        dsimp only at hproject
+        cases hresolve : resolveMut ctx projection.block
+            projection.idx.toNat with
+        | error err =>
+          rw [hresolve] at hproject
+          contradiction
+        | ok pair =>
+          rcases pair with ⟨blockConstant, member⟩
+          rw [hresolve] at hproject
+          cases member with
+          | defn definition => contradiction
+          | recr recursor => contradiction
+          | indc ind =>
+            dsimp only at hproject
+            cases value with
+            | ctorV block indIdx cidx args =>
+              dsimp only at hproject
+              cases hmatches :
+                  block == projection.block &&
+                    indIdx == projection.idx.toNat with
+              | false =>
+                rw [hmatches] at hproject
+                contradiction
+              | true =>
+                rw [hmatches] at hproject
+                have hparts := Bool.and_eq_true_iff.mp hmatches
+                have hblock : block = projection.block :=
+                  beq_iff_eq.mp hparts.1
+                have hidx : indIdx = projection.idx.toNat :=
+                  beq_iff_eq.mp hparts.2
+                cases harg : args[ind.params.toNat + fieldIdx.toNat]? with
+                | none =>
+                  rw [harg] at hproject
+                  contradiction
+                | some projected =>
+                  rw [harg] at hproject
+                  injection hproject with hresult
+                  subst projected
+                  subst block
+                  subst indIdx
+                  exact ⟨ind, blockConstant, projection.block,
+                    projection.idx.toNat, cidx, args, hresolve, rfl, harg⟩
+            | papV head args => simp [hstrict] at hproject
+            | sortV | piV | closV | quotV | litV =>
+              simp [Value.isNeutral, hstrict] at hproject
+      | defn definition => rw [hinfo] at hproject; contradiction
+      | recr recursor => rw [hinfo] at hproject; contradiction
+      | axio ax => rw [hinfo] at hproject; contradiction
+      | quot q => rw [hinfo] at hproject; contradiction
+      | cPrj cp => rw [hinfo] at hproject; contradiction
+      | rPrj rp => rw [hinfo] at hproject; contradiction
+      | dPrj dp => rw [hinfo] at hproject; contradiction
+      | muts members => rw [hinfo] at hproject; contradiction
+
+def evalUnivArgs (F : Frame) (idxs : Array UInt64) :
+    Except Err (List Nat) := do
+  let mut out := []
+  for i in idxs do
+    match F.univs[i.toNat]? with
+    | some u => out := out ++ [evalUniv F.uinst u]
+    | none => throw (.stuck s!"universe index {i.toNat} out of range")
+  return out
+
+/-- View a recursor's major premise as a constructor application,
+peeling Nat literals when `peel` is set — the firing recursor's block
+must be the configured Nat block (mirroring the erased `natLit`
+flag; peeling at an arbitrary recursor would diverge from the erased
+semantics). -/
+def majorCtor (peel : Bool) : Value → Except Err (Nat × List Value)
+  | .ctorV _ _ cidx cargs => .ok (cidx, cargs)
+  | .litV (.natL n) =>
+    if peel then
+      match n with
+      | 0 => .ok (0, [])
+      | n + 1 => .ok (1, [.litV (.natL n)])
+    else .error (.stuck "literal major premise (not the Nat recursor)")
+  | _ => .error (.stuck "recursor major premise is not a constructor")
+
+/-- Check the layout identity that a typed recursor application gets for free.
+A constructor major must come from the firing recursor's mutual block. A Nat
+literal has no stored constructor parameters, so it can only feed a
+zero-parameter recursor. The subsequent `majorCtor` check still rejects every
+other value shape. -/
+def guardRecMajor (block : Option Address) (params : Nat) :
+    Value → Except Err Unit
+  | .ctorV ctorBlock _ _ _ =>
+    if some ctorBlock == block then .ok ()
+    else .error (.stuck "constructor major belongs to a different recursor block")
+  | .litV (.natL _) =>
+    if params == 0 then .ok ()
+    else .error (.stuck "literal major requires a zero-parameter recursor")
+  | _ => .ok ()
+
+/-- Recover the representative stored by a saturated configured `Quot.mk`.
+Only the dedicated wrapper is accepted, so an ordinary or hand-built pap
+cannot masquerade as a quotient package. -/
+def quotientRep? : Value → Option Value
+  | .quotV _ representative => some representative
+  | _ => none
+
+/-- Build the `List Char` tail of the kernel's String-literal expansion using
+an abstract value application operation.  `chars` is supplied in reverse, as
+in the upstream kernel, so each successful step prepends one character and the
+result retains source order. -/
+def applyStringChars
+    (applyValue : Value → Value → Except Err Value)
+    (charOfNat cons : Value) : List Char → Value → Except Err Value
+  | [], list => .ok list
+  | char :: chars, list => do
+      let charValue ← applyValue charOfNat (.litV (.natL char.toNat))
+      let partialCons ← applyValue cons charValue
+      let list ← applyValue partialCons list
+      applyStringChars applyValue charOfNat cons chars list
+
+private theorem bindOk {α β : Type} (a : α) (f : α → Except Err β) :
+    (Except.ok a >>= f) = f a := rfl
+
+private theorem bindErr {α β : Type} (e : Err) (f : α → Except Err β) :
+    ((Except.error e : Except Err α) >>= f) = Except.error e := rfl
+
+/-- Successful character-list construction is preserved when every successful
+application is preserved.  This is the higher-order seam used by evaluator
+fuel monotonicity and sharing coherence. -/
+theorem applyStringChars_map_ok
+    {apply₁ apply₂ : Value → Value → Except Err Value}
+    (happly : ∀ f a v, apply₁ f a = .ok v → apply₂ f a = .ok v)
+    (charOfNat cons : Value) (chars : List Char) (list result : Value)
+    (h : applyStringChars apply₁ charOfNat cons chars list = .ok result) :
+    applyStringChars apply₂ charOfNat cons chars list = .ok result := by
+  induction chars generalizing list with
+  | nil => exact h
+  | cons char chars ih =>
+      simp only [applyStringChars] at h ⊢
+      cases hchar : apply₁ charOfNat (.litV (.natL char.toNat)) with
+      | error err => rw [hchar, bindErr] at h; contradiction
+      | ok charValue =>
+        rw [hchar, bindOk] at h
+        rw [happly _ _ _ hchar, bindOk]
+        cases hpartial : apply₁ cons charValue with
+        | error err => rw [hpartial, bindErr] at h; contradiction
+        | ok partialCons =>
+          rw [hpartial, bindOk] at h
+          rw [happly _ _ _ hpartial, bindOk]
+          cases hlist : apply₁ partialCons list with
+          | error err => rw [hlist, bindErr] at h; contradiction
+          | ok nextList =>
+            rw [hlist, bindOk] at h
+            rw [happly _ _ _ hlist, bindOk]
+            exact ih nextList h
+
+/-- Prepare a recursor major exactly as the upstream kernel prepares a String
+literal: construct the five configured constant heads, build the `List Char`
+spine at universe zero, and evaluate `String.ofList` once.  Abstract callbacks
+keep this definition outside the evaluator's recursive group and expose a
+small proof seam. -/
+def prepareStringMajor
+    (evalReference : Address → List Nat → Except Err Value)
+    (applyValue : Value → Value → Except Err Value)
+    (config : Option StringLiteralConfig) (rawMajor : Value) :
+    Except Err Value :=
+  match rawMajor, config with
+  | .litV (.strL value), some config => do
+      let charType ← evalReference config.charType []
+      let charOfNat ← evalReference config.charOfNat []
+      let stringOfList ← evalReference config.stringOfList []
+      let listNil ← evalReference config.listNil [0]
+      let nil ← applyValue listNil charType
+      let listCons ← evalReference config.listCons [0]
+      let cons ← applyValue listCons charType
+      let list ← applyStringChars applyValue charOfNat cons
+        value.toList.reverse nil
+      applyValue stringOfList list
+  | _, _ => .ok rawMajor
+
+@[simp] theorem prepareStringMajor_none
+    (evalReference : Address → List Nat → Except Err Value)
+    (applyValue : Value → Value → Except Err Value) (rawMajor : Value) :
+    prepareStringMajor evalReference applyValue none rawMajor = .ok rawMajor := by
+  cases rawMajor <;> try rfl
+  case litV literal => cases literal <;> rfl
+
+/-- Successful String-major preparation is preserved by pointwise-preserving
+reference evaluation and application callbacks. -/
+theorem prepareStringMajor_map_ok
+    {evalReference₁ evalReference₂ : Address → List Nat → Except Err Value}
+    {apply₁ apply₂ : Value → Value → Except Err Value}
+    (href : ∀ address uinst value,
+      evalReference₁ address uinst = .ok value →
+        evalReference₂ address uinst = .ok value)
+    (happly : ∀ f a value, apply₁ f a = .ok value →
+      apply₂ f a = .ok value)
+    (config : Option StringLiteralConfig) (rawMajor result : Value)
+    (h : prepareStringMajor evalReference₁ apply₁ config rawMajor =
+      .ok result) :
+    prepareStringMajor evalReference₂ apply₂ config rawMajor = .ok result := by
+  cases rawMajor with
+  | litV literal =>
+      cases literal with
+      | natL n => exact h
+      | strL string =>
+        cases config with
+        | none => exact h
+        | some config =>
+          simp only [prepareStringMajor] at h ⊢
+          cases hcharType : evalReference₁ config.charType [] with
+          | error err => rw [hcharType, bindErr] at h; contradiction
+          | ok charType =>
+            rw [hcharType, bindOk] at h
+            rw [href _ _ _ hcharType, bindOk]
+            cases hcharOfNat : evalReference₁ config.charOfNat [] with
+            | error err => rw [hcharOfNat, bindErr] at h; contradiction
+            | ok charOfNat =>
+              rw [hcharOfNat, bindOk] at h
+              rw [href _ _ _ hcharOfNat, bindOk]
+              cases hstringOfList :
+                  evalReference₁ config.stringOfList [] with
+              | error err =>
+                rw [hstringOfList, bindErr] at h
+                contradiction
+              | ok stringOfList =>
+                rw [hstringOfList, bindOk] at h
+                rw [href _ _ _ hstringOfList, bindOk]
+                cases hlistNil : evalReference₁ config.listNil [0] with
+                | error err => rw [hlistNil, bindErr] at h; contradiction
+                | ok listNil =>
+                  rw [hlistNil, bindOk] at h
+                  rw [href _ _ _ hlistNil, bindOk]
+                  cases hnil : apply₁ listNil charType with
+                  | error err => rw [hnil, bindErr] at h; contradiction
+                  | ok nil =>
+                    rw [hnil, bindOk] at h
+                    rw [happly _ _ _ hnil, bindOk]
+                    cases hlistCons : evalReference₁ config.listCons [0] with
+                    | error err =>
+                      rw [hlistCons, bindErr] at h
+                      contradiction
+                    | ok listCons =>
+                      rw [hlistCons, bindOk] at h
+                      rw [href _ _ _ hlistCons, bindOk]
+                      cases hcons : apply₁ listCons charType with
+                      | error err => rw [hcons, bindErr] at h; contradiction
+                      | ok cons =>
+                        rw [hcons, bindOk] at h
+                        rw [happly _ _ _ hcons, bindOk]
+                        cases hlist : applyStringChars apply₁ charOfNat cons
+                            string.toList.reverse nil with
+                        | error err => rw [hlist, bindErr] at h; contradiction
+                        | ok list =>
+                          rw [hlist, bindOk] at h
+                          rw [applyStringChars_map_ok happly charOfNat cons
+                            string.toList.reverse nil list hlist, bindOk]
+                          exact happly _ _ _ h
+  | sortV | piV | closV | papV | quotV | ctorV => exact h
+
+/-! ## The interpreter -/
+
+mutual
+
+def eval (ctx : EvalCtx) (fuel : Nat) (F : Frame) (env : List Value)
+    (e : Expr) : Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match e with
+    | .var i =>
+      match env[i.toNat]? with
+      | some v => .ok v
+      | none => .error (.stuck s!"unbound de Bruijn index {i.toNat}")
+    | .sort uidx =>
+      match F.univs[uidx.toNat]? with
+      | some u => .ok (.sortV (evalUniv F.uinst u))
+      | none => .error (.stuck s!"sort: universe index {uidx.toNat} out of range")
+    | .nat idx =>
+      match F.refs[idx.toNat]? with
+      | none => .error (.stuck s!"nat literal: ref index {idx.toNat} out of range")
+      | some a =>
+        match ctx.blobs a with
+        | some (.natB n) => .ok (.litV (.natL n))
+        | some (.strB _) => .error (.stuck "nat literal address holds a string blob")
+        | none => .error (.unknownBlob a)
+    | .str idx =>
+      match F.refs[idx.toNat]? with
+      | none => .error (.stuck s!"str literal: ref index {idx.toNat} out of range")
+      | some a =>
+        match ctx.blobs a with
+        | some (.strB s) => .ok (.litV (.strL s))
+        | some (.natB _) => .error (.stuck "str literal address holds a nat blob")
+        | none => .error (.unknownBlob a)
+    | .lam u dom body => .ok (.closV u F env dom body)
+    | .all u o dom cod => .ok (.piV u o F env dom cod)
+    | .letE _ _ val body => do
+      let v ← eval ctx fuel F env val
+      eval ctx fuel F (v :: env) body
+    | .app f a => do
+      let fv ← eval ctx fuel F env f
+      let av ← eval ctx fuel F env a
+      apply ctx fuel fv av
+    | .prj typeRefIdx fieldIdx val => do
+      let value ← eval ctx fuel F env val
+      projectValue ctx F typeRefIdx fieldIdx value
+    | .share i =>
+      match F.sharing[i.toNat]? with
+      | none => .error (.stuck s!"share index {i.toNat} out of range")
+      | some e' => eval ctx fuel F env e'
+    | .ref refIdx univIdxs =>
+      match F.refs[refIdx.toNat]? with
+      | none => .error (.stuck s!"ref index {refIdx.toNat} out of range")
+      | some a => do
+        let uinst' ← evalUnivArgs F univIdxs
+        evalRef ctx fuel a uinst'
+    | .recur recIdx univIdxs => do
+      let uinst' ← evalUnivArgs F univIdxs
+      match F.selfMuts[recIdx.toNat]? with
+      | none => .error (.stuck s!"recur index {recIdx.toNat} out of range")
+      | some (.defn d) => do
+        guardLvls d.lvls uinst'
+        if unfoldable d then
+          eval ctx fuel { F with uinst := uinst' } [] d.value
+        else
+          match F.selfAddr with
+          | none => neutralMember F.selfAddr recIdx.toNat
+          | some block =>
+            let address := Address.memberAddr block recIdx.toNat
+            match ctx.externArity address with
+            | none => neutralMember F.selfAddr recIdx.toNat
+            | some arity => saturate ctx fuel (.extH address arity) []
+      | some (.recr r) => do
+        guardLvls r.lvls uinst'
+        .ok (.papV (.recH F.selfAddr r { F with uinst := uinst' }) [])
+      | some (.indc ind) => do
+        guardLvls ind.lvls uinst'
+        neutralMember F.selfAddr recIdx.toNat
+  termination_by fuel
+
+/-- Evaluate a reference to a resolved address: switch frames,
+dispatch on the constant's shape. -/
+def evalRef (ctx : EvalCtx) (fuel : Nat) (a : Address) (uinst : List Nat) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match ctx.resolve a with
+    | none => .error (.unknownRef a)
+    | some c =>
+      match c.info with
+      | .defn d => do
+        guardLvls d.lvls uinst
+        if unfoldable d then
+          eval ctx fuel (Frame.ofConst c uinst) [] d.value
+        else
+          match ctx.externArity a with
+          | none => .ok (.papV (.neuH (.const a)) [])
+          | some arity => saturate ctx fuel (.extH a arity) []
+      | .axio ax => do
+        guardLvls ax.lvls uinst
+        match ctx.externArity a with
+        | none => .ok (.papV (.neuH (.const a)) [])
+        | some arity => saturate ctx fuel (.extH a arity) []
+      | .quot q => do
+        guardLvls q.lvls uinst
+        match ctx.quotientKind a with
+        | none => .ok (.papV (.neuH (.const a)) [])
+        | some kind =>
+          if kind == q.kind then .ok (.papV (.quotH a kind) [])
+          else .error (.stuck "configured quotient kind mismatch")
+      | .recr r => do
+        guardLvls r.lvls uinst
+        .ok (.papV (.recH (some a) r (Frame.ofConst c uinst (some a))) [])
+      | .iPrj p =>
+        match resolveMut ctx p.block p.idx.toNat with
+        | .ok (_, .indc ind) => do
+          guardLvls ind.lvls uinst
+          .ok (.papV (.neuH (.const a)) [])
+        | .ok _ => .error (.stuck "inductive projection targets a non-inductive")
+        | .error err => .error err
+      | .cPrj p =>
+        match resolveMut ctx p.block p.idx.toNat with
+        | .ok (_, .indc ind) =>
+          match ind.ctors[p.cidx.toNat]? with
+          | none => .error (.stuck "constructor projection out of range")
+          | some ct => do
+            guardLvls ct.lvls uinst
+            saturate ctx fuel
+              (.ctorH p.block p.idx.toNat p.cidx.toNat
+                (ct.params.toNat + ct.fields.toNat)) []
+        | .ok _ => .error (.stuck "constructor projection targets a non-inductive")
+        | .error err => .error err
+      | .rPrj p =>
+        match resolveMut ctx p.block p.idx.toNat with
+        | .ok (bc, .recr r) => do
+          guardLvls r.lvls uinst
+          .ok (.papV
+            (.recH (some p.block) r (Frame.ofConst bc uinst (some p.block)))
+            [])
+        | .ok _ => .error (.stuck "recursor projection targets a non-recursor")
+        | .error err => .error err
+      | .dPrj p =>
+        match resolveMut ctx p.block p.idx.toNat with
+        | .ok (bc, .defn d) => do
+          guardLvls d.lvls uinst
+          if unfoldable d then
+            eval ctx fuel (Frame.ofConst bc uinst (some p.block)) [] d.value
+          else
+            let member := Address.memberAddr p.block p.idx.toNat
+            match ctx.externArity member with
+            | none => .ok (.papV (.neuH (.const a)) [])
+            | some arity => saturate ctx fuel (.extH member arity) []
+        | .ok _ => .error (.stuck "definition projection targets a non-definition")
+        | .error err => .error err
+      | .muts _ => .error (.stuck "direct reference to a mutual block")
+  termination_by fuel
+
+def apply (ctx : EvalCtx) (fuel : Nat) (f a : Value) : Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match f with
+    | .closV _ F env _ body => eval ctx fuel F (a :: env) body
+    | .papV h args => saturate ctx fuel h (args ++ [a])
+    | _ => .error (.stuck "application of a non-function value")
+  termination_by fuel
+
+def applyMany (ctx : EvalCtx) (fuel : Nat) (f : Value) (args : List Value) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match args with
+    | [] => .ok f
+    | a :: rest => do
+      let f' ← apply ctx fuel f a
+      applyMany ctx fuel f' rest
+  termination_by fuel
+
+def saturate (ctx : EvalCtx) (fuel : Nat) (h : Head) (args : List Value) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match h.arity? with
+    | some ar =>
+      if args.length == ar then fire ctx fuel h args
+      else .ok (.papV h args)
+    | none => .ok (.papV h args)
+  termination_by fuel
+
+def fire (ctx : EvalCtx) (fuel : Nat) (h : Head) (args : List Value) :
+    Except Err Value :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match h with
+    | .ctorH block indIdx cidx _ => .ok (.ctorV block indIdx cidx args)
+    | .neuH _ => .ok (.papV h args)
+    | .extH address _ =>
+      match ctx.oracle address args with
+      | some value => .ok value
+      | none => .error (.oracleMissing address)
+    | .quotH address kind =>
+      match kind with
+      | .type => .ok (.papV h args)
+      | .ctor =>
+        match args[2]? with
+        | some representative => .ok (.quotV address representative)
+        | none => .error (.stuck "Quot.mk fired without a representative")
+      | .lift =>
+        match args[3]?, args[5]? with
+        | some fn, some quotient =>
+          match quotientRep? quotient with
+          | some representative => apply ctx fuel fn representative
+          | none => .error (.stuck "Quot.lift argument is not a quotient")
+        | _, _ => .error (.stuck "Quot.lift fired with missing arguments")
+      | .ind =>
+        match args[3]?, args[4]? with
+        | some motive, some quotient =>
+          match quotientRep? quotient with
+          | some representative => apply ctx fuel motive representative
+          | none => .error (.stuck "Quot.ind argument is not a quotient")
+        | _, _ => .error (.stuck "Quot.ind fired with missing arguments")
+    | .recH blk r F =>
+      match args.getLast? with
+      | none => .error (.stuck "recursor fired with no arguments")
+      | some rawMajor => do
+        let major ← prepareStringMajor (evalRef ctx fuel) (apply ctx fuel)
+          ctx.stringLiteral rawMajor
+        if major.isNeutral && ctx.preserveNeutralElims then
+          .ok (.papV (.recH blk r F) args)
+        else do
+            guardRecMajor blk r.params.toNat major
+            let (cidx, cargs) ← majorCtor
+              (blk.isSome && ctx.natBlock == blk) major
+            match r.rules[cidx]? with
+            | none =>
+              .error (.stuck s!"no recursor rule for constructor {cidx}")
+            | some rule =>
+              if cargs.length != r.params.toNat + rule.fields.toNat then
+                .error (.stuck "constructor arity does not match recursor rule")
+              else do
+                let ruleArgs := args.take
+                  (r.params.toNat + r.motives.toNat + r.minors.toNat)
+                let fields := cargs.drop r.params.toNat
+                let rhsV ← eval ctx fuel F [] rule.rhs
+                applyMany ctx fuel rhsV (ruleArgs ++ fields)
+  termination_by fuel
+
+end
+
+/-! ## Fuel monotonicity
+
+Successful evaluation is stable under raising fuel for all six mutually
+recursive evaluator functions. This is the composition principle used by
+sharing/inlining coherence and source-to-erased simulation proofs.
+-/
+
+private def MonoAt (fuel : Nat) : Prop :=
+  (∀ ctx F env e v, eval ctx fuel F env e = .ok v →
+    eval ctx (fuel + 1) F env e = .ok v) ∧
+  (∀ ctx a uinst v, evalRef ctx fuel a uinst = .ok v →
+    evalRef ctx (fuel + 1) a uinst = .ok v) ∧
+  (∀ ctx f a v, apply ctx fuel f a = .ok v →
+    apply ctx (fuel + 1) f a = .ok v) ∧
+  (∀ ctx f args v, applyMany ctx fuel f args = .ok v →
+    applyMany ctx (fuel + 1) f args = .ok v) ∧
+  (∀ ctx h args v, saturate ctx fuel h args = .ok v →
+    saturate ctx (fuel + 1) h args = .ok v) ∧
+  (∀ ctx h args v, fire ctx fuel h args = .ok v →
+    fire ctx (fuel + 1) h args = .ok v)
+
+private theorem monoAt : ∀ fuel, MonoAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx F env e v h; rw [eval.eq_def] at h; simp at h
+    · intro ctx a uinst v h; rw [evalRef.eq_def] at h; simp at h
+    · intro ctx f a v h; rw [apply.eq_def] at h; simp at h
+    · intro ctx f args v h; rw [applyMany.eq_def] at h; simp at h
+    · intro ctx hd args v h; rw [saturate.eq_def] at h; simp at h
+    · intro ctx hd args v h; rw [fire.eq_def] at h; simp at h
+  | succ n ihn =>
+    obtain ⟨ihE, ihR, ihA, ihM, ihS, ihF⟩ := ihn
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx F env e v h
+      cases e with
+      | var i =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | sort i =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | str i =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | nat i =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | lam u dom body =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | all u o dom cod =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | letE nd typ val body =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hv : eval ctx n F env val with
+        | error err => rw [hv, bindErr] at h; contradiction
+        | ok valV =>
+          rw [hv, bindOk] at h
+          rw [ihE _ _ _ _ _ hv, bindOk]
+          exact ihE _ _ _ _ _ h
+      | app fn arg =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hf : eval ctx n F env fn with
+        | error err => rw [hf, bindErr] at h; contradiction
+        | ok fv =>
+          rw [hf, bindOk] at h
+          rw [ihE _ _ _ _ _ hf, bindOk]
+          cases ha : eval ctx n F env arg with
+          | error err => rw [ha, bindErr] at h; contradiction
+          | ok av =>
+            rw [ha, bindOk] at h
+            rw [ihE _ _ _ _ _ ha, bindOk]
+            exact ihA _ _ _ _ h
+      | prj typeIdx fieldIdx val =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hv : eval ctx n F env val with
+        | error err => rw [hv, bindErr] at h; contradiction
+        | ok valV =>
+          rw [hv, bindOk] at h
+          rw [ihE _ _ _ _ _ hv, bindOk]
+          exact h
+      | share i =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hs : F.sharing[i.toNat]? with
+        | none => rw [hs] at h; simp at h
+        | some shared =>
+          rw [hs] at h
+          simp only at h ⊢
+          exact ihE _ _ _ _ _ h
+      | ref refIdx univIdxs =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hr : F.refs[refIdx.toNat]? with
+        | none => rw [hr] at h; simp at h
+        | some address =>
+          rw [hr] at h
+          simp only at h ⊢
+          cases hu : evalUnivArgs F univIdxs with
+          | error err => rw [hu, bindErr] at h; contradiction
+          | ok uinst =>
+            rw [hu, bindOk] at h
+            rw [bindOk]
+            exact ihR _ _ _ _ h
+      | recur recIdx univIdxs =>
+        rw [eval.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hu : evalUnivArgs F univIdxs with
+        | error err => rw [hu, bindErr] at h; contradiction
+        | ok uinst =>
+          rw [hu, bindOk] at h
+          rw [bindOk]
+          cases hm : F.selfMuts[recIdx.toNat]? with
+          | none => rw [hm] at h; simp at h
+          | some member =>
+            rw [hm] at h
+            cases member with
+            | defn d =>
+              simp only at h ⊢
+              cases hg : guardLvls d.lvls uinst with
+              | error err => rw [hg, bindErr] at h; contradiction
+              | ok checked =>
+                rw [hg, bindOk] at h
+                rw [bindOk]
+                cases hu : unfoldable d with
+                | false =>
+                  rw [hu] at h
+                  simp only [Bool.false_eq_true, if_false] at h ⊢
+                  cases hsa : F.selfAddr with
+                  | none =>
+                    rw [hsa] at h
+                    dsimp only at h ⊢
+                    exact h
+                  | some block =>
+                    rw [hsa] at h
+                    dsimp only at h ⊢
+                    cases hext : ctx.externArity
+                        (Address.memberAddr block recIdx.toNat) with
+                    | none =>
+                      rw [hext] at h
+                      dsimp only at h ⊢
+                      exact h
+                    | some arity =>
+                      rw [hext] at h
+                      dsimp only at h ⊢
+                      exact ihS _ _ _ _ h
+                | true =>
+                  rw [hu] at h
+                  simp only [if_true] at h ⊢
+                  exact ihE _ _ _ _ _ h
+            | recr r => simp only at h ⊢; exact h
+            | indc i => simp only at h ⊢; exact h
+    · intro ctx address uinst v h
+      rw [evalRef.eq_def] at h ⊢; dsimp only at h ⊢
+      cases hr : ctx.resolve address with
+      | none => rw [hr] at h; simp at h
+      | some c =>
+        rw [hr] at h
+        simp only at h ⊢
+        cases hi : c.info with
+        | defn d =>
+          rw [hi] at h
+          simp only at h ⊢
+          cases hg : guardLvls d.lvls uinst with
+          | error err => rw [hg, bindErr] at h; contradiction
+          | ok checked =>
+            rw [hg, bindOk] at h
+            rw [bindOk]
+            cases hu : unfoldable d with
+            | false =>
+              rw [hu] at h
+              simp only [Bool.false_eq_true, if_false] at h ⊢
+              cases hext : ctx.externArity address with
+              | none =>
+                rw [hext] at h
+                simpa using h
+              | some arity =>
+                rw [hext] at h
+                simpa using ihS ctx (.extH address arity) [] v h
+            | true =>
+              rw [hu] at h
+              simp only [if_true] at h ⊢
+              exact ihE _ _ _ _ _ h
+        | axio a =>
+          rw [hi] at h
+          simp only at h ⊢
+          cases hg : guardLvls a.lvls uinst with
+          | error err => rw [hg, bindErr] at h; contradiction
+          | ok checked =>
+            rw [hg, bindOk] at h
+            rw [bindOk]
+            cases hext : ctx.externArity address with
+            | none =>
+              rw [hext] at h
+              simpa using h
+            | some arity =>
+              rw [hext] at h
+              simpa using ihS ctx (.extH address arity) [] v h
+        | quot q => rw [hi] at h; simpa using h
+        | recr r => rw [hi] at h; simpa using h
+        | iPrj p => rw [hi] at h; simpa using h
+        | cPrj p =>
+          rw [hi] at h
+          simp only at h ⊢
+          cases hm : resolveMut ctx p.block p.idx.toNat with
+          | error err => rw [hm] at h; simp only at h ⊢; exact h
+          | ok pair =>
+            rw [hm] at h
+            rcases pair with ⟨bc, member⟩
+            cases member with
+            | defn d => simp only at h ⊢; exact h
+            | recr r => simp only at h ⊢; exact h
+            | indc ind =>
+              simp only at h ⊢
+              cases hc : ind.ctors[p.cidx.toNat]? with
+              | none => rw [hc] at h; simp only at h ⊢; exact h
+              | some ct =>
+                rw [hc] at h
+                simp only at h ⊢
+                cases hg : guardLvls ct.lvls uinst with
+                | error err => rw [hg, bindErr] at h; contradiction
+                | ok checked =>
+                  rw [hg, bindOk] at h
+                  rw [bindOk]
+                  exact ihS _ _ _ _ h
+        | rPrj p => rw [hi] at h; simpa using h
+        | dPrj p =>
+          rw [hi] at h
+          simp only at h ⊢
+          cases hm : resolveMut ctx p.block p.idx.toNat with
+          | error err => rw [hm] at h; simp only at h ⊢; exact h
+          | ok pair =>
+            rw [hm] at h
+            rcases pair with ⟨bc, member⟩
+            cases member with
+            | indc i => simp only at h ⊢; exact h
+            | recr r => simp only at h ⊢; exact h
+            | defn d =>
+              simp only at h ⊢
+              cases hg : guardLvls d.lvls uinst with
+              | error err => rw [hg, bindErr] at h; contradiction
+              | ok checked =>
+                rw [hg, bindOk] at h
+                rw [bindOk]
+                cases hu : unfoldable d with
+                | false =>
+                  rw [hu] at h
+                  simp only [Bool.false_eq_true, if_false] at h ⊢
+                  cases hext : ctx.externArity
+                      (Address.memberAddr p.block p.idx.toNat) with
+                  | none =>
+                    rw [hext] at h
+                    dsimp only at h ⊢
+                    exact h
+                  | some arity =>
+                    rw [hext] at h
+                    dsimp only at h ⊢
+                    exact ihS _ _ _ _ h
+                | true =>
+                  rw [hu] at h
+                  simp only [if_true] at h ⊢
+                  exact ihE _ _ _ _ _ h
+        | muts ms => rw [hi] at h; simp at h
+    · intro ctx f a v h
+      cases f with
+      | sortV lvl => rw [apply.eq_def] at h; simp at h
+      | piV u o F env dom cod => rw [apply.eq_def] at h; simp at h
+      | closV u F env dom body =>
+        rw [apply.eq_def] at h ⊢; dsimp only at h ⊢
+        exact ihE _ _ _ _ _ h
+      | papV hd args =>
+        rw [apply.eq_def] at h ⊢; dsimp only at h ⊢
+        exact ihS _ _ _ _ h
+      | quotV address representative => rw [apply.eq_def] at h; simp at h
+      | ctorV block indIdx cidx args => rw [apply.eq_def] at h; simp at h
+      | litV lit => rw [apply.eq_def] at h; simp at h
+    · intro ctx f args v h
+      cases args with
+      | nil => rw [applyMany.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | cons a rest =>
+        rw [applyMany.eq_def] at h ⊢; dsimp only at h ⊢
+        cases ha : apply ctx n f a with
+        | error err => rw [ha, bindErr] at h; contradiction
+        | ok f' =>
+          rw [ha, bindOk] at h
+          rw [ihA _ _ _ _ ha, bindOk]
+          exact ihM _ _ _ _ h
+    · intro ctx hd args v h
+      rw [saturate.eq_def] at h ⊢; dsimp only at h ⊢
+      cases ha : hd.arity? with
+      | none => rw [ha] at h; simp only at h ⊢; exact h
+      | some arity =>
+        rw [ha] at h
+        simp only at h ⊢
+        cases heq : args.length == arity with
+        | false =>
+          rw [heq] at h
+          simp only [Bool.false_eq_true, if_false] at h ⊢
+          exact h
+        | true =>
+          rw [heq] at h
+          simp only [if_true] at h ⊢
+          exact ihF _ _ _ _ h
+    · intro ctx hd args v h
+      cases hd with
+      | ctorH block indIdx cidx arity =>
+        rw [fire.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | neuH id =>
+        rw [fire.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | extH address arity =>
+        rw [fire.eq_def] at h ⊢; dsimp only at h ⊢; exact h
+      | quotH address kind =>
+        rw [fire.eq_def] at h ⊢; dsimp only at h ⊢
+        cases kind with
+        | type | ctor => exact h
+        | lift =>
+          simp only at h ⊢
+          cases hfn : args[3]? with
+          | none =>
+            rw [hfn] at h
+            dsimp only at h ⊢
+            exact h
+          | some fn =>
+            rw [hfn] at h
+            cases hquotient : args[5]? with
+            | none =>
+              rw [hquotient] at h
+              dsimp only at h ⊢
+              exact h
+            | some quotient =>
+              rw [hquotient] at h
+              dsimp only at h ⊢
+              cases hrep : quotientRep? quotient with
+              | none =>
+                rw [hrep] at h
+                dsimp only at h ⊢
+                exact h
+              | some representative =>
+                rw [hrep] at h
+                dsimp only at h ⊢
+                exact ihA _ _ _ _ h
+        | ind =>
+          simp only at h ⊢
+          cases hmotive : args[3]? with
+          | none =>
+            rw [hmotive] at h
+            dsimp only at h ⊢
+            exact h
+          | some motive =>
+            rw [hmotive] at h
+            cases hquotient : args[4]? with
+            | none =>
+              rw [hquotient] at h
+              dsimp only at h ⊢
+              exact h
+            | some quotient =>
+              rw [hquotient] at h
+              dsimp only at h ⊢
+              cases hrep : quotientRep? quotient with
+              | none =>
+                rw [hrep] at h
+                dsimp only at h ⊢
+                exact h
+              | some representative =>
+                rw [hrep] at h
+                dsimp only at h ⊢
+                exact ihA _ _ _ _ h
+      | recH block r F =>
+        rw [fire.eq_def] at h ⊢; dsimp only at h ⊢
+        cases hl : args.getLast? with
+        | none => rw [hl] at h; simp only at h ⊢; exact h
+        | some major =>
+          rw [hl] at h
+          simp only at h ⊢
+          cases hp : prepareStringMajor (evalRef ctx n) (apply ctx n)
+              ctx.stringLiteral major with
+          | error err => rw [hp, bindErr] at h; contradiction
+          | ok prepared =>
+            rw [hp, bindOk] at h
+            have hp' : prepareStringMajor (evalRef ctx (n + 1))
+                (apply ctx (n + 1)) ctx.stringLiteral major = .ok prepared :=
+              prepareStringMajor_map_ok
+                (fun address uinst value href =>
+                  ihR ctx address uinst value href)
+                (fun function argument value happly =>
+                  ihA ctx function argument value happly)
+                ctx.stringLiteral major prepared hp
+            rw [hp', bindOk]
+            cases hn : prepared.isNeutral && ctx.preserveNeutralElims with
+            | true =>
+              simp only [hn] at h ⊢
+              exact h
+            | false =>
+              simp only [hn] at h ⊢
+              cases hg : guardRecMajor block r.params.toNat prepared with
+              | error err => rw [hg, bindErr] at h; contradiction
+              | ok checked =>
+                rw [hg, bindOk] at h
+                rw [bindOk]
+                cases hm : majorCtor
+                    (block.isSome && ctx.natBlock == block) prepared with
+                | error err => rw [hm, bindErr] at h; contradiction
+                | ok pair =>
+                  rcases pair with ⟨cidx, cargs⟩
+                  rw [hm, bindOk] at h
+                  rw [bindOk]
+                  cases hr : r.rules[cidx]? with
+                  | none => rw [hr] at h; simp only at h ⊢; exact h
+                  | some rule =>
+                    rw [hr] at h
+                    simp only at h ⊢
+                    cases heq :
+                        cargs.length != r.params.toNat + rule.fields.toNat with
+                    | false =>
+                      rw [heq] at h
+                      simp only [Bool.false_eq_true, if_false] at h ⊢
+                      cases he : eval ctx n F [] rule.rhs with
+                      | error err => rw [he, bindErr] at h; contradiction
+                      | ok rhsV =>
+                        rw [he, bindOk] at h
+                        rw [ihE _ _ _ _ _ he, bindOk]
+                        exact ihM _ _ _ _ h
+                    | true =>
+                      rw [heq] at h
+                      simp only [if_true] at h ⊢
+                      exact h
+
+theorem eval_mono {ctx : EvalCtx} {fuel fuel' : Nat} {F : Frame}
+    {env : List Value} {e : Expr} {v : Value} (hle : fuel ≤ fuel')
+    (h : eval ctx fuel F env e = .ok v) :
+    eval ctx fuel' F env e = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).1 _ _ _ _ _ hrun) hle h
+
+theorem evalRef_mono {ctx : EvalCtx} {fuel fuel' : Nat} {a : Address}
+    {uinst : List Nat} {v : Value} (hle : fuel ≤ fuel')
+    (h : evalRef ctx fuel a uinst = .ok v) :
+    evalRef ctx fuel' a uinst = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).2.1 _ _ _ _ hrun) hle h
+
+theorem apply_mono {ctx : EvalCtx} {fuel fuel' : Nat} {f a v : Value}
+    (hle : fuel ≤ fuel') (h : apply ctx fuel f a = .ok v) :
+    apply ctx fuel' f a = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).2.2.1 _ _ _ _ hrun) hle h
+
+theorem applyMany_mono {ctx : EvalCtx} {fuel fuel' : Nat} {f : Value}
+    {args : List Value} {v : Value} (hle : fuel ≤ fuel')
+    (h : applyMany ctx fuel f args = .ok v) :
+    applyMany ctx fuel' f args = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).2.2.2.1 _ _ _ _ hrun) hle h
+
+theorem saturate_mono {ctx : EvalCtx} {fuel fuel' : Nat} {h : Head}
+    {args : List Value} {v : Value} (hle : fuel ≤ fuel')
+    (hs : saturate ctx fuel h args = .ok v) :
+    saturate ctx fuel' h args = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).2.2.2.2.1 _ _ _ _ hrun) hle hs
+
+theorem fire_mono {ctx : EvalCtx} {fuel fuel' : Nat} {h : Head}
+    {args : List Value} {v : Value} (hle : fuel ≤ fuel')
+    (hs : fire ctx fuel h args = .ok v) :
+    fire ctx fuel' h args = .ok v := by
+  exact fuel_mono_of_succ
+    (fun current hrun => (monoAt current).2.2.2.2.2 _ _ _ _ hrun) hle hs
+
+/-! ## Entry points -/
+
+def defaultFuel : Nat := 100000
+
+/-- Evaluate a closed expression against a frame. -/
+def evalClosed (ctx : EvalCtx) (F : Frame) (e : Expr)
+    (fuel : Nat := defaultFuel) : Except Err Value :=
+  eval ctx fuel F [] e
+
+/-- Evaluate a definition constant's value under a universe
+instantiation. -/
+def evalConst (ctx : EvalCtx) (c : Constant) (uinst : List Nat := [])
+    (fuel : Nat := defaultFuel) : Except Err Value :=
+  match c.info with
+  | .defn d => eval ctx fuel (Frame.ofConst c uinst) [] d.value
+  | _ => .error (.stuck "evalConst: not a definition")
+
+/-! ## Elaboration-time tests
+
+A hand-written store: the `Nat` mutual block (inductive + recursor
+with real kernel-shaped rules), projection constants for
+`Nat`/`zero`/`succ`/`Nat.rec`, an unerased `add`, literal blobs, a
+2-parameter `Pair` structure, and unfolding-policy probes. Pure — no
+FFI — so the suite runs at elaboration on every build.
+-/
+
+private def addrOf (n : UInt8) : Address :=
+  Address.replicate n
+
+private def aNatBlock := addrOf 0x10
+private def aNat := addrOf 0x11
+private def aZero := addrOf 0x12
+private def aSucc := addrOf 0x13
+private def aNatRec := addrOf 0x14
+private def aAdd := addrOf 0x15
+private def aTwo := addrOf 0x16
+private def aThree := addrOf 0x17
+private def aHello := addrOf 0x18
+private def aAx := addrOf 0x19
+private def aThm := addrOf 0x1A
+private def aOpq := addrOf 0x1B
+private def aPair := addrOf 0x1F
+private def aPairBlock := addrOf 0x20
+private def aMk := addrOf 0x21
+private def aSortAt := addrOf 0x22
+private def aDefBlock := addrOf 0x23
+private def aDPrj := addrOf 0x24
+private def aQuotMk := addrOf 0x25
+private def aQuotLift := addrOf 0x26
+private def aQuotInd := addrOf 0x27
+private def aMissing := addrOf 0x30
+private def aCharBlock := addrOf 0x31
+private def aChar := addrOf 0x32
+private def aCharMk := addrOf 0x33
+private def aCharOfNat := addrOf 0x34
+private def aListBlock := addrOf 0x35
+private def aListNil := addrOf 0x36
+private def aListCons := addrOf 0x37
+private def aStringBlock := addrOf 0x38
+private def aStringMk := addrOf 0x39
+private def aStringOfList := addrOf 0x3A
+private def aStringRec := addrOf 0x3B
+
+private def natInd : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+        typ := .recur 0 #[] },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .all .many .shared (.recur 0 #[]) (.recur 0 #[]) }] }
+
+/-- `fun motive z s => z` -/
+private def natRecZeroRule : RecursorRule :=
+  { fields := 0
+    rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+      (.lam .many (.sort 0) (.var 1))) }
+
+/-- `fun motive z s n => s n (Nat.rec motive z s n)` — the recursive
+reference is `recur 1` (this block's member 1) re-instantiated at the
+block's own universe variable (`univs[0] = var 0`). -/
+private def natRecSuccRule : RecursorRule :=
+  { fields := 1
+    rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+      (.lam .many (.sort 0) (.lam .many (.recur 0 #[])
+        (.app (.app (.var 1) (.var 0))
+          (.app (.app (.app (.app (.recur 1 #[0]) (.var 3)) (.var 2))
+            (.var 1)) (.var 0)))))) }
+
+private def natRec : Recursor :=
+  { k := false, isUnsafe := false, lvls := 1, params := 0, indices := 0
+    motives := 1, minors := 2, typ := .sort 0
+    rules := #[natRecZeroRule, natRecSuccRule] }
+
+private def cNatBlock : Constant :=
+  { info := .muts #[.indc natInd, .recr natRec]
+    sharing := #[], refs := #[], univs := #[.var 0] }
+
+private def prjConst (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def cNat := prjConst (.iPrj { idx := 0, block := aNatBlock })
+private def cZero := prjConst (.cPrj { idx := 0, cidx := 0, block := aNatBlock })
+private def cSucc := prjConst (.cPrj { idx := 0, cidx := 1, block := aNatBlock })
+private def cNatRec := prjConst (.rPrj { idx := 1, block := aNatBlock })
+
+/-- `fun m n => Nat.rec.{1} (fun _ => Nat) m (fun k ih => succ ih) n` —
+refs: 0 = Nat, 1 = zero, 2 = succ, 3 = Nat.rec; `univs[0] = 1` is the
+motive universe instantiation. -/
+private def cAdd : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .shared (.ref 0 #[])
+          (.all .many .shared (.ref 0 #[]) (.ref 0 #[]))
+        value := .lam .many (.ref 0 #[]) (.lam .many (.ref 0 #[])
+          (.app (.app (.app (.app (.ref 3 #[0])
+            (.lam .many (.ref 0 #[]) (.ref 0 #[])))
+            (.var 1))
+            (.lam .many (.ref 0 #[]) (.lam .many (.ref 0 #[])
+              (.app (.ref 2 #[]) (.var 0)))))
+            (.var 0))) }
+    sharing := #[], refs := #[aNat, aZero, aSucc, aNatRec]
+    univs := #[.succ .zero] }
+
+private def cAx : Constant :=
+  { info := .axio { isUnsafe := false, lvls := 0, typ := .sort 0 }
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+private def cThm : Constant :=
+  { info := .defn
+      { kind := .thm, safety := .safe, lvls := 0
+        typ := .ref 0 #[], value := .ref 1 #[] }
+    sharing := #[], refs := #[aNat, aZero], univs := #[] }
+
+private def cOpq : Constant :=
+  { info := .defn
+      { kind := .opaq, safety := .safe, lvls := 0
+        typ := .ref 0 #[], value := .ref 1 #[] }
+    sharing := #[], refs := #[aNat, aZero], univs := #[] }
+
+private def pairInd : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 2, indices := 0
+    typ := .sort 0
+    ctors := #[{ isUnsafe := false, lvls := 0, cidx := 0, params := 2
+                 fields := 2, typ := .sort 0 }] }
+
+private def cPairBlock : Constant :=
+  { info := .muts #[.indc pairInd]
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+private def cPair := prjConst (.iPrj { idx := 0, block := aPairBlock })
+private def cMk := prjConst (.cPrj { idx := 0, cidx := 0, block := aPairBlock })
+
+/-- `Sort u` at its own universe variable: instantiation probe. -/
+private def cSortAt : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 1
+        typ := .sort 0, value := .sort 0 }
+    sharing := #[], refs := #[], univs := #[.var 0] }
+
+/-- A mutual block with one definition member (`succ zero`), reached
+only through a `dPrj`; block refs: 0 = zero, 1 = succ. -/
+private def cDefBlock : Constant :=
+  { info := .muts #[
+      .defn { kind := .defn, safety := .safe, lvls := 0
+              typ := .ref 0 #[]
+              value := .app (.ref 1 #[]) (.ref 0 #[]) }]
+    sharing := #[], refs := #[aZero, aSucc], univs := #[] }
+
+private def cDPrj := prjConst (.dPrj { idx := 0, block := aDefBlock })
+
+/-- Configured quotient primitive stand-ins. -/
+private def cQuotMk : Constant :=
+  { info := .quot { kind := .ctor, lvls := 0, typ := .sort 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cQuotLift : Constant :=
+  { info := .quot { kind := .lift, lvls := 0, typ := .sort 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cQuotInd : Constant :=
+  { info := .quot { kind := .ind, lvls := 0, typ := .sort 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+/-! A small representation-faithful String fixture.  Its definitions are
+deliberately much smaller than the upstream UTF-8 implementation, but the
+constant graph and application telescope are exact: `Char.ofNat`,
+`List.nil/cons.{0}`, then `String.ofList`. -/
+
+private def charInd : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[{ isUnsafe := false, lvls := 0, cidx := 0, params := 0
+                 fields := 1, typ := .sort 0 }] }
+
+private def cCharBlock : Constant :=
+  { info := .muts #[.indc charInd]
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cChar := prjConst (.iPrj { idx := 0, block := aCharBlock })
+private def cCharMk :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aCharBlock })
+
+private def cCharOfNat : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .sort 0
+        value := .lam .many (.sort 0) (.app (.ref 0 #[]) (.var 0)) }
+    sharing := #[], refs := #[aCharMk], univs := #[] }
+
+private def listInd : Inductive :=
+  { isUnsafe := false, lvls := 1, params := 1, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 1, cidx := 0, params := 1, fields := 0
+        typ := .sort 0 },
+      { isUnsafe := false, lvls := 1, cidx := 1, params := 1, fields := 2
+        typ := .sort 0 }] }
+
+private def cListBlock : Constant :=
+  { info := .muts #[.indc listInd]
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cListNil :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aListBlock })
+private def cListCons :=
+  prjConst (.cPrj { idx := 0, cidx := 1, block := aListBlock })
+
+private def stringInd : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[{ isUnsafe := false, lvls := 0, cidx := 0, params := 0
+                 fields := 1, typ := .sort 0 }] }
+
+private def stringRecRule : RecursorRule :=
+  { fields := 1
+    rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+      (.lam .many (.sort 0) (.var 0))) }
+
+private def stringRec : Recursor :=
+  { k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0
+    motives := 1, minors := 1, typ := .sort 0
+    rules := #[stringRecRule] }
+
+private def cStringBlock : Constant :=
+  { info := .muts #[.indc stringInd, .recr stringRec]
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cStringMk :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aStringBlock })
+
+private def cStringOfList : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .sort 0
+        value := .lam .many (.sort 0) (.app (.ref 0 #[]) (.var 0)) }
+    sharing := #[], refs := #[aStringMk], univs := #[] }
+
+private def cStringRec :=
+  prjConst (.rPrj { idx := 1, block := aStringBlock })
+
+private def resolver : Address → Option Constant := fun a =>
+  (([(aNatBlock, cNatBlock), (aNat, cNat), (aZero, cZero), (aSucc, cSucc),
+     (aNatRec, cNatRec), (aAdd, cAdd), (aAx, cAx), (aThm, cThm),
+     (aOpq, cOpq), (aPairBlock, cPairBlock), (aMk, cMk),
+     (aPair, cPair),
+     (aSortAt, cSortAt), (aDefBlock, cDefBlock), (aDPrj, cDPrj),
+     (aQuotMk, cQuotMk), (aQuotLift, cQuotLift),
+     (aQuotInd, cQuotInd),
+     (aCharBlock, cCharBlock), (aChar, cChar), (aCharMk, cCharMk),
+     (aCharOfNat, cCharOfNat), (aListBlock, cListBlock),
+     (aListNil, cListNil), (aListCons, cListCons),
+     (aStringBlock, cStringBlock), (aStringMk, cStringMk),
+     (aStringOfList, cStringOfList), (aStringRec, cStringRec)] :
+      List (Address × Constant)).find?
+    (fun p => p.1 == a)).map (·.2)
+
+private def testBlobs : Address → Option Blob := fun a =>
+  if a == aTwo then some (.natB 2)
+  else if a == aThree then some (.natB 3)
+  else if a == aHello then some (.strB "hello")
+  else none
+
+private def quotientKinds : Address → Option QuotKind := fun address =>
+  if address == aQuotMk then some .ctor
+  else if address == aQuotLift then some .lift
+  else if address == aQuotInd then some .ind
+  else none
+
+private def ctx : EvalCtx :=
+  { resolve := resolver, blobs := testBlobs, natBlock := some aNatBlock
+    quotientKind := quotientKinds }
+
+/-- Test frame refs: 0 = add, 1 = zero, 2 = succ, 3 = blob 2,
+4 = blob 3, 5 = mk, 6 = axiom, 7 = thm, 8 = opaq, 9 = sortAt,
+10 = "hello" blob, 11 = Nat, 12 = unresolvable, 13 = dPrj,
+14 = Quot.mk, 15 = Quot.lift, 16 = Quot.ind, 17 = Pair. -/
+private def testF : Frame :=
+  { refs := #[aAdd, aZero, aSucc, aTwo, aThree, aMk, aAx, aThm, aOpq,
+              aSortAt, aHello, aNat, aMissing, aDPrj, aQuotMk, aQuotLift,
+              aQuotInd, aPair]
+    univs := #[.succ (.succ .zero)]
+    sharing := #[.app (.ref 2 #[]) (.ref 1 #[])] }
+
+private def run (e : Expr) : Except Err Value := evalClosed ctx testF e
+
+private def neutralCtx : EvalCtx :=
+  { ctx with preserveNeutralElims := true }
+
+private def stringConfig : StringLiteralConfig :=
+  { charType := aChar
+    charOfNat := aCharOfNat
+    stringOfList := aStringOfList
+    listNil := aListNil
+    listCons := aListCons }
+
+private def stringCtx : EvalCtx :=
+  { ctx with stringLiteral := some stringConfig }
+
+private def runNeutral (e : Expr) : Except Err Value :=
+  evalClosed neutralCtx testF e
+
+private def natE : Nat → Expr
+  | 0 => .ref 1 #[]
+  | n + 1 => .app (.ref 2 #[]) (natE n)
+
+private def toNatGo : Nat → Value → Option Nat
+  | 0, _ => none
+  | _, .litV (.natL n) => some n
+  | _, .ctorV _ _ 0 [] => some 0
+  | f + 1, .ctorV _ _ 1 [v] => (toNatGo f v).map (· + 1)
+  | _, _ => none
+
+private def runNat? (e : Expr) : Option Nat :=
+  match run e with
+  | .ok v => toNatGo 1000000 v
+  | .error _ => none
+
+private def apps : Expr → List Expr → Expr
+  | function, [] => function
+  | function, argument :: rest => apps (.app function argument) rest
+
+-- β, strict let, sharing table
+#guard runNat? (.app (.lam .many (.sort 0) (.var 0)) (natE 4)) == some 4
+#guard runNat? (.letE false (.sort 0) (natE 2)
+  (.app (.ref 2 #[]) (.var 0))) == some 3
+#guard runNat? (.share 0) == some 1
+
+-- ctor saturation: zero fires at ref-time, succ stays curried
+#guard (match run (.ref 1 #[]) with
+  | .ok (.ctorV _ _ 0 []) => true | _ => false)
+#guard (match run (.ref 2 #[]) with
+  | .ok (.papV (.ctorH _ _ 1 1) []) => true | _ => false)
+
+-- recursor ι through the block, with full universe plumbing
+#guard runNat? (.app (.app (.ref 0 #[]) (natE 2)) (natE 3)) == some 5
+#guard runNat? (.app (.app (.ref 0 #[]) (natE 0)) (natE 0)) == some 0
+#guard runNat? (.app (.app (.ref 0 #[]) (natE 7)) (natE 0)) == some 7
+
+-- malformed untyped majors are rejected before rule dispatch
+#guard (match fire ctx 10 (.recH (some aNatBlock) natRec {})
+    [.ctorV aPairBlock 0 0 []] with
+  | .error (.stuck
+      "constructor major belongs to a different recursor block") => true
+  | _ => false)
+#guard (match fire ctx 10
+    (.recH (some aNatBlock) { natRec with params := 1 } {})
+    [.litV (.natL 0)] with
+  | .error (.stuck "literal major requires a zero-parameter recursor") => true
+  | _ => false)
+
+-- literal blobs and ι-peeling (mixed literal/ctor chains decode)
+#guard runNat? (.nat 3) == some 2
+#guard runNat? (.app (.app (.ref 0 #[]) (.nat 3)) (.nat 4)) == some 5
+#guard runNat? (.app (.app (.ref 0 #[]) (natE 1)) (.nat 4)) == some 4
+#guard (match run (.str 10) with
+  | .ok (.litV (.strL "hello")) => true | _ => false)
+
+private def stringListCodes : Nat → Value → Option (List Nat)
+  | 0, _ => none
+  | _, .ctorV block 0 0 [_] =>
+      if block == aListBlock then some [] else none
+  | fuel + 1, .ctorV block 0 1 [_, .ctorV charBlock 0 0
+      [.litV (.natL codepoint)], tail] =>
+      if block == aListBlock && charBlock == aCharBlock then
+        (stringListCodes fuel tail).map (codepoint :: ·)
+      else none
+  | _, _ => none
+
+private def stringF : Frame :=
+  { refs := #[aStringRec, aHello]
+    univs := #[.zero] }
+
+private def stringLiteralEntry : Expr :=
+  apps (.ref 0 #[]) [.sort 0, .sort 0, .str 1]
+
+-- Exercise the ordinary ref/application/saturation route, not only `fire`.
+#guard (match evalClosed stringCtx stringF stringLiteralEntry with
+  | .ok list => stringListCodes 10 list == some [104, 101, 108, 108, 111]
+  | _ => false)
+
+private def fireStringLiteral (config : Option StringLiteralConfig)
+    (block : Address) (value : String) : Except Err Value :=
+  fire { ctx with stringLiteral := config } 1000
+    (.recH (some block) stringRec
+      (Frame.ofConst cStringBlock [] (some aStringBlock)))
+    [.sortV 0, .sortV 0, .litV (.strL value)]
+
+-- String literal majors follow the upstream constructor-expansion chain.
+#guard (match fireStringLiteral (some stringConfig) aStringBlock "Aé" with
+  | .ok list => stringListCodes 10 list == some [65, 233]
+  | _ => false)
+#guard (match fireStringLiteral (some stringConfig) aStringBlock "" with
+  | .ok list => stringListCodes 10 list == some []
+  | _ => false)
+
+-- Configuration is opt-in, exact-addressed, and ordinary family checking
+-- still rejects a String constructor at a different recursor block.
+#guard (match fireStringLiteral none aStringBlock "A" with
+  | .error (.stuck "recursor major premise is not a constructor") => true
+  | _ => false)
+#guard (match fireStringLiteral
+    (some { stringConfig with charOfNat := aMissing }) aStringBlock "A" with
+  | .error (.unknownRef address) => address == aMissing
+  | _ => false)
+#guard (match fireStringLiteral
+    (some { stringConfig with stringOfList := aNat }) aStringBlock "A" with
+  | .error (.stuck "recursor major premise is not a constructor") => true
+  | _ => false)
+#guard (match fireStringLiteral (some stringConfig) aNatBlock "A" with
+  | .error (.stuck
+      "constructor major belongs to a different recursor block") => true
+  | _ => false)
+
+-- Projections resolve their encoded type reference, cross-check the
+-- constructor family, and skip constructor parameters: mk A B x y.
+private def pairValueSource : Expr :=
+  apps (.ref 5 #[]) [.sort 0, .sort 0, natE 1, natE 2]
+
+#guard runNat? (.prj 17 0 pairValueSource) == some 1
+#guard runNat? (.prj 17 1 pairValueSource) == some 2
+
+#guard (match run (.prj 11 0 pairValueSource) with
+  | .error (.stuck "projection value does not match its type ref") => true
+  | _ => false)
+#guard (match run (.prj 0 0 (natE 0)) with
+  | .error (.stuck
+      "projection type ref is not an inductive projection") => true
+  | _ => false)
+#guard (match run (.prj 99 0 (natE 0)) with
+  | .error (.stuck "projection type ref index 99 out of range") => true
+  | _ => false)
+#guard (match run (.prj 12 0 (natE 0)) with
+  | .error (.unknownRef address) => address == aMissing
+  | _ => false)
+#guard (match run (.prj 11 0 (natE 0)) with
+  | .error (.stuck "projection 0 out of range") => true
+  | _ => false)
+
+-- Open evaluation retains neutral eliminations as explicit pap spines.
+-- Strict evaluation preserves the constructor-only erasure boundary.
+#guard (match runNeutral (.prj 11 0 (.ref 11 #[])) with
+  | .ok (.papV (.neuH (.projection typeAddress 0))
+      [.papV (.neuH (.const sourceAddress)) []]) =>
+    typeAddress == aNat && sourceAddress == aNat
+  | _ => false)
+#guard (match run (.prj 11 0 (.ref 11 #[])) with
+  | .error (.stuck "projection from a non-constructor value") => true
+  | _ => false)
+#guard (match runNeutral
+    (.app (.prj 11 0 (.ref 11 #[])) (natE 0)) with
+  | .ok (.papV (.neuH (.projection typeAddress 0))
+      [.papV (.neuH (.const sourceAddress)) [],
+       .ctorV block 0 0 []]) =>
+    typeAddress == aNat && sourceAddress == aNat && block == aNatBlock
+  | _ => false)
+
+private def neutralMajor : Value :=
+  .papV (.neuH (.const aNat)) []
+
+private def neutralRecArgs : List Value :=
+  [.sortV 0, .sortV 0, .sortV 0, neutralMajor]
+
+#guard Value.isNeutral
+  (.papV (.recH (some aNatBlock) natRec {}) neutralRecArgs)
+#guard !Value.isNeutral
+  (.papV (.recH (some aNatBlock) natRec {}) (neutralRecArgs.take 3))
+#guard (match fire neutralCtx 10 (.recH (some aNatBlock) natRec {})
+    neutralRecArgs with
+  | .ok (.papV (.recH (some block) _ _) args) =>
+    block == aNatBlock && args.length == neutralRecArgs.length
+  | _ => false)
+#guard (match fire ctx 10 (.recH (some aNatBlock) natRec {})
+    neutralRecArgs with
+  | .error (.stuck "recursor major premise is not a constructor") => true
+  | _ => false)
+
+private def neutralMemberFrame (block : Option Address) : Frame :=
+  { selfMuts := #[.indc natInd], selfAddr := block }
+
+#guard (match
+    eval neutralCtx 10 (neutralMemberFrame (some aNatBlock)) [] (.recur 0 #[]),
+    eval neutralCtx 10 (neutralMemberFrame (some aPairBlock)) [] (.recur 0 #[])
+  with
+  | .ok (.papV (.neuH (.member leftBlock 0)) []),
+      .ok (.papV (.neuH (.member rightBlock 0)) []) =>
+    leftBlock == aNatBlock && rightBlock == aPairBlock &&
+      leftBlock != rightBlock
+  | _, _ => false)
+#guard (match eval neutralCtx 10 (neutralMemberFrame none) [] (.recur 0 #[]) with
+  | .error (.stuck "neutral mutual member has no block identity") => true
+  | _ => false)
+
+-- universes: sorts evaluate, instantiation flows through references
+#guard (match run (.sort 0) with | .ok (.sortV 2) => true | _ => false)
+#guard (match run (.ref 9 #[0]) with | .ok (.sortV 2) => true | _ => false)
+
+-- Pi and lam are weak-head values
+#guard (match run (.all .many .shared (.sort 0) (.sort 0)) with
+  | .ok (.piV .many .shared ..) => true | _ => false)
+
+-- unfolding policy: axioms accumulate neutrally, thm unfolds, opaq not
+#guard (match run (.app (.ref 6 #[]) (natE 1)) with
+  | .ok (.papV (.neuH (.const _)) [_]) => true | _ => false)
+#guard (match run (.ref 7 #[]) with
+  | .ok (.ctorV _ _ 0 []) => true | _ => false)
+#guard (match run (.ref 8 #[]) with
+  | .ok (.papV (.neuH (.const _)) []) => true | _ => false)
+
+-- dPrj unfolds its definition member through the block frame
+#guard runNat? (.ref 13 #[]) == some 1
+
+-- Configured quotient ι: both eliminators expose the representative stored
+-- by a saturated Quot.mk. The ind witness is contentful (`succ 1 = 2`).
+private def quotientMkOne : Expr :=
+  apps (.ref 14 #[]) [.sort 0, .sort 0, natE 1]
+
+private def quotientLiftOne : Expr :=
+  apps (.ref 15 #[])
+    [.sort 0, .sort 0, .sort 0,
+      .lam .many (.sort 0) (.var 0), .sort 0, quotientMkOne]
+
+private def quotientIndOne : Expr :=
+  apps (.ref 16 #[])
+    [.sort 0, .sort 0, .sort 0,
+      .lam .many (.sort 0) (.app (.ref 2 #[]) (.var 0)), quotientMkOne]
+
+#guard runNat? quotientLiftOne == some 1
+#guard runNat? quotientIndOne == some 2
+
+-- The semantic hook is address-configured: the same constants remain neutral
+-- in a context that has not authorized quotient primitives.
+private def neutralQuotientCtx : EvalCtx :=
+  { ctx with quotientKind := fun _ => none }
+
+#guard (match evalClosed neutralQuotientCtx testF quotientLiftOne with
+  | .ok (.papV (.neuH (.const address)) args) =>
+    address == aQuotLift && args.length == 6
+  | _ => false)
+
+-- universe arity strictness (sortAt has 1 level, given 0)
+#guard (match run (.ref 9 #[]) with | .error (.stuck _) => true | _ => false)
+
+-- error taxonomy
+#guard (match run (.ref 99 #[]) with | .error (.stuck _) => true | _ => false)
+#guard (match run (.ref 12 #[]) with
+  | .error (.unknownRef _) => true | _ => false)
+#guard (match run (.nat 12) with
+  | .error (.unknownBlob _) => true | _ => false)
+#guard (match run (.app (natE 0) (natE 0)) with
+  | .error (.stuck _) => true | _ => false)
+#guard (match run (.prj 11 0 (.nat 3)) with
+  | .error (.stuck "projection from a literal") => true | _ => false)
+
+-- fuel: Ω diverges; a starved success is `.fuel`, not `.stuck`
+private def delta : Expr := .lam .many (.sort 0) (.app (.var 0) (.var 0))
+#guard (match run (.app delta delta) with
+  | .error .fuel => true | _ => false)
+#guard (match evalClosed ctx testF
+    (.app (.app (.ref 0 #[]) (natE 2)) (natE 3)) (fuel := 10) with
+  | .error .fuel => true | _ => false)
+
+end Ix.Compiler.Ixon.Eval
diff --git a/Ix/Compiler/Ixon/Expr.lean b/Ix/Compiler/Ixon/Expr.lean
new file mode 100644
index 000000000..966fe08b9
--- /dev/null
+++ b/Ix/Compiler/Ixon/Expr.lean
@@ -0,0 +1,2339 @@
+import Ix.Compiler.Ixon.Serialize
+import Ix.Compiler.Ixon.Uses
+
+/-!
+# Ixon expressions, v2
+
+ix's alpha-invariant `Expr` with modes as first-class data on the
+binder nodes: `lam` carries its binder `Uses`; `all` carries binder
+`Uses` and result `Owned`. The Lean 4 fragment is `many` binders with
+`shared` results (`Expr.leanFragment`).
+
+Because the constructors are unified (no separate annotated variants),
+v2 consumes **no new tags**: `Expr` flags stay `0x0`–`0xB`. (The tag
+namespace is shared object-wide: `Const` uses `0xC` for mutual blocks
+and `0xD` for constants, so `0xE`/`0xF` are the truly free flags —
+candidates: borrow node, region node, modal-inductive block.) The
+telescope encodings are ix's, with one mode byte per telescope binder:
+
+- `lam`: `Tag4(LAM, n)`, then per binder `[uses:u8][type]`, then base —
+  uses in the low 2 bits, values `0–3`.
+- `all`: `Tag4(ALL, n)`, then per binder `[mode:u8][type]`, then base —
+  `uses | owned <<< 2`, values `0–7`.
+
+The v1→v2 reencoder is therefore mechanical: insert `0x03` (`many`)
+per lam binder and `0x07` (`many`+`shared`) per all binder.
+
+Decoding is strict beyond `Serialize`'s size canonicity: telescopes
+must be nonempty and maximal (a decoded base may not repeat the
+telescope's constructor), mode bytes must be in range, and `letE`'s
+nonDep flag must be `0` or `1`. Writers use structurally terminating
+spine helpers; the input-driven decoder is fueled by remaining bytes.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-- Expression in the Ixon v2 format. Alpha-invariant: names are
+stripped, presentation metadata lives in the metadata arena (as in ix).
+`str`/`nat` reference the blob table; `ref`/`recur` reference the refs
+table with universe-table instantiation indices; `share` references the
+sharing table. -/
+inductive Expr where
+  | sort : UInt64 → Expr
+  | var : UInt64 → Expr
+  | ref : UInt64 → Array UInt64 → Expr
+  | recur : UInt64 → Array UInt64 → Expr
+  | prj : UInt64 → UInt64 → Expr → Expr
+  | str : UInt64 → Expr
+  | nat : UInt64 → Expr
+  | app : Expr → Expr → Expr
+  | lam : Uses → Expr → Expr → Expr
+  | all : Uses → Owned → Expr → Expr → Expr
+  | letE : Bool → Expr → Expr → Expr → Expr
+  | share : UInt64 → Expr
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+namespace Expr
+
+def FLAG_SORT : UInt8 := 0x0
+def FLAG_VAR : UInt8 := 0x1
+def FLAG_REF : UInt8 := 0x2
+def FLAG_REC : UInt8 := 0x3
+def FLAG_PRJ : UInt8 := 0x4
+def FLAG_STR : UInt8 := 0x5
+def FLAG_NAT : UInt8 := 0x6
+def FLAG_APP : UInt8 := 0x7
+def FLAG_LAM : UInt8 := 0x8
+def FLAG_ALL : UInt8 := 0x9
+def FLAG_LET : UInt8 := 0xA
+def FLAG_SHARE : UInt8 := 0xB
+
+/-- Collect a lambda telescope: binder (uses, type) list plus base. -/
+def collectLam : Expr → List (Uses × Expr) × Expr
+  | .lam u ty body =>
+    let (bs, base) := collectLam body
+    ((u, ty) :: bs, base)
+  | e => ([], e)
+
+/-- Collect an application spine (arguments in application order). -/
+def collectApp : Expr → List Expr × Expr
+  | .app f a =>
+    let (args, base) := collectApp f
+    (args ++ [a], base)
+  | e => ([], e)
+
+/-- The Lean 4 fragment: every binder `many`, every result `shared`. -/
+def leanFragment : Expr → Bool
+  | .lam .many d b => leanFragment d && leanFragment b
+  | .lam .. => false
+  | .all .many .shared d c => leanFragment d && leanFragment c
+  | .all .. => false
+  | .app f a => leanFragment f && leanFragment a
+  | .prj _ _ e => leanFragment e
+  | .letE _ t v b => leanFragment t && leanFragment v && leanFragment b
+  | _ => true
+
+/-- Expression-constructor count, used as the structural termination measure
+for the mutually recursive canonical-spine writers. -/
+def codecSize : Expr → Nat
+  | .sort _ | .var _ | .ref _ _ | .recur _ _ | .str _ | .nat _ | .share _ => 1
+  | .prj _ _ e => e.codecSize + 1
+  | .app f a => f.codecSize + a.codecSize + 1
+  | .lam _ d b | .all _ _ d b => d.codecSize + b.codecSize + 1
+  | .letE _ t v b => t.codecSize + v.codecSize + b.codecSize + 1
+
+def appCount : Expr → Nat
+  | .app f _ => f.appCount + 1
+  | _ => 0
+
+def lamCount : Expr → Nat
+  | .lam _ _ b => b.lamCount + 1
+  | _ => 0
+
+def allCount : Expr → Nat
+  | .all _ _ _ b => b.allCount + 1
+  | _ => 0
+
+/-- Every structural count written through a `UInt64` is representable.
+
+Lean arrays and inductive spines are mathematically unbounded even on a
+64-bit runtime, so this is the exact domain on which encoder-to-decoder
+roundtrip can hold for the v2 count fields. -/
+def wireWF : Expr → Prop
+  | .sort _ | .var _ | .str _ | .nat _ | .share _ => True
+  | .ref _ idxs | .recur _ idxs => idxs.size < UInt64.size
+  | .prj _ _ val => val.wireWF
+  | .app fn arg =>
+    fn.wireWF ∧ arg.wireWF ∧ fn.appCount + 1 < UInt64.size
+  | .lam _ ty body =>
+    ty.wireWF ∧ body.wireWF ∧ body.lamCount + 1 < UInt64.size
+  | .all _ _ ty body =>
+    ty.wireWF ∧ body.wireWF ∧ body.allCount + 1 < UInt64.size
+  | .letE _ ty val body => ty.wireWF ∧ val.wireWF ∧ body.wireWF
+
+end Expr
+
+/-- Canonical concatenation of a universe-index list. -/
+def tag0ListBytes : List UInt64 → ByteArray
+  | [] => ByteArray.empty
+  | idx :: idxs => tag0Bytes ⟨idx⟩ ++ tag0ListBytes idxs
+
+/-- Canonical lambda mode byte. -/
+def lamModeBytes (u : Uses) : ByteArray :=
+  u8Bytes u.toBits
+
+/-- Canonical forall mode byte. -/
+def allModeByte (u : Uses) (o : Owned) : UInt8 :=
+  u.toBits ||| (o.toBits <<< 2)
+
+def allModeBytes (u : Uses) (o : Owned) : ByteArray :=
+  u8Bytes (allModeByte u o)
+
+mutual
+  /-- Pure canonical expression encoder. Exposing bytes independently of the
+  state writer makes exact-output and converse-reader proofs compositional. -/
+  def exprBytes : Expr → ByteArray
+    | .sort idx => tag4Bytes ⟨Expr.FLAG_SORT, idx⟩
+    | .var idx => tag4Bytes ⟨Expr.FLAG_VAR, idx⟩
+    | .ref refIdx univIdxs =>
+      tag4Bytes ⟨Expr.FLAG_REF, univIdxs.size.toUInt64⟩ ++
+        tag0Bytes ⟨refIdx⟩ ++ tag0ListBytes univIdxs.toList
+    | .recur recIdx univIdxs =>
+      tag4Bytes ⟨Expr.FLAG_REC, univIdxs.size.toUInt64⟩ ++
+        tag0Bytes ⟨recIdx⟩ ++ tag0ListBytes univIdxs.toList
+    | .prj typeRefIdx fieldIdx val =>
+      tag4Bytes ⟨Expr.FLAG_PRJ, fieldIdx⟩ ++
+        tag0Bytes ⟨typeRefIdx⟩ ++ exprBytes val
+    | .str refIdx => tag4Bytes ⟨Expr.FLAG_STR, refIdx⟩
+    | .nat refIdx => tag4Bytes ⟨Expr.FLAG_NAT, refIdx⟩
+    | .app f a =>
+      tag4Bytes ⟨Expr.FLAG_APP, (f.appCount + 1).toUInt64⟩ ++
+        appSpineBytes f ++ exprBytes a
+    | .lam u ty body =>
+      tag4Bytes ⟨Expr.FLAG_LAM, (body.lamCount + 1).toUInt64⟩ ++
+        lamModeBytes u ++ exprBytes ty ++ lamTailBytes body
+    | .all u o ty body =>
+      tag4Bytes ⟨Expr.FLAG_ALL, (body.allCount + 1).toUInt64⟩ ++
+        allModeBytes u o ++ exprBytes ty ++ allTailBytes body
+    | .letE nonDep ty val body =>
+      tag4Bytes ⟨Expr.FLAG_LET, if nonDep then 1 else 0⟩ ++
+        exprBytes ty ++ exprBytes val ++ exprBytes body
+    | .share idx => tag4Bytes ⟨Expr.FLAG_SHARE, idx⟩
+  termination_by e => (e.codecSize, 0)
+  decreasing_by
+    all_goals apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+
+  /-- Application base followed by arguments in source order. -/
+  def appSpineBytes : Expr → ByteArray
+    | .app f a => appSpineBytes f ++ exprBytes a
+    | base => exprBytes base
+  termination_by e => (e.codecSize, 1)
+  decreasing_by
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+
+  /-- Remaining lambda binders followed by the non-lambda body. -/
+  def lamTailBytes : Expr → ByteArray
+    | .lam u ty body =>
+      lamModeBytes u ++ exprBytes ty ++ lamTailBytes body
+    | base => exprBytes base
+  termination_by e => (e.codecSize, 1)
+  decreasing_by
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+
+  /-- Remaining forall binders followed by the non-forall codomain. -/
+  def allTailBytes : Expr → ByteArray
+    | .all u o ty body =>
+      allModeBytes u o ++ exprBytes ty ++ allTailBytes body
+    | base => exprBytes base
+  termination_by e => (e.codecSize, 1)
+  decreasing_by
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+end
+
+/-- Total expression writer over the pure canonical encoder. -/
+def putExpr (e : Expr) : PutM Unit := putBytes (exprBytes e)
+
+theorem putExpr_spec (e : Expr) : PutSpec (putExpr e) (exprBytes e) :=
+  putBytes_spec _
+
+def getTag0List : Nat → GetM (List UInt64)
+  | 0 => pure []
+  | count + 1 => do
+    let idx := (← getTag0).size
+    return idx :: (← getTag0List count)
+
+def getLamMode : GetM Uses := do
+  let mb ← getU8
+  match Uses.ofBits? mb with
+  | none => throw s!"getExpr: invalid lam mode byte {mb}"
+  | some u => return u
+
+def getAllMode : GetM (Uses × Owned) := do
+  let mb ← getU8
+  if mb >= 8 then throw s!"getExpr: invalid all mode byte {mb}"
+  match Uses.ofBits? (mb &&& 0x3), Owned.ofBits? (mb >>> 2) with
+  | some u, some o => return (u, o)
+  | _, _ => throw s!"getExpr: invalid all mode byte {mb}"
+
+/-- Parse `extra + 1` flattened application arguments. The base check occurs
+at the unique innermost step. -/
+def getAppRunSucc (recur : GetM Expr) : Nat → GetM Expr
+  | 0 => do
+    let base ← recur
+    match base with
+    | .app .. => throw "getExpr: non-canonical app base"
+    | _ =>
+      let arg ← recur
+      return .app base arg
+  | extra + 1 => do
+    let fn ← getAppRunSucc recur extra
+    let arg ← recur
+    return .app fn arg
+
+def getAppRun (recur : GetM Expr) : Nat → GetM Expr
+  | 0 => throw "getExpr: empty app spine"
+  | count + 1 => getAppRunSucc recur count
+
+/-- Parse `extra + 1` flattened lambda binders, checking the body only at the
+unique innermost step. -/
+def getLamRunSucc (recur : GetM Expr) : Nat → GetM Expr
+  | 0 => do
+    let u ← getLamMode
+    let ty ← recur
+    let body ← recur
+    match body with
+    | .lam .. => throw "getExpr: non-canonical lam telescope"
+    | _ => return .lam u ty body
+  | extra + 1 => do
+    let u ← getLamMode
+    let ty ← recur
+    return .lam u ty (← getLamRunSucc recur extra)
+
+def getLamRun (recur : GetM Expr) : Nat → GetM Expr
+  | 0 => throw "getExpr: empty lam telescope"
+  | count + 1 => getLamRunSucc recur count
+
+/-- Parse `extra + 1` flattened forall binders, checking the codomain only at
+the unique innermost step. -/
+def getAllRunSucc (recur : GetM Expr) : Nat → GetM Expr
+  | 0 => do
+    let (u, o) ← getAllMode
+    let ty ← recur
+    let body ← recur
+    match body with
+    | .all .. => throw "getExpr: non-canonical all telescope"
+    | _ => return .all u o ty body
+  | extra + 1 => do
+    let (u, o) ← getAllMode
+    let ty ← recur
+    return .all u o ty (← getAllRunSucc recur extra)
+
+def getAllRun (recur : GetM Expr) : Nat → GetM Expr
+  | 0 => throw "getExpr: empty all telescope"
+  | count + 1 => getAllRunSucc recur count
+
+/-- Interpret one already-decoded expression header. -/
+def getExprTag (recur : GetM Expr) (tag : Tag4) : GetM Expr := do
+  match tag.flag with
+  | 0x0 => return .sort tag.size
+  | 0x1 => return .var tag.size
+  | 0x2 => do
+    let refIdx := (← getTag0).size
+    return .ref refIdx (← getTag0List tag.size.toNat).toArray
+  | 0x3 => do
+    let recIdx := (← getTag0).size
+    return .recur recIdx (← getTag0List tag.size.toNat).toArray
+  | 0x4 => do
+    let typeRefIdx := (← getTag0).size
+    return .prj typeRefIdx tag.size (← recur)
+  | 0x5 => return .str tag.size
+  | 0x6 => return .nat tag.size
+  | 0x7 => getAppRun recur tag.size.toNat
+  | 0x8 => getLamRun recur tag.size.toNat
+  | 0x9 => getAllRun recur tag.size.toNat
+  | 0xA => do
+    if tag.size > 1 then throw s!"getExpr: invalid letE nonDep {tag.size}"
+    let nonDep := tag.size == 1
+    let ty ← recur
+    let val ← recur
+    return .letE nonDep ty val (← recur)
+  | 0xB => return .share tag.size
+  | f => throw s!"getExpr: invalid flag {f}"
+
+def getExprFuel : Nat → GetM Expr
+  | 0 => throw "getExpr: recursion limit"
+  | fuel + 1 => do
+    let tag ← getTag4
+    getExprTag (getExprFuel fuel) tag
+
+def getExpr : GetM Expr := do
+  let st ← get
+  getExprFuel (st.bytes.size - st.idx + 1)
+
+instance : Serialize Expr where
+  put := putExpr
+  get := getExpr
+
+namespace ExprLaws
+
+attribute [local simp] tag0ListBytes
+
+theorem GetSpec.map {get : GetM α} {input : ByteArray} {value : α}
+    (h : GetSpec get input value) (f : α → β) :
+    GetSpec (f <$> get) input (f value) := by
+  let finish : α → GetM β := fun decoded => pure (f decoded)
+  have hfinish : GetSpec (finish value) ByteArray.empty (f value) :=
+    GetSpec.pure _
+  have htotal := GetSpec.bind (next := finish) h hfinish
+  simpa [finish] using htotal
+
+theorem GetCanonical.bind_inv {get : GetM α} {next : α → GetM β}
+    {encode : α → ByteArray} (hget : GetCanonical get encode)
+    (pre rest : ByteArray) {result : β} {st' : GetState}
+    (h : (get >>= next).run ⟨pre ++ rest, pre.size⟩ = .ok (result, st')) :
+    ∃ value after,
+      rest = encode value ++ after ∧
+      (next value).run
+        ⟨(pre ++ encode value) ++ after, (pre ++ encode value).size⟩ =
+          .ok (result, st') := by
+  simp only [StateT.run_bind] at h
+  cases hg : get.run ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hg] at h
+    contradiction
+  | ok valueState =>
+    rcases valueState with ⟨value, afterValue⟩
+    rw [hg] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨after, hrest, hstate⟩ := hget pre rest hg
+    refine ⟨value, after, hrest, ?_⟩
+    rw [hstate] at h
+    simpa [hrest, ByteArray.append_assoc,
+      ByteArray.size_append] using h
+
+theorem getTag0List_spec (idxs : List UInt64) :
+    GetSpec (getTag0List idxs.length) (tag0ListBytes idxs) idxs := by
+  induction idxs with
+  | nil => exact GetSpec.pure []
+  | cons idx idxs ih =>
+    intro pre suffix
+    simp only [List.length_cons, getTag0List, StateT.run_bind]
+    have hbytes :
+        pre ++ tag0ListBytes (idx :: idxs) ++ suffix =
+          pre ++ tag0Bytes ⟨idx⟩ ++ (tag0ListBytes idxs ++ suffix) := by
+      simp [tag0ListBytes, ByteArray.append_assoc]
+    rw [hbytes]
+    rw [getTag0_encoded_spec ⟨idx⟩ pre (tag0ListBytes idxs ++ suffix)]
+    simp only [bind, Except.bind]
+    have htail := ih (pre ++ tag0Bytes ⟨idx⟩) suffix
+    have htail' :
+        (getTag0List idxs.length).run
+            ⟨pre ++ tag0Bytes ⟨idx⟩ ++ (tag0ListBytes idxs ++ suffix),
+              pre.size + (tag0Bytes ⟨idx⟩).size⟩ =
+          .ok (idxs,
+            ⟨pre ++ tag0Bytes ⟨idx⟩ ++ (tag0ListBytes idxs ++ suffix),
+              pre.size + (tag0Bytes ⟨idx⟩).size +
+                (tag0ListBytes idxs).size⟩) := by
+      simpa [ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc] using htail
+    rw [htail']
+    simp [tag0ListBytes, ByteArray.size_append, Nat.add_assoc]
+    rfl
+
+theorem getTag0List_canonical (count : Nat) :
+    GetCanonical (getTag0List count) tag0ListBytes := by
+  induction count with
+  | zero =>
+    intro pre rest value st' h
+    simp [getTag0List] at h
+    cases h
+    exact ⟨rest, by simp [tag0ListBytes], by simp [tag0ListBytes]⟩
+  | succ count ih =>
+    intro pre rest value st' h
+    simp only [getTag0List, StateT.run_bind] at h
+    cases hh : getTag0.run ⟨pre ++ rest, pre.size⟩ with
+    | error err =>
+      rw [hh] at h
+      contradiction
+    | ok result =>
+      rcases result with ⟨tag, afterHead⟩
+      rw [hh] at h
+      simp only [bind, Except.bind] at h
+      obtain ⟨afterHeadBytes, hrestHead, hafterHead⟩ :=
+        getTag0_canonical pre rest hh
+      let headPre := pre ++ tag0Bytes tag
+      have hafterHead' :
+          afterHead = ⟨headPre ++ afterHeadBytes, headPre.size⟩ := by
+        rw [hafterHead]
+        simp [headPre, hrestHead, ByteArray.append_assoc]
+      rw [hafterHead'] at h
+      cases ht : (getTag0List count).run
+          ⟨headPre ++ afterHeadBytes, headPre.size⟩ with
+      | error err =>
+        rw [ht] at h
+        contradiction
+      | ok tailResult =>
+        rcases tailResult with ⟨tail, afterTail⟩
+        rw [ht] at h
+        simp at h
+        cases h
+        obtain ⟨suffix, hrestTail, hafterTail⟩ :=
+          ih headPre afterHeadBytes ht
+        refine ⟨suffix, ?_, ?_⟩
+        · rw [hrestHead, hrestTail]
+          simp [tag0ListBytes, ByteArray.append_assoc]
+        · simpa [headPre, hrestHead, hrestTail, tag0ListBytes,
+            ByteArray.append_assoc, ByteArray.size_append,
+            Nat.add_assoc] using hafterTail
+
+theorem getTag0List_success_length (count : Nat) :
+    ∀ (initial : GetState) {idxs : List UInt64} {st' : GetState},
+      (getTag0List count).run initial = .ok (idxs, st') →
+      idxs.length = count := by
+  induction count with
+  | zero =>
+    intro initial idxs st' h
+    simp [getTag0List] at h
+    cases h
+    rfl
+  | succ count ih =>
+    intro initial idxs st' h
+    simp only [getTag0List, StateT.run_bind] at h
+    cases hh : getTag0.run initial with
+    | error err => rw [hh] at h; contradiction
+    | ok headState =>
+      rcases headState with ⟨head, afterHead⟩
+      rw [hh] at h
+      simp only [bind, Except.bind] at h
+      cases ht : (getTag0List count).run afterHead with
+      | error err => rw [ht] at h; contradiction
+      | ok tailState =>
+        rcases tailState with ⟨tail, afterTail⟩
+        rw [ht] at h
+        simp at h
+        cases h
+        simp [ih afterHead ht]
+
+theorem uses_byte_eq_of_decode {mb : UInt8} {u : Uses}
+    (h : Uses.ofBits? mb = some u) : mb = u.toBits := by
+  cases u <;> simp only [Uses.ofBits?] at h
+  all_goals split at h <;> simp_all [Uses.toBits]
+
+theorem owned_byte_eq_of_decode {mb : UInt8} {o : Owned}
+    (h : Owned.ofBits? mb = some o) : mb = o.toBits := by
+  cases o <;> simp only [Owned.ofBits?] at h
+  all_goals split at h <;> simp_all [Owned.toBits]
+
+private theorem u8_split_low2 (byte : UInt8) :
+    ((byte >>> 2) <<< 2) ||| (byte &&& 0x3) = byte := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_or, UInt8.toBitVec_and,
+    UInt8.toBitVec_shiftLeft, UInt8.toBitVec_shiftRight,
+    BitVec.getElem_or, BitVec.getElem_and, UInt8.toBitVec_ofNat]
+  have hiCases :
+      i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 ∨ i = 4 ∨ i = 5 ∨ i = 6 ∨ i = 7 := by
+    omega
+  rcases hiCases with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+theorem getLamMode_spec (u : Uses) :
+    GetSpec getLamMode (lamModeBytes u) u := by
+  intro pre suffix
+  simp only [getLamMode, lamModeBytes, StateT.run_bind]
+  rw [getU8_spec u.toBits pre suffix]
+  simp only [bind, Except.bind]
+  rw [Uses.ofBits?_toBits]
+  rfl
+
+theorem allModeByte_lt_eight (u : Uses) (o : Owned) :
+    allModeByte u o < 8 := by
+  cases u <;> cases o <;> decide
+
+theorem getAllMode_spec (u : Uses) (o : Owned) :
+    GetSpec getAllMode (allModeBytes u o) (u, o) := by
+  intro pre suffix
+  simp only [getAllMode, allModeBytes, StateT.run_bind]
+  rw [getU8_spec (allModeByte u o) pre suffix]
+  simp only [bind, Except.bind]
+  have hnot : ¬allModeByte u o >= 8 := by
+    cases u <;> cases o <;> decide
+  simp only [hnot, if_false]
+  cases u <;> cases o <;> simp [allModeByte, Uses.ofBits?, Owned.ofBits?]
+  all_goals rfl
+
+theorem getLamMode_canonical : GetCanonical getLamMode lamModeBytes := by
+  intro pre rest u st' h
+  simp only [getLamMode, StateT.run_bind] at h
+  cases hb : getU8.run ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hb] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨mb, afterByte⟩
+    rw [hb] at h
+    simp only [bind, Except.bind] at h
+    cases hm : Uses.ofBits? mb with
+    | none =>
+      simp [hm] at h
+      change (Except.error _) = Except.ok (u, st') at h
+      contradiction
+    | some decoded =>
+      simp [hm] at h
+      cases h
+      obtain ⟨suffix, hrest, hstate⟩ := getU8_canonical pre rest hb
+      have hmb := uses_byte_eq_of_decode hm
+      subst mb
+      exact ⟨suffix, by simpa [lamModeBytes] using hrest,
+        by simpa [lamModeBytes] using hstate⟩
+
+theorem all_mode_byte_eq_of_decode {mb : UInt8} {u : Uses} {o : Owned}
+    (_hlt : mb < 8)
+    (hu : Uses.ofBits? (mb &&& 0x3) = some u)
+    (ho : Owned.ofBits? (mb >>> 2) = some o) :
+    mb = allModeByte u o := by
+  have hu' := uses_byte_eq_of_decode hu
+  have ho' := owned_byte_eq_of_decode ho
+  change mb = u.toBits ||| (o.toBits <<< 2)
+  rw [← hu', ← ho']
+  exact (u8_split_low2 mb).symm.trans (UInt8.or_comm _ _)
+
+theorem getAllMode_canonical :
+    GetCanonical getAllMode (fun mode => allModeBytes mode.1 mode.2) := by
+  intro pre rest mode st' h
+  simp only [getAllMode, StateT.run_bind] at h
+  cases hb : getU8.run ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hb] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨mb, afterByte⟩
+    rw [hb] at h
+    simp only [bind, Except.bind] at h
+    by_cases hbad : mb >= 8
+    · simp [hbad] at h
+      change (Except.error _) = Except.ok (mode, st') at h
+      contradiction
+    · simp only [hbad, if_false] at h
+      cases hu : Uses.ofBits? (mb &&& 0x3) with
+      | none =>
+        simp [hu] at h
+        change (Except.error _) = Except.ok (mode, st') at h
+        contradiction
+      | some u =>
+        cases ho : Owned.ofBits? (mb >>> 2) with
+        | none =>
+          simp [hu, ho] at h
+          change (Except.error _) = Except.ok (mode, st') at h
+          contradiction
+        | some o =>
+          simp [hu, ho] at h
+          cases h
+          obtain ⟨suffix, hrest, hstate⟩ := getU8_canonical pre rest hb
+          have hlt : mb < 8 := by
+            rw [UInt8.lt_iff_toNat_lt]
+            change mb.toNat < 8
+            have hbad' : ¬(8 : UInt8) ≤ mb := hbad
+            rw [UInt8.le_iff_toNat_le] at hbad'
+            change ¬8 ≤ mb.toNat at hbad'
+            omega
+          have hmb := all_mode_byte_eq_of_decode hlt hu ho
+          subst mb
+          exact ⟨suffix, by simpa [allModeBytes] using hrest,
+            by simpa [allModeBytes] using hstate⟩
+
+def AppBase : Expr → Prop
+  | .app .. => False
+  | _ => True
+
+def LamBase : Expr → Prop
+  | .lam .. => False
+  | _ => True
+
+def AllBase : Expr → Prop
+  | .all .. => False
+  | _ => True
+
+theorem getAppRunSucc_zero_of_specs (recur : GetM Expr)
+    (base arg : Expr) (hbase : AppBase base)
+    (hbaseSpec : GetSpec recur (exprBytes base) base)
+    (hargSpec : GetSpec recur (exprBytes arg) arg) :
+    GetSpec (getAppRunSucc recur 0)
+      (exprBytes base ++ exprBytes arg) (.app base arg) := by
+  let finish : Expr → Expr → GetM Expr := fun decodedBase decodedArg =>
+    pure (.app decodedBase decodedArg)
+  have hfinish : GetSpec (finish base arg) ByteArray.empty (.app base arg) := by
+    exact GetSpec.pure _
+  have harg := GetSpec.bind (next := finish base) hargSpec hfinish
+  simp only [ByteArray.append_empty] at harg
+  let afterBase : Expr → GetM Expr := fun decoded =>
+    match decoded with
+    | .app .. => throw "getExpr: non-canonical app base"
+    | _ => recur >>= finish decoded
+  have hafter : GetSpec (afterBase base) (exprBytes arg) (.app base arg) := by
+    cases base <;> simp_all [AppBase, afterBase, finish]
+  have htotal := GetSpec.bind (next := afterBase) hbaseSpec hafter
+  have hrun : getAppRunSucc recur 0 = recur >>= afterBase := by
+    funext st
+    simp [getAppRunSucc, afterBase, finish]
+  rw [hrun]
+  exact htotal
+
+theorem getAppRunSucc_step_of_specs (recur : GetM Expr)
+    (fn arg : Expr) (count : Nat)
+    (hfn : GetSpec (getAppRunSucc recur count)
+      (appSpineBytes fn) fn)
+    (harg : GetSpec recur (exprBytes arg) arg) :
+    GetSpec (getAppRunSucc recur (count + 1))
+      (appSpineBytes fn ++ exprBytes arg) (.app fn arg) := by
+  let finish : Expr → Expr → GetM Expr := fun decodedFn decodedArg =>
+    pure (.app decodedFn decodedArg)
+  have hfinish : GetSpec (finish fn arg) ByteArray.empty (.app fn arg) :=
+    GetSpec.pure _
+  have hright := GetSpec.bind (next := finish fn) harg hfinish
+  simp only [ByteArray.append_empty] at hright
+  let afterFn : Expr → GetM Expr := fun decodedFn =>
+    recur >>= finish decodedFn
+  have hafter : GetSpec (afterFn fn) (exprBytes arg) (.app fn arg) := by
+    simpa [afterFn, finish] using hright
+  have htotal := GetSpec.bind (next := afterFn) hfn hafter
+  simpa [getAppRunSucc, afterFn, finish] using htotal
+
+theorem getLamRunSucc_zero_of_specs (recur : GetM Expr)
+    (u : Uses) (ty body : Expr) (hbody : LamBase body)
+    (hty : GetSpec recur (exprBytes ty) ty)
+    (hbodySpec : GetSpec recur (exprBytes body) body) :
+    GetSpec (getLamRunSucc recur 0)
+      (lamModeBytes u ++ exprBytes ty ++ exprBytes body)
+      (.lam u ty body) := by
+  let finish : Uses → Expr → Expr → GetM Expr :=
+      fun decodedU decodedTy decodedBody =>
+    match decodedBody with
+    | .lam .. => throw "getExpr: non-canonical lam telescope"
+    | _ => pure (.lam decodedU decodedTy decodedBody)
+  have hfinish :
+      GetSpec (finish u ty body) ByteArray.empty (.lam u ty body) := by
+    cases body <;> simp_all [LamBase, finish] <;> exact GetSpec.pure _
+  have hbody' := GetSpec.bind (next := finish u ty) hbodySpec hfinish
+  simp only [ByteArray.append_empty] at hbody'
+  let afterTy : Uses → Expr → GetM Expr := fun decodedU decodedTy =>
+    recur >>= finish decodedU decodedTy
+  have hafterTy :
+      GetSpec (afterTy u ty) (exprBytes body) (.lam u ty body) := by
+    simpa [afterTy, finish] using hbody'
+  have hchildren := GetSpec.bind (next := afterTy u) hty hafterTy
+  let afterMode : Uses → GetM Expr := fun decodedU =>
+    recur >>= afterTy decodedU
+  have hafterMode :
+      GetSpec (afterMode u) (exprBytes ty ++ exprBytes body)
+        (.lam u ty body) := by
+    simpa [afterMode, afterTy] using hchildren
+  have htotal := GetSpec.bind (next := afterMode) (getLamMode_spec u) hafterMode
+  have hrun : getLamRunSucc recur 0 = getLamMode >>= afterMode := by
+    funext st
+    simp [getLamRunSucc, afterMode, afterTy, finish]
+  rw [hrun]
+  simpa [ByteArray.append_assoc] using htotal
+
+theorem getLamRunSucc_step_of_specs (recur : GetM Expr)
+    (u : Uses) (ty body : Expr) (count : Nat)
+    (hty : GetSpec recur (exprBytes ty) ty)
+    (htail : GetSpec (getLamRunSucc recur count)
+      (lamTailBytes body) body) :
+    GetSpec (getLamRunSucc recur (count + 1))
+      (lamModeBytes u ++ exprBytes ty ++ lamTailBytes body)
+      (.lam u ty body) := by
+  let finish : Uses → Expr → Expr → GetM Expr :=
+      fun decodedU decodedTy decodedBody =>
+    pure (.lam decodedU decodedTy decodedBody)
+  have hfinish :
+      GetSpec (finish u ty body) ByteArray.empty (.lam u ty body) :=
+    GetSpec.pure _
+  have htail' := GetSpec.bind (next := finish u ty) htail hfinish
+  simp only [ByteArray.append_empty] at htail'
+  let afterTy : Uses → Expr → GetM Expr := fun decodedU decodedTy =>
+    getLamRunSucc recur count >>= finish decodedU decodedTy
+  have hafterTy :
+      GetSpec (afterTy u ty) (lamTailBytes body) (.lam u ty body) := by
+    simpa [afterTy, finish] using htail'
+  have hchildren := GetSpec.bind (next := afterTy u) hty hafterTy
+  let afterMode : Uses → GetM Expr := fun decodedU =>
+    recur >>= afterTy decodedU
+  have hafterMode :
+      GetSpec (afterMode u) (exprBytes ty ++ lamTailBytes body)
+        (.lam u ty body) := by
+    simpa [afterMode, afterTy] using hchildren
+  have htotal := GetSpec.bind (next := afterMode) (getLamMode_spec u) hafterMode
+  simpa [getLamRunSucc, afterMode, afterTy, finish,
+    ByteArray.append_assoc] using htotal
+
+theorem getAllRunSucc_zero_of_specs (recur : GetM Expr)
+    (u : Uses) (o : Owned) (ty body : Expr) (hbody : AllBase body)
+    (hty : GetSpec recur (exprBytes ty) ty)
+    (hbodySpec : GetSpec recur (exprBytes body) body) :
+    GetSpec (getAllRunSucc recur 0)
+      (allModeBytes u o ++ exprBytes ty ++ exprBytes body)
+      (.all u o ty body) := by
+  let finish : Uses × Owned → Expr → Expr → GetM Expr :=
+      fun decodedMode decodedTy decodedBody =>
+    match decodedBody with
+    | .all .. => throw "getExpr: non-canonical all telescope"
+    | _ => pure (.all decodedMode.1 decodedMode.2 decodedTy decodedBody)
+  have hfinish :
+      GetSpec (finish (u, o) ty body) ByteArray.empty (.all u o ty body) := by
+    cases body <;> simp_all [AllBase, finish] <;> exact GetSpec.pure _
+  have hbody' := GetSpec.bind (next := finish (u, o) ty) hbodySpec hfinish
+  simp only [ByteArray.append_empty] at hbody'
+  let afterTy : Uses × Owned → Expr → GetM Expr :=
+      fun decodedMode decodedTy => recur >>= finish decodedMode decodedTy
+  have hafterTy :
+      GetSpec (afterTy (u, o) ty) (exprBytes body) (.all u o ty body) := by
+    simpa [afterTy, finish] using hbody'
+  have hchildren := GetSpec.bind (next := afterTy (u, o)) hty hafterTy
+  let afterMode : Uses × Owned → GetM Expr := fun decodedMode =>
+    recur >>= afterTy decodedMode
+  have hafterMode :
+      GetSpec (afterMode (u, o)) (exprBytes ty ++ exprBytes body)
+        (.all u o ty body) := by
+    simpa [afterMode, afterTy] using hchildren
+  have htotal := GetSpec.bind (next := afterMode) (getAllMode_spec u o) hafterMode
+  have hrun : getAllRunSucc recur 0 = getAllMode >>= afterMode := by
+    funext st
+    simp [getAllRunSucc, afterMode, afterTy, finish]
+  rw [hrun]
+  simpa [ByteArray.append_assoc] using htotal
+
+theorem getAllRunSucc_step_of_specs (recur : GetM Expr)
+    (u : Uses) (o : Owned) (ty body : Expr) (count : Nat)
+    (hty : GetSpec recur (exprBytes ty) ty)
+    (htail : GetSpec (getAllRunSucc recur count)
+      (allTailBytes body) body) :
+    GetSpec (getAllRunSucc recur (count + 1))
+      (allModeBytes u o ++ exprBytes ty ++ allTailBytes body)
+      (.all u o ty body) := by
+  let finish : Uses × Owned → Expr → Expr → GetM Expr :=
+      fun decodedMode decodedTy decodedBody =>
+    pure (.all decodedMode.1 decodedMode.2 decodedTy decodedBody)
+  have hfinish :
+      GetSpec (finish (u, o) ty body) ByteArray.empty (.all u o ty body) :=
+    GetSpec.pure _
+  have htail' := GetSpec.bind (next := finish (u, o) ty) htail hfinish
+  simp only [ByteArray.append_empty] at htail'
+  let afterTy : Uses × Owned → Expr → GetM Expr :=
+      fun decodedMode decodedTy =>
+    getAllRunSucc recur count >>= finish decodedMode decodedTy
+  have hafterTy :
+      GetSpec (afterTy (u, o) ty) (allTailBytes body) (.all u o ty body) := by
+    simpa [afterTy, finish] using htail'
+  have hchildren := GetSpec.bind (next := afterTy (u, o)) hty hafterTy
+  let afterMode : Uses × Owned → GetM Expr := fun decodedMode =>
+    recur >>= afterTy decodedMode
+  have hafterMode :
+      GetSpec (afterMode (u, o)) (exprBytes ty ++ allTailBytes body)
+        (.all u o ty body) := by
+    simpa [afterMode, afterTy] using hchildren
+  have htotal := GetSpec.bind (next := afterMode) (getAllMode_spec u o) hafterMode
+  simpa [getAllRunSucc, afterMode, afterTy, finish,
+    ByteArray.append_assoc] using htotal
+
+theorem tag4Bytes_size_pos (t : Tag4) : 0 < (tag4Bytes t).size := by
+  simp only [tag4Bytes]
+  split
+  · simp [u8Bytes]
+  · simp [u8Bytes, ByteArray.size_append]
+    omega
+
+theorem exprBytes_size_pos (e : Expr) : 0 < (exprBytes e).size := by
+  cases e with
+  | sort idx =>
+    simpa only [exprBytes] using
+      tag4Bytes_size_pos ⟨Expr.FLAG_SORT, idx⟩
+  | var idx =>
+    simpa only [exprBytes] using
+      tag4Bytes_size_pos ⟨Expr.FLAG_VAR, idx⟩
+  | ref refIdx idxs =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos
+      ⟨Expr.FLAG_REF, idxs.size.toUInt64⟩
+    omega
+  | recur recIdx idxs =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos
+      ⟨Expr.FLAG_REC, idxs.size.toUInt64⟩
+    omega
+  | prj typeRefIdx fieldIdx val =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos ⟨Expr.FLAG_PRJ, fieldIdx⟩
+    omega
+  | str idx =>
+    simpa only [exprBytes] using
+      tag4Bytes_size_pos ⟨Expr.FLAG_STR, idx⟩
+  | nat idx =>
+    simpa only [exprBytes] using
+      tag4Bytes_size_pos ⟨Expr.FLAG_NAT, idx⟩
+  | app fn arg =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos
+      ⟨Expr.FLAG_APP, (fn.appCount + 1).toUInt64⟩
+    omega
+  | lam u ty body =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos
+      ⟨Expr.FLAG_LAM, (body.lamCount + 1).toUInt64⟩
+    omega
+  | all u o ty body =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos
+      ⟨Expr.FLAG_ALL, (body.allCount + 1).toUInt64⟩
+    omega
+  | letE nonDep ty val body =>
+    simp only [exprBytes, ByteArray.size_append]
+    have h := tag4Bytes_size_pos
+      ⟨Expr.FLAG_LET, if nonDep then 1 else 0⟩
+    omega
+  | share idx =>
+    simpa only [exprBytes] using
+      tag4Bytes_size_pos ⟨Expr.FLAG_SHARE, idx⟩
+
+theorem getExprHeader_of_spec (recur : GetM Expr) (tag : Tag4)
+    (hflag : tag.flag < 16) {payload : ByteArray} {value : Expr}
+    (hpayload : GetSpec (getExprTag recur tag) payload value) :
+    GetSpec (do
+      let decodedTag ← getTag4
+      getExprTag recur decodedTag)
+      (tag4Bytes tag ++ payload) value := by
+  exact GetSpec.bind (next := getExprTag recur)
+    (getTag4_encoded_spec tag hflag) hpayload
+
+theorem getExprTag_ref_spec (recur : GetM Expr)
+    (refIdx : UInt64) (idxs : List UInt64)
+    (hcount : idxs.length < UInt64.size) :
+    GetSpec
+      (getExprTag recur ⟨Expr.FLAG_REF, idxs.length.toUInt64⟩)
+      (tag0Bytes ⟨refIdx⟩ ++ tag0ListBytes idxs)
+      (.ref refIdx idxs.toArray) := by
+  let finish : List UInt64 → GetM Expr := fun decoded =>
+    pure (.ref refIdx decoded.toArray)
+  have hfinish :
+      GetSpec (finish idxs) ByteArray.empty (.ref refIdx idxs.toArray) :=
+    GetSpec.pure _
+  have htail := GetSpec.bind (next := finish) (getTag0List_spec idxs) hfinish
+  simp only [ByteArray.append_empty] at htail
+  let afterRef : Tag0 → GetM Expr := fun decoded =>
+    getTag0List idxs.length >>= fun values =>
+      pure (.ref decoded.size values.toArray)
+  have hafter :
+      GetSpec (afterRef ⟨refIdx⟩) (tag0ListBytes idxs)
+        (.ref refIdx idxs.toArray) := by
+    simpa [afterRef, finish] using htail
+  have htotal := GetSpec.bind (next := afterRef)
+    (getTag0_encoded_spec ⟨refIdx⟩) hafter
+  have hround : idxs.length.toUInt64.toNat = idxs.length :=
+    UInt64.toNat_ofNat_of_lt hcount
+  simpa [getExprTag, Expr.FLAG_REF, hround, afterRef,
+    ByteArray.append_assoc] using htotal
+
+theorem getExprTag_recur_spec (recur : GetM Expr)
+    (recIdx : UInt64) (idxs : List UInt64)
+    (hcount : idxs.length < UInt64.size) :
+    GetSpec
+      (getExprTag recur ⟨Expr.FLAG_REC, idxs.length.toUInt64⟩)
+      (tag0Bytes ⟨recIdx⟩ ++ tag0ListBytes idxs)
+      (.recur recIdx idxs.toArray) := by
+  let finish : List UInt64 → GetM Expr := fun decoded =>
+    pure (.recur recIdx decoded.toArray)
+  have hfinish :
+      GetSpec (finish idxs) ByteArray.empty (.recur recIdx idxs.toArray) :=
+    GetSpec.pure _
+  have htail := GetSpec.bind (next := finish) (getTag0List_spec idxs) hfinish
+  simp only [ByteArray.append_empty] at htail
+  let afterRef : Tag0 → GetM Expr := fun decoded =>
+    getTag0List idxs.length >>= fun values =>
+      pure (.recur decoded.size values.toArray)
+  have hafter :
+      GetSpec (afterRef ⟨recIdx⟩) (tag0ListBytes idxs)
+        (.recur recIdx idxs.toArray) := by
+    simpa [afterRef, finish] using htail
+  have htotal := GetSpec.bind (next := afterRef)
+    (getTag0_encoded_spec ⟨recIdx⟩) hafter
+  have hround : idxs.length.toUInt64.toNat = idxs.length :=
+    UInt64.toNat_ofNat_of_lt hcount
+  simpa [getExprTag, Expr.FLAG_REC, hround, afterRef,
+    ByteArray.append_assoc] using htotal
+
+theorem getExprTag_prj_spec (recur : GetM Expr)
+    (typeRefIdx fieldIdx : UInt64) (val : Expr)
+    (hval : GetSpec recur (exprBytes val) val) :
+    GetSpec (getExprTag recur ⟨Expr.FLAG_PRJ, fieldIdx⟩)
+      (tag0Bytes ⟨typeRefIdx⟩ ++ exprBytes val)
+      (.prj typeRefIdx fieldIdx val) := by
+  let finish : UInt64 → Expr → GetM Expr :=
+    fun decodedRef decodedVal => pure (.prj decodedRef fieldIdx decodedVal)
+  have hfinish :
+      GetSpec (finish typeRefIdx val) ByteArray.empty
+        (.prj typeRefIdx fieldIdx val) := GetSpec.pure _
+  have hval' := GetSpec.bind (next := finish typeRefIdx) hval hfinish
+  simp only [ByteArray.append_empty] at hval'
+  let afterRef : Tag0 → GetM Expr := fun decoded =>
+    recur >>= finish decoded.size
+  have hafter : GetSpec (afterRef ⟨typeRefIdx⟩) (exprBytes val)
+      (.prj typeRefIdx fieldIdx val) := by
+    simpa [afterRef, finish] using hval'
+  have htotal := GetSpec.bind (next := afterRef)
+    (getTag0_encoded_spec ⟨typeRefIdx⟩) hafter
+  simpa [getExprTag, Expr.FLAG_PRJ, afterRef, finish] using htotal
+
+theorem getExprTag_let_spec (recur : GetM Expr)
+    (nonDep : Bool) (ty val body : Expr)
+    (hty : GetSpec recur (exprBytes ty) ty)
+    (hval : GetSpec recur (exprBytes val) val)
+    (hbody : GetSpec recur (exprBytes body) body) :
+    GetSpec
+      (getExprTag recur ⟨Expr.FLAG_LET, if nonDep then 1 else 0⟩)
+      (exprBytes ty ++ exprBytes val ++ exprBytes body)
+      (.letE nonDep ty val body) := by
+  let finish : Expr → Expr → Expr → GetM Expr :=
+    fun decodedTy decodedVal decodedBody =>
+      pure (.letE nonDep decodedTy decodedVal decodedBody)
+  have hfinish : GetSpec (finish ty val body) ByteArray.empty
+      (.letE nonDep ty val body) := GetSpec.pure _
+  have hbody' := GetSpec.bind (next := finish ty val) hbody hfinish
+  simp only [ByteArray.append_empty] at hbody'
+  let afterVal : Expr → GetM Expr := fun decodedVal =>
+    recur >>= finish ty decodedVal
+  have hafterVal : GetSpec (afterVal val) (exprBytes body)
+      (.letE nonDep ty val body) := by
+    simpa [afterVal, finish] using hbody'
+  have hvalBody := GetSpec.bind (next := afterVal) hval hafterVal
+  let afterTy : Expr → GetM Expr := fun decodedTy =>
+    recur >>= fun decodedVal => recur >>= finish decodedTy decodedVal
+  have hafterTy : GetSpec (afterTy ty)
+      (exprBytes val ++ exprBytes body) (.letE nonDep ty val body) := by
+    simpa [afterTy, afterVal, finish] using hvalBody
+  have htotal := GetSpec.bind (next := afterTy) hty hafterTy
+  cases nonDep <;>
+    simpa [getExprTag, Expr.FLAG_LET, afterTy, finish,
+      ByteArray.append_assoc] using htotal
+
+theorem payload_lt_of_header {header payload : ByteArray} {fuel : Nat}
+    (hheader : 0 < header.size)
+    (hfull : (header ++ payload).size < fuel + 1) :
+    payload.size < fuel := by
+  simp only [ByteArray.size_append] at hfull
+  omega
+
+mutual
+  theorem getFuel_expr_spec (e : Expr) (fuel : Nat)
+      (hwf : e.wireWF) (hfuel : (exprBytes e).size < fuel) :
+      GetSpec (getExprFuel fuel) (exprBytes e) e := by
+    cases fuel with
+    | zero =>
+      have hpos := exprBytes_size_pos e
+      omega
+    | succ fuel =>
+      cases e with
+      | sort idx =>
+        have hpayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel) ⟨Expr.FLAG_SORT, idx⟩)
+              ByteArray.empty (.sort idx) := by
+          simpa [getExprTag, Expr.FLAG_SORT] using
+            GetSpec.pure (Expr.sort idx)
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_SORT, idx⟩ (by simp [Expr.FLAG_SORT]) hpayload
+        simpa [getExprFuel, exprBytes] using htotal
+      | var idx =>
+        have hpayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel) ⟨Expr.FLAG_VAR, idx⟩)
+              ByteArray.empty (.var idx) := by
+          simpa [getExprTag, Expr.FLAG_VAR] using
+            GetSpec.pure (Expr.var idx)
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_VAR, idx⟩ (by simp [Expr.FLAG_VAR]) hpayload
+        simpa [getExprFuel, exprBytes] using htotal
+      | ref refIdx idxs =>
+        have hcount : idxs.toList.length < UInt64.size := by
+          simpa [Expr.wireWF] using hwf
+        have hpayload := getExprTag_ref_spec (getExprFuel fuel)
+          refIdx idxs.toList hcount
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_REF, idxs.size.toUInt64⟩
+          (by simp [Expr.FLAG_REF]) (by simpa using hpayload)
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | recur recIdx idxs =>
+        have hcount : idxs.toList.length < UInt64.size := by
+          simpa [Expr.wireWF] using hwf
+        have hpayload := getExprTag_recur_spec (getExprFuel fuel)
+          recIdx idxs.toList hcount
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_REC, idxs.size.toUInt64⟩
+          (by simp [Expr.FLAG_REC]) (by simpa using hpayload)
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | prj typeRefIdx fieldIdx val =>
+        have htag := tag4Bytes_size_pos ⟨Expr.FLAG_PRJ, fieldIdx⟩
+        have hvalFuel : (exprBytes val).size < fuel := by
+          simp only [exprBytes, ByteArray.size_append] at hfuel
+          omega
+        have hval := getFuel_expr_spec val fuel
+          (by simpa [Expr.wireWF] using hwf) hvalFuel
+        have hpayload := getExprTag_prj_spec (getExprFuel fuel)
+          typeRefIdx fieldIdx val hval
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_PRJ, fieldIdx⟩ (by simp [Expr.FLAG_PRJ]) hpayload
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | str idx =>
+        have hpayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel) ⟨Expr.FLAG_STR, idx⟩)
+              ByteArray.empty (.str idx) := by
+          simpa [getExprTag, Expr.FLAG_STR] using
+            GetSpec.pure (Expr.str idx)
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_STR, idx⟩ (by simp [Expr.FLAG_STR]) hpayload
+        simpa [getExprFuel, exprBytes] using htotal
+      | nat idx =>
+        have hpayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel) ⟨Expr.FLAG_NAT, idx⟩)
+              ByteArray.empty (.nat idx) := by
+          simpa [getExprTag, Expr.FLAG_NAT] using
+            GetSpec.pure (Expr.nat idx)
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_NAT, idx⟩ (by simp [Expr.FLAG_NAT]) hpayload
+        simpa [getExprFuel, exprBytes] using htotal
+      | app fn arg =>
+        rcases hwf with ⟨hfnWF, hargWF, hcount⟩
+        have htag := tag4Bytes_size_pos
+          ⟨Expr.FLAG_APP, (fn.appCount + 1).toUInt64⟩
+        have hpayload :
+            (appSpineBytes fn ++ exprBytes arg).size < fuel := by
+          apply payload_lt_of_header htag
+          simpa only [exprBytes, ByteArray.append_assoc] using hfuel
+        have hrun := getFuel_app_spec fn arg fuel hfnWF hargWF hpayload
+        have hround :
+            (fn.appCount + 1).toUInt64.toNat = fn.appCount + 1 :=
+          UInt64.toNat_ofNat_of_lt hcount
+        have htagPayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel)
+                ⟨Expr.FLAG_APP, (fn.appCount + 1).toUInt64⟩)
+              (appSpineBytes fn ++ exprBytes arg) (.app fn arg) := by
+          change GetSpec
+            (getAppRun (getExprFuel fuel)
+              (fn.appCount + 1).toUInt64.toNat)
+            (appSpineBytes fn ++ exprBytes arg) (.app fn arg)
+          rw [hround]
+          simpa only [getAppRun] using hrun
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_APP, (fn.appCount + 1).toUInt64⟩
+          (by simp [Expr.FLAG_APP]) htagPayload
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | lam u ty body =>
+        rcases hwf with ⟨htyWF, hbodyWF, hcount⟩
+        have htag := tag4Bytes_size_pos
+          ⟨Expr.FLAG_LAM, (body.lamCount + 1).toUInt64⟩
+        have hpayload :
+            (lamModeBytes u ++ exprBytes ty ++ lamTailBytes body).size < fuel := by
+          apply payload_lt_of_header htag
+          simpa only [exprBytes, ByteArray.append_assoc] using hfuel
+        have hrun := getFuel_lam_spec u ty body fuel htyWF hbodyWF hpayload
+        have hround :
+            (body.lamCount + 1).toUInt64.toNat = body.lamCount + 1 :=
+          UInt64.toNat_ofNat_of_lt hcount
+        have htagPayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel)
+                ⟨Expr.FLAG_LAM, (body.lamCount + 1).toUInt64⟩)
+              (lamModeBytes u ++ exprBytes ty ++ lamTailBytes body)
+              (.lam u ty body) := by
+          change GetSpec
+            (getLamRun (getExprFuel fuel)
+              (body.lamCount + 1).toUInt64.toNat)
+            (lamModeBytes u ++ exprBytes ty ++ lamTailBytes body)
+            (.lam u ty body)
+          rw [hround]
+          simpa only [getLamRun] using hrun
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_LAM, (body.lamCount + 1).toUInt64⟩
+          (by simp [Expr.FLAG_LAM]) htagPayload
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | all u o ty body =>
+        rcases hwf with ⟨htyWF, hbodyWF, hcount⟩
+        have htag := tag4Bytes_size_pos
+          ⟨Expr.FLAG_ALL, (body.allCount + 1).toUInt64⟩
+        have hpayload :
+            (allModeBytes u o ++ exprBytes ty ++ allTailBytes body).size < fuel := by
+          apply payload_lt_of_header htag
+          simpa only [exprBytes, ByteArray.append_assoc] using hfuel
+        have hrun := getFuel_all_spec u o ty body fuel htyWF hbodyWF hpayload
+        have hround :
+            (body.allCount + 1).toUInt64.toNat = body.allCount + 1 :=
+          UInt64.toNat_ofNat_of_lt hcount
+        have htagPayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel)
+                ⟨Expr.FLAG_ALL, (body.allCount + 1).toUInt64⟩)
+              (allModeBytes u o ++ exprBytes ty ++ allTailBytes body)
+              (.all u o ty body) := by
+          change GetSpec
+            (getAllRun (getExprFuel fuel)
+              (body.allCount + 1).toUInt64.toNat)
+            (allModeBytes u o ++ exprBytes ty ++ allTailBytes body)
+            (.all u o ty body)
+          rw [hround]
+          simpa only [getAllRun] using hrun
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_ALL, (body.allCount + 1).toUInt64⟩
+          (by simp [Expr.FLAG_ALL]) htagPayload
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | letE nonDep ty val body =>
+        rcases hwf with ⟨htyWF, hvalWF, hbodyWF⟩
+        have htag := tag4Bytes_size_pos
+          ⟨Expr.FLAG_LET, if nonDep then 1 else 0⟩
+        have htyFuel : (exprBytes ty).size < fuel := by
+          simp only [exprBytes, ByteArray.size_append] at hfuel
+          omega
+        have hvalFuel : (exprBytes val).size < fuel := by
+          simp only [exprBytes, ByteArray.size_append] at hfuel
+          omega
+        have hbodyFuel : (exprBytes body).size < fuel := by
+          simp only [exprBytes, ByteArray.size_append] at hfuel
+          omega
+        have hty := getFuel_expr_spec ty fuel htyWF htyFuel
+        have hval := getFuel_expr_spec val fuel hvalWF hvalFuel
+        have hbody := getFuel_expr_spec body fuel hbodyWF hbodyFuel
+        have hpayload := getExprTag_let_spec (getExprFuel fuel)
+          nonDep ty val body hty hval hbody
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_LET, if nonDep then 1 else 0⟩
+          (by simp [Expr.FLAG_LET]) hpayload
+        simpa [getExprFuel, exprBytes, ByteArray.append_assoc] using htotal
+      | share idx =>
+        have hpayload :
+            GetSpec
+              (getExprTag (getExprFuel fuel) ⟨Expr.FLAG_SHARE, idx⟩)
+              ByteArray.empty (.share idx) := by
+          simpa [getExprTag, Expr.FLAG_SHARE] using
+            GetSpec.pure (Expr.share idx)
+        have htotal := getExprHeader_of_spec (getExprFuel fuel)
+          ⟨Expr.FLAG_SHARE, idx⟩ (by simp [Expr.FLAG_SHARE]) hpayload
+        simpa [getExprFuel, exprBytes] using htotal
+  termination_by (e.codecSize, 1)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+
+  theorem getFuel_app_spec (fn arg : Expr) (fuel : Nat)
+      (hfnWF : fn.wireWF) (hargWF : arg.wireWF)
+      (hfuel : (appSpineBytes fn ++ exprBytes arg).size < fuel) :
+      GetSpec (getAppRunSucc (getExprFuel fuel) fn.appCount)
+        (appSpineBytes fn ++ exprBytes arg) (.app fn arg) := by
+    by_cases hbase : AppBase fn
+    · have hfnFuel : (exprBytes fn).size < fuel := by
+        cases fn <;> simp_all [AppBase, appSpineBytes, ByteArray.size_append]
+        all_goals omega
+      have hargFuel : (exprBytes arg).size < fuel := by
+        cases fn <;> simp_all [AppBase, appSpineBytes, ByteArray.size_append]
+        all_goals omega
+      have hfn := getFuel_expr_spec fn fuel hfnWF hfnFuel
+      have harg := getFuel_expr_spec arg fuel hargWF hargFuel
+      have hzero := getAppRunSucc_zero_of_specs (getExprFuel fuel)
+        fn arg hbase hfn harg
+      cases fn <;> simp_all [AppBase, Expr.appCount, appSpineBytes]
+    · cases fn <;> simp [AppBase] at hbase
+      rename_i innerFn innerArg
+      rcases hfnWF with ⟨hinnerFnWF, hinnerArgWF, hinnerCount⟩
+      have hinnerFuel :
+          (appSpineBytes innerFn ++ exprBytes innerArg).size < fuel := by
+        simp only [appSpineBytes, ByteArray.size_append] at hfuel ⊢
+        omega
+      have hargFuel : (exprBytes arg).size < fuel := by
+        simp only [appSpineBytes, ByteArray.size_append] at hfuel
+        omega
+      have hinner := getFuel_app_spec innerFn innerArg fuel
+        hinnerFnWF hinnerArgWF hinnerFuel
+      have harg := getFuel_expr_spec arg fuel hargWF hargFuel
+      have hinner' :
+          GetSpec (getAppRunSucc (getExprFuel fuel) innerFn.appCount)
+            (appSpineBytes (.app innerFn innerArg))
+            (.app innerFn innerArg) := by
+        simpa only [appSpineBytes] using hinner
+      have hstep := getAppRunSucc_step_of_specs (getExprFuel fuel)
+        (.app innerFn innerArg) arg innerFn.appCount hinner' harg
+      simpa [Expr.appCount, appSpineBytes, ByteArray.append_assoc] using hstep
+  termination_by ((Expr.app fn arg).codecSize, 0)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+
+  theorem getFuel_lam_spec (u : Uses) (ty body : Expr) (fuel : Nat)
+      (htyWF : ty.wireWF) (hbodyWF : body.wireWF)
+      (hfuel :
+        (lamModeBytes u ++ exprBytes ty ++ lamTailBytes body).size < fuel) :
+      GetSpec (getLamRunSucc (getExprFuel fuel) body.lamCount)
+        (lamModeBytes u ++ exprBytes ty ++ lamTailBytes body)
+        (.lam u ty body) := by
+    by_cases hbase : LamBase body
+    · have htyFuel : (exprBytes ty).size < fuel := by
+        simp only [ByteArray.size_append] at hfuel
+        omega
+      have hbodyFuel : (exprBytes body).size < fuel := by
+        cases body <;> simp_all [LamBase, lamTailBytes, ByteArray.size_append]
+        all_goals omega
+      have hty := getFuel_expr_spec ty fuel htyWF htyFuel
+      have hbody := getFuel_expr_spec body fuel hbodyWF hbodyFuel
+      have hzero := getLamRunSucc_zero_of_specs (getExprFuel fuel)
+        u ty body hbase hty hbody
+      cases body <;> simp_all [LamBase, Expr.lamCount, lamTailBytes]
+    · cases body <;> simp [LamBase] at hbase
+      rename_i innerU innerTy innerBody
+      rcases hbodyWF with ⟨hinnerTyWF, hinnerBodyWF, hinnerCount⟩
+      have htyFuel : (exprBytes ty).size < fuel := by
+        simp only [lamTailBytes, ByteArray.size_append] at hfuel
+        omega
+      have hinnerFuel :
+          (lamModeBytes innerU ++ exprBytes innerTy ++
+            lamTailBytes innerBody).size < fuel := by
+        simp only [lamTailBytes, ByteArray.size_append] at hfuel ⊢
+        omega
+      have hty := getFuel_expr_spec ty fuel htyWF htyFuel
+      have hinner := getFuel_lam_spec innerU innerTy innerBody fuel
+        hinnerTyWF hinnerBodyWF hinnerFuel
+      have hinner' :
+          GetSpec (getLamRunSucc (getExprFuel fuel) innerBody.lamCount)
+            (lamTailBytes (.lam innerU innerTy innerBody))
+            (.lam innerU innerTy innerBody) := by
+        simpa only [lamTailBytes] using hinner
+      have hstep := getLamRunSucc_step_of_specs (getExprFuel fuel)
+        u ty (.lam innerU innerTy innerBody) innerBody.lamCount hty hinner'
+      simpa [Expr.lamCount, lamTailBytes, ByteArray.append_assoc] using hstep
+  termination_by ((Expr.lam u ty body).codecSize, 0)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+
+  theorem getFuel_all_spec (u : Uses) (o : Owned) (ty body : Expr)
+      (fuel : Nat) (htyWF : ty.wireWF) (hbodyWF : body.wireWF)
+      (hfuel :
+        (allModeBytes u o ++ exprBytes ty ++ allTailBytes body).size < fuel) :
+      GetSpec (getAllRunSucc (getExprFuel fuel) body.allCount)
+        (allModeBytes u o ++ exprBytes ty ++ allTailBytes body)
+        (.all u o ty body) := by
+    by_cases hbase : AllBase body
+    · have htyFuel : (exprBytes ty).size < fuel := by
+        simp only [ByteArray.size_append] at hfuel
+        omega
+      have hbodyFuel : (exprBytes body).size < fuel := by
+        cases body <;> simp_all [AllBase, allTailBytes, ByteArray.size_append]
+        all_goals omega
+      have hty := getFuel_expr_spec ty fuel htyWF htyFuel
+      have hbody := getFuel_expr_spec body fuel hbodyWF hbodyFuel
+      have hzero := getAllRunSucc_zero_of_specs (getExprFuel fuel)
+        u o ty body hbase hty hbody
+      cases body <;> simp_all [AllBase, Expr.allCount, allTailBytes]
+    · cases body <;> simp [AllBase] at hbase
+      rename_i innerU innerO innerTy innerBody
+      rcases hbodyWF with ⟨hinnerTyWF, hinnerBodyWF, hinnerCount⟩
+      have htyFuel : (exprBytes ty).size < fuel := by
+        simp only [allTailBytes, ByteArray.size_append] at hfuel
+        omega
+      have hinnerFuel :
+          (allModeBytes innerU innerO ++ exprBytes innerTy ++
+            allTailBytes innerBody).size < fuel := by
+        simp only [allTailBytes, ByteArray.size_append] at hfuel ⊢
+        omega
+      have hty := getFuel_expr_spec ty fuel htyWF htyFuel
+      have hinner := getFuel_all_spec innerU innerO innerTy innerBody fuel
+        hinnerTyWF hinnerBodyWF hinnerFuel
+      have hinner' :
+          GetSpec (getAllRunSucc (getExprFuel fuel) innerBody.allCount)
+            (allTailBytes (.all innerU innerO innerTy innerBody))
+            (.all innerU innerO innerTy innerBody) := by
+        simpa only [allTailBytes] using hinner
+      have hstep := getAllRunSucc_step_of_specs (getExprFuel fuel)
+        u o ty (.all innerU innerO innerTy innerBody)
+        innerBody.allCount hty hinner'
+      simpa [Expr.allCount, allTailBytes, ByteArray.append_assoc] using hstep
+  termination_by ((Expr.all u o ty body).codecSize, 0)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Expr.codecSize] <;> omega
+      | apply Prod.Lex.right <;> omega
+end
+
+theorem getAppRunSucc_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (extra : Nat) :
+    GetCanonical (getAppRunSucc recur extra) appSpineBytes := by
+  induction extra with
+  | zero =>
+    intro pre rest value st' h
+    let afterBase : Expr → GetM Expr := fun base =>
+      match base with
+      | .app .. => throw "getExpr: non-canonical app base"
+      | _ => do
+        let arg ← recur
+        return .app base arg
+    change (recur >>= afterBase).run ⟨pre ++ rest, pre.size⟩ =
+      .ok (value, st') at h
+    obtain ⟨base, afterBaseBytes, hrestBase, hafterBase⟩ :=
+      GetCanonical.bind_inv hrecur pre rest h
+    have hbase : AppBase base := by
+      cases base with
+      | app fn arg =>
+        simp [afterBase] at hafterBase
+        change (Except.error _) = Except.ok (value, st') at hafterBase
+        contradiction
+      | _ => trivial
+    let basePre := pre ++ exprBytes base
+    let finish : Expr → GetM Expr := fun arg => pure (.app base arg)
+    have hafterBase' :
+        (recur >>= finish).run
+          ⟨basePre ++ afterBaseBytes, basePre.size⟩ = .ok (value, st') := by
+      cases base with
+      | app fn arg => simp [AppBase] at hbase
+      | _ =>
+        simpa [afterBase, finish, basePre] using hafterBase
+    obtain ⟨arg, suffix, hrestArg, hfinish⟩ :=
+      GetCanonical.bind_inv hrecur basePre afterBaseBytes hafterBase'
+    simp [finish] at hfinish
+    cases hfinish
+    refine ⟨suffix, ?_, ?_⟩
+    · rw [hrestBase, hrestArg]
+      cases base <;> simp_all [AppBase, appSpineBytes,
+        ByteArray.append_assoc]
+    · cases base <;> simp_all [AppBase, appSpineBytes, basePre,
+        ByteArray.append_assoc,
+        ByteArray.size_append, Nat.add_assoc]
+  | succ extra ih =>
+    intro pre rest value st' h
+    let afterFn : Expr → GetM Expr := fun fn => do
+      let arg ← recur
+      return .app fn arg
+    change (getAppRunSucc recur extra >>= afterFn).run
+      ⟨pre ++ rest, pre.size⟩ = .ok (value, st') at h
+    obtain ⟨fn, afterFnBytes, hrestFn, hafterFn⟩ :=
+      GetCanonical.bind_inv ih pre rest h
+    let fnPre := pre ++ appSpineBytes fn
+    let finish : Expr → GetM Expr := fun arg => pure (.app fn arg)
+    have hafterFn' :
+        (recur >>= finish).run
+          ⟨fnPre ++ afterFnBytes, fnPre.size⟩ = .ok (value, st') := by
+      simpa [afterFn, finish, fnPre] using hafterFn
+    obtain ⟨arg, suffix, hrestArg, hfinish⟩ :=
+      GetCanonical.bind_inv hrecur fnPre afterFnBytes hafterFn'
+    simp [finish] at hfinish
+    cases hfinish
+    refine ⟨suffix, ?_, ?_⟩
+    · rw [hrestFn, hrestArg]
+      simp [appSpineBytes, ByteArray.append_assoc]
+    · simp [appSpineBytes, fnPre, hrestFn, hrestArg,
+        ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc]
+
+theorem getAppRunSucc_success_count (recur : GetM Expr) (extra : Nat) :
+    ∀ (initial : GetState) {value : Expr} {st' : GetState},
+      (getAppRunSucc recur extra).run initial = .ok (value, st') →
+      ∃ fn arg, value = .app fn arg ∧ value.appCount = extra + 1 := by
+  induction extra with
+  | zero =>
+    intro initial value st' h
+    simp only [getAppRunSucc, StateT.run_bind] at h
+    cases hb : recur.run initial with
+    | error err => rw [hb] at h; contradiction
+    | ok baseState =>
+      rcases baseState with ⟨base, afterBase⟩
+      rw [hb] at h
+      simp only [bind, Except.bind] at h
+      have hbase : AppBase base := by
+        cases base with
+        | app fn arg =>
+          change (Except.error _) = Except.ok (value, st') at h
+          contradiction
+        | _ => trivial
+      have hcont :
+          (recur >>= fun arg => pure (.app base arg)).run afterBase =
+            .ok (value, st') := by
+        cases base with
+        | app fn arg => simp [AppBase] at hbase
+        | _ =>
+          exact h
+      simp only [StateT.run_bind] at hcont
+      cases ha : recur.run afterBase with
+      | error err => rw [ha] at hcont; contradiction
+      | ok argState =>
+        rcases argState with ⟨arg, afterArg⟩
+        rw [ha] at hcont
+        simp at hcont
+        cases hcont
+        have hbaseCount : base.appCount = 0 := by
+          cases base <;> simp_all [AppBase, Expr.appCount]
+        exact ⟨base, arg, rfl, by simp [Expr.appCount, hbaseCount]⟩
+  | succ extra ih =>
+    intro initial value st' h
+    simp only [getAppRunSucc, StateT.run_bind] at h
+    cases hf : (getAppRunSucc recur extra).run initial with
+    | error err => rw [hf] at h; contradiction
+    | ok fnState =>
+      rcases fnState with ⟨fn, afterFn⟩
+      rw [hf] at h
+      simp only [bind, Except.bind] at h
+      cases ha : recur.run afterFn with
+      | error err => rw [ha] at h; contradiction
+      | ok argState =>
+        rcases argState with ⟨arg, afterArg⟩
+        rw [ha] at h
+        simp at h
+        cases h
+        obtain ⟨innerFn, innerArg, hfn, hcount⟩ := ih initial hf
+        refine ⟨fn, arg, rfl, ?_⟩
+        simp [Expr.appCount, hcount]
+
+theorem getAppRun_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (count : Nat) :
+    GetCanonical (getAppRun recur count) appSpineBytes := by
+  cases count with
+  | zero =>
+    intro pre rest value st' h
+    simp [getAppRun] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ extra =>
+    simpa [getAppRun] using getAppRunSucc_canonical_of recur hrecur extra
+
+theorem getAppRun_success_count (recur : GetM Expr) (count : Nat)
+    (initial : GetState) {value : Expr} {st' : GetState}
+    (h : (getAppRun recur count).run initial = .ok (value, st')) :
+    ∃ fn arg, value = .app fn arg ∧ value.appCount = count := by
+  cases count with
+  | zero =>
+    simp [getAppRun] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ extra =>
+    have h' : (getAppRunSucc recur extra).run initial = .ok (value, st') := by
+      simpa [getAppRun] using h
+    obtain ⟨fn, arg, hvalue, hcount⟩ :=
+      getAppRunSucc_success_count recur extra initial h'
+    exact ⟨fn, arg, hvalue, by simpa using hcount⟩
+
+theorem getLamRunSucc_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (extra : Nat) :
+    GetCanonical (getLamRunSucc recur extra) lamTailBytes := by
+  induction extra with
+  | zero =>
+    intro pre rest value st' h
+    let afterMode : Uses → GetM Expr := fun u => do
+      let ty ← recur
+      let body ← recur
+      match body with
+      | .lam .. => throw "getExpr: non-canonical lam telescope"
+      | _ => return .lam u ty body
+    change (getLamMode >>= afterMode).run ⟨pre ++ rest, pre.size⟩ =
+      .ok (value, st') at h
+    obtain ⟨u, afterModeBytes, hrestMode, hafterMode⟩ :=
+      GetCanonical.bind_inv getLamMode_canonical pre rest h
+    let modePre := pre ++ lamModeBytes u
+    let afterTy : Expr → GetM Expr := fun ty => do
+      let body ← recur
+      match body with
+      | .lam .. => throw "getExpr: non-canonical lam telescope"
+      | _ => return .lam u ty body
+    have hafterMode' :
+        (recur >>= afterTy).run
+          ⟨modePre ++ afterModeBytes, modePre.size⟩ = .ok (value, st') := by
+      simpa [afterMode, afterTy, modePre] using hafterMode
+    obtain ⟨ty, afterTyBytes, hrestTy, hafterTy⟩ :=
+      GetCanonical.bind_inv hrecur modePre afterModeBytes hafterMode'
+    let tyPre := modePre ++ exprBytes ty
+    let finish : Expr → GetM Expr := fun body =>
+      match body with
+      | .lam .. => throw "getExpr: non-canonical lam telescope"
+      | _ => pure (.lam u ty body)
+    have hafterTy' :
+        (recur >>= finish).run
+          ⟨tyPre ++ afterTyBytes, tyPre.size⟩ = .ok (value, st') := by
+      simpa [afterTy, finish, tyPre] using hafterTy
+    obtain ⟨body, suffix, hrestBody, hfinish⟩ :=
+      GetCanonical.bind_inv hrecur tyPre afterTyBytes hafterTy'
+    have hbody : LamBase body := by
+      cases body with
+      | lam u' ty' body' =>
+        change (Except.error _) = Except.ok (value, st') at hfinish
+        contradiction
+      | _ => trivial
+    have hpure :
+        (pure (.lam u ty body) : GetM Expr).run
+          ⟨(tyPre ++ exprBytes body) ++ suffix,
+            (tyPre ++ exprBytes body).size⟩ = .ok (value, st') := by
+      cases body with
+      | lam u' ty' body' => simp [LamBase] at hbody
+      | _ => exact hfinish
+    simp at hpure
+    cases hpure
+    refine ⟨suffix, ?_, ?_⟩
+    · rw [hrestMode, hrestTy, hrestBody]
+      cases body <;> simp_all [LamBase, lamTailBytes,
+        ByteArray.append_assoc]
+    · cases body <;> simp_all [LamBase, lamTailBytes, modePre, tyPre,
+        ByteArray.append_assoc,
+        ByteArray.size_append, Nat.add_assoc]
+  | succ extra ih =>
+    intro pre rest value st' h
+    let afterMode : Uses → GetM Expr := fun u => do
+      let ty ← recur
+      return .lam u ty (← getLamRunSucc recur extra)
+    change (getLamMode >>= afterMode).run ⟨pre ++ rest, pre.size⟩ =
+      .ok (value, st') at h
+    obtain ⟨u, afterModeBytes, hrestMode, hafterMode⟩ :=
+      GetCanonical.bind_inv getLamMode_canonical pre rest h
+    let modePre := pre ++ lamModeBytes u
+    let afterTy : Expr → GetM Expr := fun ty => do
+      let body ← getLamRunSucc recur extra
+      return .lam u ty body
+    have hafterMode' :
+        (recur >>= afterTy).run
+          ⟨modePre ++ afterModeBytes, modePre.size⟩ = .ok (value, st') := by
+      simpa [afterMode, afterTy, modePre] using hafterMode
+    obtain ⟨ty, afterTyBytes, hrestTy, hafterTy⟩ :=
+      GetCanonical.bind_inv hrecur modePre afterModeBytes hafterMode'
+    let tyPre := modePre ++ exprBytes ty
+    let finish : Expr → GetM Expr := fun body => pure (.lam u ty body)
+    have hafterTy' :
+        (getLamRunSucc recur extra >>= finish).run
+          ⟨tyPre ++ afterTyBytes, tyPre.size⟩ = .ok (value, st') := by
+      simpa [afterTy, finish, tyPre] using hafterTy
+    obtain ⟨body, suffix, hrestBody, hfinish⟩ :=
+      GetCanonical.bind_inv ih tyPre afterTyBytes hafterTy'
+    simp [finish] at hfinish
+    cases hfinish
+    refine ⟨suffix, ?_, ?_⟩
+    · rw [hrestMode, hrestTy, hrestBody]
+      simp [lamTailBytes, ByteArray.append_assoc]
+    · simp [lamTailBytes, modePre, tyPre, hrestMode, hrestTy,
+        hrestBody, ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc]
+
+theorem getLamRun_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (count : Nat) :
+    GetCanonical (getLamRun recur count) lamTailBytes := by
+  cases count with
+  | zero =>
+    intro pre rest value st' h
+    simp [getLamRun] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ extra =>
+    simpa [getLamRun] using getLamRunSucc_canonical_of recur hrecur extra
+
+theorem getLamRunSucc_success_count (recur : GetM Expr) (extra : Nat) :
+    ∀ (initial : GetState) {value : Expr} {st' : GetState},
+      (getLamRunSucc recur extra).run initial = .ok (value, st') →
+      ∃ u ty body,
+        value = .lam u ty body ∧ value.lamCount = extra + 1 := by
+  induction extra with
+  | zero =>
+    intro initial value st' h
+    simp only [getLamRunSucc, StateT.run_bind] at h
+    cases hm : getLamMode.run initial with
+    | error err => rw [hm] at h; contradiction
+    | ok modeState =>
+      rcases modeState with ⟨u, afterMode⟩
+      rw [hm] at h
+      simp only [bind, Except.bind] at h
+      cases ht : recur.run afterMode with
+      | error err => rw [ht] at h; contradiction
+      | ok tyState =>
+        rcases tyState with ⟨ty, afterTy⟩
+        rw [ht] at h
+        simp only at h
+        cases hb : recur.run afterTy with
+        | error err => rw [hb] at h; contradiction
+        | ok bodyState =>
+          rcases bodyState with ⟨body, afterBody⟩
+          rw [hb] at h
+          simp only at h
+          have hbase : LamBase body := by
+            cases body with
+            | lam u' ty' body' =>
+              change (Except.error _) = Except.ok (value, st') at h
+              contradiction
+            | _ => trivial
+          have hpure :
+              (pure (.lam u ty body) : GetM Expr).run afterBody =
+                .ok (value, st') := by
+            cases body with
+            | lam u' ty' body' => simp [LamBase] at hbase
+            | _ => exact h
+          simp at hpure
+          cases hpure
+          have hbodyCount : body.lamCount = 0 := by
+            cases body <;> simp_all [LamBase, Expr.lamCount]
+          exact ⟨u, ty, body, rfl, by simp [Expr.lamCount, hbodyCount]⟩
+  | succ extra ih =>
+    intro initial value st' h
+    simp only [getLamRunSucc, StateT.run_bind] at h
+    cases hm : getLamMode.run initial with
+    | error err => rw [hm] at h; contradiction
+    | ok modeState =>
+      rcases modeState with ⟨u, afterMode⟩
+      rw [hm] at h
+      simp only [bind, Except.bind] at h
+      cases ht : recur.run afterMode with
+      | error err => rw [ht] at h; contradiction
+      | ok tyState =>
+        rcases tyState with ⟨ty, afterTy⟩
+        rw [ht] at h
+        simp only at h
+        cases hb : (getLamRunSucc recur extra).run afterTy with
+        | error err => rw [hb] at h; contradiction
+        | ok bodyState =>
+          rcases bodyState with ⟨body, afterBody⟩
+          rw [hb] at h
+          simp at h
+          cases h
+          obtain ⟨innerU, innerTy, innerBody, hbody, hcount⟩ :=
+            ih afterTy hb
+          refine ⟨u, ty, body, rfl, ?_⟩
+          simp [Expr.lamCount, hcount]
+
+theorem getLamRun_success_count (recur : GetM Expr) (count : Nat)
+    (initial : GetState) {value : Expr} {st' : GetState}
+    (h : (getLamRun recur count).run initial = .ok (value, st')) :
+    ∃ u ty body, value = .lam u ty body ∧ value.lamCount = count := by
+  cases count with
+  | zero =>
+    simp [getLamRun] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ extra =>
+    have h' : (getLamRunSucc recur extra).run initial = .ok (value, st') := by
+      simpa [getLamRun] using h
+    obtain ⟨u, ty, body, hvalue, hcount⟩ :=
+      getLamRunSucc_success_count recur extra initial h'
+    exact ⟨u, ty, body, hvalue, by simpa using hcount⟩
+
+theorem getAllRunSucc_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (extra : Nat) :
+    GetCanonical (getAllRunSucc recur extra) allTailBytes := by
+  induction extra with
+  | zero =>
+    intro pre rest value st' h
+    let afterMode : Uses × Owned → GetM Expr := fun mode => do
+      let ty ← recur
+      let body ← recur
+      match body with
+      | .all .. => throw "getExpr: non-canonical all telescope"
+      | _ => return .all mode.1 mode.2 ty body
+    change (getAllMode >>= afterMode).run ⟨pre ++ rest, pre.size⟩ =
+      .ok (value, st') at h
+    obtain ⟨mode, afterModeBytes, hrestMode, hafterMode⟩ :=
+      GetCanonical.bind_inv getAllMode_canonical pre rest h
+    let modePre := pre ++ allModeBytes mode.1 mode.2
+    let afterTy : Expr → GetM Expr := fun ty => do
+      let body ← recur
+      match body with
+      | .all .. => throw "getExpr: non-canonical all telescope"
+      | _ => return .all mode.1 mode.2 ty body
+    have hafterMode' :
+        (recur >>= afterTy).run
+          ⟨modePre ++ afterModeBytes, modePre.size⟩ = .ok (value, st') := by
+      simpa [afterMode, afterTy, modePre] using hafterMode
+    obtain ⟨ty, afterTyBytes, hrestTy, hafterTy⟩ :=
+      GetCanonical.bind_inv hrecur modePre afterModeBytes hafterMode'
+    let tyPre := modePre ++ exprBytes ty
+    let finish : Expr → GetM Expr := fun body =>
+      match body with
+      | .all .. => throw "getExpr: non-canonical all telescope"
+      | _ => pure (.all mode.1 mode.2 ty body)
+    have hafterTy' :
+        (recur >>= finish).run
+          ⟨tyPre ++ afterTyBytes, tyPre.size⟩ = .ok (value, st') := by
+      simpa [afterTy, finish, tyPre] using hafterTy
+    obtain ⟨body, suffix, hrestBody, hfinish⟩ :=
+      GetCanonical.bind_inv hrecur tyPre afterTyBytes hafterTy'
+    have hbody : AllBase body := by
+      cases body with
+      | all u' o' ty' body' =>
+        change (Except.error _) = Except.ok (value, st') at hfinish
+        contradiction
+      | _ => trivial
+    have hpure :
+        (pure (.all mode.1 mode.2 ty body) : GetM Expr).run
+          ⟨(tyPre ++ exprBytes body) ++ suffix,
+            (tyPre ++ exprBytes body).size⟩ = .ok (value, st') := by
+      cases body with
+      | all u' o' ty' body' => simp [AllBase] at hbody
+      | _ => exact hfinish
+    simp at hpure
+    cases hpure
+    refine ⟨suffix, ?_, ?_⟩
+    · rw [hrestMode, hrestTy, hrestBody]
+      cases body <;> simp_all [AllBase, allTailBytes,
+        ByteArray.append_assoc]
+    · cases body <;> simp_all [AllBase, allTailBytes, modePre, tyPre,
+        ByteArray.append_assoc,
+        ByteArray.size_append, Nat.add_assoc]
+  | succ extra ih =>
+    intro pre rest value st' h
+    let afterMode : Uses × Owned → GetM Expr := fun mode => do
+      let ty ← recur
+      return .all mode.1 mode.2 ty (← getAllRunSucc recur extra)
+    change (getAllMode >>= afterMode).run ⟨pre ++ rest, pre.size⟩ =
+      .ok (value, st') at h
+    obtain ⟨mode, afterModeBytes, hrestMode, hafterMode⟩ :=
+      GetCanonical.bind_inv getAllMode_canonical pre rest h
+    let modePre := pre ++ allModeBytes mode.1 mode.2
+    let afterTy : Expr → GetM Expr := fun ty => do
+      let body ← getAllRunSucc recur extra
+      return .all mode.1 mode.2 ty body
+    have hafterMode' :
+        (recur >>= afterTy).run
+          ⟨modePre ++ afterModeBytes, modePre.size⟩ = .ok (value, st') := by
+      simpa [afterMode, afterTy, modePre] using hafterMode
+    obtain ⟨ty, afterTyBytes, hrestTy, hafterTy⟩ :=
+      GetCanonical.bind_inv hrecur modePre afterModeBytes hafterMode'
+    let tyPre := modePre ++ exprBytes ty
+    let finish : Expr → GetM Expr := fun body =>
+      pure (.all mode.1 mode.2 ty body)
+    have hafterTy' :
+        (getAllRunSucc recur extra >>= finish).run
+          ⟨tyPre ++ afterTyBytes, tyPre.size⟩ = .ok (value, st') := by
+      simpa [afterTy, finish, tyPre] using hafterTy
+    obtain ⟨body, suffix, hrestBody, hfinish⟩ :=
+      GetCanonical.bind_inv ih tyPre afterTyBytes hafterTy'
+    simp [finish] at hfinish
+    cases hfinish
+    refine ⟨suffix, ?_, ?_⟩
+    · rw [hrestMode, hrestTy, hrestBody]
+      simp [allTailBytes, ByteArray.append_assoc]
+    · simp [allTailBytes, modePre, tyPre, hrestMode, hrestTy,
+        hrestBody, ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc]
+
+theorem getAllRun_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (count : Nat) :
+    GetCanonical (getAllRun recur count) allTailBytes := by
+  cases count with
+  | zero =>
+    intro pre rest value st' h
+    simp [getAllRun] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ extra =>
+    simpa [getAllRun] using getAllRunSucc_canonical_of recur hrecur extra
+
+theorem getAllRunSucc_success_count (recur : GetM Expr) (extra : Nat) :
+    ∀ (initial : GetState) {value : Expr} {st' : GetState},
+      (getAllRunSucc recur extra).run initial = .ok (value, st') →
+      ∃ u o ty body,
+        value = .all u o ty body ∧ value.allCount = extra + 1 := by
+  induction extra with
+  | zero =>
+    intro initial value st' h
+    simp only [getAllRunSucc, StateT.run_bind] at h
+    cases hm : getAllMode.run initial with
+    | error err => rw [hm] at h; contradiction
+    | ok modeState =>
+      rcases modeState with ⟨mode, afterMode⟩
+      rw [hm] at h
+      simp only [bind, Except.bind] at h
+      cases ht : recur.run afterMode with
+      | error err => rw [ht] at h; contradiction
+      | ok tyState =>
+        rcases tyState with ⟨ty, afterTy⟩
+        rw [ht] at h
+        simp only at h
+        cases hb : recur.run afterTy with
+        | error err => rw [hb] at h; contradiction
+        | ok bodyState =>
+          rcases bodyState with ⟨body, afterBody⟩
+          rw [hb] at h
+          simp only at h
+          have hbase : AllBase body := by
+            cases body with
+            | all u' o' ty' body' =>
+              change (Except.error _) = Except.ok (value, st') at h
+              contradiction
+            | _ => trivial
+          have hpure :
+              (pure (.all mode.1 mode.2 ty body) : GetM Expr).run afterBody =
+                .ok (value, st') := by
+            cases body with
+            | all u' o' ty' body' => simp [AllBase] at hbase
+            | _ => exact h
+          simp at hpure
+          cases hpure
+          have hbodyCount : body.allCount = 0 := by
+            cases body <;> simp_all [AllBase, Expr.allCount]
+          exact ⟨mode.1, mode.2, ty, body, rfl,
+            by simp [Expr.allCount, hbodyCount]⟩
+  | succ extra ih =>
+    intro initial value st' h
+    simp only [getAllRunSucc, StateT.run_bind] at h
+    cases hm : getAllMode.run initial with
+    | error err => rw [hm] at h; contradiction
+    | ok modeState =>
+      rcases modeState with ⟨mode, afterMode⟩
+      rw [hm] at h
+      simp only [bind, Except.bind] at h
+      cases ht : recur.run afterMode with
+      | error err => rw [ht] at h; contradiction
+      | ok tyState =>
+        rcases tyState with ⟨ty, afterTy⟩
+        rw [ht] at h
+        simp only at h
+        cases hb : (getAllRunSucc recur extra).run afterTy with
+        | error err => rw [hb] at h; contradiction
+        | ok bodyState =>
+          rcases bodyState with ⟨body, afterBody⟩
+          rw [hb] at h
+          simp at h
+          cases h
+          obtain ⟨innerU, innerO, innerTy, innerBody, hbody, hcount⟩ :=
+            ih afterTy hb
+          refine ⟨mode.1, mode.2, ty, body, rfl, ?_⟩
+          simp [Expr.allCount, hcount]
+
+theorem getAllRun_success_count (recur : GetM Expr) (count : Nat)
+    (initial : GetState) {value : Expr} {st' : GetState}
+    (h : (getAllRun recur count).run initial = .ok (value, st')) :
+    ∃ u o ty body,
+      value = .all u o ty body ∧ value.allCount = count := by
+  cases count with
+  | zero =>
+    simp [getAllRun] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ extra =>
+    have h' : (getAllRunSucc recur extra).run initial = .ok (value, st') := by
+      simpa [getAllRun] using h
+    obtain ⟨u, o, ty, body, hvalue, hcount⟩ :=
+      getAllRunSucc_success_count recur extra initial h'
+    exact ⟨u, o, ty, body, hvalue, by simpa using hcount⟩
+
+def ExprTagCanonical (recur : GetM Expr) (tag : Tag4) : Prop :=
+  ∀ (pre rest : ByteArray) {value : Expr} {st' : GetState},
+    (getExprTag recur tag).run ⟨pre ++ rest, pre.size⟩ = .ok (value, st') →
+    ∃ payload suffix,
+      rest = payload ++ suffix ∧
+      tag4Bytes tag ++ payload = exprBytes value ∧
+      st' = ⟨pre ++ rest, pre.size + payload.size⟩
+
+theorem getExprTag_ref_canonical (recur : GetM Expr) (size : UInt64) :
+    ExprTagCanonical recur ⟨Expr.FLAG_REF, size⟩ := by
+  intro pre rest value st' h
+  let afterRef : Tag0 → GetM Expr := fun refTag => do
+    let idxs ← getTag0List size.toNat
+    return .ref refTag.size idxs.toArray
+  change (getTag0 >>= afterRef).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨refTag, afterRefBytes, hrestRef, hafterRef⟩ :=
+    GetCanonical.bind_inv getTag0_canonical pre rest h
+  let refPre := pre ++ tag0Bytes refTag
+  change (getTag0List size.toNat >>= fun idxs =>
+    pure (.ref refTag.size idxs.toArray)).run
+      ⟨refPre ++ afterRefBytes, refPre.size⟩ = .ok (value, st') at hafterRef
+  simp only [StateT.run_bind] at hafterRef
+  cases hi : (getTag0List size.toNat).run
+      ⟨refPre ++ afterRefBytes, refPre.size⟩ with
+  | error err => rw [hi] at hafterRef; contradiction
+  | ok idxState =>
+    rcases idxState with ⟨idxs, afterIdxs⟩
+    rw [hi] at hafterRef
+    simp at hafterRef
+    cases hafterRef
+    obtain ⟨suffix, hrestIdxs, hafterIdxs⟩ :=
+      getTag0List_canonical size.toNat refPre afterRefBytes hi
+    have hlength := getTag0List_success_length size.toNat
+      ⟨refPre ++ afterRefBytes, refPre.size⟩ hi
+    have hsize : idxs.length.toUInt64 = size := by
+      rw [hlength]
+      exact UInt64.ofNat_toNat
+    let payload := tag0Bytes refTag ++ tag0ListBytes idxs
+    refine ⟨payload, suffix, ?_, ?_, ?_⟩
+    · simp [payload, hrestRef, hrestIdxs, ByteArray.append_assoc]
+    · simp [payload, exprBytes, hsize, ByteArray.append_assoc]
+    · simpa [payload, refPre, hrestRef, hrestIdxs,
+        ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc] using hafterIdxs
+
+theorem getExprTag_recur_canonical (recur : GetM Expr) (size : UInt64) :
+    ExprTagCanonical recur ⟨Expr.FLAG_REC, size⟩ := by
+  intro pre rest value st' h
+  let afterRef : Tag0 → GetM Expr := fun refTag => do
+    let idxs ← getTag0List size.toNat
+    return .recur refTag.size idxs.toArray
+  change (getTag0 >>= afterRef).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨refTag, afterRefBytes, hrestRef, hafterRef⟩ :=
+    GetCanonical.bind_inv getTag0_canonical pre rest h
+  let refPre := pre ++ tag0Bytes refTag
+  change (getTag0List size.toNat >>= fun idxs =>
+    pure (.recur refTag.size idxs.toArray)).run
+      ⟨refPre ++ afterRefBytes, refPre.size⟩ = .ok (value, st') at hafterRef
+  simp only [StateT.run_bind] at hafterRef
+  cases hi : (getTag0List size.toNat).run
+      ⟨refPre ++ afterRefBytes, refPre.size⟩ with
+  | error err => rw [hi] at hafterRef; contradiction
+  | ok idxState =>
+    rcases idxState with ⟨idxs, afterIdxs⟩
+    rw [hi] at hafterRef
+    simp at hafterRef
+    cases hafterRef
+    obtain ⟨suffix, hrestIdxs, hafterIdxs⟩ :=
+      getTag0List_canonical size.toNat refPre afterRefBytes hi
+    have hlength := getTag0List_success_length size.toNat
+      ⟨refPre ++ afterRefBytes, refPre.size⟩ hi
+    have hsize : idxs.length.toUInt64 = size := by
+      rw [hlength]
+      exact UInt64.ofNat_toNat
+    let payload := tag0Bytes refTag ++ tag0ListBytes idxs
+    refine ⟨payload, suffix, ?_, ?_, ?_⟩
+    · simp [payload, hrestRef, hrestIdxs, ByteArray.append_assoc]
+    · simp [payload, exprBytes, hsize, ByteArray.append_assoc]
+    · simpa [payload, refPre, hrestRef, hrestIdxs,
+        ByteArray.append_assoc, ByteArray.size_append,
+        Nat.add_assoc] using hafterIdxs
+
+theorem getExprTag_prj_canonical (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (fieldIdx : UInt64) :
+    ExprTagCanonical recur ⟨Expr.FLAG_PRJ, fieldIdx⟩ := by
+  intro pre rest value st' h
+  let afterRef : Tag0 → GetM Expr := fun refTag => do
+    let val ← recur
+    return .prj refTag.size fieldIdx val
+  change (getTag0 >>= afterRef).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨refTag, afterRefBytes, hrestRef, hafterRef⟩ :=
+    GetCanonical.bind_inv getTag0_canonical pre rest h
+  let refPre := pre ++ tag0Bytes refTag
+  let finish : Expr → GetM Expr := fun val =>
+    pure (.prj refTag.size fieldIdx val)
+  have hafterRef' :
+      (recur >>= finish).run ⟨refPre ++ afterRefBytes, refPre.size⟩ =
+        .ok (value, st') := by
+    simpa [afterRef, finish, refPre] using hafterRef
+  obtain ⟨val, suffix, hrestVal, hfinish⟩ :=
+    GetCanonical.bind_inv hrecur refPre afterRefBytes hafterRef'
+  simp [finish] at hfinish
+  cases hfinish
+  let payload := tag0Bytes refTag ++ exprBytes val
+  refine ⟨payload, suffix, ?_, ?_, ?_⟩
+  · simp [payload, hrestRef, hrestVal, ByteArray.append_assoc]
+  · simp [payload, exprBytes, ByteArray.append_assoc]
+  · simp [payload, refPre, hrestRef, hrestVal,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc]
+
+theorem getExprTag_let_canonical (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (size : UInt64)
+    (hsize : ¬size > 1) :
+    ExprTagCanonical recur ⟨Expr.FLAG_LET, size⟩ := by
+  intro pre rest value st' h
+  let nonDep := size == 1
+  let afterTy : Expr → GetM Expr := fun ty => do
+    let val ← recur
+    let body ← recur
+    return .letE nonDep ty val body
+  simp only [getExprTag, Expr.FLAG_LET, hsize, if_false] at h
+  change (recur >>= afterTy).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨ty, afterTyBytes, hrestTy, hafterTy⟩ :=
+    GetCanonical.bind_inv hrecur pre rest h
+  let tyPre := pre ++ exprBytes ty
+  let afterVal : Expr → GetM Expr := fun val => do
+    let body ← recur
+    return .letE nonDep ty val body
+  have hafterTy' :
+      (recur >>= afterVal).run
+        ⟨tyPre ++ afterTyBytes, tyPre.size⟩ = .ok (value, st') := by
+    simpa [afterTy, afterVal, tyPre] using hafterTy
+  obtain ⟨val, afterValBytes, hrestVal, hafterVal⟩ :=
+    GetCanonical.bind_inv hrecur tyPre afterTyBytes hafterTy'
+  let valPre := tyPre ++ exprBytes val
+  let finish : Expr → GetM Expr := fun body =>
+    pure (.letE nonDep ty val body)
+  have hafterVal' :
+      (recur >>= finish).run
+        ⟨valPre ++ afterValBytes, valPre.size⟩ = .ok (value, st') := by
+    simpa [afterVal, finish, valPre] using hafterVal
+  obtain ⟨body, suffix, hrestBody, hfinish⟩ :=
+    GetCanonical.bind_inv hrecur valPre afterValBytes hafterVal'
+  simp [finish] at hfinish
+  cases hfinish
+  have hencodedSize : (if nonDep then 1 else 0) = size := by
+    dsimp [nonDep]
+    have hsize' : ¬1 < size.toNat := by
+      simpa [UInt64.lt_iff_toNat_lt] using hsize
+    have hcases : size.toNat = 0 ∨ size.toNat = 1 := by omega
+    rcases hcases with hzero | hone
+    · have : size = 0 := UInt64.toNat_inj.1 (by simpa using hzero)
+      subst size
+      rfl
+    · have : size = 1 := UInt64.toNat_inj.1 (by simpa using hone)
+      subst size
+      rfl
+  let payload := exprBytes ty ++ exprBytes val ++ exprBytes body
+  refine ⟨payload, suffix, ?_, ?_, ?_⟩
+  · simp [payload, hrestTy, hrestVal, hrestBody,
+      ByteArray.append_assoc]
+  · simp [payload, exprBytes, hencodedSize, ByteArray.append_assoc]
+  · simp [payload, tyPre, valPre, hrestTy, hrestVal, hrestBody,
+      ByteArray.append_assoc, ByteArray.size_append,
+      Nat.add_assoc]
+
+theorem getExprTag_app_canonical (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (size : UInt64) :
+    ExprTagCanonical recur ⟨Expr.FLAG_APP, size⟩ := by
+  intro pre rest value st' h
+  change (getAppRun recur size.toNat).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨suffix, hrest, hstate⟩ :=
+    getAppRun_canonical_of recur hrecur size.toNat pre rest h
+  obtain ⟨fn, arg, hvalue, hcount⟩ :=
+    getAppRun_success_count recur size.toNat
+      ⟨pre ++ rest, pre.size⟩ h
+  subst value
+  have hsize : (fn.appCount + 1).toUInt64 = size := by
+    change (Expr.appCount (.app fn arg)).toUInt64 = size
+    rw [hcount]
+    exact UInt64.ofNat_toNat
+  exact ⟨appSpineBytes (.app fn arg), suffix, hrest,
+    by simp [exprBytes, appSpineBytes, hsize, ByteArray.append_assoc], hstate⟩
+
+theorem getExprTag_lam_canonical (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (size : UInt64) :
+    ExprTagCanonical recur ⟨Expr.FLAG_LAM, size⟩ := by
+  intro pre rest value st' h
+  change (getLamRun recur size.toNat).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨suffix, hrest, hstate⟩ :=
+    getLamRun_canonical_of recur hrecur size.toNat pre rest h
+  obtain ⟨u, ty, body, hvalue, hcount⟩ :=
+    getLamRun_success_count recur size.toNat
+      ⟨pre ++ rest, pre.size⟩ h
+  subst value
+  have hsize : (body.lamCount + 1).toUInt64 = size := by
+    change (Expr.lamCount (.lam u ty body)).toUInt64 = size
+    rw [hcount]
+    exact UInt64.ofNat_toNat
+  exact ⟨lamTailBytes (.lam u ty body), suffix, hrest,
+    by simp [exprBytes, lamTailBytes, hsize, ByteArray.append_assoc], hstate⟩
+
+theorem getExprTag_all_canonical (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (size : UInt64) :
+    ExprTagCanonical recur ⟨Expr.FLAG_ALL, size⟩ := by
+  intro pre rest value st' h
+  change (getAllRun recur size.toNat).run ⟨pre ++ rest, pre.size⟩ =
+    .ok (value, st') at h
+  obtain ⟨suffix, hrest, hstate⟩ :=
+    getAllRun_canonical_of recur hrecur size.toNat pre rest h
+  obtain ⟨u, o, ty, body, hvalue, hcount⟩ :=
+    getAllRun_success_count recur size.toNat
+      ⟨pre ++ rest, pre.size⟩ h
+  subst value
+  have hsize : (body.allCount + 1).toUInt64 = size := by
+    change (Expr.allCount (.all u o ty body)).toUInt64 = size
+    rw [hcount]
+    exact UInt64.ofNat_toNat
+  exact ⟨allTailBytes (.all u o ty body), suffix, hrest,
+    by simp [exprBytes, allTailBytes, hsize, ByteArray.append_assoc], hstate⟩
+
+theorem getExprTag_canonical_of (recur : GetM Expr)
+    (hrecur : GetCanonical recur exprBytes) (tag : Tag4) :
+    ExprTagCanonical recur tag := by
+  rcases tag with ⟨flag, size⟩
+  intro pre rest value st' h
+  by_cases h0 : flag = 0
+  · subst flag
+    simp [getExprTag] at h
+    cases h
+    exact ⟨ByteArray.empty, rest, by simp,
+      by simp [exprBytes, Expr.FLAG_SORT], by simp⟩
+  by_cases h1 : flag = 1
+  · subst flag
+    simp [getExprTag] at h
+    cases h
+    exact ⟨ByteArray.empty, rest, by simp,
+      by simp [exprBytes, Expr.FLAG_VAR], by simp⟩
+  by_cases h2 : flag = 2
+  · subst flag
+    exact getExprTag_ref_canonical recur size pre rest h
+  by_cases h3 : flag = 3
+  · subst flag
+    exact getExprTag_recur_canonical recur size pre rest h
+  by_cases h4 : flag = 4
+  · subst flag
+    exact getExprTag_prj_canonical recur hrecur size pre rest h
+  by_cases h5 : flag = 5
+  · subst flag
+    simp [getExprTag] at h
+    cases h
+    exact ⟨ByteArray.empty, rest, by simp,
+      by simp [exprBytes, Expr.FLAG_STR], by simp⟩
+  by_cases h6 : flag = 6
+  · subst flag
+    simp [getExprTag] at h
+    cases h
+    exact ⟨ByteArray.empty, rest, by simp,
+      by simp [exprBytes, Expr.FLAG_NAT], by simp⟩
+  by_cases h7 : flag = 7
+  · subst flag
+    exact getExprTag_app_canonical recur hrecur size pre rest h
+  by_cases h8 : flag = 8
+  · subst flag
+    exact getExprTag_lam_canonical recur hrecur size pre rest h
+  by_cases h9 : flag = 9
+  · subst flag
+    exact getExprTag_all_canonical recur hrecur size pre rest h
+  by_cases h10 : flag = 10
+  · subst flag
+    by_cases hsize : size > 1
+    · simp [getExprTag, hsize] at h
+      change (Except.error _) = Except.ok (value, st') at h
+      contradiction
+    · exact getExprTag_let_canonical recur hrecur size hsize pre rest h
+  by_cases h11 : flag = 11
+  · subst flag
+    simp [getExprTag] at h
+    cases h
+    exact ⟨ByteArray.empty, rest, by simp,
+      by simp [exprBytes, Expr.FLAG_SHARE], by simp⟩
+  · simp [getExprTag] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getExprFuel_canonical (fuel : Nat) :
+    GetCanonical (getExprFuel fuel) exprBytes := by
+  induction fuel with
+  | zero =>
+    intro pre rest value st' h
+    simp [getExprFuel] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+  | succ fuel ih =>
+    intro pre rest value st' h
+    simp only [getExprFuel, StateT.run_bind] at h
+    cases ht : getTag4.run ⟨pre ++ rest, pre.size⟩ with
+    | error err =>
+      rw [ht] at h
+      contradiction
+    | ok tagState =>
+      rcases tagState with ⟨tag, afterTag⟩
+      rw [ht] at h
+      simp only [bind, Except.bind] at h
+      obtain ⟨afterTagBytes, hrestTag, hafterTag⟩ :=
+        getTag4_canonical pre rest ht
+      let tagPre := pre ++ tag4Bytes tag
+      have hafterTag' :
+          afterTag = ⟨tagPre ++ afterTagBytes, tagPre.size⟩ := by
+        rw [hafterTag]
+        simp [tagPre, hrestTag, ByteArray.append_assoc]
+      rw [hafterTag'] at h
+      obtain ⟨payload, suffix, hrestPayload, hencoding, hstate⟩ :=
+        getExprTag_canonical_of (getExprFuel fuel) ih tag
+          tagPre afterTagBytes h
+      refine ⟨suffix, ?_, ?_⟩
+      · calc
+          rest = tag4Bytes tag ++ afterTagBytes := hrestTag
+          _ = (tag4Bytes tag ++ payload) ++ suffix := by
+            rw [hrestPayload]
+            simp [ByteArray.append_assoc]
+          _ = exprBytes value ++ suffix := by rw [hencoding]
+      · simpa [tagPre, hrestTag, hrestPayload, ← hencoding,
+          ByteArray.append_assoc, ByteArray.size_append,
+          Nat.add_assoc] using hstate
+
+theorem getExpr_canonical : GetCanonical getExpr exprBytes := by
+  intro pre rest value st' h
+  have hfuel : (pre ++ rest).size - pre.size + 1 = rest.size + 1 := by
+    simp [ByteArray.size_append]
+  change (getExprFuel ((pre ++ rest).size - pre.size + 1)).run
+    ⟨pre ++ rest, pre.size⟩ = .ok (value, st') at h
+  rw [hfuel] at h
+  exact getExprFuel_canonical (rest.size + 1) pre rest h
+
+theorem canonicalLaw : CanonicalLaw Expr := by
+  intro input value h
+  change runGet getExpr input = .ok value at h
+  change runPut (putExpr value) = input
+  rw [runPut_eq_of_spec (putExpr_spec value)]
+  simp only [runGet] at h
+  cases hg : getExpr.run ⟨input, 0⟩ with
+  | error err =>
+    rw [hg] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨decoded, st⟩
+    rw [hg] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨suffix, hinput, hst⟩ :=
+      getExpr_canonical ByteArray.empty input hg
+    by_cases hfull : st.idx = st.bytes.size
+    · simp [hfull] at h
+      cases h
+      have hsize : (exprBytes value).size = input.size := by
+        have hidx := congrArg GetState.idx hst
+        have hbytes := congrArg GetState.bytes hst
+        simp at hidx hbytes
+        rw [hfull, hbytes] at hidx
+        exact hidx.symm
+      have hsuffix : suffix = ByteArray.empty := by
+        have hsizes := congrArg ByteArray.size hinput
+        simpa [ByteArray.size_append, hsize] using hsizes
+      simpa [hsuffix] using hinput.symm
+    · simp [hfull] at h
+
+theorem getExpr_spec (e : Expr) (hwf : e.wireWF) :
+    GetSpec getExpr (exprBytes e) e := by
+  intro pre suffix
+  let fuel := (pre ++ exprBytes e ++ suffix).size - pre.size + 1
+  have hfuel : (exprBytes e).size < fuel := by
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  have hspec := getFuel_expr_spec e fuel hwf hfuel
+  have hrun := hspec pre suffix
+  change (getExprFuel fuel).run
+    ⟨pre ++ exprBytes e ++ suffix, pre.size⟩ = _ at hrun
+  simpa [getExpr, fuel, ByteArray.size_append] using hrun
+
+end ExprLaws
+
+namespace Expr
+
+/-- Roundtrip holds on exactly the recursively count-representable expression
+domain. Unbounded Lean `Nat` counts outside this domain cannot fit v2's u64
+headers. -/
+def RoundtripLaw : Prop :=
+  ∀ e : Expr, e.wireWF → de (ser e) = .ok e
+
+theorem roundtripLaw : RoundtripLaw := by
+  intro e hwf
+  change runGet getExpr (runPut (putExpr e)) = .ok e
+  rw [runPut_eq_of_spec (putExpr_spec e)]
+  exact runGet_eq_ok_of_spec (ExprLaws.getExpr_spec e hwf)
+
+/-- Every accepted expression byte string is its unique canonical encoding. -/
+theorem canonicalLaw : Ixon.CanonicalLaw Expr :=
+  ExprLaws.canonicalLaw
+
+end Expr
+
+/-! Elaboration-time roundtrip and canonicity checks. -/
+
+private def roundtrips (e : Expr) : Bool :=
+  match (de (ser e) : Except String Expr) with
+  | .ok e' => e' == e
+  | .error _ => false
+
+#guard roundtrips (.sort 0)
+#guard roundtrips (.var 300)
+#guard roundtrips (.ref 1 #[0, 2, 200])
+#guard roundtrips (.recur 2 #[1])
+#guard roundtrips (.prj 3 1 (.var 0))
+#guard roundtrips (.str 5)
+#guard roundtrips (.nat 7)
+#guard roundtrips (.share 12)
+#guard roundtrips (.lam .linear (.sort 0) (.var 0))
+#guard roundtrips (.lam .many (.sort 0) (.lam .erased (.sort 1) (.var 1)))
+#guard roundtrips
+  (.all .many .shared (.sort 1) (.all .linear .unique (.var 0) (.var 1)))
+#guard roundtrips (.app (.app (.var 0) (.var 1)) (.var 2))
+#guard roundtrips (.letE true (.sort 0) (.var 2) (.app (.var 0) (.var 1)))
+#guard roundtrips
+  (.lam .affine (.all .erased .shared (.sort 0) (.sort 0)) (.share 3))
+
+private def rejects (bytes : Array UInt8) : Bool :=
+  match (de (ByteArray.mk bytes) : Except String Expr) with
+  | .ok _ => false
+  | .error _ => true
+
+-- empty lam telescope (LAM tag, count 0, then var 0)
+#guard rejects #[0x80, 0x10]
+-- lam mode byte out of range (LAM count 1, mode 0x04, sort 0, var 0)
+#guard rejects #[0x81, 0x04, 0x00, 0x10]
+-- all mode byte out of range (ALL count 1, mode 0x08, sort 0, var 0)
+#guard rejects #[0x91, 0x08, 0x00, 0x10]
+-- non-minimal var size (large form for a size that fits small form)
+#guard rejects #[0x18, 0x05]
+-- letE with nonDep flag 2
+#guard rejects #[0xA2, 0x00, 0x10, 0x10]
+-- trailing bytes after a complete term
+#guard rejects #[0x10, 0x10]
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/Hash.lean b/Ix/Compiler/Ixon/Hash.lean
new file mode 100644
index 000000000..2aa065fc0
--- /dev/null
+++ b/Ix/Compiler/Ixon/Hash.lean
@@ -0,0 +1,48 @@
+import Blake3.Rust
+import Ix.Compiler.Ixon.Address
+import Ix.Compiler.Ixon.Const
+
+/-!
+# Content hashing
+
+Low-level BLAKE3 primitives over canonical artifact serializations. The hash
+itself is FFI (Rust blake3 via Blake3.lean) — an active entry in the tracked
+`docs/compiler/trusted-extern-ledger.md`: assumed semantics is the BLAKE3
+function; the endgame replacement is a verified Lean implementation
+compiled by our own backend.
+
+The semantic `Constant.address?` boundary lives in `Ixon.Sharing`, after the
+layer-2 recompression check. IxIR declaration preimages and address APIs live
+in their respective `IxIR0/Serialize.lean` and `IxIR1/Serialize.lean` modules.
+This module intentionally exposes no unchecked constant-address helper.
+
+Runtime hash vectors and artifact identities are checked by the compiled
+`compiler-tests` executable (`Tests/Compiler/Tests.lean`). The pinned Blake3
+dependency precompiles its native libraries; the compiler proof fence records
+any native proof leaves that arise through that dependency.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-- blake3 of arbitrary bytes as an `Address`. -/
+def Address.blake3 (x : ByteArray) : Address :=
+  let digest := Blake3.Rust.hash x
+  ⟨digest.val, digest.property⟩
+
+namespace Address
+
+/-- The exact pairwise cryptographic premise used by semantic-address
+theorems. It deliberately does not assert impossible global injectivity of a
+fixed-width hash. -/
+def Blake3NoCollision (left right : ByteArray) : Prop :=
+  Address.blake3 left = Address.blake3 right → left = right
+
+end Address
+
+/-- Hash of a bare serialized expression. This is only a local cache key:
+table indices have meaning inside a `Constant.Frame`, so this is deliberately
+not named `address` and must not be used as a semantic object identity. -/
+def Expr.serializedHash (e : Expr) : Address :=
+  .blake3 (runPut (putExpr e))
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/Merkle.lean b/Ix/Compiler/Ixon/Merkle.lean
new file mode 100644
index 000000000..0840c7c47
--- /dev/null
+++ b/Ix/Compiler/Ixon/Merkle.lean
@@ -0,0 +1,84 @@
+import Ix.Compiler.Ixon.Hash
+
+/-!
+# Canonical ix Merkle roots
+
+This is the small canonical-set Merkle construction used by ix environment
+and catalog roots.  Leaves are sorted lexicographically and deduplicated,
+then domain-separated as `BLAKE3(0x00 || address)`.  Internal nodes are
+`BLAKE3(0x01 || left || right)`; an odd node is paired with the fixed
+32-byte zero sentinel rather than duplicated.
+-/
+
+namespace Ix.Compiler.Ixon.Merkle
+
+def leafDomain : UInt8 := 0x00
+def nodeDomain : UInt8 := 0x01
+
+/-- The empty-set root and odd-level padding value used by ix. -/
+def zeroAddress : Address := Address.replicate 0
+
+/-- Allocation-free lexicographic comparison of the 32 address bytes. -/
+def compareAddress (left right : Address) : Ordering := Id.run do
+  for index in [:32] do
+    let leftByte := left.hash[index]!
+    let rightByte := right.hash[index]!
+    if leftByte < rightByte then return .lt
+    if rightByte < leftByte then return .gt
+  return .eq
+
+def addressLT (left right : Address) : Bool :=
+  compareAddress left right == .lt
+
+def sortAddresses (addresses : Array Address) : Array Address :=
+  addresses.qsort addressLT
+
+/-- Collapse adjacent equal entries in an already sorted address array. -/
+def dedupSorted (addresses : Array Address) : Array Address := Id.run do
+  let mut result := #[]
+  for address in addresses do
+    match result.back? with
+    | some previous =>
+      if previous != address then
+        result := result.push address
+    | none => result := result.push address
+  return result
+
+def leafHash (address : Address) : Address :=
+  Address.blake3 (ByteArray.mk #[leafDomain] ++ address.hash)
+
+def nodeHash (left right : Address) : Address :=
+  Address.blake3
+    (ByteArray.mk #[nodeDomain] ++ left.hash ++ right.hash)
+
+private def reduceLevel (level : Array Address) : Array Address := Id.run do
+  let mut next := #[]
+  let mut index := 0
+  while index < level.size do
+    let left := level[index]!
+    let right := if index + 1 < level.size then
+      level[index + 1]!
+    else
+      zeroAddress
+    next := next.push (nodeHash left right)
+    index := index + 2
+  return next
+
+private def buildTree (initial : Array Address) : Address := Id.run do
+  let mut level := initial
+  while level.size > 1 do
+    level := reduceLevel level
+  return level[0]!
+
+/-- Canonical root over a set of addresses.  The empty set uses ix's fixed
+zero sentinel; all nonempty leaves are hashed before tree construction. -/
+def rootCanonical (addresses : Array Address) : Address :=
+  let unique := dedupSorted (sortAddresses addresses)
+  if unique.isEmpty then
+    zeroAddress
+  else if unique.size == 1 then
+    leafHash unique[0]!
+  else
+    buildTree (unique.map leafHash)
+
+end Ix.Compiler.Ixon.Merkle
diff --git a/Ix/Compiler/Ixon/RecursorUsage.lean b/Ix/Compiler/Ixon/RecursorUsage.lean
new file mode 100644
index 000000000..4a2f9c0d2
--- /dev/null
+++ b/Ix/Compiler/Ixon/RecursorUsage.lean
@@ -0,0 +1,199 @@
+import Ix.Compiler.Ixon.UsageCheck
+
+/-!
+# Usage checking for saturated recursor rules
+
+A recursor rule is entered with its complete parameter/field telescope.
+Checking that telescope together avoids treating intermediate curried rule
+lambdas as escaping closures. Bound callable parameters retain their syntactic
+telescopes, so a known minor's unique result can feed a recursive call.
+The original v0 checker is unchanged. This opt-in policy also permits a
+definition's fully supplied entry telescope after its v0 check fails.
+-/
+
+namespace Ix.Compiler.Ixon.RecursorUsage
+
+open UsageCheck
+
+def policyTag : String := "recursor-modes/1"
+
+structure Binding where
+  world : Owned
+  callable : Telescope := []
+
+private def worlds (bindings : List Binding) : List Owned := bindings.map (·.world)
+
+private def headTelescope (ctx : CheckCtx) (fuel : Nat) (bindings : List Binding)
+    (head : Expr) : Except UsageErr Telescope :=
+  match head with
+  | .var index =>
+      match bindings[index.toNat]? with
+      | some binding => .ok binding.callable
+      | none => .error (.unboundVar index.toNat)
+  | _ => telescopeOfHead ctx fuel head
+
+/-- A nullary constructor reference creates a new runtime cell. Its type has
+no arrow on which to write a result world, so this explicit policy reconstructs
+freshness from the resolved constructor declaration. -/
+private def freshNullary (ctx : CheckCtx) (index : UInt64) : Bool :=
+  (do
+    let address ← ctx.refs[index.toNat]?
+    let constant ← ctx.resolve address
+    let .cPrj projection := constant.info | none
+    let block ← ctx.resolve projection.block
+    let .muts members := block.info | none
+    let .indc inductiveType ← members[projection.idx.toNat]? | none
+    let constructor ← inductiveType.ctors[projection.cidx.toNat]?
+    return inductiveType.params == 0 && constructor.params == 0 && constructor.fields == 0
+    : Option Bool).getD false
+
+mutual
+
+/-- The first-order body of a fully supplied rule. Unknown callable heads and
+escaping closures are rejected; all ownership demands must be reconstructed. -/
+def checkBody (ctx : CheckCtx) (fuel : Nat) (ghost : Bool)
+    (bindings : List Binding) (expression : Expr) : Except UsageErr (UseVec × Owned) :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 => do
+      let expression ← expandShareE ctx fuel expression
+      match expression with
+      | .app f a =>
+          let (arguments, rawHead) := Expr.collectApp (.app f a)
+          let head ← expandShareE ctx fuel rawHead
+          let telescope ← headTelescope ctx fuel bindings head
+          if arguments.length != telescope.length then
+            throw (.internal "recursor mode rule requires a resolved saturated callable telescope")
+          let (headUses, _) ← checkBody ctx fuel ghost bindings head
+          let uses ← checkArguments ctx fuel ghost bindings telescope arguments headUses
+          let result := if ghost then .shared else
+            ((telescope[arguments.length - 1]?).map (·.owned)).getD .shared
+          return (uses, result)
+      | .lam .. | .letE .. | .prj .. | .all .. =>
+          throw (.internal "recursor mode rule is outside the first-order body fragment")
+      | .ref index _ =>
+          if !ghost && freshNullary ctx index then
+            return (UseVec.zeros bindings.length, .unique)
+          else UsageCheck.check ctx fuel ghost (worlds bindings) expression
+      | _ => UsageCheck.check ctx fuel ghost (worlds bindings) expression
+  termination_by fuel
+
+def checkArguments (ctx : CheckCtx) (fuel : Nat) (ghost : Bool)
+    (bindings : List Binding) (telescope : Telescope) (arguments : List Expr)
+    (accumulator : UseVec) : Except UsageErr UseVec :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+      match arguments, telescope with
+      | [], _ => .ok accumulator
+      | _ :: _, [] => .error (.internal "recursor mode argument has no demand")
+      | argument :: rest, demand :: demands => do
+          let argument ← expandShareE ctx fuel argument
+          let contribution ← if demand.dropped then do
+            let (uses, _) ← UsageCheck.check ctx fuel true (worlds bindings) argument
+            pure (UseVec.zeroScale uses)
+          else do
+            let (uses, actual) ← checkBody ctx fuel ghost bindings argument
+            let unique := demand.uses == .linear || demand.uses == .affine
+            if !ghost && unique && actual != .unique then throw (.dereliction demand.uses)
+            if !ghost && !unique && actual == .unique then throw .freezeNeeded
+            pure <| if !ghost && unique then
+              match argument with
+              | .var index => UseVec.singleMoved bindings.length index.toNat
+              | _ => uses
+            else uses
+          checkArguments ctx fuel ghost bindings demands rest (UseVec.add accumulator contribution)
+  termination_by fuel
+
+end
+
+private def validateUses : List (Uses × Bool) → UseVec → Except UsageErr Unit
+  | [], [] => .ok ()
+  | (mode, dropped) :: modes, use :: uses => do
+      unless mode.covers use.uses do throw (.binderCovers mode use.uses)
+      if dropped && use.uses != .erased then throw (.typeBinderRuntimeUse use.uses)
+      if use.moved && use.uses != .linear then throw (.useAfterMove use.uses)
+      validateUses modes uses
+  | _, _ => .error (.internal "recursor rule usage telescope mismatch")
+
+/-- Rule lambdas are an explicit saturated entry telescope, never a PAP.
+Each retained binding stores its own type's callable demands. -/
+def checkRule (ctx : CheckCtx) (fuel : Nat) (modes : List Uses) (result : Owned)
+    (bindings : List Binding) (declared : List (Uses × Bool)) (body : Expr) :
+    Except UsageErr Unit :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 => do
+      let body ← expandShareE ctx fuel body
+      match modes, body with
+      | expected :: modes, .lam mode domain rest =>
+          if mode != expected then
+            throw (.internal "recursor rule binder disagrees with its source mode telescope")
+          discard <| UsageCheck.check ctx fuel true (worlds bindings) domain
+          let dropped := erasureDropsBinder ctx.sharing fuel mode domain
+          checkRule ctx fuel modes result
+            ({ world := worldOf mode, callable := telescopeOf ctx.sharing fuel domain } :: bindings)
+            ((mode, dropped) :: declared) rest
+      | [], body =>
+          let (uses, actual) ← checkBody ctx fuel false bindings body
+          if result == .unique && actual != .unique then throw (.resultNotUnique actual)
+          if result != .unique && actual == .unique then throw .freezeNeeded
+          validateUses declared uses
+      | _, _ => throw (.internal "recursor mode rule does not match its complete telescope")
+  termination_by fuel
+
+/-- v1 is deliberately bounded to non-indexed unique-major recursors.
+Their stored types remain the source of argument/result demands. -/
+def checkRecursor (ctx : CheckCtx) (fuel : Nat) (recursor : Recursor) : Except UsageErr Unit := do
+  let telescope := telescopeOf ctx.sharing fuel recursor.typ
+  let some major := telescope.getLast? | throw (.internal "recursor mode telescope is empty")
+  if worldOf major.uses != .unique then
+    return ← UsageCheck.checkRecursor ctx fuel recursor
+  if recursor.indices != 0 || recursor.motives != 0 || recursor.k then
+    throw (.internal "unique recursor mode requires the non-indexed non-K fragment")
+  if telescope.length != recursor.params.toNat + recursor.minors.toNat + 1 then
+    throw (.internal "recursor mode telescope arity mismatch")
+  discard <| UsageCheck.check ctx fuel true [] recursor.typ
+  let parameterModes := (telescope.take (recursor.params.toNat + recursor.minors.toNat)).map (·.uses)
+  for rule in recursor.rules do
+    checkRule ctx fuel (parameterModes ++ List.replicate rule.fields.toNat .linear)
+      major.owned [] [] rule.rhs
+
+/-- A failed v0 definition may use the same bounded, fully supplied body
+checker. This admits freshly constructed unique nullary values; it admits no
+escaping lambda, let, projection, or unresolved callable body. -/
+def checkDefinition (ctx : CheckCtx) (fuel : Nat) (definition : Definition) :
+    Except UsageErr Unit := do
+  discard <| UsageCheck.check ctx fuel true [] definition.typ
+  let telescope := telescopeOf ctx.sharing fuel definition.typ
+  checkRule ctx fuel (telescope.map (·.uses))
+    ((telescope.getLast?).map (·.owned) |>.getD .shared) [] [] definition.value
+
+/-- Explicit opt-in source policy. Definitions try v0 before the bounded
+saturated entry rule; other non-recursor declarations retain v0 checks. -/
+def checkConstant (resolve : Address → Option Constant) (constant : Constant)
+    (fuel : Nat := UsageCheck.defaultFuel) : Except UsageErr Unit := do
+  let members := match constant.info with | .muts members => members | _ => #[]
+  let context : CheckCtx :=
+    { resolve, sharing := constant.sharing, refs := constant.refs, selfMuts := members }
+  match constant.info with
+  | .defn definition =>
+      match UsageCheck.checkDefinition resolve constant definition fuel with
+      | .ok _ => pure ()
+      | .error _ => checkDefinition context fuel definition
+  | .recr recursor => checkRecursor context fuel recursor
+  | .muts members =>
+      for member in members do
+        match member with
+        | .recr recursor => checkRecursor context fuel recursor
+        | .defn definition =>
+            match UsageCheck.checkDefinition resolve constant definition fuel with
+            | .ok _ => pure ()
+            | .error _ => checkDefinition context fuel definition
+        | .indc typeDefinition =>
+            discard <| UsageCheck.check context fuel true [] typeDefinition.typ
+            for constructor in typeDefinition.ctors do
+              discard <| UsageCheck.check context fuel true [] constructor.typ
+  | _ => UsageCheck.checkConstant resolve constant fuel
+
+end Ix.Compiler.Ixon.RecursorUsage
diff --git a/Ix/Compiler/Ixon/Serialize.lean b/Ix/Compiler/Ixon/Serialize.lean
new file mode 100644
index 000000000..da3804035
--- /dev/null
+++ b/Ix/Compiler/Ixon/Serialize.lean
@@ -0,0 +1,1639 @@
+import Std
+
+/-!
+# Ixon serialization primitives
+
+Byte-level plumbing for the Ixon v2 codec, mirroring ix's format family
+(`ix/Ix/Ixon.lean`): `PutM`/`GetM`, minimal little-endian u64s, and the
+`Tag0`/`Tag2`/`Tag4` headers.
+
+v2 decoders are **strict**: non-minimal size encodings, large-form sizes
+that fit the small form, and trailing bytes are all rejected. They are
+designed so byte-equality and value-equality coincide — content addressing
+demands exactly one spelling per value — with the global `RoundtripLaw` and
+`CanonicalLaw` proofs still tracked explicitly below.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-- External store/protocol identifier for these bytes. Individual Merkle-DAG
+objects deliberately carry no redundant in-band version prefix. -/
+def wireFormatId : String := "ixon-v2"
+
+/-- Serialization writer monad: accumulate bytes. -/
+abbrev PutM := StateM ByteArray
+
+/-- Deserialization state: input bytes and cursor. -/
+structure GetState where
+  bytes : ByteArray
+  idx : Nat
+
+/-- Deserialization monad: cursor over bytes, `String` errors. -/
+abbrev GetM := StateT GetState (Except String)
+
+def runPut (m : PutM Unit) : ByteArray :=
+  (m.run .empty).2
+
+/-- Run a decoder, requiring full consumption of the input. -/
+def runGet (m : GetM α) (bytes : ByteArray) : Except String α := do
+  let (a, st) ← m.run ⟨bytes, 0⟩
+  if st.idx != st.bytes.size then
+    throw s!"trailing bytes: consumed {st.idx} of {st.bytes.size}"
+  return a
+
+class Serialize (α : Type) where
+  put : α → PutM Unit
+  get : GetM α
+
+def ser [Serialize α] (a : α) : ByteArray :=
+  runPut (Serialize.put a)
+
+def de [Serialize α] (bytes : ByteArray) : Except String α :=
+  runGet Serialize.get bytes
+
+/-! ## Codec laws
+
+These propositions separate the two global proof obligations. Total codec
+definitions make them ordinary kernel statements rather than claims about
+opaque `partial` implementations. -/
+
+/-- Encoding followed by strict decoding returns the original value. -/
+def RoundtripLaw (α : Type) [Serialize α] : Prop :=
+  ∀ a : α, de (ser a) = .ok a
+
+/-- Every accepted byte string is exactly the encoder's canonical spelling
+of its decoded value. Full consumption is already part of `de`. -/
+def CanonicalLaw (α : Type) [Serialize α] : Prop :=
+  ∀ (bytes : ByteArray) (a : α), de bytes = .ok a → ser a = bytes
+
+/-! Cursor-relative specifications are the compositional proof layer beneath
+the global laws. A writer appends exactly `output`; a reader consumes exactly
+`input` while leaving arbitrary surrounding bytes untouched. -/
+
+/-- A successful unit writer appends exactly `output`. -/
+def PutSpec (put : PutM Unit) (output : ByteArray) : Prop :=
+  ∀ pre, put.run pre = ((), pre ++ output)
+
+/-- A reader consumes exactly `input`, from an arbitrary cursor, and returns
+`value` without changing either the preceding or following bytes. -/
+def GetSpec (get : GetM α) (input : ByteArray) (value : α) : Prop :=
+  ∀ pre suffix,
+    get.run ⟨pre ++ input ++ suffix, pre.size⟩ =
+      .ok (value,
+        ⟨pre ++ input ++ suffix, pre.size + input.size⟩)
+
+/-- Converse reader specification: every successful parse consumes the
+canonical encoding of its result and leaves an arbitrary suffix untouched. -/
+def GetCanonical (get : GetM α) (encode : α → ByteArray) : Prop :=
+  ∀ (pre rest : ByteArray) {value : α} {st' : GetState},
+    get.run ⟨pre ++ rest, pre.size⟩ = .ok (value, st') →
+    ∃ suffix,
+      rest = encode value ++ suffix ∧
+      st' = ⟨pre ++ rest, pre.size + (encode value).size⟩
+
+/-- Sequential writer specifications compose by byte-array append. -/
+theorem PutSpec.seq {left right : PutM Unit} {leftBytes rightBytes : ByteArray}
+    (hleft : PutSpec left leftBytes) (hright : PutSpec right rightBytes) :
+    PutSpec (left >>= fun _ => right) (leftBytes ++ rightBytes) := by
+  intro pre
+  simp only [StateT.run_bind]
+  rw [hleft pre]
+  change right.run (pre ++ leftBytes) = _
+  rw [hright (pre ++ leftBytes)]
+  simp [ByteArray.append_assoc]
+
+/-- Sequential reader specifications compose by byte-array append. -/
+theorem GetSpec.bind {get : GetM α} {next : α → GetM β}
+    {left right : ByteArray} {value : α} {result : β}
+    (hget : GetSpec get left value)
+    (hnext : GetSpec (next value) right result) :
+    GetSpec (get >>= next) (left ++ right) result := by
+  intro pre suffix
+  simp only [StateT.run_bind]
+  have hbytes : pre ++ (left ++ right) ++ suffix =
+      pre ++ left ++ (right ++ suffix) := by
+    simp [ByteArray.append_assoc]
+  rw [hbytes, hget pre (right ++ suffix)]
+  change (next value).run
+    ⟨pre ++ left ++ (right ++ suffix), pre.size + left.size⟩ = _
+  have hpre : (pre ++ left).size = pre.size + left.size :=
+    ByteArray.size_append
+  rw [← hpre]
+  simpa [ByteArray.append_assoc, ByteArray.size_append, Nat.add_assoc] using
+    hnext (pre ++ left) suffix
+
+/-- A pure reader returns its value without consuming bytes. -/
+theorem GetSpec.pure (value : α) :
+    GetSpec (pure value) ByteArray.empty value := by
+  intro pre suffix
+  simp
+  rfl
+
+/-- A writer specification determines its top-level output. -/
+theorem runPut_eq_of_spec {put : PutM Unit} {bytes : ByteArray}
+    (h : PutSpec put bytes) : runPut put = bytes := by
+  simpa [runPut] using congrArg Prod.snd (h .empty)
+
+/-- A reader specification determines strict decoding of its exact input. -/
+theorem runGet_eq_ok_of_spec {get : GetM α} {bytes : ByteArray} {value : α}
+    (h : GetSpec get bytes value) : runGet get bytes = .ok value := by
+  simp only [runGet]
+  have hrun := h .empty .empty
+  simp only [ByteArray.empty_append, ByteArray.append_empty, ByteArray.size_empty,
+    Nat.zero_add] at hrun
+  rw [hrun]
+  simp only [bind, Except.bind]
+  simp
+  rfl
+
+/-- A roundtrip proof immediately makes content serialization injective. -/
+theorem ser_injective_of_roundtrip [Serialize α] (h : RoundtripLaw α) :
+    Function.Injective (ser (α := α)) := by
+  intro a b hab
+  have ha := h a
+  have hb := h b
+  rw [hab, hb] at ha
+  cases ha
+  rfl
+
+/-- Canonical decoding permits at most one accepted byte spelling per value. -/
+theorem accepted_bytes_unique_of_canonical [Serialize α]
+    (h : CanonicalLaw α) {a : α} {left right : ByteArray}
+    (hl : de left = .ok a) (hr : de right = .ok a) : left = right :=
+  (h left a hl).symm.trans (h right a hr)
+
+/-! ## Primitives -/
+
+def putU8 (x : UInt8) : PutM Unit :=
+  modify fun s => s.push x
+
+/-- The one-byte output used by the primitive byte codec. -/
+def u8Bytes (x : UInt8) : ByteArray :=
+  [x].toByteArray
+
+def getU8 : GetM UInt8 := do
+  let st ← get
+  if h : st.idx < st.bytes.size then
+    let b := st.bytes[st.idx]
+    set { st with idx := st.idx + 1 }
+    return b
+  else
+    throw "EOF"
+
+theorem putU8_spec (x : UInt8) : PutSpec (putU8 x) (u8Bytes x) := by
+  intro pre
+  change ((), pre.push x) = ((), pre ++ u8Bytes x)
+  congr 1
+  rw [u8Bytes, ByteArray.append_toByteArray_singleton]
+
+theorem getU8_spec (x : UInt8) : GetSpec getU8 (u8Bytes x) x := by
+  intro pre suffix
+  have hidx : pre.size < pre.size + 1 + suffix.size := by omega
+  simp [getU8, u8Bytes, hidx]
+  have hget (h : pre.size < (pre.push x).size) :
+      (pre.push x)[pre.size]'h = x := by
+    rcases pre with ⟨data⟩
+    exact Array.getElem_push_eq
+  rw [hget]
+  rfl
+
+/-- Count bytes needed to represent a u64 in minimal little-endian form. -/
+def u64ByteCount (x : UInt64) : UInt8 :=
+  if x == 0 then 0
+  else if x < 0x100 then 1
+  else if x < 0x10000 then 2
+  else if x < 0x1000000 then 3
+  else if x < 0x100000000 then 4
+  else if x < 0x10000000000 then 5
+  else if x < 0x1000000000000 then 6
+  else if x < 0x100000000000000 then 7
+  else 8
+
+/-- The low `n` bytes of a u64, least significant byte first. -/
+def u64LEList : Nat → UInt64 → List UInt8
+  | 0, _ => []
+  | n + 1, x => x.toUInt8 :: u64LEList n (x >>> 8)
+
+/-- Interpret a least-significant-byte-first list as a u64. Callers reject
+lists longer than eight before invoking this function. -/
+def u64OfLEList : List UInt8 → UInt64
+  | [] => 0
+  | b :: rest => b.toUInt64 ||| (u64OfLEList rest <<< 8)
+
+/-- The low `n` little-endian bytes of a u64. -/
+def u64LEBytes (x : UInt64) (n : Nat) : ByteArray :=
+  (u64LEList n x).toByteArray
+
+/-- Interpret at most eight little-endian bytes as a u64. -/
+def u64OfLEBytes (bytes : ByteArray) : UInt64 :=
+  u64OfLEList bytes.data.toList
+
+theorem u64LEList_length (n : Nat) (x : UInt64) :
+    (u64LEList n x).length = n := by
+  induction n generalizing x with
+  | zero => rfl
+  | succ n ih => simp [u64LEList, ih]
+
+@[simp] theorem u64LEBytes_size (n : Nat) (x : UInt64) :
+    (u64LEBytes x n).size = n := by
+  simp [u64LEBytes, u64LEList_length]
+
+private theorem u64OfLEList_zero_above (bytes : List UInt8) (i : Nat)
+    (h : 8 * bytes.length ≤ i) :
+    (u64OfLEList bytes).toBitVec.getLsbD i = false := by
+  induction bytes generalizing i with
+  | nil => simp [u64OfLEList]
+  | cons b rest ih =>
+    simp only [u64OfLEList, UInt64.toBitVec_or, UInt64.toBitVec_shiftLeft]
+    simp
+    constructor
+    · intro _
+      exact BitVec.getLsbD_of_ge b.toBitVec i (by
+        simp only [List.length_cons, Nat.mul_add] at h
+        omega)
+    · intro _ hi
+      apply ih
+      simp only [List.length_cons, Nat.mul_add] at h
+      omega
+
+private theorem u64OfLEList_cons_shift (b : UInt8) (rest : List UInt8)
+    (hle : rest.length ≤ 7) :
+    (b.toUInt64 ||| (u64OfLEList rest <<< 8)) >>> 8 =
+      u64OfLEList rest := by
+  apply UInt64.toBitVec_inj.1
+  ext i hi
+  simp only [UInt64.toBitVec_shiftRight, UInt64.toBitVec_or,
+    UInt64.toBitVec_shiftLeft]
+  simp
+  by_cases hlow : i < 56
+  · have hsum : 8 + i < 64 := by omega
+    have h8 : ¬8 + i < 8 := by omega
+    simp [hsum, h8, BitVec.getLsbD, BitVec.getElem_eq_testBit_toNat]
+  · have hz := u64OfLEList_zero_above rest i (by omega)
+    have hz' : (u64OfLEList rest).toBitVec[i] = false := by
+      simpa [BitVec.getLsbD, BitVec.getElem_eq_testBit_toNat] using hz
+    have hsum : ¬8 + i < 64 := by omega
+    simp [hsum, hz']
+
+/-- Re-encoding any list of at most eight little-endian bytes recovers the
+list. The proof reduces the word operations to kernel-checked bit extensionality. -/
+theorem u64LEList_of_decode (bytes : List UInt8) (hle : bytes.length ≤ 8) :
+    u64LEList bytes.length (u64OfLEList bytes) = bytes := by
+  induction bytes with
+  | nil => rfl
+  | cons b rest ih =>
+    simp only [List.length_cons] at hle
+    simp only [List.length_cons, u64LEList, u64OfLEList]
+    rw [show (b.toUInt64 ||| u64OfLEList rest <<< 8).toUInt8 = b by
+      apply UInt8.toBitVec_inj.1
+      simp]
+    rw [u64OfLEList_cons_shift b rest (by omega)]
+    congr 1
+    exact ih (by omega)
+
+/-- Re-encoding any byte array of length at most eight recovers it exactly. -/
+theorem u64LEBytes_of_decode (bytes : ByteArray) (hle : bytes.size ≤ 8) :
+    u64LEBytes (u64OfLEBytes bytes) bytes.size = bytes := by
+  rcases bytes with ⟨data⟩
+  change data.size ≤ 8 at hle
+  simp only [u64LEBytes, u64OfLEBytes, ByteArray.size]
+  rw [show data.size = data.toList.length by simp]
+  rw [u64LEList_of_decode data.toList (by simpa using hle)]
+  apply ByteArray.ext
+  exact Array.toList_inj.mp (by simp)
+
+/-- Minimal byte counts are always representable by a u64 payload. -/
+theorem u64ByteCount_le_eight (x : UInt64) : (u64ByteCount x).toNat ≤ 8 := by
+  simp only [u64ByteCount]
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split <;> simp
+
+private theorem u64_byte_shift_reconstruct (x : UInt64) :
+    x.toUInt8.toUInt64 ||| ((x >>> 8) <<< 8) = x := by
+  apply UInt64.toBitVec_inj.1
+  ext i hi
+  simp only [UInt64.toBitVec_or, UInt64.toBitVec_shiftLeft,
+    UInt64.toBitVec_shiftRight]
+  simp
+  by_cases hlow : i < 8
+  · simp [hlow, BitVec.getLsbD, BitVec.getElem_eq_testBit_toNat,
+      BitVec.toNat_umod]
+    have hmod := Nat.testBit_mod_two_pow x.toNat 8 i
+    rw [show 2 ^ 8 = 256 by decide] at hmod
+    simpa [hlow] using hmod
+  · have hsum : 8 + (i - 8) = i := by omega
+    simp [hlow, hsum, BitVec.getLsbD,
+      BitVec.getElem_eq_testBit_toNat, BitVec.toNat_umod]
+    have hmod := Nat.testBit_mod_two_pow x.toNat 8 i
+    rw [show 2 ^ 8 = 256 by decide] at hmod
+    rw [hmod]
+    simp [hlow]
+
+private theorem u64OfLEList_u64LEList_of_lt (n : Nat) (x : UInt64)
+    (h : x.toNat < 2 ^ (8 * n)) :
+    u64OfLEList (u64LEList n x) = x := by
+  induction n generalizing x with
+  | zero =>
+    simp only [Nat.mul_zero, Nat.pow_zero] at h
+    simp only [u64LEList, u64OfLEList]
+    apply UInt64.toNat_inj.1
+    simp
+    omega
+  | succ n ih =>
+    simp only [u64LEList, u64OfLEList]
+    rw [ih]
+    · exact u64_byte_shift_reconstruct x
+    · change x.toNat >>> 8 < 2 ^ (8 * n)
+      rw [Nat.shiftRight_eq_div_pow, Nat.div_lt_iff_lt_mul (by decide)]
+      calc
+        x.toNat < 2 ^ (8 * (n + 1)) := h
+        _ = 2 ^ (8 * n) * 2 ^ 8 := by
+          rw [show 8 * (n + 1) = 8 * n + 8 by omega, Nat.pow_add]
+
+private theorem u64ByteCount_toNat_bound (x : UInt64) :
+    x.toNat < 2 ^ (8 * (u64ByteCount x).toNat) := by
+  simp only [u64ByteCount]
+  split
+  · simp_all
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  split
+  · simp_all [UInt64.lt_iff_toNat_lt]
+  · simpa using x.toNat_lt
+
+/-- Decoding the minimal little-endian encoding returns the original u64. -/
+theorem u64OfLEBytes_encoded (x : UInt64) :
+    u64OfLEBytes (u64LEBytes x (u64ByteCount x).toNat) = x := by
+  simpa [u64OfLEBytes, u64LEBytes] using
+    u64OfLEList_u64LEList_of_lt (u64ByteCount x).toNat x
+      (u64ByteCount_toNat_bound x)
+
+def putBytes (x : ByteArray) : PutM Unit :=
+  modify fun s => s.append x
+
+def getBytes (len : Nat) : GetM ByteArray := do
+  let st ← get
+  if st.idx + len ≤ st.bytes.size then
+    let chunk := st.bytes.extract st.idx (st.idx + len)
+    set { st with idx := st.idx + len }
+    return chunk
+  else
+    throw s!"EOF: need {len} bytes at index {st.idx}, size {st.bytes.size}"
+
+theorem putBytes_spec (bytes : ByteArray) : PutSpec (putBytes bytes) bytes := by
+  intro pre
+  rfl
+
+theorem getBytes_spec (bytes : ByteArray) :
+    GetSpec (getBytes bytes.size) bytes bytes := by
+  intro pre suffix
+  have hextract :
+      (pre ++ bytes ++ suffix).extract pre.size
+        (pre.size + bytes.size) = bytes := by
+    rw [ByteArray.extract_append]
+    simp [ByteArray.size_append]
+    exact ByteArray.extract_append_eq_right rfl rfl
+  simp [getBytes, hextract]
+  rfl
+
+/-- Write a u64 in its minimal little-endian bytes. -/
+def putU64TrimmedLE (x : UInt64) : PutM Unit :=
+  putBytes (u64LEBytes x (u64ByteCount x).toNat)
+
+/-- Read a u64 from `n` little-endian bytes, rejecting impossible widths
+before consuming any payload byte. -/
+def getU64TrimmedLE (n : Nat) : GetM UInt64 := do
+  if n > 8 then
+    throw s!"getU64TrimmedLE: byte length {n} exceeds 8"
+  return u64OfLEBytes (← getBytes n)
+
+theorem putU64TrimmedLE_spec (x : UInt64) :
+    PutSpec (putU64TrimmedLE x)
+      (u64LEBytes x (u64ByteCount x).toNat) := by
+  exact putBytes_spec _
+
+/-- Any payload of width at most eight is read exactly and interpreted as a
+little-endian u64. -/
+theorem getU64TrimmedLE_spec (bytes : ByteArray) (hle : bytes.size ≤ 8) :
+    GetSpec (getU64TrimmedLE bytes.size) bytes (u64OfLEBytes bytes) := by
+  intro pre suffix
+  unfold getU64TrimmedLE
+  simp only [show ¬bytes.size > 8 by omega, ↓reduceIte, StateT.run_bind]
+  rw [getBytes_spec bytes pre suffix]
+  rfl
+
+/-- The strict reader consumes the writer's minimal output and returns the
+original u64. -/
+theorem getU64TrimmedLE_encoded_spec (x : UInt64) :
+    GetSpec (getU64TrimmedLE (u64ByteCount x).toNat)
+      (u64LEBytes x (u64ByteCount x).toNat) x := by
+  have h := getU64TrimmedLE_spec
+    (u64LEBytes x (u64ByteCount x).toNat)
+    (by rw [u64LEBytes_size]; exact u64ByteCount_le_eight x)
+  rw [u64LEBytes_size, u64OfLEBytes_encoded] at h
+  exact h
+
+/-! ## Tag headers
+
+`TagN`: an N-bit flag plus a size. Header byte layout (high to low):
+`[flag:N][large:1][small: 7-N]`. If `large = 0`, the size is the small
+field; otherwise the small field holds `byteCount - 1` and the size
+follows in minimal little-endian bytes. -/
+
+namespace HeaderBits
+
+private theorem nat_lt_eight_cases {i : Nat} (h : i < 8) :
+    i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 ∨ i = 4 ∨ i = 5 ∨ i = 6 ∨ i = 7 := by
+  omega
+
+private theorem u8_getElem_false_of_lt_pow (x : UInt8) {k i : Nat}
+    (hi : i < 8) (hlt : x.toNat < 2 ^ k) (hki : k ≤ i) :
+    x.toBitVec[i] = false := by
+  rw [BitVec.getElem_eq_testBit_toNat]
+  apply Nat.testBit_lt_two_pow
+  exact Nat.lt_of_lt_of_le hlt
+    (Nat.pow_le_pow_of_le (by decide : 1 < 2) hki)
+
+private theorem tag0_small_and_low (b : UInt8) (h : b < 128) :
+    b &&& 0x7F = b := by
+  apply UInt8.toNat_inj.1
+  simp only [UInt8.toNat_and]
+  have hb : b.toNat < 2 ^ 7 := by
+    simpa [UInt8.lt_iff_toNat_lt] using h
+  simpa using Nat.and_two_pow_sub_one_of_lt_two_pow hb
+
+private theorem tag0_small_and_high (b : UInt8) (h : b < 128) :
+    b &&& 0x80 = 0 := by
+  have hb : b.toNat < 2 ^ 7 := by
+    simpa [UInt8.lt_iff_toNat_lt] using h
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, BitVec.getElem_and, UInt8.toBitVec_ofNat,
+    BitVec.getElem_zero]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  exact u8_getElem_false_of_lt_pow b (by omega) hb (by omega)
+
+theorem tag0_small (b : UInt8) (h : b < 128) :
+    b &&& 0x80 == 0 ∧ b &&& 0x7F = b := by
+  rw [show b &&& 0x80 = 0 from tag0_small_and_high b h]
+  simp [tag0_small_and_low b h]
+
+theorem tag2_flag (flag payload : UInt8) (hf : flag < 4)
+    (hp : payload < 64) :
+    ((flag <<< 6) ||| payload) >>> 6 = flag := by
+  have hfn : flag.toNat < 2 ^ 2 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hf
+  have hpn : payload.toNat < 2 ^ 6 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hp
+  have hf2 := u8_getElem_false_of_lt_pow flag (i := 2) (by omega) hfn (by omega)
+  have hf3 := u8_getElem_false_of_lt_pow flag (i := 3) (by omega) hfn (by omega)
+  have hf4 := u8_getElem_false_of_lt_pow flag (i := 4) (by omega) hfn (by omega)
+  have hf5 := u8_getElem_false_of_lt_pow flag (i := 5) (by omega) hfn (by omega)
+  have hf6 := u8_getElem_false_of_lt_pow flag (i := 6) (by omega) hfn (by omega)
+  have hf7 := u8_getElem_false_of_lt_pow flag (i := 7) (by omega) hfn (by omega)
+  have hp6 := u8_getElem_false_of_lt_pow payload (i := 6) (by omega) hpn (by omega)
+  have hp7 := u8_getElem_false_of_lt_pow payload (i := 7) (by omega) hpn (by omega)
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_shiftRight, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp [hf2, hf3, hf4, hf5, hf6, hf7, hp6, hp7]
+
+theorem tag2_small_header (flag size : UInt8) (hf : flag < 4)
+    (hs : size < 32) :
+    ((flag <<< 6) ||| size) &&& 0x20 = 0 := by
+  have hfn : flag.toNat < 2 ^ 2 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hf
+  have hsn : size.toNat < 2 ^ 5 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hs
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat, BitVec.getElem_zero]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  exact u8_getElem_false_of_lt_pow size (by omega) hsn (by omega)
+
+theorem tag2_small_size (flag size : UInt8) (hf : flag < 4)
+    (hs : size < 32) :
+    ((flag <<< 6) ||| size) &&& 0x1F = size := by
+  have hfn : flag.toNat < 2 ^ 2 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hf
+  have hsn : size.toNat < 2 ^ 5 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hs
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  all_goals exact u8_getElem_false_of_lt_pow size (by omega) hsn (by omega)
+
+private theorem tag0_large_low (low : UInt8) (h : low < 128) :
+    (0x80 ||| low) &&& 0x7F = low := by
+  have hlow : low.toNat < 2 ^ 7 := by
+    simpa [UInt8.lt_iff_toNat_lt] using h
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    BitVec.getElem_and, BitVec.getElem_or, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  exact u8_getElem_false_of_lt_pow low (by omega) hlow (by omega)
+
+private theorem tag0_large_bit (low : UInt8) :
+    (0x80 ||| low) &&& 0x80 = 0x80 := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    BitVec.getElem_and, BitVec.getElem_or, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+theorem tag0_large (n : UInt8) (hlo : 0 < n) (hhi : n ≤ 8) :
+    ((0x80 ||| (n - 1)) &&& 0x7F) + 1 = n ∧
+      ¬((0x80 ||| (n - 1)) &&& 0x80 == 0) := by
+  have hone : (1 : UInt8) ≤ n := by
+    rw [UInt8.le_iff_toNat_le]
+    have := UInt8.lt_iff_toNat_lt.1 hlo
+    simp only [UInt8.reduceToNat] at this ⊢
+    omega
+  have hn : n - 1 < 128 :=
+    UInt8.lt_of_le_of_lt (UInt8.sub_le hone)
+      (UInt8.lt_of_le_of_lt hhi (by decide))
+  rw [tag0_large_low (n - 1) hn, UInt8.sub_add_cancel,
+    tag0_large_bit]
+  simp
+
+private theorem tag2_large_low (flag low : UInt8) (h : low < 32) :
+    ((flag <<< 6) ||| 0x20 ||| low) &&& 0x1F = low := by
+  have hlow : low.toNat < 2 ^ 5 := by
+    simpa [UInt8.lt_iff_toNat_lt] using h
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  all_goals exact u8_getElem_false_of_lt_pow low (by omega) hlow (by omega)
+
+private theorem tag2_large_bit (flag low : UInt8) :
+    ((flag <<< 6) ||| 0x20 ||| low) &&& 0x20 = 0x20 := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+theorem tag2_large (flag n : UInt8) (hf : flag < 4)
+    (hlo : 0 < n) (hhi : n ≤ 8) :
+    ((((flag <<< 6) ||| 0x20 ||| (n - 1)) >>> 6) = flag) ∧
+    ((((flag <<< 6) ||| 0x20 ||| (n - 1)) &&& 0x1F) + 1 = n) ∧
+    ¬((((flag <<< 6) ||| 0x20 ||| (n - 1)) &&& 0x20) == 0) := by
+  have hone : (1 : UInt8) ≤ n := by
+    rw [UInt8.le_iff_toNat_le]
+    have := UInt8.lt_iff_toNat_lt.1 hlo
+    simp only [UInt8.reduceToNat] at this ⊢
+    omega
+  have hn32 : n - 1 < 32 :=
+    UInt8.lt_of_le_of_lt (UInt8.sub_le hone)
+      (UInt8.lt_of_le_of_lt hhi (by decide))
+  have hp64 : 0x20 ||| (n - 1) < (64 : UInt8) := by
+    rw [UInt8.lt_iff_toNat_lt, UInt8.toNat_or]
+    simp only [UInt8.reduceToNat]
+    apply Nat.or_lt_two_pow (n := 6) (by decide)
+    have hn : (n - 1).toNat < 32 := by
+      simpa [UInt8.lt_iff_toNat_lt] using hn32
+    omega
+  rw [UInt8.or_assoc, tag2_flag flag (0x20 ||| (n - 1)) hf hp64,
+    ← UInt8.or_assoc, tag2_large_low flag (n - 1) hn32,
+    UInt8.sub_add_cancel, tag2_large_bit]
+  simp
+
+theorem tag4_flag (flag payload : UInt8) (hf : flag < 16)
+    (hp : payload < 16) :
+    ((flag <<< 4) ||| payload) >>> 4 = flag := by
+  have hfn : flag.toNat < 2 ^ 4 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hf
+  have hpn : payload.toNat < 2 ^ 4 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hp
+  have hf4 := u8_getElem_false_of_lt_pow flag (i := 4) (by omega) hfn (by omega)
+  have hf5 := u8_getElem_false_of_lt_pow flag (i := 5) (by omega) hfn (by omega)
+  have hf6 := u8_getElem_false_of_lt_pow flag (i := 6) (by omega) hfn (by omega)
+  have hf7 := u8_getElem_false_of_lt_pow flag (i := 7) (by omega) hfn (by omega)
+  have hp4 := u8_getElem_false_of_lt_pow payload (i := 4) (by omega) hpn (by omega)
+  have hp5 := u8_getElem_false_of_lt_pow payload (i := 5) (by omega) hpn (by omega)
+  have hp6 := u8_getElem_false_of_lt_pow payload (i := 6) (by omega) hpn (by omega)
+  have hp7 := u8_getElem_false_of_lt_pow payload (i := 7) (by omega) hpn (by omega)
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_shiftRight, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp [hf4, hf5, hf6, hf7, hp4, hp5, hp6, hp7]
+
+theorem tag4_small_header (flag size : UInt8) (hs : size < 8) :
+    ((flag <<< 4) ||| size) &&& 0x08 = 0 := by
+  have hsn : size.toNat < 2 ^ 3 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hs
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat, BitVec.getElem_zero]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  exact u8_getElem_false_of_lt_pow size (by omega) hsn (by omega)
+
+theorem tag4_small_size (flag size : UInt8) (hs : size < 8) :
+    ((flag <<< 4) ||| size) &&& 0x07 = size := by
+  have hsn : size.toNat < 2 ^ 3 := by
+    simpa [UInt8.lt_iff_toNat_lt] using hs
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  all_goals exact u8_getElem_false_of_lt_pow size (by omega) hsn (by omega)
+
+private theorem tag4_large_low (flag low : UInt8) (h : low < 8) :
+    ((flag <<< 4) ||| 0x08 ||| low) &&& 0x07 = low := by
+  have hlow : low.toNat < 2 ^ 3 := by
+    simpa [UInt8.lt_iff_toNat_lt] using h
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+  all_goals exact u8_getElem_false_of_lt_pow low (by omega) hlow (by omega)
+
+private theorem tag4_large_bit (flag low : UInt8) :
+    ((flag <<< 4) ||| 0x08 ||| low) &&& 0x08 = 0x08 := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_and, UInt8.toBitVec_or,
+    UInt8.toBitVec_shiftLeft, BitVec.getElem_and, BitVec.getElem_or,
+    UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+theorem tag4_large (flag n : UInt8) (hf : flag < 16)
+    (hlo : 0 < n) (hhi : n ≤ 8) :
+    ((((flag <<< 4) ||| 0x08 ||| (n - 1)) >>> 4) = flag) ∧
+    ((((flag <<< 4) ||| 0x08 ||| (n - 1)) &&& 0x07) + 1 = n) ∧
+    ¬((((flag <<< 4) ||| 0x08 ||| (n - 1)) &&& 0x08) == 0) := by
+  have hone : (1 : UInt8) ≤ n := by
+    rw [UInt8.le_iff_toNat_le]
+    have := UInt8.lt_iff_toNat_lt.1 hlo
+    simp only [UInt8.reduceToNat] at this ⊢
+    omega
+  have hn8 : n - 1 < 8 :=
+    UInt8.lt_of_lt_of_le (UInt8.sub_lt (by decide) hone) hhi
+  have hp16 : 0x08 ||| (n - 1) < (16 : UInt8) := by
+    rw [UInt8.lt_iff_toNat_lt, UInt8.toNat_or]
+    simp only [UInt8.reduceToNat]
+    apply Nat.or_lt_two_pow (n := 4) (by decide)
+    have hn := UInt8.lt_iff_toNat_lt.1 hn8
+    simp only [UInt8.reduceToNat] at hn ⊢
+    omega
+  rw [UInt8.or_assoc, tag4_flag flag (0x08 ||| (n - 1)) hf hp16,
+    ← UInt8.or_assoc, tag4_large_low flag (n - 1) hn8,
+    UInt8.sub_add_cancel, tag4_large_bit]
+  simp
+
+theorem u64_to_u8_to_u64_of_lt (x : UInt64) (h : x < 256) :
+    x.toUInt8.toUInt64 = x := by
+  apply UInt64.toNat_inj.1
+  simp only [UInt8.toNat_toUInt64, UInt64.toNat_toUInt8]
+  apply Nat.mod_eq_of_lt
+  simpa [UInt64.lt_iff_toNat_lt] using h
+
+theorem u64_to_u8_lt (x : UInt64) (bound : UInt8)
+    (h : x < bound.toUInt64) : x.toUInt8 < bound := by
+  rw [UInt8.lt_iff_toNat_lt]
+  simp only [UInt64.toNat_toUInt8]
+  have hxBound : x.toNat < bound.toNat := by
+    simpa [UInt64.lt_iff_toNat_lt] using h
+  rw [Nat.mod_eq_of_lt (Nat.lt_trans hxBound bound.toNat_lt)]
+  exact hxBound
+
+theorem byteCount_pos_of_ne_zero (x : UInt64) (h : x ≠ 0) :
+    0 < u64ByteCount x := by
+  simp only [u64ByteCount]
+  split
+  · simp_all
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split
+  · simp
+  split <;> simp
+
+private theorem tag0_split (header : UInt8) :
+    (header &&& 0x80) ||| (header &&& 0x7F) = header := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_or, UInt8.toBitVec_and,
+    BitVec.getElem_or, BitVec.getElem_and, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+private theorem tag2_split (header : UInt8) :
+    ((header >>> 6) <<< 6) ||| (header &&& 0x20) |||
+      (header &&& 0x1F) = header := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_or, UInt8.toBitVec_and,
+    UInt8.toBitVec_shiftLeft, UInt8.toBitVec_shiftRight,
+    BitVec.getElem_or, BitVec.getElem_and, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+private theorem tag4_split (header : UInt8) :
+    ((header >>> 4) <<< 4) ||| (header &&& 0x08) |||
+      (header &&& 0x07) = header := by
+  apply UInt8.toBitVec_inj.1
+  ext i hi
+  simp only [UInt8.toBitVec_or, UInt8.toBitVec_and,
+    UInt8.toBitVec_shiftLeft, UInt8.toBitVec_shiftRight,
+    BitVec.getElem_or, BitVec.getElem_and, UInt8.toBitVec_ofNat]
+  rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+    simp
+
+private theorem tag0_high_cases (header : UInt8) :
+    header &&& 0x80 = 0 ∨ header &&& 0x80 = 0x80 := by
+  by_cases hb : header.toBitVec[7] = true
+  · right
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb]
+  · left
+    have hb' : header.toBitVec[7] = false := by
+      cases hbit : header.toBitVec[7] <;> simp_all
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb']
+
+private theorem tag2_high_cases (header : UInt8) :
+    header &&& 0x20 = 0 ∨ header &&& 0x20 = 0x20 := by
+  by_cases hb : header.toBitVec[5] = true
+  · right
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb]
+  · left
+    have hb' : header.toBitVec[5] = false := by
+      cases hbit : header.toBitVec[5] <;> simp_all
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb']
+
+private theorem tag4_high_cases (header : UInt8) :
+    header &&& 0x08 = 0 ∨ header &&& 0x08 = 0x08 := by
+  by_cases hb : header.toBitVec[3] = true
+  · right
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb]
+  · left
+    have hb' : header.toBitVec[3] = false := by
+      cases hbit : header.toBitVec[3] <;> simp_all
+    apply UInt8.toBitVec_inj.1
+    ext i hi
+    simp only [UInt8.toBitVec_and, BitVec.getElem_and,
+      UInt8.toBitVec_ofNat]
+    rcases nat_lt_eight_cases hi with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl <;>
+      simp [hb']
+
+private theorem tag0_mask_bound (header : UInt8) :
+    header.toUInt64 &&& 0x7F < 128 := by
+  rw [UInt64.lt_iff_toNat_lt, UInt64.toNat_and]
+  simp only [UInt8.toNat_toUInt64, UInt64.reduceToNat]
+  exact Nat.and_lt_two_pow (n := 7) header.toNat (by decide)
+
+private theorem tag2_mask_bound (header : UInt8) :
+    header.toUInt64 &&& 0x1F < 32 := by
+  rw [UInt64.lt_iff_toNat_lt, UInt64.toNat_and]
+  simp only [UInt8.toNat_toUInt64, UInt64.reduceToNat]
+  exact Nat.and_lt_two_pow (n := 5) header.toNat (by decide)
+
+private theorem tag4_mask_bound (header : UInt8) :
+    header.toUInt64 &&& 0x07 < 8 := by
+  rw [UInt64.lt_iff_toNat_lt, UInt64.toNat_and]
+  simp only [UInt8.toNat_toUInt64, UInt64.reduceToNat]
+  exact Nat.and_lt_two_pow (n := 3) header.toNat (by decide)
+
+theorem tag0_canonical (header : UInt8) :
+    (header &&& 0x80 == 0 →
+      (header.toUInt64 &&& 0x7F) < 128 ∧
+      (header.toUInt64 &&& 0x7F).toUInt8 = header) ∧
+    (¬(header &&& 0x80 == 0) → 0x80 ||| (header &&& 0x7F) = header) := by
+  constructor
+  · intro hsmall
+    have hm : header &&& 0x80 = 0 := by simpa using hsmall
+    have hlow : header &&& 0x7F = header := by
+      have hsplit := tag0_split header
+      rw [hm] at hsplit
+      simpa using hsplit
+    exact ⟨tag0_mask_bound header, by simpa using hlow⟩
+  · intro hlarge
+    have hne : header &&& 0x80 ≠ 0 := by simpa using hlarge
+    have hm : header &&& 0x80 = 0x80 :=
+      (tag0_high_cases header).resolve_left hne
+    have hsplit := tag0_split header
+    rw [hm] at hsplit
+    exact hsplit
+
+theorem tag2_canonical (header : UInt8) :
+    (header &&& 0x20 == 0 →
+      (header.toUInt64 &&& 0x1F) < 32 ∧
+      ((header >>> 6) <<< 6) ||| (header &&& 0x1F) = header) ∧
+    (¬(header &&& 0x20 == 0) →
+      ((header >>> 6) <<< 6) ||| 0x20 ||| (header &&& 0x1F) = header) := by
+  constructor
+  · intro hsmall
+    have hm : header &&& 0x20 = 0 := by simpa using hsmall
+    have hsplit := tag2_split header
+    rw [hm] at hsplit
+    exact ⟨tag2_mask_bound header, by simpa using hsplit⟩
+  · intro hlarge
+    have hne : header &&& 0x20 ≠ 0 := by simpa using hlarge
+    have hm : header &&& 0x20 = 0x20 :=
+      (tag2_high_cases header).resolve_left hne
+    have hsplit := tag2_split header
+    rw [hm] at hsplit
+    exact hsplit
+
+theorem tag4_canonical (header : UInt8) :
+    (header &&& 0x08 == 0 →
+      (header.toUInt64 &&& 0x07) < 8 ∧
+      ((header >>> 4) <<< 4) ||| (header &&& 0x07) = header) ∧
+    (¬(header &&& 0x08 == 0) →
+      ((header >>> 4) <<< 4) ||| 0x08 ||| (header &&& 0x07) = header) := by
+  constructor
+  · intro hsmall
+    have hm : header &&& 0x08 = 0 := by simpa using hsmall
+    have hsplit := tag4_split header
+    rw [hm] at hsplit
+    exact ⟨tag4_mask_bound header, by simpa using hsplit⟩
+  · intro hlarge
+    have hne : header &&& 0x08 ≠ 0 := by simpa using hlarge
+    have hm : header &&& 0x08 = 0x08 :=
+      (tag4_high_cases header).resolve_left hne
+    have hsplit := tag4_split header
+    rw [hm] at hsplit
+    exact hsplit
+
+end HeaderBits
+
+structure Tag0 where
+  size : UInt64
+  deriving BEq, Repr
+
+structure Tag2 where
+  flag : UInt8
+  size : UInt64
+  deriving BEq, Repr
+
+structure Tag4 where
+  flag : UInt8
+  size : UInt64
+  deriving BEq, Repr
+
+/-- Canonical bytes for a no-flag size header. -/
+def tag0Bytes (t : Tag0) : ByteArray :=
+  if t.size < 128 then
+    u8Bytes t.size.toUInt8
+  else
+    let n := u64ByteCount t.size
+    u8Bytes (0x80 ||| (n - 1)) ++ u64LEBytes t.size n.toNat
+
+def putTag0 (t : Tag0) : PutM Unit :=
+  putBytes (tag0Bytes t)
+
+theorem putTag0_spec (t : Tag0) : PutSpec (putTag0 t) (tag0Bytes t) := by
+  exact putBytes_spec _
+
+def getTag0 : GetM Tag0 := do
+  let b ← getU8
+  if b &&& 0x80 == 0 then
+    return ⟨(b &&& 0x7F).toUInt64⟩
+  else
+    let n := (b &&& 0x7F) + 1
+    let size ← getU64TrimmedLE n.toNat
+    if u64ByteCount size != n then throw "getTag0: non-minimal size"
+    if size < 128 then throw "getTag0: size must use small form"
+    return ⟨size⟩
+
+/-- The strict Tag0 reader consumes exactly the canonical bytes emitted for
+every size. -/
+theorem getTag0_encoded_spec (t : Tag0) : GetSpec getTag0 (tag0Bytes t) t := by
+  rcases t with ⟨size⟩
+  intro pre suffix
+  by_cases hs : size < 128
+  · simp only [tag0Bytes, hs, if_pos]
+    simp only [getTag0, StateT.run_bind]
+    rw [getU8_spec size.toUInt8 pre suffix]
+    simp only [bind, Except.bind]
+    have hs8 : size.toUInt8 < 128 :=
+      HeaderBits.u64_to_u8_lt size 128 (by simpa using hs)
+    obtain ⟨hheader, hlow⟩ := HeaderBits.tag0_small size.toUInt8 hs8
+    have hheader : size.toUInt8 &&& 0x80 == 0 := by
+      exact hheader
+    rw [if_pos hheader]
+    have hvalue : (size.toUInt8 &&& 0x7F).toUInt64 = size := by
+      rw [hlow]
+      exact HeaderBits.u64_to_u8_to_u64_of_lt size
+        (UInt64.lt_trans hs (by decide))
+    simp [hvalue, u8Bytes]
+    rfl
+  · simp only [tag0Bytes, hs, if_false]
+    let n := u64ByteCount size
+    let header : UInt8 := 0x80 ||| (n - 1)
+    change getTag0.run
+      ⟨pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix,
+        pre.size⟩ =
+      .ok (⟨size⟩,
+        ⟨pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix,
+          pre.size + (u8Bytes header ++ u64LEBytes size n.toNat).size⟩)
+    have hbytes : pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix =
+        pre ++ u8Bytes header ++ (u64LEBytes size n.toNat ++ suffix) := by
+      simp [ByteArray.append_assoc]
+    rw [hbytes]
+    have hhead := getU8_spec header pre
+      (u64LEBytes size n.toNat ++ suffix)
+    simp only [getTag0, StateT.run_bind]
+    rw [hhead]
+    simp only [bind, Except.bind]
+    have hne : size ≠ 0 := by
+      intro hzero
+      subst size
+      simp at hs
+    have hnle : n ≤ 8 := by
+      rw [UInt8.le_iff_toNat_le]
+      exact u64ByteCount_le_eight size
+    obtain ⟨hn, hlarge⟩ := HeaderBits.tag0_large n
+      (by simpa [n] using HeaderBits.byteCount_pos_of_ne_zero size hne) hnle
+    change (header &&& 0x7F) + 1 = n at hn
+    change ¬(header &&& 0x80 == 0) at hlarge
+    rw [if_neg hlarge]
+    rw [hn]
+    dsimp only [n]
+    let next : UInt64 → GetM Tag0 := fun decoded => do
+      if u64ByteCount decoded != u64ByteCount size then
+        throw "getTag0: non-minimal size"
+      if decoded < 128 then throw "getTag0: size must use small form"
+      return Tag0.mk decoded
+    change (getU64TrimmedLE (u64ByteCount size).toNat >>= next).run
+      ⟨pre ++ u8Bytes header ++
+          (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+        pre.size + (u8Bytes header).size⟩ = _
+    have hcont : GetSpec (next size) ByteArray.empty (Tag0.mk size) := by
+      intro innerPre innerSuffix
+      simp [next, hs]
+      rfl
+    have hpayload := GetSpec.bind
+      (next := next) (getU64TrimmedLE_encoded_spec size) hcont
+    simp only [ByteArray.append_empty] at hpayload
+    have hpayload' :
+        (getU64TrimmedLE (u64ByteCount size).toNat >>= next).run
+          ⟨pre ++ u8Bytes header ++
+              (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+            pre.size + (u8Bytes header).size⟩ =
+          .ok (Tag0.mk size,
+            ⟨pre ++ u8Bytes header ++
+                (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+              pre.size + (u8Bytes header).size +
+                (u64LEBytes size (u64ByteCount size).toNat).size⟩) := by
+      simpa only [ByteArray.append_assoc, ByteArray.size_append] using
+        hpayload (pre ++ u8Bytes header) suffix
+    rw [hpayload']
+    simp [u8Bytes, ByteArray.size_append]
+    omega
+
+/-- Canonical bytes for a two-flag-bit size header. Values outside the
+two-bit flag range are not valid in-memory tags. -/
+def tag2Bytes (t : Tag2) : ByteArray :=
+  if t.size < 32 then
+    u8Bytes ((t.flag <<< 6) ||| t.size.toUInt8)
+  else
+    let n := u64ByteCount t.size
+    u8Bytes ((t.flag <<< 6) ||| 0x20 ||| (n - 1)) ++
+      u64LEBytes t.size n.toNat
+
+def putTag2 (t : Tag2) : PutM Unit :=
+  putBytes (tag2Bytes t)
+
+theorem putTag2_spec (t : Tag2) : PutSpec (putTag2 t) (tag2Bytes t) := by
+  exact putBytes_spec _
+
+def getTag2 : GetM Tag2 := do
+  let b ← getU8
+  let flag := b >>> 6
+  if b &&& 0x20 == 0 then
+    return ⟨flag, (b &&& 0x1F).toUInt64⟩
+  else
+    let n := (b &&& 0x1F) + 1
+    let size ← getU64TrimmedLE n.toNat
+    if u64ByteCount size != n then throw "getTag2: non-minimal size"
+    if size < 32 then throw "getTag2: size must use small form"
+    return ⟨flag, size⟩
+
+/-- The strict Tag2 reader consumes the canonical encoding whenever the
+in-memory flag fits its declared two-bit field. -/
+theorem getTag2_encoded_spec (t : Tag2) (hflag : t.flag < 4) :
+    GetSpec getTag2 (tag2Bytes t) t := by
+  rcases t with ⟨flag, size⟩
+  intro pre suffix
+  by_cases hs : size < 32
+  · simp only [tag2Bytes, hs, if_pos]
+    let header : UInt8 := (flag <<< 6) ||| size.toUInt8
+    change getTag2.run ⟨pre ++ u8Bytes header ++ suffix, pre.size⟩ = _
+    simp only [getTag2, StateT.run_bind]
+    rw [getU8_spec header pre suffix]
+    simp only [bind, Except.bind]
+    have hs8 : size.toUInt8 < 32 :=
+      HeaderBits.u64_to_u8_lt size 32 (by simpa using hs)
+    have hdecodedFlag : header >>> 6 = flag := by
+      dsimp [header]
+      exact HeaderBits.tag2_flag flag size.toUInt8 hflag
+        (UInt8.lt_trans hs8 (by decide))
+    have hheader : header &&& 0x20 == 0 := by
+      dsimp [header]
+      rw [HeaderBits.tag2_small_header flag size.toUInt8 hflag hs8]
+      decide
+    have hvalue : (header &&& 0x1F).toUInt64 = size := by
+      dsimp [header]
+      rw [HeaderBits.tag2_small_size flag size.toUInt8 hflag hs8]
+      exact HeaderBits.u64_to_u8_to_u64_of_lt size
+        (UInt64.lt_trans hs (by decide))
+    rw [hdecodedFlag, if_pos hheader, hvalue]
+    simp [u8Bytes]
+    rfl
+  · simp only [tag2Bytes, hs, if_false]
+    let n := u64ByteCount size
+    let header : UInt8 := (flag <<< 6) ||| 0x20 ||| (n - 1)
+    change getTag2.run
+      ⟨pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix,
+        pre.size⟩ =
+      .ok (⟨flag, size⟩,
+        ⟨pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix,
+          pre.size + (u8Bytes header ++ u64LEBytes size n.toNat).size⟩)
+    have hbytes : pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix =
+        pre ++ u8Bytes header ++ (u64LEBytes size n.toNat ++ suffix) := by
+      simp [ByteArray.append_assoc]
+    rw [hbytes]
+    have hhead := getU8_spec header pre
+      (u64LEBytes size n.toNat ++ suffix)
+    simp only [getTag2, StateT.run_bind]
+    rw [hhead]
+    simp only [bind, Except.bind]
+    have hne : size ≠ 0 := by
+      intro hzero
+      subst size
+      simp at hs
+    have hnle : n ≤ 8 := by
+      rw [UInt8.le_iff_toNat_le]
+      exact u64ByteCount_le_eight size
+    obtain ⟨hdecodedFlag, hn, hlarge⟩ := HeaderBits.tag2_large flag n hflag
+      (by simpa [n] using HeaderBits.byteCount_pos_of_ne_zero size hne) hnle
+    change header >>> 6 = flag at hdecodedFlag
+    change (header &&& 0x1F) + 1 = n at hn
+    change ¬(header &&& 0x20 == 0) at hlarge
+    rw [hdecodedFlag]
+    rw [if_neg hlarge, hn]
+    dsimp only [n]
+    let next : UInt64 → GetM Tag2 := fun decoded => do
+      if u64ByteCount decoded != u64ByteCount size then
+        throw "getTag2: non-minimal size"
+      if decoded < 32 then throw "getTag2: size must use small form"
+      return ⟨flag, decoded⟩
+    change (getU64TrimmedLE (u64ByteCount size).toNat >>= next).run
+      ⟨pre ++ u8Bytes header ++
+          (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+        pre.size + (u8Bytes header).size⟩ = _
+    have hcont : GetSpec (next size) ByteArray.empty (Tag2.mk flag size) := by
+      intro innerPre innerSuffix
+      simp [next, hs]
+      rfl
+    have hpayload := GetSpec.bind
+      (next := next) (getU64TrimmedLE_encoded_spec size) hcont
+    simp only [ByteArray.append_empty] at hpayload
+    have hpayload' :
+        (getU64TrimmedLE (u64ByteCount size).toNat >>= next).run
+          ⟨pre ++ u8Bytes header ++
+              (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+            pre.size + (u8Bytes header).size⟩ =
+          .ok (Tag2.mk flag size,
+            ⟨pre ++ u8Bytes header ++
+                (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+              pre.size + (u8Bytes header).size +
+                (u64LEBytes size (u64ByteCount size).toNat).size⟩) := by
+      simpa only [ByteArray.append_assoc, ByteArray.size_append] using
+        hpayload (pre ++ u8Bytes header) suffix
+    rw [hpayload']
+    simp [u8Bytes, ByteArray.size_append]
+    omega
+
+/-- Canonical bytes for a four-flag-bit size header. Values outside the
+four-bit flag range are not valid in-memory tags. -/
+def tag4Bytes (t : Tag4) : ByteArray :=
+  if t.size < 8 then
+    u8Bytes ((t.flag <<< 4) ||| t.size.toUInt8)
+  else
+    let n := u64ByteCount t.size
+    u8Bytes ((t.flag <<< 4) ||| 0x08 ||| (n - 1)) ++
+      u64LEBytes t.size n.toNat
+
+def putTag4 (t : Tag4) : PutM Unit :=
+  putBytes (tag4Bytes t)
+
+theorem putTag4_spec (t : Tag4) : PutSpec (putTag4 t) (tag4Bytes t) := by
+  exact putBytes_spec _
+
+def getTag4 : GetM Tag4 := do
+  let b ← getU8
+  let flag := b >>> 4
+  if b &&& 0x08 == 0 then
+    return ⟨flag, (b &&& 0x07).toUInt64⟩
+  else
+    let n := (b &&& 0x07) + 1
+    let size ← getU64TrimmedLE n.toNat
+    if u64ByteCount size != n then throw "getTag4: non-minimal size"
+    if size < 8 then throw "getTag4: size must use small form"
+    return ⟨flag, size⟩
+
+/-- The strict Tag4 reader consumes the canonical encoding whenever the
+in-memory flag fits its declared four-bit field. -/
+theorem getTag4_encoded_spec (t : Tag4) (hflag : t.flag < 16) :
+    GetSpec getTag4 (tag4Bytes t) t := by
+  rcases t with ⟨flag, size⟩
+  intro pre suffix
+  by_cases hs : size < 8
+  · simp only [tag4Bytes, hs, if_pos]
+    let header : UInt8 := (flag <<< 4) ||| size.toUInt8
+    change getTag4.run ⟨pre ++ u8Bytes header ++ suffix, pre.size⟩ = _
+    simp only [getTag4, StateT.run_bind]
+    rw [getU8_spec header pre suffix]
+    simp only [bind, Except.bind]
+    have hs8 : size.toUInt8 < 8 :=
+      HeaderBits.u64_to_u8_lt size 8 (by simpa using hs)
+    have hdecodedFlag : header >>> 4 = flag := by
+      dsimp [header]
+      exact HeaderBits.tag4_flag flag size.toUInt8 hflag
+        (UInt8.lt_trans hs8 (by decide))
+    have hheader : header &&& 0x08 == 0 := by
+      dsimp [header]
+      rw [HeaderBits.tag4_small_header flag size.toUInt8 hs8]
+      decide
+    have hvalue : (header &&& 0x07).toUInt64 = size := by
+      dsimp [header]
+      rw [HeaderBits.tag4_small_size flag size.toUInt8 hs8]
+      exact HeaderBits.u64_to_u8_to_u64_of_lt size
+        (UInt64.lt_trans hs (by decide))
+    rw [hdecodedFlag, if_pos hheader, hvalue]
+    simp [u8Bytes]
+    rfl
+  · simp only [tag4Bytes, hs, if_false]
+    let n := u64ByteCount size
+    let header : UInt8 := (flag <<< 4) ||| 0x08 ||| (n - 1)
+    change getTag4.run
+      ⟨pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix,
+        pre.size⟩ =
+      .ok (⟨flag, size⟩,
+        ⟨pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix,
+          pre.size + (u8Bytes header ++ u64LEBytes size n.toNat).size⟩)
+    have hbytes : pre ++ (u8Bytes header ++ u64LEBytes size n.toNat) ++ suffix =
+        pre ++ u8Bytes header ++ (u64LEBytes size n.toNat ++ suffix) := by
+      simp [ByteArray.append_assoc]
+    rw [hbytes]
+    have hhead := getU8_spec header pre
+      (u64LEBytes size n.toNat ++ suffix)
+    simp only [getTag4, StateT.run_bind]
+    rw [hhead]
+    simp only [bind, Except.bind]
+    have hne : size ≠ 0 := by
+      intro hzero
+      subst size
+      simp at hs
+    have hnle : n ≤ 8 := by
+      rw [UInt8.le_iff_toNat_le]
+      exact u64ByteCount_le_eight size
+    obtain ⟨hdecodedFlag, hn, hlarge⟩ := HeaderBits.tag4_large flag n hflag
+      (by simpa [n] using HeaderBits.byteCount_pos_of_ne_zero size hne) hnle
+    change header >>> 4 = flag at hdecodedFlag
+    change (header &&& 0x07) + 1 = n at hn
+    change ¬(header &&& 0x08 == 0) at hlarge
+    rw [hdecodedFlag]
+    rw [if_neg hlarge, hn]
+    dsimp only [n]
+    let next : UInt64 → GetM Tag4 := fun decoded => do
+      if u64ByteCount decoded != u64ByteCount size then
+        throw "getTag4: non-minimal size"
+      if decoded < 8 then throw "getTag4: size must use small form"
+      return ⟨flag, decoded⟩
+    change (getU64TrimmedLE (u64ByteCount size).toNat >>= next).run
+      ⟨pre ++ u8Bytes header ++
+          (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+        pre.size + (u8Bytes header).size⟩ = _
+    have hcont : GetSpec (next size) ByteArray.empty (Tag4.mk flag size) := by
+      intro innerPre innerSuffix
+      simp [next, hs]
+      rfl
+    have hpayload := GetSpec.bind
+      (next := next) (getU64TrimmedLE_encoded_spec size) hcont
+    simp only [ByteArray.append_empty] at hpayload
+    have hpayload' :
+        (getU64TrimmedLE (u64ByteCount size).toNat >>= next).run
+          ⟨pre ++ u8Bytes header ++
+              (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+            pre.size + (u8Bytes header).size⟩ =
+          .ok (Tag4.mk flag size,
+            ⟨pre ++ u8Bytes header ++
+                (u64LEBytes size (u64ByteCount size).toNat ++ suffix),
+              pre.size + (u8Bytes header).size +
+                (u64LEBytes size (u64ByteCount size).toNat).size⟩) := by
+      simpa only [ByteArray.append_assoc, ByteArray.size_append] using
+        hpayload (pre ++ u8Bytes header) suffix
+    rw [hpayload']
+    simp [u8Bytes, ByteArray.size_append]
+    omega
+
+/-! ## Canonical reader inversions
+
+These converses complement `GetSpec`: they recover the exact canonical prefix
+from an arbitrary successful parse rather than starting from known bytes. -/
+
+theorem getU8_canonical : GetCanonical getU8 u8Bytes := by
+  intro pre rest value st' h
+  rcases rest with ⟨⟨data⟩⟩
+  cases data with
+  | nil =>
+    have hrest : (ByteArray.mk ⟨[]⟩) = ByteArray.empty := rfl
+    rw [hrest] at h
+    simp [getU8] at h
+    change (Except.error "EOF") = Except.ok (value, st') at h
+    contradiction
+  | cons b bs =>
+    let tail : ByteArray := ⟨⟨bs⟩⟩
+    have hrest : (ByteArray.mk ⟨b :: bs⟩) = u8Bytes b ++ tail := by
+      rfl
+    rw [hrest] at h
+    rw [← ByteArray.append_assoc] at h
+    rw [getU8_spec b pre tail] at h
+    cases h
+    exact ⟨tail, hrest, by simp [hrest, ByteArray.append_assoc]⟩
+
+theorem getBytes_canonical (n : Nat) :
+    GetCanonical (getBytes n) (fun bytes => bytes) := by
+  intro pre rest value st' h
+  by_cases hn : n ≤ rest.size
+  · simp [getBytes, ByteArray.size_append, hn] at h
+    cases h
+    let chunk := rest.extract 0 n
+    let suffix := rest.extract n rest.size
+    have hchunk :
+        (pre ++ rest).extract pre.size (pre.size + n) = chunk := by
+      simpa [chunk] using
+        (ByteArray.extract_append_size_add (a := pre) (b := rest)
+          (i := 0) (j := n))
+    have hsplit : rest = chunk ++ suffix := by
+      rw [show rest = rest.extract 0 rest.size by simp]
+      exact ByteArray.extract_eq_extract_append_extract n (by omega) hn
+    have hchunkSize : chunk.size = n := by
+      simp [chunk, ByteArray.size_extract, hn]
+    refine ⟨suffix, ?_, ?_⟩
+    · simpa [hchunk] using hsplit
+    · simp [hchunk, hchunkSize]
+  · simp [getBytes, ByteArray.size_append, hn] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getU64TrimmedLE_canonical (n : Nat) :
+    GetCanonical (getU64TrimmedLE n) (fun value => u64LEBytes value n) := by
+  intro pre rest value st' h
+  by_cases hn : n ≤ 8
+  · simp only [getU64TrimmedLE, show ¬n > 8 by omega, if_false,
+      StateT.run_bind] at h
+    cases hc : (getBytes n).run ⟨pre ++ rest, pre.size⟩ with
+    | error err =>
+      rw [hc] at h
+      contradiction
+    | ok result =>
+      rcases result with ⟨chunk, mid⟩
+      rw [hc] at h
+      simp at h
+      cases h
+      obtain ⟨suffix, hrest, hmid⟩ := getBytes_canonical n pre rest hc
+      have hsize : chunk.size = n := by
+        by_cases hnrest : n ≤ rest.size
+        · have hc' := hc
+          simp [getBytes, ByteArray.size_append, hnrest] at hc'
+          cases hc'
+          simp [ByteArray.size_extract, hnrest]
+        · have hc' := hc
+          simp [getBytes, ByteArray.size_append, hnrest] at hc'
+          change (Except.error _) = Except.ok (chunk, mid) at hc'
+          contradiction
+      have hcanonical : u64LEBytes (u64OfLEBytes chunk) n = chunk := by
+        rw [← hsize]
+        exact u64LEBytes_of_decode chunk (by omega)
+      refine ⟨suffix, ?_, ?_⟩
+      · simpa [hcanonical] using hrest
+      · simpa [hcanonical] using hmid
+  · simp only [getU64TrimmedLE, show n > 8 by omega, if_true] at h
+    change (Except.error _) = Except.ok (value, st') at h
+    contradiction
+
+theorem getTag0_canonical : GetCanonical getTag0 tag0Bytes := by
+  intro pre rest tag st' h
+  simp only [getTag0, StateT.run_bind] at h
+  cases hh : getU8.run ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hh] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨header, mid⟩
+    rw [hh] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨afterHead, hrest, hmid⟩ := getU8_canonical pre rest hh
+    let headPre := pre ++ u8Bytes header
+    have hmid' : mid = ⟨headPre ++ afterHead, headPre.size⟩ := by
+      rw [hmid]
+      simp [headPre, hrest, ByteArray.append_assoc]
+    rw [hmid'] at h
+    by_cases hsmall : header &&& 0x80 == 0
+    · simp [hsmall] at h
+      cases h
+      obtain ⟨hsize, hheader8⟩ :=
+        (HeaderBits.tag0_canonical header).1 hsmall
+      have hcanonical :
+          tag0Bytes ⟨header.toUInt64 &&& 0x7F⟩ = u8Bytes header := by
+        simp only [tag0Bytes, hsize, if_pos]
+        rw [hheader8]
+      refine ⟨afterHead, ?_, ?_⟩
+      · simpa [hcanonical] using hrest
+      · simp [headPre, hrest, hcanonical, ByteArray.append_assoc]
+    · simp only [hsmall, Bool.false_eq_true, if_false] at h
+      let next : UInt64 → GetM Tag0 := fun size => do
+        if u64ByteCount size != (header &&& 0x7F) + 1 then
+          throw "getTag0: non-minimal size"
+        if size < 128 then throw "getTag0: size must use small form"
+        return ⟨size⟩
+      change (getU64TrimmedLE ((header &&& 0x7F) + 1).toNat >>= next).run
+        ⟨headPre ++ afterHead, headPre.size⟩ = .ok (tag, st') at h
+      simp only [StateT.run_bind] at h
+      cases hp : (getU64TrimmedLE ((header &&& 0x7F) + 1).toNat).run
+          ⟨headPre ++ afterHead, headPre.size⟩ with
+      | error err =>
+        rw [hp] at h
+        simp only [bind, Except.bind] at h
+        contradiction
+      | ok payloadResult =>
+        rcases payloadResult with ⟨size, afterPayload⟩
+        rw [hp] at h
+        simp only [bind, Except.bind] at h
+        by_cases hcountEq :
+            u64ByteCount size = (header &&& 0x7F) + 1
+        · simp only [next, hcountEq] at h
+          by_cases hsize : size < 128
+          · simp [hsize] at h
+            change (Except.error _) = Except.ok (tag, st') at h
+            contradiction
+          · simp only [hsize, if_false] at h
+            simp at h
+            cases h
+            obtain ⟨suffix, hafterHead, hafterPayload⟩ :=
+              getU64TrimmedLE_canonical ((header &&& 0x7F) + 1).toNat
+                headPre afterHead hp
+            have hheader8 := (HeaderBits.tag0_canonical header).2 hsmall
+            refine ⟨suffix, ?_, ?_⟩
+            · rw [hrest, hafterHead]
+              simp [tag0Bytes, hsize, hcountEq, hheader8,
+                ByteArray.append_assoc]
+            · simpa [headPre, hrest, hafterHead, tag0Bytes, hsize,
+                hcountEq, hheader8, ByteArray.append_assoc,
+                Nat.add_assoc] using hafterPayload
+        · simp [next, hcountEq] at h
+          change (Except.error _) = Except.ok (tag, st') at h
+          contradiction
+
+theorem getTag2_canonical : GetCanonical getTag2 tag2Bytes := by
+  intro pre rest tag st' h
+  simp only [getTag2, StateT.run_bind] at h
+  cases hh : getU8.run ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hh] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨header, mid⟩
+    rw [hh] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨afterHead, hrest, hmid⟩ := getU8_canonical pre rest hh
+    let headPre := pre ++ u8Bytes header
+    have hmid' : mid = ⟨headPre ++ afterHead, headPre.size⟩ := by
+      rw [hmid]
+      simp [headPre, hrest, ByteArray.append_assoc]
+    rw [hmid'] at h
+    by_cases hsmall : header &&& 0x20 == 0
+    · simp [hsmall] at h
+      cases h
+      obtain ⟨hsize, hheader8⟩ :=
+        (HeaderBits.tag2_canonical header).1 hsmall
+      refine ⟨afterHead, ?_, ?_⟩
+      · rw [hrest]
+        simp [tag2Bytes, hsize, hheader8]
+      · simp [headPre, hrest, tag2Bytes, hsize, hheader8,
+          ByteArray.append_assoc]
+    · simp only [hsmall, Bool.false_eq_true, if_false,
+        ] at h
+      let next : UInt64 → GetM Tag2 := fun size => do
+        if u64ByteCount size != (header &&& 0x1F) + 1 then
+          throw "getTag2: non-minimal size"
+        if size < 32 then throw "getTag2: size must use small form"
+        return ⟨header >>> 6, size⟩
+      change (getU64TrimmedLE ((header &&& 0x1F) + 1).toNat >>= next).run
+        ⟨headPre ++ afterHead, headPre.size⟩ = .ok (tag, st') at h
+      simp only [StateT.run_bind] at h
+      cases hp : (getU64TrimmedLE ((header &&& 0x1F) + 1).toNat).run
+          ⟨headPre ++ afterHead, headPre.size⟩ with
+      | error err =>
+        rw [hp] at h
+        simp only [bind, Except.bind] at h
+        contradiction
+      | ok payloadResult =>
+        rcases payloadResult with ⟨size, afterPayload⟩
+        rw [hp] at h
+        simp only [bind, Except.bind] at h
+        by_cases hcountEq :
+            u64ByteCount size = (header &&& 0x1F) + 1
+        · simp only [next, hcountEq] at h
+          by_cases hsize : size < 32
+          · simp [hsize] at h
+            change (Except.error _) = Except.ok (tag, st') at h
+            contradiction
+          · simp only [hsize, if_false] at h
+            simp at h
+            cases h
+            obtain ⟨suffix, hafterHead, hafterPayload⟩ :=
+              getU64TrimmedLE_canonical ((header &&& 0x1F) + 1).toNat
+                headPre afterHead hp
+            have hheader8 := (HeaderBits.tag2_canonical header).2 hsmall
+            refine ⟨suffix, ?_, ?_⟩
+            · rw [hrest, hafterHead]
+              simp [tag2Bytes, hsize, hcountEq, hheader8,
+                ByteArray.append_assoc]
+            · simpa [headPre, hrest, hafterHead, tag2Bytes, hsize,
+                hcountEq, hheader8, ByteArray.append_assoc,
+                Nat.add_assoc] using
+                  hafterPayload
+        · simp [next, hcountEq] at h
+          change (Except.error _) = Except.ok (tag, st') at h
+          contradiction
+
+theorem getTag4_canonical : GetCanonical getTag4 tag4Bytes := by
+  intro pre rest tag st' h
+  simp only [getTag4, StateT.run_bind] at h
+  cases hh : getU8.run ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hh] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨header, mid⟩
+    rw [hh] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨afterHead, hrest, hmid⟩ := getU8_canonical pre rest hh
+    let headPre := pre ++ u8Bytes header
+    have hmid' : mid = ⟨headPre ++ afterHead, headPre.size⟩ := by
+      rw [hmid]
+      simp [headPre, hrest, ByteArray.append_assoc]
+    rw [hmid'] at h
+    by_cases hsmall : header &&& 0x08 == 0
+    · simp [hsmall] at h
+      cases h
+      obtain ⟨hsize, hheader8⟩ :=
+        (HeaderBits.tag4_canonical header).1 hsmall
+      refine ⟨afterHead, ?_, ?_⟩
+      · rw [hrest]
+        simp [tag4Bytes, hsize, hheader8]
+      · simp [headPre, hrest, tag4Bytes, hsize, hheader8,
+          ByteArray.append_assoc]
+    · simp only [hsmall, Bool.false_eq_true, if_false] at h
+      let next : UInt64 → GetM Tag4 := fun size => do
+        if u64ByteCount size != (header &&& 0x07) + 1 then
+          throw "getTag4: non-minimal size"
+        if size < 8 then throw "getTag4: size must use small form"
+        return ⟨header >>> 4, size⟩
+      change (getU64TrimmedLE ((header &&& 0x07) + 1).toNat >>= next).run
+        ⟨headPre ++ afterHead, headPre.size⟩ = .ok (tag, st') at h
+      simp only [StateT.run_bind] at h
+      cases hp : (getU64TrimmedLE ((header &&& 0x07) + 1).toNat).run
+          ⟨headPre ++ afterHead, headPre.size⟩ with
+      | error err =>
+        rw [hp] at h
+        simp only [bind, Except.bind] at h
+        contradiction
+      | ok payloadResult =>
+        rcases payloadResult with ⟨size, afterPayload⟩
+        rw [hp] at h
+        simp only [bind, Except.bind] at h
+        by_cases hcountEq :
+            u64ByteCount size = (header &&& 0x07) + 1
+        · simp only [next, hcountEq] at h
+          by_cases hsize : size < 8
+          · simp [hsize] at h
+            change (Except.error _) = Except.ok (tag, st') at h
+            contradiction
+          · simp only [hsize, if_false] at h
+            simp at h
+            cases h
+            obtain ⟨suffix, hafterHead, hafterPayload⟩ :=
+              getU64TrimmedLE_canonical ((header &&& 0x07) + 1).toNat
+                headPre afterHead hp
+            have hheader8 := (HeaderBits.tag4_canonical header).2 hsmall
+            refine ⟨suffix, ?_, ?_⟩
+            · rw [hrest, hafterHead]
+              simp [tag4Bytes, hsize, hcountEq, hheader8,
+                ByteArray.append_assoc]
+            · simpa [headPre, hrest, hafterHead, tag4Bytes, hsize,
+                hcountEq, hheader8, ByteArray.append_assoc,
+                Nat.add_assoc] using hafterPayload
+        · simp [next, hcountEq] at h
+          change (Except.error _) = Except.ok (tag, st') at h
+          contradiction
+
+/-! Top-level consequences used by structural codec proofs and regression
+tests. These are intentionally restricted to the representable flag ranges. -/
+
+theorem tag0_roundtrip (t : Tag0) :
+    runGet getTag0 (runPut (putTag0 t)) = .ok t := by
+  rw [runPut_eq_of_spec (putTag0_spec t)]
+  exact runGet_eq_ok_of_spec (getTag0_encoded_spec t)
+
+theorem tag2_roundtrip (t : Tag2) (hflag : t.flag < 4) :
+    runGet getTag2 (runPut (putTag2 t)) = .ok t := by
+  rw [runPut_eq_of_spec (putTag2_spec t)]
+  exact runGet_eq_ok_of_spec (getTag2_encoded_spec t hflag)
+
+theorem tag4_roundtrip (t : Tag4) (hflag : t.flag < 16) :
+    runGet getTag4 (runPut (putTag4 t)) = .ok t := by
+  rw [runPut_eq_of_spec (putTag4_spec t)]
+  exact runGet_eq_ok_of_spec (getTag4_encoded_spec t hflag)
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/Sharing.lean b/Ix/Compiler/Ixon/Sharing.lean
new file mode 100644
index 000000000..c0b852d5c
--- /dev/null
+++ b/Ix/Compiler/Ixon/Sharing.lean
@@ -0,0 +1,715 @@
+import Ix.Compiler.Ixon.Sharing.Basic
+import Ix.Compiler.Ixon.Sharing.Compress
+import Ix.Compiler.Ixon.Const
+import Ix.Compiler.Ixon.DecodeCheck
+import Ix.Compiler.Ixon.Work
+
+/-!
+# Canonical sharing
+
+S1/S2 provide the decoder-enforced layer-1 invariant and proved left-to-right
+inlining. `Sharing.Compress` adds the collision-safe deterministic compressor,
+exact serializer audit, and layer-2 canonicality by recompression:
+
+`compress (inline constant) == constant`.
+
+Keeping those layers separate is deliberate. Byte decoding cheaply rejects
+cycles, forward/out-of-bounds references, aliases, and dead/singleton entries;
+the semantic address boundary pays for exact compressor-image validation.
+-/
+
+namespace Ix.Compiler.Ixon.Sharing
+
+/-- Inline each embedded expression in the constant's authoritative body
+order. This is the semantic input expected by the future compressor. -/
+def inlineBodies (c : Constant) : Array Expr :=
+  c.info.exprs.toArray.map (inlineExpr c.sharing)
+
+/-- Inlining is body-for-body: it changes expressions, not their authoritative
+enumeration order. -/
+theorem inlineBodies_size (c : Constant) :
+    (inlineBodies c).size = c.info.exprs.length := by
+  simp [inlineBodies]
+
+/-- Decoder-accepted constants have no sharing nodes after their complete body
+enumeration is inlined. This is the constant-level S2 theorem consumed by the
+next evaluator-coherence proof. -/
+theorem inlineBodies_shareFree (c : Constant)
+    (h : c.sharingWF = true) :
+    (inlineBodies c).all shareFree = true := by
+  rw [Array.all_eq_true]
+  intro i hi
+  have hi' : i < c.info.exprs.toArray.size := by
+    simpa [inlineBodies] using hi
+  change shareFree ((c.info.exprs.toArray.map (inlineExpr c.sharing))[i]) = true
+  rw [Array.getElem_map (inlineExpr c.sharing) hi]
+  apply shareFree_inlineExpr_of_layer1 c.sharing c.info.exprs.toArray
+    c.info.exprs.toArray[i]
+  · simpa [Constant.sharingWF] using h
+  · exact Array.mem_def.mp (Array.getElem_mem hi')
+
+theorem canonical_components (bodies table : Array Expr)
+    (h : canonical bodies table = true) :
+    compress? (bodies.map (inlineExpr table)) =
+      some ⟨bodies, table⟩ := by
+  unfold canonical at h
+  split at h
+  · contradiction
+  · cases hc : compress? (bodies.map (inlineExpr table)) with
+    | none => simp [hc] at h
+    | some out =>
+      simp [hc] at h
+      rcases h with ⟨hbodies, htable⟩
+      subst bodies
+      subst table
+      rfl
+
+/-- The exact compressor recognizer admits at most one representation of an
+expanded body array. -/
+theorem canonical_eq_of_expanded_eq
+    {leftBodies leftTable rightBodies rightTable : Array Expr}
+    (hleft : canonical leftBodies leftTable = true)
+    (hright : canonical rightBodies rightTable = true)
+    (hexpanded : leftBodies.map (inlineExpr leftTable) =
+      rightBodies.map (inlineExpr rightTable)) :
+    leftBodies = rightBodies ∧ leftTable = rightTable := by
+  have hl := canonical_components leftBodies leftTable hleft
+  have hr := canonical_components rightBodies rightTable hright
+  rw [hexpanded] at hl
+  rw [hr] at hl
+  cases hl
+  exact ⟨rfl, rfl⟩
+
+theorem layer1_of_canonical (bodies table : Array Expr)
+    (h : canonical bodies table = true) :
+    layer1WF table bodies = true := by
+  exact layer1_compress _ _ (canonical_components bodies table h)
+
+end Ix.Compiler.Ixon.Sharing
+
+namespace Ix.Compiler.Ixon
+
+/-- Exact layer-2 sharing canonicality for the complete constant body order. -/
+def Constant.canonicalSharing (c : Constant) : Bool :=
+  Sharing.canonical c.info.exprs.toArray c.sharing
+
+/-- Content address of an exactly recompression-canonical, checked constant.
+Raw, merely layer-1, count-truncating, or locally malformed constants remain
+serializable for codec fixtures but cannot cross this identity boundary. -/
+def Constant.address? (c : Constant) : Option Address :=
+  if c.canonicalSharing && DecodeCheck.checkedWF c then
+    some (.blake3 (ser c))
+  else none
+
+/-- Resource policy for constructed constants entering the semantic address
+boundary.  Local validation and exact recompression have separate limits
+because both execute the layer-1 predicate. -/
+structure Constant.AddressLimits where
+  ingress : DecodeCheck.Limits := {}
+  sharing : Sharing.ResourceLimits := {}
+  deriving BEq, DecidableEq, Repr
+
+def Constant.defaultAddressLimits : Constant.AddressLimits := {}
+
+inductive Constant.AddressError where
+  | wireNotRepresentable
+  | invalid (error : DecodeCheck.Error)
+  | resource (exceeded : Work.Exceeded)
+  | nonCanonicalSharing
+  deriving BEq, DecidableEq, Repr
+
+/-- Corpus-facing constructed-value address boundary.  It checks wire/local
+validity first, computes sharing-expansion size without allocating it, and
+only then runs exact recompression and BLAKE3.  `address?` remains the
+transparent proof-facing predicate. -/
+def Constant.addressCheckedWith (limits : Constant.AddressLimits)
+    (c : Constant) : Except Constant.AddressError Address :=
+  if !DecodeCheck.wireConstantWF c then
+    .error .wireNotRepresentable
+  else
+    match DecodeCheck.checkConstantWith limits.ingress c with
+    | .error error => .error (.invalid error)
+    | .ok _ =>
+      match Sharing.canonicalWith limits.sharing c.info.exprs.toArray
+          c.sharing with
+      | .error exceeded => .error (.resource exceeded)
+      | .ok false => .error .nonCanonicalSharing
+      | .ok true => .ok (.blake3 (ser c))
+
+def Constant.addressChecked (c : Constant) :
+    Except Constant.AddressError Address :=
+  c.addressCheckedWith Constant.defaultAddressLimits
+
+/-- Address boundary for bytes produced by the pinned upstream ixon-v2
+writer.  It preserves the upstream address exactly while admitting only the
+deterministic upstream compressor image; Ix.Compiler's stronger local sharing
+policy and `addressCheckedWith` remain unchanged. -/
+def Constant.addressIxonV2CheckedWith (limits : Constant.AddressLimits)
+    (c : Constant) : Except Constant.AddressError Address :=
+  if !DecodeCheck.wireConstantWF c then
+    .error .wireNotRepresentable
+  else
+    match DecodeCheck.checkIxonV2ConstantWith limits.ingress c with
+    | .error error => .error (.invalid error)
+    | .ok _ =>
+      match Sharing.ixonV2CanonicalWith limits.sharing c.info.exprs.toArray
+          c.sharing with
+      | .error exceeded => .error (.resource exceeded)
+      | .ok false => .error .nonCanonicalSharing
+      | .ok true => .ok (.blake3 (ser c))
+
+def Constant.addressIxonV2Checked (c : Constant) :
+    Except Constant.AddressError Address :=
+  c.addressIxonV2CheckedWith Constant.defaultAddressLimits
+
+theorem Constant.addressCheckedWith_sound {limits : Constant.AddressLimits}
+    {c : Constant} {address : Address}
+    (h : c.addressCheckedWith limits = .ok address) :
+    c.wireWF ∧ DecodeCheck.checkConstant c = .ok () ∧
+      c.canonicalSharing = true ∧ address = .blake3 (ser c) := by
+  unfold Constant.addressCheckedWith at h
+  split at h
+  · contradiction
+  · rename_i hwire
+    have hwire' : DecodeCheck.wireConstantWF c = true := by
+      simpa using hwire
+    cases hcheck : DecodeCheck.checkConstantWith limits.ingress c with
+    | error error => simp [hcheck] at h
+    | ok result =>
+      cases result
+      cases hcanonical : Sharing.canonicalWith limits.sharing
+          c.info.exprs.toArray c.sharing with
+      | error exceeded => simp [hcheck, hcanonical] at h
+      | ok canonical =>
+        cases canonical with
+        | false => simp [hcheck, hcanonical] at h
+        | true =>
+          simp [hcheck, hcanonical] at h
+          exact ⟨(DecodeCheck.wireConstantWF_eq_true_iff c).mp hwire',
+            DecodeCheck.checkConstant_of_checkConstantWith hcheck,
+            Sharing.canonicalWith_true hcanonical, h.symm⟩
+
+theorem Constant.addressIxonV2CheckedWith_sound
+    {limits : Constant.AddressLimits} {c : Constant} {address : Address}
+    (h : c.addressIxonV2CheckedWith limits = .ok address) :
+    c.wireWF ∧ DecodeCheck.checkIxonV2Constant c = .ok () ∧
+      Sharing.ixonV2Canonical c.info.exprs.toArray c.sharing = true ∧
+      address = .blake3 (ser c) := by
+  unfold Constant.addressIxonV2CheckedWith at h
+  split at h
+  · contradiction
+  · rename_i hwire
+    have hwire' : DecodeCheck.wireConstantWF c = true := by
+      simpa using hwire
+    cases hcheck : DecodeCheck.checkIxonV2ConstantWith limits.ingress c with
+    | error error => simp [hcheck] at h
+    | ok result =>
+      cases result
+      cases hcanonical : Sharing.ixonV2CanonicalWith limits.sharing
+          c.info.exprs.toArray c.sharing with
+      | error exceeded => simp [hcheck, hcanonical] at h
+      | ok canonical =>
+        cases canonical with
+        | false => simp [hcheck, hcanonical] at h
+        | true =>
+          simp [hcheck, hcanonical] at h
+          exact ⟨(DecodeCheck.wireConstantWF_eq_true_iff c).mp hwire',
+            DecodeCheck.checkIxonV2Constant_of_checkIxonV2ConstantWith hcheck,
+            Sharing.ixonV2CanonicalWith_true hcanonical, h.symm⟩
+
+/-! ## Canonical semantic identity -/
+
+namespace ConstantIdentityLaws
+
+def mapDefinition (f : Expr → Expr) (d : Definition) : Definition :=
+  { d with typ := f d.typ, value := f d.value }
+
+def mapRule (f : Expr → Expr) (r : RecursorRule) : RecursorRule :=
+  { r with rhs := f r.rhs }
+
+def mapRecursor (f : Expr → Expr) (r : Recursor) : Recursor :=
+  { r with typ := f r.typ, rules := r.rules.map (mapRule f) }
+
+def mapAxiom (f : Expr → Expr) (a : Axiom) : Axiom :=
+  { a with typ := f a.typ }
+
+def mapQuotient (f : Expr → Expr) (q : Quotient) : Quotient :=
+  { q with typ := f q.typ }
+
+def mapConstructor (f : Expr → Expr) (c : Constructor) : Constructor :=
+  { c with typ := f c.typ }
+
+def mapInductive (f : Expr → Expr) (i : Inductive) : Inductive :=
+  { i with typ := f i.typ, ctors := i.ctors.map (mapConstructor f) }
+
+def mapMutConst (f : Expr → Expr) : MutConst → MutConst
+  | .defn d => .defn (mapDefinition f d)
+  | .indc i => .indc (mapInductive f i)
+  | .recr r => .recr (mapRecursor f r)
+
+def mapInfo (f : Expr → Expr) : ConstantInfo → ConstantInfo
+  | .defn d => .defn (mapDefinition f d)
+  | .recr r => .recr (mapRecursor f r)
+  | .axio a => .axio (mapAxiom f a)
+  | .quot q => .quot (mapQuotient f q)
+  | .cPrj p => .cPrj p
+  | .rPrj p => .rPrj p
+  | .iPrj p => .iPrj p
+  | .dPrj p => .dPrj p
+  | .muts ms => .muts (ms.map (mapMutConst f))
+
+def eraseInfo : ConstantInfo → ConstantInfo :=
+  mapInfo (fun _ => .sort 0)
+
+def restoreRules : List RecursorRule → List Expr →
+    Option (List RecursorRule × List Expr)
+  | [], xs => some ([], xs)
+  | _, [] => none
+  | rule :: rules, rhs :: xs => do
+    let (restored, suffix) ← restoreRules rules xs
+    return ({ rule with rhs := rhs } :: restored, suffix)
+
+def restoreCtors : List Constructor → List Expr →
+    Option (List Constructor × List Expr)
+  | [], xs => some ([], xs)
+  | _, [] => none
+  | ctor :: ctors, typ :: xs => do
+    let (restored, suffix) ← restoreCtors ctors xs
+    return ({ ctor with typ := typ } :: restored, suffix)
+
+def restoreDefinition (d : Definition) : List Expr →
+    Option (Definition × List Expr)
+  | typ :: value :: suffix => some ({ d with typ := typ, value := value }, suffix)
+  | _ => none
+
+def restoreRecursor (r : Recursor) : List Expr →
+    Option (Recursor × List Expr)
+  | [] => none
+  | typ :: xs => do
+    let (rules, suffix) ← restoreRules r.rules.toList xs
+    return ({ r with typ := typ, rules := rules.toArray }, suffix)
+
+def restoreAxiom (a : Axiom) : List Expr → Option (Axiom × List Expr)
+  | [] => none
+  | typ :: suffix => some ({ a with typ := typ }, suffix)
+
+def restoreQuotient (q : Quotient) : List Expr → Option (Quotient × List Expr)
+  | [] => none
+  | typ :: suffix => some ({ q with typ := typ }, suffix)
+
+def restoreConstructor (c : Constructor) : List Expr →
+    Option (Constructor × List Expr)
+  | [] => none
+  | typ :: suffix => some ({ c with typ := typ }, suffix)
+
+def restoreInductive (i : Inductive) : List Expr →
+    Option (Inductive × List Expr)
+  | [] => none
+  | typ :: xs => do
+    let (ctors, suffix) ← restoreCtors i.ctors.toList xs
+    return ({ i with typ := typ, ctors := ctors.toArray }, suffix)
+
+def restoreMutConst (m : MutConst) (xs : List Expr) :
+    Option (MutConst × List Expr) :=
+  match m with
+  | .defn d => do
+    let (d, suffix) ← restoreDefinition d xs
+    return (.defn d, suffix)
+  | .indc i => do
+    let (i, suffix) ← restoreInductive i xs
+    return (.indc i, suffix)
+  | .recr r => do
+    let (r, suffix) ← restoreRecursor r xs
+    return (.recr r, suffix)
+
+def restoreMuts : List MutConst → List Expr →
+    Option (List MutConst × List Expr)
+  | [], xs => some ([], xs)
+  | member :: members, xs => do
+    let (member, afterMember) ← restoreMutConst member xs
+    let (members, suffix) ← restoreMuts members afterMember
+    return (member :: members, suffix)
+
+def restoreInfo (shape : ConstantInfo) (xs : List Expr) :
+    Option (ConstantInfo × List Expr) :=
+  match shape with
+  | .defn d => do
+    let (d, suffix) ← restoreDefinition d xs
+    return (.defn d, suffix)
+  | .recr r => do
+    let (r, suffix) ← restoreRecursor r xs
+    return (.recr r, suffix)
+  | .axio a => do
+    let (a, suffix) ← restoreAxiom a xs
+    return (.axio a, suffix)
+  | .quot q => do
+    let (q, suffix) ← restoreQuotient q xs
+    return (.quot q, suffix)
+  | .cPrj p => some (.cPrj p, xs)
+  | .rPrj p => some (.rPrj p, xs)
+  | .iPrj p => some (.iPrj p, xs)
+  | .dPrj p => some (.dPrj p, xs)
+  | .muts ms => do
+    let (ms, suffix) ← restoreMuts ms.toList xs
+    return (.muts ms.toArray, suffix)
+
+def replaceInfoExprs? (shape : ConstantInfo) (xs : List Expr) :
+    Option ConstantInfo := do
+  let (info, suffix) ← restoreInfo shape xs
+  if suffix.isEmpty then some info else none
+
+theorem restoreRules_spec (rules : List RecursorRule) (suffix : List Expr) :
+    restoreRules rules (rules.map (·.rhs) ++ suffix) = some (rules, suffix) := by
+  induction rules with
+  | nil => rfl
+  | cons rule rules ih => simp [restoreRules, ih]
+
+theorem restoreCtors_spec (ctors : List Constructor) (suffix : List Expr) :
+    restoreCtors ctors (ctors.map (·.typ) ++ suffix) = some (ctors, suffix) := by
+  induction ctors with
+  | nil => rfl
+  | cons ctor ctors ih => simp [restoreCtors, ih]
+
+theorem restoreDefinition_spec (d : Definition) (suffix : List Expr) :
+    restoreDefinition d (d.exprs ++ suffix) = some (d, suffix) := by
+  simp [restoreDefinition, Definition.exprs]
+
+theorem restoreRecursor_spec (r : Recursor) (suffix : List Expr) :
+    restoreRecursor r (r.exprs ++ suffix) = some (r, suffix) := by
+  simp [restoreRecursor, Recursor.exprs, restoreRules_spec]
+
+theorem restoreAxiom_spec (a : Axiom) (suffix : List Expr) :
+    restoreAxiom a (a.exprs ++ suffix) = some (a, suffix) := by
+  simp [restoreAxiom, Axiom.exprs]
+
+theorem restoreQuotient_spec (q : Quotient) (suffix : List Expr) :
+    restoreQuotient q (q.exprs ++ suffix) = some (q, suffix) := by
+  simp [restoreQuotient, Quotient.exprs]
+
+theorem restoreConstructor_spec (c : Constructor) (suffix : List Expr) :
+    restoreConstructor c (c.exprs ++ suffix) = some (c, suffix) := by
+  simp [restoreConstructor, Constructor.exprs]
+
+theorem flatMap_constructorExprs (ctors : List Constructor) :
+    ctors.flatMap Constructor.exprs = ctors.map (·.typ) := by
+  induction ctors with
+  | nil => rfl
+  | cons ctor ctors ih => simp [Constructor.exprs, ih]
+
+theorem restoreInductive_spec (i : Inductive) (suffix : List Expr) :
+    restoreInductive i (i.exprs ++ suffix) = some (i, suffix) := by
+  rw [show i.exprs = i.typ :: i.ctors.toList.flatMap Constructor.exprs by
+    rfl]
+  rw [flatMap_constructorExprs]
+  simp [restoreInductive, restoreCtors_spec]
+
+theorem restoreMutConst_spec (m : MutConst) (suffix : List Expr) :
+    restoreMutConst m (m.exprs ++ suffix) = some (m, suffix) := by
+  cases m with
+  | defn d => simp [restoreMutConst, MutConst.exprs, restoreDefinition_spec]
+  | indc i => simp [restoreMutConst, MutConst.exprs, restoreInductive_spec]
+  | recr r => simp [restoreMutConst, MutConst.exprs, restoreRecursor_spec]
+
+theorem restoreMuts_spec (members : List MutConst) (suffix : List Expr) :
+    restoreMuts members (members.flatMap MutConst.exprs ++ suffix) =
+      some (members, suffix) := by
+  induction members with
+  | nil => rfl
+  | cons member members ih =>
+    simp [restoreMuts, restoreMutConst_spec, ih, List.append_assoc]
+
+theorem restoreInfo_spec (info : ConstantInfo) (suffix : List Expr) :
+    restoreInfo info (info.exprs ++ suffix) = some (info, suffix) := by
+  cases info with
+  | defn d => simp [restoreInfo, ConstantInfo.exprs, restoreDefinition_spec]
+  | recr r => simp [restoreInfo, ConstantInfo.exprs, restoreRecursor_spec]
+  | axio a => simp [restoreInfo, ConstantInfo.exprs, restoreAxiom_spec]
+  | quot q => simp [restoreInfo, ConstantInfo.exprs, restoreQuotient_spec]
+  | cPrj p => simp [restoreInfo, ConstantInfo.exprs]
+  | rPrj p => simp [restoreInfo, ConstantInfo.exprs]
+  | iPrj p => simp [restoreInfo, ConstantInfo.exprs]
+  | dPrj p => simp [restoreInfo, ConstantInfo.exprs]
+  | muts ms => simp [restoreInfo, ConstantInfo.exprs, restoreMuts_spec]
+
+theorem replaceInfoExprs?_self (info : ConstantInfo) :
+    replaceInfoExprs? info info.exprs = some info := by
+  have hrestore : restoreInfo info info.exprs = some (info, []) := by
+    simpa using restoreInfo_spec info []
+  simp [replaceInfoExprs?, hrestore]
+
+theorem restoreRules_mapRule (f : Expr → Expr) (rules : List RecursorRule)
+    (xs : List Expr) :
+    restoreRules (rules.map (mapRule f)) xs = restoreRules rules xs := by
+  induction rules generalizing xs with
+  | nil => rfl
+  | cons rule rules ih =>
+    cases xs <;> simp [restoreRules, mapRule, ih]
+
+theorem restoreCtors_mapConstructor (f : Expr → Expr) (ctors : List Constructor)
+    (xs : List Expr) :
+    restoreCtors (ctors.map (mapConstructor f)) xs = restoreCtors ctors xs := by
+  induction ctors generalizing xs with
+  | nil => rfl
+  | cons ctor ctors ih =>
+    cases xs <;> simp [restoreCtors, mapConstructor, ih]
+
+theorem restoreDefinition_map (f : Expr → Expr) (d : Definition)
+    (xs : List Expr) :
+    restoreDefinition (mapDefinition f d) xs = restoreDefinition d xs := by
+  cases xs with
+  | nil => rfl
+  | cons x xs => cases xs <;> rfl
+
+theorem restoreRecursor_map (f : Expr → Expr) (r : Recursor)
+    (xs : List Expr) :
+    restoreRecursor (mapRecursor f r) xs = restoreRecursor r xs := by
+  cases xs with
+  | nil => rfl
+  | cons x xs => simp [restoreRecursor, mapRecursor, restoreRules_mapRule]
+
+theorem restoreAxiom_map (f : Expr → Expr) (a : Axiom) (xs : List Expr) :
+    restoreAxiom (mapAxiom f a) xs = restoreAxiom a xs := by
+  cases xs <;> rfl
+
+theorem restoreQuotient_map (f : Expr → Expr) (q : Quotient) (xs : List Expr) :
+    restoreQuotient (mapQuotient f q) xs = restoreQuotient q xs := by
+  cases xs <;> rfl
+
+theorem restoreConstructor_map (f : Expr → Expr) (c : Constructor)
+    (xs : List Expr) :
+    restoreConstructor (mapConstructor f c) xs = restoreConstructor c xs := by
+  cases xs <;> rfl
+
+theorem restoreInductive_map (f : Expr → Expr) (i : Inductive)
+    (xs : List Expr) :
+    restoreInductive (mapInductive f i) xs = restoreInductive i xs := by
+  cases xs with
+  | nil => rfl
+  | cons x xs =>
+    simp [restoreInductive, mapInductive, restoreCtors_mapConstructor]
+
+theorem restoreMutConst_map (f : Expr → Expr) (member : MutConst)
+    (xs : List Expr) :
+    restoreMutConst (mapMutConst f member) xs = restoreMutConst member xs := by
+  cases member with
+  | defn d => simp [restoreMutConst, mapMutConst, restoreDefinition_map]
+  | indc i => simp [restoreMutConst, mapMutConst, restoreInductive_map]
+  | recr r => simp [restoreMutConst, mapMutConst, restoreRecursor_map]
+
+theorem restoreMuts_map (f : Expr → Expr) (members : List MutConst)
+    (xs : List Expr) :
+    restoreMuts (members.map (mapMutConst f)) xs = restoreMuts members xs := by
+  induction members generalizing xs with
+  | nil => rfl
+  | cons member members ih =>
+    simp only [List.map_cons, restoreMuts]
+    rw [restoreMutConst_map]
+    cases hm : restoreMutConst member xs with
+    | none => rfl
+    | some result =>
+      rcases result with ⟨restored, suffix⟩
+      simp [ih]
+
+theorem restoreInfo_map (f : Expr → Expr) (info : ConstantInfo)
+    (xs : List Expr) :
+    restoreInfo (mapInfo f info) xs = restoreInfo info xs := by
+  cases info with
+  | defn d => simp [restoreInfo, mapInfo, restoreDefinition_map]
+  | recr r => simp [restoreInfo, mapInfo, restoreRecursor_map]
+  | axio a => simp [restoreInfo, mapInfo, restoreAxiom_map]
+  | quot q => simp [restoreInfo, mapInfo, restoreQuotient_map]
+  | cPrj p => rfl
+  | rPrj p => rfl
+  | iPrj p => rfl
+  | dPrj p => rfl
+  | muts ms => simp [restoreInfo, mapInfo, restoreMuts_map]
+
+theorem info_eq_of_erased_eq_of_exprs_eq (a b : ConstantInfo)
+    (hs : eraseInfo a = eraseInfo b) (he : a.exprs = b.exprs) : a = b := by
+  have ha := replaceInfoExprs?_self a
+  have hb := replaceInfoExprs?_self b
+  unfold replaceInfoExprs? at ha hb
+  rw [← restoreInfo_map (fun _ => .sort 0) a a.exprs] at ha
+  rw [← restoreInfo_map (fun _ => .sort 0) b b.exprs] at hb
+  change restoreInfo (eraseInfo a) a.exprs >>= _ = some a at ha
+  change restoreInfo (eraseInfo b) b.exprs >>= _ = some b at hb
+  rw [hs, he] at ha
+  rw [hb] at ha
+  cases ha
+  rfl
+
+end ConstantIdentityLaws
+
+/-- Apply a transformation to every authoritative expression root. These
+maps preserve all declaration metadata and nested array structure. -/
+def Definition.mapExprs (f : Expr → Expr) (d : Definition) : Definition :=
+  ConstantIdentityLaws.mapDefinition f d
+
+def RecursorRule.mapExprs (f : Expr → Expr)
+    (r : RecursorRule) : RecursorRule :=
+  ConstantIdentityLaws.mapRule f r
+
+def Recursor.mapExprs (f : Expr → Expr) (r : Recursor) : Recursor :=
+  ConstantIdentityLaws.mapRecursor f r
+
+def Axiom.mapExprs (f : Expr → Expr) (a : Axiom) : Axiom :=
+  ConstantIdentityLaws.mapAxiom f a
+
+def Quotient.mapExprs (f : Expr → Expr) (q : Quotient) : Quotient :=
+  ConstantIdentityLaws.mapQuotient f q
+
+def Constructor.mapExprs (f : Expr → Expr) (c : Constructor) : Constructor :=
+  ConstantIdentityLaws.mapConstructor f c
+
+def Inductive.mapExprs (f : Expr → Expr) (i : Inductive) : Inductive :=
+  ConstantIdentityLaws.mapInductive f i
+
+def MutConst.mapExprs (f : Expr → Expr) (m : MutConst) : MutConst :=
+  ConstantIdentityLaws.mapMutConst f m
+
+def ConstantInfo.mapExprs (f : Expr → Expr)
+    (info : ConstantInfo) : ConstantInfo :=
+  ConstantIdentityLaws.mapInfo f info
+
+namespace ConstantInfo
+
+/-- All non-expression fields and expression-slot structure, represented by
+replacing every embedded expression root with a fixed placeholder. -/
+def identityShape (info : ConstantInfo) : ConstantInfo :=
+  ConstantIdentityLaws.eraseInfo info
+
+theorem eq_of_identityShape_eq_of_exprs_eq (left right : ConstantInfo)
+    (hshape : left.identityShape = right.identityShape)
+    (hexprs : left.exprs = right.exprs) : left = right := by
+  exact ConstantIdentityLaws.info_eq_of_erased_eq_of_exprs_eq left right
+    hshape hexprs
+
+end ConstantInfo
+
+namespace Constant
+
+/-- Fully inline every authoritative expression root and clear the sharing
+table while preserving the constant's metadata, refs, and universes. -/
+def inlineSharing (c : Constant) : Constant :=
+  { info := c.info.mapExprs (Sharing.inlineExpr c.sharing)
+    sharing := #[]
+    refs := c.refs
+    univs := c.univs }
+
+/-- Sharing-independent semantic view of a constant. The body array contains
+all embedded expression roots in authoritative order after full inlining. -/
+structure InlinedView where
+  infoShape : ConstantInfo
+  bodies : Array Expr
+  refs : Array Address
+  univs : Array Univ
+  deriving BEq, Repr
+
+def inlinedView (c : Constant) : InlinedView :=
+  { infoShape := c.info.identityShape
+    bodies := Sharing.inlineBodies c
+    refs := c.refs
+    univs := c.univs }
+
+/-- The exact executable address-gate domain: layer-2 canonical sharing plus
+the checked writer's wire and local-semantic domain. -/
+def Addressable (c : Constant) : Prop :=
+  c.canonicalSharing = true ∧ DecodeCheck.checkedWF c = true
+
+theorem sharingWF_of_canonicalSharing (c : Constant)
+    (h : c.canonicalSharing = true) : c.sharingWF = true := by
+  change Sharing.layer1WF c.sharing c.info.exprs.toArray = true
+  exact Sharing.layer1_of_canonical c.info.exprs.toArray c.sharing h
+
+theorem eq_of_ser_eq (left right : Constant)
+    (hleftWire : left.wireWF) (hrightWire : right.wireWF)
+    (hleftSharing : left.sharingWF = true)
+    (hrightSharing : right.sharingWF = true)
+    (hbytes : ser left = ser right) : left = right := by
+  have hleft := roundtripLaw left hleftWire hleftSharing
+  have hright := roundtripLaw right hrightWire hrightSharing
+  rw [hbytes, hright] at hleft
+  exact (Except.ok.inj hleft).symm
+
+/-- Exact layer-2 canonicality makes the sharing-independent view injective:
+one semantic constant has one compressed representation. -/
+theorem eq_of_inlinedView_eq_of_canonicalSharing (left right : Constant)
+    (hleft : left.canonicalSharing = true)
+    (hright : right.canonicalSharing = true)
+    (hview : left.inlinedView = right.inlinedView) : left = right := by
+  have hshape := congrArg InlinedView.infoShape hview
+  have hbodies := congrArg InlinedView.bodies hview
+  have hrefs := congrArg InlinedView.refs hview
+  have hunivs := congrArg InlinedView.univs hview
+  change left.info.identityShape = right.info.identityShape at hshape
+  change Sharing.inlineBodies left = Sharing.inlineBodies right at hbodies
+  change left.refs = right.refs at hrefs
+  change left.univs = right.univs at hunivs
+  have hcomponents := Sharing.canonical_eq_of_expanded_eq hleft hright hbodies
+  have hexprs : left.info.exprs = right.info.exprs := by
+    have hlists := congrArg Array.toList hcomponents.1
+    simpa using hlists
+  have hinfo := ConstantInfo.eq_of_identityShape_eq_of_exprs_eq
+    left.info right.info hshape hexprs
+  cases left
+  cases right
+  simp_all
+
+/-- Equal accepted addresses identify equal constants under only the explicit
+pairwise no-collision premise for their two serialized preimages. -/
+theorem eq_of_address?_eq (left right : Constant)
+    (hleft : left.Addressable) (hright : right.Addressable)
+    (hcollision : Address.Blake3NoCollision (ser left) (ser right))
+    (haddress : left.address? = right.address?) : left = right := by
+  have hhash : Address.blake3 (ser left) = Address.blake3 (ser right) := by
+    simpa [address?, hleft.1, hleft.2, hright.1, hright.2] using haddress
+  have hbytes := hcollision hhash
+  exact eq_of_ser_eq left right
+    (DecodeCheck.wireWF_of_checkedWF hleft.2)
+    (DecodeCheck.wireWF_of_checkedWF hright.2)
+    (sharingWF_of_canonicalSharing left hleft.1)
+    (sharingWF_of_canonicalSharing right hright.1) hbytes
+
+/-- On locally checked, wire-representable, layer-2-canonical constants,
+equality of fully inlined semantics is equivalent to equality of addresses,
+modulo the exact pairwise BLAKE3 no-collision premise. -/
+theorem inlinedView_eq_iff_address?_eq (left right : Constant)
+    (hleft : left.Addressable) (hright : right.Addressable)
+    (hcollision : Address.Blake3NoCollision (ser left) (ser right)) :
+    left.inlinedView = right.inlinedView ↔ left.address? = right.address? := by
+  constructor
+  · intro hview
+    have heq := eq_of_inlinedView_eq_of_canonicalSharing left right
+      hleft.1 hright.1 hview
+    subst right
+    rfl
+  · intro haddress
+    exact congrArg inlinedView
+      (eq_of_address?_eq left right hleft hright hcollision haddress)
+
+/-! Pure regression for the semantic view. It deliberately avoids evaluating
+the BLAKE3-dependent canonical compressor in the elaborator. -/
+
+private def inlinedViewSharedFixture : Constant :=
+  { info := .axio
+      { isUnsafe := false, lvls := 0
+        typ := .app (.share 0) (.share 0) }
+    sharing := #[.sort 0]
+    refs := #[]
+    univs := #[] }
+
+private def inlinedViewExpandedFixture : Constant :=
+  { info := .axio
+      { isUnsafe := false, lvls := 0
+        typ := .app (.sort 0) (.sort 0) }
+    sharing := #[]
+    refs := #[]
+    univs := #[] }
+
+#guard inlinedViewSharedFixture != inlinedViewExpandedFixture
+#guard inlinedViewSharedFixture.inlinedView ==
+  inlinedViewExpandedFixture.inlinedView
+
+end Constant
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/Sharing/Basic.lean b/Ix/Compiler/Ixon/Sharing/Basic.lean
new file mode 100644
index 000000000..ed58461cf
--- /dev/null
+++ b/Ix/Compiler/Ixon/Sharing/Basic.lean
@@ -0,0 +1,454 @@
+import Ix.Compiler.Ixon.Expr
+
+/-!
+# Sharing-table invariants and inlining
+
+The cheap structural layer of canonical Ixon sharing. Ix.Compiler's local
+policy accepts a decoded table only when:
+
+1. every body reference is in bounds;
+2. entry `i` references only entries `< i`;
+3. no entry is a bare `.share` alias;
+4. every entry is referenced at least twice by later entries and bodies.
+
+The first three rules make left-to-right inlining total and rule out cycles.
+The fourth rejects dead/single-use entries, which a canonical compressor never
+emits and which otherwise mint distinct addresses for the same inlined term.
+Exact compressor-image canonicality is the next layer; it is deliberately not
+claimed here.  The pinned upstream ixon-v2 compressor can leave a nested entry
+with one direct use after sharing its parent.  `structuralWF` names the common
+first three rules so external ix artifacts can be checked against that exact
+compressor without weakening the stricter local `layer1WF` policy.
+-/
+
+namespace Ix.Compiler.Ixon.Sharing
+
+/-- Every `.share i` inside `e` satisfies `i < bound`. -/
+def sharesBelow (bound : Nat) : Expr → Bool
+  | .share i => i.toNat < bound
+  | .app f a => sharesBelow bound f && sharesBelow bound a
+  | .lam _ t b => sharesBelow bound t && sharesBelow bound b
+  | .all _ _ d c => sharesBelow bound d && sharesBelow bound c
+  | .letE _ t v b =>
+    sharesBelow bound t && sharesBelow bound v && sharesBelow bound b
+  | .prj _ _ v => sharesBelow bound v
+  | _ => true
+
+/-- Entry `i` may reference only earlier entries and may not be a bare alias. -/
+def entryWF (i : Nat) : Expr → Bool
+  | .share _ => false
+  | e => sharesBelow i e
+
+/-- Check entries left-to-right, using their final table index as the bound. -/
+def entriesWF (next : Nat) : List Expr → Bool
+  | [] => true
+  | e :: es => entryWF next e && entriesWF (next + 1) es
+
+/-- Backward-only, in-bounds, non-alias table structure (rules 2–3). -/
+def tableWF (table : Array Expr) : Bool :=
+  entriesWF 0 table.toList
+
+/-- Occurrences of `.share i` in an expression. -/
+def countShare (i : Nat) : Expr → Nat
+  | .share j => if j.toNat == i then 1 else 0
+  | .app f a => countShare i f + countShare i a
+  | .lam _ t b => countShare i t + countShare i b
+  | .all _ _ d c => countShare i d + countShare i c
+  | .letE _ t v b => countShare i t + countShare i v + countShare i b
+  | .prj _ _ v => countShare i v
+  | _ => 0
+
+/-- Rule 4: every entry is referenced at least twice by later entries and
+constant bodies. Earlier entries cannot refer forward once `tableWF` holds. -/
+def entriesUsedTwice (table bodies : Array Expr) : Bool :=
+  (List.range table.size).all fun i =>
+    let inEntries := (table.toList.drop (i + 1)).foldl
+      (fun total e => total + countShare i e) 0
+    let inBodies := bodies.foldl (fun total e => total + countShare i e) 0
+    inEntries + inBodies ≥ 2
+
+/-- The safety-critical sharing invariant common to Ix.Compiler and the
+pinned upstream ixon-v2 compressor: entries are backward-only and non-alias,
+and every body reference is in bounds.  Unlike `layer1WF`, this intentionally
+does not impose a direct-use-count policy. -/
+def structuralWF (table bodies : Array Expr) : Bool :=
+  tableWF table && bodies.all (sharesBelow table.size)
+
+/-- All four cheap sharing-table rules. -/
+def layer1WF (table bodies : Array Expr) : Bool :=
+  tableWF table
+    && bodies.all (sharesBelow table.size)
+    && entriesUsedTwice table bodies
+
+/-- Propositional view of the executable layer-1 check. -/
+structure Layer1 (table bodies : Array Expr) : Prop where
+  tableOk : tableWF table = true
+  bodiesOk : bodies.all (sharesBelow table.size) = true
+  usedTwice : entriesUsedTwice table bodies = true
+
+theorem layer1WF_iff (table bodies : Array Expr) :
+    layer1WF table bodies = true ↔ Layer1 table bodies := by
+  simp only [layer1WF, Bool.and_eq_true]
+  constructor
+  · rintro ⟨⟨htable, hbodies⟩, hused⟩
+    exact ⟨htable, hbodies, hused⟩
+  · rintro ⟨htable, hbodies, hused⟩
+    exact ⟨⟨htable, hbodies⟩, hused⟩
+
+/-! ## Share elimination -/
+
+/-- List core for share substitution. Keeping the proof-facing core structural
+avoids depending on implementation details of `Array.foldl`. -/
+def substSharesList (table : List Expr) : Expr → Expr
+  | .share i => table[i.toNat]?.getD (.share i)
+  | .app f a => .app (substSharesList table f) (substSharesList table a)
+  | .lam u t b => .lam u (substSharesList table t) (substSharesList table b)
+  | .all u o d c => .all u o (substSharesList table d) (substSharesList table c)
+  | .letE nd t v b =>
+    .letE nd (substSharesList table t) (substSharesList table v)
+      (substSharesList table b)
+  | .prj r f v => .prj r f (substSharesList table v)
+  | e => e
+
+/-- Substitute shares through a table whose entries are already inlined.
+Out-of-range indices remain visible; `layer1WF` excludes that case. -/
+def substShares (table : Array Expr) (e : Expr) : Expr :=
+  substSharesList table.toList e
+
+/-- Inline a suffix after an already-inlined prefix. Appending preserves the
+original sharing indices. -/
+def inlineEntries (inlined : List Expr) : List Expr → List Expr
+  | [] => inlined
+  | e :: es =>
+    inlineEntries (inlined ++ [substSharesList inlined e]) es
+
+/-- Inline entries left-to-right. Backward references therefore resolve in
+one pass when `tableWF` holds. -/
+def inlineTable (table : Array Expr) : Array Expr :=
+  (inlineEntries [] table.toList).toArray
+
+/-- Inline all sharing-table references in one expression. -/
+def inlineExpr (table : Array Expr) (e : Expr) : Expr :=
+  substShares (inlineTable table) e
+
+/-- No `.share` node occurs in `e`. -/
+def shareFree : Expr → Bool
+  | .share _ => false
+  | .app f a => shareFree f && shareFree a
+  | .lam _ t b => shareFree t && shareFree b
+  | .all _ _ d c => shareFree d && shareFree c
+  | .letE _ t v b => shareFree t && shareFree v && shareFree b
+  | .prj _ _ v => shareFree v
+  | _ => true
+
+/-! ## Share-elimination proofs -/
+
+/-- A structurally well-formed entry has no references at or above its own
+index. The non-alias condition is stronger than this conclusion. -/
+theorem sharesBelow_of_entryWF {i : Nat} {e : Expr}
+    (h : entryWF i e = true) : sharesBelow i e = true := by
+  cases e <;> simp_all [entryWF, sharesBelow]
+
+theorem substSharesList_append_of_sharesBelow
+    (pre suffix : List Expr) (e : Expr)
+    (hbelow : sharesBelow pre.length e = true) :
+    substSharesList (pre ++ suffix) e = substSharesList pre e := by
+  induction e with
+  | sort | var | ref | recur | str | nat => simp [substSharesList]
+  | share i =>
+    simp only [sharesBelow, decide_eq_true_eq] at hbelow
+    simp [substSharesList, List.getElem?_append_left hbelow]
+  | prj r f val ih =>
+    simp only [sharesBelow] at hbelow
+    simp [substSharesList, ih hbelow]
+  | app fn arg ihFn ihArg =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp [substSharesList, ihFn hbelow.1, ihArg hbelow.2]
+  | lam u typ body ihTyp ihBody =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp [substSharesList, ihTyp hbelow.1, ihBody hbelow.2]
+  | all u o typ body ihTyp ihBody =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp [substSharesList, ihTyp hbelow.1, ihBody hbelow.2]
+  | letE nd typ val body ihTyp ihVal ihBody =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp [substSharesList, ihTyp hbelow.1.1, ihVal hbelow.1.2,
+      ihBody hbelow.2]
+
+theorem inlineEntries_eq_append_map_subst
+    (pre entries : List Expr)
+    (hwf : entriesWF pre.length entries = true) :
+    let full := inlineEntries pre entries
+    full = pre ++ entries.map (substSharesList full) := by
+  induction entries generalizing pre with
+  | nil => simp [inlineEntries]
+  | cons entry entries ih =>
+    simp only [entriesWF, Bool.and_eq_true] at hwf
+    let entry' := substSharesList pre entry
+    have hwfTail : entriesWF (pre ++ [entry']).length entries = true := by
+      simpa using hwf.2
+    have htail := ih (pre ++ [entry']) hwfTail
+    have hbelow : sharesBelow pre.length entry = true :=
+      sharesBelow_of_entryWF hwf.1
+    have hhead :
+        substSharesList (inlineEntries (pre ++ [entry']) entries) entry =
+          entry' := by
+      rw [htail]
+      rw [show (pre ++ [entry']) ++
+          entries.map
+            (substSharesList (inlineEntries (pre ++ [entry']) entries)) =
+          pre ++ ([entry'] ++ entries.map
+            (substSharesList (inlineEntries (pre ++ [entry']) entries))) by
+        simp [List.append_assoc]]
+      exact substSharesList_append_of_sharesBelow pre _ entry hbelow
+    simp only [inlineEntries, List.map_cons]
+    change inlineEntries (pre ++ [entry']) entries =
+      pre ++ substSharesList (inlineEntries (pre ++ [entry']) entries) entry ::
+        entries.map
+          (substSharesList (inlineEntries (pre ++ [entry']) entries))
+    calc
+      inlineEntries (pre ++ [entry']) entries =
+          (pre ++ [entry']) ++ entries.map
+            (substSharesList (inlineEntries (pre ++ [entry']) entries)) :=
+        htail
+      _ = pre ++ entry' :: entries.map
+            (substSharesList (inlineEntries (pre ++ [entry']) entries)) := by
+        simp [List.append_assoc]
+      _ = pre ++ substSharesList
+            (inlineEntries (pre ++ [entry']) entries) entry ::
+            entries.map
+              (substSharesList (inlineEntries (pre ++ [entry']) entries)) := by
+        rw [hhead]
+
+theorem inlineTable_toList_eq_map (table : Array Expr)
+    (htable : tableWF table = true) :
+    (inlineTable table).toList =
+      table.toList.map (substSharesList (inlineTable table).toList) := by
+  have h := inlineEntries_eq_append_map_subst [] table.toList htable
+  simpa [inlineTable] using h
+
+theorem inlineTable_getElem?_eq_inlineExpr
+    (table : Array Expr) (i : Nat) (entry : Expr)
+    (htable : tableWF table = true)
+    (hget : table[i]? = some entry) :
+    (inlineTable table)[i]? = some (inlineExpr table entry) := by
+  have hlist : table.toList[i]? = some entry := by
+    simpa using hget
+  have hmap := congrArg (fun xs : List Expr => xs[i]?)
+    (inlineTable_toList_eq_map table htable)
+  simp [List.getElem?_map, hlist] at hmap
+  change (inlineTable table)[i]? =
+    some (substSharesList (inlineTable table).toList entry)
+  exact hmap
+
+theorem inlineExpr_share_eq_inlineExpr_entry
+    (table : Array Expr) (i : UInt64) (entry : Expr)
+    (htable : tableWF table = true)
+    (hget : table[i.toNat]? = some entry) :
+    inlineExpr table (.share i) = inlineExpr table entry := by
+  have hinlined := inlineTable_getElem?_eq_inlineExpr table i.toNat entry
+    htable hget
+  simp [inlineExpr, substShares, substSharesList, hinlined]
+
+private theorem shareFree_get?_getD
+    (table : List Expr) (i : Nat) (fallback : Expr)
+    (hi : i < table.length)
+    (hfree : ∀ x ∈ table, shareFree x = true) :
+    shareFree ((table[i]?).getD fallback) = true := by
+  induction table generalizing i with
+  | nil => simp at hi
+  | cons x xs ih =>
+    cases i with
+    | zero => simpa using hfree x (by simp)
+    | succ i =>
+      rw [List.getElem?_cons_succ]
+      apply ih i
+      · simpa using hi
+      · intro y hy
+        exact hfree y (by simp [hy])
+
+/-- Substitution through a share-free table eliminates every in-bounds share
+in the input expression. -/
+theorem shareFree_substSharesList (table : List Expr) (e : Expr)
+    (hbelow : sharesBelow table.length e = true)
+    (hfree : ∀ x ∈ table, shareFree x = true) :
+    shareFree (substSharesList table e) = true := by
+  induction e with
+  | sort | var | ref | recur | str | nat =>
+    simp [substSharesList, shareFree]
+  | share i =>
+    simp only [sharesBelow, decide_eq_true_eq] at hbelow
+    exact shareFree_get?_getD table i.toNat (.share i) hbelow hfree
+  | prj r f v ih =>
+    simp only [sharesBelow] at hbelow
+    simpa [substSharesList, shareFree] using ih hbelow
+  | app f a ihf iha =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp only [substSharesList, shareFree, Bool.and_eq_true]
+    exact ⟨ihf hbelow.1, iha hbelow.2⟩
+  | lam u t b iht ihb =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp only [substSharesList, shareFree, Bool.and_eq_true]
+    exact ⟨iht hbelow.1, ihb hbelow.2⟩
+  | all u o d c ihd ihc =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp only [substSharesList, shareFree, Bool.and_eq_true]
+    exact ⟨ihd hbelow.1, ihc hbelow.2⟩
+  | letE nd t v b iht ihv ihb =>
+    simp only [sharesBelow, Bool.and_eq_true] at hbelow
+    simp only [substSharesList, shareFree, Bool.and_eq_true]
+    exact ⟨⟨iht hbelow.1.1, ihv hbelow.1.2⟩, ihb hbelow.2⟩
+
+/-- Left-to-right inlining preserves the prefix and adds exactly one result
+per source entry. -/
+theorem inlineEntries_length (inlined entries : List Expr) :
+    (inlineEntries inlined entries).length = inlined.length + entries.length := by
+  induction entries generalizing inlined with
+  | nil => simp [inlineEntries]
+  | cons e es ih =>
+    simp only [inlineEntries]
+    rw [ih]
+    simp only [List.length_append, List.length_cons, List.length_nil]
+    omega
+
+/-- If the prefix is share-free and each suffix entry points backward from its
+eventual index, the completed inlined table is share-free. -/
+theorem inlineEntries_shareFree (inlined entries : List Expr)
+    (hfree : ∀ x ∈ inlined, shareFree x = true)
+    (hwf : entriesWF inlined.length entries = true) :
+    ∀ x ∈ inlineEntries inlined entries, shareFree x = true := by
+  induction entries generalizing inlined with
+  | nil => simpa [inlineEntries] using hfree
+  | cons e es ih =>
+    simp only [entriesWF, Bool.and_eq_true] at hwf
+    let e' := substSharesList inlined e
+    have heBelow : sharesBelow inlined.length e = true :=
+      sharesBelow_of_entryWF hwf.1
+    have heFree : shareFree e' = true :=
+      shareFree_substSharesList inlined e heBelow hfree
+    apply ih (inlined ++ [e'])
+    · intro x hx
+      simp only [List.mem_append, List.mem_singleton] at hx
+      rcases hx with hx | rfl
+      · exact hfree x hx
+      · exact heFree
+    · simpa [e'] using hwf.2
+
+/-- Every result entry of a structurally well-formed table is share-free. -/
+theorem inlineTable_shareFree (table : Array Expr)
+    (htable : tableWF table = true) :
+    ∀ x ∈ (inlineTable table).toList, shareFree x = true := by
+  simpa [inlineTable, tableWF] using
+    (inlineEntries_shareFree [] table.toList (by simp) htable)
+
+/-- Inlining preserves the number and indices of table entries. -/
+theorem inlineTable_size (table : Array Expr) :
+    (inlineTable table).size = table.size := by
+  simp [inlineTable, inlineEntries_length]
+
+/-- The structural table invariant plus an in-bounds body suffices to remove
+all shares. The profitability rule is intentionally unnecessary here. -/
+theorem shareFree_inlineExpr_of_tableWF (table : Array Expr) (e : Expr)
+    (htable : tableWF table = true)
+    (hbelow : sharesBelow table.size e = true) :
+    shareFree (inlineExpr table e) = true := by
+  apply shareFree_substSharesList
+  · simpa [inlineExpr, inlineTable_size] using hbelow
+  · simpa [inlineExpr, substShares, inlineTable] using
+      inlineTable_shareFree table htable
+
+/-- Every body admitted by layer 1 becomes share-free after inlining. -/
+theorem shareFree_inlineExpr_of_layer1 (table bodies : Array Expr) (e : Expr)
+    (hlayer : layer1WF table bodies = true)
+    (he : e ∈ bodies.toList) :
+    shareFree (inlineExpr table e) = true := by
+  have h : Layer1 table bodies := (layer1WF_iff table bodies).mp hlayer
+  apply shareFree_inlineExpr_of_tableWF table e h.tableOk
+  exact (List.all_eq_true.mp (by simpa using h.bodiesOk)) e he
+
+/-- Substitution cannot change an expression that contains no share nodes. -/
+theorem substSharesList_eq_self_of_shareFree (table : List Expr) (e : Expr)
+    (hfree : shareFree e = true) :
+    substSharesList table e = e := by
+  induction e with
+  | sort | var | ref | recur | str | nat => simp [substSharesList]
+  | share => simp [shareFree] at hfree
+  | prj r f v ih =>
+    simp only [shareFree] at hfree
+    simp [substSharesList, ih hfree]
+  | app f a ihf iha =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [substSharesList, ihf hfree.1, iha hfree.2]
+  | lam u t b iht ihb =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [substSharesList, iht hfree.1, ihb hfree.2]
+  | all u o d c ihd ihc =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [substSharesList, ihd hfree.1, ihc hfree.2]
+  | letE nd t v b iht ihv ihb =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [substSharesList, iht hfree.1.1, ihv hfree.1.2, ihb hfree.2]
+
+/-- Inlining any table is the identity on an already share-free expression. -/
+theorem inlineExpr_eq_self_of_shareFree (table : Array Expr) (e : Expr)
+    (hfree : shareFree e = true) :
+    inlineExpr table e = e := by
+  simpa [inlineExpr, substShares] using
+    substSharesList_eq_self_of_shareFree (inlineTable table).toList e hfree
+
+/-- Share-free expressions satisfy every share-index bound, including zero. -/
+theorem sharesBelow_of_shareFree (bound : Nat) (e : Expr)
+    (hfree : shareFree e = true) :
+    sharesBelow bound e = true := by
+  induction e with
+  | sort | var | ref | recur | str | nat => simp [sharesBelow]
+  | share => simp [shareFree] at hfree
+  | prj r f v ih =>
+    simp only [shareFree] at hfree
+    simpa [sharesBelow] using ih hfree
+  | app f a ihf iha =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [sharesBelow, ihf hfree.1, iha hfree.2]
+  | lam u t b iht ihb =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [sharesBelow, iht hfree.1, ihb hfree.2]
+  | all u o d c ihd ihc =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [sharesBelow, ihd hfree.1, ihc hfree.2]
+  | letE nd t v b iht ihv ihb =>
+    simp only [shareFree, Bool.and_eq_true] at hfree
+    simp [sharesBelow, iht hfree.1.1, ihv hfree.1.2, ihb hfree.2]
+
+/-- Empty sharing is a layer-1 representation of every share-free body list. -/
+theorem layer1WF_empty_of_shareFree (bodies : Array Expr)
+    (hfree : bodies.all shareFree = true) :
+    layer1WF #[] bodies = true := by
+  apply (layer1WF_iff #[] bodies).mpr
+  refine ⟨?_, ?_, ?_⟩
+  · rfl
+  · rw [Array.all_eq_true]
+    intro i hi
+    exact sharesBelow_of_shareFree 0 bodies[i]
+      ((Array.all_eq_true.mp hfree) i hi)
+  · rfl
+
+/-! Executable boundary tests. Constant-level decoder tests live in
+`Const.lean`, where all embedded bodies are available. -/
+
+#guard tableWF #[]
+#guard tableWF #[.sort 0, .app (.share 0) (.share 0)]
+#guard !tableWF #[.app (.share 0) (.share 0)]
+#guard !tableWF #[.app (.share 1) (.share 1), .sort 0]
+#guard !tableWF #[.sort 0, .share 0]
+
+#guard entriesUsedTwice #[.sort 0, .app (.share 0) (.share 0)]
+  #[.app (.share 1) (.share 1)]
+#guard !entriesUsedTwice #[.sort 0, .app (.share 0) (.share 0)]
+  #[.share 1]
+
+#guard inlineExpr #[.sort 0, .app (.share 0) (.share 0)] (.share 1)
+  == .app (.sort 0) (.sort 0)
+#guard shareFree (inlineExpr #[.sort 0, .app (.share 0) (.share 0)]
+  (.lam .many (.share 0) (.share 1)))
+
+end Ix.Compiler.Ixon.Sharing
diff --git a/Ix/Compiler/Ixon/Sharing/Compress.lean b/Ix/Compiler/Ixon/Sharing/Compress.lean
new file mode 100644
index 000000000..787801e00
--- /dev/null
+++ b/Ix/Compiler/Ixon/Sharing/Compress.lean
@@ -0,0 +1,1182 @@
+import Ix.Compiler.Ixon.Hash
+import Ix.Compiler.Ixon.Sharing.Basic
+import Ix.Compiler.Ixon.Work
+
+/-!
+# Deterministic Ixon-v2 sharing compression
+
+This is the proof-facing, collision-safe port of ix's sharing policy. It keeps
+structural `Expr` representatives as the analysis keys; BLAKE3 is used only for
+deterministic ordering. Consequently a digest collision can affect an ordering
+tie but can never identify two expressions or cause an unsound rewrite.
+
+The policy is deliberately frozen in explicit stages:
+
+1. enumerate every unfolded subterm and its occurrence count;
+2. retain telescope-safe, serializer-profitable repeated candidates;
+3. sort by ix's decreasing gross-benefit policy with deterministic tie-breaks;
+4. put admitted representatives in leaves-first order and rewrite backward;
+5. repeatedly delete any table entry that does not pay for itself under the
+   real v2 expression serializer.
+
+The final audit makes deletion-local profitability a checked postcondition and
+absorbs telescope/header effects omitted by the greedy size model.
+-/
+
+namespace Ix.Compiler.Ixon.Sharing
+
+/-- Stable external identifier for the compressor decisions frozen by the
+parity corpus. Bump only with an intentional, documented policy change. -/
+def compressorPolicyId : String := "compilatrix/ixon-v2-sharing/1"
+
+/-- Exact upstream ix revision used for the v2 wire/address golden capture and
+sharing-policy comparison. The literal capture artifacts live in `Tests.lean`;
+this is the single source of truth for their revision. -/
+def ixParityRevision : String :=
+  "6f18ea907b78d06f7dc0917c43beb385561c35f4"
+
+/-- External sharing policy recognized at ix catalog ingress.  It is pinned to
+the exact upstream revision whose writer/checker artifacts form the parity
+corpus, and is deliberately distinct from `compressorPolicyId`. -/
+def ixonV2PolicyId : String := "ix/ixon-v2-sharing@" ++ ixParityRevision
+
+/-! ## V2 Merkle ordering key -/
+
+/-- Fixed-width little-endian scalar encoding used by ix's sharing Merkle key. -/
+def uint64LE (x : UInt64) : ByteArray :=
+  ByteArray.mk #[
+    x.toUInt8, (x >>> 8).toUInt8, (x >>> 16).toUInt8, (x >>> 24).toUInt8,
+    (x >>> 32).toUInt8, (x >>> 40).toUInt8, (x >>> 48).toUInt8,
+    (x >>> 56).toUInt8]
+
+/-- Node preimage for the internal sharing-order hash. Binder mode bytes are
+included exactly as they appear in Ixon v2. -/
+def nodeBytes (e : Expr) (childHashes : Array Address) : ByteArray :=
+  let child (n : Nat) : ByteArray :=
+    (childHashes[n]?.map (·.hash)).getD ByteArray.empty
+  match e with
+  | .sort u => (ByteArray.empty.push Expr.FLAG_SORT) ++ uint64LE u
+  | .var i => (ByteArray.empty.push Expr.FLAG_VAR) ++ uint64LE i
+  | .ref r us => us.foldl (fun b u => b ++ uint64LE u)
+      ((ByteArray.empty.push Expr.FLAG_REF) ++ uint64LE r
+        ++ uint64LE us.size.toUInt64)
+  | .recur r us => us.foldl (fun b u => b ++ uint64LE u)
+      ((ByteArray.empty.push Expr.FLAG_REC) ++ uint64LE r
+        ++ uint64LE us.size.toUInt64)
+  | .prj t f _ => (ByteArray.empty.push Expr.FLAG_PRJ) ++ uint64LE t
+      ++ uint64LE f ++ child 0
+  | .str r => (ByteArray.empty.push Expr.FLAG_STR) ++ uint64LE r
+  | .nat r => (ByteArray.empty.push Expr.FLAG_NAT) ++ uint64LE r
+  | .app _ _ => (ByteArray.empty.push Expr.FLAG_APP) ++ child 0 ++ child 1
+  | .lam u _ _ => ((ByteArray.empty.push Expr.FLAG_LAM).push u.toBits)
+      ++ child 0 ++ child 1
+  | .all u o _ _ => ((ByteArray.empty.push Expr.FLAG_ALL).push
+      (u.toBits ||| (o.toBits <<< 2))) ++ child 0 ++ child 1
+  | .letE nd _ _ _ => ((ByteArray.empty.push Expr.FLAG_LET).push
+      (if nd then 1 else 0)) ++ child 0 ++ child 1 ++ child 2
+  | .share i => (ByteArray.empty.push Expr.FLAG_SHARE) ++ uint64LE i
+
+/-- Structural Merkle hash used only as a deterministic ordering key. -/
+def exprHash : Expr → Address
+  | e@(.sort _) | e@(.var _) | e@(.ref _ _) | e@(.recur _ _)
+  | e@(.str _) | e@(.nat _) | e@(.share _) =>
+    .blake3 (nodeBytes e #[])
+  | e@(.prj _ _ v) =>
+    .blake3 (nodeBytes e #[exprHash v])
+  | e@(.app f a) =>
+    .blake3 (nodeBytes e #[exprHash f, exprHash a])
+  | e@(.lam _ t b) =>
+    .blake3 (nodeBytes e #[exprHash t, exprHash b])
+  | e@(.all _ _ d c) =>
+    .blake3 (nodeBytes e #[exprHash d, exprHash c])
+  | e@(.letE _ t v b) =>
+    .blake3 (nodeBytes e #[exprHash t, exprHash v, exprHash b])
+
+/-! ## Structural occurrence analysis -/
+
+structure Occurrence where
+  expr : Expr
+  /-- False at a position where replacing this occurrence would split an
+  application or binder telescope. -/
+  telescopeMaximal : Bool
+
+/-- Enumerate occurrences in fixed constructor-field order. -/
+def occurrences (atMaximalPosition : Bool) : Expr → List Occurrence
+  | e@(.sort _) | e@(.var _) | e@(.ref _ _) | e@(.recur _ _)
+  | e@(.str _) | e@(.nat _) | e@(.share _) =>
+    [⟨e, atMaximalPosition⟩]
+  | e@(.prj _ _ v) =>
+    ⟨e, atMaximalPosition⟩ :: occurrences true v
+  | e@(.app f a) =>
+    ⟨e, atMaximalPosition⟩ :: (occurrences false f ++ occurrences true a)
+  | e@(.lam _ t b) =>
+    let bodyMax := match b with | .lam .. => false | _ => true
+    ⟨e, atMaximalPosition⟩ :: (occurrences true t ++ occurrences bodyMax b)
+  | e@(.all _ _ d c) =>
+    let codMax := match c with | .all .. => false | _ => true
+    ⟨e, atMaximalPosition⟩ :: (occurrences true d ++ occurrences codMax c)
+  | e@(.letE _ t v b) =>
+    ⟨e, atMaximalPosition⟩ ::
+      (occurrences true t ++ occurrences true v ++ occurrences true b)
+
+def blockOccurrences (exprs : Array Expr) : List Occurrence :=
+  exprs.toList.flatMap (occurrences true)
+
+def occurrenceCount (needle : Expr) (os : List Occurrence) : Nat :=
+  os.countP fun o => o.expr == needle
+
+/-- A candidate is telescope-safe only when every occurrence can be replaced
+without splitting a maximal app/lam/all encoding run. -/
+def telescopeSafe (needle : Expr) (os : List Occurrence) : Bool :=
+  os.all fun o => if o.expr == needle then o.telescopeMaximal else true
+
+/-- Direct children, in the same order used by `nodeBytes`. -/
+def children : Expr → List Expr
+  | .prj _ _ v => [v]
+  | .app f a => [f, a]
+  | .lam _ t b => [t, b]
+  | .all _ _ d c => [d, c]
+  | .letE _ t v b => [t, v, b]
+  | _ => []
+
+/-- Structural postorder. Concatenating this for hash-sorted keys and removing
+duplicates implements ix's deterministic DFS topological order without maps. -/
+def postorder : Expr → List Expr
+  | e@(.sort _) | e@(.var _) | e@(.ref _ _) | e@(.recur _ _)
+  | e@(.str _) | e@(.nat _) | e@(.share _) => [e]
+  | e@(.prj _ _ v) => postorder v ++ [e]
+  | e@(.app f a) => postorder f ++ postorder a ++ [e]
+  | e@(.lam _ t b) => postorder t ++ postorder b ++ [e]
+  | e@(.all _ _ d c) => postorder d ++ postorder c ++ [e]
+  | e@(.letE _ t v b) => postorder t ++ postorder v ++ postorder b ++ [e]
+
+structure Candidate where
+  expr : Expr
+  termSize : Nat
+  usageCount : Nat
+  digest : Address
+
+def candidateGross (c : Candidate) : Nat :=
+  (c.usageCount - 1) * c.termSize
+
+/-- Digest order is collision-safe: structurally different equal digests fall
+back to their canonical expression bytes. -/
+def exprKeyLT (a b : Expr) : Bool :=
+  let ah := exprHash a
+  let bh := exprHash b
+  if ah == bh then (ser a).data < (ser b).data
+  else ah.hash.data < bh.hash.data
+
+def candidateLT (a b : Candidate) : Bool :=
+  let ga := candidateGross a
+  let gb := candidateGross b
+  if ga != gb then ga > gb
+  else if a.digest == b.digest then (ser a.expr).data < (ser b.expr).data
+  else a.digest.hash.data < b.digest.hash.data
+
+/-- Exact v2 size of a `.share idx` reference. -/
+def shareRefSize (idx : Nat) : Nat :=
+  (ser (.share idx.toUInt64 : Expr)).size
+
+/-- Per-node size model used by the pinned upstream compressor.  It predates
+the flattened app/lam/all writer and therefore sums one AST-node header at a
+time; reproducing that heuristic (including its overestimate on long spines)
+is load-bearing for exact external table recognition. -/
+def ixonV2NodeBaseSize : Expr → Nat
+  | .sort u => (tag4Bytes ⟨Expr.FLAG_SORT, u⟩).size
+  | .var i => (tag4Bytes ⟨Expr.FLAG_VAR, i⟩).size
+  | .ref r us | .recur r us =>
+    (tag4Bytes ⟨0, us.size.toUInt64⟩).size +
+      (tag0Bytes ⟨r⟩).size +
+      us.foldl (fun size u => size + (tag0Bytes ⟨u⟩).size) 0
+  | .prj t f _ =>
+    (tag4Bytes ⟨Expr.FLAG_PRJ, f⟩).size + (tag0Bytes ⟨t⟩).size
+  | .str r => (tag4Bytes ⟨Expr.FLAG_STR, r⟩).size
+  | .nat r => (tag4Bytes ⟨Expr.FLAG_NAT, r⟩).size
+  | .app _ _ => 1
+  | .lam _ _ _ | .all _ _ _ _ => 2
+  | .letE _ _ _ _ => 1
+  | .share i => (tag4Bytes ⟨Expr.FLAG_SHARE, i⟩).size
+
+/-- Upstream's effective serialized-size estimate: node base size plus the
+effective size of every structural child. -/
+def ixonV2EffectiveSize : Expr → Nat
+  | e@(.sort _) | e@(.var _) | e@(.ref _ _) | e@(.recur _ _)
+  | e@(.str _) | e@(.nat _) | e@(.share _) => ixonV2NodeBaseSize e
+  | e@(.prj _ _ v) => ixonV2NodeBaseSize e + ixonV2EffectiveSize v
+  | e@(.app f a) =>
+    ixonV2NodeBaseSize e + ixonV2EffectiveSize f + ixonV2EffectiveSize a
+  | e@(.lam _ t b) | e@(.all _ _ t b) =>
+    ixonV2NodeBaseSize e + ixonV2EffectiveSize t + ixonV2EffectiveSize b
+  | e@(.letE _ t v b) =>
+    ixonV2NodeBaseSize e + ixonV2EffectiveSize t +
+      ixonV2EffectiveSize v + ixonV2EffectiveSize b
+
+/-- Greedy ix-style admission on structural representatives. Candidate size is
+the exact standalone v2 serialization; the final audit handles context effects. -/
+def decideSharing (exprs : Array Expr) : Array Expr :=
+  let os := blockOccurrences exprs
+  let representatives := (os.map (·.expr)).eraseDups
+  let candidates := representatives.foldl (init := #[]) fun out e =>
+    let n := occurrenceCount e os
+    let size := (ser e).size
+    if n ≥ 2 && telescopeSafe e os && (n - 1) * size > n then
+      out.push ⟨e, size, n, exprHash e⟩
+    else out
+  let candidates := candidates.qsort candidateLT
+  candidates.foldl (init := #[]) fun selected cand =>
+    if (cand.usageCount - 1) * cand.termSize >
+        cand.usageCount * shareRefSize selected.size then
+      selected.push cand.expr
+    else selected
+
+/-- Exact candidate admission used by the pinned upstream ixon-v2 compressor.
+Unlike Ix.Compiler's local policy, it neither filters non-maximal telescope
+suffixes nor runs the later exact-deletion audit.  The remaining machinery is
+shared and collision-safe: structural equality, rather than a digest alone,
+identifies representatives. -/
+def decideIxonV2Sharing (exprs : Array Expr) : Array Expr :=
+  let os := blockOccurrences exprs
+  let representatives := (os.map (·.expr)).eraseDups
+  let candidates := representatives.foldl (init := #[]) fun out e =>
+    let n := occurrenceCount e os
+    let size := ixonV2EffectiveSize e
+    if n ≥ 2 && (n - 1) * size > n then
+      out.push ⟨e, size, n, exprHash e⟩
+    else out
+  let candidates := candidates.qsort candidateLT
+  candidates.foldl (init := #[]) fun selected cand =>
+    if (cand.usageCount - 1) * cand.termSize >
+        cand.usageCount * shareRefSize selected.size then
+      selected.push cand.expr
+    else selected
+
+/-- Deterministic leaves-first order for the selected representatives. -/
+def selectedTopological (exprs selected : Array Expr) : List Expr :=
+  let all := ((blockOccurrences exprs).map (·.expr)).eraseDups.toArray
+  let sortedKeys := all.qsort exprKeyLT
+  let topo := (sortedKeys.toList.flatMap postorder).eraseDups
+  topo.filter fun e => selected.contains e
+
+/-! ## Backward rewriting -/
+
+def findExprIndex? (needle : Expr) : List Expr → Option Nat
+  | [] => none
+  | e :: es =>
+    if e = needle then some 0
+    else (findExprIndex? needle es).map (· + 1)
+
+theorem findExprIndex?_getElem? {needle : Expr} {shared : List Expr} {i : Nat}
+    (h : findExprIndex? needle shared = some i) :
+    shared[i]? = some needle := by
+  induction shared generalizing i with
+  | nil => simp [findExprIndex?] at h
+  | cons e es ih =>
+    simp only [findExprIndex?] at h
+    split at h
+    · rename_i he
+      simp only [Option.some.injEq] at h
+      subst i
+      subst e
+      simp
+    · rename_i hne
+      cases htail : findExprIndex? needle es with
+      | none => simp [htail] at h
+      | some j =>
+        simp [htail] at h
+        subst i
+        rw [List.getElem?_cons_succ]
+        exact ih htail
+
+theorem findExprIndex?_lt {needle : Expr} {shared : List Expr} {i : Nat}
+    (h : findExprIndex? needle shared = some i) :
+    i < shared.length := by
+  induction shared generalizing i with
+  | nil => simp [findExprIndex?] at h
+  | cons e es ih =>
+    simp only [findExprIndex?] at h
+    split at h
+    · simp only [Option.some.injEq] at h
+      have hi : i = 0 := h.symm
+      subst i
+      simp
+    · cases htail : findExprIndex? needle es with
+      | none => simp [htail] at h
+      | some j =>
+        simp [htail] at h
+        subst i
+        have := ih htail
+        simp only [List.length_cons]
+        omega
+
+theorem substSharesList_found {needle : Expr} {shared : List Expr} {i : Nat}
+    (hfind : findExprIndex? needle shared = some i)
+    (hsize : shared.length < UInt64.size) :
+    substSharesList shared (.share i.toUInt64) = needle := by
+  have hi : i < shared.length := findExprIndex?_lt hfind
+  have hi64 : i < UInt64.size := Nat.lt_trans hi hsize
+  have hround : i.toUInt64.toNat = i := UInt64.toNat_ofNat_of_lt hi64
+  simp only [substSharesList, hround]
+  rw [findExprIndex?_getElem? hfind]
+  rfl
+
+/-- Rewrite every selected representative to its table index. Structural
+equality, rather than its digest, authorizes replacement. -/
+def rewriteWith (shared : List Expr) : Expr → Expr
+  | e@(.sort _) | e@(.var _) | e@(.ref _ _) | e@(.recur _ _)
+  | e@(.str _) | e@(.nat _) | e@(.share _) =>
+    match findExprIndex? e shared with
+    | some i => .share i.toUInt64
+    | none => e
+  | e@(.prj r f v) =>
+    match findExprIndex? e shared with
+    | some i => .share i.toUInt64
+    | none => .prj r f (rewriteWith shared v)
+  | e@(.app f a) =>
+    match findExprIndex? e shared with
+    | some i => .share i.toUInt64
+    | none => .app (rewriteWith shared f) (rewriteWith shared a)
+  | e@(.lam u t b) =>
+    match findExprIndex? e shared with
+    | some i => .share i.toUInt64
+    | none => .lam u (rewriteWith shared t) (rewriteWith shared b)
+  | e@(.all u o d c) =>
+    match findExprIndex? e shared with
+    | some i => .share i.toUInt64
+    | none => .all u o (rewriteWith shared d) (rewriteWith shared c)
+  | e@(.letE nd t v b) =>
+    match findExprIndex? e shared with
+    | some i => .share i.toUInt64
+    | none => .letE nd (rewriteWith shared t) (rewriteWith shared v)
+        (rewriteWith shared b)
+
+/-- Rewriting against a representable structural table and immediately
+substituting that same table is the identity on share-free expressions. -/
+theorem substSharesList_rewriteWith (shared : List Expr) (e : Expr)
+    (hsize : shared.length < UInt64.size)
+    (hfree : shareFree e = true) :
+    substSharesList shared (rewriteWith shared e) = e := by
+  induction e with
+  | sort u =>
+    cases hfind : findExprIndex? (.sort u) shared with
+    | none => simp [rewriteWith, hfind, substSharesList]
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+  | var v =>
+    cases hfind : findExprIndex? (.var v) shared with
+    | none => simp [rewriteWith, hfind, substSharesList]
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+  | ref r us =>
+    cases hfind : findExprIndex? (.ref r us) shared with
+    | none => simp [rewriteWith, hfind, substSharesList]
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+  | recur r us =>
+    cases hfind : findExprIndex? (.recur r us) shared with
+    | none => simp [rewriteWith, hfind, substSharesList]
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+  | str r =>
+    cases hfind : findExprIndex? (.str r) shared with
+    | none => simp [rewriteWith, hfind, substSharesList]
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+  | nat r =>
+    cases hfind : findExprIndex? (.nat r) shared with
+    | none => simp [rewriteWith, hfind, substSharesList]
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+  | share i => simp [shareFree] at hfree
+  | prj r f v ih =>
+    cases hfind : findExprIndex? (.prj r f v) shared with
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+    | none =>
+      simp only [shareFree] at hfree
+      simp only [rewriteWith, hfind, substSharesList]
+      rw [ih hfree]
+  | app f a ihf iha =>
+    cases hfind : findExprIndex? (.app f a) shared with
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+    | none =>
+      simp only [shareFree, Bool.and_eq_true] at hfree
+      simp only [rewriteWith, hfind, substSharesList]
+      rw [ihf hfree.1, iha hfree.2]
+  | lam u t b iht ihb =>
+    cases hfind : findExprIndex? (.lam u t b) shared with
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+    | none =>
+      simp only [shareFree, Bool.and_eq_true] at hfree
+      simp only [rewriteWith, hfind, substSharesList]
+      rw [iht hfree.1, ihb hfree.2]
+  | all u o d c ihd ihc =>
+    cases hfind : findExprIndex? (.all u o d c) shared with
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+    | none =>
+      simp only [shareFree, Bool.and_eq_true] at hfree
+      simp only [rewriteWith, hfind, substSharesList]
+      rw [ihd hfree.1, ihc hfree.2]
+  | letE nd t v b iht ihv ihb =>
+    cases hfind : findExprIndex? (.letE nd t v b) shared with
+    | some i =>
+      simp only [rewriteWith, hfind]
+      exact substSharesList_found hfind hsize
+    | none =>
+      simp only [shareFree, Bool.and_eq_true] at hfree
+      simp only [rewriteWith, hfind, substSharesList]
+      rw [iht hfree.1.1, ihv hfree.1.2, ihb hfree.2]
+
+/-- Build entries against only the already-emitted structural prefix. -/
+def buildTable (prior : List Expr) : List Expr → List Expr
+  | [] => []
+  | e :: es => rewriteWith prior e :: buildTable (prior ++ [e]) es
+
+theorem buildTable_length (prior rest : List Expr) :
+    (buildTable prior rest).length = rest.length := by
+  induction rest generalizing prior with
+  | nil => simp [buildTable]
+  | cons e es ih => simp [buildTable, ih]
+
+/-- Incremental table construction inlines to the structural representatives
+accumulated so far followed by the remaining representatives. -/
+theorem inlineEntries_buildTable (prior rest : List Expr)
+    (hsize : (prior ++ rest).length < UInt64.size)
+    (hfree : ∀ e ∈ rest, shareFree e = true) :
+    inlineEntries prior (buildTable prior rest) = prior ++ rest := by
+  induction rest generalizing prior with
+  | nil => simp [buildTable, inlineEntries]
+  | cons e es ih =>
+    have heFree : shareFree e = true := hfree e (by simp)
+    have hprior : prior.length < UInt64.size := by
+      have hp : prior.length ≤ (prior ++ e :: es).length := by simp
+      omega
+    have htailFree : ∀ x ∈ es, shareFree x = true := by
+      intro x hx
+      exact hfree x (by simp [hx])
+    have htailSize : ((prior ++ [e]) ++ es).length < UInt64.size := by
+      simpa [List.append_assoc] using hsize
+    simp only [buildTable, inlineEntries]
+    rw [substSharesList_rewriteWith prior e hprior heFree]
+    rw [ih (prior ++ [e]) htailSize htailFree]
+    simp [List.append_assoc]
+
+/-- The fully inlined generated table is exactly its structural representative
+list. -/
+theorem inlineTable_buildTable (reps : List Expr)
+    (hsize : reps.length < UInt64.size)
+    (hfree : ∀ e ∈ reps, shareFree e = true) :
+    inlineTable (buildTable [] reps).toArray = reps.toArray := by
+  simp [inlineTable, inlineEntries_buildTable [] reps hsize hfree]
+
+/-- A root rewritten against a generated table inlines to the original root. -/
+theorem inlineExpr_rewriteWith_buildTable (reps : List Expr) (e : Expr)
+    (hsize : reps.length < UInt64.size)
+    (hreps : ∀ x ∈ reps, shareFree x = true)
+    (he : shareFree e = true) :
+    inlineExpr (buildTable [] reps).toArray (rewriteWith reps e) = e := by
+  simp only [inlineExpr, substShares]
+  rw [inlineTable_buildTable reps hsize hreps]
+  simpa using substSharesList_rewriteWith reps e hsize he
+
+structure Compression where
+  bodies : Array Expr
+  table : Array Expr
+  deriving BEq, Repr
+
+def Compression.expanded (c : Compression) : Array Expr :=
+  c.bodies.map (inlineExpr c.table)
+
+def compressionReps (exprs : Array Expr) : List Expr :=
+  (selectedTopological exprs (decideSharing exprs)).filter fun e => shareFree e
+
+theorem compressionReps_shareFree (exprs : Array Expr) :
+    ∀ e ∈ compressionReps exprs, shareFree e = true := by
+  intro e he
+  exact (List.mem_filter.mp he).2
+
+def buildCompression (exprs : Array Expr) : Compression :=
+  let reps := compressionReps exprs
+  { bodies := exprs.map (rewriteWith reps)
+    table := (buildTable [] reps).toArray }
+
+theorem buildCompression_table_size (exprs : Array Expr) :
+    (buildCompression exprs).table.size = (compressionReps exprs).length := by
+  simp [buildCompression, buildTable_length]
+
+/-- Raw greedy construction (before the deletion audit) recovers every
+share-free input when its generated indices fit the wire representation. -/
+theorem inline_buildCompression (exprs : Array Expr)
+    (hfree : exprs.all shareFree = true)
+    (hindex : (buildCompression exprs).table.size < UInt64.size) :
+    (buildCompression exprs).bodies.map
+      (inlineExpr (buildCompression exprs).table) = exprs := by
+  let reps := compressionReps exprs
+  have hreps : ∀ e ∈ reps, shareFree e = true :=
+    compressionReps_shareFree exprs
+  have hrepsSize : reps.length < UInt64.size := by
+    simpa [reps, buildCompression_table_size] using hindex
+  apply Array.ext
+  · simp [buildCompression]
+  · intro i hiLeft hiRight
+    have hi : i < exprs.size := by simpa [buildCompression] using hiLeft
+    have heFree : shareFree exprs[i] = true :=
+      (Array.all_eq_true.mp hfree) i hi
+    simpa [buildCompression, reps] using
+      inlineExpr_rewriteWith_buildTable reps exprs[i] hrepsSize hreps heFree
+
+/-! ## Pinned upstream ixon-v2 construction -/
+
+def ixonV2CompressionReps (exprs : Array Expr) : List Expr :=
+  (selectedTopological exprs (decideIxonV2Sharing exprs)).filter shareFree
+
+theorem ixonV2CompressionReps_shareFree (exprs : Array Expr) :
+    ∀ e ∈ ixonV2CompressionReps exprs, shareFree e = true := by
+  intro e he
+  exact (List.mem_filter.mp he).2
+
+/-- Deterministic image of the pinned upstream ixon-v2 sharing compressor.
+This intentionally stops before Ix.Compiler's telescope filter and exact
+deletion audit. -/
+def buildIxonV2Compression (exprs : Array Expr) : Compression :=
+  let reps := ixonV2CompressionReps exprs
+  { bodies := exprs.map (rewriteWith reps)
+    table := (buildTable [] reps).toArray }
+
+theorem buildIxonV2Compression_table_size (exprs : Array Expr) :
+    (buildIxonV2Compression exprs).table.size =
+      (ixonV2CompressionReps exprs).length := by
+  simp [buildIxonV2Compression, buildTable_length]
+
+theorem inline_buildIxonV2Compression (exprs : Array Expr)
+    (hfree : exprs.all shareFree = true)
+    (hindex : (buildIxonV2Compression exprs).table.size < UInt64.size) :
+    (buildIxonV2Compression exprs).expanded = exprs := by
+  let reps := ixonV2CompressionReps exprs
+  have hreps : ∀ e ∈ reps, shareFree e = true :=
+    ixonV2CompressionReps_shareFree exprs
+  have hrepsSize : reps.length < UInt64.size := by
+    simpa [reps, buildIxonV2Compression_table_size] using hindex
+  apply Array.ext
+  · simp [Compression.expanded, buildIxonV2Compression]
+  · intro i hiLeft hiRight
+    have hi : i < exprs.size := by
+      simpa [Compression.expanded, buildIxonV2Compression] using hiLeft
+    have heFree : shareFree exprs[i] = true :=
+      (Array.all_eq_true.mp hfree) i hi
+    simpa [Compression.expanded, buildIxonV2Compression, reps] using
+      inlineExpr_rewriteWith_buildTable reps exprs[i] hrepsSize hreps heFree
+
+/-! ## Exact serializer-priced audit -/
+
+/-- Replace a deleted index by its entry and shift every later index down. The
+replacement can mention only earlier entries for a table produced above. -/
+def eraseShare (idx : Nat) (replacement : Expr) : Expr → Expr
+  | .share j =>
+    if j.toNat == idx then replacement
+    else if idx < j.toNat then .share (j.toNat - 1).toUInt64
+    else .share j
+  | .app f a => .app (eraseShare idx replacement f) (eraseShare idx replacement a)
+  | .lam u t b => .lam u (eraseShare idx replacement t) (eraseShare idx replacement b)
+  | .all u o d c =>
+    .all u o (eraseShare idx replacement d) (eraseShare idx replacement c)
+  | .letE nd t v b => .letE nd (eraseShare idx replacement t)
+      (eraseShare idx replacement v) (eraseShare idx replacement b)
+  | .prj r f v => .prj r f (eraseShare idx replacement v)
+  | e => e
+
+def eraseTableEntry (idx : Nat) (replacement : Expr) (table : List Expr) :
+    List Expr :=
+  (table.eraseIdx idx).map (eraseShare idx replacement)
+
+def deleteEntry? (c : Compression) (idx : Nat) : Option Compression := do
+  let replacement ← c.table[idx]?
+  pure { bodies := c.bodies.map (eraseShare idx replacement)
+         table := (eraseTableEntry idx replacement c.table.toList).toArray }
+
+theorem deleteEntry_table_size {c smaller : Compression} {idx : Nat}
+    (h : deleteEntry? c idx = some smaller) :
+    smaller.table.size + 1 = c.table.size := by
+  unfold deleteEntry? at h
+  cases hget : c.table[idx]? with
+  | none => simp [hget] at h
+  | some replacement =>
+    have hi : idx < c.table.size :=
+      (Array.getElem?_eq_some_iff.mp hget).choose
+    simp [hget] at h
+    subst smaller
+    simp [eraseTableEntry, List.length_eraseIdx_of_lt hi]
+    omega
+
+/-- Exact bytes controlled by sharing selection: the table count/header, every
+table entry, and every body expression. Constant-info framing is unchanged. -/
+def sharingPayloadSize (c : Compression) : Nat :=
+  let tableHeader := (runPut (putTag0 ⟨c.table.size.toUInt64⟩)).size
+  tableHeader
+    + c.table.foldl (fun n e => n + (ser e).size) 0
+    + c.bodies.foldl (fun n e => n + (ser e).size) 0
+
+def firstNonPayingFrom (c : Compression) (currentSize : Nat) : Nat → Nat →
+    Option Compression
+  | 0, _ => none
+  | fuel + 1, idx =>
+    match deleteEntry? c idx with
+    | some smaller =>
+      if _hsemantic : smaller.expanded = c.expanded then
+        if sharingPayloadSize smaller ≤ currentSize then some smaller
+        else firstNonPayingFrom c currentSize fuel (idx + 1)
+      else firstNonPayingFrom c currentSize fuel (idx + 1)
+    | none => none
+
+def firstNonPaying? (c : Compression) : Option Compression :=
+  firstNonPayingFrom c (sharingPayloadSize c) c.table.size 0
+
+theorem firstNonPayingFrom_expanded (c out : Compression)
+    (currentSize fuel idx : Nat)
+    (h : firstNonPayingFrom c currentSize fuel idx = some out) :
+    out.expanded = c.expanded := by
+  induction fuel generalizing idx with
+  | zero => simp [firstNonPayingFrom] at h
+  | succ fuel ih =>
+    simp only [firstNonPayingFrom] at h
+    cases hd : deleteEntry? c idx with
+    | none => simp [hd] at h
+    | some smaller =>
+      simp only [hd] at h
+      split at h
+      · rename_i hsemantic
+        split at h
+        · simp only [Option.some.injEq] at h
+          subst out
+          exact hsemantic
+        · exact ih (idx + 1) h
+      · exact ih (idx + 1) h
+
+theorem firstNonPayingFrom_table_size (c out : Compression)
+    (currentSize fuel idx : Nat)
+    (h : firstNonPayingFrom c currentSize fuel idx = some out) :
+    out.table.size + 1 = c.table.size := by
+  induction fuel generalizing idx with
+  | zero => simp [firstNonPayingFrom] at h
+  | succ fuel ih =>
+    simp only [firstNonPayingFrom] at h
+    cases hd : deleteEntry? c idx with
+    | none => simp [hd] at h
+    | some smaller =>
+      simp only [hd] at h
+      split at h
+      · split at h
+        · simp only [Option.some.injEq] at h
+          subst out
+          exact deleteEntry_table_size hd
+        · exact ih (idx + 1) h
+      · exact ih (idx + 1) h
+
+theorem firstNonPaying_expanded (c out : Compression)
+    (h : firstNonPaying? c = some out) :
+    out.expanded = c.expanded := by
+  exact firstNonPayingFrom_expanded c out (sharingPayloadSize c)
+    c.table.size 0 h
+
+theorem firstNonPaying_table_size (c out : Compression)
+    (h : firstNonPaying? c = some out) :
+    out.table.size + 1 = c.table.size := by
+  exact firstNonPayingFrom_table_size c out (sharingPayloadSize c)
+    c.table.size 0 h
+
+/-- Remove the first non-paying entry, then restart because deletion changes
+indices and telescope contexts. At most the initial table size can be removed. -/
+def auditFuel : Nat → Compression → Compression
+  | 0, c => c
+  | fuel + 1, c =>
+    match firstNonPaying? c with
+    | none => c
+    | some smaller => auditFuel fuel smaller
+
+def audit (c : Compression) : Compression :=
+  auditFuel c.table.size c
+
+theorem auditFuel_expanded (fuel : Nat) (c : Compression) :
+    (auditFuel fuel c).expanded = c.expanded := by
+  induction fuel generalizing c with
+  | zero => rfl
+  | succ fuel ih =>
+    simp only [auditFuel]
+    cases hnext : firstNonPaying? c with
+    | none => rfl
+    | some smaller =>
+      exact (ih smaller).trans (firstNonPaying_expanded c smaller hnext)
+
+theorem auditFuel_table_size_le (fuel : Nat) (c : Compression) :
+    (auditFuel fuel c).table.size ≤ c.table.size := by
+  induction fuel generalizing c with
+  | zero => exact Nat.le_refl _
+  | succ fuel ih =>
+    simp only [auditFuel]
+    cases hnext : firstNonPaying? c with
+    | none => exact Nat.le_refl _
+    | some smaller =>
+      change (auditFuel fuel smaller).table.size ≤ c.table.size
+      have hrec := ih smaller
+      have hshrink := firstNonPaying_table_size c smaller hnext
+      omega
+
+theorem audit_expanded (c : Compression) :
+    (audit c).expanded = c.expanded := by
+  exact auditFuel_expanded c.table.size c
+
+theorem audit_table_size_le (c : Compression) :
+    (audit c).table.size ≤ c.table.size := by
+  exact auditFuel_table_size_le c.table.size c
+
+/-- The search has no remaining semantically validated non-paying deletion. -/
+def auditFixpoint (c : Compression) : Bool :=
+  (firstNonPaying? c).isNone
+
+theorem auditFuel_firstNonPaying_none (fuel : Nat) (c : Compression)
+    (hsize : c.table.size ≤ fuel) :
+    firstNonPaying? (auditFuel fuel c) = none := by
+  induction fuel generalizing c with
+  | zero =>
+    have hc : c.table.size = 0 := Nat.eq_zero_of_le_zero hsize
+    simp [auditFuel, firstNonPaying?, hc, firstNonPayingFrom]
+  | succ fuel ih =>
+    simp only [auditFuel]
+    cases hnext : firstNonPaying? c with
+    | none => exact hnext
+    | some smaller =>
+      apply ih smaller
+      have hshrink := firstNonPaying_table_size c smaller hnext
+      omega
+
+theorem audit_firstNonPaying_none (c : Compression) :
+    firstNonPaying? (audit c) = none := by
+  exact auditFuel_firstNonPaying_none c.table.size c (Nat.le_refl _)
+
+theorem audit_fixpoint (c : Compression) :
+    auditFixpoint (audit c) = true := by
+  simp [auditFixpoint, audit_firstNonPaying_none]
+
+/-- Strong diagnostic for well-formed tables: every syntactically available
+single-entry deletion increases bytes. The certified audit postcondition below
+additionally requires that the deletion preserve expansion. -/
+def allEntriesPay (c : Compression) : Bool :=
+  (List.range c.table.size).all fun i =>
+    match deleteEntry? c i with
+    | some smaller => sharingPayloadSize c < sharingPayloadSize smaller
+    | none => false
+
+/-- Exact deletion-local optimality: no single deletion that validates as
+semantics-preserving is non-paying. -/
+def deletionLocalOptimal (c : Compression) : Bool :=
+  auditFixpoint c
+
+theorem deletionLocalOptimal_audit (c : Compression) :
+    deletionLocalOptimal (audit c) = true := by
+  exact audit_fixpoint c
+
+def compressUnchecked (exprs : Array Expr) : Compression :=
+  audit (buildCompression exprs)
+
+theorem compressUnchecked_table_size_le (exprs : Array Expr) :
+    (compressUnchecked exprs).table.size ≤ (buildCompression exprs).table.size := by
+  exact audit_table_size_le (buildCompression exprs)
+
+theorem deletionLocalOptimal_compressUnchecked (exprs : Array Expr) :
+    deletionLocalOptimal (compressUnchecked exprs) = true := by
+  exact deletionLocalOptimal_audit (buildCompression exprs)
+
+/-- Full raw mechanism recovery: the exact-byte audit preserves the recovery
+proved for the greedy table builder. -/
+theorem inline_compressUnchecked (input : Array Expr)
+    (hfree : input.all shareFree = true)
+    (hindex : (buildCompression input).table.size < UInt64.size) :
+    (compressUnchecked input).expanded = input := by
+  exact (audit_expanded (buildCompression input)).trans
+    (inline_buildCompression input hfree hindex)
+
+/-! ## Certified totalization -/
+
+/-- Semantics-preserving fallback used only if the heuristic violates layer 1.
+It is deliberately visible in the specification and parity tests. -/
+def identityCompression (input : Array Expr) : Compression :=
+  { bodies := input, table := #[] }
+
+theorem identityCompression_expanded (input : Array Expr)
+    (hfree : input.all shareFree = true) :
+    (identityCompression input).expanded = input := by
+  apply Array.ext
+  · simp [identityCompression, Compression.expanded]
+  · intro i hiLeft hiRight
+    have hi : i < input.size := by
+      simpa [identityCompression, Compression.expanded] using hiLeft
+    have heFree := (Array.all_eq_true.mp hfree) i hi
+    simpa [identityCompression, Compression.expanded] using
+      inlineExpr_eq_self_of_shareFree #[] input[i] heFree
+
+/-- Retain the heuristic output when it satisfies layer 1; otherwise use the
+identity representation. This is a correctness fallback, not a policy change
+on accepted heuristic outputs. -/
+def certifyLayer1 (input : Array Expr) (candidate : Compression) : Compression :=
+  if _h : layer1WF candidate.table candidate.bodies = true then candidate
+  else identityCompression input
+
+def compressCertified (input : Array Expr) : Compression :=
+  certifyLayer1 input (compressUnchecked input)
+
+theorem layer1_compressCertified (input : Array Expr)
+    (hfree : input.all shareFree = true) :
+    layer1WF (compressCertified input).table
+      (compressCertified input).bodies = true := by
+  unfold compressCertified certifyLayer1
+  split
+  · assumption
+  · exact layer1WF_empty_of_shareFree input hfree
+
+theorem inline_compressCertified (input : Array Expr)
+    (hfree : input.all shareFree = true)
+    (hindex : (buildCompression input).table.size < UInt64.size) :
+    (compressCertified input).expanded = input := by
+  unfold compressCertified certifyLayer1
+  split
+  · exact inline_compressUnchecked input hfree hindex
+  · exact identityCompression_expanded input hfree
+
+theorem deletionLocalOptimal_identityCompression (input : Array Expr) :
+    deletionLocalOptimal (identityCompression input) = true := by
+  rfl
+
+theorem deletionLocalOptimal_compressCertified (input : Array Expr) :
+    deletionLocalOptimal (compressCertified input) = true := by
+  unfold compressCertified certifyLayer1
+  split
+  · exact deletionLocalOptimal_compressUnchecked input
+  · exact deletionLocalOptimal_identityCompression input
+
+theorem compressCertified_table_size_le (input : Array Expr) :
+    (compressCertified input).table.size ≤ (buildCompression input).table.size := by
+  unfold compressCertified certifyLayer1
+  split
+  · exact compressUnchecked_table_size_le input
+  · simp [identityCompression]
+
+/-! ## Exact pinned ixon-v2 recognizer -/
+
+/-- Reproduce the pinned upstream ixon-v2 compressor and certify the
+safety-critical table invariant plus exact inline recovery.  This is an
+external-format recognizer, not Ix.Compiler's local compressor. -/
+def compressIxonV2? (exprs : Array Expr) : Option Compression :=
+  if !exprs.all shareFree then none
+  else
+    let out := buildIxonV2Compression exprs
+    if _hstructural : structuralWF out.table out.bodies = true then
+      if _hindex : out.table.size < UInt64.size then
+        if _hinline : out.expanded = exprs then some out
+        else none
+      else none
+    else none
+
+/-- Exact-image predicate for external constants written by the pinned
+upstream ixon-v2 compressor. -/
+def ixonV2Canonical (bodies table : Array Expr) : Bool :=
+  if !structuralWF table bodies then false
+  else
+    let expanded := bodies.map (inlineExpr table)
+    match compressIxonV2? expanded with
+    | some out => decide (out.bodies = bodies ∧ out.table = table)
+    | none => false
+
+theorem inline_compressIxonV2 (input : Array Expr) (out : Compression)
+    (h : compressIxonV2? input = some out) :
+    out.expanded = input := by
+  unfold compressIxonV2? at h
+  split at h <;> simp_all
+  rcases h with ⟨_, _, hinline, rfl⟩
+  exact hinline
+
+theorem structural_compressIxonV2 (input : Array Expr) (out : Compression)
+    (h : compressIxonV2? input = some out) :
+    structuralWF out.table out.bodies = true := by
+  unfold compressIxonV2? at h
+  split at h <;> simp_all
+  rcases h with ⟨hstructural, _, _, rfl⟩
+  exact hstructural
+
+theorem ixonV2Canonical_compress (input : Array Expr) (out : Compression)
+    (h : compressIxonV2? input = some out) :
+    ixonV2Canonical out.bodies out.table = true := by
+  have hstructural := structural_compressIxonV2 input out h
+  have hinline := inline_compressIxonV2 input out h
+  change out.bodies.map (inlineExpr out.table) = input at hinline
+  simp [ixonV2Canonical, hstructural, hinline, h]
+
+/-- Public compressor. Share-freedom is enforced at the API boundary, and the
+result is accepted only when layer 1, the exact audit postcondition, and exact
+inline recovery all hold. The last check is stated as propositional equality so
+its successful branch carries the proof consumed below. -/
+def compress? (exprs : Array Expr) : Option Compression :=
+  if !exprs.all shareFree then none
+  else
+    let out := compressCertified exprs
+    if _hlayer : layer1WF out.table out.bodies = true then
+      if _hoptimal : deletionLocalOptimal out = true then
+        if _hindex : out.table.size < UInt64.size then
+          if _hinline : out.bodies.map (inlineExpr out.table) = exprs then some out
+          else none
+        else none
+      else none
+    else none
+
+/-- Layer 2: exact recompression image. This is intentionally more expensive
+than decoder-enforced layer 1 and belongs at content-address/store ingestion. -/
+def canonical (bodies table : Array Expr) : Bool :=
+  if !layer1WF table bodies then false
+  else
+    let expanded := bodies.map (inlineExpr table)
+    match compress? expanded with
+    | some out => decide (out.bodies = bodies ∧ out.table = table)
+    | none => false
+
+/-! ## Resource-bounded executable boundaries -/
+
+/-- Inclusive structural limits for content-address canonicalization.  The
+compressor cap is intentionally much tighter than the wire-size cap: the
+frozen collision-safe policy performs repeated structural comparisons and an
+exact deletion audit. -/
+structure ResourceLimits where
+  maxLayer1NodeVisits : Nat := 16 * 1024 * 1024
+  maxCompressionInputUnits : Nat := 4096
+  deriving BEq, DecidableEq, Repr
+
+def defaultResourceLimits : ResourceLimits := {}
+
+/-- Run the public compressor only after a linear input-size preflight. -/
+def compressWithLimit (maxInputUnits : Nat) (exprs : Array Expr) :
+    Except Work.Exceeded (Option Compression) :=
+  match Work.ensure .compressionInputUnits (Work.exprArrayUnits exprs)
+      maxInputUnits with
+  | .error exceeded => .error exceeded
+  | .ok _ => .ok (compress? exprs)
+
+/-- Resource-bounded layer-2 recognizer.  The fully inlined size is computed
+from the backward table without allocating the expanded expression forest;
+only an admitted input reaches `inlineExpr` and the compressor. -/
+def canonicalWith (limits : ResourceLimits) (bodies table : Array Expr) :
+    Except Work.Exceeded Bool :=
+  match Work.ensure .layer1NodeVisits (Work.layer1NodeVisits table bodies)
+      limits.maxLayer1NodeVisits with
+  | .error exceeded => .error exceeded
+  | .ok _ =>
+    match Work.expandedUnits? table bodies with
+    | none => .ok false
+    | some units =>
+      match Work.ensure .compressionInputUnits units
+          limits.maxCompressionInputUnits with
+      | .error exceeded => .error exceeded
+      | .ok _ => .ok (canonical bodies table)
+
+/-- Resource-bounded exact-image recognizer for the pinned upstream ixon-v2
+compressor.  It uses the same conservative expansion and compressor-input
+budgets as the local recognizer. -/
+def ixonV2CanonicalWith (limits : ResourceLimits)
+    (bodies table : Array Expr) : Except Work.Exceeded Bool :=
+  match Work.ensure .layer1NodeVisits (Work.layer1NodeVisits table bodies)
+      limits.maxLayer1NodeVisits with
+  | .error exceeded => .error exceeded
+  | .ok _ =>
+    match Work.expandedUnits? table bodies with
+    | none => .ok false
+    | some units =>
+      match Work.ensure .compressionInputUnits units
+          limits.maxCompressionInputUnits with
+      | .error exceeded => .error exceeded
+      | .ok _ => .ok (ixonV2Canonical bodies table)
+
+def canonicalBounded (bodies table : Array Expr) :
+    Except Work.Exceeded Bool :=
+  canonicalWith defaultResourceLimits bodies table
+
+def ixonV2CanonicalBounded (bodies table : Array Expr) :
+    Except Work.Exceeded Bool :=
+  ixonV2CanonicalWith defaultResourceLimits bodies table
+
+theorem compressWithLimit_sound {maxInputUnits : Nat} {exprs : Array Expr}
+    {out : Option Compression}
+    (h : compressWithLimit maxInputUnits exprs = .ok out) :
+    compress? exprs = out := by
+  unfold compressWithLimit at h
+  cases hbudget : Work.ensure .compressionInputUnits
+      (Work.exprArrayUnits exprs) maxInputUnits with
+  | error exceeded => simp_all
+  | ok result =>
+    cases result
+    simp_all
+
+theorem canonicalWith_true {limits : ResourceLimits}
+    {bodies table : Array Expr}
+    (h : canonicalWith limits bodies table = .ok true) :
+    canonical bodies table = true := by
+  unfold canonicalWith at h
+  cases hlayer : Work.ensure .layer1NodeVisits
+      (Work.layer1NodeVisits table bodies) limits.maxLayer1NodeVisits with
+  | error exceeded => simp_all
+  | ok layerResult =>
+    cases layerResult
+    cases hexpanded : Work.expandedUnits? table bodies with
+    | none => simp_all
+    | some units =>
+      cases hcompression : Work.ensure .compressionInputUnits units
+          limits.maxCompressionInputUnits with
+      | error exceeded => simp_all
+      | ok compressionResult =>
+        cases compressionResult
+        simp_all
+
+theorem ixonV2CanonicalWith_true {limits : ResourceLimits}
+    {bodies table : Array Expr}
+    (h : ixonV2CanonicalWith limits bodies table = .ok true) :
+    ixonV2Canonical bodies table = true := by
+  unfold ixonV2CanonicalWith at h
+  cases hlayer : Work.ensure .layer1NodeVisits
+      (Work.layer1NodeVisits table bodies) limits.maxLayer1NodeVisits with
+  | error exceeded => simp_all
+  | ok layerResult =>
+    cases layerResult
+    cases hexpanded : Work.expandedUnits? table bodies with
+    | none => simp_all
+    | some units =>
+      cases hcompression : Work.ensure .compressionInputUnits units
+          limits.maxCompressionInputUnits with
+      | error exceeded => simp_all
+      | ok compressionResult =>
+        cases compressionResult
+        simp_all
+
+/-! ## Executable proof contracts for S4 -/
+
+def InlineCompressLaw : Prop :=
+  ∀ input out, compress? input = some out →
+    out.bodies.map (inlineExpr out.table) = input
+
+def CompressCanonicalLaw : Prop :=
+  ∀ input out, compress? input = some out → canonical out.bodies out.table = true
+
+/-- Totality contract: the checked boundary never rejects a feasible
+share-free input. The certified identity fallback makes this provable even if
+the optimization heuristic violates an internal invariant. -/
+def CompressTotalLaw : Prop :=
+  ∀ input, input.all shareFree = true →
+    (buildCompression input).table.size < UInt64.size →
+    ∃ out, compress? input = some out
+
+/-- The central raw-mechanism lemma from which `CompressTotalLaw`'s recovery
+gate follows; unlike `InlineCompressLaw`, this speaks before validation. -/
+def UncheckedInlineLaw : Prop :=
+  ∀ input, input.all shareFree = true →
+    (buildCompression input).table.size < UInt64.size →
+    (compressUnchecked input).expanded = input
+
+/-- The public checked compressor is semantically sound: every successful
+result inlines exactly to its share-free input. -/
+theorem inline_compress (input : Array Expr) (out : Compression)
+    (h : compress? input = some out) :
+    out.bodies.map (inlineExpr out.table) = input := by
+  unfold compress? at h
+  split at h <;> simp_all
+  rcases h with ⟨_, _, _, hinline, rfl⟩
+  exact hinline
+
+/-- Every successful public result satisfies decoder-enforced layer 1. -/
+theorem layer1_compress (input : Array Expr) (out : Compression)
+    (h : compress? input = some out) :
+    layer1WF out.table out.bodies = true := by
+  unfold compress? at h
+  split at h <;> simp_all
+  rcases h with ⟨hlayer, _, _, _, rfl⟩
+  exact hlayer
+
+/-- Every successful public result is a fixpoint of the exact deletion audit. -/
+theorem deletionLocalOptimal_compress (input : Array Expr) (out : Compression)
+    (h : compress? input = some out) :
+    deletionLocalOptimal out = true := by
+  unfold compress? at h
+  split at h <;> simp_all
+  rcases h with ⟨_, hoptimal, _, _, rfl⟩
+  exact hoptimal
+
+/-- Every successful table index is representable by the wire's `UInt64`. -/
+theorem indexable_compress (input : Array Expr) (out : Compression)
+    (h : compress? input = some out) :
+    out.table.size < UInt64.size := by
+  unfold compress? at h
+  split at h <;> simp_all
+  rcases h with ⟨_, _, hindex, _, rfl⟩
+  exact hindex
+
+/-- Successful compression is idempotent under the exact layer-2 recognizer. -/
+theorem canonical_compress (input : Array Expr) (out : Compression)
+    (h : compress? input = some out) :
+    canonical out.bodies out.table = true := by
+  have hlayer := layer1_compress input out h
+  have hinline := inline_compress input out h
+  simp [canonical, hlayer, hinline, h]
+
+theorem inlineCompressLaw : InlineCompressLaw := by
+  intro input out h
+  exact inline_compress input out h
+
+theorem compressCanonicalLaw : CompressCanonicalLaw := by
+  intro input out h
+  exact canonical_compress input out h
+
+theorem uncheckedInlineLaw : UncheckedInlineLaw := by
+  intro input hfree hindex
+  exact inline_compressUnchecked input hfree hindex
+
+/-- Every feasible share-free input is accepted. The heuristic result is used
+when layer 1 validates; the proved identity fallback makes correctness total
+without hiding parity failures in the runtime corpus. -/
+theorem compressTotalLaw : CompressTotalLaw := by
+  intro input hfree hbuildIndex
+  refine ⟨compressCertified input, ?_⟩
+  have hlayer := layer1_compressCertified input hfree
+  have hoptimal := deletionLocalOptimal_compressCertified input
+  have hindex : (compressCertified input).table.size < UInt64.size :=
+    Nat.lt_of_le_of_lt (compressCertified_table_size_le input) hbuildIndex
+  have hinline := inline_compressCertified input hfree hbuildIndex
+  unfold compress?
+  simp [hfree, hlayer, hoptimal, hindex, Compression.expanded] at hinline ⊢
+  exact hinline
+
+/-! Pure guards for the rewriting/audit substrate. BLAKE3-dependent compressor
+fixtures run in the compiled `Tests.lean` executable. -/
+
+#guard uint64LE 0x0102030405060708 == ByteArray.mk #[8, 7, 6, 5, 4, 3, 2, 1]
+#guard nodeBytes (.lam .many (.sort 0) (.var 0)) #[] !=
+  nodeBytes (.lam .linear (.sort 0) (.var 0)) #[]
+#guard nodeBytes (.all .many .shared (.sort 0) (.var 0)) #[] !=
+  nodeBytes (.all .many .unique (.sort 0) (.var 0)) #[]
+
+private def auditFixture : Compression :=
+  { bodies := #[.app (.share 0) (.share 0)]
+    table := #[.sort 0] }
+
+#guard deleteEntry? auditFixture 0 == some
+  { bodies := #[.app (.sort 0) (.sort 0)], table := #[] }
+#guard !deletionLocalOptimal auditFixture
+#guard deletionLocalOptimal (audit auditFixture)
+
+end Ix.Compiler.Ixon.Sharing
diff --git a/Ix/Compiler/Ixon/Sharing/Eval.lean b/Ix/Compiler/Ixon/Sharing/Eval.lean
new file mode 100644
index 000000000..c17abb737
--- /dev/null
+++ b/Ix/Compiler/Ixon/Sharing/Eval.lean
@@ -0,0 +1,2277 @@
+import Ix.Compiler.Ixon.Eval
+import Ix.Compiler.Ixon.Sharing
+
+/-!
+# Sharing/evaluator coherence
+
+Full inlining extends from expressions and constants to evaluator frames,
+resolution contexts, heads, and recursive values. Under decoder-level sharing
+well-formedness, a single mutual fuel induction proves that every successful
+run of `eval`, `evalRef`, `apply`, `applyMany`, `saturate`, or `fire` remains
+successful after inlining and returns the correspondingly inlined value.
+Closed-expression and definition-constant corollaries expose the result at the
+public evaluator entry points.
+-/
+
+namespace Ix.Compiler.Ixon.Eval
+
+def Frame.inlineSharing (F : Frame) : Frame :=
+  { sharing := #[]
+    refs := F.refs
+    univs := F.univs
+    selfMuts := F.selfMuts.map
+      (MutConst.mapExprs (Sharing.inlineExpr F.sharing))
+    uinst := F.uinst
+    selfAddr := F.selfAddr }
+
+def EvalCtx.inlineSharing (ctx : EvalCtx) : EvalCtx :=
+  { resolve := fun address => (ctx.resolve address).map Constant.inlineSharing
+    blobs := ctx.blobs
+    preserveNeutralElims := ctx.preserveNeutralElims
+    natBlock := ctx.natBlock
+    stringLiteral := ctx.stringLiteral
+    quotientKind := ctx.quotientKind
+    externArity := ctx.externArity
+    oracle := ctx.oracle }
+
+@[simp] theorem Frame.inlineSharing_refs (F : Frame) :
+    F.inlineSharing.refs = F.refs := by rfl
+
+@[simp] theorem Frame.ofConst_sharing (c : Constant) (uinst : List Nat)
+    (selfAddr : Option Address) :
+    (Frame.ofConst c uinst selfAddr).sharing = c.sharing := by rfl
+
+@[simp] theorem Frame.inlineSharing_univs (F : Frame) :
+    F.inlineSharing.univs = F.univs := by rfl
+
+@[simp] theorem Frame.inlineSharing_uinst (F : Frame) :
+    F.inlineSharing.uinst = F.uinst := by rfl
+
+@[simp] theorem Frame.inlineSharing_selfAddr (F : Frame) :
+    F.inlineSharing.selfAddr = F.selfAddr := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_blobs (ctx : EvalCtx) :
+    ctx.inlineSharing.blobs = ctx.blobs := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_preserveNeutralElims (ctx : EvalCtx) :
+    ctx.inlineSharing.preserveNeutralElims = ctx.preserveNeutralElims := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_resolve (ctx : EvalCtx)
+    (address : Address) :
+    ctx.inlineSharing.resolve address =
+      (ctx.resolve address).map Constant.inlineSharing := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_natBlock (ctx : EvalCtx) :
+    ctx.inlineSharing.natBlock = ctx.natBlock := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_stringLiteral (ctx : EvalCtx) :
+    ctx.inlineSharing.stringLiteral = ctx.stringLiteral := by rfl
+
+theorem EvalCtx.Strict.inlineSharing {ctx : EvalCtx} (h : ctx.Strict) :
+    ctx.inlineSharing.Strict :=
+  ⟨by simpa using h.neutralElims, by simpa using h.stringLiterals⟩
+
+@[simp] theorem EvalCtx.inlineSharing_quotientKind (ctx : EvalCtx) :
+    ctx.inlineSharing.quotientKind = ctx.quotientKind := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_externArity (ctx : EvalCtx) :
+    ctx.inlineSharing.externArity = ctx.externArity := by rfl
+
+@[simp] theorem EvalCtx.inlineSharing_oracle (ctx : EvalCtx) :
+    ctx.inlineSharing.oracle = ctx.oracle := by rfl
+
+def Head.inlineSharing : Head → Head
+  | .ctorH block indIdx cidx arity => .ctorH block indIdx cidx arity
+  | .neuH id => .neuH id
+  | .extH address arity => .extH address arity
+  | .quotH address kind => .quotH address kind
+  | .recH block r F =>
+    .recH block (r.mapExprs (Sharing.inlineExpr F.sharing)) F.inlineSharing
+
+mutual
+  def Value.inlineSharing : Value → Value
+    | .sortV lvl => .sortV lvl
+    | .piV uses owned F env dom cod =>
+      .piV uses owned F.inlineSharing (valuesInlineSharing env)
+        (Sharing.inlineExpr F.sharing dom)
+        (Sharing.inlineExpr F.sharing cod)
+    | .closV uses F env dom body =>
+      .closV uses F.inlineSharing (valuesInlineSharing env)
+        (Sharing.inlineExpr F.sharing dom)
+        (Sharing.inlineExpr F.sharing body)
+    | .papV head args =>
+      .papV head.inlineSharing (valuesInlineSharing args)
+    | .quotV address representative =>
+      .quotV address representative.inlineSharing
+    | .ctorV block indIdx cidx args =>
+      .ctorV block indIdx cidx (valuesInlineSharing args)
+    | .litV lit => .litV lit
+  termination_by value => sizeOf value
+
+  def valuesInlineSharing : List Value → List Value
+    | [] => []
+    | value :: values => value.inlineSharing :: valuesInlineSharing values
+  termination_by values => sizeOf values
+
+end
+
+theorem Frame.inlineSharing_ofConst (c : Constant) (uinst : List Nat)
+    (selfAddr : Option Address) :
+    (Frame.ofConst c uinst selfAddr).inlineSharing =
+      Frame.ofConst c.inlineSharing uinst selfAddr := by
+  cases c with
+  | mk info sharing refs univs =>
+    cases info <;> simp [Frame.ofConst, Frame.inlineSharing,
+      Constant.inlineSharing, ConstantInfo.mapExprs,
+      MutConst.mapExprs, ConstantIdentityLaws.mapMutConst,
+      ConstantIdentityLaws.mapInfo, selfMutsOf]
+
+theorem Frame.inlineSharing_set_uinst (F : Frame) (uinst : List Nat) :
+    ({ F with uinst := uinst }).inlineSharing =
+      { F.inlineSharing with uinst := uinst } := by rfl
+
+theorem evalUnivArgs_inlineSharing (F : Frame) (idxs : Array UInt64) :
+    evalUnivArgs F.inlineSharing idxs = evalUnivArgs F idxs := by
+  rfl
+
+theorem majorCtor_inlineSharing (peel : Bool) (value : Value) :
+    majorCtor peel value.inlineSharing =
+      (majorCtor peel value).map fun result =>
+        (result.1, valuesInlineSharing result.2) := by
+  cases value <;> simp [Value.inlineSharing, majorCtor, Except.map]
+  case litV lit =>
+    cases lit <;> simp
+    case natL n =>
+      cases peel <;> cases n <;>
+        simp [Value.inlineSharing, valuesInlineSharing]
+
+@[simp] theorem guardRecMajor_inlineSharing (block : Option Address)
+    (params : Nat) (value : Value) :
+    guardRecMajor block params value.inlineSharing =
+      guardRecMajor block params value := by
+  cases value <;> simp [Value.inlineSharing, guardRecMajor]
+
+def rootsBelow (table : Array Expr) (roots : List Expr) : Prop :=
+  ∀ e ∈ roots, Sharing.sharesBelow table.size e = true
+
+structure Frame.SharingWF (F : Frame) : Prop where
+  tableOk : Sharing.tableWF F.sharing = true
+  selfMutsOk : ∀ (i : Nat) (member : MutConst),
+    F.selfMuts[i]? = some member →
+    rootsBelow F.sharing member.exprs
+
+inductive Head.SharingWF : Head → Prop where
+  | ctorH (block : Address) (indIdx cidx arity : Nat) :
+      SharingWF (.ctorH block indIdx cidx arity)
+  | neuH (id : NeutralId) : SharingWF (.neuH id)
+  | extH (address : Address) (arity : Nat) :
+      SharingWF (.extH address arity)
+  | quotH (address : Address) (kind : QuotKind) :
+      SharingWF (.quotH address kind)
+  | recH (block : Option Address) (r : Recursor) (F : Frame)
+      (hframe : Frame.SharingWF F)
+      (hrecr : rootsBelow F.sharing r.exprs) :
+      SharingWF (.recH block r F)
+
+mutual
+inductive Value.SharingWF : Value → Prop where
+  | sortV (lvl : Nat) : Value.SharingWF (.sortV lvl)
+  | piV (uses : Uses) (owned : Owned) (F : Frame) (env : List Value)
+      (dom cod : Expr) (hframe : Frame.SharingWF F)
+      (henv : ValuesSharingWF env)
+      (hdom : Sharing.sharesBelow F.sharing.size dom = true)
+      (hcod : Sharing.sharesBelow F.sharing.size cod = true) :
+      Value.SharingWF (.piV uses owned F env dom cod)
+  | closV (uses : Uses) (F : Frame) (env : List Value) (dom body : Expr)
+      (hframe : Frame.SharingWF F) (henv : ValuesSharingWF env)
+      (hdom : Sharing.sharesBelow F.sharing.size dom = true)
+      (hbody : Sharing.sharesBelow F.sharing.size body = true) :
+      Value.SharingWF (.closV uses F env dom body)
+  | papV (h : Head) (args : List Value) (hhead : Head.SharingWF h)
+      (hargs : ValuesSharingWF args) :
+      Value.SharingWF (.papV h args)
+  | quotV (address : Address) (representative : Value)
+      (hrepresentative : Value.SharingWF representative) :
+      Value.SharingWF (.quotV address representative)
+  | ctorV (block : Address) (indIdx cidx : Nat) (args : List Value)
+      (hargs : ValuesSharingWF args) :
+      Value.SharingWF (.ctorV block indIdx cidx args)
+  | litV (lit : Lit) : Value.SharingWF (.litV lit)
+
+inductive ValuesSharingWF : List Value → Prop where
+  | nil : ValuesSharingWF []
+  | cons (head : Value) (tail : List Value)
+      (hhead : Value.SharingWF head) (htail : ValuesSharingWF tail) :
+      ValuesSharingWF (head :: tail)
+end
+
+structure EvalCtx.SharingWF (ctx : EvalCtx) : Prop where
+  resolveOk : ∀ address c, ctx.resolve address = some c →
+    c.sharingWF = true
+  oracleOk : ∀ address args value,
+    ValuesSharingWF args →
+    ctx.oracle address args = some value →
+    ctx.oracle address (valuesInlineSharing args) =
+        some value.inlineSharing ∧
+      value.SharingWF
+
+theorem valuesInlineSharing_eq_map (values : List Value) :
+    valuesInlineSharing values = values.map Value.inlineSharing := by
+  induction values with
+  | nil => simp [valuesInlineSharing]
+  | cons value values ih => simp [valuesInlineSharing, ih]
+
+@[simp] theorem valuesInlineSharing_append (left right : List Value) :
+    valuesInlineSharing (left ++ right) =
+      valuesInlineSharing left ++ valuesInlineSharing right := by
+  simp [valuesInlineSharing_eq_map]
+
+@[simp] theorem valuesInlineSharing_length (values : List Value) :
+    (valuesInlineSharing values).length = values.length := by
+  simp [valuesInlineSharing_eq_map]
+
+theorem valuesInlineSharing_getElem? (values : List Value) (i : Nat) :
+    (valuesInlineSharing values)[i]? =
+      (values[i]?).map Value.inlineSharing := by
+  simp [valuesInlineSharing_eq_map, List.getElem?_map]
+
+theorem valuesInlineSharing_getLast? (values : List Value) :
+    (valuesInlineSharing values).getLast? =
+      values.getLast?.map Value.inlineSharing := by
+  simp [valuesInlineSharing_eq_map, List.getLast?_map]
+
+@[simp] theorem valuesInlineSharing_take (n : Nat) (values : List Value) :
+    valuesInlineSharing (values.take n) =
+      (valuesInlineSharing values).take n := by
+  simp [valuesInlineSharing_eq_map, List.map_take]
+
+@[simp] theorem valuesInlineSharing_drop (n : Nat) (values : List Value) :
+    valuesInlineSharing (values.drop n) =
+      (valuesInlineSharing values).drop n := by
+  simp [valuesInlineSharing_eq_map, List.map_drop]
+
+theorem ValuesSharingWF.mem {values : List Value}
+    (hvalues : ValuesSharingWF values) {value : Value}
+    (hmem : value ∈ values) : value.SharingWF := by
+  induction values with
+  | nil => simp at hmem
+  | cons head tail ih =>
+    cases hvalues with
+    | cons _ _ hhead htail =>
+    simp only [List.mem_cons] at hmem
+    rcases hmem with rfl | hmem
+    · exact hhead
+    · exact ih htail hmem
+
+theorem ValuesSharingWF.getElem?_eq {values : List Value}
+    (hvalues : ValuesSharingWF values) {i : Nat} {value : Value}
+    (hget : values[i]? = some value) : value.SharingWF := by
+  apply hvalues.mem
+  rcases List.getElem?_eq_some_iff.mp hget with ⟨hi, heq⟩
+  exact List.mem_iff_getElem.mpr ⟨i, hi, heq⟩
+
+theorem ValuesSharingWF.getLast?_eq {values : List Value}
+    (hvalues : ValuesSharingWF values) {value : Value}
+    (hget : values.getLast? = some value) : value.SharingWF := by
+  apply hvalues.mem
+  rcases List.getLast?_eq_some_iff.mp hget with ⟨pre, rfl⟩
+  simp
+
+theorem ValuesSharingWF.append {left right : List Value}
+    (hleft : ValuesSharingWF left) (hright : ValuesSharingWF right) :
+    ValuesSharingWF (left ++ right) := by
+  induction left with
+  | nil => simpa using hright
+  | cons head tail ih =>
+    cases hleft with
+    | cons _ _ hhead htail =>
+      exact .cons head (tail ++ right) hhead (ih htail)
+
+theorem ValuesSharingWF.take {values : List Value}
+    (hvalues : ValuesSharingWF values) (n : Nat) :
+    ValuesSharingWF (values.take n) := by
+  induction n generalizing values with
+  | zero => exact .nil
+  | succ n ih =>
+    cases values with
+    | nil => exact .nil
+    | cons head tail =>
+      cases hvalues with
+      | cons _ _ hhead htail =>
+        exact .cons head (tail.take n) hhead (ih htail)
+
+theorem ValuesSharingWF.drop {values : List Value}
+    (hvalues : ValuesSharingWF values) (n : Nat) :
+    ValuesSharingWF (values.drop n) := by
+  induction n generalizing values with
+  | zero => simpa using hvalues
+  | succ n ih =>
+    cases values with
+    | nil => exact .nil
+    | cons head tail =>
+      cases hvalues with
+      | cons _ _ hhead htail => exact ih htail
+
+theorem arrayAll_of_mem {α : Type} {values : Array α} {p : α → Bool}
+    (hall : values.all p = true) {value : α} (hmem : value ∈ values) :
+    p value = true := by
+  have hall' := (Array.all_eq_true.mp hall)
+  rcases List.mem_iff_getElem.mp (Array.mem_def.mp hmem) with
+    ⟨i, hi, heq⟩
+  have hi' : i < values.size := by simpa using hi
+  have hvalue : values[i] = value := by simpa using heq
+  rw [← hvalue]
+  exact hall' i hi'
+
+theorem constantTableWF_of_sharingWF (c : Constant)
+    (h : c.sharingWF = true) : Sharing.tableWF c.sharing = true := by
+  exact ((Sharing.layer1WF_iff c.sharing c.info.exprs.toArray).mp h).tableOk
+
+theorem constantRootsBelow_of_sharingWF (c : Constant)
+    (h : c.sharingWF = true) : rootsBelow c.sharing c.info.exprs := by
+  intro e he
+  have hlayer :=
+    (Sharing.layer1WF_iff c.sharing c.info.exprs.toArray).mp h
+  apply arrayAll_of_mem hlayer.bodiesOk
+  simpa using he
+
+theorem Frame.sharingWF_ofConst (c : Constant) (uinst : List Nat)
+    (selfAddr : Option Address) (h : c.sharingWF = true) :
+    (Frame.ofConst c uinst selfAddr).SharingWF := by
+  constructor
+  · exact constantTableWF_of_sharingWF c h
+  · intro i member hget
+    have hroots := constantRootsBelow_of_sharingWF c h
+    cases hi : c.info with
+    | muts members =>
+      have hget' : members[i]? = some member := by
+        simpa [Frame.ofConst, selfMutsOf, hi] using hget
+      have hmem : member ∈ members.toList := by
+        rcases Array.getElem?_eq_some_iff.mp hget' with ⟨hib, heq⟩
+        exact Array.mem_def.mp (by
+          apply Array.mem_iff_getElem.mpr
+          exact ⟨i, hib, heq⟩)
+      intro e he
+      apply hroots e
+      rw [hi]
+      simp only [ConstantInfo.exprs, List.mem_flatMap]
+      exact ⟨member, hmem, he⟩
+    | defn d =>
+      cases i with
+      | zero =>
+        have hmember : member = .defn d := by
+          simpa [Frame.ofConst, selfMutsOf, hi] using hget.symm
+        subst member
+        intro e he
+        apply hroots e
+        rw [hi]
+        simpa [ConstantInfo.exprs, MutConst.exprs] using he
+      | succ i => simp [Frame.ofConst, selfMutsOf, hi] at hget
+    | recr r =>
+      cases i with
+      | zero =>
+        have hmember : member = .recr r := by
+          simpa [Frame.ofConst, selfMutsOf, hi] using hget.symm
+        subst member
+        intro e he
+        apply hroots e
+        rw [hi]
+        simpa [ConstantInfo.exprs, MutConst.exprs] using he
+      | succ i => simp [Frame.ofConst, selfMutsOf, hi] at hget
+    | axio | quot | cPrj | rPrj | iPrj | dPrj =>
+      simp [Frame.ofConst, selfMutsOf, hi] at hget
+
+theorem Frame.SharingWF.with_uinst {F : Frame} (hF : F.SharingWF)
+    (uinst : List Nat) : ({ F with uinst := uinst }).SharingWF := by
+  cases hF
+  constructor <;> assumption
+
+theorem selfMutsOf_mapExprs (info : ConstantInfo) (f : Expr → Expr) :
+    selfMutsOf (info.mapExprs f) =
+      (selfMutsOf info).map (MutConst.mapExprs f) := by
+  cases info <;> simp [ConstantInfo.mapExprs, MutConst.mapExprs,
+    ConstantIdentityLaws.mapMutConst, ConstantIdentityLaws.mapInfo,
+    selfMutsOf]
+
+theorem resolveMut_inlineSharing_of_eq {ctx : EvalCtx} {block : Address}
+    {idx : Nat} {c : Constant} {member : MutConst}
+    (hresolve : resolveMut ctx block idx = .ok (c, member)) :
+    resolveMut ctx.inlineSharing block idx =
+      .ok (c.inlineSharing,
+        member.mapExprs (Sharing.inlineExpr c.sharing)) := by
+  unfold resolveMut at hresolve ⊢
+  cases hc : ctx.resolve block with
+  | none =>
+    rw [hc] at hresolve
+    contradiction
+  | some found =>
+    rw [hc] at hresolve
+    simp only at hresolve
+    cases hm : (selfMutsOf found.info)[idx]? with
+    | none =>
+      rw [hm] at hresolve
+      contradiction
+    | some foundMember =>
+      rw [hm] at hresolve
+      cases hresolve
+      simp [Constant.inlineSharing, selfMutsOf_mapExprs,
+        EvalCtx.inlineSharing, hc, Array.getElem?_map, hm]
+
+theorem resolveMut_components_of_eq {ctx : EvalCtx} {block : Address}
+    {idx : Nat} {c : Constant} {member : MutConst}
+    (hresolve : resolveMut ctx block idx = .ok (c, member)) :
+    ctx.resolve block = some c ∧
+      (selfMutsOf c.info)[idx]? = some member := by
+  unfold resolveMut at hresolve
+  cases hc : ctx.resolve block with
+  | none => rw [hc] at hresolve; contradiction
+  | some found =>
+    rw [hc] at hresolve
+    simp only at hresolve
+    cases hm : (selfMutsOf found.info)[idx]? with
+    | none => rw [hm] at hresolve; contradiction
+    | some foundMember =>
+      rw [hm] at hresolve
+      cases hresolve
+      exact ⟨rfl, hm⟩
+
+theorem constantMemberRoots_of_getElem (c : Constant) (i : Nat)
+    (member : MutConst) (hsharing : c.sharingWF = true)
+    (hget : (selfMutsOf c.info)[i]? = some member) :
+    rootsBelow c.sharing member.exprs := by
+  have hroots := constantRootsBelow_of_sharingWF c hsharing
+  cases hi : c.info with
+  | muts members =>
+    have hget' : members[i]? = some member := by
+      simpa [selfMutsOf, hi] using hget
+    have hmem : member ∈ members.toList := by
+      rcases Array.getElem?_eq_some_iff.mp hget' with ⟨hib, heq⟩
+      exact Array.mem_def.mp (Array.mem_iff_getElem.mpr ⟨i, hib, heq⟩)
+    intro e he
+    apply hroots e
+    rw [hi]
+    simp only [ConstantInfo.exprs, List.mem_flatMap]
+    exact ⟨member, hmem, he⟩
+  | defn d =>
+    cases i with
+    | zero =>
+      have hmember : member = .defn d := by
+        simpa [selfMutsOf, hi] using hget.symm
+      subst member
+      intro e he
+      apply hroots e
+      rw [hi]
+      simpa [ConstantInfo.exprs, MutConst.exprs] using he
+    | succ i => simp [selfMutsOf, hi] at hget
+  | recr r =>
+    cases i with
+    | zero =>
+      have hmember : member = .recr r := by
+        simpa [selfMutsOf, hi] using hget.symm
+      subst member
+      intro e he
+      apply hroots e
+      rw [hi]
+      simpa [ConstantInfo.exprs, MutConst.exprs] using he
+    | succ i => simp [selfMutsOf, hi] at hget
+  | axio | quot | cPrj | rPrj | iPrj | dPrj =>
+    simp [selfMutsOf, hi] at hget
+
+theorem resolveMut_sharingWF_of_eq {ctx : EvalCtx} (hctx : ctx.SharingWF)
+    {block : Address} {idx : Nat} {c : Constant} {member : MutConst}
+    (hresolve : resolveMut ctx block idx = .ok (c, member)) :
+    c.sharingWF = true ∧ rootsBelow c.sharing member.exprs := by
+  have hcomponents := resolveMut_components_of_eq hresolve
+  have hc := hctx.resolveOk block c hcomponents.1
+  exact ⟨hc, constantMemberRoots_of_getElem c idx member hc hcomponents.2⟩
+
+theorem Frame.inlineSharing_selfMuts_getElem? {F : Frame} {i : Nat}
+    {member : MutConst} (hget : F.selfMuts[i]? = some member) :
+    F.inlineSharing.selfMuts[i]? =
+      some (member.mapExprs (Sharing.inlineExpr F.sharing)) := by
+  simp [Frame.inlineSharing, Array.getElem?_map, hget]
+
+@[simp] theorem Head.arity?_inlineSharing (h : Head) :
+    h.inlineSharing.arity? = h.arity? := by
+  cases h <;> rfl
+
+@[simp] theorem Value.isNeutral_inlineSharing (value : Value) :
+    value.inlineSharing.isNeutral = value.isNeutral := by
+  cases value with
+  | papV head args =>
+    cases head <;> simp [Value.inlineSharing, Head.inlineSharing,
+      Value.isNeutral, recArity, Recursor.mapExprs,
+      ConstantIdentityLaws.mapRecursor] <;> rfl
+  | sortV | piV | closV | quotV | ctorV | litV =>
+    simp [Value.inlineSharing, Value.isNeutral]
+
+theorem projectValue_inlineSharing {ctx : EvalCtx} {F : Frame}
+    {typeRefIdx fieldIdx : UInt64} {value result : Value}
+    (hctx : ctx.SharingWF) (hvalue : value.SharingWF)
+    (hproject : projectValue ctx F typeRefIdx fieldIdx value = .ok result) :
+    projectValue ctx.inlineSharing F.inlineSharing typeRefIdx fieldIdx
+        value.inlineSharing = .ok result.inlineSharing ∧
+      result.SharingWF := by
+  unfold projectValue resolveProjectionTarget at hproject ⊢
+  cases href : F.refs[typeRefIdx.toNat]? with
+  | none =>
+    rw [href] at hproject
+    dsimp only at hproject
+    contradiction
+  | some typeAddress =>
+    have href' : F.inlineSharing.refs[typeRefIdx.toNat]? =
+        some typeAddress := by simpa using href
+    rw [href] at hproject
+    rw [href']
+    dsimp only at hproject ⊢
+    cases htype : ctx.resolve typeAddress with
+    | none =>
+      rw [htype] at hproject
+      contradiction
+    | some typeConstant =>
+      rw [htype] at hproject
+      rw [EvalCtx.inlineSharing_resolve, htype]
+      dsimp only at hproject ⊢
+      cases hinfo : typeConstant.info with
+      | iPrj projection =>
+        rw [hinfo] at hproject
+        dsimp only at hproject
+        simp only [Option.map, Constant.inlineSharing,
+          ConstantInfo.mapExprs, ConstantIdentityLaws.mapInfo, hinfo]
+        cases hresolve : resolveMut ctx projection.block
+            projection.idx.toNat with
+        | error err =>
+          rw [hresolve] at hproject
+          contradiction
+        | ok pair =>
+          rcases pair with ⟨blockConstant, member⟩
+          rw [hresolve] at hproject
+          rw [resolveMut_inlineSharing_of_eq hresolve]
+          cases member with
+          | defn definition => contradiction
+          | recr recursor => contradiction
+          | indc ind =>
+            simp only [MutConst.mapExprs,
+              ConstantIdentityLaws.mapMutConst,
+              ConstantIdentityLaws.mapInductive] at hproject ⊢
+            cases value with
+            | ctorV block indIdx cidx args =>
+              cases hvalue with
+              | ctorV _ _ _ _ hargs =>
+                simp only [Value.inlineSharing]
+                dsimp only at hproject ⊢
+                cases hmatches :
+                    block == projection.block &&
+                      indIdx == projection.idx.toNat with
+                | false =>
+                  rw [hmatches] at hproject
+                  contradiction
+                | true =>
+                  simp only [hmatches, if_true] at hproject ⊢
+                  cases harg : args[ind.params.toNat + fieldIdx.toNat]? with
+                  | none =>
+                    rw [harg] at hproject
+                    contradiction
+                  | some projected =>
+                    rw [harg] at hproject
+                    cases hproject
+                    rw [valuesInlineSharing_getElem?, harg]
+                    exact ⟨rfl, hargs.getElem?_eq harg⟩
+            | papV head args =>
+              cases hvalue with
+              | papV _ _ hhead hargs =>
+                simp only [Value.inlineSharing]
+                dsimp only at hproject ⊢
+                cases hneutral :
+                    (Value.papV head args).isNeutral &&
+                      ctx.preserveNeutralElims with
+                | false =>
+                  rw [hneutral] at hproject
+                  contradiction
+                | true =>
+                  rw [hneutral] at hproject
+                  cases hproject
+                  have hneutral' :
+                      ((Value.papV head.inlineSharing
+                            (valuesInlineSharing args)).isNeutral &&
+                          ctx.inlineSharing.preserveNeutralElims) = true := by
+                    have hvneutral :
+                        (Value.papV head.inlineSharing
+                          (valuesInlineSharing args)).isNeutral =
+                            (Value.papV head args).isNeutral := by
+                      simpa only [Value.inlineSharing] using
+                        Value.isNeutral_inlineSharing (Value.papV head args)
+                    rw [hvneutral,
+                      EvalCtx.inlineSharing_preserveNeutralElims]
+                    exact hneutral
+                  rw [hneutral']
+                  exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                      valuesInlineSharing],
+                    .papV _ _ (.neuH _) (.cons _ _
+                    (.papV _ _ hhead hargs) .nil)⟩
+            | sortV | piV | closV | quotV | litV =>
+              simp [Value.isNeutral] at hproject
+      | defn _ => rw [hinfo] at hproject; contradiction
+      | axio _ => rw [hinfo] at hproject; contradiction
+      | quot _ => rw [hinfo] at hproject; contradiction
+      | cPrj _ => rw [hinfo] at hproject; contradiction
+      | rPrj _ => rw [hinfo] at hproject; contradiction
+      | dPrj _ => rw [hinfo] at hproject; contradiction
+      | recr _ => rw [hinfo] at hproject; contradiction
+      | muts _ => rw [hinfo] at hproject; contradiction
+
+theorem majorCtor_sharingWF {peel : Bool} {value : Value}
+    (hvalue : value.SharingWF) {cidx : Nat} {args : List Value}
+    (hmajor : majorCtor peel value = .ok (cidx, args)) :
+    ValuesSharingWF args := by
+  cases hvalue with
+  | ctorV block indIdx cidx values hvalues =>
+    simp only [majorCtor] at hmajor
+    cases hmajor
+    exact hvalues
+  | litV lit =>
+    cases lit with
+    | strL => simp [majorCtor] at hmajor
+    | natL n =>
+      cases peel <;> cases n <;> simp [majorCtor] at hmajor
+      · rw [hmajor.2]
+        exact .nil
+      · rw [← hmajor.2]
+        exact .cons _ _ (.litV _) .nil
+  | sortV | piV | closV | papV | quotV => simp [majorCtor] at hmajor
+
+theorem quotientRep?_inlineSharing (value : Value) :
+    quotientRep? value.inlineSharing =
+      (quotientRep? value).map Value.inlineSharing := by
+  cases value <;> simp [Value.inlineSharing, quotientRep?]
+
+theorem quotientRep?_sharingWF {quotient representative : Value}
+    (hquotient : quotient.SharingWF)
+    (hrep : quotientRep? quotient = some representative) :
+    representative.SharingWF := by
+  cases hquotient with
+  | quotV address stored hstored =>
+    simp only [quotientRep?] at hrep
+    cases hrep
+    exact hstored
+  | sortV | piV | closV | papV | ctorV | litV =>
+    simp [quotientRep?] at hrep
+
+theorem rootsBelow_definition_value {table : Array Expr} {d : Definition}
+    (h : rootsBelow table d.exprs) :
+    Sharing.sharesBelow table.size d.value = true := by
+  exact h d.value (by simp [Definition.exprs])
+
+theorem rootsBelow_recursor_rule {table : Array Expr} {r : Recursor}
+    (h : rootsBelow table r.exprs) {i : Nat} {rule : RecursorRule}
+    (hget : r.rules[i]? = some rule) :
+    Sharing.sharesBelow table.size rule.rhs = true := by
+  apply h rule.rhs
+  simp only [Recursor.exprs, List.mem_cons]
+  right
+  rw [List.mem_map]
+  rcases Array.getElem?_eq_some_iff.mp hget with ⟨hi, heq⟩
+  exact ⟨rule, Array.mem_def.mp (Array.mem_iff_getElem.mpr ⟨i, hi, heq⟩), rfl⟩
+
+@[simp] theorem Definition.mapExprs_value (f : Expr → Expr)
+    (d : Definition) : (d.mapExprs f).value = f d.value := by rfl
+
+@[simp] theorem Definition.mapExprs_lvls (f : Expr → Expr)
+    (d : Definition) : (d.mapExprs f).lvls = d.lvls := by rfl
+
+@[simp] theorem Definition.mapExprs_kind (f : Expr → Expr)
+    (d : Definition) : (d.mapExprs f).kind = d.kind := by rfl
+
+@[simp] theorem Definition.mapExprs_safety (f : Expr → Expr)
+    (d : Definition) : (d.mapExprs f).safety = d.safety := by rfl
+
+@[simp] theorem unfoldable_mapExprs (f : Expr → Expr) (d : Definition) :
+    unfoldable (d.mapExprs f) = unfoldable d := by
+  simp [unfoldable]
+
+@[simp] theorem Recursor.mapExprs_lvls (f : Expr → Expr) (r : Recursor) :
+    (r.mapExprs f).lvls = r.lvls := by rfl
+
+@[simp] theorem Recursor.mapExprs_params (f : Expr → Expr) (r : Recursor) :
+    (r.mapExprs f).params = r.params := by rfl
+
+@[simp] theorem Recursor.mapExprs_motives (f : Expr → Expr) (r : Recursor) :
+    (r.mapExprs f).motives = r.motives := by rfl
+
+@[simp] theorem Recursor.mapExprs_minors (f : Expr → Expr) (r : Recursor) :
+    (r.mapExprs f).minors = r.minors := by rfl
+
+@[simp] theorem Recursor.mapExprs_indices (f : Expr → Expr) (r : Recursor) :
+    (r.mapExprs f).indices = r.indices := by rfl
+
+@[simp] theorem Recursor.mapExprs_rules (f : Expr → Expr) (r : Recursor) :
+    (r.mapExprs f).rules = r.rules.map (RecursorRule.mapExprs f) := by rfl
+
+@[simp] theorem RecursorRule.mapExprs_fields (f : Expr → Expr)
+    (r : RecursorRule) : (r.mapExprs f).fields = r.fields := by rfl
+
+@[simp] theorem RecursorRule.mapExprs_rhs (f : Expr → Expr)
+    (r : RecursorRule) : (r.mapExprs f).rhs = f r.rhs := by rfl
+
+@[simp] theorem Inductive.mapExprs_lvls (f : Expr → Expr)
+    (ind : Inductive) : (ind.mapExprs f).lvls = ind.lvls := by rfl
+
+@[simp] theorem Inductive.mapExprs_params (f : Expr → Expr)
+    (ind : Inductive) : (ind.mapExprs f).params = ind.params := by rfl
+
+@[simp] theorem inlineExpr_sort (table : Array Expr) (i : UInt64) :
+    Sharing.inlineExpr table (.sort i) = .sort i := by rfl
+
+@[simp] theorem inlineExpr_var (table : Array Expr) (i : UInt64) :
+    Sharing.inlineExpr table (.var i) = .var i := by rfl
+
+@[simp] theorem inlineExpr_ref (table : Array Expr) (i : UInt64)
+    (us : Array UInt64) :
+    Sharing.inlineExpr table (.ref i us) = .ref i us := by rfl
+
+@[simp] theorem inlineExpr_recur (table : Array Expr) (i : UInt64)
+    (us : Array UInt64) :
+    Sharing.inlineExpr table (.recur i us) = .recur i us := by rfl
+
+@[simp] theorem inlineExpr_prj (table : Array Expr) (r f : UInt64)
+    (v : Expr) :
+    Sharing.inlineExpr table (.prj r f v) =
+      .prj r f (Sharing.inlineExpr table v) := by rfl
+
+@[simp] theorem inlineExpr_str (table : Array Expr) (i : UInt64) :
+    Sharing.inlineExpr table (.str i) = .str i := by rfl
+
+@[simp] theorem inlineExpr_nat (table : Array Expr) (i : UInt64) :
+    Sharing.inlineExpr table (.nat i) = .nat i := by rfl
+
+@[simp] theorem inlineExpr_app (table : Array Expr) (f a : Expr) :
+    Sharing.inlineExpr table (.app f a) =
+      .app (Sharing.inlineExpr table f) (Sharing.inlineExpr table a) := by rfl
+
+@[simp] theorem inlineExpr_lam (table : Array Expr) (uses : Uses)
+    (dom body : Expr) :
+    Sharing.inlineExpr table (.lam uses dom body) =
+      .lam uses (Sharing.inlineExpr table dom)
+        (Sharing.inlineExpr table body) := by rfl
+
+@[simp] theorem inlineExpr_all (table : Array Expr) (uses : Uses)
+    (owned : Owned) (dom cod : Expr) :
+    Sharing.inlineExpr table (.all uses owned dom cod) =
+      .all uses owned (Sharing.inlineExpr table dom)
+        (Sharing.inlineExpr table cod) := by rfl
+
+@[simp] theorem inlineExpr_letE (table : Array Expr) (nonDep : Bool)
+    (typ value body : Expr) :
+    Sharing.inlineExpr table (.letE nonDep typ value body) =
+      .letE nonDep (Sharing.inlineExpr table typ)
+        (Sharing.inlineExpr table value)
+        (Sharing.inlineExpr table body) := by rfl
+
+theorem sharesBelow_mono {lower upper : Nat} (hle : lower ≤ upper)
+    (e : Expr) (h : Sharing.sharesBelow lower e = true) :
+    Sharing.sharesBelow upper e = true := by
+  induction e with
+  | sort | var | ref | recur | str | nat => rfl
+  | share i =>
+    simp only [Sharing.sharesBelow, decide_eq_true_eq] at h ⊢
+    omega
+  | prj r f value ih =>
+    simp only [Sharing.sharesBelow] at h ⊢
+    exact ih h
+  | app fn arg ihFn ihArg =>
+    simp only [Sharing.sharesBelow, Bool.and_eq_true] at h ⊢
+    exact ⟨ihFn h.1, ihArg h.2⟩
+  | lam uses dom body ihDom ihBody =>
+    simp only [Sharing.sharesBelow, Bool.and_eq_true] at h ⊢
+    exact ⟨ihDom h.1, ihBody h.2⟩
+  | all uses owned dom cod ihDom ihCod =>
+    simp only [Sharing.sharesBelow, Bool.and_eq_true] at h ⊢
+    exact ⟨ihDom h.1, ihCod h.2⟩
+  | letE nonDep typ value body ihTyp ihValue ihBody =>
+    simp only [Sharing.sharesBelow, Bool.and_eq_true] at h ⊢
+    exact ⟨⟨ihTyp h.1.1, ihValue h.1.2⟩, ihBody h.2⟩
+
+theorem entriesWF_getElem?_sharesBelow (next : Nat) (entries : List Expr)
+    (i : Nat) (entry : Expr)
+    (hwf : Sharing.entriesWF next entries = true)
+    (hget : entries[i]? = some entry) :
+    Sharing.sharesBelow (next + i) entry = true := by
+  induction entries generalizing next i with
+  | nil => simp at hget
+  | cons head tail ih =>
+    simp only [Sharing.entriesWF, Bool.and_eq_true] at hwf
+    cases i with
+    | zero =>
+      simp only [List.getElem?_cons_zero] at hget
+      cases hget
+      simpa using Sharing.sharesBelow_of_entryWF hwf.1
+    | succ i =>
+      rw [List.getElem?_cons_succ] at hget
+      have hbelow := ih (next + 1) i hwf.2 hget
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using hbelow
+
+theorem tableWF_getElem?_sharesBelow (table : Array Expr) (i : Nat)
+    (entry : Expr) (hwf : Sharing.tableWF table = true)
+    (hget : table[i]? = some entry) :
+    Sharing.sharesBelow table.size entry = true := by
+  have hlist : table.toList[i]? = some entry := by simpa using hget
+  have hbelow := entriesWF_getElem?_sharesBelow 0 table.toList i entry hwf hlist
+  have hi : i < table.size := (Array.getElem?_eq_some_iff.mp hget).choose
+  exact sharesBelow_mono (Nat.le_of_lt hi) entry (by simpa using hbelow)
+
+private def CoherentAt (fuel : Nat) : Prop :=
+  (∀ ctx F env e v, ctx.SharingWF → F.SharingWF →
+    ValuesSharingWF env → Sharing.sharesBelow F.sharing.size e = true →
+    eval ctx fuel F env e = .ok v →
+    eval ctx.inlineSharing fuel F.inlineSharing
+        (valuesInlineSharing env) (Sharing.inlineExpr F.sharing e) =
+          .ok v.inlineSharing ∧ v.SharingWF) ∧
+  (∀ ctx address uinst v, ctx.SharingWF →
+    evalRef ctx fuel address uinst = .ok v →
+    evalRef ctx.inlineSharing fuel address uinst = .ok v.inlineSharing ∧
+      v.SharingWF) ∧
+  (∀ ctx f a v, ctx.SharingWF → f.SharingWF → a.SharingWF →
+    apply ctx fuel f a = .ok v →
+    apply ctx.inlineSharing fuel f.inlineSharing a.inlineSharing =
+      .ok v.inlineSharing ∧ v.SharingWF) ∧
+  (∀ ctx f args v, ctx.SharingWF → f.SharingWF →
+    ValuesSharingWF args → applyMany ctx fuel f args = .ok v →
+    applyMany ctx.inlineSharing fuel f.inlineSharing
+        (valuesInlineSharing args) = .ok v.inlineSharing ∧ v.SharingWF) ∧
+  (∀ ctx h args v, ctx.SharingWF → h.SharingWF →
+    ValuesSharingWF args → saturate ctx fuel h args = .ok v →
+    saturate ctx.inlineSharing fuel h.inlineSharing
+        (valuesInlineSharing args) = .ok v.inlineSharing ∧ v.SharingWF) ∧
+  (∀ ctx h args v, ctx.SharingWF → h.SharingWF →
+    ValuesSharingWF args → fire ctx fuel h args = .ok v →
+    fire ctx.inlineSharing fuel h.inlineSharing
+        (valuesInlineSharing args) = .ok v.inlineSharing ∧ v.SharingWF)
+
+private theorem bindOkSharing {α β : Type} (a : α)
+    (f : α → Except Err β) : (Except.ok a >>= f) = f a := rfl
+
+private theorem bindErrSharing {α β : Type} (err : Err)
+    (f : α → Except Err β) :
+    ((Except.error err : Except Err α) >>= f) = .error err := rfl
+
+private theorem applyStringChars_inlineSharing_of
+    {apply₁ apply₂ : Value → Value → Except Err Value}
+    (happly : ∀ f a v, f.SharingWF → a.SharingWF →
+      apply₁ f a = .ok v →
+        apply₂ f.inlineSharing a.inlineSharing = .ok v.inlineSharing ∧
+          v.SharingWF)
+    {charOfNat cons list result : Value} (chars : List Char)
+    (hcharOfNat : charOfNat.SharingWF) (hcons : cons.SharingWF)
+    (hlist : list.SharingWF)
+    (h : applyStringChars apply₁ charOfNat cons chars list = .ok result) :
+    applyStringChars apply₂ charOfNat.inlineSharing cons.inlineSharing chars
+        list.inlineSharing = .ok result.inlineSharing ∧ result.SharingWF := by
+  induction chars generalizing list with
+  | nil =>
+      simp only [applyStringChars] at h ⊢
+      cases h
+      exact ⟨rfl, hlist⟩
+  | cons char chars ih =>
+      simp only [applyStringChars] at h ⊢
+      cases hchar : apply₁ charOfNat (.litV (.natL char.toNat)) with
+      | error err => rw [hchar, bindErrSharing] at h; contradiction
+      | ok charValue =>
+        rw [hchar, bindOkSharing] at h
+        obtain ⟨hchar', hcharWF⟩ := happly charOfNat
+          (.litV (.natL char.toNat)) charValue hcharOfNat
+          (Value.SharingWF.litV (.natL char.toNat)) hchar
+        have hchar'' : apply₂ charOfNat.inlineSharing
+            (.litV (.natL char.toNat)) = .ok charValue.inlineSharing := by
+          simpa [Value.inlineSharing] using hchar'
+        rw [hchar'', bindOkSharing]
+        cases hpartial : apply₁ cons charValue with
+        | error err => rw [hpartial, bindErrSharing] at h; contradiction
+        | ok partialCons =>
+          rw [hpartial, bindOkSharing] at h
+          obtain ⟨hpartial', hpartialWF⟩ := happly cons charValue partialCons
+            hcons hcharWF hpartial
+          rw [hpartial', bindOkSharing]
+          cases hnext : apply₁ partialCons list with
+          | error err => rw [hnext, bindErrSharing] at h; contradiction
+          | ok nextList =>
+            rw [hnext, bindOkSharing] at h
+            obtain ⟨hnext', hnextWF⟩ := happly partialCons list nextList
+              hpartialWF hlist hnext
+            rw [hnext', bindOkSharing]
+            exact ih hnextWF h
+
+private theorem prepareStringMajor_inlineSharing_of
+    {evalReference₁ evalReference₂ : Address → List Nat → Except Err Value}
+    {apply₁ apply₂ : Value → Value → Except Err Value}
+    (href : ∀ address uinst value,
+      evalReference₁ address uinst = .ok value →
+        evalReference₂ address uinst = .ok value.inlineSharing ∧
+          value.SharingWF)
+    (happly : ∀ f a value, f.SharingWF → a.SharingWF →
+      apply₁ f a = .ok value →
+        apply₂ f.inlineSharing a.inlineSharing = .ok value.inlineSharing ∧
+          value.SharingWF)
+    (config : Option StringLiteralConfig) {rawMajor result : Value}
+    (hrawMajor : rawMajor.SharingWF)
+    (h : prepareStringMajor evalReference₁ apply₁ config rawMajor =
+      .ok result) :
+    prepareStringMajor evalReference₂ apply₂ config rawMajor.inlineSharing =
+        .ok result.inlineSharing ∧ result.SharingWF := by
+  cases rawMajor with
+  | litV literal =>
+      cases literal with
+      | natL n =>
+        simp only [prepareStringMajor, Value.inlineSharing] at h ⊢
+        cases h
+        exact ⟨by simp [Value.inlineSharing], hrawMajor⟩
+      | strL string =>
+        cases config with
+        | none =>
+          simp only [prepareStringMajor, Value.inlineSharing] at h ⊢
+          cases h
+          exact ⟨by simp [Value.inlineSharing], hrawMajor⟩
+        | some config =>
+          simp only [prepareStringMajor, Value.inlineSharing] at h ⊢
+          cases hcharType : evalReference₁ config.charType [] with
+          | error err => rw [hcharType, bindErrSharing] at h; contradiction
+          | ok charType =>
+            rw [hcharType, bindOkSharing] at h
+            obtain ⟨hcharType', hcharTypeWF⟩ := href _ _ _ hcharType
+            rw [hcharType', bindOkSharing]
+            cases hcharOfNat : evalReference₁ config.charOfNat [] with
+            | error err => rw [hcharOfNat, bindErrSharing] at h; contradiction
+            | ok charOfNat =>
+              rw [hcharOfNat, bindOkSharing] at h
+              obtain ⟨hcharOfNat', hcharOfNatWF⟩ := href _ _ _ hcharOfNat
+              rw [hcharOfNat', bindOkSharing]
+              cases hstringOfList :
+                  evalReference₁ config.stringOfList [] with
+              | error err =>
+                rw [hstringOfList, bindErrSharing] at h
+                contradiction
+              | ok stringOfList =>
+                rw [hstringOfList, bindOkSharing] at h
+                obtain ⟨hstringOfList', hstringOfListWF⟩ :=
+                  href _ _ _ hstringOfList
+                rw [hstringOfList', bindOkSharing]
+                cases hlistNil : evalReference₁ config.listNil [0] with
+                | error err => rw [hlistNil, bindErrSharing] at h; contradiction
+                | ok listNil =>
+                  rw [hlistNil, bindOkSharing] at h
+                  obtain ⟨hlistNil', hlistNilWF⟩ := href _ _ _ hlistNil
+                  rw [hlistNil', bindOkSharing]
+                  cases hnil : apply₁ listNil charType with
+                  | error err => rw [hnil, bindErrSharing] at h; contradiction
+                  | ok nil =>
+                    rw [hnil, bindOkSharing] at h
+                    obtain ⟨hnil', hnilWF⟩ := happly listNil charType nil
+                      hlistNilWF hcharTypeWF hnil
+                    rw [hnil', bindOkSharing]
+                    cases hlistCons : evalReference₁ config.listCons [0] with
+                    | error err =>
+                      rw [hlistCons, bindErrSharing] at h
+                      contradiction
+                    | ok listCons =>
+                      rw [hlistCons, bindOkSharing] at h
+                      obtain ⟨hlistCons', hlistConsWF⟩ :=
+                        href _ _ _ hlistCons
+                      rw [hlistCons', bindOkSharing]
+                      cases hcons : apply₁ listCons charType with
+                      | error err => rw [hcons, bindErrSharing] at h; contradiction
+                      | ok cons =>
+                        rw [hcons, bindOkSharing] at h
+                        obtain ⟨hcons', hconsWF⟩ := happly listCons charType cons
+                          hlistConsWF hcharTypeWF hcons
+                        rw [hcons', bindOkSharing]
+                        cases hlist : applyStringChars apply₁ charOfNat cons
+                            string.toList.reverse nil with
+                        | error err =>
+                          rw [hlist, bindErrSharing] at h
+                          contradiction
+                        | ok list =>
+                          rw [hlist, bindOkSharing] at h
+                          obtain ⟨hlist', hlistWF⟩ :=
+                            applyStringChars_inlineSharing_of happly
+                              string.toList.reverse hcharOfNatWF hconsWF hnilWF
+                              hlist
+                          rw [hlist', bindOkSharing]
+                          exact happly stringOfList list result
+                            hstringOfListWF hlistWF h
+  | sortV | piV | closV | papV | quotV | ctorV =>
+      simp only [prepareStringMajor, Value.inlineSharing] at h ⊢
+      cases h
+      exact ⟨by simp [Value.inlineSharing], hrawMajor⟩
+
+private theorem coherentAt : ∀ fuel, CoherentAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx F env e v hctx hF henv he hev
+      rw [eval.eq_def] at hev
+      simp at hev
+    · intro ctx address uinst v hctx hev
+      rw [evalRef.eq_def] at hev
+      simp at hev
+    · intro ctx f a v hctx hf ha hev
+      rw [apply.eq_def] at hev
+      simp at hev
+    · intro ctx f args v hctx hf hargs hev
+      rw [applyMany.eq_def] at hev
+      simp at hev
+    · intro ctx h args v hctx hh hargs hev
+      rw [saturate.eq_def] at hev
+      simp at hev
+    · intro ctx h args v hctx hh hargs hev
+      rw [fire.eq_def] at hev
+      simp at hev
+  | succ n ih =>
+    obtain ⟨ihE, ihR, ihA, ihM, ihS, ihF⟩ := ih
+    refine ⟨?_, ?_, ?_, ?_, ?_, ?_⟩
+    · intro ctx F env e v hctx hF henv he hev
+      cases e with
+      | var i =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_var]
+        dsimp only at hev ⊢
+        cases hget : env[i.toNat]? with
+        | none => rw [hget] at hev; contradiction
+        | some value =>
+          rw [hget] at hev
+          cases hev
+          rw [valuesInlineSharing_getElem?, hget]
+          exact ⟨rfl, henv.getElem?_eq hget⟩
+      | sort i =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_sort]
+        dsimp only [Frame.inlineSharing, Value.inlineSharing] at hev ⊢
+        cases hget : F.univs[i.toNat]? with
+        | none => rw [hget] at hev; contradiction
+        | some u =>
+          rw [hget] at hev
+          simp only at hev ⊢
+          cases hev
+          exact ⟨by simp [Value.inlineSharing], .sortV _⟩
+      | str i =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_str]
+        dsimp only [Frame.inlineSharing, EvalCtx.inlineSharing,
+          Value.inlineSharing] at hev ⊢
+        cases href : F.refs[i.toNat]? with
+        | none => rw [href] at hev; contradiction
+        | some address =>
+          rw [href] at hev
+          simp only at hev ⊢
+          cases hblob : ctx.blobs address with
+          | none => rw [hblob] at hev; contradiction
+          | some blob =>
+            cases blob with
+            | natB n => rw [hblob] at hev; contradiction
+            | strB s =>
+              rw [hblob] at hev
+              simp only at hev ⊢
+              cases hev
+              exact ⟨by simp [Value.inlineSharing], .litV _⟩
+      | nat i =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_nat]
+        dsimp only [Frame.inlineSharing, EvalCtx.inlineSharing,
+          Value.inlineSharing] at hev ⊢
+        cases href : F.refs[i.toNat]? with
+        | none => rw [href] at hev; contradiction
+        | some address =>
+          rw [href] at hev
+          simp only at hev ⊢
+          cases hblob : ctx.blobs address with
+          | none => rw [hblob] at hev; contradiction
+          | some blob =>
+            cases blob with
+            | strB s => rw [hblob] at hev; contradiction
+            | natB n =>
+              rw [hblob] at hev
+              simp only at hev ⊢
+              cases hev
+              exact ⟨by simp [Value.inlineSharing], .litV _⟩
+      | lam uses dom body =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_lam]
+        dsimp only [Value.inlineSharing] at hev ⊢
+        cases hev
+        simp only [Sharing.sharesBelow, Bool.and_eq_true] at he
+        exact ⟨by simp [Value.inlineSharing],
+          .closV uses F env dom body hF henv he.1 he.2⟩
+      | all uses owned dom cod =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_all]
+        dsimp only [Value.inlineSharing] at hev ⊢
+        cases hev
+        simp only [Sharing.sharesBelow, Bool.and_eq_true] at he
+        exact ⟨by simp [Value.inlineSharing],
+          .piV uses owned F env dom cod hF henv he.1 he.2⟩
+      | letE nonDep typ val body =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_letE]
+        dsimp only at hev ⊢
+        simp only [Sharing.sharesBelow, Bool.and_eq_true] at he
+        cases hval : eval ctx n F env val with
+        | error err => rw [hval] at hev; contradiction
+        | ok value =>
+          rw [hval] at hev
+          obtain ⟨hval', hvalueWF⟩ :=
+            ihE ctx F env val value hctx hF henv he.1.2 hval
+          rw [hval']
+          have hbody := ihE ctx F (value :: env) body v hctx hF
+            (.cons value env hvalueWF henv) he.2 hev
+          change eval ctx.inlineSharing n F.inlineSharing
+            (value.inlineSharing :: valuesInlineSharing env)
+              (Sharing.inlineExpr F.sharing body) =
+                .ok v.inlineSharing ∧ v.SharingWF
+          simpa [valuesInlineSharing] using hbody
+      | app fn arg =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_app]
+        dsimp only at hev ⊢
+        simp only [Sharing.sharesBelow, Bool.and_eq_true] at he
+        cases hfn : eval ctx n F env fn with
+        | error err => rw [hfn] at hev; contradiction
+        | ok fnValue =>
+          rw [hfn] at hev
+          obtain ⟨hfn', hfnWF⟩ :=
+            ihE ctx F env fn fnValue hctx hF henv he.1 hfn
+          rw [hfn']
+          cases harg : eval ctx n F env arg with
+          | error err => rw [harg] at hev; contradiction
+          | ok argValue =>
+            rw [harg] at hev
+            obtain ⟨harg', hargWF⟩ :=
+              ihE ctx F env arg argValue hctx hF henv he.2 harg
+            rw [harg']
+            change apply ctx.inlineSharing n fnValue.inlineSharing
+              argValue.inlineSharing = .ok v.inlineSharing ∧ v.SharingWF
+            exact ihA ctx fnValue argValue v hctx hfnWF hargWF hev
+      | prj typeIdx fieldIdx val =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_prj]
+        dsimp only at hev ⊢
+        cases hval : eval ctx n F env val with
+        | error err => rw [hval] at hev; contradiction
+        | ok value =>
+          rw [hval, bindOkSharing] at hev
+          obtain ⟨hval', hvalueWF⟩ :=
+            ihE ctx F env val value hctx hF henv he hval
+          rw [hval', bindOkSharing]
+          exact projectValue_inlineSharing hctx hvalueWF hev
+      | share i =>
+        rw [eval.eq_def] at hev
+        dsimp only at hev
+        cases hget : F.sharing[i.toNat]? with
+        | none => rw [hget] at hev; contradiction
+        | some entry =>
+          rw [hget] at hev
+          obtain ⟨htarget, hvWF⟩ := ihE ctx F env entry v hctx hF henv
+            (tableWF_getElem?_sharesBelow F.sharing i.toNat entry
+              hF.tableOk hget) hev
+          constructor
+          · rw [Sharing.inlineExpr_share_eq_inlineExpr_entry F.sharing i
+              entry hF.tableOk hget]
+            exact eval_mono (Nat.le_succ n) htarget
+          · exact hvWF
+      | ref refIdx univIdxs =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_ref]
+        simp only [Frame.inlineSharing_refs]
+        dsimp only at hev ⊢
+        cases href : F.refs[refIdx.toNat]? with
+        | none => rw [href] at hev; contradiction
+        | some address =>
+          rw [href] at hev
+          simp only at hev ⊢
+          cases huinst : evalUnivArgs F univIdxs with
+          | error err => rw [huinst] at hev; contradiction
+          | ok uinst =>
+            rw [huinst] at hev
+            obtain ⟨htarget, hvWF⟩ := ihR ctx address uinst v hctx hev
+            rw [evalUnivArgs_inlineSharing, huinst]
+            exact ⟨htarget, hvWF⟩
+      | recur recIdx univIdxs =>
+        rw [eval.eq_def] at hev ⊢
+        simp only [inlineExpr_recur]
+        dsimp only at hev ⊢
+        cases huinst : evalUnivArgs F univIdxs with
+        | error err => rw [huinst] at hev; contradiction
+        | ok uinst =>
+          rw [huinst] at hev
+          rw [evalUnivArgs_inlineSharing, huinst]
+          rw [bindOkSharing] at hev ⊢
+          cases hmember : F.selfMuts[recIdx.toNat]? with
+          | none => rw [hmember] at hev; contradiction
+          | some member =>
+            rw [hmember] at hev
+            have hmember' := Frame.inlineSharing_selfMuts_getElem?
+              (F := F) hmember
+            have hroots := hF.selfMutsOk recIdx.toNat member hmember
+            cases member with
+            | defn d =>
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst] at hmember'
+              rw [hmember']
+              simp only
+              change (guardLvls d.lvls uinst >>= fun _ =>
+                if unfoldable d then
+                  eval ctx n { F with uinst := uinst } [] d.value
+                else
+                  match F.selfAddr with
+                  | none => neutralMember F.selfAddr recIdx.toNat
+                  | some block =>
+                    match ctx.externArity
+                        (Address.memberAddr block recIdx.toNat) with
+                    | none => neutralMember F.selfAddr recIdx.toNat
+                    | some arity => saturate ctx n
+                        (.extH (Address.memberAddr block recIdx.toNat) arity)
+                        []) =
+                  .ok v at hev
+              cases hguard : guardLvls d.lvls uinst with
+              | error err =>
+                rw [hguard, bindErrSharing] at hev
+                contradiction
+              | ok checked =>
+                rw [hguard, bindOkSharing] at hev
+                have hguard' : guardLvls
+                    (ConstantIdentityLaws.mapDefinition
+                      (Sharing.inlineExpr F.sharing) d).lvls uinst =
+                    .ok checked := by
+                  simpa [ConstantIdentityLaws.mapDefinition] using hguard
+                rw [hguard', bindOkSharing]
+                cases hunfold : unfoldable d with
+                | false =>
+                  rw [hunfold] at hev
+                  simp only [Bool.false_eq_true, if_false] at hev
+                  have hunfold' : unfoldable
+                      (ConstantIdentityLaws.mapDefinition
+                        (Sharing.inlineExpr F.sharing) d) = false := by
+                    simpa [ConstantIdentityLaws.mapDefinition,
+                      unfoldable] using hunfold
+                  rw [hunfold']
+                  simp only [Bool.false_eq_true, if_false]
+                  cases hself : F.selfAddr with
+                  | none =>
+                    rw [hself] at hev
+                    simp [neutralMember] at hev
+                  | some block =>
+                    rw [hself] at hev
+                    dsimp only at hev
+                    simp only [Frame.inlineSharing_selfAddr, hself]
+                    cases hext : ctx.externArity
+                        (Address.memberAddr block recIdx.toNat) with
+                    | none =>
+                      rw [hext] at hev
+                      simp only [EvalCtx.inlineSharing_externArity, hext]
+                      simp only [neutralMember] at hev ⊢
+                      cases hev
+                      exact ⟨by simp [Value.inlineSharing,
+                          Head.inlineSharing, valuesInlineSharing],
+                        .papV _ _ (.neuH _) .nil⟩
+                    | some arity =>
+                      rw [hext] at hev
+                      simp only [EvalCtx.inlineSharing_externArity, hext]
+                      simpa [Head.inlineSharing, valuesInlineSharing] using
+                        ihS ctx (.extH
+                          (Address.memberAddr block recIdx.toNat) arity)
+                          [] v hctx (.extH _ _) .nil hev
+                | true =>
+                  rw [hunfold] at hev
+                  have hunfold' : unfoldable
+                      (ConstantIdentityLaws.mapDefinition
+                        (Sharing.inlineExpr F.sharing) d) = true := by
+                    simpa [ConstantIdentityLaws.mapDefinition,
+                      unfoldable] using hunfold
+                  rw [hunfold']
+                  have hbody := ihE ctx { F with uinst := uinst } []
+                    d.value v hctx (hF.with_uinst uinst) .nil
+                    (rootsBelow_definition_value hroots) hev
+                  simpa [ConstantIdentityLaws.mapDefinition,
+                    Frame.inlineSharing_set_uinst,
+                    valuesInlineSharing] using hbody
+            | recr r =>
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst] at hmember'
+              rw [hmember']
+              simp only
+              change (guardLvls r.lvls uinst >>= fun _ =>
+                .ok (.papV
+                  (.recH F.selfAddr r { F with uinst := uinst }) [])) =
+                    .ok v at hev
+              cases hguard : guardLvls r.lvls uinst with
+              | error err =>
+                rw [hguard, bindErrSharing] at hev
+                contradiction
+              | ok checked =>
+                rw [hguard, bindOkSharing] at hev
+                have hguard' : guardLvls
+                    (ConstantIdentityLaws.mapRecursor
+                      (Sharing.inlineExpr F.sharing) r).lvls uinst =
+                    .ok checked := by
+                  simpa [ConstantIdentityLaws.mapRecursor] using hguard
+                rw [hguard', bindOkSharing]
+                cases hev
+                exact ⟨by simp [Recursor.mapExprs,
+                    ConstantIdentityLaws.mapRecursor,
+                    Value.inlineSharing, Head.inlineSharing,
+                    Frame.inlineSharing_set_uinst, valuesInlineSharing],
+                  .papV _ _
+                    (.recH F.selfAddr r { F with uinst := uinst }
+                      (hF.with_uinst uinst)
+                      (by simpa [MutConst.exprs] using hroots))
+                    .nil⟩
+            | indc ind =>
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst] at hmember'
+              rw [hmember']
+              simp only
+              change (guardLvls ind.lvls uinst >>= fun _ =>
+                neutralMember F.selfAddr recIdx.toNat) =
+                  .ok v at hev
+              cases hguard : guardLvls ind.lvls uinst with
+              | error err =>
+                rw [hguard, bindErrSharing] at hev
+                contradiction
+              | ok checked =>
+                rw [hguard, bindOkSharing] at hev
+                have hguard' : guardLvls
+                    (ConstantIdentityLaws.mapInductive
+                      (Sharing.inlineExpr F.sharing) ind).lvls uinst =
+                    .ok checked := by
+                  simpa [ConstantIdentityLaws.mapInductive] using hguard
+                rw [hguard', bindOkSharing]
+                cases hself : F.selfAddr with
+                | none =>
+                  rw [hself] at hev
+                  simp [neutralMember] at hev
+                | some block =>
+                  rw [hself] at hev
+                  simp only [Frame.inlineSharing_selfAddr, hself,
+                    neutralMember] at hev ⊢
+                  cases hev
+                  exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                      valuesInlineSharing],
+                    .papV _ _ (.neuH _) .nil⟩
+    · intro ctx address uinst v hctx hev
+      rw [evalRef.eq_def] at hev ⊢
+      dsimp only at hev ⊢
+      cases hresolve : ctx.resolve address with
+      | none => rw [hresolve] at hev; contradiction
+      | some c =>
+        rw [hresolve] at hev
+        dsimp only at hev
+        simp only [EvalCtx.inlineSharing_resolve, hresolve, Option.map_some]
+        have hcWF := hctx.resolveOk address c hresolve
+        cases hinfo : c.info with
+        | defn d =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (guardLvls d.lvls uinst >>= fun _ =>
+            if unfoldable d then
+              eval ctx n (Frame.ofConst c uinst) [] d.value
+            else
+              match ctx.externArity address with
+              | none => .ok (.papV (.neuH (.const address)) [])
+              | some arity => saturate ctx n (.extH address arity) []) =
+                .ok v at hev
+          cases hguard : guardLvls d.lvls uinst with
+          | error err =>
+            rw [hguard, bindErrSharing] at hev
+            contradiction
+          | ok checked =>
+            rw [hguard, bindOkSharing] at hev
+            have hguard' : guardLvls
+                (ConstantIdentityLaws.mapDefinition
+                  (Sharing.inlineExpr c.sharing) d).lvls uinst =
+                .ok checked := by
+              simpa [ConstantIdentityLaws.mapDefinition] using hguard
+            rw [hguard', bindOkSharing]
+            cases hunfold : unfoldable d with
+            | false =>
+              rw [hunfold] at hev
+              have hunfold' : unfoldable
+                  (ConstantIdentityLaws.mapDefinition
+                    (Sharing.inlineExpr c.sharing) d) = false := by
+                simpa [ConstantIdentityLaws.mapDefinition,
+                  unfoldable] using hunfold
+              rw [hunfold']
+              cases hext : ctx.externArity address with
+              | none =>
+                rw [hext] at hev
+                simp only [EvalCtx.inlineSharing_externArity, hext]
+                cases hev
+                exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                    valuesInlineSharing],
+                  .papV _ _ (.neuH _) .nil⟩
+              | some arity =>
+                rw [hext] at hev
+                simp only [EvalCtx.inlineSharing_externArity, hext]
+                simpa [Head.inlineSharing, valuesInlineSharing] using
+                  ihS ctx (.extH address arity) [] v hctx
+                    (.extH address arity) .nil hev
+            | true =>
+              rw [hunfold] at hev
+              have hunfold' : unfoldable
+                  (ConstantIdentityLaws.mapDefinition
+                    (Sharing.inlineExpr c.sharing) d) = true := by
+                simpa [ConstantIdentityLaws.mapDefinition,
+                  unfoldable] using hunfold
+              rw [hunfold']
+              have hroots := constantRootsBelow_of_sharingWF c hcWF
+              have hvalue : Sharing.sharesBelow c.sharing.size d.value = true := by
+                apply hroots d.value
+                rw [hinfo]
+                simp [ConstantInfo.exprs, Definition.exprs]
+              have hbody := ihE ctx (Frame.ofConst c uinst) [] d.value v
+                hctx (Frame.sharingWF_ofConst c uinst none hcWF) .nil
+                hvalue hev
+              simpa [Frame.inlineSharing_ofConst, Frame.inlineSharing,
+                Frame.ofConst, EvalCtx.inlineSharing,
+                Constant.inlineSharing, ConstantInfo.mapExprs,
+                ConstantIdentityLaws.mapInfo, hinfo,
+                ConstantIdentityLaws.mapDefinition,
+                MutConst.mapExprs, ConstantIdentityLaws.mapMutConst,
+                selfMutsOf,
+                valuesInlineSharing] using hbody
+        | recr r =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (guardLvls r.lvls uinst >>= fun _ =>
+            .ok (.papV (.recH (some address) r
+              (Frame.ofConst c uinst (some address))) [])) = .ok v at hev
+          cases hguard : guardLvls r.lvls uinst with
+          | error err =>
+            rw [hguard, bindErrSharing] at hev
+            contradiction
+          | ok checked =>
+            rw [hguard, bindOkSharing] at hev
+            have hguard' : guardLvls
+                (ConstantIdentityLaws.mapRecursor
+                  (Sharing.inlineExpr c.sharing) r).lvls uinst =
+                .ok checked := by
+              simpa [ConstantIdentityLaws.mapRecursor] using hguard
+            rw [hguard', bindOkSharing]
+            cases hev
+            have hrootsAll := constantRootsBelow_of_sharingWF c hcWF
+            have hroots : rootsBelow c.sharing r.exprs := by
+              intro e he
+              apply hrootsAll e
+              rw [hinfo]
+              simpa [ConstantInfo.exprs] using he
+            exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                Frame.inlineSharing, Frame.ofConst, hinfo,
+                Recursor.mapExprs, MutConst.mapExprs,
+                ConstantIdentityLaws.mapRecursor,
+                ConstantIdentityLaws.mapMutConst, selfMutsOf,
+                valuesInlineSharing],
+              .papV _ _
+                (.recH (some address) r
+                  (Frame.ofConst c uinst (some address))
+                  (Frame.sharingWF_ofConst c uinst (some address) hcWF)
+                  hroots)
+                .nil⟩
+        | axio ax =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (guardLvls ax.lvls uinst >>= fun _ =>
+            match ctx.externArity address with
+            | none => .ok (.papV (.neuH (.const address)) [])
+            | some arity => saturate ctx n (.extH address arity) []) =
+              .ok v at hev
+          cases hguard : guardLvls ax.lvls uinst with
+          | error err =>
+            rw [hguard, bindErrSharing] at hev
+            contradiction
+          | ok checked =>
+            rw [hguard, bindOkSharing] at hev
+            have hguard' : guardLvls
+                (ConstantIdentityLaws.mapAxiom
+                  (Sharing.inlineExpr c.sharing) ax).lvls uinst =
+                .ok checked := by
+              simpa [ConstantIdentityLaws.mapAxiom] using hguard
+            rw [hguard', bindOkSharing]
+            cases hext : ctx.externArity address with
+            | none =>
+              rw [hext] at hev
+              simp only [EvalCtx.inlineSharing_externArity, hext]
+              cases hev
+              exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                  valuesInlineSharing],
+                .papV _ _ (.neuH _) .nil⟩
+            | some arity =>
+              rw [hext] at hev
+              simp only [EvalCtx.inlineSharing_externArity, hext]
+              simpa [Head.inlineSharing, valuesInlineSharing] using
+                ihS ctx (.extH address arity) [] v hctx
+                  (.extH address arity) .nil hev
+        | quot q =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (guardLvls q.lvls uinst >>= fun _ =>
+            match ctx.quotientKind address with
+            | none => .ok (.papV (.neuH (.const address)) [])
+            | some kind =>
+              if kind == q.kind then .ok (.papV (.quotH address kind) [])
+              else .error (.stuck
+                "configured quotient kind mismatch")) = .ok v at hev
+          cases hguard : guardLvls q.lvls uinst with
+          | error err =>
+            rw [hguard, bindErrSharing] at hev
+            contradiction
+          | ok checked =>
+            rw [hguard, bindOkSharing] at hev
+            have hguard' : guardLvls
+                (ConstantIdentityLaws.mapQuotient
+                  (Sharing.inlineExpr c.sharing) q).lvls uinst =
+                .ok checked := by
+              simpa [ConstantIdentityLaws.mapQuotient] using hguard
+            rw [hguard', bindOkSharing]
+            cases hkind : ctx.quotientKind address with
+            | none =>
+              rw [hkind] at hev
+              cases hev
+              rw [EvalCtx.inlineSharing_quotientKind, hkind]
+              exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                  valuesInlineSharing],
+                .papV _ _ (.neuH _) .nil⟩
+            | some kind =>
+              rw [hkind] at hev
+              simp only at hev
+              cases hmatch : kind == q.kind with
+              | false => simp [hmatch] at hev
+              | true =>
+                rw [hmatch] at hev
+                cases hev
+                rw [EvalCtx.inlineSharing_quotientKind, hkind]
+                simp only
+                  [ConstantIdentityLaws.mapQuotient, hmatch]
+                exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                    valuesInlineSharing],
+                  .papV _ _ (.quotH _ _) .nil⟩
+        | cPrj p =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (match resolveMut ctx p.block p.idx.toNat with
+            | Except.ok (_, .indc ind) =>
+              match ind.ctors[p.cidx.toNat]? with
+              | none => Except.error (Err.stuck
+                  "constructor projection out of range")
+              | some ct => guardLvls ct.lvls uinst >>= fun _ =>
+                  saturate ctx n
+                    (.ctorH p.block p.idx.toNat p.cidx.toNat
+                      (ct.params.toNat + ct.fields.toNat)) []
+            | Except.ok _ => Except.error (Err.stuck
+                "constructor projection targets a non-inductive")
+            | Except.error err => Except.error err) = Except.ok v at hev
+          cases hmember : resolveMut ctx p.block p.idx.toNat with
+          | error err => rw [hmember] at hev; contradiction
+          | ok pair =>
+            rcases pair with ⟨blockConst, member⟩
+            rw [hmember] at hev
+            cases member with
+            | defn d => simp at hev
+            | recr r => simp at hev
+            | indc ind =>
+              change (match ind.ctors[p.cidx.toNat]? with
+                | none => Except.error (Err.stuck
+                    "constructor projection out of range")
+                | some ct => guardLvls ct.lvls uinst >>= fun _ =>
+                    saturate ctx n
+                      (.ctorH p.block p.idx.toNat p.cidx.toNat
+                        (ct.params.toNat + ct.fields.toNat)) []) =
+                          Except.ok v at hev
+              rw [resolveMut_inlineSharing_of_eq hmember]
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst,
+                ConstantIdentityLaws.mapInductive]
+              cases hctor : ind.ctors[p.cidx.toNat]? with
+              | none => rw [hctor] at hev; contradiction
+              | some ctor =>
+                rw [hctor] at hev
+                rw [Array.getElem?_map, hctor]
+                simp only [Option.map_some]
+                change (guardLvls ctor.lvls uinst >>= fun _ =>
+                  saturate ctx n
+                    (.ctorH p.block p.idx.toNat p.cidx.toNat
+                      (ctor.params.toNat + ctor.fields.toNat)) []) = .ok v at hev
+                cases hguard : guardLvls ctor.lvls uinst with
+                | error err =>
+                  rw [hguard, bindErrSharing] at hev
+                  contradiction
+                | ok checked =>
+                  rw [hguard, bindOkSharing] at hev
+                  have hguard' : guardLvls
+                      (ConstantIdentityLaws.mapConstructor
+                        (Sharing.inlineExpr blockConst.sharing) ctor).lvls
+                        uinst = .ok checked := by
+                    simpa [ConstantIdentityLaws.mapConstructor] using hguard
+                  rw [hguard', bindOkSharing]
+                  have hsat := ihS ctx
+                    (.ctorH p.block p.idx.toNat p.cidx.toNat
+                      (ctor.params.toNat + ctor.fields.toNat)) [] v hctx
+                    (.ctorH _ _ _ _) .nil hev
+                  simpa [ConstantIdentityLaws.mapConstructor,
+                    Head.inlineSharing, valuesInlineSharing] using hsat
+        | rPrj p =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (match resolveMut ctx p.block p.idx.toNat with
+            | Except.ok (blockConst, .recr r) =>
+              guardLvls r.lvls uinst >>= fun _ =>
+                Except.ok (Value.papV
+                  (.recH (some p.block) r
+                    (Frame.ofConst blockConst uinst (some p.block))) [])
+            | Except.ok _ => Except.error (Err.stuck
+                "recursor projection targets a non-recursor")
+            | Except.error err => Except.error err) = Except.ok v at hev
+          cases hmember : resolveMut ctx p.block p.idx.toNat with
+          | error err => rw [hmember] at hev; contradiction
+          | ok pair =>
+            rcases pair with ⟨blockConst, member⟩
+            rw [hmember] at hev
+            cases member with
+            | defn d => simp at hev
+            | indc ind => simp at hev
+            | recr r =>
+              change (guardLvls r.lvls uinst >>= fun _ =>
+                Except.ok (Value.papV
+                  (.recH (some p.block) r
+                    (Frame.ofConst blockConst uinst (some p.block))) [])) =
+                  Except.ok v at hev
+              rw [resolveMut_inlineSharing_of_eq hmember]
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst]
+              have hblockWF := resolveMut_sharingWF_of_eq hctx hmember
+              cases hguard : guardLvls r.lvls uinst with
+              | error err =>
+                rw [hguard, bindErrSharing] at hev
+                contradiction
+              | ok checked =>
+                rw [hguard, bindOkSharing] at hev
+                have hguard' : guardLvls
+                    (ConstantIdentityLaws.mapRecursor
+                      (Sharing.inlineExpr blockConst.sharing) r).lvls uinst =
+                    .ok checked := by
+                  simpa [ConstantIdentityLaws.mapRecursor] using hguard
+                rw [hguard', bindOkSharing]
+                cases hev
+                have hroots : rootsBelow blockConst.sharing r.exprs := by
+                  simpa [MutConst.exprs] using hblockWF.2
+                exact ⟨by
+                    simp only [Value.inlineSharing, Head.inlineSharing,
+                      valuesInlineSharing]
+                    rw [Frame.inlineSharing_ofConst]
+                    rfl,
+                  .papV _ _
+                    (.recH (some p.block) r
+                      (Frame.ofConst blockConst uinst (some p.block))
+                      (Frame.sharingWF_ofConst blockConst uinst
+                        (some p.block) hblockWF.1)
+                      hroots)
+                    .nil⟩
+        | iPrj p =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (match resolveMut ctx p.block p.idx.toNat with
+            | Except.ok (_, .indc ind) =>
+              guardLvls ind.lvls uinst >>= fun _ =>
+                Except.ok (Value.papV (.neuH (.const address)) [])
+            | Except.ok _ => Except.error (Err.stuck
+                "inductive projection targets a non-inductive")
+            | Except.error err => Except.error err) = Except.ok v at hev
+          cases hmember : resolveMut ctx p.block p.idx.toNat with
+          | error err => rw [hmember] at hev; contradiction
+          | ok pair =>
+            rcases pair with ⟨blockConst, member⟩
+            rw [hmember] at hev
+            cases member with
+            | defn d => simp at hev
+            | recr r => simp at hev
+            | indc ind =>
+              change (guardLvls ind.lvls uinst >>= fun _ =>
+                .ok (.papV (.neuH (.const address)) [])) = .ok v at hev
+              rw [resolveMut_inlineSharing_of_eq hmember]
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst]
+              cases hguard : guardLvls ind.lvls uinst with
+              | error err =>
+                rw [hguard, bindErrSharing] at hev
+                contradiction
+              | ok checked =>
+                rw [hguard, bindOkSharing] at hev
+                have hguard' : guardLvls
+                    (ConstantIdentityLaws.mapInductive
+                      (Sharing.inlineExpr blockConst.sharing) ind).lvls uinst =
+                    .ok checked := by
+                  simpa [ConstantIdentityLaws.mapInductive] using hguard
+                rw [hguard', bindOkSharing]
+                cases hev
+                exact ⟨by simp [Value.inlineSharing, Head.inlineSharing,
+                    valuesInlineSharing],
+                  .papV _ _ (.neuH _) .nil⟩
+        | dPrj p =>
+          rw [hinfo] at hev
+          simp only [Constant.inlineSharing, ConstantInfo.mapExprs,
+            ConstantIdentityLaws.mapInfo, hinfo]
+          change (match resolveMut ctx p.block p.idx.toNat with
+            | Except.ok (blockConst, .defn d) =>
+              guardLvls d.lvls uinst >>= fun _ =>
+                if unfoldable d then
+                  eval ctx n
+                    (Frame.ofConst blockConst uinst (some p.block)) [] d.value
+                else
+                  match ctx.externArity
+                      (Address.memberAddr p.block p.idx.toNat) with
+                  | none => .ok (.papV (.neuH (.const address)) [])
+                  | some arity => saturate ctx n
+                      (.extH (Address.memberAddr p.block p.idx.toNat) arity)
+                      []
+            | Except.ok _ => Except.error (Err.stuck
+                "definition projection targets a non-definition")
+            | Except.error err => Except.error err) = Except.ok v at hev
+          cases hmember : resolveMut ctx p.block p.idx.toNat with
+          | error err => rw [hmember] at hev; contradiction
+          | ok pair =>
+            rcases pair with ⟨blockConst, member⟩
+            rw [hmember] at hev
+            cases member with
+            | indc ind => simp at hev
+            | recr r => simp at hev
+            | defn d =>
+              change (guardLvls d.lvls uinst >>= fun _ =>
+                if unfoldable d then
+                  eval ctx n
+                    (Frame.ofConst blockConst uinst (some p.block)) [] d.value
+                else
+                  match ctx.externArity
+                      (Address.memberAddr p.block p.idx.toNat) with
+                  | none => .ok (.papV (.neuH (.const address)) [])
+                  | some arity => saturate ctx n
+                      (.extH (Address.memberAddr p.block p.idx.toNat) arity)
+                      []) = .ok v at hev
+              rw [resolveMut_inlineSharing_of_eq hmember]
+              simp only [MutConst.mapExprs,
+                ConstantIdentityLaws.mapMutConst]
+              have hblockWF := resolveMut_sharingWF_of_eq hctx hmember
+              cases hguard : guardLvls d.lvls uinst with
+              | error err =>
+                rw [hguard, bindErrSharing] at hev
+                contradiction
+              | ok checked =>
+                rw [hguard, bindOkSharing] at hev
+                have hguard' : guardLvls
+                    (ConstantIdentityLaws.mapDefinition
+                      (Sharing.inlineExpr blockConst.sharing) d).lvls uinst =
+                    .ok checked := by
+                  simpa [ConstantIdentityLaws.mapDefinition] using hguard
+                rw [hguard', bindOkSharing]
+                cases hunfold : unfoldable d with
+                | false =>
+                  rw [hunfold] at hev
+                  simp only [Bool.false_eq_true, if_false] at hev
+                  have hunfold' : unfoldable
+                      (ConstantIdentityLaws.mapDefinition
+                        (Sharing.inlineExpr blockConst.sharing) d) = false := by
+                    simpa [ConstantIdentityLaws.mapDefinition,
+                      unfoldable] using hunfold
+                  rw [hunfold']
+                  simp only [Bool.false_eq_true, if_false]
+                  cases hext : ctx.externArity
+                      (Address.memberAddr p.block p.idx.toNat) with
+                  | none =>
+                    rw [hext] at hev
+                    simp only [EvalCtx.inlineSharing_externArity, hext]
+                    cases hev
+                    exact ⟨by simp [Value.inlineSharing,
+                        Head.inlineSharing, valuesInlineSharing],
+                      .papV _ _ (.neuH _) .nil⟩
+                  | some arity =>
+                    rw [hext] at hev
+                    simp only [EvalCtx.inlineSharing_externArity, hext]
+                    simpa [Head.inlineSharing, valuesInlineSharing] using
+                      ihS ctx (.extH
+                        (Address.memberAddr p.block p.idx.toNat) arity)
+                        [] v hctx (.extH _ _) .nil hev
+                | true =>
+                  rw [hunfold] at hev
+                  have hunfold' : unfoldable
+                      (ConstantIdentityLaws.mapDefinition
+                        (Sharing.inlineExpr blockConst.sharing) d) = true := by
+                    simpa [ConstantIdentityLaws.mapDefinition,
+                      unfoldable] using hunfold
+                  rw [hunfold']
+                  have hvalue : Sharing.sharesBelow blockConst.sharing.size
+                      d.value = true :=
+                    rootsBelow_definition_value (by
+                      simpa [MutConst.exprs] using hblockWF.2)
+                  have hbody := ihE ctx
+                    (Frame.ofConst blockConst uinst (some p.block)) []
+                    d.value v hctx
+                    (Frame.sharingWF_ofConst blockConst uinst
+                      (some p.block) hblockWF.1)
+                    .nil hvalue hev
+                  rw [Frame.inlineSharing_ofConst] at hbody
+                  simpa [ConstantIdentityLaws.mapDefinition,
+                    valuesInlineSharing] using hbody
+        | muts members =>
+          rw [hinfo] at hev
+          simp at hev
+    · intro ctx f a v hctx hf ha hev
+      cases f with
+      | sortV lvl => rw [apply.eq_def] at hev; simp at hev
+      | piV uses owned F env dom cod =>
+        rw [apply.eq_def] at hev
+        simp at hev
+      | closV uses F env dom body =>
+        rw [apply.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases hf with
+        | closV _ _ _ _ _ hF henv hdom hbody =>
+          have hresult := ihE ctx F (a :: env) body v hctx hF
+            (.cons a env ha henv) hbody hev
+          simpa [Value.inlineSharing, valuesInlineSharing] using hresult
+      | papV head args =>
+        rw [apply.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases hf with
+        | papV _ _ hhead hargs =>
+          have hresult := ihS ctx head (args ++ [a]) v hctx hhead
+            (hargs.append (.cons a [] ha .nil)) hev
+          simpa [Value.inlineSharing, valuesInlineSharing] using hresult
+      | quotV address representative =>
+        rw [apply.eq_def] at hev
+        simp at hev
+      | ctorV block indIdx cidx args =>
+        rw [apply.eq_def] at hev
+        simp at hev
+      | litV lit =>
+        rw [apply.eq_def] at hev
+        simp at hev
+    · intro ctx f args v hctx hf hargs hev
+      cases args with
+      | nil =>
+        rw [applyMany.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases hev
+        exact ⟨by simp [valuesInlineSharing], hf⟩
+      | cons a rest =>
+        rw [applyMany.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases hargs with
+        | cons _ _ ha hrest =>
+          cases happly : apply ctx n f a with
+          | error err => rw [happly] at hev; contradiction
+          | ok applied =>
+            rw [happly] at hev
+            obtain ⟨happly', happliedWF⟩ :=
+              ihA ctx f a applied hctx hf ha happly
+            simp only [valuesInlineSharing]
+            change (do
+              let applied ← apply ctx.inlineSharing n f.inlineSharing
+                a.inlineSharing
+              applyMany ctx.inlineSharing n applied
+                (valuesInlineSharing rest)) =
+                  .ok v.inlineSharing ∧ v.SharingWF
+            rw [happly']
+            have hresult := ihM ctx applied rest v hctx happliedWF hrest hev
+            simpa only [bindOkSharing] using hresult
+    · intro ctx h args v hctx hh hargs hev
+      rw [saturate.eq_def] at hev ⊢
+      dsimp only at hev ⊢
+      rw [Head.arity?_inlineSharing]
+      cases harity : h.arity? with
+      | none =>
+        rw [harity] at hev
+        simp only at hev ⊢
+        cases hev
+        exact ⟨by simp [Value.inlineSharing], .papV h args hh hargs⟩
+      | some arity =>
+        rw [harity] at hev
+        simp only at hev ⊢
+        cases hlength : args.length == arity with
+        | false =>
+          simp only [valuesInlineSharing_length, hlength] at ⊢
+          rw [hlength] at hev
+          cases hev
+          exact ⟨by simp [Value.inlineSharing], .papV h args hh hargs⟩
+        | true =>
+          simp only [valuesInlineSharing_length, hlength] at ⊢
+          rw [hlength] at hev
+          exact ihF ctx h args v hctx hh hargs hev
+    · intro ctx h args v hctx hh hargs hev
+      cases h with
+      | ctorH block indIdx cidx arity =>
+        rw [fire.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases hev
+        exact ⟨by simp [Head.inlineSharing, Value.inlineSharing],
+          .ctorV block indIdx cidx args hargs⟩
+      | neuH id =>
+        rw [fire.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases hev
+        exact ⟨by simp [Head.inlineSharing, Value.inlineSharing],
+          .papV (.neuH id) args hh hargs⟩
+      | extH address arity =>
+        rw [fire.eq_def] at hev ⊢
+        dsimp only at hev ⊢
+        cases horacle : ctx.oracle address args with
+        | none =>
+          rw [horacle] at hev
+          contradiction
+        | some result =>
+          rw [horacle] at hev
+          obtain ⟨horacle', hresultWF⟩ :=
+            hctx.oracleOk address args result hargs horacle
+          cases hev
+          simp only [Head.inlineSharing, EvalCtx.inlineSharing_oracle,
+            horacle']
+          exact ⟨trivial, hresultWF⟩
+      | quotH address kind =>
+        cases kind with
+        | type =>
+          rw [fire.eq_def] at hev ⊢
+          dsimp only at hev ⊢
+          cases hev
+          exact ⟨by simp [Head.inlineSharing, Value.inlineSharing],
+            .papV (.quotH address .type) args hh hargs⟩
+        | ctor =>
+          rw [fire.eq_def] at hev ⊢
+          dsimp only at hev ⊢
+          cases hrepresentative : args[2]? with
+          | none => rw [hrepresentative] at hev; contradiction
+          | some representative =>
+            rw [hrepresentative] at hev
+            cases hev
+            rw [valuesInlineSharing_getElem?, hrepresentative]
+            simp only [Head.inlineSharing, Option.map, Value.inlineSharing]
+            exact ⟨by trivial, .quotV address representative
+              (hargs.getElem?_eq hrepresentative)⟩
+        | lift =>
+          rw [fire.eq_def] at hev ⊢
+          dsimp only at hev ⊢
+          simp only [Head.inlineSharing]
+          cases hfn : args[3]? with
+          | none =>
+            rw [hfn] at hev
+            rw [valuesInlineSharing_getElem?, hfn]
+            cases hev
+          | some fn =>
+            rw [hfn] at hev
+            rw [valuesInlineSharing_getElem?, hfn]
+            simp only [Option.map]
+            cases hquotient : args[5]? with
+            | none =>
+              rw [hquotient] at hev
+              rw [valuesInlineSharing_getElem?, hquotient]
+              cases hev
+            | some quotient =>
+              rw [hquotient] at hev
+              rw [valuesInlineSharing_getElem?, hquotient]
+              simp only [Option.map]
+              simp only at hev
+              cases hrep : quotientRep? quotient with
+              | none =>
+                rw [hrep] at hev
+                rw [quotientRep?_inlineSharing, hrep]
+                cases hev
+              | some representative =>
+                rw [hrep] at hev
+                rw [quotientRep?_inlineSharing, hrep]
+                simp only [Option.map]
+                have hfnWF : fn.SharingWF := hargs.getElem?_eq hfn
+                have hquotientWF : quotient.SharingWF :=
+                  hargs.getElem?_eq hquotient
+                have hrepresentativeWF : representative.SharingWF :=
+                  quotientRep?_sharingWF hquotientWF hrep
+                exact ihA ctx fn representative v hctx hfnWF
+                  hrepresentativeWF hev
+        | ind =>
+          rw [fire.eq_def] at hev ⊢
+          dsimp only at hev ⊢
+          simp only [Head.inlineSharing]
+          cases hmotive : args[3]? with
+          | none =>
+            rw [hmotive] at hev
+            rw [valuesInlineSharing_getElem?, hmotive]
+            cases hev
+          | some motive =>
+            rw [hmotive] at hev
+            rw [valuesInlineSharing_getElem?, hmotive]
+            simp only [Option.map]
+            cases hquotient : args[4]? with
+            | none =>
+              rw [hquotient] at hev
+              rw [valuesInlineSharing_getElem?, hquotient]
+              cases hev
+            | some quotient =>
+              rw [hquotient] at hev
+              rw [valuesInlineSharing_getElem?, hquotient]
+              simp only [Option.map]
+              simp only at hev
+              cases hrep : quotientRep? quotient with
+              | none =>
+                rw [hrep] at hev
+                rw [quotientRep?_inlineSharing, hrep]
+                cases hev
+              | some representative =>
+                rw [hrep] at hev
+                rw [quotientRep?_inlineSharing, hrep]
+                simp only [Option.map]
+                have hmotiveWF : motive.SharingWF :=
+                  hargs.getElem?_eq hmotive
+                have hquotientWF : quotient.SharingWF :=
+                  hargs.getElem?_eq hquotient
+                have hrepresentativeWF : representative.SharingWF :=
+                  quotientRep?_sharingWF hquotientWF hrep
+                exact ihA ctx motive representative v hctx hmotiveWF
+                  hrepresentativeWF hev
+      | recH block r F =>
+        cases hh with
+        | recH _ _ _ hF hr =>
+          rw [fire.eq_def] at hev ⊢
+          dsimp only at hev ⊢
+          simp only [Head.inlineSharing]
+          cases hlast : args.getLast? with
+          | none =>
+            rw [hlast] at hev
+            contradiction
+          | some major =>
+            rw [hlast] at hev
+            simp only at hev
+            rw [valuesInlineSharing_getLast?, hlast]
+            simp only [Option.map]
+            simp only [Recursor.mapExprs_params]
+            have hmajorWF : major.SharingWF := hargs.getLast?_eq hlast
+            cases hprepare : prepareStringMajor (evalRef ctx n) (apply ctx n)
+                ctx.stringLiteral major with
+            | error err =>
+              rw [hprepare, bindErrSharing] at hev
+              contradiction
+            | ok prepared =>
+              rw [hprepare, bindOkSharing] at hev
+              obtain ⟨hprepare', hpreparedWF⟩ :=
+                prepareStringMajor_inlineSharing_of
+                  (fun address uinst value href =>
+                    ihR ctx address uinst value hctx href)
+                  (fun function argument value hfunction hargument happly =>
+                    ihA ctx function argument value hctx hfunction hargument
+                      happly)
+                  ctx.stringLiteral hmajorWF hprepare
+              rw [EvalCtx.inlineSharing_stringLiteral, hprepare',
+                bindOkSharing]
+              cases hneutral :
+                  prepared.isNeutral && ctx.preserveNeutralElims with
+              | true =>
+                rw [hneutral] at hev
+                have hneutral' :
+                    (prepared.inlineSharing.isNeutral &&
+                      ctx.inlineSharing.preserveNeutralElims) = true := by
+                  rw [Value.isNeutral_inlineSharing prepared,
+                    EvalCtx.inlineSharing_preserveNeutralElims]
+                  exact hneutral
+                rw [hneutral']
+                cases hev
+                exact ⟨by simp [Value.inlineSharing, Head.inlineSharing],
+                  .papV _ _ (.recH block r F hF hr) hargs⟩
+              | false =>
+                rw [hneutral] at hev
+                have hneutral' :
+                    (prepared.inlineSharing.isNeutral &&
+                      ctx.inlineSharing.preserveNeutralElims) = false := by
+                  rw [Value.isNeutral_inlineSharing prepared,
+                    EvalCtx.inlineSharing_preserveNeutralElims]
+                  exact hneutral
+                rw [hneutral']
+                cases hguard : guardRecMajor block r.params.toNat prepared with
+                | error err =>
+                  rw [hguard, bindErrSharing] at hev
+                  contradiction
+                | ok checked =>
+                  rw [hguard, bindOkSharing] at hev
+                  rw [guardRecMajor_inlineSharing, hguard, bindOkSharing]
+                  cases hmajor : majorCtor
+                      (block.isSome && ctx.natBlock == block) prepared with
+                  | error err =>
+                    rw [hmajor, bindErrSharing] at hev
+                    contradiction
+                  | ok result =>
+                    rcases result with ⟨cidx, cargs⟩
+                    rw [hmajor, bindOkSharing] at hev
+                    have hcargsWF : ValuesSharingWF cargs :=
+                      majorCtor_sharingWF hpreparedWF hmajor
+                    have hmajor' : majorCtor
+                        (block.isSome && ctx.inlineSharing.natBlock == block)
+                        prepared.inlineSharing =
+                          .ok (cidx, valuesInlineSharing cargs) := by
+                      rw [EvalCtx.inlineSharing_natBlock,
+                        majorCtor_inlineSharing, hmajor]
+                      rfl
+                    rw [hmajor', bindOkSharing]
+                    cases hrule : r.rules[cidx]? with
+                    | none =>
+                      rw [hrule] at hev
+                      contradiction
+                    | some rule =>
+                      rw [hrule] at hev
+                      simp only at hev
+                      rw [Recursor.mapExprs_rules, Array.getElem?_map, hrule]
+                      simp only [Option.map]
+                      cases harity :
+                          cargs.length != r.params.toNat + rule.fields.toNat with
+                      | true =>
+                        rw [harity] at hev
+                        contradiction
+                      | false =>
+                        rw [harity] at hev
+                        simp only [valuesInlineSharing_length,
+                          RecursorRule.mapExprs_fields, harity]
+                        simp only [Bool.false_eq_true, if_false,
+                          RecursorRule.mapExprs_rhs] at hev ⊢
+                        cases heval : eval ctx n F [] rule.rhs with
+                        | error err =>
+                          rw [heval, bindErrSharing] at hev
+                          contradiction
+                        | ok rhsV =>
+                          rw [heval, bindOkSharing] at hev
+                          obtain ⟨heval', hrhsWF⟩ := ihE ctx F [] rule.rhs
+                            rhsV hctx hF ValuesSharingWF.nil
+                            (rootsBelow_recursor_rule hr hrule) heval
+                          have heval'' :
+                              eval ctx.inlineSharing n F.inlineSharing []
+                                (Sharing.inlineExpr F.sharing rule.rhs) =
+                                  .ok rhsV.inlineSharing := by
+                            simpa [valuesInlineSharing] using heval'
+                          rw [heval'', bindOkSharing]
+                          have hcallArgs : ValuesSharingWF
+                              (args.take (r.params.toNat + r.motives.toNat +
+                                  r.minors.toNat) ++
+                                cargs.drop r.params.toNat) :=
+                            (hargs.take _).append (hcargsWF.drop _)
+                          have hresult := ihM ctx rhsV
+                            (args.take (r.params.toNat + r.motives.toNat +
+                                r.minors.toNat) ++
+                              cargs.drop r.params.toNat)
+                            v hctx hrhsWF hcallArgs hev
+                          simpa only [valuesInlineSharing_append,
+                            valuesInlineSharing_take,
+                            valuesInlineSharing_drop,
+                            Recursor.mapExprs_motives,
+                            Recursor.mapExprs_minors] using hresult
+
+/-! ## Public sharing-coherence theorems -/
+
+/-- Inlining a well-formed sharing table in a frame, environment, and term
+preserves every successful evaluation and normalizes its resulting value. -/
+theorem eval_inlineSharing {ctx : EvalCtx} {fuel : Nat} {F : Frame}
+    {env : List Value} {e : Expr} {v : Value}
+    (hctx : ctx.SharingWF) (hF : F.SharingWF)
+    (henv : ValuesSharingWF env)
+    (he : Sharing.sharesBelow F.sharing.size e = true)
+    (hev : eval ctx fuel F env e = .ok v) :
+    eval ctx.inlineSharing fuel F.inlineSharing
+        (valuesInlineSharing env) (Sharing.inlineExpr F.sharing e) =
+          .ok v.inlineSharing ∧ v.SharingWF :=
+  (coherentAt fuel).1 ctx F env e v hctx hF henv he hev
+
+/-- Constant resolution commutes with sharing inlining on successful runs. -/
+theorem evalRef_inlineSharing {ctx : EvalCtx} {fuel : Nat}
+    {address : Address} {uinst : List Nat} {v : Value}
+    (hctx : ctx.SharingWF)
+    (hev : evalRef ctx fuel address uinst = .ok v) :
+    evalRef ctx.inlineSharing fuel address uinst = .ok v.inlineSharing ∧
+      v.SharingWF :=
+  (coherentAt fuel).2.1 ctx address uinst v hctx hev
+
+/-- Unary application commutes with sharing inlining on successful runs. -/
+theorem apply_inlineSharing {ctx : EvalCtx} {fuel : Nat} {f a v : Value}
+    (hctx : ctx.SharingWF) (hf : f.SharingWF) (ha : a.SharingWF)
+    (hev : apply ctx fuel f a = .ok v) :
+    apply ctx.inlineSharing fuel f.inlineSharing a.inlineSharing =
+      .ok v.inlineSharing ∧ v.SharingWF :=
+  (coherentAt fuel).2.2.1 ctx f a v hctx hf ha hev
+
+/-- Variadic application commutes with sharing inlining on successful runs. -/
+theorem applyMany_inlineSharing {ctx : EvalCtx} {fuel : Nat} {f v : Value}
+    {args : List Value} (hctx : ctx.SharingWF) (hf : f.SharingWF)
+    (hargs : ValuesSharingWF args)
+    (hev : applyMany ctx fuel f args = .ok v) :
+    applyMany ctx.inlineSharing fuel f.inlineSharing
+        (valuesInlineSharing args) = .ok v.inlineSharing ∧ v.SharingWF :=
+  (coherentAt fuel).2.2.2.1 ctx f args v hctx hf hargs hev
+
+/-- Head saturation commutes with sharing inlining on successful runs. -/
+theorem saturate_inlineSharing {ctx : EvalCtx} {fuel : Nat} {h : Head}
+    {args : List Value} {v : Value} (hctx : ctx.SharingWF)
+    (hh : h.SharingWF) (hargs : ValuesSharingWF args)
+    (hev : saturate ctx fuel h args = .ok v) :
+    saturate ctx.inlineSharing fuel h.inlineSharing
+        (valuesInlineSharing args) = .ok v.inlineSharing ∧ v.SharingWF :=
+  (coherentAt fuel).2.2.2.2.1 ctx h args v hctx hh hargs hev
+
+/-- Firing a saturated head commutes with sharing inlining on successful
+runs, including recursor rule selection and constructor-field application. -/
+theorem fire_inlineSharing {ctx : EvalCtx} {fuel : Nat} {h : Head}
+    {args : List Value} {v : Value} (hctx : ctx.SharingWF)
+    (hh : h.SharingWF) (hargs : ValuesSharingWF args)
+    (hev : fire ctx fuel h args = .ok v) :
+    fire ctx.inlineSharing fuel h.inlineSharing
+        (valuesInlineSharing args) = .ok v.inlineSharing ∧ v.SharingWF :=
+  (coherentAt fuel).2.2.2.2.2 ctx h args v hctx hh hargs hev
+
+/-- Closed evaluation is invariant under complete sharing inlining. -/
+theorem evalClosed_inlineSharing {ctx : EvalCtx} {fuel : Nat} {F : Frame}
+    {e : Expr} {v : Value} (hctx : ctx.SharingWF) (hF : F.SharingWF)
+    (he : Sharing.sharesBelow F.sharing.size e = true)
+    (hev : evalClosed ctx F e fuel = .ok v) :
+    evalClosed ctx.inlineSharing F.inlineSharing
+        (Sharing.inlineExpr F.sharing e) fuel = .ok v.inlineSharing ∧
+      v.SharingWF := by
+  simpa [evalClosed, valuesInlineSharing] using
+    eval_inlineSharing hctx hF ValuesSharingWF.nil he hev
+
+/-- Evaluating a well-formed definition constant is invariant under replacing
+the constant store and the selected constant by their fully inlined views. -/
+theorem evalConst_inlineSharing {ctx : EvalCtx} {c : Constant}
+    {uinst : List Nat} {fuel : Nat} {v : Value}
+    (hctx : ctx.SharingWF) (hc : c.sharingWF = true)
+    (hev : evalConst ctx c uinst fuel = .ok v) :
+    evalConst ctx.inlineSharing c.inlineSharing uinst fuel =
+      .ok v.inlineSharing ∧ v.SharingWF := by
+  cases hinfo : c.info with
+  | defn d =>
+    rw [evalConst, hinfo] at hev
+    have hrootsAll := constantRootsBelow_of_sharingWF c hc
+    have hroots : rootsBelow c.sharing d.exprs := by
+      intro e he
+      apply hrootsAll e
+      rw [hinfo]
+      simpa [ConstantInfo.exprs] using he
+    have hresult := eval_inlineSharing hctx
+      (Frame.sharingWF_ofConst c uinst none hc)
+      ValuesSharingWF.nil (rootsBelow_definition_value hroots) hev
+    simpa [evalConst, Constant.inlineSharing, hinfo,
+      ConstantInfo.mapExprs, ConstantIdentityLaws.mapInfo,
+      Frame.inlineSharing_ofConst, Definition.mapExprs_value,
+      ConstantIdentityLaws.mapDefinition,
+      valuesInlineSharing] using hresult
+  | recr r => simp [evalConst, hinfo] at hev
+  | axio a => simp [evalConst, hinfo] at hev
+  | quot q => simp [evalConst, hinfo] at hev
+  | cPrj p => simp [evalConst, hinfo] at hev
+  | rPrj p => simp [evalConst, hinfo] at hev
+  | iPrj p => simp [evalConst, hinfo] at hev
+  | dPrj p => simp [evalConst, hinfo] at hev
+  | muts members => simp [evalConst, hinfo] at hev
+
+end Ix.Compiler.Ixon.Eval
diff --git a/Ix/Compiler/Ixon/Univ.lean b/Ix/Compiler/Ixon/Univ.lean
new file mode 100644
index 000000000..480e46181
--- /dev/null
+++ b/Ix/Compiler/Ixon/Univ.lean
@@ -0,0 +1,980 @@
+import Ix.Compiler.Ixon.Serialize
+
+/-!
+# Universe levels
+
+Unchanged from ix's Ixon — the v2 codec for `Univ` is byte-identical
+(only `Expr` rolls in v2), modulo the strict-decoding discipline from
+`Serialize` plus telescope canonicity: a run-length-encoded succ chain
+must be maximal, so a decoded succ base may not itself be a succ. Recursive
+decoding is bounded by remaining input, and a single compressed succ run is
+limited before allocation; `getUniv_bounded` exposes the proved invariant.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-- Universe levels for Lean's type system. -/
+inductive Univ where
+  | zero : Univ
+  | succ : Univ → Univ
+  | max : Univ → Univ → Univ
+  | imax : Univ → Univ → Univ
+  | var : UInt64 → Univ
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+namespace Univ
+
+def FLAG_ZERO_SUCC : UInt8 := 0
+def FLAG_MAX : UInt8 := 1
+def FLAG_IMAX : UInt8 := 2
+def FLAG_VAR : UInt8 := 3
+
+/-- Build exactly `n` successors around a base. -/
+def addSucc : Nat → Univ → Univ
+  | 0, u => u
+  | n + 1, u => addSucc n (.succ u)
+
+/-- Maximum constructor depth, used as the structural termination measure. -/
+def codecDepth : Univ → Nat
+  | .zero | .var _ => 1
+  | .succ u => u.codecDepth + 1
+  | .max a b | .imax a b => a.codecDepth + b.codecDepth + 1
+
+end Univ
+
+/-- A single RLE header may expand to at most this many `.succ` nodes.
+Longer source runs are uniquely split into nested full chunks. Without a
+per-header bound, nine hostile bytes can request `UInt64.max` heap cells. -/
+def maxSuccExpansion : Nat := 4096
+
+mutual
+  /-- Canonical universe bytes. Keeping the structural encoder pure makes its
+  exact output available to both the writer specification and decoder proof. -/
+  def univBytes : Univ → ByteArray
+    | .zero => tag2Bytes ⟨Univ.FLAG_ZERO_SUCC, 0⟩
+    | .succ u => univSuccBytes 1 u
+    | .max a b =>
+      tag2Bytes ⟨Univ.FLAG_MAX, 0⟩ ++ univBytes a ++ univBytes b
+    | .imax a b =>
+      tag2Bytes ⟨Univ.FLAG_IMAX, 0⟩ ++ univBytes a ++ univBytes b
+    | .var idx => tag2Bytes ⟨Univ.FLAG_VAR, idx⟩
+  termination_by u => (u.codecDepth, 0)
+  decreasing_by
+    all_goals apply Prod.Lex.left <;> simp [Univ.codecDepth] <;> omega
+
+  /-- Accumulate one maximal successor run, then encode its base. -/
+  def univSuccBytes (count : Nat) : Univ → ByteArray
+    | current@(.succ u) =>
+      if count == maxSuccExpansion then
+        tag2Bytes ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩ ++
+          univBytes current
+      else
+        univSuccBytes (count + 1) u
+    | base =>
+      tag2Bytes ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩ ++ univBytes base
+  termination_by u => (u.codecDepth, 1)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Univ.codecDepth] <;> omega
+      | apply Prod.Lex.right <;> omega
+end
+
+/-- Total universe writer. -/
+def putUniv (u : Univ) : PutM Unit :=
+  putBytes (univBytes u)
+
+theorem putUniv_spec (u : Univ) : PutSpec (putUniv u) (univBytes u) := by
+  exact putBytes_spec _
+
+/-- Every decoded succ run is bounded, recursively through max/imax. -/
+inductive SuccBounded (limit : Nat) : Univ → Prop where
+  | zero : SuccBounded limit .zero
+  | var (idx : UInt64) : SuccBounded limit (.var idx)
+  | succRun (n : Nat) (base : Univ) : n ≤ limit → SuccBounded limit base →
+      SuccBounded limit (Univ.addSucc n base)
+  | max {a b : Univ} : SuccBounded limit a → SuccBounded limit b →
+      SuccBounded limit (.max a b)
+  | imax {a b : Univ} : SuccBounded limit a → SuccBounded limit b →
+      SuccBounded limit (.imax a b)
+
+/-- A decoded universe paired with the resource invariant established by
+the decoder that built it. -/
+structure DecodedUniv (limit : Nat) where
+  value : Univ
+  bounded : SuccBounded limit value
+
+/-- Interpret one already-decoded universe header. `recur` is the recursive
+decoder at the next-smaller fuel; naming this nonrecursive continuation keeps
+the executable definition and its compositional proof boundary aligned. -/
+def getUnivSucc (recur : GetM (DecodedUniv maxSuccExpansion))
+    (count : Nat) (hcount : count ≤ maxSuccExpansion) :
+    GetM (DecodedUniv maxSuccExpansion) := do
+  let base ← recur
+  match base.value with
+  | .succ _ =>
+    if count = maxSuccExpansion then
+      return ⟨Univ.addSucc count base.value,
+        .succRun count base.value hcount base.bounded⟩
+    else
+      throw "getUniv: non-canonical short succ chunk"
+  | _ =>
+    return ⟨Univ.addSucc count base.value,
+      .succRun count base.value hcount base.bounded⟩
+
+def getUnivTag (recur : GetM (DecodedUniv maxSuccExpansion))
+    (tag : Tag2) : GetM (DecodedUniv maxSuccExpansion) :=
+  match tag.flag with
+  | 0 => do
+    if tag.size == 0 then
+      return ⟨.zero, .zero⟩
+    else if hn : tag.size.toNat ≤ maxSuccExpansion then
+      getUnivSucc recur tag.size.toNat hn
+    else
+      throw s!"getUniv: succ expansion {tag.size} exceeds limit {maxSuccExpansion}"
+  | 1 => do
+    if tag.size != 0 then throw s!"getUniv: non-canonical max size {tag.size}"
+    let a ← recur
+    let b ← recur
+    return ⟨.max a.value b.value, .max a.bounded b.bounded⟩
+  | 2 => do
+    if tag.size != 0 then throw s!"getUniv: non-canonical imax size {tag.size}"
+    let a ← recur
+    let b ← recur
+    return ⟨.imax a.value b.value, .imax a.bounded b.bounded⟩
+  | 3 => return ⟨.var tag.size, .var tag.size⟩
+  | f => throw s!"getUniv: invalid flag {f}"
+
+def getUnivFuel : Nat → GetM (DecodedUniv maxSuccExpansion)
+  | 0 => throw "getUniv: recursion limit"
+  | fuel + 1 => do
+    let tag ← getTag2
+    getUnivTag (getUnivFuel fuel) tag
+
+def getUnivCertified : GetM (DecodedUniv maxSuccExpansion) := do
+  let st ← get
+  getUnivFuel (st.bytes.size - st.idx + 1)
+
+def getUniv : GetM Univ := fun st =>
+  match getUnivCertified st with
+  | .error err => .error err
+  | .ok (decoded, st') => .ok (decoded.value, st')
+
+/-- Every successful public decode satisfies the recursive succ-expansion
+bound. The proof is carried by `getUnivCertified`, then erased from the API. -/
+theorem getUniv_bounded {st st' : GetState} {u : Univ}
+    (h : getUniv.run st = .ok (u, st')) :
+    SuccBounded maxSuccExpansion u := by
+  change getUniv st = .ok (u, st') at h
+  unfold getUniv at h
+  cases hc : getUnivCertified st with
+  | error err => rw [hc] at h; contradiction
+  | ok result =>
+    rcases result with ⟨decoded, st''⟩
+    rw [hc] at h
+    cases h
+    exact decoded.bounded
+
+instance : Serialize Univ where
+  put := putUniv
+  get := getUniv
+
+/-! Elaboration-time roundtrip and canonicity checks. -/
+
+private def univRoundtrips (u : Univ) : Bool :=
+  match (de (ser u) : Except String Univ) with
+  | .ok u' => u' == u
+  | .error _ => false
+
+#guard univRoundtrips .zero
+#guard univRoundtrips (.succ (.succ .zero))
+#guard univRoundtrips (.succ (.max (.var 0) (.var 1)))
+#guard univRoundtrips (.max (.var 0) (.succ (.var 1)))
+#guard univRoundtrips (.imax .zero (.var 40))
+
+private def chunkedSucc : Univ :=
+  Univ.addSucc (maxSuccExpansion + 1) .zero
+
+-- The boundary is canonical: one full chunk, then a final run of one.
+#guard ser chunkedSucc == ByteArray.mk #[0x21, 0x00, 0x10, 0x01, 0x00]
+#guard univRoundtrips chunkedSucc
+
+private def univRejects (bytes : Array UInt8) : Bool :=
+  match (de (ByteArray.mk bytes) : Except String Univ) with
+  | .ok _ => false
+  | .error _ => true
+
+-- succ(size 1) over a base that is itself an encoded succ: non-canonical
+#guard univRejects #[0x01, 0x01, 0x00]
+
+-- max/imax with a nonzero size field: non-canonical (the encoder always
+-- writes 0; accepting other sizes would split one value across addresses)
+#guard univRejects #[0x41, 0x00, 0x00]        -- max, small-form size 1
+#guard univRejects #[0x81, 0x00, 0x00]        -- imax, small-form size 1
+#guard univRejects #[0x60, 0x20, 0x00, 0x00]  -- max, large-form size 32
+
+private def oversizedSucc : ByteArray := runPut do
+  putTag2 ⟨Univ.FLAG_ZERO_SUCC, (maxSuccExpansion + 1).toUInt64⟩
+  putTag2 ⟨Univ.FLAG_ZERO_SUCC, 0⟩
+
+-- The RLE count is rejected before allocating any successor nodes.
+#guard (match (de oversizedSucc : Except String Univ) with
+  | .error msg => msg == s!"getUniv: succ expansion {maxSuccExpansion + 1} exceeds limit {maxSuccExpansion}"
+  | .ok _ => false)
+
+namespace UnivLaws
+
+local notation "bytes" => univBytes
+local notation "succBytes" => univSuccBytes
+
+attribute [local simp] univBytes.eq_1 univBytes.eq_2 univBytes.eq_3
+  univBytes.eq_4 univBytes.eq_5 univSuccBytes.eq_1 univSuccBytes.eq_2
+
+theorem tag2Bytes_size_pos (t : Tag2) : 0 < (tag2Bytes t).size := by
+  simp only [tag2Bytes]
+  split
+  · simp [u8Bytes]
+  · simp [u8Bytes, ByteArray.size_append]
+    omega
+
+theorem getFuel_zero_spec (fuel : Nat)
+    (hfuel : (bytes .zero).size < fuel) :
+    GetSpec (getUnivFuel fuel) (bytes .zero)
+      ⟨.zero, SuccBounded.zero⟩ := by
+  cases fuel with
+  | zero => simp at hfuel
+  | succ fuel =>
+    intro pre suffix
+    simp [getUnivFuel, StateT.run_bind]
+    rw [getTag2_encoded_spec ⟨Univ.FLAG_ZERO_SUCC, 0⟩ (by decide) pre suffix]
+    simp [Univ.FLAG_ZERO_SUCC]
+    rfl
+
+theorem getFuel_var_spec (idx : UInt64) (fuel : Nat)
+    (hfuel : (bytes (.var idx)).size < fuel) :
+    GetSpec (getUnivFuel fuel) (bytes (.var idx))
+      ⟨.var idx, SuccBounded.var idx⟩ := by
+  cases fuel with
+  | zero => simp at hfuel
+  | succ fuel =>
+    intro pre suffix
+    simp [getUnivFuel, StateT.run_bind]
+    rw [getTag2_encoded_spec ⟨Univ.FLAG_VAR, idx⟩
+      (by simp [Univ.FLAG_VAR]) pre suffix]
+    simp [Univ.FLAG_VAR]
+    rfl
+
+theorem getFuel_max_of_specs (a b : Univ) (fuel : Nat)
+    {haBound : SuccBounded maxSuccExpansion a}
+    {hbBound : SuccBounded maxSuccExpansion b}
+    (ha : GetSpec (getUnivFuel fuel) (bytes a) ⟨a, haBound⟩)
+    (hb : GetSpec (getUnivFuel fuel) (bytes b) ⟨b, hbBound⟩) :
+    GetSpec (getUnivFuel (fuel + 1)) (bytes (.max a b))
+      ⟨.max a b, .max haBound hbBound⟩ := by
+  let finish : DecodedUniv maxSuccExpansion →
+      GetM (DecodedUniv maxSuccExpansion) := fun decoded =>
+    pure ⟨.max a decoded.value, .max haBound decoded.bounded⟩
+  have hfinish : GetSpec (finish ⟨b, hbBound⟩) ByteArray.empty
+      ⟨.max a b, .max haBound hbBound⟩ := by
+    simpa [finish] using GetSpec.pure
+      (DecodedUniv.mk (.max a b) (.max haBound hbBound))
+  have hright := GetSpec.bind (next := finish) hb hfinish
+  simp only [ByteArray.append_empty] at hright
+  let afterLeft : DecodedUniv maxSuccExpansion →
+      GetM (DecodedUniv maxSuccExpansion) := fun decoded => do
+    let right ← getUnivFuel fuel
+    return ⟨.max decoded.value right.value,
+      .max decoded.bounded right.bounded⟩
+  have hafterLeft : GetSpec (afterLeft ⟨a, haBound⟩) (bytes b)
+      ⟨.max a b, .max haBound hbBound⟩ := by
+    simpa [afterLeft, finish] using hright
+  have hchildren := GetSpec.bind (next := afterLeft) ha hafterLeft
+  have htag := getTag2_encoded_spec ⟨Univ.FLAG_MAX, 0⟩
+    (by simp [Univ.FLAG_MAX])
+  have hcontinuation :
+      GetSpec
+        (getUnivTag (getUnivFuel fuel) ⟨Univ.FLAG_MAX, 0⟩)
+        (bytes a ++ bytes b)
+        ⟨.max a b, .max haBound hbBound⟩ := by
+    simpa [getUnivTag, Univ.FLAG_MAX, afterLeft] using hchildren
+  have htotal := GetSpec.bind
+    (next := getUnivTag (getUnivFuel fuel)) htag hcontinuation
+  simpa [getUnivFuel, ByteArray.append_assoc] using htotal
+
+theorem getFuel_imax_of_specs (a b : Univ) (fuel : Nat)
+    {haBound : SuccBounded maxSuccExpansion a}
+    {hbBound : SuccBounded maxSuccExpansion b}
+    (ha : GetSpec (getUnivFuel fuel) (bytes a) ⟨a, haBound⟩)
+    (hb : GetSpec (getUnivFuel fuel) (bytes b) ⟨b, hbBound⟩) :
+    GetSpec (getUnivFuel (fuel + 1)) (bytes (.imax a b))
+      ⟨.imax a b, .imax haBound hbBound⟩ := by
+  let finish : DecodedUniv maxSuccExpansion →
+      GetM (DecodedUniv maxSuccExpansion) := fun decoded =>
+    pure ⟨.imax a decoded.value, .imax haBound decoded.bounded⟩
+  have hfinish : GetSpec (finish ⟨b, hbBound⟩) ByteArray.empty
+      ⟨.imax a b, .imax haBound hbBound⟩ := by
+    simpa [finish] using GetSpec.pure
+      (DecodedUniv.mk (.imax a b) (.imax haBound hbBound))
+  have hright := GetSpec.bind (next := finish) hb hfinish
+  simp only [ByteArray.append_empty] at hright
+  let afterLeft : DecodedUniv maxSuccExpansion →
+      GetM (DecodedUniv maxSuccExpansion) := fun decoded => do
+    let right ← getUnivFuel fuel
+    return ⟨.imax decoded.value right.value,
+      .imax decoded.bounded right.bounded⟩
+  have hafterLeft : GetSpec (afterLeft ⟨a, haBound⟩) (bytes b)
+      ⟨.imax a b, .imax haBound hbBound⟩ := by
+    simpa [afterLeft, finish] using hright
+  have hchildren := GetSpec.bind (next := afterLeft) ha hafterLeft
+  have htag := getTag2_encoded_spec ⟨Univ.FLAG_IMAX, 0⟩
+    (by simp [Univ.FLAG_IMAX])
+  have hcontinuation :
+      GetSpec
+        (getUnivTag (getUnivFuel fuel) ⟨Univ.FLAG_IMAX, 0⟩)
+        (bytes a ++ bytes b)
+        ⟨.imax a b, .imax haBound hbBound⟩ := by
+    simpa [getUnivTag, Univ.FLAG_IMAX, afterLeft] using hchildren
+  have htotal := GetSpec.bind
+    (next := getUnivTag (getUnivFuel fuel)) htag hcontinuation
+  simpa [getUnivFuel, ByteArray.append_assoc] using htotal
+
+def SuccChunkCanonical (count : Nat) : Univ → Prop
+  | .succ _ => count = maxSuccExpansion
+  | _ => True
+
+theorem toUInt64_toNat_of_le_limit (count : Nat)
+    (hle : count ≤ maxSuccExpansion) : count.toUInt64.toNat = count := by
+  change count % 18446744073709551616 = count
+  apply Nat.mod_eq_of_lt
+  simp [maxSuccExpansion] at hle
+  omega
+
+theorem getUnivSucc_of_spec (count : Nat) (base : Univ) (fuel : Nat)
+    (hle : count ≤ maxSuccExpansion)
+    (hcanonical : SuccChunkCanonical count base)
+    {baseBound : SuccBounded maxSuccExpansion base}
+    (hbase : GetSpec (getUnivFuel fuel) (bytes base) ⟨base, baseBound⟩) :
+    GetSpec (getUnivSucc (getUnivFuel fuel) count hle) (bytes base)
+      ⟨Univ.addSucc count base,
+        .succRun count base hle baseBound⟩ := by
+  let finish : DecodedUniv maxSuccExpansion →
+      GetM (DecodedUniv maxSuccExpansion) := fun decoded =>
+    match decoded.value with
+    | .succ _ =>
+      if count = maxSuccExpansion then
+        pure ⟨Univ.addSucc count decoded.value,
+          .succRun count decoded.value hle decoded.bounded⟩
+      else
+        throw "getUniv: non-canonical short succ chunk"
+    | _ =>
+      pure ⟨Univ.addSucc count decoded.value,
+        .succRun count decoded.value hle decoded.bounded⟩
+  have hfinish : GetSpec (finish ⟨base, baseBound⟩) ByteArray.empty
+      ⟨Univ.addSucc count base, .succRun count base hle baseBound⟩ := by
+    cases base <;>
+      simp_all [finish, SuccChunkCanonical] <;>
+      exact GetSpec.pure _
+  have hparsed := GetSpec.bind (next := finish) hbase hfinish
+  simp only [ByteArray.append_empty] at hparsed
+  change GetSpec (getUnivFuel fuel >>= finish) (bytes base)
+    ⟨Univ.addSucc count base, .succRun count base hle baseBound⟩
+  exact hparsed
+
+theorem getFuel_succ_of_spec (count : Nat) (base : Univ) (fuel : Nat)
+    (hpos : 0 < count) (hle : count ≤ maxSuccExpansion)
+    (hcanonical : SuccChunkCanonical count base)
+    {baseBound : SuccBounded maxSuccExpansion base}
+    (hbase : GetSpec (getUnivFuel fuel) (bytes base) ⟨base, baseBound⟩) :
+    GetSpec (getUnivFuel (fuel + 1))
+      (tag2Bytes ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩ ++ bytes base)
+      ⟨Univ.addSucc count base,
+        .succRun count base hle baseBound⟩ := by
+  have hcount := toUInt64_toNat_of_le_limit count hle
+  have hsizeNe : count.toUInt64 ≠ 0 := by
+    intro hzero
+    have := congrArg UInt64.toNat hzero
+    simp [hcount] at this
+    omega
+  have hparsed := getUnivSucc_of_spec count base fuel hle hcanonical hbase
+  have hcontinuation :
+      GetSpec
+        (getUnivTag (getUnivFuel fuel)
+          ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩)
+        (bytes base)
+        ⟨Univ.addSucc count base,
+          .succRun count base hle baseBound⟩ := by
+    simpa [getUnivTag, Univ.FLAG_ZERO_SUCC, hcount, hsizeNe, hle,
+      getUnivSucc] using hparsed
+  have htag := getTag2_encoded_spec
+    ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩
+    (by simp [Univ.FLAG_ZERO_SUCC])
+  have htotal := GetSpec.bind
+    (next := getUnivTag (getUnivFuel fuel)) htag hcontinuation
+  simpa [getUnivFuel, ByteArray.append_assoc] using htotal
+
+@[simp] theorem addSucc_one (u : Univ) : Univ.addSucc 1 u = .succ u := rfl
+
+theorem addSucc_succ (count : Nat) (u : Univ) :
+    Univ.addSucc count (.succ u) = Univ.addSucc (count + 1) u := by
+  induction count with
+  | zero => rfl
+  | succ count ih => simp [Univ.addSucc]
+
+mutual
+  theorem getFuel_bytes_spec (u : Univ) (fuel : Nat)
+      (hfuel : (bytes u).size < fuel) :
+      ∃ bounded : SuccBounded maxSuccExpansion u,
+        GetSpec (getUnivFuel fuel) (bytes u) ⟨u, bounded⟩ := by
+    cases u with
+    | zero =>
+      exact ⟨.zero, getFuel_zero_spec fuel hfuel⟩
+    | succ u =>
+      have h := getFuel_succBytes_spec 1 u (by omega)
+        (by simp [maxSuccExpansion]) fuel (by simpa using hfuel)
+      simpa using h
+    | max a b =>
+      cases fuel with
+      | zero => simp at hfuel
+      | succ fuel =>
+        have htag := tag2Bytes_size_pos ⟨Univ.FLAG_MAX, 0⟩
+        have haFuel : (bytes a).size < fuel := by
+          simp only [univBytes.eq_3, ByteArray.size_append] at hfuel
+          omega
+        have hbFuel : (bytes b).size < fuel := by
+          simp only [univBytes.eq_3, ByteArray.size_append] at hfuel
+          omega
+        obtain ⟨haBound, ha⟩ := getFuel_bytes_spec a fuel haFuel
+        obtain ⟨hbBound, hb⟩ := getFuel_bytes_spec b fuel hbFuel
+        exact ⟨.max haBound hbBound, getFuel_max_of_specs a b fuel ha hb⟩
+    | imax a b =>
+      cases fuel with
+      | zero => simp at hfuel
+      | succ fuel =>
+        have htag := tag2Bytes_size_pos ⟨Univ.FLAG_IMAX, 0⟩
+        have haFuel : (bytes a).size < fuel := by
+          simp only [univBytes.eq_4, ByteArray.size_append] at hfuel
+          omega
+        have hbFuel : (bytes b).size < fuel := by
+          simp only [univBytes.eq_4, ByteArray.size_append] at hfuel
+          omega
+        obtain ⟨haBound, ha⟩ := getFuel_bytes_spec a fuel haFuel
+        obtain ⟨hbBound, hb⟩ := getFuel_bytes_spec b fuel hbFuel
+        exact ⟨.imax haBound hbBound, getFuel_imax_of_specs a b fuel ha hb⟩
+    | var idx =>
+      exact ⟨.var idx, getFuel_var_spec idx fuel hfuel⟩
+  termination_by (u.codecDepth, 0)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Univ.codecDepth] <;> omega
+      | apply Prod.Lex.right <;> omega
+
+  theorem getFuel_succBytes_spec (count : Nat) (u : Univ)
+      (hpos : 0 < count) (hle : count ≤ maxSuccExpansion)
+      (fuel : Nat) (hfuel : (succBytes count u).size < fuel) :
+      ∃ bounded : SuccBounded maxSuccExpansion (Univ.addSucc count u),
+        GetSpec (getUnivFuel fuel) (succBytes count u)
+          ⟨Univ.addSucc count u, bounded⟩ := by
+    cases u with
+    | succ u =>
+      by_cases hfull : count = maxSuccExpansion
+      · subst count
+        cases fuel with
+        | zero => simp at hfuel
+        | succ fuel =>
+          have htag : 0 < (tag2Bytes
+              ⟨Univ.FLAG_ZERO_SUCC, UInt64.ofNat maxSuccExpansion⟩).size :=
+            tag2Bytes_size_pos _
+          have hbaseFuel : (bytes (.succ u)).size < fuel := by
+            rw [univBytes.eq_2]
+            simp [ByteArray.size_append] at hfuel
+            omega
+          obtain ⟨baseBound, hbase⟩ :=
+            getFuel_bytes_spec (.succ u) fuel hbaseFuel
+          have hparse := getFuel_succ_of_spec maxSuccExpansion (.succ u)
+            fuel hpos hle
+            (by simp [SuccChunkCanonical]) hbase
+          exact ⟨.succRun maxSuccExpansion (.succ u) hle baseBound,
+            by simpa using hparse⟩
+      · have hle' : count + 1 ≤ maxSuccExpansion := by omega
+        have hrec := getFuel_succBytes_spec (count + 1) u (by omega) hle'
+          fuel (by simpa [hfull] using hfuel)
+        simpa [hfull, addSucc_succ] using hrec
+    | zero =>
+      cases fuel with
+      | zero => simp at hfuel
+      | succ fuel =>
+        have htag := tag2Bytes_size_pos
+          ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩
+        have hbaseFuel : (bytes .zero).size < fuel := by
+          simp only [univSuccBytes.eq_2, ByteArray.size_append] at hfuel
+          omega
+        obtain ⟨baseBound, hbase⟩ := getFuel_bytes_spec .zero fuel hbaseFuel
+        exact ⟨.succRun count .zero hle baseBound,
+          by simpa using
+            getFuel_succ_of_spec count .zero fuel hpos hle (by trivial) hbase⟩
+    | max a b =>
+      cases fuel with
+      | zero => simp at hfuel
+      | succ fuel =>
+        have htag := tag2Bytes_size_pos
+          ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩
+        have hbaseFuel : (bytes (.max a b)).size < fuel := by
+          simp only [univSuccBytes.eq_2, ByteArray.size_append] at hfuel
+          omega
+        obtain ⟨baseBound, hbase⟩ :=
+          getFuel_bytes_spec (.max a b) fuel hbaseFuel
+        exact ⟨.succRun count (.max a b) hle baseBound,
+          by simpa using
+            getFuel_succ_of_spec count (.max a b) fuel hpos hle (by trivial) hbase⟩
+    | imax a b =>
+      cases fuel with
+      | zero => simp at hfuel
+      | succ fuel =>
+        have htag := tag2Bytes_size_pos
+          ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩
+        have hbaseFuel : (bytes (.imax a b)).size < fuel := by
+          simp only [univSuccBytes.eq_2, ByteArray.size_append] at hfuel
+          omega
+        obtain ⟨baseBound, hbase⟩ :=
+          getFuel_bytes_spec (.imax a b) fuel hbaseFuel
+        exact ⟨.succRun count (.imax a b) hle baseBound,
+          by simpa using
+            getFuel_succ_of_spec count (.imax a b) fuel hpos hle (by trivial) hbase⟩
+    | var idx =>
+      cases fuel with
+      | zero => simp at hfuel
+      | succ fuel =>
+        have htag := tag2Bytes_size_pos
+          ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩
+        have hbaseFuel : (bytes (.var idx)).size < fuel := by
+          simp only [univSuccBytes.eq_2, ByteArray.size_append] at hfuel
+          omega
+        obtain ⟨baseBound, hbase⟩ :=
+          getFuel_bytes_spec (.var idx) fuel hbaseFuel
+        exact ⟨.succRun count (.var idx) hle baseBound,
+          by simpa using
+            getFuel_succ_of_spec count (.var idx) fuel hpos hle (by trivial) hbase⟩
+  termination_by (u.codecDepth, 1)
+  decreasing_by
+    all_goals subst_vars
+    all_goals first
+      | apply Prod.Lex.left <;> simp [Univ.codecDepth] <;> omega
+      | apply Prod.Lex.right <;> omega
+end
+
+theorem allBounded (u : Univ) : SuccBounded maxSuccExpansion u := by
+  induction u with
+  | zero => exact .zero
+  | succ u ih =>
+    simpa using SuccBounded.succRun 1 u (by simp [maxSuccExpansion]) ih
+  | max a b ha hb => exact .max ha hb
+  | imax a b ha hb => exact .imax ha hb
+  | var idx => exact .var idx
+
+theorem getCertified_spec (u : Univ) :
+    GetSpec getUnivCertified (bytes u) ⟨u, allBounded u⟩ := by
+  intro pre suffix
+  let fuel := (pre ++ bytes u ++ suffix).size - pre.size + 1
+  have hfuel : (bytes u).size < fuel := by
+    dsimp [fuel]
+    simp only [ByteArray.size_append]
+    omega
+  obtain ⟨bounded, hspec⟩ := getFuel_bytes_spec u fuel hfuel
+  have hrun := hspec pre suffix
+  change (getUnivFuel fuel).run
+    ⟨pre ++ bytes u ++ suffix, pre.size⟩ = _
+  simpa [fuel] using hrun
+
+theorem getUniv_spec (u : Univ) : GetSpec getUniv (bytes u) u := by
+  intro pre suffix
+  have h := getCertified_spec u pre suffix
+  change getUniv ⟨pre ++ bytes u ++ suffix, pre.size⟩ = _
+  unfold getUniv
+  change getUnivCertified ⟨pre ++ bytes u ++ suffix, pre.size⟩ = _ at h
+  rw [h]
+
+/-! ## Canonical decoding
+
+The converse proof follows arbitrary successful parses. Each reader exposes
+the canonical prefix it consumed; recursive universe cases compose those
+prefixes and strict top-level consumption rules out a residual suffix. -/
+
+theorem univBytes_addSucc_eq_succBytes (count : Nat) (base : Univ)
+    (hpos : 0 < count) (hle : count ≤ maxSuccExpansion) :
+    univBytes (Univ.addSucc count base) = univSuccBytes count base := by
+  induction count generalizing base with
+  | zero => omega
+  | succ count ih =>
+    cases count with
+    | zero => simp [Univ.addSucc]
+    | succ count =>
+      rw [Univ.addSucc]
+      rw [ih (.succ base) (by omega) (by omega)]
+      rw [univSuccBytes.eq_1]
+      simp only [show ¬(count + 1 == maxSuccExpansion) = true by
+        simp [maxSuccExpansion] at hle ⊢; omega, Bool.false_eq_true,
+        if_false]
+
+theorem univSuccBytes_canonical (count : Nat) (base : Univ)
+    (hcanonical : UnivLaws.SuccChunkCanonical count base) :
+    univSuccBytes count base =
+      tag2Bytes ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩ ++ univBytes base := by
+  cases base with
+  | succ u =>
+    simp only [UnivLaws.SuccChunkCanonical] at hcanonical
+    subst count
+    rw [univSuccBytes.eq_1]
+    simp
+  | zero | max | imax | var =>
+    exact univSuccBytes.eq_2 count _ (by intro u h; cases h)
+
+theorem univBytes_addSucc_canonical (count : Nat) (base : Univ)
+    (hpos : 0 < count) (hle : count ≤ maxSuccExpansion)
+    (hcanonical : UnivLaws.SuccChunkCanonical count base) :
+    univBytes (Univ.addSucc count base) =
+      tag2Bytes ⟨Univ.FLAG_ZERO_SUCC, count.toUInt64⟩ ++ univBytes base := by
+  rw [univBytes_addSucc_eq_succBytes count base hpos hle]
+  exact univSuccBytes_canonical count base hcanonical
+
+set_option maxRecDepth 10000 in
+theorem getUnivSucc_success_canonical
+    (recur : GetM (DecodedUniv maxSuccExpansion)) (count : Nat)
+    (hle : count ≤ maxSuccExpansion) (base : DecodedUniv maxSuccExpansion)
+    (initial afterBase st' : GetState)
+    (decoded : DecodedUniv maxSuccExpansion)
+    (hr : recur.run initial = .ok (base, afterBase))
+    (h : (getUnivSucc recur count hle).run initial = .ok (decoded, st')) :
+    UnivLaws.SuccChunkCanonical count base.value ∧
+      decoded.value = Univ.addSucc count base.value ∧ st' = afterBase := by
+  unfold getUnivSucc at h
+  simp only [StateT.run_bind] at h
+  rw [hr] at h
+  simp only [bind, Except.bind] at h
+  cases hv : base.value with
+  | succ u =>
+    by_cases hfull : count = maxSuccExpansion
+    · simp [hv, hfull] at h
+      have hd := congrArg
+        (fun result : Except String
+            (DecodedUniv maxSuccExpansion × GetState) =>
+          match result with
+          | .ok (value, _) => value.value
+          | .error _ => .zero) h
+      have hs := congrArg
+        (fun result : Except String
+            (DecodedUniv maxSuccExpansion × GetState) =>
+          match result with
+          | .ok (_, state) => some state
+          | .error _ => none) h
+      refine ⟨by simpa [UnivLaws.SuccChunkCanonical] using hfull, ?_, ?_⟩
+      · exact hd.symm.trans
+          (congrArg (fun n => Univ.addSucc n (.succ u)) hfull.symm)
+      · change some afterBase = some st' at hs
+        exact (Option.some.inj hs).symm
+    · simp [hv, hfull] at h
+      change (Except.error _) = Except.ok (decoded, st') at h
+      contradiction
+  | zero | max | imax | var =>
+    simp [hv] at h
+    cases h
+    exact ⟨by simp [UnivLaws.SuccChunkCanonical], rfl, rfl⟩
+
+def UnivTagCanonical
+    (recur : GetM (DecodedUniv maxSuccExpansion)) (tag : Tag2) : Prop :=
+  ∀ (pre rest : ByteArray) {decoded : DecodedUniv maxSuccExpansion}
+      {st' : GetState},
+    (getUnivTag recur tag).run ⟨pre ++ rest, pre.size⟩ = .ok (decoded, st') →
+    ∃ payload suffix,
+      rest = payload ++ suffix ∧
+      tag2Bytes tag ++ payload = univBytes decoded.value ∧
+      st' = ⟨pre ++ rest, pre.size + payload.size⟩
+
+theorem getUnivTag_canonical_of
+    (recur : GetM (DecodedUniv maxSuccExpansion))
+    (hrecur : GetCanonical recur (fun decoded => univBytes decoded.value))
+    (tag : Tag2) : UnivTagCanonical recur tag := by
+  rcases tag with ⟨flag, size⟩
+  intro pre rest decoded st' h
+  by_cases h0 : flag = 0
+  · subst flag
+    by_cases hsize0 : size = 0
+    · subst size
+      simp [getUnivTag] at h
+      cases h
+      exact ⟨ByteArray.empty, rest, by simp,
+        by simp [Univ.FLAG_ZERO_SUCC], by simp⟩
+    · by_cases hle : size.toNat ≤ maxSuccExpansion
+      · have hsucc :
+            (getUnivSucc recur size.toNat hle).run
+                ⟨pre ++ rest, pre.size⟩ = .ok (decoded, st') := by
+          simpa [getUnivTag, hsize0, hle] using h
+        cases hr : recur.run ⟨pre ++ rest, pre.size⟩ with
+        | error err =>
+          unfold getUnivSucc at hsucc
+          simp only [StateT.run_bind] at hsucc
+          rw [hr] at hsucc
+          contradiction
+        | ok baseResult =>
+          rcases baseResult with ⟨base, afterBase⟩
+          obtain ⟨suffix, hrestBase, hafterBase⟩ :=
+            hrecur pre rest hr
+          obtain ⟨hcanonical, hvalue, hstate⟩ :=
+            getUnivSucc_success_canonical recur size.toNat hle base
+              ⟨pre ++ rest, pre.size⟩ afterBase st' decoded hr hsucc
+          have hpos : 0 < size.toNat := by
+            apply Nat.pos_of_ne_zero
+            intro hzero
+            have hs := UInt64.ofNat_toNat (x := size)
+            rw [hzero] at hs
+            exact hsize0 hs.symm
+          have hcount : size.toNat.toUInt64 = size := by
+            exact UInt64.ofNat_toNat
+          refine ⟨univBytes base.value, suffix, hrestBase, ?_, ?_⟩
+          · rw [hvalue]
+            rw [univBytes_addSucc_canonical size.toNat base.value hpos hle
+              hcanonical]
+            simp [Univ.FLAG_ZERO_SUCC, hcount]
+          · exact hstate.trans hafterBase
+      · simp [getUnivTag, hsize0, hle] at h
+        change (Except.error _) = Except.ok (decoded, st') at h
+        contradiction
+  by_cases h1 : flag = 1
+  · subst flag
+    by_cases hsize0 : size = 0
+    · subst size
+      let afterLeft : DecodedUniv maxSuccExpansion →
+          GetM (DecodedUniv maxSuccExpansion) := fun a => do
+        let b ← recur
+        return ⟨.max a.value b.value, .max a.bounded b.bounded⟩
+      change (recur >>= afterLeft).run ⟨pre ++ rest, pre.size⟩ =
+        .ok (decoded, st') at h
+      simp only [StateT.run_bind] at h
+      cases ha : recur.run ⟨pre ++ rest, pre.size⟩ with
+      | error err =>
+        rw [ha] at h
+        contradiction
+      | ok leftResult =>
+        rcases leftResult with ⟨a, afterA⟩
+        rw [ha] at h
+        simp only [bind, Except.bind] at h
+        obtain ⟨afterLeftBytes, hrestA, hafterA⟩ :=
+          hrecur pre rest ha
+        let leftPre := pre ++ univBytes a.value
+        have hafterA' :
+            afterA = ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ := by
+          rw [hafterA]
+          simp [leftPre, hrestA, ByteArray.append_assoc]
+        rw [hafterA'] at h
+        let finish : DecodedUniv maxSuccExpansion →
+            GetM (DecodedUniv maxSuccExpansion) := fun b =>
+          pure ⟨.max a.value b.value, .max a.bounded b.bounded⟩
+        change (recur >>= finish).run
+          ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ =
+            .ok (decoded, st') at h
+        simp only [StateT.run_bind] at h
+        cases hb : recur.run
+            ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ with
+        | error err =>
+          rw [hb] at h
+          contradiction
+        | ok rightResult =>
+          rcases rightResult with ⟨b, afterB⟩
+          rw [hb] at h
+          simp [finish] at h
+          cases h
+          obtain ⟨suffix, hrestB, hafterB⟩ :=
+            hrecur leftPre afterLeftBytes hb
+          let payload := univBytes a.value ++ univBytes b.value
+          refine ⟨payload, suffix, ?_, ?_, ?_⟩
+          · simp [payload, hrestA, hrestB, ByteArray.append_assoc]
+          · simp [payload, Univ.FLAG_MAX, ByteArray.append_assoc]
+          · simpa [payload, leftPre, hrestA, hrestB,
+              ByteArray.append_assoc, ByteArray.size_append, Nat.add_assoc]
+              using hafterB
+    · simp [getUnivTag, hsize0] at h
+      change (Except.error _) = Except.ok (decoded, st') at h
+      contradiction
+  by_cases h2 : flag = 2
+  · subst flag
+    by_cases hsize0 : size = 0
+    · subst size
+      let afterLeft : DecodedUniv maxSuccExpansion →
+          GetM (DecodedUniv maxSuccExpansion) := fun a => do
+        let b ← recur
+        return ⟨.imax a.value b.value, .imax a.bounded b.bounded⟩
+      change (recur >>= afterLeft).run ⟨pre ++ rest, pre.size⟩ =
+        .ok (decoded, st') at h
+      simp only [StateT.run_bind] at h
+      cases ha : recur.run ⟨pre ++ rest, pre.size⟩ with
+      | error err =>
+        rw [ha] at h
+        contradiction
+      | ok leftResult =>
+        rcases leftResult with ⟨a, afterA⟩
+        rw [ha] at h
+        simp only [bind, Except.bind] at h
+        obtain ⟨afterLeftBytes, hrestA, hafterA⟩ :=
+          hrecur pre rest ha
+        let leftPre := pre ++ univBytes a.value
+        have hafterA' :
+            afterA = ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ := by
+          rw [hafterA]
+          simp [leftPre, hrestA, ByteArray.append_assoc]
+        rw [hafterA'] at h
+        let finish : DecodedUniv maxSuccExpansion →
+            GetM (DecodedUniv maxSuccExpansion) := fun b =>
+          pure ⟨.imax a.value b.value, .imax a.bounded b.bounded⟩
+        change (recur >>= finish).run
+          ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ =
+            .ok (decoded, st') at h
+        simp only [StateT.run_bind] at h
+        cases hb : recur.run
+            ⟨leftPre ++ afterLeftBytes, leftPre.size⟩ with
+        | error err =>
+          rw [hb] at h
+          contradiction
+        | ok rightResult =>
+          rcases rightResult with ⟨b, afterB⟩
+          rw [hb] at h
+          simp [finish] at h
+          cases h
+          obtain ⟨suffix, hrestB, hafterB⟩ :=
+            hrecur leftPre afterLeftBytes hb
+          let payload := univBytes a.value ++ univBytes b.value
+          refine ⟨payload, suffix, ?_, ?_, ?_⟩
+          · simp [payload, hrestA, hrestB, ByteArray.append_assoc]
+          · simp [payload, Univ.FLAG_IMAX, ByteArray.append_assoc]
+          · simpa [payload, leftPre, hrestA, hrestB,
+              ByteArray.append_assoc, ByteArray.size_append, Nat.add_assoc]
+              using hafterB
+    · simp [getUnivTag, hsize0] at h
+      change (Except.error _) = Except.ok (decoded, st') at h
+      contradiction
+  by_cases h3 : flag = 3
+  · subst flag
+    simp [getUnivTag] at h
+    cases h
+    exact ⟨ByteArray.empty, rest, by simp,
+      by simp [Univ.FLAG_VAR], by simp⟩
+  · simp [getUnivTag] at h
+    change (Except.error _) = Except.ok (decoded, st') at h
+    contradiction
+
+theorem getUnivFuel_canonical (fuel : Nat) :
+    GetCanonical (getUnivFuel fuel)
+      (fun decoded => univBytes decoded.value) := by
+  induction fuel with
+  | zero =>
+    intro pre rest decoded st' h
+    simp [getUnivFuel] at h
+    change (Except.error _) = Except.ok (decoded, st') at h
+    contradiction
+  | succ fuel ih =>
+    intro pre rest decoded st' h
+    simp only [getUnivFuel, StateT.run_bind] at h
+    cases ht : getTag2.run ⟨pre ++ rest, pre.size⟩ with
+    | error err =>
+      rw [ht] at h
+      contradiction
+    | ok tagResult =>
+      rcases tagResult with ⟨tag, afterTag⟩
+      rw [ht] at h
+      simp only [bind, Except.bind] at h
+      obtain ⟨afterTagBytes, hrestTag, hafterTag⟩ :=
+        getTag2_canonical pre rest ht
+      let tagPre := pre ++ tag2Bytes tag
+      have hafterTag' :
+          afterTag = ⟨tagPre ++ afterTagBytes, tagPre.size⟩ := by
+        rw [hafterTag]
+        simp [tagPre, hrestTag, ByteArray.append_assoc]
+      rw [hafterTag'] at h
+      obtain ⟨payload, suffix, hrestPayload, hencoding, hstate⟩ :=
+        getUnivTag_canonical_of (getUnivFuel fuel) ih tag
+          tagPre afterTagBytes h
+      refine ⟨suffix, ?_, ?_⟩
+      · calc
+          rest = tag2Bytes tag ++ afterTagBytes := hrestTag
+          _ = (tag2Bytes tag ++ payload) ++ suffix := by
+            rw [hrestPayload]
+            simp [ByteArray.append_assoc]
+          _ = univBytes decoded.value ++ suffix := by rw [hencoding]
+      · simpa [tagPre, hrestTag, hrestPayload, ← hencoding,
+          ByteArray.append_assoc, ByteArray.size_append, Nat.add_assoc]
+          using hstate
+
+theorem getUnivCertified_canonical :
+    GetCanonical getUnivCertified
+      (fun decoded => univBytes decoded.value) := by
+  intro pre rest decoded st' h
+  change (getUnivFuel
+      ((pre ++ rest).size - pre.size + 1)).run
+        ⟨pre ++ rest, pre.size⟩ = .ok (decoded, st') at h
+  have hfuel : (pre ++ rest).size - pre.size + 1 = rest.size + 1 := by
+    simp [ByteArray.size_append]
+  rw [hfuel] at h
+  exact getUnivFuel_canonical (rest.size + 1) pre rest h
+
+theorem getUniv_canonical : GetCanonical getUniv univBytes := by
+  intro pre rest value st' h
+  change getUniv ⟨pre ++ rest, pre.size⟩ = .ok (value, st') at h
+  unfold getUniv at h
+  cases hc : getUnivCertified ⟨pre ++ rest, pre.size⟩ with
+  | error err =>
+    rw [hc] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨decoded, afterDecoded⟩
+    rw [hc] at h
+    cases h
+    exact getUnivCertified_canonical pre rest hc
+
+theorem canonicalLaw : CanonicalLaw Univ := by
+  intro input value h
+  change runGet getUniv input = .ok value at h
+  change runPut (putUniv value) = input
+  rw [runPut_eq_of_spec (putUniv_spec value)]
+  simp only [runGet] at h
+  cases hg : getUniv.run ⟨input, 0⟩ with
+  | error err =>
+    rw [hg] at h
+    contradiction
+  | ok result =>
+    rcases result with ⟨decoded, st⟩
+    rw [hg] at h
+    simp only [bind, Except.bind] at h
+    obtain ⟨suffix, hinput, hst⟩ :=
+      getUniv_canonical ByteArray.empty input hg
+    by_cases hfull : st.idx = st.bytes.size
+    · simp [hfull] at h
+      cases h
+      have hsize : (univBytes value).size = input.size := by
+        have hidx := congrArg GetState.idx hst
+        have hbytes := congrArg GetState.bytes hst
+        simp at hidx hbytes
+        rw [hfull, hbytes] at hidx
+        exact hidx.symm
+      have hsuffix : suffix = ByteArray.empty := by
+        have hsizes := congrArg ByteArray.size hinput
+        simpa [ByteArray.size_append, hsize] using hsizes
+      simpa [hsuffix] using hinput.symm
+    · simp [hfull] at h
+
+end UnivLaws
+
+namespace Univ
+
+/-- The canonical universe codec decodes every universe it encodes. -/
+theorem roundtripLaw : Ixon.RoundtripLaw Univ := by
+  intro u
+  change runGet getUniv (runPut (putUniv u)) = .ok u
+  rw [runPut_eq_of_spec (putUniv_spec u)]
+  exact runGet_eq_ok_of_spec (UnivLaws.getUniv_spec u)
+
+/-- Every accepted universe byte string is its unique canonical encoding. -/
+theorem canonicalLaw : Ixon.CanonicalLaw Univ :=
+  UnivLaws.canonicalLaw
+
+end Univ
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/UsageCheck.lean b/Ix/Compiler/Ixon/UsageCheck.lean
new file mode 100644
index 000000000..0da0f3aa5
--- /dev/null
+++ b/Ix/Compiler/Ixon/UsageCheck.lean
@@ -0,0 +1,1306 @@
+import Ix.Compiler.Ixon.Const
+
+/-!
+# Usage checker v0
+
+Whole-value mode checking over Ixon v2 constants — the checked
+pipeline's gate and the executable hypothesis supplier for erasure
+non-interference. Erasure drops explicit 0-mode binders and also ordinary
+binders whose domains are syntactically sort-like; the checker uses that
+same classification and certifies that their runtime demand is zero.
+
+One bottom-up walk per constant computes, for every subterm:
+
+- a **usage vector**: what each context variable experiences —
+  computed usages are `erased` (0), `linear` (1), or `many` (ω);
+  `affine` is a declared *permission*, never a computed count — plus a
+  `moved` flag (consumed at a unique-demand site);
+- a **result ownership** (`Owned`): whether the value may be treated
+  as unique.
+
+Composition is CBV-additive (`Uses.add`); `Uses.mul` appears only as
+the erasure boundary, realized as **ghost mode**: types (all `lam`/
+`all`/`letE` annotations, `all` codomains) and arguments in
+eraser-dropped parameter positions are walked with all recording and
+enforcement off — QTT's 0-fragment. Checks:
+
+- **binders** (`lam`): declared `covers` computed; no dereliction is
+  built into `covers` (`many` never satisfies a `linear`/`affine`
+  demand). A binder the eraser classifies as dropped is additionally
+  rejected if its computed head use is nonzero;
+- **applications**: parameter and argument worlds must agree — a
+  `linear`/`affine` parameter demands a `unique` argument, while a
+  `many` parameter demands a shared argument. Both dereliction and
+  the implicit-freeze direction are rejected in v0;
+- **moves**: a bare variable passed at unique demand is `moved`; a
+  moved variable's total usage must be exactly `linear`
+  (`useAfterMove` otherwise — this is what catches double-moves of
+  `let`-bound uniques, which have no declared mode to `covers`-check);
+- **definitions**: value `lam` modes must equal the type telescope's
+  `all` modes (the kernel-infer/beta-stability direction), and a type
+  promising a `unique` result must get a body that synthesizes one.
+
+Parameter demands come from **syntactic telescopes**: `collectAll`-
+style walks over referenced constants' types (through their sharing
+tables, through `muts` blocks for projections and `recur`). Each demand
+carries the eraser-aligned drop decision as well as its mode and result
+ownership, so normal `many` polymorphic parameters over `Sort` are
+zero-scaled exactly when erasure ghosts them.
+
+This module proves zero usage for every successful ghost walk and exposes
+the accepted-lambda head-zero bridge. `Ix.Compiler.UsageSound` aligns the
+checker classification with the eraser and derives successful-run semantic
+non-interference through their common erased observation.
+
+## v0 limitations (recorded, deliberate)
+
+- **Whole-value modes** (gate B): no field-level mixing; modal
+  inductives arrive later.
+- **Branch-blind counting**: recursor minors are ordinary arguments,
+  so a variable used in two minors counts `many` even though one
+  branch runs. Conservative; the typed checker (lean4ix extension)
+  will max over minors.
+- **Higher-order hole**: positions with unresolvable telescopes
+  (variable-headed applications, arguments beyond a known telescope)
+  are counted non-erased but NOT dereliction-checked — closing this
+  needs types. Sound for counting, incomplete for ownership.
+- **Unique-capturing closures are rejected**: captured usages are not
+  yet scaled by how often the resulting closure may be called, so v0
+  takes the sound conservative route already required by the IxIR₁
+  lowerer. A nested closure may capture shared values, but any runtime
+  use of a unique outer value is an error. QTT-style capture scaling
+  can later admit one-shot/non-freezable closures precisely.
+- **Flow collapsed**: `moved ⟹ single use`. True use-after-move
+  ordering (move at the last use, freeze-points) needs flow
+  sensitivity; with exactly one use the flow is trivial.
+- **Projections are shared** (`prj`, and any projection constant's
+  result): moving fields out of unique structures is the borrow
+  axis's job, later.
+- **Strict lets always count**: an inferred-erased `let` still
+  evaluates (CBV gate); erasure may drop it only under the
+  kernel-totality condition (gate A) — that is erasure's decision,
+  not this checker's.
+- **No type-level reduction**: telescopes hidden behind redexes
+  resolve as unknown.
+- **Exact `lam`/`all` mode agreement** for definitions (subsumption
+  deferred).
+-/
+
+namespace Ix.Compiler.Ixon.UsageCheck
+
+/-! ## Computed usages -/
+
+/-- What checking computes per context variable. -/
+structure VarUse where
+  uses : Uses := .erased
+  moved : Bool := false
+  deriving BEq, Repr, Inhabited
+
+/-- Usage vector, aligned with the binder context (index 0 =
+innermost). Always use qualified `UseVec.*` calls: dot notation on a
+`List` abbrev resolves into `List.*`. -/
+abbrev UseVec := List VarUse
+
+namespace UseVec
+
+def zeros (n : Nat) : UseVec := List.replicate n {}
+
+def single (n i : Nat) : UseVec := (zeros n).set i { uses := .linear }
+
+def singleMoved (n i : Nat) : UseVec :=
+  (zeros n).set i { uses := .linear, moved := true }
+
+def add (a b : UseVec) : UseVec :=
+  List.zipWith (fun x y => { uses := x.uses.add y.uses, moved := x.moved || y.moved }) a b
+
+/-- The one executable use of multiplicative grading: erase every recorded
+runtime demand at a source-only boundary. Nonzero modes are deliberately not
+scaled; they compose through `add` plus the flow-sensitive ownership rules. -/
+def zeroScale : UseVec → UseVec
+  | [] => []
+  | use :: rest =>
+    { uses := Uses.mul .erased use.uses, moved := false } :: zeroScale rest
+
+@[simp] theorem zeros_zero : zeros 0 = [] := rfl
+
+@[simp] theorem zeros_succ (n : Nat) :
+    zeros (n + 1) = {} :: zeros n := by
+  rw [zeros, List.replicate_succ]
+  rfl
+
+@[simp] theorem add_zeros (n : Nat) :
+    add (zeros n) (zeros n) = zeros n := by
+  simp [add, zeros]
+
+@[simp] theorem zeroScale_eq_zeros (uses : UseVec) :
+    zeroScale uses = zeros uses.length := by
+  induction uses with
+  | nil => rfl
+  | cons use rest ih =>
+    simp [zeroScale, zeros, List.replicate_succ, ih]
+
+end UseVec
+
+#guard UseVec.zeroScale
+    [{ uses := .many, moved := true }, { uses := .linear, moved := true }] ==
+  UseVec.zeros 2
+
+/-- The world a binder's value lives in, derived from its declared
+usage: `linear`/`affine` are the unique world, `many` the shared one.
+(`erased` binders get `shared`; their runtime use already fails the
+`covers` check, so the world is never load-bearing.) -/
+def worldOf : Uses → Owned
+  | .linear | .affine => .unique
+  | _ => .shared
+
+/-- A fresh closure with only reusable runtime parameters and a shared
+result uses the existing shared-PAP representation. Successful lambda
+checking separately rules out unique captures. Erased parameters disappear
+before that representation is selected. Other callable modes retain the
+unique classification and the existing downstream restrictions. -/
+def closureWorld (uses : Uses) (result : Owned) : Owned :=
+  if (uses == .many || uses == .erased) && result == .shared then .shared else .unique
+
+theorem closureWorld_shared_iff {uses : Uses} {result : Owned} :
+    closureWorld uses result = .shared ↔
+      (uses = .many ∨ uses = .erased) ∧ result = .shared := by
+  cases uses <;> cases result <;> simp [closureWorld]
+
+/-! ## Errors -/
+
+inductive UsageErr where
+  /-- Declared binder usage does not cover the computed usage. -/
+  | binderCovers (declared computed : Uses)
+  /-- A moved (unique-demand-consumed) variable was used more than
+  once in total. -/
+  | useAfterMove (computed : Uses)
+  /-- The eraser classifies a sort-like binder as compile-time-only,
+  but checking found a runtime use of its value. -/
+  | typeBinderRuntimeUse (computed : Uses)
+  /-- A shared value was supplied where a `linear`/`affine` parameter
+  demands a unique one. -/
+  | dereliction (demanded : Uses)
+  /-- A unique value reached a non-unique sink. The v0 checker and
+  lowering deliberately reject this implicit coercion until a deep
+  freeze operation has a representation and cost model. -/
+  | freezeNeeded
+  /-- A definition value's `lam` mode differs from its type's `all`
+  mode at the same telescope position. -/
+  | lamAllMismatch (lamUses allUses : Uses)
+  /-- The definition's type promises a `unique` result but the body
+  synthesizes a shared one. -/
+  | resultNotUnique (got : Owned)
+  /-- A nested closure uses a unique value from its outer context.
+  Such captures need multiplicity scaling/one-shot closure support. -/
+  | uniqueCapture (idx : Nat)
+  /-- A nonempty type telescope was implemented without the matching
+  leading lambda telescope. -/
+  | definitionExpectedLambda (remaining : Nat)
+  | unboundVar (idx : Nat)
+  | badShareIdx (idx : Nat)
+  | badRefIdx (idx : Nat)
+  | badRecurIdx (idx : Nat)
+  | fuel
+  | internal (msg : String)
+  deriving BEq, Repr
+
+/-- Stable user-facing diagnostic for the v0 freeze restriction. -/
+def UsageErr.message : UsageErr → String
+  | .freezeNeeded =>
+      "freeze not in v0: unique value at non-unique sink " ++
+      "(see docs/compiler/lowering-restrictions.md)"
+  | e => reprStr e
+
+/-! ## Telescopes from mode-annotated types -/
+
+/-- Syntactic sort-valued telescope test, deliberately identical to the
+eraser's `sortLike`.  It lives here as well because UsageCheck is the
+upstream gate and does not import the erasure layer. -/
+def erasureSortLike (sharing : Array Expr) : Nat → Expr → Bool
+  | 0, _ => false
+  | fuel + 1, e =>
+    match e with
+    | .sort _ => true
+    | .all _ _ _ codomain => erasureSortLike sharing fuel codomain
+    | .share index =>
+      match sharing[index.toNat]? with
+      | some target => erasureSortLike sharing fuel target
+      | none => false
+    | _ => false
+
+/-- Binder classification shared extensionally with erasure: an explicit
+zero-mode binder or a syntactically sort-valued telescope is dropped. -/
+def erasureDropsBinder (sharing : Array Expr) (fuel : Nat)
+    (uses : Uses) (domain : Expr) : Bool :=
+  uses == .erased || erasureSortLike sharing fuel domain
+
+/-- Per-argument demand: the declared mode, the application's result world
+at that point, and the eraser-aligned zero-scaling decision.  The third field
+matters for ordinary Lean-style type parameters whose declared mode is
+`many` but whose domain is sort-like. -/
+structure Demand where
+  uses : Uses
+  owned : Owned
+  dropped : Bool
+
+abbrev Telescope := List Demand
+
+/-- Syntactic telescope of a type expression, expanding shares against
+the owning constant's table. Malformed foreign types degrade to a
+shorter (conservative) telescope, never to an error — checking stays
+modular. -/
+def telescopeOf (sharing : Array Expr) (fuel : Nat) (e : Expr) : Telescope :=
+  match fuel with
+  | 0 => []
+  | fuel + 1 =>
+    match e with
+    | .all uses owned domain codomain =>
+      { uses, owned
+        dropped := erasureDropsBinder sharing fuel uses domain } ::
+        telescopeOf sharing fuel codomain
+    | .share index =>
+      match sharing[index.toNat]? with
+      | some target => telescopeOf sharing fuel target
+      | none => []
+    | _ => []
+
+def mutTyp : MutConst → Expr
+  | .defn d => d.typ
+  | .indc i => i.typ
+  | .recr r => r.typ
+
+/-- A constant's type together with the sharing table it must be read
+against — chasing projection constants into their `muts` blocks. -/
+def constTypeSharing (resolve : Address → Option Constant) (c : Constant) :
+    Option (Expr × Array Expr) :=
+  match c.info with
+  | .defn d => some (d.typ, c.sharing)
+  | .recr r => some (r.typ, c.sharing)
+  | .axio a => some (a.typ, c.sharing)
+  | .quot q => some (q.typ, c.sharing)
+  | .muts _ => none
+  | .iPrj p => do
+    let blk ← resolve p.block
+    match blk.info with
+    | .muts ms =>
+      match ms[p.idx.toNat]? with
+      | some (.indc i) => some (i.typ, blk.sharing)
+      | _ => none
+    | _ => none
+  | .cPrj p => do
+    let blk ← resolve p.block
+    match blk.info with
+    | .muts ms =>
+      match ms[p.idx.toNat]? with
+      | some (.indc i) => do
+        let ct ← i.ctors[p.cidx.toNat]?
+        some (ct.typ, blk.sharing)
+      | _ => none
+    | _ => none
+  | .rPrj p => do
+    let blk ← resolve p.block
+    match blk.info with
+    | .muts ms =>
+      match ms[p.idx.toNat]? with
+      | some (.recr r) => some (r.typ, blk.sharing)
+      | _ => none
+    | _ => none
+  | .dPrj p => do
+    let blk ← resolve p.block
+    match blk.info with
+    | .muts ms =>
+      match ms[p.idx.toNat]? with
+      | some (.defn d) => some (d.typ, blk.sharing)
+      | _ => none
+    | _ => none
+
+/-! ## The checker -/
+
+/-- Checking context: how to resolve foreign constants, plus the
+current constant's tables (and block members, for `recur`). -/
+structure CheckCtx where
+  resolve : Address → Option Constant
+  sharing : Array Expr := #[]
+  refs : Array Address := #[]
+  selfMuts : Array MutConst := #[]
+
+def defaultFuel : Nat := 100000
+
+/-- Expand top-level shares (for head/argument shape analysis). -/
+def expandShareE (ctx : CheckCtx) (fuel : Nat) (e : Expr) :
+    Except UsageErr Expr :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match e with
+    | .share i =>
+      match ctx.sharing[i.toNat]? with
+      | none => .error (.badShareIdx i.toNat)
+      | some e' => expandShareE ctx fuel e'
+    | e => .ok e
+
+/-- Demand telescope of an application head. Unresolvable heads yield
+`[]` (conservative: count, don't ownership-check); a `lam` head
+supplies its binder usages with unknown (shared) results. -/
+def telescopeOfHead (ctx : CheckCtx) (fuel : Nat) : Expr → Except UsageErr Telescope
+  | .ref idx _ =>
+    match ctx.refs[idx.toNat]? with
+    | none => .error (.badRefIdx idx.toNat)
+    | some a =>
+      match ctx.resolve a with
+      | none => .ok []
+      | some c =>
+        match constTypeSharing ctx.resolve c with
+        | none => .ok []
+        | some (typ, sh) => .ok (telescopeOf sh fuel typ)
+  | .recur idx _ =>
+    match ctx.selfMuts[idx.toNat]? with
+    | none => .error (.badRecurIdx idx.toNat)
+    | some m => .ok (telescopeOf ctx.sharing fuel (mutTyp m))
+  | e@(.lam ..) => .ok ((Expr.collectLam e).1.map fun (uses, domain) =>
+      { uses, owned := .shared
+        dropped := erasureDropsBinder ctx.sharing fuel uses domain })
+  | _ => .ok []
+
+private def headEntry : UseVec → Except UsageErr (VarUse × UseVec)
+  | e :: rest => .ok (e, rest)
+  | [] => .error (.internal "empty usage vector at binder")
+
+/-- v0 closure rule: shared captures may be duplicated with RC, but a
+runtime use of a unique outer value would require a one-shot closure
+or QTT scaling that this checker/lowerer pair does not yet model. -/
+private def rejectUniqueCaptures : Nat → UseVec → List Owned →
+    Except UsageErr Unit
+  | _, [], [] => .ok ()
+  | i, use :: uses, world :: worlds =>
+    if use.uses != .erased && world == .unique then
+      .error (.uniqueCapture i)
+    else
+      rejectUniqueCaptures (i + 1) uses worlds
+  | _, _, _ => .error (.internal "capture vector/world length mismatch")
+
+mutual
+
+/-- Compute the usage vector and result ownership of `e` under binder
+worlds `ws`. `ghost` is the 0-fragment: walk for well-formedness, but
+record nothing and enforce no usage checks. -/
+def check (ctx : CheckCtx) (fuel : Nat) (ghost : Bool) (ws : List Owned)
+    (e : Expr) : Except UsageErr (UseVec × Owned) :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match e with
+    | .var i =>
+      match ws[i.toNat]? with
+      | none => .error (.unboundVar i.toNat)
+      | some w =>
+        if ghost then .ok (UseVec.zeros ws.length, .shared)
+        else .ok (UseVec.single ws.length i.toNat, w)
+    | .sort _ => .ok (UseVec.zeros ws.length, .shared)
+    | .str _ => .ok (UseVec.zeros ws.length, .unique)
+    | .nat _ => .ok (UseVec.zeros ws.length, .unique)
+    | .ref idx _ =>
+      if ctx.refs[idx.toNat]?.isNone then .error (.badRefIdx idx.toNat)
+      else .ok (UseVec.zeros ws.length, .shared)
+    | .recur idx _ =>
+      if ctx.selfMuts[idx.toNat]?.isNone then
+        .error (.badRecurIdx idx.toNat)
+      else
+        .ok (UseVec.zeros ws.length, .shared)
+    | .prj _ _ val => do
+      let (uv, _) ← check ctx fuel ghost ws val
+      return (uv, .shared)
+    | .lam u ty body => do
+      discard <| check ctx fuel true ws ty
+      let (uvB, ownB) ← check ctx fuel ghost (worldOf u :: ws) body
+      let (entry, rest) ← headEntry uvB
+      unless ghost do
+        unless u.covers entry.uses do throw (.binderCovers u entry.uses)
+        if erasureDropsBinder ctx.sharing fuel u ty &&
+            entry.uses != .erased then
+          throw (.typeBinderRuntimeUse entry.uses)
+        if entry.moved && entry.uses != .linear then
+          throw (.useAfterMove entry.uses)
+        rejectUniqueCaptures 0 rest ws
+      return (rest, closureWorld u ownB)
+    | .all _ _ ty cod => do
+      discard <| check ctx fuel true ws ty
+      discard <| check ctx fuel true (.shared :: ws) cod
+      return (UseVec.zeros ws.length, .shared)
+    | .letE _ ty val body => do
+      discard <| check ctx fuel true ws ty
+      let (uvV, ownV) ← check ctx fuel ghost ws val
+      if !ghost && ownV == .unique then
+        throw .freezeNeeded
+      let (uvB, ownB) ← check ctx fuel ghost (ownV :: ws) body
+      let (entry, rest) ← headEntry uvB
+      unless ghost do
+        if entry.moved && entry.uses != .linear then
+          throw (.useAfterMove entry.uses)
+      return (UseVec.add uvV rest, ownB)
+    | .app f a => do
+      let (args, base₀) := Expr.collectApp (.app f a)
+      let base ← expandShareE ctx fuel base₀
+      let tel ← telescopeOfHead ctx fuel base
+      let (uvBase, _) ← check ctx fuel ghost ws base
+      let uv ← checkArgs ctx fuel ghost ws tel 0 args uvBase
+      let own := if ghost then Owned.shared
+        else ((tel[args.length - 1]?).map (·.owned)).getD .shared
+      return (uv, own)
+    | .share i =>
+      match ctx.sharing[i.toNat]? with
+      | none => .error (.badShareIdx i.toNat)
+      | some e' => check ctx fuel ghost ws e'
+  termination_by fuel
+
+/-- Fold an application spine's arguments (position `i` against the
+telescope) into the accumulated usage vector. -/
+def checkArgs (ctx : CheckCtx) (fuel : Nat) (ghost : Bool)
+    (ws : List Owned) (tel : Telescope) (i : Nat) (args : List Expr)
+    (acc : UseVec) : Except UsageErr UseVec :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match args with
+    | [] => .ok acc
+    | arg :: rest => do
+      let contrib ← match tel[i]? with
+        | some demand =>
+          if demand.dropped then
+            do
+              -- 0-scaling: the argument is compile-time only.
+              let (uvA, _) ← check ctx fuel true ws arg
+              pure (UseVec.zeroScale uvA)
+          else
+            do
+              let argX ← expandShareE ctx fuel arg
+              let (uvA, ownA) ← check ctx fuel ghost ws argX
+              let uniqueDemand := demand.uses == Uses.linear ||
+                demand.uses == Uses.affine
+              if !ghost && uniqueDemand && ownA != .unique then
+                throw (.dereliction demand.uses)
+              if !ghost && !uniqueDemand && ownA == .unique then
+                throw .freezeNeeded
+              pure <| if !ghost && uniqueDemand then
+                  match argX with
+                  | .var j => UseVec.singleMoved ws.length j.toNat
+                  | _ => uvA
+                else uvA
+        | none => do
+          -- Unknown demand: count (non-erased), no ownership check.
+          let (uvA, _) ← check ctx fuel ghost ws arg
+          pure uvA
+      checkArgs ctx fuel ghost ws tel (i + 1) rest (UseVec.add acc contrib)
+  termination_by fuel
+
+end
+
+/-! ## Executable-checker metatheory
+
+The first invariant makes the QTT zero fragment mechanical: a successful
+ghost walk contributes exactly the all-zero vector.  It is proved against the
+real mutually recursive checker, including application-spine collection and
+sharing expansion, rather than against a parallel declarative approximation.
+-/
+
+private def GhostZeroAt (fuel : Nat) : Prop :=
+  (∀ ctx ws e uv own,
+      check ctx fuel true ws e = .ok (uv, own) →
+      uv = UseVec.zeros ws.length) ∧
+  (∀ ctx ws tel i args uv,
+      checkArgs ctx fuel true ws tel i args (UseVec.zeros ws.length) =
+          .ok uv →
+      uv = UseVec.zeros ws.length)
+
+@[simp] private theorem exceptBindOk {α β : Type} (a : α)
+    (f : α → Except UsageErr β) :
+    (Except.ok a >>= f) = f a := rfl
+
+@[simp] private theorem exceptBindErr {α β : Type} (err : UsageErr)
+    (f : α → Except UsageErr β) :
+    (Except.error err >>= f) = Except.error err := rfl
+
+@[simp] private theorem exceptBindPure {α β : Type} (a : α)
+    (f : α → Except UsageErr β) :
+    (do let x ← (pure a : Except UsageErr α); f x) = f a := rfl
+
+@[simp] private theorem exceptDiscardOk {α : Type} (a : α) :
+    discard (Except.ok a : Except UsageErr α) = .ok () := rfl
+
+@[simp] private theorem exceptDiscardErr {α : Type} (err : UsageErr) :
+    discard (Except.error err : Except UsageErr α) = .error err := rfl
+
+@[simp] private theorem exceptThrow {α : Type} (err : UsageErr) :
+    (throw err : Except UsageErr α) = .error err := rfl
+
+private theorem exceptOkPairFst {α β : Type} {a b : α} {x y : β}
+    (h : (Except.ok (a, x) : Except UsageErr (α × β)) = .ok (b, y)) :
+    a = b :=
+  congrArg Prod.fst (Except.ok.inj h)
+
+private theorem ghostZeroAt : ∀ fuel, GhostZeroAt fuel := by
+  intro fuel
+  induction fuel with
+  | zero =>
+    constructor
+    · intro ctx ws e uv own h
+      simp [check] at h
+    · intro ctx ws tel i args uv h
+      simp [checkArgs] at h
+  | succ fuel ih =>
+    obtain ⟨ihCheck, ihArgs⟩ := ih
+    constructor
+    · intro ctx ws e uv own h
+      cases e with
+      | var idx =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        split at h <;> simp_all
+      | sort idx =>
+        rw [check.eq_def] at h
+        exact (exceptOkPairFst h).symm
+      | str idx =>
+        rw [check.eq_def] at h
+        exact (exceptOkPairFst h).symm
+      | nat idx =>
+        rw [check.eq_def] at h
+        exact (exceptOkPairFst h).symm
+      | ref idx univs =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        split at h <;> simp_all
+      | recur idx univs =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        split at h <;> simp_all
+      | prj typeIdx fieldIdx value =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        cases hv : check ctx fuel true ws value with
+        | error err =>
+          rw [hv] at h
+          simp only [exceptBindErr] at h
+          contradiction
+        | ok result =>
+          rcases result with ⟨valueUses, valueOwn⟩
+          have hzero := ihCheck _ _ _ _ _ hv
+          rw [hv] at h
+          simp only [exceptBindOk] at h
+          exact (exceptOkPairFst h).symm.trans hzero
+      | lam uses domain body =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        cases hd : check ctx fuel true ws domain with
+        | error err =>
+          rw [hd] at h
+          contradiction
+        | ok domainResult =>
+          rw [hd] at h
+          cases hb : check ctx fuel true (worldOf uses :: ws) body with
+          | error err =>
+            rw [hb] at h
+            simp only [exceptBindErr] at h
+            contradiction
+          | ok bodyResult =>
+            rcases bodyResult with ⟨bodyUses, bodyOwn⟩
+            rw [hb] at h
+            simp only [exceptBindOk] at h
+            cases he : headEntry bodyUses with
+            | error err =>
+              rw [he] at h
+              simp only [exceptBindErr] at h
+              contradiction
+            | ok entryRest =>
+              rcases entryRest with ⟨entry, rest⟩
+              have hzero := ihCheck _ _ _ _ _ hb
+              have heShape := he
+              rw [hzero] at heShape
+              simp [headEntry] at heShape
+              rw [he] at h
+              simp only [exceptBindOk, if_true] at h
+              exact (exceptOkPairFst h).symm.trans heShape.2.symm
+      | all uses owned domain codomain =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        cases hd : check ctx fuel true ws domain with
+        | error err =>
+          rw [hd] at h
+          contradiction
+        | ok domainResult =>
+          rw [hd] at h
+          cases hc : check ctx fuel true (.shared :: ws) codomain with
+          | error err =>
+            rw [hc] at h
+            contradiction
+          | ok codomainResult =>
+            rw [hc] at h
+            exact (exceptOkPairFst h).symm
+      | letE nondep type value body =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        cases ht : check ctx fuel true ws type with
+        | error err =>
+          rw [ht] at h
+          simp only at h
+          contradiction
+        | ok typeResult =>
+          rw [ht] at h
+          simp only at h
+          cases hv : check ctx fuel true ws value with
+          | error err =>
+            rw [hv] at h
+            simp only [exceptBindErr] at h
+            contradiction
+          | ok valueResult =>
+            rcases valueResult with ⟨valueUses, valueOwn⟩
+            rw [hv] at h
+            simp only [exceptBindOk, Bool.not_true, Bool.false_and] at h
+            cases hb : check ctx fuel true (valueOwn :: ws) body with
+            | error err =>
+              rw [hb] at h
+              simp only [exceptBindErr] at h
+              contradiction
+            | ok bodyResult =>
+              rcases bodyResult with ⟨bodyUses, bodyOwn⟩
+              rw [hb] at h
+              simp only [exceptBindOk] at h
+              cases he : headEntry bodyUses with
+              | error err =>
+                rw [he] at h
+                simp only [exceptBindErr] at h
+                contradiction
+              | ok entryRest =>
+                rcases entryRest with ⟨entry, rest⟩
+                have hvzero := ihCheck _ _ _ _ _ hv
+                have hbzero := ihCheck _ _ _ _ _ hb
+                have heShape := he
+                rw [hbzero] at heShape
+                simp [headEntry] at heShape
+                rw [he] at h
+                simp only [exceptBindOk, if_true] at h
+                rw [← exceptOkPairFst h, hvzero, ← heShape.2]
+                exact UseVec.add_zeros ws.length
+      | app function argument =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        let collected := Expr.collectApp (.app function argument)
+        cases hx : expandShareE ctx fuel collected.2 with
+        | error err =>
+          rw [show Expr.collectApp (.app function argument) = collected from rfl,
+            hx] at h
+          simp only [exceptBindErr] at h
+          contradiction
+        | ok base =>
+          rw [show Expr.collectApp (.app function argument) = collected from rfl,
+            hx] at h
+          simp only [exceptBindOk] at h
+          cases ht : telescopeOfHead ctx fuel base with
+          | error err =>
+            rw [ht] at h
+            simp only [exceptBindErr] at h
+            contradiction
+          | ok telescope =>
+            rw [ht] at h
+            simp only [exceptBindOk] at h
+            cases hb : check ctx fuel true ws base with
+            | error err =>
+              rw [hb] at h
+              simp only [exceptBindErr] at h
+              contradiction
+            | ok baseResult =>
+              rcases baseResult with ⟨baseUses, baseOwn⟩
+              rw [hb] at h
+              simp only [exceptBindOk] at h
+              cases ha : checkArgs ctx fuel true ws telescope 0 collected.1
+                  baseUses with
+              | error err =>
+                rw [ha] at h
+                simp only [exceptBindErr] at h
+                contradiction
+              | ok argsUses =>
+                have hzero := ihCheck _ _ _ _ _ hb
+                have haZero := ha
+                rw [hzero] at haZero
+                have hazero := ihArgs _ _ _ _ _ _ haZero
+                rw [ha] at h
+                simp only [exceptBindOk, if_true] at h
+                exact (exceptOkPairFst h).symm.trans hazero
+      | share idx =>
+        rw [check.eq_def] at h
+        dsimp only at h
+        cases hs : ctx.sharing[idx.toNat]? with
+        | none =>
+          rw [hs] at h
+          contradiction
+        | some shared =>
+          rw [hs] at h
+          exact ihCheck _ _ _ _ _ h
+    · intro ctx ws tel i args uv h
+      cases args with
+      | nil =>
+        rw [checkArgs.eq_def] at h
+        exact (Except.ok.inj h).symm
+      | cons argument rest =>
+        rw [checkArgs.eq_def] at h
+        dsimp only at h
+        cases hp : tel[i]? with
+        | none =>
+          rw [hp] at h
+          simp only at h
+          cases ha : check ctx fuel true ws argument with
+          | error err =>
+            rw [ha] at h
+            simp only [exceptBindErr] at h
+            contradiction
+          | ok argResult =>
+            rcases argResult with ⟨argUses, argOwn⟩
+            have hzero := ihCheck _ _ _ _ _ ha
+            rw [ha] at h
+            simp only [exceptBindOk] at h
+            simp only [exceptBindPure] at h
+            rw [hzero, UseVec.add_zeros] at h
+            exact ihArgs _ _ _ _ _ _ h
+        | some policy =>
+          rcases policy with ⟨demandUses, resultOwn, dropped⟩
+          cases dropped with
+          | true =>
+            rw [hp] at h
+            simp only [if_true] at h
+            cases ha : check ctx fuel true ws argument with
+            | error err =>
+              rw [ha] at h
+              contradiction
+            | ok argResult =>
+              rcases argResult with ⟨argUses, argOwn⟩
+              have hzero := ihCheck _ _ _ _ _ ha
+              rw [ha] at h
+              simp only [exceptBindOk, exceptBindPure] at h
+              rw [hzero, UseVec.zeroScale_eq_zeros] at h
+              have hlength : (UseVec.zeros ws.length).length = ws.length := by
+                simp [UseVec.zeros]
+              rw [hlength, UseVec.add_zeros] at h
+              exact ihArgs _ _ _ _ _ _ h
+          | false =>
+            rw [hp] at h
+            simp only [Bool.false_eq_true, if_false] at h
+            cases hx : expandShareE ctx fuel argument with
+            | error err =>
+              rw [hx] at h
+              simp only [exceptBindErr] at h
+              contradiction
+            | ok expanded =>
+              rw [hx] at h
+              simp only [exceptBindOk] at h
+              cases ha : check ctx fuel true ws expanded with
+              | error err =>
+                rw [ha] at h
+                simp only [exceptBindErr] at h
+                contradiction
+              | ok argResult =>
+                rcases argResult with ⟨argUses, argOwn⟩
+                have hzero := ihCheck _ _ _ _ _ ha
+                rw [ha] at h
+                simp only [exceptBindOk] at h
+                simp only [Bool.not_true, Bool.false_and,
+                  Bool.false_eq_true, if_false,
+                  exceptBindPure] at h
+                rw [hzero, UseVec.add_zeros] at h
+                exact ihArgs _ _ _ _ _ _ h
+
+/-- Successful ghost checking records no runtime use of any binder. -/
+theorem check_ghost_zeros {ctx : CheckCtx} {fuel : Nat}
+    {ws : List Owned} {e : Expr} {uv : UseVec} {own : Owned}
+    (h : check ctx fuel true ws e = .ok (uv, own)) :
+    uv = UseVec.zeros ws.length :=
+  (ghostZeroAt fuel).1 _ _ _ _ _ h
+
+/-- Public elimination rule for the checker's private binder-vector splitter.
+Clients can consume checker certificates without depending on its helper's
+implementation name. -/
+theorem headEntry_ok_iff {uses : UseVec} {entry : VarUse} {rest : UseVec} :
+    headEntry uses = .ok (entry, rest) ↔ uses = entry :: rest := by
+  cases uses <;> simp [headEntry]
+
+/-- Every captured unique context entry has zero runtime demand. The relation
+also records that the usage vector and context have the same length. -/
+inductive SharedCaptures : UseVec → List Owned → Prop where
+  | nil : SharedCaptures [] []
+  | cons {use : VarUse} {world : Owned} {uses : UseVec} {worlds : List Owned}
+      (head : world = .unique → use.uses = .erased)
+      (tail : SharedCaptures uses worlds) :
+      SharedCaptures (use :: uses) (world :: worlds)
+
+private theorem rejectUniqueCaptures_shared {start : Nat} {uses : UseVec}
+    {worlds : List Owned} (h : rejectUniqueCaptures start uses worlds = .ok ()) :
+    SharedCaptures uses worlds := by
+  induction uses generalizing start worlds with
+  | nil =>
+    cases worlds with
+    | nil => exact .nil
+    | cons world worlds => simp [rejectUniqueCaptures] at h
+  | cons use uses ih =>
+    cases worlds with
+    | nil => simp [rejectUniqueCaptures] at h
+    | cons world worlds =>
+      simp only [rejectUniqueCaptures] at h
+      split at h
+      · contradiction
+      · rename_i safe
+        exact .cons (by intro unique; simpa [unique] using safe) (ih h)
+
+/-- Inversion of the actual runtime checker: a lambda classified as shared
+has a reusable or erased parameter, a body that synthesizes shared, and no
+runtime capture of a unique value. No conversion of an existing unique value
+is hidden in the fresh-closure classification. -/
+theorem check_lam_shared {ctx : CheckCtx} {fuel : Nat} {worlds : List Owned}
+    {uses : Uses} {domain body : Expr} {outerUses : UseVec}
+    (hcheck : check ctx (fuel + 1) false worlds (.lam uses domain body) =
+      .ok (outerUses, .shared)) :
+    (uses = .many ∨ uses = .erased) ∧ SharedCaptures outerUses worlds ∧
+      ∃ entry, check ctx fuel false (worldOf uses :: worlds) body =
+        .ok (entry :: outerUses, .shared) := by
+  rw [check.eq_def] at hcheck
+  dsimp only at hcheck
+  cases hd : check ctx fuel true worlds domain with
+  | error err => rw [hd] at hcheck; contradiction
+  | ok domainResult =>
+    rw [hd] at hcheck
+    cases hb : check ctx fuel false (worldOf uses :: worlds) body with
+    | error err =>
+      rw [hb] at hcheck
+      simp only [exceptBindErr] at hcheck
+      contradiction
+    | ok bodyResult =>
+      rcases bodyResult with ⟨bodyUses, bodyOwn⟩
+      rw [hb] at hcheck
+      simp only [exceptBindOk] at hcheck
+      cases he : headEntry bodyUses with
+      | error err =>
+        rw [he] at hcheck
+        simp only [exceptBindErr] at hcheck
+        contradiction
+      | ok entryRest =>
+        rcases entryRest with ⟨entry, rest⟩
+        rw [he] at hcheck
+        by_cases hcovers : uses.covers entry.uses = true
+        · by_cases hdrop : erasureDropsBinder ctx.sharing fuel uses domain = true ∧
+              entry.uses ≠ .erased
+          · simp [hcovers, hdrop, exceptThrow, exceptBindErr] at hcheck
+          · by_cases hmove : entry.moved = true ∧ entry.uses ≠ .linear
+            · simp [hcovers, hdrop, hmove, exceptThrow, exceptBindErr] at hcheck
+            · cases hc : rejectUniqueCaptures 0 rest worlds with
+              | error err =>
+                simp [hcovers, hdrop, hmove, hc, Functor.map, Except.map] at hcheck
+              | ok done =>
+                cases done
+                have result : rest = outerUses ∧ closureWorld uses bodyOwn = .shared := by
+                  simpa [hcovers, hdrop, hmove, hc, Functor.map, Except.map] using hcheck
+                have classification := closureWorld_shared_iff.mp result.2
+                rcases result with ⟨rfl, _⟩
+                refine ⟨classification.1, rejectUniqueCaptures_shared hc, entry, ?_⟩
+                rw [headEntry_ok_iff.mp he, classification.2]
+        · simp [hcovers, exceptThrow, exceptBindErr] at hcheck
+
+/-- If the executable checker accepts a lambda whose binder the executable
+eraser classifies as dropped, the body's computed usage for that binder is
+exactly zero.  This covers both explicit `Uses.erased` and sort-like type
+binders; the latter is the gate condition that was previously implicit. -/
+theorem check_lam_dropped_entry_erased {ctx : CheckCtx} {fuel : Nat}
+    {ws : List Owned} {uses : Uses} {domain body : Expr}
+    {outerUses : UseVec} {own : Owned}
+    (hdrop : erasureDropsBinder ctx.sharing fuel uses domain = true)
+    (hcheck : check ctx (fuel + 1) false ws (.lam uses domain body) =
+      .ok (outerUses, own)) :
+    ∃ bodyUses bodyOwn entry rest,
+      check ctx fuel false (worldOf uses :: ws) body =
+        .ok (bodyUses, bodyOwn) ∧
+      headEntry bodyUses = .ok (entry, rest) ∧
+      entry.uses = .erased := by
+  rw [check.eq_def] at hcheck
+  dsimp only at hcheck
+  cases hd : check ctx fuel true ws domain with
+  | error err =>
+    rw [hd] at hcheck
+    contradiction
+  | ok domainResult =>
+    rw [hd] at hcheck
+    cases hb : check ctx fuel false (worldOf uses :: ws) body with
+    | error err =>
+      rw [hb] at hcheck
+      simp only [exceptBindErr] at hcheck
+      contradiction
+    | ok bodyResult =>
+      rcases bodyResult with ⟨bodyUses, bodyOwn⟩
+      rw [hb] at hcheck
+      simp only [exceptBindOk] at hcheck
+      cases he : headEntry bodyUses with
+      | error err =>
+        rw [he] at hcheck
+        simp only [exceptBindErr] at hcheck
+        contradiction
+      | ok entryRest =>
+        rcases entryRest with ⟨entry, rest⟩
+        have hentry : entry.uses = .erased := by
+          by_cases hzero : entry.uses = .erased
+          · exact hzero
+          · by_cases hcovers : uses.covers entry.uses = true
+            · simp [he, hcovers, hdrop, hzero, exceptThrow,
+                exceptBindErr] at hcheck
+            · simp [he, hcovers, exceptThrow, exceptBindErr] at hcheck
+        exact ⟨bodyUses, bodyOwn, entry, rest, rfl, he, hentry⟩
+
+/-! ## Constant-level entry points -/
+
+private def validateBinders : List (Uses × Bool) → UseVec →
+    Except UsageErr Unit
+  | [], _ => .ok ()
+  | (u, dropped) :: us, entry :: uv => do
+    unless u.covers entry.uses do throw (.binderCovers u entry.uses)
+    if dropped && entry.uses != .erased then
+      throw (.typeBinderRuntimeUse entry.uses)
+    if entry.moved && entry.uses != .linear then
+      throw (.useAfterMove entry.uses)
+    validateBinders us uv
+  | _ :: _, [] => .error (.internal "usage vector shorter than binders")
+
+/-- Peel a definition value's `lam` telescope against its type's `all`
+telescope (exact mode agreement), then check the body under the
+accumulated binders. `lastOwned` tracks the promised result ownership
+of the innermost peeled arrow. -/
+def peelDefn (ctx : CheckCtx) (fuel : Nat) (tel : Telescope)
+    (lastOwned : Owned) (ws : List Owned)
+    (declared : List (Uses × Bool))
+    (e : Expr) : Except UsageErr Unit :=
+  match fuel with
+  | 0 => .error .fuel
+  | fuel + 1 =>
+    match tel, e with
+    | demand :: telRest, .lam u ty body => do
+      discard <| check ctx fuel true ws ty
+      unless u == demand.uses do throw (.lamAllMismatch u demand.uses)
+      peelDefn ctx fuel telRest demand.owned (worldOf u :: ws)
+        ((u, erasureDropsBinder ctx.sharing fuel u ty) :: declared) body
+    | tel', .share i =>
+      match ctx.sharing[i.toNat]? with
+      | none => .error (.badShareIdx i.toNat)
+      | some e' => peelDefn ctx fuel tel' lastOwned ws declared e'
+    | [], body => do
+      let (uv, own) ← check ctx fuel false ws body
+      if lastOwned == .unique && own != .unique then
+        throw (.resultNotUnique own)
+      if lastOwned != .unique && own == .unique then
+        throw .freezeNeeded
+      validateBinders declared uv
+    | remaining, _ => throw (.definitionExpectedLambda remaining.length)
+  termination_by fuel
+
+def checkDefinition (resolve : Address → Option Constant) (c : Constant)
+    (d : Definition) (fuel : Nat := defaultFuel) : Except UsageErr Unit := do
+  let ctx : CheckCtx :=
+    { resolve, sharing := c.sharing, refs := c.refs
+      selfMuts := selfMutsOf c.info }
+  discard <| check ctx fuel true [] d.typ
+  peelDefn ctx fuel (telescopeOf c.sharing fuel d.typ) .shared [] [] d.value
+
+def checkRecursor (ctx : CheckCtx) (fuel : Nat) (r : Recursor) :
+    Except UsageErr Unit := do
+  discard <| check ctx fuel true [] r.typ
+  for rule in r.rules do
+    -- Rule right-hand sides are closed runtime terms.
+    discard <| check ctx fuel false [] rule.rhs
+
+/-- Check one constant, resolving references through `resolve`.
+Modular: unresolvable (but well-indexed) references degrade to
+conservative unknowns, never errors. -/
+def checkConstant (resolve : Address → Option Constant) (c : Constant)
+    (fuel : Nat := defaultFuel) : Except UsageErr Unit := do
+  let ctx : CheckCtx :=
+    { resolve, sharing := c.sharing, refs := c.refs
+      selfMuts := selfMutsOf c.info }
+  match c.info with
+  | .defn d => checkDefinition resolve c d fuel
+  | .recr r => checkRecursor ctx fuel r
+  | .axio a => discard <| check ctx fuel true [] a.typ
+  | .quot q => discard <| check ctx fuel true [] q.typ
+  | .cPrj _ | .rPrj _ | .iPrj _ | .dPrj _ => pure ()
+  | .muts ms =>
+    for m in ms do
+      match m with
+      | .defn d => checkDefinition resolve c d fuel
+      | .indc i => do
+        discard <| check ctx fuel true [] i.typ
+        for ct in i.ctors do
+          discard <| check ctx fuel true [] ct.typ
+      | .recr r => checkRecursor ctx fuel r
+
+/-! ## Elaboration-time tests
+
+A hand-written mini-environment: `X : Sort`, functions over it with
+every demand shape, and definitions exercising each rule. Reference
+convention for test definitions: refs = `#[X, g, h, fresh, f, c0, e]`.
+-/
+
+private def addrOf (n : UInt8) : Address :=
+  Address.replicate n
+
+private def aX := addrOf 1
+private def aG := addrOf 2      -- g : X ⊸ X (linear param, unique result)
+private def aH := addrOf 3      -- h : X →ω X (shared)
+private def aFresh := addrOf 4  -- fresh : X →ω X^unique
+private def aF := addrOf 5      -- f : X →ω X →ω X
+private def aC0 := addrOf 6     -- c0 : X
+private def aE := addrOf 7      -- e : ∀^0 (A : Sort), X ⊸ X
+private def aApply := addrOf 8  -- apply : (X →ω X) →ω X
+
+private def X : Expr := .ref 0 #[]
+private def gRef : Expr := .ref 1 #[]
+private def hRef : Expr := .ref 2 #[]
+private def freshRef : Expr := .ref 3 #[]
+private def fRef : Expr := .ref 4 #[]
+private def c0Ref : Expr := .ref 5 #[]
+private def eRef : Expr := .ref 6 #[]
+private def applyRef : Expr := .ref 7 #[]
+
+private def axConst (refs : Array Address) (typ : Expr) : Constant :=
+  { info := .axio { isUnsafe := false, lvls := 0, typ }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def cX := axConst #[] (.sort 0)
+private def cG := axConst #[aX] (.all .linear .unique X X)
+private def cH := axConst #[aX] (.all .many .shared X X)
+private def cFresh := axConst #[aX] (.all .many .unique X X)
+private def cF := axConst #[aX] (.all .many .shared X (.all .many .shared X X))
+private def cC0 := axConst #[aX] X
+private def cE := axConst #[aX]
+  (.all .erased .shared (.sort 0) (.all .linear .unique X X))
+private def cApply := axConst #[aX]
+  (.all .many .shared (.all .many .shared X X) X)
+
+private def resolver : Address → Option Constant := fun a =>
+  (([(aX, cX), (aG, cG), (aH, cH), (aFresh, cFresh), (aF, cF),
+     (aC0, cC0), (aE, cE), (aApply, cApply)] : List (Address × Constant)).find?
+    (fun p => p.1 == a)).map (·.2)
+
+private def stdRefs : Array Address := #[aX, aG, aH, aFresh, aF, aC0, aE, aApply]
+
+private def defnConst (typ value : Expr) (sharing : Array Expr := #[]) :
+    Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing, refs := stdRefs, univs := #[.zero] }
+
+private def ok? (c : Constant) : Bool :=
+  match checkConstant resolver c with
+  | .ok _ => true
+  | .error _ => false
+
+private def failsWith (c : Constant) (p : UsageErr → Bool) : Bool :=
+  match checkConstant resolver c with
+  | .error e => p e
+  | .ok _ => false
+
+-- The axioms themselves check (ghost type walks).
+#guard ok? cX
+#guard ok? cG
+#guard ok? cE
+
+-- Lean fragment: the ω identity, and an ω term that duplicates.
+#guard ok? (defnConst (.all .many .shared X X) (.lam .many X (.var 0)))
+#guard ok? (defnConst (.all .many .shared X X)
+  (.lam .many X (.app (.app fRef (.app hRef (.var 0))) (.var 0))))
+-- ... and the leanFragment predicate agrees it is vanilla Lean.
+#guard (Expr.leanFragment (.lam .many X (.app (.app fRef (.var 0)) (.var 0))))
+
+-- The linear identity: unique in, unique out.
+#guard ok? (defnConst (.all .linear .unique X X) (.lam .linear X (.var 0)))
+
+-- Fresh reusable closures use the shared PAP ABI, including let binding,
+-- shared capture, and an erased parameter ahead of the runtime telescope.
+#guard ok? (defnConst X (.app applyRef (.lam .many X (.var 0))))
+#guard ok? (defnConst X
+  (.letE true (.all .many .shared X X) (.lam .many X (.var 0))
+    (.app applyRef (.var 0))))
+#guard ok? (defnConst (.all .many .shared X X)
+  (.lam .many X (.app applyRef (.lam .many X (.var 1)))))
+#guard match check { resolve := resolver, refs := stdRefs } 100 false []
+    (.lam .erased (.sort 0) (.lam .many X (.var 0))) with
+  | .ok ([], .shared) => true
+  | _ => false
+
+-- Neighboring callable modes/results still cannot enter shared storage.
+#guard failsWith (defnConst X (.app applyRef (.lam .affine X c0Ref)))
+  (fun | .freezeNeeded => true | _ => false)
+#guard failsWith (defnConst X (.app applyRef (.lam .linear X (.var 0))))
+  (fun | .freezeNeeded => true | _ => false)
+#guard failsWith (defnConst X
+  (.app applyRef (.lam .many X (.app freshRef (.var 0)))))
+  (fun | .freezeNeeded => true | _ => false)
+#guard failsWith (defnConst (.all .linear .shared X X)
+  (.lam .linear X (.app applyRef (.lam .many X (.app gRef (.var 1))))))
+  (fun | .uniqueCapture 0 => true | _ => false)
+
+-- Affine weakening: an affine argument may be unused.
+#guard ok? (defnConst (.all .affine .shared X X) (.lam .affine X c0Ref))
+
+-- Erased type parameter: ghost in types, one real use of `a`.
+#guard ok? (defnConst
+  (.all .erased .shared (.sort 0) (.all .many .shared (.var 0) (.var 1)))
+  (.lam .erased (.sort 0) (.lam .many (.var 0) (.var 0))))
+
+-- 0-scaling: the same variable in an erased argument position (killed)
+-- and a real one (counted once) — linear is satisfied.
+#guard ok? (defnConst (.all .linear .unique X X)
+  (.lam .linear X (.app (.app eRef (.var 0)) (.var 0))))
+
+-- Moves: a linear binder moved into g (bare-var unique demand).
+#guard ok? (defnConst (.all .linear .unique X X)
+  (.lam .linear X (.app gRef (.var 0))))
+
+-- Ixon lets have no ownership mode and erasure pins them to `.many`,
+-- so a unique initializer is rejected before the old implicit freeze.
+#guard failsWith (defnConst (.all .many .shared X X)
+  (.lam .many X
+    (.letE true X (.app freshRef (.var 0)) (.app gRef (.var 0)))))
+  (fun | .freezeNeeded => true | _ => false)
+
+-- Shares resolve through the sharing table (x duplicated via share).
+#guard ok? (defnConst (.all .many .shared X X)
+  (.lam .many X (.app (.app fRef (.share 0)) (.share 0)))
+  (sharing := #[.var 0]))
+
+-- A nested freely-copyable closure may not capture a unique outer
+-- value until one-shot closures / capture multiplicity are modeled.
+#guard failsWith
+  (defnConst
+    (.all .linear .unique X X)
+    (.lam .linear X (.lam .many X (.var 1))))
+  (fun | .uniqueCapture 0 => true | _ => false)
+
+-- Erased binder used at runtime.
+#guard failsWith
+  (defnConst (.all .erased .shared X X) (.lam .erased X (.var 0)))
+  (fun | .binderCovers .erased .linear => true | _ => false)
+
+-- A sort-like binder is erased even when its declared mode is `many`; the
+-- checker must therefore reject a computed runtime read before erasure.
+#guard failsWith
+  (defnConst (.all .many .shared (.sort 0) (.sort 0))
+    (.lam .many (.sort 0) (.var 0)))
+  (fun | .typeBinderRuntimeUse .linear => true | _ => false)
+
+-- Type-only use of that same binder stays in the zero fragment and passes.
+#guard ok? (defnConst
+  (.all .many .shared (.sort 0)
+    (.all .many .shared (.var 0) (.var 1)))
+  (.lam .many (.sort 0) (.lam .many (.var 0) (.var 0))))
+
+-- Unused linear binder (no silent leaks).
+#guard failsWith
+  (defnConst (.all .linear .shared X X) (.lam .linear X c0Ref))
+  (fun | .binderCovers .linear .erased => true | _ => false)
+
+-- Linear binder used twice.
+#guard failsWith
+  (defnConst (.all .linear .shared X X)
+    (.lam .linear X (.app (.var 0) (.var 0))))
+  (fun | .binderCovers .linear .many => true | _ => false)
+
+-- Affine binder used twice (dup needs `many`).
+#guard failsWith
+  (defnConst (.all .affine .shared X X)
+    (.lam .affine X (.app (.var 0) (.var 0))))
+  (fun | .binderCovers .affine .many => true | _ => false)
+
+-- Freeze: a linear (unique-world) binder at h's `many` sink. This is
+-- the minimal checker-accepted/lowering-rejected witness closed by
+-- the v0 freeze contract.
+#guard failsWith
+  (defnConst (.all .linear .shared X X)
+    (.lam .linear X (.app hRef (.var 0))))
+  (fun | .freezeNeeded => true | _ => false)
+
+-- Dereliction: a shared (ω-bound) variable where g demands linear.
+#guard failsWith
+  (defnConst (.all .many .shared X X) (.lam .many X (.app gRef (.var 0))))
+  (fun | .dereliction .linear => true | _ => false)
+
+-- Dereliction via let: h's result is shared, g demands unique.
+#guard failsWith
+  (defnConst (.all .many .shared X X)
+    (.lam .many X
+      (.letE true X (.app hRef (.var 0)) (.app gRef (.var 0)))))
+  (fun | .dereliction .linear => true | _ => false)
+
+-- A unique let is now rejected at its shared-pinned installation
+-- boundary, before move-flow validation can inspect its body.
+#guard failsWith
+  (defnConst (.all .many .shared X X)
+    (.lam .many X
+      (.letE true X (.app freshRef (.var 0))
+        (.app (.app fRef (.app gRef (.var 0))) (.app gRef (.var 0))))))
+  (fun | .freezeNeeded => true | _ => false)
+
+-- Value/type mode mismatch (beta stability).
+#guard failsWith
+  (defnConst (.all .linear .shared X X) (.lam .many X (.var 0)))
+  (fun | .lamAllMismatch .many .linear => true | _ => false)
+
+-- Eta-contracted values cannot bypass the declared function
+-- telescope; v0 requires an explicit matching lambda chain.
+#guard failsWith
+  (defnConst (.all .many .shared X X) hRef)
+  (fun | .definitionExpectedLambda 1 => true | _ => false)
+
+-- Promised unique result, shared body (an ω-bound variable).
+#guard failsWith
+  (defnConst (.all .many .unique X X) (.lam .many X (.var 0)))
+  (fun | .resultNotUnique .shared => true | _ => false)
+
+-- The converse result mismatch would require an implicit freeze.
+#guard failsWith
+  (defnConst (.all .many .shared X X)
+    (.lam .many X (.app freshRef (.var 0))))
+  (fun | .freezeNeeded => true | _ => false)
+
+#guard UsageErr.freezeNeeded.message ==
+  "freeze not in v0: unique value at non-unique sink " ++
+  "(see docs/compiler/lowering-restrictions.md)"
+
+-- ... whereas returning fresh's result keeps the promise.
+#guard ok? (defnConst (.all .many .unique X X)
+  (.lam .many X (.app freshRef (.var 0))))
+
+-- Structural errors: bad indices are malformedness, not conservatism.
+#guard failsWith (defnConst X (.share 5))
+  (fun | .badShareIdx 5 => true | _ => false)
+#guard failsWith (defnConst X (.ref 99 #[]))
+  (fun | .badRefIdx 99 => true | _ => false)
+#guard failsWith (defnConst X (.var 5))
+  (fun | .unboundVar 5 => true | _ => false)
+#guard ok? (defnConst X (.recur 0 #[]))
+#guard failsWith (defnConst X (.recur 1 #[]))
+  (fun | .badRecurIdx 1 => true | _ => false)
+
+-- Stored definition types are ghost-walked rather than used only as
+-- an unchecked telescope hint.
+#guard failsWith (defnConst (.ref 99 #[]) c0Ref)
+  (fun | .badRefIdx 99 => true | _ => false)
+
+-- `recur` resolves both singleton-collapsed standalones and explicit muts.
+#guard ok?
+  { info := .muts #[.defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .shared X X
+        value := .lam .many X (.app (.recur 0 #[]) (.var 0)) }]
+    sharing := #[], refs := #[aX], univs := #[.zero] }
+
+-- The dedicated recursor entry point checks both the stored type and
+-- closed rule bodies (including their binder usage).
+#guard ok?
+  { info := .recr
+      { k := false, isUnsafe := false, lvls := 0
+        params := 0, indices := 0, motives := 0, minors := 0
+        typ := .sort 0
+        rules := #[{ fields := 1, rhs := .lam .many X (.var 0) }] }
+    sharing := #[], refs := #[aX], univs := #[.zero] }
+
+end Ix.Compiler.Ixon.UsageCheck
diff --git a/Ix/Compiler/Ixon/Uses.lean b/Ix/Compiler/Ixon/Uses.lean
new file mode 100644
index 000000000..465912827
--- /dev/null
+++ b/Ix/Compiler/Ixon/Uses.lean
@@ -0,0 +1,188 @@
+/-!
+# The usage algebra
+
+First real module of Compilatr.ix: the `Uses` algebra and `Owned`
+result modes that Ixon v2 binders (`all`, `lam`) carry as data. Design
+rationale lives in `docs/compiler/compiler-design.md` under ownership, borrowing,
+and reuse; the short version:
+
+- `Uses` is one enum in the data model, but the checker reads it along
+  two axes: `erased` is the multiplicative *grade* axis (QTT 0,
+  erasure — the one place `mul` survives), while `linear`/`affine` vs
+  `many` is the *ownership-mode* axis (unique vs RC'd-shared),
+  composed additively under CBV with flow-sensitive move/freeze
+  transitions and no dereliction.
+- The vanilla Lean 4 fragment is `many` binders with `shared` results.
+-/
+
+namespace Ix.Compiler.Ixon
+
+/-- Binder usage. Cf. yatima-lang-alpha's `core/src/uses.rs`. -/
+inductive Uses where
+  /-- "0": runtime-irrelevant; free to appear in types. -/
+  | erased
+  /-- "1": consumed exactly once; unique from birth; reuse licensed. -/
+  | linear
+  /-- "≤1": consumed at most once; unique; droppable (Rust's move). -/
+  | affine
+  /-- "ω": unrestricted; the RC'd shared world. Lean 4's only mode. -/
+  | many
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+instance : ReflBEq Uses where
+  rfl := by intro uses; cases uses <;> rfl
+
+instance : LawfulBEq Uses where
+  eq_of_beq := by
+    intro left right h
+    cases left <;> cases right <;>
+      first | rfl | exact Bool.noConfusion h
+
+namespace Uses
+
+/-- Parallel combination: the same variable used in two sibling
+positions. Any two runtime uses collapse to `many`. -/
+def add : Uses → Uses → Uses
+  | .erased, u | u, .erased => u
+  | _, _ => .many
+
+instance : Add Uses := ⟨add⟩
+
+/-- Multiplicative scaling. Under compiled CBV this survives only at
+the erasure boundary; nonzero modes compose additively with
+flow-sensitive ownership transitions instead. -/
+def mul : Uses → Uses → Uses
+  | .erased, _ | _, .erased => .erased
+  | .linear, u | u, .linear => u
+  | .affine, .affine => .affine
+  | _, _ => .many
+
+/- `mul` is retained as the specification algebra needed by the future theory
+bridge. Executable CBV checking invokes it only with the `.erased` grade via
+`UsageCheck.UseVec.zeroScale`; using nonzero multiplication to compose closure
+captures would be unsound before one-shot closure multiplicities exist. -/
+
+instance : Mul Uses := ⟨mul⟩
+
+/-- Binder check: does declared usage `d` accept computed usage `c`?
+`linear` does not cover `erased`: unused linear binders are errors
+(no silent leaks). There is deliberately no rule letting `many`
+satisfy a `linear`/`affine` demand (no dereliction); re-entry to the
+unique world is only via the `clone` family. -/
+def covers : Uses → Uses → Bool
+  | .many, _ => true
+  | .affine, .erased | .affine, .affine | .affine, .linear => true
+  | .linear, .linear => true
+  | .erased, .erased => true
+  | _, _ => false
+
+/-! ## The usage semiring laws -/
+
+protected theorem add_comm (a b : Uses) : a.add b = b.add a := by
+  cases a <;> cases b <;> rfl
+
+protected theorem add_assoc (a b c : Uses) :
+    (a.add b).add c = a.add (b.add c) := by
+  cases a <;> cases b <;> cases c <;> rfl
+
+@[simp] protected theorem add_erased (a : Uses) : a.add .erased = a := by
+  cases a <;> rfl
+
+@[simp] protected theorem erased_add (a : Uses) : Uses.add .erased a = a := by
+  cases a <;> rfl
+
+protected theorem mul_comm (a b : Uses) : a.mul b = b.mul a := by
+  cases a <;> cases b <;> rfl
+
+protected theorem mul_assoc (a b c : Uses) :
+    (a.mul b).mul c = a.mul (b.mul c) := by
+  cases a <;> cases b <;> cases c <;> rfl
+
+@[simp] protected theorem mul_linear (a : Uses) : a.mul .linear = a := by
+  cases a <;> rfl
+
+@[simp] protected theorem linear_mul (a : Uses) : Uses.mul .linear a = a := by
+  cases a <;> rfl
+
+@[simp] protected theorem mul_erased (a : Uses) : a.mul .erased = .erased := by
+  cases a <;> rfl
+
+@[simp] protected theorem erased_mul (a : Uses) : Uses.mul .erased a = .erased := by
+  cases a <;> rfl
+
+/-- Scaling distributes over parallel combination. -/
+protected theorem mul_add (a b c : Uses) :
+    a.mul (b.add c) = (a.mul b).add (a.mul c) := by
+  cases a <;> cases b <;> cases c <;> rfl
+
+/-- `covers` is reflexive: every declared usage accepts itself. -/
+protected theorem covers_refl (a : Uses) : a.covers a = true := by
+  cases a <;> rfl
+
+/-! ## Bit representation (Ixon mode bytes) -/
+
+def toBits : Uses → UInt8
+  | .erased => 0
+  | .linear => 1
+  | .affine => 2
+  | .many => 3
+
+def ofBits? : UInt8 → Option Uses
+  | 0 => some .erased
+  | 1 => some .linear
+  | 2 => some .affine
+  | 3 => some .many
+  | _ => none
+
+protected theorem ofBits?_toBits (u : Uses) : ofBits? u.toBits = some u := by
+  cases u <;> rfl
+
+end Uses
+
+/-- Result ownership of an arrow: may the caller treat the returned
+value as unique, or is it (possibly) shared — a top-level constant, a
+projection of shared data? `shared` is the default; `unique` is
+opt-in. -/
+inductive Owned where
+  | unique
+  | shared
+  deriving BEq, DecidableEq, Repr, Inhabited, Hashable
+
+instance : ReflBEq Owned where
+  rfl := by intro owned; cases owned <;> rfl
+
+instance : LawfulBEq Owned where
+  eq_of_beq := by
+    intro left right h
+    cases left <;> cases right <;>
+      first | rfl | exact Bool.noConfusion h
+
+namespace Owned
+
+def toBits : Owned → UInt8
+  | .unique => 0
+  | .shared => 1
+
+def ofBits? : UInt8 → Option Owned
+  | 0 => some .unique
+  | 1 => some .shared
+  | _ => none
+
+protected theorem ofBits?_toBits (o : Owned) : ofBits? o.toBits = some o := by
+  cases o <;> rfl
+
+end Owned
+
+/-! Elaboration-time sanity checks. -/
+
+#guard Uses.add .linear .linear == .many
+#guard Uses.add .affine .affine == .many
+#guard Uses.mul .erased .many == .erased
+#guard Uses.mul .affine .affine == .affine
+#guard Uses.covers .affine .erased
+#guard Uses.covers .many .linear
+#guard !(Uses.covers .linear .erased)
+#guard !(Uses.covers .linear .many)
+#guard !(Uses.covers .erased .linear)
+
+end Ix.Compiler.Ixon
diff --git a/Ix/Compiler/Ixon/Work.lean b/Ix/Compiler/Ixon/Work.lean
new file mode 100644
index 000000000..d7b75359e
--- /dev/null
+++ b/Ix/Compiler/Ixon/Work.lean
@@ -0,0 +1,222 @@
+import Ix.Compiler.Ixon.Const
+
+/-!
+# Structural work accounting
+
+The proof-facing codec, sharing checker, compressor, eraser, and certificate
+builder are total definitions.  Corpus execution additionally needs a cheap
+preflight which prevents their intentionally simple list/structural
+implementations from receiving an unbounded job.
+
+The counters here are deterministic structure-derived units, never wall-clock
+limits.  In particular:
+
+* `layer1NodeVisits` charges the expression-node visits performed by the
+  quadratic `entriesUsedTwice` sharing check, plus its repeated list
+  materialization, drops, and range traversal;
+* `expandedUnits?` computes the size of a sharing expansion without allocating
+  that expansion;
+* `programStats` charges the current append-based whole-program eraser and the
+  worst-case number of certificate validation attempts.
+
+Keeping these counters separate from the proof definitions lets proofs retain
+their transparent models while every corpus-facing executable boundary can
+fail before starting superlinear work.
+-/
+
+namespace Ix.Compiler.Ixon.Work
+
+/-- A stable name for each independently configurable resource counter. -/
+inductive Metric where
+  | catalogManifestBytes
+  | catalogMembers
+  | catalogDependencyEdges
+  | catalogStorageUnits
+  | catalogPieceBytes
+  | catalogConstantEntries
+  | catalogConstantBytes
+  | catalogBlobEntries
+  | catalogBlobBytes
+  | catalogAssumptions
+  | catalogHints
+  | layer1NodeVisits
+  | compressionInputUnits
+  | programConstants
+  | programExpressionUnits
+  | programExpandedExpressionUnits
+  | erasedDeclarations
+  | erasureAppendCells
+  | certificateCandidates
+  | certificateValidationAttempts
+  | certificateSourceNodeWork
+  | usageFuel
+  | erasureFuel
+  | validationFuel
+  | loweringFuel
+  deriving BEq, DecidableEq, Repr
+
+/-- A resource failure always records the measured value and the applicable
+inclusive limit. -/
+structure Exceeded where
+  metric : Metric
+  actual : Nat
+  limit : Nat
+  deriving BEq, DecidableEq, Repr
+
+/-- Inclusive structural budget check. -/
+def ensure (metric : Metric) (actual limit : Nat) : Except Exceeded Unit :=
+  if actual ≤ limit then .ok () else .error ⟨metric, actual, limit⟩
+
+/-- Expression work units used for compressor admission.  This is the AST
+constructor count plus every universe-instantiation index traversed by
+serialization, hashing, and structural comparisons. -/
+def exprUnits : Expr → Nat
+  | .sort _ | .var _ | .str _ | .nat _ | .share _ => 1
+  | .ref _ indices | .recur _ indices => indices.size + 1
+  | .prj _ _ value => exprUnits value + 1
+  | .app fn arg => exprUnits fn + exprUnits arg + 1
+  | .lam _ type body | .all _ _ type body =>
+    exprUnits type + exprUnits body + 1
+  | .letE _ type value body =>
+    exprUnits type + exprUnits value + exprUnits body + 1
+
+def exprArrayUnits (exprs : Array Expr) : Nat :=
+  exprs.foldl (fun total expr => total + exprUnits expr) 0
+
+def exprListUnits (exprs : List Expr) : Nat :=
+  exprs.foldl (fun total expr => total + exprUnits expr) 0
+
+def exprArrayNodes (exprs : Array Expr) : Nat :=
+  exprs.foldl (fun total expr => total + expr.codecSize) 0
+
+/-- A conservative expression/list-cell charge for the current `layer1WF`
+implementation.  Entry `j` is scanned once by `tableWF` and once for every
+earlier sharing index; every body is scanned once for bounds and once per table
+entry.  The charge also includes every `table.toList`, repeated
+`drop (i + 1)`, and construction/traversal of `List.range`. -/
+def layer1NodeVisits (table bodies : Array Expr) : Nat :=
+  let (_, weightedTable) := table.foldl (init := (0, 0)) fun state expr =>
+    let index := state.1
+    (index + 1, state.2 + (index + 1) * expr.codecSize)
+  let tableSize := table.size
+  let bodyNodes := exprArrayNodes bodies
+  weightedTable + (tableSize + 1) * bodyNodes +
+    tableSize * (tableSize + 1) +
+    tableSize * (tableSize + 1) / 2 + 2 * tableSize
+
+/-! ## Expansion accounting without expansion allocation -/
+
+/-- Expression units after replacing every `.share` with the already-computed
+size of its table entry.  `none` identifies a forward/out-of-range share. -/
+def expandedExprUnits (tableSizes : Array Nat) : Expr → Option Nat
+  | .sort _ | .var _ | .str _ | .nat _ => some 1
+  | .ref _ indices | .recur _ indices => some (indices.size + 1)
+  | .share index => tableSizes[index.toNat]?
+  | .prj _ _ value => do
+    return (← expandedExprUnits tableSizes value) + 1
+  | .app fn arg => do
+    return (← expandedExprUnits tableSizes fn) +
+      (← expandedExprUnits tableSizes arg) + 1
+  | .lam _ type body | .all _ _ type body => do
+    return (← expandedExprUnits tableSizes type) +
+      (← expandedExprUnits tableSizes body) + 1
+  | .letE _ type value body => do
+    return (← expandedExprUnits tableSizes type) +
+      (← expandedExprUnits tableSizes value) +
+      (← expandedExprUnits tableSizes body) + 1
+
+def expandedTableSizes? (table : Array Expr) : Option (Array Nat) :=
+  table.foldlM (init := #[]) fun sizes expr => do
+    let size ← expandedExprUnits sizes expr
+    return sizes.push size
+
+/-- Exact work-unit size of fully inlined bodies, computed in time linear in
+the stored representation and without materializing an exponentially larger
+tree. -/
+def expandedUnits? (table bodies : Array Expr) : Option Nat := do
+  let tableSizes ← expandedTableSizes? table
+  bodies.foldlM (init := 0) fun total expr => do
+    let size ← expandedExprUnits tableSizes expr
+    return total + size
+
+/-! ## Whole-program accounting -/
+
+def erasedDeclarationCount (constant : Constant) : Nat :=
+  match constant.info with
+  | .muts members => members.size
+  | _ => 1
+
+def certificateCandidateCount (constant : Constant) : Nat :=
+  match constant.info with
+  | .muts _ => 0
+  | _ => 1
+
+private def triangularBelow (count : Nat) : Nat :=
+  count * (count - 1) / 2
+
+/-- All counters needed before entering checking, erasure, or validation. -/
+structure ProgramStats where
+  constants : Nat
+  expressionUnits : Nat
+  /-- Sum of fully expanded body units. Malformed forward/out-of-range tables
+  fall back to stored body units and remain the semantic checker's concern. -/
+  expandedExpressionUnits : Nat
+  layer1NodeVisits : Nat
+  erasedDeclarations : Nat
+  erasureAppendCells : Nat
+  certificateCandidates : Nat
+  certificateValidationAttempts : Nat
+  certificateSourceNodeWork : Nat
+  deriving BEq, DecidableEq, Repr
+
+private structure ProgramAccum where
+  constants : Nat := 0
+  expressionUnits : Nat := 0
+  expandedExpressionUnits : Nat := 0
+  layer1NodeVisits : Nat := 0
+  erasedDeclarations : Nat := 0
+  erasureAppendCells : Nat := 0
+  certificateCandidates : Nat := 0
+
+private def addConstant (acc : ProgramAccum) (constant : Constant) :
+    ProgramAccum :=
+  let bodies := constant.info.exprs.toArray
+  let bodyUnits := exprArrayUnits bodies
+  let expandedUnits := (expandedUnits? constant.sharing bodies).getD bodyUnits
+  let outputCount := erasedDeclarationCount constant
+  { constants := acc.constants + 1
+    expressionUnits := acc.expressionUnits + bodyUnits +
+      exprArrayUnits constant.sharing
+    expandedExpressionUnits := acc.expandedExpressionUnits + expandedUnits
+    layer1NodeVisits := acc.layer1NodeVisits +
+      layer1NodeVisits constant.sharing bodies
+    erasedDeclarations := acc.erasedDeclarations + outputCount
+    -- `eraseConstant` appends each mutual member; `eraseProgram` then appends
+    -- that chunk to the prefix accumulated from earlier constants.
+    erasureAppendCells := acc.erasureAppendCells +
+      triangularBelow outputCount + acc.erasedDeclarations
+    certificateCandidates := acc.certificateCandidates +
+      certificateCandidateCount constant }
+
+/-- Worst-case calls made by the dependency-discovery fixpoint, followed by
+one dependency-ordered proof-producing pass.  A productive discovery round
+can accept only one of the remaining candidates, hence the triangular term. -/
+def certificateAttempts (candidates : Nat) : Nat :=
+  candidates * (candidates + 1) / 2 + candidates
+
+def programStats (constants : List (Address × Constant)) : ProgramStats :=
+  let acc := constants.foldl (fun acc entry => addConstant acc entry.2) {}
+  let attempts := certificateAttempts acc.certificateCandidates
+  { constants := acc.constants
+    expressionUnits := acc.expressionUnits
+    expandedExpressionUnits := acc.expandedExpressionUnits
+    layer1NodeVisits := acc.layer1NodeVisits
+    erasedDeclarations := acc.erasedDeclarations
+    erasureAppendCells := acc.erasureAppendCells
+    certificateCandidates := acc.certificateCandidates
+    certificateValidationAttempts := attempts
+    -- Deliberately conservative combined scaling charge: each possible
+    -- validation attempt is priced as one scan of every fully expanded body.
+    certificateSourceNodeWork := attempts * acc.expandedExpressionUnits }
+
+end Ix.Compiler.Ixon.Work
diff --git a/Ix/Compiler/LICENSE-APACHE b/Ix/Compiler/LICENSE-APACHE
new file mode 100644
index 000000000..bd05ef6e2
--- /dev/null
+++ b/Ix/Compiler/LICENSE-APACHE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Argument Computer Corporation
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/Ix/Compiler/LICENSE-MIT b/Ix/Compiler/LICENSE-MIT
new file mode 100644
index 000000000..d75ac3ca5
--- /dev/null
+++ b/Ix/Compiler/LICENSE-MIT
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Argument Computer Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
\ No newline at end of file
diff --git a/Ix/Compiler/LoweredCompilation.lean b/Ix/Compiler/LoweredCompilation.lean
new file mode 100644
index 000000000..88209ac26
--- /dev/null
+++ b/Ix/Compiler/LoweredCompilation.lean
@@ -0,0 +1,110 @@
+import Ix.Compiler.Pipeline
+import Ix.Compiler.EraseAddressedSim
+
+/-!
+# Source-independent checked ownership lowering
+
+The backend needs the exact IxIR₀ input, the actual lowering/addressing trace,
+selected source rows, and the existing closed extern boundary. These facts do
+not require that the input still be the literal Ixon erasure. A validated
+source compilation projects this record; a checked transformation can seal
+its own exact lowering trace with the same executable checks.
+-/
+
+namespace Ix.Compiler.Pipeline
+
+open Ixon (Address Owned)
+
+def sourceRowsSelected (declarations : List (Address × IxIR0.Decl)) : Bool :=
+  declarations.all fun (address, declaration) =>
+    IxIR0.Env.ofList declarations address == some declaration
+
+structure LoweringCertificate (declarations : List (Address × IxIR0.Decl))
+    (target : List (Address × IxIR1.Decl)) : Prop where
+  selected : sourceRowsSelected declarations = true
+  sourceExterns : ValidatedExternsRejected declarations
+  targetExterns : ValidatedTargetExternsRejected target
+
+instance (declarations : List (Address × IxIR0.Decl))
+    (target : List (Address × IxIR1.Decl)) :
+    Decidable (LoweringCertificate declarations target) :=
+  decidable_of_iff
+    (sourceRowsSelected declarations = true ∧
+      firstValidatedExtern? declarations = none ∧ firstValidatedTargetExtern? target = none)
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2⟩, fun h => ⟨h.selected, h.sourceExterns, h.targetExterns⟩⟩
+
+def checkLoweringCertificate (declarations : List (Address × IxIR0.Decl))
+    (target : List (Address × IxIR1.Decl)) :
+    Except String (PLift (LoweringCertificate declarations target)) :=
+  if h : LoweringCertificate declarations target then .ok ⟨h⟩
+  else .error "ownership lowering requires selected source rows and closed source/target externs"
+
+structure LoweredCompilation (mainWorld : Owned) (fuel : Nat) where
+  declarations : List (Address × IxIR0.Decl)
+  main : IxIR0.Expr
+  lowering : IxIR1.Lower.FullyAddressedTrace declarations main mainWorld fuel
+  certificate : LoweringCertificate declarations
+    (lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)
+
+namespace LoweredCompilation
+
+def ofTrace {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {mainWorld : Owned} {fuel : Nat}
+    (lowering : IxIR1.Lower.FullyAddressedTrace declarations main mainWorld fuel)
+    (certificate : LoweringCertificate declarations
+      (lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)) :
+    LoweredCompilation mainWorld fuel :=
+  { declarations, main, lowering, certificate }
+
+def targetDecls {mainWorld : Owned} {fuel : Nat}
+    (compilation : LoweredCompilation mainWorld fuel) : List (Address × IxIR1.Decl) :=
+  compilation.lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations
+
+def targetDeclEnv {mainWorld : Owned} {fuel : Nat}
+    (compilation : LoweredCompilation mainWorld fuel) : IxIR1.Env :=
+  AddressEnv.lookup (AddressEnv.build compilation.targetDecls)
+
+theorem declarationSelected {mainWorld : Owned} {fuel : Nat}
+    (compilation : LoweredCompilation mainWorld fuel)
+    {address : Address} {declaration : IxIR0.Decl}
+    (member : (address, declaration) ∈ compilation.declarations) :
+    IxIR0.Env.ofList compilation.declarations address = some declaration := by
+  have selected := List.all_eq_true.mp compilation.certificate.selected
+    (address, declaration) member
+  simpa only [beq_iff_eq] using selected
+
+theorem sourceEnv_ne_extern {mainWorld : Owned} {fuel : Nat}
+    (compilation : LoweredCompilation mainWorld fuel) {address : Address} {arity : Nat} :
+    IxIR0.Env.ofList compilation.declarations address ≠ some (.extern arity) :=
+  compilation.certificate.sourceExterns.env_ne_extern
+
+theorem targetDeclEnv_ne_extern {mainWorld : Owned} {fuel : Nat}
+    (compilation : LoweredCompilation mainWorld fuel) {address : Address} {arity : Nat} :
+    compilation.targetDeclEnv address ≠ some (.extern arity) :=
+  compilation.certificate.targetExterns.env_ne_extern
+
+end LoweredCompilation
+
+/-- Project the common compiler boundary without recompilation or an added
+runtime check. The validated erasure audit already supplies selected rows. -/
+def ValidatedCompilation.lowered
+    {constants : List (Address × Ixon.Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config mainWorld eraseFuel lowerFuel) :
+    LoweredCompilation mainWorld lowerFuel :=
+  { declarations := compilation.erasure.result.declarations
+    main := compilation.erasure.result.main
+    lowering := compilation.lowering
+    certificate :=
+      { selected := by
+          apply List.all_eq_true.mpr
+          intro entry member
+          have audit := compilation.erasure.result.addressed_audit
+            (EraseAddressed.semanticAudit_of_run_eq_ok compilation.erasure.runEq)
+          have selected := IxIR0.Readdress.Result.declaration_lookup_of_mem_of_semanticAudit
+            audit member
+          simpa [selected]
+        sourceExterns := compilation.externsRejected
+        targetExterns := compilation.targetExternsRejected } }
+
+end Ix.Compiler.Pipeline
diff --git a/Ix/Compiler/LoweredCompilationSim.lean b/Ix/Compiler/LoweredCompilationSim.lean
new file mode 100644
index 000000000..e922bf9de
--- /dev/null
+++ b/Ix/Compiler/LoweredCompilationSim.lean
@@ -0,0 +1,184 @@
+import Ix.Compiler.LoweredCompilation
+import Ix.Compiler.PipelineSound
+import Ix.Compiler.IxIR1.ReaddressOwnership
+
+/-! Ownership, progress, and addressed execution derived from the common
+checked lowering record. Ixon provenance is composed by the calling frontend.
+-/
+
+namespace Ix.Compiler.Pipeline.LoweredCompilation
+
+open Ix.Compiler.Ixon (Address Owned)
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.LowerSim
+
+variable {mainWorld : Owned} {fuel : Nat}
+
+def sourceCtx (compilation : LoweredCompilation mainWorld fuel) : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList compilation.declarations }
+
+def exactTargetCtx (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) : Ctx :=
+  compilation.lowering.result.rebuildSourceCtx compilation.lowering.raw oracle
+
+def functionRel (compilation : LoweredCompilation mainWorld fuel) : IxIR1.Sim.FunctionRel :=
+  CompilerFunctionRel compilation.sourceCtx (IxIR0.Env.ofList compilation.declarations)
+    compilation.lowering.finalState
+
+theorem lowerRun (compilation : LoweredCompilation mainWorld fuel) :
+    (lowerAllAction compilation.declarations compilation.main mainWorld fuel).run {} =
+      .ok (compilation.lowering.raw, compilation.lowering.mainCode) compilation.lowering.finalState := by
+  simpa only [lowerAllIndexedAction_eq_lowerAllAction] using compilation.lowering.lowerRun
+
+theorem rebuildAudit (compilation : LoweredCompilation mainWorld fuel) :
+    compilation.lowering.result.rebuildSemanticAudit
+      compilation.lowering.raw compilation.lowering.mainCode = true :=
+  ReaddressAll.rebuildSemanticAudit_of_run_eq_ok
+    (readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      compilation.lowering.lowerRun compilation.lowering.addressedRun)
+
+theorem exactTargetCtx_decls_of_mem (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) {address : Address} {declaration : Decl}
+    (member : (address, declaration) ∈ compilation.lowering.raw) :
+    (compilation.exactTargetCtx oracle).decls address = some declaration :=
+  ReaddressAll.Result.raw_lookup_of_mem_of_rebuildSemanticAudit compilation.rebuildAudit member
+
+theorem exactExtraRepresented (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) :
+    ExtraRepresented (compilation.exactTargetCtx oracle) compilation.lowering.finalState := by
+  apply lowerAllAction_extraRepresented compilation.lowerRun
+  intro address declaration member
+  exact compilation.exactTargetCtx_decls_of_mem oracle
+    (lowerAllAction_extra_mem_result compilation.lowerRun member)
+
+theorem exactCompilerContracts (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) :
+    CompilerContracts (IxIR0.Env.ofList compilation.declarations)
+        (compilation.exactTargetCtx oracle) ∧
+      ExtraFnContracts (compilation.exactTargetCtx oracle) compilation.lowering.finalState := by
+  apply lowerAllAction_compilerContracts compilation.lowerRun
+    (fun member => compilation.exactTargetCtx_decls_of_mem oracle member)
+  · intro address source worlds result member _
+    exact compilation.declarationSelected member
+  · rfl
+
+theorem externValueContract (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) :
+    ExternValueContract compilation.functionRel compilation.sourceCtx
+      (compilation.exactTargetCtx oracle) := by
+  constructor
+  intro store address arity sourceFunction sourceResult sourceArgs args result lookup
+  exact False.elim (compilation.sourceEnv_ne_extern lookup)
+
+theorem externTraceProgressContract (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) :
+    ExternTraceProgressContract compilation.functionRel compilation.sourceCtx
+      (compilation.exactTargetCtx oracle) := by
+  constructor
+  intro sourceLimit store address arity sourceFunction sourceResult sourceArgs args lookup
+  exact False.elim (compilation.sourceEnv_ne_extern lookup)
+
+/-- Every call-aware source trace produces an owned execution of the exact
+fully addressed output. Ownership and intermediate progress are reconstructed
+from the compiler trace and checked row/extern certificate. -/
+theorem addressedOwnedMain (compilation : LoweredCompilation .shared fuel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (trace : IxIR0.ProjectionSafe.Eval compilation.sourceCtx sourceFuel []
+      compilation.main sourceValue) :
+    ∃ targetFuel rawStore store value,
+      IxIR1.runOwnedMain (compilation.lowering.result.addressedCtx (fun _ _ => none))
+        .shared compilation.lowering.result.main targetFuel = .ok (store, value) ∧
+      store = Readdress.Store.mapAddresses
+        (compilation.lowering.result.rebuildRename compilation.lowering.raw) rawStore ∧
+      IxIR1.Sim.ValueGraph compilation.functionRel rawStore sourceValue value := by
+  have progress := lowerAllAction_main_progress_of_trace_sealed rfl compilation.lowerRun
+    (fun member => compilation.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+    (compilation.exactExtraRepresented (fun _ _ => none))
+    (compilation.exactCompilerContracts (fun _ _ => none)).1
+    (compilation.externValueContract (fun _ _ => none))
+    (compilation.externTraceProgressContract (fun _ _ => none)) trace
+  have simulation : SemanticForwardSimulation compilation.sourceCtx
+      (compilation.exactTargetCtx (fun _ _ => none)) compilation.main
+      compilation.lowering.mainCode compilation.functionRel := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed rfl compilation.lowerRun
+      (fun member => compilation.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+      (compilation.exactExtraRepresented (fun _ _ => none))
+      (compilation.exactCompilerContracts (fun _ _ => none)).1
+      (compilation.externValueContract (fun _ _ => none))
+    intro _ _ _
+    exact progress
+  obtain ⟨targetFuel, rawStore, value, rawRun, graph⟩ := simulation trace.run
+  let rename := compilation.lowering.result.rebuildRename compilation.lowering.raw
+  let store := Readdress.Store.mapAddresses rename rawStore
+  have ownership := lowerAllAction_main_owned compilation.lowerRun
+    (compilation.exactExtraRepresented (fun _ _ => none))
+    (compilation.exactCompilerContracts (fun _ _ => none)).1 rawRun
+  have rawWorld : IxIR1.Sim.HasWorld rawStore .shared value :=
+    ownership.roots_world ⟨.shared, value⟩ (by simp)
+  have finalWorld : IxIR1.Sim.HasWorld store .shared value :=
+    (IxIR1.Sim.hasWorld_mapAddresses_iff rename rawStore .shared value).mpr rawWorld
+  have addressedRun : IxIR1.runMain (compilation.lowering.result.addressedCtx (fun _ _ => none))
+      compilation.lowering.result.main targetFuel = .ok (store, value) := by
+    simp only [exactTargetCtx] at rawRun
+    rw [compilation.lowering.result.main_eq_rebuildMapAddresses compilation.rebuildAudit]
+    rw [Readdress.runMain_mapAddresses
+      (compilation.lowering.result.renames_rebuildSourceCtx compilation.rebuildAudit (fun _ _ => none))
+      compilation.lowering.mainCode targetFuel, rawRun]
+    rfl
+  refine ⟨targetFuel, rawStore, store, value, ?_, rfl, graph⟩
+  unfold IxIR1.runOwnedMain
+  change (IxIR1.runMain (compilation.lowering.result.addressedCtx (fun _ _ => none))
+    compilation.lowering.result.main targetFuel >>= IxIR1.checkResultWorld .shared) = _
+  rw [addressedRun]
+  simp [IxIR1.checkResultWorld, IxIR1.Sim.rval_hasWorld_eq_true_iff.mpr finalWorld]
+
+/-- Every successful fully addressed main can reclaim its returned root.
+The common lowering trace supplies both ownership and append-order facts. -/
+theorem reclamation (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal) :
+    Reclamation (compilation.lowering.result.addressedCtx oracle)
+      compilation.lowering.result.main mainWorld := by
+  have raw : Reclamation (compilation.exactTargetCtx oracle)
+      compilation.lowering.mainCode mainWorld :=
+    NoReuse.lowerAllAction_reclamation compilation.lowerRun rfl
+      (compilation.exactExtraRepresented oracle)
+      (compilation.exactCompilerContracts oracle).1
+  intro runFuel store value run
+  exact NoReuse.lowerAllIndexedFullyAddressed_reclamation_of_exact_raw
+    compilation.lowering.lowerRun compilation.lowering.addressedRun oracle raw run
+
+/-- Ownership at any successful addressed execution follows from the exact
+lowering trace; the address action preserves locations and owner counts. -/
+theorem owned (compilation : LoweredCompilation mainWorld fuel)
+    (oracle : Address → List RVal → Option RVal)
+    {runFuel : Nat} {store : Store} {value : RVal}
+    (run : IxIR1.runMain (compilation.lowering.result.addressedCtx oracle)
+      compilation.lowering.result.main runFuel = .ok (store, value)) :
+    IxIR1.Sim.RootOwnership store [⟨mainWorld, value⟩] := by
+  rw [compilation.lowering.result.main_eq_rebuildMapAddresses compilation.rebuildAudit] at run
+  have transport := Readdress.runMain_mapAddresses
+    (compilation.lowering.result.renames_rebuildSourceCtx compilation.rebuildAudit oracle)
+    compilation.lowering.mainCode runFuel
+  rw [run] at transport
+  cases rawRun : IxIR1.runMain (compilation.exactTargetCtx oracle)
+      compilation.lowering.mainCode runFuel with
+  | error error =>
+      simp only [exactTargetCtx] at rawRun
+      rw [rawRun] at transport
+      contradiction
+  | ok output =>
+      rcases output with ⟨rawStore, rawValue⟩
+      simp only [exactTargetCtx] at rawRun
+      rw [rawRun] at transport
+      have result : store = Readdress.Store.mapAddresses
+          (compilation.lowering.result.rebuildRename compilation.lowering.raw) rawStore ∧
+          value = rawValue := by
+        simpa only [Readdress.mapRunResult_ok, Except.ok.injEq, Prod.mk.injEq] using transport
+      rcases result with ⟨rfl, rfl⟩
+      exact (IxIR1.Sim.rootOwnership_mapAddresses_iff _ _ _).mpr
+        (lowerAllAction_main_owned compilation.lowerRun
+          (compilation.exactExtraRepresented oracle)
+          (compilation.exactCompilerContracts oracle).1 rawRun)
+
+end Ix.Compiler.Pipeline.LoweredCompilation
diff --git a/Ix/Compiler/Pipeline.lean b/Ix/Compiler/Pipeline.lean
new file mode 100644
index 000000000..e220427da
--- /dev/null
+++ b/Ix/Compiler/Pipeline.lean
@@ -0,0 +1,1849 @@
+import Ix.Compiler.Ixon.UsageCheck
+import Ix.Compiler.Ixon.Work
+import Ix.Compiler.EraseAddressed
+import Ix.Compiler.EraseValidator
+import Ix.Compiler.IxIR1.LowerFullyAddressed
+import Ix.Compiler.IxIR1.HPTCacheDirIO
+import Ix.Compiler.IxIR1.Optimizer
+
+/-!
+# Checked source-to-IxIR₁ pipeline
+
+The first executable composition of the three previously independent
+gatekeepers:
+
+1. every Ixon constant passes `UsageCheck.checkConstant` against the
+   same closed-world resolver;
+2. the checked program is erased through `EraseAddressed.run`, retaining the
+   exact legacy erasure while replacing mutual-member temporary keys by
+   canonical block-derived keys;
+3. the addressed IxIR₀ declarations are lowered, the complete IxIR₁ graph
+   is partitioned into SCCs, and source/generated functions are rekeyed to
+   ordinary declaration hashes or cycle-safe mutual-block identities.  Opaque
+   extern keys and constructor identities remain stable.
+
+`compile` is the unvalidated engineering gate: it deliberately accepts
+out-of-fragment programs that the proof-producing validator cannot yet
+certify. `compileValidated` closes that seam with the sharing-aware validator,
+failing closed on the first rejected declaration. Its proof-facing sibling,
+`compileValidatedWithTrace`, retains the exact member scope, erasure
+certificate, simultaneous-member coverage, and lowering/addressing equations
+consumed by `PipelineSound`. It also rejects externs on the exact addressed
+IxIR₀ input and emitted IxIR₁ graph, retaining both checks as proof fields.
+The resulting semantic endpoint keeps only genuine source execution and
+oracle-correspondence obligations explicit.
+-/
+
+namespace Ix.Compiler.Pipeline
+
+open Ix.Compiler.Ixon (Address Constant Owned)
+
+inductive Error where
+  | usage (address : Address) (error : Ixon.UsageCheck.UsageErr)
+  | erase (error : Erase.EraseErr)
+  | readdress (message : String)
+  /-- The erasure validator rejected this declaration (or the main
+  entry) with the given diagnostic — `compileValidated` only. -/
+  | validate (address : Address) (message : String)
+  | lower (message : String)
+  | resource (exceeded : Ixon.Work.Exceeded)
+  deriving BEq, Repr
+
+/-- Inclusive structural limits for one compilation unit.  These are
+deterministic preflight counters, not machine-dependent timeouts.  The
+certificate limits deliberately bound both proof-database size and the
+quadratic dependency-discovery fixpoint. -/
+structure Limits where
+  maxConstants : Nat := 16 * 1024
+  maxExpressionUnits : Nat := 1024 * 1024
+  maxExpandedExpressionUnits : Nat := 1024 * 1024
+  maxLayer1NodeVisits : Nat := 64 * 1024 * 1024
+  maxErasedDeclarations : Nat := 32 * 1024
+  maxErasureAppendCells : Nat := 64 * 1024 * 1024
+  maxCertificateCandidates : Nat := 512
+  maxCertificateValidationAttempts : Nat := 512 * 513 / 2 + 512
+  maxCertificateSourceNodeWork : Nat := 128 * 1024 * 1024
+  maxUsageFuel : Nat := Ixon.UsageCheck.defaultFuel
+  maxErasureFuel : Nat := Erase.defaultFuel
+  maxValidationFuel : Nat := Erase.defaultFuel
+  maxLoweringFuel : Nat := 100000
+  deriving BEq, Repr
+
+def defaultLimits : Limits := {}
+
+/-- Non-constant inputs needed while erasing a closed Ixon program. -/
+structure Config where
+  blobs : Address → Option Ixon.Eval.Blob := fun _ => none
+  natBlock : Option Address := none
+  limits : Limits := {}
+
+/-- Locate the first extern declaration at the validator-to-lowerer boundary.
+The certified pipeline stays closed to externs until a heap ownership ABI is
+chosen; the unvalidated engineering pipeline retains the evaluator's
+scalar-only extern support. -/
+def firstValidatedExtern? : List (Address × IxIR0.Decl) → Option Address
+  | [] => none
+  | (address, .extern _) :: _ => some address
+  | _ :: declarations => firstValidatedExtern? declarations
+
+/-- Executable proof-facing statement of the validated extern policy. -/
+def ValidatedExternsRejected
+    (declarations : List (Address × IxIR0.Decl)) : Prop :=
+  firstValidatedExtern? declarations = none
+
+/-- Target-side twin of `firstValidatedExtern?`, run over the exact emitted
+artifact graph rather than inferred from lowering behavior. -/
+def firstValidatedTargetExtern? :
+    List (Address × IxIR1.Decl) → Option Address
+  | [] => none
+  | (address, .extern _) :: _ => some address
+  | _ :: declarations => firstValidatedTargetExtern? declarations
+
+/-- The emitted certified IxIR₁ graph is closed to extern declarations. -/
+def ValidatedTargetExternsRejected
+    (declarations : List (Address × IxIR1.Decl)) : Prop :=
+  firstValidatedTargetExtern? declarations = none
+
+namespace ValidatedExternsRejected
+
+/-- A closed validated extern boundary excludes every extern row from the
+exact declaration list. -/
+theorem not_mem {declarations : List (Address × IxIR0.Decl)}
+    (hboundary : ValidatedExternsRejected declarations)
+    {address : Address} {arity : Nat} :
+    (address, .extern arity) ∉ declarations := by
+  intro hmember
+  induction declarations with
+  | nil => simp at hmember
+  | cons head tail ih =>
+      rcases head with ⟨headAddress, headDeclaration⟩
+      cases headDeclaration <;>
+        simp_all [ValidatedExternsRejected, firstValidatedExtern?]
+
+private theorem envOfList_some_mem
+    {declarations : List (Address × IxIR0.Decl)} {address : Address}
+    {declaration : IxIR0.Decl}
+    (hlookup : IxIR0.Env.ofList declarations address = some declaration) :
+    (address, declaration) ∈ declarations := by
+  unfold IxIR0.Env.ofList at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryDeclaration⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × IxIR0.Decl => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hdeclaration : entryDeclaration = declaration := by
+    simpa using hvalue
+  subst entryAddress
+  subst entryDeclaration
+  exact List.mem_of_find?_eq_some hfind
+
+/-- The proof-facing list certificate rules out extern lookup through the
+actual first-binding-wins IxIR₀ environment used by validation. -/
+theorem env_ne_extern {declarations : List (Address × IxIR0.Decl)}
+    (hboundary : ValidatedExternsRejected declarations)
+    {address : Address} {arity : Nat} :
+    IxIR0.Env.ofList declarations address ≠ some (.extern arity) := by
+  intro hlookup
+  exact hboundary.not_mem (envOfList_some_mem hlookup)
+
+end ValidatedExternsRejected
+
+namespace ValidatedTargetExternsRejected
+
+/-- The target certificate excludes every extern row from the exact emitted
+artifact list. -/
+theorem not_mem {declarations : List (Address × IxIR1.Decl)}
+    (hboundary : ValidatedTargetExternsRejected declarations)
+    {address : Address} {arity : Nat} :
+    (address, .extern arity) ∉ declarations := by
+  intro hmember
+  induction declarations with
+  | nil => simp at hmember
+  | cons head tail ih =>
+      rcases head with ⟨headAddress, headDeclaration⟩
+      cases headDeclaration <;>
+        simp_all [ValidatedTargetExternsRejected,
+          firstValidatedTargetExtern?]
+
+private theorem lookupBuild_some_mem {α : Type}
+    {declarations : List (Address × α)} {address : Address} {value : α}
+    (hlookup : AddressEnv.lookup (AddressEnv.build declarations) address =
+      some value) :
+    (address, value) ∈ declarations := by
+  rw [AddressEnv.lookup_build_apply] at hlookup
+  obtain ⟨entry, hfind, hvalue⟩ := Option.map_eq_some_iff.mp hlookup
+  rcases entry with ⟨entryAddress, entryValue⟩
+  have hbeq : entryAddress == address :=
+    List.find?_some
+      (p := fun entry : Address × α => entry.1 == address) hfind
+  have haddress : entryAddress = address := Address.eq_of_beq hbeq
+  have hentryValue : entryValue = value := by simpa using hvalue
+  subst entryAddress
+  subst entryValue
+  exact List.mem_of_find?_eq_some hfind
+
+/-- The target list certificate also rules out extern lookup through the
+indexed first-binding-wins environment used by artifact consumers. -/
+theorem env_ne_extern {declarations : List (Address × IxIR1.Decl)}
+    (hboundary : ValidatedTargetExternsRejected declarations)
+    {address : Address} {arity : Nat} :
+    AddressEnv.lookup (AddressEnv.build declarations) address ≠
+      some (.extern arity) := by
+  intro hlookup
+  exact hboundary.not_mem (lookupBuild_some_mem hlookup)
+
+end ValidatedTargetExternsRejected
+
+/-- The executable compiler boundaries, retained together so validators and
+artifact consumers can inspect both the theorem-facing legacy erasure and the
+cycle-safe addressed program. -/
+structure Artifact where
+  /-- Exact output of the existing proof-facing eraser. -/
+  rawErasedDecls : List (Address × IxIR0.Decl)
+  /-- Executable IxIR₀ environment after mutual-block readdressing. -/
+  erasedDecls : List (Address × IxIR0.Decl)
+  erasedBlocks : List IxIR0.MutualBlock.Result
+  /-- Legacy mutual-member key to final block-derived key. -/
+  erasedAddressMap : IxIR0.MutualBlock.Renaming
+  /-- Dependency-ordered stable, ordinary, and mutual target artifacts. -/
+  targetArtifacts : List IxIR1.ReaddressAll.Artifact
+  main : IxIR1.Code
+  /-- Complete raw IxIR₁ producer name to emitted identity map.  It includes
+  identity entries for stable extern ABI declarations; no nonidentity domain
+  key remains in the target declarations or main code. -/
+  targetAddressMap : IxIR1.ReaddressAll.Renaming
+
+namespace Artifact
+
+/-- Flat evaluator environment projected from the richer target artifacts. -/
+def targetDecls (artifact : Artifact) : List (Address × IxIR1.Decl) :=
+  artifact.targetArtifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations
+
+/-- The exact evaluator declaration environment committed to by the target
+artifact graph and used to interpret checked HPT facts. -/
+def targetDeclEnv (artifact : Artifact) : IxIR1.Env :=
+  IxIR1.HPT.programDeclEnv artifact.targetArtifacts
+
+def targetBlocks (artifact : Artifact) : List IxIR1.MutualBlock.Result :=
+  artifact.targetArtifacts.filterMap fun
+    | .stable _ _ | .ordinary _ _ => none
+    | .mutual block => some block
+
+/-- Install a rebuilt target graph while composing the compiler's original
+producer-to-target map through the old-target-to-new-target rebuild map. -/
+def withRebuiltTarget (artifact : Artifact)
+    (result : IxIR1.ReaddressAll.Result) : Artifact :=
+  { artifact with
+    targetArtifacts := result.artifacts
+    main := result.main
+    targetAddressMap := artifact.targetAddressMap.map fun mapping =>
+      (mapping.1, IxIR1.Readdress.Renaming.apply result.addressMap mapping.2) }
+
+/-- Resource-configurable validation and cache addressing of an untrusted HPT
+result against this artifact's exact dependency-ordered target graph. -/
+def checkHPTWith (artifact : Artifact) (limits : IxIR1.HPT.Limits)
+    (certificate : IxIR1.HPT.Certificate) :
+    Except String IxIR1.HPT.Result :=
+  IxIR1.HPT.runWith limits artifact.targetArtifacts certificate
+
+/-- Default-budget HPT checking. Analysis remains optional until an
+optimization consumes it; callers cannot substitute a different program. -/
+def checkHPT (artifact : Artifact) (certificate : IxIR1.HPT.Certificate) :
+    Except String IxIR1.HPT.Result :=
+  artifact.checkHPTWith IxIR1.HPT.defaultLimits certificate
+
+/-- Deterministically produce, validate, and content-address an HPT
+certificate for this artifact's exact target graph. -/
+def produceHPTWith (artifact : Artifact)
+    (limits : IxIR1.HPT.ProducerLimits) :
+    Except String
+      (IxIR1.HPT.Production limits.checker artifact.targetArtifacts) :=
+  IxIR1.HPT.produceWith limits artifact.targetArtifacts
+
+def produceHPT (artifact : Artifact) :
+    Except String
+      (IxIR1.HPT.Production IxIR1.HPT.defaultProducerLimits.checker
+        artifact.targetArtifacts) :=
+  artifact.produceHPTWith IxIR1.HPT.defaultProducerLimits
+
+/-- Validate dependency-addressed persistent cache hits and rebuild misses
+artifact-locally before crossing the ordinary whole-program HPT checker. -/
+def produceHPTCachedWith (artifact : Artifact)
+    (limits : IxIR1.HPT.Cache.Limits) (store : IxIR1.HPT.Cache.Store) :
+    Except String
+      (IxIR1.HPT.Cache.Production limits artifact.targetArtifacts) :=
+  IxIR1.HPT.Cache.runWith limits artifact.targetArtifacts store
+
+def produceHPTCached (artifact : Artifact)
+    (store : IxIR1.HPT.Cache.Store) :
+    Except String
+      (IxIR1.HPT.Cache.Production IxIR1.HPT.Cache.defaultLimits
+        artifact.targetArtifacts) :=
+  artifact.produceHPTCachedWith IxIR1.HPT.Cache.defaultLimits store
+
+/-- Persistent specialization: cold-start an absent file, validate every
+present hit against this artifact, rebuild misses, and save the merged store. -/
+def produceHPTCachedFileWith (artifact : Artifact)
+    (limits : IxIR1.HPT.Cache.Limits) (path : System.FilePath) :
+    IO (Except IxIR1.HPT.CacheIO.Error
+      (IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)) :=
+  IxIR1.HPT.CacheIO.refreshFileWith limits artifact.targetArtifacts path
+
+def produceHPTCachedFile (artifact : Artifact) (path : System.FilePath) :
+    IO (Except IxIR1.HPT.CacheIO.Error
+      (IxIR1.HPT.Cache.Production IxIR1.HPT.Cache.defaultLimits
+        artifact.targetArtifacts)) :=
+  artifact.produceHPTCachedFileWith IxIR1.HPT.Cache.defaultLimits path
+
+/-- Scaling specialization: index canonical per-key chunks without retaining
+their payloads, lazily read only dependency-selected records, rebuild local
+misses/rejections, and durably publish each changed chunk. -/
+def produceHPTCachedDirectoryWith (artifact : Artifact)
+    (limits : IxIR1.HPT.CacheDirIO.Limits) (directory : System.FilePath) :
+    IO (Except IxIR1.HPT.CacheIO.Error
+      (IxIR1.HPT.Cache.Production limits.cache artifact.targetArtifacts)) :=
+  IxIR1.HPT.CacheDirIO.refreshDirectoryWith limits artifact.targetArtifacts
+    directory
+
+def produceHPTCachedDirectory (artifact : Artifact)
+    (directory : System.FilePath) :
+    IO (Except IxIR1.HPT.CacheIO.Error
+      (IxIR1.HPT.Cache.Production IxIR1.HPT.CacheDirIO.defaultLimits.cache
+        artifact.targetArtifacts)) :=
+  artifact.produceHPTCachedDirectoryWith
+    IxIR1.HPT.CacheDirIO.defaultLimits directory
+
+/-! ## First checked HPT consumer -/
+
+/-- Check an untrusted HPT certificate against this exact artifact graph and
+then use it to prune one root `call`→`case` redex. -/
+def checkAndPruneCaseWith (artifact : Artifact) (limits : IxIR1.HPT.Limits)
+    (certificate : IxIR1.HPT.Certificate) (input : IxIR1.Code) :
+    Except String (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.Outcome) := do
+  let analysis ← artifact.checkHPTWith limits certificate
+  return (analysis, IxIR1.HPT.CasePrune.run artifact.targetDeclEnv
+    certificate.summaryEnv input)
+
+def checkAndPruneCase (artifact : Artifact)
+    (certificate : IxIR1.HPT.Certificate) (input : IxIR1.Code) :
+    Except String (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.Outcome) :=
+  artifact.checkAndPruneCaseWith IxIR1.HPT.defaultLimits certificate input
+
+/-- Directly produced summaries have already crossed the same checker. -/
+def pruneCaseWithProducedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts)
+    (input : IxIR1.Code) : IxIR1.HPT.CasePrune.Outcome :=
+  IxIR1.HPT.CasePrune.run artifact.targetDeclEnv
+    production.certificate.summaryEnv input
+
+/-- Cached hits and local rebuilds likewise carry whole-program checker
+evidence before they can drive the consumer. -/
+def pruneCaseWithCachedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)
+    (input : IxIR1.Code) : IxIR1.HPT.CasePrune.Outcome :=
+  IxIR1.HPT.CasePrune.run artifact.targetDeclEnv
+    production.certificate.summaryEnv input
+
+/-- Check an untrusted HPT certificate and recursively prune every eligible
+`call`→`case` redex in the supplied code fragment. -/
+def checkAndPruneCasesRecursiveWith (artifact : Artifact)
+    (limits : IxIR1.HPT.Limits) (certificate : IxIR1.HPT.Certificate)
+    (input : IxIR1.Code) :
+    Except String (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.Outcome) := do
+  let analysis ← artifact.checkHPTWith limits certificate
+  return (analysis, IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+    certificate.summaryEnv input)
+
+def checkAndPruneCasesRecursive (artifact : Artifact)
+    (certificate : IxIR1.HPT.Certificate) (input : IxIR1.Code) :
+    Except String (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.Outcome) :=
+  artifact.checkAndPruneCasesRecursiveWith IxIR1.HPT.defaultLimits
+    certificate input
+
+/-- Recursively consume a directly produced, already checked summary. -/
+def pruneCasesRecursiveWithProducedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts)
+    (input : IxIR1.Code) : IxIR1.HPT.CasePrune.Outcome :=
+  IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+    production.certificate.summaryEnv input
+
+/-- Recursively consume a persistent-cache production, whose hits and
+rebuilt misses have crossed whole-program checking. -/
+def pruneCasesRecursiveWithCachedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)
+    (input : IxIR1.Code) : IxIR1.HPT.CasePrune.Outcome :=
+  IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+    production.certificate.summaryEnv input
+
+/-- Check a certificate and recursively prune the artifact's unhashed main.
+The resulting main is safe for `runMain`, including `callSelf` re-entry. -/
+def checkAndPruneMainWith (artifact : Artifact) (limits : IxIR1.HPT.Limits)
+    (certificate : IxIR1.HPT.Certificate) :
+    Except String (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.Outcome) := do
+  let analysis ← artifact.checkHPTWith limits certificate
+  return (analysis, IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+    certificate.summaryEnv artifact.main)
+
+def checkAndPruneMain (artifact : Artifact)
+    (certificate : IxIR1.HPT.Certificate) :
+    Except String (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.Outcome) :=
+  artifact.checkAndPruneMainWith IxIR1.HPT.defaultLimits certificate
+
+/-- Recursively prune the main with a directly produced checked summary. -/
+def pruneMainWithProducedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts) :
+    IxIR1.HPT.CasePrune.Outcome :=
+  IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+    production.certificate.summaryEnv artifact.main
+
+/-- Recursively prune the main with a checked persistent-cache production. -/
+def pruneMainWithCachedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts) :
+    IxIR1.HPT.CasePrune.Outcome :=
+  IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+    production.certificate.summaryEnv artifact.main
+
+/-! ## Readdressed declaration-graph case pruning -/
+
+/-- Check an untrusted HPT certificate, recursively prune every stored
+function body and the main, and rebuild all affected content addresses.  The
+returned HPT analysis describes the input graph and must not be reused as a
+certificate for the rebuilt graph. -/
+def checkAndPruneProgramWith (artifact : Artifact)
+    (limits : IxIR1.HPT.Limits) (certificate : IxIR1.HPT.Certificate) :
+    Except String
+      (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.ProgramOutcome) := do
+  let analysis ← artifact.checkHPTWith limits certificate
+  let outcome ← IxIR1.HPT.CasePrune.rebuildProgram []
+    artifact.targetArtifacts certificate.summaryEnv artifact.main
+  return (analysis, outcome)
+
+def checkAndPruneProgram (artifact : Artifact)
+    (certificate : IxIR1.HPT.Certificate) :
+    Except String
+      (IxIR1.HPT.Result × IxIR1.HPT.CasePrune.ProgramOutcome) :=
+  artifact.checkAndPruneProgramWith IxIR1.HPT.defaultLimits certificate
+
+/-- Rebuild a complete program using a directly produced checked summary. -/
+def pruneProgramWithProducedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts) :
+    Except String IxIR1.HPT.CasePrune.ProgramOutcome :=
+  IxIR1.HPT.CasePrune.rebuildProgram [] artifact.targetArtifacts
+    production.certificate.summaryEnv artifact.main
+
+/-- Rebuild a complete program using a checked persistent-cache production. -/
+def pruneProgramWithCachedHPT (artifact : Artifact)
+    {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts) :
+    Except String IxIR1.HPT.CasePrune.ProgramOutcome :=
+  IxIR1.HPT.CasePrune.rebuildProgram [] artifact.targetArtifacts
+    production.certificate.summaryEnv artifact.main
+
+/-- Materialize the pipeline artifact represented by a successful complete
+program pruning outcome. -/
+def installPrunedProgram (artifact : Artifact)
+    (outcome : IxIR1.HPT.CasePrune.ProgramOutcome) : Artifact :=
+  artifact.withRebuiltTarget outcome.result
+
+/-- Logical old-keyed declaration rows supplied to the rebuild stage. -/
+def prunedTargetEntries (artifact : Artifact)
+    (summaries : IxIR1.HPT.SummaryEnv) :
+    List (Address × IxIR1.Decl) :=
+  IxIR1.HPT.CasePrune.rewriteEntries
+    (IxIR1.HPT.programDeclEnv artifact.targetArtifacts) summaries
+    (IxIR1.HPT.declarationEntries artifact.targetArtifacts)
+
+/-- Source evaluator context paired with a rebuilt graph's oracle pullback. -/
+def pruneProgramSourceCtx (artifact : Artifact)
+    (summaries : IxIR1.HPT.SummaryEnv)
+    (outcome : IxIR1.HPT.CasePrune.ProgramOutcome)
+    (oracle : Address → List IxIR1.RVal → Option IxIR1.RVal) : IxIR1.Ctx :=
+  IxIR1.HPT.CasePrune.rebuildOriginalCtx outcome.result
+    (artifact.prunedTargetEntries summaries)
+    (IxIR1.HPT.programDeclEnv artifact.targetArtifacts) oracle
+
+/-- Checked complete-graph pruning transports the full evaluator result,
+including address-bearing heap nodes and errors. -/
+theorem runMain_pruneProgram_of_checkHPTWith_eq_ok
+    {artifact : Artifact} {limits : IxIR1.HPT.Limits}
+    {certificate : IxIR1.HPT.Certificate} {analysis : IxIR1.HPT.Result}
+    {outcome : IxIR1.HPT.CasePrune.ProgramOutcome}
+    (hcheck : artifact.checkHPTWith limits certificate = .ok analysis)
+    (hrebuild : IxIR1.HPT.CasePrune.rebuildProgram []
+      artifact.targetArtifacts certificate.summaryEnv artifact.main =
+      .ok outcome)
+    (oracle : Address → List IxIR1.RVal → Option IxIR1.RVal :=
+      fun _ _ => none)
+    (fuel : Nat := 100000) :
+    IxIR1.runMain (outcome.result.addressedCtx oracle)
+        outcome.result.main fuel =
+      IxIR1.Readdress.mapRunResult
+        (outcome.result.rebuildRename
+          (artifact.prunedTargetEntries certificate.summaryEnv))
+        (IxIR1.runMain
+          (artifact.pruneProgramSourceCtx certificate.summaryEnv
+            outcome oracle)
+          artifact.main fuel) := by
+  exact IxIR1.HPT.CasePrune.runMain_rebuildProgram_of_runWith_eq_ok
+    (by simpa [checkHPTWith] using hcheck) hrebuild oracle fuel
+
+/-- One successful combined pipeline call carries both checker and rebuild
+evidence needed by the complete evaluator transport theorem. -/
+theorem runMain_pruneProgram_of_checkAndPruneProgramWith_eq_ok
+    {artifact : Artifact} {limits : IxIR1.HPT.Limits}
+    {certificate : IxIR1.HPT.Certificate} {analysis : IxIR1.HPT.Result}
+    {outcome : IxIR1.HPT.CasePrune.ProgramOutcome}
+    (hrun : artifact.checkAndPruneProgramWith limits certificate =
+      .ok (analysis, outcome))
+    (oracle : Address → List IxIR1.RVal → Option IxIR1.RVal :=
+      fun _ _ => none)
+    (fuel : Nat := 100000) :
+    IxIR1.runMain (outcome.result.addressedCtx oracle)
+        outcome.result.main fuel =
+      IxIR1.Readdress.mapRunResult
+        (outcome.result.rebuildRename
+          (artifact.prunedTargetEntries certificate.summaryEnv))
+        (IxIR1.runMain
+          (artifact.pruneProgramSourceCtx certificate.summaryEnv
+            outcome oracle)
+          artifact.main fuel) := by
+  unfold checkAndPruneProgramWith at hrun
+  simp only [bind, Except.bind] at hrun
+  cases hcheck : artifact.checkHPTWith limits certificate with
+  | error message =>
+      rw [hcheck] at hrun
+      contradiction
+  | ok checked =>
+      rw [hcheck] at hrun
+      cases hrebuild : IxIR1.HPT.CasePrune.rebuildProgram []
+          artifact.targetArtifacts certificate.summaryEnv artifact.main with
+      | error message =>
+          rw [hrebuild] at hrun
+          contradiction
+      | ok rebuilt =>
+          rw [hrebuild] at hrun
+          have hpair : (checked, rebuilt) = (analysis, outcome) := by
+            injection hrun
+          have hanalysis : checked = analysis := congrArg Prod.fst hpair
+          have houtcome : rebuilt = outcome := congrArg Prod.snd hpair
+          subst analysis
+          subst outcome
+          exact runMain_pruneProgram_of_checkHPTWith_eq_ok
+            hcheck hrebuild oracle fuel
+
+/-- Checked pipeline specialization of the core exact evaluator theorem. -/
+theorem runCode_pruneCase_of_checkHPTWith_eq_ok
+    {artifact : Artifact} {limits : IxIR1.HPT.Limits}
+    {certificate : IxIR1.HPT.Certificate} {analysis : IxIR1.HPT.Result}
+    (hcheck : artifact.checkHPTWith limits certificate = .ok analysis)
+    {ctx : IxIR1.Ctx} {current : IxIR1.FnDef} {store : IxIR1.Store}
+    {environment : List IxIR1.RVal} {input : IxIR1.Code} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runCode ctx fuel current store environment
+        (IxIR1.HPT.CasePrune.run artifact.targetDeclEnv
+          certificate.summaryEnv input).code =
+      IxIR1.runCode ctx fuel current store environment input := by
+  exact IxIR1.HPT.CasePrune.runCode_run_eq_of_runWith_eq_ok
+    (program := artifact.targetArtifacts)
+    (by simpa [checkHPTWith] using hcheck)
+    (by simpa [targetDeclEnv] using hctx)
+
+/-- Direct-production consumer specialization. -/
+theorem runCode_pruneCaseWithProducedHPT_eq
+    {artifact : Artifact} {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {current : IxIR1.FnDef} {store : IxIR1.Store}
+    {environment : List IxIR1.RVal} {input : IxIR1.Code} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runCode ctx fuel current store environment
+        (artifact.pruneCaseWithProducedHPT production input).code =
+      IxIR1.runCode ctx fuel current store environment input := by
+  exact IxIR1.HPT.CasePrune.runCode_run_eq_of_postFixpoint
+    production.postFixpoint (by simpa [targetDeclEnv] using hctx)
+
+/-- Persistent-cache consumer specialization. -/
+theorem runCode_pruneCaseWithCachedHPT_eq
+    {artifact : Artifact} {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {current : IxIR1.FnDef} {store : IxIR1.Store}
+    {environment : List IxIR1.RVal} {input : IxIR1.Code} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runCode ctx fuel current store environment
+        (artifact.pruneCaseWithCachedHPT production input).code =
+      IxIR1.runCode ctx fuel current store environment input := by
+  exact IxIR1.HPT.CasePrune.runCode_run_eq_of_postFixpoint
+    production.postFixpoint (by simpa [targetDeclEnv] using hctx)
+
+/-- Checked pipeline specialization for recursive supplied-code pruning. -/
+theorem runCode_pruneCasesRecursive_of_checkHPTWith_eq_ok
+    {artifact : Artifact} {limits : IxIR1.HPT.Limits}
+    {certificate : IxIR1.HPT.Certificate} {analysis : IxIR1.HPT.Result}
+    (hcheck : artifact.checkHPTWith limits certificate = .ok analysis)
+    {ctx : IxIR1.Ctx} {current : IxIR1.FnDef} {store : IxIR1.Store}
+    {environment : List IxIR1.RVal} {input : IxIR1.Code} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runCode ctx fuel current store environment
+        (IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+          certificate.summaryEnv input).code =
+      IxIR1.runCode ctx fuel current store environment input := by
+  exact IxIR1.HPT.CasePrune.runCode_runRecursive_eq_of_runWith_eq_ok
+    (program := artifact.targetArtifacts)
+    (by simpa [checkHPTWith] using hcheck)
+    (by simpa [targetDeclEnv] using hctx)
+
+/-- Direct-production specialization for recursive supplied-code pruning. -/
+theorem runCode_pruneCasesRecursiveWithProducedHPT_eq
+    {artifact : Artifact} {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {current : IxIR1.FnDef} {store : IxIR1.Store}
+    {environment : List IxIR1.RVal} {input : IxIR1.Code} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runCode ctx fuel current store environment
+        (artifact.pruneCasesRecursiveWithProducedHPT production input).code =
+      IxIR1.runCode ctx fuel current store environment input := by
+  exact IxIR1.HPT.CasePrune.runCode_runRecursive_eq_of_postFixpoint
+    production.postFixpoint (by simpa [targetDeclEnv] using hctx)
+
+/-- Persistent-cache specialization for recursive supplied-code pruning. -/
+theorem runCode_pruneCasesRecursiveWithCachedHPT_eq
+    {artifact : Artifact} {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {current : IxIR1.FnDef} {store : IxIR1.Store}
+    {environment : List IxIR1.RVal} {input : IxIR1.Code} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runCode ctx fuel current store environment
+        (artifact.pruneCasesRecursiveWithCachedHPT production input).code =
+      IxIR1.runCode ctx fuel current store environment input := by
+  exact IxIR1.HPT.CasePrune.runCode_runRecursive_eq_of_postFixpoint
+    production.postFixpoint (by simpa [targetDeclEnv] using hctx)
+
+/-- A checked candidate preserves exact `runMain` behavior for the recursively
+pruned artifact main, including self calls. -/
+theorem runMain_pruneMain_of_checkHPTWith_eq_ok
+    {artifact : Artifact} {limits : IxIR1.HPT.Limits}
+    {certificate : IxIR1.HPT.Certificate} {analysis : IxIR1.HPT.Result}
+    (hcheck : artifact.checkHPTWith limits certificate = .ok analysis)
+    {ctx : IxIR1.Ctx} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runMain ctx
+        (IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+          certificate.summaryEnv artifact.main).code fuel =
+      IxIR1.runMain ctx artifact.main fuel := by
+  exact IxIR1.HPT.CasePrune.runMain_runRecursive_eq_of_runWith_eq_ok
+    (program := artifact.targetArtifacts)
+    (by simpa [checkHPTWith] using hcheck)
+    (by simpa [targetDeclEnv] using hctx)
+
+/-- Direct-production specialization for recursive main pruning. -/
+theorem runMain_pruneMainWithProducedHPT_eq
+    {artifact : Artifact} {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runMain ctx (artifact.pruneMainWithProducedHPT production).code
+        fuel =
+      IxIR1.runMain ctx artifact.main fuel := by
+  exact IxIR1.HPT.CasePrune.runMain_runRecursive_eq_of_postFixpoint
+    production.postFixpoint (by simpa [targetDeclEnv] using hctx)
+
+/-- Persistent-cache specialization for recursive main pruning. -/
+theorem runMain_pruneMainWithCachedHPT_eq
+    {artifact : Artifact} {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv) :
+    IxIR1.runMain ctx (artifact.pruneMainWithCachedHPT production).code fuel =
+      IxIR1.runMain ctx artifact.main fuel := by
+  exact IxIR1.HPT.CasePrune.runMain_runRecursive_eq_of_postFixpoint
+    production.postFixpoint (by simpa [targetDeclEnv] using hctx)
+
+/-- A function fact admitted by configurable HPT checking covers every
+successful invocation in a context backed by this artifact's exact target
+declaration environment. -/
+theorem functionSummary_sound_of_checkHPTWith_eq_ok
+    {artifact : Artifact} {limits : IxIR1.HPT.Limits}
+    {certificate : IxIR1.HPT.Certificate} {result : IxIR1.HPT.Result}
+    {ctx : IxIR1.Ctx} {address : Address} {function : IxIR1.FnDef}
+    {claimed : IxIR1.HPT.Fact} {arguments : List IxIR1.RVal}
+    {store outputStore : IxIR1.Store} {outputValue : IxIR1.RVal}
+    {fuel : Nat}
+    (hcheck : artifact.checkHPTWith limits certificate = .ok result)
+    (hctx : ctx.decls = artifact.targetDeclEnv)
+    (hdeclaration : artifact.targetDeclEnv address = some (.fn function))
+    (hsummary : certificate.summaryEnv address = some claimed)
+    (hinvoke : IxIR1.invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds artifact.targetDeclEnv outputStore outputValue := by
+  exact IxIR1.HPT.functionSummary_sound_of_runWith_eq_ok
+    (program := artifact.targetArtifacts) (by simpa [checkHPTWith] using hcheck)
+    (by simpa [targetDeclEnv] using hctx)
+    (by simpa [targetDeclEnv] using hdeclaration) hsummary hinvoke
+
+/-- Default-limit specialization of
+`functionSummary_sound_of_checkHPTWith_eq_ok`. -/
+theorem functionSummary_sound_of_checkHPT_eq_ok
+    {artifact : Artifact} {certificate : IxIR1.HPT.Certificate}
+    {result : IxIR1.HPT.Result} {ctx : IxIR1.Ctx} {address : Address}
+    {function : IxIR1.FnDef} {claimed : IxIR1.HPT.Fact}
+    {arguments : List IxIR1.RVal} {store outputStore : IxIR1.Store}
+    {outputValue : IxIR1.RVal} {fuel : Nat}
+    (hcheck : artifact.checkHPT certificate = .ok result)
+    (hctx : ctx.decls = artifact.targetDeclEnv)
+    (hdeclaration : artifact.targetDeclEnv address = some (.fn function))
+    (hsummary : certificate.summaryEnv address = some claimed)
+    (hinvoke : IxIR1.invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds artifact.targetDeclEnv outputStore outputValue := by
+  exact functionSummary_sound_of_checkHPTWith_eq_ok
+    (limits := IxIR1.HPT.defaultLimits)
+    (by simpa [checkHPT] using hcheck) hctx hdeclaration hsummary hinvoke
+
+/-- A row returned by deterministic production has the same evaluator
+guarantee as an accepted external certificate. -/
+theorem functionSummary_sound_of_producedHPT
+    {artifact : Artifact} {limits : IxIR1.HPT.ProducerLimits}
+    (production :
+      IxIR1.HPT.Production limits.checker artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {address : Address} {function : IxIR1.FnDef}
+    {claimed : IxIR1.HPT.Fact} {arguments : List IxIR1.RVal}
+    {store outputStore : IxIR1.Store} {outputValue : IxIR1.RVal}
+    {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv)
+    (hdeclaration : artifact.targetDeclEnv address = some (.fn function))
+    (hsummary : production.certificate.summaryEnv address = some claimed)
+    (hinvoke : IxIR1.invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds artifact.targetDeclEnv outputStore outputValue := by
+  exact production.functionSummary_sound
+    (by simpa [targetDeclEnv] using hctx)
+    (by simpa [targetDeclEnv] using hdeclaration) hsummary hinvoke
+
+/-- Cache hits and rebuilt rows have the same evaluator guarantee as ordinary
+checked and directly produced summaries. -/
+theorem functionSummary_sound_of_cachedHPT
+    {artifact : Artifact} {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts)
+    {ctx : IxIR1.Ctx} {address : Address} {function : IxIR1.FnDef}
+    {claimed : IxIR1.HPT.Fact} {arguments : List IxIR1.RVal}
+    {store outputStore : IxIR1.Store} {outputValue : IxIR1.RVal}
+    {fuel : Nat}
+    (hctx : ctx.decls = artifact.targetDeclEnv)
+    (hdeclaration : artifact.targetDeclEnv address = some (.fn function))
+    (hsummary : production.certificate.summaryEnv address = some claimed)
+    (hinvoke : IxIR1.invoke ctx fuel address arguments store =
+      .ok (outputStore, outputValue)) :
+    claimed.Holds artifact.targetDeclEnv outputStore outputValue := by
+  exact production.functionSummary_sound
+    (by simpa [targetDeclEnv] using hctx)
+    (by simpa [targetDeclEnv] using hdeclaration) hsummary hinvoke
+
+/-- Compatibility projection for consumers interested only in compiler-
+generated producer labels.  The authoritative provenance is the complete
+`targetAddressMap`; this view removes source-backed IxIR₀ declaration keys. -/
+def generatedAddressMap (artifact : Artifact) : IxIR1.Readdress.Renaming :=
+  let sourceKeys := artifact.erasedDecls.map Prod.fst
+  artifact.targetAddressMap.filter fun entry => !sourceKeys.contains entry.1
+
+/-! ## Versioned optimizer harness -/
+
+/-- Run the optimizer harness with a directly produced checked HPT artifact.  A
+disabled pass, unsupported policy, exhausted optimizer budget, or rejected
+rebuild returns this artifact unchanged and records the fail-soft decision. -/
+def optimizeWithProducedHPT (artifact : Artifact)
+    (policy : IxIR1.Optimizer.Policy)
+    {limits : IxIR1.HPT.Limits}
+    (production : IxIR1.HPT.Production limits artifact.targetArtifacts) :
+    Artifact × IxIR1.Optimizer.Report :=
+  let outcome := IxIR1.Optimizer.runWithProducedHPT policy
+    artifact.targetArtifacts artifact.main production
+  let optimized := outcome.rebuilt.map artifact.withRebuiltTarget |>.getD artifact
+  (optimized, outcome.report)
+
+/-- Cached checked summaries drive the same policy and report boundary. -/
+def optimizeWithCachedHPT (artifact : Artifact)
+    (policy : IxIR1.Optimizer.Policy)
+    {limits : IxIR1.HPT.Cache.Limits}
+    (production :
+      IxIR1.HPT.Cache.Production limits artifact.targetArtifacts) :
+    Artifact × IxIR1.Optimizer.Report :=
+  let outcome := IxIR1.Optimizer.runWithCachedHPT policy
+    artifact.targetArtifacts artifact.main production
+  let optimized := outcome.rebuilt.map artifact.withRebuiltTarget |>.getD artifact
+  (optimized, outcome.report)
+
+end Artifact
+
+/-- Turn an enumerable closed world into the proof-friendly resolver
+shared by checking and erasure. -/
+def resolverOf (constants : List (Address × Constant)) :
+    Address → Option Constant :=
+  fun address =>
+    (constants.find? (fun entry => entry.1 == address)).map (·.2)
+
+/-- Prebuilt source-constant index for corpus execution. Its two stages are
+explicit so repeated usage-check/evaluator resolution shares one hash map. -/
+abbrev ResolverIndex := AddressEnv.Index Constant
+
+def ResolverIndex.ofList (constants : List (Address × Constant)) :
+    ResolverIndex :=
+  AddressEnv.build constants
+
+def ResolverIndex.resolve (index : ResolverIndex) :
+    Address → Option Constant :=
+  AddressEnv.lookup index
+
+@[simp] theorem ResolverIndex.resolve_ofList
+    (constants : List (Address × Constant)) :
+    (ResolverIndex.ofList constants).resolve = resolverOf constants := by
+  exact AddressEnv.lookup_build constants
+
+private def enforce (metric : Ixon.Work.Metric) (actual limit : Nat) :
+    Except Error Unit :=
+  match Ixon.Work.ensure metric actual limit with
+  | .ok _ => .ok ()
+  | .error exceeded => .error (.resource exceeded)
+
+/-- Budget the shared checking prefix and return its single computed stats
+record so later stages do not need to rescan the source merely to preflight. -/
+def preflightCheck (limits : Limits)
+    (constants : List (Address × Constant)) (checkFuel : Nat) :
+    Except Error Ixon.Work.ProgramStats := do
+  let stats := Ixon.Work.programStats constants
+  enforce .programConstants stats.constants limits.maxConstants
+  enforce .programExpressionUnits stats.expressionUnits
+    limits.maxExpressionUnits
+  enforce .programExpandedExpressionUnits stats.expandedExpressionUnits
+    limits.maxExpandedExpressionUnits
+  enforce .layer1NodeVisits stats.layer1NodeVisits
+    limits.maxLayer1NodeVisits
+  enforce .usageFuel checkFuel limits.maxUsageFuel
+  return stats
+
+/-- Preflight the unvalidated compiler path, including the current
+append-based whole-program eraser. -/
+def preflightCompile (limits : Limits)
+    (constants : List (Address × Constant)) (checkFuel eraseFuel lowerFuel : Nat) :
+    Except Error Ixon.Work.ProgramStats := do
+  let stats ← preflightCheck limits constants checkFuel
+  enforce .erasedDeclarations stats.erasedDeclarations
+    limits.maxErasedDeclarations
+  enforce .erasureAppendCells stats.erasureAppendCells
+    limits.maxErasureAppendCells
+  enforce .erasureFuel eraseFuel limits.maxErasureFuel
+  enforce .loweringFuel lowerFuel limits.maxLoweringFuel
+  return stats
+
+/-- Preflight the proof-producing compiler path.  The attempt count charges
+the worst dependency order (one newly covered declaration per round) plus the
+final ordered certificate pass.  No catalog-wide `decide` is used: an
+over-sized proof-producing job is rejected before validation starts. -/
+def preflightValidated (limits : Limits)
+    (constants : List (Address × Constant))
+    (checkFuel eraseFuel validateFuel lowerFuel : Nat) :
+    Except Error Ixon.Work.ProgramStats := do
+  let stats ← preflightCompile limits constants checkFuel eraseFuel lowerFuel
+  enforce .certificateCandidates stats.certificateCandidates
+    limits.maxCertificateCandidates
+  enforce .certificateValidationAttempts stats.certificateValidationAttempts
+    limits.maxCertificateValidationAttempts
+  enforce .certificateSourceNodeWork stats.certificateSourceNodeWork
+    limits.maxCertificateSourceNodeWork
+  enforce .validationFuel validateFuel limits.maxValidationFuel
+  return stats
+
+/-- Check every constant after the caller has completed structural preflight. -/
+private def checkProgramCore (constants : List (Address × Constant))
+    (fuel : Nat) : Except Error Unit := do
+  let resolverIndex := ResolverIndex.ofList constants
+  let resolve := resolverIndex.resolve
+  for (address, constant) in constants do
+    match Ixon.UsageCheck.checkConstant resolve constant fuel with
+    | .ok _ => pure ()
+    | .error error => throw (.usage address error)
+
+/-- Check every constant, reporting which address failed. -/
+def checkProgram (constants : List (Address × Constant))
+    (fuel : Nat := Ixon.UsageCheck.defaultFuel)
+    (limits : Limits := {}) : Except Error Unit := do
+  let _ ← preflightCheck limits constants fuel
+  checkProgramCore constants fuel
+
+/-- Check, erase, and lower a closed program. `mainAddress` names the
+closed entry value or computation in the source environment; lowering
+rejects an unknown address or an entry incompatible with the requested
+result demand.
+
+The erasure step is **unvalidated**: this entry point accepts
+declarations and expression shapes beyond the configured
+`Covered`/`PErase` fragment. Use `compileValidated` when every
+declaration must carry a simulation certificate. -/
+def compile (constants : List (Address × Constant))
+    (mainAddress : Address) (config : Config := {})
+    (mainWorld : Owned := .shared)
+    (checkFuel : Nat := Ixon.UsageCheck.defaultFuel)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (lowerFuel : Nat := 10000) : Except Error Artifact := do
+  let _ ← preflightCompile config.limits constants checkFuel eraseFuel lowerFuel
+  checkProgramCore constants checkFuel
+  let resolverIndex := ResolverIndex.ofList constants
+  let resolve := resolverIndex.resolve
+  let eraseCtx : Erase.EraseCtx :=
+    { resolve, blobs := config.blobs, natBlock := config.natBlock }
+  let erased ←
+    match EraseAddressed.run eraseCtx constants (.ref mainAddress) eraseFuel with
+    | .ok result => pure result
+    | .error (.erase error) => throw (.erase error)
+    | .error (.readdress message) => throw (.readdress message)
+  match IxIR1.Lower.lowerAllIndexedFullyAddressed
+      erased.declarations erased.main
+      mainWorld lowerFuel with
+  | .ok addressed =>
+    pure
+      { rawErasedDecls := erased.raw
+        erasedDecls := erased.declarations
+        erasedBlocks := erased.addressed.blocks
+        erasedAddressMap := erased.addressMap
+        targetArtifacts := addressed.artifacts
+        main := addressed.main
+        targetAddressMap := addressed.addressMap }
+  | .error message => throw (.lower message)
+
+/-! ## The validator-gated entry point
+
+`compile` runs the eraser unvalidated, so the proof-producing
+`EraseValidator` is bypassable in the composed path.
+`compileValidated` closes that seam: after the usage gate and the
+(strict) eraser it requires a `Covered` certificate for **every**
+non-block constant against the exact erased environment, obtained
+uniformly through `EraseValidator.certifySharedProgram`. With empty sharing
+tables this route reduces to ordinary erasure. Mutual blocks themselves have no
+block-level judgment — their members are certified through the
+projection constants (`iPrj`/`cPrj`/`rPrj`/`dPrj`); an erased direct
+member reference without a certified projection fails closed at the
+referencing declaration. -/
+
+/-- Every executable definition/recursor member receives one finite slot in
+the simultaneous validator scope.  Inductive members have no executable body
+to certify. -/
+private def memberPlanForBlock (block : Address) :
+    Nat → List Ixon.MutConst → List Sim.MemberKey
+  | _, [] => []
+  | index, .indc _ :: rest =>
+      memberPlanForBlock block (index + 1) rest
+  | index, .defn _ :: rest =>
+      { block, idx := index } :: memberPlanForBlock block (index + 1) rest
+  | index, .recr _ :: rest =>
+      { block, idx := index } :: memberPlanForBlock block (index + 1) rest
+
+/-- Runtime-derived simultaneous-member scope for the exact closed program. -/
+def programMemberPlan
+    (constants : List (Address × Constant)) : List Sim.MemberKey :=
+  constants.flatMap fun entry =>
+    match entry.2.info with
+    | .muts members => memberPlanForBlock entry.1 0 members.toList
+    | _ => []
+
+/-- The source evaluator context used by the validated pipeline.  Exposing
+this exact closure lets semantic clients state source evaluation and sharing
+well-formedness against the same resolver that validation used. -/
+def validatedEvalCtx (constants : List (Address × Constant))
+    (config : Config) : Ixon.Eval.EvalCtx :=
+  let resolverIndex := ResolverIndex.ofList constants
+  { resolve := resolverIndex.resolve
+    blobs := config.blobs
+    natBlock := config.natBlock }
+
+/-- Closed source frame whose sole reference is the selected program main. -/
+def validatedMainFrame (mainAddress : Address) : Ixon.Eval.Frame :=
+  { refs := #[mainAddress] }
+
+/-- Canonical closed Ixon entry expression for `compileValidated`. -/
+def validatedMainSource : Ixon.Expr := .ref 0 #[]
+
+/-- Proof-facing result of validator-gated compilation.  It retains the exact
+closed-expression erasure certificate and both successful execution traces
+consumed by the fully addressed semantic theorem.  The production artifact is
+the `artifact` projection below; proof fields erase at runtime. -/
+structure ValidatedCompilation
+    (constants : List (Address × Constant)) (mainAddress : Address)
+    (config : Config) (mainWorld : Owned)
+    (eraseFuel lowerFuel : Nat) where
+  memberScope : Sim.MemberScope
+  erasure : EraseAddressed.RunTrace
+    (EraseValidator.eraseCtxOf (validatedEvalCtx constants config))
+    constants (.ref mainAddress) eraseFuel
+  entry : @EraseValidator.CertifiedSharedExpr
+    (validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList erasure.result.raw }
+    none (EraseValidator.tablesOfFrame (validatedMainFrame mainAddress))
+    (validatedMainFrame mainAddress).selfAddr [] eraseFuel
+    validatedMainSource memberScope
+  entryTarget : entry.target = (.ref mainAddress : IxIR0.Expr)
+  members : Sim.MemberCoverage
+    (validatedEvalCtx constants config).inlineSharing
+    { env := IxIR0.Env.ofList erasure.result.raw } memberScope.plan
+  strict : (validatedEvalCtx constants config).Strict
+  /-- The exact addressed IxIR₀ graph admitted to lowering contains no extern
+  declaration. This is the conservative certified ownership ABI: reopening
+  the boundary requires replacing this field with an explicit policy. -/
+  externsRejected : ValidatedExternsRejected erasure.result.declarations
+  lowering : IxIR1.Lower.FullyAddressedTrace
+    erasure.result.declarations erasure.result.main mainWorld lowerFuel
+  /-- Defense in depth over the actual emitted graph: lowering and content
+  addressing did not introduce an extern behind the source-side gate. -/
+  targetExternsRejected : ValidatedTargetExternsRejected
+    (lowering.result.artifacts.flatMap
+      IxIR1.ReaddressAll.Artifact.declarations)
+
+namespace ValidatedCompilation
+
+/-- Ordinary production artifact projected from the proof-facing traces. -/
+def artifact {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel) : Artifact :=
+  { rawErasedDecls := compilation.erasure.result.raw
+    erasedDecls := compilation.erasure.result.declarations
+    erasedBlocks := compilation.erasure.result.addressed.blocks
+    erasedAddressMap := compilation.erasure.result.addressMap
+    targetArtifacts := compilation.lowering.result.artifacts
+    main := compilation.lowering.result.main
+    targetAddressMap := compilation.lowering.result.addressMap }
+
+/-- No extern can be resolved from the exact addressed IxIR₀ input admitted
+to certified lowering. -/
+theorem addressedSourceEnv_ne_extern
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {address : Address} {arity : Nat} :
+    IxIR0.Env.ofList compilation.erasure.result.declarations address ≠
+      some (.extern arity) :=
+  compilation.externsRejected.env_ne_extern
+
+/-- The exact IxIR₁ declaration list returned to artifact consumers contains
+no extern declaration. -/
+theorem targetExtern_not_mem
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {address : Address} {arity : Nat} :
+    (address, .extern arity) ∉ compilation.artifact.targetDecls := by
+  simpa [artifact, Artifact.targetDecls] using
+    compilation.targetExternsRejected.not_mem (address := address)
+      (arity := arity)
+
+/-- Artifact consumers cannot resolve an extern through the exact indexed
+IxIR₁ declaration environment returned by validated compilation. -/
+theorem targetDeclEnv_ne_extern
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {address : Address} {arity : Nat} :
+    compilation.artifact.targetDeclEnv address ≠ some (.extern arity) := by
+  change AddressEnv.lookup
+      (AddressEnv.build (compilation.lowering.result.artifacts.flatMap
+        IxIR1.ReaddressAll.Artifact.declarations)) address ≠
+    some (.extern arity)
+  exact compilation.targetExternsRejected.env_ne_extern
+
+end ValidatedCompilation
+
+/-- One fixpoint round of coverage validation: attempt every pending
+address against the current database, extending it in place. Returns
+the grown database, this round's successes (in attempt order), and the
+still-rejected addresses with their diagnostics (in attempt order). -/
+private def coverageRound [Sim.MemberScope]
+    (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (validateFuel : Nat) (db : EraseValidator.CoverageDB ectx ictx) :
+    List Address →
+      EraseValidator.CoverageDB ectx ictx × List Address ×
+        List (Address × String)
+  | [] => (db, [], [])
+  | address :: rest =>
+    match EraseValidator.validateCovered ectx ictx db validateFuel address with
+    | .ok ha =>
+      let (db', oks, failed) := coverageRound ectx ictx validateFuel
+        ({ address, covered := ha.down } :: db) rest
+      (db', address :: oks, failed)
+    | .error message =>
+      let (db', oks, failed) := coverageRound ectx ictx validateFuel db rest
+      (db', oks, (address, message) :: failed)
+
+/-- Discover a dependency order for `certifyProgram` by fixpoint:
+repeat `coverageRound` until every candidate validates. Fail-closed —
+a round without progress reports the first still-rejected address and
+its validator diagnostic. At most `candidates + 1` rounds are needed,
+since a productive round covers at least one address. -/
+def coveragePlan [Sim.MemberScope]
+    (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (validateFuel : Nat) :
+    Nat → EraseValidator.CoverageDB ectx ictx → List Address →
+      List Address → Except (Address × String) (List Address)
+  | _, _, done, [] => .ok done.reverse
+  | 0, _, _, address :: _ =>
+    .error (address, "coverage validation did not converge")
+  | rounds + 1, db, done, pending =>
+    let (db', oks, failed) := coverageRound ectx ictx validateFuel db pending
+    if oks.isEmpty then
+      match failed with
+      | (address, message) :: _ => .error (address, message)
+      | [] => .ok done.reverse
+    else
+      coveragePlan ectx ictx validateFuel rounds db'
+        (oks.reverse ++ done) (failed.map (·.1))
+
+/-- Check, erase, **validate the exact erased output**, and lower.
+
+The composition of `compile` with the proof-producing erasure validator:
+after `checkProgram` and the strict eraser, every non-block constant must earn
+a `Covered` certificate against the erased environment. The whole program is
+then re-certified through the sharing-aware entry point, whose result records
+the erasure equation and simultaneous-member coverage for this exact constant
+list. The closed main is certified in the same runtime-derived member scope,
+and both lowering address passes retain their successful equations. The first
+declaration the validator rejects is reported as `Error.validate` with the
+validator's own diagnostic; `mainAddress` itself must be a certifiable
+declaration. Out-of-fragment programs belong to `compile`. -/
+private def compileValidatedCore [Sim.MemberScope]
+    (constants : List (Address × Constant))
+    (mainAddress : Address) (config : Config)
+    (mainWorld : Owned) (checkFuel eraseFuel validateFuel lowerFuel : Nat) :
+    Except Error (ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel) := do
+  let _ ← preflightValidated config.limits constants checkFuel eraseFuel
+    validateFuel lowerFuel
+  checkProgramCore constants checkFuel
+  let ectx := validatedEvalCtx constants config
+  -- the artifact of record: the strict pipeline eraser (split
+  -- constructor spines already fail closed here)
+  let eraseCtx := EraseValidator.eraseCtxOf ectx
+  let erasure ←
+    match EraseAddressed.runWithTrace eraseCtx constants (.ref mainAddress)
+        eraseFuel with
+    | .ok trace => pure trace
+    | .error (.erase error) => throw (.erase error)
+    | .error (.readdress message) => throw (.readdress message)
+  let erased := erasure.result
+  let externsRejected : PLift
+      (ValidatedExternsRejected erased.declarations) ←
+    match hboundary : firstValidatedExtern? erased.declarations with
+    | none => pure ⟨hboundary⟩
+    | some address =>
+      throw (.validate address
+        "validated extern ownership ABI rejects this declaration")
+  let rawErasedDecls := erased.raw
+  let erasedIndex := IxIR0.Env.Index.ofList rawErasedDecls
+  let ictx : IxIR0.Ctx := { env := erasedIndex.toEnv }
+  -- blocks carry no block-level judgment; everything else must certify
+  let candidates := constants.filterMap fun entry =>
+    match entry.2.info with
+    | .muts _ => none
+    | _ => some entry.1
+  unless candidates.contains mainAddress do
+    throw (.validate mainAddress "main address is not a certifiable declaration")
+  let rounds := candidates.length + 1
+  -- The sharing-aware validator is a strict generalization of the plain
+  -- route: with empty sharing tables its inliner is the identity, while one
+  -- uniform certificate type lets the closed main cross the semantic API.
+  let order ←
+    match coveragePlan ectx.inlineSharing ictx validateFuel rounds [] []
+        candidates with
+    | .error (address, message) => throw (.validate address message)
+    | .ok order => pure order
+  let program ←
+    match EraseValidator.certifySharedProgram ectx constants order
+        eraseFuel validateFuel with
+    | .error (.erase error) => throw (.erase error)
+    | .error (.relation message) => throw (.validate mainAddress message)
+    | .ok cert => pure cert
+  -- the certificate re-runs the (validator-configured) eraser; its
+  -- recorded target must be exactly what this pipeline lowers
+  if hprogramTarget : program.target == rawErasedDecls then
+    have hprogramTargetEq : program.target = rawErasedDecls :=
+      beq_iff_eq.mp hprogramTarget
+    let coverage : EraseValidator.CoverageDB ectx.inlineSharing ictx := by
+      simpa [ictx, erasedIndex] using hprogramTargetEq ▸ program.coverage
+    let entry ←
+      match EraseValidator.certifySharedClosedExpr ectx ictx coverage.oracle
+          (validatedMainFrame mainAddress) validatedMainSource eraseFuel
+          validateFuel with
+      | .error (.erase error) => throw (.erase error)
+      | .error (.relation message) => throw (.validate mainAddress message)
+      | .ok cert => pure cert
+    if hentryTarget : entry.target == (.ref mainAddress : IxIR0.Expr) then
+      have hentryTargetEq : entry.target =
+          (.ref mainAddress : IxIR0.Expr) := beq_iff_eq.mp hentryTarget
+      let lowering ←
+        match IxIR1.Lower.lowerAllIndexedFullyAddressedWithTrace
+            erased.declarations erased.main mainWorld lowerFuel with
+        | .ok trace => pure trace
+        | .error message => throw (.lower message)
+      let targetExternsRejected : PLift
+          (ValidatedTargetExternsRejected
+            (lowering.result.artifacts.flatMap
+              IxIR1.ReaddressAll.Artifact.declarations)) ←
+        match hboundary : firstValidatedTargetExtern?
+            (lowering.result.artifacts.flatMap
+              IxIR1.ReaddressAll.Artifact.declarations) with
+        | none => pure ⟨hboundary⟩
+        | some address =>
+          throw (.validate address
+            "certified lowering emitted an extern outside its ownership ABI")
+      let retainedEntry : @EraseValidator.CertifiedSharedExpr
+          (validatedEvalCtx constants config)
+          { env := IxIR0.Env.ofList erasure.result.raw }
+          none (EraseValidator.tablesOfFrame
+            (validatedMainFrame mainAddress))
+          (validatedMainFrame mainAddress).selfAddr [] eraseFuel
+          validatedMainSource (inferInstance : Sim.MemberScope) := by
+        simpa [ictx, erasedIndex] using entry
+      have retainedEntryTarget : retainedEntry.target =
+          (.ref mainAddress : IxIR0.Expr) := by
+        have hsame : retainedEntry.target = entry.target :=
+          Except.ok.inj (retainedEntry.erased.symm.trans entry.erased)
+        exact hsame.trans hentryTargetEq
+      have hstrictInline := program.members.strict
+      let retainedMembers : Sim.MemberCoverage
+          (validatedEvalCtx constants config).inlineSharing
+          { env := IxIR0.Env.ofList erasure.result.raw }
+          (inferInstance : Sim.MemberScope).plan := by
+        have hmembers := program.members
+        rw [hprogramTargetEq] at hmembers
+        simpa [rawErasedDecls] using hmembers
+      pure
+        { memberScope := inferInstance
+          erasure
+          entry := retainedEntry
+          entryTarget := retainedEntryTarget
+          members := retainedMembers
+          strict :=
+            { neutralElims := by simpa using hstrictInline.neutralElims
+              stringLiterals := by
+                simpa using hstrictInline.stringLiterals }
+          externsRejected := externsRejected.down
+          lowering
+          targetExternsRejected := targetExternsRejected.down }
+    else
+      throw (.validate mainAddress
+        "certified main differs from the compiled main reference")
+  else
+    throw (.validate mainAddress
+      "certified erasure differs from the compiled erasure")
+
+/-- Validator-gated production compiler with a simultaneous-member scope
+derived from the exact runtime program and all proof-facing pass equations
+retained. -/
+def compileValidatedWithTrace (constants : List (Address × Constant))
+    (mainAddress : Address) (config : Config := {})
+    (mainWorld : Owned := .shared)
+    (checkFuel : Nat := Ixon.UsageCheck.defaultFuel)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel)
+    (lowerFuel : Nat := 10000) : Except Error
+      (ValidatedCompilation constants mainAddress config mainWorld eraseFuel
+        lowerFuel) :=
+  letI _memberScope : Sim.MemberScope :=
+    { plan := programMemberPlan constants }
+  compileValidatedCore constants mainAddress config mainWorld checkFuel
+    eraseFuel validateFuel lowerFuel
+
+/-- Validator-gated production compiler with its proof-facing execution
+record erased from the returned artifact API. -/
+def compileValidated (constants : List (Address × Constant))
+    (mainAddress : Address) (config : Config := {})
+    (mainWorld : Owned := .shared)
+    (checkFuel : Nat := Ixon.UsageCheck.defaultFuel)
+    (eraseFuel : Nat := Erase.defaultFuel)
+    (validateFuel : Nat := Erase.defaultFuel)
+    (lowerFuel : Nat := 10000) : Except Error Artifact := do
+  return (← compileValidatedWithTrace constants mainAddress config mainWorld
+    checkFuel eraseFuel validateFuel lowerFuel).artifact
+
+/-! ## End-to-end integration fixture
+
+A two-constructor `Box` block gives the first constructor a unique
+result/field world and the second a shared result/field world. Its
+identity-like recursor rebuilds either major with the shared constructor.
+`dropFirst : Box →ᵃ Box →ω Box`
+discards its affine first argument and returns its shared second one;
+`main` constructs both boxes, calls `dropFirst`, then runs the block
+recursor on the survivor.
+
+The fixture forces all integration seams at once: the checker accepts
+the mixed modes, the eraser emits a real recursor declaration, the
+lowerer consumes that declaration, and the IxIR₁ runtime observes one
+unique deep-free plus shared RC traffic. -/
+
+section Guards
+
+private def address (byte : UInt8) : Address := Address.replicate byte
+
+private def aBlock := address 0x70
+private def aBox := address 0x71
+private def aCtor := address 0x72
+private def aRec := address 0x73
+private def aDropFirst := address 0x74
+private def aMain := address 0x75
+private def aEleven := address 0x76
+private def aTwentyTwo := address 0x77
+private def aUnused := address 0x78
+private def aSharedCtor := address 0x79
+
+private def boxType : Ixon.Expr := .ref 0 #[]
+
+private def boxInductive : Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 1
+        typ := .all .affine .unique (.sort 0) (.recur 0 #[]) },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .all .many .shared (.sort 0) (.recur 0 #[]) }
+    ] }
+
+/-- `Box.rec box = Box.mk box.field`, deliberately nontrivial so the
+lowered case body allocates a fresh shared result. -/
+private def boxRecursor : Ixon.Recursor :=
+  { k := false, isUnsafe := false, lvls := 0
+    params := 0, indices := 0, motives := 0, minors := 0
+    typ := .all .many .shared (.recur 0 #[]) (.recur 0 #[])
+    rules := #[
+      { fields := 1
+        rhs := .lam .many (.sort 0) (.app (.ref 0 #[]) (.var 0)) },
+      { fields := 1
+        rhs := .lam .many (.sort 0) (.app (.ref 0 #[]) (.var 0)) }
+    ] }
+
+private def cBlock : Constant :=
+  { info := .muts #[.indc boxInductive, .recr boxRecursor]
+    sharing := #[], refs := #[aSharedCtor], univs := #[.zero] }
+
+private def projection (info : Ixon.ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def cBox :=
+  projection (.iPrj { idx := 0, block := aBlock })
+
+private def cCtor :=
+  projection (.cPrj { idx := 0, cidx := 0, block := aBlock })
+
+private def cSharedCtor :=
+  projection (.cPrj { idx := 0, cidx := 1, block := aBlock })
+
+private def cRec :=
+  projection (.rPrj { idx := 1, block := aBlock })
+
+private def dropFirstValue : Ixon.Expr :=
+  .lam .affine boxType (.lam .many boxType (.var 0))
+
+private def cDropFirst : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .affine .shared boxType
+          (.all .many .shared boxType boxType)
+        value := dropFirstValue }
+    sharing := #[], refs := #[aBox], univs := #[.zero] }
+
+private def boxOfNat (blobRef : UInt64) : Ixon.Expr :=
+  .app (.ref 2 #[]) (.nat blobRef)
+
+/-- Manufacture a checker-shared, computational Nat field without an
+implicit freeze: projection is a shared borrow, and its temporary unique
+box is lowered in the projection's shared demand. -/
+private def sharedBoxOfNat (blobRef : UInt64) : Ixon.Expr :=
+  .app (.ref 6 #[]) (.prj 0 0 (boxOfNat blobRef))
+
+private def cMain : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .ref 0 #[]
+        value := .app (.ref 3 #[])
+          (.app (.app (.ref 1 #[]) (boxOfNat 4)) (sharedBoxOfNat 5)) }
+    sharing := #[]
+    refs := #[aBox, aDropFirst, aCtor, aRec, aEleven, aTwentyTwo,
+      aSharedCtor]
+    univs := #[.zero] }
+
+/-- A validated function deliberately absent from main's transitive runtime
+references. The compiler emits it; rooted reachability must remove
+its lowered declaration rather than relying only on a hand-written graph. -/
+private def cUnused : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .shared boxType boxType
+        value := .lam .many boxType
+          (.app (.ref 1 #[]) (.var 0)) }
+    sharing := #[]
+    refs := #[aBox, aRec]
+    univs := #[.zero] }
+
+/-- A usage-valid shared constructor result whose lowered main contains no
+dynamic application. The surrounding catalog still emits stored functions,
+so it gives rooted reachability an observable compiler-produced deletion. -/
+private def cReachMain : Constant :=
+  { cMain with
+    info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .ref 0 #[]
+        value := sharedBoxOfNat 4 } }
+
+private def constants : List (Address × Constant) :=
+  [(aBlock, cBlock), (aBox, cBox), (aCtor, cCtor),
+   (aSharedCtor, cSharedCtor), (aRec, cRec),
+   (aDropFirst, cDropFirst), (aMain, cMain)]
+
+private def blobs : Address → Option Ixon.Eval.Blob := fun a =>
+  if a == aEleven then some (.natB 11)
+  else if a == aTwentyTwo then some (.natB 22)
+  else none
+
+/-! Exact structural-budget boundary fixtures.  Every field is set to the
+measured requirement of this program; lowering any one field by one must name
+that precise metric, actual value, and limit before checking begins. -/
+
+private def budgetStats : Ixon.Work.ProgramStats :=
+  Ixon.Work.programStats constants
+
+private def exactLimits : Limits :=
+  { maxConstants := budgetStats.constants
+    maxExpressionUnits := budgetStats.expressionUnits
+    maxExpandedExpressionUnits := budgetStats.expandedExpressionUnits
+    maxLayer1NodeVisits := budgetStats.layer1NodeVisits
+    maxErasedDeclarations := budgetStats.erasedDeclarations
+    maxErasureAppendCells := budgetStats.erasureAppendCells
+    maxCertificateCandidates := budgetStats.certificateCandidates
+    maxCertificateValidationAttempts :=
+      budgetStats.certificateValidationAttempts
+    maxCertificateSourceNodeWork := budgetStats.certificateSourceNodeWork
+    maxUsageFuel := Ixon.UsageCheck.defaultFuel
+    maxErasureFuel := Erase.defaultFuel
+    maxValidationFuel := Erase.defaultFuel
+    maxLoweringFuel := 10000 }
+
+private def validatedPreflight (limits : Limits) :
+    Except Error Ixon.Work.ProgramStats :=
+  preflightValidated limits constants Ixon.UsageCheck.defaultFuel
+    Erase.defaultFuel Erase.defaultFuel 10000
+
+private def rejectsResource (metric : Ixon.Work.Metric)
+    (actual limit : Nat) (result : Except Error Ixon.Work.ProgramStats) : Bool :=
+  match result with
+  | .error (.resource exceeded) =>
+    exceeded.metric == metric && exceeded.actual == actual &&
+      exceeded.limit == limit
+  | _ => false
+
+private def exactBudgetAccepted : Bool :=
+  match validatedPreflight exactLimits with
+  | .ok stats => stats == budgetStats
+  | .error _ => false
+
+private def everyOneBelowBudgetRejected : Bool :=
+  let s := budgetStats
+  #[
+    rejectsResource .programConstants s.constants (s.constants - 1)
+      (validatedPreflight
+        { exactLimits with maxConstants := s.constants - 1 }),
+    rejectsResource .programExpressionUnits s.expressionUnits
+      (s.expressionUnits - 1)
+      (validatedPreflight
+        { exactLimits with maxExpressionUnits := s.expressionUnits - 1 }),
+    rejectsResource .programExpandedExpressionUnits s.expandedExpressionUnits
+      (s.expandedExpressionUnits - 1)
+      (validatedPreflight
+        { exactLimits with maxExpandedExpressionUnits :=
+            s.expandedExpressionUnits - 1 }),
+    rejectsResource .layer1NodeVisits s.layer1NodeVisits
+      (s.layer1NodeVisits - 1)
+      (validatedPreflight
+        { exactLimits with maxLayer1NodeVisits := s.layer1NodeVisits - 1 }),
+    rejectsResource .usageFuel Ixon.UsageCheck.defaultFuel
+      (Ixon.UsageCheck.defaultFuel - 1)
+      (validatedPreflight
+        { exactLimits with maxUsageFuel := Ixon.UsageCheck.defaultFuel - 1 }),
+    rejectsResource .erasedDeclarations s.erasedDeclarations
+      (s.erasedDeclarations - 1)
+      (validatedPreflight
+        { exactLimits with maxErasedDeclarations := s.erasedDeclarations - 1 }),
+    rejectsResource .erasureAppendCells s.erasureAppendCells
+      (s.erasureAppendCells - 1)
+      (validatedPreflight
+        { exactLimits with maxErasureAppendCells :=
+            s.erasureAppendCells - 1 }),
+    rejectsResource .erasureFuel Erase.defaultFuel
+      (Erase.defaultFuel - 1)
+      (validatedPreflight
+        { exactLimits with maxErasureFuel := Erase.defaultFuel - 1 }),
+    rejectsResource .loweringFuel 10000 9999
+      (validatedPreflight { exactLimits with maxLoweringFuel := 9999 }),
+    rejectsResource .certificateCandidates s.certificateCandidates
+      (s.certificateCandidates - 1)
+      (validatedPreflight
+        { exactLimits with maxCertificateCandidates :=
+            s.certificateCandidates - 1 }),
+    rejectsResource .certificateValidationAttempts
+      s.certificateValidationAttempts (s.certificateValidationAttempts - 1)
+      (validatedPreflight
+        { exactLimits with maxCertificateValidationAttempts :=
+            s.certificateValidationAttempts - 1 }),
+    rejectsResource .certificateSourceNodeWork s.certificateSourceNodeWork
+      (s.certificateSourceNodeWork - 1)
+      (validatedPreflight
+        { exactLimits with maxCertificateSourceNodeWork :=
+            s.certificateSourceNodeWork - 1 }),
+    rejectsResource .validationFuel Erase.defaultFuel
+      (Erase.defaultFuel - 1)
+      (validatedPreflight
+        { exactLimits with maxValidationFuel := Erase.defaultFuel - 1 })
+  ].all id
+
+#guard exactBudgetAccepted
+#guard everyOneBelowBudgetRejected
+
+private def compiled : Except Error Artifact :=
+  compile constants aMain { blobs }
+
+/-- The source evaluator returns the box built from the second
+argument, after rebuilding it through the recursor. -/
+private def sourceAgrees : Bool :=
+  let resolverIndex := ResolverIndex.ofList constants
+  let ctx : Ixon.Eval.EvalCtx := { resolve := resolverIndex.resolve, blobs }
+  let frame : Ixon.Eval.Frame := { refs := #[aMain] }
+  match Ixon.Eval.evalClosed ctx frame (.ref 0 #[]) with
+  | .ok (.ctorV block 0 1 [.litV (.natL 22)]) => block == aBlock
+  | _ => false
+
+/-- The actual erased recursor reaches IxIR₁ as a unary `case`
+function; this is not a hand-written IxIR₀ recursor fixture. -/
+private def recursorCrossesBothPasses : Bool :=
+  match compiled with
+  | .error _ => false
+  | .ok artifact =>
+    let transient := Erase.memberAddr aBlock 1
+    match artifact.erasedAddressMap.lookup transient,
+        artifact.rawErasedDecls.find? (fun entry => entry.1 == transient) with
+    | some member, some (_, .recursor 0 false rawRules) =>
+      match artifact.erasedDecls.find? (fun entry => entry.1 == member),
+          artifact.targetAddressMap.lookup member with
+      | some (_, .recursor 0 false rules), some targetMember =>
+        match artifact.targetDecls.find? (fun entry =>
+            entry.1 == targetMember) with
+        | some (_, .fn fn) =>
+          member != transient && targetMember != member &&
+          artifact.erasedBlocks.length == 1 &&
+          rawRules.size == 2 && rules.size == 2 && fn.arity == 1 &&
+          !(artifact.erasedDecls.map (·.1)).contains transient &&
+          !(artifact.targetDecls.map (·.1)).contains transient &&
+          !(artifact.targetDecls.map (·.1)).contains member &&
+          match fn.body with
+          | .case _ false alts => alts.size == 2
+          | _ => false
+        | _ => false
+      | _, _ => false
+    | _, _ => false
+
+/-- Runtime result and cost facts for the composed pipeline. Before
+releasing the result: two input boxes + one pap + one rebuilt box were
+allocated; the unique input, pap, and shared major were reclaimed.
+Releasing the result leaves an empty store. -/
+private def targetAgrees : Bool :=
+  match compiled with
+  | .error _ => false
+  | .ok artifact =>
+    let targetIndex := IxIR1.Env.Index.ofList artifact.targetDecls
+    let ctx : IxIR1.Ctx := { decls := targetIndex.toEnv }
+    match IxIR1.runMain ctx artifact.main with
+    | .ok (store, value@(.loc location)) =>
+      let shape := match store.get? location with
+        | some box =>
+          match box.node with
+          | .ctorN cid fields =>
+            cid.block == aSharedCtor && cid.cidx == 1 &&
+              fields.toList == [.lit (.nat 22)]
+          | _ => false
+        | none => false
+      shape && store.allocs == 5 && store.frees == 4 &&
+        store.rcops == 3 && store.live == 1 &&
+        match IxIR1.dropVal ctx 100000 store value with
+        | .ok released =>
+          released.allocs == 5 && released.frees == 5 &&
+            released.rcops == 4 && released.live == 0
+        | .error _ => false
+    | _ => false
+
+/-- Optimizer observations run on actual compiler output, not only a
+hand-written IxIR₁ graph. Independent runs must agree byte-for-byte on their
+reports and output roots; disabling the pass must select the exact input
+graph. -/
+private def optimizerHarnessOnCompiled : Bool :=
+  match compiled with
+  | .error _ => false
+  | .ok artifact =>
+      match artifact.produceHPT with
+      | .error _ => false
+      | .ok production =>
+          let (firstArtifact, firstReport) :=
+            artifact.optimizeWithProducedHPT IxIR1.Optimizer.defaultPolicy
+              production
+          let (repeatArtifact, repeatReport) :=
+            artifact.optimizeWithProducedHPT IxIR1.Optimizer.defaultPolicy
+              production
+          let disabledPolicy : IxIR1.Optimizer.Policy :=
+            { casePrune := { enabled := false }
+              fetchForward := { enabled := false }
+              destruction := { enabled := false }
+              papFuse := { enabled := false }
+              reachability := { enabled := false } }
+          let (disabledArtifact, disabledReport) :=
+            artifact.optimizeWithProducedHPT disabledPolicy production
+          let inputRoot := IxIR1.Optimizer.graphRoot artifact.targetArtifacts
+            artifact.main
+          let firstRoot := IxIR1.Optimizer.graphRoot
+            firstArtifact.targetArtifacts firstArtifact.main
+          let repeatRoot := IxIR1.Optimizer.graphRoot
+            repeatArtifact.targetArtifacts repeatArtifact.main
+          firstReport.before.functions > 0 &&
+            firstReport.before.counts.instructions > 0 &&
+            firstReport.before.codeBytes > 0 &&
+            firstReport.certificateBytes > 0 &&
+            firstReport.inputRoot == inputRoot &&
+            firstReport.outputRoot == firstRoot &&
+            firstReport.after == IxIR1.Optimizer.observe
+              firstArtifact.targetArtifacts firstArtifact.main &&
+            firstRoot == repeatRoot &&
+            firstReport.bytes == repeatReport.bytes &&
+            firstReport.address == repeatReport.address &&
+            disabledReport.disposition ==
+              .skipped IxIR1.Optimizer.SkipReason.disabled &&
+            disabledReport.inputRoot == inputRoot &&
+            disabledReport.outputRoot == inputRoot &&
+            IxIR1.Optimizer.graphRoot disabledArtifact.targetArtifacts
+              disabledArtifact.main == inputRoot
+
+private def destructionCid : IxIR1.CtorId :=
+  { block := address 0x7d, indIdx := 0, cidx := 0 }
+
+/-- The first binding proves scalar-drop elimination; the unique allocation
+proves exact all-scalar leaf destruction.  Keeping both in `main` exercises
+the sentinel analysis owner as well as the empty-program rebuild path. -/
+private def destructionMain : IxIR1.Code :=
+  .letOp (.pure (.lit (.nat 5)))
+    (.letOp (.drop (.var 0))
+      (.letOp (.alloc .unique destructionCid #[.lit (.nat 7)])
+        (.letOp (.dropU (.var 0))
+          (.ret (.lit (.nat 42))))))
+
+private def destructionRuntimeOk (code : IxIR1.Code) : Bool :=
+  match IxIR1.runMain { decls := IxIR1.Env.empty } code with
+  | .ok (store, .lit (.nat 42)) =>
+      store.allocs == 1 && store.frees == 1 && store.rcops == 0 &&
+        store.live == 0
+  | _ => false
+
+/-- Checked production specializes both destructor sites, attributes the
+changes, preserves the exact executable observation, and reaches a structural
+fixed point on the immediately rechecked output. -/
+private def optimizerSpecializesDestruction : Bool :=
+  match IxIR1.HPT.produce ([] : List IxIR1.ReaddressAll.Artifact) with
+  | .error _ => false
+  | .ok production =>
+      let first := IxIR1.Optimizer.runWithProducedHPT
+        IxIR1.Optimizer.defaultPolicy [] destructionMain production
+      let optimizedMain := first.main destructionMain
+      let second := IxIR1.Optimizer.runWithProducedHPT
+        IxIR1.Optimizer.defaultPolicy [] optimizedMain production
+      let unsupportedPolicy : IxIR1.Optimizer.Policy :=
+        { destruction := { version := 0 } }
+      let unsupported := IxIR1.Optimizer.runWithProducedHPT
+        unsupportedPolicy [] destructionMain production
+      destructionRuntimeOk destructionMain &&
+        destructionRuntimeOk optimizedMain &&
+        first.report.disposition == .changed &&
+        first.report.elidedScalarDrops == 1 &&
+        first.report.specializedUniqueDrops == 1 &&
+        first.report.before.counts.rcDecrements == 1 &&
+        first.report.before.counts.uniqueDrops == 1 &&
+        first.report.before.counts.frees == 0 &&
+        first.report.after.counts.rcDecrements == 0 &&
+        first.report.after.counts.uniqueDrops == 0 &&
+        first.report.after.counts.frees == 1 &&
+        second.report.disposition == .unchanged &&
+        second.report.elidedScalarDrops == 0 &&
+        second.report.specializedUniqueDrops == 0 &&
+        second.report.inputRoot == second.report.outputRoot &&
+        (second.main optimizedMain).bytes == optimizedMain.bytes &&
+        unsupported.rebuilt.isNone &&
+        unsupported.report.disposition ==
+          .skipped (.unsupportedDestructionVersion 0
+            IxIR1.Optimizer.currentDestructionVersion)
+
+private def reachabilityConstants : List (Address × Constant) :=
+  [(aBlock, cBlock), (aBox, cBox), (aCtor, cCtor),
+   (aSharedCtor, cSharedCtor), (aRec, cRec),
+   (aDropFirst, cDropFirst), (aMain, cReachMain),
+   (aUnused, cUnused)]
+
+/-- Production Ixon→IxIR₁ compilation emits stored functions which the
+default rooted pass then removes. This closes the compiler-emitted witness,
+rather than relying only on a hand-written IxIR₁ declaration graph. -/
+private def compilerReachabilityRemovesUnused : Bool :=
+  match compile reachabilityConstants aMain { blobs } with
+  | .error _ => false
+  | .ok artifact =>
+      match artifact.produceHPT with
+      | .error _ => false
+      | .ok production =>
+          let (optimized, report) := artifact.optimizeWithProducedHPT
+            IxIR1.Optimizer.defaultPolicy production
+          let ctx : IxIR1.Ctx := { decls := optimized.targetDeclEnv }
+          let result := IxIR1.runMain ctx optimized.main
+          report.disposition == .changed &&
+            report.removedDeclarations == 5 &&
+            report.before.functions == 6 && report.after.functions == 1 &&
+            match result with
+            | .ok (store, .loc location) =>
+                match store.get? location with
+                | some box =>
+                    match box.node with
+                    | .ctorN cid fields =>
+                        cid.block == aSharedCtor && cid.cidx == 1 &&
+                          fields.toList == [.lit (.nat 11)]
+                    | _ => false
+                | none => false
+            | _ => false
+
+/-- A double use of the affine parameter is stopped at the first
+pipeline gate, before erasure or lowering can observe the program. -/
+private def badDropFirst : Constant :=
+  { cDropFirst with
+    info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .affine .shared boxType
+          (.all .many .shared boxType boxType)
+        value := .lam .affine boxType
+          (.lam .many boxType (.app (.var 1) (.var 1))) } }
+
+private def rejectsBadUsage : Bool :=
+  let bad := constants.map fun entry =>
+    if entry.1 == aDropFirst then (aDropFirst, badDropFirst) else entry
+  match compile bad aMain { blobs } with
+  | .error (.usage address (.binderCovers .affine .many)) =>
+    address == aDropFirst
+  | _ => false
+
+#guard sourceAgrees
+
+/-! ### The validated entry point
+
+The same mixed-mode/add fixture must compile identically through
+`compileValidated` (every constant of the fixture is inside the
+validator's fragment), and one out-of-fragment declaration must flip
+the verdict between the two entry points. -/
+
+private def validated : Except Error Artifact :=
+  compileValidated constants aMain { blobs }
+
+/-- `compileValidated` reproduces `compile` on the in-fragment
+fixture: the same erased declarations, the same target addresses, and
+the same runtime result and cost facts as `targetAgrees` pins. -/
+private def validatedAgrees : Bool :=
+  match compiled, validated with
+  | .ok direct, .ok gated =>
+    direct.rawErasedDecls == gated.rawErasedDecls &&
+    direct.erasedDecls == gated.erasedDecls &&
+    direct.erasedAddressMap == gated.erasedAddressMap &&
+    direct.targetAddressMap == gated.targetAddressMap &&
+    direct.targetBlocks.map (·.blockAddress) ==
+      gated.targetBlocks.map (·.blockAddress) &&
+    direct.targetDecls.map (·.1) == gated.targetDecls.map (·.1) &&
+    (let targetIndex := IxIR1.Env.Index.ofList gated.targetDecls
+     let ctx : IxIR1.Ctx := { decls := targetIndex.toEnv }
+     match IxIR1.runMain ctx gated.main with
+     | .ok (store, .loc location) =>
+       (match store.get? location with
+        | some box =>
+          match box.node with
+          | .ctorN cid fields =>
+            cid.block == aSharedCtor && cid.cidx == 1 &&
+              fields.toList == [.lit (.nat 22)]
+          | _ => false
+        | none => false) &&
+       store.allocs == 5 && store.frees == 4 && store.rcops == 3 &&
+       store.live == 1
+     | _ => false)
+  | _, _ => false
+
+/-- An axiom is UsageCheck-clean and erases to an extern, so the
+unvalidated pipeline accepts it. The certified pipeline rejects the exact
+addressed extern graph before lowering and retains that check as a proof field. -/
+private def aGhostAxiom := address 0x7c
+
+private def cGhostAxiom : Constant :=
+  { info := .axio { isUnsafe := false, lvls := 0, typ := .sort 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def outOfFragment : List (Address × Constant) :=
+  constants ++ [(aGhostAxiom, cGhostAxiom)]
+
+private def acceptsOutOfFragment : Bool :=
+  match compile outOfFragment aMain { blobs } with
+  | .ok _ => true
+  | .error _ => false
+
+private def rejectsOutOfFragment : Bool :=
+  match compileValidated outOfFragment aMain { blobs } with
+  | .error (.validate rejected message) =>
+    rejected == aGhostAxiom &&
+      message == "validated extern ownership ABI rejects this declaration"
+  | _ => false
+
+/-- Native integration fixtures are evaluated by the compiled test executable:
+the cycle-safe block pass invokes the BLAKE3 FFI and therefore cannot live in
+an elaboration-time `#guard`. -/
+def nativeIntegrationChecks : List (String × Bool) :=
+  [("addressed recursor crosses erasure and lowering",
+      recursorCrossesBothPasses),
+   ("addressed pipeline runtime and cost", targetAgrees),
+   ("compiler-produced optimizer report is deterministic and disable-safe",
+      optimizerHarnessOnCompiled),
+   ("checked optimizer specializes exact destruction and reaches a fixed point",
+      optimizerSpecializesDestruction),
+   ("compiler-emitted unreachable declarations are removed",
+      compilerReachabilityRemovesUnused),
+   ("usage rejection precedes addressed erasure", rejectsBadUsage),
+   ("validated and direct addressed pipelines agree", validatedAgrees),
+   ("unvalidated addressed pipeline accepts configured fragment",
+      acceptsOutOfFragment),
+   ("validated addressed pipeline rejects uncovered extern",
+      rejectsOutOfFragment)]
+
+end Guards
+
+end Ix.Compiler.Pipeline
diff --git a/Ix/Compiler/PipelineApply.lean b/Ix/Compiler/PipelineApply.lean
new file mode 100644
index 000000000..e5bdf3bc1
--- /dev/null
+++ b/Ix/Compiler/PipelineApply.lean
@@ -0,0 +1,85 @@
+import Ix.Compiler.PipelineSound
+import Ix.Compiler.SimApply
+
+/-! Runtime application contracts derived from a validated compilation.
+The stored function graph and source application trace supply the semantic
+inputs; compiler-owned value, progress, and ownership contracts are closed
+from the retained lowering run. -/
+
+namespace Ix.Compiler.Pipeline.ValidatedCompilation
+open Ix.Compiler.Ixon (Address Constant Owned)
+open Ix.Compiler.IxIR1 Ix.Compiler.IxIR1.Lower Ix.Compiler.IxIR1.LowerSim
+
+variable {constants : List (Address × Constant)} {root : Address} {config : Config}
+  {world : Owned} {eraseFuel lowerFuel : Nat}
+
+private theorem runtimeLowerRun
+    (source : ValidatedCompilation constants root config world eraseFuel lowerFuel) :
+    (lowerAllAction source.erasure.result.declarations source.erasure.result.main world lowerFuel).run {} =
+      .ok (source.lowering.raw, source.lowering.mainCode) source.lowering.finalState := by
+  simpa only [lowerAllIndexedAction_eq_lowerAllAction] using source.lowering.lowerRun
+
+theorem runtimeValueContracts
+    (source : ValidatedCompilation constants root config world eraseFuel lowerFuel) :
+    CompilerValueContracts source.functionRel source.addressedSourceCtx
+      (IxIR0.Env.ofList source.erasure.result.declarations) (source.exactTargetCtx (fun _ _ => none)) :=
+  lowerAllAction_compilerValueContracts rfl source.runtimeLowerRun
+    (fun member => source.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+    (source.exactExtraRepresented (fun _ _ => none))
+    (source.exactCompilerContracts (fun _ _ => none)).1
+    (source.externValueContract (fun _ _ => none))
+
+theorem runtimeProgressContracts
+    (source : ValidatedCompilation constants root config world eraseFuel lowerFuel) :
+    CompilerTraceProgressContracts source.functionRel source.addressedSourceCtx
+      (IxIR0.Env.ofList source.erasure.result.declarations) (source.exactTargetCtx (fun _ _ => none)) :=
+  lowerAllAction_compilerTraceProgressContracts rfl source.runtimeLowerRun
+    (fun member => source.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+    (source.exactExtraRepresented (fun _ _ => none))
+    (source.exactCompilerContracts (fun _ _ => none)).1 source.runtimeValueContracts
+    (source.externTraceProgressContract (fun _ _ => none))
+
+/-- Runtime closure/application traces cross the same mutual-block address
+map as the compiled module entry. -/
+theorem runtimeTraceRenames
+    (source : ValidatedCompilation constants root config world eraseFuel lowerFuel) :
+    IxIR0.Readdress.Ctx.TraceRenames
+      (IxIR0.MutualBlock.Renaming.apply source.erasure.result.addressMap)
+      source.rawCtx source.addressedSourceCtx := by
+  have audit := EraseAddressed.semanticAudit_of_run_eq_ok source.erasure.runEq
+  have raw := source.erasure.result.raw_eq_grouped audit
+  have contexts := source.erasure.result.addressed.traceRenames_rawCtx
+    (source.erasure.result.addressed_audit audit)
+    (fun _ _ => none)
+    (IxIR0.Readdress.Oracle.readdress source.erasure.result.addressMap (fun _ _ => none))
+    (IxIR0.Readdress.Oracle.readdress_compatible
+      (IxIR0.Readdress.Oracle.Readdressable.empty source.erasure.result.addressMap))
+  simpa only [rawCtx, addressedSourceCtx, EraseAddressed.Result.rawCtx, EraseAddressed.Result.addressMap,
+    IxIR0.Readdress.Result.rawCtx, raw] using contexts
+
+/-- Apply a source-related runtime function through the actual compiled
+IxIR₁ context. Successful source application implies target termination and
+value agreement, while the compiler supplies complete root ownership. -/
+theorem runtimeApply
+    (source : ValidatedCompilation constants root config world eraseFuel lowerFuel)
+    {limit : Nat} {store : Store} {function : RVal} {arguments : List RVal}
+    {sourceFunction sourceResult : IxIR0.Value} {sourceArguments : List IxIR0.Value}
+    (functionGraph : Sim.ValueGraph source.functionRel store sourceFunction function)
+    (argumentsGraph : Sim.ValuesGraph source.functionRel store sourceArguments arguments)
+    (trace : IxIR0.ProjectionSafe.AppliesBelow source.addressedSourceCtx limit
+      sourceFunction sourceArguments sourceResult)
+    (nonempty : sourceArguments ≠ [])
+    (ownership : Sim.RootOwnership store (⟨.shared, function⟩ :: Sim.rootsFor .shared arguments)) :
+    ∃ fuel output value,
+      applyGo (source.exactTargetCtx (fun _ _ => none)) fuel store function arguments = .ok (output, value) ∧
+      Sim.ValueGraph source.functionRel output sourceResult value ∧
+      Sim.RootOwnership output [⟨.shared, value⟩] := by
+  obtain ⟨fuel, output, value, run⟩ := source.runtimeProgressContracts.apply.progresses limit
+    functionGraph argumentsGraph trace nonempty Sim.RootsGraph.nil (by simpa using ownership)
+  have related := source.runtimeValueContracts.apply.preserves functionGraph argumentsGraph
+    (SourceAppliesSafelyBelow.sourceApplies trace) Sim.RootsGraph.nil (by simpa using ownership) run
+  have owned := (source.exactCompilerContracts (fun _ _ => none)).1.apply.preserves
+    (rest := []) (by simpa using ownership) run
+  exact ⟨fuel, output, value, run, related.1, owned⟩
+
+end Ix.Compiler.Pipeline.ValidatedCompilation
diff --git a/Ix/Compiler/PipelineErasure.lean b/Ix/Compiler/PipelineErasure.lean
new file mode 100644
index 000000000..646d03eb2
--- /dev/null
+++ b/Ix/Compiler/PipelineErasure.lean
@@ -0,0 +1,212 @@
+import Ix.Compiler.Pipeline
+import Ix.Compiler.Ixon.RecursorUsage
+
+/-!
+# Certified erasure of an explicit closed entry
+
+The original compiler keeps its reference-entry and v0 usage interfaces.
+This separate entry accepts a closed expression and retains its reconstructed
+ownership result before selecting an ownership lowering policy. The strict
+eraser, sharing-aware validator, member coverage, and extern boundary are the
+same ones used by the ordinary validated compiler.
+-/
+
+namespace Ix.Compiler.Pipeline
+
+open Ix.Compiler.Ixon (Address Constant Owned)
+
+structure ClosedEntry where
+  refs : Array Address
+  univs : Array Ixon.Univ := #[]
+  source : Ixon.Expr
+
+def ClosedEntry.frame (entry : ClosedEntry) : Ixon.Eval.Frame :=
+  { refs := entry.refs, univs := entry.univs }
+
+theorem ClosedEntry.frameSharingWF (entry : ClosedEntry) : entry.frame.SharingWF := by
+  constructor
+  · rfl
+  · intro index member hget
+    simp [ClosedEntry.frame] at hget
+
+inductive UsagePolicy where
+  | v0
+  | saturatedRecursorV1
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def UsagePolicy.tag : UsagePolicy → String
+  | .v0 => "usage/0"
+  | .saturatedRecursorV1 => Ixon.RecursorUsage.policyTag
+
+def UsagePolicy.checkConstant (policy : UsagePolicy)
+    (resolve : Address → Option Constant) (constant : Constant) (fuel : Nat) :=
+  match policy with
+  | .v0 => Ixon.UsageCheck.checkConstant resolve constant fuel
+  | .saturatedRecursorV1 => Ixon.RecursorUsage.checkConstant resolve constant fuel
+
+private def checkConstants (policy : UsagePolicy)
+    (resolve : Address → Option Constant) (fuel : Nat) :
+    (constants : List (Address × Constant)) → Except Error (PLift
+      (∀ pair ∈ constants, policy.checkConstant resolve pair.2 fuel = .ok ()))
+  | [] => .ok ⟨by simp⟩
+  | pair :: rest => do
+      match hc : policy.checkConstant resolve pair.2 fuel with
+      | .error error => throw (.usage pair.1 error)
+      | .ok _ =>
+          let checked ← checkConstants policy resolve fuel rest
+          return ⟨by
+            intro item hitem
+            rcases List.mem_cons.mp hitem with heq | hrest
+            · subst item; exact hc
+            · exact checked.down item hrest⟩
+
+def ClosedEntry.usageContext (constants : List (Address × Constant))
+    (entry : ClosedEntry) : Ixon.UsageCheck.CheckCtx :=
+  { resolve := (ResolverIndex.ofList constants).resolve, refs := entry.refs }
+
+structure CertifiedErasure (constants : List (Address × Constant))
+    (entry : ClosedEntry) (config : Config) (policy : UsagePolicy)
+    (world : Owned) (checkFuel eraseFuel : Nat) where
+  usage : ∀ pair ∈ constants, policy.checkConstant
+    (ResolverIndex.ofList constants).resolve pair.2 checkFuel = .ok ()
+  entryUsage : Ixon.UsageCheck.check (entry.usageContext constants) checkFuel
+    false [] entry.source = .ok ([], world)
+  entrySharesBelow : Ixon.Sharing.sharesBelow 0 entry.source = true
+  memberScope : Sim.MemberScope
+  rawMain : IxIR0.Expr
+  erasure : EraseAddressed.RunTrace
+    (EraseValidator.eraseCtxOf (validatedEvalCtx constants config))
+    constants rawMain eraseFuel
+  certificate : @EraseValidator.CertifiedSharedExpr
+    (validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList erasure.result.raw }
+    none (EraseValidator.tablesOfFrame entry.frame) entry.frame.selfAddr []
+    eraseFuel entry.source memberScope
+  entryTarget : certificate.target = rawMain
+  members : Sim.MemberCoverage (validatedEvalCtx constants config).inlineSharing
+    { env := IxIR0.Env.ofList erasure.result.raw } memberScope.plan
+  strict : (validatedEvalCtx constants config).Strict
+  externsRejected : ValidatedExternsRejected erasure.result.declarations
+
+private def certifyErasureCore [Sim.MemberScope]
+    (constants : List (Address × Constant)) (entry : ClosedEntry)
+    (config : Config) (policy : UsagePolicy) (world : Owned)
+    (checkFuel eraseFuel validateFuel : Nat) :
+    Except Error (CertifiedErasure constants entry config policy world checkFuel eraseFuel) := do
+  let stats ← preflightValidated config.limits constants checkFuel eraseFuel validateFuel 0
+  let entryUnits := Ixon.Work.exprUnits entry.source + entry.refs.size + entry.univs.size
+  let enforce := fun metric actual limit => (Ixon.Work.ensure metric actual limit).mapError Error.resource
+  enforce .programExpressionUnits (stats.expressionUnits + entryUnits) config.limits.maxExpressionUnits
+  enforce .programExpandedExpressionUnits (stats.expandedExpressionUnits + entryUnits)
+    config.limits.maxExpandedExpressionUnits
+  enforce .layer1NodeVisits (stats.layer1NodeVisits + entryUnits) config.limits.maxLayer1NodeVisits
+  enforce .certificateCandidates (stats.certificateCandidates + 1) config.limits.maxCertificateCandidates
+  enforce .certificateValidationAttempts (stats.certificateValidationAttempts + 1)
+    config.limits.maxCertificateValidationAttempts
+  enforce .certificateSourceNodeWork
+    (stats.certificateSourceNodeWork + stats.expandedExpressionUnits + entryUnits)
+    config.limits.maxCertificateSourceNodeWork
+  let diagnostic := entry.refs[0]?.getD (Address.replicate 0)
+  let usage ← checkConstants policy (ResolverIndex.ofList constants).resolve checkFuel constants
+  let entryUsage : PLift (Ixon.UsageCheck.check (entry.usageContext constants)
+      checkFuel false [] entry.source = .ok ([], world)) ←
+    match hu : Ixon.UsageCheck.check (entry.usageContext constants) checkFuel false [] entry.source with
+    | .error error => throw (.usage diagnostic error)
+    | .ok ([], actual) =>
+        if hw : actual = world then pure ⟨by simpa [hw] using hu⟩
+        else throw (.validate diagnostic "closed entry has a different ownership result")
+    | .ok (_ :: _, _) => throw (.validate diagnostic "closed entry has free runtime variables")
+  let below : PLift (Ixon.Sharing.sharesBelow 0 entry.source = true) ←
+    if hb : Ixon.Sharing.sharesBelow 0 entry.source then pure ⟨hb⟩
+    else throw (.validate diagnostic "closed entry contains an unresolved share")
+  let ectx := validatedEvalCtx constants config
+  let eraseCtx := EraseValidator.eraseCtxOf ectx
+  let rawMain ← (Erase.eraseExpr eraseCtx eraseFuel (EraseValidator.tablesOfFrame entry.frame)
+    [] entry.source).mapError Error.erase
+  let erasure ← match EraseAddressed.runWithTrace eraseCtx constants rawMain eraseFuel with
+    | .ok trace => pure trace
+    | .error (.erase error) => throw (.erase error)
+    | .error (.readdress message) => throw (.readdress message)
+  let boundary : PLift (ValidatedExternsRejected erasure.result.declarations) ←
+    match hb : firstValidatedExtern? erasure.result.declarations with
+    | none => pure ⟨hb⟩
+    | some address => throw (.validate address "validated extern ownership ABI rejects this declaration")
+  let ictx : IxIR0.Ctx := { env := IxIR0.Env.ofList erasure.result.raw }
+  let candidates := constants.filterMap fun pair => match pair.2.info with
+    | .muts _ => none
+    | _ => some pair.1
+  let order ← (coveragePlan ectx.inlineSharing ictx validateFuel (candidates.length + 1)
+    [] [] candidates).mapError fun (address, message) => Error.validate address message
+  let program ← match EraseValidator.certifySharedProgram ectx constants order eraseFuel validateFuel with
+    | .ok cert => pure cert
+    | .error (.erase error) => throw (.erase error)
+    | .error (.relation message) => throw (.validate diagnostic message)
+  if ht : program.target == erasure.result.raw then
+    have htEq : program.target = erasure.result.raw := beq_iff_eq.mp ht
+    let coverage : EraseValidator.CoverageDB ectx.inlineSharing ictx := by
+      simpa [ictx] using htEq ▸ program.coverage
+    let certificate ← match EraseValidator.certifySharedClosedExpr ectx ictx coverage.oracle
+        entry.frame entry.source eraseFuel validateFuel with
+      | .ok cert => pure cert
+      | .error (.erase error) => throw (.erase error)
+      | .error (.relation message) => throw (.validate diagnostic message)
+    if he : certificate.target == rawMain then
+      have hstrict := program.members.strict
+      let members : Sim.MemberCoverage ectx.inlineSharing ictx
+          (inferInstance : Sim.MemberScope).plan := by
+        have hm := program.members
+        rw [htEq] at hm
+        exact hm
+      pure
+        { usage := usage.down, entryUsage := entryUsage.down
+          entrySharesBelow := below.down, memberScope := inferInstance
+          rawMain, erasure, certificate, entryTarget := beq_iff_eq.mp he, members
+          strict :=
+            { neutralElims := by simpa using hstrict.neutralElims
+              stringLiterals := by simpa using hstrict.stringLiterals }
+          externsRejected := boundary.down }
+    else throw (.validate diagnostic "certified closed entry differs from the compiled expression")
+  else throw (.validate diagnostic "certified erasure differs from the compiled erasure")
+
+/-- Independently usable source/erasure stage. A later compiler must consume
+this exact certificate and source-derived result world. -/
+def certifyErasure (constants : List (Address × Constant)) (entry : ClosedEntry)
+    (config : Config := {}) (policy : UsagePolicy := .v0) (world : Owned := .shared)
+    (checkFuel : Nat := 1000) (eraseFuel : Nat := 1000) (validateFuel : Nat := 1000) :
+    Except Error (CertifiedErasure constants entry config policy world checkFuel eraseFuel) :=
+  letI : Sim.MemberScope := { plan := programMemberPlan constants }
+  certifyErasureCore constants entry config policy world checkFuel eraseFuel validateFuel
+
+theorem CertifiedErasure.sourceRefines
+    {constants : List (Address × Constant)} {entry : ClosedEntry} {config : Config}
+    {policy : UsagePolicy} {world : Owned} {checkFuel eraseFuel : Nat}
+    (compilation : CertifiedErasure constants entry config policy world checkFuel eraseFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.erasure.result.raw })
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel entry.frame []
+      entry.source = .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval { env := IxIR0.Env.ofList compilation.erasure.result.raw }
+        targetFuel [] compilation.rawMain = .ok targetValue ∧
+      @Sim.InlinedValRel (validatedEvalCtx constants config)
+        { env := IxIR0.Env.ofList compilation.erasure.result.raw }
+        sourceValue targetValue compilation.memberScope := by
+  letI : Sim.MemberScope := compilation.memberScope
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx entry.frameSharingWF .nil
+    compilation.entrySharesBelow hsource
+  have hentry := compilation.certificate.related
+  rw [EraseValidator.inlineTables_tablesOfFrame] at hentry
+  obtain ⟨fuel, value, heval, hrelated⟩ := Sim.erasure_sim_with_members
+    compilation.members horacles hinlined.1 hentry (by
+      simpa [Ixon.Eval.valuesInlineSharing] using
+        (Sim.EnvRel.nil (ectx := (validatedEvalCtx constants config).inlineSharing)
+          (ictx := { env := IxIR0.Env.ofList compilation.erasure.result.raw })
+          (refs := entry.frame.inlineSharing.refs) (muts := entry.frame.inlineSharing.selfMuts)
+          (sa := entry.frame.inlineSharing.selfAddr)))
+  rw [compilation.entryTarget] at heval
+  exact ⟨fuel, value, heval, hrelated⟩
+
+end Ix.Compiler.Pipeline
diff --git a/Ix/Compiler/PipelineSound.lean b/Ix/Compiler/PipelineSound.lean
new file mode 100644
index 000000000..d40674ffc
--- /dev/null
+++ b/Ix/Compiler/PipelineSound.lean
@@ -0,0 +1,1055 @@
+import Ix.Compiler.Pipeline
+import Ix.Compiler.IxIR1.LowerMutualAddressedProgress
+import Ix.Compiler.IxIR1.NoReuseAddressed
+import Ix.Compiler.IxIR1.CostTrace
+import Ix.Compiler.IxIR1.OptimizerReclamation
+
+/-!
+# Semantic interface for validator-gated compilation
+
+`Pipeline.compileValidatedWithTrace` retains the exact scoped erasure
+certificate, simultaneous-member coverage, addressed-erasure equation, and
+stateful fully-addressed lowering equations.  This file projects those
+witnesses into the production forward-simulation theorem.  Source sharing and
+oracle correspondence remain semantic premises. The certified pipeline's
+closed extern boundary discharges scalar-oracle value and progress contracts
+vacuously. Target layout, generated representation, and every compiler-owned
+ownership contract are reconstructed from the retained traces.
+-/
+
+namespace Ix.Compiler.Pipeline
+
+open Ix.Compiler.Ixon (Address Constant Owned)
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.LowerSim
+open Ix.Compiler.IxIR1.CostTrace
+
+/-- Semantic value relation after the fail-soft O1 optimizer.  The compiler's
+two address images remain explicit in the first conjunct; the optimizer then
+relates the emitted IxIR₁ result by allocation history and, when rebuilding
+succeeds, by its independent final address image. -/
+def OptimizedMutualAddressedValueGraph
+    (outcome : Optimizer.Outcome) (policy : Optimizer.Policy)
+    (program : List ReaddressAll.Artifact) (summaries : HPT.SummaryEnv)
+    (main : Code) (sourceRename targetRename : Address → Address)
+    (funRel : Sim.FunctionRel) (store : Store)
+    (legacyValue : IxIR0.Value) (targetValue : RVal) : Prop :=
+  ∃ compilerOut : Store × RVal,
+    MutualAddressedValueGraph sourceRename targetRename funRel
+        compilerOut.1 legacyValue compilerOut.2 ∧
+      outcome.RunRefines policy program summaries main compilerOut
+        (store, targetValue)
+
+/-- Forward simulation through validated lowering and the fail-soft O1
+selection. -/
+def OptimizedMutualAddressedSemanticForwardSimulation
+    (legacyCtx : IxIR0.Ctx) (outcome : Optimizer.Outcome)
+    (policy : Optimizer.Policy) (program : List ReaddressAll.Artifact)
+    (summaries : HPT.SummaryEnv) (legacyMain : IxIR0.Expr)
+    (main : Code) (oracle : Address → List RVal → Option RVal)
+    (sourceRename targetRename : Address → Address)
+    (funRel : Sim.FunctionRel) : Prop :=
+  ∀ {sourceFuel sourceValue},
+    IxIR0.eval legacyCtx sourceFuel [] legacyMain = .ok sourceValue →
+    ∃ targetFuel targetStore targetValue,
+      runMain (outcome.targetCtx program oracle) (outcome.main main)
+          targetFuel = .ok (targetStore, targetValue) ∧
+        OptimizedMutualAddressedValueGraph outcome policy program summaries
+          main sourceRename targetRename funRel targetStore sourceValue
+          targetValue
+
+namespace ValidatedCompilation
+
+/-- Exact legacy IxIR₀ context certified by the validated compiler. -/
+def rawCtx {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel) : IxIR0.Ctx :=
+  compilation.erasure.result.rawCtx
+
+/-- Addressed IxIR₀ context consumed by lowering, using the executable empty
+legacy-oracle adapter. -/
+def addressedSourceCtx
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel) : IxIR0.Ctx :=
+  compilation.erasure.result.addressed.addressedCtx
+    (IxIR0.Readdress.Oracle.readdress
+      compilation.erasure.result.addressMap (fun _ _ => none))
+
+/-- Alias-completed target context retained by the generic readdressing
+compatibility endpoint. -/
+def targetCtx
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) : IxIR1.Ctx :=
+  compilation.lowering.result.preAddressCtx compilation.lowering.raw
+    targetOracle
+
+/-- Exact raw target context immediately before complete IxIR₁ addressing.
+Its oracle is pulled back through the certified total rebuild renaming, but
+its declarations are literally the lowerer's returned list environment. -/
+def exactTargetCtx
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) : IxIR1.Ctx :=
+  compilation.lowering.result.rebuildSourceCtx compilation.lowering.raw
+    targetOracle
+
+/-- Function relation reconstructed from the exact final lowering state. -/
+def functionRel
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel) : Sim.FunctionRel :=
+  CompilerFunctionRel compilation.addressedSourceCtx
+    (IxIR0.Env.ofList compilation.erasure.result.declarations)
+    compilation.lowering.finalState
+
+/-- The exact addressed source context exposed to lowering cannot resolve an
+extern.  This is the context-level form of the executable validated ABI
+certificate retained by `compileValidatedWithTrace`. -/
+theorem addressedSourceCtx_ne_extern
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {address : Address} {arity : Nat} :
+    compilation.addressedSourceCtx.env address ≠ some (.extern arity) := by
+  simpa [addressedSourceCtx, EraseAddressed.Result.declarations,
+    IxIR0.Readdress.Result.addressedCtx] using
+    (compilation.addressedSourceEnv_ne_extern
+      (address := address) (arity := arity))
+
+/-- Validated compilation manufactures the scalar extern value contract:
+its certified source context has no extern application to discharge. -/
+theorem externValueContract
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    ExternValueContract compilation.functionRel
+      compilation.addressedSourceCtx
+      (compilation.exactTargetCtx targetOracle) := by
+  constructor
+  intro store address arity sourceFunction sourceResult sourceArgs args result
+    hlookup
+  exact False.elim (compilation.addressedSourceCtx_ne_extern hlookup)
+
+/-- Validated compilation likewise manufactures extern progress: no admitted
+source trace can start at an extern declaration. -/
+theorem externTraceProgressContract
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    ExternTraceProgressContract compilation.functionRel
+      compilation.addressedSourceCtx
+      (compilation.exactTargetCtx targetOracle) := by
+  constructor
+  intro sourceLimit store address arity sourceFunction sourceResult sourceArgs
+    args hlookup
+  exact False.elim (compilation.addressedSourceCtx_ne_extern hlookup)
+
+/-- Exact fail-soft optimizer outcome selected for this validated artifact and
+its directly produced checked HPT certificate. -/
+def producedOptimizationOutcome
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts) :
+    Optimizer.Outcome :=
+  Optimizer.runWithProducedHPT policy compilation.artifact.targetArtifacts
+    compilation.artifact.main production
+
+/-- Oracle used to establish the original compiled execution before the
+selected optimizer result. -/
+def producedOptimizationSourceOracle
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (oracle : Address → List RVal → Option RVal) :
+    Address → List RVal → Option RVal :=
+  (compilation.producedOptimizationOutcome policy production).sourceOracle
+    policy compilation.artifact.targetArtifacts
+    production.certificate.summaryEnv compilation.artifact.main oracle
+
+/-- Exact artifact selected by the existing fail-soft production API. -/
+def producedOptimizedArtifact
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts) :
+    Artifact :=
+  (compilation.artifact.optimizeWithProducedHPT policy production).1
+
+/-- The selected artifact carries exactly the target graph projected by the
+proof-facing optimizer outcome. -/
+theorem producedOptimizedArtifact_targetArtifacts
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts) :
+    (compilation.producedOptimizedArtifact policy production).targetArtifacts =
+      (compilation.producedOptimizationOutcome policy production).artifacts
+        compilation.artifact.targetArtifacts := by
+  cases hrebuilt :
+      (Optimizer.runWithProducedHPT policy
+        compilation.artifact.targetArtifacts compilation.artifact.main
+        production).rebuilt <;>
+    simp [producedOptimizedArtifact, Artifact.optimizeWithProducedHPT,
+      producedOptimizationOutcome, Optimizer.Outcome.artifacts, hrebuilt,
+      Artifact.withRebuiltTarget]
+
+/-- The selected artifact carries exactly the main projected by the
+proof-facing optimizer outcome. -/
+theorem producedOptimizedArtifact_main
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts) :
+    (compilation.producedOptimizedArtifact policy production).main =
+      (compilation.producedOptimizationOutcome policy production).main
+        compilation.artifact.main := by
+  cases hrebuilt :
+      (Optimizer.runWithProducedHPT policy
+        compilation.artifact.targetArtifacts compilation.artifact.main
+        production).rebuilt <;>
+    simp [producedOptimizedArtifact, Artifact.optimizeWithProducedHPT,
+      producedOptimizationOutcome, Optimizer.Outcome.main, hrebuilt,
+      Artifact.withRebuiltTarget]
+
+/-- Runtime context of the selected artifact is the optimizer outcome's
+proof-facing target context. -/
+theorem producedOptimizedArtifact_targetCtx
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (oracle : Address → List RVal → Option RVal) :
+    ({ decls :=
+        (compilation.producedOptimizedArtifact policy production).targetDeclEnv
+       oracle } : Ctx) =
+      (compilation.producedOptimizationOutcome policy production).targetCtx
+        compilation.artifact.targetArtifacts oracle := by
+  have hdecls := Optimizer.Outcome.targetCtx_decls
+    (compilation.producedOptimizationOutcome policy production)
+    compilation.artifact.targetArtifacts oracle
+  rw [← compilation.producedOptimizedArtifact_targetArtifacts policy
+    production] at hdecls
+  have horacle :
+      ((compilation.producedOptimizationOutcome policy production).targetCtx
+        compilation.artifact.targetArtifacts oracle).oracle = oracle := by
+    cases hrebuilt :
+        (compilation.producedOptimizationOutcome policy production).rebuilt <;>
+      simp [Optimizer.Outcome.targetCtx, hrebuilt,
+        ReaddressAll.Result.addressedCtx,
+        ReaddressAll.Result.asReaddressResult,
+        Readdress.Result.addressedCtx]
+  cases htarget :
+      (compilation.producedOptimizationOutcome policy production).targetCtx
+        compilation.artifact.targetArtifacts oracle with
+  | mk targetDecls targetOracle =>
+      have htargetDecls :
+          targetDecls = HPT.programDeclEnv
+            (compilation.producedOptimizedArtifact policy production).targetArtifacts := by
+        simpa [htarget] using hdecls
+      have htargetOracle : targetOracle = oracle := by
+        simpa [htarget] using horacle
+      subst targetDecls
+      subst targetOracle
+      simp [Artifact.targetDeclEnv]
+
+/-- The emitted compiler context with the optimizer oracle pullback is
+literally the source context consumed by the optimizer theorem. -/
+theorem addressedTargetCtx_eq_producedOptimizationSourceCtx
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (oracle : Address → List RVal → Option RVal) :
+    compilation.lowering.result.addressedCtx
+        (compilation.producedOptimizationSourceOracle policy production
+          oracle) =
+      (compilation.producedOptimizationOutcome policy production).sourceCtx
+        policy compilation.artifact.targetArtifacts
+        production.certificate.summaryEnv compilation.artifact.main oracle := by
+  let sourceOracle := compilation.producedOptimizationSourceOracle policy
+    production oracle
+  have henv := HPT.OptimizeProgram.envOfList_declarationEntries
+    compilation.lowering.result.artifacts
+  change
+    Env.ofList
+        (compilation.lowering.result.artifacts.flatMap
+          ReaddressAll.Artifact.declarations) =
+      HPT.programDeclEnv compilation.lowering.result.artifacts at henv
+  have hdecls :
+      (compilation.lowering.result.addressedCtx sourceOracle).decls =
+        HPT.programDeclEnv compilation.artifact.targetArtifacts := by
+    simpa only [ValidatedCompilation.artifact,
+      ReaddressAll.Result.addressedCtx,
+      ReaddressAll.Result.asReaddressResult,
+      Readdress.Result.addressedCtx, Readdress.Result.declarations,
+      List.append_nil, ReaddressAll.Result.declarations] using henv
+  change
+    ({ decls :=
+        (compilation.lowering.result.addressedCtx sourceOracle).decls
+       oracle := sourceOracle } : Ctx) =
+      { decls := HPT.programDeclEnv compilation.artifact.targetArtifacts
+        oracle := sourceOracle }
+  rw [hdecls]
+
+/-- Addressed erasure selects every callable declaration row in the exact
+list environment consumed by lowering. -/
+theorem sourceCallableRowsSelected
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel) :
+    SourceCallableRowsSelected compilation.erasure.result.declarations := by
+  intro address source worlds result hmember _
+  have haudit := EraseAddressed.semanticAudit_of_run_eq_ok
+    compilation.erasure.runEq
+  have haddressed := compilation.erasure.result.addressed_audit haudit
+  exact IxIR0.Readdress.Result.declaration_lookup_of_mem_of_semanticAudit
+    haddressed hmember
+
+/-- Initial complete target addressing certifies that every raw lowering row
+is selected by the exact pre-address context. -/
+theorem exactTargetCtx_decls_of_mem
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal)
+    {address : Address} {declaration : Decl}
+    (hmember : (address, declaration) ∈ compilation.lowering.raw) :
+    (compilation.exactTargetCtx targetOracle).decls address =
+      some declaration := by
+  have hrun :=
+    readdressAll_run_of_lowerAllIndexedFullyAddressed_eq_ok
+      compilation.lowering.lowerRun compilation.lowering.addressedRun
+  have haudit := ReaddressAll.rebuildSemanticAudit_of_run_eq_ok hrun
+  exact ReaddressAll.Result.raw_lookup_of_mem_of_rebuildSemanticAudit
+    haudit hmember
+
+/-- The exact raw target context represents every generated declaration and
+memoized constructor wrapper in the final lowering state. -/
+theorem exactExtraRepresented
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    ExtraRepresented (compilation.exactTargetCtx targetOracle)
+      compilation.lowering.finalState := by
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  apply lowerAllAction_extraRepresented hlower
+  intro address declaration hmember
+  exact compilation.exactTargetCtx_decls_of_mem targetOracle
+    (lowerAllAction_extra_mem_result hlower hmember)
+
+/-- The validated trace determines every source callable/extern layout in the
+exact raw target context. -/
+theorem sourceDeclLayout
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    SourceDeclLayout
+      (IxIR0.Env.ofList compilation.erasure.result.declarations)
+      (compilation.exactTargetCtx targetOracle) := by
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  exact lowerAllAction_sourceDeclLayout
+    (ctx := compilation.exactTargetCtx targetOracle) hlower
+    (fun hmember =>
+      compilation.exactTargetCtx_decls_of_mem targetOracle hmember)
+
+/-- The validated trace discharges the owner-sensitive source PAP premise in
+the exact raw target context. -/
+theorem sourcePapSafe
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    SourcePapSafe
+      (IxIR0.Env.ofList compilation.erasure.result.declarations)
+      (compilation.exactTargetCtx targetOracle) := by
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  intro address source worlds result d hsrc hsignature hdecl hsafe
+  exact lowerAllAction_sourcePapSafe
+    (ctx := compilation.exactTargetCtx targetOracle)
+    (address := address) (source := source) (worlds := worlds)
+    (result := result) (d := d) hlower
+    (fun hmember =>
+      compilation.exactTargetCtx_decls_of_mem targetOracle hmember)
+    hsrc hsignature hdecl hsafe
+
+/-- Every raw function declaration in a validated trace is covered by either
+its selected source callable or the final generated-declaration state. -/
+theorem fnDeclCovered
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    FnDeclCovered
+      (IxIR0.Env.ofList compilation.erasure.result.declarations)
+      (compilation.exactTargetCtx targetOracle)
+      compilation.lowering.finalState := by
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  apply lowerAllAction_fnDeclCovered hlower
+    compilation.sourceCallableRowsSelected
+  rfl
+
+/-- The validated compiler trace constructs, rather than assumes, every
+ownership contract of its exact raw target context. The second conjunct keeps
+the generated-function contracts available for downstream reclamation and
+cost corollaries. -/
+theorem exactCompilerContracts
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    CompilerContracts
+        (IxIR0.Env.ofList compilation.erasure.result.declarations)
+        (compilation.exactTargetCtx targetOracle) ∧
+      ExtraFnContracts (compilation.exactTargetCtx targetOracle)
+        compilation.lowering.finalState := by
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  apply lowerAllAction_compilerContracts hlower
+    (fun hmember =>
+      compilation.exactTargetCtx_decls_of_mem targetOracle hmember)
+    compilation.sourceCallableRowsSelected
+  rfl
+
+/-- The concise semantic endpoint for one successful
+`compileValidatedWithTrace` result. All executable equalities, target layout,
+ownership contracts, the closed extern boundary, and the runtime-derived
+mutual-member scope are supplied by `compilation`; the remaining premises are
+genuine source/oracle obligations. The final heap relation uses the certified
+alias-free rebuild map consumed by the exact raw target context. -/
+theorem semanticForwardSimulation
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (targetOracle : Address → List RVal → Option RVal) :
+    MutualAddressedSemanticForwardSimulation
+      (compilation.erasure.result.addressed.preAddressCtx
+        compilation.erasure.result.groups)
+      (compilation.lowering.result.addressedCtx targetOracle)
+      (.ref mainAddress) compilation.lowering.result.main
+      (IxIR0.MutualBlock.Renaming.apply
+        compilation.erasure.result.addressMap)
+      (compilation.lowering.result.rebuildRename compilation.lowering.raw)
+      compilation.functionRel := by
+  letI : Sim.MemberScope := compilation.memberScope
+  have hframe : (validatedMainFrame mainAddress).SharingWF := by
+    constructor
+    · rfl
+    · intro index member hget
+      simp [validatedMainFrame] at hget
+  have hbelow : Ixon.Sharing.sharesBelow
+      (validatedMainFrame mainAddress).sharing.size
+      validatedMainSource = true := rfl
+  have herase : EraseAddressed.run
+      (EraseValidator.eraseCtxOf (validatedEvalCtx constants config))
+      constants compilation.entry.target eraseFuel =
+        .ok compilation.erasure.result := by
+    rw [compilation.entryTarget]
+    exact compilation.erasure.runEq
+  have hsimulation : MutualAddressedSemanticForwardSimulation
+      (compilation.erasure.result.addressed.preAddressCtx
+        compilation.erasure.result.groups)
+      (compilation.lowering.result.addressedCtx targetOracle)
+      compilation.entry.target compilation.lowering.result.main
+      (IxIR0.MutualBlock.Renaming.apply
+        compilation.erasure.result.addressMap)
+      (compilation.lowering.result.rebuildRename compilation.lowering.raw)
+      compilation.functionRel := by
+    exact
+      lowerAllIndexedFullyAddressed_semanticForwardSimulation_of_certificate_with_members_exact_sealed
+      (erased := compilation.erasure.result)
+      (mainWorld := mainWorld) (compilerFuel := lowerFuel)
+      (raw := compilation.lowering.raw)
+      (mainCode := compilation.lowering.mainCode)
+      (finalState := compilation.lowering.finalState)
+      (lowered := compilation.lowering.result)
+      (fun _ _ => none) compilation.members compilation.entry herase
+      (IxIR0.Readdress.Oracle.Readdressable.empty
+        compilation.erasure.result.addressMap)
+      horacles hctx hframe hbelow hsource compilation.lowering.lowerRun
+      compilation.lowering.addressedRun targetOracle
+      (fun hmember =>
+        compilation.exactTargetCtx_decls_of_mem targetOracle hmember)
+      (compilation.exactExtraRepresented targetOracle)
+      (compilation.exactCompilerContracts targetOracle).1
+      (compilation.externValueContract targetOracle)
+      (compilation.externTraceProgressContract targetOracle)
+  intro legacyFuel legacyValue hlegacy
+  apply hsimulation
+  simpa only [compilation.entryTarget] using hlegacy
+
+/-- The validated semantic spine composed with a directly produced checked
+O1 optimizer run.  The optimized oracle is pulled back automatically for the
+pre-optimization execution. Fail-soft skips therefore select the original
+simulation literally, while successful rebuilds add allocation-history and
+optimizer-address witnesses. -/
+theorem semanticForwardSimulationAfterProducedOptimization
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (optimizerOracle : Address → List RVal → Option RVal) :
+    OptimizedMutualAddressedSemanticForwardSimulation
+      (compilation.erasure.result.addressed.preAddressCtx
+        compilation.erasure.result.groups)
+      (compilation.producedOptimizationOutcome policy production) policy
+      compilation.artifact.targetArtifacts production.certificate.summaryEnv
+      (.ref mainAddress) compilation.artifact.main optimizerOracle
+      (IxIR0.MutualBlock.Renaming.apply
+        compilation.erasure.result.addressMap)
+      (compilation.lowering.result.rebuildRename compilation.lowering.raw)
+      compilation.functionRel := by
+  let outcome := compilation.producedOptimizationOutcome policy production
+  let sourceOracle := compilation.producedOptimizationSourceOracle policy
+    production optimizerOracle
+  have hcompiler : MutualAddressedSemanticForwardSimulation
+      (compilation.erasure.result.addressed.preAddressCtx
+        compilation.erasure.result.groups)
+      (compilation.lowering.result.addressedCtx sourceOracle)
+      (.ref mainAddress) compilation.lowering.result.main
+      (IxIR0.MutualBlock.Renaming.apply
+        compilation.erasure.result.addressMap)
+      (compilation.lowering.result.rebuildRename compilation.lowering.raw)
+      compilation.functionRel := by
+    exact compilation.semanticForwardSimulation
+      (sourceFuel := sourceFuel) (sourceValue := sourceValue)
+      horacles hctx hsource sourceOracle
+  intro legacyFuel legacyValue hlegacy
+  obtain ⟨compilerFuel, compilerStore, compilerValue, hcompilerRun,
+      hcompilerGraph⟩ := hcompiler hlegacy
+  have hsourceCtx :
+      compilation.lowering.result.addressedCtx sourceOracle =
+        outcome.sourceCtx policy compilation.artifact.targetArtifacts
+          production.certificate.summaryEnv compilation.artifact.main
+          optimizerOracle := by
+    simpa [outcome, sourceOracle] using
+      compilation.addressedTargetCtx_eq_producedOptimizationSourceCtx
+        policy production optimizerOracle
+  have hoptimizerSource :
+      runMain
+          (outcome.sourceCtx policy compilation.artifact.targetArtifacts
+            production.certificate.summaryEnv compilation.artifact.main
+            optimizerOracle)
+          compilation.artifact.main compilerFuel =
+        .ok (compilerStore, compilerValue) := by
+    rw [← hsourceCtx]
+    simpa [ValidatedCompilation.artifact] using hcompilerRun
+  obtain ⟨targetOut, htargetRun, hrefines⟩ :=
+    Optimizer.runMain_of_runWithProducedHPT_eq
+      (policy := policy) (program := compilation.artifact.targetArtifacts)
+      (main := compilation.artifact.main) (production := production)
+      (outcome := outcome) rfl optimizerOracle compilerFuel hoptimizerSource
+  rcases targetOut with ⟨targetStore, targetValue⟩
+  refine ⟨compilerFuel, targetStore, targetValue, ?_, ?_⟩
+  · simpa [outcome, producedOptimizationOutcome] using htargetRun
+  · exact ⟨(compilerStore, compilerValue), hcompilerGraph, hrefines⟩
+
+/-- Artifact-facing form of the optimized semantic theorem.  Its executable
+context and main are projected directly from the artifact returned by
+`optimizeWithProducedHPT`, rather than from the proof-facing optimizer
+outcome. -/
+theorem semanticForwardSimulationOfProducedOptimizedArtifact
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (optimizerOracle : Address → List RVal → Option RVal) :
+    ∀ {legacyFuel legacyValue},
+      IxIR0.eval
+          (compilation.erasure.result.addressed.preAddressCtx
+            compilation.erasure.result.groups)
+          legacyFuel [] (.ref mainAddress) = .ok legacyValue →
+      ∃ targetFuel targetStore targetValue,
+        runMain
+            ({ decls :=
+                (compilation.producedOptimizedArtifact policy production).targetDeclEnv
+               oracle := optimizerOracle } : Ctx)
+            (compilation.producedOptimizedArtifact policy production).main
+            targetFuel = .ok (targetStore, targetValue) ∧
+          OptimizedMutualAddressedValueGraph
+            (compilation.producedOptimizationOutcome policy production)
+            policy compilation.artifact.targetArtifacts
+            production.certificate.summaryEnv compilation.artifact.main
+            (IxIR0.MutualBlock.Renaming.apply
+              compilation.erasure.result.addressMap)
+            (compilation.lowering.result.rebuildRename
+              compilation.lowering.raw)
+            compilation.functionRel targetStore legacyValue targetValue := by
+  have hsimulation : OptimizedMutualAddressedSemanticForwardSimulation
+      (compilation.erasure.result.addressed.preAddressCtx
+        compilation.erasure.result.groups)
+      (compilation.producedOptimizationOutcome policy production) policy
+      compilation.artifact.targetArtifacts production.certificate.summaryEnv
+      (.ref mainAddress) compilation.artifact.main optimizerOracle
+      (IxIR0.MutualBlock.Renaming.apply
+        compilation.erasure.result.addressMap)
+      (compilation.lowering.result.rebuildRename compilation.lowering.raw)
+      compilation.functionRel :=
+    compilation.semanticForwardSimulationAfterProducedOptimization
+      horacles hctx hsource policy production optimizerOracle
+  intro legacyFuel legacyValue hlegacy
+  obtain ⟨targetFuel, targetStore, targetValue, htarget, hgraph⟩ :=
+    hsimulation hlegacy
+  refine ⟨targetFuel, targetStore, targetValue, ?_, hgraph⟩
+  rw [compilation.producedOptimizedArtifact_targetCtx policy production
+    optimizerOracle]
+  rw [compilation.producedOptimizedArtifact_main policy production]
+  exact htarget
+
+/-- The validated source execution produces an actual successful execution
+of the final content-addressed target. -/
+theorem targetProgress
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (targetOracle : Address → List RVal → Option RVal) :
+    ∃ targetFuel store value,
+      runMain (compilation.lowering.result.addressedCtx targetOracle)
+        compilation.lowering.result.main targetFuel = .ok (store, value) := by
+  letI : Sim.MemberScope := compilation.memberScope
+  have hframe : (validatedMainFrame mainAddress).SharingWF := by
+    constructor
+    · rfl
+    · intro index member hget
+      simp [validatedMainFrame] at hget
+  have hbelow : Ixon.Sharing.sharesBelow
+      (validatedMainFrame mainAddress).sharing.size
+      validatedMainSource = true := rfl
+  have herase : EraseAddressed.run
+      (EraseValidator.eraseCtxOf (validatedEvalCtx constants config))
+      constants compilation.entry.target eraseFuel =
+        .ok compilation.erasure.result := by
+    rw [compilation.entryTarget]
+    exact compilation.erasure.runEq
+  exact
+    lowerAllIndexedFullyAddressed_main_progress_of_addressed_certificate_with_members_exact_sealed
+      (erased := compilation.erasure.result)
+      (mainWorld := mainWorld) (compilerFuel := lowerFuel)
+      (raw := compilation.lowering.raw)
+      (mainCode := compilation.lowering.mainCode)
+      (finalState := compilation.lowering.finalState)
+      (lowered := compilation.lowering.result)
+      (fun _ _ => none) compilation.members compilation.entry herase
+      (IxIR0.Readdress.Oracle.Readdressable.empty
+        compilation.erasure.result.addressMap)
+      horacles hctx hframe hbelow hsource compilation.lowering.lowerRun
+      compilation.lowering.addressedRun targetOracle
+      (fun hmember =>
+        compilation.exactTargetCtx_decls_of_mem targetOracle hmember)
+      (compilation.exactExtraRepresented targetOracle)
+      (compilation.exactCompilerContracts targetOracle).1
+      (compilation.externValueContract targetOracle)
+      (compilation.externTraceProgressContract targetOracle)
+
+/-- The artifact selected by the directly produced fail-soft optimizer has a
+successful execution.  This is stated on the artifact's own declaration
+environment and main, so no proof-facing optimizer projection remains in the
+operational conclusion. -/
+theorem targetProgressAfterProducedOptimization
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (optimizerOracle : Address → List RVal → Option RVal) :
+    ∃ targetFuel store value,
+      runMain
+          ({ decls :=
+              (compilation.producedOptimizedArtifact policy production).targetDeclEnv
+             oracle := optimizerOracle } : Ctx)
+          (compilation.producedOptimizedArtifact policy production).main
+          targetFuel = .ok (store, value) := by
+  let outcome := compilation.producedOptimizationOutcome policy production
+  let sourceOracle := compilation.producedOptimizationSourceOracle policy
+    production optimizerOracle
+  obtain ⟨compilerFuel, compilerStore, compilerValue, hcompilerRun⟩ :=
+    compilation.targetProgress horacles hctx hsource sourceOracle
+  have hsourceCtx :
+      compilation.lowering.result.addressedCtx sourceOracle =
+        outcome.sourceCtx policy compilation.artifact.targetArtifacts
+          production.certificate.summaryEnv compilation.artifact.main
+          optimizerOracle := by
+    simpa [outcome, sourceOracle] using
+      compilation.addressedTargetCtx_eq_producedOptimizationSourceCtx
+        policy production optimizerOracle
+  have hoptimizerSource :
+      runMain
+          (outcome.sourceCtx policy compilation.artifact.targetArtifacts
+            production.certificate.summaryEnv compilation.artifact.main
+            optimizerOracle)
+          compilation.artifact.main compilerFuel =
+        .ok (compilerStore, compilerValue) := by
+    rw [← hsourceCtx]
+    simpa [ValidatedCompilation.artifact] using hcompilerRun
+  obtain ⟨targetOut, htargetRun, _⟩ :=
+    Optimizer.runMain_of_runWithProducedHPT_eq
+      (policy := policy) (program := compilation.artifact.targetArtifacts)
+      (main := compilation.artifact.main) (production := production)
+      (outcome := outcome) rfl optimizerOracle compilerFuel hoptimizerSource
+  rcases targetOut with ⟨targetStore, targetValue⟩
+  refine ⟨compilerFuel, targetStore, targetValue, ?_⟩
+  rw [compilation.producedOptimizedArtifact_targetCtx policy production
+    optimizerOracle]
+  rw [compilation.producedOptimizedArtifact_main policy production]
+  simpa [outcome, producedOptimizationOutcome] using htargetRun
+
+/-- No execution fuel can expose a dynamic memory error in the validated
+fully addressed main. One certified successful run rules out smaller-fuel
+memory errors by persistence and larger-fuel errors by success monotonicity. -/
+theorem memoryErrorUnreachable
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (targetOracle : Address → List RVal → Option RVal) :
+    MemoryErrorUnreachable
+      (compilation.lowering.result.addressedCtx targetOracle)
+      compilation.lowering.result.main := by
+  apply memoryErrorUnreachable_of_progress
+  exact compilation.targetProgress horacles hctx hsource targetOracle
+
+/-- No execution fuel can expose a dynamic memory error in the artifact
+selected by the directly produced fail-soft optimizer. -/
+theorem memoryErrorUnreachableAfterProducedOptimization
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (optimizerOracle : Address → List RVal → Option RVal) :
+    MemoryErrorUnreachable
+      ({ decls :=
+          (compilation.producedOptimizedArtifact policy production).targetDeclEnv
+         oracle := optimizerOracle } : Ctx)
+      (compilation.producedOptimizedArtifact policy production).main := by
+  apply memoryErrorUnreachable_of_progress
+  exact compilation.targetProgressAfterProducedOptimization
+    horacles hctx hsource policy production optimizerOracle
+
+/-- Every successful execution of the validated fully addressed artifact can
+release its result and reclaim the entire fresh heap. No target-context or
+ownership premise remains at the pipeline boundary. -/
+theorem reclamation
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    Reclamation (compilation.lowering.result.addressedCtx targetOracle)
+      compilation.lowering.result.main mainWorld := by
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  have hraw : Reclamation (compilation.exactTargetCtx targetOracle)
+      compilation.lowering.mainCode mainWorld :=
+    NoReuse.lowerAllAction_reclamation hlower rfl
+      (compilation.exactExtraRepresented targetOracle)
+      (compilation.exactCompilerContracts targetOracle).1
+  intro runFuel store value hrun
+  exact NoReuse.lowerAllIndexedFullyAddressed_reclamation_of_exact_raw
+    compilation.lowering.lowerRun compilation.lowering.addressedRun
+    targetOracle hraw hrun
+
+/-- Every successful execution of the artifact selected by the directly
+produced fail-soft optimizer can release its result and reclaim the entire
+fresh heap.  The optimizer needs one successful source run to identify its
+selected execution; the validated source premises provide that witness. -/
+theorem reclamationAfterProducedOptimization
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.memberScope
+      (validatedEvalCtx constants config).inlineSharing compilation.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource =
+        .ok sourceValue)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (optimizerOracle : Address → List RVal → Option RVal) :
+    Reclamation
+      ({ decls :=
+          (compilation.producedOptimizedArtifact policy production).targetDeclEnv
+         oracle := optimizerOracle } : Ctx)
+      (compilation.producedOptimizedArtifact policy production).main
+      mainWorld := by
+  let outcome := compilation.producedOptimizationOutcome policy production
+  let sourceOracle := compilation.producedOptimizationSourceOracle policy
+    production optimizerOracle
+  obtain ⟨compilerFuel, compilerStore, compilerValue, hcompilerRun⟩ :=
+    compilation.targetProgress horacles hctx hsource sourceOracle
+  have hsourceCtx :
+      compilation.lowering.result.addressedCtx sourceOracle =
+        outcome.sourceCtx policy compilation.artifact.targetArtifacts
+          production.certificate.summaryEnv compilation.artifact.main
+          optimizerOracle := by
+    simpa [outcome, sourceOracle] using
+      compilation.addressedTargetCtx_eq_producedOptimizationSourceCtx
+        policy production optimizerOracle
+  have hoptimizerSource :
+      runMain
+          (outcome.sourceCtx policy compilation.artifact.targetArtifacts
+            production.certificate.summaryEnv compilation.artifact.main
+            optimizerOracle)
+          compilation.artifact.main compilerFuel =
+        .ok (compilerStore, compilerValue) := by
+    rw [← hsourceCtx]
+    simpa [ValidatedCompilation.artifact] using hcompilerRun
+  have hsourceReclamation :
+      Reclamation
+          (outcome.sourceCtx policy compilation.artifact.targetArtifacts
+            production.certificate.summaryEnv compilation.artifact.main
+            optimizerOracle)
+          compilation.artifact.main mainWorld := by
+    intro runFuel store value hrun
+    have hcompilerRun' :
+        runMain (compilation.lowering.result.addressedCtx sourceOracle)
+            compilation.lowering.result.main runFuel = .ok (store, value) := by
+      rw [hsourceCtx]
+      simpa [ValidatedCompilation.artifact] using hrun
+    obtain ⟨releaseFuel, released, hrelease, hlive⟩ :=
+      compilation.reclamation sourceOracle hcompilerRun'
+    refine ⟨releaseFuel, released, ?_, hlive⟩
+    rw [LowerSim.releaseResult_ctx_eq
+      (compilation.lowering.result.addressedCtx sourceOracle)
+      (outcome.sourceCtx policy compilation.artifact.targetArtifacts
+        production.certificate.summaryEnv compilation.artifact.main
+        optimizerOracle)]
+    exact hrelease
+  have htarget :
+      Reclamation
+        (outcome.targetCtx compilation.artifact.targetArtifacts
+          optimizerOracle)
+        (outcome.main compilation.artifact.main) mainWorld :=
+    Optimizer.reclamation_of_runWithProducedHPT_eq
+      (policy := policy) (program := compilation.artifact.targetArtifacts)
+      (main := compilation.artifact.main) (production := production)
+      (outcome := outcome) (houtcome := rfl) (oracle := optimizerOracle)
+      (world := mainWorld)
+      (hprogress :=
+        ⟨compilerFuel, (compilerStore, compilerValue), hoptimizerSource⟩)
+      (hreclamation := hsourceReclamation)
+  rw [compilation.producedOptimizedArtifact_targetCtx policy production
+    optimizerOracle]
+  rw [compilation.producedOptimizedArtifact_main policy production]
+  intro runFuel store value hrun
+  exact htarget hrun
+
+/-- The selected optimized artifact retains the evaluator-universal
+allocation/free law.  Stronger four-counter contracts are deliberately not
+claimed here: successful optimizer rewrites may change allocation and free
+counts while preserving the heap history used by semantic refinement. -/
+theorem allocationFreeCostInvariantAfterProducedOptimization
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (policy : Optimizer.Policy) {limits : HPT.Limits}
+    (production : HPT.Production limits compilation.artifact.targetArtifacts)
+    (optimizerOracle : Address → List RVal → Option RVal) :
+    RunCostInvariant
+      ({ decls :=
+          (compilation.producedOptimizedArtifact policy production).targetDeclEnv
+         oracle := optimizerOracle } : Ctx)
+      (compilation.producedOptimizedArtifact policy production).main
+      AllocationFreeCostSpec := by
+  exact runCostInvariant_allocationFree _ _
+
+/-- The fully addressed artifact satisfies the current lowerer's public
+counter contract: no reuse instruction executes, and frees never exceed
+allocations. Address completion preserves all four observed counters. -/
+theorem costRefinement
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal) :
+    CostRefinement compilation.addressedSourceCtx
+      (compilation.lowering.result.addressedCtx targetOracle)
+      compilation.erasure.result.main compilation.lowering.result.main
+      compilation.functionRel
+      (fun _ observation => NoReuse.CurrentLowererCostSpec observation) := by
+  apply RunCostInvariant.costRefinement
+  have hlower :
+      (lowerAllAction compilation.erasure.result.declarations
+        compilation.erasure.result.main mainWorld lowerFuel).run {} =
+          .ok (compilation.lowering.raw, compilation.lowering.mainCode)
+            compilation.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using
+      compilation.lowering.lowerRun
+  have hraw : RunCostInvariant (compilation.exactTargetCtx targetOracle)
+      compilation.lowering.mainCode NoReuse.CurrentLowererCostSpec :=
+    NoReuse.runCostInvariant_of_noReuse_with_allocationFree
+      (NoReuse.lowerAllAction_ctxNoReuse hlower rfl)
+      (NoReuse.lowerAllAction_noReuse hlower).2.1
+  intro targetFuel targetStore targetValue htarget
+  exact
+    NoReuse.lowerAllIndexedFullyAddressed_runCostInvariant_of_exact_raw
+      compilation.lowering.lowerRun compilation.lowering.addressedRun
+      targetOracle hraw htarget
+
+/-- A call-aware source profile gives the final artifact the existing
+ownership-amortized four-counter budget. Profile availability stays explicit
+because ordinary IxIR₀ evaluation is broader than the call-aware trace
+fragment; target layout and ownership are derived from compilation. -/
+theorem ownershipAmortizedCostRefinement
+    {constants : List (Address × Constant)} {mainAddress : Address}
+    {config : Config} {mainWorld : Owned} {eraseFuel lowerFuel : Nat}
+    (compilation : ValidatedCompilation constants mainAddress config
+      mainWorld eraseFuel lowerFuel)
+    (targetOracle : Address → List RVal → Option RVal)
+    (hprofile : ∀ {sourceFuel sourceValue},
+      IxIR0.eval compilation.addressedSourceCtx sourceFuel []
+        compilation.erasure.result.main = .ok sourceValue →
+      ∃ profile, IxIR0.DynamicCost.Profiled compilation.addressedSourceCtx
+        compilation.erasure.result.main sourceValue profile) :
+    ProfileCostRefinement compilation.addressedSourceCtx
+      (compilation.lowering.result.addressedCtx targetOracle)
+      compilation.erasure.result.main compilation.lowering.result.main
+      compilation.functionRel
+      (fun _ profile observation =>
+        WithinBudget ownershipAmortizedWeights profile observation) := by
+  exact lowerAllIndexedFullyAddressed_profileCostRefinement_exact_sealed
+    (funRel := compilation.functionRel) rfl
+    compilation.lowering.lowerRun compilation.lowering.addressedRun
+    targetOracle
+    (fun hmember =>
+      compilation.exactTargetCtx_decls_of_mem targetOracle hmember)
+    (compilation.exactExtraRepresented targetOracle)
+    (compilation.exactCompilerContracts targetOracle).1
+    (compilation.externValueContract targetOracle) hprofile
+
+end ValidatedCompilation
+
+end Ix.Compiler.Pipeline
diff --git a/Ix/Compiler/Recursion/Allocation.lean b/Ix/Compiler/Recursion/Allocation.lean
new file mode 100644
index 000000000..b077beef4
--- /dev/null
+++ b/Ix/Compiler/Recursion/Allocation.lean
@@ -0,0 +1,123 @@
+import Ix.Compiler.Recursion.Resources
+import Ix.Compiler.IxIR2.PipelineAllocation
+
+/-!
+# Source refinement with comparative allocation laws
+
+The source contracts and semantic relations remain those of D2 and R2.
+Recovered shared-main execution additionally compares the actual selected
+physical result with an actual checked baseline run, before and after shared
+reclamation. Literal fallback retains R2's original owned execution.
+-/
+
+namespace Ix.Compiler.Recursion
+
+open Ix.Compiler.Ixon (Address Constant)
+
+namespace Lowered
+
+variable {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+  {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+
+/-- Source execution derives every backend premise and produces the same
+selected semantic result, its R2 resources, and comparison with an actual
+physical baseline. -/
+theorem physicalMainAllocationLaws (lowered : Lowered recovery fuel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (sourceRun : IxIR0.eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main = .ok sourceValue) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.runMain
+        (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+          lowered.attached.target.artifact.validationContext.schemas)
+        .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+      lowered.PhysicalValueRel sourceValue result ∧ result.SharedResources ∧
+      lowered.attached.AllocationComparison result := by
+  have trace : IxIR0.ProjectionSafe.Eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main sourceValue := recovery.projectionSafe sourceRun
+  obtain ⟨ir1Fuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    lowered.compilation.addressedOwnedMain trace
+  have attachedRun : IxIR1.runOwnedMain lowered.attached.simulationSourceContext
+      lowered.attached.target.artifact.source.mainResult
+      lowered.attached.target.artifact.source.main ir1Fuel = .ok (store, value) := by
+    rw [lowered.attached.simulationSourceContext_eq_addressedCtx,
+      lowered.attached.targetSourceProduced, lowered.attached.inputProduced, lowered.sourceProduced]
+    exact ownedRun
+  obtain ⟨baselineControl, controlFuel, heapFuel, baseline, result, locRel,
+      baselineRun, run, baselineRelation, heaps, values, baselineResources, resources,
+      laws, reclaimed⟩ :=
+    lowered.attached.selectedPhysicalMainAllocationLaws lowered.reuse attachedRun
+  exact ⟨controlFuel, heapFuel, result, run,
+    ⟨store, value, baseline, locRel, ⟨rawStore, addressImage, graph⟩,
+      baselineRelation, heaps, values⟩, resources,
+    baselineControl, heapFuel, baseline, baselineRun, baselineResources, laws, reclaimed⟩
+
+end Lowered
+
+namespace Compilation
+
+variable {constants : List (Address × Constant)} {root : Address}
+  {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+/-- Recovered shared results carry comparative allocation/free laws for
+actual baseline and selected runs. Literal fallback keeps exactly R2's
+resource endpoint. -/
+def SelectedExecutionWithAllocationLaws
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) : Prop :=
+  match compilation.outcome with
+  | .literal _ => compilation.SelectedExecutionWithResources sourceValue
+  | .recovered _ lowered =>
+      ∃ rawValue controlFuel heapFuel result,
+        compilation.SourceValueRel sourceValue rawValue ∧
+        IxIR2.Eval.runMain
+          (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+            lowered.attached.target.artifact.validationContext.schemas)
+          .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+        lowered.PhysicalValueRel rawValue result ∧ result.SharedResources ∧
+        lowered.attached.AllocationComparison result
+
+/-- Forgetting comparative evidence recovers the unchanged R2 endpoint. -/
+theorem SelectedExecutionWithAllocationLaws.resources
+    {compilation : Compilation constants root config eraseFuel lowerFuel}
+    {sourceValue : Ixon.Eval.Value}
+    (execution : compilation.SelectedExecutionWithAllocationLaws sourceValue) :
+    compilation.SelectedExecutionWithResources sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      simpa only [SelectedExecutionWithAllocationLaws, selected] using execution
+  | recovered recovery lowered =>
+      simp only [SelectedExecutionWithAllocationLaws, SelectedExecutionWithResources,
+        selected] at execution ⊢
+      obtain ⟨raw, control, heap, result, source, run, relation, resources, _laws⟩ := execution
+      exact ⟨raw, control, heap, result, source, run, relation, resources⟩
+
+/-- Successful source evaluation supplies the selected execution and the
+comparative laws with exactly the original sharing and oracle contracts.
+The recovered branch covers both optimized and checked baseline selection. -/
+theorem sourceRefinesSelectedWithAllocationLaws
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    compilation.SelectedExecutionWithAllocationLaws sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      simpa only [SelectedExecutionWithAllocationLaws, selected] using
+        compilation.sourceRefinesSelectedWithResources horacles hctx hsource
+  | recovered recovery lowered =>
+      obtain ⟨rawFuel, rawValue, rawRun, sourceRelation⟩ :=
+        compilation.sourceRefines horacles hctx hsource
+      rw [selected] at rawRun
+      obtain ⟨controlFuel, heapFuel, result, run, relation, resources, laws⟩ :=
+        lowered.physicalMainAllocationLaws rawRun
+      simp only [SelectedExecutionWithAllocationLaws, selected]
+      exact ⟨rawValue, controlFuel, heapFuel, result, sourceRelation, run, relation, resources, laws⟩
+
+end Compilation
+
+end Ix.Compiler.Recursion
diff --git a/Ix/Compiler/Recursion/Costs.lean b/Ix/Compiler/Recursion/Costs.lean
new file mode 100644
index 000000000..8c133d15e
--- /dev/null
+++ b/Ix/Compiler/Recursion/Costs.lean
@@ -0,0 +1,121 @@
+import Ix.Compiler.Recursion.Allocation
+import Ix.Compiler.IxIR2.PipelineCosts
+
+/-!
+# Source refinement with RC and peak-live bounds
+
+The source contracts and semantic relations remain those of D2, R2, and R3.
+Recovered shared mains additionally bound selected RC work and every recorded
+live-node peak by the actual physical baseline, including intermediate states
+and complete shared-result reclamation. Literal fallback retains R3's endpoint.
+-/
+
+namespace Ix.Compiler.Recursion
+
+open Ix.Compiler.Ixon (Address Constant)
+
+namespace Lowered
+
+variable {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+  {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+
+/-- Successful source execution derives all compiler and heap invariants
+internally, retaining the same selected semantic value and shared resources. -/
+theorem physicalMainCostLaws (lowered : Lowered recovery fuel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (sourceRun : IxIR0.eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main = .ok sourceValue) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.runMain
+        (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+          lowered.attached.target.artifact.validationContext.schemas)
+        .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+      lowered.PhysicalValueRel sourceValue result ∧ result.SharedResources ∧
+      lowered.attached.CostComparison lowered.reuse heapFuel result := by
+  have trace : IxIR0.ProjectionSafe.Eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main sourceValue := recovery.projectionSafe sourceRun
+  obtain ⟨ir1Fuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    lowered.compilation.addressedOwnedMain trace
+  have attachedRun : IxIR1.runOwnedMain lowered.attached.simulationSourceContext
+      lowered.attached.target.artifact.source.mainResult
+      lowered.attached.target.artifact.source.main ir1Fuel = .ok (store, value) := by
+    rw [lowered.attached.simulationSourceContext_eq_addressedCtx,
+      lowered.attached.targetSourceProduced, lowered.attached.inputProduced, lowered.sourceProduced]
+    exact ownedRun
+  obtain ⟨baselineControl, controlFuel, heapFuel, baseline, result, locRel,
+      baselineRun, run, baselineRelation, heaps, values, baselineResources, resources,
+      allocations, costs, reclaimed, prefixes⟩ :=
+    lowered.attached.selectedPhysicalMainCostLaws lowered.reuse attachedRun
+  exact ⟨controlFuel, heapFuel, result, run,
+    ⟨store, value, baseline, locRel, ⟨rawStore, addressImage, graph⟩,
+      baselineRelation, heaps, values⟩, resources,
+    baselineControl, heapFuel, baseline, baselineRun, baselineResources,
+    allocations, costs, reclaimed, prefixes⟩
+
+end Lowered
+
+namespace Compilation
+
+variable {constants : List (Address × Constant)} {root : Address}
+  {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+/-- Recovered shared results carry the full comparison with an actual
+physical baseline. Both selection branches have RC and peak bounds; literal
+fallback retains exactly the existing allocation/resource endpoint. -/
+def SelectedExecutionWithCostLaws
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) : Prop :=
+  match compilation.outcome with
+  | .literal _ => compilation.SelectedExecutionWithAllocationLaws sourceValue
+  | .recovered _ lowered =>
+      ∃ rawValue controlFuel heapFuel result,
+        compilation.SourceValueRel sourceValue rawValue ∧
+        IxIR2.Eval.runMain
+          (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+            lowered.attached.target.artifact.validationContext.schemas)
+          .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+        lowered.PhysicalValueRel rawValue result ∧ result.SharedResources ∧
+        lowered.attached.CostComparison lowered.reuse heapFuel result
+
+/-- Forgetting the new bounds recovers R3's unchanged source endpoint. -/
+theorem SelectedExecutionWithCostLaws.allocations
+    {compilation : Compilation constants root config eraseFuel lowerFuel}
+    {sourceValue : Ixon.Eval.Value}
+    (execution : compilation.SelectedExecutionWithCostLaws sourceValue) :
+    compilation.SelectedExecutionWithAllocationLaws sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason => simpa only [SelectedExecutionWithCostLaws, selected] using execution
+  | recovered recovery lowered =>
+      simp only [SelectedExecutionWithCostLaws, SelectedExecutionWithAllocationLaws,
+        selected] at execution ⊢
+      obtain ⟨raw, control, heap, result, source, run, relation, resources, costs⟩ := execution
+      exact ⟨raw, control, heap, result, source, run, relation, resources, costs.allocations⟩
+
+/-- Source refinement with allocation/free laws, RC and peak bounds, and
+complete reclamation, under exactly the original source sharing and oracle
+contracts. Compiler trace invariants and both selection branches are internal. -/
+theorem sourceRefinesSelectedWithCostLaws
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    compilation.SelectedExecutionWithCostLaws sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      simpa only [SelectedExecutionWithCostLaws, selected] using
+        compilation.sourceRefinesSelectedWithAllocationLaws horacles hctx hsource
+  | recovered recovery lowered =>
+      obtain ⟨rawFuel, rawValue, rawRun, sourceRelation⟩ := compilation.sourceRefines horacles hctx hsource
+      rw [selected] at rawRun
+      obtain ⟨controlFuel, heapFuel, result, run, relation, resources, costs⟩ :=
+        lowered.physicalMainCostLaws rawRun
+      simp only [SelectedExecutionWithCostLaws, selected]
+      exact ⟨rawValue, controlFuel, heapFuel, result, sourceRelation, run, relation, resources, costs⟩
+
+end Compilation
+
+end Ix.Compiler.Recursion
diff --git a/Ix/Compiler/Recursion/Observations.lean b/Ix/Compiler/Recursion/Observations.lean
new file mode 100644
index 000000000..af6c79dbd
--- /dev/null
+++ b/Ix/Compiler/Recursion/Observations.lean
@@ -0,0 +1,320 @@
+import Ix.Compiler.Recursion.Sources
+import Ix.Compiler.Recursion.Pipeline
+import Ix.Compiler.Coverage.HeapSnapshot
+
+/-! Execute the actual source and compiler outputs. Constructor observations
+check full identities; final reclamation visits the returned heaps. The
+three-element hot/cold measurements retain the earlier IxIR₀ witness's counts.
+-/
+
+namespace Ix.Compiler.Recursion.Examples
+
+open Lean Ix.Compiler.Ixon
+
+deriving instance ToJson for IxIR0.Recursion.Schema
+deriving instance ToJson for IxIR0.Recursion.Plan
+deriving instance ToJson for IxIR2.Reuse.Report
+
+inductive Observation where
+  | list (values : List Nat)
+  | pair (reversed original : List Nat)
+  deriving BEq, Repr, ToJson
+
+private def sourceList? (source : Source) : Nat → Ixon.Eval.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctorV block 1 tag fields =>
+      if block != source.dataBlock then none
+      else match tag, fields with
+        | 0, [] => some []
+        | 1, [.litV (.natL n), tail] => (n :: ·) <$> sourceList? source fuel tail
+        | _, _ => none
+  | _, _ => none
+
+private def sourceObservation? (source : Source) (value : Ixon.Eval.Value) : Option Observation :=
+  if source.aliased then
+    match value with
+    | .ctorV block 3 0 [left, right] => do
+        if block != source.dataBlock then none
+        else return .pair (← sourceList? source 1000 left) (← sourceList? source 1000 right)
+    | _ => none
+  else .list <$> sourceList? source 1000 value
+
+private def list0? (source : Source) : Nat → IxIR0.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctor address tag fields =>
+      if address == source.nil && tag == 0 && fields.isEmpty then some []
+      else if address == source.cons && tag == 1 then
+        match fields with
+        | [.lit (.nat n), tail] => (n :: ·) <$> list0? source fuel tail
+        | _ => none
+      else none
+  | _, _ => none
+
+private def observation0? (source : Source) (value : IxIR0.Value) : Option Observation :=
+  if source.aliased then
+    match value with
+    | .ctor address 0 [left, right] => do
+        if address != source.pair then none
+        else return .pair (← list0? source 1000 left) (← list0? source 1000 right)
+    | _ => none
+  else .list <$> list0? source 1000 value
+
+private def list1? (source : Source) : Nat → IxIR1.Store → IxIR1.RVal → Option (List Nat)
+  | 0, _, _ => none
+  | fuel + 1, store, .loc location => do
+      let box ← store.get? location
+      let .ctorN identity fields := box.node | none
+      if identity == IxIR1.Lower.ctorIdOf source.nil 0 && fields.isEmpty then some []
+      else if identity == IxIR1.Lower.ctorIdOf source.cons 1 then
+        match fields.toList with
+        | [.lit (.nat n), tail] => (n :: ·) <$> list1? source fuel store tail
+        | _ => none
+      else none
+  | _, _, _ => none
+
+private def observation1? (source : Source) (store : IxIR1.Store)
+    (value : IxIR1.RVal) : Option Observation :=
+  if source.aliased then do
+    let .loc location := value | none
+    let box ← store.get? location
+    let .ctorN identity fields := box.node | none
+    if identity != IxIR1.Lower.ctorIdOf source.pair 0 then none
+    else match fields.toList with
+      | [left, right] => return .pair (← list1? source 1000 store left) (← list1? source 1000 store right)
+      | _ => none
+  else .list <$> list1? source 1000 store value
+
+private def expected (source : Source) : Observation :=
+  if source.aliased then .pair source.values.reverse source.values
+  else .list source.values.reverse
+
+private def agree (source : Source) (stage : String) (actual : Option Observation) : Except String Unit :=
+  if actual == some (expected source) then .ok ()
+  else .error s!"{stage}: expected {repr (expected source)}, got {repr actual}"
+
+private def observe0 (source : Source) (stage : String) (declarations : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) : Except String Unit := do
+  let value ← (IxIR0.eval { env := IxIR0.Env.ofList declarations } 10000 [] main).mapError
+    (fun error => s!"{stage}: {repr error}")
+  agree source stage (observation0? source value)
+
+private def observe1 (source : Source) (stage : String) (context : IxIR1.Ctx)
+    (main : IxIR1.Code) : Except String (IxIR1.Store × IxIR1.RVal × Json) := do
+  let (store, value) ← (IxIR1.runOwnedMain context .shared main 10000).mapError
+    (fun error => s!"{stage}: {repr error}")
+  agree source stage (observation1? source store value)
+  if store.live + store.frees != store.allocs then
+    throw s!"{stage} terminal allocation balance disagrees"
+  let reclaimed ← (IxIR1.dropVal context 10000 store value).mapError
+    (fun error => s!"{stage} reclamation: {repr error}")
+  if reclaimed.live != 0 || reclaimed.allocs != reclaimed.frees then
+    throw s!"{stage} did not reclaim every allocation"
+  return (store, value, Json.mkObj [
+    ("value", toJson (expected source)), ("store", toJson store),
+    ("reclaimed", toJson reclaimed)])
+
+private def observe2 (source : Source) (stage : String) (context : IxIR2.Validate.Context)
+    (program : IxIR2.Program) (mode : IxIR2.Eval.Interpretation) :
+    Except String (IxIR2.Eval.Result × IxIR2.Eval.Store × Json) := do
+  let result ← (IxIR2.Eval.runMain (IxIR2.Eval.Context.ofProgram program context.schemas)
+    mode program 10000 10000).mapError (fun error => s!"{stage}: {repr error}")
+  agree source stage (observation1? source result.store.heap result.value)
+  if result.store.live + result.store.counters.frees != result.store.counters.allocs then
+    throw s!"{stage} terminal allocation balance disagrees"
+  let (reclaimed, remaining) ← (IxIR2.Eval.releaseShared 10000 result.store result.value).mapError
+    (fun error => s!"{stage} reclamation: {repr error}")
+  if reclaimed.live != 0 || reclaimed.counters.allocs != reclaimed.counters.frees then
+    throw s!"{stage} did not reclaim every allocation"
+  return (result, reclaimed, Json.mkObj [
+    ("value", toJson (expected source)), ("store", toJson result.store),
+    ("control_remaining", toJson result.controlRemaining), ("heap_remaining", toJson result.heapRemaining),
+    ("reclaimed", toJson reclaimed), ("reclamation_remaining", toJson remaining)])
+
+private def heapCounters (store : IxIR1.Store) : Json :=
+  Json.mkObj [("allocs", toJson store.allocs), ("frees", toJson store.frees),
+    ("rcops", toJson store.rcops), ("reuses", toJson store.reuses), ("live", toJson store.live)]
+
+private def costGate (source : Source) (baseline logical physical : IxIR2.Eval.Result)
+    (baselineReleased physicalReleased : IxIR2.Eval.Store) : Except String Unit := do
+  let b := baseline.store.counters
+  let l := logical.store.counters
+  let p := physical.store.counters
+  if b.reuses != 0 || b.allocs != p.allocs + p.reuses || b.frees != p.frees + p.reuses then
+    throw "physical baseline/selected terminal allocation laws disagree"
+  if p.rcops > b.rcops || p.peakLiveNodes > b.peakLiveNodes then
+    throw "physical baseline/selected terminal RC or peak-live bound disagrees"
+  let br := baselineReleased.counters
+  let pr := physicalReleased.counters
+  if br.reuses != 0 || br.allocs != pr.allocs + pr.reuses || br.frees != pr.frees + pr.reuses then
+    throw "physical baseline/selected reclaimed allocation laws disagree"
+  if pr.rcops > br.rcops || pr.peakLiveNodes > br.peakLiveNodes then
+    throw "physical baseline/selected reclaimed RC or peak-live bound disagrees"
+  if l.allocs != p.allocs + p.reuses || l.frees != p.frees + p.reuses ||
+      l.rcops != p.rcops || logical.store.live != physical.store.live ||
+      l.resetAttempts != p.resetAttempts || l.hotResets != p.hotResets || l.coldResets != p.coldResets then
+    throw "logical/physical terminal accounting disagreement"
+  let n := source.values.length
+  if p.resetAttempts != n || (if source.aliased then p.coldResets != n || p.hotResets != 0 || p.reuses != 0
+      else p.hotResets != n || p.coldResets != 0 || p.reuses != n || p.reusedPayloadUnits != 2 * n) then
+    throw "one reset per input cons was not observed"
+  if n == 3 then
+    if source.aliased then
+      if b.allocs != 9 || b.frees != 0 || b.rcops != 8 || p.allocs != 9 || p.frees != 0 ||
+          p.rcops != 8 || p.peakLiveNodes != 9 then throw "three-cons cold witness counters drifted"
+    else
+      if b.allocs != 8 || b.frees != 4 || b.rcops != 10 || p.allocs != 5 || p.frees != 1 ||
+          p.rcops != 1 || p.peakLiveNodes != 5 then throw "three-cons hot witness counters drifted"
+
+private def graphSnapshot (result : IxIR1.ReaddressAll.Result)
+    (raw : List (Address × IxIR1.Decl)) (rawMain : IxIR1.Code) : Json :=
+  Json.mkObj [
+    ("root", toJson (IxIR1.Optimizer.graphRoot result.artifacts result.main)),
+    ("raw_declarations", Coverage.ir1Entries raw), ("raw_main", Coverage.byteJson rawMain.bytes),
+    ("artifacts", toJson (result.artifacts.map Coverage.ir1Artifact)),
+    ("declarations", Coverage.ir1Entries (result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)),
+    ("main", Coverage.byteJson result.main.bytes), ("address_map", toJson result.addressMap),
+    ("reserved", toJson result.reserved)]
+
+structure CaseResult where
+  name : String
+  summary : Json
+  snapshot : Json
+
+def runCase (name : String) (values : List Nat) (aliased : Bool) : Except String CaseResult := do
+  let source ← Examples.source values aliased
+  let sourceValue ← (Ixon.Eval.eval (Pipeline.validatedEvalCtx source.constants source.config) 10000
+    (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError
+      (fun error => s!"Ixon: {repr error}")
+  agree source "Ixon" (sourceObservation? source sourceValue)
+  let compilation ← (compileValidated source.constants source.root source.config).mapError
+    (fun error => s!"validated source compilation: {repr error}")
+  let .recovered recovery lowered := compilation.outcome
+    | throw s!"{name}: recovery did not reach the checked backend"
+  let .optimized optimized _ := lowered.reuse | throw "reuse was unexpectedly skipped"
+  let plan := recovery.checked.plan
+  let erasure := compilation.source.erasure.result
+  let oldLowering := compilation.source.lowering
+  let newLowering := lowered.lowering
+  let baseline := lowered.attached.target
+  observe0 source "literal raw IxIR0" erasure.raw (.ref source.root)
+  observe0 source "literal addressed IxIR0" erasure.declarations erasure.main
+  observe0 source "recovered IxIR0" (IxIR0.Recursion.targetDeclarations plan recovery.address)
+    (plan.directMain recovery.address)
+  let (oldRaw, _, oldRawJson) ← observe1 source "literal raw IxIR1"
+    { decls := IxIR1.Env.ofList oldLowering.raw } oldLowering.mainCode
+  let (oldFinal, _, oldFinalJson) ← observe1 source "literal addressed IxIR1"
+    { decls := compilation.source.artifact.targetDeclEnv } oldLowering.result.main
+  if toJson oldRaw != toJson oldFinal then throw "literal IxIR1 addressing changed the complete terminal store"
+  let (raw, _, rawJson) ← observe1 source "recovered raw IxIR1"
+    { decls := IxIR1.Env.ofList newLowering.raw } newLowering.mainCode
+  let (final, _, finalJson) ← observe1 source "recovered addressed IxIR1"
+    { decls := IxIR1.HPT.programDeclEnv newLowering.result.artifacts } newLowering.result.main
+  let (baseLogical, _, baseLogicalJson) ← observe2 source "baseline logical IxIR2"
+    baseline.artifact.validationContext baseline.artifact.program .logical
+  let (basePhysical, baseReleased, basePhysicalJson) ← observe2 source "baseline physical IxIR2"
+    baseline.artifact.validationContext baseline.artifact.program .physical
+  if toJson raw != toJson final || toJson final != toJson baseLogical.store.heap ||
+      toJson baseLogical.store != toJson basePhysical.store ||
+      baseLogical.controlRemaining != basePhysical.controlRemaining ||
+      baseLogical.heapRemaining != basePhysical.heapRemaining then
+    throw "recovered addressing or baseline interpretation changed stores/counters/budgets"
+  let (logical, _, logicalJson) ← observe2 source "reuse logical IxIR2"
+    baseline.artifact.validationContext optimized.target .logical
+  let (physical, physicalReleased, physicalJson) ← observe2 source "reuse physical IxIR2"
+    baseline.artifact.validationContext optimized.target .physical
+  costGate source basePhysical logical physical baseReleased physicalReleased
+  let loop := loopAddress newLowering.result recovery.address
+  let some (_, .fn function) := baseline.artifact.program.declarations.find? (fun entry => entry.1 == loop)
+    | throw "derived recursor is missing from the addressed target"
+  let tailSelf := function.blocks.countP fun block => match block.terminator with
+    | .tailCallSelf _ => true | _ => false
+  if tailSelf != 1 || optimized.report.rewritten != 1 || optimized.report.helperBlocks != 2 then
+    throw "checked lowering did not produce one recursive tail and one reset diamond"
+  let rerun := IxIR2.Reuse.rewriteProgram baseline.artifact.validationContext optimized.target
+  if rerun.program != optimized.target || rerun.report.rewritten != 0 then
+    throw "reuse is not idempotent on the selected target"
+  let summary := Json.mkObj [
+    ("name", toJson name), ("snapshot", toJson s!"{name}.json"),
+    ("source_root", toJson source.root), ("source_constants", toJson source.constants.length),
+    ("input", toJson values), ("aliased", toJson aliased), ("value", toJson (expected source)),
+    ("literal_ixir1_root", toJson (IxIR1.Optimizer.graphRoot oldLowering.result.artifacts oldLowering.result.main)),
+    ("recovered_recursion_root", toJson recovery.address),
+    ("recovered_ixir1_root", toJson (IxIR1.Optimizer.graphRoot newLowering.result.artifacts newLowering.result.main)),
+    ("hpt_roots", toJson (lowered.attached.hpt.result.artifacts.map (·.address))),
+    ("loop", toJson loop), ("tail_self_calls", toJson tailSelf),
+    ("literal_ixir1", heapCounters oldFinal), ("recovered_ixir1", heapCounters final),
+    ("baseline", toJson baseLogical.store.counters), ("logical", toJson logical.store.counters),
+    ("physical", toJson physical.store.counters), ("reuse", toJson optimized.report),
+    ("all_heaps_reclaimed", toJson true)]
+  let context := lowered.attached.loweringContext
+  let attached := lowered.attached
+  let common := attached.source
+  let sidecars := attached.sidecars
+  let constructors := (IxIR0.Recursion.targetDeclarations plan recovery.address).filterMap fun
+    | (address, .ctor tag _) => some (IxIR1.Lower.ctorIdOf address tag)
+    | _ => none
+  let snapshot := Json.mkObj [
+    ("format", toJson "compilatrix/source-recursion-case/2"), ("summary", summary),
+    ("source", Json.mkObj [
+      ("root", toJson source.root), ("limits", toJson source.config.limits),
+      ("fuel", Json.mkObj [("usage", toJson (1000 : Nat)), ("erasure", toJson (1000 : Nat)),
+        ("validation", toJson (1000 : Nat)), ("ownership_lowering", toJson (1000 : Nat)),
+        ("evaluation", toJson (10000 : Nat)), ("control", toJson (10000 : Nat)),
+        ("heap", toJson (10000 : Nat)), ("reclamation", toJson (10000 : Nat))]),
+      ("constants", toJson (source.constants.map fun (address, constant) =>
+        Json.mkObj [("key", toJson address), ("bytes", Coverage.byteJson (ser constant))])),
+      ("literals", toJson (values.map fun n =>
+        Json.mkObj [("key", toJson (X86.ValidatedScalar.literalAddress n)), ("nat", toJson n)]))]),
+    ("literal_ixir0", Json.mkObj [
+      ("raw", Coverage.ir0Entries erasure.raw), ("raw_main", Coverage.byteJson (IxIR0.Expr.ref source.root).bytes),
+      ("groups", toJson (erasure.groups.map Coverage.ir0Group)),
+      ("declarations", Coverage.ir0Entries erasure.declarations), ("main", Coverage.byteJson erasure.main.bytes),
+      ("blocks", toJson (erasure.addressed.blocks.map Coverage.ir0Block)), ("address_map", toJson erasure.addressMap)]),
+    ("literal_ixir1", graphSnapshot oldLowering.result oldLowering.raw oldLowering.mainCode),
+    ("recovery", Json.mkObj [
+      ("plan", toJson plan), ("derived_key", toJson recovery.address),
+      ("declarations", Coverage.ir0Entries (IxIR0.Recursion.targetDeclarations plan recovery.address)),
+      ("main", Coverage.byteJson (plan.directMain recovery.address).bytes)]),
+    ("recovered_ixir1", graphSnapshot newLowering.result newLowering.raw newLowering.mainCode),
+    ("ownership_lowering", Json.mkObj [
+      ("declarations", Coverage.ir0Entries common.declarations),
+      ("main", Coverage.byteJson common.main.bytes),
+      ("source_rows_selected", toJson (Pipeline.sourceRowsSelected common.declarations)),
+      ("source_externs_rejected", toJson (Pipeline.firstValidatedExtern? common.declarations).isNone),
+      ("target_externs_rejected", toJson (Pipeline.firstValidatedTargetExtern? common.targetDecls).isNone)]),
+    ("hpt", Json.mkObj [
+      ("producer_limits", toJson IxIR1.HPT.defaultProducerLimits),
+      ("producer_stats", toJson attached.hpt.stats),
+      ("candidate", toJson (attached.hpt.certificate.artifacts.map Coverage.hptCandidate)),
+      ("artifacts", toJson (attached.hpt.result.artifacts.map Coverage.hptArtifact))]),
+    ("sidecars", Json.mkObj [
+      ("input_declarations", Coverage.ir1Entries sidecars.input.declarations),
+      ("input_main", Coverage.byteJson sidecars.input.main.bytes),
+      ("main_world", toJson sidecars.input.mainResult),
+      ("parameter_worlds", toJson sidecars.parameterEntries),
+      ("constructors", toJson sidecars.constructors),
+      ("recursor_origins", toJson sidecars.recursorOrigins),
+      ("hpt_certificate", toJson (sidecars.hptCertificate.artifacts.map Coverage.hptCandidate))]),
+    ("ixir2_diagnostic", Json.mkObj [
+      ("baseline", toJson baseline.artifact.program), ("baseline_stats", toJson baseline.stats),
+      ("selected", toJson optimized.target), ("selected_stats", toJson optimized.targetStats),
+      ("parameters", toJson [(loop, context.parameterWorlds loop)]),
+      ("schemas", toJson (constructors.map fun c => (c, context.schemas .shared c))),
+      ("case_constructors", toJson [context.caseCtors { owner := .declaration loop } 0,
+        context.caseCtors { owner := .declaration loop } 1]),
+      ("max_depth", toJson lowered.maxDepth), ("reuse", toJson optimized.report)]),
+    ("observations", Json.mkObj [
+      ("literal_raw_ixir1", oldRawJson), ("literal_ixir1", oldFinalJson),
+      ("recovered_raw_ixir1", rawJson), ("recovered_ixir1", finalJson),
+      ("baseline_logical", baseLogicalJson), ("baseline_physical", basePhysicalJson),
+      ("reuse_logical", logicalJson), ("reuse_physical", physicalJson)])]
+  return { name, summary, snapshot }
+
+def cases : List (String × List Nat × Bool) :=
+  [("empty-hot", [], false), ("empty-cold", [], true),
+    ("singleton-hot", [17], false), ("singleton-cold", [17], true),
+    ("three-hot", [1, 2, 3], false), ("three-cold", [1, 2, 3], true),
+    ("mixed-hot", [0, 3, 3, UInt64.size, 1, 42, 0], false),
+    ("mixed-cold", [0, 3, 3, UInt64.size, 1, 42, 0], true)]
+
+end Ix.Compiler.Recursion.Examples
diff --git a/Ix/Compiler/Recursion/PhysicalSim.lean b/Ix/Compiler/Recursion/PhysicalSim.lean
new file mode 100644
index 000000000..255a4a24b
--- /dev/null
+++ b/Ix/Compiler/Recursion/PhysicalSim.lean
@@ -0,0 +1,176 @@
+import Ix.Compiler.Recursion.Sim
+import Ix.Compiler.Recursion.Trace
+import Ix.Compiler.LoweredCompilationSim
+import Ix.Compiler.IxIR2.PipelinePhysical
+import Ix.Compiler.IxIR2.ReuseLiveSim
+
+/-!
+# Selected source execution through physical reuse
+
+The exact checked recovery supplies projection-free trace completeness.
+Ownership lowering, complete addressing, baseline physical execution, and
+the selected reuse result then compose through the common attachment.
+Literal fallback retains the original validated owned IxIR₁ endpoint.
+-/
+
+namespace Ix.Compiler.Recursion
+
+open Ix.Compiler.Ixon (Address Constant)
+
+namespace Lowered
+
+variable {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+  {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+
+/-- The existing value/heap relations composed across full addressing,
+baseline lowering, and physical reuse. Allocation counters are not part of
+this semantic relation. -/
+def PhysicalValueRel (lowered : Lowered recovery fuel) (sourceValue : IxIR0.Value)
+    (result : IxIR2.Eval.Result) : Prop :=
+  ∃ store value baseline locRel,
+    IxIR1.LowerSim.AddressedValueGraph
+      (lowered.lowering.result.rebuildRename lowered.lowering.raw)
+      lowered.compilation.functionRel store sourceValue value ∧
+    IxIR2.Lower.Sim.OutcomeRel (store, value) baseline ∧
+    IxIR2.ReuseSim.StableHeapRel baseline.store result.store locRel ∧
+    IxIR1.Sim.RValIso locRel baseline.value result.value
+
+/-- No intermediate run or compiler invariant is supplied by the caller.
+The selected program may be the validated rewrite or its checked baseline. -/
+theorem physicalMainSimulation (lowered : Lowered recovery fuel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (sourceRun : IxIR0.eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main = .ok sourceValue) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.runMain
+        (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+          lowered.attached.target.artifact.validationContext.schemas)
+        .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+      lowered.PhysicalValueRel sourceValue result := by
+  have trace : IxIR0.ProjectionSafe.Eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main sourceValue := recovery.projectionSafe sourceRun
+  obtain ⟨ir1Fuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    lowered.compilation.addressedOwnedMain trace
+  have attachedRun : IxIR1.runOwnedMain lowered.attached.simulationSourceContext
+      lowered.attached.target.artifact.source.mainResult
+      lowered.attached.target.artifact.source.main ir1Fuel = .ok (store, value) := by
+    rw [lowered.attached.simulationSourceContext_eq_addressedCtx,
+      lowered.attached.targetSourceProduced, lowered.attached.inputProduced, lowered.sourceProduced]
+    exact ownedRun
+  obtain ⟨controlFuel, heapFuel, baseline, baselineRun, baselineRelation⟩ :=
+    lowered.attached.successfulPhysicalMainSimulation attachedRun
+  obtain ⟨selectedControl, result, locRel, selectedRun, heapRelation, valueRelation, _budget⟩ :=
+    IxIR2.ReuseLiveSim.selectedPhysicalMainSimulation (attached := lowered.attached)
+      (oracle := fun _ _ => none) lowered.reuse baselineRun
+  exact ⟨selectedControl, heapFuel, result, selectedRun, store, value, baseline, locRel,
+    ⟨rawStore, addressImage, graph⟩, baselineRelation, heapRelation, valueRelation⟩
+
+end Lowered
+
+namespace Compilation
+
+variable {constants : List (Address × Constant)} {root : Address}
+  {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+abbrev SourceValueRel (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) (rawValue : IxIR0.Value) : Prop :=
+  @Ix.Compiler.Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList compilation.source.erasure.result.raw }
+    sourceValue rawValue compilation.source.memberScope
+
+def LiteralValueRel (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) (store : IxIR1.Store) (value : IxIR1.RVal) : Prop :=
+  ∃ rawValue,
+    compilation.SourceValueRel sourceValue rawValue ∧
+    IxIR1.LowerSim.MutualAddressedValueGraph
+      (IxIR0.MutualBlock.Renaming.apply compilation.source.erasure.result.addressMap)
+      (compilation.source.lowering.result.rebuildRename compilation.source.lowering.raw)
+      compilation.source.lowered.functionRel store rawValue value
+
+/-- The executable outcome determines the theorem's target: the original
+owned IxIR₁ on literal fallback, or the exact selected physical IxIR₂ after
+successful recovery and attachment. -/
+def SelectedExecution (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) : Prop :=
+  match compilation.outcome with
+  | .literal _ =>
+      ∃ targetFuel store value,
+        IxIR1.runOwnedMain (compilation.source.lowering.result.addressedCtx (fun _ _ => none))
+          .shared compilation.source.artifact.main targetFuel = .ok (store, value) ∧
+        compilation.LiteralValueRel sourceValue store value
+  | .recovered _ lowered =>
+      ∃ rawValue controlFuel heapFuel result,
+        compilation.SourceValueRel sourceValue rawValue ∧
+        IxIR2.Eval.runMain
+          (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+            lowered.attached.target.artifact.validationContext.schemas)
+          .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+        lowered.PhysicalValueRel rawValue result
+
+/-- The original source certificate also supplies the literal fallback's
+call-aware trace. It crosses the same generic ownership theorem as recovery. -/
+theorem literalSourceRefines
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    ∃ targetFuel store value,
+      IxIR1.runOwnedMain (compilation.source.lowering.result.addressedCtx (fun _ _ => none))
+        .shared compilation.source.artifact.main targetFuel = .ok (store, value) ∧
+      compilation.LiteralValueRel sourceValue store value := by
+  letI : Ix.Compiler.Sim.MemberScope := compilation.source.memberScope
+  have hframe : (Pipeline.validatedMainFrame root).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [Pipeline.validatedMainFrame] at found
+  have hbelow : Ixon.Sharing.sharesBelow (Pipeline.validatedMainFrame root).sharing.size
+      Pipeline.validatedMainSource = true := rfl
+  have herase : EraseAddressed.run
+      (EraseValidator.eraseCtxOf (Pipeline.validatedEvalCtx constants config)) constants
+      compilation.source.entry.target eraseFuel = .ok compilation.source.erasure.result := by
+    rw [compilation.source.entryTarget]
+    exact compilation.source.erasure.runEq
+  obtain ⟨traceFuel, addressedValue, trace, rawValue, sourceRelation, addressedEq⟩ :=
+    IxIR1.LowerSim.CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members
+      (fun _ _ => none) (fun _ _ => none) compilation.source.members compilation.source.entry herase
+      (by intro address arguments; rfl) horacles hctx hframe hbelow hsource
+  subst addressedValue
+  obtain ⟨targetFuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    compilation.source.lowered.addressedOwnedMain trace
+  exact ⟨targetFuel, store, value, ownedRun, rawValue, sourceRelation,
+    rawStore, addressImage, graph⟩
+
+/-- Source-facing semantic preservation for every successful compilation
+outcome. The only caller premises are the existing source sharing/oracle
+contracts and successful Ixon evaluation. -/
+theorem sourceRefinesSelected
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    compilation.SelectedExecution sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      simpa only [SelectedExecution, selected] using
+        compilation.literalSourceRefines horacles hctx hsource
+  | recovered recovery lowered =>
+      obtain ⟨rawFuel, rawValue, rawRun, sourceRelation⟩ :=
+        compilation.sourceRefines horacles hctx hsource
+      rw [selected] at rawRun
+      obtain ⟨controlFuel, heapFuel, result, run, related⟩ :=
+        lowered.physicalMainSimulation rawRun
+      simp only [SelectedExecution, selected]
+      exact ⟨rawValue, controlFuel, heapFuel, result, sourceRelation, run, related⟩
+
+end Compilation
+
+end Ix.Compiler.Recursion
diff --git a/Ix/Compiler/Recursion/Pipeline.lean b/Ix/Compiler/Recursion/Pipeline.lean
new file mode 100644
index 000000000..a0f4deb45
--- /dev/null
+++ b/Ix/Compiler/Recursion/Pipeline.lean
@@ -0,0 +1,142 @@
+import Ix.Compiler.Pipeline
+import Ix.Compiler.IxIR0.Recursion
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR2.Reuse
+
+/-!
+# Validated source compilation with optional recursion recovery
+
+The literal validated compilation remains available in every result. Recovery
+consumes its exact raw erasure. A recovered recursor receives a fresh canonical
+IxIR₀ key, passes ordinary ownership lowering and complete IxIR₁ addressing,
+and then crosses the existing checked CFG and reuse boundaries. The constructor
+sidecars here come from the small checked recovery schema.
+
+Unrecognized inputs and optional backend failures retain the literal compiler
+artifact. Source validation failures remain compilation errors.
+-/
+
+namespace Ix.Compiler.Recursion
+
+open Ix.Compiler.Ixon (Address Constant)
+
+def inputOf (result : IxIR1.ReaddressAll.Result) : IxIR2.Lower.Input :=
+  { declarations := result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations
+    main := result.main, mainResult := .shared }
+
+def loopAddress (result : IxIR1.ReaddressAll.Result) (address : Address) : Address :=
+  IxIR1.Readdress.Renaming.apply result.addressMap address
+
+/-- The known recovery constructors and actual addressed loop feed the same
+checked HPT/sidecar attachment as ordinary source compilation. -/
+def buildSidecars {fuel : Nat} (plan : IxIR0.Recursion.Plan) (address : Address)
+    (source : Pipeline.LoweredCompilation .shared fuel) :
+    Except IxIR2.Pipeline.Error (IxIR2.Pipeline.BuiltCompiledSidecars source) := do
+  let hpt ← (IxIR1.HPT.produce source.lowering.result.artifacts).mapError .hpt
+  let constructors : List IxIR2.Pipeline.ConstructorInfo :=
+    [{ identity := IxIR1.Lower.ctorIdOf plan.schema.nil 0, arity := 0 },
+     { identity := IxIR1.Lower.ctorIdOf plan.schema.cons 1, arity := 2 }] ++
+      plan.retainedAlias.toList.map fun pair =>
+        { identity := IxIR1.Lower.ctorIdOf pair 0, arity := 2 }
+  let sidecars : IxIR2.Pipeline.Sidecars :=
+    { input := inputOf source.lowering.result
+      parameterEntries := [(loopAddress source.lowering.result address, #[.shared, .shared])]
+      constructors
+      hptCertificate := hpt.certificate }
+  return { sidecars, hpt, certificateProduced := rfl, inputProduced := rfl }
+
+structure Lowered {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    (recovery : IxIR0.Recursion.Recovered declarations main) (fuel : Nat) where
+  lowering : IxIR1.Lower.FullyAddressedTrace
+    (IxIR0.Recursion.targetDeclarations recovery.checked.plan recovery.address)
+    (recovery.checked.plan.directMain recovery.address) .shared fuel
+  certificate : Pipeline.LoweringCertificate
+    (IxIR0.Recursion.targetDeclarations recovery.checked.plan recovery.address)
+    (lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)
+  backend : IxIR2.Pipeline.CompiledRun (Pipeline.LoweredCompilation.ofTrace lowering certificate)
+  reuse : IxIR2.Reuse.Selection IxIR2.Validate.defaultLimits
+    backend.val.target.artifact.validationContext backend.val.target.artifact.program
+
+def Lowered.compilation {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+    (lowered : Lowered recovery fuel) : Pipeline.LoweredCompilation .shared fuel :=
+  Pipeline.LoweredCompilation.ofTrace lowered.lowering lowered.certificate
+
+def Lowered.attached {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+    (lowered : Lowered recovery fuel) : IxIR2.Pipeline.CompiledAttachment .shared fuel :=
+  lowered.backend.val
+
+def Lowered.maxDepth {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+    (lowered : Lowered recovery fuel) : Nat := lowered.attached.maxDepth
+
+theorem Lowered.sourceProduced {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+    (lowered : Lowered recovery fuel) : lowered.attached.source = lowered.compilation :=
+  lowered.backend.property
+
+inductive Skip where
+  | recovery (reason : IxIR0.Recursion.Skip)
+  | ownershipLowering (message : String)
+  | cfgLowering (error : IxIR2.Lower.Error)
+  | cfgAttachment (error : IxIR2.Pipeline.Error)
+  deriving Repr
+
+private def attachmentSkip : IxIR2.Pipeline.Error → Skip
+  | .lowering error => .cfgLowering error
+  | error => .cfgAttachment error
+
+def lower {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    (recovery : IxIR0.Recursion.Recovered declarations main) (fuel : Nat)
+    (maxDepth : Nat := 1000) :
+    Except Skip (Lowered recovery fuel) := do
+  let lowering ←
+    (IxIR1.Lower.lowerAllIndexedFullyAddressedWithTrace
+      (IxIR0.Recursion.targetDeclarations recovery.checked.plan recovery.address)
+      (recovery.checked.plan.directMain recovery.address) .shared fuel).mapError .ownershipLowering
+  let certificate ← (Pipeline.checkLoweringCertificate
+    (IxIR0.Recursion.targetDeclarations recovery.checked.plan recovery.address)
+    (lowering.result.artifacts.flatMap IxIR1.ReaddressAll.Artifact.declarations)).mapError .ownershipLowering
+  let compilation := Pipeline.LoweredCompilation.ofTrace lowering certificate.down
+  let sidecars ← (buildSidecars recovery.checked.plan recovery.address compilation).mapError attachmentSkip
+  let backend ← (IxIR2.Pipeline.attachCompiled compilation sidecars maxDepth).mapError attachmentSkip
+  let reuse := IxIR2.Reuse.selectChecked backend.val.target.artifact.validationContext
+    backend.val.target.artifact.program backend.val.target.valid
+  return { lowering, certificate := certificate.down, backend, reuse }
+
+inductive Outcome (declarations : List (Address × IxIR0.Decl)) (main : IxIR0.Expr)
+    (fuel : Nat) where
+  | literal (reason : Skip)
+  | recovered (recovery : IxIR0.Recursion.Recovered declarations main)
+      (lowered : Lowered recovery fuel)
+
+def Outcome.selected {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    {fuel : Nat} : Outcome declarations main fuel → IxIR0.Recursion.Selection declarations main
+  | .literal (.recovery reason) => .literal reason
+  | .literal _ => .literal .rejectedTarget
+  | .recovered recovery _ => .recovered recovery
+
+structure Compilation (constants : List (Address × Constant)) (root : Address)
+    (config : Pipeline.Config) (eraseFuel lowerFuel : Nat) where
+  source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel
+  outcome : Outcome source.erasure.result.raw (.ref root) lowerFuel
+
+/-- Keep the original validated artifact through every optional failure.
+Neither callers nor the recognizer supply IxIR₁ or IxIR₂ code. -/
+def compileValidated (constants : List (Address × Constant)) (root : Address)
+    (config : Pipeline.Config := {})
+    (checkFuel : Nat := 1000) (eraseFuel : Nat := 1000)
+    (validateFuel : Nat := 1000) (lowerFuel : Nat := 1000) (maxDepth : Nat := 1000) :
+    Except Pipeline.Error (Compilation constants root config eraseFuel lowerFuel) := do
+  let source ← Pipeline.compileValidatedWithTrace constants root config .shared
+    checkFuel eraseFuel validateFuel lowerFuel
+  let outcome := match IxIR0.Recursion.select source.erasure.result.raw (.ref root) with
+    | .literal reason => Outcome.literal (.recovery reason)
+    | .recovered recovery =>
+        match lower recovery lowerFuel maxDepth with
+        | .error reason => .literal reason
+        | .ok lowered => .recovered recovery lowered
+  return { source, outcome }
+
+end Ix.Compiler.Recursion
diff --git a/Ix/Compiler/Recursion/Rejections.lean b/Ix/Compiler/Recursion/Rejections.lean
new file mode 100644
index 000000000..f1027810d
--- /dev/null
+++ b/Ix/Compiler/Recursion/Rejections.lean
@@ -0,0 +1,127 @@
+import Ix.Compiler.Recursion.Observations
+
+/-! Adversarial proposals use copies of the actual source erasure. They check
+the recognizer/checker boundary, first-binding lookup, fresh naming, source
+rejection, and a real CFG resource failure that retains the literal artifact.
+-/
+
+namespace Ix.Compiler.Recursion.Examples
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR0.Recursion
+
+private def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+private def replace (entries : List (Address × IxIR0.Decl)) (address : Address)
+    (replacement : IxIR0.Decl) : List (Address × IxIR0.Decl) :=
+  entries.map fun entry => if entry.1 == address then (entry.1, replacement) else entry
+
+private def rejected (name : String) (entries : List (Address × IxIR0.Decl))
+    (main : IxIR0.Expr) (proposal : Option Plan) (reason : IxIR0.Recursion.Skip) : Except String Unit := do
+  let selection := selectWith entries main proposal
+  match selection with
+  | .recovered _ => throw s!"{name}: unsafe recovery accepted"
+  | .literal actual => need (actual == reason) s!"{name}: wrong skip reason {repr actual}"
+  need (selection.declarations == entries && selection.main == main)
+    s!"{name}: literal fallback changed the input"
+
+private def changedStep (s : Schema) (body : IxIR0.Expr) : IxIR0.Decl :=
+  .defn .shared (.lam .many (.lam .many (.lam .many
+    (packExpr s (ghost (.lam .many body)) (.var 0)))))
+
+def rejectionChecks : Except String (List String) := do
+  let fixture ← source [1, 2, 3] false
+  let compilation ← (compileValidated fixture.constants fixture.root fixture.config).mapError
+    (fun error => s!"rejection fixture: {repr error}")
+  let .recovered recovery lowered := compilation.outcome | throw "rejection fixture was not recovered"
+  let entries := compilation.source.erasure.result.raw
+  let main : IxIR0.Expr := .ref fixture.root
+  let plan := recovery.checked.plan
+  let s := plan.schema
+  let .recursor _ _ rules := literalRecursor s | throw "invalid reference recursor"
+  let mutations : List (String × Address × IxIR0.Decl) := [
+    ("recursive-arity", s.recursor, .recursor 3 false rules),
+    ("nat-peeling", s.recursor, .recursor 2 true rules),
+    ("extra-constructor-rule", s.recursor,
+      .recursor 2 false (rules.push { fields := 0, rhs := .var 0 })),
+    ("non-immediate-recursion", s.recursor,
+      .recursor 2 false (rules.set! 1 { fields := 2, rhs := .app (.var 4) (.proj 1 (.var 0)) })),
+    ("wrong-constructor-layout", s.cons, .ctor 1 3),
+    ("wrong-constructor-tag", s.cons, .ctor 0 2),
+    ("wrong-base-function", s.base, .defn .shared
+      (packExpr s (ghost (.lam .many (.var 1))) (ghost (.ref s.unit)))),
+    ("below-escape", s.step, changedStep s (.var 2)),
+    ("below-data-projection", s.step,
+      changedStep s (.app (.proj 1 (.var 2)) (consExpr s (.var 4) (.var 0)))),
+    ("course-of-values-projection", s.step,
+      changedStep s (.app (.proj 0 (.proj 1 (.var 2))) (consExpr s (.var 4) (.var 0)))),
+    ("changed-accumulator", s.step,
+      changedStep s (.app (.proj 0 (.var 2)) (consExpr s (.var 4) (.var 3)))),
+    ("returned-below-tuple", fixture.root, .defn .shared (.ref s.base)),
+    ("extra-entry-use", fixture.root, .defn .shared (.letE .many (.ref s.base) plan.literalMain)),
+    ("unique-entry-result", fixture.root, .defn .unique plan.literalMain)]
+  for (name, address, declaration) in mutations do
+    rejected name (replace entries address declaration) main (some plan) .rejectedProposal
+  rejected "changed-proposal-input" entries main (some { plan with values := [3, 2, 1] }) .rejectedProposal
+  rejected "unrecognized-entry" entries (.app main .erased) none .unrecognized
+  need ((propose entries (.app main .erased)).isNone) "unrecognized entry was proposed"
+  rejected "first-binding-shadow" ((s.cons, .ctor 1 7) :: entries) main (some plan) .rejectedProposal
+  rejected "fresh-address-conflict" (entries ++ [(recovery.address, .defn .shared .erased)])
+    main (some plan) .addressConflict
+  let common := lowered.compilation
+  let certificateRejections : List (String × List (Address × IxIR0.Decl) × List (Address × IxIR1.Decl)) :=
+    [("lowering-shadowed-source", (s.cons, .ctor 1 7) :: common.declarations, common.targetDecls),
+     ("lowering-source-extern", replace common.declarations s.cons (.extern 2), common.targetDecls),
+     ("lowering-target-extern", common.declarations, (s.cons, .extern 2) :: common.targetDecls)]
+  for (name, source, target) in certificateRejections do
+    match Pipeline.checkLoweringCertificate source target with
+    | .error _ => pure ()
+    | .ok _ => throw s!"{name}: invalid common lowering certificate accepted"
+  let fallback ← (compileValidated fixture.constants fixture.root fixture.config
+    1000 1000 1000 1000 0).mapError (fun error => s!"source rejected at optional CFG limit: {repr error}")
+  match fallback.outcome with
+  | .literal (.cfgLowering (.resources _)) => pure ()
+  | _ => throw "zero CFG depth did not retain the literal backend with its exact resource error"
+  need (fallback.outcome.selected.declarations == entries && fallback.outcome.selected.main == main &&
+    Coverage.ir1Entries fallback.source.artifact.targetDecls ==
+      Coverage.ir1Entries compilation.source.artifact.targetDecls &&
+    fallback.source.artifact.main.bytes == compilation.source.artifact.main.bytes)
+    "CFG failure changed the checked literal artifact"
+  let scalar ← Coverage.scalar "fallback" 42 true
+  let scalarResult ← (compileValidated scalar.constants scalar.root scalar.config 100 100 100 100).mapError
+    (fun error => s!"scalar fallback failed: {repr error}")
+  match scalarResult.outcome with
+  | .literal (.recovery .unrecognized) => pure ()
+  | _ => throw "ordinary scalar source did not retain its literal compilation"
+  let (scalarStore, scalarValue) ←
+    (IxIR1.runOwnedMain { decls := scalarResult.source.artifact.targetDeclEnv }
+      .shared scalarResult.source.artifact.main 1000).mapError (fun error => s!"scalar fallback run: {repr error}")
+  need (scalarValue == .lit (.nat 42) && scalarStore.live == 0) "scalar fallback result changed"
+  let bare ← Coverage.bareLiteral
+  match compileValidated bare.constants bare.root bare.config 100 100 100 100 with
+  | .error (.usage _ .freezeNeeded) => pure ()
+  | _ => throw "source freeze rejection was weakened by optional recovery"
+  let external ← Coverage.externSource
+  match compileValidated external.constants external.root external.config 100 100 100 100 with
+  | .error (.validate _ "validated extern ownership ABI rejects this declaration") => pure ()
+  | _ => throw "source extern rejection was weakened by optional recovery"
+  return mutations.map (·.1) ++ ["changed-proposal-input", "unrecognized-entry", "first-binding-shadow",
+    "fresh-address-conflict", "cfg-resource-fallback", "scalar-literal-fallback", "source-freeze-rejection",
+    "source-extern-rejection"] ++ certificateRejections.map (·.1)
+
+def runAll : Except String (List CaseResult × List String) := do
+  let rejected ← rejectionChecks
+  let results ← cases.mapM fun (name, values, aliased) =>
+    (runCase name values aliased).mapError (fun error => s!"{name}: {error}")
+  return (results, rejected)
+
+def report (results : List CaseResult) (rejections : List String) : Lean.Json :=
+  Lean.Json.mkObj [
+    ("format", Lean.toJson "compilatrix/source-recursion-report/1"),
+    ("source_origin", Lean.toJson "canonical synthetic Ixon"),
+    ("recovery_policy", Lean.toJson "immediate-list-below/1"),
+    ("cases", Lean.toJson (results.map (·.summary))),
+    ("rejection_checks", Lean.toJson rejections)]
+
+end Ix.Compiler.Recursion.Examples
diff --git a/Ix/Compiler/Recursion/Resources.lean b/Ix/Compiler/Recursion/Resources.lean
new file mode 100644
index 000000000..03f8ac0c9
--- /dev/null
+++ b/Ix/Compiler/Recursion/Resources.lean
@@ -0,0 +1,134 @@
+import Ix.Compiler.Recursion.PhysicalSim
+import Ix.Compiler.IxIR2.PipelineResources
+
+/-!
+# Source refinement with terminal resources
+
+The source contracts are exactly those of D2. Each successful selected target
+execution preserves the existing value relation, accounts for all physical
+reservations at halt, and admits complete reclamation of its shared result.
+Literal fallback retains the original owned IxIR₁ execution and its release.
+-/
+
+namespace Ix.Compiler.Recursion
+
+open Ix.Compiler.Ixon (Address Constant)
+
+namespace Lowered
+
+variable {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+  {recovery : IxIR0.Recursion.Recovered declarations main} {fuel : Nat}
+
+/-- The same actual selected execution satisfies semantic preservation and
+terminal resource guarantees, with no caller-supplied heap invariant. -/
+theorem physicalMainResources (lowered : Lowered recovery fuel)
+    {sourceFuel : Nat} {sourceValue : IxIR0.Value}
+    (sourceRun : IxIR0.eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main = .ok sourceValue) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.runMain
+        (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+          lowered.attached.target.artifact.validationContext.schemas)
+        .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+      lowered.PhysicalValueRel sourceValue result ∧ result.SharedResources := by
+  have trace : IxIR0.ProjectionSafe.Eval lowered.compilation.sourceCtx sourceFuel []
+      lowered.compilation.main sourceValue := recovery.projectionSafe sourceRun
+  obtain ⟨ir1Fuel, rawStore, store, value, ownedRun, addressImage, graph⟩ :=
+    lowered.compilation.addressedOwnedMain trace
+  have attachedRun : IxIR1.runOwnedMain lowered.attached.simulationSourceContext
+      lowered.attached.target.artifact.source.mainResult
+      lowered.attached.target.artifact.source.main ir1Fuel = .ok (store, value) := by
+    rw [lowered.attached.simulationSourceContext_eq_addressedCtx,
+      lowered.attached.targetSourceProduced, lowered.attached.inputProduced, lowered.sourceProduced]
+    exact ownedRun
+  obtain ⟨controlFuel, heapFuel, result, baseline, locRel, run, baselineRelation,
+      heaps, values, resources⟩ :=
+    lowered.attached.selectedPhysicalMainResources lowered.reuse attachedRun
+  exact ⟨controlFuel, heapFuel, result, run,
+    ⟨store, value, baseline, locRel, ⟨rawStore, addressImage, graph⟩,
+      baselineRelation, heaps, values⟩, resources⟩
+
+end Lowered
+
+namespace Compilation
+
+variable {constants : List (Address × Constant)} {root : Address}
+  {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+/-- Each branch retains the D2 semantic relation and adds a successful release
+of that very returned value. Recovered shared results additionally carry the
+physical allocation accounting theorem, before and after release. -/
+def SelectedExecutionWithResources
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    (sourceValue : Ixon.Eval.Value) : Prop :=
+  match compilation.outcome with
+  | .literal _ =>
+      ∃ targetFuel store value,
+        IxIR1.runOwnedMain (compilation.source.lowering.result.addressedCtx (fun _ _ => none))
+          .shared compilation.source.artifact.main targetFuel = .ok (store, value) ∧
+        compilation.LiteralValueRel sourceValue store value ∧
+        ∃ releaseFuel released,
+          IxIR1.dropVal (compilation.source.lowering.result.addressedCtx (fun _ _ => none))
+            releaseFuel store value = .ok released ∧ released.live = 0
+  | .recovered _ lowered =>
+      ∃ rawValue controlFuel heapFuel result,
+        compilation.SourceValueRel sourceValue rawValue ∧
+        IxIR2.Eval.runMain
+          (IxIR2.Eval.Context.ofProgram lowered.reuse.target
+            lowered.attached.target.artifact.validationContext.schemas)
+          .physical lowered.reuse.target controlFuel heapFuel = .ok result ∧
+        lowered.PhysicalValueRel rawValue result ∧ result.SharedResources
+
+/-- Forgetting resource evidence recovers the unchanged D2 semantic endpoint. -/
+theorem SelectedExecutionWithResources.semantic
+    {compilation : Compilation constants root config eraseFuel lowerFuel}
+    {sourceValue : Ixon.Eval.Value}
+    (execution : compilation.SelectedExecutionWithResources sourceValue) :
+    compilation.SelectedExecution sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      simp only [SelectedExecutionWithResources, SelectedExecution, selected] at execution ⊢
+      obtain ⟨fuel, store, value, run, relation, release⟩ := execution
+      exact ⟨fuel, store, value, run, relation⟩
+  | recovered recovery lowered =>
+      simp only [SelectedExecutionWithResources, SelectedExecution, selected] at execution ⊢
+      obtain ⟨raw, control, heap, result, source, run, relation, resources⟩ := execution
+      exact ⟨raw, control, heap, result, source, run, relation⟩
+
+/-- Successful Ixon evaluation supplies the actual selected execution, its
+existing physical value relation, and complete shared-result reclamation.
+The only caller premises are the original source sharing/oracle contracts. -/
+theorem sourceRefinesSelectedWithResources
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    compilation.SelectedExecutionWithResources sourceValue := by
+  cases selected : compilation.outcome with
+  | literal reason =>
+      obtain ⟨targetFuel, store, value, run, relation⟩ :=
+        compilation.literalSourceRefines horacles hctx hsource
+      have bodyRun : IxIR1.runMain
+          (compilation.source.lowering.result.addressedCtx (fun _ _ => none))
+          compilation.source.artifact.main targetFuel = .ok (store, value) :=
+        (IxIR1.Sim.runOwnedMain_ok run).1
+      obtain ⟨releaseFuel, released, release, empty⟩ :=
+        compilation.source.lowered.reclamation (fun _ _ => none) bodyRun
+      simp only [SelectedExecutionWithResources, selected]
+      exact ⟨targetFuel, store, value, run, relation, releaseFuel, released, release, empty⟩
+  | recovered recovery lowered =>
+      obtain ⟨rawFuel, rawValue, rawRun, sourceRelation⟩ :=
+        compilation.sourceRefines horacles hctx hsource
+      rw [selected] at rawRun
+      obtain ⟨controlFuel, heapFuel, result, run, relation, resources⟩ :=
+        lowered.physicalMainResources rawRun
+      simp only [SelectedExecutionWithResources, selected]
+      exact ⟨rawValue, controlFuel, heapFuel, result, sourceRelation, run, relation, resources⟩
+
+end Compilation
+
+end Ix.Compiler.Recursion
diff --git a/Ix/Compiler/Recursion/Sim.lean b/Ix/Compiler/Recursion/Sim.lean
new file mode 100644
index 000000000..3c2e0f134
--- /dev/null
+++ b/Ix/Compiler/Recursion/Sim.lean
@@ -0,0 +1,58 @@
+import Ix.Compiler.Recursion.Pipeline
+import Ix.Compiler.IxIR0.RecursionSim
+
+/-! The validated Ixon entry composed with the exact selected IxIR₀ program.
+The source certificate, not the recognizer, supplies the erasure relation.
+The later lowering traces remain available on `Outcome.recovered`.
+-/
+
+namespace Ix.Compiler.Recursion
+
+open Ix.Compiler.Ixon (Address Constant)
+
+/-- Source-facing recovery, including literal fallback after an optional
+backend failure. The only source premises are the existing sharing and oracle
+contracts and a successful Ixon execution. -/
+theorem Compilation.sourceRefines
+    {constants : List (Address × Constant)} {root : Address}
+    {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+    (compilation : Compilation constants root config eraseFuel lowerFuel)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Ix.Compiler.Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval { env := IxIR0.Env.ofList compilation.outcome.selected.declarations }
+        targetFuel [] compilation.outcome.selected.main = .ok targetValue ∧
+      @Ix.Compiler.Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+        { env := IxIR0.Env.ofList compilation.source.erasure.result.raw }
+        sourceValue targetValue compilation.source.memberScope := by
+  letI : Ix.Compiler.Sim.MemberScope := compilation.source.memberScope
+  have hframe : (Pipeline.validatedMainFrame root).SharingWF := by
+    constructor
+    · rfl
+    · intro index member hget
+      simp [Pipeline.validatedMainFrame] at hget
+  have hbelow : Ixon.Sharing.sharesBelow (Pipeline.validatedMainFrame root).sharing.size
+      Pipeline.validatedMainSource = true := rfl
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx hframe .nil hbelow hsource
+  have hentry := compilation.source.entry.related
+  rw [EraseValidator.inlineTables_tablesOfFrame] at hentry
+  obtain ⟨rawFuel, rawValue, hraw, hrelated⟩ :=
+    Ix.Compiler.Sim.erasure_sim_with_members compilation.source.members horacles
+      hinlined.1 hentry (by
+        simpa [Ixon.Eval.valuesInlineSharing] using
+          (Ix.Compiler.Sim.EnvRel.nil
+            (ectx := (Pipeline.validatedEvalCtx constants config).inlineSharing)
+            (ictx := { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+            (refs := (Pipeline.validatedMainFrame root).inlineSharing.refs)
+            (muts := (Pipeline.validatedMainFrame root).inlineSharing.selfMuts)
+            (sa := (Pipeline.validatedMainFrame root).inlineSharing.selfAddr)))
+  rw [compilation.source.entryTarget] at hraw
+  obtain ⟨targetFuel, htarget⟩ := compilation.outcome.selected.forwardSimulation hraw
+  exact ⟨targetFuel, rawValue, htarget, hrelated⟩
+
+end Ix.Compiler.Recursion
diff --git a/Ix/Compiler/Recursion/Sources.lean b/Ix/Compiler/Recursion/Sources.lean
new file mode 100644
index 000000000..e3a803660
--- /dev/null
+++ b/Ix/Compiler/Recursion/Sources.lean
@@ -0,0 +1,138 @@
+import Ix.Compiler.Coverage.Sources
+
+/-!
+# Ixon inputs for source recursion recovery
+
+These canonical synthetic constants describe an eager tail-below fold and a
+closed list-reversal entry. They supply no intermediate IR. The explicit
+erased-argument applications are accepted by the existing shared-result gate.
+The constants are not an upstream Lean export or a claim about Std coverage.
+-/
+
+namespace Ix.Compiler.Recursion.Examples
+
+open Ix.Compiler.Ixon
+
+private def definition (value typ : Expr) (refs : Array Address) : Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def projection (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def ghost (value : Expr) : Expr :=
+  .app (.lam .erased (.sort 0) value) (.sort 0)
+
+private def app2 (f x y : Expr) : Expr := .app (.app f x) y
+
+private def inductiveType (types : Array (Nat × Expr)) : Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0, typ := .sort 0
+    ctors := types.mapIdx fun i row =>
+      { isUnsafe := false, lvls := 0, cidx := i.toUInt64, params := 0
+        fields := row.1.toUInt64, typ := row.2 } }
+
+structure Source where
+  constants : List (Address × Constant)
+  root : Address
+  values : List Nat
+  aliased : Bool
+  nil : Address
+  cons : Address
+  pair : Address
+  dataBlock : Address
+
+def Source.config (source : Source) : Pipeline.Config :=
+  { blobs := fun a => (source.values.find? fun n =>
+      X86.ValidatedScalar.literalAddress n == a).map .natB
+    limits :=
+      { maxConstants := 32, maxExpressionUnits := 4096, maxExpandedExpressionUnits := 4096
+        maxLayer1NodeVisits := 262144, maxErasedDeclarations := 128
+        maxErasureAppendCells := 8192, maxCertificateCandidates := 64
+        maxCertificateValidationAttempts := 4160, maxCertificateSourceNodeWork := 1048576
+        maxUsageFuel := 1000, maxErasureFuel := 1000
+        maxValidationFuel := 1000, maxLoweringFuel := 1000 } }
+
+/-- One declaration group holds four types without introducing mutual list
+recursion: Nat, List Nat, the below tuple, and the returned pair. Separate
+type-only blocks would erase to duplicate block identities at today's gate.
+-/
+def source (values : List Nat) (aliased : Bool) : Except String Source := do
+  if values.length > 64 then throw "recursion fixture exceeds 64 list elements"
+  let natT := Expr.recur 0 #[]
+  let listT := Expr.recur 1 #[]
+  let tupleT := Expr.recur 2 #[]
+  let stepT := .all .many .shared natT
+    (.all .many .shared listT (.all .many .shared tupleT tupleT))
+  let recursor : Recursor :=
+    { k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0
+      motives := 0, minors := 2
+      typ := .all .many .shared tupleT
+        (.all .many .shared stepT (.all .many .shared listT tupleT))
+      rules := #[
+        { fields := 0
+          rhs := .lam .many tupleT (.lam .many stepT (.var 1)) },
+        { fields := 2
+          rhs := .lam .many tupleT (.lam .many stepT
+            (.lam .many natT (.lam .many listT
+              (.app (app2 (.var 2) (.var 1) (.var 0))
+                (.app (app2 (.recur 4 #[]) (.var 3) (.var 2)) (.var 0)))))) }] }
+  let dataBlock ← Coverage.addressed
+    { info := .muts #[
+        .indc (inductiveType #[(0, .recur 0 #[]),
+          (1, .all .many .shared (.recur 0 #[]) (.recur 0 #[]))]),
+        .indc (inductiveType #[(0, .recur 1 #[]),
+          (2, .all .many .shared (.recur 0 #[])
+            (.all .many .shared (.recur 1 #[]) (.recur 1 #[])))]),
+        .indc (inductiveType #[(2, .all .many .shared
+          (.all .many .shared (.recur 1 #[]) (.recur 1 #[]))
+          (.all .many .shared (.recur 2 #[]) (.recur 2 #[]))), (0, .recur 2 #[])]),
+        .indc (inductiveType #[(2, .all .many .shared (.recur 1 #[])
+          (.all .many .shared (.recur 1 #[]) (.recur 3 #[])))]),
+        .recr recursor]
+      sharing := #[], refs := #[], univs := #[.zero] }
+  let unit ← Coverage.addressed (projection (.cPrj { idx := 2, cidx := 1, block := dataBlock.1 }))
+  let pack ← Coverage.addressed (projection (.cPrj { idx := 2, cidx := 0, block := dataBlock.1 }))
+  let nil ← Coverage.addressed (projection (.cPrj { idx := 1, cidx := 0, block := dataBlock.1 }))
+  let cons ← Coverage.addressed (projection (.cPrj { idx := 1, cidx := 1, block := dataBlock.1 }))
+  let pair ← Coverage.addressed (projection (.cPrj { idx := 3, cidx := 0, block := dataBlock.1 }))
+  let natType ← Coverage.addressed (projection (.iPrj { idx := 0, block := dataBlock.1 }))
+  let listType ← Coverage.addressed (projection (.iPrj { idx := 1, block := dataBlock.1 }))
+  let tupleType ← Coverage.addressed (projection (.iPrj { idx := 2, block := dataBlock.1 }))
+  let pairType ← Coverage.addressed (projection (.iPrj { idx := 3, block := dataBlock.1 }))
+  let listT := Expr.ref 3 #[]
+  let tupleT := Expr.ref 4 #[]
+  let consE := fun h t => app2 (.ref 1 #[]) h t
+  let packE := fun f b => app2 (.ref 0 #[]) f b
+  let base ← Coverage.addressed (definition
+    (packE (ghost (.lam .many (.ref 2 #[]) (.var 0))) (ghost (.ref 1 #[])))
+    (.ref 3 #[]) #[pack.1, unit.1, listType.1, tupleType.1])
+  -- Inside the accumulator lambda: acc, erased argument, below, tail, head.
+  let stepBody := .lam .many (.ref 2 #[]) (.lam .many listT
+    (.lam .many tupleT
+      (packE (ghost (.lam .many listT
+        (.app (.prj 4 0 (.var 2)) (consE (.var 4) (.var 0))))) (.var 0))))
+  let step ← Coverage.addressed (definition stepBody
+    (.all .many .shared (.ref 2 #[])
+      (.all .many .shared listT (.all .many .shared tupleT tupleT)))
+    #[pack.1, cons.1, natType.1, listType.1, tupleType.1])
+  let recursorPrj ← Coverage.addressed (projection (.rPrj { idx := 4, block := dataBlock.1 }))
+  let heads := values.mapIdx fun i _ => ghost (.nat (i + 9).toUInt64)
+  let xs := heads.foldr (fun head tail => app2 (.ref 2 #[]) head tail)
+    (ghost (.ref 1 #[]))
+  let call := fun xs => .app
+    (.prj 5 0 (.app (app2 (.ref 0 #[]) (.ref 7 #[]) (.ref 8 #[])) xs))
+    (ghost (.ref 1 #[]))
+  let main := if aliased then
+    .letE false (.ref 3 #[]) xs (app2 (.ref 4 #[]) (call (.var 0)) (.var 0))
+    else call xs
+  let entry ← Coverage.addressed (definition main (if aliased then .ref 6 #[] else .ref 3 #[])
+    (#[recursorPrj.1, nil.1, cons.1, listType.1, pair.1, tupleType.1, pairType.1,
+      base.1, step.1] ++
+      (values.map X86.ValidatedScalar.literalAddress).toArray))
+  return {
+    constants := [dataBlock, unit, pack, nil, cons, pair, natType, listType,
+      tupleType, pairType, recursorPrj, base, step, entry]
+    root := entry.1, values, aliased, nil := nil.1, cons := cons.1, pair := pair.1
+    dataBlock := dataBlock.1 }
+
+end Ix.Compiler.Recursion.Examples
diff --git a/Ix/Compiler/Recursion/Trace.lean b/Ix/Compiler/Recursion/Trace.lean
new file mode 100644
index 000000000..e5dce7517
--- /dev/null
+++ b/Ix/Compiler/Recursion/Trace.lean
@@ -0,0 +1,51 @@
+import Ix.Compiler.IxIR0.RecursionSim
+import Ix.Compiler.IxIR0.ProjectionFree
+
+/-! The checked direct recursor is projection-free throughout its reachable
+program. Successful evaluator runs therefore supply the actual call-aware
+trace required by ownership-lowering progress.
+-/
+
+namespace Ix.Compiler.IxIR0.Recursion
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR0.ProjectionFree
+
+theorem directListSafe (schema : Schema) (values : List Nat) :
+    ExprSafe (directList schema values) := by
+  induction values with
+  | nil => rfl
+  | cons head tail ih =>
+      simpa only [ExprSafe, directList, consExpr, app2, syntaxSafe, Bool.true_and] using ih
+
+theorem Plan.directMainSafe (plan : Plan) (address : Address) :
+    ExprSafe (plan.directMain address) := by
+  cases alias : plan.retainedAlias <;>
+    simp [ExprSafe, Plan.directMain, alias, directCall, app2, syntaxSafe, directListSafe]
+
+theorem Plan.targetContextSafe (plan : Plan) (address : Address) :
+    CtxSafe { env := Env.ofList (targetDeclarations plan address) } := by
+  constructor
+  · intro key declaration lookup
+    have rows : (targetDeclarations plan address).all (fun row => declSafe row.2) = true := by
+      cases alias : plan.retainedAlias <;>
+        simp [targetDeclarations, alias, directRecursor, consExpr, app2, declSafe, syntaxSafe]
+    unfold Env.ofList at lookup
+    obtain ⟨row, found, value⟩ := Option.map_eq_some_iff.mp lookup
+    have safe := List.all_eq_true.mp rows row (List.mem_of_find?_eq_some found)
+    simpa only [value] using safe
+  · intro key arguments result _ oracle
+    cases oracle
+
+theorem Recovered.projectionSafe
+    {declarations : List (Address × Decl)} {main : Expr}
+    (recovery : Recovered declarations main) {fuel : Nat} {value : Value}
+    (run : eval { env := Env.ofList (targetDeclarations recovery.checked.plan recovery.address) }
+      fuel [] (recovery.checked.plan.directMain recovery.address) = .ok value) :
+    ProjectionSafe.Eval
+      { env := Env.ofList (targetDeclarations recovery.checked.plan recovery.address) }
+      fuel [] (recovery.checked.plan.directMain recovery.address) value :=
+  ProjectionFree.Eval.of_run (recovery.checked.plan.targetContextSafe recovery.address)
+    ValuesSafe.nil (recovery.checked.plan.directMainSafe recovery.address) run
+
+end Ix.Compiler.IxIR0.Recursion
diff --git a/Ix/Compiler/Sim.lean b/Ix/Compiler/Sim.lean
new file mode 100644
index 000000000..84ffb9851
--- /dev/null
+++ b/Ix/Compiler/Sim.lean
@@ -0,0 +1,5547 @@
+import Ix.Compiler.Ixon.Sharing.Eval
+import Ix.Compiler.IxIR0.Mono
+import Ix.Compiler.IxIR0.ProjectionSafe
+import Ix.Compiler.Sim.Segment
+
+/-!
+# The erasure simulation, stages 1 + 2a + 2b plus sharing composition
+
+Stage 1 proved the theorem on the pure λ-fragment; stage 2a added
+literals, constructors, projections, and reference
+resolution with the program-level `Covered` relation. **Stage 2b puts
+recursor ι under the theorem**, including parameterized List-shaped layouts,
+protected split source-only index segments, and indexed recursive self calls.
+Visible constructor-parameter prefixes stutter over their dropped target
+arguments:
+
+- `PErase` is now indexed by the frame's **refs, selfMuts, and
+  selfAddr** (a `recur` reads the mutual block through the frame, and
+  literal peeling keys on the block identity), plus a **self
+  context** `sc : Option (Address × Nat)` — set to the (block,
+  member) pair exactly while relating a recursor rule's body.
+- `RecMember` is the per-recursor program correspondence: the source
+  recursor resolves through its block, the erased declaration sits at
+  the synthetic member address with `numArgs = params + motives + minors` and
+  `natLit` pinned to the *same* well-known-address comparison the
+  evaluator peels on, and every rule's right-hand side peels
+  (`peelChain`) to a body related under the rule mask
+  `fields·true ++ reverse(map policyKept recRulePolicy)` — ghost parameter
+  and motive slots are dropped environment slots, the stage-1 insight again.
+- The recursor-self slot: a rule-body `recur` of the block's own member relates
+  to `var mask.length` through `recurS` for index-free heads and
+  `RecEraseSpine.selfHead` for indexed spines, with **no
+  program-level hypothesis** — requiring `RecMember` there would make
+  the relation non-well-founded (the rule body would contain its own
+  coverage). The obligations live in the **environment base**
+  instead: `EnvRel.selfB` seats the unapplied target recursor pap
+  below the rule binders, carrying `RecMember` — constructible at
+  fire time, where coverage is in hand.
+- Ghost parameter or motive arguments erase to applications of `◻` — `appG`,
+  guarded by `RecPrefix` (the head is syntactically a recursor spine
+  whose next policy is `ghost`). The guard is what makes the clause
+  sound: an unguarded ghost application against a kept-binder closure
+  is false. `recSpine_eval` pins the evaluated head to a recursor
+  pap so the value relation can only be `papRec`.
+- Ghost arguments at ordinary unfoldable definition heads use `appDG`.
+  `DefSpine` follows the visible application spine through the definition's
+  literal implementation lambdas, independently of the executable eraser's
+  declaration-type policy. Both the type and the actual runtime binder must
+  therefore classify the slot as dropped; a mismatched type/value telescope
+  cannot justify erasure.
+- `papRec` carries a `RuntimePolicyPrefix` cursor through parameter, motive,
+  and minor applications. Kept slots require `ValRel`; ghost slots consume
+  both sides but leave their runtime values unconstrained, while exact
+  `PErase.appG` still emits `◻`. For indexed recursors, `RecEraseSpine`
+  keeps the complete `recPolicy` cursor local while source-only indices
+  stutter, then `papRecI` exposes only the ready-to-fire pre-major value. If
+  the visible spine stops inside that index suffix, `recW` evaluates and
+  let-captures the target pap before wrapping it in ignored continuations;
+  `papRecIW` keeps the escaped wrapper closed under generic application and
+  transitions to `papRecI` exactly at the final index. Intermediate raw target
+  paps are deliberately excluded from `ValRel`: they are already one argument
+  from firing while the source still owes indices.
+- Constructor paps and values carry the reusable `PolicyPrefix` cursor from
+  `Sim/Segment.lean`. `CtorParamSpine` handles every visible dropped-parameter
+  prefix. A partial prefix emits ignored target lambdas (`ctorW`) and
+  `papCtorParams` keeps those wrappers closed under later generic application,
+  including after escape through a variable or let; after the last parameter,
+  ordinary `papCtor`/`ctorV` application retains and relates the fields.
+  Recursor firing guards constructor-block identity, and `RecMember` stores a
+  finite `BlockParams` witness, so the global parameterized value relation
+  cannot feed a mismatched recursor layout.
+- At ι both sides select the same rule (same constructor index, or
+  the same literal peel — the evaluator now carries the recursor's
+  block identity precisely so the peels agree), the source enters the
+  kernel-shaped lambda telescope (`applyMany_chain`), and the target
+  evaluates the peeled body in the assembled rule environment;
+  `fireSim` proves the two runs related.
+- Configured opaque definitions and axioms lower to same-arity target
+  externs. `papExtern` relates every under-saturated application prefix;
+  exact saturation crosses the explicit per-address `OracleRelAt`
+  hypothesis, which relates successful source-oracle calls to target-oracle
+  results. `Covered` and the executable validator establish only the
+  structural address/kind/arity correspondence: semantic oracle agreement
+  remains a theorem premise supplied by the trusted ledger.
+
+Mutual-member calls are closed by a finite simultaneous certificate:
+`MemberScope.plan` names the admitted `(block, member)` keys and
+`MemberCoverage` proves every unfoldable definition body or recursor rule set
+against that same plan and pins configured opaque definitions to the exact
+same synthetic member extern used by the source oracle. Public opaque `dPrj`
+aliases use that identity directly. This admits genuinely cyclic non-self
+definition and recursor `recur` heads (including indexed recursor spines)
+without recursively nesting coverage proofs; non-self inductive heads retain
+their direct structural clause. Still outside the core relation are
+occurrences of variables bound in slots the executable eraser drops to `◻`. Raw
+`.share` syntax deliberately remains outside `PErase`; the composition
+theorems at the end of this file transport evaluation through full inlining
+and then reuse the share-free relation unchanged.
+That last case needs usage-checker soundness or a typed logical
+relation: `EnvRel` deliberately leaves dropped slots unconstrained,
+so a general `PErase.var` clause would be false. The differential
+suite in `Erase.lean` witnesses the executable cases; this file is the
+theorem catching up.
+
+Higher-order or otherwise unknown application heads remain conservative:
+without a visible declaration or recursor telescope the executable eraser
+retains the argument, so no unchecked ghost-drop clause is needed.
+
+Fuel handling is unchanged: strong induction on source fuel,
+`IxIR0.eval_mono` to combine target sub-derivations.
+-/
+
+namespace Ix.Compiler.Sim
+
+open Ix.Compiler.Ixon (Uses Owned Recursor RecursorRule MutConst Constant)
+
+/-- Syntactic type-scheme test — share-free restriction of
+`Erase.sortLike`. -/
+def sortLikeP : Ixon.Expr → Bool
+  | .sort _ => true
+  | .all _ _ _ cod => sortLikeP cod
+  | _ => false
+
+/-- Is a binder with this mode and domain erased? Mirrors
+`Erase.dropBinder` on the fragment. -/
+def dropB (u : Uses) (dom : Ixon.Expr) : Bool :=
+  u == .erased || sortLikeP dom
+
+/-- Constructor identity resolved through the source context, including the
+shared source parameter count and the runtime field count. -/
+def CtorShape (ectx : Ixon.Eval.EvalCtx) (block : Ixon.Address)
+    (indIdx cidx params fields : Nat) : Prop :=
+  ∃ bc ind ct,
+    Ixon.Eval.resolveMut ectx block indIdx = .ok (bc, .indc ind) ∧
+    ind.ctors[cidx]? = some ct ∧
+    ind.params.toNat = params ∧ ct.params.toNat = params ∧
+    ct.fields.toNat = fields
+
+/-- Every inductive member of a mutual block uses the recursor's parameter
+count. Definitions and other recursors do not contribute constructor majors.
+This is the finite table-layout fact that source typing normally implies. -/
+inductive BlockParams (params : Nat) : List MutConst → Prop where
+  | nil : BlockParams params []
+  | defn {d rest} : BlockParams params rest →
+      BlockParams params (.defn d :: rest)
+  | recr {r rest} : BlockParams params rest →
+      BlockParams params (.recr r :: rest)
+  | indc {ind rest} : ind.params.toNat = params →
+      BlockParams params rest → BlockParams params (.indc ind :: rest)
+
+theorem BlockParams.lookup_indc {params : Nat} :
+    ∀ {members : List MutConst}, BlockParams params members →
+      ∀ {idx : Nat} {ind : Ix.Compiler.Ixon.Inductive},
+        members[idx]? = some (MutConst.indc ind) →
+        ind.params.toNat = params := by
+  intro members h
+  induction h with
+  | nil => intro idx ind hget; simp at hget
+  | defn hrest ih | recr hrest ih =>
+    intro idx ind hget
+    cases idx with
+    | zero => simp at hget
+    | succ idx =>
+      simp only [List.getElem?_cons_succ] at hget
+      exact ih hget
+  | indc hparams hrest ih =>
+    intro idx ind' hget
+    cases idx with
+    | zero =>
+      simp only [List.getElem?_cons_zero] at hget
+      injection hget with heq
+      cases MutConst.indc.inj heq
+      exact hparams
+    | succ idx =>
+      simp only [List.getElem?_cons_succ] at hget
+      exact ih hget
+
+/-- Peel exactly `n` lambdas (share-free — the kernel-rule chains the
+relation covers are literal). -/
+def peelChain : Nat → Ixon.Expr → Option Ixon.Expr
+  | 0, e => some e
+  | n + 1, .lam _ _ b => peelChain n b
+  | _ + 1, _ => none
+
+/-- Runtime policies for the first `params` binders of a recursor type.
+Share-free all-binders use the same keep/ghost test as expression erasure;
+a short or non-telescope type is conservatively padded with `keep`, matching
+the executable eraser's fallback. -/
+def recParamPolicy : Nat → Ixon.Expr → List Erase.ArgPolicy
+  | 0, _ => []
+  | params + 1, .all u _ dom cod =>
+      (if dropB u dom then .ghost else .keep) :: recParamPolicy params cod
+  | params + 1, _ => List.replicate (params + 1) .keep
+
+/-- Policies for the source arguments passed to a recursor rule: parameters,
+ghost motives, then kept minors. -/
+def recRulePolicy (r : Recursor) : List Erase.ArgPolicy :=
+  recParamPolicy r.params.toNat r.typ ++
+    List.replicate r.motives.toNat .ghost ++
+    List.replicate r.minors.toNat .keep
+
+/-- Complete pre-major policy, adding source-only indices. -/
+def recPolicy (r : Recursor) : List Erase.ArgPolicy :=
+  recRulePolicy r ++ List.replicate r.indices.toNat .drop
+
+def policyKept : Erase.ArgPolicy → Bool
+  | .keep => true
+  | .ghost | .drop => false
+
+/-- A policy list with target slots at every position. Recursor rule
+arguments have this shape; source-only drops occur only in the later index
+segment. -/
+inductive SlotPolicies : List Erase.ArgPolicy → Prop where
+  | nil : SlotPolicies []
+  | keep {rest} : SlotPolicies rest → SlotPolicies (.keep :: rest)
+  | ghost {rest} : SlotPolicies rest → SlotPolicies (.ghost :: rest)
+
+namespace SlotPolicies
+
+theorem append {left right : List Erase.ArgPolicy}
+    (hl : SlotPolicies left) (hr : SlotPolicies right) :
+    SlotPolicies (left ++ right) := by
+  induction hl with
+  | nil => exact hr
+  | keep _ ih => exact .keep ih
+  | ghost _ ih => exact .ghost ih
+
+theorem replicate_keep (n : Nat) :
+    SlotPolicies (List.replicate n .keep) := by
+  induction n with
+  | zero => exact .nil
+  | succ n ih => simpa [List.replicate_succ] using SlotPolicies.keep ih
+
+theorem replicate_ghost (n : Nat) :
+    SlotPolicies (List.replicate n .ghost) := by
+  induction n with
+  | zero => exact .nil
+  | succ n ih => simpa [List.replicate_succ] using SlotPolicies.ghost ih
+
+theorem targetArity_eq_length {policies : List Erase.ArgPolicy}
+    (h : SlotPolicies policies) :
+    policyTargetArity policies = policies.length := by
+  induction h <;> simp_all [policyTargetArity]
+
+theorem dropN {policies : List Erase.ArgPolicy}
+    (h : SlotPolicies policies) (n : Nat) :
+    SlotPolicies (policies.drop n) := by
+  induction n generalizing policies with
+  | zero => simpa using h
+  | succ n ih =>
+    cases h with
+    | nil => exact .nil
+    | keep hrest => exact ih hrest
+    | ghost hrest => exact ih hrest
+
+end SlotPolicies
+
+/-- Rule environments are innermost-first: fields, minors, motives, then the
+reversed parameter policy. -/
+def recRuleMask (r : Recursor) (fields : Nat) : List Bool :=
+  List.replicate fields true ++ ((recRulePolicy r).map policyKept).reverse
+
+@[simp] theorem recParamPolicy_length (params : Nat) (typ : Ixon.Expr) :
+    (recParamPolicy params typ).length = params := by
+  induction params generalizing typ with
+  | zero => rfl
+  | succ params ih =>
+    cases typ <;> simp [recParamPolicy, ih]
+
+theorem recParamPolicy_slots (params : Nat) (typ : Ixon.Expr) :
+    SlotPolicies (recParamPolicy params typ) := by
+  induction params generalizing typ with
+  | zero => exact .nil
+  | succ params ih =>
+    cases typ with
+    | all u o dom cod =>
+      simp only [recParamPolicy]
+      split
+      · exact .ghost (ih cod)
+      · exact .keep (ih cod)
+    | _ => exact SlotPolicies.replicate_keep (params + 1)
+
+theorem recRulePolicy_slots (r : Recursor) :
+    SlotPolicies (recRulePolicy r) := by
+  simpa [recRulePolicy] using
+    (recParamPolicy_slots r.params.toNat r.typ).append
+      ((SlotPolicies.replicate_ghost r.motives.toNat).append
+        (SlotPolicies.replicate_keep r.minors.toNat))
+
+@[simp] theorem recRulePolicy_length (r : Recursor) :
+    (recRulePolicy r).length =
+      r.params.toNat + r.motives.toNat + r.minors.toNat := by
+  simp [recRulePolicy]
+  omega
+
+@[simp] theorem recPolicy_length (r : Recursor) :
+    (recPolicy r).length = Ixon.Eval.recArity r - 1 := by
+  simp [recPolicy, Ixon.Eval.recArity]
+
+@[simp] theorem recPolicy_length_exact (r : Recursor) :
+    (recPolicy r).length = r.params.toNat + r.motives.toNat +
+      r.minors.toNat + r.indices.toNat := by
+  simp [recPolicy]
+
+@[simp] theorem policyTargetArity_recParamPolicy
+    (params : Nat) (typ : Ixon.Expr) :
+    policyTargetArity (recParamPolicy params typ) = params := by
+  calc
+    policyTargetArity (recParamPolicy params typ) =
+        (recParamPolicy params typ).length :=
+      (recParamPolicy_slots params typ).targetArity_eq_length
+    _ = params := recParamPolicy_length params typ
+
+@[simp] theorem policyTargetArity_recRulePolicy (r : Recursor) :
+    policyTargetArity (recRulePolicy r) =
+      r.params.toNat + r.motives.toNat + r.minors.toNat := by
+  simp [recRulePolicy]
+  omega
+
+@[simp] theorem policyTargetArity_recPolicy (r : Recursor) :
+    policyTargetArity (recPolicy r) =
+      r.params.toNat + r.motives.toNat + r.minors.toNat := by
+  simp [recPolicy]
+
+/-- An index-free recursor head. Heads resolve the way the evaluator resolves
+them (through the refs table, or as the frame's own block member). -/
+inductive RecPrefix (ectx : Ixon.Eval.EvalCtx) (refs : Array Ixon.Address)
+    (muts : Array MutConst) (sa : Option Ixon.Address) :
+    Ixon.Expr → Recursor → Prop where
+  | refH {refIdx : UInt64} {u : Array UInt64} {a : Ixon.Address}
+      {c : Constant} {p : Ix.Compiler.Ixon.RecursorProj} {bc : Constant}
+      {r : Recursor} :
+      refs[refIdx.toNat]? = some a →
+      ectx.resolve a = some c →
+      c.info = .rPrj p →
+      Ixon.Eval.resolveMut ectx p.block p.idx.toNat = .ok (bc, .recr r) →
+      r.indices.toNat = 0 →
+      RecPrefix ectx refs muts sa (.ref refIdx u) r
+  | recurH {recIdx : UInt64} {u : Array UInt64} {blk : Ixon.Address}
+      {r : Recursor} :
+      sa = some blk →
+      muts[recIdx.toNat]? = some (.recr r) →
+      r.indices.toNat = 0 →
+      RecPrefix ectx refs muts sa (.recur recIdx u) r
+
+/-- The spine form: a `RecPrefix` head under `j` applications, still before
+the major and driven by `recRulePolicy`. -/
+inductive RecSpine (ectx : Ixon.Eval.EvalCtx) (refs : Array Ixon.Address)
+    (muts : Array MutConst) (sa : Option Ixon.Address) :
+    Ixon.Expr → Recursor → Nat → Prop where
+  | head {e r} : RecPrefix ectx refs muts sa e r →
+      RecSpine ectx refs muts sa e r 0
+  | step {f a r j} : RecSpine ectx refs muts sa f r j →
+      j < (recRulePolicy r).length →
+      RecSpine ectx refs muts sa (.app f a) r (j + 1)
+
+/-- An unfoldable ordinary definition head followed through its literal
+lambda telescope.  This witnesses the *implementation* binder reached by a
+visible source application spine; the executable eraser's `headPolicies`
+checks the declaration type independently.  Requiring both checks prevents
+an ill-shaped type/value pair from justifying argument erasure. -/
+inductive DefSpine (ectx : Ixon.Eval.EvalCtx)
+    (refs : Array Ixon.Address) : Ixon.Expr → Ixon.Expr → Prop where
+  | head {refIdx : UInt64} {univIdxs : Array UInt64}
+      {address : Ixon.Address} {constant : Constant}
+      {definition : Ix.Compiler.Ixon.Definition} :
+      refs[refIdx.toNat]? = some address →
+      ectx.resolve address = some constant →
+      constant.info = .defn definition →
+      Ixon.Eval.unfoldable definition = true →
+      DefSpine ectx refs (.ref refIdx univIdxs) definition.value
+  | step {function argument : Ixon.Expr} {uses : Uses}
+      {domain body : Ixon.Expr} :
+      DefSpine ectx refs function (.lam uses domain body) →
+      DefSpine ectx refs (.app function argument) body
+
+/-- A terminal type expression has no further arrow result and is not a
+sharing indirection. -/
+def resultTypeTerminal : Ixon.Expr → Bool
+  | .all .. | .share .. => false
+  | _ => true
+
+/-- Fuel-free proof relation for the innermost result ownership of a
+definition telescope.  Unlike `Erase.teleResultOwned`, cyclic sharing has no
+derivation instead of acquiring a fuel-dependent default. -/
+inductive TeleResultOwned (sharing : Array Ixon.Expr) :
+    Ixon.Expr → Option Owned → Prop where
+  | terminal {typ : Ixon.Expr} :
+      resultTypeTerminal typ = true →
+      TeleResultOwned sharing typ none
+  | shareMissing {index : UInt64} :
+      sharing[index.toNat]? = none →
+      TeleResultOwned sharing (.share index) none
+  | share {index : UInt64} {typ : Ixon.Expr} {result : Option Owned} :
+      sharing[index.toNat]? = some typ →
+      TeleResultOwned sharing typ result →
+      TeleResultOwned sharing (.share index) result
+  | allHere {uses : Uses} {result : Owned} {domain codomain : Ixon.Expr} :
+      TeleResultOwned sharing codomain none →
+      TeleResultOwned sharing (.all uses result domain codomain) (some result)
+  | allInner {uses : Uses} {result inner : Owned}
+      {domain codomain : Ixon.Expr} :
+      TeleResultOwned sharing codomain (some inner) →
+      TeleResultOwned sharing (.all uses result domain codomain) (some inner)
+
+/-- The target declaration's result world is exactly the source telescope's
+innermost result, defaulting a non-function to shared. -/
+def DefinitionResultOwned (sharing : Array Ixon.Expr) (typ : Ixon.Expr)
+    (result : Owned) : Prop :=
+  ∃ candidate, TeleResultOwned sharing typ candidate ∧
+    result = candidate.getD .shared
+
+/-- A syntactically visible constructor head followed only by its dropped
+parameter prefix.  The final index counts consumed source parameters; target
+evaluation stutters throughout this spine. -/
+inductive CtorParamSpine (ectx : Ixon.Eval.EvalCtx)
+    (refs : Array Ixon.Address) : Ixon.Expr → Ixon.Address → Ixon.Address →
+    Nat → Nat → Nat → Nat → Nat → Prop where
+  | head {refIdx : UInt64} {univIdxs : Array UInt64}
+      {a : Ixon.Address} {c : Constant}
+      {p : Ix.Compiler.Ixon.ConstructorProj} {params fields : Nat} :
+      refs[refIdx.toNat]? = some a →
+      ectx.resolve a = some c →
+      c.info = .cPrj p →
+      CtorShape ectx p.block p.idx.toNat p.cidx.toNat params fields →
+      CtorParamSpine ectx refs (.ref refIdx univIdxs) a p.block
+        p.idx.toNat p.cidx.toNat params fields 0
+  | step {f arg : Ixon.Expr} {a block : Ixon.Address}
+      {indIdx cidx params fields consumed : Nat} :
+      CtorParamSpine ectx refs f a block indIdx cidx params fields consumed →
+      consumed < params →
+      CtorParamSpine ectx refs (.app f arg) a block indIdx cidx params fields
+        (consumed + 1)
+
+/-- A member admitted through one simultaneous mutual-block certificate. -/
+structure MemberKey where
+  block : Ixon.Address
+  idx : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+/-- The finite set of mutual members whose bodies may refer to one another.
+The default scope is empty, preserving the closed relation used by existing
+clients. -/
+class MemberScope where
+  plan : List MemberKey
+
+/-- Existing certificates do not admit open mutual-member calls. A local
+instance with a nonempty plan opts a validator run into simultaneous
+certification. -/
+instance (priority := low) defaultMemberScope : MemberScope where
+  plan := []
+
+section MemberScoped
+
+variable [scope : MemberScope]
+
+mutual
+  /-- Relational erasure, read against a frame's tables. The mask
+  records, per context slot, whether the binder was kept; `sc` names
+  the recursor whose rule body is being related (its `recur` maps to
+  the recSelf slot just below the mask). -/
+  inductive PErase : Ixon.Eval.EvalCtx → IxIR0.Ctx →
+      Option (Ixon.Address × Nat) → Array Ixon.Address →
+      Array MutConst → Option Ixon.Address →
+      List Bool → Ixon.Expr → IxIR0.Expr → Prop where
+    | var {ectx ictx sc refs muts sa} {mask : List Bool} {i : UInt64} :
+        mask[i.toNat]? = some true →
+        PErase ectx ictx sc refs muts sa mask (.var i) (.var i.toNat)
+    | sortE {ectx ictx sc refs muts sa} {mask : List Bool} {u : UInt64} :
+        PErase ectx ictx sc refs muts sa mask (.sort u) .erased
+    | allE {ectx ictx sc refs muts sa} {mask : List Bool} {u : Uses}
+        {o : Ix.Compiler.Ixon.Owned} {dom cod : Ixon.Expr} :
+        PErase ectx ictx sc refs muts sa mask (.all u o dom cod) .erased
+    | lamK {ectx ictx sc refs muts sa} {mask : List Bool} {u : Uses}
+        {dom body : Ixon.Expr} {body' : IxIR0.Expr} :
+        dropB u dom = false →
+        PErase ectx ictx sc refs muts sa (true :: mask) body body' →
+        PErase ectx ictx sc refs muts sa mask (.lam u dom body)
+          (.lam u body')
+    | lamD {ectx ictx sc refs muts sa} {mask : List Bool} {u : Uses}
+        {dom body : Ixon.Expr} {body' : IxIR0.Expr} :
+        dropB u dom = true →
+        PErase ectx ictx sc refs muts sa (false :: mask) body body' →
+        PErase ectx ictx sc refs muts sa mask (.lam u dom body)
+          (.lam .many body')
+    | app {ectx ictx sc refs muts sa} {mask : List Bool} {f a : Ixon.Expr}
+        {f' a' : IxIR0.Expr} :
+        PErase ectx ictx sc refs muts sa mask f f' →
+        PErase ectx ictx sc refs muts sa mask a a' →
+        PErase ectx ictx sc refs muts sa mask (.app f a) (.app f' a')
+    | appE {ectx ictx sc refs muts sa} {mask : List Bool} {u : Uses}
+        {dom body a : Ixon.Expr} {f' : IxIR0.Expr} :
+        dropB u dom = true →
+        PErase ectx ictx sc refs muts sa mask (.lam u dom body) f' →
+        PErase ectx ictx sc refs muts sa mask (.app (.lam u dom body) a)
+          (.app f' .erased)
+    | appG {ectx ictx sc refs muts sa} {mask : List Bool}
+        {f a : Ixon.Expr} {f' : IxIR0.Expr} {r : Recursor} {j : Nat} :
+        RecSpine ectx refs muts sa f r j →
+        (recRulePolicy r)[j]? = some .ghost →
+        PErase ectx ictx sc refs muts sa mask f f' →
+        PErase ectx ictx sc refs muts sa mask (.app f a)
+          (.app f' .erased)
+    | appDG {ectx ictx sc refs muts sa} {mask : List Bool}
+        {f a : Ixon.Expr} {f' : IxIR0.Expr} {uses : Uses}
+        {domain body : Ixon.Expr} :
+        DefSpine ectx refs f (.lam uses domain body) →
+        dropB uses domain = true →
+        PErase ectx ictx sc refs muts sa mask f f' →
+        PErase ectx ictx sc refs muts sa mask (.app f a)
+          (.app f' .erased)
+    | recP {ectx ictx sc refs muts sa} {mask : List Bool}
+        {e : Ixon.Expr} {e' : IxIR0.Expr} {r : Recursor} :
+        RecEraseSpine ectx ictx sc refs muts sa mask e e' r [] →
+        PErase ectx ictx sc refs muts sa mask e e'
+    | recW {ectx ictx sc refs muts sa} {mask : List Bool}
+        {e : Ixon.Expr} {e' : IxIR0.Expr} {r : Recursor}
+        {remaining : Nat} :
+        RecEraseSpine ectx ictx sc refs muts sa mask e e' r
+          (List.replicate remaining .drop) →
+        0 < remaining →
+        PErase ectx ictx sc refs muts sa mask e
+          (Erase.captureThenIgnoreN remaining e')
+    | letE {ectx ictx sc refs muts sa} {mask : List Bool} {nd : Bool}
+        {ty val body : Ixon.Expr} {val' body' : IxIR0.Expr} :
+        PErase ectx ictx sc refs muts sa mask val val' →
+        PErase ectx ictx sc refs muts sa (true :: mask) body body' →
+        PErase ectx ictx sc refs muts sa mask (.letE nd ty val body)
+          (.letE .many val' body')
+    | ctorP {ectx ictx sc refs muts sa} {mask : List Bool}
+        {e : Ixon.Expr} {a block : Ixon.Address}
+        {indIdx cidx params fields : Nat} :
+        0 < params →
+        CtorParamSpine ectx refs e a block indIdx cidx params fields params →
+        ictx.env a = some (.ctor cidx fields) →
+        PErase ectx ictx sc refs muts sa mask e (.ref a)
+    | ctorW {ectx ictx sc refs muts sa} {mask : List Bool}
+        {e : Ixon.Expr} {a block : Ixon.Address}
+        {indIdx cidx params fields consumed : Nat} :
+        CtorParamSpine ectx refs e a block indIdx cidx params fields consumed →
+        consumed < params →
+        ictx.env a = some (.ctor cidx fields) →
+        PErase ectx ictx sc refs muts sa mask e
+          (.lam .many
+            (Erase.lamManyN (params - consumed - 1) (.ref a)))
+    | ref {ectx ictx sc refs muts sa} {mask : List Bool} {refIdx : UInt64}
+        {univIdxs : Array UInt64} {a : Ixon.Address} :
+        refs[refIdx.toNat]? = some a →
+        Covered ectx ictx a →
+        PErase ectx ictx sc refs muts sa mask (.ref refIdx univIdxs)
+          (.ref a)
+    | recurS {ectx ictx refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {idx : Nat} {recIdx : UInt64}
+        {univIdxs : Array UInt64} :
+        recIdx.toNat = idx →
+        (∀ r, muts[recIdx.toNat]? = some (.recr r) →
+          r.indices.toNat = 0) →
+        PErase ectx ictx (some (block, idx)) refs muts sa mask
+          (.recur recIdx univIdxs) (.var mask.length)
+    | recurI {ectx ictx sc refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {recIdx : UInt64}
+        {univIdxs : Array UInt64} {bc : Constant}
+        {ind : Ix.Compiler.Ixon.Inductive} :
+        sa = some block →
+        Ixon.Eval.resolveMut ectx block recIdx.toNat =
+          .ok (bc, .indc ind) →
+        refs = bc.refs →
+        muts[recIdx.toNat]? = some (.indc ind) →
+        ictx.env (Erase.memberAddr block recIdx.toNat) =
+          some (.defn .shared .erased) →
+        PErase ectx ictx sc refs muts sa mask (.recur recIdx univIdxs)
+          (.ref (Erase.memberAddr block recIdx.toNat))
+    | recurD {ectx ictx sc refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {recIdx : UInt64}
+        {univIdxs : Array UInt64} {bc : Constant}
+        {d : Ix.Compiler.Ixon.Definition} :
+        sa = some block →
+        Ixon.Eval.resolveMut ectx block recIdx.toNat =
+          .ok (bc, .defn d) →
+        refs = bc.refs →
+        muts = Ixon.selfMutsOf bc.info →
+        Ixon.Eval.unfoldable d = true →
+        ⟨block, recIdx.toNat⟩ ∈ scope.plan →
+        PErase ectx ictx sc refs muts sa mask (.recur recIdx univIdxs)
+          (.ref (Erase.memberAddr block recIdx.toNat))
+    | recurO {ectx ictx sc refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {recIdx : UInt64}
+        {univIdxs : Array UInt64} {bc : Constant}
+        {d : Ix.Compiler.Ixon.Definition} {arity : Nat} :
+        sa = some block →
+        Ixon.Eval.resolveMut ectx block recIdx.toNat =
+          .ok (bc, .defn d) →
+        refs = bc.refs →
+        muts = Ixon.selfMutsOf bc.info →
+        Ixon.Eval.unfoldable d = false →
+        ectx.externArity (Erase.memberAddr block recIdx.toNat) =
+          some arity →
+        ⟨block, recIdx.toNat⟩ ∈ scope.plan →
+        PErase ectx ictx sc refs muts sa mask (.recur recIdx univIdxs)
+          (.ref (Erase.memberAddr block recIdx.toNat))
+    | recurR {ectx ictx sc refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {recIdx : UInt64}
+        {univIdxs : Array UInt64} {bc : Constant} {r : Recursor} :
+        sa = some block →
+        Ixon.Eval.resolveMut ectx block recIdx.toNat =
+          .ok (bc, .recr r) →
+        refs = bc.refs →
+        muts = Ixon.selfMutsOf bc.info →
+        r.indices.toNat = 0 →
+        ⟨block, recIdx.toNat⟩ ∈ scope.plan →
+        PErase ectx ictx sc refs muts sa mask (.recur recIdx univIdxs)
+          (.ref (Erase.memberAddr block recIdx.toNat))
+    | natE {ectx ictx sc refs muts sa} {mask : List Bool} {idx : UInt64}
+        {a : Ixon.Address} {n : Nat} :
+        refs[idx.toNat]? = some a →
+        ectx.blobs a = some (.natB n) →
+        PErase ectx ictx sc refs muts sa mask (.nat idx) (.lit (.nat n))
+    | strE {ectx ictx sc refs muts sa} {mask : List Bool} {idx : UInt64}
+        {a : Ixon.Address} {s : String} :
+        refs[idx.toNat]? = some a →
+        ectx.blobs a = some (.strB s) →
+        PErase ectx ictx sc refs muts sa mask (.str idx) (.lit (.str s))
+    | prjE {ectx ictx sc refs muts sa} {mask : List Bool}
+        {tyRef fieldIdx : UInt64} {val : Ixon.Expr} {val' : IxIR0.Expr} :
+        PErase ectx ictx sc refs muts sa mask val val' →
+        PErase ectx ictx sc refs muts sa mask (.prj tyRef fieldIdx val)
+          (.proj fieldIdx.toNat val')
+
+  /-- Exact erasure of a fully supplied, syntactically visible indexed
+  recursor spine. The global value relation sees only the final pre-major pap;
+  intermediate paps with a pending source-only index are deliberately not
+  exposed, because generic target application would otherwise fire early. -/
+  inductive RecEraseSpine : Ixon.Eval.EvalCtx → IxIR0.Ctx →
+      Option (Ixon.Address × Nat) → Array Ixon.Address →
+      Array MutConst → Option Ixon.Address → List Bool →
+      Ixon.Expr → IxIR0.Expr → Recursor → List Erase.ArgPolicy → Prop where
+    | head {ectx ictx sc refs muts sa} {mask : List Bool}
+        {refIdx : UInt64} {univIdxs : Array UInt64} {a : Ixon.Address}
+        {c : Constant} {p : Ix.Compiler.Ixon.RecursorProj}
+        {bc : Constant} {r : Recursor} :
+        refs[refIdx.toNat]? = some a →
+        ectx.resolve a = some c →
+        c.info = .rPrj p →
+        Ixon.Eval.resolveMut ectx p.block p.idx.toNat = .ok (bc, .recr r) →
+        0 < r.indices.toNat →
+        ictx.env a = some (.defn .shared (.ref
+          (Erase.memberAddr p.block p.idx.toNat))) →
+        RecMember ectx ictx p.block p.idx.toNat r →
+        RecEraseSpine ectx ictx sc refs muts sa mask
+          (.ref refIdx univIdxs) (.ref a) r (recPolicy r)
+    | selfHead {ectx ictx sc refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {idx : Nat} {recIdx : UInt64}
+        {univIdxs : Array UInt64} {bc : Constant} {r : Recursor} :
+        sc = some (block, idx) →
+        sa = some block →
+        recIdx.toNat = idx →
+        Ixon.Eval.resolveMut ectx block idx = .ok (bc, .recr r) →
+        refs = bc.refs →
+        muts[recIdx.toNat]? = some (.recr r) →
+        0 < r.indices.toNat →
+        RecEraseSpine ectx ictx sc refs muts sa mask
+          (.recur recIdx univIdxs) (.var mask.length) r (recPolicy r)
+    | memberHead {ectx ictx sc refs muts sa} {mask : List Bool}
+        {block : Ixon.Address} {recIdx : UInt64}
+        {univIdxs : Array UInt64} {bc : Constant} {r : Recursor} :
+        sa = some block →
+        Ixon.Eval.resolveMut ectx block recIdx.toNat =
+          .ok (bc, .recr r) →
+        refs = bc.refs →
+        muts = Ixon.selfMutsOf bc.info →
+        0 < r.indices.toNat →
+        ⟨block, recIdx.toNat⟩ ∈ scope.plan →
+        RecEraseSpine ectx ictx sc refs muts sa mask
+          (.recur recIdx univIdxs)
+          (.ref (Erase.memberAddr block recIdx.toNat)) r (recPolicy r)
+    | keep {ectx ictx sc refs muts sa} {mask : List Bool}
+        {f a : Ixon.Expr} {f' a' : IxIR0.Expr} {r : Recursor}
+        {rest : List Erase.ArgPolicy} :
+        RecEraseSpine ectx ictx sc refs muts sa mask f f' r
+          (.keep :: rest) →
+        PErase ectx ictx sc refs muts sa mask a a' →
+        RecEraseSpine ectx ictx sc refs muts sa mask
+          (.app f a) (.app f' a') r rest
+    | ghost {ectx ictx sc refs muts sa} {mask : List Bool}
+        {f a : Ixon.Expr} {f' : IxIR0.Expr} {r : Recursor}
+        {rest : List Erase.ArgPolicy} :
+        RecEraseSpine ectx ictx sc refs muts sa mask f f' r
+          (.ghost :: rest) →
+        RecEraseSpine ectx ictx sc refs muts sa mask
+          (.app f a) (.app f' .erased) r rest
+    | drop {ectx ictx sc refs muts sa} {mask : List Bool}
+        {f a : Ixon.Expr} {f' : IxIR0.Expr} {r : Recursor}
+        {rest : List Erase.ArgPolicy} :
+        RecEraseSpine ectx ictx sc refs muts sa mask f f' r
+          (.drop :: rest) →
+        RecEraseSpine ectx ictx sc refs muts sa mask (.app f a) f' r rest
+
+  /-- The program correspondence at one address. -/
+  inductive Covered : Ixon.Eval.EvalCtx → IxIR0.Ctx →
+      Ixon.Address → Prop where
+    | defn {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {d : Ix.Compiler.Ixon.Definition} {result : Owned}
+        {body' : IxIR0.Expr} :
+        ectx.resolve a = some c →
+        c.info = .defn d →
+        Ixon.Eval.unfoldable d = true →
+        ictx.env a = some (.defn result body') →
+        DefinitionResultOwned c.sharing d.typ result →
+        PErase ectx ictx none c.refs (Ixon.selfMutsOf c.info) none
+          [] d.value body' →
+        Covered ectx ictx a
+    | defnProj {ectx ictx} {a : Ixon.Address} {c bc : Constant}
+        {p : Ix.Compiler.Ixon.DefinitionProj}
+        {d : Ix.Compiler.Ixon.Definition} {result : Owned}
+        {body' : IxIR0.Expr} :
+        ectx.resolve a = some c →
+        c.info = .dPrj p →
+        Ixon.Eval.resolveMut ectx p.block p.idx.toNat = .ok (bc, .defn d) →
+        Ixon.Eval.unfoldable d = true →
+        ictx.env a = some (.defn result
+          (.ref (Erase.memberAddr p.block p.idx.toNat))) →
+        ictx.env (Erase.memberAddr p.block p.idx.toNat) =
+          some (.defn result body') →
+        DefinitionResultOwned bc.sharing d.typ result →
+        PErase ectx ictx none bc.refs (Ixon.selfMutsOf bc.info)
+          (some p.block) [] d.value body' →
+        Covered ectx ictx a
+    | externDefn {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {d : Ix.Compiler.Ixon.Definition} {arity : Nat} :
+        ectx.resolve a = some c →
+        c.info = .defn d →
+        Ixon.Eval.unfoldable d = false →
+        ectx.externArity a = some arity →
+        ictx.env a = some (.extern arity) →
+        Covered ectx ictx a
+    | externDefnProj {ectx ictx} {a : Ixon.Address} {c bc : Constant}
+        {p : Ix.Compiler.Ixon.DefinitionProj}
+        {d : Ix.Compiler.Ixon.Definition} {result : Owned} {arity : Nat} :
+        ectx.resolve a = some c →
+        c.info = .dPrj p →
+        Ixon.Eval.resolveMut ectx p.block p.idx.toNat = .ok (bc, .defn d) →
+        Ixon.Eval.unfoldable d = false →
+        ectx.externArity (Erase.memberAddr p.block p.idx.toNat) =
+          some arity →
+        ictx.env a = some (.defn result
+          (.ref (Erase.memberAddr p.block p.idx.toNat))) →
+        ictx.env (Erase.memberAddr p.block p.idx.toNat) =
+          some (.extern arity) →
+        DefinitionResultOwned bc.sharing d.typ result →
+        Covered ectx ictx a
+    | externAxio {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {ax : Ix.Compiler.Ixon.Axiom} {arity : Nat} :
+        ectx.resolve a = some c →
+        c.info = .axio ax →
+        ectx.externArity a = some arity →
+        ictx.env a = some (.extern arity) →
+        Covered ectx ictx a
+    | ctor {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {p : Ix.Compiler.Ixon.ConstructorProj} {fields : Nat} :
+        ectx.resolve a = some c →
+        c.info = .cPrj p →
+        CtorShape ectx p.block p.idx.toNat p.cidx.toNat 0 fields →
+        ictx.env a = some (.ctor p.cidx.toNat fields) →
+        Covered ectx ictx a
+    | tyf {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {p : Ix.Compiler.Ixon.InductiveProj} :
+        ectx.resolve a = some c →
+        c.info = .iPrj p →
+        ictx.env a = some (.defn .shared .erased) →
+        Covered ectx ictx a
+    | quot {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {q : Ix.Compiler.Ixon.Quotient} {result : Owned} :
+        ectx.resolve a = some c →
+        c.info = .quot q →
+        ectx.quotientKind a = some q.kind →
+        ictx.env a = some (.defn result (Erase.quotientBody q.kind)) →
+        DefinitionResultOwned c.sharing q.typ result →
+        Covered ectx ictx a
+    | recrP {ectx ictx} {a : Ixon.Address} {c : Constant}
+        {p : Ix.Compiler.Ixon.RecursorProj} {bc : Constant} {r : Recursor} :
+        ectx.resolve a = some c →
+        c.info = .rPrj p →
+        Ixon.Eval.resolveMut ectx p.block p.idx.toNat = .ok (bc, .recr r) →
+        r.indices.toNat = 0 →
+        ictx.env a = some (.defn .shared (.ref
+          (Erase.memberAddr p.block p.idx.toNat))) →
+        RecMember ectx ictx p.block p.idx.toNat r →
+        Covered ectx ictx a
+
+  /-- Per-recursor program correspondence: resolution, the erased
+  declaration at the member address (arity `params + motives + minors`,
+  `natLit` by the same block-identity comparison the evaluator peels
+  on), and related rules. Source-only indices are handled by the enclosing
+  complete-spine relation rather than the rule environment. -/
+  inductive RecMember : Ixon.Eval.EvalCtx → IxIR0.Ctx → Ixon.Address →
+      Nat → Recursor → Prop where
+    | mk {ectx ictx} {block : Ixon.Address} {idx : Nat} {r : Recursor}
+        {bc : Constant} {trules : Array IxIR0.RecRule} :
+        Ixon.Eval.resolveMut ectx block idx = .ok (bc, .recr r) →
+        BlockParams r.params.toNat
+          (Ixon.selfMutsOf bc.info).toList →
+        ictx.env (Erase.memberAddr block idx) =
+          some (.recursor
+            (r.params.toNat + r.motives.toNat + r.minors.toNat)
+            (ectx.natBlock == some block) trules) →
+        RulesRel ectx ictx block idx r bc.refs
+          (Ixon.selfMutsOf bc.info) r.rules.toList trules.toList →
+        RecMember ectx ictx block idx r
+
+  /-- Pointwise rule correspondence: field counts agree and the peeled
+  source body relates to the erased rhs under the rule mask, in
+  self-context. -/
+  inductive RulesRel : Ixon.Eval.EvalCtx → IxIR0.Ctx → Ixon.Address →
+      Nat → Recursor → Array Ixon.Address → Array MutConst →
+      List RecursorRule → List IxIR0.RecRule → Prop where
+    | nil {ectx ictx block idx r refs muts} :
+        RulesRel ectx ictx block idx r refs muts [] []
+    | cons {ectx ictx block idx r refs muts}
+        {rule : RecursorRule} {trule : IxIR0.RecRule}
+        {rest : List RecursorRule} {trest : List IxIR0.RecRule}
+        {B : Ixon.Expr} :
+        trule.fields = rule.fields.toNat →
+        peelChain (r.params.toNat + r.motives.toNat + r.minors.toNat +
+          rule.fields.toNat)
+          rule.rhs = some B →
+        PErase ectx ictx (some (block, idx)) refs muts (some block)
+          (recRuleMask r rule.fields.toNat)
+          B trule.rhs →
+        RulesRel ectx ictx block idx r refs muts rest trest →
+        RulesRel ectx ictx block idx r refs muts (rule :: rest)
+          (trule :: trest)
+end
+
+/-- Full correspondence for one member named by a simultaneous certificate.
+Definition and recursor bodies may themselves use member holes from the same
+`MemberScope`, which makes genuinely cyclic blocks finitely representable. -/
+inductive MemberRel (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) :
+    MemberKey → Prop where
+  | defn {block : Ixon.Address} {idx : Nat} {bc : Constant}
+      {d : Ix.Compiler.Ixon.Definition} {result : Owned}
+      {body' : IxIR0.Expr} :
+      Ixon.Eval.resolveMut ectx block idx = .ok (bc, .defn d) →
+      Ixon.Eval.unfoldable d = true →
+      ictx.env (Erase.memberAddr block idx) =
+        some (.defn result body') →
+      DefinitionResultOwned bc.sharing d.typ result →
+      PErase ectx ictx none bc.refs (Ixon.selfMutsOf bc.info)
+        (some block) [] d.value body' →
+      MemberRel ectx ictx ⟨block, idx⟩
+  | externDefn {block : Ixon.Address} {idx : Nat} {bc : Constant}
+      {d : Ix.Compiler.Ixon.Definition} {arity : Nat} :
+      Ixon.Eval.resolveMut ectx block idx = .ok (bc, .defn d) →
+      Ixon.Eval.unfoldable d = false →
+      ectx.externArity (Erase.memberAddr block idx) = some arity →
+      ictx.env (Erase.memberAddr block idx) = some (.extern arity) →
+      MemberRel ectx ictx ⟨block, idx⟩
+  | recr {block : Ixon.Address} {idx : Nat} {r : Recursor} :
+      RecMember ectx ictx block idx r →
+      MemberRel ectx ictx ⟨block, idx⟩
+
+/-- A finite, simultaneous proof for every key in a member plan. Recursive
+references inside its entries point only to keys, never to nested copies of
+the entries themselves. -/
+inductive MemberCoverage (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) :
+    List MemberKey → Prop where
+  | nil : ectx.Strict →
+      MemberCoverage ectx ictx []
+  | cons {key : MemberKey} {rest : List MemberKey} :
+      MemberRel ectx ictx key →
+      MemberCoverage ectx ictx rest →
+      MemberCoverage ectx ictx (key :: rest)
+
+namespace MemberCoverage
+
+theorem strict {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {keys : List MemberKey} (coverage : MemberCoverage ectx ictx keys) :
+    ectx.Strict := by
+  induction coverage with
+  | nil hstrict => exact hstrict
+  | cons _ _ ih => exact ih
+
+theorem lookup {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {keys : List MemberKey} (coverage : MemberCoverage ectx ictx keys) :
+    ∀ {key : MemberKey}, key ∈ keys → MemberRel ectx ictx key := by
+  intro key hmem
+  induction coverage with
+  | nil _ => simp at hmem
+  | @cons head rest hhead hrest ih =>
+    simp only [List.mem_cons] at hmem
+    cases hmem with
+    | inl heq => cases heq; exact hhead
+    | inr htail => exact ih htail
+
+end MemberCoverage
+
+namespace RecMember
+
+theorem resolve {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {block : Ixon.Address} {idx : Nat} {r : Recursor}
+    (h : RecMember ectx ictx block idx r) :
+    ∃ bc, Ixon.Eval.resolveMut ectx block idx = .ok (bc, .recr r) := by
+  cases h with
+  | mk hresolve _ _ _ => exact ⟨_, hresolve⟩
+
+theorem target {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {block : Ixon.Address} {idx : Nat} {r : Recursor}
+    (h : RecMember ectx ictx block idx r) :
+    ∃ trules, ictx.env (Erase.memberAddr block idx) =
+      some (.recursor
+        (r.params.toNat + r.motives.toNat + r.minors.toNat)
+        (ectx.natBlock == some block) trules) := by
+  cases h with
+  | mk _ _ htarget _ => exact ⟨_, htarget⟩
+
+end RecMember
+
+/-- The executable eraser's constructor-address convention. Erasure emits
+`Decl.ctor` only for constructor-projection constants, registered at the
+projection constant's own address (`Erase.eraseConstant`, `.cPrj` case),
+and the target evaluator stamps constructor values with the environment
+key whose head it fired (`IxIR0.eval` at `.ref` / `IxIR0.fire`). A target
+constructor address is therefore pinned to the source family: it must
+resolve, in the **source** context, to a projection of exactly this block,
+inductive, and constructor index. Without this premise `ValRel` would
+relate same-index constructors of different inductive families, letting a
+wrong-family eraser bug satisfy `erasure_sim`. -/
+def CtorAddr (ectx : Ixon.Eval.EvalCtx) (a block : Ixon.Address)
+    (indIdx cidx : Nat) : Prop :=
+  ∃ c p, ectx.resolve a = some c ∧ c.info = .cPrj p ∧
+    p.block = block ∧ p.idx.toNat = indIdx ∧ p.cidx.toNat = cidx
+
+mutual
+  /-- Source and target values related by erasure. -/
+  inductive ValRel : Ixon.Eval.EvalCtx → IxIR0.Ctx →
+      Ixon.Eval.Value → IxIR0.Value → Prop where
+    | sort {ectx ictx l} : ValRel ectx ictx (.sortV l) .erased
+    | pi {ectx ictx u o F env dom cod} :
+        ValRel ectx ictx (.piV u o F env dom cod) .erased
+    | clos {ectx ictx sc} {mask : List Bool} {b : Bool} {u : Uses}
+        {F : Ixon.Eval.Frame} {env : List Ixon.Eval.Value}
+        {dom body : Ixon.Expr} {u' : Uses} {ρ : List IxIR0.Value}
+        {body' : IxIR0.Expr} :
+        b = !dropB u dom →
+        EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ →
+        PErase ectx ictx sc F.refs F.selfMuts F.selfAddr (b :: mask)
+          body body' →
+        ValRel ectx ictx (.closV u F env dom body) (.clos u' ρ body')
+    | litNat {ectx ictx} {n : Nat} :
+        ValRel ectx ictx (.litV (.natL n)) (.lit (.nat n))
+    | litStr {ectx ictx} {s : String} :
+        ValRel ectx ictx (.litV (.strL s)) (.lit (.str s))
+    | quotV {ectx ictx} {address : Ixon.Address}
+        {representative : Ixon.Eval.Value} {target : IxIR0.Value} :
+        ValRel ectx ictx representative target →
+        ValRel ectx ictx (.quotV address representative) target
+    | quotType {ectx ictx} {address : Ixon.Address}
+        {args : List Ixon.Eval.Value} :
+        ValRel ectx ictx (.papV (.quotH address .type) args) .erased
+    | papQuot {ectx ictx} {address : Ixon.Address}
+        {kind : Ix.Compiler.Ixon.QuotKind}
+        {sourceArgs : List Ixon.Eval.Value}
+        {targetArgs : List IxIR0.Value} :
+        kind ≠ .type →
+        sourceArgs.length < Ixon.Eval.quotArity kind →
+        ValsRel ectx ictx sourceArgs targetArgs →
+        ValRel ectx ictx (.papV (.quotH address kind) sourceArgs)
+          (.clos .many targetArgs.reverse
+            (Erase.lamManyN
+              (Ixon.Eval.quotArity kind - sourceArgs.length - 1)
+              (Erase.quotientCore kind)))
+    | papExtern {ectx ictx} {address : Ixon.Address} {arity : Nat}
+        {sourceArgs : List Ixon.Eval.Value}
+        {targetArgs : List IxIR0.Value} :
+        ectx.externArity address = some arity →
+        sourceArgs.length < arity →
+        ValsRel ectx ictx sourceArgs targetArgs →
+        ValRel ectx ictx (.papV (.extH address arity) sourceArgs)
+          (.pap (.ext address arity) targetArgs)
+    | ctorV {ectx ictx} {block : Ixon.Address}
+        {indIdx cidx params fields : Nat}
+        {cargs : List Ixon.Eval.Value} {a : Ixon.Address}
+        {fargs : List IxIR0.Value} :
+        CtorShape ectx block indIdx cidx params fields →
+        CtorAddr ectx a block indIdx cidx →
+        ValsRel ectx ictx (cargs.drop params) fargs →
+        PolicyRel (fun _ _ => True) .erased (ctorPolicy params fields)
+          cargs fargs →
+        ValRel ectx ictx (.ctorV block indIdx cidx cargs)
+          (.ctor a cidx fargs)
+    | papCtor {ectx ictx} {block : Ixon.Address}
+        {indIdx cidx params fields arity tarity : Nat}
+        {sargs : List Ixon.Eval.Value} {a : Ixon.Address}
+        {targs : List IxIR0.Value} :
+        CtorShape ectx block indIdx cidx params fields →
+        CtorAddr ectx a block indIdx cidx →
+        arity = params + fields → tarity = fields →
+        params ≤ sargs.length →
+        sargs.length < arity →
+        ValsRel ectx ictx (sargs.drop params) targs →
+        PolicyPrefix (fun _ _ => True) .erased (ctorPolicy params fields)
+          sargs targs
+            (List.replicate (params + fields - sargs.length) .keep) →
+        ValRel ectx ictx (.papV (.ctorH block indIdx cidx arity) sargs)
+          (.pap (.ctor a cidx tarity) targs)
+    | papCtorParams {ectx ictx} {block : Ixon.Address}
+        {indIdx cidx params fields arity : Nat}
+        {sargs : List Ixon.Eval.Value} {a : Ixon.Address}
+        {targetEnv : List IxIR0.Value} :
+        CtorShape ectx block indIdx cidx params fields →
+        CtorAddr ectx a block indIdx cidx →
+        ictx.env a = some (.ctor cidx fields) →
+        arity = params + fields →
+        sargs.length < params →
+        ValRel ectx ictx (.papV (.ctorH block indIdx cidx arity) sargs)
+          (.clos .many targetEnv
+            (Erase.lamManyN (params - sargs.length - 1) (.ref a)))
+    | papRec {ectx ictx} {block : Ixon.Address} {idx : Nat}
+        {r : Recursor} {F : Ixon.Eval.Frame} {bc : Constant}
+        {sargs : List Ixon.Eval.Value} {targs : List IxIR0.Value}
+        {rest : List Erase.ArgPolicy} :
+        ectx.resolve block = some bc →
+        F.refs = bc.refs →
+        F.selfMuts = Ixon.selfMutsOf bc.info →
+        F.selfAddr = some block →
+        RecMember ectx ictx block idx r →
+        r.indices.toNat = 0 →
+        sargs.length = targs.length →
+        sargs.length ≤ (recRulePolicy r).length →
+        RuntimePolicyPrefix (ValRel ectx ictx) (recRulePolicy r)
+          sargs targs rest →
+        ValRel ectx ictx (.papV (.recH (some block) r F) sargs)
+          (.pap (.rec_ (Erase.memberAddr block idx)
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) targs)
+    | papRecI {ectx ictx} {block : Ixon.Address} {idx : Nat}
+        {r : Recursor} {F : Ixon.Eval.Frame} {bc : Constant}
+        {ruleArgs indexArgs : List Ixon.Eval.Value}
+        {targs : List IxIR0.Value} :
+        ectx.resolve block = some bc →
+        F.refs = bc.refs →
+        F.selfMuts = Ixon.selfMutsOf bc.info →
+        F.selfAddr = some block →
+        RecMember ectx ictx block idx r →
+        0 < r.indices.toNat →
+        indexArgs.length = r.indices.toNat →
+        RuntimePolicyPrefix (ValRel ectx ictx) (recRulePolicy r)
+          ruleArgs targs [] →
+        ValRel ectx ictx
+          (.papV (.recH (some block) r F) (ruleArgs ++ indexArgs))
+          (.pap (.rec_ (Erase.memberAddr block idx)
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) targs)
+    | papRecIW {ectx ictx} {block : Ixon.Address} {idx : Nat}
+        {r : Recursor} {F : Ixon.Eval.Frame} {bc : Constant}
+        {sargs : List Ixon.Eval.Value} {targs ignored : List IxIR0.Value}
+        {baseEnv : List IxIR0.Value} {remaining anchor : Nat} :
+        ectx.resolve block = some bc →
+        F.refs = bc.refs →
+        F.selfMuts = Ixon.selfMutsOf bc.info →
+        F.selfAddr = some block →
+        RecMember ectx ictx block idx r →
+        0 < r.indices.toNat →
+        0 < remaining →
+        ignored.length + remaining = anchor →
+        RuntimePolicyPrefix (ValRel ectx ictx) (recPolicy r)
+          sargs targs (List.replicate remaining .drop) →
+        ValRel ectx ictx (.papV (.recH (some block) r F) sargs)
+          (.clos .many
+            (ignored.reverse ++
+              .pap (.rec_ (Erase.memberAddr block idx)
+                (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+                targs :: baseEnv)
+            (Erase.lamManyN (remaining - 1) (.var anchor)))
+    | inductiveType {ectx ictx} {address : Ixon.Address}
+        {c : Constant} {p : Ix.Compiler.Ixon.InductiveProj}
+        {args : List Ixon.Eval.Value} :
+        ectx.resolve address = some c →
+        c.info = .iPrj p →
+        ValRel ectx ictx (.papV (.neuH (.const address)) args) .erased
+    | inductiveMember {ectx ictx} {block : Ixon.Address} {idx : Nat}
+        {bc : Constant} {ind : Ix.Compiler.Ixon.Inductive}
+        {args : List Ixon.Eval.Value} :
+        ectx.resolve block = some bc →
+        (Ixon.selfMutsOf bc.info)[idx]? = some (.indc ind) →
+        ValRel ectx ictx (.papV (.neuH (.member block idx)) args) .erased
+
+  /-- Environments related slot-wise along the mask against a frame's
+  tables; dropped slots are unconstrained on both sides. A rule-body
+  environment bottoms out at `selfB`: the recSelf slot below the
+  binders, carrying the recursor's coverage. -/
+  inductive EnvRel : Ixon.Eval.EvalCtx → IxIR0.Ctx →
+      Option (Ixon.Address × Nat) → Array Ixon.Address →
+      Array MutConst → Option Ixon.Address → List Bool →
+      List Ixon.Eval.Value → List IxIR0.Value → Prop where
+    | nil {ectx ictx refs muts sa} :
+        EnvRel ectx ictx none refs muts sa [] [] []
+    | selfB {ectx ictx} {refs : Array Ixon.Address} {muts : Array MutConst}
+        {block : Ixon.Address} {idx : Nat} {r : Recursor} {bc : Constant} :
+        ectx.resolve block = some bc →
+        refs = bc.refs →
+        muts = Ixon.selfMutsOf bc.info →
+          RecMember ectx ictx block idx r →
+        EnvRel ectx ictx (some (block, idx)) refs muts (some block) [] []
+          [.pap (.rec_ (Erase.memberAddr block idx)
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) []]
+    | keep {ectx ictx sc refs muts sa mask env ρ v v'} :
+        ValRel ectx ictx v v' →
+        EnvRel ectx ictx sc refs muts sa mask env ρ →
+        EnvRel ectx ictx sc refs muts sa (true :: mask) (v :: env)
+          (v' :: ρ)
+    | drop {ectx ictx sc refs muts sa mask env ρ v v'} :
+        EnvRel ectx ictx sc refs muts sa mask env ρ →
+        EnvRel ectx ictx sc refs muts sa (false :: mask) (v :: env)
+          (v' :: ρ)
+
+  /-- Pointwise-related value lists (constructor fields, pap args). -/
+  inductive ValsRel : Ixon.Eval.EvalCtx → IxIR0.Ctx →
+      List Ixon.Eval.Value → List IxIR0.Value → Prop where
+    | nil {ectx ictx} : ValsRel ectx ictx [] []
+    | cons {ectx ictx v v' vs vs'} :
+        ValRel ectx ictx v v' → ValsRel ectx ictx vs vs' →
+        ValsRel ectx ictx (v :: vs) (v' :: vs')
+end
+
+/-- Semantic correspondence for one configured external address. Structural
+coverage proves that both programs expose the same arity; this premise is the
+trusted ledger entry that relates successful source-oracle calls to target
+oracle calls. -/
+def OracleRelAt (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (address : Ixon.Address) (arity : Nat) : Prop :=
+  ∀ sourceArgs targetArgs sourceValue,
+    sourceArgs.length = arity →
+    ValsRel ectx ictx sourceArgs targetArgs →
+    ectx.oracle address sourceArgs = some sourceValue →
+    ∃ targetValue,
+      ictx.oracle address targetArgs = some targetValue ∧
+      ValRel ectx ictx sourceValue targetValue
+
+/-- Pointwise trusted-extern ledger for every address configured by the
+source evaluator. -/
+def OracleRel (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx) : Prop :=
+  ∀ address arity,
+    ectx.externArity address = some arity →
+    OracleRelAt ectx ictx address arity
+
+namespace OracleRel
+
+/-- A context with no configured external addresses has a vacuous oracle
+ledger. This discharges the new semantic premise for the existing fragment. -/
+theorem of_externFree {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    (hfree : ∀ address, ectx.externArity address = none) :
+    OracleRel ectx ictx := by
+  intro address arity hconfigured
+  rw [hfree address] at hconfigured
+  simp at hconfigured
+
+end OracleRel
+
+omit scope in
+private theorem bindOk {ε α β : Type} (a : α) (f : α → Except ε β) :
+    (Except.ok a >>= f) = f a := rfl
+
+omit scope in
+private theorem bindErr {ε α β : Type} (er : ε) (f : α → Except ε β) :
+    ((Except.error er : Except ε α) >>= f) = Except.error er := rfl
+
+omit scope in
+private theorem bind_ok_iff {ε α β : Type} {x : Except ε α}
+    {f : α → Except ε β} {b : β} :
+    (x >>= f) = .ok b ↔ ∃ a, x = .ok a ∧ f a = .ok b := by
+  cases x with
+  | error e => simp [bindErr]
+  | ok a => simp [bindOk]
+
+/-! ## List and resolution helpers -/
+
+omit scope in
+private theorem arrGet?_toList {α} (a : Array α) (i : Nat) :
+    a.toList[i]? = a[i]? := by
+  simp
+
+omit scope in
+private theorem drop_append_of_le {α} :
+    ∀ (l₁ l₂ : List α) (n : Nat), n ≤ l₁.length →
+    (l₁ ++ l₂).drop n = l₁.drop n ++ l₂ := by
+  intro l₁
+  induction l₁ with
+  | nil =>
+    intro l₂ n h
+    simp at h
+    subst h
+    simp
+  | cons x rest ih =>
+    intro l₂ n h
+    cases n with
+    | zero => simp
+    | succ k =>
+      simp only [List.cons_append, List.drop_succ_cons]
+      exact ih l₂ k (by simpa using h)
+
+omit scope in
+private theorem peelChain_succ {n : Nat} {e B : Ixon.Expr}
+    (h : peelChain (n + 1) e = some B) :
+    ∃ u d b, e = .lam u d b ∧ peelChain n b = some B := by
+  cases e <;> first
+    | exact ⟨_, _, _, rfl, h⟩
+    | (rw [peelChain.eq_def] at h; simp at h)
+
+omit scope in
+private theorem resolveMut_ok {ectx : Ixon.Eval.EvalCtx}
+    {b : Ixon.Address} {i : Nat} {bc : Constant} {m : MutConst}
+    (h : Ixon.Eval.resolveMut ectx b i = .ok (bc, m)) :
+    ectx.resolve b = some bc ∧
+      (Ixon.selfMutsOf bc.info)[i]? = some m := by
+  rw [Ixon.Eval.resolveMut.eq_def] at h
+  split at h
+  · simp at h
+  · rename_i bc' hres
+    split at h
+    · rename_i m' hm
+      injection h with h'
+      injection h' with hbc hm'
+      subst hbc
+      subst hm'
+      exact ⟨hres, hm⟩
+    · simp at h
+
+/-- A successful guarded constructor major has the recursor's parameter
+layout. Runtime block agreement plus `RecMember`'s finite block witness replace
+the source typing fact that is not yet exposed in this repository. -/
+private theorem recMember_ctor_params {ectx : Ixon.Eval.EvalCtx}
+    {ictx : IxIR0.Ctx} {block ctorBlock : Ixon.Address} {idx : Nat}
+    {r : Recursor} {indIdx cidx params fields : Nat}
+    {cargs : List Ixon.Eval.Value} {checked : Unit}
+    (hmem : RecMember ectx ictx block idx r)
+    (hguard : Ixon.Eval.guardRecMajor (some block) r.params.toNat
+      (.ctorV ctorBlock indIdx cidx cargs) = .ok checked)
+    (hshape : CtorShape ectx ctorBlock indIdx cidx params fields) :
+    params = r.params.toNat := by
+  have hblock : ctorBlock = block := by
+    simp only [Ixon.Eval.guardRecMajor] at hguard
+    split at hguard
+    · rename_i heq
+      exact Ixon.Address.eq_of_beq heq
+    · simp at hguard
+  subst ctorBlock
+  obtain ⟨bcCtor, ind, ct, hrm, hct, hip, hcp, hcf⟩ := hshape
+  cases hmem with
+  | mk hres hparams hienv hrules =>
+    rename_i bcRec trules
+    have hbc : bcCtor = bcRec := by
+      have hc := (resolveMut_ok hrm).1
+      have hr := (resolveMut_ok hres).1
+      rw [hr] at hc
+      injection hc with hbc
+      exact hbc.symm
+    subst bcCtor
+    have hget : (Ixon.selfMutsOf bcRec.info).toList[indIdx]? =
+        some (.indc ind) := by
+      rw [arrGet?_toList]
+      exact (resolveMut_ok hrm).2
+    have hip' := hparams.lookup_indc hget
+    exact hip.symm.trans hip'
+
+/-! ## Relation lemmas -/
+
+section Lemmas
+
+variable {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+  {sc : Option (Ixon.Address × Nat)} {refs : Array Ixon.Address}
+  {muts : Array MutConst} {sa : Option Ixon.Address}
+
+private theorem envRel_lookup : ∀ (i : Nat) {mask : List Bool}
+    {env : List Ixon.Eval.Value} {ρ : List IxIR0.Value},
+    EnvRel ectx ictx sc refs muts sa mask env ρ →
+    ∀ (v : Ixon.Eval.Value), mask[i]? = some true →
+      env[i]? = some v →
+      ∃ v', ρ[i]? = some v' ∧ ValRel ectx ictx v v' := by
+  intro i
+  induction i with
+  | zero =>
+    intro mask env ρ h v hm he
+    cases h with
+    | nil => simp at hm
+    | selfB _ _ _ _ => simp at hm
+    | keep hv henv =>
+      simp only [List.getElem?_cons_zero] at he ⊢
+      injection he with he'
+      subst he'
+      exact ⟨_, rfl, hv⟩
+    | drop henv => simp at hm
+  | succ j ihj =>
+    intro mask env ρ h v hm he
+    cases h with
+    | nil => simp at hm
+    | selfB _ _ _ _ => simp at hm
+    | keep hv henv =>
+      simp only [List.getElem?_cons_succ] at hm he ⊢
+      exact ihj henv v hm he
+    | drop henv =>
+      simp only [List.getElem?_cons_succ] at hm he ⊢
+      exact ihj henv v hm he
+
+private theorem envRel_self : ∀ {mask : List Bool}
+    {env : List Ixon.Eval.Value} {ρ : List IxIR0.Value}
+    {block : Ixon.Address} {idx : Nat},
+    EnvRel ectx ictx (some (block, idx)) refs muts sa mask env ρ →
+    ∃ r bc, ectx.resolve block = some bc ∧ refs = bc.refs ∧
+      muts = Ixon.selfMutsOf bc.info ∧ sa = some block ∧
+      RecMember ectx ictx block idx r ∧
+      ρ[mask.length]? = some (.pap (.rec_ (Erase.memberAddr block idx)
+        (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) []) := by
+  intro mask
+  induction mask with
+  | nil =>
+    intro env ρ block idx henv
+    cases henv with
+    | selfB hres hrefs hmuts hmem =>
+      exact ⟨_, _, hres, hrefs, hmuts, rfl, hmem, rfl⟩
+  | cons b mrest ih =>
+    intro env ρ block idx henv
+    cases henv with
+    | keep hv henv' =>
+      obtain ⟨r, bc, hres, hrefs, hmuts, hsa, hmem, hslot⟩ := ih henv'
+      exact ⟨r, bc, hres, hrefs, hmuts, hsa, hmem, by simpa using hslot⟩
+    | drop henv' =>
+      obtain ⟨r, bc, hres, hrefs, hmuts, hsa, hmem, hslot⟩ := ih henv'
+      exact ⟨r, bc, hres, hrefs, hmuts, hsa, hmem, by simpa using hslot⟩
+
+private theorem valsRel_length : ∀ {vs : List Ixon.Eval.Value}
+    {vs' : List IxIR0.Value}, ValsRel ectx ictx vs vs' →
+    vs.length = vs'.length := by
+  intro vs
+  induction vs with
+  | nil => intro vs' h; cases h; rfl
+  | cons v rest ih =>
+    intro vs' h
+    cases h with
+    | cons hv hrest => simp [ih hrest]
+
+/-- A configured external head either remains a related partial application
+or, at exact saturation, crosses the trusted oracle ledger. -/
+private theorem externSaturate_sim
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {address : Ixon.Address} {arity sourceFuel : Nat}
+    {sourceArgs : List Ixon.Eval.Value} {targetArgs : List IxIR0.Value}
+    {sourceValue : Ixon.Eval.Value}
+    (horacles : OracleRel ectx ictx)
+    (hconfigured : ectx.externArity address = some arity)
+    (hle : sourceArgs.length ≤ arity)
+    (hargs : ValsRel ectx ictx sourceArgs targetArgs)
+    (hsource : Ixon.Eval.saturate ectx sourceFuel
+      (.extH address arity) sourceArgs = .ok sourceValue) :
+    ∃ targetFuel targetValue,
+      IxIR0.saturate ictx targetFuel (.ext address arity) targetArgs =
+          .ok targetValue ∧
+        ValRel ectx ictx sourceValue targetValue ∧
+        IxIR0.ProjectionSafe.Saturate ictx targetFuel
+          (.ext address arity) targetArgs targetValue := by
+  have hlength := valsRel_length hargs
+  cases sourceFuel with
+  | zero =>
+    rw [Ixon.Eval.saturate.eq_def] at hsource
+    simp at hsource
+  | succ fuel =>
+    rw [Ixon.Eval.saturate.eq_def] at hsource
+    dsimp only at hsource
+    simp only [Ixon.Eval.Head.arity?] at hsource
+    cases hfull : sourceArgs.length == arity with
+    | false =>
+      rw [hfull] at hsource
+      injection hsource with hvalue
+      subst hvalue
+      have hne : sourceArgs.length ≠ arity := by
+        intro heq
+        subst heq
+        simp at hfull
+      have hlt : sourceArgs.length < arity := by omega
+      have htne : targetArgs.length ≠ arity := by omega
+      refine ⟨1, .pap (.ext address arity) targetArgs, ?_,
+        .papExtern hconfigured hlt hargs, .pending ?_⟩
+      · rw [IxIR0.saturate.eq_def]
+        dsimp only
+        simp [IxIR0.Head.arity, htne]
+      · simpa [IxIR0.Head.arity] using htne
+    | true =>
+      rw [hfull] at hsource
+      have hsourceLength : sourceArgs.length = arity :=
+        beq_iff_eq.mp hfull
+      have htargetLength : targetArgs.length = arity := by omega
+      cases fuel with
+      | zero =>
+        rw [Ixon.Eval.fire.eq_def] at hsource
+        simp at hsource
+      | succ fireFuel =>
+        rw [Ixon.Eval.fire.eq_def] at hsource
+        dsimp only at hsource
+        cases hsourceOracle : ectx.oracle address sourceArgs with
+        | none =>
+          rw [hsourceOracle] at hsource
+          contradiction
+        | some oracleValue =>
+          rw [hsourceOracle] at hsource
+          injection hsource with hvalue
+          subst hvalue
+          obtain ⟨targetValue, htargetOracle, hvalueRel⟩ :=
+            horacles address arity hconfigured sourceArgs targetArgs
+              oracleValue hsourceLength hargs hsourceOracle
+          refine ⟨2, targetValue, ?_, hvalueRel,
+            .full htargetLength (.extern htargetOracle)⟩
+          rw [IxIR0.saturate.eq_def]
+          dsimp only
+          simp only [IxIR0.Head.arity, beq_iff_eq.mpr htargetLength,
+            if_true]
+          rw [IxIR0.fire.eq_def]
+          dsimp only
+          rw [htargetOracle]
+
+private theorem trueListRel_of_valsRel : ∀
+    {vs : List Ixon.Eval.Value} {vs' : List IxIR0.Value},
+    ValsRel ectx ictx vs vs' → ListRel (fun _ _ => True) vs vs' := by
+  intro vs
+  induction vs with
+  | nil =>
+    intro vs' h
+    cases h
+    exact .nil
+  | cons v rest ih =>
+    intro vs' h
+    cases h with
+    | cons hv hrest => exact .cons trivial (ih hrest)
+
+private theorem valsRel_append : ∀ {vs : List Ixon.Eval.Value}
+    {vs' : List IxIR0.Value} {v v'},
+    ValsRel ectx ictx vs vs' → ValRel ectx ictx v v' →
+    ValsRel ectx ictx (vs ++ [v]) (vs' ++ [v']) := by
+  intro vs
+  induction vs with
+  | nil =>
+    intro vs' v v' h hv
+    cases h
+    exact .cons hv .nil
+  | cons w rest ih =>
+    intro vs' v v' h hv
+    cases h with
+    | cons hw hrest => exact .cons hw (ih hrest hv)
+
+private theorem valsRel_lookup : ∀ (i : Nat) {vs : List Ixon.Eval.Value}
+    {vs' : List IxIR0.Value}, ValsRel ectx ictx vs vs' →
+    ∀ v, vs[i]? = some v →
+    ∃ v', vs'[i]? = some v' ∧ ValRel ectx ictx v v' := by
+  intro i
+  induction i with
+  | zero =>
+    intro vs vs' h v he
+    cases h with
+    | nil => simp at he
+    | cons hv hrest =>
+      simp only [List.getElem?_cons_zero] at he ⊢
+      injection he with he'
+      subst he'
+      exact ⟨_, rfl, hv⟩
+  | succ j ihj =>
+    intro vs vs' h v he
+    cases h with
+    | nil => simp at he
+    | cons hv hrest =>
+      simp only [List.getElem?_cons_succ] at he ⊢
+      exact ihj hrest v he
+
+private theorem quotientRep_valRel {source : Ixon.Eval.Value}
+    {target : IxIR0.Value} {representative : Ixon.Eval.Value}
+    (hrel : ValRel ectx ictx source target)
+    (hrep : Ixon.Eval.quotientRep? source = some representative) :
+    ValRel ectx ictx representative target := by
+  cases hrel with
+  | quotV hrepresentative =>
+    simp only [Ixon.Eval.quotientRep?] at hrep
+    cases hrep
+    exact hrepresentative
+  | sort | pi | clos | litNat | litStr | quotType | papQuot | papExtern |
+      ctorV | papCtor | papCtorParams | papRec | papRecI | papRecIW |
+      inductiveType | inductiveMember =>
+    simp [Ixon.Eval.quotientRep?] at hrep
+
+private theorem envRel_keepRev : ∀ {vs : List Ixon.Eval.Value}
+    {vs' : List IxIR0.Value} {mask : List Bool}
+    {env : List Ixon.Eval.Value} {ρ : List IxIR0.Value},
+    ValsRel ectx ictx vs vs' →
+    EnvRel ectx ictx sc refs muts sa mask env ρ →
+    EnvRel ectx ictx sc refs muts sa
+      (List.replicate vs.length true ++ mask)
+      (vs.reverse ++ env) (vs'.reverse ++ ρ) := by
+  intro vs
+  induction vs with
+  | nil =>
+    intro vs' mask env ρ hv henv
+    cases hv
+    simpa using henv
+  | cons v rest ih =>
+    intro vs' mask env ρ hv henv
+    cases hv with
+    | cons hv1 hrest =>
+      have h := ih hrest (.keep hv1 henv)
+      simpa [List.replicate_succ', List.append_assoc] using h
+
+private theorem envRel_dropAny : ∀ (n : Nat) {xs : List Ixon.Eval.Value}
+    {ys : List IxIR0.Value} {mask : List Bool}
+    {env : List Ixon.Eval.Value} {ρ : List IxIR0.Value},
+    xs.length = n → ys.length = n →
+    EnvRel ectx ictx sc refs muts sa mask env ρ →
+    EnvRel ectx ictx sc refs muts sa
+      (List.replicate n false ++ mask) (xs ++ env) (ys ++ ρ) := by
+  intro n
+  induction n with
+  | zero =>
+    intro xs ys mask env ρ hx hy henv
+    cases xs with
+    | nil =>
+      cases ys with
+      | nil => simpa using henv
+      | cons _ _ => simp at hy
+    | cons _ _ => simp at hx
+  | succ k ih
+  =>
+    intro xs ys mask env ρ hx hy henv
+    cases xs with
+    | nil => simp at hx
+    | cons x xrest =>
+      cases ys with
+      | nil => simp at hy
+      | cons y yrest =>
+        simp only [List.length_cons, Nat.succ.injEq] at hx hy
+        simp only [List.replicate_succ, List.cons_append]
+        exact .drop (ih hx hy henv)
+
+/-- Turn a fully consumed keep/ghost runtime cursor into the reversed rule
+environment relation, extending an existing recSelf base. -/
+private theorem envRel_runtimePolicyRev :
+    ∀ {policies : List Erase.ArgPolicy}
+      {sargs : List Ixon.Eval.Value} {targs : List IxIR0.Value},
+      SlotPolicies policies →
+      RuntimePolicyRel (ValRel ectx ictx) policies sargs targs →
+      ∀ {mask : List Bool} {env : List Ixon.Eval.Value}
+        {ρ : List IxIR0.Value},
+        EnvRel ectx ictx sc refs muts sa mask env ρ →
+        EnvRel ectx ictx sc refs muts sa
+          ((policies.map policyKept).reverse ++ mask)
+          (sargs.reverse ++ env) (targs.reverse ++ ρ) := by
+  intro policies sargs targs hslots hcursor mask env ρ henv
+  induction hslots generalizing sargs targs mask env ρ with
+  | nil =>
+    cases hcursor
+    simpa using henv
+  | keep hslots ih =>
+    cases hcursor with
+    | keep hrel htail =>
+      have hout := ih htail (.keep hrel henv)
+      simpa [List.reverse_cons, List.append_assoc, policyKept] using hout
+  | ghost hslots ih =>
+    cases hcursor with
+    | ghost htail =>
+      rename_i sarg targ
+      have hout := ih htail
+        (.drop (v := sarg) (v' := targ) henv)
+      simpa [List.reverse_cons, List.append_assoc, policyKept] using hout
+
+private theorem rulesRel_lookup {block : Ixon.Address} {idx : Nat}
+    {r : Recursor} : ∀ (i : Nat) {rules : List RecursorRule}
+    {trules : List IxIR0.RecRule},
+    RulesRel ectx ictx block idx r refs muts rules trules →
+    ∀ {rule}, rules[i]? = some rule →
+    ∃ trule B, trules[i]? = some trule ∧
+      trule.fields = rule.fields.toNat ∧
+      peelChain (r.params.toNat + r.motives.toNat + r.minors.toNat +
+        rule.fields.toNat)
+        rule.rhs = some B ∧
+      PErase ectx ictx (some (block, idx)) refs muts (some block)
+        (recRuleMask r rule.fields.toNat)
+        B trule.rhs := by
+  intro i
+  induction i with
+  | zero =>
+    intro rules trules h rule hr
+    cases h with
+    | nil => simp at hr
+    | cons hf hpeel hpe hrest =>
+      simp only [List.getElem?_cons_zero] at hr ⊢
+      injection hr with hr'
+      subst hr'
+      exact ⟨_, _, rfl, hf, hpeel, hpe⟩
+  | succ j ihj =>
+    intro rules trules h rule hr
+    cases h with
+    | nil => simp at hr
+    | cons _ _ _ hrest =>
+      simp only [List.getElem?_cons_succ] at hr ⊢
+      exact ihj hrest hr
+
+end Lemmas
+
+/-! ## Evaluation-shape lemmas -/
+
+omit scope in
+private theorem ctorParamSpine_shape {ectx : Ixon.Eval.EvalCtx}
+    {refs : Array Ixon.Address} {e : Ixon.Expr} {a block : Ixon.Address}
+    {indIdx cidx params fields consumed : Nat}
+    (h : CtorParamSpine ectx refs e a block indIdx cidx params fields consumed) :
+    CtorShape ectx block indIdx cidx params fields := by
+  induction h with
+  | head _ _ _ hshape => exact hshape
+  | step _ _ ih => exact ih
+
+omit scope in
+private theorem ctorParamSpine_addr {ectx : Ixon.Eval.EvalCtx}
+    {refs : Array Ixon.Address} {e : Ixon.Expr} {a block : Ixon.Address}
+    {indIdx cidx params fields consumed : Nat}
+    (h : CtorParamSpine ectx refs e a block indIdx cidx params fields consumed) :
+    CtorAddr ectx a block indIdx cidx := by
+  induction h with
+  | head _ hres hinfo _ => exact ⟨_, _, hres, hinfo, rfl, rfl, rfl⟩
+  | step _ _ ih => exact ih
+
+omit scope in
+private theorem recPrefix_shape {ectx refs muts sa} {e : Ixon.Expr}
+    {r : Recursor} (h : RecPrefix ectx refs muts sa e r) :
+    r.indices.toNat = 0 := by
+  cases h with
+  | refH _ _ _ _ hi => exact hi
+  | recurH _ _ hi => exact hi
+
+omit scope in
+private theorem recSpine_shape {ectx refs muts sa} :
+    ∀ {e : Ixon.Expr} {r : Recursor} {j : Nat},
+    RecSpine ectx refs muts sa e r j →
+    r.indices.toNat = 0 := by
+  intro e r j h
+  induction h with
+  | head hp => exact recPrefix_shape hp
+  | step _ _ ih => exact ih
+
+omit scope in
+/-- Evaluating a recursor-spine prefix yields the recursor's pap with
+exactly the prefix's argument count. -/
+private theorem recSpine_eval {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} :
+    ∀ {e : Ixon.Expr} {r : Recursor} {j : Nat},
+    RecSpine ectx F.refs F.selfMuts F.selfAddr e r j →
+    ∀ {fuel : Nat} {env : List Ixon.Eval.Value} {fv : Ixon.Eval.Value},
+    Ixon.Eval.eval ectx fuel F env e = .ok fv →
+    ∃ ob F' sargs, fv = .papV (.recH ob r F') sargs ∧ sargs.length = j := by
+  intro e r j h
+  induction h with
+  | head hp =>
+    cases hp with
+    | refH href hres hinfo hrm hi0 =>
+      intro fuel env fv hev
+      cases fuel with
+      | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+      | succ g =>
+        rw [Ixon.Eval.eval.eq_def] at hev
+        dsimp only at hev
+        rw [href] at hev
+        dsimp only at hev
+        rw [bind_ok_iff] at hev
+        obtain ⟨uinst', _, hev⟩ := hev
+        cases g with
+        | zero => rw [Ixon.Eval.evalRef.eq_def] at hev; simp at hev
+        | succ g' =>
+          rw [Ixon.Eval.evalRef.eq_def] at hev
+          dsimp only at hev
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [hrm] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          injection hev with hv
+          exact ⟨_, _, _, hv.symm, rfl⟩
+    | recurH hsa hlook hi0 =>
+      intro fuel env fv hev
+      cases fuel with
+      | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+      | succ g =>
+        rw [Ixon.Eval.eval.eq_def] at hev
+        dsimp only at hev
+        rw [bind_ok_iff] at hev
+        obtain ⟨uinst', _, hev⟩ := hev
+        rw [hlook] at hev
+        dsimp only at hev
+        rw [bind_ok_iff] at hev
+        obtain ⟨_, _, hev⟩ := hev
+        injection hev with hv
+        exact ⟨_, _, _, hv.symm, rfl⟩
+  | step hpre hj ih =>
+    rename_i f a r' j'
+    intro fuel env fv hev
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hf : Ixon.Eval.eval ectx g F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv₁ =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx g F env a with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨ob, F', sargs, hfv₁, hlen⟩ := ih hf
+          subst hfv₁
+          have hi0 := recSpine_shape hpre
+          have hj' := hj
+          rw [recRulePolicy_length] at hj'
+          cases g with
+          | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+          | succ g₂ =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases g₂ with
+            | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+            | succ g₃ =>
+              rw [Ixon.Eval.saturate.eq_def] at hev
+              simp only [Ixon.Eval.Head.arity?] at hev
+              have hne : ((sargs ++ [av]).length ==
+                  Ixon.Eval.recArity r') = false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil, Ixon.Eval.recArity, hi0, Nat.add_zero,
+                  hlen]
+                omega
+              rw [hne] at hev
+              simp at hev
+              refine ⟨ob, F', sargs ++ [av], hev.symm, ?_⟩
+              simp [hlen]
+
+omit scope in
+/-- Evaluating a visible ordinary-definition spine whose residual body is a
+lambda yields exactly that residual closure.  The lemma follows the source
+implementation telescope, independently of the declaration-type policy used
+by executable erasure. -/
+private theorem defSpine_eval_clos {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} :
+    ∀ {function residual : Ixon.Expr},
+      DefSpine ectx F.refs function residual →
+      ∀ {uses : Uses} {domain body : Ixon.Expr},
+      residual = .lam uses domain body →
+      ∀ {fuel : Nat} {env : List Ixon.Eval.Value}
+        {value : Ixon.Eval.Value},
+        Ixon.Eval.eval ectx fuel F env function = .ok value →
+        ∃ closureFrame closureEnv,
+          value = .closV uses closureFrame closureEnv domain body := by
+  intro function residual hspine
+  induction hspine with
+  | head href hresolve hinfo hunfold =>
+    intro uses domain body hresidual fuel env value heval
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at heval; simp at heval
+    | succ refFuel =>
+      rw [Ixon.Eval.eval.eq_def] at heval
+      dsimp only at heval
+      rw [href] at heval
+      dsimp only at heval
+      rw [bind_ok_iff] at heval
+      obtain ⟨uinst, _, heval⟩ := heval
+      cases refFuel with
+      | zero => rw [Ixon.Eval.evalRef.eq_def] at heval; simp at heval
+      | succ bodyFuel =>
+        rw [Ixon.Eval.evalRef.eq_def] at heval
+        dsimp only at heval
+        rw [hresolve] at heval
+        dsimp only at heval
+        rw [hinfo] at heval
+        dsimp only at heval
+        rw [bind_ok_iff] at heval
+        obtain ⟨_, _, heval⟩ := heval
+        rw [hunfold] at heval
+        simp only [if_true] at heval
+        rw [hresidual] at heval
+        cases bodyFuel with
+        | zero => rw [Ixon.Eval.eval.eq_def] at heval; simp at heval
+        | succ bodyFuel =>
+          rw [Ixon.Eval.eval.eq_def] at heval
+          dsimp only at heval
+          injection heval with hvalue
+          exact ⟨_, [], hvalue.symm⟩
+  | step hprefix ih =>
+    rename_i functionPrefix sourceArgument previousUses previousDomain
+      previousBody
+    intro uses domain body hresidual fuel env value heval
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at heval; simp at heval
+    | succ applyFuel =>
+      rw [Ixon.Eval.eval.eq_def] at heval
+      dsimp only at heval
+      cases hfunction : Ixon.Eval.eval ectx applyFuel F env functionPrefix with
+      | error error => rw [hfunction, bindErr] at heval; simp at heval
+      | ok functionValue =>
+        rw [hfunction, bindOk] at heval
+        cases hargument : Ixon.Eval.eval ectx applyFuel F env sourceArgument with
+        | error error => rw [hargument, bindErr] at heval; simp at heval
+        | ok argumentValue =>
+          rw [hargument, bindOk] at heval
+          obtain ⟨closureFrame, closureEnv, hvalue⟩ := ih rfl hfunction
+          subst functionValue
+          cases applyFuel with
+          | zero => rw [Ixon.Eval.apply.eq_def] at heval; simp at heval
+          | succ bodyFuel =>
+            rw [Ixon.Eval.apply.eq_def] at heval
+            dsimp only at heval
+            rw [hresidual] at heval
+            cases bodyFuel with
+            | zero => rw [Ixon.Eval.eval.eq_def] at heval; simp at heval
+            | succ bodyFuel =>
+              rw [Ixon.Eval.eval.eq_def] at heval
+              dsimp only at heval
+              injection heval with hresult
+              exact ⟨closureFrame, argumentValue :: closureEnv,
+                hresult.symm⟩
+
+omit scope in
+/-- Before all constructor parameters have been consumed, a visible
+constructor spine evaluates to a source pap with exactly the consumed
+parameter values. -/
+private theorem ctorParamSpine_eval_lt {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} :
+    ∀ {e : Ixon.Expr} {a block : Ixon.Address}
+      {indIdx cidx params fields consumed : Nat},
+      CtorParamSpine ectx F.refs e a block indIdx cidx params fields consumed →
+      consumed < params →
+      ∀ {fuel : Nat} {env : List Ixon.Eval.Value}
+        {fv : Ixon.Eval.Value},
+        Ixon.Eval.eval ectx fuel F env e = .ok fv →
+        ∃ sargs, sargs.length = consumed ∧
+          fv = .papV (.ctorH block indIdx cidx (params + fields)) sargs := by
+  intro e a block indIdx cidx params fields consumed h
+  induction h with
+  | head href hres hinfo hshape =>
+    intro hlt fuel env fv hev
+    obtain ⟨bc, ind, ct, hrm, hct, hip, hcp, hcf⟩ := hshape
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [href] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      cases g with
+      | zero => rw [Ixon.Eval.evalRef.eq_def] at hev; simp at hev
+      | succ g' =>
+        rw [Ixon.Eval.evalRef.eq_def] at hev
+        dsimp only at hev
+        rw [hres] at hev
+        dsimp only at hev
+        rw [hinfo] at hev
+        dsimp only at hev
+        rw [hrm] at hev
+        dsimp only at hev
+        rw [hct] at hev
+        dsimp only at hev
+        rw [bind_ok_iff] at hev
+        obtain ⟨_, _, hev⟩ := hev
+        cases g' with
+        | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+        | succ g'' =>
+          rw [Ixon.Eval.saturate.eq_def] at hev
+          simp only [Ixon.Eval.Head.arity?] at hev
+          have hctpos : 0 < ct.params.toNat := by omega
+          have hne : ((([] : List Ixon.Eval.Value).length ==
+              ct.params.toNat + ct.fields.toNat) : Bool) = false := by
+            rw [beq_eq_false_iff_ne]
+            simp only [List.length_nil]
+            omega
+          rw [hne] at hev
+          simp at hev
+          exact ⟨[], rfl, by simpa [hcp, hcf] using hev.symm⟩
+  | step hpre hj ih =>
+    rename_i f arg a block indIdx cidx params fields consumed
+    intro hlt fuel env fv hev
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hf : Ixon.Eval.eval ectx g F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv₁ =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx g F env arg with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨sargs, hlen, hfv₁⟩ := ih hj hf
+          subst fv₁
+          cases g with
+          | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+          | succ g' =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases g' with
+            | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+            | succ g'' =>
+              rw [Ixon.Eval.saturate.eq_def] at hev
+              simp only [Ixon.Eval.Head.arity?] at hev
+              have hne : ((sargs ++ [av]).length == params + fields) =
+                  false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil]
+                omega
+              rw [hne] at hev
+              simp at hev
+              subst hev
+              exact ⟨sargs ++ [av], by simp [hlen], rfl⟩
+
+omit scope in
+/-- After the entire dropped parameter prefix, source and target constructor
+heads have synchronized runtime arities: a nullary target constructor has
+fired, while a constructor with fields is an unapplied target pap. -/
+private theorem ctorParamSpine_eval_full {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} {e : Ixon.Expr} {a block : Ixon.Address}
+    {indIdx cidx params fields : Nat}
+    (hpos : 0 < params)
+    (h : CtorParamSpine ectx F.refs e a block indIdx cidx params fields params)
+    {fuel : Nat} {env : List Ixon.Eval.Value} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v) :
+    ∃ sargs, sargs.length = params ∧
+      ((fields = 0 ∧ v = .ctorV block indIdx cidx sargs) ∨
+       (0 < fields ∧
+        v = .papV (.ctorH block indIdx cidx (params + fields)) sargs)) := by
+  cases h with
+  | head href hres hinfo hshape => omega
+  | step hpre hj =>
+    rename_i f arg consumed
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hf : Ixon.Eval.eval ectx g F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx g F env arg with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨sargs, hlen, hfv⟩ := ctorParamSpine_eval_lt hpre hj hf
+          subst fv
+          cases g with
+          | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+          | succ g' =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases g' with
+            | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+            | succ g'' =>
+              rw [Ixon.Eval.saturate.eq_def] at hev
+              simp only [Ixon.Eval.Head.arity?] at hev
+              cases fields with
+              | zero =>
+                have heq : ((sargs ++ [av]).length ==
+                    (consumed + 1) + 0) = true := by
+                  rw [beq_iff_eq]
+                  simp only [List.length_append, List.length_cons,
+                    List.length_nil]
+                  omega
+                rw [heq] at hev
+                simp at hev
+                cases g'' with
+                | zero => rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+                | succ g''' =>
+                  rw [Ixon.Eval.fire.eq_def] at hev
+                  dsimp only at hev
+                  injection hev with hv
+                  subst hv
+                  exact ⟨sargs ++ [av], by simp [hlen], .inl ⟨rfl, rfl⟩⟩
+              | succ fields' =>
+                have hne : ((sargs ++ [av]).length ==
+                    (consumed + 1) + (fields' + 1)) = false := by
+                  rw [beq_eq_false_iff_ne]
+                  simp only [List.length_append, List.length_cons,
+                    List.length_nil]
+                  omega
+                rw [hne] at hev
+                simp at hev
+                subst hev
+                exact ⟨sargs ++ [av], by simp [hlen],
+                  .inr ⟨by omega, rfl⟩⟩
+
+omit scope in
+/-- Entering a kernel-shaped lambda telescope: applying the chain's
+closure to all its arguments ends in evaluating the peeled body under
+the reversed arguments. -/
+private theorem applyMany_chain {ectx : Ixon.Eval.EvalCtx} :
+    ∀ (rest : List Ixon.Eval.Value) {a : Ixon.Eval.Value} {fuel : Nat}
+    {F : Ixon.Eval.Frame} {envAcc : List Ixon.Eval.Value} {u : Uses}
+    {dom body B : Ixon.Expr} {v : Ixon.Eval.Value},
+    peelChain rest.length body = some B →
+    Ixon.Eval.applyMany ectx fuel (.closV u F envAcc dom body)
+      (a :: rest) = .ok v →
+    ∃ g, g ≤ fuel ∧
+      Ixon.Eval.eval ectx g F (rest.reverse ++ a :: envAcc) B = .ok v := by
+  intro rest
+  induction rest with
+  | nil =>
+    intro a fuel F envAcc u dom body B v hpeel happ
+    injection hpeel with hB
+    subst hB
+    cases fuel with
+    | zero => rw [Ixon.Eval.applyMany.eq_def] at happ; simp at happ
+    | succ fu =>
+      rw [Ixon.Eval.applyMany.eq_def] at happ
+      dsimp only at happ
+      rw [bind_ok_iff] at happ
+      obtain ⟨f', happly, hrest⟩ := happ
+      cases fu with
+      | zero => rw [Ixon.Eval.apply.eq_def] at happly; simp at happly
+      | succ fu₂ =>
+        rw [Ixon.Eval.applyMany.eq_def] at hrest
+        dsimp only at hrest
+        injection hrest with hv
+        subst hv
+        rw [Ixon.Eval.apply.eq_def] at happly
+        dsimp only at happly
+        exact ⟨fu₂, by omega, happly⟩
+  | cons b rest' ihr =>
+    intro a fuel F envAcc u dom body B v hpeel happ
+    obtain ⟨u', d', b₂, hbody, hpeel'⟩ := peelChain_succ hpeel
+    subst hbody
+    cases fuel with
+    | zero => rw [Ixon.Eval.applyMany.eq_def] at happ; simp at happ
+    | succ fu =>
+      rw [Ixon.Eval.applyMany.eq_def] at happ
+      dsimp only at happ
+      rw [bind_ok_iff] at happ
+      obtain ⟨f', happly, hrest⟩ := happ
+      cases fu with
+      | zero => rw [Ixon.Eval.apply.eq_def] at happly; simp at happly
+      | succ fu₂ =>
+        rw [Ixon.Eval.apply.eq_def] at happly
+        dsimp only at happly
+        cases fu₂ with
+        | zero => rw [Ixon.Eval.eval.eq_def] at happly; simp at happly
+        | succ fu₃ =>
+          rw [Ixon.Eval.eval.eq_def] at happly
+          dsimp only at happly
+          injection happly with hf'
+          subst hf'
+          obtain ⟨g, hg, hev⟩ := ihr hpeel' hrest
+          refine ⟨g, by omega, ?_⟩
+          simpa [List.append_assoc] using hev
+
+omit scope in
+/-- Chain entry from the rule's closed rhs: evaluate the chain (a
+closure), apply all arguments, land in the body. -/
+private theorem chain_enter {ectx : Ixon.Eval.EvalCtx} :
+    ∀ (args : List Ixon.Eval.Value) {fuel : Nat} {F : Ixon.Eval.Frame}
+    {chain B : Ixon.Expr} {rhsV v : Ixon.Eval.Value},
+    peelChain args.length chain = some B →
+    Ixon.Eval.eval ectx fuel F [] chain = .ok rhsV →
+    Ixon.Eval.applyMany ectx fuel rhsV args = .ok v →
+    ∃ g, g ≤ fuel ∧ Ixon.Eval.eval ectx g F args.reverse B = .ok v := by
+  intro args
+  cases args with
+  | nil =>
+    intro fuel F chain B rhsV v hpeel hchain happ
+    injection hpeel with hB
+    subst hB
+    cases fuel with
+    | zero => rw [Ixon.Eval.applyMany.eq_def] at happ; simp at happ
+    | succ fu =>
+      rw [Ixon.Eval.applyMany.eq_def] at happ
+      dsimp only at happ
+      injection happ with hv
+      subst hv
+      exact ⟨fu + 1, by omega, hchain⟩
+  | cons a rest =>
+    intro fuel F chain B rhsV v hpeel hchain happ
+    obtain ⟨u, d, b, hchainEq, hpeel'⟩ := peelChain_succ hpeel
+    subst hchainEq
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hchain; simp at hchain
+    | succ fu =>
+      rw [Ixon.Eval.eval.eq_def] at hchain
+      dsimp only at hchain
+      injection hchain with hrhsV
+      subst hrhsV
+      obtain ⟨g, hg, hev⟩ := applyMany_chain rest hpeel' happ
+      refine ⟨g, by omega, ?_⟩
+      simpa using hev
+
+omit scope in
+private theorem strongNat {P : Nat → Prop}
+    (step : ∀ n, (∀ m, m < n → P m) → P n) : ∀ n, P n := by
+  have aux : ∀ k n, n < k → P n := by
+    intro k
+    induction k with
+    | zero => intro n hn; exact absurd hn (Nat.not_lt_zero n)
+    | succ k ihk =>
+      intro n hn
+      exact step n fun m hm =>
+        ihk m (Nat.lt_of_lt_of_le hm (Nat.lt_succ_iff.mp hn))
+  exact fun n => aux (n + 1) n (Nat.lt_succ_self n)
+
+private def SimAt (fuel : Nat) : Prop :=
+  ∀ (ectx : Ixon.Eval.EvalCtx) (F : Ixon.Eval.Frame)
+    (env : List Ixon.Eval.Value) (e : Ixon.Expr) (v : Ixon.Eval.Value)
+    (sc : Option (Ixon.Address × Nat)) (mask : List Bool)
+    (ρ : List IxIR0.Value) (e' : IxIR0.Expr) (ictx : IxIR0.Ctx),
+    MemberCoverage ectx ictx scope.plan →
+    OracleRel ectx ictx →
+    Ixon.Eval.eval ectx fuel F env e = .ok v →
+    PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask e e' →
+    EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ →
+    ∃ fuel' v', IxIR0.eval ictx fuel' ρ e' = .ok v' ∧ ValRel ectx ictx v v'
+      ∧ IxIR0.ProjectionSafe.Eval ictx fuel' ρ e' v'
+
+/-- Reuse expression simulation as a value-application lemma.  Two kept
+variables expose the already related function and argument; the one extra
+evaluation layer is why callers supply the strict `fuel + 1 < bound` fact. -/
+private theorem applyRel_sim {bound : Nat}
+    (sim : ∀ m, m < bound → SimAt m)
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {fuel : Nat} {function argument result : Ixon.Eval.Value}
+    {targetFunction targetArgument : IxIR0.Value}
+    (hmembers : MemberCoverage ectx ictx scope.plan)
+    (horacles : OracleRel ectx ictx)
+    (hbound : fuel + 1 < bound)
+    (happly : Ixon.Eval.apply ectx fuel function argument = .ok result)
+    (hfunction : ValRel ectx ictx function targetFunction)
+    (hargument : ValRel ectx ictx argument targetArgument) :
+    ∃ targetFuel targetResult,
+      IxIR0.apply ictx targetFuel targetFunction targetArgument =
+          .ok targetResult ∧
+        ValRel ectx ictx result targetResult ∧
+        IxIR0.ProjectionSafe.Apply ictx targetFuel targetFunction
+          targetArgument targetResult := by
+  cases fuel with
+  | zero => rw [Ixon.Eval.apply.eq_def] at happly; simp at happly
+  | succ fuel =>
+    have hsource : Ixon.Eval.eval ectx (fuel + 2) {}
+        [function, argument] (.app (.var 0) (.var 1)) = .ok result := by
+      simpa [Ixon.Eval.eval, bindOk] using happly
+    have hpe : PErase ectx ictx none #[] #[] none [true, true]
+        (.app (.var 0) (.var 1)) (.app (.var 0) (.var 1)) :=
+      .app (.var rfl) (.var rfl)
+    have henv : EnvRel ectx ictx none #[] #[] none [true, true]
+        [function, argument] [targetFunction, targetArgument] :=
+      .keep hfunction (.keep hargument .nil)
+    obtain ⟨targetFuel, targetResult, htarget, hresult, htrace⟩ :=
+      sim (fuel + 2) (by omega) ectx {} [function, argument]
+        (.app (.var 0) (.var 1)) result none [true, true]
+        [targetFunction, targetArgument] (.app (.var 0) (.var 1)) ictx
+        hmembers horacles hsource hpe henv
+    cases htrace with
+    | app htargetFunction htargetArgument happlyTrace =>
+      cases htargetFunction with
+      | var hlookupFunction =>
+        simp only [List.getElem?_cons_zero] at hlookupFunction
+        cases hlookupFunction
+        cases htargetArgument with
+        | var hlookupArgument =>
+          simp only [List.getElem?_cons_succ,
+            List.getElem?_cons_zero] at hlookupArgument
+          cases hlookupArgument
+          exact ⟨_, _, happlyTrace.run, hresult, happlyTrace⟩
+
+/-- A visible indexed recursor spine simulates as one unit.  The result keeps
+the complete policy cursor local until every source-only index has been
+consumed, so no intermediate target pap is exposed to generic application. -/
+private theorem recEraseSpine_sim {bound : Nat}
+    (sim : ∀ m, m < bound → SimAt m)
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    (hmembers : MemberCoverage ectx ictx scope.plan)
+    (horacles : OracleRel ectx ictx)
+    {sc : Option (Ixon.Address × Nat)} {F : Ixon.Eval.Frame}
+    {mask : List Bool} :
+    ∀ {e : Ixon.Expr} {e' : IxIR0.Expr} {r : Recursor}
+      {rest : List Erase.ArgPolicy},
+      RecEraseSpine ectx ictx sc F.refs F.selfMuts F.selfAddr mask
+        e e' r rest →
+      ∀ {fuel : Nat} {env : List Ixon.Eval.Value}
+        {v : Ixon.Eval.Value} {ρ : List IxIR0.Value},
+        fuel ≤ bound →
+        Ixon.Eval.eval ectx fuel F env e = .ok v →
+        EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ →
+        ∃ fuel' block idx F₂ bc sargs targs,
+          v = .papV (.recH (some block) r F₂) sargs ∧
+          IxIR0.eval ictx fuel' ρ e' =
+            .ok (.pap (.rec_ (Erase.memberAddr block idx)
+              (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+              targs) ∧
+          IxIR0.ProjectionSafe.Eval ictx fuel' ρ e'
+            (.pap (.rec_ (Erase.memberAddr block idx)
+              (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+              targs) ∧
+          ectx.resolve block = some bc ∧
+          F₂.refs = bc.refs ∧
+          F₂.selfMuts = Ixon.selfMutsOf bc.info ∧
+          F₂.selfAddr = some block ∧
+          RecMember ectx ictx block idx r ∧
+          0 < r.indices.toNat ∧
+          RuntimePolicyPrefix (ValRel ectx ictx) (recPolicy r)
+            sargs targs rest := by
+  intro e e' r rest hspine fuel env v ρ hbound hev henv
+  induction fuel using strongNat generalizing e e' r rest v
+  rename_i fuel fuelIH
+  cases hspine with
+  | head href hres hinfo hrm hipos hidecl hmem =>
+    rename_i refIdx univIdxs a c p bc
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [href] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', huinst, hev⟩ := hev
+      cases g with
+      | zero => rw [Ixon.Eval.evalRef.eq_def] at hev; simp at hev
+      | succ g' =>
+        rw [Ixon.Eval.evalRef.eq_def] at hev
+        dsimp only at hev
+        rw [hres] at hev
+        dsimp only at hev
+        rw [hinfo] at hev
+        dsimp only at hev
+        rw [hrm] at hev
+        dsimp only at hev
+        rw [bind_ok_iff] at hev
+        obtain ⟨guarded, hguard, hev⟩ := hev
+        injection hev with hv
+        subst v
+        obtain ⟨trules, hienv⟩ := hmem.target
+        refine ⟨3, p.block, p.idx.toNat,
+          Ixon.Eval.Frame.ofConst bc uinst' (some p.block), bc,
+          [], [], rfl, ?_, .refDefn hidecl (.refRecursor hienv),
+          (resolveMut_ok hrm).1, rfl, rfl, rfl,
+          hmem, hipos, .stop (recPolicy r)⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hidecl]
+        dsimp only
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hienv]
+  | selfHead hsc hsa hidx hrm hrefs hlookup hipos =>
+    rename_i block idx recIdx univIdxs bc
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', huinst, hev⟩ := hev
+      rw [hlookup] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨guarded, hguard, hev⟩ := hev
+      rw [hsa] at hev
+      injection hev with hvalue
+      subst v
+      rw [hsc] at henv
+      obtain ⟨selfR, selfBc, hselfResolve, selfRefs, selfMuts, selfAddr,
+          selfMember, hslot⟩ := envRel_self henv
+      have hbc : selfBc = bc := by
+        rw [(resolveMut_ok hrm).1] at hselfResolve
+        injection hselfResolve with heq
+        exact heq.symm
+      subst selfBc
+      obtain ⟨selfBc', hselfMut⟩ := selfMember.resolve
+      rw [hrm] at hselfMut
+      injection hselfMut with hpair
+      injection hpair with hbc hr
+      injection hr with hrecur
+      subst selfR
+      refine ⟨1, block, idx, { F with uinst := uinst', selfAddr := some block },
+        bc, [], [], rfl,
+        ?_, .var hslot, (resolveMut_ok hrm).1, selfRefs, selfMuts, rfl,
+        selfMember,
+        hipos, .stop (recPolicy r)⟩
+      rw [IxIR0.eval.eq_def]
+      dsimp only
+      rw [hslot]
+  | memberHead hsa hrm hrefs hmuts hipos hplan =>
+    rename_i block recIdx univIdxs bc
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      have hlookup : F.selfMuts[recIdx.toNat]? = some (.recr r) := by
+        rw [hmuts]
+        exact (resolveMut_ok hrm).2
+      rw [hlookup] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨_, _, hev⟩ := hev
+      rw [hsa] at hev
+      injection hev with hv
+      subst v
+      have hrel := hmembers.lookup hplan
+      cases hrel with
+      | defn hother _ _ _ _ =>
+        rw [hrm] at hother
+        simp at hother
+      | externDefn hother _ _ _ =>
+        rw [hrm] at hother
+        simp at hother
+      | recr hmem =>
+        obtain ⟨bc', hother⟩ := hmem.resolve
+        rw [hrm] at hother
+        injection hother with hpair
+        injection hpair with hbc hr
+        subst bc'
+        cases hr
+        obtain ⟨trules, hienv⟩ := hmem.target
+        refine ⟨1, block, recIdx.toNat, { F with uinst := uinst' }, bc,
+          [], [], (by simp [hsa]), ?_, .refRecursor hienv,
+          (resolveMut_ok hrm).1, hrefs, hmuts, hsa, hmem, hipos,
+          .stop (recPolicy r)⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hienv]
+  | keep hpre harg =>
+    rename_i f a f' a'
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hf : Ixon.Eval.eval ectx g F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx g F env a with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨n₁, block, idx, F₂, bc, sargs, targs, hfv, hfv', htraceF,
+              hresolve, hFrefs, hFmuts, hFsa, hmem, hipos, hcursor⟩ :=
+            fuelIH g (by omega) hpre (by omega) hf
+          obtain ⟨n₂, av', hav', hrelA, htraceA⟩ :=
+            sim g (by omega) ectx F env a av sc mask ρ a' ictx
+              hmembers horacles ha harg henv
+          rw [hfv] at hev
+          cases g with
+          | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+          | succ g' =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases g' with
+            | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+            | succ g'' =>
+              rw [Ixon.Eval.saturate.eq_def] at hev
+              simp only [Ixon.Eval.Head.arity?] at hev
+              have hslen := hcursor.source_length
+              have hne : ((sargs ++ [av]).length ==
+                  Ixon.Eval.recArity r) = false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil, Ixon.Eval.recArity]
+                simp only [List.length_cons] at hslen
+                rw [recPolicy_length_exact] at hslen
+                omega
+              rw [hne] at hev
+              simp at hev
+              subst v
+              have hcursor' := hcursor.append_keep hrelA
+              refine ⟨n₁ + n₂ + 4, block, idx, F₂, bc,
+                sargs ++ [av], targs ++ [av'], rfl, ?_, ?_, hresolve,
+                hFrefs, hFmuts, hFsa, hmem, hipos, hcursor'⟩
+              rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 3 by omega)
+                hfv', bindOk]
+              rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 3 by omega)
+                hav', bindOk]
+              rw [IxIR0.apply.eq_def]
+              dsimp only
+              rw [IxIR0.saturate.eq_def]
+              dsimp only
+              have htlen := hcursor.target_length
+              have hne' : ((targs ++ [av']).length ==
+                  (r.params.toNat + r.motives.toNat +
+                    r.minors.toNat + 1)) = false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil]
+                simp only [policyTargetArity,
+                  policyTargetArity_recPolicy] at htlen
+                omega
+              simp only [IxIR0.Head.arity.eq_def, hne']
+              simp
+              have hsaturate : IxIR0.ProjectionSafe.Saturate ictx
+                  (n₁ + n₂ + 2)
+                  (.rec_ (Erase.memberAddr block idx)
+                    (r.params.toNat + r.motives.toNat +
+                      r.minors.toNat + 1))
+                  (targs ++ [av'])
+                  (.pap (.rec_ (Erase.memberAddr block idx)
+                    (r.params.toNat + r.motives.toNat +
+                      r.minors.toNat + 1)) (targs ++ [av'])) :=
+                .pending (by
+                  have htlen := hcursor.target_length
+                  simp only [policyTargetArity,
+                    policyTargetArity_recPolicy] at htlen
+                  simp only [IxIR0.Head.arity, List.length_append,
+                    List.length_cons, List.length_nil]
+                  omega)
+              exact .app
+                (htraceF.mono_le (by omega))
+                (htraceA.mono_le (by omega))
+                (.pap hsaturate)
+  | ghost hpre =>
+    rename_i f a f'
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hf : Ixon.Eval.eval ectx g F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx g F env a with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨n₁, block, idx, F₂, bc, sargs, targs, hfv, hfv', htraceF,
+              hresolve, hFrefs, hFmuts, hFsa, hmem, hipos, hcursor⟩ :=
+            fuelIH g (by omega) hpre (by omega) hf
+          rw [hfv] at hev
+          cases g with
+          | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+          | succ g' =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases g' with
+            | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+            | succ g'' =>
+              rw [Ixon.Eval.saturate.eq_def] at hev
+              simp only [Ixon.Eval.Head.arity?] at hev
+              have hslen := hcursor.source_length
+              have hne : ((sargs ++ [av]).length ==
+                  Ixon.Eval.recArity r) = false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil, Ixon.Eval.recArity]
+                simp only [List.length_cons] at hslen
+                rw [recPolicy_length_exact] at hslen
+                omega
+              rw [hne] at hev
+              simp at hev
+              subst v
+              have hcursor' := hcursor.append_ghost
+                (sarg := av) (targ := IxIR0.Value.erased)
+              refine ⟨n₁ + 4, block, idx, F₂, bc, sargs ++ [av],
+                targs ++ [.erased], rfl, ?_, ?_, hresolve, hFrefs, hFmuts,
+                hFsa, hmem, hipos, hcursor'⟩
+              rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [IxIR0.eval_mono (show n₁ ≤ n₁ + 3 by omega) hfv', bindOk]
+              have hbox : IxIR0.eval ictx (n₁ + 3) ρ .erased =
+                  .ok .erased := by rw [IxIR0.eval.eq_def]
+              rw [hbox, bindOk]
+              rw [IxIR0.apply.eq_def]
+              dsimp only
+              rw [IxIR0.saturate.eq_def]
+              dsimp only
+              have htlen := hcursor.target_length
+              have hne' : ((targs ++ [IxIR0.Value.erased]).length ==
+                  (r.params.toNat + r.motives.toNat +
+                    r.minors.toNat + 1)) = false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil]
+                simp only [policyTargetArity,
+                  policyTargetArity_recPolicy] at htlen
+                omega
+              simp only [IxIR0.Head.arity.eq_def, hne']
+              simp
+              have hsaturate : IxIR0.ProjectionSafe.Saturate ictx
+                  (n₁ + 2)
+                  (.rec_ (Erase.memberAddr block idx)
+                    (r.params.toNat + r.motives.toNat +
+                      r.minors.toNat + 1))
+                  (targs ++ [.erased])
+                  (.pap (.rec_ (Erase.memberAddr block idx)
+                    (r.params.toNat + r.motives.toNat +
+                      r.minors.toNat + 1)) (targs ++ [.erased])) :=
+                .pending (by
+                  have htlen := hcursor.target_length
+                  simp only [policyTargetArity,
+                    policyTargetArity_recPolicy] at htlen
+                  simp only [IxIR0.Head.arity, List.length_append,
+                    List.length_cons, List.length_nil]
+                  omega)
+              exact .app
+                (htraceF.mono_le (by omega))
+                (.erased)
+                (.pap hsaturate)
+  | drop hpre =>
+    rename_i f a
+    cases fuel with
+    | zero => rw [Ixon.Eval.eval.eq_def] at hev; simp at hev
+    | succ g =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hf : Ixon.Eval.eval ectx g F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx g F env a with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨n₁, block, idx, F₂, bc, sargs, targs, hfv, hfv', htraceF,
+              hresolve, hFrefs, hFmuts, hFsa, hmem, hipos, hcursor⟩ :=
+            fuelIH g (by omega) hpre (by omega) hf
+          rw [hfv] at hev
+          cases g with
+          | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+          | succ g' =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases g' with
+            | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+            | succ g'' =>
+              rw [Ixon.Eval.saturate.eq_def] at hev
+              simp only [Ixon.Eval.Head.arity?] at hev
+              have hslen := hcursor.source_length
+              have hne : ((sargs ++ [av]).length ==
+                  Ixon.Eval.recArity r) = false := by
+                rw [beq_eq_false_iff_ne]
+                simp only [List.length_append, List.length_cons,
+                  List.length_nil, Ixon.Eval.recArity]
+                simp only [List.length_cons] at hslen
+                rw [recPolicy_length_exact] at hslen
+                omega
+              rw [hne] at hev
+              simp at hev
+              subst v
+              exact ⟨n₁, block, idx, F₂, bc, sargs ++ [av], targs,
+                rfl, hfv', htraceF, hresolve, hFrefs, hFmuts, hFsa, hmem, hipos,
+                hcursor.append_drop⟩
+
+private theorem not_neutral_of_majorCtor_ok
+    {peel : Bool} {major : Ixon.Eval.Value} {tag : Nat}
+    {fields : List Ixon.Eval.Value}
+    (hmajor : Ixon.Eval.majorCtor peel major = .ok (tag, fields)) :
+    major.isNeutral = false := by
+  cases major <;>
+    simp [Ixon.Eval.majorCtor, Ixon.Eval.Value.isNeutral] at hmajor ⊢
+
+/-- The ι correspondence: given a saturated recursor pap on both
+sides, agreeing major analyses (`hmcS`/`htmc` — the same
+block-identity peel), and related constructor fields, the source fire
+and the target fire terminate related. -/
+private theorem fireSim {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {fuel : Nat} (ih : ∀ m, m < fuel → SimAt m)
+    (hmembers : MemberCoverage ectx ictx scope.plan)
+    (horacles : OracleRel ectx ictx)
+    {g'' : Nat} (hg : g'' < fuel)
+    {F₂ : Ixon.Eval.Frame} {block : Ixon.Address} {idx : Nat}
+    {r : Recursor} {bc : Constant}
+    (hresolve : ectx.resolve block = some bc)
+    (hFrefs : F₂.refs = bc.refs)
+    (hFmuts : F₂.selfMuts = Ixon.selfMutsOf bc.info)
+    (hFsa : F₂.selfAddr = some block)
+    (hmem : RecMember ectx ictx block idx r)
+    {sargs : List Ixon.Eval.Value} {av : Ixon.Eval.Value}
+    {indexArgs : List Ixon.Eval.Value}
+    {targs : List IxIR0.Value} {av' : IxIR0.Value}
+    (hlen2 : sargs.length = targs.length)
+    (hslen : sargs.length = (recRulePolicy r).length)
+    (hcursor : RuntimePolicyRel (ValRel ectx ictx) (recRulePolicy r)
+      sargs targs)
+    {cidx : Nat} {ccargs : List Ixon.Eval.Value} {tfields : List IxIR0.Value}
+    (hmcS : Ixon.Eval.majorCtor (ectx.natBlock == some block) av =
+      .ok (cidx, ccargs))
+    (htmc : IxIR0.majorCtor (ectx.natBlock == some block) av' =
+      .ok (cidx, tfields))
+    (hcrel : ValsRel ectx ictx (ccargs.drop r.params.toNat) tfields)
+    {v : Ixon.Eval.Value}
+    (hfire : Ixon.Eval.fire ectx g'' (.recH (some block) r F₂)
+      ((sargs ++ indexArgs) ++ [av]) = .ok v)
+    {ρ : List IxIR0.Value} {fT aT : IxIR0.Expr} {n₁ n₂ : Nat}
+    (hfv' : IxIR0.eval ictx n₁ ρ fT = .ok (.pap
+      (.rec_ (Erase.memberAddr block idx)
+        (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) targs))
+    (hav' : IxIR0.eval ictx n₂ ρ aT = .ok av')
+    (htraceF : IxIR0.ProjectionSafe.Eval ictx n₁ ρ fT (.pap
+      (.rec_ (Erase.memberAddr block idx)
+        (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) targs))
+    (htraceA : IxIR0.ProjectionSafe.Eval ictx n₂ ρ aT av') :
+    ∃ fuel' v', IxIR0.eval ictx fuel' ρ (.app fT aT) = .ok v' ∧
+      ValRel ectx ictx v v' ∧
+      IxIR0.ProjectionSafe.Eval ictx fuel' ρ (.app fT aT) v' := by
+  obtain ⟨bc₂, trules, hres2, hienv, hrules⟩ :
+      ∃ bc₂ trules,
+        Ixon.Eval.resolveMut ectx block idx = .ok (bc₂, .recr r) ∧
+        ictx.env (Erase.memberAddr block idx) =
+          some (.recursor
+            (r.params.toNat + r.motives.toNat + r.minors.toNat)
+            (ectx.natBlock == some block) trules) ∧
+        RulesRel ectx ictx block idx r bc₂.refs
+          (Ixon.selfMutsOf bc₂.info) r.rules.toList trules.toList := by
+    cases hmem with
+    | mk hres2 hparams hienv hrules =>
+      exact ⟨_, _, hres2, hienv, hrules⟩
+  have hbc : bc₂ = bc := by
+    have h1 := (resolveMut_ok hres2).1
+    rw [hresolve] at h1
+    injection h1 with h1'
+    exact h1'.symm
+  subst hbc
+  have hstrict := hmembers.strict
+  cases g'' with
+  | zero => rw [Ixon.Eval.fire.eq_def] at hfire; simp at hfire
+  | succ g₃ =>
+    rw [Ixon.Eval.fire.eq_def] at hfire
+    dsimp only at hfire
+    rw [List.getLast?_concat] at hfire
+    dsimp only at hfire
+    simp only [Option.isSome_some, Bool.true_and] at hfire
+    rw [hstrict.stringLiterals, Ixon.Eval.prepareStringMajor_none,
+      bindOk] at hfire
+    rw [not_neutral_of_majorCtor_ok hmcS] at hfire
+    simp only [Bool.false_and, Bool.false_eq_true, if_false] at hfire
+    obtain ⟨checked, hguard⟩ : ∃ checked,
+        Ixon.Eval.guardRecMajor (some block) r.params.toNat av =
+          .ok checked := by
+      cases hgmajor : Ixon.Eval.guardRecMajor (some block) r.params.toNat av with
+      | error err => rw [hgmajor, bindErr] at hfire; simp at hfire
+      | ok checked => exact ⟨checked, rfl⟩
+    rw [hguard, bindOk] at hfire
+    rw [hmcS, bindOk] at hfire
+    dsimp only at hfire
+    split at hfire
+    · simp at hfire
+    · rename_i rule hrule
+      split at hfire
+      · simp at hfire
+      · rename_i hfc
+        have hfc' : ccargs.length =
+            r.params.toNat + rule.fields.toNat := by
+          simp at hfc
+          omega
+        have hslen' : sargs.length =
+            r.params.toNat + r.motives.toNat + r.minors.toNat := by
+          simpa using hslen
+        have htake : ((sargs ++ indexArgs) ++ [av]).take
+            (r.params.toNat + r.motives.toNat + r.minors.toNat) =
+            sargs := by
+          rw [List.append_assoc, List.take_left' hslen']
+        rw [htake] at hfire
+        rw [bind_ok_iff] at hfire
+        obtain ⟨rhsV, hrhsV, happ⟩ := hfire
+        have hruleL : r.rules.toList[cidx]? = some rule := by
+          rw [arrGet?_toList]; exact hrule
+        obtain ⟨trule, B, htruleL, hfields, hpeel, hpB⟩ :=
+          rulesRel_lookup cidx hrules hruleL
+        have htrule : trules[cidx]? = some trule := by
+          rw [← arrGet?_toList]; exact htruleL
+        have hcfields : (ccargs.drop r.params.toNat).length =
+            rule.fields.toNat := by
+          simp only [List.length_drop, hfc']
+          omega
+        have hlen3 : (sargs ++ ccargs.drop r.params.toNat).length =
+            r.params.toNat + r.motives.toNat + r.minors.toNat +
+              rule.fields.toNat := by
+          simp only [List.length_append, hslen', hcfields]
+        rw [← hlen3] at hpeel
+        obtain ⟨gb, hgb, hbody⟩ :=
+          chain_enter (sargs ++ ccargs.drop r.params.toNat)
+            hpeel hrhsV happ
+        have htflen : tfields.length = rule.fields.toNat := by
+          rw [← valsRel_length hcrel]
+          exact hcfields
+        -- Build the rule-body environment from the policy cursor, then fields.
+        have hbase : EnvRel ectx ictx (some (block, idx)) F₂.refs
+            F₂.selfMuts F₂.selfAddr [] []
+            [.pap (.rec_ (Erase.memberAddr block idx)
+              (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+              []] := by
+          rw [hFrefs, hFmuts, hFsa]
+          exact .selfB hresolve rfl rfl hmem
+        have hargs := envRel_runtimePolicyRev (recRulePolicy_slots r)
+          hcursor hbase
+        have hfieldsEnv := envRel_keepRev hcrel hargs
+        have h3 : EnvRel ectx ictx (some (block, idx)) F₂.refs
+            F₂.selfMuts F₂.selfAddr (recRuleMask r rule.fields.toNat)
+            (sargs ++ ccargs.drop r.params.toNat).reverse
+            (tfields.reverse ++ targs.reverse ++
+              [.pap (.rec_ (Erase.memberAddr block idx)
+                (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+                []]) := by
+          simpa [recRuleMask, hcfields, List.reverse_append,
+            List.append_assoc] using hfieldsEnv
+        rw [← hFrefs, ← hFmuts, ← hFsa] at hpB
+        obtain ⟨n₃, v', hv', hrel, htraceBody⟩ := ih gb (by omega) ectx F₂
+          (sargs ++ ccargs.drop r.params.toNat).reverse B v
+          (some (block, idx)) (recRuleMask r rule.fields.toNat)
+          (tfields.reverse ++ targs.reverse ++
+            [IxIR0.Value.pap (.rec_ (Erase.memberAddr block idx)
+              (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) []])
+          trule.rhs ictx hmembers horacles hbody hpB h3
+        refine ⟨n₁ + n₂ + n₃ + 5, v', ?_, hrel, ?_⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + n₃ + 4 by omega) hfv',
+          bindOk]
+        rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + n₃ + 4 by omega) hav',
+          bindOk]
+        rw [IxIR0.apply.eq_def]
+        dsimp only
+        rw [IxIR0.saturate.eq_def]
+        dsimp only
+        have hc2 : ((targs ++ [av']).length ==
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) =
+            true := by
+          simp only [List.length_append, List.length_cons, List.length_nil,
+            beq_iff_eq]
+          omega
+        simp only [IxIR0.Head.arity.eq_def, hc2]
+        simp only [if_true]
+        rw [IxIR0.fire.eq_def]
+        dsimp only
+        rw [hienv]
+        dsimp only
+        rw [List.getLast?_concat]
+        dsimp only
+        rw [htmc, bindOk]
+        dsimp only
+        rw [htrule]
+        dsimp only
+        rw [if_neg (by simp [htflen, hfields])]
+        rw [List.dropLast_concat]
+        exact IxIR0.eval_mono (show n₃ ≤ n₁ + n₂ + n₃ + 1 by omega) hv'
+        have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx
+            (n₁ + n₂ + n₃ + 1)
+            (tfields.reverse ++ (targs ++ [av']).dropLast.reverse ++
+              [.pap (.rec_ (Erase.memberAddr block idx)
+                (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+                []]) trule.rhs v' := by
+          simpa using htraceBody.mono_le
+            (show n₃ ≤ n₁ + n₂ + n₃ + 1 by omega)
+        have hfireTrace : IxIR0.ProjectionSafe.Fire ictx
+            (n₁ + n₂ + n₃ + 2)
+            (.rec_ (Erase.memberAddr block idx)
+              (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+            (targs ++ [av']) v' :=
+          .recursor hienv (by simp) htmc htrule
+            (by simpa [hfields] using htflen) hbodyTrace
+        have hsaturateTrace : IxIR0.ProjectionSafe.Saturate ictx
+            (n₁ + n₂ + n₃ + 3)
+            (.rec_ (Erase.memberAddr block idx)
+              (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+            (targs ++ [av']) v' :=
+          .full (by
+            simp only [IxIR0.Head.arity, List.length_append,
+              List.length_cons, List.length_nil]
+            omega) hfireTrace
+        exact .app
+          (htraceF.mono_le (by omega))
+          (htraceA.mono_le (by omega))
+          (.pap hsaturateTrace)
+
+private theorem simAt : ∀ fuel, SimAt fuel := by
+  refine strongNat ?_
+  intro fuel ih
+  cases fuel with
+  | zero =>
+    intro ectx F env e v sc mask ρ e' ictx hmembers horacles hev hpe henv
+    rw [Ixon.Eval.eval.eq_def] at hev
+    simp at hev
+  | succ n =>
+    intro ectx F env e v sc mask ρ e' ictx hmembers horacles hev hpe henv
+    have hstrict := hmembers.strict
+    cases hpe with
+    | var hm =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      split at hev
+      · rename_i w heq
+        injection hev with hv
+        subst hv
+        obtain ⟨v', hρ, hrel⟩ := envRel_lookup _ henv _ hm heq
+        refine ⟨1, v', ?_, hrel, .var hρ⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hρ]
+      · simp at hev
+    | sortE =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      split at hev
+      · rename_i u heq
+        injection hev with hv
+        subst hv
+        exact ⟨1, .erased, by rw [IxIR0.eval.eq_def], .sort, .erased⟩
+      · simp at hev
+    | allE =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      injection hev with hv
+      subst hv
+      exact ⟨1, .erased, by rw [IxIR0.eval.eq_def], .pi, .erased⟩
+    | lamK hnd hpb =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      injection hev with hv
+      subst hv
+      exact ⟨1, _, by rw [IxIR0.eval.eq_def],
+        .clos (by simp [hnd]) henv hpb, .lam⟩
+    | lamD hd hpb =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      injection hev with hv
+      subst hv
+      exact ⟨1, _, by rw [IxIR0.eval.eq_def],
+        .clos (by simp [hd]) henv hpb, .lam⟩
+    | letE hpv hpb =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rename_i nd ty val body val' body'
+      cases hval : Ixon.Eval.eval ectx n F env val with
+      | error err => rw [hval, bindErr] at hev; simp at hev
+      | ok w =>
+        rw [hval, bindOk] at hev
+        obtain ⟨n₁, w', hw', hrelW, htraceW⟩ :=
+          ih n (by omega) ectx F env val w sc mask ρ val' ictx
+            hmembers horacles hval hpv henv
+        obtain ⟨n₂, v', hv', hrel, htraceBody⟩ :=
+          ih n (by omega) ectx F (w :: env) body v sc (true :: mask)
+            (w' :: ρ) body' ictx hmembers horacles hev hpb
+              (.keep hrelW henv)
+        refine ⟨n₁ + n₂ + 1, v', ?_, hrel, ?_⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ by omega) hw', bindOk]
+        exact IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ by omega) hv'
+        exact .letE (htraceW.mono_le (by omega))
+          (htraceBody.mono_le (by omega))
+    | natE hrefs hblob =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [hrefs] at hev
+      dsimp only at hev
+      rw [hblob] at hev
+      dsimp only at hev
+      injection hev with hv
+      subst hv
+      exact ⟨1, _, by rw [IxIR0.eval.eq_def], .litNat, .lit⟩
+    | strE hrefs hblob =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [hrefs] at hev
+      dsimp only at hev
+      rw [hblob] at hev
+      dsimp only at hev
+      injection hev with hv
+      subst hv
+      exact ⟨1, _, by rw [IxIR0.eval.eq_def], .litStr, .lit⟩
+    | recurS hidx hsafe =>
+      rename_i block idx recIdx univIdxs
+      obtain ⟨r, bc, hres, hrefs, hmuts, hsa, hmem, hslot⟩ :=
+        envRel_self henv
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      obtain ⟨bc₂, trules, hres2, hi0, hienv, hrules⟩ :
+          ∃ bc₂ trules,
+            Ixon.Eval.resolveMut ectx block idx = .ok (bc₂, .recr r) ∧
+            r.indices.toNat = 0 ∧
+            ictx.env (Erase.memberAddr block idx) =
+              some (.recursor
+                (r.params.toNat + r.motives.toNat + r.minors.toNat)
+                (ectx.natBlock == some block) trules) ∧
+            RulesRel ectx ictx block idx r bc₂.refs
+              (Ixon.selfMutsOf bc₂.info) r.rules.toList
+              trules.toList := by
+        cases hmem with
+        | mk hres2 hparams hienv hrules =>
+          rename_i bc' trules
+          have hbcEq : bc' = bc := by
+            have h1 := (resolveMut_ok hres2).1
+            rw [hres] at h1
+            injection h1 with h1'
+            exact h1'.symm
+          cases hbcEq
+          have hlook : F.selfMuts[recIdx.toNat]? = some (.recr r) := by
+            rw [hidx, hmuts]
+            exact (resolveMut_ok hres2).2
+          have hi0 := hsafe r hlook
+          exact ⟨_, _, hres2, hi0, hienv, hrules⟩
+      have hbc : bc₂ = bc := by
+        have h1 := (resolveMut_ok hres2).1
+        rw [hres] at h1
+        injection h1 with h1'
+        exact h1'.symm
+      subst hbc
+      have hlook : F.selfMuts[recIdx.toNat]? = some (.recr r) := by
+        rw [hidx, hmuts]
+        exact (resolveMut_ok hres2).2
+      have hi0 := hsafe r hlook
+      rw [hlook] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨_, _, hev⟩ := hev
+      injection hev with hv
+      subst hv
+      refine ⟨1, .pap (.rec_ (Erase.memberAddr block idx)
+        (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) [], ?_, ?_,
+        .var hslot⟩
+      · rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hslot]
+      · rw [hsa]
+        exact .papRec hres hrefs hmuts rfl hmem hi0 rfl
+          (Nat.zero_le _) (.stop (recRulePolicy r))
+    | recurI hsa hresolve hrefs hlookup hidecl =>
+      rename_i block recIdx univIdxs bc ind
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      rw [hlookup] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨_, _, hev⟩ := hev
+      rw [hsa] at hev
+      injection hev with hv
+      subst hv
+      refine ⟨2, .erased, ?_,
+        .inductiveMember (resolveMut_ok hresolve).1 (resolveMut_ok hresolve).2,
+        .refDefn hidecl .erased⟩
+      rw [IxIR0.eval.eq_def]
+      dsimp only
+      rw [hidecl]
+      dsimp only
+      rw [IxIR0.eval.eq_def]
+    | recurD hsa hresolve hrefs hmuts hunfold hplan =>
+      rename_i block recIdx univIdxs bc d
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      have hlookup : F.selfMuts[recIdx.toNat]? = some (.defn d) := by
+        rw [hmuts]
+        exact (resolveMut_ok hresolve).2
+      rw [hlookup] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨_, _, hev⟩ := hev
+      rw [hunfold] at hev
+      simp only [if_true] at hev
+      have hrel := hmembers.lookup hplan
+      cases hrel with
+      | defn hresolve' _ hidecl _ hbody =>
+        rw [hresolve] at hresolve'
+        injection hresolve' with hpair
+        injection hpair with hbc hd
+        cases hbc
+        cases hd
+        have hbody' := hbody
+        rw [← hrefs, ← hmuts, ← hsa] at hbody'
+        obtain ⟨n₁, v', hv', hvalue, htrace⟩ :=
+          ih n (by omega) ectx { F with uinst := uinst' } [] d.value v
+            none [] [] _ ictx hmembers horacles hev hbody' .nil
+        refine ⟨n₁ + 1, v', ?_, hvalue, .refDefn hidecl htrace⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hidecl]
+        exact hv'
+      | externDefn hresolve' hunfold' _ _ =>
+        rw [hresolve] at hresolve'
+        injection hresolve' with hpair
+        injection hpair with hbc hd
+        cases hbc
+        cases hd
+        rw [hunfold] at hunfold'
+        simp at hunfold'
+      | recr hmem =>
+        obtain ⟨bc', hresolve'⟩ := hmem.resolve
+        rw [hresolve] at hresolve'
+        simp at hresolve'
+    | recurO hsa hresolve hrefs hmuts hunfold hconfigured hplan =>
+      rename_i block recIdx univIdxs bc d arity
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      have hlookup : F.selfMuts[recIdx.toNat]? = some (.defn d) := by
+        rw [hmuts]
+        exact (resolveMut_ok hresolve).2
+      rw [hlookup] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨_, _, hev⟩ := hev
+      rw [hunfold] at hev
+      rw [hsa] at hev
+      simp only [Bool.false_eq_true, if_false] at hev
+      rw [hconfigured] at hev
+      have hrel := hmembers.lookup hplan
+      cases hrel with
+      | defn hresolve' hunfold' _ _ _ =>
+        rw [hresolve] at hresolve'
+        injection hresolve' with hpair
+        injection hpair with hbc hd
+        cases hbc
+        cases hd
+        rw [hunfold] at hunfold'
+        simp at hunfold'
+      | externDefn hresolve' _ hconfigured' hidecl =>
+        rw [hresolve] at hresolve'
+        injection hresolve' with hpair
+        injection hpair with hbc hd
+        cases hbc
+        cases hd
+        rw [hconfigured] at hconfigured'
+        injection hconfigured' with harity
+        cases harity
+        obtain ⟨targetFuel, targetValue, htarget, hvalue, htrace⟩ :=
+          externSaturate_sim horacles hconfigured (Nat.zero_le _) .nil hev
+        refine ⟨targetFuel + 1, targetValue, ?_, hvalue,
+          .refExtern hidecl htrace⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hidecl]
+        exact htarget
+      | recr hmem =>
+        obtain ⟨bc', hresolve'⟩ := hmem.resolve
+        rw [hresolve] at hresolve'
+        simp at hresolve'
+    | recurR hsa hresolve hrefs hmuts hi0 hplan =>
+      rename_i block recIdx univIdxs bc r
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      have hlookup : F.selfMuts[recIdx.toNat]? = some (.recr r) := by
+        rw [hmuts]
+        exact (resolveMut_ok hresolve).2
+      rw [hlookup] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨_, _, hev⟩ := hev
+      rw [hsa] at hev
+      injection hev with hv
+      subst v
+      have hrel := hmembers.lookup hplan
+      cases hrel with
+      | defn hresolve' _ _ _ _ =>
+        rw [hresolve] at hresolve'
+        simp at hresolve'
+      | externDefn hresolve' _ _ _ =>
+        rw [hresolve] at hresolve'
+        simp at hresolve'
+      | recr hmem =>
+        obtain ⟨bc', hresolve'⟩ := hmem.resolve
+        rw [hresolve] at hresolve'
+        injection hresolve' with hpair
+        injection hpair with hbc hr
+        subst bc'
+        cases hr
+        obtain ⟨trules, hienv⟩ := hmem.target
+        refine ⟨1, .pap (.rec_ (Erase.memberAddr block recIdx.toNat)
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) [],
+          ?_, ?_, .refRecursor hienv⟩
+        · rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hienv]
+        · exact .papRec (resolveMut_ok hresolve).1 hrefs hmuts rfl hmem
+            hi0 rfl (Nat.zero_le _) (.stop (recRulePolicy r))
+    | prjE hpv =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rename_i tyRef fieldIdx val val'
+      cases hval : Ixon.Eval.eval ectx n F env val with
+      | error err => rw [hval, bindErr] at hev; simp at hev
+      | ok w =>
+        rw [hval, bindOk] at hev
+        obtain ⟨n₁, w', hw', hrelW, htraceW⟩ :=
+          ih n (by omega) ectx F env val w sc mask ρ val' ictx
+            hmembers horacles hval hpv henv
+        obtain ⟨projectedInd, projectedBlockConstant, block, indIdx, cidx,
+            cargs, hprojectedResolve, hw, hfield⟩ :=
+          Ixon.Eval.projectValue_ok_of_strict hstrict.neutralElims hev
+        subst w
+        cases hrelW with
+        | ctorV hshape _haddr hargs hcursor =>
+          rename_i params fields a fargs
+          obtain ⟨bc, ind, ct, hrm, hct, hip, hcp, hcf⟩ := hshape
+          rw [hrm] at hprojectedResolve
+          injection hprojectedResolve with hpair
+          injection hpair with _ hind
+          injection hind with hind
+          subst projectedInd
+          have hidxDrop : (cargs.drop params)[fieldIdx.toNat]? =
+              some v := by
+            rw [List.getElem?_drop]
+            simpa [hip] using hfield
+          obtain ⟨w0', hidx', hrel0⟩ :=
+            valsRel_lookup _ hargs _ hidxDrop
+          refine ⟨n₁ + 1, w0', ?_, hrel0, .proj htraceW hidx'⟩
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [IxIR0.eval_mono (Nat.le_refl n₁) hw', bindOk]
+          dsimp only
+          rw [hidx']
+    | ctorW hspine hlt hidecl =>
+      rename_i a block indIdx cidx params fields consumed
+      have hshape := ctorParamSpine_shape hspine
+      have haddr := ctorParamSpine_addr hspine
+      obtain ⟨sargs, hlen, hv⟩ := ctorParamSpine_eval_lt hspine hlt hev
+      subst v
+      have hbody : params - consumed - 1 =
+          params - sargs.length - 1 := by omega
+      have htrace : IxIR0.ProjectionSafe.Eval ictx 1 ρ
+          (.lam .many
+            (Erase.lamManyN (params - consumed - 1) (.ref a)))
+          (.clos .many ρ
+            (Erase.lamManyN (params - sargs.length - 1) (.ref a))) := by
+        rw [hbody]
+        exact
+          (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx) (fuel := 0)
+            (env := ρ) (uses := Uses.many)
+            (body := Erase.lamManyN (params - sargs.length - 1) (.ref a)))
+      exact ⟨1, _, htrace.run,
+        .papCtorParams hshape haddr hidecl rfl (by omega), htrace⟩
+    | ctorP hpos hspine hidecl =>
+      rename_i a block indIdx cidx params fields
+      have hshape := ctorParamSpine_shape hspine
+      have haddr := ctorParamSpine_addr hspine
+      obtain ⟨sargs, hlen, hresult⟩ :=
+        ctorParamSpine_eval_full hpos hspine hev
+      cases hresult with
+      | inl hctor =>
+        obtain ⟨hfields, hv⟩ := hctor
+        subst fields
+        subst v
+        have hdrop : sargs.drop params = [] :=
+          List.drop_eq_nil_of_le (by omega)
+        have hargs : ValsRel ectx ictx (sargs.drop params) [] := by
+          rw [hdrop]
+          exact .nil
+        have hcursor : PolicyRel (fun _ _ => True) IxIR0.Value.erased
+            (ctorPolicy params 0) sargs [] := by
+          have hc := PolicyPrefix.ctor_of_fields
+            (R := fun _ _ => True) (ghost := IxIR0.Value.erased)
+            (show params ≤ sargs.length by omega)
+            (show sargs.length ≤ params + 0 by omega)
+            (show ListRel (fun _ _ => True) (sargs.drop params) [] by
+              rw [hdrop]
+              exact ListRel.nil)
+          simpa [hlen] using hc
+        refine ⟨3, .ctor a cidx [], ?_, .ctorV hshape haddr hargs hcursor,
+          .refCtor hidecl (.full (by simp [IxIR0.Head.arity]) .ctor)⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hidecl]
+        dsimp only
+        rw [IxIR0.saturate.eq_def]
+        dsimp only
+        simp [IxIR0.Head.arity]
+        rw [IxIR0.fire.eq_def]
+      | inr hpap =>
+        obtain ⟨hfields, hv⟩ := hpap
+        subst v
+        have hdrop : sargs.drop params = [] :=
+          List.drop_eq_nil_of_le (by omega)
+        have hargs : ValsRel ectx ictx (sargs.drop params) [] := by
+          rw [hdrop]
+          exact .nil
+        have hcursor : PolicyPrefix (fun _ _ => True) IxIR0.Value.erased
+            (ctorPolicy params fields) sargs []
+            (List.replicate (params + fields - sargs.length) .keep) :=
+          PolicyPrefix.ctor_of_fields
+            (show params ≤ sargs.length by omega)
+            (show sargs.length ≤ params + fields by omega)
+            (show ListRel (fun _ _ => True) (sargs.drop params) [] by
+              rw [hdrop]
+              exact ListRel.nil)
+        refine ⟨2, .pap (.ctor a cidx fields) [], ?_,
+          .papCtor hshape haddr rfl rfl (by omega) (by omega) hargs hcursor,
+          .refCtor hidecl (.pending (by simp [IxIR0.Head.arity]; omega))⟩
+        rw [IxIR0.eval.eq_def]
+        dsimp only
+        rw [hidecl]
+        dsimp only
+        rw [IxIR0.saturate.eq_def]
+        dsimp only
+        have hne : ((0 == fields) : Bool) = false := by
+          rw [beq_eq_false_iff_ne]
+          omega
+        simp only [IxIR0.Head.arity.eq_def, List.length_nil, hne]
+        simp
+    | ref hrefs hcov =>
+      rename_i refIdx univIdxs a
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rw [hrefs] at hev
+      dsimp only at hev
+      rw [bind_ok_iff] at hev
+      obtain ⟨uinst', _, hev⟩ := hev
+      cases n with
+      | zero => rw [Ixon.Eval.evalRef.eq_def] at hev; simp at hev
+      | succ g =>
+        rw [Ixon.Eval.evalRef.eq_def] at hev
+        dsimp only at hev
+        cases hcov with
+        | defn hres hinfo hunf hidecl _ hpe' =>
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          rw [hunf] at hev
+          simp at hev
+          obtain ⟨n₁, v', hv', hrel, htraceBody⟩ :=
+            ih g (by omega) ectx _ [] _ v none [] [] _ ictx
+              hmembers horacles hev hpe' .nil
+          refine ⟨n₁ + 1, v', ?_, hrel, .refDefn hidecl htraceBody⟩
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hidecl]
+          exact hv'
+        | defnProj hres hinfo hrm hunf hidecl hmember _ hpe' =>
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [hrm] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          rw [hunf] at hev
+          simp at hev
+          obtain ⟨n₁, v', hv', hrel, htraceBody⟩ :=
+            ih g (by omega) ectx _ [] _ v none [] [] _ ictx
+              hmembers horacles hev hpe' .nil
+          refine ⟨n₁ + 2, v', ?_, hrel,
+            .refDefn hidecl (.refDefn hmember htraceBody)⟩
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hidecl]
+          dsimp only
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hmember]
+          exact hv'
+        | externDefn hres hinfo hunf hconfigured hidecl =>
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          rw [hunf] at hev
+          rw [hconfigured] at hev
+          obtain ⟨targetFuel, targetValue, htarget, hrel, htrace⟩ :=
+            externSaturate_sim horacles hconfigured (Nat.zero_le _) .nil hev
+          refine ⟨targetFuel + 1, targetValue, ?_, hrel,
+            .refExtern hidecl htrace⟩
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hidecl]
+          exact htarget
+        | externDefnProj hres hinfo hrm hunf hconfigured hidecl hmember _ =>
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [hrm] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          rw [hunf] at hev
+          rw [hconfigured] at hev
+          obtain ⟨targetFuel, targetValue, htarget, hrel, htrace⟩ :=
+            externSaturate_sim horacles hconfigured (Nat.zero_le _) .nil hev
+          refine ⟨targetFuel + 2, targetValue, ?_, hrel,
+            .refDefn hidecl (.refExtern hmember htrace)⟩
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hidecl]
+          dsimp only
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hmember]
+          exact htarget
+        | externAxio hres hinfo hconfigured hidecl =>
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          rw [hconfigured] at hev
+          obtain ⟨targetFuel, targetValue, htarget, hrel, htrace⟩ :=
+            externSaturate_sim horacles hconfigured (Nat.zero_le _) .nil hev
+          refine ⟨targetFuel + 1, targetValue, ?_, hrel,
+            .refExtern hidecl htrace⟩
+          rw [IxIR0.eval.eq_def]
+          dsimp only
+          rw [hidecl]
+          exact htarget
+        | ctor hres hinfo hshape hidecl =>
+          rename_i c p fields
+          obtain ⟨bc, ind, ct, hrm, hct, hip, hcp, hcf⟩ := hshape
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [hrm] at hev
+          dsimp only at hev
+          rw [hct] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          cases g with
+          | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+          | succ g' =>
+            rw [Ixon.Eval.saturate.eq_def] at hev
+            simp only [Ixon.Eval.Head.arity?] at hev
+            rw [hcp, hcf] at hev
+            simp only [List.length_nil, Nat.zero_add] at hev
+            cases fields with
+            | zero =>
+              simp at hev
+              cases g' with
+              | zero => rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+              | succ g'' =>
+                rw [Ixon.Eval.fire.eq_def] at hev
+                dsimp only at hev
+                injection hev with hv
+                subst hv
+                refine ⟨3, .ctor a p.cidx.toNat [], ?_,
+                  .ctorV ⟨bc, ind, ct, hrm, hct, hip, hcp, hcf⟩
+                    ⟨c, p, hres, hinfo, rfl, rfl, rfl⟩ .nil
+                    (.stop []),
+                  .refCtor hidecl (.full (by simp [IxIR0.Head.arity]) .ctor)⟩
+                rw [IxIR0.eval.eq_def]
+                dsimp only
+                rw [hidecl]
+                dsimp only
+                rw [IxIR0.saturate.eq_def]
+                dsimp only
+                simp [IxIR0.Head.arity]
+                rw [IxIR0.fire.eq_def]
+            | succ f' =>
+              simp at hev
+              subst hev
+              refine ⟨2, .pap (.ctor a p.cidx.toNat (f' + 1)) [], ?_,
+                .papCtor ⟨bc, ind, ct, hrm, hct, hip, hcp, hcf⟩
+                  ⟨c, p, hres, hinfo, rfl, rfl, rfl⟩ (by simp) rfl
+                  (by simp) (by simp) .nil
+                  (by simpa [ctorPolicy] using
+                    (PolicyPrefix.stop (R := fun _ _ => True)
+                      (ghost := IxIR0.Value.erased)
+                      (ctorPolicy 0 (f' + 1)))),
+                .refCtor hidecl (.pending (by simp [IxIR0.Head.arity]))⟩
+              rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [hidecl]
+              dsimp only
+              rw [IxIR0.saturate.eq_def]
+              dsimp only
+              simp [IxIR0.Head.arity]
+        | tyf hres hinfo hidecl =>
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          split at hev
+          · rw [bind_ok_iff] at hev
+            obtain ⟨_, _, hev⟩ := hev
+            injection hev with hv
+            subst hv
+            refine ⟨3, .erased, ?_, .inductiveType hres hinfo,
+              .refDefn hidecl (.erased)⟩
+            rw [IxIR0.eval.eq_def]
+            dsimp only
+            rw [hidecl]
+            dsimp only
+            rw [IxIR0.eval.eq_def]
+          · simp at hev
+          · simp at hev
+        | quot hres hinfo hkind hidecl howned =>
+          rename_i c q result
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          rw [hkind] at hev
+          dsimp only at hev
+          cases hqkind : q.kind with
+          | type =>
+            rw [hqkind] at hev
+            rw [show ((Ixon.QuotKind.type == Ixon.QuotKind.type) : Bool) =
+              true by rfl] at hev
+            simp only [if_true] at hev
+            injection hev with hv
+            subst hv
+            rw [hqkind] at hidecl
+            refine ⟨2, .erased, ?_, .quotType,
+              .refDefn hidecl .erased⟩
+            rw [IxIR0.eval.eq_def]
+            dsimp only
+            rw [hidecl]
+            dsimp only
+            simp [Erase.quotientBody, IxIR0.eval]
+          | ctor =>
+            rw [hqkind] at hev
+            rw [show ((Ixon.QuotKind.ctor == Ixon.QuotKind.ctor) : Bool) =
+              true by rfl] at hev
+            simp only [if_true] at hev
+            injection hev with hv
+            subst hv
+            rw [hqkind] at hidecl
+            refine ⟨2, _, ?_, .papQuot (by simp)
+              (by simp [Ixon.Eval.quotArity]) .nil,
+              .refDefn hidecl ?_⟩
+            · rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [hidecl]
+              dsimp only
+              simp [Erase.quotientBody, Erase.quotMkBody,
+                Erase.lamManyN, Ixon.Eval.quotArity, IxIR0.eval]
+            · simpa [Erase.quotientBody, Erase.quotMkBody,
+                Erase.lamManyN, Ixon.Eval.quotArity] using
+                (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx)
+                  (fuel := 0) (env := ([] : List IxIR0.Value))
+                  (uses := Uses.many)
+                  (body := Erase.lamManyN 2 (Erase.quotientCore .ctor)))
+          | lift =>
+            rw [hqkind] at hev
+            rw [show ((Ixon.QuotKind.lift == Ixon.QuotKind.lift) : Bool) =
+              true by rfl] at hev
+            simp only [if_true] at hev
+            injection hev with hv
+            subst hv
+            rw [hqkind] at hidecl
+            refine ⟨2, _, ?_, .papQuot (by simp)
+              (by simp [Ixon.Eval.quotArity]) .nil,
+              .refDefn hidecl ?_⟩
+            · rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [hidecl]
+              dsimp only
+              simp [Erase.quotientBody, Erase.quotLiftBody,
+                Erase.lamManyN, Ixon.Eval.quotArity, IxIR0.eval]
+            · simpa [Erase.quotientBody, Erase.quotLiftBody,
+                Erase.lamManyN, Ixon.Eval.quotArity] using
+                (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx)
+                  (fuel := 0) (env := ([] : List IxIR0.Value))
+                  (uses := Uses.many)
+                  (body := Erase.lamManyN 5 (Erase.quotientCore .lift)))
+          | ind =>
+            rw [hqkind] at hev
+            rw [show ((Ixon.QuotKind.ind == Ixon.QuotKind.ind) : Bool) =
+              true by rfl] at hev
+            simp only [if_true] at hev
+            injection hev with hv
+            subst hv
+            rw [hqkind] at hidecl
+            refine ⟨2, _, ?_, .papQuot (by simp)
+              (by simp [Ixon.Eval.quotArity]) .nil,
+              .refDefn hidecl ?_⟩
+            · rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [hidecl]
+              dsimp only
+              simp [Erase.quotientBody, Erase.quotIndBody,
+                Erase.lamManyN, Ixon.Eval.quotArity, IxIR0.eval]
+            · simpa [Erase.quotientBody, Erase.quotIndBody,
+                Erase.lamManyN, Ixon.Eval.quotArity] using
+                (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx)
+                  (fuel := 0) (env := ([] : List IxIR0.Value))
+                  (uses := Uses.many)
+                  (body := Erase.lamManyN 4 (Erase.quotientCore .ind)))
+        | recrP hres hinfo hrm hi0 hidecl hmem =>
+          rename_i c p bc r
+          rw [hres] at hev
+          dsimp only at hev
+          rw [hinfo] at hev
+          dsimp only at hev
+          rw [hrm] at hev
+          dsimp only at hev
+          rw [bind_ok_iff] at hev
+          obtain ⟨_, _, hev⟩ := hev
+          injection hev with hv
+          subst hv
+          obtain ⟨bc₂, trules, hres2, hi0, hienv, hrules⟩ :
+              ∃ bc₂ trules,
+                Ixon.Eval.resolveMut ectx p.block p.idx.toNat =
+                  .ok (bc₂, .recr r) ∧
+                r.indices.toNat = 0 ∧
+                ictx.env (Erase.memberAddr p.block p.idx.toNat) =
+                  some (.recursor
+                    (r.params.toNat + r.motives.toNat + r.minors.toNat)
+                    (ectx.natBlock == some p.block) trules) ∧
+                RulesRel ectx ictx p.block p.idx.toNat r bc₂.refs
+                  (Ixon.selfMutsOf bc₂.info) r.rules.toList
+                  trules.toList := by
+            cases hmem with
+            | mk hres2 hparams hienv hrules =>
+              exact ⟨_, _, hres2, hi0, hienv, hrules⟩
+          have hbc : bc₂ = bc := by
+            have h1 := (resolveMut_ok hres2).1
+            rw [(resolveMut_ok hrm).1] at h1
+            injection h1 with h1'
+            exact h1'.symm
+          subst hbc
+          refine ⟨3, .pap (.rec_ (Erase.memberAddr p.block p.idx.toNat)
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) [], ?_, ?_,
+            .refDefn hidecl (.refRecursor hienv)⟩
+          · rw [IxIR0.eval.eq_def]
+            dsimp only
+            rw [hidecl]
+            dsimp only
+            rw [IxIR0.eval.eq_def]
+            dsimp only
+            rw [hienv]
+          · exact .papRec (resolveMut_ok hrm).1 rfl rfl rfl hmem hi0 rfl
+              (Nat.zero_le _)
+              (.stop (recRulePolicy r))
+    | appG hspine hj hpf =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rename_i f a f' r j
+      cases hf : Ixon.Eval.eval ectx n F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx n F env a with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨n₁, fv', hfv', hrelF, htraceF⟩ :=
+            ih n (by omega) ectx F env f fv sc mask ρ f' ictx
+              hmembers horacles hf hpf henv
+          obtain ⟨ob, F₂, sargs, hfv, hlen⟩ := recSpine_eval hspine hf
+          subst hfv
+          cases hrelF with
+          | papRec hresolve hFrefs hFmuts hFsa hmem hi0 hlen2 hle hcursor =>
+            rename_i block idx bc₃ targs rest
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                obtain ⟨hjlt, hget⟩ := getElem?_eq_some_iff.mp hj
+                have hdrop := List.drop_eq_getElem_cons
+                  (l := recRulePolicy r) hjlt
+                rw [hget] at hdrop
+                have hrest := hcursor.remaining_eq_drop
+                rw [hlen, hdrop] at hrest
+                rw [hrest] at hcursor
+                have hcursor' := hcursor.append_ghost
+                  (sarg := av) (targ := IxIR0.Value.erased)
+                have hi0 := recSpine_shape hspine
+                have hne : ((sargs ++ [av]).length ==
+                    Ixon.Eval.recArity r) = false := by
+                  rw [beq_eq_false_iff_ne]
+                  simp only [List.length_append, List.length_cons,
+                    List.length_nil, Ixon.Eval.recArity, hi0, Nat.add_zero,
+                    hlen]
+                  rw [recRulePolicy_length] at hjlt
+                  omega
+                rw [hne] at hev
+                simp at hev
+                subst hev
+                refine ⟨n₁ + 4, .pap (.rec_ (Erase.memberAddr block idx)
+                  (r.params.toNat + r.motives.toNat + r.minors.toNat + 1))
+                  (targs ++ [IxIR0.Value.erased]), ?_, ?_, ?_⟩
+                · rw [IxIR0.eval.eq_def]
+                  dsimp only
+                  rw [IxIR0.eval_mono (show n₁ ≤ n₁ + 3 by omega) hfv',
+                    bindOk]
+                  have hbox : IxIR0.eval ictx (n₁ + 3) ρ .erased =
+                      .ok .erased := by rw [IxIR0.eval.eq_def]
+                  rw [hbox, bindOk]
+                  rw [IxIR0.apply.eq_def]
+                  dsimp only
+                  rw [IxIR0.saturate.eq_def]
+                  dsimp only
+                  have hne2 : ((targs ++ [IxIR0.Value.erased]).length ==
+                      (r.params.toNat + r.motives.toNat +
+                        r.minors.toNat + 1)) = false := by
+                    rw [beq_eq_false_iff_ne]
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil, ← hlen2, hlen]
+                    rw [recRulePolicy_length] at hjlt
+                    omega
+                  simp only [IxIR0.Head.arity.eq_def, hne2]
+                  simp
+                · refine .papRec hresolve hFrefs hFmuts hFsa hmem hi0
+                    (by simp [hlen2])
+                    (by simpa [hlen] using Nat.succ_le_of_lt hjlt) hcursor'
+                · have hsaturate : IxIR0.ProjectionSafe.Saturate ictx
+                      (n₁ + 2)
+                      (.rec_ (Erase.memberAddr block idx)
+                        (r.params.toNat + r.motives.toNat +
+                          r.minors.toNat + 1))
+                      (targs ++ [.erased])
+                      (.pap (.rec_ (Erase.memberAddr block idx)
+                        (r.params.toNat + r.motives.toNat +
+                          r.minors.toNat + 1)) (targs ++ [.erased])) :=
+                    .pending (by
+                      simp only [IxIR0.Head.arity, List.length_append,
+                        List.length_cons, List.length_nil, ← hlen2, hlen]
+                      rw [recRulePolicy_length] at hjlt
+                      omega)
+                  exact .app (htraceF.mono_le (by omega)) .erased
+                    (.pap hsaturate)
+          | papRecI _ _ _ _ _ hipos _ _ =>
+            have hi0 := recSpine_shape hspine
+            omega
+          | papRecIW _ _ _ _ _ hipos _ _ _ =>
+            have hi0 := recSpine_shape hspine
+            omega
+    | appDG hspine hdrop hpf =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rename_i f a f' uses domain body
+      cases hf : Ixon.Eval.eval ectx n F env f with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx n F env a with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨n₁, fv', hfv', hrelF, htraceF⟩ :=
+            ih n (by omega) ectx F env f fv sc mask ρ f' ictx
+              hmembers horacles hf hpf henv
+          obtain ⟨closureFrame, closureEnv, hfv⟩ :=
+            defSpine_eval_clos hspine rfl hf
+          subst fv
+          cases hrelF with
+          | clos hdropC henvC hbodyC =>
+            rename_i scC maskC bC uC' ρC bodyC'
+            have hbC : bC = false := by
+              simpa [hdrop] using hdropC
+            have hbodyC' : PErase ectx ictx scC closureFrame.refs
+                closureFrame.selfMuts closureFrame.selfAddr
+                (false :: maskC) body bodyC' := by
+              rw [← hbC]
+              exact hbodyC
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ bodyFuel =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              obtain ⟨n₂, v', hv', hrel, htraceBody⟩ :=
+                ih bodyFuel (by omega) ectx closureFrame
+                  (av :: closureEnv) body v scC
+                  (false :: maskC) (.erased :: ρC) bodyC' ictx hmembers
+                  horacles hev hbodyC' (.drop henvC)
+              refine ⟨n₁ + n₂ + 2, v', ?_, hrel, ?_⟩
+              rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 1 by omega)
+                hfv', bindOk]
+              have herased : IxIR0.eval ictx (n₁ + n₂ + 1) ρ .erased =
+                  .ok .erased := by
+                rw [IxIR0.eval.eq_def]
+              rw [herased, bindOk]
+              rw [IxIR0.apply.eq_def]
+              dsimp only
+              exact IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ by omega) hv'
+              exact .app
+                (htraceF.mono_le (by omega))
+                .erased
+                (.clos (htraceBody.mono_le (by omega)))
+    | recP hspine =>
+      rename_i r
+      obtain ⟨n₁, block, idx, F₂, bc, sargs, targs, hv, hv', htrace,
+          hresolve,
+          hFrefs, hFmuts, hFsa, hmem, hipos, hcursor⟩ :=
+        recEraseSpine_sim ih hmembers horacles hspine (by omega) hev henv
+      obtain ⟨ruleArgs, indexArgs, hsargs, hindices, hfront⟩ :
+          ∃ ruleArgs indexArgs,
+            sargs = ruleArgs ++ indexArgs ∧
+            indexArgs.length = r.indices.toNat ∧
+            RuntimePolicyRel (ValRel ectx ictx) (recRulePolicy r)
+              ruleArgs targs := by
+        simpa [recPolicy] using
+          (hcursor.split_suffix_drops
+            (policies := recRulePolicy r) (n := r.indices.toNat))
+      subst v
+      rw [hsargs]
+      exact ⟨n₁, _, hv', .papRecI hresolve hFrefs hFmuts hFsa hmem
+        hipos hindices hfront, htrace⟩
+    | recW hspine hremaining =>
+      rename_i e' r remaining
+      obtain ⟨n₁, block, idx, F₂, bc, sargs, targs, hv, hv', htrace,
+          hresolve, hFrefs, hFmuts, hFsa, hmem, hipos, hcursor⟩ :=
+        recEraseSpine_sim ih hmembers horacles hspine (by omega) hev henv
+      subst v
+      cases remaining with
+      | zero => omega
+      | succ remaining =>
+        let targetPap : IxIR0.Value :=
+          .pap (.rec_ (Erase.memberAddr block idx)
+            (r.params.toNat + r.motives.toNat + r.minors.toNat + 1)) targs
+        have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx (n₁ + 1)
+            (targetPap :: ρ)
+            (Erase.lamManyN (remaining + 1) (.var (remaining + 1)))
+            (.clos .many (targetPap :: ρ)
+              (Erase.lamManyN remaining (.var (remaining + 1)))) := by
+          simpa [Erase.lamManyN] using
+            (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx) (fuel := n₁)
+              (env := targetPap :: ρ) (uses := Uses.many)
+              (body := Erase.lamManyN remaining (.var (remaining + 1))))
+        have htargetTrace : IxIR0.ProjectionSafe.Eval ictx (n₁ + 2) ρ
+            (Erase.captureThenIgnoreN (remaining + 1) e')
+            (.clos .many (targetPap :: ρ)
+              (Erase.lamManyN remaining (.var (remaining + 1)))) := by
+          simpa [Erase.captureThenIgnoreN] using
+            (IxIR0.ProjectionSafe.Eval.letE
+              (htrace.mono_le (by omega)) hbodyTrace)
+        refine ⟨n₁ + 2, _, htargetTrace.run, ?_, htargetTrace⟩
+        simpa [targetPap] using
+          (ValRel.papRecIW hresolve hFrefs hFmuts hFsa hmem hipos
+            (show 0 < remaining + 1 by omega) (by simp) hcursor
+            : ValRel ectx ictx
+                (.papV (.recH (some block) r F₂) sargs)
+                (.clos .many
+                  ([].reverse ++ targetPap :: ρ)
+                  (Erase.lamManyN ((remaining + 1) - 1)
+                    (.var (remaining + 1)))))
+    | app hpf hpa =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rename_i fS aS fT aT
+      cases hf : Ixon.Eval.eval ectx n F env fS with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx n F env aS with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          obtain ⟨n₁, fv', hfv', hrelF, htraceF⟩ :=
+            ih n (by omega) ectx F env fS fv sc mask ρ fT ictx
+              hmembers horacles hf hpf henv
+          obtain ⟨n₂, av', hav', hrelA, htraceA⟩ :=
+            ih n (by omega) ectx F env aS av sc mask ρ aT ictx
+              hmembers horacles ha hpa henv
+          cases hrelF with
+          | sort =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            cases n <;> simp at hev
+          | pi =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            cases n <;> simp at hev
+          | litNat =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            cases n <;> simp at hev
+          | litStr =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            cases n <;> simp at hev
+          | ctorV _ _ _ _ =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            cases n <;> simp at hev
+          | quotV _ =>
+            rw [Ixon.Eval.apply.eq_def] at hev
+            cases n <;> simp at hev
+          | quotType =>
+            rename_i address sourceArgs
+            have hvalue : v = .papV (.quotH address .type)
+                (sourceArgs ++ [av]) := by
+              cases n with
+              | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+              | succ g =>
+                rw [Ixon.Eval.apply.eq_def] at hev
+                dsimp only at hev
+                cases g with
+                | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+                | succ g' =>
+                  rw [Ixon.Eval.saturate.eq_def] at hev
+                  dsimp only at hev
+                  simp only [Ixon.Eval.Head.arity?, Ixon.Eval.quotArity] at hev
+                  cases hcmp : (sourceArgs ++ [av]).length == 2 with
+                  | false => rw [hcmp] at hev; simpa using hev.symm
+                  | true =>
+                    rw [hcmp] at hev
+                    simp only [if_true] at hev
+                    cases g' with
+                    | zero => rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+                    | succ g'' =>
+                      rw [Ixon.Eval.fire.eq_def] at hev
+                      dsimp only at hev
+                      injection hev with hv
+                      exact hv.symm
+            subst v
+            refine ⟨n₁ + n₂ + 3, .erased, ?_, .quotType, ?_⟩
+            · rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 2 by omega)
+                hfv', bindOk]
+              rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 2 by omega)
+                hav', bindOk]
+              rw [IxIR0.apply.eq_def]
+            · exact .app
+                (htraceF.mono_le (by omega))
+                (htraceA.mono_le (by omega))
+                .erased
+          | papQuot hkind hlt hargs =>
+            rename_i address kind sourceArgs targetArgs
+            have hlength := valsRel_length hargs
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                dsimp only at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                cases hcmp : (sourceArgs ++ [av]).length ==
+                    Ixon.Eval.quotArity kind with
+                | false =>
+                  rw [hcmp] at hev
+                  simp only [Bool.false_eq_true, if_false] at hev
+                  injection hev with hvalue
+                  subst hvalue
+                  have hlt' : (sourceArgs ++ [av]).length <
+                      Ixon.Eval.quotArity kind := by
+                    have hne := ne_of_beq_false hcmp
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil] at hne ⊢
+                    omega
+                  have hargs' : ValsRel ectx ictx (sourceArgs ++ [av])
+                      (targetArgs ++ [av']) :=
+                    valsRel_append hargs hrelA
+                  have hexponent :
+                      Ixon.Eval.quotArity kind - sourceArgs.length - 1 =
+                        (Ixon.Eval.quotArity kind -
+                          (sourceArgs ++ [av]).length - 1) + 1 := by
+                    cases kind <;>
+                      simp_all [Ixon.Eval.quotArity] <;> omega
+                  have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx 1
+                      (av' :: targetArgs.reverse)
+                      (Erase.lamManyN
+                        (Ixon.Eval.quotArity kind - sourceArgs.length - 1)
+                        (Erase.quotientCore kind))
+                      (.clos .many (targetArgs ++ [av']).reverse
+                        (Erase.lamManyN
+                          (Ixon.Eval.quotArity kind -
+                            (sourceArgs ++ [av]).length - 1)
+                          (Erase.quotientCore kind))) := by
+                    rw [hexponent]
+                    simpa [Erase.lamManyN] using
+                      (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx)
+                        (fuel := 0) (env := av' :: targetArgs.reverse)
+                        (uses := Uses.many)
+                        (body := Erase.lamManyN
+                          (Ixon.Eval.quotArity kind -
+                            (sourceArgs ++ [av]).length - 1)
+                          (Erase.quotientCore kind)))
+                  have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 2
+                      (.clos .many targetArgs.reverse
+                        (Erase.lamManyN
+                          (Ixon.Eval.quotArity kind - sourceArgs.length - 1)
+                          (Erase.quotientCore kind))) av'
+                      (.clos .many (targetArgs ++ [av']).reverse
+                        (Erase.lamManyN
+                          (Ixon.Eval.quotArity kind -
+                            (sourceArgs ++ [av]).length - 1)
+                          (Erase.quotientCore kind))) :=
+                    .clos hbodyTrace
+                  have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                      (n₁ + n₂ + 3) ρ (.app fT aT)
+                      (.clos .many (targetArgs ++ [av']).reverse
+                        (Erase.lamManyN
+                          (Ixon.Eval.quotArity kind -
+                            (sourceArgs ++ [av]).length - 1)
+                          (Erase.quotientCore kind))) :=
+                    .app (htraceF.mono_le (by omega))
+                      (htraceA.mono_le (by omega))
+                      (happlyTrace.mono_le (by omega))
+                  exact ⟨_, _, htargetTrace.run,
+                    .papQuot hkind hlt' hargs', htargetTrace⟩
+                | true =>
+                  rw [hcmp] at hev
+                  simp only [if_true] at hev
+                  cases g' with
+                  | zero => rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+                  | succ g'' =>
+                    rw [Ixon.Eval.fire.eq_def] at hev
+                    dsimp only at hev
+                    cases kind with
+                    | type => exact absurd rfl hkind
+                    | ctor =>
+                      have hsourceLength : sourceArgs.length = 2 := by
+                        have heq := (beq_iff_eq).mp hcmp
+                        simp only [List.length_append, List.length_cons,
+                          List.length_nil, Ixon.Eval.quotArity] at heq
+                        omega
+                      have hrepresentative :
+                          (sourceArgs ++ [av])[2]? = some av := by
+                        rw [← hsourceLength]
+                        exact List.getElem?_concat_length
+                      rw [hrepresentative] at hev
+                      injection hev with hvalue
+                      subst hvalue
+                      have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx 1
+                          (av' :: targetArgs.reverse)
+                          (Erase.lamManyN
+                            (Ixon.Eval.quotArity .ctor -
+                              sourceArgs.length - 1)
+                            (Erase.quotientCore .ctor)) av' := by
+                        simpa [hsourceLength, Ixon.Eval.quotArity,
+                          Erase.lamManyN, Erase.quotientCore] using
+                          (IxIR0.ProjectionSafe.Eval.var (ctx := ictx)
+                            (fuel := 0)
+                            (env := av' :: targetArgs.reverse)
+                            (index := 0) (value := av') rfl)
+                      have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 2
+                          (.clos .many targetArgs.reverse
+                            (Erase.lamManyN
+                              (Ixon.Eval.quotArity .ctor -
+                                sourceArgs.length - 1)
+                              (Erase.quotientCore .ctor))) av' av' :=
+                        .clos hbodyTrace
+                      have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                          (n₁ + n₂ + 3) ρ (.app fT aT) av' :=
+                        .app (htraceF.mono_le (by omega))
+                          (htraceA.mono_le (by omega))
+                          (happlyTrace.mono_le (by omega))
+                      exact ⟨_, _, htargetTrace.run, .quotV hrelA,
+                        htargetTrace⟩
+                    | lift =>
+                      have hsourceLength : sourceArgs.length = 5 := by
+                        have heq := (beq_iff_eq).mp hcmp
+                        simp only [List.length_append, List.length_cons,
+                          List.length_nil, Ixon.Eval.quotArity] at heq
+                        omega
+                      have hfunctionBound : 3 < sourceArgs.length := by omega
+                      let sourceFunction := sourceArgs[3]
+                      have hfunction : sourceArgs[3]? =
+                          some sourceFunction :=
+                        List.getElem?_eq_getElem hfunctionBound
+                      have hfunction' : (sourceArgs ++ [av])[3]? =
+                          some sourceFunction := by
+                        rw [List.getElem?_append_left hfunctionBound]
+                        exact hfunction
+                      have hquotient : (sourceArgs ++ [av])[5]? = some av := by
+                        rw [← hsourceLength]
+                        exact List.getElem?_concat_length
+                      rw [hfunction', hquotient] at hev
+                      simp only at hev
+                      cases hrep : Ixon.Eval.quotientRep? av with
+                      | none => rw [hrep] at hev; contradiction
+                      | some representative =>
+                        rw [hrep] at hev
+                        dsimp only at hev
+                        obtain ⟨targetFunction, htargetFunction,
+                            hfunctionRel⟩ :=
+                          valsRel_lookup 3 hargs sourceFunction hfunction
+                        have hrepresentativeRel :
+                            ValRel ectx ictx representative av' :=
+                          quotientRep_valRel hrelA hrep
+                        obtain ⟨targetFuel, targetResult, htargetApply,
+                            hresultRel, htargetApplyTrace⟩ :=
+                          applyRel_sim ih hmembers horacles (by omega) hev
+                            hfunctionRel
+                            hrepresentativeRel
+                        have htargetLength : targetArgs.length = 5 := by
+                          omega
+                        have hreverse : targetArgs.reverse[1]? =
+                            some targetFunction := by
+                          rw [List.getElem?_reverse'
+                            (l := targetArgs) (i := 1) (j := 3) (by omega)]
+                          exact htargetFunction
+                        have hlookup :
+                            (av' :: targetArgs.reverse)[2]? =
+                              some targetFunction := by simpa using hreverse
+                        have hcoreTrace : IxIR0.ProjectionSafe.Eval ictx
+                            (targetFuel + 2) (av' :: targetArgs.reverse)
+                            (Erase.quotientCore .lift) targetResult := by
+                          simpa [Erase.quotientCore] using
+                            (IxIR0.ProjectionSafe.Eval.app
+                              (IxIR0.ProjectionSafe.Eval.var
+                                (ctx := ictx) (fuel := targetFuel)
+                                (env := av' :: targetArgs.reverse)
+                                (index := 2) (value := targetFunction) hlookup)
+                              (IxIR0.ProjectionSafe.Eval.var
+                                (ctx := ictx) (fuel := targetFuel)
+                                (env := av' :: targetArgs.reverse)
+                                (index := 0) (value := av') rfl)
+                              htargetApplyTrace.mono)
+                        have hclosureApply : IxIR0.ProjectionSafe.Apply ictx
+                            (targetFuel + 3)
+                            (.clos .many targetArgs.reverse
+                              (Erase.lamManyN
+                                (Ixon.Eval.quotArity .lift -
+                                  sourceArgs.length - 1)
+                                (Erase.quotientCore .lift))) av'
+                            targetResult := by
+                          simpa [hsourceLength, Ixon.Eval.quotArity,
+                            Erase.lamManyN] using
+                            (IxIR0.ProjectionSafe.Apply.clos hcoreTrace)
+                        have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                            (n₁ + n₂ + targetFuel + 4) ρ
+                            (.app fT aT) targetResult :=
+                          .app (htraceF.mono_le (by omega))
+                            (htraceA.mono_le (by omega))
+                            (hclosureApply.mono_le (by omega))
+                        exact ⟨_, _, htargetTrace.run, hresultRel,
+                          htargetTrace⟩
+                    | ind =>
+                      have hsourceLength : sourceArgs.length = 4 := by
+                        have heq := (beq_iff_eq).mp hcmp
+                        simp only [List.length_append, List.length_cons,
+                          List.length_nil, Ixon.Eval.quotArity] at heq
+                        omega
+                      have hmotiveBound : 3 < sourceArgs.length := by omega
+                      let sourceMotive := sourceArgs[3]
+                      have hmotive : sourceArgs[3]? = some sourceMotive :=
+                        List.getElem?_eq_getElem hmotiveBound
+                      have hmotive' : (sourceArgs ++ [av])[3]? =
+                          some sourceMotive := by
+                        rw [List.getElem?_append_left hmotiveBound]
+                        exact hmotive
+                      have hquotient : (sourceArgs ++ [av])[4]? = some av := by
+                        rw [← hsourceLength]
+                        exact List.getElem?_concat_length
+                      rw [hmotive', hquotient] at hev
+                      simp only at hev
+                      cases hrep : Ixon.Eval.quotientRep? av with
+                      | none => rw [hrep] at hev; contradiction
+                      | some representative =>
+                        rw [hrep] at hev
+                        dsimp only at hev
+                        obtain ⟨targetMotive, htargetMotive, hmotiveRel⟩ :=
+                          valsRel_lookup 3 hargs sourceMotive hmotive
+                        have hrepresentativeRel :
+                            ValRel ectx ictx representative av' :=
+                          quotientRep_valRel hrelA hrep
+                        obtain ⟨targetFuel, targetResult, htargetApply,
+                            hresultRel, htargetApplyTrace⟩ :=
+                          applyRel_sim ih hmembers horacles (by omega) hev
+                            hmotiveRel
+                            hrepresentativeRel
+                        have htargetLength : targetArgs.length = 4 := by
+                          omega
+                        have hreverse : targetArgs.reverse[0]? =
+                            some targetMotive := by
+                          rw [List.getElem?_reverse'
+                            (l := targetArgs) (i := 0) (j := 3) (by omega)]
+                          exact htargetMotive
+                        have hlookup :
+                            (av' :: targetArgs.reverse)[1]? =
+                              some targetMotive := by simpa using hreverse
+                        have hcoreTrace : IxIR0.ProjectionSafe.Eval ictx
+                            (targetFuel + 2) (av' :: targetArgs.reverse)
+                            (Erase.quotientCore .ind) targetResult := by
+                          simpa [Erase.quotientCore] using
+                            (IxIR0.ProjectionSafe.Eval.app
+                              (IxIR0.ProjectionSafe.Eval.var
+                                (ctx := ictx) (fuel := targetFuel)
+                                (env := av' :: targetArgs.reverse)
+                                (index := 1) (value := targetMotive) hlookup)
+                              (IxIR0.ProjectionSafe.Eval.var
+                                (ctx := ictx) (fuel := targetFuel)
+                                (env := av' :: targetArgs.reverse)
+                                (index := 0) (value := av') rfl)
+                              htargetApplyTrace.mono)
+                        have hclosureApply : IxIR0.ProjectionSafe.Apply ictx
+                            (targetFuel + 3)
+                            (.clos .many targetArgs.reverse
+                              (Erase.lamManyN
+                                (Ixon.Eval.quotArity .ind -
+                                  sourceArgs.length - 1)
+                                (Erase.quotientCore .ind))) av'
+                            targetResult := by
+                          simpa [hsourceLength, Ixon.Eval.quotArity,
+                            Erase.lamManyN] using
+                            (IxIR0.ProjectionSafe.Apply.clos hcoreTrace)
+                        have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                            (n₁ + n₂ + targetFuel + 4) ρ
+                            (.app fT aT) targetResult :=
+                          .app (htraceF.mono_le (by omega))
+                            (htraceA.mono_le (by omega))
+                            (hclosureApply.mono_le (by omega))
+                        exact ⟨_, _, htargetTrace.run, hresultRel,
+                          htargetTrace⟩
+          | papExtern hconfigured hlt hargs =>
+            rename_i address arity sourceArgs targetArgs
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ sourceFuel =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              have hargs' : ValsRel ectx ictx (sourceArgs ++ [av])
+                  (targetArgs ++ [av']) := valsRel_append hargs hrelA
+              obtain ⟨targetFuel, targetValue, htargetSaturate, hresultRel,
+                  htargetSaturateTrace⟩ :=
+                externSaturate_sim horacles hconfigured (by simp; omega)
+                  hargs' hev
+              have htargetApply : IxIR0.apply ictx (targetFuel + 1)
+                  (.pap (.ext address arity) targetArgs) av' =
+                    .ok targetValue := by
+                rw [IxIR0.apply.eq_def]
+                dsimp only
+                exact htargetSaturate
+              have htargetApplyTrace : IxIR0.ProjectionSafe.Apply ictx
+                  (targetFuel + 1) (.pap (.ext address arity) targetArgs) av'
+                  targetValue := .pap htargetSaturateTrace
+              refine ⟨n₁ + n₂ + targetFuel + 2, targetValue, ?_,
+                hresultRel, ?_⟩
+              · rw [IxIR0.eval.eq_def]
+                dsimp only
+                rw [IxIR0.eval_mono
+                  (show n₁ ≤ n₁ + n₂ + targetFuel + 1 by omega) hfv',
+                  bindOk]
+                rw [IxIR0.eval_mono
+                  (show n₂ ≤ n₁ + n₂ + targetFuel + 1 by omega) hav',
+                  bindOk]
+                exact IxIR0.apply_mono
+                  (show targetFuel + 1 ≤ n₁ + n₂ + targetFuel + 1 by omega)
+                  htargetApply
+              · exact .app
+                  (htraceF.mono_le (by omega))
+                  (htraceA.mono_le (by omega))
+                  (htargetApplyTrace.mono_le (by omega))
+          | clos hdropC henvC hbodyC =>
+            rename_i scC maskC bC uC FC envC domC bodyC uC' ρC bodyC'
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              have henv' : EnvRel ectx ictx scC FC.refs FC.selfMuts
+                  FC.selfAddr (bC :: maskC) (av :: envC) (av' :: ρC) := by
+                cases bC
+                · exact .drop henvC
+                · exact .keep hrelA henvC
+              obtain ⟨n₃, v', hv', hrel, htraceBody⟩ :=
+                ih g (by omega) ectx FC (av :: envC) bodyC v scC (bC :: maskC)
+                  (av' :: ρC) bodyC' ictx hmembers horacles hev hbodyC henv'
+              refine ⟨n₁ + n₂ + n₃ + 2, v', ?_, hrel, ?_⟩
+              rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + n₃ + 1 by omega)
+                hfv', bindOk]
+              rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + n₃ + 1 by omega)
+                hav', bindOk]
+              rw [IxIR0.apply.eq_def]
+              dsimp only
+              exact IxIR0.eval_mono (show n₃ ≤ n₁ + n₂ + n₃ by omega) hv'
+              exact .app
+                (htraceF.mono_le (by omega))
+                (htraceA.mono_le (by omega))
+                (.clos (htraceBody.mono_le (by omega)))
+          | inductiveType hres hinfo =>
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                injection hev with hv
+                subst hv
+                refine ⟨n₁ + n₂ + 3, .erased, ?_,
+                  .inductiveType hres hinfo, ?_⟩
+                rw [IxIR0.eval.eq_def]
+                dsimp only
+                rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 2 by omega)
+                  hfv', bindOk]
+                rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 2 by omega)
+                  hav', bindOk]
+                rw [IxIR0.apply.eq_def]
+                exact .app
+                  (htraceF.mono_le (by omega))
+                  (htraceA.mono_le (by omega))
+                  .erased
+          | inductiveMember hresolve hmember =>
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                injection hev with hv
+                subst hv
+                refine ⟨n₁ + n₂ + 3, .erased, ?_,
+                  .inductiveMember hresolve hmember, ?_⟩
+                rw [IxIR0.eval.eq_def]
+                dsimp only
+                rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 2 by omega)
+                  hfv', bindOk]
+                rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 2 by omega)
+                  hav', bindOk]
+                rw [IxIR0.apply.eq_def]
+                exact .app
+                  (htraceF.mono_le (by omega))
+                  (htraceA.mono_le (by omega))
+                  .erased
+          | papCtorParams hshape haddr hidecl harity hparams =>
+            rename_i block indIdx cidx params fields arity sargs a targetEnv
+            subst arity
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                by_cases hstill : (sargs ++ [av]).length < params
+                · have hcmp : ((sargs ++ [av]).length ==
+                      params + fields) = false := by
+                    rw [beq_eq_false_iff_ne]
+                    omega
+                  rw [hcmp] at hev
+                  simp at hev
+                  subst v
+                  have hremaining : params - sargs.length - 1 =
+                      (params - (sargs ++ [av]).length - 1) + 1 := by
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil] at hstill ⊢
+                    omega
+                  have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx 1
+                      (av' :: targetEnv)
+                      (Erase.lamManyN (params - sargs.length - 1) (.ref a))
+                      (.clos .many (av' :: targetEnv)
+                        (Erase.lamManyN
+                          (params - (sargs ++ [av]).length - 1) (.ref a))) := by
+                    rw [hremaining]
+                    simpa [Erase.lamManyN] using
+                      (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx) (fuel := 0)
+                        (env := av' :: targetEnv) (uses := Uses.many)
+                        (body := Erase.lamManyN
+                          (params - (sargs ++ [av]).length - 1) (.ref a)))
+                  have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 2
+                      (.clos .many targetEnv
+                        (Erase.lamManyN (params - sargs.length - 1) (.ref a)))
+                      av'
+                      (.clos .many (av' :: targetEnv)
+                        (Erase.lamManyN
+                          (params - (sargs ++ [av]).length - 1) (.ref a))) :=
+                    .clos hbodyTrace
+                  have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                      (n₁ + n₂ + 3) ρ (.app fT aT)
+                      (.clos .many (av' :: targetEnv)
+                        (Erase.lamManyN
+                          (params - (sargs ++ [av]).length - 1) (.ref a))) :=
+                    .app (htraceF.mono_le (by omega))
+                      (htraceA.mono_le (by omega))
+                      (happlyTrace.mono_le (by omega))
+                  exact ⟨_, _, htargetTrace.run,
+                    .papCtorParams hshape haddr hidecl rfl hstill,
+                    htargetTrace⟩
+                · have hfull : (sargs ++ [av]).length = params := by
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil] at hstill ⊢
+                    omega
+                  have hbody : params - sargs.length - 1 = 0 := by
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil] at hfull
+                    omega
+                  have hdrop : (sargs ++ [av]).drop params = [] :=
+                    List.drop_eq_nil_of_le (by omega)
+                  have hargs : ValsRel ectx ictx
+                      ((sargs ++ [av]).drop params) [] := by
+                    rw [hdrop]
+                    exact .nil
+                  cases fields with
+                  | zero =>
+                    have hcmp : ((sargs ++ [av]).length == params + 0) = true :=
+                      beq_iff_eq.mpr (by omega)
+                    rw [hcmp] at hev
+                    simp at hev
+                    cases g' with
+                    | zero => rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+                    | succ g'' =>
+                      rw [Ixon.Eval.fire.eq_def] at hev
+                      dsimp only at hev
+                      injection hev with hv
+                      subst v
+                      have hcursor : PolicyRel (fun _ _ => True)
+                          IxIR0.Value.erased (ctorPolicy params 0)
+                          (sargs ++ [av]) [] := by
+                        have hc := PolicyPrefix.ctor_of_fields
+                          (R := fun _ _ => True) (ghost := IxIR0.Value.erased)
+                          (show params ≤ (sargs ++ [av]).length by omega)
+                          (show (sargs ++ [av]).length ≤ params + 0 by omega)
+                          (show ListRel (fun _ _ => True)
+                              ((sargs ++ [av]).drop params) [] by
+                            rw [hdrop]
+                            exact .nil)
+                        simpa [hfull] using hc
+                      have hsaturate : IxIR0.ProjectionSafe.Saturate ictx 2
+                          (.ctor a cidx 0) [] (.ctor a cidx []) :=
+                        .full (by simp [IxIR0.Head.arity]) .ctor
+                      have hrefTrace : IxIR0.ProjectionSafe.Eval ictx 3
+                          (av' :: targetEnv) (.ref a) (.ctor a cidx []) :=
+                        .refCtor hidecl hsaturate
+                      have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 4
+                          (.clos .many targetEnv
+                            (Erase.lamManyN
+                              (params - sargs.length - 1) (.ref a)))
+                          av' (.ctor a cidx []) := by
+                        simpa [hbody, Erase.lamManyN] using
+                          (IxIR0.ProjectionSafe.Apply.clos hrefTrace)
+                      have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                          (n₁ + n₂ + 5) ρ (.app fT aT) (.ctor a cidx []) :=
+                        .app (htraceF.mono_le (by omega))
+                          (htraceA.mono_le (by omega))
+                          (happlyTrace.mono_le (by omega))
+                      exact ⟨_, _, htargetTrace.run,
+                        .ctorV hshape haddr hargs hcursor, htargetTrace⟩
+                  | succ fields' =>
+                    have hcmp : ((sargs ++ [av]).length ==
+                        params + (fields' + 1)) = false := by
+                      rw [beq_eq_false_iff_ne]
+                      omega
+                    rw [hcmp] at hev
+                    simp at hev
+                    subst v
+                    have hcursor : PolicyPrefix (fun _ _ => True)
+                        IxIR0.Value.erased (ctorPolicy params (fields' + 1))
+                        (sargs ++ [av]) []
+                        (List.replicate
+                          (params + (fields' + 1) - (sargs ++ [av]).length)
+                          .keep) :=
+                      PolicyPrefix.ctor_of_fields
+                        (show params ≤ (sargs ++ [av]).length by omega)
+                        (show (sargs ++ [av]).length ≤
+                            params + (fields' + 1) by omega)
+                        (show ListRel (fun _ _ => True)
+                            ((sargs ++ [av]).drop params) [] by
+                          rw [hdrop]
+                          exact .nil)
+                    have hsaturate : IxIR0.ProjectionSafe.Saturate ictx 1
+                        (.ctor a cidx (fields' + 1)) []
+                        (.pap (.ctor a cidx (fields' + 1)) []) :=
+                      .pending (by simp [IxIR0.Head.arity])
+                    have hrefTrace : IxIR0.ProjectionSafe.Eval ictx 2
+                        (av' :: targetEnv) (.ref a)
+                        (.pap (.ctor a cidx (fields' + 1)) []) :=
+                      .refCtor hidecl hsaturate
+                    have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 3
+                        (.clos .many targetEnv
+                          (Erase.lamManyN
+                            (params - sargs.length - 1) (.ref a)))
+                        av' (.pap (.ctor a cidx (fields' + 1)) []) := by
+                      simpa [hbody, Erase.lamManyN] using
+                        (IxIR0.ProjectionSafe.Apply.clos hrefTrace)
+                    have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                        (n₁ + n₂ + 4) ρ (.app fT aT)
+                        (.pap (.ctor a cidx (fields' + 1)) []) :=
+                      .app (htraceF.mono_le (by omega))
+                        (htraceA.mono_le (by omega))
+                        (happlyTrace.mono_le (by omega))
+                    exact ⟨_, _, htargetTrace.run,
+                      .papCtor hshape haddr rfl rfl (by omega) (by omega)
+                        hargs hcursor,
+                      htargetTrace⟩
+          | papCtor hshape haddr harity htarity hparams hlt hargs hcursor =>
+            rename_i block indIdx cidx params fields arity tarity sargs a
+              targs
+            subst arity
+            subst tarity
+            have hlen := valsRel_length hargs
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                cases hcmp : (sargs ++ [av]).length == params + fields with
+                | false =>
+                  rw [hcmp] at hev
+                  simp at hev
+                  subst hev
+                  have hne := ne_of_beq_false hcmp
+                  have hparams' : params ≤ (sargs ++ [av]).length := by
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil]
+                    omega
+                  have hdrop : (sargs ++ [av]).drop params =
+                      sargs.drop params ++ [av] :=
+                    drop_append_of_le sargs [av] params hparams
+                  have hargs' : ValsRel ectx ictx
+                      ((sargs ++ [av]).drop params) (targs ++ [av']) := by
+                    rw [hdrop]
+                    exact valsRel_append hargs hrelA
+                  have hlt' : (sargs ++ [av]).length < params + fields := by
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil] at hne ⊢
+                    omega
+                  have hcursor' : PolicyPrefix (fun _ _ => True) .erased
+                      (ctorPolicy params fields) (sargs ++ [av])
+                      (targs ++ [av'])
+                      (List.replicate
+                        (params + fields - (sargs ++ [av]).length) .keep) :=
+                    PolicyPrefix.ctor_of_fields hparams'
+                      (Nat.le_of_lt hlt') (trueListRel_of_valsRel hargs')
+                  refine ⟨n₁ + n₂ + 4,
+                    .pap (.ctor a cidx fields) (targs ++ [av']), ?_,
+                    .papCtor hshape haddr rfl rfl hparams' hlt' hargs'
+                      hcursor', ?_⟩
+                  rw [IxIR0.eval.eq_def]
+                  dsimp only
+                  rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 3 by omega)
+                    hfv', bindOk]
+                  rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 3 by omega)
+                    hav', bindOk]
+                  rw [IxIR0.apply.eq_def]
+                  dsimp only
+                  rw [IxIR0.saturate.eq_def]
+                  dsimp only
+                  have hc2 : ((targs ++ [av']).length == fields) = false := by
+                    rw [beq_eq_false_iff_ne] at hcmp ⊢
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil, List.length_drop] at hlen hcmp ⊢
+                    omega
+                  simp only [IxIR0.Head.arity.eq_def, hc2]
+                  simp
+                  have hsaturate : IxIR0.ProjectionSafe.Saturate ictx
+                      (n₁ + n₂ + 2) (.ctor a cidx fields)
+                      (targs ++ [av'])
+                      (.pap (.ctor a cidx fields) (targs ++ [av'])) :=
+                    .pending (by
+                      have hsourceNe := ne_of_beq_false hcmp
+                      simp only [List.length_append, List.length_cons,
+                        List.length_nil, List.length_drop] at hlen hsourceNe ⊢
+                      simp only [IxIR0.Head.arity]
+                      omega)
+                  exact .app
+                    (htraceF.mono_le (by omega))
+                    (htraceA.mono_le (by omega))
+                    (.pap hsaturate)
+                | true =>
+                  rw [hcmp] at hev
+                  simp at hev
+                  cases g' with
+                  | zero => rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+                  | succ g'' =>
+                    rw [Ixon.Eval.fire.eq_def] at hev
+                    dsimp only at hev
+                    injection hev with hv
+                    subst hv
+                    have heq := (beq_iff_eq).mp hcmp
+                    have hparams' : params ≤ (sargs ++ [av]).length := by
+                      simp only [List.length_append, List.length_cons,
+                        List.length_nil]
+                      omega
+                    have hdrop : (sargs ++ [av]).drop params =
+                        sargs.drop params ++ [av] :=
+                      drop_append_of_le sargs [av] params hparams
+                    have hargs' : ValsRel ectx ictx
+                        ((sargs ++ [av]).drop params) (targs ++ [av']) := by
+                      rw [hdrop]
+                      exact valsRel_append hargs hrelA
+                    have hcursor' : PolicyRel (fun _ _ => True) .erased
+                        (ctorPolicy params fields) (sargs ++ [av])
+                        (targs ++ [av']) := by
+                      have hc := PolicyPrefix.ctor_of_fields
+                        (ghost := IxIR0.Value.erased) hparams'
+                        (show (sargs ++ [av]).length ≤ params + fields by
+                          omega)
+                        (trueListRel_of_valsRel hargs')
+                      simpa [heq] using hc
+                    refine ⟨n₁ + n₂ + 5,
+                      .ctor a cidx (targs ++ [av']), ?_,
+                      .ctorV hshape haddr hargs' hcursor', ?_⟩
+                    rw [IxIR0.eval.eq_def]
+                    dsimp only
+                    rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 4 by omega)
+                      hfv', bindOk]
+                    rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 4 by omega)
+                      hav', bindOk]
+                    rw [IxIR0.apply.eq_def]
+                    dsimp only
+                    rw [IxIR0.saturate.eq_def]
+                    dsimp only
+                    have hc2 : ((targs ++ [av']).length == fields) = true := by
+                      rw [beq_iff_eq]
+                      simp only [List.length_append, List.length_cons,
+                        List.length_nil, List.length_drop] at hlen heq ⊢
+                      omega
+                    simp only [IxIR0.Head.arity.eq_def, hc2]
+                    simp only [if_true]
+                    rw [IxIR0.fire.eq_def]
+                    have hsaturate : IxIR0.ProjectionSafe.Saturate ictx
+                        (n₁ + n₂ + 3) (.ctor a cidx fields)
+                        (targs ++ [av']) (.ctor a cidx (targs ++ [av'])) :=
+                      .full (by
+                        simp only [IxIR0.Head.arity, List.length_append,
+                          List.length_cons, List.length_nil,
+                          List.length_drop] at hlen heq ⊢
+                        omega) .ctor
+                    exact .app
+                      (htraceF.mono_le (by omega))
+                      (htraceA.mono_le (by omega))
+                      (.pap hsaturate)
+          | papRec hresolve hFrefs hFmuts hFsa hmem hi0 hlen2 hle hcursor =>
+            rename_i block idx r F₂ bc₃ sargs targs rest
+            have hrestSlots : SlotPolicies rest := by
+              rw [hcursor.remaining_eq_drop]
+              exact (recRulePolicy_slots r).dropN sargs.length
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                cases hcmp : ((sargs ++ [av]).length ==
+                    Ixon.Eval.recArity r) with
+                | false =>
+                  rw [hcmp] at hev
+                  simp at hev
+                  subst hev
+                  have hne : (sargs ++ [av]).length ≠
+                      Ixon.Eval.recArity r := by
+                    exact ne_of_beq_false hcmp
+                  cases rest with
+                  | nil =>
+                    have hslen := hcursor.source_length
+                    simp only [List.length_nil, Nat.add_zero] at hslen
+                    exfalso
+                    apply hne
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil, Ixon.Eval.recArity, hi0,
+                      Nat.add_zero]
+                    rw [recRulePolicy_length] at hslen
+                    omega
+                  | cons policy rest =>
+                    have hcursor' : RuntimePolicyPrefix (ValRel ectx ictx)
+                        (recRulePolicy r) (sargs ++ [av]) (targs ++ [av'])
+                        rest := by
+                      cases hrestSlots with
+                      | keep _ => exact hcursor.append_keep hrelA
+                      | ghost _ => exact hcursor.append_ghost
+                    refine ⟨n₁ + n₂ + 4,
+                      .pap (.rec_ (Erase.memberAddr block idx)
+                        (r.params.toNat + r.motives.toNat +
+                          r.minors.toNat + 1))
+                        (targs ++ [av']), ?_, ?_, ?_⟩
+                    · rw [IxIR0.eval.eq_def]
+                      dsimp only
+                      rw [IxIR0.eval_mono (show n₁ ≤ n₁ + n₂ + 3 by omega)
+                        hfv', bindOk]
+                      rw [IxIR0.eval_mono (show n₂ ≤ n₁ + n₂ + 3 by omega)
+                        hav', bindOk]
+                      rw [IxIR0.apply.eq_def]
+                      dsimp only
+                      rw [IxIR0.saturate.eq_def]
+                      dsimp only
+                      have hc2 : ((targs ++ [av']).length ==
+                          (r.params.toNat + r.motives.toNat +
+                            r.minors.toNat + 1)) = false := by
+                        rw [beq_eq_false_iff_ne]
+                        intro heq
+                        apply hne
+                        simp only [List.length_append, List.length_cons,
+                          List.length_nil, Ixon.Eval.recArity, hi0,
+                          Nat.add_zero] at heq ⊢
+                        omega
+                      simp only [IxIR0.Head.arity.eq_def, hc2]
+                      simp
+                    · refine .papRec hresolve hFrefs hFmuts hFsa hmem hi0
+                        (by simp [hlen2]) ?_ hcursor'
+                      have hsource := hcursor'.source_length
+                      omega
+                    · have hsaturate : IxIR0.ProjectionSafe.Saturate ictx
+                          (n₁ + n₂ + 2)
+                          (.rec_ (Erase.memberAddr block idx)
+                            (r.params.toNat + r.motives.toNat +
+                              r.minors.toNat + 1))
+                          (targs ++ [av'])
+                          (.pap (.rec_ (Erase.memberAddr block idx)
+                            (r.params.toNat + r.motives.toNat +
+                              r.minors.toNat + 1)) (targs ++ [av'])) :=
+                        .pending (by
+                          intro heq
+                          apply hne
+                          simp only [IxIR0.Head.arity, List.length_append,
+                            List.length_cons, List.length_nil,
+                            Ixon.Eval.recArity, hi0, Nat.add_zero] at heq ⊢
+                          omega)
+                      exact .app
+                        (htraceF.mono_le (by omega))
+                        (htraceA.mono_le (by omega))
+                        (.pap hsaturate)
+                | true =>
+                  rw [hcmp] at hev
+                  simp at hev
+                  have hslen : sargs.length =
+                      (recRulePolicy r).length := by
+                    have h := (beq_iff_eq).mp hcmp
+                    simp only [List.length_append, List.length_cons,
+                      List.length_nil, Ixon.Eval.recArity, hi0,
+                      Nat.add_zero] at h
+                    rw [recRulePolicy_length]
+                    omega
+                  have hrestLen : rest.length = 0 := by
+                    have hsource := hcursor.source_length
+                    omega
+                  have hrest : rest = [] :=
+                    List.length_eq_zero_iff.mp hrestLen
+                  subst rest
+                  -- the fired major must analyze as a constructor
+                  have hmc : ∃ checked p,
+                      Ixon.Eval.guardRecMajor (some block) r.params.toNat av =
+                        .ok checked ∧
+                      Ixon.Eval.majorCtor
+                        (ectx.natBlock == some block) av = .ok p := by
+                    cases g' with
+                    | zero =>
+                      rw [Ixon.Eval.fire.eq_def] at hev; simp at hev
+                    | succ g'' =>
+                      rw [Ixon.Eval.fire.eq_def] at hev
+                      dsimp only at hev
+                      rw [List.getLast?_concat] at hev
+                      dsimp only at hev
+                      simp only [Option.isSome_some, Bool.true_and] at hev
+                      simp [hstrict.neutralElims, hstrict.stringLiterals,
+                        bindOk] at hev
+                      cases hgmajor : Ixon.Eval.guardRecMajor (some block)
+                          r.params.toNat av with
+                      | error e =>
+                        rw [hgmajor, bindErr] at hev
+                        simp at hev
+                      | ok checked =>
+                        rw [hgmajor, bindOk] at hev
+                        cases hm : Ixon.Eval.majorCtor
+                            (ectx.natBlock == some block) av with
+                        | error e => rw [hm, bindErr] at hev; simp at hev
+                        | ok p => exact ⟨checked, p, rfl, rfl⟩
+                  obtain ⟨checked, p0, hguard, hmc⟩ := hmc
+                  have hfire0 : Ixon.Eval.fire ectx g'
+                      (.recH (some block) r F₂)
+                      ((sargs ++ []) ++ [av]) = .ok v := by
+                    simpa using hev
+                  cases hrelA with
+                  | sort => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | pi => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | clos _ _ _ => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | litStr => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | quotV _ => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | quotType => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papQuot _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papExtern _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papCtor _ _ _ _ _ _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papCtorParams _ _ _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papRec _ _ _ _ _ _ _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papRecI _ _ _ _ _ _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | papRecIW _ _ _ _ _ _ _ _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | inductiveType _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | inductiveMember _ _ =>
+                    simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                  | ctorV hshape _haddr hfargs hctorCursor =>
+                    rename_i cblock cindIdx ccidx cparams cfields ccargs2 ca
+                      tflds
+                    have hmcS : Ixon.Eval.majorCtor
+                        (ectx.natBlock == some block)
+                        (.ctorV cblock cindIdx ccidx ccargs2) =
+                        .ok (ccidx, ccargs2) := by
+                      simp [Ixon.Eval.majorCtor.eq_def]
+                    have htmc : IxIR0.majorCtor
+                        (ectx.natBlock == some block)
+                        (.ctor ca ccidx tflds) = .ok (ccidx, tflds) := by
+                      simp [IxIR0.majorCtor.eq_def]
+                    have hcparams :=
+                      recMember_ctor_params hmem hguard hshape
+                    rw [hcparams] at hfargs
+                    exact fireSim ih hmembers horacles (by omega) hresolve
+                      hFrefs hFmuts hFsa
+                      hmem (indexArgs := []) hlen2 hslen hcursor hmcS htmc
+                      hfargs hfire0 hfv' hav' htraceF htraceA
+                  | litNat =>
+                    rename_i nn
+                    have hp0 : r.params.toNat = 0 := by
+                      simp only [Ixon.Eval.guardRecMajor] at hguard
+                      split at hguard
+                      · rename_i hp
+                        exact (beq_iff_eq.mp hp)
+                      · simp at hguard
+                    cases hNB : (ectx.natBlock == some block) with
+                    | false =>
+                      simp [Ixon.Eval.majorCtor.eq_def, hNB] at hmc
+                    | true =>
+                      cases nn with
+                      | zero =>
+                        have hmcS : Ixon.Eval.majorCtor
+                            (ectx.natBlock == some block)
+                            (.litV (.natL 0)) = .ok (0, []) := by
+                          simp [Ixon.Eval.majorCtor.eq_def, hNB]
+                        have htmc : IxIR0.majorCtor
+                            (ectx.natBlock == some block)
+                            (.lit (.nat 0)) = .ok (0, []) := by
+                          simp [IxIR0.majorCtor.eq_def, hNB]
+                        exact fireSim ih hmembers horacles (by omega) hresolve hFrefs hFmuts
+                          hFsa hmem (indexArgs := []) hlen2 hslen hcursor
+                          hmcS htmc
+                          (by simpa [hp0] using
+                            (ValsRel.nil : ValsRel ectx ictx [] []))
+                          hfire0 hfv' hav' htraceF htraceA
+                      | succ k =>
+                        have hmcS : Ixon.Eval.majorCtor
+                            (ectx.natBlock == some block)
+                            (.litV (.natL (k + 1))) =
+                            .ok (1, [.litV (.natL k)]) := by
+                          simp [Ixon.Eval.majorCtor.eq_def, hNB]
+                        have htmc : IxIR0.majorCtor
+                            (ectx.natBlock == some block)
+                            (.lit (.nat (k + 1))) =
+                            .ok (1, [.lit (.nat k)]) := by
+                          simp [IxIR0.majorCtor.eq_def, hNB]
+                        exact fireSim ih hmembers horacles (by omega) hresolve hFrefs hFmuts
+                          hFsa hmem (indexArgs := []) hlen2 hslen hcursor
+                          hmcS htmc
+                          (by simpa [hp0] using
+                            (ValsRel.cons ValRel.litNat ValsRel.nil))
+                          hfire0 hfv' hav' htraceF htraceA
+          | papRecIW hresolve hFrefs hFmuts hFsa hmem hipos hremaining
+              hanchor hcursor =>
+            rename_i block idx r F₂ bc sargs targs ignored baseEnv remaining
+              anchor
+            cases remaining with
+            | zero => omega
+            | succ remaining =>
+              have hsourcePending : ((sargs ++ [av]).length ==
+                  Ixon.Eval.recArity r) = false := by
+                rw [beq_eq_false_iff_ne]
+                have hlen := hcursor.source_length
+                simp only [List.length_replicate, List.length_append,
+                  List.length_cons, List.length_nil] at hlen ⊢
+                rw [recPolicy_length_exact] at hlen
+                simp only [Ixon.Eval.recArity]
+                omega
+              cases n with
+              | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+              | succ g =>
+                rw [Ixon.Eval.apply.eq_def] at hev
+                dsimp only at hev
+                cases g with
+                | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+                | succ g' =>
+                  rw [Ixon.Eval.saturate.eq_def] at hev
+                  simp only [Ixon.Eval.Head.arity?, hsourcePending,
+                    Bool.false_eq_true, if_false] at hev
+                  injection hev with hvalue
+                  subst v
+                  let targetPap : IxIR0.Value :=
+                    .pap (.rec_ (Erase.memberAddr block idx)
+                      (r.params.toNat + r.motives.toNat +
+                        r.minors.toNat + 1)) targs
+                  have hcursor' : RuntimePolicyPrefix (ValRel ectx ictx)
+                      (recPolicy r) (sargs ++ [av]) targs
+                      (List.replicate remaining .drop) := by
+                    have happend := hcursor.append_drop (sarg := av)
+                    simpa [List.replicate_succ] using happend
+                  cases remaining with
+                  | zero =>
+                    have hlookup :
+                        (av' :: ignored.reverse ++ targetPap :: baseEnv)[anchor]? =
+                          some targetPap := by
+                      have hprefix : (av' :: ignored.reverse).length = anchor := by
+                        simpa using hanchor
+                      change
+                        (((av' :: ignored.reverse) ++
+                          (targetPap :: baseEnv))[anchor]? = some targetPap)
+                      rw [← hprefix]
+                      rw [List.getElem?_append_right (Nat.le_refl _)]
+                      simp
+                    have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx 1
+                        (av' :: ignored.reverse ++ targetPap :: baseEnv)
+                        (.var anchor) targetPap :=
+                      .var hlookup
+                    have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 2
+                        (.clos .many
+                          (ignored.reverse ++ targetPap :: baseEnv)
+                          (.var anchor)) av' targetPap :=
+                      .clos hbodyTrace
+                    have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                        (n₁ + n₂ + 3) ρ (.app fT aT) targetPap :=
+                      .app (htraceF.mono_le (by omega))
+                        (htraceA.mono_le (by omega))
+                        (happlyTrace.mono_le (by omega))
+                    obtain ⟨ruleArgs, indexArgs, hsargs, hindices, hfront⟩ :=
+                      hcursor'.split_suffix_drops
+                        (policies := recRulePolicy r)
+                        (n := r.indices.toNat)
+                    rw [hsargs]
+                    exact ⟨_, _, htargetTrace.run,
+                      .papRecI hresolve hFrefs hFmuts hFsa hmem hipos
+                        hindices hfront,
+                      htargetTrace⟩
+                  | succ remaining =>
+                    have hbodyTrace : IxIR0.ProjectionSafe.Eval ictx 1
+                        (av' :: ignored.reverse ++ targetPap :: baseEnv)
+                        (Erase.lamManyN (remaining + 1) (.var anchor))
+                        (.clos .many
+                          (av' :: ignored.reverse ++ targetPap :: baseEnv)
+                          (Erase.lamManyN remaining (.var anchor))) := by
+                      simpa [Erase.lamManyN] using
+                        (IxIR0.ProjectionSafe.Eval.lam (ctx := ictx)
+                          (fuel := 0)
+                          (env := av' :: ignored.reverse ++
+                            targetPap :: baseEnv)
+                          (uses := Uses.many)
+                          (body := Erase.lamManyN remaining (.var anchor)))
+                    have happlyTrace : IxIR0.ProjectionSafe.Apply ictx 2
+                        (.clos .many
+                          (ignored.reverse ++ targetPap :: baseEnv)
+                          (Erase.lamManyN (remaining + 1) (.var anchor))) av'
+                        (.clos .many
+                          (av' :: ignored.reverse ++ targetPap :: baseEnv)
+                          (Erase.lamManyN remaining (.var anchor))) :=
+                      .clos hbodyTrace
+                    have htargetTrace : IxIR0.ProjectionSafe.Eval ictx
+                        (n₁ + n₂ + 3) ρ (.app fT aT)
+                        (.clos .many
+                          (av' :: ignored.reverse ++ targetPap :: baseEnv)
+                          (Erase.lamManyN remaining (.var anchor))) :=
+                      .app (htraceF.mono_le (by omega))
+                        (htraceA.mono_le (by omega))
+                        (happlyTrace.mono_le (by omega))
+                    refine ⟨_, _, htargetTrace.run, ?_, htargetTrace⟩
+                    simpa [targetPap] using
+                      (ValRel.papRecIW hresolve hFrefs hFmuts hFsa hmem hipos
+                        (show 0 < remaining + 1 by omega)
+                        (show (ignored ++ [av']).length + (remaining + 1) =
+                            anchor by
+                          simp only [List.length_append, List.length_cons,
+                            List.length_nil]
+                          omega)
+                        hcursor'
+                        : ValRel ectx ictx
+                            (.papV (.recH (some block) r F₂)
+                              (sargs ++ [av]))
+                            (.clos .many
+                              ((ignored ++ [av']).reverse ++
+                                targetPap :: baseEnv)
+                              (Erase.lamManyN ((remaining + 1) - 1)
+                                (.var anchor))))
+          | papRecI hresolve hFrefs hFmuts hFsa hmem _hipos hindices
+              hcursor =>
+            rename_i block idx r F₂ bc ruleArgs indexArgs targs
+            have hslen : ruleArgs.length = (recRulePolicy r).length := by
+              simpa using hcursor.source_length
+            have hlen2 : ruleArgs.length = targs.length := by
+              calc
+                ruleArgs.length = (recRulePolicy r).length := hslen
+                _ = policyTargetArity (recRulePolicy r) :=
+                  (recRulePolicy_slots r).targetArity_eq_length.symm
+                _ = targs.length := by
+                  simpa [policyTargetArity] using hcursor.target_length.symm
+            cases n with
+            | zero => rw [Ixon.Eval.apply.eq_def] at hev; simp at hev
+            | succ g =>
+              rw [Ixon.Eval.apply.eq_def] at hev
+              dsimp only at hev
+              cases g with
+              | zero => rw [Ixon.Eval.saturate.eq_def] at hev; simp at hev
+              | succ g' =>
+                rw [Ixon.Eval.saturate.eq_def] at hev
+                simp only [Ixon.Eval.Head.arity?] at hev
+                have hcmp : (((ruleArgs ++ indexArgs) ++ [av]).length ==
+                    Ixon.Eval.recArity r) = true := by
+                  rw [beq_iff_eq]
+                  simp only [List.length_append, List.length_cons,
+                    List.length_nil, Ixon.Eval.recArity, hindices, hslen]
+                  rw [recRulePolicy_length]
+                rw [hcmp] at hev
+                simp at hev
+                have hmc : ∃ checked p,
+                    Ixon.Eval.guardRecMajor (some block) r.params.toNat av =
+                      .ok checked ∧
+                    Ixon.Eval.majorCtor
+                      (ectx.natBlock == some block) av = .ok p := by
+                  cases g' with
+                  | zero =>
+                    rw [Ixon.Eval.fire.eq_def] at hev
+                    simp at hev
+                  | succ g'' =>
+                    rw [Ixon.Eval.fire.eq_def] at hev
+                    dsimp only at hev
+                    rw [← List.append_assoc] at hev
+                    rw [List.getLast?_concat] at hev
+                    dsimp only at hev
+                    simp only [Option.isSome_some, Bool.true_and] at hev
+                    simp [hstrict.neutralElims, hstrict.stringLiterals,
+                      bindOk] at hev
+                    cases hgmajor : Ixon.Eval.guardRecMajor (some block)
+                        r.params.toNat av with
+                    | error e =>
+                      rw [hgmajor, bindErr] at hev
+                      simp at hev
+                    | ok checked =>
+                      rw [hgmajor, bindOk] at hev
+                      cases hm : Ixon.Eval.majorCtor
+                          (ectx.natBlock == some block) av with
+                      | error e => rw [hm, bindErr] at hev; simp at hev
+                      | ok p => exact ⟨checked, p, rfl, rfl⟩
+                obtain ⟨checked, p0, hguard, hmc⟩ := hmc
+                have hfireI : Ixon.Eval.fire ectx g'
+                    (.recH (some block) r F₂)
+                    ((ruleArgs ++ indexArgs) ++ [av]) = .ok v := by
+                  simpa using hev
+                cases hrelA with
+                | sort => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | pi => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | clos _ _ _ => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | litStr => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | quotV _ => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | quotType => simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papQuot _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papExtern _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papCtor _ _ _ _ _ _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papCtorParams _ _ _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papRec _ _ _ _ _ _ _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papRecI _ _ _ _ _ _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | papRecIW _ _ _ _ _ _ _ _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | inductiveType _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | inductiveMember _ _ =>
+                  simp [Ixon.Eval.majorCtor.eq_def] at hmc
+                | ctorV hshape _haddr hfargs hctorCursor =>
+                  rename_i cblock cindIdx ccidx cparams cfields ccargs2 ca
+                    tflds
+                  have hmcS : Ixon.Eval.majorCtor
+                      (ectx.natBlock == some block)
+                      (.ctorV cblock cindIdx ccidx ccargs2) =
+                      .ok (ccidx, ccargs2) := by
+                    simp [Ixon.Eval.majorCtor.eq_def]
+                  have htmc : IxIR0.majorCtor
+                      (ectx.natBlock == some block)
+                      (.ctor ca ccidx tflds) = .ok (ccidx, tflds) := by
+                    simp [IxIR0.majorCtor.eq_def]
+                  have hcparams := recMember_ctor_params hmem hguard hshape
+                  rw [hcparams] at hfargs
+                  exact fireSim ih hmembers horacles (by omega) hresolve hFrefs
+                    hFmuts hFsa
+                    hmem (indexArgs := indexArgs) hlen2 hslen hcursor hmcS
+                    htmc hfargs hfireI hfv' hav' htraceF htraceA
+                | litNat =>
+                  rename_i nn
+                  have hp0 : r.params.toNat = 0 := by
+                    simp only [Ixon.Eval.guardRecMajor] at hguard
+                    split at hguard
+                    · rename_i hp
+                      exact beq_iff_eq.mp hp
+                    · simp at hguard
+                  cases hNB : (ectx.natBlock == some block) with
+                  | false =>
+                    simp [Ixon.Eval.majorCtor.eq_def, hNB] at hmc
+                  | true =>
+                    cases nn with
+                    | zero =>
+                      have hmcS : Ixon.Eval.majorCtor
+                          (ectx.natBlock == some block)
+                          (.litV (.natL 0)) = .ok (0, []) := by
+                        simp [Ixon.Eval.majorCtor.eq_def, hNB]
+                      have htmc : IxIR0.majorCtor
+                          (ectx.natBlock == some block)
+                          (.lit (.nat 0)) = .ok (0, []) := by
+                        simp [IxIR0.majorCtor.eq_def, hNB]
+                      exact fireSim ih hmembers horacles (by omega) hresolve hFrefs hFmuts
+                        hFsa hmem (indexArgs := indexArgs) hlen2 hslen
+                        hcursor hmcS htmc
+                        (by simpa [hp0] using
+                          (ValsRel.nil : ValsRel ectx ictx [] []))
+                        hfireI hfv' hav' htraceF htraceA
+                    | succ k =>
+                      have hmcS : Ixon.Eval.majorCtor
+                          (ectx.natBlock == some block)
+                          (.litV (.natL (k + 1))) =
+                          .ok (1, [.litV (.natL k)]) := by
+                        simp [Ixon.Eval.majorCtor.eq_def, hNB]
+                      have htmc : IxIR0.majorCtor
+                          (ectx.natBlock == some block)
+                          (.lit (.nat (k + 1))) =
+                          .ok (1, [.lit (.nat k)]) := by
+                        simp [IxIR0.majorCtor.eq_def, hNB]
+                      exact fireSim ih hmembers horacles (by omega) hresolve hFrefs hFmuts
+                        hFsa hmem (indexArgs := indexArgs) hlen2 hslen
+                        hcursor hmcS htmc
+                        (by simpa [hp0] using
+                          (ValsRel.cons ValRel.litNat ValsRel.nil))
+                        hfireI hfv' hav' htraceF htraceA
+    | appE hd hlam =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      rename_i u dom body aS fT
+      cases hf : Ixon.Eval.eval ectx n F env (.lam u dom body) with
+      | error err => rw [hf, bindErr] at hev; simp at hev
+      | ok fv =>
+        rw [hf, bindOk] at hev
+        cases ha : Ixon.Eval.eval ectx n F env aS with
+        | error err => rw [ha, bindErr] at hev; simp at hev
+        | ok av =>
+          rw [ha, bindOk] at hev
+          cases n with
+          | zero => rw [Ixon.Eval.eval.eq_def] at hf; simp at hf
+          | succ g =>
+            rw [Ixon.Eval.eval.eq_def] at hf
+            dsimp only at hf
+            injection hf with hfv
+            subst hfv
+            rw [Ixon.Eval.apply.eq_def] at hev
+            dsimp only at hev
+            cases hlam with
+            | lamK hnd hpb => rw [hd] at hnd; simp at hnd
+            | lamD hd' hpb =>
+              rename_i bodyT
+              obtain ⟨n₃, v', hv', hrel, htraceBody⟩ :=
+                ih g (by omega) ectx F (av :: env) body v sc (false :: mask)
+                  (.erased :: ρ) bodyT ictx hmembers horacles hev hpb
+                    (.drop henv)
+              have hlamT : IxIR0.eval ictx (n₃ + 1) ρ (.lam .many bodyT) =
+                  .ok (.clos .many ρ bodyT) := by rw [IxIR0.eval.eq_def]
+              have hboxT : IxIR0.eval ictx (n₃ + 1) ρ .erased =
+                  .ok .erased := by rw [IxIR0.eval.eq_def]
+              refine ⟨n₃ + 2, v', ?_, hrel,
+                .app .lam .erased (.clos htraceBody)⟩
+              rw [IxIR0.eval.eq_def]
+              dsimp only
+              rw [hlamT, bindOk, hboxT, bindOk]
+              rw [IxIR0.apply.eq_def]
+              dsimp only
+              exact hv'
+            | ctorP _ hspine _ => cases hspine
+            | ctorW hspine _ _ => cases hspine
+            | recP hspine => cases hspine
+            | recW hspine _ => cases hspine
+
+/-- **The erasure simulation (stages 1 + 2a + 2b).** If a source term
+terminates with a value under the Ixon reference semantics, its
+erasure terminates under the IxIR₀ semantics with a related value. -/
+theorem erasure_sim_with_members {fuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} {env : List Ixon.Eval.Value} {e : Ixon.Expr}
+    {v : Ixon.Eval.Value} {sc : Option (Ixon.Address × Nat)}
+    {mask : List Bool} {ρ : List IxIR0.Value}
+    {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hmembers : MemberCoverage ectx ictx scope.plan)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v)
+    (hpe : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask e e')
+    (henv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ) :
+    ∃ fuel' v', IxIR0.eval ictx fuel' ρ e' = .ok v' ∧
+      ValRel ectx ictx v v' := by
+  obtain ⟨fuel', v', hrun, hrel, _⟩ :=
+    simAt fuel ectx F env e v sc mask ρ e' ictx hmembers horacles hev hpe henv
+  exact ⟨fuel', v', hrun, hrel⟩
+
+/-- Erasure simulation with a proof-producing, call-aware projection-safety
+trace.  The witness follows every closure and recursor-rule body reached by
+the successful source execution. -/
+theorem erasure_sim_projectionSafe_with_members {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {env : List Ixon.Eval.Value} {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hmembers : MemberCoverage ectx ictx scope.plan)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v)
+    (hpe : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask e e')
+    (henv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ) :
+    ∃ fuel' v', IxIR0.ProjectionSafe.Eval ictx fuel' ρ e' v' ∧
+      ValRel ectx ictx v v' := by
+  obtain ⟨fuel', v', _, hrel, htrace⟩ :=
+    simAt fuel ectx F env e v sc mask ρ e' ictx hmembers horacles hev hpe henv
+  exact ⟨fuel', v', htrace, hrel⟩
+
+end MemberScoped
+
+/-- Compatibility specialization of `erasure_sim_with_members` to the empty
+member scope. -/
+theorem erasure_sim {fuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} {env : List Ixon.Eval.Value} {e : Ixon.Expr}
+    {v : Ixon.Eval.Value} {sc : Option (Ixon.Address × Nat)}
+    {mask : List Bool} {ρ : List IxIR0.Value}
+    {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v)
+    (hpe : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask e e')
+    (henv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ) :
+    ∃ fuel' v', IxIR0.eval ictx fuel' ρ e' = .ok v' ∧
+      ValRel ectx ictx v v' := by
+  exact erasure_sim_with_members (.nil hstrict) horacles hev hpe henv
+
+/-- Compatibility specialization of the call-aware theorem to the empty
+member scope. -/
+theorem erasure_sim_projectionSafe {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {env : List Ixon.Eval.Value} {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v)
+    (hpe : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask e e')
+    (henv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ) :
+    ∃ fuel' v', IxIR0.ProjectionSafe.Eval ictx fuel' ρ e' v' ∧
+      ValRel ectx ictx v v' := by
+  exact erasure_sim_projectionSafe_with_members (.nil hstrict) horacles hev hpe henv
+
+/-- Successful projection in the source pins the erased projection target to
+a constructor, not to IxIR₀'s extra erased-absorber case.  Besides the target
+constructor evaluation, the witness identifies the selected erased field and
+relates it to the actual Ixon projection result.  This is the local
+admissibility fact needed to rule out erased-slot projection stuckness in the
+subsequent IxIR₀ → IxIR₁ lowering proof. -/
+theorem erasure_proj_sim {fuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} {env : List Ixon.Eval.Value}
+    {tyRef fieldIdx : UInt64} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {target : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F env
+      (.prj tyRef fieldIdx source) = .ok sourceValue)
+    (hpe : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask
+      (.prj tyRef fieldIdx source) (.proj fieldIdx.toNat target))
+    (henv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ) :
+    ∃ targetFuel address tag fields targetValue,
+      IxIR0.eval ictx targetFuel ρ target =
+          .ok (.ctor address tag fields) ∧
+        fields[fieldIdx.toNat]? = some targetValue ∧
+        ValRel ectx ictx sourceValue targetValue := by
+  cases hpe with
+  | recP hspine => cases hspine
+  | prjE hsourceErase =>
+    cases fuel with
+    | zero =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      simp at hev
+    | succ fuel =>
+      rw [Ixon.Eval.eval.eq_def] at hev
+      dsimp only at hev
+      cases hsourceRun : Ixon.Eval.eval ectx fuel F env source with
+      | error error =>
+        rw [hsourceRun, bindErr] at hev
+        simp at hev
+      | ok sourceTarget =>
+        rw [hsourceRun, bindOk] at hev
+        obtain ⟨projectedInd, projectedBlockConstant, block, indIdx, cidx,
+            sourceArgs, hprojectedResolve, hsourceTarget, hfield⟩ :=
+          Ixon.Eval.projectValue_ok_of_strict hstrict.neutralElims hev
+        subst sourceTarget
+        obtain ⟨targetFuel, targetTarget, htargetRun, htargetRel⟩ :=
+          erasure_sim hstrict horacles hsourceRun hsourceErase henv
+        cases htargetRel with
+        | ctorV hshape haddress hargs hcursor =>
+          rename_i params fieldCount address targetFields
+          obtain ⟨blockConstant, indDecl, ctor, hresolve, hctor,
+              hparams, hctorParams, hctorFields⟩ := hshape
+          rw [hresolve] at hprojectedResolve
+          injection hprojectedResolve with hpair
+          injection hpair with _ hind
+          injection hind with hind
+          subst projectedInd
+          have hfieldDrop :
+              (sourceArgs.drop params)[fieldIdx.toNat]? =
+                some sourceValue := by
+            rw [List.getElem?_drop]
+            simpa [hparams] using hfield
+          obtain ⟨targetValue, htargetField, hvalueRel⟩ :=
+            valsRel_lookup _ hargs _ hfieldDrop
+          exact ⟨targetFuel, address, cidx, targetFields, targetValue,
+            htargetRun, htargetField, hvalueRel⟩
+
+/-- Any independently obtained successful evaluation of the erased
+projection target has the constructor shape recovered by
+`erasure_proj_sim`.  Fuel monotonicity joins the two evaluations, so this is
+the convenient inversion form for a downstream compiler proof that already
+has its own target-evaluation witness. -/
+theorem erasure_proj_target_ctor {fuel targetFuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} {env : List Ixon.Eval.Value}
+    {tyRef fieldIdx : UInt64} {source : Ixon.Expr}
+    {sourceValue : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetSource : IxIR0.Value} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F env
+      (.prj tyRef fieldIdx source) = .ok sourceValue)
+    (hpe : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr mask
+      (.prj tyRef fieldIdx source) (.proj fieldIdx.toNat target))
+    (henv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr mask env ρ)
+    (htarget : IxIR0.eval ictx targetFuel ρ target = .ok targetSource) :
+    ∃ address tag fields targetValue,
+      targetSource = .ctor address tag fields ∧
+        fields[fieldIdx.toNat]? = some targetValue ∧
+        ValRel ectx ictx sourceValue targetValue := by
+  obtain ⟨witnessFuel, address, tag, fields, targetValue,
+      hwitness, hfield, hvalueRel⟩ :=
+    erasure_proj_sim hstrict horacles hev hpe henv
+  let common := max witnessFuel targetFuel
+  have hwitness' : IxIR0.eval ictx common ρ target =
+      .ok (.ctor address tag fields) :=
+    IxIR0.eval_mono (Nat.le_max_left _ _) hwitness
+  have htarget' : IxIR0.eval ictx common ρ target = .ok targetSource :=
+    IxIR0.eval_mono (Nat.le_max_right _ _) htarget
+  have hvalue : targetSource = .ctor address tag fields := by
+    rw [hwitness'] at htarget'
+    exact (Except.ok.inj htarget').symm
+  exact ⟨address, tag, fields, targetValue, hvalue, hfield, hvalueRel⟩
+
+/-- Closed-term corollary. -/
+theorem erasure_sim_closed {fuel : Nat} {ectx : Ixon.Eval.EvalCtx}
+    {F : Ixon.Eval.Frame} {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F [] e = .ok v)
+    (hpe : PErase ectx ictx none F.refs F.selfMuts F.selfAddr [] e e') :
+    ∃ fuel' v', IxIR0.eval ictx fuel' [] e' = .ok v' ∧
+      ValRel ectx ictx v v' :=
+  erasure_sim hstrict horacles hev hpe .nil
+
+/-- Closed-term call-aware projection-safe erasure simulation. -/
+theorem erasure_sim_projectionSafe_closed {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (hev : Ixon.Eval.eval ectx fuel F [] e = .ok v)
+    (hpe : PErase ectx ictx none F.refs F.selfMuts F.selfAddr [] e e') :
+    ∃ fuel' v', IxIR0.ProjectionSafe.Eval ictx fuel' [] e' v' ∧
+      ValRel ectx ictx v v' :=
+  erasure_sim_projectionSafe hstrict horacles hev hpe .nil
+
+/-! ## Sharing composition
+
+Sharing is eliminated semantically before entering `PErase`.  The relation
+therefore remains share-free: source evaluation is first transported to the
+fully inlined context, frame, environment, and expression, then the existing
+simulation theorem applies unchanged. -/
+
+/-- A source value relates to an IxIR₀ value after every captured sharing
+table and expression root in the source value has been fully inlined. -/
+abbrev InlinedValRel (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (value : Ixon.Eval.Value) (target : IxIR0.Value)
+    [scope : MemberScope] : Prop :=
+  ValRel ectx.inlineSharing ictx value.inlineSharing target
+
+/-- General sharing composition.  Successful evaluation under a well-formed
+sharing frame is transported to the share-free evaluator, after which an
+ordinary `PErase` derivation supplies the existing erasure simulation. -/
+theorem erasure_sim_inlineSharing {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {env : List Ixon.Eval.Value} {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF env)
+    (he : Ixon.Sharing.sharesBelow F.sharing.size e = true)
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v)
+    (hpe : PErase ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (Ixon.Sharing.inlineExpr F.sharing e) e')
+    (henv : EnvRel ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing env) ρ) :
+    ∃ fuel' v', IxIR0.eval ictx fuel' ρ e' = .ok v' ∧
+      InlinedValRel ectx ictx v v' := by
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx hF henvWF he hev
+  exact erasure_sim hstrict.inlineSharing horacles hinlined.1 hpe henv
+
+/-- Sharing-aware erasure simulation retaining the full call-aware
+projection-safe target trace. -/
+theorem erasure_sim_projectionSafe_inlineSharing {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {env : List Ixon.Eval.Value} {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF env)
+    (he : Ixon.Sharing.sharesBelow F.sharing.size e = true)
+    (hev : Ixon.Eval.eval ectx fuel F env e = .ok v)
+    (hpe : PErase ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (Ixon.Sharing.inlineExpr F.sharing e) e')
+    (henv : EnvRel ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing env) ρ) :
+    ∃ fuel' v', IxIR0.ProjectionSafe.Eval ictx fuel' ρ e' v' ∧
+      InlinedValRel ectx ictx v v' := by
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx hF henvWF he hev
+  exact erasure_sim_projectionSafe hstrict.inlineSharing horacles
+    hinlined.1 hpe henv
+
+/-- Closed-term sharing-aware call-aware erasure simulation. -/
+theorem erasure_sim_projectionSafe_inlineSharing_closed {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {e : Ixon.Expr} {v : Ixon.Eval.Value}
+    {e' : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (he : Ixon.Sharing.sharesBelow F.sharing.size e = true)
+    (hev : Ixon.Eval.eval ectx fuel F [] e = .ok v)
+    (hpe : PErase ectx.inlineSharing ictx none F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr F.sharing e) e') :
+    ∃ fuel' v', IxIR0.ProjectionSafe.Eval ictx fuel' [] e' v' ∧
+      InlinedValRel ectx ictx v v' := by
+  apply erasure_sim_projectionSafe_inlineSharing hstrict horacles hctx hF .nil
+    he hev hpe
+  simpa [Ixon.Eval.valuesInlineSharing] using
+    (EnvRel.nil (ectx := ectx.inlineSharing) (ictx := ictx)
+      (refs := F.inlineSharing.refs) (muts := F.inlineSharing.selfMuts)
+      (sa := F.inlineSharing.selfAddr))
+
+/-- Sharing-aware projection corollary.  It transports the successful source
+projection to the fully inlined semantics used by
+`CertifiedSharedExpr`/`CertifiedSharedProgram`, then applies the same
+constructor-only projection inversion as the share-free theorem. -/
+theorem erasure_proj_sim_inlineSharing {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {env : List Ixon.Eval.Value} {tyRef fieldIdx : UInt64}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {target : IxIR0.Expr} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF env)
+    (hsourceBelow :
+      Ixon.Sharing.sharesBelow F.sharing.size source = true)
+    (hev : Ixon.Eval.eval ectx fuel F env
+      (.prj tyRef fieldIdx source) = .ok sourceValue)
+    (hpe : PErase ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (.prj tyRef fieldIdx (Ixon.Sharing.inlineExpr F.sharing source))
+      (.proj fieldIdx.toNat target))
+    (henv : EnvRel ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing env) ρ) :
+    ∃ targetFuel address tag fields targetValue,
+      IxIR0.eval ictx targetFuel ρ target =
+          .ok (.ctor address tag fields) ∧
+        fields[fieldIdx.toNat]? = some targetValue ∧
+        InlinedValRel ectx ictx sourceValue targetValue := by
+  have hwholeBelow : Ixon.Sharing.sharesBelow F.sharing.size
+      (.prj tyRef fieldIdx source) = true := by
+    simpa [Ixon.Sharing.sharesBelow] using hsourceBelow
+  have hinlined := Ixon.Eval.eval_inlineSharing hctx hF henvWF
+    hwholeBelow hev
+  have hinlineEval : Ixon.Eval.eval ectx.inlineSharing fuel
+      F.inlineSharing (Ixon.Eval.valuesInlineSharing env)
+      (.prj tyRef fieldIdx (Ixon.Sharing.inlineExpr F.sharing source)) =
+        .ok sourceValue.inlineSharing := by
+    simpa [Ixon.Sharing.inlineExpr, Ixon.Sharing.substShares,
+      Ixon.Sharing.substSharesList] using hinlined.1
+  exact erasure_proj_sim hstrict.inlineSharing horacles hinlineEval hpe henv
+
+/-- Fuel-joined inversion form of the sharing-aware projection theorem. -/
+theorem erasure_proj_target_ctor_inlineSharing
+    {fuel targetFuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {env : List Ixon.Eval.Value} {tyRef fieldIdx : UInt64}
+    {source : Ixon.Expr} {sourceValue : Ixon.Eval.Value}
+    {sc : Option (Ixon.Address × Nat)} {mask : List Bool}
+    {ρ : List IxIR0.Value} {target : IxIR0.Expr}
+    {targetSource : IxIR0.Value} {ictx : IxIR0.Ctx}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (henvWF : Ixon.Eval.ValuesSharingWF env)
+    (hsourceBelow :
+      Ixon.Sharing.sharesBelow F.sharing.size source = true)
+    (hev : Ixon.Eval.eval ectx fuel F env
+      (.prj tyRef fieldIdx source) = .ok sourceValue)
+    (hpe : PErase ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (.prj tyRef fieldIdx (Ixon.Sharing.inlineExpr F.sharing source))
+      (.proj fieldIdx.toNat target))
+    (henv : EnvRel ectx.inlineSharing ictx sc F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr mask
+      (Ixon.Eval.valuesInlineSharing env) ρ)
+    (htarget : IxIR0.eval ictx targetFuel ρ target = .ok targetSource) :
+    ∃ address tag fields targetValue,
+      targetSource = .ctor address tag fields ∧
+        fields[fieldIdx.toNat]? = some targetValue ∧
+        InlinedValRel ectx ictx sourceValue targetValue := by
+  obtain ⟨witnessFuel, address, tag, fields, targetValue,
+      hwitness, hfield, hvalueRel⟩ :=
+    erasure_proj_sim_inlineSharing hstrict horacles hctx hF henvWF hsourceBelow
+      hev hpe henv
+  let common := max witnessFuel targetFuel
+  have hwitness' : IxIR0.eval ictx common ρ target =
+      .ok (.ctor address tag fields) :=
+    IxIR0.eval_mono (Nat.le_max_left _ _) hwitness
+  have htarget' : IxIR0.eval ictx common ρ target = .ok targetSource :=
+    IxIR0.eval_mono (Nat.le_max_right _ _) htarget
+  have hvalue : targetSource = .ctor address tag fields := by
+    rw [hwitness'] at htarget'
+    exact (Except.ok.inj htarget').symm
+  exact ⟨address, tag, fields, targetValue, hvalue, hfield, hvalueRel⟩
+
+/-- Closed-term sharing composition, the entry point used by executable
+certificates.  No `.share` constructor is added to `PErase`. -/
+theorem erasure_sim_inlineSharing_closed {fuel : Nat}
+    {ectx : Ixon.Eval.EvalCtx} {F : Ixon.Eval.Frame}
+    {e : Ixon.Expr} {v : Ixon.Eval.Value} {e' : IxIR0.Expr}
+    {ictx : IxIR0.Ctx} (hstrict : ectx.Strict)
+    (hctx : ectx.SharingWF) (hF : F.SharingWF)
+    (horacles : OracleRel ectx.inlineSharing ictx)
+    (he : Ixon.Sharing.sharesBelow F.sharing.size e = true)
+    (hev : Ixon.Eval.eval ectx fuel F [] e = .ok v)
+    (hpe : PErase ectx.inlineSharing ictx none F.inlineSharing.refs
+      F.inlineSharing.selfMuts F.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr F.sharing e) e') :
+    ∃ fuel' v', IxIR0.eval ictx fuel' [] e' = .ok v' ∧
+      InlinedValRel ectx ictx v v' := by
+  apply erasure_sim_inlineSharing hstrict horacles hctx hF .nil he hev hpe
+  simpa [Ixon.Eval.valuesInlineSharing] using
+    (EnvRel.nil (ectx := ectx.inlineSharing) (ictx := ictx)
+      (refs := F.inlineSharing.refs) (muts := F.inlineSharing.selfMuts)
+      (sa := F.inlineSharing.selfAddr))
+
+/-! Executable-pass agreement spot checks on fragment terms, and a
+relation witness for the ι machinery. -/
+
+private def ectx₀ : Erase.EraseCtx := { resolve := fun _ => none }
+
+#guard (match Erase.eraseExpr ectx₀ 1000 {} []
+    (.lam .many (.var 9) (.var 0)) with
+  | .ok (.lam .many (.var 0)) => true
+  | _ => false)
+
+#guard (match Erase.eraseExpr ectx₀ 1000 {} []
+    (.lam .many (.sort 0) (.lam .many (.var 0) (.var 0))) with
+  | .ok (.lam .many (.lam .many (.var 0))) => true
+  | _ => false)
+
+example {ectx ictx sc refs muts sa} :
+    PErase ectx ictx sc refs muts sa [] (.lam .many (.var 9) (.var 0))
+      (.lam .many (.var 0)) :=
+  .lamK rfl (.var rfl)
+
+example {ectx ictx sc refs muts sa} :
+    PErase ectx ictx sc refs muts sa []
+      (.lam .many (.sort 0) (.lam .many (.var 0) (.var 0)))
+      (.lam .many (.lam .many (.var 0))) :=
+  .lamD rfl (.lamK rfl (.var rfl))
+
+/-- The `Nat.rec` successor-rule body (kernel-shaped, peeled): source
+`s n (rec motive z s n)` with the self-`recur`; the erasure rewires
+self to the recSelf slot (`var 4` — just past the four peeled
+binders) and the motive argument to `◻` through the guarded ghost
+application. The rule mask drops the motive slot. -/
+example {ectx ictx refs} {muts : Array MutConst} {blk : Ixon.Address}
+    {r : Recursor}
+    (hm : muts[1]? = some (.recr r))
+    (hp : r.params.toNat = 0) (hi : r.indices.toNat = 0)
+    (hmot : 0 < r.motives.toNat) :
+    PErase ectx ictx (some (blk, 1)) refs muts (some blk)
+      [true, true, true, false]
+      (.app (.app (.var 1) (.var 0))
+        (.app (.app (.app (.app (.recur 1 #[0]) (.var 3)) (.var 2))
+          (.var 1)) (.var 0)))
+      (.app (.app (.var 1) (.var 0))
+      (.app (.app (.app (.app (.var 4) .erased) (.var 2)) (.var 1))
+          (.var 0))) :=
+  .app (.app (.var rfl) (.var rfl))
+    (.app (.app (.app (.appG (.head (.recurH rfl hm hi))
+      (by
+        cases hmotive : r.motives.toNat with
+        | zero => omega
+        | succ motives =>
+          simp [recRulePolicy, recParamPolicy, hp, hmotive,
+            List.replicate_succ])
+      (.recurS rfl (by
+        intro r' hr
+        have hm' : muts[UInt64.toNat 1]? = some (.recr r) := by
+          simpa using hm
+        rw [hm'] at hr
+        injection hr with heq
+        cases heq
+        exact hi))) (.var rfl)) (.var rfl)) (.var rfl))
+
+end Ix.Compiler.Sim
diff --git a/Ix/Compiler/Sim/Segment.lean b/Ix/Compiler/Sim/Segment.lean
new file mode 100644
index 000000000..019e05294
--- /dev/null
+++ b/Ix/Compiler/Sim/Segment.lean
@@ -0,0 +1,517 @@
+import Ix.Compiler.Erase
+
+/-!
+# Argument-policy cursors
+
+Constructor and recursor spines do not preserve argument positions
+pointwise: a `keep` position consumes a source and target argument, a
+`ghost` position consumes both but fixes the target argument to `◻`, and a
+`drop` position consumes only a source argument.  `PolicyPrefix` records a
+prefix of such a spine together with the unconsumed policy suffix.  Keeping
+the suffix in the relation is the cursor needed for partial applications.
+
+The relation is generic in the source/target argument relation and in the
+target ghost value, so the simulation can instantiate it for expressions
+and for evaluated values without introducing a dependency cycle.
+-/
+
+namespace Ix.Compiler.Sim
+
+open Ix.Compiler.Erase (ArgPolicy)
+
+/-- The structural policy of a constructor with `params` parameters and
+`fields` runtime fields. -/
+def ctorPolicy (params fields : Nat) : List ArgPolicy :=
+  List.replicate params .drop ++ List.replicate fields .keep
+
+/-- Generic pointwise list relation, kept here to avoid tying policy
+reasoning to either evaluator's value type. -/
+inductive ListRel {S T : Type} (R : S → T → Prop) :
+    List S → List T → Prop where
+  | nil : ListRel R [] []
+  | cons {sarg targ sargs targs} :
+      R sarg targ → ListRel R sargs targs →
+      ListRel R (sarg :: sargs) (targ :: targs)
+
+namespace ListRel
+
+theorem length {S T : Type} {R : S → T → Prop}
+    {sargs : List S} {targs : List T} (h : ListRel R sargs targs) :
+    sargs.length = targs.length := by
+  induction h <;> simp_all
+
+theorem append {S T : Type} {R : S → T → Prop}
+    {sargs : List S} {targs : List T} {sarg : S} {targ : T}
+    (h : ListRel R sargs targs) (hr : R sarg targ) :
+    ListRel R (sargs ++ [sarg]) (targs ++ [targ]) := by
+  induction h with
+  | nil => exact .cons hr .nil
+  | cons hhead _ ih => exact .cons hhead ih
+
+theorem lookup {S T : Type} {R : S → T → Prop} (i : Nat)
+    {sargs : List S} {targs : List T} (h : ListRel R sargs targs)
+    {sarg : S} (hs : sargs[i]? = some sarg) :
+    ∃ targ, targs[i]? = some targ ∧ R sarg targ := by
+  induction i generalizing sargs targs with
+  | zero =>
+    cases h with
+    | nil => simp at hs
+    | cons hhead htail =>
+      simp only [List.getElem?_cons_zero] at hs ⊢
+      injection hs with heq
+      subst heq
+      exact ⟨_, rfl, hhead⟩
+  | succ i ih =>
+    cases h with
+    | nil => simp at hs
+    | cons hhead htail =>
+      simp only [List.getElem?_cons_succ] at hs ⊢
+      exact ih htail hs
+
+end ListRel
+
+/-- Number of target arguments emitted by a policy list. -/
+def policyTargetArity : List ArgPolicy → Nat
+  | [] => 0
+  | .keep :: rest => policyTargetArity rest + 1
+  | .ghost :: rest => policyTargetArity rest + 1
+  | .drop :: rest => policyTargetArity rest
+
+@[simp] theorem policyTargetArity_replicate_drop (n : Nat) :
+    policyTargetArity (List.replicate n .drop) = 0 := by
+  induction n with
+  | zero => rfl
+  | succ n ih => simpa [List.replicate_succ, policyTargetArity]
+
+/-- A related prefix of an argument spine.  The first policy list is the
+complete policy and the last one is its unconsumed suffix. -/
+inductive PolicyPrefix {S T : Type} (R : S → T → Prop) (ghost : T) :
+    List ArgPolicy → List S → List T → List ArgPolicy → Prop where
+  | stop (policies : List ArgPolicy) :
+      PolicyPrefix R ghost policies [] [] policies
+  | keep {policies sargs targs rest sarg targ} :
+      R sarg targ →
+      PolicyPrefix R ghost policies sargs targs rest →
+      PolicyPrefix R ghost (.keep :: policies) (sarg :: sargs)
+        (targ :: targs) rest
+  | ghost {policies sargs targs rest sarg} :
+      PolicyPrefix R ghost policies sargs targs rest →
+      PolicyPrefix R ghost (.ghost :: policies) (sarg :: sargs)
+        (ghost :: targs) rest
+  | drop {policies sargs targs rest sarg} :
+      PolicyPrefix R ghost policies sargs targs rest →
+      PolicyPrefix R ghost (.drop :: policies) (sarg :: sargs) targs rest
+
+/-- All policy positions have been consumed. -/
+abbrev PolicyRel {S T : Type} (R : S → T → Prop) (ghost : T)
+    (policies : List ArgPolicy) (sargs : List S) (targs : List T) : Prop :=
+  PolicyPrefix R ghost policies sargs targs []
+
+/-- Runtime cursor used for recursor paps.  A ghost position still consumes a
+target slot, but its value is intentionally unconstrained: exact erasure fixes
+that slot to `ghost` in `PErase`, while the semantic relation remains closed
+under the generic application constructor. -/
+inductive RuntimePolicyPrefix {S T : Type} (R : S → T → Prop) :
+    List ArgPolicy → List S → List T → List ArgPolicy → Prop where
+  | stop (policies : List ArgPolicy) :
+      RuntimePolicyPrefix R policies [] [] policies
+  | keep {policies sargs targs rest sarg targ} :
+      R sarg targ →
+      RuntimePolicyPrefix R policies sargs targs rest →
+      RuntimePolicyPrefix R (.keep :: policies) (sarg :: sargs)
+        (targ :: targs) rest
+  | ghost {policies sargs targs rest sarg targ} :
+      RuntimePolicyPrefix R policies sargs targs rest →
+      RuntimePolicyPrefix R (.ghost :: policies) (sarg :: sargs)
+        (targ :: targs) rest
+  | drop {policies sargs targs rest sarg} :
+      RuntimePolicyPrefix R policies sargs targs rest →
+      RuntimePolicyPrefix R (.drop :: policies) (sarg :: sargs) targs rest
+
+/-- Every runtime policy position has been consumed. -/
+abbrev RuntimePolicyRel {S T : Type} (R : S → T → Prop)
+    (policies : List ArgPolicy) (sargs : List S) (targs : List T) : Prop :=
+  RuntimePolicyPrefix R policies sargs targs []
+
+namespace RuntimePolicyPrefix
+
+theorem source_length {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : RuntimePolicyPrefix R policies sargs targs rest) :
+    sargs.length + rest.length = policies.length := by
+  induction h <;> simp_all <;> omega
+
+theorem target_length {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : RuntimePolicyPrefix R policies sargs targs rest) :
+    targs.length + policyTargetArity rest = policyTargetArity policies := by
+  induction h <;> simp_all [policyTargetArity] <;> omega
+
+/-- The stored suffix is the policy list after the consumed source prefix. -/
+theorem remaining_eq_drop {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : RuntimePolicyPrefix R policies sargs targs rest) :
+    rest = policies.drop sargs.length := by
+  induction h with
+  | stop => rfl
+  | keep _ _ ih | ghost _ ih | drop _ ih => simpa using ih
+
+theorem append_keep {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy} {sarg : S} {targ : T}
+    (h : RuntimePolicyPrefix R policies sargs targs (.keep :: rest))
+    (hr : R sarg targ) :
+    RuntimePolicyPrefix R policies (sargs ++ [sarg]) (targs ++ [targ])
+      rest := by
+  generalize hrem : (.keep :: rest) = remaining at h
+  induction h with
+  | stop => cases hrem; exact .keep hr (.stop rest)
+  | keep hhead _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.keep hhead (ih hrem)
+  | ghost _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.ghost (ih hrem)
+  | drop _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.drop (ih hrem)
+
+theorem append_ghost {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy} {sarg : S} {targ : T}
+    (h : RuntimePolicyPrefix R policies sargs targs (.ghost :: rest)) :
+    RuntimePolicyPrefix R policies (sargs ++ [sarg]) (targs ++ [targ])
+      rest := by
+  generalize hrem : (.ghost :: rest) = remaining at h
+  induction h with
+  | stop => cases hrem; exact .ghost (.stop rest)
+  | keep hhead _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.keep hhead (ih hrem)
+  | ghost _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.ghost (ih hrem)
+  | drop _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.drop (ih hrem)
+
+theorem append_drop {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy} {sarg : S}
+    (h : RuntimePolicyPrefix R policies sargs targs (.drop :: rest)) :
+    RuntimePolicyPrefix R policies (sargs ++ [sarg]) targs rest := by
+  generalize hrem : (.drop :: rest) = remaining at h
+  induction h with
+  | stop => cases hrem; exact .drop (.stop rest)
+  | keep hhead _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.keep hhead (ih hrem)
+  | ghost _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.ghost (ih hrem)
+  | drop _ ih =>
+    simpa only [List.cons_append] using RuntimePolicyPrefix.drop (ih hrem)
+
+/-- Split a fully consumed runtime policy at a policy-list boundary. -/
+theorem split {S T : Type} {R : S → T → Prop}
+    {left right : List ArgPolicy} {sargs : List S} {targs : List T}
+    (h : RuntimePolicyRel R (left ++ right) sargs targs) :
+    ∃ sleft sright tleft tright,
+      sargs = sleft ++ sright ∧ targs = tleft ++ tright ∧
+      RuntimePolicyRel R left sleft tleft ∧
+      RuntimePolicyRel R right sright tright := by
+  induction left generalizing sargs targs with
+  | nil =>
+    exact ⟨[], sargs, [], targs, rfl, rfl, .stop [], by simpa using h⟩
+  | cons policy left ih =>
+    cases policy with
+    | keep =>
+      cases h with
+      | keep hrel htail =>
+        rename_i sarg targ
+        obtain ⟨sl, sr, tl, tr, hs, ht, hl, hr⟩ := ih htail
+        exact ⟨sarg :: sl, sr, targ :: tl, tr, by simp [hs], by simp [ht],
+          .keep hrel hl, hr⟩
+    | ghost =>
+      cases h with
+      | ghost htail =>
+        rename_i sarg targ
+        obtain ⟨sl, sr, tl, tr, hs, ht, hl, hr⟩ := ih htail
+        exact ⟨sarg :: sl, sr, targ :: tl, tr, by simp [hs], by simp [ht],
+          .ghost hl, hr⟩
+    | drop =>
+      cases h with
+      | drop htail =>
+        rename_i sarg
+        obtain ⟨sl, sr, tl, tr, hs, ht, hl, hr⟩ := ih htail
+        exact ⟨sarg :: sl, sr, tl, tr, by simp [hs], ht, .drop hl, hr⟩
+
+/-- Split a fully consumed policy whose suffix consists only of source drops.
+The suffix contributes no target arguments. -/
+theorem split_suffix_drops {S T : Type} {R : S → T → Prop}
+    {policies : List ArgPolicy} {n : Nat}
+    {sargs : List S} {targs : List T}
+    (h : RuntimePolicyRel R (policies ++ List.replicate n .drop)
+      sargs targs) :
+    ∃ sfront dropped,
+      sargs = sfront ++ dropped ∧ dropped.length = n ∧
+      RuntimePolicyRel R policies sfront targs := by
+  obtain ⟨sfront, dropped, targets, discarded, hs, ht, hp, hd⟩ := h.split
+  have hdiscarded : discarded = [] := by
+    cases discarded with
+    | nil => rfl
+    | cons value rest =>
+      have hlen := hd.target_length
+      simp at hlen
+  subst discarded
+  simp only [List.append_nil] at ht
+  subst targets
+  refine ⟨sfront, dropped, hs, ?_, hp⟩
+  have hlen := hd.source_length
+  simpa using hlen
+
+end RuntimePolicyPrefix
+
+namespace PolicyPrefix
+
+/-- A cursor consumes exactly one source argument per policy position. -/
+theorem source_length {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : PolicyPrefix R ghost policies sargs targs rest) :
+    sargs.length + rest.length = policies.length := by
+  induction h <;> simp_all <;> omega
+
+/-- The target side has one slot for every consumed `keep` or `ghost`, and
+no slot for a consumed `drop`. -/
+theorem target_length {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : PolicyPrefix R ghost policies sargs targs rest) :
+    targs.length + policyTargetArity rest = policyTargetArity policies := by
+  induction h <;> simp_all [policyTargetArity] <;> omega
+
+/-- Advance a cursor through a `keep` position, appending the newly
+consumed arguments in application order. -/
+theorem append_keep {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy} {sarg : S} {targ : T}
+    (h : PolicyPrefix R ghost policies sargs targs (.keep :: rest))
+    (hr : R sarg targ) :
+    PolicyPrefix R ghost policies (sargs ++ [sarg]) (targs ++ [targ])
+      rest := by
+  generalize hrem : (.keep :: rest) = remaining at h
+  induction h with
+  | stop =>
+    cases hrem
+    exact .keep hr (.stop rest)
+  | keep hhead _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.keep hhead (ih hrem)
+  | ghost _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.ghost (ih hrem)
+  | drop _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.drop (ih hrem)
+
+/-- Advance a cursor through a `ghost` position. -/
+theorem append_ghost {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy} {sarg : S}
+    (h : PolicyPrefix R ghost policies sargs targs (.ghost :: rest)) :
+    PolicyPrefix R ghost policies (sargs ++ [sarg]) (targs ++ [ghost])
+      rest := by
+  generalize hrem : (.ghost :: rest) = remaining at h
+  induction h with
+  | stop =>
+    cases hrem
+    exact .ghost (.stop rest)
+  | keep hhead _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.keep hhead (ih hrem)
+  | ghost _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.ghost (ih hrem)
+  | drop _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.drop (ih hrem)
+
+/-- Advance a cursor through a `drop` position. -/
+theorem append_drop {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy} {sarg : S}
+    (h : PolicyPrefix R ghost policies sargs targs (.drop :: rest)) :
+    PolicyPrefix R ghost policies (sargs ++ [sarg]) targs rest := by
+  generalize hrem : (.drop :: rest) = remaining at h
+  induction h with
+  | stop =>
+    cases hrem
+    exact .drop (.stop rest)
+  | keep hhead _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.keep hhead (ih hrem)
+  | ghost _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.ghost (ih hrem)
+  | drop _ ih =>
+    simpa only [List.cons_append] using PolicyPrefix.drop (ih hrem)
+
+/-- A full policy relation consumes every source position. -/
+theorem source_length_eq {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    (h : PolicyRel R ghost policies sargs targs) :
+    sargs.length = policies.length := by
+  simpa using h.source_length
+
+/-- A full policy relation emits precisely the policy's target arity. -/
+theorem target_length_eq {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    (h : PolicyRel R ghost policies sargs targs) :
+    targs.length = policyTargetArity policies := by
+  simpa [policyTargetArity] using h.target_length
+
+/-- The cursor cannot have consumed more source arguments than there are
+policy positions. -/
+theorem source_length_le {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : PolicyPrefix R ghost policies sargs targs rest) :
+    sargs.length ≤ policies.length := by
+  have := h.source_length
+  omega
+
+/-- The cursor cannot have emitted more target arguments than the full
+policy emits. -/
+theorem target_length_le {S T : Type} {R : S → T → Prop} {ghost : T}
+    {policies : List ArgPolicy} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : PolicyPrefix R ghost policies sargs targs rest) :
+    targs.length ≤ policyTargetArity policies := by
+  have := h.target_length
+  omega
+
+/-- A full all-`keep` policy is exactly pointwise list relatedness. -/
+theorem listRel_of_full_keep {S T : Type} {R : S → T → Prop}
+    {ghost : T} {n : Nat} {sargs : List S} {targs : List T}
+    (h : PolicyRel R ghost (List.replicate n .keep) sargs targs) :
+    ListRel R sargs targs := by
+  induction n generalizing sargs targs with
+  | zero =>
+    cases h
+    exact .nil
+  | succ n ih =>
+    simp only [List.replicate_succ] at h
+    cases h with
+    | keep hr hrest => exact .cons hr (ih hrest)
+
+/-- After a constructor's dropped parameter segment, its source fields and
+target fields are pointwise related. -/
+theorem ctor_fields {S T : Type} {R : S → T → Prop}
+    {ghost : T} {params fields : Nat} {sargs : List S} {targs : List T}
+    (h : PolicyRel R ghost (ctorPolicy params fields) sargs targs) :
+    ListRel R (sargs.drop params) targs := by
+  induction params generalizing sargs targs with
+  | zero =>
+    simpa [ctorPolicy] using
+      (listRel_of_full_keep (n := fields) h)
+  | succ params ih =>
+    simp only [ctorPolicy, List.replicate_succ, List.cons_append] at h
+    cases h with
+    | drop hrest =>
+      simpa [ctorPolicy] using ih hrest
+
+/-- Every consumed position of an all-`keep` cursor is pointwise related,
+even when the cursor is not yet saturated. -/
+theorem listRel_of_replicate_keep {S T : Type} {R : S → T → Prop}
+    {ghost : T} {n : Nat} {sargs : List S} {targs : List T}
+    {rest : List ArgPolicy}
+    (h : PolicyPrefix R ghost (List.replicate n .keep) sargs targs rest) :
+    ListRel R sargs targs := by
+  induction n generalizing sargs targs rest with
+  | zero =>
+    cases h
+    exact .nil
+  | succ n ih =>
+    simp only [List.replicate_succ] at h
+    cases h with
+    | stop => exact .nil
+    | keep hhead htail => exact .cons hhead (ih htail)
+
+/-- Construct the canonical cursor for a pointwise-related prefix of an
+all-`keep` policy. -/
+theorem replicate_keep_of_listRel {S T : Type} {R : S → T → Prop}
+    {ghost : T} {n : Nat} {sargs : List S} {targs : List T}
+    (h : ListRel R sargs targs) (hle : sargs.length ≤ n) :
+    PolicyPrefix R ghost (List.replicate n .keep) sargs targs
+      (List.replicate (n - sargs.length) .keep) := by
+  induction h generalizing n with
+  | nil =>
+    simpa using (PolicyPrefix.stop (R := R) (ghost := ghost)
+      (List.replicate n .keep))
+  | cons hhead htail ih =>
+    cases n with
+    | zero => simp at hle
+    | succ n =>
+      have htail' := ih (n := n) (by simpa using hle)
+      simpa [List.replicate_succ] using PolicyPrefix.keep hhead htail'
+
+/-- Build the canonical constructor cursor from its unconstrained source
+parameter prefix and the relation on fields consumed so far. Once all
+parameters have been consumed, the remaining cursor contains only `keep`
+positions. -/
+theorem ctor_of_fields {S T : Type} {R : S → T → Prop} {ghost : T}
+    {params fields : Nat} {sargs : List S} {targs : List T}
+    (hparams : params ≤ sargs.length)
+    (harity : sargs.length ≤ params + fields)
+    (hfields : ListRel R (sargs.drop params) targs) :
+    PolicyPrefix R ghost (ctorPolicy params fields) sargs targs
+      (List.replicate (params + fields - sargs.length) .keep) := by
+  induction params generalizing sargs targs with
+  | zero =>
+    simpa [ctorPolicy] using
+      (replicate_keep_of_listRel (n := fields) hfields (by simpa using harity))
+  | succ params ih =>
+    cases sargs with
+    | nil => simp at hparams
+    | cons sarg sargs =>
+      have hparams' : params ≤ sargs.length := by simpa using hparams
+      have harity' : sargs.length ≤ params + fields := by
+        simp only [List.length_cons] at harity
+        omega
+      have htail := ih hparams' harity' (by simpa using hfields)
+      have hsuffix : params + 1 + fields - (sargs.length + 1) =
+          params + fields - sargs.length := by omega
+      simpa [ctorPolicy, List.replicate_succ, hsuffix] using
+        (PolicyPrefix.drop (sarg := sarg) htail)
+
+end PolicyPrefix
+
+@[simp] theorem policyTargetArity_replicate_keep (n : Nat) :
+    policyTargetArity (List.replicate n .keep) = n := by
+  induction n with
+  | zero => rfl
+  | succ n ih => simp [List.replicate_succ, policyTargetArity, ih]
+
+@[simp] theorem policyTargetArity_replicate_ghost (n : Nat) :
+    policyTargetArity (List.replicate n .ghost) = n := by
+  induction n with
+  | zero => rfl
+  | succ n ih => simp [List.replicate_succ, policyTargetArity, ih]
+
+@[simp] theorem policyTargetArity_append (left right : List ArgPolicy) :
+    policyTargetArity (left ++ right) =
+      policyTargetArity left + policyTargetArity right := by
+  induction left with
+  | nil => simp [policyTargetArity]
+  | cons policy rest ih =>
+    cases policy <;> simp [policyTargetArity, ih, Nat.add_comm,
+      Nat.add_left_comm]
+
+@[simp] theorem policyTargetArity_ctorPolicy (params fields : Nat) :
+    policyTargetArity (ctorPolicy params fields) = fields := by
+  simp [ctorPolicy]
+
+/-! Small elaborated witnesses pin the cursor orientation and each policy
+transition. -/
+
+example : PolicyRel (fun x y : Nat => x = y) 0
+    [.drop, .ghost, .keep] [10, 20, 30] [0, 30] :=
+  .drop (.ghost (.keep rfl (.stop [])))
+
+example : PolicyPrefix (fun x y : Nat => x = y) 0
+    [.drop, .ghost, .keep] [10] [] [.ghost, .keep] :=
+  .drop (.stop [.ghost, .keep])
+
+example : PolicyPrefix (fun x y : Nat => x = y) 0
+    [.drop, .ghost, .keep] [10, 20] [0] [.keep] := by
+  exact PolicyPrefix.append_ghost (.drop (.stop [.ghost, .keep]))
+
+end Ix.Compiler.Sim
diff --git a/Ix/Compiler/SimApply.lean b/Ix/Compiler/SimApply.lean
new file mode 100644
index 000000000..e0b5b34aa
--- /dev/null
+++ b/Ix/Compiler/SimApply.lean
@@ -0,0 +1,125 @@
+import Ix.Compiler.Sim
+
+/-! The public application corollary of erasure simulation, for exported
+functions invoked with runtime values. It uses the existing relation and
+member coverage, including their sharing and oracle premises. -/
+
+namespace Ix.Compiler.Sim
+
+variable [scope : MemberScope]
+
+/-- Retain the call-aware application trace needed by lowering progress. -/
+theorem apply_sim_projectionSafe_with_members {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {fuel : Nat} {function argument result : Ixon.Eval.Value}
+    {targetFunction targetArgument : IxIR0.Value}
+    (members : MemberCoverage ectx ictx scope.plan) (oracles : OracleRel ectx ictx)
+    (applied : Ixon.Eval.apply ectx fuel function argument = .ok result)
+    (functionRel : ValRel ectx ictx function targetFunction)
+    (argumentRel : ValRel ectx ictx argument targetArgument) :
+    ∃ targetFuel targetResult,
+      IxIR0.ProjectionSafe.Apply ictx targetFuel targetFunction targetArgument targetResult ∧
+      ValRel ectx ictx result targetResult := by
+  cases fuel with
+  | zero => simp [Ixon.Eval.apply] at applied
+  | succ fuel =>
+    have source : Ixon.Eval.eval ectx (fuel + 2) {}
+        [function, argument] (.app (.var 0) (.var 1)) = .ok result := by
+      simpa [Ixon.Eval.eval, bind, Except.bind] using applied
+    have erased : PErase ectx ictx none #[] #[] none [true, true]
+        (.app (.var 0) (.var 1)) (.app (.var 0) (.var 1)) := .app (.var rfl) (.var rfl)
+    have related : EnvRel ectx ictx none #[] #[] none [true, true]
+        [function, argument] [targetFunction, targetArgument] :=
+      .keep functionRel (.keep argumentRel .nil)
+    obtain ⟨_, targetResult, trace, resultRel⟩ :=
+      erasure_sim_projectionSafe_with_members members oracles source erased related
+    cases trace with
+    | app functionTrace argumentTrace appliedTrace =>
+      cases functionTrace with
+      | var functionAt =>
+        simp only [List.getElem?_cons_zero] at functionAt
+        cases functionAt
+        cases argumentTrace with
+        | var argumentAt =>
+          simp only [List.getElem?_cons_succ, List.getElem?_cons_zero] at argumentAt
+          cases argumentAt
+          exact ⟨_, targetResult, appliedTrace, resultRel⟩
+
+theorem apply_sim_with_members {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {fuel : Nat} {function argument result : Ixon.Eval.Value}
+    {targetFunction targetArgument : IxIR0.Value}
+    (members : MemberCoverage ectx ictx scope.plan) (oracles : OracleRel ectx ictx)
+    (applied : Ixon.Eval.apply ectx fuel function argument = .ok result)
+    (functionRel : ValRel ectx ictx function targetFunction)
+    (argumentRel : ValRel ectx ictx argument targetArgument) :
+    ∃ targetFuel targetResult,
+      IxIR0.apply ictx targetFuel targetFunction targetArgument = .ok targetResult ∧
+      ValRel ectx ictx result targetResult := by
+  obtain ⟨targetFuel, targetResult, trace, related⟩ :=
+    apply_sim_projectionSafe_with_members members oracles applied functionRel argumentRel
+  exact ⟨targetFuel, targetResult, trace.run, related⟩
+
+/-- A runtime application vector gets one finite trace bound, constructed
+from its individual source applications. No target execution is assumed. -/
+theorem applyMany_sim_projectionSafe_with_members {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    (members : MemberCoverage ectx ictx scope.plan) (oracles : OracleRel ectx ictx)
+    {fuel : Nat} {function result : Ixon.Eval.Value} {arguments : List Ixon.Eval.Value}
+    {targetFunction : IxIR0.Value} {targetArguments : List IxIR0.Value}
+    (applied : Ixon.Eval.applyMany ectx fuel function arguments = .ok result)
+    (functionRel : ValRel ectx ictx function targetFunction)
+    (argumentsRel : ValsRel ectx ictx arguments targetArguments) :
+    ∃ limit targetResult,
+      IxIR0.ProjectionSafe.AppliesBelow ictx limit targetFunction targetArguments targetResult ∧
+      ValRel ectx ictx result targetResult := by
+  induction fuel generalizing function result arguments targetFunction targetArguments with
+  | zero => simp [Ixon.Eval.applyMany] at applied
+  | succ fuel ih =>
+    cases argumentsRel with
+    | nil =>
+      simp only [Ixon.Eval.applyMany, Except.ok.injEq] at applied
+      subst result
+      exact ⟨0, targetFunction, .nil, functionRel⟩
+    | @cons argument targetArgument arguments targetArguments argumentRel argumentsRel =>
+      cases first : Ixon.Eval.apply ectx fuel function argument with
+      | error error => simp [Ixon.Eval.applyMany, first, bind, Except.bind] at applied
+      | ok middle =>
+        have rest : Ixon.Eval.applyMany ectx fuel middle arguments = .ok result := by
+          simpa [Ixon.Eval.applyMany, first, bind, Except.bind] using applied
+        obtain ⟨firstFuel, targetMiddle, firstTrace, middleRel⟩ :=
+          apply_sim_projectionSafe_with_members members oracles first functionRel argumentRel
+        obtain ⟨limit, targetResult, restTrace, resultRel⟩ := ih rest middleRel argumentsRel
+        exact ⟨firstFuel + limit + 1, targetResult,
+          .cons (by omega) firstTrace (restTrace.mono_limit (by omega)), resultRel⟩
+
+theorem applyMany_sim_projectionSafe_inlineSharing {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    (members : MemberCoverage ectx.inlineSharing ictx scope.plan)
+    (oracles : OracleRel ectx.inlineSharing ictx)
+    {fuel : Nat} {function result : Ixon.Eval.Value} {arguments : List Ixon.Eval.Value}
+    {targetFunction : IxIR0.Value} {targetArguments : List IxIR0.Value}
+    (contextWF : ectx.SharingWF) (functionWF : function.SharingWF)
+    (argumentsWF : Ixon.Eval.ValuesSharingWF arguments)
+    (applied : Ixon.Eval.applyMany ectx fuel function arguments = .ok result)
+    (functionRel : InlinedValRel ectx ictx function targetFunction)
+    (argumentsRel : ValsRel ectx.inlineSharing ictx
+      (Ixon.Eval.valuesInlineSharing arguments) targetArguments) :
+    ∃ limit targetResult,
+      IxIR0.ProjectionSafe.AppliesBelow ictx limit targetFunction targetArguments targetResult ∧
+      InlinedValRel ectx ictx result targetResult := by
+  exact applyMany_sim_projectionSafe_with_members members oracles
+    (Ixon.Eval.applyMany_inlineSharing contextWF functionWF argumentsWF applied).1 functionRel argumentsRel
+
+theorem apply_sim_inlineSharing {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {fuel : Nat} {function argument result : Ixon.Eval.Value}
+    {targetFunction targetArgument : IxIR0.Value}
+    (members : MemberCoverage ectx.inlineSharing ictx scope.plan)
+    (oracles : OracleRel ectx.inlineSharing ictx)
+    (contextWF : ectx.SharingWF) (functionWF : function.SharingWF) (argumentWF : argument.SharingWF)
+    (applied : Ixon.Eval.apply ectx fuel function argument = .ok result)
+    (functionRel : InlinedValRel ectx ictx function targetFunction)
+    (argumentRel : InlinedValRel ectx ictx argument targetArgument) :
+    ∃ targetFuel targetResult,
+      IxIR0.apply ictx targetFuel targetFunction targetArgument = .ok targetResult ∧
+      InlinedValRel ectx ictx result targetResult :=
+  apply_sim_with_members members oracles
+    (Ixon.Eval.apply_inlineSharing contextWF functionWF argumentWF applied).1 functionRel argumentRel
+
+end Ix.Compiler.Sim
diff --git a/Ix/Compiler/SimInstance.lean b/Ix/Compiler/SimInstance.lean
new file mode 100644
index 000000000..97f451cc3
--- /dev/null
+++ b/Ix/Compiler/SimInstance.lean
@@ -0,0 +1,4548 @@
+import Ix.Compiler.EraseValidator
+import Ix.Compiler.IxIR1.LowerProgress
+import Ix.Compiler.IxIR1.CostTrace
+import Ix.Compiler.IxIR0.Mono
+import Ix.Compiler.IxIR0.ProjectionFree
+
+/-!
+# The first theorem, applied
+
+`erasure_sim` instantiated on a real program: `add 2̂ 3̂` over the
+hand-written Nat store (the same shapes as the reference-evaluator
+and differential suites). This file closes the loop between the
+theorem and the executable pass:
+
+- the proof-producing validator runs `Erase.eraseProgram`, checks a
+  dependency-ordered coverage plan against that exact output, and
+  returns a reusable database of `Covered` witnesses;
+- `Covered` / `RecMember` / `RulesRel` / `PErase` derivations are
+  generated by checked computation for every address and expression
+  the program touches — including both recursor rules (`recurS`, the
+  guarded ghost application, and the rule mask);
+- the exact IxIR₁ `lowerAllAction` output is traced back to those source
+  declarations and its lifted lambda, then sealed into source, generated,
+  and higher-order application ownership contracts;
+- the Ixon source run is pinned by an executable `#guard`, while `addSim`
+  remains the general hypothesis-driven erasure theorem;
+- the erased `add` run and the exact compiled IxIR₁ main are additionally
+  certified by kernel-checked computation/trace lemmas, yielding a concrete
+  `SemanticForwardSimulation` whose result realizes `5̂` through
+  `ValueGraph`;
+- a second fixture stores a definition behind a valid sharing table, runs the
+  sharing-aware program and expression validators, and instantiates
+  `erasure_sim_inlineSharing_closed`.
+- a two-parameter `Pair.mk` fixture certifies both the complete constructor
+  drop spine and a partial pap that escapes through a let, consumes its final
+  parameter through a variable head, and projects the contentful field `22`.
+- a one-parameter List-shaped fixture certifies a parameterized recursor,
+  including its ghost parameter slot and a two-field constructor rule.
+- a two-constructor, one-index family certifies complete and escaping partial
+  pre-major recursor spines, plus a step rule whose indexed `recur` self call
+  processes a contentful base value; the source-only index is consumed before
+  either evaluator fires on the major.
+- an unfoldable `dPrj` fixture follows the emitted member alias and returns
+  `91`; a mixed mutual block evaluates a non-self inductive `recur` through an
+  escaping application before both sides return the contentful literal `88`.
+- a simultaneous member certificate closes a genuinely cyclic pair of
+  unfoldable definitions, while a second certificate closes two Nat recursors
+  whose successor rules alternate across the block; exact program/expression
+  certificates and source/target runs return `71` and `77`, respectively, and
+  an incomplete-plan guard pins fail-closed validation.
+- an unfoldable mutual member calls a configured opaque sibling and a public
+  projection aliases that sibling directly; both same-address oracle paths
+  return `83`, with missing-configuration and arity-drift guards.
+- a contentful ordinary-definition fixture evaluates a source-only ghost
+  argument to `7̂`, discards it through the independently checked declaration
+  and implementation telescopes, and returns `9̂` on both sides; a negative
+  guard pins rejection of mismatched target result ownership.
+- configured quotient fixtures certify the exact emitted `Quot.mk`,
+  `Quot.lift`, and `Quot.ind` definitions and return the wrapped
+  representative `37` contentfully on both sides.
+- a configured two-argument axiom crosses an explicit source/target oracle
+  ledger and returns `42` contentfully; a separate opaque-definition witness
+  exercises the same structural extern validation path.
+
+If any relation clause failed to cover what the eraser actually
+emits, this file would not elaborate.
+-/
+
+namespace Ix.Compiler.SimInstance
+
+open Ix.Compiler.Ixon (Uses Recursor RecursorRule MutConst Constant
+  ConstantInfo)
+open Ix.Compiler.Sim
+
+private def addrOf (n : UInt8) : Ixon.Address :=
+  Ixon.Address.replicate n
+
+private def aNatBlock := addrOf 0x10
+private def aNat := addrOf 0x11
+private def aZero := addrOf 0x12
+private def aSucc := addrOf 0x13
+private def aNatRec := addrOf 0x14
+private def aAdd := addrOf 0x15
+
+/-! ## The source store (the reference-evaluator suite's shapes) -/
+
+private def natInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+        typ := .recur 0 #[] },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .all .many .shared (.recur 0 #[]) (.recur 0 #[]) }] }
+
+private def natRec : Recursor :=
+  { k := false, isUnsafe := false, lvls := 1, params := 0, indices := 0
+    motives := 1, minors := 2, typ := .sort 0
+    rules := #[
+      { fields := 0
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.var 1))) },
+      { fields := 1
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.lam .many (.recur 0 #[])
+            (.app (.app (.var 1) (.var 0))
+              (.app (.app (.app (.app (.recur 1 #[0]) (.var 3)) (.var 2))
+                (.var 1)) (.var 0)))))) }] }
+
+private def cNatBlock : Constant :=
+  { info := .muts #[.indc natInd, .recr natRec]
+    sharing := #[], refs := #[], univs := #[.var 0] }
+
+private def prjConst (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def cNat := prjConst (.iPrj { idx := 0, block := aNatBlock })
+private def cZero :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aNatBlock })
+private def cSucc :=
+  prjConst (.cPrj { idx := 0, cidx := 1, block := aNatBlock })
+private def cNatRec := prjConst (.rPrj { idx := 1, block := aNatBlock })
+
+/-- `fun m n => Nat.rec.{1} (fun _ => Nat) m (fun k ih => succ ih) n` —
+refs: 0 = Nat, 1 = zero, 2 = succ, 3 = Nat.rec. -/
+private def cAdd : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .shared (.ref 0 #[])
+          (.all .many .shared (.ref 0 #[]) (.ref 0 #[]))
+        value := .lam .many (.ref 0 #[]) (.lam .many (.ref 0 #[])
+          (.app (.app (.app (.app (.ref 3 #[0])
+            (.lam .many (.ref 0 #[]) (.ref 0 #[])))
+            (.var 1))
+            (.lam .many (.ref 0 #[]) (.lam .many (.ref 0 #[])
+              (.app (.ref 2 #[]) (.var 0)))))
+            (.var 0))) }
+    sharing := #[], refs := #[aNat, aZero, aSucc, aNatRec]
+    univs := #[.succ .zero] }
+
+private def storeL : List (Ixon.Address × Constant) :=
+  [(aNatBlock, cNatBlock), (aNat, cNat), (aZero, cZero), (aSucc, cSucc),
+   (aNatRec, cNatRec), (aAdd, cAdd)]
+
+private def resolver : Ixon.Address → Option Constant := fun a =>
+  (storeL.find? (fun p => p.1 == a)).map (·.2)
+
+private def ectxI : Ixon.Eval.EvalCtx :=
+  { resolve := resolver, natBlock := some aNatBlock }
+
+/-! ## The erased environment, pinned to the executable pass -/
+
+/-- Expected erasure of the successor rule's body. -/
+private def succRuleBody' : IxIR0.Expr :=
+  .app (.app (.var 1) (.var 0))
+    (.app (.app (.app (.app (.var 4) .erased) (.var 2)) (.var 1))
+      (.var 0))
+
+/-- Expected erasure of `add`'s body: motive ghosted to `◻`, the
+recursor referenced by address, the minor's lambdas kept. -/
+private def addBody' : IxIR0.Expr :=
+  .lam .many (.lam .many
+    (.app
+      (.app (.app (.app (.ref aNatRec) .erased) (.var 1))
+        (.lam .many (.lam .many (.app (.ref aSucc) (.var 0)))))
+      (.var 0)))
+
+private def maNat := Erase.memberAddr aNatBlock 0
+private def maNatRec := Erase.memberAddr aNatBlock 1
+
+private def erasedList : List (Ixon.Address × IxIR0.Decl) :=
+  [(maNat, .defn .shared .erased),
+   (maNatRec, .recursor 3 true #[
+     { fields := 0, rhs := .var 1 },
+     { fields := 1, rhs := succRuleBody' }]),
+   (aNat, .defn .shared .erased),
+   (aZero, .ctor 0 0),
+   (aSucc, .ctor 1 1),
+   (aNatRec, .defn .shared (.ref maNatRec)),
+   (aAdd, .defn .shared addBody')]
+
+private def coverageOrder : List Ixon.Address :=
+  [aZero, aSucc, aNatRec, aAdd]
+
+-- This is both the executable-erasure equality check and the environment
+-- adequacy check: success contains four kernel-checked `Covered` proofs.
+#guard (match EraseValidator.certifyProgram ectxI storeL coverageOrder
+    1000 1000 with
+  | .ok cert => cert.target == erasedList && cert.coverage.length == 4
+  | .error _ => false)
+
+-- The schedule is a real certificate obligation: `add` cannot be checked
+-- before the recursor and constructor facts its body references.
+#guard (match EraseValidator.certifyProgram ectxI storeL [aAdd] 1000 1000 with
+  | .error (.relation "reference lacks a Covered certificate") => true
+  | _ => false)
+
+private def ienv : IxIR0.Env := IxIR0.Env.ofList erasedList
+
+private def ictxI : IxIR0.Ctx := { env := ienv }
+
+/-! ## The program -/
+
+/-- Evaluation frame: refs 0 = add, 1 = zero, 2 = succ. -/
+private def testFI : Ixon.Eval.Frame :=
+  { refs := #[aAdd, aZero, aSucc] }
+
+private def natE : Nat → Ixon.Expr
+  | 0 => .ref 1 #[]
+  | n + 1 => .app (.ref 2 #[]) (natE n)
+
+private def natE' : Nat → IxIR0.Expr
+  | 0 => .ref aZero
+  | n + 1 => .app (.ref aSucc) (natE' n)
+
+private def addE : Ixon.Expr :=
+  .app (.app (.ref 0 #[]) (natE 2)) (natE 3)
+
+private def addE' : IxIR0.Expr :=
+  .app (.app (.ref aAdd) (natE' 2)) (natE' 3)
+
+/-! ## Generated coverage certificates -/
+
+private theorem covZero : Covered ectxI ictxI aZero :=
+  by
+    apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+    decide
+
+private theorem covSucc : Covered ectxI ictxI aSucc :=
+  by
+    apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+    decide
+
+private theorem covNatRec : Covered ectxI ictxI aNatRec :=
+  by
+    apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+    decide
+
+private def addCoverage : EraseValidator.CoverageDB ectxI ictxI :=
+  [{ address := aNatRec, covered := covNatRec },
+   { address := aSucc, covered := covSucc }]
+
+private theorem covAdd : Covered ectxI ictxI aAdd :=
+  by
+    apply EraseValidator.covered_of_validate
+      (db := addCoverage) (fuel := 100)
+    decide
+
+/-! ## The instance -/
+
+private def mainCoverage : EraseValidator.CoverageDB ectxI ictxI :=
+  [{ address := aAdd, covered := covAdd },
+   { address := aZero, covered := covZero },
+   { address := aSucc, covered := covSucc }]
+
+private def coverMain : EraseValidator.CoverOracle ectxI ictxI :=
+  mainCoverage.oracle
+
+private theorem addEDer : PErase ectxI ictxI none testFI.refs
+    testFI.selfMuts testFI.selfAddr [] addE addE' :=
+  by
+    apply EraseValidator.related_of_validateExpr
+      (cover := coverMain) (fuel := 100)
+    decide
+
+private def mainTables : Erase.ETables :=
+  { refs := testFI.refs, selfMuts := testFI.selfMuts }
+
+-- The proof-producing validator runs the executable eraser itself and
+-- returns a `PErase` witness for that exact output, not a parallel fixture.
+#guard (match EraseValidator.certifyExpr ectxI ictxI coverMain none
+    mainTables testFI.selfAddr [] addE 100 100 with
+  | .ok cert => cert.target == addE'
+  | .error _ => false)
+
+/-- **The first theorem, applied**: whenever the source `add 2̂ 3̂`
+terminates (it does — the `#guard` below witnesses the hypothesis
+executably; the fueled interpreters are well-founded definitions, so
+runs are compiler facts, not kernel `rfl`s), its erasure terminates
+under the IxIR₀ semantics with a related value. The content is the
+coverage derivation `addEDer`: it elaborates only because the
+relation covers exactly what the executable eraser emits. -/
+theorem addSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval ectxI fuel testFI [] addE = .ok v) :
+    ∃ fuel' v', IxIR0.eval ictxI fuel' [] addE' = .ok v' ∧
+      ValRel ectxI ictxI v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev addEDer
+
+-- The hypothesis is inhabited: the source run computes `5̂`…
+private def srcNatOf? : Nat → Ixon.Eval.Value → Option Nat
+  | 0, _ => none
+  | _, .ctorV _ _ 0 [] => some 0
+  | f + 1, .ctorV _ _ 1 [v] => (srcNatOf? f v).map (· + 1)
+  | _, _ => none
+
+#guard (match Ixon.Eval.eval ectxI 1000 testFI [] addE with
+  | .ok v => srcNatOf? 100 v == some 5
+  | .error _ => false)
+
+-- …and the erased run computes `5̂` on the target evaluator. The guard is
+-- address-sensitive: every successor cell must carry the `succ`
+-- constructor-projection address and the base cell the `zero` one — the
+-- same source-pinned addresses `ValRel.ctorV`'s `CtorAddr` premise demands
+-- (a wrong-family eraser would flunk this executably).
+#guard (match IxIR0.eval ictxI 1000 [] addE' with
+  | .ok (.ctor a5 1 [.ctor a4 1 [.ctor a3 1 [.ctor a2 1 [.ctor a1 1
+      [.ctor a0 0 []]]]]]) =>
+    a5 == aSucc && a4 == aSucc && a3 == aSucc && a2 == aSucc &&
+      a1 == aSucc && a0 == aZero
+  | _ => false)
+
+/-! ## IxIR₁ compiler ownership-contract instance -/
+
+section IxIR1CompilerContracts
+
+open Ix.Compiler.IxIR1.LowerSim
+
+@[simp] private theorem addrOf_eq_iff (left right : UInt8) :
+    addrOf left = addrOf right ↔ left = right := by
+  constructor
+  · intro h
+    have hget := congrArg
+      (fun address : Ixon.Address => address.get ⟨0, by decide⟩) h
+    simpa [addrOf] using hget
+  · intro h
+    subst right
+    rfl
+
+@[simp] private theorem memberAddr_ne_addrOf (idx : Nat) (byte : UInt8)
+    (hne : byte ≠ 0x10) :
+    Erase.memberAddr aNatBlock idx ≠ addrOf byte := by
+  intro h
+  have hget := congrArg
+    (fun address : Ixon.Address => address.get ⟨0, by decide⟩) h
+  have heq : (0x10 : UInt8) = byte := by
+    simpa [aNatBlock, addrOf] using hget
+  exact hne heq.symm
+
+@[simp] private theorem addrOf_ne_synthAddr_zero (byte : UInt8)
+    (hne : byte ≠ 0xFE) :
+    addrOf byte ≠ IxIR1.Lower.synthAddr 0 := by
+  intro h
+  have hget := congrArg
+    (fun address : Ixon.Address => address.get ⟨0, by decide⟩) h
+  have heq : byte = 0xFE := by
+    simpa [addrOf, IxIR1.Lower.synthAddr] using hget
+  exact hne heq
+
+@[simp] private theorem memberAddr_ne_synthAddr_zero (idx : Nat) :
+    Erase.memberAddr aNatBlock idx ≠ IxIR1.Lower.synthAddr 0 := by
+  intro h
+  have hget := congrArg
+    (fun address : Ixon.Address => address.get ⟨0, by decide⟩) h
+  have heq : (0x10 : UInt8) = 0xFE := by
+    simpa [aNatBlock, addrOf, IxIR1.Lower.synthAddr] using hget
+  revert heq
+  decide
+
+@[simp] private theorem maNat_ne_maNatRec : maNat ≠ maNatRec := by
+  intro h
+  have hget := congrArg
+    (fun address : Ixon.Address => address.get ⟨24, by decide⟩) h
+  simp only [maNat, maNatRec, Erase.memberAddr_get,
+    aNatBlock, addrOf, Ixon.Address.get_replicate] at hget
+  revert hget
+  decide
+
+@[simp] private theorem memberAddr_zero_ne_one :
+    Erase.memberAddr aNatBlock 0 ≠ Erase.memberAddr aNatBlock 1 := by
+  simpa [maNat, maNatRec] using maNat_ne_maNatRec
+
+@[simp] private theorem estateMapGet_run {error state result : Type}
+    (f : state → result) (initial : state) :
+    EStateM.run (f <$> (get : EStateM error state state)) initial =
+      .ok (f initial) initial := by
+  rfl
+
+@[simp] private theorem estateMapModify_run {error state result : Type}
+    (f : PUnit → result) (update : state → state) (initial : state) :
+    EStateM.run (f <$> (modify update : EStateM error state PUnit)) initial =
+      .ok (f ⟨⟩) (update initial) := by
+  rfl
+
+private theorem envOfList_some_mem {l : List (Ixon.Address × IxIR0.Decl)}
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    (hsrc : IxIR0.Env.ofList l address = some source) :
+    ∃ item ∈ l, item.1 = address ∧ item.2 = source := by
+  unfold IxIR0.Env.ofList at hsrc
+  cases hfind : l.find? (fun item => item.1 == address) with
+  | none => simp [hfind] at hsrc
+  | some item =>
+    have hmember := List.mem_of_find?_eq_some hfind
+    have hmatch := List.find?_some hfind
+    simp only [hfind, Option.map_some, Option.some.injEq] at hsrc
+    exact ⟨item, hmember, Ixon.Address.eq_of_beq hmatch, hsrc⟩
+
+private theorem targetEnv_some_mem {l : List (Ixon.Address × IxIR1.Decl)}
+    {address : Ixon.Address} {decl : IxIR1.Decl}
+    (hsrc : IxIR1.Env.ofList l address = some decl) :
+    ∃ item ∈ l, item.1 = address ∧ item.2 = decl := by
+  unfold IxIR1.Env.ofList at hsrc
+  cases hfind : l.find? (fun item => item.1 == address) with
+  | none => simp [hfind] at hsrc
+  | some item =>
+    have hmember := List.mem_of_find?_eq_some hfind
+    have hmatch := List.find?_some hfind
+    simp only [hfind, Option.map_some, Option.some.injEq] at hsrc
+    exact ⟨item, hmember, Ixon.Address.eq_of_beq hmatch, hsrc⟩
+
+private theorem ienv_cases {address : Ixon.Address} {source : IxIR0.Decl}
+    (hsrc : ienv address = some source) :
+    (address = maNat ∧ source = .defn .shared .erased) ∨
+    (address = maNatRec ∧ source = .recursor 3 true #[
+      { fields := 0, rhs := .var 1 },
+      { fields := 1, rhs := succRuleBody' }]) ∨
+    (address = aNat ∧ source = .defn .shared .erased) ∨
+    (address = aZero ∧ source = .ctor 0 0) ∨
+    (address = aSucc ∧ source = .ctor 1 1) ∨
+    (address = aNatRec ∧ source = .defn .shared (.ref maNatRec)) ∨
+    (address = aAdd ∧ source = .defn .shared addBody') := by
+  obtain ⟨item, hmember, haddress, hsource⟩ :=
+    envOfList_some_mem (l := erasedList) hsrc
+  simp only [erasedList, List.mem_cons] at hmember
+  rcases hmember with h | h | h | h | h | h | h
+  all_goals cases h
+  all_goals simp_all
+
+private def addAction :=
+  IxIR1.Lower.lowerAllAction erasedList addE' .shared 100
+
+private def addTargetDecls : List (Ixon.Address × IxIR1.Decl) :=
+  match addAction.run {} with
+  | .ok (decls, _) _ => decls
+  | .error _ _ => []
+
+private def addMainCode : IxIR1.Code :=
+  match addAction.run {} with
+  | .ok (_, code) _ => code
+  | .error _ _ => .ret .erased
+
+private def addFinalState : IxIR1.Lower.LowSt :=
+  match addAction.run {} with
+  | .ok _ state | .error _ state => state
+
+private def addTargetCtx : IxIR1.Ctx :=
+  { decls := IxIR1.Env.ofList addTargetDecls }
+
+private def addExpectedLiftedDef : IxIR1.FnDef :=
+  ⟨2, .shared, true,
+    .letOp (.drop (.var 1))
+      (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 1])
+        (.ret (.var 0)))⟩
+
+private def declOwnershipShape : IxIR1.Decl → Option (Nat × Ixon.Owned)
+  | .fn d => some (d.arity, d.result)
+  | .extern _ => none
+
+private def targetOwnershipShapes
+    (decls : List (Ixon.Address × IxIR1.Decl)) :=
+  decls.map fun item => (item.1, declOwnershipShape item.2)
+
+private theorem targetOwnershipShapes_addresses
+    (decls : List (Ixon.Address × IxIR1.Decl)) :
+    (targetOwnershipShapes decls).map Prod.fst = decls.map Prod.fst := by
+  simp [targetOwnershipShapes, List.map_map, Function.comp_def]
+
+/-- One kernel-reduced summary of the concrete lowering run. All subsequent
+layout facts project from this theorem instead of re-running the compiler or
+trusting native code generation. -/
+private theorem addAction_facts :
+    match addAction.run {} with
+    | .ok (decls, _) state =>
+      state.extra =
+          [(IxIR1.Lower.synthAddr 0, .fn addExpectedLiftedDef)] ∧
+        state.wrappers = [] ∧ state.fresh = 1 ∧
+        targetOwnershipShapes decls =
+          [(maNat, some (0, .shared)),
+           (maNatRec, some (4, .shared)),
+           (aNat, some (0, .shared)),
+           (aNatRec, some (0, .shared)),
+           (aAdd, some (2, .shared)),
+           (IxIR1.Lower.synthAddr 0, some (2, .shared))]
+    | .error _ _ => False := by
+  simp [addAction, IxIR1.Lower.lowerAllAction, erasedList, addE', natE',
+    succRuleBody', addBody', maNat, maNatRec, aNat, aZero, aSucc,
+    aNatRec, aAdd, addExpectedLiftedDef, targetOwnershipShapes,
+    declOwnershipShape, List.filterMapM, List.filterMapM.loop, List.filter,
+    List.range, List.range.loop, IxIR1.Lower.lowerDecl,
+    IxIR1.Lower.lowerFnBody, IxIR1.Lower.lowerRecursor,
+    IxIR1.Lower.lowerRecursorRule, IxIR1.Lower.releaseSlots,
+    IxIR1.Lower.parameterEntries, IxIR1.Lower.parameterDrops,
+    IxIR1.Lower.lamUses, IxIR1.Lower.lamArity,
+    IxIR1.Lower.stripLams, IxIR1.Lower.lowerE,
+    IxIR1.Lower.countUses, IxIR1.Lower.recursorFieldRetains,
+    IxIR1.Lower.applyRecursorFieldRetains,
+    IxIR1.Lower.SlotDrop.offsetEntry, IxIR1.Lower.VEnv.setEntry,
+    IxIR1.Lower.VEnv.bump, IxIR1.Lower.VEnv.rel,
+    IxIR1.Lower.worldOfUses, IxIR1.Lower.requireResultWorld,
+    IxIR1.Lower.lowerSpine, IxIR1.Lower.knownCall,
+    IxIR1.Lower.lowerArgs, IxIR1.Lower.applyRest,
+    IxIR1.Lower.lowerCaptures, IxIR1.Lower.lowerLam,
+    IxIR1.Lower.freshAddr, IxIR1.Lower.pushExtra,
+    IxIR1.Lower.papSafe, IxIR1.Lower.padWorlds,
+    IxIR1.Lower.AVal.toAtom, IxIR1.Lower.emitOp,
+    IxIR0.Env.ofList, bne]
+
+private theorem targetEnv_lookup_of_mem_nodup
+    {decls : List (Ixon.Address × IxIR1.Decl)}
+    (hnodup : (decls.map Prod.fst).Nodup)
+    {address : Ixon.Address} {decl : IxIR1.Decl}
+    (hmember : (address, decl) ∈ decls) :
+    IxIR1.Env.ofList decls address = some decl := by
+  induction decls with
+  | nil => simp at hmember
+  | cons head tail ih =>
+    rcases head with ⟨headAddress, headDecl⟩
+    simp only [List.map_cons, List.nodup_cons] at hnodup
+    simp only [List.mem_cons] at hmember
+    cases hmember with
+    | inl hhead =>
+      cases hhead
+      have hself : (address == address) = true := by
+        change (address.hash.data == address.hash.data) = true
+        exact (beq_iff_eq).mpr rfl
+      simp [IxIR1.Env.ofList, hself]
+    | inr htail =>
+      have hne : headAddress ≠ address := by
+        intro heq
+        apply hnodup.1
+        rw [heq]
+        exact List.mem_map.mpr ⟨(address, decl), htail, rfl⟩
+      have hbeq : (headAddress == address) = false := by
+        cases heq : headAddress == address with
+        | false => rfl
+        | true => exact (hne (Ixon.Address.eq_of_beq heq)).elim
+      simp only [IxIR1.Env.ofList, List.find?_cons, hbeq]
+      exact ih hnodup.2 htail
+
+private theorem sourceEnv_lookup_of_mem_nodup
+    {decls : List (Ixon.Address × IxIR0.Decl)}
+    (hnodup : (decls.map Prod.fst).Nodup)
+    {address : Ixon.Address} {decl : IxIR0.Decl}
+    (hmember : (address, decl) ∈ decls) :
+    IxIR0.Env.ofList decls address = some decl := by
+  induction decls with
+  | nil => simp at hmember
+  | cons head tail ih =>
+    rcases head with ⟨headAddress, headDecl⟩
+    simp only [List.map_cons, List.nodup_cons] at hnodup
+    simp only [List.mem_cons] at hmember
+    cases hmember with
+    | inl hhead =>
+      cases hhead
+      have hself : (address == address) = true := by
+        change (address.hash.data == address.hash.data) = true
+        exact (beq_iff_eq).mpr rfl
+      simp [IxIR0.Env.ofList, hself]
+    | inr htail =>
+      have hne : headAddress ≠ address := by
+        intro heq
+        apply hnodup.1
+        rw [heq]
+        exact List.mem_map.mpr ⟨(address, decl), htail, rfl⟩
+      have hbeq : (headAddress == address) = false := by
+        cases heq : headAddress == address with
+        | false => rfl
+        | true => exact (hne (Ixon.Address.eq_of_beq heq)).elim
+      simp only [IxIR0.Env.ofList, List.find?_cons, hbeq]
+      exact ih hnodup.2 htail
+
+private def firstExtraFn : List (Ixon.Address × IxIR1.Decl) → IxIR1.FnDef
+  | (_, .fn d) :: _ => d
+  | _ => ⟨0, .shared, false, .ret .erased⟩
+
+private def addLiftedDef : IxIR1.FnDef := firstExtraFn addFinalState.extra
+
+private def SingletonFnAt (address : Ixon.Address) :
+    List (Ixon.Address × IxIR1.Decl) → Prop
+  | [(found, .fn _)] => found = address
+  | _ => False
+
+private def singletonFnAtB (address : Ixon.Address) :
+    List (Ixon.Address × IxIR1.Decl) → Bool
+  | [(found, .fn _)] => found == address
+  | _ => false
+
+private theorem singletonFnAt_of_beq {address : Ixon.Address}
+    {extra : List (Ixon.Address × IxIR1.Decl)}
+    (hshape : singletonFnAtB address extra = true) :
+    SingletonFnAt address extra := by
+  cases extra with
+  | nil => simp [singletonFnAtB] at hshape
+  | cons head rest =>
+    rcases head with ⟨found, decl⟩
+    cases rest with
+    | nil =>
+      cases decl with
+      | extern arity => simp [singletonFnAtB] at hshape
+      | fn d =>
+        exact Ixon.Address.eq_of_beq (by
+          simpa [singletonFnAtB] using hshape)
+    | cons next tail => simp [singletonFnAtB] at hshape
+
+private theorem eq_singletonFn_of_shape {address : Ixon.Address}
+    {extra : List (Ixon.Address × IxIR1.Decl)}
+    (hshape : SingletonFnAt address extra) :
+    extra = [(address, .fn (firstExtraFn extra))] := by
+  cases extra with
+  | nil => simp [SingletonFnAt] at hshape
+  | cons head rest =>
+    rcases head with ⟨found, decl⟩
+    cases rest with
+    | nil =>
+      cases decl with
+      | extern arity => simp [SingletonFnAt] at hshape
+      | fn d =>
+        change found = address at hshape
+        subst found
+        rfl
+    | cons next tail => simp [SingletonFnAt] at hshape
+
+private theorem addAction_run : addAction.run {} =
+    .ok (addTargetDecls, addMainCode) addFinalState := by
+  have hfacts := addAction_facts
+  cases hrun : addAction.run {} with
+  | error error state => simp [hrun] at hfacts
+  | ok result state =>
+    rcases result with ⟨decls, code⟩
+    simp [addTargetDecls, addMainCode, addFinalState, hrun]
+
+private theorem addFinalState_extra : addFinalState.extra =
+    [(IxIR1.Lower.synthAddr 0, .fn addLiftedDef)] := by
+  have hfacts := addAction_facts
+  rw [addAction_run] at hfacts
+  have hextra := hfacts.1
+  simpa [addLiftedDef, firstExtraFn, hextra] using hextra
+
+private theorem addLiftedDef_eq_addExpected :
+    addLiftedDef = addExpectedLiftedDef := by
+  have hfacts := addAction_facts
+  rw [addAction_run] at hfacts
+  unfold addLiftedDef
+  rw [hfacts.1]
+  rfl
+
+private theorem addTargetOwnershipShapes :
+    targetOwnershipShapes addTargetDecls =
+      [(maNat, some (0, .shared)),
+       (maNatRec, some (4, .shared)),
+       (aNat, some (0, .shared)),
+       (aNatRec, some (0, .shared)),
+       (aAdd, some (2, .shared)),
+       (IxIR1.Lower.synthAddr 0, some (2, .shared))] := by
+  have hfacts := addAction_facts
+  rw [addAction_run] at hfacts
+  exact hfacts.2.2.2
+
+private theorem addTargetDecls_nodup :
+    (addTargetDecls.map Prod.fst).Nodup := by
+  have haddresses : addTargetDecls.map Prod.fst =
+      [maNat, maNatRec, aNat, aNatRec, aAdd,
+        IxIR1.Lower.synthAddr 0] := by
+    rw [← targetOwnershipShapes_addresses]
+    rw [addTargetOwnershipShapes]
+    rfl
+  rw [haddresses]
+  simp [maNat, maNatRec, aNat, aNatRec, aAdd]
+
+private theorem addLifted_lookup :
+    addTargetCtx.decls (IxIR1.Lower.synthAddr 0) =
+      some (.fn addLiftedDef) := by
+  apply targetEnv_lookup_of_mem_nodup addTargetDecls_nodup
+  apply IxIR1.LowerSim.lowerAllAction_extra_mem_result addAction_run
+  rw [addFinalState_extra]
+  simp
+
+private theorem addTargetFn_of_shape
+    {address : Ixon.Address} {arity : Nat} {result : Ixon.Owned}
+    (hmember : (address, some (arity, result)) ∈
+      [(maNat, some (0, .shared)),
+       (maNatRec, some (4, .shared)),
+       (aNat, some (0, .shared)),
+       (aNatRec, some (0, .shared)),
+       (aAdd, some (2, .shared)),
+       (IxIR1.Lower.synthAddr 0, some (2, .shared))]) :
+    ∃ d, addTargetCtx.decls address = some (.fn d) ∧
+      d.arity = arity ∧ d.result = result := by
+  have hmapped : (address, some (arity, result)) ∈
+      targetOwnershipShapes addTargetDecls := by
+    rw [addTargetOwnershipShapes]
+    exact hmember
+  unfold targetOwnershipShapes at hmapped
+  obtain ⟨item, hitem, hshape⟩ := List.mem_map.mp hmapped
+  rcases item with ⟨found, decl⟩
+  dsimp only at hshape
+  cases decl with
+  | extern externArity => simp [declOwnershipShape] at hshape
+  | fn d =>
+    simp only [declOwnershipShape, Prod.mk.injEq,
+      Option.some.injEq] at hshape
+    obtain ⟨rfl, harity, hresult⟩ := hshape
+    exact ⟨d, targetEnv_lookup_of_mem_nodup addTargetDecls_nodup hitem,
+      harity, hresult⟩
+
+private def targetFnAt (ctx : IxIR1.Ctx) (address : Ixon.Address) : IxIR1.FnDef :=
+  match ctx.decls address with
+  | some (.fn d) => d
+  | _ => ⟨0, .shared, false, .ret .erased⟩
+
+private def isFnAtB (ctx : IxIR1.Ctx) (address : Ixon.Address) : Bool :=
+  match ctx.decls address with
+  | some (.fn _) => true
+  | _ => false
+
+private theorem lookup_targetFnAt_of_isFnAtB {ctx : IxIR1.Ctx}
+    {address : Ixon.Address} (hfn : isFnAtB ctx address = true) :
+    ctx.decls address = some (.fn (targetFnAt ctx address)) := by
+  cases hlookup : ctx.decls address with
+  | none => simp [isFnAtB, hlookup] at hfn
+  | some decl =>
+    cases decl with
+    | extern arity => simp [isFnAtB, hlookup] at hfn
+    | fn d => simp [targetFnAt, hlookup]
+
+private theorem addSourceLayout : SourceDeclLayout ienv addTargetCtx := by
+  constructor
+  · intro address source worlds result hsrc hsignature
+    rcases ienv_cases hsrc with h | h | h | h | h | h | h
+    · obtain ⟨rfl, rfl⟩ := h
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simpa [IxIR1.Lower.lamArity] using
+        (addTargetFn_of_shape (address := maNat)
+        (arity := 0) (result := .shared) (by simp))
+    · obtain ⟨rfl, rfl⟩ := h
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simpa [IxIR1.Lower.lamArity] using
+        (addTargetFn_of_shape (address := maNatRec)
+        (arity := 4) (result := .shared) (by simp))
+    · obtain ⟨rfl, rfl⟩ := h
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simpa [IxIR1.Lower.lamArity] using
+        (addTargetFn_of_shape (address := aNat)
+        (arity := 0) (result := .shared) (by simp))
+    · obtain ⟨rfl, rfl⟩ := h
+      simp [sourceCallableSignature] at hsignature
+    · obtain ⟨rfl, rfl⟩ := h
+      simp [sourceCallableSignature] at hsignature
+    · obtain ⟨rfl, rfl⟩ := h
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simpa [IxIR1.Lower.lamArity] using
+        (addTargetFn_of_shape (address := aNatRec)
+        (arity := 0) (result := .shared) (by simp))
+    · obtain ⟨rfl, rfl⟩ := h
+      simp only [sourceCallableSignature, Option.some.injEq,
+        Prod.mk.injEq] at hsignature
+      obtain ⟨rfl, rfl⟩ := hsignature
+      simpa [addBody', IxIR1.Lower.lamArity] using
+        (addTargetFn_of_shape (address := aAdd)
+        (arity := 2) (result := .shared) (by simp))
+  · intro address arity hsrc
+    rcases ienv_cases hsrc with h | h | h | h | h | h | h
+    all_goals obtain ⟨rfl, h⟩ := h
+    all_goals simp at h
+
+private theorem addSourcePapSafe : SourcePapSafe ienv addTargetCtx := by
+  intro address source worlds result d hsrc hsignature _hdecl _hpapsafe
+  rcases ienv_cases hsrc with h | h | h | h | h | h | h
+  all_goals obtain ⟨rfl, rfl⟩ := h
+  all_goals
+    simp [sourceCallableSignature, addBody']
+      at hsignature
+  all_goals obtain ⟨rfl, rfl⟩ := hsignature
+  all_goals
+    simp [IxIR1.Lower.lamUses, IxIR1.Lower.worldOfUses]
+
+private theorem erasedList_nodup : (erasedList.map Prod.fst).Nodup := by
+  simp [erasedList, maNat, maNatRec, aNat, aZero, aSucc, aNatRec, aAdd]
+
+private theorem addTargetAddresses : addTargetDecls.map Prod.fst =
+    [maNat, maNatRec, aNat, aNatRec, aAdd,
+      IxIR1.Lower.synthAddr 0] := by
+  rw [← targetOwnershipShapes_addresses]
+  rw [addTargetOwnershipShapes]
+  rfl
+
+private theorem addExtraResultsShared : ExtraFnResultsShared addFinalState := by
+  intro address d hmember
+  rw [addFinalState_extra] at hmember
+  simp only [List.mem_singleton, Prod.mk.injEq] at hmember
+  obtain ⟨rfl, hdecl⟩ := hmember
+  have hd := IxIR1.Decl.fn.inj hdecl
+  subst d
+  rw [addLiftedDef_eq_addExpected]
+  rfl
+
+private theorem addFnDeclCovered :
+    FnDeclCovered ienv addTargetCtx addFinalState := by
+  intro address d hdecl
+  obtain ⟨item, hitem, hitemAddress, hitemDecl⟩ :=
+    targetEnv_some_mem hdecl
+  rcases item with ⟨itemAddress, itemDecl⟩
+  dsimp only at hitemAddress hitemDecl
+  subst address
+  subst itemDecl
+  have haddress : itemAddress ∈ addTargetDecls.map Prod.fst := by
+    exact List.mem_map.mpr ⟨(itemAddress, .fn d), hitem, rfl⟩
+  rw [addTargetAddresses] at haddress
+  simp only [List.mem_cons] at haddress
+  rcases haddress with h | h | h | h | h | h
+  · subst itemAddress
+    left
+    refine ⟨.defn .shared .erased, [], .shared, ?_, rfl⟩
+    exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+      simp only [erasedList]
+      exact List.mem_cons_self)
+  · subst itemAddress
+    left
+    refine ⟨.recursor 3 true #[
+        { fields := 0, rhs := .var 1 },
+        { fields := 1, rhs := succRuleBody' }],
+      List.replicate 4 .shared, .shared, ?_, rfl⟩
+    exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+      simp only [erasedList]
+      exact List.mem_cons_of_mem _ List.mem_cons_self)
+  · subst itemAddress
+    left
+    refine ⟨.defn .shared .erased, [], .shared, ?_, rfl⟩
+    exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+      simp only [erasedList]
+      exact List.mem_cons_of_mem _
+        (List.mem_cons_of_mem _ List.mem_cons_self))
+  · subst itemAddress
+    left
+    refine ⟨.defn .shared (.ref maNatRec), [], .shared, ?_, rfl⟩
+    exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+      simp only [erasedList]
+      exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+        (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ List.mem_cons_self)))))
+  · subst itemAddress
+    left
+    refine ⟨.defn .shared addBody',
+      [.shared, .shared], .shared, ?_, ?_⟩
+    · exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+        simp only [erasedList]
+        exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+            (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+              List.mem_cons_self))))))
+    · rfl
+  · have h' : itemAddress = IxIR1.Lower.synthAddr 0 := by
+      simpa using h
+    subst itemAddress
+    right
+    have hd : d = addLiftedDef := by
+      have heq : some (IxIR1.Decl.fn addLiftedDef) =
+          some (IxIR1.Decl.fn d) :=
+        addLifted_lookup.symm.trans hdecl
+      exact (IxIR1.Decl.fn.inj (Option.some.inj heq)).symm
+    subst d
+    rw [addFinalState_extra]
+    simp
+
+private theorem addExtraRepresented :
+    ExtraRepresented addTargetCtx addFinalState := by
+  apply lowerAllAction_extraRepresented addAction_run
+  intro address decl hmember
+  apply targetEnv_lookup_of_mem_nodup addTargetDecls_nodup
+  exact IxIR1.LowerSim.lowerAllAction_extra_mem_result addAction_run hmember
+
+private theorem addLowerDecl_run
+    {address : Ixon.Address} {source : IxIR0.Decl}
+    {worlds : List Ixon.Owned} {result : Ixon.Owned}
+    {d : IxIR1.FnDef}
+    (hmember : (address, source) ∈ erasedList)
+    (hsignature : sourceCallableSignature source = some (worlds, result))
+    (hdecl : addTargetCtx.decls address = some (.fn d)) :
+    ∃ initial final,
+      (IxIR1.Lower.lowerDecl ienv 100 (address, source)).run initial =
+          .ok (some (address, .fn d)) final ∧
+        ExtraRepresented addTargetCtx final := by
+  obtain ⟨initial, final, output, hrun, hextends, houtput⟩ :=
+    lowerAllAction_decl_trace addAction_run hmember
+  obtain ⟨generated, hgenerated⟩ :=
+    lowerDecl_output_fn_of_callable hsignature hrun
+  have htargetMember : (address, IxIR1.Decl.fn generated) ∈
+      addTargetDecls := houtput _ hgenerated
+  have hgeneratedDecl : addTargetCtx.decls address =
+      some (.fn generated) :=
+    targetEnv_lookup_of_mem_nodup addTargetDecls_nodup htargetMember
+  have hd : generated = d := by
+    have heq : some (IxIR1.Decl.fn generated) =
+        some (IxIR1.Decl.fn d) := hgeneratedDecl.symm.trans hdecl
+    exact IxIR1.Decl.fn.inj (Option.some.inj heq)
+  subst generated
+  refine ⟨initial, final, ?_, addExtraRepresented.of_extends hextends⟩
+  rw [hgenerated] at hrun
+  exact hrun
+
+private theorem addDef_preservesAt
+    {limit : Nat}
+    (happly : IxIR1.Sim.ApplyOwnershipContractBelow addTargetCtx limit)
+    (hdecls : SourceDeclContractsBelow ienv addTargetCtx limit)
+    {address : Ixon.Address} {result : Ixon.Owned} {body : IxIR0.Expr}
+    {d : IxIR1.FnDef}
+    (_hsrc : ienv address = some (.defn result body))
+    (hmember : (address, .defn result body) ∈ erasedList)
+    (hadmissible : ParameterDropsAdmissible
+      (IxIR1.Lower.lamUses body)
+      (fun index => IxIR1.Lower.countUses index
+        (IxIR1.Lower.stripLams body)))
+    (hdecl : addTargetCtx.decls address = some (.fn d)) :
+    IxIR1.Sim.FnOwnershipPreservesAt addTargetCtx d
+      ((IxIR1.Lower.lamUses body).map IxIR1.Lower.worldOfUses) limit := by
+  obtain ⟨initial, final, hrun, hrepresented⟩ :=
+    addLowerDecl_run hmember (by rfl) hdecl
+  exact lowerDecl_defn_preservesAt happly hdecls hadmissible hrun
+    hrepresented
+
+private theorem addRecursor_preservesAt
+    {limit : Nat}
+    (happly : IxIR1.Sim.ApplyOwnershipContractBelow addTargetCtx limit)
+    (hdecls : SourceDeclContractsBelow ienv addTargetCtx limit)
+    {address : Ixon.Address} {numArgs : Nat} {natLit : Bool}
+    {rules : Array IxIR0.RecRule} {d : IxIR1.FnDef}
+    (hsrc : ienv address = some (.recursor numArgs natLit rules))
+    (hmember : (address, .recursor numArgs natLit rules) ∈ erasedList)
+    (hdecl : addTargetCtx.decls address = some (.fn d)) :
+    IxIR1.Sim.FnOwnershipPreservesAt addTargetCtx d
+      (List.replicate (numArgs + 1) .shared) limit := by
+  obtain ⟨initial, final, hrun, hrepresented⟩ :=
+    addLowerDecl_run hmember (by rfl) hdecl
+  obtain ⟨self, hselfDecl, harity, hself⟩ :=
+    hdecls.recursorCurrentSelf hsrc
+  have hd : self = d := by
+    have heq : some (IxIR1.Decl.fn self) = some (IxIR1.Decl.fn d) :=
+      hselfDecl.symm.trans hdecl
+    exact IxIR1.Decl.fn.inj (Option.some.inj heq)
+  subst self
+  intro store store' args value rest hlength hown hcodeRun
+  exact lowerDecl_recursor_preservesAt happly hdecls hself hrun
+    hrepresented hlength hown hcodeRun
+
+private theorem addSourceFnPreservesAt
+    (limit : Nat)
+    (happly : IxIR1.Sim.ApplyOwnershipContractBelow addTargetCtx limit)
+    (hdecls : SourceDeclContractsBelow ienv addTargetCtx limit) :
+    SourceFnPreservesAt ienv addTargetCtx limit := by
+  intro address source worlds result d hsrc hsignature hdecl
+  rcases ienv_cases hsrc with h | h | h | h | h | h | h
+  · obtain ⟨rfl, rfl⟩ := h
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    apply addDef_preservesAt happly hdecls (by
+      exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+        simp only [erasedList]
+        exact List.mem_cons_self))
+    · exact List.mem_cons_self
+    · trivial
+    · exact hdecl
+  · obtain ⟨rfl, rfl⟩ := h
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    apply addRecursor_preservesAt happly hdecls (by
+      exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+        simp only [erasedList]
+        exact List.mem_cons_of_mem _ List.mem_cons_self))
+    · exact List.mem_cons_of_mem _ List.mem_cons_self
+    · exact hdecl
+  · obtain ⟨rfl, rfl⟩ := h
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    apply addDef_preservesAt happly hdecls (by
+      exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+        simp only [erasedList]
+        exact List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ List.mem_cons_self)))
+    · exact List.mem_cons_of_mem _
+        (List.mem_cons_of_mem _ List.mem_cons_self)
+    · trivial
+    · exact hdecl
+  · obtain ⟨rfl, rfl⟩ := h
+    simp [sourceCallableSignature] at hsignature
+  · obtain ⟨rfl, rfl⟩ := h
+    simp [sourceCallableSignature] at hsignature
+  · obtain ⟨rfl, rfl⟩ := h
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    apply addDef_preservesAt happly hdecls (by
+      exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+        simp only [erasedList]
+        exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+            (List.mem_cons_of_mem _ List.mem_cons_self))))))
+    · exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+        (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ List.mem_cons_self))))
+    · trivial
+    · exact hdecl
+  · obtain ⟨rfl, rfl⟩ := h
+    simp only [sourceCallableSignature, Option.some.injEq,
+      Prod.mk.injEq] at hsignature
+    obtain ⟨rfl, rfl⟩ := hsignature
+    apply addDef_preservesAt happly hdecls (by
+      exact sourceEnv_lookup_of_mem_nodup erasedList_nodup (by
+        simp only [erasedList]
+        exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+            (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+              List.mem_cons_self)))))))
+    · exact List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+        (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+          (List.mem_cons_of_mem _ (List.mem_cons_of_mem _
+            List.mem_cons_self)))))
+    · exact parameterDropsAdmissible_replicate_many 2 _
+    · exact hdecl
+
+private def addLiftedExpr : IxIR0.Expr :=
+  .lam .many (.lam .many (.app (.ref aSucc) (.var 0)))
+
+private def expectedLiftedDef : IxIR1.FnDef :=
+  addExpectedLiftedDef
+
+private def singletonVarB (expected : Nat) (args : Array IxIR1.Atom) : Bool :=
+  match args.toList with
+  | [.var index] => index == expected
+  | _ => false
+
+private theorem eq_singletonVar_of_matches {expected : Nat} {args : Array IxIR1.Atom}
+    (h : singletonVarB expected args = true) : args = #[.var expected] := by
+  cases hlist : args.toList with
+  | nil => simp [singletonVarB, hlist] at h
+  | cons atom rest =>
+    cases rest with
+    | nil =>
+      cases atom <;> try {simp [singletonVarB, hlist] at h}
+      case var index =>
+        have hindex : index = expected := by
+          apply beq_iff_eq.mp
+          simpa [singletonVarB, hlist] using h
+        subst index
+        apply Array.toList_inj.mp
+        simpa using hlist
+    | cons next tail => simp [singletonVarB, hlist] at h
+
+private def matchesAddLiftedBodyB : IxIR1.Code → Bool
+  | .letOp (.drop (.var dropIndex))
+      (.letOp (.alloc world cid args) (.ret (.var returnIndex))) =>
+    dropIndex == 1 && (world == .shared &&
+      (cid.block == aSucc && (cid.indIdx == 0 && (cid.cidx == 1 &&
+        (singletonVarB 1 args && returnIndex == 0)))))
+  | _ => false
+
+private theorem eq_expectedLiftedBody_of_matches {body : IxIR1.Code}
+    (h : matchesAddLiftedBodyB body = true) :
+    body = expectedLiftedDef.body := by
+  cases body with
+  | ret atom => simp [matchesAddLiftedBodyB] at h
+  | case scrut peel alts => simp [matchesAddLiftedBodyB] at h
+  | letOp op rest =>
+    cases op <;> try {simp [matchesAddLiftedBodyB] at h}
+    case drop target =>
+      cases target <;> try {simp [matchesAddLiftedBodyB] at h}
+      case var dropIndex =>
+        cases rest <;> try {simp [matchesAddLiftedBodyB] at h}
+        case letOp op rest =>
+          cases op <;> try {simp [matchesAddLiftedBodyB] at h}
+          case alloc world cid args =>
+            cases rest <;> try {simp [matchesAddLiftedBodyB] at h}
+            case ret atom =>
+              cases atom <;> try {simp [matchesAddLiftedBodyB] at h}
+              case var returnIndex =>
+                simp only [matchesAddLiftedBodyB] at h
+                change (dropIndex == 1 && (world == .shared &&
+                  (cid.block == aSucc && (cid.indIdx == 0 &&
+                    (cid.cidx == 1 && (singletonVarB 1 args &&
+                      returnIndex == 0)))))) = true at h
+                have hsplit : (dropIndex == 1) = true ∧
+                    (world == .shared &&
+                      (cid.block == aSucc && (cid.indIdx == 0 &&
+                        (cid.cidx == 1 && (singletonVarB 1 args &&
+                          returnIndex == 0))))) = true := by
+                  simpa only [Bool.and_eq_true] using h
+                have hdrop := hsplit.1
+                have hrest := hsplit.2
+                have hsplit : (world == .shared) = true ∧
+                    (cid.block == aSucc && (cid.indIdx == 0 &&
+                      (cid.cidx == 1 && (singletonVarB 1 args &&
+                        returnIndex == 0)))) = true := by
+                  simpa only [Bool.and_eq_true] using hrest
+                have hworld := hsplit.1
+                have hrest := hsplit.2
+                have hsplit : (cid.block == aSucc) = true ∧
+                    (cid.indIdx == 0 && (cid.cidx == 1 &&
+                      (singletonVarB 1 args && returnIndex == 0))) = true := by
+                  simpa only [Bool.and_eq_true] using hrest
+                have hblock := hsplit.1
+                have hrest := hsplit.2
+                have hsplit : (cid.indIdx == 0) = true ∧
+                    (cid.cidx == 1 &&
+                      (singletonVarB 1 args && returnIndex == 0)) = true := by
+                  simpa only [Bool.and_eq_true] using hrest
+                have hindIdx := hsplit.1
+                have hrest := hsplit.2
+                have hsplit : (cid.cidx == 1) = true ∧
+                    (singletonVarB 1 args && returnIndex == 0) = true := by
+                  simpa only [Bool.and_eq_true] using hrest
+                have hcidx := hsplit.1
+                have hrest := hsplit.2
+                have hsplit : singletonVarB 1 args = true ∧
+                    (returnIndex == 0) = true := by
+                  simpa only [Bool.and_eq_true] using hrest
+                have hargs := hsplit.1
+                have hreturn := hsplit.2
+                have hdrop' : dropIndex = 1 := beq_iff_eq.mp hdrop
+                have hworld' : world = .shared := by
+                  cases world with
+                  | unique =>
+                    have hfalse : ((.unique : Ixon.Owned) == .shared) =
+                        false := by decide
+                    rw [hfalse] at hworld
+                    exact Bool.noConfusion hworld
+                  | shared => rfl
+                have hblock' : cid.block = aSucc :=
+                  Ixon.Address.eq_of_beq hblock
+                have hindIdx' : cid.indIdx = 0 := beq_iff_eq.mp hindIdx
+                have hcidx' : cid.cidx = 1 := beq_iff_eq.mp hcidx
+                have hcid' : cid = IxIR1.Lower.ctorIdOf aSucc 1 := by
+                  rcases cid with ⟨block, indIdx, cidx⟩
+                  simp only [IxIR1.Lower.ctorIdOf] at hblock' hindIdx' hcidx' ⊢
+                  subst block
+                  subst indIdx
+                  subst cidx
+                  rfl
+                have hargs' : args = #[.var 1] :=
+                  eq_singletonVar_of_matches hargs
+                have hreturn' : returnIndex = 0 := beq_iff_eq.mp hreturn
+                subst dropIndex
+                subst world
+                subst cid
+                subst args
+                subst returnIndex
+                rfl
+
+private def matchesAddLiftedDefB (d : IxIR1.FnDef) : Bool :=
+  d.arity == 2 && (d.result == .shared &&
+    (d.papSafe && matchesAddLiftedBodyB d.body))
+
+private theorem eq_expectedLiftedDef_of_matches {d : IxIR1.FnDef}
+    (h : matchesAddLiftedDefB d = true) : d = expectedLiftedDef := by
+  rcases d with ⟨arity, result, papSafe, body⟩
+  change (arity == 2 &&
+    (result == .shared && (papSafe && matchesAddLiftedBodyB body))) = true at h
+  have hsplit : (arity == 2) = true ∧
+      (result == .shared && (papSafe && matchesAddLiftedBodyB body)) = true := by
+    simpa only [Bool.and_eq_true] using h
+  have harity := hsplit.1
+  have hrest := hsplit.2
+  have hsplit : (result == .shared) = true ∧
+      (papSafe && matchesAddLiftedBodyB body) = true := by
+    simpa only [Bool.and_eq_true] using hrest
+  have hresult := hsplit.1
+  have hpapBody : papSafe = true ∧ matchesAddLiftedBodyB body = true := by
+    simpa only [Bool.and_eq_true] using hsplit.2
+  have hpapsafe := hpapBody.1
+  have hbody := hpapBody.2
+  have harity' : arity = 2 := beq_iff_eq.mp harity
+  have hresult' : result = .shared := by
+    cases result with
+    | unique =>
+      have hfalse : ((.unique : Ixon.Owned) == .shared) = false := by
+        decide
+      rw [hfalse] at hresult
+      exact Bool.noConfusion hresult
+    | shared => rfl
+  have hbody' : body = expectedLiftedDef.body :=
+    eq_expectedLiftedBody_of_matches hbody
+  subst arity
+  subst result
+  subst papSafe
+  rw [hbody']
+  rfl
+
+private theorem addLiftedDef_eq_expected : addLiftedDef = expectedLiftedDef := by
+  exact addLiftedDef_eq_addExpected
+
+private def addLiftedAction :=
+  IxIR1.Lower.lowerLam ienv 100 ({} : IxIR1.Lower.VEnv) addLiftedExpr
+
+private def addLiftedOutput :
+    IxIR1.Lower.VEnv × IxIR1.Lower.Emit × IxIR1.Lower.AVal :=
+  match addLiftedAction.run {} with
+  | .ok output _ => output
+  | .error _ _ => ({}, id, .constA .erased)
+
+private def addLiftedReplayState : IxIR1.Lower.LowSt :=
+  match addLiftedAction.run {} with
+  | .ok _ state | .error _ state => state
+
+private theorem addLiftedAction_run_exact : addLiftedAction.run {} =
+    .ok (⟨[], 1⟩,
+      IxIR1.Lower.emitOp (.papp (IxIR1.Lower.synthAddr 0) #[]),
+      .slotA 0)
+      { extra := [(IxIR1.Lower.synthAddr 0, .fn expectedLiftedDef)],
+        fresh := 1 } := by
+  simp [addLiftedAction, addLiftedExpr, expectedLiftedDef,
+    addExpectedLiftedDef, ienv,
+    erasedList, maNat, maNatRec, aNat, aZero, aSucc, aNatRec, aAdd,
+    IxIR1.Lower.lowerLam, IxIR1.Lower.lowerCaptures,
+    IxIR1.Lower.lowerFnBody, IxIR1.Lower.releaseSlots,
+    IxIR1.Lower.parameterEntries, IxIR1.Lower.parameterDrops,
+    IxIR1.Lower.lamUses, IxIR1.Lower.lamArity,
+    IxIR1.Lower.stripLams, IxIR1.Lower.lowerE,
+    IxIR1.Lower.countUses, IxIR1.Lower.VEnv.setEntry,
+    IxIR1.Lower.VEnv.bump, IxIR1.Lower.VEnv.rel,
+    IxIR1.Lower.selectedEntriesFrom, IxIR1.Lower.worldOfUses,
+    IxIR1.Lower.lowerSpine, IxIR1.Lower.knownCall,
+    IxIR1.Lower.lowerArgs, IxIR1.Lower.applyRest,
+    IxIR1.Lower.requireResultWorld, IxIR1.Lower.padWorlds,
+    IxIR1.Lower.freshAddr, IxIR1.Lower.pushExtra,
+    IxIR1.Lower.papSafe, IxIR1.Lower.AVal.toAtom,
+    IxIR1.Lower.emitOp, List.filter, List.range, List.range.loop,
+    IxIR0.Env.ofList, bne, EStateM.instMonad,
+    EStateM.instMonadStateOf, EStateM.map, EStateM.get]
+
+private theorem addLiftedAction_run : addLiftedAction.run {} =
+    .ok addLiftedOutput addLiftedReplayState := by
+  simp [addLiftedOutput, addLiftedReplayState, addLiftedAction_run_exact]
+
+private def addLiftedReplayDef : IxIR1.FnDef :=
+  firstExtraFn addLiftedReplayState.extra
+
+private theorem addLiftedReplayState_extra : addLiftedReplayState.extra =
+    [(IxIR1.Lower.synthAddr 0, .fn expectedLiftedDef)] := by
+  simp [addLiftedReplayState, addLiftedAction_run_exact]
+
+private theorem addLiftedReplayRepresented :
+    ExtraRepresented addTargetCtx addLiftedReplayState := by
+  constructor
+  · intro address decl hmember
+    rw [addLiftedReplayState_extra] at hmember
+    simp only [List.mem_singleton, Prod.mk.injEq] at hmember
+    obtain ⟨rfl, hdecl⟩ := hmember
+    subst decl
+    rw [← addLiftedDef_eq_expected]
+    exact addLifted_lookup
+  · intro memo hmember
+    have hempty : addLiftedReplayState.wrappers = [] := by
+      simp [addLiftedReplayState, addLiftedAction_run_exact]
+    simp [hempty] at hmember
+
+private theorem addLifted_preservesAt
+    (limit : Nat)
+    (happly : IxIR1.Sim.ApplyOwnershipContractBelow addTargetCtx limit)
+    (hdecls : SourceDeclContractsBelow ienv addTargetCtx limit) :
+    IxIR1.Sim.FnOwnershipPreservesAt addTargetCtx addLiftedDef
+      (List.replicate 2 .shared) limit := by
+  rcases houtput : addLiftedOutput with ⟨output, emit, value⟩
+  have hrun : (IxIR1.Lower.lowerLam ienv 100
+      ({} : IxIR1.Lower.VEnv) addLiftedExpr).run {} =
+      .ok (output, emit, value) addLiftedReplayState := by
+    simpa [addLiftedAction, houtput] using addLiftedAction_run
+  have hgenerated := IxIR1.LowerSim.lowerLam_generatedFn_preservesAt
+    happly hdecls (input := ({} : IxIR1.Lower.VEnv))
+    (expr := addLiftedExpr) (state := ({} : IxIR1.Lower.LowSt))
+    (finalState := addLiftedReplayState) (output := output)
+    (emit := emit) (value := value)
+    (by simp [addLiftedExpr, IxIR1.Lower.lamArity]) hrun
+    addLiftedReplayRepresented
+  have hgenerated' : ∃ address code,
+      (address, .fn ⟨2, .shared, true, code⟩) ∈ addLiftedReplayState.extra ∧
+      addTargetCtx.decls address = some (.fn ⟨2, .shared, true, code⟩) ∧
+      IxIR1.Sim.FnOwnershipPreservesAt addTargetCtx
+        ⟨2, .shared, true, code⟩ (List.replicate 2 .shared) limit := by
+    simpa [addLiftedExpr, IxIR1.Lower.lamArity] using hgenerated
+  obtain ⟨address, code, hmember, _, hpreserves⟩ := hgenerated'
+  rw [addLiftedReplayState_extra] at hmember
+  simp only [List.mem_singleton, Prod.mk.injEq] at hmember
+  have hfn : (⟨2, .shared, true, code⟩ : IxIR1.FnDef) = expectedLiftedDef :=
+    IxIR1.Decl.fn.inj hmember.2
+  have hd : addLiftedDef = (⟨2, .shared, true, code⟩ : IxIR1.FnDef) :=
+    addLiftedDef_eq_expected.trans hfn.symm
+  intro store store' args value rest hlength hown hcodeRun
+  have hcodeRun' : IxIR1.runCode addTargetCtx limit
+      (⟨2, .shared, true, code⟩ : IxIR1.FnDef) store args.reverse code =
+        .ok (store', value) := by
+    simpa only [hd] using hcodeRun
+  have hout := hpreserves hlength hown hcodeRun'
+  simpa only [hd] using hout
+
+private theorem addExtraFnPreservesAt
+    (limit : Nat)
+    (happly : IxIR1.Sim.ApplyOwnershipContractBelow addTargetCtx limit)
+    (hdecls : SourceDeclContractsBelow ienv addTargetCtx limit) :
+    ExtraFnPreservesAt addTargetCtx addFinalState limit := by
+  intro address d hmember
+  rw [addFinalState_extra] at hmember
+  simp only [List.mem_singleton, Prod.mk.injEq] at hmember
+  obtain ⟨rfl, hdecl⟩ := hmember
+  have hd : d = addLiftedDef :=
+    IxIR1.Decl.fn.inj hdecl
+  subst d
+  have hresult : addLiftedDef.result = .shared := by
+    rw [addLiftedDef_eq_expected]
+    rfl
+  have harity : addLiftedDef.arity = 2 := by
+    rw [addLiftedDef_eq_expected]
+    rfl
+  refine ⟨hresult, ?_⟩
+  rw [harity]
+  exact addLifted_preservesAt limit happly hdecls
+
+theorem addIxIR1CompilerContracts :
+    CompilerContracts ienv addTargetCtx ∧
+      ExtraFnContracts addTargetCtx addFinalState := by
+  apply compilerContracts_of_source_extra_below_step
+    addSourceLayout addSourcePapSafe addExtraResultsShared addFnDeclCovered
+  intro limit hsource _ happly
+  exact ⟨addSourceFnPreservesAt limit happly hsource,
+    addExtraFnPreservesAt limit happly hsource⟩
+
+end IxIR1CompilerContracts
+
+/-! ## IxIR₁ semantic forward-simulation instance
+
+The exact compiled `add 2 3` fixture is evaluated through small,
+kernel-checked trace segments.  Keeping allocation, recursive-call, and
+closure-application steps separate avoids a native evaluation oracle while
+making the RC transitions visible in the proof.
+-/
+
+section IxIR1SemanticSimulation
+
+open Ix.Compiler.IxIR1.LowerSim
+
+private def ixNatValue : Nat → IxIR0.Value
+  | 0 => .ctor aZero 0 []
+  | n + 1 => .ctor aSucc 1 [ixNatValue n]
+
+private def expectedMainCode : IxIR1.Code :=
+  .letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aZero 0) #[])
+    (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 0])
+      (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 0])
+        (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aZero 0) #[])
+          (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 0])
+            (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 0])
+              (.letOp (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 0])
+                (.letOp (.call aAdd #[.var 4, .var 0])
+                  (.ret (.var 0)))))))))
+
+private def expectedRecursorDef : IxIR1.FnDef :=
+  ⟨4, .shared, true,
+    .case (.var 0) true #[
+      .mk 0 0
+        (.letOp (.drop (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 5))
+              (.ret (.var 5))))),
+      .mk 1 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 6))
+              (.letOp (.dup (.var 5))
+                (.letOp (.dup (.var 3))
+                  (.letOp (.callSelf #[.erased, .var 8, .var 7, .var 4])
+                    (.letOp (.apply (.var 2) #[.var 1, .var 0])
+                      (.ret (.var 0)))))))))]⟩
+
+private def expectedAliasDef : IxIR1.FnDef :=
+  ⟨0, .shared, true,
+    .letOp (.papp maNatRec #[]) (.ret (.var 0))⟩
+
+private def expectedAddDef : IxIR1.FnDef :=
+  ⟨2, .shared, true,
+    .letOp (.call aNatRec #[])
+      (.letOp (.papp (IxIR1.Lower.synthAddr 0) #[])
+        (.letOp (.apply (.var 1) #[.erased, .var 3, .var 0, .var 2])
+          (.ret (.var 0))))⟩
+
+private def expectedTargetDecls : List (Ixon.Address × IxIR1.Decl) :=
+  [(maNat, .fn ⟨0, .shared, true, .ret .erased⟩),
+   (maNatRec, .fn expectedRecursorDef),
+   (aNat, .fn ⟨0, .shared, true, .ret .erased⟩),
+   (aNatRec, .fn expectedAliasDef),
+   (aAdd, .fn expectedAddDef),
+   (IxIR1.Lower.synthAddr 0, .fn expectedLiftedDef)]
+
+private theorem addAction_exact : addAction.run {} =
+    .ok (expectedTargetDecls, expectedMainCode)
+      { extra := [(IxIR1.Lower.synthAddr 0, .fn expectedLiftedDef)],
+        fresh := 1 } := by
+  simp [addAction, IxIR1.Lower.lowerAllAction, erasedList, addE', natE',
+    succRuleBody', addBody', maNat, maNatRec, aNat, aZero, aSucc,
+    aNatRec, aAdd, expectedMainCode, expectedTargetDecls,
+    expectedRecursorDef, expectedAliasDef, expectedAddDef,
+    expectedLiftedDef, addExpectedLiftedDef,
+    List.filterMapM, List.filterMapM.loop, List.filter,
+    List.range, List.range.loop, IxIR1.Lower.lowerDecl,
+    IxIR1.Lower.lowerFnBody, IxIR1.Lower.lowerRecursor,
+    IxIR1.Lower.lowerRecursorRule, IxIR1.Lower.releaseSlots,
+    IxIR1.Lower.parameterEntries, IxIR1.Lower.parameterDrops,
+    IxIR1.Lower.lamUses, IxIR1.Lower.lamArity,
+    IxIR1.Lower.stripLams, IxIR1.Lower.lowerE,
+    IxIR1.Lower.countUses, IxIR1.Lower.recursorFieldRetains,
+    IxIR1.Lower.applyRecursorFieldRetains,
+    IxIR1.Lower.SlotDrop.offsetEntry, IxIR1.Lower.VEnv.setEntry,
+    IxIR1.Lower.VEnv.bump, IxIR1.Lower.VEnv.rel,
+    IxIR1.Lower.worldOfUses, IxIR1.Lower.requireResultWorld,
+    IxIR1.Lower.lowerSpine, IxIR1.Lower.knownCall,
+    IxIR1.Lower.lowerArgs, IxIR1.Lower.applyRest,
+    IxIR1.Lower.lowerCaptures, IxIR1.Lower.lowerLam,
+    IxIR1.Lower.freshAddr, IxIR1.Lower.pushExtra,
+    IxIR1.Lower.papSafe, IxIR1.Lower.padWorlds,
+    IxIR1.Lower.AVal.toAtom, IxIR1.Lower.emitOp,
+    IxIR0.Env.ofList, bne]
+private def expectedCtx : IxIR1.Ctx :=
+  { decls := IxIR1.Env.ofList expectedTargetDecls }
+
+set_option allowUnsafeReducibility true
+attribute [local reducible]
+  IxIR1.runCode IxIR1.runOp IxIR1.invoke IxIR1.applyGo
+  IxIR1.dropVal IxIR1.dropMany IxIR1.dupVals
+  IxIR1.checkResultWorld IxIR1.RVal.hasWorld
+  IxIR1.resolveAtom IxIR1.resolveAtoms IxIR1.declArity
+  IxIR1.Store.allocNode IxIR1.Store.get? IxIR1.Store.setBox
+  IxIR1.Store.kill IxIR1.Store.rcTick
+set_option allowUnsafeReducibility false
+
+private theorem runCode_letOp_of_runOp {ctx : IxIR1.Ctx} {fuel : Nat}
+    {cur : IxIR1.FnDef} {store store' : IxIR1.Store}
+    {env : List IxIR1.RVal} {op : IxIR1.Op} {rest : IxIR1.Code}
+    {value : IxIR1.RVal}
+    (hop : IxIR1.runOp ctx fuel cur store env op = .ok (store', value)) :
+    IxIR1.runCode ctx (fuel + 1) cur store env (.letOp op rest) =
+      IxIR1.runCode ctx fuel cur store' (value :: env) rest := by
+  rw [IxIR1.runCode.eq_def]
+  dsimp only
+  rw [hop]
+  rfl
+
+private theorem checkResultWorld_of_hasWorld {world : Ixon.Owned}
+    {store : IxIR1.Store} {value : IxIR1.RVal}
+    (hworld : IxIR1.Sim.HasWorld store world value) :
+    IxIR1.checkResultWorld world (store, value) = .ok (store, value) := by
+  unfold IxIR1.checkResultWorld
+  rw [if_pos (IxIR1.Sim.rval_hasWorld_eq_true_iff.mpr hworld)]
+
+private theorem invoke_fn_of_runCode {ctx : IxIR1.Ctx} {fuel : Nat}
+    {address : Ixon.Address} {args : List IxIR1.RVal}
+    {store store' : IxIR1.Store} {value : IxIR1.RVal}
+    {d : IxIR1.FnDef}
+    (hdecl : ctx.decls address = some (.fn d))
+    (hlength : args.length = d.arity)
+    (hrun : IxIR1.runCode ctx fuel d store args.reverse d.body =
+      .ok (store', value))
+    (hworld : IxIR1.Sim.HasWorld store' d.result value) :
+    IxIR1.invoke ctx (fuel + 1) address args store =
+      .ok (store', value) := by
+  rw [IxIR1.invoke.eq_def]
+  dsimp only
+  rw [hdecl]
+  simp only
+  rw [if_neg (by simp [hlength])]
+  rw [hrun]
+  exact checkResultWorld_of_hasWorld hworld
+
+private theorem runOp_call_of_invoke {ctx : IxIR1.Ctx} {fuel : Nat}
+    {cur : IxIR1.FnDef} {store store' : IxIR1.Store}
+    {env : List IxIR1.RVal} {address : Ixon.Address}
+    {atoms : Array IxIR1.Atom} {args : List IxIR1.RVal}
+    {value : IxIR1.RVal}
+    (hargs : IxIR1.resolveAtoms env atoms = .ok args)
+    (hinvoke : IxIR1.invoke ctx fuel address args store =
+      .ok (store', value)) :
+    IxIR1.runOp ctx (fuel + 1) cur store env (.call address atoms) =
+      .ok (store', value) := by
+  rw [IxIR1.runOp.eq_def]
+  dsimp only
+  rw [hargs]
+  simp only [bind, Except.bind]
+  exact hinvoke
+
+private theorem runOp_papp {ctx : IxIR1.Ctx} {fuel : Nat}
+    {cur : IxIR1.FnDef} {store : IxIR1.Store}
+    {env : List IxIR1.RVal} {address : Ixon.Address}
+    {atoms : Array IxIR1.Atom} {args : List IxIR1.RVal}
+    {decl : IxIR1.Decl}
+    (hargs : IxIR1.resolveAtoms env atoms = .ok args)
+    (hdecl : ctx.decls address = some decl)
+    (hunder : args.length < IxIR1.declArity decl) :
+    IxIR1.runOp ctx (fuel + 1) cur store env (.papp address atoms) =
+      .ok ((store.allocNode .shared
+          (.papN address (IxIR1.declArity decl) args.toArray)).1,
+        .loc (store.allocNode .shared
+          (.papN address (IxIR1.declArity decl) args.toArray)).2) := by
+  rw [IxIR1.runOp.eq_def]
+  dsimp only
+  rw [hargs]
+  simp only [bind, Except.bind]
+  rw [hdecl]
+  simp only
+  rw [if_pos hunder]
+
+private theorem runOp_apply_of_applyGo {ctx : IxIR1.Ctx} {fuel : Nat}
+    {cur : IxIR1.FnDef} {store store' : IxIR1.Store}
+    {env : List IxIR1.RVal} {function : IxIR1.Atom}
+    {atoms : Array IxIR1.Atom} {fv value : IxIR1.RVal}
+    {args : List IxIR1.RVal}
+    (hfunction : IxIR1.resolveAtom env function = .ok fv)
+    (hargs : IxIR1.resolveAtoms env atoms = .ok args)
+    (happly : IxIR1.applyGo ctx fuel store fv args = .ok (store', value)) :
+    IxIR1.runOp ctx (fuel + 1) cur store env (.apply function atoms) =
+      .ok (store', value) := by
+  rw [IxIR1.runOp.eq_def]
+  dsimp only
+  rw [hfunction]
+  simp only [bind, Except.bind]
+  rw [hargs]
+  exact happly
+
+private def mainCur : IxIR1.FnDef := ⟨0, .shared, false, expectedMainCode⟩
+
+private def mainStep0 := ({} : IxIR1.Store).allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aZero 0) #[])
+private def mainStore1 := mainStep0.1
+private def mainLoc0 := mainStep0.2
+
+private def mainStep1 := mainStore1.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) ([.loc mainLoc0].toArray))
+private def mainStore2 := mainStep1.1
+private def mainLoc1 := mainStep1.2
+
+private def mainStep2 := mainStore2.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) ([.loc mainLoc1].toArray))
+private def mainStore3 := mainStep2.1
+private def mainLoc2 := mainStep2.2
+
+private def mainStep3 := mainStore3.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aZero 0) #[])
+private def mainStore4 := mainStep3.1
+private def mainLoc3 := mainStep3.2
+
+private def mainStep4 := mainStore4.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) ([.loc mainLoc3].toArray))
+private def mainStore5 := mainStep4.1
+private def mainLoc4 := mainStep4.2
+
+private def mainStep5 := mainStore5.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) ([.loc mainLoc4].toArray))
+private def mainStore6 := mainStep5.1
+private def mainLoc5 := mainStep5.2
+
+private def mainStep6 := mainStore6.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) ([.loc mainLoc5].toArray))
+private def mainStore7 := mainStep6.1
+private def mainLoc6 := mainStep6.2
+
+private theorem main_prefix :
+    IxIR1.runCode expectedCtx 46 mainCur
+        {} [] expectedMainCode =
+      IxIR1.runCode expectedCtx 39 mainCur mainStore7
+        [.loc mainLoc6, .loc mainLoc5, .loc mainLoc4, .loc mainLoc3,
+          .loc mainLoc2, .loc mainLoc1, .loc mainLoc0]
+        (.letOp (.call aAdd #[.var 4, .var 0]) (.ret (.var 0))) := by
+  unfold expectedMainCode
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rw [runCode_letOp_of_runOp (IxIR1.Sim.runOp_alloc (by rfl))]
+  rfl
+
+private theorem expectedExpectedCtx_add : expectedCtx.decls aAdd =
+    some (.fn expectedAddDef) := by
+  simp [expectedCtx, expectedTargetDecls, IxIR1.Env.ofList,
+    maNat, maNatRec, aNat, aNatRec, aAdd]
+
+private theorem expectedExpectedCtx_alias : expectedCtx.decls aNatRec =
+    some (.fn expectedAliasDef) := by
+  simp [expectedCtx, expectedTargetDecls, IxIR1.Env.ofList,
+    maNat, maNatRec, aNat, aNatRec, aAdd]
+
+private theorem expectedExpectedCtx_recursor : expectedCtx.decls maNatRec =
+    some (.fn expectedRecursorDef) := by
+  simp [expectedCtx, expectedTargetDecls, IxIR1.Env.ofList,
+    maNat, maNatRec, aNat, aNatRec, aAdd]
+
+private theorem expectedExpectedCtx_lifted :
+    expectedCtx.decls (IxIR1.Lower.synthAddr 0) =
+      some (.fn expectedLiftedDef) := by
+  simp [expectedCtx, expectedTargetDecls, IxIR1.Env.ofList,
+    maNat, maNatRec, aNat, aNatRec, aAdd]
+
+private def aliasStep := mainStore7.allocNode .shared
+  (.papN maNatRec expectedRecursorDef.arity #[])
+private def aliasStore := aliasStep.1
+private def aliasLoc := aliasStep.2
+
+private theorem alias_runCode :
+    IxIR1.runCode expectedCtx 33 expectedAliasDef mainStore7 []
+        expectedAliasDef.body =
+      .ok (aliasStore, .loc aliasLoc) := by
+  rw [show expectedAliasDef.body =
+    .letOp (.papp maNatRec #[]) (.ret (.var 0)) by rfl]
+  rw [runCode_letOp_of_runOp (runOp_papp (by rfl)
+    expectedExpectedCtx_recursor (by decide))]
+  rfl
+
+private theorem alias_result_world :
+    IxIR1.Sim.HasWorld aliasStore .shared (.loc aliasLoc) := by
+  simpa [aliasStore, aliasLoc, aliasStep] using
+    (IxIR1.Sim.HasWorld.allocNode_new mainStore7 .shared
+      (.papN maNatRec expectedRecursorDef.arity #[]))
+
+private theorem alias_invoke :
+    IxIR1.invoke expectedCtx 34 aNatRec [] mainStore7 =
+      .ok (aliasStore, .loc aliasLoc) := by
+  exact invoke_fn_of_runCode expectedExpectedCtx_alias rfl
+    alias_runCode alias_result_world
+
+private def liftStep := aliasStore.allocNode .shared
+  (.papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[])
+private def liftStore := liftStep.1
+private def liftLoc := liftStep.2
+
+private theorem add_runCode_to_apply :
+    IxIR1.runCode expectedCtx 36 expectedAddDef mainStore7
+        [.loc mainLoc6, .loc mainLoc2] expectedAddDef.body =
+      IxIR1.runCode expectedCtx 34 expectedAddDef liftStore
+        [.loc liftLoc, .loc aliasLoc, .loc mainLoc6, .loc mainLoc2]
+        (.letOp
+          (.apply (.var 1) #[.erased, .var 3, .var 0, .var 2])
+          (.ret (.var 0))) := by
+  rw [show expectedAddDef.body =
+    .letOp (.call aNatRec #[])
+      (.letOp (.papp (IxIR1.Lower.synthAddr 0) #[])
+        (.letOp (.apply (.var 1) #[.erased, .var 3, .var 0, .var 2])
+          (.ret (.var 0)))) by rfl]
+  rw [runCode_letOp_of_runOp
+    (runOp_call_of_invoke (by rfl) alias_invoke)]
+  rw [runCode_letOp_of_runOp
+    (runOp_papp (by rfl) expectedExpectedCtx_lifted (by decide))]
+  rfl
+
+private theorem dropVal_pap_one_empty {ctx : IxIR1.Ctx} {fuel : Nat}
+    {store : IxIR1.Store} {loc : Nat} {address : Ixon.Address}
+    {arity : Nat}
+    (hget : store.get? loc =
+      some ⟨.shared, 1, .papN address arity #[]⟩) :
+    IxIR1.dropVal ctx (fuel + 2) store (.loc loc) =
+      .ok (store.rcTick.kill loc) := by
+  rw [IxIR1.dropVal.eq_def]
+  dsimp only
+  rw [hget]
+  dsimp only
+  rw [if_pos (by decide)]
+  rw [IxIR1.dropMany.eq_def]
+
+private theorem applyGo_pap_empty_saturated {ctx : IxIR1.Ctx} {fuel : Nat}
+    {store : IxIR1.Store} {loc : Nat} {address : Ixon.Address}
+    {arity : Nat} {args : List IxIR1.RVal} {declaration : IxIR1.Decl}
+    (hget : store.get? loc =
+      some ⟨.shared, 1, .papN address arity #[]⟩)
+    (hlength : args.length = arity)
+    (hdecl : ctx.decls address = some declaration)
+    (hpapsafe : IxIR1.declPapSafe declaration = true) :
+    IxIR1.applyGo ctx (fuel + 3) store (.loc loc) args =
+      IxIR1.invoke ctx (fuel + 2) address args
+        (store.rcTick.kill loc) := by
+  rw [IxIR1.applyGo.eq_def]
+  dsimp only
+  rw [hget]
+  dsimp only
+  have hdup : IxIR1.dupVals store [] = .ok store := by rfl
+  rw [hdup]
+  simp only [bind, Except.bind, List.nil_append]
+  rw [dropVal_pap_one_empty hget]
+  simp [hlength, hdecl, hpapsafe]
+
+private theorem liftStore_alias_get : liftStore.get? aliasLoc =
+    some ⟨.shared, 1,
+      .papN maNatRec expectedRecursorDef.arity #[]⟩ := by
+  have hold : aliasStore.get? aliasLoc =
+      some ⟨.shared, 1,
+        .papN maNatRec expectedRecursorDef.arity #[]⟩ := by
+    simpa [aliasStore, aliasLoc, aliasStep] using
+      (IxIR1.Sim.HeapIso.get?_allocNode_new mainStore7 .shared
+        (.papN maNatRec expectedRecursorDef.arity #[]))
+  simpa [liftStore, liftStep] using
+    (IxIR1.Sim.HeapIso.get?_allocNode_old
+      (world := .shared)
+      (node := .papN (IxIR1.Lower.synthAddr 0)
+        expectedLiftedDef.arity #[]) hold)
+
+private def recEntryStore := liftStore.rcTick.kill aliasLoc
+
+private theorem initial_applyGo :
+    IxIR1.applyGo expectedCtx 32 liftStore (.loc aliasLoc)
+        [.erased, .loc mainLoc2, .loc liftLoc, .loc mainLoc6] =
+      IxIR1.invoke expectedCtx 31 maNatRec
+        [.erased, .loc mainLoc2, .loc liftLoc, .loc mainLoc6]
+        recEntryStore := by
+  simpa [recEntryStore] using
+    (applyGo_pap_empty_saturated (fuel := 29)
+      liftStore_alias_get (by rfl) expectedExpectedCtx_recursor (by rfl))
+
+example : recEntryStore.get? mainLoc6 =
+    some ⟨.shared, 1,
+      .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc5]⟩ := by
+  rfl
+
+example : recEntryStore.get? mainLoc5 =
+    some ⟨.shared, 1,
+      .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc4]⟩ := by
+  rfl
+
+private def topDupChildStore := IxIR1.Sim.incRcStore recEntryStore mainLoc5
+  ⟨.shared, 1,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc4]⟩
+private def topDropMajorBase := topDupChildStore.rcTick.kill mainLoc6
+private def topDropMajorStore := IxIR1.Sim.decRcStore topDropMajorBase mainLoc5
+  ⟨.shared, 2,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc4]⟩
+private def topDupClosureStore := IxIR1.Sim.incRcStore topDropMajorStore liftLoc
+  ⟨.shared, 1,
+    .papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[]⟩
+private def topCallStore := IxIR1.Sim.incRcStore topDupClosureStore mainLoc5
+  ⟨.shared, 1,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc4]⟩
+
+private def level2DupChildStore := IxIR1.Sim.incRcStore topCallStore mainLoc4
+  ⟨.shared, 1,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc3]⟩
+private def level2DropMajorStore := IxIR1.Sim.decRcStore level2DupChildStore mainLoc5
+  ⟨.shared, 2,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc4]⟩
+private def level2DupClosureStore :=
+  IxIR1.Sim.incRcStore level2DropMajorStore liftLoc
+    ⟨.shared, 2,
+      .papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[]⟩
+private def level2CallStore := IxIR1.Sim.incRcStore level2DupClosureStore mainLoc4
+  ⟨.shared, 2,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc3]⟩
+
+private def level1DupChildStore := IxIR1.Sim.incRcStore level2CallStore mainLoc3
+  ⟨.shared, 1,
+    .ctorN (IxIR1.Lower.ctorIdOf aZero 0) #[]⟩
+private def level1DropMajorStore := IxIR1.Sim.decRcStore level1DupChildStore mainLoc4
+  ⟨.shared, 3,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc3]⟩
+private def level1DupClosureStore :=
+  IxIR1.Sim.incRcStore level1DropMajorStore liftLoc
+    ⟨.shared, 3,
+      .papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[]⟩
+private def level1CallStore := IxIR1.Sim.incRcStore level1DupClosureStore mainLoc3
+  ⟨.shared, 2,
+    .ctorN (IxIR1.Lower.ctorIdOf aZero 0) #[]⟩
+
+private def baseDropMajorStore := IxIR1.Sim.decRcStore level1CallStore mainLoc3
+  ⟨.shared, 3,
+    .ctorN (IxIR1.Lower.ctorIdOf aZero 0) #[]⟩
+private def baseStore := IxIR1.Sim.decRcStore baseDropMajorStore liftLoc
+  ⟨.shared, 4,
+    .papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[]⟩
+
+private theorem recursor_top_prefix :
+    IxIR1.runCode expectedCtx 30 expectedRecursorDef recEntryStore
+        [.loc mainLoc6, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      IxIR1.runCode expectedCtx 24 expectedRecursorDef topCallStore
+        [.loc mainLoc5, .loc liftLoc, .erased, .erased,
+          .loc mainLoc5, .loc mainLoc5, .loc mainLoc6, .loc liftLoc,
+          .loc mainLoc2, .erased]
+        (.letOp
+          (.callSelf #[.erased, .var 8, .var 7, .var 4])
+          (.letOp (.apply (.var 2) #[.var 1, .var 0])
+            (.ret (.var 0)))) := by
+  rw [show expectedRecursorDef.body = .case (.var 0) true #[
+      .mk 0 0
+        (.letOp (.drop (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 5))
+              (.ret (.var 5))))),
+      .mk 1 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 6))
+              (.letOp (.dup (.var 5))
+                (.letOp (.dup (.var 3))
+                  (.letOp (.callSelf #[.erased, .var 8, .var 7, .var 4])
+                    (.letOp (.apply (.var 2) #[.var 1, .var 0])
+                      (.ret (.var 0)))))))))] by rfl]
+  rw [IxIR1.Sim.runCode_case_ctor (by rfl) (by rfl) (by rfl) (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rfl
+
+private theorem recursor_level2_prefix :
+    IxIR1.runCode expectedCtx 22 expectedRecursorDef topCallStore
+        [.loc mainLoc5, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      IxIR1.runCode expectedCtx 16 expectedRecursorDef level2CallStore
+        [.loc mainLoc4, .loc liftLoc, .erased, .erased,
+          .loc mainLoc4, .loc mainLoc4, .loc mainLoc5, .loc liftLoc,
+          .loc mainLoc2, .erased]
+        (.letOp
+          (.callSelf #[.erased, .var 8, .var 7, .var 4])
+          (.letOp (.apply (.var 2) #[.var 1, .var 0])
+            (.ret (.var 0)))) := by
+  rw [show expectedRecursorDef.body = .case (.var 0) true #[
+      .mk 0 0
+        (.letOp (.drop (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 5))
+              (.ret (.var 5))))),
+      .mk 1 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 6))
+              (.letOp (.dup (.var 5))
+                (.letOp (.dup (.var 3))
+                  (.letOp (.callSelf #[.erased, .var 8, .var 7, .var 4])
+                    (.letOp (.apply (.var 2) #[.var 1, .var 0])
+                      (.ret (.var 0)))))))))] by rfl]
+  rw [IxIR1.Sim.runCode_case_ctor (by rfl) (by rfl) (by rfl) (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rfl
+
+private theorem recursor_level1_prefix :
+    IxIR1.runCode expectedCtx 14 expectedRecursorDef level2CallStore
+        [.loc mainLoc4, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      IxIR1.runCode expectedCtx 8 expectedRecursorDef level1CallStore
+        [.loc mainLoc3, .loc liftLoc, .erased, .erased,
+          .loc mainLoc3, .loc mainLoc3, .loc mainLoc4, .loc liftLoc,
+          .loc mainLoc2, .erased]
+        (.letOp
+          (.callSelf #[.erased, .var 8, .var 7, .var 4])
+          (.letOp (.apply (.var 2) #[.var 1, .var 0])
+            (.ret (.var 0)))) := by
+  rw [show expectedRecursorDef.body = .case (.var 0) true #[
+      .mk 0 0
+        (.letOp (.drop (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 5))
+              (.ret (.var 5))))),
+      .mk 1 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 6))
+              (.letOp (.dup (.var 5))
+                (.letOp (.dup (.var 3))
+                  (.letOp (.callSelf #[.erased, .var 8, .var 7, .var 4])
+                    (.letOp (.apply (.var 2) #[.var 1, .var 0])
+                      (.ret (.var 0)))))))))] by rfl]
+  rw [IxIR1.Sim.runCode_case_ctor (by rfl) (by rfl) (by rfl) (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rfl
+
+private theorem recursor_base_run :
+    IxIR1.runCode expectedCtx 6 expectedRecursorDef level1CallStore
+        [.loc mainLoc3, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      .ok (baseStore, .loc mainLoc2) := by
+  rw [show expectedRecursorDef.body = .case (.var 0) true #[
+      .mk 0 0
+        (.letOp (.drop (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 5))
+              (.ret (.var 5))))),
+      .mk 1 1
+        (.letOp (.dup (.var 0))
+          (.letOp (.drop (.var 2))
+            (.letOp (.drop (.var 6))
+              (.letOp (.dup (.var 5))
+                (.letOp (.dup (.var 3))
+                  (.letOp (.callSelf #[.erased, .var 8, .var 7, .var 4])
+                    (.letOp (.apply (.var 2) #[.var 1, .var 0])
+                      (.ret (.var 0)))))))))] by rfl]
+  rw [IxIR1.Sim.runCode_case_ctor (by rfl) (by rfl) (by rfl) (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rfl
+
+private theorem runOp_callSelf_of_runCode {ctx : IxIR1.Ctx} {fuel : Nat}
+    {cur : IxIR1.FnDef} {store store' : IxIR1.Store}
+    {env : List IxIR1.RVal} {atoms : Array IxIR1.Atom}
+    {args : List IxIR1.RVal} {value : IxIR1.RVal}
+    (hargs : IxIR1.resolveAtoms env atoms = .ok args)
+    (hlength : args.length = cur.arity)
+    (hrun : IxIR1.runCode ctx fuel cur store args.reverse cur.body =
+      .ok (store', value))
+    (hworld : IxIR1.Sim.HasWorld store' cur.result value) :
+    IxIR1.runOp ctx (fuel + 1) cur store env (.callSelf atoms) =
+      .ok (store', value) := by
+  rw [IxIR1.runOp.eq_def]
+  dsimp only
+  rw [hargs]
+  simp only [bind, Except.bind]
+  rw [if_neg (by simp [hlength])]
+  rw [hrun]
+  exact checkResultWorld_of_hasWorld hworld
+
+private theorem applyGo_pap_empty_saturated_of_eval {ctx : IxIR1.Ctx}
+    {fuel : Nat} {store dropped store' : IxIR1.Store}
+    {loc : Nat} {address : Ixon.Address} {arity : Nat}
+    {args : List IxIR1.RVal} {value : IxIR1.RVal}
+    {declaration : IxIR1.Decl}
+    (hget : store.get? loc =
+      some ⟨.shared, 1, .papN address arity #[]⟩ ∨
+      ∃ rc, 1 < rc ∧ store.get? loc =
+        some ⟨.shared, rc, .papN address arity #[]⟩)
+    (hdrop : IxIR1.dropVal ctx fuel store (.loc loc) = .ok dropped)
+    (hlength : args.length = arity)
+    (hdecl : ctx.decls address = some declaration)
+    (hpapsafe : IxIR1.declPapSafe declaration = true)
+    (hinvoke : IxIR1.invoke ctx fuel address args dropped =
+      .ok (store', value)) :
+    IxIR1.applyGo ctx (fuel + 1) store (.loc loc) args =
+      .ok (store', value) := by
+  obtain hget | ⟨rc, _, hget⟩ := hget
+  · rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [hget]
+    dsimp only
+    have hdup : IxIR1.dupVals store [] = .ok store := by rfl
+    rw [hdup]
+    simp only [bind, Except.bind, List.nil_append]
+    rw [hdrop]
+    simp [hlength, hdecl, hpapsafe, hinvoke]
+  · rw [IxIR1.applyGo.eq_def]
+    dsimp only
+    rw [hget]
+    dsimp only
+    have hdup : IxIR1.dupVals store [] = .ok store := by rfl
+    rw [hdup]
+    simp only [bind, Except.bind, List.nil_append]
+    rw [hdrop]
+    simp [hlength, hdecl, hpapsafe, hinvoke]
+
+private def level1ApplyStore := IxIR1.Sim.decRcStore baseStore liftLoc
+  ⟨.shared, 3,
+    .papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[]⟩
+private def level1LiftDropStore := IxIR1.Sim.decRcStore level1ApplyStore mainLoc3
+  ⟨.shared, 2,
+    .ctorN (IxIR1.Lower.ctorIdOf aZero 0) #[]⟩
+private def level1ResultStep := level1LiftDropStore.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc2])
+private def level1ResultStore := level1ResultStep.1
+private def level1ResultLoc := level1ResultStep.2
+
+private theorem level1_lifted_runCode :
+    IxIR1.runCode expectedCtx 3 expectedLiftedDef level1ApplyStore
+        [.loc mainLoc2, .loc mainLoc3] expectedLiftedDef.body =
+      .ok (level1ResultStore, .loc level1ResultLoc) := by
+  rw [show expectedLiftedDef.body =
+    .letOp (.drop (.var 1))
+      (.letOp
+        (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 1])
+        (.ret (.var 0))) by rfl]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rfl
+
+private theorem level1_lifted_result_world :
+    IxIR1.Sim.HasWorld level1ResultStore .shared
+      (.loc level1ResultLoc) := by
+  simpa [level1ResultStore, level1ResultLoc, level1ResultStep] using
+    (IxIR1.Sim.HasWorld.allocNode_new level1LiftDropStore .shared
+      (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc2]))
+
+private theorem level1_lifted_invoke :
+    IxIR1.invoke expectedCtx 4 (IxIR1.Lower.synthAddr 0)
+        [.loc mainLoc3, .loc mainLoc2] level1ApplyStore =
+      .ok (level1ResultStore, .loc level1ResultLoc) := by
+  exact invoke_fn_of_runCode expectedExpectedCtx_lifted rfl
+    level1_lifted_runCode level1_lifted_result_world
+
+private theorem level1_applyGo :
+    IxIR1.applyGo expectedCtx 5 baseStore (.loc liftLoc)
+        [.loc mainLoc3, .loc mainLoc2] =
+      .ok (level1ResultStore, .loc level1ResultLoc) := by
+  apply applyGo_pap_empty_saturated_of_eval
+  · right
+    exact ⟨3, by decide, by rfl⟩
+  · rfl
+  · rfl
+  · exact expectedExpectedCtx_lifted
+  · rfl
+  · exact level1_lifted_invoke
+
+private theorem base_result_world :
+    IxIR1.Sim.HasWorld baseStore .shared (.loc mainLoc2) := by
+  exact ⟨⟨.shared, 1,
+      .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc1]⟩,
+    by rfl, rfl⟩
+
+private theorem recursor_level1_run :
+    IxIR1.runCode expectedCtx 14 expectedRecursorDef level2CallStore
+        [.loc mainLoc4, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      .ok (level1ResultStore, .loc level1ResultLoc) := by
+  rw [recursor_level1_prefix]
+  rw [runCode_letOp_of_runOp
+    (runOp_callSelf_of_runCode (by rfl) rfl
+      recursor_base_run base_result_world)]
+  rw [runCode_letOp_of_runOp
+    (runOp_apply_of_applyGo (by rfl) (by rfl) level1_applyGo)]
+  rfl
+
+private def level2ApplyStore := IxIR1.Sim.decRcStore level1ResultStore liftLoc
+  ⟨.shared, 2,
+    .papN (IxIR1.Lower.synthAddr 0) expectedLiftedDef.arity #[]⟩
+private def level2LiftDropStore := IxIR1.Sim.decRcStore level2ApplyStore mainLoc4
+  ⟨.shared, 2,
+    .ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc mainLoc3]⟩
+private def level2ResultStep := level2LiftDropStore.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc level1ResultLoc])
+private def level2ResultStore := level2ResultStep.1
+private def level2ResultLoc := level2ResultStep.2
+
+private theorem level2_lifted_runCode :
+    IxIR1.runCode expectedCtx 11 expectedLiftedDef level2ApplyStore
+        [.loc level1ResultLoc, .loc mainLoc4] expectedLiftedDef.body =
+      .ok (level2ResultStore, .loc level2ResultLoc) := by
+  rw [show expectedLiftedDef.body =
+    .letOp (.drop (.var 1))
+      (.letOp
+        (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 1])
+        (.ret (.var 0))) by rfl]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rw [runCode_letOp_of_runOp (by rfl)]
+  rfl
+
+private theorem level2_result_world :
+    IxIR1.Sim.HasWorld level2ResultStore .shared
+      (.loc level2ResultLoc) := by
+  simpa [level2ResultStore, level2ResultLoc, level2ResultStep] using
+    (IxIR1.Sim.HasWorld.allocNode_new level2LiftDropStore .shared
+      (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc level1ResultLoc]))
+
+private theorem level2_lifted_invoke :
+    IxIR1.invoke expectedCtx 12 (IxIR1.Lower.synthAddr 0)
+        [.loc mainLoc4, .loc level1ResultLoc] level2ApplyStore =
+      .ok (level2ResultStore, .loc level2ResultLoc) := by
+  exact invoke_fn_of_runCode expectedExpectedCtx_lifted rfl
+    level2_lifted_runCode level2_result_world
+
+private theorem level2_applyGo :
+    IxIR1.applyGo expectedCtx 13 level1ResultStore (.loc liftLoc)
+        [.loc mainLoc4, .loc level1ResultLoc] =
+      .ok (level2ResultStore, .loc level2ResultLoc) := by
+  apply applyGo_pap_empty_saturated_of_eval
+  · right
+    exact ⟨2, by decide, by rfl⟩
+  · rfl
+  · rfl
+  · exact expectedExpectedCtx_lifted
+  · rfl
+  · exact level2_lifted_invoke
+
+private theorem recursor_level2_run :
+    IxIR1.runCode expectedCtx 22 expectedRecursorDef topCallStore
+        [.loc mainLoc5, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      .ok (level2ResultStore, .loc level2ResultLoc) := by
+  rw [recursor_level2_prefix]
+  rw [runCode_letOp_of_runOp
+    (runOp_callSelf_of_runCode (by rfl) rfl
+      recursor_level1_run level1_lifted_result_world)]
+  rw [runCode_letOp_of_runOp
+    (runOp_apply_of_applyGo (by rfl) (by rfl) level2_applyGo)]
+  rfl
+
+private def topApplyStore := level2ResultStore.rcTick.kill liftLoc
+private def topLiftDrop5Store := topApplyStore.rcTick.kill mainLoc5
+private def topLiftDrop4Store := topLiftDrop5Store.rcTick.kill mainLoc4
+private def topLiftDropStore := topLiftDrop4Store.rcTick.kill mainLoc3
+private def topResultStep := topLiftDropStore.allocNode .shared
+  (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc level2ResultLoc])
+private def topResultStore := topResultStep.1
+private def topResultLoc := topResultStep.2
+
+set_option maxRecDepth 4000 in
+private theorem top_dropVal :
+    IxIR1.dropVal expectedCtx 17 topApplyStore (.loc mainLoc5) =
+      .ok topLiftDropStore := by
+  rfl
+
+private theorem top_dropOp :
+    IxIR1.runOp expectedCtx 18 expectedLiftedDef topApplyStore
+        [.loc level2ResultLoc, .loc mainLoc5] (.drop (.var 1)) =
+      .ok (topLiftDropStore, .erased) := by
+  exact IxIR1.Sim.runOp_drop (by rfl) top_dropVal
+
+private theorem top_allocOp :
+    IxIR1.runOp expectedCtx 17 expectedLiftedDef topLiftDropStore
+        [.erased, .loc level2ResultLoc, .loc mainLoc5]
+        (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 1]) =
+      .ok (topResultStore, .loc topResultLoc) := by
+  simpa only [topResultStore, topResultLoc, topResultStep] using
+    (IxIR1.Sim.runOp_alloc (ctx := expectedCtx) (fuel := 16)
+      (cur := expectedLiftedDef) (store := topLiftDropStore)
+      (env := [.erased, .loc level2ResultLoc, .loc mainLoc5])
+      (world := .shared)
+      (cid := IxIR1.Lower.ctorIdOf aSucc 1)
+      (args := #[.var 1]) (values := [.loc level2ResultLoc]) (by rfl))
+
+private theorem top_lifted_runCode :
+    IxIR1.runCode expectedCtx 19 expectedLiftedDef topApplyStore
+        [.loc level2ResultLoc, .loc mainLoc5] expectedLiftedDef.body =
+      .ok (topResultStore, .loc topResultLoc) := by
+  rw [show expectedLiftedDef.body =
+    .letOp (.drop (.var 1))
+      (.letOp
+        (.alloc .shared (IxIR1.Lower.ctorIdOf aSucc 1) #[.var 1])
+        (.ret (.var 0))) by rfl]
+  rw [runCode_letOp_of_runOp top_dropOp]
+  rw [runCode_letOp_of_runOp top_allocOp]
+  rfl
+
+private theorem top_result_world :
+    IxIR1.Sim.HasWorld topResultStore .shared (.loc topResultLoc) := by
+  simpa [topResultStore, topResultLoc, topResultStep] using
+    (IxIR1.Sim.HasWorld.allocNode_new topLiftDropStore .shared
+      (.ctorN (IxIR1.Lower.ctorIdOf aSucc 1) #[.loc level2ResultLoc]))
+
+private theorem top_lifted_invoke :
+    IxIR1.invoke expectedCtx 20 (IxIR1.Lower.synthAddr 0)
+        [.loc mainLoc5, .loc level2ResultLoc] topApplyStore =
+      .ok (topResultStore, .loc topResultLoc) := by
+  exact invoke_fn_of_runCode expectedExpectedCtx_lifted rfl
+    top_lifted_runCode top_result_world
+
+private theorem top_applyGo :
+    IxIR1.applyGo expectedCtx 21 level2ResultStore (.loc liftLoc)
+        [.loc mainLoc5, .loc level2ResultLoc] =
+      .ok (topResultStore, .loc topResultLoc) := by
+  apply applyGo_pap_empty_saturated_of_eval
+  · left
+    rfl
+  · rfl
+  · rfl
+  · exact expectedExpectedCtx_lifted
+  · rfl
+  · exact top_lifted_invoke
+
+private theorem recursor_top_run :
+    IxIR1.runCode expectedCtx 30 expectedRecursorDef recEntryStore
+        [.loc mainLoc6, .loc liftLoc, .loc mainLoc2, .erased]
+        expectedRecursorDef.body =
+      .ok (topResultStore, .loc topResultLoc) := by
+  rw [recursor_top_prefix]
+  rw [runCode_letOp_of_runOp
+    (runOp_callSelf_of_runCode (by rfl) rfl
+      recursor_level2_run level2_result_world)]
+  rw [runCode_letOp_of_runOp
+    (runOp_apply_of_applyGo (by rfl) (by rfl) top_applyGo)]
+  rfl
+
+private theorem recursor_invoke :
+    IxIR1.invoke expectedCtx 31 maNatRec
+        [.erased, .loc mainLoc2, .loc liftLoc, .loc mainLoc6]
+        recEntryStore =
+      .ok (topResultStore, .loc topResultLoc) := by
+  exact invoke_fn_of_runCode expectedExpectedCtx_recursor rfl
+    recursor_top_run top_result_world
+
+private theorem add_applyGo :
+    IxIR1.applyGo expectedCtx 32 liftStore (.loc aliasLoc)
+        [.erased, .loc mainLoc2, .loc liftLoc, .loc mainLoc6] =
+      .ok (topResultStore, .loc topResultLoc) := by
+  rw [initial_applyGo]
+  exact recursor_invoke
+
+private theorem add_runCode :
+    IxIR1.runCode expectedCtx 36 expectedAddDef mainStore7
+        [.loc mainLoc6, .loc mainLoc2] expectedAddDef.body =
+      .ok (topResultStore, .loc topResultLoc) := by
+  rw [add_runCode_to_apply]
+  rw [runCode_letOp_of_runOp
+    (runOp_apply_of_applyGo (by rfl) (by rfl) add_applyGo)]
+  rfl
+
+private theorem add_invoke :
+    IxIR1.invoke expectedCtx 37 aAdd
+        [.loc mainLoc2, .loc mainLoc6] mainStore7 =
+      .ok (topResultStore, .loc topResultLoc) := by
+  exact invoke_fn_of_runCode expectedExpectedCtx_add rfl
+    add_runCode top_result_world
+
+private theorem expected_main_runCode :
+    IxIR1.runCode expectedCtx 46 mainCur {} [] expectedMainCode =
+      .ok (topResultStore, .loc topResultLoc) := by
+  rw [main_prefix]
+  rw [runCode_letOp_of_runOp
+    (runOp_call_of_invoke (by rfl) add_invoke)]
+  rfl
+
+private theorem expected_runMain :
+    IxIR1.runMain expectedCtx expectedMainCode 46 =
+      .ok (topResultStore, .loc topResultLoc) := by
+  simpa [IxIR1.runMain, mainCur] using expected_main_runCode
+
+private theorem expectedCtx_eq_addTargetCtx : expectedCtx = addTargetCtx := by
+  simp [expectedCtx, addTargetCtx, addTargetDecls, addAction_exact]
+
+private theorem expectedMainCode_eq_addMainCode :
+    expectedMainCode = addMainCode := by
+  simp [addMainCode, addAction_exact]
+
+private theorem add_runMain_exact :
+    IxIR1.runMain addTargetCtx addMainCode 46 =
+      .ok (topResultStore, .loc topResultLoc) := by
+  rw [← expectedCtx_eq_addTargetCtx,
+    ← expectedMainCode_eq_addMainCode]
+  exact expected_runMain
+
+set_option maxRecDepth 4000 in
+private theorem add_value_graph :
+    IxIR1.Sim.ValueGraph (fun _ _ _ _ => False) topResultStore
+      (ixNatValue 5) (.loc topResultLoc) := by
+  simp only [ixNatValue]
+  refine .ctor (by rfl) (by rfl) (by rfl) (.cons ?_ .nil)
+  refine .ctor (by rfl) (by rfl) (by rfl) (.cons ?_ .nil)
+  refine .ctor (by rfl) (by rfl) (by rfl) (.cons ?_ .nil)
+  refine .ctor (by rfl) (by rfl) (by rfl) (.cons ?_ .nil)
+  refine .ctor (by rfl) (by rfl) (by rfl) (.cons ?_ .nil)
+  exact .ctor (by rfl) (by rfl) (by rfl) .nil
+
+private theorem add_source_exact : IxIR0.eval ictxI 23 [] addE' =
+    .ok (ixNatValue 5) := by
+  have hzero : ienv aZero = some (.ctor 0 0) :=
+    sourceEnv_lookup_of_mem_nodup erasedList_nodup (by simp [erasedList])
+  have hsucc : ienv aSucc = some (.ctor 1 1) :=
+    sourceEnv_lookup_of_mem_nodup erasedList_nodup (by simp [erasedList])
+  have hnrec : ienv maNatRec = some (.recursor 3 true #[
+      { fields := 0, rhs := .var 1 },
+      { fields := 1, rhs := succRuleBody' }]) :=
+    sourceEnv_lookup_of_mem_nodup erasedList_nodup (by simp [erasedList])
+  have hanrec : ienv aNatRec = some (.defn .shared (.ref maNatRec)) :=
+    sourceEnv_lookup_of_mem_nodup erasedList_nodup (by simp [erasedList])
+  have hadd : ienv aAdd = some (.defn .shared addBody') :=
+    sourceEnv_lookup_of_mem_nodup erasedList_nodup (by simp [erasedList])
+  simp [ictxI, addE', natE', addBody', succRuleBody', IxIR0.eval,
+    IxIR0.apply, IxIR0.saturate, IxIR0.fire, IxIR0.majorCtor,
+    IxIR0.Head.arity,
+    hzero, hsucc, hnrec, hanrec, hadd, ixNatValue, bind, Except.bind]
+
+private theorem add_projectionFreeCtx :
+    IxIR0.ProjectionFree.CtxSafe ictxI := by
+  constructor
+  · intro address declaration hlookup
+    change IxIR0.Env.ofList erasedList address = some declaration at hlookup
+    obtain ⟨⟨itemAddress, itemDeclaration⟩, hmem, haddress,
+      hdeclaration⟩ := envOfList_some_mem hlookup
+    dsimp only at haddress hdeclaration
+    subst itemAddress
+    subst itemDeclaration
+    simp only [erasedList, List.mem_cons, List.not_mem_nil, or_false] at hmem
+    rcases hmem with hmem | hmem | hmem | hmem | hmem | hmem | hmem
+    all_goals
+      cases hmem
+      simp [IxIR0.ProjectionFree.declSafe,
+        IxIR0.ProjectionFree.syntaxSafe, succRuleBody', addBody']
+  · intro address args result hargs horacle
+    simp [ictxI] at horacle
+
+private theorem add_projectionFreeExpr :
+    IxIR0.ProjectionFree.ExprSafe addE' := by
+  change IxIR0.ProjectionFree.syntaxSafe addE' = true
+  rfl
+
+/-- The certified erasure trace for `add 2 3` retains the dynamically entered
+closure and recursive rule bodies. -/
+private theorem add_source_callAwareTrace :
+    ∃ sourceFuel,
+      IxIR0.ProjectionSafe.Eval ictxI sourceFuel [] addE'
+        (ixNatValue 5) := by
+  exact ⟨23, IxIR0.ProjectionFree.Eval.of_run add_projectionFreeCtx
+    IxIR0.ProjectionFree.ValuesSafe.nil add_projectionFreeExpr
+    add_source_exact⟩
+
+private theorem add_source_profile :
+    ∃ sourceFuel profile,
+      IxIR0.DynamicCost.Eval ictxI sourceFuel [] addE'
+        (ixNatValue 5) profile := by
+  obtain ⟨sourceFuel, htrace⟩ := add_source_callAwareTrace
+  obtain ⟨profile, hprofile⟩ :=
+    IxIR0.DynamicCost.Eval.ofTrace htrace
+  exact ⟨sourceFuel, profile, hprofile⟩
+
+/-- Exact target counters for the compiled recursive `add 2 3` execution. -/
+def addIxIR1ExactCost : CostObservation :=
+  { allocs := 12, reuses := 0, frees := 6, rcops := 24 }
+
+set_option maxRecDepth 4000 in
+private theorem add_target_cost_exact :
+    costObservation topResultStore = addIxIR1ExactCost := by
+  rfl
+
+/-- The recursive fixture uses the compiler-facing ownership-amortized
+tariff.  Unlike the original witness-calibrated model, these weights contain
+no counter from this particular target run. -/
+def addIxIR1ProfileWeights : IxIR1.CostTrace.ProfileWeights :=
+  IxIR1.CostTrace.ownershipAmortizedWeights
+
+def AddDynamicCostSpec (_value : IxIR0.Value)
+    (profile : IxIR0.DynamicCost.Profile)
+    (observation : CostObservation) : Prop :=
+  observation = addIxIR1ExactCost ∧
+    IxIR1.CostTrace.WithinBudget addIxIR1ProfileWeights profile observation
+
+/-- The actual whole-pass recursive fixture has an explicit dynamic source
+profile and satisfies both its exact target counter equation and the induced
+linear profile budget at every successful source/target fuel. -/
+theorem addIxIR1DynamicCostRefinement :
+    IxIR1.CostTrace.ProfileCostRefinement ictxI addTargetCtx addE'
+      addMainCode (fun _ _ _ _ => False) AddDynamicCostSpec := by
+  obtain ⟨sourceFuel, profile, hprofile⟩ := add_source_profile
+  apply IxIR1.CostTrace.ProfileCostRefinement.of_witness
+    hprofile add_runMain_exact
+  constructor
+  · exact add_target_cost_exact
+  · rw [add_target_cost_exact]
+    have hevals : 15 ≤ profile.evals := by
+      simpa [addE', natE', IxIR0.DynamicCost.surfaceEvals] using
+        hprofile.surfaceEvals_le
+    simp [IxIR1.CostTrace.WithinBudget,
+      IxIR1.CostTrace.ObservationLE,
+      IxIR1.CostTrace.ProfileWeights.budget,
+      IxIR1.CostTrace.observationAdd,
+      IxIR1.CostTrace.observationScale,
+      IxIR1.CostTrace.ownershipAmortizedWeights,
+      addIxIR1ProfileWeights, addIxIR1ExactCost]
+    omega
+
+theorem addIxIR1SemanticForwardSimulation :
+    SemanticForwardSimulation ictxI addTargetCtx addE' addMainCode
+      (fun _ _ _ _ => False) := by
+  intro sourceFuel sourceValue hsource
+  let commonFuel := max sourceFuel 23
+  have hsourceCommon :
+      IxIR0.eval ictxI commonFuel [] addE' = .ok sourceValue :=
+    IxIR0.eval_mono (Nat.le_max_left sourceFuel 23) hsource
+  have hexactCommon :
+      IxIR0.eval ictxI commonFuel [] addE' = .ok (ixNatValue 5) :=
+    IxIR0.eval_mono (Nat.le_max_right sourceFuel 23) add_source_exact
+  have hvalue : sourceValue = ixNatValue 5 := by
+    exact Except.ok.inj (hsourceCommon.symm.trans hexactCommon)
+  subst sourceValue
+  exact ⟨46, topResultStore, .loc topResultLoc,
+    add_runMain_exact, add_value_graph⟩
+
+/-- The exact compiled `add 2 3` main cannot expose a dynamic memory error
+at any evaluator fuel. One kernel-checked successful run is sufficient:
+success is monotone above fuel 46, while a memory error below it would
+persist upward and contradict that run. -/
+theorem addIxIR1MemoryErrorUnreachable :
+    IxIR1.LowerSim.MemoryErrorUnreachable addTargetCtx addMainCode :=
+  IxIR1.LowerSim.SemanticForwardSimulation.memoryErrorUnreachable
+    addIxIR1SemanticForwardSimulation add_source_exact
+
+
+end IxIR1SemanticSimulation
+
+/-! ## Constructor-parameter drop instance -/
+
+private def aPairBlock : Ixon.Address := addrOf 0x20
+private def aPairMk : Ixon.Address := addrOf 0x21
+private def aPairLeft : Ixon.Address := addrOf 0x22
+private def aPairRight : Ixon.Address := addrOf 0x23
+private def aPairType : Ixon.Address := addrOf 0x24
+
+private def pairInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 2, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 2, fields := 2
+        typ := .sort 0 }] }
+
+private def cPairBlock : Constant :=
+  { info := .muts #[.indc pairInd]
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+private def cPairMk : Constant :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aPairBlock })
+
+private def cPairType : Constant :=
+  prjConst (.iPrj { idx := 0, block := aPairBlock })
+
+private def pairStore : List (Ixon.Address × Constant) :=
+  [(aPairBlock, cPairBlock), (aPairMk, cPairMk), (aPairType, cPairType)]
+
+private def pairResolver : Ixon.Address → Option Constant := fun a =>
+  (pairStore.find? (fun p => p.1 == a)).map (·.2)
+
+private def pairEctx : Ixon.Eval.EvalCtx :=
+  { resolve := pairResolver
+    blobs := fun address =>
+      if address = aPairLeft then some (.natB 11)
+      else if address = aPairRight then some (.natB 22)
+      else none }
+
+private def pairMember : Ixon.Address := Erase.memberAddr aPairBlock 0
+
+private def pairErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(pairMember, .defn .shared .erased), (aPairMk, .ctor 0 2),
+   (aPairType, .defn .shared .erased)]
+
+private def pairIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList pairErased }
+
+private def pairFrame : Ixon.Eval.Frame :=
+  { refs := #[aPairMk, aPairLeft, aPairRight, aPairType], univs := #[.zero] }
+
+private def pairTables : Erase.ETables :=
+  { refs := pairFrame.refs, selfMuts := pairFrame.selfMuts }
+
+private def pairSource : Ixon.Expr :=
+  .app (.app (.app (.app (.ref 0 #[]) (.sort 0)) (.sort 0)) (.sort 0))
+    (.sort 0)
+
+private def pairTarget : IxIR0.Expr :=
+  .app (.app (.ref aPairMk) .erased) .erased
+
+private def pairPartialSource : Ixon.Expr :=
+  .app (.ref 0 #[]) (.sort 0)
+
+/-- A one-parameter constructor pap escapes through a let; its remaining
+parameter and two contentful fields are supplied through an unknown variable
+head. -/
+private def pairSplitSource : Ixon.Expr :=
+  .letE false (.sort 0) (.app (.ref 0 #[]) (.sort 0))
+    (.app (.app (.app (.var 0) (.sort 0)) (.nat 1)) (.nat 2))
+
+private def pairSplitTarget : IxIR0.Expr :=
+  .letE .many (.lam .many (.ref aPairMk))
+    (.app (.app (.app (.var 0) .erased) (.lit (.nat 11)))
+      (.lit (.nat 22)))
+
+private def pairSplitProjectionSource : Ixon.Expr :=
+  .prj 3 1 pairSplitSource
+
+private def pairSplitProjectionTarget : IxIR0.Expr :=
+  .proj 1 pairSplitTarget
+
+private def pairProjectionSource : Ixon.Expr := .prj 3 1 pairSource
+private def pairProjectionTarget : IxIR0.Expr := .proj 1 pairTarget
+
+private def pairNoCover : EraseValidator.CoverOracle pairEctx pairIctx :=
+  fun _ => none
+
+-- The constructor declaration is emitted by the real program eraser. It is
+-- intentionally absent from the ordinary `Covered` database: parameterized
+-- constructor expressions use the stronger `ctorW`/`ctorP` structural
+-- certificates instead of the generic reference rule.
+#guard (match EraseValidator.certifyProgram pairEctx pairStore [] 100 100 with
+  | .ok cert => cert.target == pairErased && cert.coverage.isEmpty
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr pairEctx pairIctx pairNoCover none
+    pairTables pairFrame.selfAddr [] pairSource 100 100 with
+  | .ok cert => cert.target == pairTarget
+  | .error _ => false)
+
+-- A partial visible prefix is now certified against one ignored target
+-- wrapper, rather than exposing the two-field target constructor early.
+#guard (match EraseValidator.certifyExpr pairEctx pairIctx pairNoCover none
+    pairTables pairFrame.selfAddr [] pairPartialSource 100 100 with
+  | .ok cert => cert.target == .lam .many (.ref aPairMk)
+  | _ => false)
+
+#guard (match EraseValidator.validateExpr pairEctx pairIctx pairNoCover none
+    pairTables.refs pairTables.selfMuts pairFrame.selfAddr [] 100
+    pairPartialSource (.lam .many (.lam .many (.ref aPairMk))) with
+  | .error "constructor wrapper body mismatch" => true
+  | _ => false)
+
+-- The wrapper is first-class: it may escape through a let and receive the
+-- remaining parameter through a variable head before the kept fields.
+#guard (match EraseValidator.certifyExpr pairEctx pairIctx pairNoCover none
+    pairTables pairFrame.selfAddr [] pairSplitSource 100 100 with
+  | .ok cert => cert.target == pairSplitTarget
+  | _ => false)
+
+#guard (match EraseValidator.certifyExpr pairEctx pairIctx pairNoCover none
+    pairTables pairFrame.selfAddr [] pairSplitProjectionSource 100 100 with
+  | .ok cert => cert.target == pairSplitProjectionTarget
+  | _ => false)
+
+#guard (match EraseValidator.certifyExpr pairEctx pairIctx pairNoCover none
+    pairTables pairFrame.selfAddr [] pairProjectionSource 100 100 with
+  | .ok cert => cert.target == pairProjectionTarget
+  | .error _ => false)
+
+private theorem pairProjectionDer :
+    PErase pairEctx pairIctx none pairFrame.refs pairFrame.selfMuts
+      pairFrame.selfAddr [] pairProjectionSource pairProjectionTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := pairNoCover) (fuel := 100)
+  decide
+
+private theorem pairSplitProjectionDer :
+    PErase pairEctx pairIctx none pairFrame.refs pairFrame.selfMuts
+      pairFrame.selfAddr [] pairSplitProjectionSource
+        pairSplitProjectionTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := pairNoCover) (fuel := 100)
+  decide
+
+theorem pairProjectionSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval pairEctx fuel pairFrame [] pairProjectionSource =
+      .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval pairIctx fuel' [] pairProjectionTarget = .ok v' ∧
+      ValRel pairEctx pairIctx v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev pairProjectionDer
+
+/-- Forward simulation for a split constructor-parameter pap that escapes
+through a let and returns the contentful second field. -/
+theorem pairSplitProjectionSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval pairEctx fuel pairFrame []
+      pairSplitProjectionSource = .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval pairIctx fuel' [] pairSplitProjectionTarget = .ok v' ∧
+      ValRel pairEctx pairIctx v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev pairSplitProjectionDer
+
+#guard (match Ixon.Eval.eval pairEctx 100 pairFrame [] pairSource with
+  | .ok (.ctorV block 0 0 [_, _, _, _]) => block == aPairBlock
+  | _ => false)
+
+#guard (match IxIR0.eval pairIctx 100 [] pairTarget with
+  | .ok (.ctor address 0 [.erased, .erased]) => address == aPairMk
+  | _ => false)
+
+#guard (match Ixon.Eval.eval pairEctx 100 pairFrame []
+    pairSplitProjectionSource with
+  | .ok (.litV (.natL 22)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval pairIctx 100 [] pairSplitProjectionTarget with
+  | .ok (.lit (.nat 22)) => true
+  | _ => false)
+
+#guard (match Ixon.Eval.eval pairEctx 100 pairFrame [] pairProjectionSource with
+  | .ok (.sortV 0) => true
+  | _ => false)
+
+#guard (match IxIR0.eval pairIctx 100 [] pairProjectionTarget with
+  | .ok .erased => true
+  | _ => false)
+
+/-! ## Parameterized recursor instance -/
+
+private def aListBlock : Ixon.Address := addrOf 0x30
+private def aList : Ixon.Address := addrOf 0x31
+private def aListNil : Ixon.Address := addrOf 0x32
+private def aListCons : Ixon.Address := addrOf 0x33
+private def aListRec : Ixon.Address := addrOf 0x34
+
+private def listInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 1, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 1, fields := 0
+        typ := .sort 0 },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 1, fields := 2
+        typ := .sort 0 }] }
+
+/-- A List-shaped recursor telescope. Its type parameter is syntactically
+sort-like, so both the executable eraser and `recParamPolicy` ghost it. The
+cons rule returns its head field, which makes the fired result easy to pin. -/
+private def listRec : Recursor :=
+  { k := false, isUnsafe := false, lvls := 0, params := 1, indices := 0
+    motives := 1, minors := 2
+    typ := .all .many .shared (.sort 0) (.sort 0)
+    rules := #[
+      { fields := 0
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.lam .many (.sort 0) (.var 1)))) },
+      { fields := 2
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.lam .many (.sort 0)
+            (.lam .many (.sort 0) (.lam .many (.sort 0) (.var 1)))))) }] }
+
+private def cListBlock : Constant :=
+  { info := .muts #[.indc listInd, .recr listRec]
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+private def cList :=
+  prjConst (.iPrj { idx := 0, block := aListBlock })
+
+private def cListNil :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aListBlock })
+
+private def cListCons :=
+  prjConst (.cPrj { idx := 0, cidx := 1, block := aListBlock })
+
+private def cListRec :=
+  prjConst (.rPrj { idx := 1, block := aListBlock })
+
+private def listStore : List (Ixon.Address × Constant) :=
+  [(aListBlock, cListBlock), (aList, cList), (aListNil, cListNil),
+   (aListCons, cListCons), (aListRec, cListRec)]
+
+private def listResolver : Ixon.Address → Option Constant := fun a =>
+  (listStore.find? (fun p => p.1 == a)).map (·.2)
+
+private def listEctx : Ixon.Eval.EvalCtx :=
+  { resolve := listResolver }
+
+private def maList : Ixon.Address := Erase.memberAddr aListBlock 0
+private def maListRec : Ixon.Address := Erase.memberAddr aListBlock 1
+
+private def listErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maList, .defn .shared .erased),
+   (maListRec, .recursor 4 false #[
+     { fields := 0, rhs := .var 1 },
+     { fields := 2, rhs := .var 1 }]),
+   (aList, .defn .shared .erased),
+   (aListNil, .ctor 0 0),
+   (aListCons, .ctor 1 2),
+   (aListRec, .defn .shared (.ref maListRec))]
+
+private def listIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList listErased }
+
+private def listFrame : Ixon.Eval.Frame :=
+  { refs := #[aListRec, aListCons], univs := #[.zero] }
+
+private def listTables : Erase.ETables :=
+  { refs := listFrame.refs, selfMuts := listFrame.selfMuts }
+
+private def listMajorSource : Ixon.Expr :=
+  .app (.app (.app (.ref 1 #[]) (.sort 0)) (.sort 0)) (.sort 0)
+
+private def listMajorTarget : IxIR0.Expr :=
+  .app (.app (.ref aListCons) .erased) .erased
+
+private def listRecSource : Ixon.Expr :=
+  .app
+    (.app (.app (.app (.app (.ref 0 #[]) (.sort 0)) (.sort 0))
+      (.sort 0)) (.sort 0))
+    listMajorSource
+
+private def listRecTarget : IxIR0.Expr :=
+  .app
+    (.app (.app (.app (.app (.ref aListRec) .erased) .erased)
+      .erased) .erased)
+    listMajorTarget
+
+-- Program validation reconstructs the generalized `RecMember` and both
+-- parameterized rule witnesses from the executable eraser's exact output.
+#guard (match EraseValidator.certifyProgram listEctx listStore [aListRec]
+    200 200 with
+  | .ok cert => cert.target == listErased && cert.coverage.length == 1
+  | .error _ => false)
+
+private theorem covListRec : Covered listEctx listIctx aListRec := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 200)
+  decide
+
+private def listCoverage : EraseValidator.CoverageDB listEctx listIctx :=
+  [{ address := aListRec, covered := covListRec }]
+
+private def listCover : EraseValidator.CoverOracle listEctx listIctx :=
+  listCoverage.oracle
+
+#guard (match EraseValidator.certifyExpr listEctx listIctx listCover none
+    listTables listFrame.selfAddr [] listRecSource 200 200 with
+  | .ok cert => cert.target == listRecTarget
+  | .error _ => false)
+
+private theorem listRecDer :
+    PErase listEctx listIctx none listFrame.refs listFrame.selfMuts
+      listFrame.selfAddr [] listRecSource listRecTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := listCover) (fuel := 200)
+  decide
+
+theorem parameterizedListRecSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval listEctx fuel listFrame [] listRecSource = .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval listIctx fuel' [] listRecTarget = .ok v' ∧
+      ValRel listEctx listIctx v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev listRecDer
+
+#guard (match Ixon.Eval.eval listEctx 200 listFrame [] listRecSource with
+  | .ok (.sortV 0) => true
+  | _ => false)
+
+#guard (match IxIR0.eval listIctx 200 [] listRecTarget with
+  | .ok .erased => true
+  | _ => false)
+
+/-! ## Source-only recursor-index instance -/
+
+private def aIxBlock : Ixon.Address := addrOf 0x40
+private def aIxCtor : Ixon.Address := addrOf 0x41
+private def aIxRec : Ixon.Address := addrOf 0x42
+private def aIxMinor : Ixon.Address := addrOf 0x43
+private def aIxField : Ixon.Address := addrOf 0x44
+private def aIxStep : Ixon.Address := addrOf 0x45
+
+/-- A one-index family with base and step constructors.  Both carry one
+runtime field; the step fixture stores another family value in that field.
+The family index is supplied to the recursor but absent from its erased
+pre-major application spine. -/
+private def ixInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 1
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 1
+        typ := .sort 0 },
+      { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+        typ := .sort 0 }] }
+
+/-- The base rule returns its field.  The step rule recursively applies the
+same indexed recursor to its field.  Each lambda chain contains the motive,
+two minors, and field binders; the source-only index is intentionally not part
+of the rule environment. -/
+private def ixRecStepBody : Ixon.Expr :=
+  .app
+    (.app
+      (.app
+        (.app
+          (.app (.recur 1 #[]) (.var 3))
+          (.var 2))
+        (.var 1))
+      (.sort 0))
+    (.var 0)
+
+private def ixRuleBody (body : Ixon.Expr) : Ixon.Expr :=
+  .lam .many (.sort 0)
+    (.lam .many (.sort 0)
+      (.lam .many (.sort 0)
+        (.lam .many (.sort 0) body)))
+
+private def ixRec : Recursor :=
+  { k := false, isUnsafe := false, lvls := 0, params := 0, indices := 1
+    motives := 1, minors := 2, typ := .sort 0
+    rules := #[
+      { fields := 1, rhs := ixRuleBody (.var 0) },
+      { fields := 1, rhs := ixRuleBody ixRecStepBody }] }
+
+private def cIxBlock : Constant :=
+  { info := .muts #[.indc ixInd, .recr ixRec]
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+private def cIxCtor : Constant :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aIxBlock })
+
+private def cIxRec : Constant :=
+  prjConst (.rPrj { idx := 1, block := aIxBlock })
+
+private def cIxStep : Constant :=
+  prjConst (.cPrj { idx := 0, cidx := 1, block := aIxBlock })
+
+private def ixStore : List (Ixon.Address × Constant) :=
+  [(aIxBlock, cIxBlock), (aIxCtor, cIxCtor), (aIxRec, cIxRec),
+   (aIxStep, cIxStep)]
+
+private def ixResolver : Ixon.Address → Option Constant := fun a =>
+  (ixStore.find? (fun p => p.1 == a)).map (·.2)
+
+private def ixEctx : Ixon.Eval.EvalCtx :=
+  { resolve := ixResolver
+    blobs := fun address =>
+      if address = aIxMinor then some (.natB 17)
+      else if address = aIxField then some (.natB 73)
+      else none }
+
+private def maIx : Ixon.Address := Erase.memberAddr aIxBlock 0
+private def maIxRec : Ixon.Address := Erase.memberAddr aIxBlock 1
+
+private def ixErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maIx, .defn .shared .erased),
+   (maIxRec, .recursor 3 false #[
+      { fields := 1, rhs := .var 0 },
+      { fields := 1
+        rhs := .app
+          (.app (.app (.app (.var 4) .erased) (.var 2)) (.var 1))
+          (.var 0) }]),
+   (aIxCtor, .ctor 0 1),
+   (aIxRec, .defn .shared (.ref maIxRec)),
+   (aIxStep, .ctor 1 1)]
+
+private def ixIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList ixErased }
+
+private def ixFrame : Ixon.Eval.Frame :=
+  { refs := #[aIxRec, aIxCtor, aIxStep, aIxMinor, aIxField],
+    univs := #[.zero] }
+
+private def ixTables : Erase.ETables :=
+  { refs := ixFrame.refs, selfMuts := ixFrame.selfMuts }
+
+private def ixMajorSource : Ixon.Expr :=
+  .app (.ref 1 #[]) (.nat 4)
+
+private def ixMajorTarget : IxIR0.Expr :=
+  .app (.ref aIxCtor) (.lit (.nat 73))
+
+/-- Motive, two minors, source-only index, then major. -/
+private def ixPreMajorSource : Ixon.Expr :=
+  .app
+    (.app (.app (.app (.ref 0 #[]) (.sort 0)) (.nat 3)) (.sort 0))
+    (.sort 0)
+
+private def ixPreMajorTarget : IxIR0.Expr :=
+  .app (.app (.app (.ref aIxRec) .erased) (.lit (.nat 17))) .erased
+
+private def ixIncompleteSource : Ixon.Expr :=
+  .app (.app (.app (.ref 0 #[]) (.sort 0)) (.nat 3)) (.sort 0)
+
+private def ixIncompleteTarget : IxIR0.Expr :=
+  Erase.captureThenIgnoreN 1 ixPreMajorTarget
+
+/-- The protected pre-major pap escapes through a let, receives its erased
+index through an ordinary variable-headed application, and only then receives
+the constructor major. -/
+private def ixSplitSource : Ixon.Expr :=
+  .letE false (.sort 0) ixIncompleteSource
+    (.app (.app (.var 0) (.sort 0)) ixMajorSource)
+
+private def ixSplitTarget : IxIR0.Expr :=
+  .letE .many ixIncompleteTarget
+    (.app (.app (.var 0) .erased) ixMajorTarget)
+
+private def ixRecursiveMajorSource : Ixon.Expr :=
+  .app (.ref 2 #[]) ixMajorSource
+
+private def ixRecursiveMajorTarget : IxIR0.Expr :=
+  .app (.ref aIxStep) ixMajorTarget
+
+private def ixRecursiveSource : Ixon.Expr :=
+  .app ixPreMajorSource ixRecursiveMajorSource
+
+private def ixRecursiveTarget : IxIR0.Expr :=
+  .app ixPreMajorTarget ixRecursiveMajorTarget
+
+private def ixRecSource : Ixon.Expr :=
+  .app ixPreMajorSource ixMajorSource
+
+/-- The index application has disappeared; target saturation still happens
+only when the major is appended. -/
+private def ixRecTarget : IxIR0.Expr :=
+  .app ixPreMajorTarget ixMajorTarget
+
+private theorem covIxCtor : Covered ixEctx ixIctx aIxCtor := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 200)
+  decide
+
+private theorem covIxStep : Covered ixEctx ixIctx aIxStep := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 200)
+  decide
+
+private def ixCoverage : EraseValidator.CoverageDB ixEctx ixIctx :=
+  [{ address := aIxCtor, covered := covIxCtor },
+   { address := aIxStep, covered := covIxStep }]
+
+private def ixCover : EraseValidator.CoverOracle ixEctx ixIctx :=
+  ixCoverage.oracle
+
+private theorem ixResolveRec :
+    Ixon.Eval.resolveMut ixEctx aIxBlock 1 =
+      .ok (cIxBlock, .recr ixRec) := by
+  rfl
+
+private theorem ixMember : RecMember ixEctx ixIctx aIxBlock 1 ixRec := by
+  apply EraseValidator.recMember_of_validate
+    (db := []) (bc := cIxBlock) (hm := ixResolveRec) (fuel := 200)
+  decide
+
+private def ixRecMembers : EraseValidator.RecMemberOracle ixEctx ixIctx :=
+  fun block idx bc r hm =>
+    if hb : block = aIxBlock then
+      if hi : idx = 1 then
+        some ⟨by
+          subst block
+          subst idx
+          rw [ixResolveRec] at hm
+          injection hm with hpair
+          injection hpair with hbc hrecr
+          injection hrecr with hr
+          subst bc
+          subst r
+          exact ixMember⟩
+      else none
+    else none
+
+-- The indexed projection is intentionally not `Covered`; only the unary
+-- constructors are scheduled. The member declaration is used by the entry
+-- oracle directly.
+#guard (match EraseValidator.certifyProgram ixEctx ixStore
+    [aIxCtor, aIxStep] 200 200 with
+  | .ok cert => cert.target == ixErased && cert.coverage.length == 2
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExprWithRec ixEctx ixIctx ixCover
+    ixRecMembers none ixTables ixFrame.selfAddr [] ixRecSource 200 200 with
+  | .ok cert => cert.target == ixRecTarget
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExprWithRec ixEctx ixIctx ixCover
+    ixRecMembers none ixTables ixFrame.selfAddr [] ixIncompleteSource
+    200 200 with
+  | .ok cert => cert.target == ixIncompleteTarget
+  | .error _ => false)
+
+-- Exposing the raw pre-major pap would let the target fire while the source
+-- still owes its index, so the validator accepts only the protected shape.
+#guard (match EraseValidator.validateExprWithRec ixEctx ixIctx ixCover
+    ixRecMembers none ixTables.refs ixTables.selfMuts ixFrame.selfAddr [] 200
+    ixIncompleteSource ixPreMajorTarget with
+  | .error _ => true
+  | .ok _ => false)
+
+#guard (match EraseValidator.certifyExprWithRec ixEctx ixIctx ixCover
+    ixRecMembers none ixTables ixFrame.selfAddr [] ixSplitSource 200 200 with
+  | .ok cert => cert.target == ixSplitTarget
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExprWithRec ixEctx ixIctx ixCover
+    ixRecMembers none ixTables ixFrame.selfAddr [] ixRecursiveSource 300 300 with
+  | .ok cert => cert.target == ixRecursiveTarget
+  | .error _ => false)
+
+private theorem ixRecDer :
+    PErase ixEctx ixIctx none ixFrame.refs ixFrame.selfMuts
+      ixFrame.selfAddr [] ixRecSource ixRecTarget := by
+  apply EraseValidator.related_of_validateExprWithRec
+    (cover := ixCover) (recMembers := ixRecMembers) (fuel := 200)
+  decide
+
+theorem indexedRecSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval ixEctx fuel ixFrame [] ixRecSource = .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval ixIctx fuel' [] ixRecTarget = .ok v' ∧
+      ValRel ixEctx ixIctx v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev ixRecDer
+
+private theorem ixSplitDer :
+    PErase ixEctx ixIctx none ixFrame.refs ixFrame.selfMuts
+      ixFrame.selfAddr [] ixSplitSource ixSplitTarget := by
+  apply EraseValidator.related_of_validateExprWithRec
+    (cover := ixCover) (recMembers := ixRecMembers) (fuel := 200)
+  decide
+
+theorem indexedRecSplitSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval ixEctx fuel ixFrame [] ixSplitSource = .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval ixIctx fuel' [] ixSplitTarget = .ok v' ∧
+      ValRel ixEctx ixIctx v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev ixSplitDer
+
+private theorem ixRecursiveDer :
+    PErase ixEctx ixIctx none ixFrame.refs ixFrame.selfMuts
+      ixFrame.selfAddr [] ixRecursiveSource ixRecursiveTarget := by
+  apply EraseValidator.related_of_validateExprWithRec
+    (cover := ixCover) (recMembers := ixRecMembers) (fuel := 300)
+  decide
+
+theorem indexedRecSelfSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval ixEctx fuel ixFrame [] ixRecursiveSource = .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval ixIctx fuel' [] ixRecursiveTarget = .ok v' ∧
+      ValRel ixEctx ixIctx v v' :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hev ixRecursiveDer
+
+#guard (match Ixon.Eval.eval ixEctx 200 ixFrame [] ixRecSource with
+  | .ok (.litV (.natL 73)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval ixIctx 200 [] ixRecTarget with
+  | .ok (.lit (.nat 73)) => true
+  | _ => false)
+
+#guard (match Ixon.Eval.eval ixEctx 200 ixFrame [] ixSplitSource with
+  | .ok (.litV (.natL 73)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval ixIctx 200 [] ixSplitTarget with
+  | .ok (.lit (.nat 73)) => true
+  | _ => false)
+
+#guard (match Ixon.Eval.eval ixEctx 300 ixFrame [] ixRecursiveSource with
+  | .ok (.litV (.natL 73)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval ixIctx 300 [] ixRecursiveTarget with
+  | .ok (.lit (.nat 73)) => true
+  | _ => false)
+
+/-! ## Definition projections into mutual blocks
+
+The source enters an unfoldable definition member through `dPrj`, switching
+to the block's refs and self tables.  Erasure emits both the member declaration
+and the public projection alias; the certificate follows that exact two-hop
+target lookup and returns the contentful blob `91` on both sides. -/
+
+private def aMutDefBlock : Ixon.Address := addrOf 0x60
+private def aMutDefProj : Ixon.Address := addrOf 0x61
+private def aMutDefResult : Ixon.Address := addrOf 0x62
+
+private def mutDef : Ix.Compiler.Ixon.Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0, value := .nat 0 }
+
+private def cMutDefBlock : Constant :=
+  { info := .muts #[.defn mutDef]
+    sharing := #[], refs := #[aMutDefResult], univs := #[] }
+
+private def cMutDefProj : Constant :=
+  prjConst (.dPrj { idx := 0, block := aMutDefBlock })
+
+private def mutDefStore : List (Ixon.Address × Constant) :=
+  [(aMutDefBlock, cMutDefBlock), (aMutDefProj, cMutDefProj)]
+
+private def mutDefResolver : Ixon.Address → Option Constant := fun address =>
+  (mutDefStore.find? (fun entry => entry.1 == address)).map (·.2)
+
+private def mutDefEctx : Ixon.Eval.EvalCtx :=
+  { resolve := mutDefResolver
+    blobs := fun address =>
+      if address = aMutDefResult then some (.natB 91) else none }
+
+private def maMutDef : Ixon.Address := Erase.memberAddr aMutDefBlock 0
+
+private def mutDefErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maMutDef, .defn .shared (.lit (.nat 91))),
+   (aMutDefProj, .defn .shared (.ref maMutDef))]
+
+private def mutDefIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList mutDefErased }
+
+private theorem mutDefCovered : Covered mutDefEctx mutDefIctx aMutDefProj := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private def mutDefCoverage :
+    EraseValidator.CoverageDB mutDefEctx mutDefIctx :=
+  [{ address := aMutDefProj, covered := mutDefCovered }]
+
+private def mutDefCover :
+    EraseValidator.CoverOracle mutDefEctx mutDefIctx :=
+  mutDefCoverage.oracle
+
+private def mutDefFrame : Ixon.Eval.Frame :=
+  { refs := #[aMutDefProj] }
+
+private def mutDefTables : Erase.ETables :=
+  { refs := mutDefFrame.refs }
+
+private def mutDefSource : Ixon.Expr := .ref 0 #[]
+private def mutDefTarget : IxIR0.Expr := .ref aMutDefProj
+
+#guard (match EraseValidator.certifyProgram mutDefEctx mutDefStore
+    [aMutDefProj] 100 100 with
+  | .ok cert => cert.target == mutDefErased && cert.coverage.length == 1
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr mutDefEctx mutDefIctx mutDefCover none
+    mutDefTables mutDefFrame.selfAddr [] mutDefSource 100 100 with
+  | .ok cert => cert.target == mutDefTarget
+  | .error _ => false)
+
+private theorem mutDefDer :
+    PErase mutDefEctx mutDefIctx none mutDefFrame.refs mutDefFrame.selfMuts
+      mutDefFrame.selfAddr [] mutDefSource mutDefTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := mutDefCover) (fuel := 100)
+  decide
+
+theorem definitionProjectionSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval mutDefEctx fuel mutDefFrame [] mutDefSource =
+      .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval mutDefIctx targetFuel [] mutDefTarget = .ok targetValue ∧
+      ValRel mutDefEctx mutDefIctx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hsource mutDefDer
+
+#guard (match Ixon.Eval.eval mutDefEctx 100 mutDefFrame [] mutDefSource with
+  | .ok (.litV (.natL 91)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval mutDefIctx 100 [] mutDefTarget with
+  | .ok (.lit (.nat 91)) => true
+  | _ => false)
+
+/-! ## Non-self inductive members inside mutual definitions
+
+This mixed block enters its definition through `dPrj`, then evaluates a
+`recur` that names the block's other, inductive member.  The neutral source
+member escapes through a let and accepts an ordinary argument; the erased
+inductive declaration and every application of it remain `◻`, after which
+both sides return the contentful literal `88`. -/
+
+private def aMixedBlock : Ixon.Address := addrOf 0x63
+private def aMixedProj : Ixon.Address := addrOf 0x64
+private def aMixedResult : Ixon.Address := addrOf 0x65
+
+private def mixedInd : Ix.Compiler.Ixon.Inductive :=
+  { isUnsafe := false, lvls := 0, params := 0, indices := 0
+    typ := .sort 0
+    ctors := #[
+      { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+        typ := .sort 0 }] }
+
+private def mixedDef : Ix.Compiler.Ixon.Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0) (.recur 0 #[])
+      (.letE false (.sort 0) (.app (.var 0) (.sort 0)) (.nat 0)) }
+
+private def cMixedBlock : Constant :=
+  { info := .muts #[.indc mixedInd, .defn mixedDef]
+    sharing := #[], refs := #[aMixedResult], univs := #[.zero] }
+
+private def cMixedProj : Constant :=
+  prjConst (.dPrj { idx := 1, block := aMixedBlock })
+
+private def mixedStore : List (Ixon.Address × Constant) :=
+  [(aMixedBlock, cMixedBlock), (aMixedProj, cMixedProj)]
+
+private def mixedResolver : Ixon.Address → Option Constant := fun address =>
+  (mixedStore.find? (fun entry => entry.1 == address)).map (·.2)
+
+private def mixedEctx : Ixon.Eval.EvalCtx :=
+  { resolve := mixedResolver
+    blobs := fun address =>
+      if address = aMixedResult then some (.natB 88) else none }
+
+private def maMixedInd : Ixon.Address := Erase.memberAddr aMixedBlock 0
+private def maMixedDef : Ixon.Address := Erase.memberAddr aMixedBlock 1
+
+private def mixedDefTarget : IxIR0.Expr :=
+  .letE .many (.ref maMixedInd)
+    (.letE .many (.app (.var 0) .erased) (.lit (.nat 88)))
+
+private def mixedErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maMixedInd, .defn .shared .erased),
+   (maMixedDef, .defn .shared mixedDefTarget),
+   (aMixedProj, .defn .shared (.ref maMixedDef))]
+
+private def mixedIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList mixedErased }
+
+private theorem mixedCovered : Covered mixedEctx mixedIctx aMixedProj := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private def mixedCoverage :
+    EraseValidator.CoverageDB mixedEctx mixedIctx :=
+  [{ address := aMixedProj, covered := mixedCovered }]
+
+private def mixedCover :
+    EraseValidator.CoverOracle mixedEctx mixedIctx :=
+  mixedCoverage.oracle
+
+private def mixedFrame : Ixon.Eval.Frame :=
+  { refs := #[aMixedProj] }
+
+private def mixedTables : Erase.ETables :=
+  { refs := mixedFrame.refs }
+
+private def mixedSource : Ixon.Expr := .ref 0 #[]
+private def mixedTarget : IxIR0.Expr := .ref aMixedProj
+
+#guard (match EraseValidator.certifyProgram mixedEctx mixedStore
+    [aMixedProj] 100 100 with
+  | .ok cert => cert.target == mixedErased && cert.coverage.length == 1
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr mixedEctx mixedIctx mixedCover none
+    mixedTables mixedFrame.selfAddr [] mixedSource 100 100 with
+  | .ok cert => cert.target == mixedTarget
+  | .error _ => false)
+
+private def mixedIndDrift : Ix.Compiler.Ixon.Inductive :=
+  { mixedInd with indices := 1 }
+
+-- The validator ties the runtime frame slot to the resolver-selected member;
+-- matching only the synthetic target address is insufficient.
+#guard (match EraseValidator.validateExpr mixedEctx mixedIctx mixedCover none
+    #[aMixedResult] #[.indc mixedIndDrift, .defn mixedDef]
+    (some aMixedBlock) [] 100
+    (.recur 0 #[]) (.ref maMixedInd) with
+  | .error "non-self recur mutual member mismatch" => true
+  | _ => false)
+
+private theorem mixedDer :
+    PErase mixedEctx mixedIctx none mixedFrame.refs mixedFrame.selfMuts
+      mixedFrame.selfAddr [] mixedSource mixedTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := mixedCover) (fuel := 100)
+  decide
+
+theorem mutualInductiveMemberSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval mixedEctx fuel mixedFrame [] mixedSource =
+      .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval mixedIctx targetFuel [] mixedTarget = .ok targetValue ∧
+      ValRel mixedEctx mixedIctx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    hsource mixedDer
+
+#guard (match Ixon.Eval.eval mixedEctx 100 mixedFrame [] mixedSource with
+  | .ok (.litV (.natL 88)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval mixedIctx 100 [] mixedTarget with
+  | .ok (.lit (.nat 88)) => true
+  | _ => false)
+
+/-! ## Simultaneously certified cyclic definitions
+
+Member zero evaluates member one before returning `71`; member one contains a
+closure whose body calls member zero. Thus the syntactic member graph is a
+real cycle, while the selected execution traverses one cross-member edge and
+terminates contentfully. No topological ordering of the two body proofs
+exists: both are closed by one `MemberCoverage` certificate. -/
+
+private def aCyclicDefBlock : Ixon.Address := addrOf 0x66
+private def aCyclicDefProj : Ixon.Address := addrOf 0x67
+private def aCyclicDefResult0 : Ixon.Address := addrOf 0x68
+private def aCyclicDefResult1 : Ixon.Address := addrOf 0x69
+
+private def cyclicDef0 : Ix.Compiler.Ixon.Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0) (.recur 1 #[]) (.nat 0) }
+
+private def cyclicDef1 : Ix.Compiler.Ixon.Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0)
+      (.lam .many (.sort 0) (.recur 0 #[])) (.nat 1) }
+
+private def cCyclicDefBlock : Constant :=
+  { info := .muts #[.defn cyclicDef0, .defn cyclicDef1]
+    sharing := #[]
+    refs := #[aCyclicDefResult0, aCyclicDefResult1]
+    univs := #[] }
+
+private def cCyclicDefProj : Constant :=
+  prjConst (.dPrj { idx := 0, block := aCyclicDefBlock })
+
+private def cyclicDefStore : List (Ixon.Address × Constant) :=
+  [(aCyclicDefBlock, cCyclicDefBlock),
+   (aCyclicDefProj, cCyclicDefProj)]
+
+private def cyclicDefResolver : Ixon.Address → Option Constant :=
+  fun address =>
+    (cyclicDefStore.find? (fun entry => entry.1 == address)).map (·.2)
+
+private def cyclicDefEctx : Ixon.Eval.EvalCtx :=
+  { resolve := cyclicDefResolver
+    blobs := fun address =>
+      if address = aCyclicDefResult0 then some (.natB 71)
+      else if address = aCyclicDefResult1 then some (.natB 72)
+      else none }
+
+private def maCyclicDef0 : Ixon.Address :=
+  Erase.memberAddr aCyclicDefBlock 0
+private def maCyclicDef1 : Ixon.Address :=
+  Erase.memberAddr aCyclicDefBlock 1
+
+private def cyclicDefBody0 : IxIR0.Expr :=
+  .letE .many (.ref maCyclicDef1) (.lit (.nat 71))
+
+private def cyclicDefBody1 : IxIR0.Expr :=
+  .letE .many (.lam .many (.ref maCyclicDef0)) (.lit (.nat 72))
+
+private def cyclicDefErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maCyclicDef0, .defn .shared cyclicDefBody0),
+   (maCyclicDef1, .defn .shared cyclicDefBody1),
+   (aCyclicDefProj, .defn .shared (.ref maCyclicDef0))]
+
+private def cyclicDefIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList cyclicDefErased }
+
+@[instance_reducible] private def cyclicDefMemberScope : MemberScope :=
+  { plan := [⟨aCyclicDefBlock, 0⟩, ⟨aCyclicDefBlock, 1⟩] }
+
+section CyclicDefinitionMembers
+
+local instance : MemberScope := cyclicDefMemberScope
+
+private theorem cyclicDefCovered :
+    Covered cyclicDefEctx cyclicDefIctx aCyclicDefProj := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 200)
+  decide
+
+private def cyclicDefCoverage :
+    EraseValidator.CoverageDB cyclicDefEctx cyclicDefIctx :=
+  [{ address := aCyclicDefProj, covered := cyclicDefCovered }]
+
+private def cyclicDefCover :
+    EraseValidator.CoverOracle cyclicDefEctx cyclicDefIctx :=
+  cyclicDefCoverage.oracle
+
+private theorem cyclicDefMembers :
+    MemberCoverage cyclicDefEctx cyclicDefIctx
+      cyclicDefMemberScope.plan := by
+  apply EraseValidator.memberCoverage_of_validate
+    (db := cyclicDefCoverage) (fuel := 200)
+  decide
+
+private def cyclicDefFrame : Ixon.Eval.Frame :=
+  { refs := #[aCyclicDefProj] }
+
+private def cyclicDefTables : Erase.ETables :=
+  { refs := cyclicDefFrame.refs }
+
+private def cyclicDefSource : Ixon.Expr := .ref 0 #[]
+private def cyclicDefTarget : IxIR0.Expr := .ref aCyclicDefProj
+
+#guard (match EraseValidator.certifyProgram cyclicDefEctx cyclicDefStore
+    [aCyclicDefProj] 200 200 with
+  | .ok cert => cert.target == cyclicDefErased && cert.coverage.length == 1
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr cyclicDefEctx cyclicDefIctx
+    cyclicDefCover none cyclicDefTables cyclicDefFrame.selfAddr []
+    cyclicDefSource 200 200 with
+  | .ok cert => cert.target == cyclicDefTarget
+  | .error _ => false)
+
+private theorem cyclicDefDer :
+    PErase cyclicDefEctx cyclicDefIctx none cyclicDefFrame.refs
+      cyclicDefFrame.selfMuts cyclicDefFrame.selfAddr [] cyclicDefSource
+      cyclicDefTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := cyclicDefCover) (fuel := 200)
+  decide
+
+theorem cyclicDefinitionMembersSim {fuel : Nat}
+    {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval cyclicDefEctx fuel cyclicDefFrame []
+      cyclicDefSource = .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval cyclicDefIctx targetFuel [] cyclicDefTarget =
+        .ok targetValue ∧
+      ValRel cyclicDefEctx cyclicDefIctx value targetValue := by
+  exact erasure_sim_with_members cyclicDefMembers
+    (OracleRel.of_externFree (by intro address; rfl)) hsource cyclicDefDer .nil
+
+#guard (match Ixon.Eval.eval cyclicDefEctx 200 cyclicDefFrame []
+    cyclicDefSource with
+  | .ok (.litV (.natL 71)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval cyclicDefIctx 200 [] cyclicDefTarget with
+  | .ok (.lit (.nat 71)) => true
+  | _ => false)
+
+end CyclicDefinitionMembers
+
+/-- Omitting either endpoint does not silently turn the simultaneous proof
+into an acyclic one: validation encounters the missing cross-member edge. -/
+@[instance_reducible] private def incompleteCyclicDefMemberScope :
+    MemberScope :=
+  { plan := [⟨aCyclicDefBlock, 0⟩] }
+
+section IncompleteCyclicDefinitionMembers
+
+local instance : MemberScope := incompleteCyclicDefMemberScope
+
+#guard (match EraseValidator.validateMemberCoverage cyclicDefEctx
+    cyclicDefIctx [] 200 incompleteCyclicDefMemberScope.plan with
+  | .error message =>
+      message == "definition member is absent from the simultaneous plan"
+  | .ok _ => false)
+
+end IncompleteCyclicDefinitionMembers
+
+/-! ## Alternating cyclic recursors
+
+Two Nat-shaped recursors occupy the same block. Each successor rule invokes
+the other member on the predecessor, so evaluation over three successors
+traverses `r0 → r1 → r0 → r1` before the shared base minor returns
+`77`. Their rule certificates are mutually cyclic and are closed by the same
+finite plan used for definition members above. -/
+
+private def aCyclicRecBlock : Ixon.Address := addrOf 0x6A
+private def aCyclicRecNat : Ixon.Address := addrOf 0x6B
+private def aCyclicRecZero : Ixon.Address := addrOf 0x6C
+private def aCyclicRecSucc : Ixon.Address := addrOf 0x6D
+private def aCyclicRecProj0 : Ixon.Address := addrOf 0x6E
+private def aCyclicRecResult : Ixon.Address := addrOf 0x6F
+
+private def cyclicRecStepRule (other : UInt64) : RecursorRule :=
+  { fields := 1
+    rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+      (.lam .many (.sort 0) (.lam .many (.recur 0 #[])
+        (.app (.app (.var 1) (.var 0))
+          (.app (.app (.app (.app (.recur other #[]) (.var 3)) (.var 2))
+            (.var 1)) (.var 0)))))) }
+
+private def cyclicRecursor (other : UInt64) : Recursor :=
+  { k := false, isUnsafe := false, lvls := 0
+    params := 0, indices := 0, motives := 1, minors := 2
+    typ := .sort 0
+    rules := #[
+      { fields := 0
+        rhs := .lam .many (.sort 0) (.lam .many (.sort 0)
+          (.lam .many (.sort 0) (.var 1))) },
+      cyclicRecStepRule other] }
+
+private def cyclicRec0 : Recursor := cyclicRecursor 2
+private def cyclicRec1 : Recursor := cyclicRecursor 1
+
+private def cCyclicRecBlock : Constant :=
+  { info := .muts #[.indc natInd, .recr cyclicRec0, .recr cyclicRec1]
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cCyclicRecNat : Constant :=
+  prjConst (.iPrj { idx := 0, block := aCyclicRecBlock })
+private def cCyclicRecZero : Constant :=
+  prjConst (.cPrj { idx := 0, cidx := 0, block := aCyclicRecBlock })
+private def cCyclicRecSucc : Constant :=
+  prjConst (.cPrj { idx := 0, cidx := 1, block := aCyclicRecBlock })
+private def cCyclicRecProj0 : Constant :=
+  prjConst (.rPrj { idx := 1, block := aCyclicRecBlock })
+
+private def cyclicRecStore : List (Ixon.Address × Constant) :=
+  [(aCyclicRecBlock, cCyclicRecBlock),
+   (aCyclicRecNat, cCyclicRecNat),
+   (aCyclicRecZero, cCyclicRecZero),
+   (aCyclicRecSucc, cCyclicRecSucc),
+   (aCyclicRecProj0, cCyclicRecProj0)]
+
+private def cyclicRecResolver : Ixon.Address → Option Constant :=
+  fun address =>
+    (cyclicRecStore.find? (fun entry => entry.1 == address)).map (·.2)
+
+private def cyclicRecEctx : Ixon.Eval.EvalCtx :=
+  { resolve := cyclicRecResolver
+    blobs := fun address =>
+      if address = aCyclicRecResult then some (.natB 77) else none
+    natBlock := some aCyclicRecBlock }
+
+private def maCyclicRecNat : Ixon.Address :=
+  Erase.memberAddr aCyclicRecBlock 0
+private def maCyclicRec0 : Ixon.Address :=
+  Erase.memberAddr aCyclicRecBlock 1
+private def maCyclicRec1 : Ixon.Address :=
+  Erase.memberAddr aCyclicRecBlock 2
+
+private def cyclicRecTargetStep (other : Ixon.Address) : IxIR0.Expr :=
+  .app (.app (.var 1) (.var 0))
+    (.app (.app (.app (.app (.ref other) .erased) (.var 2)) (.var 1))
+      (.var 0))
+
+private def cyclicRecTargetRules (other : Ixon.Address) :
+    Array IxIR0.RecRule :=
+  #[{ fields := 0, rhs := .var 1 },
+    { fields := 1, rhs := cyclicRecTargetStep other }]
+
+private def cyclicRecErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maCyclicRecNat, .defn .shared .erased),
+   (maCyclicRec0, .recursor 3 true (cyclicRecTargetRules maCyclicRec1)),
+   (maCyclicRec1, .recursor 3 true (cyclicRecTargetRules maCyclicRec0)),
+   (aCyclicRecNat, .defn .shared .erased),
+   (aCyclicRecZero, .ctor 0 0),
+   (aCyclicRecSucc, .ctor 1 1),
+   (aCyclicRecProj0, .defn .shared (.ref maCyclicRec0))]
+
+private def cyclicRecIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList cyclicRecErased }
+
+@[instance_reducible] private def cyclicRecMemberScope : MemberScope :=
+  { plan := [⟨aCyclicRecBlock, 1⟩, ⟨aCyclicRecBlock, 2⟩] }
+
+section CyclicRecursorMembers
+
+local instance : MemberScope := cyclicRecMemberScope
+
+private theorem cyclicRecNatCovered :
+    Covered cyclicRecEctx cyclicRecIctx aCyclicRecNat := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 300)
+  decide
+
+private theorem cyclicRecZeroCovered :
+    Covered cyclicRecEctx cyclicRecIctx aCyclicRecZero := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 300)
+  decide
+
+private theorem cyclicRecSuccCovered :
+    Covered cyclicRecEctx cyclicRecIctx aCyclicRecSucc := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 300)
+  decide
+
+private def cyclicRecBaseCoverage :
+    EraseValidator.CoverageDB cyclicRecEctx cyclicRecIctx :=
+  [{ address := aCyclicRecSucc, covered := cyclicRecSuccCovered },
+   { address := aCyclicRecZero, covered := cyclicRecZeroCovered },
+   { address := aCyclicRecNat, covered := cyclicRecNatCovered }]
+
+private theorem cyclicRecProjCovered :
+    Covered cyclicRecEctx cyclicRecIctx aCyclicRecProj0 := by
+  apply EraseValidator.covered_of_validate
+    (db := cyclicRecBaseCoverage) (fuel := 300)
+  decide
+
+private def cyclicRecCoverage :
+    EraseValidator.CoverageDB cyclicRecEctx cyclicRecIctx :=
+  { address := aCyclicRecProj0, covered := cyclicRecProjCovered } ::
+    cyclicRecBaseCoverage
+
+private def cyclicRecCover :
+    EraseValidator.CoverOracle cyclicRecEctx cyclicRecIctx :=
+  cyclicRecCoverage.oracle
+
+private theorem cyclicRecMembers :
+    MemberCoverage cyclicRecEctx cyclicRecIctx
+      cyclicRecMemberScope.plan := by
+  apply EraseValidator.memberCoverage_of_validate
+    (db := cyclicRecCoverage) (fuel := 300)
+  decide
+
+private def cyclicRecFrame : Ixon.Eval.Frame :=
+  { refs := #[aCyclicRecProj0, aCyclicRecZero, aCyclicRecSucc,
+      aCyclicRecResult, aCyclicRecNat]
+    univs := #[.zero] }
+
+private def cyclicRecTables : Erase.ETables :=
+  { refs := cyclicRecFrame.refs }
+
+private def cyclicRecNatSource : Nat → Ixon.Expr
+  | 0 => .ref 1 #[]
+  | n + 1 => .app (.ref 2 #[]) (cyclicRecNatSource n)
+
+private def cyclicRecNatTarget : Nat → IxIR0.Expr
+  | 0 => .ref aCyclicRecZero
+  | n + 1 => .app (.ref aCyclicRecSucc) (cyclicRecNatTarget n)
+
+private def cyclicRecMinor : Ixon.Expr :=
+  .lam .many (.ref 4 #[])
+    (.lam .many (.ref 4 #[]) (.var 0))
+
+private def cyclicRecMinorTarget : IxIR0.Expr :=
+  .lam .many (.lam .many (.var 0))
+
+private def cyclicRecSource : Ixon.Expr :=
+  .app
+    (.app
+      (.app (.app (.ref 0 #[]) (.sort 0)) (.nat 3))
+      cyclicRecMinor)
+    (cyclicRecNatSource 3)
+
+private def cyclicRecTarget : IxIR0.Expr :=
+  .app
+    (.app
+      (.app (.app (.ref aCyclicRecProj0) .erased) (.lit (.nat 77)))
+      cyclicRecMinorTarget)
+    (cyclicRecNatTarget 3)
+
+#guard (match EraseValidator.certifyProgram cyclicRecEctx cyclicRecStore
+    [aCyclicRecNat, aCyclicRecZero, aCyclicRecSucc, aCyclicRecProj0]
+    300 300 with
+  | .ok cert => cert.target == cyclicRecErased && cert.coverage.length == 4
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr cyclicRecEctx cyclicRecIctx
+    cyclicRecCover none cyclicRecTables cyclicRecFrame.selfAddr []
+    cyclicRecSource 300 300 with
+  | .ok cert => cert.target == cyclicRecTarget
+  | .error _ => false)
+
+private theorem cyclicRecDer :
+    PErase cyclicRecEctx cyclicRecIctx none cyclicRecFrame.refs
+      cyclicRecFrame.selfMuts cyclicRecFrame.selfAddr [] cyclicRecSource
+      cyclicRecTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := cyclicRecCover) (fuel := 300)
+  decide
+
+theorem cyclicRecursorMembersSim {fuel : Nat}
+    {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval cyclicRecEctx fuel cyclicRecFrame []
+      cyclicRecSource = .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval cyclicRecIctx targetFuel [] cyclicRecTarget =
+        .ok targetValue ∧
+      ValRel cyclicRecEctx cyclicRecIctx value targetValue := by
+  exact erasure_sim_with_members cyclicRecMembers
+    (OracleRel.of_externFree (by intro address; rfl)) hsource cyclicRecDer .nil
+
+#guard (match Ixon.Eval.eval cyclicRecEctx 300 cyclicRecFrame []
+    cyclicRecSource with
+  | .ok (.litV (.natL 77)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval cyclicRecIctx 300 [] cyclicRecTarget with
+  | .ok (.lit (.nat 77)) => true
+  | _ => false)
+
+end CyclicRecursorMembers
+
+/-! ## Opaque mutual-definition members
+
+An unfoldable member calls an opaque sibling at its synthetic member address,
+while a second public projection aliases that opaque member directly.  The
+source and target evaluators therefore cross one same-address, two-argument
+oracle ledger on both entry paths and return the contentful literal `83`. -/
+
+private def aOpaqueMutBlock : Ixon.Address := addrOf 0x70
+private def aOpaqueMutWrapper : Ixon.Address := addrOf 0x71
+private def aOpaqueMutLeaf : Ixon.Address := addrOf 0x72
+private def aOpaqueMutLeft : Ixon.Address := addrOf 0x73
+private def aOpaqueMutRight : Ixon.Address := addrOf 0x74
+
+private def maOpaqueMutWrapper : Ixon.Address :=
+  Erase.memberAddr aOpaqueMutBlock 0
+
+private def maOpaqueMutLeaf : Ixon.Address :=
+  Erase.memberAddr aOpaqueMutBlock 1
+
+private def opaqueMutType : Ixon.Expr :=
+  .all .many .shared (.var 0)
+    (.all .many .shared (.var 0) (.sort 0))
+
+private def opaqueMutWrapperDef : Ix.Compiler.Ixon.Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := opaqueMutType
+    value := .lam .many (.var 0)
+      (.lam .many (.var 0)
+        (.app (.app (.recur 1 #[]) (.var 1)) (.var 0))) }
+
+private def opaqueMutLeafDef : Ix.Compiler.Ixon.Definition :=
+  { kind := .opaq, safety := .safe, lvls := 0
+    typ := opaqueMutType, value := .sort 0 }
+
+private def cOpaqueMutBlock : Constant :=
+  { info := .muts #[.defn opaqueMutWrapperDef, .defn opaqueMutLeafDef]
+    sharing := #[], refs := #[], univs := #[] }
+
+private def cOpaqueMutWrapper : Constant :=
+  prjConst (.dPrj { idx := 0, block := aOpaqueMutBlock })
+
+private def cOpaqueMutLeaf : Constant :=
+  prjConst (.dPrj { idx := 1, block := aOpaqueMutBlock })
+
+private def opaqueMutStore : List (Ixon.Address × Constant) :=
+  [(aOpaqueMutBlock, cOpaqueMutBlock),
+   (aOpaqueMutWrapper, cOpaqueMutWrapper),
+   (aOpaqueMutLeaf, cOpaqueMutLeaf)]
+
+private def opaqueMutResolver : Ixon.Address → Option Constant :=
+  fun address =>
+    (opaqueMutStore.find? (fun entry => entry.1 == address)).map (·.2)
+
+private def opaqueMutSourceOracle (address : Ixon.Address)
+    (args : List Ixon.Eval.Value) : Option Ixon.Eval.Value :=
+  if address = maOpaqueMutLeaf then
+    if args.length = 2 then some (.litV (.natL 83)) else none
+  else none
+
+private def opaqueMutTargetOracle (address : Ixon.Address)
+    (args : List IxIR0.Value) : Option IxIR0.Value :=
+  if address = maOpaqueMutLeaf then
+    if args.length = 2 then some (.lit (.nat 83)) else none
+  else none
+
+private def opaqueMutEctx : Ixon.Eval.EvalCtx :=
+  { resolve := opaqueMutResolver
+    blobs := fun address =>
+      if address = aOpaqueMutLeft then some (.natB 31)
+      else if address = aOpaqueMutRight then some (.natB 52)
+      else none
+    externArity := fun address =>
+      if address = maOpaqueMutLeaf then some 2 else none
+    oracle := opaqueMutSourceOracle }
+
+private def opaqueMutWrapperBody : IxIR0.Expr :=
+  .lam .many (.lam .many
+    (.app (.app (.ref maOpaqueMutLeaf) (.var 1)) (.var 0)))
+
+private def opaqueMutErased : List (Ixon.Address × IxIR0.Decl) :=
+  [(maOpaqueMutWrapper, .defn .shared opaqueMutWrapperBody),
+   (maOpaqueMutLeaf, .extern 2),
+   (aOpaqueMutWrapper, .defn .shared (.ref maOpaqueMutWrapper)),
+   (aOpaqueMutLeaf, .defn .shared (.ref maOpaqueMutLeaf))]
+
+private def opaqueMutIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList opaqueMutErased
+    oracle := opaqueMutTargetOracle }
+
+@[instance_reducible] private def opaqueMutMemberScope : MemberScope :=
+  { plan := [⟨aOpaqueMutBlock, 0⟩, ⟨aOpaqueMutBlock, 1⟩] }
+
+section OpaqueMutualDefinitionMembers
+
+local instance : MemberScope := opaqueMutMemberScope
+
+private theorem opaqueMutWrapperCovered :
+    Covered opaqueMutEctx opaqueMutIctx aOpaqueMutWrapper := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 200)
+  decide
+
+private theorem opaqueMutLeafCovered :
+    Covered opaqueMutEctx opaqueMutIctx aOpaqueMutLeaf := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 200)
+  decide
+
+private def opaqueMutCoverage :
+    EraseValidator.CoverageDB opaqueMutEctx opaqueMutIctx :=
+  [{ address := aOpaqueMutLeaf, covered := opaqueMutLeafCovered },
+   { address := aOpaqueMutWrapper, covered := opaqueMutWrapperCovered }]
+
+private def opaqueMutCover :
+    EraseValidator.CoverOracle opaqueMutEctx opaqueMutIctx :=
+  opaqueMutCoverage.oracle
+
+private theorem opaqueMutMembers :
+    MemberCoverage opaqueMutEctx opaqueMutIctx opaqueMutMemberScope.plan := by
+  apply EraseValidator.memberCoverage_of_validate
+    (db := opaqueMutCoverage) (fuel := 200)
+  decide
+
+private def opaqueMutFrame : Ixon.Eval.Frame :=
+  { refs := #[aOpaqueMutWrapper, aOpaqueMutLeaf,
+      aOpaqueMutLeft, aOpaqueMutRight] }
+
+private def opaqueMutTables : Erase.ETables :=
+  { refs := opaqueMutFrame.refs }
+
+private def opaqueMutWrapperSource : Ixon.Expr :=
+  .app (.app (.ref 0 #[]) (.nat 2)) (.nat 3)
+
+private def opaqueMutWrapperTarget : IxIR0.Expr :=
+  .app (.app (.ref aOpaqueMutWrapper) (.lit (.nat 31))) (.lit (.nat 52))
+
+private def opaqueMutLeafSource : Ixon.Expr :=
+  .app (.app (.ref 1 #[]) (.nat 2)) (.nat 3)
+
+private def opaqueMutLeafTarget : IxIR0.Expr :=
+  .app (.app (.ref aOpaqueMutLeaf) (.lit (.nat 31))) (.lit (.nat 52))
+
+#guard (match EraseValidator.certifyProgram opaqueMutEctx opaqueMutStore
+    [aOpaqueMutWrapper, aOpaqueMutLeaf] 200 200 with
+  | .ok cert => cert.target == opaqueMutErased && cert.coverage.length == 2
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr opaqueMutEctx opaqueMutIctx
+    opaqueMutCover none opaqueMutTables none [] opaqueMutWrapperSource 200 200 with
+  | .ok cert => cert.target == opaqueMutWrapperTarget
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr opaqueMutEctx opaqueMutIctx
+    opaqueMutCover none opaqueMutTables none [] opaqueMutLeafSource 200 200 with
+  | .ok cert => cert.target == opaqueMutLeafTarget
+  | .error _ => false)
+
+private theorem opaqueMutWrapperPErase :
+    PErase opaqueMutEctx opaqueMutIctx none opaqueMutFrame.refs
+      opaqueMutFrame.selfMuts opaqueMutFrame.selfAddr []
+      opaqueMutWrapperSource opaqueMutWrapperTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := opaqueMutCover) (fuel := 200)
+  decide
+
+private theorem opaqueMutLeafPErase :
+    PErase opaqueMutEctx opaqueMutIctx none opaqueMutFrame.refs
+      opaqueMutFrame.selfMuts opaqueMutFrame.selfAddr []
+      opaqueMutLeafSource opaqueMutLeafTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := opaqueMutCover) (fuel := 200)
+  decide
+
+private theorem opaqueMutValsLength {sourceArgs : List Ixon.Eval.Value}
+    {targetArgs : List IxIR0.Value}
+    (hargs : ValsRel opaqueMutEctx opaqueMutIctx sourceArgs targetArgs) :
+    sourceArgs.length = targetArgs.length := by
+  cases hargs with
+  | nil => rfl
+  | cons _ htail => simp [opaqueMutValsLength htail]
+termination_by sourceArgs
+
+private theorem opaqueMutOracleRel : OracleRel opaqueMutEctx opaqueMutIctx := by
+  intro address arity hconfigured
+  by_cases haddress : address = maOpaqueMutLeaf
+  · subst address
+    simp [opaqueMutEctx] at hconfigured
+    subst arity
+    intro sourceArgs targetArgs sourceValue hsourceLength hargs horacle
+    have hsourceValue : (.litV (.natL 83) : Ixon.Eval.Value) =
+        sourceValue := by
+      simpa [opaqueMutEctx, opaqueMutSourceOracle, hsourceLength] using horacle
+    subst sourceValue
+    have htargetLength : targetArgs.length = 2 := by
+      rw [← opaqueMutValsLength hargs, hsourceLength]
+    refine ⟨.lit (.nat 83), ?_, .litNat⟩
+    simp [opaqueMutIctx, opaqueMutTargetOracle, htargetLength]
+  · simp [opaqueMutEctx, haddress] at hconfigured
+
+/-- An unfoldable member may call a configured opaque sibling through the
+same synthetic extern identity emitted for that sibling. -/
+theorem opaqueMutualMemberSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval opaqueMutEctx fuel opaqueMutFrame []
+      opaqueMutWrapperSource = .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval opaqueMutIctx targetFuel [] opaqueMutWrapperTarget =
+        .ok targetValue ∧
+      ValRel opaqueMutEctx opaqueMutIctx value targetValue := by
+  exact erasure_sim_with_members opaqueMutMembers opaqueMutOracleRel hsource
+    opaqueMutWrapperPErase .nil
+
+/-- The public projection of that opaque member uses the same oracle key. -/
+theorem opaqueMutualProjectionSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval opaqueMutEctx fuel opaqueMutFrame []
+      opaqueMutLeafSource = .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval opaqueMutIctx targetFuel [] opaqueMutLeafTarget =
+        .ok targetValue ∧
+      ValRel opaqueMutEctx opaqueMutIctx value targetValue := by
+  exact erasure_sim_with_members opaqueMutMembers opaqueMutOracleRel hsource
+    opaqueMutLeafPErase .nil
+
+#guard (match Ixon.Eval.eval opaqueMutEctx 200 opaqueMutFrame []
+    opaqueMutWrapperSource with
+  | .ok (.litV (.natL 83)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval opaqueMutIctx 200 [] opaqueMutWrapperTarget with
+  | .ok (.lit (.nat 83)) => true
+  | _ => false)
+
+#guard (match Ixon.Eval.eval opaqueMutEctx 200 opaqueMutFrame []
+    opaqueMutLeafSource with
+  | .ok (.litV (.natL 83)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval opaqueMutIctx 200 [] opaqueMutLeafTarget with
+  | .ok (.lit (.nat 83)) => true
+  | _ => false)
+
+private def opaqueMutUnconfiguredEctx : Ixon.Eval.EvalCtx :=
+  { opaqueMutEctx with externArity := fun _ => none }
+
+#guard (match EraseValidator.validateCovered opaqueMutUnconfiguredEctx
+    opaqueMutIctx [] 100 aOpaqueMutLeaf with
+  | .error "opaque definition member extern is not configured" => true
+  | _ => false)
+
+private def opaqueMutWrongArityIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList
+      [(maOpaqueMutWrapper, .defn .shared opaqueMutWrapperBody),
+       (maOpaqueMutLeaf, .extern 1),
+       (aOpaqueMutWrapper, .defn .shared (.ref maOpaqueMutWrapper)),
+       (aOpaqueMutLeaf, .defn .shared (.ref maOpaqueMutLeaf))]
+    oracle := opaqueMutTargetOracle }
+
+#guard (match EraseValidator.validateMemberRel opaqueMutEctx
+    opaqueMutWrongArityIctx [] 100 ⟨aOpaqueMutBlock, 1⟩ with
+  | .error "opaque definition member extern arity mismatch" => true
+  | _ => false)
+
+end OpaqueMutualDefinitionMembers
+
+/-! ## Ghost arguments at ordinary definition heads
+
+The source ghost argument evaluates to `7̂`, so it cannot independently
+relate to target `◻`.  The unfoldable definition's declaration type and
+literal implementation lambda both classify the position as ghost; after
+discarding that argument, both evaluators return the contentful `9̂` body.
+This pins the `PErase.appDG` theorem/validator path on the executable eraser's
+exact output. -/
+
+private def aGhostDef : Ixon.Address := addrOf 0xD0
+private def aGhostArgument : Ixon.Address := addrOf 0xD1
+private def aGhostResult : Ixon.Address := addrOf 0xD2
+
+private def cGhostDef : Ixon.Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .shared (.sort 0) (.sort 0)
+        value := .lam .many (.sort 0) (.nat 0) }
+    sharing := #[], refs := #[aGhostResult], univs := #[.zero] }
+
+private def ghostStore : List (Ixon.Address × Ixon.Constant) :=
+  [(aGhostDef, cGhostDef)]
+
+private def ghostEctx : Ixon.Eval.EvalCtx :=
+  { resolve := fun address =>
+      if address = aGhostDef then some cGhostDef else none
+    blobs := fun address =>
+      if address = aGhostArgument then some (.natB 7)
+      else if address = aGhostResult then some (.natB 9)
+      else none }
+
+private def ghostTargetList : List (Ixon.Address × IxIR0.Decl) :=
+  [(aGhostDef, .defn .shared (.lam .many (.lit (.nat 9))))]
+
+private def ghostIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList ghostTargetList }
+
+private def ghostWrongOwnedIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList
+      [(aGhostDef, .defn .unique (.lam .many (.lit (.nat 9))))] }
+
+#guard (match EraseValidator.validateCovered ghostEctx ghostWrongOwnedIctx
+    [] 100 aGhostDef with
+  | .error "definition result ownership mismatch" => true
+  | _ => false)
+
+private theorem ghostCovered : Covered ghostEctx ghostIctx aGhostDef := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private def ghostCoverage : EraseValidator.CoverageDB ghostEctx ghostIctx :=
+  [{ address := aGhostDef, covered := ghostCovered }]
+
+private def ghostCover : EraseValidator.CoverOracle ghostEctx ghostIctx :=
+  ghostCoverage.oracle
+
+private def ghostFrame : Ixon.Eval.Frame :=
+  { refs := #[aGhostDef, aGhostArgument] }
+
+private def ghostSource : Ixon.Expr :=
+  .app (.ref 0 #[]) (.nat 1)
+
+private def ghostTarget : IxIR0.Expr :=
+  .app (.ref aGhostDef) .erased
+
+private def ghostTables : Erase.ETables :=
+  { refs := ghostFrame.refs }
+
+#guard (match EraseValidator.certifyProgram ghostEctx ghostStore
+    [aGhostDef] 100 100 with
+  | .ok cert => cert.target == ghostTargetList && cert.coverage.length == 1
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr ghostEctx ghostIctx ghostCover none
+    ghostTables none [] ghostSource 100 100 with
+  | .ok cert => cert.target == ghostTarget
+  | .error _ => false)
+
+private theorem ghostPErase :
+    PErase ghostEctx ghostIctx none ghostFrame.refs ghostFrame.selfMuts
+      ghostFrame.selfAddr [] ghostSource ghostTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := ghostCover) (fuel := 100)
+  decide
+
+/-- A contentful ordinary-definition application certified through the new
+ghost-head clause. -/
+theorem ghostDefinitionHeadSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (heval : Ixon.Eval.eval ghostEctx fuel ghostFrame [] ghostSource =
+      .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval ghostIctx targetFuel [] ghostTarget = .ok targetValue ∧
+      ValRel ghostEctx ghostIctx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    heval ghostPErase
+
+#guard (match Ixon.Eval.eval ghostEctx 100 ghostFrame [] ghostSource with
+  | .ok (.litV (.natL 9)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval ghostIctx 100 [] ghostTarget with
+  | .ok (.lit (.nat 9)) => true
+  | _ => false)
+
+/-! ## Configured quotient primitives
+
+These constants use deliberately all-kept telescopes, isolating the quotient
+semantic seam from argument-policy erasure.  The source evaluator preserves a
+distinct `quotV` wrapper after `mk`; `lift` and `ind` open that wrapper and run
+their supplied function.  IxIR₀ executes the exact lambda bodies emitted by
+`eraseProgram`, and the validator reconstructs `Covered.quot` for each global.
+-/
+
+private def aQuotCtorI : Ixon.Address := addrOf 0x50
+private def aQuotLiftI : Ixon.Address := addrOf 0x51
+private def aQuotIndI : Ixon.Address := addrOf 0x52
+private def aQuotPayloadI : Ixon.Address := addrOf 0x53
+
+private def quotientTestType : Nat → Ixon.Expr
+  | 0 => .var 0
+  | n + 1 => .all .many .shared (.var 0) (quotientTestType n)
+
+private def quotientConstant (kind : Ixon.QuotKind) (arity : Nat) :
+    Ixon.Constant :=
+  { info := .quot { kind, lvls := 0, typ := quotientTestType arity }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def quotientStore : List (Ixon.Address × Ixon.Constant) :=
+  [(aQuotCtorI, quotientConstant .ctor 3),
+   (aQuotLiftI, quotientConstant .lift 6),
+   (aQuotIndI, quotientConstant .ind 5)]
+
+private def quotientResolver : Ixon.Address → Option Ixon.Constant := fun a =>
+  (quotientStore.find? (fun entry => entry.1 == a)).map (·.2)
+
+private def quotientKindAt : Ixon.Address → Option Ixon.QuotKind := fun a =>
+  if a == aQuotCtorI then some .ctor
+  else if a == aQuotLiftI then some .lift
+  else if a == aQuotIndI then some .ind
+  else none
+
+private def quotientEctx : Ixon.Eval.EvalCtx :=
+  { resolve := quotientResolver
+    blobs := fun a => if a == aQuotPayloadI then some (.natB 37) else none
+    quotientKind := quotientKindAt }
+
+private def quotientUnconfiguredEctx : Ixon.Eval.EvalCtx :=
+  { resolve := quotientResolver
+    blobs := quotientEctx.blobs }
+
+private def quotientMismatchedEctx : Ixon.Eval.EvalCtx :=
+  { resolve := quotientResolver
+    blobs := quotientEctx.blobs
+    quotientKind := fun a =>
+      if a == aQuotCtorI then some .lift else quotientKindAt a }
+
+private def quotientTargetList : List (Ixon.Address × IxIR0.Decl) :=
+  [(aQuotCtorI, .defn .shared (Erase.quotientBody .ctor)),
+   (aQuotLiftI, .defn .shared (Erase.quotientBody .lift)),
+   (aQuotIndI, .defn .shared (Erase.quotientBody .ind))]
+
+private def quotientIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList quotientTargetList }
+
+private def quotientWrongOwnedIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList
+      [(aQuotCtorI, .defn .unique (Erase.quotientBody .ctor))] }
+
+private def quotientWrongBodyIctx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList
+      [(aQuotCtorI, .defn .shared .erased)] }
+
+private def quotientCoverageOrder : List Ixon.Address :=
+  [aQuotCtorI, aQuotLiftI, aQuotIndI]
+
+#guard (match EraseValidator.certifyProgram quotientEctx quotientStore
+    quotientCoverageOrder 200 200 with
+  | .ok cert =>
+      cert.target == quotientTargetList && cert.coverage.length == 3
+  | .error _ => false)
+
+#guard (match EraseValidator.validateCovered quotientUnconfiguredEctx
+    quotientIctx [] 100 aQuotCtorI with
+  | .error "quotient address is not configured" => true
+  | _ => false)
+
+#guard (match EraseValidator.validateCovered quotientMismatchedEctx
+    quotientIctx [] 100 aQuotCtorI with
+  | .error "configured quotient kind mismatch" => true
+  | _ => false)
+
+#guard (match EraseValidator.validateCovered quotientEctx
+    quotientWrongOwnedIctx [] 100 aQuotCtorI with
+  | .error "quotient result ownership mismatch" => true
+  | _ => false)
+
+#guard (match EraseValidator.validateCovered quotientEctx
+    quotientWrongBodyIctx [] 100 aQuotCtorI with
+  | .error "erased quotient body mismatch" => true
+  | _ => false)
+
+private theorem quotientCtorCovered :
+    Covered quotientEctx quotientIctx aQuotCtorI := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private theorem quotientLiftCovered :
+    Covered quotientEctx quotientIctx aQuotLiftI := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private theorem quotientIndCovered :
+    Covered quotientEctx quotientIctx aQuotIndI := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private def quotientCoverage :
+    EraseValidator.CoverageDB quotientEctx quotientIctx :=
+  [{ address := aQuotCtorI, covered := quotientCtorCovered },
+   { address := aQuotLiftI, covered := quotientLiftCovered },
+   { address := aQuotIndI, covered := quotientIndCovered }]
+
+private def quotientCover :
+    EraseValidator.CoverOracle quotientEctx quotientIctx :=
+  quotientCoverage.oracle
+
+private def quotientFrame : Ixon.Eval.Frame :=
+  { refs := #[aQuotCtorI, aQuotLiftI, aQuotIndI, aQuotPayloadI]
+    univs := #[.zero] }
+
+private def quotientTables : Erase.ETables :=
+  { refs := quotientFrame.refs }
+
+private def quotientSourceApps (head : Ixon.Expr)
+    (args : List Ixon.Expr) : Ixon.Expr :=
+  args.foldl .app head
+
+private def quotientTargetApps (head : IxIR0.Expr)
+    (args : List IxIR0.Expr) : IxIR0.Expr :=
+  args.foldl .app head
+
+private def quotientMk37 : Ixon.Expr :=
+  quotientSourceApps (.ref 0 #[]) [.sort 0, .sort 0, .nat 3]
+
+private def quotientLift37 : Ixon.Expr :=
+  quotientSourceApps (.ref 1 #[])
+    [.sort 0, .sort 0, .sort 0,
+     .lam .many (.var 0) (.var 0), .sort 0, quotientMk37]
+
+private def quotientInd37 : Ixon.Expr :=
+  quotientSourceApps (.ref 2 #[])
+    [.sort 0, .sort 0, .sort 0,
+     .lam .many (.var 0) (.var 0), quotientMk37]
+
+private def quotientMk37Target : IxIR0.Expr :=
+  quotientTargetApps (.ref aQuotCtorI)
+    [.erased, .erased, .lit (.nat 37)]
+
+private def quotientLift37Target : IxIR0.Expr :=
+  quotientTargetApps (.ref aQuotLiftI)
+    [.erased, .erased, .erased, .lam .many (.var 0), .erased,
+      quotientMk37Target]
+
+private def quotientInd37Target : IxIR0.Expr :=
+  quotientTargetApps (.ref aQuotIndI)
+    [.erased, .erased, .erased, .lam .many (.var 0),
+      quotientMk37Target]
+
+#guard (match EraseValidator.certifyExpr quotientEctx quotientIctx
+    quotientCover none quotientTables none [] quotientLift37 200 200 with
+  | .ok cert => cert.target == quotientLift37Target
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr quotientEctx quotientIctx
+    quotientCover none quotientTables none [] quotientInd37 200 200 with
+  | .ok cert => cert.target == quotientInd37Target
+  | .error _ => false)
+
+private theorem quotientLiftPErase :
+    PErase quotientEctx quotientIctx none quotientFrame.refs
+      quotientFrame.selfMuts quotientFrame.selfAddr [] quotientLift37
+      quotientLift37Target := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := quotientCover) (fuel := 200)
+  decide
+
+private theorem quotientIndPErase :
+    PErase quotientEctx quotientIctx none quotientFrame.refs
+      quotientFrame.selfMuts quotientFrame.selfAddr [] quotientInd37
+      quotientInd37Target := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := quotientCover) (fuel := 200)
+  decide
+
+/-- Configured `Quot.lift` preserves the contentful representative through
+the executable quotient compilation scheme. -/
+theorem quotientLiftSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (heval : Ixon.Eval.eval quotientEctx fuel quotientFrame []
+      quotientLift37 = .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval quotientIctx targetFuel [] quotientLift37Target =
+        .ok targetValue ∧
+      ValRel quotientEctx quotientIctx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    heval quotientLiftPErase
+
+/-- Configured `Quot.ind` preserves the contentful representative through
+the executable quotient compilation scheme. -/
+theorem quotientIndSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (heval : Ixon.Eval.eval quotientEctx fuel quotientFrame [] quotientInd37 =
+      .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval quotientIctx targetFuel [] quotientInd37Target =
+        .ok targetValue ∧
+      ValRel quotientEctx quotientIctx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ (OracleRel.of_externFree (by intro address; rfl))
+    heval quotientIndPErase
+
+#guard (match Ixon.Eval.eval quotientEctx 200 quotientFrame []
+    quotientLift37 with
+  | .ok (.litV (.natL 37)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval quotientIctx 200 [] quotientLift37Target with
+  | .ok (.lit (.nat 37)) => true
+  | _ => false)
+
+#guard (match Ixon.Eval.eval quotientEctx 200 quotientFrame []
+    quotientInd37 with
+  | .ok (.litV (.natL 37)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval quotientIctx 200 [] quotientInd37Target with
+  | .ok (.lit (.nat 37)) => true
+  | _ => false)
+
+/-! ## Configured axioms and opaque definitions
+
+Extern lowering is only structural: the compiler emits an arity, while this
+fixture supplies the semantic relation separately. Both oracles deliberately
+return the contentful literal `42` only at the configured address and exact
+two-argument saturation. -/
+
+private def aExtern : Ixon.Address := addrOf 0xE2
+private def aExternLeft : Ixon.Address := addrOf 0xE3
+private def aExternRight : Ixon.Address := addrOf 0xE4
+private def aOpaque : Ixon.Address := addrOf 0xE5
+
+private def externType : Ixon.Expr :=
+  .all .many .shared (.var 0)
+    (.all .many .shared (.var 0) (.sort 0))
+
+private def cExtern : Ixon.Constant :=
+  { info := .axio { isUnsafe := false, lvls := 0, typ := externType }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def externSourceOracle (address : Ixon.Address)
+    (args : List Ixon.Eval.Value) : Option Ixon.Eval.Value :=
+  if address = aExtern then
+    if args.length = 2 then some (.litV (.natL 42)) else none
+  else none
+
+private def externTargetOracle (address : Ixon.Address)
+    (args : List IxIR0.Value) : Option IxIR0.Value :=
+  if address = aExtern then
+    if args.length = 2 then some (.lit (.nat 42)) else none
+  else none
+
+private def externEctx : Ixon.Eval.EvalCtx :=
+  { resolve := fun address =>
+      if address = aExtern then some cExtern else none
+    blobs := fun address =>
+      if address = aExternLeft then some (.natB 17)
+      else if address = aExternRight then some (.natB 25)
+      else none
+    externArity := fun address =>
+      if address = aExtern then some 2 else none
+    oracle := externSourceOracle }
+
+private def externIctx : IxIR0.Ctx :=
+  { env := fun address =>
+      if address = aExtern then some (.extern 2) else none
+    oracle := externTargetOracle }
+
+private def externFrame : Ixon.Eval.Frame :=
+  { refs := #[aExtern, aExternLeft, aExternRight] }
+
+private def externSource : Ixon.Expr :=
+  .app (.app (.ref 0 #[]) (.nat 1)) (.nat 2)
+
+private def externTarget : IxIR0.Expr :=
+  .app (.app (.ref aExtern) (.lit (.nat 17))) (.lit (.nat 25))
+
+private theorem externCovered : Covered externEctx externIctx aExtern := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private def externCoverage : EraseValidator.CoverageDB externEctx externIctx :=
+  [{ address := aExtern, covered := externCovered }]
+
+private def externCover : EraseValidator.CoverOracle externEctx externIctx :=
+  externCoverage.oracle
+
+private def externTables : Erase.ETables :=
+  { refs := externFrame.refs }
+
+private theorem externPErase :
+    PErase externEctx externIctx none externFrame.refs externFrame.selfMuts
+      externFrame.selfAddr [] externSource externTarget := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := externCover) (fuel := 100)
+  decide
+
+private theorem externValsLength {sourceArgs : List Ixon.Eval.Value}
+    {targetArgs : List IxIR0.Value}
+    (hargs : ValsRel externEctx externIctx sourceArgs targetArgs) :
+    sourceArgs.length = targetArgs.length := by
+  cases hargs with
+  | nil => rfl
+  | cons _ htail => simp [externValsLength htail]
+termination_by sourceArgs
+
+private theorem externOracleRel : OracleRel externEctx externIctx := by
+  intro address arity hconfigured
+  by_cases haddress : address = aExtern
+  · subst address
+    simp [externEctx] at hconfigured
+    subst arity
+    intro sourceArgs targetArgs sourceValue hsourceLength hargs horacle
+    have hsourceValue : (.litV (.natL 42) : Ixon.Eval.Value) =
+        sourceValue := by
+      simpa [externEctx, externSourceOracle, hsourceLength] using horacle
+    subst sourceValue
+    have htargetLength : targetArgs.length = 2 := by
+      rw [← externValsLength hargs, hsourceLength]
+    refine ⟨.lit (.nat 42), ?_, .litNat⟩
+    simp [externIctx, externTargetOracle, htargetLength]
+  · simp [externEctx, haddress] at hconfigured
+
+#guard (match EraseValidator.certifyProgram externEctx [(aExtern, cExtern)]
+    [aExtern] 100 100 with
+  | .ok cert => cert.target == [(aExtern, .extern 2)]
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyExpr externEctx externIctx externCover none
+    externTables none [] externSource 100 100 with
+  | .ok cert => cert.target == externTarget
+  | .error _ => false)
+
+/-- A configured axiom crosses the explicit per-address oracle ledger at exact
+saturation and preserves its contentful result. -/
+theorem externAnswerSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (heval : Ixon.Eval.eval externEctx fuel externFrame [] externSource =
+      .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval externIctx targetFuel [] externTarget = .ok targetValue ∧
+      ValRel externEctx externIctx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ externOracleRel heval externPErase
+
+#guard (match Ixon.Eval.eval externEctx 100 externFrame [] externSource with
+  | .ok (.litV (.natL 42)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval externIctx 100 [] externTarget with
+  | .ok (.lit (.nat 42)) => true
+  | _ => false)
+
+private def externUnconfiguredEctx : Ixon.Eval.EvalCtx :=
+  { externEctx with externArity := fun _ => none }
+
+#guard (match EraseValidator.validateCovered externUnconfiguredEctx externIctx
+    [] 100 aExtern with
+  | .error "extern address is not configured" => true
+  | _ => false)
+
+private def externWrongArityIctx : IxIR0.Ctx :=
+  { externIctx with env := fun address =>
+      if address = aExtern then some (.extern 1) else none }
+
+#guard (match EraseValidator.validateCovered externEctx externWrongArityIctx
+    [] 100 aExtern with
+  | .error "configured extern arity mismatch" => true
+  | _ => false)
+
+private def externMissingOracleEctx : Ixon.Eval.EvalCtx :=
+  { externEctx with oracle := fun _ _ => none }
+
+#guard (match Ixon.Eval.eval externMissingOracleEctx 100 externFrame []
+    externSource with
+  | .error (.oracleMissing address) => address == aExtern
+  | _ => false)
+
+private def opaqueType : Ixon.Expr :=
+  .all .many .shared (.sort 0) (.sort 0)
+
+private def cOpaque : Ixon.Constant :=
+  { info := .defn
+      { kind := .opaq, safety := .safe, lvls := 0
+        typ := opaqueType, value := .sort 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+private def opaqueEctx : Ixon.Eval.EvalCtx :=
+  { resolve := fun address =>
+      if address = aOpaque then some cOpaque else none
+    externArity := fun address =>
+      if address = aOpaque then some 1 else none }
+
+private def opaqueIctx : IxIR0.Ctx :=
+  { env := fun address =>
+      if address = aOpaque then some (.extern 1) else none }
+
+private theorem opaqueCovered : Covered opaqueEctx opaqueIctx aOpaque := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+#guard (match EraseValidator.certifyProgram opaqueEctx [(aOpaque, cOpaque)]
+    [aOpaque] 100 100 with
+  | .ok cert => cert.target == [(aOpaque, .extern 1)]
+  | .error _ => false)
+
+/-! ## Sharing composition instance
+
+This fixture keeps the entry expression share-free but stores the referenced
+definition behind a valid sharing table.  Both the program and expression
+certificates are produced from the executable eraser's exact output; the
+simulation theorem reaches that certificate through semantic inlining. -/
+
+private def aShared : Ixon.Address := addrOf 0xE1
+
+private def cShared : Ixon.Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .share 0, value := .share 0 }
+    sharing := #[.sort 0], refs := #[], univs := #[.zero] }
+
+private def sharedStore : List (Ixon.Address × Ixon.Constant) :=
+  [(aShared, cShared)]
+
+private def sharedEctx : Ixon.Eval.EvalCtx :=
+  { resolve := fun address =>
+      if address = aShared then some cShared else none }
+
+private theorem sharedEctxWF : sharedEctx.SharingWF := by
+  constructor
+  · intro address c hresolve
+    by_cases haddress : address = aShared
+    · simp [sharedEctx, haddress] at hresolve
+      subst c
+      simp [cShared, Ixon.Constant.sharingWF, Ixon.Sharing.layer1WF,
+        Ixon.Sharing.tableWF, Ixon.Sharing.entriesWF,
+        Ixon.Sharing.entryWF, Ixon.Sharing.sharesBelow,
+        Ixon.Sharing.entriesUsedTwice, Ixon.Sharing.countShare,
+        Ixon.ConstantInfo.exprs, Ixon.Definition.exprs]
+    · simp [sharedEctx, haddress] at hresolve
+  · intro address args value hargs horacle
+    simp [sharedEctx] at horacle
+
+private def sharedIctx : IxIR0.Ctx :=
+  { env := fun address =>
+      if address = aShared then some (.defn .shared .erased) else none }
+
+private def dSharedInlined : Ixon.Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0, value := .sort 0 }
+
+private theorem sharedCovered :
+    Covered sharedEctx.inlineSharing sharedIctx aShared := by
+  apply Covered.defn (c := cShared.inlineSharing)
+    (d := dSharedInlined) (result := .shared) (body' := .erased)
+  · simp [sharedEctx, Ixon.Eval.EvalCtx.inlineSharing]
+  · simp [cShared, Ixon.Constant.inlineSharing,
+      Ixon.ConstantInfo.mapExprs, Ixon.ConstantIdentityLaws.mapInfo,
+      Ixon.ConstantIdentityLaws.mapDefinition,
+      Ixon.Sharing.inlineExpr, Ixon.Sharing.inlineTable,
+      Ixon.Sharing.inlineEntries, Ixon.Sharing.substShares,
+      Ixon.Sharing.substSharesList, dSharedInlined]
+  · rfl
+  · simp [sharedIctx]
+  · refine ⟨none, ?_, rfl⟩
+    exact .terminal rfl
+  · exact .sortE
+
+private def sharedCoverage :
+    EraseValidator.CoverageDB sharedEctx.inlineSharing sharedIctx :=
+  [{ address := aShared, covered := sharedCovered }]
+
+private def sharedCover :
+    EraseValidator.CoverOracle sharedEctx.inlineSharing sharedIctx :=
+  sharedCoverage.oracle
+
+private def sharedFrame : Ixon.Eval.Frame :=
+  { refs := #[aShared] }
+
+private theorem sharedFrameWF : sharedFrame.SharingWF := by
+  constructor
+  · decide
+  · intro i member hget
+    simp [sharedFrame] at hget
+
+private def sharedSource : Ixon.Expr := .ref 0 #[]
+
+#guard (match EraseValidator.certifySharedProgram sharedEctx sharedStore
+    [aShared] 100 100 with
+  | .ok cert => cert.target == [(aShared, .defn .shared .erased)]
+  | .error _ => false)
+
+#guard (match EraseValidator.certifySharedClosedExpr sharedEctx sharedIctx
+    sharedCover sharedFrame sharedSource 100 100 with
+  | .ok cert => cert.target == .ref aShared
+  | .error _ => false)
+
+private theorem sharedPErase :
+    PErase sharedEctx.inlineSharing sharedIctx none
+      sharedFrame.inlineSharing.refs sharedFrame.inlineSharing.selfMuts
+      sharedFrame.inlineSharing.selfAddr []
+      (Ixon.Sharing.inlineExpr sharedFrame.sharing sharedSource)
+      (.ref aShared) := by
+  simpa [sharedFrame, sharedSource, Ixon.Eval.Frame.inlineSharing,
+    Ixon.Sharing.inlineExpr, Ixon.Sharing.inlineTable,
+    Ixon.Sharing.inlineEntries, Ixon.Sharing.substShares,
+    Ixon.Sharing.substSharesList] using
+    (PErase.ref (mask := []) (refs := sharedFrame.inlineSharing.refs)
+      (muts := sharedFrame.inlineSharing.selfMuts)
+      (sa := sharedFrame.inlineSharing.selfAddr) (sc := none)
+      (refIdx := 0) (univIdxs := #[]) (a := aShared) rfl sharedCovered)
+
+/-- A real shared definition, certified through the executable program and
+expression erasers, instantiates the composed sharing/erasure simulation. -/
+theorem sharedDefinitionSim {fuel : Nat} {v : Ixon.Eval.Value}
+    (hev : Ixon.Eval.eval sharedEctx fuel sharedFrame [] sharedSource =
+      .ok v) :
+    ∃ fuel' v',
+      IxIR0.eval sharedIctx fuel' [] (.ref aShared) = .ok v' ∧
+      InlinedValRel sharedEctx sharedIctx v v' := by
+  apply erasure_sim_inlineSharing_closed ⟨rfl, rfl⟩ sharedEctxWF sharedFrameWF
+    (OracleRel.of_externFree (by intro address; rfl))
+    (e := sharedSource) (e' := .ref aShared)
+  · decide
+  · exact hev
+  · exact sharedPErase
+
+#guard (match Ixon.Eval.eval sharedEctx 100 sharedFrame [] sharedSource with
+  | .ok (.sortV 0) => true
+  | _ => false)
+
+#guard (match IxIR0.eval sharedIctx 100 [] (.ref aShared) with
+  | .ok .erased => true
+  | _ => false)
+
+end Ix.Compiler.SimInstance
diff --git a/Ix/Compiler/Tools/BorrowCheck.lean b/Ix/Compiler/Tools/BorrowCheck.lean
new file mode 100644
index 000000000..c71f91b0a
--- /dev/null
+++ b/Ix/Compiler/Tools/BorrowCheck.lean
@@ -0,0 +1,152 @@
+import Ix.Compiler.Tools.Check
+import Blake3.Rust
+
+/-! Independent JSON artifact inspection. This module imports no compiler,
+borrow optimizer, ownership validator, or evaluator. IxIR₂ JSON remains a
+diagnostic format; this checker is a regression oracle for the named gate. -/
+
+namespace Ix.Compiler.Tools.BorrowCheck
+
+open Lean Ix.Compiler.Tools.Check
+
+def number (value : Json) (key : String) : IO Nat := do nat (← field value key)
+def obj := Json.mkObj
+def tagged (tag : String) (fields : List (String × Json)) : Json := obj [(tag, obj fields)]
+def reg (id : Nat) : Json := tagged "reg" [("id", toJson id)]
+def owned : Json := tagged "owned" [("world", toJson "shared")]
+def borrowed : Json := tagged "borrowed" [("world", toJson "shared"), ("lender", toJson "caller")]
+def scalar (n : Nat) : Json := tagged "lit" [("l", tagged "nat" [("n", toJson n)])]
+
+def constructor (value : Json) : IO (String × Json) := do
+  let [(tag, arguments)] ← pairs value | throw (IO.userError "expected one constructor tag")
+  return (tag, arguments)
+
+def replace (value : Json) (key : String) (replacement : Json) : IO Json := do
+  let fields ← pairs value
+  need (fields.any (·.1 == key)) s!"cannot replace missing field {key}"
+  return obj (fields.map fun (name, old) => (name, if name == key then replacement else old))
+
+def hash (bytes : ByteArray) : String :=
+  (Blake3.Rust.hash bytes).val.data.foldl (fun output byte =>
+    output ++ (if byte.toNat < 16 then "0" else "") ++ hexNat byte.toNat) ""
+
+def hashField (value : Json) (payload key : String) : IO Unit := do
+  let bytes ← checked (unhex (← strField value payload))
+  need (hash bytes == (← strField value key)) s!"{payload}/{key} hash mismatch"
+
+def entry (value : Json) : IO (String × Json) := do
+  let #[owner, declaration] ← array value | throw (IO.userError "malformed declaration entry")
+  return (← string owner, ← field (← field declaration "fn") "definition")
+
+def function (program : Json) (owner : String) : IO Json := do
+  if owner == "main" then return ← field program "main"
+  let entries ← (← arrField program "declarations").mapM entry
+  let some (_, definition) := entries.find? (·.1 == owner)
+    | throw (IO.userError "missing addressed function")
+  return definition
+
+def target (summaries : Array Json) (owner : String) : IO String := do
+  for summary in summaries do
+    if (← strField summary "owner") == owner then return ← strField summary "borrowed"
+  return owner
+
+private def loan (loans : Array Bool) (atom : Json) : IO Bool := do
+  if atom == toJson "erased" then return false
+  let (tag, fields) ← constructor atom
+  if tag == "reg" then return loans[← number fields "id"]?.getD false
+  need (tag == "lit") "unknown atom"
+  return false
+
+private def redirect (summaries : Array Json) (term : Json) : IO Json := do
+  let (tag, args) ← constructor term
+  if tag != "call" && tag != "tailCall" then return term
+  return obj [(tag, ← replace args "function" (toJson (← target summaries (← strField args "function"))))]
+
+def variantBlock (summaries : Array Json) (block : Json) : IO Json := do
+  need ((← arrField block "creditParams").isEmpty) "borrow variant retained credit parameters"
+  let parameters ← arrField block "valueParams"
+  let mut loans := parameters.map (· == owned)
+  let mut rewritten := #[]
+  for instruction in ← arrField block "instructions" do
+    let (tag, args) ← constructor instruction
+    match tag with
+    | "move" =>
+        loans := loans.push (← loan loans (← field args "value"))
+        rewritten := rewritten.push instruction
+    | "retainShared" =>
+        let atom ← field args "target"
+        let isLoan ← loan loans atom
+        loans := loans.push isLoan
+        rewritten := rewritten.push (if isLoan then tagged "move" [("value", atom)] else instruction)
+    | "releaseShared" =>
+        if !(← loan loans (← field args "target")) then rewritten := rewritten.push instruction
+    | "call" =>
+        loans := loans.push false
+        rewritten := rewritten.push (← redirect summaries instruction)
+    | "alloc" | "fetch" | "papp" | "apply" =>
+        loans := loans.push false
+        rewritten := rewritten.push instruction
+    | "dropUnique" | "freeUnique" => rewritten := rewritten.push instruction
+    | _ => throw (IO.userError "unsupported borrowed variant instruction")
+  let term ← field block "terminator"
+  let (tag, _) ← constructor term
+  need (tag != "tailCallSelf" && tag != "branchCredit") "unsupported borrowed terminator"
+  let block ← replace block "valueParams" (toJson (parameters.map fun cap => if cap == owned then borrowed else cap))
+  let block ← replace block "instructions" (toJson rewritten)
+  replace block "terminator" (← redirect summaries term)
+
+def variant (summaries : Array Json) (definition : Json) : IO Json := do
+  let signature ← field definition "signature"
+  let ownedParam := obj [("world", toJson "shared"), ("passing", toJson "owned")]
+  need ((← field signature "params") == toJson #[ownedParam] &&
+    (← strField signature "result") == "shared") "invalid borrow summary signature"
+  let signature ← replace signature "params"
+    (toJson #[obj [("world", toJson "shared"), ("passing", toJson "borrowed")]])
+  let signature ← replace signature "papSafe" (toJson false)
+  let definition ← replace definition "signature" signature
+  replace definition "blocks" (toJson (← (← arrField definition "blocks").mapM (variantBlock summaries)))
+
+def wrapper (borrowedAddress : String) (definition : Json) : IO Json := do
+  let block := obj [
+    ("valueParams", toJson #[owned]), ("creditParams", toJson (#[] : Array Json)),
+    ("instructions", toJson #[
+      tagged "call" [("function", toJson borrowedAddress), ("args", toJson #[reg 0])],
+      tagged "releaseShared" [("target", reg 0)]]),
+    ("terminator", tagged "ret" [("value", reg 1)])]
+  replace definition "blocks" (toJson #[block])
+
+def declaration (owner : String) (definition : Json) : Json :=
+  toJson #[toJson owner, tagged "fn" [("definition", definition)]]
+
+def inspectRewrite (baseline rewritten : Json) (summaries : Array Json) : IO Unit := do
+  let originals ← (← arrField baseline "declarations").mapM entry
+  let owners ← summaries.mapM (strField · "owner")
+  let labels ← summaries.mapM (strField · "borrowed")
+  need (owners.toList.eraseDups.length == owners.size && labels.toList.eraseDups.length == labels.size)
+    "duplicate borrow summary or label"
+  need (labels.all fun label => !(originals.any (·.1 == label))) "borrow label aliases an owned entry"
+  let mut expected := #[]
+  for (owner, definition) in originals do
+    let label ← target summaries owner
+    expected := expected.push (declaration owner (← if label == owner then pure definition else wrapper label definition))
+  for summary in summaries do
+    let owner ← strField summary "owner"
+    let label ← strField summary "borrowed"
+    let bytes ← checked (unhex owner)
+    need (hash ("compilatrix/borrowed-entry/1\x00".toUTF8 ++ bytes) == label) "borrow label preimage mismatch"
+    expected := expected.push (declaration label (← variant summaries (← function baseline owner)))
+  let rebuilt ← replace baseline "declarations" (toJson expected)
+  need (rebuilt == rewritten) "borrowed graph differs from independent caller/callee reconstruction"
+
+def programSize (program : Json) : IO Json := do
+  let definitions ← (← arrField program "declarations").mapM (fun value => do return (← entry value).2)
+  let mut blocks := 0
+  let mut instructions := 0
+  for definition in definitions.push (← field program "main") do
+    let body ← arrField definition "blocks"
+    blocks := blocks + body.size
+    for block in body do instructions := instructions + (← arrField block "instructions").size
+  return obj [("declarations", toJson definitions.size), ("blocks", toJson blocks),
+    ("instructions", toJson instructions)]
+
+end Ix.Compiler.Tools.BorrowCheck
diff --git a/Ix/Compiler/Tools/BorrowExecution.lean b/Ix/Compiler/Tools/BorrowExecution.lean
new file mode 100644
index 000000000..b16557a54
--- /dev/null
+++ b/Ix/Compiler/Tools/BorrowExecution.lean
@@ -0,0 +1,242 @@
+import Ix.Compiler.Tools.BorrowCheck
+
+/-! A separate interpreter for the small shared-heap instruction slice used
+by the source-borrow fixtures. It checks every exported control state, frame
+value, heap slot, RC update, release work item, and continuation transition.
+It imports neither the compiler evaluator nor the borrowed-call pass. -/
+
+namespace Ix.Compiler.Tools.BorrowCheck
+
+open Lean Ix.Compiler.Tools.Check
+
+structure Memory where
+  nodes : Array Json := #[]
+  allocs : Nat := 0
+  frees : Nat := 0
+  rcops : Nat := 0
+  peak : Nat := 0
+  remaining : Nat := 1000
+
+def Memory.json (memory : Memory) : Json :=
+  obj [("heap", obj [("nodes", toJson memory.nodes), ("allocs", toJson memory.allocs),
+    ("frees", toJson memory.frees), ("rcops", toJson memory.rcops), ("reuses", toJson (0 : Nat))]),
+    ("peakLiveNodes", toJson memory.peak), ("resetAttempts", toJson (0 : Nat)),
+    ("hotResets", toJson (0 : Nat)), ("coldResets", toJson (0 : Nat)),
+    ("reusedPayloadUnits", toJson (0 : Nat))]
+
+private def location (value : Json) : IO (Option Nat) := do
+  if value == toJson "erased" then return none
+  let (tag, info) ← constructor value
+  if tag == "loc" then return some (← number info "l")
+  need (tag == "lit") "malformed runtime value"
+  return none
+
+def Memory.get (memory : Memory) (index : Nat) : IO Json := do
+  let some node := memory.nodes[index]? | throw (IO.userError "heap location out of bounds")
+  need (node != Json.null && (← strField node "world") == "shared" && (← number node "rc") > 0)
+    "dead or invalid shared heap location"
+  return node
+
+private def retain (memory : Memory) (value : Json) : IO Memory := do
+  let some index ← location value | return memory
+  let node ← memory.get index
+  let node ← replace node "rc" (toJson ((← number node "rc") + 1))
+  return { memory with nodes := memory.nodes.set! index node, rcops := memory.rcops + 1 }
+
+private def release (initial : Memory) (value : Json) : IO Memory := do
+  let mut memory := initial
+  let mut todo := [value]
+  for _ in [:1001] do
+    let head :: rest := todo | return memory
+    todo := rest
+    need (memory.remaining > 0) "independent release budget exhausted"
+    memory := { memory with remaining := memory.remaining - 1 }
+    if let some index ← location head then
+      let box ← memory.get index
+      let rc ← number box "rc"
+      memory := { memory with rcops := memory.rcops + 1 }
+      if rc > 1 then
+        memory := { memory with nodes := memory.nodes.set! index (← replace box "rc" (toJson (rc - 1))) }
+      else
+        let (tag, node) ← constructor (← field box "node")
+        let children ← arrField node (if tag == "ctorN" then "fields" else "args")
+        need (tag == "ctorN" || tag == "papN") "invalid heap node tag"
+        todo := children.toList ++ todo
+        memory := { memory with nodes := memory.nodes.set! index Json.null, frees := memory.frees + 1 }
+  throw (IO.userError "independent release work exceeded its bound")
+
+private def allocate (memory : Memory) (node : Json) : Memory × Json :=
+  let index := memory.nodes.size
+  let nodes := memory.nodes.push (obj [("world", toJson "shared"), ("rc", toJson (1 : Nat)), ("node", node)])
+  ({ memory with
+      nodes, allocs := memory.allocs + 1
+      peak := max memory.peak (nodes.countP (· != Json.null)) }, tagged "loc" [("l", toJson index)])
+
+structure Frame where
+  owner : String := "main"
+  block : Nat := 0
+  pc : Nat := 0
+  values : Array Json := #[]
+
+structure Machine where
+  memory : Memory := {}
+  frame : Frame := {}
+  stack : List Frame := []
+  halted : Option Json := none
+
+def Machine.control (machine : Machine) : Json :=
+  match machine.halted with
+  | some value => obj [("halted", value)]
+  | none => obj [("owner", toJson machine.frame.owner), ("block", toJson machine.frame.block),
+      ("pc", toJson machine.frame.pc), ("values", toJson machine.frame.values),
+      ("stack_depth", toJson machine.stack.length)]
+
+private def resolve (frame : Frame) (atom : Json) : IO Json := do
+  if atom == toJson "erased" then return atom
+  let (tag, info) ← constructor atom
+  match tag with
+  | "reg" =>
+      present frame.values[← number info "id"]? "unbound operand register"
+  | "lit" => return tagged "lit" [("l", ← field info "literal")]
+  | _ => throw (IO.userError "unknown block atom")
+
+private def arguments (frame : Frame) (args : Json) : IO (Array Json) := do
+  (← array args).mapM (resolve frame)
+
+private def enter (program : Json) (owner : String) (values : Array Json) : IO Frame := do
+  let definition ← function program owner
+  let signature ← field definition "signature"
+  need ((← arrField signature "params").size == values.size && !(← arrField definition "blocks").isEmpty)
+    "independent call entry mismatch"
+  return { owner, values }
+
+private def papArity (program : Json) (owner : String) : IO Nat := do
+  let signature ← field (← function program owner) "signature"
+  need ((← field signature "papSafe") == toJson true && (← strField signature "result") == "shared")
+    "dynamic entry reached a borrowed or non-shared signature"
+  let params ← arrField signature "params"
+  for param in params do
+    need ((← strField param "world") == "shared" && (← strField param "passing") == "owned")
+      "dynamic argument is not owned"
+  return params.size
+
+private def transfer (machine : Machine) (edge : Json) : IO Machine := do
+  need ((← arrField edge "credits").isEmpty) "unexpected edge credit"
+  let values ← arguments machine.frame (← field edge "values")
+  return { machine with frame := { machine.frame with block := ← number edge "target", pc := 0, values } }
+
+def step (program : Json) (machine : Machine) : IO Machine := do
+  need machine.halted.isNone "extra transition after halt"
+  let definition ← function program machine.frame.owner
+  let blocks ← arrField definition "blocks"
+  let block ← present blocks[machine.frame.block]? "missing execution block"
+  need ((← arrField block "creditParams").isEmpty) "unexpected execution credit"
+  let instructions ← arrField block "instructions"
+  let frame := machine.frame
+  let next := { frame with pc := frame.pc + 1 }
+  if frame.pc < instructions.size then
+    let (tag, args) ← constructor instructions[frame.pc]!
+    match tag with
+    | "move" =>
+        return { machine with frame := { next with values := next.values.push (← resolve frame (← field args "value")) } }
+    | "retainShared" =>
+        let value ← resolve frame (← field args "target")
+        return { machine with
+          memory := ← retain machine.memory value
+          frame := { next with values := next.values.push value } }
+    | "releaseShared" =>
+        return { machine with memory := ← release machine.memory (← resolve frame (← field args "target")), frame := next }
+    | "alloc" =>
+        need ((← strField args "world") == "shared") "unexpected allocation world"
+        let values ← arguments frame (← field args "args")
+        let (memory, value) := allocate machine.memory (tagged "ctorN" [("cid", ← field args "cid"), ("fields", toJson values)])
+        return { machine with memory, frame := { next with values := next.values.push value } }
+    | "fetch" =>
+        let some index ← location (← resolve frame (← field args "target"))
+          | throw (IO.userError "fetch target is not a location")
+        let node ← field (← field (← machine.memory.get index) "node") "ctorN"
+        need ((← field node "cid") == (← field args "cid")) "fetch constructor mismatch"
+        let fields ← arrField node "fields"
+        let value ← present fields[← number args "field"]? "fetch field missing"
+        return { machine with frame := { next with values := next.values.push value } }
+    | "call" =>
+        let callee ← enter program (← strField args "function") (← arguments frame (← field args "args"))
+        return { machine with frame := callee, stack := next :: machine.stack }
+    | "papp" =>
+        let owner ← strField args "function"
+        let arity ← papArity program owner
+        let values ← arguments frame (← field args "args")
+        need (values.size < arity) "saturated papp instruction"
+        let (memory, value) := allocate machine.memory
+          (tagged "papN" [("f", toJson owner), ("arity", toJson arity), ("args", toJson values)])
+        return { machine with memory, frame := { next with values := next.values.push value } }
+    | "apply" =>
+        let value ← resolve frame (← field args "function")
+        let some index ← location value | throw (IO.userError "fixture apply is not a PAP")
+        let pap ← field (← field (← machine.memory.get index) "node") "papN"
+        let owner ← strField pap "f"
+        let arity ← papArity program owner
+        need ((← number pap "arity") == arity) "PAP arity mismatch"
+        let captured ← arrField pap "args"
+        let values := captured ++ (← arguments frame (← field args "args"))
+        need (captured.size < arity && values.size == arity) "fixture application left the exact-saturation slice"
+        let mut memory := machine.memory
+        for value in captured do memory ← retain memory value
+        memory ← release memory value
+        return { machine with memory, frame := ← enter program owner values, stack := next :: machine.stack }
+    | _ => throw (IO.userError s!"unsupported independent instruction {tag}")
+  else
+    need (frame.pc == instructions.size) "execution pc passed terminator"
+    let (tag, args) ← constructor (← field block "terminator")
+    match tag with
+    | "ret" =>
+        let value ← resolve frame (← field args "value")
+        match machine.stack with
+        | [] => return { machine with halted := some value }
+        | caller :: rest =>
+            return { machine with
+              stack := rest, frame := { caller with values := caller.values.push value } }
+    | "tailCall" =>
+        let callee ← enter program (← strField args "function") (← arguments frame (← field args "args"))
+        return { machine with frame := callee }
+    | "jump" => transfer machine (← field args "edge")
+    | "switchValue" =>
+        let some index ← location (← resolve frame (← field args "scrutinee"))
+          | throw (IO.userError "fixture switch is not a heap constructor")
+        let ctor ← field (← field (← machine.memory.get index) "node") "ctorN"
+        let alternatives ← arrField args "constructors"
+        for alternative in alternatives do
+          if (← field alternative "cid") == (← field ctor "cid") then
+            return ← transfer machine (← field alternative "edge")
+        throw (IO.userError "missing independent switch alternative")
+    | _ => throw (IO.userError s!"unsupported independent terminator {tag}")
+
+def inspectExecutionFrom (program prefixes result : Json) (expected : Nat)
+    (initial : Machine) (requireReclamation : Bool := true) : IO Unit := do
+  let prefixes ← array prefixes
+  need (!prefixes.isEmpty && prefixes.size ≤ 1001) "invalid execution-prefix count"
+  let mut machine := initial
+  for index in [:prefixes.size] do
+    let row := prefixes[index]!
+    need ((← number row "step") == index && (← field row "store") == machine.memory.json &&
+      (← number row "heap_remaining") == machine.memory.remaining &&
+      (← field row "control") == machine.control) s!"independent execution mismatch at step {index}"
+    if index + 1 < prefixes.size then machine ← step program machine
+  need (machine.halted == some (scalar expected)) "independent result mismatch"
+  if requireReclamation then
+    need (machine.memory.nodes.all (· == Json.null) && machine.memory.allocs == machine.memory.frees)
+      "independent reclamation mismatch"
+  need ((← field result "value") == scalar expected && (← field result "store") == machine.memory.json &&
+    (← number result "control_remaining") + prefixes.size - 1 == 1000 &&
+    (← number result "heap_remaining") == machine.memory.remaining) "replay result differs from independent execution"
+
+def inspectExecution (program prefixes result : Json) (expected : Nat) : IO Unit :=
+  inspectExecutionFrom program prefixes result expected {}
+
+def reclaimCopies (initial : Memory) (value : Json) (count : Nat) : IO Memory := do
+  need (count ≤ 32) "caller release count exceeded its bound"
+  let mut memory := initial
+  for _ in [:count] do memory ← release memory value
+  return memory
+
+end Ix.Compiler.Tools.BorrowCheck
diff --git a/Ix/Compiler/Tools/BorrowRuntimeCheck.lean b/Ix/Compiler/Tools/BorrowRuntimeCheck.lean
new file mode 100644
index 000000000..dd5847332
--- /dev/null
+++ b/Ix/Compiler/Tools/BorrowRuntimeCheck.lean
@@ -0,0 +1,230 @@
+import Ix.Compiler.Tools.BorrowExecution
+
+/-! Independent structural reconstruction and runtime-input replay for B2.
+This module imports no compiler, optimizer, ownership checker, evaluator,
+source generator, or semantic certificate. -/
+
+namespace Ix.Compiler.Tools.BorrowRuntimeCheck
+
+open Lean Ix.Compiler.Tools.Check Ix.Compiler.Tools.BorrowCheck
+
+def atomNat (n : Nat) : Json := tagged "lit" [("literal", tagged "nat" [("n", toJson n)])]
+
+def signature (borrow : Bool) : Json := obj [
+  ("params", toJson #[obj [("world", toJson "shared"), ("passing", toJson (if borrow then "borrowed" else "owned"))]]),
+  ("result", toJson "shared"), ("papSafe", toJson (!borrow))]
+
+def block (borrow : Bool) (instructions : Array Json) (terminator : Json) : Json := obj [
+  ("valueParams", toJson #[if borrow then borrowed else owned]), ("creditParams", toJson (#[] : Array Json)),
+  ("instructions", toJson instructions), ("terminator", terminator)]
+
+def ret (value : Json) : Json := tagged "ret" [("value", value)]
+def call (tag address : String) (args : Array Json) : Json := tagged tag [("function", toJson address), ("args", toJson args)]
+
+def forward (borrow : Bool) (address : String) : Json := obj [
+  ("signature", signature borrow), ("blocks", toJson #[block borrow #[] (call "tailCall" address #[reg 0])])]
+
+def twice (borrow : Bool) (address : String) : Json := obj [
+  ("signature", signature borrow), ("blocks", toJson #[block borrow #[
+    if borrow then tagged "move" [("value", reg 0)] else tagged "retainShared" [("target", reg 0)],
+    call "call" address #[reg 1], tagged "releaseShared" [("target", reg 2)]] (call "tailCall" address #[reg 0])])]
+
+def reader (schema : Json) (borrow : Bool) : IO Json := do
+  let zero ← field schema "zero"
+  let succ ← field schema "succ"
+  let releases := if borrow then #[] else #[tagged "releaseShared" [("target", reg 0)]]
+  let edge := fun (target : Nat) => obj [("target", toJson target), ("values", toJson #[reg 0]), ("credits", toJson (#[] : Array Json))]
+  let switch := tagged "switchValue" [("scrutinee", reg 0), ("natPeel", Json.null),
+    ("constructors", toJson #[obj [("cid", zero), ("edge", edge 1)], obj [("cid", succ), ("edge", edge 2)]])]
+  return obj [("signature", signature borrow), ("blocks", toJson #[
+    block borrow #[] switch,
+    block borrow releases (ret (atomNat (← number schema "zeroResult"))),
+    block borrow (#[tagged "fetch" [("target", reg 0), ("cid", succ), ("field", toJson (0 : Nat))]] ++ releases)
+      (ret (atomNat (← number schema "succResult")))])]
+
+def nullary (papSafe : Bool) (instructions : Array Json) (terminator : Json) : Json := obj [
+  ("signature", obj [("params", toJson (#[] : Array Json)), ("result", toJson "shared"), ("papSafe", toJson papSafe)]),
+  ("blocks", toJson #[obj [("valueParams", toJson (#[] : Array Json)), ("creditParams", toJson (#[] : Array Json)),
+    ("instructions", toJson instructions), ("terminator", terminator)]])]
+
+def callerAddress : String := String.join (List.replicate 32 "f0")
+
+def dynamicCaller (entry : String) : Json := obj [
+  ("signature", obj [("params", toJson #[obj [("world", toJson "shared"), ("passing", toJson "owned")]]),
+    ("result", toJson "shared"), ("papSafe", toJson false)]),
+  ("blocks", toJson #[block false #[call "papp" entry #[], tagged "apply" [("function", reg 1), ("args", toJson #[reg 0])]] (ret (reg 2))])]
+
+def withCaller (program : Json) (entry : String) : IO Json := do
+  let declarations ← arrField program "declarations"
+  for declaration in declarations do
+    need ((← BorrowCheck.entry declaration).1 != callerAddress) "caller adapter label collision"
+  replace program "declarations" (toJson (declarations.push (toJson #[toJson callerAddress,
+    tagged "fn" [("definition", dynamicCaller entry)]])))
+
+private def callee (definition : Json) : IO String := do
+  let blocks ← arrField definition "blocks"
+  let block ← present blocks[0]? "missing reader entry block"
+  let (tag, term) ← constructor (← field block "terminator")
+  need (tag == "tailCall") "expected a direct call-chain link"
+  strField term "function"
+
+def inspectGraph (row baseline rewritten : Json) : IO Unit := do
+  let depth ← number row "depth"
+  let schema ← field row "schema"
+  need ((← number schema "zeroResult") == 11 && (← number schema "succResult") == 22 &&
+    (← number (← field schema "zero") "cidx") == 0 && (← number (← field schema "succ") "cidx") == 1 &&
+    (← number (← field schema "zero") "indIdx") == 0 && (← number (← field schema "succ") "indIdx") == 0)
+    "runtime reader schema changed"
+  let entry ← strField row "entry"
+  let borrowedEntry ← strField row "borrowed_entry"
+  let factory ← strField row "factory"
+  let summaries ← arrField (← field row "inference") "summaries"
+  inspectRewrite baseline rewritten summaries
+  need ((← target summaries entry) == borrowedEntry && borrowedEntry != entry) "owned/borrowed export mapping mismatch"
+  let factoryDefinition := nullary true #[call "papp" entry #[]] (ret (reg 0))
+  let main := nullary false #[] (call "tailCall" factory #[])
+  need ((← function baseline factory) == factoryDefinition && (← function rewritten factory) == factoryDefinition &&
+    (← field baseline "main") == main && (← field rewritten "main") == main) "runtime owned PAP export changed"
+  let entryDefinition ← function baseline entry
+  let mut address ← callee entryDefinition
+  need (entryDefinition == twice false address) "runtime entry does not read its argument twice"
+  let expectedReader ← reader schema false
+  let mut covered := #[entry]
+  let mut links := 0
+  let mut finished := false
+  for _ in [:33] do
+    need (!covered.contains address) "cyclic borrowed dependency"
+    covered := covered.push address
+    let definition ← function baseline address
+    if definition == expectedReader then
+      finished := true
+      break
+    let next ← callee definition
+    need (definition == forward false next) "non-reader body in the runtime call chain"
+    address := next
+    links := links + 1
+  need (finished && links == depth && covered.size == depth + 2) "runtime chain depth mismatch"
+  let owners ← summaries.mapM (strField · "owner")
+  need (owners.size == covered.size && owners.all covered.contains && covered.all owners.contains)
+    "unproved or omitted borrowed summary"
+  let mut extras := 0
+  for declaration in ← arrField baseline "declarations" do
+    let (owner, definition) ← BorrowCheck.entry declaration
+    if !covered.contains owner && owner != factory then
+      need (definition == nullary true #[] (ret (toJson "erased"))) "unexpected source function outside the checked chain"
+      extras := extras + 1
+  need (extras == 1) "runtime source erased declaration inventory mismatch"
+  need ((← field row "baseline_size") == (← programSize baseline) &&
+    (← field row "borrowed_size") == (← programSize rewritten)) "runtime code growth report mismatch"
+  for (key, declarations, blocks, instructions) in [
+      ("baseline_size", depth + 4, depth + 7, 7),
+      ("borrowed_size", 2 * depth + 6, 2 * depth + 9, 2 * depth + 9)] do
+    let size ← field row key
+    need ((← number size "declarations") == declarations && (← number size "blocks") == blocks &&
+      (← number size "instructions") == instructions) "runtime wrapper/code-size formula changed"
+
+def scalarTree (value : Nat) : Json := tagged "scalar" [("value", toJson value)]
+def succTree (tail : Json) : Json := tagged "succ" [("tail", tail)]
+def nested : Nat → Json → Json
+  | 0, value => value
+  | count + 1, value => succTree (nested count value)
+def succArgument (payload : Json) : Json := tagged "succ" [("payload", payload)]
+
+def expectedInputs : Array (String × Json) := #[
+  ("zero", toJson "zero"), ("succ-0", succArgument (scalarTree 0)),
+  ("succ-1", succArgument (scalarTree 1)), ("succ-wide", succArgument (scalarTree (2 ^ 256 + 19))),
+  ("nested-zero-1", succArgument (toJson "zero")),
+  ("nested-zero-8", succArgument (nested 7 (toJson "zero"))),
+  ("nested-zero-32", succArgument (nested 31 (toJson "zero"))),
+  ("nested-scalar-17", succArgument (nested 16 (scalarTree 4096)))]
+
+structure Built where
+  memory : Memory
+  value : Json
+  scalarLeaves : Nat
+
+def appendCtor (memory : Memory) (cid : Json) (fields : Array Json) : Memory × Json :=
+  let index := memory.nodes.size
+  ({ memory with
+      nodes := memory.nodes.push (obj [("world", toJson "shared"), ("rc", toJson (1 : Nat)),
+        ("node", tagged "ctorN" [("cid", cid), ("fields", toJson fields)])])
+      allocs := memory.allocs + 1, peak := memory.allocs + 1 }, tagged "loc" [("l", toJson index)])
+
+def makeTree (schema : Json) : Nat → Json → IO Built
+  | 0, _ => throw (IO.userError "runtime input tree bound exceeded")
+  | fuel + 1, tree => do
+      if tree == toJson "zero" then
+        let (memory, value) := appendCtor {} (← field schema "zero") #[]
+        return ⟨memory, value, 0⟩
+      let (tag, data) ← constructor tree
+      if tag == "scalar" then return ⟨{}, scalar (← number data "value"), 1⟩
+      need (tag == "succ") "unknown runtime input tree"
+      let child ← makeTree schema fuel (← field data "tail")
+      let (memory, value) := appendCtor child.memory (← field schema "succ") #[child.value]
+      return ⟨memory, value, child.scalarLeaves⟩
+
+def makeArgument (schema argument : Json) : IO Built := do
+  if argument == toJson "zero" then makeTree schema 64 argument else do
+    let (tag, data) ← constructor argument
+    need (tag == "succ") "runtime root must be a constructor"
+    makeTree schema 64 (succTree (← field data "payload"))
+
+def inspectInput (row baseline rewritten observation : Json) (name : String) (argument : Json) : IO Unit := do
+  let schema ← field row "schema"
+  let built ← makeArgument schema argument
+  let nodes := built.memory.allocs
+  let successorCase := argument != toJson "zero"
+  let expected := if successorCase then 22 else 11
+  need ((← strField observation "name") == name && (← field observation "argument") == argument &&
+    (← field observation "input_store") == built.memory.json && (← field observation "input_value") == built.value &&
+    (← number observation "nodes") == nodes && (← number observation "number") == expected &&
+    (← number observation "ixon") == expected && (← number observation "raw_ixir0") == expected)
+    "runtime argument or source observation mismatch"
+  let paths ← arrField observation "paths"
+  need (paths.size == 2) "missing direct/PAP runtime comparison"
+  let depth ← number row "depth"
+  let entry ← strField row "entry"
+  for index in [:2] do
+    let dynamic := index == 1
+    let path := paths[index]!
+    need ((← strField path "kind") == (if dynamic then "dynamic" else "direct")) "runtime invocation kind changed"
+    let initial : Machine := { memory := built.memory, frame := { owner := if dynamic then callerAddress else entry, values := #[built.value] } }
+    for (label, program, extraRC, extraSteps, extraWork) in [
+        ("baseline", baseline, 2, 0, 2), ("borrowed", rewritten, 0, 1, 1)] do
+      let program ← if dynamic then withCaller program entry else pure program
+      let result ← field path label
+      inspectExecutionFrom program (← field path s!"{label}_prefixes") result expected initial
+      let store ← field result "store"
+      let heap ← field store "heap"
+      let allocations := nodes + (if dynamic then 1 else 0)
+      let steps := 2 * depth + 10 + (if successorCase then 2 else 0) + (if dynamic then 3 else 0) + extraSteps
+      let work := nodes + built.scalarLeaves + extraWork + (if dynamic then 1 else 0)
+      need ((← number heap "allocs") == allocations && (← number heap "frees") == allocations &&
+        (← number heap "rcops") == nodes + extraRC + (if dynamic then 1 else 0) &&
+        (← number store "peakLiveNodes") == allocations &&
+        (← number result "control_remaining") + steps == 1000 &&
+        (← number result "heap_remaining") + work == 1000) "runtime RC/heap/control contract drifted"
+
+def inspectLender (row rewritten lender : Json) : IO Unit := do
+  let argument := succArgument (nested 7 (toJson "zero"))
+  let built ← makeArgument (← field row "schema") argument
+  let (_, locationData) ← constructor built.value
+  let location ← number locationData "l"
+  let node ← built.memory.get location
+  let memory := { built.memory with nodes := built.memory.nodes.set! location (← replace node "rc" (toJson (3 : Nat))), rcops := 2 }
+  need ((← field lender "argument") == argument && (← number lender "owners") == 3 &&
+    (← field lender "input_store") == memory.json && (← field lender "input_value") == built.value)
+    "aliased caller input mismatch"
+  let result ← field lender "execution"
+  let prefixes ← field lender "prefixes"
+  inspectExecutionFrom rewritten prefixes result 22
+    { memory, frame := { owner := ← strField row "borrowed_entry", values := #[built.value] } } false
+  need ((← field result "store") == memory.json) "borrowed entry consumed its lender"
+  for row in ← array prefixes do need ((← field row "store") == memory.json) "borrowed prefix changed lender heap"
+  need ((← number result "control_remaining") + 2 * (← number row "depth") + 10 == 1000 &&
+    (← number result "heap_remaining") == 999) "borrowed entry execution cost changed"
+  let cleaned ← reclaimCopies { memory with remaining := 999 } built.value 3
+  need ((← field lender "cleanup_store") == cleaned.json && (← number lender "cleanup_remaining") == cleaned.remaining &&
+    cleaned.nodes.all (· == Json.null) && cleaned.frees == cleaned.allocs) "caller failed to reclaim its returned lender"
+
+end Ix.Compiler.Tools.BorrowRuntimeCheck
diff --git a/Ix/Compiler/Tools/CapturedScalarNativeCheck.lean b/Ix/Compiler/Tools/CapturedScalarNativeCheck.lean
new file mode 100644
index 000000000..8fbdaffb8
--- /dev/null
+++ b/Ix/Compiler/Tools/CapturedScalarNativeCheck.lean
@@ -0,0 +1,162 @@
+import Ix.Compiler.Tools.PhysicalScalarNativeCheck
+
+/-! Independent JSON, ELF and arithmetic checks. No source compiler,
+instruction selector, encoder or machine evaluator is imported. -/
+namespace Ix.Compiler.Tools.CapturedScalarNativeCheck
+open Lean Check UniqueCheck UpstreamNativeCheck
+
+def families : Array String := #["capture-project", "capture-choice", "capture-nested"]
+def tags : Array String := #["zero", "seven", "max"]
+def captures : Array Nat := #[0, 7, UInt64.size - 1]
+
+def expected (family : String) (capture argument : Nat) : Nat :=
+  if family == "capture-project" then capture
+  else if family == "capture-choice" then (if argument == 0 then capture else argument - 1)
+  else if argument < 3 then capture else argument - 3
+
+def reg (index : Nat) : Json := Json.mkObj [("reg", Json.mkObj [("id", toJson index)])]
+def owned : Json := Json.mkObj [("owned", Json.mkObj [("world", toJson "shared")])]
+def parameter : Json := Json.mkObj [("world", toJson "shared"), ("passing", toJson "owned")]
+
+def heap (freed rc live : Nat) : Json := Json.mkObj [
+  ("allocs", toJson (2 : Nat)), ("frees", toJson freed), ("rcops", toJson rc),
+  ("reuses", toJson (0 : Nat)), ("slots", toJson (2 : Nat)), ("live", toJson live)]
+
+/-- Independently inspect the fixture's closed initializer, including its
+literal helper and capture register. This is an artifact gate, not a proof. -/
+def exportAddress (program : Json) (capture : Nat) : Nat → Json → IO String
+  | 0, _ => throw (IO.userError "captured scalar initializer exceeds its depth")
+  | fuel + 1, definition => do
+    let signature ← field definition "signature"
+    need ((← arrField signature "params").isEmpty && (← strField signature "result") == "shared")
+      "captured scalar initializer signature changed"
+    let blocks ← arrField definition "blocks"
+    need (blocks.size == 1) "captured scalar initializer block count changed"
+    let block := blocks[0]!
+    need ((← arrField block "valueParams").isEmpty && (← arrField block "creditParams").isEmpty)
+      "captured scalar initializer capabilities changed"
+    let instructions ← arrField block "instructions"
+    let term ← field block "terminator"
+    if let .ok tail := term.getObjVal? "tailCall" then
+      need (instructions.isEmpty && (← arrField tail "args").isEmpty) "captured scalar initializer alias changed"
+      return ← exportAddress program capture fuel (← PhysicalScalarNativeCheck.declared program (← strField tail "function"))
+    else
+      need (instructions.size == 3 && (← field (← field term "ret") "value") == reg 2)
+        "captured scalar initializer result changed"
+      let first ← field instructions[0]! "papp"
+      need ((← arrField first "args").isEmpty) "captured scalar literal helper captures arguments"
+      let helper ← PhysicalScalarNativeCheck.declared program (← strField first "function")
+      let helperSig ← field helper "signature"
+      need ((← field helperSig "params") == toJson #[parameter] && (← strField helperSig "result") == "shared" &&
+        (← field helperSig "papSafe") == toJson true) "captured scalar literal helper signature changed"
+      let body ← arrField helper "blocks"
+      need (body.size == 1 && (← field body[0]! "valueParams") == toJson #[owned] &&
+        (← arrField body[0]! "creditParams").isEmpty &&
+        (← field body[0]! "instructions") == toJson #[Json.mkObj [("releaseShared", Json.mkObj [("target", reg 0)])]])
+        "captured scalar literal helper ownership changed"
+      let literal ← field (← field (← field (← field (← field body[0]! "terminator") "ret") "value") "lit") "literal"
+      need ((← number (← field literal "nat") "n") == capture) "captured scalar initializer literal disagrees"
+      let applied ← field instructions[1]! "apply"
+      need ((← field applied "function") == reg 0 && (← field applied "args") == toJson #[toJson "erased"])
+        "captured scalar initializer literal application changed"
+      let pap ← field instructions[2]! "papp"
+      need ((← field pap "args") == toJson #[reg 1]) "captured scalar initializer capture register changed"
+      let address ← strField pap "function"
+      let target ← PhysicalScalarNativeCheck.declared program address
+      let signature ← field target "signature"
+      need ((← field signature "papSafe") == toJson true && (← field signature "params") == toJson #[parameter, parameter] &&
+        (← strField signature "result") == "shared") "captured scalar target signature changed"
+      return address
+
+def inspect (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-native-captured-scalar/1" &&
+    (← strField snapshot "policy") == "physical-scalar-capture/1" && (← field snapshot "row") == row)
+    "captured scalar snapshot policy/row disagrees"
+  let family ← strField row "family"
+  let capture ← number row "capture"
+  need (families.contains family && captures.contains capture) "unknown captured scalar source family/capture"
+  need ((← number row "runtime_parameters") == 1 && (← number row "physical_parameters") == 2)
+    "captured scalar runtime arity disagrees"
+  let text ← byteField snapshot "text"
+  need (text.size == (← number row "text_bytes") && digest text == (← strField row "text_hash") &&
+    bytes.size == (← number row "object_bytes")) "captured scalar text hash/size disagrees"
+  let root ← strField row "ir1_root"
+  let entry ← strField row "physical_entry"
+  need (isHex 64 root && isHex 64 entry && isHex 64 (← strField row "source_root")) "captured scalar root invalid"
+  let provenance := "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ root ++ " 07 00 00 00 01 00 00 00")))
+  need ((← byteField snapshot "provenance") == provenance) "captured scalar provenance disagrees"
+  ScalarNativeCheck.inspectObject bytes text (← number snapshot "entry_offset") root 7
+  let source ← field snapshot "source_compilation"
+  need ((← strField (← field source "source") "root") == (← strField row "source_root") &&
+    (← strField (← field source "ixir1") "root") == root) "captured scalar source/IR binding disagrees"
+  let program ← field (← field source "ixir2_diagnostic") "program"
+  need ((← exportAddress program capture 32 (← field program "main")) == entry) "captured scalar export binding disagrees"
+  let initialized ← field snapshot "initializer"
+  need ((← number initialized "capture") == capture && (← number initialized "location") == 1 &&
+    (← field initialized "heap") == heap 1 1 1 && (← number initialized "peak_live") == 1 &&
+    (← number initialized "control_steps") == 8 && (← number initialized "heap_fuel") == 2)
+    "captured scalar initializer observation disagrees"
+  let entries ← arrField snapshot "selected_entries"
+  let selected ← number row "selected_functions"
+  let functions ← number row "functions"
+  need (entries.size == selected && functions == selected + 1 && entries.back? == some (toJson entry) &&
+    entries.toList.eraseDups.length == entries.size) "captured scalar selection map disagrees"
+  let mut blocks := 0
+  for address in entries do
+    let definition ← PhysicalScalarNativeCheck.declared program (← string address)
+    blocks := blocks + (← arrField definition "blocks").size
+  need (blocks == (← number row "physical_blocks")) "captured scalar selected block count disagrees"
+  let depth ← number row "stack_depth"
+  need (depth > 1 && depth ≤ 32 && depth == functions && (← number row "stack_bytes") == 272 * depth &&
+    (← number row "below_entry_bytes") == 272 * depth - 8) "captured scalar stack reservation disagrees"
+  let observations ← arrField snapshot "observations"
+  let m := UInt64.size - 1
+  let inputs : Array (Nat × Nat) := #[(0,0), (0,1), (1,0), (1,1), (2,3), (3,2), (7,7), (7,19), (19,7),
+    (0,m), (m,0), (m,1), (1,m), (m,m), (m-1,1), (m-1,2), (2,m-1), (m,m-1), (m-1,m)]
+  need (observations.size == inputs.size) "captured scalar input inventory disagrees"
+  for index in [:observations.size] do
+    let observation := observations[index]!
+    let a ← number observation "argument"
+    let b ← number observation "unused_rsi"
+    need ((a,b) == inputs[index]!) "captured scalar boundary input inventory disagrees"
+    need ((← field observation "source_arguments") == toJson #[a] &&
+      (← field observation "physical_arguments") == toJson #[capture, a]) "captured scalar application arguments disagree"
+    need ((← field observation "application_heap") == heap 2 2 0) "captured scalar application reclamation disagrees"
+    need ((← number observation "value") == expected family capture a && (← number observation "status") == 0 &&
+      (← number observation "byte_steps") > 0 && (← number observation "physical_control") > 0 &&
+      (← number observation "physical_heap_fuel") ≤ (← number observation "physical_control") &&
+      (← field observation "source_evaluated") == toJson true) "captured scalar arithmetic/source observation disagrees"
+
+def regressions (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  for (path, value, message) in [
+    (["policy"], toJson "unknown/1", "policy/row"),
+    (["text"], toJson "c3", "hash/size"),
+    (["entry_offset"], toJson (999999 : Nat), "export"),
+    (["source_compilation", "ixir1", "root"], toJson (String.ofList (List.replicate 64 '0')), "source/IR binding"),
+    (["selected_entries"], toJson ([] : List String), "selection map"),
+    (["initializer", "capture"], toJson (UInt64.size : Nat), "initializer observation"),
+    (["initializer", "heap", "frees"], toJson (0 : Nat), "initializer observation"),
+    (["source_compilation", "ixir2_diagnostic", "program", "main", "signature", "params"], toJson #[parameter], "initializer signature")
+  ] do
+    let changed ← replaceAt snapshot path value
+    rejects "captured snapshot corruption" message (inspect row changed bytes)
+  rejects "captured ELF byte" "ELF header" (inspect row snapshot (bytes.set! 0 0))
+  let changedRow ← replaceAt row ["runtime_parameters"] (toJson (2 : Nat))
+  let changed ← replaceAt snapshot ["row"] changedRow
+  rejects "captured runtime arity" "runtime arity" (inspect changedRow changed bytes)
+  let changedRow ← replaceAt row ["capture"] (toJson (if (← number row "capture") == 0 then 7 else 0 : Nat))
+  let changed ← replaceAt snapshot ["row"] changedRow
+  rejects "captured initializer literal" "initializer literal" (inspect changedRow changed bytes)
+  let observations ← arrField snapshot "observations"
+  for (path, value, message) in [
+    (["status"], toJson (1 : Nat), "arithmetic/source"),
+    (["source_arguments"], toJson ([] : List Nat), "application arguments"),
+    (["physical_arguments"], toJson ([1, 2] : List Nat), "application arguments"),
+    (["application_heap", "frees"], toJson (0 : Nat), "application reclamation")
+  ] do
+    let first ← replaceAt observations[0]! path value
+    let changed ← replaceAt snapshot ["observations"] (toJson (observations.set! 0 first))
+    rejects "captured application corruption" message (inspect row changed bytes)
+
+end Ix.Compiler.Tools.CapturedScalarNativeCheck
diff --git a/Ix/Compiler/Tools/Check.lean b/Ix/Compiler/Tools/Check.lean
new file mode 100644
index 000000000..7f42fb8d0
--- /dev/null
+++ b/Ix/Compiler/Tools/Check.lean
@@ -0,0 +1,118 @@
+import Lean
+
+/-! Shared IO for repository checks. Child processes receive argument arrays;
+no check constructs a shell command. Temporary outputs are removed on failure. -/
+
+namespace Ix.Compiler.Tools.Check
+
+open Lean System
+
+def need (condition : Bool) (message : String) : IO Unit :=
+  unless condition do throw (IO.userError message)
+
+def checked (value : Except String α) : IO α :=
+  match value with
+  | .ok value => pure value
+  | .error message => throw (IO.userError message)
+
+def present (value : Option α) (message : String) : IO α :=
+  match value with
+  | some value => pure value
+  | none => throw (IO.userError message)
+
+def run (command : String) (args : Array String := #[]) : IO String := do
+  let result ← IO.Process.output { cmd := command, args }
+  need (result.exitCode == 0)
+    s!"{command} exited {result.exitCode}\n{result.stdout}{result.stderr}"
+  return result.stdout
+
+def requireAll (output : String) (expected : List String) (label : String) : IO Unit := do
+  for item in expected do
+    need (output.contains item) s!"{label}: missing {repr item}\n{output}"
+
+def words (value : String) : List String :=
+  (value.splitToList Char.isWhitespace).filter (!·.isEmpty)
+
+def hexDigit (char : Char) : Option Nat :=
+  if '0' ≤ char && char ≤ '9' then some (char.toNat - '0'.toNat)
+  else if 'a' ≤ char && char ≤ 'f' then some (char.toNat - 'a'.toNat + 10)
+  else if 'A' ≤ char && char ≤ 'F' then some (char.toNat - 'A'.toNat + 10)
+  else none
+
+def isHex (length : Nat) (value : String) : Bool :=
+  value.length == length && value.toList.all (fun char =>
+    char.isDigit || ('a' ≤ char && char ≤ 'f'))
+
+def unhex (value : String) : Except String ByteArray := do
+  let chars := (value.toList.filter (!·.isWhitespace)).toArray
+  if chars.size % 2 != 0 then throw "hex input has odd length"
+  let mut bytes := ByteArray.empty
+  for index in [:chars.size / 2] do
+    let some high := hexDigit chars[index * 2]! | throw "invalid hex digit"
+    let some low := hexDigit chars[index * 2 + 1]! | throw "invalid hex digit"
+    bytes := bytes.push (UInt8.ofNat (16 * high + low))
+  return bytes
+
+def hexNat (value : Nat) : String := String.ofList (Nat.toDigits 16 value)
+
+def containsBytes (bytes part : ByteArray) : Bool :=
+  part.size ≤ bytes.size &&
+    (List.range (bytes.size - part.size + 1)).any fun index =>
+      bytes.extract index (index + part.size) == part
+
+def readJson (path : FilePath) : IO Json := do
+  checked (Json.parse (← IO.FS.readFile path))
+
+def field (value : Json) (key : String) : IO Json := checked (value.getObjVal? key)
+def string (value : Json) : IO String := checked value.getStr?
+def array (value : Json) : IO (Array Json) := checked value.getArr?
+def nat (value : Json) : IO Nat := checked value.getNat?
+def strField (value : Json) (key : String) : IO String := do string (← field value key)
+def arrField (value : Json) (key : String) : IO (Array Json) := do array (← field value key)
+
+def pairs (value : Json) : IO (List (String × Json)) := do
+  let object ← checked value.getObj?
+  return object.toList
+
+def option (args : List (String × String)) (name : String) (fallback : String) : String :=
+  (args.find? (·.1 == name)).map (·.2) |>.getD fallback
+
+def optional (args : List (String × String)) (name : String) : Option String :=
+  (args.find? (·.1 == name)).map (·.2)
+
+def parseArgs (allowed : List String) (args : List String)
+    (repeatable : List String := []) : Except String (List (String × String)) := do
+  let rec go (args : List String) (result : List (String × String)) := do
+    match args with
+    | [] => return result.reverse
+    | name :: value :: rest =>
+        if !allowed.contains name then throw s!"unknown option {name}"
+        if !repeatable.contains name && result.any (·.1 == name) then
+          throw s!"duplicate option {name}"
+        go rest ((name, value) :: result)
+    | [name] => throw s!"missing value for {name}"
+  go args []
+
+def cli (label : String) (action : IO Unit) : IO UInt32 := do
+  try
+    action
+    return 0
+  catch error =>
+    IO.eprintln s!"{label}: {error}"
+    return 1
+
+def sha256 (path : FilePath) : IO String := do
+  let output ← run "sha256sum" #["--", path.toString]
+  let digest := (words output).headD ""
+  need (isHex 64 digest) s!"invalid SHA-256 tool output for {path}"
+  return digest
+
+partial def files (root : FilePath) (skipHidden : Bool := false) : IO (List FilePath) := do
+  let mut result := []
+  for entry in ← root.readDir do
+    if skipHidden && entry.fileName.startsWith "." then continue
+    if ← entry.path.isDir then result := result ++ (← files entry.path skipHidden)
+    else result := entry.path :: result
+  return result.mergeSort (fun a b => a.toString ≤ b.toString)
+
+end Ix.Compiler.Tools.Check
diff --git a/Ix/Compiler/Tools/PhysicalScalarNativeCheck.lean b/Ix/Compiler/Tools/PhysicalScalarNativeCheck.lean
new file mode 100644
index 000000000..4d3d0f9a4
--- /dev/null
+++ b/Ix/Compiler/Tools/PhysicalScalarNativeCheck.lean
@@ -0,0 +1,134 @@
+import Ix.Compiler.Tools.ScalarNativeCheck
+
+/-! Independent artifact checks for physical scalar selection. This module
+imports no source compiler, selector, encoder, or machine evaluator. -/
+namespace Ix.Compiler.Tools.PhysicalScalarNativeCheck
+open Lean Check UniqueCheck UpstreamNativeCheck
+
+def names : Array String := #["project", "tag", "pred", "choose", "helpers", "nested", "unary-pred"]
+
+def expected (name : String) (a b : Nat) : Nat :=
+  if name == "project" then a
+  else if name == "tag" then (if a == 0 then 11 else 22)
+  else if name == "pred" || name == "unary-pred" then a - 1
+  else if name == "choose" then (if a == 0 then b else a - 1)
+  else if name == "helpers" then (if a < 2 then 11 else 22)
+  else if a < 3 then b else a - 3
+
+def declared (program : Json) (address : String) : IO Json := do
+  for declaration in (← arrField program "declarations") do
+    let pair ← array declaration
+    if pair.size == 2 && pair[0]! == toJson address then
+      return ← field (← field pair[1]! "fn") "definition"
+  throw (IO.userError "physical scalar selected declaration is missing")
+
+def exportAddress (program : Json) (arity : Nat) : Nat → Json → IO String
+  | 0, _ => throw (IO.userError "physical scalar module export exceeds its depth")
+  | fuel + 1, definition => do
+    let signature ← field definition "signature"
+    need ((← arrField signature "params").isEmpty) "physical scalar module export wrapper has arguments"
+    let blocks ← arrField definition "blocks"
+    need (blocks.size == 1) "physical scalar module export has extra blocks"
+    let block := blocks[0]!
+    need ((← arrField block "valueParams").isEmpty && (← arrField block "creditParams").isEmpty)
+      "physical scalar module export wrapper has capabilities"
+    let instructions ← arrField block "instructions"
+    let term ← field block "terminator"
+    if let .ok tail := term.getObjVal? "tailCall" then
+      need (instructions.isEmpty && (← arrField tail "args").isEmpty) "physical scalar module export alias changed"
+      return ← exportAddress program arity fuel (← declared program (← strField tail "function"))
+    else
+      need (instructions.size == 1 && (← strField signature "result") == "shared") "physical scalar module export closure changed"
+      let pap ← field instructions[0]! "papp"
+      need ((← arrField pap "args").isEmpty &&
+        (← number (← field (← field (← field term "ret") "value") "reg") "id") == 0)
+        "physical scalar module export captures values or returns another register"
+      let address ← strField pap "function"
+      let target ← declared program address
+      let signature ← field target "signature"
+      need ((← field signature "papSafe") == toJson true && (← arrField signature "params").size == arity)
+        "physical scalar module export target signature changed"
+      return address
+
+def inspect (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-native-physical-scalar/2" &&
+    (← strField snapshot "policy") == "physical-scalar-cfg/1" && (← field snapshot "row") == row)
+    "physical scalar snapshot policy/row disagrees"
+  let name ← strField row "name"
+  need (names.contains name) "unknown physical scalar source family"
+  let arity ← number row "runtime_parameters"
+  need (arity == if name == "unary-pred" then 1 else 2) "physical scalar runtime arity disagrees"
+  let text ← byteField snapshot "text"
+  need (text.size == (← number row "text_bytes") && digest text == (← strField row "text_hash") &&
+    bytes.size == (← number row "object_bytes")) "physical scalar text hash/size disagrees"
+  let root ← strField row "ir1_root"
+  let entry ← strField row "physical_entry"
+  need (isHex 64 root && isHex 64 entry && isHex 64 (← strField row "source_root")) "physical scalar root invalid"
+  let provenance := "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ root ++ " 06 00 00 00 01 00 00 00")))
+  need ((← byteField snapshot "provenance") == provenance) "physical scalar snapshot provenance disagrees"
+  ScalarNativeCheck.inspectObject bytes text (← number snapshot "entry_offset") root 6
+  let source ← field snapshot "source_compilation"
+  need ((← strField (← field source "source") "root") == (← strField row "source_root") &&
+    (← strField (← field source "ixir1") "root") == root) "physical scalar source/IR binding disagrees"
+  let program ← field (← field source "ixir2_diagnostic") "program"
+  need ((← exportAddress program arity 32 (← field program "main")) == entry) "physical scalar module export binding disagrees"
+  let entries ← arrField snapshot "selected_entries"
+  let functions ← number row "functions"
+  need (entries.size == functions && entries.back? == some (toJson entry) &&
+    entries.toList.eraseDups.length == entries.size) "physical scalar selection map disagrees"
+  let mut blocks := 0
+  for address in entries do
+    let definition ← declared program (← string address)
+    blocks := blocks + (← arrField definition "blocks").size
+  need (blocks == (← number row "physical_blocks")) "physical scalar selected block count disagrees"
+  let depth ← number row "stack_depth"
+  need (depth > 0 && depth ≤ 32 && depth == functions && (← number row "stack_bytes") == 272 * depth &&
+    (← number row "below_entry_bytes") == 272 * depth - 8) "physical scalar stack reservation disagrees"
+  let observations ← arrField snapshot "observations"
+  let m := UInt64.size - 1
+  let inputs : Array (Nat × Nat) := #[(0,0), (0,1), (1,0), (1,1), (2,3), (3,2), (7,7), (7,19), (19,7),
+    (0,m), (m,0), (m,1), (1,m), (m,m), (m-1,1), (m-1,2), (2,m-1), (m,m-1), (m-1,m)]
+  need (observations.size == inputs.size) "physical scalar input inventory disagrees"
+  for index in [:observations.size] do
+    let observation := observations[index]!
+    let a ← number observation "left"
+    let b ← number observation "right"
+    need ((a,b) == inputs[index]!) "physical scalar boundary input inventory disagrees"
+    let args : Array Nat := if arity == 1 then #[a] else #[a, b]
+    need ((← field observation "source_arguments") == toJson args) "physical scalar source application arguments disagree"
+    need ((← field observation "application_heap") == Json.mkObj [("allocs", toJson (1 : Nat)), ("frees", toJson (1 : Nat)),
+      ("rcops", toJson (1 : Nat)), ("reuses", toJson (0 : Nat)), ("slots", toJson (1 : Nat)), ("live", toJson (0 : Nat))])
+      "physical scalar source application reclamation disagrees"
+    need ((← number observation "value") == expected name a b && (← number observation "status") == 0 &&
+      (← number observation "byte_steps") > 0 && (← number observation "physical_control") > 0 &&
+      (← number observation "physical_heap_fuel") ≤ (← number observation "physical_control") &&
+      (← field observation "source_evaluated") == toJson true) "physical scalar arithmetic/source observation disagrees"
+
+def regressions (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  let changed ← replaceAt snapshot ["policy"] (toJson "unknown/1")
+  rejects "physical policy" "policy/row" (inspect row changed bytes)
+  let changed ← replaceAt snapshot ["text"] (toJson "c3")
+  rejects "physical text" "hash/size" (inspect row changed bytes)
+  let changed ← replaceAt snapshot ["entry_offset"] (toJson (999999 : Nat))
+  rejects "physical entry" "export" (inspect row changed bytes)
+  rejects "physical ELF byte" "ELF header" (inspect row snapshot (bytes.set! 0 0))
+  let observations ← arrField snapshot "observations"
+  let first ← replaceAt observations[0]! ["status"] (toJson (1 : Nat))
+  let changed ← replaceAt snapshot ["observations"] (toJson (observations.set! 0 first))
+  rejects "physical observation" "arithmetic/source" (inspect row changed bytes)
+  let changed ← replaceAt snapshot ["source_compilation", "ixir1", "root"] (toJson (String.ofList (List.replicate 64 '0')))
+  rejects "physical root" "source/IR binding" (inspect row changed bytes)
+  let changed ← replaceAt snapshot ["selected_entries"] (toJson ([] : List String))
+  rejects "physical selection map" "selection map" (inspect row changed bytes)
+  let changedRow ← replaceAt row ["runtime_parameters"] (toJson (3 : Nat))
+  let changed ← replaceAt snapshot ["row"] changedRow
+  rejects "physical runtime arity" "runtime arity" (inspect changedRow changed bytes)
+  let first ← replaceAt observations[0]! ["source_arguments"] (toJson ([] : List Nat))
+  let changed ← replaceAt snapshot ["observations"] (toJson (observations.set! 0 first))
+  rejects "physical application arguments" "application arguments" (inspect row changed bytes)
+  let first ← replaceAt observations[0]! ["application_heap", "frees"] (toJson (0 : Nat))
+  let changed ← replaceAt snapshot ["observations"] (toJson (observations.set! 0 first))
+  rejects "physical application reclamation" "application reclamation" (inspect row changed bytes)
+
+end Ix.Compiler.Tools.PhysicalScalarNativeCheck
diff --git a/Ix/Compiler/Tools/ScalarNativeCheck.lean b/Ix/Compiler/Tools/ScalarNativeCheck.lean
new file mode 100644
index 000000000..1b0b68867
--- /dev/null
+++ b/Ix/Compiler/Tools/ScalarNativeCheck.lean
@@ -0,0 +1,99 @@
+import Ix.Compiler.Tools.UpstreamNativeCheck
+
+/-! Independent scalar artifact and arithmetic checks. This module imports
+no source compiler, native selector, encoder, or machine evaluator. -/
+namespace Ix.Compiler.Tools.ScalarNativeCheck
+open Lean Check UniqueCheck UpstreamNativeCheck
+
+def expected (name : String) (a b : Nat) : Nat × Nat :=
+  let value :=
+    if name == "sub" then some (a - b)
+    else if name == "nested" && a == 0 then some 7
+    else if name == "nested" && a > b then some (a - b)
+    else if a + b ≥ UInt64.size then none
+    else if name == "helpers" || name == "diamond" then some (a + b - 1)
+    else some (a + b)
+  (value.getD 0, if value.isSome then 0 else 1)
+
+def inspectObject (bytes text : ByteArray) (entry : Nat) (root : String) (loweringVersion : UInt8 := 5) : IO Unit := do
+  need (bytes.size ≥ 64 && bytes.extract 0 7 == (← checked (unhex "7f 45 4c 46 02 01 01"))) "scalar ELF header disagrees"
+  need ((← readLE bytes 16 2) == 1 && (← readLE bytes 18 2) == 62 && (← readLE bytes 20 4) == 1 &&
+    (← readLE bytes 24 8) == 0 && (← readLE bytes 32 8) == 0 && (← readLE bytes 52 2) == 64 &&
+    (← readLE bytes 56 2) == 0 && (← readLE bytes 58 2) == 64 && (← readLE bytes 60 2) == 8 &&
+    (← readLE bytes 62 2) == 7) "scalar ELF structure disagrees"
+  let table ← readLE bytes 40 8
+  need (table + 8 * 64 == bytes.size) "scalar ELF table bounds disagree"
+  let sectionOffset := fun index => table + 64 * index
+  let payload (index : Nat) : IO ByteArray := do
+    slice bytes (← readLE bytes (sectionOffset index + 24) 8) (← readLE bytes (sectionOffset index + 32) 8)
+  need ((← payload 1) == text && (← readLE bytes (sectionOffset 1 + 4) 4) == 1 &&
+    (← readLE bytes (sectionOffset 1 + 8) 8) == 6) "scalar ELF text disagrees"
+  need ((← payload 2).isEmpty && (← payload 6).isEmpty && (← readLE bytes (sectionOffset 6 + 8) 8) == 0)
+    "scalar ELF relocation/stack policy disagrees"
+  let symbols ← payload 4
+  let strings ← payload 5
+  need (symbols.size == 72 && (← readLE bytes (sectionOffset 4 + 56) 8) == 24 &&
+    (← readLE bytes (sectionOffset 4 + 40) 4) == 5) "scalar ELF symbol table disagrees"
+  let nameOffset ← readLE symbols 48 4
+  need (strings.extract nameOffset (nameOffset + 19) == "compilatrix_scalar".toUTF8.push 0 &&
+    (← readLE symbols 52 1) == 18 && (← readLE symbols 53 1) == 0 && (← readLE symbols 54 2) == 1 &&
+    (← readLE symbols 56 8) == entry && (← readLE symbols 64 8) == text.size - entry)
+    "scalar ELF export disagrees"
+  let provenance := "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ root))) ++ ByteArray.mk #[loweringVersion, 0, 0, 0, 1, 0, 0, 0]
+  let note ← payload 3
+  need (containsBytes note provenance) "scalar ELF provenance disagrees"
+
+def inspect (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-native-scalar/1" &&
+    (← strField snapshot "policy") == "source-scalar-runtime/1" && (← field snapshot "row") == row)
+    "scalar snapshot policy/row disagrees"
+  let name ← strField row "name"
+  need (["add", "sub", "diamond", "helpers", "nested"].contains name) "unknown scalar source family"
+  let text ← byteField snapshot "text"
+  need (text.size == (← number row "text_bytes") && digest text == (← strField row "text_hash") &&
+    bytes.size == (← number row "object_bytes")) "scalar text hash/size disagrees"
+  let root ← strField row "ir1_root"
+  need (isHex 64 root && isHex 64 (← strField row "source_root")) "scalar source/IR root invalid"
+  let provenance := "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ root ++ " 05 00 00 00 01 00 00 00")))
+  need ((← byteField snapshot "provenance") == provenance) "scalar snapshot provenance disagrees"
+  inspectObject bytes text (← number snapshot "entry_offset") root
+  let depth ← number row "stack_depth"
+  need (depth > 0 && depth ≤ 32 && depth == (← number row "functions") &&
+    (← number row "stack_bytes") == 272 * depth && (← number row "below_entry_bytes") == 272 * depth - 8)
+    "scalar stack reservation disagrees"
+  let observations ← arrField snapshot "observations"
+  need (observations.size == 19) "scalar runtime observation inventory disagrees"
+  let m := UInt64.size - 1
+  let inputs : Array (Nat × Nat) := #[(0,0), (0,1), (1,0), (1,1), (2,3), (3,2), (7,7), (7,19), (19,7),
+    (0,m), (m,0), (m,1), (1,m), (m,m), (m-1,1), (m-1,2), (2,m-1), (m,m-1), (m-1,m)]
+  let mut sourceCount := 0
+  for index in [:observations.size] do
+    let observation := observations[index]!
+    let a ← number observation "left"
+    let b ← number observation "right"
+    need ((a, b) == inputs[index]!) "scalar boundary input inventory disagrees"
+    need (a < UInt64.size && b < UInt64.size) "scalar argument conversion overflow"
+    let (value, status) := expected name a b
+    need ((← number observation "value") == value && (← number observation "status") == status &&
+      (← number observation "byte_steps") > 0) "scalar arithmetic observation disagrees"
+    let sourceEvaluated := a < 32 && b < 32
+    need ((← field observation "source_evaluated") == toJson sourceEvaluated) "scalar source evaluation claim disagrees"
+    if sourceEvaluated then sourceCount := sourceCount + 1
+  need (sourceCount == 9) "scalar source evaluation count disagrees"
+
+def regressions (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  let changed ← replaceAt snapshot ["policy"] (toJson "unknown/1")
+  rejects "scalar policy" "policy/row" (inspect row changed bytes)
+  let changed ← replaceAt snapshot ["text"] (toJson "c3")
+  rejects "scalar text" "hash/size" (inspect row changed bytes)
+  let changed ← replaceAt snapshot ["entry_offset"] (toJson (999999 : Nat))
+  rejects "scalar entry" "export" (inspect row changed bytes)
+  rejects "scalar object byte" "ELF header" (inspect row snapshot (bytes.set! 0 0))
+  let observations ← arrField snapshot "observations"
+  let first ← replaceAt observations[0]! ["status"] (toJson (7 : Nat))
+  let changed ← replaceAt snapshot ["observations"] (toJson (observations.set! 0 first))
+  rejects "scalar observation" "arithmetic" (inspect row changed bytes)
+
+end Ix.Compiler.Tools.ScalarNativeCheck
diff --git a/Ix/Compiler/Tools/SourceScan.lean b/Ix/Compiler/Tools/SourceScan.lean
new file mode 100644
index 000000000..f1938959d
--- /dev/null
+++ b/Ix/Compiler/Tools/SourceScan.lean
@@ -0,0 +1,169 @@
+import Ix.Compiler.Tools.Check
+
+/-! A conservative lexer for the trust ledger's source inventory. It handles
+nested Lean comments and quoted literals, retains line locations, and rejects
+unterminated input. Inventory consumers reject syntax they cannot account for;
+this scanner is a tripwire, not a replacement for Lean's parser or axiom fence. -/
+
+namespace Ix.Compiler.Tools.SourceScan
+
+inductive Kind where
+  | name | literal | punctuation | quotedName
+  deriving BEq, Repr, Inhabited
+
+structure Token where
+  text : String
+  line : Nat
+  kind : Kind
+  deriving BEq, Repr, Inhabited
+
+private def nameStart (char : Char) : Bool :=
+  Lean.isIdFirst char
+
+private def namePart (char : Char) : Bool :=
+  Lean.isIdRest char || char == '.'
+
+def scan (input : String) (cSource : Bool := false) : Except String (Array Token) := do
+  let chars := input.toList.toArray
+  let mut tokens := #[]
+  let mut index := 0
+  let mut line := 1
+  while index < chars.size do
+    let char := chars[index]!
+    let next := chars[index + 1]?.getD '\x00'
+    if char.isWhitespace then
+      if char == '\n' then line := line + 1
+      index := index + 1
+    else if (cSource && char == '/' && next == '/') ||
+        (!cSource && char == '-' && next == '-') then
+      while index < chars.size && chars[index]! != '\n' do index := index + 1
+    else if char == '/' && next == (if cSource then '*' else '-') then
+      let mut depth := 1
+      index := index + 2
+      while index < chars.size && depth > 0 do
+        let first := chars[index]!
+        let second := chars[index + 1]?.getD '\x00'
+        if !cSource && first == '/' && second == '-' then
+          depth := depth + 1
+          index := index + 2
+        else if first == (if cSource then '*' else '-') && second == '/' then
+          depth := depth - 1
+          index := index + 2
+        else
+          if first == '\n' then line := line + 1
+          index := index + 1
+      if depth != 0 then throw s!"line {line}: unterminated block comment"
+    else if char == '"' || (char == '\'' &&
+        (cSource || next == '\\' || chars[index + 2]? == some '\'')) then
+      let startLine := line
+      let delimiter := char
+      let mut value := ""
+      let mut ended := false
+      index := index + 1
+      while index < chars.size && !ended do
+        let current := chars[index]!
+        if current == delimiter then
+          ended := true
+          index := index + 1
+        else if current == '\\' then
+          if index + 1 ≥ chars.size then throw s!"line {startLine}: dangling literal escape"
+          value := (value.push current).push chars[index + 1]!
+          index := index + 2
+        else
+          if current == '\n' then line := line + 1
+          value := value.push current
+          index := index + 1
+      if !ended then throw s!"line {startLine}: unterminated literal"
+      tokens := tokens.push ⟨value, startLine, .literal⟩
+    else if char == '«' then
+      let startLine := line
+      index := index + 1
+      let mut value := ""
+      while index < chars.size && chars[index]! != '»' do
+        if chars[index]! == '\n' then line := line + 1
+        value := value.push chars[index]!
+        index := index + 1
+      if index == chars.size then throw s!"line {startLine}: unterminated quoted name"
+      index := index + 1
+      tokens := tokens.push ⟨value, startLine, .quotedName⟩
+    else if nameStart char || char.isDigit || (char == '.' && nameStart next) then
+      let start := index
+      index := index + 1
+      while index < chars.size && namePart chars[index]! && chars[index]! != '«' do
+        index := index + 1
+      tokens := tokens.push ⟨String.ofList (chars.extract start index).toList, line, .name⟩
+    else
+      tokens := tokens.push ⟨String.singleton char, line, .punctuation⟩
+      index := index + 1
+  return tokens
+
+def imports (tokens : Array Token) : List String := Id.run do
+  let mut result := []
+  for index in [:tokens.size] do
+    if tokens[index]!.text == "import" && tokens[index]!.kind == .name then
+      if let some next := tokens[index + 1]? then
+        if next.kind == .name then result := next.text :: result
+  return result.reverse
+
+def hygiene (tokens : Array Token) : Except String Unit := do
+  for token in tokens do
+    if token.kind == .name && ["axiom", "sorry", "native_decide"].contains token.text then
+      throw s!"line {token.line}: {token.text} is not allowed in checked sources"
+
+private def modifier (name : String) : Bool :=
+  ["public", "protected", "private", "unsafe", "partial", "noncomputable", "meta"].contains name
+
+def externs (tokens : Array Token) : Except String (List (String × String)) := do
+  let mut declarations := []
+  for index in [:tokens.size] do
+    let token := tokens[index]!
+    if token.kind == .literal then continue
+    if (token.text == "@" || token.text == "attribute") &&
+        (tokens[index + 1]?.map (·.text)) == some "[" then
+      let mut finish := index + 2
+      while finish < tokens.size && tokens[finish]!.text != "]" do finish := finish + 1
+      if finish == tokens.size then throw s!"line {token.line}: unterminated attribute"
+      let attributes := tokens.extract (index + 2) finish
+      let positions := (List.range attributes.size).filter fun pos =>
+        attributes[pos]!.kind == .name && attributes[pos]!.text == "extern"
+      if positions.isEmpty then continue
+      if positions.length != 1 then throw s!"line {token.line}: ambiguous extern attributes"
+      let mut symbolAt := positions.head! + 1
+      if (attributes[symbolAt]?.map (fun t => t.text.toList.all Char.isDigit)).getD false then
+        symbolAt := symbolAt + 1
+      let some symbol := attributes[symbolAt]?
+        | throw s!"line {token.line}: extern has no explicit symbol"
+      if symbol.kind != .literal || symbol.text.isEmpty || symbol.text.contains '\\' then
+        throw s!"line {token.line}: extern needs an auditable explicit symbol string"
+      let mut after := finish + 1
+      if token.text == "@" then
+        while after < tokens.size && modifier tokens[after]!.text do after := after + 1
+        if !["opaque", "def"].contains (tokens[after]?.map (·.text) |>.getD "") then
+          throw s!"line {token.line}: unrecognized extern declaration form"
+        let some name := tokens[after + 1]? | throw s!"line {token.line}: missing extern declaration"
+        if name.kind != .name then throw s!"line {token.line}: unsupported extern name"
+        declarations := (symbol.text, name.text) :: declarations
+      else
+        let mut count := 0
+        while after < tokens.size && tokens[after]!.line == tokens[finish]!.line &&
+            tokens[after]!.kind == .name do
+          declarations := (symbol.text, tokens[after]!.text) :: declarations
+          count := count + 1
+          after := after + 1
+        if count == 0 then throw s!"line {token.line}: missing attribute-command names"
+  return declarations.reverse
+
+def cExports (tokens : Array Token) : Except String (List String) := do
+  let mut result := []
+  for index in [:tokens.size] do
+    if tokens[index]!.kind != .name || tokens[index]!.text != "LEAN_EXPORT" then continue
+    let mut after := index + 1
+    while after < tokens.size && !["(", ";", "{", "}"].contains tokens[after]!.text do
+      after := after + 1
+    if after == tokens.size || tokens[after]!.text != "(" || after == index + 1 ||
+        tokens[after - 1]!.kind != .name then
+      throw s!"line {tokens[index]!.line}: unsupported C export"
+    result := tokens[after - 1]!.text :: result
+  return result.reverse
+
+end Ix.Compiler.Tools.SourceScan
diff --git a/Ix/Compiler/Tools/TrustLedger.lean b/Ix/Compiler/Tools/TrustLedger.lean
new file mode 100644
index 000000000..6d91ba53e
--- /dev/null
+++ b/Ix/Compiler/Tools/TrustLedger.lean
@@ -0,0 +1,213 @@
+import Ix.Compiler.Tools.SourceScan
+import Ix.Compiler.Tools.TrustProfile
+import Lake.Toml.Load
+
+/-! Compiler-scoped native/source audit. The reviewed Lake section fixes its build
+inputs; the rest of the monorepo uses its own CI checks. No ledger is regenerated. -/
+
+namespace Ix.Compiler.Tools.TrustLedger
+open Lean System Check SourceScan TrustProfile
+
+private def sameSet [BEq α] [Repr α] (actual expected : List α) (label : String) : IO Unit :=
+  need (actual.all expected.contains && expected.all actual.contains)
+    s!"{label} drifted:\nexpected={repr expected}\nactual={repr actual}"
+
+private def tokenAt (tokens : Array Token) (index : Nat) : String :=
+  tokens[index]?.map (·.text) |>.getD ""
+
+private def assignment (tokens : Array Token) (key : String) : IO (Option (Array Token)) := do
+  let positions := (List.range tokens.size).filter fun index =>
+    tokens[index]!.kind == .name && tokens[index]!.text == key
+  need (positions.length ≤ 1) s!"duplicate Lake {key} field"
+  match positions with
+  | [] => return none
+  | index :: _ =>
+      need (tokenAt tokens (index + 1) == ":" && tokenAt tokens (index + 2) == "=")
+        s!"unsupported Lake {key} assignment"
+      return some (tokens.extract (index + 3) tokens.size)
+
+private def moduleName (token : Token) : Bool :=
+  token.kind == .name && !token.text.isEmpty &&
+    token.text.toList.all (fun char => char.isAlphanum || char == '_' || char == '.' || char == '\'')
+
+def lakeRoots (tokens : Array Token) : IO (List (String × String)) := do
+  let positions := (List.range tokens.size).filter fun index =>
+    tokens[index]!.kind == .name && ["lean_lib", "lean_exe"].contains tokens[index]!.text
+  need (!positions.isEmpty) "lakefile.lean declares no auditable Lean roots"
+  let mut roots := []
+  for position in [:positions.length] do
+    let index := positions[position]!
+    let finish := positions[position + 1]?.getD tokens.size
+    let some name := tokens[index + 1]? | throw (IO.userError "Lake target has no name")
+    need (name.kind == .name || name.kind == .quotedName) "unsupported Lake target name"
+    let body := tokens.extract (index + 2) finish
+    let sourceDir ← match ← assignment body "srcDir" with
+      | none => pure "."
+      | some value =>
+          need (value[0]?.map (·.kind) == some .literal && !(tokenAt value 0).isEmpty)
+            "unsupported Lake srcDir"
+          pure (tokenAt value 0)
+    need (!(FilePath.mk sourceDir).isAbsolute && !(sourceDir.splitOn "/").contains "..")
+      "Lake source root escapes project"
+    let single ← assignment body "root"
+    let multiple ← assignment body "roots"
+    need (!(single.isSome && multiple.isSome)) "Lake target declares both root and roots"
+    let modules ← match single, multiple with
+      | some value, none =>
+          need (tokenAt value 0 == String.singleton (Char.ofNat 96) &&
+            (value[1]?.map moduleName).getD false) "unsupported Lake root"
+          pure [tokenAt value 1]
+      | none, some value =>
+          need (tokenAt value 0 == "#" && tokenAt value 1 == "[") "unsupported Lake roots"
+          let mut index := 2
+          let mut modules := []
+          while tokenAt value index != "]" do
+            need (tokenAt value index == String.singleton (Char.ofNat 96) &&
+              (value[index + 1]?.map moduleName).getD false) "unsupported/empty Lake roots"
+            modules := tokenAt value (index + 1) :: modules
+            index := index + 2
+            if tokenAt value index == "," then index := index + 1
+            else need (tokenAt value index == "]") "unsupported Lake root separator"
+          need (!modules.isEmpty) "empty Lake roots"
+          pure modules.reverse
+      | none, none =>
+          need (moduleName name) "Lake target needs an explicit root"
+          pure [name.text]
+      | _, _ => throw (IO.userError "ambiguous Lake roots")
+    roots := roots ++ modules.map (sourceDir, ·)
+  return roots
+
+def leanSources (root : FilePath) (lake : Array Token) : IO (List FilePath) := do
+  let mut sources := []
+  for (directory, mod) in ← lakeRoots lake do
+    let path := root / directory / mod.replace "." "/"
+    let file := path.withExtension "lean"
+    let mut found := []
+    if ← file.pathExists then found := [file]
+    if ← path.isDir then
+      found := found ++ ((← files path).filter (·.extension == some "lean"))
+    need (!found.isEmpty) s!"Lake root {mod} has no Lean sources"
+    sources := sources ++ found
+  return sources.eraseDups.mergeSort (fun a b => a.toString ≤ b.toString)
+
+private def scanFile (path : FilePath) (cSource : Bool := false) : IO (Array Token) := do
+  checked ((scan (← IO.FS.readFile path) cSource).mapError (fun message => s!"{path}: {message}"))
+
+private def modulePath (root : FilePath) (mod : String) : FilePath :=
+  root / (mod.replace "." "/" ++ ".lean")
+
+private def pathModule (root path : FilePath) : IO String := do
+  let base := (← IO.FS.realPath root).toString ++ "/"
+  let path := (← IO.FS.realPath path).withExtension "" |>.toString
+  need (path.startsWith base) s!"source escapes project root: {path}"
+  return ((path.drop base.length).toString.replace "/" ".")
+
+private def symbolsOf (root : FilePath) (sources : List (FilePath × Array Token))
+    : IO (List (String × String × String)) := do
+  let mut symbols := []
+  for (path, tokens) in sources do
+    let mod ← pathModule root path
+    for (symbol, name) in ← checked ((externs tokens).mapError (fun e => s!"{path}: {e}")) do
+      symbols := (mod, if name.contains "." then name else mod ++ "." ++ name, symbol) :: symbols
+  return symbols
+
+private def tomlString (table : Lake.Toml.Table) (key : String) : IO String := do
+  let some (.string _ value) := table.find? key.toName | throw (IO.userError s!"Cargo missing string {key}")
+  return value
+
+private def cargoPackages (path : FilePath) : IO (List Lake.Toml.Table) := do
+  let input ← IO.FS.readFile path
+  let table ← match ← (Lake.Toml.loadToml (Parser.mkInputContext input path.toString)).toBaseIO with
+    | .ok table => pure table
+    | .error _ => throw (IO.userError s!"invalid Cargo TOML: {path}")
+  let some (.array _ entries) := table.find? "package".toName
+    | throw (IO.userError "Cargo TOML lacks package array")
+  entries.toList.mapM fun
+    | .table _ entry => pure entry
+    | _ => throw (IO.userError "Cargo package is not a table")
+
+def compilerSection (text : String) : IO String := do
+  let [_, rest] := text.splitOn "section Compiler\n"
+    | throw (IO.userError "expected exactly one Compiler Lake section")
+  let [body, _] := rest.splitOn "end Compiler\n"
+    | throw (IO.userError "expected exactly one Compiler Lake section end")
+  return body
+
+def textSha256 (text : String) : IO String := IO.FS.withTempFile fun handle path => do
+  handle.putStr text
+  handle.flush
+  sha256 path
+
+def compilerLake (root : FilePath) : IO (Array Token) := do
+  checked (scan (← compilerSection (← IO.FS.readFile (root / "lakefile.lean"))))
+
+private def under (root name : String) : Bool := name == root || name.startsWith (root ++ ".")
+
+private def validateImports (sources : List (FilePath × Array Token)) : IO Unit := do
+  let localRoots := ["Ix.Compiler", "Tests.Compiler", "Benchmarks.Compiler", "Lean", "Std", "Init", "Lake"]
+  let imported := sources.flatMap (fun source => imports source.2)
+  let external := imported.filter fun name => !localRoots.any (under · name)
+  sameSet external ["Blake3.Rust"] "external Lean imports"
+  for (mod, expected) in entrypoints do
+    let calls := sources.flatMap fun (_, tokens) => tokens.toList.filterMap fun token =>
+      if token.kind == .name && token.text.startsWith (mod ++ ".") then
+        some (mod ++ "." ++ ((token.text.drop (mod.length + 1)).toString.splitOn ".").headD "")
+      else none
+    sameSet calls expected s!"qualified uses of {mod}"
+
+def auditWith (profile : Profile) (root blake : FilePath) : IO Unit := do
+  let root ← IO.FS.realPath root
+  let blake ← IO.FS.realPath blake
+  let buildSection ← compilerSection (← IO.FS.readFile (root / "lakefile.lean"))
+  need ((← textSha256 buildSection) == profile.lakeSectionSha256) "Compiler Lake section hash drifted"
+  let lake ← checked (scan buildSection)
+  let paths ← leanSources root lake
+  let sources ← paths.mapM fun path => return (path, ← scanFile path)
+  for (path, tokens) in sources do
+    checked ((hygiene tokens).mapError (fun error => s!"{path}: {error}"))
+  validateImports sources
+  sameSet (← symbolsOf root sources) projectSymbols "project extern inventory"
+  let native := "native/compiler/hpt_cache_sync.c"
+  let cFiles := lake.toList.filterMap fun token =>
+    if token.kind == .literal && token.text.endsWith ".c" then some token.text else none
+  sameSet cFiles [native] "project foreign-source inventory"
+  need ((← sha256 (root / native)) == profile.durableSha256) "foreign source hash drifted"
+  sameSet (← checked (cExports (← scanFile (root / native) true)))
+    (projectSymbols.map (·.2.2)) "durability C export inventory"
+  let packageFiles := (← files blake true).filter (·.extension == some "lean")
+  let packageSources ← packageFiles.mapM fun path => return (path, ← scanFile path)
+  sameSet (← symbolsOf blake packageSources) dependencySymbols "Blake3 package-tree extern inventory"
+  let imported := sources.flatMap (fun source => imports source.2)
+  need (imported.contains "Blake3.Rust" && !imported.contains "Blake3.C" &&
+    imported.contains "Ix.Compiler.DurableSync") "native import reachability drifted"
+  let manifest ← readJson (root / "lake-manifest.json")
+  let packages ← (← arrField manifest "packages").filterM fun entry =>
+    return (← strField entry "name") == "Blake3"
+  need (packages.size == 1) "missing/duplicate Blake3 Lake dependency"
+  need ((← strField packages[0]! "rev") == profile.blakeRevision) "Blake3 Lake revision drifted"
+  let nodes ← field (← readJson (root / "flake.lock")) "nodes"
+  for (node, revision) in [("blake3-lean", profile.blakeRevision), ("blake3", profile.blakeUpstreamRevision)] do
+    need ((← strField (← field (← field nodes node) "locked") "rev") == revision)
+      s!"{node} flake revision drifted"
+  need ((← IO.FS.readFile (root / "lean-toolchain")).trimAscii.toString == profile.leanVersion)
+    "Lean seed version drifted"
+  let cargo := blake / "rust/Cargo.lock"
+  need ((← sha256 cargo) == profile.cargoSha256) "Cargo lockfile hash drifted"
+  let records ← cargoPackages cargo
+  let inventory ← records.mapM fun record => return (← tomlString record "name", ← tomlString record "version")
+  need (inventory.eraseDups.length == inventory.length) "duplicate Cargo package identity"
+  need (inventory.contains ("blake3", profile.blakeVersion)) "BLAKE3 crate version drifted"
+  let mut ffiSources := []
+  for record in records do
+    if (← tomlString record "name") == "lean-ffi" then
+      ffiSources := (← tomlString record "source") :: ffiSources
+  need (ffiSources.length == 1 && ffiSources.all (·.endsWith ("#" ++ profile.leanFfiRevision)))
+    "lean-ffi Cargo revision drifted"
+  IO.println s!"compiler trust audit OK: {sources.length} Lean files, 2 native interfaces, 14 symbols, {inventory.length} Cargo packages; reviewed component build and seed pins"
+
+def audit (root : FilePath) (overrides : List (String × String)) : IO Unit := do
+  let root ← IO.FS.realPath root
+  need (overrides.all (·.1 == "Blake3")) "unknown dependency override"
+  auditWith reviewed root (option overrides "Blake3" (root / ".lake/packages/Blake3").toString)
+
+end Ix.Compiler.Tools.TrustLedger
diff --git a/Ix/Compiler/Tools/TrustProfile.lean b/Ix/Compiler/Tools/TrustProfile.lean
new file mode 100644
index 000000000..009e4d4e0
--- /dev/null
+++ b/Ix/Compiler/Tools/TrustProfile.lean
@@ -0,0 +1,45 @@
+/-! Reviewed native inputs for the compiler component. Changes to these values
+require review of the corresponding implementation, symbols, and proof boundary.
+See `docs/compiler/trusted-extern-ledger.md` for assumptions and scope. -/
+
+namespace Ix.Compiler.Tools.TrustProfile
+
+structure Profile where
+  leanVersion : String
+  blakeRevision : String
+  blakeUpstreamRevision : String
+  blakeVersion : String
+  leanFfiRevision : String
+  cargoSha256 : String
+  durableSha256 : String
+  lakeSectionSha256 : String
+  deriving Repr
+
+def reviewed : Profile := {
+  leanVersion := "leanprover/lean4:v4.33.1"
+  blakeRevision := "78f5bc4b22de1172af8a5d91e7039128084fad3a"
+  blakeUpstreamRevision := "f3149ec5bb5449af877ba20377a11008ff499fa2"
+  blakeVersion := "1.8.7"
+  leanFfiRevision := "93c7e52952ae94546be08313f4ff3922984c84d5"
+  cargoSha256 := "4ebb14071ab64d7913f299e243630b4b4f8aebd55db1a68d3b8a7ce1251778ea"
+  durableSha256 := "f44c087cf80b2f5499ac1e25c0bb63be0f1e0687bc49a941c6b0ace8b03248f5"
+  lakeSectionSha256 := "9a38d159118f4736947238d1fb0656f2af7c6e4a7bab28644ad73aec64a6c781"
+}
+
+def projectSymbols : List (String × String × String) := [
+  ("Ix.Compiler.DurableSync", "Ix.Compiler.DurableSync.file", "compilatrix_durable_sync_file"),
+  ("Ix.Compiler.DurableSync", "Ix.Compiler.DurableSync.directory", "compilatrix_durable_sync_directory")]
+
+def dependencySymbols : List (String × String × String) :=
+  [ ("Blake3.Rust", "rs_blake3"), ("Blake3.C", "c_blake3") ].flatMap fun (mod, symbolPrefix) =>
+    [("internalVersion", "version"), ("hasherInit", "init"),
+      ("hasherInitKeyed", "init_keyed"), ("hasherInitDeriveKey", "init_derive_key"),
+      ("hasherUpdate", "hasher_update"), ("hasherFinalize", "hasher_finalize")].map
+      fun (name, suffix) => (mod, mod ++ "." ++ name, symbolPrefix ++ "_" ++ suffix)
+
+def entrypoints : List (String × List String) := [
+  ("Blake3.Rust", ["Blake3.Rust.hash"]),
+  ("Blake3.C", []),
+  ("Ix.Compiler.DurableSync", ["Ix.Compiler.DurableSync.file", "Ix.Compiler.DurableSync.directory"])]
+
+end Ix.Compiler.Tools.TrustProfile
diff --git a/Ix/Compiler/Tools/UniqueCheck.lean b/Ix/Compiler/Tools/UniqueCheck.lean
new file mode 100644
index 000000000..1c6223f12
--- /dev/null
+++ b/Ix/Compiler/Tools/UniqueCheck.lean
@@ -0,0 +1,236 @@
+import Ix.Compiler.Tools.Check
+import Blake3.Rust
+
+/-! Independent artifact and resource checker. Only the shared CLI helpers
+and the existing hash primitive are imported; compiler and evaluator modules
+are absent. Canonical mode, graph, source, and policy preimages are rebuilt
+from the exported fields before comparing two fresh compiler processes. -/
+
+open Lean System Ix.Compiler.Tools.Check
+
+namespace Ix.Compiler.Tools.UniqueCheck
+
+
+def number (value : Json) (key : String) : IO Nat := do nat (← field value key)
+def bytes (value : Json) : IO ByteArray := do checked (unhex (← string value))
+def byteField (value : Json) (key : String) : IO ByteArray := do bytes (← field value key)
+def tag (value : Nat) : ByteArray := ByteArray.mk #[value.toUInt8]
+def uleb (value : Nat) : ByteArray :=
+  if value < 128 then tag value else tag (128 + value % 128) ++ uleb (value / 128)
+termination_by value
+decreasing_by apply Nat.div_lt_self <;> omega
+def blob (value : ByteArray) : ByteArray := uleb value.size ++ value
+def vector (values : Array ByteArray) : ByteArray := uleb values.size ++ values.foldl (· ++ ·) ByteArray.empty
+def digest (value : ByteArray) : String :=
+  (Blake3.Rust.hash value).val.data.foldl (fun output byte =>
+    output ++ (if byte.toNat < 16 then "0" else "") ++ hexNat byte.toNat) ""
+
+def hashField (value : Json) (payload key label : String) : IO Unit := do
+  need (digest (← byteField value payload) == (← strField value key)) s!"{label}: hash disagreement"
+
+private def mode (value : Json) : IO ByteArray := do
+  match ← string value with
+  | "unique" => return tag 0
+  | "shared" => return tag 1
+  | _ => throw (IO.userError "unknown recursor world")
+
+private def inspectInstance (value : Json) (arguments : List String) : IO Unit := do
+  need ((← field value "arguments") == toJson arguments &&
+    (← field value "fields") == toJson ([[], ["unique", "unique"]] : List (List String)) &&
+    (← strField value "result") == "unique" && (← field value "well_shaped") == toJson true)
+    "recursor world vector disagreement"
+  let args ← (← arrField value "arguments").mapM mode
+  let fields ← (← arrField value "fields").mapM fun row => do return vector (← (← array row).mapM mode)
+  let expected := "compilatrix/ixir0/recursor-instance/1\x00".toUTF8 ++ blob (← byteField value "declaration") ++
+    vector args ++ vector fields ++ (← mode (← field value "result"))
+  need (expected == (← byteField value "bytes")) "recursor canonical preimage disagreement"
+  hashField value "bytes" "identity" "recursor"
+
+def inspectList (schema heap root : Json) (expected : Array Json) : IO Unit := do
+  let nodes ← arrField heap "nodes"
+  let mut current := root
+  let mut visited : List Nat := []
+  for index in [:expected.size + 1] do
+    let location ← number (← field current "loc") "l"
+    need (location < nodes.size && !visited.contains location) "unique list pointer is invalid or cyclic"
+    visited := location :: visited
+    let box := nodes[location]!
+    need ((← strField box "world") == "unique" && (← number box "rc") == 1) "unique list box has the wrong ownership"
+    let ctor ← field (← field box "node") "ctorN"
+    let identity ← field ctor "cid"
+    let isCons := index < expected.size
+    need ((← number identity "indIdx") == 0 && (← number identity "cidx") == (if isCons then 1 else 0) &&
+      (← field identity "block") == (← field schema (if isCons then "cons" else "nil"))) "unique list constructor identity disagreement"
+    let fields ← arrField ctor "fields"
+    need (fields.size == (if isCons then 2 else 0)) "unique list field arity disagreement"
+    if isCons then
+      let value ← field (← field (← field fields[0]! "lit") "l") "nat"
+      need ((← field value "n") == expected[index]!) "unique list payload disagreement"
+      current := fields[1]!
+  need (visited.length == nodes.countP (· != Json.null)) "unique result does not own every live node"
+
+def inspectSnapshot (row snapshot : Json) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-unique-reuse-case/1" &&
+    (← field snapshot "summary") == row) "unique snapshot/report disagreement"
+  let input ← arrField row "input"
+  let count := input.size
+  need ((← field row "value") == Json.arr input.reverse) "source reversal disagreement"
+  let optimized := (← field row "optimized") == toJson true
+  let reused := if optimized then count else 0
+  let source ← field snapshot "source"
+  need ((← field source "root") == (← field row "source_root") &&
+    (← field source "identity") == (← field row "source_identity")) "source identity disagreement"
+  let constants ← arrField source "constants"
+  need (constants.size == 8) "source inventory disagreement"
+  let constantBytes ← constants.mapM fun entry => do
+    hashField entry "bytes" "key" "Ixon constant"
+    return (← byteField entry "key") ++ blob (← byteField entry "bytes")
+  let refs ← (← arrField source "entry_refs").mapM bytes
+  let univs ← (← arrField source "entry_univs").mapM fun value => do return blob (← bytes value)
+  let sourceBytes := "compilatrix/closed-ixon-input/1\x00".toUTF8 ++ vector constantBytes ++ vector refs ++ vector univs ++
+    blob (← byteField source "entry")
+  need (sourceBytes == (← byteField source "input_bytes")) "source canonical preimage disagreement"
+  hashField source "input_bytes" "identity" "source"
+  let specialization ← field snapshot "specialization"
+  need ((← strField specialization "policy") == "unique-reverse-specialize/1") "specialization policy disagreement"
+  let original ← field specialization "source_instance"
+  let direct ← field specialization "direct_instance"
+  inspectInstance original ["shared", "unique", "unique"]
+  inspectInstance direct ["unique", "unique"]
+  need ((← field original "identity") == (← field row "source_instance") &&
+    (← field direct "identity") == (← field row "specialized_instance")) "instance identity disagreement"
+  let ir0 ← field snapshot "ixir0"
+  for name in ["raw", "raw_main", "declarations", "main", "groups", "blocks", "address_map"] do
+    need ((← field ir0 name) != Json.null) s!"missing IxIR0 artifact: {name}"
+  let graph ← field snapshot "ixir1"
+  need ((← field graph "root") == (← field row "ixir1_root")) "IxIR1 graph identity disagreement"
+  let artifacts ← arrField graph "artifacts"
+  need (artifacts.size == 1) "consuming graph has an unexpected artifact inventory"
+  let artifactBytes ← artifacts.mapM fun artifact => do
+    need ((← strField artifact "kind") == "ordinary") "consuming function has no canonical ordinary address"
+    hashField artifact "preimage" "root" "IxIR1 declaration"
+    return tag 1 ++ (← byteField artifact "root") ++ blob (← byteField artifact "preimage")
+  let graphBytes := "compilatrix/ixir1/optimizer-graph/1\x00".toUTF8 ++ vector artifactBytes ++ blob (← byteField graph "main")
+  need (digest graphBytes == (← strField graph "root")) "IxIR1 graph preimage disagreement"
+  let provenance ← field snapshot "provenance"
+  for (key, expected) in [("kind", "ixir1-plus-policy"), ("usage", "recursor-modes/1"),
+      ("lowering", "consuming-unique-recursor/1"), ("reuse", "static-unique-reuse/1"), ("execution", "call-local/0")] do
+    need ((← strField provenance key) == expected) s!"unique provenance policy disagreement: {key}"
+  need ((← field provenance "identity") == (← field row "provenance") &&
+    (← number provenance "outcome") == (if optimized then 2 else 1)) "unique provenance outcome disagreement"
+  let target ← field snapshot "ixir2_diagnostic"
+  let limits ← field target "limits"
+  let limitValues ← ["maxDeclarations", "maxBlocks", "maxBlocksPerFunction", "maxInstructionsPerBlock", "maxValueParams",
+    "maxCreditParams", "maxOperands", "maxAlternatives", "maxValueRegisters", "maxCreditRegisters", "maxScalarLeafFacts",
+    "maxFlowWork"].toArray.mapM fun key => do return uleb (← number limits key)
+  let policyBytes := "compilatrix/unique-reuse-provenance/1\x00".toUTF8 ++
+    (← byteField source "identity") ++ (← byteField graph "root") ++ (← byteField original "identity") ++
+    (← byteField direct "identity") ++ uleb (← number provenance "check_fuel") ++ uleb (← number provenance "erase_fuel") ++
+    vector limitValues ++ blob "recursor-modes/1".toUTF8 ++ blob "unique-reverse-specialize/1".toUTF8 ++
+    blob "consuming-unique-recursor/1".toUTF8 ++ blob "static-unique-reuse/1".toUTF8 ++
+    blob "call-local/0".toUTF8 ++ uleb (if optimized then 2 else 1)
+  need (policyBytes == (← byteField provenance "bytes")) "policy canonical preimage disagreement"
+  hashField provenance "bytes" "identity" "provenance"
+  for key in ["baseline", "selected", "baseline_stats", "selected_stats", "schemas"] do
+    need ((← field target key) != Json.null) s!"missing target artifact: {key}"
+  if !optimized then need ((← field target "baseline") == (← field target "selected")) "checked fallback changed its program"
+  let observations ← field snapshot "observations"
+  for stage in ["ixir1", "baseline_logical", "baseline_physical", "selected_logical", "selected_physical"] do
+    let observed ← field observations stage
+    need ((← field observed "value") == (← field row "value")) s!"{stage}: value disagreement"
+    let physical := stage == "selected_physical"
+    let saved := if physical then reused else 0
+    for phase in ["store", "reclaimed"] do
+      let store ← field observed phase
+      let heap ← if stage == "ixir1" then pure store else field store "heap"
+      if phase == "store" then
+        inspectList (← field (← field specialization "plan") "schema") heap (← field observed "result") (← arrField row "value")
+      let live := (← arrField heap "nodes").countP (· != Json.null)
+      need ((← number heap "rcops") == 0) s!"{stage}/{phase}: RC work in unique path"
+      need ((← number heap "allocs") + saved == 2 * count + 2 && (← number heap "reuses") == saved)
+        s!"{stage}/{phase}: FIP allocation disagreement"
+      need (live + (← number heap "frees") == (← number heap "allocs")) s!"{stage}/{phase}: allocation balance"
+      need (live == (if phase == "store" then count + 1 else 0)) s!"{stage}/{phase}: incomplete reclamation or wrong live count"
+      if stage != "ixir1" then
+        need ((← number store "peakLiveNodes") == count + 2) s!"{stage}/{phase}: peak disagreement"
+        need ((← number store "reusedPayloadUnits") == 2 * saved) s!"{stage}/{phase}: payload disagreement"
+        for key in ["resetAttempts", "hotResets", "coldResets"] do
+          need ((← number store key) == 0) s!"{stage}/{phase}: shared reset in unique path"
+    if stage != "ixir1" then
+      let cost := (if stage.startsWith "selected" && optimized then 5 else 6) * count + 7
+      need ((← number observed "control_remaining") + cost == 10000 &&
+        (← number observed "heap_remaining") == 0 && (← number observed "reclamation_remaining") == 0)
+        s!"{stage}: independent budget disagreement"
+  for (stage, key) in [("baseline_physical", "baseline"), ("selected_logical", "logical"), ("selected_physical", "physical")] do
+    let store ← field (← field observations stage) "store"
+    let heap ← field store "heap"
+    let counters ← field row key
+    for name in ["allocs", "frees", "reuses", "rcops"] do
+      need ((← field heap name) == (← field counters name)) "summary heap counters disagree"
+    for name in ["peakLiveNodes", "reusedPayloadUnits", "resetAttempts", "hotResets", "coldResets"] do
+      need ((← field store name) == (← field counters name)) "summary observation counters disagree"
+  let prefixes ← arrField snapshot "prefixes"
+  need (prefixes.size == (if optimized then 5 else 6) * count + 8 && prefixes.size == (← number row "prefixes"))
+    "prefix inventory disagreement"
+  for index in [:prefixes.size] do
+    let state := prefixes[index]!
+    need ((← number state "step") == index) "prefix sequence gap"
+    let owners ← (← arrField state "owners").toList.mapM nat
+    let emptySlots ← (← arrField state "empty_slots").toList.mapM nat
+    need (owners.eraseDups.length == owners.length) "duplicate reservation owner"
+    need (owners.all emptySlots.contains) "reservation aliases a live slot"
+    let counters ← field state "counters"
+    let live ← number state "live"
+    need (live + (← number counters "frees") + owners.length == (← number counters "allocs")) "prefix allocation balance"
+    need ((← number counters "rcops") == 0) "prefix RC disagreement"
+    need (live ≤ (← number counters "peakLiveNodes") && (← number counters "peakLiveNodes") ≤ count + 2) "prefix peak disagreement"
+  need ((← field prefixes.back! "counters") == (← field row "physical")) "prefix terminal counters disagree"
+
+def replaceAt (value : Json) (path : List String) (replacement : Json) : IO Json := do
+  match path with
+  | [] => return replacement
+  | key :: rest =>
+      let entries ← pairs value
+      let changed ← replaceAt (← field value key) rest replacement
+      return Json.mkObj (entries.map fun (name, old) => (name, if name == key then changed else old))
+
+def rejects (label fragment : String) (action : IO Unit) : IO Unit := do
+  let error ← try action; pure none catch error => pure (some error.toString)
+  let some error := error | throw (IO.userError s!"{label}: checker accepted corruption")
+  need (error.contains fragment) s!"{label}: wrong rejection: {error}"
+
+def regressionChecks (row snapshot : Json) : IO Unit := do
+  for phase in ["store", "reclaimed"] do
+    let changed ← replaceAt snapshot ["observations", "selected_physical", phase, "heap", "rcops"] (toJson (1 : Nat))
+    rejects "RC corruption" "RC work in unique path" (inspectSnapshot row changed)
+    let changed ← replaceAt snapshot ["observations", "selected_physical", phase, "peakLiveNodes"] (toJson (6 : Nat))
+    rejects "peak corruption" "peak disagreement" (inspectSnapshot row changed)
+  let changed ← replaceAt snapshot ["specialization", "source_instance", "arguments"] (toJson ["shared", "unique", "shared"])
+  rejects "mode corruption" "world vector disagreement" (inspectSnapshot row changed)
+  let changed ← replaceAt snapshot ["provenance", "execution"] (toJson "suspended-direct-calls/1")
+  rejects "policy corruption" "provenance policy disagreement" (inspectSnapshot row changed)
+  let changed ← replaceAt snapshot ["provenance", "bytes"] (toJson "00")
+  rejects "preimage corruption" "policy canonical preimage disagreement" (inspectSnapshot row changed)
+  let changed ← replaceAt snapshot ["ixir1", "main"] (toJson "00")
+  rejects "main corruption" "graph preimage disagreement" (inspectSnapshot row changed)
+  let nodes ← arrField (← field (← field (← field (← field snapshot "observations") "selected_physical") "store") "heap") "nodes"
+  let some live := nodes.findIdx? (· != Json.null) | throw (IO.userError "no live regression node")
+  for (name, path, replacement, fragment) in [
+      ("shared result corruption", ["world"], toJson "shared", "unique list box has the wrong ownership"),
+      ("constructor corruption", ["node", "ctorN", "cid", "block"], toJson "wrong", "constructor identity disagreement")] do
+    let changedNode ← replaceAt nodes[live]! path replacement
+    let changed ← replaceAt snapshot ["observations", "selected_physical", "store", "heap", "nodes"]
+      (Json.arr (nodes.set! live changedNode))
+    rejects name fragment (inspectSnapshot row changed)
+  let prefixes ← arrField snapshot "prefixes"
+  let some index := prefixes.findIdx? (fun row => (row.getObjVal? "owners" |>.bind Json.getArr?).toOption.any (!·.isEmpty))
+    | throw (IO.userError "regression case has no reservation")
+  let state := prefixes[index]!
+  let changedState ← replaceAt state ["owners"] (toJson ([0, 0] : List Nat))
+  let changed ← replaceAt snapshot ["prefixes"] (Json.arr (prefixes.set! index changedState))
+  rejects "duplicate owner corruption" "duplicate reservation owner" (inspectSnapshot row changed)
+  let changedState ← replaceAt state ["empty_slots"] (toJson ([] : List Nat))
+  let changed ← replaceAt snapshot ["prefixes"] (Json.arr (prefixes.set! index changedState))
+  rejects "live reservation corruption" "reservation aliases a live slot" (inspectSnapshot row changed)
+
+end Ix.Compiler.Tools.UniqueCheck
diff --git a/Ix/Compiler/Tools/UpstreamNativeCheck.lean b/Ix/Compiler/Tools/UpstreamNativeCheck.lean
new file mode 100644
index 000000000..8334f383a
--- /dev/null
+++ b/Ix/Compiler/Tools/UpstreamNativeCheck.lean
@@ -0,0 +1,340 @@
+import Ix.Compiler.Tools.UniqueCheck
+import Ix.Compiler.Tools.X86Check
+
+/-! Independent inspection of the residual expression, its complete machine
+text, source/physical observations, and native ABI results. No compiler,
+selector, encoder, ELF writer, or machine evaluator is imported. -/
+namespace Ix.Compiler.Tools.UpstreamNativeCheck
+open Lean System Check UniqueCheck X86Check
+
+def little (count value : Nat) : ByteArray :=
+  ByteArray.mk ((List.range count).toArray.map fun index => (value / 2^(8 * index) % 256).toUInt8)
+
+def expressionLength : Nat → Json → IO Nat
+  | 0, _ => throw (IO.userError "residual expression exceeds checker budget")
+  | fuel + 1, expression => do
+    match ← strField expression "op" with
+    | "argument" => return 3
+    | "constant" =>
+        need ((← number expression "value") < UInt64.size) "residual constant exceeds Word"
+        return 10
+    | "successor" => return (← expressionLength fuel (← field expression "value")) + 7
+    | "call" => return (← expressionLength fuel (← field expression "value")) + 10
+    | _ => throw (IO.userError "unknown residual operation")
+
+def expressionBytes (offsets : Array Nat) (current : Nat) : Nat → Json → Nat → IO ByteArray
+  | 0, _, _ => throw (IO.userError "residual expression exceeds checker budget")
+  | fuel + 1, expression, position => do
+    match ← strField expression "op" with
+    | "argument" => return ← checked (unhex "48 89 f8")
+    | "constant" =>
+        let value ← number expression "value"
+        need (value < UInt64.size) "residual constant exceeds Word"
+        return (← checked (unhex "48 b8")) ++ little 8 value
+    | "successor" => return (← expressionBytes offsets current fuel (← field expression "value") position) ++
+        (← checked (unhex "48 81 c0 01 00 00 00"))
+    | "call" =>
+        let callee ← number expression "function"
+        need (callee < current && callee < offsets.size) "residual call is recursive or out of range"
+        let headBytes ← expressionBytes offsets current fuel (← field expression "value") position
+        let delta : Int := (offsets[callee]! : Int) - (position + headBytes.size + 9 : Nat)
+        need (-(2^31 : Int) ≤ delta && delta < 2^31) "residual call displacement out of range"
+        return headBytes ++ (← checked (unhex "48 89 c7 55 e8")) ++ little 4 (delta % (2^32)).toNat ++ (← checked (unhex "5d"))
+    | _ => throw (IO.userError "unknown residual operation")
+
+def expressionValue (functions : Array Json) : Nat → Json → Nat → IO Nat
+  | 0, _, _ => throw (IO.userError "residual evaluation exceeds checker budget")
+  | fuel + 1, expression, argument => do
+    let result ← match ← strField expression "op" with
+      | "argument" => pure argument
+      | "constant" => number expression "value"
+      | "successor" => return (← expressionValue functions fuel (← field expression "value") argument) + 1
+      | "call" => do
+          let target ← number expression "function"
+          need (target < functions.size) "residual evaluation call out of range"
+          expressionValue functions fuel (← field functions[target]! "body")
+            (← expressionValue functions fuel (← field expression "value") argument)
+      | _ => throw (IO.userError "unknown residual operation")
+    need (result < UInt64.size) "residual arithmetic overflows Word"
+    return result
+
+/-- Executed instruction/call counts and maximum simultaneous call depth.
+Successors can run more than once, so these cannot be inferred from the result. -/
+def expressionCost (functions : Array Json) : Nat → Json → IO (Nat × Nat × Nat)
+  | 0, _ => throw (IO.userError "residual cost exceeds checker budget")
+  | fuel + 1, expression => do
+    match ← strField expression "op" with
+    | "argument" | "constant" => return (1, 0, 0)
+    | "successor" =>
+        let (steps, calls, depth) ← expressionCost functions fuel (← field expression "value")
+        return (steps + 1, calls, depth)
+    | "call" =>
+        let target ← number expression "function"
+        need (target < functions.size) "residual cost call out of range"
+        let (inputSteps, inputCalls, inputDepth) ← expressionCost functions fuel (← field expression "value")
+        let (bodySteps, bodyCalls, bodyDepth) ← expressionCost functions fuel (← field functions[target]! "body")
+        return (inputSteps + 4 + bodySteps + 1, inputCalls + 1 + bodyCalls, max inputDepth (bodyDepth + 1))
+    | _ => throw (IO.userError "unknown residual operation")
+
+def policyProvenance (root : String) (version : Nat := 4) : IO ByteArray := do
+  return "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ root))) ++ little 4 version ++ little 4 1
+
+def readLE (bytes : ByteArray) (offset count : Nat) : IO Nat := do
+  need (offset + count ≤ bytes.size) "upstream ELF field out of bounds"
+  return (List.range count).foldl (fun value index => value + bytes[offset + index]!.toNat * 2^(8 * index)) 0
+
+def slice (bytes : ByteArray) (offset size : Nat) : IO ByteArray := do
+  need (offset + size ≤ bytes.size) "upstream ELF section out of bounds"
+  return bytes.extract offset (offset + size)
+
+def inspectELFBytes (bytes text : ByteArray) (entry : Nat) (root : String) (version : Nat := 4) : IO Unit := do
+  need (bytes.size ≥ 64 && bytes.extract 0 7 == (← checked (unhex "7f 45 4c 46 02 01 01"))) "upstream ELF header disagrees"
+  need ((← readLE bytes 16 2) == 1 && (← readLE bytes 18 2) == 62 && (← readLE bytes 20 4) == 1 &&
+    (← readLE bytes 24 8) == 0 && (← readLE bytes 32 8) == 0 && (← readLE bytes 52 2) == 64 &&
+    (← readLE bytes 56 2) == 0 && (← readLE bytes 58 2) == 64 && (← readLE bytes 60 2) == 8 &&
+    (← readLE bytes 62 2) == 7) "upstream ELF structural header disagrees"
+  let table ← readLE bytes 40 8
+  need (table + 8 * 64 == bytes.size) "upstream ELF section table bounds disagree"
+  let sectionOffset := fun index => table + 64 * index
+  let payload (index : Nat) : IO ByteArray := do
+    slice bytes (← readLE bytes (sectionOffset index + 24) 8) (← readLE bytes (sectionOffset index + 32) 8)
+  let names ← payload 7
+  let stringAt := fun (strings : ByteArray) offset => do
+    need (offset < strings.size) "upstream ELF string out of bounds"
+    let tail := strings.extract offset strings.size
+    let length := tail.data.toList.takeWhile (· != 0) |>.length
+    need (length < tail.size) "upstream ELF string is unterminated"
+    present (String.fromUTF8? (tail.extract 0 length)) "upstream ELF string is not UTF-8"
+  for (index, name) in [(1, ".text"), (2, ".rela.text"), (3, ".note.compilatrix"), (4, ".symtab"),
+      (5, ".strtab"), (6, ".note.GNU-stack"), (7, ".shstrtab")] do
+    need ((← stringAt names (← readLE bytes (sectionOffset index) 4)) == name) "upstream ELF section name disagrees"
+  need ((← payload 1) == text && (← readLE bytes (sectionOffset 1 + 4) 4) == 1 &&
+    (← readLE bytes (sectionOffset 1 + 8) 8) == 6) "upstream ELF executable text disagrees"
+  need ((← payload 2).isEmpty && (← payload 6).isEmpty && (← readLE bytes (sectionOffset 6 + 8) 8) == 0)
+    "upstream ELF relocations or stack policy disagree"
+  let symbols ← payload 4
+  let strings ← payload 5
+  need (symbols.size == 72 && (← readLE bytes (sectionOffset 4 + 56) 8) == 24 &&
+    (← readLE bytes (sectionOffset 4 + 40) 4) == 5) "upstream ELF symbol table disagrees"
+  need ((← stringAt strings (← readLE symbols 48 4)) == "compilatrix_main" &&
+    (← readLE symbols 52 1) == 18 && (← readLE symbols 53 1) == 0 && (← readLE symbols 54 2) == 1 &&
+    (← readLE symbols 56 8) == entry && (← readLE symbols 64 8) == text.size - entry)
+    "upstream ELF exported entry disagrees"
+  let note ← payload 3
+  need (containsBytes note (← policyProvenance root version)) "upstream ELF provenance disagrees"
+
+private def register (index : Nat) : Json :=
+  Json.mkObj [("reg", Json.mkObj [("id", toJson index)])]
+
+private def operation (name : String) (fields : List (String × Json)) : Json :=
+  Json.mkObj [(name, Json.mkObj fields)]
+
+private def physicalBlock (program : Json) (origin : String) (arity : Nat) : IO Json := do
+  let declarations ← arrField program "declarations"
+  let matching ← declarations.filterM fun declaration => do return (← array declaration)[0]? == some (toJson origin)
+  need (matching.size == 1) "capture transport declaration identity disagrees"
+  let declaration ← array matching[0]!
+  let definition ← field (← field declaration[1]! "fn") "definition"
+  let signature ← field definition "signature"
+  let owned := Json.mkObj [("world", toJson "shared"), ("passing", toJson "owned")]
+  need ((← field signature "params") == toJson (Array.replicate arity owned) &&
+      (← strField signature "result") == "shared" && (← field signature "papSafe") == toJson true)
+    "capture transport physical signature disagrees"
+  let blocks ← arrField definition "blocks"
+  need (blocks.size == 1 && (← arrField blocks[0]! "creditParams").isEmpty &&
+      (← field blocks[0]! "valueParams") == toJson (Array.replicate arity
+        (operation "owned" [("world", toJson "shared")]))) "capture transport physical block disagrees"
+  return blocks[0]!
+
+/-- Independently tie this upstream fixture's residual capture to the actual
+physical initializer, PAP target, application order, and returned parameter.
+The selector accepts a wider fragment; this oracle checks the reviewed fixture. -/
+def inspectCapture (snapshot : Json) (functions : Array Json) : IO Unit := do
+  let native ← field snapshot "native"
+  let schema ← field native "schema"
+  let program ← field (← field (← field snapshot "compilation") "ixir2_diagnostic") "program"
+  let capturedOrigin ← strField functions[0]! "origin"
+  let twiceOrigin ← strField functions[1]! "origin"
+  let initializerOrigin ← strField functions[2]! "origin"
+  let captured ← physicalBlock program capturedOrigin 2
+  let twice ← physicalBlock program twiceOrigin 2
+  let initializer ← physicalBlock program initializerOrigin 0
+  let call := fun function args => operation "tailCall" [("function", toJson function), ("args", toJson args)]
+  let ret := fun index => operation "ret" [("value", register index)]
+  need ((← field captured "instructions") == toJson #[operation "releaseShared" [("target", register 1)]] &&
+      (← field captured "terminator") == ret 0) "capture transport physical parameter order disagrees"
+  let apply := fun closure argument => operation "apply" [("function", register closure), ("args", toJson #[register argument])]
+  need ((← field twice "instructions") == toJson #[operation "retainShared" [("target", register 0)], apply 0 1, apply 2 3] &&
+      (← field twice "terminator") == ret 4) "capture transport physical applications disagree"
+  let alloc := fun cid args => operation "alloc" [("world", toJson "shared"), ("cid", cid), ("args", toJson args)]
+  need ((← field initializer "instructions") == toJson #[
+      alloc (← field schema "zero") (#[] : Array Json),
+      alloc (← field schema "succ") #[register 0], alloc (← field schema "succ") #[register 1],
+      operation "papp" [("function", toJson capturedOrigin), ("args", toJson #[register 2])],
+      alloc (← field schema "zero") (#[] : Array Json)] &&
+      (← field initializer "terminator") == call twiceOrigin #[register 3, register 4])
+    "capture transport physical initializer disagrees"
+  let main ← field program "main"
+  let mainBlocks ← arrField main "blocks"
+  need (mainBlocks.size == 1 && (← arrField mainBlocks[0]! "instructions").isEmpty &&
+      (← field mainBlocks[0]! "terminator") == call initializerOrigin (#[] : Array Json))
+    "capture transport physical main disagrees"
+  let zero := Json.mkObj [("op", toJson "constant"), ("value", toJson (0 : Nat))]
+  let successor := fun value => Json.mkObj [("op", toJson "successor"), ("value", value)]
+  let capture := successor (successor zero)
+  let natParam := Json.mkObj [("kind", toJson "nat")]
+  let staticParam := Json.mkObj [("kind", toJson "static-nat"), ("value", capture)]
+  let closureParam := Json.mkObj [("kind", toJson "known-static-capture-pap"),
+    ("function", toJson capturedOrigin), ("capture", capture)]
+  need ((← field functions[0]! "parameters") == toJson #[staticParam, natParam] &&
+      (← field functions[1]! "parameters") == toJson #[closureParam, natParam] &&
+      (← arrField functions[2]! "parameters").isEmpty)
+    "capture transport residual parameters disagree"
+  let residualCall := fun (index : Nat) value =>
+    Json.mkObj [("op", toJson "call"), ("function", toJson index), ("value", value)]
+  need ((← field functions[0]! "body") == capture &&
+      (← field functions[1]! "body") == residualCall 0 (residualCall 0 (Json.mkObj [("op", toJson "argument")])) &&
+      (← field functions[2]! "body") == residualCall 1 zero &&
+      (← field functions[3]! "body") == residualCall 2 zero) "capture transport residual expressions disagree"
+
+def inspect (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  let native ← field snapshot "native"
+  let selector ← strField native "selector"
+  let captured := selector == "closed-static-capture-nat-calls/1"
+  let version := if captured then 8 else 4
+  need ((← strField native "format") == "compilatrix/upstream-native/1" &&
+    (captured || selector == "closed-unary-nat-calls/1") &&
+    (← number native "runtime_arguments") == 0 && (← field native "word_exact") == toJson true)
+    "upstream native selection domain disagrees"
+  need ((← number native "lowering_version") == version && (← number native "pass_policy_version") == 1 &&
+    (← strField native "symbol") == "compilatrix_main" &&
+    (← strField row "optimization_policy") == "baseline-ixir2; " ++ selector) "upstream native policy disagrees"
+  let expected ← number (← field row "observation") "nat"
+  need ((← number native "value") == expected) "upstream native source value disagrees"
+  let residual ← field native "residual"
+  let functions ← arrField residual "functions"
+  let entry ← number residual "entry"
+  need (functions.size == 4 && entry == 3) "upstream native function inventory disagrees"
+  if captured then inspectCapture snapshot functions
+  let mut offsets := #[]
+  let mut position := 0
+  for function in functions do
+    offsets := offsets.push position
+    position := position + (← expressionLength 1024 (← field function "body")) + 1
+  let mut text := ByteArray.empty
+  for index in [:functions.size] do
+    let function := functions[index]!
+    let parameters ← arrField function "parameters"
+    if !captured then
+      for parameter in parameters do
+        need (["nat", "known-capture-free-pap", "erased"].contains (← strField parameter "kind"))
+          "capture-free parameter domain disagrees"
+    need ((parameters.filter fun parameter => (parameter.getObjValAs? String "kind").toOption == some "nat").size ≤ 1)
+      "upstream native residual has multiple Nat arguments"
+    if index == entry then
+      need ((← field function "origin") == Json.null && parameters.isEmpty) "upstream native main is open"
+    else
+      need (isHex 64 (← strField function "origin")) "upstream native origin is missing"
+    text := text ++ (← expressionBytes offsets index 1024 (← field function "body") offsets[index]!) ++ little 1 0xc3
+  need ((← field native "block_offsets") == toJson offsets && (← number native "text_bytes") == text.size &&
+    (← byteField native "text") == text) "upstream native complete text or CALL layout disagrees"
+  need ((← expressionValue functions 1024 (← field functions[entry]! "body") 0) == expected)
+    "upstream residual result disagrees"
+  need ((← byteField native "object") == bytes && (← number native "object_bytes") == bytes.size &&
+    (← strField native "object_identity") == digest bytes) "upstream native object bytes disagree"
+  inspectELFBytes bytes text offsets[entry]! (← strField row "ir1_root") version
+  let physical ← field (← field snapshot "observations") "physical_ixir2"
+  need ((← field native "physical_store") == (← field physical "store") &&
+    (← field native "physical_value") == (← field physical "value") &&
+    (← field native "reclaimed_store") == (← field physical "reclaimed")) "upstream native physical certificate disagrees"
+  let reclaimed ← field (← field native "reclaimed_store") "heap"
+  need ((← arrField reclaimed "nodes").all (· == Json.null) &&
+    (← field reclaimed "allocs") == (← field reclaimed "frees")) "upstream native baseline reclamation disagrees"
+  let heap ← field native "native_heap"
+  for counter in ["allocs", "frees", "rcops"] do need ((← number heap counter) == 0) "unboxed native kernel allocated"
+  need ((← number heap "result_bytes") == 8) "native Word result size disagrees"
+  let executions ← arrField native "executions"
+  need (executions.size == 4) "upstream native execution inventory disagrees"
+  let (steps, calls, depth) ← expressionCost functions 1024 (← field functions[entry]! "body")
+  for execution in executions do
+    need ((← number execution "value") == expected && (← number execution "direct_calls") == calls &&
+      (← number execution "stack_written_bytes") == 16 * depth && (← number execution "stack_capacity_bytes") == 64 &&
+      (← number execution "typed_steps") == steps + 1 && (← number execution "byte_steps") == steps + 1)
+      "upstream native computation or stack observation disagrees"
+    for flag in ["saved_registers_preserved", "stack_restored_before_ret", "call_trace_certified", "object_entry_certified"] do
+      need ((← field execution flag) == toJson true) s!"upstream native {flag} failed"
+  let fallbacks ← arrField native "fallbacks_and_rejections"
+  let budgetNames := #["zero-depth", "zero-functions", "zero-instructions"] ++
+    (if captured then #["zero-capture-fuel"] else #[])
+  let baselineNames := budgetNames ++ (if captured then #["capture-free-policy"] else #[])
+  need ((← fallbacks.mapM (strField · "name")) == baselineNames ++ #["misaligned-stack", "insufficient-stack"])
+    "upstream native fallback inventory disagrees"
+  for index in [:fallbacks.size] do
+    let path := if index < baselineNames.size then "checked-baseline-ixir2" else "no-native-execution-certificate"
+    let reason := if index < budgetNames.size then "budget" else if index < baselineNames.size then "capturedPap" else "execution-condition"
+    need ((← strField fallbacks[index]! "path") == path && (← strField fallbacks[index]! "reason") == reason)
+      "native fallback path or reason disagrees"
+
+def regressions (row snapshot : Json) (bytes : ByteArray) : IO Unit := do
+  for (name, path, replacement, fragment) in [
+      ("Word bound", ["native", "word_exact"], toJson false, "selection domain"),
+      ("policy", ["native", "lowering_version"], toJson (1 : Nat), "native policy"),
+      ("source value", ["native", "value"], toJson (99 : Nat), "source value"),
+      ("text", ["native", "text"], toJson "c3", "complete text"),
+      ("entry", ["native", "residual", "entry"], toJson (0 : Nat), "function inventory"),
+      ("calls", ["native", "block_offsets"], toJson [0, 0, 0, 0], "CALL layout"),
+      ("object", ["native", "object"], toJson "00", "object bytes"),
+      ("reclamation", ["native", "reclaimed_store"], Json.null, "physical certificate"),
+      ("fallbacks", ["native", "fallbacks_and_rejections"], toJson ([] : List Json), "fallback inventory")] do
+    rejects name fragment (inspect row (← replaceAt snapshot path replacement) bytes)
+  rejects "truncated object" "object bytes" (inspect row snapshot (bytes.extract 0 (bytes.size - 1)))
+  let native ← field snapshot "native"
+  let executions ← arrField native "executions"
+  let badSteps ← replaceAt executions[0]! ["typed_steps"] (toJson (28 : Nat))
+  rejects "executed capture cost" "computation or stack" (inspect row
+    (← replaceAt snapshot ["native", "executions"] (toJson (executions.set! 0 badSteps))) bytes)
+  if (← strField native "selector") != "closed-static-capture-nat-calls/1" then return
+  let functions ← arrField (← field native "residual") "functions"
+  let staticParams ← arrField functions[0]! "parameters"
+  let closureParams ← arrField functions[1]! "parameters"
+  let constant := Json.mkObj [("op", toJson "constant"), ("value", toJson (2 : Nat))]
+  let wrongCapture ← replaceAt staticParams[0]! ["value"] constant
+  let wrongClosure ← replaceAt closureParams[0]! ["capture"] constant
+  let wrongTarget ← replaceAt closureParams[0]! ["function"] (← field functions[1]! "origin")
+  for (name, index, path, replacement, fragment) in [
+      ("capture expression", 0, ["parameters"], toJson (staticParams.set! 0 wrongCapture), "residual parameters"),
+      ("capture parameter order", 0, ["parameters"], toJson #[staticParams[1]!, staticParams[0]!], "residual parameters"),
+      ("closure capture key", 1, ["parameters"], toJson (closureParams.set! 0 wrongClosure), "residual parameters"),
+      ("closure target", 1, ["parameters"], toJson (closureParams.set! 0 wrongTarget), "residual parameters"),
+      ("folded capture body", 0, ["body"], constant, "residual expressions")] do
+    let function ← replaceAt functions[index]! path replacement
+    let changed ← replaceAt snapshot ["native", "residual", "functions"] (toJson (functions.set! index function))
+    rejects name fragment (inspect row changed bytes)
+  let program ← field (← field (← field snapshot "compilation") "ixir2_diagnostic") "program"
+  let declarations ← arrField program "declarations"
+  let initializer ← physicalBlock program (← strField functions[2]! "origin") 0
+  let instructions ← arrField initializer "instructions"
+  let wrongPap ← replaceAt instructions[3]! ["papp", "args"] (toJson #[register 1])
+  for (name, origin, blockPath, replacement, fragment) in [
+      ("physical capture return", 0, ["terminator", "ret", "value"], register 1, "physical parameter order"),
+      ("physical capture initializer", 2, ["instructions"], toJson ([] : List Json), "physical initializer"),
+      ("physical PAP capture", 2, ["instructions"], toJson (instructions.set! 3 wrongPap), "physical initializer"),
+      ("physical PAP safety", 0, [], Json.null, "physical signature")] do
+    let target ← field functions[origin]! "origin"
+    let mut changedDeclarations := declarations
+    for index in [:declarations.size] do
+      let declaration ← array declarations[index]!
+      if declaration[0]! != target then continue
+      let definition ← field (← field declaration[1]! "fn") "definition"
+      let changedDefinition ← if blockPath.isEmpty then replaceAt definition ["signature", "papSafe"] (toJson false)
+        else do
+          let blocks ← arrField definition "blocks"
+          let block ← replaceAt blocks[0]! blockPath replacement
+          replaceAt definition ["blocks"] (toJson (blocks.set! 0 block))
+      let changed ← replaceAt declaration[1]! ["fn", "definition"] changedDefinition
+      changedDeclarations := changedDeclarations.set! index (toJson (declaration.set! 1 changed))
+    let changed ← replaceAt snapshot ["compilation", "ixir2_diagnostic", "program", "declarations"] (toJson changedDeclarations)
+    rejects name fragment (inspect row changed bytes)
+
+end Ix.Compiler.Tools.UpstreamNativeCheck
diff --git a/Ix/Compiler/Tools/X86Check.lean b/Ix/Compiler/Tools/X86Check.lean
new file mode 100644
index 000000000..fa8c9d362
--- /dev/null
+++ b/Ix/Compiler/Tools/X86Check.lean
@@ -0,0 +1,50 @@
+import Ix.Compiler.Tools.Check
+
+/-! External ELF and native execution checks shared by the repository gates.
+These checks intentionally do not import the compiler, encoder, or ELF writer. -/
+
+namespace Ix.Compiler.Tools.X86Check
+
+open System Check
+
+def inspectElf (readelf : String) (path : FilePath) (exportName : String := "compilatrix_main") : IO String := do
+  let elf ← run readelf #["-W", "-h", "-S", "-s", "-r", "-n", path.toString]
+  requireAll elf [
+    "Class:                             ELF64",
+    "Data:                              2's complement, little endian",
+    "Type:                              REL (Relocatable file)",
+    "Machine:                           Advanced Micro Devices X86-64",
+    ".text", ".note.compilatrix", ".note.GNU-stack", exportName,
+    "COMPILATRIX", "0x43495801"
+  ] s!"{path}: readelf"
+  return elf
+
+def disassemble (objdump : String) (path : FilePath) (exportName : String := "compilatrix_main") : IO String := do
+  let result := (← run objdump #["-dr", "-M", "intel", path.toString]).toLower
+  need (!result.contains "(bad)") s!"{path}: decoder emitted (bad)\n{result}"
+  requireAll result ["file format elf64-x86-64", s!"<{exportName}>:", "ret"] s!"{path}: objdump"
+  return result
+
+def provenance (root : String) : IO ByteArray := do
+  return "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ root ++ " 01 00 00 00 01 00 00 00")))
+
+def linkAndRun (cc readelf : String) (harness object executable : FilePath)
+    (expected : Nat) : IO Unit := do
+  let _ ← run cc #[
+    "-std=c11", "-Wall", "-Wextra", "-Werror", "-Wl,--fatal-warnings", "-no-pie",
+    s!"-DEXPECTED_RESULT={expected}ULL", harness.toString, object.toString,
+    "-o", executable.toString]
+  let _ ← run executable.toString
+  let headers ← run readelf #["-W", "-l", executable.toString]
+  let stacks := (headers.splitOn "\n").filter (·.contains "GNU_STACK")
+  need (stacks.length == 1 && !stacks.any (·.contains "RWE"))
+    s!"{executable}: expected one non-executable GNU_STACK\n{headers}"
+
+def nativeArgs (args : List (String × String)) : IO (Option (String × FilePath)) := do
+  match optional args "--cc", optional args "--harness" with
+  | none, none => return none
+  | some cc, some harness => return some (cc, harness)
+  | _, _ => throw (IO.userError "--cc and --harness must be supplied together")
+
+end Ix.Compiler.Tools.X86Check
diff --git a/Ix/Compiler/UniqueReuse/Heap.lean b/Ix/Compiler/UniqueReuse/Heap.lean
new file mode 100644
index 000000000..62e6549e5
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Heap.lean
@@ -0,0 +1,171 @@
+import Ix.Compiler.UniqueReuse.Lower
+import Ix.Compiler.IxIR0.UniqueReverseSim
+import Ix.Compiler.IxIR1.Reclamation
+
+/-! Exact unique-list heap views and the existing root/edge ownership
+algebra. The views record full constructor identities, unit reference counts,
+and finite list contents. Shallow destruction transports surviving views via
+the post-state ownership invariant. -/
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema)
+
+inductive ListAt (schema : Schema) (store : Store) : List Nat → RVal → Prop where
+  | nil {location : Nat}
+      (found : store.get? location = some ⟨.unique, 1, .ctorN (nilId schema) #[]⟩) :
+      ListAt schema store [] (.loc location)
+  | cons {head : Nat} {tail : List Nat} {location : Nat} {rest : RVal}
+      (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), rest]⟩)
+      (next : ListAt schema store tail rest) : ListAt schema store (head :: tail) (.loc location)
+
+theorem ListAt.hasWorld {schema : Schema} {store : Store} {values : List Nat} {value : RVal}
+    (list : ListAt schema store values value) : HasWorld store .unique value := by
+  cases list with
+  | nil found => exact ⟨_, found, rfl⟩
+  | cons found _ => exact ⟨_, found, rfl⟩
+
+theorem ListAt.graph {schema : Schema} {store : Store} {values : List Nat} {value : RVal}
+    (list : ListAt schema store values value) (functions : FunctionRel) :
+    ValueGraph functions store (IxIR0.UniqueReverse.listValue schema values) value := by
+  induction list with
+  | nil found => exact .ctor found rfl rfl .nil
+  | cons found _ ih => exact .ctor found rfl rfl (.cons .lit (.cons ih .nil))
+
+theorem ListAt.mono {schema : Schema} {before after : Store} {values : List Nat} {value : RVal}
+    (preserved : ∀ {location box}, before.get? location = some box → after.get? location = some box)
+    (list : ListAt schema before values value) : ListAt schema after values value := by
+  induction list with
+  | nil found => exact .nil (preserved found)
+  | cons found _ ih => exact .cons (preserved found) ih
+
+theorem ListAt.allocNode {schema : Schema} {store : Store} {values : List Nat} {value : RVal}
+    (list : ListAt schema store values value) (world : Owned) (node : Node) :
+    ListAt schema (store.allocNode world node).1 values value :=
+  list.mono (fun found => HeapIso.get?_allocNode_old found)
+
+private theorem unique_shape_after_restriction {before after : Store} {roots : List Root}
+    {location : Nat} {node : Node} (restricted : StoreGraphRestricts before after)
+    (owned : RootOwnership after roots) (world : HasWorld after .unique (.loc location))
+    (found : before.get? location = some ⟨.unique, 1, node⟩) :
+    after.get? location = some ⟨.unique, 1, node⟩ := by
+  obtain ⟨⟨actualWorld, rc, actualNode⟩, afterGet, worldEq⟩ := world
+  dsimp at worldEq
+  subst actualWorld
+  obtain ⟨oldRc, oldGet⟩ := restricted afterGet
+  have same := Option.some.inj (oldGet.symm.trans found)
+  cases same
+  have unit : rc = 1 := (owned.counts afterGet).1
+  subst rc
+  exact afterGet
+
+theorem ListAt.ofRestricts {schema : Schema} {before after : Store} {roots : List Root}
+    {values : List Nat} {value : RVal} (restricted : StoreGraphRestricts before after)
+    (owned : RootOwnership after roots) (world : HasWorld after .unique value)
+    (list : ListAt schema before values value) : ListAt schema after values value := by
+  induction list with
+  | nil found => exact .nil (unique_shape_after_restriction restricted owned world found)
+  | cons found next ih =>
+      have afterGet := unique_shape_after_restriction restricted owned world found
+      exact .cons afterGet (ih (owned.edges_world afterGet _ (by simp [nodeChildren])))
+
+def uniqueRoots (values : List RVal) : List Root := rootsFor .unique values
+
+theorem uniqueRoots_cons (value : RVal) (values : List RVal) :
+    uniqueRoots (value :: values) = ⟨.unique, value⟩ :: uniqueRoots values := rfl
+
+theorem ownedNilAllocation {store : Store} {rest : List Root}
+    (owned : RootOwnership store rest) (schema : Schema) :
+    RootOwnership (store.allocNode .unique (.ctorN (nilId schema) #[])).1
+      (⟨.unique, .loc store.nodes.size⟩ :: rest) := by
+  exact (show RootOwnership store (rootsFor .unique (nodeChildren (.ctorN (nilId schema) #[])) ++ rest)
+    from owned).allocNode trivial
+
+theorem nilAllocated (store : Store) (schema : Schema) :
+    ListAt schema (store.allocNode .unique (.ctorN (nilId schema) #[])).1 [] (.loc store.nodes.size) :=
+  .nil (HeapIso.get?_allocNode_new store .unique _)
+
+theorem consAllocated {store : Store} {schema : Schema} {tail : List Nat} {value : RVal}
+    (next : ListAt schema store tail value) (head : Nat) :
+    ListAt schema (store.allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), value])).1
+      (head :: tail) (.loc store.nodes.size) :=
+  .cons (HeapIso.get?_allocNode_new store .unique _) (next.allocNode .unique _)
+
+theorem nilConsumed {store : Store} {schema : Schema} {location : Nat}
+    {accumulator : RVal} {accValues : List Nat}
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (nilId schema) #[]⟩)
+    (owned : RootOwnership store [⟨.unique, .loc location⟩, ⟨.unique, accumulator⟩])
+    (acc : ListAt schema store accValues accumulator) :
+    RootOwnership (store.kill location) [⟨.unique, accumulator⟩] ∧
+      ListAt schema (store.kill location) accValues accumulator := by
+  have after : RootOwnership (store.kill location) [⟨.unique, accumulator⟩] := owned.killUniqueOne found
+  exact ⟨after, acc.ofRestricts (StoreGraphRestricts.kill found) after
+    (after.roots_world ⟨.unique, accumulator⟩ (by simp))⟩
+
+structure TakenCons (schema : Schema) (store : Store) (location head : Nat)
+    (tail accumulator : RVal) (tailValues accValues : List Nat) : Prop where
+  owned : RootOwnership (store.kill location)
+    [⟨.unique, .lit (.nat head)⟩, ⟨.unique, accumulator⟩, ⟨.unique, tail⟩]
+  tailAt : ListAt schema (store.kill location) tailValues tail
+  accAt : ListAt schema (store.kill location) accValues accumulator
+
+theorem consTaken {store : Store} {schema : Schema} {location head : Nat}
+    {tail accumulator : RVal} {tailValues accValues : List Nat}
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (owned : RootOwnership store [⟨.unique, .loc location⟩, ⟨.unique, accumulator⟩])
+    (next : ListAt schema store tailValues tail) (acc : ListAt schema store accValues accumulator) :
+    TakenCons schema store location head tail accumulator tailValues accValues := by
+  have after := owned.killUniqueOne found
+  have after' : RootOwnership (store.kill location)
+      [⟨.unique, .lit (.nat head)⟩, ⟨.unique, tail⟩, ⟨.unique, accumulator⟩] := after
+  refine ⟨after'.perm ((List.Perm.swap _ _ []).cons _), ?_, ?_⟩
+  · exact next.ofRestricts (StoreGraphRestricts.kill found) after'
+      (after'.roots_world ⟨.unique, tail⟩ (by simp))
+  · exact acc.ofRestricts (StoreGraphRestricts.kill found) after'
+      (after'.roots_world ⟨.unique, accumulator⟩ (by simp))
+
+theorem TakenCons.allocate {store : Store} {schema : Schema} {location head : Nat}
+    {tail accumulator : RVal} {tailValues accValues : List Nat}
+    (taken : TakenCons schema store location head tail accumulator tailValues accValues) :
+    let output := ((store.kill location).allocNode .unique
+      (.ctorN (consId schema) #[.lit (.nat head), accumulator]))
+    RootOwnership output.1 [⟨.unique, tail⟩, ⟨.unique, .loc output.2⟩] ∧
+      ListAt schema output.1 tailValues tail ∧
+      ListAt schema output.1 (head :: accValues) (.loc output.2) := by
+  dsimp only
+  have allocated := (show RootOwnership (store.kill location)
+    (rootsFor .unique (nodeChildren (.ctorN (consId schema) #[.lit (.nat head), accumulator])) ++
+      [⟨.unique, tail⟩]) from taken.owned).allocNode (by trivial)
+  exact ⟨allocated.perm (List.Perm.swap _ _ []), taken.tailAt.allocNode .unique _, consAllocated taken.accAt head⟩
+
+private theorem revive_preserves_killed {store : Store} {location other : Nat} {oldBox box : NodeBox}
+    {node : Node} (found : store.get? location = some oldBox)
+    (kept : (store.kill location).get? other = some box) :
+    (reuseNodeStore store location node).get? other = some box := by
+  have different : location ≠ other := by
+    intro h; subst other
+    rw [get?_kill_same found] at kept
+    cases kept
+  exact get?_reuseNodeStore_other different found (get?_of_kill_other different found kept)
+
+theorem TakenCons.reuse {store : Store} {schema : Schema} {location head : Nat}
+    {tail accumulator : RVal} {tailValues accValues : List Nat}
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (taken : TakenCons schema store location head tail accumulator tailValues accValues) :
+    let output := reuseNodeStore store location (.ctorN (consId schema) #[.lit (.nat head), accumulator])
+    RootOwnership output [⟨.unique, tail⟩, ⟨.unique, .loc location⟩] ∧
+      ListAt schema output tailValues tail ∧
+      ListAt schema output (head :: accValues) (.loc location) := by
+  dsimp only
+  have ready : RootOwnership (store.kill location)
+      (rootsFor .unique (nodeChildren (.ctorN (consId schema) #[.lit (.nat head), accumulator])) ++
+        [⟨.unique, tail⟩]) := taken.owned
+  have revived := ready.reviveUnique found (by trivial)
+  refine ⟨revived.perm (List.Perm.swap _ _ []), taken.tailAt.mono (revive_preserves_killed found), ?_⟩
+  exact .cons (get?_reuseNodeStore_same found)
+    (taken.accAt.mono (revive_preserves_killed found))
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/Lower.lean b/Ix/Compiler/UniqueReuse/Lower.lean
new file mode 100644
index 000000000..02bd9a71b
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Lower.lean
@@ -0,0 +1,67 @@
+import Ix.Compiler.UniqueReuse.ModeCheck
+import Ix.Compiler.IxIR1.Serialize
+import Ix.Compiler.IxIR1.ReaddressAll
+
+/-! Consuming ownership emission for the checked reverse instantiation. Every
+case field is moved before the parent is shallow-freed. No shared retain or
+release is generated. The declaration is canonically addressed after emission;
+the separate recursor-instance address retains the source world vector. -/
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+
+def nilId (schema : Schema) : CtorId := IxIR1.Lower.ctorIdOf schema.nil 0
+def consId (schema : Schema) : CtorId := IxIR1.Lower.ctorIdOf schema.cons 1
+
+def lets : List Op → Code → Code
+  | [], code => code
+  | operation :: rest, code => .letOp operation (lets rest code)
+
+def consumingBody (schema : Schema) : Code :=
+  .case (.var 0) false #[
+    .mk 0 0 (.letOp (.free (.var 0)) (.ret (.var 2))),
+    .mk 1 2 (lets
+      [.free (.var 2), .alloc .unique (consId schema) #[.var 2, .var 4],
+       .callSelf #[.var 0, .var 2]] (.ret (.var 0)))]
+
+def consumingFunction (schema : Schema) : FnDef :=
+  { arity := 2, result := .unique, papSafe := false, body := consumingBody schema }
+
+def functionAddress (schema : Schema) : Address := (Decl.fn (consumingFunction schema)).address
+
+def inputOperations (schema : Schema) (values : List Nat) : List Op :=
+  .alloc .unique (nilId schema) #[] ::
+    values.reverse.map (fun value => .alloc .unique (consId schema) #[.lit (.nat value), .var 0])
+
+def mainCode (plan : Plan) : Code :=
+  lets (inputOperations plan.schema plan.values ++
+    [.alloc .unique (nilId plan.schema) #[], .call (functionAddress plan.schema) #[.var 0, .var 1]])
+    (.ret (.var 0))
+
+def declarations (schema : Schema) : List (Address × Decl) :=
+  [(functionAddress schema, .fn (consumingFunction schema))]
+
+def artifacts (schema : Schema) : List ReaddressAll.Artifact :=
+  [.ordinary (functionAddress schema) (.fn (consumingFunction schema))]
+
+structure Lowered {constants : List (Address × Ixon.Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    (source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique
+      checkFuel eraseFuel) where
+  checked : CheckedSource source
+
+def Lowered.plan {constants : List (Address × Ixon.Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    {source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique
+      checkFuel eraseFuel} (lowered : Lowered source) : Plan := lowered.checked.recovery.checked.plan
+
+def lower {constants : List (Address × Ixon.Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    (source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique
+      checkFuel eraseFuel) : Except String (Lowered source) := do
+  return { checked := ← checkSource source }
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/LowerSim.lean b/Ix/Compiler/UniqueReuse/LowerSim.lean
new file mode 100644
index 000000000..34b1225e9
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/LowerSim.lean
@@ -0,0 +1,204 @@
+import Ix.Compiler.UniqueReuse.Heap
+import Ix.Compiler.IxIR1.EvalHistory
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+
+theorem lets_append (first second : List Op) (code : Code) :
+    lets (first ++ second) code = lets first (lets second code) := by
+  induction first with
+  | nil => rfl
+  | cons operation rest ih => simp only [List.cons_append, lets, ih]
+
+theorem inputOperations_nil (schema : Schema) :
+    inputOperations schema [] = [.alloc .unique (nilId schema) #[]] := rfl
+
+theorem inputOperations_cons (schema : Schema) (head : Nat) (tail : List Nat) :
+    inputOperations schema (head :: tail) = inputOperations schema tail ++
+      [.alloc .unique (consId schema) #[.lit (.nat head), .var 0]] := by
+  simp [inputOperations, List.reverse_cons]
+
+private theorem consumingConsHistory (ctx : Ctx) (schema : Schema) (store : Store)
+    (location head : Nat) (tail accumulator : RVal)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩) :
+    let allocated := (store.kill location).allocNode .unique
+      (.ctorN (consId schema) #[.lit (.nat head), accumulator])
+    ExecutionHistory ctx
+      ⟨consumingFunction schema, store, [.loc location, accumulator], consumingBody schema⟩
+      ⟨consumingFunction schema, allocated.1, [tail, .loc allocated.2], consumingBody schema⟩ := by
+  dsimp only
+  let current := consumingFunction schema
+  let allocated := (store.kill location).allocNode .unique
+    (.ctorN (consId schema) #[.lit (.nat head), accumulator])
+  have branch : ExecutionHistory ctx
+      ⟨current, store, [.loc location, accumulator], consumingBody schema⟩
+      ⟨current, store, [tail, .lit (.nat head), .loc location, accumulator],
+        lets [.free (.var 2), .alloc .unique (consId schema) #[.var 2, .var 4],
+          .callSelf #[.var 0, .var 2]] (.ret (.var 0))⟩ :=
+    ExecutionHistory.caseCtor rfl found rfl rfl rfl
+  have freed := ExecutionHistory.stepOp (next := lets
+      [.alloc .unique (consId schema) #[.var 2, .var 4], .callSelf #[.var 0, .var 2]] (.ret (.var 0)))
+    (runOp_free (ctx := ctx) (cur := current) (fuel := 0)
+      (env := [tail, .lit (.nat head), .loc location, accumulator]) (target := .var 2) rfl found)
+  have built := ExecutionHistory.stepOp (next := .letOp (.callSelf #[.var 0, .var 2]) (.ret (.var 0)))
+    (runOp_alloc (ctx := ctx) (cur := current) (fuel := 0) (store := store.kill location)
+      (env := [.erased, tail, .lit (.nat head), .loc location, accumulator]) (world := .unique)
+      (cid := consId schema) (args := #[.var 2, .var 4]) (by rfl))
+  have called : ExecutionHistory ctx
+      ⟨current, allocated.1, [.loc allocated.2, .erased, tail, .lit (.nat head), .loc location, accumulator],
+        .letOp (.callSelf #[.var 0, .var 2]) (.ret (.var 0))⟩
+      ⟨current, allocated.1, [tail, .loc allocated.2], consumingBody schema⟩ :=
+    ExecutionHistory.tailCallSelf (arguments := [.loc allocated.2, tail]) rfl rfl
+  exact ((branch.trans freed).trans built).trans called
+
+structure LoopResult (schema : Schema) (before after : Store)
+    (values accumulator : List Nat) (value : RVal) : Prop where
+  owned : RootOwnership after [⟨.unique, value⟩]
+  list : ListAt schema after (values.reverse ++ accumulator) value
+  allocs : after.allocs = before.allocs + values.length
+  frees : after.frees = before.frees + values.length + 1
+  reuses : after.reuses = before.reuses
+  rcops : after.rcops = before.rcops
+
+theorem consumingLoop (ctx : Ctx) (schema : Schema) (values : List Nat)
+    (store : Store) (major accumulator : RVal) (accValues : List Nat)
+    (owned : RootOwnership store [⟨.unique, major⟩, ⟨.unique, accumulator⟩])
+    (input : ListAt schema store values major) (acc : ListAt schema store accValues accumulator) :
+    ∃ output value,
+      CodePoint.Runs ctx ⟨consumingFunction schema, store, [major, accumulator], consumingBody schema⟩ (output, value) ∧
+      LoopResult schema store output values accValues value := by
+  induction values generalizing store major accumulator accValues with
+  | nil =>
+      cases input with
+      | @nil location found =>
+          obtain ⟨afterOwned, afterList⟩ := nilConsumed found owned acc
+          refine ⟨store.kill location, accumulator, ?_, afterOwned, ?_, ?_, ?_, rfl, rfl⟩
+          · exact ⟨3, by simp [consumingBody, runCode, runOp, resolveAtom, found, nilId, IxIR1.Lower.ctorIdOf, Alt.cidx]⟩
+          · simpa using afterList
+          · simp [Store.kill]
+          · simp [Store.kill]
+  | cons head tail ih =>
+      cases input with
+      | @cons _ _ location tailValue found next =>
+          let allocated := (store.kill location).allocNode .unique
+            (.ctorN (consId schema) #[.lit (.nat head), accumulator])
+          have taken := consTaken found owned next acc
+          obtain ⟨afterOwned, tailAt, accAt⟩ := taken.allocate
+          obtain ⟨output, value, run, result⟩ := ih allocated.1 tailValue (.loc allocated.2)
+            (head :: accValues) afterOwned tailAt accAt
+          refine ⟨output, value,
+            (consumingConsHistory ctx schema store location head tailValue accumulator found).complete
+              run result.list.hasWorld, ?_⟩
+          refine ⟨result.owned, ?_, ?_, ?_, ?_, ?_⟩
+          · simpa [List.reverse_cons, List.append_assoc] using result.list
+          · simpa [allocated, Store.kill, Store.allocNode, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using result.allocs
+          · simpa [allocated, Store.kill, Store.allocNode, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using result.frees
+          · exact result.reuses
+          · exact result.rcops
+
+structure InputResult (schema : Schema) (before after : Store)
+    (values : List Nat) (value : RVal) (rest : List Root) : Prop where
+  owned : RootOwnership after (⟨.unique, value⟩ :: rest)
+  list : ListAt schema after values value
+  allocs : after.allocs = before.allocs + values.length + 1
+  frees : after.frees = before.frees
+  reuses : after.reuses = before.reuses
+  rcops : after.rcops = before.rcops
+
+theorem inputHistory (ctx : Ctx) (current : FnDef) (schema : Schema) (values : List Nat)
+    (store : Store) (environment : List RVal) (rest : List Root) (code : Code)
+    (owned : RootOwnership store rest) :
+    ∃ output value remaining,
+      ExecutionHistory ctx ⟨current, store, environment, lets (inputOperations schema values) code⟩
+        ⟨current, output, value :: remaining, code⟩ ∧
+      InputResult schema store output values value rest := by
+  induction values generalizing store environment code with
+  | nil =>
+      let output := store.allocNode .unique (.ctorN (nilId schema) #[])
+      refine ⟨output.1, .loc output.2, environment, ?_, ownedNilAllocation owned schema, nilAllocated store schema,
+        ?_, rfl, rfl, rfl⟩
+      · exact ExecutionHistory.stepOp (runOp_alloc (ctx := ctx) (cur := current) (fuel := 0)
+          (store := store) (env := environment) (world := .unique) (cid := nilId schema) (args := #[]) rfl)
+      · simp [output, Store.allocNode]
+  | cons head tail ih =>
+      let operation := Op.alloc .unique (consId schema) #[.lit (.nat head), .var 0]
+      obtain ⟨middle, tailValue, remaining, history, result⟩ :=
+        ih store environment (.letOp operation code) owned
+      let output := middle.allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), tailValue])
+      have ready : RootOwnership middle
+          (rootsFor .unique (nodeChildren (.ctorN (consId schema) #[.lit (.nat head), tailValue])) ++ rest) :=
+        RootOwnership.addNoLocation (value := .lit (.nat head)) rfl result.owned
+      refine ⟨output.1, .loc output.2, tailValue :: remaining, ?_, ready.allocNode trivial,
+        consAllocated result.list head, ?_, ?_, ?_, ?_⟩
+      · have built := ExecutionHistory.stepOp (next := code) (runOp_alloc (ctx := ctx) (cur := current)
+          (fuel := 0) (store := middle) (env := tailValue :: remaining)
+          (world := .unique) (cid := consId schema) (args := #[.lit (.nat head), .var 0]) rfl)
+        simpa [inputOperations_cons, lets_append, lets, operation, output] using history.trans built
+      · have count := result.allocs
+        simp only [output, Store.allocNode, List.length_cons]
+        omega
+      · exact result.frees
+      · exact result.reuses
+      · exact result.rcops
+
+structure MainResult (plan : Plan) (store : Store) (value : RVal) : Prop where
+  owned : RootOwnership store [⟨.unique, value⟩]
+  list : ListAt plan.schema store plan.values.reverse value
+  allocs : store.allocs = 2 * plan.values.length + 2
+  frees : store.frees = plan.values.length + 1
+  reuses : store.reuses = 0
+  rcops : store.rcops = 0
+  live : store.live = plan.values.length + 1
+
+theorem mainExists (plan : Plan) :
+    ∃ fuel store value,
+      runOwnedMain { decls := Env.ofList (declarations plan.schema) } .unique (mainCode plan) fuel = .ok (store, value) ∧
+      MainResult plan store value := by
+  let ctx : Ctx := { decls := Env.ofList (declarations plan.schema) }
+  let current : FnDef := ⟨0, .unique, false, mainCode plan⟩
+  let suffix := lets [.alloc .unique (nilId plan.schema) #[],
+    .call (functionAddress plan.schema) #[.var 0, .var 1]] (.ret (.var 0))
+  obtain ⟨built, inputValue, remaining, history, inputResult⟩ :=
+    inputHistory ctx current plan.schema plan.values {} [] [] suffix RootOwnership.empty
+  let initialized := built.allocNode .unique (.ctorN (nilId plan.schema) #[])
+  have initializedOwned : RootOwnership initialized.1 [⟨.unique, inputValue⟩, ⟨.unique, .loc initialized.2⟩] :=
+    (ownedNilAllocation inputResult.owned plan.schema).perm (List.Perm.swap _ _ [])
+  obtain ⟨store, value, loopRun, loopResult⟩ := consumingLoop ctx plan.schema plan.values initialized.1
+    inputValue (.loc initialized.2) [] initializedOwned (inputResult.list.allocNode .unique _) (nilAllocated built plan.schema)
+  have accumulatorHistory := ExecutionHistory.stepOp (next := .letOp
+      (.call (functionAddress plan.schema) #[.var 0, .var 1]) (.ret (.var 0)))
+    (runOp_alloc (ctx := ctx) (cur := current) (fuel := 0) (store := built)
+      (env := inputValue :: remaining) (world := .unique) (cid := nilId plan.schema) (args := #[]) rfl)
+  have call : ExecutionHistory ctx
+      ⟨current, initialized.1, .loc initialized.2 :: inputValue :: remaining,
+        .letOp (.call (functionAddress plan.schema) #[.var 0, .var 1]) (.ret (.var 0))⟩
+      ⟨consumingFunction plan.schema, initialized.1, [inputValue, .loc initialized.2], consumingBody plan.schema⟩ :=
+    ExecutionHistory.tailCall (arguments := [.loc initialized.2, inputValue]) rfl
+      (by simp [ctx, declarations, Env.ofList]) rfl rfl
+  have complete := ((history.trans accumulatorHistory).trans call).complete loopRun loopResult.list.hasWorld
+  obtain ⟨fuel, run⟩ := complete
+  have bodyRun : runCode ctx fuel current {} [] (mainCode plan) = .ok (store, value) := by
+    simpa only [mainCode, lets_append, suffix] using run
+  have world := rval_hasWorld_eq_true_iff.mpr loopResult.list.hasWorld
+  have ownedRun : runOwnedMain ctx .unique (mainCode plan) fuel = .ok (store, value) := by
+    simp [runOwnedMain, bodyRun, current, checkResultWorld, world]
+  have hallocs : store.allocs = 2 * plan.values.length + 2 := by
+    have ih := inputResult.allocs
+    have lh := loopResult.allocs
+    simp only [initialized, Store.allocNode] at lh
+    change built.allocs = 0 + plan.values.length + 1 at ih
+    omega
+  have hfrees : store.frees = plan.values.length + 1 := by
+    simpa [initialized, Store.allocNode, inputResult.frees] using loopResult.frees
+  have footprint := (IxIR1.Reclamation.runCode_footprint bodyRun).live_balance
+  refine ⟨fuel, store, value, ownedRun, loopResult.owned, ?_, hallocs, hfrees, ?_, ?_, ?_⟩
+  · simpa using loopResult.list
+  · exact loopResult.reuses.trans inputResult.reuses
+  · exact loopResult.rcops.trans inputResult.rcops
+  · change store.live + store.frees + 0 = 0 + 0 + store.allocs at footprint
+    omega
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/ModeCheck.lean b/Ix/Compiler/UniqueReuse/ModeCheck.lean
new file mode 100644
index 000000000..59ad26d2c
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/ModeCheck.lean
@@ -0,0 +1,85 @@
+import Ix.Compiler.PipelineErasure
+import Ix.Compiler.IxIR0.UniqueReverse
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon
+
+structure RecursorWorlds where
+  arguments : List Owned
+  fields : List (List Owned)
+  result : Owned
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def recursorWorlds? (resolve : Address → Option Constant) (alias : Address)
+    (fuel : Nat) : Option RecursorWorlds := do
+  let constant ← resolve alias
+  let .rPrj projection := constant.info | none
+  let block ← resolve projection.block
+  let .muts members := block.info | none
+  let .recr recursor ← members[projection.idx.toNat]? | none
+  if recursor.params != 0 || recursor.motives != 0 || recursor.indices != 0 || recursor.k then none else
+    let telescope := UsageCheck.telescopeOf block.sharing fuel recursor.typ
+    let result ← telescope.getLast?
+    let fields := recursor.rules.toList.map fun rule =>
+      ((Expr.collectLam rule.rhs).1.drop recursor.minors.toNat).map fun (mode, _) => UsageCheck.worldOf mode
+    return { arguments := telescope.map fun demand => UsageCheck.worldOf demand.uses
+             fields, result := result.owned }
+
+def constructorWorlds? (resolve : Address → Option Constant) (address : Address)
+    (fuel : Nat) : Option (Nat × List Owned × Owned) := do
+  let constant ← resolve address
+  let .cPrj projection := constant.info | none
+  let block ← resolve projection.block
+  let .muts members := block.info | none
+  let .indc typeDefinition ← members[projection.idx.toNat]? | none
+  let constructor ← typeDefinition.ctors[projection.cidx.toNat]?
+  if constructor.params != 0 || typeDefinition.params != 0 then none else
+    let telescope := UsageCheck.telescopeOf block.sharing fuel constructor.typ
+    return (constructor.fields.toNat, telescope.map fun demand => UsageCheck.worldOf demand.uses,
+      ((telescope.getLast?).map (·.owned)).getD .unique)
+
+def builderWorlds? (resolve : Address → Option Constant) (address : Address)
+    (fuel : Nat) : Option (List Owned × Owned) := do
+  let constant ← resolve address
+  let .defn definition := constant.info | none
+  let telescope := UsageCheck.telescopeOf constant.sharing fuel definition.typ
+  let result ← telescope.getLast?
+  return (telescope.map fun demand => UsageCheck.worldOf demand.uses, result.owned)
+
+structure ModeEvidence (resolve : Address → Option Constant)
+    (schema : IxIR0.UniqueReverse.Schema) (fuel : Nat) : Prop where
+  recursor : recursorWorlds? resolve schema.alias fuel =
+    some { arguments := [.shared, .unique, .unique], fields := [[], [.unique, .unique]], result := .unique }
+  nil : constructorWorlds? resolve schema.nil fuel = some (0, [], .unique)
+  cons : constructorWorlds? resolve schema.cons fuel = some (2, [.unique, .unique], .unique)
+  builder : builderWorlds? resolve schema.builder fuel = some ([.unique, .unique], .unique)
+
+instance (resolve : Address → Option Constant) (schema : IxIR0.UniqueReverse.Schema)
+    (fuel : Nat) : Decidable (ModeEvidence resolve schema fuel) :=
+  decidable_of_iff
+    (recursorWorlds? resolve schema.alias fuel =
+        some { arguments := [.shared, .unique, .unique], fields := [[], [.unique, .unique]], result := .unique } ∧
+      constructorWorlds? resolve schema.nil fuel = some (0, [], .unique) ∧
+      constructorWorlds? resolve schema.cons fuel = some (2, [.unique, .unique], .unique) ∧
+      builderWorlds? resolve schema.builder fuel = some ([.unique, .unique], .unique))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2⟩, fun h => ⟨h.recursor, h.nil, h.cons, h.builder⟩⟩
+
+structure CheckedSource {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    (source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique
+      checkFuel eraseFuel) where
+  recovery : IxIR0.UniqueReverse.Recovered source.erasure.result.raw source.rawMain
+  modes : ModeEvidence (Pipeline.ResolverIndex.ofList constants).resolve recovery.checked.plan.schema checkFuel
+
+def checkSource {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    (source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique
+      checkFuel eraseFuel) : Except String (CheckedSource source) := do
+  let some recovery := IxIR0.UniqueReverse.recover source.erasure.result.raw source.rawMain
+    | throw "unique reverse source is outside the checked specialization fragment"
+  if hm : ModeEvidence (Pipeline.ResolverIndex.ofList constants).resolve recovery.checked.plan.schema checkFuel then
+    return { recovery, modes := hm }
+  else throw "unique reverse worlds do not match the original Ixon declarations"
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/Native.lean b/Ix/Compiler/UniqueReuse/Native.lean
new file mode 100644
index 000000000..0a2bea905
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Native.lean
@@ -0,0 +1,76 @@
+import Ix.Compiler.UniqueReuse.Pipeline
+import Ix.Compiler.X86.UniqueTarget
+
+/-! Optional native selection from the actual checked unique-reversal
+compilation. Selection requires static reuse, exact Word representation, and
+the bounded native shape. A skip retains the existing compiler artifact. -/
+
+namespace Ix.Compiler.UniqueReuse.Native
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.X86 (Word Checked)
+
+variable {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+  {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+
+structure Output (compilation : Compilation constants entry config checkFuel eraseFuel limits) where
+  sourceTarget : CompiledTarget compilation.plan limits
+  backendProduced : compilation.backend = .translated sourceTarget
+  reuseSelected : sourceTarget.selection.reused = true
+  words : List Word
+  valuesExact : words.map UInt64.toNat = compilation.plan.values
+  lengthBound : words.length ≤ X86.UniqueABI.maxLength
+  main : Checked
+  mainProduced : main.program = X86.UniqueTarget.program words
+  release : Checked
+  releaseProduced : release.program = X86.UniqueTarget.releaseProgram
+
+inductive Selection (compilation : Compilation constants entry config checkFuel eraseFuel limits) where
+  | skipped (reason : String)
+  | native (output : Output compilation)
+
+/-- Native objects can only be requested through the successful certificate.
+The representability comparison rejects large Nats instead of truncating them. -/
+def select (compilation : Compilation constants entry config checkFuel eraseFuel limits) : Selection compilation :=
+  match backend : compilation.backend with
+  | .ownedOnly reason => .skipped s!"native requires a translated target: {reason}"
+  | .translated target =>
+      if reused : target.selection.reused = true then
+        let words := compilation.plan.values.map UInt64.ofNat
+        if exactValues : words.map UInt64.toNat = compilation.plan.values then
+          if bounded : words.length ≤ X86.UniqueABI.maxLength then
+            if mainValid : (X86.UniqueTarget.program words).wellFormed = true then
+              if releaseValid : X86.UniqueTarget.releaseProgram.wellFormed = true then
+                .native
+                  { sourceTarget := target
+                    backendProduced := backend
+                    reuseSelected := reused
+                    words
+                    valuesExact := exactValues
+                    lengthBound := bounded
+                    main := ⟨X86.UniqueTarget.program words, mainValid⟩
+                    mainProduced := rfl
+                    release := ⟨X86.UniqueTarget.releaseProgram, releaseValid⟩
+                    releaseProduced := rfl }
+              else .skipped "native release control validation failed"
+            else .skipped "native main control validation failed"
+          else .skipped "native unique reversal exceeds 64 scalar elements"
+        else .skipped "native unique reversal contains a Nat outside the 64-bit Word range"
+      else .skipped "native unique reversal requires selected static reuse"
+
+theorem Output.sourceProgram {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) :
+    output.sourceTarget.selection.program = IxIR2.UniqueLower.program compilation.plan true := by
+  simp only [IxIR2.UniqueLower.Selection.program, output.reuseSelected]
+
+def Output.sourceChecked {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) :
+    IxIR2.Validate.Checked limits (IxIR2.UniqueLower.context compilation.plan.schema)
+      (IxIR2.UniqueLower.program compilation.plan true) :=
+  output.sourceProgram ▸ output.sourceTarget.selection.checked
+
+theorem Output.sourceLength {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) : compilation.plan.values.length = output.words.length := by
+  rw [← output.valuesExact, List.length_map]
+
+end Ix.Compiler.UniqueReuse.Native
diff --git a/Ix/Compiler/UniqueReuse/NativeObject.lean b/Ix/Compiler/UniqueReuse/NativeObject.lean
new file mode 100644
index 000000000..9f5b51be8
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/NativeObject.lean
@@ -0,0 +1,76 @@
+import Ix.Compiler.UniqueReuse.Native
+import Ix.Compiler.UniqueReuse.Provenance
+import Ix.Compiler.X86.ELFValidate
+
+/-! Native object production is available only from successful checked native
+selection. Both ELF notes retain the actual canonical IxIR₁ graph root. Native
+lowering version 2 and role policy versions 1/2 distinguish main and release;
+the extended canonical preimage also records source policy and arena ABI. -/
+
+namespace Ix.Compiler.UniqueReuse.Native
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.X86
+open Ix.Compiler.IxIR
+
+inductive Role where
+  | main | release
+  deriving Repr, BEq, DecidableEq
+
+def Role.name : Role → String | .main => "main" | .release => "release"
+def Role.symbol : Role → String | .main => "compilatrix_main" | .release => "compilatrix_unique_drop"
+def Role.policyVersion : Role → UInt32 | .main => 1 | .release => 2
+
+def nativeLoweringVersion : UInt32 := 2
+
+variable {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+  {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+
+/-- This digest is an extended native policy identity, never an IxIR₁ root. -/
+def Output.nativeBytes {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) : ByteArray :=
+  Encoding.domain "compilatrix/native-unique-provenance/1" ++ Encoding.tag 0 ++
+    Encoding.address compilation.provenance.identity ++ Encoding.address compilation.provenance.graph ++
+    Encoding.string UniqueABI.policyTag ++ Encoding.string UniqueTarget.policyTag ++
+    Encoding.nat UniqueABI.maxLength ++ Encoding.nat UniqueABI.headerWords ++ Encoding.nat UniqueABI.cellWords ++
+    Encoding.address compilation.plan.schema.nil ++ Encoding.address compilation.plan.schema.cons ++
+    Encoding.list Encoding.nat (output.words.map UInt64.toNat) ++
+    Encoding.string role.name ++ Encoding.nat nativeLoweringVersion.toNat ++ Encoding.nat role.policyVersion.toNat
+
+def Output.nativeIdentity {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) : Address := Address.blake3 (output.nativeBytes role)
+
+def Output.objectProvenance {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (_output : Output compilation) (role : Role) : ELF.Provenance :=
+  .ixir1Policy compilation.provenance.graph nativeLoweringVersion role.policyVersion
+
+structure Object where
+  role : Role
+  checked : Checked
+  provenance : ELF.Provenance
+  policyBytes : ByteArray
+  policyIdentity : Address
+  encoded : Encode.Output
+  bytes : ByteArray
+  streamValid : Stream.Valid checked.program encoded
+  objectValid : ELF.Valid { encoded, entryBlock := checked.program.entry, exportName := role.symbol, provenance } bytes
+
+def Output.emit {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) : Except String Object := do
+  let checked := match role with | .main => output.main | .release => output.release
+  let stream ← (Stream.encode checked).mapError reprStr
+  let encoded := stream.output
+  let provenance := output.objectProvenance role
+  let input : ELF.Input :=
+    { encoded
+      entryBlock := checked.program.entry
+      exportName := role.symbol
+      provenance }
+  let object ← (ELF.writeChecked input).mapError reprStr
+  return {
+    role, checked, provenance, encoded, bytes := object.bytes
+    policyBytes := output.nativeBytes role
+    policyIdentity := output.nativeIdentity role
+    streamValid := stream.valid, objectValid := object.valid }
+
+end Ix.Compiler.UniqueReuse.Native
diff --git a/Ix/Compiler/UniqueReuse/NativeObservations.lean b/Ix/Compiler/UniqueReuse/NativeObservations.lean
new file mode 100644
index 000000000..8dc8081aa
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/NativeObservations.lean
@@ -0,0 +1,184 @@
+import Ix.Compiler.UniqueReuse.NativeObject
+import Ix.Compiler.UniqueReuse.NativeSim
+import Ix.Compiler.UniqueReuse.Observations
+
+/-! Reproducible compiler and byte-evaluator observations for the bounded
+native witness. Native addresses are normalized to checked arena indices;
+source, graph, policy, typed target, text, and ELF identities are exported. -/
+
+namespace Ix.Compiler.UniqueReuse.Native.Examples
+
+open Lean Ix.Compiler.Ixon Ix.Compiler.X86 Ix.Compiler.X86.UniqueABI
+open Ix.Compiler.UniqueReuse.Examples (need)
+
+def headerValues (layout : Layout) (memory : Memory) : Array Nat :=
+  (List.range headerWords).toArray.map fun field => (memory.read64 (layout.address field)).toNat
+
+def pointerIndex (layout : Layout) (pointer : Word) : Except String Json := do
+  if pointer == 0 then return Json.null
+  let base := layout.base.toNat + headerBytes
+  need (base ≤ pointer.toNat && pointer.toNat < base + cellBytes * layout.capacity &&
+    (pointer.toNat - base) % cellBytes == 0) "native pointer escaped or is misaligned"
+  return toJson ((pointer.toNat - base) / cellBytes)
+
+def heapSnapshot (layout : Layout) (memory : Memory) : Except String Json := do
+  let cells ← (List.range layout.capacity).toArray.mapM fun index => do
+    let words := (List.range 4).toArray.map fun field => memory.read64 (layout.address (cellSlot index field))
+    return Json.arr #[toJson words[0]!.toNat, toJson words[1]!.toNat,
+      ← pointerIndex layout words[2]!, toJson words[3]!.toNat]
+  return Json.mkObj [("header", toJson (headerValues layout memory)), ("cells", Json.arr cells)]
+
+def nativeList (layout : Layout) (memory : Memory) (length : Nat) (root : Word) : Except String (List Nat) := do
+  let mut pointer := root
+  let mut values := []
+  let mut visited := []
+  for index in [:length + 1] do
+    let normalized ← pointerIndex layout pointer
+    need (normalized != Json.null && !visited.contains normalized) "native graph is null or cyclic"
+    visited := normalized :: visited
+    let tag := memory.read64 pointer
+    need (tag == (if index < length then consTag else nilTag) && memory.read64 (pointer + 24) == 0)
+      "native graph tag or padding disagreement"
+    if index < length then
+      values := values ++ [(memory.read64 (pointer + 8)).toNat]
+      pointer := memory.read64 (pointer + 16)
+    else need (memory.read64 (pointer + 8) == 0 && memory.read64 (pointer + 16) == 0) "native nil fields not zero"
+  return values
+
+def boundary (machine : Machine) : Bool :=
+  machine.status != .running || machine.pc.offset == 0 ||
+    (machine.pc.block == 2 && machine.pc.offset.toNat % 20 == 0) ||
+    (machine.pc.block == 5 && machine.pc.offset == 10)
+
+def prefixSnapshot (layout : Layout) (machine : Machine) (step : Nat) : Except String Json := do
+  let header := headerValues layout machine.core.memory
+  need (header[0]! == cellBytes * header[2]! && header[2]! ≤ layout.capacity) "native prefix allocation cursor disagreement"
+  let tags := (List.range header[2]!).toArray.map fun index =>
+    (machine.core.memory.read64 (layout.cell index)).toNat
+  let live := tags.countP (fun tag => tag == 0 || tag == 1)
+  let reservations := tags.countP (· == 2)
+  let freed := tags.countP (· == 3)
+  need (live + reservations + freed == tags.size && live == header[5]! && freed == header[3]! &&
+    reservations == header[9]! && reservations ≤ 1) "native prefix ownership accounting disagreement"
+  need (header[7]! == 0 && live ≤ header[6]! && header[6]! ≤ layout.capacity) "native prefix RC or peak disagreement"
+  return Json.mkObj [("step", toJson step), ("block", toJson machine.pc.block.toNat),
+    ("offset", toJson machine.pc.offset.toNat), ("halted", toJson (machine.status != .running)),
+    ("header", toJson header), ("tags", toJson tags)]
+
+private def observe (layout : Layout) (values : List Word) (main release : Checked) : Except String Json := do
+  let initial : Core :=
+    { registers := (Registers.zero.set .rdi layout.base).set .rsp 0x8008
+      memory := initialMemory layout Memory.unmapped }
+  let mut machine := Machine.initial main initial
+  let mut prefixes := #[]
+  for count in [:UniqueTarget.controlCost values + 1] do
+    need (machine.core.readReg .rsp == 0x8008 && machine.core.readReg .rdi == layout.base &&
+      machine.core.calleeSavedSnapshot == initial.calleeSavedSnapshot) "native ABI register disagreement"
+    match machine.status with
+    | .trapped fault => throw s!"native byte evaluator trapped: {repr fault}"
+    | _ => pure ()
+    if boundary machine then prefixes := prefixes.push (← prefixSnapshot layout machine count)
+    if count < UniqueTarget.controlCost values then
+      need (machine.status == .running) "native entry halted before its control cost"
+      machine := step Runtime.rejecting main machine
+  need (machine.status == .halted (layout.cell 1)) "native entry did not return its owned root"
+  let observed ← nativeList layout machine.core.memory values.length (machine.core.readReg .rax)
+  need (observed == (values.map UInt64.toNat).reverse) "native reversal disagreement"
+  let returned ← heapSnapshot layout machine.core.memory
+  let dropped := runFrom Runtime.rejecting release (UniqueTarget.releaseCost values.length) machine.core
+  need (dropped.status == .halted 0 && dropped.core.readReg .rsp == initial.readReg .rsp &&
+    dropped.core.calleeSavedSnapshot == initial.calleeSavedSnapshot) "native release status or ABI disagreement"
+  let reclaimed ← heapSnapshot layout dropped.core.memory
+  let after := headerValues layout dropped.core.memory
+  need (after[2]! == after[3]! && after[5]! == 0 && after[7]! == 0 && after[9]! == 0) "native release leaked"
+  let mut failures := #[]
+  for (label, cursor, capacity, fuel) in [
+      ("one-byte-short", (0 : Word), UInt64.ofNat (UniqueTarget.requiredBytes values - 1), 7),
+      ("zero-capacity", 0, 0, 7),
+      ("nonzero-cursor", 1, UInt64.ofNat (UniqueTarget.requiredBytes values), 7),
+      ("cursor-overflow", 0xffffffffffffffff, UInt64.ofNat (UniqueTarget.requiredBytes values), 5)] do
+    let memory := (initial.memory.write64 (layout.address 0) cursor).write64 (layout.address 1) capacity
+    let failed := runFrom Runtime.rejecting main fuel { initial with memory }
+    need (failed.status == .halted 0 && failed.core.registers .rsp == initial.registers .rsp) "native capacity guard did not reject"
+    for slot in [:layout.slots] do
+      need (failed.core.memory.read64 (layout.address slot) == memory.read64 (layout.address slot))
+        "native capacity rejection modified arena memory"
+    failures := failures.push (toJson label)
+  return Json.mkObj [("value", toJson observed), ("root", toJson (1 : Nat)),
+    ("returned", returned), ("reclaimed", reclaimed), ("prefixes", Json.arr prefixes),
+    ("capacity_rejections", Json.arr failures)]
+
+structure CaseResult where
+  name : String
+  summary : Json
+  snapshot : Json
+  mainObject : ByteArray
+  releaseObject : ByteArray
+
+private def objectJson (name : String) (object : Object) (program : Program) : Json :=
+  Json.mkObj [("file", toJson s!"{name}-{object.role.name}.o"), ("role", toJson object.role.name),
+    ("symbol", toJson object.role.symbol), ("identity", toJson (Address.blake3 object.bytes)),
+    ("size", toJson object.bytes.size), ("policy_identity", toJson object.policyIdentity),
+    ("policy_bytes", Coverage.byteJson object.policyBytes), ("provenance", Coverage.byteJson object.provenance.bytes),
+    ("lowering_version", toJson nativeLoweringVersion.toNat), ("role_version", toJson object.role.policyVersion.toNat),
+    ("text", Coverage.byteJson object.encoded.text), ("blocks", toJson object.encoded.blockOffsets),
+    ("relocations", toJson object.encoded.relocations.size), ("typed_program_diagnostic", toJson (reprStr program))]
+
+def runCase (name : String) (values : List Nat) : Except String CaseResult := do
+  let source ← UniqueReuse.Examples.source values
+  let compilation ← (UniqueReuse.compile source.constants source.entry source.config).mapError reprStr
+  let .native output := Native.select compilation | throw "eligible source skipped native selection"
+  let sourceResult ← UniqueReuse.Examples.runCase name values
+  let sourcePolicy ← sourceResult.summary.getObjVal? "provenance"
+  need (sourcePolicy == toJson compilation.provenance.identity)
+    "native and source snapshot compilation identities disagree"
+  let main ← output.emit .main
+  let release ← output.emit .release
+  let observations ← observe output.canonicalLayout output.words output.main output.release
+  let returnedHeader ← (← observations.getObjVal? "returned").getObjVal? "header"
+  let reclaimedHeader ← (← observations.getObjVal? "reclaimed").getObjVal? "header"
+  let summary := Json.mkObj [("name", toJson name), ("input", toJson values), ("value", toJson values.reverse),
+    ("source_identity", toJson compilation.provenance.source), ("ixir1_root", toJson compilation.provenance.graph),
+    ("source_policy", toJson compilation.provenance.identity), ("main_policy", toJson main.policyIdentity),
+    ("release_policy", toJson release.policyIdentity), ("main_object", toJson s!"{name}-main.o"),
+    ("release_object", toJson s!"{name}-release.o"), ("main_object_identity", toJson (Address.blake3 main.bytes)),
+    ("release_object_identity", toJson (Address.blake3 release.bytes)), ("snapshot", toJson s!"{name}.json"),
+    ("main_steps", toJson (UniqueTarget.controlCost output.words)),
+    ("release_steps", toJson (UniqueTarget.releaseCost output.words.length)),
+    ("headers", Json.mkObj [("returned", returnedHeader), ("reclaimed", reclaimedHeader)])]
+  let snapshot := Json.mkObj [("format", toJson "compilatrix/source-native-unique-case/1"), ("summary", summary),
+    ("source_pipeline", sourceResult.snapshot), ("abi", Json.mkObj [("policy", toJson UniqueABI.policyTag),
+      ("selector", toJson UniqueTarget.policyTag), ("max_length", toJson maxLength),
+      ("header_words", toJson headerWords), ("cell_words", toJson cellWords)]),
+    ("main", objectJson name main output.main.program), ("release", objectJson name release output.release.program),
+    ("observations", observations)]
+  return { name, summary, snapshot, mainObject := main.bytes, releaseObject := release.bytes }
+
+def cases : List (String × List Nat) :=
+  [("empty", []), ("zero", [0]), ("singleton", [17]), ("three", [1, 2, 3]),
+    ("mixed-words", [0, 18446744073709551615, 3, 3, 0, 18446744073709551608, 42]),
+    ("word-max", [18446744073709551615]), ("repeated", [9, 9, 9, 9, 9]), ("sixty-four", List.range 64)]
+
+def rejections : Except String (Array Json) := do
+  let mut rows := #[]
+  for (name, values, policy, limits, fragment) in [
+      ("word-overflow", [UInt64.size], ({} : IxIR2.UniqueLower.ReusePolicy), IxIR2.Validate.defaultLimits, "64-bit Word"),
+      ("word-overflow-mixed", [7, UInt64.size + 7], {}, IxIR2.Validate.defaultLimits, "64-bit Word"),
+      ("length-sixty-five", List.range 65, {}, IxIR2.Validate.defaultLimits, "exceeds 64"),
+      ("static-reuse-disabled", [1, 2, 3], { enabled := false }, IxIR2.Validate.defaultLimits, "selected static reuse"),
+      ("rewrite-budget-zero", [1, 2, 3], { maxRewrites := 0 }, IxIR2.Validate.defaultLimits, "selected static reuse"),
+      ("target-limit-zero", [1, 2, 3], {}, { IxIR2.Validate.defaultLimits with maxDeclarations := 0 }, "translated target")] do
+    let source ← UniqueReuse.Examples.source values 65
+    let compilation ← (UniqueReuse.compile source.constants source.entry source.config 1000 1000 1000 limits policy).mapError reprStr
+    let .skipped reason := Native.select compilation | throw s!"{name}: native rejection unexpectedly selected"
+    need (reason.contains fragment) s!"{name}: wrong native rejection: {reason}"
+    let fallback := match compilation.backend with | .ownedOnly _ => "ixir1-consuming" | .translated _ => "ixir2-checked"
+    rows := rows.push (Json.mkObj [("name", toJson name), ("reason", toJson reason), ("fallback", toJson fallback),
+      ("input_length", toJson values.length), ("provenance", toJson compilation.provenance.identity)])
+  return rows
+
+def report (results : List CaseResult) (rejections : Array Json) : Json :=
+  Json.mkObj [("format", toJson "compilatrix/source-native-unique-report/1"),
+    ("cases", toJson (results.map (·.summary))), ("selection_rejections", Json.arr rejections)]
+
+end Ix.Compiler.UniqueReuse.Native.Examples
diff --git a/Ix/Compiler/UniqueReuse/NativeSim.lean b/Ix/Compiler/UniqueReuse/NativeSim.lean
new file mode 100644
index 000000000..936014b83
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/NativeSim.lean
@@ -0,0 +1,130 @@
+import Ix.Compiler.UniqueReuse.Native
+import Ix.Compiler.UniqueReuse.PipelineSim
+import Ix.Compiler.X86.UniqueResult
+
+/-! Source refinement for the actual checked native selection. The source
+contract is unchanged; the native conclusion constructs its heap from a fresh
+arena and proves both calls, the value graph, resource agreement, and complete
+reclamation. No caller-supplied list, ownership, or cost premise is required. -/
+
+namespace Ix.Compiler.UniqueReuse.Native
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.X86
+open Ix.Compiler.X86.UniqueABI
+open Ix.Compiler.X86.UniqueExecution
+
+variable {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+  {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+
+/-- The full source constructor identities interpret the selected ABI tags. -/
+def ValueRel (schema : IxIR0.UniqueReverse.Schema) (memory : Memory) (value : IxIR0.Value) (root : Word) : Prop :=
+  ∃ values nodes, value = IxIR0.UniqueReverse.listValue schema values ∧ NativeList memory values root nodes
+
+structure Execution {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (layout : Layout) (registers : Registers) (outside : Memory) (runtime : Runtime)
+    (returned : State) (returnedMemory : Memory) (reclaimed : State) (reclaimedMemory : Memory) : Prop where
+  returnedResult : UniqueExecution.LoopResult layout output.words.reverse (mainCounts output.words.length)
+    ⟨registers, initialWords layout⟩ returned
+  returnedView : Realizes layout outside returned.words returnedMemory
+  value : ValueRel compilation.plan.schema returnedMemory compilation.plan.value (returned.registers .rax)
+  graph : NativeList returnedMemory compilation.plan.values.reverse (returned.registers .rax)
+    (chainNodes layout 1 output.words.length)
+  mainRun : runFrom runtime output.main (UniqueTarget.controlCost output.words)
+    ⟨registers, initialMemory layout outside⟩ = haltedLeaf (returned.core returnedMemory) 4 13
+  reclaimedResult : Reclaimed layout output.words.length ⟨registers, initialWords layout⟩ reclaimed
+  reclaimedView : Realizes layout outside reclaimed.words reclaimedMemory
+  releaseRun : runFrom runtime output.release (UniqueTarget.releaseCost output.words.length)
+    (returned.core returnedMemory) = haltedLeaf (reclaimed.core reclaimedMemory) 2 13
+
+theorem Execution.mainSafe {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    {output : Output compilation} {layout : Layout} {registers : Registers} {outside : Memory} {runtime : Runtime}
+    {returned reclaimed : State} {returnedMemory reclaimedMemory : Memory}
+    (execution : Execution output layout registers outside runtime returned returnedMemory reclaimed reclaimedMemory)
+    (count : Nat) (bound : count ≤ UniqueTarget.controlCost output.words) (fault : Trap) :
+    (runFrom runtime output.main count ⟨registers, initialMemory layout outside⟩).status ≠ .trapped fault :=
+  run_prefix_not_trapped execution.mainRun rfl count bound fault
+
+theorem Execution.releaseSafe {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    {output : Output compilation} {layout : Layout} {registers : Registers} {outside : Memory} {runtime : Runtime}
+    {returned reclaimed : State} {returnedMemory reclaimedMemory : Memory}
+    (execution : Execution output layout registers outside runtime returned returnedMemory reclaimed reclaimedMemory)
+    (count : Nat) (bound : count ≤ UniqueTarget.releaseCost output.words.length) (fault : Trap) :
+    (runFrom runtime output.release count (returned.core returnedMemory)).status ≠ .trapped fault :=
+  run_prefix_not_trapped execution.releaseRun rfl count bound fault
+
+theorem Output.executes {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (layout : Layout) (registers : Registers)
+    (capacity : output.words.length + 2 ≤ layout.capacity) (context : registers .rdi = layout.base)
+    (outside : Memory) (runtime : Runtime) :
+    ∃ returned returnedMemory reclaimed reclaimedMemory,
+      Execution output layout registers outside runtime returned returnedMemory reclaimed reclaimedMemory := by
+  obtain ⟨returned, returnedMemory, reclaimed, reclaimedMemory, result, returnedView, graph, mainRun,
+    reclaimedResult, reclaimedView, releaseRun⟩ := mainAndRelease layout output.words registers capacity context
+      outside runtime output.main output.release output.mainProduced output.releaseProduced
+  rw [output.valuesExact, ← result.result] at graph
+  exact ⟨returned, returnedMemory, reclaimed, reclaimedMemory, result, returnedView,
+    ⟨compilation.plan.values.reverse, _, rfl, graph⟩, graph, mainRun, reclaimedResult, reclaimedView, releaseRun⟩
+
+def targetCounts (store : IxIR2.Eval.Store) : Counts :=
+  { allocs := store.heap.allocs
+    frees := store.heap.frees
+    reuses := store.heap.reuses
+    live := store.live
+    peak := store.peakLiveNodes
+    payload := store.reusedPayloadUnits }
+
+/-- Resource observations agree with the physical, statically reused IxIR₂
+execution selected by the same compilation certificate. -/
+theorem Output.costsAgree {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) {layout : Layout} {before after : State}
+    (native : UniqueExecution.LoopResult layout output.words.reverse (mainCounts output.words.length) before after)
+    {store : IxIR2.Eval.Store} {value : IxIR1.RVal}
+    (target : Target.MainResult compilation.plan true .physical store value) :
+    CountsAt layout (targetCounts store) after.words := by
+  have equal : targetCounts store = mainCounts output.words.length := by
+    simp [targetCounts, target.allocs, target.frees, target.reuses, target.live, target.peak, target.payload,
+      Target.freshPerCons, Target.reusesPerCons, Target.inPlace, output.sourceLength, mainCounts]
+  rw [equal]
+  exact native.countsAt
+
+/-- A concrete witness needs no additional native-memory hypothesis. General
+clients can instead use `executes` with any valid arena base and larger capacity. -/
+def Output.canonicalLayout {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) : Layout :=
+  { base := 0x1000
+    capacity := output.words.length + 2
+    capacityBound := Nat.add_le_add_right output.lengthBound 2
+    aligned := by decide
+    nonzero := by decide
+    fits := by
+      have bound := output.lengthBound
+      change output.words.length ≤ 64 at bound
+      change 4096 + 80 + 32 * (output.words.length + 2) ≤ 18446744073709551616
+      omega }
+
+structure SourceNativeResult {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (sourceValue : Ixon.Eval.Value) : Prop where
+  source : SourceResult compilation sourceValue
+  native : ∀ (layout : Layout) (registers : Registers), output.words.length + 2 ≤ layout.capacity → registers .rdi = layout.base →
+    ∀ (outside : Memory) (runtime : Runtime), ∃ returned returnedMemory reclaimed reclaimedMemory,
+      Execution output layout registers outside runtime returned returnedMemory reclaimed reclaimedMemory
+
+theorem Output.sourceRefines {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel entry.frame []
+      entry.source = .ok sourceValue) : SourceNativeResult output sourceValue :=
+  ⟨compilation.sourceRefinesWithCostLaws horacles hctx hsource, output.executes⟩
+
+theorem SourceNativeResult.witness {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    {output : Output compilation} {sourceValue : Ixon.Eval.Value} (result : SourceNativeResult output sourceValue) :
+    ∃ returned returnedMemory reclaimed reclaimedMemory,
+      Execution output output.canonicalLayout (Registers.zero.set .rdi output.canonicalLayout.base)
+        Memory.unmapped Runtime.rejecting returned returnedMemory reclaimed reclaimedMemory :=
+  result.native output.canonicalLayout _ (Nat.le_refl _) (by simp) Memory.unmapped Runtime.rejecting
+
+end Ix.Compiler.UniqueReuse.Native
diff --git a/Ix/Compiler/UniqueReuse/Observations.lean b/Ix/Compiler/UniqueReuse/Observations.lean
new file mode 100644
index 000000000..8721d5659
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Observations.lean
@@ -0,0 +1,203 @@
+import Ix.Compiler.UniqueReuse.Sources
+import Ix.Compiler.UniqueReuse.Provenance
+import Ix.Compiler.Coverage.HeapSnapshot
+import Ix.Compiler.IxIR2.ReservationOwnership
+
+namespace Ix.Compiler.UniqueReuse.Examples
+
+open Lean Ix.Compiler.Ixon
+
+deriving instance ToJson for IxIR0.UniqueReverse.Schema
+deriving instance ToJson for IxIR0.UniqueReverse.Plan
+deriving instance ToJson for IxIR2.Validate.Limits
+
+def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+def sourceList? (source : Source) : Nat → Ixon.Eval.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctorV block 1 tag fields =>
+      if block != source.dataBlock then none else match tag, fields with
+        | 0, [] => some []
+        | 1, [.litV (.natL n), tail] => (n :: ·) <$> sourceList? source fuel tail
+        | _, _ => none
+  | _, _ => none
+
+def list0? (source : Source) : Nat → IxIR0.Value → Option (List Nat)
+  | 0, _ => none
+  | fuel + 1, .ctor address tag fields =>
+      if address == source.nil && tag == 0 && fields.isEmpty then some []
+      else if address == source.cons && tag == 1 then match fields with
+        | [.lit (.nat n), tail] => (n :: ·) <$> list0? source fuel tail
+        | _ => none
+      else none
+  | _, _ => none
+
+def list1? (source : Source) : Nat → IxIR1.Store → IxIR1.RVal → Option (List Nat)
+  | 0, _, _ => none
+  | fuel + 1, store, .loc location => do
+      let box ← store.get? location
+      if box.world != .unique || box.rc != 1 then none else
+        let .ctorN identity fields := box.node | none
+        if identity == IxIR1.Lower.ctorIdOf source.nil 0 && fields.isEmpty then some []
+        else if identity == IxIR1.Lower.ctorIdOf source.cons 1 then match fields.toList with
+          | [.lit (.nat n), tail] => (n :: ·) <$> list1? source fuel store tail
+          | _ => none
+        else none
+  | _, _, _ => none
+
+private def observe0 (source : Source) (entries : List (Address × IxIR0.Decl)) (main : IxIR0.Expr) :
+    Except String Unit := do
+  let value ← (IxIR0.eval { env := IxIR0.Env.ofList entries } 10000 [] main).mapError reprStr
+  need (list0? source 1000 value == some source.values.reverse) "IxIR0 value disagreement"
+
+def observe1 (source : Source) (plan : IxIR0.UniqueReverse.Plan) : Except String Json := do
+  let context : IxIR1.Ctx := { decls := IxIR1.Env.ofList (declarations plan.schema) }
+  let (store, value) ← (IxIR1.runOwnedMain context .unique (mainCode plan) 10000).mapError reprStr
+  need (list1? source 1000 store value == some source.values.reverse) "IxIR1 unique value disagreement"
+  let reclaimed ← (IxIR1.dropUVal context (3 * source.values.length + 2) store value).mapError reprStr
+  need (store.allocs == 2 * source.values.length + 2 && store.frees == source.values.length + 1 &&
+    store.reuses == 0 && store.rcops == 0 && store.live == source.values.length + 1) "IxIR1 counter disagreement"
+  need (reclaimed.live == 0 && reclaimed.allocs == reclaimed.frees && reclaimed.rcops == 0 && reclaimed.reuses == 0)
+    "IxIR1 reclamation disagreement"
+  return Json.mkObj [("value", toJson source.values.reverse), ("result", toJson value),
+    ("store", toJson store), ("reclaimed", toJson reclaimed)]
+
+private def observe2 (source : Source) (plan : IxIR0.UniqueReverse.Plan) (reuse : Bool)
+    (mode : IxIR2.Eval.Interpretation) : Except String (IxIR2.Eval.Result × Json) := do
+  let program := IxIR2.UniqueLower.program plan reuse
+  let context := IxIR2.Eval.Context.ofProgram program (IxIR2.UniqueLower.schemas plan.schema)
+  let result ← (IxIR2.Eval.runMain context mode program 10000 0).mapError reprStr
+  need (list1? source 1000 result.store.heap result.value == some source.values.reverse) "IxIR2 unique value disagreement"
+  let (reclaimed, remaining) ← (IxIR2.Eval.dropUnique (2 * source.values.length + 1) result.store result.value).mapError reprStr
+  let count := source.values.length
+  let reused := if reuse && mode == .physical then count else 0
+  let counters := result.store.counters
+  need (counters.allocs + reused == 2 * count + 2 && counters.frees + reused == count + 1 &&
+    counters.reuses == reused && counters.rcops == 0 && counters.resetAttempts == 0 && counters.hotResets == 0 &&
+    counters.coldResets == 0 && counters.reusedPayloadUnits == 2 * reused &&
+    counters.peakLiveNodes == count + 2 && result.store.live == count + 1) "IxIR2 FIP counter disagreement"
+  need (result.controlRemaining + (if reuse then 5 else 6) * count + 7 == 10000 && result.heapRemaining == 0)
+    "IxIR2 independent budget disagreement"
+  need (remaining == 0 && reclaimed.live == 0 && reclaimed.heap.allocs == reclaimed.heap.frees &&
+    reclaimed.heap.rcops == 0 && reclaimed.heap.reuses == reused &&
+    reclaimed.peakLiveNodes == counters.peakLiveNodes && reclaimed.reusedPayloadUnits == 2 * reused)
+    "IxIR2 reclamation disagreement"
+  return (result, Json.mkObj [("value", toJson source.values.reverse), ("result", toJson result.value), ("store", toJson result.store),
+    ("reclaimed", toJson reclaimed), ("control_remaining", toJson result.controlRemaining),
+    ("heap_remaining", toJson result.heapRemaining), ("reclamation_remaining", toJson remaining)])
+
+private def prefixes (plan : IxIR0.UniqueReverse.Plan) (reuse : Bool) (final : IxIR2.Eval.Result) :
+    Except String (Array Json) := do
+  let program := IxIR2.UniqueLower.program plan reuse
+  let context := IxIR2.Eval.Context.ofProgram program (IxIR2.UniqueLower.schemas plan.schema)
+  let mut machine := IxIR2.Eval.initialMachine program.main #[] 0
+  let mut rows := #[]
+  for index in [:10001] do
+    let owners := machine.reservations
+    let emptySlots := (List.range machine.store.heap.nodes.size).filter fun location =>
+      match machine.store.heap.nodes[location]? with | some none => true | _ => false
+    need (owners.eraseDups.length == owners.length && owners.all emptySlots.contains)
+      "prefix reservation duplicated or aliases a live slot"
+    need (machine.store.live + machine.store.heap.frees + owners.length == machine.store.heap.allocs)
+      "prefix allocation accounting disagreement"
+    need (machine.store.heap.rcops == 0 && machine.store.live ≤ machine.store.peakLiveNodes &&
+      machine.store.peakLiveNodes ≤ plan.values.length + 2 && machine.heapFuel == 0) "prefix RC, peak, or budget disagreement"
+    rows := rows.push (Json.mkObj [("step", toJson index), ("counters", toJson machine.store.counters),
+      ("live", toJson machine.store.live), ("owners", toJson owners), ("empty_slots", toJson emptySlots)])
+    match machine.control with
+    | .halted value =>
+        need (toJson machine.store == toJson final.store && value == final.value) "prefix endpoint differs from runMain"
+        return rows
+    | .running _ stack =>
+        need stack.isEmpty "unique tail recursion unexpectedly suspended a caller"
+        machine ← (IxIR2.Eval.step context .physical machine).mapError reprStr
+  throw "unique prefix traversal exceeded its execution budget"
+
+structure CaseResult where
+  name : String
+  summary : Json
+  snapshot : Json
+
+def runCase (name : String) (values : List Nat) (policy : IxIR2.UniqueLower.ReusePolicy := {}) :
+    Except String CaseResult := do
+  let source ← Examples.source values
+  for (address, constant) in source.constants do
+    need (Address.blake3 (ser constant) == address &&
+      (de (ser constant) : Except String Constant).toOption == some constant) "source codec or content address disagreement"
+  let sourceValue ← (Ixon.Eval.eval (Pipeline.validatedEvalCtx source.constants source.config)
+    10000 source.mainFrame [] Source.main).mapError reprStr
+  need (sourceList? source 1000 sourceValue == some values.reverse) "Ixon value disagreement"
+  let compilation ← (compile source.constants source.entry source.config 1000 1000 1000
+    IxIR2.Validate.defaultLimits policy).mapError reprStr
+  let plan := compilation.plan
+  let recovery := compilation.lowered.checked.recovery
+  let .translated target := compilation.backend | throw "unique target unexpectedly unavailable"
+  need (plan.values == values && target.selection.reused == (policy.enabled && policy.maxRewrites > 0))
+    "source plan or selection disagreement"
+  let erased := compilation.source.erasure.result
+  observe0 source erased.raw compilation.source.rawMain
+  observe0 source erased.declarations erased.main
+  observe0 source (IxIR0.UniqueReverse.targetDeclarations plan recovery.address) (plan.directMain recovery.address)
+  let owned ← observe1 source plan
+  let (baselineLogical, baselineLogicalJson) ← observe2 source plan false .logical
+  let (baseline, baselineJson) ← observe2 source plan false .physical
+  let (logical, logicalJson) ← observe2 source plan target.selection.reused .logical
+  let (physical, physicalJson) ← observe2 source plan target.selection.reused .physical
+  need (baselineLogical.store.counters == baseline.store.counters && logical.store.counters == baseline.store.counters)
+    "logical baseline/selected counters differ"
+  let prefixes ← prefixes plan target.selection.reused physical
+  let provenance := compilation.provenance
+  let summary := Json.mkObj [("name", toJson name), ("input", toJson values), ("value", toJson values.reverse),
+    ("source_root", toJson source.root), ("source_identity", toJson provenance.source),
+    ("ixir1_root", toJson provenance.graph), ("source_instance", toJson provenance.recursorInstance),
+    ("specialized_instance", toJson provenance.specializedInstance), ("provenance", toJson provenance.identity),
+    ("optimized", toJson target.selection.reused), ("baseline", toJson baseline.store.counters),
+    ("logical", toJson logical.store.counters), ("physical", toJson physical.store.counters),
+    ("prefixes", toJson prefixes.size), ("snapshot", toJson s!"{name}.json")]
+  let instanceJson := fun (inst : IxIR0.RecursorInstance) => Json.mkObj [
+    ("identity", toJson inst.address), ("bytes", Coverage.byteJson inst.bytes),
+    ("declaration", Coverage.byteJson inst.declaration.preimage), ("arguments", toJson inst.arguments),
+    ("fields", toJson inst.fields), ("result", toJson inst.result), ("well_shaped", toJson inst.wellShaped)]
+  let snapshot := Json.mkObj [("format", toJson "compilatrix/source-unique-reuse-case/1"), ("summary", summary),
+    ("source", Json.mkObj [("root", toJson source.root), ("identity", toJson provenance.source),
+      ("input_bytes", Coverage.byteJson (sourceBytes source.constants source.entry)), ("limits", toJson source.config.limits),
+      ("constants", toJson (source.constants.map fun (address, constant) => Json.mkObj [
+        ("key", toJson address), ("bytes", Coverage.byteJson (ser constant))])),
+      ("literals", toJson (values.eraseDups.map fun value => (X86.ValidatedScalar.literalAddress value, value))),
+      ("entry", Coverage.byteJson (ser source.entry.source)), ("entry_refs", toJson source.entry.refs),
+      ("entry_univs", toJson (source.entry.univs.toList.map fun univ => Coverage.byteJson (ser univ)))]),
+    ("ixir0", Json.mkObj [("raw", Coverage.ir0Entries erased.raw), ("raw_main", Coverage.byteJson compilation.source.rawMain.bytes),
+      ("declarations", Coverage.ir0Entries erased.declarations), ("main", Coverage.byteJson erased.main.bytes),
+      ("groups", toJson (erased.groups.map Coverage.ir0Group)), ("blocks", toJson (erased.addressed.blocks.map Coverage.ir0Block)),
+      ("address_map", toJson erased.addressMap)]),
+    ("specialization", Json.mkObj [("plan", toJson plan), ("policy", toJson IxIR0.UniqueReverse.policyTag),
+      ("source_instance", instanceJson IxIR0.UniqueReverse.sourceInstance),
+      ("direct_instance", instanceJson (IxIR0.UniqueReverse.directInstance plan.schema)),
+      ("declarations", Coverage.ir0Entries (IxIR0.UniqueReverse.targetDeclarations plan recovery.address)),
+      ("main", Coverage.byteJson (plan.directMain recovery.address).bytes)]),
+    ("ixir1", Json.mkObj [("root", toJson provenance.graph), ("main", Coverage.byteJson (mainCode plan).bytes),
+      ("declarations", Coverage.ir1Entries (declarations plan.schema)),
+      ("artifacts", toJson ((artifacts plan.schema).map Coverage.ir1Artifact))]),
+    ("provenance", Json.mkObj [("kind", toJson "ixir1-plus-policy"), ("identity", toJson provenance.identity),
+      ("bytes", Coverage.byteJson provenance.bytes), ("usage", toJson Ixon.RecursorUsage.policyTag),
+      ("lowering", toJson IxIR2.UniqueLower.policyTag), ("reuse", toJson IxIR2.UniqueLower.reusePolicyTag),
+      ("execution", toJson IxIR2.CreditPolicy.callLocalV0.tag), ("outcome", toJson provenance.outcome),
+      ("check_fuel", toJson provenance.checkFuel), ("erase_fuel", toJson provenance.eraseFuel)]),
+    ("ixir2_diagnostic", Json.mkObj [("baseline", toJson (IxIR2.UniqueLower.program plan false)),
+      ("selected", toJson target.selection.program), ("baseline_stats", toJson target.translation.checked.stats),
+      ("selected_stats", toJson target.selection.checked.stats), ("limits", toJson IxIR2.Validate.defaultLimits),
+      ("schemas", toJson ([nilId plan.schema, consId plan.schema].map fun cid =>
+        (cid, IxIR2.UniqueLower.schemas plan.schema .unique cid)))]),
+    ("observations", Json.mkObj [("ixir1", owned), ("baseline_logical", baselineLogicalJson),
+      ("baseline_physical", baselineJson), ("selected_logical", logicalJson), ("selected_physical", physicalJson)]),
+    ("prefixes", toJson prefixes)]
+  return { name, summary, snapshot }
+
+def cases : List (String × List Nat × IxIR2.UniqueLower.ReusePolicy) :=
+  [("empty", [], {}), ("singleton", [17], {}), ("three", [1, 2, 3], {}),
+    ("mixed-values", [0, UInt64.size, 3, 3, 0, UInt64.size + 7, 42], {}),
+    ("sixty-four", List.range 64, {}), ("disabled", [1, 2, 3], { enabled := false }),
+    ("rewrite-budget", [1, 2, 3], { maxRewrites := 0 })]
+
+end Ix.Compiler.UniqueReuse.Examples
diff --git a/Ix/Compiler/UniqueReuse/Pipeline.lean b/Ix/Compiler/UniqueReuse/Pipeline.lean
new file mode 100644
index 000000000..f6609ef66
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Pipeline.lean
@@ -0,0 +1,52 @@
+import Ix.Compiler.IxIR2.UniqueLower
+
+/-! Opt-in source compilation for the checked unique reversal fragment.
+Optional target failure retains the consuming IxIR₁ artifact; static reuse
+failure retains its validated IxIR₂ baseline. -/
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.UniqueReverse (Plan)
+
+structure CompiledTarget (plan : Plan) (limits : IxIR2.Validate.Limits) where
+  translation : IxIR2.UniqueLower.Translation (IxIR2.UniqueLower.input plan) plan limits
+  selection : IxIR2.UniqueLower.Selection plan limits
+
+inductive Backend (plan : Plan) (limits : IxIR2.Validate.Limits) where
+  | ownedOnly (reason : String)
+  | translated (target : CompiledTarget plan limits)
+
+def buildTarget (plan : Plan) (limits : IxIR2.Validate.Limits)
+    (policy : IxIR2.UniqueLower.ReusePolicy) : Backend plan limits :=
+  match IxIR2.UniqueLower.translate plan limits with
+  | .error message => .ownedOnly message
+  | .ok translation => .translated
+      { translation, selection := IxIR2.UniqueLower.select plan limits translation.checked policy }
+
+structure Compilation (constants : List (Address × Constant)) (entry : Pipeline.ClosedEntry)
+    (config : Pipeline.Config) (checkFuel eraseFuel : Nat) (limits : IxIR2.Validate.Limits) where
+  source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique checkFuel eraseFuel
+  lowered : Lowered source
+  backend : Backend lowered.plan limits
+
+def Compilation.plan {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits) : Plan := compilation.lowered.plan
+
+inductive Error where
+  | source (error : Pipeline.Error)
+  | ownership (detail : String)
+  deriving Repr
+
+def compile (constants : List (Address × Constant)) (entry : Pipeline.ClosedEntry)
+    (config : Pipeline.Config := {}) (checkFuel : Nat := 1000) (eraseFuel : Nat := 1000)
+    (validateFuel : Nat := 1000) (limits : IxIR2.Validate.Limits := IxIR2.Validate.defaultLimits)
+    (policy : IxIR2.UniqueLower.ReusePolicy := {}) :
+    Except Error (Compilation constants entry config checkFuel eraseFuel limits) := do
+  let source ← (Pipeline.certifyErasure constants entry config .saturatedRecursorV1 .unique
+    checkFuel eraseFuel validateFuel).mapError .source
+  let lowered ← (lower source).mapError .ownership
+  return { source, lowered, backend := buildTarget lowered.plan limits policy }
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/PipelineSim.lean b/Ix/Compiler/UniqueReuse/PipelineSim.lean
new file mode 100644
index 000000000..642b44330
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/PipelineSim.lean
@@ -0,0 +1,96 @@
+import Ix.Compiler.UniqueReuse.Pipeline
+import Ix.Compiler.UniqueReuse.TargetSim
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.UniqueReverse (Plan)
+
+def OwnedSemantics (plan : Plan) : Prop :=
+  ∃ fuel store value reclaimed,
+    IxIR1.runOwnedMain { decls := IxIR1.Env.ofList (declarations plan.schema) }
+      .unique (mainCode plan) fuel = .ok (store, value) ∧
+    MainResult plan store value ∧
+    IxIR1.dropUVal { decls := IxIR1.Env.ofList (declarations plan.schema) }
+      (3 * plan.values.length + 2) store value = .ok reclaimed ∧
+    reclaimed.live = 0 ∧ reclaimed.frees = reclaimed.allocs ∧
+    Released1 store reclaimed (plan.values.length + 1) []
+
+theorem ownedSemantics (plan : Plan) : OwnedSemantics plan := by
+  obtain ⟨fuel, store, value, run, result⟩ := mainExists plan
+  obtain ⟨reclaimed, release, released⟩ := release1
+    { decls := IxIR1.Env.ofList (declarations plan.schema) } result.owned result.list
+  have live := released.live release
+  refine ⟨fuel, store, value, reclaimed, run, result, by simpa using release, ?_, ?_, by simpa using released⟩
+  · rw [result.live] at live
+    simp only [List.length_reverse] at live
+    omega
+  · rw [released.allocs, released.frees, result.allocs, result.frees]
+    simp only [List.length_reverse]
+    omega
+
+def TargetSemantics (plan : Plan) (reuse : Bool) (mode : IxIR2.Eval.Interpretation)
+    (extraControl heapFuel : Nat) (result : IxIR2.Eval.Result) : Prop :=
+  IxIR2.Eval.runMain (Target.context plan reuse) mode (IxIR2.UniqueLower.program plan reuse)
+    (Target.controlCost plan reuse + extraControl) heapFuel = .ok result ∧
+  Target.MainResult plan reuse mode result.store result.value ∧
+  result.controlRemaining = extraControl ∧ result.heapRemaining = heapFuel ∧
+  ∃ reclaimed,
+    IxIR2.Eval.dropUnique (2 * plan.values.length + 1) result.store result.value = .ok (reclaimed, 0) ∧
+    reclaimed.live = 0 ∧ reclaimed.heap.frees = reclaimed.heap.allocs ∧
+    Released2 result.store reclaimed (plan.values.length + 1) []
+
+theorem targetSemantics (plan : Plan) (reuse : Bool) (mode : IxIR2.Eval.Interpretation)
+    (extraControl heapFuel : Nat) : ∃ result, TargetSemantics plan reuse mode extraControl heapFuel result := by
+  obtain ⟨result, run, semantics, control, heap⟩ := Target.mainRuns plan reuse mode extraControl heapFuel
+  exact ⟨result, run, semantics, control, heap, semantics.reclaims⟩
+
+def BackendSemantics {plan : Plan} {limits : IxIR2.Validate.Limits} : Backend plan limits → Prop
+  | .ownedOnly _ => True
+  | .translated target => ∀ extraControl heapFuel,
+      ∃ baseline selected logical,
+        TargetSemantics plan false .physical extraControl heapFuel baseline ∧
+        TargetSemantics plan target.selection.reused .physical extraControl heapFuel selected ∧
+        TargetSemantics plan target.selection.reused .logical extraControl heapFuel logical ∧
+        Target.CostLaws plan baseline.store selected.store target.selection.reused
+
+theorem backendSemantics {plan : Plan} {limits : IxIR2.Validate.Limits}
+    (backend : Backend plan limits) : BackendSemantics backend := by
+  cases backend with
+  | ownedOnly _ => trivial
+  | translated target =>
+      intro extraControl heapFuel
+      obtain ⟨baseline, base⟩ := targetSemantics plan false .physical extraControl heapFuel
+      obtain ⟨selected, physical⟩ := targetSemantics plan target.selection.reused .physical extraControl heapFuel
+      obtain ⟨logical, semantic⟩ := targetSemantics plan target.selection.reused .logical extraControl heapFuel
+      exact ⟨baseline, selected, logical, base, physical, semantic, Target.costLaws base.2.1 physical.2.1⟩
+
+structure SourceResult {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits)
+    (value : Ixon.Eval.Value) : Prop where
+  related : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList compilation.source.erasure.result.raw }
+    value compilation.plan.value compilation.source.memberScope
+  owned : OwnedSemantics compilation.plan
+  backend : BackendSemantics compilation.backend
+
+/-- Source-to-heap refinement, complete reclamation, and comparative static
+reuse laws from the actual compiler certificate. Optional target failure
+retains the proved consuming execution. No heap, liveness, shape, ownership,
+or cost hypothesis is added to the established source contract. -/
+theorem Compilation.sourceRefinesWithCostLaws
+    {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel compilation.source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel entry.frame []
+      entry.source = .ok sourceValue) : SourceResult compilation sourceValue :=
+  ⟨compilation.lowered.checked.sourceValue horacles hctx hsource,
+    ownedSemantics compilation.plan, backendSemantics compilation.backend⟩
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/Provenance.lean b/Ix/Compiler/UniqueReuse/Provenance.lean
new file mode 100644
index 000000000..a3fc98191
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Provenance.lean
@@ -0,0 +1,59 @@
+import Ix.Compiler.UniqueReuse.Pipeline
+import Ix.Compiler.IxIR1.Optimizer
+
+/-! Canonical IxIR₁ graph and explicit policy provenance. The source identity
+commits to the complete Ixon input bytes as well as their supplied keys and
+the explicit entry. Diagnostic IxIR₂ JSON has no wire or cache identity. -/
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR
+
+def sourceBytes (constants : List (Address × Constant)) (entry : Pipeline.ClosedEntry) : ByteArray :=
+  Encoding.domain "compilatrix/closed-ixon-input/1" ++ Encoding.tag 0 ++
+    Encoding.list (fun (address, constant) => Encoding.address address ++ Encoding.blob (Ixon.ser constant)) constants ++
+    Encoding.list Encoding.address entry.refs.toList ++
+    Encoding.list (fun univ => Encoding.blob (Ixon.ser univ)) entry.univs.toList ++
+    Encoding.blob (Ixon.ser entry.source)
+
+def targetLimitBytes (limits : IxIR2.Validate.Limits) : ByteArray :=
+  Encoding.list Encoding.nat [limits.maxDeclarations, limits.maxBlocks, limits.maxBlocksPerFunction,
+    limits.maxInstructionsPerBlock, limits.maxValueParams, limits.maxCreditParams, limits.maxOperands,
+    limits.maxAlternatives, limits.maxValueRegisters, limits.maxCreditRegisters, limits.maxScalarLeafFacts,
+    limits.maxFlowWork]
+
+structure Provenance where
+  source : Address
+  graph : Address
+  recursorInstance : Address
+  specializedInstance : Address
+  checkFuel : Nat
+  eraseFuel : Nat
+  limits : IxIR2.Validate.Limits
+  outcome : Nat
+
+def Provenance.bytes (provenance : Provenance) : ByteArray :=
+  Encoding.domain "compilatrix/unique-reuse-provenance/1" ++ Encoding.tag 0 ++
+    Encoding.address provenance.source ++ Encoding.address provenance.graph ++
+    Encoding.address provenance.recursorInstance ++ Encoding.address provenance.specializedInstance ++
+    Encoding.nat provenance.checkFuel ++ Encoding.nat provenance.eraseFuel ++ targetLimitBytes provenance.limits ++
+    Encoding.string Ixon.RecursorUsage.policyTag ++ Encoding.string IxIR0.UniqueReverse.policyTag ++
+    Encoding.string IxIR2.UniqueLower.policyTag ++ Encoding.string IxIR2.UniqueLower.reusePolicyTag ++
+    Encoding.string IxIR2.CreditPolicy.callLocalV0.tag ++ Encoding.nat provenance.outcome
+
+def Provenance.identity (provenance : Provenance) : Address := Address.blake3 provenance.bytes
+
+def Compilation.provenance {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits) : Provenance :=
+  { source := Address.blake3 (sourceBytes constants entry)
+    graph := IxIR1.Optimizer.graphRoot (artifacts compilation.plan.schema) (mainCode compilation.plan)
+    recursorInstance := IxIR0.UniqueReverse.sourceInstance.address
+    specializedInstance := compilation.lowered.checked.recovery.address
+    checkFuel, eraseFuel, limits
+    outcome := match compilation.backend with
+      | .ownedOnly _ => 0
+      | .translated target => if target.selection.reused then 2 else 1 }
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/Reclamation.lean b/Ix/Compiler/UniqueReuse/Reclamation.lean
new file mode 100644
index 000000000..d510e70a2
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Reclamation.lean
@@ -0,0 +1,136 @@
+import Ix.Compiler.UniqueReuse.Heap
+import Ix.Compiler.IxIR1.Mono
+import Ix.Compiler.IxIR2.HeapAccounting
+import Ix.Compiler.IxIR2.LowerSim
+
+/-! Complete unique-list release, including heaps whose links were reversed
+in place. Finite list views and exact owner counts replace an allocation-order
+premise; reuse need not preserve the original order of heap locations. -/
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema)
+
+private theorem consReleaseReady {store : Store} {schema : Schema} {location head : Nat}
+    {tail : RVal} {values : List Nat} {rest : List Root}
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (owned : RootOwnership store (⟨.unique, .loc location⟩ :: rest))
+    (next : ListAt schema store values tail) :
+    RootOwnership (store.kill location) (⟨.unique, tail⟩ :: rest) ∧
+      ListAt schema (store.kill location) values tail := by
+  have killed : RootOwnership (store.kill location)
+      (⟨.unique, .lit (.nat head)⟩ :: ⟨.unique, tail⟩ :: rest) := owned.killUniqueOne found
+  have ready := killed.dropNoLocation rfl
+  exact ⟨ready, next.ofRestricts (StoreGraphRestricts.kill found) ready
+    (ready.roots_world ⟨.unique, tail⟩ (by simp))⟩
+
+structure Released1 (before after : Store) (count : Nat) (rest : List Root) : Prop where
+  owned : RootOwnership after rest
+  allocs : after.allocs = before.allocs
+  frees : after.frees = before.frees + count
+  reuses : after.reuses = before.reuses
+  rcops : after.rcops = before.rcops
+
+theorem release1 (ctx : Ctx) {schema : Schema} {store : Store} {value : RVal}
+    {rest : List Root} {values : List Nat}
+    (owned : RootOwnership store (⟨.unique, value⟩ :: rest))
+    (list : ListAt schema store values value) :
+    ∃ output, dropUVal ctx (3 * values.length + 2) store value = .ok output ∧
+      Released1 store output (values.length + 1) rest := by
+  induction values generalizing store value with
+  | nil =>
+      cases list with
+      | nil found =>
+          refine ⟨store.kill _, ?_, owned.killUniqueOne found, rfl, ?_, rfl, rfl⟩
+          · simp [dropUVal, found, dropManyU]
+          · simp [Store.kill]
+  | cons head tail ih =>
+      cases list with
+      | @cons _ _ location tailValue found next =>
+          obtain ⟨ready, tailAt⟩ := consReleaseReady found owned next
+          obtain ⟨output, run, result⟩ := ih ready tailAt
+          refine ⟨output, ?_, result.owned, result.allocs, ?_, result.reuses, result.rcops⟩
+          · have count : 3 * (head :: tail).length + 2 = (3 * tail.length + 2) + 3 := by simp; omega
+            rw [count]
+            rw [dropUVal.eq_def]
+            simp only [found]
+            change dropManyU ctx ((3 * tail.length + 2) + 2) (store.kill location)
+              [.lit (.nat head), tailValue] = .ok output
+            rw [dropManyU.eq_def]
+            simp only [dropUVal, bind, Except.bind]
+            rw [dropManyU.eq_def]
+            simp only [run, bind, Except.bind, dropManyU]
+          · simpa [Store.kill, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using result.frees
+
+theorem Released1.live {ctx : Ctx} {fuel : Nat} {before after : Store} {value : RVal}
+    {count : Nat} {rest : List Root} (released : Released1 before after count rest)
+    (run : dropUVal ctx fuel before value = .ok after) : after.live + count = before.live := by
+  have operation : runOp ctx (fuel + 1) ⟨0, .unique, false, .ret .erased⟩ before [value]
+      (.dropU (.var 0)) = .ok (after, .erased) := by
+    cases value with
+    | loc location => exact runOp_dropU rfl run
+    | lit literal => cases fuel <;> simp_all [dropUVal, runOp, resolveAtom]
+    | erased => cases fuel <;> simp_all [dropUVal, runOp, resolveAtom]
+  have balance := (IxIR1.Reclamation.runOp_footprint operation).live_balance
+  rw [released.allocs, released.frees] at balance
+  omega
+
+structure Released2 (before after : IxIR2.Eval.Store) (count : Nat) (rest : List Root) : Prop where
+  owned : RootOwnership after.heap rest
+  allocs : after.heap.allocs = before.heap.allocs
+  frees : after.heap.frees = before.heap.frees + count
+  reuses : after.heap.reuses = before.heap.reuses
+  rcops : after.heap.rcops = before.heap.rcops
+  peak : after.peakLiveNodes = before.peakLiveNodes
+  attempts : after.resetAttempts = before.resetAttempts
+  hot : after.hotResets = before.hotResets
+  cold : after.coldResets = before.coldResets
+  payload : after.reusedPayloadUnits = before.reusedPayloadUnits
+
+theorem release2 {schema : Schema} {store : IxIR2.Eval.Store} {value : RVal}
+    {rest : List Root} {values : List Nat}
+    (owned : RootOwnership store.heap (⟨.unique, value⟩ :: rest))
+    (list : ListAt schema store.heap values value) :
+    ∃ output, IxIR2.Eval.dropUnique (2 * values.length + 1) store value = .ok (output, 0) ∧
+      Released2 store output (values.length + 1) rest := by
+  induction values generalizing store value with
+  | nil =>
+      cases list with
+      | nil found =>
+          refine ⟨store.kill _, ?_, owned.killUniqueOne found, rfl, ?_, rfl, rfl, rfl, rfl, rfl, rfl, rfl⟩
+          · simp [IxIR2.Eval.dropUnique, IxIR2.Eval.dropUniqueWork, IxIR2.Eval.Store.get?, found]
+          · simp [IxIR2.Eval.Store.kill, Store.kill]
+  | cons head tail ih =>
+      cases list with
+      | @cons _ _ location tailValue found next =>
+          obtain ⟨ready, tailAt⟩ := consReleaseReady found owned next
+          obtain ⟨output, run, result⟩ := ih (store := store.kill location) ready tailAt
+          refine ⟨output, ?_, result.owned, result.allocs, ?_, result.reuses, result.rcops,
+            result.peak, result.attempts, result.hot, result.cold, result.payload⟩
+          · have count : 2 * (head :: tail).length + 1 = (2 * tail.length + 1) + 2 := by simp; omega
+            rw [count]
+            simpa [IxIR2.Eval.dropUnique, IxIR2.Eval.dropUniqueWork, IxIR2.Eval.Store.get?,
+              found, List.append_nil] using run
+          · simpa [IxIR2.Eval.Store.kill, Store.kill, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using result.frees
+
+theorem Released2.live {fuel remaining : Nat} {before after : IxIR2.Eval.Store} {value : RVal}
+    {count : Nat} {rest : List Root} (released : Released2 before after count rest)
+    (run : IxIR2.Eval.dropUnique fuel before value = .ok (after, remaining)) :
+    after.live + count = before.live := by
+  have balance := IxIR2.Eval.dropUnique_heapBalance run
+  unfold IxIR2.Eval.HeapBalance at balance
+  rw [released.allocs, released.frees] at balance
+  omega
+
+theorem release2_complete {schema : Schema} {store : IxIR2.Eval.Store} {value : RVal} {values : List Nat}
+    (owned : RootOwnership store.heap [⟨.unique, value⟩])
+    (list : ListAt schema store.heap values value) (live : store.live = values.length + 1) :
+    ∃ output, IxIR2.Eval.dropUnique (2 * values.length + 1) store value = .ok (output, 0) ∧
+      output.live = 0 ∧ Released2 store output (values.length + 1) [] := by
+  obtain ⟨output, run, result⟩ := release2 owned list
+  have balance := result.live run
+  exact ⟨output, run, by omega, result⟩
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/Rejections.lean b/Ix/Compiler/UniqueReuse/Rejections.lean
new file mode 100644
index 000000000..ee4fd37f4
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Rejections.lean
@@ -0,0 +1,165 @@
+import Ix.Compiler.UniqueReuse.Observations
+
+namespace Ix.Compiler.UniqueReuse.Examples
+
+open Lean Ix.Compiler.Ixon
+
+private def rejected (value : Except ε α) : Bool := value.toOption.isNone
+
+private def replace (entries : List (Address × IxIR0.Decl)) (address : Address) (value : IxIR0.Decl) :=
+  entries.map fun entry => if entry.1 == address then (address, value) else entry
+
+private def ruleBody (replace : Ixon.Expr → Ixon.Expr) : Ixon.Expr → Ixon.Expr
+  | .lam mode domain rest => .lam mode domain (ruleBody replace rest)
+  | body => replace body
+
+def rejectionChecks : Except String (List String) := do
+  let source ← Examples.source [1, 2, 3]
+  let compiled ← (compile source.constants source.entry source.config).mapError reprStr
+  let plan := compiled.plan
+  let schema := plan.schema
+  let recovery := compiled.lowered.checked.recovery
+  let .translated target := compiled.backend | throw "rejection fixture has no target"
+  let resolve := (Pipeline.ResolverIndex.ofList source.constants).resolve
+  let some block := resolve source.dataBlock | throw "rejection fixture has no data block"
+  let .muts members := block.info | throw "rejection fixture data block is not mutual"
+  let some (.recr recursor) := (members[2]? : Option Ixon.MutConst) | throw "rejection fixture has no recursor"
+  let some consRule := recursor.rules[1]? | throw "rejection fixture has no cons rule"
+  let mut names := []
+  need (rejected (UsageCheck.checkConstant resolve block) &&
+    !rejected (RecursorUsage.checkConstant resolve block)) "unique recursor did not cross the explicit usage policy"
+  names := names ++ ["v0-remains-conservative", "v1-source-modes-accepted"]
+  for (name, changed) in [
+      ("indexed-recursor", { recursor with indices := 1 }),
+      ("motive-recursor", { recursor with motives := 1 }),
+      ("k-recursor", { recursor with k := true }),
+      ("recursor-telescope-arity", { recursor with minors := 1 }),
+      ("rule-field-count", { recursor with rules := recursor.rules.set! 1 { consRule with fields := 1 } })] do
+    need (rejected (RecursorUsage.checkConstant resolve { block with info := .muts (members.set! 2 (.recr changed)) }))
+      s!"{name}: source mode checker accepted"
+    names := names ++ [name]
+  for (name, body) in [
+      ("rule-drops-fields", ruleBody (fun _ => .var 2) consRule.rhs),
+      ("rule-duplicates-accumulator", ruleBody (fun body => match body with
+        | .app fn _ => .app fn (.var 2) | _ => body) consRule.rhs),
+      ("rule-partial-call", ruleBody (fun _ => .app (.var 3) (.var 1)) consRule.rhs),
+      ("rule-escaping-lambda", ruleBody (fun body => .lam .linear (.sort 0) body) consRule.rhs),
+      ("rule-unknown-callable", ruleBody (fun _ => .app (.var 0) (.var 1)) consRule.rhs)] do
+    let changed := { recursor with rules := recursor.rules.set! 1 { consRule with rhs := body } }
+    need (rejected (RecursorUsage.checkConstant resolve { block with info := .muts (members.set! 2 (.recr changed)) }))
+      s!"{name}: source rule checker accepted"
+    names := names ++ [name]
+  let inst := IxIR0.UniqueReverse.sourceInstance
+  for (name, changed) in [
+      ("argument-mode-identity", { inst with arguments := [.unique, .unique, .unique] }),
+      ("major-mode-identity", { inst with arguments := [.shared, .unique, .shared] }),
+      ("head-mode-identity", { inst with fields := [[], [.shared, .unique]] }),
+      ("tail-mode-identity", { inst with fields := [[], [.unique, .shared]] }),
+      ("result-mode-identity", { inst with result := .shared })] do
+    need (changed.wellShaped && changed.bytes != inst.bytes && changed.address != inst.address)
+      s!"{name}: canonical instance lost a mode"
+    names := names ++ [name]
+  need (!({ inst with arguments := [.unique] }).wellShaped &&
+    !({ inst with fields := [[], [.unique]] }).wellShaped) "malformed mode vectors accepted"
+  names := names ++ ["mode-vector-arity"]
+  let entries := compiled.source.erasure.result.raw
+  for (name, changed) in [
+      ("raw-wrong-builder", replace entries schema.builder (.defn .unique (.lam .linear (.lam .linear (.var 0))))),
+      ("raw-wrong-recursor", replace entries schema.recursor (.recursor 2 true #[])),
+      ("raw-wrong-cons-arity", replace entries schema.cons (.ctor 1 1)),
+      ("raw-wrong-nil-tag", replace entries schema.nil (.ctor 1 0)),
+      ("raw-wrong-alias", replace entries schema.alias (.defn .unique (.ref schema.recursor))),
+      ("raw-wrong-entry", replace entries recovery.checked.root (.defn .unique .erased))] do
+    need ((IxIR0.UniqueReverse.check changed compiled.source.rawMain plan).isNone &&
+      (IxIR0.UniqueReverse.recover changed compiled.source.rawMain).isNone) s!"{name}: specialization accepted"
+    names := names ++ [name]
+  need ((IxIR0.UniqueReverse.recover ((recovery.address, .defn .shared .erased) :: entries)
+    compiled.source.rawMain).isNone) "specialization address collision accepted"
+  names := names ++ ["instance-address-conflict"]
+  for (name, entry) in [("entry-shared-result", { source.entry with source := .ref 0 #[] }),
+      ("entry-free-variable", { source.entry with source := .var 0 }),
+      ("entry-unresolved-share", { source.entry with source := .share 0 })] do
+    need (rejected (compile source.constants entry source.config)) s!"{name}: source compiler accepted"
+    names := names ++ [name]
+  let entryBound := { source.config with limits := { source.config.limits with
+    maxExpressionUnits := (Work.programStats source.constants).expressionUnits } }
+  match compile source.constants source.entry entryBound with
+  | .error (.source (.resource exceeded)) =>
+      need (exceeded.metric == .programExpressionUnits) "wrong closed-entry work limit"
+  | _ => throw "closed entry escaped structural preflight"
+  names := names ++ ["closed-entry-work-budget"]
+  let baseline := IxIR2.UniqueLower.program plan false
+  let optimized := target.selection.program
+  let fn := IxIR2.UniqueLower.function schema true
+  let cons := IxIR2.UniqueLower.consBlock schema true
+  let nil := IxIR2.UniqueLower.nilBlock schema
+  let context := IxIR2.UniqueLower.context schema
+  for (name, changed) in [
+      ("target-duplicate-credit", { cons with instructions := cons.instructions.push (.discardCredit 0) }),
+      ("target-stranded-credit", { cons with
+        instructions := #[.takeUnique (.reg 1) (consId schema)]
+        terminator := .tailCallSelf #[.reg 0, .reg 3] }),
+      ("target-use-after-take", { cons with instructions := #[.takeUnique (.reg 1) (consId schema),
+        .allocWith 0 .unique (consId schema) #[.reg 2, .reg 1]] }),
+      ("target-duplicate-unique-field", { cons with instructions := #[.takeUnique (.reg 1) (consId schema),
+        .allocWith 0 .unique (consId schema) #[.reg 0, .reg 0]] }),
+      ("target-shared-reset-of-unique", { cons with instructions := #[.resetShared (.reg 1) (consId schema),
+        .allocWith 0 .unique (consId schema) #[.reg 2, .reg 0]] }),
+      ("target-wrong-constructor", { cons with instructions := #[.takeUnique (.reg 1) (nilId schema),
+        .allocWith 0 .unique (consId schema) #[.reg 2, .reg 0]] })] do
+    let program := { optimized with declarations := [(functionAddress schema, .fn { fn with blocks := fn.blocks.set! 2 changed })] }
+    need (rejected (IxIR2.Validate.validate context program)) s!"{name}: validator accepted"
+    names := names ++ [name]
+  let leaked := { optimized with declarations := [(functionAddress schema,
+    .fn { fn with blocks := fn.blocks.set! 1 { nil with instructions := #[] } })] }
+  need (rejected (IxIR2.Validate.validate context leaked)) "nil owner leaked through target return"
+  names := names ++ ["target-nil-leak"]
+  let foreign := { consId schema with cidx := 2 }
+  let foreignSchemas := fun world cid => if world == .unique && cid == foreign then
+    some { layout := Address.replicate 13, fields := #[.unique, .unique] : IxIR2.CtorSchema }
+    else context.schemas world cid
+  let foreignContext : IxIR2.Validate.Context := { schemas := foreignSchemas }
+  let foreignCons := { cons with
+    instructions := #[.takeUnique (.reg 1) (consId schema), .allocWith 0 .unique foreign #[.reg 2, .reg 0]] }
+  let mismatch := { optimized with declarations := [(functionAddress schema, .fn { fn with blocks := fn.blocks.set! 2 foreignCons })] }
+  need (rejected (IxIR2.Validate.validate foreignContext mismatch)) "incompatible credit layout accepted"
+  names := names ++ ["target-layout-mismatch"]
+  let liveSite := { IxIR2.UniqueLower.consBlock schema false with
+    terminator := .tailCallSelf #[.reg 1, .reg 3] }
+  need (((IxIR2.Reuse.inferPlacementWith IxIR2.Validate.defaultLimits liveSite 1 0).toOption.bind id).isNone)
+    "liveness accepted an owner used after take"
+  names := names ++ ["later-owner-use"]
+  for (name, policy) in [("disabled-baseline", { enabled := false : IxIR2.UniqueLower.ReusePolicy }),
+      ("budget-baseline", { maxRewrites := 0 : IxIR2.UniqueLower.ReusePolicy })] do
+    let selected := IxIR2.UniqueLower.select plan IxIR2.Validate.defaultLimits target.translation.checked policy
+    need (!selected.reused && toJson selected.program == toJson baseline) s!"{name}: changed checked fallback"
+    names := names ++ [name]
+  let skipped ← (compile source.constants source.entry source.config 1000 1000 1000
+    { IxIR2.Validate.defaultLimits with maxBlocks := 0 }).mapError reprStr
+  match skipped.backend with
+  | .ownedOnly _ =>
+      need ((mainCode skipped.plan).bytes == (mainCode plan).bytes &&
+        Coverage.ir1Entries (declarations skipped.plan.schema) == Coverage.ir1Entries (declarations schema))
+        "target failure changed consuming fallback"
+      discard <| observe1 source skipped.plan
+  | _ => throw "target limit did not retain the consuming fallback"
+  names := names ++ ["target-budget-owned-fallback"]
+  let evalContext := IxIR2.Eval.Context.ofProgram optimized context.schemas
+  need (match IxIR2.Eval.runMain evalContext .physical optimized 21 0 with
+    | .error .controlFuel => true | _ => false) "insufficient control budget was ignored"
+  let result ← (IxIR2.Eval.runMain evalContext .physical optimized 22 0).mapError reprStr
+  need (match IxIR2.Eval.dropUnique 6 result.store result.value with
+    | .error .heapFuel => true | _ => false) "insufficient reclamation budget was ignored"
+  names := names ++ ["control-budget-independent", "reclamation-budget-independent"]
+  return names
+
+def runAll : Except String (List CaseResult × List String) := do
+  let results ← cases.mapM fun (name, values, policy) =>
+    (runCase name values policy).mapError (fun error => s!"{name}: {error}")
+  return (results, ← rejectionChecks)
+
+def report (results : List CaseResult) (checks : List String) : Json :=
+  Json.mkObj [("format", toJson "compilatrix/source-unique-reuse-report/1"),
+    ("cases", toJson (results.map (·.summary))), ("policy_and_rejection_checks", toJson checks)]
+
+end Ix.Compiler.UniqueReuse.Examples
diff --git a/Ix/Compiler/UniqueReuse/Runtime.lean b/Ix/Compiler/UniqueReuse/Runtime.lean
new file mode 100644
index 000000000..fa0edfbd3
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Runtime.lean
@@ -0,0 +1,91 @@
+import Ix.Compiler.UniqueReuse.RuntimeSource
+import Ix.Compiler.UniqueReuse.Provenance
+
+/-! Compilation and checked selection of the parameterized reversal entry.
+IxIR₂ keeps its nullary module main; clients enter the independently checked
+exported declaration with an owned runtime argument. -/
+
+namespace Ix.Compiler.UniqueReuse.Runtime
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.UniqueReverse (Schema)
+
+def entryCode (schema : Schema) : IxIR1.Code :=
+  .letOp (.alloc .unique (nilId schema) #[])
+    (.letOp (.call (functionAddress schema) #[.var 0, .var 1]) (.ret (.var 0)))
+
+def entryFunction (schema : Schema) : IxIR1.FnDef :=
+  { arity := 1, result := .unique, papSafe := false, body := entryCode schema }
+
+def entryAddress (schema : Schema) : Address := (IxIR1.Decl.fn (entryFunction schema)).address
+
+def artifacts (schema : Schema) : List IxIR1.ReaddressAll.Artifact :=
+  .ordinary (entryAddress schema) (.fn (entryFunction schema)) :: UniqueReuse.artifacts schema
+
+def targetEntry (schema : Schema) : IxIR2.Function :=
+  { signature := { params := #[{ world := .unique, passing := .owned }], result := .unique, papSafe := false }
+    blocks := #[
+      { valueParams := #[.owned .unique], creditParams := #[]
+        instructions := #[.alloc .unique (nilId schema) #[]]
+        terminator := .tailCall (functionAddress schema) #[.reg 1, .reg 0] }] }
+
+def program (schema : Schema) (reuse : Bool) : IxIR2.Program :=
+  { declarations := [(entryAddress schema, .fn (targetEntry schema)),
+      (functionAddress schema, .fn (IxIR2.UniqueLower.function schema reuse))]
+    main := IxIR2.UniqueLower.mainFunction { schema, values := [] } }
+
+structure Selection (schema : Schema) (limits : IxIR2.Validate.Limits) where
+  reuse : Bool
+  reason : Option String
+  distinct : entryAddress schema ≠ functionAddress schema
+  checked : IxIR2.Validate.Checked limits (IxIR2.UniqueLower.context schema) (program schema reuse)
+  placement : reuse = true → ∃ placement : IxIR2.Reuse.Placement (IxIR2.UniqueLower.consBlock schema false),
+    placement.value = 1 ∧ placement.position = 0
+
+def select (schema : Schema) (limits : IxIR2.Validate.Limits) (policy : IxIR2.UniqueLower.ReusePolicy) :
+    Except String (Selection schema limits) := do
+  let distinct : PLift (entryAddress schema ≠ functionAddress schema) ←
+    if hd : entryAddress schema ≠ functionAddress schema then pure ⟨hd⟩
+    else throw "runtime export collides with the worker identity"
+  let baseline ← match hc : IxIR2.Validate.validateWith limits (IxIR2.UniqueLower.context schema) (program schema false) with
+    | .error error => throw s!"runtime consuming target rejected: {repr error}"
+    | .ok stats => pure (⟨stats, hc⟩ : IxIR2.Validate.Checked limits (IxIR2.UniqueLower.context schema) (program schema false))
+  let fallback := fun reason =>
+    ({ reuse := false, reason := some reason, distinct := distinct.down, checked := baseline, placement := by simp } : Selection schema limits)
+  if !policy.enabled then return fallback "disabled"
+  if policy.maxRewrites == 0 then return fallback "rewrite budget"
+  match hp : IxIR2.Reuse.inferPlacementWith limits (IxIR2.UniqueLower.consBlock schema false) 1 0 with
+  | .error error => return fallback s!"liveness: {repr error}"
+  | .ok none => return fallback "unique input has a later use"
+  | .ok (some placement) =>
+    let bounds := IxIR2.Reuse.inferPlacementWith_sound hp
+    match hc : IxIR2.Validate.validateWith limits (IxIR2.UniqueLower.context schema) (program schema true) with
+    | .error error => return fallback s!"reuse validation: {repr error}"
+    | .ok stats =>
+      return {
+        reuse := true, reason := none, distinct := distinct.down
+        checked := ⟨stats, hc⟩, placement := fun _ => ⟨placement, bounds⟩ }
+
+structure Compilation (constants : List (Address × Constant)) (entry : Pipeline.ClosedEntry)
+    (config : Pipeline.Config) (checkFuel eraseFuel : Nat) (limits : IxIR2.Validate.Limits) where
+  erased : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .shared checkFuel eraseFuel
+  source : CheckedSource erased
+  selection : Selection source.shape.schema limits
+
+def Compilation.schema {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits) : Schema :=
+  compilation.source.shape.schema
+
+def compile (constants : List (Address × Constant)) (entry : Pipeline.ClosedEntry)
+    (config : Pipeline.Config := {}) (checkFuel eraseFuel validateFuel : Nat := 1000)
+    (limits : IxIR2.Validate.Limits := IxIR2.Validate.defaultLimits)
+    (policy : IxIR2.UniqueLower.ReusePolicy := {}) :
+    Except String (Compilation constants entry config checkFuel eraseFuel limits) := do
+  let erased ← (Pipeline.certifyErasure constants entry config .saturatedRecursorV1 .shared
+    checkFuel eraseFuel validateFuel).mapError reprStr
+  let source ← checkSource erased
+  let selection ← select source.shape.schema limits policy
+  return { erased, source, selection }
+
+end Ix.Compiler.UniqueReuse.Runtime
diff --git a/Ix/Compiler/UniqueReuse/RuntimeNative.lean b/Ix/Compiler/UniqueReuse/RuntimeNative.lean
new file mode 100644
index 000000000..16c1248f9
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeNative.lean
@@ -0,0 +1,120 @@
+import Ix.Compiler.UniqueReuse.Runtime
+import Ix.Compiler.X86.RuntimeTarget
+import Ix.Compiler.X86.ELFValidate
+
+/-! Native selection and artifact identity for a compiled function. The
+preimage commits to the function, schema, policies, and runtime ABI; runtime
+payloads are deliberately absent. -/
+
+namespace Ix.Compiler.UniqueReuse.Runtime.Native
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR
+open Ix.Compiler.X86
+
+variable {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+  {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+
+structure Output (compilation : Compilation constants entry config checkFuel eraseFuel limits) where
+  reuseSelected : compilation.selection.reuse = true
+  foldCounters : Bool := false
+
+inductive Selection (compilation : Compilation constants entry config checkFuel eraseFuel limits) where
+  | skipped (reason : String)
+  | native (output : Output compilation)
+
+def select (compilation : Compilation constants entry config checkFuel eraseFuel limits)
+    (foldCounters : Bool := false) : Selection compilation :=
+  if reused : compilation.selection.reuse = true then .native ⟨reused, foldCounters⟩
+  else .skipped (compilation.selection.reason.getD "runtime native entry requires static unique reuse")
+
+inductive Role where
+  | main | release
+  deriving Repr, BEq, DecidableEq
+
+def Role.name : Role → String | .main => "main" | .release => "release"
+def Role.symbol : Role → String | .main => "compilatrix_runtime_reverse" | .release => "compilatrix_runtime_drop"
+def Role.policyVersion (role : Role) (foldCounters : Bool := false) : UInt32 :=
+  match role with | .main => if foldCounters then 3 else 1 | .release => 2
+def Role.checked (role : Role) (foldCounters : Bool := false) : Checked :=
+  match role with | .main => RuntimeTarget.checked foldCounters | .release => RuntimeTarget.releaseChecked
+def loweringVersion : UInt32 := 3
+
+/-- Check exact scalar representation before preparing a native argument. -/
+def ofNats (values : List Nat) : Except String (List Word) :=
+  if values.length > UniqueABI.maxLength then .error "runtime input exceeds 64 cons cells"
+  else if values.all (fun value => decide (value < UInt64.size)) then .ok (values.map UInt64.ofNat)
+  else .error "runtime Nat does not fit an exact 64-bit Word"
+
+theorem ofNats_exact {values : List Nat} {words : List Word} (accepted : ofNats values = .ok words) :
+    words.map UInt64.toNat = values ∧ words.length ≤ UniqueABI.maxLength := by
+  unfold ofNats at accepted
+  split at accepted
+  · contradiction
+  next bounded =>
+    split at accepted
+    · next exactWords =>
+        have equal := Except.ok.inj accepted
+        subst words
+        constructor
+        · rw [List.map_map]
+          calc
+            _ = values.map (fun value => value) := List.map_congr_left fun value member =>
+              UInt64.toNat_ofNat_of_lt' (of_decide_eq_true (List.all_eq_true.mp exactWords value member))
+            _ = values := List.map_id' values
+        · simpa using Nat.le_of_not_gt bounded
+    · contradiction
+
+def Output.graph {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (_output : Output compilation) : Address :=
+  IxIR1.Optimizer.graphRoot (Runtime.artifacts compilation.schema)
+    (UniqueReuse.mainCode { schema := compilation.schema, values := [] })
+
+def Output.policyBytes {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) : ByteArray :=
+  Encoding.domain "compilatrix/native-runtime-unique-provenance/1" ++ Encoding.tag 0 ++
+    Encoding.address (Address.blake3 (sourceBytes constants entry)) ++ Encoding.address output.graph ++
+    Encoding.address (entryAddress compilation.schema) ++ Encoding.address (functionAddress compilation.schema) ++
+    Encoding.string Runtime.policyTag ++ Encoding.string Ixon.RecursorUsage.policyTag ++
+    Encoding.string IxIR2.UniqueLower.policyTag ++ Encoding.string IxIR2.UniqueLower.reusePolicyTag ++
+    Encoding.string IxIR2.CreditPolicy.callLocalV0.tag ++
+    Encoding.nat checkFuel ++ Encoding.nat eraseFuel ++ targetLimitBytes limits ++
+    Encoding.string RuntimeTarget.abiTag ++ Encoding.string (RuntimeTarget.policyTag output.foldCounters) ++
+    Encoding.nat UniqueABI.maxLength ++ Encoding.nat UniqueABI.headerWords ++ Encoding.nat UniqueABI.cellWords ++
+    Encoding.address compilation.schema.nil ++ Encoding.address compilation.schema.cons ++
+    Encoding.string role.name ++ Encoding.nat loweringVersion.toNat ++ Encoding.nat (role.policyVersion output.foldCounters).toNat ++
+    (if output.foldCounters then Encoding.string UniqueCounterFold.policyTag else ByteArray.empty)
+
+def Output.identity {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) : Address := Address.blake3 (output.policyBytes role)
+
+structure Object where
+  role : Role
+  foldCounters : Bool := false
+  provenance : ELF.Provenance
+  policyBytes : ByteArray
+  policyIdentity : Address
+  encoded : Encode.Output
+  bytes : ByteArray
+  streamValid : Stream.Valid (role.checked foldCounters).program encoded
+  objectValid : ELF.Valid { encoded, entryBlock := (role.checked foldCounters).program.entry, exportName := role.symbol, provenance } bytes
+
+def Output.emit {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) : Except String Object := do
+  let stream ← (Stream.encode (role.checked output.foldCounters)).mapError reprStr
+  let encoded := stream.output
+  let provenance := ELF.Provenance.ixir1Policy output.graph loweringVersion (role.policyVersion output.foldCounters)
+  let object ← (ELF.writeChecked { encoded, entryBlock := (role.checked output.foldCounters).program.entry, exportName := role.symbol, provenance }).mapError reprStr
+  return {
+    role, foldCounters := output.foldCounters, provenance, encoded, bytes := object.bytes,
+    policyBytes := output.policyBytes role, policyIdentity := output.identity role
+    streamValid := stream.valid, objectValid := object.valid }
+
+def Output.targetChecked {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) :
+    IxIR2.Validate.Checked limits (IxIR2.UniqueLower.context compilation.schema) (Runtime.program compilation.schema true) := by
+  have checked := compilation.selection.checked
+  rw [output.reuseSelected] at checked
+  exact checked
+
+end Ix.Compiler.UniqueReuse.Runtime.Native
diff --git a/Ix/Compiler/UniqueReuse/RuntimeNativeSim.lean b/Ix/Compiler/UniqueReuse/RuntimeNativeSim.lean
new file mode 100644
index 000000000..d6000a3f8
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeNativeSim.lean
@@ -0,0 +1,86 @@
+import Ix.Compiler.UniqueReuse.RuntimeNative
+import Ix.Compiler.UniqueReuse.RuntimeSourceSim
+import Ix.Compiler.UniqueReuse.RuntimeTarget
+import Ix.Compiler.X86.RuntimeInput
+
+namespace Ix.Compiler.UniqueReuse.Runtime.Native
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.X86
+open Ix.Compiler.X86.UniqueABI
+open Ix.Compiler.X86.UniqueExecution
+
+variable {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+  {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+
+/-- The source argument and the native input denote the same finite list.
+`Word` payloads state exact representation, `Layout` states alignment and
+nonwrapping bounds, and `Realizes` supplies permissions and the memory frame.
+The caller transfers exclusive ownership of the admitted arena's list cells. -/
+structure ArgumentRel (compilation : Compilation constants entry config checkFuel eraseFuel limits)
+    (argument : Ixon.Eval.Value) (values : List Word) (layout : Layout) (state : State) (outside memory : Memory) : Prop where
+  sourceWF : argument.SharingWF
+  source : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw }
+    argument (IxIR0.UniqueReverse.listValue compilation.schema (values.map UInt64.toNat)) compilation.erased.memberScope
+  input : RuntimeExecution.Input layout values state
+  capacity : values.length + 2 ≤ layout.capacity
+  represented : Realizes layout outside state.words memory
+
+theorem ArgumentRel.graph {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    {argument : Ixon.Eval.Value} {values : List Word} {layout : Layout} {state : State} {outside memory : Memory}
+    (relation : ArgumentRel compilation argument values layout state outside memory) :
+    NativeList memory (values.map UInt64.toNat) (layout.cell values.length) (RuntimeExecution.downNodes layout values.length) :=
+  RuntimeExecution.down_native relation.input.chain relation.represented (by have := relation.capacity; omega)
+
+structure Result {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (sourceResult : Ixon.Eval.Value) (values : List Word)
+    (layout : Layout) (state : State) (outside memory : Memory) (runtime : X86.Runtime) : Prop where
+  source : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw }
+    sourceResult (IxIR0.UniqueReverse.listValue compilation.schema ((values.map UInt64.toNat).reverse)) compilation.erased.memberScope
+  target : ∀ (before : IxIR2.Eval.Store) (argument : IxIR1.RVal) (heapFuel : Nat),
+    Target.Input compilation.schema (values.map UInt64.toNat) before argument →
+    ∃ result,
+      IxIR2.Eval.runFunction (Target.context compilation.schema true) .physical (targetEntry compilation.schema) #[argument]
+        (Target.controlCost true values.length) heapFuel before = .ok result ∧
+      UniqueReuse.Target.MainResult { schema := compilation.schema, values := values.map UInt64.toNat } true .physical
+        result.store result.value ∧
+      result.controlRemaining = 0 ∧ result.heapRemaining = heapFuel
+  native : ∃ returned returnedMemory reclaimed reclaimedMemory,
+    RuntimeExecution.Execution layout values state memory outside runtime returned returnedMemory reclaimed reclaimedMemory output.foldCounters
+
+/-- A successful source call refines to the selected physical function and
+the single selected native function on every admitted runtime argument. -/
+theorem Output.sourceRefines {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) {functionFuel applyFuel : Nat} {function argument sourceResult : Ixon.Eval.Value}
+    {values : List Word} {layout : Layout} {state : State} {outside memory : Memory}
+    (relation : ArgumentRel compilation argument values layout state outside memory)
+    (oracles : @Sim.OracleRel compilation.erased.memberScope (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) functionFuel entry.frame [] entry.source = .ok function)
+    (applied : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config) applyFuel function argument = .ok sourceResult)
+    (runtime : X86.Runtime) : Result output sourceResult values layout state outside memory runtime := by
+  refine ⟨compilation.sourceRefines oracles contextWF evaluated relation.sourceWF relation.source applied, ?_,
+    RuntimeExecution.executes layout values state relation.input relation.capacity outside memory relation.represented runtime⟩
+  intro before targetArgument heapFuel input
+  have result := compilation.targetRuns (values.map UInt64.toNat) before targetArgument heapFuel input .physical
+  simpa [output.reuseSelected] using result
+
+def targetCounts (store : IxIR2.Eval.Store) : Counts :=
+  { allocs := store.heap.allocs, frees := store.heap.frees, reuses := store.heap.reuses
+    live := store.live, peak := store.peakLiveNodes, payload := store.reusedPayloadUnits }
+
+theorem costsAgree {schema : IxIR0.UniqueReverse.Schema} {values : List Word} {layout : Layout} {before after : State}
+    (native : LoopResult layout values.reverse (mainCounts values.length) before after)
+    {store : IxIR2.Eval.Store} {value : IxIR1.RVal}
+    (target : UniqueReuse.Target.MainResult { schema, values := values.map UInt64.toNat } true .physical store value) :
+    CountsAt layout (targetCounts store) after.words := by
+  have equal : targetCounts store = mainCounts values.length := by
+    simp [targetCounts, target.allocs, target.frees, target.reuses, target.live, target.peak, target.payload,
+      UniqueReuse.Target.freshPerCons, UniqueReuse.Target.reusesPerCons, UniqueReuse.Target.inPlace, mainCounts]
+  rw [equal]
+  exact native.countsAt
+
+end Ix.Compiler.UniqueReuse.Runtime.Native
diff --git a/Ix/Compiler/UniqueReuse/RuntimeObjectSim.lean b/Ix/Compiler/UniqueReuse/RuntimeObjectSim.lean
new file mode 100644
index 000000000..d70bbc3ba
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeObjectSim.lean
@@ -0,0 +1,188 @@
+import Ix.Compiler.UniqueReuse.RuntimeNativeSim
+import Ix.Compiler.X86.ObjectExecution
+import Ix.Compiler.X86.StreamPermissions
+
+/-! The runtime-input source theorem reaches actual emitted ELF text.
+Every admitted Word list uses the same compiled object pair. -/
+
+namespace Ix.Compiler.UniqueReuse.Runtime.Native
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.X86
+open Ix.Compiler.X86.UniqueABI
+open Ix.Compiler.X86.UniqueExecution
+open Ix.Compiler.X86.UniqueTarget (releaseCost)
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+variable {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+  {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+  {foldCounters : Bool}
+
+theorem Output.emit_spec {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (role : Role) {object : Object} (emitted : output.emit role = .ok object) :
+    object.role = role ∧ object.provenance = .ixir1Policy output.graph loweringVersion (role.policyVersion output.foldCounters) ∧
+      object.policyBytes = output.policyBytes role ∧ object.policyIdentity = output.identity role ∧
+      object.foldCounters = output.foldCounters := by
+  unfold Output.emit at emitted
+  cases stream : Stream.encode (role.checked output.foldCounters) with
+  | error error => simp [stream, Except.mapError] at emitted
+  | ok streamValue =>
+      simp only [stream, Except.mapError, bind, Except.bind] at emitted
+      cases written : ELF.writeChecked {
+          encoded := streamValue.output, entryBlock := (role.checked output.foldCounters).program.entry, exportName := role.symbol
+          provenance := .ixir1Policy output.graph loweringVersion (role.policyVersion output.foldCounters) } with
+      | error error => simp [written] at emitted
+      | ok objectValue =>
+          simp only [written, pure, Except.pure] at emitted
+          cases Except.ok.inj emitted
+          exact ⟨rfl, rfl, rfl, rfl, rfl⟩
+
+theorem role_callFree (role : Role) (foldCounters : Bool := false) : Stream.CallFree (role.checked foldCounters).program := by
+  apply Stream.callFree_sound
+  cases role <;> cases foldCounters <;> decide +kernel
+
+theorem Object.run_from_typed (object : Object) (runtime : X86.Runtime) (base : Word)
+    (fuel : Nat) (core : Core) (flags : ByteEval.Flags) {after : Machine} {result returnAddress : Word}
+    (execution : X86.runFrom runtime (object.role.checked object.foldCounters) fuel core = after) (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ count finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      ObjectEval.run object.bytes object.role.symbol base count core flags = .ok finalState ∧
+      Stream.Returned after.core returnAddress finalState :=
+  ObjectEval.run_from_typed object.streamValid object.objectValid rfl (role_callFree object.role object.foldCounters)
+    runtime base fuel core flags execution halted slot
+
+theorem Object.provenance_parsed (object : Object) :
+    (ELFRead.parse object.bytes).map ELFRead.View.provenance = some (ELF.expectedProvenance object.provenance) := by
+  obtain ⟨view, parsed, fields⟩ := object.objectValid
+  simp [parsed, fields.provenance]
+
+structure CallerSlot (layout : Layout) (stack : Word) (memory : Memory) (returnAddress : Word) : Prop where
+  outside : ∀ offset < 8, layout.allowed (stack + UInt64.ofNat offset) = false
+  read : memory.read64? stack = .ok returnAddress
+
+theorem caller_read_preserved {layout : Layout} {outside before after : Memory} {beforeWords afterWords : Words}
+    {stack returnAddress : Word} (caller : CallerSlot layout stack before returnAddress)
+    (beforeView : Realizes layout outside beforeWords before) (afterView : Realizes layout outside afterWords after)
+    (permissions : after.readable = before.readable) : after.read64? stack = .ok returnAddress := by
+  have bytes : after.read64 stack = before.read64 stack := by
+    apply Memory.readLittle_congr
+    intro offset bound
+    rw [afterView.frame _ (caller.outside offset bound), beforeView.frame _ (caller.outside offset bound)]
+  change (if Memory.rangeAllowed after.readable stack 8 then Except.ok (after.read64 stack)
+    else Except.error (⟨.read, stack, 8⟩ : MemoryFault)) = Except.ok returnAddress
+  rw [permissions, bytes]
+  exact caller.read
+
+theorem return_slots {layout : Layout} {values : List Word} {before returned reclaimed : State}
+    {memory outside returnedMemory reclaimedMemory : Memory} {runtime : X86.Runtime} {returnAddress : Word}
+    (execution : RuntimeExecution.Execution layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory foldCounters)
+    (initial : Realizes layout outside before.words memory)
+    (caller : CallerSlot layout (before.registers .rsp) memory returnAddress) :
+    returnedMemory.read64? (returned.registers .rsp) = .ok returnAddress ∧
+      reclaimedMemory.read64? (reclaimed.registers .rsp) = .ok returnAddress := by
+  have mainPermissions := Stream.run_permissions runtime (RuntimeTarget.checked foldCounters) (role_callFree .main foldCounters)
+    (RuntimeTarget.controlCost values.length foldCounters) (Machine.initial (RuntimeTarget.checked foldCounters) (before.core memory))
+  have releasePermissions := Stream.run_permissions runtime RuntimeTarget.releaseChecked (role_callFree .release)
+    (releaseCost values.length) (Machine.initial RuntimeTarget.releaseChecked (returned.core returnedMemory))
+  change Stream.Permissions _ (runFrom runtime (RuntimeTarget.checked foldCounters) _ _).core at mainPermissions
+  change Stream.Permissions _ (runFrom runtime RuntimeTarget.releaseChecked _ _).core at releasePermissions
+  rw [execution.mainRun] at mainPermissions
+  rw [execution.releaseRun] at releasePermissions
+  have mainRead : returnedMemory.readable = memory.readable := mainPermissions.1
+  have releaseRead : reclaimedMemory.readable = memory.readable := releasePermissions.1.trans mainRead
+  rw [execution.returnedResult.saved .rsp rfl, execution.reclaimedResult.saved .rsp rfl]
+  exact ⟨caller_read_preserved caller initial execution.returnedView mainRead,
+    caller_read_preserved caller initial execution.reclaimedView releaseRead⟩
+
+structure ByteExecution (main release : Object) (layout : Layout) (values : List Word) (before : State)
+    (memory outside : Memory) (runtime : X86.Runtime) (returned : State) (returnedMemory : Memory)
+    (reclaimed : State) (reclaimedMemory : Memory) (base returnAddress : Word) (flags : ByteEval.Flags)
+    (mainCount releaseCount : Nat) (byteReturned byteReclaimed : ByteEval.State) : Prop where
+  typed : RuntimeExecution.Execution layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory main.foldCounters
+  mainPositive : 0 < mainCount
+  mainBound : mainCount ≤ 3 * RuntimeTarget.controlCost values.length main.foldCounters
+  releasePositive : 0 < releaseCount
+  releaseBound : releaseCount ≤ 3 * releaseCost values.length
+  mainRun : ObjectEval.run main.bytes Role.main.symbol base mainCount (before.core memory) flags = .ok byteReturned
+  releaseRun : ObjectEval.run release.bytes Role.release.symbol base releaseCount (returned.core returnedMemory) flags = .ok byteReclaimed
+  mainReturn : Stream.Returned (returned.core returnedMemory) returnAddress byteReturned
+  releaseReturn : Stream.Returned (reclaimed.core reclaimedMemory) returnAddress byteReclaimed
+  graph : NativeList byteReturned.core.memory ((values.map UInt64.toNat).reverse) (byteReturned.core.readReg .rax)
+    (chainNodes layout 1 values.length)
+  releasedMemory : byteReclaimed.core.memory = reclaimedMemory
+  releasedValue : byteReclaimed.core.readReg .rax = 0
+
+theorem byte_execution {layout : Layout} {values : List Word} {before returned reclaimed : State}
+    {memory outside returnedMemory reclaimedMemory : Memory} {runtime : X86.Runtime} {returnAddress : Word}
+    (execution : RuntimeExecution.Execution layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory foldCounters)
+    (initial : Realizes layout outside before.words memory)
+    (caller : CallerSlot layout (before.registers .rsp) memory returnAddress)
+    (main release : Object) (mainRole : main.role = .main) (releaseRole : release.role = .release)
+    (mainMode : main.foldCounters = foldCounters)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ mainCount releaseCount byteReturned byteReclaimed,
+      ByteExecution main release layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory
+        base returnAddress flags mainCount releaseCount byteReturned byteReclaimed := by
+  subst foldCounters
+  have slots := return_slots execution initial caller
+  have mainRun : runFrom runtime (main.role.checked main.foldCounters) (RuntimeTarget.controlCost values.length main.foldCounters) (before.core memory) =
+      haltedLeaf (returned.core returnedMemory) 4 13 := by simpa [mainRole, Role.checked] using execution.mainRun
+  have releaseRun : runFrom runtime (release.role.checked release.foldCounters) (releaseCost values.length) (returned.core returnedMemory) =
+      haltedLeaf (reclaimed.core reclaimedMemory) 2 13 := by simpa [releaseRole, Role.checked] using execution.releaseRun
+  obtain ⟨mainCount, byteReturned, mainPositive, mainBound, mainExecuted, mainReturned⟩ :=
+    main.run_from_typed runtime base _ _ flags mainRun rfl slots.1
+  obtain ⟨releaseCount, byteReclaimed, releasePositive, releaseBound, releaseExecuted, releaseReturned⟩ :=
+    release.run_from_typed runtime base _ _ flags releaseRun rfl slots.2
+  refine ⟨mainCount, releaseCount, byteReturned, byteReclaimed, execution, mainPositive, mainBound, releasePositive,
+    releaseBound, by simpa [mainRole] using mainExecuted, by simpa [releaseRole] using releaseExecuted,
+    mainReturned, releaseReturned, ?_, ?_, ?_⟩
+  · rw [mainReturned.1]
+    simpa [Core.setReg, Core.readReg, State.core, haltedLeaf, leaf] using execution.graph
+  · rw [releaseReturned.1]
+    rfl
+  · rw [releaseReturned.1]
+    simpa [Core.setReg, Core.readReg, State.core, haltedLeaf, leaf] using execution.reclaimedResult.result
+
+structure ObjectResult {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) (sourceResult : Ixon.Eval.Value) (values : List Word)
+    (layout : Layout) (before : State) (outside memory : Memory) (runtime : X86.Runtime)
+    (main release : Object) (base returnAddress : Word) (flags : ByteEval.Flags) : Prop where
+  source : Result output sourceResult values layout before outside memory runtime
+  mainProvenance : (ELFRead.parse main.bytes).map ELFRead.View.provenance =
+    some (ELF.expectedProvenance (.ixir1Policy output.graph loweringVersion (Role.main.policyVersion output.foldCounters)))
+  releaseProvenance : (ELFRead.parse release.bytes).map ELFRead.View.provenance =
+    some (ELF.expectedProvenance (.ixir1Policy output.graph loweringVersion (Role.release.policyVersion output.foldCounters)))
+  native : ∃ returned returnedMemory reclaimed reclaimedMemory mainCount releaseCount byteReturned byteReclaimed,
+    ByteExecution main release layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory
+      base returnAddress flags mainCount releaseCount byteReturned byteReclaimed
+
+/-- The actual compiler's emitted object pair executes on every admitted
+runtime argument and preserves the source result, native graph and complete
+reclamation observations. Emission success carries the concrete certificates. -/
+theorem Output.sourceRefinesObjects {compilation : Compilation constants entry config checkFuel eraseFuel limits}
+    (output : Output compilation) {functionFuel applyFuel : Nat} {function argument sourceResult : Ixon.Eval.Value}
+    {values : List Word} {layout : Layout} {state : State} {outside memory : Memory}
+    (relation : ArgumentRel compilation argument values layout state outside memory)
+    (oracles : @Sim.OracleRel compilation.erased.memberScope (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) functionFuel entry.frame [] entry.source = .ok function)
+    (applied : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config) applyFuel function argument = .ok sourceResult)
+    (runtime : X86.Runtime) (main release : Object)
+    (mainEmitted : output.emit .main = .ok main) (releaseEmitted : output.emit .release = .ok release)
+    (base returnAddress : Word) (flags : ByteEval.Flags)
+    (caller : CallerSlot layout (state.registers .rsp) memory returnAddress) :
+    ObjectResult output sourceResult values layout state outside memory runtime main release base returnAddress flags := by
+  have source := output.sourceRefines relation oracles contextWF evaluated applied runtime
+  have mainSpec := output.emit_spec .main mainEmitted
+  have releaseSpec := output.emit_spec .release releaseEmitted
+  refine ⟨source, ?_, ?_, ?_⟩
+  · simpa [mainSpec.2.1] using main.provenance_parsed
+  · simpa [releaseSpec.2.1] using release.provenance_parsed
+  · obtain ⟨returned, returnedMemory, reclaimed, reclaimedMemory, execution⟩ := source.native
+    obtain ⟨mainCount, releaseCount, byteReturned, byteReclaimed, bytes⟩ :=
+      byte_execution execution relation.represented caller main release mainSpec.1 releaseSpec.1 mainSpec.2.2.2.2 base flags
+    exact ⟨returned, returnedMemory, reclaimed, reclaimedMemory, mainCount, releaseCount, byteReturned, byteReclaimed, bytes⟩
+
+end Ix.Compiler.UniqueReuse.Runtime.Native
diff --git a/Ix/Compiler/UniqueReuse/RuntimeObservations.lean b/Ix/Compiler/UniqueReuse/RuntimeObservations.lean
new file mode 100644
index 000000000..8181a87f5
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeObservations.lean
@@ -0,0 +1,229 @@
+import Ix.Compiler.UniqueReuse.RuntimeNativeSim
+import Ix.Compiler.UniqueReuse.NativeObservations
+import Ix.Compiler.X86.RuntimeReject
+
+/-! Compile and emit once, then apply the resulting source function and target
+functions to independent runtime arguments. Caller-side input construction is
+kept outside the exported native code and the artifact identity. -/
+
+namespace Ix.Compiler.UniqueReuse.Runtime.Native.Examples
+
+open Lean Ix.Compiler.Ixon Ix.Compiler.X86 Ix.Compiler.X86.UniqueABI
+open Ix.Compiler.UniqueReuse.Examples (need sourceList? list0? list1?)
+open Ix.Compiler.UniqueReuse.Native.Examples (headerValues heapSnapshot nativeList boundary prefixSnapshot)
+
+private def argument (source : Runtime.Source) : List Nat → Ixon.Eval.Value
+  | [] => .ctorV source.dataBlock 1 0 []
+  | head :: tail => .ctorV source.dataBlock 1 1 [.litV (.natL head), argument source tail]
+
+private def rejectionInputs (layout : Layout) (length : Nat) (initial : Core) : List (String × Core) :=
+  let changed := fun name slot value => (name, { initial with memory := initial.memory.write64 (layout.address slot) value })
+  [("length-sixty-five", initial.setReg .rsi 65), ("length-word-max", initial.setReg .rsi 0xffffffffffffffff),
+   ("null-descriptor", initial.setReg .rdi 0), ("misaligned-descriptor", initial.setReg .rdi (layout.base + 1)),
+   changed "wrong-cursor" 0 1,
+   changed "insufficient-capacity" 1 (UInt64.ofNat (32 * (length + 1))), changed "zero-capacity" 1 0,
+   changed "excess-capacity" 1 2144, changed "misaligned-capacity" 1 (UInt64.ofNat (32 * (length + 2) + 1))] ++
+  ([("allocs", 2), ("frees", 3), ("reuses", 4), ("live", 5), ("peak", 6),
+    ("rcops", 7), ("payload", 8), ("reservations", 9)].map fun (name, slot) =>
+    changed s!"wrong-{name}" slot (initial.memory.read64 (layout.address slot) + 1)) ++
+  ([("nil-tag", 0), ("nil-head", 1), ("nil-tail", 2), ("nil-padding", 3)].map fun (name, field) =>
+    changed name (cellSlot 0 field) 1) ++
+  (if length == 0 then [] else
+    [changed "cons-tag" (cellSlot length 0) 0,
+     changed "cons-self-tail" (cellSlot length 2) (layout.cell length),
+     changed "cons-null-tail" (cellSlot length 2) 0,
+     changed "cons-outside-tail" (cellSlot length 2) 0xffffffffffffffff,
+     changed "cons-padding" (cellSlot length 3) 1])
+
+private def observeNative (values : List Word) (bound : values.length ≤ maxLength)
+    (foldCounters : Bool) : Except String Json := do
+  let layout := RuntimeExecution.canonicalLayout values bound
+  let initial : Core :=
+    { registers := ((Registers.zero.set .rsp 0x8008).set .rdi layout.base).set .rsi (UInt64.ofNat values.length)
+      memory := RuntimeExecution.inputMemory layout values Memory.unmapped }
+  need ((← nativeList layout initial.memory values.length (layout.cell values.length)) == values.map UInt64.toNat)
+    "caller input graph disagreement"
+  let input ← heapSnapshot layout initial.memory
+  let checked := RuntimeTarget.checked foldCounters
+  let cost := RuntimeTarget.controlCost values.length foldCounters
+  let mut machine := Machine.initial checked initial
+  let mut prefixes := #[]
+  for count in [:cost + 1] do
+    need (machine.core.readReg .rsp == 0x8008 && machine.core.readReg .rdi == layout.base &&
+      machine.core.calleeSavedSnapshot == initial.calleeSavedSnapshot) "runtime ABI register disagreement"
+    match machine.status with
+    | .trapped fault => throw s!"runtime byte evaluator trapped: {repr fault}"
+    | _ => pure ()
+    -- The folded reserve/reuse pair is one operation boundary. Its cancelled
+    -- counter updates do not expose the old intermediate reservation state.
+    if boundary machine && !(foldCounters && machine.pc.block == 5 && machine.pc.offset == 10) then
+      prefixes := prefixes.push (← prefixSnapshot layout machine count)
+    if count < cost then
+      need (machine.status == .running) "runtime entry halted before its control cost"
+      machine := step X86.Runtime.rejecting checked machine
+  need (machine.status == .halted (layout.cell 1)) "runtime entry did not return its owned root"
+  let observed ← nativeList layout machine.core.memory values.length (machine.core.readReg .rax)
+  need (observed == (values.map UInt64.toNat).reverse) "runtime reversal disagreement"
+  let returned ← heapSnapshot layout machine.core.memory
+  let dropped := runFrom X86.Runtime.rejecting RuntimeTarget.releaseChecked (UniqueTarget.releaseCost values.length) machine.core
+  need (dropped.status == .halted 0 && dropped.core.readReg .rsp == initial.readReg .rsp &&
+    dropped.core.calleeSavedSnapshot == initial.calleeSavedSnapshot) "runtime release status or ABI disagreement"
+  let reclaimed ← heapSnapshot layout dropped.core.memory
+  let after := headerValues layout dropped.core.memory
+  need (after[2]! == after[3]! && after[5]! == 0 && after[7]! == 0 && after[9]! == 0) "runtime release leaked"
+  let mut failures := #[]
+  for (label, before) in rejectionInputs layout values.length initial do
+    let failed := runFrom X86.Runtime.rejecting checked cost before
+    need (failed.status == .halted 0 && failed.core.readReg .rsp == before.readReg .rsp &&
+      failed.core.calleeSavedSnapshot == before.calleeSavedSnapshot) s!"runtime guard did not reject {label}"
+    for byte in [:8 * layout.slots] do
+      let address := layout.base + UInt64.ofNat byte
+      need (failed.core.memory.bytes address == before.memory.bytes address)
+        s!"runtime rejection modified arena memory: {label}"
+    failures := failures.push (toJson label)
+  return Json.mkObj [("value", toJson observed), ("root", toJson (1 : Nat)), ("input", input),
+    ("returned", returned), ("reclaimed", reclaimed), ("prefixes", Json.arr prefixes), ("rejections", Json.arr failures)]
+
+private def observe2 (view : UniqueReuse.Examples.Source) (schema : IxIR0.UniqueReverse.Schema)
+    (reuse : Bool) (mode : IxIR2.Eval.Interpretation) : Except String Json := do
+  let (input, argument) := Target.makeInput schema view.values
+  let cost := Target.controlCost reuse view.values.length
+  let result ← (IxIR2.Eval.runFunction (Target.context schema reuse) mode (targetEntry schema) #[argument] cost 0 input).mapError reprStr
+  need (list1? view 1000 result.store.heap result.value == some view.values.reverse) "runtime IxIR2 value disagreement"
+  let (reclaimed, remaining) ← (IxIR2.Eval.dropUnique (2 * view.values.length + 1) result.store result.value).mapError reprStr
+  let count := view.values.length
+  let reused := if reuse && mode == .physical then count else 0
+  let counters := result.store.counters
+  need (counters.allocs + reused == 2 * count + 2 && counters.frees + reused == count + 1 &&
+    counters.reuses == reused && counters.rcops == 0 && counters.resetAttempts == 0 && counters.hotResets == 0 &&
+    counters.coldResets == 0 && counters.reusedPayloadUnits == 2 * reused &&
+    counters.peakLiveNodes == count + 2 && result.store.live == count + 1) "runtime IxIR2 counter disagreement"
+  need (result.controlRemaining == 0 && result.heapRemaining == 0 && remaining == 0 &&
+    reclaimed.live == 0 && reclaimed.heap.allocs == reclaimed.heap.frees && reclaimed.heap.rcops == 0)
+    "runtime IxIR2 budget or reclamation disagreement"
+  return Json.mkObj [("value", toJson view.values.reverse), ("input", toJson input), ("argument", toJson argument),
+    ("result", toJson result.value), ("store", toJson result.store), ("reclaimed", toJson reclaimed),
+    ("control_cost", toJson cost), ("control_remaining", toJson result.controlRemaining),
+    ("heap_remaining", toJson result.heapRemaining), ("reclamation_remaining", toJson remaining)]
+
+private def objectJson (object : Object) : Json :=
+  Json.mkObj [("file", toJson s!"{object.role.name}.o"), ("role", toJson object.role.name),
+    ("symbol", toJson object.role.symbol), ("identity", toJson (Address.blake3 object.bytes)),
+    ("size", toJson object.bytes.size), ("policy_identity", toJson object.policyIdentity),
+    ("policy_bytes", Coverage.byteJson object.policyBytes), ("provenance", Coverage.byteJson object.provenance.bytes),
+    ("lowering_version", toJson loweringVersion.toNat), ("role_version", toJson (object.role.policyVersion object.foldCounters).toNat),
+    ("text", Coverage.byteJson object.encoded.text), ("blocks", toJson object.encoded.blockOffsets),
+    ("relocations", toJson object.encoded.relocations.size),
+    ("typed_program_diagnostic", toJson (reprStr (object.role.checked object.foldCounters).program))]
+
+structure Result where
+  pipeline : Json
+  cases : List (String × Json)
+  report : Json
+  mainObject : ByteArray
+  releaseObject : ByteArray
+
+def run (foldCounters : Bool := false) : Except String Result := do
+  let source ← Runtime.source
+  for (address, constant) in source.constants do
+    need (Address.blake3 (ser constant) == address &&
+      (de (ser constant) : Except String Constant).toOption == some constant) "runtime source codec disagreement"
+  let compilation ← Runtime.compile source.constants source.entry
+  let .native output := Native.select compilation foldCounters | throw "runtime source skipped native selection"
+  let main ← output.emit .main
+  let release ← output.emit .release
+  let sourceContext := Pipeline.validatedEvalCtx source.constants {}
+  let sourceFunction ← (Ixon.Eval.eval sourceContext 10000 source.entry.frame [] source.entry.source).mapError reprStr
+  let erased := compilation.erased.erasure.result
+  let context0 : IxIR0.Ctx := { env := IxIR0.Env.ofList erased.raw }
+  let function0 ← (IxIR0.eval context0 10000 [] compilation.erased.rawMain).mapError reprStr
+  let schema := compilation.schema
+  let mut rows := []
+  let mut cases := []
+  for (name, values) in UniqueReuse.Native.Examples.cases do
+    let words ← ofNats values
+    let bound : PLift (words.length ≤ maxLength) ←
+      if bounded : words.length ≤ maxLength then pure ⟨bounded⟩ else throw "runtime length bound lost"
+    let view : UniqueReuse.Examples.Source :=
+      { constants := source.constants, root := source.root, dataBlock := source.dataBlock,
+        nil := source.nil, cons := source.cons, recursor := schema.recursor, builder := schema.builder, values }
+    let sourceValue ← (Ixon.Eval.apply sourceContext 10000 sourceFunction (argument source values)).mapError reprStr
+    need (sourceList? view 1000 sourceValue == some values.reverse) "runtime Ixon result disagreement"
+    let value0 ← (IxIR0.apply context0 10000 function0 (IxIR0.UniqueReverse.listValue schema values)).mapError reprStr
+    need (list0? view 1000 value0 == some values.reverse) "runtime IxIR0 result disagreement"
+    let context1 : IxIR1.Ctx :=
+      { decls := IxIR1.Env.ofList ((entryAddress schema, .fn (entryFunction schema)) :: UniqueReuse.declarations schema) }
+    let (input1, argument1) := Target.makeInput schema values
+    let (store1, value1) ← (IxIR1.invoke context1 10000 (entryAddress schema) [argument1] input1.heap).mapError reprStr
+    need (list1? view 1000 store1 value1 == some values.reverse) "runtime IxIR1 result disagreement"
+    let reclaimed1 ← (IxIR1.dropUVal context1 (3 * values.length + 2) store1 value1).mapError reprStr
+    need (reclaimed1.live == 0 && reclaimed1.allocs == reclaimed1.frees && reclaimed1.rcops == 0)
+      "runtime IxIR1 reclamation disagreement"
+    let baselineLogical ← observe2 view schema false .logical
+    let baselinePhysical ← observe2 view schema false .physical
+    let selectedLogical ← observe2 view schema compilation.selection.reuse .logical
+    let selectedPhysical ← observe2 view schema compilation.selection.reuse .physical
+    let native ← observeNative words bound.down foldCounters
+    let row := Json.mkObj [("name", toJson name), ("input", toJson values), ("value", toJson values.reverse),
+      ("snapshot", toJson s!"{name}.json"), ("main_steps", toJson (RuntimeTarget.controlCost values.length foldCounters)),
+      ("release_steps", toJson (UniqueTarget.releaseCost values.length)),
+      ("prefixes", toJson (← (← native.getObjVal? "prefixes").getArr?).size),
+      ("rejections", ← native.getObjVal? "rejections")]
+    rows := rows ++ [row]
+    cases := cases ++ [(name, Json.mkObj [("format", toJson "compilatrix/source-native-runtime-case/1"),
+      ("summary", row), ("source", toJson values.reverse), ("ixir0", toJson values.reverse),
+      ("ixir1", Json.mkObj [("value", toJson values.reverse), ("input", toJson input1.heap),
+        ("argument", toJson argument1), ("result", toJson value1), ("store", toJson store1), ("reclaimed", toJson reclaimed1)]),
+      ("baseline_logical", baselineLogical), ("baseline_physical", baselinePhysical),
+      ("selected_logical", selectedLogical), ("selected_physical", selectedPhysical), ("native", native)])]
+  let mut rejections := #[]
+  for (name, values) in [("word-overflow", [UInt64.size]), ("word-overflow-mixed", [7, UInt64.size + 7]),
+      ("length-sixty-five", List.range 65)] do
+    let .error reason := ofNats values | throw s!"{name}: runtime adapter accepted"
+    rejections := rejections.push (Json.mkObj [("name", toJson name), ("reason", toJson reason)])
+  for (name, policy) in [("disabled", ({ enabled := false } : IxIR2.UniqueLower.ReusePolicy)),
+      ("rewrite-budget", { maxRewrites := 0 })] do
+    let selected ← Runtime.select schema IxIR2.Validate.defaultLimits policy
+    need (!selected.reuse) s!"{name}: runtime selector accepted"
+    let .skipped reason := Native.select { compilation with selection := selected } foldCounters
+      | throw s!"{name}: native selector accepted the consuming fallback"
+    rejections := rejections.push (Json.mkObj [("name", toJson name), ("reason", toJson reason)])
+  let .error limitReason := Runtime.select schema { IxIR2.Validate.defaultLimits with maxDeclarations := 0 } {}
+    | throw "runtime target limit accepted"
+  rejections := rejections.push (Json.mkObj [("name", toJson "target-limit-zero"), ("reason", toJson limitReason)])
+  let baseline ← Runtime.select schema IxIR2.Validate.defaultLimits { enabled := false }
+  let pipeline := Json.mkObj [("format", toJson "compilatrix/source-native-runtime-pipeline/1"),
+    ("source", Json.mkObj [("root", toJson source.root), ("identity", toJson (Address.blake3 (sourceBytes source.constants source.entry))),
+      ("input_bytes", Coverage.byteJson (sourceBytes source.constants source.entry)),
+      ("constants", toJson (source.constants.map fun (address, constant) => Json.mkObj [
+        ("key", toJson address), ("bytes", Coverage.byteJson (ser constant))])),
+      ("entry", Coverage.byteJson (ser source.entry.source)), ("entry_refs", toJson source.entry.refs),
+      ("entry_univs", toJson (source.entry.univs.toList.map fun univ => Coverage.byteJson (ser univ))),
+      ("argument_worlds", toJson ["unique"]), ("result_world", toJson "unique")]),
+    ("ixir0", Json.mkObj [("raw", Coverage.ir0Entries erased.raw), ("raw_main", Coverage.byteJson compilation.erased.rawMain.bytes),
+      ("declarations", Coverage.ir0Entries erased.declarations), ("main", Coverage.byteJson erased.main.bytes),
+      ("groups", toJson (erased.groups.map Coverage.ir0Group)), ("blocks", toJson (erased.addressed.blocks.map Coverage.ir0Block)),
+      ("address_map", toJson erased.addressMap)]),
+    ("schema", toJson schema), ("entry_address", toJson (entryAddress schema)), ("worker_address", toJson (functionAddress schema)),
+    ("ixir1", Json.mkObj [("root", toJson output.graph),
+      ("main", Coverage.byteJson (UniqueReuse.mainCode { schema, values := [] }).bytes),
+      ("artifacts", toJson ((Runtime.artifacts schema).map Coverage.ir1Artifact))]),
+    ("policies", Json.mkObj [("source", toJson Runtime.policyTag), ("usage", toJson Ixon.RecursorUsage.policyTag),
+      ("lowering", toJson IxIR2.UniqueLower.policyTag), ("reuse", toJson IxIR2.UniqueLower.reusePolicyTag),
+      ("execution", toJson IxIR2.CreditPolicy.callLocalV0.tag), ("check_fuel", toJson (1000 : Nat)), ("erase_fuel", toJson (1000 : Nat))]),
+    ("ixir2_diagnostic", Json.mkObj [("baseline", toJson (Runtime.program schema false)),
+      ("selected", toJson (Runtime.program schema compilation.selection.reuse)),
+      ("baseline_stats", toJson baseline.checked.stats), ("selected_stats", toJson compilation.selection.checked.stats),
+      ("limits", toJson IxIR2.Validate.defaultLimits)]),
+    ("abi", Json.mkObj [("policy", toJson RuntimeTarget.abiTag), ("selector", toJson (RuntimeTarget.policyTag foldCounters)),
+      ("max_length", toJson maxLength), ("header_words", toJson headerWords), ("cell_words", toJson cellWords)]),
+    ("main", objectJson main), ("release", objectJson release)]
+  let report := Json.mkObj [("format", toJson "compilatrix/source-native-runtime-report/1"),
+    ("pipeline", toJson "pipeline.json"), ("pipeline_identity", toJson (Address.blake3 pipeline.compress.toUTF8)),
+    ("source_identity", toJson (Address.blake3 (sourceBytes source.constants source.entry))), ("ixir1_root", toJson output.graph),
+    ("main_identity", toJson (Address.blake3 main.bytes)), ("release_identity", toJson (Address.blake3 release.bytes)),
+    ("main_policy", toJson main.policyIdentity), ("release_policy", toJson release.policyIdentity),
+    ("cases", toJson rows), ("adapter_and_selection_rejections", Json.arr rejections)]
+  return { pipeline, cases, report, mainObject := main.bytes, releaseObject := release.bytes }
+
+end Ix.Compiler.UniqueReuse.Runtime.Native.Examples
diff --git a/Ix/Compiler/UniqueReuse/RuntimeSource.lean b/Ix/Compiler/UniqueReuse/RuntimeSource.lean
new file mode 100644
index 000000000..b5523f323
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeSource.lean
@@ -0,0 +1,94 @@
+import Ix.Compiler.UniqueReuse.Sources
+import Ix.Compiler.UniqueReuse.ModeCheck
+
+/-! A checked source function with one owned list argument. Its constants and
+entry contain no input payloads. The closed expression names the function;
+runtime application is a separate semantic operation. -/
+
+namespace Ix.Compiler.UniqueReuse.Runtime
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.UniqueReverse (Schema SourceMatches)
+
+def policyTag : String := "unique-reverse-runtime/1"
+
+structure Source where
+  constants : List (Address × Constant)
+  root : Address
+  dataBlock : Address
+  nil : Address
+  cons : Address
+
+def Source.entry (source : Source) : Pipeline.ClosedEntry :=
+  { refs := #[source.root], univs := #[.zero], source := .ref 0 #[] }
+
+/-- Reuse the accepted unique constructor and recursor declarations, replacing
+only the closed fixture entry with `fun xs => reverseOnto nil xs`. -/
+def source : Except String Source := do
+  let base ← Examples.source []
+  let listType := (base.constants.find? fun pair => match pair.2.info with
+    | .iPrj projection => projection.idx == 1 && projection.block == base.dataBlock
+    | _ => false).map (·.1)
+  let some listType := listType | throw "unique list type projection is missing"
+  let body : Ixon.Expr := .app
+    (.app (.app (.ref 0 #[]) (.ref 3 #[])) (.ref 1 #[])) (.var 0)
+  let entry ← Coverage.addressed
+    { info := .defn
+        { kind := .defn, safety := .safe, lvls := 0
+          typ := .all .linear .unique (.ref 4 #[]) (.ref 4 #[])
+          value := .lam .linear (.ref 4 #[]) body }
+      sharing := #[], refs := #[base.recursor, base.nil, base.cons, base.builder, listType]
+      univs := #[.zero] }
+  return { constants := base.constants.filter (fun pair => pair.1 != base.root) ++ [entry],
+           root := entry.1, dataBlock := base.dataBlock, nil := base.nil, cons := base.cons }
+
+def body (schema : Schema) : IxIR0.Expr :=
+  IxIR0.UniqueReverse.literalCall schema (.var 0) (.ref schema.nil)
+
+structure SourceShape (declarations : List (Address × IxIR0.Decl)) (main : IxIR0.Expr) where
+  schema : Schema
+  root : Address
+  mainEq : main = .ref root
+  declarationsAt : SourceMatches (IxIR0.Env.ofList declarations) schema
+  entry : IxIR0.Env.ofList declarations root = some (.defn .unique (.lam .linear (body schema)))
+
+def recognize (declarations : List (Address × IxIR0.Decl)) (main : IxIR0.Expr) :
+    Option (SourceShape declarations main) := do
+  let .ref root := main | none
+  let env := IxIR0.Env.ofList declarations
+  let some (.defn .unique (.lam .linear
+      (.app (.app (.app (.ref alias) (.ref builder)) (.ref nil)) (.var 0)))) := env root | none
+  let some (.defn .shared (.ref recursor)) := env alias | none
+  let some (.defn .unique (.lam .linear (.lam .linear
+      (.app (.app (.ref cons) (.var 1)) (.var 0))))) := env builder | none
+  let schema : Schema := { nil, cons, alias, recursor, builder }
+  if hm : SourceMatches env schema then
+    if he : env root = some (.defn .unique (.lam .linear (body schema))) then
+      if hmain : main = .ref root then
+        some { schema, root, mainEq := hmain, declarationsAt := hm, entry := he }
+      else none
+    else none
+  else none
+
+structure CheckedSource {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    (erased : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .shared checkFuel eraseFuel) where
+  shape : SourceShape erased.erasure.result.raw erased.rawMain
+  modes : ModeEvidence (Pipeline.ResolverIndex.ofList constants).resolve shape.schema checkFuel
+  argumentMode : builderWorlds? (Pipeline.ResolverIndex.ofList constants).resolve shape.root checkFuel =
+    some ([.unique], .unique)
+
+def checkSource {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    (erased : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .shared checkFuel eraseFuel) :
+    Except String (CheckedSource erased) := do
+  let some shape := recognize erased.erasure.result.raw erased.rawMain
+    | throw "runtime reverse requires the checked one-argument source function"
+  let resolve := (Pipeline.ResolverIndex.ofList constants).resolve
+  if hm : ModeEvidence resolve shape.schema checkFuel then
+    if ha : builderWorlds? resolve shape.root checkFuel = some ([.unique], .unique) then
+      return { shape, modes := hm, argumentMode := ha }
+    else throw "runtime reverse entry must consume one unique list and return a unique list"
+  else throw "runtime reverse constructor and recursor worlds do not match"
+
+end Ix.Compiler.UniqueReuse.Runtime
diff --git a/Ix/Compiler/UniqueReuse/RuntimeSourceSim.lean b/Ix/Compiler/UniqueReuse/RuntimeSourceSim.lean
new file mode 100644
index 000000000..8361bdb36
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeSourceSim.lean
@@ -0,0 +1,70 @@
+import Ix.Compiler.UniqueReuse.Runtime
+import Ix.Compiler.IxIR0.UniqueReverseSim
+import Ix.Compiler.SimApply
+
+namespace Ix.Compiler.UniqueReuse.Runtime
+
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.Recursion
+open Ix.Compiler.IxIR0.UniqueReverse (listValue literalRun reverseOnto_nil)
+
+def functionValue (schema : IxIR0.UniqueReverse.Schema) : IxIR0.Value := .clos .linear [] (body schema)
+
+theorem SourceShape.evaluates {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    (shape : SourceShape declarations main) :
+    Evaluates { env := IxIR0.Env.ofList declarations } [] main (functionValue shape.schema) := by
+  simpa only [shape.mainEq, functionValue] using evaluatesDef shape.entry
+    (evaluatesLam { env := IxIR0.Env.ofList declarations } [] .linear _)
+
+theorem SourceShape.applies {declarations : List (Address × IxIR0.Decl)} {main : IxIR0.Expr}
+    (shape : SourceShape declarations main) (values : List Nat) :
+    Applies { env := IxIR0.Env.ofList declarations } (functionValue shape.schema)
+      (listValue shape.schema values) (listValue shape.schema values.reverse) := by
+  apply appliesClosure
+  have run := literalRun (ctx := { env := IxIR0.Env.ofList declarations }) shape.declarationsAt
+    (evaluatesVar (by rfl : [listValue shape.schema values][0]? = some (listValue shape.schema values)))
+    (evaluatesNullary (ctx := { env := IxIR0.Env.ofList declarations }) shape.declarationsAt.nil)
+  simpa only [body, reverseOnto_nil] using run
+
+theorem applies_unique {ctx : IxIR0.Ctx} {function argument left right : IxIR0.Value}
+    (first : Applies ctx function argument left) (second : Applies ctx function argument right) : left = right := by
+  obtain ⟨a, ha⟩ := first
+  obtain ⟨b, hb⟩ := second
+  have ha' := IxIR0.apply_mono (fuel' := a + b) (by omega) ha
+  have hb' := IxIR0.apply_mono (fuel' := a + b) (by omega) hb
+  exact Except.ok.inj (ha'.symm.trans hb')
+
+/-- The same compiled function preserves every represented runtime argument.
+Successful source application remains the forward-preservation premise. -/
+theorem Compilation.sourceRefines
+    {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits)
+    {functionFuel applyFuel : Nat} {function argument result : Ixon.Eval.Value} {values : List Nat}
+    (oracles : @Sim.OracleRel compilation.erased.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config)
+      functionFuel entry.frame [] entry.source = .ok function)
+    (argumentWF : argument.SharingWF)
+    (argumentRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw }
+      argument (listValue compilation.schema values) compilation.erased.memberScope)
+    (applied : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config)
+      applyFuel function argument = .ok result) :
+    @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList compilation.erased.erasure.result.raw }
+      result (listValue compilation.schema values.reverse) compilation.erased.memberScope := by
+  letI : Sim.MemberScope := compilation.erased.memberScope
+  obtain ⟨_, _, functionRun, functionRel⟩ := compilation.erased.sourceRefines oracles contextWF evaluated
+  have functionEq := Evaluates.unique ⟨_, functionRun⟩ compilation.source.shape.evaluates
+  rw [functionEq] at functionRel
+  have functionWF := (Ixon.Eval.eval_inlineSharing contextWF entry.frameSharingWF .nil
+    compilation.erased.entrySharesBelow evaluated).2
+  obtain ⟨_, _, resultRun, resultRel⟩ := Sim.apply_sim_inlineSharing compilation.erased.members
+    oracles contextWF functionWF argumentWF applied functionRel argumentRel
+  have resultEq := applies_unique ⟨_, resultRun⟩ (compilation.source.shape.applies values)
+  simpa only [resultEq, Compilation.schema] using resultRel
+
+end Ix.Compiler.UniqueReuse.Runtime
diff --git a/Ix/Compiler/UniqueReuse/RuntimeTarget.lean b/Ix/Compiler/UniqueReuse/RuntimeTarget.lean
new file mode 100644
index 000000000..de873d007
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/RuntimeTarget.lean
@@ -0,0 +1,164 @@
+import Ix.Compiler.UniqueReuse.Runtime
+import Ix.Compiler.UniqueReuse.TargetMain
+
+/-! The actual exported IxIR₂ function starts from a caller-owned list,
+allocates its empty accumulator, and enters the selected reversal worker.
+The input observations account for the caller's existing allocation. -/
+
+namespace Ix.Compiler.UniqueReuse.Runtime.Target
+
+open Ix.Compiler.IxIR0.UniqueReverse (Schema)
+open Ix.Compiler.IxIR1.Sim (RootOwnership)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.UniqueReuse.Target
+
+def context (schema : Schema) (reuse : Bool) : Context :=
+  .ofProgram (Runtime.program schema reuse) (UniqueLower.schemas schema)
+
+structure Input (schema : Schema) (values : List Nat) (store : Store) (value : RVal) : Prop where
+  owned : RootOwnership store.heap [⟨.unique, value⟩]
+  list : ListAt schema store.heap values value
+  allocs : store.heap.allocs = values.length + 1
+  frees : store.heap.frees = 0
+  reuses : store.heap.reuses = 0
+  rcops : store.heap.rcops = 0
+  live : store.live = values.length + 1
+  peak : store.peakLiveNodes = values.length + 1
+  attempts : store.resetAttempts = 0
+  hot : store.hotResets = 0
+  cold : store.coldResets = 0
+  payload : store.reusedPayloadUnits = 0
+
+def controlCost (reuse : Bool) (length : Nat) : Nat := consControl reuse * length + 6
+
+/-- Caller-side construction, separate from the compiled function. -/
+def makeInput (schema : Schema) : List Nat → Store × RVal
+  | [] =>
+      let allocated := ({} : Store).allocNode .unique (.ctorN (nilId schema) #[])
+      (allocated.1, .loc allocated.2)
+  | head :: tail =>
+      let input := makeInput schema tail
+      let allocated := input.1.allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), input.2])
+      (allocated.1, .loc allocated.2)
+
+theorem makeInput_valid (schema : Schema) (values : List Nat) :
+    Input schema values (makeInput schema values).1 (makeInput schema values).2 := by
+  induction values with
+  | nil =>
+      refine ⟨ownedNilAllocation RootOwnership.empty schema, nilAllocated {} schema,
+        rfl, rfl, rfl, rfl, ?_, rfl, rfl, rfl, rfl, rfl⟩
+      exact Store.live_allocNode {} .unique _
+  | cons head tail ih =>
+      let input := makeInput schema tail
+      have ready : RootOwnership input.1.heap
+          (IxIR1.Sim.rootsFor .unique (IxIR1.Sim.nodeChildren (.ctorN (consId schema) #[.lit (.nat head), input.2])) ++ []) :=
+        RootOwnership.addNoLocation (value := .lit (.nat head)) rfl ih.owned
+      refine ⟨ready.allocNode trivial, consAllocated ih.list head, ?_, ih.frees, ih.reuses, ih.rcops, ?_, ?_,
+        ih.attempts, ih.hot, ih.cold, ih.payload⟩
+      · simp [makeInput, IxIR1.Store.allocNode, ih.allocs]
+      · simp [makeInput, Store.live_allocNode, ih.live]
+      · simp only [makeInput]
+        rw [Store.peakLive_allocNode, Store.live_allocNode, ih.peak, ih.live]
+        simp [Nat.max_eq_right (show tail.length + 1 ≤ tail.length + 1 + 1 by omega)]
+
+theorem inputSteps (schema : Schema) (reuse : Bool) (mode : Interpretation)
+    (values : List Nat) (before : Store) (argument : RVal) (heapFuel : Nat)
+    (input : Input schema values before argument)
+    (distinct : entryAddress schema ≠ functionAddress schema) :
+    ∃ after value,
+      Steps (context schema reuse) mode (controlCost reuse values.length)
+        (initialMachine (targetEntry schema) #[argument] heapFuel before)
+        { store := after, heapFuel, control := .halted value } ∧
+      MainResult { schema, values } reuse mode after value := by
+  let allocated := before.allocNode .unique (.ctorN (nilId schema) #[])
+  let entryPoint := fun store pc registers =>
+    inputPoint (targetEntry schema) store heapFuel pc registers
+  have nilRun := Step.alloc (context := context schema reuse) (interpretation := mode)
+    (arguments := #[]) (world := .unique) (cid := nilId schema)
+    (machine := entryPoint before 0 #[argument]) rfl rfl (by change 0 < 1; decide) rfl
+    (nilSchemaAt schema) rfl (nilFields schema before)
+  have call := Step.tailCallFn (context := context schema reuse) (interpretation := mode)
+    (definition := UniqueLower.function schema reuse)
+    (machine := entryPoint allocated.1 1 (#[argument].push (.loc allocated.2)))
+    rfl rfl rfl rfl rfl (values := #[.loc allocated.2, argument]) rfl
+    (by simp [context, Context.ofProgram, Runtime.program, distinct]) rfl rfl
+  have allocatedLive : allocated.1.live = values.length + 2 := by
+    simp [allocated, Store.live_allocNode, input.live, Nat.add_assoc]
+  have allocatedPeak : allocated.1.peakLiveNodes = values.length + 2 := by
+    rw [Store.peakLive_allocNode, allocatedLive, input.peak]
+    omega
+  have owned : RootOwnership allocated.1.heap [⟨.unique, argument⟩, ⟨.unique, .loc allocated.2⟩] :=
+    (ownedNilAllocation input.owned schema).perm (List.Perm.swap _ _ [])
+  obtain ⟨after, value, loopRun, result⟩ := loopSteps (context schema reuse) mode schema reuse values
+    allocated.1 heapFuel argument (.loc allocated.2) [] rfl owned
+    (input.list.allocNode .unique _) (nilAllocated before.heap schema)
+    (by rw [allocatedLive, allocatedPeak]; exact Nat.le_refl _)
+  refine ⟨after, value, ?_, result.owned, ?_, ?_, ?_, ?_, ?_, ?_, ?_,
+    result.attempts.trans input.attempts, result.hot.trans input.hot,
+    result.cold.trans input.cold, ?_⟩
+  · have history := ((nilRun.toSteps rfl).trans (call.toSteps rfl)).trans loopRun
+    have initial : initialMachine (targetEntry schema) #[argument] heapFuel before =
+        entryPoint before 0 #[argument] := by
+      have peak : max before.peakLiveNodes before.live = before.peakLiveNodes := by
+        rw [input.live, input.peak]; omega
+      change ({ store := { before with peakLiveNodes := max before.peakLiveNodes before.live }, heapFuel,
+                control := .running { definition := targetEntry schema, values := #[argument] } [] } : Machine) = _
+      rw [peak]
+      rfl
+    rw [initial]
+    have cost : 1 + 1 + (consControl reuse * values.length + 4) = controlCost reuse values.length := by
+      simp only [controlCost]
+      omega
+    rw [cost] at history
+    exact history
+  · simpa using result.list
+  · rw [result.allocs]
+    simp [allocated, IxIR1.Store.allocNode, input.allocs, Nat.add_assoc]
+  · rw [result.frees]
+    simp [allocated, IxIR1.Store.allocNode, input.frees]
+  · rw [result.reuses]
+    simp [allocated, IxIR1.Store.allocNode, input.reuses]
+  · exact result.rcops.trans input.rcops
+  · have live := result.live
+    rw [allocatedLive] at live
+    simpa using Nat.add_right_cancel live
+  · exact result.peak.trans allocatedPeak
+  · rw [result.payload]
+    change before.reusedPayloadUnits + _ = _
+    rw [input.payload, Nat.zero_add]
+
+theorem inputRuns (schema : Schema) (reuse : Bool) (mode : Interpretation)
+    (values : List Nat) (before : Store) (argument : RVal) (heapFuel : Nat)
+    (input : Input schema values before argument)
+    (distinct : entryAddress schema ≠ functionAddress schema) :
+    ∃ result,
+      runFunction (context schema reuse) mode (targetEntry schema) #[argument]
+        (controlCost reuse values.length) heapFuel before = .ok result ∧
+      MainResult { schema, values } reuse mode result.store result.value ∧
+      result.controlRemaining = 0 ∧ result.heapRemaining = heapFuel := by
+  obtain ⟨after, value, steps, result⟩ := inputSteps schema reuse mode values before argument heapFuel input distinct
+  exact ⟨⟨after, value, 0, heapFuel⟩,
+    by rw [runFunction_eq_runMachine rfl rfl]; exact steps.runMachine_halted,
+    result, rfl, rfl⟩
+
+end Ix.Compiler.UniqueReuse.Runtime.Target
+
+namespace Ix.Compiler.UniqueReuse.Runtime
+
+open Ix.Compiler.Ixon (Address Constant)
+
+theorem Compilation.targetRuns {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat} {limits : IxIR2.Validate.Limits}
+    (compilation : Compilation constants entry config checkFuel eraseFuel limits)
+    (values : List Nat) (before : IxIR2.Eval.Store) (argument : IxIR1.RVal) (heapFuel : Nat)
+    (input : Target.Input compilation.schema values before argument) (mode : IxIR2.Eval.Interpretation) :
+    ∃ result,
+      IxIR2.Eval.runFunction (Target.context compilation.schema compilation.selection.reuse) mode
+        (targetEntry compilation.schema) #[argument] (Target.controlCost compilation.selection.reuse values.length)
+        heapFuel before = .ok result ∧
+      UniqueReuse.Target.MainResult { schema := compilation.schema, values } compilation.selection.reuse mode result.store result.value ∧
+      result.controlRemaining = 0 ∧ result.heapRemaining = heapFuel :=
+  Target.inputRuns compilation.schema compilation.selection.reuse mode values before argument heapFuel input compilation.selection.distinct
+
+end Ix.Compiler.UniqueReuse.Runtime
diff --git a/Ix/Compiler/UniqueReuse/SourceSim.lean b/Ix/Compiler/UniqueReuse/SourceSim.lean
new file mode 100644
index 000000000..bb0c7b4e1
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/SourceSim.lean
@@ -0,0 +1,29 @@
+import Ix.Compiler.UniqueReuse.ModeCheck
+import Ix.Compiler.IxIR0.UniqueReverseSim
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.Ixon (Address Constant)
+
+/-- The original successful source value is related to the checked reversal
+value. Its ownership modes and syntax come from the compiler certificate;
+callers supply only the established source sharing/oracle contract. -/
+theorem CheckedSource.sourceValue
+    {constants : List (Address × Constant)} {entry : Pipeline.ClosedEntry}
+    {config : Pipeline.Config} {checkFuel eraseFuel : Nat}
+    {source : Pipeline.CertifiedErasure constants entry config .saturatedRecursorV1 .unique checkFuel eraseFuel}
+    (checked : CheckedSource source) {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel source.memberScope
+      (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList source.erasure.result.raw })
+    (hctx : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) sourceFuel entry.frame []
+      entry.source = .ok sourceValue) :
+    @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList source.erasure.result.raw }
+      sourceValue checked.recovery.checked.plan.value source.memberScope := by
+  obtain ⟨fuel, value, heval, hrelated⟩ := source.sourceRefines horacles hctx hsource
+  have heq := IxIR0.Recursion.Evaluates.unique ⟨fuel, heval⟩ checked.recovery.checked.sourceEvaluates
+  simpa only [heq] using hrelated
+
+end Ix.Compiler.UniqueReuse
diff --git a/Ix/Compiler/UniqueReuse/Sources.lean b/Ix/Compiler/UniqueReuse/Sources.lean
new file mode 100644
index 000000000..2f4dd6ff7
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/Sources.lean
@@ -0,0 +1,105 @@
+import Ix.Compiler.Coverage.Sources
+import Ix.Compiler.Ixon.RecursorUsage
+import Ix.Compiler.PipelineErasure
+
+/-! Canonical Ixon inputs with unique list fields and a unique-major
+accumulator recursor. The entry is an explicit erased-argument application,
+whose unique result is checked before ownership lowering. -/
+
+namespace Ix.Compiler.UniqueReuse.Examples
+
+open Ix.Compiler.Ixon
+
+private def definition (value typ : Expr) (refs : Array Address) : Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def projection (info : ConstantInfo) : Constant :=
+  { info, sharing := #[], refs := #[], univs := #[] }
+
+private def app2 (f x y : Expr) : Expr := .app (.app f x) y
+private def app3 (f x y z : Expr) : Expr := .app (app2 f x y) z
+
+structure Source where
+  constants : List (Address × Constant)
+  root : Address
+  values : List Nat
+  dataBlock : Address
+  nil : Address
+  cons : Address
+  recursor : Address
+  builder : Address
+
+def Source.config (source : Source) : Pipeline.Config :=
+  { blobs := fun address => (source.values.find? fun value =>
+      X86.ValidatedScalar.literalAddress value == address).map .natB }
+
+def Source.mainFrame (source : Source) : Ixon.Eval.Frame :=
+  { refs := #[source.root], univs := #[.zero] }
+
+def Source.main : Expr := .app (.ref 0 #[]) (.sort 0)
+
+def Source.entry (source : Source) : Pipeline.ClosedEntry :=
+  { refs := #[source.root], univs := #[.zero], source := Source.main }
+
+def source (values : List Nat) (maxElements : Nat := 64) : Except String Source := do
+  if values.length > maxElements then throw s!"unique fixture exceeds {maxElements} list elements"
+  let natT := Expr.recur 0 #[]
+  let listT := Expr.recur 1 #[]
+  let builderT := .all .linear .unique natT (.all .linear .unique listT listT)
+  let recursor : Recursor :=
+    { k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0
+      motives := 0, minors := 2
+      typ := .all .many .shared builderT
+        (.all .linear .unique listT (.all .linear .unique listT listT))
+      rules := #[
+        { fields := 0
+          rhs := .lam .many builderT (.lam .linear listT (.var 0)) },
+        { fields := 2
+          rhs := .lam .many builderT (.lam .linear listT
+            (.lam .linear natT (.lam .linear listT
+              (.app (app2 (.recur 2 #[]) (.var 3)
+                (app2 (.var 3) (.var 1) (.var 2))) (.var 0))))) }] }
+  let dataBlock ← Coverage.addressed
+    { info := .muts #[
+        .indc {
+          isUnsafe := false, lvls := 0, params := 0, indices := 0, typ := .sort 0
+          ctors := #[
+            { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0, typ := natT },
+            { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1
+              typ := .all .many .shared natT natT }] },
+        .indc {
+          isUnsafe := false, lvls := 0, params := 0, indices := 0
+          typ := .sort 0
+          ctors := #[
+            { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0
+              typ := listT },
+            { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 2
+              typ := .all .linear .unique natT (.all .linear .unique listT listT) }] },
+        .recr recursor]
+      sharing := #[], refs := #[], univs := #[.zero] }
+  let nil ← Coverage.addressed (projection (.cPrj { idx := 1, cidx := 0, block := dataBlock.1 }))
+  let cons ← Coverage.addressed (projection (.cPrj { idx := 1, cidx := 1, block := dataBlock.1 }))
+  let natType ← Coverage.addressed (projection (.iPrj { idx := 0, block := dataBlock.1 }))
+  let listType ← Coverage.addressed (projection (.iPrj { idx := 1, block := dataBlock.1 }))
+  let recursorPrj ← Coverage.addressed (projection (.rPrj { idx := 2, block := dataBlock.1 }))
+  let listT := Expr.ref 2 #[]
+  let builder ← Coverage.addressed (definition
+    (.lam .linear (.ref 1 #[]) (.lam .linear listT
+      (app2 (.ref 0 #[]) (.var 1) (.var 0))))
+    (.all .linear .unique (.ref 1 #[]) (.all .linear .unique listT listT))
+    #[cons.1, natType.1, listType.1])
+  let input := (values.mapIdx fun index _ => Expr.nat (index + 5).toUInt64).foldr
+    (fun head tail => app2 (.ref 2 #[]) head tail) (.ref 1 #[])
+  let body := app3 (.ref 0 #[]) (.ref 3 #[]) (.ref 1 #[]) input
+  let entry ← Coverage.addressed (definition
+    (.lam .erased (.sort 0) body)
+    (.all .erased .unique (.sort 0) (.ref 4 #[]))
+    (#[recursorPrj.1, nil.1, cons.1, builder.1, listType.1] ++
+      (values.map X86.ValidatedScalar.literalAddress).toArray))
+  return {
+    constants := [dataBlock, nil, cons, natType, listType, recursorPrj, builder, entry]
+    root := entry.1, values, dataBlock := dataBlock.1, nil := nil.1, cons := cons.1
+    recursor := recursorPrj.1, builder := builder.1 }
+
+end Ix.Compiler.UniqueReuse.Examples
diff --git a/Ix/Compiler/UniqueReuse/TargetHeap.lean b/Ix/Compiler/UniqueReuse/TargetHeap.lean
new file mode 100644
index 000000000..bbae414b2
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetHeap.lean
@@ -0,0 +1,94 @@
+import Ix.Compiler.UniqueReuse.Heap
+import Ix.Compiler.IxIR2.UniqueLower
+import Ix.Compiler.IxIR2.ReservationHeap
+import Ix.Compiler.IxIR2.CostObservations
+
+namespace Ix.Compiler.UniqueReuse.Target
+
+open Ix.Compiler.Ixon (Owned)
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+
+def nilSchema (schema : Schema) : CtorSchema :=
+  { layout := Pipeline.baselineLayout .unique (nilId schema), fields := #[] }
+
+def consSchema (schema : Schema) : CtorSchema :=
+  { layout := Pipeline.baselineLayout .unique (consId schema), fields := #[.unique, .unique] }
+
+theorem nilSchemaAt (schema : Schema) :
+    UniqueLower.schemas schema .unique (nilId schema) = some (nilSchema schema) := by
+  simp [UniqueLower.schemas, nilSchema]
+
+theorem cons_ne_nil (schema : Schema) : consId schema ≠ nilId schema := by
+  intro same
+  have := congrArg IxIR1.CtorId.cidx same
+  simp [consId, nilId, IxIR1.Lower.ctorIdOf] at this
+
+theorem consSchemaAt (schema : Schema) :
+    UniqueLower.schemas schema .unique (consId schema) = some (consSchema schema) := by
+  simp [UniqueLower.schemas, consSchema, cons_ne_nil]
+
+theorem listWorld {schema : Schema} {store : Store} {values : List Nat} {value : RVal}
+    (list : ListAt schema store.heap values value) : value.hasWorld store .unique = true := by
+  exact IxIR1.Sim.rval_hasWorld_eq_true_iff.mpr list.hasWorld
+
+theorem nilFields (schema : Schema) (store : Store) : FieldWorlds store (nilSchema schema) #[] := by
+  apply FieldWorlds.of_replicate (world := .unique) (count := 0) rfl rfl
+  simp
+
+theorem consFields {schema : Schema} {store : Store} {values : List Nat} {value : RVal}
+    (list : ListAt schema store.heap values value) (head : Nat) :
+    FieldWorlds store (consSchema schema) #[.lit (.nat head), value] := by
+  apply FieldWorlds.of_replicate (world := .unique) (count := 2) rfl rfl
+  intro candidate member
+  simp at member
+  rcases member with rfl | rfl
+  · rfl
+  · exact listWorld list
+
+theorem reserveRelease {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) :
+    (store.reserve location).releaseReservation location = .ok (store.kill location) := by
+  have empty := Store.reserve_empty found
+  unfold Store.EmptySlot at empty
+  simp only [Store.releaseReservation, empty]
+  rfl
+
+/-- The exact result of reserving and reusing a unique slot, including the
+physical payload and peak observations. -/
+def reuseAt (store : Store) (location : Nat) (node : Node) (payload : Nat) : Store :=
+  let heap := reuseNodeStore store.heap location node
+  { store with
+    heap := heap
+    reusedPayloadUnits := store.reusedPayloadUnits + payload
+    peakLiveNodes := max store.peakLiveNodes heap.live }
+
+theorem reserveReuse {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (node : Node) (payload : Nat) :
+    (store.reserve location).reuseReservation location .unique node payload =
+      .ok (reuseAt store location node payload) := by
+  have empty := Store.reserve_empty found
+  unfold Store.EmptySlot at empty
+  simp only [Store.reuseReservation, empty]
+  simp [Store.reserve, reuseAt, reuseNodeStore, IxIR1.Store.kill, IxIR1.Store.setBox,
+    Array.set!_eq_setIfInBounds]
+  rfl
+
+theorem reuseAt_live {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (node : Node) (payload : Nat) :
+    (reuseAt store location node payload).live = store.live := by
+  have reused := (Store.reuseReservation_accounting (reserveReuse found node payload)).1
+  have reserved := Store.live_reserve found
+  omega
+
+theorem reuseAt_peak {store : Store} {location : Nat} {box : NodeBox}
+    (found : store.get? location = some box) (node : Node) (payload : Nat)
+    (peak : store.live ≤ store.peakLiveNodes) :
+    (reuseAt store location node payload).peakLiveNodes = store.peakLiveNodes := by
+  have live := reuseAt_live found node payload
+  change max store.peakLiveNodes (reuseAt store location node payload).live = _
+  rw [live, Nat.max_eq_left peak]
+
+end Ix.Compiler.UniqueReuse.Target
diff --git a/Ix/Compiler/UniqueReuse/TargetInput.lean b/Ix/Compiler/UniqueReuse/TargetInput.lean
new file mode 100644
index 000000000..2aabecf15
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetInput.lean
@@ -0,0 +1,106 @@
+import Ix.Compiler.UniqueReuse.TargetLoop
+
+namespace Ix.Compiler.UniqueReuse.Target
+
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+
+def inputPrefix (schema : Schema) (values : List Nat) : Array Instr :=
+  #[.alloc .unique (nilId schema) #[]] ++
+    (values.reverse.mapIdx fun index value =>
+      .alloc .unique (consId schema) #[.lit (.nat value), .reg index]).toArray
+
+@[simp] theorem inputPrefix_size (schema : Schema) (values : List Nat) :
+    (inputPrefix schema values).size = values.length + 1 := by
+  simp [inputPrefix]
+
+theorem inputPrefix_cons (schema : Schema) (head : Nat) (tail : List Nat) :
+    inputPrefix schema (head :: tail) = (inputPrefix schema tail).push
+      (.alloc .unique (consId schema) #[.lit (.nat head), .reg tail.length]) := by
+  simp [inputPrefix, List.reverse_cons]
+
+theorem inputInstructions_eq (plan : Plan) :
+    UniqueLower.inputInstructions plan = inputPrefix plan.schema plan.values ++
+      #[.alloc .unique (nilId plan.schema) #[]] := rfl
+
+def inputPoint (definition : Function) (store : Store) (fuel pc : Nat) (values : Array RVal) : Machine :=
+  { store, heapFuel := fuel, control := .running { definition, pc, values } [] }
+
+structure InputResult (schema : Schema) (store : Store) (values : List Nat)
+    (registers : Array RVal) (value : RVal) : Prop where
+  owned : RootOwnership store.heap [⟨.unique, value⟩]
+  list : ListAt schema store.heap values value
+  size : registers.size = values.length + 1
+  last : registers[values.length]? = some value
+  allocs : store.heap.allocs = values.length + 1
+  frees : store.heap.frees = 0
+  reuses : store.heap.reuses = 0
+  rcops : store.heap.rcops = 0
+  live : store.live = values.length + 1
+  peak : store.peakLiveNodes = values.length + 1
+  attempts : store.resetAttempts = 0
+  hot : store.hotResets = 0
+  cold : store.coldResets = 0
+  payload : store.reusedPayloadUnits = 0
+
+theorem inputSteps (ctx : Context) (mode : Interpretation) (schema : Schema) (values : List Nat)
+    (definition : Function) (block : Block) (suffix : Array Instr) (fuel : Nat)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (blockAt : definition.blocks[0]? = some block)
+    (instructions : block.instructions = inputPrefix schema values ++ suffix) :
+    ∃ store registers value,
+      Steps ctx mode (values.length + 1) (inputPoint definition {} fuel 0 #[])
+        (inputPoint definition store fuel (values.length + 1) registers) ∧
+      InputResult schema store values registers value := by
+  induction values generalizing suffix with
+  | nil =>
+      let allocated := ({} : Store).allocNode .unique (.ctorN (nilId schema) #[])
+      have head := Step.alloc (context := ctx) (interpretation := mode)
+        (arguments := #[])
+        (machine := inputPoint definition {} fuel 0 #[]) rfl blockAt
+        (by simp [instructions, inputPrefix]; omega)
+        (by simp [instructions, inputPrefix])
+        (schemas ▸ nilSchemaAt schema) rfl (nilFields schema {})
+      refine ⟨allocated.1, #[.loc allocated.2], .loc allocated.2, head.toSteps rfl,
+        ownedNilAllocation RootOwnership.empty schema, nilAllocated {} schema,
+        rfl, rfl, rfl, rfl, rfl, rfl, ?_, ?_, rfl, rfl, rfl, rfl⟩
+      · exact Store.live_allocNode {} .unique _
+      · rfl
+  | cons head tail ih =>
+      let operation := Instr.alloc .unique (consId schema) #[.lit (.nat head), .reg tail.length]
+      have instructions' : block.instructions = inputPrefix schema tail ++ (#[operation] ++ suffix) := by
+        rw [instructions, inputPrefix_cons]
+        simp only [Array.push_eq_append, Array.append_assoc, operation]
+      obtain ⟨middle, registers, tailValue, first, result⟩ := ih (#[operation] ++ suffix) instructions'
+      let allocated := middle.allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), tailValue])
+      have bound : tail.length + 1 < block.instructions.size := by
+        simp [instructions']; omega
+      have step := Step.alloc (context := ctx) (interpretation := mode)
+        (arguments := #[.lit (.nat head), .reg tail.length])
+        (machine := inputPoint definition middle fuel (tail.length + 1) registers) rfl blockAt
+        bound
+        (by
+          change block.instructions[tail.length + 1] = operation
+          simp only [instructions']
+          rw [Array.getElem_append_right (by simp)]
+          simp)
+        (schemas ▸ consSchemaAt schema)
+        (by simp [resolveAtoms, resolveAtom, result.last]; rfl)
+        (consFields result.list head)
+      have ready : RootOwnership middle.heap
+          (rootsFor .unique (nodeChildren (.ctorN (consId schema) #[.lit (.nat head), tailValue])) ++ []) :=
+        RootOwnership.addNoLocation (value := .lit (.nat head)) rfl result.owned
+      refine ⟨allocated.1, registers.push (.loc allocated.2), .loc allocated.2, ?_, ready.allocNode trivial,
+        consAllocated result.list head, ?_, ?_, ?_, result.frees, result.reuses, result.rcops,
+        ?_, ?_, result.attempts, result.hot, result.cold, result.payload⟩
+      · exact first.trans (step.toSteps rfl)
+      · simp [result.size]
+      · simp [show (head :: tail).length = registers.size by simp [result.size]]
+      · simp [allocated, IxIR1.Store.allocNode, result.allocs]
+      · simp [allocated, Store.live_allocNode, result.live]
+      · rw [Store.peakLive_allocNode, Store.live_allocNode, result.peak, result.live]
+        simp [Nat.max_eq_right (show tail.length + 1 ≤ tail.length + 1 + 1 by omega)]
+
+end Ix.Compiler.UniqueReuse.Target
diff --git a/Ix/Compiler/UniqueReuse/TargetLoop.lean b/Ix/Compiler/UniqueReuse/TargetLoop.lean
new file mode 100644
index 000000000..bc99913ba
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetLoop.lean
@@ -0,0 +1,158 @@
+import Ix.Compiler.UniqueReuse.TargetSteps
+
+namespace Ix.Compiler.UniqueReuse.Target
+
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+
+def inPlace (reuse : Bool) (mode : Interpretation) : Bool := reuse && mode == .physical
+def freshPerCons (reuse : Bool) (mode : Interpretation) : Nat := if inPlace reuse mode then 0 else 1
+def reusesPerCons (reuse : Bool) (mode : Interpretation) : Nat := if inPlace reuse mode then 1 else 0
+def consControl (reuse : Bool) : Nat := if reuse then 4 else 5
+
+structure ConsResult (schema : Schema) (physical : Bool) (before after : Store)
+    (head : Nat) (tailValues accValues : List Nat) (tail accumulator : RVal) : Prop where
+  owned : RootOwnership after.heap [⟨.unique, tail⟩, ⟨.unique, accumulator⟩]
+  tailAt : ListAt schema after.heap tailValues tail
+  accAt : ListAt schema after.heap (head :: accValues) accumulator
+  allocs : after.heap.allocs = before.heap.allocs + (if physical then 0 else 1)
+  frees : after.heap.frees = before.heap.frees + (if physical then 0 else 1)
+  reuses : after.heap.reuses = before.heap.reuses + (if physical then 1 else 0)
+  rcops : after.heap.rcops = before.heap.rcops
+  live : after.live = before.live
+  peak : after.peakLiveNodes = before.peakLiveNodes
+  attempts : after.resetAttempts = before.resetAttempts
+  hot : after.hotResets = before.hotResets
+  cold : after.coldResets = before.coldResets
+  payload : after.reusedPayloadUnits = before.reusedPayloadUnits + (if physical then 2 else 0)
+
+private theorem freshConsResult {schema : Schema} {store : Store} {location head : Nat}
+    {tail acc : RVal} {tailValues accValues : List Nat}
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (taken : TakenCons schema store.heap location head tail acc tailValues accValues)
+    (peak : store.live ≤ store.peakLiveNodes) :
+    let allocated := (store.kill location).allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), acc])
+    ConsResult schema false store allocated.1 head tailValues accValues tail (.loc allocated.2) := by
+  obtain ⟨owned, tailAt, accAt⟩ := taken.allocate
+  have live := Store.live_kill found
+  refine ⟨owned, tailAt, accAt, rfl, rfl, ?_, rfl, ?_, ?_, rfl, rfl, rfl, ?_⟩
+  · simp; rfl
+  · rw [Store.live_allocNode]; omega
+  · rw [Store.peakLive_allocNode, Store.live_allocNode]
+    change max store.peakLiveNodes ((store.kill location).live + 1) = _
+    rw [live, Nat.max_eq_left peak]
+  · simp; rfl
+
+private theorem physicalConsResult {schema : Schema} {store : Store} {location head : Nat}
+    {tail acc : RVal} {tailValues accValues : List Nat}
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (taken : TakenCons schema store.heap location head tail acc tailValues accValues)
+    (peak : store.live ≤ store.peakLiveNodes) :
+    ConsResult schema true store (reuseAt store location (.ctorN (consId schema) #[.lit (.nat head), acc]) 2)
+      head tailValues accValues tail (.loc location) := by
+  obtain ⟨owned, tailAt, accAt⟩ := taken.reuse found
+  refine ⟨owned, tailAt, accAt, ?_, ?_, rfl, rfl, reuseAt_live found _ 2,
+    reuseAt_peak found _ 2 peak, rfl, rfl, rfl, rfl⟩ <;> simp [reuseAt, reuseNodeStore] <;> rfl
+
+theorem consSteps (ctx : Context) (mode : Interpretation) (schema : Schema) (reuse : Bool)
+    (store : Store) (fuel location head : Nat) (tail acc : RVal) (tailValues accValues : List Nat)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (taken : TakenCons schema store.heap location head tail acc tailValues accValues)
+    (peak : store.live ≤ store.peakLiveNodes) :
+    ∃ output value,
+      Steps ctx mode (consControl reuse) (loop schema reuse store fuel acc (.loc location))
+        (loop schema reuse output fuel value tail) ∧
+      ConsResult schema (inPlace reuse mode) store output head tailValues accValues tail value := by
+  let allocated := (store.kill location).allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), acc])
+  have fields := consFields (store := store.kill location) taken.accAt head
+  cases reuse with
+  | false =>
+      exact ⟨allocated.1, .loc allocated.2,
+        consBaselineSteps ctx mode schema store fuel location head tail acc schemas found fields,
+        freshConsResult found taken peak⟩
+  | true =>
+      cases mode with
+      | logical =>
+          exact ⟨allocated.1, .loc allocated.2,
+            consLogicalSteps ctx schema store fuel location head tail acc schemas found fields,
+            freshConsResult found taken peak⟩
+      | physical =>
+          have accAt : ListAt schema (store.reserve location).heap accValues acc :=
+            taken.accAt.mono (before := store.heap.kill location)
+              (after := (store.reserve location).heap) (fun kept => kept)
+          exact ⟨reuseAt store location (.ctorN (consId schema) #[.lit (.nat head), acc]) 2, .loc location,
+            consPhysicalSteps ctx schema store fuel location head tail acc schemas found
+              (consFields (store := store.reserve location) accAt head),
+            physicalConsResult found taken peak⟩
+
+structure LoopResult (schema : Schema) (reuse : Bool) (mode : Interpretation) (before after : Store)
+    (values accValues : List Nat) (value : RVal) : Prop where
+  owned : RootOwnership after.heap [⟨.unique, value⟩]
+  list : ListAt schema after.heap (values.reverse ++ accValues) value
+  allocs : after.heap.allocs = before.heap.allocs + freshPerCons reuse mode * values.length
+  frees : after.heap.frees = before.heap.frees + freshPerCons reuse mode * values.length + 1
+  reuses : after.heap.reuses = before.heap.reuses + reusesPerCons reuse mode * values.length
+  rcops : after.heap.rcops = before.heap.rcops
+  live : after.live + 1 = before.live
+  peak : after.peakLiveNodes = before.peakLiveNodes
+  attempts : after.resetAttempts = before.resetAttempts
+  hot : after.hotResets = before.hotResets
+  cold : after.coldResets = before.coldResets
+  payload : after.reusedPayloadUnits = before.reusedPayloadUnits + 2 * reusesPerCons reuse mode * values.length
+
+theorem loopSteps (ctx : Context) (mode : Interpretation) (schema : Schema) (reuse : Bool)
+    (values : List Nat) (store : Store) (fuel : Nat) (major acc : RVal) (accValues : List Nat)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (owned : RootOwnership store.heap [⟨.unique, major⟩, ⟨.unique, acc⟩])
+    (input : ListAt schema store.heap values major) (accAt : ListAt schema store.heap accValues acc)
+    (peak : store.live ≤ store.peakLiveNodes) :
+    ∃ output value,
+      Steps ctx mode (consControl reuse * values.length + 4) (loop schema reuse store fuel acc major)
+        { store := output, heapFuel := fuel, control := .halted value } ∧
+      LoopResult schema reuse mode store output values accValues value := by
+  induction values generalizing store major acc accValues with
+  | nil =>
+      cases input with
+      | @nil location found =>
+          obtain ⟨afterOwned, afterList⟩ := nilConsumed found owned accAt
+          refine ⟨store.kill location, acc, ?_, afterOwned, ?_, ?_, ?_, ?_, rfl,
+            Store.live_kill found, rfl, rfl, rfl, rfl, ?_⟩
+          · simpa using nilSteps ctx mode schema reuse store fuel location acc schemas found (listWorld afterList)
+          · simpa using afterList
+          · simp [Store.kill, IxIR1.Store.kill]
+          · simp [Store.kill, IxIR1.Store.kill]
+          · simp [Store.kill, IxIR1.Store.kill]
+          · simp [Store.kill]
+  | cons head tail ih =>
+      cases input with
+      | @cons _ _ location tailValue found next =>
+          have taken := consTaken found owned next accAt
+          obtain ⟨middle, accumulator, first, middleResult⟩ := consSteps ctx mode schema reuse store fuel
+            location head tailValue acc tail accValues schemas found taken peak
+          obtain ⟨output, value, rest, result⟩ := ih middle tailValue accumulator (head :: accValues)
+            middleResult.owned middleResult.tailAt middleResult.accAt
+            (by rw [middleResult.live, middleResult.peak]; exact peak)
+          refine ⟨output, value, ?_, result.owned, ?_, ?_, ?_, ?_, result.rcops.trans middleResult.rcops,
+            ?_, result.peak.trans middleResult.peak, result.attempts.trans middleResult.attempts,
+            result.hot.trans middleResult.hot, result.cold.trans middleResult.cold, ?_⟩
+          · have count : consControl reuse * (head :: tail).length + 4 =
+                consControl reuse + (consControl reuse * tail.length + 4) := by
+              simp [Nat.mul_add, Nat.add_comm, Nat.add_left_comm]
+            rw [count]
+            exact first.trans rest
+          · simpa [List.reverse_cons, List.append_assoc] using result.list
+          · rw [result.allocs, middleResult.allocs]
+            simp [freshPerCons, Nat.mul_add, Nat.add_assoc, Nat.add_comm]
+          · rw [result.frees, middleResult.frees]
+            simp [freshPerCons, Nat.mul_add, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm]
+          · rw [result.reuses, middleResult.reuses]
+            simp [reusesPerCons, Nat.mul_add, Nat.add_assoc, Nat.add_comm]
+          · rw [result.live, middleResult.live]
+          · rw [result.payload, middleResult.payload]
+            cases h : inPlace reuse mode <;>
+              simp [reusesPerCons, h, Nat.mul_add, Nat.add_assoc, Nat.add_comm]
+
+end Ix.Compiler.UniqueReuse.Target
diff --git a/Ix/Compiler/UniqueReuse/TargetMain.lean b/Ix/Compiler/UniqueReuse/TargetMain.lean
new file mode 100644
index 000000000..d3fe36f9c
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetMain.lean
@@ -0,0 +1,135 @@
+import Ix.Compiler.UniqueReuse.TargetInput
+import Ix.Compiler.UniqueReuse.Reclamation
+
+namespace Ix.Compiler.UniqueReuse.Target
+
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+
+def context (plan : Plan) (reuse : Bool) : Context :=
+  .ofProgram (UniqueLower.program plan reuse) (UniqueLower.schemas plan.schema)
+
+def controlCost (plan : Plan) (reuse : Bool) : Nat :=
+  (consControl reuse + 1) * plan.values.length + 7
+
+structure MainResult (plan : Plan) (reuse : Bool) (mode : Interpretation) (store : Store) (value : RVal) : Prop where
+  owned : RootOwnership store.heap [⟨.unique, value⟩]
+  list : ListAt plan.schema store.heap plan.values.reverse value
+  allocs : store.heap.allocs = plan.values.length + 2 + freshPerCons reuse mode * plan.values.length
+  frees : store.heap.frees = freshPerCons reuse mode * plan.values.length + 1
+  reuses : store.heap.reuses = reusesPerCons reuse mode * plan.values.length
+  rcops : store.heap.rcops = 0
+  live : store.live = plan.values.length + 1
+  peak : store.peakLiveNodes = plan.values.length + 2
+  attempts : store.resetAttempts = 0
+  hot : store.hotResets = 0
+  cold : store.coldResets = 0
+  payload : store.reusedPayloadUnits = 2 * reusesPerCons reuse mode * plan.values.length
+
+/-- Actual execution of the emitted SSA program. Both selection branches and
+both interpretations derive their heap ownership from the empty entry store.
+The main program performs no recursive heap traversal, so its independent
+heap budget is arbitrary. -/
+theorem mainSteps (plan : Plan) (reuse : Bool) (mode : Interpretation) (heapFuel : Nat) :
+    ∃ store value,
+      Steps (context plan reuse) mode (controlCost plan reuse)
+        (initialMachine (UniqueLower.program plan reuse).main #[] heapFuel)
+        { store, heapFuel, control := .halted value } ∧
+      MainResult plan reuse mode store value := by
+  let definition := UniqueLower.mainFunction plan
+  let block := definition.blocks[0]'(by simp [definition, UniqueLower.mainFunction])
+  let suffix : Array Instr := #[.alloc .unique (nilId plan.schema) #[]]
+  obtain ⟨built, registers, inputValue, inputRun, inputResult⟩ :=
+    inputSteps (context plan reuse) mode plan.schema plan.values definition block suffix heapFuel rfl rfl
+      (inputInstructions_eq plan)
+  let initialized := built.allocNode .unique (.ctorN (nilId plan.schema) #[])
+  have instructions : block.instructions = inputPrefix plan.schema plan.values ++ suffix := inputInstructions_eq plan
+  have bound : plan.values.length + 1 < block.instructions.size := by
+    simp [instructions, suffix]
+  have accRun := Step.alloc (context := context plan reuse) (interpretation := mode) (arguments := #[])
+    (world := .unique) (cid := nilId plan.schema)
+    (machine := inputPoint definition built heapFuel (plan.values.length + 1) registers)
+    rfl rfl bound
+    (by
+      change block.instructions[plan.values.length + 1] = .alloc .unique (nilId plan.schema) #[]
+      simp only [instructions]
+      rw [Array.getElem_append_right (by simp)]
+      simp [suffix])
+    (nilSchemaAt plan.schema) rfl (nilFields plan.schema built)
+  have initializedLive : initialized.1.live = plan.values.length + 2 := by
+    simp [initialized, Store.live_allocNode, inputResult.live, Nat.add_assoc]
+  have initializedPeak : initialized.1.peakLiveNodes = plan.values.length + 2 := by
+    rw [Store.peakLive_allocNode, initializedLive, inputResult.peak]
+    omega
+  have initializedOwned : RootOwnership initialized.1.heap
+      [⟨.unique, inputValue⟩, ⟨.unique, .loc initialized.2⟩] :=
+    (ownedNilAllocation inputResult.owned plan.schema).perm (List.Perm.swap _ _ [])
+  have call := Step.tailCallFn (context := context plan reuse) (interpretation := mode)
+    (definition := UniqueLower.function plan.schema reuse)
+    (machine := inputPoint definition initialized.1 heapFuel (plan.values.length + 2)
+      (registers.push (.loc initialized.2)))
+    rfl rfl (by simp [definition, UniqueLower.mainFunction, inputInstructions_eq]) rfl rfl
+    (values := #[.loc initialized.2, inputValue])
+    (by
+      have atInput : (registers.push (.loc initialized.2))[plan.values.length]? = some inputValue := by
+        rw [Array.getElem?_push_lt (by simp [inputResult.size])]
+        exact congrArg some (Array.getElem?_eq_some_iff.mp inputResult.last).2
+      have atAcc : (registers.push (.loc initialized.2))[plan.values.length + 1]? = some (.loc initialized.2) := by
+        rw [← inputResult.size]; simp
+      simp [resolveAtoms, resolveAtom, atInput, atAcc]; rfl)
+    (by simp [context, Context.ofProgram, UniqueLower.program]) rfl rfl
+  obtain ⟨store, value, loopRun, result⟩ := loopSteps (context plan reuse) mode plan.schema reuse plan.values
+    initialized.1 heapFuel inputValue (.loc initialized.2) [] rfl initializedOwned
+    (inputResult.list.allocNode .unique _) (nilAllocated built.heap plan.schema)
+    (by rw [initializedLive, initializedPeak]; exact Nat.le_refl _)
+  have history := ((inputRun.trans (accRun.toSteps rfl)).trans (call.toSteps rfl)).trans loopRun
+  refine ⟨store, value, ?_, result.owned, ?_, ?_, ?_, ?_, ?_, ?_, ?_,
+    result.attempts.trans inputResult.attempts, result.hot.trans inputResult.hot,
+    result.cold.trans inputResult.cold, ?_⟩
+  · have count : plan.values.length + 1 + 1 + 1 + (consControl reuse * plan.values.length + 4) =
+        controlCost plan reuse := by simp [controlCost, Nat.add_mul]; omega
+    have initialHeap := initialMachine_store_empty definition #[] heapFuel
+    dsimp only [initialMachine] at initialHeap
+    simpa only [count, initialMachine, inputPoint, UniqueLower.program, definition, initialHeap] using history
+  · simpa using result.list
+  · rw [result.allocs]
+    simp [initialized, IxIR1.Store.allocNode, inputResult.allocs, Nat.add_assoc]
+  · rw [result.frees]
+    simp [initialized, IxIR1.Store.allocNode, inputResult.frees]
+  · rw [result.reuses]
+    simp [initialized, IxIR1.Store.allocNode, inputResult.reuses]
+  · exact result.rcops.trans inputResult.rcops
+  · have live := result.live
+    rw [initializedLive] at live
+    omega
+  · exact result.peak.trans initializedPeak
+  · rw [result.payload]
+    change built.reusedPayloadUnits + _ = _
+    rw [inputResult.payload, Nat.zero_add]
+
+theorem mainRuns (plan : Plan) (reuse : Bool) (mode : Interpretation) (extraControl heapFuel : Nat) :
+    ∃ result,
+      runMain (context plan reuse) mode (UniqueLower.program plan reuse)
+        (controlCost plan reuse + extraControl) heapFuel = .ok result ∧
+      MainResult plan reuse mode result.store result.value ∧
+      result.controlRemaining = extraControl ∧ result.heapRemaining = heapFuel := by
+  obtain ⟨store, value, steps, result⟩ := mainSteps plan reuse mode heapFuel
+  refine ⟨⟨store, value, extraControl, heapFuel⟩, ?_, result, rfl, rfl⟩
+  rw [runMain_eq_runMachine rfl rfl, steps.runMachine]
+  simp [runMachine]
+
+theorem MainResult.reclaims {plan : Plan} {reuse : Bool} {mode : Interpretation} {store : Store} {value : RVal}
+    (result : MainResult plan reuse mode store value) :
+    ∃ reclaimed,
+      dropUnique (2 * plan.values.length + 1) store value = .ok (reclaimed, 0) ∧
+      reclaimed.live = 0 ∧ reclaimed.heap.frees = reclaimed.heap.allocs ∧
+      Released2 store reclaimed (plan.values.length + 1) [] := by
+  obtain ⟨reclaimed, run, empty, released⟩ := release2_complete result.owned result.list (by simpa using result.live)
+  refine ⟨reclaimed, by simpa using run, empty, ?_, by simpa using released⟩
+  rw [released.allocs, released.frees, result.allocs, result.frees]
+  simp only [List.length_reverse]
+  omega
+
+end Ix.Compiler.UniqueReuse.Target
diff --git a/Ix/Compiler/UniqueReuse/TargetResources.lean b/Ix/Compiler/UniqueReuse/TargetResources.lean
new file mode 100644
index 000000000..1763f7d06
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetResources.lean
@@ -0,0 +1,60 @@
+import Ix.Compiler.UniqueReuse.TargetMain
+import Ix.Compiler.IxIR2.ReservationSteps
+import Ix.Compiler.IxIR2.Resources
+import Ix.Compiler.IxIR2.CostSteps
+
+namespace Ix.Compiler.UniqueReuse.Target
+
+open Ix.Compiler.IxIR0.UniqueReverse (Plan)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+
+private theorem stepsV0 {ctx : Context} {mode : Interpretation} {count : Nat} {before after : Machine}
+    (steps : Steps ctx mode count before after) : Policy.Steps .callLocalV0 ctx mode count before after := by
+  induction steps with
+  | refl => exact .refl _
+  | cons running head tail ih => exact .cons running head ih
+
+/-- Every actual physical prefix has exactly owned, non-live reservations,
+balanced allocation accounting, no RC work, and the final peak bound. -/
+theorem prefixResources (plan : Plan) (reuse : Bool) {heapFuel count : Nat} {middle : Machine}
+    (prefixSteps : Steps (context plan reuse) .physical count
+      (initialMachine (UniqueLower.program plan reuse).main #[] heapFuel) middle) :
+    middle.ReservationOwnership ∧ middle.AllocationAccounting ∧
+      middle.store.heap.rcops = 0 ∧ middle.store.live ≤ middle.store.peakLiveNodes ∧
+      middle.store.peakLiveNodes ≤ plan.values.length + 2 ∧ count ≤ controlCost plan reuse := by
+  obtain ⟨store, value, execution, result⟩ := mainSteps plan reuse .physical heapFuel
+  obtain ⟨suffixCount, countEq, suffix⟩ := prefixSteps.cancelPrefixToHalted execution rfl
+  have costs := suffix.costs_mono
+  have initialPeak : (initialMachine (UniqueLower.program plan reuse).main #[] heapFuel).store.live ≤
+      (initialMachine (UniqueLower.program plan reuse).main #[] heapFuel).store.peakLiveNodes := by
+    rw [initialMachine_store_empty]; exact Nat.le_refl _
+  exact ⟨Policy.runMain_prefix_reservationOwnership (stepsV0 prefixSteps),
+    prefixSteps.allocationAccounting (initialMachine_allocationAccounting ..),
+    Nat.eq_zero_of_le_zero (by simpa only [result.rcops] using costs.1),
+    prefixSteps.preservesPeakBound initialPeak, by simpa only [result.peak] using costs.2, by omega⟩
+
+structure CostLaws (plan : Plan) (baseline selected : Store) (reuse : Bool) : Prop where
+  allocations : selected.heap.allocs + (if reuse then plan.values.length else 0) = baseline.heap.allocs
+  frees : selected.heap.frees + (if reuse then plan.values.length else 0) = baseline.heap.frees
+  reuses : selected.heap.reuses = if reuse then plan.values.length else 0
+  payload : selected.reusedPayloadUnits = if reuse then 2 * plan.values.length else 0
+  noRC : baseline.heap.rcops = 0 ∧ selected.heap.rcops = 0
+  peak : selected.peakLiveNodes = baseline.peakLiveNodes
+  live : selected.live = baseline.live
+
+theorem costLaws {plan : Plan} {reuse : Bool} {baseline selected : Store} {baselineValue selectedValue : RVal}
+    (base : MainResult plan false .physical baseline baselineValue)
+    (result : MainResult plan reuse .physical selected selectedValue) : CostLaws plan baseline selected reuse := by
+  refine ⟨?_, ?_, ?_, ?_, ⟨base.rcops, result.rcops⟩, result.peak.trans base.peak.symm,
+    result.live.trans base.live.symm⟩
+  · rw [base.allocs, result.allocs]
+    cases reuse <;> simp [freshPerCons, inPlace] <;> omega
+  · rw [base.frees, result.frees]
+    cases reuse <;> simp [freshPerCons, inPlace] <;> omega
+  · rw [result.reuses]
+    cases reuse <;> simp [reusesPerCons, inPlace]
+  · rw [result.payload]
+    cases reuse <;> simp [reusesPerCons, inPlace]
+
+end Ix.Compiler.UniqueReuse.Target
diff --git a/Ix/Compiler/UniqueReuse/TargetSim.lean b/Ix/Compiler/UniqueReuse/TargetSim.lean
new file mode 100644
index 000000000..119e5d03f
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetSim.lean
@@ -0,0 +1,56 @@
+import Ix.Compiler.UniqueReuse.TargetResources
+import Ix.Compiler.UniqueReuse.LowerSim
+import Ix.Compiler.UniqueReuse.SourceSim
+
+namespace Ix.Compiler.UniqueReuse
+
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Plan)
+
+/-- Successful executions at any source fuel have the compiler-derived
+ownership and finite-list view, by determinism of the ordinary evaluator. -/
+theorem consumingMainResult (plan : Plan) {fuel : Nat} {store : IxIR1.Store} {value : IxIR1.RVal}
+    (run : IxIR1.runOwnedMain { decls := IxIR1.Env.ofList (declarations plan.schema) } .unique
+      (mainCode plan) fuel = .ok (store, value)) : MainResult plan store value := by
+  obtain ⟨canonicalFuel, canonicalStore, canonicalValue, canonicalRun, result⟩ := mainExists plan
+  have left := IxIR1.runCode_mono (Nat.le_max_left fuel canonicalFuel) (runOwnedMain_ok run).1
+  have right := IxIR1.runCode_mono (Nat.le_max_right fuel canonicalFuel) (runOwnedMain_ok canonicalRun).1
+  have same : (store, value) = (canonicalStore, canonicalValue) := Except.ok.inj (left.symm.trans right)
+  have hs := congrArg Prod.fst same
+  have hv := congrArg Prod.snd same
+  dsimp only at hs hv
+  subst canonicalStore canonicalValue
+  exact result
+
+end Ix.Compiler.UniqueReuse
+
+namespace Ix.Compiler.IxIR2.UniqueLower
+
+open Ix.Compiler.IxIR1.Sim
+open Ix.Compiler.IxIR0.UniqueReverse (Plan)
+open Ix.Compiler.UniqueReuse
+
+/-- The consuming translation preserves the exact finite value of every
+successful run of its indexed IxIR₁ input. Ownership is obtained from that
+compiler input, rather than required from the caller. -/
+theorem Translation.forwardSimulation {source : Lower.Input} {plan : Plan} {limits : Validate.Limits}
+    (translation : Translation source plan limits)
+    {sourceFuel : Nat} {sourceStore : IxIR1.Store} {sourceValue : IxIR1.RVal}
+    (run : IxIR1.runOwnedMain { decls := IxIR1.Env.ofList source.declarations }
+      source.mainResult source.main sourceFuel = .ok (sourceStore, sourceValue))
+    (mode : Eval.Interpretation) (extraControl heapFuel : Nat) (functions : FunctionRel) :
+    ∃ result,
+      Eval.runMain (Target.context plan false) mode (program plan false)
+        (Target.controlCost plan false + extraControl) heapFuel = .ok result ∧
+      ValueGraph functions sourceStore plan.value sourceValue ∧
+      ValueGraph functions result.store.heap plan.value result.value ∧
+      Target.MainResult plan false mode result.store result.value ∧
+      result.controlRemaining = extraControl ∧ result.heapRemaining = heapFuel := by
+  have sourceResult : MainResult plan sourceStore sourceValue := by
+    rw [translation.sourceEq] at run
+    exact consumingMainResult plan run
+  obtain ⟨result, targetRun, targetResult, control, heap⟩ := Target.mainRuns plan false mode extraControl heapFuel
+  exact ⟨result, targetRun, sourceResult.list.graph functions, targetResult.list.graph functions,
+    targetResult, control, heap⟩
+
+end Ix.Compiler.IxIR2.UniqueLower
diff --git a/Ix/Compiler/UniqueReuse/TargetSteps.lean b/Ix/Compiler/UniqueReuse/TargetSteps.lean
new file mode 100644
index 000000000..9e0adef82
--- /dev/null
+++ b/Ix/Compiler/UniqueReuse/TargetSteps.lean
@@ -0,0 +1,169 @@
+import Ix.Compiler.UniqueReuse.TargetHeap
+
+namespace Ix.Compiler.UniqueReuse.Target
+
+open Ix.Compiler.IxIR0.UniqueReverse (Schema Plan)
+open Ix.Compiler.IxIR2
+open Ix.Compiler.IxIR2.Eval
+
+def point (schema : Schema) (reuse : Bool) (block pc : Nat) (store : Store)
+    (heapFuel : Nat) (values : Array RVal) (credits : Array (Option Credit) := #[]) : Machine :=
+  { store, heapFuel, control := .running
+      { definition := UniqueLower.function schema reuse, block, pc, values, credits } [] }
+
+def loop (schema : Schema) (reuse : Bool) (store : Store) (heapFuel : Nat)
+    (accumulator major : RVal) : Machine :=
+  point schema reuse 0 0 store heapFuel #[accumulator, major]
+
+theorem switchNil (ctx : Context) (mode : Interpretation) (schema : Schema) (reuse : Bool)
+    (store : Store) (fuel location : Nat) (acc : RVal)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (nilId schema) #[]⟩) :
+    Step ctx mode (loop schema reuse store fuel acc (.loc location))
+      (point schema reuse 1 0 store fuel #[acc, .loc location]) := by
+  apply Step.switchCtor (alternative := ⟨nilId schema, ⟨1, #[.reg 0, .reg 1], #[]⟩⟩)
+    rfl rfl rfl rfl rfl found rfl
+  · simp
+  · exact EdgeTransfer.baseline (block := UniqueLower.nilBlock schema)
+      (values := #[acc, .loc location]) rfl rfl rfl rfl rfl rfl
+
+theorem switchCons (ctx : Context) (mode : Interpretation) (schema : Schema) (reuse : Bool)
+    (store : Store) (fuel location head : Nat) (tail acc : RVal)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩) :
+    Step ctx mode (loop schema reuse store fuel acc (.loc location))
+      (point schema reuse 2 0 store fuel #[acc, .loc location]) := by
+  apply Step.switchCtor (alternative := ⟨consId schema, ⟨2, #[.reg 0, .reg 1], #[]⟩⟩)
+    rfl rfl rfl rfl rfl found rfl
+  · simp [Ne.symm (cons_ne_nil schema)]
+  · exact EdgeTransfer.baseline (block := UniqueLower.consBlock schema reuse)
+      (values := #[acc, .loc location]) rfl rfl rfl rfl rfl rfl
+
+theorem nilSteps (ctx : Context) (mode : Interpretation) (schema : Schema) (reuse : Bool)
+    (store : Store) (fuel location : Nat) (acc : RVal)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (nilId schema) #[]⟩)
+    (world : acc.hasWorld (store.kill location) .unique = true) :
+    Steps ctx mode 4 (loop schema reuse store fuel acc (.loc location))
+      { store := store.kill location, heapFuel := fuel, control := .halted acc } := by
+  have schemaAt : ctx.schemas .unique (nilId schema) = some (nilSchema schema) :=
+    schemas ▸ nilSchemaAt schema
+  have first := (switchNil ctx mode schema reuse store fuel location acc found).toSteps rfl
+  have finish := Step.retHaltCleared (context := ctx) (interpretation := mode)
+    (machine := point schema reuse 1 2 (store.kill location) fuel #[acc, .loc location] #[none])
+    rfl rfl rfl rfl rfl (by simp [NoLiveCredits]) world
+  cases mode with
+  | logical =>
+      have take := Step.takeUniqueLogical (context := ctx)
+        (machine := point schema reuse 1 0 store fuel #[acc, .loc location])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl (ConstructorView.of_box found rfl rfl) rfl
+      have discard := Step.discardCreditLogical (context := ctx)
+        (machine := point schema reuse 1 1 (store.kill location) fuel #[acc, .loc location]
+          #[some ⟨(nilSchema schema).layout, .present none⟩])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl (CreditTake.of_lookup (CreditLookup.of_getElem rfl)) rfl
+      exact ((first.trans (take.toSteps rfl)).trans (discard.toSteps rfl)).trans (finish.toSteps rfl)
+  | physical =>
+      have take := Step.takeUniquePhysical (context := ctx)
+        (machine := point schema reuse 1 0 store fuel #[acc, .loc location])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl (ConstructorView.of_box found rfl rfl) rfl
+      have discard := Step.discardCreditPhysical (context := ctx)
+        (machine := point schema reuse 1 1 (store.reserve location) fuel #[acc, .loc location]
+          #[some ⟨(nilSchema schema).layout, .present (some location)⟩])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl (CreditTake.of_lookup (CreditLookup.of_getElem rfl)) rfl
+        (reserveRelease found)
+      exact ((first.trans (take.toSteps rfl)).trans (discard.toSteps rfl)).trans (finish.toSteps rfl)
+
+theorem consBaselineSteps (ctx : Context) (mode : Interpretation) (schema : Schema)
+    (store : Store) (fuel location head : Nat) (tail acc : RVal)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (fields : FieldWorlds (store.kill location) (consSchema schema) #[.lit (.nat head), acc]) :
+    let allocated := (store.kill location).allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), acc])
+    Steps ctx mode 5 (loop schema false store fuel acc (.loc location))
+      (loop schema false allocated.1 fuel (.loc allocated.2) tail) := by
+  dsimp only
+  have schemaAt : ctx.schemas .unique (consId schema) = some (consSchema schema) :=
+    schemas ▸ consSchemaAt schema
+  let allocated := (store.kill location).allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), acc])
+  have first := (switchCons ctx mode schema false store fuel location head tail acc found).toSteps rfl
+  have alloc := Step.alloc (context := ctx) (interpretation := mode)
+    (machine := point schema false 2 2 (store.kill location) fuel #[acc, .loc location, .lit (.nat head), tail] #[none])
+    rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl fields
+  have call := Step.tailCallSelfCleared (context := ctx) (interpretation := mode)
+    (machine := point schema false 2 3 allocated.1 fuel
+      #[acc, .loc location, .lit (.nat head), tail, .loc allocated.2] #[none])
+    rfl rfl rfl rfl (by simp [NoLiveCredits]) rfl rfl rfl
+  cases mode with
+  | logical =>
+      have take := Step.takeUniqueLogical (context := ctx)
+        (machine := point schema false 2 0 store fuel #[acc, .loc location])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl (ConstructorView.of_box found rfl rfl) rfl
+      have discard := Step.discardCreditLogical (context := ctx)
+        (machine := point schema false 2 1 (store.kill location) fuel #[acc, .loc location, .lit (.nat head), tail]
+          #[some ⟨(consSchema schema).layout, .present none⟩])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl (CreditTake.of_lookup (CreditLookup.of_getElem rfl)) rfl
+      exact (((first.trans (take.toSteps rfl)).trans (discard.toSteps rfl)).trans (alloc.toSteps rfl)).trans
+        (call.toSteps rfl)
+  | physical =>
+      have take := Step.takeUniquePhysical (context := ctx)
+        (machine := point schema false 2 0 store fuel #[acc, .loc location])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl (ConstructorView.of_box found rfl rfl) rfl
+      have discard := Step.discardCreditPhysical (context := ctx)
+        (machine := point schema false 2 1 (store.reserve location) fuel #[acc, .loc location, .lit (.nat head), tail]
+          #[some ⟨(consSchema schema).layout, .present (some location)⟩])
+        rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl (CreditTake.of_lookup (CreditLookup.of_getElem rfl)) rfl (reserveRelease found)
+      exact (((first.trans (take.toSteps rfl)).trans (discard.toSteps rfl)).trans (alloc.toSteps rfl)).trans
+        (call.toSteps rfl)
+
+theorem consLogicalSteps (ctx : Context) (schema : Schema)
+    (store : Store) (fuel location head : Nat) (tail acc : RVal)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (fields : FieldWorlds (store.kill location) (consSchema schema) #[.lit (.nat head), acc]) :
+    let allocated := (store.kill location).allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), acc])
+    Steps ctx .logical 4 (loop schema true store fuel acc (.loc location))
+      (loop schema true allocated.1 fuel (.loc allocated.2) tail) := by
+  dsimp only
+  have schemaAt : ctx.schemas .unique (consId schema) = some (consSchema schema) :=
+    schemas ▸ consSchemaAt schema
+  let allocated := (store.kill location).allocNode .unique (.ctorN (consId schema) #[.lit (.nat head), acc])
+  have first := (switchCons ctx .logical schema true store fuel location head tail acc found).toSteps rfl
+  have take := Step.takeUniqueLogical (context := ctx)
+    (machine := point schema true 2 0 store fuel #[acc, .loc location])
+    rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl (ConstructorView.of_box found rfl rfl) rfl
+  have alloc := Step.allocWithLogical (context := ctx)
+    (machine := point schema true 2 1 (store.kill location) fuel #[acc, .loc location, .lit (.nat head), tail]
+      #[some ⟨(consSchema schema).layout, .present none⟩])
+    rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl fields (CreditTake.of_lookup (CreditLookup.of_getElem rfl)) rfl rfl
+  have call := Step.tailCallSelfCleared (context := ctx) (interpretation := .logical)
+    (machine := point schema true 2 2 allocated.1 fuel
+      #[acc, .loc location, .lit (.nat head), tail, .loc allocated.2] #[none])
+    rfl rfl rfl rfl (by simp [NoLiveCredits]) rfl rfl rfl
+  exact ((first.trans (take.toSteps rfl)).trans (alloc.toSteps rfl)).trans (call.toSteps rfl)
+
+theorem consPhysicalSteps (ctx : Context) (schema : Schema)
+    (store : Store) (fuel location head : Nat) (tail acc : RVal)
+    (schemas : ctx.schemas = UniqueLower.schemas schema)
+    (found : store.get? location = some ⟨.unique, 1, .ctorN (consId schema) #[.lit (.nat head), tail]⟩)
+    (fields : FieldWorlds (store.reserve location) (consSchema schema) #[.lit (.nat head), acc]) :
+    let output := reuseAt store location (.ctorN (consId schema) #[.lit (.nat head), acc]) 2
+    Steps ctx .physical 4 (loop schema true store fuel acc (.loc location))
+      (loop schema true output fuel (.loc location) tail) := by
+  dsimp only
+  have schemaAt : ctx.schemas .unique (consId schema) = some (consSchema schema) :=
+    schemas ▸ consSchemaAt schema
+  let output := reuseAt store location (.ctorN (consId schema) #[.lit (.nat head), acc]) 2
+  have first := (switchCons ctx .physical schema true store fuel location head tail acc found).toSteps rfl
+  have take := Step.takeUniquePhysical (context := ctx)
+    (machine := point schema true 2 0 store fuel #[acc, .loc location])
+    rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl (ConstructorView.of_box found rfl rfl) rfl
+  have alloc := Step.allocWithPhysical (context := ctx)
+    (machine := point schema true 2 1 (store.reserve location) fuel #[acc, .loc location, .lit (.nat head), tail]
+      #[some ⟨(consSchema schema).layout, .present (some location)⟩])
+    rfl rfl (by simp [UniqueLower.function, UniqueLower.nilBlock, UniqueLower.consBlock]) rfl schemaAt rfl fields (CreditTake.of_lookup (CreditLookup.of_getElem rfl)) rfl rfl
+    (reserveReuse found _ 2)
+  have call := Step.tailCallSelfCleared (context := ctx) (interpretation := .physical)
+    (machine := point schema true 2 2 output fuel
+      #[acc, .loc location, .lit (.nat head), tail, .loc location] #[none])
+    rfl rfl rfl rfl (by simp [NoLiveCredits]) rfl rfl rfl
+  exact ((first.trans (take.toSteps rfl)).trans (alloc.toSteps rfl)).trans (call.toSteps rfl)
+
+end Ix.Compiler.UniqueReuse.Target
diff --git a/Ix/Compiler/UsageSound.lean b/Ix/Compiler/UsageSound.lean
new file mode 100644
index 000000000..cdd4dc7ce
--- /dev/null
+++ b/Ix/Compiler/UsageSound.lean
@@ -0,0 +1,482 @@
+import Ix.Compiler.Ixon.UsageCheck
+import Ix.Compiler.EraseValidator
+
+/-!
+# Usage-checker non-interference at the erasure boundary
+
+This module connects three independently executable facts:
+
+1. `UsageCheck.check` computes zero use for every binder the eraser drops;
+2. `PErase` certifies the exact executable erasure and deliberately leaves
+   dropped runtime environment slots unconstrained;
+3. two successful source runs related to the same erased run therefore have
+   one common observable target value.
+
+The result is intentionally an erasure observation, not raw source-value
+equality.  Raw equality is false for closures: changing an unused captured
+slot changes the closure's stored environment even though no erased program
+can observe it.  Sharing one `IxIR0.Value` witness is the appropriate
+semantic quotient and composes directly with the existing simulation.
+
+Both source runs are assumed successful.  Ixon is weak CBV and still
+evaluates ghost arguments; termination/error irrelevance needs the future
+typed totality bridge, while the forward-simulation theorem only needs the
+successful-run direction proved here.
+-/
+
+namespace Ix.Compiler.UsageSound
+
+open Ix.Compiler.Ixon (Expr Owned Uses)
+open Ix.Compiler.Sim
+
+namespace UC
+
+open Ix.Compiler.Ixon.UsageCheck
+
+/-- The checker and eraser use extensionally identical sort-telescope tests.
+Keeping this theorem explicit prevents their separately layered executable
+definitions from drifting. -/
+theorem erasureSortLike_eq_sortLike (sharing : Array Expr) (fuel : Nat)
+    (expression : Expr) :
+    erasureSortLike sharing fuel expression =
+      Erase.sortLike sharing fuel expression := by
+  induction fuel generalizing expression with
+  | zero => rfl
+  | succ fuel ih =>
+    cases expression <;>
+      simp only [erasureSortLike, Erase.sortLike]
+    case all uses owned domain codomain => exact ih codomain
+    case share index =>
+      cases sharing[index.toNat]? with
+      | none => rfl
+      | some target => exact ih target
+
+/-- Consequently the checker's executable drop classification is exactly the
+eraser's, including fuel behavior through sharing indirections. -/
+theorem erasureDropsBinder_eq_dropBinder (sharing : Array Expr) (fuel : Nat)
+    (uses : Uses) (domain : Expr) :
+    erasureDropsBinder sharing fuel uses domain =
+      Erase.dropBinder sharing fuel uses domain := by
+  simp only [erasureDropsBinder, Erase.dropBinder,
+    erasureSortLike_eq_sortLike]
+
+/-- Logical view of the checker's "head binder computed zero" fact.  The
+existential usage vector is retained inside the proposition so later typed
+extensions can attach their runtime-occurrence relation to the same witness. -/
+inductive ComputedErasedHead (ctx : CheckCtx) (fuel : Nat)
+    (world : Owned) (worlds : List Owned) (body : Expr) : Prop where
+  | mk {bodyUses : UseVec} {bodyOwned : Owned} {entry : VarUse}
+      {rest : UseVec} :
+      check ctx fuel false (world :: worlds) body =
+        .ok (bodyUses, bodyOwned) →
+      bodyUses = entry :: rest →
+      entry.uses = .erased →
+      ComputedErasedHead ctx fuel world worlds body
+
+/-- Successful checking of a lambda classified as dropped constructs the
+proof-relevant computed-zero witness for its body. -/
+theorem ComputedErasedHead.of_checkedLambda {ctx : CheckCtx} {fuel : Nat}
+    {worlds : List Owned} {uses : Uses} {domain body : Expr}
+    {outerUses : UseVec} {owned : Owned}
+    (hdrop : erasureDropsBinder ctx.sharing fuel uses domain = true)
+    (hcheck : check ctx (fuel + 1) false worlds (.lam uses domain body) =
+      .ok (outerUses, owned)) :
+    ComputedErasedHead ctx fuel (worldOf uses) worlds body := by
+  obtain ⟨bodyUses, bodyOwned, entry, rest, hbody, hhead, herased⟩ :=
+    check_lam_dropped_entry_erased hdrop hcheck
+  have hshape : bodyUses = entry :: rest := headEntry_ok_iff.mp hhead
+  exact .mk hbody hshape herased
+
+end UC
+
+/-- Two source values are indistinguishable after erasure when both relate to
+the same target value.  This intentionally identifies sort/pi/neutral values
+with `◻` and closures whose only differences live in dropped captures. -/
+def ErasureObsEq (ectx : Ixon.Eval.EvalCtx) (ictx : IxIR0.Ctx)
+    (left right : Ixon.Eval.Value) : Prop :=
+  ∃ target, ValRel ectx ictx left target ∧ ValRel ectx ictx right target
+
+theorem ErasureObsEq.symm {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {left right : Ixon.Eval.Value}
+    (h : ErasureObsEq ectx ictx left right) :
+    ErasureObsEq ectx ictx right left := by
+  obtain ⟨target, hleft, hright⟩ := h
+  exact ⟨target, hright, hleft⟩
+
+/-- Semantic non-interference for a checker-computed erased head slot.
+
+`leftEnv` and `rightEnv` may contain arbitrary, unrelated source values in
+every `false` mask position.  Both environments relate to one target
+environment, and the exact body erasure is certified.  If both source runs
+succeed, their results share one erased observation. -/
+theorem computedErased_eval_noninterference
+    {ectx : Ixon.Eval.EvalCtx} {ictx : IxIR0.Ctx}
+    {F : Ixon.Eval.Frame} {sc : Option (Ixon.Address × Nat)}
+    {mask : List Bool} {leftEnv rightEnv : List Ixon.Eval.Value}
+    {targetEnv : List IxIR0.Value} {body : Expr} {targetBody : IxIR0.Expr}
+    {leftFuel rightFuel : Nat} {leftValue rightValue : Ixon.Eval.Value}
+    {checkCtx : Ixon.UsageCheck.CheckCtx} {checkFuel : Nat}
+    {world : Owned} {worlds : List Owned}
+    (hstrict : ectx.Strict)
+    (horacles : OracleRel ectx ictx)
+    (_computed : UC.ComputedErasedHead checkCtx checkFuel world worlds body)
+    (herased : PErase ectx ictx sc F.refs F.selfMuts F.selfAddr
+      (false :: mask) body targetBody)
+    (hleftEnv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr
+      (false :: mask) leftEnv targetEnv)
+    (hrightEnv : EnvRel ectx ictx sc F.refs F.selfMuts F.selfAddr
+      (false :: mask) rightEnv targetEnv)
+    (hleft : Ixon.Eval.eval ectx leftFuel F leftEnv body = .ok leftValue)
+    (hright : Ixon.Eval.eval ectx rightFuel F rightEnv body =
+      .ok rightValue) :
+    ErasureObsEq ectx ictx leftValue rightValue := by
+  obtain ⟨leftTargetFuel, leftTarget, hleftTarget, hleftRel⟩ :=
+    erasure_sim hstrict horacles hleft herased hleftEnv
+  obtain ⟨rightTargetFuel, rightTarget, hrightTarget, hrightRel⟩ :=
+    erasure_sim hstrict horacles hright herased hrightEnv
+  let joinedFuel := Nat.max leftTargetFuel rightTargetFuel
+  have hleftJoined :
+      IxIR0.eval ictx joinedFuel targetEnv targetBody = .ok leftTarget :=
+    IxIR0.eval_mono (Nat.le_max_left _ _) hleftTarget
+  have hrightJoined :
+      IxIR0.eval ictx joinedFuel targetEnv targetBody = .ok rightTarget :=
+    IxIR0.eval_mono (Nat.le_max_right _ _) hrightTarget
+  have htarget : leftTarget = rightTarget := by
+    exact Except.ok.inj (hleftJoined.symm.trans hrightJoined)
+  subst rightTarget
+  exact ⟨leftTarget, hleftRel, hrightRel⟩
+
+/-! ## Contentful dropped-variable witness
+
+`wrapper` binds a sort-like `many` parameter and passes the bound variable to
+the sort-like parameter of `consumer`.  UsageCheck computes that occurrence
+as zero, erasure emits `◻`, and the proof-producing validator certifies the
+exact output.  Source environments containing the distinct runtime literals
+`7̂` and `8̂` both produce the contentful `9̂` result and share the same
+erased observation.
+-/
+
+namespace DroppedVariableFixture
+
+private theorem exceptOkBind {error value result : Type}
+    (input : value) (next : value → Except error result) :
+    (Except.ok input >>= next) = next input := rfl
+
+private theorem exceptOkDiscard {error value : Type} (input : value) :
+    discard (Except.ok input : Except error value) =
+      Except.ok PUnit.unit := rfl
+
+private def addrOf (byte : UInt8) : Ixon.Address :=
+  Ixon.Address.replicate byte
+
+private def consumerAddress : Ixon.Address := addrOf 0xE0
+private def wrapperAddress : Ixon.Address := addrOf 0xE1
+private def resultBlob : Ixon.Address := addrOf 0xE2
+private def argumentBlob : Ixon.Address := addrOf 0xE3
+
+private def consumer : Ixon.Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .unique (.sort 0) (.sort 0)
+        value := .lam .many (.sort 0) (.nat 0) }
+    sharing := #[], refs := #[resultBlob], univs := #[.zero] }
+
+private def wrapperBody : Expr :=
+  .app (.ref 0 #[]) (.var 0)
+
+private def wrapper : Ixon.Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .all .many .unique (.sort 0) (.sort 0)
+        value := .lam .many (.sort 0) wrapperBody }
+    sharing := #[], refs := #[consumerAddress], univs := #[.zero] }
+
+private def constants : List (Ixon.Address × Ixon.Constant) :=
+  [(consumerAddress, consumer), (wrapperAddress, wrapper)]
+
+private def resolve : Ixon.Address → Option Ixon.Constant := fun address =>
+  (constants.find? fun entry => entry.1 == address).map (·.2)
+
+private def ectx : Ixon.Eval.EvalCtx :=
+  { resolve
+    blobs := fun address =>
+      if address = resultBlob then some (.natB 9)
+      else if address = argumentBlob then some (.natB 7)
+      else none }
+
+private def consumerTarget : IxIR0.Expr :=
+  .lam .many (.lit (.nat 9))
+
+private def wrapperTargetBody : IxIR0.Expr :=
+  .app (.ref consumerAddress) .erased
+
+private def target : List (Ixon.Address × IxIR0.Decl) :=
+  [ (consumerAddress, .defn .unique consumerTarget)
+  , (wrapperAddress, .defn .unique (.lam .many wrapperTargetBody)) ]
+
+private def ictx : IxIR0.Ctx :=
+  { env := IxIR0.Env.ofList target }
+
+private theorem oracleRel : OracleRel ectx ictx :=
+  OracleRel.of_externFree (by
+    intro address
+    rfl)
+
+private def consumerCheckCtx : Ixon.UsageCheck.CheckCtx :=
+  { resolve, refs := consumer.refs }
+
+private def wrapperCheckCtx : Ixon.UsageCheck.CheckCtx :=
+  { resolve, refs := wrapper.refs }
+
+#guard (match Ixon.UsageCheck.checkConstant resolve consumer 100 with
+  | .ok () => true
+  | .error _ => false)
+
+#guard (match Ixon.UsageCheck.checkConstant resolve wrapper 100 with
+  | .ok () => true
+  | .error _ => false)
+
+#guard (match Erase.eraseProgram (EraseValidator.eraseCtxOf ectx)
+    constants 100 with
+  | .ok declarations => declarations == target
+  | .error _ => false)
+
+#guard (match EraseValidator.certifyProgram ectx constants
+    [consumerAddress, wrapperAddress] 100 100 with
+  | .ok certificate => certificate.target == target &&
+      certificate.coverage.length == 2
+  | .error _ => false)
+
+private theorem consumerCovered : Covered ectx ictx consumerAddress := by
+  apply EraseValidator.covered_of_validate (db := []) (fuel := 100)
+  decide
+
+private def consumerCoverage : EraseValidator.CoverageDB ectx ictx :=
+  [{ address := consumerAddress, covered := consumerCovered }]
+
+private theorem wrapperCovered : Covered ectx ictx wrapperAddress := by
+  apply EraseValidator.covered_of_validate
+    (db := consumerCoverage) (fuel := 100)
+  decide
+
+private def coverage : EraseValidator.CoverageDB ectx ictx :=
+  [ { address := wrapperAddress, covered := wrapperCovered }
+  , { address := consumerAddress, covered := consumerCovered } ]
+
+private def cover : EraseValidator.CoverOracle ectx ictx :=
+  coverage.oracle
+
+private def wrapperFrame : Ixon.Eval.Frame :=
+  Ixon.Eval.Frame.ofConst wrapper
+
+private theorem resolveConsumer :
+    resolve consumerAddress = some consumer := by
+  simp [resolve, constants]
+
+private def wrapperDemand : Ixon.UsageCheck.Demand :=
+  { uses := .many, owned := .unique, dropped := true }
+
+private theorem wrapperExpandHead :
+    Ixon.UsageCheck.expandShareE wrapperCheckCtx 98 (.ref 0 #[]) =
+      .ok (.ref 0 #[]) := by
+  rfl
+
+private theorem wrapperHeadTelescope :
+    Ixon.UsageCheck.telescopeOfHead wrapperCheckCtx 98 (.ref 0 #[]) =
+      .ok [wrapperDemand] := by
+  simp [Ixon.UsageCheck.telescopeOfHead, wrapperCheckCtx, wrapper,
+    resolveConsumer, Ixon.UsageCheck.constTypeSharing, consumer,
+    Ixon.UsageCheck.telescopeOf, wrapperDemand,
+    Ixon.UsageCheck.erasureDropsBinder,
+    Ixon.UsageCheck.erasureSortLike]
+
+private theorem wrapperBaseCheck :
+    Ixon.UsageCheck.check wrapperCheckCtx 98 false [.shared]
+      (.ref 0 #[]) = .ok ([{}], .shared) := by
+  rw [Ixon.UsageCheck.check.eq_def]
+  simp [wrapperCheckCtx, wrapper, Ixon.UsageCheck.UseVec.zeros]
+
+private theorem wrapperGhostArgumentCheck :
+    Ixon.UsageCheck.check wrapperCheckCtx 97 true [.shared]
+      (.var 0) = .ok ([{}], .shared) := by
+  rw [Ixon.UsageCheck.check.eq_def]
+  rfl
+
+private theorem wrapperArgumentsCheck :
+    Ixon.UsageCheck.checkArgs wrapperCheckCtx 98 false [.shared]
+      [wrapperDemand] 0 [.var 0] [{}] = .ok [{}] := by
+  rw [Ixon.UsageCheck.checkArgs.eq_def]
+  dsimp only [wrapperDemand]
+  rw [wrapperGhostArgumentCheck]
+  change Ixon.UsageCheck.checkArgs wrapperCheckCtx 97 false [.shared]
+    [wrapperDemand] 1 [] [{}] = .ok [{}]
+  rw [Ixon.UsageCheck.checkArgs.eq_def]
+
+private theorem wrapperBodyCheck :
+    Ixon.UsageCheck.check wrapperCheckCtx 99 false [.shared]
+      wrapperBody = .ok ([{}], .unique) := by
+  dsimp only [wrapperBody]
+  rw [Ixon.UsageCheck.check.eq_def]
+  dsimp only [Expr.collectApp]
+  rw [wrapperExpandHead]
+  simp only [exceptOkBind]
+  rw [wrapperHeadTelescope]
+  simp only [exceptOkBind]
+  rw [wrapperBaseCheck]
+  simp only [exceptOkBind]
+  simp only [List.nil_append]
+  rw [wrapperArgumentsCheck]
+  simp only [exceptOkBind]
+  rfl
+
+private theorem wrapperLambdaCheck :
+    Ixon.UsageCheck.check wrapperCheckCtx 100 false []
+      (.lam .many (.sort 0) wrapperBody) = .ok ([], .unique) := by
+  rw [Ixon.UsageCheck.check.eq_def]
+  dsimp only
+  have domainCheck :
+      Ixon.UsageCheck.check wrapperCheckCtx 99 true [] (.sort 0) =
+        .ok ([], .shared) := by
+    rw [Ixon.UsageCheck.check.eq_def]
+    rfl
+  rw [domainCheck]
+  simp only [exceptOkDiscard, exceptOkBind,
+    Ixon.UsageCheck.worldOf]
+  rw [wrapperBodyCheck]
+  rfl
+
+private def consumerClosure : Ixon.Eval.Value :=
+  .closV .many (Ixon.Eval.Frame.ofConst consumer) [] (.sort 0) (.nat 0)
+
+private theorem resultBlobResolved :
+    ectx.blobs resultBlob = some (.natB 9) := by
+  simp [ectx]
+
+private theorem consumerReferenceEval :
+    Ixon.Eval.evalRef ectx 98 consumerAddress [] =
+      .ok consumerClosure := by
+  rw [Ixon.Eval.evalRef.eq_def]
+  simp only [ectx, resolveConsumer, consumer,
+    Ixon.Eval.guardLvls, Ixon.Eval.unfoldable]
+  rw [Ixon.Eval.eval.eq_def]
+  rfl
+
+private theorem wrapperFunctionEval (env : List Ixon.Eval.Value) :
+    Ixon.Eval.eval ectx 99 wrapperFrame env (.ref 0 #[]) =
+      .ok consumerClosure := by
+  rw [Ixon.Eval.eval.eq_def]
+  simp only [wrapperFrame, wrapper, Ixon.Eval.evalUnivArgs]
+  exact consumerReferenceEval
+
+private theorem wrapperArgumentEval (argument : Ixon.Eval.Value) :
+    Ixon.Eval.eval ectx 99 wrapperFrame [argument] (.var 0) =
+      .ok argument := by
+  rw [Ixon.Eval.eval.eq_def]
+  rfl
+
+private theorem consumerApply (argument : Ixon.Eval.Value) :
+    Ixon.Eval.apply ectx 99 consumerClosure argument =
+      .ok (.litV (.natL 9)) := by
+  rw [Ixon.Eval.apply.eq_def]
+  dsimp only [consumerClosure]
+  rw [Ixon.Eval.eval.eq_def]
+  change (match ectx.blobs resultBlob with
+    | some (.natB n) =>
+        Except.ok (Ixon.Eval.Value.litV (Ixon.Eval.Lit.natL n))
+    | some (.strB _) => Except.error
+        (Ixon.Eval.Err.stuck "nat literal address holds a string blob")
+    | none => Except.error (Ixon.Eval.Err.unknownBlob resultBlob)) =
+      Except.ok (Ixon.Eval.Value.litV (Ixon.Eval.Lit.natL 9))
+  rw [resultBlobResolved]
+
+private theorem wrapperBodyEval (argument : Ixon.Eval.Value) :
+    Ixon.Eval.eval ectx 100 wrapperFrame [argument] wrapperBody =
+      .ok (.litV (.natL 9)) := by
+  dsimp only [wrapperBody]
+  rw [Ixon.Eval.eval.eq_def]
+  dsimp only
+  rw [wrapperFunctionEval]
+  rw [wrapperArgumentEval]
+  exact consumerApply argument
+
+private theorem wrapperBodyPErase :
+    PErase ectx ictx none wrapperFrame.refs wrapperFrame.selfMuts
+      wrapperFrame.selfAddr [false]
+      wrapperBody wrapperTargetBody := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := cover) (fuel := 100)
+  decide
+
+private theorem wrapperComputed :
+    UC.ComputedErasedHead wrapperCheckCtx 99 .shared [] wrapperBody := by
+  apply UC.ComputedErasedHead.of_checkedLambda
+    (uses := .many) (domain := .sort 0)
+    (outerUses := []) (owned := .unique)
+  · rfl
+  · exact wrapperLambdaCheck
+
+private theorem leftEnv :
+    EnvRel ectx ictx none wrapperFrame.refs wrapperFrame.selfMuts
+      wrapperFrame.selfAddr [false]
+      [.litV (.natL 7)] [.erased] :=
+  .drop .nil
+
+private theorem rightEnv :
+    EnvRel ectx ictx none wrapperFrame.refs wrapperFrame.selfMuts
+      wrapperFrame.selfAddr [false]
+      [.litV (.natL 8)] [.erased] :=
+  .drop .nil
+
+/-- Non-degenerate non-interference instance: the dropped slot changes from
+`7̂` to `8̂`, while both checked source executions share target result `9̂`. -/
+theorem droppedVariableOccurrenceNoninterference :
+    ErasureObsEq ectx ictx (.litV (.natL 9)) (.litV (.natL 9)) := by
+  apply computedErased_eval_noninterference
+    (F := wrapperFrame) (mask := [])
+    (leftEnv := [.litV (.natL 7)])
+    (rightEnv := [.litV (.natL 8)]) (targetEnv := [.erased])
+    ⟨rfl, rfl⟩ oracleRel wrapperComputed wrapperBodyPErase leftEnv rightEnv
+    (leftFuel := 100) (rightFuel := 100)
+  · exact wrapperBodyEval _
+  · exact wrapperBodyEval _
+
+private def entryFrame : Ixon.Eval.Frame :=
+  { refs := #[wrapperAddress, argumentBlob] }
+
+private def sourceEntry : Expr :=
+  .app (.ref 0 #[]) (.nat 1)
+
+private def targetEntry : IxIR0.Expr :=
+  .app (.ref wrapperAddress) .erased
+
+private def entryTables : Erase.ETables :=
+  { refs := entryFrame.refs }
+
+private theorem entryPErase :
+    PErase ectx ictx none entryFrame.refs #[] none [] sourceEntry
+      targetEntry := by
+  apply EraseValidator.related_of_validateExpr
+    (cover := cover) (fuel := 100)
+  decide
+
+/-- Whole-expression forward simulation for the same checked, certified
+dropped-variable occurrence. -/
+theorem droppedVariableOccurrenceSim {fuel : Nat} {value : Ixon.Eval.Value}
+    (hsource : Ixon.Eval.eval ectx fuel entryFrame [] sourceEntry =
+      .ok value) :
+    ∃ targetFuel targetValue,
+      IxIR0.eval ictx targetFuel [] targetEntry = .ok targetValue ∧
+      ValRel ectx ictx value targetValue :=
+  erasure_sim_closed ⟨rfl, rfl⟩ oracleRel hsource entryPErase
+
+#guard (match Ixon.Eval.eval ectx 100 entryFrame [] sourceEntry with
+  | .ok (.litV (.natL 9)) => true
+  | _ => false)
+
+#guard (match IxIR0.eval ictx 100 [] targetEntry with
+  | .ok (.lit (.nat 9)) => true
+  | _ => false)
+
+end DroppedVariableFixture
+
+end Ix.Compiler.UsageSound
diff --git a/Ix/Compiler/X86/Basic.lean b/Ix/Compiler/X86/Basic.lean
new file mode 100644
index 000000000..7915949cc
--- /dev/null
+++ b/Ix/Compiler/X86/Basic.lean
@@ -0,0 +1,359 @@
+import Std
+
+/-!
+# Typed x86-64 v0 target syntax
+
+This is the proof-facing target boundary for the first native wedge.  It is
+deliberately not an encoder: branch and call destinations are bounded symbolic
+block identifiers, and every constructor denotes only an instruction form in
+the reviewed sequential System V subset.  Byte layout and relocation belong
+to the later encoder/object layer.
+
+The AST combines compare-and-branch into one target operation.  This keeps
+EFLAGS local by construction while still allowing the encoder to emit the
+usual `cmp`/`jcc` pair.  Memory operands also separate index registers from
+general registers, excluding the x86 `rsp`-as-index encoding hole by type.
+-/
+
+namespace Ix.Compiler.X86
+
+abbrev Word := UInt64
+abbrev Imm32 := UInt32
+abbrev BlockId := UInt32
+
+/-- The sixteen integer registers in 64-bit mode. -/
+inductive GPR where
+  | rax | rcx | rdx | rbx | rsp | rbp | rsi | rdi
+  | r8 | r9 | r10 | r11 | r12 | r13 | r14 | r15
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Registers accepted in the SIB index position.  `rsp` has no constructor:
+the corresponding encoding means "no index" on x86-64. -/
+inductive IndexReg where
+  | rax | rcx | rdx | rbx | rbp | rsi | rdi
+  | r8 | r9 | r10 | r11 | r12 | r13 | r14 | r15
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def IndexReg.gpr : IndexReg → GPR
+  | .rax => .rax
+  | .rcx => .rcx
+  | .rdx => .rdx
+  | .rbx => .rbx
+  | .rbp => .rbp
+  | .rsi => .rsi
+  | .rdi => .rdi
+  | .r8 => .r8
+  | .r9 => .r9
+  | .r10 => .r10
+  | .r11 => .r11
+  | .r12 => .r12
+  | .r13 => .r13
+  | .r14 => .r14
+  | .r15 => .r15
+
+inductive Width where
+  | w8 | w16 | w32 | w64
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Width.bits : Width → Nat
+  | .w8 => 8
+  | .w16 => 16
+  | .w32 => 32
+  | .w64 => 64
+
+def Width.bytes : Width → Nat
+  | .w8 => 1
+  | .w16 => 2
+  | .w32 => 4
+  | .w64 => 8
+
+def Width.mask : Width → Word
+  | .w8 => 0xff
+  | .w16 => 0xffff
+  | .w32 => 0xffffffff
+  | .w64 => 0xffffffffffffffff
+
+/-- Widths with a two-operand integer `imul` encoding.  Byte multiplication
+has a different implicit-register shape and is outside this AST form. -/
+inductive MulWidth where
+  | w16 | w32 | w64
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def MulWidth.width : MulWidth → Width
+  | .w16 => .w16
+  | .w32 => .w32
+  | .w64 => .w64
+
+inductive Scale where
+  | one | two | four | eight
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Scale.word : Scale → Word
+  | .one => 1
+  | .two => 2
+  | .four => 4
+  | .eight => 8
+
+/-- An encodable x86 base/index/scale/signed-disp32 address.  `displacement`
+is the two's-complement bit pattern of the signed 32-bit displacement. -/
+structure MemAddr where
+  base : Option GPR := none
+  index : Option IndexReg := none
+  scale : Scale := .one
+  displacement : Imm32 := 0
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Stack allocation is intrinsically 16-byte aligned and bounded. -/
+structure FrameSize where
+  units16 : UInt16
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def FrameSize.bytes (size : FrameSize) : Word :=
+  size.units16.toUInt64 * 16
+
+/-- A spill slot is an eight-byte cell below `rbp`.  The `UInt16` index keeps
+its negative displacement well inside the signed-disp32 encoding range. -/
+structure StackSlot where
+  index : UInt16
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def StackSlot.displacement (slot : StackSlot) : Word :=
+  (slot.index.toUInt64 + 1) * 8
+
+inductive MoveSource where
+  | reg (source : GPR)
+  | imm (value : Word)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive AluSource where
+  | reg (source : GPR)
+  /-- A sign-extended imm32 when used at width 64. -/
+  | imm (value : Imm32)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive AluOp where
+  | add | sub | and | or | xor
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Condition where
+  | eq | ne
+  | unsignedLt | unsignedLe | unsignedGt | unsignedGe
+  | signedLt | signedLe | signedGt | signedGe
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Compare where
+  width : Width
+  left : GPR
+  right : AluSource
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The named runtime surface reachable from v0 target code.  General division
+is deliberately a runtime call rather than an x86 `div` instruction. -/
+inductive Intrinsic where
+  | allocate
+  | reserve
+  | reuse
+  | releaseReservation
+  | retainShared
+  | releaseShared
+  | memcpy
+  | unsignedDiv
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Intrinsic.arity : Intrinsic → Nat
+  | .allocate => 2
+  | .reserve => 2
+  | .reuse => 3
+  | .releaseReservation => 1
+  | .retainShared => 1
+  | .releaseShared => 1
+  | .memcpy => 3
+  | .unsignedDiv => 2
+
+/-- Non-control target operations.  Operand restrictions are represented by
+the constructors: there is no memory-to-memory ALU form, no arbitrary runtime
+symbol, no indirect call, and no raw byte escape hatch. -/
+inductive Instr where
+  | mov (width : Width) (destination : GPR) (source : MoveSource)
+  /-- Narrow loads are zero-extending (`movzx`); w32 follows the architectural
+  zero-extension rule and w64 is a normal move. -/
+  | load (width : Width) (destination : GPR) (source : MemAddr)
+  | store (width : Width) (destination : MemAddr) (source : GPR)
+  | lea (destination : GPR) (source : MemAddr)
+  | alu (operation : AluOp) (width : Width) (destination : GPR)
+      (source : AluSource)
+  | imul (width : MulWidth) (destination source : GPR)
+  | push (source : GPR)
+  | pop (destination : GPR)
+  | allocFrame (size : FrameSize)
+  | freeFrame (size : FrameSize)
+  | spill (slot : StackSlot) (source : GPR)
+  | reload (destination : GPR) (slot : StackSlot)
+  | call (target : BlockId)
+  | callRuntime (intrinsic : Intrinsic)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Control operations close a target block.  A conditional branch owns its
+comparison, so no later operation can consume stale EFLAGS. -/
+inductive Terminator where
+  | jump (target : BlockId)
+  | branch (comparison : Compare) (condition : Condition)
+      (ifTrue ifFalse : BlockId)
+  | tailCall (target : BlockId)
+  | ret
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Block where
+  instructions : Array Instr
+  terminator : Terminator
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Blocks form one linked target text world.  Function symbols and local
+labels both resolve to block IDs before this semantics, but byte offsets do
+not: instruction encoding remains a separate pass. -/
+structure Program where
+  blocks : Array Block
+  entry : BlockId
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-! ## System V register convention -/
+
+namespace SysV
+
+def argumentRegisters : Array GPR :=
+  #[.rdi, .rsi, .rdx, .rcx, .r8, .r9]
+
+def resultRegister : GPR := .rax
+def stackPointer : GPR := .rsp
+def framePointer : GPR := .rbp
+
+/-- System V function entry observes the return address already pushed. -/
+def functionEntryAligned (stack : Word) : Bool := stack % 16 == 8
+
+/-- Immediately before `call`, the caller has restored 16-byte alignment. -/
+def callSiteAligned (stack : Word) : Bool := stack % 16 == 0
+
+def calleeSaved : Array GPR :=
+  #[.rbx, .rbp, .r12, .r13, .r14, .r15]
+
+def callerSaved : Array GPR :=
+  #[.rax, .rcx, .rdx, .rsi, .rdi, .r8, .r9, .r10, .r11]
+
+def argumentRegister? (index : Nat) : Option GPR :=
+  argumentRegisters[index]?
+
+def isCallerSaved (register : GPR) : Bool :=
+  callerSaved.contains register
+
+end SysV
+
+/-! ## Closed-fragment theorem -/
+
+/-- A vocabulary wider than the v0 AST, used to state what remains excluded. -/
+inductive Form where
+  | move | load | store | address | arithmetic | multiply
+  | stack | spill | reload | directCall | runtimeCall
+  | jump | compareBranch | tailCall | ret
+  | scalarDivision | float | simd | atomic | indirectCall | syscall | tls
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The reviewed sequential v0 emitted fragment. -/
+def Form.InV0 : Form → Prop
+  | .move | .load | .store | .address | .arithmetic | .multiply
+  | .stack | .spill | .reload | .directCall | .runtimeCall
+  | .jump | .compareBranch | .tailCall | .ret => True
+  | .scalarDivision | .float | .simd | .atomic | .indirectCall | .syscall
+  | .tls => False
+
+def Instr.form : Instr → Form
+  | .mov .. => .move
+  | .load .. => .load
+  | .store .. => .store
+  | .lea .. => .address
+  | .alu .. => .arithmetic
+  | .imul .. => .multiply
+  | .push .. | .pop .. | .allocFrame .. | .freeFrame .. => .stack
+  | .spill .. => .spill
+  | .reload .. => .reload
+  | .call .. => .directCall
+  | .callRuntime .. => .runtimeCall
+
+def Terminator.form : Terminator → Form
+  | .jump .. => .jump
+  | .branch .. => .compareBranch
+  | .tailCall .. => .tailCall
+  | .ret => .ret
+
+/-- Unsupported ISA forms cannot be constructed as v0 instructions. -/
+theorem Instr.inV0 (instruction : Instr) : instruction.form.InV0 := by
+  cases instruction <;> trivial
+
+/-- Unsupported ISA forms cannot be constructed as v0 terminators. -/
+theorem Terminator.inV0 (terminator : Terminator) : terminator.form.InV0 := by
+  cases terminator <;> trivial
+
+def Block.InV0 (block : Block) : Prop :=
+  (∀ instruction ∈ block.instructions, instruction.form.InV0) ∧
+    block.terminator.form.InV0
+
+def Program.InV0 (program : Program) : Prop :=
+  ∀ block ∈ program.blocks, block.InV0
+
+/-- Fragment containment is structural: validation cannot widen the emitted
+ISA because the target AST has no constructor for an excluded form. -/
+theorem Program.inV0 (program : Program) : program.InV0 := by
+  intro block blockMember
+  constructor
+  · intro instruction instructionMember
+    exact instruction.inV0
+  · exact block.terminator.inV0
+
+/-! ## Bounded control validation -/
+
+def Program.hasBlock (program : Program) (target : BlockId) : Bool :=
+  decide (target.toNat < program.blocks.size)
+
+def Instr.targetsValid (program : Program) : Instr → Bool
+  | .call target => program.hasBlock target
+  | _ => true
+
+def Terminator.targetsValid (program : Program) : Terminator → Bool
+  | .jump target | .tailCall target => program.hasBlock target
+  | .branch _ _ ifTrue ifFalse =>
+      program.hasBlock ifTrue && program.hasBlock ifFalse
+  | .ret => true
+
+def Block.targetsValid (program : Program) (block : Block) : Bool :=
+  block.instructions.all (Instr.targetsValid program) &&
+    block.terminator.targetsValid program
+
+def Block.offsetsFit (block : Block) : Bool :=
+  decide (block.instructions.size < 2 ^ 32)
+
+def Program.wellFormed (program : Program) : Bool :=
+  !program.blocks.isEmpty &&
+    decide (program.blocks.size < 2 ^ 32) &&
+    program.hasBlock program.entry &&
+    program.blocks.all fun block =>
+      block.offsetsFit && block.targetsValid program
+
+structure Checked where
+  program : Program
+  valid : program.wellFormed = true
+
+inductive ValidationError where
+  | malformedControl
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Program.check (program : Program) : Except ValidationError Checked :=
+  if valid : program.wellFormed = true then
+    .ok ⟨program, valid⟩
+  else
+    .error .malformedControl
+
+/-- Validation adds control-bounds evidence but cannot change the closed ISA
+fragment established by the typed program. -/
+theorem Checked.inV0 (checked : Checked) : checked.program.InV0 :=
+  checked.program.inV0
+
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/ByteBranch.lean b/Ix/Compiler/X86/ByteBranch.lean
new file mode 100644
index 000000000..1981921f9
--- /dev/null
+++ b/Ix/Compiler/X86/ByteBranch.lean
@@ -0,0 +1,144 @@
+import Ix.Compiler.X86.ByteControl
+
+/-! The emitted CMP/Jcc/JMP recipe executes from its actual bytes. -/
+
+namespace Ix.Compiler.X86.Encode
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def branchBytes (comparison : Compare) (condition : Condition) (yes no : Imm32) : ByteArray :=
+  encodeCompare comparison ++ (bytes [0x0f, nearOpcode condition] ++ imm32Bytes yes) ++
+    (byte 0xe9 ++ imm32Bytes no)
+
+theorem branchBytes_origin (comparison : Compare) (condition : Condition) (yes no : BlockId) :
+    (encodeTerminator (.branch comparison condition yes no)).bytes = branchBytes comparison condition 0 0 := by
+  simp [encodeTerminator, Chunk.append, Chunk.raw, rel32, branchBytes, imm32_zero_bytes,
+    ByteArray.append_assoc]
+
+theorem branchBytes_compare (comparison : Compare) (condition : Condition) (yes no : Imm32) :
+    Decode.decodeAt (branchBytes comparison condition yes no) 0 =
+      some ⟨.compare comparison.width comparison.left (aluOperand comparison.width comparison.right),
+        (encodeCompare comparison).size⟩ := by
+  have decoded := decodeAt_of_one (encodeCompare comparison) ByteArray.empty
+    ((bytes [0x0f, nearOpcode condition] ++ imm32Bytes yes) ++ (byte 0xe9 ++ imm32Bytes no))
+    _ (compare_decode comparison _) (compare_size comparison).1
+    (Nat.le_trans (compare_size comparison).2 (by decide))
+  simpa [branchBytes, ByteArray.append_assoc] using decoded
+
+theorem branchBytes_branch (comparison : Compare) (condition : Condition) (yes no : Imm32) :
+    Decode.decodeAt (branchBytes comparison condition yes no) (encodeCompare comparison).size =
+      some ⟨.branch condition yes, 6⟩ :=
+  branch_decodeAt condition yes (encodeCompare comparison) (byte 0xe9 ++ imm32Bytes no)
+
+theorem branchBytes_jump (comparison : Compare) (condition : Condition) (yes no : Imm32) :
+    Decode.decodeAt (branchBytes comparison condition yes no) ((encodeCompare comparison).size + 6) =
+      some ⟨.jump no, 5⟩ := by
+  simpa [branchBytes, imm32Bytes] using jump_decodeAt no
+    (encodeCompare comparison ++ (bytes [0x0f, nearOpcode condition] ++ imm32Bytes yes)) ByteArray.empty
+
+def comparedState (comparison : Compare) (state : ByteEval.State) : ByteEval.State :=
+  { state with
+    rip := state.rip + UInt64.ofNat (encodeCompare comparison).size
+    flags := ByteEval.aluFlags .sub comparison.width (state.core.readReg comparison.left)
+      (ByteEval.operand (aluOperand comparison.width comparison.right) state.core) }
+
+@[simp] theorem comparedState_test (comparison : Compare) (condition : Condition) (state : ByteEval.State) :
+    (comparedState comparison state).flags.test condition = some (comparison.holds condition state.core) := by
+  rw [comparedState, ByteEval.compare_flags]
+  exact congrArg some (condition_congr _ _ _ _ _ (aluOperand_low _ _ _))
+
+theorem branch_step_compare (comparison : Compare) (condition : Condition) (yes no : Imm32)
+    (state : ByteEval.State) :
+    ByteEval.step (branchBytes comparison condition yes no) state.rip state =
+      .ok (comparedState comparison state) := by
+  simp [ByteEval.step, branchBytes_compare, ByteEval.execute, comparedState]
+
+theorem offset_after (rip : Word) (count : Nat) (bound : count < UInt64.size) :
+    (rip + UInt64.ofNat count - rip).toNat = count := by
+  rw [UInt64.add_comm, UInt64.add_sub_cancel, UInt64.toNat_ofNat_of_lt' bound]
+
+theorem branch_step_branch (comparison : Compare) (condition : Condition) (yes no : Imm32)
+    (state : ByteEval.State) :
+    ByteEval.step (branchBytes comparison condition yes no) state.rip (comparedState comparison state) =
+      .ok { comparedState comparison state with
+        rip := if comparison.holds condition state.core then
+          ByteEval.relative ((comparedState comparison state).rip + 6) yes
+        else (comparedState comparison state).rip + 6 } := by
+  have bound := compare_size comparison
+  have offset := offset_after state.rip (encodeCompare comparison).size (by
+    simp only [UInt64.size]; omega)
+  simp only [ByteEval.step, comparedState] at offset ⊢
+  rw [offset, branchBytes_branch]
+  simp only [ByteEval.execute]
+  change (match (comparedState comparison state).flags.test condition with
+    | none => _ | some take => _) = _
+  rw [comparedState_test]
+  rfl
+
+def fallthroughState (comparison : Compare) (state : ByteEval.State) : ByteEval.State :=
+  { comparedState comparison state with rip := (comparedState comparison state).rip + 6 }
+
+theorem branch_step_jump (comparison : Compare) (condition : Condition) (yes no : Imm32)
+    (state : ByteEval.State) :
+    ByteEval.step (branchBytes comparison condition yes no) state.rip (fallthroughState comparison state) =
+      .ok { fallthroughState comparison state with
+        rip := ByteEval.relative ((fallthroughState comparison state).rip + 5) no } := by
+  have bound := compare_size comparison
+  have offset := offset_after state.rip ((encodeCompare comparison).size + 6) (by
+    simp only [UInt64.size]; omega)
+  simp only [UInt64.ofNat_add] at offset
+  change (state.rip + (UInt64.ofNat (encodeCompare comparison).size + 6) - state.rip).toNat =
+    (encodeCompare comparison).size + 6 at offset
+  simp only [ByteEval.step, fallthroughState, comparedState]
+  rw [show state.rip + UInt64.ofNat (encodeCompare comparison).size + 6 =
+    state.rip + (UInt64.ofNat (encodeCompare comparison).size + 6) by rw [UInt64.add_assoc]]
+  rw [offset, branchBytes_jump]
+  rfl
+
+/-- Taken branches use CMP/Jcc; untaken branches additionally execute JMP.
+The theorem reads real bytes, retains the comparison flags, and preserves the
+entire core on both paths. -/
+theorem branch_bytes_execution (comparison : Compare) (condition : Condition) (yes no : Imm32)
+    (state : ByteEval.State) :
+    ByteEval.run (branchBytes comparison condition yes no) state.rip
+      (if comparison.holds condition state.core then 2 else 3) state =
+      .ok { comparedState comparison state with
+        rip := if comparison.holds condition state.core then
+          ByteEval.relative ((comparedState comparison state).rip + 6) yes
+        else ByteEval.relative ((comparedState comparison state).rip + 6 + 5) no } := by
+  have jumped := branch_step_jump comparison condition yes no state
+  simp only [fallthroughState] at jumped
+  cases take : comparison.holds condition state.core <;>
+    simp [take, ByteEval.run, branch_step_compare, branch_step_branch, jumped]
+
+/-- Applying both actual rel32 fixups to the emitted terminator yields the
+same bytes consumed by `branch_bytes_execution`. Layout supplies the signed
+values and checks their range; the local patch law is valid for all Ints. -/
+theorem branch_patch (comparison : Compare) (condition : Condition) (yes no : BlockId)
+    (yesDisplacement noDisplacement : Int) :
+    (do
+      let first ← patchSigned32 (encodeTerminator (.branch comparison condition yes no)).bytes
+        ((encodeCompare comparison).size + 2) yesDisplacement
+      patchSigned32 first ((encodeCompare comparison).size + 7) noDisplacement) =
+    .ok (branchBytes comparison condition (Int32.ofInt yesDisplacement).toUInt32
+      (Int32.ofInt noDisplacement).toUInt32) := by
+  have first : patchSigned32 (branchBytes comparison condition 0 0)
+      ((encodeCompare comparison).size + 2) yesDisplacement =
+      .ok (branchBytes comparison condition (Int32.ofInt yesDisplacement).toUInt32 0) := by
+    simpa [branchBytes, signed32Bytes, imm32_zero_bytes, ByteArray.append_assoc] using
+      patchSigned32_splice (encodeCompare comparison ++ bytes [0x0f, nearOpcode condition])
+        (byte 0xe9 ++ bytes [0, 0, 0, 0]) 0 0 0 0 yesDisplacement
+  have second : patchSigned32
+      (branchBytes comparison condition (Int32.ofInt yesDisplacement).toUInt32 0)
+      ((encodeCompare comparison).size + 7) noDisplacement =
+      .ok (branchBytes comparison condition (Int32.ofInt yesDisplacement).toUInt32
+        (Int32.ofInt noDisplacement).toUInt32) := by
+    simpa [branchBytes, signed32Bytes, imm32_zero_bytes,
+      ByteArray.append_assoc, Nat.add_assoc] using
+      patchSigned32_splice
+        (encodeCompare comparison ++ (bytes [0x0f, nearOpcode condition] ++ signed32Bytes yesDisplacement) ++ byte 0xe9)
+        ByteArray.empty 0 0 0 0 noDisplacement
+  rw [branchBytes_origin, first]
+  exact second
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/ByteCall.lean b/Ix/Compiler/X86/ByteCall.lean
new file mode 100644
index 000000000..8701f4c30
--- /dev/null
+++ b/Ix/Compiler/X86/ByteCall.lean
@@ -0,0 +1,86 @@
+import Ix.Compiler.X86.ByteControl
+
+/-! Paired local CALL/RET effects. Return slots contain the typed continuation
+token on one side and the physical byte RIP on the other. E2 must compose this
+explicit difference through callees; neither equality nor an opaque step
+simulation is assumed here. ABI diagnostics remain typed contracts. -/
+
+namespace Ix.Compiler.X86.Encode
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def typedCallState (machine : Machine) (target : BlockId) (continuation : PC) : Machine :=
+  let stack := machine.core.readReg .rsp - 8
+  { machine with
+    core := { machine.core.setReg .rsp stack with memory := machine.core.memory.write64 stack continuation.encode }
+    pc := ⟨target, 0⟩
+    returns := ⟨continuation, stack, machine.core.calleeSavedSnapshot⟩ :: machine.returns }
+
+def byteCallState (core : Core) (rip : Word) (flags : ByteEval.Flags) (displacement : Imm32) : ByteEval.State :=
+  let stack := core.readReg .rsp - 8
+  { core := { core.setReg .rsp stack with memory := core.memory.write64 stack (rip + 5) }
+    rip := ByteEval.relative (rip + 5) displacement
+    flags }
+
+/-- Both models push an eight-byte return slot and update the same registers.
+The values in that slot are stated separately, without conflating PCs. -/
+theorem call_pair (runtime : Runtime) (checked : Checked) (machine : Machine)
+    (target : BlockId) (continuation : PC) (rip : Word) (flags : ByteEval.Flags) (displacement : Imm32)
+    (aligned : SysV.callSiteAligned (machine.core.readReg .rsp) = true)
+    (valid : checked.program.hasBlock target = true) (next : machine.pc.next? = some continuation)
+    (writable : Memory.rangeAllowed machine.core.memory.writable (machine.core.readReg .rsp - 8) 8 = true) :
+    executeInstr runtime checked (.call target) machine = typedCallState machine target continuation ∧
+    ByteEval.step (byte 0xe8 ++ imm32Bytes displacement) rip ⟨machine.core, rip, flags⟩ =
+      .ok (byteCallState machine.core rip flags displacement) ∧
+    (typedCallState machine target continuation).core.registers =
+      (byteCallState machine.core rip flags displacement).core.registers ∧
+    (typedCallState machine target continuation).core.memory.read64 (machine.core.readReg .rsp - 8) = continuation.encode ∧
+    (byteCallState machine.core rip flags displacement).core.memory.read64 (machine.core.readReg .rsp - 8) = rip + 5 := by
+  rw [call_bytes_execution displacement ⟨machine.core, rip, flags⟩]
+  simp [executeInstr, aligned, valid, next, Memory.write64?, Memory.write?, Width.bytes,
+    writable, typedCallState, byteCallState, Memory.read64_write64]
+  exact ⟨rfl, rfl⟩
+
+theorem call_fault (runtime : Runtime) (checked : Checked) (machine : Machine)
+    (target : BlockId) (continuation : PC) (rip : Word) (flags : ByteEval.Flags) (displacement : Imm32)
+    (aligned : SysV.callSiteAligned (machine.core.readReg .rsp) = true)
+    (valid : checked.program.hasBlock target = true) (next : machine.pc.next? = some continuation)
+    (denied : Memory.rangeAllowed machine.core.memory.writable (machine.core.readReg .rsp - 8) 8 = false) :
+    let fault : MemoryFault := ⟨.write, machine.core.readReg .rsp - 8, 8⟩
+    executeInstr runtime checked (.call target) machine = machine.trap (.memoryFault fault) ∧
+    ByteEval.step (byte 0xe8 ++ imm32Bytes displacement) rip ⟨machine.core, rip, flags⟩ = .error (.memory fault) := by
+  rw [call_bytes_execution displacement ⟨machine.core, rip, flags⟩]
+  simp [executeInstr, aligned, valid, next, Memory.write64?, Memory.write?, Width.bytes, denied]
+
+/-- A matched pair of concrete return-slot reads suffices for local return
+agreement. Establishing those reads across a complete callee is the stream
+simulation's responsibility. The caller's memory may store physical RIPs. -/
+theorem ret_pair (checked : Checked) (machine : Machine) (frame : ReturnFrame) (rest : List ReturnFrame)
+    (physicalMemory : Memory) (rip target : Word) (flags : ByteEval.Flags)
+    (returns : machine.returns = frame :: rest)
+    (stack : machine.core.readReg .rsp = frame.returnSlot)
+    (typedRead : machine.core.memory.read64? frame.returnSlot = .ok frame.continuation.encode)
+    (physicalRead : physicalMemory.read64? frame.returnSlot = .ok target)
+    (saved : machine.core.calleeSavedMatch frame.calleeSaved = true) :
+    executeTerminator checked .ret machine =
+      { machine with core := machine.core.setReg .rsp (frame.returnSlot + 8), pc := frame.continuation, returns := rest } ∧
+    ByteEval.step (byte 0xc3) rip ⟨{ machine.core with memory := physicalMemory }, rip, flags⟩ =
+      .ok ⟨({ machine.core with memory := physicalMemory } : Core).setReg .rsp (frame.returnSlot + 8), target, flags⟩ := by
+  constructor
+  · simp [executeTerminator, returns, stack, typedRead, saved]
+  · rw [ret_bytes_execution ⟨{ machine.core with memory := physicalMemory }, rip, flags⟩]
+    change (match physicalMemory.read64? (machine.core.readReg .rsp) with
+      | .error fault => _ | .ok target => _) = _
+    rw [stack, physicalRead]
+    change Except.ok ({
+      core := ({ machine.core with memory := physicalMemory } : Core).setReg .rsp (machine.core.readReg .rsp + 8)
+      rip := target, flags } : ByteEval.State) = _
+    rw [stack]
+
+/-- Named runtime calls use the same physical CALL form. Their typed atomic
+invocation is still an external procedure contract, outside local encoding. -/
+theorem runtime_call_form (intrinsic : Intrinsic) :
+    (encodeInstr (.callRuntime intrinsic)).bytes = byte 0xe8 ++ imm32Bytes 0 := by
+  simp [encodeInstr, rel32, imm32_zero_bytes]
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/ByteControl.lean b/Ix/Compiler/X86/ByteControl.lean
new file mode 100644
index 000000000..6c42c6006
--- /dev/null
+++ b/Ix/Compiler/X86/ByteControl.lean
@@ -0,0 +1,79 @@
+import Ix.Compiler.X86.EncodeExecution
+import Ix.Compiler.X86.EncodePatch
+
+/-! Local byte-PC and control-transfer laws. These consume encoded bytes and
+state explicit return-slot and symbolic-PC obligations for later composition. -/
+
+namespace Ix.Compiler.X86.Encode
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+theorem call_decodeAt (displacement : Imm32) (before after : ByteArray) :
+    Decode.decodeAt (before ++ (byte 0xe8 ++ imm32Bytes displacement) ++ after) before.size =
+      some ⟨.call displacement, 5⟩ := by
+  simpa [imm32Bytes] using decodeAt_of_one (byte 0xe8 ++ imm32Bytes displacement) before after
+    (.call displacement) (call_decode displacement after.data.toList) (by simp [imm32Bytes]) (by simp [imm32Bytes])
+
+theorem jump_decodeAt (displacement : Imm32) (before after : ByteArray) :
+    Decode.decodeAt (before ++ (byte 0xe9 ++ imm32Bytes displacement) ++ after) before.size =
+      some ⟨.jump displacement, 5⟩ := by
+  simpa [imm32Bytes] using decodeAt_of_one (byte 0xe9 ++ imm32Bytes displacement) before after
+    (.jump displacement) (jump_decode displacement after.data.toList) (by simp [imm32Bytes]) (by simp [imm32Bytes])
+
+theorem branch_decodeAt (condition : Condition) (displacement : Imm32) (before after : ByteArray) :
+    Decode.decodeAt (before ++ (bytes [0x0f, nearOpcode condition] ++ imm32Bytes displacement) ++ after) before.size =
+      some ⟨.branch condition displacement, 6⟩ := by
+  simpa [imm32Bytes] using decodeAt_of_one (bytes [0x0f, nearOpcode condition] ++ imm32Bytes displacement)
+    before after (.branch condition displacement) (branch_decode condition displacement after.data.toList)
+    (by simp [imm32Bytes]) (by simp [imm32Bytes])
+
+theorem ret_decodeAt (before after : ByteArray) :
+    Decode.decodeAt (before ++ byte 0xc3 ++ after) before.size = some ⟨.ret, 1⟩ := by
+  simpa using decodeAt_of_one (byte 0xc3) before after .ret (ret_decode after.data.toList) (by simp) (by simp)
+
+theorem relative_resolves (next target : Nat) (fits : fitsSigned32 ((target : Int) - next) = true) :
+    ByteEval.relative (UInt64.ofNat next) (Int32.ofInt ((target : Int) - next)).toUInt32 = UInt64.ofNat target := by
+  apply UInt64.toBitVec_inj.mp
+  simp only [ByteEval.relative, UInt64.toBitVec_add, UInt64.toBitVec_ofNat', signExtend32_ofInt _ fits]
+  change BitVec.ofInt 64 (next : Int) + BitVec.ofInt 64 ((target : Int) - next) = BitVec.ofInt 64 (target : Int)
+  rw [← BitVec.ofInt_add]
+  congr 1
+  omega
+
+theorem relative_resolves_base (base : Word) (next target : Nat)
+    (fits : fitsSigned32 ((target : Int) - next) = true) :
+    ByteEval.relative (base + UInt64.ofNat next) (Int32.ofInt ((target : Int) - next)).toUInt32 =
+      base + UInt64.ofNat target := by
+  simpa [ByteEval.relative, UInt64.add_assoc] using congrArg (base + ·) (relative_resolves next target fits)
+
+theorem call_bytes_execution (displacement : Imm32) (state : ByteEval.State) :
+    ByteEval.step (byte 0xe8 ++ imm32Bytes displacement) state.rip state =
+      match state.core.memory.write64? (state.core.readReg .rsp - 8) (state.rip + 5) with
+      | .error fault => .error (.memory fault)
+      | .ok memory => .ok {
+          core := { state.core.setReg .rsp (state.core.readReg .rsp - 8) with memory }
+          rip := ByteEval.relative (state.rip + 5) displacement, flags := state.flags } := by
+  have decode := call_decodeAt displacement ByteArray.empty ByteArray.empty
+  simp only [ByteArray.empty_append, ByteArray.append_empty, ByteArray.size_empty] at decode
+  simp only [ByteEval.step, UInt64.sub_self, UInt64.toNat_zero, decode, ByteEval.execute]
+  cases state.core.memory.write64? (state.core.readReg .rsp - 8) (state.rip + 5) <;>
+    simp [Except.mapError]
+
+theorem ret_bytes_execution (state : ByteEval.State) :
+    ByteEval.step (byte 0xc3) state.rip state =
+      match state.core.memory.read64? (state.core.readReg .rsp) with
+      | .error fault => .error (.memory fault)
+      | .ok target => .ok { state with core := state.core.setReg .rsp (state.core.readReg .rsp + 8), rip := target } := by
+  have decode := ret_decodeAt ByteArray.empty ByteArray.empty
+  simp only [ByteArray.empty_append, ByteArray.append_empty, ByteArray.size_empty] at decode
+  simp only [ByteEval.step, UInt64.sub_self, UInt64.toNat_zero, decode, ByteEval.execute]
+  cases state.core.memory.read64? (state.core.readReg .rsp) <;> simp [Except.mapError]
+
+theorem jump_bytes_execution (displacement : Imm32) (state : ByteEval.State) :
+    ByteEval.step (byte 0xe9 ++ imm32Bytes displacement) state.rip state =
+      .ok { state with rip := ByteEval.relative (state.rip + 5) displacement } := by
+  have decode := jump_decodeAt displacement ByteArray.empty ByteArray.empty
+  simp only [ByteArray.empty_append, ByteArray.append_empty, ByteArray.size_empty] at decode
+  simp [ByteEval.step, decode, ByteEval.execute]
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/ByteEval.lean b/Ix/Compiler/X86/ByteEval.lean
new file mode 100644
index 000000000..fa8ed2168
--- /dev/null
+++ b/Ix/Compiler/X86/ByteEval.lean
@@ -0,0 +1,136 @@
+import Ix.Compiler.X86.Decode
+import Ix.Compiler.X86.Eval
+
+/-! Local execution of independently decoded instructions with byte RIP and
+the four condition flags read by the emitted branches. Memory permissions are
+the existing per-byte local ISA model. Undefined IMUL sign/zero flags remain
+unknown, so an unsupported use is explicit rather than silently assumed. -/
+
+namespace Ix.Compiler.X86.ByteEval
+
+structure Flags where
+  carry : Option Bool := none
+  zero : Option Bool := none
+  sign : Option Bool := none
+  overflow : Option Bool := none
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Flags.test (flags : Flags) : Condition → Option Bool
+  | .eq => flags.zero
+  | .ne => flags.zero.map not
+  | .unsignedLt => flags.carry
+  | .unsignedLe => do return (← flags.carry) || (← flags.zero)
+  | .unsignedGt => do return !((← flags.carry) || (← flags.zero))
+  | .unsignedGe => flags.carry.map not
+  | .signedLt => do return (← flags.sign) ^^ (← flags.overflow)
+  | .signedLe => do return ((← flags.sign) ^^ (← flags.overflow)) || (← flags.zero)
+  | .signedGt => do return !(((← flags.sign) ^^ (← flags.overflow)) || (← flags.zero))
+  | .signedGe => do return !((← flags.sign) ^^ (← flags.overflow))
+
+def resultFlags (result : BitVec bits) (carry overflow : Bool) : Flags :=
+  ⟨some carry, some (result == 0), some result.msb, some overflow⟩
+
+def addFlags (left right : BitVec bits) : Flags :=
+  resultFlags (left + right) (BitVec.uaddOverflow left right) (BitVec.saddOverflow left right)
+
+def subFlags (left right : BitVec bits) : Flags :=
+  resultFlags (left - right) (BitVec.usubOverflow left right) (BitVec.ssubOverflow left right)
+
+def aluFlags (operation : AluOp) (width : Width) (left right : Word) : Flags :=
+  let left := left.toBitVec.setWidth width.bits
+  let right := right.toBitVec.setWidth width.bits
+  match operation with
+  | .add => addFlags left right
+  | .sub => subFlags left right
+  | .and => resultFlags (left &&& right) false false
+  | .or => resultFlags (left ||| right) false false
+  | .xor => resultFlags (left ^^^ right) false false
+
+def mulFlags (width : MulWidth) (left right : Word) : Flags :=
+  let overflow := BitVec.smulOverflow
+    (left.toBitVec.setWidth width.width.bits) (right.toBitVec.setWidth width.width.bits)
+  { carry := some overflow, overflow := some overflow }
+
+def operand (source : Decode.Operand) (core : Core) : Word :=
+  match source with
+  | .reg register => core.readReg register
+  | .imm value => value
+
+structure State where
+  core : Core
+  rip : Word
+  flags : Flags := {}
+
+inductive Fault where
+  | memory (fault : MemoryFault)
+  | decode (rip : Word)
+  | undefinedCondition (condition : Condition)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Arithmetic RIP addition wraps at 64 bits, as do effective addresses. -/
+def relative (next : Word) (displacement : Imm32) : Word := next + signExtend32 displacement
+
+def execute (decoded : Decode.Decoded) (state : State) : Except Fault State := do
+  let core := state.core
+  let next := state.rip + UInt64.ofNat decoded.length
+  match decoded.operation with
+  | .mov width destination source =>
+      return { state with core := core.writeReg width destination (operand source core), rip := next }
+  | .load width destination source =>
+      let core ← (core.loadReg? width destination (source.eval core)).mapError Fault.memory
+      return { state with core, rip := next }
+  | .store width destination source =>
+      let core ← (core.storeReg? width (destination.eval core) source).mapError Fault.memory
+      return { state with core, rip := next }
+  | .lea destination source =>
+      return { state with core := core.setReg destination (source.eval core), rip := next }
+  | .alu operation width destination source =>
+      let left := core.readReg destination
+      let right := operand source core
+      return {
+        core := core.writeReg width destination (operation.eval left right)
+        rip := next, flags := aluFlags operation width left right }
+  | .imul width destination source =>
+      let left := core.readReg destination
+      let right := core.readReg source
+      return {
+        core := core.writeReg width.width destination (left * right)
+        rip := next, flags := mulFlags width left right }
+  | .compare width left right =>
+      return { state with
+        rip := next
+        flags := aluFlags .sub width (core.readReg left) (operand right core) }
+  | .push source =>
+      let stack := core.readReg .rsp - 8
+      let memory ← (core.memory.write64? stack (core.readReg source)).mapError Fault.memory
+      return { state with core := { core.setReg .rsp stack with memory }, rip := next }
+  | .pop destination =>
+      let stack := core.readReg .rsp
+      let value ← (core.memory.read64? stack).mapError Fault.memory
+      return { state with core := (core.setReg .rsp (stack + 8)).setReg destination value, rip := next }
+  | .call displacement =>
+      let stack := core.readReg .rsp - 8
+      let memory ← (core.memory.write64? stack next).mapError Fault.memory
+      return { state with core := { core.setReg .rsp stack with memory }, rip := relative next displacement }
+  | .jump displacement => return { state with rip := relative next displacement }
+  | .branch condition displacement =>
+      match state.flags.test condition with
+      | none => .error (.undefinedCondition condition)
+      | some take => return { state with rip := if take then relative next displacement else next }
+  | .ret =>
+      let stack := core.readReg .rsp
+      let target ← (core.memory.read64? stack).mapError Fault.memory
+      return { state with core := core.setReg .rsp (stack + 8), rip := target }
+
+def step (text : ByteArray) (textBase : Word) (state : State) : Except Fault State :=
+  match Decode.decodeAt text (state.rip - textBase).toNat with
+  | none => .error (.decode state.rip)
+  | some decoded => execute decoded state
+
+def run (text : ByteArray) (textBase : Word) : Nat → State → Except Fault State
+  | 0, state => .ok state
+  | fuel + 1, state => do
+      let next ← step text textBase state
+      run text textBase fuel next
+
+end Ix.Compiler.X86.ByteEval
diff --git a/Ix/Compiler/X86/ByteExamples.lean b/Ix/Compiler/X86/ByteExamples.lean
new file mode 100644
index 000000000..154260fe1
--- /dev/null
+++ b/Ix/Compiler/X86/ByteExamples.lean
@@ -0,0 +1,45 @@
+import Ix.Compiler.X86.ByteBranch
+import Ix.Compiler.X86.ByteCall
+
+/-! Small kernel-evaluated checks of independently specified bytes and effects.
+The compiled gate supplies the larger matrix and complete native text runs. -/
+
+namespace Ix.Compiler.X86.ByteExamples
+
+open Encode (bytes)
+
+-- REX changes byte-register code six to SIL, preserving RSI's upper bits.
+#guard (ByteEval.step (bytes [0x40, 0xb6, 0x12]) 0x1000
+  ⟨(Core.empty 0x8008).setReg .rsi 0x1234567890abcdef, 0x1000, {}⟩).toOption.map
+    (fun state => (state.core.readReg .rsi, state.rip)) == some (0x1234567890abcd12, 0x1003)
+
+-- A 32-bit register move clears the destination's upper half.
+#guard (ByteEval.step (bytes [0x45, 0x89, 0xd1]) 0
+  ⟨((Core.empty 0).setReg .r9 0xffffffffffffffff).setReg .r10 0x9876543280000000, 0, {}⟩).toOption.map
+    (fun state => state.core.readReg .r9) == some 0x80000000
+
+-- R12 is a valid extended SIB index; code four without REX.X means no index.
+#guard Decode.one [0x4e, 0x8d, 0x8c, 0xe5, 0xff, 0xff, 0xff, 0xff] ==
+  some (.lea .r9 { base := some .rbp, index := some .r12, scale := .eight, displacement := 0xffffffff }, [])
+#guard Decode.one [0x4c, 0x8d, 0x0c, 0x25, 0xff, 0xff, 0xff, 0xff] ==
+  some (.lea .r9 { displacement := 0xffffffff }, [])
+
+-- The sign of the subtraction result alone gives the wrong signed answer.
+#guard (ByteEval.aluFlags .sub .w64 0x8000000000000000 1).overflow == some true
+#guard (ByteEval.aluFlags .sub .w64 0x8000000000000000 1).sign == some false
+#guard (ByteEval.aluFlags .sub .w64 0x8000000000000000 1).test .signedLt == some true
+
+-- imm32 is signed at width 64; POP RSP installs the popped value last.
+#guard (ByteEval.step (bytes [0x48, 0x81, 0xc0, 0xff, 0xff, 0xff, 0xff]) 0
+  ⟨(Core.empty 0).setReg .rax 0, 0, {}⟩).toOption.map (fun state => state.core.readReg .rax) ==
+    some 0xffffffffffffffff
+#guard (ByteEval.step (bytes [0x5c]) 0
+  ⟨{ (Core.empty 0x8008) with memory := Memory.flat.write64 0x8008 0x9000 }, 0, {}⟩).toOption.map
+    (fun state => state.core.readReg .rsp) == some 0x9000
+
+#guard Decode.one [0x48, 0xb8, 1, 2, 3] == none
+#guard Decode.one [0x88, 0xe0] == none
+#guard (ByteEval.mulFlags .w64 0x7fffffffffffffff 2).zero == none
+#guard (ByteEval.mulFlags .w64 0x7fffffffffffffff 2).overflow == some true
+
+end Ix.Compiler.X86.ByteExamples
diff --git a/Ix/Compiler/X86/ByteFlags.lean b/Ix/Compiler/X86/ByteFlags.lean
new file mode 100644
index 000000000..173aa6324
--- /dev/null
+++ b/Ix/Compiler/X86/ByteFlags.lean
@@ -0,0 +1,71 @@
+import Ix.Compiler.X86.ByteEval
+import Ix.Compiler.X86.EncodeWord
+
+/-! Comparison flags agree with all ten emitted typed conditions. -/
+
+namespace Ix.Compiler.X86.ByteEval
+
+theorem sub_zero (left right : BitVec bits) : (left - right == 0) = (left == right) := by
+  simp [Bool.beq_eq_decide_eq, BitVec.sub_eq_iff_eq_add]
+
+theorem sub_signed_less (left right : BitVec bits) :
+    ((left - right).msb ^^ BitVec.ssubOverflow left right) = decide (left.toInt < right.toInt) := by
+  by_cases under : left.toInt - right.toInt < -2 ^ (bits - 1)
+  · have wrap := BitVec.toInt_sub_toInt_lt_twoPow_iff.mp under
+    simp [BitVec.msb_eq_toInt, BitVec.toInt_sub, BitVec.ssubOverflow, under,
+      show ¬(left.toInt - right.toInt).bmod (2 ^ bits) < 0 by omega,
+      show left.toInt < right.toInt by omega]
+  · by_cases over : 2 ^ (bits - 1) ≤ left.toInt - right.toInt
+    · have wrap := BitVec.twoPow_le_toInt_sub_toInt_iff.mp over
+      simp [BitVec.msb_eq_toInt, BitVec.toInt_sub, BitVec.ssubOverflow, under, over,
+        wrap.2.2, show ¬left.toInt < right.toInt by omega]
+    · have clean : ¬BitVec.ssubOverflow left right := by
+        simp [BitVec.ssubOverflow, under, over]
+      rw [BitVec.msb_eq_toInt, BitVec.toInt_sub_of_not_ssubOverflow clean]
+      simp [BitVec.ssubOverflow, under, over]
+      omega
+
+def conditionBits (condition : Condition) (left right : BitVec bits) : Bool :=
+  match condition with
+  | .eq => left == right
+  | .ne => left != right
+  | .unsignedLt => decide (left.toNat < right.toNat)
+  | .unsignedLe => decide (left.toNat ≤ right.toNat)
+  | .unsignedGt => decide (right.toNat < left.toNat)
+  | .unsignedGe => decide (right.toNat ≤ left.toNat)
+  | .signedLt => decide (left.toInt < right.toInt)
+  | .signedLe => decide (left.toInt ≤ right.toInt)
+  | .signedGt => decide (right.toInt < left.toInt)
+  | .signedGe => decide (right.toInt ≤ left.toInt)
+
+theorem sub_test (condition : Condition) (left right : BitVec bits) :
+    (subFlags left right).test condition = some (conditionBits condition left right) := by
+  cases condition <;>
+    simp only [Flags.test, subFlags, resultFlags, conditionBits, sub_zero, sub_signed_less,
+      BitVec.usubOverflow, bind, Option.bind, pure, Option.map_some, Option.some.injEq]
+  all_goals
+    apply Bool.eq_iff_iff.mpr
+    first
+    | solve | simp [← BitVec.toNat_inj, bne] <;> omega
+    | solve | simp [← BitVec.toInt_inj] <;> omega
+
+theorem signedValue_bits (width : Width) (value : Word) :
+    width.signedValue value = (value.toBitVec.setWidth width.bits).toInt := by
+  cases width <;>
+    simp [Width.signedValue, Encode.truncate_nat, BitVec.toInt_eq_toNat_cond,
+      BitVec.toNat_setWidth, Width.bits] <;>
+    split <;> split <;> omega
+
+theorem condition_agrees (condition : Condition) (width : Width) (left right : Word) :
+    conditionBits condition (left.toBitVec.setWidth width.bits) (right.toBitVec.setWidth width.bits) =
+      condition.holds width left right := by
+  cases condition <;>
+    simp [conditionBits, Condition.holds, signedValue_bits, UInt64.lt_iff_toNat_lt,
+      UInt64.le_iff_toNat_le, Encode.truncate_nat, BitVec.toNat_setWidth,
+      Bool.beq_eq_decide_eq, ← UInt64.toNat_inj, ← BitVec.toNat_inj, bne]
+
+theorem compare_flags (condition : Condition) (width : Width) (left right : Word) :
+    (aluFlags .sub width left right).test condition = some (condition.holds width left right) := by
+  rw [aluFlags, sub_test, condition_agrees]
+
+end Ix.Compiler.X86.ByteEval
diff --git a/Ix/Compiler/X86/Decode.lean b/Ix/Compiler/X86/Decode.lean
new file mode 100644
index 000000000..2f3ed5708
--- /dev/null
+++ b/Ix/Compiler/X86/Decode.lean
@@ -0,0 +1,266 @@
+import Ix.Compiler.X86.Basic
+
+/-! Independent decoding of the emitted x86-64 forms. The parser reads actual
+opcode, REX, ModRM, SIB, displacement, and immediate fields. It imports neither
+the encoder nor the typed evaluator. Unsupported or truncated forms reject.
+Typed pseudo-operations decode to their ordinary machine instructions. -/
+
+namespace Ix.Compiler.X86.Decode
+
+inductive Operand where
+  | reg (register : GPR)
+  | imm (value : Word)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Operation where
+  | mov (width : Width) (destination : GPR) (source : Operand)
+  | load (width : Width) (destination : GPR) (source : MemAddr)
+  | store (width : Width) (destination : MemAddr) (source : GPR)
+  | lea (destination : GPR) (source : MemAddr)
+  | alu (operation : AluOp) (width : Width) (destination : GPR) (source : Operand)
+  | imul (width : MulWidth) (destination source : GPR)
+  | compare (width : Width) (left : GPR) (right : Operand)
+  | push (source : GPR)
+  | pop (destination : GPR)
+  | call (displacement : Imm32)
+  | jump (displacement : Imm32)
+  | branch (condition : Condition) (displacement : Imm32)
+  | ret
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def register (extended : Bool) : Nat → Option GPR
+  | 0 => some (if extended then .r8 else .rax)
+  | 1 => some (if extended then .r9 else .rcx)
+  | 2 => some (if extended then .r10 else .rdx)
+  | 3 => some (if extended then .r11 else .rbx)
+  | 4 => some (if extended then .r12 else .rsp)
+  | 5 => some (if extended then .r13 else .rbp)
+  | 6 => some (if extended then .r14 else .rsi)
+  | 7 => some (if extended then .r15 else .rdi)
+  | _ => none
+
+def asIndex : GPR → Option IndexReg
+  | .rax => some .rax | .rcx => some .rcx | .rdx => some .rdx
+  | .rbx => some .rbx | .rsp => none | .rbp => some .rbp
+  | .rsi => some .rsi | .rdi => some .rdi
+  | .r8 => some .r8 | .r9 => some .r9 | .r10 => some .r10 | .r11 => some .r11
+  | .r12 => some .r12 | .r13 => some .r13 | .r14 => some .r14 | .r15 => some .r15
+
+def index (extended : Bool) (low : Nat) : Option (Option IndexReg) :=
+  if low == 4 && !extended then some none else do
+    let register ← register extended low
+    let index ← asIndex register
+    return some index
+
+def scale : Nat → Option Scale
+  | 0 => some .one | 1 => some .two | 2 => some .four | 3 => some .eight
+  | _ => none
+
+def readLE : Nat → List UInt8 → Option (Word × List UInt8)
+  | 0, input => some (0, input)
+  | _ + 1, [] => none
+  | count + 1, head :: tail => do
+      let (value, rest) ← readLE count tail
+      return (head.toUInt64 ||| (value <<< 8), rest)
+
+structure Prefix where
+  operand16 : Bool
+  w : Bool
+  r : Bool
+  x : Bool
+  b : Bool
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def rex (operand16 : Bool) (byte : UInt8) : Option Prefix :=
+  if 0x40 ≤ byte.toNat && byte.toNat < 0x50 then
+    some {
+      operand16, w := byte.toNat / 8 % 2 == 1
+      r := byte.toNat / 4 % 2 == 1, x := byte.toNat / 2 % 2 == 1, b := byte.toNat % 2 == 1 }
+  else none
+
+def Prefix.wide (pref : Prefix) : Option Width :=
+  if pref.w then if pref.operand16 then none else some .w64
+  else some (if pref.operand16 then .w16 else .w32)
+
+def Prefix.width (pref : Prefix) (byte : Bool) : Option Width :=
+  if byte then if pref.operand16 || pref.w then none else some .w8
+  else pref.wide
+
+def Prefix.mulWidth (pref : Prefix) : Option MulWidth := do
+  match ← pref.wide with
+  | .w16 => some .w16 | .w32 => some .w32 | .w64 => some .w64 | .w8 => none
+
+def modMode (byte : UInt8) : Nat := byte.toNat / 64
+def modReg (byte : UInt8) : Nat := byte.toNat / 8 % 8
+def modRM (byte : UInt8) : Nat := byte.toNat % 8
+
+def memory (pref : Prefix) (modrm : UInt8) (input : List UInt8) :
+    Option (MemAddr × List UInt8) := do
+  let mode := modMode modrm
+  let rm := modRM modrm
+  if rm == 4 then
+    let sib :: tail := input | none
+    let index ← index pref.x (modReg sib)
+    let scale ← scale (modMode sib)
+    let base ← if mode == 0 && modRM sib == 5 && !pref.b then some none
+      else if mode == 2 then (register pref.b (modRM sib)).map some
+      else none
+    let (displacement, rest) ← readLE 4 tail
+    return ({
+      base, index, scale := if index.isSome then scale else .one
+      displacement := displacement.toUInt32 }, rest)
+  else
+    if mode != 2 || pref.x then none else do
+      let base ← register pref.b rm
+      let (displacement, rest) ← readLE 4 input
+      return ({ base := some base, displacement := displacement.toUInt32 }, rest)
+
+def registers (pref : Prefix) (modrm : UInt8) : Option (GPR × GPR) := do
+  if modMode modrm != 3 || pref.x then none else do
+    let reg ← register pref.r (modReg modrm)
+    let rm ← register pref.b (modRM modrm)
+    return (reg, rm)
+
+def memoryOperation (pref : Prefix) (make : GPR → MemAddr → Operation)
+    (input : List UInt8) : Option (Operation × List UInt8) := do
+  let modrm :: input := input | none
+  let register ← register pref.r (modReg modrm)
+  let (address, rest) ← memory pref modrm input
+  return (make register address, rest)
+
+def immediateBytes : Width → Nat
+  | .w8 => 1 | .w16 => 2 | .w32 => 4 | .w64 => 8
+
+def sign32 (value : Word) : Word :=
+  if value < 0x80000000 then value else value ||| 0xffffffff00000000
+
+def groupImmediate (width : Width) (input : List UInt8) : Option (Word × List UInt8) := do
+  let (value, rest) ← readLE (if width == .w64 then 4 else immediateBytes width) input
+  return (if width == .w64 then sign32 value else value, rest)
+
+def aluRegisterOpcode : UInt8 → Option (AluOp × Bool)
+  | 0x00 => some (.add, true) | 0x01 => some (.add, false)
+  | 0x08 => some (.or, true) | 0x09 => some (.or, false)
+  | 0x20 => some (.and, true) | 0x21 => some (.and, false)
+  | 0x28 => some (.sub, true) | 0x29 => some (.sub, false)
+  | 0x30 => some (.xor, true) | 0x31 => some (.xor, false)
+  | _ => none
+
+def aluGroup : Nat → Option AluOp
+  | 0 => some .add | 1 => some .or | 4 => some .and | 5 => some .sub | 6 => some .xor
+  | _ => none
+
+def nearCondition : UInt8 → Option Condition
+  | 0x84 => some .eq | 0x85 => some .ne
+  | 0x82 => some .unsignedLt | 0x86 => some .unsignedLe
+  | 0x87 => some .unsignedGt | 0x83 => some .unsignedGe
+  | 0x8c => some .signedLt | 0x8e => some .signedLe
+  | 0x8f => some .signedGt | 0x8d => some .signedGe
+  | _ => none
+
+def prefixed (pref : Prefix) (input : List UInt8) : Option (Operation × List UInt8) := do
+  let opcode :: input := input | none
+  if 0xb0 ≤ opcode.toNat && opcode.toNat < 0xc0 then
+    if pref.r || pref.x then none else do
+      let narrow := opcode.toNat < 0xb8
+      let width ← pref.width narrow
+      let destination ← register pref.b (opcode.toNat % 8)
+      let (value, rest) ← readLE (immediateBytes width) input
+      return (.mov width destination (.imm value), rest)
+  else do
+    let opcode2 :: input := input | none
+    if opcode == 0x0f then
+      let modrm :: input := input | none
+      if opcode2 == 0xaf then
+        let width ← pref.mulWidth
+        let (destination, source) ← registers pref modrm
+        return (.imul width destination source, input)
+      else if (opcode2 == 0xb6 || opcode2 == 0xb7) && pref.w && !pref.operand16 then
+        memoryOperation pref (.load (if opcode2 == 0xb6 then .w8 else .w16)) (modrm :: input)
+      else none
+    else
+      let modrm := opcode2
+      if opcode == 0x88 || opcode == 0x89 then
+        let width ← pref.width (opcode == 0x88)
+        if modMode modrm == 3 then
+          let (source, destination) ← registers pref modrm
+          return (.mov width destination (.reg source), input)
+        else
+          memoryOperation pref (fun source address => .store width address source) (modrm :: input)
+      else if opcode == 0x8b || opcode == 0x8d then
+        if pref.operand16 then none else do
+          if opcode == 0x8d then
+            if pref.w then memoryOperation pref .lea (modrm :: input) else none
+          else memoryOperation pref (.load (if pref.w then .w64 else .w32)) (modrm :: input)
+      else if opcode == 0x80 || opcode == 0x81 then
+        if pref.r then none else do
+          let width ← pref.width (opcode == 0x80)
+          let (_, destination) ← registers pref modrm
+          let (value, rest) ← groupImmediate width input
+          if modReg modrm == 7 then some (.compare width destination (.imm value), rest)
+          else do
+            let operation ← aluGroup (modReg modrm)
+            return (.alu operation width destination (.imm value), rest)
+      else if opcode == 0x38 || opcode == 0x39 then
+        let width ← pref.width (opcode == 0x38)
+        let (right, left) ← registers pref modrm
+        return (.compare width left (.reg right), input)
+      else
+        let (operation, narrow) ← aluRegisterOpcode opcode
+        let width ← pref.width narrow
+        let (source, destination) ← registers pref modrm
+        return (.alu operation width destination (.reg source), input)
+
+def stack (extended : Bool) (opcode : UInt8) (rest : List UInt8) : Option (Operation × List UInt8) := do
+  let register ← register extended (opcode.toNat % 8)
+  if 0x50 ≤ opcode.toNat && opcode.toNat < 0x58 then some (.push register, rest)
+  else if 0x58 ≤ opcode.toNat && opcode.toNat < 0x60 then some (.pop register, rest)
+  else none
+
+def one : List UInt8 → Option (Operation × List UInt8)
+  | [] => none
+  | 0xc3 :: rest => some (.ret, rest)
+  | 0xe8 :: rest => do
+      let (displacement, rest) ← readLE 4 rest
+      return (.call displacement.toUInt32, rest)
+  | 0xe9 :: rest => do
+      let (displacement, rest) ← readLE 4 rest
+      return (.jump displacement.toUInt32, rest)
+  | 0x0f :: opcode :: rest => do
+      let condition ← nearCondition opcode
+      let (displacement, rest) ← readLE 4 rest
+      return (.branch condition displacement.toUInt32, rest)
+  | 0x66 :: pref :: rest => do
+      let pref ← rex true pref
+      prefixed pref rest
+  | head :: tail =>
+      if head == 0x41 then
+        match tail with
+        | opcode :: rest =>
+            if 0x50 ≤ opcode.toNat && opcode.toNat < 0x60 then stack true opcode rest
+            else do let pref ← rex false head; prefixed pref tail
+        | [] => none
+      else if 0x50 ≤ head.toNat && head.toNat < 0x60 then stack false head tail
+      else do let pref ← rex false head; prefixed pref tail
+
+/-- Decode an explicitly bounded instruction recipe, preserving its suffix. -/
+def sequence : Nat → List UInt8 → Option (List Operation × List UInt8)
+  | 0, input => some ([], input)
+  | count + 1, input => do
+      let (operation, rest) ← one input
+      let (operations, rest) ← sequence count rest
+      return (operation :: operations, rest)
+
+structure Decoded where
+  operation : Operation
+  length : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def decodeAt (text : ByteArray) (offset : Nat) : Option Decoded := do
+  if offset ≥ text.size then none else do
+    let input := text.data.toList.drop offset
+    let (operation, rest) ← one input
+    let length := input.length - rest.length
+    if 0 < length && length ≤ 15 then some ⟨operation, length⟩ else none
+
+end Ix.Compiler.X86.Decode
diff --git a/Ix/Compiler/X86/ELF.lean b/Ix/Compiler/X86/ELF.lean
new file mode 100644
index 000000000..5fb3f50c7
--- /dev/null
+++ b/Ix/Compiler/X86/ELF.lean
@@ -0,0 +1,301 @@
+import Ix.Compiler.X86.Encode
+import Ix.Compiler.Ixon.Address
+
+/-!
+# Minimal ELF64 relocatable-object writer
+
+The writer packages one encoded x86-64 text world, its named runtime PC32
+relocations, one exported entry symbol, and a mandatory Compilatr.ix
+provenance note.  It emits no program headers, dynamic-linking metadata, debug
+surface, or arbitrary sections.
+
+Like the E0 instruction encoder, this executable writer is not yet connected
+to a kernel-checked ELF parser/linker theorem.  `readelf`, `objdump`, and a
+native link/run fixture provide independent staging evidence.
+-/
+
+namespace Ix.Compiler.X86.ELF
+
+open Ix.Compiler.X86
+open Ix.Compiler.X86.Encode
+open Ix.Compiler.Ixon
+
+def zeros (count : Nat) : ByteArray :=
+  ByteArray.mk (Array.replicate count 0)
+
+def naturalBytes (count value : Nat) : ByteArray :=
+  littleEndian count (UInt64.ofNat value)
+
+def u16 (value : Nat) : ByteArray := naturalBytes 2 value
+def u32 (value : Nat) : ByteArray := naturalBytes 4 value
+def u64 (value : Nat) : ByteArray := naturalBytes 8 value
+def word64 (value : UInt64) : ByteArray := littleEndian 8 value
+
+def alignUp (value alignment : Nat) : Nat :=
+  if alignment == 0 then value
+  else ((value + alignment - 1) / alignment) * alignment
+
+def padTo (input : ByteArray) (size : Nat) : ByteArray :=
+  input ++ zeros (size - input.size)
+
+def padAlignment (input : ByteArray) (alignment : Nat) : ByteArray :=
+  padTo input (alignUp input.size alignment)
+
+inductive RootKind where
+  /-- IxIR₁ root plus deterministic lowering/pass policy versions. -/
+  | ixir1Policy
+  /-- Canonically serialized IxIR₂ root, once that codec exists. -/
+  | ixir2
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def RootKind.tag : RootKind → UInt8
+  | .ixir1Policy => 0
+  | .ixir2 => 1
+
+/-- Mandatory object provenance. An IxIR₁ root must carry the policy fields
+that prevent it from silently identifying different deterministic IxIR₂
+lowerings. A directly addressed IxIR₂ root has no such extraneous fields. -/
+inductive Provenance where
+  | ixir1Policy (root : Address) (loweringVersion passPolicyVersion : UInt32)
+  | ixir2 (root : Address)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Provenance.kind : Provenance → RootKind
+  | .ixir1Policy .. => .ixir1Policy
+  | .ixir2 .. => .ixir2
+
+def Provenance.root : Provenance → Address
+  | .ixir1Policy root .. => root
+  | .ixir2 root => root
+
+def provenanceDomain : ByteArray :=
+  "compilatrix/x86-object-provenance/1".toUTF8 ++ byte 0
+
+def Provenance.bytes : Provenance → ByteArray
+  | .ixir1Policy root loweringVersion passPolicyVersion =>
+      provenanceDomain ++ byte RootKind.ixir1Policy.tag ++ root.hash ++
+        imm32Bytes loweringVersion ++ imm32Bytes passPolicyVersion
+  | .ixir2 root =>
+      provenanceDomain ++ byte RootKind.ixir2.tag ++ root.hash
+
+def noteName : ByteArray := "COMPILATRIX".toUTF8 ++ byte 0
+
+def provenanceNote (provenance : Provenance) : ByteArray :=
+  let description := provenance.bytes
+  u32 noteName.size ++ u32 description.size ++ u32 0x43495801 ++
+    padAlignment noteName 4 ++ padAlignment description 4
+
+structure Input where
+  encoded : Encode.Output
+  entryBlock : BlockId
+  exportName : String := "compilatrix_main"
+  provenance : Provenance
+
+inductive Error where
+  | invalidExportName
+  | missingEntryBlock (block : BlockId)
+  | invalidEntryOffset (offset textSize : Nat)
+  | invalidRelocation (offset textSize : Nat)
+  | invalidRelocationAddend (offset : Nat) (addend : Int)
+  | duplicateSymbol (name : String)
+  | missingString (name : String)
+  | missingSymbol (name : String)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def validName (name : String) : Bool :=
+  !name.isEmpty && !(name.toUTF8.data.contains 0)
+
+structure StringTable where
+  bytes : ByteArray
+  offsets : List (String × Nat)
+
+def buildStringTable (names : List String) : StringTable := Id.run do
+  let mut output := byte 0
+  let mut offsets := []
+  for name in names do
+    offsets := offsets ++ [(name, output.size)]
+    output := output ++ name.toUTF8 ++ byte 0
+  return { bytes := output, offsets }
+
+def StringTable.offset? (table : StringTable) (name : String) : Option Nat :=
+  (table.offsets.find? fun entry => entry.1 == name).map (fun entry => entry.2)
+
+def symbol (name info sectionIndex : Nat) (value size : UInt64) : ByteArray :=
+  u32 name ++ byte (UInt8.ofNat info) ++ byte 0 ++ u16 sectionIndex ++
+    word64 value ++ word64 size
+
+def nullSymbol : ByteArray := zeros 24
+
+def textSectionSymbol : ByteArray :=
+  symbol 0 0x03 1 0 0
+
+def functionSymbol (name : Nat) (value size : UInt64) : ByteArray :=
+  symbol name 0x12 1 value size
+
+def undefinedFunctionSymbol (name : Nat) : ByteArray :=
+  symbol name 0x12 0 0 0
+
+private def runtimeSymbols (encoded : Encode.Output) : List String :=
+  (encoded.relocations.toList.map (fun relocation => relocation.symbol)).eraseDups
+
+private def listIndex? [BEq α] (target : α) : List α → Option Nat
+  | [] => none
+  | value :: values =>
+      if value == target then some 0
+      else (listIndex? target values).map (fun index => index + 1)
+
+def relocationInfo (symbolIndex relocationType : Nat) : UInt64 :=
+  (UInt64.ofNat symbolIndex <<< 32) ||| UInt64.ofNat relocationType
+
+def relocationEntry (offset symbolIndex : Nat) (addend : Int) : ByteArray :=
+  u64 offset ++ word64 (relocationInfo symbolIndex 2) ++
+    word64 (Int64.ofInt addend).toUInt64
+
+private def relocationBytes (encoded : Encode.Output)
+    (symbols : List String) : Except Error ByteArray := do
+  let mut output := ByteArray.empty
+  for relocation in encoded.relocations do
+    if encoded.text.size < relocation.offset + 4 then
+      throw (.invalidRelocation relocation.offset encoded.text.size)
+    if relocation.addend != -4 then
+      throw (.invalidRelocationAddend relocation.offset relocation.addend)
+    let some index := listIndex? relocation.symbol symbols
+      | throw (.missingSymbol relocation.symbol)
+    -- null, .text section, exported entry, then undefined runtime symbols
+    output := output ++ relocationEntry relocation.offset (3 + index)
+      relocation.addend
+  return output
+
+private def symbolBytes (encoded : Encode.Output) (entryOffset : Nat)
+    (exportName : String) (symbols : List String)
+    (strings : StringTable) : Except Error ByteArray := do
+  let some exportOffset := strings.offset? exportName
+    | throw (.missingString exportName)
+  let mut output := nullSymbol ++ textSectionSymbol ++
+    functionSymbol exportOffset (UInt64.ofNat entryOffset)
+      (UInt64.ofNat (encoded.text.size - entryOffset))
+  for name in symbols do
+    let some nameOffset := strings.offset? name
+      | throw (.missingString name)
+    output := output ++ undefinedFunctionSymbol nameOffset
+  return output
+
+structure SectionHeader where
+  name : Nat := 0
+  sectionType : Nat := 0
+  flags : UInt64 := 0
+  offset : Nat := 0
+  size : Nat := 0
+  link : Nat := 0
+  info : Nat := 0
+  alignment : Nat := 0
+  entrySize : Nat := 0
+
+def SectionHeader.bytes (header : SectionHeader) : ByteArray :=
+  u32 header.name ++ u32 header.sectionType ++ word64 header.flags ++ word64 0 ++
+    u64 header.offset ++ u64 header.size ++ u32 header.link ++
+    u32 header.info ++ u64 header.alignment ++ u64 header.entrySize
+
+def nullSectionHeader : ByteArray := zeros 64
+
+def elfHeader (sectionHeadersOffset sectionCount sectionNamesIndex : Nat) :
+    ByteArray :=
+  -- ELF magic, 64-bit class, little endian, current version, System V ABI.
+  bytes [0x7f, 0x45, 0x4c, 0x46, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0] ++
+    u16 1 ++              -- ET_REL
+    u16 62 ++             -- EM_X86_64
+    u32 1 ++              -- EV_CURRENT
+    u64 0 ++              -- no entry address in a relocatable object
+    u64 0 ++              -- no program-header table
+    u64 sectionHeadersOffset ++
+    u32 0 ++              -- architecture flags
+    u16 64 ++             -- ELF header size
+    u16 0 ++ u16 0 ++     -- no program headers
+    u16 64 ++ u16 sectionCount ++ u16 sectionNamesIndex
+
+private def sectionNames : List String :=
+  [".text", ".rela.text", ".note.compilatrix", ".symtab", ".strtab",
+    ".note.GNU-stack", ".shstrtab"]
+
+private def requireOffset (table : StringTable) (name : String) :
+    Except Error Nat :=
+  match table.offset? name with
+  | some offset => .ok offset
+  | none => .error (.missingString name)
+
+/-- Emit one ELF64 little-endian x86-64 relocatable object. -/
+def write (input : Input) : Except Error ByteArray := do
+  if !validName input.exportName then
+    throw .invalidExportName
+  let some entryOffset := input.encoded.blockOffsets[input.entryBlock.toNat]?
+    | throw (.missingEntryBlock input.entryBlock)
+  if input.encoded.text.size ≤ entryOffset then
+    throw (.invalidEntryOffset entryOffset input.encoded.text.size)
+  let symbols := runtimeSymbols input.encoded
+  if !(symbols.all validName) then
+    throw .invalidExportName
+  if symbols.contains input.exportName then
+    throw (.duplicateSymbol input.exportName)
+  let strings := buildStringTable (input.exportName :: symbols)
+  let symbolTable ← symbolBytes input.encoded entryOffset input.exportName
+    symbols strings
+  let relocations ← relocationBytes input.encoded symbols
+  let note := provenanceNote input.provenance
+  let sectionStrings := buildStringTable sectionNames
+
+  let textOffset := alignUp 64 16
+  let relocationOffset := alignUp (textOffset + input.encoded.text.size) 8
+  let noteOffset := alignUp (relocationOffset + relocations.size) 4
+  let symbolOffset := alignUp (noteOffset + note.size) 8
+  let stringOffset := symbolOffset + symbolTable.size
+  let sectionStringOffset := stringOffset + strings.bytes.size
+  let sectionHeadersOffset := alignUp
+    (sectionStringOffset + sectionStrings.bytes.size) 8
+
+  let textName ← requireOffset sectionStrings ".text"
+  let relocationName ← requireOffset sectionStrings ".rela.text"
+  let noteSectionName ← requireOffset sectionStrings ".note.compilatrix"
+  let symbolName ← requireOffset sectionStrings ".symtab"
+  let stringName ← requireOffset sectionStrings ".strtab"
+  let stackNoteName ← requireOffset sectionStrings ".note.GNU-stack"
+  let sectionStringName ← requireOffset sectionStrings ".shstrtab"
+
+  let headers := nullSectionHeader ++
+    (SectionHeader.bytes
+      { name := textName, sectionType := 1, flags := 0x6
+        offset := textOffset, size := input.encoded.text.size
+        alignment := 16 }) ++
+    (SectionHeader.bytes
+      { name := relocationName, sectionType := 4
+        offset := relocationOffset, size := relocations.size
+        link := 4, info := 1, alignment := 8, entrySize := 24 }) ++
+    (SectionHeader.bytes
+      { name := noteSectionName, sectionType := 7
+        offset := noteOffset, size := note.size, alignment := 4 }) ++
+    (SectionHeader.bytes
+      { name := symbolName, sectionType := 2
+        offset := symbolOffset, size := symbolTable.size
+        link := 5, info := 2, alignment := 8, entrySize := 24 }) ++
+    (SectionHeader.bytes
+      { name := stringName, sectionType := 3
+        offset := stringOffset, size := strings.bytes.size, alignment := 1 }) ++
+    -- Empty and flag-free: tell ELF linkers that this object does not require
+    -- an executable process stack.
+    (SectionHeader.bytes
+      { name := stackNoteName, sectionType := 1
+        offset := sectionStringOffset, size := 0, alignment := 1 }) ++
+    (SectionHeader.bytes
+      { name := sectionStringName, sectionType := 3
+        offset := sectionStringOffset, size := sectionStrings.bytes.size,
+        alignment := 1 })
+
+  let output := elfHeader sectionHeadersOffset 8 7
+  let output := (padTo output textOffset) ++ input.encoded.text
+  let output := (padTo output relocationOffset) ++ relocations
+  let output := (padTo output noteOffset) ++ note
+  let output := (padTo output symbolOffset) ++ symbolTable
+  let output := (padTo output stringOffset) ++ strings.bytes
+  let output := (padTo output sectionStringOffset) ++ sectionStrings.bytes
+  return (padTo output sectionHeadersOffset) ++ headers
+
+end Ix.Compiler.X86.ELF
diff --git a/Ix/Compiler/X86/ELFExamples.lean b/Ix/Compiler/X86/ELFExamples.lean
new file mode 100644
index 000000000..4fe40a19b
--- /dev/null
+++ b/Ix/Compiler/X86/ELFExamples.lean
@@ -0,0 +1,156 @@
+import Ix.Compiler.X86.ELF
+import Ix.Compiler.X86.EncodeExamples
+
+/-!
+Executable checks for the minimal ELF64 relocatable-object writer.  These
+checks cover the writer's internal layout; the native fixture and external
+binutils check independently parse, disassemble, link, and execute its output.
+-/
+
+namespace Ix.Compiler.X86.ELF.Examples
+
+open Ix.Compiler.X86
+open Ix.Compiler.X86.Encode
+open Ix.Compiler.X86.ELF
+open Ix.Compiler.Ixon
+
+def fixtureProvenance : Provenance :=
+  .ixir1Policy (Address.replicate 0x42) 1 1
+
+#guard (Provenance.bytes fixtureProvenance).size ==
+  provenanceDomain.size + 1 + 32 + 8
+
+#guard (Provenance.bytes (.ixir2 (Address.replicate 0x42))).size ==
+  provenanceDomain.size + 1 + 32
+
+def encodeObject (program : Program) : Except String (Encode.Output × ByteArray) := do
+  let encoded ← Encode.Program.encode program |>.mapError reprStr
+  let object ← ELF.write
+    { encoded
+      entryBlock := program.entry
+      provenance := fixtureProvenance } |>.mapError reprStr
+  return (encoded, object)
+
+def readNatural (input : ByteArray) (offset count : Nat) : Nat :=
+  (List.range count).foldl (fun value index =>
+    value + (input.get! (offset + index)).toNat * 2 ^ (8 * index)) 0
+
+def containsBytes (input needle : ByteArray) : Bool :=
+  (List.range (input.size + 1)).any fun offset =>
+    input.extract offset (offset + needle.size) == needle
+
+def arithmeticObjectAccepted : Bool :=
+  match encodeObject Ix.Compiler.X86.Examples.arithmeticProgram with
+  | .error _ => false
+  | .ok (encoded, object) =>
+      let sectionHeadersOffset := readNatural object 40 8
+      let textHeader := sectionHeadersOffset + 64
+      let textOffset := readNatural object (textHeader + 24) 8
+      let textSize := readNatural object (textHeader + 32) 8
+      object.extract 0 4 == ByteArray.mk #[0x7f, 0x45, 0x4c, 0x46] &&
+        readNatural object 16 2 == 1 &&
+        readNatural object 18 2 == 62 &&
+        readNatural object 52 2 == 64 &&
+        readNatural object 58 2 == 64 &&
+        readNatural object 60 2 == 8 &&
+        readNatural object 62 2 == 7 &&
+        object.size == sectionHeadersOffset + 8 * 64 &&
+        textSize == encoded.text.size &&
+        object.extract textOffset (textOffset + textSize) == encoded.text &&
+        containsBytes object ".note.compilatrix".toUTF8 &&
+        containsBytes object ".note.GNU-stack".toUTF8 &&
+        containsBytes object "compilatrix_main".toUTF8 &&
+        containsBytes object (Provenance.bytes fixtureProvenance)
+
+#guard arithmeticObjectAccepted
+
+def runtimeRelocationAccepted : Bool :=
+  match encodeObject Ix.Compiler.X86.Examples.runtimeProgram with
+  | .error _ => false
+  | .ok (_, object) =>
+      let sectionHeadersOffset := readNatural object 40 8
+      let relocationHeader := sectionHeadersOffset + 2 * 64
+      let relocationOffset := readNatural object (relocationHeader + 24) 8
+      let relocationSize := readNatural object (relocationHeader + 32) 8
+      relocationSize == 24 &&
+        object.extract relocationOffset (relocationOffset + 24) ==
+          (u64 22 ++ word64 (relocationInfo 3 2) ++
+            word64 (Int64.ofInt (-4)).toUInt64) &&
+        containsBytes object "compilatrix_rt_allocate".toUTF8
+
+#guard runtimeRelocationAccepted
+
+def invalidEntryRejected : Bool :=
+  match Encode.Program.encode Ix.Compiler.X86.Examples.arithmeticProgram with
+  | .error _ => false
+  | .ok encoded =>
+      match ELF.write
+          { encoded
+            entryBlock := 99
+            provenance := fixtureProvenance } with
+      | .error (.missingEntryBlock 99) => true
+      | _ => false
+
+#guard invalidEntryRejected
+
+def invalidEntryOffsetRejected : Bool :=
+  match Encode.Program.encode Ix.Compiler.X86.Examples.arithmeticProgram with
+  | .error _ => false
+  | .ok encoded =>
+      let invalid :=
+        { encoded with blockOffsets := #[encoded.text.size] }
+      match ELF.write
+          { encoded := invalid
+            entryBlock := 0
+            provenance := fixtureProvenance } with
+      | .error (.invalidEntryOffset offset size) =>
+          offset == encoded.text.size && size == encoded.text.size
+      | _ => false
+
+#guard invalidEntryOffsetRejected
+
+def invalidExportRejected : Bool :=
+  match Encode.Program.encode Ix.Compiler.X86.Examples.arithmeticProgram with
+  | .error _ => false
+  | .ok encoded =>
+      match ELF.write
+          { encoded
+            entryBlock := 0
+            exportName := ""
+            provenance := fixtureProvenance } with
+      | .error .invalidExportName => true
+      | _ => false
+
+#guard invalidExportRejected
+
+def invalidRelocationAddendRejected : Bool :=
+  match Encode.Program.encode Ix.Compiler.X86.Examples.runtimeProgram with
+  | .error _ => false
+  | .ok encoded =>
+      let invalid :=
+        { encoded with relocations := encoded.relocations.map fun relocation =>
+            { relocation with addend := 0 } }
+      match ELF.write
+          { encoded := invalid
+            entryBlock := 0
+            provenance := fixtureProvenance } with
+      | .error (.invalidRelocationAddend 22 0) => true
+      | _ => false
+
+#guard invalidRelocationAddendRejected
+
+def duplicateSymbolRejected : Bool :=
+  match Encode.Program.encode Ix.Compiler.X86.Examples.runtimeProgram with
+  | .error _ => false
+  | .ok encoded =>
+      match ELF.write
+          { encoded
+            entryBlock := 0
+            exportName := "compilatrix_rt_allocate"
+            provenance := fixtureProvenance } with
+      | .error (.duplicateSymbol "compilatrix_rt_allocate") => true
+      | _ => false
+
+#guard duplicateSymbolRejected
+
+end Ix.Compiler.X86.ELF.Examples
diff --git a/Ix/Compiler/X86/ELFLink.lean b/Ix/Compiler/X86/ELFLink.lean
new file mode 100644
index 000000000..92a3fe633
--- /dev/null
+++ b/Ix/Compiler/X86/ELFLink.lean
@@ -0,0 +1,167 @@
+import Ix.Compiler.X86.ELFValidate
+
+/-! PC32 relocation application and complete-text revalidation. Symbols are
+mathematical positions relative to the text base, so negative positions are
+allowed. The system linker/loader remains responsible for realizing these
+positions and mapping the immutable executable text. -/
+
+namespace Ix.Compiler.X86.ELFLink
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+abbrev Symbols := String → Option Int
+
+def pc32 (symbol addend : Int) (position : Nat) : Int := symbol + addend - position
+
+theorem pc32_absolute (base symbol addend : Int) (position : Nat) :
+    (base + symbol) + addend - (base + position) = pc32 symbol addend position := by
+  unfold pc32
+  omega
+
+theorem pc32_call (symbol : Int) (instructionOffset : Nat) :
+    pc32 symbol (-4) (instructionOffset + 1) = symbol - (instructionOffset + 5 : Nat) := by
+  unfold pc32
+  omega
+
+/-- A concrete trace of the actual four-byte patcher, using ELF's S+A-P
+rule and rejecting signed overflow. Surrounding-byte preservation follows
+from the existing `Encode.patchSigned32_splice` law at each application. -/
+inductive Applied (symbols : Symbols) : List ELFRead.Relocation → ByteArray → ByteArray → Prop where
+  | nil (text : ByteArray) : Applied symbols [] text text
+  | cons {relocation : ELFRead.Relocation} {rest : List ELFRead.Relocation} {before middle after : ByteArray}
+      (name : String) (nameBytes : name.toUTF8 = relocation.symbolName) (target : Int)
+      (resolved : symbols name = some target) (kind : relocation.relocationType = 2)
+      (fits : Encode.fitsSigned32 (pc32 target relocation.addend relocation.offset) = true)
+      (patched : Encode.patchSigned32 before relocation.offset (pc32 target relocation.addend relocation.offset) = .ok middle)
+      (remaining : Applied symbols rest middle after) : Applied symbols (relocation :: rest) before after
+
+structure Application (symbols : Symbols) (relocations : List ELFRead.Relocation) (before : ByteArray) where
+  text : ByteArray
+  applied : Applied symbols relocations before text
+
+inductive Error where
+  | invalidSymbolEncoding
+  | missingSymbol (name : String)
+  | unsupportedRelocation (kind : Nat)
+  | overflow (offset : Nat) (value : Int)
+  | patch (error : Encode.Error)
+  | invalidObject
+  | invalidLinkedStream
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def symbolName (bytes : ByteArray) : Option String := String.fromUTF8? bytes
+
+/-- UTF-8 decoding is checked by round trip before its name is used for
+resolution. Thus no malformed byte string can alias a replacement character. -/
+def apply (symbols : Symbols) (relocations : List ELFRead.Relocation) (before : ByteArray) :
+    Except Error (Application symbols relocations before) :=
+  match relocations with
+  | [] => .ok ⟨before, .nil before⟩
+  | relocation :: rest => do
+      let some name := symbolName relocation.symbolName | throw .invalidSymbolEncoding
+      if nameBytes : name.toUTF8 = relocation.symbolName then
+        if kind : relocation.relocationType = 2 then
+          match resolved : symbols name with
+          | none => throw (.missingSymbol name)
+          | some target =>
+              let value := pc32 target relocation.addend relocation.offset
+              if fits : Encode.fitsSigned32 value = true then
+                match patched : Encode.patchSigned32 before relocation.offset value with
+                | .error error => throw (.patch error)
+                | .ok middle =>
+                    let after ← apply symbols rest middle
+                    return ⟨after.text, .cons name nameBytes target resolved kind fits patched after.applied⟩
+              else throw (.overflow relocation.offset value)
+        else throw (.unsupportedRelocation relocation.relocationType)
+      else throw .invalidSymbolEncoding
+
+def targets (symbols : Symbols) : Stream.ExternalTargets := fun intrinsic => symbols (Encode.intrinsicSymbol intrinsic)
+
+theorem _root_.Ix.Compiler.X86.ELF.Valid.fields_of_parse {input : ELF.Input} {bytes : ByteArray}
+    (valid : ELF.Valid input bytes) {view : ELFRead.View} (parsed : ELFRead.parse bytes = some view) :
+    ELF.Fields input bytes view := by
+  obtain ⟨original, originalParse, fields⟩ := valid
+  rw [parsed] at originalParse
+  cases Option.some.inj originalParse
+  exact fields
+
+structure Linked (checked : Checked) (input : ELF.Input) (bytes : ByteArray) (symbols : Symbols) where
+  view : ELFRead.View
+  parsed : ELFRead.parse bytes = some view
+  fields : ELF.Fields input bytes view
+  output : Encode.Output
+  valid : Stream.Valid checked.program output (targets symbols)
+  applied : Applied symbols view.relocations.toList input.encoded.text output.text
+
+def resolve (checked : Checked) (input : ELF.Input) (object : ELF.Certified input) (symbols : Symbols) :
+    Except Error (Linked checked input object.bytes symbols) := do
+  match parsed : ELFRead.parse object.bytes with
+  | none => throw .invalidObject
+  | some view =>
+      let linked ← apply symbols view.relocations.toList input.encoded.text
+      let output := { input.encoded with text := linked.text }
+      if accepted : Stream.check checked.program output (targets symbols) = true then
+        return ⟨view, parsed, object.valid.fields_of_parse parsed, output, Stream.check_sound accepted, linked.applied⟩
+      else throw .invalidLinkedStream
+
+theorem Applied.resolves {symbols : Symbols} {relocations : List ELFRead.Relocation} {before after : ByteArray}
+    (applied : Applied symbols relocations before after) :
+    ∀ relocation ∈ relocations, ∃ name target, name.toUTF8 = relocation.symbolName ∧ symbols name = some target := by
+  induction applied with
+  | nil => simp
+  | cons name nameBytes target resolved kind fits patched remaining ih =>
+      intro relocation member
+      rcases List.mem_cons.mp member with equal | member
+      · subst relocation
+        exact ⟨name, target, nameBytes, resolved⟩
+      · exact ih relocation member
+
+def address (base : Word) (relative : Int) : Word := base + ⟨BitVec.ofInt 64 relative⟩
+
+theorem external_resolves (base : Word) (next : Nat) (target : Int)
+    (fits : Encode.fitsSigned32 (target - next) = true) :
+    ByteEval.relative (base + UInt64.ofNat next) (Stream.externalDisplacement next target) = address base target := by
+  apply UInt64.toBitVec_inj.mp
+  simp only [ByteEval.relative, Stream.externalDisplacement, UInt64.toBitVec_add,
+    UInt64.toBitVec_ofNat', Encode.signExtend32_ofInt _ fits]
+  change (base.toBitVec + BitVec.ofInt 64 (next : Int)) + BitVec.ofInt 64 (target - next) =
+    base.toBitVec + BitVec.ofInt 64 target
+  rw [BitVec.add_assoc, ← BitVec.ofInt_add]
+  congr 2
+  omega
+
+/-- A resolved runtime CALL transfers to the named external address and
+stores the actual continuation RIP. Execution of that external procedure
+still requires the separately ledgered runtime-body/ABI contract. -/
+theorem runtime_call_transfer {checked : Checked} {output : Encode.Output} {symbols : Symbols}
+    (valid : Stream.Valid checked.program output (targets symbols)) (base : Word) (state : ByteEval.State) (pc : PC)
+    (atPC : Stream.AtPC checked.program base pc state.rip) {block : Block} {intrinsic : Intrinsic} {target : Int}
+    (found : checked.program.blocks[pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[pc.offset.toNat]? = some (.callRuntime intrinsic))
+    (resolved : symbols (Encode.intrinsicSymbol intrinsic) = some target) :
+    ByteEval.step output.text base state =
+      match state.core.memory.write64? (state.core.readReg .rsp - 8) (state.rip + 5) with
+      | .error fault => .error (.memory fault)
+      | .ok memory => .ok {
+          core := { state.core.setReg .rsp (state.core.readReg .rsp - 8) with memory }
+          rip := address base target, flags := state.flags } := by
+  have accepted := valid.instruction _ _ found _ _ foundInstruction
+  simp only [Stream.instructionMatches, targets, resolved, Bool.and_eq_true, Stream.decodes, beq_iff_eq] at accepted
+  have indexBound := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+  have rip := atPC.offset found (by omega)
+  have mapped : Stream.pcOffset? checked.program pc =
+      some (Stream.blockOffset checked.program pc.block.toNat + Stream.instructionOffset block pc.offset.toNat) := by
+    simp [Stream.pcOffset?, found, show pc.offset.toNat ≤ block.instructions.size by omega]
+  rw [Stream.step_decoded rip (Stream.AtPC.small valid.textBound mapped) accepted.2]
+  have nextAddress : state.rip + 5 = base + UInt64.ofNat
+      (Stream.blockOffset checked.program pc.block.toNat + Stream.instructionOffset block pc.offset.toNat + 5) := by
+    simp [rip, UInt64.ofNat_add, UInt64.add_assoc]
+  have resolves := external_resolves base _ target accepted.1
+  have effect : ByteEval.relative (state.rip + 5)
+      (Stream.externalDisplacement (Stream.blockOffset checked.program pc.block.toNat + Stream.instructionOffset block pc.offset.toNat + 5) target) =
+      address base target := by rw [nextAddress]; exact resolves
+  simp only [ByteEval.execute]
+  cases state.core.memory.write64? (state.core.readReg .rsp - 8) (state.rip + 5) <;>
+    simp [Except.mapError, effect]
+
+end Ix.Compiler.X86.ELFLink
diff --git a/Ix/Compiler/X86/ELFRead.lean b/Ix/Compiler/X86/ELFRead.lean
new file mode 100644
index 000000000..a694eef24
--- /dev/null
+++ b/Ix/Compiler/X86/ELFRead.lean
@@ -0,0 +1,213 @@
+import Ix.Compiler.X86.Basic
+import Init.Data.ByteArray.Lemmas
+
+/-! Independent reader for the emitted ELF64 relocatable-object subset.
+Unsigned fields are mathematical naturals; truncated or out-of-file reads
+fail. This module imports neither the encoder nor the ELF writer. The note
+reader implements the four-byte Linux/GNU note convention declared by the
+section's alignment, rather than silently assuming generic ELF64 alignment.
+
+Field layouts: System V gABI chapters 2--6; x86-64 psABI section 4.4.
+GNU note convention: binutils commit 82ed9683ec099d8205dc499ac84febc975235af6.
+-/
+
+namespace Ix.Compiler.X86.ELFRead
+
+instance byteArrayLawfulBEq : LawfulBEq ByteArray where
+  eq_of_beq := by
+    intro left right equal
+    exact ByteArray.ext (eq_of_beq equal)
+  rfl := by
+    intro bytes
+    change (bytes.data == bytes.data) = true
+    simp
+
+instance byteArrayRepr : Repr ByteArray where
+  reprPrec bytes precedence := reprPrec bytes.data precedence
+
+def require (condition : Bool) : Option Unit := if condition then some () else none
+
+def natural (bytes : ByteArray) (offset : Nat) : Nat → Option Nat
+  | 0 => some 0
+  | count + 1 => do
+      let lower ← natural bytes offset count
+      let byte ← bytes[offset + count]?
+      return lower + byte.toNat * 256 ^ count
+
+def slice (bytes : ByteArray) (offset size : Nat) : Option ByteArray :=
+  if offset + size ≤ bytes.size then some (bytes.extract offset (offset + size)) else none
+
+private def stringBytes (bytes : ByteArray) (offset : Nat) : Nat → Option (List UInt8)
+  | 0 => none
+  | fuel + 1 => do
+      let byte ← bytes[offset]?
+      if byte == 0 then return []
+      else return byte :: (← stringBytes bytes (offset + 1) fuel)
+
+def cstring (bytes : ByteArray) (offset : Nat) : Option ByteArray := do
+  return ⟨(← stringBytes bytes offset bytes.size).toArray⟩
+
+structure Header where
+  ident : ByteArray
+  objectType : Nat
+  machine : Nat
+  version : Nat
+  entry : Nat
+  programOffset : Nat
+  sectionOffset : Nat
+  flags : Nat
+  headerSize : Nat
+  programEntrySize : Nat
+  programCount : Nat
+  sectionEntrySize : Nat
+  sectionCount : Nat
+  sectionNames : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def header (bytes : ByteArray) : Option Header := do
+  return ⟨← slice bytes 0 16, ← natural bytes 16 2, ← natural bytes 18 2,
+    ← natural bytes 20 4, ← natural bytes 24 8, ← natural bytes 32 8,
+    ← natural bytes 40 8, ← natural bytes 48 4, ← natural bytes 52 2,
+    ← natural bytes 54 2, ← natural bytes 56 2, ← natural bytes 58 2,
+    ← natural bytes 60 2, ← natural bytes 62 2⟩
+
+structure SectionHeader where
+  nameOffset : Nat
+  sectionType : Nat
+  flags : Nat
+  address : Nat
+  offset : Nat
+  size : Nat
+  link : Nat
+  info : Nat
+  alignment : Nat
+  entrySize : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def sectionHeader (bytes : ByteArray) (offset : Nat) : Option SectionHeader := do
+  return ⟨← natural bytes offset 4, ← natural bytes (offset + 4) 4,
+    ← natural bytes (offset + 8) 8, ← natural bytes (offset + 16) 8,
+    ← natural bytes (offset + 24) 8, ← natural bytes (offset + 32) 8,
+    ← natural bytes (offset + 40) 4, ← natural bytes (offset + 44) 4,
+    ← natural bytes (offset + 48) 8, ← natural bytes (offset + 56) 8⟩
+
+structure Section where
+  header : SectionHeader
+  name : ByteArray
+  data : ByteArray
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Symbol where
+  nameOffset : Nat
+  name : ByteArray
+  info : Nat
+  other : Nat
+  sectionIndex : Nat
+  value : Nat
+  size : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def symbol (bytes strings : ByteArray) (offset : Nat) : Option Symbol := do
+  let nameOffset ← natural bytes offset 4
+  return ⟨nameOffset, ← cstring strings nameOffset, ← natural bytes (offset + 4) 1,
+    ← natural bytes (offset + 5) 1, ← natural bytes (offset + 6) 2,
+    ← natural bytes (offset + 8) 8, ← natural bytes (offset + 16) 8⟩
+
+structure Relocation where
+  offset : Nat
+  symbolIndex : Nat
+  symbolName : ByteArray
+  relocationType : Nat
+  addend : Int
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def signed64 (natural : Nat) : Int :=
+  if natural < 2 ^ 63 then natural else (natural : Int) - 2 ^ 64
+
+def relocation (bytes : ByteArray) (symbols : Array Symbol) (offset : Nat) : Option Relocation := do
+  let position ← natural bytes offset 8
+  let info ← natural bytes (offset + 8) 8
+  let symbolIndex := info / 2 ^ 32
+  let target ← symbols[symbolIndex]?
+  return ⟨position, symbolIndex, target.name, info % 2 ^ 32, signed64 (← natural bytes (offset + 16) 8)⟩
+
+def aligned4 (size : Nat) : Nat := ((size + 3) / 4) * 4
+
+structure Note where
+  name : ByteArray
+  noteType : Nat
+  descriptor : ByteArray
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def note (bytes : ByteArray) : Option Note := do
+  let nameSize ← natural bytes 0 4
+  let descriptorSize ← natural bytes 4 4
+  let noteType ← natural bytes 8 4
+  let name ← slice bytes 12 nameSize
+  let descriptor ← slice bytes (12 + aligned4 nameSize) descriptorSize
+  require (12 + aligned4 nameSize + aligned4 descriptorSize == bytes.size)
+  let namePadding ← slice bytes (12 + nameSize) (aligned4 nameSize - nameSize)
+  let descriptorPadding ← slice bytes (12 + aligned4 nameSize + descriptorSize) (aligned4 descriptorSize - descriptorSize)
+  require (namePadding.data.all (· == 0) && descriptorPadding.data.all (· == 0))
+  return ⟨name, noteType, descriptor⟩
+
+inductive Provenance where
+  | ixir1Policy (root : ByteArray) (lowering passPolicy : Nat)
+  | ixir2 (root : ByteArray)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Parse the domain, kind, fixed-size root and policy words individually. -/
+def provenance (bytes : ByteArray) : Option Provenance := do
+  let domain := "compilatrix/x86-object-provenance/1".toUTF8
+  require ((← slice bytes 0 domain.size) == domain)
+  require ((← natural bytes domain.size 1) == 0)
+  let kind ← natural bytes (domain.size + 1) 1
+  let root ← slice bytes (domain.size + 2) 32
+  if kind == 0 then
+    require (bytes.size == domain.size + 42)
+    return .ixir1Policy root (← natural bytes (domain.size + 34) 4) (← natural bytes (domain.size + 38) 4)
+  else if kind == 1 then
+    require (bytes.size == domain.size + 34)
+    return .ixir2 root
+  else none
+
+structure View where
+  header : Header
+  sections : Array Section
+  text : ByteArray
+  symbols : Array Symbol
+  relocations : Array Relocation
+  note : Note
+  provenance : Provenance
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Fixed section count and table sizes are checked before allocating or
+iterating. Other semantic obligations are stated by the object validator. -/
+def parse (bytes : ByteArray) : Option View := do
+  let header ← header bytes
+  require (header.sectionCount == 8 && header.sectionEntrySize == 64 && header.sectionNames == 7)
+  require (decide (header.sectionOffset + 8 * 64 ≤ bytes.size))
+  let headers ← (List.range 8).mapM (fun index => sectionHeader bytes (header.sectionOffset + index * 64))
+  let headers := headers.toArray
+  let names ← headers[7]?
+  let strings ← slice bytes names.offset names.size
+  let sections ← headers.toList.mapM fun sectionInfo => do
+    return (⟨sectionInfo, ← cstring strings sectionInfo.nameOffset, ← slice bytes sectionInfo.offset sectionInfo.size⟩ : Section)
+  let sections := sections.toArray
+  let text ← sections[1]?
+  let symtab ← sections[4]?
+  let symbolStrings ← sections[symtab.header.link]?
+  require (symtab.data.size % 24 == 0)
+  let symbols ← (List.range (symtab.data.size / 24)).mapM (fun index => symbol symtab.data symbolStrings.data (index * 24))
+  let symbols := symbols.toArray
+  let rela ← sections[2]?
+  require (rela.data.size % 24 == 0)
+  let relocations ← (List.range (rela.data.size / 24)).mapM (fun index => relocation rela.data symbols (index * 24))
+  let noteSection ← sections[3]?
+  let note ← note noteSection.data
+  let provenance ← provenance note.descriptor
+  return ⟨header, sections, text.data, symbols, relocations.toArray, note, provenance⟩
+
+def text? (bytes : ByteArray) : Option ByteArray := (parse bytes).map View.text
+
+end Ix.Compiler.X86.ELFRead
diff --git a/Ix/Compiler/X86/ELFValidate.lean b/Ix/Compiler/X86/ELFValidate.lean
new file mode 100644
index 000000000..e98853145
--- /dev/null
+++ b/Ix/Compiler/X86/ELFValidate.lean
@@ -0,0 +1,184 @@
+import Ix.Compiler.X86.ELFRead
+import Ix.Compiler.X86.ELF
+import Ix.Compiler.X86.StreamTrace
+
+/-! Fail-closed validation of actual serialized objects against independent
+ELF interpretation. Successful emission certifies the text, exported entry,
+symbol/relocation inventory, provenance and concrete section-layout policy. -/
+
+namespace Ix.Compiler.X86.ELF
+
+def expectedHeader (sectionOffset : Nat) : ELFRead.Header :=
+  ⟨⟨#[0x7f, 0x45, 0x4c, 0x46, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0]⟩,
+    1, 62, 1, 0, 0, sectionOffset, 0, 64, 0, 0, 64, 8, 7⟩
+
+def sectionShape (index : Nat) (part : ELFRead.Section) : Bool :=
+  let h := part.header
+  let expected (name : String) (kind flags link info alignment entrySize : Nat) (size := h.size) :=
+    part.name == name.toUTF8 && h == (⟨h.nameOffset, kind, flags, 0, h.offset, size, link, info, alignment, entrySize⟩ : ELFRead.SectionHeader)
+  match index with
+  | 0 => part.name == ByteArray.empty && part.data == ByteArray.empty &&
+      h == (⟨0, 0, 0, 0, 0, 0, 0, 0, 0, 0⟩ : ELFRead.SectionHeader)
+  | 1 => expected ".text" 1 6 0 0 16 0
+  | 2 => expected ".rela.text" 4 0 4 1 8 24
+  | 3 => expected ".note.compilatrix" 7 0 0 0 4 0
+  | 4 => expected ".symtab" 2 0 5 2 8 24
+  | 5 => expected ".strtab" 3 0 0 0 1 0
+  | 6 => expected ".note.GNU-stack" 1 0 0 0 1 0 0
+  | 7 => expected ".shstrtab" 3 0 0 0 1 0
+  | _ => false
+
+def sectionLayout (bytes : ByteArray) (view : ELFRead.View) (index : Nat) : Bool :=
+  match view.sections[index]? with
+  | none => false
+  | some part =>
+      sectionShape index part && part.data.size == part.header.size &&
+      ELFRead.slice bytes part.header.offset part.header.size == some part.data &&
+      (index == 0 || (decide (64 ≤ part.header.offset) &&
+        decide (part.header.offset + part.header.size ≤ view.header.sectionOffset) &&
+        part.header.offset % part.header.alignment == 0)) &&
+      (index == 0 || index == 7 || match view.sections[index + 1]? with
+        | none => false
+        | some next => decide (part.header.offset + part.header.size ≤ next.header.offset))
+
+def layout (bytes : ByteArray) (view : ELFRead.View) : Bool :=
+  decide (bytes.size < UInt64.size) && view.header == expectedHeader view.header.sectionOffset &&
+    decide (64 ≤ view.header.sectionOffset) && view.header.sectionOffset % 8 == 0 &&
+    view.header.sectionOffset + 512 == bytes.size && view.sections.size == 8 &&
+    (List.range 8).all (sectionLayout bytes view) &&
+    ((view.sections[1]?).map ELFRead.Section.data == some view.text) &&
+    ((view.sections[4]?).map (fun part => part.data.size) == some (24 * view.symbols.size)) &&
+    ((view.sections[2]?).map (fun part => part.data.size) == some (24 * view.relocations.size)) &&
+    ((view.sections[5]?).map (fun part => part.data[0]? == some 0 && part.data[part.data.size - 1]? == some 0) == some true) &&
+    ((view.sections[7]?).map (fun part => part.data[0]? == some 0 && part.data[part.data.size - 1]? == some 0) == some true) &&
+    view.note.name == ("COMPILATRIX".toUTF8.push 0) && view.note.noteType == 0x43495801
+
+structure SymbolMeaning where
+  name : ByteArray
+  info : Nat
+  other : Nat
+  sectionIndex : Nat
+  value : Nat
+  size : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def symbolMeaning (symbol : ELFRead.Symbol) : SymbolMeaning :=
+  ⟨symbol.name, symbol.info, symbol.other, symbol.sectionIndex, symbol.value, symbol.size⟩
+
+def entryMeaning (input : Input) (entryOffset : Nat) : SymbolMeaning :=
+  ⟨input.exportName.toUTF8, 0x12, 0, 1, entryOffset, input.encoded.text.size - entryOffset⟩
+
+def expectedSymbols (input : Input) (entryOffset : Nat) : Array SymbolMeaning :=
+  (⟨ByteArray.empty, 0, 0, 0, 0, 0⟩ :: ⟨ByteArray.empty, 3, 0, 1, 0, 0⟩ :: entryMeaning input entryOffset ::
+    ((input.encoded.relocations.toList.map (·.symbol)).eraseDups.map fun name => ⟨name.toUTF8, 0x12, 0, 0, 0, 0⟩)).toArray
+
+structure RelocationMeaning where
+  offset : Nat
+  name : ByteArray
+  relocationType : Nat
+  addend : Int
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def relocationMeaning (relocation : ELFRead.Relocation) : RelocationMeaning :=
+  ⟨relocation.offset, relocation.symbolName, relocation.relocationType, relocation.addend⟩
+
+def expectedRelocations (input : Input) : Array RelocationMeaning :=
+  input.encoded.relocations.map fun relocation => ⟨relocation.offset, relocation.symbol.toUTF8, 2, relocation.addend⟩
+
+def relocationBounds (view : ELFRead.View) : Bool :=
+  view.relocations.all fun relocation =>
+    decide (relocation.offset + 4 ≤ view.text.size) && decide (3 ≤ relocation.symbolIndex) &&
+    relocation.addend == -4 &&
+    match view.symbols[relocation.symbolIndex]? with
+    | none => false
+    | some symbol => symbol.name == relocation.symbolName && symbol.sectionIndex == 0 && symbol.info == 0x12
+
+def expectedProvenance : Provenance → ELFRead.Provenance
+  | .ixir1Policy root lowering policy => .ixir1Policy root.hash lowering.toNat policy.toNat
+  | .ixir2 root => .ixir2 root.hash
+
+def checkView (input : Input) (bytes : ByteArray) (view : ELFRead.View) : Bool :=
+  match input.encoded.blockOffsets[input.entryBlock.toNat]?, view.symbols[2]? with
+  | some entryOffset, some entrySymbol =>
+      layout bytes view && validName input.exportName && decide (entryOffset < input.encoded.text.size) &&
+      view.text == input.encoded.text && symbolMeaning entrySymbol == entryMeaning input entryOffset &&
+      view.symbols.map symbolMeaning == expectedSymbols input entryOffset &&
+      view.relocations.map relocationMeaning == expectedRelocations input && relocationBounds view &&
+      view.provenance == expectedProvenance input.provenance
+  | _, _ => false
+
+structure Fields (input : Input) (bytes : ByteArray) (view : ELFRead.View) : Prop where
+  layout : layout bytes view = true
+  exportName : validName input.exportName = true
+  text : view.text = input.encoded.text
+  entry : ∃ offset symbol, input.encoded.blockOffsets[input.entryBlock.toNat]? = some offset ∧
+    offset < input.encoded.text.size ∧ view.symbols[2]? = some symbol ∧
+    symbolMeaning symbol = entryMeaning input offset ∧ view.symbols.map symbolMeaning = expectedSymbols input offset
+  relocations : view.relocations.map relocationMeaning = expectedRelocations input
+  relocationBounds : relocationBounds view = true
+  provenance : view.provenance = expectedProvenance input.provenance
+
+theorem checkView_sound {input : Input} {bytes : ByteArray} {view : ELFRead.View}
+    (accepted : checkView input bytes view = true) : Fields input bytes view := by
+  cases entry : input.encoded.blockOffsets[input.entryBlock.toNat]? with
+  | none => simp [checkView, entry] at accepted
+  | some offset =>
+      cases symbol : view.symbols[2]? with
+      | none => simp [checkView, entry, symbol] at accepted
+      | some symbolValue =>
+          simp only [checkView, entry, symbol, Bool.and_eq_true, decide_eq_true_eq, beq_iff_eq, and_assoc] at accepted
+          obtain ⟨shape, name, bound, text, meaning, symbols, relocations, relocationBounds, provenance⟩ := accepted
+          exact ⟨shape, name, text, ⟨offset, symbolValue, entry, bound, symbol, meaning, symbols⟩,
+            relocations, relocationBounds, provenance⟩
+
+def check (input : Input) (bytes : ByteArray) : Bool :=
+  match ELFRead.parse bytes with
+  | none => false
+  | some view => checkView input bytes view
+
+def Valid (input : Input) (bytes : ByteArray) : Prop :=
+  ∃ view, ELFRead.parse bytes = some view ∧ Fields input bytes view
+
+theorem check_sound {input : Input} {bytes : ByteArray} (accepted : check input bytes = true) : Valid input bytes := by
+  cases parsed : ELFRead.parse bytes with
+  | none => simp [check, parsed] at accepted
+  | some view => exact ⟨view, parsed, checkView_sound (by simpa [check, parsed] using accepted)⟩
+
+theorem Valid.text {input : Input} {bytes : ByteArray} (valid : Valid input bytes) :
+    ELFRead.text? bytes = some input.encoded.text := by
+  obtain ⟨view, parsed, fields⟩ := valid
+  simp [ELFRead.text?, parsed, fields.text]
+
+def entry? (bytes : ByteArray) (name : String) : Option Nat := do
+  let view ← ELFRead.parse bytes
+  let symbol ← view.symbols[2]?
+  ELFRead.require (symbol.name == name.toUTF8 && symbol.info == 0x12 && symbol.other == 0 && symbol.sectionIndex == 1)
+  return symbol.value
+
+theorem Valid.entry {input : Input} {bytes : ByteArray} (valid : Valid input bytes) :
+    entry? bytes input.exportName = input.encoded.blockOffsets[input.entryBlock.toNat]? := by
+  obtain ⟨view, parsed, fields⟩ := valid
+  obtain ⟨offset, symbol, found, _, atEntry, meaning, _⟩ := fields.entry
+  have name := congrArg SymbolMeaning.name meaning
+  have info := congrArg SymbolMeaning.info meaning
+  have other := congrArg SymbolMeaning.other meaning
+  have sectionIndex := congrArg SymbolMeaning.sectionIndex meaning
+  have value := congrArg SymbolMeaning.value meaning
+  simp only [symbolMeaning, entryMeaning] at name info other sectionIndex value
+  simp [entry?, parsed, atEntry, name, info, other, sectionIndex, value, ELFRead.require, found]
+
+structure Certified (input : Input) where
+  bytes : ByteArray
+  valid : Valid input bytes
+
+inductive CheckedError where
+  | writer (error : Error)
+  | invalidObject
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def writeChecked (input : Input) : Except CheckedError (Certified input) := do
+  let bytes ← (write input).mapError CheckedError.writer
+  if accepted : check input bytes = true then return ⟨bytes, check_sound accepted⟩
+  else throw .invalidObject
+
+end Ix.Compiler.X86.ELF
diff --git a/Ix/Compiler/X86/Encode.lean b/Ix/Compiler/X86/Encode.lean
new file mode 100644
index 000000000..eae1fc7e9
--- /dev/null
+++ b/Ix/Compiler/X86/Encode.lean
@@ -0,0 +1,419 @@
+import Ix.Compiler.X86.Basic
+
+/-!
+# Staged x86-64 v0 encoder
+
+This module is intentionally downstream of the typed target AST and has no
+dependency on IxIR₂ or instruction selection.  It emits fixed-shape encodings
+with rel32 placeholders, resolves block-local relocations after layout, and
+retains named runtime calls as explicit object-writer relocations.
+
+The E1 modules prove local per-form decode/execution agreement with the
+independent Decode/ByteEval model. Complete stream layout, symbolic-PC/byte-RIP
+correspondence and object relocation composition remain E2 obligations;
+agreement with an external ISA reference remains the separate S2 boundary.
+-/
+
+namespace Ix.Compiler.X86.Encode
+
+open Ix.Compiler.X86
+
+def bytes (values : List UInt8) : ByteArray :=
+  ByteArray.mk values.toArray
+
+def byte (value : UInt8) : ByteArray := bytes [value]
+
+def littleEndian (count : Nat) (value : Word) : ByteArray :=
+  ByteArray.mk <| (List.range count).toArray.map fun index =>
+    (value >>> UInt64.ofNat (8 * index)).toUInt8
+
+def imm32Bytes (value : Imm32) : ByteArray :=
+  littleEndian 4 value.toUInt64
+
+def signed32Bytes (value : Int) : ByteArray :=
+  imm32Bytes (Int32.ofInt value).toUInt32
+
+def gprCode : GPR → UInt8
+  | .rax => 0
+  | .rcx => 1
+  | .rdx => 2
+  | .rbx => 3
+  | .rsp => 4
+  | .rbp => 5
+  | .rsi => 6
+  | .rdi => 7
+  | .r8 => 8
+  | .r9 => 9
+  | .r10 => 10
+  | .r11 => 11
+  | .r12 => 12
+  | .r13 => 13
+  | .r14 => 14
+  | .r15 => 15
+
+def indexRegCode (register : IndexReg) : UInt8 :=
+  gprCode register.gpr
+
+def registerLow (code : UInt8) : Nat := code.toNat % 8
+def registerExtended (code : UInt8) : Bool := decide (8 ≤ code.toNat)
+
+def modRM (mode register rm : Nat) : UInt8 :=
+  UInt8.ofNat (mode * 64 + (register % 8) * 8 + rm % 8)
+
+def sib (scale index base : Nat) : UInt8 :=
+  UInt8.ofNat ((scale % 4) * 64 + (index % 8) * 8 + base % 8)
+
+def scaleBits : Scale → Nat
+  | .one => 0
+  | .two => 1
+  | .four => 2
+  | .eight => 3
+
+/-- Legacy operand-size prefix followed by an always-present REX prefix.
+Always emitting REX keeps byte-register selection structural (`spl`, `bpl`,
+`sil`, `dil` rather than the legacy high-byte registers). -/
+def prefixes (operand16 rexW rexR rexX rexB : Bool) : ByteArray :=
+  let legacy := if operand16 then byte 0x66 else ByteArray.empty
+  let rex : UInt8 := UInt8.ofNat <|
+    0x40 + (if rexW then 8 else 0) + (if rexR then 4 else 0) +
+      (if rexX then 2 else 0) + (if rexB then 1 else 0)
+  legacy ++ byte rex
+
+def widthPrefixes (width : Width) (rexR rexX rexB : Bool) : ByteArray :=
+  prefixes (width == .w16) (width == .w64) rexR rexX rexB
+
+structure MemoryTail where
+  rexX : Bool
+  rexB : Bool
+  bytes : ByteArray
+
+def memoryTail (regField : UInt8) (address : MemAddr) : MemoryTail :=
+  let displacement := imm32Bytes address.displacement
+  let regLow := registerLow regField
+  let indexCode := address.index.map indexRegCode
+  let indexLow := match indexCode with
+    | none => 4
+    | some code => registerLow code
+  let rexX := match indexCode with
+    | none => false
+    | some code => registerExtended code
+  match address.base with
+  | none =>
+      { rexX
+        rexB := false
+        bytes := bytes [modRM 0 regLow 4,
+          sib (scaleBits address.scale) indexLow 5] ++ displacement }
+  | some base =>
+      let baseCode := gprCode base
+      let baseLow := registerLow baseCode
+      let useSib := address.index.isSome || baseLow == 4
+      if useSib then
+        { rexX
+          rexB := registerExtended baseCode
+          bytes := bytes [modRM 2 regLow 4,
+            sib (scaleBits address.scale) indexLow baseLow] ++ displacement }
+      else
+        { rexX := false
+          rexB := registerExtended baseCode
+          bytes := byte (modRM 2 regLow baseLow) ++ displacement }
+
+def encodeMemory (operand16 rexW : Bool) (opcode : ByteArray)
+    (regField : UInt8) (address : MemAddr) : ByteArray :=
+  let tail := memoryTail regField address
+  prefixes operand16 rexW (registerExtended regField) tail.rexX tail.rexB ++
+    opcode ++ tail.bytes
+
+def encodeRegReg (width : Width) (opcode : UInt8)
+    (regField rm : GPR) : ByteArray :=
+  widthPrefixes width (registerExtended (gprCode regField)) false
+      (registerExtended (gprCode rm)) ++
+    bytes [opcode, modRM 3 (registerLow (gprCode regField))
+      (registerLow (gprCode rm))]
+
+def moveOpcode : Width → UInt8
+  | .w8 => 0x88
+  | .w16 | .w32 | .w64 => 0x89
+
+def aluOpcode (operation : AluOp) (width : Width) : UInt8 :=
+  let wide : UInt8 := match operation with
+    | .add => 0x01
+    | .or => 0x09
+    | .and => 0x21
+    | .sub => 0x29
+    | .xor => 0x31
+  if width == .w8 then wide - 1 else wide
+
+def aluExtension : AluOp → Nat
+  | .add => 0
+  | .or => 1
+  | .and => 4
+  | .sub => 5
+  | .xor => 6
+
+def immediateBytes (width : Width) (value : Word) : ByteArray :=
+  match width with
+  | .w8 => littleEndian 1 value
+  | .w16 => littleEndian 2 value
+  | .w32 => littleEndian 4 value
+  | .w64 => littleEndian 8 value
+
+def groupImmediateBytes (width : Width) (value : Imm32) : ByteArray :=
+  match width with
+  | .w8 => littleEndian 1 value.toUInt64
+  | .w16 => littleEndian 2 value.toUInt64
+  | .w32 | .w64 => imm32Bytes value
+
+def encodeMov (width : Width) (destination : GPR)
+    (source : MoveSource) : ByteArray :=
+  match source with
+  | .reg source => encodeRegReg width (moveOpcode width) source destination
+  | .imm value =>
+      widthPrefixes width false false (registerExtended (gprCode destination)) ++
+        byte (UInt8.ofNat (0xb8 + registerLow (gprCode destination) -
+          (if width == .w8 then 8 else 0))) ++
+        immediateBytes width value
+
+def encodeLoad (width : Width) (destination : GPR)
+    (source : MemAddr) : ByteArray :=
+  match width with
+  | .w8 => encodeMemory false true (bytes [0x0f, 0xb6])
+      (gprCode destination) source
+  | .w16 => encodeMemory false true (bytes [0x0f, 0xb7])
+      (gprCode destination) source
+  | .w32 => encodeMemory false false (byte 0x8b) (gprCode destination) source
+  | .w64 => encodeMemory false true (byte 0x8b) (gprCode destination) source
+
+def encodeStore (width : Width) (destination : MemAddr)
+    (source : GPR) : ByteArray :=
+  encodeMemory (width == .w16) (width == .w64)
+    (byte (if width == .w8 then 0x88 else 0x89)) (gprCode source) destination
+
+def encodeLea (destination : GPR) (source : MemAddr) : ByteArray :=
+  encodeMemory false true (byte 0x8d) (gprCode destination) source
+
+def encodeAlu (operation : AluOp) (width : Width) (destination : GPR)
+    (source : AluSource) : ByteArray :=
+  match source with
+  | .reg source =>
+      encodeRegReg width (aluOpcode operation width) source destination
+  | .imm value =>
+      widthPrefixes width false false
+          (registerExtended (gprCode destination)) ++
+        bytes [if width == .w8 then 0x80 else 0x81,
+          modRM 3 (aluExtension operation)
+            (registerLow (gprCode destination))] ++
+        groupImmediateBytes width value
+
+def encodeImul (width : MulWidth) (destination source : GPR) : ByteArray :=
+  encodeRegReg width.width 0xaf destination source |>
+    fun encoded =>
+      -- `encodeRegReg` accepts one opcode byte; insert the mandatory 0x0f
+      -- escape immediately before its final opcode/modRM pair.
+      let prefixSize := encoded.size - 2
+      encoded.extract 0 prefixSize ++ bytes [0x0f, 0xaf] ++
+        encoded.extract (prefixSize + 1) encoded.size
+
+def encodePush (source : GPR) : ByteArray :=
+  let rexPrefix := if registerExtended (gprCode source) then byte 0x41
+    else ByteArray.empty
+  rexPrefix ++ byte (UInt8.ofNat (0x50 + registerLow (gprCode source)))
+
+def encodePop (destination : GPR) : ByteArray :=
+  let rexPrefix := if registerExtended (gprCode destination) then byte 0x41
+    else ByteArray.empty
+  rexPrefix ++ byte (UInt8.ofNat (0x58 + registerLow (gprCode destination)))
+
+def frameBytes (subtract : Bool) (size : FrameSize) : ByteArray :=
+  bytes [0x48, 0x81, if subtract then 0xec else 0xc4] ++
+    littleEndian 4 size.bytes
+
+def spillAddress (slot : StackSlot) : MemAddr :=
+  { base := some .rbp
+    displacement := (0 - slot.displacement).toUInt32 }
+
+def encodeSpill (slot : StackSlot) (source : GPR) : ByteArray :=
+  encodeStore .w64 (spillAddress slot) source
+
+def encodeReload (destination : GPR) (slot : StackSlot) : ByteArray :=
+  encodeLoad .w64 destination (spillAddress slot)
+
+inductive FixupTarget where
+  | block (target : BlockId)
+  | intrinsic (target : Intrinsic)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Fixup where
+  offset : Nat
+  target : FixupTarget
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Chunk where
+  bytes : ByteArray
+  fixups : Array Fixup
+  deriving Inhabited
+
+def Chunk.empty : Chunk := { bytes := ByteArray.empty, fixups := #[] }
+
+def Chunk.raw (encoded : ByteArray) : Chunk :=
+  { bytes := encoded, fixups := #[] }
+
+def Chunk.append (left right : Chunk) : Chunk :=
+  { bytes := left.bytes ++ right.bytes
+    fixups := left.fixups ++ right.fixups.map fun fixup =>
+      { fixup with offset := left.bytes.size + fixup.offset } }
+
+def rel32 (opcode : ByteArray) (target : FixupTarget) : Chunk :=
+  { bytes := opcode ++ bytes [0, 0, 0, 0]
+    fixups := #[{ offset := opcode.size, target }] }
+
+def encodeInstr : Instr → Chunk
+  | .mov width destination source => .raw (encodeMov width destination source)
+  | .load width destination source => .raw (encodeLoad width destination source)
+  | .store width destination source => .raw (encodeStore width destination source)
+  | .lea destination source => .raw (encodeLea destination source)
+  | .alu operation width destination source =>
+      .raw (encodeAlu operation width destination source)
+  | .imul width destination source => .raw (encodeImul width destination source)
+  | .push source => .raw (encodePush source)
+  | .pop destination => .raw (encodePop destination)
+  | .allocFrame size => .raw (frameBytes true size)
+  | .freeFrame size => .raw (frameBytes false size)
+  | .spill slot source => .raw (encodeSpill slot source)
+  | .reload destination slot => .raw (encodeReload destination slot)
+  | .call target => rel32 (byte 0xe8) (.block target)
+  | .callRuntime intrinsic => rel32 (byte 0xe8) (.intrinsic intrinsic)
+
+def cmpOpcode : Width → UInt8
+  | .w8 => 0x38
+  | .w16 | .w32 | .w64 => 0x39
+
+def encodeCompare (comparison : Compare) : ByteArray :=
+  match comparison.right with
+  | .reg right =>
+      encodeRegReg comparison.width (cmpOpcode comparison.width)
+        right comparison.left
+  | .imm value =>
+      widthPrefixes comparison.width false false
+          (registerExtended (gprCode comparison.left)) ++
+        bytes [if comparison.width == .w8 then 0x80 else 0x81,
+          modRM 3 7 (registerLow (gprCode comparison.left))] ++
+        groupImmediateBytes comparison.width value
+
+def nearOpcode : Condition → UInt8
+  | .eq => 0x84
+  | .ne => 0x85
+  | .unsignedLt => 0x82
+  | .unsignedLe => 0x86
+  | .unsignedGt => 0x87
+  | .unsignedGe => 0x83
+  | .signedLt => 0x8c
+  | .signedLe => 0x8e
+  | .signedGt => 0x8f
+  | .signedGe => 0x8d
+
+def encodeTerminator : Terminator → Chunk
+  | .jump target => rel32 (byte 0xe9) (.block target)
+  | .branch comparison condition ifTrue ifFalse =>
+      (Chunk.raw (encodeCompare comparison)).append
+        ((rel32 (bytes [0x0f, nearOpcode condition]) (.block ifTrue)).append
+          (rel32 (byte 0xe9) (.block ifFalse)))
+  | .tailCall target => rel32 (byte 0xe9) (.block target)
+  | .ret => Chunk.raw (byte 0xc3)
+
+def encodeBlock (block : Block) : Chunk :=
+  let instructions := block.instructions.foldl
+    (fun output instruction => output.append (encodeInstr instruction))
+    Chunk.empty
+  instructions.append (encodeTerminator block.terminator)
+
+def intrinsicSymbol : Intrinsic → String
+  | .allocate => "compilatrix_rt_allocate"
+  | .reserve => "compilatrix_rt_reserve"
+  | .reuse => "compilatrix_rt_reuse"
+  | .releaseReservation => "compilatrix_rt_release_reservation"
+  | .retainShared => "compilatrix_rt_retain_shared"
+  | .releaseShared => "compilatrix_rt_release_shared"
+  | .memcpy => "compilatrix_rt_memcpy"
+  | .unsignedDiv => "compilatrix_rt_unsigned_div"
+
+structure Relocation where
+  offset : Nat
+  symbol : String
+  /-- ELF `R_X86_64_PC32` addend.  With P at the four-byte field, -4 makes
+  the resolved displacement relative to the following instruction. -/
+  addend : Int := -4
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Output where
+  text : ByteArray
+  blockOffsets : Array Nat
+  relocations : Array Relocation
+  deriving Inhabited
+
+inductive Error where
+  | malformedControl
+  | missingBlock (target : BlockId)
+  | displacementOutOfRange (source target : Nat)
+  | invalidPatch (offset size : Nat)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def fitsSigned32 (value : Int) : Bool :=
+  decide (-(2 ^ 31 : Int) ≤ value ∧ value < (2 ^ 31 : Int))
+
+def patchSigned32 (input : ByteArray) (offset : Nat) (value : Int) :
+    Except Error ByteArray :=
+  if offset + 4 ≤ input.size then
+    let patch := signed32Bytes value
+    .ok <| (List.range 4).foldl (fun output index =>
+      output.set! (offset + index) (patch.get! index)) input
+  else
+    .error (.invalidPatch offset input.size)
+
+private def layout (chunks : Array Chunk) : Array Nat := Id.run do
+  let mut offsets := #[]
+  let mut cursor := 0
+  for chunk in chunks do
+    offsets := offsets.push cursor
+    cursor := cursor + chunk.bytes.size
+  return offsets
+
+private def concatenate (chunks : Array Chunk) : ByteArray :=
+  chunks.foldl (fun output chunk => output ++ chunk.bytes) ByteArray.empty
+
+private def locatedFixups (chunks : Array Chunk)
+    (offsets : Array Nat) : Array Fixup := Id.run do
+  let mut output := #[]
+  for index in List.range chunks.size do
+    let base := offsets[index]!
+    for fixup in chunks[index]!.fixups do
+      output := output.push { fixup with offset := base + fixup.offset }
+  return output
+
+def encode (checked : Checked) : Except Error Output := do
+  let chunks := checked.program.blocks.map encodeBlock
+  let offsets := layout chunks
+  let mut text := concatenate chunks
+  let mut relocations := #[]
+  for fixup in locatedFixups chunks offsets do
+    match fixup.target with
+    | .intrinsic intrinsic =>
+        relocations := relocations.push
+          { offset := fixup.offset, symbol := intrinsicSymbol intrinsic }
+    | .block target =>
+        let some targetOffset := offsets[target.toNat]?
+          | throw (.missingBlock target)
+        let afterPatch := fixup.offset + 4
+        let displacement := Int.ofNat targetOffset - Int.ofNat afterPatch
+        if fitsSigned32 displacement then
+          text ← patchSigned32 text fixup.offset displacement
+        else
+          throw (Error.displacementOutOfRange afterPatch targetOffset)
+  return { text, blockOffsets := offsets, relocations }
+
+def Program.encode (program : Program) : Except Error Output := do
+  let checked ← match program.check with
+    | .ok checked => pure checked
+    | .error _ => throw .malformedControl
+  Ix.Compiler.X86.Encode.encode checked
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeBytes.lean b/Ix/Compiler/X86/EncodeBytes.lean
new file mode 100644
index 000000000..b0d0b2934
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeBytes.lean
@@ -0,0 +1,114 @@
+import Ix.Compiler.X86.Encode
+import Ix.Compiler.X86.Decode
+import Ix.Compiler.X86.Memory
+
+/-! Kernel-checked byte-field laws for the actual encoder. -/
+
+namespace Ix.Compiler.X86.Encode
+
+@[simp] theorem bytes_list (values : List UInt8) : (bytes values).data.toList = values := by
+  simp [bytes]
+
+theorem littleEndian_list (count : Nat) (value : Word) :
+    (littleEndian count value).data.toList =
+      (List.range count).map (fun index => (value >>> UInt64.ofNat (8 * index)).toUInt8) := by
+  simp [littleEndian]
+
+theorem packByte (value : Word) : value.toUInt8.toUInt64 = Width.w8.truncate value := by
+  apply UInt64.toBitVec_inj.mp
+  simp only [Width.truncate, UInt64.toBitVec_and, UInt64.toBitVec_toUInt8,
+    UInt8.toBitVec_toUInt64]
+  change (value.toBitVec.setWidth 8).setWidth 64 =
+    value.toBitVec &&& (BitVec.allOnes 8).setWidth 64
+  apply BitVec.eq_of_getLsbD_eq
+  intro index bound
+  simp only [BitVec.getLsbD_setWidth, BitVec.getLsbD_and, BitVec.getLsbD_allOnes,
+    decide_eq_true bound, Bool.true_and, Bool.and_comm]
+
+theorem mask_bits (width : Width) :
+    width.mask.toBitVec = (BitVec.allOnes width.bits).setWidth 64 := by
+  cases width <;> rfl
+
+theorem read_immediate (width : Width) (value : Word) (rest : List UInt8) :
+    Decode.readLE (Decode.immediateBytes width) ((immediateBytes width value).data.toList ++ rest) =
+      some (width.truncate value, rest) := by
+  cases width <;>
+    simp [immediateBytes, Decode.immediateBytes, littleEndian_list, List.range_succ,
+      Decode.readLE, Width.truncate, -UInt64.toUInt64_toUInt8]
+  all_goals
+    apply UInt64.toBitVec_inj.mp
+    apply BitVec.eq_of_getLsbD_eq
+    intro index bound
+    simp only [UInt64.toBitVec_or, UInt64.toBitVec_and, UInt64.toBitVec_shiftLeft,
+      UInt64.toBitVec_shiftRight, UInt64.toBitVec_toUInt8, UInt8.toBitVec_toUInt64,
+      mask_bits, UInt64.toBitVec_ofNat, BitVec.shiftLeft_eq', BitVec.ushiftRight_eq',
+      BitVec.toNat_umod, BitVec.toNat_ofNat, BitVec.getLsbD_or, BitVec.getLsbD_and,
+      BitVec.getLsbD_shiftLeft, BitVec.getLsbD_ushiftRight, BitVec.getLsbD_setWidth,
+      BitVec.getLsbD_allOnes, Width.bits]
+    have ranges : index < 8 ∨ (8 ≤ index ∧ index < 16) ∨ (16 ≤ index ∧ index < 24) ∨
+        (24 ≤ index ∧ index < 32) ∨ (32 ≤ index ∧ index < 40) ∨
+        (40 ≤ index ∧ index < 48) ∨ (48 ≤ index ∧ index < 56) ∨
+        (56 ≤ index ∧ index < 64) := by omega
+    rcases ranges with h | h | h | h | h | h | h | h <;>
+      simp (discharger := omega) [decide_eq_true, decide_eq_false, Bool.and_comm] <;>
+      congr 1 <;> omega
+
+theorem truncate_bits (width : Width) (value : Word) :
+    (width.truncate value).toBitVec = (value.toBitVec.setWidth width.bits).setWidth 64 := by
+  apply BitVec.eq_of_getLsbD_eq
+  intro index bound
+  simp only [Width.truncate, UInt64.toBitVec_and, mask_bits, BitVec.getLsbD_and,
+    BitVec.getLsbD_setWidth, BitVec.getLsbD_allOnes, decide_eq_true bound,
+    Bool.true_and, Bool.and_comm]
+
+@[simp] theorem truncate32 (value : Imm32) : Width.w32.truncate value.toUInt64 = value.toUInt64 := by
+  apply UInt64.toBitVec_inj.mp
+  simp [truncate_bits, UInt32.toBitVec_toUInt64, Width.bits]
+
+@[simp] theorem truncate64 (value : Word) : Width.w64.truncate value = value := by
+  apply UInt64.toBitVec_inj.mp
+  simp [truncate_bits, Width.bits]
+
+theorem read_imm32 (value : Imm32) (rest : List UInt8) :
+    Decode.readLE 4 ((imm32Bytes value).data.toList ++ rest) = some (value.toUInt64, rest) := by
+  simpa [imm32Bytes, immediateBytes, Decode.immediateBytes] using
+    read_immediate .w32 value.toUInt64 rest
+
+theorem imm32_zero_bytes : imm32Bytes 0 = bytes [0, 0, 0, 0] := by
+  apply ByteArray.ext
+  simp [imm32Bytes, littleEndian, bytes, List.range_succ]
+
+@[simp] theorem sign32_decode (value : Imm32) : Decode.sign32 value.toUInt64 = signExtend32 value := by
+  simp [Decode.sign32, signExtend32, UInt32.lt_iff_toNat_lt, UInt64.lt_iff_toNat_lt]
+
+def normalizedImmediate (width : Width) (value : Imm32) : Word :=
+  if width == .w64 then signExtend32 value else width.truncate value.toUInt64
+
+theorem read_groupImmediate (width : Width) (value : Imm32) (rest : List UInt8) :
+    Decode.groupImmediate width ((groupImmediateBytes width value).data.toList ++ rest) =
+      some (normalizedImmediate width value, rest) := by
+  have byte := read_immediate .w8 value.toUInt64 rest
+  have short := read_immediate .w16 value.toUInt64 rest
+  cases width <;>
+    simp_all [Decode.groupImmediate, groupImmediateBytes, normalizedImmediate, read_imm32,
+      Decode.immediateBytes, immediateBytes]
+
+theorem truncate_nat (width : Width) (value : Word) :
+    (width.truncate value).toNat = value.toNat % 2 ^ width.bits := by
+  have bits := congrArg BitVec.toNat (truncate_bits width value)
+  cases width <;>
+    simp only [Width.bits, BitVec.toNat_setWidth, UInt64.toNat_toBitVec, Nat.reducePow] at bits ⊢ <;>
+    omega
+
+theorem truncate32_of_small (value : Word) (bound : value.toNat < 2 ^ 32) :
+    Width.w32.truncate value = value := by
+  apply UInt64.toNat_inj.mp
+  rw [truncate_nat]
+  exact Nat.mod_eq_of_lt bound
+
+theorem read_word32 (value : Word) (bound : value.toNat < 2 ^ 32) (rest : List UInt8) :
+    Decode.readLE 4 ((littleEndian 4 value).data.toList ++ rest) = some (value, rest) := by
+  simpa [Decode.immediateBytes, immediateBytes, truncate32_of_small value bound] using
+    read_immediate .w32 value rest
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeControl.lean b/Ix/Compiler/X86/EncodeControl.lean
new file mode 100644
index 000000000..40774d3a4
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeControl.lean
@@ -0,0 +1,57 @@
+import Ix.Compiler.X86.EncodeRegisters
+import Ix.Compiler.X86.EncodeMemory
+
+/-! Frame pseudo-operations and ordinary relative-control instruction bytes. -/
+
+namespace Ix.Compiler.X86.Encode
+
+theorem frame_bound (size : FrameSize) : size.bytes.toNat < 2 ^ 31 := by
+  have bound := size.units16.toNat_lt_size
+  simp only [FrameSize.bytes, UInt64.toNat_mul, UInt16.toNat_toUInt64]
+  change (size.units16.toNat * 16) % 18446744073709551616 < 2147483648
+  simp only [UInt16.size] at bound
+  omega
+
+theorem frame_decode (subtract : Bool) (size : FrameSize) (rest : List UInt8) :
+    Decode.one ((frameBytes subtract size).data.toList ++ rest) =
+      some (.alu (if subtract then .sub else .add) .w64 .rsp (.imm size.bytes), rest) := by
+  have small := frame_bound size
+  have read := read_word32 size.bytes (by omega) rest
+  cases subtract <;>
+    simp [frameBytes, Decode.one, Decode.rex, Decode.prefixed, Decode.Prefix.width,
+      Decode.Prefix.wide, Decode.registers, Decode.modMode, Decode.modReg, Decode.modRM,
+      Decode.register, Decode.groupImmediate, Decode.aluGroup, read, Decode.sign32,
+      UInt64.lt_iff_toNat_lt, show size.bytes.toNat < 2147483648 from small]
+
+theorem spill_decode (slot : StackSlot) (source : GPR) (rest : List UInt8) :
+    Decode.one ((encodeSpill slot source).data.toList ++ rest) =
+      some (.store .w64 (spillAddress slot) source, rest) := by
+  simpa [encodeSpill, normalizedAddress, spillAddress] using
+    store_decode .w64 (spillAddress slot) source rest
+
+theorem reload_decode (destination : GPR) (slot : StackSlot) (rest : List UInt8) :
+    Decode.one ((encodeReload destination slot).data.toList ++ rest) =
+      some (.load .w64 destination (spillAddress slot), rest) := by
+  simpa [encodeReload, normalizedAddress, spillAddress] using
+    load_decode .w64 destination (spillAddress slot) rest
+
+theorem call_decode (displacement : Imm32) (rest : List UInt8) :
+    Decode.one ((byte 0xe8 ++ imm32Bytes displacement).data.toList ++ rest) =
+      some (.call displacement, rest) := by
+  simp [byte, Decode.one, read_imm32]
+
+theorem jump_decode (displacement : Imm32) (rest : List UInt8) :
+    Decode.one ((byte 0xe9 ++ imm32Bytes displacement).data.toList ++ rest) =
+      some (.jump displacement, rest) := by
+  simp [byte, Decode.one, read_imm32]
+
+theorem branch_decode (condition : Condition) (displacement : Imm32) (rest : List UInt8) :
+    Decode.one ((bytes [0x0f, nearOpcode condition] ++ imm32Bytes displacement).data.toList ++ rest) =
+      some (.branch condition displacement, rest) := by
+  cases condition <;> simp [Decode.one, nearOpcode, Decode.nearCondition, read_imm32]
+
+theorem ret_decode (rest : List UInt8) :
+    Decode.one ((byte 0xc3).data.toList ++ rest) = some (.ret, rest) := by
+  simp [byte, Decode.one]
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeExamples.lean b/Ix/Compiler/X86/EncodeExamples.lean
new file mode 100644
index 000000000..412bab6ed
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeExamples.lean
@@ -0,0 +1,174 @@
+import Ix.Compiler.X86.Encode
+import Ix.Compiler.X86.EvalExamples
+
+/-!
+Golden E0 encoder checks.  These byte strings are also decoded independently
+by `scripts/CheckX86Encoder.lean`; keeping the Lean expectations here makes
+every ordinary build catch local encoder drift before the external check.
+-/
+
+namespace Ix.Compiler.X86.Encode.Examples
+
+open Ix.Compiler.X86
+open Ix.Compiler.X86.Encode
+
+def expected (values : Array UInt8) : ByteArray := ByteArray.mk values
+
+#guard encodeMov .w64 .rax (.imm 42) ==
+  expected #[0x48, 0xb8, 0x2a, 0, 0, 0, 0, 0, 0, 0]
+
+#guard encodeMov .w8 .rsi (.imm 7) ==
+  expected #[0x40, 0xb6, 0x07]
+
+#guard encodeMov .w64 .r9 (.reg .r10) ==
+  expected #[0x4d, 0x89, 0xd1]
+
+#guard encodeLoad .w8 .r9
+    { base := some .r12, index := some .r13, scale := .eight,
+      displacement := 16 } ==
+  expected #[0x4f, 0x0f, 0xb6, 0x8c, 0xec, 0x10, 0, 0, 0]
+
+#guard encodeLoad .w16 .rax { base := some .rbx, displacement := 4 } ==
+  expected #[0x48, 0x0f, 0xb7, 0x83, 0x04, 0, 0, 0]
+
+#guard encodeLoad .w32 .r8 { base := none, displacement := 0x100 } ==
+  expected #[0x44, 0x8b, 0x04, 0x25, 0, 0x01, 0, 0]
+
+#guard encodeStore .w64 { base := some .rbp, displacement := 0xfffffff8 }
+    .r12 ==
+  expected #[0x4c, 0x89, 0xa5, 0xf8, 0xff, 0xff, 0xff]
+
+#guard encodeLea .r10
+    { base := some .rbx, index := some .r9, scale := .four,
+      displacement := 32 } ==
+  expected #[0x4e, 0x8d, 0x94, 0x8b, 0x20, 0, 0, 0]
+
+#guard encodeAlu .add .w64 .rax (.imm 2) ==
+  expected #[0x48, 0x81, 0xc0, 0x02, 0, 0, 0]
+
+#guard encodeAlu .sub .w8 .rsi (.imm 1) ==
+  expected #[0x40, 0x80, 0xee, 0x01]
+
+#guard encodeAlu .xor .w32 .r9 (.reg .r10) ==
+  expected #[0x45, 0x31, 0xd1]
+
+#guard encodeImul .w64 .r9 .r10 ==
+  expected #[0x4d, 0x0f, 0xaf, 0xca]
+
+#guard encodePush .r12 == expected #[0x41, 0x54]
+#guard encodePop .r12 == expected #[0x41, 0x5c]
+
+#guard frameBytes true { units16 := 1 } ==
+  expected #[0x48, 0x81, 0xec, 0x10, 0, 0, 0]
+
+#guard frameBytes false { units16 := 1 } ==
+  expected #[0x48, 0x81, 0xc4, 0x10, 0, 0, 0]
+
+#guard encodeSpill { index := 0 } .r12 ==
+  expected #[0x4c, 0x89, 0xa5, 0xf8, 0xff, 0xff, 0xff]
+
+#guard encodeReload .r12 { index := 0 } ==
+  expected #[0x4c, 0x8b, 0xa5, 0xf8, 0xff, 0xff, 0xff]
+
+#guard encodeCompare
+    { width := .w64, left := .rax, right := .imm 42 } ==
+  expected #[0x48, 0x81, 0xf8, 0x2a, 0, 0, 0]
+
+#guard encodeCompare
+    { width := .w32, left := .r9, right := .reg .r10 } ==
+  expected #[0x45, 0x39, 0xd1]
+
+def directCallPlaceholderAccepted : Bool :=
+  let chunk := encodeInstr (.call 3)
+  chunk.bytes == expected #[0xe8, 0, 0, 0, 0] &&
+    chunk.fixups == #[{ offset := 1, target := .block 3 }]
+
+#guard directCallPlaceholderAccepted
+
+def runtimeCallPlaceholderAccepted : Bool :=
+  let chunk := encodeInstr (.callRuntime .allocate)
+  chunk.bytes == expected #[0xe8, 0, 0, 0, 0] &&
+    chunk.fixups == #[{ offset := 1, target := .intrinsic .allocate }]
+
+#guard runtimeCallPlaceholderAccepted
+
+#guard (encodeTerminator (.jump 1)).bytes ==
+  expected #[0xe9, 0, 0, 0, 0]
+
+#guard (encodeTerminator (.branch
+    { width := .w64, left := .rax, right := .imm 42 }
+    .eq 1 2)).bytes ==
+  expected #[0x48, 0x81, 0xf8, 0x2a, 0, 0, 0,
+    0x0f, 0x84, 0, 0, 0, 0,
+    0xe9, 0, 0, 0, 0]
+
+#guard (encodeTerminator (.tailCall 1)).bytes ==
+  expected #[0xe9, 0, 0, 0, 0]
+
+#guard (encodeTerminator .ret).bytes == expected #[0xc3]
+
+def arithmeticProgramBytesAccepted : Bool :=
+  match Ix.Compiler.X86.Encode.Program.encode
+      Ix.Compiler.X86.Examples.arithmeticProgram with
+  | .error _ => false
+  | .ok output =>
+      output.text == expected #[
+        0x48, 0xb8, 0x28, 0, 0, 0, 0, 0, 0, 0,
+        0x48, 0x81, 0xc0, 0x02, 0, 0, 0,
+        0x48, 0x81, 0xf8, 0x2a, 0, 0, 0,
+        0x0f, 0x84, 0x05, 0, 0, 0,
+        0xe9, 0x01, 0, 0, 0,
+        0xc3,
+        0x48, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0,
+        0xc3] &&
+      output.blockOffsets == #[0, 35, 36] &&
+      output.relocations.isEmpty
+
+#guard arithmeticProgramBytesAccepted
+
+def directCallProgramBytesAccepted : Bool :=
+  match Ix.Compiler.X86.Encode.Program.encode
+      Ix.Compiler.X86.Examples.callProgram with
+  | .error _ => false
+  | .ok output =>
+      output.text == expected #[
+        0x55,
+        0xe8, 0x09, 0, 0, 0,
+        0x5d,
+        0x48, 0x81, 0xc0, 0x02, 0, 0, 0,
+        0xc3,
+        0x48, 0xb8, 0x28, 0, 0, 0, 0, 0, 0, 0,
+        0xc3] &&
+      output.blockOffsets == #[0, 15] &&
+      output.relocations.isEmpty
+
+#guard directCallProgramBytesAccepted
+
+def runtimeRelocationAccepted : Bool :=
+  match Ix.Compiler.X86.Encode.Program.encode
+      Ix.Compiler.X86.Examples.runtimeProgram with
+  | .error _ => false
+  | .ok output =>
+      output.text == expected #[
+        0x55,
+        0x48, 0xbf, 0x10, 0, 0, 0, 0, 0, 0, 0,
+        0x48, 0xbe, 0x08, 0, 0, 0, 0, 0, 0, 0,
+        0xe8, 0, 0, 0, 0,
+        0x5d,
+        0xc3] &&
+      output.relocations == #[
+        { offset := 22
+          symbol := "compilatrix_rt_allocate"
+          addend := -4 }]
+
+#guard runtimeRelocationAccepted
+
+def malformedProgramRejected : Bool :=
+  match Ix.Compiler.X86.Encode.Program.encode
+      Ix.Compiler.X86.Examples.invalidTargetProgram with
+  | .error .malformedControl => true
+  | _ => false
+
+#guard malformedProgramRejected
+
+end Ix.Compiler.X86.Encode.Examples
diff --git a/Ix/Compiler/X86/EncodeExecution.lean b/Ix/Compiler/X86/EncodeExecution.lean
new file mode 100644
index 000000000..9b0ead764
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeExecution.lean
@@ -0,0 +1,111 @@
+import Ix.Compiler.X86.EncodeLength
+import Ix.Compiler.X86.ByteFlags
+
+/-! Per-form execution agreement with the existing typed evaluator, including
+its modeled memory faults. Symbolic control addresses and external calls have
+separate local contracts below; a complete linked stream relation is E2. -/
+
+namespace Ix.Compiler.X86.Encode
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def linearInstruction : Instr → Bool
+  | .call _ | .callRuntime _ => false
+  | _ => true
+
+def LinearAgreement (before after : Machine) : Except ByteEval.Fault ByteEval.State → Prop
+  | .ok state => after = before.advanceWith state.core
+  | .error (.memory fault) => after = before.trap (.memoryFault fault)
+  | .error _ => False
+
+theorem moveOperand_write (width : Width) (destination : GPR) (source : MoveSource) (core : Core) :
+    core.writeReg width destination (ByteEval.operand (moveOperand width source) core) =
+      core.writeReg width destination (source.eval core) := by
+  cases source <;> simp [moveOperand, ByteEval.operand, MoveSource.eval, writeReg_truncate]
+
+theorem aluOperand_low (width : Width) (source : AluSource) (core : Core) :
+    width.truncate (ByteEval.operand (aluOperand width source) core) =
+      width.truncate (source.eval core) := by
+  cases source <;> simp [aluOperand, ByteEval.operand, AluSource.eval, normalizedImmediate_truncate]
+
+theorem aluOperand_write (operation : AluOp) (width : Width) (destination : GPR)
+    (source : AluSource) (core : Core) :
+    core.writeReg width destination
+      (operation.eval (core.readReg destination) (ByteEval.operand (aluOperand width source) core)) =
+    core.writeReg width destination (operation.eval (core.readReg destination) (source.eval core)) :=
+  writeReg_congr _ _ _ _ _ (alu_congr_right _ _ _ _ _ (aluOperand_low width source core))
+
+/-- Length, RIP and prior flags are arbitrary here: each emitted linear form
+has the same register/memory effect or the same precise memory fault. -/
+theorem instruction_execution (instruction : Instr) (linear : linearInstruction instruction = true)
+    (runtime : Runtime) (checked : Checked) (machine : Machine)
+    (rip : Word) (flags : ByteEval.Flags) (length : Nat) :
+    LinearAgreement machine (executeInstr runtime checked instruction machine)
+      (ByteEval.execute ⟨instructionOperation instruction, length⟩ ⟨machine.core, rip, flags⟩) := by
+  cases instruction with
+  | mov width destination source =>
+    simp [instructionOperation, ByteEval.execute, LinearAgreement, executeInstr, moveOperand_write]
+  | load width destination address =>
+    simp only [instructionOperation, ByteEval.execute, normalizedAddress_eval, executeInstr]
+    cases machine.core.loadReg? width destination (address.eval machine.core) <;>
+      simp [LinearAgreement, Except.mapError]
+  | store width address source =>
+    simp only [instructionOperation, ByteEval.execute, normalizedAddress_eval, executeInstr]
+    cases machine.core.storeReg? width (address.eval machine.core) source <;>
+      simp [LinearAgreement, Except.mapError]
+  | lea destination address =>
+    simp [instructionOperation, ByteEval.execute, LinearAgreement, executeInstr]
+  | alu operation width destination source =>
+    simp [instructionOperation, ByteEval.execute, LinearAgreement, executeInstr, aluOperand_write]
+  | imul width destination source =>
+    simp [instructionOperation, ByteEval.execute, LinearAgreement, executeInstr]
+  | push source =>
+    simp only [instructionOperation, ByteEval.execute, executeInstr]
+    cases machine.core.memory.write64? (machine.core.readReg .rsp - 8) (machine.core.readReg source) <;>
+      simp [LinearAgreement, Except.mapError]
+  | pop destination =>
+    simp only [instructionOperation, ByteEval.execute, executeInstr]
+    cases machine.core.memory.read64? (machine.core.readReg .rsp) <;>
+      simp [LinearAgreement, Except.mapError]
+  | allocFrame size | freeFrame size =>
+    simp [instructionOperation, ByteEval.execute, LinearAgreement, executeInstr,
+      ByteEval.operand, Core.writeReg, AluOp.eval]
+  | spill slot source =>
+    simp only [instructionOperation, ByteEval.execute, spillAddress_eval, executeInstr]
+    cases machine.core.storeReg? .w64 (machine.core.readReg .rbp - slot.displacement) source <;>
+      simp [LinearAgreement, Except.mapError]
+  | reload destination slot =>
+    simp only [instructionOperation, ByteEval.execute, spillAddress_eval, executeInstr]
+    cases machine.core.loadReg? .w64 destination (machine.core.readReg .rbp - slot.displacement) <;>
+      simp [LinearAgreement, Except.mapError]
+  | call target | callRuntime intrinsic => simp [linearInstruction] at linear
+
+/-- The execution theorem consumes the actual encoder bytes, surrounded by
+arbitrary bytes. The explicit boundary is a premise for this local E1 result. -/
+theorem encoded_instruction_execution (instruction : Instr)
+    (linear : linearInstruction instruction = true) (before after : ByteArray)
+    (runtime : Runtime) (checked : Checked) (machine : Machine) (flags : ByteEval.Flags)
+    (textBase rip : Word) (boundary : (rip - textBase).toNat = before.size) :
+    LinearAgreement machine (executeInstr runtime checked instruction machine)
+      (ByteEval.step (before ++ (encodeInstr instruction).bytes ++ after) textBase
+        ⟨machine.core, rip, flags⟩) := by
+  rw [ByteEval.step, boundary, instruction_decodeAt]
+  exact instruction_execution instruction linear runtime checked machine rip flags _
+
+theorem condition_congr (condition : Condition) (width : Width) (left first second : Word)
+    (equal : width.truncate first = width.truncate second) :
+    condition.holds width left first = condition.holds width left second := by
+  cases condition <;> simp [Condition.holds, Width.signedValue, equal]
+
+theorem compare_execution (comparison : Compare) (condition : Condition)
+    (state : ByteEval.State) (length : Nat) :
+    let next := ByteEval.execute
+      ⟨.compare comparison.width comparison.left (aluOperand comparison.width comparison.right), length⟩ state
+    ∃ after, next = .ok after ∧ after.core = state.core ∧
+      after.rip = state.rip + UInt64.ofNat length ∧
+      after.flags.test condition = some (comparison.holds condition state.core) := by
+  refine ⟨_, rfl, rfl, rfl, ?_⟩
+  rw [ByteEval.compare_flags]
+  exact congrArg some (condition_congr _ _ _ _ _ (aluOperand_low _ _ _))
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeFields.lean b/Ix/Compiler/X86/EncodeFields.lean
new file mode 100644
index 000000000..1f891bcde
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeFields.lean
@@ -0,0 +1,76 @@
+import Ix.Compiler.X86.EncodeBytes
+
+/-! Register, prefix, ModRM and SIB field inverses. -/
+
+namespace Ix.Compiler.X86.Encode
+
+@[simp] theorem register_decode (register : GPR) :
+    Decode.register (registerExtended (gprCode register)) (registerLow (gprCode register)) =
+      some register := by
+  cases register <;> rfl
+
+@[simp] theorem index_decode (register : IndexReg) :
+    Decode.index (registerExtended (indexRegCode register)) (registerLow (indexRegCode register)) =
+      some (some register) := by
+  cases register <;> rfl
+
+@[simp] theorem index_none : Decode.index false 4 = some none := rfl
+
+@[simp] theorem scale_decode (scale : Scale) : Decode.scale (scaleBits scale) = some scale := by
+  cases scale <;> rfl
+
+theorem low_lt (code : UInt8) : registerLow code < 8 := Nat.mod_lt _ (by decide)
+
+@[simp] theorem modRM_mode (mode register rm : Nat) (bound : mode < 4) :
+    Decode.modMode (modRM mode register rm) = mode := by
+  have := Nat.mod_lt register (by decide : 0 < 8)
+  have := Nat.mod_lt rm (by decide : 0 < 8)
+  simp only [Decode.modMode, modRM, UInt8.toNat_ofNat']
+  omega
+
+@[simp] theorem modRM_register (mode register rm : Nat) :
+    Decode.modReg (modRM mode register rm) = register % 8 := by
+  have := Nat.mod_lt register (by decide : 0 < 8)
+  have := Nat.mod_lt rm (by decide : 0 < 8)
+  simp only [Decode.modReg, modRM, UInt8.toNat_ofNat']
+  omega
+
+@[simp] theorem modRM_rm (mode register rm : Nat) :
+    Decode.modRM (modRM mode register rm) = rm % 8 := by
+  have := Nat.mod_lt register (by decide : 0 < 8)
+  have := Nat.mod_lt rm (by decide : 0 < 8)
+  simp only [Decode.modRM, modRM, UInt8.toNat_ofNat']
+  omega
+
+@[simp] theorem sib_scale (scale index base : Nat) :
+    Decode.modMode (sib scale index base) = scale % 4 := by
+  exact modRM_mode _ _ _ (Nat.mod_lt _ (by decide))
+
+@[simp] theorem sib_index (scale index base : Nat) :
+    Decode.modReg (sib scale index base) = index % 8 := by
+  exact modRM_register _ _ _
+
+@[simp] theorem sib_base (scale index base : Nat) :
+    Decode.modRM (sib scale index base) = base % 8 := by
+  exact modRM_rm _ _ _
+
+@[simp] theorem low_mod (code : UInt8) : registerLow code % 8 = registerLow code := by
+  simp [registerLow]
+
+@[simp] theorem scale_mod (scale : Scale) : scaleBits scale % 4 = scaleBits scale := by
+  cases scale <;> rfl
+
+theorem registers_decode (operand16 w : Bool) (reg rm : GPR) :
+    Decode.registers
+      ⟨operand16, w, registerExtended (gprCode reg), false, registerExtended (gprCode rm)⟩
+      (modRM 3 (registerLow (gprCode reg)) (registerLow (gprCode rm))) = some (reg, rm) := by
+  simp [Decode.registers]
+
+theorem one_prefixes (operand16 w r x b : Bool) (opcode : UInt8) (rest : List UInt8)
+    (notStack : (0x50 ≤ opcode.toNat && opcode.toNat < 0x60) = false) :
+    Decode.one ((prefixes operand16 w r x b).data.toList ++ opcode :: rest) =
+      Decode.prefixed ⟨operand16, w, r, x, b⟩ (opcode :: rest) := by
+  cases operand16 <;> cases w <;> cases r <;> cases x <;> cases b <;>
+    simp [prefixes, byte, Decode.one, Decode.rex, notStack]
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeForms.lean b/Ix/Compiler/X86/EncodeForms.lean
new file mode 100644
index 000000000..964f333f8
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeForms.lean
@@ -0,0 +1,80 @@
+import Ix.Compiler.X86.EncodeControl
+
+/-! Every emitted typed form has a concrete, independently decoded recipe.
+Control displacements here are the encoder's pre-layout placeholders; the
+relative-field laws separately cover patched values. -/
+
+namespace Ix.Compiler.X86.Encode
+
+def instructionOperation : Instr → Decode.Operation
+  | .mov width destination source => .mov width destination (moveOperand width source)
+  | .load width destination source => .load width destination (normalizedAddress source)
+  | .store width destination source => .store width (normalizedAddress destination) source
+  | .lea destination source => .lea destination (normalizedAddress source)
+  | .alu operation width destination source => .alu operation width destination (aluOperand width source)
+  | .imul width destination source => .imul width destination source
+  | .push source => .push source
+  | .pop destination => .pop destination
+  | .allocFrame size => .alu .sub .w64 .rsp (.imm size.bytes)
+  | .freeFrame size => .alu .add .w64 .rsp (.imm size.bytes)
+  | .spill slot source => .store .w64 (spillAddress slot) source
+  | .reload destination slot => .load .w64 destination (spillAddress slot)
+  | .call _ | .callRuntime _ => .call 0
+
+theorem instruction_decode (instruction : Instr) (rest : List UInt8) :
+    Decode.one ((encodeInstr instruction).bytes.data.toList ++ rest) =
+      some (instructionOperation instruction, rest) := by
+  cases instruction with
+  | mov width destination source => exact mov_decode width destination source rest
+  | load width destination source => exact load_decode width destination source rest
+  | store width destination source => exact store_decode width destination source rest
+  | lea destination source => exact lea_decode destination source rest
+  | alu operation width destination source => exact alu_decode operation width destination source rest
+  | imul width destination source => exact imul_decode width destination source rest
+  | push source => exact push_decode source rest
+  | pop destination => exact pop_decode destination rest
+  | allocFrame size => exact frame_decode true size rest
+  | freeFrame size => exact frame_decode false size rest
+  | spill slot source => exact spill_decode slot source rest
+  | reload destination slot => exact reload_decode destination slot rest
+  | call target | callRuntime intrinsic =>
+    simp [encodeInstr, instructionOperation, rel32, byte, Decode.one, Decode.readLE]
+
+def terminatorOperations : Terminator → List Decode.Operation
+  | .jump _ | .tailCall _ => [.jump 0]
+  | .branch comparison condition _ _ =>
+      [.compare comparison.width comparison.left (aluOperand comparison.width comparison.right),
+        .branch condition 0, .jump 0]
+  | .ret => [.ret]
+
+theorem rel32_branch_decode (condition : Condition) (target : FixupTarget) (rest : List UInt8) :
+    Decode.one ((rel32 (bytes [0x0f, nearOpcode condition]) target).bytes.data.toList ++ rest) =
+      some (.branch condition 0, rest) := by
+  cases condition <;>
+    simp [rel32, Decode.one, nearOpcode, Decode.nearCondition, Decode.readLE]
+
+theorem rel32_jump_decode (target : FixupTarget) (rest : List UInt8) :
+    Decode.one ((rel32 (byte 0xe9) target).bytes.data.toList ++ rest) =
+      some (.jump 0, rest) := by
+  simp [rel32, byte, Decode.one, Decode.readLE]
+
+theorem terminator_decode (terminator : Terminator) (rest : List UInt8) :
+    Decode.sequence (terminatorOperations terminator).length
+      ((encodeTerminator terminator).bytes.data.toList ++ rest) =
+        some (terminatorOperations terminator, rest) := by
+  cases terminator with
+  | jump target | tailCall target =>
+    simp [terminatorOperations, encodeTerminator, Decode.sequence, rel32_jump_decode]
+  | ret =>
+    simp [terminatorOperations, encodeTerminator, Chunk.raw, Decode.sequence, ret_decode]
+  | branch comparison condition yes no =>
+    simp only [terminatorOperations, List.length_cons, List.length_nil, encodeTerminator,
+      Chunk.append, Chunk.raw, ByteArray.toList_data_append, List.append_assoc]
+    rw [Decode.sequence, compare_decode]
+    simp only [bind, Option.bind]
+    rw [Decode.sequence, rel32_branch_decode]
+    simp only [bind, Option.bind]
+    rw [Decode.sequence, rel32_jump_decode]
+    rfl
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeLength.lean b/Ix/Compiler/X86/EncodeLength.lean
new file mode 100644
index 000000000..b1c41a7bd
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeLength.lean
@@ -0,0 +1,108 @@
+import Ix.Compiler.X86.EncodeForms
+
+/-! Instruction lengths and exact decoding at a supplied byte boundary. -/
+
+namespace Ix.Compiler.X86.Encode
+
+@[simp] theorem bytes_size (values : List UInt8) : (bytes values).size = values.length := by
+  simp [bytes, ByteArray.size]
+
+@[simp] theorem byte_size (value : UInt8) : (byte value).size = 1 := by simp [byte]
+
+@[simp] theorem littleEndian_size (count : Nat) (value : Word) : (littleEndian count value).size = count := by
+  simp [littleEndian, ByteArray.size]
+
+@[simp] theorem imm32Bytes_size (value : Imm32) : (imm32Bytes value).size = 4 := by simp [imm32Bytes]
+
+@[simp] theorem prefixes_size (operand16 w r x b : Bool) :
+    (prefixes operand16 w r x b).size = if operand16 then 2 else 1 := by
+  cases operand16 <;> simp [prefixes]
+
+@[simp] theorem widthPrefixes_size (width : Width) (r x b : Bool) :
+    (widthPrefixes width r x b).size = if width == .w16 then 2 else 1 := by
+  simp [widthPrefixes]
+
+theorem memoryTail_size (reg : UInt8) (address : MemAddr) :
+    5 ≤ (memoryTail reg address).bytes.size ∧ (memoryTail reg address).bytes.size ≤ 6 := by
+  cases address with
+  | mk base index scale displacement =>
+    cases base with
+    | none => simp [memoryTail, imm32Bytes]
+    | some base =>
+      by_cases useSib : index.isSome || registerLow (gprCode base) == 4 <;>
+        simp [memoryTail, useSib, imm32Bytes]
+
+@[simp] theorem immediateBytes_size (width : Width) (value : Word) :
+    (immediateBytes width value).size = width.bytes := by
+  cases width <;> simp [immediateBytes, Width.bytes]
+
+@[simp] theorem groupImmediateBytes_size (width : Width) (value : Imm32) :
+    (groupImmediateBytes width value).size = if width == .w64 then 4 else width.bytes := by
+  cases width <;> simp [groupImmediateBytes, imm32Bytes, Width.bytes]
+
+@[simp] theorem imul_size (width : MulWidth) (destination source : GPR) :
+    (encodeImul width destination source).size = if width == .w16 then 5 else 4 := by
+  have size := congrArg List.length (imul_list width destination source)
+  simp only [List.length_append, List.length_cons, List.length_nil, Array.length_toList,
+    ByteArray.size_data] at size
+  cases width <;> simpa [MulWidth.width] using size
+
+theorem instruction_size (instruction : Instr) :
+    0 < (encodeInstr instruction).bytes.size ∧ (encodeInstr instruction).bytes.size ≤ 10 := by
+  cases instruction with
+  | mov width destination source =>
+    cases source <;> cases width <;>
+      simp [encodeInstr, Chunk.raw, encodeMov, encodeRegReg, Width.bytes]
+  | load width destination address =>
+    have bounds := memoryTail_size (gprCode destination) address
+    cases width <;> simp_all [encodeInstr, Chunk.raw, encodeLoad, encodeMemory] <;> omega
+  | store width address source =>
+    have bounds := memoryTail_size (gprCode source) address
+    cases width <;> simp_all [encodeInstr, Chunk.raw, encodeStore, encodeMemory] <;> omega
+  | lea destination address =>
+    have bounds := memoryTail_size (gprCode destination) address
+    simp_all [encodeInstr, Chunk.raw, encodeLea, encodeMemory] <;> omega
+  | alu operation width destination source =>
+    cases source <;> cases width <;>
+      simp [encodeInstr, Chunk.raw, encodeAlu, encodeRegReg, Width.bytes]
+  | imul width destination source =>
+    cases width <;> simp [encodeInstr, Chunk.raw]
+  | push source =>
+    simp only [encodeInstr, Chunk.raw, encodePush]
+    split <;> simp
+  | pop destination =>
+    simp only [encodeInstr, Chunk.raw, encodePop]
+    split <;> simp
+  | allocFrame size | freeFrame size => simp [encodeInstr, Chunk.raw, frameBytes]
+  | spill slot source =>
+    have bounds := memoryTail_size (gprCode source) (spillAddress slot)
+    simp_all [encodeInstr, Chunk.raw, encodeSpill, encodeStore, encodeMemory] <;> omega
+  | reload destination slot =>
+    have bounds := memoryTail_size (gprCode destination) (spillAddress slot)
+    simp_all [encodeInstr, Chunk.raw, encodeReload, encodeLoad, encodeMemory] <;> omega
+  | call target | callRuntime intrinsic => simp [encodeInstr, rel32]
+
+theorem compare_size (comparison : Compare) :
+    0 < (encodeCompare comparison).size ∧ (encodeCompare comparison).size ≤ 7 := by
+  cases comparison with
+  | mk width left right =>
+    cases right <;> cases width <;> simp [encodeCompare, encodeRegReg, Width.bytes]
+
+/-- A local boundary theorem: arbitrary prefix and suffix bytes are allowed.
+Complete stream boundary discovery and layout correspondence belong to E2. -/
+theorem decodeAt_of_one (encoded before after : ByteArray) (operation : Decode.Operation)
+    (decoded : Decode.one (encoded.data.toList ++ after.data.toList) =
+      some (operation, after.data.toList))
+    (positive : 0 < encoded.size) (short : encoded.size ≤ 15) :
+    Decode.decodeAt (before ++ encoded ++ after) before.size = some ⟨operation, encoded.size⟩ := by
+  simp only [← ByteArray.size_data] at positive short
+  simp [Decode.decodeAt, ← ByteArray.size_data, decoded]
+  omega
+
+theorem instruction_decodeAt (instruction : Instr) (before after : ByteArray) :
+    Decode.decodeAt (before ++ (encodeInstr instruction).bytes ++ after) before.size =
+      some ⟨instructionOperation instruction, (encodeInstr instruction).bytes.size⟩ :=
+  decodeAt_of_one _ before after _ (instruction_decode instruction after.data.toList)
+    (instruction_size instruction).1 (Nat.le_trans (instruction_size instruction).2 (by decide))
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeMemory.lean b/Ix/Compiler/X86/EncodeMemory.lean
new file mode 100644
index 000000000..7110ea9d5
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeMemory.lean
@@ -0,0 +1,100 @@
+import Ix.Compiler.X86.EncodeFields
+
+/-! Exact emitted addressing bytes, including displacement consumption. -/
+
+namespace Ix.Compiler.X86.Encode
+
+/-- Scale bits have no architectural effect in the absence of an index. -/
+def normalizedAddress (address : MemAddr) : MemAddr :=
+  { address with scale := if address.index.isSome then address.scale else .one }
+
+@[simp] theorem normalizedAddress_eval (address : MemAddr) (core : Core) :
+    (normalizedAddress address).eval core = address.eval core := by
+  cases address with
+  | mk base index scale displacement => cases index <;> rfl
+
+theorem memoryTail_decode (operand16 w : Bool) (reg : GPR) (address : MemAddr)
+    (make : GPR → MemAddr → Decode.Operation) (rest : List UInt8) :
+    let tail := memoryTail (gprCode reg) address
+    Decode.memoryOperation
+      ⟨operand16, w, registerExtended (gprCode reg), tail.rexX, tail.rexB⟩ make
+      (tail.bytes.data.toList ++ rest) = some (make reg (normalizedAddress address), rest) := by
+  cases address with
+  | mk base index scale displacement =>
+    cases base with
+    | none =>
+      cases index <;>
+        simp [memoryTail, Decode.memoryOperation, Decode.memory, normalizedAddress,
+          read_imm32]
+    | some base =>
+      cases index with
+      | none =>
+        have baseDecoded := register_decode base
+        by_cases useSib : registerLow (gprCode base) = 4 <;>
+          simp_all [memoryTail, Decode.memoryOperation, Decode.memory, normalizedAddress,
+            byte, read_imm32]
+      | some index =>
+        simp [memoryTail, Decode.memoryOperation, Decode.memory, normalizedAddress,
+          read_imm32]
+
+theorem memoryTail_head (reg : GPR) (address : MemAddr) :
+    ∃ head tail, (memoryTail (gprCode reg) address).bytes.data.toList = head :: tail ∧
+      Decode.modMode head ≠ 3 := by
+  cases address with
+  | mk base index scale displacement =>
+    cases base with
+    | none => simp [memoryTail]
+    | some base =>
+      by_cases useSib : index.isSome || registerLow (gprCode base) == 4 <;>
+        simp [memoryTail, useSib, byte]
+
+theorem one_encodeMemory (operand16 w : Bool) (opcode : UInt8) (extra : List UInt8)
+    (reg : GPR) (address : MemAddr) (rest : List UInt8)
+    (notStack : (0x50 ≤ opcode.toNat && opcode.toNat < 0x60) = false) :
+    let tail := memoryTail (gprCode reg) address
+    Decode.one ((encodeMemory operand16 w (bytes (opcode :: extra))
+      (gprCode reg) address).data.toList ++ rest) =
+        Decode.prefixed ⟨operand16, w, registerExtended (gprCode reg), tail.rexX, tail.rexB⟩
+          (opcode :: (extra ++ tail.bytes.data.toList ++ rest)) := by
+  simp only [encodeMemory, ByteArray.toList_data_append, bytes_list, List.append_assoc,
+    List.cons_append]
+  exact one_prefixes _ _ _ _ _ _ _ notStack
+
+theorem load_decode (width : Width) (destination : GPR) (address : MemAddr)
+    (rest : List UInt8) :
+    Decode.one ((encodeLoad width destination address).data.toList ++ rest) =
+      some (.load width destination (normalizedAddress address), rest) := by
+  obtain ⟨head, tail, shape, mode⟩ := memoryTail_head destination address
+  have decoded := fun rexW => memoryTail_decode false rexW destination address (.load width) rest
+  cases width <;>
+    simp only [encodeLoad, byte] <;>
+    rw [one_encodeMemory _ _ _ _ _ _ _ (by decide)] <;>
+    simp only [List.nil_append, shape, List.cons_append] at * <;>
+    first
+    | simpa [Decode.prefixed] using decoded true
+    | simpa [Decode.prefixed] using decoded false
+
+theorem store_decode (width : Width) (address : MemAddr) (source : GPR)
+    (rest : List UInt8) :
+    Decode.one ((encodeStore width address source).data.toList ++ rest) =
+      some (.store width (normalizedAddress address) source, rest) := by
+  obtain ⟨head, tail, shape, mode⟩ := memoryTail_head source address
+  have decoded := memoryTail_decode (width == .w16) (width == .w64) source address
+    (fun source address => .store width address source) rest
+  cases width <;>
+    simp only [encodeStore, byte] <;>
+    rw [one_encodeMemory _ _ _ _ _ _ _ (by decide)] <;>
+    simp only [List.nil_append, shape, List.cons_append] at * <;>
+    simpa [Decode.prefixed, Decode.Prefix.width, Decode.Prefix.wide, mode] using decoded
+
+theorem lea_decode (destination : GPR) (address : MemAddr) (rest : List UInt8) :
+    Decode.one ((encodeLea destination address).data.toList ++ rest) =
+      some (.lea destination (normalizedAddress address), rest) := by
+  obtain ⟨head, tail, shape, mode⟩ := memoryTail_head destination address
+  have decoded := memoryTail_decode false true destination address .lea rest
+  simp only [encodeLea, byte]
+  rw [one_encodeMemory _ _ _ _ _ _ _ (by decide)]
+  simp only [List.nil_append, shape, List.cons_append] at *
+  simpa [Decode.prefixed] using decoded
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodePatch.lean b/Ix/Compiler/X86/EncodePatch.lean
new file mode 100644
index 000000000..2a01b2f5a
--- /dev/null
+++ b/Ix/Compiler/X86/EncodePatch.lean
@@ -0,0 +1,53 @@
+import Ix.Compiler.X86.EncodeLength
+import Ix.Compiler.X86.EncodeWord
+
+/-! The actual rel32 patcher replaces exactly its four-byte field. Range
+checks recover the signed displacement; no layout or linker premise is hidden. -/
+
+namespace Ix.Compiler.X86.Encode
+
+theorem list_set_after (before after : List α) (index : Nat) (value : α) :
+    (before ++ after).set (before.length + index) value = before ++ after.set index value := by
+  rw [List.set_append_right _ _ (by omega)]
+  simp
+
+theorem patchSigned32_splice (before after : ByteArray) (a b c d : UInt8) (value : Int) :
+    patchSigned32 (before ++ bytes [a, b, c, d] ++ after) before.size value =
+      .ok (before ++ signed32Bytes value ++ after) := by
+  simp only [patchSigned32, ByteArray.size_append, bytes_size, List.length_cons, List.length_nil]
+  rw [if_pos (by omega)]
+  simp only [List.range_succ, List.range_zero, List.foldl_append, List.foldl_cons, List.foldl_nil,
+    List.nil_append, Nat.add_zero]
+  congr 1
+  apply ByteArray.ext
+  apply Array.toList_inj.mp
+  simp only [ByteArray.set!, Array.set!_eq_setIfInBounds, Array.toList_setIfInBounds, ByteArray.toList_data_append,
+    bytes_list, List.append_assoc]
+  change ((((before.data.toList ++ a :: b :: c :: d :: after.data.toList).set
+      (before.data.toList.length + 0) ((signed32Bytes value).get! 0)).set
+      (before.data.toList.length + 1) ((signed32Bytes value).get! 1)).set
+      (before.data.toList.length + 2) ((signed32Bytes value).get! 2)).set
+      (before.data.toList.length + 3) ((signed32Bytes value).get! 3) = _
+  simp only [list_set_after, List.set_cons_zero, List.set_cons_succ]
+  simp [signed32Bytes, imm32Bytes, littleEndian, List.range_succ, ByteArray.get!]
+
+theorem patchSigned32_reject (input : ByteArray) (offset : Nat) (value : Int)
+    (outside : input.size < offset + 4) :
+    patchSigned32 input offset value = .error (.invalidPatch offset input.size) := by
+  simp [patchSigned32, Nat.not_le.mpr outside]
+
+theorem rel32_patch (opcode : ByteArray) (target : FixupTarget) (value : Int) :
+    patchSigned32 (rel32 opcode target).bytes opcode.size value = .ok (opcode ++ signed32Bytes value) := by
+  simpa [rel32] using patchSigned32_splice opcode ByteArray.empty 0 0 0 0 value
+
+theorem signed32_decode (value : Int) (rest : List UInt8) :
+    Decode.readLE 4 ((signed32Bytes value).data.toList ++ rest) =
+      some ((Int32.ofInt value).toUInt32.toUInt64, rest) := read_imm32 _ rest
+
+theorem signed32_checked (value : Int) (fits : fitsSigned32 value = true) :
+    (signExtend32 (Int32.ofInt value).toUInt32).toBitVec.toInt = value := by
+  rw [signExtend32_ofInt _ fits]
+  simp only [fitsSigned32, decide_eq_true_eq] at fits
+  exact BitVec.toInt_ofInt_eq_self (by decide) (by omega) (by omega)
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeRegisters.lean b/Ix/Compiler/X86/EncodeRegisters.lean
new file mode 100644
index 000000000..1e51e6706
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeRegisters.lean
@@ -0,0 +1,156 @@
+import Ix.Compiler.X86.EncodeFields
+
+/-! Register and immediate instruction forms, proved from their encoded bytes. -/
+
+namespace Ix.Compiler.X86.Encode
+
+def moveOperand (width : Width) : MoveSource → Decode.Operand
+  | .reg register => .reg register
+  | .imm value => .imm (width.truncate value)
+
+def aluOperand (width : Width) : AluSource → Decode.Operand
+  | .reg register => .reg register
+  | .imm value => .imm (normalizedImmediate width value)
+
+theorem one_encodeRegReg (width : Width) (opcode : UInt8) (reg rm : GPR) (rest : List UInt8)
+    (notStack : (0x50 ≤ opcode.toNat && opcode.toNat < 0x60) = false) :
+    Decode.one ((encodeRegReg width opcode reg rm).data.toList ++ rest) =
+      Decode.prefixed
+        ⟨width == .w16, width == .w64, registerExtended (gprCode reg), false,
+          registerExtended (gprCode rm)⟩
+        (opcode :: modRM 3 (registerLow (gprCode reg)) (registerLow (gprCode rm)) :: rest) := by
+  simp only [encodeRegReg, widthPrefixes, ByteArray.toList_data_append, bytes_list,
+    List.append_assoc, List.cons_append, List.nil_append]
+  exact one_prefixes _ _ _ _ _ _ _ notStack
+
+theorem mov_register_decode (width : Width) (destination source : GPR) (rest : List UInt8) :
+    Decode.one ((encodeMov width destination (.reg source)).data.toList ++ rest) =
+      some (.mov width destination (.reg source), rest) := by
+  cases width <;> simp only [encodeMov] <;>
+    rw [one_encodeRegReg _ _ _ _ _ (by decide)] <;>
+    simp [Decode.prefixed, moveOpcode, Decode.Prefix.width, Decode.Prefix.wide, registers_decode]
+
+theorem alu_register_decode (operation : AluOp) (width : Width)
+    (destination source : GPR) (rest : List UInt8) :
+    Decode.one ((encodeAlu operation width destination (.reg source)).data.toList ++ rest) =
+      some (.alu operation width destination (.reg source), rest) := by
+  cases operation <;> cases width <;> simp only [encodeAlu] <;>
+    rw [one_encodeRegReg _ _ _ _ _ (by decide)] <;>
+    simp [Decode.prefixed, aluOpcode, Decode.aluRegisterOpcode, Decode.Prefix.width,
+      Decode.Prefix.wide, registers_decode]
+
+theorem compare_register_decode (width : Width) (left right : GPR) (rest : List UInt8) :
+    Decode.one ((encodeCompare ⟨width, left, .reg right⟩).data.toList ++ rest) =
+      some (.compare width left (.reg right), rest) := by
+  cases width <;> simp only [encodeCompare] <;>
+    rw [one_encodeRegReg _ _ _ _ _ (by decide)] <;>
+    simp [Decode.prefixed, cmpOpcode, Decode.Prefix.width, Decode.Prefix.wide, registers_decode]
+
+theorem mov_immediate_decode (width : Width) (destination : GPR) (value : Word)
+    (rest : List UInt8) :
+    Decode.one ((encodeMov width destination (.imm value)).data.toList ++ rest) =
+      some (.mov width destination (.imm (width.truncate value)), rest) := by
+  cases width <;> cases destination <;>
+    simp [encodeMov, widthPrefixes, prefixes, byte, gprCode, registerLow, registerExtended,
+      Decode.one, Decode.rex, Decode.prefixed, Decode.Prefix.width,
+      Decode.Prefix.wide, Decode.register, read_immediate]
+
+theorem mov_decode (width : Width) (destination : GPR) (source : MoveSource)
+    (rest : List UInt8) :
+    Decode.one ((encodeMov width destination source).data.toList ++ rest) =
+      some (.mov width destination (moveOperand width source), rest) := by
+  cases source with
+  | reg source => exact mov_register_decode width destination source rest
+  | imm value => exact mov_immediate_decode width destination value rest
+
+def groupBytes (width : Width) (extension : Nat) (destination : GPR) (value : Imm32) : ByteArray :=
+  widthPrefixes width false false (registerExtended (gprCode destination)) ++
+    bytes [if width == .w8 then 0x80 else 0x81,
+      modRM 3 extension (registerLow (gprCode destination))] ++
+    groupImmediateBytes width value
+
+theorem one_groupBytes (width : Width) (extension : Nat) (destination : GPR)
+    (value : Imm32) (rest : List UInt8) :
+    Decode.one ((groupBytes width extension destination value).data.toList ++ rest) =
+      Decode.prefixed
+        ⟨width == .w16, width == .w64, false, false, registerExtended (gprCode destination)⟩
+        ((if width == .w8 then 0x80 else 0x81) ::
+          modRM 3 extension (registerLow (gprCode destination)) ::
+            ((groupImmediateBytes width value).data.toList ++ rest)) := by
+  simp only [groupBytes, widthPrefixes, ByteArray.toList_data_append, bytes_list,
+    List.append_assoc, List.cons_append, List.nil_append]
+  apply one_prefixes
+  cases width <;> decide
+
+theorem alu_immediate_decode (operation : AluOp) (width : Width)
+    (destination : GPR) (value : Imm32) (rest : List UInt8) :
+    Decode.one ((encodeAlu operation width destination (.imm value)).data.toList ++ rest) =
+      some (.alu operation width destination (.imm (normalizedImmediate width value)), rest) := by
+  change Decode.one ((groupBytes width (aluExtension operation) destination value).data.toList ++ rest) = _
+  rw [one_groupBytes]
+  cases operation <;> cases width <;>
+    simp [Decode.prefixed, aluExtension, Decode.Prefix.width, Decode.Prefix.wide,
+      Decode.registers, Decode.aluGroup, read_groupImmediate] <;>
+    simp [Decode.register]
+
+theorem compare_immediate_decode (width : Width) (left : GPR) (value : Imm32)
+    (rest : List UInt8) :
+    Decode.one ((encodeCompare ⟨width, left, .imm value⟩).data.toList ++ rest) =
+      some (.compare width left (.imm (normalizedImmediate width value)), rest) := by
+  change Decode.one ((groupBytes width 7 left value).data.toList ++ rest) = _
+  rw [one_groupBytes]
+  cases width <;>
+    simp [Decode.prefixed, Decode.Prefix.width, Decode.Prefix.wide, Decode.registers,
+      read_groupImmediate] <;>
+    simp [Decode.register]
+
+theorem imul_list (width : MulWidth) (destination source : GPR) :
+    (encodeImul width destination source).data.toList =
+      (widthPrefixes width.width (registerExtended (gprCode destination)) false
+        (registerExtended (gprCode source))).data.toList ++
+      [0x0f, 0xaf, modRM 3 (registerLow (gprCode destination)) (registerLow (gprCode source))] := by
+  cases width <;>
+    simp [encodeImul, encodeRegReg, widthPrefixes, prefixes, byte, bytes, MulWidth.width,
+      ByteArray.size]
+
+theorem imul_decode (width : MulWidth) (destination source : GPR) (rest : List UInt8) :
+    Decode.one ((encodeImul width destination source).data.toList ++ rest) =
+      some (.imul width destination source, rest) := by
+  rw [imul_list]
+  simp only [widthPrefixes, List.append_assoc, List.cons_append, List.nil_append]
+  rw [one_prefixes _ _ _ _ _ _ _ (by decide)]
+  cases width <;>
+    simp [Decode.prefixed, Decode.Prefix.mulWidth, Decode.Prefix.wide, MulWidth.width,
+      registers_decode]
+
+theorem push_decode (source : GPR) (rest : List UInt8) :
+    Decode.one ((encodePush source).data.toList ++ rest) = some (.push source, rest) := by
+  cases source <;>
+    simp [encodePush, registerExtended, registerLow, gprCode, byte, Decode.one,
+      Decode.stack, Decode.register]
+
+theorem pop_decode (destination : GPR) (rest : List UInt8) :
+    Decode.one ((encodePop destination).data.toList ++ rest) = some (.pop destination, rest) := by
+  cases destination <;>
+    simp [encodePop, registerExtended, registerLow, gprCode, byte, Decode.one,
+      Decode.stack, Decode.register]
+
+theorem alu_decode (operation : AluOp) (width : Width) (destination : GPR)
+    (source : AluSource) (rest : List UInt8) :
+    Decode.one ((encodeAlu operation width destination source).data.toList ++ rest) =
+      some (.alu operation width destination (aluOperand width source), rest) := by
+  cases source with
+  | reg source => exact alu_register_decode operation width destination source rest
+  | imm value => exact alu_immediate_decode operation width destination value rest
+
+theorem compare_decode (comparison : Compare) (rest : List UInt8) :
+    Decode.one ((encodeCompare comparison).data.toList ++ rest) =
+      some (.compare comparison.width comparison.left
+        (aluOperand comparison.width comparison.right), rest) := by
+  cases comparison with
+  | mk width left right =>
+    cases right with
+    | reg right => exact compare_register_decode width left right rest
+    | imm value => exact compare_immediate_decode width left value rest
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/EncodeWord.lean b/Ix/Compiler/X86/EncodeWord.lean
new file mode 100644
index 000000000..6c99a87e6
--- /dev/null
+++ b/Ix/Compiler/X86/EncodeWord.lean
@@ -0,0 +1,106 @@
+import Ix.Compiler.X86.EncodeControl
+
+/-! Width and signed-word laws used by the byte execution bridge. -/
+
+namespace Ix.Compiler.X86.Encode
+
+theorem width_bound (width : Width) : width.bits ≤ 64 := by cases width <;> decide
+
+@[simp] theorem truncate_truncate (width : Width) (value : Word) :
+    width.truncate (width.truncate value) = width.truncate value := by
+  simp [Width.truncate, UInt64.and_assoc]
+
+theorem writeReg_truncate (core : Core) (width : Width) (register : GPR) (value : Word) :
+    core.writeReg width register (width.truncate value) = core.writeReg width register value := by
+  cases width <;> simp [Core.writeReg]
+
+theorem writeReg_congr (core : Core) (width : Width) (register : GPR) (left right : Word)
+    (equal : width.truncate left = width.truncate right) :
+    core.writeReg width register left = core.writeReg width register right := by
+  rw [← writeReg_truncate, equal, writeReg_truncate]
+
+theorem truncate_alu (operation : AluOp) (width : Width) (left right : Word) :
+    width.truncate (operation.eval left right) =
+      width.truncate (operation.eval (width.truncate left) (width.truncate right)) := by
+  apply UInt64.toBitVec_inj.mp
+  cases operation <;>
+    simp (discharger := exact width_bound width) [AluOp.eval, truncate_bits,
+      UInt64.toBitVec_add, UInt64.toBitVec_sub, UInt64.toBitVec_and, UInt64.toBitVec_or,
+      UInt64.toBitVec_xor, BitVec.sub_eq_add_neg, BitVec.neg_eq_not_add, BitVec.setWidth_add]
+
+theorem alu_congr_right (operation : AluOp) (width : Width) (left first second : Word)
+    (equal : width.truncate first = width.truncate second) :
+    width.truncate (operation.eval left first) = width.truncate (operation.eval left second) := by
+  rw [truncate_alu operation width left first, equal, ← truncate_alu]
+
+theorem signExtend32_bits (value : Imm32) :
+    (signExtend32 value).toBitVec = value.toBitVec.signExtend 64 := by
+  have sign : value.toBitVec.msb = decide (2147483648 ≤ value.toNat) := by
+    simp [BitVec.msb_eq_decide]
+  by_cases low : value.toNat < 2147483648
+  · have msb : value.toBitVec.msb = false := by simp [sign, Nat.not_le.mpr low]
+    simp [signExtend32, UInt32.lt_iff_toNat_lt, low, UInt32.toBitVec_toUInt64,
+      BitVec.signExtend_eq_setWidth_of_msb_false msb]
+  · have msb : value.toBitVec.msb = true := by simp [sign, Nat.le_of_not_lt low]
+    simp only [signExtend32, UInt32.lt_iff_toNat_lt, UInt32.toNat_ofNat,
+      show (2147483648 : Nat) % 2 ^ 32 = 2147483648 from rfl, low, ↓reduceIte,
+      UInt64.toBitVec_or, UInt32.toBitVec_toUInt64]
+    change value.toBitVec.setWidth 64 ||| ((BitVec.allOnes 32).setWidth 64 <<< 32) = _
+    apply BitVec.eq_of_getLsbD_eq
+    intro index bound
+    by_cases inner : index < 32 <;>
+      simp only [BitVec.getLsbD_or, BitVec.getLsbD_shiftLeft, BitVec.getLsbD_setWidth,
+        BitVec.getLsbD_allOnes, BitVec.getLsbD_signExtend, msb] <;>
+      simp (discharger := omega) [bound, inner] <;> omega
+
+theorem normalizedImmediate_truncate (width : Width) (value : Imm32) :
+    width.truncate (normalizedImmediate width value) = width.truncate (signExtend32 value) := by
+  cases width with
+  | w64 => rfl
+  | w8 | w16 | w32 =>
+    simp only [normalizedImmediate, beq_iff_eq, reduceCtorEq, ↓reduceIte, truncate_truncate]
+    apply UInt64.toBitVec_inj.mp
+    simp only [truncate_bits, signExtend32_bits, UInt32.toBitVec_toUInt64]
+    apply congrArg (BitVec.setWidth 64)
+    apply BitVec.eq_of_getLsbD_eq
+    intro index bound
+    simp only [Width.bits] at bound
+    simp only [BitVec.getLsbD_setWidth, BitVec.getLsbD_signExtend, Width.bits]
+    simp [bound, show index < 32 by omega, show index < 64 by omega]
+
+theorem spill_bound (slot : StackSlot) : 0 < slot.displacement.toNat ∧ slot.displacement.toNat < 2 ^ 31 := by
+  have bound := slot.index.toNat_lt_size
+  simp only [StackSlot.displacement, UInt64.toNat_mul, UInt64.toNat_add, UInt16.toNat_toUInt64]
+  change 0 < (((slot.index.toNat + 1) % 18446744073709551616) * 8) % 18446744073709551616 ∧
+    (((slot.index.toNat + 1) % 18446744073709551616) * 8) % 18446744073709551616 < 2147483648
+  simp only [UInt16.size] at bound
+  omega
+
+theorem signExtend32_ofInt (value : Int) (fits : fitsSigned32 value = true) :
+    (signExtend32 (Int32.ofInt value).toUInt32).toBitVec = BitVec.ofInt 64 value := by
+  simp only [fitsSigned32, decide_eq_true_eq] at fits
+  rw [signExtend32_bits]
+  change (BitVec.ofInt 32 value).signExtend 64 = _
+  unfold BitVec.signExtend
+  rw [BitVec.toInt_ofInt_eq_self (by decide : 0 < 32) fits.1 fits.2]
+
+theorem signExtend32_neg (value : Word) (bound : value.toNat < 2 ^ 31) :
+    signExtend32 (0 - value).toUInt32 = 0 - value := by
+  have fits : fitsSigned32 (-(value.toNat : Int)) = true := by
+    simp only [fitsSigned32, decide_eq_true_eq]
+    omega
+  have raw : (Int32.ofInt (-(value.toNat : Int))).toUInt32 = (0 - value).toUInt32 := by
+    apply UInt32.toBitVec_inj.mp
+    simp [UInt64.toBitVec_toUInt32, BitVec.neg_eq_not_add]
+    rfl
+  apply UInt64.toBitVec_inj.mp
+  rw [← raw, signExtend32_ofInt _ fits]
+  simp [BitVec.ofInt_neg]
+
+@[simp] theorem spillAddress_eval (slot : StackSlot) (core : Core) :
+    (spillAddress slot).eval core = core.readReg .rbp - slot.displacement := by
+  simp only [spillAddress, MemAddr.eval, UInt64.add_zero]
+  rw [signExtend32_neg _ (spill_bound slot).2]
+  simp [UInt64.sub_eq_add_neg]
+
+end Ix.Compiler.X86.Encode
diff --git a/Ix/Compiler/X86/Eval.lean b/Ix/Compiler/X86/Eval.lean
new file mode 100644
index 000000000..0943491ad
--- /dev/null
+++ b/Ix/Compiler/X86/Eval.lean
@@ -0,0 +1,513 @@
+import Ix.Compiler.X86.Basic
+
+/-!
+# Executable local semantics for the typed x86-64 v0 fragment
+
+The model is intentionally architectural where the first encoder bridge needs
+it to be: fixed-width registers, little-endian byte memory, observable `rsp`
+effects, call return slots, and normal/trap outcomes.  A PC is still a symbolic
+block/operation pair.  Calls store its stable 64-bit structural token in the
+modeled stack; the later layout proof relates that token to the encoded return
+RIP.
+
+Runtime intrinsics are supplied as an explicit semantic parameter.  Their
+result type can mutate memory and caller-saved registers only, so preservation
+of the System V callee-saved set and `rsp` is structural rather than a promise
+made by an opaque callback.
+
+`misalignedCall`, `stackMismatch`, `corruptReturn`, and
+`calleeSavedClobber` are compiler/ABI contract failures, not claims that the
+processor raises corresponding architectural exceptions. A native refinement
+must prove those cases unreachable. Likewise, a top-level `ret` is observed as
+halt rather than executing the surrounding harness's return instruction.
+-/
+
+namespace Ix.Compiler.X86
+
+abbrev Registers := GPR → Word
+
+inductive AccessKind where
+  | read | write
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure MemoryFault where
+  access : AccessKind
+  address : Word
+  bytes : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- Byte memory with explicit read/write mappings.  Permissions are checked
+for every byte touched, including call return slots and spill accesses. -/
+structure Memory where
+  bytes : Word → UInt8
+  readable : Word → Bool
+  writable : Word → Bool
+
+namespace Registers
+
+def zero : Registers := fun _ => 0
+
+def set (registers : Registers) (register : GPR) (value : Word) : Registers :=
+  fun candidate => if candidate == register then value else registers candidate
+
+end Registers
+
+namespace Memory
+
+def flat : Memory :=
+  { bytes := fun _ => 0
+    readable := fun _ => true
+    writable := fun _ => true }
+
+def unmapped : Memory :=
+  { bytes := fun _ => 0
+    readable := fun _ => false
+    writable := fun _ => false }
+
+def writeByte (memory : Memory) (address : Word) (value : UInt8) : Memory :=
+  { memory with
+    bytes := fun candidate =>
+      if candidate == address then value else memory.bytes candidate }
+
+def rangeAllowed (permission : Word → Bool) (address : Word) : Nat → Bool
+  | 0 => true
+  | count + 1 =>
+      rangeAllowed permission address count &&
+        permission (address + UInt64.ofNat count)
+
+def readLittle (memory : Memory) (address : Word) : Nat → Word
+  | 0 => 0
+  | count + 1 =>
+      memory.readLittle address count |||
+        (memory.bytes (address + UInt64.ofNat count)).toUInt64 <<<
+          UInt64.ofNat (8 * count)
+
+def writeLittle (memory : Memory) (address value : Word) : Nat → Memory
+  | 0 => memory
+  | count + 1 =>
+      (memory.writeLittle address value count).writeByte
+        (address + UInt64.ofNat count)
+        ((value >>> UInt64.ofNat (8 * count)).toUInt8)
+
+def read (memory : Memory) (width : Width) (address : Word) : Word :=
+  memory.readLittle address width.bytes
+
+def write (memory : Memory) (width : Width) (address value : Word) : Memory :=
+  memory.writeLittle address value width.bytes
+
+def read64 (memory : Memory) (address : Word) : Word :=
+  memory.read .w64 address
+
+def write64 (memory : Memory) (address value : Word) : Memory :=
+  memory.write .w64 address value
+
+def read? (memory : Memory) (width : Width) (address : Word) :
+    Except MemoryFault Word :=
+  if Memory.rangeAllowed memory.readable address width.bytes then
+    .ok (memory.read width address)
+  else
+    .error { access := .read, address, bytes := width.bytes }
+
+def write? (memory : Memory) (width : Width) (address value : Word) :
+    Except MemoryFault Memory :=
+  if Memory.rangeAllowed memory.writable address width.bytes then
+    .ok (memory.write width address value)
+  else
+    .error { access := .write, address, bytes := width.bytes }
+
+def read64? (memory : Memory) (address : Word) : Except MemoryFault Word :=
+  memory.read? .w64 address
+
+def write64? (memory : Memory) (address value : Word) :
+    Except MemoryFault Memory :=
+  memory.write? .w64 address value
+
+end Memory
+
+def signExtend32 (value : Imm32) : Word :=
+  let raw := value.toUInt64
+  if value < 0x80000000 then raw else raw ||| 0xffffffff00000000
+
+def Width.truncate (width : Width) (value : Word) : Word :=
+  value &&& width.mask
+
+/-- Signed mathematical interpretation of the low `width` bits. -/
+def Width.signedValue (width : Width) (value : Word) : Int :=
+  let unsigned := (width.truncate value).toNat
+  let sign := 2 ^ (width.bits - 1)
+  let modulus := 2 ^ width.bits
+  if unsigned < sign then
+    Int.ofNat unsigned
+  else
+    Int.ofNat unsigned - Int.ofNat modulus
+
+structure Core where
+  registers : Registers
+  memory : Memory
+
+namespace Core
+
+def empty (stackTop : Word := 0) : Core :=
+  { registers := Registers.zero.set .rsp stackTop
+    memory := Memory.flat }
+
+def readReg (core : Core) (register : GPR) : Word :=
+  core.registers register
+
+def setReg (core : Core) (register : GPR) (value : Word) : Core :=
+  { core with registers := core.registers.set register value }
+
+/-- Architectural low-register writes: 32-bit destinations clear their upper
+half, while 8/16-bit destinations preserve it. -/
+def writeReg (core : Core) (width : Width) (register : GPR)
+    (value : Word) : Core :=
+  match width with
+  | .w64 => core.setReg register value
+  | .w32 => core.setReg register (width.truncate value)
+  | .w8 | .w16 =>
+      let old := core.readReg register
+      let highMask := 0xffffffffffffffff ^^^ width.mask
+      core.setReg register
+        ((old &&& highMask) ||| width.truncate value)
+
+def loadReg? (core : Core) (width : Width) (register : GPR)
+    (address : Word) : Except MemoryFault Core := do
+  let value ← core.memory.read? width address
+  return core.setReg register (width.truncate value)
+
+def storeReg? (core : Core) (width : Width) (address : Word)
+    (register : GPR) : Except MemoryFault Core := do
+  let memory ← core.memory.write? width address (core.readReg register)
+  return { core with memory }
+
+end Core
+
+def MemAddr.eval (address : MemAddr) (core : Core) : Word :=
+  let base := match address.base with
+    | none => 0
+    | some register => core.readReg register
+  let index := match address.index with
+    | none => 0
+    | some register => core.readReg register.gpr * address.scale.word
+  base + index + signExtend32 address.displacement
+
+def MoveSource.eval (source : MoveSource) (core : Core) : Word :=
+  match source with
+  | .reg register => core.readReg register
+  | .imm value => value
+
+def AluSource.eval (source : AluSource) (core : Core) : Word :=
+  match source with
+  | .reg register => core.readReg register
+  | .imm value => signExtend32 value
+
+def AluOp.eval (operation : AluOp) (left right : Word) : Word :=
+  match operation with
+  | .add => left + right
+  | .sub => left - right
+  | .and => left &&& right
+  | .or => left ||| right
+  | .xor => left ^^^ right
+
+def Condition.holds (condition : Condition) (width : Width)
+    (left right : Word) : Bool :=
+  let leftUnsigned := width.truncate left
+  let rightUnsigned := width.truncate right
+  match condition with
+  | .eq => leftUnsigned == rightUnsigned
+  | .ne => leftUnsigned != rightUnsigned
+  | .unsignedLt => decide (leftUnsigned < rightUnsigned)
+  | .unsignedLe => decide (leftUnsigned ≤ rightUnsigned)
+  | .unsignedGt => decide (leftUnsigned > rightUnsigned)
+  | .unsignedGe => decide (leftUnsigned ≥ rightUnsigned)
+  | .signedLt => decide (width.signedValue left < width.signedValue right)
+  | .signedLe => decide (width.signedValue left ≤ width.signedValue right)
+  | .signedGt => decide (width.signedValue left > width.signedValue right)
+  | .signedGe => decide (width.signedValue left ≥ width.signedValue right)
+
+def Compare.holds (comparison : Compare) (condition : Condition)
+    (core : Core) : Bool :=
+  condition.holds comparison.width (core.readReg comparison.left)
+    (comparison.right.eval core)
+
+/-- Symbolic instruction position.  Its encoding is a stable stack token, not
+an emitted byte address; encoder correctness will relate the two. -/
+structure PC where
+  block : BlockId
+  offset : UInt32
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def PC.encode (pc : PC) : Word :=
+  (pc.block.toUInt64 <<< 32) ||| pc.offset.toUInt64
+
+def PC.decode (word : Word) : PC :=
+  { block := (word >>> 32).toUInt32
+    offset := word.toUInt32 }
+
+def PC.next? (pc : PC) : Option PC :=
+  if pc.offset == (0xffffffff : UInt32) then
+    none
+  else
+    some { pc with offset := pc.offset + 1 }
+
+structure ReturnFrame where
+  continuation : PC
+  returnSlot : Word
+  calleeSaved : Array Word
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Trap where
+  | invalidBlock (block : BlockId)
+  | invalidOffset (pc : PC)
+  | pcOverflow (pc : PC)
+  | memoryFault (fault : MemoryFault)
+  | misalignedCall (stack : Word)
+  | stackMismatch (expected actual : Word)
+  | corruptReturn (expected actual : Word)
+  | calleeSavedClobber
+  | intrinsicFailure (intrinsic : Intrinsic) (code : Nat)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+inductive Status where
+  | running
+  | halted (result : Word)
+  | trapped (fault : Trap)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Machine where
+  core : Core
+  pc : PC
+  returns : List ReturnFrame
+  status : Status
+
+/-- An intrinsic can change memory, the result register, and caller-saved
+registers.  There is no field through which it can mutate `rsp` or a
+callee-saved register. -/
+structure IntrinsicResult where
+  memory : Memory
+  result : Word
+  clobber : GPR → Word
+
+structure Runtime where
+  invoke : Intrinsic → Array Word → Memory →
+    Except Nat IntrinsicResult
+
+def Runtime.rejecting : Runtime where
+  invoke intrinsic _ _ := .error intrinsic.arity
+
+def Core.calleeSavedSnapshot (core : Core) : Array Word :=
+  SysV.calleeSaved.map core.readReg
+
+def Core.calleeSavedMatch (core : Core) (snapshot : Array Word) : Bool :=
+  core.calleeSavedSnapshot == snapshot
+
+def Core.intrinsicArguments (core : Core) (intrinsic : Intrinsic) : Array Word :=
+  (List.range intrinsic.arity).toArray.map fun index =>
+    match SysV.argumentRegister? index with
+    | some register => core.readReg register
+    | none => 0
+
+def Core.applyIntrinsicResult (core : Core)
+    (result : IntrinsicResult) : Core :=
+  { memory := result.memory
+    registers := fun register =>
+      if register == SysV.resultRegister then
+        result.result
+      else if SysV.isCallerSaved register then
+        result.clobber register
+      else
+        core.readReg register }
+
+/-- An atomic runtime call cannot change the architectural stack pointer. -/
+@[simp] theorem Core.applyIntrinsicResult_rsp (core : Core)
+    (result : IntrinsicResult) :
+    (core.applyIntrinsicResult result).readReg .rsp = core.readReg .rsp := by
+  simp [Core.applyIntrinsicResult, Core.readReg, SysV.isCallerSaved,
+    SysV.callerSaved, SysV.resultRegister]
+
+/-- An atomic runtime call preserves the complete System V callee-saved
+snapshot by construction. -/
+@[simp] theorem Core.applyIntrinsicResult_calleeSaved (core : Core)
+    (result : IntrinsicResult) :
+    (core.applyIntrinsicResult result).calleeSavedSnapshot =
+      core.calleeSavedSnapshot := by
+  simp [Core.calleeSavedSnapshot, SysV.calleeSaved,
+    Core.applyIntrinsicResult, Core.readReg, SysV.isCallerSaved,
+    SysV.callerSaved, SysV.resultRegister]
+
+def Machine.trap (machine : Machine) (fault : Trap) : Machine :=
+  { machine with status := .trapped fault }
+
+def Machine.advanceWith (machine : Machine) (core : Core) : Machine :=
+  match machine.pc.next? with
+  | none => machine.trap (.pcOverflow machine.pc)
+  | some next => { machine with core, pc := next }
+
+def Machine.goto (checked : Checked) (machine : Machine)
+    (target : BlockId) : Machine :=
+  if checked.program.hasBlock target then
+    { machine with pc := { block := target, offset := 0 } }
+  else
+    machine.trap (.invalidBlock target)
+
+def executeInstr (runtime : Runtime) (checked : Checked)
+    (instruction : Instr) (machine : Machine) : Machine :=
+  let core := machine.core
+  match instruction with
+  | .mov width destination source =>
+      machine.advanceWith (core.writeReg width destination (source.eval core))
+  | .load width destination source =>
+      match core.loadReg? width destination (source.eval core) with
+      | .error fault => machine.trap (.memoryFault fault)
+      | .ok loaded => machine.advanceWith loaded
+  | .store width destination source =>
+      match core.storeReg? width (destination.eval core) source with
+      | .error fault => machine.trap (.memoryFault fault)
+      | .ok stored => machine.advanceWith stored
+  | .lea destination source =>
+      machine.advanceWith (core.setReg destination (source.eval core))
+  | .alu operation width destination source =>
+      machine.advanceWith
+        (core.writeReg width destination
+          (operation.eval (core.readReg destination) (source.eval core)))
+  | .imul width destination source =>
+      machine.advanceWith
+        (core.writeReg width.width destination
+          (core.readReg destination * core.readReg source))
+  | .push source =>
+      let stack := core.readReg .rsp - 8
+      match core.memory.write64? stack (core.readReg source) with
+      | .error fault => machine.trap (.memoryFault fault)
+      | .ok memory =>
+          machine.advanceWith { core.setReg .rsp stack with memory }
+  | .pop destination =>
+      let stack := core.readReg .rsp
+      match core.memory.read64? stack with
+      | .error fault => machine.trap (.memoryFault fault)
+      | .ok value =>
+          let popped := (core.setReg .rsp (stack + 8)).setReg destination value
+          machine.advanceWith popped
+  | .allocFrame size =>
+      machine.advanceWith
+        (core.setReg .rsp (core.readReg .rsp - size.bytes))
+  | .freeFrame size =>
+      machine.advanceWith
+        (core.setReg .rsp (core.readReg .rsp + size.bytes))
+  | .spill slot source =>
+      let address := core.readReg .rbp - slot.displacement
+      match core.storeReg? .w64 address source with
+      | .error fault => machine.trap (.memoryFault fault)
+      | .ok stored => machine.advanceWith stored
+  | .reload destination slot =>
+      let address := core.readReg .rbp - slot.displacement
+      match core.loadReg? .w64 destination address with
+      | .error fault => machine.trap (.memoryFault fault)
+      | .ok loaded => machine.advanceWith loaded
+  | .call target =>
+      if !SysV.callSiteAligned (core.readReg .rsp) then
+        machine.trap (.misalignedCall (core.readReg .rsp))
+      else if checked.program.hasBlock target then
+        match machine.pc.next? with
+        | none => machine.trap (.pcOverflow machine.pc)
+        | some continuation =>
+            let stack := core.readReg .rsp - 8
+            match core.memory.write64? stack continuation.encode with
+            | .error fault => machine.trap (.memoryFault fault)
+            | .ok memory =>
+                let frame : ReturnFrame :=
+                  { continuation
+                    returnSlot := stack
+                    calleeSaved := core.calleeSavedSnapshot }
+                let called := { core.setReg .rsp stack with memory }
+                { machine with
+                  core := called
+                  pc := { block := target, offset := 0 }
+                  returns := frame :: machine.returns }
+      else
+        machine.trap (.invalidBlock target)
+  | .callRuntime intrinsic =>
+      if !SysV.callSiteAligned (core.readReg .rsp) then
+        machine.trap (.misalignedCall (core.readReg .rsp))
+      else
+        match runtime.invoke intrinsic (core.intrinsicArguments intrinsic)
+            core.memory with
+        | .error code => machine.trap (.intrinsicFailure intrinsic code)
+        | .ok result => machine.advanceWith (core.applyIntrinsicResult result)
+
+def executeTerminator (checked : Checked) (terminator : Terminator)
+    (machine : Machine) : Machine :=
+  let core := machine.core
+  match terminator with
+  | .jump target => machine.goto checked target
+  | .branch comparison condition ifTrue ifFalse =>
+      machine.goto checked
+        (if comparison.holds condition core then ifTrue else ifFalse)
+  | .tailCall target => machine.goto checked target
+  | .ret =>
+      match machine.returns with
+      | [] => { machine with status := .halted (core.readReg .rax) }
+      | frame :: returns =>
+          let stack := core.readReg .rsp
+          if stack != frame.returnSlot then
+            machine.trap (.stackMismatch frame.returnSlot stack)
+          else
+            match core.memory.read64? stack with
+            | .error fault => machine.trap (.memoryFault fault)
+            | .ok actual =>
+                let expected := frame.continuation.encode
+                if actual != expected then
+                  machine.trap (.corruptReturn expected actual)
+                else if !core.calleeSavedMatch frame.calleeSaved then
+                  machine.trap .calleeSavedClobber
+                else
+                  { machine with
+                    core := core.setReg .rsp (stack + 8)
+                    pc := frame.continuation
+                    returns }
+
+def Machine.initial (checked : Checked) (core : Core) : Machine :=
+  { core
+    pc := { block := checked.program.entry, offset := 0 }
+    returns := []
+    status := .running }
+
+/-- One target step.  A block's terminator occupies the position immediately
+after its instruction array. -/
+def step (runtime : Runtime) (checked : Checked)
+    (machine : Machine) : Machine :=
+  match machine.status with
+  | .halted _ | .trapped _ => machine
+  | .running =>
+      match checked.program.blocks[machine.pc.block.toNat]? with
+      | none => machine.trap (.invalidBlock machine.pc.block)
+      | some block =>
+          match block.instructions[machine.pc.offset.toNat]? with
+          | some instruction => executeInstr runtime checked instruction machine
+          | none =>
+              if machine.pc.offset.toNat == block.instructions.size then
+                executeTerminator checked block.terminator machine
+              else
+                machine.trap (.invalidOffset machine.pc)
+
+def run (runtime : Runtime) (checked : Checked) : Nat → Machine → Machine
+  | 0, machine => machine
+  | fuel + 1, machine =>
+      let next := step runtime checked machine
+      match next.status with
+      | .running => run runtime checked fuel next
+      | .halted _ | .trapped _ => next
+
+def runFrom (runtime : Runtime) (checked : Checked) (fuel : Nat)
+    (core : Core) : Machine :=
+  run runtime checked fuel (Machine.initial checked core)
+
+/-- Finished target states are stable under a further local step. -/
+theorem step_of_not_running (runtime : Runtime) (checked : Checked)
+    (machine : Machine) (notRunning : machine.status ≠ .running) :
+    step runtime checked machine = machine := by
+  cases status : machine.status with
+  | running => exact False.elim (notRunning status)
+  | halted result => simp [step, status]
+  | trapped fault => simp [step, status]
+
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/EvalExamples.lean b/Ix/Compiler/X86/EvalExamples.lean
new file mode 100644
index 000000000..3a6414f5f
--- /dev/null
+++ b/Ix/Compiler/X86/EvalExamples.lean
@@ -0,0 +1,178 @@
+import Ix.Compiler.X86.Eval
+
+/-! Executable checks for the local x86-64 v0 target semantics. -/
+
+namespace Ix.Compiler.X86.Examples
+
+#guard SysV.functionEntryAligned 0x1008
+#guard SysV.callSiteAligned (0x1008 - 8)
+
+def runStatus (program : Program) (runtime : Runtime) (fuel : Nat)
+    (core : Core) : Option Status :=
+  match program.check with
+  | .error _ => none
+  | .ok checked => some (runFrom runtime checked fuel core).status
+
+def arithmeticProgram : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[
+          .mov .w64 .rax (.imm 40),
+          .alu .add .w64 .rax (.imm 2)]
+        terminator :=
+          .branch
+            { width := .w64, left := .rax, right := .imm 42 }
+            .eq 1 2 },
+      { instructions := #[], terminator := .ret },
+      { instructions := #[.mov .w64 .rax (.imm 0)],
+        terminator := .ret }] }
+
+def arithmeticBranchAccepted : Bool :=
+  runStatus arithmeticProgram Runtime.rejecting 8 (Core.empty 0x1008) ==
+    some (.halted 42)
+
+#guard arithmeticBranchAccepted
+
+def stackProgram : Program :=
+  let frame : FrameSize := { units16 := 1 }
+  let slot : StackSlot := { index := 0 }
+  { entry := 0
+    blocks := #[
+      { instructions := #[
+          .push .rbp,
+          .mov .w64 .rbp (.reg .rsp),
+          .allocFrame frame,
+          .mov .w64 .rax (.imm 21),
+          .spill slot .rax,
+          .mov .w64 .rax (.imm 0),
+          .reload .rax slot,
+          .alu .add .w64 .rax (.imm 21),
+          .freeFrame frame,
+          .pop .rbp]
+        terminator := .ret }] }
+
+def stackRoundtripAccepted : Bool :=
+  match stackProgram.check with
+  | .error _ => false
+  | .ok checked =>
+      let result := runFrom Runtime.rejecting checked 16 (Core.empty 0x1008)
+      result.status == .halted 42 &&
+        result.core.readReg .rsp == 0x1008 &&
+        result.core.readReg .rbp == 0
+
+#guard stackRoundtripAccepted
+
+def callProgram : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[
+          .push .rbp,
+          .call 1,
+          .pop .rbp,
+          .alu .add .w64 .rax (.imm 2)]
+        terminator := .ret },
+      { instructions := #[.mov .w64 .rax (.imm 40)]
+        terminator := .ret }] }
+
+def directCallAccepted : Bool :=
+  match callProgram.check with
+  | .error _ => false
+  | .ok checked =>
+      let result := runFrom Runtime.rejecting checked 10 (Core.empty 0x1008)
+      result.status == .halted 42 &&
+        result.core.readReg .rsp == 0x1008 &&
+        result.returns.isEmpty
+
+#guard directCallAccepted
+
+def clobberProgram : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[.push .rbp, .call 1, .pop .rbp], terminator := .ret },
+      { instructions := #[.mov .w64 .rbx (.imm 1)], terminator := .ret }] }
+
+def calleeSavedViolationTraps : Bool :=
+  runStatus clobberProgram Runtime.rejecting 8 (Core.empty 0x1008) ==
+    some (.trapped .calleeSavedClobber)
+
+#guard calleeSavedViolationTraps
+
+def fixtureRuntime : Runtime where
+  invoke intrinsic arguments memory :=
+    match intrinsic with
+    | .allocate =>
+        if arguments == #[16, 8] then
+          .ok
+            { memory
+              result := 0x2000
+              clobber := fun _ => 0 }
+        else
+          .error 1
+    | _ => .error 2
+
+def runtimeProgram : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[
+          .push .rbp,
+          .mov .w64 .rdi (.imm 16),
+          .mov .w64 .rsi (.imm 8),
+          .callRuntime .allocate,
+          .pop .rbp]
+        terminator := .ret }] }
+
+def runtimeCallAccepted : Bool :=
+  runStatus runtimeProgram fixtureRuntime 10 (Core.empty 0x1008) ==
+    some (.halted 0x2000)
+
+#guard runtimeCallAccepted
+
+def invalidTargetProgram : Program :=
+  { entry := 0
+    blocks := #[{ instructions := #[], terminator := .jump 1 }] }
+
+def invalidTargetRejected : Bool :=
+  match invalidTargetProgram.check with
+  | .error .malformedControl => true
+  | _ => false
+
+#guard invalidTargetRejected
+
+def littleEndianAccepted : Bool :=
+  let memory := Memory.flat.write64 0x100 0x8877665544332211
+  memory.bytes 0x100 == 0x11 &&
+    memory.bytes 0x107 == 0x88 &&
+    memory.read64 0x100 == 0x8877665544332211
+
+#guard littleEndianAccepted
+
+def unmappedLoadProgram : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[
+          .load .w64 .rax { base := none, displacement := 0x100 }]
+        terminator := .ret }] }
+
+def unmappedLoadTraps : Bool :=
+  match unmappedLoadProgram.check with
+  | .error _ => false
+  | .ok checked =>
+      let core : Core :=
+        { registers := Registers.zero.set .rsp 0x1000
+          memory := Memory.unmapped }
+      (runFrom Runtime.rejecting checked 4 core).status ==
+        .trapped (.memoryFault
+          { access := .read, address := 0x100, bytes := 8 })
+
+#guard unmappedLoadTraps
+
+def misalignedCallTraps : Bool :=
+  runStatus callProgram Runtime.rejecting 3 (Core.empty 0x1000) ==
+    some (.trapped (.misalignedCall 0x0ff8))
+
+#guard misalignedCallTraps
+
+example : arithmeticProgram.InV0 := arithmeticProgram.inV0
+example : callProgram.InV0 := callProgram.inV0
+
+end Ix.Compiler.X86.Examples
diff --git a/Ix/Compiler/X86/ExactNat.lean b/Ix/Compiler/X86/ExactNat.lean
new file mode 100644
index 000000000..74ac21dcd
--- /dev/null
+++ b/Ix/Compiler/X86/ExactNat.lean
@@ -0,0 +1,108 @@
+import Ix.Compiler.X86.Execution
+
+/-! Exact unsigned scalar arithmetic. The external Nat interface checks its
+conversion before entering native code. A native ADD reports overflow; a SUB
+uses an unsigned comparison to implement Nat's truncation at zero. Neither
+contract treats a wrapped machine result as an exact natural number. -/
+
+namespace Ix.Compiler.X86.ExactNat
+
+def encode (value : Nat) : Option Word :=
+  if value < UInt64.size then some (UInt64.ofNat value) else none
+
+theorem encode_some_iff {value : Nat} {word : Word} :
+    encode value = some word ↔ word.toNat = value := by
+  constructor
+  · intro accepted
+    unfold encode at accepted
+    split at accepted
+    next bound =>
+      cases Option.some.inj accepted
+      exact UInt64.toNat_ofNat_of_lt' bound
+    next => contradiction
+  · intro represented
+    have bound : value < UInt64.size := represented ▸ word.toNat_lt_size
+    simp only [encode, if_pos bound, Option.some.injEq]
+    apply UInt64.toNat_inj.mp
+    rw [UInt64.toNat_ofNat_of_lt' bound, represented]
+
+theorem encode_none_iff (value : Nat) :
+    encode value = none ↔ UInt64.size ≤ value := by
+  simp [encode]
+
+@[simp] theorem encode_toNat (word : Word) : encode word.toNat = some word :=
+  encode_some_iff.mpr rfl
+
+/-- This is the unsigned carry test emitted after ADD. -/
+def overflow (left right : Word) : Bool := decide (left + right < left)
+
+theorem overflow_iff (left right : Word) :
+    overflow left right = true ↔ UInt64.size ≤ left.toNat + right.toNat := by
+  have hl := left.toNat_lt_size
+  have hr := right.toNat_lt_size
+  simp only [overflow, decide_eq_true_eq, UInt64.lt_iff_toNat_lt, UInt64.toNat_add]
+  change (left.toNat + right.toNat) % UInt64.size < left.toNat ↔ _
+  simp only [UInt64.size] at *
+  omega
+
+def add (left right : Word) : Option Word :=
+  if overflow left right then none else some (left + right)
+
+theorem add_none_iff (left right : Word) :
+    add left right = none ↔ UInt64.size ≤ left.toNat + right.toNat := by
+  simp only [add]
+  split <;> simp_all [overflow_iff]
+
+theorem add_some_iff {left right result : Word} :
+    add left right = some result ↔ result.toNat = left.toNat + right.toNat := by
+  constructor
+  · intro accepted
+    unfold add at accepted
+    split at accepted
+    next => contradiction
+    next noOverflow =>
+      cases Option.some.inj accepted
+      have bound : left.toNat + right.toNat < UInt64.size := by
+        exact Nat.lt_of_not_ge (fun h => noOverflow ((overflow_iff left right).mpr h))
+      exact (UInt64.toNat_add left right).trans (Nat.mod_eq_of_lt bound)
+  · intro represented
+    have bound : left.toNat + right.toNat < UInt64.size := represented ▸ result.toNat_lt_size
+    have noOverflow : overflow left right = false := by
+      have := overflow_iff left right
+      cases h : overflow left right <;> simp_all <;> omega
+    simp only [add, noOverflow, Bool.false_eq_true, ↓reduceIte, Option.some.injEq]
+    apply UInt64.toNat_inj.mp
+    rw [UInt64.toNat_add, Nat.mod_eq_of_lt bound, represented]
+
+/-- Truncated Nat subtraction, including the underflow case. -/
+def sub (left right : Word) : Word :=
+  if left < right then 0 else left - right
+
+theorem sub_toNat (left right : Word) :
+    (sub left right).toNat = left.toNat - right.toNat := by
+  unfold sub
+  split
+  next less =>
+    have less := UInt64.lt_iff_toNat_lt.mp less
+    simp only [UInt64.toNat_zero]
+    omega
+  next ge =>
+    exact UInt64.toNat_sub_of_le _ _ (UInt64.le_iff_toNat_le.mpr (by
+      exact Nat.le_of_not_gt (fun h => ge (UInt64.lt_iff_toNat_lt.mpr h))))
+
+theorem successor_exact {value : Word} (bound : value.toNat + 1 < UInt64.size) :
+    (value + 1).toNat = value.toNat + 1 := by
+  simpa only [UInt64.toNat_one] using
+    (UInt64.toNat_add value 1).trans (Nat.mod_eq_of_lt bound)
+
+theorem predecessor_exact {value : Word} (positive : value ≠ 0) :
+    (value - 1).toNat = value.toNat - 1 := by
+  have nonzero : value.toNat ≠ 0 := by
+    intro h
+    exact positive (UInt64.toNat_inj.mp h)
+  have : (1 : Word) ≤ value := UInt64.le_iff_toNat_le.mpr (by
+    change 1 ≤ value.toNat
+    omega)
+  simpa only [UInt64.toNat_one] using UInt64.toNat_sub_of_le value 1 this
+
+end Ix.Compiler.X86.ExactNat
diff --git a/Ix/Compiler/X86/Execution.lean b/Ix/Compiler/X86/Execution.lean
new file mode 100644
index 000000000..4baee6364
--- /dev/null
+++ b/Ix/Compiler/X86/Execution.lean
@@ -0,0 +1,234 @@
+import Ix.Compiler.X86.Memory
+
+/-! Finite execution and straight-line composition for the existing typed
+x86 evaluator. Instruction effects below are propositions about `executeInstr`;
+there is no additional instruction interpreter or runtime assumption. -/
+
+namespace Ix.Compiler.X86
+
+theorem run_of_not_running (runtime : Runtime) (checked : Checked) (fuel : Nat)
+    (machine : Machine) (finished : machine.status ≠ .running) :
+    run runtime checked fuel machine = machine := by
+  cases fuel with
+  | zero => rfl
+  | succ fuel =>
+      rw [run, step_of_not_running _ _ _ finished]
+      cases status : machine.status with
+      | running => exact False.elim (finished status)
+      | halted result => rfl
+      | trapped fault => rfl
+
+theorem run_succ (runtime : Runtime) (checked : Checked) (fuel : Nat) (machine : Machine) :
+    run runtime checked (fuel + 1) machine = run runtime checked fuel (step runtime checked machine) := by
+  rw [run]
+  cases status : (step runtime checked machine).status with
+  | running => rfl
+  | halted result => exact (run_of_not_running _ _ _ _ (by simp [status])).symm
+  | trapped fault => exact (run_of_not_running _ _ _ _ (by simp [status])).symm
+
+theorem run_add (runtime : Runtime) (checked : Checked) (first second : Nat) (machine : Machine) :
+    run runtime checked (first + second) machine =
+      run runtime checked second (run runtime checked first machine) := by
+  induction first generalizing machine with
+  | zero => simp [run]
+  | succ first ih =>
+      rw [Nat.succ_add, run_succ, run_succ, ih]
+
+/-- A terminating run has no trapped prefix, since faults are absorbing in
+the existing evaluator. This includes memory and ABI contract faults. -/
+theorem run_prefix_not_trapped {runtime : Runtime} {checked : Checked} {count : Nat}
+    {before after : Machine} {result : Word}
+    (execution : run runtime checked count before = after) (halted : after.status = .halted result)
+    (prefixCount : Nat) (bound : prefixCount ≤ count) (fault : Trap) :
+    (run runtime checked prefixCount before).status ≠ .trapped fault := by
+  intro trapped
+  have split : count = prefixCount + (count - prefixCount) := by omega
+  rw [split, run_add] at execution
+  rw [run_of_not_running _ _ _ _ (by simp [trapped])] at execution
+  rw [← execution, trapped] at halted
+  contradiction
+
+inductive Steps (runtime : Runtime) (checked : Checked) : Nat → Machine → Machine → Prop where
+  | refl (machine) : Steps runtime checked 0 machine machine
+  | cons {before middle after : Machine} {count : Nat}
+      (first : step runtime checked before = middle)
+      (rest : Steps runtime checked count middle after) : Steps runtime checked (count + 1) before after
+
+theorem Steps.append {runtime : Runtime} {checked : Checked} {first second : Nat}
+    {before middle after : Machine} (left : Steps runtime checked first before middle)
+    (right : Steps runtime checked second middle after) :
+    Steps runtime checked (first + second) before after := by
+  induction left with
+  | refl => simpa using right
+  | cons one rest ih => simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using Steps.cons one (ih right)
+
+theorem Steps.run_eq {runtime : Runtime} {checked : Checked} {count : Nat}
+    {before after : Machine} (steps : Steps runtime checked count before after) :
+    run runtime checked count before = after := by
+  induction steps with
+  | refl => rfl
+  | cons first rest ih => rw [run_succ, first, ih]
+
+theorem Steps.single {runtime : Runtime} {checked : Checked} {before after : Machine}
+    (one : step runtime checked before = after) : Steps runtime checked 1 before after :=
+  .cons one (.refl after)
+
+/-- A running leaf state at a natural-number instruction offset. -/
+def leaf (core : Core) (block : BlockId) (offset : Nat) : Machine :=
+  { core, pc := { block, offset := UInt32.ofNat offset }, returns := [], status := .running }
+
+def haltedLeaf (core : Core) (block : BlockId) (offset : Nat) : Machine :=
+  { leaf core block offset with status := .halted (core.readReg .rax) }
+
+/-- Lookup evidence for a complete emitted block, including a nonwrapping PC. -/
+structure BlockCode (checked : Checked) (block : BlockId) (instructions : List Instr)
+    (terminator : Terminator) : Prop where
+  found : checked.program.blocks[block.toNat]? =
+    some { instructions := instructions.toArray, terminator }
+  fits : instructions.length < UInt32.size
+
+theorem BlockCode.terminator {checked : Checked} {block : BlockId} {instructions : List Instr}
+    {terminator : Terminator} (code : BlockCode checked block instructions terminator)
+    (runtime : Runtime) (core : Core) :
+    step runtime checked (leaf core block instructions.length) =
+      executeTerminator checked terminator (leaf core block instructions.length) := by
+  simp [step, leaf, UInt32.toNat_ofNat_of_lt' code.fits, code.found]
+
+theorem BlockCode.jump {checked : Checked} {block target : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions (.jump target))
+    (valid : checked.program.hasBlock target = true) (runtime : Runtime) (core : Core) :
+    step runtime checked (leaf core block instructions.length) = leaf core target 0 := by
+  rw [code.terminator]
+  simp [executeTerminator, Machine.goto, valid, leaf]
+
+theorem BlockCode.branch {checked : Checked} {block yes no : BlockId} {instructions : List Instr}
+    {comparison : Compare} {condition : Condition}
+    (code : BlockCode checked block instructions (.branch comparison condition yes no))
+    (runtime : Runtime) (core : Core) (answer : Bool)
+    (holds : comparison.holds condition core = answer)
+    (valid : checked.program.hasBlock (if answer then yes else no) = true) :
+    step runtime checked (leaf core block instructions.length) =
+      leaf core (if answer then yes else no) 0 := by
+  rw [code.terminator]
+  simp [executeTerminator, leaf, holds, Machine.goto, valid]
+
+theorem BlockCode.ret {checked : Checked} {block : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions .ret) (runtime : Runtime) (core : Core) :
+    step runtime checked (leaf core block instructions.length) = haltedLeaf core block instructions.length := by
+  rw [code.terminator]
+  rfl
+
+theorem leaf_advance (core after : Core) (block : BlockId) {offset : Nat}
+    (fits : offset + 1 < UInt32.size) :
+    (leaf core block offset).advanceWith after = leaf after block (offset + 1) := by
+  have notLast : UInt32.ofNat offset ≠ 0xffffffff := by
+    intro equal
+    have equal := congrArg UInt32.toNat equal
+    rw [UInt32.toNat_ofNat_of_lt' (by omega)] at equal
+    change offset = 4294967295 at equal
+    simp only [UInt32.size] at fits
+    omega
+  simp [leaf, Machine.advanceWith, PC.next?, notLast, UInt32.ofNat_add]
+
+namespace Straight
+
+/-- A non-control instruction's effect, stated in the existing evaluator. -/
+def Effect (instruction : Instr) (before after : Core) : Prop :=
+  ∀ (runtime : Runtime) (checked : Checked) (machine : Machine), machine.core = before →
+    executeInstr runtime checked instruction machine = machine.advanceWith after
+
+inductive Sequence : List Instr → Core → Core → Prop where
+  | nil (core) : Sequence [] core core
+  | cons {instruction : Instr} {instructions : List Instr} {before middle after : Core}
+      (first : Effect instruction before middle) (rest : Sequence instructions middle after) :
+      Sequence (instruction :: instructions) before after
+
+theorem Sequence.append {left right : List Instr} {before middle after : Core}
+    (first : Sequence left before middle) (second : Sequence right middle after) :
+    Sequence (left ++ right) before after := by
+  induction first with
+  | nil => exact second
+  | cons first rest ih => exact .cons first (ih second)
+
+theorem Effect.mov (core : Core) (destination : GPR) (source : MoveSource) :
+    Effect (.mov .w64 destination source) core (core.setReg destination (source.eval core)) := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal, Core.writeReg]
+
+theorem Effect.lea (core : Core) (destination : GPR) (source : MemAddr) :
+    Effect (.lea destination source) core (core.setReg destination (source.eval core)) := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal]
+
+theorem Effect.alu (core : Core) (operation : AluOp) (destination : GPR) (source : AluSource) :
+    Effect (.alu operation .w64 destination source) core
+      (core.setReg destination (operation.eval (core.readReg destination) (source.eval core))) := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal, Core.writeReg]
+
+@[simp] theorem truncate_w64 (value : Word) : Width.truncate .w64 value = value := by
+  apply UInt64.toBitVec_inj.mp
+  change value.toBitVec &&& BitVec.allOnes 64 = value.toBitVec
+  exact BitVec.and_allOnes
+
+theorem Effect.load (core : Core) (destination : GPR) (source : MemAddr) (value : Word)
+    (allowed : Memory.rangeAllowed core.memory.readable (source.eval core) 8 = true)
+    (loaded : core.memory.read64 (source.eval core) = value) :
+    Effect (.load .w64 destination source) core (core.setReg destination value) := by
+  intro runtime checked machine equal
+  change core.memory.read .w64 (source.eval core) = value at loaded
+  simp [executeInstr, equal, Core.loadReg?, Memory.read?, Width.bytes, allowed,
+    loaded] <;> rfl
+
+theorem Effect.store (core : Core) (destination : MemAddr) (source : GPR)
+    (allowed : Memory.rangeAllowed core.memory.writable (destination.eval core) 8 = true) :
+    Effect (.store .w64 destination source) core
+      { core with memory := core.memory.write64 (destination.eval core) (core.readReg source) } := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal, Core.storeReg?, Memory.write?, Width.bytes, allowed, Memory.write64] <;> rfl
+
+/-- Consecutive instruction lookup, independent of any prefix/suffix syntax. -/
+def Segment (checked : Checked) (block : BlockId) (offset : Nat) (instructions : List Instr) : Prop :=
+  ∃ code, checked.program.blocks[block.toNat]? = some code ∧
+    ∀ i < instructions.length, code.instructions[offset + i]? = instructions[i]?
+
+theorem _root_.Ix.Compiler.X86.BlockCode.segment {checked : Checked} {block : BlockId}
+    {instructions : List Instr} {terminator : Terminator}
+    (code : BlockCode checked block instructions terminator) : Segment checked block 0 instructions := by
+  refine ⟨_, code.found, ?_⟩
+  intro i bound
+  simp
+
+theorem Segment.tail {checked : Checked} {block : BlockId} {offset : Nat}
+    {instruction : Instr} {instructions : List Instr}
+    (segment : Segment checked block offset (instruction :: instructions)) :
+    Segment checked block (offset + 1) instructions := by
+  obtain ⟨code, found, reads⟩ := segment
+  refine ⟨code, found, ?_⟩
+  intro i bound
+  simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using reads (i + 1) (by simpa using bound)
+
+theorem Sequence.steps {instructions : List Instr} {before after : Core}
+    (sequence : Sequence instructions before after) (runtime : Runtime) (checked : Checked)
+    (block : BlockId) (offset : Nat) (segment : Segment checked block offset instructions)
+    (fits : offset + instructions.length < UInt32.size) :
+    Steps runtime checked instructions.length (leaf before block offset)
+      (leaf after block (offset + instructions.length)) := by
+  induction sequence generalizing offset with
+  | nil core => simpa using Steps.refl (runtime := runtime) (checked := checked) (leaf core block offset)
+  | @cons instruction instructions before middle after first rest ih =>
+      obtain ⟨code, found, reads⟩ := segment
+      have offsetBound : offset < UInt32.size := by simp only [List.length_cons] at fits; omega
+      have head := reads 0 (by simp)
+      simp only [Nat.add_zero, List.getElem?_cons_zero] at head
+      have one : step runtime checked (leaf before block offset) = leaf middle block (offset + 1) := by
+        simp only [step, leaf, UInt32.toNat_ofNat_of_lt' offsetBound, found, head]
+        rw [first runtime checked _ rfl]
+        exact leaf_advance _ _ _ (by simp only [List.length_cons] at fits; omega)
+      have next := ih (offset + 1) (Segment.tail ⟨code, found, reads⟩) (by
+        simp only [List.length_cons] at fits
+        omega)
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using Steps.cons one next
+
+end Straight
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/FrameCalls.lean b/Ix/Compiler/X86/FrameCalls.lean
new file mode 100644
index 000000000..da1c8081f
--- /dev/null
+++ b/Ix/Compiler/X86/FrameCalls.lean
@@ -0,0 +1,65 @@
+import Ix.Compiler.X86.FrameExecution
+
+namespace Ix.Compiler.X86
+
+theorem PC.next_ofNat (block : BlockId) {offset : Nat} (fits : offset + 1 < UInt32.size) :
+    (PC.mk block (UInt32.ofNat offset)).next? = some ⟨block, UInt32.ofNat (offset + 1)⟩ := by
+  have notLast : UInt32.ofNat offset ≠ 0xffffffff := by
+    intro equal
+    have equal := congrArg UInt32.toNat equal
+    rw [UInt32.toNat_ofNat_of_lt' (by omega)] at equal
+    change offset = 4294967295 at equal
+    simp only [UInt32.size] at fits
+    omega
+  simp [PC.next?, notLast, UInt32.ofNat_add]
+
+theorem Straight.Segment.instruction_inFrame {checked : Checked} {block : BlockId}
+    {offset : Nat} {instruction : Instr}
+    (segment : Straight.Segment checked block offset [instruction])
+    (fits : offset < UInt32.size) (runtime : Runtime) (core : Core) (returns : List ReturnFrame) :
+    step runtime checked (inFrame core block offset returns) =
+      executeInstr runtime checked instruction (inFrame core block offset returns) := by
+  obtain ⟨code, found, reads⟩ := segment
+  have head := reads 0 (by simp)
+  simp only [Nat.add_zero, List.getElem?_cons_zero] at head
+  simp [step, inFrame, UInt32.toNat_ofNat_of_lt' fits, found, head]
+
+def callFrame (core : Core) (block : BlockId) (offset : Nat) : ReturnFrame := {
+  continuation := ⟨block, UInt32.ofNat (offset + 1)⟩
+  returnSlot := core.readReg .rsp - 8
+  calleeSaved := core.calleeSavedSnapshot }
+
+def callCore (core : Core) (block : BlockId) (offset : Nat) : Core :=
+  { core.setReg .rsp (core.readReg .rsp - 8) with
+    memory := core.memory.write64 (core.readReg .rsp - 8) (callFrame core block offset).continuation.encode }
+
+/-- CALL's complete typed effect, including the real stack write and saved
+register snapshot. The caller supplies finite memory capacity and alignment. -/
+theorem call_inFrame {checked : Checked} {block target : BlockId} {offset : Nat}
+    (segment : Straight.Segment checked block offset [.call target])
+    (fits : offset + 1 < UInt32.size) (valid : checked.program.hasBlock target = true)
+    (runtime : Runtime) (core : Core) (returns : List ReturnFrame)
+    (aligned : SysV.callSiteAligned (core.readReg .rsp) = true)
+    (writable : Memory.rangeAllowed core.memory.writable (core.readReg .rsp - 8) 8 = true) :
+    step runtime checked (inFrame core block offset returns) =
+      inFrame (callCore core block offset) target 0 (callFrame core block offset :: returns) := by
+  rw [segment.instruction_inFrame (by omega)]
+  simp only [executeInstr, inFrame, aligned, Bool.not_true, Bool.false_eq_true, ↓reduceIte,
+    valid, PC.next_ofNat block fits]
+  simp [Memory.write64?, Memory.write?, Width.bytes, writable, callCore, callFrame, Memory.write64]
+
+/-- A callee returns to the actual stored continuation after restoring its
+entry stack pointer and the System V saved-register set. -/
+theorem BlockCode.ret_inFrame {checked : Checked} {block : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions .ret)
+    (runtime : Runtime) (core : Core) (frame : ReturnFrame) (returns : List ReturnFrame)
+    (stack : core.readReg .rsp = frame.returnSlot)
+    (readable : core.memory.read64? frame.returnSlot = .ok frame.continuation.encode)
+    (saved : core.calleeSavedMatch frame.calleeSaved = true) :
+    step runtime checked (inFrame core block instructions.length (frame :: returns)) =
+      { core := core.setReg .rsp (frame.returnSlot + 8), pc := frame.continuation,
+        returns, status := .running } := by
+  rw [code.terminator_inFrame]
+  simp [executeTerminator, inFrame, stack, readable, saved]
+
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/FrameExecution.lean b/Ix/Compiler/X86/FrameExecution.lean
new file mode 100644
index 000000000..7a4a45b1b
--- /dev/null
+++ b/Ix/Compiler/X86/FrameExecution.lean
@@ -0,0 +1,119 @@
+import Ix.Compiler.X86.Execution
+
+/-! Instruction and block contracts inside an arbitrary caller continuation.
+Unlike leaf execution, these contracts retain the active return frames. -/
+
+namespace Ix.Compiler.X86
+
+def inFrame (core : Core) (block : BlockId) (offset : Nat) (returns : List ReturnFrame) : Machine :=
+  { core, pc := { block, offset := UInt32.ofNat offset }, returns, status := .running }
+
+theorem inFrame_advance (core after : Core) (block : BlockId) (returns : List ReturnFrame)
+    {offset : Nat} (fits : offset + 1 < UInt32.size) :
+    (inFrame core block offset returns).advanceWith after = inFrame after block (offset + 1) returns := by
+  have notLast : UInt32.ofNat offset ≠ 0xffffffff := by
+    intro equal
+    have equal := congrArg UInt32.toNat equal
+    rw [UInt32.toNat_ofNat_of_lt' (by omega)] at equal
+    change offset = 4294967295 at equal
+    simp only [UInt32.size] at fits
+    omega
+  simp [inFrame, Machine.advanceWith, PC.next?, notLast, UInt32.ofNat_add]
+
+theorem BlockCode.terminator_inFrame {checked : Checked} {block : BlockId}
+    {instructions : List Instr} {terminator : Terminator}
+    (code : BlockCode checked block instructions terminator)
+    (runtime : Runtime) (core : Core) (returns : List ReturnFrame) :
+    step runtime checked (inFrame core block instructions.length returns) =
+      executeTerminator checked terminator (inFrame core block instructions.length returns) := by
+  simp [step, inFrame, UInt32.toNat_ofNat_of_lt' code.fits, code.found]
+
+theorem BlockCode.jump_inFrame {checked : Checked} {block target : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions (.jump target))
+    (valid : checked.program.hasBlock target = true)
+    (runtime : Runtime) (core : Core) (returns : List ReturnFrame) :
+    step runtime checked (inFrame core block instructions.length returns) = inFrame core target 0 returns := by
+  rw [code.terminator_inFrame]
+  simp [executeTerminator, Machine.goto, valid, inFrame]
+
+theorem BlockCode.branch_inFrame {checked : Checked} {block yes no : BlockId} {instructions : List Instr}
+    {comparison : Compare} {condition : Condition}
+    (code : BlockCode checked block instructions (.branch comparison condition yes no))
+    (runtime : Runtime) (core : Core) (returns : List ReturnFrame) (answer : Bool)
+    (holds : comparison.holds condition core = answer)
+    (valid : checked.program.hasBlock (if answer then yes else no) = true) :
+    step runtime checked (inFrame core block instructions.length returns) =
+      inFrame core (if answer then yes else no) 0 returns := by
+  rw [code.terminator_inFrame]
+  simp [executeTerminator, inFrame, holds, Machine.goto, valid]
+
+theorem Straight.Sequence.steps_inFrame {instructions : List Instr} {before after : Core}
+    (sequence : Straight.Sequence instructions before after) (runtime : Runtime) (checked : Checked)
+    (block : BlockId) (offset : Nat) (returns : List ReturnFrame)
+    (segment : Straight.Segment checked block offset instructions)
+    (fits : offset + instructions.length < UInt32.size) :
+    Steps runtime checked instructions.length (inFrame before block offset returns)
+      (inFrame after block (offset + instructions.length) returns) := by
+  induction sequence generalizing offset with
+  | nil core => simpa using Steps.refl (runtime := runtime) (checked := checked) (inFrame core block offset returns)
+  | @cons instruction instructions before middle after first rest ih =>
+      obtain ⟨code, found, reads⟩ := segment
+      have offsetBound : offset < UInt32.size := by simp only [List.length_cons] at fits; omega
+      have head := reads 0 (by simp)
+      simp only [Nat.add_zero, List.getElem?_cons_zero] at head
+      have one : step runtime checked (inFrame before block offset returns) =
+          inFrame middle block (offset + 1) returns := by
+        simp only [step, inFrame, UInt32.toNat_ofNat_of_lt' offsetBound, found, head]
+        rw [first runtime checked _ rfl]
+        exact inFrame_advance _ _ _ _ (by simp only [List.length_cons] at fits; omega)
+      have next := ih (offset + 1) (Straight.Segment.tail ⟨code, found, reads⟩) (by
+        simp only [List.length_cons] at fits
+        omega)
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using Steps.cons one next
+
+namespace Straight.Effect
+
+theorem push (core : Core) (source : GPR)
+    (allowed : Memory.rangeAllowed core.memory.writable (core.readReg .rsp - 8) 8 = true) :
+    Effect (.push source) core
+      { core.setReg .rsp (core.readReg .rsp - 8) with
+        memory := core.memory.write64 (core.readReg .rsp - 8) (core.readReg source) } := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal, Memory.write64?, Memory.write?, Width.bytes, allowed, Memory.write64]
+
+theorem pop (core : Core) (destination : GPR) (value : Word)
+    (allowed : Memory.rangeAllowed core.memory.readable (core.readReg .rsp) 8 = true)
+    (loaded : core.memory.read64 (core.readReg .rsp) = value) :
+    Effect (.pop destination) core ((core.setReg .rsp (core.readReg .rsp + 8)).setReg destination value) := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal, Memory.read64?, Memory.read?, Width.bytes, allowed, Memory.read64] at *
+  exact congrArg machine.advanceWith (by rw [loaded])
+
+theorem allocFrame (core : Core) (size : FrameSize) :
+    Effect (.allocFrame size) core (core.setReg .rsp (core.readReg .rsp - size.bytes)) := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal]
+
+theorem freeFrame (core : Core) (size : FrameSize) :
+    Effect (.freeFrame size) core (core.setReg .rsp (core.readReg .rsp + size.bytes)) := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal]
+
+theorem spill (core : Core) (slot : StackSlot) (source : GPR)
+    (allowed : Memory.rangeAllowed core.memory.writable (core.readReg .rbp - slot.displacement) 8 = true) :
+    Effect (.spill slot source) core
+      { core with memory := core.memory.write64 (core.readReg .rbp - slot.displacement) (core.readReg source) } := by
+  intro runtime checked machine equal
+  simp [executeInstr, equal, Core.storeReg?, Memory.write?, Width.bytes, allowed, Memory.write64] <;> rfl
+
+theorem reload (core : Core) (destination : GPR) (slot : StackSlot) (value : Word)
+    (allowed : Memory.rangeAllowed core.memory.readable (core.readReg .rbp - slot.displacement) 8 = true)
+    (loaded : core.memory.read64 (core.readReg .rbp - slot.displacement) = value) :
+    Effect (.reload destination slot) core (core.setReg destination value) := by
+  intro runtime checked machine equal
+  change core.memory.read .w64 (core.readReg .rbp - slot.displacement) = value at loaded
+  simp [executeInstr, equal, Core.loadReg?, Memory.read?, Width.bytes, allowed,
+    loaded] <;> rfl
+
+end Straight.Effect
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/Memory.lean b/Ix/Compiler/X86/Memory.lean
new file mode 100644
index 000000000..38a3797f5
--- /dev/null
+++ b/Ix/Compiler/X86/Memory.lean
@@ -0,0 +1,143 @@
+import Ix.Compiler.X86.Eval
+
+/-! Word-access laws for the existing little-endian byte-memory semantics.
+The native heap selector uses aligned 64-bit fields. These lemmas keep its
+word-level invariant connected to the actual byte loads and stores. -/
+
+namespace Ix.Compiler.X86.Memory
+
+@[simp] theorem write64_readable (memory : Memory) (address value : Word) :
+    (memory.write64 address value).readable = memory.readable := by
+  rfl
+
+@[simp] theorem write64_writable (memory : Memory) (address value : Word) :
+    (memory.write64 address value).writable = memory.writable := by
+  rfl
+
+private theorem byteOffset_injective (address : Word) {left right : Nat}
+    (leftBound : left < 8) (rightBound : right < 8)
+    (equal : address + UInt64.ofNat left = address + UInt64.ofNat right) :
+    left = right := by
+  have equal := congrArg UInt64.toNat equal
+  simp only [UInt64.toNat_add, UInt64.toNat_ofNat'] at equal
+  omega
+
+private theorem aligned_bytes_disjoint (left right : Word)
+    (leftAligned : left % 8 = 0) (rightAligned : right % 8 = 0) (different : left ≠ right)
+    {i j : Nat} (iBound : i < 8) (jBound : j < 8) :
+    left + UInt64.ofNat i ≠ right + UInt64.ofNat j := by
+  intro equal
+  have equal := congrArg UInt64.toNat equal
+  have leftAligned := congrArg UInt64.toNat leftAligned
+  have rightAligned := congrArg UInt64.toNat rightAligned
+  have leftSmall := left.toNat_lt_size
+  have rightSmall := right.toNat_lt_size
+  have different : left.toNat ≠ right.toNat := fun equal => different (UInt64.toNat_inj.mp equal)
+  simp only [UInt64.toNat_add, UInt64.toNat_ofNat', UInt64.toNat_mod] at equal leftAligned rightAligned
+  change left.toNat % 8 = 0 at leftAligned
+  change right.toNat % 8 = 0 at rightAligned
+  simp only [UInt64.size] at leftSmall rightSmall
+  omega
+
+theorem writeLittle_bytes (memory : Memory) (address value : Word) {count offset : Nat}
+    (countBound : count ≤ 8) (offsetBound : offset < count) :
+    (memory.writeLittle address value count).bytes (address + UInt64.ofNat offset) =
+      (value >>> UInt64.ofNat (8 * offset)).toUInt8 := by
+  induction count with
+  | zero => omega
+  | succ count ih =>
+      by_cases same : offset = count
+      · subst offset; simp [writeLittle, writeByte]
+      · have different : address + UInt64.ofNat offset ≠ address + UInt64.ofNat count :=
+          fun equal => same (byteOffset_injective address (by omega) (by omega) equal)
+        simp only [writeLittle, writeByte, beq_iff_eq, if_neg different]
+        exact ih (by omega) (by omega)
+
+/-- Reconstruct a word from its eight little-endian bytes. The proof inspects
+bit positions with kernel-checked arithmetic; no native decision axiom is used. -/
+theorem pack64 (value : Word) :
+    value.toUInt8.toUInt64 ||| (value >>> 8).toUInt8.toUInt64 <<< 8 |||
+      (value >>> 16).toUInt8.toUInt64 <<< 16 ||| (value >>> 24).toUInt8.toUInt64 <<< 24 |||
+      (value >>> 32).toUInt8.toUInt64 <<< 32 ||| (value >>> 40).toUInt8.toUInt64 <<< 40 |||
+      (value >>> 48).toUInt8.toUInt64 <<< 48 ||| (value >>> 56).toUInt8.toUInt64 <<< 56 = value := by
+  apply UInt64.toBitVec_inj.mp
+  apply BitVec.eq_of_getLsbD_eq
+  intro i hi
+  simp only [UInt64.toBitVec_or, UInt64.toBitVec_shiftLeft, UInt64.toBitVec_shiftRight,
+    UInt64.toBitVec_toUInt8, UInt8.toBitVec_toUInt64, UInt64.toBitVec_ofNat,
+    BitVec.shiftLeft_eq', BitVec.ushiftRight_eq', BitVec.toNat_umod, BitVec.toNat_ofNat,
+    BitVec.getLsbD_or, BitVec.getLsbD_shiftLeft, BitVec.getLsbD_ushiftRight, BitVec.getLsbD_setWidth]
+  have ranges : i < 8 ∨ (8 ≤ i ∧ i < 16) ∨ (16 ≤ i ∧ i < 24) ∨
+      (24 ≤ i ∧ i < 32) ∨ (32 ≤ i ∧ i < 40) ∨ (40 ≤ i ∧ i < 48) ∨
+      (48 ≤ i ∧ i < 56) ∨ (56 ≤ i ∧ i < 64) := by omega
+  rcases ranges with h | h | h | h | h | h | h | h <;>
+    simp (discharger := omega) [decide_eq_true, decide_eq_false]
+
+theorem read64_write64 (memory : Memory) (address value : Word) :
+    (memory.write64 address value).read64 address = value := by
+  change (memory.writeLittle address value 8).readLittle address 8 = value
+  simp (discharger := omega) only [readLittle, writeLittle_bytes]
+  simpa using pack64 value
+
+theorem readLittle_congr (left right : Memory) (address : Word) (count : Nat)
+    (equal : ∀ offset < count, left.bytes (address + UInt64.ofNat offset) =
+      right.bytes (address + UInt64.ofNat offset)) :
+    left.readLittle address count = right.readLittle address count := by
+  induction count with
+  | zero => rfl
+  | succ count ih =>
+      rw [readLittle, readLittle, ih (fun offset bound => equal offset (by omega)), equal count (by omega)]
+
+theorem rangeAllowed_of_forall (permission : Word → Bool) (address : Word)
+    (count : Nat) (allowed : ∀ offset < count, permission (address + UInt64.ofNat offset) = true) :
+    rangeAllowed permission address count = true := by
+  induction count with
+  | zero => rfl
+  | succ count ih =>
+      simp only [rangeAllowed, Bool.and_eq_true]
+      exact ⟨ih (fun offset bound => allowed offset (by omega)), allowed count (by omega)⟩
+
+theorem writeLittle_bytes_outside (memory : Memory) (address value other : Word) (count : Nat)
+    (outside : ∀ offset < count, other ≠ address + UInt64.ofNat offset) :
+    (memory.writeLittle address value count).bytes other = memory.bytes other := by
+  induction count with
+  | zero => rfl
+  | succ count ih =>
+      simp only [writeLittle, writeByte, beq_iff_eq, if_neg (outside count (by omega))]
+      exact ih (fun offset bound => outside offset (by omega))
+
+theorem write64_bytes_outside (memory : Memory) (address value other : Word)
+    (outside : ∀ offset < 8, other ≠ address + UInt64.ofNat offset) :
+    (memory.write64 address value).bytes other = memory.bytes other :=
+  writeLittle_bytes_outside memory address value other 8 outside
+
+theorem read64_write64_ne (memory : Memory) (address other value : Word)
+    (addressAligned : address % 8 = 0) (otherAligned : other % 8 = 0)
+    (different : other ≠ address) :
+    (memory.write64 address value).read64 other = memory.read64 other := by
+  apply readLittle_congr
+  intro i iBound
+  apply write64_bytes_outside
+  intro j jBound
+  exact aligned_bytes_disjoint other address otherAligned addressAligned different iBound jBound
+
+end Ix.Compiler.X86.Memory
+
+namespace Ix.Compiler.X86
+
+theorem word_add_left_comm (left middle right : Word) : left + (middle + right) = middle + (left + right) := by
+  rw [← UInt64.add_assoc, UInt64.add_comm left middle, UInt64.add_assoc]
+
+@[simp] theorem Registers.set_same (registers : Registers) (register : GPR) (value : Word) :
+    (registers.set register value) register = value := by simp [Registers.set]
+
+@[simp] theorem Registers.set_other (registers : Registers) (register other : GPR) (value : Word)
+    (different : other ≠ register) : (registers.set register value) other = registers other := by
+  simp [Registers.set, different]
+
+@[simp] theorem Registers.set_set (registers : Registers) (register : GPR) (first second : Word) :
+    (registers.set register first).set register second = registers.set register second := by
+  funext candidate
+  by_cases same : candidate = register <;> simp [Registers.set, same]
+
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/NatCalls.lean b/Ix/Compiler/X86/NatCalls.lean
new file mode 100644
index 000000000..32ae5d0d9
--- /dev/null
+++ b/Ix/Compiler/X86/NatCalls.lean
@@ -0,0 +1,126 @@
+import Ix.Compiler.X86.NatCallsCapture
+
+/-! A bounded structural selector for closed unary-Nat computations. Known
+PAP arguments specialize a function's call interface; a separate mode admits
+one checked static Nat capture. Nat values
+remain expressions: successor emits ADD, and calls remain direct CALLs.
+The closed translation validator is separate in NatCallsCheck. -/
+namespace Ix.Compiler.X86.NatCalls
+open Ix.Compiler Ixon
+
+def value (registers : Array Value) : IxIR2.Atom → Except Error Value
+  | .reg register => match registers[register]? with
+      | some value => .ok value
+      | none => .error .unknownRegister
+  | .lit (.nat number) =>
+      if number < UInt64.size then .ok (.nat (.constant number.toUInt64)) else .error .wordOverflow
+  | .erased => .ok .erased
+  | _ => .error .notNat
+
+def natValue : Value → Except Error Expr
+  | .nat expression => .ok expression
+  | .staticNat expression => .ok expression
+  | _ => .error .notNat
+
+def parameter : Value → Param
+  | .nat _ => .nat
+  | .closure function capture => .closure function capture
+  | .staticNat expression => .staticNat expression
+  | .erased => .erased
+
+def parameterValue : Param → Value
+  | .nat => .nat .argument
+  | .closure function capture => .closure function capture
+  | .staticNat expression => .staticNat expression
+  | .erased => .erased
+
+def shared (function : IxIR2.Function) : Bool :=
+  function.signature.result == .shared &&
+  function.signature.params.all (fun param => param.world == .shared && param.passing == .owned)
+
+mutual
+  def lowerFunction (program : IxIR2.Program) (schema : Schema) (limits : Limits) (mode : CaptureMode) :
+      Nat → Array Function → Option Address → IxIR2.Function → Array Param →
+      Except Error (Array Function × Nat)
+    | 0, _, _, _, _ => .error .budget
+    | fuel + 1, functions, origin, function, parameters => do
+      if !shared function then throw .ownership
+      if function.signature.params.size != parameters.size then throw .callArity
+      let #[block] := function.blocks | throw .controlFlow
+      if !block.creditParams.isEmpty then throw .ownership
+      if block.instructions.size > limits.instructions || functions.size >= limits.functions then throw .budget
+      let mut functions := functions
+      let mut registers := parameters.map parameterValue
+      for instruction in block.instructions do
+        match instruction with
+        | .move atom | .retainShared atom => registers := registers.push (← value registers atom)
+        | .releaseShared _ => pure ()
+        | .alloc .shared cid args =>
+            let values ← args.mapM (value registers)
+            if cid == schema.zero && values.isEmpty then
+              registers := registers.push (.nat (.constant 0))
+            else if cid == schema.succ then
+              let #[argument] := values | throw .constructor
+              registers := registers.push (.nat (.successor (← natValue argument)))
+            else throw .constructor
+        | .papp address captures =>
+            if captures.isEmpty then registers := registers.push (.closure address none)
+            else
+              if mode == .captureFree then throw .capturedPap
+              let #[atom] := captures | throw .capturedPap
+              let expression ← natValue (← value registers atom)
+              let _ ← checkCapture functions expression limits.captureFuel
+              registers := registers.push (.closure address (some expression))
+        | .call address atoms =>
+            let (next, expression) ← lowerCall program schema limits mode fuel functions address (← atoms.mapM (value registers))
+            functions := next
+            registers := registers.push (.nat expression)
+        | .apply closure atoms =>
+            let .closure address capture ← value registers closure | throw .unknownClosure
+            let values := capture.toArray.map Value.staticNat ++ (← atoms.mapM (value registers))
+            let (next, expression) ← lowerCall program schema limits mode fuel functions address values
+            functions := next
+            registers := registers.push (.nat expression)
+        | _ => throw .instruction
+      let (nextFunctions, body) ← (match block.terminator with
+        | .ret atom => do return (functions, ← natValue (← value registers atom))
+        | .tailCall address atoms => do lowerCall program schema limits mode fuel functions address (← atoms.mapM (value registers))
+        | _ => throw .controlFlow : Except Error (Array Function × Expr))
+      if nextFunctions.size >= limits.functions then throw .budget
+      return (nextFunctions.push { origin, parameters, body }, nextFunctions.size)
+
+  def lowerCall (program : IxIR2.Program) (schema : Schema) (limits : Limits) (mode : CaptureMode) :
+      Nat → Array Function → Address → Array Value → Except Error (Array Function × Expr)
+    | 0, _, _, _ => .error .budget
+    | fuel + 1, functions, address, values => do
+      let parameters := values.map parameter
+      let numbers := values.filterMap fun | .nat expression => some expression | _ => none
+      if numbers.size > 1 then throw .multipleNatArguments
+      let inputExpr := numbers[0]?.getD (.constant 0)
+      if let some index := functions.findIdx? (fun function => function.origin == some address && function.parameters == parameters) then
+        return (functions, .call index inputExpr)
+      let some (_, .fn function) := program.declarations.find? (·.1 == address) | throw .unknownFunction
+      let (next, index) ← lowerFunction program schema limits mode fuel functions (some address) function parameters
+      return (next, .call index inputExpr)
+end
+
+def lower (program : IxIR2.Program) (schema : Schema) (limits : Limits := {})
+    (mode : CaptureMode := .captureFree) : Except Error Residual := do
+  if !program.main.signature.params.isEmpty then throw .openMain
+  let (functions, entry) ← lowerFunction program schema limits mode limits.depth #[] none program.main #[]
+  return { functions, entry }
+
+def Expr.instructions : Expr → List X86.Instr
+  | .argument => [.mov .w64 .rax (.reg .rdi)]
+  | .constant value => [.mov .w64 .rax (.imm value)]
+  | .successor value => value.instructions ++ [.alu .add .w64 .rax (.imm 1)]
+  | .call function inputExpr => inputExpr.instructions ++
+      [.mov .w64 .rdi (.reg .rax), .push .rbp, .call function.toUInt32, .pop .rbp]
+
+def Residual.target (residual : Residual) : X86.Program := {
+  entry := residual.entry.toUInt32
+  blocks := residual.functions.map fun function => {
+    instructions := function.body.instructions.toArray
+    terminator := .ret } }
+
+end Ix.Compiler.X86.NatCalls
diff --git a/Ix/Compiler/X86/NatCallsCapture.lean b/Ix/Compiler/X86/NatCallsCapture.lean
new file mode 100644
index 000000000..4b78f7118
--- /dev/null
+++ b/Ix/Compiler/X86/NatCallsCapture.lean
@@ -0,0 +1,49 @@
+import Ix.Compiler.X86.NatCallsSyntax
+
+namespace Ix.Compiler.X86.NatCalls
+
+/-- Static capture expressions cannot refer to the caller's Nat parameter.
+Callees may use their own parameter, supplied by a closed argument. -/
+def Expr.closed : Expr → Bool
+  | .argument => false
+  | .constant _ => true
+  | .successor value | .call _ value => value.closed
+
+theorem Expr.closed_evaluate {expression : Expr} (closed : expression.closed = true)
+    (functions : Array Function) (fuel left right : Nat) :
+    evaluate functions fuel expression left = evaluate functions fuel expression right := by
+  induction fuel generalizing expression left right with
+  | zero => rfl
+  | succ fuel ih =>
+      cases expression with
+      | argument => simp [Expr.closed] at closed
+      | constant value => rfl
+      | successor value => simp only [evaluate, ih (expression := value) closed left right]
+      | call function value => simp only [evaluate, ih (expression := value) closed left right]
+
+structure StaticCapture (functions : Array Function) (expression : Expr) (fuel : Nat) where
+  closed : expression.closed = true
+  word : Word
+  evaluated : evaluate functions fuel expression 0 = .ok word.toNat
+
+/-- Check exact capture representation while retaining its original
+expression for native emission. The initializer is not replaced by its Nat
+result, and no open expression is evaluated using a guessed argument. -/
+def checkCapture (functions : Array Function) (expression : Expr) (fuel : Nat) :
+    Except Error (StaticCapture functions expression fuel) := do
+  if closed : expression.closed = true then
+    match evaluated : evaluate functions fuel expression 0 with
+    | .error error => throw error
+    | .ok number =>
+      let word := UInt64.ofNat number
+      if exact : word.toNat = number then
+        return { closed, word, evaluated := by simpa [exact] using evaluated }
+      else throw .wordOverflow
+  else throw .dynamicCapture
+
+theorem StaticCapture.evaluates {functions expression fuel}
+    (capture : StaticCapture functions expression fuel) (argument : Nat) :
+    evaluate functions fuel expression argument = .ok capture.word.toNat :=
+  (expression.closed_evaluate capture.closed functions fuel argument 0).trans capture.evaluated
+
+end Ix.Compiler.X86.NatCalls
diff --git a/Ix/Compiler/X86/NatCallsCheck.lean b/Ix/Compiler/X86/NatCallsCheck.lean
new file mode 100644
index 000000000..dcbe68645
--- /dev/null
+++ b/Ix/Compiler/X86/NatCallsCheck.lean
@@ -0,0 +1,207 @@
+import Ix.Compiler.X86.NatCalls
+import Ix.Compiler.IxIR2.EvalFuel
+import Ix.Compiler.X86.ObjectExecution
+import Ix.Compiler.X86.StreamDecidable
+
+/-! Closed translation validation connects the structurally selected call
+program to the actual physical run, its complete release, and certified ELF
+bytes. Execution certificates expose their stack/state conditions explicitly;
+they do not establish N3's later open-function or branch/join domain. -/
+namespace Ix.Compiler.X86.NatCalls
+open Ix.Compiler
+
+def heapNat (schema : Schema) : Nat → IxIR1.Store → IxIR1.RVal → Option Nat
+  | 0, _, _ => none
+  | fuel + 1, store, .loc location => do
+      let box ← store.get? location
+      if box.world != .shared then none else do
+        let .ctorN cid fields := box.node | none
+        if cid == schema.zero && fields.isEmpty then some 0
+        else if cid == schema.succ then
+          let #[tail] := fields | none
+          (· + 1) <$> heapNat schema fuel store tail
+        else none
+  | _, _, .lit (.nat number) => some number
+  | _, _, _ => none
+
+def evalContext (source : IxIR2.Program) (context : IxIR2.Validate.Context) : IxIR2.Eval.Context :=
+  IxIR2.Eval.Context.ofProgram source context.schemas
+
+structure Output (source : IxIR2.Program) (context : IxIR2.Validate.Context) (schema : Schema) where
+  limits : Limits
+  captureMode : CaptureMode
+  sourceStats : IxIR2.Validate.Stats
+  sourceAccepted : IxIR2.Validate.validate context source = .ok sourceStats
+  arity : source.main.signature.params.size = 0
+  nonempty : source.main.blocks.isEmpty = false
+  residual : Residual
+  lowered : lower source schema limits captureMode = .ok residual
+  number : Nat
+  evaluated : residual.evaluate 1024 = .ok number
+  word : Word
+  exactWord : word.toNat = number
+  physical : IxIR2.Eval.Result
+  physicalRun : IxIR2.Eval.runMain (evalContext source context) .physical source 10000 10000 = .ok physical
+  observation : heapNat schema 10000 physical.store.heap physical.value = some number
+  reclaimed : IxIR2.Eval.Store
+  remaining : Nat
+  releaseRun : IxIR2.Eval.releaseShared 10000 physical.store physical.value = .ok (reclaimed, remaining)
+  empty : reclaimed.heap.live = 0
+  balanced : reclaimed.heap.allocs = reclaimed.heap.frees
+  target : X86.Checked
+  targetProduced : target.program = residual.target
+
+inductive CheckError where
+  | source (error : IxIR2.Validate.Error)
+  | lowering (error : Error)
+  | physical (error : IxIR2.Eval.Error)
+  | arity
+  | emptyMain
+  | representation
+  | reclamation
+  | target
+  deriving Repr
+
+def select (source : IxIR2.Program) (context : IxIR2.Validate.Context) (schema : Schema)
+    (limits : Limits := {}) (captureMode : CaptureMode := .captureFree) : Except CheckError (Output source context schema) := do
+  match sourceAccepted : IxIR2.Validate.validate context source with
+  | .error error => throw (.source error)
+  | .ok sourceStats =>
+    if arity : source.main.signature.params.size = 0 then
+      if nonempty : source.main.blocks.isEmpty = false then
+        match lowered : lower source schema limits captureMode with
+        | .error error => throw (.lowering error)
+        | .ok residual =>
+          match evaluated : residual.evaluate 1024 with
+          | .error error => throw (.lowering error)
+          | .ok number =>
+            let word := UInt64.ofNat number
+            if exactWord : word.toNat = number then
+              match physicalRun : IxIR2.Eval.runMain (evalContext source context) .physical source 10000 10000 with
+              | .error error => throw (.physical error)
+              | .ok physical =>
+                if observation : heapNat schema 10000 physical.store.heap physical.value = some number then
+                  match releaseRun : IxIR2.Eval.releaseShared 10000 physical.store physical.value with
+                  | .error error => throw (.physical error)
+                  | .ok (reclaimed, remaining) =>
+                    if empty : reclaimed.heap.live = 0 then
+                      if balanced : reclaimed.heap.allocs = reclaimed.heap.frees then
+                        if valid : residual.target.wellFormed = true then
+                          return {
+                            limits, captureMode, sourceStats, sourceAccepted, arity, nonempty, residual, lowered,
+                            number, evaluated, word, exactWord, physical, physicalRun, observation,
+                            reclaimed, remaining, releaseRun, empty, balanced,
+                            target := ⟨residual.target, valid⟩, targetProduced := rfl }
+                        else throw .target
+                      else throw .reclamation
+                    else throw .reclamation
+                else throw .representation
+            else throw .representation
+      else throw .emptyMain
+    else throw .arity
+
+/-- The value and entire physical store are independent of successful run
+budgets. The endpoint is a Nat observation, not equality to an unboxed physical
+literal: the baseline still returns its actual shared constructor heap. -/
+theorem Output.refinesSuccessfulRun {source context schema} (output : Output source context schema)
+    {control heap : Nat} {result : IxIR2.Eval.Result}
+    (execution : IxIR2.Eval.runMain (evalContext source context) .physical source control heap = .ok result) :
+    heapNat schema 10000 result.store.heap result.value = some output.word.toNat ∧
+      result.store = output.physical.store ∧ result.value = output.physical.value := by
+  obtain ⟨stores, values⟩ := IxIR2.Eval.runMain_success_unique output.arity output.nonempty execution output.physicalRun
+  refine ⟨?_, stores, values⟩
+  rw [stores, values, output.exactWord]
+  exact output.observation
+
+/-- Every successful physical run has the same complete result release,
+including the captured PAP and its retained constructor graph. -/
+theorem Output.reclaimsSuccessfulRun {source context schema} (output : Output source context schema)
+    {control heap : Nat} {result : IxIR2.Eval.Result}
+    (execution : IxIR2.Eval.runMain (evalContext source context) .physical source control heap = .ok result) :
+    IxIR2.Eval.releaseShared 10000 result.store result.value = .ok (output.reclaimed, output.remaining) ∧
+      output.reclaimed.heap.live = 0 ∧ output.reclaimed.heap.allocs = output.reclaimed.heap.frees := by
+  obtain ⟨_, stores, values⟩ := output.refinesSuccessfulRun execution
+  exact ⟨by rw [stores, values]; exact output.releaseRun, output.empty, output.balanced⟩
+
+structure Object (source : IxIR2.Program) (context : IxIR2.Validate.Context) (schema : Schema) where
+  selected : Output source context schema
+  stream : Stream.Certified selected.target
+  input : ELF.Input
+  encoded : input.encoded = stream.output
+  entry : input.entryBlock = selected.target.program.entry
+  object : ELF.Certified input
+
+def CaptureMode.policy : CaptureMode → String
+  | .captureFree => "closed-unary-nat-calls/1"
+  | .staticNat => "closed-static-capture-nat-calls/1"
+
+def CaptureMode.loweringVersion : CaptureMode → UInt32
+  | .captureFree => 4
+  | .staticNat => 8
+
+def Output.emit {source context schema} (output : Output source context schema)
+    (root : Ixon.Address) (name : String) : Except String (Object source context schema) := do
+  let stream ← (Stream.encode output.target).mapError reprStr
+  let input : ELF.Input := {
+    encoded := stream.output, entryBlock := output.target.program.entry, exportName := name,
+    provenance := .ixir1Policy root output.captureMode.loweringVersion 1 }
+  let object ← (ELF.writeChecked input).mapError reprStr
+  return { selected := output, stream, input, encoded := rfl, entry := rfl, object }
+
+/-- Explicit, executable certification of a complete terminating typed trace
+including call alignment, return slots, saved registers, and the final RET.
+It can be checked for any supplied initial machine state. -/
+structure Execution {source context schema} (object : Object source context schema) (core : Core) (fuel : Nat) where
+  after : Machine
+  run : X86.runFrom Runtime.rejecting object.selected.target fuel core = after
+  halted : after.status = .halted object.selected.word
+  value : after.core.readReg .rax = object.selected.word
+  safe : Stream.SafeTrace Runtime.rejecting object.selected.target fuel (fun _ => False)
+    (Machine.initial object.selected.target core)
+  stack : after.core.readReg .rsp = core.readReg .rsp
+  saved : after.core.calleeSavedMatch (core.calleeSavedSnapshot) = true
+  returnAddress : Word
+  slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress
+
+def certifyExecution {source context schema} (object : Object source context schema)
+    (core : Core) (fuel : Nat := 4096) : Except String (Execution object core fuel) := do
+  let after := X86.runFrom Runtime.rejecting object.selected.target fuel core
+  if halted : after.status = .halted object.selected.word then
+   if value : after.core.readReg .rax = object.selected.word then
+    if safe : Stream.SafeTrace Runtime.rejecting object.selected.target fuel (fun _ => False)
+        (Machine.initial object.selected.target core) then
+      if stack : after.core.readReg .rsp = core.readReg .rsp then
+        if saved : after.core.calleeSavedMatch core.calleeSavedSnapshot = true then
+          match slot : after.core.memory.read64? (after.core.readReg .rsp) with
+          | .error _ => throw "unreadable native return slot"
+          | .ok returnAddress => return { after, run := rfl, halted, value, safe, stack, saved, returnAddress, slot }
+        else throw "native callee-saved register mismatch"
+      else throw "native stack pointer mismatch"
+    else throw "native call/stack trace rejected"
+   else throw "native result register disagrees"
+  else throw "native return value or termination disagrees"
+
+theorem Execution.objectRun {source context schema} {object : Object source context schema}
+    {core : Core} {fuel : Nat} (execution : Execution object core fuel) (base : Word) (flags : ByteEval.Flags) :
+    ∃ count holes finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      ObjectEval.run object.object.bytes object.input.exportName base count core flags = .ok finalState ∧
+      finalState.rip = execution.returnAddress ∧
+      Stream.CoreRelated object.selected.target.program base holes []
+        (execution.after.core.setReg .rsp (execution.after.core.readReg .rsp + 8)) finalState.core := by
+  have stream : Stream.Valid object.selected.target.program object.input.encoded := by
+    rw [object.encoded]
+    exact object.stream.valid
+  exact ObjectEval.run_with_calls stream object.object.valid object.entry Runtime.rejecting base fuel core flags
+    execution.safe execution.run execution.halted execution.slot
+
+theorem Execution.objectReturns {source context schema} {object : Object source context schema}
+    {core : Core} {fuel : Nat} (execution : Execution object core fuel) (base : Word) (flags : ByteEval.Flags) :
+    ∃ count finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      ObjectEval.run object.object.bytes object.input.exportName base count core flags = .ok finalState ∧
+      finalState.rip = execution.returnAddress ∧ finalState.core.readReg .rax = object.selected.word := by
+  obtain ⟨count, holes, finalState, positive, bounded, run, returned, related⟩ := execution.objectRun base flags
+  refine ⟨count, finalState, positive, bounded, run, returned, ?_⟩
+  have equal := related.readReg .rax
+  simpa [Core.readReg, Core.setReg, Registers.set] using equal.symm.trans (by simpa [Core.readReg, Core.setReg, Registers.set] using execution.value)
+
+end Ix.Compiler.X86.NatCalls
diff --git a/Ix/Compiler/X86/NatCallsExamples.lean b/Ix/Compiler/X86/NatCallsExamples.lean
new file mode 100644
index 000000000..2553a3528
--- /dev/null
+++ b/Ix/Compiler/X86/NatCallsExamples.lean
@@ -0,0 +1,106 @@
+import Ix.Compiler.X86.NatCallsCheck
+import Ix.Compiler.X86.Select
+
+namespace Ix.Compiler.X86.NatCalls.Examples
+open Ix.Compiler
+
+def schema : Schema := {
+  zero := ⟨Ixon.Address.replicate 0x71, 0, 0⟩
+  succ := ⟨Ixon.Address.replicate 0x71, 0, 1⟩ }
+def address := Ixon.Address.replicate 0x72
+def source : IxIR2.Program := { Select.scalarMoveProgram 7 with main.signature.result := .shared }
+
+def errorIs {α : Type} (result : Except Error α) (expected : Error) : Bool :=
+  match result with
+  | .error error => error == expected
+  | _ => false
+
+#guard match select source Select.validationContext schema with
+  | .ok output => output.word == 7 && output.reclaimed.heap.live == 0
+  | _ => false
+
+def changed (instructions : Array IxIR2.Instr) (terminator : IxIR2.Terminator := .ret (.reg 0)) : IxIR2.Program :=
+  { source with main.blocks := #[{ valueParams := #[], creditParams := #[], instructions, terminator }] }
+
+#guard errorIs (lower { source with main.signature.params := #[⟨.shared, .owned⟩] } schema) .openMain
+#guard errorIs (lower { source with main.blocks := #[] } schema) .controlFlow
+#guard errorIs (lower { source with main.signature.result := .unique } schema) .ownership
+#guard errorIs (lower (changed #[.move (.reg 3)]) schema) .unknownRegister
+#guard errorIs (lower (changed #[.move (.lit (.nat UInt64.size))]) schema) .wordOverflow
+#guard errorIs (lower (changed #[.papp address #[.lit (.nat 0)]]) schema) .capturedPap
+#guard errorIs (lower (changed #[.apply (.lit (.nat 0)) #[]]) schema) .unknownClosure
+#guard errorIs (lower (changed #[.call address #[]]) schema) .unknownFunction
+#guard errorIs (lower (changed #[.call address #[.lit (.nat 0), .lit (.nat 1)]]) schema) .multipleNatArguments
+#guard errorIs (lower (changed #[] (.tailCallSelf #[])) schema) .controlFlow
+#guard errorIs (evaluate #[] 10 (.successor (.constant (UInt64.size - 1).toUInt64)) 0) .wordOverflow
+
+-- Validation precedes selection, including registers ignored by native
+-- representation lowering. A dead malformed release still rejects.
+#guard match select (changed #[.releaseShared (.reg 9), .move (.lit (.nat 7))]) Select.validationContext schema with
+  | .error (.source _) => true
+  | _ => false
+
+def capturedBody : IxIR2.Function := {
+  signature := { params := #[⟨.shared, .owned⟩, ⟨.shared, .owned⟩], result := .shared, papSafe := true }
+  blocks := #[{
+    valueParams := #[.owned .shared, .owned .shared], creditParams := #[],
+    instructions := #[.releaseShared (.reg 1)], terminator := .ret (.reg 0) }] }
+
+def capturedProgram (first second : Nat) : IxIR2.Program := {
+  declarations := [(address, .fn capturedBody)]
+  main := { source.main with blocks := #[{
+    valueParams := #[], creditParams := #[], instructions := #[
+      .papp address #[.lit (.nat first)], .apply (.reg 0) #[.lit (.nat 11)], .releaseShared (.reg 1),
+      .papp address #[.lit (.nat second)], .apply (.reg 2) #[.lit (.nat 13)]],
+    terminator := .ret (.reg 3) }] } }
+
+-- Both captures use the same declaration. Their expressions must remain in
+-- the specialization key, and each saturated application consumes its PAP.
+#guard match select (capturedProgram 0 7) Select.validationContext schema {} .staticNat with
+  | .ok output => output.word == 7 && output.residual.functions.size == 3 &&
+      output.residual.functions[0]!.parameters == #[.staticNat (.constant 0), .nat] &&
+      output.residual.functions[1]!.parameters == #[.staticNat (.constant 7), .nat] &&
+      output.reclaimed.heap.allocs == 2 && output.reclaimed.heap.frees == 2 && output.reclaimed.heap.live == 0
+  | _ => false
+#guard match select (capturedProgram 0 (UInt64.size - 1)) Select.validationContext schema {} .staticNat with
+  | .ok output => output.word.toNat == UInt64.size - 1 && output.reclaimed.heap.live == 0
+  | _ => false
+#guard errorIs (lower (capturedProgram 0 UInt64.size) schema {} .staticNat) .wordOverflow
+#guard errorIs (lower (capturedProgram 0 7) schema { captureFuel := 0 } .staticNat) .budget
+#guard errorIs (lower (capturedProgram 0 7) schema) .capturedPap
+
+#guard errorIs (checkCapture #[] .argument 10) .dynamicCapture
+#guard errorIs (checkCapture #[] (.successor (.constant (UInt64.size - 1).toUInt64)) 10) .wordOverflow
+#guard errorIs (lower (changed #[.papp address #[.erased]]) schema {} .staticNat) .notNat
+#guard errorIs (lower (changed #[.papp address #[.lit (.nat 0), .lit (.nat 1)]]) schema {} .staticNat) .capturedPap
+#guard errorIs (lower (changed #[.papp address #[], .papp address #[.reg 0]]) schema {} .staticNat) .notNat
+
+def dynamicBody : IxIR2.Function := {
+  signature := { params := #[⟨.shared, .owned⟩], result := .shared, papSafe := true }
+  blocks := #[{
+    valueParams := #[.owned .shared], creditParams := #[],
+    instructions := #[.papp address #[.reg 0]], terminator := .ret (.reg 1) }] }
+#guard errorIs (lowerFunction (capturedProgram 0 7) schema {} .staticNat 10 #[] none dynamicBody #[.nat]) .dynamicCapture
+
+-- Capture-free callees may use their own argument when the initializer's
+-- call input is closed. The original call/successor syntax is retained.
+def initializerFunctions : Array Function := #[{ origin := none, parameters := #[.nat], body := .successor .argument }]
+#guard match checkCapture initializerFunctions (.call 0 (.constant 6)) 10 with
+  | .ok capture => capture.word == 7
+  | _ => false
+#guard errorIs (checkCapture initializerFunctions (.call 0 .argument) 10) .dynamicCapture
+
+-- Validation rejects unsafe or unsaturated targets before capture selection.
+#guard match select { capturedProgram 0 7 with declarations := [] } Select.validationContext schema {} .staticNat with
+  | .error (.source _) => true
+  | _ => false
+#guard match select { capturedProgram 0 7 with declarations := [(address,
+    .fn { capturedBody with signature.papSafe := false })] } Select.validationContext schema {} .staticNat with
+  | .error (.source _) => true
+  | _ => false
+#guard match select { capturedProgram 0 7 with declarations := [(address,
+    .fn { capturedBody with signature.params := #[⟨.shared, .owned⟩] })] } Select.validationContext schema {} .staticNat with
+  | .error (.source _) => true
+  | _ => false
+
+end Ix.Compiler.X86.NatCalls.Examples
diff --git a/Ix/Compiler/X86/NatCallsSim.lean b/Ix/Compiler/X86/NatCallsSim.lean
new file mode 100644
index 000000000..81b5bfc5a
--- /dev/null
+++ b/Ix/Compiler/X86/NatCallsSim.lean
@@ -0,0 +1,98 @@
+import Ix.Compiler.X86.NatCallsCheck
+import Ix.Compiler.IxIR2.SourcePipelineSim
+
+namespace Ix.Compiler.X86.NatCalls
+open Ix.Compiler Ix.Compiler.Pipeline Ix.Compiler.IxIR1.LowerSim
+
+/-- Source erasure/lowering and the closed representation certificate meet
+at the actual constructor-valued physical run. The complete object endpoint
+additionally requires the explicit execution/stack certificate for its initial
+state; no ISA, runtime-body, or hash-injectivity axiom is added here. -/
+theorem sourceObjectRefines
+    {constants : List (Ixon.Address × Ixon.Constant)}
+    {mainAddress : Ixon.Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (attached : IxIR2.Pipeline.Attached constants mainAddress config .shared eraseFuel lowerFuel)
+    {schema : Schema}
+    (object : Object attached.target.artifact.program attached.target.artifact.validationContext schema)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource = .ok sourceValue)
+    {core : Core} {fuel : Nat} (execution : Execution object core fuel)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ rawValue ir1Fuel ir1Store ir1Value controlFuel heapFuel physicalResult count holes finalState,
+      @Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+        sourceValue rawValue attached.source.memberScope ∧
+      MutualAddressedValueGraph
+        (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap)
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw)
+        attached.source.functionRel ir1Store rawValue ir1Value ∧
+      IxIR1.runOwnedMain attached.compiled.simulationSourceContext .shared
+        attached.target.artifact.source.main ir1Fuel = .ok (ir1Store, ir1Value) ∧
+      IxIR2.Eval.runMain attached.compiled.simulationTargetContext .physical
+        attached.target.artifact.program controlFuel heapFuel = .ok physicalResult ∧
+      IxIR2.Lower.Sim.OutcomeRel (ir1Store, ir1Value) physicalResult ∧
+      heapNat schema 10000 physicalResult.store.heap physicalResult.value = some object.selected.word.toNat ∧
+      0 < count ∧ count ≤ 3 * fuel ∧
+      ObjectEval.run object.object.bytes object.input.exportName base count core flags = .ok finalState ∧
+      finalState.rip = execution.returnAddress ∧
+      Stream.CoreRelated object.selected.target.program base holes []
+        (execution.after.core.setReg .rsp (execution.after.core.readReg .rsp + 8)) finalState.core := by
+  obtain ⟨rawValue, ir1Fuel, ir1Store, ir1Value, controlFuel, heapFuel, physicalResult,
+    relatedSource, graph, owned, physical, relatedPhysical⟩ := attached.sourcePhysical horacles hctx hsource
+  obtain ⟨observed, _, _⟩ := object.selected.refinesSuccessfulRun physical
+  obtain ⟨count, holes, finalState, positive, bounded, executed, returned, relatedTarget⟩ := execution.objectRun base flags
+  exact ⟨rawValue, ir1Fuel, ir1Store, ir1Value, controlFuel, heapFuel, physicalResult, count, holes, finalState,
+    relatedSource, graph, owned, physical, relatedPhysical, observed, positive, bounded, executed, returned, relatedTarget⟩
+
+/-- The source-to-object endpoint also exposes complete baseline reclamation
+and the actual serialized object's RAX value. Static capture selection retains
+the same source oracle/sharing and supplied-state execution hypotheses. -/
+theorem sourceObjectReclaims
+    {constants : List (Ixon.Address × Ixon.Constant)}
+    {mainAddress : Ixon.Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (attached : IxIR2.Pipeline.Attached constants mainAddress config .shared eraseFuel lowerFuel)
+    {schema : Schema}
+    (object : Object attached.target.artifact.program attached.target.artifact.validationContext schema)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource = .ok sourceValue)
+    {core : Core} {fuel : Nat} (execution : Execution object core fuel)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ rawValue ir1Fuel ir1Store ir1Value controlFuel heapFuel physicalResult count finalState,
+      @Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+        sourceValue rawValue attached.source.memberScope ∧
+      MutualAddressedValueGraph
+        (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap)
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw)
+        attached.source.functionRel ir1Store rawValue ir1Value ∧
+      IxIR1.runOwnedMain attached.compiled.simulationSourceContext .shared
+        attached.target.artifact.source.main ir1Fuel = .ok (ir1Store, ir1Value) ∧
+      IxIR2.Eval.runMain attached.compiled.simulationTargetContext .physical
+        attached.target.artifact.program controlFuel heapFuel = .ok physicalResult ∧
+      IxIR2.Lower.Sim.OutcomeRel (ir1Store, ir1Value) physicalResult ∧
+      heapNat schema 10000 physicalResult.store.heap physicalResult.value = some object.selected.word.toNat ∧
+      IxIR2.Eval.releaseShared 10000 physicalResult.store physicalResult.value =
+        .ok (object.selected.reclaimed, object.selected.remaining) ∧
+      object.selected.reclaimed.heap.live = 0 ∧
+      object.selected.reclaimed.heap.allocs = object.selected.reclaimed.heap.frees ∧
+      0 < count ∧ count ≤ 3 * fuel ∧
+      ObjectEval.run object.object.bytes object.input.exportName base count core flags = .ok finalState ∧
+      finalState.rip = execution.returnAddress ∧ finalState.core.readReg .rax = object.selected.word := by
+  obtain ⟨rawValue, ir1Fuel, ir1Store, ir1Value, controlFuel, heapFuel, physicalResult,
+    relatedSource, graph, owned, physical, relatedPhysical⟩ := attached.sourcePhysical horacles hctx hsource
+  obtain ⟨observed, _, _⟩ := object.selected.refinesSuccessfulRun physical
+  obtain ⟨released, empty, balanced⟩ := object.selected.reclaimsSuccessfulRun physical
+  obtain ⟨count, finalState, positive, bounded, executed, returned, result⟩ := execution.objectReturns base flags
+  exact ⟨rawValue, ir1Fuel, ir1Store, ir1Value, controlFuel, heapFuel, physicalResult, count, finalState,
+    relatedSource, graph, owned, physical, relatedPhysical, observed, released, empty, balanced,
+    positive, bounded, executed, returned, result⟩
+
+end Ix.Compiler.X86.NatCalls
diff --git a/Ix/Compiler/X86/NatCallsSyntax.lean b/Ix/Compiler/X86/NatCallsSyntax.lean
new file mode 100644
index 000000000..ff9d527cb
--- /dev/null
+++ b/Ix/Compiler/X86/NatCallsSyntax.lean
@@ -0,0 +1,95 @@
+import Ix.Compiler.IxIR2.Validate
+import Ix.Compiler.X86.Basic
+
+namespace Ix.Compiler.X86.NatCalls
+open Ix.Compiler Ixon
+
+inductive CaptureMode where
+  | captureFree
+  | staticNat
+  deriving BEq, Repr
+
+structure Schema where
+  zero : IxIR2.CtorId
+  succ : IxIR2.CtorId
+  deriving BEq, Repr
+
+inductive Expr where
+  | argument
+  | constant (value : Word)
+  | successor (value : Expr)
+  | call (function : Nat) (argument : Expr)
+  deriving BEq, Repr, Inhabited
+
+inductive Value where
+  | nat (expression : Expr)
+  | closure (function : Address) (capture : Option Expr := none)
+  | staticNat (expression : Expr)
+  | erased
+  deriving BEq, Repr, Inhabited
+
+inductive Param where
+  | nat
+  | closure (function : Address) (capture : Option Expr := none)
+  | staticNat (expression : Expr)
+  | erased
+  deriving BEq, Repr, Inhabited
+
+structure Function where
+  origin : Option Address
+  parameters : Array Param
+  body : Expr
+  deriving BEq, Repr, Inhabited
+
+structure Residual where
+  functions : Array Function
+  entry : Nat
+  deriving BEq, Repr, Inhabited
+
+inductive Error where
+  | budget
+  | openMain
+  | controlFlow
+  | ownership
+  | unknownRegister
+  | wordOverflow
+  | notNat
+  | unknownFunction
+  | callArity
+  | multipleNatArguments
+  | capturedPap
+  | dynamicCapture
+  | unknownClosure
+  | constructor
+  | instruction
+  | returnValue
+  deriving BEq, Repr
+
+structure Limits where
+  depth : Nat := 32
+  functions : Nat := 64
+  instructions : Nat := 1024
+  captureFuel : Nat := 1024
+  deriving BEq, Repr
+
+/-- Mathematical Nat evaluation checks every intermediate bound; a wrapping
+Word calculation is never used to justify an exact Nat result. -/
+def evaluate (functions : Array Function) : Nat → Expr → Nat → Except Error Nat
+  | 0, _, _ => .error .budget
+  | fuel + 1, expression, argument => do
+      let result ← match expression with
+        | .argument => pure argument
+        | .constant value => pure value.toNat
+        | .successor expression => do pure ((← evaluate functions fuel expression argument) + 1)
+        | .call function expression =>
+            let some body := functions[function]? | throw .unknownFunction
+            let argument ← evaluate functions fuel expression argument
+            evaluate functions fuel body.body argument
+      if result >= UInt64.size then throw .wordOverflow
+      return result
+
+def Residual.evaluate (residual : Residual) (fuel : Nat := 1024) : Except Error Nat := do
+  let some main := residual.functions[residual.entry]? | throw .unknownFunction
+  NatCalls.evaluate residual.functions fuel main.body 0
+
+end Ix.Compiler.X86.NatCalls
diff --git a/Ix/Compiler/X86/ObjectExecution.lean b/Ix/Compiler/X86/ObjectExecution.lean
new file mode 100644
index 000000000..cb5835d41
--- /dev/null
+++ b/Ix/Compiler/X86/ObjectExecution.lean
@@ -0,0 +1,92 @@
+import Ix.Compiler.X86.ELFLink
+
+/-! Execution starts from the independently parsed object text and its
+exported symbol. The initial RIP is therefore selected by actual ELF bytes,
+rather than supplied as an unchecked address in a theorem premise. -/
+
+namespace Ix.Compiler.X86.Stream
+
+theorem checked_entry_bound (checked : Checked) : checked.program.entry.toNat < checked.program.blocks.size := by
+  have fields := checked.valid
+  simp only [Program.wellFormed, Bool.and_eq_true, and_assoc] at fields
+  simpa [Program.hasBlock] using fields.2.2.1
+
+theorem blockOffsets_get {program : Program} {index : Nat} (bound : index < program.blocks.size) :
+    (blockOffsets program)[index]? = some (blockOffset program index) := by
+  simp [blockOffsets, bound]
+
+theorem Valid.entryOffset {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) :
+    output.blockOffsets[checked.program.entry.toNat]? = some (blockOffset checked.program checked.program.entry.toNat) := by
+  rw [valid.offsets]
+  exact blockOffsets_get (checked_entry_bound checked)
+
+theorem initial_running (checked : Checked) (base : Word) (core : Core) (flags : ByteEval.Flags) :
+    RunningAt checked.program base (Machine.initial checked core)
+      ⟨core, base + UInt64.ofNat (blockOffset checked.program checked.program.entry.toNat), flags⟩ :=
+  ⟨rfl, rfl, rfl, _, target_entry (checked_entry_bound checked), rfl⟩
+
+theorem initial_related (checked : Checked) (base : Word) (core : Core) (flags : ByteEval.Flags) :
+    Related checked.program base (fun _ => False) (Machine.initial checked core)
+      ⟨core, base + UInt64.ofNat (blockOffset checked.program checked.program.entry.toNat), flags⟩ :=
+  ⟨⟨rfl, MemoryRelated.refl _, by simp [FramesMapped, Machine.initial]⟩,
+    rfl, _, target_entry (checked_entry_bound checked), rfl⟩
+
+end Ix.Compiler.X86.Stream
+
+namespace Ix.Compiler.X86.ObjectEval
+
+inductive Fault where
+  | object
+  | entry
+  | machine (fault : ByteEval.Fault)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def run (bytes : ByteArray) (name : String) (base : Word) (fuel : Nat) (core : Core) (flags : ByteEval.Flags := {}) :
+    Except Fault ByteEval.State := do
+  let some text := ELFRead.text? bytes | throw .object
+  let some offset := ELF.entry? bytes name | throw .entry
+  (ByteEval.run text base fuel ⟨core, base + UInt64.ofNat offset, flags⟩).mapError Fault.machine
+
+/-- Whole-object execution for every terminating call-free typed run. Both
+text fetch and entry selection are obtained from the actual serialized file. -/
+theorem run_from_typed {checked : Checked} {input : ELF.Input} {bytes : ByteArray}
+    (stream : Stream.Valid checked.program input.encoded) (object : ELF.Valid input bytes)
+    (entry : input.entryBlock = checked.program.entry) (free : Stream.CallFree checked.program)
+    (runtime : Runtime) (base : Word) (fuel : Nat) (core : Core) (flags : ByteEval.Flags)
+    {after : Machine} {result returnAddress : Word}
+    (execution : X86.runFrom runtime checked fuel core = after) (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ count finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      run bytes input.exportName base count core flags = .ok finalState ∧ Stream.Returned after.core returnAddress finalState := by
+  obtain ⟨count, finalState, positive, bound, executed, returned⟩ :=
+    Stream.run_to_return stream free runtime base fuel (Machine.initial checked core) _
+      (Stream.initial_running checked base core flags) execution halted slot
+  have selected := object.entry
+  rw [entry, stream.entryOffset] at selected
+  refine ⟨count, finalState, positive, bound, ?_, returned⟩
+  simp [run, object.text, selected, executed, Except.mapError]
+
+/-- The same actual-object entry point composes nested internal calls under
+the explicit stack/data-access conditions of `SafeTrace`. -/
+theorem run_with_calls {checked : Checked} {input : ELF.Input} {bytes : ByteArray}
+    (stream : Stream.Valid checked.program input.encoded) (object : ELF.Valid input bytes)
+    (entry : input.entryBlock = checked.program.entry)
+    (runtime : Runtime) (base : Word) (fuel : Nat) (core : Core) (flags : ByteEval.Flags)
+    (safe : Stream.SafeTrace runtime checked fuel (fun _ => False) (Machine.initial checked core))
+    {after : Machine} {result returnAddress : Word}
+    (execution : X86.runFrom runtime checked fuel core = after) (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ count holes finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      run bytes input.exportName base count core flags = .ok finalState ∧ finalState.rip = returnAddress ∧
+      Stream.CoreRelated checked.program base holes []
+        (after.core.setReg .rsp (after.core.readReg .rsp + 8)) finalState.core := by
+  obtain ⟨count, holes, finalState, positive, bound, executed, returned, related⟩ :=
+    Stream.run_with_calls stream runtime base fuel (fun _ => False) (Machine.initial checked core) _
+      (Stream.initial_related checked base core flags) safe execution halted slot
+  have selected := object.entry
+  rw [entry, stream.entryOffset] at selected
+  refine ⟨count, holes, finalState, positive, bound, ?_, returned, related⟩
+  simp [run, object.text, selected, executed, Except.mapError]
+
+end Ix.Compiler.X86.ObjectEval
diff --git a/Ix/Compiler/X86/PhysicalScalar.lean b/Ix/Compiler/X86/PhysicalScalar.lean
new file mode 100644
index 000000000..81f8f473e
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalar.lean
@@ -0,0 +1,97 @@
+import Ix.Compiler.X86.Scalar
+import Ix.Compiler.IxIR2.EvalFuel
+
+/-! A proof-facing scalar fragment of the actual physical IxIR₂ CFG.
+Registers contain exact literal Nats. Copying and scalar ownership operations
+preserve that representation; Nat peeling exposes the exact predecessor.
+Block edges substitute their arguments simultaneously. Direct calls target
+earlier functions, and bounded CFG expansion excludes cycles. -/
+namespace Ix.Compiler.X86.PhysicalScalar
+open Ix.Compiler.Ixon (Address)
+abbrev Entries := Array (Address × IxIR2.Function)
+
+def lookup (program : IxIR2.Program) (address : Address) : Option IxIR2.Decl :=
+  (program.declarations.find? (fun entry => entry.1 == address)).map (·.2)
+
+def lowerAtom (bindings : Array Scalar.Atom) : IxIR2.Atom → Option Scalar.Atom
+  | .reg index => bindings[index]?
+  | .lit (.nat number) => (ExactNat.encode number).map Scalar.Atom.constant
+  | _ => none
+
+def lowerAtoms (bindings : Array Scalar.Atom) (atoms : Array IxIR2.Atom) : Option (Array Scalar.Atom) :=
+  atoms.mapM (lowerAtom bindings)
+
+def parameters (count : Nat) : Array Scalar.Atom := (List.range count).toArray.map Scalar.Atom.var
+
+/-- These checks describe a complete credit-free edge, including the implicit
+predecessor register on a successor edge. -/
+inductive EdgeReady (definition : IxIR2.Function) (edge : IxIR2.Edge)
+    (arguments : Array Scalar.Atom) (implicitCount : Nat) : Prop where
+  | mk (target : IxIR2.Block)
+      (found : definition.blocks[edge.target]? = some target)
+      (arity : implicitCount + arguments.size = target.valueParams.size)
+      (credits : edge.credits = #[])
+      (targetCredits : target.creditParams = #[])
+
+/-- Selection certificates compose at an arbitrary instruction position.
+They record only syntax and checked indices, never runtime input values or
+an evaluator result. Unused copies are represented by an extended map. -/
+inductive Code (entries : Entries) (current : Nat) (definition : IxIR2.Function) :
+    Nat → Nat → Array Scalar.Atom → Nat → Scalar.Expr → Prop where
+  | ret {block pc bindings locals source target body}
+      (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+      (term : body.terminator = .ret source) (atom : lowerAtom bindings source = some target) :
+      Code entries current definition block pc bindings locals (.atom target)
+  | move {block pc bindings locals source target body expression}
+      (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.move source))
+      (atom : lowerAtom bindings source = some target)
+      (rest : Code entries current definition block (pc + 1) (bindings.push target) locals expression) :
+      Code entries current definition block pc bindings locals expression
+  | retain {block pc bindings locals source target body expression}
+      (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.retainShared source))
+      (atom : lowerAtom bindings source = some target)
+      (rest : Code entries current definition block (pc + 1) (bindings.push target) locals expression) :
+      Code entries current definition block pc bindings locals expression
+  | release {block pc bindings locals source target body expression}
+      (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.releaseShared source))
+      (atom : lowerAtom bindings source = some target)
+      (rest : Code entries current definition block (pc + 1) bindings locals expression) :
+      Code entries current definition block pc bindings locals expression
+  | drop {block pc bindings locals source target body expression}
+      (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.dropUnique source))
+      (atom : lowerAtom bindings source = some target)
+      (rest : Code entries current definition block (pc + 1) bindings locals expression) :
+      Code entries current definition block pc bindings locals expression
+  | jump {block pc bindings locals edge arguments body expression}
+      (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+      (term : body.terminator = .jump edge) (atoms : lowerAtoms bindings edge.values = some arguments)
+      (ready : EdgeReady definition edge arguments 0)
+      (rest : Code entries current definition edge.target 0 arguments locals expression) :
+      Code entries current definition block pc bindings locals expression
+  | branch {block pc bindings locals source target peel zeroArgs succArgs body zero successor}
+      (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+      (term : body.terminator = .switchValue source #[] (some peel))
+      (atom : lowerAtom bindings source = some target)
+      (zeroAtoms : lowerAtoms bindings peel.zero.values = some zeroArgs)
+      (succAtoms : lowerAtoms bindings peel.succ.values = some succArgs)
+      (zeroReady : EdgeReady definition peel.zero zeroArgs 0)
+      (succReady : EdgeReady definition peel.succ succArgs 1)
+      (zeroCode : Code entries current definition peel.zero.target 0 zeroArgs locals zero)
+      (succCode : Code entries current definition peel.succ.target 0 (#[.var locals] ++ succArgs) (locals + 1) successor) :
+      Code entries current definition block pc bindings locals
+        (.branch target zero (.letE (.sub target (.constant 1)) successor))
+  | call {block pc bindings locals address source arguments index callee body expression}
+      (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.call address source))
+      (atoms : lowerAtoms bindings source = some arguments)
+      (found : entries[index]? = some (address, callee)) (earlier : index < current)
+      (arity : arguments.size = callee.signature.params.size)
+      (rest : Code entries current definition block (pc + 1) (bindings.push (.var locals)) (locals + 1) expression) :
+      Code entries current definition block pc bindings locals (.letE (.call index arguments) expression)
+  | tailCall {block pc bindings locals address source arguments index callee body}
+      (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+      (term : body.terminator = .tailCall address source) (atoms : lowerAtoms bindings source = some arguments)
+      (found : entries[index]? = some (address, callee)) (earlier : index < current)
+      (arity : arguments.size = callee.signature.params.size) :
+      Code entries current definition block pc bindings locals (.call index arguments)
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarCapturedExport.lean b/Ix/Compiler/X86/PhysicalScalarCapturedExport.lean
new file mode 100644
index 000000000..8b5513b63
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarCapturedExport.lean
@@ -0,0 +1,101 @@
+import Ix.Compiler.X86.PhysicalScalarCapturedInit
+import Ix.Compiler.X86.ScalarBind
+
+namespace Ix.Compiler.X86.PhysicalScalar.Captured
+
+def policy : String := "physical-scalar-capture/1"
+
+structure Compiled (program : IxIR2.Program)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (limits : Limits) (provenance : ELF.Provenance) where
+  source : Initialized program schemas limits
+  selected : Selected program source.address
+  definitionFound : selected.entries[selected.scalar.program.entry]? = some (source.address, source.target)
+  bound : Scalar.Bound selected.scalar source.capture
+  native : Scalar.Output bound.checked
+  stream : Stream.Certified native.target
+  input : ELF.Input
+  encoded : input.encoded = stream.output
+  entry : input.entryBlock = native.target.program.entry
+  provenanceBound : input.provenance = provenance
+  object : ELF.Certified input
+
+def compile (program : IxIR2.Program)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema) (provenance : ELF.Provenance)
+    (name : String := "compilatrix_captured_scalar") (limits : Limits := {}) :
+    Except String (Compiled program schemas limits provenance) := do
+  let source ← checkInitializer program schemas limits
+  let selected ← select program source.address
+  if definitionFound : selected.entries[selected.scalar.program.entry]? = some (source.address, source.target) then
+    let bound ← Scalar.bind selected.scalar source.capture
+    let native ← Scalar.compile bound.checked
+    let stream ← (Stream.encode native.target).mapError reprStr
+    let input : ELF.Input := { encoded := stream.output, entryBlock := native.target.program.entry, exportName := name, provenance }
+    let object ← (ELF.writeChecked input).mapError reprStr
+    return {
+      source, selected, definitionFound, bound, native, stream, input, encoded := rfl, entry := rfl
+      provenanceBound := rfl, object }
+  else throw "captured scalar selected entry differs from the initialized closure target"
+
+/-- Every runtime Word executes the captured physical function with arguments
+in capture-first order and returns through the complete unary ELF entry. -/
+theorem Compiled.nativeReturns {program schemas limits provenance}
+    (compiled : Compiled program schemas limits provenance) (argument : Word)
+    (oracle : Ixon.Address → List IxIR2.Eval.RVal → Option IxIR2.Eval.RVal)
+    (stack : Scalar.Stack) (depth : compiled.bound.checked.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt #[argument] ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, Runs (IxIR2.Eval.Context.ofProgram program schemas oracle) .physical
+      (frame compiled.source.target 0 0 #[compiled.source.capture, argument]) word ∧
+      Nonempty (Scalar.ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack (some word)) := by
+  have arity : #[compiled.source.capture, argument].size = compiled.bound.function.parameters := by
+    simp [compiled.bound.binary]
+  obtain ⟨result, evaluated⟩ := compiled.selected.scalar.function_total _ _ compiled.bound.found _ arity
+  have contract := compiled.selected.contract (mode := .physical) (compiled.selected.declarations schemas oracle)
+    compiled.definitionFound compiled.bound.found
+  obtain ⟨word, success, physical⟩ := contract.evaluates _ result arity evaluated
+  subst result
+  obtain ⟨executed⟩ := compiled.native.root_run compiled.bound.entry (by rfl)
+    (compiled.bound.evaluates argument evaluated) stack depth core stackPointer arguments readable writable
+  have stream : Stream.Valid compiled.native.target.program compiled.input.encoded := by
+    rw [compiled.encoded]
+    exact compiled.stream.valid
+  exact ⟨word, physical, executed.objectResult stream compiled.object.valid compiled.entry base flags⟩
+
+theorem Compiled.physicalReturns {program schemas limits provenance}
+    (compiled : Compiled program schemas limits provenance) (argument : Word)
+    (oracle : Ixon.Address → List IxIR2.Eval.RVal → Option IxIR2.Eval.RVal)
+    {controlFuel heapFuel : Nat} {store : IxIR2.Eval.Store} {result : IxIR2.Eval.Result}
+    (physical : IxIR2.Eval.runFunction (IxIR2.Eval.Context.ofProgram program schemas oracle) .physical
+      compiled.source.target (#[compiled.source.capture, argument].map rval) controlFuel heapFuel store = .ok result)
+    (stack : Scalar.Stack) (depth : compiled.bound.checked.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt #[argument] ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, result.value = rval word ∧
+      result.store = (IxIR2.Eval.initialMachine compiled.source.target (#[compiled.source.capture, argument].map rval) 0 store).store ∧
+      Nonempty (Scalar.ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack (some word)) := by
+  obtain ⟨word, executed, native⟩ := compiled.nativeReturns argument oracle stack depth core stackPointer arguments readable writable base flags
+  have contract := compiled.selected.contract (mode := .physical) (compiled.selected.declarations schemas oracle)
+    compiled.definitionFound compiled.bound.found
+  obtain ⟨value, heap⟩ := executed.agrees (by simp [compiled.source.binary]) contract.nonempty physical
+  exact ⟨word, value, heap, native⟩
+
+def sourceProvenance {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel) : ELF.Provenance :=
+  .ixir1Policy (IxIR1.Optimizer.graphRoot attached.source.artifact.targetArtifacts attached.source.artifact.main) 7 1
+
+def compileSource {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel)
+    (name : String := "compilatrix_captured_scalar") (limits : Limits := {}) :
+    Except String (Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached)) :=
+  compile attached.target.artifact.program attached.target.artifact.validationContext.schemas
+    (sourceProvenance attached) name limits
+
+end Ix.Compiler.X86.PhysicalScalar.Captured
diff --git a/Ix/Compiler/X86/PhysicalScalarCapturedHeap.lean b/Ix/Compiler/X86/PhysicalScalarCapturedHeap.lean
new file mode 100644
index 000000000..5a0ce57cb
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarCapturedHeap.lean
@@ -0,0 +1,157 @@
+import Ix.Compiler.X86.PhysicalScalarSourceHeap
+
+namespace Ix.Compiler.X86.PhysicalScalar.Captured
+
+def emptyHeap (store : IxIR1.Store) : Prop := ∀ location, store.get? location = none
+
+theorem emptyHeap.nodes {store : IxIR1.Store} (empty : emptyHeap store) :
+    store.nodes = Array.replicate store.nodes.size none := by
+  apply Array.ext
+  · simp
+  · intro index small _
+    have absent := empty index
+    cases slot : store.nodes[index] with
+    | none => simp
+    | some box => simp [IxIR1.Store.get?, Array.getElem?_eq_getElem small, slot] at absent
+
+theorem emptyHeap.renamed {store : IxIR1.Store} (empty : emptyHeap store) (rename : Ixon.Address → Ixon.Address) :
+    IxIR1.Readdress.Store.mapAddresses rename store = store := by
+  cases store with
+  | mk nodes allocs reuses frees rcops =>
+      have shape := empty.nodes
+      simp only at shape
+      simp only [IxIR1.Readdress.Store.mapAddresses]
+      congr 1
+      conv => lhs; rw [shape]
+      simpa only [Array.map_replicate, Option.map_none] using shape.symm
+
+theorem emptyHeap.runtime {store : IxIR1.Store} (empty : emptyHeap store) (values : Array Word) :
+    IxIR2.Lower.Sim.SourceRuntimeInvariant store (values.map rval).toList.reverse := by
+  refine ⟨⟨?_, ?_⟩, ?_, ⟨?_⟩⟩
+  · intro location box found
+    simp [empty location] at found
+  · intro parent box child found
+    simp [empty parent] at found
+  · intro value member
+    simp only [List.mem_reverse, Array.toList_map, List.mem_map] at member
+    obtain ⟨word, _, rfl⟩ := member
+    trivial
+  · intro location world rc address arity captured found
+    simp [empty location] at found
+
+theorem emptyHeap.image {store : IxIR1.Store} (empty : emptyHeap store)
+    {world fuel} (attached : IxIR2.Pipeline.CompiledAttachment world fuel) : attached.SourceStoreImage store := by
+  refine ⟨store, empty.renamed _, ?_⟩
+  constructor
+  intro location world rc identity fields found
+  simp [empty location] at found
+
+theorem emptyHeap.owned {store : IxIR1.Store} (empty : emptyHeap store) (values : Array Word) :
+    IxIR1.Sim.RootOwnership store (IxIR1.Sim.rootsFor .shared (values.map rval).toList) := by
+  have ownership : IxIR1.Sim.RootOwnership store [] := by
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · simp
+    · intro location box found
+      simp [empty location] at found
+    · intro location box address arity captured found
+      simp [empty location] at found
+    · intro location box found
+      simp [empty location] at found
+  simpa using scalarArguments_owned ownership values
+
+/-- A closed initializer may leave dead slots, but its only live value is
+the returned shared PAP with one exact Word capture. -/
+structure Heap (store : IxIR1.Store) (address : Ixon.Address) (capture : Word) where
+  location : Nat
+  found : store.get? location = some ⟨.shared, 1, .papN address 2 #[rval capture]⟩
+  exclusive : ∀ index box, store.get? index = some box → index = location
+
+def exclusive (store : IxIR1.Store) (location : Nat) : Bool :=
+  (Array.range store.nodes.size).all fun index => index == location || (store.get? index).isNone
+
+theorem exclusive_sound {store : IxIR1.Store} {location : Nat} (accepted : exclusive store location = true) :
+    ∀ index box, store.get? index = some box → index = location := by
+  intro index box found
+  have small : index < store.nodes.size := by
+    by_cases small : index < store.nodes.size
+    · exact small
+    · simp [IxIR1.Store.get?, Array.getElem?_eq_none (Nat.le_of_not_gt small)] at found
+  have selected := Array.all_eq_true.mp accepted index (by simpa using small)
+  simpa [Array.getElem_range, found] using selected
+
+theorem Heap.box {store address capture} (heap : Heap store address capture)
+    {index box} (found : store.get? index = some box) :
+    box = ⟨.shared, 1, .papN address 2 #[rval capture]⟩ := by
+  have same := heap.exclusive index box found
+  subst index
+  exact (Option.some.inj (heap.found.symm.trans found)).symm
+
+theorem Heap.edges {store address capture} (heap : Heap store address capture) :
+    IxIR1.Sim.edgeLocations store = [] := by
+  apply List.flatMap_eq_nil_iff.mpr
+  intro slot member
+  cases slot with
+  | none => rfl
+  | some box =>
+      obtain ⟨index, small, located⟩ := Array.mem_iff_getElem.mp
+        (show some box ∈ store.nodes from by simpa using member)
+      have found : store.get? index = some box := by
+        simp [IxIR1.Store.get?, Array.getElem?_eq_getElem small, located]
+      rw [heap.box found]
+      simp [IxIR1.Sim.slotEdgeLocations, IxIR1.Sim.nodeChildren, rval, IxIR1.Sim.rvalLocation?]
+
+theorem Heap.owned {store address capture} (heap : Heap store address capture) :
+    IxIR1.Sim.RootOwnership store [⟨.shared, .loc heap.location⟩] := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro root member
+    simp only [List.mem_singleton] at member
+    subst root
+    exact ⟨_, heap.found, rfl⟩
+  · intro index box found child member
+    rw [heap.box found] at member ⊢
+    simp only [IxIR1.Sim.nodeChildren, List.mem_singleton] at member
+    subst child
+    trivial
+  · intro index box function arity arguments found _
+    rw [heap.box found]
+  · intro index box found
+    rw [heap.box found, heap.exclusive index box found]
+    simp [IxIR1.Sim.incoming, heap.edges, IxIR1.Sim.rootLocation?, IxIR1.Sim.rvalLocation?]
+
+def Heap.spent {store address capture} (heap : Heap store address capture) : IxIR1.Store :=
+  store.rcTick.kill heap.location
+
+theorem Heap.spent_empty {store address capture} (heap : Heap store address capture) : emptyHeap heap.spent := by
+  intro index
+  have small : heap.location < store.nodes.size := by
+    by_cases small : heap.location < store.nodes.size
+    · exact small
+    · have found := heap.found
+      simp [IxIR1.Store.get?, Array.getElem?_eq_none (Nat.le_of_not_gt small)] at found
+  by_cases same : index = heap.location
+  · subst index
+    simp [Heap.spent, IxIR1.Store.kill, IxIR1.Store.rcTick, IxIR1.Store.get?, small]
+  · have absent : store.get? index = none := by
+      cases found : store.get? index with
+      | none => rfl
+      | some box => exact False.elim (same (heap.exclusive index box found))
+    simpa [Heap.spent, IxIR1.Store.kill, IxIR1.Store.rcTick, IxIR1.Store.get?, Array.getElem?_setIfInBounds, same, Ne.symm same] using absent
+
+theorem Heap.drop {store address capture} (heap : Heap store address capture) (context : IxIR1.Ctx) (fuel : Nat) :
+    IxIR1.dropVal context (fuel + 4) store (.loc heap.location) = .ok heap.spent := by
+  simp [IxIR1.dropVal, heap.found, IxIR1.dropMany, Heap.spent, rval]
+
+/-- Successful ordinary application supplies the captured Word before the
+runtime argument and completely consumes the exported closure. -/
+theorem Heap.applied {store address capture} (heap : Heap store address capture)
+    {context : IxIR1.Ctx} {declaration : IxIR1.Decl}
+    (declared : context.decls address = some declaration) (safe : IxIR1.declPapSafe declaration = true)
+    (argument : Word) {fuel : Nat} {output : IxIR1.Store × IxIR1.RVal}
+    (applied : IxIR1.applyGo context fuel store (.loc heap.location) [rval argument] = .ok output) :
+    ∃ callFuel, IxIR1.invoke context callFuel address [rval capture, rval argument] heap.spent = .ok output := by
+  have padded := IxIR1.applyGo_mono (larger := fuel + 5) (by omega) applied
+  refine ⟨fuel + 4, ?_⟩
+  simpa [IxIR1.applyGo, heap.found, IxIR1.dupVals, heap.drop, declared, safe,
+    bind, Except.bind, pure, Except.pure, rval] using padded
+
+end Ix.Compiler.X86.PhysicalScalar.Captured
diff --git a/Ix/Compiler/X86/PhysicalScalarCapturedInit.lean b/Ix/Compiler/X86/PhysicalScalarCapturedInit.lean
new file mode 100644
index 000000000..155565694
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarCapturedInit.lean
@@ -0,0 +1,86 @@
+import Ix.Compiler.X86.PhysicalScalarCapturedHeap
+
+namespace Ix.Compiler.X86.PhysicalScalar.Captured
+
+/-- These limits bound the closed module initializer, before any runtime
+argument exists. They do not bound general allocating native programs. -/
+structure Limits where
+  control : Nat := 4096
+  heap : Nat := 16384
+  slots : Nat := 256
+  deriving Repr, Inhabited
+
+structure Initialized (program : IxIR2.Program)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema) (limits : Limits) where
+  result : IxIR2.Eval.Result
+  nullary : program.main.signature.params.size = 0
+  nonempty : program.main.blocks.isEmpty = false
+  run : IxIR2.Eval.runMain (IxIR2.Eval.Context.ofProgram program schemas (fun _ _ => none))
+    .physical program limits.control limits.heap = .ok result
+  address : Ixon.Address
+  capture : Word
+  heap : Heap result.store.heap address capture
+  value : result.value = .loc heap.location
+  target : IxIR2.Function
+  declared : lookup program address = some (.fn target)
+  safe : target.signature.papSafe = true
+  binary : target.signature.params.size = 2
+  allocationSlots : result.store.heap.allocs = result.store.heap.nodes.size
+  noReuse : result.store.heap.reuses = 0
+  accounted : result.store.heap.frees + 1 = result.store.heap.allocs
+  bounded : result.store.heap.nodes.size ≤ limits.slots
+
+/-- A successful check retains the actual initializer execution as a kernel
+proof. Only its single live, shared PAP and exact scalar capture are admitted. -/
+def checkInitializer (program : IxIR2.Program)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema) (limits : Limits := {}) :
+    Except String (Initialized program schemas limits) := do
+  if nullary : program.main.signature.params.size = 0 then
+    if nonempty : program.main.blocks.isEmpty = false then
+      match run : IxIR2.Eval.runMain (IxIR2.Eval.Context.ofProgram program schemas (fun _ _ => none))
+          .physical program limits.control limits.heap with
+      | .error error => throw s!"captured scalar initializer failed: {reprStr error}"
+      | .ok result =>
+        match value : result.value with
+        | .loc location =>
+          match found : result.store.heap.get? location with
+          | some ⟨.shared, 1, .papN address 2 #[.lit (.nat number)]⟩ =>
+            match encoded : ExactNat.encode number with
+            | none => throw "captured scalar initializer capture exceeds Word range"
+            | some capture =>
+              if sole : exclusive result.store.heap location = true then
+                match declared : lookup program address with
+                | some (.fn target) =>
+                  if safe : target.signature.papSafe = true then
+                    if binary : target.signature.params.size = 2 then
+                      if allocationSlots : result.store.heap.allocs = result.store.heap.nodes.size then
+                        if noReuse : result.store.heap.reuses = 0 then
+                          if accounted : result.store.heap.frees + 1 = result.store.heap.allocs then
+                            if bounded : result.store.heap.nodes.size ≤ limits.slots then
+                              return {
+                                result, nullary, nonempty, run, address, capture
+                                heap := { location
+                                          found := by simpa [rval, ExactNat.encode_some_iff.mp encoded] using found
+                                          exclusive := exclusive_sound sole }
+                                value, target, declared, safe, binary, allocationSlots, noReuse, accounted, bounded }
+                            else throw "captured scalar initializer exceeds the slot limit"
+                          else throw "captured scalar initializer has unaccounted allocations"
+                        else throw "captured scalar initializer reused storage"
+                      else throw "captured scalar initializer allocation count differs from its slots"
+                    else throw "captured scalar initializer target must have two parameters"
+                  else throw "captured scalar initializer target is not PAP-safe"
+                | _ => throw "captured scalar initializer target is missing"
+              else throw "captured scalar initializer leaves additional live heap values"
+          | _ => throw "captured scalar initializer must return one shared PAP with one Word capture and RC one"
+        | _ => throw "captured scalar initializer did not return a closure"
+    else throw "captured scalar initializer has no entry block"
+  else throw "captured scalar initializer must be nullary"
+
+theorem Initialized.reclaimed {program schemas limits} (source : Initialized program schemas limits) :
+    emptyHeap source.heap.spent ∧ source.heap.spent.frees = source.heap.spent.allocs ∧
+      source.heap.spent.allocs = source.result.store.heap.allocs ∧
+      source.heap.spent.rcops = source.result.store.heap.rcops + 1 ∧
+      source.heap.spent.reuses = 0 := by
+  exact ⟨source.heap.spent_empty, source.accounted, rfl, rfl, source.noReuse⟩
+
+end Ix.Compiler.X86.PhysicalScalar.Captured
diff --git a/Ix/Compiler/X86/PhysicalScalarCapturedSourceApply.lean b/Ix/Compiler/X86/PhysicalScalarCapturedSourceApply.lean
new file mode 100644
index 000000000..36a3ba2e2
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarCapturedSourceApply.lean
@@ -0,0 +1,148 @@
+import Ix.Compiler.X86.PhysicalScalarCapturedExport
+import Ix.Compiler.IxIR2.SourcePipelineSim
+
+namespace Ix.Compiler.X86.PhysicalScalar.Captured
+open Ix.Compiler.Pipeline (validatedEvalCtx validatedMainFrame validatedMainSource)
+
+variable {constants : List (Ixon.Address × Ixon.Constant)} {root : Ixon.Address}
+  {config : Ix.Compiler.Pipeline.Config} {eraseFuel lowerFuel : Nat} {limits : Limits}
+
+/-- The closed initializer identifies the source function's actual value
+graph and heap image through both compiler address passes. -/
+theorem Compiled.sourceFunction
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (compiled : Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached))
+    {fuel : Nat} {function : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) fuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function) :
+    ∃ rawFunction rawStore,
+      @Ix.Compiler.Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+        function rawFunction attached.source.memberScope ∧
+      IxIR1.Sim.ValueGraph attached.source.functionRel rawStore
+        (IxIR0.Readdress.Value.mapAddresses
+          (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap) rawFunction)
+        (.loc compiled.source.heap.location) ∧
+      IxIR1.Readdress.Store.mapAddresses
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) rawStore =
+        compiled.source.result.store.heap := by
+  obtain ⟨rawFunction, _, store, value, _, _, result, related, graph, _, physical, heaps⟩ :=
+    attached.sourcePhysical oracles contextWF entry
+  have same := IxIR2.Eval.runMain_success_unique compiled.source.nullary compiled.source.nonempty
+    physical compiled.source.run
+  have valueEq : value = .loc compiled.source.heap.location :=
+    heaps.value.symm.trans (same.2.trans compiled.source.value)
+  have storeEq : store = compiled.source.result.store.heap :=
+    heaps.heap.symm.trans (congrArg IxIR2.Eval.Store.heap same.1)
+  obtain ⟨rawStore, renamed, graph⟩ := graph
+  exact ⟨rawFunction, rawStore, related, valueEq ▸ graph, renamed.symm.trans storeEq⟩
+
+structure SourceRun
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (compiled : Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached)) (argument : Word) (result : Ixon.Eval.Value) where
+  rawResult : IxIR0.Value
+  rawStore : IxIR1.Store
+  store : IxIR1.Store
+  value : IxIR1.RVal
+  applyFuel : Nat
+  invokeFuel : Nat
+  controlFuel : Nat
+  heapFuel : Nat
+  physicalResult : IxIR2.Eval.Result
+  sourceRelated : @Ix.Compiler.Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+    result rawResult attached.source.memberScope
+  valueRelated : IxIR1.Sim.ValueGraph attached.source.functionRel rawStore
+    (IxIR0.Readdress.Value.mapAddresses
+      (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap) rawResult) value
+  storeRenamed : store = IxIR1.Readdress.Store.mapAddresses
+    (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) rawStore
+  applied : IxIR1.applyGo attached.compiled.simulationSourceContext applyFuel
+    compiled.source.result.store.heap (.loc compiled.source.heap.location) [rval argument] = .ok (store, value)
+  invoked : IxIR1.invoke attached.compiled.simulationSourceContext invokeFuel compiled.source.address
+    [rval compiled.source.capture, rval argument] compiled.source.heap.spent = .ok (store, value)
+  physical : IxIR2.Eval.runFunction attached.compiled.simulationTargetContext .physical
+    compiled.source.target (#[compiled.source.capture, argument].map rval) controlFuel heapFuel
+    { heap := compiled.source.heap.spent } = .ok physicalResult
+  agrees : IxIR2.Lower.Sim.OutcomeRel (store, value) physicalResult
+
+/-- Source application reaches the selected binary physical function with
+the checked capture followed by the runtime argument. Lower-stage dispatch,
+invocation and execution are conclusions, including closure reclamation. -/
+theorem Compiled.sourceRun
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (compiled : Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached)) (argument : Word)
+    {entryFuel applyFuel : Nat} {function result : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) entryFuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function)
+    (applied : Ixon.Eval.applyMany (validatedEvalCtx constants config) applyFuel
+      function (sourceArguments #[argument]) = .ok result) :
+    Nonempty (SourceRun attached compiled argument result) := by
+  letI : Ix.Compiler.Sim.MemberScope := attached.source.memberScope
+  obtain ⟨rawFunction, rawStore, functionRel, functionGraph, storeRenamed⟩ :=
+    compiled.sourceFunction attached oracles contextWF entry
+  have frameWF : (validatedMainFrame root).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [validatedMainFrame] at found
+  have functionWF := (Ixon.Eval.eval_inlineSharing contextWF frameWF .nil (by rfl) entry).2
+  obtain ⟨limit, rawResult, rawTrace, resultRel⟩ := Ix.Compiler.Sim.applyMany_sim_projectionSafe_inlineSharing
+    attached.source.members oracles contextWF functionWF (sourceArguments.wf #[argument]) applied functionRel
+    (sourceArguments.related _ _ #[argument])
+  have trace := IxIR0.Readdress.ProjectionSafe.AppliesBelow.mapAddresses attached.source.runtimeTraceRenames rawTrace
+  rw [rawArguments.renamed] at trace
+  have rawOwned : IxIR1.Sim.RootOwnership rawStore [⟨.shared, .loc compiled.source.heap.location⟩] := by
+    apply (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) rawStore _).mp
+    rw [storeRenamed]
+    exact compiled.source.heap.owned
+  have ownership : IxIR1.Sim.RootOwnership rawStore
+      (⟨.shared, .loc compiled.source.heap.location⟩ :: IxIR1.Sim.rootsFor .shared (#[argument].map rval).toList) := by
+    simpa using (scalarArguments_owned rawOwned #[argument]).perm List.perm_append_comm
+  obtain ⟨targetFuel, outputStore, outputValue, targetRun, outputGraph, _⟩ :=
+    attached.source.runtimeApply functionGraph (rawArguments.graph _ _ #[argument]) trace (by simp [rawArguments]) ownership
+  let store := IxIR1.Readdress.Store.mapAddresses
+    (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) outputStore
+  have targetApplied : IxIR1.applyGo attached.compiled.simulationSourceContext targetFuel
+      compiled.source.result.store.heap (.loc compiled.source.heap.location) [rval argument] = .ok (store, outputValue) := by
+    have renames : IxIR1.Readdress.Ctx.Renames
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw)
+        (attached.source.exactTargetCtx (fun _ _ => none)) attached.compiled.simulationSourceContext :=
+      attached.compiled.sourceContextRenames
+    conv => lhs; arg 3; rw [← storeRenamed]
+    rw [IxIR1.Readdress.applyGo_mapAddresses renames]
+    have targetRun : IxIR1.applyGo (attached.source.exactTargetCtx (fun _ _ => none)) targetFuel rawStore
+        (.loc compiled.source.heap.location) [rval argument] = .ok (outputStore, outputValue) := by
+      simpa using targetRun
+    rw [targetRun]
+    rfl
+  have declared : attached.compiled.simulationTargetContext.declarations compiled.source.address =
+      some (.fn compiled.source.target) := compiled.source.declared
+  obtain ⟨definition, functionTrace, _, matched, sourceDeclared⟩ :=
+    attached.compiled.functionTrace_of_target_declaration
+      (sourceContext := attached.compiled.simulationSourceContext) rfl rfl declared
+  have safe : IxIR1.declPapSafe (.fn definition) = true := by
+    change definition.papSafe = true
+    rw [← matched.source, ← functionTrace.sourcePapSafe, matched.generated]
+    exact compiled.source.safe
+  obtain ⟨invokeFuel, invoked⟩ := compiled.source.heap.applied sourceDeclared safe argument targetApplied
+  obtain ⟨controlFuel, heapFuel, physicalResult, physical, agrees⟩ :=
+    attached.compiled.successfulFunctionSimulation declared compiled.source.safe
+      (#[compiled.source.capture, argument].map rval) (by simpa using invoked)
+      (compiled.source.heap.spent_empty.owned _) (compiled.source.heap.spent_empty.runtime _)
+      (compiled.source.heap.spent_empty.image attached.compiled)
+  exact ⟨{
+    rawResult, rawStore := outputStore, store, value := outputValue
+    applyFuel := targetFuel, invokeFuel, controlFuel, heapFuel, physicalResult
+    sourceRelated := resultRel, valueRelated := outputGraph, storeRenamed := rfl
+    applied := targetApplied, invoked, physical, agrees }⟩
+
+end Ix.Compiler.X86.PhysicalScalar.Captured
diff --git a/Ix/Compiler/X86/PhysicalScalarCapturedSourceObject.lean b/Ix/Compiler/X86/PhysicalScalarCapturedSourceObject.lean
new file mode 100644
index 000000000..0abe0858b
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarCapturedSourceObject.lean
@@ -0,0 +1,97 @@
+import Ix.Compiler.X86.PhysicalScalarCapturedSourceApply
+
+namespace Ix.Compiler.X86.PhysicalScalar.Captured
+open Ix.Compiler.Pipeline (validatedEvalCtx validatedMainFrame validatedMainSource)
+
+variable {constants : List (Ixon.Address × Ixon.Constant)} {root : Ixon.Address}
+  {config : Ix.Compiler.Pipeline.Config} {eraseFuel lowerFuel : Nat} {limits : Limits}
+
+/-- Exact source application and invocation, with the initializer's heap
+fully reclaimed and every allocation accounted for. -/
+structure SourceResult
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (compiled : Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached)) (argument : Word) (result : Ixon.Eval.Value) (word : Word) : Prop where
+  related : @Ix.Compiler.Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+    result (rawArgument word) attached.source.memberScope
+  applied : ∃ fuel, IxIR1.applyGo attached.compiled.simulationSourceContext fuel
+    compiled.source.result.store.heap (.loc compiled.source.heap.location) [rval argument] =
+      .ok (compiled.source.heap.spent, rval word)
+  invoked : ∃ fuel, IxIR1.invoke attached.compiled.simulationSourceContext fuel compiled.source.address
+    [rval compiled.source.capture, rval argument] compiled.source.heap.spent =
+      .ok (compiled.source.heap.spent, rval word)
+  empty : emptyHeap compiled.source.heap.spent
+  accounted : compiled.source.heap.spent.frees = compiled.source.heap.spent.allocs
+
+/-- For every runtime Word, ordinary source application composes with actual
+captured PAP dispatch, physical CFG selection and execution of the complete
+unary ELF. Finite stack, saved registers and outside memory are covered by
+the native object result. No lower-stage execution is a caller premise. -/
+theorem Compiled.sourceReturns
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (compiled : Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached)) (argument : Word)
+    {entryFuel applyFuel : Nat} {function result : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) entryFuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function)
+    (applied : Ixon.Eval.applyMany (validatedEvalCtx constants config) applyFuel
+      function (sourceArguments #[argument]) = .ok result)
+    (stack : Scalar.Stack) (depth : compiled.bound.checked.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt #[argument] ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, SourceResult attached compiled argument result word ∧
+      Nonempty (Scalar.ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack (some word)) := by
+  obtain ⟨run⟩ := compiled.sourceRun attached argument oracles contextWF entry applied
+  obtain ⟨word, valueEq, heapEq, native⟩ := compiled.physicalReturns argument (fun _ _ => none)
+    (by simpa only [IxIR2.Pipeline.CompiledAttachment.simulationTargetContext,
+      IxIR2.Pipeline.Attached.compiled] using run.physical)
+    stack depth core stackPointer arguments readable writable base flags
+  have value : run.value = rval word := run.agrees.value.symm.trans valueEq
+  have heap : run.store = compiled.source.heap.spent :=
+    run.agrees.heap.symm.trans (congrArg IxIR2.Eval.Store.heap heapEq)
+  have raw : run.rawResult = rawArgument word := by
+    have graph := run.valueRelated
+    rw [value] at graph
+    cases selected : run.rawResult <;>
+      simp only [selected, IxIR0.Readdress.Value.mapAddresses] at graph <;> cases graph <;> rfl
+  refine ⟨word, ⟨?_, ?_, ?_, compiled.source.reclaimed.1, compiled.source.reclaimed.2.1⟩, native⟩
+  · simpa [raw] using run.sourceRelated
+  · exact ⟨run.applyFuel, by simpa [heap, value] using run.applied⟩
+  · exact ⟨run.invokeFuel, by simpa [heap, value] using run.invoked⟩
+
+theorem Compiled.sourceNatReturns
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (compiled : Compiled attached.target.artifact.program attached.target.artifact.validationContext.schemas
+      limits (sourceProvenance attached)) (argument : Word)
+    {entryFuel applyFuel number : Nat} {function : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) entryFuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function)
+    (applied : Ixon.Eval.applyMany (validatedEvalCtx constants config) applyFuel
+      function (sourceArguments #[argument]) = .ok (.litV (.natL number)))
+    (stack : Scalar.Stack) (depth : compiled.bound.checked.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt #[argument] ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, word.toNat = number ∧ SourceResult attached compiled argument (.litV (.natL number)) word ∧
+      Nonempty (Scalar.ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack (some word)) := by
+  obtain ⟨word, source, native⟩ := compiled.sourceReturns attached argument oracles contextWF entry applied
+    stack depth core stackPointer arguments readable writable base flags
+  have numberEq : word.toNat = number := by
+    have related := source.related
+    simp only [Ix.Compiler.Sim.InlinedValRel, Ixon.Eval.Value.inlineSharing, rawArgument] at related
+    cases related
+    rfl
+  exact ⟨word, numberEq, source, native⟩
+
+end Ix.Compiler.X86.PhysicalScalar.Captured
diff --git a/Ix/Compiler/X86/PhysicalScalarContracts.lean b/Ix/Compiler/X86/PhysicalScalarContracts.lean
new file mode 100644
index 000000000..5a34f59d2
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarContracts.lean
@@ -0,0 +1,83 @@
+import Ix.Compiler.X86.PhysicalScalarSelect
+import Ix.Compiler.X86.PhysicalScalarSim
+
+namespace Ix.Compiler.X86.PhysicalScalar
+open IxIR2.Eval
+
+theorem Selected.rowAt {program root} (selected : Selected program root) {index : Nat} {target : Scalar.Function}
+    (found : selected.scalar.program.functions[index]? = some target) :
+    ∃ row : Row selected.entries, selected.rows[index]? = some row ∧ row.index = index ∧
+      selected.entries[index]? = some (row.address, row.definition) ∧ row.target = target := by
+  rw [selected.functions, Array.getElem?_map] at found
+  cases rowAt : selected.rows[index]? with
+  | none => simp [rowAt] at found
+  | some row =>
+    have targetEq : row.target = target := by simpa [rowAt] using found
+    obtain ⟨bound, rowEq⟩ := Array.getElem?_eq_some_iff.mp rowAt
+    have member : (row, index) ∈ selected.rows.toList.zipIdx := by
+      have h := List.getElem_mem (l := selected.rows.toList.zipIdx) (n := index) (by simpa using bound)
+      simpa [rowEq] using h
+    have checked := List.all_eq_true.mp selected.indexed (row, index) member
+    simp only [Bool.and_eq_true, beq_iff_eq] at checked
+    exact ⟨row, rfl, checked.1, checked.2, targetEq⟩
+
+theorem Selected.declarations {program root} (selected : Selected program root)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (oracle : Ixon.Address → List RVal → Option RVal) :
+    Declarations (Context.ofProgram program schemas oracle) selected.entries := by
+  intro index address definition found
+  obtain ⟨bound, eq⟩ := Array.getElem?_eq_some_iff.mp found
+  have checked := Array.all_eq_true.mp selected.declared index bound
+  change lookup program address = some (.fn definition)
+  simpa only [eq, beq_iff_eq] using checked
+
+/-- Universal call contracts for all accepted physical functions. This is a
+single strong induction on the checked nonrecursive function order. -/
+theorem Selected.contract {program root} (selected : Selected program root)
+    {context : Context} {mode : Interpretation} (declarations : Declarations context selected.entries)
+    {index : Nat} {address : Ixon.Address} {definition : IxIR2.Function} {target : Scalar.Function}
+    (entryAt : selected.entries[index]? = some (address, definition))
+    (targetAt : selected.scalar.program.functions[index]? = some target) :
+    FunctionContract context mode definition selected.scalar.program.functions target := by
+  induction index using Nat.strongRecOn generalizing address definition target with
+  | ind index ih =>
+    obtain ⟨row, _, rowIndex, entry, rowTarget⟩ := selected.rowAt targetAt
+    have definitions : definition = row.definition := congrArg Prod.snd (Option.some.inj (entryAt.symm.trans entry))
+    subst definition
+    have callees : Callees context mode selected.entries selected.scalar.program.functions index := by
+      intro callee address definition target found earlier targetAt
+      exact ih callee earlier found targetAt
+    refine ⟨by simpa [rowTarget] using row.arity, row.nonempty, ?_⟩
+    intro values result arity evaluated
+    have code : Code selected.entries index row.definition 0 0 (parameters target.parameters) target.parameters target.body := by
+      simpa [rowIndex, rowTarget] using row.code
+    apply code.simulate declarations callees arity _ evaluated
+    simpa [arity] using EnvRel.parameters values
+
+/-- Compare the constructed execution with any successful physical run,
+even when its control and traversal budgets differ. The complete input heap
+is preserved (apart from the evaluator's initial peak bookkeeping). -/
+theorem Runs.agrees {context mode definition arguments word controlFuel heapFuel store result}
+    (executed : Runs context mode (frame definition 0 0 arguments) word)
+    (arity : arguments.size = definition.signature.params.size) (nonempty : definition.blocks.isEmpty = false)
+    (actual : runFunction context mode definition (arguments.map rval) controlFuel heapFuel store = .ok result) :
+    result.value = rval word ∧ result.store = (initialMachine definition (arguments.map rval) 0 store).store := by
+  rw [runFunction_eq_runMachine (by simpa using arity) nonempty] at actual
+  obtain ⟨actualCount, _, actualSteps⟩ := runMachine_steps actual
+  obtain ⟨count, heap, selectedSteps⟩ := executed
+    (initialMachine definition (arguments.map rval) 0 store).store .halt 0
+  have selectedSteps : IxIR2.Eval.Steps context mode count
+      (initialMachine definition (arguments.map rval) heap store)
+      { store := (initialMachine definition (arguments.map rval) 0 store).store
+        heapFuel := 0, control := .halted (rval word) } := by
+    simpa [initialMachine, frame, Exit.stack, Exit.result] using selectedSteps
+  have left := actualSteps.addHeapFuel heap
+  have right := selectedSteps.addHeapFuel heapFuel
+  have common : (initialMachine definition (arguments.map rval) heap store).addHeapFuel heapFuel =
+      (initialMachine definition (arguments.map rval) heapFuel store).addHeapFuel heap := by
+    simp [initialMachine, IxIR2.Eval.Machine.addHeapFuel, Nat.add_comm]
+  rw [common] at right
+  obtain ⟨_, heaps, _, values⟩ := left.halted_unique right
+  exact ⟨values, heaps⟩
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarControl.lean b/Ix/Compiler/X86/PhysicalScalarControl.lean
new file mode 100644
index 000000000..0bade797b
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarControl.lean
@@ -0,0 +1,208 @@
+import Ix.Compiler.X86.PhysicalScalarValues
+
+namespace Ix.Compiler.X86.PhysicalScalar
+open IxIR2.Eval
+
+inductive Exit where
+  | halt
+  | resume (caller : Frame) (rest : List Continuation)
+
+def Exit.stack : Exit → List Continuation
+  | .halt => []
+  | .resume caller rest => .resume caller :: rest
+
+def Exit.result (exit : Exit) (word : Word) : Control :=
+  match exit with
+  | .halt => .halted (rval word)
+  | .resume caller rest => .running { caller with values := caller.values.push (rval word) } rest
+
+def frame (definition : IxIR2.Function) (block pc : Nat) (values : Array Word) : Frame :=
+  { definition, block, pc, values := values.map rval }
+
+/-- A function suffix can execute under an arbitrary suspended caller and
+arbitrary heap. Scalar releases consume traversal fuel but preserve the whole
+store. Both budgets are constructed by the proof; neither is an input-specific
+certificate supplied to the selector. -/
+def Runs (context : Context) (mode : Interpretation) (start : Frame) (word : Word) : Prop :=
+  ∀ (store : Store) (exit : Exit) (suffix : Nat), ∃ controlCost heapCost,
+    IxIR2.Eval.Steps context mode controlCost
+      { store, heapFuel := heapCost + suffix, control := .running start exit.stack }
+      { store, heapFuel := suffix, control := exit.result word }
+
+theorem Runs.prepend {context mode before after word} (rest : Runs context mode after word) (cost : Nat)
+    (step : ∀ (store : Store) (exit : Exit) (fuel : Nat), Step context mode
+      { store, heapFuel := cost + fuel, control := .running before exit.stack }
+      { store, heapFuel := fuel, control := .running after exit.stack }) : Runs context mode before word := by
+  intro store exit suffix
+  obtain ⟨controls, heap, executed⟩ := rest store exit suffix
+  refine ⟨controls + 1, cost + heap, ?_⟩
+  simpa [Nat.add_assoc] using IxIR2.Eval.Steps.cons rfl (step store exit (heap + suffix)) executed
+
+theorem Runs.ret {context mode definition block pc values atom body word}
+    (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+    (term : body.terminator = .ret atom) (resolved : resolveAtom (values.map rval) atom = .ok (rval word)) :
+    Runs context mode (frame definition block pc values) word := by
+  intro store exit suffix
+  refine ⟨1, 0, ?_⟩
+  cases exit with
+  | halt =>
+    have step := Step.retHalt (context := context) (interpretation := mode)
+      (machine := { store, heapFuel := suffix, control := .running (frame definition block pc values) [] })
+      rfl blockAt endAt term resolved rfl rfl
+    simpa [Exit.stack, Exit.result] using step.toSteps rfl
+  | resume caller rest =>
+    have step := Step.retResume (context := context) (interpretation := mode)
+      (machine := { store, heapFuel := suffix, control := .running (frame definition block pc values) (.resume caller :: rest) })
+      rfl blockAt endAt term resolved rfl rfl
+    simpa [Exit.stack, Exit.result] using step.toSteps rfl
+
+theorem Runs.move {context mode definition block pc values atom body word result}
+    (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.move atom))
+    (resolved : resolveAtom (values.map rval) atom = .ok (rval word))
+    (rest : Runs context mode (frame definition block (pc + 1) (values.push word)) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 0
+  intro store exit fuel
+  obtain ⟨bound, instruction⟩ := Array.getElem?_eq_some_iff.mp instruction
+  simpa [frame] using Step.move (context := context) (interpretation := mode)
+    (machine := { store, heapFuel := fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt bound instruction resolved
+
+theorem Runs.retain {context mode definition block pc values atom body word result}
+    (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.retainShared atom))
+    (resolved : resolveAtom (values.map rval) atom = .ok (rval word))
+    (rest : Runs context mode (frame definition block (pc + 1) (values.push word)) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 0
+  intro store exit fuel
+  obtain ⟨bound, instruction⟩ := Array.getElem?_eq_some_iff.mp instruction
+  simpa [frame] using Step.retainShared (context := context) (interpretation := mode)
+    (machine := { store, heapFuel := fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt bound instruction resolved rfl
+
+theorem Runs.release {context mode definition block pc values atom body word result}
+    (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.releaseShared atom))
+    (resolved : resolveAtom (values.map rval) atom = .ok (rval word))
+    (rest : Runs context mode (frame definition block (pc + 1) values) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 1
+  intro store exit fuel
+  obtain ⟨bound, instruction⟩ := Array.getElem?_eq_some_iff.mp instruction
+  exact Step.releaseShared
+    (machine := { store, heapFuel := 1 + fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt bound instruction resolved
+    (by simp [releaseShared, releaseSharedWork, rval, Nat.add_comm])
+
+theorem Runs.drop {context mode definition block pc values atom body word result}
+    (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.dropUnique atom))
+    (resolved : resolveAtom (values.map rval) atom = .ok (rval word))
+    (rest : Runs context mode (frame definition block (pc + 1) values) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 1
+  intro store exit fuel
+  obtain ⟨bound, instruction⟩ := Array.getElem?_eq_some_iff.mp instruction
+  exact Step.dropUnique
+    (machine := { store, heapFuel := 1 + fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt bound instruction resolved
+    (by simp [dropUnique, dropUniqueWork, rval, Nat.add_comm])
+
+theorem edge_transfer {definition block pc values edge arguments implicitWords targets implicitCount}
+    (ready : EdgeReady definition edge targets implicitCount)
+    (argumentsSize : arguments.size = targets.size) (implicitSize : implicitWords.size = implicitCount)
+    (resolved : resolveAtoms (values.map rval) edge.values = .ok (arguments.map rval)) :
+    EdgeTransfer (frame definition block pc values) edge (implicitWords.map rval)
+      (frame definition edge.target 0 (implicitWords ++ arguments)) := by
+  obtain ⟨target, found, arity, credits, targetCredits⟩ := ready
+  have step := EdgeTransfer.baseline (frame := frame definition block pc values)
+    (implicitValues := implicitWords.map rval) resolved rfl credits found
+    (by simpa [argumentsSize, implicitSize] using arity) targetCredits
+  simpa [frame] using step
+
+theorem Runs.jump {context mode definition block pc values edge arguments targets body result}
+    (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+    (term : body.terminator = .jump edge) (ready : EdgeReady definition edge targets 0)
+    (argumentsSize : arguments.size = targets.size)
+    (resolved : resolveAtoms (values.map rval) edge.values = .ok (arguments.map rval))
+    (rest : Runs context mode (frame definition edge.target 0 arguments) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 0
+  intro store exit fuel
+  have transferred := edge_transfer (block := block) (pc := pc) (implicitWords := #[]) ready argumentsSize rfl resolved
+  simp only [Array.map_empty, Array.empty_append] at transferred
+  simpa using Step.jump (machine := { store, heapFuel := fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt endAt term transferred
+
+theorem Runs.zero {context mode definition block pc values atom peel arguments targets body result}
+    (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+    (term : body.terminator = .switchValue atom #[] (some peel))
+    (scrutinee : resolveAtom (values.map rval) atom = .ok (rval 0))
+    (ready : EdgeReady definition peel.zero targets 0) (argumentsSize : arguments.size = targets.size)
+    (resolved : resolveAtoms (values.map rval) peel.zero.values = .ok (arguments.map rval))
+    (rest : Runs context mode (frame definition peel.zero.target 0 arguments) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 0
+  intro store exit fuel
+  have transferred := edge_transfer (block := block) (pc := pc) (implicitWords := #[]) ready argumentsSize rfl resolved
+  simp only [Array.map_empty, Array.empty_append] at transferred
+  simpa using Step.switchNatZero (machine := { store, heapFuel := fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt endAt term scrutinee transferred
+
+theorem Runs.successor {context mode definition block pc values atom peel arguments targets body result word}
+    (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+    (term : body.terminator = .switchValue atom #[] (some peel))
+    (positive : word ≠ 0) (scrutinee : resolveAtom (values.map rval) atom = .ok (rval word))
+    (ready : EdgeReady definition peel.succ targets 1) (argumentsSize : arguments.size = targets.size)
+    (resolved : resolveAtoms (values.map rval) peel.succ.values = .ok (arguments.map rval))
+    (rest : Runs context mode (frame definition peel.succ.target 0 (#[ExactNat.sub word 1] ++ arguments)) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 0
+  intro store exit fuel
+  have transferred := edge_transfer (block := block) (pc := pc) (implicitWords := #[ExactNat.sub word 1]) ready argumentsSize rfl resolved
+  have nonzero : word.toNat ≠ 0 := by intro eq; exact positive (UInt64.toNat_inj.mp eq)
+  have successor : word.toNat - 1 + 1 = word.toNat := by omega
+  have scrutinee : resolveAtom (values.map rval) atom = .ok (.lit (.nat (word.toNat - 1 + 1))) := by
+    simpa [rval, successor] using scrutinee
+  have transferred : EdgeTransfer (frame definition block pc values) peel.succ #[.lit (.nat (word.toNat - 1))]
+      (frame definition peel.succ.target 0 (#[ExactNat.sub word 1] ++ arguments)) := by
+    simpa [rval, ExactNat.sub_toNat] using transferred
+  simpa using Step.switchNatSucc (machine := { store, heapFuel := fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt endAt term scrutinee transferred
+
+theorem Runs.tailCall {context mode definition block pc values address atoms callee arguments body result}
+    (blockAt : definition.blocks[block]? = some body) (endAt : pc = body.instructions.size)
+    (term : body.terminator = .tailCall address atoms)
+    (resolved : resolveAtoms (values.map rval) atoms = .ok (arguments.map rval))
+    (declared : context.declarations address = some (.fn callee))
+    (arity : arguments.size = callee.signature.params.size) (nonempty : callee.blocks.isEmpty = false)
+    (rest : Runs context mode (frame callee 0 0 arguments) result) :
+    Runs context mode (frame definition block pc values) result := by
+  apply rest.prepend 0
+  intro store exit fuel
+  simpa [frame] using Step.tailCallFn (context := context) (interpretation := mode)
+    (machine := { store, heapFuel := fuel, control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt endAt term rfl resolved declared (by simpa using arity) nonempty
+
+theorem Runs.call {context mode definition block pc values address atoms callee arguments body bound result}
+    (blockAt : definition.blocks[block]? = some body) (instruction : body.instructions[pc]? = some (.call address atoms))
+    (resolved : resolveAtoms (values.map rval) atoms = .ok (arguments.map rval))
+    (declared : context.declarations address = some (.fn callee))
+    (arity : arguments.size = callee.signature.params.size) (nonempty : callee.blocks.isEmpty = false)
+    (called : Runs context mode (frame callee 0 0 arguments) bound)
+    (rest : Runs context mode (frame definition block (pc + 1) (values.push bound)) result) :
+    Runs context mode (frame definition block pc values) result := by
+  intro store exit suffix
+  obtain ⟨restControl, restHeap, continuation⟩ := rest store exit suffix
+  obtain ⟨callControl, callHeap, executed⟩ := called store (.resume (frame definition block (pc + 1) values) exit.stack) (restHeap + suffix)
+  obtain ⟨position, instruction⟩ := Array.getElem?_eq_some_iff.mp instruction
+  have entered := Step.callFn (context := context) (interpretation := mode)
+    (machine := { store, heapFuel := callHeap + (restHeap + suffix), control := .running (frame definition block pc values) exit.stack })
+    rfl blockAt position instruction rfl resolved declared (by simpa using arity) nonempty
+  have executed : IxIR2.Eval.Steps context mode callControl
+      { store, heapFuel := callHeap + (restHeap + suffix)
+        control := .running (frame callee 0 0 arguments) (.resume (frame definition block (pc + 1) values) :: exit.stack) }
+      { store, heapFuel := restHeap + suffix, control := .running (frame definition block (pc + 1) (values.push bound)) exit.stack } := by
+    simpa [Exit.stack, Exit.result, frame] using executed
+  refine ⟨callControl + restControl + 1, callHeap + restHeap, ?_⟩
+  simpa [frame, Nat.add_assoc] using IxIR2.Eval.Steps.cons rfl entered (executed.trans continuation)
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarExamples.lean b/Ix/Compiler/X86/PhysicalScalarExamples.lean
new file mode 100644
index 000000000..05412c385
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarExamples.lean
@@ -0,0 +1,91 @@
+import Ix.Compiler.X86.PhysicalScalarExport
+
+namespace Ix.Compiler.X86.PhysicalScalar.Examples
+open Ixon (Address)
+
+def block (parameters : Nat) (instructions : Array IxIR2.Instr) (terminator : IxIR2.Terminator) : IxIR2.Block :=
+  { valueParams := Array.replicate parameters .scalar, creditParams := #[], instructions, terminator }
+
+def function (arity : Nat) (blocks : Array IxIR2.Block) : IxIR2.Function :=
+  { signature := { params := Array.replicate arity ⟨.shared, .owned⟩, result := .shared, papSafe := true }, blocks }
+
+def edge (target : Nat) (values : Array IxIR2.Atom) : IxIR2.Edge := { target, values, credits := #[] }
+
+def root : Address := Address.replicate 0x40
+def helper : Address := Address.replicate 0x41
+
+def program (definition : IxIR2.Function) (helpers : List (Address × IxIR2.Decl) := []) : IxIR2.Program :=
+  { declarations := helpers ++ [(root, .fn definition)]
+    main := function 0 #[block 0 #[] (.ret (.lit (.nat 0)))] }
+
+def diamond : IxIR2.Program := program (function 2 #[
+  block 2 #[] (.switchValue (.reg 0) #[] (some ⟨edge 1 #[.reg 1, .reg 0], edge 2 #[.reg 1, .reg 0]⟩)),
+  block 2 #[.move (.reg 0)] (.jump (edge 3 #[.reg 2, .reg 1])),
+  block 3 #[.retainShared (.reg 0), .releaseShared (.reg 2)] (.jump (edge 3 #[.reg 3, .reg 1])),
+  block 2 #[.dropUnique (.reg 1)] (.ret (.reg 0))])
+
+def swap : IxIR2.Program := program (function 2 #[
+  block 2 #[] (.jump (edge 1 #[.reg 1, .reg 0])),
+  block 2 #[.move (.reg 0)] (.ret (.reg 1))])
+
+def permuted : IxIR2.Program := program (function 2 #[
+  block 2 #[] (.jump (edge 3 #[.reg 1, .reg 0])),
+  block 2 #[] (.ret (.reg 0)),
+  block 1 #[] (.ret (.reg 0)),
+  block 2 #[] (.switchValue (.reg 1) #[] (some ⟨edge 1 #[.reg 0, .reg 1], edge 4 #[.reg 0, .reg 1]⟩)),
+  block 3 #[] (.jump (edge 1 #[.reg 2, .reg 1]))])
+
+def constant : IxIR2.Program := program (function 2 #[block 2 #[.call helper #[]] (.ret (.reg 2))])
+  [(helper, .fn (function 0 #[block 0 #[] (.ret (.lit (.nat (UInt64.size - 1))))]))]
+
+def cfgs : List (String × IxIR2.Program) := [("diamond", diamond), ("swap", swap), ("permuted", permuted), ("constant", constant)]
+
+def expansion : IxIR2.Program := Id.run do
+  let mut blocks := #[]
+  for index in [:13] do
+    let start := index * 3
+    blocks := blocks ++ #[
+      block (if index == 0 then 2 else 1) #[] (.switchValue (.reg 0) #[]
+        (some ⟨edge (start + 1) #[.reg 0], edge (start + 2) #[.reg 0]⟩)),
+      block 1 #[] (.jump (edge (start + 3) #[.reg 0])),
+      block 2 #[] (.jump (edge (start + 3) #[.reg 1]))]
+  return program (function 2 (blocks.push (block 1 #[] (.ret (.reg 0)))))
+
+def rejections : List (String × IxIR2.Program) :=
+  let one := fun instructions terminator => program (function 2 #[block 2 instructions terminator])
+  let ret := IxIR2.Terminator.ret (.reg 0)
+  let jump := fun e => program (function 2 #[block 2 #[] (.jump e), block 1 #[] (.ret (.reg 0))])
+  let cid : IxIR2.CtorId := ⟨Address.replicate 0x20, 0, 0⟩
+  let credit : IxIR2.CreditCap := .required (Address.replicate 0x22)
+  let identity := function 1 #[block 1 #[] (.ret (.reg 0))]
+  [
+    ("unknown-register", one #[] (.ret (.reg 2))),
+    ("erased-result", one #[] (.ret .erased)),
+    ("literal-overflow", one #[] (.ret (.lit (.nat UInt64.size)))),
+    ("unknown-block", jump (edge 99 #[.reg 0])),
+    ("edge-arity", jump (edge 1 #[.reg 0, .reg 1])),
+    ("edge-credit", jump { edge 1 #[.reg 0] with credits := #[0] }),
+    ("target-credit", program (function 2 #[block 2 #[] (.jump (edge 1 #[.reg 0])),
+      { block 1 #[] (.ret (.reg 0)) with creditParams := #[credit] }])),
+    ("missing-peel", one #[] (.switchValue (.reg 0) #[] none)),
+    ("constructor-switch", one #[] (.switchValue (.reg 0) #[⟨cid, edge 0 #[]⟩] (some ⟨edge 0 #[], edge 0 #[]⟩))),
+    ("allocation", one #[.alloc .shared cid #[]] ret),
+    ("fetch", one #[.fetch (.reg 0) cid 0] ret),
+    ("extern", one #[.extern helper #[.reg 0]] ret),
+    ("apply", one #[.apply (.reg 0) #[.reg 1]] ret),
+    ("pap", one #[.papp helper #[]] ret),
+    ("self-call", one #[.callSelf #[.reg 0, .reg 1]] ret),
+    ("self-tail-call", one #[] (.tailCallSelf #[.reg 0, .reg 1])),
+    ("recursive-call", one #[.call root #[.reg 0, .reg 1]] ret),
+    ("missing-callee", one #[.call helper #[.reg 0]] ret),
+    ("extern-callee", program (function 2 #[block 2 #[.call helper #[.reg 0]] ret]) [(helper, .extern 1)]),
+    ("call-arity", program (function 2 #[block 2 #[.call helper #[]] ret]) [(helper, .fn identity)]),
+    ("parameters", program (function 3 #[block 3 #[] ret])),
+    ("no-blocks", program (function 2 #[])),
+    ("cycle", one #[] (.jump (edge 0 #[.reg 0, .reg 1]))),
+    ("local-capacity", program (function 2 #[block 2 (Array.replicate 31 (.call helper #[.reg 0])) (.ret (.reg 32))])
+      [(helper, .fn identity)]),
+    ("expansion-budget", expansion),
+    ("instruction-budget", one (Array.replicate 129 (.move (.reg 0))) ret)]
+
+end Ix.Compiler.X86.PhysicalScalar.Examples
diff --git a/Ix/Compiler/X86/PhysicalScalarExport.lean b/Ix/Compiler/X86/PhysicalScalarExport.lean
new file mode 100644
index 000000000..551ca3285
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarExport.lean
@@ -0,0 +1,155 @@
+import Ix.Compiler.X86.PhysicalScalarObject
+
+namespace Ix.Compiler.X86.PhysicalScalar
+open IxIR2.Eval
+
+def papBlock (address : Ixon.Address) : IxIR2.Block :=
+  { valueParams := #[], creditParams := #[], instructions := #[.papp address #[]], terminator := .ret (.reg 0) }
+
+def tailBlock (address : Ixon.Address) : IxIR2.Block :=
+  { valueParams := #[], creditParams := #[], instructions := #[], terminator := .tailCall address #[] }
+
+/-- The module's exported value must be an uncaptured function closure.
+Nullary tail aliases may lead to that closure; runtime CFG selection starts
+at its declared target. This adapter is separate from instruction selection. -/
+inductive ExportPath (program : IxIR2.Program) (address : Ixon.Address) (target : IxIR2.Function) : IxIR2.Function → Prop where
+  | closure {definition}
+      (nullary : definition.signature.params.size = 0) (shared : definition.signature.result = .shared)
+      (blocks : definition.blocks = #[papBlock address])
+      (declared : lookup program address = some (.fn target))
+      (papSafe : target.signature.papSafe = true) (positive : 0 < target.signature.params.size) :
+      ExportPath program address target definition
+  | tail {definition alias callee}
+      (nullary : definition.signature.params.size = 0) (blocks : definition.blocks = #[tailBlock alias])
+      (declared : lookup program alias = some (.fn callee))
+      (rest : ExportPath program address target callee) : ExportPath program address target definition
+
+theorem ExportPath.nullary {program address target definition} (path : ExportPath program address target definition) :
+    definition.signature.params.size = 0 := by cases path <;> assumption
+
+theorem ExportPath.nonempty {program address target definition} (path : ExportPath program address target definition) :
+    definition.blocks.isEmpty = false := by cases path <;> simp_all
+
+theorem ExportPath.declared {program address target definition} (path : ExportPath program address target definition) :
+    lookup program address = some (.fn target) := by
+  induction path with
+  | closure _ _ _ declared _ _ => exact declared
+  | tail _ _ _ _ ih => exact ih
+
+theorem ExportPath.papSafe {program address target definition} (path : ExportPath program address target definition) :
+    target.signature.papSafe = true := by
+  induction path with
+  | closure _ _ _ _ safe _ => exact safe
+  | tail _ _ _ _ ih => exact ih
+
+theorem ExportPath.positive {program address target definition} (path : ExportPath program address target definition) :
+    0 < target.signature.params.size := by
+  induction path with
+  | closure _ _ _ _ _ positive => exact positive
+  | tail _ _ _ _ ih => exact ih
+
+def closureStore (address : Ixon.Address) (target : IxIR2.Function) : Store :=
+  (({} : Store).allocNode .shared (.papN address target.signature.params.size #[])).1
+
+theorem closureStore.view (address : Ixon.Address) (target : IxIR2.Function) :
+    (closureStore address target).get? 0 = some ⟨.shared, 1, .papN address target.signature.params.size #[]⟩ := rfl
+
+/-- The checked module entry really returns the closure selected for the
+runtime ABI. No runtime scalar input is evaluated during this check. -/
+theorem ExportPath.steps {program address target definition} (path : ExportPath program address target definition)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (oracle : Ixon.Address → List RVal → Option RVal) :
+    ∃ count, IxIR2.Eval.Steps (Context.ofProgram program schemas oracle) .physical count
+      (initialMachine definition #[] 0)
+      { store := closureStore address target, heapFuel := 0, control := .halted (.loc 0) } := by
+  induction path with
+  | @closure definition nullary shared blocks declared papSafe positive =>
+    let context := Context.ofProgram program schemas oracle
+    let start := initialMachine definition #[] 0
+    let middle : IxIR2.Eval.Machine := {
+      store := closureStore address target, heapFuel := 0
+      control := .running { definition, pc := 1, values := #[.loc 0] } [] }
+    have allocated := Step.pappFn (context := context) (interpretation := .physical) (machine := start)
+      (frame := { definition, values := #[] }) (block := papBlock address)
+      rfl (by simp [blocks]) (by simp [papBlock]) rfl rfl declared papSafe rfl positive
+    have allocated : Step context .physical start middle := allocated
+    have returned : Step context .physical middle
+        { store := closureStore address target, heapFuel := 0, control := .halted (.loc 0) } :=
+      Step.retHalt (machine := middle) (block := papBlock address)
+        rfl (by simp [blocks]) rfl rfl rfl rfl (by rw [shared]; rfl)
+    exact ⟨2, (allocated.toSteps rfl).trans (returned.toSteps rfl)⟩
+  | @tail definition alias callee nullary blocks declared rest ih =>
+    obtain ⟨count, executed⟩ := ih
+    have entered := Step.tailCallFn (context := Context.ofProgram program schemas oracle) (interpretation := .physical)
+      (machine := initialMachine definition #[] 0) (frame := { definition, values := #[] }) (block := tailBlock alias)
+      rfl (by simp [blocks]) rfl rfl rfl rfl declared rest.nullary.symm rest.nonempty
+    refine ⟨count + 1, ?_⟩
+    exact .cons rfl entered executed
+
+theorem ExportPath.runMain {program address target} (path : ExportPath program address target program.main)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (oracle : Ixon.Address → List RVal → Option RVal) :
+    ∃ count, runMain (Context.ofProgram program schemas oracle) .physical program count 0 =
+      .ok { store := closureStore address target, value := .loc 0, controlRemaining := 0, heapRemaining := 0 } := by
+  obtain ⟨count, steps⟩ := path.steps schemas oracle
+  exact ⟨count, (runMain_eq_runMachine path.nullary path.nonempty).trans steps.runMachine_halted⟩
+
+structure ExportedFrom (program : IxIR2.Program) (definition : IxIR2.Function) where
+  address : Ixon.Address
+  target : IxIR2.Function
+  path : ExportPath program address target definition
+
+private def resolveFrom (program : IxIR2.Program) : Nat → (definition : IxIR2.Function) → Except String (ExportedFrom program definition)
+  | 0, _ => throw "physical scalar export aliases are cyclic or exceed the depth limit"
+  | fuel + 1, definition => do
+    if nullary : definition.signature.params.size = 0 then
+      match _bodyAt : definition.blocks[0]? with
+      | none => throw "physical scalar module export is missing"
+      | some body =>
+        match body.instructions.toList, body.terminator with
+        | [.papp address #[]], .ret (.reg 0) =>
+          if blocks : definition.blocks = #[papBlock address] then
+            if shared : definition.signature.result = .shared then
+              match declared : lookup program address with
+              | some (.fn target) =>
+                if papSafe : target.signature.papSafe = true then
+                  if positive : 0 < target.signature.params.size then
+                    return ⟨address, target, .closure nullary shared blocks declared papSafe positive⟩
+                  else throw "physical scalar exported closure is saturated"
+                else throw "physical scalar exported function is not PAP-safe"
+              | _ => throw "physical scalar exported closure target is missing"
+            else throw "physical scalar exported closure has the wrong ownership world"
+          else throw "physical scalar exported closure wrapper has unsupported blocks"
+        | [], .tailCall address #[] =>
+          if blocks : definition.blocks = #[tailBlock address] then
+            match declared : lookup program address with
+            | some (.fn callee) =>
+              let rest ← resolveFrom program fuel callee
+              return ⟨rest.address, rest.target, .tail nullary blocks declared rest.path⟩
+            | _ => throw "physical scalar export alias is missing"
+          else throw "physical scalar export alias has unsupported blocks"
+        | _, _ => throw "physical scalar module must export an uncaptured function closure"
+    else throw "physical scalar module export wrapper is not nullary"
+
+def resolveExport (program : IxIR2.Program) : Except String (ExportedFrom program program.main) :=
+  resolveFrom program 32 program.main
+
+structure Exported (program : IxIR2.Program) (provenance : ELF.Provenance) where
+  source : ExportedFrom program program.main
+  compiled : Compiled program source.address provenance
+  same : compiled.definition = source.target
+
+def compileExport (program : IxIR2.Program) (provenance : ELF.Provenance)
+    (name : String := "compilatrix_physical_scalar") : Except String (Exported program provenance) := do
+  let source ← resolveExport program
+  let compiled ← compile program source.address provenance name
+  if same : compiled.definition = source.target then return { source, compiled, same }
+  else throw "physical scalar exported target differs from its selected definition"
+
+def compileSourceExport {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel)
+    (name : String := "compilatrix_physical_scalar") :
+    Except String (Exported attached.target.artifact.program (sourceProvenance attached)) :=
+  compileExport attached.target.artifact.program (sourceProvenance attached) name
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarObject.lean b/Ix/Compiler/X86/PhysicalScalarObject.lean
new file mode 100644
index 000000000..857967805
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarObject.lean
@@ -0,0 +1,114 @@
+import Ix.Compiler.X86.PhysicalScalarContracts
+import Ix.Compiler.X86.ScalarObject
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.IxIR1.Optimizer
+
+namespace Ix.Compiler.X86.PhysicalScalar
+
+def policy : String := "physical-scalar-cfg/1"
+
+structure Compiled (program : IxIR2.Program) (root : Ixon.Address) (provenance : ELF.Provenance) where
+  selected : Selected program root
+  definition : IxIR2.Function
+  definitionFound : selected.entries[selected.scalar.program.entry]? = some (root, definition)
+  target : Scalar.Function
+  targetFound : selected.scalar.program.functions[selected.scalar.program.entry]? = some target
+  native : Scalar.Output selected.scalar
+  stream : Stream.Certified native.target
+  input : ELF.Input
+  encoded : input.encoded = stream.output
+  entry : input.entryBlock = native.target.program.entry
+  provenanceBound : input.provenance = provenance
+  object : ELF.Certified input
+
+def compile (program : IxIR2.Program) (root : Ixon.Address) (provenance : ELF.Provenance)
+    (name : String := "compilatrix_physical_scalar") : Except String (Compiled program root provenance) := do
+  let selected ← select program root
+  match definitionFound : selected.entries[selected.scalar.program.entry]? with
+  | none => throw "physical scalar selected entry is missing"
+  | some (address, definition) =>
+    if same : address = root then
+      match targetFound : selected.scalar.program.functions[selected.scalar.program.entry]? with
+      | none => throw "physical scalar native entry is missing"
+      | some target =>
+        let native ← Scalar.compile selected.scalar
+        let stream ← (Stream.encode native.target).mapError reprStr
+        let input : ELF.Input := { encoded := stream.output, entryBlock := native.target.program.entry, exportName := name, provenance }
+        let object ← (ELF.writeChecked input).mapError reprStr
+        return {
+          selected, definition, definitionFound := by simpa [same] using definitionFound
+          target, targetFound, native, stream, input, encoded := rfl, entry := rfl, provenanceBound := rfl, object }
+    else throw "physical scalar entry does not match the requested function"
+
+theorem Compiled.arity {program root provenance} (compiled : Compiled program root provenance) :
+    compiled.target.parameters = compiled.definition.signature.params.size :=
+  (compiled.selected.contract (mode := .physical) (compiled.selected.declarations (fun _ _ => none) (fun _ _ => none))
+    compiled.definitionFound compiled.targetFound).arity
+
+/-- Universal execution of the actual exported ELF, with finite stack
+capacity and complete register, return-address, and outside-memory behavior.
+The same Word result has a physical CFG execution under every caller/heap. -/
+theorem Compiled.nativeReturns {program root provenance} (compiled : Compiled program root provenance)
+    (values : Array Word) (arity : values.size = compiled.definition.signature.params.size)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (oracle : Ixon.Address → List IxIR2.Eval.RVal → Option IxIR2.Eval.RVal)
+    (stack : Scalar.Stack) (depth : compiled.selected.scalar.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt values ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, Runs (IxIR2.Eval.Context.ofProgram program schemas oracle) .physical (frame compiled.definition 0 0 values) word ∧
+      Nonempty (Scalar.ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack (some word)) := by
+  have argumentArity := arity.trans compiled.arity.symm
+  obtain ⟨result, evaluated⟩ := compiled.selected.scalar.function_total _ _ compiled.targetFound values argumentArity
+  have contract := compiled.selected.contract (mode := .physical) (compiled.selected.declarations schemas oracle)
+    compiled.definitionFound compiled.targetFound
+  obtain ⟨word, success, physical⟩ := contract.evaluates values result argumentArity evaluated
+  subst result
+  obtain ⟨executed⟩ := compiled.native.root_run compiled.targetFound argumentArity evaluated stack depth core
+    stackPointer arguments readable writable
+  have stream : Stream.Valid compiled.native.target.program compiled.input.encoded := by
+    rw [compiled.encoded]
+    exact compiled.stream.valid
+  exact ⟨word, physical, executed.objectResult stream compiled.object.valid compiled.entry base flags⟩
+
+/-- Successful-run preservation for every selected physical CFG. The premise
+is an execution of that exact input function; byte execution of the exact
+emitted ELF and finite stack safety are conclusions. -/
+theorem Compiled.physicalReturns {program root provenance} (compiled : Compiled program root provenance)
+    (values : Array Word) (arity : values.size = compiled.definition.signature.params.size)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (oracle : Ixon.Address → List IxIR2.Eval.RVal → Option IxIR2.Eval.RVal)
+    {controlFuel heapFuel : Nat} {store : IxIR2.Eval.Store} {result : IxIR2.Eval.Result}
+    (physical : IxIR2.Eval.runFunction (IxIR2.Eval.Context.ofProgram program schemas oracle) .physical
+      compiled.definition (values.map rval) controlFuel heapFuel store = .ok result)
+    (stack : Scalar.Stack) (depth : compiled.selected.scalar.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt values ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, result.value = rval word ∧
+      result.store = (IxIR2.Eval.initialMachine compiled.definition (values.map rval) 0 store).store ∧
+      Nonempty (Scalar.ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack (some word)) := by
+  obtain ⟨word, executed, native⟩ := compiled.nativeReturns values arity schemas oracle stack depth core stackPointer arguments readable writable base flags
+  have contract := compiled.selected.contract (mode := .physical) (compiled.selected.declarations schemas oracle)
+    compiled.definitionFound compiled.targetFound
+  obtain ⟨value, heap⟩ := executed.agrees arity contract.nonempty physical
+  exact ⟨word, value, heap, native⟩
+
+def sourceProvenance {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel) : ELF.Provenance :=
+  .ixir1Policy (IxIR1.Optimizer.graphRoot attached.source.artifact.targetArtifacts attached.source.artifact.main) 6 1
+
+/-- This attachment selects the physical IxIR₂ produced by the full validated
+source compiler. Its object provenance pins the actual IxIR₁ root and this
+physical selection policy; it does not re-read erased source to select code. -/
+def compileSource {constants root config world eraseFuel lowerFuel}
+    (attached : IxIR2.Pipeline.Attached constants root config world eraseFuel lowerFuel)
+    (entry : Ixon.Address) (name : String := "compilatrix_physical_scalar") :
+    Except String (Compiled attached.target.artifact.program entry (sourceProvenance attached)) :=
+  compile attached.target.artifact.program entry (sourceProvenance attached) name
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarSelect.lean b/Ix/Compiler/X86/PhysicalScalarSelect.lean
new file mode 100644
index 000000000..52d2f1d57
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarSelect.lean
@@ -0,0 +1,194 @@
+import Ix.Compiler.X86.PhysicalScalar
+
+namespace Ix.Compiler.X86.PhysicalScalar
+
+def maxDepth : Nat := 128
+def maxWork : Nat := 4096
+
+private abbrev Build := StateT Nat (Except String)
+
+private def tick : Build Unit := do
+  match ← get with
+  | 0 => throw "physical scalar CFG expansion exceeds its work limit"
+  | remaining + 1 => set remaining
+
+private def atom (bindings : Array Scalar.Atom) (source : IxIR2.Atom) :
+    Build { target : Scalar.Atom // lowerAtom bindings source = some target } :=
+  match _found : lowerAtom bindings source with
+  | none => throw "physical scalar operand is not an in-scope register or exact Word Nat"
+  | some target => pure ⟨target, rfl⟩
+
+private def atoms (bindings : Array Scalar.Atom) (source : Array IxIR2.Atom) :
+    Build { target : Array Scalar.Atom // lowerAtoms bindings source = some target } :=
+  match _found : lowerAtoms bindings source with
+  | none => throw "physical scalar arguments contain an unsupported operand"
+  | some target => pure ⟨target, rfl⟩
+
+private def edge (definition : IxIR2.Function) (source : IxIR2.Edge)
+    (arguments : Array Scalar.Atom) (implicitCount : Nat) :
+    Build (PLift (EdgeReady definition source arguments implicitCount)) := do
+  match found : definition.blocks[source.target]? with
+  | none => throw "physical scalar edge targets a missing block"
+  | some target =>
+    if arity : implicitCount + arguments.size = target.valueParams.size then
+      if credits : source.credits = #[] then
+        if targetCredits : target.creditParams = #[] then
+          return ⟨.mk target found arity credits targetCredits⟩
+        else throw "physical scalar edge requires reuse credits"
+      else throw "physical scalar edge transfers reuse credits"
+    else throw "physical scalar edge has the wrong value arity"
+
+private def callee (entries : Entries) (current : Nat) (address : Ixon.Address)
+    (arguments : Array Scalar.Atom) :
+    Build { index : Nat // ∃ definition, entries[index]? = some (address, definition) ∧
+      index < current ∧ arguments.size = definition.signature.params.size } := do
+  let some index := entries.findIdx? (·.1 == address) | throw "physical scalar direct callee is missing"
+  match found : entries[index]? with
+  | none => throw "physical scalar callee index is missing"
+  | some (actual, definition) =>
+    if same : actual = address then
+      if earlier : index < current then
+        if arity : arguments.size = definition.signature.params.size then
+          return ⟨index, definition, by simpa [same] using found, earlier, arity⟩
+        else throw "physical scalar call has the wrong argument arity"
+      else throw "physical scalar calls must target earlier nonrecursive functions"
+    else throw "physical scalar callee address disagrees"
+
+private def lowerCode (entries : Entries) (current : Nat) (definition : IxIR2.Function) :
+    Nat → (block pc : Nat) → (bindings : Array Scalar.Atom) → (locals : Nat) →
+      Build { expression : Scalar.Expr // Code entries current definition block pc bindings locals expression }
+  | 0, _, _, _, _ => throw "physical scalar CFG is cyclic or exceeds the depth limit"
+  | fuel + 1, block, pc, bindings, locals => do
+    tick
+    if locals > Scalar.maxLocals then throw "physical scalar path exceeds its local slot limit"
+    match blockAt : definition.blocks[block]? with
+    | none => throw "physical scalar current block is missing"
+    | some body =>
+      match instruction : body.instructions[pc]? with
+      | some (.move source) =>
+        let target ← atom bindings source
+        let rest ← lowerCode entries current definition fuel block (pc + 1) (bindings.push target.val) locals
+        return ⟨rest.val, .move blockAt instruction target.property rest.property⟩
+      | some (.retainShared source) =>
+        let target ← atom bindings source
+        let rest ← lowerCode entries current definition fuel block (pc + 1) (bindings.push target.val) locals
+        return ⟨rest.val, .retain blockAt instruction target.property rest.property⟩
+      | some (.releaseShared source) =>
+        let target ← atom bindings source
+        let rest ← lowerCode entries current definition fuel block (pc + 1) bindings locals
+        return ⟨rest.val, .release blockAt instruction target.property rest.property⟩
+      | some (.dropUnique source) =>
+        let target ← atom bindings source
+        let rest ← lowerCode entries current definition fuel block (pc + 1) bindings locals
+        return ⟨rest.val, .drop blockAt instruction target.property rest.property⟩
+      | some (.call address source) =>
+        let arguments ← atoms bindings source
+        let called ← callee entries current address arguments.val
+        let rest ← lowerCode entries current definition fuel block (pc + 1) (bindings.push (.var locals)) (locals + 1)
+        return ⟨.letE (.call called.val arguments.val) rest.val, by
+          obtain ⟨definition, found, earlier, arity⟩ := called.property
+          exact .call blockAt instruction arguments.property found earlier arity rest.property⟩
+      | some _ => throw "physical scalar instruction is outside the admitted fragment"
+      | none =>
+        if endAt : pc = body.instructions.size then
+          match term : body.terminator with
+          | .ret source =>
+            let target ← atom bindings source
+            return ⟨.atom target.val, .ret blockAt endAt term target.property⟩
+          | .jump source =>
+            let arguments ← atoms bindings source.values
+            let ready ← edge definition source arguments.val 0
+            let rest ← lowerCode entries current definition fuel source.target 0 arguments.val locals
+            return ⟨rest.val, .jump blockAt endAt term arguments.property ready.down rest.property⟩
+          | .switchValue source constructors (some peel) =>
+            if empty : constructors = #[] then
+              let target ← atom bindings source
+              let zeroArgs ← atoms bindings peel.zero.values
+              let succArgs ← atoms bindings peel.succ.values
+              let zeroReady ← edge definition peel.zero zeroArgs.val 0
+              let succReady ← edge definition peel.succ succArgs.val 1
+              let zero ← lowerCode entries current definition fuel peel.zero.target 0 zeroArgs.val locals
+              let successor ← lowerCode entries current definition fuel peel.succ.target 0
+                (#[.var locals] ++ succArgs.val) (locals + 1)
+              return ⟨.branch target.val zero.val (.letE (.sub target.val (.constant 1)) successor.val),
+                .branch blockAt endAt (by simpa [empty] using term) target.property zeroArgs.property succArgs.property
+                  zeroReady.down succReady.down zero.property successor.property⟩
+            else throw "physical scalar switch has constructor alternatives"
+          | .tailCall address source =>
+            let arguments ← atoms bindings source
+            let called ← callee entries current address arguments.val
+            return ⟨.call called.val arguments.val, by
+              obtain ⟨definition, found, earlier, arity⟩ := called.property
+              exact .tailCall blockAt endAt term arguments.property found earlier arity⟩
+          | _ => throw "physical scalar terminator is outside the admitted fragment"
+        else throw "physical scalar instruction position passed the terminator"
+
+private def dependencies (definition : IxIR2.Function) : List Ixon.Address :=
+  definition.blocks.toList.flatMap fun block =>
+    block.instructions.toList.filterMap (fun | .call address _ => some address | _ => none) ++
+      match block.terminator with | .tailCall address _ => [address] | _ => []
+
+private def discover (program : IxIR2.Program) : Nat → Entries → Ixon.Address → Except String Entries
+  | 0, _, _ => throw "physical scalar call graph is recursive or exceeds its depth limit"
+  | fuel + 1, entries, address => do
+    if entries.any (·.1 == address) then return entries
+    let some (.fn definition) := lookup program address | throw "physical scalar entry/callee is not a declared function"
+    if definition.blocks.size > maxDepth || definition.blocks.any (·.instructions.size > maxDepth) then
+      throw "physical scalar function exceeds its block or instruction limit"
+    let mut entries := entries
+    for dependency in dependencies definition do
+      entries ← discover program fuel entries dependency
+    if entries.size >= Scalar.maxFunctions then throw "physical scalar call graph exceeds its function limit"
+    return entries.push (address, definition)
+
+structure Row (entries : Entries) where
+  index : Nat
+  address : Ixon.Address
+  definition : IxIR2.Function
+  target : Scalar.Function
+  arity : target.parameters = definition.signature.params.size
+  nonempty : definition.blocks.isEmpty = false
+  code : Code entries index definition 0 0 (parameters target.parameters) target.parameters target.body
+
+private def lowerFunction (entries : Entries) (index : Nat) (address : Ixon.Address) (definition : IxIR2.Function) :
+    Except String (Row entries) := do
+  let count := definition.signature.params.size
+  if count > 2 then throw "physical scalar function has more than two parameters"
+  if nonempty : definition.blocks.isEmpty = false then
+    let (body, _) ← (lowerCode entries index definition maxDepth 0 0 (parameters count) count).run maxWork
+    return { index, address, definition, target := ⟨count, body.val⟩, arity := rfl, nonempty, code := body.property }
+  else throw "physical scalar function has no entry block"
+
+structure Selected (program : IxIR2.Program) (root : Ixon.Address) where
+  entries : Entries
+  rows : Array (Row entries)
+  declared : entries.all (fun (address, definition) => lookup program address == some (.fn definition)) = true
+  indexed : (rows.toList.zipIdx).all (fun (row, index) => row.index == index && entries[index]? == some (row.address, row.definition)) = true
+  complete : rows.size = entries.size
+  scalar : Scalar.Checked
+  functions : scalar.program.functions = rows.map (·.target)
+  rootFound : (entries[scalar.program.entry]?).map (·.1) = some root
+
+/-- Select an actual physical function from a checked source artifact or an
+explicit CFG input. The certificates are independent of runtime arguments. -/
+def select (program : IxIR2.Program) (root : Ixon.Address) : Except String (Selected program root) := do
+  let entries ← discover program Scalar.maxFunctions #[] root
+  let mut rows := #[]
+  for index in [:entries.size] do
+    let (address, definition) := entries[index]!
+    rows := rows.push (← lowerFunction entries index address definition)
+  let target : Scalar.Program := { functions := rows.map (·.target), entry := entries.size - 1 }
+  let some scalar := Scalar.check target | throw "physical scalar output exceeds native scope, call, or size limits"
+  if declared : entries.all (fun (address, definition) => lookup program address == some (.fn definition)) = true then
+    if indexed : (rows.toList.zipIdx).all (fun (row, index) => row.index == index && entries[index]? == some (row.address, row.definition)) = true then
+      if complete : rows.size = entries.size then
+        if functions : scalar.program.functions = rows.map (·.target) then
+          if rootFound : (entries[scalar.program.entry]?).map (·.1) = some root then
+            return { entries, rows, declared, indexed, complete, scalar, functions, rootFound }
+          else throw "physical scalar selected root disagrees"
+        else throw "physical scalar native functions disagree"
+      else throw "physical scalar function table is incomplete"
+    else throw "physical scalar function table indices disagree"
+  else throw "physical scalar declaration lookup disagrees"
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarSim.lean b/Ix/Compiler/X86/PhysicalScalarSim.lean
new file mode 100644
index 000000000..143ebc268
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarSim.lean
@@ -0,0 +1,115 @@
+import Ix.Compiler.X86.PhysicalScalarControl
+
+namespace Ix.Compiler.X86.PhysicalScalar
+open IxIR2.Eval
+
+structure FunctionContract (context : Context) (mode : Interpretation) (definition : IxIR2.Function)
+    (functions : Array Scalar.Function) (target : Scalar.Function) : Prop where
+  arity : target.parameters = definition.signature.params.size
+  nonempty : definition.blocks.isEmpty = false
+  evaluates : ∀ (values : Array Word) (result : Option Word), values.size = target.parameters →
+    Scalar.Evaluates functions target.body values result →
+    ∃ word, result = some word ∧ Runs context mode (frame definition 0 0 values) word
+
+def Declarations (context : Context) (entries : Entries) : Prop :=
+  ∀ (index : Nat) address definition, entries[index]? = some (address, definition) →
+    context.declarations address = some (.fn definition)
+
+def Callees (context : Context) (mode : Interpretation) (entries : Entries)
+    (functions : Array Scalar.Function) (current : Nat) : Prop :=
+  ∀ index address definition target, entries[index]? = some (address, definition) → index < current →
+    functions[index]? = some target → FunctionContract context mode definition functions target
+
+theorem Callees.call {context mode entries functions current index address definition arguments values result}
+    (callees : Callees context mode entries functions current)
+    (found : entries[index]? = some (address, definition)) (earlier : index < current)
+    (evaluated : Scalar.Evaluates functions (.call index arguments) values result) :
+    ∃ supplied word, arguments.mapM (Scalar.Atom.eval values) = some supplied ∧
+      supplied.size = definition.signature.params.size ∧ definition.blocks.isEmpty = false ∧
+      result = some word ∧ Runs context mode (frame definition 0 0 supplied) word := by
+  cases evaluated with
+  | call targetAt argumentsAt arity evaluated =>
+    have contract := callees _ _ _ _ found earlier targetAt
+    obtain ⟨word, same, executed⟩ := contract.evaluates _ _ arity evaluated
+    exact ⟨_, word, argumentsAt, arity.trans contract.arity, contract.nonempty, same, executed⟩
+
+/-- Every syntax certificate preserves its physical execution. The induction
+composes code at each block/PC and uses only earlier function contracts at a
+call. In particular it covers every accepted CFG, without recognizing a
+complete graph or requiring a runtime evaluation certificate. -/
+theorem Code.simulate {entries current definition block pc bindings locals expression}
+    (code : Code entries current definition block pc bindings locals expression)
+    {context : Context} {mode : Interpretation} {functions : Array Scalar.Function}
+    (declarations : Declarations context entries) (callees : Callees context mode entries functions current)
+    {native physical : Array Word} {result : Option Word}
+    (size : native.size = locals) (environment : EnvRel bindings native physical)
+    (evaluated : Scalar.Evaluates functions expression native result) :
+    ∃ word, result = some word ∧ Runs context mode (frame definition block pc physical) word := by
+  induction code generalizing native physical result with
+  | ret blockAt endAt term atom =>
+    cases evaluated with
+    | atom value =>
+      exact ⟨_, rfl, Runs.ret blockAt endAt term (atom_resolves environment atom value)⟩
+  | move blockAt instruction atom rest ih =>
+    obtain ⟨value, found, resolved⟩ := atom_sound environment atom
+    obtain ⟨word, same, executed⟩ := ih size (environment.push found) evaluated
+    exact ⟨word, same, executed.move blockAt instruction resolved⟩
+  | retain blockAt instruction atom rest ih =>
+    obtain ⟨value, found, resolved⟩ := atom_sound environment atom
+    obtain ⟨word, same, executed⟩ := ih size (environment.push found) evaluated
+    exact ⟨word, same, executed.retain blockAt instruction resolved⟩
+  | release blockAt instruction atom rest ih =>
+    obtain ⟨value, _, resolved⟩ := atom_sound environment atom
+    obtain ⟨word, same, executed⟩ := ih size environment evaluated
+    exact ⟨word, same, executed.release blockAt instruction resolved⟩
+  | drop blockAt instruction atom rest ih =>
+    obtain ⟨value, _, resolved⟩ := atom_sound environment atom
+    obtain ⟨word, same, executed⟩ := ih size environment evaluated
+    exact ⟨word, same, executed.drop blockAt instruction resolved⟩
+  | jump blockAt endAt term atoms ready rest ih =>
+    obtain ⟨arguments, argsEnvironment, _, resolved⟩ := atoms_sound environment atoms
+    obtain ⟨word, same, executed⟩ := ih size argsEnvironment evaluated
+    exact ⟨word, same, executed.jump blockAt endAt term ready argsEnvironment.size.symm resolved⟩
+  | branch blockAt endAt term atom zeroAtoms succAtoms zeroReady succReady zeroCode succCode ihZero ihSucc =>
+    cases evaluated with
+    | zero found taken =>
+      obtain ⟨arguments, argsEnvironment, _, resolved⟩ := atoms_sound environment zeroAtoms
+      obtain ⟨word, same, executed⟩ := ihZero size argsEnvironment taken
+      exact ⟨word, same, executed.zero blockAt endAt term (atom_resolves environment atom found)
+        zeroReady argsEnvironment.size.symm resolved⟩
+    | @successor _ _ _ _ value _ found positive taken =>
+      cases taken with
+      | letOverflow first => cases first
+      | letE first rest =>
+        cases first with
+        | @sub _ _ _ a b left right =>
+          have leftSame := Option.some.inj (left.symm.trans found)
+          have rightSame : b = 1 := (Option.some.inj right).symm
+          subst a b
+          obtain ⟨arguments, argsEnvironment, _, resolved⟩ := atoms_sound environment succAtoms
+          obtain ⟨word, same, executed⟩ := ihSucc (by simpa using size)
+            (argsEnvironment.prepend size (ExactNat.sub value 1)) rest
+          exact ⟨word, same, executed.successor blockAt endAt term positive (atom_resolves environment atom found)
+            succReady argsEnvironment.size.symm resolved⟩
+  | call blockAt instruction atoms found earlier arity rest ih =>
+    obtain ⟨arguments, argsEnvironment, argumentsAt, resolved⟩ := atoms_sound environment atoms
+    cases evaluated with
+    | letOverflow first =>
+      obtain ⟨_, _, _, _, _, impossible, _⟩ := callees.call found earlier first
+      contradiction
+    | @letE _ _ _ bound _ first tail =>
+      obtain ⟨supplied, value, suppliedAt, suppliedArity, nonempty, same, called⟩ := callees.call found earlier first
+      have suppliedSame := Option.some.inj (suppliedAt.symm.trans argumentsAt)
+      have valueSame := Option.some.inj same
+      subst supplied bound
+      obtain ⟨word, same, continuation⟩ := ih (by simpa using size) (environment.bind size value) tail
+      exact ⟨word, same, Runs.call blockAt instruction resolved (declarations _ _ _ found)
+        suppliedArity nonempty called continuation⟩
+  | tailCall blockAt endAt term atoms found earlier arity =>
+    obtain ⟨arguments, argsEnvironment, argumentsAt, resolved⟩ := atoms_sound environment atoms
+    obtain ⟨supplied, word, suppliedAt, suppliedArity, nonempty, same, called⟩ := callees.call found earlier evaluated
+    have suppliedSame := Option.some.inj (suppliedAt.symm.trans argumentsAt)
+    subst supplied
+    exact ⟨word, same, called.tailCall blockAt endAt term resolved (declarations _ _ _ found) suppliedArity nonempty⟩
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarSourceApply.lean b/Ix/Compiler/X86/PhysicalScalarSourceApply.lean
new file mode 100644
index 000000000..1cbbf4544
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarSourceApply.lean
@@ -0,0 +1,147 @@
+import Ix.Compiler.X86.PhysicalScalarSourceHeap
+import Ix.Compiler.IxIR2.SourcePipelineSim
+
+namespace Ix.Compiler.X86.PhysicalScalar
+open Ix.Compiler.Pipeline (ValidatedCompilation validatedEvalCtx validatedMainFrame validatedMainSource)
+
+variable {constants : List (Ixon.Address × Ixon.Constant)} {root : Ixon.Address}
+  {config : Ix.Compiler.Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+/-- The actual compiled module identifies the source-related uncaptured
+function and its exact heap image, including both compiler address passes. -/
+theorem Exported.sourceFunction
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (exported : Exported attached.target.artifact.program (sourceProvenance attached))
+    {fuel : Nat} {function : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) fuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function) :
+    ∃ rawFunction rawStore,
+      @Ix.Compiler.Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+        function rawFunction attached.source.memberScope ∧
+      IxIR1.Sim.ValueGraph attached.source.functionRel rawStore
+        (IxIR0.Readdress.Value.mapAddresses
+          (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap) rawFunction) (.loc 0) ∧
+      IxIR1.Readdress.Store.mapAddresses
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) rawStore =
+        (closureStore exported.source.address exported.source.target).heap := by
+  obtain ⟨rawFunction, _, store, value, _, _, result, related, graph, _, physical, heaps⟩ :=
+    attached.sourcePhysical oracles contextWF entry
+  obtain ⟨count, canonical⟩ := exported.source.path.runMain attached.target.artifact.validationContext.schemas (fun _ _ => none)
+  have same := IxIR2.Eval.runMain_success_unique exported.source.path.nullary exported.source.path.nonempty physical canonical
+  have valueEq : value = .loc 0 := heaps.value.symm.trans same.2
+  have storeEq : store = (closureStore exported.source.address exported.source.target).heap :=
+    heaps.heap.symm.trans (congrArg IxIR2.Eval.Store.heap same.1)
+  obtain ⟨rawStore, renamed, graph⟩ := graph
+  exact ⟨rawFunction, rawStore, related, valueEq ▸ graph, renamed.symm.trans storeEq⟩
+
+/-- A composed source application keeps the actual PAP dispatch, addressed
+function invocation, physical execution, and source value graph together. -/
+structure SourceRun
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (exported : Exported attached.target.artifact.program (sourceProvenance attached))
+    (values : Array Word) (result : Ixon.Eval.Value) where
+  rawResult : IxIR0.Value
+  rawStore : IxIR1.Store
+  store : IxIR1.Store
+  value : IxIR1.RVal
+  applyFuel : Nat
+  invokeFuel : Nat
+  controlFuel : Nat
+  heapFuel : Nat
+  physicalResult : IxIR2.Eval.Result
+  sourceRelated : @Ix.Compiler.Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+    result rawResult attached.source.memberScope
+  valueRelated : IxIR1.Sim.ValueGraph attached.source.functionRel rawStore
+    (IxIR0.Readdress.Value.mapAddresses
+      (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap) rawResult) value
+  storeRenamed : store = IxIR1.Readdress.Store.mapAddresses
+    (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) rawStore
+  applied : IxIR1.applyGo attached.compiled.simulationSourceContext applyFuel
+    (closureStore exported.source.address exported.source.target).heap (.loc 0) (values.map rval).toList = .ok (store, value)
+  invoked : IxIR1.invoke attached.compiled.simulationSourceContext invokeFuel exported.source.address
+    (values.map rval).toList invocationHeap = .ok (store, value)
+  physical : IxIR2.Eval.runFunction attached.compiled.simulationTargetContext .physical
+    exported.source.target (values.map rval) controlFuel heapFuel { heap := invocationHeap } = .ok physicalResult
+  agrees : IxIR2.Lower.Sim.OutcomeRel (store, value) physicalResult
+
+/-- Runtime Ixon application reaches the selected physical function through
+the ordinary compiler. Only source execution, sharing/oracle assumptions,
+and the scalar ABI arity are supplied by the caller. -/
+theorem Exported.sourceRun
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (exported : Exported attached.target.artifact.program (sourceProvenance attached))
+    (values : Array Word) (arity : values.size = exported.source.target.signature.params.size)
+    {entryFuel applyFuel : Nat} {function result : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) entryFuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function)
+    (applied : Ixon.Eval.applyMany (validatedEvalCtx constants config) applyFuel
+      function (sourceArguments values) = .ok result) :
+    Nonempty (SourceRun attached exported values result) := by
+  letI : Ix.Compiler.Sim.MemberScope := attached.source.memberScope
+  obtain ⟨rawFunction, rawStore, functionRel, functionGraph, storeRenamed⟩ :=
+    exported.sourceFunction attached oracles contextWF entry
+  have frameWF : (validatedMainFrame root).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [validatedMainFrame] at found
+  have functionWF := (Ixon.Eval.eval_inlineSharing contextWF frameWF .nil (by rfl) entry).2
+  obtain ⟨limit, rawResult, rawTrace, resultRel⟩ := Ix.Compiler.Sim.applyMany_sim_projectionSafe_inlineSharing
+    attached.source.members oracles contextWF functionWF (sourceArguments.wf values) applied functionRel
+    (sourceArguments.related _ _ values)
+  have trace := IxIR0.Readdress.ProjectionSafe.AppliesBelow.mapAddresses attached.source.runtimeTraceRenames rawTrace
+  rw [rawArguments.renamed] at trace
+  have rawOwned : IxIR1.Sim.RootOwnership rawStore [⟨.shared, .loc 0⟩] := by
+    apply (IxIR1.Sim.rootOwnership_mapAddresses_iff
+      (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) rawStore _).mp
+    rw [storeRenamed]
+    exact closureStore.owned _ _
+  have ownership : IxIR1.Sim.RootOwnership rawStore
+      (⟨.shared, .loc 0⟩ :: IxIR1.Sim.rootsFor .shared (values.map rval).toList) := by
+    simpa using (scalarArguments_owned rawOwned values).perm List.perm_append_comm
+  have nonempty : rawArguments values ≠ [] := by
+    intro empty
+    have length : values.size = 0 := by
+      simpa only [rawArguments, List.length_map, Array.length_toList, List.length_nil] using congrArg List.length empty
+    have positive := exported.source.path.positive
+    omega
+  obtain ⟨targetFuel, outputStore, outputValue, targetRun, outputGraph, _⟩ :=
+    attached.source.runtimeApply functionGraph (rawArguments.graph _ _ values) trace nonempty ownership
+  let store := IxIR1.Readdress.Store.mapAddresses
+    (attached.source.lowering.result.rebuildRename attached.source.lowering.raw) outputStore
+  have targetApplied : IxIR1.applyGo attached.compiled.simulationSourceContext targetFuel
+      (closureStore exported.source.address exported.source.target).heap (.loc 0) (values.map rval).toList =
+      .ok (store, outputValue) := by
+    have renames : IxIR1.Readdress.Ctx.Renames
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw)
+        (attached.source.exactTargetCtx (fun _ _ => none)) attached.compiled.simulationSourceContext :=
+      attached.compiled.sourceContextRenames
+    rw [← storeRenamed, IxIR1.Readdress.applyGo_mapAddresses renames, targetRun]
+    rfl
+  have declared : attached.compiled.simulationTargetContext.declarations exported.source.address =
+      some (.fn exported.source.target) := exported.source.path.declared
+  obtain ⟨definition, functionTrace, _, matched, sourceDeclared⟩ :=
+    attached.compiled.functionTrace_of_target_declaration
+      (sourceContext := attached.compiled.simulationSourceContext) rfl rfl declared
+  have safe : IxIR1.declPapSafe (.fn definition) = true := by
+    change definition.papSafe = true
+    rw [← matched.source, ← functionTrace.sourcePapSafe, matched.generated]
+    exact exported.source.path.papSafe
+  obtain ⟨invokeFuel, invoked⟩ := closureStore.applied sourceDeclared safe arity targetApplied
+  obtain ⟨controlFuel, heapFuel, physicalResult, physical, agrees⟩ :=
+    attached.compiled.successfulFunctionSimulation declared exported.source.path.papSafe
+      (values.map rval) invoked (invocationHeap.owned values) (invocationHeap.runtime values)
+      (invocationHeap.image attached.compiled)
+  exact ⟨{
+    rawResult, rawStore := outputStore, store, value := outputValue
+    applyFuel := targetFuel, invokeFuel, controlFuel, heapFuel, physicalResult
+    sourceRelated := resultRel, valueRelated := outputGraph, storeRenamed := rfl
+    applied := targetApplied, invoked, physical, agrees }⟩
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarSourceHeap.lean b/Ix/Compiler/X86/PhysicalScalarSourceHeap.lean
new file mode 100644
index 000000000..6f3be7a2e
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarSourceHeap.lean
@@ -0,0 +1,132 @@
+import Ix.Compiler.X86.PhysicalScalarExport
+import Ix.Compiler.PipelineApply
+import Ix.Compiler.IxIR2.PipelineInvoke
+
+namespace Ix.Compiler.X86.PhysicalScalar
+
+def sourceArgument (word : Word) : Ixon.Eval.Value := .litV (.natL word.toNat)
+def rawArgument (word : Word) : IxIR0.Value := .lit (.nat word.toNat)
+def sourceArguments (values : Array Word) : List Ixon.Eval.Value := values.toList.map sourceArgument
+def rawArguments (values : Array Word) : List IxIR0.Value := values.toList.map rawArgument
+
+theorem sourceArguments.wf (values : Array Word) : Ixon.Eval.ValuesSharingWF (sourceArguments values) := by
+  have all : ∀ words : List Word, Ixon.Eval.ValuesSharingWF (words.map sourceArgument) := by
+    intro words
+    induction words with
+    | nil => exact .nil
+    | cons word words ih => exact .cons _ _ (.litV _) ih
+  exact all values.toList
+
+theorem sourceArguments.related [scope : Ix.Compiler.Sim.MemberScope]
+    (context : Ixon.Eval.EvalCtx) (raw : IxIR0.Ctx) (values : Array Word) :
+    Ix.Compiler.Sim.ValsRel context.inlineSharing raw
+      (Ixon.Eval.valuesInlineSharing (sourceArguments values)) (rawArguments values) := by
+  have all : ∀ words : List Word, Ix.Compiler.Sim.ValsRel context.inlineSharing raw
+      (Ixon.Eval.valuesInlineSharing (words.map sourceArgument)) (words.map rawArgument) := by
+    intro words
+    induction words with
+    | nil => simpa [Ixon.Eval.valuesInlineSharing] using (Ix.Compiler.Sim.ValsRel.nil
+        (ectx := context.inlineSharing) (ictx := raw))
+    | cons word words ih =>
+      simpa [Ixon.Eval.valuesInlineSharing, sourceArgument, rawArgument, Ixon.Eval.Value.inlineSharing] using
+        (Ix.Compiler.Sim.ValsRel.cons (Ix.Compiler.Sim.ValRel.litNat (n := word.toNat)) ih)
+  exact all values.toList
+
+theorem rawArguments.renamed (rename : Ixon.Address → Ixon.Address) (values : Array Word) :
+    IxIR0.Readdress.ValueList.mapAddresses rename (rawArguments values) = rawArguments values := by
+  simp [rawArguments, rawArgument, IxIR0.Readdress.Value.mapAddresses]
+
+theorem rawArguments.graph (relation : IxIR1.Sim.FunctionRel) (store : IxIR1.Store) (values : Array Word) :
+    IxIR1.Sim.ValuesGraph relation store (rawArguments values) (values.map rval).toList := by
+  have all : ∀ words : List Word, IxIR1.Sim.ValuesGraph relation store (words.map rawArgument) (words.map rval) := by
+    intro words
+    induction words with
+    | nil => exact .nil
+    | cons word words ih => exact .cons .lit ih
+  simpa [rawArguments] using all values.toList
+
+/-- Module initialization allocates one uncaptured PAP. The saturated scalar
+application consumes it before entering the selected function. -/
+def invocationHeap : IxIR1.Store := { nodes := #[none], allocs := 1, frees := 1, rcops := 1 }
+
+theorem invocationHeap.get? (location : Nat) : invocationHeap.get? location = none := by
+  cases location <;> simp [invocationHeap, IxIR1.Store.get?]
+
+theorem invocationHeap.renamed (rename : Ixon.Address → Ixon.Address) :
+    IxIR1.Readdress.Store.mapAddresses rename invocationHeap = invocationHeap := by
+  simp [IxIR1.Readdress.Store.mapAddresses, invocationHeap]
+
+theorem invocationHeap.runtime (values : Array Word) :
+    IxIR2.Lower.Sim.SourceRuntimeInvariant invocationHeap (values.map rval).toList.reverse := by
+  refine ⟨⟨?_, ?_⟩, ?_, ⟨?_⟩⟩
+  · intro location box found
+    simp [invocationHeap.get?] at found
+  · intro parent box child found
+    simp [invocationHeap.get?] at found
+  · intro value member
+    simp only [List.mem_reverse, Array.toList_map, List.mem_map] at member
+    obtain ⟨word, _, rfl⟩ := member
+    trivial
+  · intro location world rc address arity captured found
+    simp [invocationHeap.get?] at found
+
+theorem invocationHeap.image {world fuel} (attached : IxIR2.Pipeline.CompiledAttachment world fuel) :
+    attached.SourceStoreImage invocationHeap := by
+  refine ⟨invocationHeap, invocationHeap.renamed _, ?_⟩
+  constructor
+  intro location world rc identity fields found
+  simp [invocationHeap.get?] at found
+
+theorem scalarArguments_owned {store : IxIR1.Store} {roots : List IxIR1.Sim.Root}
+    (owned : IxIR1.Sim.RootOwnership store roots) (values : Array Word) :
+    IxIR1.Sim.RootOwnership store (IxIR1.Sim.rootsFor .shared (values.map rval).toList ++ roots) := by
+  have all : ∀ words : List Word,
+      IxIR1.Sim.RootOwnership store (IxIR1.Sim.rootsFor .shared (words.map rval) ++ roots) := by
+    intro words
+    induction words with
+    | nil => simpa [IxIR1.Sim.rootsFor] using owned
+    | cons word words ih =>
+      simpa [IxIR1.Sim.rootsFor] using ih.addNoLocation (value := rval word) rfl
+  simpa using all values.toList
+
+theorem invocationHeap.owned (values : Array Word) :
+    IxIR1.Sim.RootOwnership invocationHeap (IxIR1.Sim.rootsFor .shared (values.map rval).toList) := by
+  have empty : IxIR1.Sim.RootOwnership invocationHeap [] := by
+    refine ⟨?_, ?_, ?_, ?_⟩
+    · simp
+    · intro location box found
+      simp [invocationHeap.get?] at found
+    · intro location box address arity captured found
+      simp [invocationHeap.get?] at found
+    · intro location box found
+      simp [invocationHeap.get?] at found
+  simpa using scalarArguments_owned empty values
+
+theorem closureStore.owned (address : Ixon.Address) (target : IxIR2.Function) :
+    IxIR1.Sim.RootOwnership (closureStore address target).heap [⟨.shared, .loc 0⟩] := by
+  exact IxIR1.Sim.RootOwnership.allocNode (by simpa [IxIR1.Sim.rootsFor, IxIR1.Sim.nodeChildren] using
+    IxIR1.Sim.RootOwnership.empty) rfl
+
+theorem closureStore.drop (context : IxIR1.Ctx) (address : Ixon.Address) (target : IxIR2.Function) (fuel : Nat) :
+    IxIR1.dropVal context (fuel + 2) (closureStore address target).heap (.loc 0) = .ok invocationHeap := by
+  simp [IxIR1.dropVal, IxIR1.dropMany, closureStore, IxIR2.Eval.Store.allocNode,
+    IxIR1.Store.allocNode, IxIR1.Store.get?, IxIR1.Store.rcTick, IxIR1.Store.kill, invocationHeap]
+
+/-- Decode the ordinary PAP entry prefix of a successful IxIR₁ application.
+The extra evaluator fuel only exposes this fixed, terminating prefix. -/
+theorem closureStore.applied {context : IxIR1.Ctx} {address : Ixon.Address} {target : IxIR2.Function}
+    {declaration : IxIR1.Decl} (declared : context.decls address = some declaration)
+    (safe : IxIR1.declPapSafe declaration = true)
+    {values : Array Word} (arity : values.size = target.signature.params.size)
+    {fuel : Nat} {output : IxIR1.Store × IxIR1.RVal}
+    (applied : IxIR1.applyGo context fuel (closureStore address target).heap (.loc 0)
+      (values.map rval).toList = .ok output) :
+    ∃ callFuel, IxIR1.invoke context callFuel address (values.map rval).toList invocationHeap = .ok output := by
+  have padded := IxIR1.applyGo_mono (larger := fuel + 3) (by omega) applied
+  have found : (closureStore address target).heap.get? 0 =
+      some ⟨.shared, 1, .papN address target.signature.params.size #[]⟩ := rfl
+  refine ⟨fuel + 2, ?_⟩
+  simpa [IxIR1.applyGo, found, IxIR1.dupVals, closureStore.drop, declared, safe, arity,
+    bind, Except.bind, pure, Except.pure] using padded
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarSourceObject.lean b/Ix/Compiler/X86/PhysicalScalarSourceObject.lean
new file mode 100644
index 000000000..3c8456908
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarSourceObject.lean
@@ -0,0 +1,96 @@
+import Ix.Compiler.X86.PhysicalScalarSourceApply
+
+namespace Ix.Compiler.X86.PhysicalScalar
+open Ix.Compiler.Pipeline (validatedEvalCtx validatedMainFrame validatedMainSource)
+
+variable {constants : List (Ixon.Address × Ixon.Constant)} {root : Ixon.Address}
+  {config : Ix.Compiler.Pipeline.Config} {eraseFuel lowerFuel : Nat}
+
+/-- Source value agreement and complete reclamation of the module's exported
+PAP. The scalar body preserves the resulting dead slot and exact counters. -/
+structure SourceResult
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (exported : Exported attached.target.artifact.program (sourceProvenance attached))
+    (values : Array Word) (result : Ixon.Eval.Value) (word : Word) : Prop where
+  related : @Ix.Compiler.Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+    result (rawArgument word) attached.source.memberScope
+  applied : ∃ fuel, IxIR1.applyGo attached.compiled.simulationSourceContext fuel
+    (closureStore exported.source.address exported.source.target).heap (.loc 0) (values.map rval).toList =
+      .ok (invocationHeap, rval word)
+  invoked : ∃ fuel, IxIR1.invoke attached.compiled.simulationSourceContext fuel exported.source.address
+    (values.map rval).toList invocationHeap = .ok (invocationHeap, rval word)
+
+/-- The ordinary source compiler, actual physical CFG selector, complete ELF,
+and finite native stack compose for every admitted runtime Word vector.
+The caller supplies source execution and the declared ABI/environment facts;
+all lower-stage applications and native executions are conclusions. -/
+theorem Exported.sourceReturns
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (exported : Exported attached.target.artifact.program (sourceProvenance attached))
+    (values : Array Word) (arity : values.size = exported.source.target.signature.params.size)
+    {entryFuel applyFuel : Nat} {function result : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) entryFuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function)
+    (applied : Ixon.Eval.applyMany (validatedEvalCtx constants config) applyFuel
+      function (sourceArguments values) = .ok result)
+    (stack : Scalar.Stack) (depth : exported.compiled.selected.scalar.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt values ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, SourceResult attached exported values result word ∧
+      Nonempty (Scalar.ObjectResult exported.compiled.object.bytes exported.compiled.input.exportName base flags core stack (some word)) := by
+  obtain ⟨run⟩ := exported.sourceRun attached values arity oracles contextWF entry applied
+  obtain ⟨word, valueEq, heapEq, native⟩ := exported.compiled.physicalReturns values
+    (by simpa [exported.same] using arity) attached.target.artifact.validationContext.schemas (fun _ _ => none)
+    (by simpa only [exported.same, IxIR2.Pipeline.CompiledAttachment.simulationTargetContext,
+      IxIR2.Pipeline.Attached.compiled] using run.physical)
+    stack depth core stackPointer arguments readable writable base flags
+  have value : run.value = rval word := run.agrees.value.symm.trans valueEq
+  have heap : run.store = invocationHeap := run.agrees.heap.symm.trans (congrArg IxIR2.Eval.Store.heap heapEq)
+  have raw : run.rawResult = rawArgument word := by
+    have graph := run.valueRelated
+    rw [value] at graph
+    cases selected : run.rawResult <;>
+      simp only [selected, IxIR0.Readdress.Value.mapAddresses] at graph <;> cases graph <;> rfl
+  refine ⟨word, ⟨?_, ?_, ?_⟩, native⟩
+  · simpa [raw] using run.sourceRelated
+  · exact ⟨run.applyFuel, by simpa [heap, value] using run.applied⟩
+  · exact ⟨run.invokeFuel, by simpa [heap, value] using run.invoked⟩
+
+/-- Exact numeric observation of the source-to-object endpoint. A returned
+source Nat is representable and equals RAX's Word value without truncation. -/
+theorem Exported.sourceNatReturns
+    (attached : IxIR2.Pipeline.Attached constants root config .shared eraseFuel lowerFuel)
+    (exported : Exported attached.target.artifact.program (sourceProvenance attached))
+    (values : Array Word) (arity : values.size = exported.source.target.signature.params.size)
+    {entryFuel applyFuel number : Nat} {function : Ixon.Eval.Value}
+    (oracles : @Ix.Compiler.Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (contextWF : (validatedEvalCtx constants config).SharingWF)
+    (entry : Ixon.Eval.eval (validatedEvalCtx constants config) entryFuel
+      (validatedMainFrame root) [] validatedMainSource = .ok function)
+    (applied : Ixon.Eval.applyMany (validatedEvalCtx constants config) applyFuel
+      function (sourceArguments values) = .ok (.litV (.natL number)))
+    (stack : Scalar.Stack) (depth : exported.compiled.selected.scalar.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : Scalar.ArgumentsAt values ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ word, word.toNat = number ∧ SourceResult attached exported values (.litV (.natL number)) word ∧
+      Nonempty (Scalar.ObjectResult exported.compiled.object.bytes exported.compiled.input.exportName base flags core stack (some word)) := by
+  obtain ⟨word, source, native⟩ := exported.sourceReturns attached values arity oracles contextWF entry applied
+    stack depth core stackPointer arguments readable writable base flags
+  have numberEq : word.toNat = number := by
+    have related := source.related
+    simp only [Ix.Compiler.Sim.InlinedValRel, Ixon.Eval.Value.inlineSharing, rawArgument] at related
+    cases related
+    rfl
+  exact ⟨word, numberEq, source, native⟩
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PhysicalScalarSources.lean b/Ix/Compiler/X86/PhysicalScalarSources.lean
new file mode 100644
index 000000000..645ce86bf
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarSources.lean
@@ -0,0 +1,66 @@
+import Ix.Compiler.Coverage.Sources
+
+/-! Runtime scalar sources for physical CFG selection. The recursors have
+no recursive calls or higher-order arguments. Their ordinary compilation
+exposes Nat peeling, direct calls, and scalar ownership operations. -/
+namespace Ix.Compiler.X86.PhysicalScalar.Examples
+open Ix.Compiler.Ixon (Address Constant)
+
+def source (name : String) (captured : Option Nat := none) : Except String Coverage.Source := do
+  let nat : Ixon.Expr := .recur 0 #[]
+  let tag : Ixon.Recursor := {
+    k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0, motives := 0, minors := 0
+    typ := .all .many .shared nat nat
+    rules := #[{ fields := 0, rhs := .nat 0 },
+      { fields := 1, rhs := .lam .many nat (.nat 1) }] }
+  let pred : Ixon.Recursor := { tag with rules := #[{ fields := 0, rhs := .nat 2 },
+    { fields := 1, rhs := .lam .many nat (.var 0) }] }
+  let choose : Ixon.Recursor := {
+    k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0, motives := 0, minors := 1
+    typ := .all .many .shared nat (.all .many .shared nat nat)
+    rules := #[{ fields := 0, rhs := .lam .many nat (.var 0) },
+      { fields := 1, rhs := .lam .many nat (.lam .many nat (.var 0)) }] }
+  let binary : Ixon.Expr := .all .many .shared nat (.all .many .shared nat nat)
+  let body : Ixon.Expr := match name with
+    | "project" => .var 1
+    | "tag" => .app (.recur 1 #[]) (.var 1)
+    | "pred" => .app (.recur 2 #[]) (.var 1)
+    | "unary-pred" => .app (.recur 2 #[]) (.var 0)
+    | "choose" => .app (.app (.recur 3 #[]) (.var 0)) (.var 1)
+    | "capture-project" => .var 1
+    | "capture-choice" => .app (.app (.recur 3 #[]) (.var 1)) (.var 0)
+    | "capture-nested" => .letE true nat (.app (.recur 2 #[]) (.var 0))
+        (.app (.app (.recur 3 #[]) (.var 2)) (.app (.recur 2 #[]) (.var 0)))
+    | "nested" => .letE true nat (.app (.recur 2 #[]) (.var 1))
+        (.app (.app (.recur 3 #[]) (.var 1)) (.app (.recur 2 #[]) (.var 0)))
+    | _ => .app (.recur 1 #[]) (.app (.recur 2 #[]) (.var 1))
+  let block ← Coverage.addressed {
+    info := .muts (#[.indc {
+      isUnsafe := false, lvls := 0, params := 0, indices := 0, typ := .sort 0
+      ctors := #[
+        { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0, typ := nat },
+        { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1, typ := .all .many .shared nat nat }] },
+      .recr tag, .recr pred, .recr choose,
+      .defn {
+        kind := .defn, safety := .safe, lvls := 0
+        typ := if captured.isSome then .recur 5 #[]
+          else if name == "unary-pred" then .all .many .shared nat nat else binary
+        value := if captured.isSome then .letE true nat
+          (.app (.lam .erased (.sort 0) (.nat 3)) (.sort 0)) (.lam .many nat body)
+          else if name == "unary-pred" then .lam .many nat body else .lam .many nat (.lam .many nat body) }] ++
+      if captured.isSome then #[.defn {
+        kind := .defn, safety := .safe, lvls := 0, typ := .sort 0
+        value := .all .many .shared nat nat }] else #[])
+    sharing := #[], refs := #[ValidatedScalar.literalAddress 11, ValidatedScalar.literalAddress 22,
+      ValidatedScalar.literalAddress 0] ++ captured.toArray.map ValidatedScalar.literalAddress, univs := #[.zero] }
+  let entry ← Coverage.addressed {
+    info := .dPrj { idx := 4, block := block.1 }, sharing := #[], refs := #[], univs := #[] }
+  return {
+    name
+    constants := [block, entry]
+    root := entry.1
+    literals := [0, 11, 22] ++ captured.toList
+    natBlock := some block.1
+    expected := .scalar 0 false }
+
+end Ix.Compiler.X86.PhysicalScalar.Examples
diff --git a/Ix/Compiler/X86/PhysicalScalarValues.lean b/Ix/Compiler/X86/PhysicalScalarValues.lean
new file mode 100644
index 000000000..25dbec166
--- /dev/null
+++ b/Ix/Compiler/X86/PhysicalScalarValues.lean
@@ -0,0 +1,186 @@
+import Ix.Compiler.X86.PhysicalScalar
+
+namespace Ix.Compiler.X86.PhysicalScalar
+
+inductive Each {α β : Type} (relation : α → β → Prop) : List α → List β → Prop where
+  | nil : Each relation [] []
+  | cons {a b as bs} (head : relation a b) (tail : Each relation as bs) : Each relation (a :: as) (b :: bs)
+
+theorem Each.length {α β : Type} {r : α → β → Prop} {as bs} (related : Each r as bs) : as.length = bs.length := by
+  induction related <;> simp_all
+
+theorem Each.lookup {α β : Type} {r : α → β → Prop} {as bs} (related : Each r as bs)
+    {index : Nat} {a : α} (found : as[index]? = some a) : ∃ b, bs[index]? = some b ∧ r a b := by
+  induction related generalizing index with
+  | nil => simp at found
+  | cons head tail ih =>
+    cases index with
+    | zero => simp at found; subst a; exact ⟨_, rfl, head⟩
+    | succ index => exact ih found
+
+theorem Each.append {α β : Type} {r : α → β → Prop} {as bs cs ds}
+    (first : Each r as bs) (second : Each r cs ds) : Each r (as ++ cs) (bs ++ ds) := by
+  induction first with
+  | nil => exact second
+  | cons head _ ih => exact .cons head ih
+
+theorem Each.mono {α β : Type} {r s : α → β → Prop} {as bs}
+    (related : Each r as bs) (imp : ∀ a b, r a b → s a b) : Each s as bs := by
+  induction related with
+  | nil => exact .nil
+  | cons head _ ih => exact .cons (imp _ _ head) ih
+
+theorem each_mapM {α β : Type} {f : α → Option β} {as : List α} {bs : List β}
+    (mapped : as.mapM f = some bs) : Each (fun a b => f a = some b) as bs := by
+  induction as generalizing bs with
+  | nil => simp at mapped; subst bs; exact .nil
+  | cons a as ih =>
+    cases head : f a with
+    | none => simp [List.mapM_cons, head] at mapped
+    | some b =>
+      cases tail : as.mapM f with
+      | none => simp [List.mapM_cons, head, tail] at mapped
+      | some rest =>
+        simp [List.mapM_cons, head, tail] at mapped
+        subst bs
+        exact .cons head (ih tail)
+
+theorem Each.mapM {α β : Type} {f : α → Option β} {as : List α} {bs : List β}
+    (related : Each (fun a b => f a = some b) as bs) : as.mapM f = some bs := by
+  induction related with
+  | nil => rfl
+  | cons head _ ih => simp [List.mapM_cons, head, ih]
+
+theorem array_each_mapM {α β : Type} {f : α → Option β} {as : Array α} {bs : Array β}
+    (mapped : as.mapM f = some bs) : Each (fun a b => f a = some b) as.toList bs.toList := by
+  apply each_mapM
+  have same := congrArg (Option.map Array.toList) mapped
+  change (Array.toList <$> as.mapM f) = some bs.toList at same
+  simpa only [Array.toList_mapM, Option.map_some] using same
+
+theorem each_array_mapM {α β : Type} {f : α → Option β} {as : Array α} {bs : Array β}
+    (related : Each (fun a b => f a = some b) as.toList bs.toList) : as.mapM f = some bs := by
+  simp [Array.mapM_eq_mapM_toList, related.mapM]
+
+def rval (word : Word) : IxIR2.Eval.RVal := .lit (.nat word.toNat)
+
+def EnvRel (bindings : Array Scalar.Atom) (native physical : Array Word) : Prop :=
+  Each (fun atom word => atom.eval native = some word) bindings.toList physical.toList
+
+theorem EnvRel.size {bindings native physical} (related : EnvRel bindings native physical) : bindings.size = physical.size := by
+  simpa using related.length
+
+theorem EnvRel.parameters (values : Array Word) : EnvRel (parameters values.size) values values := by
+  suffices ∀ (xs : List Nat), (∀ i ∈ xs, i < values.size) →
+      Each (fun atom word => atom.eval values = some word) (xs.map Scalar.Atom.var) (xs.map (fun i => values[i]!)) by
+    have h := this (List.range values.size) (by simp)
+    have same : (List.range values.size).map (fun i => values[i]!) = values.toList := by
+      apply List.ext_getElem
+      · simp
+      · intro index left right
+        simp at left
+        simp [left]
+    simpa [EnvRel, PhysicalScalar.parameters, same] using h
+  intro xs bounds
+  induction xs with
+  | nil => exact .nil
+  | cons index indices ih =>
+    exact .cons (by simp [Scalar.Atom.eval, bounds index (by simp)])
+      (ih (fun i h => bounds i (by simp [h])))
+
+theorem atom_sound {bindings native physical source target}
+    (related : EnvRel bindings native physical) (lowered : lowerAtom bindings source = some target) :
+    ∃ word, target.eval native = some word ∧ IxIR2.Eval.resolveAtom (physical.map rval) source = .ok (rval word) := by
+  cases source with
+  | reg index =>
+    obtain ⟨word, found, evaluated⟩ := related.lookup (by simpa [lowerAtom] using lowered)
+    have found : physical[index]? = some word := by simpa using found
+    exact ⟨word, evaluated, by simp [IxIR2.Eval.resolveAtom, found]⟩
+  | erased => simp [lowerAtom] at lowered
+  | lit literal =>
+    cases literal with
+    | nat number =>
+      cases encoded : ExactNat.encode number with
+      | none => simp [lowerAtom, encoded] at lowered
+      | some word =>
+        simp [lowerAtom, encoded] at lowered
+        subst target
+        exact ⟨word, rfl, by simp [IxIR2.Eval.resolveAtom, rval, ← ExactNat.encode_some_iff.mp encoded]⟩
+    | _ => simp [lowerAtom] at lowered
+
+theorem atom_resolves {bindings native physical source target word}
+    (related : EnvRel bindings native physical) (lowered : lowerAtom bindings source = some target)
+    (evaluated : target.eval native = some word) :
+    IxIR2.Eval.resolveAtom (physical.map rval) source = .ok (rval word) := by
+  obtain ⟨actual, value, resolved⟩ := atom_sound related lowered
+  have same := Option.some.inj (value.symm.trans evaluated)
+  subst actual
+  exact resolved
+
+theorem atom_push {atom : Scalar.Atom} {values : Array Word} {word : Word}
+    (evaluated : atom.eval values = some word) (bound : Word) : atom.eval (values.push bound) = some word := by
+  cases atom with
+  | constant value => exact evaluated
+  | var index =>
+    have found : values[index]? = some word := evaluated
+    obtain ⟨lt, eq⟩ := Array.getElem?_eq_some_iff.mp found
+    simp [Scalar.Atom.eval, Array.getElem?_push, lt, eq, Nat.ne_of_lt lt]
+
+theorem EnvRel.weaken {bindings native physical} (related : EnvRel bindings native physical) (word : Word) :
+    EnvRel bindings (native.push word) physical := related.mono (fun _ _ value => atom_push value word)
+
+theorem EnvRel.push {bindings native physical target word}
+    (related : EnvRel bindings native physical) (evaluated : target.eval native = some word) :
+    EnvRel (bindings.push target) native (physical.push word) := by
+  simpa [EnvRel] using related.append (Each.cons evaluated Each.nil)
+
+theorem EnvRel.bind {bindings native physical locals}
+    (related : EnvRel bindings native physical) (size : native.size = locals) (word : Word) :
+    EnvRel (bindings.push (.var locals)) (native.push word) (physical.push word) := by
+  apply (related.weaken word).push
+  simp [Scalar.Atom.eval, ← size]
+
+theorem EnvRel.prepend {bindings native physical locals}
+    (related : EnvRel bindings native physical) (size : native.size = locals) (word : Word) :
+    EnvRel (#[.var locals] ++ bindings) (native.push word) (#[word] ++ physical) := by
+  change Each _ _ _
+  simp only [Array.toList_append, List.cons_append, List.nil_append]
+  exact .cons (by simp [Scalar.Atom.eval, ← size]) (related.weaken word)
+
+theorem resolves_each {physical : Array Word} {sources : List IxIR2.Atom} {words : List Word}
+    (resolved : Each (fun source word => IxIR2.Eval.resolveAtom (physical.map rval) source = .ok (rval word)) sources words)
+    (accumulator : Array IxIR2.Eval.RVal) :
+    sources.foldlM (fun output source => do return output.push (← IxIR2.Eval.resolveAtom (physical.map rval) source)) accumulator =
+      .ok (accumulator ++ (words.toArray.map rval)) := by
+  induction resolved generalizing accumulator with
+  | nil => simp [pure, Except.pure]
+  | @cons source word sources words head tail ih =>
+    simp only [List.foldlM_cons, head, bind, Except.bind, pure, Except.pure]
+    have rest := ih (accumulator.push (rval word))
+    simp only [bind, Except.bind, pure, Except.pure] at rest
+    rw [rest]
+    congr 1
+    apply Array.ext'
+    simp
+
+theorem atoms_sound {bindings native physical sources targets}
+    (related : EnvRel bindings native physical) (lowered : lowerAtoms bindings sources = some targets) :
+    ∃ words, EnvRel targets native words ∧ targets.mapM (Scalar.Atom.eval native) = some words ∧
+      IxIR2.Eval.resolveAtoms (physical.map rval) sources = .ok (words.map rval) := by
+  have translated := array_each_mapM lowered
+  have many : ∀ {ss ts}, Each (fun s t => lowerAtom bindings s = some t) ss ts →
+      ∃ ws, Each (fun t w => t.eval native = some w) ts ws ∧
+        Each (fun s w => IxIR2.Eval.resolveAtom (physical.map rval) s = .ok (rval w)) ss ws := by
+    intro ss ts h
+    induction h with
+    | nil => exact ⟨[], .nil, .nil⟩
+    | cons head tail ih =>
+      obtain ⟨word, evaluated, resolved⟩ := atom_sound related head
+      obtain ⟨words, values, resolutions⟩ := ih
+      exact ⟨word :: words, .cons evaluated values, .cons resolved resolutions⟩
+  obtain ⟨words, values, resolutions⟩ := many translated
+  have env : EnvRel targets native words.toArray := by simpa [EnvRel] using values
+  refine ⟨words.toArray, env, each_array_mapM env, ?_⟩
+  simpa [IxIR2.Eval.resolveAtoms, ← Array.foldlM_toList] using resolves_each resolutions #[]
+
+end Ix.Compiler.X86.PhysicalScalar
diff --git a/Ix/Compiler/X86/PipelineSim.lean b/Ix/Compiler/X86/PipelineSim.lean
new file mode 100644
index 000000000..df9a32d73
--- /dev/null
+++ b/Ix/Compiler/X86/PipelineSim.lean
@@ -0,0 +1,168 @@
+import Ix.Compiler.IxIR2.PipelinePhysical
+import Ix.Compiler.X86.Select
+
+/-! Source evaluation through the validated baseline and the actual scalar
+selector result, ending at the typed local System V machine. -/
+
+namespace Ix.Compiler.X86.Select
+
+open Ix.Compiler
+open Ix.Compiler.Pipeline
+open Ix.Compiler.IxIR1.Lower
+open Ix.Compiler.IxIR1.LowerSim
+
+/-- The composed scalar boundary keeps the source sharing and oracle
+obligations of `ValidatedCompilation.semanticForwardSimulation`. Erasure,
+addressed execution, owned execution, interpretation transport, and selection
+facts are derived from the exact returned artifacts. -/
+theorem sourceRefines
+    {constants : List (Ixon.Address × Ixon.Constant)}
+    {mainAddress : Ixon.Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (attached : IxIR2.Pipeline.Attached constants mainAddress config .shared eraseFuel lowerFuel)
+    (selected : Output attached.target.artifact.program)
+    {sourceFuel : Nat} {sourceValue : Ixon.Eval.Value}
+    (horacles : @Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource = .ok sourceValue)
+    (core : X86.Core) :
+    ∃ rawValue ir1Fuel ir1Store controlFuel heapFuel physicalResult,
+      @Sim.InlinedValRel (validatedEvalCtx constants config) attached.source.rawCtx
+        sourceValue rawValue attached.source.memberScope ∧
+      MutualAddressedValueGraph
+        (IxIR0.MutualBlock.Renaming.apply attached.source.erasure.result.addressMap)
+        (attached.source.lowering.result.rebuildRename attached.source.lowering.raw)
+        attached.source.functionRel ir1Store rawValue (.lit (.nat selected.word.toNat)) ∧
+      IxIR1.runOwnedMain attached.compiled.simulationSourceContext .shared
+        attached.target.artifact.source.main ir1Fuel =
+          .ok (ir1Store, .lit (.nat selected.word.toNat)) ∧
+      IxIR2.Eval.runMain attached.compiled.simulationTargetContext .physical
+        attached.target.artifact.program controlFuel heapFuel = .ok physicalResult ∧
+      IxIR2.Lower.Sim.OutcomeRel (ir1Store, .lit (.nat selected.word.toNat)) physicalResult ∧
+      (X86.runFrom X86.Runtime.rejecting selected.target 2 core).status = .halted selected.word ∧
+      (X86.runFrom X86.Runtime.rejecting selected.target 2 core).core.readReg .rsp = core.readReg .rsp := by
+  letI : Sim.MemberScope := attached.source.memberScope
+  have hframe : (validatedMainFrame mainAddress).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [validatedMainFrame] at found
+  have hbelow : Ixon.Sharing.sharesBelow
+      (validatedMainFrame mainAddress).sharing.size validatedMainSource = true := rfl
+  have herase : EraseAddressed.run
+      (EraseValidator.eraseCtxOf (validatedEvalCtx constants config))
+      constants attached.source.entry.target eraseFuel = .ok attached.source.erasure.result := by
+    rw [attached.source.entryTarget]
+    exact attached.source.erasure.runEq
+  obtain ⟨traceFuel, addressedValue, trace, sourceRelation⟩ :=
+    CallAwareProjectionSafe.of_certifiedSharedClosed_addressed_with_members
+      (fun _ _ => none)
+      (IxIR0.Readdress.Oracle.readdress attached.source.erasure.result.addressMap (fun _ _ => none))
+      attached.source.members attached.source.entry herase
+      (IxIR0.Readdress.Oracle.readdress_compatible
+        (IxIR0.Readdress.Oracle.Readdressable.empty attached.source.erasure.result.addressMap))
+      horacles hctx hframe hbelow hsource
+  obtain ⟨rawValue, sourceRelation, addressedValueEq⟩ := sourceRelation
+  subst addressedValue
+  have lowered : (lowerAllAction attached.source.erasure.result.declarations
+      attached.source.erasure.result.main .shared lowerFuel).run {} =
+      .ok (attached.source.lowering.raw, attached.source.lowering.mainCode)
+        attached.source.lowering.finalState := by
+    simpa only [lowerAllIndexedAction_eq_lowerAllAction] using attached.source.lowering.lowerRun
+  have progress := lowerAllAction_main_progress_of_trace_sealed rfl lowered
+    (fun member => attached.source.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+    (attached.source.exactExtraRepresented (fun _ _ => none))
+    (attached.source.exactCompilerContracts (fun _ _ => none)).1
+    (attached.source.externValueContract (fun _ _ => none))
+    (attached.source.externTraceProgressContract (fun _ _ => none)) trace
+  have simulation : SemanticForwardSimulation attached.source.addressedSourceCtx
+      (attached.source.exactTargetCtx (fun _ _ => none))
+      attached.source.erasure.result.main attached.source.lowering.mainCode
+      attached.source.functionRel := by
+    apply lowerAllAction_semanticForwardSimulation_of_targetProgress_sealed rfl lowered
+      (fun member => attached.source.exactTargetCtx_decls_of_mem (fun _ _ => none) member)
+      (attached.source.exactExtraRepresented (fun _ _ => none))
+      (attached.source.exactCompilerContracts (fun _ _ => none)).1
+      (attached.source.externValueContract (fun _ _ => none))
+    intro _ _ _
+    exact progress
+  obtain ⟨ir1Fuel, rawStore, ir1Value, rawRun, graph⟩ := simulation trace.run
+  let rename := attached.source.lowering.result.rebuildRename attached.source.lowering.raw
+  let ir1Store := IxIR1.Readdress.Store.mapAddresses rename rawStore
+  have ownership := lowerAllAction_main_owned lowered
+    (attached.source.exactExtraRepresented (fun _ _ => none))
+    (attached.source.exactCompilerContracts (fun _ _ => none)).1 rawRun
+  have rawWorld : IxIR1.Sim.HasWorld rawStore .shared ir1Value :=
+    ownership.roots_world ⟨.shared, ir1Value⟩ (by simp)
+  have finalWorld : IxIR1.Sim.HasWorld ir1Store .shared ir1Value :=
+    (IxIR1.Sim.hasWorld_mapAddresses_iff rename rawStore .shared ir1Value).mpr rawWorld
+  have sourceRun : IxIR1.runMain attached.compiled.simulationSourceContext
+      attached.source.lowering.result.main ir1Fuel = .ok (ir1Store, ir1Value) := by
+    have audit : attached.source.lowering.result.rebuildSemanticAudit
+        attached.source.lowering.raw attached.source.lowering.mainCode = true :=
+      attached.compiled.sourceRebuildSemanticAudit
+    have renames : IxIR1.Readdress.Ctx.Renames rename
+        (attached.source.exactTargetCtx (fun _ _ => none))
+        attached.compiled.simulationSourceContext := attached.compiled.sourceContextRenames
+    rw [attached.source.lowering.result.main_eq_rebuildMapAddresses audit]
+    rw [IxIR1.Readdress.runMain_mapAddresses renames
+      attached.source.lowering.mainCode ir1Fuel, rawRun]
+    rfl
+  have mainEq : attached.target.artifact.source.main = attached.source.lowering.result.main := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+    rfl
+  have resultEq : attached.target.artifact.source.mainResult = .shared := by
+    rw [attached.targetSourceProduced, attached.inputProduced]
+  have ownedRun : IxIR1.runOwnedMain attached.compiled.simulationSourceContext
+      attached.target.artifact.source.mainResult attached.target.artifact.source.main ir1Fuel =
+      .ok (ir1Store, ir1Value) := by
+    rw [mainEq, resultEq]
+    unfold IxIR1.runOwnedMain
+    change (IxIR1.runMain attached.compiled.simulationSourceContext
+      attached.source.lowering.result.main ir1Fuel >>= IxIR1.checkResultWorld .shared) = _
+    rw [sourceRun]
+    simp [IxIR1.checkResultWorld, IxIR1.Sim.rval_hasWorld_eq_true_iff.mpr finalWorld]
+  obtain ⟨controlFuel, heapFuel, physicalResult, physicalRun, related⟩ :=
+    attached.compiled.successfulPhysicalMainSimulation ownedRun
+  obtain ⟨value, targetRun, stackPreserved⟩ := selected.refinesSuccessfulRun physicalRun core
+  have ir1ValueEq : ir1Value = .lit (.nat selected.word.toNat) := related.value.symm.trans value
+  subst ir1Value
+  refine ⟨rawValue, ir1Fuel, ir1Store, controlFuel, heapFuel, physicalResult,
+    sourceRelation, ⟨rawStore, rfl, graph⟩, ?_, physicalRun, related, targetRun, stackPreserved⟩
+  simpa only [resultEq] using ownedRun
+
+/-- A source Nat is returned exactly as a native word, without truncation.
+This specialization makes the scalar observation explicit at both ends. -/
+theorem sourceScalarRefines
+    {constants : List (Ixon.Address × Ixon.Constant)}
+    {mainAddress : Ixon.Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (attached : IxIR2.Pipeline.Attached constants mainAddress config .shared eraseFuel lowerFuel)
+    (selected : Output attached.target.artifact.program)
+    {sourceFuel number : Nat}
+    (horacles : @Sim.OracleRel attached.source.memberScope
+      (validatedEvalCtx constants config).inlineSharing attached.source.rawCtx)
+    (hctx : (validatedEvalCtx constants config).SharingWF)
+    (hsource : Ixon.Eval.eval (validatedEvalCtx constants config) sourceFuel
+      (validatedMainFrame mainAddress) [] validatedMainSource = .ok (.litV (.natL number)))
+    (core : X86.Core) :
+    selected.word.toNat = number ∧
+      (X86.runFrom X86.Runtime.rejecting selected.target 2 core).status = .halted selected.word ∧
+      (X86.runFrom X86.Runtime.rejecting selected.target 2 core).core.readReg .rsp = core.readReg .rsp := by
+  obtain ⟨rawValue, _, _, _, _, _, sourceRelation, graph, _, _, _, targetRun, stackPreserved⟩ :=
+    sourceRefines attached selected horacles hctx hsource core
+  have literal : rawValue = .lit (.nat number) := by
+    simp only [Sim.InlinedValRel, Ixon.Eval.Value.inlineSharing] at sourceRelation
+    cases sourceRelation
+    rfl
+  subst rawValue
+  obtain ⟨_, _, graph⟩ := graph
+  have numberEq : number = selected.word.toNat := by
+    simp only [IxIR0.Readdress.Value.mapAddresses] at graph
+    cases graph
+    rfl
+  exact ⟨numberEq.symm, targetRun, stackPreserved⟩
+
+end Ix.Compiler.X86.Select
diff --git a/Ix/Compiler/X86/RuntimeExecution.lean b/Ix/Compiler/X86/RuntimeExecution.lean
new file mode 100644
index 000000000..a6518e5ee
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeExecution.lean
@@ -0,0 +1,135 @@
+import Ix.Compiler.X86.RuntimeScan
+import Ix.Compiler.X86.UniqueResult
+
+/-! The complete runtime-input native call and its release. The input heap is
+supplied through a bounded ownership relation; all execution conclusions use
+the one checked program and the ordinary typed x86 byte-memory runner. -/
+
+namespace Ix.Compiler.X86.RuntimeExecution
+
+open UniqueABI UniqueTarget UniqueExecution
+
+variable {foldCounters : Bool}
+
+theorem initializeInput (layout : Layout) (values : List Word) (state : State)
+    (capacity : values.length + 2 ≤ layout.capacity) (context : state.registers .rdi = layout.base)
+    (root : state.registers .rdx = layout.cell values.length) (chain : DownChain layout state.words values)
+    (counts : CountsAt layout (readyCounts (values.length + 1)) state.words) :
+    ∃ after, Trace layout (allocate nilTag 0 (.imm 0) .rsi) state after ∧ Initialized layout values state after := by
+  let after := allocateState state layout (values.length + 1) nilTag 0 (.imm 0) .rsi
+  have allocation := allocateTrace layout state (values.length + 1) nilTag 0 (.imm 0) .rsi
+    (by omega) context counts.cursor
+  have words : after.words = allocatedWords state.words (values.length + 1) nilTag 0 0 := by
+    simpa [after] using allocateState_words state layout (values.length + 1) nilTag 0 (.imm 0) .rsi rfl
+  refine ⟨after, allocation, ?_, ?_, ?_, ?_, allocateState_destination state layout (values.length + 1) nilTag 0 (.imm 0) .rsi,
+    ?_, allocateState_saved state layout (values.length + 1) nilTag 0 (.imm 0) .rsi rfl⟩
+  · rw [words]
+    apply chain.mono
+    intro index bound field fieldBound
+    exact allocatedWords_other state.words (by omega) fieldBound _ _ _
+  · change CellAt after.words (values.length + 1) nilTag 0 0
+    rw [words]
+    exact allocatedWords_cell _ _ _ _ _
+  · rw [words]
+    simpa [Nat.add_assoc] using counts.allocate (values.length + 1) nilTag 0 0
+  · exact (allocateState_other state layout (values.length + 1) nilTag 0 (.imm 0) .rsi .rdx
+      (by decide) (by decide) (by decide) (by decide)).trans root
+  · exact (allocateState_other state layout (values.length + 1) nilTag 0 (.imm 0) .rsi .rdi
+      (by decide) (by decide) (by decide) (by decide)).trans context
+
+theorem mainSteps (layout : Layout) (values : List Word) (state : State)
+    (input : Input layout values state) (capacity : values.length + 2 ≤ layout.capacity)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    ∃ after nextMemory, LoopResult layout values.reverse (mainCounts values.length) state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      Steps runtime (RuntimeTarget.checked foldCounters) (RuntimeTarget.controlCost values.length foldCounters) (leaf (state.core memory) 0 0)
+        (haltedLeaf (after.core nextMemory) 4 13) := by
+  obtain ⟨prepared, result, validation⟩ := validationSteps (foldCounters := foldCounters) layout values state input capacity outside memory represented runtime
+  have preparedView : Realizes layout outside prepared.words memory := result.words.symm ▸ represented
+  obtain ⟨initialized, allocation, initializedResult⟩ := initializeInput layout values prepared capacity result.context result.root
+    (result.words.symm ▸ input.chain) (result.words.symm ▸ input.counts)
+  obtain ⟨allocatedMemory, allocatedView, allocationSteps⟩ := allocation.jump outside memory preparedView runtime (RuntimeTarget.checked foldCounters) 2 3
+    ⟨rfl, by decide⟩ (hasBlock 3 (by decide))
+  have invariant : LoopInvariant layout values [] (readyCounts (values.length + 2)) initialized :=
+    ⟨initializedResult.input, initializedResult.accumulator, initializedResult.counts, initializedResult.inputRoot,
+      initializedResult.accRoot, initializedResult.context⟩
+  obtain ⟨after, nextMemory, loopResult, finalView, loop⟩ := loopStepsFor layout values [] (readyCounts (values.length + 2))
+    initialized invariant (by simpa using capacity) (by simp [readyCounts]) outside allocatedMemory allocatedView
+    runtime (RuntimeTarget.checked foldCounters) (RuntimeTarget.loopInstructions foldCounters)
+    (RuntimeTarget.loopCode foldCounters) (RuntimeTarget.loopTrace foldCounters layout)
+  refine ⟨after, nextMemory, ?_, finalView, ?_⟩
+  · have saved := (result.saved.trans initializedResult.saved).trans loopResult.saved
+    simp only [List.append_nil, readyCounts_finish] at loopResult
+    exact { loopResult with saved }
+  · have all := validation.append (allocationSteps.append loop)
+    have cost : RuntimeTarget.validationCost values.length +
+        ((allocate nilTag 0 (.imm 0) .rsi).length + 1 +
+          (((RuntimeTarget.loopInstructions foldCounters).length + 3) * values.length + 16)) =
+        RuntimeTarget.controlCost values.length foldCounters := by
+      cases foldCounters <;>
+        simp [RuntimeTarget.validationCost, RuntimeTarget.controlCost, allocate_length,
+          RuntimeTarget.loopInstructions, UniqueCounterFold.instructions, consInstructions,
+          reserveCons, reuseCons, changeCounter] <;> omega
+    rw [cost] at all
+    exact all
+
+theorem mainRuns (layout : Layout) (values : List Word) (state : State)
+    (input : Input layout values state) (capacity : values.length + 2 ≤ layout.capacity)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    ∃ after nextMemory, LoopResult layout values.reverse (mainCounts values.length) state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      runFrom runtime (RuntimeTarget.checked foldCounters) (RuntimeTarget.controlCost values.length foldCounters) (state.core memory) =
+        haltedLeaf (after.core nextMemory) 4 13 := by
+  obtain ⟨after, nextMemory, result, finalView, steps⟩ := mainSteps (foldCounters := foldCounters) layout values state input capacity outside memory represented runtime
+  exact ⟨after, nextMemory, result, finalView, steps.run_eq⟩
+
+structure Execution (layout : Layout) (values : List Word) (before : State) (memory outside : Memory) (runtime : Runtime)
+    (returned : State) (returnedMemory : Memory) (reclaimed : State) (reclaimedMemory : Memory)
+    (foldCounters : Bool := false) : Prop where
+  returnedResult : LoopResult layout values.reverse (mainCounts values.length) before returned
+  returnedView : Realizes layout outside returned.words returnedMemory
+  graph : NativeList returnedMemory ((values.map UInt64.toNat).reverse) (returned.registers .rax)
+    (chainNodes layout 1 values.length)
+  mainRun : runFrom runtime (RuntimeTarget.checked foldCounters) (RuntimeTarget.controlCost values.length foldCounters) (before.core memory) =
+    haltedLeaf (returned.core returnedMemory) 4 13
+  reclaimedResult : Reclaimed layout values.length before reclaimed
+  reclaimedView : Realizes layout outside reclaimed.words reclaimedMemory
+  releaseRun : runFrom runtime RuntimeTarget.releaseChecked (releaseCost values.length) (returned.core returnedMemory) =
+    haltedLeaf (reclaimed.core reclaimedMemory) 2 13
+
+theorem executes (layout : Layout) (values : List Word) (state : State)
+    (input : Input layout values state) (capacity : values.length + 2 ≤ layout.capacity)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    ∃ returned returnedMemory reclaimed reclaimedMemory,
+      Execution layout values state memory outside runtime returned returnedMemory reclaimed reclaimedMemory foldCounters := by
+  obtain ⟨returned, returnedMemory, result, returnedView, mainRun⟩ := mainRuns (foldCounters := foldCounters) layout values state input capacity outside memory represented runtime
+  have graph := result.chain.native returnedView (by simp; omega)
+  obtain ⟨reclaimed, reclaimedMemory, released, reclaimedView, releaseRun⟩ := releaseRuns layout values.reverse 1
+    (mainCounts values.length) returned result.chain result.countsAt result.root result.context
+    (by simp; omega) (by simp [mainCounts]) outside returnedMemory returnedView runtime RuntimeTarget.releaseChecked rfl
+  refine ⟨returned, returnedMemory, reclaimed, reclaimedMemory, result, returnedView,
+    by simpa [result.result] using graph, mainRun, ?_, reclaimedView, by simpa using releaseRun⟩
+  refine ⟨by simpa using released.countsAt, ?_, released.result, result.saved.trans released.saved⟩
+  intro index bound
+  by_cases zero : index = 0
+  · subst index
+    apply result.freedNil.mono
+    intro field fieldBound
+    exact released.frame 0 (Or.inl (by decide)) field fieldBound
+  · exact released.freed index (by omega) (by simp; omega)
+
+theorem Execution.mainSafe {layout : Layout} {values : List Word} {before returned reclaimed : State}
+    {memory outside returnedMemory reclaimedMemory : Memory} {runtime : Runtime}
+    (execution : Execution layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory foldCounters)
+    (count : Nat) (bound : count ≤ RuntimeTarget.controlCost values.length foldCounters) (fault : Trap) :
+    (runFrom runtime (RuntimeTarget.checked foldCounters) count (before.core memory)).status ≠ .trapped fault :=
+  run_prefix_not_trapped execution.mainRun rfl count bound fault
+
+theorem Execution.releaseSafe {layout : Layout} {values : List Word} {before returned reclaimed : State}
+    {memory outside returnedMemory reclaimedMemory : Memory} {runtime : Runtime}
+    (execution : Execution layout values before memory outside runtime returned returnedMemory reclaimed reclaimedMemory foldCounters)
+    (count : Nat) (bound : count ≤ releaseCost values.length) (fault : Trap) :
+    (runFrom runtime RuntimeTarget.releaseChecked count (returned.core returnedMemory)).status ≠ .trapped fault :=
+  run_prefix_not_trapped execution.releaseRun rfl count bound fault
+
+end Ix.Compiler.X86.RuntimeExecution
diff --git a/Ix/Compiler/X86/RuntimeGuards.lean b/Ix/Compiler/X86/RuntimeGuards.lean
new file mode 100644
index 000000000..4eb8d7ec5
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeGuards.lean
@@ -0,0 +1,119 @@
+import Ix.Compiler.X86.RuntimeInspect
+import Ix.Compiler.X86.UniqueMain
+
+namespace Ix.Compiler.X86.RuntimeExecution
+
+open UniqueABI UniqueTarget UniqueExecution RuntimeTarget
+
+variable {foldCounters : Bool}
+
+structure Input (layout : Layout) (values : List Word) (state : State) : Prop where
+  chain : DownChain layout state.words values
+  counts : CountsAt layout (readyCounts (values.length + 1)) state.words
+  context : state.registers .rdi = layout.base
+  length : state.registers .rsi = UInt64.ofNat values.length
+
+theorem hasBlock (block : BlockId) (bound : block.toNat < 26) :
+    (RuntimeTarget.checked foldCounters).program.hasBlock block = true := by
+  simpa [RuntimeTarget.checked, RuntimeTarget.program, Program.hasBlock] using bound
+
+theorem and_seven (value : Word) : value &&& 7 = value % 8 := by
+  apply UInt64.toNat_inj.mp
+  change value.toNat &&& 7 = value.toNat % 8
+  exact Nat.and_two_pow_sub_one_eq_mod value.toNat 3
+
+theorem and_thirtyOne (value : Word) : value &&& 31 = value % 32 := by
+  apply UInt64.toNat_inj.mp
+  change value.toNat &&& 31 = value.toNat % 32
+  exact Nat.and_two_pow_sub_one_eq_mod value.toNat 5
+
+def alignmentState (state : State) : State := state.setReg .rax (state.registers .rdi &&& 7)
+
+theorem alignmentTrace (layout : Layout) (state : State) :
+    Trace layout alignmentInstructions state (alignmentState state) := by
+  refine .cons (.mov _ _ _) (.cons (.alu _ _ _ _) ?_)
+  simpa [alignmentState, AluOp.eval, signExtend32] using Trace.nil (layout := layout) (alignmentState state)
+
+def byteCount (count : Word) : Word := (count + 1) * 8 * 4
+
+theorem byteCount_nat (count : Nat) : byteCount (UInt64.ofNat count) = UInt64.ofNat (cellBytes * (count + 1)) := by
+  simp only [byteCount, cellBytes, UInt64.ofNat_mul, UInt64.ofNat_add]
+  rw [UInt64.mul_assoc]
+  exact UInt64.mul_comm _ _
+
+def cursorState (state : State) : State :=
+  ((state.setReg .r10 (state.registers .rsi + 1)).setReg .rax
+    (byteCount (state.registers .rsi))).setReg .r11 (state.words Field.cursor.index)
+
+theorem cursorTrace (layout : Layout) (state : State) (context : state.registers .rdi = layout.base) :
+    Trace layout cursorInstructions state (cursorState state) := by
+  let first := state.setReg .r10 (state.registers .rsi + 1)
+  let second := first.setReg .rax ((state.registers .rsi + 1) * 8)
+  let third := second.setReg .rax (byteCount (state.registers .rsi))
+  have one : Trace layout [.lea .r10 (memoryOperand .rsi 1)] state first := by
+    refine .cons (.lea _ _ _) ?_
+    simpa [first, operand_address state .rsi 1 (by decide)] using Trace.nil (layout := layout) first
+  have two : Trace layout [.lea .rax { index := some .r10, scale := .eight }] first second := by
+    refine .cons (.lea _ _ _) ?_
+    simpa [first, second, State.address, State.core, MemAddr.eval, Core.readReg, IndexReg.gpr, Scale.word,
+      signExtend32] using Trace.nil (layout := layout) second
+  have three : Trace layout [.lea .rax { index := some .rax, scale := .four }] second third := by
+    refine .cons (.lea _ _ _) ?_
+    simpa [second, third, byteCount, State.address, State.core, MemAddr.eval, Core.readReg, IndexReg.gpr,
+      Scale.word, signExtend32] using Trace.nil (layout := layout) third
+  have four : Trace layout [Instr.load .w64 .r11 (header .cursor)] third (cursorState state) := by
+    refine .cons (.load _ _ _ Field.cursor.index (layout.field_bound .cursor)
+      (header_address third layout .cursor (by simpa [third, second, first] using context))) ?_
+    simpa [third, second, first, cursorState] using Trace.nil (layout := layout) (cursorState state)
+  exact ((one.append two).append three).append four
+
+def capacityState (state : State) : State :=
+  (state.setReg .rcx (state.words Field.capacity.index)).setReg .r11 (state.registers .rax + 32)
+
+theorem capacityTrace (layout : Layout) (state : State) (context : state.registers .rdi = layout.base) :
+    Trace layout capacityInstructions state (capacityState state) := by
+  refine .cons (.load _ _ _ Field.capacity.index (layout.field_bound .capacity)
+    (header_address state layout .capacity context)) (.cons (.lea _ _ _) ?_)
+  simpa [capacityState, cellBytes, operand_address _ .rax 32 (by decide)] using
+    Trace.nil (layout := layout) (capacityState state)
+
+def capacityAlignmentState (state : State) : State := state.setReg .r11 (state.registers .rcx &&& 31)
+
+theorem capacityAlignmentTrace (layout : Layout) (state : State) :
+    Trace layout capacityAlignmentInstructions state (capacityAlignmentState state) := by
+  refine .cons (.mov _ _ _) (.cons (.alu _ _ _ _) ?_)
+  simpa [capacityAlignmentState, AluOp.eval, signExtend32] using
+    Trace.nil (layout := layout) (capacityAlignmentState state)
+
+def headerState (state : State) (field : Field) : State := state.setReg .r11 (state.words field.index)
+
+theorem headerTrace (layout : Layout) (state : State) (field : Field)
+    (context : state.registers .rdi = layout.base) :
+    Trace layout (headerInstructions field) state (headerState state field) :=
+  .cons (.load _ _ _ field.index (layout.field_bound field) (header_address state layout field context)) (.nil _)
+
+theorem guardSteps {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (readonly : instructions.all readsOnly = true)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (runtime : Runtime) (block next : BlockId) (left : GPR) (right : AluSource) (condition : Condition)
+    (code : BlockCode (RuntimeTarget.checked foldCounters) block instructions (.branch (wordCompare left right) condition next 6))
+    (holds : (wordCompare left right).holds condition (after.core Memory.unmapped) = true)
+    (nextBound : next.toNat < 26) :
+    Steps runtime (RuntimeTarget.checked foldCounters) (instructions.length + 1) (leaf (before.core memory) block 0)
+      (leaf (after.core memory) next 0) :=
+  trace.branch_readOnly readonly outside memory represented runtime (RuntimeTarget.checked foldCounters) block next 6
+    (wordCompare left right) condition code true holds (hasBlock (foldCounters := foldCounters) next nextBound)
+
+theorem headerSteps (layout : Layout) (state : State) (field : Field)
+    (context : state.registers .rdi = layout.base) (outside memory : Memory)
+    (represented : Realizes layout outside state.words memory) (runtime : Runtime) (block next : BlockId)
+    (right : AluSource)
+    (code : BlockCode (RuntimeTarget.checked foldCounters) block (headerInstructions field) (.branch (wordCompare .r11 right) .eq next 6))
+    (holds : (wordCompare .r11 right).holds .eq ((headerState state field).core Memory.unmapped) = true)
+    (nextBound : next.toNat < 26) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 2 (leaf (state.core memory) block 0)
+      (leaf ((headerState state field).core memory) next 0) :=
+  guardSteps (foldCounters := foldCounters) (headerTrace layout state field context) rfl outside memory represented runtime block next
+    .r11 right .eq code holds nextBound
+
+end Ix.Compiler.X86.RuntimeExecution
diff --git a/Ix/Compiler/X86/RuntimeHeader.lean b/Ix/Compiler/X86/RuntimeHeader.lean
new file mode 100644
index 000000000..18bcb256d
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeHeader.lean
@@ -0,0 +1,150 @@
+import Ix.Compiler.X86.RuntimeGuards
+
+namespace Ix.Compiler.X86.RuntimeExecution
+
+open UniqueABI UniqueTarget UniqueExecution RuntimeTarget
+
+variable {foldCounters : Bool}
+
+def headersState (state : State) : State :=
+  let state := headerState state .allocs
+  let state := headerState state .frees
+  let state := headerState state .reuses
+  let state := headerState state .live
+  let state := headerState state .peak
+  let state := headerState state .rcops
+  let state := headerState state .payload
+  headerState state .reservations
+
+theorem headerSequence (layout : Layout) (count : Nat) (state : State)
+    (counts : CountsAt layout (readyCounts count) state.words)
+    (context : state.registers .rdi = layout.base) (expected : state.registers .r10 = UInt64.ofNat count)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 16 (leaf (state.core memory) 12 0)
+      (leaf ((headersState state).core memory) 20 0) := by
+  let s1 := headerState state .allocs
+  let s2 := headerState s1 .frees
+  let s3 := headerState s2 .reuses
+  let s4 := headerState s3 .live
+  let s5 := headerState s4 .peak
+  let s6 := headerState s5 .rcops
+  let s7 := headerState s6 .payload
+  have one := headerSteps (foldCounters := foldCounters) layout state .allocs context outside memory represented runtime 12 13 (.reg .r10)
+    ⟨rfl, by decide⟩ (by simp [headerState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, Field.index, counts.allocs, readyCounts, expected]) (by decide)
+  have two := headerSteps (foldCounters := foldCounters) layout s1 .frees (by simpa [s1, headerState] using context) outside memory represented
+    runtime 13 14 (.imm 0) ⟨rfl, by decide⟩ (by simp [s1, headerState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.frees, readyCounts, signExtend32]) (by decide)
+  have three := headerSteps (foldCounters := foldCounters) layout s2 .reuses (by simpa [s2, s1, headerState] using context) outside memory represented
+    runtime 14 15 (.imm 0) ⟨rfl, by decide⟩ (by simp [s2, s1, headerState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.reuses, readyCounts, signExtend32]) (by decide)
+  have four := headerSteps (foldCounters := foldCounters) layout s3 .live (by simpa [s3, s2, s1, headerState] using context) outside memory represented
+    runtime 15 16 (.reg .r10) ⟨rfl, by decide⟩ (by simp [s3, s2, s1, headerState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.live, readyCounts, expected]) (by decide)
+  have five := headerSteps (foldCounters := foldCounters) layout s4 .peak (by simpa [s4, s3, s2, s1, headerState] using context) outside memory represented
+    runtime 16 17 (.reg .r10) ⟨rfl, by decide⟩ (by simp [s4, s3, s2, s1, headerState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.peak, readyCounts, expected]) (by decide)
+  have six := headerSteps (foldCounters := foldCounters) layout s5 .rcops (by simpa [s5, s4, s3, s2, s1, headerState] using context) outside memory represented
+    runtime 17 18 (.imm 0) ⟨rfl, by decide⟩ (by simp [s5, s4, s3, s2, s1, headerState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.rcops, signExtend32]) (by decide)
+  have seven := headerSteps (foldCounters := foldCounters) layout s6 .payload (by simpa [s6, s5, s4, s3, s2, s1, headerState] using context) outside memory represented
+    runtime 18 19 (.imm 0) ⟨rfl, by decide⟩ (by simp [s6, s5, s4, s3, s2, s1, headerState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.payload, readyCounts, signExtend32]) (by decide)
+  have eight := headerSteps (foldCounters := foldCounters) layout s7 .reservations (by simpa [s7, s6, s5, s4, s3, s2, s1, headerState] using context)
+    outside memory represented runtime 19 20 (.imm 0) ⟨rfl, by decide⟩
+    (by simp [s7, s6, s5, s4, s3, s2, s1, headerState, wordCompare, Compare.holds, Condition.holds, Core.readReg,
+      State.core, AluSource.eval, Field.index, counts.reservations, signExtend32]) (by decide)
+  exact one.append (two.append (three.append (four.append (five.append (six.append (seven.append eight))))))
+
+def descriptorState (state : State) : State :=
+  headersState (capacityAlignmentState (capacityState (cursorState (alignmentState state))))
+
+theorem descriptorSteps (layout : Layout) (length : Nat) (state : State)
+    (capacity : length + 2 ≤ layout.capacity)
+    (counts : CountsAt layout (readyCounts (length + 1)) state.words)
+    (context : state.registers .rdi = layout.base) (argument : state.registers .rsi = UInt64.ofNat length)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 33 (leaf (state.core memory) 0 0)
+      (leaf ((descriptorState state).core memory) 20 0) := by
+  have lengthBound : length ≤ 64 := by have := layout.capacityBound; change layout.capacity ≤ 66 at this; omega
+  have lengthSmall : length < UInt64.size := by change length < 18446744073709551616; omega
+  have bytesSmall : cellBytes * layout.capacity < UInt64.size := by
+    have := layout.capacityBound
+    change layout.capacity ≤ 66 at this
+    change 32 * layout.capacity < 18446744073709551616
+    omega
+  have requiredSmall : cellBytes * (length + 2) < UInt64.size := by
+    change 32 * (length + 2) < 18446744073709551616
+    omega
+  have space : UInt64.ofNat (cellBytes * (length + 2)) ≤ UInt64.ofNat (cellBytes * layout.capacity) := by
+    rw [UInt64.ofNat_le_iff_le requiredSmall bytesSmall]
+    exact Nat.mul_le_mul_left _ capacity
+  have capped : UInt64.ofNat (cellBytes * layout.capacity) ≤ 2112 := by
+    change UInt64.ofNat (cellBytes * layout.capacity) ≤ UInt64.ofNat 2112
+    rw [UInt64.ofNat_le_iff_le bytesSmall (by decide)]
+    have := layout.capacityBound
+    change layout.capacity ≤ 66 at this
+    change 32 * layout.capacity ≤ 2112
+    omega
+  have multiple : UInt64.ofNat (cellBytes * layout.capacity) &&& 31 = 0 := by
+    rw [and_thirtyOne]
+    apply UInt64.toNat_inj.mp
+    simp [UInt64.toNat_mod, UInt64.toNat_ofNat_of_lt' bytesSmall, cellBytes]
+  have required : UInt64.ofNat (cellBytes * (length + 1)) + 32 = UInt64.ofNat (cellBytes * (length + 2)) := by
+    simp [cellBytes, Nat.mul_add, UInt64.ofNat_add, UInt64.add_assoc]
+  have available : byteCount (UInt64.ofNat length) + 32 ≤ UInt64.ofNat (cellBytes * layout.capacity) := by
+    rw [byteCount_nat, required]
+    exact space
+  let aligned := alignmentState state
+  let cursor := cursorState aligned
+  let sized := capacityState cursor
+  let prepared := capacityAlignmentState sized
+  have zero := guardSteps (foldCounters := foldCounters) (Trace.nil (layout := layout) state) rfl outside memory represented runtime 0 1
+    .rsi (.imm 64) .unsignedLe ⟨rfl, by decide⟩
+    (by simpa [wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval,
+      signExtend32, argument, UInt64.le_iff_toNat_le, UInt64.toNat_ofNat_of_lt' lengthSmall] using lengthBound) (by decide)
+  have one := guardSteps (foldCounters := foldCounters) (alignmentTrace layout state) rfl outside memory represented runtime 1 7
+    .rax (.imm 0) .eq ⟨rfl, by decide⟩
+    (by simp [alignmentState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, signExtend32, context, and_seven, layout.aligned]) (by decide)
+  have seven := guardSteps (foldCounters := foldCounters) (Trace.nil (layout := layout) aligned) rfl outside memory represented runtime 7 8
+    .rdi (.imm 0) .ne ⟨rfl, by decide⟩
+    (by simp [aligned, alignmentState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, signExtend32, context, layout.nonzero]) (by decide)
+  have eight := guardSteps (foldCounters := foldCounters) (cursorTrace layout aligned (by simpa [aligned, alignmentState] using context)) rfl
+    outside memory represented runtime 8 9 .r11 (.reg .rax) .eq ⟨rfl, by decide⟩
+    (by simp [cursorState, aligned, alignmentState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, argument, byteCount_nat, Field.index, counts.cursor, readyCounts]) (by decide)
+  have nine := guardSteps (foldCounters := foldCounters) (capacityTrace layout cursor (by simpa [cursor, cursorState, aligned, alignmentState] using context))
+    rfl outside memory represented runtime 9 10 .rcx (.reg .r11) .unsignedGe ⟨rfl, by decide⟩
+    (by simpa [capacityState, cursor, cursorState, aligned, alignmentState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, argument, Field.index, counts.capacity] using available) (by decide)
+  have ten := guardSteps (foldCounters := foldCounters) (Trace.nil (layout := layout) sized) rfl outside memory represented runtime 10 11
+    .rcx (.imm 2112) .unsignedLe ⟨rfl, by decide⟩
+    (by simpa [sized, capacityState, cursor, cursorState, aligned, alignmentState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, Field.index, counts.capacity, signExtend32] using capped) (by decide)
+  have eleven := guardSteps (foldCounters := foldCounters) (capacityAlignmentTrace layout sized) rfl outside memory represented runtime 11 12
+    .r11 (.imm 0) .eq ⟨rfl, by decide⟩
+    (by simpa [capacityAlignmentState, sized, capacityState, cursor, cursorState, aligned, alignmentState, wordCompare,
+      Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval, Field.index, counts.capacity,
+      signExtend32] using multiple) (by decide)
+  have rest := headerSequence (foldCounters := foldCounters) layout (length + 1) prepared counts
+    (by simpa [prepared, capacityAlignmentState, sized, capacityState, cursor, cursorState, aligned, alignmentState] using context)
+    (by simp [prepared, capacityAlignmentState, sized, capacityState, cursor, cursorState, aligned, alignmentState,
+      argument, UInt64.ofNat_add]) outside memory represented runtime
+  exact zero.append (one.append (seven.append (eight.append (nine.append (ten.append (eleven.append rest))))))
+
+theorem descriptorState_words (state : State) : (descriptorState state).words = state.words := rfl
+
+theorem descriptorState_register (state : State) (register : GPR)
+    (kept : register ∉ [.rax, .rcx, .r10, .r11]) :
+    (descriptorState state).registers register = state.registers register := by
+  cases register <;>
+    simp_all [descriptorState, headersState, headerState, capacityAlignmentState, capacityState, cursorState, alignmentState]
+
+theorem descriptorState_saved (state : State) : PreservesSaved state (descriptorState state) := by
+  intro register saved
+  apply descriptorState_register
+  cases register <;> simp_all [Saved]
+
+end Ix.Compiler.X86.RuntimeExecution
diff --git a/Ix/Compiler/X86/RuntimeInput.lean b/Ix/Compiler/X86/RuntimeInput.lean
new file mode 100644
index 000000000..eb8b77fb2
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeInput.lean
@@ -0,0 +1,132 @@
+import Ix.Compiler.X86.RuntimeExecution
+
+/-! The caller's canonical input construction and its byte-memory relation.
+This constructor is test/ABI support; it is absent from the emitted function. -/
+
+namespace Ix.Compiler.X86.RuntimeExecution
+
+open UniqueABI UniqueTarget UniqueExecution
+
+/-- Inspect the requested slot before reading counters from the recursive
+input. This avoids eager recomputation of every counter at every cell. -/
+def inputWordsStep (words : Words) (index : Nat) (tag head tail : Word) (slot : Nat) : Word :=
+  if slot == Field.peak.index then words Field.live.index + 1
+  else if slot == Field.live.index then words Field.live.index + 1
+  else if slot == Field.allocs.index then words Field.allocs.index + 1
+  else if slot == cellSlot index 3 then 0
+  else if slot == cellSlot index 2 then tail
+  else if slot == cellSlot index 1 then head
+  else if slot == cellSlot index 0 then tag
+  else if slot == Field.cursor.index then words Field.cursor.index + 32
+  else words slot
+
+theorem inputWordsStep_eq (words : Words) (index : Nat) (tag head tail : Word) :
+    inputWordsStep words index tag head tail = allocatedWords words index tag head tail := rfl
+
+def inputWords (layout : Layout) : List Word → Words
+  | [] => inputWordsStep (initialWords layout) 0 nilTag 0 0
+  | head :: tail => inputWordsStep (inputWords layout tail) (tail.length + 1) consTag head (layout.cell tail.length)
+
+theorem inputWords_valid (layout : Layout) (values : List Word) :
+    DownChain layout (inputWords layout values) values ∧
+      CountsAt layout (readyCounts (values.length + 1)) (inputWords layout values) := by
+  induction values with
+  | nil => exact ⟨allocatedWords_cell _ _ _ _ _, (CountsAt.initial layout).allocate 0 nilTag 0 0⟩
+  | cons head tail ih =>
+      refine ⟨⟨allocatedWords_cell _ _ _ _ _, ih.1.mono ?_⟩, ?_⟩
+      · intro index bound field fieldBound
+        exact allocatedWords_other (inputWords layout tail) (by omega) fieldBound _ _ _
+      · simpa [inputWords, inputWordsStep_eq, List.length_cons, Nat.add_assoc] using ih.2.allocate (tail.length + 1) consTag head (layout.cell tail.length)
+
+def inputMemory (layout : Layout) (values : List Word) (outside : Memory) : Memory :=
+  fillWords layout (inputWords layout values)
+    { outside with
+      readable := fun address => layout.allowed address || outside.readable address
+      writable := fun address => layout.allowed address || outside.writable address }
+    layout.slots
+
+theorem inputMemory_realizes (layout : Layout) (values : List Word) (outside : Memory) :
+    Realizes layout outside (inputWords layout values) (inputMemory layout values outside) := by
+  refine ⟨fun slot bound => fillWords_read _ _ _ (by omega) bound, ?_, ?_, ?_⟩
+  · intro slot bound
+    simp only [inputMemory, fillWords_readable]
+    apply Memory.rangeAllowed_of_forall
+    intro offset offsetBound
+    simp [layout.byteAllowed bound offsetBound]
+  · intro slot bound
+    simp only [inputMemory, fillWords_writable]
+    apply Memory.rangeAllowed_of_forall
+    intro offset offsetBound
+    simp [layout.byteAllowed bound offsetBound]
+  · intro address notAllowed
+    exact fillWords_frame _ _ _ (by omega) address notAllowed
+
+def inputState (layout : Layout) (values : List Word) (registers : Registers) : State :=
+  { registers := (registers.set .rdi layout.base).set .rsi (UInt64.ofNat values.length)
+    words := inputWords layout values }
+
+theorem inputState_valid (layout : Layout) (values : List Word) (registers : Registers) :
+    Input layout values (inputState layout values registers) :=
+  ⟨(inputWords_valid layout values).1, (inputWords_valid layout values).2, by simp [inputState], by simp [inputState]⟩
+
+def canonicalLayout (values : List Word) (bound : values.length ≤ maxLength) : Layout :=
+  { base := 0x1000
+    capacity := values.length + 2
+    capacityBound := Nat.add_le_add_right bound 2
+    aligned := by decide
+    nonzero := by decide
+    fits := by
+      change values.length ≤ 64 at bound
+      change 4096 + 80 + 32 * (values.length + 2) ≤ 18446744073709551616
+      omega }
+
+def downNodes (layout : Layout) : Nat → List Word
+  | 0 => [layout.cell 0]
+  | length + 1 => layout.cell (length + 1) :: downNodes layout length
+
+theorem downNodes_mem {layout : Layout} {length : Nat} {pointer : Word}
+    (member : pointer ∈ downNodes layout length) : ∃ index, index ≤ length ∧ pointer = layout.cell index := by
+  induction length with
+  | zero => exact ⟨0, by omega, by simpa [downNodes] using member⟩
+  | succ length ih =>
+      simp only [downNodes, List.mem_cons] at member
+      rcases member with same | member
+      · exact ⟨length + 1, by omega, same⟩
+      · obtain ⟨index, bound, same⟩ := ih member
+        exact ⟨index, by omega, same⟩
+
+theorem down_native {layout : Layout} {outside memory : Memory} {words : Words} {values : List Word}
+    (chain : DownChain layout words values) (represented : Realizes layout outside words memory)
+    (bound : values.length < layout.capacity) :
+    NativeList memory (values.map UInt64.toNat) (layout.cell values.length) (downNodes layout values.length) := by
+  induction values with
+  | nil =>
+      have atCell : 0 < layout.capacity := by simpa using bound
+      refine .nil ?_ ?_ ?_ ?_
+      · simpa using (represented.readCell atCell (by decide : 0 < cellWords)).trans chain.tagAt
+      · exact (represented.readCell atCell (by decide : 1 < cellWords)).trans chain.headAt
+      · exact (represented.readCell atCell (by decide : 2 < cellWords)).trans chain.tailAt
+      · exact (represented.readCell atCell (by decide : 3 < cellWords)).trans chain.padding
+  | cons head tail ih =>
+      have atCell : tail.length + 1 < layout.capacity := by simpa using bound
+      refine .cons ?_ ?_ ?_ ?_ (ih chain.2 (by omega)) ?_
+      · simpa using (represented.readCell atCell (by decide : 0 < cellWords)).trans chain.1.tagAt
+      · exact congrArg UInt64.toNat ((represented.readCell atCell (by decide : 1 < cellWords)).trans chain.1.headAt)
+      · exact (represented.readCell atCell (by decide : 2 < cellWords)).trans chain.1.tailAt
+      · exact (represented.readCell atCell (by decide : 3 < cellWords)).trans chain.1.padding
+      · intro member
+        obtain ⟨index, lower, equal⟩ := downNodes_mem member
+        have := cell_injective layout atCell (by omega) equal
+        omega
+
+/-- Every bounded runtime list has an admitted caller state, and the same
+emitted code executes and fully reclaims it. -/
+theorem canonical_executes (values : List Word) (bound : values.length ≤ maxLength) (registers : Registers)
+    (outside : Memory) (runtime : Runtime) :
+    ∃ returned returnedMemory reclaimed reclaimedMemory,
+      Execution (canonicalLayout values bound) values (inputState (canonicalLayout values bound) values registers)
+        (inputMemory (canonicalLayout values bound) values outside) outside runtime
+        returned returnedMemory reclaimed reclaimedMemory :=
+  executes _ values _ (inputState_valid _ values registers) (Nat.le_refl _) outside _ (inputMemory_realizes _ values outside) runtime
+
+end Ix.Compiler.X86.RuntimeExecution
diff --git a/Ix/Compiler/X86/RuntimeInspect.lean b/Ix/Compiler/X86/RuntimeInspect.lean
new file mode 100644
index 000000000..fdafa88d9
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeInspect.lean
@@ -0,0 +1,117 @@
+import Ix.Compiler.X86.RuntimeTarget
+
+/-! Read-only instruction traces preserve the exact byte memory. These
+corollaries expose the failure behavior of the runtime-input checks while
+remaining steps of the existing permissioned x86 evaluator. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI
+
+def readsOnly : Instr → Bool
+  | .mov .. | .lea .. | .alu .. | .load .. => true
+  | _ => false
+
+def keepsRegister (register : GPR) : Instr → Bool
+  | .mov _ destination _ | .lea destination _ | .alu _ _ destination _ | .load _ destination _ =>
+      destination != register
+  | .store .. => true
+  | _ => false
+
+theorem Effect.words_readOnly {layout : Layout} {instruction : Instr} {before after : State}
+    (effect : Effect layout instruction before after) (readonly : readsOnly instruction = true) :
+    after.words = before.words := by
+  cases effect <;> simp_all [readsOnly]
+
+theorem Effect.register_kept {layout : Layout} {instruction : Instr} {before after : State}
+    (effect : Effect layout instruction before after) (register : GPR)
+    (kept : keepsRegister register instruction = true) : after.registers register = before.registers register := by
+  cases effect <;> simp_all [keepsRegister, ne_comm]
+
+theorem Trace.words_readOnly {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (readonly : instructions.all readsOnly = true) :
+    after.words = before.words := by
+  induction trace with
+  | nil => rfl
+  | cons first rest ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at readonly
+      exact (ih readonly.2).trans (first.words_readOnly readonly.1)
+
+theorem Trace.register_kept {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (register : GPR)
+    (kept : instructions.all (keepsRegister register) = true) :
+    after.registers register = before.registers register := by
+  induction trace with
+  | nil => rfl
+  | cons first rest ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at kept
+      exact (ih kept.2).trans (first.register_kept register kept.1)
+
+theorem Trace.saved {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after)
+    (kept : ∀ register, Saved register = true → instructions.all (keepsRegister register) = true) :
+    PreservesSaved before after := fun register saved => trace.register_kept register (kept register saved)
+
+theorem Effect.sound_readOnly {layout : Layout} {instruction : Instr} {before after : State}
+    (effect : Effect layout instruction before after) (readonly : readsOnly instruction = true)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory) :
+    Straight.Effect instruction (before.core memory) (after.core memory) := by
+  cases effect with
+  | mov _ destination source =>
+      have effect := Straight.Effect.mov (before.core memory) destination source
+      rw [State.move_core] at effect
+      simpa [State.core, State.setReg, Core.setReg] using effect
+  | lea _ destination source =>
+      have effect := Straight.Effect.lea (before.core memory) destination source
+      rw [State.address_core] at effect
+      simpa [State.core, State.setReg, Core.setReg] using effect
+  | alu _ operation destination source =>
+      have effect := Straight.Effect.alu (before.core memory) operation destination source
+      rw [State.alu_core] at effect
+      simpa [State.core, State.setReg, Core.setReg, Core.readReg] using effect
+  | load _ destination source slot bound address =>
+      apply Straight.Effect.load (before.core memory) destination source (before.words slot)
+      · rw [State.address_core, address]; exact represented.readable slot bound
+      · rw [State.address_core, address]; exact represented.view slot bound
+  | store => contradiction
+
+theorem Trace.sound_readOnly {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (readonly : instructions.all readsOnly = true)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory) :
+    Straight.Sequence instructions (before.core memory) (after.core memory) := by
+  induction trace with
+  | nil => exact .nil _
+  | cons first rest ih =>
+      simp only [List.all_cons, Bool.and_eq_true] at readonly
+      exact .cons (first.sound_readOnly readonly.1 outside memory represented)
+        (ih readonly.2 ((first.words_readOnly readonly.1).symm ▸ represented))
+
+theorem Trace.branch_readOnly {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (readonly : instructions.all readsOnly = true)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (runtime : Runtime) (checked : Checked) (block yes no : BlockId)
+    (comparison : Compare) (condition : Condition)
+    (code : BlockCode checked block instructions (.branch comparison condition yes no)) (answer : Bool)
+    (holds : comparison.holds condition (after.core Memory.unmapped) = answer)
+    (valid : checked.program.hasBlock (if answer then yes else no) = true) :
+    Steps runtime checked (instructions.length + 1) (leaf (before.core memory) block 0)
+      (leaf (after.core memory) (if answer then yes else no) 0) := by
+  have first := (trace.sound_readOnly readonly outside memory represented).steps
+    runtime checked block 0 code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at first
+  exact first.append (Steps.single (code.branch runtime _ answer
+    ((after.compare_core memory comparison condition).trans holds) valid))
+
+theorem Trace.jump_readOnly {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (readonly : instructions.all readsOnly = true)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (runtime : Runtime) (checked : Checked) (block target : BlockId)
+    (code : BlockCode checked block instructions (.jump target)) (valid : checked.program.hasBlock target = true) :
+    Steps runtime checked (instructions.length + 1) (leaf (before.core memory) block 0)
+      (leaf (after.core memory) target 0) := by
+  have first := (trace.sound_readOnly readonly outside memory represented).steps
+    runtime checked block 0 code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at first
+  exact first.append (Steps.single (code.jump valid runtime _))
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/RuntimeReject.lean b/Ix/Compiler/X86/RuntimeReject.lean
new file mode 100644
index 000000000..5ebb95277
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeReject.lean
@@ -0,0 +1,113 @@
+import Ix.Compiler.X86.RuntimeInput
+
+/-! Explicit rejection results for the runtime ABI. The generic guard lemma
+preserves the exact memory, and the length/capacity corollaries start at the
+actual exported entry rather than assuming a program counter after checks. -/
+
+namespace Ix.Compiler.X86.RuntimeExecution
+
+open UniqueABI UniqueTarget UniqueExecution RuntimeTarget
+
+variable {foldCounters : Bool}
+
+def rejectedState (state : State) : State := state.setReg .rax 0
+
+theorem failureSteps (state : State) (memory : Memory) (runtime : Runtime) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 2 (leaf (state.core memory) 6 0)
+      (haltedLeaf ((rejectedState state).core memory) 6 1) := by
+  have sequence : Straight.Sequence [Instr.mov .w64 .rax (.imm 0)]
+      (state.core memory) ((rejectedState state).core memory) :=
+    .cons (Straight.Effect.mov (state.core memory) .rax (.imm 0)) (.nil _)
+  have code : BlockCode (RuntimeTarget.checked foldCounters) 6 [Instr.mov .w64 .rax (.imm 0)] .ret := ⟨rfl, by decide⟩
+  have first := sequence.steps runtime (RuntimeTarget.checked foldCounters) 6 0 code.segment (by decide)
+  exact first.append (Steps.single (code.ret runtime _))
+
+theorem guardRejectedSteps {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (readonly : instructions.all readsOnly = true)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (runtime : Runtime) (block next : BlockId) (left : GPR) (right : AluSource) (condition : Condition)
+    (code : BlockCode (RuntimeTarget.checked foldCounters) block instructions (.branch (wordCompare left right) condition next 6))
+    (fails : (wordCompare left right).holds condition (after.core Memory.unmapped) = false) :
+    Steps runtime (RuntimeTarget.checked foldCounters) (instructions.length + 3) (leaf (before.core memory) block 0)
+      (haltedLeaf ((rejectedState after).core memory) 6 1) := by
+  have guard := trace.branch_readOnly readonly outside memory represented runtime (RuntimeTarget.checked foldCounters) block next 6
+    (wordCompare left right) condition code false fails (hasBlock 6 (by decide))
+  have all := guard.append (failureSteps after memory runtime)
+  simpa [Nat.add_assoc] using all
+
+theorem lengthRejects (state : State) (memory : Memory) (runtime : Runtime)
+    (tooLong : ¬state.registers .rsi ≤ 64) :
+    runFrom runtime (RuntimeTarget.checked foldCounters) 3 (state.core memory) =
+        haltedLeaf ((rejectedState state).core memory) 6 1 ∧
+      PreservesSaved state (rejectedState state) := by
+  have code : BlockCode (RuntimeTarget.checked foldCounters) 0 [] (.branch (wordCompare .rsi (.imm 64)) .unsignedLe 1 6) := ⟨rfl, by decide⟩
+  have branch := code.branch runtime (state.core memory) false
+    (by simp [wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval, signExtend32, tooLong])
+    (hasBlock 6 (by decide))
+  have steps := (Steps.single branch).append (failureSteps state memory runtime)
+  exact ⟨steps.run_eq, PreservesSaved.setReg state .rax 0 rfl⟩
+
+theorem cursorPrefix (layout : Layout) (length : Nat) (state : State) (bounded : length ≤ 64)
+    (counts : CountsAt layout (readyCounts (length + 1)) state.words)
+    (context : state.registers .rdi = layout.base) (argument : state.registers .rsi = UInt64.ofNat length)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 10 (leaf (state.core memory) 0 0)
+      (leaf ((cursorState (alignmentState state)).core memory) 9 0) := by
+  have small : length < UInt64.size := by change length < 18446744073709551616; omega
+  let aligned := alignmentState state
+  have zero := guardSteps (foldCounters := foldCounters) (Trace.nil (layout := layout) state) rfl outside memory represented runtime 0 1
+    .rsi (.imm 64) .unsignedLe ⟨rfl, by decide⟩
+    (by simpa [wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval,
+      signExtend32, argument, UInt64.le_iff_toNat_le, UInt64.toNat_ofNat_of_lt' small] using bounded) (by decide)
+  have one := guardSteps (foldCounters := foldCounters) (alignmentTrace layout state) rfl outside memory represented runtime 1 7
+    .rax (.imm 0) .eq ⟨rfl, by decide⟩
+    (by simp [alignmentState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, signExtend32, context, and_seven, layout.aligned]) (by decide)
+  have seven := guardSteps (foldCounters := foldCounters) (Trace.nil (layout := layout) aligned) rfl outside memory represented runtime 7 8
+    .rdi (.imm 0) .ne ⟨rfl, by decide⟩
+    (by simp [aligned, alignmentState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, signExtend32, context, layout.nonzero]) (by decide)
+  have eight := guardSteps (foldCounters := foldCounters) (cursorTrace layout aligned (by simpa [aligned, alignmentState] using context)) rfl
+    outside memory represented runtime 8 9 .r11 (.reg .rax) .eq ⟨rfl, by decide⟩
+    (by simp [cursorState, aligned, alignmentState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, argument, byteCount_nat, Field.index, counts.cursor, readyCounts]) (by decide)
+  exact zero.append (one.append (seven.append eight))
+
+def capacityRejectedState (state : State) : State := rejectedState (capacityState (cursorState (alignmentState state)))
+
+theorem capacityRejects (layout : Layout) (length : Nat) (state : State) (bounded : length ≤ 64)
+    (insufficient : layout.capacity < length + 2)
+    (counts : CountsAt layout (readyCounts (length + 1)) state.words)
+    (context : state.registers .rdi = layout.base) (argument : state.registers .rsi = UInt64.ofNat length)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    runFrom runtime (RuntimeTarget.checked foldCounters) 15 (state.core memory) =
+        haltedLeaf ((capacityRejectedState state).core memory) 6 1 ∧
+      PreservesSaved state (capacityRejectedState state) := by
+  have capBound := layout.capacityBound
+  change layout.capacity ≤ 66 at capBound
+  have requiredSmall : cellBytes * (length + 2) < UInt64.size := by
+    change 32 * (length + 2) < 18446744073709551616
+    omega
+  have bytesSmall : cellBytes * layout.capacity < UInt64.size := by
+    change 32 * layout.capacity < 18446744073709551616
+    omega
+  have short : ¬UInt64.ofNat (cellBytes * (length + 2)) ≤ UInt64.ofNat (cellBytes * layout.capacity) := by
+    rw [UInt64.ofNat_le_iff_le requiredSmall bytesSmall]
+    change ¬32 * (length + 2) ≤ 32 * layout.capacity
+    omega
+  have required : UInt64.ofNat (cellBytes * (length + 1)) + 32 = UInt64.ofNat (cellBytes * (length + 2)) := by
+    simp [cellBytes, Nat.mul_add, UInt64.ofNat_add, UInt64.add_assoc]
+  have unavailable : ¬byteCount (UInt64.ofNat length) + 32 ≤ UInt64.ofNat (cellBytes * layout.capacity) := by
+    rw [byteCount_nat, required]
+    exact short
+  let prepared := cursorState (alignmentState state)
+  have validationPrefix := cursorPrefix (foldCounters := foldCounters) layout length state bounded counts context argument outside memory represented runtime
+  have failure := guardRejectedSteps (foldCounters := foldCounters) (capacityTrace layout prepared (by simpa [prepared, cursorState, alignmentState] using context))
+    rfl outside memory represented runtime 9 10 .rcx (.reg .r11) .unsignedGe ⟨rfl, by decide⟩
+    (by simpa [capacityState, prepared, cursorState, alignmentState, wordCompare, Compare.holds, Condition.holds,
+      Core.readReg, State.core, AluSource.eval, argument, Field.index, counts.capacity] using unavailable)
+  refine ⟨(validationPrefix.append failure).run_eq, ?_⟩
+  intro register saved
+  cases register <;> simp_all [Saved, capacityRejectedState, rejectedState, capacityState, cursorState, alignmentState]
+
+end Ix.Compiler.X86.RuntimeExecution
diff --git a/Ix/Compiler/X86/RuntimeScan.lean b/Ix/Compiler/X86/RuntimeScan.lean
new file mode 100644
index 000000000..7216e6ece
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeScan.lean
@@ -0,0 +1,237 @@
+import Ix.Compiler.X86.RuntimeHeader
+
+namespace Ix.Compiler.X86.RuntimeExecution
+
+open UniqueABI UniqueTarget UniqueExecution RuntimeTarget
+
+variable {foldCounters : Bool}
+
+theorem cell_successor (layout : Layout) (index : Nat) :
+    layout.cell index + 32 = layout.cell (index + 1) := by
+  simp [Layout.cell, Layout.address, cellSlot, headerWords, cellWords, Nat.mul_add,
+    UInt64.ofNat_add, UInt64.add_assoc]
+
+theorem down_nil {layout : Layout} {words : Words} {values : List Word} (chain : DownChain layout words values) :
+    CellAt words 0 nilTag 0 0 := by
+  induction values with
+  | nil => exact chain
+  | cons _ _ ih => exact ih chain.2
+
+structure LinkAt (layout : Layout) (words : Words) (index : Nat) : Prop where
+  tag : words (cellSlot index 0) = consTag
+  tail : words (cellSlot index 2) = layout.cell (index - 1)
+  padding : words (cellSlot index 3) = 0
+
+theorem down_link {layout : Layout} {words : Words} {values : List Word}
+    (chain : DownChain layout words values) (index : Nat) (positive : 0 < index) (bound : index ≤ values.length) :
+    LinkAt layout words index := by
+  induction values with
+  | nil => simp at bound; omega
+  | cons head tail ih =>
+      by_cases last : index = tail.length + 1
+      · subst index
+        exact ⟨chain.1.tagAt, by simpa using chain.1.tailAt, chain.1.padding⟩
+      · exact ih chain.2 (by simp only [List.length_cons] at bound; omega)
+
+def nilSetupState (layout : Layout) (state : State) : State :=
+  ((state.setReg .rdx (layout.cell 0)).setReg .r8 (layout.cell 1)).setReg .r9 (state.registers .rsi)
+
+def nilFieldsState (state : State) : State :=
+  let state := state.setReg .rcx 0
+  let state := state.setReg .r11 0
+  let state := state.setReg .rcx 0
+  let state := state.setReg .r11 0
+  let state := state.setReg .rcx 0
+  let state := state.setReg .r11 0
+  state.setReg .rcx 0
+
+def nilState (layout : Layout) (state : State) : State := nilFieldsState (nilSetupState layout state)
+
+theorem nilTrace (layout : Layout) (state : State) (context : state.registers .rdi = layout.base)
+    (bound : 1 < layout.capacity) (atNil : CellAt state.words 0 nilTag 0 0) :
+    Trace layout nilInstructions state (nilState layout state) := by
+  have setup : Trace layout
+      [Instr.lea .rdx (memoryOperand .rdi headerBytes), .lea .r8 (memoryOperand .rdx cellBytes),
+        .mov .w64 .r9 (.reg .rsi)] state (nilSetupState layout state) := by
+    refine .cons (.lea _ _ _) (.cons (.lea _ _ _) (.cons (.mov _ _ _) ?_))
+    have root : state.address (memoryOperand .rdi headerBytes) = layout.cell 0 := by
+      rw [operand_address _ _ _ (by decide), context]
+      simpa [headerBytes] using layout.allocate_address 0
+    simpa [nilSetupState, root, cellBytes, operand_address _ .rdx 32 (by decide), cell_successor] using
+      Trace.nil (layout := layout) (nilSetupState layout state)
+  let start := nilSetupState layout state
+  have fields : Trace layout
+      [Instr.load .w64 .rcx (memoryOperand .rdx 0), .load .w64 .r11 (memoryOperand .rdx 8),
+        .alu .or .w64 .rcx (.reg .r11), .load .w64 .r11 (memoryOperand .rdx 16),
+        .alu .or .w64 .rcx (.reg .r11), .load .w64 .r11 (memoryOperand .rdx 24),
+        .alu .or .w64 .rcx (.reg .r11)] start (nilFieldsState start) := by
+    refine .cons (loadField layout start .rdx .rcx 0 0 (by omega) (by decide) (by simp [start, nilSetupState])) ?_
+    refine .cons (loadField layout _ .rdx .r11 0 1 (by omega) (by decide) (by simp [start, nilSetupState])) ?_
+    refine .cons (.alu _ _ _ _) ?_
+    refine .cons (loadField layout _ .rdx .r11 0 2 (by omega) (by decide) (by simp [start, nilSetupState])) ?_
+    refine .cons (.alu _ _ _ _) ?_
+    refine .cons (loadField layout _ .rdx .r11 0 3 (by omega) (by decide) (by simp [start, nilSetupState])) ?_
+    refine .cons (.alu _ _ _ _) ?_
+    simpa [nilFieldsState, start, nilSetupState, AluOp.eval, atNil.tagAt, atNil.headAt, atNil.tailAt, atNil.padding,
+      nilTag] using Trace.nil (layout := layout) (nilFieldsState start)
+  exact setup.append fields
+
+theorem nilSteps (layout : Layout) (state : State) (context : state.registers .rdi = layout.base)
+    (bound : 1 < layout.capacity) (atNil : CellAt state.words 0 nilTag 0 0)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 11 (leaf (state.core memory) 20 0)
+      (leaf ((nilState layout state).core memory) 21 0) :=
+  guardSteps (foldCounters := foldCounters) (nilTrace layout state context bound atNil) rfl outside memory represented runtime 20 21
+    .rcx (.imm 0) .eq ⟨rfl, by decide⟩
+    (by simp [nilState, nilFieldsState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, signExtend32]) (by decide)
+
+def fieldState (state : State) (index field : Nat) : State := state.setReg .rcx (state.words (cellSlot index field))
+
+theorem fieldTrace (layout : Layout) (state : State) (index field : Nat)
+    (bound : index < layout.capacity) (fieldBound : field < cellWords) (pointer : state.registers .r8 = layout.cell index) :
+    Trace layout (fieldInstructions (8 * field)) state (fieldState state index field) :=
+  .cons (loadField layout state .r8 .rcx index field bound fieldBound pointer) (.nil _)
+
+def advanceState (state : State) : State :=
+  ((state.setReg .rdx (state.registers .r8)).setReg .r8 (state.registers .r8 + 32)).setReg .r9 (state.registers .r9 - 1)
+
+theorem advanceTrace (layout : Layout) (state : State) :
+    Trace layout advanceInstructions state (advanceState state) := by
+  refine .cons (.mov _ _ _) (.cons (.lea _ _ _) (.cons (.alu _ _ _ _) ?_))
+  simpa [advanceState, cellBytes, operand_address _ .r8 32 (by decide), AluOp.eval, signExtend32] using
+    Trace.nil (layout := layout) (advanceState state)
+
+def inspectedState (state : State) (index : Nat) : State :=
+  advanceState (fieldState (fieldState (fieldState state index 0) index 2) index 3)
+
+theorem inspectSteps (layout : Layout) (state : State) (index : Nat)
+    (bound : index + 1 < layout.capacity) (pointer : state.registers .r8 = layout.cell (index + 1))
+    (previous : state.registers .rdx = layout.cell index) (link : LinkAt layout state.words (index + 1))
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    Steps runtime (RuntimeTarget.checked foldCounters) 10 (leaf (state.core memory) 22 0)
+      (leaf ((inspectedState state (index + 1)).core memory) 21 0) := by
+  let tagged := fieldState state (index + 1) 0
+  let linked := fieldState tagged (index + 1) 2
+  let padded := fieldState linked (index + 1) 3
+  have tag := guardSteps (foldCounters := foldCounters) (fieldTrace layout state (index + 1) 0 bound (by decide) pointer) rfl outside memory represented
+    runtime 22 23 .rcx (.imm 1) .eq ⟨rfl, by decide⟩
+    (by simp [fieldState, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval,
+      signExtend32, link.tag, consTag]) (by decide)
+  have tail := guardSteps (foldCounters := foldCounters) (fieldTrace layout tagged (index + 1) 2 bound (by decide) (by simpa [tagged, fieldState] using pointer))
+    rfl outside memory represented runtime 23 24 .rcx (.reg .rdx) .eq ⟨rfl, by decide⟩
+    (by simp [fieldState, tagged, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval,
+      link.tail, previous]) (by decide)
+  have padding := guardSteps (foldCounters := foldCounters) (fieldTrace layout linked (index + 1) 3 bound (by decide)
+    (by simpa [linked, tagged, fieldState] using pointer)) rfl outside memory represented runtime 24 25 .rcx (.imm 0) .eq
+    ⟨rfl, by decide⟩ (by simp [fieldState, linked, tagged, wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      AluSource.eval, link.padding, signExtend32]) (by decide)
+  have advance := (advanceTrace layout padded).jump_readOnly rfl outside memory represented runtime (RuntimeTarget.checked foldCounters) 25 21
+    ⟨rfl, by decide⟩ (hasBlock 21 (by decide))
+  exact tag.append (tail.append (padding.append advance))
+
+theorem inspectedState_register (state : State) (index : Nat) (register : GPR)
+    (kept : register ∉ [.rcx, .rdx, .r8, .r9]) :
+    (inspectedState state index).registers register = state.registers register := by
+  cases register <;> simp_all [inspectedState, advanceState, fieldState]
+
+theorem inspectedState_saved (state : State) (index : Nat) : PreservesSaved state (inspectedState state index) := by
+  intro register saved
+  apply inspectedState_register
+  cases register <;> simp_all [Saved]
+
+structure Scanned (layout : Layout) (length : Nat) (before after : State) : Prop where
+  words : after.words = before.words
+  root : after.registers .rdx = layout.cell length
+  context : after.registers .rdi = before.registers .rdi
+  length : after.registers .rsi = before.registers .rsi
+  saved : PreservesSaved before after
+
+theorem scanSteps (layout : Layout) (values : List Word) (remaining index : Nat) (state : State)
+    (chain : DownChain layout state.words values) (capacity : values.length + 2 ≤ layout.capacity)
+    (position : index + remaining = values.length)
+    (previous : state.registers .rdx = layout.cell index)
+    (pointer : state.registers .r8 = layout.cell (index + 1))
+    (counter : state.registers .r9 = UInt64.ofNat remaining)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    ∃ after, Scanned layout values.length state after ∧
+      Steps runtime (RuntimeTarget.checked foldCounters) (11 * remaining + 1) (leaf (state.core memory) 21 0)
+        (leaf (after.core memory) 2 0) := by
+  induction remaining generalizing index state with
+  | zero =>
+      have dispatch := (Trace.nil (layout := layout) state).branch_readOnly rfl outside memory represented runtime
+        (RuntimeTarget.checked foldCounters) 21 2 22 (wordCompare .r9 (.imm 0)) .eq ⟨rfl, by decide⟩ true
+        (by simp [wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval, counter, signExtend32])
+        (hasBlock 2 (by decide))
+      exact ⟨state, ⟨rfl, by simpa [show index = values.length by omega] using previous, rfl, rfl, PreservesSaved.refl state⟩, dispatch⟩
+  | succ remaining ih =>
+      have countSmall : remaining + 1 < UInt64.size := by
+        have := layout.capacityBound
+        change layout.capacity ≤ 66 at this
+        change remaining + 1 < 18446744073709551616
+        omega
+      have nonzero : UInt64.ofNat (remaining + 1) ≠ 0 := by
+        intro equal
+        have natEqual := congrArg UInt64.toNat equal
+        rw [UInt64.toNat_ofNat_of_lt' countSmall] at natEqual
+        change remaining + 1 = 0 at natEqual
+        omega
+      have dispatch := (Trace.nil (layout := layout) state).branch_readOnly rfl outside memory represented runtime
+        (RuntimeTarget.checked foldCounters) 21 2 22 (wordCompare .r9 (.imm 0)) .eq ⟨rfl, by decide⟩ false
+        (by simpa [wordCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval,
+          counter, signExtend32] using nonzero) (hasBlock 22 (by decide))
+      have inspect := inspectSteps (foldCounters := foldCounters) layout state index (by omega) pointer previous
+        (down_link chain (index + 1) (by omega) (by omega)) outside memory represented runtime
+      let next := inspectedState state (index + 1)
+      obtain ⟨after, result, rest⟩ := ih (index + 1) next chain (by omega)
+        (by simpa [next, inspectedState, advanceState, fieldState] using pointer)
+        (by simp [next, inspectedState, advanceState, fieldState, pointer, cell_successor])
+        (by simp [next, inspectedState, advanceState, fieldState, counter, UInt64.ofNat_add]) represented
+      refine ⟨after, ⟨result.words, result.root, ?_, ?_, (inspectedState_saved state _).trans result.saved⟩, ?_⟩
+      · exact result.context.trans (inspectedState_register state _ .rdi (by decide))
+      · exact result.length.trans (inspectedState_register state _ .rsi (by decide))
+      · have all := dispatch.append (inspect.append rest)
+        simp only [List.length_nil, Nat.zero_add] at all
+        have cost : 1 + (10 + (11 * remaining + 1)) = 11 * (remaining + 1) + 1 := by omega
+        rw [cost] at all
+        exact all
+
+structure Prepared (layout : Layout) (values : List Word) (before after : State) : Prop where
+  words : after.words = before.words
+  root : after.registers .rdx = layout.cell values.length
+  context : after.registers .rdi = layout.base
+  saved : PreservesSaved before after
+
+theorem validationSteps (layout : Layout) (values : List Word) (state : State)
+    (input : Input layout values state) (capacity : values.length + 2 ≤ layout.capacity)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory) (runtime : Runtime) :
+    ∃ after, Prepared layout values state after ∧
+      Steps runtime (RuntimeTarget.checked foldCounters) (validationCost values.length) (leaf (state.core memory) 0 0)
+        (leaf (after.core memory) 2 0) := by
+  let described := descriptorState state
+  let start := nilState layout described
+  have headerRun := descriptorSteps (foldCounters := foldCounters) layout values.length state capacity input.counts input.context input.length
+    outside memory represented runtime
+  have describedContext : described.registers .rdi = layout.base :=
+    (descriptorState_register state .rdi (by decide)).trans input.context
+  have describedLength : described.registers .rsi = UInt64.ofNat values.length :=
+    (descriptorState_register state .rsi (by decide)).trans input.length
+  have nilRun := nilSteps (foldCounters := foldCounters) layout described describedContext (by omega) (down_nil input.chain) outside memory represented runtime
+  obtain ⟨after, result, scan⟩ := scanSteps (foldCounters := foldCounters) layout values values.length 0 start input.chain capacity (by omega)
+    (by simp [start, nilState, nilFieldsState, nilSetupState])
+    (by simp [start, nilState, nilFieldsState, nilSetupState])
+    (by simpa [start, nilState, nilFieldsState, nilSetupState] using describedLength)
+    outside memory represented runtime
+  have savedNil : PreservesSaved described start := by
+    intro register saved
+    cases register <;> simp_all [Saved, start, nilState, nilFieldsState, nilSetupState]
+  refine ⟨after, ⟨result.words, result.root, ?_, ((descriptorState_saved state).trans savedNil).trans result.saved⟩, ?_⟩
+  · exact result.context.trans (by simpa [start, nilState, nilFieldsState, nilSetupState] using describedContext)
+  · have all := headerRun.append (nilRun.append scan)
+    have cost : 33 + (11 + (11 * values.length + 1)) = validationCost values.length := by
+      simp only [validationCost]
+      omega
+    rw [cost] at all
+    exact all
+
+end Ix.Compiler.X86.RuntimeExecution
diff --git a/Ix/Compiler/X86/RuntimeTarget.lean b/Ix/Compiler/X86/RuntimeTarget.lean
new file mode 100644
index 000000000..1380658c0
--- /dev/null
+++ b/Ix/Compiler/X86/RuntimeTarget.lean
@@ -0,0 +1,122 @@
+import Ix.Compiler.X86.UniqueControl
+import Ix.Compiler.X86.UniqueCounterFold
+
+/-! One native reversal function for all admitted input lists. `rdi` points to
+the arena and `rsi` supplies the number of cons cells. Validation reads only
+the descriptor and canonical cells; it never follows an untrusted tail.
+Every rejection returns zero before the first write. -/
+
+namespace Ix.Compiler.X86.RuntimeTarget
+
+open UniqueABI UniqueTarget
+
+def policyTag (foldCounters : Bool := false) : String :=
+  if foldCounters then "unique-reverse-runtime-x86/2" else "unique-reverse-runtime-x86/1"
+def abiTag : String := "unique-list-runtime-arena/1"
+
+def wordCompare (left : GPR) (right : AluSource) : Compare := { width := .w64, left, right }
+def guard (instructions : List Instr) (left : GPR) (right : AluSource)
+    (condition : Condition) (next : BlockId) : Block :=
+  { instructions := instructions.toArray, terminator := .branch (wordCompare left right) condition next 6 }
+
+def alignmentInstructions : List Instr := [.mov .w64 .rax (.reg .rdi), .alu .and .w64 .rax (.imm 7)]
+
+def cursorInstructions : List Instr :=
+  [.lea .r10 (memoryOperand .rsi 1),
+   .lea .rax { index := some .r10, scale := .eight },
+   .lea .rax { index := some .rax, scale := .four },
+   .load .w64 .r11 (header .cursor)]
+
+def capacityInstructions : List Instr :=
+  [.load .w64 .rcx (header .capacity), .lea .r11 (memoryOperand .rax cellBytes)]
+
+def capacityAlignmentInstructions : List Instr :=
+  [.mov .w64 .r11 (.reg .rcx), .alu .and .w64 .r11 (.imm 31)]
+
+def headerInstructions (field : Field) : List Instr := [.load .w64 .r11 (header field)]
+
+def nilInstructions : List Instr :=
+  [.lea .rdx (memoryOperand .rdi headerBytes),
+   .lea .r8 (memoryOperand .rdx cellBytes), .mov .w64 .r9 (.reg .rsi),
+   .load .w64 .rcx (memoryOperand .rdx 0),
+   .load .w64 .r11 (memoryOperand .rdx 8), .alu .or .w64 .rcx (.reg .r11),
+   .load .w64 .r11 (memoryOperand .rdx 16), .alu .or .w64 .rcx (.reg .r11),
+   .load .w64 .r11 (memoryOperand .rdx 24), .alu .or .w64 .rcx (.reg .r11)]
+
+def fieldInstructions (offset : Nat) : List Instr := [.load .w64 .rcx (memoryOperand .r8 offset)]
+
+def advanceInstructions : List Instr :=
+  [.mov .w64 .rdx (.reg .r8), .lea .r8 (memoryOperand .r8 cellBytes), .alu .sub .w64 .r9 (.imm 1)]
+
+def loopInstructions (foldCounters : Bool) : List Instr :=
+  if foldCounters then UniqueCounterFold.instructions else consInstructions
+
+theorem loopTrace (foldCounters : Bool) (layout : Layout) (state : UniqueExecution.State) (index : Nat)
+    (indexBound : index < layout.capacity) (context : state.registers .rdi = layout.base)
+    (pointer : state.registers .rdx = layout.cell index) :
+    UniqueExecution.Trace layout (loopInstructions foldCounters) state (UniqueExecution.consState state index) := by
+  cases foldCounters
+  · exact UniqueExecution.consTrace layout state index indexBound context pointer
+  · exact UniqueCounterFold.trace layout state index indexBound context pointer
+
+def program (foldCounters : Bool := false) : Program :=
+  { entry := 0
+    blocks := #[
+      guard [] .rsi (.imm 64) .unsignedLe 1,
+      guard alignmentInstructions .rax (.imm 0) .eq 7,
+      { instructions := (allocate nilTag 0 (.imm 0) .rsi).toArray, terminator := .jump 3 },
+      { instructions := #[.load .w64 .rcx (memoryOperand .rdx 0)]
+        terminator := .branch (wordCompare .rcx (.imm 0)) .eq 4 5 },
+      { instructions := (releaseCell .rdx ++ [Instr.mov .w64 .rax (.reg .rsi)]).toArray, terminator := .ret },
+      { instructions := (loopInstructions foldCounters).toArray, terminator := .jump 3 },
+      { instructions := #[.mov .w64 .rax (.imm 0)], terminator := .ret },
+      guard [] .rdi (.imm 0) .ne 8,
+      guard cursorInstructions .r11 (.reg .rax) .eq 9,
+      guard capacityInstructions .rcx (.reg .r11) .unsignedGe 10,
+      guard [] .rcx (.imm 2112) .unsignedLe 11,
+      guard capacityAlignmentInstructions .r11 (.imm 0) .eq 12,
+      guard (headerInstructions .allocs) .r11 (.reg .r10) .eq 13,
+      guard (headerInstructions .frees) .r11 (.imm 0) .eq 14,
+      guard (headerInstructions .reuses) .r11 (.imm 0) .eq 15,
+      guard (headerInstructions .live) .r11 (.reg .r10) .eq 16,
+      guard (headerInstructions .peak) .r11 (.reg .r10) .eq 17,
+      guard (headerInstructions .rcops) .r11 (.imm 0) .eq 18,
+      guard (headerInstructions .payload) .r11 (.imm 0) .eq 19,
+      guard (headerInstructions .reservations) .r11 (.imm 0) .eq 20,
+      guard nilInstructions .rcx (.imm 0) .eq 21,
+      { instructions := #[], terminator := .branch (wordCompare .r9 (.imm 0)) .eq 2 22 },
+      guard (fieldInstructions 0) .rcx (.imm 1) .eq 23,
+      guard (fieldInstructions 16) .rcx (.reg .rdx) .eq 24,
+      guard (fieldInstructions 24) .rcx (.imm 0) .eq 25,
+      { instructions := advanceInstructions.toArray, terminator := .jump 21 }] }
+
+theorem wellFormed (foldCounters : Bool := false) : (program foldCounters).wellFormed = true := by
+  cases foldCounters <;>
+  simp [program, Program.wellFormed, Program.hasBlock, Block.offsetsFit, Block.targetsValid,
+    Instr.targetsValid, Terminator.targetsValid, guard, alignmentInstructions, cursorInstructions,
+    capacityInstructions, capacityAlignmentInstructions, headerInstructions, nilInstructions,
+    fieldInstructions, advanceInstructions, allocate, changeCounter, consInstructions, reserveCons,
+    reuseCons, releaseCell, loopInstructions, UniqueCounterFold.instructions]
+
+def checked (foldCounters : Bool := false) : Checked := ⟨program foldCounters, wellFormed foldCounters⟩
+
+theorem releaseWellFormed : UniqueTarget.releaseProgram.wellFormed = true := by
+  simp [UniqueTarget.releaseProgram, Program.wellFormed, Program.hasBlock, Block.offsetsFit, Block.targetsValid,
+    Instr.targetsValid, Terminator.targetsValid, releaseCell, changeCounter]
+
+def releaseChecked : Checked := ⟨UniqueTarget.releaseProgram, releaseWellFormed⟩
+
+theorem loopCode (foldCounters : Bool := false) :
+    UniqueExecution.LoopCode (checked foldCounters) (loopInstructions foldCounters) := by
+  cases foldCounters <;>
+  refine ⟨⟨rfl, by decide⟩, ⟨rfl, by decide⟩, ⟨rfl, by decide⟩, ?_, ?_, ?_⟩ <;> decide
+
+def validationCost (length : Nat) : Nat := 11 * length + 45
+def controlCost (length : Nat) (foldCounters : Bool := false) : Nat :=
+  if foldCounters then 30 * length + 82 else 42 * length + 82
+
+theorem controlCost_saving (length : Nat) : controlCost length true + 12 * length = controlCost length := by
+  simp [controlCost]
+  omega
+
+end Ix.Compiler.X86.RuntimeTarget
diff --git a/Ix/Compiler/X86/SafeControl.lean b/Ix/Compiler/X86/SafeControl.lean
new file mode 100644
index 000000000..a47a5194d
--- /dev/null
+++ b/Ix/Compiler/X86/SafeControl.lean
@@ -0,0 +1,54 @@
+import Ix.Compiler.X86.SafeSteps
+
+namespace Ix.Compiler.X86
+
+theorem BlockCode.hasBlock {checked : Checked} {block : BlockId} {instructions : List Instr}
+    {terminator : Terminator} (code : BlockCode checked block instructions terminator) :
+    checked.program.hasBlock block = true := by
+  have := Array.getElem?_eq_some_iff.mp code.found
+  exact decide_eq_true this.1
+
+theorem BlockCode.holeStep {checked : Checked} {block : BlockId} {instructions : List Instr}
+    {terminator : Terminator} (code : BlockCode checked block instructions terminator)
+    (core : Core) (returns : List ReturnFrame) (holes : Stream.Holes) :
+    Stream.holeStep checked.program (inFrame core block instructions.length returns) holes = holes := by
+  simp [Stream.holeStep, inFrame, UInt32.toNat_ofNat_of_lt' code.fits, code.found]
+
+theorem BlockCode.safe_jump {checked : Checked} {block target : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions (.jump target))
+    (valid : checked.program.hasBlock target = true)
+    (runtime : Runtime) (core : Core) (returns : List ReturnFrame) (holes : Stream.Holes) :
+    Stream.SafeSteps runtime checked 1 holes (inFrame core block instructions.length returns)
+      holes (inFrame core target 0 returns) := by
+  have safe : Stream.SafeAt checked.program holes (inFrame core block instructions.length returns) := by
+    simp [Stream.SafeAt, inFrame, UInt32.toNat_ofNat_of_lt' code.fits, code.found]
+  have one := Stream.SafeSteps.single safe (code.jump_inFrame valid runtime core returns)
+  simpa only [code.holeStep] using one
+
+theorem BlockCode.safe_branch {checked : Checked} {block yes no : BlockId} {instructions : List Instr}
+    {comparison : Compare} {condition : Condition}
+    (code : BlockCode checked block instructions (.branch comparison condition yes no))
+    (runtime : Runtime) (core : Core) (returns : List ReturnFrame) (holes : Stream.Holes) (answer : Bool)
+    (holds : comparison.holds condition core = answer)
+    (valid : checked.program.hasBlock (if answer then yes else no) = true) :
+    Stream.SafeSteps runtime checked 1 holes (inFrame core block instructions.length returns)
+      holes (inFrame core (if answer then yes else no) 0 returns) := by
+  have safe : Stream.SafeAt checked.program holes (inFrame core block instructions.length returns) := by
+    simp [Stream.SafeAt, inFrame, UInt32.toNat_ofNat_of_lt' code.fits, code.found]
+  have one := Stream.SafeSteps.single safe (code.branch_inFrame runtime core returns answer holds valid)
+  simpa only [code.holeStep] using one
+
+theorem BlockCode.safe_ret {checked : Checked} {block : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions .ret)
+    (runtime : Runtime) (core : Core) (frame : ReturnFrame) (returns : List ReturnFrame) (holes : Stream.Holes)
+    (stack : core.readReg .rsp = frame.returnSlot)
+    (readable : core.memory.read64? frame.returnSlot = .ok frame.continuation.encode)
+    (saved : core.calleeSavedMatch frame.calleeSaved = true) :
+    Stream.SafeSteps runtime checked 1 holes (inFrame core block instructions.length (frame :: returns))
+      holes { core := core.setReg .rsp (frame.returnSlot + 8), pc := frame.continuation, returns, status := .running } := by
+  have safe : Stream.SafeAt checked.program holes (inFrame core block instructions.length (frame :: returns)) := by
+    simpa [Stream.SafeAt, inFrame, UInt32.toNat_ofNat_of_lt' code.fits, code.found] using ⟨stack, readable, saved⟩
+  have one := Stream.SafeSteps.single safe (code.ret_inFrame runtime core frame returns stack readable saved)
+  simpa only [code.holeStep] using one
+
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/SafeSteps.lean b/Ix/Compiler/X86/SafeSteps.lean
new file mode 100644
index 000000000..a26132a12
--- /dev/null
+++ b/Ix/Compiler/X86/SafeSteps.lean
@@ -0,0 +1,69 @@
+import Ix.Compiler.X86.StreamTrace
+import Ix.Compiler.X86.FrameCalls
+
+namespace Ix.Compiler.X86.Stream
+
+/-- Composable checked steps with the return-slot mask at both ends. These
+steps imply the existing E2 safety predicate; no byte execution is assumed. -/
+inductive SafeSteps (runtime : Runtime) (checked : Checked) :
+    Nat → Holes → Machine → Holes → Machine → Prop where
+  | refl (holes : Holes) (machine : Machine) : SafeSteps runtime checked 0 holes machine holes machine
+  | cons {before middle after : Machine} {holes finalHoles : Holes} {count : Nat}
+      (safe : SafeAt checked.program holes before)
+      (first : step runtime checked before = middle)
+      (rest : SafeSteps runtime checked count (holeStep checked.program before holes) middle finalHoles after) :
+      SafeSteps runtime checked (count + 1) holes before finalHoles after
+
+theorem SafeSteps.steps {runtime : Runtime} {checked : Checked} {count : Nat}
+    {before after : Machine} {holes finalHoles : Holes}
+    (safe : SafeSteps runtime checked count holes before finalHoles after) :
+    Steps runtime checked count before after := by
+  induction safe with
+  | refl => exact .refl _
+  | cons _ first _ ih => exact .cons first ih
+
+theorem SafeSteps.safeTrace {runtime : Runtime} {checked : Checked} {count : Nat}
+    {before after : Machine} {holes finalHoles : Holes}
+    (safe : SafeSteps runtime checked count holes before finalHoles after) :
+    SafeTrace runtime checked count holes before := by
+  induction safe with
+  | refl => trivial
+  | @cons before middle after holes finalHoles count access first rest ih =>
+      simp only [SafeTrace, first]
+      refine ⟨access, ?_⟩
+      cases middle.status <;> simp_all
+
+theorem SafeSteps.append {runtime : Runtime} {checked : Checked} {first second : Nat}
+    {before middle after : Machine} {holes middleHoles finalHoles : Holes}
+    (left : SafeSteps runtime checked first holes before middleHoles middle)
+    (right : SafeSteps runtime checked second middleHoles middle finalHoles after) :
+    SafeSteps runtime checked (first + second) holes before finalHoles after := by
+  induction left with
+  | refl => simpa using right
+  | cons access one rest ih =>
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using SafeSteps.cons access one (ih right)
+
+theorem SafeSteps.single {runtime : Runtime} {checked : Checked}
+    {before after : Machine} {holes : Holes}
+    (safe : SafeAt checked.program holes before) (one : step runtime checked before = after) :
+    SafeSteps runtime checked 1 holes before (holeStep checked.program before holes) after :=
+  .cons safe one (.refl _ _)
+
+theorem safeAt_linear {program : Program} {machine : Machine} {holes : Holes}
+    {block : Block} {instruction : Instr}
+    (found : program.blocks[machine.pc.block.toNat]? = some block)
+    (located : block.instructions[machine.pc.offset.toNat]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true)
+    (access : OperationSafe holes machine.returns (Encode.instructionOperation instruction) machine.core) :
+    SafeAt program holes machine := by
+  cases instruction <;> simp_all [SafeAt, Encode.linearInstruction]
+
+theorem holeStep_linear {program : Program} {machine : Machine} {holes : Holes}
+    {block : Block} {instruction : Instr}
+    (found : program.blocks[machine.pc.block.toNat]? = some block)
+    (located : block.instructions[machine.pc.offset.toNat]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true) :
+    holeStep program machine holes = nextHoles holes (Encode.instructionOperation instruction) machine.core := by
+  cases instruction <;> simp_all [holeStep, Encode.linearInstruction]
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/SafeStepsObject.lean b/Ix/Compiler/X86/SafeStepsObject.lean
new file mode 100644
index 000000000..6ed8e9600
--- /dev/null
+++ b/Ix/Compiler/X86/SafeStepsObject.lean
@@ -0,0 +1,88 @@
+import Ix.Compiler.X86.SafeSteps
+import Ix.Compiler.X86.ObjectExecution
+
+namespace Ix.Compiler.X86.Stream
+
+theorem SafeSteps.finished {runtime : Runtime} {checked : Checked} {count : Nat}
+    {before after : Machine} {holes finalHoles : Holes}
+    (steps : SafeSteps runtime checked count holes before finalHoles after)
+    (finished : before.status ≠ .running)
+    (fixed : ∀ mask, holeStep checked.program before mask = mask) :
+    after = before ∧ finalHoles = holes := by
+  induction steps with
+  | refl => exact ⟨rfl, rfl⟩
+  | @cons before middle after holes finalHoles count access first rest ih =>
+      have same : middle = before := first.symm.trans (step_of_not_running _ _ _ finished)
+      have result := ih (by simpa only [same] using finished) (by simpa only [same] using fixed)
+      exact ⟨result.1.trans same, result.2.trans (fixed _)⟩
+
+/-- Preserve the exact final return-slot mask of a compositional trace. -/
+theorem SafeSteps.run_with_calls {runtime : Runtime} {checked : Checked} {count : Nat}
+    {machine after : Machine} {holes finalHoles : Holes}
+    (steps : SafeSteps runtime checked count holes machine finalHoles after)
+    {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (base : Word) (state : ByteEval.State)
+    (related : Related checked.program base holes machine state)
+    {result returnAddress : Word} (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ byteCount finalState, 0 < byteCount ∧ byteCount ≤ 3 * count ∧
+      ByteEval.run output.text base byteCount state = .ok finalState ∧ finalState.rip = returnAddress ∧
+      CoreRelated checked.program base finalHoles []
+        (after.core.setReg .rsp (after.core.readReg .rsp + 8)) finalState.core := by
+  induction steps generalizing state with
+  | refl => rw [related.running] at halted; contradiction
+  | @cons machine middle after holes finalHoles count access first rest ih =>
+      cases status : middle.status with
+      | running =>
+          obtain ⟨leading, next, positive, bound, run, nextRelated⟩ :=
+            safe_progress valid runtime machine base holes state related access (first ▸ status)
+          rw [first] at nextRelated
+          obtain ⟨trailing, finalState, trailingPositive, trailingBound, tailRun, returned, core⟩ := ih next nextRelated halted slot
+          refine ⟨leading + trailing, finalState, by omega, by omega, ?_, returned, core⟩
+          rw [byte_run_add, run]
+          exact tailRun
+      | trapped fault =>
+          have same := rest.steps.run_eq
+          rw [run_of_not_running _ _ _ _ (by simp [status])] at same
+          rw [← same, status] at halted
+          contradiction
+      | halted value =>
+          have middleHalted : (step runtime checked machine).status = .halted value := first ▸ status
+          obtain ⟨block, found, position, term, returns, coreEqual⟩ := halting_shape runtime machine related.running middleHalted
+          have absent : block.instructions[machine.pc.offset.toNat]? = none := by simp [position]
+          have fixedBefore : ∀ mask, holeStep checked.program machine mask = mask := by simp [holeStep, found, absent]
+          have pcSame : middle.pc = machine.pc := by
+            rw [← first, source_terminator runtime machine related.running found position]
+            simp [term, executeTerminator, returns]
+          have fixedMiddle : ∀ mask, holeStep checked.program middle mask = mask := by simp [holeStep, pcSame, found, absent]
+          obtain ⟨same, maskSame⟩ := rest.finished (by simp [status]) fixedMiddle
+          have maskSame : finalHoles = holes := maskSame.trans (fixedBefore holes)
+          obtain ⟨finalState, last, returned, core⟩ := final_ret valid runtime machine base holes state related access
+            middleHalted (by simpa [first, same] using slot)
+          refine ⟨1, finalState, by decide, by omega, by simp [ByteEval.run, last, bind, Except.bind], returned, ?_⟩
+          simpa only [first, same, maskSame] using core
+
+end Ix.Compiler.X86.Stream
+
+namespace Ix.Compiler.X86.ObjectEval
+
+theorem run_safeSteps {checked : Checked} {input : ELF.Input} {bytes : ByteArray}
+    (stream : Stream.Valid checked.program input.encoded) (object : ELF.Valid input bytes)
+    (entry : input.entryBlock = checked.program.entry)
+    {runtime : Runtime} {count : Nat} (base : Word) (core : Core) (flags : ByteEval.Flags)
+    {after : Machine} {holes : Stream.Holes} {result returnAddress : Word}
+    (steps : Stream.SafeSteps runtime checked count (fun _ => False) (Machine.initial checked core) holes after)
+    (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ byteCount finalState, 0 < byteCount ∧ byteCount ≤ 3 * count ∧
+      run bytes input.exportName base byteCount core flags = .ok finalState ∧ finalState.rip = returnAddress ∧
+      Stream.CoreRelated checked.program base holes []
+        (after.core.setReg .rsp (after.core.readReg .rsp + 8)) finalState.core := by
+  obtain ⟨byteCount, finalState, positive, bound, executed, returned, related⟩ :=
+    steps.run_with_calls stream base _ (Stream.initial_related checked base core flags) halted slot
+  have selected := object.entry
+  rw [entry, stream.entryOffset] at selected
+  refine ⟨byteCount, finalState, positive, bound, ?_, returned, related⟩
+  simp [run, object.text, selected, executed, Except.mapError]
+
+end Ix.Compiler.X86.ObjectEval
diff --git a/Ix/Compiler/X86/Scalar.lean b/Ix/Compiler/X86/Scalar.lean
new file mode 100644
index 000000000..89437467c
--- /dev/null
+++ b/Ix/Compiler/X86/Scalar.lean
@@ -0,0 +1,151 @@
+import Ix.Compiler.X86.ExactNat
+
+/-! The first compositional scalar fragment. Values are exact unsigned
+64-bit naturals. Local slots are immutable bindings; a let adds one slot.
+Branches return a value to the enclosing continuation, giving explicit
+joins. Calls have at most two scalar arguments and target earlier functions.
+The executable semantics reports arithmetic overflow without wrapping. -/
+
+namespace Ix.Compiler.X86.Scalar
+
+def maxLocals : Nat := 32
+def maxFunctions : Nat := 32
+def maxNodes : Nat := 4096
+
+inductive Atom where
+  | var (index : Nat)
+  | constant (value : Word)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Atom.eval (values : Array Word) : Atom → Option Word
+  | .var index => values[index]?
+  | .constant value => some value
+
+def Atom.valid (locals : Nat) : Atom → Bool
+  | .var index => index < locals
+  | .constant _ => true
+
+inductive Expr where
+  | atom (value : Atom)
+  | add (left right : Atom)
+  | sub (left right : Atom)
+  | letE (value body : Expr)
+  | branch (scrutinee : Atom) (zero successor : Expr)
+  | call (function : Nat) (arguments : Array Atom)
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Function where
+  parameters : Nat
+  body : Expr
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+structure Program where
+  functions : Array Function
+  entry : Nat
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Expr.nodes : Expr → Nat
+  | .letE value body => 1 + value.nodes + body.nodes
+  | .branch _ zero successor => 1 + zero.nodes + successor.nodes
+  | _ => 1
+
+def Expr.valid (functions : Array Function) (current : Nat) : Nat → Expr → Bool
+  | locals, .atom value => value.valid locals
+  | locals, .add left right | locals, .sub left right => left.valid locals && right.valid locals
+  | locals, .letE value body =>
+      locals < maxLocals && value.valid functions current locals && body.valid functions current (locals + 1)
+  | locals, .branch scrutinee zero successor =>
+      scrutinee.valid locals && zero.valid functions current locals && successor.valid functions current locals
+  | locals, .call function arguments =>
+      function < current && arguments.size ≤ 2 && arguments.all (·.valid locals) &&
+        match functions[function]? with
+        | some callee => arguments.size == callee.parameters
+        | none => false
+
+def Program.valid (program : Program) : Bool :=
+  program.entry < program.functions.size && program.functions.size ≤ maxFunctions &&
+    program.functions.toList.zipIdx.all fun (function, index) =>
+      function.parameters ≤ 2 && function.body.nodes ≤ maxNodes &&
+        function.body.valid program.functions index function.parameters
+
+structure Checked where
+  program : Program
+  valid : program.valid = true
+
+def check (program : Program) : Option Checked :=
+  if valid : program.valid = true then some ⟨program, valid⟩ else none
+
+inductive Error where
+  | fuel
+  | local
+  | function
+  | arity
+  | overflow
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr
+
+def atom (values : Array Word) (value : Atom) : Except Error Word :=
+  match value.eval values with
+  | some value => .ok value
+  | none => .error .local
+
+def evaluate (functions : Array Function) : Nat → Expr → Array Word → Except Error Word
+  | 0, _, _ => .error .fuel
+  | fuel + 1, expression, values => do
+      match expression with
+      | .atom value => atom values value
+      | .add left right =>
+          let left ← atom values left
+          let right ← atom values right
+          match ExactNat.add left right with
+          | some value => pure value
+          | none => throw .overflow
+      | .sub left right => return ExactNat.sub (← atom values left) (← atom values right)
+      | .letE value body =>
+          let value ← evaluate functions fuel value values
+          evaluate functions fuel body (values.push value)
+      | .branch scrutinee zero successor =>
+          if (← atom values scrutinee) == 0 then evaluate functions fuel zero values
+          else evaluate functions fuel successor values
+      | .call function arguments =>
+          let some callee := functions[function]? | throw .function
+          let supplied ← arguments.mapM (atom values)
+          if supplied.size != callee.parameters then throw .arity
+          evaluate functions fuel callee.body supplied
+
+/-- A finite semantic derivation is independent of interpreter fuel. In
+particular, a native proof consumes this compositional relation rather than
+an execution certificate specialized to one set of runtime arguments. -/
+inductive Evaluates (functions : Array Function) : Expr → Array Word → Option Word → Prop where
+  | atom {values : Array Word} {source : Atom} {value : Word}
+      (found : source.eval values = some value) : Evaluates functions (.atom source) values (some value)
+  | add {values : Array Word} {left right : Atom} {a b : Word}
+      (leftValue : left.eval values = some a) (rightValue : right.eval values = some b) :
+      Evaluates functions (.add left right) values (ExactNat.add a b)
+  | sub {values : Array Word} {left right : Atom} {a b : Word}
+      (leftValue : left.eval values = some a) (rightValue : right.eval values = some b) :
+      Evaluates functions (.sub left right) values (some (ExactNat.sub a b))
+  | letE {values : Array Word} {value body : Expr} {bound : Word} {result : Option Word}
+      (first : Evaluates functions value values (some bound))
+      (rest : Evaluates functions body (values.push bound) result) :
+      Evaluates functions (.letE value body) values result
+  | letOverflow {values : Array Word} {value body : Expr}
+      (first : Evaluates functions value values none) :
+      Evaluates functions (.letE value body) values none
+  | zero {values : Array Word} {scrutinee : Atom} {zero successor : Expr} {result : Option Word}
+      (scrutineeValue : scrutinee.eval values = some 0)
+      (taken : Evaluates functions zero values result) :
+      Evaluates functions (.branch scrutinee zero successor) values result
+  | successor {values : Array Word} {scrutinee : Atom} {zero successor : Expr}
+      {value : Word} {result : Option Word}
+      (scrutineeValue : scrutinee.eval values = some value) (positive : value ≠ 0)
+      (taken : Evaluates functions successor values result) :
+      Evaluates functions (.branch scrutinee zero successor) values result
+  | call {values supplied : Array Word} {function : Nat} {arguments : Array Atom}
+      {callee : Function} {result : Option Word}
+      (found : functions[function]? = some callee)
+      (argumentsAt : arguments.mapM (Atom.eval values) = some supplied)
+      (arity : supplied.size = callee.parameters)
+      (evaluated : Evaluates functions callee.body supplied result) :
+      Evaluates functions (.call function arguments) values result
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarApply.lean b/Ix/Compiler/X86/ScalarApply.lean
new file mode 100644
index 000000000..7c46def08
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarApply.lean
@@ -0,0 +1,140 @@
+import Ix.Compiler.IxIR2.Eval
+
+/-! The small closed application graph emitted by the validated scalar source.
+Selection recognizes this exact graph, including both addressed declarations;
+it does not prune declarations or rewrite the compiler artifact. -/
+
+namespace Ix.Compiler.X86.Select.ScalarApply
+
+open Ix.Compiler Ix.Compiler.IxIR2 Ix.Compiler.IxIR2.Eval
+open Ix.Compiler.Ixon (Address)
+
+def worker (word : UInt64) : Function :=
+  { signature := { params := #[{ world := .shared, passing := .owned }]
+                   result := .shared, papSafe := true }
+    blocks := #[{ valueParams := #[.owned .shared], creditParams := #[]
+                  instructions := #[.releaseShared (.reg 0)]
+                  terminator := .ret (.lit (.nat word.toNat)) }] }
+
+def entry (workerAddress : Address) : Function :=
+  { signature := { params := #[], result := .shared, papSafe := true }
+    blocks := #[{ valueParams := #[], creditParams := #[]
+                  instructions := #[.papp workerAddress #[], .apply (.reg 0) #[.erased]]
+                  terminator := .ret (.reg 1) }] }
+
+def program (word : UInt64) (workerAddress entryAddress : Address) : IxIR2.Program :=
+  { declarations := [(workerAddress, .fn (worker word)), (entryAddress, .fn (entry workerAddress))]
+    main := { signature := { params := #[], result := .shared, papSafe := false }
+              blocks := #[{ valueParams := #[], creditParams := #[], instructions := #[]
+                            terminator := .tailCall entryAddress #[] }] } }
+
+def context (word : UInt64) (workerAddress entryAddress : Address)
+    (schemas : Ixon.Owned → CtorId → Option CtorSchema := fun _ _ => none)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) : Context :=
+  Context.ofProgram (program word workerAddress entryAddress) schemas oracle
+
+def resultStore : Store :=
+  { heap := { nodes := #[none], allocs := 1, frees := 1, rcops := 1 }
+    peakLiveNodes := 1 }
+
+private def allocatedStore (workerAddress : Address) : Store :=
+  (({} : Store).allocNode .shared (.papN workerAddress 1 #[])).1
+
+private def caller (workerAddress : Address) : Frame :=
+  { definition := entry workerAddress, pc := 2, values := #[.loc 0] }
+
+private def machine (word : UInt64) (workerAddress entryAddress : Address)
+    (heapRemaining : Nat) : Nat → Machine
+  | 0 => initialMachine (program word workerAddress entryAddress).main #[] (heapRemaining + 2)
+  | 1 => { heapFuel := heapRemaining + 2, control := .running { definition := entry workerAddress } [] }
+  | 2 => { store := allocatedStore workerAddress, heapFuel := heapRemaining + 2
+           control := .running { definition := entry workerAddress, pc := 1, values := #[.loc 0] } [] }
+  | 3 => { store := resultStore, heapFuel := heapRemaining + 1
+           control := .running { definition := worker word, values := #[.erased] } [.resume (caller workerAddress)] }
+  | 4 => { store := resultStore, heapFuel := heapRemaining
+           control := .running { definition := worker word, pc := 1, values := #[.erased] } [.resume (caller workerAddress)] }
+  | 5 => { store := resultStore, heapFuel := heapRemaining
+           control := .running { definition := entry workerAddress, pc := 2
+                                 values := #[.loc 0, .lit (.nat word.toNat)] } [] }
+  | _ => { store := resultStore, heapFuel := heapRemaining, control := .halted (.lit (.nat word.toNat)) }
+
+/-- The actual compiler graph takes six control steps, allocating and
+reclaiming one PAP. The proof is uniform in the scalar and both addresses. -/
+theorem steps (word : UInt64) (workerAddress entryAddress : Address)
+    (distinct : workerAddress ≠ entryAddress) (interpretation : Interpretation)
+    (heapRemaining : Nat)
+    (schemas : Ixon.Owned → CtorId → Option CtorSchema := fun _ _ => none)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) :
+    Steps (context word workerAddress entryAddress schemas oracle) interpretation 6
+      (machine word workerAddress entryAddress heapRemaining 0)
+      (machine word workerAddress entryAddress heapRemaining 6) := by
+  have workerAt : (context word workerAddress entryAddress schemas oracle).declarations workerAddress =
+      some (.fn (worker word)) := by simp [context, Context.ofProgram, program]
+  have entryAt : (context word workerAddress entryAddress schemas oracle).declarations entryAddress =
+      some (.fn (entry workerAddress)) := by simp [context, Context.ofProgram, program, distinct]
+  have first : Step (context word workerAddress entryAddress schemas oracle) interpretation
+      (machine word workerAddress entryAddress heapRemaining 0)
+      (machine word workerAddress entryAddress heapRemaining 1) := by
+    apply StepCase.step
+    refine .terminator (block := (program word workerAddress entryAddress).main.blocks[0]'(by simp [program]))
+      rfl rfl rfl ?_
+    exact .tailCallFn (by simp [NoLiveCredits]) rfl entryAt rfl rfl
+  have second : Step (context word workerAddress entryAddress schemas oracle) interpretation
+      (machine word workerAddress entryAddress heapRemaining 1)
+      (machine word workerAddress entryAddress heapRemaining 2) := by
+    apply StepCase.step
+    refine .instruction (block := (entry workerAddress).blocks[0]'(by simp [entry])) rfl (by simp [entry]) rfl ?_
+    exact .pappFn (by simp [NoLiveCredits]) workerAt rfl rfl (by simp [worker])
+  have third : Step (context word workerAddress entryAddress schemas oracle) interpretation
+      (machine word workerAddress entryAddress heapRemaining 2)
+      (machine word workerAddress entryAddress heapRemaining 3) := by
+    apply StepCase.step
+    refine .instruction (block := (entry workerAddress).blocks[0]'(by simp [entry])) rfl (by simp [entry]) rfl ?_
+    refine .apply (by simp [NoLiveCredits]) rfl rfl ?_
+    have transfer := ApplyTransferCase.papFn
+      (context := context word workerAddress entryAddress schemas oracle) (interpretation := interpretation)
+      (store := allocatedStore workerAddress) (heapFuel := heapRemaining + 2)
+      (arguments := #[.erased]) (resume := caller workerAddress) (stack := [])
+      (location := 0) (box := { world := .shared, rc := 1, node := .papN workerAddress 1 #[] })
+      (captured := #[]) (retainedStore := allocatedStore workerAddress)
+      (releasedStore := resultStore) (outHeapFuel := heapRemaining + 1)
+      rfl rfl rfl (by decide) rfl rfl (by decide) workerAt rfl rfl rfl
+    exact transfer.transfer
+  have fourth : Step (context word workerAddress entryAddress schemas oracle) interpretation
+      (machine word workerAddress entryAddress heapRemaining 3)
+      (machine word workerAddress entryAddress heapRemaining 4) := by
+    apply StepCase.step
+    refine .instruction (block := (worker word).blocks[0]'(by simp [worker])) rfl (by simp [worker]) rfl ?_
+    exact .releaseShared rfl (by cases heapRemaining <;> rfl)
+  have fifth : Step (context word workerAddress entryAddress schemas oracle) interpretation
+      (machine word workerAddress entryAddress heapRemaining 4)
+      (machine word workerAddress entryAddress heapRemaining 5) := by
+    apply StepCase.step
+    refine .terminator (block := (worker word).blocks[0]'(by simp [worker])) rfl rfl rfl ?_
+    exact .retResume rfl (by simp [NoLiveCredits]) rfl
+  have sixth : Step (context word workerAddress entryAddress schemas oracle) interpretation
+      (machine word workerAddress entryAddress heapRemaining 5)
+      (machine word workerAddress entryAddress heapRemaining 6) := by
+    apply StepCase.step
+    refine .terminator (block := (entry workerAddress).blocks[0]'(by simp [entry])) rfl rfl rfl ?_
+    exact .retHalt rfl (by simp [NoLiveCredits]) rfl
+  exact .cons rfl first (.cons rfl second (.cons rfl third
+    (.cons rfl fourth (.cons rfl fifth (.cons rfl sixth (.refl _))))))
+
+theorem runs (word : UInt64) (workerAddress entryAddress : Address)
+    (distinct : workerAddress ≠ entryAddress) (interpretation : Interpretation)
+    (controlRemaining heapRemaining : Nat)
+    (schemas : Ixon.Owned → CtorId → Option CtorSchema := fun _ _ => none)
+    (oracle : Address → List RVal → Option RVal := fun _ _ => none) :
+    runMain (context word workerAddress entryAddress schemas oracle) interpretation
+      (program word workerAddress entryAddress) (6 + controlRemaining) (heapRemaining + 2) =
+      .ok { store := resultStore, value := .lit (.nat word.toNat)
+            controlRemaining, heapRemaining } := by
+  rw [runMain_eq_runMachine rfl rfl]
+  have run := (steps word workerAddress entryAddress distinct interpretation heapRemaining schemas oracle).runMachine
+    (controlFuel := controlRemaining)
+  change runMachine _ _ _ (machine word workerAddress entryAddress heapRemaining 0) = _
+  rw [run]
+  cases controlRemaining <;> rfl
+
+end Ix.Compiler.X86.Select.ScalarApply
diff --git a/Ix/Compiler/X86/ScalarArguments.lean b/Ix/Compiler/X86/ScalarArguments.lean
new file mode 100644
index 000000000..8f786cec3
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarArguments.lean
@@ -0,0 +1,68 @@
+import Ix.Compiler.X86.ScalarFunctions
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem array_le_two {α : Type} (array : Array α) (bound : array.size ≤ 2) :
+    array = #[] ∨ (∃ first, array = #[first]) ∨ (∃ first second, array = #[first, second]) := by
+  rcases array with ⟨list⟩
+  cases list with
+  | nil => exact .inl rfl
+  | cons first rest =>
+      cases rest with
+      | nil => exact .inr (.inl ⟨first, rfl⟩)
+      | cons second rest =>
+          cases rest with
+          | nil => exact .inr (.inr ⟨first, second, rfl⟩)
+          | cons third rest => simp at bound
+
+theorem mapped_arguments {values supplied : Array Word} {arguments : Array Atom}
+    (small : arguments.size ≤ 2) (mapped : arguments.mapM (Atom.eval values) = some supplied) :
+    supplied.size ≤ 2 ∧
+    (arguments[0]?.getD (Atom.constant 0)).eval values = some (supplied[0]?.getD 0) ∧
+    (arguments[1]?.getD (Atom.constant 0)).eval values = some (supplied[1]?.getD 0) := by
+  rcases array_le_two arguments small with rfl | ⟨first, rfl⟩ | ⟨first, second, rfl⟩
+  · simp [Array.mapM_eq_mapM_toList] at mapped
+    subst supplied
+    simp [Atom.eval]
+  · cases evaluated : first.eval values with
+    | none => simp [Array.mapM_eq_mapM_toList, evaluated] at mapped
+    | some value =>
+        simp [Array.mapM_eq_mapM_toList, evaluated] at mapped
+        subst supplied
+        simp [evaluated, show Atom.eval values (.constant 0) = some 0 from rfl]
+  · cases left : first.eval values with
+    | none => simp [Array.mapM_eq_mapM_toList, left] at mapped
+    | some a =>
+        cases right : second.eval values with
+        | none => simp [Array.mapM_eq_mapM_toList, left, right] at mapped
+        | some b =>
+            simp [Array.mapM_eq_mapM_toList, left, right] at mapped
+            subst supplied
+            simp [left, right]
+
+def argumentsState (state : State) (supplied : Array Word) : State :=
+  (state.setReg .rdi (supplied[0]?.getD 0)).setReg .rsi (supplied[1]?.getD 0)
+
+theorem arguments_preserves {layout : Layout} (frame : Frame layout) (locals : Nat) (state : State) (supplied : Array Word) :
+    Preserves frame locals state (argumentsState state supplied) :=
+  (Preserves.setReg _ _ _ _ _ (by simp)).trans (Preserves.setReg _ _ _ _ _ (by simp))
+
+theorem arguments_ready (state : State) (supplied : Array Word) (small : supplied.size ≤ 2) :
+    ArgumentsAt supplied (argumentsState state supplied) := by
+  refine ⟨small, fun index bound => ?_⟩
+  have alternatives : index = 0 ∨ index = 1 := by omega
+  rcases alternatives with rfl | rfl <;> simp [argumentsState, Array.getElem?_eq_getElem bound]
+
+theorem arguments_safeTrace {layout : Layout} {frame : Frame layout} {values supplied : Array Word}
+    {state : State} {returns : List ReturnFrame} {rootTop : Nat} {holes : Stream.Holes} {arguments : Array Atom}
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state) (valid : HolesIn layout rootTop holes)
+    (small : arguments.size ≤ 2) (mapped : arguments.mapM (Atom.eval values) = some supplied) :
+    SafeTrace layout returns [load .rdi (arguments[0]?.getD (.constant 0)), load .rsi (arguments[1]?.getD (.constant 0))]
+      state holes (argumentsState state supplied) holes := by
+  have found := mapped_arguments small mapped
+  have preserved := Preserves.setReg frame values.size state .rdi (supplied[0]?.getD 0) (by simp)
+  exact (load_safeTrace framed valuesAt valid .rdi found.2.1).append
+    (load_safeTrace (preserved.1.framed framed) (preserved.values valuesAt) valid .rsi found.2.2)
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarBind.lean b/Ix/Compiler/X86/ScalarBind.lean
new file mode 100644
index 000000000..6e4ec7ec8
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarBind.lean
@@ -0,0 +1,62 @@
+import Ix.Compiler.X86.ScalarObject
+
+namespace Ix.Compiler.X86.Scalar
+
+/-- Existing scalar derivations survive extension of the function table. -/
+theorem Evaluates.withFunctions {functions extended : Array Function} {expression values result}
+    (evaluated : Evaluates functions expression values result)
+    (preserved : ∀ (index : Nat) (function : Function), functions[index]? = some function → extended[index]? = some function) :
+    Evaluates extended expression values result := by
+  induction evaluated with
+  | atom found => exact .atom found
+  | add left right => exact .add left right
+  | sub left right => exact .sub left right
+  | letE _ _ first rest => exact .letE first rest
+  | letOverflow _ first => exact .letOverflow first
+  | zero found _ taken => exact .zero found taken
+  | successor found positive _ taken => exact .successor found positive taken
+  | call found arguments arity _ called => exact .call (preserved _ _ found) arguments arity called
+
+def bindFunction (entry : Nat) (captured : Word) : Function :=
+  { parameters := 1, body := .call entry #[.constant captured, .var 0] }
+
+def bindProgram (source : Program) (captured : Word) : Program :=
+  { functions := source.functions.push (bindFunction source.entry captured), entry := source.functions.size }
+
+/-- A checked unary ABI wrapper binds the first parameter of the original
+binary entry. The original functions and their call indices are retained. -/
+structure Bound (source : Checked) (captured : Word) where
+  function : Function
+  found : source.program.functions[source.program.entry]? = some function
+  binary : function.parameters = 2
+  checked : Checked
+  same : checked.program = bindProgram source.program captured
+
+def bind (source : Checked) (captured : Word) : Except String (Bound source captured) := do
+  match found : source.program.functions[source.program.entry]? with
+  | none => throw "captured scalar source entry is missing"
+  | some function =>
+      if binary : function.parameters = 2 then
+        if valid : (bindProgram source.program captured).valid = true then
+          return { function, found, binary, checked := ⟨bindProgram source.program captured, valid⟩, same := rfl }
+        else throw "captured scalar wrapper exceeds the scalar function or code limits"
+      else throw "captured scalar source entry must have two parameters"
+
+theorem Bound.preserves {source captured} (bound : Bound source captured)
+    {index : Nat} {function : Function} (found : source.program.functions[index]? = some function) :
+    bound.checked.program.functions[index]? = some function := by
+  have small := (Array.getElem?_eq_some_iff.mp found).1
+  simpa [bound.same, bindProgram, Array.getElem?_push, small, Nat.ne_of_lt small] using found
+
+theorem Bound.entry {source captured} (bound : Bound source captured) :
+    bound.checked.program.functions[bound.checked.program.entry]? = some (bindFunction source.program.entry captured) := by
+  simp [bound.same, bindProgram]
+
+theorem Bound.evaluates {source captured} (bound : Bound source captured) (argument : Word) {result}
+    (evaluated : Evaluates source.program.functions bound.function.body #[captured, argument] result) :
+    Evaluates bound.checked.program.functions (bindFunction source.program.entry captured).body #[argument] result := by
+  exact .call (supplied := #[captured, argument]) (bound.preserves bound.found)
+    (by simp [Array.mapM_eq_mapM_toList, Atom.eval]) (by simp [bound.binary])
+    (evaluated.withFunctions (fun _ _ found => bound.preserves found))
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarCalls.lean b/Ix/Compiler/X86/ScalarCalls.lean
new file mode 100644
index 000000000..36fe5ceae
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarCalls.lean
@@ -0,0 +1,129 @@
+import Ix.Compiler.X86.ScalarArguments
+import Ix.Compiler.X86.WordRegionSafeCalls
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem Frame.child_address {layout : Layout} (frame : Frame layout) (enough : 67 ≤ frame.top) :
+    layout.address frame.stackIndex - 8 = layout.address (frame.child enough).top := by
+  have shifted := layout.subtract (slot := frame.stackIndex) (count := 1) (by simp [Frame.stackIndex]; omega)
+  simpa [Frame.stackIndex, Frame.child, frameStride, Nat.sub_sub] using shifted
+
+theorem FramesAbove.child {layout : Layout} {frame : Frame layout} {returns : List ReturnFrame}
+    (frames : FramesAbove layout frame.top returns) (enough : 67 ≤ frame.top)
+    (newFrame : ReturnFrame) (address : newFrame.returnSlot = layout.address (frame.child enough).top) :
+    FramesAbove layout (frame.child enough).top (newFrame :: returns) := by
+  intro active member
+  rcases List.mem_cons.mp member with rfl | old
+  · exact ⟨_, (frame.child enough).bound, Nat.le_refl _, address⟩
+  · obtain ⟨index, bound, above, location⟩ := frames active old
+    exact ⟨index, bound, by simp only [Frame.child, frameStride]; omega, location⟩
+
+theorem call_preserves {layout : Layout} (frame : Frame layout) (enough : 67 ≤ frame.top)
+    {locals : Nat} (small : locals ≤ maxLocals) (before after : State) (block : BlockId)
+    (stable : Stable (before.call layout (frame.child enough).top block 2) after)
+    (words : ∀ index, (frame.child enough).top ≤ index →
+      after.words index = (before.call layout (frame.child enough).top block 2).words index) :
+    Preserves frame locals before (after.setReg .rsp (before.registers .rsp)) := by
+  refine ⟨?_, ?_⟩
+  · intro register saved
+    have same := stable register saved
+    cases register <;> simp_all [State.call]
+  · intro index above
+    have high : (frame.child enough).top < index := by
+      simp only [Frame.child, frameStride, maxLocals] at *
+      omega
+    simpa [State.call, Words.set, Nat.ne_of_gt high] using words index (Nat.le_of_lt high)
+
+theorem failed_holds (state : State) (result : Option Word) (memory : Memory)
+    (tag : state.registers .rdx = returnTag result) :
+    failedCompare.holds .ne (state.core memory) = result.isNone := by
+  cases result <;> simp [failedCompare, Compare.holds, Condition.holds, State.core, Core.readReg,
+    AluSource.eval, signExtend32, tag, returnTag]
+
+theorem call_contract {checked : X86.Checked} {entries : Array BlockId} {source : Function} {calleePlan : FunctionPlan}
+    {layout : Layout} {frame : Frame layout} {values supplied : Array Word} {rootTop : Nat} {returns : List ReturnFrame}
+    {entry success failure : BlockId} {function : Nat} {arguments : Array Atom} {result : Option Word}
+    (enough : 67 ≤ frame.top) (below : frame.top ≤ rootTop)
+    (small : arguments.size ≤ 2) (mapped : arguments.mapM (Atom.eval values) = some supplied)
+    (code : BlockCode checked entry (callInstructions calleePlan.entry arguments) (.branch failedCompare .ne failure success))
+    (calleeCode : FunctionCode checked entries source calleePlan)
+    (successValid : checked.program.hasBlock success = true) (failureValid : checked.program.hasBlock failure = true)
+    (callee : ∀ activeReturns, FunctionContract checked calleePlan layout (frame.child enough) supplied rootTop activeReturns result) :
+    ExprContract checked (.call entry function arguments) success failure layout frame values rootTop returns result := by
+  intro outside memory state holes framed valuesAt safeHoles frames represented
+  have argumentTrace := arguments_safeTrace framed valuesAt safeHoles small mapped (returns := returns)
+  have argumentSegment : Straight.Segment checked entry 0
+      [load .rdi (arguments[0]?.getD (.constant 0)), load .rsi (arguments[1]?.getD (.constant 0))] := by
+    refine ⟨_, code.found, ?_⟩
+    intro index bound
+    have alternatives : index = 0 ∨ index = 1 := by simp only [List.length_cons, List.length_nil] at bound; omega
+    rcases alternatives with rfl | rfl <;> rfl
+  obtain ⟨argumentMemory, argumentView, argumentSteps⟩ := argumentTrace.steps outside memory represented
+    Runtime.rejecting checked entry 0 argumentSegment (by change 2 < UInt32.size; decide)
+  let ready := argumentsState state supplied
+  have readyPreserved : Preserves frame values.size state ready := arguments_preserves frame values.size state supplied
+  have readyFramed := readyPreserved.1.framed framed
+  have address : ready.registers .rsp - 8 = layout.address (frame.child enough).top :=
+    readyFramed.2 ▸ frame.child_address enough
+  have callSegment : Straight.Segment checked entry 2 [.call calleePlan.entry] :=
+    Straight.Segment.tail (Straight.Segment.tail code.segment)
+  have disjoint := frames.disjoint (frame.child enough).bound (by simp only [Frame.child, frameStride]; omega)
+  obtain ⟨callMemory, callView, callSteps⟩ := call_safeStep argumentView (frame.child enough).bound address callSegment
+    (by decide) calleeCode.prologue.hasBlock (readyFramed.2 ▸ frame.call_aligned) disjoint (holes := holes)
+  let active := callFrame (ready.core argumentMemory) entry 2
+  have activeSlot : active.returnSlot = layout.address (frame.child enough).top := address
+  have activeFrames := frames.child enough active activeSlot
+  have hidden := safeHoles.add_return (frame.child enough).bound
+    (by simp only [Frame.child, frameStride]; omega) (frame.child enough).partition
+  have readyArguments := arguments_ready state supplied (mapped_arguments small mapped).1
+  obtain ⟨executed⟩ := callee (active :: returns) outside callMemory (ready.call layout (frame.child enough).top entry 2)
+    _ (by simpa [ArgumentsAt, State.call] using readyArguments) (by simp [State.call]) hidden activeFrames callView
+  have stack : (executed.after.core executed.memory).readReg .rsp = active.returnSlot := by
+    change executed.after.registers .rsp = active.returnSlot
+    rw [executed.stable .rsp (by simp), activeSlot]
+    simp [State.call]
+  have readable : executed.memory.read64? active.returnSlot = .ok active.continuation.encode := by
+    rw [activeSlot]
+    simp only [Memory.read64?, Memory.read?, Width.bytes, executed.represented.readable _ (frame.child enough).bound,
+      ↓reduceIte, Except.ok.injEq]
+    change executed.memory.read64 (layout.address (frame.child enough).top) = active.continuation.encode
+    rw [executed.represented.view _ (frame.child enough).bound, executed.preserved _ (Nat.le_refl _)]
+    simp [State.call, active, callFrame]
+  have saved : (executed.after.core executed.memory).calleeSavedMatch active.calleeSaved = true := by
+    simp only [Core.calleeSavedMatch, beq_iff_eq]
+    rw [executed.stable.snapshot callMemory executed.memory]
+    simp [active, callFrame, Core.calleeSavedSnapshot, SysV.calleeSaved, State.call,
+      State.core, Core.readReg, State.setReg, State.setWord, Registers.set]
+  have exitCode := calleeCode.exit result
+  have retSteps := exitCode.safe_ret Runtime.rejecting (executed.after.core executed.memory) active returns executed.holes stack readable saved
+  let resumed := executed.after.setReg .rsp (ready.registers .rsp)
+  have returnAddress : active.returnSlot + 8 = ready.registers .rsp := by
+    change (ready.registers .rsp - 8) + 8 = ready.registers .rsp
+    exact UInt64.sub_add_cancel _ _
+  have retEffect :
+      { core := (executed.after.core executed.memory).setReg .rsp (active.returnSlot + 8),
+        pc := active.continuation, returns, status := Status.running } =
+      inFrame (resumed.core executed.memory) entry 3 returns := by
+    rw [returnAddress]
+    rfl
+  rw [retEffect] at retSteps
+  have resumedPreserved := call_preserves frame enough valuesAt.1 ready executed.after entry executed.stable executed.preserved
+  have resumedTag : resumed.registers .rdx = returnTag result := by simpa [resumed] using executed.resultTag
+  have branchSteps := code.safe_branch Runtime.rejecting (resumed.core executed.memory) returns executed.holes result.isNone
+    (failed_holds resumed result executed.memory resumedTag) (by cases result <;> assumption)
+  have label : (if result.isNone then failure else success) = destination success failure result := by cases result <;> rfl
+  rw [label] at branchSteps
+  refine ⟨{
+    count := 2 + 1 + executed.count + 1 + 1, after := resumed, memory := executed.memory, holes := executed.holes
+    represented := executed.represented, safeHoles := executed.safeHoles
+    preserved := readyPreserved.trans resumedPreserved
+    resultAt := ?_, steps := ?_ }⟩
+  · intro value same
+    simpa [resumed, same] using executed.resultValue
+  · have offset : (tagInstructions result ++ epilogue).length = returnOffset result := by cases result <;> rfl
+    rw [offset] at retSteps
+    simpa only [callInstructions, List.length_cons, List.length_nil, Nat.zero_add, Plan.entry] using
+      (((argumentSteps.append callSteps).append executed.steps).append retSteps).append branchSteps
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarCapacity.lean b/Ix/Compiler/X86/ScalarCapacity.lean
new file mode 100644
index 000000000..2e6a0aa80
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarCapacity.lean
@@ -0,0 +1,60 @@
+import Ix.Compiler.X86.ScalarTotal
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+/-- A caller-provided finite stack reservation. It includes the external
+return slot. No initial contents of local or saved-base slots are required. -/
+structure Stack where
+  base : Word
+  depth : Nat
+  positive : 0 < depth
+  aligned : base % 16 = 0
+  fits : base.toNat + 272 * depth ≤ UInt64.size
+
+def Stack.layout (stack : Stack) : Layout where
+  base := stack.base
+  slots := frameStride * stack.depth
+  aligned := by
+    apply UInt64.toNat_inj.mp
+    have aligned := congrArg UInt64.toNat stack.aligned
+    simp only [UInt64.toNat_mod] at aligned ⊢
+    change stack.base.toNat % 16 = 0 at aligned
+    change stack.base.toNat % 8 = 0
+    omega
+  fits := by simpa only [frameStride, ← Nat.mul_assoc] using stack.fits
+
+def Stack.frame (stack : Stack) : Frame stack.layout where
+  top := frameStride * stack.depth - 1
+  enough := by have := stack.positive; simp only [frameStride]; omega
+  bound := by have := stack.positive; simp only [Stack.layout, frameStride]; omega
+  aligned := by
+    simp only [SysV.functionEntryAligned, beq_iff_eq]
+    apply UInt64.toNat_inj.mp
+    simp only [UInt64.toNat_mod]
+    change (stack.layout.address (frameStride * stack.depth - 1)).toNat % 16 = 8
+    rw [stack.layout.address_toNat (by have := stack.positive; simp only [Stack.layout, frameStride]; omega)]
+    have aligned := congrArg UInt64.toNat stack.aligned
+    simp only [UInt64.toNat_mod] at aligned
+    change stack.base.toNat % 16 = 0 at aligned
+    have := stack.positive
+    simp only [Stack.layout, frameStride]
+    omega
+  partition := by simp only [frameStride]; have := stack.positive; omega
+
+theorem Stack.bytes (stack : Stack) : 8 * stack.layout.slots = 272 * stack.depth := by
+  simp [Stack.layout, frameStride, ← Nat.mul_assoc]
+
+theorem Stack.below_entry (stack : Stack) :
+    (stack.layout.address stack.frame.top).toNat - stack.base.toNat = 272 * stack.depth - 8 := by
+  rw [stack.layout.address_toNat stack.frame.bound]
+  have := stack.positive
+  simp only [Stack.layout, Stack.frame, frameStride]
+  omega
+
+theorem Stack.rank_capacity (stack : Stack) {index : Nat} (depth : index < stack.depth) :
+    frameStride * (index + 1) - 1 ≤ stack.frame.top := by
+  simp only [Stack.frame, frameStride]
+  omega
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarComposition.lean b/Ix/Compiler/X86/ScalarComposition.lean
new file mode 100644
index 000000000..03be564da
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarComposition.lean
@@ -0,0 +1,96 @@
+import Ix.Compiler.X86.ScalarPrimitives
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem Plan.entry_valid {checked : X86.Checked} {entries : Array BlockId} {plan : Plan}
+    {locals : Nat} {success failure : BlockId}
+    (matched : plan.matches checked.program entries locals success failure = true) :
+    checked.program.hasBlock plan.entry = true := by
+  induction plan generalizing locals success failure with
+  | atom entry value => exact (blockMatches_code matched).hasBlock
+  | add entry left right => exact (blockMatches_code matched).hasBlock
+  | sub entry underflow ordinary left right =>
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact (blockMatches_code matched.1.1).hasBlock
+  | letE join value body ihValue ihBody =>
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact ihValue matched.1.2
+  | branch entry scrutinee zero successor ihZero ihSuccessor =>
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact (blockMatches_code matched.1.1).hasBlock
+  | call entry function arguments =>
+      simp only [Plan.matches] at matched
+      split at matched
+      · contradiction
+      · exact (blockMatches_code matched).hasBlock
+
+theorem let_contract {checked : X86.Checked} {layout : Layout} {frame : Frame layout}
+    {values : Array Word} {rootTop : Nat} {returns : List ReturnFrame}
+    {join success failure : BlockId} {value body : Plan} {bound : Word} {result : Option Word}
+    (small : values.size < maxLocals)
+    (code : BlockCode checked join [.spill (slot values.size) .rax] (.jump body.entry))
+    (bodyValid : checked.program.hasBlock body.entry = true)
+    (first : ExprContract checked value join failure layout frame values rootTop returns (some bound))
+    (rest : ExprContract checked body success failure layout frame (values.push bound) rootTop returns result) :
+    ExprContract checked (.letE join value body) success failure layout frame values rootTop returns result := by
+  intro outside memory state holes framed valuesAt safeHoles frames represented
+  obtain ⟨leading⟩ := first outside memory state holes framed valuesAt safeHoles frames represented
+  have middleFramed := leading.preserved.1.framed framed
+  have middleValues := leading.preserved.values valuesAt
+  have stored : SafeTrace layout returns [.spill (slot values.size) .rax] leading.after leading.holes
+      (leading.after.setWord (frame.localIndex values.size) bound)
+      (Stream.clearRange leading.holes (layout.address (frame.localIndex values.size)) 8) := by
+    simpa only [leading.resultAt bound rfl] using SafeTrace.spill layout returns leading.after leading.holes
+      (slot values.size) .rax (frame.localIndex values.size) (frame.local_bound values.size)
+      (by rw [middleFramed.1]; exact frame.local_address small) (frame.local_disjoint frames values.size)
+  obtain ⟨joinMemory, joinView, joinSteps⟩ := stored.jump outside leading.memory leading.represented checked join body.entry code bodyValid
+  obtain ⟨trailing⟩ := rest outside joinMemory _ _ ((Stable.setWord _ _ _).framed middleFramed) (middleValues.push small bound)
+    (leading.safeHoles.clear _ _) frames joinView
+  refine ⟨{
+    count := leading.count + 2 + trailing.count, after := trailing.after, memory := trailing.memory, holes := trailing.holes
+    represented := trailing.represented, safeHoles := trailing.safeHoles, resultAt := trailing.resultAt
+    preserved := leading.preserved.trans ((Preserves.fresh frame small leading.after bound).trans
+      (trailing.preserved.weaken (smaller := values.size) (by simp)))
+    steps := ?_ }⟩
+  simpa only [destination, Plan.entry, List.length_cons, List.length_nil] using (leading.steps.append joinSteps).append trailing.steps
+
+theorem let_overflow_contract {checked : X86.Checked} {layout : Layout} {frame : Frame layout}
+    {values : Array Word} {rootTop : Nat} {returns : List ReturnFrame}
+    {join success failure : BlockId} {value body : Plan}
+    (first : ExprContract checked value join failure layout frame values rootTop returns none) :
+    ExprContract checked (.letE join value body) success failure layout frame values rootTop returns none := by
+  intro outside memory state holes framed valuesAt safeHoles frames represented
+  obtain ⟨leading⟩ := first outside memory state holes framed valuesAt safeHoles frames represented
+  exact ⟨{ leading with steps := leading.steps }⟩
+
+theorem zero_holds (state : State) (value : Word) (memory : Memory) :
+    zeroCompare.holds .eq ((state.setReg .rax value).core memory) = (value == 0) := by
+  simp [zeroCompare, Compare.holds, Condition.holds, State.core, State.setReg,
+    Core.readReg, Registers.set, AluSource.eval, signExtend32]
+
+theorem branch_contract {checked : X86.Checked} {layout : Layout} {frame : Frame layout}
+    {values : Array Word} {rootTop : Nat} {returns : List ReturnFrame}
+    {entry success failure : BlockId} {scrutinee : Atom} {zero successor : Plan}
+    {value : Word} {result : Option Word}
+    (found : scrutinee.eval values = some value)
+    (code : BlockCode checked entry [load .rax scrutinee] (.branch zeroCompare .eq zero.entry successor.entry))
+    (valid : checked.program.hasBlock (if value == 0 then zero.entry else successor.entry) = true)
+    (taken : ExprContract checked (if value == 0 then zero else successor) success failure layout frame values rootTop returns result) :
+    ExprContract checked (.branch entry scrutinee zero successor) success failure layout frame values rootTop returns result := by
+  intro outside memory state holes framed valuesAt safeHoles frames represented
+  have preserved := Preserves.setReg frame values.size state .rax value (by simp)
+  obtain ⟨branchMemory, branchView, branchSteps⟩ := (load_safeTrace framed valuesAt safeHoles .rax found).branch
+    outside memory represented checked entry zero.entry successor.entry zeroCompare .eq code (value == 0)
+    (zero_holds state value Memory.unmapped) valid
+  obtain ⟨trailing⟩ := taken outside branchMemory _ holes (preserved.1.framed framed) (preserved.values valuesAt)
+    safeHoles frames branchView
+  have label : (if value == 0 then zero else successor).entry = if value == 0 then zero.entry else successor.entry := by split <;> rfl
+  have trailingSteps := trailing.steps
+  rw [label] at trailingSteps
+  exact ⟨{
+    count := 2 + trailing.count, after := trailing.after, memory := trailing.memory, holes := trailing.holes
+    represented := trailing.represented, safeHoles := trailing.safeHoles, resultAt := trailing.resultAt
+    preserved := preserved.trans trailing.preserved, steps := branchSteps.append trailingSteps }⟩
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarContracts.lean b/Ix/Compiler/X86/ScalarContracts.lean
new file mode 100644
index 000000000..3b3155717
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarContracts.lean
@@ -0,0 +1,82 @@
+import Ix.Compiler.X86.ScalarInstructions
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+def destination (success failure : BlockId) : Option Word → BlockId
+  | some _ => success
+  | none => failure
+
+def ResultAt (result : Option Word) (state : State) : Prop :=
+  ∀ value, result = some value → state.registers .rax = value
+
+/-- The expression contract preserves existing locals and reaches its exact
+success or overflow continuation. All accesses carry E2 safety evidence. -/
+structure ExprRun (checked : X86.Checked) (plan : Plan) (success failure : BlockId)
+    (layout : Layout) (frame : Frame layout) (values : Array Word)
+    (outside initialMemory : Memory) (before : State) (initialHoles : Stream.Holes)
+    (rootTop : Nat) (returns : List ReturnFrame) (result : Option Word) where
+  count : Nat
+  after : State
+  memory : Memory
+  holes : Stream.Holes
+  represented : Realizes layout outside after.words memory
+  preserved : Preserves frame values.size before after
+  safeHoles : HolesIn layout rootTop holes
+  resultAt : ResultAt result after
+  steps : Stream.SafeSteps Runtime.rejecting checked count initialHoles
+    (inFrame (before.core initialMemory) plan.entry 0 returns)
+    holes (inFrame (after.core memory) (destination success failure result) 0 returns)
+
+def returnBlock (plan : FunctionPlan) : Option Word → BlockId
+  | some _ => plan.success
+  | none => plan.failure
+
+def returnOffset : Option Word → Nat
+  | some _ => successInstructions.length
+  | none => failureInstructions.length
+
+def returnTag : Option Word → Word
+  | some _ => 0
+  | none => 1
+
+/-- A complete activation up to its final RET. The caller then composes the
+stored-continuation contract; the exported entry composes the external RET. -/
+structure FunctionRun (checked : X86.Checked) (plan : FunctionPlan)
+    (layout : Layout) (frame : Frame layout) (outside initialMemory : Memory)
+    (before : State) (initialHoles : Stream.Holes) (rootTop : Nat)
+    (returns : List ReturnFrame) (result : Option Word) where
+  count : Nat
+  after : State
+  memory : Memory
+  holes : Stream.Holes
+  represented : Realizes layout outside after.words memory
+  stable : Stable before after
+  preserved : ∀ index, frame.top ≤ index → after.words index = before.words index
+  safeHoles : HolesIn layout rootTop holes
+  resultValue : after.registers .rax = result.getD 0
+  resultTag : after.registers .rdx = returnTag result
+  steps : Stream.SafeSteps Runtime.rejecting checked count initialHoles
+    (inFrame (before.core initialMemory) plan.entry 0 returns)
+    holes (inFrame (after.core memory) (returnBlock plan result) (returnOffset result) returns)
+
+/-- The quantifiers include arbitrary runtime registers, scratch contents,
+mapped stack memory, and active callers. -/
+def ExprContract (checked : X86.Checked) (plan : Plan) (success failure : BlockId)
+    (layout : Layout) (frame : Frame layout) (values : Array Word)
+    (rootTop : Nat) (returns : List ReturnFrame) (result : Option Word) : Prop :=
+  ∀ outside memory state holes,
+    Framed frame state → ValuesAt frame values state → HolesIn layout rootTop holes →
+    FramesAbove layout frame.top returns → Realizes layout outside state.words memory →
+    Nonempty (ExprRun checked plan success failure layout frame values outside memory state holes rootTop returns result)
+
+def FunctionContract (checked : X86.Checked) (plan : FunctionPlan)
+    (layout : Layout) (frame : Frame layout) (values : Array Word)
+    (rootTop : Nat) (returns : List ReturnFrame) (result : Option Word) : Prop :=
+  ∀ outside memory state holes,
+    ArgumentsAt values state → state.registers .rsp = layout.address frame.top →
+    HolesIn layout rootTop holes → FramesAbove layout frame.top returns →
+    Realizes layout outside state.words memory →
+    Nonempty (FunctionRun checked plan layout frame outside memory state holes rootTop returns result)
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarFrames.lean b/Ix/Compiler/X86/ScalarFrames.lean
new file mode 100644
index 000000000..01e7e8192
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarFrames.lean
@@ -0,0 +1,135 @@
+import Ix.Compiler.X86.ScalarStack
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem Frame.push_address {layout : Layout} (frame : Frame layout) :
+    layout.address frame.top - 8 = layout.address frame.baseIndex := by
+  simpa [Frame.baseIndex] using layout.subtract (slot := frame.top) (count := 1) (by have := frame.enough; omega)
+
+theorem Frame.allocate_address {layout : Layout} (frame : Frame layout) :
+    layout.address frame.baseIndex - frameSize.bytes = layout.address frame.stackIndex := by
+  have enough := frame.enough
+  have result := layout.subtract (slot := frame.baseIndex) (count := 32) (by simp only [Frame.baseIndex]; omega)
+  change layout.address frame.baseIndex - 256 = layout.address (frame.baseIndex - 32) at result
+  change layout.address frame.baseIndex - 256 = layout.address frame.stackIndex
+  simpa [Frame.baseIndex, Frame.stackIndex, Nat.sub_sub] using result
+
+theorem Frame.free_address {layout : Layout} (frame : Frame layout) :
+    layout.address frame.stackIndex + frameSize.bytes = layout.address frame.baseIndex := by
+  rw [← frame.allocate_address, UInt64.sub_add_cancel]
+
+theorem Frame.pop_address {layout : Layout} (frame : Frame layout) :
+    layout.address frame.baseIndex + 8 = layout.address frame.top := by
+  rw [← frame.push_address, UInt64.sub_add_cancel]
+
+def pushState {layout : Layout} (frame : Frame layout) (state : State) : State :=
+  (state.setReg .rsp (layout.address frame.baseIndex)).setWord frame.baseIndex (state.registers .rbp)
+
+def frameState {layout : Layout} (frame : Frame layout) (state : State) : State :=
+  ((pushState frame state).setReg .rbp (layout.address frame.baseIndex)).setReg .rsp (layout.address frame.stackIndex)
+
+def enterState {layout : Layout} (frame : Frame layout) (parameters : Nat) (state : State) : State :=
+  let ready := frameState frame state
+  let first := if 0 < parameters then ready.setWord (frame.localIndex 0) (state.registers .rdi) else ready
+  if 1 < parameters then first.setWord (frame.localIndex 1) (state.registers .rsi) else first
+
+theorem frame_trace {layout : Layout} (frame : Frame layout) (state : State)
+    (stack : state.registers .rsp = layout.address frame.top) :
+    Trace layout [.push .rbp, .mov .w64 .rbp (.reg .rsp), .allocFrame frameSize] state (frameState frame state) := by
+  have pushed : Trace layout [.push .rbp] state (pushState frame state) :=
+    .cons (.push _ _ _ frame.base_bound (by rw [stack, frame.push_address])) (.nil _)
+  have setBase : Trace layout [.mov .w64 .rbp (.reg .rsp)] (pushState frame state)
+      ((pushState frame state).setReg .rbp (layout.address frame.baseIndex)) := by
+    simpa [pushState] using Trace.cons (Effect.mov (pushState frame state) .rbp (.reg .rsp)) (Trace.nil _)
+  have allocate : Trace layout [.allocFrame frameSize]
+      ((pushState frame state).setReg .rbp (layout.address frame.baseIndex)) (frameState frame state) := by
+    simpa [frameState, pushState, frame.allocate_address] using
+      Trace.cons (Effect.allocFrame ((pushState frame state).setReg .rbp (layout.address frame.baseIndex)) frameSize)
+        (Trace.nil _)
+  exact pushed.append (setBase.append allocate)
+
+theorem enter_framed {layout : Layout} (frame : Frame layout) (parameters : Nat) (state : State) :
+    Framed frame (enterState frame parameters state) := by
+  simp only [enterState]
+  split <;> (try split) <;>
+    simp [Framed, frameState, pushState, State.setReg_registers]
+
+theorem enter_trace {layout : Layout} (frame : Frame layout) (parameters : Nat) (state : State)
+    (stack : state.registers .rsp = layout.address frame.top) :
+    Trace layout (prologue parameters) state (enterState frame parameters state) := by
+  have first : Trace layout [.spill (slot 0) .rdi] (frameState frame state)
+      ((frameState frame state).setWord (frame.localIndex 0) (state.registers .rdi)) := by
+    have store := Effect.spill (frameState frame state) (slot 0) .rdi (frame.localIndex 0)
+      (frame.local_bound 0) (by simpa [frameState, pushState] using frame.local_address (index := 0) (by decide))
+    simpa [frameState, pushState] using Trace.cons store (Trace.nil _)
+  have second (ready : State) (base : ready.registers .rbp = layout.address frame.baseIndex)
+      (argument : ready.registers .rsi = state.registers .rsi) :
+      Trace layout [.spill (slot 1) .rsi] ready (ready.setWord (frame.localIndex 1) (state.registers .rsi)) := by
+    have store := Effect.spill ready (slot 1) .rsi (frame.localIndex 1) (frame.local_bound 1)
+      (by rw [base]; exact frame.local_address (by decide))
+    simpa [argument] using Trace.cons store (Trace.nil _)
+  unfold prologue enterState
+  by_cases one : 0 < parameters
+  · by_cases two : 1 < parameters
+    · simpa only [if_pos one, if_pos two] using
+        ((frame_trace frame state stack).append first).append
+          (second _ (by simp [frameState, pushState]) (by simp [frameState, pushState]))
+    · simpa only [if_pos one, if_neg two, List.append_nil] using (frame_trace frame state stack).append first
+  · have two : ¬1 < parameters := by omega
+    simpa only [if_neg one, if_neg two, List.append_nil] using frame_trace frame state stack
+
+def ArgumentsAt (values : Array Word) (state : State) : Prop :=
+  values.size ≤ 2 ∧ ∀ index (bound : index < values.size),
+    values[index] = if index = 0 then state.registers .rdi else state.registers .rsi
+
+theorem enter_values {layout : Layout} (frame : Frame layout) (state : State) (values : Array Word)
+    (arguments : ArgumentsAt values state) : ValuesAt frame values (enterState frame values.size state) := by
+  refine ⟨by have := arguments.1; simp only [maxLocals]; omega, ?_⟩
+  intro index bound
+  have arity := arguments.1
+  have enough := frame.enough
+  have indexCases : index = 0 ∨ index = 1 := by omega
+  rcases indexCases with rfl | rfl
+  · have one : 0 < values.size := bound
+    have different : frame.localIndex 0 ≠ frame.localIndex 1 := by
+      simp only [Frame.localIndex]
+      omega
+    rw [arguments.2 0 bound]
+    simp only [enterState, if_pos one]
+    split <;> simp [Words.set, different]
+  · have one : 0 < values.size := by omega
+    have two : 1 < values.size := bound
+    rw [arguments.2 1 bound]
+    simp [enterState, if_pos one, if_pos two]
+
+theorem enter_words_above {layout : Layout} (frame : Frame layout) (parameters : Nat) (state : State)
+    (index : Nat) (above : frame.top ≤ index) :
+    (enterState frame parameters state).words index = state.words index := by
+  have enough := frame.enough
+  simp only [enterState]
+  split <;> (try split) <;>
+    simp (discharger := omega) [frameState, pushState, Words.set, Frame.baseIndex, Frame.localIndex, if_neg] <;> omega
+
+theorem enter_savedBase {layout : Layout} (frame : Frame layout) (parameters : Nat) (state : State) :
+    (enterState frame parameters state).words frame.baseIndex = state.registers .rbp := by
+  have enough := frame.enough
+  simp only [enterState]
+  split <;> (try split) <;>
+    simp (discharger := omega) [frameState, pushState, Words.set, Frame.baseIndex, Frame.localIndex, if_neg] <;> omega
+
+def leaveState {layout : Layout} (frame : Frame layout) (state : State) : State :=
+  (state.setReg .rsp (layout.address frame.top)).setReg .rbp (state.words frame.baseIndex)
+
+theorem leave_trace {layout : Layout} (frame : Frame layout) (state : State) (framed : Framed frame state) :
+    Trace layout epilogue state (leaveState frame state) := by
+  have freed : Trace layout [.freeFrame frameSize] state (state.setReg .rsp (layout.address frame.baseIndex)) := by
+    simpa [framed.2, frame.free_address] using Trace.cons (Effect.freeFrame state frameSize) (Trace.nil _)
+  have popped : Trace layout [.pop .rbp] (state.setReg .rsp (layout.address frame.baseIndex))
+      (leaveState frame state) := by
+    simpa [leaveState, frame.pop_address] using Trace.cons
+      (Effect.pop (state.setReg .rsp (layout.address frame.baseIndex)) .rbp frame.baseIndex frame.base_bound (by simp))
+      (Trace.nil _)
+  exact freed.append popped
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarFunctions.lean b/Ix/Compiler/X86/ScalarFunctions.lean
new file mode 100644
index 000000000..139e3f61d
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarFunctions.lean
@@ -0,0 +1,113 @@
+import Ix.Compiler.X86.ScalarComposition
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+structure FunctionCode (checked : X86.Checked) (entries : Array BlockId)
+    (source : Function) (plan : FunctionPlan) : Prop where
+  expression : plan.body.expression = source.body
+  prologue : BlockCode checked plan.entry (Scalar.prologue source.parameters) (.jump plan.body.entry)
+  success : BlockCode checked plan.success successInstructions .ret
+  failure : BlockCode checked plan.failure failureInstructions .ret
+  body : plan.body.matches checked.program entries source.parameters plan.success plan.failure = true
+
+theorem FunctionPlan.code {checked : X86.Checked} {entries : Array BlockId} {source : Function} {plan : FunctionPlan}
+    (matched : plan.matches checked.program entries source = true) : FunctionCode checked entries source plan := by
+  simp only [FunctionPlan.matches, Bool.and_eq_true, beq_iff_eq] at matched
+  exact ⟨matched.1.1.1.1, blockMatches_code matched.1.1.1.2, blockMatches_code matched.1.1.2,
+    blockMatches_code matched.1.2, matched.2⟩
+
+def tagInstructions : Option Word → List Instr
+  | some _ => [.mov .w64 .rdx (.imm 0)]
+  | none => [.mov .w64 .rax (.imm 0), .mov .w64 .rdx (.imm 1)]
+
+def tagState (result : Option Word) (state : State) : State :=
+  match result with
+  | some _ => state.setReg .rdx 0
+  | none => (state.setReg .rax 0).setReg .rdx 1
+
+theorem tag_safeTrace (layout : Layout) (returns : List ReturnFrame) (result : Option Word)
+    (state : State) (holes : Stream.Holes) :
+    SafeTrace layout returns (tagInstructions result) state holes (tagState result state) holes := by
+  cases result with
+  | none => exact (SafeTrace.mov _ _ _ _ _ _).append (SafeTrace.mov _ _ _ _ _ _)
+  | some value => exact SafeTrace.mov _ _ _ _ _ _
+
+theorem tag_preserves {layout : Layout} (frame : Frame layout) (locals : Nat) (result : Option Word) (state : State) :
+    Preserves frame locals state (tagState result state) := by
+  cases result with
+  | none => exact (Preserves.setReg _ _ _ _ _ (by simp)).trans (Preserves.setReg _ _ _ _ _ (by simp))
+  | some value => exact Preserves.setReg _ _ _ _ _ (by simp)
+
+@[simp] theorem tag_words (result : Option Word) (state : State) : (tagState result state).words = state.words := by
+  cases result <;> rfl
+
+theorem tag_result {result : Option Word} {state : State} (value : ResultAt result state) :
+    (tagState result state).registers .rax = result.getD 0 ∧
+    (tagState result state).registers .rdx = returnTag result := by
+  cases result with
+  | none => simp [tagState, returnTag]
+  | some result => simp [tagState, returnTag, value result rfl]
+
+@[simp] theorem enter_registers {layout : Layout} (frame : Frame layout) (parameters : Nat) (state : State) :
+    (enterState frame parameters state).registers = (frameState frame state).registers := by
+  unfold enterState
+  split <;> (try split) <;> rfl
+
+theorem leave_stable {layout : Layout} (frame : Frame layout) (parameters : Nat) (before after : State)
+    (stack : before.registers .rsp = layout.address frame.top)
+    (preserved : Preserves frame parameters (enterState frame parameters before) after) :
+    Stable before (leaveState frame after) := by
+  have base : after.words frame.baseIndex = before.registers .rbp := by
+    rw [preserved.2 _ (by simp only [Frame.baseIndex]; omega), enter_savedBase]
+  intro register saved
+  have same := preserved.1 register saved
+  cases register <;> simp only [callerSaved] at saved <;> (try contradiction)
+  all_goals simp_all [leaveState, frameState, pushState]
+
+theorem FunctionCode.exit {checked : X86.Checked} {entries : Array BlockId} {source : Function} {plan : FunctionPlan}
+    (code : FunctionCode checked entries source plan) (result : Option Word) :
+    BlockCode checked (returnBlock plan result) (tagInstructions result ++ epilogue) .ret := by
+  cases result
+  · exact code.failure
+  · exact code.success
+
+theorem function_contract {checked : X86.Checked} {entries : Array BlockId} {source : Function} {plan : FunctionPlan}
+    {layout : Layout} {frame : Frame layout} {values : Array Word} {rootTop : Nat} {returns : List ReturnFrame}
+    {result : Option Word}
+    (code : FunctionCode checked entries source plan) (arity : values.size = source.parameters)
+    (body : ExprContract checked plan.body plan.success plan.failure layout frame values rootTop returns result) :
+    FunctionContract checked plan layout frame values rootTop returns result := by
+  intro outside memory state holes arguments stack safeHoles frames represented
+  obtain ⟨bodyMemory, bodyView, prologueSteps⟩ := (enter_safeTrace frame source.parameters state holes stack frames).jump
+    outside memory represented checked plan.entry plan.body.entry code.prologue (Plan.entry_valid code.body)
+  obtain ⟨executed⟩ := body outside bodyMemory _ _ (enter_framed frame source.parameters state)
+    (by simpa only [arity] using enter_values frame state values arguments)
+    (safeHoles.enter frame source.parameters) frames bodyView
+  have preserved := executed.preserved.trans (tag_preserves frame values.size result executed.after)
+  have framed := preserved.1.framed (enter_framed frame source.parameters state)
+  have exitTrace := (tag_safeTrace layout returns result executed.after executed.holes).append
+    (leave_safeTrace frame (tagState result executed.after) executed.holes framed executed.safeHoles)
+  have exitCode := code.exit result
+  obtain ⟨exitMemory, exitView, exitSteps⟩ := exitTrace.steps outside executed.memory executed.represented
+    Runtime.rejecting checked (returnBlock plan result) 0 exitCode.segment (by simpa using exitCode.fits)
+  have value := tag_result executed.resultAt
+  refine ⟨{
+    count := (Scalar.prologue source.parameters).length + 1 + executed.count + (tagInstructions result ++ epilogue).length
+    after := leaveState frame (tagState result executed.after), memory := exitMemory, holes := executed.holes
+    represented := exitView, safeHoles := executed.safeHoles
+    stable := leave_stable frame source.parameters state _ stack (by simpa only [arity] using preserved)
+    preserved := ?_, resultValue := ?_, resultTag := ?_, steps := ?_ }⟩
+  · intro index above
+    change (tagState result executed.after).words index = state.words index
+    rw [preserved.2 _ (by omega), enter_words_above _ _ _ _ above]
+  · simpa [leaveState] using value.1
+  · simpa [leaveState] using value.2
+  · have label : destination plan.success plan.failure result = returnBlock plan result := by cases result <;> rfl
+    have offset : (tagInstructions result ++ epilogue).length = returnOffset result := by cases result <;> rfl
+    have bodySteps := executed.steps
+    rw [label] at bodySteps
+    have combined := (prologueSteps.append bodySteps).append exitSteps
+    simpa only [Nat.zero_add, offset] using combined
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarInstructions.lean b/Ix/Compiler/X86/ScalarInstructions.lean
new file mode 100644
index 000000000..989a618e7
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarInstructions.lean
@@ -0,0 +1,107 @@
+import Ix.Compiler.X86.ScalarSafeFrames
+import Ix.Compiler.X86.SafeControl
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem Preserves.setReg {layout : Layout} (frame : Frame layout) (locals : Nat) (state : State)
+    (register : GPR) (value : Word) (scratch : SysV.isCallerSaved register = true) :
+    Preserves frame locals state (state.setReg register value) :=
+  ⟨Stable.setReg _ _ _ scratch, fun _ _ => rfl⟩
+
+theorem Preserves.weaken {layout : Layout} {frame : Frame layout} {smaller larger : Nat} {before after : State}
+    (preserved : Preserves frame larger before after) (bound : smaller ≤ larger) :
+    Preserves frame smaller before after :=
+  ⟨preserved.1, fun index high => preserved.2 index (by omega)⟩
+
+theorem Preserves.fresh {layout : Layout} (frame : Frame layout) {locals : Nat} (bound : locals < maxLocals)
+    (state : State) (value : Word) :
+    Preserves frame locals state (state.setWord (frame.localIndex locals) value) := by
+  refine ⟨Stable.setWord _ _ _, fun index high => ?_⟩
+  apply Words.set_other
+  have enough := frame.enough
+  simp only [Frame.localIndex, maxLocals] at *
+  omega
+
+theorem ValuesAt.push {layout : Layout} {frame : Frame layout} {values : Array Word} {state : State}
+    (valuesAt : ValuesAt frame values state) (bound : values.size < maxLocals) (value : Word) :
+    ValuesAt frame (values.push value) (state.setWord (frame.localIndex values.size) value) := by
+  refine ⟨by simp only [Array.size_push]; omega, ?_⟩
+  intro index small
+  simp only [Array.size_push] at small
+  by_cases previous : index < values.size
+  · have different : frame.localIndex index ≠ frame.localIndex values.size := by
+      intro equal
+      have := frame.local_injective (by omega) bound equal
+      omega
+    simp only [State.setWord_words, Words.set_other _ _ _ _ different,
+      Array.getElem_push_lt previous]
+    exact valuesAt.2 index previous
+  · have equal : index = values.size := by omega
+    subst index
+    simp
+
+theorem load_safeTrace {layout : Layout} {frame : Frame layout} {values : Array Word} {state : State}
+    {returns : List ReturnFrame} {rootTop : Nat} {holes : Stream.Holes}
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state)
+    (valid : HolesIn layout rootTop holes) (destination : GPR)
+    {source : Atom} {value : Word} (found : source.eval values = some value) :
+    SafeTrace layout returns [load destination source] state holes (state.setReg destination value) holes := by
+  cases source with
+  | constant number =>
+      simp only [Atom.eval, Option.some.injEq] at found
+      subst value
+      exact SafeTrace.mov _ _ _ _ _ _
+  | var index =>
+      simp only [Atom.eval] at found
+      obtain ⟨bound, equal⟩ := Array.getElem?_eq_some_iff.mp found
+      have small : index < maxLocals := by have := valuesAt.1; omega
+      have loaded : state.words (frame.localIndex index) = value := (valuesAt.2 index bound).trans equal
+      have address : state.registers .rbp - (slot index).displacement = layout.address (frame.localIndex index) := by
+        rw [framed.1]
+        exact frame.local_address small
+      simpa only [load, loaded] using SafeTrace.reload layout returns state holes destination (slot index)
+        (frame.localIndex index) (frame.local_bound index) address
+        (valid.readable (frame.local_bound index) (.inl (frame.local_ordinary small)))
+
+def operandsState (state : State) (left right : Word) : State := (state.setReg .rax left).setReg .rcx right
+def sumState (state : State) (left right : Word) : State :=
+  ((operandsState state left right).setReg .r10 left).setReg .rax (left + right)
+
+theorem operands_preserves {layout : Layout} (frame : Frame layout) (locals : Nat) (state : State) (left right : Word) :
+    Preserves frame locals state (operandsState state left right) :=
+  (Preserves.setReg frame locals state .rax left (by simp)).trans
+    (Preserves.setReg frame locals _ .rcx right (by simp))
+
+theorem sum_preserves {layout : Layout} (frame : Frame layout) (locals : Nat) (state : State) (left right : Word) :
+    Preserves frame locals state (sumState state left right) :=
+  ((operands_preserves frame locals state left right).trans
+    (Preserves.setReg frame locals _ .r10 left (by simp))).trans
+    (Preserves.setReg frame locals _ .rax (left + right) (by simp))
+
+theorem operands_safeTrace {layout : Layout} {frame : Frame layout} {values : Array Word} {state : State}
+    {returns : List ReturnFrame} {rootTop : Nat} {holes : Stream.Holes} {left right : Atom} {a b : Word}
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state) (valid : HolesIn layout rootTop holes)
+    (leftValue : left.eval values = some a) (rightValue : right.eval values = some b) :
+    SafeTrace layout returns [load .rax left, load .rcx right] state holes (operandsState state a b) holes := by
+  have preserved := Preserves.setReg frame values.size state .rax a (by simp)
+  exact (load_safeTrace framed valuesAt valid .rax leftValue).append
+    (load_safeTrace (preserved.1.framed framed) (preserved.values valuesAt) valid .rcx rightValue)
+
+theorem add_safeTrace {layout : Layout} {frame : Frame layout} {values : Array Word} {state : State}
+    {returns : List ReturnFrame} {rootTop : Nat} {holes : Stream.Holes} {left right : Atom} {a b : Word}
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state) (valid : HolesIn layout rootTop holes)
+    (leftValue : left.eval values = some a) (rightValue : right.eval values = some b) :
+    SafeTrace layout returns (addInstructions left right) state holes (sumState state a b) holes := by
+  have saved := SafeTrace.mov layout returns (operandsState state a b) holes .r10 (.reg .rax)
+  have added := SafeTrace.alu layout returns ((operandsState state a b).setReg .r10 a) holes .add .rax (.reg .rcx)
+  simp [operandsState, AluOp.eval] at saved added
+  simpa [addInstructions, sumState, operandsState] using
+    ((operands_safeTrace framed valuesAt valid leftValue rightValue).append saved).append added
+
+theorem carry_holds (state : State) (left right : Word) (memory : Memory) :
+    carryCompare.holds .unsignedLt ((sumState state left right).core memory) = ExactNat.overflow left right := by
+  simp [carryCompare, Compare.holds, Condition.holds, sumState, operandsState, State.core, State.setReg,
+    Core.readReg, Registers.set, AluSource.eval, ExactNat.overflow]
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarNat.lean b/Ix/Compiler/X86/ScalarNat.lean
new file mode 100644
index 000000000..61036c548
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarNat.lean
@@ -0,0 +1,121 @@
+import Ix.Compiler.X86.ScalarObject
+
+namespace Ix.Compiler.X86.Scalar
+
+def Atom.natEval (values : Array Nat) : Atom → Option Nat
+  | .var index => values[index]?
+  | .constant word => some word.toNat
+
+/-- Unbounded source arithmetic. Successful word execution refines this
+relation; an overflowing intermediate returns the separate fallback tag. -/
+inductive NatEvaluates (functions : Array Function) : Expr → Array Nat → Nat → Prop where
+  | atom {values : Array Nat} {source : Atom} {value : Nat}
+      (found : source.natEval values = some value) : NatEvaluates functions (.atom source) values value
+  | add {values : Array Nat} {left right : Atom} {a b : Nat}
+      (leftValue : left.natEval values = some a) (rightValue : right.natEval values = some b) :
+      NatEvaluates functions (.add left right) values (a + b)
+  | sub {values : Array Nat} {left right : Atom} {a b : Nat}
+      (leftValue : left.natEval values = some a) (rightValue : right.natEval values = some b) :
+      NatEvaluates functions (.sub left right) values (a - b)
+  | letE {values : Array Nat} {value body : Expr} {bound result : Nat}
+      (first : NatEvaluates functions value values bound)
+      (rest : NatEvaluates functions body (values.push bound) result) :
+      NatEvaluates functions (.letE value body) values result
+  | zero {values : Array Nat} {scrutinee : Atom} {zero successor : Expr} {result : Nat}
+      (scrutineeValue : scrutinee.natEval values = some 0) (taken : NatEvaluates functions zero values result) :
+      NatEvaluates functions (.branch scrutinee zero successor) values result
+  | successor {values : Array Nat} {scrutinee : Atom} {zero successor : Expr} {value result : Nat}
+      (scrutineeValue : scrutinee.natEval values = some value) (positive : value ≠ 0)
+      (taken : NatEvaluates functions successor values result) :
+      NatEvaluates functions (.branch scrutinee zero successor) values result
+  | call {values supplied : Array Nat} {function : Nat} {arguments : Array Atom} {callee : Function} {result : Nat}
+      (found : functions[function]? = some callee)
+      (argumentsAt : arguments.mapM (Atom.natEval values) = some supplied)
+      (arity : supplied.size = callee.parameters) (evaluated : NatEvaluates functions callee.body supplied result) :
+      NatEvaluates functions (.call function arguments) values result
+
+theorem Atom.toNat {source : Atom} {values : Array Word} {word : Word}
+    (found : source.eval values = some word) : source.natEval (values.map UInt64.toNat) = some word.toNat := by
+  cases source <;> simp_all [Atom.eval, Atom.natEval]
+
+theorem list_mapM_transform {α β γ : Type} {f : α → Option β} {g : α → Option γ} (convert : β → γ)
+    (related : ∀ item value, f item = some value → g item = some (convert value))
+    {items : List α} {values : List β} (mapped : items.mapM f = some values) :
+    items.mapM g = some (values.map convert) := by
+  induction items generalizing values with
+  | nil => simp at mapped; subst values; simp
+  | cons item items ih =>
+      cases first : f item with
+      | none => simp [List.mapM_cons, first] at mapped
+      | some value =>
+          cases rest : items.mapM f with
+          | none => simp [List.mapM_cons, first, rest] at mapped
+          | some tail =>
+              simp [List.mapM_cons, first, rest] at mapped
+              subst values
+              simp [List.mapM_cons, related item value first, ih rest]
+
+theorem array_mapM_transform {α β γ : Type} {f : α → Option β} {g : α → Option γ} (convert : β → γ)
+    (related : ∀ item value, f item = some value → g item = some (convert value))
+    {items : Array α} {values : Array β} (mapped : items.mapM f = some values) :
+    items.mapM g = some (values.map convert) := by
+  have lists : items.toList.mapM f = some values.toList := by
+    have same := congrArg (Option.map Array.toList) mapped
+    change (Array.toList <$> items.mapM f) = some values.toList at same
+    simpa only [Array.toList_mapM, Option.map_some] using same
+  have transformed := list_mapM_transform convert related lists
+  simp only [Array.mapM_eq_mapM_toList, transformed]
+  change some ((values.toList.map convert).toArray) = some (values.map convert)
+  apply congrArg some
+  apply Array.toList_inj.mp
+  simp
+
+/-- No successful native result silently wraps. Every successful path,
+including all nested calls and joins, computes the exact source Nat. -/
+theorem Evaluates.exact {functions : Array Function} {expression : Expr} {values : Array Word} {result : Option Word}
+    (evaluated : Evaluates functions expression values result) :
+    ∀ word, result = some word → NatEvaluates functions expression (values.map UInt64.toNat) word.toNat := by
+  induction evaluated with
+  | atom found =>
+      intro word same; cases Option.some.inj same
+      exact .atom (Atom.toNat found)
+  | add left right =>
+      intro word same
+      have sum := ExactNat.add_some_iff.mp same
+      rw [sum]
+      exact .add (Atom.toNat left) (Atom.toNat right)
+  | sub left right =>
+      intro word same; cases Option.some.inj same
+      rw [ExactNat.sub_toNat]
+      exact .sub (Atom.toNat left) (Atom.toNat right)
+  | letE first rest ihFirst ihRest =>
+      intro word same
+      exact .letE (ihFirst _ rfl) (by simpa using ihRest word same)
+  | letOverflow => intro word impossible; contradiction
+  | zero found taken ih =>
+      intro word same
+      exact .zero (Atom.toNat found) (ih word same)
+  | @successor values scrutinee zero successor value result found positive taken ih =>
+      intro word same
+      exact .successor (Atom.toNat found) (by intro equal; apply positive; exact UInt64.toNat_inj.mp equal) (ih word same)
+  | call found argumentsAt arity evaluated ih =>
+      intro word same
+      exact .call found (array_mapM_transform UInt64.toNat (fun _ _ h => Atom.toNat h) argumentsAt)
+        (by simpa using arity) (ih word same)
+
+def encodeArguments (values : Array Nat) : Option (Array Word) := values.mapM ExactNat.encode
+
+theorem encodeArguments_exact {values : Array Nat} {words : Array Word} (encoded : encodeArguments values = some words) :
+    words.map UInt64.toNat = values := by
+  have mapped := array_mapM_transform UInt64.toNat (f := ExactNat.encode) (g := some)
+    (fun _ _ encoded => by rw [ExactNat.encode_some_iff.mp encoded]) encoded
+  have pureMap : values.mapM (some : Nat → Option Nat) = some values := by
+    have lists (items : List Nat) : items.mapM (some : Nat → Option Nat) = some items := by
+      induction items with
+      | nil => rfl
+      | cons head tail ih => simp [List.mapM_cons, ih]
+    simp [Array.mapM_eq_mapM_toList, lists]
+  rw [pureMap] at mapped
+  exact (Option.some.inj mapped).symm
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarObject.lean b/Ix/Compiler/X86/ScalarObject.lean
new file mode 100644
index 000000000..65d785c54
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarObject.lean
@@ -0,0 +1,130 @@
+import Ix.Compiler.X86.ScalarCapacity
+import Ix.Compiler.X86.SafeStepsObject
+
+namespace Ix.Compiler.X86
+
+theorem BlockCode.safe_leaf_ret {checked : Checked} {block : BlockId} {instructions : List Instr}
+    (code : BlockCode checked block instructions .ret) (core : Core) (holes : Stream.Holes)
+    (readable : Stream.ReadableData holes (core.readReg .rsp) 8) :
+    Stream.SafeSteps Runtime.rejecting checked 1 holes (inFrame core block instructions.length [])
+      holes (haltedLeaf core block instructions.length) := by
+  have safe : Stream.SafeAt checked.program holes (inFrame core block instructions.length []) := by
+    simp [Stream.SafeAt, inFrame, UInt32.toNat_ofNat_of_lt' code.fits, code.found, readable]
+  have executed := code.ret Runtime.rejecting core
+  simpa only [code.holeStep] using Stream.SafeSteps.single safe executed
+
+namespace Scalar
+open WordRegion
+
+structure RootRun (output : X86.Checked) (core : Core) (stack : Stack) (result : Option Word) where
+  count : Nat
+  after : Machine
+  holes : Stream.Holes
+  holesIn : HolesIn stack.layout stack.frame.top holes
+  steps : Stream.SafeSteps Runtime.rejecting output count (fun _ => False) (Machine.initial output core) holes after
+  halted : after.status = .halted (result.getD 0)
+  value : after.core.readReg .rax = result.getD 0
+  tag : after.core.readReg .rdx = returnTag result
+  stackPointer : after.core.readReg .rsp = core.readReg .rsp
+  saved : after.core.calleeSavedSnapshot = core.calleeSavedSnapshot
+  outside : ∀ address, stack.layout.allowed address = false → after.core.memory.bytes address = core.memory.bytes address
+  returnSlot : after.core.memory.read64? (after.core.readReg .rsp) = .ok (core.memory.read64 (core.readReg .rsp))
+
+theorem Output.root_run {checked : Scalar.Checked} (output : Output checked)
+    {function : Function} {values : Array Word} {result : Option Word}
+    (found : checked.program.functions[checked.program.entry]? = some function)
+    (arity : values.size = function.parameters)
+    (evaluated : Evaluates checked.program.functions function.body values result)
+    (stack : Stack) (depth : checked.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : ArgumentsAt values ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true) :
+    Nonempty (RootRun output.target core stack result) := by
+  let state : State := ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩
+  have represented : Realizes stack.layout core.memory state.words core.memory := realizes_initial _ _ readable writable
+  obtain ⟨plan, planFound, code⟩ := output.function_code found
+  have entry : output.target.program.entry = plan.entry := by simpa [planFound] using output.entry
+  obtain ⟨executed⟩ := output.function_contract found code arity evaluated (stack.rank_capacity depth) (Nat.le_refl _) (returns := [])
+    core.memory core.memory state (fun _ => False) arguments stackPointer (HolesIn.empty _ _)
+    (by intro active member; cases member) represented
+  have finalStack : (executed.after.core executed.memory).readReg .rsp = stack.layout.address stack.frame.top :=
+    (executed.stable .rsp (by simp)).trans stackPointer
+  have exitCode := code.exit result
+  have safe := executed.safeHoles.readable stack.frame.bound (.inr (Nat.le_refl _))
+  have retSteps := exitCode.safe_leaf_ret (executed.after.core executed.memory) executed.holes (finalStack ▸ safe)
+  have offset : (tagInstructions result ++ epilogue).length = returnOffset result := by cases result <;> rfl
+  rw [offset] at retSteps
+  refine ⟨{
+    count := executed.count + 1
+    after := haltedLeaf (executed.after.core executed.memory) (returnBlock plan result) (returnOffset result)
+    holes := executed.holes, holesIn := executed.safeHoles, steps := ?_, halted := ?_, value := executed.resultValue, tag := executed.resultTag
+    stackPointer := executed.stable .rsp (by simp), saved := executed.stable.snapshot core.memory executed.memory
+    outside := executed.represented.frame, returnSlot := ?_ }⟩
+  · have initial : inFrame (state.core core.memory) plan.entry 0 [] = Machine.initial output.target core := by
+      simp [Machine.initial, inFrame, state, State.core, entry]
+    simpa only [initial] using executed.steps.append retSteps
+  · simpa [haltedLeaf, State.core, Core.readReg] using executed.resultValue
+  · change executed.memory.read64? (executed.after.registers .rsp) = .ok (core.memory.read64 (core.readReg .rsp))
+    change executed.after.registers .rsp = stack.layout.address stack.frame.top at finalStack
+    rw [finalStack, stackPointer]
+    simp only [Memory.read64?, Memory.read?, Width.bytes, executed.represented.readable _ stack.frame.bound, ↓reduceIte, Except.ok.injEq]
+    change executed.memory.read64 (stack.layout.address stack.frame.top) = core.memory.read64 (stack.layout.address stack.frame.top)
+    rw [executed.represented.view _ stack.frame.bound, executed.preserved _ (Nat.le_refl _)]
+
+/-- The object bytes select both text and the exported entry. Safety and
+typed execution are derived from the structural scalar compiler theorem. -/
+theorem RootRun.object {checked : X86.Checked} {core : Core} {stack : Stack} {result : Option Word}
+    (executed : RootRun checked core stack result) {input : ELF.Input} {bytes : ByteArray}
+    (stream : Stream.Valid checked.program input.encoded) (object : ELF.Valid input bytes)
+    (entry : input.entryBlock = checked.program.entry) (base : Word) (flags : ByteEval.Flags) :
+    ∃ count finalState, 0 < count ∧ count ≤ 3 * executed.count ∧
+      ObjectEval.run bytes input.exportName base count core flags = .ok finalState ∧
+      finalState.rip = core.memory.read64 (core.readReg .rsp) ∧
+      Stream.CoreRelated checked.program base executed.holes []
+        (executed.after.core.setReg .rsp (executed.after.core.readReg .rsp + 8)) finalState.core :=
+  ObjectEval.run_safeSteps stream object entry base core flags executed.steps executed.halted executed.returnSlot
+
+/-- Complete observable machine behavior of the parsed exported object. -/
+structure ObjectResult (bytes : ByteArray) (exportName : String) (base : Word)
+    (flags : ByteEval.Flags) (core : Core) (stack : Stack) (result : Option Word) where
+  count : Nat
+  finalState : ByteEval.State
+  positive : 0 < count
+  run : ObjectEval.run bytes exportName base count core flags = .ok finalState
+  returned : finalState.rip = core.memory.read64 (core.readReg .rsp)
+  value : finalState.core.readReg .rax = result.getD 0
+  tag : finalState.core.readReg .rdx = returnTag result
+  stackPointer : finalState.core.readReg .rsp = core.readReg .rsp + 8
+  saved : finalState.core.calleeSavedSnapshot = core.calleeSavedSnapshot
+  outside : ∀ address, stack.layout.allowed address = false → finalState.core.memory.bytes address = core.memory.bytes address
+
+theorem RootRun.objectResult {checked : X86.Checked} {core : Core} {stack : Stack} {result : Option Word}
+    (executed : RootRun checked core stack result) {input : ELF.Input} {bytes : ByteArray}
+    (stream : Stream.Valid checked.program input.encoded) (object : ELF.Valid input bytes)
+    (entry : input.entryBlock = checked.program.entry) (base : Word) (flags : ByteEval.Flags) :
+    Nonempty (ObjectResult bytes input.exportName base flags core stack result) := by
+  obtain ⟨count, finalState, positive, bounded, run, returned, related⟩ := executed.object stream object entry base flags
+  refine ⟨⟨count, finalState, positive, run, returned, ?_, ?_, ?_, ?_, ?_⟩⟩
+  · simpa [Core.setReg, Core.readReg, Registers.set] using (related.readReg .rax).symm.trans (by
+      simpa [Core.setReg, Core.readReg, Registers.set] using executed.value)
+  · simpa [Core.setReg, Core.readReg, Registers.set] using (related.readReg .rdx).symm.trans (by
+      simpa [Core.setReg, Core.readReg, Registers.set] using executed.tag)
+  · have same : executed.after.core.registers .rsp = core.registers .rsp := executed.stackPointer
+    simpa [Core.setReg, Core.readReg, Registers.set, same] using (related.readReg .rsp).symm
+  · have same : finalState.core.calleeSavedSnapshot = executed.after.core.calleeSavedSnapshot := by
+      change SysV.calleeSaved.map finalState.core.readReg = SysV.calleeSaved.map executed.after.core.readReg
+      have equal := congrArg (fun registers => SysV.calleeSaved.map registers) related.registers.symm
+      simpa [Core.setReg, Core.readReg, SysV.calleeSaved, Registers.set] using equal
+    exact same.trans executed.saved
+  · intro address outside
+    have visible : ¬executed.holes address := by
+      intro hidden
+      obtain ⟨slot, offset, bound, below, partition, small, equal⟩ := executed.holesIn address hidden
+      have allowed := stack.layout.byteAllowed bound small
+      rw [← equal, outside] at allowed
+      contradiction
+    exact (related.memory.bytes address visible).symm.trans (executed.outside address outside)
+
+end Scalar
+end Ix.Compiler.X86
diff --git a/Ix/Compiler/X86/ScalarPrimitives.lean b/Ix/Compiler/X86/ScalarPrimitives.lean
new file mode 100644
index 000000000..1f0578301
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarPrimitives.lean
@@ -0,0 +1,100 @@
+import Ix.Compiler.X86.ScalarContracts
+import Ix.Compiler.X86.WordRegionSafeControl
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+variable {checked : X86.Checked} {layout : Layout} {frame : Frame layout} {values : Array Word}
+  {outside memory : Memory} {state : State} {holes : Stream.Holes} {rootTop : Nat} {returns : List ReturnFrame}
+
+theorem atom_run {entry success failure : BlockId} {source : Atom} {value : Word}
+    (code : BlockCode checked entry [load .rax source] (.jump success))
+    (valid : checked.program.hasBlock success = true)
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state)
+    (safeHoles : HolesIn layout rootTop holes) (represented : Realizes layout outside state.words memory)
+    (found : source.eval values = some value) :
+    Nonempty (ExprRun checked (.atom entry source) success failure layout frame values outside memory state holes
+      rootTop returns (some value)) := by
+  obtain ⟨nextMemory, nextView, steps⟩ :=
+    (load_safeTrace framed valuesAt safeHoles .rax found).jump outside memory represented checked entry success code valid
+  exact ⟨{
+    count := 2, after := state.setReg .rax value, memory := nextMemory, holes
+    represented := nextView, preserved := Preserves.setReg _ _ _ _ _ (by simp), safeHoles
+    resultAt := by intro result equal; cases Option.some.inj equal; simp
+    steps := steps }⟩
+
+theorem add_destination (success failure : BlockId) (left right : Word) :
+    (if ExactNat.overflow left right then failure else success) = destination success failure (ExactNat.add left right) := by
+  unfold ExactNat.add
+  split <;> rfl
+
+theorem sum_result (state : State) (left right : Word) : ResultAt (ExactNat.add left right) (sumState state left right) := by
+  intro result equal
+  unfold ExactNat.add at equal
+  split at equal
+  · contradiction
+  · cases Option.some.inj equal
+    simp [sumState]
+
+theorem add_run {entry success failure : BlockId} {left right : Atom} {a b : Word}
+    (code : BlockCode checked entry (addInstructions left right) (.branch carryCompare .unsignedLt failure success))
+    (successValid : checked.program.hasBlock success = true) (failureValid : checked.program.hasBlock failure = true)
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state)
+    (safeHoles : HolesIn layout rootTop holes) (represented : Realizes layout outside state.words memory)
+    (leftValue : left.eval values = some a) (rightValue : right.eval values = some b) :
+    Nonempty (ExprRun checked (.add entry left right) success failure layout frame values outside memory state holes
+      rootTop returns (ExactNat.add a b)) := by
+  obtain ⟨nextMemory, nextView, steps⟩ := (add_safeTrace framed valuesAt safeHoles leftValue rightValue).branch
+    outside memory represented checked entry failure success carryCompare .unsignedLt code
+    (ExactNat.overflow a b) (carry_holds state a b Memory.unmapped)
+    (by split <;> assumption)
+  rw [add_destination] at steps
+  exact ⟨{
+    count := 5, after := sumState state a b, memory := nextMemory, holes
+    represented := nextView, preserved := sum_preserves _ _ _ _ _, safeHoles
+    resultAt := sum_result _ _ _, steps := steps }⟩
+
+theorem operands_holds (state : State) (left right : Word) (memory : Memory) :
+    operandsCompare.holds .unsignedLt ((operandsState state left right).core memory) = decide (left < right) := by
+  simp [operandsCompare, Compare.holds, Condition.holds, operandsState, State.core, State.setReg,
+    Core.readReg, Registers.set, AluSource.eval]
+
+theorem sub_run {entry underflow ordinary success failure : BlockId} {left right : Atom} {a b : Word}
+    (code : BlockCode checked entry [load .rax left, load .rcx right]
+      (.branch operandsCompare .unsignedLt underflow ordinary))
+    (underflowCode : BlockCode checked underflow [.mov .w64 .rax (.imm 0)] (.jump success))
+    (ordinaryCode : BlockCode checked ordinary [.alu .sub .w64 .rax (.reg .rcx)] (.jump success))
+    (valid : checked.program.hasBlock success = true)
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state)
+    (safeHoles : HolesIn layout rootTop holes) (represented : Realizes layout outside state.words memory)
+    (leftValue : left.eval values = some a) (rightValue : right.eval values = some b) :
+    Nonempty (ExprRun checked (.sub entry underflow ordinary left right) success failure layout frame values
+      outside memory state holes rootTop returns (some (ExactNat.sub a b))) := by
+  obtain ⟨middleMemory, middleView, leading⟩ := (operands_safeTrace framed valuesAt safeHoles leftValue rightValue).branch
+    outside memory represented checked entry underflow ordinary operandsCompare .unsignedLt code (decide (a < b))
+    (operands_holds state a b Memory.unmapped)
+    (by split; exact underflowCode.hasBlock; exact ordinaryCode.hasBlock)
+  by_cases less : a < b
+  · simp only [less, decide_true, ↓reduceIte] at leading
+    obtain ⟨finalMemory, finalView, suffix⟩ :=
+      (SafeTrace.mov layout returns (operandsState state a b) holes .rax (.imm 0)).jump
+        outside middleMemory middleView checked underflow success underflowCode valid
+    exact ⟨{
+      count := 5, after := (operandsState state a b).setReg .rax 0, memory := finalMemory, holes
+      represented := finalView, safeHoles
+      preserved := (operands_preserves _ _ _ _ _).trans (Preserves.setReg _ _ _ _ _ (by simp))
+      resultAt := by intro result equal; simp only [ExactNat.sub, if_pos less, Option.some.injEq] at equal; subst result; simp
+      steps := by simpa [destination, Plan.entry] using leading.append suffix }⟩
+  · simp only [less, decide_false, Bool.false_eq_true, ↓reduceIte] at leading
+    have trace : SafeTrace layout returns [.alu .sub .w64 .rax (.reg .rcx)] (operandsState state a b) holes
+        ((operandsState state a b).setReg .rax (a - b)) holes := by
+      simpa [operandsState, AluOp.eval] using SafeTrace.alu layout returns (operandsState state a b) holes .sub .rax (.reg .rcx)
+    obtain ⟨finalMemory, finalView, suffix⟩ := trace.jump outside middleMemory middleView checked ordinary success ordinaryCode valid
+    exact ⟨{
+      count := 5, after := (operandsState state a b).setReg .rax (a - b), memory := finalMemory, holes
+      represented := finalView, safeHoles
+      preserved := (operands_preserves _ _ _ _ _).trans (Preserves.setReg _ _ _ _ _ (by simp))
+      resultAt := by intro result equal; simp only [ExactNat.sub, if_neg less, Option.some.injEq] at equal; subst result; simp
+      steps := by simpa [destination, Plan.entry] using leading.append suffix }⟩
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarSafeFrames.lean b/Ix/Compiler/X86/ScalarSafeFrames.lean
new file mode 100644
index 000000000..f62a4ce2c
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSafeFrames.lean
@@ -0,0 +1,91 @@
+import Ix.Compiler.X86.ScalarSafety
+import Ix.Compiler.X86.WordRegionSafeMacros
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+def pushHoles {layout : Layout} (frame : Frame layout) (holes : Stream.Holes) : Stream.Holes :=
+  Stream.clearRange holes (layout.address frame.baseIndex) 8
+
+def enterHoles {layout : Layout} (frame : Frame layout) (parameters : Nat) (holes : Stream.Holes) : Stream.Holes :=
+  let pushed := pushHoles frame holes
+  let first := if 0 < parameters then Stream.clearRange pushed (layout.address (frame.localIndex 0)) 8 else pushed
+  if 1 < parameters then Stream.clearRange first (layout.address (frame.localIndex 1)) 8 else first
+
+theorem HolesIn.enter {layout : Layout} {rootTop : Nat} {holes : Stream.Holes}
+    (valid : HolesIn layout rootTop holes) (frame : Frame layout) (parameters : Nat) :
+    HolesIn layout rootTop (enterHoles frame parameters holes) := by
+  have pushed := valid.clear (layout.address frame.baseIndex) 8
+  unfold enterHoles pushHoles
+  split <;> (try split)
+  · exact (pushed.clear _ _).clear _ _
+  · exact pushed.clear _ _
+  · exact pushed.clear _ _
+  · exact pushed
+
+theorem frame_safeTrace {layout : Layout} {returns : List ReturnFrame}
+    (frame : Frame layout) (state : State) (holes : Stream.Holes)
+    (stack : state.registers .rsp = layout.address frame.top)
+    (frames : FramesAbove layout frame.top returns) :
+    SafeTrace layout returns [.push .rbp, .mov .w64 .rbp (.reg .rsp), .allocFrame frameSize]
+      state holes (frameState frame state) (pushHoles frame holes) := by
+  have pushed : SafeTrace layout returns [.push .rbp] state holes (pushState frame state) (pushHoles frame holes) :=
+    SafeTrace.push _ _ _ _ _ _ frame.base_bound (by rw [stack, frame.push_address]) (frame.base_disjoint frames)
+  have setBase : SafeTrace layout returns [.mov .w64 .rbp (.reg .rsp)]
+      (pushState frame state) (pushHoles frame holes)
+      ((pushState frame state).setReg .rbp (layout.address frame.baseIndex)) (pushHoles frame holes) := by
+    simpa [pushState] using SafeTrace.mov layout returns (pushState frame state) (pushHoles frame holes) .rbp (.reg .rsp)
+  have allocate : SafeTrace layout returns [.allocFrame frameSize]
+      ((pushState frame state).setReg .rbp (layout.address frame.baseIndex)) (pushHoles frame holes)
+      (frameState frame state) (pushHoles frame holes) := by
+    simpa [frameState, pushState, frame.allocate_address] using
+      SafeTrace.allocFrame layout returns ((pushState frame state).setReg .rbp (layout.address frame.baseIndex))
+        (pushHoles frame holes) frameSize
+  exact pushed.append (setBase.append allocate)
+
+theorem enter_safeTrace {layout : Layout} {returns : List ReturnFrame}
+    (frame : Frame layout) (parameters : Nat) (state : State) (holes : Stream.Holes)
+    (stack : state.registers .rsp = layout.address frame.top)
+    (frames : FramesAbove layout frame.top returns) :
+    SafeTrace layout returns (prologue parameters) state holes
+      (enterState frame parameters state) (enterHoles frame parameters holes) := by
+  have first : SafeTrace layout returns [.spill (slot 0) .rdi] (frameState frame state) (pushHoles frame holes)
+      ((frameState frame state).setWord (frame.localIndex 0) (state.registers .rdi))
+      (Stream.clearRange (pushHoles frame holes) (layout.address (frame.localIndex 0)) 8) := by
+    simpa [frameState, pushState] using SafeTrace.spill layout returns (frameState frame state) (pushHoles frame holes)
+      (slot 0) .rdi (frame.localIndex 0) (frame.local_bound 0)
+      (by simpa [frameState, pushState] using frame.local_address (index := 0) (by decide)) (frame.local_disjoint frames 0)
+  have second (ready : State) (currentHoles : Stream.Holes)
+      (base : ready.registers .rbp = layout.address frame.baseIndex)
+      (argument : ready.registers .rsi = state.registers .rsi) :
+      SafeTrace layout returns [.spill (slot 1) .rsi] ready currentHoles
+        (ready.setWord (frame.localIndex 1) (state.registers .rsi))
+        (Stream.clearRange currentHoles (layout.address (frame.localIndex 1)) 8) := by
+    simpa [argument] using SafeTrace.spill layout returns ready currentHoles (slot 1) .rsi (frame.localIndex 1)
+      (frame.local_bound 1) (by rw [base]; exact frame.local_address (by decide)) (frame.local_disjoint frames 1)
+  unfold prologue enterState enterHoles
+  by_cases one : 0 < parameters
+  · by_cases two : 1 < parameters
+    · simpa only [if_pos one, if_pos two] using
+        ((frame_safeTrace frame state holes stack frames).append first).append
+          (second _ _ (by simp [frameState, pushState]) (by simp [frameState, pushState]))
+    · simpa only [if_pos one, if_neg two, List.append_nil] using
+        (frame_safeTrace frame state holes stack frames).append first
+  · have two : ¬1 < parameters := by omega
+    simpa only [if_neg one, if_neg two, List.append_nil] using frame_safeTrace frame state holes stack frames
+
+theorem leave_safeTrace {layout : Layout} {returns : List ReturnFrame} {rootTop : Nat}
+    (frame : Frame layout) (state : State) (holes : Stream.Holes) (framed : Framed frame state)
+    (valid : HolesIn layout rootTop holes) :
+    SafeTrace layout returns epilogue state holes (leaveState frame state) holes := by
+  have freed : SafeTrace layout returns [.freeFrame frameSize] state holes
+      (state.setReg .rsp (layout.address frame.baseIndex)) holes := by
+    simpa [framed.2, frame.free_address] using SafeTrace.freeFrame layout returns state holes frameSize
+  have popped : SafeTrace layout returns [.pop .rbp] (state.setReg .rsp (layout.address frame.baseIndex)) holes
+      (leaveState frame state) holes := by
+    simpa [leaveState, frame.pop_address] using SafeTrace.pop layout returns
+      (state.setReg .rsp (layout.address frame.baseIndex)) holes .rbp frame.baseIndex frame.base_bound (by simp)
+      (valid.readable frame.base_bound (.inl frame.base_ordinary))
+  exact freed.append popped
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarSafety.lean b/Ix/Compiler/X86/ScalarSafety.lean
new file mode 100644
index 000000000..62bcb2cc9
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSafety.lean
@@ -0,0 +1,90 @@
+import Ix.Compiler.X86.ScalarFrames
+import Ix.Compiler.X86.WordRegionSafeTrace
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem byte_slots_distinct {layout : Layout} {left right a b : Nat}
+    (leftBound : left < layout.slots) (rightBound : right < layout.slots)
+    (different : left ≠ right) (aBound : a < 8) (bBound : b < 8) :
+    layout.address left + UInt64.ofNat a ≠ layout.address right + UInt64.ofNat b := by
+  intro equal
+  have equal := congrArg UInt64.toNat equal
+  rw [layout.byteAddress_toNat leftBound aBound, layout.byteAddress_toNat rightBound bBound] at equal
+  omega
+
+def FramesAbove (layout : Layout) (top : Nat) (returns : List ReturnFrame) : Prop :=
+  ∀ frame ∈ returns, ∃ index, index < layout.slots ∧ top ≤ index ∧ frame.returnSlot = layout.address index
+
+theorem FramesAbove.disjoint {layout : Layout} {top index : Nat} {returns : List ReturnFrame}
+    (frames : FramesAbove layout top returns) (bound : index < layout.slots) (below : index < top) :
+    Stream.FramesDisjoint returns (layout.address index) 8 := by
+  intro frame member i iBound j jBound
+  obtain ⟨slot, slotBound, above, address⟩ := frames frame member
+  rw [address]
+  exact byte_slots_distinct slotBound bound (by omega) iBound jBound
+
+/-- Internal calls write structural return tokens at slot 33 modulo 34.
+The external caller's return slot is excluded from this set. -/
+def HolesIn (layout : Layout) (rootTop : Nat) (holes : Stream.Holes) : Prop :=
+  ∀ address, holes address → ∃ slot offset,
+    slot < layout.slots ∧ slot < rootTop ∧ slot % frameStride = 33 ∧ offset < 8 ∧
+      address = layout.address slot + UInt64.ofNat offset
+
+theorem HolesIn.empty (layout : Layout) (rootTop : Nat) : HolesIn layout rootTop (fun _ => False) :=
+  fun _ impossible => impossible.elim
+
+theorem HolesIn.mono {layout : Layout} {rootTop : Nat} {holes smaller : Stream.Holes}
+    (valid : HolesIn layout rootTop holes) (subset : ∀ address, smaller address → holes address) :
+    HolesIn layout rootTop smaller := fun address hidden => valid address (subset address hidden)
+
+theorem HolesIn.clear {layout : Layout} {rootTop : Nat} {holes : Stream.Holes}
+    (valid : HolesIn layout rootTop holes) (address : Word) (count : Nat) :
+    HolesIn layout rootTop (Stream.clearRange holes address count) := valid.mono (fun _ h => h.1)
+
+theorem HolesIn.add_return {layout : Layout} {rootTop index : Nat} {holes : Stream.Holes}
+    (valid : HolesIn layout rootTop holes) (bound : index < layout.slots) (below : index < rootTop)
+    (partition : index % frameStride = 33) :
+    HolesIn layout rootTop (Stream.addRange holes (layout.address index) 8) := by
+  intro address hidden
+  rcases hidden with old | ⟨offset, offsetBound, equal⟩
+  · exact valid address old
+  · exact ⟨index, offset, bound, below, partition, offsetBound, equal⟩
+
+theorem HolesIn.readable {layout : Layout} {rootTop index : Nat} {holes : Stream.Holes}
+    (valid : HolesIn layout rootTop holes) (bound : index < layout.slots)
+    (ordinary : index % frameStride ≠ 33 ∨ rootTop ≤ index) :
+    Stream.ReadableData holes (layout.address index) 8 := by
+  intro offset offsetBound hidden
+  obtain ⟨slot, slotOffset, slotBound, below, partition, small, equal⟩ := valid _ hidden
+  have different : index ≠ slot := by
+    intro same
+    subst slot
+    rcases ordinary with normal | high
+    · exact normal partition
+    · omega
+  exact byte_slots_distinct bound slotBound different offsetBound small equal
+
+theorem Frame.local_ordinary {layout : Layout} (frame : Frame layout) {index : Nat} (bound : index < maxLocals) :
+    frame.localIndex index % frameStride ≠ 33 := by
+  have partition := frame.partition
+  have enough := frame.enough
+  simp only [Frame.localIndex, maxLocals, frameStride] at *
+  omega
+
+theorem Frame.base_ordinary {layout : Layout} (frame : Frame layout) : frame.baseIndex % frameStride ≠ 33 := by
+  have partition := frame.partition
+  have enough := frame.enough
+  simp only [Frame.baseIndex, frameStride] at *
+  omega
+
+theorem Frame.local_disjoint {layout : Layout} {returns : List ReturnFrame} (frame : Frame layout)
+    (frames : FramesAbove layout frame.top returns) (index : Nat) :
+    Stream.FramesDisjoint returns (layout.address (frame.localIndex index)) 8 :=
+  frames.disjoint (frame.local_bound index) (by have := frame.enough; simp only [Frame.localIndex]; omega)
+
+theorem Frame.base_disjoint {layout : Layout} {returns : List ReturnFrame} (frame : Frame layout)
+    (frames : FramesAbove layout frame.top returns) : Stream.FramesDisjoint returns (layout.address frame.baseIndex) 8 :=
+  frames.disjoint frame.base_bound (by have := frame.enough; simp only [Frame.baseIndex]; omega)
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarSimulation.lean b/Ix/Compiler/X86/ScalarSimulation.lean
new file mode 100644
index 000000000..8784a4abc
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSimulation.lean
@@ -0,0 +1,135 @@
+import Ix.Compiler.X86.ScalarCalls
+
+namespace Ix.Compiler.X86.Scalar
+open WordRegion
+
+theorem Checked.function_valid (checked : Checked) {index : Nat} {function : Function}
+    (found : checked.program.functions[index]? = some function) :
+    function.parameters ≤ 2 ∧ function.body.valid checked.program.functions index function.parameters = true := by
+  have valid := checked.valid
+  simp only [Program.valid, Bool.and_eq_true] at valid
+  have member : (function, index) ∈ checked.program.functions.toList.zipIdx :=
+    List.mk_mem_zipIdx_iff_getElem?.mpr (by simpa using found)
+  have accepted := List.all_eq_true.mp valid.2 (function, index) member
+  simp only [Bool.and_eq_true, decide_eq_true_eq] at accepted
+  exact ⟨accepted.1.1, accepted.2⟩
+
+theorem Output.function_code {checked : Checked} (output : Output checked) {index : Nat} {function : Function}
+    (found : checked.program.functions[index]? = some function) :
+    ∃ plan, output.plans[index]? = some plan ∧
+      FunctionCode output.target (output.plans.map (·.entry)) function plan := by
+  obtain ⟨bound, equal⟩ := Array.getElem?_eq_some_iff.mp found
+  have planBound : index < output.plans.size := by rw [output.size]; exact bound
+  have accepted := Array.all_eq_true.mp output.verified index (by simp [Array.size_zip, output.size, bound])
+  simp only [Array.getElem_zip, equal] at accepted
+  exact ⟨output.plans[index], Array.getElem?_eq_getElem planBound, FunctionPlan.code accepted⟩
+
+/-- Structural compilation preserves every evaluation in the admitted
+language, including overflow. The stack premise depends only on function
+rank, never on runtime values or an x86 execution certificate. -/
+theorem Evaluates.native {checked : Checked} (output : Output checked)
+    {expression : Expr} {values : Array Word} {result : Option Word}
+    (evaluated : Evaluates checked.program.functions expression values result) :
+    ∀ (current : Nat) (plan : Plan) (success failure : BlockId) (layout : Layout) (frame : Frame layout)
+      (rootTop : Nat) (returns : List ReturnFrame),
+      expression.valid checked.program.functions current values.size = true →
+      plan.expression = expression →
+      plan.matches output.target.program (output.plans.map (·.entry)) values.size success failure = true →
+      output.target.program.hasBlock success = true → output.target.program.hasBlock failure = true →
+      frameStride * (current + 1) - 1 ≤ frame.top → frame.top ≤ rootTop →
+      ExprContract output.target plan success failure layout frame values rootTop returns result := by
+  induction evaluated with
+  | atom found =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      intro outside memory state holes framed valuesAt safeHoles frames represented
+      exact atom_run (blockMatches_code matched) successValid framed valuesAt safeHoles represented found
+  | add leftValue rightValue =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      intro outside memory state holes framed valuesAt safeHoles frames represented
+      exact add_run (blockMatches_code matched) successValid failureValid framed valuesAt safeHoles represented leftValue rightValue
+  | sub leftValue rightValue =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      intro outside memory state holes framed valuesAt safeHoles frames represented
+      exact sub_run (blockMatches_code matched.1.1) (blockMatches_code matched.1.2) (blockMatches_code matched.2)
+        successValid framed valuesAt safeHoles represented leftValue rightValue
+  | @letE values value body bound result first rest ihFirst ihRest =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      rename_i join valuePlan bodyPlan
+      simp only [Expr.valid, Bool.and_eq_true, decide_eq_true_eq] at valid
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact let_contract valid.1.1 (blockMatches_code matched.1.1) (Plan.entry_valid matched.2)
+        (ihFirst current valuePlan join failure layout frame rootTop returns valid.1.2 rfl matched.1.2
+          (blockMatches_code matched.1.1).hasBlock failureValid capacity below)
+        (ihRest current bodyPlan success failure layout frame rootTop returns (by simpa using valid.2) rfl
+          (by simpa using matched.2) successValid failureValid capacity below)
+  | @letOverflow values value body first ihFirst =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      rename_i join valuePlan bodyPlan
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact let_overflow_contract (ihFirst current valuePlan join failure layout frame rootTop returns valid.1.2 rfl matched.1.2
+        (blockMatches_code matched.1.1).hasBlock failureValid capacity below)
+  | @zero values scrutinee zero successor result scrutineeValue taken ih =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      rename_i entry zeroPlan successorPlan
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact branch_contract scrutineeValue (blockMatches_code matched.1.1)
+        (by simpa using Plan.entry_valid matched.1.2)
+        (by simpa using (ih current zeroPlan success failure layout frame rootTop returns valid.1.2 rfl matched.1.2
+          successValid failureValid capacity below))
+  | @successor values scrutinee zero successor value result scrutineeValue positive taken ih =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      rename_i entry zeroPlan successorPlan
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      simp only [Plan.matches, Bool.and_eq_true] at matched
+      exact branch_contract scrutineeValue (blockMatches_code matched.1.1)
+        (by simpa [positive] using Plan.entry_valid matched.2)
+        (by simpa [positive] using (ih current successorPlan success failure layout frame rootTop returns valid.2 rfl matched.2
+          successValid failureValid capacity below))
+  | @call values supplied function arguments callee result found argumentsAt arity evaluated ih =>
+      intro current plan success failure layout frame rootTop returns valid same matched successValid failureValid capacity below
+      cases plan <;> cases same
+      rename_i entry
+      simp only [Expr.valid, found, Bool.and_eq_true, decide_eq_true_eq, beq_iff_eq] at valid
+      obtain ⟨calleePlan, planFound, calleeCode⟩ := output.function_code found
+      have entryFound : (output.plans.map (·.entry))[function]? = some calleePlan.entry := by simp [planFound]
+      simp only [Plan.matches, entryFound] at matched
+      have enough : 67 ≤ frame.top := by simp only [frameStride] at capacity; omega
+      apply call_contract enough below valid.1.1.2 argumentsAt (blockMatches_code matched) calleeCode successValid failureValid
+      intro activeReturns
+      apply function_contract calleeCode arity
+      apply ih function calleePlan.body calleePlan.success calleePlan.failure layout (frame.child enough) rootTop activeReturns
+      · simpa only [arity] using (checked.function_valid found).2
+      · exact calleeCode.expression
+      · simpa only [arity] using calleeCode.body
+      · exact calleeCode.success.hasBlock
+      · exact calleeCode.failure.hasBlock
+      · simp only [Frame.child, frameStride] at *
+        omega
+      · simp only [Frame.child, frameStride]
+        omega
+
+theorem Output.function_contract {checked : Checked} (output : Output checked)
+    {index : Nat} {function : Function} {plan : FunctionPlan} {values : Array Word} {result : Option Word}
+    {layout : Layout} {frame : Frame layout} {rootTop : Nat} {returns : List ReturnFrame}
+    (found : checked.program.functions[index]? = some function)
+    (code : FunctionCode output.target (output.plans.map (·.entry)) function plan)
+    (arity : values.size = function.parameters)
+    (evaluated : Evaluates checked.program.functions function.body values result)
+    (capacity : frameStride * (index + 1) - 1 ≤ frame.top) (below : frame.top ≤ rootTop) :
+    FunctionContract output.target plan layout frame values rootTop returns result :=
+  Scalar.function_contract code arity
+    (evaluated.native output index plan.body plan.success plan.failure layout frame rootTop returns
+      (by simpa only [arity] using (checked.function_valid found).2) code.expression
+      (by simpa only [arity] using code.body) code.success.hasBlock code.failure.hasBlock capacity below)
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarSourceApply.lean b/Ix/Compiler/X86/ScalarSourceApply.lean
new file mode 100644
index 000000000..9075729c4
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSourceApply.lean
@@ -0,0 +1,122 @@
+import Ix.Compiler.X86.ScalarSourceSelect
+import Ix.Compiler.Pipeline
+import Ix.Compiler.SimApply
+
+namespace Ix.Compiler.X86.Scalar.Source
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.Recursion
+open Ix.Compiler.IxIR0.NatArithmetic (Represents)
+
+def Selected.rawBody {declarations root} (selected : Selected declarations root) : IxIR0.Expr :=
+  expression selected.primitives selected.entries (parameters 2) selected.entryFunction.body
+
+def Selected.rawFunction {declarations root} (selected : Selected declarations root) : IxIR0.Value :=
+  .clos .many [] (.lam .many selected.rawBody)
+
+theorem Selected.evaluates {declarations root} (selected : Selected declarations root) :
+    IxIR0.Recursion.Evaluates { env := IxIR0.Env.ofList declarations } [] (.ref root) selected.rawFunction := by
+  obtain ⟨address, found, declared⟩ := selected.matched.functions _ _ selected.functionFound
+  have same : address = root := Option.some.inj (found.symm.trans selected.rootFound)
+  subst address
+  have declared : IxIR0.Env.ofList declarations root =
+      some (.defn .shared (.lam .many (.lam .many selected.rawBody))) := by
+    simpa only [functionBody, selected.binary, lambda, Selected.rawBody] using declared
+  exact evaluatesDef declared (evaluatesLam _ _ _ _)
+
+theorem Selected.applies {declarations root} (selected : Selected declarations root)
+    {left right : IxIR0.Value} {a b number : Nat}
+    (leftRep : Represents selected.primitives.arithmetic left a)
+    (rightRep : Represents selected.primitives.arithmetic right b)
+    (evaluated : NatEvaluates selected.scalar.program.functions selected.entryFunction.body #[a, b] number) :
+    ∃ result,
+      Applies { env := IxIR0.Env.ofList declarations } selected.rawFunction left (.clos .many [left] selected.rawBody) ∧
+      Applies { env := IxIR0.Env.ofList declarations } (.clos .many [left] selected.rawBody) right result ∧
+      Represents selected.primitives.arithmetic result number := by
+  have valid := (selected.scalar.function_valid selected.functionFound).2
+  obtain ⟨result, bodyRun, resultRep⟩ := raw_evaluates selected.matched evaluated selected.scalar.program.entry
+    (by simpa [selected.binary] using valid)
+    _ _ (bindings_two leftRep rightRep)
+  exact ⟨result, appliesClosure (evaluatesLam _ _ _ _), appliesClosure bodyRun, resultRep⟩
+
+theorem applies_unique {ctx : IxIR0.Ctx} {function argument left right : IxIR0.Value}
+    (first : Applies ctx function argument left) (second : Applies ctx function argument right) : left = right := by
+  obtain ⟨a, first⟩ := first
+  obtain ⟨b, second⟩ := second
+  exact Except.ok.inj ((IxIR0.apply_mono (fuel' := a + b) (by omega) first).symm.trans
+    (IxIR0.apply_mono (fuel' := a + b) (by omega) second))
+
+/-- Reuse the checked source erasure certificate for an exported closure.
+The later native attachment does not alter or revalidate source semantics. -/
+theorem Selected.sourceFunction
+    {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel)
+    (selected : Selected source.erasure.result.raw root)
+    {fuel : Nat} {function : Ixon.Eval.Value}
+    (oracles : @Sim.OracleRel source.memberScope (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList source.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (evaluated : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) fuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok function) :
+    @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList source.erasure.result.raw } function selected.rawFunction source.memberScope := by
+  letI : Sim.MemberScope := source.memberScope
+  have frameWF : (Pipeline.validatedMainFrame root).SharingWF := by
+    constructor
+    · rfl
+    · intro index member found
+      simp [Pipeline.validatedMainFrame] at found
+  have inlined := Ixon.Eval.eval_inlineSharing contextWF frameWF .nil (by rfl) evaluated
+  have entry := source.entry.related
+  rw [EraseValidator.inlineTables_tablesOfFrame] at entry
+  obtain ⟨targetFuel, value, run, related⟩ := Sim.erasure_sim_with_members source.members oracles inlined.1 entry (by
+    simpa [Ixon.Eval.valuesInlineSharing] using
+      (Sim.EnvRel.nil (ectx := (Pipeline.validatedEvalCtx constants config).inlineSharing)
+        (ictx := { env := IxIR0.Env.ofList source.erasure.result.raw })
+        (refs := (Pipeline.validatedMainFrame root).inlineSharing.refs)
+        (muts := (Pipeline.validatedMainFrame root).inlineSharing.selfMuts)
+        (sa := (Pipeline.validatedMainFrame root).inlineSharing.selfAddr)))
+  rw [source.entryTarget] at run
+  have same := (IxIR0.Recursion.Evaluates.unique ⟨targetFuel, run⟩ selected.evaluates)
+  exact same ▸ related
+
+theorem Selected.sourceApplies
+    {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel)
+    (selected : Selected source.erasure.result.raw root)
+    {function left right intermediate result : Ixon.Eval.Value} {fuel firstFuel secondFuel : Nat}
+    {rawLeft rawRight : IxIR0.Value} {a b number : Nat}
+    (oracles : @Sim.OracleRel source.memberScope (Pipeline.validatedEvalCtx constants config).inlineSharing
+      { env := IxIR0.Env.ofList source.erasure.result.raw })
+    (contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF)
+    (functionWF : function.SharingWF) (leftWF : left.SharingWF) (rightWF : right.SharingWF)
+    (entry : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) fuel
+      (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok function)
+    (first : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config) firstFuel function left = .ok intermediate)
+    (second : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config) secondFuel intermediate right = .ok result)
+    (leftRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList source.erasure.result.raw } left rawLeft source.memberScope)
+    (rightRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+      { env := IxIR0.Env.ofList source.erasure.result.raw } right rawRight source.memberScope)
+    (leftRep : Represents selected.primitives.arithmetic rawLeft a)
+    (rightRep : Represents selected.primitives.arithmetic rawRight b)
+    (evaluated : NatEvaluates selected.scalar.program.functions selected.entryFunction.body #[a, b] number) :
+    ∃ rawResult,
+      @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+        { env := IxIR0.Env.ofList source.erasure.result.raw } result rawResult source.memberScope ∧
+      Represents selected.primitives.arithmetic rawResult number := by
+  letI : Sim.MemberScope := source.memberScope
+  have functionRel := selected.sourceFunction source oracles contextWF entry
+  obtain ⟨rawResult, firstRun, secondRun, resultRep⟩ := selected.applies leftRep rightRep evaluated
+  obtain ⟨firstTargetFuel, middle, applied, middleRel⟩ := Sim.apply_sim_inlineSharing
+    source.members oracles contextWF functionWF leftWF first functionRel leftRel
+  have same := applies_unique ⟨firstTargetFuel, applied⟩ firstRun
+  subst middle
+  have middleWF := (Ixon.Eval.apply_inlineSharing contextWF functionWF leftWF first).2
+  obtain ⟨secondTargetFuel, finalValue, applied, resultRel⟩ := Sim.apply_sim_inlineSharing
+    source.members oracles contextWF middleWF rightWF second middleRel rightRel
+  have same := applies_unique ⟨secondTargetFuel, applied⟩ secondRun
+  exact ⟨rawResult, same ▸ resultRel, resultRep⟩
+
+end Ix.Compiler.X86.Scalar.Source
diff --git a/Ix/Compiler/X86/ScalarSourceObject.lean b/Ix/Compiler/X86/ScalarSourceObject.lean
new file mode 100644
index 000000000..ba8384426
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSourceObject.lean
@@ -0,0 +1,118 @@
+import Ix.Compiler.X86.ScalarSourceApply
+import Ix.Compiler.IxIR1.Optimizer
+
+namespace Ix.Compiler.X86.Scalar.Source
+open Ix.Compiler.Ixon (Address Constant)
+open Ix.Compiler.IxIR0.NatArithmetic (Represents)
+
+def policy : String := "source-scalar-runtime/1"
+
+/-- The source certificate, selected runtime graph, instruction stream, and
+actual ELF bytes are attached once, independently of runtime arguments. -/
+structure Compiled {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel) where
+  selected : Selected source.erasure.result.raw root
+  native : Output selected.scalar
+  stream : Stream.Certified native.target
+  input : ELF.Input
+  encoded : input.encoded = stream.output
+  entry : input.entryBlock = native.target.program.entry
+  object : ELF.Certified input
+
+def compile {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel)
+    (name : String := "compilatrix_scalar") : Except String (Compiled source) := do
+  let selected ← select source.erasure.result.raw root
+  let native ← Scalar.compile selected.scalar
+  let stream ← (Stream.encode native.target).mapError reprStr
+  let graphRoot := IxIR1.Optimizer.graphRoot source.artifact.targetArtifacts source.artifact.main
+  let input : ELF.Input := {
+    encoded := stream.output, entryBlock := native.target.program.entry, exportName := name
+    provenance := .ixir1Policy graphRoot 5 1 }
+  let object ← (ELF.writeChecked input).mapError reprStr
+  return { selected, native, stream, input, encoded := rfl, entry := rfl, object }
+
+theorem Compiled.nativeReturns
+    {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+    {source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel}
+    (compiled : Compiled source) (left right : Word) (stack : Stack)
+    (depth : compiled.selected.scalar.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : ArgumentsAt #[left, right] ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ result, Evaluates compiled.selected.scalar.program.functions compiled.selected.entryFunction.body #[left, right] result ∧
+      Nonempty (ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack result) := by
+  have arity : #[left, right].size = compiled.selected.entryFunction.parameters := by simp [compiled.selected.binary]
+  obtain ⟨result, evaluated⟩ := compiled.selected.scalar.function_total _ _ compiled.selected.functionFound _ arity
+  obtain ⟨executed⟩ := compiled.native.root_run compiled.selected.functionFound arity evaluated stack depth core
+    stackPointer arguments readable writable
+  have stream : Stream.Valid compiled.native.target.program compiled.input.encoded := by
+    rw [compiled.encoded]
+    exact compiled.stream.valid
+  exact ⟨result, evaluated, executed.objectResult stream compiled.object.valid compiled.entry base flags⟩
+
+/-- A successful source call and the existing source/raw value relation.
+These are source obligations; no scalar, typed x86, or byte run is assumed. -/
+structure Invocation {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config}
+    {eraseFuel lowerFuel : Nat}
+    (source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel)
+    (selected : Selected source.erasure.result.raw root) (a b : Nat) (result : Ixon.Eval.Value) where
+  function : Ixon.Eval.Value
+  left : Ixon.Eval.Value
+  right : Ixon.Eval.Value
+  intermediate : Ixon.Eval.Value
+  rawLeft : IxIR0.Value
+  rawRight : IxIR0.Value
+  fuel : Nat
+  firstFuel : Nat
+  secondFuel : Nat
+  oracles : @Sim.OracleRel source.memberScope (Pipeline.validatedEvalCtx constants config).inlineSharing
+    { env := IxIR0.Env.ofList source.erasure.result.raw }
+  contextWF : (Pipeline.validatedEvalCtx constants config).SharingWF
+  functionWF : function.SharingWF
+  leftWF : left.SharingWF
+  rightWF : right.SharingWF
+  entry : Ixon.Eval.eval (Pipeline.validatedEvalCtx constants config) fuel
+    (Pipeline.validatedMainFrame root) [] Pipeline.validatedMainSource = .ok function
+  first : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config) firstFuel function left = .ok intermediate
+  second : Ixon.Eval.apply (Pipeline.validatedEvalCtx constants config) secondFuel intermediate right = .ok result
+  leftRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList source.erasure.result.raw } left rawLeft source.memberScope
+  rightRel : @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+    { env := IxIR0.Env.ofList source.erasure.result.raw } right rawRight source.memberScope
+  leftRep : Represents selected.primitives.arithmetic rawLeft a
+  rightRep : Represents selected.primitives.arithmetic rawRight b
+
+/-- Every compiled binary source function returns safely from its actual
+ELF for every pair of runtime Words and every sufficiently mapped stack.
+Success refines the source Nat; overflow returns the explicit fallback tag. -/
+theorem Compiled.sourceReturns
+    {constants : List (Address × Constant)} {root : Address} {config : Pipeline.Config} {eraseFuel lowerFuel : Nat}
+    {source : Pipeline.ValidatedCompilation constants root config .shared eraseFuel lowerFuel}
+    (compiled : Compiled source) (left right : Word) {sourceResult : Ixon.Eval.Value}
+    (invocation : Invocation source compiled.selected left.toNat right.toNat sourceResult)
+    (stack : Stack) (depth : compiled.selected.scalar.program.entry < stack.depth) (core : Core)
+    (stackPointer : core.readReg .rsp = stack.layout.address stack.frame.top)
+    (arguments : ArgumentsAt #[left, right] ⟨core.registers, fun index => core.memory.read64 (stack.layout.address index)⟩)
+    (readable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.readable (stack.layout.address index) 8 = true)
+    (writable : ∀ index < stack.layout.slots, Memory.rangeAllowed core.memory.writable (stack.layout.address index) 8 = true)
+    (base : Word) (flags : ByteEval.Flags) :
+    ∃ result, Nonempty (ObjectResult compiled.object.bytes compiled.input.exportName base flags core stack result) ∧
+      ∀ word, result = some word → ∃ rawResult,
+        @Sim.InlinedValRel (Pipeline.validatedEvalCtx constants config)
+          { env := IxIR0.Env.ofList source.erasure.result.raw } sourceResult rawResult source.memberScope ∧
+        Represents compiled.selected.primitives.arithmetic rawResult word.toNat := by
+  obtain ⟨result, evaluated, native⟩ := compiled.nativeReturns left right stack depth core stackPointer arguments readable writable base flags
+  refine ⟨result, native, ?_⟩
+  intro word success
+  have exactNat := evaluated.exact word success
+  apply compiled.selected.sourceApplies source invocation.oracles invocation.contextWF invocation.functionWF
+    invocation.leftWF invocation.rightWF invocation.entry invocation.first invocation.second
+    invocation.leftRel invocation.rightRel invocation.leftRep invocation.rightRep
+  simpa using exactNat
+
+end Ix.Compiler.X86.Scalar.Source
diff --git a/Ix/Compiler/X86/ScalarSourceSelect.lean b/Ix/Compiler/X86/ScalarSourceSelect.lean
new file mode 100644
index 000000000..93d4d1394
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSourceSelect.lean
@@ -0,0 +1,148 @@
+import Ix.Compiler.X86.ScalarSourceSim
+
+namespace Ix.Compiler.X86.Scalar.Source
+open Ix.Compiler.Ixon (Address)
+
+def findDeclaration (declarations : List (Address × IxIR0.Decl)) (wanted : IxIR0.Decl) : Option Address :=
+  (declarations.find? (fun pair => pair.2 == wanted)).map (·.1)
+
+/-- Primitive names are discovered from complete evaluator bodies. A name,
+hash, or extern declaration alone never enables native arithmetic. -/
+def discover (declarations : List (Address × IxIR0.Decl)) : Option Primitives := do
+  let ctx : IxIR0.Ctx := { env := IxIR0.Env.ofList declarations }
+  for (alias, declaration) in declarations do
+    if let .defn .shared (.ref recursor) := declaration then
+      for (successor, declaration) in declarations do
+        if declaration == .ctor 1 1 then
+          let arithmetic : NatSchema := { successor, recursor, alias }
+          if IxIR0.NatArithmetic.Matches ctx arithmetic then
+            if let some addition := findDeclaration declarations (.defn .shared (IxIR0.NatArithmetic.body arithmetic)) then
+              if let some predecessor := findDeclaration declarations (.defn .shared (IxIR0.NatArithmetic.predBody arithmetic)) then
+                if let some subtraction := findDeclaration declarations (.defn .shared (IxIR0.NatArithmetic.subBody arithmetic predecessor)) then
+                  if let some caseRecursor := findDeclaration declarations (.recursor 2 true IxIR0.NatArithmetic.caseRules) then
+                    if let some caseAlias := findDeclaration declarations (.defn .shared (.ref caseRecursor)) then
+                      let primitives : Primitives := { arithmetic, addition, predecessor, subtraction, caseRecursor, caseAlias }
+                      if primitives.Matches ctx then return primitives
+  none
+
+def lowerAtom (bindings : Array Binding) : IxIR0.Expr → Except String Atom
+  | .var index =>
+      match bindings.findIdx? (· == .var index) with
+      | some localIndex => .ok (.var localIndex)
+      | none => .error "scalar source variable is outside the admitted bindings"
+  | .lit (.nat number) | .app (.lam .many (.lit (.nat number))) .erased =>
+      match ExactNat.encode number with
+      | some word => .ok (.constant word)
+      | none => .error "scalar source literal does not fit an exact 64-bit Nat"
+  | _ => .error "scalar source operand must be a bound Nat or a Nat literal"
+
+def functionParts : IxIR0.Expr → Except String (Nat × IxIR0.Expr)
+  | .lam .many (.lam .many body) =>
+      match body with
+      | .lam _ _ => .error "scalar source function has more than two parameters"
+      | _ => .ok (2, body)
+  | .lam .many body =>
+      match body with
+      | .lam _ _ => .error "scalar source parameter uses are unsupported"
+      | _ => .ok (1, body)
+  | .lam _ _ => .error "scalar source parameter uses are unsupported"
+  | body => .ok (0, body)
+
+abbrev Functions := Array (Address × Function)
+
+mutual
+  def lowerFunction (ctx : IxIR0.Ctx) (primitives : Primitives) :
+      Nat → Functions → Address → Except String (Functions × Nat)
+    | 0, _, _ => .error "scalar source call graph exceeds the depth limit or is recursive"
+    | fuel + 1, functions, address => do
+        if let some index := functions.findIdx? (·.1 == address) then return (functions, index)
+        let some (.defn .shared body) := ctx.env address | throw "scalar source callee must be a shared definition"
+        let (parameters, body) ← functionParts body
+        let (functions, body) ← lowerExpression ctx primitives fuel functions (Source.parameters parameters) body
+        if functions.size >= maxFunctions then throw "scalar source has too many functions"
+        return (functions.push (address, { parameters, body }), functions.size)
+
+  def lowerExpression (ctx : IxIR0.Ctx) (primitives : Primitives) :
+      Nat → Functions → Array Binding → IxIR0.Expr → Except String (Functions × Expr)
+    | 0, _, _, _ => .error "scalar source expression exceeds the depth limit"
+    | fuel + 1, functions, bindings, expr => do
+        match expr with
+        | .letE .many value body =>
+            let (functions, value) ← lowerExpression ctx primitives fuel functions bindings value
+            let (functions, body) ← lowerExpression ctx primitives fuel functions (push bindings) body
+            return (functions, .letE value body)
+        | .app (.app (.app (.ref address) (.lam .many zero)) (.lam .many successor)) scrutinee =>
+            if address != primitives.caseAlias then throw "scalar source branch must use the checked Nat case recursor"
+            let scrutinee ← lowerAtom bindings scrutinee
+            let (functions, zero) ← lowerExpression ctx primitives fuel functions (lift bindings) zero
+            let (functions, successor) ← lowerExpression ctx primitives fuel functions (lift bindings) successor
+            return (functions, .branch scrutinee zero successor)
+        | .app (.app (.ref address) left) right =>
+            let left ← lowerAtom bindings left
+            let right ← lowerAtom bindings right
+            if address == primitives.addition then return (functions, .add left right)
+            if address == primitives.subtraction then return (functions, .sub left right)
+            let (functions, callee) ← lowerFunction ctx primitives fuel functions address
+            return (functions, .call callee #[left, right])
+        | .app (.ref address) argument =>
+            let argument ← lowerAtom bindings argument
+            let (functions, callee) ← lowerFunction ctx primitives fuel functions address
+            return (functions, .call callee #[argument])
+        | .ref address =>
+            let (functions, callee) ← lowerFunction ctx primitives fuel functions address
+            return (functions, .call callee #[])
+        | _ => return (functions, .atom (← lowerAtom bindings expr))
+end
+
+def programMatches (ctx : IxIR0.Ctx) (primitives : Primitives) (entries : Array Address) (program : Program) : Bool :=
+  entries.size == program.functions.size &&
+    (entries.zip program.functions).all (fun (address, function) =>
+      ctx.env address == some (.defn .shared (functionBody primitives entries function)))
+
+theorem programMatches_sound {ctx : IxIR0.Ctx} {primitives : Primitives} {entries : Array Address} {program : Program}
+    (primitiveMatches : primitives.Matches ctx) (accepted : programMatches ctx primitives entries program = true) :
+    ProgramMatches ctx primitives entries program := by
+  simp only [programMatches, Bool.and_eq_true, beq_iff_eq] at accepted
+  refine ⟨primitiveMatches, accepted.1, ?_⟩
+  intro index function found
+  obtain ⟨bound, equal⟩ := Array.getElem?_eq_some_iff.mp found
+  have entryBound : index < entries.size := by rw [accepted.1]; exact bound
+  have selected := Array.all_eq_true.mp accepted.2 index (by simp [Array.size_zip, accepted.1, bound])
+  simp only [Array.getElem_zip, equal, beq_iff_eq] at selected
+  exact ⟨entries[index], Array.getElem?_eq_getElem entryBound, selected⟩
+
+structure Selected (declarations : List (Address × IxIR0.Decl)) (root : Address) where
+  primitives : Primitives
+  entries : Array Address
+  scalar : Checked
+  matched : ProgramMatches { env := IxIR0.Env.ofList declarations } primitives entries scalar.program
+  rootFound : entries[scalar.program.entry]? = some root
+  entryFunction : Function
+  functionFound : scalar.program.functions[scalar.program.entry]? = some entryFunction
+  binary : entryFunction.parameters = 2
+
+/-- The first source ABI exports two runtime Nats. Internal helpers may
+have zero, one, or two parameters. Selection does no per-input evaluation. -/
+def select (declarations : List (Address × IxIR0.Decl)) (root : Address) : Except String (Selected declarations root) := do
+  let some primitives := discover declarations | throw "scalar source primitive bodies are missing or unsupported"
+  let ctx : IxIR0.Ctx := { env := IxIR0.Env.ofList declarations }
+  let (functions, entry) ← lowerFunction ctx primitives 128 #[] root
+  let entries := functions.map (·.1)
+  let some scalar := Scalar.check { functions := functions.map (·.2), entry }
+    | throw "scalar source graph exceeds its arity, scope, call-order, or size limits"
+  if primitiveMatches : primitives.Matches ctx then
+    if accepted : programMatches ctx primitives entries scalar.program = true then
+      if rootFound : entries[scalar.program.entry]? = some root then
+        match functionFound : scalar.program.functions[scalar.program.entry]? with
+        | none => throw "scalar source entry is missing"
+        | some entryFunction =>
+            if binary : entryFunction.parameters = 2 then
+              return {
+                primitives, entries, scalar, matched := programMatches_sound primitiveMatches accepted
+                rootFound, entryFunction, functionFound, binary }
+            else throw "scalar source entry must accept two runtime Nats"
+      else throw "scalar source entry does not match the selected root"
+    else throw "scalar source reconstruction certificate failed"
+  else throw "scalar source primitive certificate failed"
+
+end Ix.Compiler.X86.Scalar.Source
diff --git a/Ix/Compiler/X86/ScalarSourceSim.lean b/Ix/Compiler/X86/ScalarSourceSim.lean
new file mode 100644
index 000000000..cf1802514
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSourceSim.lean
@@ -0,0 +1,119 @@
+import Ix.Compiler.X86.ScalarSourceSyntax
+
+namespace Ix.Compiler.X86.Scalar.Source
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR0.Recursion
+open Ix.Compiler.IxIR0.NatArithmetic (Represents)
+
+/-- Every expression accepted by the source shape checker implements the
+unbounded scalar semantics in the existing IxIR₀ evaluator. -/
+theorem raw_evaluates {checked : Checked} {ctx : IxIR0.Ctx} {primitives : Primitives} {entries : Array Address}
+    (matched : ProgramMatches ctx primitives entries checked.program)
+    {expr : Expr} {values : Array Nat} {number : Nat}
+    (evaluated : NatEvaluates checked.program.functions expr values number) :
+    ∀ current, expr.valid checked.program.functions current values.size = true →
+      ∀ environment bindings, BindingsRepresent primitives.arithmetic environment bindings values →
+      ∃ result, IxIR0.Recursion.Evaluates ctx environment (expression primitives entries bindings expr) result ∧
+        Represents primitives.arithmetic result number := by
+  induction evaluated with
+  | atom found =>
+      intro current valid environment bindings represented
+      exact represented.atom found
+  | add leftValue rightValue =>
+      intro current valid environment bindings represented
+      obtain ⟨left, leftRun, leftRep⟩ := represented.atom leftValue
+      obtain ⟨right, rightRun, rightRep⟩ := represented.atom rightValue
+      obtain ⟨closure, result, first, second, resultRep⟩ := IxIR0.NatArithmetic.body_applies matched.matched.arithmetic leftRep rightRep
+      exact ⟨result, evaluatesApp
+        (evaluatesApp (evaluatesDef matched.matched.addition (evaluatesLam _ _ _ _)) leftRun first)
+        rightRun second, resultRep⟩
+  | sub leftValue rightValue =>
+      intro current valid environment bindings represented
+      obtain ⟨left, leftRun, leftRep⟩ := represented.atom leftValue
+      obtain ⟨right, rightRun, rightRep⟩ := represented.atom rightValue
+      obtain ⟨closure, result, first, second, resultRep⟩ := IxIR0.NatArithmetic.sub_applies
+        matched.matched.arithmetic matched.matched.predecessor leftRep rightRep
+      exact ⟨result, evaluatesApp
+        (evaluatesApp (evaluatesDef matched.matched.subtraction (evaluatesLam _ _ _ _)) leftRun first)
+        rightRun second, resultRep⟩
+  | letE first rest ihFirst ihRest =>
+      intro current valid environment bindings represented
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨bound, boundRun, boundRep⟩ := ihFirst current valid.1.2 environment bindings represented
+      obtain ⟨result, resultRun, resultRep⟩ := ihRest current (by simpa using valid.2) _ _ (represented.push boundRep)
+      exact ⟨result, evaluatesLet boundRun resultRun, resultRep⟩
+  | @zero values scrutinee zero successor result scrutineeValue taken ih =>
+      intro current valid environment bindings represented
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨major, majorRun, majorRep⟩ := represented.atom scrutineeValue
+      obtain ⟨result, takenRun, resultRep⟩ := ih current valid.1.2 _ _ (represented.lift (.lit (.nat 0)))
+      have selected := IxIR0.NatArithmetic.case_zero
+        (successor := .clos .many environment (expression primitives entries (lift bindings) successor))
+        matched.matched.caseRecursor majorRep (appliesClosure (u := .many) takenRun)
+      exact ⟨result, evaluatesApp
+        (evaluatesApp (evaluatesApp (evaluatesDef matched.matched.caseAlias (evaluatesRecursor matched.matched.caseRecursor))
+          (evaluatesLam _ _ _ _) (IxIR0.NatArithmetic.appliesRecursorFirst _ _ _))
+          (evaluatesLam _ _ _ _) (IxIR0.NatArithmetic.appliesRecursorSecond _ _ _ _))
+        majorRun selected, resultRep⟩
+  | @successor values scrutinee zero successor value result scrutineeValue positive taken ih =>
+      intro current valid environment bindings represented
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨major, majorRun, majorRep⟩ := represented.atom scrutineeValue
+      obtain ⟨predecessor, view, predecessorRep⟩ := majorRep.successor_view positive
+      obtain ⟨result, takenRun, resultRep⟩ := ih current valid.2 _ _ (represented.lift predecessor)
+      have selected := IxIR0.NatArithmetic.case_successor
+        (zero := .clos .many environment (expression primitives entries (lift bindings) zero))
+        matched.matched.caseRecursor view (appliesClosure (u := .many) takenRun)
+      exact ⟨result, evaluatesApp
+        (evaluatesApp (evaluatesApp (evaluatesDef matched.matched.caseAlias (evaluatesRecursor matched.matched.caseRecursor))
+          (evaluatesLam _ _ _ _) (IxIR0.NatArithmetic.appliesRecursorFirst _ _ _))
+          (evaluatesLam _ _ _ _) (IxIR0.NatArithmetic.appliesRecursorSecond _ _ _ _))
+        majorRun selected, resultRep⟩
+  | @call values supplied function arguments callee number found argumentsAt arity evaluated ih =>
+      intro current valid environment bindings represented
+      simp only [Expr.valid, Bool.and_eq_true, decide_eq_true_eq] at valid
+      obtain ⟨address, entryFound, declaration⟩ := matched.functions function callee found
+      have bodyValid := (checked.function_valid found).2
+      rcases array_le_two arguments valid.1.1.2 with rfl | ⟨first, rfl⟩ | ⟨first, second, rfl⟩
+      · simp [Array.mapM_eq_mapM_toList] at argumentsAt
+        subst supplied
+        have parametersZero : callee.parameters = 0 := arity.symm
+        obtain ⟨result, bodyRun, resultRep⟩ := ih function (by simpa [parametersZero] using bodyValid) [] _ (bindings_empty _)
+        have declared : ctx.env address = some (.defn .shared (expression primitives entries (parameters 0) callee.body)) := by
+          simpa only [functionBody, parametersZero, lambda] using declaration
+        refine ⟨result, ?_, resultRep⟩
+        simpa [expression, entryFound] using evaluatesDef (env := environment) declared bodyRun
+      · cases firstValue : first.natEval values with
+        | none => simp [Array.mapM_eq_mapM_toList, firstValue] at argumentsAt
+        | some a =>
+            simp [Array.mapM_eq_mapM_toList, firstValue] at argumentsAt
+            subst supplied
+            have parametersOne : callee.parameters = 1 := arity.symm
+            obtain ⟨left, leftRun, leftRep⟩ := represented.atom firstValue
+            obtain ⟨result, bodyRun, resultRep⟩ := ih function (by simpa [parametersOne] using bodyValid) _ _ (bindings_one leftRep)
+            have declared : ctx.env address = some (.defn .shared (.lam .many (expression primitives entries (parameters 1) callee.body))) := by
+              simpa only [functionBody, parametersOne, lambda] using declaration
+            refine ⟨result, ?_, resultRep⟩
+            simpa [expression, entryFound] using evaluatesApp
+              (evaluatesDef declared (evaluatesLam _ _ _ _)) leftRun (appliesClosure bodyRun)
+      · cases firstValue : first.natEval values with
+        | none => simp [Array.mapM_eq_mapM_toList, firstValue] at argumentsAt
+        | some a =>
+            cases secondValue : second.natEval values with
+            | none => simp [Array.mapM_eq_mapM_toList, firstValue, secondValue] at argumentsAt
+            | some b =>
+                simp [Array.mapM_eq_mapM_toList, firstValue, secondValue] at argumentsAt
+                subst supplied
+                have parametersTwo : callee.parameters = 2 := arity.symm
+                obtain ⟨left, leftRun, leftRep⟩ := represented.atom firstValue
+                obtain ⟨right, rightRun, rightRep⟩ := represented.atom secondValue
+                obtain ⟨result, bodyRun, resultRep⟩ := ih function (by simpa [parametersTwo] using bodyValid) _ _ (bindings_two leftRep rightRep)
+                have declared : ctx.env address = some (.defn .shared (.lam .many (.lam .many
+                    (expression primitives entries (parameters 2) callee.body)))) := by
+                  simpa only [functionBody, parametersTwo, lambda] using declaration
+                refine ⟨result, ?_, resultRep⟩
+                simpa [expression, entryFound] using evaluatesApp
+                  (evaluatesApp (evaluatesDef declared (evaluatesLam _ _ _ _)) leftRun (appliesClosure (evaluatesLam _ _ _ _)))
+                  rightRun (appliesClosure bodyRun)
+
+end Ix.Compiler.X86.Scalar.Source
diff --git a/Ix/Compiler/X86/ScalarSourceSyntax.lean b/Ix/Compiler/X86/ScalarSourceSyntax.lean
new file mode 100644
index 000000000..2100980a4
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSourceSyntax.lean
@@ -0,0 +1,178 @@
+import Ix.Compiler.X86.ScalarNat
+import Ix.Compiler.IxIR0.NatRecursors
+
+namespace Ix.Compiler.X86.Scalar.Source
+open Ix.Compiler.Ixon (Address)
+open Ix.Compiler.IxIR0.Recursion
+open Ix.Compiler.IxIR0.NatArithmetic (Represents)
+abbrev NatSchema := IxIR0.NatArithmetic.Schema
+
+structure Primitives where
+  arithmetic : NatSchema
+  addition : Address
+  predecessor : Address
+  subtraction : Address
+  caseRecursor : Address
+  caseAlias : Address
+  deriving DecidableEq, Repr
+
+structure Primitives.Matches (ctx : IxIR0.Ctx) (primitives : Primitives) : Prop where
+  arithmetic : IxIR0.NatArithmetic.Matches ctx primitives.arithmetic
+  addition : ctx.env primitives.addition = some (.defn .shared (IxIR0.NatArithmetic.body primitives.arithmetic))
+  predecessor : ctx.env primitives.predecessor = some (.defn .shared (IxIR0.NatArithmetic.predBody primitives.arithmetic))
+  subtraction : ctx.env primitives.subtraction = some (.defn .shared (IxIR0.NatArithmetic.subBody primitives.arithmetic primitives.predecessor))
+  caseRecursor : ctx.env primitives.caseRecursor = some (.recursor 2 true IxIR0.NatArithmetic.caseRules)
+  caseAlias : ctx.env primitives.caseAlias = some (.defn .shared (.ref primitives.caseRecursor))
+
+instance (ctx : IxIR0.Ctx) (primitives : Primitives) : Decidable (primitives.Matches ctx) :=
+  decidable_of_iff
+    (IxIR0.NatArithmetic.Matches ctx primitives.arithmetic ∧
+      ctx.env primitives.addition = some (.defn .shared (IxIR0.NatArithmetic.body primitives.arithmetic)) ∧
+      ctx.env primitives.predecessor = some (.defn .shared (IxIR0.NatArithmetic.predBody primitives.arithmetic)) ∧
+      ctx.env primitives.subtraction = some (.defn .shared (IxIR0.NatArithmetic.subBody primitives.arithmetic primitives.predecessor)) ∧
+      ctx.env primitives.caseRecursor = some (.recursor 2 true IxIR0.NatArithmetic.caseRules) ∧
+      ctx.env primitives.caseAlias = some (.defn .shared (.ref primitives.caseRecursor)))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2.1, h.2.2.2.1, h.2.2.2.2.1, h.2.2.2.2.2⟩,
+      fun h => ⟨h.arithmetic, h.addition, h.predecessor, h.subtraction, h.caseRecursor, h.caseAlias⟩⟩
+
+inductive Binding where
+  | var (index : Nat)
+  | constant (word : Word)
+  deriving DecidableEq, BEq, Repr, Inhabited
+
+def Binding.expression : Binding → IxIR0.Expr
+  | .var index => .var index
+  | .constant word => IxIR0.NatArithmetic.sharedLiteral word.toNat
+
+def Binding.read (environment : List IxIR0.Value) : Binding → Option IxIR0.Value
+  | .var index => environment[index]?
+  | .constant word => some (.lit (.nat word.toNat))
+
+def Binding.lift : Binding → Binding
+  | .var index => .var (index + 1)
+  | .constant word => .constant word
+
+def atom (bindings : Array Binding) : Atom → IxIR0.Expr
+  | .var index => (bindings[index]?.map Binding.expression).getD .erased
+  | .constant word => IxIR0.NatArithmetic.sharedLiteral word.toNat
+
+def lift (bindings : Array Binding) : Array Binding := bindings.map Binding.lift
+def push (bindings : Array Binding) : Array Binding := (lift bindings).push (.var 0)
+
+def expression (primitives : Primitives) (entries : Array Address) : Array Binding → Expr → IxIR0.Expr
+  | bindings, .atom value => atom bindings value
+  | bindings, .add left right => .app (.app (.ref primitives.addition) (atom bindings left)) (atom bindings right)
+  | bindings, .sub left right => .app (.app (.ref primitives.subtraction) (atom bindings left)) (atom bindings right)
+  | bindings, .letE value body => .letE .many (expression primitives entries bindings value) (expression primitives entries (push bindings) body)
+  | bindings, .branch scrutinee zero successor =>
+      .app (.app (.app (.ref primitives.caseAlias)
+        (.lam .many (expression primitives entries (lift bindings) zero)))
+        (.lam .many (expression primitives entries (lift bindings) successor))) (atom bindings scrutinee)
+  | bindings, .call function arguments =>
+      match entries[function]? with
+      | none => .erased
+      | some address => arguments.foldl (fun function argument => .app function (atom bindings argument)) (.ref address)
+
+def parameters : Nat → Array Binding
+  | 0 => #[]
+  | 1 => #[.var 0]
+  | _ + 2 => #[.var 1, .var 0]
+
+def lambda : Nat → IxIR0.Expr → IxIR0.Expr
+  | 0, body => body
+  | n + 1, body => .lam .many (lambda n body)
+
+def functionBody (primitives : Primitives) (entries : Array Address) (function : Function) : IxIR0.Expr :=
+  lambda function.parameters (expression primitives entries (parameters function.parameters) function.body)
+
+structure ProgramMatches (ctx : IxIR0.Ctx) (primitives : Primitives) (entries : Array Address) (program : Program) : Prop where
+  matched : primitives.Matches ctx
+  size : entries.size = program.functions.size
+  functions : ∀ (index : Nat) (function : Function), program.functions[index]? = some function →
+    ∃ address, entries[index]? = some address ∧ ctx.env address = some (.defn .shared (functionBody primitives entries function))
+
+structure BindingsRepresent (schema : NatSchema) (environment : List IxIR0.Value) (bindings : Array Binding) (values : Array Nat) : Prop where
+  size : bindings.size = values.size
+  value : ∀ index (bound : index < values.size),
+    ∃ value, (bindings[index]'(by omega)).read environment = some value ∧ Represents schema value values[index]
+
+theorem Binding.evaluates {ctx : IxIR0.Ctx} {environment : List IxIR0.Value} {binding : Binding} {value : IxIR0.Value}
+    (read : binding.read environment = some value) : IxIR0.Recursion.Evaluates ctx environment binding.expression value := by
+  cases binding with
+  | var index => exact evaluatesVar read
+  | constant word =>
+      cases Option.some.inj read
+      exact IxIR0.NatArithmetic.sharedLiteral_evaluates _ _ _
+
+theorem BindingsRepresent.atom {ctx : IxIR0.Ctx} {schema : NatSchema} {environment : List IxIR0.Value}
+    {bindings : Array Binding} {values : Array Nat} {source : Atom} {number : Nat}
+    (represented : BindingsRepresent schema environment bindings values)
+    (found : source.natEval values = some number) :
+    ∃ value, IxIR0.Recursion.Evaluates ctx environment (atom bindings source) value ∧ Represents schema value number := by
+  cases source with
+  | constant word =>
+      cases Option.some.inj found
+      exact ⟨_, IxIR0.NatArithmetic.sharedLiteral_evaluates _ _ _, .literal _⟩
+  | var index =>
+      obtain ⟨bound, equal⟩ := Array.getElem?_eq_some_iff.mp found
+      obtain ⟨value, read, valueRep⟩ := represented.value index bound
+      refine ⟨value, ?_, equal ▸ valueRep⟩
+      have bindingBound : index < bindings.size := by have := represented.size; omega
+      have located := Array.getElem?_eq_getElem (xs := bindings) bindingBound
+      simpa only [Source.atom, located, Option.map_some, Option.getD_some] using (Binding.evaluates (ctx := ctx) read)
+
+theorem BindingsRepresent.lift {schema : NatSchema} {environment : List IxIR0.Value}
+    {bindings : Array Binding} {values : Array Nat}
+    (represented : BindingsRepresent schema environment bindings values) (newValue : IxIR0.Value) :
+    BindingsRepresent schema (newValue :: environment) (lift bindings) values := by
+  refine ⟨by simpa [Source.lift] using represented.size, ?_⟩
+  intro index bound
+  obtain ⟨value, read, valueRep⟩ := represented.value index bound
+  refine ⟨value, ?_, valueRep⟩
+  simp only [Source.lift, Array.getElem_map]
+  cases binding : bindings[index]'(by have := represented.size; omega) <;>
+    simpa only [binding, Binding.lift, Binding.read, List.getElem?_cons_succ] using read
+
+theorem BindingsRepresent.push {schema : NatSchema} {environment : List IxIR0.Value}
+    {bindings : Array Binding} {values : Array Nat}
+    (represented : BindingsRepresent schema environment bindings values) {value : IxIR0.Value} {number : Nat}
+    (valueRep : Represents schema value number) :
+    BindingsRepresent schema (value :: environment) (push bindings) (values.push number) := by
+  have lifted := represented.lift value
+  refine ⟨by simp [Source.push, Source.lift, represented.size], ?_⟩
+  intro index bound
+  by_cases old : index < values.size
+  · obtain ⟨previous, read, previousRep⟩ := lifted.value index old
+    refine ⟨previous, ?_, ?_⟩
+    · have bindingBound : index < (Source.lift bindings).size := by have := lifted.size; omega
+      simpa only [Source.push, Array.getElem_push_lt (xs := Source.lift bindings) bindingBound] using read
+    · simpa only [Array.getElem_push_lt old] using previousRep
+  · have last : index = values.size := by simp only [Array.size_push] at bound; omega
+    subst index
+    refine ⟨value, ?_, ?_⟩
+    · have same : values.size = (Source.lift bindings).size := by simp [Source.lift, represented.size]
+      simp only [Source.push, same, Array.getElem_push_eq, Binding.read, List.getElem?_cons_zero]
+    · simpa using valueRep
+
+theorem bindings_empty (schema : NatSchema) : BindingsRepresent schema [] (parameters 0) #[] := by
+  exact ⟨rfl, by intro index bound; simp at bound⟩
+
+theorem bindings_one {schema : NatSchema} {value : IxIR0.Value} {number : Nat} (represented : Represents schema value number) :
+    BindingsRepresent schema [value] (parameters 1) #[number] := by
+  refine ⟨rfl, ?_⟩
+  intro index bound
+  have equal : index = 0 := by simp only [Array.size_singleton] at bound; omega
+  subst index
+  exact ⟨value, rfl, represented⟩
+
+theorem bindings_two {schema : NatSchema} {left right : IxIR0.Value} {a b : Nat}
+    (leftRep : Represents schema left a) (rightRep : Represents schema right b) :
+    BindingsRepresent schema [right, left] (parameters 2) #[a, b] := by
+  refine ⟨rfl, ?_⟩
+  intro index bound
+  have alternatives : index = 0 ∨ index = 1 := by change index < 2 at bound; omega
+  rcases alternatives with rfl | rfl
+  · exact ⟨left, rfl, leftRep⟩
+  · exact ⟨right, rfl, rightRep⟩
+
+end Ix.Compiler.X86.Scalar.Source
diff --git a/Ix/Compiler/X86/ScalarSources.lean b/Ix/Compiler/X86/ScalarSources.lean
new file mode 100644
index 000000000..245d42d8f
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarSources.lean
@@ -0,0 +1,148 @@
+import Ix.Compiler.X86.ScalarSourceSelect
+import Ix.Compiler.Coverage.Sources
+
+/-! Synthetic Ixon programs with open scalar entry functions. Every constant
+crosses the ordinary source identity gate, and the fixtures use the complete
+source compiler. Runtime inputs are supplied separately. -/
+namespace Ix.Compiler.X86.Scalar.Examples
+open Ix.Compiler.Ixon (Address Constant)
+
+structure Library where
+  constants : List (Address × Constant)
+  natBlock : Address
+  natType : Address
+  addition : Address
+  subtraction : Address
+  caseAlias : Address
+
+private def definition (value typ : Ixon.Expr) (refs : Array Address) : Constant :=
+  { info := .defn { kind := .defn, safety := .safe, lvls := 0, typ, value }
+    sharing := #[], refs, univs := #[.zero] }
+
+private def sharedLiteral (index : Nat) : Ixon.Expr :=
+  .app (.lam .erased (.sort 0) (.nat index.toUInt64)) (.sort 0)
+
+def library : Except String Library := do
+  let nat : Ixon.Expr := .recur 0 #[]
+  let stepType : Ixon.Expr := .all .many .shared nat (.all .many .shared nat nat)
+  let thunkType : Ixon.Expr := .all .many .shared nat nat
+  let recursor : Ixon.Recursor := {
+    k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0, motives := 0, minors := 2
+    typ := .all .many .shared nat (.all .many .shared stepType (.all .many .shared nat nat))
+    rules := #[
+      { fields := 0, rhs := .lam .many nat (.lam .many stepType (.var 1)) },
+      { fields := 1, rhs := .lam .many nat (.lam .many stepType (.lam .many nat
+        (.app (.app (.var 1) (.var 0))
+          (.app (.app (.app (.recur 1 #[]) (.var 2)) (.var 1)) (.var 0))))) }] }
+  let caseRecursor : Ixon.Recursor := {
+    k := false, isUnsafe := false, lvls := 0, params := 0, indices := 0, motives := 0, minors := 2
+    typ := .all .many .shared thunkType (.all .many .shared thunkType (.all .many .shared nat nat))
+    rules := #[
+      { fields := 0, rhs := .lam .many thunkType (.lam .many thunkType (.app (.var 1) (sharedLiteral 0))) },
+      { fields := 1, rhs := .lam .many thunkType (.lam .many thunkType (.lam .many nat (.app (.var 1) (.var 0)))) }] }
+  let block ← Coverage.addressed {
+    info := .muts #[.indc {
+      isUnsafe := false, lvls := 0, params := 0, indices := 0, typ := .sort 0
+      ctors := #[
+        { isUnsafe := false, lvls := 0, cidx := 0, params := 0, fields := 0, typ := nat },
+        { isUnsafe := false, lvls := 0, cidx := 1, params := 0, fields := 1, typ := .all .many .shared nat nat }] },
+      .recr recursor, .recr caseRecursor]
+    sharing := #[], refs := #[ValidatedScalar.literalAddress 0], univs := #[.zero] }
+  let project := fun info => Coverage.addressed { info, sharing := #[], refs := #[], univs := #[] }
+  let natType ← project (.iPrj { idx := 0, block := block.1 })
+  let successor ← project (.cPrj { idx := 0, cidx := 1, block := block.1 })
+  let recursor ← project (.rPrj { idx := 1, block := block.1 })
+  let caseAlias ← project (.rPrj { idx := 2, block := block.1 })
+  let nat : Ixon.Expr := .ref 0 #[]
+  let binary : Ixon.Expr := .all .many .shared nat (.all .many .shared nat nat)
+  let addition ← Coverage.addressed (definition
+    (.lam .many nat (.lam .many nat
+      (.app (.app (.app (.ref 2 #[]) (.var 1))
+        (.lam .many nat (.lam .many nat (.app (.ref 1 #[]) (.var 0))))) (.var 0))))
+    binary #[natType.1, successor.1, recursor.1])
+  let predecessor ← Coverage.addressed (definition
+    (.lam .many nat (.app (.app (.app (.ref 1 #[]) (sharedLiteral 2))
+      (.lam .many nat (.lam .many nat (.var 1)))) (.var 0)))
+    (.all .many .shared nat nat) #[natType.1, recursor.1, ValidatedScalar.literalAddress 0])
+  let subtraction ← Coverage.addressed (definition
+    (.lam .many nat (.lam .many nat
+      (.app (.app (.app (.ref 1 #[]) (.var 1))
+        (.lam .many nat (.lam .many nat (.app (.ref 2 #[]) (.var 0))))) (.var 0))))
+    binary #[natType.1, recursor.1, predecessor.1])
+  return {
+    constants := [block, natType, successor, recursor, caseAlias, addition, predecessor, subtraction]
+    natBlock := block.1, natType := natType.1, addition := addition.1, subtraction := subtraction.1, caseAlias := caseAlias.1 }
+
+def atomConstants : Atom → List Nat
+  | .constant word => [word.toNat]
+  | _ => []
+
+def constantsOf : Expr → List Nat
+  | .atom value => atomConstants value
+  | .add left right | .sub left right => atomConstants left ++ atomConstants right
+  | .letE value body => constantsOf value ++ constantsOf body
+  | .branch scrutinee zero successor => atomConstants scrutinee ++ constantsOf zero ++ constantsOf successor
+  | .call _ arguments => arguments.toList.flatMap atomConstants
+
+private def bindingSource (literals : List Nat) (literalStart : Nat) : Source.Binding → Ixon.Expr
+  | .var index => .var index.toUInt64
+  | .constant word => sharedLiteral (literalStart + literals.idxOf word.toNat)
+
+private def atomSource (bindings : Array Source.Binding) (literals : List Nat) (literalStart : Nat) : Atom → Ixon.Expr
+  | .var index => bindingSource literals literalStart (bindings[index]?.getD (.var 0))
+  | .constant word => bindingSource literals literalStart (.constant word)
+
+private def expressionSource (literals : List Nat) (literalStart : Nat) : Array Source.Binding → Expr → Ixon.Expr
+  | bindings, .atom value => atomSource bindings literals literalStart value
+  | bindings, .add left right => .app (.app (.ref 1 #[]) (atomSource bindings literals literalStart left)) (atomSource bindings literals literalStart right)
+  | bindings, .sub left right => .app (.app (.ref 2 #[]) (atomSource bindings literals literalStart left)) (atomSource bindings literals literalStart right)
+  | bindings, .letE value body => .letE true (.ref 0 #[])
+      (expressionSource literals literalStart bindings value) (expressionSource literals literalStart (Source.push bindings) body)
+  | bindings, .branch scrutinee zero successor =>
+      .app (.app (.app (.ref 3 #[]) (.lam .many (.ref 0 #[]) (expressionSource literals literalStart (Source.lift bindings) zero)))
+        (.lam .many (.ref 0 #[]) (expressionSource literals literalStart (Source.lift bindings) successor)))
+        (atomSource bindings literals literalStart scrutinee)
+  | bindings, .call function arguments =>
+      arguments.foldl (fun function argument => .app function (atomSource bindings literals literalStart argument))
+        (.ref (4 + function).toUInt64 #[])
+
+private def functionType : Nat → Ixon.Expr
+  | 0 => .ref 0 #[]
+  | n + 1 => .all .many .shared (.ref 0 #[]) (functionType n)
+
+private def lambda : Nat → Ixon.Expr → Ixon.Expr
+  | 0, body => body
+  | n + 1, body => .lam .many (.ref 0 #[]) (lambda n body)
+
+def source (name : String) (program : Program) : Except String Coverage.Source := do
+  let library ← library
+  let literals := (0 :: program.functions.toList.flatMap (fun function => constantsOf function.body)).eraseDups
+  let mut constants := library.constants
+  let mut entries : Array Address := #[]
+  for function in program.functions do
+    let refs := #[library.natType, library.addition, library.subtraction, library.caseAlias] ++ entries ++
+      (literals.map ValidatedScalar.literalAddress).toArray
+    let body := expressionSource literals (4 + entries.size) (Source.parameters function.parameters) function.body
+    let entry ← Coverage.addressed (definition (lambda function.parameters body) (functionType function.parameters) refs)
+    constants := constants ++ [entry]
+    entries := entries.push entry.1
+  let some root := entries[program.entry]? | throw "scalar fixture entry is missing"
+  return { name, constants, root, literals, natBlock := some library.natBlock, expected := .scalar 0 false }
+
+def addition : Program := { functions := #[⟨2, .add (.var 0) (.var 1)⟩], entry := 0 }
+def subtraction : Program := { functions := #[⟨2, .sub (.var 0) (.var 1)⟩], entry := 0 }
+def diamond : Program := {
+  functions := #[⟨2, .letE (.branch (.var 0) (.atom (.var 1)) (.add (.var 0) (.var 1)))
+    (.sub (.var 2) (.constant 1))⟩], entry := 0 }
+def helperCalls : Program := {
+  functions := #[⟨2, .add (.var 0) (.var 1)⟩, ⟨1, .sub (.var 0) (.constant 1)⟩,
+    ⟨2, .letE (.call 0 #[.var 0, .var 1]) (.call 1 #[.var 2])⟩], entry := 2 }
+def nested : Program := {
+  functions := #[⟨0, .atom (.constant 7)⟩, ⟨2, .sub (.var 0) (.var 1)⟩,
+    ⟨2, .branch (.var 0) (.call 0 #[]) (.letE (.call 1 #[.var 0, .var 1])
+      (.branch (.var 2) (.add (.var 0) (.var 1)) (.atom (.var 2))))⟩], entry := 2 }
+
+def families : List (String × Program) :=
+  [("add", addition), ("sub", subtraction), ("diamond", diamond), ("helpers", helperCalls), ("nested", nested)]
+
+end Ix.Compiler.X86.Scalar.Examples
diff --git a/Ix/Compiler/X86/ScalarStack.lean b/Ix/Compiler/X86/ScalarStack.lean
new file mode 100644
index 000000000..8c23986ee
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarStack.lean
@@ -0,0 +1,189 @@
+import Ix.Compiler.X86.ScalarTarget
+import Ix.Compiler.X86.WordRegionExecution
+import Ix.Compiler.X86.FrameCalls
+
+namespace Ix.Compiler.X86.Scalar
+
+open WordRegion
+
+@[simp] theorem callerSaved (register : GPR) : SysV.isCallerSaved register =
+    (match register with
+      | .rax | .rcx | .rdx | .rsi | .rdi | .r8 | .r9 | .r10 | .r11 => true
+      | _ => false) := by
+  cases register <;> simp [SysV.isCallerSaved, SysV.callerSaved]
+
+/-- One activation has a return slot, saved `rbp`, and 32 local words. The
+return slot belongs to its caller; the other 264 bytes are this frame. -/
+structure Frame (layout : Layout) where
+  top : Nat
+  enough : 33 ≤ top
+  bound : top < layout.slots
+  aligned : SysV.functionEntryAligned (layout.address top) = true
+  partition : top % frameStride = 33
+
+def Frame.baseIndex {layout : Layout} (frame : Frame layout) : Nat := frame.top - 1
+def Frame.stackIndex {layout : Layout} (frame : Frame layout) : Nat := frame.top - 33
+def Frame.localIndex {layout : Layout} (frame : Frame layout) (index : Nat) : Nat := frame.top - 2 - index
+
+theorem Frame.base_bound {layout : Layout} (frame : Frame layout) : frame.baseIndex < layout.slots := by
+  have := frame.bound
+  simp only [Frame.baseIndex]
+  omega
+
+theorem Frame.stack_bound {layout : Layout} (frame : Frame layout) : frame.stackIndex < layout.slots := by
+  have := frame.bound
+  simp only [Frame.stackIndex]
+  omega
+
+theorem Frame.local_bound {layout : Layout} (frame : Frame layout) (index : Nat) :
+    frame.localIndex index < layout.slots := by
+  have := frame.bound
+  simp only [Frame.localIndex]
+  omega
+
+theorem Frame.local_injective {layout : Layout} (frame : Frame layout) {left right : Nat}
+    (leftBound : left < maxLocals) (rightBound : right < maxLocals)
+    (equal : frame.localIndex left = frame.localIndex right) : left = right := by
+  have := frame.enough
+  simp only [Frame.localIndex, maxLocals] at *
+  omega
+
+theorem slot_displacement {index : Nat} (bound : index < maxLocals) :
+    (slot index).displacement = UInt64.ofNat (8 * (index + 1)) := by
+  have small : index < UInt16.size := by simp only [maxLocals, UInt16.size] at *; omega
+  have convert : (UInt16.ofNat index).toUInt64 = UInt64.ofNat index := by
+    apply UInt64.toNat_inj.mp
+    rw [UInt16.toNat_toUInt64, UInt16.toNat_ofNat_of_lt' small,
+      UInt64.toNat_ofNat_of_lt' (by simp only [maxLocals, UInt64.size] at *; omega)]
+  simp [slot, StackSlot.displacement, convert, UInt64.ofNat_add, UInt64.ofNat_mul, UInt64.mul_comm]
+
+theorem Frame.local_address {layout : Layout} (frame : Frame layout) {index : Nat}
+    (bound : index < maxLocals) :
+    layout.address frame.baseIndex - (slot index).displacement = layout.address (frame.localIndex index) := by
+  have enough := frame.enough
+  rw [slot_displacement bound, layout.subtract (by
+    simp only [Frame.baseIndex, maxLocals] at *
+    omega)]
+  congr 1
+  simp only [Frame.baseIndex, Frame.localIndex]
+  omega
+
+theorem Frame.call_aligned {layout : Layout} (frame : Frame layout) :
+    SysV.callSiteAligned (layout.address frame.stackIndex) = true := by
+  have aligned := frame.aligned
+  simp only [SysV.functionEntryAligned, beq_iff_eq] at aligned
+  have aligned := congrArg UInt64.toNat aligned
+  simp only [UInt64.toNat_mod] at aligned
+  change (layout.address frame.top).toNat % 16 = 8 at aligned
+  rw [layout.address_toNat frame.bound] at aligned
+  simp only [SysV.callSiteAligned, beq_iff_eq]
+  apply UInt64.toNat_inj.mp
+  simp only [UInt64.toNat_mod]
+  change (layout.address frame.stackIndex).toNat % 16 = 0
+  rw [layout.address_toNat frame.stack_bound]
+  have enough := frame.enough
+  simp only [Frame.stackIndex]
+  omega
+
+def Frame.child {layout : Layout} (frame : Frame layout) (enough : 67 ≤ frame.top) : Frame layout where
+  top := frame.top - frameStride
+  enough := by simp only [frameStride]; omega
+  bound := by have := frame.bound; simp only [frameStride]; omega
+  aligned := by
+    have aligned := frame.aligned
+    simp only [SysV.functionEntryAligned, beq_iff_eq] at aligned ⊢
+    have aligned := congrArg UInt64.toNat aligned
+    apply UInt64.toNat_inj.mp
+    simp only [UInt64.toNat_mod] at aligned ⊢
+    change (layout.address (frame.top - frameStride)).toNat % 16 = 8
+    change (layout.address frame.top).toNat % 16 = 8 at aligned
+    rw [layout.address_toNat frame.bound] at aligned
+    rw [layout.address_toNat (by have := frame.bound; simp only [frameStride]; omega)]
+    simp only [frameStride]
+    omega
+  partition := by
+    have partition := frame.partition
+    simp only [frameStride] at *
+    omega
+
+def Framed {layout : Layout} (frame : Frame layout) (state : State) : Prop :=
+  state.registers .rbp = layout.address frame.baseIndex ∧
+  state.registers .rsp = layout.address frame.stackIndex
+
+def ValuesAt {layout : Layout} (frame : Frame layout) (values : Array Word) (state : State) : Prop :=
+  values.size ≤ maxLocals ∧ ∀ index (bound : index < values.size), state.words (frame.localIndex index) = values[index]
+
+/-- The expression compiler may change caller-saved registers. It preserves
+`rsp`, `rbp`, and every other System V callee-saved register. -/
+def Stable (before after : State) : Prop :=
+  ∀ register, SysV.isCallerSaved register = false → after.registers register = before.registers register
+
+theorem Stable.refl (state : State) : Stable state state := fun _ _ => rfl
+
+theorem Stable.trans {before middle after : State} (left : Stable before middle) (right : Stable middle after) :
+    Stable before after := fun register safe => (right register safe).trans (left register safe)
+
+theorem Stable.setReg (state : State) (register : GPR) (value : Word)
+    (scratch : SysV.isCallerSaved register = true) : Stable state (state.setReg register value) := by
+  intro other saved
+  have different : other ≠ register := by
+    intro equal
+    subst other
+    exact Bool.noConfusion (saved.symm.trans scratch)
+  simp [State.setReg_registers, different]
+
+theorem Stable.setWord (state : State) (slot : Nat) (value : Word) :
+    Stable state (state.setWord slot value) := fun _ _ => rfl
+
+theorem Stable.framed {layout : Layout} {frame : Frame layout} {before after : State}
+    (stable : Stable before after) (framed : Framed frame before) : Framed frame after :=
+  ⟨(stable .rbp (by simp)).trans framed.1, (stable .rsp (by simp)).trans framed.2⟩
+
+theorem Stable.snapshot {before after : State} (stable : Stable before after) (memory nextMemory : Memory) :
+    (after.core nextMemory).calleeSavedSnapshot = (before.core memory).calleeSavedSnapshot := by
+  simp [Core.calleeSavedSnapshot, SysV.calleeSaved, State.core, Core.readReg,
+    stable .rbx (by simp), stable .rbp (by simp), stable .r12 (by simp),
+    stable .r13 (by simp), stable .r14 (by simp), stable .r15 (by simp)]
+
+def Preserves {layout : Layout} (frame : Frame layout) (locals : Nat) (before after : State) : Prop :=
+  Stable before after ∧
+    ∀ index, frame.top - 1 - locals ≤ index → after.words index = before.words index
+
+theorem Preserves.refl {layout : Layout} (frame : Frame layout) (locals : Nat) (state : State) :
+    Preserves frame locals state state := ⟨Stable.refl _, fun _ _ => rfl⟩
+
+theorem Preserves.trans {layout : Layout} {frame : Frame layout} {locals : Nat} {before middle after : State}
+    (left : Preserves frame locals before middle) (right : Preserves frame locals middle after) :
+    Preserves frame locals before after :=
+  ⟨left.1.trans right.1, fun index bound => (right.2 index bound).trans (left.2 index bound)⟩
+
+theorem Preserves.values {layout : Layout} {frame : Frame layout} {values : Array Word} {before after : State}
+    (preserved : Preserves frame values.size before after) (valuesAt : ValuesAt frame values before) :
+    ValuesAt frame values after := by
+  refine ⟨valuesAt.1, fun index bound => ?_⟩
+  rw [preserved.2]
+  · exact valuesAt.2 index bound
+  · simp only [Frame.localIndex]
+    omega
+
+theorem load_trace {layout : Layout} {frame : Frame layout} {values : Array Word} {state : State}
+    (framed : Framed frame state) (valuesAt : ValuesAt frame values state)
+    (destination : GPR) {source : Atom} {value : Word} (found : source.eval values = some value) :
+    Trace layout [load destination source] state (state.setReg destination value) := by
+  cases source with
+  | constant number =>
+      simp only [Atom.eval, Option.some.injEq] at found
+      subst value
+      exact .cons (.mov _ _ _) (.nil _)
+  | var index =>
+      simp only [Atom.eval] at found
+      obtain ⟨bound, equal⟩ := Array.getElem?_eq_some_iff.mp found
+      have loaded : state.words (frame.localIndex index) = value := (valuesAt.2 index bound).trans equal
+      have address : state.registers .rbp - (slot index).displacement = layout.address (frame.localIndex index) := by
+        rw [framed.1]
+        exact frame.local_address (by have := valuesAt.1; omega)
+      simpa only [load, loaded] using
+        Trace.cons (Effect.reload state destination (slot index) (frame.localIndex index)
+          (frame.local_bound index) address) (Trace.nil _)
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarTarget.lean b/Ix/Compiler/X86/ScalarTarget.lean
new file mode 100644
index 000000000..c7a2788f3
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarTarget.lean
@@ -0,0 +1,173 @@
+import Ix.Compiler.X86.Scalar
+import Ix.Compiler.X86.FrameExecution
+
+namespace Ix.Compiler.X86.Scalar
+
+def frameSize : FrameSize := ⟨16⟩
+def frameBytes : Nat := 256
+def frameStride : Nat := 34
+
+def slot (index : Nat) : StackSlot := ⟨UInt16.ofNat index⟩
+
+def load (destination : GPR) : Atom → Instr
+  | .var index => .reload destination (slot index)
+  | .constant value => .mov .w64 destination (.imm value)
+
+def addInstructions (left right : Atom) : List Instr :=
+  [load .rax left, load .rcx right, .mov .w64 .r10 (.reg .rax), .alu .add .w64 .rax (.reg .rcx)]
+
+def carryCompare : Compare := { width := .w64, left := .rax, right := .reg .r10 }
+def operandsCompare : Compare := { width := .w64, left := .rax, right := .reg .rcx }
+def zeroCompare : Compare := { width := .w64, left := .rax, right := .imm 0 }
+def failedCompare : Compare := { width := .w64, left := .rdx, right := .imm 0 }
+
+def callInstructions (target : BlockId) (arguments : Array Atom) : List Instr :=
+  [load .rdi (arguments[0]?.getD (.constant 0)),
+   load .rsi (arguments[1]?.getD (.constant 0)), .call target]
+
+def prologue (parameters : Nat) : List Instr :=
+  [.push .rbp, .mov .w64 .rbp (.reg .rsp), .allocFrame frameSize] ++
+    (if 0 < parameters then [.spill (slot 0) .rdi] else []) ++
+    (if 1 < parameters then [.spill (slot 1) .rsi] else [])
+
+def epilogue : List Instr := [.freeFrame frameSize, .pop .rbp]
+def successInstructions : List Instr := [.mov .w64 .rdx (.imm 0)] ++ epilogue
+def failureInstructions : List Instr := [.mov .w64 .rax (.imm 0), .mov .w64 .rdx (.imm 1)] ++ epilogue
+
+/-- The plan retains all block labels needed by a structural certificate.
+The checker reconstructs every instruction and continuation from this tree. -/
+inductive Plan where
+  | atom (entry : BlockId) (value : Atom)
+  | add (entry : BlockId) (left right : Atom)
+  | sub (entry underflow ordinary : BlockId) (left right : Atom)
+  | letE (join : BlockId) (value body : Plan)
+  | branch (entry : BlockId) (scrutinee : Atom) (zero successor : Plan)
+  | call (entry : BlockId) (function : Nat) (arguments : Array Atom)
+  deriving Repr, Inhabited
+
+def Plan.expression : Plan → Expr
+  | .atom _ value => .atom value
+  | .add _ left right => .add left right
+  | .sub _ _ _ left right => .sub left right
+  | .letE _ value body => .letE value.expression body.expression
+  | .branch _ scrutinee zero successor => .branch scrutinee zero.expression successor.expression
+  | .call _ function arguments => .call function arguments
+
+def Plan.entry : Plan → BlockId
+  | .atom entry _ | .add entry _ _ | .sub entry _ _ _ _ |
+    .branch entry _ _ _ | .call entry _ _ => entry
+  | .letE _ value _ => value.entry
+
+def blockMatches (program : X86.Program) (entry : BlockId) (instructions : List Instr)
+    (terminator : Terminator) : Bool :=
+  program.blocks[entry.toNat]? == some ⟨instructions.toArray, terminator⟩ && instructions.length < UInt32.size
+
+theorem blockMatches_code {checked : X86.Checked} {entry : BlockId} {instructions : List Instr}
+    {terminator : Terminator} (matched : blockMatches checked.program entry instructions terminator = true) :
+    BlockCode checked entry instructions terminator := by
+  simp only [blockMatches, Bool.and_eq_true, beq_iff_eq, decide_eq_true_eq] at matched
+  exact ⟨matched.1, matched.2⟩
+
+def Plan.matches (program : X86.Program) (entries : Array BlockId) :
+    Plan → Nat → BlockId → BlockId → Bool
+  | .atom entry value, _, success, _ => blockMatches program entry [load .rax value] (.jump success)
+  | .add entry left right, _, success, failure =>
+      blockMatches program entry (addInstructions left right)
+        (.branch carryCompare .unsignedLt failure success)
+  | .sub entry underflow ordinary left right, _, success, _ =>
+      blockMatches program entry [load .rax left, load .rcx right]
+        (.branch operandsCompare .unsignedLt underflow ordinary) &&
+      blockMatches program underflow [.mov .w64 .rax (.imm 0)] (.jump success) &&
+      blockMatches program ordinary [.alu .sub .w64 .rax (.reg .rcx)] (.jump success)
+  | .letE join value body, locals, success, failure =>
+      blockMatches program join [.spill (slot locals) .rax] (.jump body.entry) &&
+      value.matches program entries locals join failure &&
+      body.matches program entries (locals + 1) success failure
+  | .branch entry scrutinee zero successor, locals, success, failure =>
+      blockMatches program entry [load .rax scrutinee] (.branch zeroCompare .eq zero.entry successor.entry) &&
+      zero.matches program entries locals success failure && successor.matches program entries locals success failure
+  | .call entry function arguments, _, success, failure =>
+      match entries[function]? with
+      | none => false
+      | some target => blockMatches program entry (callInstructions target arguments)
+          (.branch failedCompare .ne failure success)
+
+structure FunctionPlan where
+  entry : BlockId
+  success : BlockId
+  failure : BlockId
+  body : Plan
+  deriving Repr, Inhabited
+
+def FunctionPlan.matches (program : X86.Program) (entries : Array BlockId)
+    (source : Function) (plan : FunctionPlan) : Bool :=
+  plan.body.expression == source.body &&
+  blockMatches program plan.entry (prologue source.parameters) (.jump plan.body.entry) &&
+  blockMatches program plan.success successInstructions .ret &&
+  blockMatches program plan.failure failureInstructions .ret &&
+  plan.body.matches program entries source.parameters plan.success plan.failure
+
+abbrev Emit := StateT (Array Block) (Except String)
+
+def emit (instructions : List Instr) (terminator : Terminator) : Emit BlockId := do
+  let blocks ← get
+  if blocks.size + 1 >= UInt32.size then throw "scalar target exceeds the block-address range"
+  set (blocks.push ⟨instructions.toArray, terminator⟩)
+  return UInt32.ofNat blocks.size
+
+def emitExpr (entries : Array BlockId) (locals : Nat) (success failure : BlockId) : Expr → Emit Plan
+  | .atom value => return .atom (← emit [load .rax value] (.jump success)) value
+  | .add left right => do
+      let entry ← emit (addInstructions left right) (.branch carryCompare .unsignedLt failure success)
+      return .add entry left right
+  | .sub left right => do
+      let underflow ← emit [.mov .w64 .rax (.imm 0)] (.jump success)
+      let ordinary ← emit [.alu .sub .w64 .rax (.reg .rcx)] (.jump success)
+      let entry ← emit [load .rax left, load .rcx right] (.branch operandsCompare .unsignedLt underflow ordinary)
+      return .sub entry underflow ordinary left right
+  | .letE value body => do
+      let body ← emitExpr entries (locals + 1) success failure body
+      let join ← emit [.spill (slot locals) .rax] (.jump body.entry)
+      let value ← emitExpr entries locals join failure value
+      return .letE join value body
+  | .branch scrutinee zero successor => do
+      let zero ← emitExpr entries locals success failure zero
+      let successor ← emitExpr entries locals success failure successor
+      let entry ← emit [load .rax scrutinee] (.branch zeroCompare .eq zero.entry successor.entry)
+      return .branch entry scrutinee zero successor
+  | .call function arguments => do
+      let some target := entries[function]? | throw "scalar call is not an earlier function"
+      return .call (← emit (callInstructions target arguments) (.branch failedCompare .ne failure success))
+        function arguments
+
+def emitFunction (entries : Array BlockId) (function : Function) : Emit FunctionPlan := do
+  let success ← emit successInstructions .ret
+  let failure ← emit failureInstructions .ret
+  let body ← emitExpr entries function.parameters success failure function.body
+  let entry ← emit (prologue function.parameters) (.jump body.entry)
+  return { entry, success, failure, body }
+
+structure Output (source : Checked) where
+  target : X86.Checked
+  plans : Array FunctionPlan
+  size : plans.size = source.program.functions.size
+  entry : target.program.entry = (plans.map (·.entry))[source.program.entry]?.getD 0
+  verified : (plans.zip source.program.functions).all
+    (fun (plan, function) => plan.matches target.program (plans.map (·.entry)) function) = true
+
+def compile (source : Checked) : Except String (Output source) := do
+  let (plans, blocks) ← ((source.program.functions.foldlM (fun plans function => do
+    let plan ← emitFunction (plans.map (·.entry)) function
+    return plans.push plan) #[] : Emit (Array FunctionPlan))).run #[]
+  let target ← (X86.Program.check
+    { blocks, entry := (plans.map (·.entry))[source.program.entry]?.getD 0 }).mapError reprStr
+  if size : plans.size = source.program.functions.size then
+    if entry : target.program.entry = (plans.map (·.entry))[source.program.entry]?.getD 0 then
+      if verified : (plans.zip source.program.functions).all
+          (fun (plan, function) => plan.matches target.program (plans.map (·.entry)) function) = true then
+        return { target, plans, size, entry, verified }
+      else throw "scalar target failed its structural instruction and control-flow certificate"
+    else throw "scalar target entry mismatch"
+  else throw "scalar function count mismatch"
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/ScalarTotal.lean b/Ix/Compiler/X86/ScalarTotal.lean
new file mode 100644
index 000000000..0a0b026dc
--- /dev/null
+++ b/Ix/Compiler/X86/ScalarTotal.lean
@@ -0,0 +1,89 @@
+import Ix.Compiler.X86.ScalarSimulation
+
+namespace Ix.Compiler.X86.Scalar
+
+theorem Atom.total {value : Atom} {values : Array Word} (valid : value.valid values.size = true) :
+    ∃ word, value.eval values = some word := by
+  cases value with
+  | constant word => exact ⟨word, rfl⟩
+  | var index =>
+      have bound : index < values.size := by simpa [Atom.valid] using valid
+      exact ⟨values[index], Array.getElem?_eq_getElem bound⟩
+
+theorem arguments_total {arguments : Array Atom} {values : Array Word}
+    (small : arguments.size ≤ 2) (valid : arguments.all (·.valid values.size) = true) :
+    ∃ supplied, arguments.mapM (Atom.eval values) = some supplied ∧ supplied.size = arguments.size := by
+  rcases array_le_two arguments small with rfl | ⟨first, rfl⟩ | ⟨first, second, rfl⟩
+  · exact ⟨#[], by simp [Array.mapM_eq_mapM_toList], rfl⟩
+  · have firstValid := Array.all_eq_true.mp valid 0 (by simp)
+    obtain ⟨word, evaluated⟩ := Atom.total firstValid
+    change first.eval values = some word at evaluated
+    exact ⟨#[word], by simp [Array.mapM_eq_mapM_toList, evaluated], rfl⟩
+  · have firstValid := Array.all_eq_true.mp valid 0 (by simp)
+    have secondValid := Array.all_eq_true.mp valid 1 (by simp)
+    obtain ⟨left, leftValue⟩ := Atom.total firstValid
+    obtain ⟨right, rightValue⟩ := Atom.total secondValid
+    change first.eval values = some left at leftValue
+    change second.eval values = some right at rightValue
+    exact ⟨#[left, right], by simp [Array.mapM_eq_mapM_toList, leftValue, rightValue], rfl⟩
+
+theorem Expr.total {functions : Array Function} {current : Nat}
+    (callees : ∀ index, index < current → ∀ function, functions[index]? = some function →
+      ∀ values : Array Word, values.size = function.parameters → ∃ result, Evaluates functions function.body values result)
+    (expression : Expr) (values : Array Word) (valid : expression.valid functions current values.size = true) :
+    ∃ result, Evaluates functions expression values result := by
+  induction expression generalizing values with
+  | atom source =>
+      obtain ⟨value, found⟩ := Atom.total valid
+      exact ⟨some value, .atom found⟩
+  | add left right =>
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨a, leftValue⟩ := Atom.total valid.1
+      obtain ⟨b, rightValue⟩ := Atom.total valid.2
+      exact ⟨ExactNat.add a b, .add leftValue rightValue⟩
+  | sub left right =>
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨a, leftValue⟩ := Atom.total valid.1
+      obtain ⟨b, rightValue⟩ := Atom.total valid.2
+      exact ⟨some (ExactNat.sub a b), .sub leftValue rightValue⟩
+  | letE value body ihValue ihBody =>
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨first, evaluated⟩ := ihValue values valid.1.2
+      cases first with
+      | none => exact ⟨none, .letOverflow evaluated⟩
+      | some first =>
+          obtain ⟨result, rest⟩ := ihBody (values.push first) (by simpa using valid.2)
+          exact ⟨result, .letE evaluated rest⟩
+  | branch scrutinee zero successor ihZero ihSuccessor =>
+      simp only [Expr.valid, Bool.and_eq_true] at valid
+      obtain ⟨value, found⟩ := Atom.total valid.1.1
+      by_cases empty : value = 0
+      · subst value
+        obtain ⟨result, taken⟩ := ihZero values valid.1.2
+        exact ⟨result, .zero found taken⟩
+      · obtain ⟨result, taken⟩ := ihSuccessor values valid.2
+        exact ⟨result, .successor found empty taken⟩
+  | call function arguments =>
+      simp only [Expr.valid, Bool.and_eq_true, decide_eq_true_eq] at valid
+      cases found : functions[function]? with
+      | none => simp only [found, Bool.false_eq_true, and_false] at valid
+      | some callee =>
+          obtain ⟨supplied, mapped, size⟩ := arguments_total valid.1.1.2 valid.1.2
+          have arity : supplied.size = callee.parameters := by
+            rw [size]
+            simpa only [found, beq_iff_eq] using valid.2
+          obtain ⟨result, evaluated⟩ := callees function valid.1.1.1 callee found supplied arity
+          exact ⟨result, .call found mapped arity evaluated⟩
+
+/-- Accepted nonrecursive functions have a result for every well-formed
+runtime argument array. `none` is the explicit arithmetic fallback result. -/
+theorem Checked.function_total (checked : Checked) (index : Nat) (function : Function)
+    (found : checked.program.functions[index]? = some function) (values : Array Word)
+    (arity : values.size = function.parameters) :
+    ∃ result, Evaluates checked.program.functions function.body values result := by
+  induction index using Nat.strongRecOn generalizing function values with
+  | ind index ih =>
+      apply Expr.total (fun callee smaller body located supplied suppliedArity => ih callee smaller body located supplied suppliedArity)
+      simpa only [arity] using (checked.function_valid found).2
+
+end Ix.Compiler.X86.Scalar
diff --git a/Ix/Compiler/X86/Select.lean b/Ix/Compiler/X86/Select.lean
new file mode 100644
index 000000000..1a4db2714
--- /dev/null
+++ b/Ix/Compiler/X86/Select.lean
@@ -0,0 +1,389 @@
+import Ix.Compiler.IxIR2.Validate
+import Ix.Compiler.IxIR2.Eval
+import Ix.Compiler.X86.Eval
+import Ix.Compiler.X86.ScalarApply
+import Ix.Compiler.IxIR2.EvalFuel
+
+/-!
+# First IxIR₂ to x86-64 scalar selection slice
+
+The selector accepts two exact source graphs: a literal/alias/return leaf and
+the closed application graph emitted by the validated synthetic Ixon scalar.
+The latter retains both addressed declarations, its PAP/application path, and
+the main tail call. Selection folds either graph's bounded Nat observation to
+an x86 immediate move and returns it in System V's `rax` result register.
+
+The executable selector always runs the ordinary bounded IxIR₂ validator
+before reflecting exact source equality. `Output.refinesSuccessfulRun` relates
+any successful physical execution to the actual selected typed local x86
+result, independently of execution budgets. `PipelineSim` composes this with
+validated Ixon evaluation. The E0 bytes implementing the typed machine remain
+the separately ledgered encoder/local-ISA boundary.
+-/
+
+namespace Ix.Compiler.X86.Select
+
+open Ix.Compiler
+
+def validationContext : IxIR2.Validate.Context := {}
+
+def scalarSignature : IxIR2.Signature :=
+  { params := #[]
+    result := .unique
+    papSafe := false }
+
+def scalarMoveBlock (word : Word) : IxIR2.Block :=
+  { valueParams := #[]
+    creditParams := #[]
+    instructions := #[
+      .move (.lit (.nat word.toNat)),
+      .move (.reg 0)]
+    terminator := .ret (.reg 1) }
+
+/-- The first selected IxIR₂ family.  The second move is intentional: it
+exercises block-local SSA register resolution instead of selecting a literal
+return directly. -/
+def scalarMoveProgram (word : Word) : IxIR2.Program :=
+  { declarations := []
+    main :=
+      { signature := scalarSignature
+        blocks := #[scalarMoveBlock word] } }
+
+private def moveCandidate? (source : IxIR2.Program) : Option Word := do
+  let block ← source.main.blocks[0]?
+  let .move (.lit (.nat number)) ← block.instructions[0]? | none
+  return UInt64.ofNat number
+
+/-- Recognize the bounded literal/alias family by reflecting exact program
+equality. The comparison also rejects a Nat that wraps at the word boundary. -/
+def sourceWord? (source : IxIR2.Program) : Option Word := do
+  let word ← moveCandidate? source
+  if source == scalarMoveProgram word then some word else none
+
+@[simp] theorem sourceWord?_scalarMoveProgram (word : Word) :
+    sourceWord? (scalarMoveProgram word) = some word := by
+  simp [sourceWord?, moveCandidate?, scalarMoveProgram, scalarMoveBlock,
+    scalarSignature, UInt64.ofNat_toNat]
+
+theorem sourceWord?_sound {source : IxIR2.Program} {word : Word}
+    (found : sourceWord? source = some word) : source = scalarMoveProgram word := by
+  obtain ⟨candidate, _, selected⟩ := Option.bind_eq_some_iff.mp found
+  split at selected
+  · rename_i matched
+    cases Option.some.inj selected
+    exact beq_iff_eq.mp matched
+  · contradiction
+
+/-- Both recognized graphs retain exact source equations. The closed
+application family is the actual validated Ixon compiler output. -/
+inductive SourceShape (source : IxIR2.Program) (word : Word) : Prop where
+  | moves (exactSource : source = scalarMoveProgram word)
+  | closedApply (workerAddress entryAddress : Ixon.Address)
+      (distinct : workerAddress ≠ entryAddress)
+      (exactSource : source = ScalarApply.program word workerAddress entryAddress)
+
+private structure Recognized (source : IxIR2.Program) where
+  word : Word
+  shape : SourceShape source word
+
+private def applyCandidate? (source : IxIR2.Program) :
+    Option (Word × Ixon.Address × Ixon.Address) := do
+  let [(workerAddress, .fn worker), (entryAddress, .fn _)] := source.declarations | none
+  let block ← worker.blocks[0]?
+  let .ret (.lit (.nat number)) := block.terminator | none
+  return (UInt64.ofNat number, workerAddress, entryAddress)
+
+private def recognize (source : IxIR2.Program) : Option (Recognized source) :=
+  match found : sourceWord? source with
+  | some word => some { word, shape := .moves (sourceWord?_sound found) }
+  | none => do
+      let (word, workerAddress, entryAddress) ← applyCandidate? source
+      if distinct : workerAddress = entryAddress then none
+      else if matched : source == ScalarApply.program word workerAddress entryAddress then
+        some { word, shape := .closedApply workerAddress entryAddress distinct (beq_iff_eq.mp matched) }
+      else none
+
+private theorem recognize_scalarMoveProgram (word : Word) :
+    recognize (scalarMoveProgram word) = some { word, shape := .moves rfl } := by
+  unfold recognize
+  split
+  · rename_i candidate found
+    have same : candidate = word := Option.some.inj
+      (found.symm.trans (sourceWord?_scalarMoveProgram word))
+    subst candidate
+    rfl
+  · rename_i found
+    simp at found
+
+/-- Initial scalar calling convention: a nullary leaf returns its machine word
+in `rax`; it needs no frame and does not touch the entry stack pointer. -/
+def targetProgram (word : Word) : X86.Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[.mov .w64 SysV.resultRegister (.imm word)]
+        terminator := .ret }] }
+
+theorem targetProgram_wellFormed (word : Word) :
+    (targetProgram word).wellFormed = true := by
+  simp [targetProgram, X86.Program.wellFormed, X86.Program.hasBlock,
+    X86.Block.offsetsFit, X86.Block.targetsValid,
+    X86.Instr.targetsValid, X86.Terminator.targetsValid]
+
+def targetChecked (word : Word) : X86.Checked :=
+  { program := targetProgram word
+    valid := targetProgram_wellFormed word }
+
+inductive Error where
+  | invalidSource (error : IxIR2.Validate.Error)
+  | unsupportedScalarShape
+  deriving Repr
+
+/-- A selected target carries the exact successful source-validation equation
+that authorized selection. -/
+structure Output (source : IxIR2.Program) where
+  sourceStats : IxIR2.Validate.Stats
+  sourceAccepted :
+    IxIR2.Validate.validate validationContext source = .ok sourceStats
+  word : Word
+  shape : SourceShape source word
+  target : X86.Checked
+  targetProduced : target = targetChecked word
+
+theorem Output.sourceValid {source : IxIR2.Program} (output : Output source) :
+    IxIR2.Validate.Valid validationContext source :=
+  ⟨output.sourceStats, output.sourceAccepted⟩
+
+/-- Validator-gated selection for the first scalar slice. -/
+def select (source : IxIR2.Program) : Except Error (Output source) :=
+  match accepted : IxIR2.Validate.validate validationContext source with
+  | .error error => .error (.invalidSource error)
+  | .ok stats =>
+      match recognize source with
+      | none => .error .unsupportedScalarShape
+      | some recognized =>
+          .ok
+            { sourceStats := stats
+              sourceAccepted := accepted
+              word := recognized.word
+              shape := recognized.shape
+              target := targetChecked recognized.word
+              targetProduced := rfl }
+
+/-- Any validated member of the canonical scalar family is accepted by the
+selector, and the selected word and typed target are definitionally the ones
+used by the semantic refinement theorem below. -/
+theorem select_scalarMoveProgram (word : Word)
+    (stats : IxIR2.Validate.Stats)
+    (accepted : IxIR2.Validate.validate validationContext
+      (scalarMoveProgram word) = .ok stats) :
+    ∃ output, select (scalarMoveProgram word) = .ok output ∧
+      output.word = word ∧ output.target = targetChecked word := by
+  unfold select
+  split
+  · rename_i error invalid
+    simp_all
+  · rename_i selectedStats valid
+    have same : selectedStats = stats := Except.ok.inj (valid.symm.trans accepted)
+    subst selectedStats
+    rw [recognize_scalarMoveProgram]
+    exact ⟨_, rfl, rfl, rfl⟩
+
+def sourceContext (word : Word) : IxIR2.Eval.Context :=
+  IxIR2.Eval.Context.ofProgram (scalarMoveProgram word) (fun _ _ => none)
+
+private def sourceFrame0 (word : Word) : IxIR2.Eval.Frame :=
+  { definition := (scalarMoveProgram word).main }
+
+private def sourceFrame1 (word : Word) : IxIR2.Eval.Frame :=
+  { definition := (scalarMoveProgram word).main
+    pc := 1
+    values := #[.lit (.nat word.toNat)] }
+
+private def sourceFrame2 (word : Word) : IxIR2.Eval.Frame :=
+  { definition := (scalarMoveProgram word).main
+    pc := 2
+    values := #[.lit (.nat word.toNat), .lit (.nat word.toNat)] }
+
+private def sourceMachine0 (word : Word) : IxIR2.Eval.Machine :=
+  { heapFuel := 0
+    control := .running (sourceFrame0 word) [] }
+
+private def sourceMachine1 (word : Word) : IxIR2.Eval.Machine :=
+  { heapFuel := 0
+    control := .running (sourceFrame1 word) [] }
+
+private def sourceMachine2 (word : Word) : IxIR2.Eval.Machine :=
+  { heapFuel := 0
+    control := .running (sourceFrame2 word) [] }
+
+private def sourceHalted (word : Word) : IxIR2.Eval.Machine :=
+  { heapFuel := 0
+    control := .halted (.lit (.nat word.toNat)) }
+
+theorem scalarMoveSteps (word : Word) (context : IxIR2.Eval.Context := sourceContext word) :
+    IxIR2.Eval.Steps context .physical 3
+      (sourceMachine0 word) (sourceHalted word) := by
+  have first : IxIR2.Eval.Step context .physical
+      (sourceMachine0 word) (sourceMachine1 word) := by
+    simpa [sourceMachine0, sourceMachine1, sourceFrame0, sourceFrame1]
+      using
+        (IxIR2.Eval.Step.move
+          (context := context) (interpretation := .physical)
+          (machine := sourceMachine0 word) (frame := sourceFrame0 word)
+          (stack := []) (block := scalarMoveBlock word)
+          (atom := .lit (.nat word.toNat))
+          (value := .lit (.nat word.toNat))
+          (control := rfl)
+          (blockAt := by
+            simp [sourceFrame0, scalarMoveProgram, scalarMoveBlock])
+          (pc := by simp [sourceFrame0, scalarMoveBlock])
+          (instruction := by simp [sourceFrame0, scalarMoveBlock])
+          (resolved := rfl))
+  have second : IxIR2.Eval.Step context .physical
+      (sourceMachine1 word) (sourceMachine2 word) := by
+    simpa [sourceMachine1, sourceMachine2, sourceFrame1, sourceFrame2]
+      using
+        (IxIR2.Eval.Step.move
+          (context := context) (interpretation := .physical)
+          (machine := sourceMachine1 word) (frame := sourceFrame1 word)
+          (stack := []) (block := scalarMoveBlock word)
+          (atom := .reg 0) (value := .lit (.nat word.toNat))
+          (control := rfl)
+          (blockAt := by
+            simp [sourceFrame1, scalarMoveProgram, scalarMoveBlock])
+          (pc := by simp [sourceFrame1, scalarMoveBlock])
+          (instruction := by simp [sourceFrame1, scalarMoveBlock])
+          (resolved := by simp [sourceFrame1, IxIR2.Eval.resolveAtom]))
+  have third : IxIR2.Eval.Step context .physical
+      (sourceMachine2 word) (sourceHalted word) := by
+    simpa [sourceMachine2, sourceHalted, sourceFrame2]
+      using
+        (IxIR2.Eval.Step.retHalt
+          (context := context) (interpretation := .physical)
+          (machine := sourceMachine2 word) (frame := sourceFrame2 word)
+          (block := scalarMoveBlock word) (atom := .reg 1)
+          (value := .lit (.nat word.toNat))
+          (control := rfl)
+          (blockAt := by
+            simp [sourceFrame2, scalarMoveProgram, scalarMoveBlock])
+          (pc := by simp [sourceFrame2, scalarMoveBlock])
+          (terminator := rfl)
+          (resolved := by simp [sourceFrame2, IxIR2.Eval.resolveAtom])
+          (noCredits := rfl)
+          (world := rfl))
+  exact .cons rfl first (.cons rfl second (.cons rfl third (.refl _)))
+
+theorem scalarMoveSourceRuns (word : Word) (context : IxIR2.Eval.Context := sourceContext word) :
+    IxIR2.Eval.runMain context .physical
+        (scalarMoveProgram word) 3 0 =
+      .ok
+        { store := {}
+          value := .lit (.nat word.toNat)
+          controlRemaining := 0
+          heapRemaining := 0 } := by
+  rw [IxIR2.Eval.runMain_eq_runMachine (arity := rfl)
+    (nonempty := by simp [scalarMoveProgram])]
+  exact (scalarMoveSteps word context).runMachine_halted
+
+theorem scalarMoveTargetRuns (word : Word) (core : X86.Core) :
+    let result := X86.runFrom X86.Runtime.rejecting (targetChecked word) 2
+      core
+    result.status = .halted word ∧
+      result.core.readReg .rsp = core.readReg .rsp := by
+  simp [X86.runFrom, X86.run, X86.step, X86.Machine.initial,
+    targetChecked, targetProgram, X86.executeInstr, X86.executeTerminator,
+    X86.Machine.advanceWith, X86.PC.next?,
+    X86.MoveSource.eval, X86.Core.writeReg, X86.Core.setReg,
+    X86.Core.readReg, X86.Registers.set, SysV.resultRegister]
+
+/-- Semantic refinement for the complete first slice.  The source observation
+is the Nat literal corresponding exactly to the target word, and the target
+additionally preserves the System V entry stack pointer. -/
+theorem scalarMoveRefines (word : Word) :
+    IxIR2.Eval.runMain (sourceContext word) .physical
+        (scalarMoveProgram word) 3 0 =
+      .ok
+        { store := {}
+          value := .lit (.nat word.toNat)
+          controlRemaining := 0
+          heapRemaining := 0 } ∧
+    (X86.runFrom X86.Runtime.rejecting (targetChecked word) 2
+      (X86.Core.empty 0x1008)).status = .halted word := by
+  exact ⟨scalarMoveSourceRuns word,
+    (scalarMoveTargetRuns word (X86.Core.empty 0x1008)).1⟩
+
+/-- Flagship validator-to-semantics statement for this first slice: once the
+ordinary IxIR₂ validator accepts a canonical member, the executable selector
+returns a checked target and both machines return the same 64-bit scalar. -/
+theorem selectScalarMoveRefines (word : Word)
+    (stats : IxIR2.Validate.Stats)
+    (accepted : IxIR2.Validate.validate validationContext
+      (scalarMoveProgram word) = .ok stats) :
+    ∃ output, select (scalarMoveProgram word) = .ok output ∧
+      output.word = word ∧
+      IxIR2.Eval.runMain (sourceContext word) .physical
+          (scalarMoveProgram word) 3 0 =
+        .ok
+          { store := {}
+            value := .lit (.nat word.toNat)
+            controlRemaining := 0
+            heapRemaining := 0 } ∧
+      (X86.runFrom X86.Runtime.rejecting output.target 2
+        (X86.Core.empty 0x1008)).status = .halted word := by
+  obtain ⟨output, selected, result, target⟩ :=
+    select_scalarMoveProgram word stats accepted
+  refine ⟨output, selected, result, scalarMoveSourceRuns word, ?_⟩
+  rw [target]
+  exact (scalarMoveTargetRuns word (X86.Core.empty 0x1008)).1
+
+theorem SourceShape.entryFacts {source : IxIR2.Program} {word : Word}
+    (shape : SourceShape source word) :
+    source.main.signature.params.size = 0 ∧ source.main.blocks.isEmpty = false := by
+  cases shape with
+  | moves exactSource => subst source; exact ⟨rfl, rfl⟩
+  | closedApply workerAddress entryAddress distinct exactSource =>
+      subst source; exact ⟨rfl, rfl⟩
+
+/-- Shape reflection produces a physical run of the exact accepted graph.
+Schemas and the oracle are arbitrary because neither supported graph uses
+constructor layouts or extern calls. -/
+theorem SourceShape.sourceRuns {source : IxIR2.Program} {word : Word}
+    (shape : SourceShape source word)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema)
+    (oracle : Ixon.Address → List IxIR1.RVal → Option IxIR1.RVal) :
+    ∃ controlFuel heapFuel result,
+      IxIR2.Eval.runMain (IxIR2.Eval.Context.ofProgram source schemas oracle)
+        .physical source controlFuel heapFuel = .ok result ∧
+      result.value = .lit (.nat word.toNat) := by
+  cases shape with
+  | moves exactSource =>
+      subst source
+      exact ⟨3, 0, _, scalarMoveSourceRuns word _, rfl⟩
+  | closedApply workerAddress entryAddress distinct exactSource =>
+      subst source
+      exact ⟨6, 2, _, ScalarApply.runs word workerAddress entryAddress distinct
+        .physical 0 0 schemas oracle, rfl⟩
+
+/-- Correctness of the actual returned selector artifact. Every successful
+physical execution of its source returns the selected scalar, independently
+of both evaluator budgets, and the exact selected typed x86 target returns
+that word while preserving the entry stack pointer. -/
+theorem Output.refinesSuccessfulRun {source : IxIR2.Program}
+    (output : Output source)
+    {schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema}
+    {oracle : Ixon.Address → List IxIR1.RVal → Option IxIR1.RVal}
+    {controlFuel heapFuel : Nat} {result : IxIR2.Eval.Result}
+    (run : IxIR2.Eval.runMain (IxIR2.Eval.Context.ofProgram source schemas oracle)
+      .physical source controlFuel heapFuel = .ok result)
+    (core : X86.Core) :
+    result.value = .lit (.nat output.word.toNat) ∧
+      (X86.runFrom X86.Runtime.rejecting output.target 2 core).status = .halted output.word ∧
+      (X86.runFrom X86.Runtime.rejecting output.target 2 core).core.readReg .rsp = core.readReg .rsp := by
+  obtain ⟨_, _, expected, expectedRun, value⟩ := output.shape.sourceRuns schemas oracle
+  have same := IxIR2.Eval.runMain_success_unique output.shape.entryFacts.1
+    output.shape.entryFacts.2 run expectedRun
+  refine ⟨same.2.trans value, ?_⟩
+  rw [output.targetProduced]
+  exact scalarMoveTargetRuns output.word core
+
+end Ix.Compiler.X86.Select
diff --git a/Ix/Compiler/X86/SelectExamples.lean b/Ix/Compiler/X86/SelectExamples.lean
new file mode 100644
index 000000000..065e79cd7
--- /dev/null
+++ b/Ix/Compiler/X86/SelectExamples.lean
@@ -0,0 +1,123 @@
+import Ix.Compiler.X86.Select
+import Ix.Compiler.X86.Encode
+
+/-! Executable and proof-facing checks for the first IxIR₂ selector slice. -/
+
+namespace Ix.Compiler.X86.Select.Examples
+
+open Ix.Compiler
+
+def fixtureWord : X86.Word := 42
+
+def fixtureSource : IxIR2.Program := scalarMoveProgram fixtureWord
+
+def fixtureStats : IxIR2.Validate.Stats :=
+  { functions := 1
+    blocks := 1
+    instructions := 2
+    flowWork := 8 }
+
+def fixtureValidationAccepted : Bool :=
+  match IxIR2.Validate.validate validationContext fixtureSource with
+  | .ok stats => stats == fixtureStats
+  | .error _ => false
+
+#guard fixtureValidationAccepted
+
+def selectionAccepted : Bool :=
+  match select fixtureSource with
+  | .error _ => false
+  | .ok output =>
+      output.word == fixtureWord &&
+        output.target.program == targetProgram fixtureWord
+
+#guard selectionAccepted
+
+def invalidRegisterSource : IxIR2.Program :=
+  { declarations := []
+    main :=
+      { signature := scalarSignature
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .move (.lit (.nat fixtureWord.toNat)),
+              .move (.reg 9)]
+            terminator := .ret (.reg 1) }] } }
+
+#guard match select invalidRegisterSource with
+  | .error (.invalidSource _) => true
+  | _ => false
+
+def overflowingLiteralSource : IxIR2.Program :=
+  { declarations := []
+    main :=
+      { signature := scalarSignature
+        blocks := #[
+          { valueParams := #[]
+            creditParams := #[]
+            instructions := #[
+              .move (.lit (.nat UInt64.size)),
+              .move (.reg 0)]
+            terminator := .ret (.reg 1) }] } }
+
+#guard match IxIR2.Validate.validate validationContext overflowingLiteralSource,
+    select overflowingLiteralSource with
+  | .ok _, .error .unsupportedScalarShape => true
+  | _, _ => false
+
+def selectedBytesAccepted : Bool :=
+  match select fixtureSource with
+  | .error _ => false
+  | .ok output =>
+      match X86.Encode.encode output.target with
+      | .error _ => false
+      | .ok encoded =>
+          encoded.text == ByteArray.mk #[
+            0x48, 0xb8, 0x2a, 0, 0, 0, 0, 0, 0, 0,
+            0xc3] &&
+          encoded.blockOffsets == #[0] && encoded.relocations.isEmpty
+
+#guard selectedBytesAccepted
+
+def workerAddress : Ixon.Address := Ixon.Address.replicate 0x53
+def entryAddress : Ixon.Address := Ixon.Address.replicate 0x54
+
+def closedApplyAccepted (word : X86.Word) : Bool :=
+  match select (ScalarApply.program word workerAddress entryAddress) with
+  | .error _ => false
+  | .ok output => output.word == word && output.target.program == targetProgram word
+
+#guard closedApplyAccepted 0
+#guard closedApplyAccepted fixtureWord
+#guard closedApplyAccepted (UInt64.ofNat (UInt64.size - 1))
+
+/-- Reading only the worker's literal would silently miscompile this valid
+graph: its entry returns seven without calling the worker. -/
+def changedEntrySource : IxIR2.Program :=
+  { ScalarApply.program fixtureWord workerAddress entryAddress with
+    declarations :=
+      [(workerAddress, .fn (ScalarApply.worker fixtureWord)),
+       (entryAddress, .fn
+         { ScalarApply.entry workerAddress with
+           blocks := #[{ valueParams := #[], creditParams := #[]
+                         instructions := #[.move (.lit (.nat 7))]
+                         terminator := .ret (.reg 0) }] })] }
+
+#guard match IxIR2.Validate.validate validationContext changedEntrySource,
+    select changedEntrySource with
+  | .ok _, .error .unsupportedScalarShape => true
+  | _, _ => false
+
+theorem fixtureRefines :
+    IxIR2.Eval.runMain (sourceContext fixtureWord) .physical fixtureSource 3 0 =
+      .ok
+        { store := {}
+          value := .lit (.nat fixtureWord.toNat)
+          controlRemaining := 0
+          heapRemaining := 0 } ∧
+    (X86.runFrom X86.Runtime.rejecting (targetChecked fixtureWord) 2
+      (X86.Core.empty 0x1008)).status = .halted fixtureWord :=
+  scalarMoveRefines fixtureWord
+
+end Ix.Compiler.X86.Select.Examples
diff --git a/Ix/Compiler/X86/StreamCalls.lean b/Ix/Compiler/X86/StreamCalls.lean
new file mode 100644
index 000000000..ea3625e49
--- /dev/null
+++ b/Ix/Compiler/X86/StreamCalls.lean
@@ -0,0 +1,220 @@
+import Ix.Compiler.X86.StreamEffects
+
+/-! Complete-text call and return effects, with bytewise return-slot
+correspondence preserved across ordinary callee instructions. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+structure Related (program : Program) (base : Word) (holes : Holes) (machine : Machine) (state : ByteEval.State) : Prop where
+  core : CoreRelated program base holes machine.returns machine.core state.core
+  running : machine.status = .running
+  pc : AtPC program base machine.pc state.rip
+
+theorem paired_linear_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (holes : Holes) (state : ByteEval.State) (related : Related checked.program base holes machine state)
+    {block : Block} {instruction : Instr}
+    (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[machine.pc.offset.toNat]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true)
+    (safe : OperationSafe holes machine.returns (Encode.instructionOperation instruction) machine.core)
+    (nextRunning : (step runtime checked machine).status = .running) :
+    ∃ after, ByteEval.step output.text base state = .ok after ∧
+      Related checked.program base (nextHoles holes (Encode.instructionOperation instruction) machine.core)
+        (step runtime checked machine) after := by
+  have fetched := fetch_linear valid base state.rip machine.pc related.pc found foundInstruction linear
+  have agreement := linear_step valid runtime machine related.running base state.rip state.flags
+    related.pc found foundInstruction linear
+  simp only [ByteEval.step, fetched] at agreement
+  have pair := operation_pair checked.program base state.rip state.flags holes machine.returns
+    machine.core state.core related.core (Encode.instructionOperation instruction) (instructionSize instruction)
+    (instruction_linear_operation instruction linear) safe
+  have sourceStep : step runtime checked machine = executeInstr runtime checked instruction machine := by
+    simp [step, related.running, found, foundInstruction]
+  have returns : (step runtime checked machine).returns = machine.returns := by
+    rw [sourceStep, linear_returns runtime checked machine instruction linear]
+  cases logicalStep : ByteEval.execute ⟨Encode.instructionOperation instruction, instructionSize instruction⟩
+      ⟨machine.core, state.rip, state.flags⟩ with
+  | error fault =>
+      cases fault with
+      | memory fault =>
+          simp only [logicalStep, LinearResult] at agreement
+          rw [agreement] at nextRunning
+          contradiction
+      | decode rip | undefinedCondition condition => simp [logicalStep, LinearResult] at agreement
+  | ok logicalAfter =>
+      simp only [logicalStep, LinearResult] at agreement
+      cases physicalStep : ByteEval.execute ⟨Encode.instructionOperation instruction, instructionSize instruction⟩ state with
+      | error fault => simp [logicalStep, physicalStep, CorePair] at pair
+      | ok physicalAfter =>
+          simp only [logicalStep, physicalStep, CorePair] at pair
+          have sameRip := (linear_rip instruction linear state (instructionSize instruction) physicalStep).trans
+            (linear_rip instruction linear ⟨machine.core, state.rip, state.flags⟩
+              (instructionSize instruction) logicalStep).symm
+          refine ⟨physicalAfter, by simp [ByteEval.step, fetched, physicalStep], ?_⟩
+          refine ⟨?_, nextRunning, ?_⟩
+          · rw [returns, agreement.1]
+            exact pair
+          · rw [sameRip]
+            exact agreement.2.2
+
+theorem CoreRelated.comparison {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical)
+    (comparison : Compare) (condition : Condition) :
+    comparison.holds condition logical = comparison.holds condition physical := by
+  have source : comparison.right.eval logical = comparison.right.eval physical := by
+    cases comparison.right <;> simp [AluSource.eval, related.readReg]
+  simp only [Compare.holds, related.readReg, source]
+
+theorem paired_control_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (holes : Holes) (state : ByteEval.State) (related : Related checked.program base holes machine state)
+    {block : Block} (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (position : machine.pc.offset.toNat = block.instructions.size) (notRet : block.terminator ≠ .ret) :
+    ∃ count after, 0 < count ∧ count ≤ 3 ∧ ByteEval.run output.text base count state = .ok after ∧
+      Related checked.program base holes (step runtime checked machine) after := by
+  have sourceStep := source_terminator runtime machine related.running found position
+  have address := related.pc.offset found (by omega)
+  rw [position] at address
+  have accepted := valid.terminator machine.pc.block.toNat block found
+  have bound := terminator_bound found
+  have textBound := valid.textBound
+  cases term : block.terminator with
+  | ret => exact False.elim (notRet term)
+  | jump target | tailCall target =>
+      rw [term] at accepted bound
+      change targets _ _ _ .jump 5 target = true at accepted
+      have targetBound := (targets_sound accepted).1
+      have jumped := jump_at accepted base state address (by simp only [terminatorSize] at bound; omega)
+      have goEqual : step runtime checked machine = { machine with pc := ⟨target, 0⟩ } := by
+        simp [sourceStep, term, executeTerminator, Machine.goto, hasBlock_of_bound targetBound]
+      refine ⟨1, { state with rip := base + UInt64.ofNat (blockOffset checked.program target.toNat) },
+        by decide, by decide, by simp [ByteEval.run, jumped], ?_⟩
+      rw [goEqual]
+      exact ⟨related.core, related.running, _, target_entry targetBound, rfl⟩
+  | branch comparison condition yes no =>
+      rw [term] at accepted bound
+      have branched := branch_at accepted base state address (by simp only [terminatorSize] at bound; omega)
+      have parts := accepted
+      simp only [terminatorMatches, Bool.and_eq_true, and_assoc] at parts
+      have yesBound := (targets_sound parts.2.1).1
+      have noBound := (targets_sound parts.2.2).1
+      have targetBound : (if comparison.holds condition state.core then yes else no).toNat < checked.program.blocks.size := by
+        split <;> assumption
+      have goEqual : step runtime checked machine =
+          { machine with pc := ⟨if comparison.holds condition state.core then yes else no, 0⟩ } := by
+        simp [sourceStep, term, executeTerminator, related.core.comparison comparison condition,
+          Machine.goto, hasBlock_of_bound targetBound]
+      refine ⟨if comparison.holds condition state.core then 2 else 3, _, ?_, ?_, branched, ?_⟩
+      · split <;> decide
+      · split <;> decide
+      · rw [goEqual]
+        exact ⟨related.core, related.running, _, target_entry targetBound, rfl⟩
+
+theorem call_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (holes : Holes) (state : ByteEval.State) (related : Related checked.program base holes machine state)
+    {block : Block} {target : BlockId}
+    (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[machine.pc.offset.toNat]? = some (.call target))
+    (aligned : SysV.callSiteAligned (machine.core.readReg .rsp) = true)
+    (writable : Memory.rangeAllowed machine.core.memory.writable (machine.core.readReg .rsp - 8) 8 = true)
+    (disjoint : FramesDisjoint machine.returns (machine.core.readReg .rsp - 8) 8) :
+    ∃ after, ByteEval.step output.text base state = .ok after ∧
+      Related checked.program base (addRange holes (machine.core.readReg .rsp - 8) 8)
+        (step runtime checked machine) after := by
+  have accepted := valid.instruction _ _ found _ _ foundInstruction
+  change targets _ _ _ .call 5 target = true at accepted
+  obtain ⟨targetBound, fits, fetched⟩ := targets_sound accepted
+  have indexBound := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+  have address := related.pc.offset found (by omega)
+  have mapped : pcOffset? checked.program machine.pc =
+      some (blockOffset checked.program machine.pc.block.toNat + instructionOffset block machine.pc.offset.toNat) := by
+    simp [pcOffset?, found, show machine.pc.offset.toNat ≤ block.instructions.size by omega]
+  have physicalFetch := step_decoded address (AtPC.small valid.textBound mapped) fetched
+  have next := pc_next found foundInstruction
+  have continuation := pcOffset_next found foundInstruction
+  have size : instructionSize (.call target) = 5 := rfl
+  rw [size] at continuation
+  let nextOffset := blockOffset checked.program machine.pc.block.toNat + instructionOffset block machine.pc.offset.toNat + 5
+  have nextAddress : state.rip + 5 = base + UInt64.ofNat nextOffset := by
+    simp [nextOffset, address, UInt64.ofNat_add, UInt64.add_assoc]
+  have resolved := Encode.relative_resolves_base base nextOffset (blockOffset checked.program target.toNat) fits
+  have sourceStep : step runtime checked machine =
+      Encode.typedCallState machine target { machine.pc with offset := machine.pc.offset + 1 } := by
+    simp [step, related.running, found, foundInstruction, executeInstr, aligned, hasBlock_of_bound targetBound,
+      next.1, Memory.write64?, Memory.write?, Width.bytes, writable, Encode.typedCallState, Memory.write64]
+  let physicalAfter : ByteEval.State := {
+    core := { state.core.setReg .rsp (machine.core.readReg .rsp - 8) with
+      memory := state.core.memory.write64 (machine.core.readReg .rsp - 8) (state.rip + 5) }
+    rip := base + UInt64.ofNat (blockOffset checked.program target.toNat), flags := state.flags }
+  have physicalStep : ByteEval.step output.text base state = .ok physicalAfter := by
+    rw [physicalFetch]
+    simp only [ByteEval.execute, Memory.write64?, Memory.write?, Width.bytes, ← related.core.readReg .rsp,
+      ← related.core.memory.writable, writable, ↓reduceIte, Except.mapError, bind, Except.bind, pure, Except.pure]
+    change Except.ok ({ core := _, rip := ByteEval.relative (state.rip + 5) (displacement nextOffset (blockOffset checked.program target.toNat)), flags := state.flags } : ByteEval.State) = _
+    rw [nextAddress]
+    change Except.ok ({ core := _, rip := ByteEval.relative (base + UInt64.ofNat nextOffset) (Int32.ofInt ((blockOffset checked.program target.toNat : Int) - nextOffset)).toUInt32, flags := state.flags } : ByteEval.State) = _
+    rw [resolved]
+    rfl
+  refine ⟨physicalAfter, physicalStep, ?_⟩
+  rw [sourceStep]
+  refine ⟨?_, related.running, _, target_entry targetBound, rfl⟩
+  refine ⟨(related.core.setReg .rsp _).registers, ?_, ?_⟩
+  · exact related.core.memory.write_different _ _ _ 8
+  · intro frame member
+    change frame ∈ _ :: machine.returns at member
+    rcases List.mem_cons.mp member with equal | member
+    · subst frame
+      exact ⟨nextOffset, continuation, by simpa [physicalAfter, Memory.read64_write64] using nextAddress⟩
+    · exact related.core.frames.write _ _ 8 disjoint frame member
+
+theorem ret_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (holes : Holes) (state : ByteEval.State) (related : Related checked.program base holes machine state)
+    {block : Block} (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (position : machine.pc.offset.toNat = block.instructions.size) (term : block.terminator = .ret)
+    (frame : ReturnFrame) (rest : List ReturnFrame) (returns : machine.returns = frame :: rest)
+    (stack : machine.core.readReg .rsp = frame.returnSlot)
+    (typedRead : machine.core.memory.read64? frame.returnSlot = .ok frame.continuation.encode)
+    (saved : machine.core.calleeSavedMatch frame.calleeSaved = true) :
+    ∃ after, ByteEval.step output.text base state = .ok after ∧
+      Related checked.program base holes (step runtime checked machine) after := by
+  obtain ⟨offset, continuation, slot⟩ := related.core.frames frame (by simp [returns])
+  have allowed : Memory.rangeAllowed machine.core.memory.readable frame.returnSlot 8 = true := by
+    by_cases allowed : Memory.rangeAllowed machine.core.memory.readable frame.returnSlot 8 = true
+    · exact allowed
+    · simp [Memory.read64?, Memory.read?, Width.bytes, allowed] at typedRead
+  have physicalRead : state.core.memory.read64? frame.returnSlot = .ok (base + UInt64.ofNat offset) := by
+    simp only [Memory.read64?, Memory.read?, ← related.core.memory.readable, Width.bytes, allowed, ↓reduceIte]
+    exact congrArg Except.ok slot
+  have sourceStep : step runtime checked machine =
+      { machine with core := machine.core.setReg .rsp (frame.returnSlot + 8), pc := frame.continuation, returns := rest } := by
+    rw [source_terminator runtime machine related.running found position, term]
+    simp [executeTerminator, returns, stack, typedRead, saved]
+  have fetched := valid.terminator _ _ found
+  have decode : Decode.decodeAt output.text
+      (blockOffset checked.program machine.pc.block.toNat + instructionOffset block block.instructions.size) =
+      some ⟨.ret, 1⟩ := by
+    simpa [term, terminatorMatches, decodes, beq_iff_eq] using fetched
+  have address := related.pc.offset found (by omega)
+  rw [position] at address
+  have bound := terminator_bound found
+  have textBound := valid.textBound
+  rw [term] at bound
+  have one := step_decoded address (by simp only [terminatorSize] at bound; omega) decode
+  let after : ByteEval.State := ⟨state.core.setReg .rsp (frame.returnSlot + 8), base + UInt64.ofNat offset, state.flags⟩
+  have executed : ByteEval.step output.text base state = .ok after := by
+    rw [one]
+    simp [ByteEval.execute, ← related.core.readReg .rsp, stack, physicalRead, Except.mapError, after]
+  refine ⟨after, executed, ?_⟩
+  rw [sourceStep]
+  refine ⟨?_, related.running, offset, continuation, rfl⟩
+  have core := related.core.setReg .rsp (frame.returnSlot + 8)
+  refine ⟨core.registers, core.memory, ?_⟩
+  intro remaining member
+  exact core.frames remaining (by simp [returns, member])
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamControl.lean b/Ix/Compiler/X86/StreamControl.lean
new file mode 100644
index 000000000..45bc850ad
--- /dev/null
+++ b/Ix/Compiler/X86/StreamControl.lean
@@ -0,0 +1,121 @@
+import Ix.Compiler.X86.StreamLinear
+
+/-! Control transfers fetched from complete certified text. The branch
+recipe takes two or three byte steps and reaches the mapped typed target. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+theorem targets_sound {program : Program} {text : ByteArray} {offset length : Nat}
+    {operation : Imm32 → Decode.Operation} {target : BlockId}
+    (accepted : targets program text offset operation length target = true) :
+    target.toNat < program.blocks.size ∧
+      Encode.fitsSigned32 ((blockOffset program target.toNat : Int) - (offset + length)) = true ∧
+      Decode.decodeAt text offset =
+        some ⟨operation (displacement (offset + length) (blockOffset program target.toNat)), length⟩ := by
+  simpa only [targets, decodes, Bool.and_eq_true, decide_eq_true_eq, beq_iff_eq, and_assoc] using accepted
+
+theorem step_decoded {text : ByteArray} {base : Word} {state : ByteEval.State}
+    {offset : Nat} {decoded : Decode.Decoded}
+    (address : state.rip = base + UInt64.ofNat offset) (bound : offset < UInt64.size)
+    (fetched : Decode.decodeAt text offset = some decoded) :
+    ByteEval.step text base state = ByteEval.execute decoded state := by
+  simp [ByteEval.step, address, rip_offset _ _ bound, fetched]
+
+theorem jump_at {program : Program} {text : ByteArray} {offset : Nat} {target : BlockId}
+    (accepted : targets program text offset .jump 5 target = true)
+    (base : Word) (state : ByteEval.State)
+    (address : state.rip = base + UInt64.ofNat offset) (bound : offset < UInt64.size) :
+    ByteEval.step text base state =
+      .ok { state with rip := base + UInt64.ofNat (blockOffset program target.toNat) } := by
+  obtain ⟨_, fits, fetched⟩ := targets_sound accepted
+  rw [step_decoded address bound fetched]
+  have resolved := Encode.relative_resolves_base base (offset + 5) (blockOffset program target.toNat) fits
+  change Except.ok { state with rip := ByteEval.relative (state.rip + 5) (displacement (offset + 5) (blockOffset program target.toNat)) } = _
+  have nextAddress : state.rip + 5 = base + UInt64.ofNat (offset + 5) := by
+    simp [address, UInt64.ofNat_add, UInt64.add_assoc]
+  rw [nextAddress]
+  change Except.ok { state with rip := ByteEval.relative (base + UInt64.ofNat (offset + 5)) (Int32.ofInt ((blockOffset program target.toNat : Int) - ((offset + 5 : Nat) : Int))).toUInt32 } = _
+  rw [resolved]
+
+theorem branch_at {program : Program} {text : ByteArray} {offset : Nat}
+    {comparison : Compare} {condition : Condition} {yes no : BlockId}
+    (accepted : terminatorMatches program text offset (.branch comparison condition yes no) = true)
+    (base : Word) (state : ByteEval.State)
+    (address : state.rip = base + UInt64.ofNat offset)
+    (bound : offset + (Encode.encodeCompare comparison).size + 6 < UInt64.size) :
+    ByteEval.run text base (if comparison.holds condition state.core then 2 else 3) state =
+      .ok { Encode.comparedState comparison state with
+        rip := base + UInt64.ofNat (blockOffset program
+          (if comparison.holds condition state.core then yes else no).toNat) } := by
+  simp only [terminatorMatches, Bool.and_eq_true, and_assoc] at accepted
+  obtain ⟨compareAccepted, yesAccepted, noAccepted⟩ := accepted
+  have compareFetched : Decode.decodeAt text offset = some
+      ⟨.compare comparison.width comparison.left (Encode.aluOperand comparison.width comparison.right),
+        (Encode.encodeCompare comparison).size⟩ := by
+    simpa [decodes, beq_iff_eq] using compareAccepted
+  have first : ByteEval.step text base state = .ok (Encode.comparedState comparison state) := by
+    rw [step_decoded address (by omega) compareFetched]
+    rfl
+  have compareAddress : (Encode.comparedState comparison state).rip =
+      base + UInt64.ofNat (offset + (Encode.encodeCompare comparison).size) := by
+    simp [Encode.comparedState, address, UInt64.ofNat_add, UInt64.add_assoc]
+  obtain ⟨_, fits, fetched⟩ := targets_sound yesAccepted
+  have second := step_decoded compareAddress (by omega) fetched
+  have resolved := Encode.relative_resolves_base base (offset + (Encode.encodeCompare comparison).size + 6)
+    (blockOffset program yes.toNat) fits
+  have taken : ByteEval.step text base (Encode.comparedState comparison state) =
+      .ok { Encode.comparedState comparison state with
+        rip := if comparison.holds condition state.core then
+          base + UInt64.ofNat (blockOffset program yes.toNat)
+        else base + UInt64.ofNat (offset + (Encode.encodeCompare comparison).size + 6) } := by
+    rw [second]
+    simp only [ByteEval.execute]
+    rw [Encode.comparedState_test]
+    have nextAddress : (Encode.comparedState comparison state).rip + UInt64.ofNat 6 =
+        base + UInt64.ofNat (offset + (Encode.encodeCompare comparison).size + 6) := by
+      simp [compareAddress, UInt64.ofNat_add, UInt64.add_assoc]
+    simp only [nextAddress, displacement, resolved]
+    rfl
+  have third := jump_at noAccepted base
+    ({ Encode.comparedState comparison state with
+      rip := base + UInt64.ofNat (offset + (Encode.encodeCompare comparison).size + 6) }) rfl bound
+  cases take : comparison.holds condition state.core <;>
+    simp only [take, Bool.false_eq_true, ↓reduceIte, ByteEval.run, first, taken,
+      bind, Except.bind, third]
+
+theorem terminator_bound {program : Program} {blockIndex : Nat} {block : Block}
+    (found : program.blocks[blockIndex]? = some block) :
+    blockOffset program blockIndex + instructionOffset block block.instructions.size +
+      terminatorSize block.terminator ≤ textSize program := by
+  simpa [instructionOffset_end, blockSize, Nat.add_assoc] using block_end_le found
+
+theorem source_terminator {checked : Checked} (runtime : Runtime) (machine : Machine)
+    (running : machine.status = .running) {block : Block}
+    (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (position : machine.pc.offset.toNat = block.instructions.size) :
+    step runtime checked machine = executeTerminator checked block.terminator machine := by
+  simp [step, running, found, position]
+
+theorem target_entry {program : Program} {target : BlockId}
+    (bound : target.toNat < program.blocks.size) :
+    pcOffset? program ⟨target, 0⟩ = some (blockOffset program target.toNat) :=
+  block_entry (Array.getElem?_eq_getElem bound)
+
+theorem hasBlock_of_bound {program : Program} {target : BlockId}
+    (bound : target.toNat < program.blocks.size) : program.hasBlock target = true := by
+  simpa [Program.hasBlock] using bound
+
+theorem goto_at {checked : Checked} {target : BlockId} (machine : Machine) (base : Word)
+    (bound : target.toNat < checked.program.blocks.size) (running : machine.status = .running) :
+    (machine.goto checked target).core = machine.core ∧
+      (machine.goto checked target).status = .running ∧
+      AtPC checked.program base (machine.goto checked target).pc
+        (base + UInt64.ofNat (blockOffset checked.program target.toNat)) := by
+  have go : machine.goto checked target = { machine with pc := ⟨target, 0⟩ } := by
+    simp [Machine.goto, hasBlock_of_bound bound]
+  rw [go]
+  exact ⟨rfl, running, _, target_entry bound, rfl⟩
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamDecidable.lean b/Ix/Compiler/X86/StreamDecidable.lean
new file mode 100644
index 000000000..fb0e0a9f8
--- /dev/null
+++ b/Ix/Compiler/X86/StreamDecidable.lean
@@ -0,0 +1,72 @@
+import Ix.Compiler.X86.StreamTrace
+
+/-! Executable decisions for the concrete call/stack conditions. These
+instances evaluate the stated predicates; they introduce no reflection axiom. -/
+
+namespace Ix.Compiler.X86.Stream
+
+instance (result : Except MemoryFault Word) (value : Word) : Decidable (result = .ok value) := by
+  cases result with
+  | error fault => exact isFalse (by intro impossible; cases impossible)
+  | ok result => exact decidable_of_iff (result = value) ⟨congrArg Except.ok, Except.ok.inj⟩
+
+instance (address candidate : Word) (count : Nat) : Decidable (inRange address count candidate) := by
+  unfold inRange
+  infer_instance
+
+instance (holes : Holes) [DecidablePred holes] (address : Word) (count : Nat) :
+    DecidablePred (addRange holes address count) := fun candidate => by
+  unfold addRange
+  infer_instance
+
+instance (holes : Holes) [DecidablePred holes] (address : Word) (count : Nat) :
+    DecidablePred (clearRange holes address count) := fun candidate => by
+  unfold clearRange
+  infer_instance
+
+instance (holes : Holes) [DecidablePred holes] (address : Word) (count : Nat) :
+    Decidable (ReadableData holes address count) := by
+  unfold ReadableData
+  infer_instance
+
+instance (frames : List ReturnFrame) (address : Word) (count : Nat) :
+    Decidable (FramesDisjoint frames address count) := by
+  unfold FramesDisjoint
+  infer_instance
+
+instance (holes : Holes) [DecidablePred holes] (frames : List ReturnFrame)
+    (operation : Decode.Operation) (core : Core) : Decidable (OperationSafe holes frames operation core) := by
+  unfold OperationSafe
+  repeat' split
+  all_goals infer_instance
+
+instance (holes : Holes) [DecidablePred holes] (operation : Decode.Operation) (core : Core) :
+    DecidablePred (nextHoles holes operation core) := by
+  unfold nextHoles
+  split <;> infer_instance
+
+instance (program : Program) (machine : Machine) (holes : Holes) [DecidablePred holes] :
+    DecidablePred (holeStep program machine holes) := by
+  unfold holeStep
+  repeat' split
+  all_goals infer_instance
+
+instance (program : Program) (holes : Holes) [DecidablePred holes] (machine : Machine) :
+    Decidable (SafeAt program holes machine) := by
+  unfold SafeAt
+  repeat' split
+  all_goals infer_instance
+
+def safeTraceDecidable (runtime : Runtime) (checked : Checked) (fuel : Nat)
+    (holes : Holes) [DecidablePred holes] (machine : Machine) : Decidable (SafeTrace runtime checked fuel holes machine) :=
+  match fuel with
+  | 0 => isTrue trivial
+  | fuel + 1 => by
+      unfold SafeTrace
+      letI := safeTraceDecidable runtime checked fuel (holeStep checked.program machine holes) (step runtime checked machine)
+      split <;> infer_instance
+
+instance (runtime : Runtime) (checked : Checked) (fuel : Nat) (holes : Holes) [DecidablePred holes] (machine : Machine) :
+    Decidable (SafeTrace runtime checked fuel holes machine) := safeTraceDecidable runtime checked fuel holes machine
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamEffects.lean b/Ix/Compiler/X86/StreamEffects.lean
new file mode 100644
index 000000000..833cba775
--- /dev/null
+++ b/Ix/Compiler/X86/StreamEffects.lean
@@ -0,0 +1,128 @@
+import Ix.Compiler.X86.StreamMemory
+
+/-! Preservation of return-address memory correspondence by ordinary
+decoded instructions. Access premises describe concrete byte ranges; they
+do not assume instruction effects or a simulation relation after execution. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def operationReads (operation : Decode.Operation) (core : Core) : Option (Word × Nat) :=
+  match operation with
+  | .load width _ address => some (address.eval core, width.bytes)
+  | .pop _ => some (core.readReg .rsp, 8)
+  | _ => none
+
+def operationWrites (operation : Decode.Operation) (core : Core) : Option (Word × Nat) :=
+  match operation with
+  | .store width address _ => some (address.eval core, width.bytes)
+  | .push _ => some (core.readReg .rsp - 8, 8)
+  | _ => none
+
+def OperationSafe (holes : Holes) (frames : List ReturnFrame) (operation : Decode.Operation) (core : Core) : Prop :=
+  (match operationReads operation core with
+    | none => True | some (address, count) => ReadableData holes address count) ∧
+  (match operationWrites operation core with
+    | none => True | some (address, count) => FramesDisjoint frames address count)
+
+def nextHoles (holes : Holes) (operation : Decode.Operation) (core : Core) : Holes :=
+  match operationWrites operation core with
+  | none => holes
+  | some (address, count) => clearRange holes address count
+
+def linearOperation : Decode.Operation → Bool
+  | .call _ | .jump _ | .branch _ _ | .ret => false
+  | _ => true
+
+def CorePair (program : Program) (base : Word) (holes : Holes) (frames : List ReturnFrame) :
+    Except ByteEval.Fault ByteEval.State → Except ByteEval.Fault ByteEval.State → Prop
+  | .ok logical, .ok physical => CoreRelated program base holes frames logical.core physical.core
+  | .error left, .error right => left = right
+  | _, _ => False
+
+theorem CoreRelated.operand {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical)
+    (operand : Decode.Operand) : ByteEval.operand operand logical = ByteEval.operand operand physical := by
+  cases operand <;> simp [ByteEval.operand, related.readReg]
+
+theorem width_bytes_le (width : Width) : width.bytes ≤ 8 := by cases width <;> decide
+
+theorem operation_pair (program : Program) (base rip : Word) (flags : ByteEval.Flags)
+    (holes : Holes) (frames : List ReturnFrame) (logical physical : Core)
+    (related : CoreRelated program base holes frames logical physical)
+    (operation : Decode.Operation) (length : Nat) (linear : linearOperation operation = true)
+    (safe : OperationSafe holes frames operation logical) :
+    CorePair program base (nextHoles holes operation logical) frames
+      (ByteEval.execute ⟨operation, length⟩ ⟨logical, rip, flags⟩)
+      (ByteEval.execute ⟨operation, length⟩ ⟨physical, rip, flags⟩) := by
+  cases operation with
+  | mov width destination source =>
+      simp only [ByteEval.execute, pure, Except.pure, CorePair, nextHoles, operationWrites]
+      rw [← related.operand source]
+      exact related.writeReg width destination _
+  | lea destination source =>
+      simp only [ByteEval.execute, pure, Except.pure, CorePair, nextHoles, operationWrites]
+      rw [← related.address source]
+      exact related.setReg destination _
+  | alu operation width destination source =>
+      simp only [ByteEval.execute, pure, Except.pure, CorePair, nextHoles, operationWrites]
+      rw [← related.readReg destination, ← related.operand source]
+      exact related.writeReg width destination _
+  | imul width destination source =>
+      simp only [ByteEval.execute, pure, Except.pure, CorePair, nextHoles, operationWrites]
+      rw [← related.readReg destination, ← related.readReg source]
+      exact related.writeReg width.width destination _
+  | compare width left right =>
+      exact related
+  | load width destination source =>
+      have readEqual := related.memory.read? width (source.eval logical) safe.1
+      have address := related.address source
+      cases loaded : logical.memory.read? width (source.eval logical) with
+      | error fault =>
+          simp [ByteEval.execute, Core.loadReg?, ← address, ← readEqual, loaded, Except.mapError, CorePair]
+      | ok value =>
+          simp only [ByteEval.execute, Core.loadReg?, ← address, ← readEqual, loaded, Except.mapError,
+            bind, Except.bind, pure, Except.pure, CorePair, nextHoles, operationWrites]
+          exact related.setReg destination (width.truncate value)
+  | pop destination =>
+      have readEqual := related.memory.read? .w64 (logical.readReg .rsp) safe.1
+      cases loaded : logical.memory.read? .w64 (logical.readReg .rsp) with
+      | error fault =>
+          simp [ByteEval.execute, Memory.read64?, ← related.readReg .rsp, ← readEqual,
+            loaded, Except.mapError, CorePair]
+      | ok value =>
+          simp only [ByteEval.execute, Memory.read64?, ← related.readReg .rsp, ← readEqual,
+            loaded, Except.mapError, bind, Except.bind, pure, Except.pure,
+            CorePair, nextHoles, operationWrites]
+          exact (related.setReg .rsp _).setReg destination value
+  | store width destination source =>
+      have address := related.address destination
+      have permissions := related.memory.writable
+      cases allowed : Memory.rangeAllowed logical.memory.writable (destination.eval logical) width.bytes with
+      | false =>
+          simp [ByteEval.execute, Core.storeReg?, Memory.write?, ← address, ← permissions, allowed, Except.mapError, CorePair]
+      | true =>
+          simp only [ByteEval.execute, Core.storeReg?, Memory.write?, ← address, ← permissions, allowed,
+            ↓reduceIte, Except.mapError, bind, Except.bind, pure, Except.pure, CorePair, nextHoles, operationWrites]
+          rw [← related.readReg source]
+          exact related.write _ _ _ (width_bytes_le width) safe.2
+  | push source =>
+      have permissions := related.memory.writable
+      cases allowed : Memory.rangeAllowed logical.memory.writable (logical.readReg .rsp - 8) 8 with
+      | false =>
+          simp [ByteEval.execute, Memory.write64?, Memory.write?, ← related.readReg .rsp, ← permissions,
+            Width.bytes, allowed, Except.mapError, CorePair]
+      | true =>
+          simp only [ByteEval.execute, Memory.write64?, Memory.write?, ← related.readReg .rsp, ← permissions,
+            Width.bytes, allowed, ↓reduceIte, Except.mapError, bind, Except.bind, pure, Except.pure,
+            CorePair, nextHoles, operationWrites]
+          rw [← related.readReg source]
+          exact (related.write _ _ 8 (by decide) safe.2).setReg .rsp _
+  | call _ | jump _ | branch _ _ | ret => simp [linearOperation] at linear
+
+theorem instruction_linear_operation (instruction : Instr) (linear : Encode.linearInstruction instruction = true) :
+    linearOperation (Encode.instructionOperation instruction) = true := by
+  cases instruction <;> simp_all [Encode.linearInstruction, Encode.instructionOperation, linearOperation]
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamExamples.lean b/Ix/Compiler/X86/StreamExamples.lean
new file mode 100644
index 000000000..b662de3d3
--- /dev/null
+++ b/Ix/Compiler/X86/StreamExamples.lean
@@ -0,0 +1,69 @@
+import Ix.Compiler.X86.ObjectExecution
+import Ix.Compiler.X86.StreamDecidable
+import Ix.Compiler.X86.EvalExamples
+
+/-! Kernel checks and shared regression inputs for complete certified streams.
+The call cases include nested frames and reuse of a released return slot. -/
+
+namespace Ix.Compiler.X86.StreamExamples
+
+def reusedCalls : Program := {
+  entry := 0
+  blocks := #[
+    { instructions := #[.push .rbp, .call 1, .call 2,
+        .store .w64 { base := some .rsp, displacement := 0xfffffff8 } .rax,
+        .load .w64 .rcx { base := some .rsp, displacement := 0xfffffff8 }, .pop .rbp]
+      terminator := .ret },
+    { instructions := #[.mov .w64 .rax (.imm 41)], terminator := .ret },
+    { instructions := #[.alu .add .w64 .rax (.imm 1)], terminator := .ret }] }
+
+def nestedCalls : Program := {
+  entry := 0
+  blocks := #[
+    { instructions := #[.push .rbp, .call 1, .pop .rbp], terminator := .ret },
+    { instructions := #[.push .rbp, .call 2, .pop .rbp], terminator := .ret },
+    { instructions := #[.mov .w64 .rax (.imm 42)], terminator := .ret }] }
+
+def tailCall : Program := {
+  entry := 0
+  blocks := #[{ instructions := #[], terminator := .tailCall 1 },
+    { instructions := #[.mov .w64 .rax (.imm 42)], terminator := .ret }] }
+
+def core : Core := { (Core.empty 0x8008) with memory := Memory.flat.write64 0x8008 0xff00 }
+
+def reusedChecked : Checked := ⟨reusedCalls, by decide +kernel⟩
+def nestedChecked : Checked := ⟨nestedCalls, by decide +kernel⟩
+
+def certified (program : Program) : Bool :=
+  match program.check with
+  | .error _ => false
+  | .ok checked => (Stream.encode checked).isOk
+
+example : certified reusedCalls = true := by decide +kernel
+example : certified nestedCalls = true := by decide +kernel
+example : certified Examples.arithmeticProgram = true := by decide +kernel
+example : certified Examples.runtimeProgram = true := by decide +kernel
+
+example : (runFrom Runtime.rejecting reusedChecked 11 core).status = .halted 42 := by decide +kernel
+example : (runFrom Runtime.rejecting nestedChecked 10 core).status = .halted 42 := by decide +kernel
+
+-- A released slot stays masked after RET, and a later ordinary store clears
+-- the bytes it overwrites. The mask never hides register differences.
+example (holes : Stream.Holes) (address : Word) :
+    ¬Stream.clearRange (Stream.addRange holes address 8) address 8 address := by
+  intro hidden
+  exact hidden.2 ⟨0, by decide, by simp⟩
+
+example (program : Program) (base : Word) (memory : Memory) (frame : ReturnFrame)
+    (mapped : Stream.FramesMapped program base memory [frame]) :
+    Stream.SlotMapped program base memory frame := mapped frame (by simp)
+
+theorem reused_safe : Stream.SafeTrace Runtime.rejecting reusedChecked 11 (fun _ => False)
+    (Machine.initial reusedChecked core) := by
+  decide +kernel
+
+theorem nested_safe : Stream.SafeTrace Runtime.rejecting nestedChecked 10 (fun _ => False)
+    (Machine.initial nestedChecked core) := by
+  decide +kernel
+
+end Ix.Compiler.X86.StreamExamples
diff --git a/Ix/Compiler/X86/StreamLayout.lean b/Ix/Compiler/X86/StreamLayout.lean
new file mode 100644
index 000000000..09775d920
--- /dev/null
+++ b/Ix/Compiler/X86/StreamLayout.lean
@@ -0,0 +1,239 @@
+import Ix.Compiler.X86.ByteBranch
+import Ix.Compiler.X86.ByteCall
+
+/-! Canonical byte positions for complete typed text worlds. Positions count
+the actual emitted lengths, include each terminator, and are independent of
+the encoder's layout/fixup implementation. The stream validator checks that
+the emitted text and block-offset table realize these positions. -/
+
+namespace Ix.Compiler.X86.Stream
+
+def prefixSize (sizes : List Nat) (count : Nat) : Nat := (sizes.take count).sum
+
+theorem prefix_zero (sizes : List Nat) : prefixSize sizes 0 = 0 := by simp [prefixSize]
+
+theorem prefix_succ (sizes : List Nat) (index : Nat) :
+    prefixSize sizes (index + 1) = prefixSize sizes index + (sizes[index]?.getD 0) := by
+  simp [prefixSize, List.take_add_one]
+  cases sizes[index]? <;> simp
+
+theorem prefix_mono (sizes : List Nat) {first second : Nat} (bound : first ≤ second) :
+    prefixSize sizes first ≤ prefixSize sizes second := by
+  induction second with
+  | zero =>
+      have equal : first = 0 := by omega
+      subst first
+      exact Nat.le_refl _
+  | succ second ih =>
+      by_cases before : first ≤ second
+      · have earlier := ih before
+        rw [prefix_succ]
+        omega
+      · have equal : first = second + 1 := by omega
+        subst first
+        exact Nat.le_refl _
+
+theorem prefix_le_sum (sizes : List Nat) (index : Nat) : prefixSize sizes index ≤ sizes.sum := by
+  have split := List.take_append_drop index sizes
+  have total := congrArg List.sum split
+  simp only [List.sum_append] at total
+  unfold prefixSize
+  omega
+
+theorem prefix_strict (sizes : List Nat) (positive : ∀ size ∈ sizes, 0 < size)
+    {first second : Nat} (less : first < second) (bound : second ≤ sizes.length) :
+    prefixSize sizes first < prefixSize sizes second := by
+  have member : sizes[first] ∈ sizes := List.getElem_mem (by omega)
+  have nonzero := positive _ member
+  have next := prefix_succ sizes first
+  rw [List.getElem?_eq_getElem (by omega)] at next
+  simp only [Option.getD_some] at next
+  have later := prefix_mono sizes (show first + 1 ≤ second by omega)
+  omega
+
+def instructionSize (instruction : Instr) : Nat := (Encode.encodeInstr instruction).bytes.size
+
+def terminatorSize : Terminator → Nat
+  | .jump _ | .tailCall _ => 5
+  | .branch comparison _ _ _ => (Encode.encodeCompare comparison).size + 11
+  | .ret => 1
+
+def instructionSizes (block : Block) : List Nat := block.instructions.toList.map instructionSize
+def blockSize (block : Block) : Nat := (instructionSizes block).sum + terminatorSize block.terminator
+def blockSizes (program : Program) : List Nat := program.blocks.toList.map blockSize
+def textSize (program : Program) : Nat := (blockSizes program).sum
+def blockOffset (program : Program) (index : Nat) : Nat := prefixSize (blockSizes program) index
+def instructionOffset (block : Block) (index : Nat) : Nat := prefixSize (instructionSizes block) index
+
+def blockOffsets (program : Program) : Array Nat :=
+  (List.range program.blocks.size).toArray.map (blockOffset program)
+
+def pcOffset? (program : Program) (pc : PC) : Option Nat := do
+  let block ← program.blocks[pc.block.toNat]?
+  if pc.offset.toNat ≤ block.instructions.size then
+    some (blockOffset program pc.block.toNat + instructionOffset block pc.offset.toNat)
+  else none
+
+theorem instructionSize_pos (instruction : Instr) : 0 < instructionSize instruction :=
+  (Encode.instruction_size instruction).1
+
+theorem terminatorSize_pos (terminator : Terminator) : 0 < terminatorSize terminator := by
+  cases terminator <;> simp [terminatorSize]
+
+theorem blockSize_pos (block : Block) : 0 < blockSize block := by
+  have := terminatorSize_pos block.terminator
+  unfold blockSize
+  omega
+
+theorem instructionOffset_zero (block : Block) : instructionOffset block 0 = 0 := prefix_zero _
+theorem blockOffset_zero (program : Program) : blockOffset program 0 = 0 := prefix_zero _
+
+theorem instructionOffset_end (block : Block) :
+    instructionOffset block block.instructions.size = (instructionSizes block).sum := by
+  unfold instructionOffset prefixSize
+  rw [List.take_of_length_le (by simp [instructionSizes])]
+
+theorem instructionOffset_next {block : Block} {index : Nat} {instruction : Instr}
+    (found : block.instructions[index]? = some instruction) :
+    instructionOffset block (index + 1) = instructionOffset block index + instructionSize instruction := by
+  rw [instructionOffset, prefix_succ]
+  simp [instructionSizes, found, instructionOffset]
+
+theorem instructionOffset_lt (block : Block) (index : Nat) : instructionOffset block index < blockSize block := by
+  have prefixSize := prefix_le_sum (instructionSizes block) index
+  have positive := terminatorSize_pos block.terminator
+  unfold instructionOffset blockSize
+  omega
+
+theorem blockOffset_next {program : Program} {index : Nat} {block : Block}
+    (found : program.blocks[index]? = some block) :
+    blockOffset program (index + 1) = blockOffset program index + blockSize block := by
+  rw [blockOffset, prefix_succ]
+  simp [blockSizes, found, blockOffset]
+
+theorem blockOffset_end (program : Program) : blockOffset program program.blocks.size = textSize program := by
+  unfold blockOffset prefixSize
+  rw [List.take_of_length_le (by simp [blockSizes])]
+  rfl
+
+theorem block_end_le {program : Program} {index : Nat} {block : Block}
+    (found : program.blocks[index]? = some block) :
+    blockOffset program index + blockSize block ≤ textSize program := by
+  rw [← blockOffset_next found]
+  exact prefix_le_sum _ _
+
+theorem pcOffset_small {program : Program} {pc : PC} {offset : Nat}
+    (found : pcOffset? program pc = some offset) : offset < textSize program := by
+  unfold pcOffset? at found
+  cases blockFound : program.blocks[pc.block.toNat]? with
+  | none => simp [blockFound] at found
+  | some block =>
+      simp only [blockFound, bind, Option.bind] at found
+      split at found
+      · have equal := Option.some.inj found
+        have blockBound := block_end_le blockFound
+        have inner := instructionOffset_lt block pc.offset.toNat
+        omega
+      · contradiction
+
+theorem block_entry {program : Program} {block : Block} {id : BlockId}
+    (found : program.blocks[id.toNat]? = some block) :
+    pcOffset? program ⟨id, 0⟩ = some (blockOffset program id.toNat) := by
+  simp [pcOffset?, found, instructionOffset_zero]
+
+theorem rip_offset (base : Word) (offset : Nat) (bound : offset < UInt64.size) :
+    (base + UInt64.ofNat offset - base).toNat = offset := Encode.offset_after base offset bound
+
+theorem instructionOffset_strict (block : Block) {first second : Nat}
+    (less : first < second) (bound : second ≤ block.instructions.size) :
+    instructionOffset block first < instructionOffset block second := by
+  apply prefix_strict
+  · intro size member
+    obtain ⟨instruction, _, rfl⟩ := List.mem_map.mp member
+    exact instructionSize_pos instruction
+  · exact less
+  · simpa [instructionSizes] using bound
+
+theorem block_before {program : Program} {index later : Nat} {block : Block}
+    (found : program.blocks[index]? = some block) (less : index < later) :
+    blockOffset program index + blockSize block ≤ blockOffset program later := by
+  rw [← blockOffset_next found]
+  exact prefix_mono _ (by omega)
+
+theorem pcOffset_info {program : Program} {pc : PC} {offset : Nat}
+    (found : pcOffset? program pc = some offset) :
+    ∃ block, program.blocks[pc.block.toNat]? = some block ∧ pc.offset.toNat ≤ block.instructions.size ∧
+      offset = blockOffset program pc.block.toNat + instructionOffset block pc.offset.toNat := by
+  unfold pcOffset? at found
+  cases blockFound : program.blocks[pc.block.toNat]? with
+  | none => simp [blockFound] at found
+  | some block =>
+      simp only [blockFound, bind, Option.bind] at found
+      split at found
+      · exact ⟨block, rfl, by assumption, (Option.some.inj found).symm⟩
+      · contradiction
+
+/-- Distinct symbolic instruction/terminator positions cannot alias. Branch
+macro interior positions are introduced only by the checked CMP/Jcc/JMP recipe. -/
+theorem pcOffset_injective {program : Program} {first second : PC} {offset : Nat}
+    (firstFound : pcOffset? program first = some offset) (secondFound : pcOffset? program second = some offset) :
+    first = second := by
+  obtain ⟨left, leftFound, leftBound, leftOffset⟩ := pcOffset_info firstFound
+  obtain ⟨right, rightFound, rightBound, rightOffset⟩ := pcOffset_info secondFound
+  have blocksEqual : first.block = second.block := by
+    apply UInt32.toNat_inj.mp
+    have insideLeft := instructionOffset_lt left first.offset.toNat
+    have insideRight := instructionOffset_lt right second.offset.toNat
+    have orderedLeft := fun h => block_before leftFound (later := second.block.toNat) h
+    have orderedRight := fun h => block_before rightFound (later := first.block.toNat) h
+    omega
+  have equalBlocks : left = right := by
+    rw [blocksEqual, rightFound] at leftFound
+    exact Option.some.inj leftFound.symm
+  subst right
+  have offsetsEqual : first.offset = second.offset := by
+    apply UInt32.toNat_inj.mp
+    have orderedLeft := fun (h : first.offset.toNat < second.offset.toNat) => instructionOffset_strict left h rightBound
+    have orderedRight := fun (h : second.offset.toNat < first.offset.toNat) => instructionOffset_strict left h leftBound
+    rw [blocksEqual] at leftOffset
+    omega
+  cases first
+  cases second
+  simp_all
+
+theorem checked_block_bound {checked : Checked} {index : Nat} {block : Block}
+    (found : checked.program.blocks[index]? = some block) : block.instructions.size < UInt32.size := by
+  have valid := checked.valid
+  simp only [Program.wellFormed, Bool.and_eq_true, and_assoc] at valid
+  obtain ⟨bound, equal⟩ := Array.getElem?_eq_some_iff.mp found
+  have fields := Array.all_eq_true.mp valid.2.2.2 index bound
+  rw [equal] at fields
+  simp only [Bool.and_eq_true] at fields
+  simpa [Block.offsetsFit, UInt32.size] using fields.1
+
+theorem pc_next {checked : Checked} {block : Block} {pc : PC} {instruction : Instr}
+    (found : checked.program.blocks[pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[pc.offset.toNat]? = some instruction) :
+    pc.next? = some { pc with offset := pc.offset + 1 } ∧
+      (pc.offset + 1).toNat = pc.offset.toNat + 1 := by
+  have blockBound := checked_block_bound found
+  have indexBound := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+  have nextBound : pc.offset.toNat + 1 < UInt32.size := by omega
+  have notLast : pc.offset ≠ 0xffffffff := by
+    intro equal
+    simp [equal, UInt32.size] at nextBound
+  constructor
+  · simp [PC.next?, notLast]
+  · simp [UInt32.toNat_add, Nat.mod_eq_of_lt nextBound]
+
+theorem pcOffset_next {checked : Checked} {block : Block} {pc : PC} {instruction : Instr}
+    (found : checked.program.blocks[pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[pc.offset.toNat]? = some instruction) :
+    pcOffset? checked.program { pc with offset := pc.offset + 1 } =
+      some (blockOffset checked.program pc.block.toNat + instructionOffset block pc.offset.toNat + instructionSize instruction) := by
+  have next := pc_next found foundInstruction
+  have indexBound := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+  simp [pcOffset?, found, next.2, show pc.offset.toNat + 1 ≤ block.instructions.size by omega,
+    instructionOffset_next foundInstruction, Nat.add_assoc]
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamLinear.lean b/Ix/Compiler/X86/StreamLinear.lean
new file mode 100644
index 000000000..dabb15d81
--- /dev/null
+++ b/Ix/Compiler/X86/StreamLinear.lean
@@ -0,0 +1,109 @@
+import Ix.Compiler.X86.StreamValidate
+
+/-! Actual text fetch and typed-PC advancement for every linear instruction.
+The checked program supplies the successor bound; no unchecked PC-overflow
+case is hidden in the successful core relation. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def AtPC (program : Program) (base : Word) (pc : PC) (rip : Word) : Prop :=
+  ∃ offset, pcOffset? program pc = some offset ∧ rip = base + UInt64.ofNat offset
+
+theorem AtPC.offset {program : Program} {base rip : Word} {pc : PC} {block : Block}
+    (atPC : AtPC program base pc rip) (found : program.blocks[pc.block.toNat]? = some block)
+    (bound : pc.offset.toNat ≤ block.instructions.size) :
+    rip = base + UInt64.ofNat (blockOffset program pc.block.toNat + instructionOffset block pc.offset.toNat) := by
+  obtain ⟨offset, mapped, address⟩ := atPC
+  simp [pcOffset?, found, bound] at mapped
+  subst offset
+  exact address
+
+theorem AtPC.small {program : Program} {pc : PC} {offset : Nat}
+    (bound : textSize program < UInt64.size) (mapped : pcOffset? program pc = some offset) :
+    offset < UInt64.size := Nat.lt_trans (pcOffset_small mapped) bound
+
+theorem linear_rip (instruction : Instr) (linear : Encode.linearInstruction instruction = true)
+    (state : ByteEval.State) (length : Nat) {after : ByteEval.State}
+    (evaluated : ByteEval.execute ⟨Encode.instructionOperation instruction, length⟩ state = .ok after) :
+    after.rip = state.rip + UInt64.ofNat length := by
+  cases instruction with
+  | load width destination address =>
+      cases memoryResult : state.core.loadReg? width destination (address.eval state.core) <;>
+        simp_all [Encode.instructionOperation, ByteEval.execute, Except.mapError] <;> cases evaluated <;> rfl
+  | store width address source =>
+      cases memoryResult : state.core.storeReg? width (address.eval state.core) source <;>
+        simp_all [Encode.instructionOperation, ByteEval.execute, Except.mapError] <;> cases evaluated <;> rfl
+  | push source =>
+      cases memoryResult : state.core.memory.write64? (state.core.readReg .rsp - 8) (state.core.readReg source) <;>
+        simp_all [Encode.instructionOperation, ByteEval.execute, Except.mapError] <;> cases evaluated <;> rfl
+  | pop destination =>
+      cases memoryResult : state.core.memory.read64? (state.core.readReg .rsp) <;>
+        simp_all [Encode.instructionOperation, ByteEval.execute, Except.mapError] <;> cases evaluated <;> rfl
+  | spill slot source =>
+      cases memoryResult : state.core.storeReg? .w64 (state.core.readReg .rbp - slot.displacement) source <;>
+        simp_all [Encode.instructionOperation, ByteEval.execute, Except.mapError] <;> cases evaluated <;> rfl
+  | reload destination slot =>
+      cases memoryResult : state.core.loadReg? .w64 destination (state.core.readReg .rbp - slot.displacement) <;>
+        simp_all [Encode.instructionOperation, ByteEval.execute, Except.mapError] <;> cases evaluated <;> rfl
+  | _ => simp_all [Encode.linearInstruction, Encode.instructionOperation, ByteEval.execute] <;> cases evaluated <;> rfl
+
+/-- Fetch uses the complete certified text and its actual byte RIP. -/
+theorem fetch_linear {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (base rip : Word) (pc : PC)
+    (atPC : AtPC checked.program base pc rip) {block : Block} {instruction : Instr}
+    (found : checked.program.blocks[pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[pc.offset.toNat]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true) :
+    Decode.decodeAt output.text (rip - base).toNat =
+      some ⟨Encode.instructionOperation instruction, instructionSize instruction⟩ := by
+  have indexBound := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+  have address := atPC.offset found (by omega)
+  have mapped : pcOffset? checked.program pc =
+      some (blockOffset checked.program pc.block.toNat + instructionOffset block pc.offset.toNat) := by
+    simp [pcOffset?, found, show pc.offset.toNat ≤ block.instructions.size by omega]
+  rw [address, rip_offset _ _ (AtPC.small valid.textBound mapped)]
+  exact valid.decode_linear found foundInstruction linear
+
+def LinearResult (program : Program) (base : Word) (before after : Machine) :
+    Except ByteEval.Fault ByteEval.State → Prop
+  | .ok state => after.core = state.core ∧ after.status = .running ∧ AtPC program base after.pc state.rip
+  | .error (.memory fault) => after = before.trap (.memoryFault fault)
+  | .error _ => False
+
+theorem linear_step {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (running : machine.status = .running) (base rip : Word) (flags : ByteEval.Flags)
+    (atPC : AtPC checked.program base machine.pc rip) {block : Block} {instruction : Instr}
+    (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[machine.pc.offset.toNat]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true) :
+    LinearResult checked.program base machine (step runtime checked machine)
+      (ByteEval.step output.text base ⟨machine.core, rip, flags⟩) := by
+  have fetched := fetch_linear valid base rip machine.pc atPC found foundInstruction linear
+  have bytesStep : ByteEval.step output.text base ⟨machine.core, rip, flags⟩ =
+      ByteEval.execute ⟨Encode.instructionOperation instruction, instructionSize instruction⟩ ⟨machine.core, rip, flags⟩ := by
+    simp [ByteEval.step, fetched]
+  have sourceStep : step runtime checked machine = executeInstr runtime checked instruction machine := by
+    simp [step, running, found, foundInstruction]
+  have agreement := Encode.instruction_execution instruction linear runtime checked machine rip flags (instructionSize instruction)
+  have next := pc_next found foundInstruction
+  rw [sourceStep, bytesStep]
+  cases evaluated : ByteEval.execute ⟨Encode.instructionOperation instruction, instructionSize instruction⟩
+      ⟨machine.core, rip, flags⟩ with
+  | error fault =>
+      cases fault with
+      | memory fault => exact (by simpa [LinearResult, Encode.LinearAgreement, evaluated] using agreement)
+      | decode address | undefinedCondition condition => simp [Encode.LinearAgreement, evaluated] at agreement
+  | ok after =>
+      simp only [evaluated, Encode.LinearAgreement, Machine.advanceWith, next.1] at agreement
+      rw [agreement]
+      refine ⟨rfl, running, ?_⟩
+      refine ⟨_, pcOffset_next found foundInstruction, ?_⟩
+      have advance := linear_rip instruction linear ⟨machine.core, rip, flags⟩ (instructionSize instruction) evaluated
+      have indexBound := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+      have address := atPC.offset found (by omega)
+      simpa [address, UInt64.ofNat_add, UInt64.add_assoc] using advance
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamMemory.lean b/Ix/Compiler/X86/StreamMemory.lean
new file mode 100644
index 000000000..6925846cb
--- /dev/null
+++ b/Ix/Compiler/X86/StreamMemory.lean
@@ -0,0 +1,146 @@
+import Ix.Compiler.X86.StreamRun
+
+/-! Bytewise memory correspondence for physical return addresses. A call
+adds eight differing bytes; an ordinary write clears the bytes it overwrites.
+RET retains residual differences in the released slot, so stack reuse does
+not rely on an incorrect equality after popping a frame. -/
+
+namespace Ix.Compiler.X86.Stream
+
+abbrev Holes := Word → Prop
+
+def inRange (address : Word) (count : Nat) (candidate : Word) : Prop :=
+  ∃ index < count, candidate = address + UInt64.ofNat index
+
+def addRange (holes : Holes) (address : Word) (count : Nat) : Holes :=
+  fun candidate => holes candidate ∨ inRange address count candidate
+
+def clearRange (holes : Holes) (address : Word) (count : Nat) : Holes :=
+  fun candidate => holes candidate ∧ ¬inRange address count candidate
+
+def ReadableData (holes : Holes) (address : Word) (count : Nat) : Prop :=
+  ∀ index < count, ¬holes (address + UInt64.ofNat index)
+
+structure MemoryRelated (holes : Holes) (logical physical : Memory) : Prop where
+  readable : logical.readable = physical.readable
+  writable : logical.writable = physical.writable
+  bytes : ∀ address, ¬holes address → logical.bytes address = physical.bytes address
+
+theorem MemoryRelated.refl (memory : Memory) : MemoryRelated (fun _ => False) memory memory :=
+  ⟨rfl, rfl, fun _ _ => rfl⟩
+
+theorem MemoryRelated.read {holes : Holes} {logical physical : Memory}
+    (related : MemoryRelated holes logical physical) (width : Width) (address : Word)
+    (data : ReadableData holes address width.bytes) : logical.read width address = physical.read width address :=
+  Memory.readLittle_congr _ _ _ _ (fun index bound => related.bytes _ (data index bound))
+
+theorem MemoryRelated.read? {holes : Holes} {logical physical : Memory}
+    (related : MemoryRelated holes logical physical) (width : Width) (address : Word)
+    (data : ReadableData holes address width.bytes) : logical.read? width address = physical.read? width address := by
+  simp only [Memory.read?, related.readable, related.read width address data]
+
+@[simp] theorem writeLittle_readable (memory : Memory) (address value : Word) (count : Nat) :
+    (memory.writeLittle address value count).readable = memory.readable := by
+  induction count with
+  | zero => rfl
+  | succ count ih => exact ih
+
+@[simp] theorem writeLittle_writable (memory : Memory) (address value : Word) (count : Nat) :
+    (memory.writeLittle address value count).writable = memory.writable := by
+  induction count with
+  | zero => rfl
+  | succ count ih => exact ih
+
+theorem outside_range {address candidate : Word} {count : Nat}
+    (outside : ¬inRange address count candidate) :
+    ∀ index < count, candidate ≠ address + UInt64.ofNat index := by
+  intro index bound equal
+  exact outside ⟨index, bound, equal⟩
+
+theorem MemoryRelated.write_same {holes : Holes} {logical physical : Memory}
+    (related : MemoryRelated holes logical physical) (address value : Word) (count : Nat)
+    (bound : count ≤ 8) :
+    MemoryRelated (clearRange holes address count)
+      (logical.writeLittle address value count) (physical.writeLittle address value count) := by
+  refine ⟨by simpa using related.readable, by simpa using related.writable, ?_⟩
+  intro candidate visible
+  by_cases inside : inRange address count candidate
+  · obtain ⟨index, indexBound, rfl⟩ := inside
+    rw [Memory.writeLittle_bytes _ _ _ bound indexBound, Memory.writeLittle_bytes _ _ _ bound indexBound]
+  · have wasVisible : ¬holes candidate := fun hidden => visible ⟨hidden, inside⟩
+    rw [Memory.writeLittle_bytes_outside _ _ _ _ _ (outside_range inside),
+      Memory.writeLittle_bytes_outside _ _ _ _ _ (outside_range inside), related.bytes _ wasVisible]
+
+theorem MemoryRelated.write_different {holes : Holes} {logical physical : Memory}
+    (related : MemoryRelated holes logical physical) (address logicalValue physicalValue : Word) (count : Nat) :
+    MemoryRelated (addRange holes address count)
+      (logical.writeLittle address logicalValue count) (physical.writeLittle address physicalValue count) := by
+  refine ⟨by simpa using related.readable, by simpa using related.writable, ?_⟩
+  intro candidate visible
+  have wasVisible : ¬holes candidate := fun hidden => visible (Or.inl hidden)
+  have outside : ¬inRange address count candidate := fun inside => visible (Or.inr inside)
+  rw [Memory.writeLittle_bytes_outside _ _ _ _ _ (outside_range outside),
+    Memory.writeLittle_bytes_outside _ _ _ _ _ (outside_range outside), related.bytes _ wasVisible]
+
+def SlotMapped (program : Program) (base : Word) (memory : Memory) (frame : ReturnFrame) : Prop :=
+  ∃ offset, pcOffset? program frame.continuation = some offset ∧
+    memory.read64 frame.returnSlot = base + UInt64.ofNat offset
+
+def FramesMapped (program : Program) (base : Word) (memory : Memory) (frames : List ReturnFrame) : Prop :=
+  ∀ frame ∈ frames, SlotMapped program base memory frame
+
+/-- Ordinary writes may reuse retired return slots. Active frames still
+protect their concrete eight-byte return-address ranges. -/
+def FramesDisjoint (frames : List ReturnFrame) (address : Word) (count : Nat) : Prop :=
+  ∀ frame ∈ frames, ∀ i < 8, ∀ j < count,
+    frame.returnSlot + UInt64.ofNat i ≠ address + UInt64.ofNat j
+
+theorem FramesMapped.write {program : Program} {base : Word} {memory : Memory} {frames : List ReturnFrame}
+    (mapped : FramesMapped program base memory frames) (address value : Word) (count : Nat)
+    (disjoint : FramesDisjoint frames address count) :
+    FramesMapped program base (memory.writeLittle address value count) frames := by
+  intro frame member
+  obtain ⟨offset, pc, slot⟩ := mapped frame member
+  refine ⟨offset, pc, ?_⟩
+  have same : (memory.writeLittle address value count).read64 frame.returnSlot = memory.read64 frame.returnSlot := by
+    apply Memory.readLittle_congr
+    intro i bound
+    exact Memory.writeLittle_bytes_outside _ _ _ _ _ (disjoint frame member i bound)
+  rw [same, slot]
+
+structure CoreRelated (program : Program) (base : Word) (holes : Holes) (frames : List ReturnFrame)
+    (logical physical : Core) : Prop where
+  registers : logical.registers = physical.registers
+  memory : MemoryRelated holes logical.memory physical.memory
+  frames : FramesMapped program base physical.memory frames
+
+theorem CoreRelated.readReg {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical) (register : GPR) :
+    logical.readReg register = physical.readReg register := congrFun related.registers register
+
+theorem CoreRelated.address {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical) (address : MemAddr) :
+    address.eval logical = address.eval physical := by
+  simp [MemAddr.eval, related.readReg]
+
+theorem CoreRelated.setReg {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical)
+    (register : GPR) (value : Word) :
+    CoreRelated program base holes frames (logical.setReg register value) (physical.setReg register value) :=
+  ⟨congrArg (fun registers => registers.set register value) related.registers, related.memory, related.frames⟩
+
+theorem CoreRelated.writeReg {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical)
+    (width : Width) (register : GPR) (value : Word) :
+    CoreRelated program base holes frames (logical.writeReg width register value) (physical.writeReg width register value) := by
+  cases width <;> simp only [Core.writeReg, related.readReg] <;> exact related.setReg _ _
+
+theorem CoreRelated.write {program : Program} {base : Word} {holes : Holes} {frames : List ReturnFrame}
+    {logical physical : Core} (related : CoreRelated program base holes frames logical physical)
+    (address value : Word) (count : Nat) (bound : count ≤ 8) (disjoint : FramesDisjoint frames address count) :
+    CoreRelated program base (clearRange holes address count) frames
+      { logical with memory := logical.memory.writeLittle address value count }
+      { physical with memory := physical.memory.writeLittle address value count } :=
+  ⟨related.registers, related.memory.write_same address value count bound, related.frames.write address value count disjoint⟩
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamPermissions.lean b/Ix/Compiler/X86/StreamPermissions.lean
new file mode 100644
index 000000000..f96a90050
--- /dev/null
+++ b/Ix/Compiler/X86/StreamPermissions.lean
@@ -0,0 +1,57 @@
+import Ix.Compiler.X86.StreamMemory
+
+/-! Ordinary typed instructions cannot change page/byte permissions. This
+connects a caller's entry-time return-slot read to the final physical RET. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def Permissions (before after : Core) : Prop :=
+  after.memory.readable = before.memory.readable ∧ after.memory.writable = before.memory.writable
+
+theorem linear_permissions (runtime : Runtime) (checked : Checked) (machine : Machine)
+    (instruction : Instr) (linear : Encode.linearInstruction instruction = true) :
+    Permissions machine.core (executeInstr runtime checked instruction machine).core := by
+  cases next : machine.pc.next? <;> cases instruction <;>
+    simp_all only [Encode.linearInstruction, Bool.false_eq_true]
+  all_goals simp only [executeInstr, Core.loadReg?, Core.storeReg?, Memory.read64?, Memory.write64?, Memory.read?, Memory.write?]
+  all_goals (repeat' split) <;>
+    simp_all [Permissions, Machine.advanceWith, Machine.trap, Memory.write, Core.setReg, Core.writeReg]
+  all_goals (repeat' split at *) <;> simp_all
+  all_goals subst_vars <;> simp
+
+theorem terminator_memory (checked : Checked) (machine : Machine) (terminator : Terminator) :
+    (executeTerminator checked terminator machine).core.memory = machine.core.memory := by
+  cases terminator <;> simp only [executeTerminator, Machine.goto]
+  all_goals (repeat' split) <;> rfl
+
+theorem step_permissions (runtime : Runtime) (checked : Checked) (free : CallFree checked.program) (machine : Machine) :
+    Permissions machine.core (step runtime checked machine).core := by
+  cases running : machine.status with
+  | halted _ | trapped _ => simp [step, running, Permissions]
+  | running =>
+      cases found : checked.program.blocks[machine.pc.block.toNat]? with
+      | none => simp [step, running, found, Machine.trap, Permissions]
+      | some block =>
+          cases foundInstruction : block.instructions[machine.pc.offset.toNat]? with
+          | some instruction =>
+              simpa [step, running, found, foundInstruction] using
+                linear_permissions runtime checked machine instruction (free _ _ found _ _ foundInstruction)
+          | none =>
+              simp only [step, running, found, foundInstruction]
+              split
+              · simp [Permissions, terminator_memory]
+              · simp [Permissions, Machine.trap]
+
+theorem run_permissions (runtime : Runtime) (checked : Checked) (free : CallFree checked.program) (fuel : Nat) (machine : Machine) :
+    Permissions machine.core (run runtime checked fuel machine).core := by
+  induction fuel generalizing machine with
+  | zero => exact ⟨rfl, rfl⟩
+  | succ fuel ih =>
+      rw [run_succ]
+      have first := step_permissions runtime checked free machine
+      have rest := ih (step runtime checked machine)
+      exact ⟨rest.1.trans first.1, rest.2.trans first.2⟩
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamRun.lean b/Ix/Compiler/X86/StreamRun.lean
new file mode 100644
index 000000000..c7d1395f9
--- /dev/null
+++ b/Ix/Compiler/X86/StreamRun.lean
@@ -0,0 +1,247 @@
+import Ix.Compiler.X86.StreamControl
+import Ix.Compiler.X86.Execution
+
+/-! Complete terminating execution for call-free streams, including loops,
+branches and the physical caller's return slot. Internal-call composition is
+separate because typed and physical return-slot bytes are different. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def CallFree (program : Program) : Prop :=
+  ∀ (blockIndex : Nat) (block : Block), program.blocks[blockIndex]? = some block →
+    ∀ (index : Nat) (instruction : Instr), block.instructions[index]? = some instruction →
+      Encode.linearInstruction instruction = true
+
+def callFree (program : Program) : Bool :=
+  program.blocks.all (fun block => block.instructions.all Encode.linearInstruction)
+
+theorem callFree_sound {program : Program} (accepted : callFree program = true) : CallFree program := by
+  intro blockIndex block found index instruction foundInstruction
+  obtain ⟨blockBound, blockEqual⟩ := Array.getElem?_eq_some_iff.mp found
+  obtain ⟨indexBound, instructionEqual⟩ := Array.getElem?_eq_some_iff.mp foundInstruction
+  have row := Array.all_eq_true.mp accepted blockIndex blockBound
+  rw [blockEqual] at row
+  have cell := Array.all_eq_true.mp row index indexBound
+  simpa [instructionEqual] using cell
+
+@[simp] theorem advance_returns (machine : Machine) (core : Core) :
+    (machine.advanceWith core).returns = machine.returns := by
+  unfold Machine.advanceWith
+  split <;> rfl
+
+theorem linear_returns (runtime : Runtime) (checked : Checked) (machine : Machine)
+    (instruction : Instr) (linear : Encode.linearInstruction instruction = true) :
+    (executeInstr runtime checked instruction machine).returns = machine.returns := by
+  cases instruction <;> simp_all only [Encode.linearInstruction, Bool.false_eq_true]
+  all_goals simp only [executeInstr]
+  all_goals first | exact advance_returns _ _ | (split <;> simp [Machine.trap])
+
+structure RunningAt (program : Program) (base : Word) (machine : Machine) (state : ByteEval.State) : Prop where
+  core : state.core = machine.core
+  running : machine.status = .running
+  returns : machine.returns = []
+  pc : AtPC program base machine.pc state.rip
+
+theorem linear_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (state : ByteEval.State) (related : RunningAt checked.program base machine state)
+    {block : Block} {instruction : Instr}
+    (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (foundInstruction : block.instructions[machine.pc.offset.toNat]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true)
+    (nextRunning : (step runtime checked machine).status = .running) :
+    ∃ after, ByteEval.step output.text base state = .ok after ∧
+      RunningAt checked.program base (step runtime checked machine) after := by
+  have agreement := linear_step valid runtime machine related.running base state.rip state.flags
+    related.pc found foundInstruction linear
+  have stateEqual : ({ core := machine.core, rip := state.rip, flags := state.flags } : ByteEval.State) = state := by
+    rw [← related.core]
+  rw [stateEqual] at agreement
+  have sourceStep : step runtime checked machine = executeInstr runtime checked instruction machine := by
+    simp [step, related.running, found, foundInstruction]
+  have returns : (step runtime checked machine).returns = [] := by
+    rw [sourceStep, linear_returns runtime checked machine instruction linear, related.returns]
+  cases evaluated : ByteEval.step output.text base state with
+  | ok after =>
+      simp only [evaluated, LinearResult] at agreement
+      exact ⟨after, rfl, agreement.1.symm, agreement.2.1, returns, agreement.2.2⟩
+  | error fault =>
+      cases fault with
+      | memory fault =>
+          simp only [evaluated, LinearResult] at agreement
+          rw [agreement] at nextRunning
+          contradiction
+      | decode rip | undefinedCondition condition => simp [evaluated, LinearResult] at agreement
+
+theorem control_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (state : ByteEval.State) (related : RunningAt checked.program base machine state)
+    {block : Block} (found : checked.program.blocks[machine.pc.block.toNat]? = some block)
+    (position : machine.pc.offset.toNat = block.instructions.size)
+    (nextRunning : (step runtime checked machine).status = .running) :
+    ∃ count after, 0 < count ∧ count ≤ 3 ∧ ByteEval.run output.text base count state = .ok after ∧
+      RunningAt checked.program base (step runtime checked machine) after := by
+  have sourceStep := source_terminator runtime machine related.running found position
+  have address := related.pc.offset found (by omega)
+  rw [position] at address
+  have accepted := valid.terminator machine.pc.block.toNat block found
+  have bound := terminator_bound found
+  have textBound := valid.textBound
+  cases term : block.terminator with
+  | ret =>
+      simp [sourceStep, term, executeTerminator, related.returns] at nextRunning
+  | jump target | tailCall target =>
+      rw [term] at accepted bound
+      change targets _ _ _ .jump 5 target = true at accepted
+      obtain ⟨targetBound, _, _⟩ := targets_sound accepted
+      have jumped := jump_at accepted base state address (by simp only [terminatorSize] at bound; omega)
+      have goEqual : step runtime checked machine = { machine with pc := ⟨target, 0⟩ } := by
+        simp [sourceStep, term, executeTerminator, Machine.goto, hasBlock_of_bound targetBound]
+      refine ⟨1, { state with rip := base + UInt64.ofNat (blockOffset checked.program target.toNat) },
+        by decide, by decide, ?_, ?_⟩
+      · simp [ByteEval.run, jumped]
+      · rw [goEqual]
+        exact ⟨related.core, related.running, related.returns, _, target_entry targetBound, rfl⟩
+  | branch comparison condition yes no =>
+      rw [term] at accepted bound
+      have branched := branch_at accepted base state address (by simp only [terminatorSize] at bound; omega)
+      have parts := accepted
+      simp only [terminatorMatches, Bool.and_eq_true, and_assoc] at parts
+      have yesBound := (targets_sound parts.2.1).1
+      have noBound := (targets_sound parts.2.2).1
+      have targetBound : (if comparison.holds condition state.core then yes else no).toNat < checked.program.blocks.size := by
+        split <;> assumption
+      have goEqual : step runtime checked machine =
+          { machine with pc := ⟨if comparison.holds condition state.core then yes else no, 0⟩ } := by
+        simp [sourceStep, term, executeTerminator, ← related.core, Machine.goto, hasBlock_of_bound targetBound]
+      refine ⟨if comparison.holds condition state.core then 2 else 3, _, ?_, ?_, branched, ?_⟩
+      · split <;> decide
+      · split <;> decide
+      · rw [goEqual]
+        exact ⟨related.core, related.running, related.returns, _, target_entry targetBound, rfl⟩
+
+theorem running_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (free : CallFree checked.program)
+    (runtime : Runtime) (machine : Machine) (base : Word) (state : ByteEval.State)
+    (related : RunningAt checked.program base machine state)
+    (nextRunning : (step runtime checked machine).status = .running) :
+    ∃ count after, 0 < count ∧ count ≤ 3 ∧ ByteEval.run output.text base count state = .ok after ∧
+      RunningAt checked.program base (step runtime checked machine) after := by
+  obtain ⟨offset, mapped, _⟩ := related.pc
+  obtain ⟨block, found, bound, _⟩ := pcOffset_info mapped
+  cases foundInstruction : block.instructions[machine.pc.offset.toNat]? with
+  | some instruction =>
+      obtain ⟨after, evaluated, next⟩ := linear_progress valid runtime machine base state related found
+        foundInstruction (free _ _ found _ _ foundInstruction) nextRunning
+      exact ⟨1, after, by decide, by decide, by simp [ByteEval.run, evaluated], next⟩
+  | none =>
+      have position : machine.pc.offset.toNat = block.instructions.size := by
+        have missing := Array.getElem?_eq_none_iff.mp foundInstruction
+        omega
+      exact control_progress valid runtime machine base state related found position nextRunning
+
+theorem halting_ret {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (free : CallFree checked.program)
+    (runtime : Runtime) (machine : Machine) (base : Word) (state : ByteEval.State)
+    (related : RunningAt checked.program base machine state) {result : Word}
+    (halted : (step runtime checked machine).status = .halted result) :
+    (step runtime checked machine).core = machine.core ∧
+      Decode.decodeAt output.text (state.rip - base).toNat = some ⟨.ret, 1⟩ := by
+  obtain ⟨offset, mapped, _⟩ := related.pc
+  obtain ⟨block, found, bound, offsetEqual⟩ := pcOffset_info mapped
+  cases foundInstruction : block.instructions[machine.pc.offset.toNat]? with
+  | some instruction =>
+      have agreement := linear_step valid runtime machine related.running base state.rip state.flags
+        related.pc found foundInstruction (free _ _ found _ _ foundInstruction)
+      cases evaluated : ByteEval.step output.text base ⟨machine.core, state.rip, state.flags⟩ with
+      | ok after => simp only [evaluated, LinearResult] at agreement; rw [agreement.2.1] at halted; contradiction
+      | error fault =>
+          cases fault with
+          | memory fault =>
+              simp only [evaluated, LinearResult] at agreement
+              rw [agreement] at halted
+              contradiction
+          | decode rip | undefinedCondition condition => simp [evaluated, LinearResult] at agreement
+  | none =>
+      have position : machine.pc.offset.toNat = block.instructions.size := by
+        have missing := Array.getElem?_eq_none_iff.mp foundInstruction
+        omega
+      have sourceStep := source_terminator runtime machine related.running found position
+      have accepted := valid.terminator machine.pc.block.toNat block found
+      have gotoStatus (target : BlockId) : (machine.goto checked target).status ≠ .halted result := by
+        unfold Machine.goto
+        split <;> simp [Machine.trap, related.running]
+      cases term : block.terminator with
+      | ret =>
+          constructor
+          · simp [sourceStep, term, executeTerminator, related.returns]
+          · have address := related.pc.offset found bound
+            rw [position] at address
+            have small := AtPC.small valid.textBound mapped
+            rw [offsetEqual, position] at small
+            rw [address, rip_offset _ _ small]
+            simpa [term, terminatorMatches, decodes, beq_iff_eq] using accepted
+      | jump target | tailCall target =>
+          simp only [sourceStep, term, executeTerminator] at halted
+          exact False.elim (gotoStatus _ halted)
+      | branch comparison condition yes no =>
+          simp only [sourceStep, term, executeTerminator] at halted
+          exact False.elim (gotoStatus _ halted)
+
+theorem byte_run_add (text : ByteArray) (base : Word) (first second : Nat) (state : ByteEval.State) :
+    ByteEval.run text base (first + second) state =
+      (ByteEval.run text base first state >>= ByteEval.run text base second) := by
+  induction first generalizing state with
+  | zero => simp [ByteEval.run]
+  | succ first ih =>
+      rw [Nat.succ_add, ByteEval.run, ByteEval.run]
+      cases ByteEval.step text base state <;> simp [ih]
+
+/-- The physical RET consumes the caller's slot after the typed harness
+halts. Every other register and every memory byte agree with the typed run. -/
+def Returned (core : Core) (returnAddress : Word) (state : ByteEval.State) : Prop :=
+  state.core = core.setReg .rsp (core.readReg .rsp + 8) ∧ state.rip = returnAddress
+
+/-- A whole-stream theorem, quantified over every finite terminating run.
+The return-slot premise is one concrete final memory read. No byte-step or
+simulation callback is an input. -/
+theorem run_to_return {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (free : CallFree checked.program)
+    (runtime : Runtime) (base : Word) (fuel : Nat) (machine : Machine) (state : ByteEval.State)
+    (related : RunningAt checked.program base machine state) {after : Machine} {result returnAddress : Word}
+    (execution : run runtime checked fuel machine = after) (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ count finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      ByteEval.run output.text base count state = .ok finalState ∧ Returned after.core returnAddress finalState := by
+  induction fuel generalizing machine state with
+  | zero =>
+      have same : machine = after := execution
+      rw [← same, related.running] at halted
+      contradiction
+  | succ fuel ih =>
+      rw [run_succ] at execution
+      cases nextStatus : (step runtime checked machine).status with
+      | running =>
+          obtain ⟨first, middle, positive, bound, one, next⟩ :=
+            running_progress valid free runtime machine base state related nextStatus
+          obtain ⟨rest, finalState, restPositive, restBound, remaining, returned⟩ := ih _ _ next execution
+          refine ⟨first + rest, finalState, by omega, by omega, ?_, returned⟩
+          rw [byte_run_add, one]
+          exact remaining
+      | trapped fault =>
+          rw [run_of_not_running _ _ _ _ (by simp [nextStatus])] at execution
+          rw [← execution, nextStatus] at halted
+          contradiction
+      | halted value =>
+          rw [run_of_not_running _ _ _ _ (by simp [nextStatus])] at execution
+          obtain ⟨coreEqual, fetched⟩ := halting_ret valid free runtime machine base state related nextStatus
+          have stateCore : state.core = after.core := by rw [← execution, coreEqual]; exact related.core
+          let finalState : ByteEval.State :=
+            ⟨after.core.setReg .rsp (after.core.readReg .rsp + 8), returnAddress, state.flags⟩
+          have last : ByteEval.step output.text base state = .ok finalState := by
+            simp [ByteEval.step, fetched, ByteEval.execute, stateCore, slot, Except.mapError, finalState]
+          exact ⟨1, finalState, by decide, by omega, by simp [ByteEval.run, last], rfl, rfl⟩
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamTrace.lean b/Ix/Compiler/X86/StreamTrace.lean
new file mode 100644
index 000000000..6f6bbdb1a
--- /dev/null
+++ b/Ix/Compiler/X86/StreamTrace.lean
@@ -0,0 +1,219 @@
+import Ix.Compiler.X86.StreamCalls
+
+/-! Concrete compiler/ABI conditions for composing internal calls. Safety
+mentions only typed memory accesses, active frames and the deterministic
+mask of return-slot differences. It contains no byte-execution premise. -/
+
+namespace Ix.Compiler.X86.Stream
+
+attribute [local simp] pure Except.pure Functor.map Except.map bind Except.bind
+
+def holeStep (program : Program) (machine : Machine) (holes : Holes) : Holes :=
+  match program.blocks[machine.pc.block.toNat]? with
+  | none => holes
+  | some block =>
+      match block.instructions[machine.pc.offset.toNat]? with
+      | some (.call _) => addRange holes (machine.core.readReg .rsp - 8) 8
+      | some instruction => nextHoles holes (Encode.instructionOperation instruction) machine.core
+      | none => holes
+
+def SafeAt (program : Program) (holes : Holes) (machine : Machine) : Prop :=
+  match program.blocks[machine.pc.block.toNat]? with
+  | none => False
+  | some block =>
+      match block.instructions[machine.pc.offset.toNat]? with
+      | some (.call _) =>
+          SysV.callSiteAligned (machine.core.readReg .rsp) = true ∧
+          Memory.rangeAllowed machine.core.memory.writable (machine.core.readReg .rsp - 8) 8 = true ∧
+          FramesDisjoint machine.returns (machine.core.readReg .rsp - 8) 8
+      | some (.callRuntime _) => False
+      | some instruction => OperationSafe holes machine.returns (Encode.instructionOperation instruction) machine.core
+      | none =>
+          machine.pc.offset.toNat = block.instructions.size ∧
+          match block.terminator with
+          | .ret =>
+              match machine.returns with
+              | [] => ReadableData holes (machine.core.readReg .rsp) 8
+              | frame :: _ =>
+                  machine.core.readReg .rsp = frame.returnSlot ∧
+                  machine.core.memory.read64? frame.returnSlot = .ok frame.continuation.encode ∧
+                  machine.core.calleeSavedMatch frame.calleeSaved = true
+          | _ => True
+
+def SafeTrace (runtime : Runtime) (checked : Checked) : Nat → Holes → Machine → Prop
+  | 0, _, _ => True
+  | count + 1, holes, machine =>
+      SafeAt checked.program holes machine ∧
+      match (step runtime checked machine).status with
+      | .running => SafeTrace runtime checked count (holeStep checked.program machine holes) (step runtime checked machine)
+      | _ => True
+
+theorem safe_progress {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (holes : Holes) (state : ByteEval.State) (related : Related checked.program base holes machine state)
+    (safe : SafeAt checked.program holes machine)
+    (nextRunning : (step runtime checked machine).status = .running) :
+    ∃ count after, 0 < count ∧ count ≤ 3 ∧ ByteEval.run output.text base count state = .ok after ∧
+      Related checked.program base (holeStep checked.program machine holes) (step runtime checked machine) after := by
+  obtain ⟨offset, mapped, _⟩ := related.pc
+  obtain ⟨block, found, bound, _⟩ := pcOffset_info mapped
+  cases foundInstruction : block.instructions[machine.pc.offset.toNat]? with
+  | some instruction =>
+      by_cases linear : Encode.linearInstruction instruction = true
+      · have access : OperationSafe holes machine.returns (Encode.instructionOperation instruction) machine.core := by
+          cases instruction <;> simp_all [SafeAt, Encode.linearInstruction]
+        have changed : holeStep checked.program machine holes =
+            nextHoles holes (Encode.instructionOperation instruction) machine.core := by
+          cases instruction <;> simp_all [holeStep, Encode.linearInstruction]
+        obtain ⟨after, executed, next⟩ := paired_linear_progress valid runtime machine base holes state related
+          found foundInstruction linear access nextRunning
+        exact ⟨1, after, by decide, by decide, by simp [ByteEval.run, executed], changed.symm ▸ next⟩
+      · cases instruction <;> simp only [Encode.linearInstruction, not_true_eq_false] at linear
+        case call target =>
+          simp only [SafeAt, found, foundInstruction] at safe
+          obtain ⟨after, executed, next⟩ := call_progress valid runtime machine base holes state related
+            found foundInstruction safe.1 safe.2.1 safe.2.2
+          refine ⟨1, after, by decide, by decide, by simp [ByteEval.run, executed], ?_⟩
+          simpa only [holeStep, found, foundInstruction] using next
+        case callRuntime intrinsic => simp [SafeAt, found, foundInstruction] at safe
+  | none =>
+      simp only [SafeAt, found, foundInstruction] at safe
+      by_cases term : block.terminator = .ret
+      · have access := safe.2
+        rw [term] at access
+        cases returns : machine.returns with
+        | nil =>
+            simp [source_terminator runtime machine related.running found safe.1, term,
+              executeTerminator, returns] at nextRunning
+        | cons frame rest =>
+            simp only [returns] at access
+            obtain ⟨after, executed, next⟩ := ret_progress valid runtime machine base holes state related
+              found safe.1 term frame rest returns access.1 access.2.1 access.2.2
+            refine ⟨1, after, by decide, by decide, by simp [ByteEval.run, executed], ?_⟩
+            simpa only [holeStep, found, foundInstruction] using next
+      · obtain ⟨count, after, positive, countBound, executed, next⟩ :=
+          paired_control_progress valid runtime machine base holes state related found safe.1 term
+        refine ⟨count, after, positive, countBound, executed, ?_⟩
+        simpa only [holeStep, found, foundInstruction] using next
+
+theorem instruction_not_halted (runtime : Runtime) (checked : Checked) (machine : Machine)
+    (running : machine.status = .running) (instruction : Instr) (result : Word) :
+    (executeInstr runtime checked instruction machine).status ≠ .halted result := by
+  intro halted
+  cases next : machine.pc.next? <;> cases instruction <;> simp only [executeInstr] at halted
+  all_goals (repeat' split at halted) <;> simp_all [Machine.advanceWith, Machine.trap]
+
+theorem halting_shape {checked : Checked} (runtime : Runtime) (machine : Machine)
+    (running : machine.status = .running) {result : Word}
+    (halted : (step runtime checked machine).status = .halted result) :
+    ∃ block, checked.program.blocks[machine.pc.block.toNat]? = some block ∧
+      machine.pc.offset.toNat = block.instructions.size ∧ block.terminator = .ret ∧
+      machine.returns = [] ∧ (step runtime checked machine).core = machine.core := by
+  cases found : checked.program.blocks[machine.pc.block.toNat]? with
+  | none => simp [step, running, found, Machine.trap] at halted
+  | some block =>
+      cases foundInstruction : block.instructions[machine.pc.offset.toNat]? with
+      | some instruction =>
+          have one : step runtime checked machine = executeInstr runtime checked instruction machine := by
+            simp [step, running, found, foundInstruction]
+          exact False.elim (instruction_not_halted runtime checked machine running instruction result (one ▸ halted))
+      | none =>
+          by_cases position : machine.pc.offset.toNat = block.instructions.size
+          · have one := source_terminator runtime machine running found position
+            have gotoStatus (target : BlockId) : (machine.goto checked target).status ≠ .halted result := by
+              unfold Machine.goto
+              split <;> simp [Machine.trap, running]
+            cases term : block.terminator with
+            | jump target | tailCall target =>
+                simp only [one, term, executeTerminator] at halted
+                exact False.elim (gotoStatus _ halted)
+            | branch comparison condition yes no =>
+                simp only [one, term, executeTerminator] at halted
+                exact False.elim (gotoStatus _ halted)
+            | ret =>
+                cases returns : machine.returns with
+                | nil => exact ⟨block, rfl, position, term, rfl, by simp [one, term, executeTerminator, returns]⟩
+                | cons frame rest =>
+                    simp only [one, term, executeTerminator, returns] at halted
+                    (repeat' split at halted) <;> simp_all [Machine.trap]
+          · simp [step, running, found, foundInstruction, position, Machine.trap] at halted
+
+theorem final_ret {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (machine : Machine)
+    (base : Word) (holes : Holes) (state : ByteEval.State) (related : Related checked.program base holes machine state)
+    (safe : SafeAt checked.program holes machine) {result returnAddress : Word}
+    (halted : (step runtime checked machine).status = .halted result)
+    (slot : (step runtime checked machine).core.memory.read64?
+      ((step runtime checked machine).core.readReg .rsp) = .ok returnAddress) :
+    ∃ after, ByteEval.step output.text base state = .ok after ∧ after.rip = returnAddress ∧
+      CoreRelated checked.program base holes []
+        ((step runtime checked machine).core.setReg .rsp ((step runtime checked machine).core.readReg .rsp + 8)) after.core := by
+  obtain ⟨block, found, position, term, returns, coreEqual⟩ := halting_shape runtime machine related.running halted
+  have none : block.instructions[machine.pc.offset.toNat]? = none := by simp [position]
+  have data : ReadableData holes (machine.core.readReg .rsp) 8 := by
+    simpa [SafeAt, found, none, term, returns, position] using safe
+  rw [coreEqual] at slot
+  have readEqual := related.core.memory.read? .w64 (machine.core.readReg .rsp) data
+  have physicalRead : state.core.memory.read64? (state.core.readReg .rsp) = .ok returnAddress := by
+    rw [← related.core.readReg .rsp]
+    change state.core.memory.read? .w64 (machine.core.readReg .rsp) = .ok returnAddress
+    rw [← readEqual]
+    exact slot
+  have decode := valid.terminator _ _ found
+  simp only [term, terminatorMatches, decodes, beq_iff_eq] at decode
+  have address := related.pc.offset found (by omega)
+  rw [position] at address
+  have bound := terminator_bound found
+  have textBound := valid.textBound
+  rw [term] at bound
+  have one := step_decoded address (by simp only [terminatorSize] at bound; omega) decode
+  let after : ByteEval.State := ⟨state.core.setReg .rsp (state.core.readReg .rsp + 8), returnAddress, state.flags⟩
+  refine ⟨after, ?_, rfl, ?_⟩
+  · rw [one]
+    simp [ByteEval.execute, physicalRead, Except.mapError, after]
+  · change CoreRelated _ _ _ _ _ (state.core.setReg .rsp (state.core.readReg .rsp + 8))
+    rw [coreEqual, ← related.core.readReg .rsp, ← returns]
+    exact related.core.setReg .rsp _
+
+/-- Complete terminating streams with direct calls and tail calls. The
+residual mask precisely limits data-memory observations after return; every
+ordinary byte outside it and all registers (with RET's RSP adjustment) agree. -/
+theorem run_with_calls {checked : Checked} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid checked.program output externals) (runtime : Runtime) (base : Word)
+    (fuel : Nat) (holes : Holes) (machine : Machine) (state : ByteEval.State)
+    (related : Related checked.program base holes machine state) (safe : SafeTrace runtime checked fuel holes machine)
+    {after : Machine} {result returnAddress : Word}
+    (execution : run runtime checked fuel machine = after) (halted : after.status = .halted result)
+    (slot : after.core.memory.read64? (after.core.readReg .rsp) = .ok returnAddress) :
+    ∃ count finalHoles finalState, 0 < count ∧ count ≤ 3 * fuel ∧
+      ByteEval.run output.text base count state = .ok finalState ∧ finalState.rip = returnAddress ∧
+      CoreRelated checked.program base finalHoles [] (after.core.setReg .rsp (after.core.readReg .rsp + 8)) finalState.core := by
+  induction fuel generalizing holes machine state with
+  | zero =>
+      have same : machine = after := execution
+      rw [← same, related.running] at halted
+      contradiction
+  | succ fuel ih =>
+      rw [run_succ] at execution
+      obtain ⟨safeAt, restSafe⟩ := safe
+      cases nextStatus : (step runtime checked machine).status with
+      | running =>
+          obtain ⟨first, middle, positive, bound, one, next⟩ :=
+            safe_progress valid runtime machine base holes state related safeAt nextStatus
+          simp only [nextStatus] at restSafe
+          obtain ⟨rest, finalHoles, finalState, restPositive, restBound, remaining, returned, core⟩ :=
+            ih _ _ _ next restSafe execution
+          refine ⟨first + rest, finalHoles, finalState, by omega, by omega, ?_, returned, core⟩
+          rw [byte_run_add, one]
+          exact remaining
+      | trapped fault =>
+          rw [run_of_not_running _ _ _ _ (by simp [nextStatus])] at execution
+          rw [← execution, nextStatus] at halted
+          contradiction
+      | halted value =>
+          rw [run_of_not_running _ _ _ _ (by simp [nextStatus])] at execution
+          obtain ⟨finalState, last, returned, core⟩ := final_ret valid runtime machine base holes state related safeAt
+            nextStatus (execution ▸ slot)
+          exact ⟨1, holes, finalState, by decide, by omega, by simp [ByteEval.run, last], returned, execution ▸ core⟩
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/StreamValidate.lean b/Ix/Compiler/X86/StreamValidate.lean
new file mode 100644
index 000000000..55026e205
--- /dev/null
+++ b/Ix/Compiler/X86/StreamValidate.lean
@@ -0,0 +1,131 @@
+import Ix.Compiler.X86.StreamLayout
+
+/-! Fail-closed validation of complete emitted text. This checks decoded
+operations, canonical positions, all internal targets, and the exact external
+relocation inventory. Certificates contain these concrete facts, never a
+caller-supplied execution or simulation function. -/
+
+namespace Ix.Compiler.X86.Stream
+
+/-- External code positions relative to the text base; negative positions
+allow a linker to place a procedure before the current text segment. -/
+abbrev ExternalTargets := Intrinsic → Option Int
+def unresolved : ExternalTargets := fun _ => none
+
+def displacement (next target : Nat) : Imm32 := (Int32.ofInt ((target : Int) - next)).toUInt32
+def externalDisplacement (next : Nat) (target : Int) : Imm32 := (Int32.ofInt (target - next)).toUInt32
+
+def decodes (text : ByteArray) (offset : Nat) (operation : Decode.Operation) (length : Nat) : Bool :=
+  Decode.decodeAt text offset == some ⟨operation, length⟩
+
+def targets (program : Program) (text : ByteArray) (offset : Nat)
+    (operation : Imm32 → Decode.Operation) (length : Nat) (target : BlockId) : Bool :=
+  decide (target.toNat < program.blocks.size) &&
+    Encode.fitsSigned32 ((blockOffset program target.toNat : Int) - (offset + length)) &&
+    decodes text offset (operation (displacement (offset + length) (blockOffset program target.toNat))) length
+
+def instructionMatches (program : Program) (text : ByteArray) (externals : ExternalTargets)
+    (offset : Nat) (instruction : Instr) : Bool :=
+  match instruction with
+  | .call target => targets program text offset .call 5 target
+  | .callRuntime intrinsic =>
+      match externals intrinsic with
+      | none => decodes text offset (.call 0) 5
+      | some target => Encode.fitsSigned32 (target - (offset + 5)) &&
+          decodes text offset (.call (externalDisplacement (offset + 5) target)) 5
+  | _ => decodes text offset (Encode.instructionOperation instruction) (instructionSize instruction)
+
+def terminatorMatches (program : Program) (text : ByteArray) (offset : Nat) : Terminator → Bool
+  | .jump target | .tailCall target => targets program text offset .jump 5 target
+  | .ret => decodes text offset .ret 1
+  | .branch comparison condition yes no =>
+      let size := (Encode.encodeCompare comparison).size
+      decodes text offset (.compare comparison.width comparison.left (Encode.aluOperand comparison.width comparison.right)) size &&
+        targets program text (offset + size) (.branch condition) 6 yes &&
+        targets program text (offset + size + 6) .jump 5 no
+
+def expectedRelocations (program : Program) : Array Encode.Relocation :=
+  ((program.blocks.toList.zipIdx).flatMap fun (block, blockIndex) =>
+    block.instructions.toList.zipIdx.filterMap fun (instruction, instructionIndex) =>
+      match instruction with
+      | .callRuntime intrinsic => some {
+          offset := blockOffset program blockIndex + instructionOffset block instructionIndex + 1
+          symbol := Encode.intrinsicSymbol intrinsic, addend := -4 }
+      | _ => none).toArray
+
+def blockMatches (program : Program) (output : Encode.Output) (externals : ExternalTargets)
+    (blockIndex : Nat) : Bool :=
+  match program.blocks[blockIndex]? with
+  | none => false
+  | some block =>
+      (List.range block.instructions.size).all (fun index =>
+        match block.instructions[index]? with
+        | none => false
+        | some instruction => instructionMatches program output.text externals
+            (blockOffset program blockIndex + instructionOffset block index) instruction) &&
+      terminatorMatches program output.text
+        (blockOffset program blockIndex + instructionOffset block block.instructions.size) block.terminator
+
+def check (program : Program) (output : Encode.Output) (externals : ExternalTargets := unresolved) : Bool :=
+  decide (textSize program < UInt64.size) && output.text.size == textSize program &&
+    output.blockOffsets == blockOffsets program && output.relocations == expectedRelocations program &&
+    (List.range program.blocks.size).all (blockMatches program output externals)
+
+structure Valid (program : Program) (output : Encode.Output) (externals : ExternalTargets := unresolved) : Prop where
+  textBound : textSize program < UInt64.size
+  textLength : output.text.size = textSize program
+  offsets : output.blockOffsets = blockOffsets program
+  relocations : output.relocations = expectedRelocations program
+  instruction : ∀ blockIndex block, program.blocks[blockIndex]? = some block →
+    ∀ index instruction, block.instructions[index]? = some instruction →
+      instructionMatches program output.text externals
+        (blockOffset program blockIndex + instructionOffset block index) instruction = true
+  terminator : ∀ blockIndex block, program.blocks[blockIndex]? = some block →
+    terminatorMatches program output.text
+      (blockOffset program blockIndex + instructionOffset block block.instructions.size) block.terminator = true
+
+theorem check_sound {program : Program} {output : Encode.Output} {externals : ExternalTargets}
+    (accepted : check program output externals = true) : Valid program output externals := by
+  simp only [check, Bool.and_eq_true, decide_eq_true_eq, beq_iff_eq, and_assoc] at accepted
+  obtain ⟨bound, length, offsets, relocations, blocks⟩ := accepted
+  refine ⟨bound, length, offsets, relocations, ?_, ?_⟩
+  · intro blockIndex block found index instruction foundInstruction
+    have blockBound : blockIndex < program.blocks.size := (Array.getElem?_eq_some_iff.mp found).1
+    have row := List.all_eq_true.mp blocks blockIndex (List.mem_range.mpr blockBound)
+    simp only [blockMatches, found, Bool.and_eq_true] at row
+    have indexBound : index < block.instructions.size := (Array.getElem?_eq_some_iff.mp foundInstruction).1
+    have cell := List.all_eq_true.mp row.1 index (List.mem_range.mpr indexBound)
+    simpa [foundInstruction] using cell
+  · intro blockIndex block found
+    have blockBound : blockIndex < program.blocks.size := (Array.getElem?_eq_some_iff.mp found).1
+    have row := List.all_eq_true.mp blocks blockIndex (List.mem_range.mpr blockBound)
+    simp only [blockMatches, found, Bool.and_eq_true] at row
+    exact row.2
+
+structure Certified (checked : Checked) where
+  output : Encode.Output
+  valid : Valid checked.program output
+
+inductive Error where
+  | encoder (error : Encode.Error)
+  | invalidStream
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+/-- The compiler returns a stream only with a checked concrete certificate.
+The ordinary encoder remains available for isolated encoding tests. -/
+def encode (checked : Checked) : Except Error (Certified checked) := do
+  let output ← (Encode.encode checked).mapError Error.encoder
+  if accepted : check checked.program output = true then
+    return ⟨output, check_sound accepted⟩
+  else throw .invalidStream
+
+theorem Valid.decode_linear {program : Program} {output : Encode.Output} {externals : ExternalTargets}
+    (valid : Valid program output externals) {blockIndex index : Nat} {block : Block} {instruction : Instr}
+    (found : program.blocks[blockIndex]? = some block) (foundInstruction : block.instructions[index]? = some instruction)
+    (linear : Encode.linearInstruction instruction = true) :
+    Decode.decodeAt output.text (blockOffset program blockIndex + instructionOffset block index) =
+      some ⟨Encode.instructionOperation instruction, instructionSize instruction⟩ := by
+  have accepted := valid.instruction blockIndex block found index instruction foundInstruction
+  cases instruction <;> simp_all [instructionMatches, Encode.linearInstruction, decodes, beq_iff_eq]
+
+end Ix.Compiler.X86.Stream
diff --git a/Ix/Compiler/X86/UniqueABI.lean b/Ix/Compiler/X86/UniqueABI.lean
new file mode 100644
index 000000000..392fad709
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueABI.lean
@@ -0,0 +1,207 @@
+import Ix.Compiler.X86.Memory
+
+/-!
+# Bounded unique-list arena ABI
+
+The entry receives an eight-byte-aligned descriptor in `rdi`. Its ten words
+contain a bump offset in bytes, capacity in bytes, and resource observations.
+Four-word list cells follow immediately. Each cell stores a tag, scalar head,
+tail pointer, and zero padding. Allocation, reservation, reuse, and release are
+selected as ordinary x86 instructions; the caller supplies the bounded region.
+
+Only the checked reversal schema uses this ABI. Tags have meaning relative to
+that schema's complete constructor identities, retained by the compiler and
+object provenance. This representation is not an open heap or extern ABI.
+-/
+
+namespace Ix.Compiler.X86.UniqueABI
+
+def policyTag : String := "unique-list-arena/1"
+def maxLength : Nat := 64
+def headerWords : Nat := 10
+def cellWords : Nat := 4
+def headerBytes : Nat := 80
+def cellBytes : Nat := 32
+
+inductive Field where
+  | cursor | capacity | allocs | frees | reuses | live | peak | rcops | payload | reservations
+  deriving BEq, ReflBEq, LawfulBEq, DecidableEq, Repr, Inhabited
+
+def Field.index : Field → Nat
+  | .cursor => 0 | .capacity => 1 | .allocs => 2 | .frees => 3 | .reuses => 4
+  | .live => 5 | .peak => 6 | .rcops => 7 | .payload => 8 | .reservations => 9
+
+@[simp] theorem Field.index_lt (field : Field) : field.index < headerWords := by
+  cases field <;> decide
+
+def nilTag : Word := 0
+def consTag : Word := 1
+def reservedTag : Word := 2
+def freedTag : Word := 3
+
+structure Layout where
+  base : Word
+  capacity : Nat
+  capacityBound : capacity ≤ maxLength + 2
+  aligned : base % 8 = 0
+  nonzero : base ≠ 0
+  fits : base.toNat + headerBytes + cellBytes * capacity ≤ UInt64.size
+
+def Layout.slots (layout : Layout) : Nat := headerWords + cellWords * layout.capacity
+def Layout.address (layout : Layout) (slot : Nat) : Word := layout.base + UInt64.ofNat (8 * slot)
+def cellSlot (index field : Nat) : Nat := headerWords + cellWords * index + field
+def Layout.cell (layout : Layout) (index : Nat) : Word := layout.address (cellSlot index 0)
+
+theorem Layout.address_toNat (layout : Layout) {slot : Nat} (bound : slot < layout.slots) :
+    (layout.address slot).toNat = layout.base.toNat + 8 * slot := by
+  have fits := layout.fits
+  have small : layout.base.toNat + 8 * slot < UInt64.size := by
+    simp only [Layout.slots, headerWords, cellWords] at bound
+    simp only [headerBytes, cellBytes] at fits
+    omega
+  rw [Layout.address, UInt64.toNat_add, UInt64.toNat_ofNat_of_lt' (by omega)]
+  exact Nat.mod_eq_of_lt small
+
+theorem Layout.address_aligned (layout : Layout) {slot : Nat} (bound : slot < layout.slots) :
+    layout.address slot % 8 = 0 := by
+  apply UInt64.toNat_inj.mp
+  have aligned := congrArg UInt64.toNat layout.aligned
+  simp only [UInt64.toNat_mod] at aligned ⊢
+  change layout.base.toNat % 8 = 0 at aligned
+  change (layout.address slot).toNat % 8 = 0
+  rw [layout.address_toNat bound]
+  omega
+
+theorem Layout.address_injective (layout : Layout) {left right : Nat}
+    (leftBound : left < layout.slots) (rightBound : right < layout.slots)
+    (equal : layout.address left = layout.address right) : left = right := by
+  have same := congrArg UInt64.toNat equal
+  rw [layout.address_toNat leftBound, layout.address_toNat rightBound] at same
+  omega
+
+theorem Layout.byteAddress_toNat (layout : Layout) {slot offset : Nat}
+    (slotBound : slot < layout.slots) (offsetBound : offset < 8) :
+    (layout.address slot + UInt64.ofNat offset).toNat = layout.base.toNat + 8 * slot + offset := by
+  have fits := layout.fits
+  have small : layout.base.toNat + 8 * slot + offset < UInt64.size := by
+    simp only [Layout.slots, headerWords, cellWords] at slotBound
+    simp only [headerBytes, cellBytes] at fits
+    omega
+  rw [UInt64.toNat_add, layout.address_toNat slotBound, UInt64.toNat_ofNat_of_lt' (by omega)]
+  exact Nat.mod_eq_of_lt small
+
+def Layout.allowed (layout : Layout) (address : Word) : Bool :=
+  decide (layout.base.toNat ≤ address.toNat ∧ address.toNat < layout.base.toNat + 8 * layout.slots)
+
+theorem Layout.byteAllowed (layout : Layout) {slot offset : Nat}
+    (slotBound : slot < layout.slots) (offsetBound : offset < 8) :
+    layout.allowed (layout.address slot + UInt64.ofNat offset) = true := by
+  simp only [Layout.allowed, decide_eq_true_eq, layout.byteAddress_toNat slotBound offsetBound]
+  omega
+
+abbrev Words := Nat → Word
+
+def Words.set (words : Words) (slot : Nat) (value : Word) : Words :=
+  fun candidate => if candidate == slot then value else words candidate
+
+@[simp] theorem Words.set_same (words : Words) (slot : Nat) (value : Word) :
+    words.set slot value slot = value := by simp [Words.set]
+
+@[simp] theorem Words.set_other (words : Words) (slot other : Nat) (value : Word)
+    (different : other ≠ slot) : words.set slot value other = words other := by
+  simp [Words.set, different]
+
+def initialWords (layout : Layout) : Words :=
+  Words.set (fun _ => 0) Field.capacity.index (UInt64.ofNat (cellBytes * layout.capacity))
+
+structure Realizes (layout : Layout) (outside : Memory) (words : Words) (memory : Memory) : Prop where
+  view : ∀ slot < layout.slots, memory.read64 (layout.address slot) = words slot
+  readable : ∀ slot < layout.slots, Memory.rangeAllowed memory.readable (layout.address slot) 8 = true
+  writable : ∀ slot < layout.slots, Memory.rangeAllowed memory.writable (layout.address slot) 8 = true
+  frame : ∀ address, layout.allowed address = false → memory.bytes address = outside.bytes address
+
+theorem Realizes.write64 {layout : Layout} {outside memory : Memory} {words : Words}
+    (represented : Realizes layout outside words memory) {slot : Nat} (bound : slot < layout.slots)
+    (value : Word) :
+    Realizes layout outside (words.set slot value) (memory.write64 (layout.address slot) value) := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro other otherBound
+    by_cases same : other = slot
+    · subst other
+      simp [Memory.read64_write64]
+    · rw [Memory.read64_write64_ne _ _ _ _ (layout.address_aligned bound)
+        (layout.address_aligned otherBound) (fun equal => same (layout.address_injective otherBound bound equal))]
+      simp [represented.view other otherBound, same]
+  · simpa using represented.readable
+  · simpa using represented.writable
+  · intro address notAllowed
+    rw [Memory.write64_bytes_outside]
+    · exact represented.frame address notAllowed
+    · intro offset offsetBound same
+      have allowed := layout.byteAllowed bound offsetBound
+      rw [← same, notAllowed] at allowed
+      contradiction
+
+def fillWords (layout : Layout) (words : Words) (memory : Memory) : Nat → Memory
+  | 0 => memory
+  | count + 1 => (fillWords layout words memory count).write64 (layout.address count) (words count)
+
+@[simp] theorem fillWords_readable (layout : Layout) (words : Words) (memory : Memory) (count : Nat) :
+    (fillWords layout words memory count).readable = memory.readable := by
+  induction count <;> simp [fillWords, *]
+
+@[simp] theorem fillWords_writable (layout : Layout) (words : Words) (memory : Memory) (count : Nat) :
+    (fillWords layout words memory count).writable = memory.writable := by
+  induction count <;> simp [fillWords, *]
+
+theorem fillWords_read (layout : Layout) (words : Words) (memory : Memory)
+    {count slot : Nat} (countBound : count ≤ layout.slots) (slotBound : slot < count) :
+    (fillWords layout words memory count).read64 (layout.address slot) = words slot := by
+  induction count with
+  | zero => omega
+  | succ count ih =>
+      rw [fillWords]
+      by_cases same : slot = count
+      · subst slot; exact Memory.read64_write64 _ _ _
+      · rw [Memory.read64_write64_ne _ _ _ _ (layout.address_aligned (by omega))
+          (layout.address_aligned (by omega)) (fun equal => same (layout.address_injective (by omega) (by omega) equal))]
+        exact ih (by omega) (by omega)
+
+theorem fillWords_frame (layout : Layout) (words : Words) (memory : Memory)
+    {count : Nat} (countBound : count ≤ layout.slots) (address : Word)
+    (notAllowed : layout.allowed address = false) :
+    (fillWords layout words memory count).bytes address = memory.bytes address := by
+  induction count with
+  | zero => rfl
+  | succ count ih =>
+      rw [fillWords, Memory.write64_bytes_outside]
+      · exact ih (by omega)
+      · intro offset offsetBound same
+        have allowed := layout.byteAllowed (slot := count) (by omega) offsetBound
+        rw [← same, notAllowed] at allowed
+        contradiction
+
+def initialMemory (layout : Layout) (outside : Memory) : Memory :=
+  fillWords layout (initialWords layout)
+    { outside with
+      readable := fun address => layout.allowed address || outside.readable address
+      writable := fun address => layout.allowed address || outside.writable address }
+    layout.slots
+
+theorem initialMemory_realizes (layout : Layout) (outside : Memory) :
+    Realizes layout outside (initialWords layout) (initialMemory layout outside) := by
+  refine ⟨fun slot bound => fillWords_read _ _ _ (by omega) bound, ?_, ?_, ?_⟩
+  · intro slot bound
+    simp only [initialMemory, fillWords_readable]
+    apply Memory.rangeAllowed_of_forall
+    intro offset offsetBound
+    simp [layout.byteAllowed bound offsetBound]
+  · intro slot bound
+    simp only [initialMemory, fillWords_writable]
+    apply Memory.rangeAllowed_of_forall
+    intro offset offsetBound
+    simp [layout.byteAllowed bound offsetBound]
+  · intro address notAllowed
+    exact fillWords_frame _ _ _ (by omega) address notAllowed
+
+end Ix.Compiler.X86.UniqueABI
diff --git a/Ix/Compiler/X86/UniqueControl.lean b/Ix/Compiler/X86/UniqueControl.lean
new file mode 100644
index 000000000..bcf27af14
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueControl.lean
@@ -0,0 +1,130 @@
+import Ix.Compiler.X86.UniqueInvariant
+
+/-! Complete-block execution for the selected leaf programs. These lemmas
+compose instruction traces with the actual evaluator's jumps, branches, and
+return, preserving the byte-memory realization at every block boundary. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+theorem State.compare_core (state : State) (memory : Memory) (comparison : Compare)
+    (condition : Condition) :
+    comparison.holds condition (state.core memory) =
+      comparison.holds condition (state.core Memory.unmapped) := by
+  cases comparison.right <;> rfl
+
+theorem Trace.jump {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) (runtime : Runtime) (checked : Checked)
+    (block target : BlockId) (code : BlockCode checked block instructions (.jump target))
+    (valid : checked.program.hasBlock target = true) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (instructions.length + 1) (leaf (before.core memory) block 0)
+        (leaf (after.core nextMemory) target 0) := by
+  obtain ⟨nextMemory, finalView, first⟩ := trace.steps outside memory represented runtime checked block 0
+    code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at first
+  exact ⟨nextMemory, finalView, first.append (Steps.single (code.jump valid runtime _))⟩
+
+theorem Trace.branch {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) (runtime : Runtime) (checked : Checked)
+    (block yes no : BlockId) (comparison : Compare) (condition : Condition)
+    (code : BlockCode checked block instructions (.branch comparison condition yes no)) (answer : Bool)
+    (holds : comparison.holds condition (after.core Memory.unmapped) = answer)
+    (valid : checked.program.hasBlock (if answer then yes else no) = true) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (instructions.length + 1) (leaf (before.core memory) block 0)
+        (leaf (after.core nextMemory) (if answer then yes else no) 0) := by
+  obtain ⟨nextMemory, finalView, first⟩ := trace.steps outside memory represented runtime checked block 0
+    code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at first
+  exact ⟨nextMemory, finalView, first.append (Steps.single (code.branch runtime _ answer
+    ((after.compare_core nextMemory comparison condition).trans holds) valid))⟩
+
+theorem Trace.ret {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) (runtime : Runtime) (checked : Checked)
+    (block : BlockId) (code : BlockCode checked block instructions .ret) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (instructions.length + 1) (leaf (before.core memory) block 0)
+        (haltedLeaf (after.core nextMemory) block instructions.length) := by
+  obtain ⟨nextMemory, finalView, first⟩ := trace.steps outside memory represented runtime checked block 0
+    code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at first
+  exact ⟨nextMemory, finalView, first.append (Steps.single (code.ret runtime _))⟩
+
+def tagInstructions (pointer : GPR) : List Instr := [.load .w64 .rcx (memoryOperand pointer 0)]
+def tagCompare : Compare := { width := .w64, left := .rcx, right := .imm 0 }
+def tagState (state : State) (index : Nat) : State := state.setReg .rcx (state.words (cellSlot index 0))
+
+theorem tagTrace (layout : Layout) (state : State) (pointer : GPR) (index : Nat)
+    (bound : index < layout.capacity) (root : state.registers pointer = layout.cell index) :
+    Trace layout (tagInstructions pointer) state (tagState state index) :=
+  .cons (loadField layout state pointer .rcx index 0 bound (by decide) root) (.nil _)
+
+theorem tagState_test (state : State) (index : Nat) (tag : Word)
+    (tagAt : state.words (cellSlot index 0) = tag) :
+    tagCompare.holds .eq ((tagState state index).core Memory.unmapped) = (tag == 0) := by
+  simp [tagCompare, Compare.holds, Condition.holds, Core.readReg, State.core, AluSource.eval,
+    tagState, tagAt, signExtend32]
+
+theorem main_hasBlock (values : List Word) (checked : Checked) (produced : checked.program = program values)
+    (block : BlockId) (bound : block.toNat < 7) : checked.program.hasBlock block = true := by
+  simp [Program.hasBlock, produced, program, bound]
+
+theorem main_tagCode (values : List Word) (checked : Checked) (produced : checked.program = program values) :
+    BlockCode checked 3 (tagInstructions .rdx) (.branch tagCompare .eq 4 5) :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+theorem main_consCode (values : List Word) (checked : Checked) (produced : checked.program = program values) :
+    BlockCode checked 5 consInstructions (.jump 3) :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+theorem main_retCode (values : List Word) (checked : Checked) (produced : checked.program = program values) :
+    BlockCode checked 4 (releaseCell .rdx ++ [Instr.mov .w64 .rax (.reg .rsi)]) .ret :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+/-- The reversal loop can be reached from either a closed builder or a
+checked runtime-input prologue. A replacement cons block supplies its own
+instruction-effect proof to the loop composition theorem. -/
+structure LoopCode (checked : Checked) (body : List Instr := consInstructions) : Prop where
+  tag : BlockCode checked 3 (tagInstructions .rdx) (.branch tagCompare .eq 4 5)
+  cons : BlockCode checked 5 body (.jump 3)
+  finish : BlockCode checked 4 (releaseCell .rdx ++ [Instr.mov .w64 .rax (.reg .rsi)]) .ret
+  hasTag : checked.program.hasBlock 3 = true
+  hasCons : checked.program.hasBlock 5 = true
+  hasFinish : checked.program.hasBlock 4 = true
+
+theorem main_loopCode (values : List Word) (checked : Checked) (produced : checked.program = program values) :
+    LoopCode checked :=
+  ⟨main_tagCode values checked produced, main_consCode values checked produced, main_retCode values checked produced,
+    main_hasBlock values checked produced 3 (by decide), main_hasBlock values checked produced 5 (by decide),
+    main_hasBlock values checked produced 4 (by decide)⟩
+
+theorem main_inputCode (values : List Word) (checked : Checked) (produced : checked.program = program values)
+    (bound : values.length ≤ maxLength) : BlockCode checked 2 (inputInstructions values) (.jump 3) := by
+  refine ⟨by rw [produced]; rfl, ?_⟩
+  simp only [inputInstructions_length, UInt32.size]
+  change values.length ≤ 64 at bound
+  omega
+
+theorem release_hasBlock (checked : Checked) (produced : checked.program = releaseProgram)
+    (block : BlockId) (bound : block.toNat < 3) : checked.program.hasBlock block = true := by
+  simp [Program.hasBlock, produced, releaseProgram, bound]
+
+theorem release_tagCode (checked : Checked) (produced : checked.program = releaseProgram) :
+    BlockCode checked 0 (tagInstructions .rsi) (.branch tagCompare .eq 2 1) :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+theorem release_consCode (checked : Checked) (produced : checked.program = releaseProgram) :
+    BlockCode checked 1 ([Instr.load .w64 .rdx (memoryOperand .rsi 16)] ++ releaseCell .rsi ++
+      [Instr.mov .w64 .rsi (.reg .rdx)]) (.jump 0) :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+theorem release_retCode (checked : Checked) (produced : checked.program = releaseProgram) :
+    BlockCode checked 2 (releaseCell .rsi ++ [Instr.mov .w64 .rax (.imm 0)]) .ret :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueCounterFold.lean b/Ix/Compiler/X86/UniqueCounterFold.lean
new file mode 100644
index 000000000..aba97cc4f
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueCounterFold.lean
@@ -0,0 +1,91 @@
+import Ix.Compiler.X86.UniqueHeap
+
+/-! A bounded reserve/reuse rewrite. The adjacent reservation and live-cell
+counter updates cancel before any observer or call. Retain every cell operation,
+the cumulative reuse/payload counters, and the exact final register state. -/
+
+namespace Ix.Compiler.X86.UniqueCounterFold
+
+open UniqueABI UniqueTarget UniqueExecution
+
+def policyTag : String := "unique-reserve-reuse-counter-fold/1"
+
+def instructions : List Instr :=
+  [.load .w64 .r8 (memoryOperand .rdx 8), .load .w64 .r9 (memoryOperand .rdx 16),
+   .mov .w64 .rcx (.imm reservedTag), .store .w64 (memoryOperand .rdx 0) .rcx,
+   .store .w64 (memoryOperand .rdx 8) .r8, .store .w64 (memoryOperand .rdx 16) .rsi,
+   .mov .w64 .rcx (.imm consTag), .store .w64 (memoryOperand .rdx 0) .rcx] ++
+  changeCounter .reuses .add 1 ++ changeCounter .payload .add 2 ++
+  [.mov .w64 .rsi (.reg .rdx), .mov .w64 .rdx (.reg .r9)]
+
+def foldedState (state : State) (index : Nat) : State :=
+  let loaded := (state.setReg .r8 (state.words (cellSlot index 1))).setReg .r9
+    (state.words (cellSlot index 2))
+  let reserved := writeSourceState loaded (cellSlot index 0) (.imm reservedTag)
+  let payload := (reserved.setWord (cellSlot index 1) (reserved.registers .r8)).setWord
+    (cellSlot index 2) (reserved.registers .rsi)
+  let reused := writeSourceState payload (cellSlot index 0) (.imm consTag)
+  let counted := counterState (counterState reused .reuses .add 1) .payload .add 2
+  (counted.setReg .rsi (counted.registers .rdx)).setReg .rdx (counted.registers .r9)
+
+/-- Equality includes scratch registers and every arena word. No assumption
+about the initial counter values is needed for the cancelling Word updates. -/
+theorem state_eq (state : State) (index : Nat) : foldedState state index = consState state index := by
+  apply State.ext
+  · funext register
+    cases register <;>
+      simp (discharger := omega) [foldedState, consState, reserveState, reuseState,
+        writeSourceState, counterState, State.setReg, State.setWord, State.move,
+        MoveSource.eval, Registers.set, Words.set, Field.index, AluOp.eval,
+        signExtend32, cellSlot, headerWords, cellWords, beq_iff_eq]
+  · rw [consState_words]
+    funext slot
+    have cases : slot = 4 ∨ slot = 8 ∨ slot = cellSlot index 0 ∨ slot = cellSlot index 1 ∨
+        slot = cellSlot index 2 ∨
+        (slot ≠ 4 ∧ slot ≠ 8 ∧ slot ≠ cellSlot index 0 ∧ slot ≠ cellSlot index 1 ∧ slot ≠ cellSlot index 2) := by
+      omega
+    rcases cases with h | h | h | h | h | h <;>
+      (try simp only [cellSlot, headerWords, cellWords, Nat.add_zero] at h) <;>
+      simp (discharger := omega) [foldedState, consumedWords, writeSourceState, counterState,
+        State.setReg, State.setWord, State.move, MoveSource.eval,
+        Registers.set, Words.set, Field.index, AluOp.eval, signExtend32, cellSlot,
+        headerWords, cellWords, beq_iff_eq, if_neg, *] <;> rfl
+
+theorem trace (layout : Layout) (state : State) (index : Nat) (indexBound : index < layout.capacity)
+    (context : state.registers .rdi = layout.base) (pointer : state.registers .rdx = layout.cell index) :
+    Trace layout instructions state (consState state index) := by
+  let first := state.setReg .r8 (state.words (cellSlot index 1))
+  let loaded := first.setReg .r9 (state.words (cellSlot index 2))
+  let reserved := writeSourceState loaded (cellSlot index 0) (.imm reservedTag)
+  let head := reserved.setWord (cellSlot index 1) (reserved.registers .r8)
+  let payload := head.setWord (cellSlot index 2) (reserved.registers .rsi)
+  let reused := writeSourceState payload (cellSlot index 0) (.imm consTag)
+  let counted := counterState reused .reuses .add 1
+  let final := counterState counted .payload .add 2
+  have loads : Trace layout [.load .w64 .r8 (memoryOperand .rdx 8), .load .w64 .r9 (memoryOperand .rdx 16)]
+      state loaded := by
+    refine .cons (loadField layout state .rdx .r8 index 1 indexBound (by decide) pointer)
+      (.cons (loadField layout first .rdx .r9 index 2 indexBound (by decide) ?_) (.nil _))
+    simpa [first] using pointer
+  have reserve := writeSourceTrace layout loaded .rdx index 0 (.imm reservedTag) indexBound (by decide)
+    (by simpa [loaded, first] using pointer) (by decide)
+  have stores : Trace layout [.store .w64 (memoryOperand .rdx 8) .r8, .store .w64 (memoryOperand .rdx 16) .rsi]
+      reserved payload := by
+    refine .cons (storeField layout reserved .rdx .r8 index 1 indexBound (by decide) ?_)
+      (.cons (storeField layout head .rdx .rsi index 2 indexBound (by decide) ?_) (.nil _)) <;>
+      simpa [head, reserved, loaded, first] using pointer
+  have reuse := writeSourceTrace layout payload .rdx index 0 (.imm consTag) indexBound (by decide)
+    (by simpa [payload, head, reserved, loaded, first] using pointer) (by decide)
+  have countReuse := counterTrace layout reused .reuses .add 1
+    (by simpa [reused, payload, head, reserved, loaded, first] using context)
+  have countPayload := counterTrace layout counted .payload .add 2
+    (by simpa [counted, reused, payload, head, reserved, loaded, first] using context)
+  have finish : Trace layout [.mov .w64 .rsi (.reg .rdx), .mov .w64 .rdx (.reg .r9)] final (foldedState state index) := by
+    refine .cons (.mov _ _ _) (.cons (.mov _ _ _) ?_)
+    exact .nil _
+  have all := loads.append (reserve.append (stores.append (reuse.append (countReuse.append (countPayload.append finish)))))
+  simpa [instructions, List.append_assoc, state_eq] using all
+
+theorem instruction_saving : instructions.length + 12 = consInstructions.length := rfl
+
+end Ix.Compiler.X86.UniqueCounterFold
diff --git a/Ix/Compiler/X86/UniqueExecution.lean b/Ix/Compiler/X86/UniqueExecution.lean
new file mode 100644
index 000000000..f454c73ea
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueExecution.lean
@@ -0,0 +1,128 @@
+import Ix.Compiler.X86.Execution
+import Ix.Compiler.X86.UniqueTarget
+
+/-! Word views of native instruction effects. Every load/store supplies an
+in-bounds arena slot and an equality to the actual effective address. The
+soundness theorem reconstructs execution over the existing byte memory. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI
+
+structure State where
+  registers : Registers
+  words : Words
+
+theorem State.ext {left right : State} (registers : left.registers = right.registers)
+    (words : left.words = right.words) : left = right := by
+  cases left
+  cases right
+  cases registers
+  cases words
+  rfl
+
+def State.core (state : State) (memory : Memory) : Core := ⟨state.registers, memory⟩
+def State.setReg (state : State) (register : GPR) (value : Word) : State :=
+  { state with registers := state.registers.set register value }
+def State.setWord (state : State) (slot : Nat) (value : Word) : State :=
+  { state with words := state.words.set slot value }
+def State.address (state : State) (address : MemAddr) : Word := address.eval (state.core Memory.unmapped)
+def State.move (state : State) (source : MoveSource) : Word := source.eval (state.core Memory.unmapped)
+def State.alu (state : State) (source : AluSource) : Word := source.eval (state.core Memory.unmapped)
+
+@[simp] theorem State.address_core (state : State) (memory : Memory) (address : MemAddr) :
+    address.eval (state.core memory) = state.address address := rfl
+@[simp] theorem State.move_core (state : State) (memory : Memory) (source : MoveSource) :
+    source.eval (state.core memory) = state.move source := by cases source <;> rfl
+@[simp] theorem State.alu_core (state : State) (memory : Memory) (source : AluSource) :
+    source.eval (state.core memory) = state.alu source := by cases source <;> rfl
+
+inductive Effect (layout : Layout) : Instr → State → State → Prop where
+  | mov (state : State) (destination : GPR) (source : MoveSource) :
+      Effect layout (.mov .w64 destination source) state (state.setReg destination (state.move source))
+  | lea (state : State) (destination : GPR) (source : MemAddr) :
+      Effect layout (.lea destination source) state (state.setReg destination (state.address source))
+  | alu (state : State) (operation : AluOp) (destination : GPR) (source : AluSource) :
+      Effect layout (.alu operation .w64 destination source) state
+        (state.setReg destination (operation.eval (state.registers destination) (state.alu source)))
+  | load (state : State) (destination : GPR) (source : MemAddr) (slot : Nat)
+      (bound : slot < layout.slots) (address : state.address source = layout.address slot) :
+      Effect layout (.load .w64 destination source) state (state.setReg destination (state.words slot))
+  | store (state : State) (destination : MemAddr) (source : GPR) (slot : Nat)
+      (bound : slot < layout.slots) (address : state.address destination = layout.address slot) :
+      Effect layout (.store .w64 destination source) state (state.setWord slot (state.registers source))
+
+inductive Trace (layout : Layout) : List Instr → State → State → Prop where
+  | nil (state) : Trace layout [] state state
+  | cons {instruction : Instr} {instructions : List Instr} {before middle after : State}
+      (first : Effect layout instruction before middle) (rest : Trace layout instructions middle after) :
+      Trace layout (instruction :: instructions) before after
+
+theorem Trace.append {layout : Layout} {left right : List Instr} {before middle after : State}
+    (first : Trace layout left before middle) (second : Trace layout right middle after) :
+    Trace layout (left ++ right) before after := by
+  induction first with
+  | nil => exact second
+  | cons first rest ih => exact .cons first (ih second)
+
+theorem Effect.sound {layout : Layout} {instruction : Instr} {before after : State}
+    (effect : Effect layout instruction before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Straight.Effect instruction (before.core memory) (after.core nextMemory) := by
+  cases effect with
+  | mov _ destination source =>
+      refine ⟨memory, represented, ?_⟩
+      have effect := Straight.Effect.mov (before.core memory) destination source
+      rw [State.move_core] at effect
+      simpa [State.core, State.setReg, Core.setReg] using effect
+  | lea _ destination source =>
+      refine ⟨memory, represented, ?_⟩
+      have effect := Straight.Effect.lea (before.core memory) destination source
+      rw [State.address_core] at effect
+      simpa [State.core, State.setReg, Core.setReg] using effect
+  | alu _ operation destination source =>
+      refine ⟨memory, represented, ?_⟩
+      have effect := Straight.Effect.alu (before.core memory) operation destination source
+      rw [State.alu_core] at effect
+      simpa [State.core, State.setReg, Core.setReg, Core.readReg] using effect
+  | load _ destination source slot bound address =>
+      refine ⟨memory, represented, ?_⟩
+      have allowed : Memory.rangeAllowed memory.readable (source.eval (before.core memory)) 8 = true := by
+        rw [State.address_core, address]; exact represented.readable slot bound
+      have loaded : memory.read64 (source.eval (before.core memory)) = before.words slot := by
+        rw [State.address_core, address]; exact represented.view slot bound
+      exact
+        Straight.Effect.load (before.core memory) destination source (before.words slot) allowed loaded
+  | store _ destination source slot bound address =>
+      refine ⟨memory.write64 (layout.address slot) (before.registers source), represented.write64 bound _, ?_⟩
+      have allowed : Memory.rangeAllowed memory.writable (destination.eval (before.core memory)) 8 = true := by
+        rw [State.address_core, address]; exact represented.writable slot bound
+      have stored := Straight.Effect.store (before.core memory) destination source allowed
+      rw [State.address_core, address] at stored
+      simpa [State.core, State.setWord, Core.readReg] using stored
+
+theorem Trace.sound {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Straight.Sequence instructions (before.core memory) (after.core nextMemory) := by
+  induction trace generalizing memory with
+  | nil state => exact ⟨memory, represented, .nil _⟩
+  | cons first rest ih =>
+      obtain ⟨middle, middleView, one⟩ := first.sound outside memory represented
+      obtain ⟨finalMemory, finalView, following⟩ := ih middle middleView
+      exact ⟨finalMemory, finalView, .cons one following⟩
+
+theorem Trace.steps {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) (runtime : Runtime) (checked : Checked)
+    (block : BlockId) (offset : Nat) (segment : Straight.Segment checked block offset instructions)
+    (fits : offset + instructions.length < UInt32.size) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked instructions.length (leaf (before.core memory) block offset)
+        (leaf (after.core nextMemory) block (offset + instructions.length)) := by
+  obtain ⟨nextMemory, finalView, sequence⟩ := trace.sound outside memory represented
+  exact ⟨nextMemory, finalView, sequence.steps runtime checked block offset segment fits⟩
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueHeap.lean b/Ix/Compiler/X86/UniqueHeap.lean
new file mode 100644
index 000000000..e2256e9e3
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueHeap.lean
@@ -0,0 +1,238 @@
+import Ix.Compiler.X86.UniqueMacros
+
+/-! Physical cell and resource effects of the selected instruction traces.
+The scalar heads and native tail pointers stay in the byte-memory word view. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+def putCell (words : Words) (index : Nat) (tag head tail : Word) : Words :=
+  (((words.set (cellSlot index 0) tag).set (cellSlot index 1) head).set (cellSlot index 2) tail).set
+    (cellSlot index 3) 0
+
+def allocatedWords (words : Words) (index : Nat) (tag head tail : Word) : Words :=
+  let cells := putCell (words.set Field.cursor.index (words Field.cursor.index + 32)) index tag head tail
+  ((cells.set Field.allocs.index (words Field.allocs.index + 1)).set Field.live.index
+    (words Field.live.index + 1)).set Field.peak.index (words Field.live.index + 1)
+
+def consumedWords (words : Words) (index : Nat) (accumulator : Word) : Words :=
+  (((words.set (cellSlot index 0) consTag).set (cellSlot index 2) accumulator).set Field.reuses.index
+    (words Field.reuses.index + 1)).set Field.payload.index (words Field.payload.index + 2)
+
+def releasedWords (words : Words) (index : Nat) : Words :=
+  ((putCell words index freedTag 0 0).set Field.frees.index (words Field.frees.index + 1)).set
+    Field.live.index (words Field.live.index - 1)
+
+private theorem slot_cases (slot index : Nat) :
+    slot = 0 ∨ slot = 1 ∨ slot = 2 ∨ slot = 3 ∨ slot = 4 ∨ slot = 5 ∨ slot = 6 ∨ slot = 7 ∨
+    slot = 8 ∨ slot = 9 ∨ slot = cellSlot index 0 ∨ slot = cellSlot index 1 ∨
+    slot = cellSlot index 2 ∨ slot = cellSlot index 3 ∨
+    (slot ≠ 0 ∧ slot ≠ 1 ∧ slot ≠ 2 ∧ slot ≠ 3 ∧ slot ≠ 4 ∧ slot ≠ 5 ∧ slot ≠ 6 ∧ slot ≠ 7 ∧
+     slot ≠ 8 ∧ slot ≠ 9 ∧ slot ≠ cellSlot index 0 ∧ slot ≠ cellSlot index 1 ∧
+     slot ≠ cellSlot index 2 ∧ slot ≠ cellSlot index 3) := by omega
+
+/-- The emitter uses an immediate tail for nil and the previous input root for
+cons. The latter register survives the allocation's scratch work. -/
+def allocationTailSafe : MoveSource → Bool
+  | .imm _ => true
+  | .reg register => register == .rdx
+
+theorem allocateState_words (state : State) (layout : Layout) (index : Nat)
+    (tag head : Word) (tail : MoveSource) (destination : GPR) (safe : allocationTailSafe tail = true) :
+    (allocateState state layout index tag head tail destination).words =
+      allocatedWords state.words index tag head (state.move tail) := by
+  cases tail with
+  | reg register =>
+      simp only [allocationTailSafe, beq_iff_eq] at safe
+      subst register
+      funext slot
+      rcases slot_cases slot index with h | h | h | h | h | h | h | h | h | h | h | h | h | h | h <;>
+        (try simp only [cellSlot, headerWords, cellWords, Nat.add_zero] at h) <;>
+        simp (discharger := omega) [allocateState, allocatedWords, putCell, prepareAllocation,
+          writeSourceState, counterState, State.setWord, State.setReg, State.move, State.core,
+          MoveSource.eval, Core.readReg, Registers.set, Words.set, Field.index,
+          AluOp.eval, signExtend32, beq_iff_eq, if_neg, cellSlot, headerWords, cellWords, *] <;> rfl
+  | imm value =>
+      funext slot
+      rcases slot_cases slot index with h | h | h | h | h | h | h | h | h | h | h | h | h | h | h <;>
+        (try simp only [cellSlot, headerWords, cellWords, Nat.add_zero] at h) <;>
+        simp (discharger := omega) [allocateState, allocatedWords, putCell, prepareAllocation,
+          writeSourceState, counterState, State.setWord, State.setReg, State.move,
+          MoveSource.eval, Registers.set, Words.set, Field.index,
+          AluOp.eval, signExtend32, beq_iff_eq, if_neg, cellSlot, headerWords, cellWords, *] <;> rfl
+
+theorem consState_words (state : State) (index : Nat) :
+    (consState state index).words = consumedWords state.words index (state.registers .rsi) := by
+  funext slot
+  rcases slot_cases slot index with h | h | h | h | h | h | h | h | h | h | h | h | h | h | h <;>
+    (try simp only [cellSlot, headerWords, cellWords, Nat.add_zero] at h) <;>
+    simp (discharger := omega) [consState, consumedWords, reserveState, reuseState,
+      writeSourceState, counterState, State.setWord, State.setReg, State.move,
+      MoveSource.eval, Registers.set, Words.set, Field.index,
+      AluOp.eval, signExtend32, beq_iff_eq, if_neg, cellSlot, headerWords, cellWords,
+      UInt64.add_sub_cancel, UInt64.sub_add_cancel, *] <;> rfl
+
+theorem releaseState_words (state : State) (index : Nat) :
+    (releaseState state index).words = releasedWords state.words index := by
+  funext slot
+  rcases slot_cases slot index with h | h | h | h | h | h | h | h | h | h | h | h | h | h | h <;>
+    (try simp only [cellSlot, headerWords, cellWords, Nat.add_zero] at h) <;>
+    simp (discharger := omega) [releaseState, releasedWords, putCell,
+      writeSourceState, counterState, State.setWord, State.setReg, State.move,
+      MoveSource.eval, Words.set, Field.index,
+      AluOp.eval, signExtend32, beq_iff_eq, if_neg, cellSlot, headerWords, cellWords, *] <;> rfl
+
+structure CellAt (words : Words) (index : Nat) (tag head tail : Word) : Prop where
+  tagAt : words (cellSlot index 0) = tag
+  headAt : words (cellSlot index 1) = head
+  tailAt : words (cellSlot index 2) = tail
+  padding : words (cellSlot index 3) = 0
+
+theorem CellAt.mono {before after : Words} {index : Nat} {tag head tail : Word}
+    (cell : CellAt before index tag head tail)
+    (same : ∀ field < 4, after (cellSlot index field) = before (cellSlot index field)) :
+    CellAt after index tag head tail := by
+  exact ⟨(same 0 (by decide)).trans cell.tagAt, (same 1 (by decide)).trans cell.headAt,
+    (same 2 (by decide)).trans cell.tailAt, (same 3 (by decide)).trans cell.padding⟩
+
+theorem CellAt.setHeader {words : Words} {index slot : Nat} {tag head tail : Word}
+    (cell : CellAt words index tag head tail) (bound : slot < headerWords) (value : Word) :
+    CellAt (words.set slot value) index tag head tail := by
+  apply cell.mono
+  intro field fieldBound
+  apply Words.set_other
+  simp only [cellSlot, headerWords, cellWords] at *
+  omega
+
+theorem putCell_at (words : Words) (index : Nat) (tag head tail : Word) :
+    CellAt (putCell words index tag head tail) index tag head tail := by
+  constructor <;> simp [putCell, Words.set, cellSlot]
+
+theorem putCell_other (words : Words) {index other field : Nat} (different : other ≠ index)
+    (fieldBound : field < 4) (tag head tail : Word) :
+    putCell words index tag head tail (cellSlot other field) = words (cellSlot other field) := by
+  simp (discharger := omega) [putCell, Words.set, cellSlot, headerWords, cellWords, if_neg]
+
+theorem allocatedWords_cell (words : Words) (index : Nat) (tag head tail : Word) :
+    CellAt (allocatedWords words index tag head tail) index tag head tail :=
+  (((putCell_at _ _ _ _ _).setHeader (by decide : Field.allocs.index < headerWords) _).setHeader
+    (by decide : Field.live.index < headerWords) _).setHeader (by decide : Field.peak.index < headerWords) _
+
+theorem allocatedWords_other (words : Words) {index other field : Nat} (different : other ≠ index)
+    (fieldBound : field < 4) (tag head tail : Word) :
+    allocatedWords words index tag head tail (cellSlot other field) = words (cellSlot other field) := by
+  simp (discharger := omega) [allocatedWords, putCell, Words.set, cellSlot, headerWords,
+    cellWords, Field.index, if_neg]
+
+theorem consumedWords_cell {words : Words} {index : Nat} {head tail : Word}
+    (cell : CellAt words index consTag head tail) (accumulator : Word) :
+    CellAt (consumedWords words index accumulator) index consTag head accumulator := by
+  obtain ⟨tagAt, headAt, tailAt, padding⟩ := cell
+  simp only [cellSlot, headerWords, cellWords] at headAt padding
+  constructor <;> simp (discharger := omega) [consumedWords, Words.set, cellSlot, headerWords,
+    cellWords, Field.index, if_neg, *]
+
+theorem consumedWords_other (words : Words) {index other field : Nat} (different : other ≠ index)
+    (fieldBound : field < 4) (accumulator : Word) :
+    consumedWords words index accumulator (cellSlot other field) = words (cellSlot other field) := by
+  simp (discharger := omega) [consumedWords, Words.set, cellSlot, headerWords, cellWords, Field.index, if_neg]
+
+theorem releasedWords_cell (words : Words) (index : Nat) :
+    CellAt (releasedWords words index) index freedTag 0 0 :=
+  ((putCell_at _ _ _ _ _).setHeader (by decide : Field.frees.index < headerWords) _).setHeader
+    (by decide : Field.live.index < headerWords) _
+
+theorem releasedWords_other (words : Words) {index other field : Nat} (different : other ≠ index)
+    (fieldBound : field < 4) :
+    releasedWords words index (cellSlot other field) = words (cellSlot other field) := by
+  simp (discharger := omega) [releasedWords, putCell, Words.set, cellSlot, headerWords, cellWords, Field.index, if_neg]
+
+structure Counts where
+  allocs : Nat := 0
+  frees : Nat := 0
+  reuses : Nat := 0
+  live : Nat := 0
+  peak : Nat := 0
+  payload : Nat := 0
+  deriving Repr, BEq, DecidableEq
+
+def Counts.allocate (counts : Counts) : Counts :=
+  { counts with allocs := counts.allocs + 1, live := counts.live + 1, peak := counts.live + 1 }
+def Counts.consume (counts : Counts) : Counts :=
+  { counts with reuses := counts.reuses + 1, payload := counts.payload + 2 }
+def Counts.release (counts : Counts) : Counts :=
+  { counts with frees := counts.frees + 1, live := counts.live - 1 }
+
+structure CountsAt (layout : Layout) (counts : Counts) (words : Words) : Prop where
+  cursor : words 0 = UInt64.ofNat (cellBytes * counts.allocs)
+  capacity : words 1 = UInt64.ofNat (cellBytes * layout.capacity)
+  allocs : words 2 = UInt64.ofNat counts.allocs
+  frees : words 3 = UInt64.ofNat counts.frees
+  reuses : words 4 = UInt64.ofNat counts.reuses
+  live : words 5 = UInt64.ofNat counts.live
+  peak : words 6 = UInt64.ofNat counts.peak
+  rcops : words 7 = 0
+  payload : words 8 = UInt64.ofNat counts.payload
+  reservations : words 9 = 0
+
+theorem CountsAt.initial (layout : Layout) : CountsAt layout {} (initialWords layout) := by
+  constructor <;> rfl
+
+theorem CountsAt.allocate {layout : Layout} {counts : Counts} {words : Words}
+    (before : CountsAt layout counts words) (index : Nat) (tag head tail : Word) :
+    CountsAt layout counts.allocate (allocatedWords words index tag head tail) := by
+  obtain ⟨cursor, capacity, allocs, frees, reuses, live, peak, rcops, payload, reservations⟩ := before
+  constructor <;>
+    simp (discharger := omega) [allocatedWords, putCell, Words.set, cellSlot, headerWords, cellWords,
+      Field.index, Counts.allocate, if_neg, cellBytes, UInt64.ofNat_add, Nat.mul_add, *] <;> rfl
+
+theorem CountsAt.consume {layout : Layout} {counts : Counts} {words : Words}
+    (before : CountsAt layout counts words) (index : Nat) (accumulator : Word) :
+    CountsAt layout counts.consume (consumedWords words index accumulator) := by
+  obtain ⟨cursor, capacity, allocs, frees, reuses, live, peak, rcops, payload, reservations⟩ := before
+  constructor <;>
+    simp (discharger := omega) [consumedWords, Words.set, cellSlot, headerWords, cellWords,
+      Field.index, Counts.consume, if_neg, UInt64.ofNat_add, *] <;> rfl
+
+theorem CountsAt.release {layout : Layout} {counts : Counts} {words : Words}
+    (before : CountsAt layout counts words) (index : Nat) (positive : 0 < counts.live) :
+    CountsAt layout counts.release (releasedWords words index) := by
+  obtain ⟨cursor, capacity, allocs, frees, reuses, live, peak, rcops, payload, reservations⟩ := before
+  constructor <;>
+    simp (discharger := omega) [releasedWords, putCell, Words.set, cellSlot, headerWords, cellWords,
+      Field.index, Counts.release, if_neg, UInt64.ofNat_add, UInt64.ofNat_sub, *] <;> rfl
+
+@[simp] theorem consState_rdi (state : State) (index : Nat) :
+    (consState state index).registers .rdi = state.registers .rdi := by
+  simp [consState, reserveState, reuseState]
+@[simp] theorem consState_rsi (state : State) (index : Nat) :
+    (consState state index).registers .rsi = state.registers .rdx := by
+  simp [consState, reserveState, reuseState]
+@[simp] theorem consState_rdx (state : State) (index : Nat) :
+    (consState state index).registers .rdx = state.words (cellSlot index 2) := by
+  simp [consState, reserveState, reuseState]
+
+@[simp] theorem releaseState_rdi (state : State) (index : Nat) :
+    (releaseState state index).registers .rdi = state.registers .rdi := by
+  simp [releaseState]
+@[simp] theorem releaseState_rsi (state : State) (index : Nat) :
+    (releaseState state index).registers .rsi = state.registers .rsi := by
+  simp [releaseState]
+@[simp] theorem releaseState_rdx (state : State) (index : Nat) :
+    (releaseState state index).registers .rdx = state.registers .rdx := by
+  simp [releaseState]
+
+theorem allocateState_destination (state : State) (layout : Layout) (index : Nat)
+    (tag head : Word) (tail : MoveSource) (destination : GPR) :
+    (allocateState state layout index tag head tail destination).registers destination = layout.cell index := by
+  simp [allocateState]
+
+theorem allocateState_other (state : State) (layout : Layout) (index : Nat)
+    (tag head : Word) (tail : MoveSource) (destination register : GPR)
+    (other : register ≠ destination) (notRax : register ≠ .rax) (notRcx : register ≠ .rcx)
+    (notR11 : register ≠ .r11) :
+    (allocateState state layout index tag head tail destination).registers register = state.registers register := by
+  simp [allocateState, other, notRax, notRcx, notR11]
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueInvariant.lean b/Ix/Compiler/X86/UniqueInvariant.lean
new file mode 100644
index 000000000..e05b79a9b
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueInvariant.lean
@@ -0,0 +1,207 @@
+import Ix.Compiler.X86.UniqueHeap
+
+/-! The two owned native chains occupy disjoint index intervals. The input
+chain runs down to cell zero; the accumulator runs up to its allocated nil.
+No external root or caller-supplied heap shape is assumed at source entry. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+def DownChain (layout : Layout) (words : Words) : List Word → Prop
+  | [] => CellAt words 0 nilTag 0 0
+  | head :: tail => CellAt words (tail.length + 1) consTag head (layout.cell tail.length) ∧
+      DownChain layout words tail
+
+def UpChain (layout : Layout) (words : Words) (start : Nat) : List Word → Prop
+  | [] => CellAt words start nilTag 0 0
+  | head :: tail => CellAt words start consTag head (layout.cell (start + 1)) ∧
+      UpChain layout words (start + 1) tail
+
+theorem DownChain.mono {layout : Layout} {before after : Words} {values : List Word}
+    (chain : DownChain layout before values)
+    (same : ∀ index ≤ values.length, ∀ field < 4,
+      after (cellSlot index field) = before (cellSlot index field)) : DownChain layout after values := by
+  induction values with
+  | nil => exact CellAt.mono chain (same 0 (by simp))
+  | cons head tail ih =>
+      exact ⟨chain.1.mono (same (tail.length + 1) (by simp)),
+        ih chain.2 (fun index bound field fieldBound => same index (by simp; omega) field fieldBound)⟩
+
+theorem UpChain.mono {layout : Layout} {before after : Words} {values : List Word} {start : Nat}
+    (chain : UpChain layout before start values)
+    (same : ∀ index, start ≤ index → index ≤ start + values.length → ∀ field < 4,
+      after (cellSlot index field) = before (cellSlot index field)) : UpChain layout after start values := by
+  induction values generalizing start with
+  | nil => exact CellAt.mono chain (same start (by omega) (by simp))
+  | cons head tail ih =>
+      exact ⟨chain.1.mono (same start (by omega) (by simp)),
+        ih chain.2 (fun index lower upper field fieldBound =>
+          same index (by omega) (by simp only [List.length_cons]; omega) field fieldBound)⟩
+
+/-- One destructive transfer preserves the two disjoint finite chains. -/
+theorem chains_cons {layout : Layout} {words : Words} {head : Word} {tail acc : List Word}
+    (input : DownChain layout words (head :: tail))
+    (accumulator : UpChain layout words (tail.length + 2) acc) :
+    let after := consumedWords words (tail.length + 1) (layout.cell (tail.length + 2))
+    DownChain layout after tail ∧ UpChain layout after (tail.length + 1) (head :: acc) := by
+  refine ⟨input.2.mono ?_, consumedWords_cell input.1 _, ?_⟩
+  · intro index bound field fieldBound
+    exact consumedWords_other words (by omega) fieldBound _
+  · apply accumulator.mono
+    intro index lower upper field fieldBound
+    exact consumedWords_other words (by omega) fieldBound _
+
+def Saved : GPR → Bool
+  | .rbx | .rbp | .rsp | .r12 | .r13 | .r14 | .r15 => true
+  | _ => false
+
+def PreservesSaved (before after : State) : Prop :=
+  ∀ register, Saved register = true → after.registers register = before.registers register
+
+theorem PreservesSaved.refl (state : State) : PreservesSaved state state := fun _ _ => rfl
+
+theorem PreservesSaved.trans {before middle after : State}
+    (first : PreservesSaved before middle) (second : PreservesSaved middle after) : PreservesSaved before after :=
+  fun register saved => (second register saved).trans (first register saved)
+
+theorem PreservesSaved.setReg (state : State) (register : GPR) (value : Word) (allowed : Saved register = false) :
+    PreservesSaved state (state.setReg register value) := by
+  intro candidate saved
+  have different : candidate ≠ register := by
+    intro same
+    rw [same, allowed] at saved
+    contradiction
+  simp [different]
+
+theorem PreservesSaved.core {before after : State} (preserved : PreservesSaved before after)
+    (beforeMemory afterMemory : Memory) :
+    (after.core afterMemory).readReg .rsp = (before.core beforeMemory).readReg .rsp ∧
+    (after.core afterMemory).calleeSavedSnapshot = (before.core beforeMemory).calleeSavedSnapshot := by
+  constructor
+  · exact preserved .rsp rfl
+  · simp [Core.calleeSavedSnapshot, SysV.calleeSaved, Core.readReg, State.core,
+      preserved .rbx rfl, preserved .rbp rfl, preserved .r12 rfl, preserved .r13 rfl,
+      preserved .r14 rfl, preserved .r15 rfl]
+
+theorem allocateState_saved (state : State) (layout : Layout) (index : Nat)
+    (tag head : Word) (tail : MoveSource) (destination : GPR) (allowed : Saved destination = false) :
+    PreservesSaved state (allocateState state layout index tag head tail destination) := by
+  intro register saved
+  apply allocateState_other
+  · intro same; rw [same, allowed] at saved; contradiction
+  · intro same; subst register; contradiction
+  · intro same; subst register; contradiction
+  · intro same; subst register; contradiction
+
+theorem consState_saved (state : State) (index : Nat) : PreservesSaved state (consState state index) := by
+  intro register saved
+  cases register <;> simp [Saved] at saved <;> simp [consState, reuseState, reserveState]
+
+theorem releaseState_saved (state : State) (index : Nat) : PreservesSaved state (releaseState state index) := by
+  intro register saved
+  cases register <;> simp [Saved] at saved <;> simp [releaseState]
+
+def readyCounts (count : Nat) : Counts := { allocs := count, live := count, peak := count }
+
+@[simp] theorem readyCounts_allocate (count : Nat) : (readyCounts count).allocate = readyCounts (count + 1) := rfl
+
+def inputPrefix (values : List Word) : List Instr :=
+  allocate nilTag 0 (.imm 0) .rdx ++ inputCons values.reverse
+
+theorem inputCons_append (left right : List Word) : inputCons (left ++ right) = inputCons left ++ inputCons right := by
+  induction left with
+  | nil => rfl
+  | cons head tail ih => simp [inputCons, ih, List.append_assoc]
+
+theorem inputPrefix_cons (head : Word) (tail : List Word) :
+    inputPrefix (head :: tail) = inputPrefix tail ++ allocate consTag head (.reg .rdx) .rdx := by
+  simp [inputPrefix, List.reverse_cons, inputCons_append, inputCons, List.append_assoc]
+
+structure InputResult (layout : Layout) (values : List Word) (before after : State) : Prop where
+  chain : DownChain layout after.words values
+  counts : CountsAt layout (readyCounts (values.length + 1)) after.words
+  root : after.registers .rdx = layout.cell values.length
+  context : after.registers .rdi = layout.base
+  saved : PreservesSaved before after
+
+theorem inputTrace (layout : Layout) (values : List Word) (state : State)
+    (capacity : values.length + 1 ≤ layout.capacity) (context : state.registers .rdi = layout.base)
+    (initial : state.words = initialWords layout) :
+    ∃ after, Trace layout (inputPrefix values) state after ∧ InputResult layout values state after := by
+  induction values with
+  | nil =>
+      let after := allocateState state layout 0 nilTag 0 (.imm 0) .rdx
+      have first := allocateTrace layout state 0 nilTag 0 (.imm 0) .rdx (by simp at capacity; omega) context
+        (by simp [initial, initialWords, Field.index, Words.set])
+      have words : after.words = allocatedWords state.words 0 nilTag 0 0 := by
+        simpa [after] using allocateState_words state layout 0 nilTag 0 (.imm 0) .rdx rfl
+      have counts : CountsAt layout {} state.words := initial ▸ CountsAt.initial layout
+      refine ⟨after, by simpa [inputPrefix, inputCons, after] using first, ?_⟩
+      refine ⟨?_, ?_, allocateState_destination state layout 0 nilTag 0 (.imm 0) .rdx, ?_,
+        allocateState_saved state layout 0 nilTag 0 (.imm 0) .rdx rfl⟩
+      · change CellAt after.words 0 nilTag 0 0
+        rw [words]
+        exact allocatedWords_cell _ _ _ _ _
+      · rw [words]
+        exact counts.allocate 0 nilTag 0 0
+      · exact (allocateState_other state layout 0 nilTag 0 (.imm 0) .rdx .rdi
+          (by decide) (by decide) (by decide) (by decide)).trans context
+  | cons head tail ih =>
+      obtain ⟨middle, first, result⟩ := ih (by simp only [List.length_cons] at capacity; omega)
+      let after := allocateState middle layout (tail.length + 1) consTag head (.reg .rdx) .rdx
+      have cursor : middle.words Field.cursor.index = UInt64.ofNat (cellBytes * (tail.length + 1)) :=
+        result.counts.cursor
+      have last := allocateTrace layout middle (tail.length + 1) consTag head (.reg .rdx) .rdx
+        (by simp only [List.length_cons] at capacity; omega) result.context cursor
+      have words : after.words = allocatedWords middle.words (tail.length + 1) consTag head (layout.cell tail.length) := by
+        simpa [after, result.root] using allocateState_words middle layout (tail.length + 1) consTag head (.reg .rdx) .rdx rfl
+      refine ⟨after, by rw [inputPrefix_cons]; exact first.append last, ?_⟩
+      refine ⟨?_, ?_, allocateState_destination middle layout (tail.length + 1) consTag head (.reg .rdx) .rdx, ?_,
+        result.saved.trans (allocateState_saved middle layout (tail.length + 1) consTag head (.reg .rdx) .rdx rfl)⟩
+      · rw [words]
+        refine ⟨allocatedWords_cell _ _ _ _ _, result.chain.mono ?_⟩
+        intro index bound field fieldBound
+        exact allocatedWords_other middle.words (by omega) fieldBound _ _ _
+      · rw [words]
+        simpa using result.counts.allocate (tail.length + 1) consTag head (layout.cell tail.length)
+      · exact (allocateState_other middle layout (tail.length + 1) consTag head (.reg .rdx) .rdx .rdi
+          (by decide) (by decide) (by decide) (by decide)).trans result.context
+
+structure Initialized (layout : Layout) (values : List Word) (before after : State) : Prop where
+  input : DownChain layout after.words values
+  accumulator : UpChain layout after.words (values.length + 1) []
+  counts : CountsAt layout (readyCounts (values.length + 2)) after.words
+  inputRoot : after.registers .rdx = layout.cell values.length
+  accRoot : after.registers .rsi = layout.cell (values.length + 1)
+  context : after.registers .rdi = layout.base
+  saved : PreservesSaved before after
+
+theorem initializeTrace (layout : Layout) (values : List Word) (state : State)
+    (capacity : values.length + 2 ≤ layout.capacity) (context : state.registers .rdi = layout.base)
+    (initial : state.words = initialWords layout) :
+    ∃ after, Trace layout (inputInstructions values) state after ∧ Initialized layout values state after := by
+  obtain ⟨middle, first, result⟩ := inputTrace layout values state (by omega) context initial
+  let after := allocateState middle layout (values.length + 1) nilTag 0 (.imm 0) .rsi
+  have last := allocateTrace layout middle (values.length + 1) nilTag 0 (.imm 0) .rsi
+    (by omega) result.context result.counts.cursor
+  have words : after.words = allocatedWords middle.words (values.length + 1) nilTag 0 0 := by
+    simpa [after] using allocateState_words middle layout (values.length + 1) nilTag 0 (.imm 0) .rsi rfl
+  refine ⟨after, first.append last, ?_⟩
+  refine ⟨?_, ?_, ?_, ?_, allocateState_destination middle layout (values.length + 1) nilTag 0 (.imm 0) .rsi, ?_,
+    result.saved.trans (allocateState_saved middle layout (values.length + 1) nilTag 0 (.imm 0) .rsi rfl)⟩
+  · rw [words]
+    apply result.chain.mono
+    intro index bound field fieldBound
+    exact allocatedWords_other middle.words (by omega) fieldBound _ _ _
+  · change CellAt after.words (values.length + 1) nilTag 0 0
+    rw [words]
+    exact allocatedWords_cell _ _ _ _ _
+  · rw [words]
+    simpa [Nat.add_assoc] using result.counts.allocate (values.length + 1) nilTag 0 0
+  · exact (allocateState_other middle layout (values.length + 1) nilTag 0 (.imm 0) .rsi .rdx
+      (by decide) (by decide) (by decide) (by decide)).trans result.root
+  · exact (allocateState_other middle layout (values.length + 1) nilTag 0 (.imm 0) .rsi .rdi
+      (by decide) (by decide) (by decide) (by decide)).trans result.context
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueLoop.lean b/Ix/Compiler/X86/UniqueLoop.lean
new file mode 100644
index 000000000..2a508c74b
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueLoop.lean
@@ -0,0 +1,158 @@
+import Ix.Compiler.X86.UniqueControl
+
+/-! The complete destructive reversal loop, including its selected branches.
+The descending input and ascending accumulator remain disjoint, and every
+step is a step of the existing typed x86 evaluator. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+def Counts.finish (counts : Counts) (length : Nat) : Counts :=
+  { counts.release with reuses := counts.reuses + length, payload := counts.payload + 2 * length }
+
+@[simp] theorem Counts.finish_zero (counts : Counts) : counts.finish 0 = counts.release := by
+  cases counts
+  simp [Counts.finish, Counts.release]
+
+@[simp] theorem Counts.finish_consume (counts : Counts) (length : Nat) :
+    counts.consume.finish length = counts.finish (length + 1) := by
+  cases counts
+  simp [Counts.finish, Counts.release, Counts.consume, Nat.mul_add, Nat.add_assoc,
+    Nat.add_comm, Nat.add_left_comm]
+
+structure LoopInvariant (layout : Layout) (values acc : List Word) (counts : Counts) (state : State) : Prop where
+  input : DownChain layout state.words values
+  accumulator : UpChain layout state.words (values.length + 1) acc
+  countsAt : CountsAt layout counts state.words
+  inputRoot : state.registers .rdx = layout.cell values.length
+  accRoot : state.registers .rsi = layout.cell (values.length + 1)
+  context : state.registers .rdi = layout.base
+
+structure LoopResult (layout : Layout) (values : List Word) (counts : Counts) (before after : State) : Prop where
+  chain : UpChain layout after.words 1 values
+  countsAt : CountsAt layout counts after.words
+  freedNil : CellAt after.words 0 freedTag 0 0
+  result : after.registers .rax = layout.cell 1
+  root : after.registers .rsi = layout.cell 1
+  context : after.registers .rdi = layout.base
+  saved : PreservesSaved before after
+
+theorem loopStepsFor (layout : Layout) (values acc : List Word) (counts : Counts) (state : State)
+    (invariant : LoopInvariant layout values acc counts state)
+    (capacity : values.length + acc.length + 2 ≤ layout.capacity) (positive : 0 < counts.live)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory)
+    (runtime : Runtime) (checked : Checked) (body : List Instr) (code : LoopCode checked body)
+    (bodyTrace : ∀ (state : State) (index : Nat), index < layout.capacity →
+      state.registers .rdi = layout.base → state.registers .rdx = layout.cell index →
+      Trace layout body state (consState state index)) :
+    ∃ after nextMemory, LoopResult layout (values.reverse ++ acc) (counts.finish values.length) state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked ((body.length + 3) * values.length + 16) (leaf (state.core memory) 3 0)
+        (haltedLeaf (after.core nextMemory) 4 13) := by
+  induction values generalizing acc counts state memory with
+  | nil =>
+      let tagged := tagState state 0
+      have load := tagTrace layout state .rdx 0 (by simp at capacity; omega) invariant.inputRoot
+      have tested := tagState_test state 0 nilTag invariant.input.tagAt
+      obtain ⟨tagMemory, tagView, dispatch⟩ := load.branch outside memory represented runtime checked 3 4 5
+        tagCompare .eq code.tag true tested code.hasFinish
+      let after := (releaseState tagged 0).setReg .rax (state.registers .rsi)
+      have released := releaseTrace layout tagged .rdx 0 (by simp at capacity; omega)
+        (by simpa [tagged, tagState] using invariant.context)
+        (by simpa [tagged, tagState] using invariant.inputRoot) (by decide)
+      have move : Trace layout [Instr.mov .w64 .rax (.reg .rsi)] (releaseState tagged 0) after := by
+        refine .cons (.mov _ _ _) ?_
+        simpa [after, tagged, tagState] using Trace.nil (layout := layout) after
+      obtain ⟨nextMemory, finalView, finish⟩ := (released.append move).ret outside tagMemory tagView
+        runtime checked 4 code.finish
+      have words : after.words = releasedWords state.words 0 := by
+        simp [after, releaseState_words, tagged, tagState]
+      refine ⟨after, nextMemory, ?_, finalView, ?_⟩
+      · refine ⟨?_, ?_, ?_, ?_, ?_, ?_, ?_⟩
+        · simp only [List.reverse_nil, List.nil_append]
+          rw [words]
+          apply invariant.accumulator.mono
+          intro index lower upper field fieldBound
+          exact releasedWords_other state.words (by simp at lower; omega) fieldBound
+        · rw [words]
+          simpa using invariant.countsAt.release 0 positive
+        · rw [words]
+          exact releasedWords_cell state.words 0
+        · simpa [after] using invariant.accRoot
+        · simpa [after, tagged, tagState] using invariant.accRoot
+        · simpa [after, tagged, tagState] using invariant.context
+        · exact ((PreservesSaved.setReg state .rcx _ rfl).trans (releaseState_saved tagged 0)).trans
+            (PreservesSaved.setReg _ .rax _ rfl)
+      · exact dispatch.append finish
+  | cons head tail ih =>
+      let index := tail.length + 1
+      let tagged := tagState state index
+      have indexBound : index < layout.capacity := by simp only [List.length_cons] at capacity; omega
+      have load := tagTrace layout state .rdx index indexBound invariant.inputRoot
+      have tested := tagState_test state index consTag invariant.input.1.tagAt
+      obtain ⟨tagMemory, tagView, dispatch⟩ := load.branch outside memory represented runtime checked 3 4 5
+        tagCompare .eq code.tag false tested code.hasCons
+      let next := consState tagged index
+      have consume := bodyTrace tagged index indexBound
+        (by simpa [tagged, tagState] using invariant.context)
+        (by simpa [tagged, tagState] using invariant.inputRoot)
+      obtain ⟨consumeMemory, consumeView, consumed⟩ := consume.jump outside tagMemory tagView runtime checked 5 3
+        code.cons code.hasTag
+      have words : next.words = consumedWords state.words index (layout.cell (tail.length + 2)) := by
+        simp [next, consState_words, tagged, tagState, invariant.accRoot, Nat.add_assoc]
+      have chains := chains_cons invariant.input invariant.accumulator
+      have nextInvariant : LoopInvariant layout tail (head :: acc) counts.consume next := by
+        refine ⟨?_, ?_, ?_, ?_, ?_, ?_⟩
+        · rw [words]
+          exact chains.1
+        · rw [words]
+          exact chains.2
+        · rw [words]
+          exact invariant.countsAt.consume index _
+        · simpa [next, tagged, tagState, index] using invariant.input.1.tailAt
+        · simpa [next, tagged, tagState] using invariant.inputRoot
+        · simpa [next, tagged, tagState] using invariant.context
+      obtain ⟨after, nextMemory, result, finalView, rest⟩ := ih (head :: acc) counts.consume next nextInvariant
+        (by simp only [List.length_cons] at *; omega) positive consumeMemory consumeView
+      refine ⟨after, nextMemory, ?_, finalView, ?_⟩
+      · have saved : PreservesSaved state after :=
+          ((PreservesSaved.setReg state .rcx _ rfl).trans (consState_saved tagged index)).trans result.saved
+        have valueEq : tail.reverse ++ head :: acc = (head :: tail).reverse ++ acc := by
+          simp [List.reverse_cons, List.append_assoc]
+        rw [valueEq, Counts.finish_consume] at result
+        exact { result with saved }
+      · have all := dispatch.append (consumed.append rest)
+        have cost : (tagInstructions .rdx).length + 1 +
+            (body.length + 1 + ((body.length + 3) * tail.length + 16)) =
+            (body.length + 3) * (head :: tail).length + 16 := by
+          simp only [tagInstructions, List.length_cons, List.length_nil, Nat.mul_add, Nat.mul_one]
+          omega
+        rw [cost] at all
+        exact all
+
+theorem loopStepsWith (layout : Layout) (values acc : List Word) (counts : Counts) (state : State)
+    (invariant : LoopInvariant layout values acc counts state)
+    (capacity : values.length + acc.length + 2 ≤ layout.capacity) (positive : 0 < counts.live)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory)
+    (runtime : Runtime) (checked : Checked) (code : LoopCode checked) :
+    ∃ after nextMemory, LoopResult layout (values.reverse ++ acc) (counts.finish values.length) state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (31 * values.length + 16) (leaf (state.core memory) 3 0)
+        (haltedLeaf (after.core nextMemory) 4 13) :=
+  loopStepsFor layout values acc counts state invariant capacity positive outside memory represented
+    runtime checked consInstructions code (consTrace layout)
+
+theorem loopSteps (layout : Layout) (emitted values acc : List Word) (counts : Counts) (state : State)
+    (invariant : LoopInvariant layout values acc counts state)
+    (capacity : values.length + acc.length + 2 ≤ layout.capacity) (positive : 0 < counts.live)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory)
+    (runtime : Runtime) (checked : Checked) (produced : checked.program = program emitted) :
+    ∃ after nextMemory, LoopResult layout (values.reverse ++ acc) (counts.finish values.length) state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (31 * values.length + 16) (leaf (state.core memory) 3 0)
+        (haltedLeaf (after.core nextMemory) 4 13) :=
+  loopStepsWith layout values acc counts state invariant capacity positive outside memory represented
+    runtime checked (main_loopCode emitted checked produced)
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueMacros.lean b/Ix/Compiler/X86/UniqueMacros.lean
new file mode 100644
index 000000000..c43e090fc
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueMacros.lean
@@ -0,0 +1,325 @@
+import Ix.Compiler.X86.UniqueExecution
+
+/-! Instruction selection lemmas for arena allocation, reservation, reuse,
+and release. The traces retain every selected load, store, and counter update. -/
+
+namespace Ix.Compiler.X86.UniqueABI
+
+
+theorem Layout.field_bound (layout : Layout) (field : Field) : field.index < layout.slots := by
+  have := field.index_lt
+  simp only [Layout.slots] at *
+  omega
+
+theorem Layout.cell_field_bound (layout : Layout) {index field : Nat}
+    (indexBound : index < layout.capacity) (fieldBound : field < cellWords) :
+    cellSlot index field < layout.slots := by
+  simp only [cellSlot, Layout.slots, cellWords] at *
+  omega
+
+theorem Layout.cell_offset (layout : Layout) (index field : Nat) :
+    layout.cell index + UInt64.ofNat (8 * field) = layout.address (cellSlot index field) := by
+  simp [Layout.cell, Layout.address, cellSlot, Nat.mul_add, UInt64.ofNat_add, UInt64.add_assoc]
+
+theorem Layout.allocate_address (layout : Layout) (index : Nat) :
+    layout.base + UInt64.ofNat (cellBytes * index) + 80 = layout.cell index := by
+  simp [Layout.cell, Layout.address, cellSlot, headerWords, cellWords, cellBytes,
+    Nat.mul_add, ← Nat.mul_assoc, UInt64.ofNat_add,
+    UInt64.add_comm, word_add_left_comm]
+
+end Ix.Compiler.X86.UniqueABI
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+theorem operand_address (state : State) (register : GPR) (offset : Nat)
+    (small : offset < 0x80000000) :
+    state.address (memoryOperand register offset) = state.registers register + UInt64.ofNat offset := by
+  have small32 : UInt32.ofNat offset < 0x80000000 := by
+    change (UInt32.ofNat offset).toNat < 2147483648
+    rw [UInt32.toNat_ofNat_of_lt' (by change offset < 4294967296; omega)]
+    exact small
+  have widened : (UInt32.ofNat offset).toUInt64 = UInt64.ofNat offset := by
+    apply UInt64.toNat_inj.mp
+    simp only [UInt32.toNat_toUInt64, UInt32.toNat_ofNat', UInt64.toNat_ofNat']
+    omega
+  simp [State.address, State.core, MemAddr.eval, Core.readReg, memoryOperand, signExtend32, small32, widened]
+
+theorem header_address (state : State) (layout : Layout) (field : Field)
+    (context : state.registers .rdi = layout.base) :
+    state.address (header field) = layout.address field.index := by
+  rw [header, operand_address _ _ _ (by have := field.index_lt; change field.index < 10 at this; omega), context]
+  rfl
+
+@[simp] theorem State.setReg_registers (state : State) (register candidate : GPR) (value : Word) :
+    (state.setReg register value).registers candidate =
+      if candidate == register then value else state.registers candidate := rfl
+@[simp] theorem State.setWord_registers (state : State) (slot : Nat) (value : Word) :
+    (state.setWord slot value).registers = state.registers := rfl
+@[simp] theorem State.setReg_words (state : State) (register : GPR) (value : Word) :
+    (state.setReg register value).words = state.words := rfl
+@[simp] theorem State.setWord_words (state : State) (slot : Nat) (value : Word) :
+    (state.setWord slot value).words = state.words.set slot value := rfl
+@[simp] theorem State.move_imm (state : State) (value : Word) : state.move (.imm value) = value := rfl
+@[simp] theorem State.move_reg (state : State) (register : GPR) :
+    state.move (.reg register) = state.registers register := rfl
+@[simp] theorem State.alu_imm (state : State) (value : Imm32) :
+    state.alu (.imm value) = signExtend32 value := rfl
+@[simp] theorem State.alu_reg (state : State) (register : GPR) :
+    state.alu (.reg register) = state.registers register := rfl
+
+@[simp] theorem State.setReg_setReg (state : State) (register : GPR) (first second : Word) :
+    (state.setReg register first).setReg register second = state.setReg register second := by
+  simp [State.setReg]
+
+def counterState (state : State) (field : Field) (operation : AluOp) (amount : Imm32) : State :=
+  let value := operation.eval (state.words field.index) (signExtend32 amount)
+  (state.setReg .r11 value).setWord field.index value
+
+theorem counterTrace (layout : Layout) (state : State) (field : Field) (operation : AluOp) (amount : Imm32)
+    (context : state.registers .rdi = layout.base) :
+    Trace layout (changeCounter field operation amount) state (counterState state field operation amount) := by
+  refine .cons (.load _ _ _ field.index (layout.field_bound field) (header_address state layout field context)) ?_
+  refine .cons (.alu _ _ _ _) ?_
+  refine .cons (.store _ _ _ field.index (layout.field_bound field) ?_) ?_
+  · apply header_address
+    simpa using context
+  · simpa [counterState] using
+      (Trace.nil (layout := layout)
+        (((state.setReg .r11 (state.words field.index)).setReg .r11
+          (operation.eval (state.words field.index) (signExtend32 amount))).setWord field.index
+            (operation.eval (state.words field.index) (signExtend32 amount))))
+
+@[simp] theorem counterState_registers (state : State) (field : Field) (operation : AluOp)
+    (amount : Imm32) (register : GPR) :
+    (counterState state field operation amount).registers register =
+      if register == .r11 then operation.eval (state.words field.index) (signExtend32 amount)
+      else state.registers register := rfl
+
+theorem field_address (layout : Layout) (state : State) (pointer : GPR) (index field : Nat)
+    (fieldBound : field < cellWords) (atCell : state.registers pointer = layout.cell index) :
+    state.address (memoryOperand pointer (8 * field)) = layout.address (cellSlot index field) := by
+  rw [operand_address _ _ _ (by change field < 4 at fieldBound; omega), atCell, layout.cell_offset]
+
+theorem loadField (layout : Layout) (state : State) (pointer destination : GPR) (index field : Nat)
+    (indexBound : index < layout.capacity) (fieldBound : field < cellWords)
+    (atCell : state.registers pointer = layout.cell index) :
+    Effect layout (.load .w64 destination (memoryOperand pointer (8 * field))) state
+      (state.setReg destination (state.words (cellSlot index field))) :=
+  .load _ _ _ _ (layout.cell_field_bound indexBound fieldBound)
+    (field_address layout state pointer index field fieldBound atCell)
+
+theorem storeField (layout : Layout) (state : State) (pointer source : GPR) (index field : Nat)
+    (indexBound : index < layout.capacity) (fieldBound : field < cellWords)
+    (atCell : state.registers pointer = layout.cell index) :
+    Effect layout (.store .w64 (memoryOperand pointer (8 * field)) source) state
+      (state.setWord (cellSlot index field) (state.registers source)) :=
+  .store _ _ _ _ (layout.cell_field_bound indexBound fieldBound)
+    (field_address layout state pointer index field fieldBound atCell)
+
+def writeSourceState (state : State) (slot : Nat) (source : MoveSource) : State :=
+  (state.setReg .rcx (state.move source)).setWord slot (state.move source)
+
+@[simp] theorem writeSourceState_registers (state : State) (slot : Nat) (source : MoveSource) (register : GPR) :
+    (writeSourceState state slot source).registers register =
+      if register == .rcx then state.move source else state.registers register := rfl
+
+theorem writeSourceTrace (layout : Layout) (state : State) (pointer : GPR) (index field : Nat)
+    (source : MoveSource) (indexBound : index < layout.capacity) (fieldBound : field < cellWords)
+    (atCell : state.registers pointer = layout.cell index) (notScratch : pointer ≠ .rcx) :
+    Trace layout [.mov .w64 .rcx source, .store .w64 (memoryOperand pointer (8 * field)) .rcx]
+      state (writeSourceState state (cellSlot index field) source) := by
+  refine .cons (.mov _ _ _) (.cons (storeField layout _ pointer .rcx index field indexBound fieldBound ?_) ?_)
+  · simpa [notScratch] using atCell
+  · simpa [writeSourceState] using
+      (Trace.nil (layout := layout) ((state.setReg .rcx (state.move source)).setWord
+        (cellSlot index field) (state.move source)))
+
+def prepareAllocation (state : State) (layout : Layout) (index : Nat) : State :=
+  ((state.setReg .rax (layout.cell index)).setReg .r11 (state.words Field.cursor.index + 32)).setWord
+    Field.cursor.index (state.words Field.cursor.index + 32)
+
+@[simp] theorem prepareAllocation_registers (state : State) (layout : Layout) (index : Nat) (register : GPR) :
+    (prepareAllocation state layout index).registers register =
+      if register == .r11 then state.words Field.cursor.index + 32
+      else if register == .rax then layout.cell index else state.registers register := rfl
+
+theorem prepareAllocationTrace (layout : Layout) (state : State) (index : Nat)
+    (context : state.registers .rdi = layout.base)
+    (cursor : state.words Field.cursor.index = UInt64.ofNat (cellBytes * index)) :
+    Trace layout
+      [.load .w64 .rax (header .cursor), .lea .r11 (memoryOperand .rax cellBytes),
+       .store .w64 (header .cursor) .r11,
+       .lea .rax { base := some .rdi, index := some .rax, displacement := 80 }]
+      state (prepareAllocation state layout index) := by
+  refine .cons (.load _ _ _ Field.cursor.index (layout.field_bound .cursor)
+    (header_address state layout .cursor context)) (.cons (.lea _ _ _) ?_)
+  refine .cons (.store _ _ _ Field.cursor.index (layout.field_bound .cursor) ?_) (.cons (.lea _ _ _) ?_)
+  · apply header_address
+    simpa using context
+  · have bump : (state.setReg .rax (state.words Field.cursor.index)).address (memoryOperand .rax cellBytes) =
+        state.words Field.cursor.index + 32 := by
+      simpa [cellBytes] using operand_address (state.setReg .rax (state.words Field.cursor.index)) .rax cellBytes
+        (by decide)
+    simp only [bump, State.setReg_registers, beq_self_eq_true, ↓reduceIte]
+    have atPointer :
+        (((state.setReg .rax (state.words Field.cursor.index)).setReg .r11
+          (state.words Field.cursor.index + 32)).setWord Field.cursor.index
+            (state.words Field.cursor.index + 32)).address
+          { base := some .rdi, index := some .rax, displacement := 80 } = layout.cell index := by
+      simp [State.address, State.core, MemAddr.eval, Core.readReg, State.setReg, State.setWord,
+        Registers.set, Scale.word, IndexReg.gpr, signExtend32, context, cursor]
+      simpa only [UInt64.ofNat_mul] using layout.allocate_address index
+    rw [atPointer]
+    have reorder :
+        ((((state.setReg .rax (state.words Field.cursor.index)).setReg .r11
+          (state.words Field.cursor.index + 32)).setWord Field.cursor.index
+            (state.words Field.cursor.index + 32)).setReg .rax (layout.cell index)) =
+          prepareAllocation state layout index := by
+      apply State.ext
+      · funext register
+        cases register <;> simp [prepareAllocation, State.setReg, State.setWord, Registers.set]
+      · rfl
+    rw [reorder]
+    exact .nil _
+
+def allocateState (state : State) (layout : Layout) (index : Nat)
+    (tag head : Word) (tail : MoveSource) (destination : GPR) : State :=
+  let s0 := prepareAllocation state layout index
+  let s1 := writeSourceState s0 (cellSlot index 0) (.imm tag)
+  let s2 := writeSourceState s1 (cellSlot index 1) (.imm head)
+  let s3 := writeSourceState s2 (cellSlot index 2) tail
+  let s4 := writeSourceState s3 (cellSlot index 3) (.imm 0)
+  let s5 := counterState s4 .allocs .add 1
+  let s6 := counterState s5 .live .add 1
+  (s6.setWord Field.peak.index (s6.registers .r11)).setReg destination (s6.registers .rax)
+
+theorem allocateTrace (layout : Layout) (state : State) (index : Nat)
+    (tag head : Word) (tail : MoveSource) (destination : GPR)
+    (indexBound : index < layout.capacity) (context : state.registers .rdi = layout.base)
+    (cursor : state.words Field.cursor.index = UInt64.ofNat (cellBytes * index)) :
+    Trace layout (allocate tag head tail destination) state
+      (allocateState state layout index tag head tail destination) := by
+  let s0 := prepareAllocation state layout index
+  let s1 := writeSourceState s0 (cellSlot index 0) (.imm tag)
+  let s2 := writeSourceState s1 (cellSlot index 1) (.imm head)
+  let s3 := writeSourceState s2 (cellSlot index 2) tail
+  let s4 := writeSourceState s3 (cellSlot index 3) (.imm 0)
+  let s5 := counterState s4 .allocs .add 1
+  let s6 := counterState s5 .live .add 1
+  have h0 := prepareAllocationTrace layout state index context cursor
+  have h1 := writeSourceTrace layout s0 .rax index 0 (.imm tag) indexBound (by decide) (by simp [s0]) (by decide)
+  have h2 := writeSourceTrace layout s1 .rax index 1 (.imm head) indexBound (by decide) (by simp [s1, s0]) (by decide)
+  have h3 := writeSourceTrace layout s2 .rax index 2 tail indexBound (by decide) (by simp [s2, s1, s0]) (by decide)
+  have h4 := writeSourceTrace layout s3 .rax index 3 (.imm 0) indexBound (by decide) (by simp [s3, s2, s1, s0]) (by decide)
+  have h5 := counterTrace layout s4 .allocs .add 1 (by simpa [s4, s3, s2, s1, s0] using context)
+  have h6 := counterTrace layout s5 .live .add 1 (by simpa [s5, s4, s3, s2, s1, s0] using context)
+  have last : Trace layout [.store .w64 (header .peak) .r11, .mov .w64 destination (.reg .rax)] s6
+      ((s6.setWord Field.peak.index (s6.registers .r11)).setReg destination (s6.registers .rax)) := by
+    refine .cons (.store _ _ _ Field.peak.index (layout.field_bound .peak) ?_) (.cons (.mov _ _ _) ?_)
+    · apply header_address
+      simpa [s6, s5, s4, s3, s2, s1, s0] using context
+    · simpa using (Trace.nil (layout := layout)
+        ((s6.setWord Field.peak.index (s6.registers .r11)).setReg destination (s6.registers .rax)))
+  simpa [allocate, allocateState, List.append_assoc, s0, s1, s2, s3, s4, s5, s6] using
+    h0.append (h1.append (h2.append (h3.append (h4.append (h5.append (h6.append last))))))
+
+def reserveState (state : State) (index : Nat) : State :=
+  let loaded := (state.setReg .r8 (state.words (cellSlot index 1))).setReg .r9 (state.words (cellSlot index 2))
+  let reserved := writeSourceState loaded (cellSlot index 0) (.imm reservedTag)
+  counterState (counterState reserved .reservations .add 1) .live .sub 1
+
+theorem reserveTrace (layout : Layout) (state : State) (index : Nat) (indexBound : index < layout.capacity)
+    (context : state.registers .rdi = layout.base) (pointer : state.registers .rdx = layout.cell index) :
+    Trace layout reserveCons state (reserveState state index) := by
+  let first := state.setReg .r8 (state.words (cellSlot index 1))
+  let loaded := first.setReg .r9 (state.words (cellSlot index 2))
+  let reserved := writeSourceState loaded (cellSlot index 0) (.imm reservedTag)
+  let counted := counterState reserved .reservations .add 1
+  have h0 : Trace layout [.load .w64 .r8 (memoryOperand .rdx 8), .load .w64 .r9 (memoryOperand .rdx 16)] state loaded := by
+    refine .cons (loadField layout state .rdx .r8 index 1 indexBound (by decide) pointer)
+      (.cons (loadField layout first .rdx .r9 index 2 indexBound (by decide) ?_) ?_)
+    · simpa [first] using pointer
+    · exact .nil _
+  have h1 := writeSourceTrace layout loaded .rdx index 0 (.imm reservedTag) indexBound (by decide)
+    (by simpa [loaded, first] using pointer) (by decide)
+  have h2 := counterTrace layout reserved .reservations .add 1 (by simpa [reserved, loaded, first] using context)
+  have h3 := counterTrace layout counted .live .sub 1 (by simpa [counted, reserved, loaded, first] using context)
+  simpa [reserveCons, reserveState, loaded, first, reserved, counted, List.append_assoc] using
+    h0.append (h1.append (h2.append h3))
+
+def reuseState (state : State) (index : Nat) : State :=
+  let payload := (state.setWord (cellSlot index 1) (state.registers .r8)).setWord
+    (cellSlot index 2) (state.registers .rsi)
+  let reused := writeSourceState payload (cellSlot index 0) (.imm consTag)
+  let credited := counterState (counterState reused .reservations .sub 1) .live .add 1
+  counterState (counterState credited .reuses .add 1) .payload .add 2
+
+theorem reuseTrace (layout : Layout) (state : State) (index : Nat) (indexBound : index < layout.capacity)
+    (context : state.registers .rdi = layout.base) (pointer : state.registers .rdx = layout.cell index) :
+    Trace layout reuseCons state (reuseState state index) := by
+  let first := state.setWord (cellSlot index 1) (state.registers .r8)
+  let payload := first.setWord (cellSlot index 2) (state.registers .rsi)
+  let reused := writeSourceState payload (cellSlot index 0) (.imm consTag)
+  let unreserved := counterState reused .reservations .sub 1
+  let credited := counterState unreserved .live .add 1
+  let counted := counterState credited .reuses .add 1
+  have h0 : Trace layout [.store .w64 (memoryOperand .rdx 8) .r8, .store .w64 (memoryOperand .rdx 16) .rsi] state payload := by
+    exact .cons (storeField layout state .rdx .r8 index 1 indexBound (by decide) pointer)
+      (.cons (storeField layout first .rdx .rsi index 2 indexBound (by decide) pointer) (.nil _))
+  have h1 := writeSourceTrace layout payload .rdx index 0 (.imm consTag) indexBound (by decide) pointer (by decide)
+  have h2 := counterTrace layout reused .reservations .sub 1 (by simpa [reused, payload, first] using context)
+  have h3 := counterTrace layout unreserved .live .add 1 (by simpa [unreserved, reused, payload, first] using context)
+  have h4 := counterTrace layout credited .reuses .add 1 (by simpa [credited, unreserved, reused, payload, first] using context)
+  have h5 := counterTrace layout counted .payload .add 2 (by simpa [counted, credited, unreserved, reused, payload, first] using context)
+  simpa [reuseCons, reuseState, first, payload, reused, unreserved, credited, counted, List.append_assoc] using
+    h0.append (h1.append (h2.append (h3.append (h4.append h5))))
+
+def releaseState (state : State) (index : Nat) : State :=
+  let tagged := writeSourceState state (cellSlot index 0) (.imm freedTag)
+  let cleared := ((writeSourceState tagged (cellSlot index 1) (.imm 0)).setWord (cellSlot index 2) 0).setWord
+    (cellSlot index 3) 0
+  counterState (counterState cleared .frees .add 1) .live .sub 1
+
+theorem releaseTrace (layout : Layout) (state : State) (pointer : GPR) (index : Nat)
+    (indexBound : index < layout.capacity) (context : state.registers .rdi = layout.base)
+    (atCell : state.registers pointer = layout.cell index) (notScratch : pointer ≠ .rcx) :
+    Trace layout (releaseCell pointer) state (releaseState state index) := by
+  let tagged := writeSourceState state (cellSlot index 0) (.imm freedTag)
+  let first := writeSourceState tagged (cellSlot index 1) (.imm 0)
+  let second := first.setWord (cellSlot index 2) 0
+  let cleared := second.setWord (cellSlot index 3) 0
+  let counted := counterState cleared .frees .add 1
+  have h0 := writeSourceTrace layout state pointer index 0 (.imm freedTag) indexBound (by decide) atCell notScratch
+  have h1 := writeSourceTrace layout tagged pointer index 1 (.imm 0) indexBound (by decide)
+    (by simpa [tagged, notScratch] using atCell) notScratch
+  have h2 : Trace layout [.store .w64 (memoryOperand pointer 16) .rcx, .store .w64 (memoryOperand pointer 24) .rcx]
+      first cleared := by
+    refine .cons (storeField layout first pointer .rcx index 2 indexBound (by decide) ?_)
+      (.cons (storeField layout second pointer .rcx index 3 indexBound (by decide) ?_) ?_)
+    · simpa [first, tagged, notScratch] using atCell
+    · simpa [second, first, tagged, notScratch] using atCell
+    · simpa [cleared, second, first] using (Trace.nil (layout := layout) cleared)
+  have h3 := counterTrace layout cleared .frees .add 1 (by simpa [cleared, second, first, tagged] using context)
+  have h4 := counterTrace layout counted .live .sub 1 (by simpa [counted, cleared, second, first, tagged] using context)
+  simpa [releaseCell, releaseState, tagged, first, second, cleared, counted, List.append_assoc] using
+    h0.append (h1.append (h2.append (h3.append h4)))
+
+def consState (state : State) (index : Nat) : State :=
+  let reused := reuseState (reserveState state index) index
+  (reused.setReg .rsi (reused.registers .rdx)).setReg .rdx (reused.registers .r9)
+
+theorem consTrace (layout : Layout) (state : State) (index : Nat) (indexBound : index < layout.capacity)
+    (context : state.registers .rdi = layout.base) (pointer : state.registers .rdx = layout.cell index) :
+    Trace layout consInstructions state (consState state index) := by
+  have first := reserveTrace layout state index indexBound context pointer
+  have second := reuseTrace layout (reserveState state index) index indexBound
+    (by simpa [reserveState] using context) (by simpa [reserveState] using pointer)
+  have last : Trace layout [.mov .w64 .rsi (.reg .rdx), .mov .w64 .rdx (.reg .r9)]
+      (reuseState (reserveState state index) index) (consState state index) := by
+    refine .cons (.mov _ _ _) (.cons (.mov _ _ _) ?_)
+    simpa [consState] using Trace.nil (layout := layout) (consState state index)
+  exact first.append (second.append last)
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueMain.lean b/Ix/Compiler/X86/UniqueMain.lean
new file mode 100644
index 000000000..7dd7f1ed1
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueMain.lean
@@ -0,0 +1,145 @@
+import Ix.Compiler.X86.UniqueLoop
+
+/-! The native entry starts from a fresh bounded arena, passes the emitted
+capacity checks, constructs its owned input, and returns the reversed chain.
+The theorem is parametric in the arena base, surrounding memory, and runtime. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+def guardLoads : List Instr := [.load .w64 .rax (header .cursor), .load .w64 .r11 (header .capacity)]
+def guardSubtract : List Instr := [.alu .sub .w64 .r11 (.reg .rax)]
+def cursorCompare : Compare := { width := .w64, left := .rax, right := .reg .r11 }
+def capacityCompare (values : List Word) : Compare :=
+  { width := .w64, left := .r11, right := .imm (UInt32.ofNat (requiredBytes values)) }
+
+theorem main_guard0Code (values : List Word) (checked : Checked) (produced : checked.program = program values) :
+    BlockCode checked 0 guardLoads (.branch cursorCompare .unsignedLe 1 6) :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+theorem main_guard1Code (values : List Word) (checked : Checked) (produced : checked.program = program values) :
+    BlockCode checked 1 guardSubtract (.branch (capacityCompare values) .unsignedGe 2 6) :=
+  ⟨by rw [produced]; rfl, by decide⟩
+
+theorem signExtend32_ofNat (value : Nat) (small : value < 0x80000000) :
+    signExtend32 (UInt32.ofNat value) = UInt64.ofNat value := by
+  have small32 : UInt32.ofNat value < 0x80000000 := by
+    change (UInt32.ofNat value).toNat < 2147483648
+    rw [UInt32.toNat_ofNat_of_lt' (by change value < 4294967296; omega)]
+    exact small
+  rw [signExtend32, if_pos small32]
+  apply UInt64.toNat_inj.mp
+  simp only [UInt32.toNat_toUInt64, UInt32.toNat_ofNat', UInt64.toNat_ofNat']
+  omega
+
+structure GuardsPassed (layout : Layout) (before after : State) : Prop where
+  words : after.words = initialWords layout
+  context : after.registers .rdi = layout.base
+  saved : PreservesSaved before after
+
+theorem guardSteps (layout : Layout) (values : List Word) (state : State)
+    (capacity : values.length + 2 ≤ layout.capacity) (context : state.registers .rdi = layout.base)
+    (initial : state.words = initialWords layout) (outside memory : Memory)
+    (represented : Realizes layout outside state.words memory) (runtime : Runtime)
+    (checked : Checked) (produced : checked.program = program values) :
+    ∃ after nextMemory, GuardsPassed layout state after ∧ Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked 5 (leaf (state.core memory) 0 0) (leaf (after.core nextMemory) 2 0) := by
+  let loaded := (state.setReg .rax 0).setReg .r11 (UInt64.ofNat (cellBytes * layout.capacity))
+  have loads : Trace layout guardLoads state loaded := by
+    refine .cons (.load _ _ _ Field.cursor.index (layout.field_bound .cursor)
+      (header_address state layout .cursor context)) (.cons (.load _ _ _ Field.capacity.index
+      (layout.field_bound .capacity) (header_address _ layout .capacity ?_)) ?_)
+    · simpa using context
+    · simpa [loaded, initial, initialWords, Words.set, Field.index] using Trace.nil (layout := layout) loaded
+  have cursorOK : cursorCompare.holds .unsignedLe (loaded.core Memory.unmapped) = true := by
+    simp [cursorCompare, Compare.holds, Condition.holds, Core.readReg, State.core, loaded,
+      AluSource.eval, UInt64.le_iff_toNat_le]
+  obtain ⟨loadedMemory, loadedView, first⟩ := loads.branch outside memory represented runtime checked 0 1 6
+    cursorCompare .unsignedLe (main_guard0Code values checked produced) true cursorOK
+    (main_hasBlock values checked produced 1 (by decide))
+  have subtract : Trace layout guardSubtract loaded loaded := by
+    refine .cons (.alu _ _ _ _) ?_
+    simpa [loaded, AluOp.eval] using Trace.nil (layout := layout) loaded
+  have bytesBound : cellBytes * layout.capacity < UInt64.size := by
+    have := layout.capacityBound
+    simp only [cellBytes, UInt64.size, maxLength] at *
+    omega
+  have requiredBound : requiredBytes values < UInt64.size := by
+    simp only [requiredBytes, cellBytes, UInt64.size] at *
+    omega
+  have immediate : signExtend32 (UInt32.ofNat (requiredBytes values)) = UInt64.ofNat (requiredBytes values) :=
+    signExtend32_ofNat _ (by have := layout.capacityBound; simp only [requiredBytes, cellBytes, maxLength] at *; omega)
+  have space : UInt64.ofNat (requiredBytes values) ≤ UInt64.ofNat (cellBytes * layout.capacity) := by
+    rw [UInt64.ofNat_le_iff_le requiredBound bytesBound]
+    simp only [requiredBytes, cellBytes]
+    omega
+  have capacityOK : (capacityCompare values).holds .unsignedGe (loaded.core Memory.unmapped) = true := by
+    simpa [capacityCompare, Compare.holds, Condition.holds, Core.readReg, State.core,
+      loaded, AluSource.eval, immediate] using space
+  obtain ⟨nextMemory, finalView, second⟩ := subtract.branch outside loadedMemory loadedView runtime checked 1 2 6
+    (capacityCompare values) .unsignedGe (main_guard1Code values checked produced) true capacityOK
+    (main_hasBlock values checked produced 2 (by decide))
+  refine ⟨loaded, nextMemory, ⟨?_, ?_, ?_⟩, finalView, first.append second⟩
+  · exact initial
+  · simpa [loaded] using context
+  · exact (PreservesSaved.setReg state .rax _ rfl).trans (PreservesSaved.setReg _ .r11 _ rfl)
+
+def mainCounts (length : Nat) : Counts :=
+  { allocs := length + 2, frees := 1, reuses := length, live := length + 1,
+    peak := length + 2, payload := 2 * length }
+
+@[simp] theorem readyCounts_finish (length : Nat) : (readyCounts (length + 2)).finish length = mainCounts length := by
+  simp [readyCounts, Counts.finish, Counts.release, mainCounts]
+
+theorem mainSteps (layout : Layout) (values : List Word) (state : State)
+    (capacity : values.length + 2 ≤ layout.capacity) (context : state.registers .rdi = layout.base)
+    (initial : state.words = initialWords layout) (outside memory : Memory)
+    (represented : Realizes layout outside state.words memory) (runtime : Runtime)
+    (checked : Checked) (produced : checked.program = program values) :
+    ∃ after nextMemory, LoopResult layout values.reverse (mainCounts values.length) state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (controlCost values) (leaf (state.core memory) 0 0)
+        (haltedLeaf (after.core nextMemory) 4 13) := by
+  obtain ⟨guarded, guardMemory, guardResult, guardView, guards⟩ :=
+    guardSteps layout values state capacity context initial outside memory represented runtime checked produced
+  obtain ⟨initialized, input, inputResult⟩ :=
+    initializeTrace layout values guarded capacity guardResult.context guardResult.words
+  have bound : values.length ≤ maxLength := by have := layout.capacityBound; omega
+  obtain ⟨inputMemory, inputView, inputSteps⟩ := input.jump outside guardMemory guardView runtime checked 2 3
+    (main_inputCode values checked produced bound) (main_hasBlock values checked produced 3 (by decide))
+  have invariant : LoopInvariant layout values [] (readyCounts (values.length + 2)) initialized :=
+    ⟨inputResult.input, inputResult.accumulator, inputResult.counts, inputResult.inputRoot,
+      inputResult.accRoot, inputResult.context⟩
+  obtain ⟨after, nextMemory, loopResult, finalView, loop⟩ := loopSteps layout values values []
+    (readyCounts (values.length + 2)) initialized invariant (by simpa using capacity) (by simp [readyCounts])
+    outside inputMemory inputView runtime checked produced
+  refine ⟨after, nextMemory, ?_, finalView, ?_⟩
+  · have saved := (guardResult.saved.trans inputResult.saved).trans loopResult.saved
+    simp only [List.append_nil, readyCounts_finish] at loopResult
+    exact { loopResult with saved }
+  · have cost : 5 + ((inputInstructions values).length + 1 + (31 * values.length + 16)) = controlCost values := by
+      simp only [inputInstructions_length, controlCost]
+      omega
+    have all := guards.append (inputSteps.append loop)
+    rw [cost] at all
+    exact all
+
+/-- The public word-level result is about `runFrom` on the emitted program,
+with the arena's initial bytes constructed from any surrounding memory. -/
+theorem mainRuns (layout : Layout) (values : List Word) (registers : Registers)
+    (capacity : values.length + 2 ≤ layout.capacity) (context : registers .rdi = layout.base)
+    (outside : Memory) (runtime : Runtime) (checked : Checked) (produced : checked.program = program values) :
+    ∃ after nextMemory, LoopResult layout values.reverse (mainCounts values.length)
+        ⟨registers, initialWords layout⟩ after ∧
+      Realizes layout outside after.words nextMemory ∧
+      runFrom runtime checked (controlCost values) ⟨registers, initialMemory layout outside⟩ =
+        haltedLeaf (after.core nextMemory) 4 13 := by
+  obtain ⟨after, nextMemory, result, finalView, steps⟩ := mainSteps layout values
+    ⟨registers, initialWords layout⟩ capacity context rfl outside (initialMemory layout outside)
+    (initialMemory_realizes layout outside) runtime checked produced
+  refine ⟨after, nextMemory, result, finalView, ?_⟩
+  have entry : checked.program.entry = 0 := by rw [produced]; rfl
+  simpa [runFrom, Machine.initial, leaf, entry, State.core] using steps.run_eq
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueRelease.lean b/Ix/Compiler/X86/UniqueRelease.lean
new file mode 100644
index 000000000..1132eb58f
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueRelease.lean
@@ -0,0 +1,161 @@
+import Ix.Compiler.X86.UniqueMain
+
+/-! Complete reclamation by the separately emitted release entry. The result
+records every freed cell and preservation of cells outside the released chain,
+so it composes with the main entry's already-freed input nil. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+def Counts.dropped (counts : Counts) (length : Nat) : Counts :=
+  { counts with frees := counts.frees + (length + 1), live := counts.live - (length + 1) }
+
+@[simp] theorem Counts.dropped_zero (counts : Counts) : counts.dropped 0 = counts.release := rfl
+
+@[simp] theorem Counts.dropped_release (counts : Counts) (length : Nat) :
+    counts.release.dropped length = counts.dropped (length + 1) := by
+  cases counts
+  simp [Counts.dropped, Counts.release, Nat.sub_sub, Nat.add_comm, Nat.add_left_comm]
+
+def CellFrame (before after : Words) (start count : Nat) : Prop :=
+  ∀ index, (index < start ∨ start + count ≤ index) → ∀ field < 4,
+    after (cellSlot index field) = before (cellSlot index field)
+
+structure DropResult (layout : Layout) (start length : Nat) (counts : Counts) (before after : State) : Prop where
+  countsAt : CountsAt layout (counts.dropped length) after.words
+  freed : ∀ index, start ≤ index → index ≤ start + length → CellAt after.words index freedTag 0 0
+  frame : CellFrame before.words after.words start (length + 1)
+  result : after.registers .rax = 0
+  context : after.registers .rdi = layout.base
+  saved : PreservesSaved before after
+
+theorem releaseSteps (layout : Layout) (values : List Word) (start : Nat) (counts : Counts) (state : State)
+    (chain : UpChain layout state.words start values) (counted : CountsAt layout counts state.words)
+    (root : state.registers .rsi = layout.cell start) (context : state.registers .rdi = layout.base)
+    (capacity : start + values.length < layout.capacity) (live : values.length + 1 ≤ counts.live)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory)
+    (runtime : Runtime) (checked : Checked) (produced : checked.program = releaseProgram) :
+    ∃ after nextMemory, DropResult layout start values.length counts state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked (releaseCost values.length) (leaf (state.core memory) 0 0)
+        (haltedLeaf (after.core nextMemory) 2 13) := by
+  induction values generalizing start counts state memory with
+  | nil =>
+      let tagged := tagState state start
+      have bound : start < layout.capacity := by simpa using capacity
+      have load := tagTrace layout state .rsi start bound root
+      have tested := tagState_test state start nilTag chain.tagAt
+      obtain ⟨tagMemory, tagView, dispatch⟩ := load.branch outside memory represented runtime checked 0 2 1
+        tagCompare .eq (release_tagCode checked produced) true tested
+        (release_hasBlock checked produced 2 (by decide))
+      let after := (releaseState tagged start).setReg .rax 0
+      have release := releaseTrace layout tagged .rsi start bound
+        (by simpa [tagged, tagState] using context) (by simpa [tagged, tagState] using root) (by decide)
+      have move : Trace layout [Instr.mov .w64 .rax (.imm 0)] (releaseState tagged start) after :=
+        .cons (.mov _ _ _) (.nil _)
+      obtain ⟨nextMemory, finalView, finish⟩ := (release.append move).ret outside tagMemory tagView
+        runtime checked 2 (release_retCode checked produced)
+      have words : after.words = releasedWords state.words start := by
+        simp [after, releaseState_words, tagged, tagState]
+      refine ⟨after, nextMemory, ?_, finalView, dispatch.append finish⟩
+      refine ⟨?_, ?_, ?_, ?_, ?_, ?_⟩
+      · rw [words]
+        exact counted.release start (by simp only [List.length_nil] at live; omega)
+      · intro index lower upper
+        have equal : index = start := by simp at upper; omega
+        subst index
+        rw [words]
+        exact releasedWords_cell state.words start
+      · intro index outsideRange field fieldBound
+        rw [words]
+        exact releasedWords_other state.words (by simp at outsideRange; omega) fieldBound
+      · simp [after]
+      · simpa [after, tagged, tagState] using context
+      · exact ((PreservesSaved.setReg state .rcx _ rfl).trans (releaseState_saved tagged start)).trans
+          (PreservesSaved.setReg _ .rax _ rfl)
+  | cons head tail ih =>
+      let tagged := tagState state start
+      have bound : start < layout.capacity := by simp only [List.length_cons] at capacity; omega
+      have load := tagTrace layout state .rsi start bound root
+      have tested := tagState_test state start consTag chain.1.tagAt
+      obtain ⟨tagMemory, tagView, dispatch⟩ := load.branch outside memory represented runtime checked 0 2 1
+        tagCompare .eq (release_tagCode checked produced) false tested
+        (release_hasBlock checked produced 1 (by decide))
+      let pointed := tagged.setReg .rdx (state.words (cellSlot start 2))
+      let next := (releaseState pointed start).setReg .rsi (pointed.registers .rdx)
+      have readTail : Trace layout [Instr.load .w64 .rdx (memoryOperand .rsi 16)] tagged pointed :=
+        .cons (loadField layout tagged .rsi .rdx start 2 bound (by decide)
+          (by simpa [tagged, tagState] using root)) (.nil _)
+      have release := releaseTrace layout pointed .rsi start bound
+        (by simpa [pointed, tagged, tagState] using context)
+        (by simpa [pointed, tagged, tagState] using root) (by decide)
+      have move : Trace layout [Instr.mov .w64 .rsi (.reg .rdx)] (releaseState pointed start) next := by
+        refine .cons (.mov _ _ _) ?_
+        simpa [next] using Trace.nil (layout := layout) next
+      obtain ⟨releaseMemory, releaseView, released⟩ := ((readTail.append release).append move).jump
+        outside tagMemory tagView runtime checked 1 0 (release_consCode checked produced)
+        (release_hasBlock checked produced 0 (by decide))
+      have words : next.words = releasedWords state.words start := by
+        simp [next, releaseState_words, pointed, tagged, tagState]
+      have nextChain : UpChain layout next.words (start + 1) tail := by
+        rw [words]
+        apply chain.2.mono
+        intro index lower upper field fieldBound
+        exact releasedWords_other state.words (by omega) fieldBound
+      have nextCounted : CountsAt layout counts.release next.words := by
+        rw [words]
+        exact counted.release start (by simp only [List.length_cons] at live; omega)
+      have nextRoot : next.registers .rsi = layout.cell (start + 1) := by
+        simpa [next, pointed] using chain.1.tailAt
+      have nextContext : next.registers .rdi = layout.base := by
+        simpa [next, pointed, tagged, tagState] using context
+      obtain ⟨after, nextMemory, result, finalView, rest⟩ := ih (start + 1) counts.release next
+        nextChain nextCounted nextRoot nextContext (by simp only [List.length_cons] at capacity; omega)
+        (by simp only [List.length_cons] at live; simp only [Counts.release]; omega) releaseMemory releaseView
+      have saved : PreservesSaved state after :=
+        ((((PreservesSaved.setReg state .rcx _ rfl).trans (PreservesSaved.setReg tagged .rdx _ rfl)).trans
+          (releaseState_saved pointed start)).trans (PreservesSaved.setReg _ .rsi _ rfl)).trans result.saved
+      refine ⟨after, nextMemory, ⟨?_, ?_, ?_, result.result, result.context, saved⟩, finalView, ?_⟩
+      · simpa using result.countsAt
+      · intro index lower upper
+        by_cases equal : index = start
+        · subst index
+          apply (releasedWords_cell state.words start).mono
+          intro field fieldBound
+          rw [result.frame start (Or.inl (by omega)) field fieldBound, words]
+        · exact result.freed index (by omega) (by simp only [List.length_cons] at upper; omega)
+      · intro index outsideRange field fieldBound
+        have elsewhere : index < start + 1 ∨ start + 1 + (tail.length + 1) ≤ index := by
+          simp only [List.length_cons] at outsideRange
+          omega
+        rw [result.frame index elsewhere field fieldBound, words]
+        exact releasedWords_other state.words (by simp only [List.length_cons] at outsideRange; omega) fieldBound
+      · have all := dispatch.append (released.append rest)
+        have cost : (tagInstructions .rsi).length + 1 +
+            (([Instr.load .w64 .rdx (memoryOperand .rsi 16)] ++ releaseCell .rsi ++
+              [Instr.mov .w64 .rsi (.reg .rdx)]).length + 1 + releaseCost tail.length) =
+            releaseCost (head :: tail).length := by
+          change 2 + (15 + (17 * tail.length + 16)) = 17 * (tail.length + 1) + 16
+          omega
+        rw [cost] at all
+        exact all
+
+/-- Executing the release entry consumes exactly the returned finite chain. -/
+theorem releaseRuns (layout : Layout) (values : List Word) (start : Nat) (counts : Counts) (state : State)
+    (chain : UpChain layout state.words start values) (counted : CountsAt layout counts state.words)
+    (root : state.registers .rsi = layout.cell start) (context : state.registers .rdi = layout.base)
+    (capacity : start + values.length < layout.capacity) (live : values.length + 1 ≤ counts.live)
+    (outside memory : Memory) (represented : Realizes layout outside state.words memory)
+    (runtime : Runtime) (checked : Checked) (produced : checked.program = releaseProgram) :
+    ∃ after nextMemory, DropResult layout start values.length counts state after ∧
+      Realizes layout outside after.words nextMemory ∧
+      runFrom runtime checked (releaseCost values.length) (state.core memory) =
+        haltedLeaf (after.core nextMemory) 2 13 := by
+  obtain ⟨after, nextMemory, result, finalView, steps⟩ := releaseSteps layout values start counts state
+    chain counted root context capacity live outside memory represented runtime checked produced
+  refine ⟨after, nextMemory, result, finalView, ?_⟩
+  have entry : checked.program.entry = 0 := by rw [produced]; rfl
+  simpa [runFrom, Machine.initial, leaf, entry] using steps.run_eq
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueResult.lean b/Ix/Compiler/X86/UniqueResult.lean
new file mode 100644
index 000000000..032cb4876
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueResult.lean
@@ -0,0 +1,145 @@
+import Ix.Compiler.X86.UniqueRelease
+
+/-! Observable native list ownership and complete main/release semantics.
+The graph relation reads byte memory at actual native pointers. Its finite
+footprint has no repeated node; tags are interpreted by the selected schema. -/
+
+namespace Ix.Compiler.X86.UniqueExecution
+
+open UniqueABI UniqueTarget
+
+theorem cell_injective (layout : Layout) {left right : Nat} (leftBound : left < layout.capacity)
+    (rightBound : right < layout.capacity) (equal : layout.cell left = layout.cell right) : left = right := by
+  have slots := layout.address_injective (layout.cell_field_bound leftBound (by decide : 0 < cellWords))
+    (layout.cell_field_bound rightBound (by decide : 0 < cellWords)) equal
+  simp only [cellSlot, headerWords, cellWords] at slots
+  omega
+
+def chainNodes (layout : Layout) (start : Nat) : Nat → List Word
+  | 0 => [layout.cell start]
+  | length + 1 => layout.cell start :: chainNodes layout (start + 1) length
+
+theorem chainNodes_mem {layout : Layout} {start length : Nat} {pointer : Word}
+    (member : pointer ∈ chainNodes layout start length) :
+    ∃ index, start ≤ index ∧ index ≤ start + length ∧ pointer = layout.cell index := by
+  induction length generalizing start with
+  | zero =>
+      simp only [chainNodes, List.mem_singleton] at member
+      exact ⟨start, Nat.le_refl _, by omega, member⟩
+  | succ length ih =>
+      simp only [chainNodes, List.mem_cons] at member
+      rcases member with same | member
+      · exact ⟨start, Nat.le_refl _, by omega, same⟩
+      · obtain ⟨index, lower, upper, same⟩ := ih member
+        exact ⟨index, by omega, by omega, same⟩
+
+theorem chainNodes_fresh (layout : Layout) (start length : Nat)
+    (bound : start + length + 1 < layout.capacity) :
+    layout.cell start ∉ chainNodes layout (start + 1) length := by
+  intro member
+  obtain ⟨index, lower, upper, equal⟩ := chainNodes_mem member
+  have same := cell_injective layout (by omega) (by omega) equal
+  omega
+
+/-- A read-only graph observation with an exclusive finite node footprint. -/
+inductive NativeList (memory : Memory) : List Nat → Word → List Word → Prop where
+  | nil {root : Word}
+      (tagAt : memory.read64 root = nilTag)
+      (headAt : memory.read64 (root + 8) = 0)
+      (tailAt : memory.read64 (root + 16) = 0)
+      (padding : memory.read64 (root + 24) = 0) : NativeList memory [] root [root]
+  | cons {head : Nat} {tail : List Nat} {root next : Word} {nodes : List Word}
+      (tagAt : memory.read64 root = consTag)
+      (headAt : (memory.read64 (root + 8)).toNat = head)
+      (tailAt : memory.read64 (root + 16) = next)
+      (padding : memory.read64 (root + 24) = 0)
+      (rest : NativeList memory tail next nodes) (fresh : root ∉ nodes) :
+      NativeList memory (head :: tail) root (root :: nodes)
+
+theorem NativeList.nodup {memory : Memory} {values : List Nat} {root : Word} {nodes : List Word}
+    (list : NativeList memory values root nodes) : nodes.Nodup := by
+  induction list with
+  | nil => simp
+  | cons _ _ _ _ _ fresh ih => exact List.nodup_cons.mpr ⟨fresh, ih⟩
+
+theorem NativeList.length {memory : Memory} {values : List Nat} {root : Word} {nodes : List Word}
+    (list : NativeList memory values root nodes) : nodes.length = values.length + 1 := by
+  induction list with
+  | nil => rfl
+  | cons _ _ _ _ _ _ ih => simp [ih]
+
+theorem _root_.Ix.Compiler.X86.UniqueABI.Realizes.readCell {layout : Layout} {outside memory : Memory} {words : Words}
+    (represented : Realizes layout outside words memory) {index field : Nat}
+    (bound : index < layout.capacity) (fieldBound : field < cellWords) :
+    memory.read64 (layout.cell index + UInt64.ofNat (8 * field)) = words (cellSlot index field) := by
+  rw [layout.cell_offset]
+  exact represented.view _ (layout.cell_field_bound bound fieldBound)
+
+theorem UpChain.native {layout : Layout} {outside memory : Memory} {words : Words}
+    {values : List Word} {start : Nat} (chain : UpChain layout words start values)
+    (represented : Realizes layout outside words memory) (bound : start + values.length < layout.capacity) :
+    NativeList memory (values.map UInt64.toNat) (layout.cell start) (chainNodes layout start values.length) := by
+  induction values generalizing start with
+  | nil =>
+      have atCell : start < layout.capacity := by simpa using bound
+      refine .nil ?_ ?_ ?_ ?_
+      · simpa using (represented.readCell atCell (by decide : 0 < cellWords)).trans chain.tagAt
+      · exact (represented.readCell atCell (by decide : 1 < cellWords)).trans chain.headAt
+      · exact (represented.readCell atCell (by decide : 2 < cellWords)).trans chain.tailAt
+      · exact (represented.readCell atCell (by decide : 3 < cellWords)).trans chain.padding
+  | cons head tail ih =>
+      have atCell : start < layout.capacity := by simp only [List.length_cons] at bound; omega
+      refine .cons ?_ ?_ ?_ ?_ (ih chain.2 (by simp only [List.length_cons] at bound; omega))
+        (chainNodes_fresh layout start tail.length (by simpa [Nat.add_assoc] using bound))
+      · simpa using (represented.readCell atCell (by decide : 0 < cellWords)).trans chain.1.tagAt
+      · exact congrArg UInt64.toNat ((represented.readCell atCell (by decide : 1 < cellWords)).trans chain.1.headAt)
+      · exact (represented.readCell atCell (by decide : 2 < cellWords)).trans chain.1.tailAt
+      · exact (represented.readCell atCell (by decide : 3 < cellWords)).trans chain.1.padding
+
+def reclaimedCounts (length : Nat) : Counts := { mainCounts length with frees := length + 2, live := 0 }
+
+@[simp] theorem mainCounts_dropped (length : Nat) : (mainCounts length).dropped length = reclaimedCounts length := by
+  simp [mainCounts, Counts.dropped, reclaimedCounts]
+  omega
+
+structure Reclaimed (layout : Layout) (length : Nat) (before after : State) : Prop where
+  countsAt : CountsAt layout (reclaimedCounts length) after.words
+  freed : ∀ index < length + 2, CellAt after.words index freedTag 0 0
+  result : after.registers .rax = 0
+  saved : PreservesSaved before after
+
+/-- Both calls terminate; every originally allocated cell is cleared and freed.
+All surrounding bytes and System V callee-saved registers are preserved. -/
+theorem mainAndRelease (layout : Layout) (values : List Word) (registers : Registers)
+    (capacity : values.length + 2 ≤ layout.capacity) (context : registers .rdi = layout.base)
+    (outside : Memory) (runtime : Runtime) (main release : Checked)
+    (mainProduced : main.program = program values) (releaseProduced : release.program = releaseProgram) :
+    ∃ returned returnedMemory reclaimed reclaimedMemory,
+      LoopResult layout values.reverse (mainCounts values.length) ⟨registers, initialWords layout⟩ returned ∧
+      Realizes layout outside returned.words returnedMemory ∧
+      NativeList returnedMemory ((values.map UInt64.toNat).reverse) (layout.cell 1)
+        (chainNodes layout 1 values.length) ∧
+      runFrom runtime main (controlCost values) ⟨registers, initialMemory layout outside⟩ =
+        haltedLeaf (returned.core returnedMemory) 4 13 ∧
+      Reclaimed layout values.length ⟨registers, initialWords layout⟩ reclaimed ∧
+      Realizes layout outside reclaimed.words reclaimedMemory ∧
+      runFrom runtime release (releaseCost values.length) (returned.core returnedMemory) =
+        haltedLeaf (reclaimed.core reclaimedMemory) 2 13 := by
+  obtain ⟨returned, returnedMemory, result, returnedView, mainRun⟩ :=
+    mainRuns layout values registers capacity context outside runtime main mainProduced
+  have graph := result.chain.native returnedView (by simp; omega)
+  obtain ⟨reclaimed, reclaimedMemory, released, reclaimedView, releaseRun⟩ := releaseRuns layout values.reverse 1
+    (mainCounts values.length) returned result.chain result.countsAt result.root result.context
+    (by simp; omega) (by simp [mainCounts]) outside returnedMemory returnedView runtime release releaseProduced
+  refine ⟨returned, returnedMemory, reclaimed, reclaimedMemory, result, returnedView,
+    by simpa using graph, mainRun, ?_, reclaimedView, by simpa using releaseRun⟩
+  refine ⟨by simpa using released.countsAt, ?_, released.result, result.saved.trans released.saved⟩
+  intro index bound
+  by_cases zero : index = 0
+  · subst index
+    apply result.freedNil.mono
+    intro field fieldBound
+    exact released.frame 0 (Or.inl (by decide)) field fieldBound
+  · exact released.freed index (by omega) (by simp; omega)
+
+end Ix.Compiler.X86.UniqueExecution
diff --git a/Ix/Compiler/X86/UniqueTarget.lean b/Ix/Compiler/X86/UniqueTarget.lean
new file mode 100644
index 000000000..fc2a45f27
--- /dev/null
+++ b/Ix/Compiler/X86/UniqueTarget.lean
@@ -0,0 +1,108 @@
+import Ix.Compiler.X86.UniqueABI
+
+/-! Native instruction emission for the checked unique reversal shape. Both
+entry points are System V leaves: they use caller-saved registers and perform
+all heap operations with the existing typed memory/arithmetic instructions.
+The main entry checks available arena bytes before its first write. -/
+
+namespace Ix.Compiler.X86.UniqueTarget
+
+open UniqueABI
+
+def policyTag : String := "unique-reverse-x86/1"
+
+def memoryOperand (base : GPR) (offset : Nat := 0) : MemAddr :=
+  { base := some base, displacement := UInt32.ofNat offset }
+
+def header (field : Field) : MemAddr := memoryOperand .rdi (8 * field.index)
+
+def changeCounter (field : Field) (operation : AluOp) (amount : Imm32) : List Instr :=
+  [.load .w64 .r11 (header field), .alu operation .w64 .r11 (.imm amount),
+   .store .w64 (header field) .r11]
+
+def allocate (tag head : Word) (tail : MoveSource) (destination : GPR) : List Instr :=
+  [.load .w64 .rax (header .cursor),
+   .lea .r11 (memoryOperand .rax cellBytes), .store .w64 (header .cursor) .r11,
+   .lea .rax { base := some .rdi, index := some .rax, displacement := 80 },
+   .mov .w64 .rcx (.imm tag), .store .w64 (memoryOperand .rax 0) .rcx,
+   .mov .w64 .rcx (.imm head), .store .w64 (memoryOperand .rax 8) .rcx,
+   .mov .w64 .rcx tail, .store .w64 (memoryOperand .rax 16) .rcx,
+   .mov .w64 .rcx (.imm 0), .store .w64 (memoryOperand .rax 24) .rcx] ++
+  changeCounter .allocs .add 1 ++ changeCounter .live .add 1 ++
+  [.store .w64 (header .peak) .r11, .mov .w64 destination (.reg .rax)]
+
+def inputCons : List Word → List Instr
+  | [] => []
+  | value :: rest => allocate consTag value (.reg .rdx) .rdx ++ inputCons rest
+
+def inputInstructions (values : List Word) : List Instr :=
+  allocate nilTag 0 (.imm 0) .rdx ++ inputCons values.reverse ++
+    allocate nilTag 0 (.imm 0) .rsi
+
+def reserveCons : List Instr :=
+  [.load .w64 .r8 (memoryOperand .rdx 8), .load .w64 .r9 (memoryOperand .rdx 16),
+   .mov .w64 .rcx (.imm reservedTag), .store .w64 (memoryOperand .rdx 0) .rcx] ++
+  changeCounter .reservations .add 1 ++ changeCounter .live .sub 1
+
+def reuseCons : List Instr :=
+  [.store .w64 (memoryOperand .rdx 8) .r8, .store .w64 (memoryOperand .rdx 16) .rsi,
+   .mov .w64 .rcx (.imm consTag), .store .w64 (memoryOperand .rdx 0) .rcx] ++
+  changeCounter .reservations .sub 1 ++ changeCounter .live .add 1 ++
+  changeCounter .reuses .add 1 ++ changeCounter .payload .add 2
+
+def releaseCell (pointer : GPR) : List Instr :=
+  [.mov .w64 .rcx (.imm freedTag), .store .w64 (memoryOperand pointer 0) .rcx,
+   .mov .w64 .rcx (.imm 0), .store .w64 (memoryOperand pointer 8) .rcx,
+   .store .w64 (memoryOperand pointer 16) .rcx, .store .w64 (memoryOperand pointer 24) .rcx] ++
+  changeCounter .frees .add 1 ++ changeCounter .live .sub 1
+
+def consInstructions : List Instr :=
+  reserveCons ++ reuseCons ++ [.mov .w64 .rsi (.reg .rdx), .mov .w64 .rdx (.reg .r9)]
+
+def requiredBytes (values : List Word) : Nat := cellBytes * (values.length + 2)
+
+def program (values : List Word) : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[.load .w64 .rax (header .cursor), .load .w64 .r11 (header .capacity)]
+        terminator := .branch { width := .w64, left := .rax, right := .reg .r11 } .unsignedLe 1 6 },
+      { instructions := #[.alu .sub .w64 .r11 (.reg .rax)]
+        terminator := .branch { width := .w64, left := .r11, right := .imm (UInt32.ofNat (requiredBytes values)) }
+          .unsignedGe 2 6 },
+      { instructions := (inputInstructions values).toArray, terminator := .jump 3 },
+      { instructions := #[.load .w64 .rcx (memoryOperand .rdx 0)]
+        terminator := .branch { width := .w64, left := .rcx, right := .imm 0 } .eq 4 5 },
+      { instructions := (releaseCell .rdx ++ [Instr.mov .w64 .rax (.reg .rsi)]).toArray, terminator := .ret },
+      { instructions := consInstructions.toArray, terminator := .jump 3 },
+      { instructions := #[.mov .w64 .rax (.imm 0)], terminator := .ret }] }
+
+/-- The separate release entry receives the descriptor in `rdi` and the
+returned root in `rsi`. It returns zero after releasing every cell. -/
+def releaseProgram : Program :=
+  { entry := 0
+    blocks := #[
+      { instructions := #[.load .w64 .rcx (memoryOperand .rsi 0)]
+        terminator := .branch { width := .w64, left := .rcx, right := .imm 0 } .eq 2 1 },
+      { instructions := ([Instr.load .w64 .rdx (memoryOperand .rsi 16)] ++ releaseCell .rsi ++
+          [Instr.mov .w64 .rsi (.reg .rdx)]).toArray
+        terminator := .jump 0 },
+      { instructions := (releaseCell .rsi ++ [Instr.mov .w64 .rax (.imm 0)]).toArray
+        terminator := .ret }] }
+
+@[simp] theorem allocate_length (tag head : Word) (tail : MoveSource) (destination : GPR) :
+    (allocate tag head tail destination).length = 20 := rfl
+
+@[simp] theorem inputCons_length (values : List Word) :
+    (inputCons values).length = 20 * values.length := by
+  induction values with
+  | nil => rfl
+  | cons value rest ih => simp [inputCons, ih]; omega
+
+@[simp] theorem inputInstructions_length (values : List Word) :
+    (inputInstructions values).length = 20 * values.length + 40 := by
+  simp [inputInstructions]; omega
+
+def controlCost (values : List Word) : Nat := 51 * values.length + 62
+def releaseCost (length : Nat) : Nat := 17 * length + 16
+
+end Ix.Compiler.X86.UniqueTarget
diff --git a/Ix/Compiler/X86/ValidatedScalar.lean b/Ix/Compiler/X86/ValidatedScalar.lean
new file mode 100644
index 000000000..9e548d459
--- /dev/null
+++ b/Ix/Compiler/X86/ValidatedScalar.lean
@@ -0,0 +1,151 @@
+import Ix.Compiler.IxIR2.Pipeline
+import Ix.Compiler.Ixon.Sharing
+import Ix.Compiler.X86.Select
+import Ix.Compiler.X86.ELF
+
+/-! A reproducible synthetic Ixon input for the source-to-native scalar slice.
+The erased-argument application returns the configured Nat in the Ixon
+evaluator and emits the exact `ScalarApply.program` graph. All addresses are
+computed from bytes; the fixture supplies no hand-written intermediate IR. -/
+
+namespace Ix.Compiler.X86.ValidatedScalar
+
+open Ix.Compiler Ix.Compiler.Ixon
+
+/-- The fixture's literal resolver is pinned to a versioned Nat preimage.
+This is a synthetic resolver input, not a catalog blob-format claim. -/
+def literalAddress (number : Nat) : Address :=
+  Address.blake3 ("compilatrix/native-scalar-literal/1\x00".toUTF8 ++ IxIR.Encoding.nat number)
+
+def constant (number : Nat) (ghostApplication : Bool := true) : Constant :=
+  { info := .defn
+      { kind := .defn, safety := .safe, lvls := 0, typ := .sort 0
+        value := if ghostApplication then .app (.lam .erased (.sort 0) (.nat 0)) (.sort 0)
+          else .nat 0 }
+    sharing := #[], refs := #[literalAddress number], univs := #[.zero] }
+
+/-- Conservative, explicit source budgets for this one-constant fixture. -/
+def config (number : Nat) : Pipeline.Config :=
+  { blobs := fun address => if address == literalAddress number then some (.natB number) else none
+    natBlock := none
+    limits :=
+      { maxConstants := 1, maxExpressionUnits := 32, maxExpandedExpressionUnits := 32
+        maxLayer1NodeVisits := 128, maxErasedDeclarations := 8, maxErasureAppendCells := 64
+        maxCertificateCandidates := 8, maxCertificateValidationAttempts := 64
+        maxCertificateSourceNodeWork := 1024, maxUsageFuel := 100, maxErasureFuel := 100
+        maxValidationFuel := 100, maxLoweringFuel := 100 } }
+
+/-- Version 1 pins shared-result baseline lowering and the two exact scalar
+selection families. No optional IxIR₁ or IxIR₂ optimizer is invoked. -/
+def loweringVersion : UInt32 := 1
+def passPolicyVersion : UInt32 := 1
+
+inductive Error where
+  | sourceAddress
+  | compilation (error : IxIR2.Pipeline.Error)
+  | selection (error : Select.Error)
+  deriving Repr
+
+structure Compiled (number : Nat) where
+  sourceRoot : Address
+  addressed : (constant number).address? = some sourceRoot
+  attached : IxIR2.Pipeline.Attached [(sourceRoot, constant number)] sourceRoot
+    (config number) .shared 100 100
+  compiled : IxIR2.Pipeline.compileValidated [(sourceRoot, constant number)] sourceRoot
+    (config number) .shared 100 100 100 100 100 = .ok attached
+  selected : Select.Output attached.target.artifact.program
+  selection : Select.select attached.target.artifact.program = .ok selected
+
+/-- One executable call crosses every real compiler and selector gate,
+retaining the exact successful equations used by the semantic endpoint. -/
+def compile (number : Nat) : Except Error (Compiled number) :=
+  match addressed : (constant number).address? with
+  | none => .error .sourceAddress
+  | some sourceRoot =>
+      match compiled : IxIR2.Pipeline.compileValidated [(sourceRoot, constant number)] sourceRoot
+          (config number) .shared 100 100 100 100 100 with
+      | .error error => .error (.compilation error)
+      | .ok attached =>
+          match selection : Select.select attached.target.artifact.program with
+          | .error error => .error (.selection error)
+          | .ok selected => .ok { sourceRoot, addressed, attached, compiled, selected, selection }
+
+def Compiled.ir1Root {number : Nat} (compiled : Compiled number) : Address :=
+  IxIR1.Optimizer.graphRoot compiled.attached.source.artifact.targetArtifacts
+    compiled.attached.source.artifact.main
+
+def Compiled.provenance {number : Nat} (compiled : Compiled number) : ELF.Provenance :=
+  .ixir1Policy compiled.ir1Root loweringVersion passPolicyVersion
+
+private def scalar (value : IxIR1.RVal) : Except String Word :=
+  match value with
+  | .lit (.nat number) =>
+      let word := UInt64.ofNat number
+      if word.toNat == number then .ok word else .error "scalar result exceeds 64 bits"
+  | _ => .error "intermediate execution returned a non-Nat value"
+
+/-- Execute the source and every intermediate observation used by the native
+gate. These operational checks accompany the generic theorem in PipelineSim. -/
+def Compiled.observe {number : Nat} (compiled : Compiled number) : Except String Word := do
+  let constants := [(compiled.sourceRoot, constant number)]
+  let sourceNumber ← match Ixon.Eval.eval (Pipeline.validatedEvalCtx constants (config number))
+      100 (Pipeline.validatedMainFrame compiled.sourceRoot) [] Pipeline.validatedMainSource with
+    | .ok (.litV (.natL result)) => pure result
+    | _ => throw "Ixon scalar execution failed"
+  let artifact := compiled.attached.source.artifact
+  let rawValue ← match IxIR0.eval { env := IxIR0.Env.ofList artifact.rawErasedDecls }
+      100 [] (.ref compiled.sourceRoot) with
+    | .ok (.lit (.nat result)) => pure result
+    | _ => throw "raw IxIR₀ scalar execution failed"
+  let addressedValue ← match IxIR0.eval { env := IxIR0.Env.ofList artifact.erasedDecls }
+      100 [] compiled.attached.source.erasure.result.main with
+    | .ok (.lit (.nat result)) => pure result
+    | _ => throw "addressed IxIR₀ scalar execution failed"
+  let (ir1Store, ir1Value) ← match IxIR1.runOwnedMain
+      { decls := artifact.targetDeclEnv } .shared artifact.main 100 with
+    | .ok output => pure output
+    | .error _ => throw "addressed IxIR₁ scalar execution failed"
+  let ir1Word ← scalar ir1Value
+  let program := compiled.attached.target.artifact.program
+  let context := IxIR2.Eval.Context.ofProgram program
+    compiled.attached.target.artifact.validationContext.schemas
+  for interpretation in [IxIR2.Eval.Interpretation.logical, .physical] do
+    let result ← match IxIR2.Eval.runMain context interpretation program 6 2 with
+      | .ok result => pure result
+      | .error error => throw s!"IxIR₂ scalar execution failed: {repr error}"
+    let word ← scalar result.value
+    if word != ir1Word || result.controlRemaining != 0 || result.heapRemaining != 0 ||
+        result.store.heap.allocs != 1 || result.store.heap.frees != 1 ||
+        result.store.heap.rcops != 1 || result.store.heap.reuses != 0 ||
+        result.store.live != 0 || result.store.peakLiveNodes != 1 ||
+        result.store.resetAttempts != 0 || result.store.hotResets != 0 ||
+        result.store.coldResets != 0 || result.store.reusedPayloadUnits != 0 then
+      throw "IxIR₂ scalar observation or counters drifted"
+  if sourceNumber != number || rawValue != number || addressedValue != number ||
+      ir1Word.toNat != number || compiled.selected.word != ir1Word ||
+      ir1Store.allocs != 1 || ir1Store.frees != 1 || ir1Store.rcops != 1 ||
+      ir1Store.reuses != 0 || ir1Store.live != 0 then
+    throw "source and intermediate scalar observations disagree"
+  let localResult := X86.runFrom X86.Runtime.rejecting compiled.selected.target 2 (X86.Core.empty 0x1008)
+  if localResult.status != .halted ir1Word || localResult.core.readReg .rsp != 0x1008 then
+    throw "selected local x86 execution disagrees with the source"
+  return ir1Word
+
+/-- A bare unique literal cannot satisfy the existing shared constant result
+policy. Keep the exact source rejection visible before selection. -/
+def rejectsBareLiteral (number : Nat) : Bool :=
+  let source := constant number false
+  match source.address? with
+  | none => false
+  | some root =>
+      match IxIR2.Pipeline.compileValidated [(root, source)] root
+          (config number) .shared 100 100 100 100 100 with
+      | .error (.pipeline (.usage address .freezeNeeded)) => address == root
+      | _ => false
+
+def rejectsOverflow : Bool :=
+  match compile UInt64.size with
+  | .error (.selection .unsupportedScalarShape) => true
+  | _ => false
+
+end Ix.Compiler.X86.ValidatedScalar
diff --git a/Ix/Compiler/X86/WordRegion.lean b/Ix/Compiler/X86/WordRegion.lean
new file mode 100644
index 000000000..894ff37c1
--- /dev/null
+++ b/Ix/Compiler/X86/WordRegion.lean
@@ -0,0 +1,117 @@
+import Ix.Compiler.X86.Execution
+
+/-! An aligned finite word region over the existing byte memory. This view is
+used for scalar stack frames, including saved registers and return slots.
+Every access has a concrete capacity and nonwrapping-address proof. -/
+
+namespace Ix.Compiler.X86.WordRegion
+
+structure Layout where
+  base : Word
+  slots : Nat
+  aligned : base % 8 = 0
+  fits : base.toNat + 8 * slots ≤ UInt64.size
+
+def Layout.address (layout : Layout) (slot : Nat) : Word :=
+  layout.base + UInt64.ofNat (8 * slot)
+
+theorem Layout.address_toNat (layout : Layout) {slot : Nat} (bound : slot < layout.slots) :
+    (layout.address slot).toNat = layout.base.toNat + 8 * slot := by
+  have fits := layout.fits
+  have small : layout.base.toNat + 8 * slot < UInt64.size := by omega
+  rw [Layout.address, UInt64.toNat_add, UInt64.toNat_ofNat_of_lt' (by omega)]
+  exact Nat.mod_eq_of_lt small
+
+theorem Layout.address_aligned (layout : Layout) {slot : Nat} (bound : slot < layout.slots) :
+    layout.address slot % 8 = 0 := by
+  apply UInt64.toNat_inj.mp
+  have aligned := congrArg UInt64.toNat layout.aligned
+  simp only [UInt64.toNat_mod] at aligned ⊢
+  change layout.base.toNat % 8 = 0 at aligned
+  change (layout.address slot).toNat % 8 = 0
+  rw [layout.address_toNat bound]
+  omega
+
+theorem Layout.address_injective (layout : Layout) {left right : Nat}
+    (leftBound : left < layout.slots) (rightBound : right < layout.slots)
+    (equal : layout.address left = layout.address right) : left = right := by
+  have same := congrArg UInt64.toNat equal
+  rw [layout.address_toNat leftBound, layout.address_toNat rightBound] at same
+  omega
+
+theorem Layout.byteAddress_toNat (layout : Layout) {slot offset : Nat}
+    (slotBound : slot < layout.slots) (offsetBound : offset < 8) :
+    (layout.address slot + UInt64.ofNat offset).toNat = layout.base.toNat + 8 * slot + offset := by
+  have fits := layout.fits
+  have small : layout.base.toNat + 8 * slot + offset < UInt64.size := by omega
+  rw [UInt64.toNat_add, layout.address_toNat slotBound, UInt64.toNat_ofNat_of_lt' (by omega)]
+  exact Nat.mod_eq_of_lt small
+
+def Layout.allowed (layout : Layout) (address : Word) : Bool :=
+  decide (layout.base.toNat ≤ address.toNat ∧ address.toNat < layout.base.toNat + 8 * layout.slots)
+
+theorem Layout.byteAllowed (layout : Layout) {slot offset : Nat}
+    (slotBound : slot < layout.slots) (offsetBound : offset < 8) :
+    layout.allowed (layout.address slot + UInt64.ofNat offset) = true := by
+  simp only [Layout.allowed, decide_eq_true_eq, layout.byteAddress_toNat slotBound offsetBound]
+  omega
+
+theorem Layout.subtract (layout : Layout) {slot count : Nat} (enough : count ≤ slot) :
+    layout.address slot - UInt64.ofNat (8 * count) = layout.address (slot - count) := by
+  have split : 8 * slot = 8 * (slot - count) + 8 * count := by omega
+  simp only [Layout.address]
+  rw [split, UInt64.ofNat_add, ← UInt64.add_assoc, UInt64.add_sub_cancel]
+
+theorem Layout.add (layout : Layout) (slot count : Nat) :
+    layout.address slot + UInt64.ofNat (8 * count) = layout.address (slot + count) := by
+  simp [Layout.address, Nat.mul_add, UInt64.ofNat_add, UInt64.add_assoc]
+
+abbrev Words := Nat → Word
+
+def Words.set (words : Words) (slot : Nat) (value : Word) : Words :=
+  fun candidate => if candidate == slot then value else words candidate
+
+@[simp] theorem Words.set_same (words : Words) (slot : Nat) (value : Word) :
+    words.set slot value slot = value := by simp [Words.set]
+
+@[simp] theorem Words.set_other (words : Words) (slot other : Nat) (value : Word)
+    (different : other ≠ slot) : words.set slot value other = words other := by
+  simp [Words.set, different]
+
+structure Realizes (layout : Layout) (outside : Memory) (words : Words) (memory : Memory) : Prop where
+  view : ∀ slot < layout.slots, memory.read64 (layout.address slot) = words slot
+  readable : ∀ slot < layout.slots, Memory.rangeAllowed memory.readable (layout.address slot) 8 = true
+  writable : ∀ slot < layout.slots, Memory.rangeAllowed memory.writable (layout.address slot) 8 = true
+  frame : ∀ address, layout.allowed address = false → memory.bytes address = outside.bytes address
+
+theorem Realizes.write64 {layout : Layout} {outside memory : Memory} {words : Words}
+    (represented : Realizes layout outside words memory) {slot : Nat} (bound : slot < layout.slots)
+    (value : Word) :
+    Realizes layout outside (words.set slot value) (memory.write64 (layout.address slot) value) := by
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · intro other otherBound
+    by_cases same : other = slot
+    · subst other
+      simp [Memory.read64_write64]
+    · rw [Memory.read64_write64_ne _ _ _ _ (layout.address_aligned bound)
+        (layout.address_aligned otherBound) (fun equal => same (layout.address_injective otherBound bound equal))]
+      simp [represented.view other otherBound, same]
+  · simpa using represented.readable
+  · simpa using represented.writable
+  · intro address notAllowed
+    rw [Memory.write64_bytes_outside]
+    · exact represented.frame address notAllowed
+    · intro offset offsetBound same
+      have allowed := layout.byteAllowed bound offsetBound
+      rw [← same, notAllowed] at allowed
+      contradiction
+
+/-- No initialization of scratch slots is required by the native interface:
+the word view can be read from any sufficiently mapped initial byte memory. -/
+theorem realizes_initial (layout : Layout) (memory : Memory)
+    (readable : ∀ slot < layout.slots, Memory.rangeAllowed memory.readable (layout.address slot) 8 = true)
+    (writable : ∀ slot < layout.slots, Memory.rangeAllowed memory.writable (layout.address slot) 8 = true) :
+    Realizes layout memory (fun slot => memory.read64 (layout.address slot)) memory :=
+  ⟨fun _ _ => rfl, readable, writable, fun _ _ => rfl⟩
+
+end Ix.Compiler.X86.WordRegion
diff --git a/Ix/Compiler/X86/WordRegionExecution.lean b/Ix/Compiler/X86/WordRegionExecution.lean
new file mode 100644
index 000000000..b8590f442
--- /dev/null
+++ b/Ix/Compiler/X86/WordRegionExecution.lean
@@ -0,0 +1,153 @@
+import Ix.Compiler.X86.WordRegion
+import Ix.Compiler.X86.FrameExecution
+
+namespace Ix.Compiler.X86.WordRegion
+
+structure State where
+  registers : Registers
+  words : Words
+
+def State.core (state : State) (memory : Memory) : Core := ⟨state.registers, memory⟩
+def State.setReg (state : State) (register : GPR) (value : Word) : State :=
+  { state with registers := state.registers.set register value }
+def State.setWord (state : State) (slot : Nat) (value : Word) : State :=
+  { state with words := state.words.set slot value }
+def State.move (state : State) (source : MoveSource) : Word := source.eval (state.core Memory.unmapped)
+def State.alu (state : State) (source : AluSource) : Word := source.eval (state.core Memory.unmapped)
+
+@[simp] theorem State.move_core (state : State) (memory : Memory) (source : MoveSource) :
+    source.eval (state.core memory) = state.move source := by cases source <;> rfl
+@[simp] theorem State.alu_core (state : State) (memory : Memory) (source : AluSource) :
+    source.eval (state.core memory) = state.alu source := by cases source <;> rfl
+@[simp] theorem State.setReg_registers (state : State) (register candidate : GPR) (value : Word) :
+    (state.setReg register value).registers candidate =
+      if candidate == register then value else state.registers candidate := rfl
+@[simp] theorem State.setWord_registers (state : State) (slot : Nat) (value : Word) :
+    (state.setWord slot value).registers = state.registers := rfl
+@[simp] theorem State.setReg_words (state : State) (register : GPR) (value : Word) :
+    (state.setReg register value).words = state.words := rfl
+@[simp] theorem State.setWord_words (state : State) (slot : Nat) (value : Word) :
+    (state.setWord slot value).words = state.words.set slot value := rfl
+@[simp] theorem State.move_imm (state : State) (value : Word) : state.move (.imm value) = value := rfl
+@[simp] theorem State.move_reg (state : State) (register : GPR) :
+    state.move (.reg register) = state.registers register := rfl
+@[simp] theorem State.alu_reg (state : State) (register : GPR) :
+    state.alu (.reg register) = state.registers register := rfl
+
+@[simp] theorem State.setReg_setReg (state : State) (register : GPR) (first second : Word) :
+    (state.setReg register first).setReg register second = state.setReg register second := by
+  simp [State.setReg]
+
+/-- Each memory effect supplies its finite slot and actual effective address. -/
+inductive Effect (layout : Layout) : Instr → State → State → Prop where
+  | mov (state : State) (destination : GPR) (source : MoveSource) :
+      Effect layout (.mov .w64 destination source) state (state.setReg destination (state.move source))
+  | alu (state : State) (operation : AluOp) (destination : GPR) (source : AluSource) :
+      Effect layout (.alu operation .w64 destination source) state
+        (state.setReg destination (operation.eval (state.registers destination) (state.alu source)))
+  | push (state : State) (source : GPR) (slot : Nat) (bound : slot < layout.slots)
+      (address : state.registers .rsp - 8 = layout.address slot) :
+      Effect layout (.push source) state
+        ((state.setReg .rsp (layout.address slot)).setWord slot (state.registers source))
+  | pop (state : State) (destination : GPR) (slot : Nat) (bound : slot < layout.slots)
+      (address : state.registers .rsp = layout.address slot) :
+      Effect layout (.pop destination) state
+        ((state.setReg .rsp (layout.address slot + 8)).setReg destination (state.words slot))
+  | allocFrame (state : State) (size : FrameSize) :
+      Effect layout (.allocFrame size) state (state.setReg .rsp (state.registers .rsp - size.bytes))
+  | freeFrame (state : State) (size : FrameSize) :
+      Effect layout (.freeFrame size) state (state.setReg .rsp (state.registers .rsp + size.bytes))
+  | spill (state : State) (destination : StackSlot) (source : GPR) (slot : Nat)
+      (bound : slot < layout.slots)
+      (address : state.registers .rbp - destination.displacement = layout.address slot) :
+      Effect layout (.spill destination source) state (state.setWord slot (state.registers source))
+  | reload (state : State) (destination : GPR) (source : StackSlot) (slot : Nat)
+      (bound : slot < layout.slots)
+      (address : state.registers .rbp - source.displacement = layout.address slot) :
+      Effect layout (.reload destination source) state (state.setReg destination (state.words slot))
+
+inductive Trace (layout : Layout) : List Instr → State → State → Prop where
+  | nil (state) : Trace layout [] state state
+  | cons {instruction : Instr} {instructions : List Instr} {before middle after : State}
+      (first : Effect layout instruction before middle) (rest : Trace layout instructions middle after) :
+      Trace layout (instruction :: instructions) before after
+
+theorem Trace.append {layout : Layout} {left right : List Instr} {before middle after : State}
+    (first : Trace layout left before middle) (second : Trace layout right middle after) :
+    Trace layout (left ++ right) before after := by
+  induction first with
+  | nil => exact second
+  | cons first rest ih => exact .cons first (ih second)
+
+theorem Effect.sound {layout : Layout} {instruction : Instr} {before after : State}
+    (effect : Effect layout instruction before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Straight.Effect instruction (before.core memory) (after.core nextMemory) := by
+  cases effect with
+  | mov _ destination source =>
+      refine ⟨memory, represented, ?_⟩
+      have effect := Straight.Effect.mov (before.core memory) destination source
+      rw [State.move_core] at effect
+      exact effect
+  | alu _ operation destination source =>
+      refine ⟨memory, represented, ?_⟩
+      have effect := Straight.Effect.alu (before.core memory) operation destination source
+      rw [State.alu_core] at effect
+      exact effect
+  | push _ source slot bound address =>
+      refine ⟨memory.write64 (layout.address slot) (before.registers source), represented.write64 bound _, ?_⟩
+      have allowed : Memory.rangeAllowed memory.writable (before.registers .rsp - 8) 8 = true :=
+        address ▸ represented.writable slot bound
+      have effect := Straight.Effect.push (before.core memory) source allowed
+      simpa only [State.core, Core.readReg, State.setReg, State.setWord, Core.setReg, address] using effect
+  | pop _ destination slot bound address =>
+      refine ⟨memory, represented, ?_⟩
+      have allowed : Memory.rangeAllowed memory.readable (before.registers .rsp) 8 = true :=
+        address ▸ represented.readable slot bound
+      have loaded : memory.read64 (before.registers .rsp) = before.words slot :=
+        address ▸ represented.view slot bound
+      have effect := Straight.Effect.pop (before.core memory) destination (before.words slot) allowed loaded
+      simpa only [State.core, Core.readReg, State.setReg, Core.setReg, address] using effect
+  | allocFrame _ size => exact ⟨memory, represented, Straight.Effect.allocFrame _ size⟩
+  | freeFrame _ size => exact ⟨memory, represented, Straight.Effect.freeFrame _ size⟩
+  | spill _ destination source slot bound address =>
+      refine ⟨memory.write64 (layout.address slot) (before.registers source), represented.write64 bound _, ?_⟩
+      have allowed : Memory.rangeAllowed memory.writable (before.registers .rbp - destination.displacement) 8 = true :=
+        address ▸ represented.writable slot bound
+      have effect := Straight.Effect.spill (before.core memory) destination source allowed
+      simpa only [State.core, Core.readReg, State.setWord, address] using effect
+  | reload _ destination source slot bound address =>
+      refine ⟨memory, represented, ?_⟩
+      have allowed : Memory.rangeAllowed memory.readable (before.registers .rbp - source.displacement) 8 = true :=
+        address ▸ represented.readable slot bound
+      have loaded : memory.read64 (before.registers .rbp - source.displacement) = before.words slot :=
+        address ▸ represented.view slot bound
+      have effect := Straight.Effect.reload (before.core memory) destination source (before.words slot) allowed loaded
+      exact effect
+
+theorem Trace.sound {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Straight.Sequence instructions (before.core memory) (after.core nextMemory) := by
+  induction trace generalizing memory with
+  | nil state => exact ⟨memory, represented, .nil _⟩
+  | cons first rest ih =>
+      obtain ⟨middle, middleView, one⟩ := first.sound outside memory represented
+      obtain ⟨finalMemory, finalView, following⟩ := ih middle middleView
+      exact ⟨finalMemory, finalView, .cons one following⟩
+
+theorem Trace.steps {layout : Layout} {instructions : List Instr} {before after : State}
+    (trace : Trace layout instructions before after) (outside memory : Memory)
+    (represented : Realizes layout outside before.words memory) (runtime : Runtime) (checked : Checked)
+    (block : BlockId) (offset : Nat) (returns : List ReturnFrame)
+    (segment : Straight.Segment checked block offset instructions)
+    (fits : offset + instructions.length < UInt32.size) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Steps runtime checked instructions.length (inFrame (before.core memory) block offset returns)
+        (inFrame (after.core nextMemory) block (offset + instructions.length) returns) := by
+  obtain ⟨nextMemory, finalView, sequence⟩ := trace.sound outside memory represented
+  exact ⟨nextMemory, finalView, sequence.steps_inFrame runtime checked block offset returns segment fits⟩
+
+end Ix.Compiler.X86.WordRegion
diff --git a/Ix/Compiler/X86/WordRegionSafeCalls.lean b/Ix/Compiler/X86/WordRegionSafeCalls.lean
new file mode 100644
index 000000000..610257a7f
--- /dev/null
+++ b/Ix/Compiler/X86/WordRegionSafeCalls.lean
@@ -0,0 +1,40 @@
+import Ix.Compiler.X86.WordRegionSafeControl
+
+namespace Ix.Compiler.X86.WordRegion
+
+def State.call (layout : Layout) (state : State) (slot : Nat) (block : BlockId) (offset : Nat) : State :=
+  (state.setReg .rsp (layout.address slot)).setWord slot (PC.mk block (UInt32.ofNat (offset + 1))).encode
+
+theorem call_safeStep {layout : Layout} {outside memory : Memory} {state : State} {index : Nat}
+    {checked : Checked} {block target : BlockId} {offset : Nat} {returns : List ReturnFrame} {holes : Stream.Holes}
+    (represented : Realizes layout outside state.words memory) (bound : index < layout.slots)
+    (address : state.registers .rsp - 8 = layout.address index)
+    (segment : Straight.Segment checked block offset [.call target])
+    (fits : offset + 1 < UInt32.size) (valid : checked.program.hasBlock target = true)
+    (aligned : SysV.callSiteAligned (state.registers .rsp) = true)
+    (disjoint : Stream.FramesDisjoint returns (layout.address index) 8) :
+    ∃ nextMemory, Realizes layout outside (state.call layout index block offset).words nextMemory ∧
+      Stream.SafeSteps Runtime.rejecting checked 1 holes (inFrame (state.core memory) block offset returns)
+        (Stream.addRange holes (layout.address index) 8)
+        (inFrame ((state.call layout index block offset).core nextMemory) target 0
+          (callFrame (state.core memory) block offset :: returns)) := by
+  let nextMemory := memory.write64 (layout.address index) (PC.mk block (UInt32.ofNat (offset + 1))).encode
+  have writable := represented.writable index bound
+  have one := call_inFrame segment fits valid Runtime.rejecting (state.core memory) returns aligned
+    (by simpa only [State.core, Core.readReg, address] using writable)
+  have effect : callCore (state.core memory) block offset = (state.call layout index block offset).core nextMemory := by
+    simp [callCore, callFrame, State.core, Core.readReg, State.call, State.setReg, State.setWord, Core.setReg, address, nextMemory]
+  rw [effect] at one
+  obtain ⟨code, found, reads⟩ := segment
+  have head := reads 0 (by simp)
+  simp only [Nat.add_zero, List.getElem?_cons_zero] at head
+  have safe : Stream.SafeAt checked.program holes (inFrame (state.core memory) block offset returns) := by
+    simp [Stream.SafeAt, inFrame, UInt32.toNat_ofNat_of_lt' (by omega : offset < UInt32.size), found, head,
+      State.core, Core.readReg, address, aligned, writable, disjoint]
+  have changed : Stream.holeStep checked.program (inFrame (state.core memory) block offset returns) holes =
+      Stream.addRange holes (layout.address index) 8 := by
+    simp [Stream.holeStep, inFrame, UInt32.toNat_ofNat_of_lt' (by omega : offset < UInt32.size), found, head,
+      State.core, Core.readReg, address]
+  exact ⟨nextMemory, represented.write64 bound _, by simpa only [changed] using Stream.SafeSteps.single safe one⟩
+
+end Ix.Compiler.X86.WordRegion
diff --git a/Ix/Compiler/X86/WordRegionSafeControl.lean b/Ix/Compiler/X86/WordRegionSafeControl.lean
new file mode 100644
index 000000000..ff5291b17
--- /dev/null
+++ b/Ix/Compiler/X86/WordRegionSafeControl.lean
@@ -0,0 +1,45 @@
+import Ix.Compiler.X86.WordRegionSafeTrace
+import Ix.Compiler.X86.SafeControl
+
+namespace Ix.Compiler.X86.WordRegion
+
+theorem State.compare_core (state : State) (memory : Memory) (comparison : Compare) (condition : Condition) :
+    comparison.holds condition (state.core memory) = comparison.holds condition (state.core Memory.unmapped) := by
+  cases comparison.right <;> rfl
+
+theorem SafeTrace.jump {layout : Layout} {returns : List ReturnFrame} {instructions : List Instr}
+    {before after : State} {holes finalHoles : Stream.Holes}
+    (trace : SafeTrace layout returns instructions before holes after finalHoles)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (checked : Checked) (block target : BlockId) (code : BlockCode checked block instructions (.jump target))
+    (valid : checked.program.hasBlock target = true) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Stream.SafeSteps Runtime.rejecting checked (instructions.length + 1)
+        holes (inFrame (before.core memory) block 0 returns)
+        finalHoles (inFrame (after.core nextMemory) target 0 returns) := by
+  obtain ⟨nextMemory, nextView, executed⟩ := trace.steps outside memory represented Runtime.rejecting checked block 0
+    code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at executed
+  refine ⟨nextMemory, nextView, ?_⟩
+  exact executed.append (code.safe_jump valid Runtime.rejecting (after.core nextMemory) returns finalHoles)
+
+theorem SafeTrace.branch {layout : Layout} {returns : List ReturnFrame} {instructions : List Instr}
+    {before after : State} {holes finalHoles : Stream.Holes}
+    (trace : SafeTrace layout returns instructions before holes after finalHoles)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (checked : Checked) (block yes no : BlockId) (comparison : Compare) (condition : Condition)
+    (code : BlockCode checked block instructions (.branch comparison condition yes no))
+    (answer : Bool) (holds : comparison.holds condition (after.core Memory.unmapped) = answer)
+    (valid : checked.program.hasBlock (if answer then yes else no) = true) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Stream.SafeSteps Runtime.rejecting checked (instructions.length + 1)
+        holes (inFrame (before.core memory) block 0 returns)
+        finalHoles (inFrame (after.core nextMemory) (if answer then yes else no) 0 returns) := by
+  obtain ⟨nextMemory, nextView, executed⟩ := trace.steps outside memory represented Runtime.rejecting checked block 0
+    code.segment (by simpa using code.fits)
+  simp only [Nat.zero_add] at executed
+  refine ⟨nextMemory, nextView, ?_⟩
+  exact executed.append (code.safe_branch Runtime.rejecting (after.core nextMemory) returns finalHoles answer
+    ((after.compare_core nextMemory comparison condition).trans holds) valid)
+
+end Ix.Compiler.X86.WordRegion
diff --git a/Ix/Compiler/X86/WordRegionSafeMacros.lean b/Ix/Compiler/X86/WordRegionSafeMacros.lean
new file mode 100644
index 000000000..de93ba0b0
--- /dev/null
+++ b/Ix/Compiler/X86/WordRegionSafeMacros.lean
@@ -0,0 +1,80 @@
+import Ix.Compiler.X86.WordRegionSafeTrace
+
+namespace Ix.Compiler.X86.WordRegion
+
+theorem SafeTrace.mov (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (destination : GPR) (source : MoveSource) :
+    SafeTrace layout returns [.mov .w64 destination source] state holes
+      (state.setReg destination (state.move source)) holes :=
+  .cons (.mov _ _ _) ⟨trivial, trivial⟩ (.nil _ _)
+
+theorem SafeTrace.alu (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (operation : AluOp) (destination : GPR) (source : AluSource) :
+    SafeTrace layout returns [.alu operation .w64 destination source] state holes
+      (state.setReg destination (operation.eval (state.registers destination) (state.alu source))) holes :=
+  .cons (.alu _ _ _ _) ⟨trivial, trivial⟩ (.nil _ _)
+
+theorem SafeTrace.allocFrame (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (size : FrameSize) :
+    SafeTrace layout returns [.allocFrame size] state holes
+      (state.setReg .rsp (state.registers .rsp - size.bytes)) holes :=
+  .cons (.allocFrame _ _) ⟨trivial, trivial⟩ (.nil _ _)
+
+theorem SafeTrace.freeFrame (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (size : FrameSize) :
+    SafeTrace layout returns [.freeFrame size] state holes
+      (state.setReg .rsp (state.registers .rsp + size.bytes)) holes :=
+  .cons (.freeFrame _ _) ⟨trivial, trivial⟩ (.nil _ _)
+
+theorem SafeTrace.reload (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (destination : GPR) (source : StackSlot) (index : Nat)
+    (bound : index < layout.slots)
+    (address : state.registers .rbp - source.displacement = layout.address index)
+    (readable : Stream.ReadableData holes (layout.address index) 8) :
+    SafeTrace layout returns [.reload destination source] state holes
+      (state.setReg destination (state.words index)) holes := by
+  refine .cons (.reload _ _ _ _ bound address) ?_ (.nil _ _)
+  simpa [Stream.OperationSafe, Stream.operationReads, Stream.operationWrites, Encode.instructionOperation,
+    Encode.spillAddress_eval, State.core, Core.readReg, address, Width.bytes] using readable
+
+theorem SafeTrace.spill (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (destination : StackSlot) (source : GPR) (index : Nat)
+    (bound : index < layout.slots)
+    (address : state.registers .rbp - destination.displacement = layout.address index)
+    (disjoint : Stream.FramesDisjoint returns (layout.address index) 8) :
+    SafeTrace layout returns [.spill destination source] state holes
+      (state.setWord index (state.registers source)) (Stream.clearRange holes (layout.address index) 8) := by
+  refine .cons (.spill _ _ _ _ bound address) ?_ ?_
+  · simpa [Stream.OperationSafe, Stream.operationReads, Stream.operationWrites, Encode.instructionOperation,
+      Encode.spillAddress_eval, State.core, Core.readReg, address, Width.bytes] using disjoint
+  · simpa [Stream.nextHoles, Stream.operationWrites, Encode.instructionOperation,
+      Encode.spillAddress_eval, State.core, Core.readReg, address, Width.bytes] using
+      SafeTrace.nil (layout := layout) (returns := returns) (state.setWord index (state.registers source))
+        (Stream.clearRange holes (layout.address index) 8)
+
+theorem SafeTrace.push (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (source : GPR) (index : Nat) (bound : index < layout.slots)
+    (address : state.registers .rsp - 8 = layout.address index)
+    (disjoint : Stream.FramesDisjoint returns (layout.address index) 8) :
+    SafeTrace layout returns [.push source] state holes
+      ((state.setReg .rsp (layout.address index)).setWord index (state.registers source))
+      (Stream.clearRange holes (layout.address index) 8) := by
+  refine .cons (.push _ _ _ bound address) ?_ ?_
+  · simpa [Stream.OperationSafe, Stream.operationReads, Stream.operationWrites, Encode.instructionOperation,
+      State.core, Core.readReg, address] using disjoint
+  · simpa [Stream.nextHoles, Stream.operationWrites, Encode.instructionOperation,
+      State.core, Core.readReg, address] using SafeTrace.nil (layout := layout) (returns := returns)
+      ((state.setReg .rsp (layout.address index)).setWord index (state.registers source))
+      (Stream.clearRange holes (layout.address index) 8)
+
+theorem SafeTrace.pop (layout : Layout) (returns : List ReturnFrame) (state : State)
+    (holes : Stream.Holes) (destination : GPR) (index : Nat) (bound : index < layout.slots)
+    (address : state.registers .rsp = layout.address index)
+    (readable : Stream.ReadableData holes (layout.address index) 8) :
+    SafeTrace layout returns [.pop destination] state holes
+      ((state.setReg .rsp (layout.address index + 8)).setReg destination (state.words index)) holes := by
+  refine .cons (.pop _ _ _ bound address) ?_ (.nil _ _)
+  simpa [Stream.OperationSafe, Stream.operationReads, Stream.operationWrites, Encode.instructionOperation,
+    State.core, Core.readReg, address] using readable
+
+end Ix.Compiler.X86.WordRegion
diff --git a/Ix/Compiler/X86/WordRegionSafeTrace.lean b/Ix/Compiler/X86/WordRegionSafeTrace.lean
new file mode 100644
index 000000000..c048f6ef8
--- /dev/null
+++ b/Ix/Compiler/X86/WordRegionSafeTrace.lean
@@ -0,0 +1,88 @@
+import Ix.Compiler.X86.WordRegionExecution
+import Ix.Compiler.X86.SafeSteps
+
+namespace Ix.Compiler.X86.WordRegion
+
+theorem Effect.linear {layout : Layout} {instruction : Instr} {before after : State}
+    (effect : Effect layout instruction before after) : Encode.linearInstruction instruction = true := by
+  cases effect <;> rfl
+
+theorem operationSafe_memory (instruction : Instr) (state : State) (memory : Memory)
+    (holes : Stream.Holes) (returns : List ReturnFrame) :
+    Stream.OperationSafe holes returns (Encode.instructionOperation instruction) (state.core memory) =
+      Stream.OperationSafe holes returns (Encode.instructionOperation instruction) (state.core Memory.unmapped) := by
+  cases instruction <;> rfl
+
+theorem nextHoles_memory (instruction : Instr) (state : State) (memory : Memory) (holes : Stream.Holes) :
+    Stream.nextHoles holes (Encode.instructionOperation instruction) (state.core memory) =
+      Stream.nextHoles holes (Encode.instructionOperation instruction) (state.core Memory.unmapped) := by
+  cases instruction <;> rfl
+
+inductive SafeTrace (layout : Layout) (returns : List ReturnFrame) :
+    List Instr → State → Stream.Holes → State → Stream.Holes → Prop where
+  | nil (state : State) (holes : Stream.Holes) : SafeTrace layout returns [] state holes state holes
+  | cons {instruction : Instr} {instructions : List Instr} {before middle after : State}
+      {holes finalHoles : Stream.Holes}
+      (effect : Effect layout instruction before middle)
+      (access : Stream.OperationSafe holes returns (Encode.instructionOperation instruction) (before.core Memory.unmapped))
+      (rest : SafeTrace layout returns instructions middle
+        (Stream.nextHoles holes (Encode.instructionOperation instruction) (before.core Memory.unmapped)) after finalHoles) :
+      SafeTrace layout returns (instruction :: instructions) before holes after finalHoles
+
+theorem SafeTrace.append {layout : Layout} {returns : List ReturnFrame} {left right : List Instr}
+    {before middle after : State} {holes middleHoles finalHoles : Stream.Holes}
+    (first : SafeTrace layout returns left before holes middle middleHoles)
+    (second : SafeTrace layout returns right middle middleHoles after finalHoles) :
+    SafeTrace layout returns (left ++ right) before holes after finalHoles := by
+  induction first with
+  | nil => exact second
+  | cons effect access rest ih => exact .cons effect access (ih second)
+
+theorem SafeTrace.trace {layout : Layout} {returns : List ReturnFrame} {instructions : List Instr}
+    {before after : State} {holes finalHoles : Stream.Holes}
+    (safe : SafeTrace layout returns instructions before holes after finalHoles) :
+    Trace layout instructions before after := by
+  induction safe with
+  | nil => exact .nil _
+  | cons effect _ _ ih => exact .cons effect ih
+
+theorem SafeTrace.steps {layout : Layout} {returns : List ReturnFrame} {instructions : List Instr}
+    {before after : State} {holes finalHoles : Stream.Holes}
+    (safe : SafeTrace layout returns instructions before holes after finalHoles)
+    (outside memory : Memory) (represented : Realizes layout outside before.words memory)
+    (runtime : Runtime) (checked : Checked) (block : BlockId) (offset : Nat)
+    (segment : Straight.Segment checked block offset instructions)
+    (fits : offset + instructions.length < UInt32.size) :
+    ∃ nextMemory, Realizes layout outside after.words nextMemory ∧
+      Stream.SafeSteps runtime checked instructions.length holes (inFrame (before.core memory) block offset returns)
+        finalHoles (inFrame (after.core nextMemory) block (offset + instructions.length) returns) := by
+  induction safe generalizing memory offset with
+  | nil state holes => exact ⟨memory, represented, Stream.SafeSteps.refl _ _⟩
+  | @cons instruction instructions before middle after holes finalHoles effect access rest ih =>
+      obtain ⟨nextMemory, nextView, executed⟩ := effect.sound outside memory represented
+      obtain ⟨code, found, reads⟩ := segment
+      have offsetBound : offset < UInt32.size := by simp only [List.length_cons] at fits; omega
+      have head := reads 0 (by simp)
+      simp only [Nat.add_zero, List.getElem?_cons_zero] at head
+      have foundAt : checked.program.blocks[(inFrame (before.core memory) block offset returns).pc.block.toNat]? =
+          some code := found
+      have headAt : code.instructions[(inFrame (before.core memory) block offset returns).pc.offset.toNat]? =
+          some instruction := by simpa only [inFrame, UInt32.toNat_ofNat_of_lt' offsetBound] using head
+      have one : step runtime checked (inFrame (before.core memory) block offset returns) =
+          inFrame (middle.core nextMemory) block (offset + 1) returns := by
+        simp only [step, inFrame, UInt32.toNat_ofNat_of_lt' offsetBound, found, head]
+        rw [executed runtime checked _ rfl]
+        exact inFrame_advance _ _ _ _ (by simp only [List.length_cons] at fits; omega)
+      have safeAt : Stream.SafeAt checked.program holes (inFrame (before.core memory) block offset returns) := by
+        apply Stream.safeAt_linear foundAt headAt effect.linear
+        exact (operationSafe_memory instruction before memory holes returns).symm ▸ access
+      have changed := Stream.holeStep_linear (holes := holes) foundAt headAt effect.linear
+      rw [show (inFrame (before.core memory) block offset returns).core = before.core memory from rfl,
+        nextHoles_memory] at changed
+      obtain ⟨finalMemory, finalView, remaining⟩ := ih nextMemory nextView (offset + 1)
+        (Straight.Segment.tail ⟨code, found, reads⟩) (by simp only [List.length_cons] at fits; omega)
+      refine ⟨finalMemory, finalView, ?_⟩
+      rw [← changed] at remaining
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using Stream.SafeSteps.cons safeAt one remaining
+
+end Ix.Compiler.X86.WordRegion
diff --git a/Ix/Environment.lean b/Ix/Environment.lean
index 4bb2c6c3f..6726d69c6 100644
--- a/Ix/Environment.lean
+++ b/Ix/Environment.lean
@@ -114,7 +114,7 @@ instance : ToString Name where
 /-- Dot-separated bare rendering — byte-for-byte mirror of the Rust
     `Name::pretty` (str components verbatim, num components as plain
     digits, NO `«»` escaping). The kernel's canonical aux ordering seeds
-    on this exact string (`Ix.Tc.canonicalAuxOrder` ↔ Rust
+    on this exact string (`Ix.Kernel.canonicalAuxOrder` ↔ Rust
     `canonical_aux_order`), so `toString` (which escapes nums as `«n»`)
     must not be substituted there. -/
 partial def pretty : Name → String
diff --git a/Ix/IxVM/Certified/Accept.lean b/Ix/IxVM/Certified/Accept.lean
new file mode 100644
index 000000000..1bd3f86b8
--- /dev/null
+++ b/Ix/IxVM/Certified/Accept.lean
@@ -0,0 +1,113 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.IxVM.Certified.Read
+import Ix.Aiur.Compiler
+
+/-!
+Complete C2 certificate-checking execution, initialized from the pinned empty
+type and eliminator and an empty context. This pilot consumes host-decoded
+source declarations alongside certificates. Its packet is not authenticated
+Ixon; C6 byte binding and C8 success reflection remain open.
+-/
+
+namespace IxVM.Certified
+
+def accept := ⟦
+  fn c_false_elim_type(fref: CRef) -> CExpr {
+    let false_type = store(CExprNode.Const(fref, store(ListNode.Nil)));
+    let p = CWhen.AllZero(store(ListNode.Cons(0, store(ListNode.Nil))));
+    let motive = store(CExprNode.Pi(CWhen.Never, false_type,
+      store(CExprNode.Srt(store(CLevelNode.Param(0))))));
+    let result = store(CExprNode.App(store(CExprNode.BVar(1)), store(CExprNode.BVar(0))));
+    store(CExprNode.Pi(p, motive, store(CExprNode.Pi(p, false_type, result))))
+  }
+  fn c_initialize(fref: CRef, eref: CRef, idx: G) -> (CEnv, G) {
+    assert_eq!(c_ref_eq(fref, eref), 0);
+    let prop = store(CExprNode.Srt(store(CLevelNode.Zero)));
+    let (fsrc, idx) = c_read_source(idx);
+    let CSource.Induct(0, 0, 0, ftyp, 0, 0) = fsrc;
+    assert_eq!(c_expr_eq(192, 0, ftyp, prop), 1);
+    let (esrc, idx) = c_read_source(idx);
+    let CSource.Recr(1, 0, 0, 1, 0, etyp, 0, 0, 0) = esrc;
+    let elim_type = c_false_elim_type(fref);
+    assert_eq!(c_expr_eq(192, 0, etyp, elim_type), 1);
+    let env = store(ListNode.Cons(CEntry.Mk(fref, 0, prop, Option.None),
+      store(ListNode.Cons(CEntry.Mk(eref, 1, elim_type, Option.None), store(ListNode.Nil)))));
+    (env, idx)
+  }
+  fn c_admit(env: CEnv, idx: G) -> (CEnv, G) {
+    let (ref, idx) = c_read_ref(idx);
+    let (source, idx) = c_read_source(idx);
+    let CSource.Defn(n, kind, source_type, source_body, 0) = source;
+    assert_eq!(u32_less_than(kind, 3), 1);
+    let (typ, idx) = c_read_expr(192, idx);
+    let (body, idx) = c_read_expr(192, idx);
+    let (level, idx) = c_read_level(192, idx);
+    let (wt, idx) = c_read_type(192, idx);
+    let (wb, idx) = c_read_type(192, idx);
+    assert_eq!(c_expr_eq(192, 0, source_type, typ), 1);
+    assert_eq!(c_expr_eq(192, 0, source_body, body), 1);
+    let Option.None = c_lookup(192, env, ref);
+    c_scope(192, n, 0, typ); c_scope(192, n, 0, body);
+    c_references(192, env, typ); c_references(192, env, body);
+    let empty = store(ListNode.Nil);
+    c_type(192, n, env, empty, typ, store(CExprNode.Srt(level)), wt);
+    c_type(192, n, env, empty, body, typ, wb);
+    (store(ListNode.Cons(CEntry.Mk(ref, n, typ, Option.Some(body)), env)), idx)
+  }
+  fn c_admit_many(fuel: G, count: G, env: CEnv, idx: G) -> (CEnv, G) {
+    c_fuel(fuel);
+    match count {
+      0 => (env, idx),
+      _ =>
+        let (env, idx) = c_admit(env, idx);
+        c_admit_many(fuel - 1, count - 1, env, idx),
+    }
+  }
+  pub fn c_accept(faddr: [G; 32], fmember: G, eaddr: [G; 32], emember: G) -> G {
+    let fref = CRef.Member(c_make_address(faddr), c_nat(fmember));
+    let eref = CRef.Member(c_make_address(eaddr), c_nat(emember));
+    let (start, len) = io_get_info(17, [0]);
+    let start = c_nat(start);
+    let len = c_nat(len);
+    let limit = c_add(start, len);
+    let (version, idx) = c_read_nat(start);
+    assert_eq!(version, 1);
+    let (env, idx) = c_initialize(fref, eref, idx);
+    let (count, idx) = c_read_nat(idx);
+    let (env, idx) = c_admit_many(192, count, env, idx);
+    let (n, idx) = c_read_nat(idx);
+    let (source_proof, idx) = c_read_expr(192, idx);
+    let (source_prop, idx) = c_read_expr(192, idx);
+    let (proof, idx) = c_read_expr(192, idx);
+    let (prop, idx) = c_read_expr(192, idx);
+    let (wp, idx) = c_read_type(192, idx);
+    let (wt, idx) = c_read_type(192, idx);
+    assert_eq!(idx, limit);
+    assert_eq!(c_expr_eq(192, 0, source_proof, proof), 1);
+    assert_eq!(c_expr_eq(192, 0, source_prop, prop), 1);
+    c_references(192, env, proof); c_references(192, env, prop);
+    let empty = store(ListNode.Nil);
+    c_type(192, n, env, empty, prop, store(CExprNode.Srt(store(CLevelNode.Zero))), wt);
+    c_type(192, n, env, empty, proof, prop, wp);
+    1
+  }
+⟧
+
+def toplevel : Except Aiur.Global Aiur.Source.Toplevel := do
+  let vm ← IxVM.core.merge types
+  let vm ← vm.merge levels
+  let vm ← vm.merge expr
+  let vm ← vm.merge checker
+  let vm ← vm.merge read
+  let vm ← vm.merge accept
+  return vm.prune [`c_accept]
+
+def compiled : Except String Aiur.CompiledToplevel := do
+  let vm ← toplevel.mapError toString
+  vm.compile
+
+end IxVM.Certified
diff --git a/Ix/IxVM/Certified/Checker.lean b/Ix/IxVM/Certified/Checker.lean
new file mode 100644
index 000000000..2bc18ba5e
--- /dev/null
+++ b/Ix/IxVM/Certified/Checker.lean
@@ -0,0 +1,116 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.IxVM.Certified.Expr
+
+/-!
+Aiur implementation of the C2 rule checks in
+`Ix.Theory.Certified.Checker`. The checked endpoints and intermediate terms are
+untrusted data. Assertions and pattern failures abort; the sole successful
+result is unit. The backend reflection theorem remains a separate obligation.
+-/
+
+namespace IxVM.Certified
+
+def checker := ⟦
+  fn c_type(fuel: G, n: G, env: CEnv, ctx: CCtx, e: CExpr, a: CExpr, w: CType) {
+    c_fuel(fuel);
+    let depth = c_len(192, ctx);
+    c_scope(192, n, depth, e); c_scope(192, n, depth, a);
+    match load(w) {
+      CTypeNode.Srt =>
+        let CExprNode.Srt(l) = load(e);
+        assert_eq!(c_expr_eq(192, 1, a, store(CExprNode.Srt(store(CLevelNode.Succ(l))))), 1); (),
+      CTypeNode.BVar =>
+        let CExprNode.BVar(i) = load(e);
+        assert_eq!(c_expr_eq(192, 1, a, c_at(192, ctx, i)), 1); (),
+      CTypeNode.Const =>
+        let CExprNode.Const(r, ls) = load(e);
+        let Option.Some(CEntry.Mk(_, m, typ, _)) = c_lookup(192, env, r);
+        assert_eq!(c_len(192, ls), m);
+        assert_eq!(c_expr_eq(192, 1, a, c_inst_levels(192, ls, typ)), 1); (),
+      CTypeNode.App(p, d, b, wf, wa) =>
+        let CExprNode.App(f, arg) = load(e);
+        assert_eq!(c_expr_eq(192, 1, a, c_inst(192, 0, arg, b)), 1);
+        c_type(fuel - 1, n, env, ctx, f, store(CExprNode.Pi(p, d, b)), wf);
+        c_type(fuel - 1, n, env, ctx, arg, d, wa),
+      CTypeNode.Lam(ld, lb, b, wd, wb, wt) =>
+        let CExprNode.Lam(p, d, body) = load(e);
+        assert_eq!(c_when_eq(192, p, c_zero_condition(192, lb)), 1);
+        assert_eq!(c_expr_eq(192, 1, a, store(CExprNode.Pi(p, d, b))), 1);
+        c_type(fuel - 1, n, env, ctx, d, store(CExprNode.Srt(ld)), wd);
+        let next = c_push(192, d, ctx);
+        c_type(fuel - 1, n, env, next, b, store(CExprNode.Srt(lb)), wb);
+        c_type(fuel - 1, n, env, next, body, b, wt),
+      CTypeNode.Pi(ld, lb, wd, wb) =>
+        let CExprNode.Pi(p, d, b) = load(e);
+        assert_eq!(c_when_eq(192, p, c_zero_condition(192, lb)), 1);
+        assert_eq!(c_expr_eq(192, 1, a, store(CExprNode.Srt(store(CLevelNode.IMax(ld, lb))))), 1);
+        c_type(fuel - 1, n, env, ctx, d, store(CExprNode.Srt(ld)), wd);
+        c_type(fuel - 1, n, env, c_push(192, d, ctx), b, store(CExprNode.Srt(lb)), wb),
+      CTypeNode.Conv(b, la, we, wa, wc) =>
+        c_type(fuel - 1, n, env, ctx, e, b, we);
+        c_type(fuel - 1, n, env, ctx, a, store(CExprNode.Srt(la)), wa);
+        c_conv(fuel - 1, n, env, ctx, b, a, wc),
+    }
+  }
+  fn c_conv(fuel: G, n: G, env: CEnv, ctx: CCtx, a: CExpr, b: CExpr, w: CConv) {
+    c_fuel(fuel);
+    let depth = c_len(192, ctx);
+    c_scope(192, n, depth, a); c_scope(192, n, depth, b);
+    match load(w) {
+      CConvNode.Refl => assert_eq!(c_expr_eq(192, 1, a, b), 1); (),
+      CConvNode.Symm(w) => c_conv(fuel - 1, n, env, ctx, b, a, w),
+      CConvNode.Trans(c, wl, wr) =>
+        c_conv(fuel - 1, n, env, ctx, a, c, wl);
+        c_conv(fuel - 1, n, env, ctx, c, b, wr),
+      CConvNode.App(wf, wa) =>
+        let CExprNode.App(f, arg) = load(a);
+        let CExprNode.App(g, arg2) = load(b);
+        c_conv(fuel - 1, n, env, ctx, f, g, wf);
+        c_conv(fuel - 1, n, env, ctx, arg, arg2, wa),
+      CConvNode.Lam(ld, wd, wa, wb) =>
+        let CExprNode.Lam(p, d, body) = load(a);
+        let CExprNode.Lam(q, d2, body2) = load(b);
+        assert_eq!(c_when_eq(192, p, q), 1);
+        c_type(fuel - 1, n, env, ctx, d, store(CExprNode.Srt(ld)), wd);
+        c_conv(fuel - 1, n, env, ctx, d, d2, wa);
+        c_conv(fuel - 1, n, env, c_push(192, d, ctx), body, body2, wb),
+      CConvNode.Pi(ld, wd, wa, wb) =>
+        let CExprNode.Pi(p, d, body) = load(a);
+        let CExprNode.Pi(q, d2, body2) = load(b);
+        assert_eq!(c_when_eq(192, p, q), 1);
+        c_type(fuel - 1, n, env, ctx, d, store(CExprNode.Srt(ld)), wd);
+        c_conv(fuel - 1, n, env, ctx, d, d2, wa);
+        c_conv(fuel - 1, n, env, c_push(192, d, ctx), body, body2, wb),
+      CConvNode.Beta(t, wl, wa) =>
+        let CExprNode.App(f, arg) = load(a);
+        let CExprNode.Lam(_, d, body) = load(f);
+        assert_eq!(c_expr_eq(192, 1, b, c_inst(192, 0, arg, body)), 1);
+        c_type(fuel - 1, n, env, ctx, f, t, wl);
+        c_type(fuel - 1, n, env, ctx, arg, d, wa),
+      CConvNode.Eta(codomain, wf) =>
+        let CExprNode.Lam(p, d, body) = load(a);
+        let expansion = store(CExprNode.App(c_lift(192, 1, 0, b), store(CExprNode.BVar(0))));
+        assert_eq!(c_expr_eq(192, 1, body, expansion), 1);
+        c_type(fuel - 1, n, env, ctx, b, store(CExprNode.Pi(p, d, codomain)), wf),
+      CConvNode.ProofIrrel(typ, wt, wa, wb) =>
+        c_type(fuel - 1, n, env, ctx, typ, store(CExprNode.Srt(store(CLevelNode.Zero))), wt);
+        c_type(fuel - 1, n, env, ctx, a, typ, wa);
+        c_type(fuel - 1, n, env, ctx, b, typ, wb),
+      CConvNode.Delta =>
+        let CExprNode.Const(r, ls) = load(a);
+        let Option.Some(CEntry.Mk(_, m, _, Option.Some(body))) = c_lookup(192, env, r);
+        assert_eq!(c_len(192, ls), m);
+        assert_eq!(c_expr_eq(192, 1, b, c_inst_levels(192, ls, body)), 1); (),
+      CConvNode.Srt =>
+        let CExprNode.Srt(l) = load(a);
+        let CExprNode.Srt(m) = load(b);
+        assert_eq!(c_level_eq(192, c_level_normalize(192, l), c_level_normalize(192, m)), 1); (),
+    }
+  }
+⟧
+
+end IxVM.Certified
diff --git a/Ix/IxVM/Certified/Expr.lean b/Ix/IxVM/Certified/Expr.lean
new file mode 100644
index 000000000..eb4a45cd6
--- /dev/null
+++ b/Ix/IxVM/Certified/Expr.lean
@@ -0,0 +1,136 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.IxVM.Certified.Levels
+
+namespace IxVM.Certified
+
+def expr := ⟦
+  fn c_scope(fuel: G, n: G, depth: G, e: CExpr) {
+    c_fuel(fuel);
+    match load(e) {
+      CExprNode.Srt(l) => c_level_wf(fuel - 1, n, l),
+      CExprNode.BVar(i) => assert_eq!(u32_less_than(i, depth), 1); (),
+      CExprNode.Const(_, ls) => c_levels_wf(fuel - 1, n, ls),
+      CExprNode.App(f, a) =>
+        c_scope(fuel - 1, n, depth, f); c_scope(fuel - 1, n, depth, a),
+      CExprNode.Lam(p, a, b) =>
+        c_when_wf(fuel - 1, n, p);
+        c_scope(fuel - 1, n, depth, a); c_scope(fuel - 1, n, c_add(depth, 1), b),
+      CExprNode.Pi(p, a, b) =>
+        c_when_wf(fuel - 1, n, p);
+        c_scope(fuel - 1, n, depth, a); c_scope(fuel - 1, n, c_add(depth, 1), b),
+    }
+  }
+  -- `annotations = 0` compares erasures; `1` compares the complete reading.
+  -- Comparisons are by content. No decision relies on pointer inequality.
+  fn c_expr_eq(fuel: G, annotations: G, a: CExpr, b: CExpr) -> G {
+    c_fuel(fuel);
+    match (load(a), load(b)) {
+      (CExprNode.Srt(l), CExprNode.Srt(m)) => c_level_eq(fuel - 1, l, m),
+      (CExprNode.BVar(i), CExprNode.BVar(j)) => c_eq(i, j),
+      (CExprNode.Const(r, ls), CExprNode.Const(s, ms)) =>
+        c_ref_eq(r, s) * c_levels_eq(fuel - 1, ls, ms),
+      (CExprNode.App(f, a), CExprNode.App(g, b)) =>
+        c_expr_eq(fuel - 1, annotations, f, g) * c_expr_eq(fuel - 1, annotations, a, b),
+      (CExprNode.Lam(p, a, b), CExprNode.Lam(q, c, d)) =>
+        let same = match annotations { 0 => 1, 1 => c_when_eq(fuel - 1, p, q), };
+        same * c_expr_eq(fuel - 1, annotations, a, c) * c_expr_eq(fuel - 1, annotations, b, d),
+      (CExprNode.Pi(p, a, b), CExprNode.Pi(q, c, d)) =>
+        let same = match annotations { 0 => 1, 1 => c_when_eq(fuel - 1, p, q), };
+        same * c_expr_eq(fuel - 1, annotations, a, c) * c_expr_eq(fuel - 1, annotations, b, d),
+      _ => 0,
+    }
+  }
+  fn c_lift(fuel: G, count: G, cutoff: G, e: CExpr) -> CExpr {
+    c_fuel(fuel);
+    match load(e) {
+      CExprNode.Srt(_) => e,
+      CExprNode.BVar(i) => match u32_less_than(i, cutoff) {
+        1 => e, 0 => store(CExprNode.BVar(c_add(i, count))),
+      },
+      CExprNode.Const(_, _) => e,
+      CExprNode.App(f, a) => store(CExprNode.App(
+        c_lift(fuel - 1, count, cutoff, f), c_lift(fuel - 1, count, cutoff, a))),
+      CExprNode.Lam(p, a, b) => store(CExprNode.Lam(p,
+        c_lift(fuel - 1, count, cutoff, a), c_lift(fuel - 1, count, c_add(cutoff, 1), b))),
+      CExprNode.Pi(p, a, b) => store(CExprNode.Pi(p,
+        c_lift(fuel - 1, count, cutoff, a), c_lift(fuel - 1, count, c_add(cutoff, 1), b))),
+    }
+  }
+  fn c_inst(fuel: G, cutoff: G, arg: CExpr, e: CExpr) -> CExpr {
+    c_fuel(fuel);
+    match load(e) {
+      CExprNode.Srt(_) => e,
+      CExprNode.BVar(i) => match u32_less_than(i, cutoff) {
+        1 => e,
+        0 => match i - cutoff {
+          0 => c_lift(fuel - 1, cutoff, 0, arg),
+          _ => store(CExprNode.BVar(i - 1)),
+        },
+      },
+      CExprNode.Const(_, _) => e,
+      CExprNode.App(f, a) => store(CExprNode.App(
+        c_inst(fuel - 1, cutoff, arg, f), c_inst(fuel - 1, cutoff, arg, a))),
+      CExprNode.Lam(p, a, b) => store(CExprNode.Lam(p,
+        c_inst(fuel - 1, cutoff, arg, a), c_inst(fuel - 1, c_add(cutoff, 1), arg, b))),
+      CExprNode.Pi(p, a, b) => store(CExprNode.Pi(p,
+        c_inst(fuel - 1, cutoff, arg, a), c_inst(fuel - 1, c_add(cutoff, 1), arg, b))),
+    }
+  }
+  fn c_inst_levels(fuel: G, ls: List‹CLevel›, e: CExpr) -> CExpr {
+    c_fuel(fuel);
+    match load(e) {
+      CExprNode.Srt(l) => store(CExprNode.Srt(c_level_inst(fuel - 1, ls, l))),
+      CExprNode.BVar(_) => e,
+      CExprNode.Const(r, ms) => store(CExprNode.Const(r, c_levels_inst(fuel - 1, ls, ms))),
+      CExprNode.App(f, a) => store(CExprNode.App(
+        c_inst_levels(fuel - 1, ls, f), c_inst_levels(fuel - 1, ls, a))),
+      CExprNode.Lam(p, a, b) => store(CExprNode.Lam(c_when_inst(fuel - 1, ls, p),
+        c_inst_levels(fuel - 1, ls, a), c_inst_levels(fuel - 1, ls, b))),
+      CExprNode.Pi(p, a, b) => store(CExprNode.Pi(c_when_inst(fuel - 1, ls, p),
+        c_inst_levels(fuel - 1, ls, a), c_inst_levels(fuel - 1, ls, b))),
+    }
+  }
+  fn c_lift_context(fuel: G, ctx: CCtx) -> CCtx {
+    c_fuel(fuel);
+    match load(ctx) {
+      ListNode.Nil => ctx,
+      ListNode.Cons(a, tail) => store(ListNode.Cons(
+        c_lift(fuel - 1, 1, 0, a), c_lift_context(fuel - 1, tail))),
+    }
+  }
+  fn c_push(fuel: G, a: CExpr, ctx: CCtx) -> CCtx {
+    store(ListNode.Cons(c_lift(fuel, 1, 0, a), c_lift_context(fuel, ctx)))
+  }
+  fn c_lookup(fuel: G, env: CEnv, r: CRef) -> Option‹CEntry› {
+    c_fuel(fuel);
+    match load(env) {
+      ListNode.Nil => Option.None,
+      ListNode.Cons(entry, tail) =>
+        let CEntry.Mk(s, _, _, _) = entry;
+        match c_ref_eq(r, s) {
+          1 => Option.Some(entry),
+          0 => c_lookup(fuel - 1, tail, r),
+        },
+    }
+  }
+  fn c_references(fuel: G, env: CEnv, e: CExpr) {
+    c_fuel(fuel);
+    match load(e) {
+      CExprNode.Srt(_) => (),
+      CExprNode.BVar(_) => (),
+      CExprNode.Const(r, _) => let Option.Some(_) = c_lookup(fuel - 1, env, r); (),
+      CExprNode.App(f, a) =>
+        c_references(fuel - 1, env, f); c_references(fuel - 1, env, a),
+      CExprNode.Lam(_, a, b) =>
+        c_references(fuel - 1, env, a); c_references(fuel - 1, env, b),
+      CExprNode.Pi(_, a, b) =>
+        c_references(fuel - 1, env, a); c_references(fuel - 1, env, b),
+    }
+  }
+⟧
+
+end IxVM.Certified
diff --git a/Ix/IxVM/Certified/Levels.lean b/Ix/IxVM/Certified/Levels.lean
new file mode 100644
index 000000000..3fac9ae75
--- /dev/null
+++ b/Ix/IxVM/Certified/Levels.lean
@@ -0,0 +1,132 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.IxVM.Certified.Types
+
+namespace IxVM.Certified
+
+def levels := ⟦
+  fn c_level_wf(fuel: G, n: G, l: CLevel) {
+    c_fuel(fuel);
+    match load(l) {
+      CLevelNode.Zero => (),
+      CLevelNode.Param(i) => assert_eq!(u32_less_than(i, n), 1); (),
+      CLevelNode.Succ(a) => c_level_wf(fuel - 1, n, a),
+      CLevelNode.Max(a, b) =>
+        c_level_wf(fuel - 1, n, a); c_level_wf(fuel - 1, n, b),
+      CLevelNode.IMax(a, b) =>
+        c_level_wf(fuel - 1, n, a); c_level_wf(fuel - 1, n, b),
+    }
+  }
+  fn c_levels_wf(fuel: G, n: G, ls: List‹CLevel›) {
+    c_fuel(fuel);
+    match load(ls) {
+      ListNode.Nil => (),
+      ListNode.Cons(l, tail) =>
+        c_level_wf(fuel - 1, n, l); c_levels_wf(fuel - 1, n, tail),
+    }
+  }
+  fn c_level_eq(fuel: G, a: CLevel, b: CLevel) -> G {
+    c_fuel(fuel);
+    match (load(a), load(b)) {
+      (CLevelNode.Zero, CLevelNode.Zero) => 1,
+      (CLevelNode.Param(i), CLevelNode.Param(j)) => c_eq(i, j),
+      (CLevelNode.Succ(x), CLevelNode.Succ(y)) => c_level_eq(fuel - 1, x, y),
+      (CLevelNode.Max(a, b), CLevelNode.Max(c, d)) =>
+        c_level_eq(fuel - 1, a, c) * c_level_eq(fuel - 1, b, d),
+      (CLevelNode.IMax(a, b), CLevelNode.IMax(c, d)) =>
+        c_level_eq(fuel - 1, a, c) * c_level_eq(fuel - 1, b, d),
+      _ => 0,
+    }
+  }
+  fn c_levels_eq(fuel: G, xs: List‹CLevel›, ys: List‹CLevel›) -> G {
+    c_fuel(fuel);
+    match (load(xs), load(ys)) {
+      (ListNode.Nil, ListNode.Nil) => 1,
+      (ListNode.Cons(x, xt), ListNode.Cons(y, yt)) =>
+        c_level_eq(fuel - 1, x, y) * c_levels_eq(fuel - 1, xt, yt),
+      _ => 0,
+    }
+  }
+  fn c_zero_condition(fuel: G, l: CLevel) -> CWhen {
+    c_fuel(fuel);
+    match load(l) {
+      CLevelNode.Zero => CWhen.AllZero(store(ListNode.Nil)),
+      CLevelNode.Param(i) => CWhen.AllZero(store(ListNode.Cons(i, store(ListNode.Nil)))),
+      CLevelNode.Succ(_) => CWhen.Never,
+      CLevelNode.Max(a, b) =>
+        c_intersect(fuel - 1, c_zero_condition(fuel - 1, a), c_zero_condition(fuel - 1, b)),
+      CLevelNode.IMax(_, b) => c_zero_condition(fuel - 1, b),
+    }
+  }
+  fn c_level_inst(fuel: G, ls: List‹CLevel›, l: CLevel) -> CLevel {
+    c_fuel(fuel);
+    match load(l) {
+      CLevelNode.Zero => l,
+      CLevelNode.Param(i) => c_at(fuel - 1, ls, i),
+      CLevelNode.Succ(a) => store(CLevelNode.Succ(c_level_inst(fuel - 1, ls, a))),
+      CLevelNode.Max(a, b) => store(CLevelNode.Max(
+        c_level_inst(fuel - 1, ls, a), c_level_inst(fuel - 1, ls, b))),
+      CLevelNode.IMax(a, b) => store(CLevelNode.IMax(
+        c_level_inst(fuel - 1, ls, a), c_level_inst(fuel - 1, ls, b))),
+    }
+  }
+  fn c_levels_inst(fuel: G, ls: List‹CLevel›, xs: List‹CLevel›) -> List‹CLevel› {
+    c_fuel(fuel);
+    match load(xs) {
+      ListNode.Nil => xs,
+      ListNode.Cons(x, tail) => store(ListNode.Cons(
+        c_level_inst(fuel - 1, ls, x), c_levels_inst(fuel - 1, ls, tail))),
+    }
+  }
+  fn c_nums_inst(fuel: G, ls: List‹CLevel›, xs: List‹G›) -> CWhen {
+    c_fuel(fuel);
+    match load(xs) {
+      ListNode.Nil => CWhen.AllZero(store(ListNode.Nil)),
+      ListNode.Cons(x, tail) => c_intersect(fuel - 1,
+        c_zero_condition(fuel - 1, c_at(fuel - 1, ls, x)),
+        c_nums_inst(fuel - 1, ls, tail)),
+    }
+  }
+  fn c_when_inst(fuel: G, ls: List‹CLevel›, p: CWhen) -> CWhen {
+    match p {
+      CWhen.Never => CWhen.Never,
+      CWhen.AllZero(xs) => c_nums_inst(fuel, ls, xs),
+    }
+  }
+  fn c_level_max(fuel: G, a: CLevel, b: CLevel) -> CLevel {
+    match (load(a), load(b)) {
+      (CLevelNode.Zero, _) => b,
+      (_, CLevelNode.Zero) => a,
+      _ => match c_level_eq(fuel, a, b) {
+        1 => a, 0 => store(CLevelNode.Max(a, b)),
+      },
+    }
+  }
+  fn c_level_imax(fuel: G, a: CLevel, b: CLevel) -> CLevel {
+    match (load(a), load(b)) {
+      (_, CLevelNode.Zero) => b,
+      (_, CLevelNode.Succ(_)) => c_level_max(fuel, a, b),
+      (CLevelNode.Zero, _) => b,
+      _ => match c_level_eq(fuel, a, b) {
+        1 => a, 0 => store(CLevelNode.IMax(a, b)),
+      },
+    }
+  }
+  fn c_level_normalize(fuel: G, l: CLevel) -> CLevel {
+    c_fuel(fuel);
+    match load(l) {
+      CLevelNode.Zero => l,
+      CLevelNode.Param(_) => l,
+      CLevelNode.Succ(a) => store(CLevelNode.Succ(c_level_normalize(fuel - 1, a))),
+      CLevelNode.Max(a, b) => c_level_max(fuel - 1,
+        c_level_normalize(fuel - 1, a), c_level_normalize(fuel - 1, b)),
+      CLevelNode.IMax(a, b) => c_level_imax(fuel - 1,
+        c_level_normalize(fuel - 1, a), c_level_normalize(fuel - 1, b)),
+    }
+  }
+⟧
+
+end IxVM.Certified
diff --git a/Ix/IxVM/Certified/Read.lean b/Ix/IxVM/Certified/Read.lean
new file mode 100644
index 000000000..1f7e7dbc8
--- /dev/null
+++ b/Ix/IxVM/Certified/Read.lean
@@ -0,0 +1,241 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.IxVM.Certified.Checker
+
+/-!
+Bounded private-witness transport for the C2 pilot. Scalars are field words
+with an enforced `< 65536` domain, addresses are range-checked bytes, and
+every recursive decoder decreases fuel. The entrypoint checks exact packet
+consumption. This is a certificate transport, not the Ixon wire codec.
+-/
+
+namespace IxVM.Certified
+
+def read := ⟦
+  enum CSource {
+    Axiom(G, CExpr, G), Defn(G, G, CExpr, CExpr, G),
+    Induct(G, G, G, CExpr, G, G),
+    Recr(G, G, G, G, G, CExpr, G, G, G), Unsupported
+  }
+  fn c_read_nat(idx: G) -> (G, G) {
+    let [x] = io_read(17, idx, 1);
+    (c_nat(x), c_add(idx, 1))
+  }
+  fn c_make_address(raw: [G; 32]) -> Addr {
+    let (b0, b1) = u8_range_check(raw[0], raw[1]);
+    let (b2, b3) = u8_range_check(raw[2], raw[3]);
+    let (b4, b5) = u8_range_check(raw[4], raw[5]);
+    let (b6, b7) = u8_range_check(raw[6], raw[7]);
+    let (b8, b9) = u8_range_check(raw[8], raw[9]);
+    let (b10, b11) = u8_range_check(raw[10], raw[11]);
+    let (b12, b13) = u8_range_check(raw[12], raw[13]);
+    let (b14, b15) = u8_range_check(raw[14], raw[15]);
+    let (b16, b17) = u8_range_check(raw[16], raw[17]);
+    let (b18, b19) = u8_range_check(raw[18], raw[19]);
+    let (b20, b21) = u8_range_check(raw[20], raw[21]);
+    let (b22, b23) = u8_range_check(raw[22], raw[23]);
+    let (b24, b25) = u8_range_check(raw[24], raw[25]);
+    let (b26, b27) = u8_range_check(raw[26], raw[27]);
+    let (b28, b29) = u8_range_check(raw[28], raw[29]);
+    let (b30, b31) = u8_range_check(raw[30], raw[31]);
+    store([b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15,
+      b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31])
+  }
+  fn c_read_address(idx: G) -> (Addr, G) {
+    let raw: [G; 32] = io_read(17, idx, 32);
+    (c_make_address(raw), c_add(idx, 32))
+  }
+  fn c_read_ref(idx: G) -> (CRef, G) {
+    let (tag, idx) = c_read_nat(idx);
+    let (addr, idx) = c_read_address(idx);
+    let (member, idx) = c_read_nat(idx);
+    match tag {
+      0 => (CRef.Member(addr, member), idx),
+      1 => let (ctor, idx) = c_read_nat(idx); (CRef.Ctor(addr, member, ctor), idx),
+    }
+  }
+  fn c_read_nums(fuel: G, count: G, idx: G) -> (List‹G›, G) {
+    c_fuel(fuel);
+    match count {
+      0 => (store(ListNode.Nil), idx),
+      _ =>
+        let (x, idx) = c_read_nat(idx);
+        let (xs, idx) = c_read_nums(fuel - 1, count - 1, idx);
+        (store(ListNode.Cons(x, xs)), idx),
+    }
+  }
+  fn c_read_when(fuel: G, idx: G) -> (CWhen, G) {
+    let (tag, idx) = c_read_nat(idx);
+    match tag {
+      0 => (CWhen.Never, idx),
+      1 =>
+        let (count, idx) = c_read_nat(idx);
+        let (xs, idx) = c_read_nums(fuel, count, idx);
+        (CWhen.AllZero(xs), idx),
+    }
+  }
+  fn c_read_level(fuel: G, idx: G) -> (CLevel, G) {
+    c_fuel(fuel);
+    let (tag, idx) = c_read_nat(idx);
+    match tag {
+      0 => (store(CLevelNode.Zero), idx),
+      1 => let (l, idx) = c_read_level(fuel - 1, idx); (store(CLevelNode.Succ(l)), idx),
+      2 =>
+        let (a, idx) = c_read_level(fuel - 1, idx);
+        let (b, idx) = c_read_level(fuel - 1, idx); (store(CLevelNode.Max(a, b)), idx),
+      3 =>
+        let (a, idx) = c_read_level(fuel - 1, idx);
+        let (b, idx) = c_read_level(fuel - 1, idx); (store(CLevelNode.IMax(a, b)), idx),
+      4 => let (i, idx) = c_read_nat(idx); (store(CLevelNode.Param(i)), idx),
+    }
+  }
+  fn c_read_levels(fuel: G, count: G, idx: G) -> (List‹CLevel›, G) {
+    c_fuel(fuel);
+    match count {
+      0 => (store(ListNode.Nil), idx),
+      _ =>
+        let (l, idx) = c_read_level(fuel - 1, idx);
+        let (ls, idx) = c_read_levels(fuel - 1, count - 1, idx);
+        (store(ListNode.Cons(l, ls)), idx),
+    }
+  }
+  fn c_read_expr(fuel: G, idx: G) -> (CExpr, G) {
+    c_fuel(fuel);
+    let (tag, idx) = c_read_nat(idx);
+    match tag {
+      0 => let (l, idx) = c_read_level(fuel - 1, idx); (store(CExprNode.Srt(l)), idx),
+      1 => let (i, idx) = c_read_nat(idx); (store(CExprNode.BVar(i)), idx),
+      2 =>
+        let (r, idx) = c_read_ref(idx);
+        let (count, idx) = c_read_nat(idx);
+        let (ls, idx) = c_read_levels(fuel - 1, count, idx);
+        (store(CExprNode.Const(r, ls)), idx),
+      3 =>
+        let (f, idx) = c_read_expr(fuel - 1, idx);
+        let (a, idx) = c_read_expr(fuel - 1, idx); (store(CExprNode.App(f, a)), idx),
+      4 =>
+        let (p, idx) = c_read_when(fuel - 1, idx);
+        let (a, idx) = c_read_expr(fuel - 1, idx);
+        let (b, idx) = c_read_expr(fuel - 1, idx); (store(CExprNode.Lam(p, a, b)), idx),
+      5 =>
+        let (p, idx) = c_read_when(fuel - 1, idx);
+        let (a, idx) = c_read_expr(fuel - 1, idx);
+        let (b, idx) = c_read_expr(fuel - 1, idx); (store(CExprNode.Pi(p, a, b)), idx),
+    }
+  }
+  fn c_read_type(fuel: G, idx: G) -> (CType, G) {
+    c_fuel(fuel);
+    let (tag, idx) = c_read_nat(idx);
+    match tag {
+      0 => (store(CTypeNode.Srt), idx),
+      1 => (store(CTypeNode.BVar), idx),
+      2 => (store(CTypeNode.Const), idx),
+      3 =>
+        let (p, idx) = c_read_when(fuel - 1, idx);
+        let (d, idx) = c_read_expr(fuel - 1, idx);
+        let (b, idx) = c_read_expr(fuel - 1, idx);
+        let (wf, idx) = c_read_type(fuel - 1, idx);
+        let (wa, idx) = c_read_type(fuel - 1, idx);
+        (store(CTypeNode.App(p, d, b, wf, wa)), idx),
+      4 =>
+        let (ld, idx) = c_read_level(fuel - 1, idx);
+        let (lb, idx) = c_read_level(fuel - 1, idx);
+        let (b, idx) = c_read_expr(fuel - 1, idx);
+        let (wd, idx) = c_read_type(fuel - 1, idx);
+        let (wb, idx) = c_read_type(fuel - 1, idx);
+        let (wt, idx) = c_read_type(fuel - 1, idx);
+        (store(CTypeNode.Lam(ld, lb, b, wd, wb, wt)), idx),
+      5 =>
+        let (ld, idx) = c_read_level(fuel - 1, idx);
+        let (lb, idx) = c_read_level(fuel - 1, idx);
+        let (wd, idx) = c_read_type(fuel - 1, idx);
+        let (wb, idx) = c_read_type(fuel - 1, idx);
+        (store(CTypeNode.Pi(ld, lb, wd, wb)), idx),
+      6 =>
+        let (b, idx) = c_read_expr(fuel - 1, idx);
+        let (la, idx) = c_read_level(fuel - 1, idx);
+        let (we, idx) = c_read_type(fuel - 1, idx);
+        let (wa, idx) = c_read_type(fuel - 1, idx);
+        let (wc, idx) = c_read_conv(fuel - 1, idx);
+        (store(CTypeNode.Conv(b, la, we, wa, wc)), idx),
+    }
+  }
+  fn c_read_conv(fuel: G, idx: G) -> (CConv, G) {
+    c_fuel(fuel);
+    let (tag, idx) = c_read_nat(idx);
+    match tag {
+      0 => (store(CConvNode.Refl), idx),
+      1 => let (w, idx) = c_read_conv(fuel - 1, idx); (store(CConvNode.Symm(w)), idx),
+      2 =>
+        let (c, idx) = c_read_expr(fuel - 1, idx);
+        let (wl, idx) = c_read_conv(fuel - 1, idx);
+        let (wr, idx) = c_read_conv(fuel - 1, idx); (store(CConvNode.Trans(c, wl, wr)), idx),
+      3 =>
+        let (wf, idx) = c_read_conv(fuel - 1, idx);
+        let (wa, idx) = c_read_conv(fuel - 1, idx); (store(CConvNode.App(wf, wa)), idx),
+      4 =>
+        let (ld, idx) = c_read_level(fuel - 1, idx);
+        let (wd, idx) = c_read_type(fuel - 1, idx);
+        let (wa, idx) = c_read_conv(fuel - 1, idx);
+        let (wb, idx) = c_read_conv(fuel - 1, idx); (store(CConvNode.Lam(ld, wd, wa, wb)), idx),
+      5 =>
+        let (ld, idx) = c_read_level(fuel - 1, idx);
+        let (wd, idx) = c_read_type(fuel - 1, idx);
+        let (wa, idx) = c_read_conv(fuel - 1, idx);
+        let (wb, idx) = c_read_conv(fuel - 1, idx); (store(CConvNode.Pi(ld, wd, wa, wb)), idx),
+      6 =>
+        let (t, idx) = c_read_expr(fuel - 1, idx);
+        let (wl, idx) = c_read_type(fuel - 1, idx);
+        let (wa, idx) = c_read_type(fuel - 1, idx); (store(CConvNode.Beta(t, wl, wa)), idx),
+      7 =>
+        let (b, idx) = c_read_expr(fuel - 1, idx);
+        let (wf, idx) = c_read_type(fuel - 1, idx); (store(CConvNode.Eta(b, wf)), idx),
+      8 =>
+        let (a, idx) = c_read_expr(fuel - 1, idx);
+        let (wt, idx) = c_read_type(fuel - 1, idx);
+        let (wa, idx) = c_read_type(fuel - 1, idx);
+        let (wb, idx) = c_read_type(fuel - 1, idx); (store(CConvNode.ProofIrrel(a, wt, wa, wb)), idx),
+      9 => (store(CConvNode.Delta), idx),
+      10 => (store(CConvNode.Srt), idx),
+    }
+  }
+  fn c_read_source(idx: G) -> (CSource, G) {
+    let (tag, idx) = c_read_nat(idx);
+    match tag {
+      0 =>
+        let (n, idx) = c_read_nat(idx);
+        let (typ, idx) = c_read_expr(192, idx);
+        let (unsafe_flag, idx) = c_read_nat(idx); (CSource.Axiom(n, typ, unsafe_flag), idx),
+      1 =>
+        let (n, idx) = c_read_nat(idx);
+        let (kind, idx) = c_read_nat(idx);
+        let (typ, idx) = c_read_expr(192, idx);
+        let (body, idx) = c_read_expr(192, idx);
+        let (safety, idx) = c_read_nat(idx); (CSource.Defn(n, kind, typ, body, safety), idx),
+      2 =>
+        let (n, idx) = c_read_nat(idx);
+        let (params, idx) = c_read_nat(idx);
+        let (indices, idx) = c_read_nat(idx);
+        let (typ, idx) = c_read_expr(192, idx);
+        let (ctors, idx) = c_read_nat(idx);
+        let (unsafe_flag, idx) = c_read_nat(idx); (CSource.Induct(n, params, indices, typ, ctors, unsafe_flag), idx),
+      3 =>
+        let (n, idx) = c_read_nat(idx);
+        let (params, idx) = c_read_nat(idx);
+        let (indices, idx) = c_read_nat(idx);
+        let (motives, idx) = c_read_nat(idx);
+        let (minors, idx) = c_read_nat(idx);
+        let (typ, idx) = c_read_expr(192, idx);
+        let (rules, idx) = c_read_nat(idx);
+        let (k, idx) = c_read_nat(idx);
+        let (unsafe_flag, idx) = c_read_nat(idx);
+        (CSource.Recr(n, params, indices, motives, minors, typ, rules, k, unsafe_flag), idx),
+      4 => (CSource.Unsupported, idx),
+    }
+  }
+⟧
+
+end IxVM.Certified
diff --git a/Ix/IxVM/Certified/Types.lean b/Ix/IxVM/Certified/Types.lean
new file mode 100644
index 000000000..608645409
--- /dev/null
+++ b/Ix/IxVM/Certified/Types.lean
@@ -0,0 +1,140 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.IxVM.Core
+
+/-!
+The C2 Aiur pilot uses the same occurrence annotations and explicit
+block/member/constructor references as the semantic validator. Every recursive
+operation has a decreasing, bounded fuel argument. Exhaustion aborts execution.
+This module does not claim compiler or AIR reflection.
+-/
+
+namespace IxVM.Certified
+
+def types := ⟦
+  enum CLevelNode {
+    Zero, Succ(CLevel), Max(CLevel, CLevel), IMax(CLevel, CLevel), Param(G)
+  }
+  type CLevel = &CLevelNode
+
+  enum CWhen { Never, AllZero(List‹G›) }
+  enum CRef { Member(Addr, G), Ctor(Addr, G, G) }
+  enum CExprNode {
+    Srt(CLevel), BVar(G), Const(CRef, List‹CLevel›),
+    App(CExpr, CExpr), Lam(CWhen, CExpr, CExpr), Pi(CWhen, CExpr, CExpr)
+  }
+  type CExpr = &CExprNode
+
+  enum CTypeNode {
+    Srt, BVar, Const,
+    App(CWhen, CExpr, CExpr, CType, CType),
+    Lam(CLevel, CLevel, CExpr, CType, CType, CType),
+    Pi(CLevel, CLevel, CType, CType),
+    Conv(CExpr, CLevel, CType, CType, CConv)
+  }
+  type CType = &CTypeNode
+  enum CConvNode {
+    Refl, Symm(CConv), Trans(CExpr, CConv, CConv), App(CConv, CConv),
+    Lam(CLevel, CType, CConv, CConv), Pi(CLevel, CType, CConv, CConv),
+    Beta(CExpr, CType, CType), Eta(CExpr, CType),
+    ProofIrrel(CExpr, CType, CType, CType), Delta, Srt
+  }
+  type CConv = &CConvNode
+
+  enum CEntry { Mk(CRef, G, CExpr, Option‹CExpr›) }
+  type CEnv = List‹CEntry›
+  type CCtx = List‹CExpr›
+
+  fn c_fuel(fuel: G) {
+    match fuel { 0 => assert_eq!(0, 1); (), _ => (), }
+  }
+  fn c_nat(x: G) -> G {
+    assert_eq!(u32_less_than(x, 65536), 1); x
+  }
+  fn c_add(a: G, b: G) -> G { c_nat(a + b) }
+  fn c_eq(a: G, b: G) -> G { match a - b { 0 => 1, _ => 0, } }
+  fn c_len‹T›(fuel: G, xs: List‹T›) -> G {
+    c_fuel(fuel);
+    match load(xs) {
+      ListNode.Nil => 0,
+      ListNode.Cons(_, tail) => c_add(1, c_len(fuel - 1, tail)),
+    }
+  }
+  fn c_at‹T›(fuel: G, xs: List‹T›, i: G) -> T {
+    c_fuel(fuel);
+    let ListNode.Cons(x, tail) = load(xs);
+    match i { 0 => x, _ => c_at(fuel - 1, tail, i - 1), }
+  }
+  fn c_ref_eq(a: CRef, b: CRef) -> G {
+    match (a, b) {
+      (CRef.Member(x, i), CRef.Member(y, j)) => address_eq(x, y) * c_eq(i, j),
+      (CRef.Ctor(x, i, k), CRef.Ctor(y, j, l)) =>
+        address_eq(x, y) * c_eq(i, j) * c_eq(k, l),
+      _ => 0,
+    }
+  }
+  fn c_nums_eq(fuel: G, xs: List‹G›, ys: List‹G›) -> G {
+    c_fuel(fuel);
+    match (load(xs), load(ys)) {
+      (ListNode.Nil, ListNode.Nil) => 1,
+      (ListNode.Cons(x, xt), ListNode.Cons(y, yt)) =>
+        c_eq(x, y) * c_nums_eq(fuel - 1, xt, yt),
+      _ => 0,
+    }
+  }
+  fn c_when_eq(fuel: G, a: CWhen, b: CWhen) -> G {
+    match (a, b) {
+      (CWhen.Never, CWhen.Never) => 1,
+      (CWhen.AllZero(xs), CWhen.AllZero(ys)) => c_nums_eq(fuel, xs, ys),
+      _ => 0,
+    }
+  }
+  fn c_nums_wf(fuel: G, n: G, xs: List‹G›) {
+    c_fuel(fuel);
+    match load(xs) {
+      ListNode.Nil => (),
+      ListNode.Cons(x, tail) =>
+        assert_eq!(u32_less_than(x, n), 1);
+        match load(tail) {
+          ListNode.Nil => (),
+          ListNode.Cons(y, _) => assert_eq!(u32_less_than(x, y), 1); (),
+        };
+        c_nums_wf(fuel - 1, n, tail),
+    }
+  }
+  fn c_when_wf(fuel: G, n: G, p: CWhen) {
+    match p { CWhen.Never => (), CWhen.AllZero(xs) => c_nums_wf(fuel, n, xs), }
+  }
+  fn c_insert(fuel: G, x: G, xs: List‹G›) -> List‹G› {
+    c_fuel(fuel);
+    match load(xs) {
+      ListNode.Nil => store(ListNode.Cons(x, xs)),
+      ListNode.Cons(y, tail) =>
+        match u32_less_than(x, y) {
+          1 => store(ListNode.Cons(x, xs)),
+          0 => match x - y {
+            0 => xs,
+            _ => store(ListNode.Cons(y, c_insert(fuel - 1, x, tail))),
+          },
+        },
+    }
+  }
+  fn c_union(fuel: G, xs: List‹G›, ys: List‹G›) -> List‹G› {
+    c_fuel(fuel);
+    match load(xs) {
+      ListNode.Nil => ys,
+      ListNode.Cons(x, tail) => c_insert(fuel - 1, x, c_union(fuel - 1, tail, ys)),
+    }
+  }
+  fn c_intersect(fuel: G, a: CWhen, b: CWhen) -> CWhen {
+    match (a, b) {
+      (CWhen.AllZero(xs), CWhen.AllZero(ys)) => CWhen.AllZero(c_union(fuel, xs, ys)),
+      _ => CWhen.Never,
+    }
+  }
+⟧
+
+end IxVM.Certified
diff --git a/Ix/IxVM/ClaimHarness.lean b/Ix/IxVM/ClaimHarness.lean
index 45446a614..6a7539321 100644
--- a/Ix/IxVM/ClaimHarness.lean
+++ b/Ix/IxVM/ClaimHarness.lean
@@ -5,7 +5,7 @@ public import Ix.Claim
 public import Ix.AssumptionTree
 public import Ix.CompileM
 public import Ix.Common
-public import Ix.Tc.Primitive
+public import Ix.Kernel.Primitive
 
 public section
 
@@ -357,7 +357,7 @@ private def seedTreeAt (root : Address)
     key`. -/
 def closureFrom (env : Ixon.Env) (target : Address) : Std.HashSet Address :=
   closureFromRoots env
-    (#[target] ++ Ix.Tc.primAddrSet.toArray.filter env.consts.contains)
+    (#[target] ++ Ix.Kernel.primAddrSet.toArray.filter env.consts.contains)
 
 /-- Serializes `claim`, seeds its bytes at `key = blake3(claim)`, and
     populates the IOBuffer with the `closureFrom` byte scope of every
@@ -468,7 +468,7 @@ def shardCheckEnvClaimTrees (env : Ixon.Env) (owned : Array Address) :
 def shardCheckEnvClaim (env : Ixon.Env) (owned : Array Address) :
     Except String (Ix.Claim × Std.HashSet Address × Std.HashMap Address Ix.AssumptionTree) := do
   let (claim, trees) ← shardCheckEnvClaimTrees env owned
-  let primitiveRoots := Ix.Tc.primAddrSet.toArray.filter env.consts.contains
+  let primitiveRoots := Ix.Kernel.primAddrSet.toArray.filter env.consts.contains
   let closure := closureFromRoots env (owned ++ primitiveRoots)
   pure (claim, closure, trees)
 
diff --git a/Ix/IxVM/Kernel/DefEq.lean b/Ix/IxVM/Kernel/DefEq.lean
index 8b8f54f6a..fa167900c 100644
--- a/Ix/IxVM/Kernel/DefEq.lean
+++ b/Ix/IxVM/Kernel/DefEq.lean
@@ -691,7 +691,7 @@ def defEq := ⟦
                                 -- Mirrors the reference's
                                 -- "Types must be def-eq" check
                                 -- (crates/kernel/src/def_eq.rs), itself
-                                -- lean4lean's `tryEtaStructCore`.
+                                -- the named specification's `tryEtaStructCore`.
                                 let t_ty = k_infer_only(t, types);
                                 let s_ty = k_infer_only(s, types);
                                 match k_is_def_eq(t_ty, s_ty, types) {
@@ -784,7 +784,7 @@ def defEq := ⟦
   -- inductive.
   --
   -- The index count is part of the reference's test (`def_eq.rs:912`,
-  -- `if indices != 0 || ctors.len() != 1`) and of lean4lean's
+  -- `if indices != 0 || ctors.len() != 1`) and of the named specification's
   -- (`numIndices := 0`); it was dropped here, which made `Eq α a b` and
   -- every other 1-ctor 0-field indexed family read as unit-like.
   fn is_unit_like_type(ty: KExpr) -> G {
@@ -843,8 +843,8 @@ def defEq := ⟦
   -- binder type, not out of `ty_a`, and the ensuing Lam/Lam comparison
   -- is what checks the two domains agree. Rust `try_eta_expansion`
   -- (`def_eq.rs:1179-1211`) infers `s`, whnfs to `All`, and takes that
-  -- `ty`; `Ix/Tc` `tryEtaExpansion` (`DefEq.lean:946-951`) does the same
-  -- via `inferOnlyCall`; lean4lean `tryEtaExpansionCore`
+  -- `ty`; `Ix/Kernel` `tryEtaExpansion` (`DefEq.lean:946-951`) does the same
+  -- via `inferOnlyCall`; the named specification `tryEtaExpansionCore`
   -- (`TypeChecker.lean:507-511`) is `let .forallE name ty _ bi ← whnf
   -- (← inferType s)`.
   --
@@ -883,8 +883,8 @@ def defEq := ⟦
   -- SEMANTIC on purpose — `level_equal`, matching `is_inductive_prop`
   -- (`Infer.lean:260`) and all three references: Rust gates both struct-
   -- eta (`whnf.rs:1884`) and proof irrelevance (`def_eq.rs:878`) on
-  -- `KUniv::is_semantic_zero`, `Ix/Tc` on `isSemanticZero`
-  -- (`Whnf.lean:1139`, `DefEq.lean:817`), and lean4lean's `isProp` on
+  -- `KUniv::is_semantic_zero`, `Ix/Kernel` on `isSemanticZero`
+  -- (`Whnf.lean:1139`, `DefEq.lean:817`), and the named specification's `isProp` on
   -- `Level.isAlwaysZero` (`TypeChecker.lean:230`), all of which normalize.
   --
   -- A structural `KLevelNode.Zero` test is UNSOUND here: `convert_univ`
diff --git a/Ix/IxVM/Kernel/Infer.lean b/Ix/IxVM/Kernel/Infer.lean
index c604377ab..7ff8816fc 100644
--- a/Ix/IxVM/Kernel/Infer.lean
+++ b/Ix/IxVM/Kernel/Infer.lean
@@ -365,8 +365,8 @@ def infer := ⟦
     -- Sort is malformed, and both references that implement this ERROR
     -- rather than answering — Rust `inductive_app_is_prop`
     -- (`infer.rs:485-517`, "projection: expected forall in inductive
-    -- type", then `ensure_sort`) and `Ix/Tc` `inductiveAppIsProp`
-    -- (`Infer.lean:296-324`), with the same message. lean4lean has no
+    -- type", then `ensure_sort`) and `Ix/Kernel` `inductiveAppIsProp`
+    -- (`Infer.lean:296-324`), with the same message. the named specification has no
     -- counterpart: `inferProj` infers the type of the APPLIED struct
     -- expression instead and never peels the declaration's telescope, so
     -- it offers no data point either way.
@@ -505,7 +505,7 @@ def infer := ⟦
 
   -- No fallthrough arm: a value whose type does not whnf to a Sort is not
   -- a type, and the references error there too (Rust `ensure_sort`,
-  -- `tc.rs:648-658`, returns `TcError::TypeExpected`; `Ix/Tc`
+  -- `tc.rs:648-658`, returns `TcError::TypeExpected`; `Ix/Kernel`
   -- `ensureSortWhnf` throws `.typeExpected`). Do not give it a default
   -- level — that would make an ill-typed `Lam` usable as a type.
   fn k_ensure_sort(e: KExpr, types: List‹KExpr›) -> KLevel {
diff --git a/Ix/IxVM/Kernel/Levels.lean b/Ix/IxVM/Kernel/Levels.lean
index a01a780f1..2dc96433b 100644
--- a/Ix/IxVM/Kernel/Levels.lean
+++ b/Ix/IxVM/Kernel/Levels.lean
@@ -60,7 +60,7 @@ def levels := ⟦
   -- ============================================================================
   -- Canonical level normalization (mirror: crates/kernel/src/level.rs
   -- normalize_level / norm_level_eq / norm_level_le, itself a port of
-  -- Lean4Lean's Level.Normalize with the documented subsumption and
+  -- Ix.Theory.Named's Level.Normalize with the documented subsumption and
   -- covers-split fixes).
   --
   -- Semantic level comparison via the recursive `Level.leq` with its
@@ -594,7 +594,7 @@ def levels := ⟦
   -- Semantic l1 <= l2 on canonical forms: every entry's contribution in
   -- its activation branch must be dominated by subset-path entries of l2.
   -- Mirrors level.rs norm_level_le (with its covers split, sound where
-  -- Lean4Lean's single-entry search is incomplete).
+  -- Ix.Theory.Named's single-entry search is incomplete).
   fn nl_le(l1: List‹&NLEntry›, l2: List‹&NLEntry›) -> G {
     match load(l1) {
       ListNode.Nil => 1,
diff --git a/Ix/IxVM/Kernel/Whnf.lean b/Ix/IxVM/Kernel/Whnf.lean
index bd89e681c..b40b90722 100644
--- a/Ix/IxVM/Kernel/Whnf.lean
+++ b/Ix/IxVM/Kernel/Whnf.lean
@@ -364,13 +364,13 @@ def whnf := ⟦
   -- Dispatch is on the ADDRESS alone, and the stored `QuotKind` is not
   -- consulted. All three references decide this way — Rust
   -- `try_quot_reduce` (`whnf.rs:3073-3120`) compares against
-  -- `self.prims.quot_lift.addr` / `quot_ind.addr`, `Ix/Tc`
+  -- `self.prims.quot_lift.addr` / `quot_ind.addr`, `Ix/Kernel`
   -- `tryQuotReduce` (`Whnf.lean:1674-1698`) against `p.quotLift.addr` /
-  -- `p.quotInd.addr`, and lean4lean `quotReduceRec` (`Quot.lean:85-100`)
+  -- `p.quotInd.addr`, and the named specification `quotReduceRec` (`Quot.lean:85-100`)
   -- against the names `Quot.lift` / `Quot.ind`.
   --
   -- The kind field is a checked REDUNDANCY, not a dispatch input: Rust's
-  -- `check_quot` and `Ix/Tc`'s `checkQuot` both DERIVE the expected kind
+  -- `check_quot` and `Ix/Kernel`'s `checkQuot` both DERIVE the expected kind
   -- from the address and assert the stored one matches. Reduction runs
   -- before any of that — `get_ci` typechecks nothing — so keying on the
   -- kind would trust a field no one has validated yet.
@@ -424,8 +424,8 @@ def whnf := ⟦
   -- The head is recognised by ADDRESS and the arity must be exactly 3,
   -- which is all the references look at: Rust
   -- `if *mk_addr != self.prims.quot_ctor.addr { return Ok(None) }` then
-  -- `if mk_args.len() != 3` (`whnf.rs:3108`), `Ix/Tc` the same against
-  -- `p.quotCtor.addr` (`Whnf.lean:1690-1698`), lean4lean
+  -- `if mk_args.len() != 3` (`whnf.rs:3108`), `Ix/Kernel` the same against
+  -- `p.quotCtor.addr` (`Whnf.lean:1690-1698`), the named specification
   -- `if !mk.isAppOfArity ``Quot.mk 3` (`Quot.lean:88`). No `get_ci`, no
   -- stored kind — the constant need not even be resolvable for this to
   -- decide, and resolving it would only reintroduce the unvalidated tag.
diff --git a/Ix/IxonUniv.lean b/Ix/IxonUniv.lean
index 922372c41..94d96a03a 100644
--- a/Ix/IxonUniv.lean
+++ b/Ix/IxonUniv.lean
@@ -12,7 +12,7 @@ Mirror: crates/ixon/src/canon_univ.rs
 deterministic canonical representative of a stored level's Géran
 semantic-equality class, kernel-free and next to the wire type so
 `Ix.CompileM`, the Tc egress, and probes can all use it. The Géran
-machinery is the transliteration of `Ix/Tc/Level.lean:227-472` onto
+machinery is the transliteration of `Ix/Kernel/Level.lean:227-472` onto
 `Ixon.Univ` (positional `var` indices; no metadata); the three kernel
 `NormLevel` implementations stay untouched and serve as the P4 oracle.
 
@@ -20,10 +20,10 @@ The frozen kernel `mk*` rule set (M1–M8 / I1–I6) is kept with its
 kernel-rebuild role: `reduceUniv` is the stage-1 decoration-presence
 test and the P6 oracle, and P3 (canonical forms are `mk*` fixpoints) is
 what makes kernel ingress the identity on canonical content.
-(`Ix.Tc.reduceIxonUniv` computes the same closure by rounding through
+(`Ix.Kernel.reduceIxonUniv` computes the same closure by rounding through
 the actual kernel constructors; `tc-unit` pins their agreement.)
 
-Property set (tested in `Tests/Ix/Tc/Unit.lean` and the Rust twin;
+Property set (tested in `Tests/Ix/Kernel/Unit.lean` and the Rust twin;
 Verify-layer proofs are the D7 follow-up): P1 idempotence; P2
 roundtrip-fixpoint (`normalize (linearize L) = L`, exact on non-empty
 entries — `subsumption` can leave EMPTY entries which `linearize`
@@ -42,7 +42,7 @@ namespace Ixon
 namespace Univ
 
 /-- Constructor count — termination measure for the normalization
-    family (mirrors `Ix.Tc.KUniv.size`). -/
+    family (mirrors `Ix.Kernel.KUniv.size`). -/
 def size : Univ → Nat
   | .zero => 1
   | .succ u => u.size + 1
@@ -81,7 +81,7 @@ end Univ
 
 /-- `mkMax` of the frozen kernel rule set (M1–M8), on `Ixon.Univ`:
     numerals → the larger (ties → `a`); `max a a = a`; zero sides;
-    absorption; same-base offsets; raw. Mirrors `Ix.Tc.KUniv.mkMax` /
+    absorption; same-base offsets; raw. Mirrors `Ix.Kernel.KUniv.mkMax` /
     Rust `canon_univ::n_max`. -/
 def nMax (a b : Univ) : Univ :=
   if a.isExplicit && b.isExplicit then
@@ -126,7 +126,7 @@ def nIMax (a b : Univ) : Univ :=
     A non-fixpoint entry reaches the kernel changed (the stage-1
     decoration-presence test); P6 pins that this rebuild refines into
     the Géran classes. `tc-unit` pins agreement with
-    `Ix.Tc.reduceIxonUniv` (the same closure via the kernel's own
+    `Ix.Kernel.reduceIxonUniv` (the same closure via the kernel's own
     constructors). -/
 def reduceUniv : Univ → Univ
   | .zero => .zero
@@ -157,7 +157,7 @@ abbrev CNorm := RBTree.RBMap CPath CNode compare
 instance : Inhabited CNorm := ⟨.empty⟩
 
 /-- Insert `(idx, k)` into the sorted var list, max-merging offsets.
-    `k` must be the current succ-accumulator (`Ix/Tc/Level.lean:249-252`
+    `k` must be the current succ-accumulator (`Ix/Kernel/Level.lean:249-252`
     — dropping it is the classic port bug). -/
 def CNode.addVar (n : CNode) (idx k : UInt64) : CNode :=
   match n.vars.findIdx? (fun v => idx ≤ v.1) with
@@ -187,13 +187,13 @@ def orderedInsert (a : UInt64) : CPath → Option CPath
     else (x :: ·) <$> orderedInsert a xs
 
 /-!
-Termination mirrors `Ix/Tc/Level.lean:289-296`: the measure is
+Termination mirrors `Ix/Kernel/Level.lean:289-296`: the measure is
 `3·Σ Univ.size + {0,1,2}` ordering the equal-size hops between the
 mutual members.
 -/
 mutual
 
-/-- Flatten a level into canonical form (`Ix.Tc.Level.normalizeAux` on
+/-- Flatten a level into canonical form (`Ix.Kernel.Level.normalizeAux` on
     `Ixon.Univ`). `path` is the imax-conditioning chain, `k` the
     accumulated succ offset. -/
 def normalizeAux (l : Univ) (path : CPath) (k : UInt64) (acc : CNorm) :
@@ -276,7 +276,7 @@ def isSubset : CPath → CPath → Bool
     else false
 
 /-- Keep only the `xs` entries not dominated by a `ys` entry
-    (merge-walk over sorted var lists — `Ix.Tc.Level.subsumeVars`). -/
+    (merge-walk over sorted var lists — `Ix.Kernel.Level.subsumeVars`). -/
 def subsumeVars (xs ys : Array (UInt64 × UInt64)) :
     Array (UInt64 × UInt64) :=
   go 0 0 #[]
@@ -302,7 +302,7 @@ where
   decreasing_by all_goals omega
 
 /-- Drop contributions dominated by entries at sub-paths
-    (`Ix.Tc.Level.subsumption` — the in-loop `n1` mutations are
+    (`Ix.Kernel.Level.subsumption` — the in-loop `n1` mutations are
     order-sensitive). -/
 def subsumption (acc : CNorm) : CNorm := Id.run do
   let snapshot := acc.toList
diff --git a/Ix/Kernel.lean b/Ix/Kernel.lean
new file mode 100644
index 000000000..91b1327b1
--- /dev/null
+++ b/Ix/Kernel.lean
@@ -0,0 +1,54 @@
+module
+
+public import Ix.Kernel.Mode
+public import Ix.Kernel.Id
+public import Ix.Kernel.Level
+public import Ix.Kernel.Expr
+public import Ix.Kernel.Error
+public import Ix.Kernel.Const
+public import Ix.Kernel.Equiv
+public import Ix.Kernel.Env
+public import Ix.Kernel.Primitive
+public import Ix.Kernel.Subst
+public import Ix.Kernel.Lctx
+public import Ix.Kernel.Monad
+public import Ix.Kernel.Ingress
+public import Ix.Kernel.IngressMeta
+public import Ix.Kernel.Egress
+public import Ix.Kernel.EgressLean
+public import Ix.Kernel.Driver
+public import Ix.Kernel.ParCheck
+public import Ix.Kernel.Validate
+public import Ix.Kernel.Whnf
+public import Ix.Kernel.Infer
+public import Ix.Kernel.DefEq
+public import Ix.Kernel.Knot
+public import Ix.Kernel.CanonicalCheck
+public import Ix.Kernel.Inductive
+public import Ix.Kernel.Check
+
+/-!
+# Ix.Kernel — pure-Lean Ix kernel over Ixon
+
+A correctness-first, formalizable port of the Rust Ix kernel
+(`crates/kernel`), operating over the Ixon content-addressed format with
+separated anon and meta modes. Designed for correctness and formalization;
+for performance, use the Rust kernel.
+
+Module map (mirrors `crates/kernel/src/` file-for-file):
+
+| Lean module       | Rust source    |
+|-------------------|----------------|
+| `Ix.Kernel.Mode`      | `mode.rs`      |
+| `Ix.Kernel.Id`        | `id.rs`        |
+| `Ix.Kernel.Error`     | `error.rs`     |
+| `Ix.Kernel.Level`     | `level.rs`     |
+| `Ix.Kernel.Expr`      | `expr.rs`      |
+| `Ix.Kernel.Const`     | `constant.rs`  |
+| `Ix.Kernel.Equiv`     | `equiv.rs`     |
+| `Ix.Kernel.Env`       | `env.rs`       |
+| `Ix.Kernel.Primitive` | `primitive.rs` |
+| `Ix.Kernel.Subst`     | `subst.rs`     |
+| `Ix.Kernel.Lctx`      | `lctx.rs`      |
+| `Ix.Kernel.Monad`     | `tc.rs`        |
+-/
diff --git a/Ix/Tc/CanonicalCheck.lean b/Ix/Kernel/CanonicalCheck.lean
similarity index 99%
rename from Ix/Tc/CanonicalCheck.lean
rename to Ix/Kernel/CanonicalCheck.lean
index 0f6c82976..515fedc2c 100644
--- a/Ix/Tc/CanonicalCheck.lean
+++ b/Ix/Kernel/CanonicalCheck.lean
@@ -1,7 +1,7 @@
 module
 
-public import Ix.Tc.Const
-public import Ix.Tc.Error
+public import Ix.Kernel.Const
+public import Ix.Kernel.Error
 
 /-!
 Mirror: crates/kernel/src/canonical_check.rs
@@ -29,7 +29,7 @@ ctx hits compare positionally (weak), misses fall back to address order
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 
@@ -465,7 +465,7 @@ def validateCanonicalBlockSinglePass (blockAddr : Address)
     | .eq, _ => throw (.nonCanonicalBlock blockAddr i .eq)
     | .gt, _ => throw (.nonCanonicalBlock blockAddr i .gt)
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Kernel/Certified.lean b/Ix/Kernel/Certified.lean
new file mode 100644
index 000000000..6d37c9ee1
--- /dev/null
+++ b/Ix/Kernel/Certified.lean
@@ -0,0 +1,338 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Monad
+import Ix.Certified.Ingress
+
+/-! The witness-assisted certified Ix.Kernel entry point. It reads the selected
+closure from the actual lazy Ixon store and checks it against the modeled
+policy. Its only reusable cache is the checked byte/decoder cache. Existing
+inference flags, equivalence classes and judgment caches have no effect on
+this entry point. Successful legacy checking does not create a receipt. -/
+
+namespace Ix.Kernel
+
+open Ix.Certified Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Model.SetTheory
+
+universe v
+
+namespace TcM
+
+def checkCertified (fuel : Nat) (source : Ixon.Env) (profile : Profile) (target : Address)
+    (selection : InputSelection) (witness : ProofWitness Address) (cache : InputCache) :
+    TcM m (SourceReceipt.{v} source fuel profile target witness × InputCache) := fun state =>
+  match checkSource? fuel source profile target selection witness cache with
+  | none => .error (.other "certified source, profile, resource or witness check failed") state
+  | some result => .ok result state
+
+/-- A successful TcM execution reflects the independent full validator, and
+cannot be influenced by pre-existing kernel judgment caches or flags. -/
+theorem checkCertified_success {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address}
+    {selection : InputSelection} {witness : ProofWitness Address} {cache nextCache : InputCache}
+    {before after : TcState m} {receipt : SourceReceipt.{v} source fuel profile target witness}
+    (h : (checkCertified fuel source profile target selection witness cache).run before =
+      .ok (receipt, nextCache) after) :
+    checkSource? fuel source profile target selection witness cache = some (receipt, nextCache) ∧
+      after = before := by
+  unfold checkCertified EStateM.run at h
+  cases hc : checkSource? fuel source profile target selection witness cache with
+  | none => simp [hc] at h
+  | some result =>
+    simp only [hc, EStateM.Result.ok.injEq] at h
+    rcases h with ⟨rfl, rfl⟩
+    exact ⟨rfl, rfl⟩
+
+/-- On failure the entire caller state is unchanged. No admission receipt or
+partially populated cache escapes the failed source transaction. -/
+theorem checkCertified_failure {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address}
+    {selection : InputSelection} {witness : ProofWitness Address} {cache : InputCache}
+    {before after : TcState m} {error : TcError m}
+    (h : (checkCertified.{v} fuel source profile target selection witness cache).run before =
+      .error error after) :
+    checkSource?.{v} fuel source profile target selection witness cache = none ∧ after = before := by
+  unfold checkCertified EStateM.run at h
+  cases hc : checkSource?.{v} fuel source profile target selection witness cache with
+  | none =>
+    simp only [hc, EStateM.Result.error.injEq] at h
+    exact ⟨rfl, h.2.symm⟩
+  | some result => simp [hc] at h
+
+end TcM
+
+/-- Anonymous initialization constructs IDs directly. It does not evaluate
+meta-mode display-name hashing, whose legacy implementation carries native
+proof leaves. The certified primitive signature is checked separately. -/
+def initialCertifiedPrimitives : Primitives .anon where
+  nat := ⟨PrimAddrs.canonical.nat, ()⟩
+  natZero := ⟨PrimAddrs.canonical.natZero, ()⟩
+  natSucc := ⟨PrimAddrs.canonical.natSucc, ()⟩
+  natAdd := ⟨PrimAddrs.canonical.natAdd, ()⟩
+  natPred := ⟨PrimAddrs.canonical.natPred, ()⟩
+  natSub := ⟨PrimAddrs.canonical.natSub, ()⟩
+  natMul := ⟨PrimAddrs.canonical.natMul, ()⟩
+  natPow := ⟨PrimAddrs.canonical.natPow, ()⟩
+  natGcd := ⟨PrimAddrs.canonical.natGcd, ()⟩
+  natMod := ⟨PrimAddrs.canonical.natMod, ()⟩
+  natDiv := ⟨PrimAddrs.canonical.natDiv, ()⟩
+  natBitwise := ⟨PrimAddrs.canonical.natBitwise, ()⟩
+  natBeq := ⟨PrimAddrs.canonical.natBeq, ()⟩
+  natBle := ⟨PrimAddrs.canonical.natBle, ()⟩
+  natLand := ⟨PrimAddrs.canonical.natLand, ()⟩
+  natLor := ⟨PrimAddrs.canonical.natLor, ()⟩
+  natXor := ⟨PrimAddrs.canonical.natXor, ()⟩
+  natShiftLeft := ⟨PrimAddrs.canonical.natShiftLeft, ()⟩
+  natShiftRight := ⟨PrimAddrs.canonical.natShiftRight, ()⟩
+  boolType := ⟨PrimAddrs.canonical.boolType, ()⟩
+  boolTrue := ⟨PrimAddrs.canonical.boolTrue, ()⟩
+  boolFalse := ⟨PrimAddrs.canonical.boolFalse, ()⟩
+  string := ⟨PrimAddrs.canonical.string, ()⟩
+  stringMk := ⟨PrimAddrs.canonical.stringMk, ()⟩
+  charType := ⟨PrimAddrs.canonical.charType, ()⟩
+  charMk := ⟨PrimAddrs.canonical.charMk, ()⟩
+  charOfNat := ⟨PrimAddrs.canonical.charOfNat, ()⟩
+  stringOfList := ⟨PrimAddrs.canonical.stringOfList, ()⟩
+  stringToByteArray := ⟨PrimAddrs.canonical.stringToByteArray, ()⟩
+  byteArrayEmpty := ⟨PrimAddrs.canonical.byteArrayEmpty, ()⟩
+  list := ⟨PrimAddrs.canonical.list, ()⟩
+  listNil := ⟨PrimAddrs.canonical.listNil, ()⟩
+  listCons := ⟨PrimAddrs.canonical.listCons, ()⟩
+  eq := ⟨PrimAddrs.canonical.eq, ()⟩
+  eqRefl := ⟨PrimAddrs.canonical.eqRefl, ()⟩
+  quotType := ⟨PrimAddrs.canonical.quotType, ()⟩
+  quotCtor := ⟨PrimAddrs.canonical.quotCtor, ()⟩
+  quotLift := ⟨PrimAddrs.canonical.quotLift, ()⟩
+  quotInd := ⟨PrimAddrs.canonical.quotInd, ()⟩
+  reduceBool := ⟨PrimAddrs.canonical.reduceBool, ()⟩
+  reduceNat := ⟨PrimAddrs.canonical.reduceNat, ()⟩
+  eagerReduce := ⟨PrimAddrs.canonical.eagerReduce, ()⟩
+  systemPlatformNumBits := ⟨PrimAddrs.canonical.systemPlatformNumBits, ()⟩
+  systemPlatformGetNumBits := ⟨PrimAddrs.canonical.systemPlatformGetNumBits, ()⟩
+  subtypeVal := ⟨PrimAddrs.canonical.subtypeVal, ()⟩
+  natDecLe := ⟨PrimAddrs.canonical.natDecLe, ()⟩
+  natDecEq := ⟨PrimAddrs.canonical.natDecEq, ()⟩
+  natDecLt := ⟨PrimAddrs.canonical.natDecLt, ()⟩
+  decidableRec := ⟨PrimAddrs.canonical.decidableRec, ()⟩
+  decidableIsTrue := ⟨PrimAddrs.canonical.decidableIsTrue, ()⟩
+  decidableIsFalse := ⟨PrimAddrs.canonical.decidableIsFalse, ()⟩
+  natLeOfBleEqTrue := ⟨PrimAddrs.canonical.natLeOfBleEqTrue, ()⟩
+  natNotLeOfNotBleEqTrue := ⟨PrimAddrs.canonical.natNotLeOfNotBleEqTrue, ()⟩
+  natEqOfBeqEqTrue := ⟨PrimAddrs.canonical.natEqOfBeqEqTrue, ()⟩
+  natNeOfBeqEqFalse := ⟨PrimAddrs.canonical.natNeOfBeqEqFalse, ()⟩
+  fin := ⟨PrimAddrs.canonical.fin, ()⟩
+  boolNoConfusion := ⟨PrimAddrs.canonical.boolNoConfusion, ()⟩
+  int := ⟨PrimAddrs.canonical.int, ()⟩
+  intOfNat := ⟨PrimAddrs.canonical.intOfNat, ()⟩
+  intNegSucc := ⟨PrimAddrs.canonical.intNegSucc, ()⟩
+  intAdd := ⟨PrimAddrs.canonical.intAdd, ()⟩
+  intSub := ⟨PrimAddrs.canonical.intSub, ()⟩
+  intMul := ⟨PrimAddrs.canonical.intMul, ()⟩
+  intNeg := ⟨PrimAddrs.canonical.intNeg, ()⟩
+  intEmod := ⟨PrimAddrs.canonical.intEmod, ()⟩
+  intEdiv := ⟨PrimAddrs.canonical.intEdiv, ()⟩
+  intBmod := ⟨PrimAddrs.canonical.intBmod, ()⟩
+  intBdiv := ⟨PrimAddrs.canonical.intBdiv, ()⟩
+  intNatAbs := ⟨PrimAddrs.canonical.intNatAbs, ()⟩
+  intPow := ⟨PrimAddrs.canonical.intPow, ()⟩
+  intDecEq := ⟨PrimAddrs.canonical.intDecEq, ()⟩
+  intDecLe := ⟨PrimAddrs.canonical.intDecLe, ()⟩
+  intDecLt := ⟨PrimAddrs.canonical.intDecLt, ()⟩
+  punit := ⟨PrimAddrs.canonical.punit, ()⟩
+  natRec := ⟨PrimAddrs.canonical.natRec, ()⟩
+  natCasesOn := ⟨PrimAddrs.canonical.natCasesOn, ()⟩
+  bitVec := ⟨PrimAddrs.canonical.bitVec, ()⟩
+  bitVecToNat := ⟨PrimAddrs.canonical.bitVecToNat, ()⟩
+  bitVecOfNat := ⟨PrimAddrs.canonical.bitVecOfNat, ()⟩
+  bitVecUlt := ⟨PrimAddrs.canonical.bitVecUlt, ()⟩
+  decidableDecide := ⟨PrimAddrs.canonical.decidableDecide, ()⟩
+  ltLt := ⟨PrimAddrs.canonical.ltLt, ()⟩
+  ofNatOfNat := ⟨PrimAddrs.canonical.ofNatOfNat, ()⟩
+  unit := ⟨PrimAddrs.canonical.unit, ()⟩
+  punitSizeOf1 := ⟨PrimAddrs.canonical.punitSizeOf1, ()⟩
+  sizeOfSizeOf := ⟨PrimAddrs.canonical.sizeOfSizeOf, ()⟩
+  stringBack := ⟨PrimAddrs.canonical.stringBack, ()⟩
+  stringLegacyBack := ⟨PrimAddrs.canonical.stringLegacyBack, ()⟩
+  stringUtf8ByteSize := ⟨PrimAddrs.canonical.stringUtf8ByteSize, ()⟩
+  stringAppend := ⟨PrimAddrs.canonical.stringAppend, ()⟩
+  stringDecEq := ⟨PrimAddrs.canonical.stringDecEq, ()⟩
+
+/-- State of the certified driver. Semantic judgments are never cached. -/
+structure CertifiedState where
+  checker : TcState .anon := TcState.new {} initialCertifiedPrimitives
+  inputCache : InputCache := {}
+
+/-- The public source program starts with empty kernel and byte caches. -/
+def initialCertifiedState : CertifiedState := {}
+
+def certifiedStep (fuel : Nat) (source : Ixon.Env) (profile : Profile) (target : Address)
+    (selection : InputSelection) (witness : ProofWitness Address) :
+    EStateM (TcError .anon) CertifiedState (SourceReceipt.{v} source fuel profile target witness) := fun state =>
+  match (TcM.checkCertified fuel source profile target selection witness state.inputCache).run state.checker with
+  | .error error _ => .error error state
+  | .ok (receipt, cache) checker => .ok receipt ⟨checker, cache⟩
+
+theorem certifiedStep_failure {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address}
+    {selection : InputSelection} {witness : ProofWitness Address}
+    {before after : CertifiedState} {error : TcError .anon}
+    (h : (certifiedStep.{v} fuel source profile target selection witness).run before = .error error after) :
+    after = before := by
+  unfold certifiedStep EStateM.run at h
+  dsimp only at h
+  split at h
+  · exact (EStateM.Result.error.inj h).2.symm
+  · cases h
+
+/-- All reused cache entries still match current bytes, and every request
+reruns full scope, policy, dependency, formation and proof validation. -/
+theorem certifiedStep_success {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address}
+    {selection : InputSelection} {witness : ProofWitness Address}
+    {before after : CertifiedState} {receipt : SourceReceipt.{v} source fuel profile target witness}
+    (h : (certifiedStep fuel source profile target selection witness).run before = .ok receipt after) :
+    checkSource? fuel source profile target selection witness before.inputCache =
+      some (receipt, after.inputCache) ∧ after.checker = before.checker := by
+  unfold certifiedStep EStateM.run at h
+  dsimp only at h
+  split at h
+  · cases h
+  · rename_i pair checker he
+    rcases pair with ⟨result, cache⟩
+    cases h
+    exact TcM.checkCertified_success he
+
+def runCertified (fuel : Nat) (source : Ixon.Env) (profile : Profile) (target : Address)
+    (selection : InputSelection) (witness : ProofWitness Address) :
+    Option (SourceReceipt.{v} source fuel profile target witness) :=
+  match (certifiedStep fuel source profile target selection witness).run initialCertifiedState with
+  | .error _ _ => none
+  | .ok receipt _ => some receipt
+
+def acceptsCertifiedSource (fuel : Nat) (source : Ixon.Env) (profile : Profile) (target : Address)
+    (selection : InputSelection) (witness : ProofWitness Address) : Bool :=
+  (runCertified.{v} fuel source profile target selection witness).isSome
+
+/-- Source success constructs every model premise from actual byte reads and
+validator execution. There is no initial semantic model or cache oracle. -/
+theorem accepted_tc_has_model {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address}
+    {selection : InputSelection} {witness : ProofWitness Address}
+    (h : acceptsCertifiedSource.{v} fuel source profile target selection witness = true)
+    (V : Type v) [SetTheory V] (levels : List Nat) (env : Nat → V) :
+    ∃ receipt : SourceReceipt.{v} source fuel profile target witness,
+      runCertified fuel source profile target selection witness = some receipt ∧
+      (∀ address bytes, (address, bytes) ∈ receipt.snapshot.blobs → constantBytes? source address = some bytes) ∧
+      (∀ address bytes, (address, bytes) ∈ receipt.snapshot.literalBlobs → source.getBlob? address = some bytes) ∧
+      ∃ constants : Assignment Address V,
+        receipt.prepared.signature.Compatible receipt.proof.environment.entries constants ∧
+        WellDenoted constants levels env receipt.proof.proof.val ∧
+        WellDenoted constants levels env receipt.proof.proposition.val ∧
+        interp constants levels env receipt.proof.proof.val ∈ˢ
+          interp constants levels env receipt.proof.proposition.val := by
+  unfold acceptsCertifiedSource at h
+  cases hr : runCertified.{v} fuel source profile target selection witness with
+  | none => simp [hr] at h
+  | some receipt =>
+    exact ⟨receipt, rfl, fun _ _ he => receipt.snapshot.objects_from_source he,
+      fun _ _ he => receipt.snapshot.naturals_from_source he, receipt.has_model V levels env⟩
+
+theorem no_tc_proof_of_False (receipt : SourceReceipt.{v} source fuel profile target witness)
+    (V : Type v) [SetTheory V]
+    (h : receipt.prepared.input.proposition = receipt.prepared.signature.falseExpr) : False := by
+  apply no_proof_of_False (fuel := fuel) (witness := witness) V h
+  simp only [acceptsCertified, receipt.checked, Option.isSome_some]
+
+
+namespace TcM
+
+def checkStoreCertified (fuel : Nat) (source : Ixon.Env) (profile : Profile) (subjects : List Address)
+    (selection : InputSelection) (witness : List (DeclarationWitness Address)) (cache : InputCache) :
+    TcM m (StoreReceipt.{v} source fuel profile subjects witness × InputCache) := fun state =>
+  match checkSourceStore? fuel source profile subjects selection witness cache with
+  | none => .error (.other "certified declaration, profile, resource or witness check failed") state
+  | some result => .ok result state
+
+theorem checkStoreCertified_success {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address}
+    {selection : InputSelection} {witness : List (DeclarationWitness Address)} {cache nextCache : InputCache}
+    {before after : TcState m} {receipt : StoreReceipt.{v} source fuel profile subjects witness}
+    (h : (checkStoreCertified fuel source profile subjects selection witness cache).run before =
+      .ok (receipt, nextCache) after) :
+    checkSourceStore? fuel source profile subjects selection witness cache = some (receipt, nextCache) ∧
+      after = before := by
+  unfold checkStoreCertified EStateM.run at h
+  cases hc : checkSourceStore? fuel source profile subjects selection witness cache with
+  | none => simp [hc] at h
+  | some result =>
+    simp only [hc, EStateM.Result.ok.injEq] at h
+    rcases h with ⟨rfl, rfl⟩
+    exact ⟨rfl, rfl⟩
+
+end TcM
+
+def certifiedStoreStep (fuel : Nat) (source : Ixon.Env) (profile : Profile) (subjects : List Address)
+    (selection : InputSelection) (witness : List (DeclarationWitness Address)) :
+    EStateM (TcError .anon) CertifiedState (StoreReceipt.{v} source fuel profile subjects witness) := fun state =>
+  match (TcM.checkStoreCertified fuel source profile subjects selection witness state.inputCache).run state.checker with
+  | .error error _ => .error error state
+  | .ok (receipt, cache) checker => .ok receipt ⟨checker, cache⟩
+
+theorem certifiedStoreStep_failure {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address}
+    {selection : InputSelection} {witness : List (DeclarationWitness Address)}
+    {before after : CertifiedState} {error : TcError .anon}
+    (h : (certifiedStoreStep.{v} fuel source profile subjects selection witness).run before = .error error after) :
+    after = before := by
+  unfold certifiedStoreStep EStateM.run at h
+  dsimp only at h
+  split at h
+  · exact (EStateM.Result.error.inj h).2.symm
+  · cases h
+
+theorem certifiedStoreStep_success {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address}
+    {selection : InputSelection} {witness : List (DeclarationWitness Address)}
+    {before after : CertifiedState} {receipt : StoreReceipt.{v} source fuel profile subjects witness}
+    (h : (certifiedStoreStep fuel source profile subjects selection witness).run before = .ok receipt after) :
+    checkSourceStore? fuel source profile subjects selection witness before.inputCache =
+      some (receipt, after.inputCache) ∧ after.checker = before.checker := by
+  unfold certifiedStoreStep EStateM.run at h
+  dsimp only at h
+  split at h
+  · cases h
+  · rename_i pair checker he
+    rcases pair with ⟨result, cache⟩
+    cases h
+    exact TcM.checkStoreCertified_success he
+
+def runCertifiedStore (fuel : Nat) (source : Ixon.Env) (profile : Profile) (subjects : List Address)
+    (selection : InputSelection) (witness : List (DeclarationWitness Address)) :
+    Option (StoreReceipt.{v} source fuel profile subjects witness) :=
+  match (certifiedStoreStep fuel source profile subjects selection witness).run initialCertifiedState with
+  | .error _ _ => none
+  | .ok receipt _ => some receipt
+
+def acceptsCertifiedStoreSource (fuel : Nat) (source : Ixon.Env) (profile : Profile) (subjects : List Address)
+    (selection : InputSelection) (witness : List (DeclarationWitness Address)) : Bool :=
+  (runCertifiedStore.{v} fuel source profile subjects selection witness).isSome
+
+/-- Complete declaration requests, including source blocks, construct a
+single model realizing every requested member and constructor. -/
+theorem accepted_tc_store_has_model {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address}
+    {selection : InputSelection} {witness : List (DeclarationWitness Address)}
+    (h : acceptsCertifiedStoreSource.{v} fuel source profile subjects selection witness = true)
+    (V : Type v) [SetTheory V] :
+    ∃ receipt : StoreReceipt.{v} source fuel profile subjects witness,
+      runCertifiedStore fuel source profile subjects selection witness = some receipt ∧
+      (∀ address bytes, (address, bytes) ∈ receipt.snapshot.blobs → constantBytes? source address = some bytes) ∧
+      (∀ address bytes, (address, bytes) ∈ receipt.snapshot.literalBlobs → source.getBlob? address = some bytes) ∧
+      ∃ constants : Assignment Address V,
+        receipt.prepared.signature.Compatible receipt.result.environment.entries constants ∧
+        ∀ r ∈ receipt.prepared.targets, ∃ entry, receipt.result.environment.entries r = some entry ∧
+          EntrySource receipt.prepared.signature receipt.prepared.store r entry ∧
+          ∀ levels, levels.length = entry.universes → ∀ env : Nat → V,
+            WellDenoted constants levels env entry.type ∧
+            constants r levels ∈ˢ interp constants levels env entry.type := by
+  unfold acceptsCertifiedStoreSource at h
+  cases hr : runCertifiedStore.{v} fuel source profile subjects selection witness with
+  | none => simp [hr] at h
+  | some receipt =>
+    exact ⟨receipt, rfl, fun _ _ he => receipt.snapshot.objects_from_source he,
+      fun _ _ he => receipt.snapshot.naturals_from_source he, receipt.has_model V⟩
+
+end Ix.Kernel
diff --git a/Ix/Kernel/CertifiedClaims.lean b/Ix/Kernel/CertifiedClaims.lean
new file mode 100644
index 000000000..581360880
--- /dev/null
+++ b/Ix/Kernel/CertifiedClaims.lean
@@ -0,0 +1,95 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Certified
+import Ix.Certified.ClaimAccept
+
+namespace Ix.Kernel
+
+open Ix.Certified
+
+universe v
+
+namespace TcM
+
+def checkClaimCertified (fuel : Nat) (source : Ixon.Env) (address : Address) (bytes : ByteArray)
+    (witness : ClaimWitness) (cache : InputCache) :
+    TcM m (ClaimReceipt.{v} source fuel address bytes × InputCache) := fun state =>
+  match checkClaimBytes? fuel source address bytes witness cache with
+  | none => .error (.other "certified claim, source, policy or witness check failed") state
+  | some result => .ok result state
+
+theorem checkClaimCertified_success {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray}
+    {witness : ClaimWitness} {cache nextCache : InputCache}
+    {before after : TcState m} {receipt : ClaimReceipt.{v} source fuel address bytes}
+    (h : (checkClaimCertified fuel source address bytes witness cache).run before =
+      .ok (receipt, nextCache) after) :
+    checkClaimBytes? fuel source address bytes witness cache = some (receipt, nextCache) ∧
+      after = before := by
+  unfold checkClaimCertified EStateM.run at h
+  cases hc : checkClaimBytes? fuel source address bytes witness cache with
+  | none => simp [hc] at h
+  | some result =>
+    simp only [hc, EStateM.Result.ok.injEq] at h
+    rcases h with ⟨rfl, rfl⟩
+    exact ⟨rfl, rfl⟩
+
+end TcM
+
+def certifiedClaimStep (fuel : Nat) (source : Ixon.Env) (address : Address) (bytes : ByteArray)
+    (witness : ClaimWitness) :
+    EStateM (TcError .anon) CertifiedState (ClaimReceipt.{v} source fuel address bytes) := fun state =>
+  match (TcM.checkClaimCertified fuel source address bytes witness state.inputCache).run state.checker with
+  | .error error _ => .error error state
+  | .ok (receipt, cache) checker => .ok receipt ⟨checker, cache⟩
+
+theorem certifiedClaimStep_failure {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray}
+    {witness : ClaimWitness} {before after : CertifiedState} {error : TcError .anon}
+    (h : (certifiedClaimStep.{v} fuel source address bytes witness).run before = .error error after) :
+    after = before := by
+  unfold certifiedClaimStep EStateM.run at h
+  dsimp only at h
+  split at h
+  · exact (EStateM.Result.error.inj h).2.symm
+  · cases h
+
+theorem certifiedClaimStep_success {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray}
+    {witness : ClaimWitness} {before after : CertifiedState} {receipt : ClaimReceipt.{v} source fuel address bytes}
+    (h : (certifiedClaimStep fuel source address bytes witness).run before = .ok receipt after) :
+    checkClaimBytes? fuel source address bytes witness before.inputCache = some (receipt, after.inputCache) ∧
+      after.checker = before.checker := by
+  unfold certifiedClaimStep EStateM.run at h
+  dsimp only at h
+  split at h
+  · cases h
+  · rename_i pair checker he
+    rcases pair with ⟨result, cache⟩
+    cases h
+    exact TcM.checkClaimCertified_success he
+
+def runCertifiedClaim (fuel : Nat) (source : Ixon.Env) (address : Address) (bytes : ByteArray)
+    (witness : ClaimWitness) : Option (ClaimReceipt.{v} source fuel address bytes) :=
+  match (certifiedClaimStep fuel source address bytes witness).run initialCertifiedState with
+  | .error _ _ => none
+  | .ok receipt _ => some receipt
+
+def acceptsCertifiedClaim (fuel : Nat) (source : Ixon.Env) (address : Address) (bytes : ByteArray)
+    (witness : ClaimWitness) : Bool := (runCertifiedClaim.{v} fuel source address bytes witness).isSome
+
+/-- The actual TcM entry point constructs the meaning of the original claim
+from empty initialization. Warm callers have the same receipt theorem and
+full rollback; neither logical judgments nor policy decisions are cached. -/
+theorem accepted_tc_claim_meaning {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray}
+    {witness : ClaimWitness} (h : acceptsCertifiedClaim.{v} fuel source address bytes witness = true) :
+    ∃ receipt : ClaimReceipt.{v} source fuel address bytes,
+      runCertifiedClaim fuel source address bytes witness = some receipt ∧
+      Address.blake3 bytes = address ∧ envelopeBytes receipt.reading.envelope = bytes ∧
+      SemanticClaimMeaning.{v} source fuel receipt.reading.envelope := by
+  unfold acceptsCertifiedClaim at h
+  cases hr : runCertifiedClaim.{v} fuel source address bytes witness with
+  | none => simp [hr] at h
+  | some receipt => exact ⟨receipt, rfl, receipt.reading.authenticated, receipt.reading.canonical, receipt.meaning⟩
+
+end Ix.Kernel
diff --git a/Ix/Tc/Check.lean b/Ix/Kernel/Check.lean
similarity index 99%
rename from Ix/Tc/Check.lean
rename to Ix/Kernel/Check.lean
index c2f176d4f..f2d2e14e6 100644
--- a/Ix/Tc/Check.lean
+++ b/Ix/Kernel/Check.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Inductive
+public import Ix.Kernel.Inductive
 
 /-!
 Mirror: crates/kernel/src/check.rs
@@ -18,13 +18,13 @@ Constant checking dispatch:
   inductive machinery.
 
 The inductive and recursor member/block validators live in
-`Ix.Tc.Inductive`.
+`Ix.Kernel.Inductive`.
 -/
 
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashSet)
 
@@ -478,7 +478,7 @@ def checkBlockBody (block : KId m) (requested : KId m) :
   let kind ← classifyBlock members
   checkClassifiedBlock kind block members
 
--- ### Inductive machinery (validation and recursor generation in Ix.Tc.Inductive)
+-- ### Inductive machinery (validation and recursor generation in Ix.Kernel.Inductive)
 
 def checkInductiveMember (id : KId m) : RecM m Unit :=
   checkInductiveMemberImpl id
@@ -516,7 +516,7 @@ def checkConst (id : KId m) : TcM m Unit :=
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Const.lean b/Ix/Kernel/Const.lean
similarity index 98%
rename from Ix/Tc/Const.lean
rename to Ix/Kernel/Const.lean
index 26b0fb7db..2690a4f35 100644
--- a/Ix/Tc/Const.lean
+++ b/Ix/Kernel/Const.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Expr
+public import Ix.Kernel.Expr
 
 /-!
 Mirror: crates/kernel/src/constant.rs
@@ -13,7 +13,7 @@ fidelity in meta mode.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- A recursor computation rule. `ctor` carries the Lean name of the
     constructor this rule dispatches on; the kernel dispatches on the
@@ -94,7 +94,7 @@ def kindName : KConst m → String
 
 end KConst
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/DefEq.lean b/Ix/Kernel/DefEq.lean
similarity index 99%
rename from Ix/Tc/DefEq.lean
rename to Ix/Kernel/DefEq.lean
index 234606b4a..c015446b1 100644
--- a/Ix/Tc/DefEq.lean
+++ b/Ix/Kernel/DefEq.lean
@@ -1,11 +1,11 @@
 module
 
-public import Ix.Tc.Infer
+public import Ix.Kernel.Infer
 
 /-!
 Mirror: crates/kernel/src/def_eq.rs
 
-Multi-tier definitional equality (lean4lean shape):
+Multi-tier definitional equality (the named specification shape):
 1. quick structural (hash / binder common-fvar opening)
 1b. eager Bool.true reduction; 1c. string-literal expansion **before any
     whnf**; 1d. cheap whnf-core then cheap whnf-no-delta passes
@@ -28,7 +28,7 @@ cheap cache; cheap `true` promotes to the full cache and the EquivManager
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Lazy-delta single-step outcome. -/
 inductive LazyDeltaStep where
@@ -1277,7 +1277,7 @@ end
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Driver.lean b/Ix/Kernel/Driver.lean
similarity index 97%
rename from Ix/Tc/Driver.lean
rename to Ix/Kernel/Driver.lean
index 9cb37894b..be0310eeb 100644
--- a/Ix/Tc/Driver.lean
+++ b/Ix/Kernel/Driver.lean
@@ -1,12 +1,12 @@
 module
 
-public import Ix.Tc.Ingress
-public import Ix.Tc.Egress
-public import Ix.Tc.Check
+public import Ix.Kernel.Ingress
+public import Ix.Kernel.Egress
+public import Ix.Kernel.Check
 
 /-!
 Mirror: crates/kernel/src/anon_work.rs (work enumeration) plus the driver
-skeleton (the check loop itself lands with `Ix.Tc.Check`).
+skeleton (the check loop itself lands with `Ix.Kernel.Check`).
 
 `buildAnonWork` identifies the kernel-checkable target set from `env.consts`
 without consulting metadata sections. For each entry:
@@ -26,7 +26,7 @@ are visited in ascending byte-lexicographic address order (Rust
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- A single anon-mode work item — one `checkConst primary` per item
     suffices to typecheck every address in `targets`. -/
@@ -178,7 +178,7 @@ def ingressAll (ixonEnv : Ixon.Env) (verify : Bool := true) :
     then merge in chunk order with `KEnv.union` (deterministic conversion
     makes duplicate keys benign). The shared shape behind the eager
     whole-env parallel ingress drivers (anon here, meta in
-    `Ix.Tc.ParCheck`). Chunks schedule on the task pool (bounded by
+    `Ix.Kernel.ParCheck`). Chunks schedule on the task pool (bounded by
     `LEAN_NUM_THREADS`). -/
 def ingressEnvParallelWith (work : Array W)
     (runItem : W → EStateM IngressErr (KEnv m) Unit)
@@ -214,7 +214,7 @@ def ingressAnonEnvParallel (ixonEnv : Ixon.Env) (work : Array AnonWorkItem)
 /-- Driver configuration. -/
 structure CheckCfg where
   /-- Verify `blake3(bytes) == addr` at every constant materialization
-      (the soundness-critical integrity check; see `Ix.Tc.Ingress`). -/
+      (the soundness-critical integrity check; see `Ix.Kernel.Ingress`). -/
   verifyHashes : Bool := true
   /-- Clear the reduction-memo caches every N work items (structural caches,
       constants, and the faulted set are preserved). `0` disables. -/
@@ -295,10 +295,10 @@ def checkEnvAnon (ixonEnv : Ixon.Env) (cfg : CheckCfg := {}) :
 
 /-! ### Kernel ↔ Ixon roundtrip driver
 
-`Lean env → (Rust) compile → ixe → Ix.Tc ingress → Ix.Tc egress → canonical
+`Lean env → (Rust) compile → ixe → Ix.Kernel ingress → Ix.Kernel egress → canonical
 compare` — the anon analog of the Rust `kernel-ixon-roundtrip` test.
 Certifies ingress loses no information: every constant reconstructs
-structurally from kernel data alone (see `Ix.Tc.Egress` for the comparison
+structurally from kernel data alone (see `Ix.Kernel.Egress` for the comparison
 contract). Each item runs against a **fresh** kernel env — egress needs no
 cross-item state, so memory stays bounded per item at any corpus size. -/
 
@@ -419,7 +419,7 @@ def checkIxeAnon (path : System.FilePath) (cfg : CheckCfg := {}) :
   let bytes ← IO.FS.readBinFile path
   return checkIxeBytesAnon bytes cfg
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Egress.lean b/Ix/Kernel/Egress.lean
similarity index 99%
rename from Ix/Tc/Egress.lean
rename to Ix/Kernel/Egress.lean
index c8f0ca312..691654350 100644
--- a/Ix/Tc/Egress.lean
+++ b/Ix/Kernel/Egress.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Ingress
+public import Ix.Kernel.Ingress
 
 /-!
 Mirror: crates/compile/src/kernel_egress.rs (the kernel → Ixon half,
@@ -50,13 +50,13 @@ leg) becomes possible once meta-mode ingress lands.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 
 /-! ### Universe conversion and reduction
 
-`ixonUnivToK` / `kUnivToIxon` / `reduceIxonUniv` live in `Ix.Tc.Ingress`
+`ixonUnivToK` / `kUnivToIxon` / `reduceIxonUniv` live in `Ix.Kernel.Ingress`
 (shared with meta ingress's decoration-presence test). -/
 
 /-! ### Expression egress -/
@@ -893,7 +893,7 @@ def roundtripCompare (original egressed : Ixon.Constant) :
     return none
   return some ((describeDiff ca cb).getD "canonical forms differ (no diff located)")
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/EgressLean.lean b/Ix/Kernel/EgressLean.lean
similarity index 99%
rename from Ix/Tc/EgressLean.lean
rename to Ix/Kernel/EgressLean.lean
index e2516cb89..92f07208c 100644
--- a/Ix/Tc/EgressLean.lean
+++ b/Ix/Kernel/EgressLean.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Ingress
+public import Ix.Kernel.Ingress
 public import Ix.Environment
 
 /-!
@@ -33,7 +33,7 @@ recursors — and walk to the first structural divergence for messages.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 
@@ -365,7 +365,7 @@ def compareLeanCI (original egressed : Ix.ConstantInfo) : Option String := Id.ru
   | _, _ => pure ()
   return none
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Env.lean b/Ix/Kernel/Env.lean
similarity index 98%
rename from Ix/Tc/Env.lean
rename to Ix/Kernel/Env.lean
index 3df2be1c1..8c2ecfc41 100644
--- a/Ix/Tc/Env.lean
+++ b/Ix/Kernel/Env.lean
@@ -1,7 +1,7 @@
 module
 
-public import Ix.Tc.Const
-public import Ix.Tc.Error
+public import Ix.Kernel.Const
+public import Ix.Kernel.Error
 
 /-!
 Mirror: crates/kernel/src/env.rs
@@ -13,19 +13,19 @@ Divergences from Rust (documented, semantics-preserving):
 - The `prims: OnceCell<Primitives<M>>` field is not stored here (Rust has an
   env ↔ primitive module cycle Lean can't express); the resolved `Primitives`
   lives on `TcState` instead, which is where the Rust `TypeChecker` copies it
-  anyway. `Primitives.fromEnv` performs the resolution (see `Ix.Tc.Primitive`).
+  anyway. `Primitives.fromEnv` performs the resolution (see `Ix.Kernel.Primitive`).
 - The reserved-marker guard in Rust's `KEnv::insert` (a panic) is enforced at
-  ingress time instead (`Ix.Tc.Ingress`), which is the only path that feeds
+  ingress time instead (`Ix.Kernel.Ingress`), which is the only path that feeds
   untrusted constants into the env.
 - `subst_scratch`/`lift_scratch` buffer *reuse* is not ported (allocation
-  churn is a Rust concern); per-call memoization itself is (see `Ix.Tc.Subst`).
+  churn is a Rust concern); per-call memoization itself is (see `Ix.Kernel.Subst`).
 - Perf counters and the sharding profile sink are not ported.
 -/
 
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap HashSet)
 
@@ -383,7 +383,7 @@ def cacheSizes (env : KEnv m) : KEnvCacheSizes where
 
 end KEnv
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Equiv.lean b/Ix/Kernel/Equiv.lean
similarity index 99%
rename from Ix/Tc/Equiv.lean
rename to Ix/Kernel/Equiv.lean
index d8f2841f0..ac83a1ec1 100644
--- a/Ix/Tc/Equiv.lean
+++ b/Ix/Kernel/Equiv.lean
@@ -17,7 +17,7 @@ reads). Do not reuse the `IO.Ref`-based `Ix.UnionFind`.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Composite key for one expression in one context-suffix interpretation.
 
@@ -147,7 +147,7 @@ def addEquiv (em : EquivManager) (k1 k2 : EqKey) : EquivManager :=
 
 end EquivManager
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Error.lean b/Ix/Kernel/Error.lean
similarity index 98%
rename from Ix/Tc/Error.lean
rename to Ix/Kernel/Error.lean
index be3513dfa..901f23182 100644
--- a/Ix/Tc/Error.lean
+++ b/Ix/Kernel/Error.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Expr
+public import Ix.Kernel.Expr
 
 /-!
 Mirror: crates/kernel/src/error.rs
@@ -12,7 +12,7 @@ Type checker error types. (Rust's `u64_to_usize` helper is unneeded: Lean
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 inductive TcError (m : Mode) where
   | typeExpected
@@ -80,7 +80,7 @@ instance : Inhabited (TcError m) := ⟨.typeExpected⟩
 
 end TcError
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Expr.lean b/Ix/Kernel/Expr.lean
similarity index 99%
rename from Ix/Tc/Expr.lean
rename to Ix/Kernel/Expr.lean
index 69159a4b2..2d094a950 100644
--- a/Ix/Tc/Expr.lean
+++ b/Ix/Kernel/Expr.lean
@@ -1,8 +1,8 @@
 module
 
-public import Ix.Tc.Mode
-public import Ix.Tc.Id
-public import Ix.Tc.Level
+public import Ix.Kernel.Mode
+public import Ix.Kernel.Id
+public import Ix.Kernel.Level
 public import Ix.Address
 public import Ix.Unsigned
 public import Ix.Ixon
@@ -38,7 +38,7 @@ and mdata are never hashed — hash equality is alpha-invariant in meta mode.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Blake3.Rust (Hasher)
 
@@ -531,7 +531,7 @@ instance : Repr (KExpr m) := ⟨fun e _ => .text e.render⟩
 
 end KExpr
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Id.lean b/Ix/Kernel/Id.lean
similarity index 97%
rename from Ix/Tc/Id.lean
rename to Ix/Kernel/Id.lean
index b0e6969f7..721ec09d9 100644
--- a/Ix/Tc/Id.lean
+++ b/Ix/Kernel/Id.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Mode
+public import Ix.Kernel.Mode
 public import Ix.Address
 
 /-!
@@ -11,7 +11,7 @@ definition ordering).
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Kernel identifier: bundles a content address with a metadata name.
     In meta mode both fields participate in equality; in anon mode the name
@@ -78,7 +78,7 @@ structure FVarId where
 
 instance : ToString FVarId := ⟨fun f => s!"fv${f.id}"⟩
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Inductive.lean b/Ix/Kernel/Inductive.lean
similarity index 99%
rename from Ix/Tc/Inductive.lean
rename to Ix/Kernel/Inductive.lean
index dea08a8e9..61fc12e10 100644
--- a/Ix/Tc/Inductive.lean
+++ b/Ix/Kernel/Inductive.lean
@@ -1,7 +1,7 @@
 module
 
-public import Ix.Tc.Knot
-public import Ix.Tc.CanonicalCheck
+public import Ix.Kernel.Knot
+public import Ix.Kernel.CanonicalCheck
 
 /-!
 Mirror: crates/kernel/src/inductive.rs
@@ -34,7 +34,7 @@ triggering recursor generation for the block
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashSet)
 
@@ -394,7 +394,7 @@ def getResultSortLevel (ty : KExpr m) (n : Nat) :
 
 /-- Large eliminator (can target any universe): non-Prop, or Empty-like
     (0 ctors), or single-ctor Prop whose non-Prop fields all appear among
-    the return-type args (lean4lean `isLargeEliminator`). -/
+    the return-type args (the named specification `isLargeEliminator`). -/
 def isLargeEliminator (resultLevel : KUniv m)
     (indInfos : Array (KId m × UInt64 × UInt64 × Array (KId m) × KExpr m)) :
     RecM m Bool := do
@@ -3120,7 +3120,7 @@ end
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Infer.lean b/Ix/Kernel/Infer.lean
similarity index 97%
rename from Ix/Tc/Infer.lean
rename to Ix/Kernel/Infer.lean
index f48831ef3..abfedbfcc 100644
--- a/Ix/Tc/Infer.lean
+++ b/Ix/Kernel/Infer.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Whnf
+public import Ix.Kernel.Whnf
 
 /-!
 Mirror: crates/kernel/src/infer.rs
@@ -22,7 +22,7 @@ Let inference eagerly substitutes the value into the abstracted body type
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -84,7 +84,7 @@ def inferUncached (inferRec : KExpr m → RecM m (KExpr m))
         let t ← inferRec ty
         let _ ← ensureSortDirect t
       withLctxScope do
-        -- Open the binder with a fresh fvar (lean4lean inferLambda).
+        -- Open the binder with a fresh fvar (the named specification inferLambda).
         let (bodyOpen, fvId) ← TcM.openBinder name bi ty body
         let bodyTy ← inferRec bodyOpen
         -- Peephole-reduce App(λ…, …) shapes before wrapping in the Pi.
@@ -107,7 +107,7 @@ def inferUncached (inferRec : KExpr m → RecM m (KExpr m))
         let valTy ← inferRec val
         if !(← isDefEqCall valTy ty) then
           throw .declTypeMismatch
-      -- Open with a let-bound fvar (lean4lean inferLet); eagerly substitute
+      -- Open with a let-bound fvar (the named specification inferLet); eagerly substitute
       -- the value into the abstracted body type, then cheap-beta.
       withLctxScope do
         let (bodyOpen, fvId) ← TcM.openLet name ty val body
@@ -179,7 +179,7 @@ def ensureForallDirect (e : KExpr m) : RecM m (KExpr m × KExpr m) := do
     return (a, b)
   ensureForallWhnf e
 
-/-- The isDefEq back-edge (tied in `Ix.Tc.Knot`). -/
+/-- The isDefEq back-edge (tied in `Ix.Kernel.Knot`). -/
 def isDefEqCall (a b : KExpr m) : RecM m Bool := do
   (← read).isDefEq a b
 
@@ -327,7 +327,7 @@ end
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Ingress.lean b/Ix/Kernel/Ingress.lean
similarity index 99%
rename from Ix/Tc/Ingress.lean
rename to Ix/Kernel/Ingress.lean
index 33999c741..f459ddbd4 100644
--- a/Ix/Tc/Ingress.lean
+++ b/Ix/Kernel/Ingress.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Monad
+public import Ix.Kernel.Monad
 public import Ix.Ixon
 
 /-!
@@ -22,7 +22,7 @@ universe-table index for the same reason. Every constructed node is interned.
 
 Integrity: `getConstVerified` checks `blake3(rawBytes) == addr` at
 materialization. Rust's `Env::get` does this on its main path; the
-`rs_de_env_lazy`-style loaders and pure-Lean `getEnv` do not, and Ix.Tc is
+`rs_de_env_lazy`-style loaders and pure-Lean `getEnv` do not, and Ix.Kernel is
 the soundness-critical consumer — so it verifies here (`verify := true` by
 default; the driver's `CheckCfg` can disable it for benchmarking).
 
@@ -31,13 +31,13 @@ here in `insertEntries`, the only path feeding untrusted constants into the
 kernel env.
 
 Meta-mode ingress (arena parallel walk, name resolution, mdata layers)
-lives in `Ix.Tc.IngressMeta`.
+lives in `Ix.Kernel.IngressMeta`.
 -/
 
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 
@@ -100,7 +100,7 @@ def anonCtorAddrs (blockAddr : Address) (indcIdx : UInt64)
     UNCONDITIONALLY — `--no-verify` must not be able to bind them to
     other content, because acceleration substitutes native semantics for
     exactly these declarations (soundness argument in
-    `Ix/Tc/Primitive.lean` at `primAddrSet`). -/
+    `Ix/Kernel/Primitive.lean` at `primAddrSet`). -/
 def getConstVerified (ixonEnv : Ixon.Env) (addr : Address)
     (verify : Bool := true) : Except IngressErr (Option Ixon.Constant) := do
   match ixonEnv.consts[addr]? with
@@ -597,7 +597,7 @@ def ingressAnonAddrShallow (ixonEnv : Ixon.Env) (addr : Address)
     let _ ← ingressAnonStandalone ixonEnv addr constant
     return true
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/IngressMeta.lean b/Ix/Kernel/IngressMeta.lean
similarity index 99%
rename from Ix/Tc/IngressMeta.lean
rename to Ix/Kernel/IngressMeta.lean
index 1e9533ba6..9f2971f59 100644
--- a/Ix/Tc/IngressMeta.lean
+++ b/Ix/Kernel/IngressMeta.lean
@@ -1,13 +1,13 @@
 module
 
-public import Ix.Tc.Ingress
-public import Ix.Tc.CanonicalCheck
+public import Ix.Kernel.Ingress
+public import Ix.Kernel.CanonicalCheck
 
 /-!
 Mirror: crates/kernel/src/ingress.rs (the Ixon → kernel, meta-mode half)
 
 Meta ingress converts the same `Ixon.Constant` structure as the anon path
-(`Ix.Tc.Ingress`) but additionally threads the per-constant metadata
+(`Ix.Kernel.Ingress`) but additionally threads the per-constant metadata
 (`Ixon.ConstantMeta`) — binder names/infos, mdata layers, level-param
 names, constant names — into the kernel types' `Mode.F` fields. Semantic
 Blake3 addresses never include metadata, so every KExpr/KUniv/KConst
@@ -62,13 +62,13 @@ tables the fallback never fires (P3: canonical forms are mk*-fixed),
 but it keeps raw-table fixtures exercised. Either way the `UnivDecor`
 on the KExpr node (`ExprInfo.univDecor`) folds into `metaAddr` only,
 never `addr`, so `tc-meta-addr` and all semantic checking are
-untouched; meta egress replays the spelling (`Ix.Tc.egressExpr`).
+untouched; meta egress replays the spelling (`Ix.Kernel.egressExpr`).
 -/
 
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 
@@ -954,7 +954,7 @@ def ingressMetaWorkItem (ixonEnv : Ixon.Env) (item : MetaWorkItem)
       catch e => throw s!"{name}: {e}"
     insertMutsEntriesMeta entries
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Knot.lean b/Ix/Kernel/Knot.lean
similarity index 94%
rename from Ix/Tc/Knot.lean
rename to Ix/Kernel/Knot.lean
index 5479bb563..b67bdbcc4 100644
--- a/Ix/Tc/Knot.lean
+++ b/Ix/Kernel/Knot.lean
@@ -1,9 +1,9 @@
 module
 
-public import Ix.Tc.DefEq
+public import Ix.Kernel.DefEq
 
 /-!
-The recursion knot. `Ix.Tc.Whnf`/`Infer`/`DefEq` define the kernel algorithms
+The recursion knot. `Ix.Kernel.Whnf`/`Infer`/`DefEq` define the kernel algorithms
 in `RecM` (a `Methods`-reader over `TcM`); this module ties the back-edges
 with a total, depth-indexed method table and exports `TcM`-level entry
 points. Only the back-edges route through the record (whnf reads
@@ -18,7 +18,7 @@ has already been consumed. Exhausting method-table depth throws the same
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Fuel-exhausted end of the recursive method table. Every back-edge has
     the same error and error-state behavior as an exhausted `TcM.tick`. -/
@@ -81,7 +81,7 @@ def ensureForall (e : KExpr m) : TcM m (KExpr m × KExpr m) :=
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Lctx.lean b/Ix/Kernel/Lctx.lean
similarity index 98%
rename from Ix/Tc/Lctx.lean
rename to Ix/Kernel/Lctx.lean
index 31c2d9a08..9fdd0581d 100644
--- a/Ix/Tc/Lctx.lean
+++ b/Ix/Kernel/Lctx.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Subst
+public import Ix.Kernel.Subst
 
 /-!
 Mirror: crates/kernel/src/lctx.rs
@@ -19,7 +19,7 @@ Rust's legacy `NameGenerator` is not ported: fvar ids are minted from
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- A single local-context entry: a regular binder (`cdecl`, from lambda or
     forall) or a let-binding (`ldecl`, with an associated value that WHNF
@@ -137,7 +137,7 @@ def isFVar (e : KExpr m) : Bool :=
   | .fvar .. => true
   | _ => false
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Level.lean b/Ix/Kernel/Level.lean
similarity index 97%
rename from Ix/Tc/Level.lean
rename to Ix/Kernel/Level.lean
index a57d19314..62b99ecdb 100644
--- a/Ix/Tc/Level.lean
+++ b/Ix/Kernel/Level.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Mode
+public import Ix.Kernel.Mode
 public import Ix.Address
 public import Ix.Unsigned
 public import Batteries.Recycling.RBTree.Basic
@@ -15,21 +15,21 @@ carries `m.F Name` — the parameter name in meta mode, erased in anon mode.
 Parameter *identity* is the positional index; names are display-only and never
 hashed, so anon and meta levels of the same structure share addresses.
 
-`normalizeLevel` is a port of the Rust port of Lean4Lean's `Level.Normalize`
+`normalizeLevel` is a port of the Rust port of Ix.Theory.Named's `Level.Normalize`
 (Yoan Géran, "A Canonical Form for Universe Levels in Impredicative Type
 Theory"). `NormLevel` maps sorted param-index paths (the imax conditioning
 chain) to nodes tracking constant offsets and variable contributions.
 
 Divergence inherited from Rust (see level.rs `norm_level_le` doc): the `≤`
 check splits constant and variable coverage into independent searches
-(`coversConst` / `coversVar`), strictly more complete than Lean4Lean's
-single-witness `NormLevel.le`. `univEq` matches Lean4Lean's `isEquiv'`.
+(`coversConst` / `coversVar`), strictly more complete than Ix.Theory.Named's
+single-witness `NormLevel.le`. `univEq` matches Ix.Theory.Named's `isEquiv'`.
 -/
 
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Blake3.Rust (Hasher)
 
@@ -320,7 +320,7 @@ def normalizeAux (l : KUniv m) (path : Path) (k : UInt64)
         normalizeAux u newPath k acc
       | none =>
         -- idx already in path (fixed > 0 along this chain); the outer k succs
-        -- still contribute. Matches Lean4Lean's `acc.addVar v k path`.
+        -- still contribute. Matches Ix.Theory.Named's `acc.addVar v k path`.
         let acc := if k != 0 then acc.addVar idx k path else acc
         normalizeAux u path k acc
   | .param idx _ _ =>
@@ -450,7 +450,7 @@ def coversVar (l2 : NormLevel) (p1 : Path) (w off : UInt64) : Bool :=
 /-- Semantic `l1 ≤ l2` on canonical forms. Each ingredient of every `l1`
     entry must be covered by *some* `l2` entry at a sub-path — constant and
     variable coverage searched independently (see module doc: intentionally
-    stronger than Lean4Lean's single-witness `NormLevel.le`). -/
+    stronger than Ix.Theory.Named's single-witness `NormLevel.le`). -/
 def normLevelLe (l1 l2 : NormLevel) : Bool :=
   l1.toList.all fun (p1, n1) =>
     if n1.constant == 0 && n1.vars.isEmpty then true
@@ -505,7 +505,7 @@ def univGeq (u v : KUniv m) : Bool :=
 def KUniv.isSemanticZero (u : KUniv m) : Bool :=
   u.isZero || (Level.normalizeLevel u).toList.all (!Level.entryNonEmpty ·)
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Mode.lean b/Ix/Kernel/Mode.lean
similarity index 98%
rename from Ix/Tc/Mode.lean
rename to Ix/Kernel/Mode.lean
index 078493dd6..bae9ea9c5 100644
--- a/Ix/Tc/Mode.lean
+++ b/Ix/Kernel/Mode.lean
@@ -18,14 +18,14 @@ in either mode, so anon and meta terms of the same underlying structure carry
 identical Blake3 addresses.
 
 Rust's `MetaHash` trait is not ported: its only load-bearing uses are the
-`Ord` on `KId` (ported directly in `Ix.Tc.Id` via stored name hashes) and
+`Ord` on `KId` (ported directly in `Ix.Kernel.Id` via stored name hashes) and
 duplicate-level-param detection (`Mode.F.hasDups` below).
 -/
 
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Kernel mode. `anon` erases metadata fields to `Unit`; `«meta»` keeps them.
     Mirrors Rust `ZMode<META>` (`Anon = ZMode<false>`, `Meta = ZMode<true>`). -/
@@ -173,7 +173,7 @@ instance {m : Mode} [MetaDisplay α] : MetaDisplay (m.F α) where
 
 end Mode.F
 
-end Ix.Tc
+end Ix.Kernel
 
 /-- Saturating decrement: `0 - 1 = 0`. Lean `UInt64` subtraction wraps where
     Rust's `saturating_sub` saturates; loose-bound-range (`lbr`) computations
diff --git a/Ix/Tc/Monad.lean b/Ix/Kernel/Monad.lean
similarity index 98%
rename from Ix/Tc/Monad.lean
rename to Ix/Kernel/Monad.lean
index 45c06591d..f797e47c6 100644
--- a/Ix/Tc/Monad.lean
+++ b/Ix/Kernel/Monad.lean
@@ -1,10 +1,10 @@
 module
 
-public import Ix.Tc.Env
-public import Ix.Tc.Equiv
-public import Ix.Tc.Primitive
-public import Ix.Tc.Subst
-public import Ix.Tc.Lctx
+public import Ix.Kernel.Env
+public import Ix.Kernel.Equiv
+public import Ix.Kernel.Primitive
+public import Ix.Kernel.Subst
+public import Ix.Kernel.Lctx
 
 /-!
 Mirror: crates/kernel/src/tc.rs
@@ -26,7 +26,7 @@ Fuels are data-level and placed exactly where Rust places them
 (post-cache-miss). The `IX_MAX_REC_FUEL` env override is not ported.
 
 Cross-file recursion (whnf ↔ infer ↔ def_eq) is tied through a `Methods m`
-record + `RecM m := ReaderT (Methods m) (TcM m)`; `Ix.Tc.Knot` ties a total
+record + `RecM m := ReaderT (Methods m) (TcM m)`; `Ix.Kernel.Knot` ties a total
 method table indexed by the current `recFuel`. Only back-edges go through
 the record.
 
@@ -37,7 +37,7 @@ Not ported (diagnostics/profiling only): perf counters, hot-miss sampler,
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap HashSet)
 
@@ -145,8 +145,8 @@ structure TcState (m : Mode) where
       constant's block into `env` by address. Installed by the driver
       (`TcState.newLazyAnon`); `none` for eagerly-ingressed envs. The closure
       runs against `env` and returns whether the address was found in the
-      backing Ixon env. (The error type is `Ix.Tc.IngressErr`, spelled
-      `String` here because `Ix.Tc.Ingress` imports this module.) -/
+      backing Ixon env. (The error type is `Ix.Kernel.IngressErr`, spelled
+      `String` here because `Ix.Kernel.Ingress` imports this module.) -/
   lazyFault : Option (Address → EStateM String (KEnv m) Bool) := none
   /-- Addresses already faulted (hit or miss) — never re-ingress. Lives on
       the state (not reset per constant), mirroring Rust
@@ -257,7 +257,7 @@ def addr8 (a : Address) : String := ((toString a).take 8).toString
     `[tag] <fuelUsed> <payload>` mirrors the Rust kernel's
     `IX_STEP_TRACE` journal; diffing the two sequences localizes a
     behavioral divergence at the first fork (workflow in
-    `Ix.Tc.ParCheck`). -/
+    `Ix.Kernel.ParCheck`). -/
 @[inline] def stepTrace (tag : String) (payload : Unit → String) :
     TcM m Unit := do
   let s ← get
@@ -383,7 +383,8 @@ def ctxAddrForLbrUncached (s : TcState m) (lbr : UInt64) : Address :=
       | none =>
         h := h.update "local".toUTF8
         h := h.update s.ctx[i]!.addr.hash
-    return ⟨(h.finalizeWithLength 32).val⟩
+    return ⟨(h.finalizeWithLength 32 (by
+      rcases System.Platform.numBits_eq with bits | bits <;> rw [bits] <;> decide)).val⟩
 
 /-- Memoized wrapper around `ctxAddrForLbrUncached`, mirroring tc.rs
     `ctx_addr_for_lbr`. The pure helper is a verification seam as well as an
@@ -602,7 +603,7 @@ def instUnivInner (e : KExpr m) (us : Array (KUniv m)) :
     -- `pure`, not `return`, in every rebuilding arm: `return` exits the
     -- whole function, skipping the intern + memo-insert tail below, and
     -- an interior-node-less memo turns shared-DAG walks exponential
-    -- (see the note in `Ix/Tc/Subst.lean` `liftCached`).
+    -- (see the note in `Ix/Kernel/Subst.lean` `liftCached`).
     | .sort u _ =>
       pure (KExpr.mkSort (← TcM.ofExcept (substUniv u us)))
     | .const id curUs _ => do
@@ -871,7 +872,7 @@ def ensureForall (e : KExpr m) : RecM m (KExpr m × KExpr m) := do
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/ParCheck.lean b/Ix/Kernel/ParCheck.lean
similarity index 98%
rename from Ix/Tc/ParCheck.lean
rename to Ix/Kernel/ParCheck.lean
index 606eddc29..b214fa29a 100644
--- a/Ix/Tc/ParCheck.lean
+++ b/Ix/Kernel/ParCheck.lean
@@ -1,12 +1,12 @@
 module
 
-public import Ix.Tc.Driver
-public import Ix.Tc.IngressMeta
+public import Ix.Kernel.Driver
+public import Ix.Kernel.IngressMeta
 public import Std.Sync.Mutex
 
 /-!
 Parallel whole-env kernel check driver (`ix check-lean`'s engine) plus the
-eager parallel meta-ingress driver it needs (shared with `Ix.Tc.Validate`).
+eager parallel meta-ingress driver it needs (shared with `Ix.Kernel.Validate`).
 
 Mirrors the Rust parallel checker's coordination design
 (`crates/ffi/src/kernel.rs`: work-stealing over an atomic next-index,
@@ -47,7 +47,7 @@ per-constant fuel budget on both sides.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Set the stack size, in bytes, for subsequently spawned Lean runtime
     threads (`.dedicated` task threads and not-yet-spawned pool workers) —
@@ -392,7 +392,7 @@ def checkEnvParallel (kenv : KEnv m) (prims : Primitives m)
            failures := failures.qsort fun a b => a.1 < b.1
            elapsedMs := endMs - startMs }
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Primitive.lean b/Ix/Kernel/Primitive.lean
similarity index 99%
rename from Ix/Tc/Primitive.lean
rename to Ix/Kernel/Primitive.lean
index 026479be2..71e71a3b2 100644
--- a/Ix/Tc/Primitive.lean
+++ b/Ix/Kernel/Primitive.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Env
+public import Ix.Kernel.Env
 
 /-!
 Mirror: crates/kernel/src/primitive.rs
@@ -23,7 +23,7 @@ nested-inductive recursor generation), mirroring Rust.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Hardcoded canonical primitive addresses (for lookup in the env). -/
 structure PrimAddrs where
@@ -593,7 +593,7 @@ def ofAnonAddrs : Primitives .anon :=
 
 end Primitives
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Subst.lean b/Ix/Kernel/Subst.lean
similarity index 99%
rename from Ix/Tc/Subst.lean
rename to Ix/Kernel/Subst.lean
index 5e8329e57..462a12129 100644
--- a/Ix/Tc/Subst.lean
+++ b/Ix/Kernel/Subst.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Env
+public import Ix.Kernel.Env
 
 /-!
 Mirror: crates/kernel/src/subst.rs
@@ -21,7 +21,7 @@ node avoids gratuitous re-interning.
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- State monad over the intern table — the Lean face of Rust's
     `&mut InternTable` threading. -/
@@ -463,14 +463,14 @@ def internAppChain (base : KExpr m) : List (KExpr m) → InternM m (KExpr m)
 
 /-- Cheap beta reduction: peephole-reduce `App(λ…λ. body, args)` without full
     `subst` in trivial cases (closed body, or single-bvar body). Otherwise
-    returns the input unchanged (full WHNF handles it). Mirrors lean4lean's
+    returns the input unchanged (full WHNF handles it). Mirrors the named specification's
     `Expr.cheapBetaReduce`. -/
 def cheapBetaReduce (e : KExpr m) : InternM m (KExpr m) := do
   match cheapBetaPlan? e with
   | none => return e
   | some plan => internAppChain plan.base plan.trailing
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Validate.lean b/Ix/Kernel/Validate.lean
similarity index 98%
rename from Ix/Tc/Validate.lean
rename to Ix/Kernel/Validate.lean
index 9b27859fa..f0580674f 100644
--- a/Ix/Tc/Validate.lean
+++ b/Ix/Kernel/Validate.lean
@@ -1,13 +1,13 @@
 module
 
-public import Ix.Tc.Driver
-public import Ix.Tc.IngressMeta
-public import Ix.Tc.ParCheck
-public import Ix.Tc.EgressLean
+public import Ix.Kernel.Driver
+public import Ix.Kernel.IngressMeta
+public import Ix.Kernel.ParCheck
+public import Ix.Kernel.EgressLean
 public import Ix.CanonM
 
 /-!
-Whole-env validation drivers for the pure-Lean `Ix.Tc` pipeline — the
+Whole-env validation drivers for the pure-Lean `Ix.Kernel` pipeline — the
 shared core behind the `tc-roundtrip` test suite and `ix validate-lean`.
 
 Three gates over a Rust-compiled `.ixe` byte image:
@@ -18,7 +18,7 @@ Three gates over a Rust-compiled `.ixe` byte image:
    bytes EXACTLY.
 2. `anonRoundtripEnv` — structural kernel roundtrip: every constant
    anon-ingressed, egressed back to `Ixon.Constant`, canonically compared
-   (see `Ix.Tc.Egress`); projections byte-exact. Parallel per work item.
+   (see `Ix.Kernel.Egress`); projections byte-exact. Parallel per work item.
 3. `metaRoundtripEnv` — full-fidelity kernel roundtrip against the SOURCE
    Lean environment (the oracle): phase-parallel meta ingress of the
    whole env into one merged `KEnv .meta`, then per-named-entry egress to
@@ -36,7 +36,7 @@ Three gates over a Rust-compiled `.ixe` byte image:
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 
@@ -364,7 +364,7 @@ def metaRoundtripEnvStreaming (leanEnv : Lean.Environment)
           report := { report with errors := report.errors.push (name, msg) }
   return report
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/Tc/Verify/Audit/Basic.lean b/Ix/Kernel/Verify/Audit/Basic.lean
similarity index 64%
rename from Ix/Tc/Verify/Audit/Basic.lean
rename to Ix/Kernel/Verify/Audit/Basic.lean
index 54f1c2f61..69b1991bb 100644
--- a/Ix/Tc/Verify/Audit/Basic.lean
+++ b/Ix/Kernel/Verify/Audit/Basic.lean
@@ -1,16 +1,18 @@
 import Lean.Elab.Command
 import Lean.PrivateName
-import Lean.Util.CollectAxioms
 import Lean.Util.FoldConsts
+import Ix.Theory.Named.Std.AxiomAudit
 
 /-!
-# Exact trust-boundary auditing for `Ix.Tc.Verify`
+# Exact trust-boundary auditing for `Ix.Kernel.Verify`
 
-`Lean.collectAxioms` gives the kernel-computed, transitive axiom set for a
-declaration.  This module adds two pieces needed by the verification plan:
+The audit traverses the checked declarations directly, including types,
+theorem bodies, and inductive constructors. Imported axiom summaries can
+omit dependencies of recursive declaration groups, so they are not the
+source of truth here. The audit checks:
 
 * an exact, per-root allowlist split into ordinary Lean axioms, explicitly
-  named upstream implementation axioms, quarantined pending-upstream axioms,
+  named implementation bridge axioms, quarantined pending metatheory axioms,
   and generated `native_decide` axioms;
 * an exact list of the reachable declarations that use `sorryAx` directly,
   so permitting `sorryAx` cannot hide where that debt entered the proof.
@@ -21,7 +23,7 @@ import context from the concrete translation relations with which their
 opaque names currently collide.
 -/
 
-namespace Ix.Tc.Verify.Audit
+namespace Ix.Kernel.Verify.Audit
 
 open Lean
 open Lean.Elab.Command
@@ -29,19 +31,19 @@ open Lean.Elab.Command
 /-- The complete permitted trust boundary for one exported theorem root.
 
 Lean usually gives generated native axioms private names such as
-`_private.Ix.Tc.Expr.0....`; a public theorem proved directly by
+`_private.Ix.Kernel.Expr.0....`; a public theorem proved directly by
 `native_decide` can instead expose a public generated axiom.  Use
 `nativeAxiom` below for the private case.  `sorryOrigins` is checked by
 traversing the root's dependency graph. -/
 structure RootAllowance where
   root : Lean.Name
   standardAxioms : Array Lean.Name := #[]
-  /-- Nonlogical implementation bridge axioms inherited from an upstream
-  package.  These remain separate from Lean's three permitted logical axioms
-  so an executable upstream fixture cannot silently widen `standardAxioms`. -/
-  upstreamAxioms : Array Lean.Name := #[]
-  /-- Temporary local witnesses for facts expected from a future upstream
-  release.  Only the quarantined `Ix.Tc.Upstream.Pending` namespace may occur
+  /-- Nonlogical implementation bridge axioms retained in the local proof
+  support. These remain separate from Lean's three permitted logical axioms
+  so an executable fixture cannot silently widen `standardAxioms`. -/
+  implementationAxioms : Array Lean.Name := #[]
+  /-- Temporary local witnesses for unfinished metatheory proofs.
+  Only the quarantined `Ix.Kernel.Frontier.Pending` namespace may occur
   here; completed theorem roots must leave this category empty. -/
   pendingAxioms : Array Lean.Name := #[]
   nativeAxioms : Array Lean.Name := #[]
@@ -63,49 +65,10 @@ private def permittedStandardAxioms : Array Lean.Name :=
 private def sortNames (xs : Array Name) : Array Name :=
   xs.qsort Name.lt
 
-/-- Direct constant references, following the same declaration cases as
-`Lean.collectAxioms`.  In particular, opaque theorem values and inductive
-constructors are included. -/
-private def directConstants : ConstantInfo → Array Name
-  | .axiomInfo v => v.type.getUsedConstants
-  | .defnInfo v => v.type.getUsedConstants ++ v.value.getUsedConstants
-  | .thmInfo v => v.type.getUsedConstants ++ v.value.getUsedConstants
-  | .opaqueInfo v => v.type.getUsedConstants ++ v.value.getUsedConstants
-  | .quotInfo _ => #[]
-  | .ctorInfo v => v.type.getUsedConstants
-  | .recInfo v => v.type.getUsedConstants
-  | .inductInfo v => v.type.getUsedConstants ++ v.ctors
-
 namespace DependencyAudit
 
-structure State where
-  visited : NameSet := {}
-  names : Array Name := #[]
-  origins : Array Name := #[]
-
-abbrev M := ReaderT Environment (StateM State)
-
-/-- Traverse the checked kernel environment and record each reachable
-declaration whose type or value directly mentions `sorryAx`. -/
-partial def visit (declName : Name) : M Unit := do
-  let state ← get
-  unless state.visited.contains declName do
-    modify fun s =>
-      { s with
-        visited := s.visited.insert declName
-        names := s.names.push declName }
-    let env ← read
-    match env.checked.get.find? declName with
-    | none => pure ()
-    | some info =>
-      let dependencies := directConstants info
-      if declName != ``sorryAx && dependencies.contains ``sorryAx then
-        modify fun s => { s with origins := s.origins.push declName }
-      dependencies.forM visit
-
-def collect (env : Environment) (root : Name) : State :=
-  let (_, state) := ((visit root).run env).run {}
-  state
+abbrev State := Ix.Theory.Named.AxiomAudit.State
+abbrev collect := Ix.Theory.Named.AxiomAudit.collect
 
 end DependencyAudit
 
@@ -114,20 +77,20 @@ private def validateCategories (allowance : RootAllowance) :
   for axiomName in allowance.standardAxioms do
     unless permittedStandardAxioms.contains axiomName do
       throwError m!"{allowance.root}: {axiomName} is not a permitted standard Lean axiom"
-  for axiomName in allowance.upstreamAxioms do
+  for axiomName in allowance.implementationAxioms do
     let rendered := axiomName.toString
     unless rendered.startsWith "Lean." || rendered.startsWith "Std." ||
-        rendered.startsWith "Lean4Lean." do
-      throwError m!"{allowance.root}: upstream axiom is outside Lean/Std/Lean4Lean: {axiomName}"
+        rendered.startsWith "Ix.Theory.Named." do
+      throwError m!"{allowance.root}: implementation axiom is outside Lean/Std/Ix.Theory.Named: {axiomName}"
     if permittedStandardAxioms.contains axiomName then
-      throwError m!"{allowance.root}: standard axiom misclassified as upstream: {axiomName}"
+      throwError m!"{allowance.root}: standard axiom misclassified as implementation: {axiomName}"
     if axiomName == ``sorryAx then
       throwError m!"{allowance.root}: sorryAx must be accounted for by sorryOrigins"
     if Lean.isPrivateName axiomName then
       throwError m!"{allowance.root}: private axiom must be accounted for as native: {axiomName}"
   for axiomName in allowance.pendingAxioms do
-    unless axiomName.toString.startsWith "Ix.Tc.Upstream.Pending." do
-      throwError m!"{allowance.root}: pending axiom is outside Ix.Tc.Upstream.Pending: {axiomName}"
+    unless axiomName.toString.startsWith "Ix.Kernel.Frontier.Pending." do
+      throwError m!"{allowance.root}: pending axiom is outside Ix.Kernel.Frontier.Pending: {axiomName}"
     if permittedStandardAxioms.contains axiomName then
       throwError m!"{allowance.root}: standard axiom misclassified as pending: {axiomName}"
     if axiomName == ``sorryAx then
@@ -139,18 +102,19 @@ private def validateCategories (allowance : RootAllowance) :
       throwError m!"{allowance.root}: malformed native_decide axiom: {axiomName}"
 
 private def expectedAxioms (allowance : RootAllowance) : Array Lean.Name :=
-  let expected := allowance.standardAxioms ++ allowance.upstreamAxioms ++
+  let expected := allowance.standardAxioms ++ allowance.implementationAxioms ++
     allowance.pendingAxioms ++ allowance.nativeAxioms
   sortNames <| if allowance.sorryOrigins.isEmpty then expected
     else expected.push ``sorryAx
 
-private def checkOne (allowance : RootAllowance) : CommandElabM Unit := do
+private def checkOne (allowance : RootAllowance) (dependencyAudit : DependencyAudit.State) :
+    CommandElabM Unit := do
   validateCategories allowance
   let env ← getEnv
   unless env.contains allowance.root do
     throwError m!"axiom-audit root does not exist: {allowance.root}"
 
-  let actualAxioms := sortNames (← Lean.collectAxioms allowance.root)
+  let actualAxioms := sortNames dependencyAudit.axioms
   let expectedAxioms := expectedAxioms allowance
   unless actualAxioms == expectedAxioms do
     let missing := expectedAxioms.filter fun name =>
@@ -164,7 +128,6 @@ private def checkOne (allowance : RootAllowance) : CommandElabM Unit := do
   -- Origin and architectural-quarantine checks consume the same transitive
   -- dependency graph. Keep one exact traversal per root: large generated
   -- recursor proofs make two independent walks unnecessarily expensive.
-  let dependencyAudit := DependencyAudit.collect env allowance.root
   let actualOrigins := sortNames dependencyAudit.origins
   let expectedOrigins := sortNames allowance.sorryOrigins
   unless actualOrigins == expectedOrigins do
@@ -173,12 +136,12 @@ private def checkOne (allowance : RootAllowance) : CommandElabM Unit := do
       actual direct origins:   {repr actualOrigins.toList}"
 
   -- A root is unconditional exactly when it has no explicitly enumerated
-  -- pending-upstream axioms.  Such a root must not reach even axiom-free
+  -- pending metatheory axioms.  Such a root must not reach even axiom-free
   -- helper definitions from the quarantine module: otherwise replacing a
   -- pending witness could silently change the completed proof surface.
   if allowance.pendingAxioms.isEmpty then
     for dependency in dependencyAudit.names do
-      if dependency.toString.startsWith "Ix.Tc.Upstream.Pending." then
+      if dependency.toString.startsWith "Ix.Kernel.Frontier.Pending." then
         throwError m!"{allowance.root}: unconditional root reaches quarantined dependency {dependency}"
 
   for forbidden in allowance.forbiddenDependencies do
@@ -188,12 +151,17 @@ private def checkOne (allowance : RootAllowance) : CommandElabM Unit := do
 /-- Check a complete executable trust manifest.  Duplicate roots are rejected
 instead of being silently audited twice. -/
 def check (allowances : Array RootAllowance) : CommandElabM Unit := do
+  let env ← getEnv
   let mut roots : NameSet := {}
+  let mut cache : Ix.Theory.Named.AxiomAudit.Cache := {}
   for allowance in allowances do
     if roots.contains allowance.root then
       throwError m!"duplicate axiom-audit root: {allowance.root}"
     roots := roots.insert allowance.root
-    checkOne allowance
-  logInfo m!"Ix.Tc verification trust audit passed for {allowances.size} theorem roots"
+    let (dependencies, nextCache) :=
+      Ix.Theory.Named.AxiomAudit.collectCached env allowance.root cache
+    cache := nextCache
+    checkOne allowance dependencies
+  logInfo m!"Ix.Kernel verification trust audit passed for {allowances.size} theorem roots"
 
-end Ix.Tc.Verify.Audit
+end Ix.Kernel.Verify.Audit
diff --git a/Ix/Tc/Verify/Audit/Completed.lean b/Ix/Kernel/Verify/Audit/Completed.lean
similarity index 59%
rename from Ix/Tc/Verify/Audit/Completed.lean
rename to Ix/Kernel/Verify/Audit/Completed.lean
index 920f76509..85a6a60aa 100644
--- a/Ix/Tc/Verify/Audit/Completed.lean
+++ b/Ix/Kernel/Verify/Audit/Completed.lean
@@ -1,133 +1,135 @@
-import Ix.Tc.Verify.Audit.Basic
-import Ix.Tc.Verify.Check.Acceptance
-import Ix.Tc.Verify.Check.BoundedPipelines
-import Ix.Tc.Verify.Check.CheckerEvidence
-import Ix.Tc.Verify.Check.FullInferenceApplications
-import Ix.Tc.Verify.Check.FullInferenceBinders
-import Ix.Tc.Verify.Check.FullInferenceCache
-import Ix.Tc.Verify.Check.FullInferenceDispatcher
-import Ix.Tc.Verify.Check.FullInferenceProjections
-import Ix.Tc.Verify.Check.MemberEvidence
-import Ix.Tc.Verify.Check.NatAcceptance
-import Ix.Tc.Verify.Check.BlockNatFixture
-import Ix.Tc.Verify.Check.PreTranslationScopes
-import Ix.Tc.Verify.Check.PositiveFuelSort
-import Ix.Tc.Verify.Check.ScopedPositiveFuelCertificate
-import Ix.Tc.Verify.Check.SingletonInductive
-import Ix.Tc.Verify.Inductive.EnumerationAcceptance
-import Ix.Tc.Verify.Check.ProjectionInferencePolicy
-import Ix.Tc.Verify.Check.ResetFrame
-import Ix.Tc.Verify.Check.SafetyFrame
-import Ix.Tc.Verify.Check.PublicStandalone
-import Ix.Tc.Verify.Check.PublicBlocks
-import Ix.Tc.Verify.Check.ValidatorFrame
-import Ix.Tc.Verify.Ctx
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.DefEq
-import Ix.Tc.Verify.DefEq.AcceleratorGates
-import Ix.Tc.Verify.DefEq.ApplicationSpine
-import Ix.Tc.Verify.DefEq.CacheShell
-import Ix.Tc.Verify.DefEq.Closure
-import Ix.Tc.Verify.DefEq.DeltaClassification
-import Ix.Tc.Verify.DefEq.EqualRankCache
-import Ix.Tc.Verify.DefEq.EqualRankPrefix
-import Ix.Tc.Verify.DefEq.EqualRankReduction
-import Ix.Tc.Verify.DefEq.FinalWhnf.Application
-import Ix.Tc.Verify.DefEq.FinalWhnf.Closure
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
-import Ix.Tc.Verify.DefEq.FinalWhnf.EtaExpansion
-import Ix.Tc.Verify.DefEq.FinalWhnf.LetDeclaration
-import Ix.Tc.Verify.DefEq.FinalWhnf.NatBridge
-import Ix.Tc.Verify.DefEq.FinalWhnf.ProofTail
-import Ix.Tc.Verify.DefEq.FinalWhnf.StringExpansion
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructuralPrefix
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructureEta
-import Ix.Tc.Verify.DefEq.FinalWhnf.UnitLike
-import Ix.Tc.Verify.DefEq.LazyDelta
-import Ix.Tc.Verify.DefEq.LazyDeltaClosure
-import Ix.Tc.Verify.DefEq.LazyDeltaIteration
-import Ix.Tc.Verify.DefEq.LoopFinish
-import Ix.Tc.Verify.DefEq.NatOffset
-import Ix.Tc.Verify.DefEq.NatOffsetDecomposition
-import Ix.Tc.Verify.DefEq.NatReduction
-import Ix.Tc.Verify.DefEq.OneSidedDelta
-import Ix.Tc.Verify.DefEq.ProjectionDeltaActive
-import Ix.Tc.Verify.DefEq.ProjectionDeltaClosure
-import Ix.Tc.Verify.DefEq.ProjectionDeltaEqualRank
-import Ix.Tc.Verify.DefEq.ProjectionDeltaFinish
-import Ix.Tc.Verify.DefEq.ProjectionDeltaLoop
-import Ix.Tc.Verify.DefEq.ProjectionDeltaRank
-import Ix.Tc.Verify.DefEq.ProjectionDeltaStep
-import Ix.Tc.Verify.DefEq.ProjectionDeltaUnfolding
-import Ix.Tc.Verify.DefEq.ProjectionProbe
-import Ix.Tc.Verify.DefEq.ProjectionReduction
-import Ix.Tc.Verify.DefEq.PropositionClassifier
-import Ix.Tc.Verify.DefEq.RankDispatch
-import Ix.Tc.Verify.DefEq.SameHeadSpine
-import Ix.Tc.Verify.DefEq.SpineArguments
-import Ix.Tc.Verify.DefEq.StoppedContinuation
-import Ix.Tc.Verify.DefEq.StoppedContinuationClosure
-import Ix.Tc.Verify.DefEq.StructuralCongruence
-import Ix.Tc.Verify.Driver.Fixtures
-import Ix.Tc.Verify.Driver.BooleanAcceptance
-import Ix.Tc.Verify.Driver.SupportedAcceptanceFixtures
-import Ix.Tc.Verify.Execution
-import Ix.Tc.Verify.Frame
-import Ix.Tc.Verify.Infer.CacheSoundness
-import Ix.Tc.Verify.InferDefEq.Closure
-import Ix.Tc.Verify.Inductive.Certificate
-import Ix.Tc.Verify.Inductive.AliasFormerAdmission
-import Ix.Tc.Verify.Inductive.AliasRecAdmission
-import Ix.Tc.Verify.Inductive.AnnotatedPiCertificate
-import Ix.Tc.Verify.Inductive.AnnotatedPiAdmission
-import Ix.Tc.Verify.Inductive.EliminationBreadthFixture
-import Ix.Tc.Verify.Inductive.MutualBlockCertificate
-import Ix.Tc.Verify.Inductive.MutualFamilyAdmission
-import Ix.Tc.Verify.Inductive.IndexedRecursiveCertificate
-import Ix.Tc.Verify.Inductive.RecursivePiCertificate
-import Ix.Tc.Verify.Inductive.RecursivePiAdmission
-import Ix.Tc.Verify.Inductive.IndexedRecursiveAcceptance
-import Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-import Ix.Tc.Verify.Inductive.SpecializationIdentity
-import Ix.Tc.Verify.Inductive.GeneratedRecursorMetadata
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAcceptance
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAcceptanceClosure
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAdmission
-import Ix.Tc.Verify.Inductive.IndexedProducerClosure
-import Ix.Tc.Verify.Inductive.GeneratedRecursorCheckerFixture
-import Ix.Tc.Verify.Inductive.GeneratedRecursorCommitFixture
-import Ix.Tc.Verify.Inductive.GeneratedRecursorComparison
-import Ix.Tc.Verify.Inductive.GeneratedRecursorRuleFixture
-import Ix.Tc.Verify.Inductive.GeneratedRecursorSelection
-import Ix.Tc.Verify.Inductive.GeneratedRecursorSemantics
-import Ix.Tc.Verify.Inductive.GeneratedRecursorTypeClosure
-import Ix.Tc.Verify.Inductive.GeneratedRecursorTypeFixture
-import Ix.Tc.Verify.Inductive.NestedAuxiliaryExpansion
-import Ix.Tc.Verify.Inductive.NestedAdmission
-import Ix.Tc.Verify.Inductive.NestedConstructorValidation
-import Ix.Tc.Verify.Inductive.NestedRecursiveFixture
-import Ix.Tc.Verify.Inductive.NestedRecursorAdmission
-import Ix.Tc.Verify.Inductive.OccurrenceClosure
-import Ix.Tc.Verify.Inductive.PositivityTraceAdapter
-import Ix.Tc.Verify.Inductive.RecursivePositivityTraversal
-import Ix.Tc.Verify.Ingress.LiteralBlobs
-import Ix.Tc.Verify.Ingress.SerializedBoolean
-import Ix.Tc.Verify.InstL
-import Ix.Tc.Verify.Whnf.Closure
-import Ix.Tc.Verify.Knot
-import Ix.Tc.Verify.NatFixture
-import Ix.Tc.Verify.Projection.ConcreteFixture
-import Ix.Tc.Verify.Run
-import Ix.Tc.Verify.RecursiveMethods.Closure
-import Ix.Tc.Verify.RecursiveMethods.FiniteSupportBoundary
-import Ix.Tc.Verify.RecursiveMethods.Public
-import Ix.Tc.Verify.Support
-import Ix.Tc.Verify.Totalization
-import Ix.Tc.Verify.Whnf
-import Ix.Tc.Verify.World
+import Ix.Kernel.Verify.Audit.Basic
+import Ix.Kernel.Verify.Check.Acceptance
+import Ix.Kernel.Verify.Check.BoundedPipelines
+import Ix.Kernel.Verify.Check.CheckerEvidence
+import Ix.Kernel.Verify.Check.FullInferenceApplications
+import Ix.Kernel.Verify.Check.FullInferenceBinders
+import Ix.Kernel.Verify.Check.FullInferenceCache
+import Ix.Kernel.Verify.Check.FullInferenceDispatcher
+import Ix.Kernel.Verify.Check.FullInferenceProjections
+import Ix.Kernel.Verify.Check.MemberEvidence
+import Ix.Kernel.Verify.Check.NatAcceptance
+import Ix.Kernel.Verify.Check.BlockNatFixture
+import Ix.Kernel.Verify.Check.PreTranslationScopes
+import Ix.Kernel.Verify.Check.PositiveFuelSort
+import Ix.Kernel.Verify.Check.ScopedPositiveFuelCertificate
+import Ix.Kernel.Verify.Check.SingletonInductive
+import Ix.Kernel.Verify.Inductive.EnumerationAcceptance
+import Ix.Kernel.Verify.Check.ProjectionInferencePolicy
+import Ix.Kernel.Verify.Check.ResetFrame
+import Ix.Kernel.Verify.Check.SafetyFrame
+import Ix.Kernel.Verify.Check.PublicStandalone
+import Ix.Kernel.Verify.Check.PublicBlocks
+import Ix.Kernel.Verify.Check.ValidatorFrame
+import Ix.Kernel.Verify.Ctx
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.DefEq
+import Ix.Kernel.Verify.DefEq.AcceleratorGates
+import Ix.Kernel.Verify.DefEq.ApplicationSpine
+import Ix.Kernel.Verify.DefEq.CacheShell
+import Ix.Kernel.Verify.DefEq.Closure
+import Ix.Kernel.Verify.DefEq.DeltaClassification
+import Ix.Kernel.Verify.DefEq.EqualRankCache
+import Ix.Kernel.Verify.DefEq.EqualRankPrefix
+import Ix.Kernel.Verify.DefEq.EqualRankReduction
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Application
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Closure
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.FinalWhnf.EtaExpansion
+import Ix.Kernel.Verify.DefEq.FinalWhnf.LetDeclaration
+import Ix.Kernel.Verify.DefEq.FinalWhnf.NatBridge
+import Ix.Kernel.Verify.DefEq.FinalWhnf.ProofTail
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StringExpansion
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructuralPrefix
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructureEta
+import Ix.Kernel.Verify.DefEq.FinalWhnf.UnitLike
+import Ix.Kernel.Verify.DefEq.LazyDelta
+import Ix.Kernel.Verify.DefEq.LazyDeltaClosure
+import Ix.Kernel.Verify.DefEq.LazyDeltaIteration
+import Ix.Kernel.Verify.DefEq.LoopFinish
+import Ix.Kernel.Verify.DefEq.NatOffset
+import Ix.Kernel.Verify.DefEq.NatOffsetDecomposition
+import Ix.Kernel.Verify.DefEq.NatReduction
+import Ix.Kernel.Verify.DefEq.OneSidedDelta
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaActive
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaClosure
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaEqualRank
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaFinish
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaLoop
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaRank
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaStep
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaUnfolding
+import Ix.Kernel.Verify.DefEq.ProjectionProbe
+import Ix.Kernel.Verify.DefEq.ProjectionReduction
+import Ix.Kernel.Verify.DefEq.PropositionClassifier
+import Ix.Kernel.Verify.DefEq.RankDispatch
+import Ix.Kernel.Verify.DefEq.SameHeadSpine
+import Ix.Kernel.Verify.DefEq.SpineArguments
+import Ix.Kernel.Verify.DefEq.StoppedContinuation
+import Ix.Kernel.Verify.DefEq.StoppedContinuationClosure
+import Ix.Kernel.Verify.DefEq.StructuralCongruence
+import Ix.Kernel.Verify.Driver.Fixtures
+import Ix.Kernel.Verify.Driver.BooleanAcceptance
+import Ix.Kernel.Verify.Driver.SupportedAcceptanceFixtures
+import Ix.Kernel.Verify.Execution
+import Ix.Kernel.Verify.Frame
+import Ix.Kernel.Verify.Infer.CacheSoundness
+import Ix.Kernel.Verify.InferDefEq.Closure
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Kernel.Verify.Inductive.AliasFormerAdmission
+import Ix.Kernel.Verify.Inductive.AliasRecAdmission
+import Ix.Kernel.Verify.Inductive.AnnotatedPiCertificate
+import Ix.Kernel.Verify.Inductive.AnnotatedPiAdmission
+import Ix.Kernel.Verify.Inductive.EliminationBreadthFixture
+import Ix.Kernel.Verify.Inductive.MutualBlockCertificate
+import Ix.Kernel.Verify.Inductive.MutualFamilyAdmission
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveCertificate
+import Ix.Kernel.Verify.Inductive.RecursivePiCertificate
+import Ix.Kernel.Verify.Inductive.RecursivePiAdmission
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveAcceptance
+import Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+import Ix.Kernel.Verify.Inductive.SpecializationIdentity
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorMetadata
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAcceptance
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAcceptanceClosure
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAdmission
+import Ix.Kernel.Verify.Inductive.IndexedProducerClosure
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorCheckerFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorCommitFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorComparison
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorRuleFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorSelection
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorSemantics
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeClosure
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeFixture
+import Ix.Kernel.Verify.Inductive.NestedAuxiliaryExpansion
+import Ix.Kernel.Verify.Inductive.NestedAdmission
+import Ix.Kernel.Verify.Inductive.NestedConstructorValidation
+import Ix.Kernel.Verify.Inductive.NestedRecursiveFixture
+import Ix.Kernel.Verify.Inductive.NestedRecursorAdmission
+import Ix.Kernel.Verify.Inductive.OccurrenceClosure
+import Ix.Kernel.Verify.Inductive.PositivityTraceAdapter
+import Ix.Kernel.Verify.Inductive.RecursivePositivityTraversal
+import Ix.Kernel.Verify.Ingress.LiteralBlobs
+import Ix.Kernel.Verify.Ingress.SerializedBoolean
+import Ix.Kernel.Verify.InstL
+import Ix.Kernel.Verify.Whnf.Closure
+import Ix.Kernel.Verify.Knot
+import Ix.Kernel.Verify.NatFixture
+import Ix.Kernel.Verify.Projection.ConcreteFixture
+import Ix.Kernel.Verify.Run
+import Ix.Kernel.Verify.RecursiveMethods.Closure
+import Ix.Kernel.Verify.RecursiveMethods.FiniteSupportBoundary
+import Ix.Kernel.Verify.RecursiveMethods.Public
+import Ix.Kernel.Verify.Support
+import Ix.Kernel.Verify.Totalization
+import Ix.Kernel.Verify.Whnf
+import Ix.Kernel.Verify.World
+
+open Ix.Theory (VLevel)
 
 /-!
-# Trust manifest for the completed `Ix.Tc.Verify` proof surface
+# Trust manifest for the completed `Ix.Kernel.Verify` proof surface
 
 These are the current completed foundations and reusable semantic interfaces
 that later C1--C3 roots will consume.  A new headline theorem must be added here
@@ -141,9 +143,9 @@ transitive trust boundary of any one interface should produce a focused CI
 failure.  Shared arrays below are only labels for exactly repeated sets.
 -/
 
-namespace Ix.Tc.Verify.Audit.Completed
+namespace Ix.Kernel.Verify.Audit.Completed
 
-open Ix.Tc.Verify.Audit
+open Ix.Kernel.Verify.Audit
 
 private def standard : Array Lean.Name :=
   #[``propext, ``Classical.choice, ``Quot.sound]
@@ -156,12 +158,12 @@ private def standardWithoutQuot : Array Lean.Name :=
 
 private def propextOnly : Array Lean.Name := #[``propext]
 
-/- The executable `AnnotatedPi` replay in the pinned Lean4Lean fork crosses
+/- The executable `AnnotatedPi` replay in the local named specification crosses
 its verified wrappers for Lean's pointer-aware expression implementation.
 Keep that nonlogical upstream footprint distinct from `standard`: these are
 not ordinary logical axioms and must not become globally permitted. -/
 private def annotatedPiUpstreamAxioms : Array Lean.Name := #[
-  ``Lean4Lean.ptrEqConstantInfo_eq,
+  ``Ix.Theory.Named.ptrEqConstantInfo_eq,
   ``Lean.Expr.abstractRange_eq,
   ``Lean.Expr.abstract_eq,
   ``Lean.Expr.eqv_eq,
@@ -189,17 +191,17 @@ private def annotatedPiUpstreamAxioms : Array Lean.Name := #[
   ``Std.TreeMap.all_eq_all_toList
 ]
 
-/- Exact direct `sorryAx` frontier inherited from Lean4Lean's executable
+/- Exact direct `sorryAx` frontier inherited from Ix.Theory.Named's executable
 candidate-normalization proof.  Unlike the earlier closed-form fixtures,
 `AnnotatedPi` exercises the verified implementation path far enough to reach
 the currently declared projection/typechecker proof debt. -/
 private def annotatedPiUpstreamDebt : Array Lean.Name := #[
-  ``Lean4Lean.VEnv.IsDefEqU.forallE_inv_stratified,
-  ``Lean4Lean.VEnv.IsDefEqU.sort_forallE_inv,
-  ``Lean4Lean.VEnv.IsDefEqU.sort_inv,
-  ``Lean4Lean.VEnv.IsDefEqU.weakN_iff,
-  ``Lean4Lean.VEnv.WF.registeredStructureHeadInversion,
-  ``Lean4Lean.TypeChecker.Inner.reduceRecursor.WF
+  ``Ix.Theory.Named.VEnv.IsDefEqU.forallE_inv_stratified,
+  ``Ix.Theory.Named.VEnv.IsDefEqU.sort_forallE_inv,
+  ``Ix.Theory.Named.VEnv.IsDefEqU.sort_inv,
+  ``Ix.Theory.Named.VEnv.IsDefEqU.weakN_iff,
+  ``Ix.Theory.Named.VEnv.WF.registeredStructureHeadInversion,
+  ``Ix.Theory.Named.TypeChecker.Inner.reduceRecursor.WF
 ]
 
 /- `AliasFormer` reaches the same executable normalization boundary as
@@ -211,7 +213,7 @@ private def aliasFormerUpstreamAxioms : Array Lean.Name :=
 
 private def aliasFormerUpstreamDebt : Array Lean.Name :=
   annotatedPiUpstreamDebt.push
-    ``Lean4Lean.InductiveReplayFixtures.aliasFormerAlignmentRun
+    ``Ix.Theory.Named.InductiveReplayFixtures.aliasFormerAlignmentRun
 
 /- `AliasRec` reaches the same executable normalization boundary while
 unfolding a reducible wrapper around a recursive constructor field.  Keep its
@@ -222,31 +224,26 @@ private def aliasRecUpstreamAxioms : Array Lean.Name :=
 private def aliasRecUpstreamDebt : Array Lean.Name :=
   annotatedPiUpstreamDebt
 
-private def blake3Native : Array Lean.Name := #[
-  nativeAxiom `Blake3
-    `Blake3.HasherOps.hash._native.native_decide.ax_1
-]
-
-private def expressionNative : Array Lean.Name := blake3Native.push
-  (nativeAxiom `Ix.Tc.Expr
-    `Ix.Tc.KExpr.mkVar._native.native_decide.ax_1)
+private def expressionNative : Array Lean.Name := #[].push
+  (nativeAxiom `Ix.Kernel.Expr
+    `Ix.Kernel.KExpr.mkVar._native.native_decide.ax_1)
 
 private def levelNative : Array Lean.Name := expressionNative.push
-  (nativeAxiom `Ix.Tc.Level
-    `Ix.Tc.KUniv.mkSucc._native.native_decide.ax_1)
+  (nativeAxiom `Ix.Kernel.Level
+    `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1)
 
-private def occurrenceValidationNative : Array Lean.Name := blake3Native.push
-  (nativeAxiom `Ix.Tc.Level
-    `Ix.Tc.KUniv.mkSucc._native.native_decide.ax_1)
+private def occurrenceValidationNative : Array Lean.Name := #[].push
+  (nativeAxiom `Ix.Kernel.Level
+    `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1)
 
 private def specializationIdentityNative : Array Lean.Name :=
   occurrenceValidationNative.push
-    (nativeAxiom `Ix.Tc.Verify.Inductive.SpecializationIdentity
-      `Ix.Tc.SpecializationIdentityFixture.semanticUniverseEquality_does_not_collapse_specializationNative._native.native_decide.ax_1_1)
+    (nativeAxiom `Ix.Kernel.Verify.Inductive.SpecializationIdentity
+      `Ix.Kernel.SpecializationIdentityFixture.semanticUniverseEquality_does_not_collapse_specializationNative._native.native_decide.ax_1_1)
 
 private def univOnlyNative : Array Lean.Name := #[
-  nativeAxiom `Ix.Tc.Level
-    `Ix.Tc.KUniv.mkSucc._native.native_decide.ax_1
+  nativeAxiom `Ix.Kernel.Level
+    `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1
 ]
 
 private def nameDecideNative : Lean.Name :=
@@ -259,38 +256,31 @@ private def expressionNameNative : Array Lean.Name :=
   expressionNative.push nameDecideNative
 
 private def canonicalPrimitivesNative : Array Lean.Name :=
-  blake3Native.push nameDecideNative
-
-private def ctxAddrNative : Lean.Name :=
-  nativeAxiom `Ix.Tc.Monad
-    `Ix.Tc.TcM.ctxAddrForLbrUncached._native.native_decide.ax_3
-
-private def blake3ContextNative : Array Lean.Name :=
-  blake3Native.push ctxAddrNative
+  #[].push nameDecideNative
 
 private def contextNative : Array Lean.Name :=
-  expressionNative.push ctxAddrNative
+  expressionNative
 
 private def inferNative : Array Lean.Name :=
-  levelNative.push ctxAddrNative
+  levelNative
 
 private def nameContextNative : Array Lean.Name :=
-  nameNative.push ctxAddrNative
+  nameNative
 
 private def canonicalPrimitivesContextNative : Array Lean.Name :=
-  canonicalPrimitivesNative.push ctxAddrNative
+  canonicalPrimitivesNative
 
 private def natAddNeSuccNative : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.NatFixture
-    `Ix.Tc.AmbientNat.natAdd_ne_natSucc._native.native_decide.ax_1_1
+  nativeAxiom `Ix.Kernel.Verify.NatFixture
+    `Ix.Kernel.AmbientNat.natAdd_ne_natSucc._native.native_decide.ax_1_1
 
 private def natAddNeBeqNative : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.NatFixture
-    `Ix.Tc.AmbientNat.natAdd_ne_natBeq._native.native_decide.ax_1_1
+  nativeAxiom `Ix.Kernel.Verify.NatFixture
+    `Ix.Kernel.AmbientNat.natAdd_ne_natBeq._native.native_decide.ax_1_1
 
 private def natAddNeBleNative : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.NatFixture
-    `Ix.Tc.AmbientNat.natAdd_ne_natBle._native.native_decide.ax_1_1
+  nativeAxiom `Ix.Kernel.Verify.NatFixture
+    `Ix.Kernel.AmbientNat.natAdd_ne_natBle._native.native_decide.ax_1_1
 
 private def natReductionNative : Array Lean.Name :=
   (((contextNative.push nameDecideNative).push natAddNeSuccNative).push
@@ -311,8 +301,8 @@ private def natBranchOrderNative : Array Lean.Name :=
 private def inductiveNative : Array Lean.Name := (inferNative.push
   (nativeAxiom `Ix.Environment
     `Ix.Name.mkStr._native.native_decide.ax_1)).push
-  (nativeAxiom `Ix.Tc.Inductive
-    `Ix.Tc.RecM.canonicalAuxOrder._native.native_decide.ax_9)
+  (nativeAxiom `Ix.Kernel.Inductive
+    `Ix.Kernel.RecM.canonicalAuxOrder._native.native_decide.ax_9)
 
 /- Mutual-block fixtures use many small closed `native_decide` facts.  Build
 their exact private names structurally so the audit stays reviewable while
@@ -321,7 +311,7 @@ private def mutualNativeUserName (decl : String) (index : Nat) : Lean.Name :=
   Lean.Name.str
     (Lean.Name.str
       (Lean.Name.str
-        (Lean.Name.str `Ix.Tc.MutualTreeFixture decl)
+        (Lean.Name.str `Ix.Kernel.MutualTreeFixture decl)
         "_native")
       "native_decide")
     s!"ax_1_{index + 1}"
@@ -341,15 +331,15 @@ private def mutualNativeSingletons (moduleName : Lean.Name)
 
 private def mutualFamilyAdmissionNativeSeries (decl : String)
     (count : Nat) : Array Lean.Name :=
-  mutualNativeSeries `Ix.Tc.Verify.Inductive.MutualFamilyAdmission decl count
+  mutualNativeSeries `Ix.Kernel.Verify.Inductive.MutualFamilyAdmission decl count
 
 private def mutualBlockFixtureNativeSeries (decl : String)
     (count : Nat) : Array Lean.Name :=
-  mutualNativeSeries `Ix.Tc.Verify.Inductive.MutualBlockFixture decl count
+  mutualNativeSeries `Ix.Kernel.Verify.Inductive.MutualBlockFixture decl count
 
 private def mutualRecursorAdmissionNativeSeries (decl : String)
     (count : Nat) : Array Lean.Name :=
-  mutualNativeSeries `Ix.Tc.Verify.Inductive.MutualRecursorAdmission decl count
+  mutualNativeSeries `Ix.Kernel.Verify.Inductive.MutualRecursorAdmission decl count
 
 private def mutualInternDataValueNative : Lean.Name :=
   nativeAxiom `Ix.CanonM
@@ -378,20 +368,20 @@ def mutualFamilyNative : Array Lean.Name :=
   mutualPublicNativeSeries "nameOf_treeList" 2 ++
   mutualPublicNativeSeries "familyMembers_eq" 1 ++
   mutualPublicNativeSeries "recursorMembers_eq" 1 ++
-  mutualNativeSingletons `Ix.Tc.Verify.Inductive.MutualBlockFixture #[
+  mutualNativeSingletons `Ix.Kernel.Verify.Inductive.MutualBlockFixture #[
     "familyAuxCompileSucceededNative",
     "familyBlockLoadedNative",
     "familyIngressSucceededNative",
     "recursorBlockLoadedNative",
     "recursorIngressSucceededNative"
   ] ++
-  mutualNativeSingletons `Ix.Tc.Verify.Inductive.MutualBlockValidation #[
+  mutualNativeSingletons `Ix.Kernel.Verify.Inductive.MutualBlockValidation #[
     "familyKernelSucceededNative",
     "recursorKernelSucceededNative"
   ] ++
   mutualFamilyAdmissionNativeSeries "familyMemberShapeFactsNative" 19 ++
   mutualFamilyAdmissionNativeSeries "ownershipShapeFactsNative" 9 ++
-  mutualNativeSingletons `Ix.Tc.Verify.Inductive.MutualFamilyAdmission #[
+  mutualNativeSingletons `Ix.Kernel.Verify.Inductive.MutualFamilyAdmission #[
     "treeBranchTypeRawNative",
     "treeLeafTypeRawNative",
     "treeListConsTypeRawNative",
@@ -411,7 +401,7 @@ def mutualRecursorConditionalNative : Array Lean.Name :=
   mutualRecursorAdmissionNativeSeries
     "physicalSourceMembershipFactsNative" 5 ++
   mutualRecursorAdmissionNativeSeries "recursorRepresentationFactsNative" 55 ++
-  mutualNativeSingletons `Ix.Tc.Verify.Inductive.MutualRecursorAdmission #[
+  mutualNativeSingletons `Ix.Kernel.Verify.Inductive.MutualRecursorAdmission #[
     "branchRuleRawNative",
     "consRuleRawNative",
     "flatCtorFour",
@@ -443,187 +433,187 @@ def mutualRecursorConditionalNative : Array Lean.Name :=
   ]
 
 private def recursivePiFixtureNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.RecursivePiFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.RecursivePiFixture name
 
 private def recursivePiRecursorFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.RecursivePiRecursorFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.RecursivePiRecursorFixture name
 
 private def recursivePiAdmissionNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.RecursivePiAdmission name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.RecursivePiAdmission name
 
 private def annotatedPiCertificateNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AnnotatedPiCertificate name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AnnotatedPiCertificate name
 
 private def annotatedPiCertificateBreadthNative : Array Lean.Name := #[
   annotatedPiCertificateNativeAxiom
-    `Ix.Tc.AnnotatedPiCertificateFixture.breadthNative._native.native_decide.ax_1_1
+    `Ix.Kernel.AnnotatedPiCertificateFixture.breadthNative._native.native_decide.ax_1_1
 ]
 
 private def annotatedPiFixtureNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AnnotatedPiFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AnnotatedPiFixture name
 
 private def annotatedPiRecursorFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AnnotatedPiRecursorFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AnnotatedPiRecursorFixture name
 
 private def annotatedPiAdmissionNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AnnotatedPiAdmission name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AnnotatedPiAdmission name
 
 private def aliasFormerCertificateNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasFormerCertificate name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasFormerCertificate name
 
 private def aliasFormerCertificateBreadthNative : Array Lean.Name := #[
   aliasFormerCertificateNativeAxiom
-    `Ix.Tc.AliasFormerCertificateFixture.breadthNative._native.native_decide.ax_1_1
+    `Ix.Kernel.AliasFormerCertificateFixture.breadthNative._native.native_decide.ax_1_1
 ]
 
 private def aliasFormerFixtureNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasFormerFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasFormerFixture name
 
 private def aliasFormerPatternNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasFormerPattern name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasFormerPattern name
 
 private def aliasFormerRecursorFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasFormerRecursorFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasFormerRecursorFixture name
 
 private def aliasFormerAdmissionNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasFormerAdmission name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasFormerAdmission name
 
 private def aliasRecCertificateNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasRecCertificate name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasRecCertificate name
 
 private def aliasRecCertificateBreadthNative : Array Lean.Name := #[
   aliasRecCertificateNativeAxiom
-    `Ix.Tc.AliasRecCertificateFixture.breadthNative._native.native_decide.ax_1_1
+    `Ix.Kernel.AliasRecCertificateFixture.breadthNative._native.native_decide.ax_1_1
 ]
 
 private def aliasRecFixtureNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasRecFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasRecFixture name
 
 private def aliasRecRecursorFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasRecRecursorFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasRecRecursorFixture name
 
 private def aliasRecAdmissionNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.AliasRecAdmission name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.AliasRecAdmission name
 
 /- Exact executable footprint of the family-result-normalizing
 AliasFormer family/recursor transaction. -/
 private def aliasFormerAtomicClosureNative : Array Lean.Name :=
   inductiveNative ++ aliasFormerCertificateBreadthNative ++ #[
   aliasFormerAdmissionNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   aliasFormerAdmissionNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.entriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.entriesSizeNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.entriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.entriesUniqueNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.entryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.entryAtOneNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.entryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.entryAtZeroNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.entryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.entryIdsNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.familyEntryNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.familyShapeNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.memberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.memberKidsNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.mkEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.mkEntryNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.mkShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.mkShapeNative._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   aliasFormerFixtureNativeAxiom
-    `Ix.Tc.AliasFormerFixture.typeFamilyAliasIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerFixture.typeFamilyAliasIngressSucceededNative._native.native_decide.ax_1_1,
   aliasFormerPatternNativeAxiom
-    `Ix.Tc.AliasFormerPattern.generationCtorPairsNonempty._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerPattern.generationCtorPairsNonempty._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_2,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogMkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogMkNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogMkNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogMkNative._native.native_decide.ax_1_2,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogMkNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogMkNative._native.native_decide.ax_1_3,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_4,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.catalogTypeFamilyAliasNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.catalogTypeFamilyAliasNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkRuleBinderCoreNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkRuleFieldsNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkRuleRawNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkRuleScopedNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkRuleSizeBoundNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkSourceNameNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.mkTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.mkTypeRawNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.nameOfMkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.nameOfMkNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.nameOfTypeFamilyAliasNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.nameOfTypeFamilyAliasNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasFormerRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
   aliasFormerRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasFormerRecursorFixture.typeFamilyAliasTranslationsNative._native.native_decide.ax_1_1
+    `Ix.Kernel.AliasFormerRecursorFixture.typeFamilyAliasTranslationsNative._native.native_decide.ax_1_1
 ]
 
 /- Exact executable footprint of the recursive-field-normalizing `AliasRec`
@@ -631,113 +621,113 @@ family/recursor transaction. -/
 private def aliasRecAtomicClosureNative : Array Lean.Name :=
   inductiveNative ++ aliasRecCertificateBreadthNative ++ #[
   aliasRecAdmissionNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   aliasRecAdmissionNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.entriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.entriesSizeNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.entriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.entriesUniqueNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.entryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.entryAtOneNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.entryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.entryAtZeroNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.entryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.entryIdsNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.familyEntryNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.familyShapeNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.memberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.memberKidsNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.mkEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.mkEntryNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.mkShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.mkShapeNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.recAliasIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.recAliasIngressSucceededNative._native.native_decide.ax_1_1,
   aliasRecFixtureNativeAxiom
-    `Ix.Tc.AliasRecFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_2,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogMkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogMkNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogMkNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogMkNative._native.native_decide.ax_1_2,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogMkNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogMkNative._native.native_decide.ax_1_3,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogRecAliasNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogRecAliasNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.AliasRecRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_4,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkRuleBinderCoreNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkRuleFieldsNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkRuleRawNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkRuleScopedNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkRuleSizeBoundNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkSourceNameNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.mkTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.mkTypeRawNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.nameOfMkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.nameOfMkNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.nameOfRecAliasNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.nameOfRecAliasNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recAliasTranslationsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recAliasTranslationsNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AliasRecRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
   aliasRecRecursorFixtureNativeAxiom
-    `Ix.Tc.AliasRecRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1
+    `Ix.Kernel.AliasRecRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1
 ]
 
 /- Exact executable footprint of the annotation-normalizing family/recursor
@@ -746,113 +736,113 @@ family, constructor, and recursor entries. -/
 private def annotatedPiAtomicClosureNative : Array Lean.Name :=
   inductiveNative ++ annotatedPiCertificateBreadthNative ++ #[
   annotatedPiAdmissionNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   annotatedPiAdmissionNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.entriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.entriesSizeNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.entriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.entriesUniqueNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.entryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.entryAtOneNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.entryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.entryAtZeroNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.entryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.entryIdsNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.familyEntryNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.familyShapeNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.memberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.memberKidsNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.mkEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.mkEntryNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.mkShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.mkShapeNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.outParamIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.outParamIngressSucceededNative._native.native_decide.ax_1_1,
   annotatedPiFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_2,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogMkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogMkNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogMkNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogMkNative._native.native_decide.ax_1_2,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogMkNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogMkNative._native.native_decide.ax_1_3,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogOutParamNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogOutParamNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_4,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkRuleBinderCoreNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkRuleFieldsNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkRuleRawNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkRuleScopedNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkRuleSizeBoundNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkSourceNameNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.mkTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.mkTypeRawNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.nameOfMkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.nameOfMkNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.nameOfOutParamNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.nameOfOutParamNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.outParamTranslationsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.outParamTranslationsNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
   annotatedPiRecursorFixtureNativeAxiom
-    `Ix.Tc.AnnotatedPiRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1
+    `Ix.Kernel.AnnotatedPiRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1
 ]
 
 /- Exact executable footprint of the recursive-Pi family/recursor transaction.
@@ -861,291 +851,291 @@ the `Acc` closure cannot silently acquire unrelated native assumptions. -/
 private def recursivePiAtomicClosureNative : Array Lean.Name :=
   inductiveNative ++ #[
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.entriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.entriesSizeNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.entriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.entriesUniqueNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.entryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.entryAtOneNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.entryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.entryAtZeroNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.entryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.entryIdsNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.familyEntryNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.familyShapeNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.ingressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.ingressSucceededNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.introEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.introEntryNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.introShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.introShapeNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.memberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.memberKidsNative._native.native_decide.ax_1_1,
   recursivePiFixtureNativeAxiom
-    `Ix.Tc.RecursivePiFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.catalogIntroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.catalogIntroNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.catalogIntroNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.RecursivePiRecursorFixture.catalogIntroNative._native.native_decide.ax_1_2,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.RecursivePiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.RecursivePiRecursorFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.constructorCountNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.familyTypeRawNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.generationCtorPairZero._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introRuleBinderCoreNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introRuleFieldsNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introRuleRawNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introRuleScopedNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introRuleSizeBoundNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introSourceNameNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.introTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.introTypeRawNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.nameOfIntroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.nameOfIntroNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorEntryNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorEntrySizeNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorShapeNative._native.native_decide.ax_1_1,
   recursivePiRecursorFixtureNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
   recursivePiAdmissionNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.RecursivePiRecursorFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   recursivePiAdmissionNativeAxiom
-    `Ix.Tc.RecursivePiRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1
+    `Ix.Kernel.RecursivePiRecursorFixture.recursorOwnerNative._native.native_decide.ax_1_1
 ]
 
 private def enumerationFixtureNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.EnumerationFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.EnumerationFixture name
 
 private def enumerationAcceptanceNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.EnumerationAcceptance name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.EnumerationAcceptance name
 
 private def indexedRecursiveFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedRecursiveFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedRecursiveFixture name
 
 private def indexedRecursiveAcceptanceNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedRecursiveAcceptance name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedRecursiveAcceptance name
 
 private def eliminationBreadthNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.EliminationBreadthFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.EliminationBreadthFixture name
 
 private def smallEliminationAcceptanceNative : Array Lean.Name :=
   inductiveNative.push mutualInternDataValueNative ++ #[
-    `Lean4Lean.InductiveReplayFixtures.smallSourceAlignment06._native.native_decide.ax_1,
-    `Lean4Lean.InductiveReplayFixtures.smallSourceEliminationResult06_isOk._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_2,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_3,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_4,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_5,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_6,
-    `Ix.Tc.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_7,
-    `Ix.Tc.EliminationBreadthFixture.smallComputeKMatches_eq._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.smallPreparationMatches_eq._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.smallRecursorShape._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.smallTheoryRecUvars._native.native_decide.ax_1_1,
+    `Ix.Theory.Named.InductiveReplayFixtures.smallSourceAlignment06._native.native_decide.ax_1,
+    `Ix.Theory.Named.InductiveReplayFixtures.smallSourceEliminationResult06_isOk._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_2,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_3,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_4,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_5,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_6,
+    `Ix.Kernel.EliminationBreadthFixture.smallCompiledIdentity._native.native_decide.ax_1_7,
+    `Ix.Kernel.EliminationBreadthFixture.smallComputeKMatches_eq._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.smallPreparationMatches_eq._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.smallRecursorShape._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.smallTheoryRecUvars._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallCompilerSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.smallCompilerSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallExecutionKNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.smallExecutionKNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallExecutionModeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.smallExecutionModeNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallFamilyIngressSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.smallFamilyIngressSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallFamilyKernelSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.smallFamilyKernelSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallRecursorIngressSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.smallRecursorIngressSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.smallRecursorKernelSucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.EliminationBreadthFixture.smallRecursorKernelSucceededNative._native.native_decide.ax_1_1
   ]
 
 private def kTargetAcceptanceNative : Array Lean.Name :=
   inductiveNative.push mutualInternDataValueNative ++ #[
-    `Lean4Lean.InductiveReplayFixtures.eqAlignment06._native.native_decide.ax_1,
-    `Lean4Lean.InductiveReplayFixtures.eqEliminationResult06_isOk._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_2,
-    `Ix.Tc.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_3,
-    `Ix.Tc.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_4,
-    `Ix.Tc.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_5,
-    `Ix.Tc.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_6,
-    `Ix.Tc.EliminationBreadthFixture.eqComputeKMatches_eq._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.eqPreparationMatches_eq._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.eqRecursorShape._native.native_decide.ax_1_1,
-    `Ix.Tc.EliminationBreadthFixture.eqTheoryRecUvars._native.native_decide.ax_1_1,
+    `Ix.Theory.Named.InductiveReplayFixtures.eqAlignment06._native.native_decide.ax_1,
+    `Ix.Theory.Named.InductiveReplayFixtures.eqEliminationResult06_isOk._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_2,
+    `Ix.Kernel.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_3,
+    `Ix.Kernel.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_4,
+    `Ix.Kernel.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_5,
+    `Ix.Kernel.EliminationBreadthFixture.eqCompiledIdentity._native.native_decide.ax_1_6,
+    `Ix.Kernel.EliminationBreadthFixture.eqComputeKMatches_eq._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.eqPreparationMatches_eq._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.eqRecursorShape._native.native_decide.ax_1_1,
+    `Ix.Kernel.EliminationBreadthFixture.eqTheoryRecUvars._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqCompilerSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.eqCompilerSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqExecutionKNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.eqExecutionKNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqExecutionModeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.eqExecutionModeNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqFamilyIngressSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.eqFamilyIngressSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqFamilyKernelSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.eqFamilyKernelSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqRecursorIngressSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.EliminationBreadthFixture.eqRecursorIngressSucceededNative._native.native_decide.ax_1_1,
     eliminationBreadthNativeAxiom
-      `Ix.Tc.EliminationBreadthFixture.eqRecursorKernelSucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.EliminationBreadthFixture.eqRecursorKernelSucceededNative._native.native_decide.ax_1_1
   ]
 
 private def indexedRecursiveFixtureNativeNames : Array Lean.Name := #[
-  `Ix.Tc.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_2,
-  `Ix.Tc.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_3,
-  `Ix.Tc.IndexedRecursiveFixture.catalogFamilyNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_2,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_3,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_4,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_5,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_2,
-  `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_2,
-  `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_3,
-  `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_4,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_2,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_3,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_4,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_5,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_6,
-  `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_7,
-  `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_2,
-  `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_3,
-  `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_4,
-  `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_5,
-  `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_6,
-  `Ix.Tc.IndexedRecursiveFixture.consEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consSourceNameNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consRuleBinderCoreNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consRuleFieldsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consRuleRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consRuleScopedNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consRuleSizeBoundNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.consTypeRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.constructorCountNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyTypeRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.generationCtorPairOne._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.generationCtorPairZero._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfConsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfNatNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfNilNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfSuccNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nameOfZeroNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natConstructorCountNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntriesSizeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntriesUniqueNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntryAtOneNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntryAtTwoNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntryAtZeroNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntryIdsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natFamilyShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natIngressSucceededNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natMemberKidsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natSourceConstructorOne._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natSourceConstructorZero._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natTypeRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilSourceNameNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilRuleBinderCoreNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilRuleFieldsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilRuleRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilRuleScopedNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilRuleSizeBoundNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.nilTypeRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.sourceConstructorOne._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.sourceConstructorZero._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.succEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.succSourceNameNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.succShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.succTypeRawNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.zeroEntryNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.zeroSourceNameNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.zeroShapeNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.zeroTypeRawNative._native.native_decide.ax_1_1
+  `Ix.Kernel.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_2,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_3,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_2,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_3,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_4,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_5,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_2,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_2,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_3,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_4,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_5,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_6,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_7,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_2,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_3,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_4,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_5,
+  `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_6,
+  `Ix.Kernel.IndexedRecursiveFixture.consEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consSourceNameNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consRuleBinderCoreNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consRuleFieldsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consRuleRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consRuleScopedNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consRuleSizeBoundNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.consTypeRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.constructorCountNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyTypeRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.generationCtorPairOne._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfConsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfNatNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfNilNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfSuccNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nameOfZeroNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natConstructorCountNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntriesSizeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntriesUniqueNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntryAtOneNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntryAtTwoNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntryAtZeroNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntryIdsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natFamilyShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natIngressSucceededNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natMemberKidsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natSourceConstructorOne._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natSourceConstructorZero._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natTypeRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilSourceNameNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilRuleBinderCoreNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilRuleFieldsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilRuleRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilRuleScopedNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilRuleSizeBoundNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.nilTypeRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.sourceConstructorOne._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.succEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.succSourceNameNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.succShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.succTypeRawNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.zeroEntryNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.zeroSourceNameNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.zeroShapeNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.zeroTypeRawNative._native.native_decide.ax_1_1
 ]
 
 private def indexedRecursiveAcceptanceNativeNames : Array Lean.Name := #[
-  `Ix.Tc.IndexedRecursiveFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.malformedRecursorRejectedNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natKernelSucceededNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.natNotFamilyDirectOwnerNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
-  `Ix.Tc.IndexedRecursiveFixture.recursorOwnerNative._native.native_decide.ax_1_1
+  `Ix.Kernel.IndexedRecursiveFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.malformedRecursorRejectedNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natKernelSucceededNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.natNotFamilyDirectOwnerNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
+  `Ix.Kernel.IndexedRecursiveFixture.recursorOwnerNative._native.native_decide.ax_1_1
 ]
 
 private def indexedRecursiveNative : Array Lean.Name :=
@@ -1161,75 +1151,75 @@ this builder root. -/
 private def generatedRecursorTypeFixtureNative : Array Lean.Name :=
   inductiveNative ++ #[
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeSizeBoundNative._native.native_decide.ax_1_1,
-    nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorTypeFixture
-      `Ix.Tc.IndexedRecursiveFixture.familyBuildTypeResultNative._native.native_decide.ax_1_1,
-    nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorTypeFixture
-      `Ix.Tc.IndexedRecursiveFixture.familyBuildTypeSucceededNative._native.native_decide.ax_1_1,
-    nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorTypeFixture
-      `Ix.Tc.IndexedRecursiveFixture.familyPreparationSucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeSizeBoundNative._native.native_decide.ax_1_1,
+    nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeFixture
+      `Ix.Kernel.IndexedRecursiveFixture.familyBuildTypeResultNative._native.native_decide.ax_1_1,
+    nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeFixture
+      `Ix.Kernel.IndexedRecursiveFixture.familyBuildTypeSucceededNative._native.native_decide.ax_1_1,
+    nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeFixture
+      `Ix.Kernel.IndexedRecursiveFixture.familyPreparationSucceededNative._native.native_decide.ax_1_1
   ]
 
 private def generatedRecursorRuleFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorRuleFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorRuleFixture name
 
 /-- Exact native footprint of the complete IndexedVec peer-alignment and
 `buildRuleRhs` run. -/
 private def generatedRecursorRuleFixtureNative : Array Lean.Name :=
   inductiveNative ++ #[
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeSizeBoundNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeSizeBoundNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.generationCtorPairZero._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.generationCtorPairOne._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.generationCtorPairOne._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleFieldsNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleFieldsNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleSizeBoundNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleSizeBoundNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleFieldsNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleFieldsNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleSizeBoundNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleSizeBoundNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyBuiltRulesNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyBuiltRulesNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyCompletedRecursorTypeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyCompletedRecursorTypeNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyRulePopulationSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyRulePopulationSucceededNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.generationRuleCountNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.generationRuleCountNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorRulesLiteralNative._native.native_decide.ax_1_1
+      `Ix.Kernel.IndexedRecursiveFixture.recursorRulesLiteralNative._native.native_decide.ax_1_1
   ]
 
 /- Exact native footprint of the transactional rule commit.  This is kept
@@ -1239,63 +1229,63 @@ completed-type observation used by the builder fixture. -/
 private def generatedRecursorCommitFixtureNative : Array Lean.Name :=
   inductiveNative ++ #[
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorTypeSizeBoundNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.recursorTypeSizeBoundNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.generationCtorPairZero._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.generationCtorPairOne._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.generationCtorPairOne._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleFieldsNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleFieldsNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.nilRuleSizeBoundNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.nilRuleSizeBoundNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleBinderCoreNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleBinderCoreNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleFieldsNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleFieldsNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleRawNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleRawNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleScopedNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleScopedNative._native.native_decide.ax_1_1,
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.consRuleSizeBoundNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.consRuleSizeBoundNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyBuiltRulesNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyBuiltRulesNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyGeneratedSnapshotSizeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyGeneratedSnapshotSizeNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyGeneratedWithRulesSizeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyGeneratedWithRulesSizeNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.familyRulePopulationSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.familyRulePopulationSucceededNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.generationRuleCountNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.IndexedRecursiveFixture.generationRuleCountNative._native.native_decide.ax_1_1,
     generatedRecursorRuleFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorRulesLiteralNative._native.native_decide.ax_1_1,
-    nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorCommitFixture
-      `Ix.Tc.IndexedRecursiveFixture.familyRuleCommitSucceededNative._native.native_decide.ax_1_1,
-    nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorCommitFixture
-      `Ix.Tc.IndexedRecursiveFixture.familyGeneratedSnapshotTypeNative._native.native_decide.ax_1_1
+      `Ix.Kernel.IndexedRecursiveFixture.recursorRulesLiteralNative._native.native_decide.ax_1_1,
+    nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorCommitFixture
+      `Ix.Kernel.IndexedRecursiveFixture.familyRuleCommitSucceededNative._native.native_decide.ax_1_1,
+    nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorCommitFixture
+      `Ix.Kernel.IndexedRecursiveFixture.familyGeneratedSnapshotTypeNative._native.native_decide.ax_1_1
   ]
 
 private def generatedRecursorCheckerFixtureNative : Array Lean.Name :=
   generatedRecursorCommitFixtureNative ++ #[
     indexedRecursiveFixtureNativeAxiom
-      `Ix.Tc.IndexedRecursiveFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
-    nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorCheckerFixture
-      `Ix.Tc.IndexedRecursiveFixture.familyCacheCheckSucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.IndexedRecursiveFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorCheckerFixture
+      `Ix.Kernel.IndexedRecursiveFixture.familyCacheCheckSucceededNative._native.native_decide.ax_1_1
   ]
 
 /- The additional native facts used to construct the concrete IndexedVec
@@ -1303,161 +1293,161 @@ semantic world.  They are disjoint from the checker execution footprint
 above, so the concatenated canonical fixture manifest remains exact. -/
 private def generatedRecursorCanonicalWorldNative : Array Lean.Name := #[
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natNotFamilyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natNotFamilyDirectOwnerNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_2,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogConsNative._native.native_decide.ax_1_3,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_2,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_3,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_4,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_5,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNatNative._native.native_decide.ax_1_5,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogNilNative._native.native_decide.ax_1_2,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_2,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_3,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_4,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_5,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_5,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_6,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_6,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_7,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogSuccNative._native.native_decide.ax_1_7,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_2,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_3,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_4,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_5,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_5,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_6,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogZeroNative._native.native_decide.ax_1_6,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.consEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.consEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.consShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.consShapeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.consSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.consSourceNameNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.consTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.consTypeRawNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.constructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.constructorCountNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyShapeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyTypeRawNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfConsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfConsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfNatNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfNatNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfNilNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfNilNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfSuccNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfSuccNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfZeroNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natConstructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natConstructorCountNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntriesSizeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntriesUniqueNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntryAtOneNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntryAtTwoNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntryAtTwoNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntryAtZeroNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntryIdsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natFamilyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natFamilyShapeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natIngressSucceededNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natMemberKidsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natSourceConstructorOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natSourceConstructorOne._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natSourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natSourceConstructorZero._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.natTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.natTypeRawNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nilEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nilEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nilShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nilShapeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nilSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nilSourceNameNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nilTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nilTypeRawNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.sourceConstructorOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.sourceConstructorOne._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.succEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.succEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.succShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.succShapeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.succSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.succSourceNameNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.succTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.succTypeRawNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.zeroEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.zeroEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.zeroShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.zeroShapeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.zeroSourceNameNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.zeroSourceNameNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.zeroTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.zeroTypeRawNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorShapeNative._native.native_decide.ax_1_1
+    `Ix.Kernel.IndexedRecursiveFixture.recursorShapeNative._native.native_decide.ax_1_1
 ]
 
 private def generatedRecursorCanonicalFixtureNative : Array Lean.Name :=
@@ -1466,16 +1456,16 @@ private def generatedRecursorCanonicalFixtureNative : Array Lean.Name :=
 
 private def generatedRecursorCommitFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorCommitFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorCommitFixture name
 
 private def generatedRecursorMemberFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.GeneratedRecursorMemberFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.GeneratedRecursorMemberFixture name
 
 private def generatedRecursorInitialInvariantNativeAxiom
     (name : Lean.Name) : Lean.Name :=
   nativeAxiom
-    `Ix.Tc.Verify.Inductive.GeneratedRecursorInitialInvariant name
+    `Ix.Kernel.Verify.Inductive.GeneratedRecursorInitialInvariant name
 
 /- Exact executable footprint of the complete concrete recursor-member
 transaction.  The earlier commit and semantic-world manifests are reused
@@ -1486,221 +1476,221 @@ private def generatedRecursorAtomicClosureNative : Array Lean.Name :=
   generatedRecursorCommitFixtureNative ++
     generatedRecursorCanonicalWorldNative ++ #[
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorUniverseCountNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.IndexedRecursiveFixture.catalogRecursorNative._native.native_decide.ax_1_4,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorEntryNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   indexedRecursiveFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorOwnerNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.consConcreteHeaderNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyConcreteHeaderNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.recursorOwnerNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.consConcreteHeaderNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyConcreteHeaderNative._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledRecursorAtZeroMemberNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledRecursorAtZeroMemberNative._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledRecursorTypeEqNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledRecursorTypeEqNative._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledConsRuleInternSupported._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledConsRuleInternSupported._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledNilRuleInternSupported._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledNilRuleInternSupported._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledRecursorInductiveAddress._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledRecursorInductiveAddress._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledRecursorRules._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledRecursorRules._native.native_decide.ax_1_1,
   generatedRecursorCommitFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyInstalledRecursorTypeInternSupported._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyInstalledRecursorTypeInternSupported._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberArityBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberArityBoundNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSingletonSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSingletonSizeNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialPrimitivesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialPrimitivesNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyCharOfNatAbsent._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyCharOfNatAbsent._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberCheckSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberCheckSucceededNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberDirectMajorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberDirectMajorShapeNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialBlocksCoveredNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialBlocksCoveredNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialClosedFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialClosedFieldsNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialConstsCoveredNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialConstsCoveredNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialEquivEntriesEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialEquivEntriesEmpty._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialEquivLabelsEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialEquivLabelsEmpty._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialEquivParentEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialEquivParentEmpty._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialExprKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialExprKeysNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialRecursorLoaded._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialRecursorLoaded._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialReferencesCovered._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialReferencesCovered._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInitialUnivKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInitialUnivKeysNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberMajorSkipRunNeutral._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberMajorSkipRunNeutral._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberOwnerCacheMatchesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberOwnerCacheMatchesNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberPopulationReferencesCovered._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberPopulationReferencesCovered._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberPreparationMatchesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberPreparationMatchesNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRecursorConcreteHeader._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRecursorConcreteHeader._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberReferenceId_authorized._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberReferenceId_authorized._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberReferenceId_authorized._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberReferenceId_authorized._native.native_decide.ax_1_2,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberReferenceId_authorized._native.native_decide.ax_1_3,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberReferenceId_authorized._native.native_decide.ax_1_3,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberResolutionPrefixMatchesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberResolutionPrefixMatchesNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberResultLevelNonzero._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberResultLevelNonzero._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberResultSortShape._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberResultSortShape._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationCacheChecksNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationCacheChecksNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationExprKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationExprKeysNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationExtendsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationExtendsNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationMatchesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationMatchesNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationNoLazyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationNoLazyNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationSemanticChecksNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationSemanticChecksNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRulePopulationUnivKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRulePopulationUnivKeysNative._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSnapshotFamilyLoaded._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSnapshotFamilyLoaded._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSnapshotGeneratedCache._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSnapshotGeneratedCache._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyNatSuccLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyNatSuccLookup._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyNatZeroLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyNatZeroLookup._native.native_decide.ax_1_1,
   generatedRecursorMemberFixtureNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyNilConcreteHeader._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyNilConcreteHeader._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberBlockPeersClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberBlockPeersClassifiedNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberBlockResultKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberBlockResultKeysClassifiedNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberConsInfoLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberConsInfoLookup._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberConsInnerResultLevel_raw._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberConsInnerResultLevel_raw._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberConsResultLevel_raw._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberConsResultLevel_raw._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberConsTypeTranslation._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberConsTypeTranslation._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberDefEqCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberDefEqCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberDefEqCheapCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberDefEqCheapCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberDefEqFailureCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberDefEqFailureCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberFamilyInfoLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberFamilyInfoLookup._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberFamilyReferenceTranslation._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberFamilyReferenceTranslation._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberFamilyResultLevel_raw._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberFamilyResultLevel_raw._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberFamilyTypeTranslation._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberFamilyTypeTranslation._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInferCensusNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInferCensusNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberInferOnlyCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberInferOnlyCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberIsPropCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberIsPropCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberIsRecCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberIsRecCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatBlockAccepted._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatBlockAccepted._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatBlockAccepted._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatBlockAccepted._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatInfoLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatInfoLookup._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatReferenceTranslation._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatReferenceTranslation._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatReferenceWhnf._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatReferenceWhnf._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatSuccStuckCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatSuccStuckCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatTrusted._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatTrusted._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNatTypeTranslation._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNatTypeTranslation._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNilInfoLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNilInfoLookup._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberNilTypeTranslation._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberNilTypeTranslation._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRecMajorsClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRecMajorsClassifiedNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRecursorBlocksClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRecursorBlocksClassifiedNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRecursorOwnersClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRecursorOwnersClassifiedNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberRecursorPayloadsInternedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberRecursorPayloadsInternedNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSuccInfoLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSuccInfoLookup._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSuccReferenceTranslation._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSuccReferenceTranslation._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSuccTrusted._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSuccTrusted._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberSuccTypeTranslation._native.native_decide.ax_1_2,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberSuccTypeTranslation._native.native_decide.ax_1_2,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberTypedConstantSyntaxNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberTypedConstantSyntaxNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberUnfoldCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberUnfoldCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberWhnfCensusNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberWhnfCensusNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberWhnfCoreCensusNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberWhnfCoreCensusNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberWhnfCoreCheapCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberWhnfCoreCheapCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberWhnfNoDeltaCensusNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberWhnfNoDeltaCensusNative._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberWhnfNoDeltaCheapCacheEmpty._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberWhnfNoDeltaCheapCacheEmpty._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberZeroInfoLookup._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberZeroInfoLookup._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberZeroReferenceTranslation._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberZeroReferenceTranslation._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberZeroTrusted._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberZeroTrusted._native.native_decide.ax_1_1,
   generatedRecursorInitialInvariantNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberZeroTypeTranslation._native.native_decide.ax_1_2
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberZeroTypeTranslation._native.native_decide.ax_1_2
 ]
 
 /-- Exact executable delta between the existing semantic recursor closure
@@ -1709,236 +1699,232 @@ equation.  The latter adds only the two outer production block checks. -/
 private def indexedProducerClosureNative : Array Lean.Name :=
   generatedRecursorAtomicClosureNative ++ #[
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.IndexedRecursiveFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
   indexedRecursiveAcceptanceNativeAxiom
-    `Ix.Tc.IndexedRecursiveFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1
+    `Ix.Kernel.IndexedRecursiveFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1
 ]
 
 /-- Exact executable footprint of the production-linked IndexedVec
 constructor-validation replay.  Keep this separate from the broader
 end-to-end acceptance fixture so a new observation changes this root's audit. -/
 private def indexedConstructorValidationNative : Array Lean.Name := #[
-  nativeAxiom `Blake3
-    `Blake3.HasherOps.hash._native.native_decide.ax_1,
   nativeAxiom `Ix.Environment
     `Ix.Name.mkStr._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Expr
-    `Ix.Tc.KExpr.mkVar._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Inductive
-    `Ix.Tc.RecM.canonicalAuxOrder._native.native_decide.ax_9,
-  nativeAxiom `Ix.Tc.Level
-    `Ix.Tc.KUniv.mkSucc._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Monad
-    `Ix.Tc.TcM.ctxAddrForLbrUncached._native.native_decide.ax_3,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.consConcreteHeaderNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyAritySucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyClassificationMatchesNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyConcreteHeaderNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyDiscoveryMatchesNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyMemberLoadedNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyNilAfterConsLoadedNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyNilValidationSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyPeerAgreementSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedBlockValidation
-    `Ix.Tc.IndexedRecursiveFixture.familyResultLevelSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-    `Ix.Tc.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_2,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-    `Ix.Tc.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_3,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-    `Ix.Tc.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_4,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-    `Ix.Tc.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_5,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-    `Ix.Tc.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_6,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-    `Ix.Tc.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_7,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorAfterParamShapeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorAlphaEnsureTypeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorConsumeAlphaNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorConsumeNatNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorConsumeTailNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorGetTypeAlphaNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorInstantiateHeadNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorInstantiateNNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorInstantiateTailNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorNatEnsureTypeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorNatUniverse._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorParamIsDefEqNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorParamUniverse._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorResultIsValidNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorTailEnsureTypeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedConstructorValidation
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecConstructorTypeShapeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.familyConsHeadDomainCandidateCheckNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.familyConsNatDomainCandidateCheckNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailDomainCandidateCheckNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailWhnfCandidateCheckNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecAlphaCandidateWhnfNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecAlphaHasNoIndOccTrusted._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecNatCandidateWhnfNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecNatHasNoIndOccTrusted._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecTailAppIsValidTrusted._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecTailCandidateWhnfNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedPositivityTransport
-    `Ix.Tc.IndexedRecursiveFixture.indexedVecTailHasIndOccTrusted._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsHeadDomainRootFreeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsHeadOpenSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsHeadTelescopeWhnfIsForallNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsNatDomainRootFreeNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsNatOpenSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsNatTelescopeWhnfIsForallNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsPositivityParametersSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsResultWhnfSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsResultWhnfTerminalNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailDomainMentionsRootNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailDomainSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailDomainWhnfNotForallNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailDomainWhnfSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailOpenSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailTelescopeWhnfIsForallNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailWhnfSpineActiveNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-    `Ix.Tc.IndexedRecursiveFixture.familyConsTailWhnfSpineIsConstNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedRecursiveAcceptance
-    `Ix.Tc.IndexedRecursiveFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
-  nativeAxiom `Ix.Tc.Verify.Inductive.IndexedRecursiveFixture
-    `Ix.Tc.IndexedRecursiveFixture.familyEntriesSizeNative._native.native_decide.ax_1_1
+  nativeAxiom `Ix.Kernel.Expr
+    `Ix.Kernel.KExpr.mkVar._native.native_decide.ax_1,
+  nativeAxiom `Ix.Kernel.Inductive
+    `Ix.Kernel.RecM.canonicalAuxOrder._native.native_decide.ax_9,
+  nativeAxiom `Ix.Kernel.Level
+    `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.consConcreteHeaderNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyAritySucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyClassificationMatchesNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyConcreteHeaderNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyDiscoveryMatchesNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyMemberLoadedNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyNilAfterConsLoadedNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyNilValidationSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyPeerAgreementSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+    `Ix.Kernel.IndexedRecursiveFixture.familyResultLevelSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+    `Ix.Kernel.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_2,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+    `Ix.Kernel.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_3,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+    `Ix.Kernel.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_4,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+    `Ix.Kernel.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_5,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+    `Ix.Kernel.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_6,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+    `Ix.Kernel.IndexedRecursiveFixture.candidateBlockSyntaxNative._native.native_decide.ax_1_7,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorAfterParamShapeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorAlphaEnsureTypeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorConsumeAlphaNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorConsumeNatNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorConsumeTailNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorGetTypeAlphaNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorInstantiateHeadNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorInstantiateNNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorInstantiateTailNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorNatEnsureTypeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorNatUniverse._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorParamIsDefEqNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorParamUniverse._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorResultIsValidNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorTailEnsureTypeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedConstructorValidation
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecConstructorTypeShapeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsHeadDomainCandidateCheckNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsNatDomainCandidateCheckNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailDomainCandidateCheckNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailWhnfCandidateCheckNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecAlphaCandidateWhnfNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecAlphaHasNoIndOccTrusted._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecNatCandidateWhnfNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecNatHasNoIndOccTrusted._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecTailAppIsValidTrusted._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecTailCandidateWhnfNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
+    `Ix.Kernel.IndexedRecursiveFixture.indexedVecTailHasIndOccTrusted._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsHeadDomainRootFreeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsHeadOpenSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsHeadTelescopeWhnfIsForallNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsNatDomainRootFreeNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsNatOpenSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsNatTelescopeWhnfIsForallNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsPositivityParametersSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsResultWhnfSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsResultWhnfTerminalNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailDomainMentionsRootNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailDomainSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailDomainWhnfNotForallNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailDomainWhnfSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailOpenSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailTelescopeWhnfIsForallNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailWhnfSpineActiveNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+    `Ix.Kernel.IndexedRecursiveFixture.familyConsTailWhnfSpineIsConstNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedRecursiveAcceptance
+    `Ix.Kernel.IndexedRecursiveFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+  nativeAxiom `Ix.Kernel.Verify.Inductive.IndexedRecursiveFixture
+    `Ix.Kernel.IndexedRecursiveFixture.familyEntriesSizeNative._native.native_decide.ax_1_1
 ]
 
 private def nestedRecursiveFixtureNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.NestedRecursiveFixture name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.NestedRecursiveFixture name
 
 private def nestedRecursiveActionNative : Array Lean.Name :=
   nameContextNative ++ #[
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.boxInactiveNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.boxInactiveNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedMentionsRootNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.nestedMentionsRootNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedSpineNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.nestedSpineNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedWhnfSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.nestedWhnfSucceededNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.positivitySucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.positivitySucceededNative._native.native_decide.ax_1_1
   ]
 
 private def nestedRecursiveProducedNative : Array Lean.Name :=
   nestedRecursiveActionNative ++ #[
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.boxConcreteHeaderMatchesNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.boxConcreteHeaderMatchesNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.boxLookupConcreteNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.boxLookupConcreteNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.boxLookupSucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.boxLookupSucceededNative._native.native_decide.ax_1_1
   ]
 
 private def nestedRecursiveFreshNative : Array Lean.Name :=
   nestedRecursiveProducedNative.push
     (nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.positivityRequestAbsentNative._native.native_decide.ax_1_1)
+      `Ix.Kernel.NestedRecursiveFixture.positivityRequestAbsentNative._native.native_decide.ax_1_1)
 
 private def nestedRecursiveReachabilityNative : Array Lean.Name :=
   nestedRecursiveFreshNative ++ #[
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.builtFlatShapeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.builtFlatShapeNative._native.native_decide.ax_1_1,
     nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.flatBuildSucceededNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.flatBuildSucceededNative._native.native_decide.ax_1_1
   ]
 
 private def nestedCandidateSyntaxNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.NestedCandidateSyntax name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.NestedCandidateSyntax name
 
 private def nestedPositivityTransportNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.NestedPositivityTransport name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.NestedPositivityTransport name
 
 private def nestedAuxiliaryPositivityNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.NestedAuxiliaryPositivity name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.NestedAuxiliaryPositivity name
 
 private def nestedConstructorValidationNativeAxiom
     (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.NestedConstructorValidation name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.NestedConstructorValidation name
 
 private def nestedCandidateRelationNative : Array Lean.Name := #[
   nestedCandidateSyntaxNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.leanAuxiliaryOccursNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.leanAuxiliaryOccursNative._native.native_decide.ax_1_1,
   nestedCandidateSyntaxNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.leanAuxiliarySourceNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.leanAuxiliarySourceNative._native.native_decide.ax_1_1,
   nestedCandidateSyntaxNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.leanAuxiliaryTargetNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.leanAuxiliaryTargetNative._native.native_decide.ax_1_1,
   nestedCandidateSyntaxNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.leanFlatNodeTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.leanFlatNodeTypeNative._native.native_decide.ax_1_1,
   nestedCandidateSyntaxNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedDomainCandidateCheckNative._native.native_decide.ax_1_1
+    `Ix.Kernel.NestedRecursiveFixture.nestedDomainCandidateCheckNative._native.native_decide.ax_1_1
 ]
 
 private def nestedRecursiveReachabilityWithResultNative : Array Lean.Name :=
   nestedRecursiveReachabilityNative.push
     (nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedWhnfResultNative._native.native_decide.ax_1_1)
+      `Ix.Kernel.NestedRecursiveFixture.nestedWhnfResultNative._native.native_decide.ax_1_1)
 
 private def nestedOuterTransportNative : Array Lean.Name :=
   nestedRecursiveReachabilityWithResultNative ++ nestedCandidateRelationNative ++ #[
     nestedPositivityTransportNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanAuxiliaryCandidateWhnfNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanAuxiliaryCandidateWhnfNative._native.native_decide.ax_1_1,
     nestedPositivityTransportNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedDomainMentionsRootNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.nestedDomainMentionsRootNative._native.native_decide.ax_1_1,
     nestedPositivityTransportNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedExternalInactiveNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.nestedExternalInactiveNative._native.native_decide.ax_1_1
   ]
 
 private def nestedAuxiliaryCandidateTargetNative : Array Lean.Name :=
@@ -1946,29 +1932,29 @@ private def nestedAuxiliaryCandidateTargetNative : Array Lean.Name :=
 
 private def nestedAuxiliaryExecutionNative : Array Lean.Name := #[
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryDiscoverySucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryDiscoverySucceededNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryDomainWhnfNotForallNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryDomainWhnfNotForallNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryDomainWhnfResultNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryDomainWhnfResultNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryDomainWhnfSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryDomainWhnfSucceededNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryFieldWhnfShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryFieldWhnfShapeNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryFieldWhnfSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryFieldWhnfSucceededNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryInstantiationSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryInstantiationSucceededNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryParameterArgsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryParameterArgsNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryStrippingSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryStrippingSucceededNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliarySubstitutionSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliarySubstitutionSucceededNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryTreeMentionsRootNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryTreeMentionsRootNative._native.native_decide.ax_1_1,
   nestedAuxiliaryPositivityNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.auxiliaryWrapLookupSucceededNative._native.native_decide.ax_1_1
+    `Ix.Kernel.NestedRecursiveFixture.auxiliaryWrapLookupSucceededNative._native.native_decide.ax_1_1
 ]
 
 private def nestedAuxiliaryProductionNative : Array Lean.Name :=
@@ -1977,70 +1963,70 @@ private def nestedAuxiliaryProductionNative : Array Lean.Name :=
 private def nestedAuxiliaryTransportNative : Array Lean.Name :=
   nameContextNative ++ #[
     nestedAuxiliaryPositivityNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.auxiliaryDomainWhnfResultNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.auxiliaryDomainWhnfResultNative._native.native_decide.ax_1_1,
     nestedAuxiliaryPositivityNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.auxiliaryDomainWhnfSucceededNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.auxiliaryDomainWhnfSucceededNative._native.native_decide.ax_1_1,
     nestedAuxiliaryPositivityNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.auxiliaryTreeMentionsRootNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.auxiliaryTreeMentionsRootNative._native.native_decide.ax_1_1,
     nestedAuxiliaryPositivityNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeCandidateWhnfNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeCandidateWhnfNative._native.native_decide.ax_1_1,
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeOccursNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeOccursNative._native.native_decide.ax_1_1,
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeTargetNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeTargetNative._native.native_decide.ax_1_1,
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.treeCandidateCheckNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.treeCandidateCheckNative._native.native_decide.ax_1_1
   ]
 
 private def nestedAuxiliaryConstructorNative : Array Lean.Name :=
   nestedAuxiliaryProductionNative ++ #[
     nestedAuxiliaryPositivityNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeCandidateWhnfNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeCandidateWhnfNative._native.native_decide.ax_1_1,
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeOccursNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeOccursNative._native.native_decide.ax_1_1,
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeTargetNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeTargetNative._native.native_decide.ax_1_1,
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.treeCandidateCheckNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.treeCandidateCheckNative._native.native_decide.ax_1_1
   ]
 
 private def nestedNodeConstructorValidationNative : Array Lean.Name :=
   nestedOuterTransportNative ++ #[
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.consumeLeanAuxiliaryNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.consumeLeanAuxiliaryNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.instantiateLeanTreeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.instantiateLeanTreeNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanAuxiliaryEnsureTypeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanAuxiliaryEnsureTypeNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanFlatFieldUniverse._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanFlatFieldUniverse._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeTerminalNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeTerminalNative._native.native_decide.ax_1_1
   ]
 
 private def nestedWrapConstructorValidationNative : Array Lean.Name :=
   nestedAuxiliaryConstructorNative ++ #[
     nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanFlatWrapTypeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanFlatWrapTypeNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.consumeLeanTreeNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.consumeLeanTreeNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.instantiateLeanAuxiliaryNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.instantiateLeanAuxiliaryNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanAuxiliaryTerminalNative._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanAuxiliaryTerminalNative._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanFlatFieldUniverse._native.native_decide.ax_1_1,
+      `Ix.Kernel.NestedRecursiveFixture.leanFlatFieldUniverse._native.native_decide.ax_1_1,
     nestedConstructorValidationNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.leanTreeEnsureTypeNative._native.native_decide.ax_1_1
+      `Ix.Kernel.NestedRecursiveFixture.leanTreeEnsureTypeNative._native.native_decide.ax_1_1
   ]
 
 private def nestedTreeCandidateSyntaxNative : Array Lean.Name :=
   expressionNative.push
     (nestedCandidateSyntaxNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.treeCandidateCheckNative._native.native_decide.ax_1_1)
+      `Ix.Kernel.NestedRecursiveFixture.treeCandidateCheckNative._native.native_decide.ax_1_1)
 
 /- The nested semantic transaction has two independently executable halves:
-the Lean4Lean source/restoration proof and Ix's physical catalog/checker
+the Ix.Theory.Named source/restoration proof and Ix's physical catalog/checker
 join.  Keep their native footprints explicit so the headline audit cannot
 silently acquire oracle materialization or pending assumptions. -/
 private def nativeUnion (left right : Array Lean.Name) : Array Lean.Name :=
@@ -2048,75 +2034,75 @@ private def nativeUnion (left right : Array Lean.Name) : Array Lean.Name :=
     if names.contains name then names else names.push name) left
 
 private def nestedSemanticBoxNative : Array Lean.Name := #[
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxAfter_isSome._native.native_decide.ax_1_1,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxChecked._native.native_decide.ax_1,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxGeneration._native.native_decide.ax_1,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_1,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_2,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_3,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_4,
-  `Ix.Tc.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_5
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxAfter_isSome._native.native_decide.ax_1_1,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxChecked._native.native_decide.ax_1,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxGeneration._native.native_decide.ax_1,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_1,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_2,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_3,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_4,
+  `Ix.Kernel.NestedRecursiveFixture.semanticBoxShape._native.native_decide.ax_1_5
 ]
 
 private def nestedSemanticWFNative : Array Lean.Name :=
   nestedSemanticBoxNative ++ #[
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeNested_isSome._native.native_decide.ax_1_1,
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeRecursors_eq._native.native_decide.ax_1_1,
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeRules_eq._native.native_decide.ax_1_1
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeNested_isSome._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeRecursors_eq._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeRules_eq._native.native_decide.ax_1_1
   ]
 
 private def nestedSemanticCertificateNative : Array Lean.Name :=
   nestedSemanticWFNative.push
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeAfter_isSome._native.native_decide.ax_1_1
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeAfter_isSome._native.native_decide.ax_1_1
 
 private def nestedSemanticFactsNative : Array Lean.Name :=
   nestedSemanticCertificateNative ++ #[
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeNodeName._native.native_decide.ax_1_1,
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeRestoredClean._native.native_decide.ax_1_1
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeNodeName._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeRestoredClean._native.native_decide.ax_1_1
   ]
 
 private def nestedSemanticAdmissionNative : Array Lean.Name :=
   nestedSemanticCertificateNative ++ #[
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeNodeName._native.native_decide.ax_1_1,
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeSourceInventory._native.native_decide.ax_1_1,
-    `Ix.Tc.NestedRecursiveFixture.semanticTreeSourceInventory._native.native_decide.ax_1_2
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeNodeName._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeSourceInventory._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.semanticTreeSourceInventory._native.native_decide.ax_1_2
   ]
 
 private def nestedAdmissionNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Inductive.NestedAdmission name
+  nativeAxiom `Ix.Kernel.Verify.Inductive.NestedAdmission name
 
 private def nestedAdmissionPublicNative : Array Lean.Name := #[
-  `Ix.Tc.NestedRecursiveFixture.nestedCatalog_node._native.native_decide.ax_1_1,
-  `Ix.Tc.NestedRecursiveFixture.nestedCatalog_node._native.native_decide.ax_1_2,
-  `Ix.Tc.NestedRecursiveFixture.nestedCatalog_tree._native.native_decide.ax_1_1,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_1,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_2,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_3,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_4,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_tree._native.native_decide.ax_1_1,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_tree._native.native_decide.ax_1_2,
-  `Ix.Tc.NestedRecursiveFixture.nestedNameOf_tree._native.native_decide.ax_1_3
+  `Ix.Kernel.NestedRecursiveFixture.nestedCatalog_node._native.native_decide.ax_1_1,
+  `Ix.Kernel.NestedRecursiveFixture.nestedCatalog_node._native.native_decide.ax_1_2,
+  `Ix.Kernel.NestedRecursiveFixture.nestedCatalog_tree._native.native_decide.ax_1_1,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_1,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_2,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_3,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_node._native.native_decide.ax_1_4,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_tree._native.native_decide.ax_1_1,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_tree._native.native_decide.ax_1_2,
+  `Ix.Kernel.NestedRecursiveFixture.nestedNameOf_tree._native.native_decide.ax_1_3
 ]
 
 private def nestedAdmissionPrivateNative : Array Lean.Name := #[
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedFamilyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.nestedFamilyBlockLoadedNative._native.native_decide.ax_1_1,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_1,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_2,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_3,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.NestedRecursiveFixture.nestedMemberShapeFactsNative._native.native_decide.ax_1_4,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedNodeDirectConstructor._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.nestedNodeDirectConstructor._native.native_decide.ax_1_1,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedNodeTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.nestedNodeTypeRawNative._native.native_decide.ax_1_1,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedTreeDirectOwner._native.native_decide.ax_1_1,
+    `Ix.Kernel.NestedRecursiveFixture.nestedTreeDirectOwner._native.native_decide.ax_1_1,
   nestedAdmissionNativeAxiom
-    `Ix.Tc.NestedRecursiveFixture.nestedTreeTypeRawNative._native.native_decide.ax_1_1
+    `Ix.Kernel.NestedRecursiveFixture.nestedTreeTypeRawNative._native.native_decide.ax_1_1
 ]
 
 private def nestedFamilyCertificateNative : Array Lean.Name :=
@@ -2127,7 +2113,7 @@ private def nestedFamilyCertificateNative : Array Lean.Name :=
 private def nestedFamilyKernelNative : Array Lean.Name :=
   inductiveNative.push
     (nestedAdmissionNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.nestedFamilyKernelSucceededNative._native.native_decide.ax_1_1)
+      `Ix.Kernel.NestedRecursiveFixture.nestedFamilyKernelSucceededNative._native.native_decide.ax_1_1)
 
 private def nestedSemanticTransactionClosureNative : Array Lean.Name :=
   let withSemantics := nativeUnion nestedFamilyCertificateNative
@@ -2137,10 +2123,10 @@ private def nestedSemanticTransactionClosureNative : Array Lean.Name :=
   let withWrap := nativeUnion withNode nestedWrapConstructorValidationNative
   let withBoxIngress := withWrap.push
     (nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.boxIngressSucceededNative._native.native_decide.ax_1_1)
+      `Ix.Kernel.NestedRecursiveFixture.boxIngressSucceededNative._native.native_decide.ax_1_1)
   withBoxIngress.push
     (nestedRecursiveFixtureNativeAxiom
-      `Ix.Tc.NestedRecursiveFixture.treeIngressSucceededNative._native.native_decide.ax_1_1)
+      `Ix.Kernel.NestedRecursiveFixture.treeIngressSucceededNative._native.native_decide.ax_1_1)
 
 /- The physical nested-recursor slice is deliberately separate from the
 source transaction above.  It compiles the retained kernel declarations,
@@ -2153,7 +2139,7 @@ private def nestedRecursorNativeUserName (decl : String)
   Lean.Name.str
     (Lean.Name.str
       (Lean.Name.str
-        (Lean.Name.str `Ix.Tc.NestedRecursiveFixture decl)
+        (Lean.Name.str `Ix.Kernel.NestedRecursiveFixture decl)
         "_native")
       "native_decide")
     s!"ax_1_{index + 1}"
@@ -2171,22 +2157,22 @@ private def nestedRecursorPublicNativeSeries (decl : String)
 private def nestedRecursorFixtureNativeSeries (decl : String)
     (count : Nat := 1) : Array Lean.Name :=
   nestedRecursorNativeSeries
-    `Ix.Tc.Verify.Inductive.NestedRecursorFixture decl count
+    `Ix.Kernel.Verify.Inductive.NestedRecursorFixture decl count
 
 private def nestedRecursorPatternNativeSeries (decl : String)
     (count : Nat := 1) : Array Lean.Name :=
   nestedRecursorNativeSeries
-    `Ix.Tc.Verify.Inductive.NestedRecursorPattern decl count
+    `Ix.Kernel.Verify.Inductive.NestedRecursorPattern decl count
 
 private def nestedRecursorSoundnessNativeSeries (decl : String)
     (count : Nat := 1) : Array Lean.Name :=
   nestedRecursorNativeSeries
-    `Ix.Tc.Verify.Inductive.NestedRecursorSoundness decl count
+    `Ix.Kernel.Verify.Inductive.NestedRecursorSoundness decl count
 
 private def nestedRecursorAdmissionNativeSeries (decl : String)
     (count : Nat := 1) : Array Lean.Name :=
   nestedRecursorNativeSeries
-    `Ix.Tc.Verify.Inductive.NestedRecursorAdmission decl count
+    `Ix.Kernel.Verify.Inductive.NestedRecursorAdmission decl count
 
 private def nestedRecursorCompilerBaseNative : Array Lean.Name :=
   nameContextNative.push mutualInternDataValueNative
@@ -2267,7 +2253,7 @@ private def nestedRecursorPublicNative : Array Lean.Name :=
     nestedRecursorPublicNativeSeries "nestedRecursorNameOf_wrap" 2
 
 private def nestedRecursorMemberShapeNative : Array Lean.Name :=
-  nestedRecursorNativeSeries `Ix.Tc.Verify.Inductive.NestedAdmission
+  nestedRecursorNativeSeries `Ix.Kernel.Verify.Inductive.NestedAdmission
     "nestedMemberShapeFactsNative" 4
 
 private def nestedRecursorAdmissionFactsNative : Array Lean.Name :=
@@ -2317,26 +2303,26 @@ private def nestedRecursorOperationalNative : Array Lean.Name :=
     nestedRecursorFixtureNativeSeries "recursorEntriesUniqueNative" ++
     nestedRecursorFixtureNativeSeries "recursorEntryIdsNative" ++
     nestedRecursorFixtureNativeSeries "recursorIngressSucceededNative" ++
-    #[nativeAxiom `Ix.Tc.Inductive
-      `Ix.Tc.RecM.canonicalAuxOrder._native.native_decide.ax_9]
+    #[nativeAxiom `Ix.Kernel.Inductive
+      `Ix.Kernel.RecM.canonicalAuxOrder._native.native_decide.ax_9]
 
 private def nestedRecursorAtomicClosureNative : Array Lean.Name :=
   nativeUnion nestedRecursorAtomicAdmissionNative
     nestedRecursorOperationalNative
 
 private def nestedRestoredPatternUpstreamDebt : Array Lean.Name := #[
-  ``Lean4Lean.VEnv.IsDefEqU.forallE_inv_stratified,
-  ``Lean4Lean.VEnv.IsDefEqU.sort_inv
+  ``Ix.Theory.Named.VEnv.IsDefEqU.forallE_inv_stratified,
+  ``Ix.Theory.Named.VEnv.IsDefEqU.sort_inv
 ]
 
 private def booleanAcceptanceNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Driver.BooleanAcceptance name
+  nativeAxiom `Ix.Kernel.Verify.Driver.BooleanAcceptance name
 
 private def serializedBooleanNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Ingress.SerializedBoolean name
+  nativeAxiom `Ix.Kernel.Verify.Ingress.SerializedBoolean name
 
 private def literalBlobsNativeAxiom (name : Lean.Name) : Lean.Name :=
-  nativeAxiom `Ix.Tc.Verify.Ingress.LiteralBlobs name
+  nativeAxiom `Ix.Kernel.Verify.Ingress.LiteralBlobs name
 
 /- The explicit Boolean one-family admission consumes the finite catalog,
 ingress, generation, rule, and pattern facts below.  Checker executions are
@@ -2344,139 +2330,139 @@ kept out of this shared semantic slice so the one-family root cannot inherit
 them merely because the larger end-to-end witness also records those runs. -/
 private def booleanSemanticFixtureNative : Array Lean.Name := #[
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_4,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_3,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_6,
+    `Ix.Kernel.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_6,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_7,
+    `Ix.Kernel.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_7,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleBinderCoreNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleFieldsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleRawNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleScopedNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleSizeBoundNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseSourceTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseSourceTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyConstructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyConstructorCountNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.generationCtorPairOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.generationCtorPairOne._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.generationCtorPairZero._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfFalseNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfTrueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceConstructorOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceConstructorOne._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleBinderCoreNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleFieldsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleRawNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleScopedNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleSizeBoundNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueSourceTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueSourceTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_2
+    `Ix.Kernel.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_2
 ]
 
 private def booleanSemanticAdmissionNative : Array Lean.Name :=
     nameNative ++ #[
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorOwnerNative._native.native_decide.ax_1_1
+    `Ix.Kernel.BooleanEnumerationFixture.recursorOwnerNative._native.native_decide.ax_1_1
 ] ++ booleanSemanticFixtureNative
 
 /- The concrete Boolean end-to-end witness additionally evaluates the real
@@ -2486,27 +2472,27 @@ than treating the witness as one opaque executable assumption. -/
 private def booleanEnumerationNative : Array Lean.Name :=
     inductiveNative ++ #[
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBodySucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBodySucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyClassificationSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyClassificationSucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyKernelSucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockLoadedAfterFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockLoadedAfterFamilyNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBodySucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBodySucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorClassificationSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorClassificationSucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorKernelSucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorOwnerNative._native.native_decide.ax_1_1
+    `Ix.Kernel.BooleanEnumerationFixture.recursorOwnerNative._native.native_decide.ax_1_1
 ] ++ booleanSemanticFixtureNative
 
 /- The E3-S family-body bridge consumes only the family-side slice of the
@@ -2516,83 +2502,83 @@ recursor run, kernel-run, generated-rule, or recursor-ingress facts merely
 because the larger E2b witness uses them. -/
 private def booleanFamilyBodyNative : Array Lean.Name := inductiveNative ++ #[
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBodySucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBodySucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyClassificationSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyClassificationSucceededNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_3,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseSourceTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseSourceTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyConstructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyConstructorCountNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfFalseNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfTrueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceConstructorOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceConstructorOne._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueSourceTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueSourceTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_2
+    `Ix.Kernel.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_2
 ]
 
 /-- Exact evaluator boundary of the final E3-S Boolean whole-driver witness.
@@ -2602,185 +2588,185 @@ does not inherit the earlier standalone body/kernel executions as semantic
 authority for the serial run. -/
 def booleanDriverNative : Array Lean.Name := inductiveNative ++ #[
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.buildAnonWorkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.buildAnonWorkNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.checkEnvAnonNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.checkEnvAnonNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseProjectionEntry._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.falseProjectionEntry._native.native_decide.ax_1_2,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseProjectionEntry._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.falseProjectionEntry._native.native_decide.ax_1_3,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockEntry._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockEntry._native.native_decide.ax_1_2,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockEntry._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockEntry._native.native_decide.ax_1_3,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyProjectionEntry._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.familyProjectionEntry._native.native_decide.ax_1_2,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyProjectionEntry._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.familyProjectionEntry._native.native_decide.ax_1_3,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyTargetsNonemptyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyTargetsNonemptyNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockEntry._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockEntry._native.native_decide.ax_1_2,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockEntry._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockEntry._native.native_decide.ax_1_3,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorProjectionEntry._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorProjectionEntry._native.native_decide.ax_1_2,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorProjectionEntry._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorProjectionEntry._native.native_decide.ax_1_3,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorTargetsNonemptyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorTargetsNonemptyNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceAddressesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceAddressesNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceAddressesNodupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceAddressesNodupNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceKeysNative._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueProjectionEntry._native.native_decide.ax_1_1,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.trueProjectionEntry._native.native_decide.ax_1_2,
   booleanAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueProjectionEntry._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.trueProjectionEntry._native.native_decide.ax_1_3,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyDirectOwnerNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorBlockLoadedNative._native.native_decide.ax_1_1,
   enumerationAcceptanceNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorOwnerNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorOwnerNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFalseNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogFamilyNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_3,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_4,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogRecursorNative._native.native_decide.ax_1_4,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_3,
+    `Ix.Kernel.BooleanEnumerationFixture.catalogTrueNative._native.native_decide.ax_1_3,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_6,
+    `Ix.Kernel.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_6,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_7,
+    `Ix.Kernel.BooleanEnumerationFixture.enumerationShapeNative._native.native_decide.ax_1_7,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleBinderCoreNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleFieldsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleRawNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleScopedNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseRuleSizeBoundNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseSourceTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseSourceTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanEnumerationFixture.falseTypeNative._native.native_decide.ax_1_2,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyConstructorCountNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyConstructorCountNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntriesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntriesUniqueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtOneNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtTwoNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryAtZeroNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryIdsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyIngressSucceededNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyMemberKidsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.familyTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.familyTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.generationCtorPairOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.generationCtorPairOne._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.generationCtorPairZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.generationCtorPairZero._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfFalseNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfFamilyNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfRecursorNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.nameOfTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.nameOfTrueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntriesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntriesUniqueNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntryIdsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorIngressSucceededNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorMemberKidsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorRulesSizeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.recursorTypeRawNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceConstructorOne._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceConstructorOne._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.sourceConstructorZero._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.sourceConstructorZero._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueEntryNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueEntryNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleBinderCoreNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleBinderCoreNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleFieldsNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleFieldsNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleRawNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleRawNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleScopedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleScopedNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueRuleSizeBoundNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueRuleSizeBoundNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueShapeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueShapeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueSourceTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueSourceTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_1,
   enumerationFixtureNativeAxiom
-    `Ix.Tc.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_2
+    `Ix.Kernel.BooleanEnumerationFixture.trueTypeNative._native.native_decide.ax_1_2
 ]
 
 /-- Exact evaluator boundary of the serialized T0 Boolean certificate.  Each
@@ -2788,255 +2774,255 @@ closed computation is named so changes in the byte, eager, lazy, dependency,
 or driver slices are visible independently in the trust manifest. -/
 def serializedBooleanNative : Array Lean.Name := booleanDriverNative ++ #[
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.blobKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.blobKeysNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.buildAnonWorkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.buildAnonWorkNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.checkEnvAnonNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.checkEnvAnonNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.decodeSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.decodeSucceededNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerBlockKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerBlockKeysClassifiedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerFalseNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerFamilyBlockNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerFamilyBlockNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerFamilyNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerKeysClassifiedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerRecursorBlockNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerRecursorBlockNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerRecursorNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerSucceededNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerTrueNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.eagerWorkNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.eagerWorkNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.encodeSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.encodeSucceededNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.falseProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.falseProjectionEntry._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.falseProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanSerialized.falseProjectionEntry._native.native_decide.ax_1_2,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.falseProjectionHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.falseProjectionHashNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.falseProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.falseProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyBlockEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyBlockEntry._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyBlockEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanSerialized.familyBlockEntry._native.native_decide.ax_1_2,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyBlockHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyBlockHashNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyBlockLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyBlockLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyProjectionEntry._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanSerialized.familyProjectionEntry._native.native_decide.ax_1_2,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyProjectionHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyProjectionHashNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.familyTargetsNonemptyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.familyTargetsNonemptyNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFalseLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFalseLoadedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFamilyBlockKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFamilyBlockKeysNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFamilyBlockNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFamilyBlockNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFamilyKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFamilyKeysClassifiedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFamilyLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFamilyLoadedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFamilySucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFamilySucceededNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalBlockKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalBlockKeysClassifiedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalFalseNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalFalseNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalFamilyBlockNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalFamilyBlockNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalFamilyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalFamilyNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalRecursorBlockNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalRecursorBlockNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalRecursorNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalRecursorNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyFinalTrueNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyFinalTrueNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyRecursorKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyRecursorKeysClassifiedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyRecursorSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyRecursorSucceededNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.lazyTrueLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.lazyTrueLoadedNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.originalFalseProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.originalFalseProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.originalFamilyBlockLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.originalFamilyBlockLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.originalFamilyProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.originalFamilyProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.originalRecursorBlockLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.originalRecursorBlockLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.originalRecursorProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.originalRecursorProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.originalTrueProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.originalTrueProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorBlockEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorBlockEntry._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorBlockEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanSerialized.recursorBlockEntry._native.native_decide.ax_1_2,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorBlockHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorBlockHashNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorBlockLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorBlockLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorProjectionEntry._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanSerialized.recursorProjectionEntry._native.native_decide.ax_1_2,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorProjectionHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorProjectionHashNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorProjectionLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorProjectionLookupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.recursorTargetsNonemptyNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.recursorTargetsNonemptyNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.sourceAddressesNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.sourceAddressesNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.sourceAddressesNodupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.sourceAddressesNodupNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.sourceKeysNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.sourceKeysNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.trueProjectionEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.trueProjectionEntry._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.trueProjectionEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.BooleanSerialized.trueProjectionEntry._native.native_decide.ax_1_2,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.trueProjectionHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.BooleanSerialized.trueProjectionHashNative._native.native_decide.ax_1_1,
   serializedBooleanNativeAxiom
-    `Ix.Tc.BooleanSerialized.trueProjectionLookupNative._native.native_decide.ax_1_1
+    `Ix.Kernel.BooleanSerialized.trueProjectionLookupNative._native.native_decide.ax_1_1
 ]
 
 /- Exact evaluator boundary of the non-vacuous literal/blob T0 fixture. -/
 private def literalRoundTripNative : Array Lean.Name := nameNative ++ #[
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.blobKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.blobKeysClassifiedNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.decodeSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.decodeSucceededNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.encodeSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.encodeSucceededNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natBlobHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natBlobHashNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natBlobLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natBlobLookupNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natEntry._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.SerializedLiteralBlobs.natEntry._native.native_decide.ax_1_2,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natHashNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natLoadedNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natLookupNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.natSucceededNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.natSucceededNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.sourceAddressesClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.sourceAddressesClassifiedNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.sourceAddressesNodupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.sourceAddressesNodupNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.sourceKeysClassifiedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.sourceKeysClassifiedNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringBlobHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.stringBlobHashNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringBlobLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.stringBlobLookupNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringEntry._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.stringEntry._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringEntry._native.native_decide.ax_1_2,
+    `Ix.Kernel.SerializedLiteralBlobs.stringEntry._native.native_decide.ax_1_2,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringHashNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.stringHashNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringLoadedNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.stringLoadedNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringLookupNative._native.native_decide.ax_1_1,
+    `Ix.Kernel.SerializedLiteralBlobs.stringLookupNative._native.native_decide.ax_1_1,
   literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.stringSucceededNative._native.native_decide.ax_1_1
+    `Ix.Kernel.SerializedLiteralBlobs.stringSucceededNative._native.native_decide.ax_1_1
 ]
 
 private def malformedConstantNative : Array Lean.Name :=
   canonicalPrimitivesNative.push <| literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.malformedConstantRejectedNative._native.native_decide.ax_1_1
+    `Ix.Kernel.SerializedLiteralBlobs.malformedConstantRejectedNative._native.native_decide.ax_1_1
 
 private def malformedBlobNative : Array Lean.Name :=
   canonicalPrimitivesNative.push <| literalBlobsNativeAxiom
-    `Ix.Tc.SerializedLiteralBlobs.malformedBlobRejectedNative._native.native_decide.ax_1_1
+    `Ix.Kernel.SerializedLiteralBlobs.malformedBlobRejectedNative._native.native_decide.ax_1_1
 
 /- Direct upstream `sorryAx` origins.  Listing the declarations, rather than
 merely allowing `sorryAx`, makes upstream debt movement visible in review.
-The certificate-bearing Lean4Lean pin discharges the former `VInductDecl.WF`,
+The certificate-bearing Ix.Theory.Named pin discharges the former `VInductDecl.WF`,
 `VEnv.addInduct`, `VEnv.addInduct_WF`, and `TrProj` origins. -/
 private def forallEInv : Lean.Name :=
-  ``Lean4Lean.VEnv.IsDefEqU.forallE_inv_stratified
-private def sortInv : Lean.Name := ``Lean4Lean.VEnv.IsDefEqU.sort_inv
+  ``Ix.Theory.Named.VEnv.IsDefEqU.forallE_inv_stratified
+private def sortInv : Lean.Name := ``Ix.Theory.Named.VEnv.IsDefEqU.sort_inv
 
 private def typingDebt : Array Lean.Name :=
   #[forallEInv, sortInv]
 
-/- P0's concrete projection adapter consumes Lean4Lean's structural laws.
+/- P0's concrete projection adapter consumes Ix.Theory.Named's structural laws.
 Its uniqueness law reaches the named registered-structure inversion theorem;
-the context-defeq law also crosses Lean4Lean's current unique-typing boundary
+the context-defeq law also crosses Ix.Theory.Named's current unique-typing boundary
 and therefore inherits the two L2 inversion origins.  Keep this exact rather
 than allowing the remainder of the executable inductive-fixture debt. -/
 private def projectionDebt : Array Lean.Name :=
-  typingDebt.push ``Lean4Lean.VEnv.WF.registeredStructureHeadInversion
+  typingDebt.push ``Ix.Theory.Named.VEnv.WF.registeredStructureHeadInversion
 
 /- The empty legacy whole-`KEnv` inductive path is forbidden from every G2b
 consumer root.  Keeping this list in the executable audit prevents an
 innocent-looking helper from reintroducing the old `nomatch` dependency. -/
 private def legacyWholeEnv : Array Lean.Name := #[
-  ``Ix.Tc.AddKInduct,
-  ``Ix.Tc.AddKInduct.to_addInduct,
-  ``Ix.Tc.TrKEnv',
-  ``Ix.Tc.TrKEnv
+  ``Ix.Kernel.AddKInduct,
+  ``Ix.Kernel.AddKInduct.to_addInduct,
+  ``Ix.Kernel.TrKEnv',
+  ``Ix.Kernel.TrKEnv
 ]
 
 /- E2a is intentionally a Theory-only certificate consumer. These
 checker/catalog/pattern declarations must not enter its dependency graph. -/
 private def certificateAdapterForbidden : Array Lean.Name := #[
-  ``Ix.Tc.Catalog,
-  ``Ix.Tc.RawInductiveConstRel,
-  ``Ix.Tc.RawRecursorRuleRel,
-  ``Ix.Tc.RawRecursorRulePatternRel,
-  ``Ix.Tc.InductiveOracle,
-  ``Lean4Lean.TrProj
+  ``Ix.Kernel.Catalog,
+  ``Ix.Kernel.RawInductiveConstRel,
+  ``Ix.Kernel.RawRecursorRuleRel,
+  ``Ix.Kernel.RawRecursorRulePatternRel,
+  ``Ix.Kernel.InductiveOracle,
+  ``Ix.Theory.Named.TrProj
 ]
 
-/- `AnnotatedPi`'s upstream certificate is produced by Lean4Lean's executable
+/- `AnnotatedPi`'s upstream certificate is produced by Ix.Theory.Named's executable
 normalization pipeline, so it cannot satisfy the earlier closed-form
 certificate quarantine against `TrProj`.  It must still remain independent of
 all Ix catalog, checker-pattern, and oracle authority. -/
 private def annotatedPiCertificateForbidden : Array Lean.Name := #[
-  ``Ix.Tc.Catalog,
-  ``Ix.Tc.RawInductiveConstRel,
-  ``Ix.Tc.RawRecursorRuleRel,
-  ``Ix.Tc.RawRecursorRulePatternRel,
-  ``Ix.Tc.InductiveOracle
+  ``Ix.Kernel.Catalog,
+  ``Ix.Kernel.RawInductiveConstRel,
+  ``Ix.Kernel.RawRecursorRuleRel,
+  ``Ix.Kernel.RawRecursorRulePatternRel,
+  ``Ix.Kernel.InductiveOracle
 ]
 
 /- The pre-TrustedBody delta route admitted successful unfolding through a broad
 reflection oracle and arbitrary cache-write authority.  The final K1 closure
 must use exact trusted declaration certificates instead. -/
 private def legacyDeltaAuthority : Array Lean.Name := #[
-  ``Ix.Tc.UnfoldCacheWriteOracle,
-  ``Ix.Tc.DeltaUnfoldReflection,
-  ``Ix.Tc.RecM.DeltaUnfoldContext,
-  ``Ix.Tc.RecM.FullWhnfStepContext.ofDelta
+  ``Ix.Kernel.UnfoldCacheWriteOracle,
+  ``Ix.Kernel.DeltaUnfoldReflection,
+  ``Ix.Kernel.RecM.DeltaUnfoldContext,
+  ``Ix.Kernel.RecM.FullWhnfStepContext.ofDelta
 ]
 
 private def k1ForbiddenDependencies : Array Lean.Name :=
@@ -3047,13 +3033,13 @@ all-depth, single-support closure interface whose finite-sort obstruction is
 proved below.  The legacy declarations remain audited as compatibility
 artifacts while consumers migrate. -/
 private def legacyAllDepthKnot : Array Lean.Name := #[
-  ``Ix.Tc.RecursiveMethodClosureContext,
-  ``Ix.Tc.RecursiveMethodClosureContext.closedAt,
-  ``Ix.Tc.RecursiveMethodClosureContext.methodsN,
-  ``Ix.Tc.RecursiveMethodClosureContext.fullInferenceContext,
-  ``Ix.Tc.RecursiveMethodClosureContext.next_fullInferenceWFAt,
-  ``Ix.Tc.RecursiveMethodClosureContext.methodsN_fullInferenceWFAt,
-  ``Ix.Tc.RecursiveMethodClosureContext.publicInfer_full_wf
+  ``Ix.Kernel.RecursiveMethodClosureContext,
+  ``Ix.Kernel.RecursiveMethodClosureContext.closedAt,
+  ``Ix.Kernel.RecursiveMethodClosureContext.methodsN,
+  ``Ix.Kernel.RecursiveMethodClosureContext.fullInferenceContext,
+  ``Ix.Kernel.RecursiveMethodClosureContext.next_fullInferenceWFAt,
+  ``Ix.Kernel.RecursiveMethodClosureContext.methodsN_fullInferenceWFAt,
+  ``Ix.Kernel.RecursiveMethodClosureContext.publicInfer_full_wf
 ]
 
 private def boundedKnotForbiddenDependencies : Array Lean.Name :=
@@ -3062,7 +3048,7 @@ private def boundedKnotForbiddenDependencies : Array Lean.Name :=
 /- E2c occurrence-validation roots must be derived from the production run,
 not from the ambient semantic inductive oracle retained by E2b. -/
 private def occurrenceValidationForbiddenDependencies : Array Lean.Name :=
-  boundedKnotForbiddenDependencies.push ``Ix.Tc.InductiveOracle
+  boundedKnotForbiddenDependencies.push ``Ix.Kernel.InductiveOracle
 
 /- Existing semantic admission returns the shared `TrustedCatalogLog`, whose
 inductive declaration necessarily mentions its legacy ambient constructor.
@@ -3070,19 +3056,19 @@ Constructor-insensitive dependency traversal therefore cannot forbid the
 `InductiveOracle` type itself here.  Instead, quarantine every operation that
 materializes or admits an oracle-selected future world. -/
 private def oracleWorldMaterialization : Array Lean.Name := #[
-    ``Ix.Tc.VerifyWorld.admitOracle,
-    ``Ix.Tc.VerifyWorld.le_admitOracle,
-    ``Ix.Tc.OracleBlockCertificate.admit,
-    ``Ix.Tc.OracleBlockCertificate.admitState,
-    ``Ix.Tc.RecM.certifyOracleBackedBlock,
-    ``Ix.Tc.RecM.certifyOracleBackedAdmittedBlock,
-    ``Ix.Tc.SingletonFamilyCatalogLink.oracle,
-    ``Ix.Tc.SingletonRecursorCatalogLink.oracle,
-    ``Ix.Tc.InductiveOracle.reindex,
-    ``Ix.Tc.InductiveOracle.restageMissing,
-    ``Ix.Tc.IndexedRecursivePattern.oracle,
-    ``Ix.Tc.IndexedRecursiveFixture.recursorBlockOracle,
-    ``Ix.Tc.IndexedRecursiveFixture.recursorAtomicAdmission
+    ``Ix.Kernel.VerifyWorld.admitOracle,
+    ``Ix.Kernel.VerifyWorld.le_admitOracle,
+    ``Ix.Kernel.OracleBlockCertificate.admit,
+    ``Ix.Kernel.OracleBlockCertificate.admitState,
+    ``Ix.Kernel.RecM.certifyOracleBackedBlock,
+    ``Ix.Kernel.RecM.certifyOracleBackedAdmittedBlock,
+    ``Ix.Kernel.SingletonFamilyCatalogLink.oracle,
+    ``Ix.Kernel.SingletonRecursorCatalogLink.oracle,
+    ``Ix.Kernel.InductiveOracle.reindex,
+    ``Ix.Kernel.InductiveOracle.restageMissing,
+    ``Ix.Kernel.IndexedRecursivePattern.oracle,
+    ``Ix.Kernel.IndexedRecursiveFixture.recursorBlockOracle,
+    ``Ix.Kernel.IndexedRecursiveFixture.recursorAtomicAdmission
 ]
 
 private def existingSemanticBlockForbiddenDependencies : Array Lean.Name :=
@@ -3092,14 +3078,14 @@ private def existingSemanticBlockForbiddenDependencies : Array Lean.Name :=
 finite positive-fuel construction must neither manufacture that model nor
 reach the older public adapters that consume it. -/
 private def legacyGlobalSuffix : Array Lean.Name := #[
-  ``Ix.Tc.KernelSuffixModel,
-  ``Ix.Tc.ScopedKernelSuffixModel.toKernelSuffixModel,
-  ``Ix.Tc.PropositionClassifierContext,
-  ``Ix.Tc.RecursiveMethodRunContext,
-  ``Ix.Tc.TcM.whnf.wf_legacy,
-  ``Ix.Tc.TcM.infer.wf_legacy,
-  ``Ix.Tc.TcM.isDefEq.wf_legacy,
-  ``Ix.Tc.TcM.checkConst.wf_legacy
+  ``Ix.Kernel.KernelSuffixModel,
+  ``Ix.Kernel.ScopedKernelSuffixModel.toKernelSuffixModel,
+  ``Ix.Kernel.PropositionClassifierContext,
+  ``Ix.Kernel.RecursiveMethodRunContext,
+  ``Ix.Kernel.TcM.whnf.wf_legacy,
+  ``Ix.Kernel.TcM.infer.wf_legacy,
+  ``Ix.Kernel.TcM.isDefEq.wf_legacy,
+  ``Ix.Kernel.TcM.checkConst.wf_legacy
 ]
 
 private def scopedK2SForbiddenDependencies : Array Lean.Name :=
@@ -3119,73 +3105,73 @@ set_option maxRecDepth 100000
 
 private def roots : Array RootAllowance := #[
   -- Level decision procedures.
-  { root := ``Ix.Tc.univEq_sound, standardAxioms := standard },
-  { root := ``Ix.Tc.univGeq_sound, standardAxioms := standard },
+  { root := ``Ix.Kernel.univEq_sound, standardAxioms := standard },
+  { root := ``Ix.Kernel.univGeq_sound, standardAxioms := standard },
 
   -- Memoized expression walkers against their pure specifications.
-  { root := ``Ix.Tc.lift_spec,
+  { root := ``Ix.Kernel.lift_spec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.subst_spec,
+  { root := ``Ix.Kernel.subst_spec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.simulSubst_spec,
+  { root := ``Ix.Kernel.simulSubst_spec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.instantiateRev_spec,
+  { root := ``Ix.Kernel.instantiateRev_spec,
     standardAxioms := standard, nativeAxioms := expressionNative },
   -- There is not yet an API-level `abstractFVars_spec`; protect the current
   -- walker master until that final wrapper replaces it.
-  { root := ``Ix.Tc.abstractFVarsCached_spec,
+  { root := ``Ix.Kernel.abstractFVarsCached_spec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TcM.instantiateUnivParams_wf,
+  { root := ``Ix.Kernel.TcM.instantiateUnivParams_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
 
   -- G3a finite run support and generated-term resource bounds. Universe
   -- instantiation can rebuild sorts/constants and therefore reaches the now
   -- total expression serializer's standard `UInt8` quotient implementation.
-  { root := ``Ix.Tc.KExpr.LiftReach.finite,
+  { root := ``Ix.Kernel.KExpr.LiftReach.finite,
     standardAxioms := standardWithoutQuot,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.KExpr.SubstReach.finite,
+  { root := ``Ix.Kernel.KExpr.SubstReach.finite,
     standardAxioms := standardWithoutQuot,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.KExpr.InstUnivReach.finite,
+  { root := ``Ix.Kernel.KExpr.InstUnivReach.finite,
     standardAxioms := standard,
     nativeAxioms := levelNative },
-  { root := ``Ix.Tc.WalkerRequest.reach_finite,
+  { root := ``Ix.Kernel.WalkerRequest.reach_finite,
     standardAxioms := standard,
     nativeAxioms := levelNative },
-  { root := ``Ix.Tc.InternTable.exprSupport_finite,
+  { root := ``Ix.Kernel.InternTable.exprSupport_finite,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RunSupport.collisionFree_of_le,
+  { root := ``Ix.Kernel.RunSupport.collisionFree_of_le,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.RunSupport.singleton_collisionFree,
+  { root := ``Ix.Kernel.RunSupport.singleton_collisionFree,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.WalkerRequest.Bounds.lift_result,
+  { root := ``Ix.Kernel.WalkerRequest.Bounds.lift_result,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WalkerRequest.Bounds.subst_result,
+  { root := ``Ix.Kernel.WalkerRequest.Bounds.subst_result,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.CheckConstSupport.initial_support,
+  { root := ``Ix.Kernel.CheckConstSupport.initial_support,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.lift,
+  { root := ``Ix.Kernel.CheckConstSupport.lift,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.subst,
+  { root := ``Ix.Kernel.CheckConstSupport.subst,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.instUniv,
+  { root := ``Ix.Kernel.CheckConstSupport.instUniv,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.mono,
+  { root := ``Ix.Kernel.CheckConstSupport.mono,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.scope,
+  { root := ``Ix.Kernel.CheckConstSupport.scope,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.ResourceBounds.mono,
+  { root := ``Ix.Kernel.ResourceBounds.mono,
     standardAxioms := standard,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.checkSupport,
+  { root := ``Ix.Kernel.AmbientNat.checkSupport,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.resourceBounds,
+  { root := ``Ix.Kernel.AmbientNat.resourceBounds,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.supportAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.supportAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -3193,310 +3179,310 @@ private def roots : Array RootAllowance := #[
   -- ties the exact finite request list to an actual TcM computation. The
   -- simultaneous/reverse instantiation specs can likewise rebuild serialized
   -- expressions and inherit the same standard quotient footprint.
-  { root := ``Ix.Tc.KExpr.SimulSubstReach.finite,
+  { root := ``Ix.Kernel.KExpr.SimulSubstReach.finite,
     standardAxioms := standard,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.KExpr.InstRevReach.finite,
+  { root := ``Ix.Kernel.KExpr.InstRevReach.finite,
     standardAxioms := standard,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.KExpr.AbstractReach.finite,
+  { root := ``Ix.Kernel.KExpr.AbstractReach.finite,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WalkerRequest.univReach_finite,
+  { root := ``Ix.Kernel.WalkerRequest.univReach_finite,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.InternTable.univSupport_finite,
+  { root := ``Ix.Kernel.InternTable.univSupport_finite,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RunSupport.pair_collisionFree,
+  { root := ``Ix.Kernel.RunSupport.pair_collisionFree,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.WalkerRequest.Bounds.simulSubst_result,
+  { root := ``Ix.Kernel.WalkerRequest.Bounds.simulSubst_result,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WalkerRequest.Bounds.instRev_result,
+  { root := ``Ix.Kernel.WalkerRequest.Bounds.instRev_result,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WalkerRequest.Bounds.abstractFVars_result,
+  { root := ``Ix.Kernel.WalkerRequest.Bounds.abstractFVars_result,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.abstractFVars_eq,
+  { root := ``Ix.Kernel.abstractFVars_eq,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.InternPreservesUnivs.pure,
+  { root := ``Ix.Kernel.InternPreservesUnivs.pure,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.InternPreservesUnivs.runWalk,
+  { root := ``Ix.Kernel.InternPreservesUnivs.runWalk,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.WalkPreservesUnivs.pure,
+  { root := ``Ix.Kernel.WalkPreservesUnivs.pure,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.WalkPreservesUnivs.bind,
+  { root := ``Ix.Kernel.WalkPreservesUnivs.bind,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.WalkPreservesUnivs.scratchGet,
+  { root := ``Ix.Kernel.WalkPreservesUnivs.scratchGet,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.WalkPreservesUnivs.scratchInsert,
+  { root := ``Ix.Kernel.WalkPreservesUnivs.scratchInsert,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.WalkPreservesUnivs.liftIntern,
+  { root := ``Ix.Kernel.WalkPreservesUnivs.liftIntern,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.WalkPreservesUnivs.internExpr,
+  { root := ``Ix.Kernel.WalkPreservesUnivs.internExpr,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.lift_preservesUnivs,
+  { root := ``Ix.Kernel.lift_preservesUnivs,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.subst_preservesUnivs,
+  { root := ``Ix.Kernel.subst_preservesUnivs,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.simulSubst_preservesUnivs,
+  { root := ``Ix.Kernel.simulSubst_preservesUnivs,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.instantiateRev_preservesUnivs,
+  { root := ``Ix.Kernel.instantiateRev_preservesUnivs,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.abstractFVars_preservesUnivs,
+  { root := ``Ix.Kernel.abstractFVars_preservesUnivs,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WalkerRequest.Bounds.abstractFVarsCached_result,
+  { root := ``Ix.Kernel.WalkerRequest.Bounds.abstractFVarsCached_result,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.CheckConstSupport.initial_univ_support,
+  { root := ``Ix.Kernel.CheckConstSupport.initial_univ_support,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.internExpr,
+  { root := ``Ix.Kernel.CheckConstSupport.internExpr,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.internUniv,
+  { root := ``Ix.Kernel.CheckConstSupport.internUniv,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.simulSubst,
+  { root := ``Ix.Kernel.CheckConstSupport.simulSubst,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.instRev,
+  { root := ``Ix.Kernel.CheckConstSupport.instRev,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.CheckConstSupport.abstractFVars,
+  { root := ``Ix.Kernel.CheckConstSupport.abstractFVars,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.ExecutionRequests.bind,
-    standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.ExecutionRequests.tryCatch,
-    standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.ExecutionRequests.runRec,
+  { root := ``Ix.Kernel.ExecutionRequests.bind,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.ExecutionRequests.isolateCheckErrors,
-    standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.ExecutionRequests.modify,
+  { root := ``Ix.Kernel.ExecutionRequests.tryCatch,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.ExecutionRequests.weaken,
-    standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.ExecutionRequests.of_eq,
-    standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.ExecutionRequests.intern_eq_of_nil,
+  { root := ``Ix.Kernel.ExecutionRequests.runRec,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.ExecutionRequests.isolateCheckErrors,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RunAssumptions.initial,
+  { root := ``Ix.Kernel.ExecutionRequests.modify,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.ExecutionRequests.weaken,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.ExecutionRequests.of_eq,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.ExecutionRequests.intern_eq_of_nil,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.RunAssumptions.initial,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.requestBounds,
-    standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RunAssumptions.internExpr_spec,
+  { root := ``Ix.Kernel.RunAssumptions.requestBounds,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.RunAssumptions.internExpr_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.internUniv_spec,
+  { root := ``Ix.Kernel.RunAssumptions.internUniv_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunSupport.CoversIntern.of_expr_univs,
+  { root := ``Ix.Kernel.RunSupport.CoversIntern.of_expr_univs,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RunAssumptions.lift_spec,
+  { root := ``Ix.Kernel.RunAssumptions.lift_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.subst_spec,
+  { root := ``Ix.Kernel.RunAssumptions.subst_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.simulSubst_spec,
+  { root := ``Ix.Kernel.RunAssumptions.simulSubst_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.instRev_spec,
+  { root := ``Ix.Kernel.RunAssumptions.instRev_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.abstractFVarsCached_spec,
+  { root := ``Ix.Kernel.RunAssumptions.abstractFVarsCached_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.abstractFVars_spec,
+  { root := ``Ix.Kernel.RunAssumptions.abstractFVars_spec,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.instantiateUnivParams_wf,
+  { root := ``Ix.Kernel.RunAssumptions.instantiateUnivParams_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.runIntern_supported_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RunAssumptions.lift_wf,
+  { root := ``Ix.Kernel.RunAssumptions.runIntern_supported_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RunAssumptions.lift_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.subst_wf,
+  { root := ``Ix.Kernel.RunAssumptions.subst_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.simulSubst_wf,
+  { root := ``Ix.Kernel.RunAssumptions.simulSubst_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.instRev_wf,
+  { root := ``Ix.Kernel.RunAssumptions.instRev_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.abstractFVars_wf,
+  { root := ``Ix.Kernel.RunAssumptions.abstractFVars_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.instUniv_wf,
+  { root := ``Ix.Kernel.RunAssumptions.instUniv_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.AmbientNat.supportExecution,
+  { root := ``Ix.Kernel.AmbientNat.supportExecution,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.runAssumptions,
+  { root := ``Ix.Kernel.AmbientNat.runAssumptions,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- Expression translation, typing, uniqueness, and defeq bridges.
-  { root := ``Ix.Tc.TrKExprS.instL,
+  { root := ``Ix.Kernel.TrKExprS.instL,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.TrKExprS.inst,
+  { root := ``Ix.Kernel.TrKExprS.inst,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TrKExprS.inst_let,
+  { root := ``Ix.Kernel.TrKExprS.inst_let,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TrKExprS.inst_let_lbr,
+  { root := ``Ix.Kernel.TrKExprS.inst_let_lbr,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TrKExprS.wf, standardAxioms := standard },
-  { root := ``Ix.Tc.TrKExpr.wf, standardAxioms := standard },
-  { root := ``Ix.Tc.TrKExprS.uniq,
+  { root := ``Ix.Kernel.TrKExprS.wf, standardAxioms := standard },
+  { root := ``Ix.Kernel.TrKExpr.wf, standardAxioms := standard },
+  { root := ``Ix.Kernel.TrKExprS.uniq,
     standardAxioms := standard, sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.TrKExprS.defeqDFC,
+  { root := ``Ix.Kernel.TrKExprS.defeqDFC,
     standardAxioms := standard, sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.TrKExpr.defeq,
+  { root := ``Ix.Kernel.TrKExpr.defeq,
     standardAxioms := standard, sorryOrigins := typingDebt },
 
   -- Legacy whole-environment compatibility interfaces.  G2b consumer roots
   -- below are forbidden from depending on these declarations.
-  { root := ``Ix.Tc.TrKEnv.wf,
+  { root := ``Ix.Kernel.TrKEnv.wf,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrKEnv.find?,
+  { root := ``Ix.Kernel.TrKEnv.find?,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcM.tick.tcInv,
+  { root := ``Ix.Kernel.TcM.tick.tcInv,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcM.instantiateUnivParams.tcInv,
+  { root := ``Ix.Kernel.TcM.instantiateUnivParams.tcInv,
     standardAxioms := standard, nativeAxioms := levelNative },
 
   -- The narrow upstream-context dependency behind translation uniqueness.
-  { root := ``Ix.Tc.KVLCtx.IsDefEq.find?_uniq,
+  { root := ``Ix.Kernel.KVLCtx.IsDefEq.find?_uniq,
     standardAxioms := standard },
 
   -- Dual-context reconciliation entry points used by the checker proofs.
-  { root := ``Ix.Tc.CtxRecon.wf, standardAxioms := standard },
-  { root := ``Ix.Tc.CtxRecon.lookupVar,
+  { root := ``Ix.Kernel.CtxRecon.wf, standardAxioms := standard },
+  { root := ``Ix.Kernel.CtxRecon.lookupVar,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.CtxRecon.fvar_resolves,
+  { root := ``Ix.Kernel.CtxRecon.fvar_resolves,
     standardAxioms := standard },
 
   -- G1a's non-circular world and one-way lazy-load boundary.
-  { root := ``Ix.Tc.VerifyWorld.ofCatalog_catalogued_not_trusted,
+  { root := ``Ix.Kernel.VerifyWorld.ofCatalog_catalogued_not_trusted,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.VerifyWorld.LE.trans,
+  { root := ``Ix.Kernel.VerifyWorld.LE.trans,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.VerifyWorld.LE.catalogued_iff,
+  { root := ``Ix.Kernel.VerifyWorld.LE.catalogued_iff,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.LoadedAgrees.world_iff,
+  { root := ``Ix.Kernel.LoadedAgrees.world_iff,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.LoadedAgrees.insert,
+  { root := ``Ix.Kernel.LoadedAgrees.insert,
     standardAxioms := standard },
-  { root := ``Ix.Tc.LoadedAgrees.of_extension,
+  { root := ``Ix.Kernel.LoadedAgrees.of_extension,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.VerifyWorld.ofCatalog_loaded,
+  { root := ``Ix.Kernel.VerifyWorld.ofCatalog_loaded,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.VerifyWorld.ofCatalog_loaded_not_trusted,
+  { root := ``Ix.Kernel.VerifyWorld.ofCatalog_loaded_not_trusted,
     standardAxioms := standard },
 
   -- G1b's raw/pending boundary.  Raw correspondence has no declaration-WF
   -- premise; the fixture roots pin the concrete non-WF pending case.
-  { root := ``Ix.Tc.RawExprRel.mono,
+  { root := ``Ix.Kernel.RawExprRel.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RawExprRel.reference_resolved,
+  { root := ``Ix.Kernel.RawExprRel.reference_resolved,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RawDeclRel.mono,
+  { root := ``Ix.Kernel.RawDeclRel.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.PendingDecl.no_target_lookup,
+  { root := ``Ix.Kernel.PendingDecl.no_target_lookup,
     standardAxioms := standard },
-  { root := ``Ix.Tc.PendingDecl.no_self_expr_reference,
+  { root := ``Ix.Kernel.PendingDecl.no_self_expr_reference,
     standardAxioms := standard },
-  { root := ``Ix.Tc.PendingDecl.not_trustedDecl,
+  { root := ``Ix.Kernel.PendingDecl.not_trustedDecl,
     standardAxioms := standard },
-  { root := ``Ix.Tc.IllTypedPending.pending_but_not_wf,
+  { root := ``Ix.Kernel.IllTypedPending.pending_but_not_wf,
     standardAxioms := standard },
-  { root := ``Ix.Tc.IllTypedPending.loaded_pending_but_not_wf,
+  { root := ``Ix.Kernel.IllTypedPending.loaded_pending_but_not_wf,
     standardAxioms := standard },
 
   -- G1c's trusted-only catalog log and explicit-WF promotion boundary.
-  { root := ``Ix.Tc.RawDeclRel.wf_le,
+  { root := ``Ix.Kernel.RawDeclRel.wf_le,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogLog.wf,
+  { root := ``Ix.Kernel.TrustedCatalogLog.wf,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogLog.catalogued,
+  { root := ``Ix.Kernel.TrustedCatalogLog.catalogued,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogLog.find,
+  { root := ``Ix.Kernel.TrustedCatalogLog.find,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogRel.ofCatalog,
+  { root := ``Ix.Kernel.TrustedCatalogRel.ofCatalog,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogRel.find,
+  { root := ``Ix.Kernel.TrustedCatalogRel.find,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogEntry.recursorRule,
+  { root := ``Ix.Kernel.TrustedCatalogEntry.recursorRule,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogRel.recursorRule,
+  { root := ``Ix.Kernel.TrustedCatalogRel.recursorRule,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogEntry.recursorPattern,
+  { root := ``Ix.Kernel.TrustedCatalogEntry.recursorPattern,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogRel.recursorPattern,
+  { root := ``Ix.Kernel.TrustedCatalogRel.recursorPattern,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedDecl.lookup,
+  { root := ``Ix.Kernel.TrustedDecl.lookup,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrustedCatalogRel.lookup,
+  { root := ``Ix.Kernel.TrustedCatalogRel.lookup,
     standardAxioms := standard },
-  { root := ``Ix.Tc.Promotes.trans,
+  { root := ``Ix.Kernel.Promotes.trans,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TrustedCatalogRel.promote,
+  { root := ``Ix.Kernel.TrustedCatalogRel.promote,
     standardAxioms := standard },
-  { root := ``Ix.Tc.IllTypedPending.trustedCatalogRel,
+  { root := ``Ix.Kernel.IllTypedPending.trustedCatalogRel,
     standardAxioms := standard },
-  { root := ``Ix.Tc.WellTypedPromotion.promotes,
+  { root := ``Ix.Kernel.WellTypedPromotion.promotes,
     standardAxioms := standard },
 
   -- G1d's world-based concrete-state invariant.  Loading stays
   -- representation-only, promotion requires a fresh WF witness, and the
   -- fixed-world Hoare roots pin no-promotion behavior on both outcomes.
-  { root := ``Ix.Tc.TcStateWF.of_consts_eq,
+  { root := ``Ix.Kernel.TcStateWF.of_consts_eq,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcStateWF.load,
+  { root := ``Ix.Kernel.TcStateWF.load,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcStateWF.promote,
+  { root := ``Ix.Kernel.TcStateWF.promote,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcStateWF.find?,
+  { root := ``Ix.Kernel.TcStateWF.find?,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcInv.find?,
+  { root := ``Ix.Kernel.TcInv.find?,
     standardAxioms := standard },
-  { root := ``Ix.Tc.IllTypedPending.tcInv_pending_but_not_wf,
+  { root := ``Ix.Kernel.IllTypedPending.tcInv_pending_but_not_wf,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcM.tick.tcStateWF,
+  { root := ``Ix.Kernel.TcM.tick.tcStateWF,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcM.instantiateUnivParams.tcStateWF,
+  { root := ``Ix.Kernel.TcM.instantiateUnivParams.tcStateWF,
     standardAxioms := standard, nativeAxioms := levelNative },
 
-  -- Pin A / E2a: the certified-generation adapter may use only Lean4Lean
+  -- Pin A / E2a: the certified-generation adapter may use only Ix.Theory.Named
   -- Theory transaction facts, never Ix checker/catalog/pattern authority.
-  { root := ``Ix.Tc.CertifiedGenerationTransaction.trace,
+  { root := ``Ix.Kernel.CertifiedGenerationTransaction.trace,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.CertifiedGenerationTransaction.afterWF,
+  { root := ``Ix.Kernel.CertifiedGenerationTransaction.afterWF,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.CertifiedGenerationTransaction.facts,
+  { root := ``Ix.Kernel.CertifiedGenerationTransaction.facts,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := certificateAdapterForbidden },
 
-  -- L4L-08's Theory-only block adapter preserves the same quarantine while
+  -- Spec-08's Theory-only block adapter preserves the same quarantine while
   -- exposing one atomic all-families/all-constructors/all-recursors/all-rules
   -- transaction rather than a sequence of singleton admissions.
-  { root := ``Ix.Tc.CertifiedBlockGenerationTransaction.trace,
+  { root := ``Ix.Kernel.CertifiedBlockGenerationTransaction.trace,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.CertifiedBlockGenerationTransaction.afterWF,
+  { root := ``Ix.Kernel.CertifiedBlockGenerationTransaction.afterWF,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.CertifiedBlockGenerationTransaction.facts,
+  { root := ``Ix.Kernel.CertifiedBlockGenerationTransaction.facts,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := certificateAdapterForbidden },
 
-  -- E2c retains the exact Lean4Lean candidate-producer equation alongside
+  -- E2c retains the exact Ix.Theory.Named candidate-producer equation alongside
   -- the certified Theory transaction.  Unlike the Theory-only adapter above,
   -- this Verify-backed bridge deliberately inherits the pinned analyzer debt.
-  { root := ``Ix.Tc.ProducedGenerationTransaction.facts,
+  { root := ``Ix.Kernel.ProducedGenerationTransaction.facts,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.ExactProducedGenerationTransaction.facts,
+  { root := ``Ix.Kernel.ExactProducedGenerationTransaction.facts,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
 
   -- First genuine multi-family semantic witness: Tree/TreeList has two
   -- motives and recursors, five flattened constructors/rules, sibling
   -- recursion in both directions, and one recursive occurrence below a Pi.
-  { root := ``Ix.Tc.MutualTreeCertificateFixture.breadth,
+  { root := ``Ix.Kernel.MutualTreeCertificateFixture.breadth,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.MutualTreeCertificateFixture.certifiedFacts,
+  { root := ``Ix.Kernel.MutualTreeCertificateFixture.certifiedFacts,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.MutualTreeCertificateFixture.finalEnvWF,
+  { root := ``Ix.Kernel.MutualTreeCertificateFixture.finalEnvWF,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
 
@@ -3504,7 +3490,7 @@ private def roots : Array RootAllowance := #[
   -- `TreeList, Tree`.  All seven family/constructor entries are linked to the
   -- complete catalog and admitted atomically without the pending recursor
   -- pattern/WF witnesses used by the later conditional closure.
-  { root := ``Ix.Tc.MutualTreeFixture.mutualFamilyAtomicClosure,
+  { root := ``Ix.Kernel.MutualTreeFixture.mutualFamilyAtomicClosure,
     standardAxioms := standard,
     nativeAxioms := mutualFamilyNative },
 
@@ -3513,28 +3499,28 @@ private def roots : Array RootAllowance := #[
   -- elimination, and both generated rules.  It remains Theory-only here;
   -- production Ix catalog correspondence is audited in the later linkage.
   { root :=
-      ``Ix.Tc.IndexedRecursiveCertificateFixture.transaction_generation,
+      ``Ix.Kernel.IndexedRecursiveCertificateFixture.transaction_generation,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.IndexedRecursiveCertificateFixture.breadth,
+  { root := ``Ix.Kernel.IndexedRecursiveCertificateFixture.breadth,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.IndexedRecursiveCertificateFixture.certifiedFacts,
+  { root := ``Ix.Kernel.IndexedRecursiveCertificateFixture.certifiedFacts,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.IndexedRecursiveCertificateFixture.producedCertificate_eq,
+  { root := ``Ix.Kernel.IndexedRecursiveCertificateFixture.producedCertificate_eq,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.IndexedRecursiveCertificateFixture.producedToCertified_eq,
+  { root := ``Ix.Kernel.IndexedRecursiveCertificateFixture.producedToCertified_eq,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.IndexedRecursiveCertificateFixture.producerLinkedFacts,
+  { root := ``Ix.Kernel.IndexedRecursiveCertificateFixture.producerLinkedFacts,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
 
@@ -3544,13 +3530,13 @@ private def roots : Array RootAllowance := #[
   -- IndexedVec certificate, these roots remain entirely on the Theory side
   -- of the catalog/checker boundary.
   { root :=
-      ``Ix.Tc.RecursivePiCertificateFixture.transaction_generation,
+      ``Ix.Kernel.RecursivePiCertificateFixture.transaction_generation,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.RecursivePiCertificateFixture.breadth,
+  { root := ``Ix.Kernel.RecursivePiCertificateFixture.breadth,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
-  { root := ``Ix.Tc.RecursivePiCertificateFixture.certifiedFacts,
+  { root := ``Ix.Kernel.RecursivePiCertificateFixture.certifiedFacts,
     standardAxioms := standard,
     forbiddenDependencies := certificateAdapterForbidden },
 
@@ -3559,23 +3545,23 @@ private def roots : Array RootAllowance := #[
   -- `outParam Prop`, while the analyzer-owned candidate exposes `Prop`.
   -- These certificate roots remain entirely on the Theory side.
   { root :=
-      ``Ix.Tc.AnnotatedPiCertificateFixture.transaction_generation,
+      ``Ix.Kernel.AnnotatedPiCertificateFixture.transaction_generation,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AnnotatedPiCertificateFixture.breadth,
+  { root := ``Ix.Kernel.AnnotatedPiCertificateFixture.breadth,
     standardAxioms := standardWithoutChoice,
     nativeAxioms := annotatedPiCertificateBreadthNative,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AnnotatedPiCertificateFixture.certifiedFacts,
+  { root := ``Ix.Kernel.AnnotatedPiCertificateFixture.certifiedFacts,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AnnotatedPiCertificateFixture.producerLinkedFacts,
+  { root := ``Ix.Kernel.AnnotatedPiCertificateFixture.producerLinkedFacts,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
 
@@ -3584,23 +3570,23 @@ private def roots : Array RootAllowance := #[
   -- `Type`.  These roots certify the non-identity family-result view without
   -- Ix catalog, checker-pattern, or oracle authority.
   { root :=
-      ``Ix.Tc.AliasFormerCertificateFixture.transaction_generation,
+      ``Ix.Kernel.AliasFormerCertificateFixture.transaction_generation,
     standardAxioms := standard,
-    upstreamAxioms := aliasFormerUpstreamAxioms,
+    implementationAxioms := aliasFormerUpstreamAxioms,
     sorryOrigins := aliasFormerUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AliasFormerCertificateFixture.breadth,
+  { root := ``Ix.Kernel.AliasFormerCertificateFixture.breadth,
     standardAxioms := standardWithoutChoice,
     nativeAxioms := aliasFormerCertificateBreadthNative,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AliasFormerCertificateFixture.certifiedFacts,
+  { root := ``Ix.Kernel.AliasFormerCertificateFixture.certifiedFacts,
     standardAxioms := standard,
-    upstreamAxioms := aliasFormerUpstreamAxioms,
+    implementationAxioms := aliasFormerUpstreamAxioms,
     sorryOrigins := aliasFormerUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AliasFormerCertificateFixture.producerLinkedFacts,
+  { root := ``Ix.Kernel.AliasFormerCertificateFixture.producerLinkedFacts,
     standardAxioms := standard,
-    upstreamAxioms := aliasFormerUpstreamAxioms,
+    implementationAxioms := aliasFormerUpstreamAxioms,
     sorryOrigins := aliasFormerUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
 
@@ -3608,20 +3594,20 @@ private def roots : Array RootAllowance := #[
   -- certifying the direct-recursive checked field.  The adapter packages the
   -- pinned upstream generation/WF replay without Ix-side semantic authority.
   { root :=
-      ``Ix.Tc.AliasRecCertificateFixture.transaction_generation,
+      ``Ix.Kernel.AliasRecCertificateFixture.transaction_generation,
     standardAxioms := standard,
-    upstreamAxioms := aliasRecUpstreamAxioms,
+    implementationAxioms := aliasRecUpstreamAxioms,
     sorryOrigins := aliasRecUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AliasRecCertificateFixture.breadth,
+  { root := ``Ix.Kernel.AliasRecCertificateFixture.breadth,
     standardAxioms := standard,
-    upstreamAxioms := aliasRecUpstreamAxioms,
+    implementationAxioms := aliasRecUpstreamAxioms,
     nativeAxioms := aliasRecCertificateBreadthNative,
     sorryOrigins := aliasRecUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
-  { root := ``Ix.Tc.AliasRecCertificateFixture.certifiedFacts,
+  { root := ``Ix.Kernel.AliasRecCertificateFixture.certifiedFacts,
     standardAxioms := standard,
-    upstreamAxioms := aliasRecUpstreamAxioms,
+    implementationAxioms := aliasRecUpstreamAxioms,
     sorryOrigins := aliasRecUpstreamDebt,
     forbiddenDependencies := annotatedPiCertificateForbidden },
 
@@ -3629,40 +3615,40 @@ private def roots : Array RootAllowance := #[
   -- family and strengthen every production guard into the elementwise
   -- valid-inductive-application invariant, without oracle authority.
   { root :=
-      ``Ix.Tc.RecM.checkPositiveRecursiveApplicationPreconditions_success_iff,
+      ``Ix.Kernel.RecM.checkPositiveRecursiveApplicationPreconditions_success_iff,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.positiveUniverseArgumentsAgree_eq_true_iff,
+  { root := ``Ix.Kernel.RecM.positiveUniverseArgumentsAgree_eq_true_iff,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.positiveIndicesIndependent_eq_true_iff,
+  { root := ``Ix.Kernel.RecM.positiveIndicesIndependent_eq_true_iff,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositiveParametersFrom_success,
+  { root := ``Ix.Kernel.RecM.checkPositiveParametersFrom_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositiveParameters_success,
+  { root := ``Ix.Kernel.RecM.checkPositiveParameters_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.PositiveParameterComparisonTrace.sound,
+  { root := ``Ix.Kernel.RecM.PositiveParameterComparisonTrace.sound,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.PositiveParameterComparisonTrace.theoryDefEq,
+  { root := ``Ix.Kernel.RecM.PositiveParameterComparisonTrace.theoryDefEq,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.ValidPositiveRecursiveApplicationHeader.theoryParameters,
+      ``Ix.Kernel.RecM.ValidPositiveRecursiveApplicationHeader.theoryParameters,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.PositiveParameterComparisonTrace.theoryDefEqScoped,
+      ``Ix.Kernel.RecM.PositiveParameterComparisonTrace.theoryDefEqScoped,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     -- This is the K2S instantiation bridge, not the oracle-free occurrence
@@ -3671,40 +3657,40 @@ private def roots : Array RootAllowance := #[
     -- confined to the projected `ScopedWFAtOn.isDefEq` field.
     forbiddenDependencies := boundedKnotForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.ValidPositiveRecursiveApplicationHeader.theoryParametersScoped,
+      ``Ix.Kernel.RecM.ValidPositiveRecursiveApplicationHeader.theoryParametersScoped,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.positivityGroupMatches_eq_true_iff,
+  { root := ``Ix.Kernel.RecM.positivityGroupMatches_eq_true_iff,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.SpecializationIdentityFixture.semanticUniverseEquality_does_not_collapse_specialization,
+      ``Ix.Kernel.SpecializationIdentityFixture.semanticUniverseEquality_does_not_collapse_specialization,
     standardAxioms := standard,
     nativeAxioms := specializationIdentityNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkPositiveRecursiveApplicationHeader_success,
+      ``Ix.Kernel.RecM.checkPositiveRecursiveApplicationHeader_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.PositiveRecursiveApplicationHeaderTrace.valid,
+  { root := ``Ix.Kernel.RecM.PositiveRecursiveApplicationHeaderTrace.valid,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositiveRecursiveApplicationHeader_valid,
+  { root := ``Ix.Kernel.RecM.checkPositiveRecursiveApplicationHeader_valid,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositiveRecursiveApplication_success,
+  { root := ``Ix.Kernel.RecM.checkPositiveRecursiveApplication_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.PositiveRecursiveApplicationTrace.valid,
+  { root := ``Ix.Kernel.RecM.PositiveRecursiveApplicationTrace.valid,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositiveRecursiveApplication_valid,
+  { root := ``Ix.Kernel.RecM.checkPositiveRecursiveApplication_valid,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -3713,31 +3699,31 @@ private def roots : Array RootAllowance := #[
   -- direct recursive-family applications inherit the oracle-free occurrence
   -- invariant; and forall success exposes the decremented recursive run plus
   -- exact local-context restoration.
-  { root := ``Ix.Tc.RecM.withLctxRestoration_success,
+  { root := ``Ix.Kernel.RecM.withLctxRestoration_success,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_rootFree,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_rootFree,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_direct,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_direct,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_direct_valid,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_direct_valid,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_nested,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_nested,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_forall_success,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_forall_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_forall_negative,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_forall_negative,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -3747,79 +3733,79 @@ private def roots : Array RootAllowance := #[
   -- traversal, universe instantiation, parameter stripping/substitution,
   -- recursive field-domain checks, and context restoration.  The final root
   -- classifies every successful production domain without a branch oracle.
-  { root := ``Ix.Tc.RecM.findNestedPositivityGroup?_some,
+  { root := ``Ix.Kernel.RecM.findNestedPositivityGroup?_some,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkNestedPositivityApplicationPreconditions_success_iff,
+      ``Ix.Kernel.RecM.checkNestedPositivityApplicationPreconditions_success_iff,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkNestedPositivityApplicationResolvedFuel_success,
+      ``Ix.Kernel.RecM.checkNestedPositivityApplicationResolvedFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkNestedPositivityApplicationCheckedFuel_success,
+      ``Ix.Kernel.RecM.checkNestedPositivityApplicationCheckedFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkNestedConstructorFuel_success,
+  { root := ``Ix.Kernel.RecM.checkNestedConstructorFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkNestedConstructorsFuel_success,
+  { root := ``Ix.Kernel.RecM.checkNestedConstructorsFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkFreshNestedPositivityApplicationFuel_success,
+      ``Ix.Kernel.RecM.checkFreshNestedPositivityApplicationFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.stripNestedCtorParameters_success,
+  { root := ``Ix.Kernel.RecM.stripNestedCtorParameters_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkNestedCtorFieldsLoopFuel_success,
+  { root := ``Ix.Kernel.RecM.checkNestedCtorFieldsLoopFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkNestedCtorFieldsFuel_success,
+  { root := ``Ix.Kernel.RecM.checkNestedCtorFieldsFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.completeNestedConstructor_of_trace,
+  { root := ``Ix.Kernel.RecM.completeNestedConstructor_of_trace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.completeNestedConstructorList_of_trace,
+  { root := ``Ix.Kernel.RecM.completeNestedConstructorList_of_trace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.completeFreshNestedPositivity_of_trace,
+  { root := ``Ix.Kernel.RecM.completeFreshNestedPositivity_of_trace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.completeNestedPositivityChecked_of_trace,
+  { root := ``Ix.Kernel.RecM.completeNestedPositivityChecked_of_trace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.completeNestedPositivityResolved_of_trace,
+  { root := ``Ix.Kernel.RecM.completeNestedPositivityResolved_of_trace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkNestedPositivityApplicationFuel_success,
+      ``Ix.Kernel.RecM.checkNestedPositivityApplicationFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.checkNestedPositivityApplicationFuel_complete,
+      ``Ix.Kernel.RecM.checkNestedPositivityApplicationFuel_complete,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_success,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -3831,121 +3817,121 @@ private def roots : Array RootAllowance := #[
   -- real public builder returns an aligned, duplicate-free physical/key list.
   -- The next fixture must identify its positivity request with one detector
   -- call; it cannot replace that reachability evidence with DefEq.
-  { root := ``Ix.Tc.lawfulBEqNestedSpecializationKey,
+  { root := ``Ix.Kernel.lawfulBEqNestedSpecializationKey,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedAuxiliaryHeaderRel.key_eq,
+  { root := ``Ix.Kernel.NestedAuxiliaryHeaderRel.key_eq,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedAuxiliaryHeaderRel.positivityFlatIdentity,
+  { root := ``Ix.Kernel.NestedAuxiliaryHeaderRel.positivityFlatIdentity,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedAuxiliaryAppendTrace.member_mem,
+  { root := ``Ix.Kernel.NestedAuxiliaryAppendTrace.member_mem,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedAuxiliaryAppendTrace.key_mem,
+  { root := ``Ix.Kernel.NestedAuxiliaryAppendTrace.key_mem,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.appendNestedAuxiliary_fresh,
+  { root := ``Ix.Kernel.RecM.appendNestedAuxiliary_fresh,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.appendNestedAuxiliary_existing,
+  { root := ``Ix.Kernel.RecM.appendNestedAuxiliary_existing,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxSeenSound.empty,
+  { root := ``Ix.Kernel.FlatAuxSeenSound.empty,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxSeenSound.push,
+  { root := ``Ix.Kernel.FlatAuxSeenSound.push,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxTransition.seenSound,
+  { root := ``Ix.Kernel.FlatAuxTransition.seenSound,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxTransition.flat_mem,
+  { root := ``Ix.Kernel.FlatAuxTransition.flat_mem,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxTransition.key_mem,
+  { root := ``Ix.Kernel.FlatAuxTransition.key_mem,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxHistory.single,
+  { root := ``Ix.Kernel.FlatAuxHistory.single,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxHistory.trans,
+  { root := ``Ix.Kernel.FlatAuxHistory.trans,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxHistory.seenSound,
+  { root := ``Ix.Kernel.FlatAuxHistory.seenSound,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxHistory.flat_mem,
+  { root := ``Ix.Kernel.FlatAuxHistory.flat_mem,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxHistory.key_mem,
+  { root := ``Ix.Kernel.FlatAuxHistory.key_mem,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxQueueExact.empty,
+  { root := ``Ix.Kernel.FlatAuxQueueExact.empty,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxQueueExact.pushOriginal,
+  { root := ``Ix.Kernel.FlatAuxQueueExact.pushOriginal,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxQueueExact.transition,
+  { root := ``Ix.Kernel.FlatAuxQueueExact.transition,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.FlatAuxQueueExact.history,
+  { root := ``Ix.Kernel.FlatAuxQueueExact.history,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.appendNestedAuxiliary_transition,
+  { root := ``Ix.Kernel.RecM.appendNestedAuxiliary_transition,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.appendNestedAuxiliary_seenSound,
+  { root := ``Ix.Kernel.RecM.appendNestedAuxiliary_seenSound,
     standardAxioms := standard,
     nativeAxioms := occurrenceValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryDetectNestedCore_transition,
+  { root := ``Ix.Kernel.RecM.tryDetectNestedCore_transition,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryDetectNested_transition,
+  { root := ``Ix.Kernel.RecM.tryDetectNested_transition,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryDetectNested_seenSound,
+  { root := ``Ix.Kernel.RecM.tryDetectNested_seenSound,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.scanFlatConstructorFields_history,
+  { root := ``Ix.Kernel.RecM.scanFlatConstructorFields_history,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.scanFlatConstructor_history,
+  { root := ``Ix.Kernel.RecM.scanFlatConstructor_history,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.scanFlatConstructors_history,
+  { root := ``Ix.Kernel.RecM.scanFlatConstructors_history,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.buildFlatBlockQueueStep_history,
+  { root := ``Ix.Kernel.RecM.buildFlatBlockQueueStep_history,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.runBounded_flatAuxHistory,
+  { root := ``Ix.Kernel.RecM.runBounded_flatAuxHistory,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.seedFlatBlockMembers_exact,
+  { root := ``Ix.Kernel.RecM.seedFlatBlockMembers_exact,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.buildFlatBlockWithAuxSeen_exact,
+  { root := ``Ix.Kernel.RecM.buildFlatBlockWithAuxSeen_exact,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.buildFlatBlock_auxiliaryOrder,
+  { root := ``Ix.Kernel.RecM.buildFlatBlock_auxiliaryOrder,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.CompleteNestedPositivityApplicationTrace.auxiliaryRequest,
+      ``Ix.Kernel.CompleteNestedPositivityApplicationTrace.auxiliaryRequest,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.CompleteNestedPositivityApplicationTrace.producedRequest,
+      ``Ix.Kernel.CompleteNestedPositivityApplicationTrace.producedRequest,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -3954,206 +3940,206 @@ private def roots : Array RootAllowance := #[
   -- runs production ingress, positivity, and flat-block construction on the
   -- same `Box Tree` occurrence.  Its headline root proves that the exact
   -- fresh positivity request is retained under the audited queue invariant.
-  { root := ``Ix.Tc.NestedRecursiveFixture.boxIngressRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.boxIngressRun,
     standardAxioms := standard,
     nativeAxioms := levelNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.boxIngressSucceededNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.boxIngressSucceededNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.treeIngressRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.treeIngressRun,
     standardAxioms := standard,
     nativeAxioms := levelNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.treeIngressSucceededNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.treeIngressSucceededNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.boxConcreteHeader,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.boxConcreteHeader,
     standardAxioms := standard,
     nativeAxioms := levelNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.boxConcreteHeaderMatchesNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.boxConcreteHeaderMatchesNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nodeConcreteType,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nodeConcreteType,
     standardAxioms := standard,
     nativeAxioms := levelNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.nodeConcreteTypeNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.nodeConcreteTypeNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.positivityRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.positivityRun,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.positivitySucceededNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.positivitySucceededNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedWhnfRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedWhnfRun,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.nestedWhnfSucceededNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.nestedWhnfSucceededNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedWhnfResult_eq,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedWhnfResult_eq,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.nestedWhnfResultNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.nestedWhnfResultNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedActionRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedActionRun,
     standardAxioms := standard,
     nativeAxioms := nestedRecursiveActionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.requestHeaderRelation,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.requestHeaderRelation,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.positivityCompleteTrace,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.positivityCompleteTrace,
     standardAxioms := standard,
     nativeAxioms := nestedRecursiveActionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.boxLookupRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.boxLookupRun,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.boxLookupSucceededNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.boxLookupSucceededNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.boxLookupConcrete_eq,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.boxLookupConcrete_eq,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.boxLookupConcreteNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.boxLookupConcreteNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.positivityRequestProduced,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.positivityRequestProduced,
     standardAxioms := standard,
     nativeAxioms := nestedRecursiveProducedNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.positivityRequestFreshExpansion,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.positivityRequestFreshExpansion,
     standardAxioms := standard,
     nativeAxioms := nestedRecursiveFreshNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.flatBuildRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.flatBuildRun,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.flatBuildSucceededNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.flatBuildSucceededNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.builtFlatShape,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.builtFlatShape,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.builtFlatShapeNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.builtFlatShapeNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.requestedAuxiliaryPresent,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.requestedAuxiliaryPresent,
     standardAxioms := standard,
     nativeAxioms := nameContextNative.push
       (nestedRecursiveFixtureNativeAxiom
-        `Ix.Tc.NestedRecursiveFixture.builtFlatShapeNative._native.native_decide.ax_1_1),
+        `Ix.Kernel.NestedRecursiveFixture.builtFlatShapeNative._native.native_decide.ax_1_1),
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryReachability,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryReachability,
     standardAxioms := standard,
     nativeAxioms := nestedRecursiveReachabilityNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
 
-  -- Exact Lean4Lean syntax and semantic transport for the retained nested
+  -- Exact Ix.Theory.Named syntax and semantic transport for the retained nested
   -- member.  The outer field reaches the fresh auxiliary; the auxiliary's
   -- own field recursively reaches the original Tree member at lower fuel.
-  { root := ``Ix.Tc.NestedRecursiveFixture.treeCandidateSyntax,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.treeCandidateSyntax,
     standardAxioms := standard,
     nativeAxioms := nestedTreeCandidateSyntaxNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryCandidateTarget,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryCandidateTarget,
     standardAxioms := standard,
     nativeAxioms := nestedAuxiliaryCandidateTargetNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedOuterPositivityTransport,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedOuterPositivityTransport,
     standardAxioms := standard,
     nativeAxioms := nestedOuterTransportNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedOuterConstructorPositivityTrace,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedOuterConstructorPositivityTrace,
     standardAxioms := standard,
     nativeAxioms := nestedOuterTransportNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryFieldProductionTrace,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryFieldProductionTrace,
     standardAxioms := standard,
     nativeAxioms := nestedAuxiliaryProductionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryPositivityTransport,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryPositivityTransport,
     standardAxioms := standard,
     nativeAxioms := nestedAuxiliaryTransportNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryFieldProductionTraceAt,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryFieldProductionTraceAt,
     standardAxioms := standard,
     nativeAxioms := nestedAuxiliaryProductionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryConstructorPositivityTraceAt,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryConstructorPositivityTraceAt,
     standardAxioms := standard,
     nativeAxioms := nestedAuxiliaryConstructorNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedAuxiliaryConstructorPositivityTrace,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedAuxiliaryConstructorPositivityTrace,
     standardAxioms := standard,
     nativeAxioms := nestedAuxiliaryConstructorNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.leanFlatNodeConstructorTypeValidationTrace,
+      ``Ix.Kernel.NestedRecursiveFixture.leanFlatNodeConstructorTypeValidationTrace,
     standardAxioms := standard,
     nativeAxioms := nestedNodeConstructorValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.leanFlatNodeConstructorValidationRun,
+      ``Ix.Kernel.NestedRecursiveFixture.leanFlatNodeConstructorValidationRun,
     standardAxioms := standard,
     nativeAxioms := nestedNodeConstructorValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.leanFlatWrapConstructorTypeValidationTrace,
+      ``Ix.Kernel.NestedRecursiveFixture.leanFlatWrapConstructorTypeValidationTrace,
     standardAxioms := standard,
     nativeAxioms := nestedWrapConstructorValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.leanFlatWrapConstructorValidationRun,
+      ``Ix.Kernel.NestedRecursiveFixture.leanFlatWrapConstructorValidationRun,
     standardAxioms := standard,
     nativeAxioms := nestedWrapConstructorValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
 
   -- Completed nested semantic transaction.  The generic adapter consumes a
-  -- pinned Lean4Lean `NestedBlockCertificate`; the concrete roots then prove
+  -- local named-specification `NestedBlockCertificate`; the concrete roots then prove
   -- restored source/recursor/rule well-formedness, run Ix's real nested
   -- family checker, and admit the exact two-member source block atomically.
   -- No auxiliary flattening name, legacy inductive oracle, or pending axiom
   -- may enter this completed boundary.
-  { root := ``Ix.Tc.NestedFamilyCatalogLink.translateMember,
+  { root := ``Ix.Kernel.NestedFamilyCatalogLink.translateMember,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedFamilyCatalogLink.semanticEntry,
+  { root := ``Ix.Kernel.NestedFamilyCatalogLink.semanticEntry,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedFamilyCatalogLink.transition,
+  { root := ``Ix.Kernel.NestedFamilyCatalogLink.transition,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.semanticTreeCertificate,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.semanticTreeCertificate,
     standardAxioms := standard,
     nativeAxioms := nestedSemanticCertificateNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.semanticTreeTransactionFacts,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.semanticTreeTransactionFacts,
     standardAxioms := standard,
     nativeAxioms := nestedSemanticFactsNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedFamilyKernelRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedFamilyKernelRun,
     standardAxioms := standard,
     nativeAxioms := nestedFamilyKernelNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedFamilyBlockCertificate,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedFamilyBlockCertificate,
     standardAxioms := standard,
     nativeAxioms := nestedFamilyCertificateNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedFamilyAtomicAdmission,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedFamilyAtomicAdmission,
     standardAxioms := standard,
     nativeAxioms := nestedFamilyCertificateNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedSemanticTransactionClosure,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedSemanticTransactionClosure,
     standardAxioms := standard,
     nativeAxioms := nestedSemanticTransactionClosureNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
@@ -4162,40 +4148,40 @@ private def roots : Array RootAllowance := #[
   -- ingress roots pin the actual generated block; the two pattern roots pin
   -- the restored node/wrap equations independently; the final roots require
   -- all-or-nothing family-plus-recursor admission.  The only `sorryAx`
-  -- origins are two exact inversion lemmas inherited from Lean4Lean.
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedCompilerRun,
+  -- origins are two exact inversion lemmas inherited from Ix.Theory.Named.
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedCompilerRun,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorCompilerRunNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedCompiledIdentityFacts,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedCompiledIdentityFacts,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorCompilerIdentityNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.recursorIngressRun,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.recursorIngressRun,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorIngressNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
   { root :=
-      ``Ix.Tc.NestedRecursiveFixture.nestedRecursorRepresentationFacts,
+      ``Ix.Kernel.NestedRecursiveFixture.nestedRecursorRepresentationFacts,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorRepresentationNative,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.treeNodePatternRel,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.treeNodePatternRel,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorNodePatternNative,
     sorryOrigins := nestedRestoredPatternUpstreamDebt,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.treeWrapPatternRel,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.treeWrapPatternRel,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorWrapPatternNative,
     sorryOrigins := nestedRestoredPatternUpstreamDebt,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedRecursorAtomicAdmission,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedRecursorAtomicAdmission,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorAtomicAdmissionNative,
     sorryOrigins := nestedRestoredPatternUpstreamDebt,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.NestedRecursiveFixture.nestedRecursorAtomicClosure,
+  { root := ``Ix.Kernel.NestedRecursiveFixture.nestedRecursorAtomicClosure,
     standardAxioms := standard,
     nativeAxioms := nestedRecursorAtomicClosureNative,
     sorryOrigins := nestedRestoredPatternUpstreamDebt,
@@ -4206,77 +4192,77 @@ private def roots : Array RootAllowance := #[
   -- under both best-effort and complete rule population.  The final root
   -- covers the actual anonymous-mode cache insertion phase; none of these
   -- roots may recover the legacy inductive oracle.
-  { root := ``Ix.Tc.GeneratedRecursorMetadata.at_of_expectedFlat,
+  { root := ``Ix.Kernel.GeneratedRecursorMetadata.at_of_expectedFlat,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.initialGeneratedRecursor_metadata,
+  { root := ``Ix.Kernel.initialGeneratedRecursor_metadata,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursor.metadata_setRules,
+  { root := ``Ix.Kernel.GeneratedRecursor.metadata_setRules,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursor.metadata_withRules,
+  { root := ``Ix.Kernel.GeneratedRecursor.metadata_withRules,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursor.ty_withRules,
+  { root := ``Ix.Kernel.GeneratedRecursor.ty_withRules,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursor.map_metadata_modify_withRules,
+  { root := ``Ix.Kernel.GeneratedRecursor.map_metadata_modify_withRules,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursor.map_metadata_zipWithRules,
+  { root := ``Ix.Kernel.GeneratedRecursor.map_metadata_zipWithRules,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursor.map_ty_zipWithRules,
+  { root := ``Ix.Kernel.GeneratedRecursor.map_ty_zipWithRules,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.commitGeneratedRecursorRulesAt_artifacts,
+      ``Ix.Kernel.RecM.commitGeneratedRecursorRulesAt_artifacts,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.populateOptionalGeneratedRecursorRules_metadata,
+      ``Ix.Kernel.RecM.populateOptionalGeneratedRecursorRules_metadata,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecM.populateCompleteGeneratedRecursorRules_metadata,
+      ``Ix.Kernel.RecM.populateCompleteGeneratedRecursorRules_metadata,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.populateRecursorRulesFromBlock_artifacts,
+  { root := ``Ix.Kernel.RecM.populateRecursorRulesFromBlock_artifacts,
     standardAxioms := standard,
     nativeAxioms := inductiveNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.populateRecursorRulesFromBlock_metadata,
+  { root := ``Ix.Kernel.RecM.populateRecursorRulesFromBlock_metadata,
     standardAxioms := standard,
     nativeAxioms := inductiveNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorSemantics.CanonicalRulesS.generatedRuleAt,
+      ``Ix.Kernel.GeneratedRecursorSemantics.CanonicalRulesS.generatedRuleAt,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorSemantics.CanonicalArtifactsS.withRules,
+      ``Ix.Kernel.GeneratedRecursorSemantics.CanonicalArtifactsS.withRules,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorSemantics.CanonicalTypeS.canonical,
+      ``Ix.Kernel.GeneratedRecursorSemantics.CanonicalTypeS.canonical,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorSemantics.CanonicalRulesS.canonical,
+      ``Ix.Kernel.GeneratedRecursorSemantics.CanonicalRulesS.canonical,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorSemantics.CanonicalArtifactsS.canonical,
+      ``Ix.Kernel.GeneratedRecursorSemantics.CanonicalArtifactsS.canonical,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorSemantics.RecM.commitGeneratedRecursorRulesAt_canonicalAt,
+      ``Ix.Kernel.GeneratedRecursorSemantics.RecM.commitGeneratedRecursorRulesAt_canonicalAt,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.buildGeneratedRecursorTypes_metadata,
+  { root := ``Ix.Kernel.RecM.buildGeneratedRecursorTypes_metadata,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.buildAndCacheGeneratedRecursors_metadata,
+  { root := ``Ix.Kernel.RecM.buildAndCacheGeneratedRecursors_metadata,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -4284,71 +4270,71 @@ private def roots : Array RootAllowance := #[
   -- E2c generated-recursor type closure. Production closes the accumulated
   -- domains through explicit right-to-left intern requests. These roots prove
   -- exact finite-support execution, operation-shaped structural translation,
-  -- and equality with Lean4Lean's public canonical mixed recursor type.
-  { root := ``Ix.Tc.CertifiedGenerationTransaction.generationEnv,
+  -- and equality with Ix.Theory.Named's public canonical mixed recursor type.
+  { root := ``Ix.Kernel.CertifiedGenerationTransaction.generationEnv,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.opened_toCtx,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.opened_toCtx,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.isType_forallN_inv,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.isType_forallN_inv,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.onTel_isType_getElem,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.onTel_isType_getElem,
     standardAxioms := propextOnly,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorTypeClosure.canonical_onTel_and_bodyType,
+      ``Ix.Kernel.GeneratedRecursorTypeClosure.canonical_onTel_and_bodyType,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.canonical_domainType,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.canonical_domainType,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.canonical_bodyType,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.canonical_bodyType,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorTypeClosure.TelescopeS.of_canonical,
+      ``Ix.Kernel.GeneratedRecursorTypeClosure.TelescopeS.of_canonical,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorTypeClosure.closeV_eq_forallN_take,
+      ``Ix.Kernel.GeneratedRecursorTypeClosure.closeV_eq_forallN_take,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.closeV_canonical,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.closeV_canonical,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.TelescopeS.close,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.TelescopeS.close,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.run_exact,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.run_exact,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.run_translation,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.run_translation,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.run_canonicalType,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.run_canonicalType,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.GeneratedRecursorTypeClosure.buildRecType_decompose,
+  { root := ``Ix.Kernel.GeneratedRecursorTypeClosure.buildRecType_decompose,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.GeneratedRecursorTypeClosure.buildRecType_canonical_of_body,
+      ``Ix.Kernel.GeneratedRecursorTypeClosure.buildRecType_canonical_of_body,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.familyBuildTypeExecution,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.familyBuildTypeExecution,
     standardAxioms := standard,
     nativeAxioms := generatedRecursorTypeFixtureNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.familyBuildArtifactsExecution,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.familyBuildArtifactsExecution,
     standardAxioms := standard,
     nativeAxioms := generatedRecursorRuleFixtureNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -4358,31 +4344,31 @@ private def roots : Array RootAllowance := #[
   -- finite fold; one K2S successor layer preserves the scoped state across
   -- selection and gives semantic meaning to the repeated type and positional
   -- rule comparisons.
-  { root := ``Ix.Tc.RecM.checkGeneratedRecursorFromCache_success,
+  { root := ``Ix.Kernel.RecM.checkGeneratedRecursorFromCache_success,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkGeneratedRecursorFromCache_canonical,
+  { root := ``Ix.Kernel.RecM.checkGeneratedRecursorFromCache_canonical,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkGeneratedRecursorFromCache_canonicalScoped,
+  { root := ``Ix.Kernel.RecM.checkGeneratedRecursorFromCache_canonicalScoped,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.selectGeneratedRecursorIndex_preservesScoped,
+  { root := ``Ix.Kernel.RecM.selectGeneratedRecursorIndex_preservesScoped,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.familyRuleCommitExecution,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.familyRuleCommitExecution,
     standardAxioms := standard,
     nativeAxioms := generatedRecursorCommitFixtureNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.familyCacheCheckExecution,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.familyCacheCheckExecution,
     standardAxioms := standard,
     nativeAxioms := generatedRecursorCheckerFixtureNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.familyCacheCheckCanonicalScoped,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.familyCacheCheckCanonicalScoped,
     standardAxioms := standard,
     nativeAxioms := generatedRecursorCanonicalFixtureNative,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
@@ -4395,88 +4381,88 @@ private def roots : Array RootAllowance := #[
   -- audit forbids every oracle constructor/world-materialization operation
   -- rather than the `InductiveOracle` type name itself.
   { root :=
-      ``Ix.Tc.SemanticBlockTransitionCertificate.le_admittedWorld,
+      ``Ix.Kernel.SemanticBlockTransitionCertificate.le_admittedWorld,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.SemanticBlockTransitionCertificate.admit,
+  { root := ``Ix.Kernel.SemanticBlockTransitionCertificate.admit,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.SemanticBlockTransitionCertificate.admitState,
+  { root := ``Ix.Kernel.SemanticBlockTransitionCertificate.admitState,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
   { root :=
-      ``Ix.Tc.ExistingSemanticBlockCertificate.le_admittedWorld,
+      ``Ix.Kernel.ExistingSemanticBlockCertificate.le_admittedWorld,
     standardAxioms := standard,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.ExistingSemanticBlockCertificate.admit,
+  { root := ``Ix.Kernel.ExistingSemanticBlockCertificate.admit,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.ExistingSemanticBlockCertificate.admitState,
+  { root := ``Ix.Kernel.ExistingSemanticBlockCertificate.admitState,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.OneFamilyRecursorCertificate.atomicClosure,
+  { root := ``Ix.Kernel.OneFamilyRecursorCertificate.atomicClosure,
     standardAxioms := standard,
     forbiddenDependencies := existingSemanticBlockForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.familyRecursorAtomicClosure,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.familyRecursorAtomicClosure,
     standardAxioms := standard,
     nativeAxioms := generatedRecursorAtomicClosureNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.producerLinkedOneFamilyClosure,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.producerLinkedOneFamilyClosure,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     nativeAxioms := indexedProducerClosureNative,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
   { root :=
-      ``Ix.Tc.RecursivePiRecursorFixture.recursivePiAtomicClosure,
+      ``Ix.Kernel.RecursivePiRecursorFixture.recursivePiAtomicClosure,
     standardAxioms := standard,
     nativeAxioms := recursivePiAtomicClosureNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
   { root :=
-      ``Ix.Tc.AnnotatedPiRecursorFixture.annotatedPiAtomicClosure,
+      ``Ix.Kernel.AnnotatedPiRecursorFixture.annotatedPiAtomicClosure,
     standardAxioms := standard,
-    upstreamAxioms := annotatedPiUpstreamAxioms,
+    implementationAxioms := annotatedPiUpstreamAxioms,
     nativeAxioms := annotatedPiAtomicClosureNative,
     sorryOrigins := annotatedPiUpstreamDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
   { root :=
-      ``Ix.Tc.AliasFormerRecursorFixture.aliasFormerAtomicClosure,
+      ``Ix.Kernel.AliasFormerRecursorFixture.aliasFormerAtomicClosure,
     standardAxioms := standard,
-    upstreamAxioms := aliasFormerUpstreamAxioms,
+    implementationAxioms := aliasFormerUpstreamAxioms,
     nativeAxioms := aliasFormerAtomicClosureNative,
     sorryOrigins := aliasFormerUpstreamDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
   { root :=
-      ``Ix.Tc.AliasRecRecursorFixture.aliasRecAtomicClosure,
+      ``Ix.Kernel.AliasRecRecursorFixture.aliasRecAtomicClosure,
     standardAxioms := standard,
-    upstreamAxioms := aliasRecUpstreamAxioms,
+    implementationAxioms := aliasRecUpstreamAxioms,
     nativeAxioms := aliasRecAtomicClosureNative,
     sorryOrigins := aliasRecUpstreamDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
 
   -- E2c flat semantic transport.  The refined flat production trace erases
   -- to the exhaustive classifier, and the operation-shaped cross-kernel
-  -- contract recursively constructs Lean4Lean's retained positivity trace.
+  -- contract recursively constructs Ix.Theory.Named's retained positivity trace.
   -- Nested auxiliary expansion remains a separate explicit bridge.
-  { root := ``Ix.Tc.FlatPositivityDomainTrace.toPositivityDomainTrace,
+  { root := ``Ix.Kernel.FlatPositivityDomainTrace.toPositivityDomainTrace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
   { root :=
-      ``Ix.Tc.FlatPositivityTraceTransport.constructorPositivityTrace,
+      ``Ix.Kernel.FlatPositivityTraceTransport.constructorPositivityTrace,
     standardAxioms := standard,
     nativeAxioms := inferNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
 
   -- E2c's concrete cross-kernel trace bridge.  These roots start at the
   -- exact positivity calls selected by the production IndexedVec family
-  -- checker, transport those operations to Lean4Lean, and replay the complete
+  -- checker, transport those operations to Ix.Theory.Named, and replay the complete
   -- retained constructor validator.  The direct recursive fixture has no
   -- nested auxiliary expansion; that remains the next generic E2c bridge.
   { root :=
-      ``Ix.Tc.IndexedRecursiveFixture.indexedVecConsConstructorValidationRun,
+      ``Ix.Kernel.IndexedRecursiveFixture.indexedVecConsConstructorValidationRun,
     standardAxioms := standard,
     nativeAxioms := indexedConstructorValidationNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -4487,23 +4473,23 @@ private def roots : Array RootAllowance := #[
   -- family/recursor checking, exact ownership, and atomic admission.  The
   -- same executable witness rejects a recursor whose stored index arity was
   -- changed while its canonical type and rules were retained.
-  { root := ``Lean4Lean.VEnv.HasType.lamN_appN_beta,
+  { root := ``Ix.Theory.Named.VEnv.HasType.lamN_appN_beta,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursivePattern.nilPatternRel,
+  { root := ``Ix.Kernel.IndexedRecursivePattern.nilPatternRel,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursivePattern.consPatternRel,
+  { root := ``Ix.Kernel.IndexedRecursivePattern.consPatternRel,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursivePattern.oracle,
+  { root := ``Ix.Kernel.IndexedRecursivePattern.oracle,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IndexedRecursiveFixture.endToEndAcceptance,
+  { root := ``Ix.Kernel.IndexedRecursiveFixture.endToEndAcceptance,
     standardAxioms := standard,
     nativeAxioms := indexedRecursiveNative,
     sorryOrigins := typingDebt,
@@ -4512,13 +4498,13 @@ private def roots : Array RootAllowance := #[
   -- Elimination-breadth regression over exact kernel declarations.  These
   -- roots compile, ingress, and run the production family/recursor checkers
   -- for both a source-universe-bearing small eliminator and `Eq`'s positive
-  -- K branch, then relate the stored physical metadata to Lean4Lean's exact
+  -- K branch, then relate the stored physical metadata to Ix.Theory.Named's exact
   -- generation trace.
-  { root := ``Ix.Tc.EliminationBreadthFixture.smallEliminationAcceptance,
+  { root := ``Ix.Kernel.EliminationBreadthFixture.smallEliminationAcceptance,
     standardAxioms := standard,
     nativeAxioms := smallEliminationAcceptanceNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
-  { root := ``Ix.Tc.EliminationBreadthFixture.kTargetAcceptance,
+  { root := ``Ix.Kernel.EliminationBreadthFixture.kTargetAcceptance,
     standardAxioms := standard,
     nativeAxioms := kTargetAcceptanceNative,
     forbiddenDependencies := occurrenceValidationForbiddenDependencies },
@@ -4528,32 +4514,32 @@ private def roots : Array RootAllowance := #[
   -- consumes those oracle constructors: its family block advances the exact
   -- generated Theory environment, and its recursor block consumes entries
   -- already installed there.
-  { root := ``Lean4Lean.VEnv.HasType.transfer_appN_telescope,
+  { root := ``Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.SingletonFamilyCatalogLink.oracle,
+  { root := ``Ix.Kernel.SingletonFamilyCatalogLink.oracle,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.SingletonRecursorCatalogLink.enumerationPatternRel,
+  { root := ``Ix.Kernel.SingletonRecursorCatalogLink.enumerationPatternRel,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.SingletonRecursorCatalogLink.oracle,
+  { root := ``Ix.Kernel.SingletonRecursorCatalogLink.oracle,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.certifySingletonFamilyBlock,
+  { root := ``Ix.Kernel.RecM.certifySingletonFamilyBlock,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.certifySingletonRecursorBlock,
+  { root := ``Ix.Kernel.RecM.certifySingletonRecursorBlock,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
   -- Oracle-free semantic composition is audited independently of production
   -- execution so its native boundary contains only the finite representation,
   -- generation, equation, and pattern checks.
-  { root := ``Ix.Tc.BooleanEnumerationFixture.oneFamilyAtomicClosure,
+  { root := ``Ix.Kernel.BooleanEnumerationFixture.oneFamilyAtomicClosure,
     standardAxioms := standard,
     nativeAxioms := booleanSemanticAdmissionNative,
     sorryOrigins := typingDebt,
@@ -4561,7 +4547,7 @@ private def roots : Array RootAllowance := #[
   -- The headline additionally joins anonymous ingress, both production
   -- block-body and branch checkers, exact physical/catalog ownership, and the
   -- composed two-stage semantic transaction in one final world.
-  { root := ``Ix.Tc.BooleanEnumerationFixture.endToEndAcceptance,
+  { root := ``Ix.Kernel.BooleanEnumerationFixture.endToEndAcceptance,
     standardAxioms := standard, nativeAxioms := booleanEnumerationNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := canonicalRecursorForbiddenDependencies },
@@ -4569,410 +4555,408 @@ private def roots : Array RootAllowance := #[
   -- G2a's explicit ambient-inductive assumption boundary.  Audit every
   -- oracle projection so adding a field changes this manifest, then pin the
   -- constructive Nat model and its adversarial loaded-state witness.
-  { root := ``Ix.Tc.RawInductiveConstRel.mono,
+  { root := ``Ix.Kernel.RawInductiveConstRel.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TrKExprS.mono,
+  { root := ``Ix.Kernel.TrKExprS.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RegisteredRecursorRuleRhsRel.mono,
+  { root := ``Ix.Kernel.RegisteredRecursorRuleRhsRel.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RegisteredRecursorRuleRhsRel.rhsTyped,
+  { root := ``Ix.Kernel.RegisteredRecursorRuleRhsRel.rhsTyped,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RawRecursorRuleRel.registeredRhs,
+  { root := ``Ix.Kernel.RawRecursorRuleRel.registeredRhs,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RawRecursorRuleRel.mono,
+  { root := ``Ix.Kernel.RawRecursorRuleRel.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.HeadConstN.of_varN_matches },
-  { root := ``Ix.Tc.RecursorIotaPattern.matches_shape },
-  { root := ``Ix.Tc.KConst.RecursorRuleAt.hasRecursorRule,
+  { root := ``Ix.Kernel.HeadConstN.of_varN_matches },
+  { root := ``Ix.Kernel.RecursorIotaPattern.matches_shape },
+  { root := ``Ix.Kernel.KConst.RecursorRuleAt.hasRecursorRule,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.RawRecursorRulePatternRel.mono,
+  { root := ``Ix.Kernel.RawRecursorRulePatternRel.mono,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.InductiveOracle.members,
+  { root := ``Ix.Kernel.InductiveOracle.members,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.nonempty,
+  { root := ``Ix.Kernel.InductiveOracle.nonempty,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.fresh,
+  { root := ``Ix.Kernel.InductiveOracle.fresh,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.after,
+  { root := ``Ix.Kernel.InductiveOracle.after,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.envLE,
+  { root := ``Ix.Kernel.InductiveOracle.envLE,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.blockWF,
+  { root := ``Ix.Kernel.InductiveOracle.blockWF,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.translateBlock,
+  { root := ``Ix.Kernel.InductiveOracle.translateBlock,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.recursorFacts,
+  { root := ``Ix.Kernel.InductiveOracle.recursorFacts,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.recursorPatterns,
+  { root := ``Ix.Kernel.InductiveOracle.recursorPatterns,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveOracle.catalogued,
+  { root := ``Ix.Kernel.InductiveOracle.catalogued,
     standardAxioms := standard },
-  { root := ``Ix.Tc.AmbientNat.oracle,
+  { root := ``Ix.Kernel.AmbientNat.oracle,
     standardAxioms := standard },
-  { root := ``Ix.Tc.AmbientNat.nat_lookup_good,
+  { root := ``Ix.Kernel.AmbientNat.nat_lookup_good,
     standardAxioms := standard },
-  { root := ``Ix.Tc.AmbientNat.badDecl_not_wf,
+  { root := ``Ix.Kernel.AmbientNat.badDecl_not_wf,
     standardAxioms := standard },
-  { root := ``Ix.Tc.AmbientNat.acceptance,
+  { root := ``Ix.Kernel.AmbientNat.acceptance,
     standardAxioms := standard },
 
   -- G2b's C1--C3 consumer path.  These roots resolve exact concrete
   -- constants through trusted-world provenance and are mechanically barred
   -- from depending on the legacy whole-environment translation.
-  { root := ``Ix.Tc.TrustedConstRel.mono,
+  { root := ``Ix.Kernel.TrustedConstRel.mono,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrustedConstRel.trKExprS_const,
+  { root := ``Ix.Kernel.TrustedConstRel.trKExprS_const,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrustedCatalogRel.resolve,
+  { root := ``Ix.Kernel.TrustedCatalogRel.resolve,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcStateWF.resolve,
+  { root := ``Ix.Kernel.TcStateWF.resolve,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcInv.resolve,
+  { root := ``Ix.Kernel.TcInv.resolve,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.natResolved,
+  { root := ``Ix.Kernel.AmbientNat.natResolved,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.natReferenceTranslates,
+  { root := ``Ix.Kernel.AmbientNat.natReferenceTranslates,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.bad_not_resolved,
+  { root := ``Ix.Kernel.AmbientNat.bad_not_resolved,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.natResolvedInv,
+  { root := ``Ix.Kernel.AmbientNat.natResolvedInv,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
 
   -- G4's lookup isolation, exhaustive semantic-cache provenance, monotone
   -- warm-world transport, and transactional public-check error boundary.
-  { root := ``Ix.Tc.PendingDecl.lookup_isolation,
+  { root := ``Ix.Kernel.PendingDecl.lookup_isolation,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheEntry.SupportedBy.mono },
-  { root := ``Ix.Tc.CacheAuthority.stable_mono,
+  { root := ``Ix.Kernel.CacheEntry.SupportedBy.mono },
+  { root := ``Ix.Kernel.CacheAuthority.stable_mono,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.CacheProvenance.mono,
+  { root := ``Ix.Kernel.CacheProvenance.mono,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.CacheProvenance.pending_isolation_stable,
+  { root := ``Ix.Kernel.CacheProvenance.pending_isolation_stable,
     standardAxioms := standard },
-  { root := ``Ix.Tc.KEnv.restoreBlockCheckResultsOnError_origin,
+  { root := ``Ix.Kernel.KEnv.restoreBlockCheckResultsOnError_origin,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.mono,
+  { root := ``Ix.Kernel.CacheInvariant.mono,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.CacheInvariant.insertWhnf,
+  { root := ``Ix.Kernel.CacheInvariant.insertWhnf,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.insertWhnfNoDelta,
+  { root := ``Ix.Kernel.CacheInvariant.insertWhnfNoDelta,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.insertWhnfNoDeltaCheap,
+  { root := ``Ix.Kernel.CacheInvariant.insertWhnfNoDeltaCheap,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.insertWhnfCore,
+  { root := ``Ix.Kernel.CacheInvariant.insertWhnfCore,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.insertWhnfCoreCheap,
+  { root := ``Ix.Kernel.CacheInvariant.insertWhnfCoreCheap,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.of_intern_update,
+  { root := ``Ix.Kernel.CacheInvariant.of_intern_update,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.CacheInvariant.clearReductionCaches,
+  { root := ``Ix.Kernel.CacheInvariant.clearReductionCaches,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.restoreCheckCachesOnError,
+  { root := ``Ix.Kernel.CacheInvariant.restoreCheckCachesOnError,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcM.isolateCheckErrors_error,
+  { root := ``Ix.Kernel.TcM.isolateCheckErrors_error,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.reset_cache_frame,
-    standardAxioms := standard,
-    nativeAxioms := #[nativeAxiom `Blake3
-      `Blake3.HasherOps.hash._native.native_decide.ax_1] },
-  { root := ``Ix.Tc.KernelStateWF.pendingCacheIsolation,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.KernelStateWF.restoreCheckCachesOnError,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.AmbientNat.warmCache_worldTransport,
+  { root := ``Ix.Kernel.TcM.reset_cache_frame,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.KernelStateWF.pendingCacheIsolation,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.KernelStateWF.restoreCheckCachesOnError,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.AmbientNat.warmCache_worldTransport,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.warmCache_cannotResolvePending,
+  { root := ``Ix.Kernel.AmbientNat.warmCache_cannotResolvePending,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.cacheAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.cacheAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- K1's concrete Theory reduction meaning, exact five-way cache overlay,
   -- and real ambient-Nat warm-hit witness.  The only sorries are the already
   -- named upstream inductive-environment boundary.
-  { root := ``Ix.Tc.WhnfMeaning.refl,
+  { root := ``Ix.Kernel.WhnfMeaning.refl,
     standardAxioms := standard },
-  { root := ``Ix.Tc.WhnfMeaning.symm,
+  { root := ``Ix.Kernel.WhnfMeaning.symm,
     standardAxioms := standard },
-  { root := ``Ix.Tc.WhnfMeaning.mono,
+  { root := ``Ix.Kernel.WhnfMeaning.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.ExprCacheKind.isWhnf_iff },
-  { root := ``Ix.Tc.WhnfCacheValid.mono,
+  { root := ``Ix.Kernel.ExprCacheKind.isWhnf_iff },
+  { root := ``Ix.Kernel.WhnfCacheValid.mono,
     standardAxioms := standard },
-  { root := ``Ix.Tc.WhnfCacheValid.expr,
+  { root := ``Ix.Kernel.WhnfCacheValid.expr,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheProvenance.isRec_of_trusted,
+  { root := ``Ix.Kernel.CacheProvenance.isRec_of_trusted,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.IsRecCacheValid.mono,
+  { root := ``Ix.Kernel.IsRecCacheValid.mono,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.IsRecCacheValid.trusted,
+  { root := ``Ix.Kernel.IsRecCacheValid.trusted,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.kernelCacheSemantics_isRec_valid,
+  { root := ``Ix.Kernel.kernelCacheSemantics_isRec_valid,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheProvenance.whnfMeaning,
+  { root := ``Ix.Kernel.CacheProvenance.whnfMeaning,
     standardAxioms := standard },
-  { root := ``Ix.Tc.CacheInvariant.whnfHit,
+  { root := ``Ix.Kernel.CacheInvariant.whnfHit,
     standardAxioms := standard },
-  { root := ``Ix.Tc.AmbientNat.supportExpr_whnfMeaning,
+  { root := ``Ix.Kernel.AmbientNat.supportExpr_whnfMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.warmHit_whnfMeaning,
+  { root := ``Ix.Kernel.AmbientNat.warmHit_whnfMeaning,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNative_noAccel,
+  { root := ``Ix.Kernel.RecM.tryReduceNative_noAccel,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RecM.tryReduceBitvec_noAccel,
+  { root := ``Ix.Kernel.RecM.tryReduceBitvec_noAccel,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryReduceDecidable_noAccel,
+  { root := ``Ix.Kernel.RecM.tryReduceDecidable_noAccel,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RecM.tryReduceFinValDecidableRec_noAccel,
+  { root := ``Ix.Kernel.RecM.tryReduceFinValDecidableRec_noAccel,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WhnfTheory.exprWF,
+  { root := ``Ix.Kernel.WhnfTheory.exprWF,
     standardAxioms := standard },
-  { root := ``Ix.Tc.WhnfTheory.transMeaning,
+  { root := ``Ix.Kernel.WhnfTheory.transMeaning,
     standardAxioms := standard,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RawProjRel.none_ok,
+  { root := ``Ix.Kernel.RawProjRel.none_ok,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.RawProjRel.lean4Lean_ok,
+  { root := ``Ix.Kernel.RawProjRel.named_ok,
     standardAxioms := standard,
     sorryOrigins := projectionDebt },
-  { root := ``Ix.Tc.ConcreteProjectionFixture.acceptance,
+  { root := ``Ix.Kernel.ConcreteProjectionFixture.acceptance,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     sorryOrigins := projectionDebt },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_zero,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_zero,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.TcM.whnfKey_closed,
+  { root := ``Ix.Kernel.TcM.whnfKey_closed,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.ContextKeyFrame.whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_wf,
+  { root := ``Ix.Kernel.ContextKeyFrame.whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_wf,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.TcM.whnfKey_wf,
+  { root := ``Ix.Kernel.TcM.whnfKey_wf,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.TcM.whnfKey_matches_wf,
+  { root := ``Ix.Kernel.TcM.whnfKey_matches_wf,
     standardAxioms := standard, nativeAxioms := contextNative },
   -- interning frame: exact intern-only framing, execution-indexed simultaneous
   -- substitution, and the production one-argument beta path.
-  { root := ``Ix.Tc.InternUpdateFrame.whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.runIntern_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.runIntern_whnf_eval,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RunAssumptions.simulSubst_whnf_wf,
+  { root := ``Ix.Kernel.InternUpdateFrame.whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.runIntern_whnf_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.runIntern_whnf_eval,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RunAssumptions.simulSubst_whnf_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.simulSubst_whnf_eval,
+  { root := ``Ix.Kernel.RunAssumptions.simulSubst_whnf_eval,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.WhnfMeaning.beta,
+  { root := ``Ix.Kernel.WhnfMeaning.beta,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WhnfMeaning.letE,
+  { root := ``Ix.Kernel.WhnfMeaning.letE,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WhnfMeaning.betaSimul,
+  { root := ``Ix.Kernel.WhnfMeaning.betaSimul,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreLeaf.eval,
+  { root := ``Ix.Kernel.RecM.WhnfCoreLeaf.eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_betaOne,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_betaOne,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_leaf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_leaf,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_betaOne,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_betaOne,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_betaOne_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_betaOne_wf,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_leaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_leaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.warmStateInvAccelerated,
+  { root := ``Ix.Kernel.AmbientNat.warmStateInvAccelerated,
     standardAxioms := standard,
     nativeAxioms := inferNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.warmKey_matches_wf,
+  { root := ``Ix.Kernel.AmbientNat.warmKey_matches_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.whnfCoreConst_noAccel_acceptance,
+  { root := ``Ix.Kernel.AmbientNat.whnfCoreConst_noAccel_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaIdentityMeaning,
+  { root := ``Ix.Kernel.AmbientNat.betaIdentityMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaSimulSpec,
+  { root := ``Ix.Kernel.AmbientNat.betaSimulSpec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.betaSimulMeaning,
+  { root := ``Ix.Kernel.AmbientNat.betaSimulMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaWalker_eval,
+  { root := ``Ix.Kernel.AmbientNat.betaWalker_eval,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.betaResultMeaning,
+  { root := ``Ix.Kernel.AmbientNat.betaResultMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaCoreUncached_eval,
+  { root := ``Ix.Kernel.AmbientNat.betaCoreUncached_eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.betaCoreUncached_acceptance,
+  { root := ``Ix.Kernel.AmbientNat.betaCoreUncached_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- zeta reduction: both production zeta branches, including the legacy lifting walk,
   -- mixed-context semantic lookup, bounded driver, and inhabited fixtures.
-  { root := ``Ix.Tc.CtxRecon.lctxFindLetVal,
+  { root := ``Ix.Kernel.CtxRecon.lctxFindLetVal,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TcM.lookupLetVal_eval,
+  { root := ``Ix.Kernel.TcM.lookupLetVal_eval,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RunAssumptions.lift_whnf_wf,
+  { root := ``Ix.Kernel.RunAssumptions.lift_whnf_wf,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RunAssumptions.lift_whnf_eval,
+  { root := ``Ix.Kernel.RunAssumptions.lift_whnf_eval,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.WhnfMeaning.zetaVar,
+  { root := ``Ix.Kernel.WhnfMeaning.zetaVar,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.WhnfMeaning.zetaFVar,
+  { root := ``Ix.Kernel.WhnfMeaning.zetaFVar,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_varZeta,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_varZeta,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_fvarZeta,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_fvarZeta,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_nextLeaf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_nextLeaf,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_varZeta,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_varZeta,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_fvarZeta,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_fvarZeta,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_varZeta_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_varZeta_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_fvarZeta_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_fvarZeta_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.bvarZetaLiftSpec,
+  { root := ``Ix.Kernel.AmbientNat.bvarZetaLiftSpec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.bvarZetaLookupEval,
+  { root := ``Ix.Kernel.AmbientNat.bvarZetaLookupEval,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.bvarZetaMeaning,
+  { root := ``Ix.Kernel.AmbientNat.bvarZetaMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.bvarZetaCoreUncachedEval,
+  { root := ``Ix.Kernel.AmbientNat.bvarZetaCoreUncachedEval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.bvarZetaAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.bvarZetaAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fvarZetaMeaning,
+  { root := ``Ix.Kernel.AmbientNat.fvarZetaMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fvarZetaCoreUncachedEval,
+  { root := ``Ix.Kernel.AmbientNat.fvarZetaCoreUncachedEval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.fvarZetaAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fvarZetaAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- projection/iota branch: exact projection/iota branches and bounded-driver composition.
   -- Semantic success is conditional on an explicit translated-source oracle;
   -- the two hostile fixtures prove that raw helper success cannot replace it.
-  { root := ``Ix.Tc.WhnfMeaning.projection,
+  { root := ``Ix.Kernel.WhnfMeaning.projection,
     standardAxioms := standard },
-  { root := ``Ix.Tc.WhnfMeaning.registeredDefEq,
+  { root := ``Ix.Kernel.WhnfMeaning.registeredDefEq,
     standardAxioms := standard },
-  { root := ``Ix.Tc.InductiveReductionOracle.projection,
-    standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.InductiveReductionOracle.iota,
+  { root := ``Ix.Kernel.InductiveReductionOracle.projection,
+    standardAxioms := standard, nativeAxioms := levelNative },
+  { root := ``Ix.Kernel.InductiveReductionOracle.iota,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projection,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projection,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_iota,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_iota,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_projection,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_projection,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_iota,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_iota,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_projection_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_projection_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsUncached_iota_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsUncached_iota_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.projectionReduceEval,
+  { root := ``Ix.Kernel.AmbientNat.projectionReduceEval,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.projectionCoreEval,
+  { root := ``Ix.Kernel.AmbientNat.projectionCoreEval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.projectionSource_not_translated,
+  { root := ``Ix.Kernel.AmbientNat.projectionSource_not_translated,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.projectionAdversarialWitness,
+  { root := ``Ix.Kernel.AmbientNat.projectionAdversarialWitness,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStateInv,
+  { root := ``Ix.Kernel.AmbientNat.iotaStateInv,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaTryEval,
+  { root := ``Ix.Kernel.AmbientNat.iotaTryEval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaCoreEval,
+  { root := ``Ix.Kernel.AmbientNat.iotaCoreEval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaSource_not_translated,
+  { root := ``Ix.Kernel.AmbientNat.iotaSource_not_translated,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaAdversarialWitness,
+  { root := ``Ix.Kernel.AmbientNat.iotaAdversarialWitness,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- structural trace: arbitrary-length structural traces compose exact production
   -- execution, fixed-world/context invariants, and local Theory meanings.
   -- The inhabited fixture takes two `.next` steps before its leaf; the
   -- hostile zero-fuel witness cannot be certified as a successful trace.
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.no_zero,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.no_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.eval,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.initialInv,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.initialInv,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.finalInv,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.finalInv,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.meaning,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.meaning,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.uncached_eval,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.uncached_eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.uncached_acceptance,
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.uncached_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.AmbientNat.structuralNatLit_type,
+  { root := ``Ix.Kernel.AmbientNat.structuralNatLit_type,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralWhnfTheory,
+  { root := ``Ix.Kernel.AmbientNat.structuralWhnfTheory,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopStateInv,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopStateInv,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopSourceMeaning,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopSourceMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopBetaMeaning,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopBetaMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopFVarStep,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopFVarStep,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopBetaStep,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopBetaStep,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopTrace,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopTrace,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralLoopZeroFuel,
+  { root := ``Ix.Kernel.AmbientNat.structuralLoopZeroFuel,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- structural cache: the public structural entry point's keyed body has exact full,
@@ -4980,92 +4964,92 @@ private def roots : Array RootAllowance := #[
   -- execution-indexed trace and universal provenance before insertion;
   -- hits require the physical entry, semantic invariant, and executed key
   -- match.  The Nat fixture runs cold-to-warm in both isolated partitions.
-  { root := ``Ix.Tc.RecM.WhnfCoreNonLeaf.enter,
+  { root := ``Ix.Kernel.RecM.WhnfCoreNonLeaf.enter,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_varNotLet,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_varNotLet,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_varEnter,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_varEnter,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreKeyedEntry.eval,
+  { root := ``Ix.Kernel.RecM.WhnfCoreKeyedEntry.eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsNonLeaf_fullHit,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsNonLeaf_fullHit,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsNonLeaf_cheapHit,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsNonLeaf_cheapHit,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsNonLeaf_fullMiss,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsNonLeaf_fullMiss,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsNonLeaf_cheapMiss,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsNonLeaf_cheapMiss,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsNonLeaf_transient,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsNonLeaf_transient,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreCacheUpdate.full_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WhnfCoreCacheUpdate.cheap_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_fullHit_acceptance,
+  { root := ``Ix.Kernel.RecM.WhnfCoreCacheUpdate.full_whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WhnfCoreCacheUpdate.cheap_whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_fullHit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_cheapHit_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_cheapHit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_fullMiss_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_fullMiss_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_cheapMiss_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_cheapMiss_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_transient_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_transient_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.AmbientNat.betaArgMeaning,
+  { root := ``Ix.Kernel.AmbientNat.betaArgMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullCoreProvenance,
+  { root := ``Ix.Kernel.AmbientNat.fullCoreProvenance,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.cheapCoreProvenance,
+  { root := ``Ix.Kernel.AmbientNat.cheapCoreProvenance,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.coreCacheFreshStateInv,
+  { root := ``Ix.Kernel.AmbientNat.coreCacheFreshStateInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullCoreWarmStateInv,
+  { root := ``Ix.Kernel.AmbientNat.fullCoreWarmStateInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.bothCoreWarmStateInv,
+  { root := ``Ix.Kernel.AmbientNat.bothCoreWarmStateInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.coreCacheKey_eval,
+  { root := ``Ix.Kernel.AmbientNat.coreCacheKey_eval,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.coreCacheKey_matches,
+  { root := ``Ix.Kernel.AmbientNat.coreCacheKey_matches,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaTransientFalse,
+  { root := ``Ix.Kernel.AmbientNat.betaTransientFalse,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaWalker_eval_state,
+  { root := ``Ix.Kernel.AmbientNat.betaWalker_eval_state,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaStep_state,
+  { root := ``Ix.Kernel.AmbientNat.betaStep_state,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.coreCacheTrace,
+  { root := ``Ix.Kernel.AmbientNat.coreCacheTrace,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullCoreColdAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fullCoreColdAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullCoreWarmAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fullCoreWarmAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.cheapCorePolicyMissAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.cheapCorePolicyMissAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.cheapCoreWarmAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.cheapCoreWarmAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.coreCachePolicyIsolation,
+  { root := ``Ix.Kernel.AmbientNat.coreCachePolicyIsolation,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   -- outer WHNF driver: no-delta and full-WHNF now have execution-indexed bounded traces,
@@ -5073,174 +5057,174 @@ private def roots : Array RootAllowance := #[
   -- and semantic hit/miss acceptance.  The Nat fixture executes all nested
   -- cache layers, proves the cold call consumes exactly one fuel unit, and
   -- proves the warm public call preserves the entire state.
-  { root := ``Ix.Tc.WhnfStateInv.of_semantic_fields_eq,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.stepTrace_disabled,
+  { root := ``Ix.Kernel.WhnfStateInv.of_semantic_fields_eq,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.stepTrace_disabled,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.bumpStats_disabled,
+  { root := ``Ix.Kernel.TcM.bumpStats_disabled,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.tick_success,
+  { root := ``Ix.Kernel.TcM.tick_success,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.no_zero,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.no_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.eval,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.initialInv,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.initialInv,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.finalInv,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.finalInv,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.meaning,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.meaning,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.uncached_eval,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.uncached_eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.uncached_acceptance,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.uncached_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.no_zero,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.no_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.eval,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.initialInv,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.initialInv,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.finalInv,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.finalInv,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.meaning,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.meaning,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.uncached_eval,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.uncached_eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.uncached_acceptance,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.uncached_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfDriverNonLeaf.noDelta_enter,
+  { root := ``Ix.Kernel.RecM.WhnfDriverNonLeaf.noDelta_enter,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfDriverNonLeaf.full_enter,
+  { root := ``Ix.Kernel.RecM.WhnfDriverNonLeaf.full_enter,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfDriverEntry.noDelta_eval,
+  { root := ``Ix.Kernel.RecM.WhnfDriverEntry.noDelta_eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfDriverEntry.full_eval,
+  { root := ``Ix.Kernel.RecM.WhnfDriverEntry.full_eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModePrefix_disabled,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModePrefix_disabled,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeMissCharge_disabled,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeMissCharge_disabled,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_fullHit,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_fullHit,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_cheapHit,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_cheapHit,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_fullMiss,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_fullMiss,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_cheapMiss,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_cheapMiss,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_stuck,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_stuck,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_transient,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_transient,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_nativeNoInsert,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_nativeNoInsert,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfDriverCacheUpdate.noDelta_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WhnfDriverCacheUpdate.noDeltaCheap_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WhnfDriverCacheUpdate.full_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_fullHit_acceptance,
+  { root := ``Ix.Kernel.RecM.WhnfDriverCacheUpdate.noDelta_whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WhnfDriverCacheUpdate.noDeltaCheap_whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WhnfDriverCacheUpdate.full_whnfStateInv,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_fullHit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_cheapHit_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_cheapHit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_fullMiss_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_fullMiss_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_cheapMiss_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_cheapMiss_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_stuck_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_stuck_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_transient_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_transient_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeNonLeaf_hit,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeNonLeaf_hit,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeNonLeaf_miss,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeNonLeaf_miss,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeNonLeaf_stuck,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeNonLeaf_stuck,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeNonLeaf_transient,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeNonLeaf_transient,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeNonLeaf_nativeNoInsert,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeNonLeaf_nativeNoInsert,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_hit_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_hit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_miss_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_miss_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_stuck_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_stuck_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_transient_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_transient_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnf_public_eq_whnfWithNatSuccMode,
+  { root := ``Ix.Kernel.RecM.whnf_public_eq_whnfWithNatSuccMode,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.betaNoDeltaStep,
+  { root := ``Ix.Kernel.AmbientNat.betaNoDeltaStep,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullNoDeltaProvenance,
+  { root := ``Ix.Kernel.AmbientNat.fullNoDeltaProvenance,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfProvenance,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfProvenance,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullNoDeltaWarmStateInv,
+  { root := ``Ix.Kernel.AmbientNat.fullNoDeltaWarmStateInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaTrace,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaTrace,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullNoDeltaColdAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fullNoDeltaColdAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullNoDeltaWarmAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fullNoDeltaWarmAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaCachePolicyIsolation,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaCachePolicyIsolation,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfChargedStateInv,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfChargedStateInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfPrefixCold,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfPrefixCold,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfMissCharge,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfMissCharge,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfCharged_noDeltaHit,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfCharged_noDeltaHit,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaFullWhnfStep,
+  { root := ``Ix.Kernel.AmbientNat.betaFullWhnfStep,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfTrace,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfTrace,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfWarmStateInv,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfWarmStateInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfColdAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfColdAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfWarmAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfWarmAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfFuelDiscipline,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfFuelDiscipline,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfCacheLayering,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfCacheLayering,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   -- total-outcome boundary: local step contracts now construct success traces and classify
@@ -5248,362 +5232,362 @@ private def roots : Array RootAllowance := #[
   -- dispatchers close conditionally over suffix reconciliation, transient
   -- lookup safety, collision-robust insertion provenance, and the local
   -- semantic step contracts.  Instrumentation and miss charging are proved.
-  { root := ``Ix.Tc.WhnfPost.transMeaning,
+  { root := ``Ix.Kernel.WhnfPost.transMeaning,
     standardAxioms := standard, sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.WhnfPost.meaning,
+  { root := ``Ix.Kernel.WhnfPost.meaning,
     standardAxioms := standard },
-  { root := ``Ix.Tc.TcM.isLetVar_wf,
+  { root := ``Ix.Kernel.TcM.isLetVar_wf,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.stepTrace_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.bumpStats_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WF.liftTcM,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WF.get,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WF.modifyGet,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WF.modify,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.complete,
-    standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfCoreTrace.uncached_wf,
+  { root := ``Ix.Kernel.TcM.stepTrace_whnf_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.bumpStats_whnf_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WF.liftTcM,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WF.get,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WF.modifyGet,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WF.modify,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.complete,
+    standardAxioms := standard, nativeAxioms := inferNative },
+  { root := ``Ix.Kernel.RecM.WhnfCoreTrace.uncached_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.complete,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.complete,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfNoDeltaTrace.uncached_wf,
+  { root := ``Ix.Kernel.RecM.WhnfNoDeltaTrace.uncached_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.complete,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.complete,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.WhnfFullTrace.uncached_wf,
+  { root := ``Ix.Kernel.RecM.WhnfFullTrace.uncached_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplNonLeaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplNonLeaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_nonLeaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_nonLeaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeNonLeaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeNonLeaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_nonLeaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_nonLeaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModePrefix_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccModeMissCharge_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_nonLeaf_semantic_wf,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModePrefix_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccModeMissCharge_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_nonLeaf_semantic_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfWithNatSuccMode_wf,
+  { root := ``Ix.Kernel.RecM.whnfWithNatSuccMode_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDelta_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnf_wf,
+  { root := ``Ix.Kernel.RecM.whnf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaZeroFuel,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaZeroFuel,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fullWhnfZeroFuel,
+  { root := ``Ix.Kernel.AmbientNat.fullWhnfZeroFuel,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.whnfLoopErrorSeparation,
+  { root := ``Ix.Kernel.AmbientNat.whnfLoopErrorSeparation,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfPost.refl,
+  { root := ``Ix.Kernel.WhnfPost.refl,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WF.bind,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.WF.bind,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.runBounded_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.RecM.WhnfLeaf.eval,
+  { root := ``Ix.Kernel.RecM.runBounded_wf,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.RecM.WhnfLeaf.eval,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnf_leaf_wf,
+  { root := ``Ix.Kernel.RecM.whnf_leaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnf_leaf_wf_of_theory,
+  { root := ``Ix.Kernel.RecM.whnf_leaf_wf_of_theory,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.AmbientNat.noAccelStateInv,
+  { root := ``Ix.Kernel.AmbientNat.noAccelStateInv,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.whnfLeaf_noAccel_wf,
+  { root := ``Ix.Kernel.AmbientNat.whnfLeaf_noAccel_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.whnfLeaf_noAccel_acceptance,
+  { root := ``Ix.Kernel.AmbientNat.whnfLeaf_noAccel_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.whnfKey_fst,
+  { root := ``Ix.Kernel.TcM.whnfKey_fst,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.WhnfContextKeys.Matches.sourceAddr,
+  { root := ``Ix.Kernel.WhnfContextKeys.Matches.sourceAddr,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.CacheProvenance.whnfMeaningOfMatches,
+  { root := ``Ix.Kernel.CacheProvenance.whnfMeaningOfMatches,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.CacheInvariant.whnfHitOfMatches,
+  { root := ``Ix.Kernel.CacheInvariant.whnfHitOfMatches,
     standardAxioms := standard, nativeAxioms := contextNative },
-  { root := ``Ix.Tc.AmbientNat.warmKey_matches,
+  { root := ``Ix.Kernel.AmbientNat.warmKey_matches,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.methodsN_zero,
+  { root := ``Ix.Kernel.methodsN_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsN_succ_whnf,
+  { root := ``Ix.Kernel.methodsN_succ_whnf,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsN_succ_whnfCore,
+  { root := ``Ix.Kernel.methodsN_succ_whnfCore,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsN_succ_whnfMode,
+  { root := ``Ix.Kernel.methodsN_succ_whnfMode,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsN_succ_whnfCoreFlags,
+  { root := ``Ix.Kernel.methodsN_succ_whnfCoreFlags,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsN_succ_infer,
+  { root := ``Ix.Kernel.methodsN_succ_infer,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsN_succ_isDefEq,
+  { root := ``Ix.Kernel.methodsN_succ_isDefEq,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.methodsOut_whnf,
+  { root := ``Ix.Kernel.methodsOut_whnf,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.methodsOut_whnfCore,
+  { root := ``Ix.Kernel.methodsOut_whnfCore,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.methodsOut_whnfMode,
+  { root := ``Ix.Kernel.methodsOut_whnfMode,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.methodsOut_whnfCoreFlags,
+  { root := ``Ix.Kernel.methodsOut_whnfCoreFlags,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.methodsOut_infer,
+  { root := ``Ix.Kernel.methodsOut_infer,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.methodsOut_isDefEq,
+  { root := ``Ix.Kernel.methodsOut_isDefEq,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.runRec_apply,
+  { root := ``Ix.Kernel.TcM.runRec_apply,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.runRec_directInfer_zero,
+  { root := ``Ix.Kernel.TcM.runRec_directInfer_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.whnf_eq_runRec,
+  { root := ``Ix.Kernel.TcM.whnf_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.whnfCore_eq_runRec,
+  { root := ``Ix.Kernel.TcM.whnfCore_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.whnfNoDelta_eq_runRec,
+  { root := ``Ix.Kernel.TcM.whnfNoDelta_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.infer_eq_runRec,
+  { root := ``Ix.Kernel.TcM.infer_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.isDefEq_eq_runRec,
+  { root := ``Ix.Kernel.TcM.isDefEq_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.ensureSort_eq_runRec,
+  { root := ``Ix.Kernel.TcM.ensureSort_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.TcM.ensureForall_eq_runRec,
+  { root := ``Ix.Kernel.TcM.ensureForall_eq_runRec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.unfoldConstValue_equation,
+  { root := ``Ix.Kernel.RecM.unfoldConstValue_equation,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RecM.tryDeltaUnfold_equation,
+  { root := ``Ix.Kernel.RecM.tryDeltaUnfold_equation,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RecM.deltaUnfoldOne_equation,
+  { root := ``Ix.Kernel.RecM.deltaUnfoldOne_equation,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RecM.applyIotaArg_false,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_false,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.applyIotaArg_true_lam,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_true_lam,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.isNatLiteralRecursorApp_equation,
+  { root := ``Ix.Kernel.RecM.isNatLiteralRecursorApp_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isTransientNatLiteralWork_equation,
+  { root := ``Ix.Kernel.RecM.isTransientNatLiteralWork_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.cleanupNatOffsetMajor_equation,
+  { root := ``Ix.Kernel.RecM.cleanupNatOffsetMajor_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.projectDecidableFinValMinor_equation,
+  { root := ``Ix.Kernel.RecM.projectDecidableFinValMinor_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryReduceFinValDecidableRec_equation,
+  { root := ``Ix.Kernel.RecM.tryReduceFinValDecidableRec_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryReduceProjectionDefinition_equation,
+  { root := ``Ix.Kernel.RecM.tryReduceProjectionDefinition_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.natRecLiteralParts_equation,
+  { root := ``Ix.Kernel.RecM.natRecLiteralParts_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isNatStuckRecursorAddr_equation,
+  { root := ``Ix.Kernel.RecM.isNatStuckRecursorAddr_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isStuckNatPredicateProbe_equation,
+  { root := ``Ix.Kernel.RecM.isStuckNatPredicateProbe_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.bitvecOfNatArgs_equation,
+  { root := ``Ix.Kernel.RecM.bitvecOfNatArgs_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.charOfNatExpr_equation,
+  { root := ``Ix.Kernel.RecM.charOfNatExpr_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryReduceString_equation,
+  { root := ``Ix.Kernel.RecM.tryReduceString_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.discoverBlockInductives_equation,
+  { root := ``Ix.Kernel.RecM.discoverBlockInductives_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.runBounded_zero,
+  { root := ``Ix.Kernel.RecM.runBounded_zero,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.runBounded_succ,
+  { root := ``Ix.Kernel.RecM.runBounded_succ,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.consumeBetaLams_equation,
+  { root := ``Ix.Kernel.RecM.consumeBetaLams_equation,
     standardAxioms := standard,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.consumeBetaLamsFuel_zero,
+  { root := ``Ix.Kernel.RecM.consumeBetaLamsFuel_zero,
     standardAxioms := standard,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.consumeBetaLamsFuel_succ,
+  { root := ``Ix.Kernel.RecM.consumeBetaLamsFuel_succ,
     standardAxioms := standard,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.compareRank_equation,
+  { root := ``Ix.Kernel.RecM.compareRank_equation,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.RecM.isNatLike_equation,
+  { root := ``Ix.Kernel.RecM.isNatLike_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isNatZero_equation,
+  { root := ``Ix.Kernel.RecM.isNatZero_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.natSuccOf_equation,
+  { root := ``Ix.Kernel.RecM.natSuccOf_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.isBoolTrue_equation,
+  { root := ``Ix.Kernel.RecM.isBoolTrue_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isDelta_equation,
+  { root := ``Ix.Kernel.RecM.isDelta_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isRegular_equation,
+  { root := ``Ix.Kernel.RecM.isRegular_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.defRankId_equation,
+  { root := ``Ix.Kernel.RecM.defRankId_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.infer_eq_inferWith,
+  { root := ``Ix.Kernel.RecM.infer_eq_inferWith,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.inferCall_run,
+  { root := ``Ix.Kernel.RecM.inferCall_run,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.inferOnlyCall_run,
+  { root := ``Ix.Kernel.RecM.inferOnlyCall_run,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isDefEqCall_run,
+  { root := ``Ix.Kernel.RecM.isDefEqCall_run,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.whnfRec_run,
+  { root := ``Ix.Kernel.RecM.whnfRec_run,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.whnfModeRec_run,
+  { root := ``Ix.Kernel.RecM.whnfModeRec_run,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.whnfCoreFlagsRec_run,
+  { root := ``Ix.Kernel.RecM.whnfCoreFlagsRec_run,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.whnf_eq_whnfWithNatSuccMode,
+  { root := ``Ix.Kernel.RecM.whnf_eq_whnfWithNatSuccMode,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCore_eq_whnfCoreWithFlags,
+  { root := ``Ix.Kernel.RecM.whnfCore_eq_whnfCoreWithFlags,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDelta_eq_whnfNoDeltaImpl,
+  { root := ``Ix.Kernel.RecM.whnfNoDelta_eq_whnfNoDeltaImpl,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.ensureSortDirect_equation,
+  { root := ``Ix.Kernel.RecM.ensureSortDirect_equation,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.ensureForallDirect_equation,
+  { root := ``Ix.Kernel.RecM.ensureForallDirect_equation,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.peelProjForall_equation,
+  { root := ``Ix.Kernel.RecM.peelProjForall_equation,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.checkNoUnsafeRefs_equation,
+  { root := ``Ix.Kernel.RecM.checkNoUnsafeRefs_equation,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.checkNoUnsafeRefs_go_nil,
+  { root := ``Ix.Kernel.RecM.checkNoUnsafeRefs_go_nil,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.checkNoUnsafeRefs_go_app,
+  { root := ``Ix.Kernel.RecM.checkNoUnsafeRefs_go_app,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_equation,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_go_nil,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_go_nil,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_go_max,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_go_max,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_equation,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_go_nil,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_go_nil,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_go_app,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_go_app,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.peelRuleIhForalls_equation,
+  { root := ``Ix.Kernel.RecM.peelRuleIhForalls_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.checkPositivityDomain_equation,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomain_equation,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.checkPositivityDomainFuel_zero,
+  { root := ``Ix.Kernel.RecM.checkPositivityDomainFuel_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.checkNestedCtorFieldsFuel_zero,
+  { root := ``Ix.Kernel.RecM.checkNestedCtorFieldsFuel_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.checkNestedCtorFieldsLoopFuel_zero,
+  { root := ``Ix.Kernel.RecM.checkNestedCtorFieldsLoopFuel_zero,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.countForalls_equation,
+  { root := ``Ix.Kernel.RecM.countForalls_equation,
     standardAxioms := standard, nativeAxioms := inferNative },
   -- The complete checker dispatch is transparent now; these roots pin its
   -- exact production trust boundary in addition to the local equations.
-  { root := ``Ix.Tc.RecM.checkInductive,
+  { root := ``Ix.Kernel.RecM.checkInductive,
     standardAxioms := standard, nativeAxioms := inductiveNative },
-  { root := ``Ix.Tc.RecM.checkRecursorMemberImpl,
+  { root := ``Ix.Kernel.RecM.checkRecursorMemberImpl,
     standardAxioms := standard, nativeAxioms := inductiveNative },
-  { root := ``Ix.Tc.RecM.checkConst,
+  { root := ``Ix.Kernel.RecM.checkConst,
     standardAxioms := standard, nativeAxioms := inductiveNative },
-  { root := ``Ix.Tc.TcM.checkConst,
+  { root := ``Ix.Kernel.TcM.checkConst,
     standardAxioms := standard, nativeAxioms := inductiveNative },
-  { root := ``Ix.Tc.extractNatValue_app_const_equation,
+  { root := ``Ix.Kernel.extractNatValue_app_const_equation,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.extractNatValue_nat_equation,
+  { root := ``Ix.Kernel.extractNatValue_nat_equation,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.projectionDefinitionInfo_go_equation,
+  { root := ``Ix.Kernel.projectionDefinitionInfo_go_equation,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.EquivManager.find_equation,
+  { root := ``Ix.Kernel.EquivManager.find_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.EquivManager.find_go_zero },
-  { root := ``Ix.Tc.EquivManager.find_go_succ },
-  { root := ``Ix.Tc.LocalContext.truncate_equation,
+  { root := ``Ix.Kernel.EquivManager.find_go_zero },
+  { root := ``Ix.Kernel.EquivManager.find_go_succ },
+  { root := ``Ix.Kernel.LocalContext.truncate_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.LocalContext.truncate_go_zero,
+  { root := ``Ix.Kernel.LocalContext.truncate_go_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.LocalContext.truncate_go_succ,
+  { root := ``Ix.Kernel.LocalContext.truncate_go_succ,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TcM.restoreDepth_apply,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.restoreDepth_go_zero,
-    standardAxioms := standard, nativeAxioms := blake3Native },
-  { root := ``Ix.Tc.TcM.ctxSuffixNeed_zero,
+  { root := ``Ix.Kernel.TcM.restoreDepth_apply,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.restoreDepth_go_zero,
+    standardAxioms := standard },
+  { root := ``Ix.Kernel.TcM.ctxSuffixNeed_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TcM.ctxSuffixNeed_succ,
+  { root := ``Ix.Kernel.TcM.ctxSuffixNeed_succ,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TcM.ctxSuffixNeed_of_fixed,
+  { root := ``Ix.Kernel.TcM.ctxSuffixNeed_of_fixed,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.KExpr.render_equation,
+  { root := ``Ix.Kernel.KExpr.render_equation,
     standardAxioms := standard },
-  { root := ``Ix.Tc.KExpr.renderFuel_zero,
+  { root := ``Ix.Kernel.KExpr.renderFuel_zero,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.natOffset_equation,
+  { root := ``Ix.Kernel.RecM.natOffset_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.natOffsetOrZero_equation,
+  { root := ``Ix.Kernel.RecM.natOffsetOrZero_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.evalNatOffsetLiteral_equation,
+  { root := ``Ix.Kernel.RecM.evalNatOffsetLiteral_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.natOffsetFuel_zero,
+  { root := ``Ix.Kernel.RecM.natOffsetFuel_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.evalNatOffsetLiteralFuel_zero,
+  { root := ``Ix.Kernel.RecM.evalNatOffsetLiteralFuel_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryEvalNatValueForPred_equation,
+  { root := ``Ix.Kernel.RecM.tryEvalNatValueForPred_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryEvalNatValueForPredFuel_zero,
+  { root := ``Ix.Kernel.RecM.tryEvalNatValueForPredFuel_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.compareKUniv_succ_equation,
+  { root := ``Ix.Kernel.compareKUniv_succ_equation,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.compareKUniv_max_equation,
+  { root := ``Ix.Kernel.compareKUniv_max_equation,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.mergeSorted_equation,
+  { root := ``Ix.Kernel.mergeSorted_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.mergeSorted_go_zero,
+  { root := ``Ix.Kernel.mergeSorted_go_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.sortByCompare_equation,
+  { root := ``Ix.Kernel.sortByCompare_equation,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.sortByCompareFuel_zero,
+  { root := ``Ix.Kernel.sortByCompareFuel_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.sortKConstsRefineFuel_zero,
+  { root := ``Ix.Kernel.sortKConstsRefineFuel_zero,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.KExpr.treeSize_pos,
+  { root := ``Ix.Kernel.KExpr.treeSize_pos,
     standardAxioms := propextOnly },
-  { root := ``Ix.Tc.exprMentionsAddr_equation,
+  { root := ``Ix.Kernel.exprMentionsAddr_equation,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.exprMentionsAddr_go_nil,
+  { root := ``Ix.Kernel.exprMentionsAddr_go_nil,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.exprMentionsAddr_go_app,
+  { root := ``Ix.Kernel.exprMentionsAddr_go_app,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.exprMentionsAddr_go_const,
+  { root := ``Ix.Kernel.exprMentionsAddr_go_const,
     standardAxioms := standardWithoutChoice },
 
   -- RuntimeContracts: the repaired step source includes finite support plus an actual
@@ -5611,77 +5595,77 @@ private def roots : Array RootAllowance := #[
   -- collision-robust write validity.  The transient Nat probe is proved
   -- state-pure for eager states.  General lazy execution is reduced to the
   -- exact invariant contract of the driver-installed environment hook.
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_leaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_leaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_betaOne_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_betaOne_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projection_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projection_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_iota_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_iota_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RunAssumptions.subst_whnf_wf,
+  { root := ``Ix.Kernel.RunAssumptions.subst_whnf_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RunAssumptions.subst_whnf_eval,
+  { root := ``Ix.Kernel.RunAssumptions.subst_whnf_eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_letE,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_letE,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_letE_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_letE_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- regular-binder fallback: both translated regular-binder forms take the state-pure `.done`
   -- fallback and cannot be confused with their let-bound zeta siblings.
-  { root := ``Ix.Tc.TcM.lookupLetVal_none_state,
+  { root := ``Ix.Kernel.TcM.lookupLetVal_none_state,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_varDone,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_varDone,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_fvarDone,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_fvarDone,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_varDone_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_varDone_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_fvarDone_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_fvarDone_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.bvarStuckAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.bvarStuckAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.fvarStuckAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.fvarStuckAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- stuck-reduction fallback: projection misses and unchanged non-lambda application heads keep
   -- their original syntax, distinguish helper errors from `none`, and are
   -- inhabited by translated projection and constructor-application fixtures.
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projectionDone,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projectionDone,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projectionWhnfError,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projectionWhnfError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projectionReduceError,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projectionReduceError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appUnchangedDone,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appUnchangedDone,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appHeadError,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appHeadError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appUnchangedIotaError,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appUnchangedIotaError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projectionDone_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projectionDone_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appUnchangedDone_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appUnchangedDone_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.appStuckAcceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.ProjectionFallback.acceptance,
+  { root := ``Ix.Kernel.AmbientNat.ProjectionFallback.acceptance,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -5690,691 +5674,691 @@ private def roots : Array RootAllowance := #[
   -- intern-only framing; general multi-beta and changed-head hit/miss/error
   -- equations consume that helper boundary.  The Nat fixtures make argument
   -- reversal, a trailing argument, and physically changed heads observable.
-  { root := ``Ix.Tc.InternUpdateFrame.refl,
+  { root := ``Ix.Kernel.InternUpdateFrame.refl,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.InternUpdateFrame.trans,
+  { root := ``Ix.Kernel.InternUpdateFrame.trans,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RunAssumptions.internExpr_whnf_eval,
+  { root := ``Ix.Kernel.RunAssumptions.internExpr_whnf_eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishAppResult_eq_foldlM,
+  { root := ``Ix.Kernel.RecM.finishAppResult_eq_foldlM,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.finishAppResult_one,
+  { root := ``Ix.Kernel.RecM.finishAppResult_one,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.result_eq_foldl,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.result_eq_foldl,
     standardAxioms := standardWithoutQuot,
     nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.support,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.support,
     standardAxioms := standard, nativeAxioms := levelNative },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.foldlM_eval,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.foldlM_eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.eval,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.final_eq_spec,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.final_eq_spec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_betaMany,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_betaMany,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChangedIota,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChangedIota,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChangedDone,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChangedDone,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChangedIotaError,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChangedIotaError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_betaMany_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_betaMany_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChangedDone_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChangedDone_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChangedIota_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChangedIota_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChangedIotaError_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChangedIotaError_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiBetaStep,
+  { root := ``Ix.Kernel.AmbientNat.multiBetaStep,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.changedHeadInternSpec,
+  { root := ``Ix.Kernel.AmbientNat.changedHeadInternSpec,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.changedHeadStep,
+  { root := ``Ix.Kernel.AmbientNat.changedHeadStep,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.WhnfKey.closed_represents,
+  { root := ``Ix.Kernel.RecM.WhnfKey.closed_represents,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.WhnfCacheWriteOracle.closed,
+  { root := ``Ix.Kernel.RecM.WhnfCacheWriteOracle.closed,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.tryGetConst_noLazy,
+  { root := ``Ix.Kernel.TcM.tryGetConst_noLazy,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.lazyIngressAddr_wf,
+  { root := ``Ix.Kernel.TcM.lazyIngressAddr_wf,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.TcM.tryGetConst_wf,
+  { root := ``Ix.Kernel.TcM.tryGetConst_wf,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.KId.anon_eq_of_addr_eq },
-  { root := ``Ix.Tc.TcM.tryGetConst_success_loaded,
+  { root := ``Ix.Kernel.KId.anon_eq_of_addr_eq },
+  { root := ``Ix.Kernel.TcM.tryGetConst_success_loaded,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsSuccessTrace.eval,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsSuccessTrace.complete,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsSuccessTrace.complete,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsSuccessTrace.trusted,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsSuccessTrace.trusted,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrustedNatRecLiteralParts.patternAt,
+  { root := ``Ix.Kernel.RecM.TrustedNatRecLiteralParts.patternAt,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.HeadConstN.matches_varN },
-  { root := ``Ix.Tc.HeadConstN.natLit_zero },
-  { root := ``Ix.Tc.HeadConstN.natLit_succ },
-  { root := ``Ix.Tc.RecursorIotaPattern.matches_of_shapes },
-  { root := ``Ix.Tc.RecursorIotaPattern.exists_matches_iff_shapes },
-  { root := ``Ix.Tc.RecursorIotaPattern.matches_natZero },
-  { root := ``Ix.Tc.RecursorIotaPattern.matches_natSucc },
-  { root := ``Ix.Tc.NatRecIotaCase.major_shape },
-  { root := ``Ix.Tc.RecursorRulePattern.matches_natLiteral },
-  { root := ``Ix.Tc.RecM.TrAppSpine.headConstN,
+  { root := ``Ix.Kernel.HeadConstN.matches_varN },
+  { root := ``Ix.Kernel.HeadConstN.natLit_zero },
+  { root := ``Ix.Kernel.HeadConstN.natLit_succ },
+  { root := ``Ix.Kernel.RecursorIotaPattern.matches_of_shapes },
+  { root := ``Ix.Kernel.RecursorIotaPattern.exists_matches_iff_shapes },
+  { root := ``Ix.Kernel.RecursorIotaPattern.matches_natZero },
+  { root := ``Ix.Kernel.RecursorIotaPattern.matches_natSucc },
+  { root := ``Ix.Kernel.NatRecIotaCase.major_shape },
+  { root := ``Ix.Kernel.RecursorRulePattern.matches_natLiteral },
+  { root := ``Ix.Kernel.RecM.TrAppSpine.headConstN,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RecM.TrAppSpine.matches_natRecRulePrefix,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.matches_natRecRulePrefix,
     standardAxioms := standard },
-  { root := ``Ix.Tc.RawRecursorRulePatternRel.matches_natLiteralPrefix,
+  { root := ``Ix.Kernel.RawRecursorRulePatternRel.matches_natLiteralPrefix,
     standardAxioms := standard },
-  { root := ``Ix.Tc.AmbientNat.linearRecTheoryPrefix_shape },
-  { root := ``Ix.Tc.AmbientNat.linearRecZeroPatternMatch },
-  { root := ``Ix.Tc.AmbientNat.linearRecSuccPatternMatch },
-  { root := ``Ix.Tc.TrustedNatRecursorLayout.caseForMajor,
+  { root := ``Ix.Kernel.AmbientNat.linearRecTheoryPrefix_shape },
+  { root := ``Ix.Kernel.AmbientNat.linearRecZeroPatternMatch },
+  { root := ``Ix.Kernel.AmbientNat.linearRecSuccPatternMatch },
+  { root := ``Ix.Kernel.TrustedNatRecursorLayout.caseForMajor,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSuffix.tr,
+  { root := ``Ix.Kernel.RecM.TrAppSuffix.tr,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.splitAt,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.splitAt,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsDescriptor.patternMajor,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsDescriptor.patternMajor,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsDescriptor.translatedSplit,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsDescriptor.translatedSplit,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrustedNatRecLiteralParts.translatedCase,
+  { root := ``Ix.Kernel.RecM.TrustedNatRecLiteralParts.translatedCase,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSuffix.startHasType,
+  { root := ``Ix.Kernel.RecM.TrAppSuffix.startHasType,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSuffix.rebase,
+  { root := ``Ix.Kernel.RecM.TrAppSuffix.rebase,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RawRecursorRulePatternRel.checkedReduction,
+  { root := ``Ix.Kernel.RawRecursorRulePatternRel.checkedReduction,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatRecLiteralTranslationSplit.checkedRhsSuffix,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralTranslationSplit.checkedRhsSuffix,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RegisteredRecursorRuleRhsRel.rhsRaw,
+  { root := ``Ix.Kernel.RegisteredRecursorRuleRhsRel.rhsRaw,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RegisteredRecursorRuleRhsRel.rhsStructural,
+  { root := ``Ix.Kernel.RegisteredRecursorRuleRhsRel.rhsStructural,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RegisteredRecursorRuleRhsRel.instUnivSpec,
+  { root := ``Ix.Kernel.RegisteredRecursorRuleRhsRel.instUnivSpec,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RegisteredRecursorRuleRhsRel.instantiateUnivParams_nonempty,
+      ``Ix.Kernel.RegisteredRecursorRuleRhsRel.instantiateUnivParams_nonempty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RawRecursorRuleRel.registeredRhsTyped,
+  { root := ``Ix.Kernel.RawRecursorRuleRel.registeredRhsTyped,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSuffix.rebaseQuot,
+  { root := ``Ix.Kernel.RecM.TrAppSuffix.rebaseQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.NatRecLiteralTranslationSplit.checkedRhsSuffixQuot,
+      ``Ix.Kernel.RecM.NatRecLiteralTranslationSplit.checkedRhsSuffixQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KExpr.Constructed.liftNoIntern_eq_liftSpec,
+  { root := ``Ix.Kernel.KExpr.Constructed.liftNoIntern_eq_liftSpec,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KExpr.Constructed.substNoIntern_eq_substSpec,
+  { root := ``Ix.Kernel.KExpr.Constructed.substNoIntern_eq_substSpec,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArg_true_lam_spec,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_true_lam_spec,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArg_true_lam_run,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_true_lam_run,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.betaNoIntern,
+  { root := ``Ix.Kernel.WhnfMeaning.betaNoIntern,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaIotaArgRun,
+  { root := ``Ix.Kernel.AmbientNat.betaIotaArgRun,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.betaNoInternMeaning,
+  { root := ``Ix.Kernel.AmbientNat.betaNoInternMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.IotaArgNonLambda.applyIotaArg_true,
+  { root := ``Ix.Kernel.IotaArgNonLambda.applyIotaArg_true,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.IotaArgNonLambda.applyIotaArg_true_run,
+  { root := ``Ix.Kernel.IotaArgNonLambda.applyIotaArg_true_run,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.appRebuild,
+  { root := ``Ix.Kernel.WhnfMeaning.appRebuild,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArg_true_nonlam_semantic,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_true_nonlam_semantic,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArg_false_eval,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_false_eval,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArg_false_semantic,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_false_semantic,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckIotaTransient,
+  { root := ``Ix.Kernel.AmbientNat.appStuckIotaTransient,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckIotaInterned,
+  { root := ``Ix.Kernel.AmbientNat.appStuckIotaInterned,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.resultQuot,
+  { root := ``Ix.Kernel.WhnfMeaning.resultQuot,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.ofStructuralQuot,
+  { root := ``Ix.Kernel.WhnfMeaning.ofStructuralQuot,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KExpr.substNoIntern_of_lbr_le,
+  { root := ``Ix.Kernel.KExpr.substNoIntern_of_lbr_le,
     standardAxioms := standardWithoutQuot,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KExpr.liftNoIntern_of_lbr_le,
+  { root := ``Ix.Kernel.KExpr.liftNoIntern_of_lbr_le,
     standardAxioms := standardWithoutQuot,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArgs_eq_foldlM,
+  { root := ``Ix.Kernel.RecM.applyIotaArgs_eq_foldlM,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.singleton,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.singleton,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.append,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.append,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.three,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.three,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaArgsTrace.transientNonLambdaSingleton,
+      ``Ix.Kernel.RecM.ApplyIotaArgsTrace.transientNonLambdaSingleton,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaArgsTrace.transientNonLambdaSingletonQuot,
+      ``Ix.Kernel.RecM.ApplyIotaArgsTrace.transientNonLambdaSingletonQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.internedSingleton,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.internedSingleton,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.transientLambdaSingleton,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.transientLambdaSingleton,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.transientLambdaSingletonQuot,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.transientLambdaSingletonQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.evalList,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.evalList,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.evalArray,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.evalArray,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.sourceTr,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.sourceTr,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.finalQuot,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.finalQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.finalInv,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.finalInv,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.frame,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.frame,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.finalSupport,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.finalSupport,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.acceptance,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.acceptance,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.evalThreeArrays,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.evalThreeArrays,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.threeArrayAcceptance,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.threeArrayAcceptance,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.ofQuot,
+  { root := ``Ix.Kernel.WhnfMeaning.ofQuot,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.sourceQuot,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.sourceQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.acceptanceQuot,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.acceptanceQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaArgsTrace.threeArrayAcceptanceQuot,
+  { root := ``Ix.Kernel.RecM.ApplyIotaArgsTrace.threeArrayAcceptanceQuot,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.instantiateUnivParams_whnf_of_run,
+  { root := ``Ix.Kernel.TcM.instantiateUnivParams_whnf_of_run,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaRuleTrace.eval,
+  { root := ``Ix.Kernel.RecM.ApplyIotaRuleTrace.eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaRuleTrace.emptyInstantiation,
+  { root := ``Ix.Kernel.RecM.ApplyIotaRuleTrace.emptyInstantiation,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaRuleTrace.instantiatePost,
+  { root := ``Ix.Kernel.RecM.ApplyIotaRuleTrace.instantiatePost,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaRuleTrace.acceptance,
+  { root := ``Ix.Kernel.RecM.ApplyIotaRuleTrace.acceptance,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaRuleTrace.acceptance_empty,
+  { root := ``Ix.Kernel.RecM.ApplyIotaRuleTrace.acceptance_empty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaRuleTrace.registeredStartQuot_empty,
+      ``Ix.Kernel.RecM.ApplyIotaRuleTrace.registeredStartQuot_empty,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaRuleTrace.registeredAcceptance_empty,
+      ``Ix.Kernel.RecM.ApplyIotaRuleTrace.registeredAcceptance_empty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaRuleTrace.registeredStartQuot_nonempty,
+      ``Ix.Kernel.RecM.ApplyIotaRuleTrace.registeredStartQuot_nonempty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaRuleTrace.registeredAcceptance_nonempty,
+      ``Ix.Kernel.RecM.ApplyIotaRuleTrace.registeredAcceptance_nonempty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaRuleTrace.checkedMeaning,
+  { root := ``Ix.Kernel.RecM.ApplyIotaRuleTrace.checkedMeaning,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaRuleTrace.checkedAcceptance_empty,
+      ``Ix.Kernel.RecM.ApplyIotaRuleTrace.checkedAcceptance_empty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.ApplyIotaRuleTrace.checkedAcceptance_nonempty,
+      ``Ix.Kernel.RecM.ApplyIotaRuleTrace.checkedAcceptance_nonempty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KConst.recursorMajorIdx_of_iotaInfo,
+  { root := ``Ix.Kernel.KConst.recursorMajorIdx_of_iotaInfo,
     standardAxioms := propextOnly,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KConst.recursorRuleAt_of_iotaInfo,
+  { root := ``Ix.Kernel.KConst.recursorRuleAt_of_iotaInfo,
     standardAxioms := propextOnly,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryApplyIotaCtorSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.TryApplyIotaCtorSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaCtorTrace.operational,
+  { root := ``Ix.Kernel.RecM.ApplyIotaCtorTrace.operational,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaCtorTrace.eval,
+  { root := ``Ix.Kernel.RecM.ApplyIotaCtorTrace.eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaCtorTrace.recursorRuleAt,
+  { root := ``Ix.Kernel.RecM.ApplyIotaCtorTrace.recursorRuleAt,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaCtorTrace.acceptance_empty,
+  { root := ``Ix.Kernel.RecM.ApplyIotaCtorTrace.acceptance_empty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaCtorTrace.checkedAcceptance_empty,
+  { root := ``Ix.Kernel.RecM.ApplyIotaCtorTrace.checkedAcceptance_empty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ApplyIotaCtorTrace.checkedAcceptance_nonempty,
+  { root := ``Ix.Kernel.RecM.ApplyIotaCtorTrace.checkedAcceptance_nonempty,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_regular,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_regular,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaAfterMajorWhnf_regular,
+  { root := ``Ix.Kernel.RecM.tryIotaAfterMajorWhnf_regular,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_nonKPrefix,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_nonKPrefix,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_regularCtor,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_regularCtor,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryIotaWithFlags_regularCtor_checkedAcceptance_empty,
+      ``Ix.Kernel.RecM.tryIotaWithFlags_regularCtor_checkedAcceptance_empty,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natToConstructor_zero,
+  { root := ``Ix.Kernel.RecM.natToConstructor_zero,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natToConstructor_succ,
+  { root := ``Ix.Kernel.RecM.natToConstructor_succ,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaAfterMajorWhnf_nat,
+  { root := ``Ix.Kernel.RecM.tryIotaAfterMajorWhnf_nat,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_natCtor,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_natCtor,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryIotaWithFlags_natCtor_checkedAcceptance_empty,
+      ``Ix.Kernel.RecM.tryIotaWithFlags_natCtor_checkedAcceptance_empty,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.intern_success_frame,
+  { root := ``Ix.Kernel.RecM.intern_success_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.strLitListToConstructor_empty,
+  { root := ``Ix.Kernel.RecM.strLitListToConstructor_empty,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.strLitListToConstructor_success_frame,
+  { root := ``Ix.Kernel.RecM.strLitListToConstructor_success_frame,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.strLitToConstructor_success_frame,
+  { root := ``Ix.Kernel.RecM.strLitToConstructor_success_frame,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.evalNatOffsetLiteral_str,
+  { root := ``Ix.Kernel.RecM.evalNatOffsetLiteral_str,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natOffset_str,
+  { root := ``Ix.Kernel.RecM.natOffset_str,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.cleanupNatOffsetMajor_str,
+  { root := ``Ix.Kernel.RecM.cleanupNatOffsetMajor_str,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaAfterMajorWhnf_str,
+  { root := ``Ix.Kernel.RecM.tryIotaAfterMajorWhnf_str,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_strCtor,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_strCtor,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryIotaWithFlags_strCtor_checkedAcceptance_empty,
+      ``Ix.Kernel.RecM.tryIotaWithFlags_strCtor_checkedAcceptance_empty,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringEmptyFold,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringEmptyFold,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringExpand,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringExpand,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringCallback,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringCallback,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringCleanup,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringCleanup,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringGetZeroOfFrame,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringGetZeroOfFrame,
     standardAxioms := standard,
     nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringApplyRule,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringApplyRule,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringApplyCtor,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringApplyCtor,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaStringAfterEval,
+  { root := ``Ix.Kernel.AmbientNat.iotaStringAfterEval,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- ConstructorSynthesis: the positive K-like recursor branch.  Optional probes retain
   -- error-side state, candidate synthesis records the DefEq gate and counter
   -- order, and the inhabited fixture reaches the real bounded WHNF driver.
-  { root := ``Ix.Tc.RecM.tryOptional_success,
+  { root := ``Ix.Kernel.RecM.tryOptional_success,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptional_error,
+  { root := ``Ix.Kernel.RecM.tryOptional_error,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.VerifyKSynthCandidateSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.VerifyKSynthCandidateSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.VerifyKSynthCandidateRejectTrace.eval,
+  { root := ``Ix.Kernel.RecM.VerifyKSynthCandidateRejectTrace.eval,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_kPrefix,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_kPrefix,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_kFallback,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_kFallback,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_kCtor,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_kCtor,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryIotaWithFlags_kCtor_checkedAcceptance_empty,
+      ``Ix.Kernel.RecM.tryIotaWithFlags_kCtor_checkedAcceptance_empty,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaIntern,
+  { root := ``Ix.Kernel.AmbientNat.kIotaIntern,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaMajorInfer,
+  { root := ``Ix.Kernel.AmbientNat.kIotaMajorInfer,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaMajorWhnf,
+  { root := ``Ix.Kernel.AmbientNat.kIotaMajorWhnf,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaGetRec,
+  { root := ``Ix.Kernel.AmbientNat.kIotaGetRec,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaGetNat,
+  { root := ``Ix.Kernel.AmbientNat.kIotaGetNat,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaMajorInductive,
+  { root := ``Ix.Kernel.AmbientNat.kIotaMajorInductive,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaCtorInfer,
+  { root := ``Ix.Kernel.AmbientNat.kIotaCtorInfer,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaAttemptStats,
+  { root := ``Ix.Kernel.AmbientNat.kIotaAttemptStats,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaTypeDefEq,
+  { root := ``Ix.Kernel.AmbientNat.kIotaTypeDefEq,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaCandidate,
+  { root := ``Ix.Kernel.AmbientNat.kIotaCandidate,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaSynth,
+  { root := ``Ix.Kernel.AmbientNat.kIotaSynth,
     standardAxioms := standard,
     nativeAxioms := inferNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaInternFrame,
+  { root := ``Ix.Kernel.AmbientNat.kIotaInternFrame,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaSynthCleanup,
+  { root := ``Ix.Kernel.AmbientNat.kIotaSynthCleanup,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaSynthWhnf,
+  { root := ``Ix.Kernel.AmbientNat.kIotaSynthWhnf,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaGetZeroAfter,
+  { root := ``Ix.Kernel.AmbientNat.kIotaGetZeroAfter,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaApplyRule,
+  { root := ``Ix.Kernel.AmbientNat.kIotaApplyRule,
     standardAxioms := standard, nativeAxioms := nameNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaApplyCtor,
+  { root := ``Ix.Kernel.AmbientNat.kIotaApplyCtor,
     standardAxioms := standard, nativeAxioms := nameNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaTryEval,
+  { root := ``Ix.Kernel.AmbientNat.kIotaTryEval,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaStepEval,
+  { root := ``Ix.Kernel.AmbientNat.kIotaStepEval,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kIotaCoreEval,
+  { root := ``Ix.Kernel.AmbientNat.kIotaCoreEval,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- ConstructorSynthesisFallback: exhaustive K-synthesis fallback and error branches.
-  { root := ``Ix.Tc.RecM.verifyKSynthCandidate_inferMiss,
+  { root := ``Ix.Kernel.RecM.verifyKSynthCandidate_inferMiss,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.verifyKSynthCandidate_inferError,
+  { root := ``Ix.Kernel.RecM.verifyKSynthCandidate_inferError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.verifyKSynthCandidate_defEqError,
+  { root := ``Ix.Kernel.RecM.verifyKSynthCandidate_defEqError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_mismatch,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_mismatch,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_missing,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_missing,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_nonInductive,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_nonInductive,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_empty,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_empty,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_selected,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_selected,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_selectedError,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_selectedError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_majorInferMiss,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_majorInferMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_majorInferError,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_majorInferError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_majorWhnfMiss,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_majorWhnfMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_majorWhnfError,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_majorWhnfError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_nonConstHead,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_nonConstHead,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_recursorMissing,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_recursorMissing,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_majorInductiveMiss,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_majorInductiveMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_majorInductiveError,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_majorInductiveError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.eval,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.mismatch,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.mismatch,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.missing,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.missing,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.nonInductive,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.nonInductive,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.empty,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.empty,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.selected,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.selected,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SynthCtorWhenKSelectionTrace.selectedError,
+  { root := ``Ix.Kernel.RecM.SynthCtorWhenKSelectionTrace.selectedError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kMajorInferRawError,
+  { root := ``Ix.Kernel.AmbientNat.kMajorInferRawError,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kMajorInferCaughtMiss,
+  { root := ``Ix.Kernel.AmbientNat.kMajorInferCaughtMiss,
     standardAxioms := standard,
     nativeAxioms := inferNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kCandidateInferRawError,
+  { root := ``Ix.Kernel.AmbientNat.kCandidateInferRawError,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kCandidateInferCaughtMiss,
+  { root := ``Ix.Kernel.AmbientNat.kCandidateInferCaughtMiss,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kDefEqRawError,
+  { root := ``Ix.Kernel.AmbientNat.kDefEqRawError,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kDefEqCandidateError,
+  { root := ``Ix.Kernel.AmbientNat.kDefEqCandidateError,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kDefEqSynthError,
+  { root := ``Ix.Kernel.AmbientNat.kDefEqSynthError,
     standardAxioms := standard,
     nativeAxioms := inferNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kEmptyGetRec,
+  { root := ``Ix.Kernel.AmbientNat.kEmptyGetRec,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kEmptyGetNat,
+  { root := ``Ix.Kernel.AmbientNat.kEmptyGetNat,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kEmptyMajorInductive,
+  { root := ``Ix.Kernel.AmbientNat.kEmptyMajorInductive,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.kEmptyInductiveMiss,
+  { root := ``Ix.Kernel.AmbientNat.kEmptyInductiveMiss,
     standardAxioms := standard,
     nativeAxioms := inferNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
@@ -6382,270 +6366,270 @@ private def roots : Array RootAllowance := #[
   -- StructEtaControl: exhaustive struct-eta classification, caught probes, rebuild,
   -- single-rule selection, and final constructor fallthrough.  Rebuilding is
   -- proved total; only universe instantiation can produce a post-guard error.
-  { root := ``Ix.Tc.RecM.isStructLike_missing,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_missing,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isStructLike_nonInductive,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_nonInductive,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isStructLike_lookupError,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_lookupError,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isStructLike_badShape,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_badShape,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isStructLike_shapeQualified,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_shapeQualified,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isStructLike_recError,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_recError,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaResult_empty,
+  { root := ``Ix.Kernel.RecM.finishStructEtaResult_empty,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.structEtaIntern_total,
+  { root := ``Ix.Kernel.RecM.structEtaIntern_total,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaFields_total,
+  { root := ``Ix.Kernel.RecM.finishStructEtaFields_total,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaResult_of_segments,
+  { root := ``Ix.Kernel.RecM.finishStructEtaResult_of_segments,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaResult_total,
+  { root := ``Ix.Kernel.RecM.finishStructEtaResult_total,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaResult_ne_error,
+  { root := ``Ix.Kernel.RecM.finishStructEtaResult_ne_error,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaAfterSort_prop,
+  { root := ``Ix.Kernel.RecM.finishStructEtaAfterSort_prop,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaAfterSort_success,
+  { root := ``Ix.Kernel.RecM.finishStructEtaAfterSort_success,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaAfterSort_instantiateError,
+  { root := ``Ix.Kernel.RecM.finishStructEtaAfterSort_instantiateError,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaAfterSort_finishError,
+  { root := ``Ix.Kernel.RecM.finishStructEtaAfterSort_finishError,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_notStruct,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_notStruct,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_structError,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_structError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_majorInferMiss,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_majorInferMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_majorInferError,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_majorInferError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_sortInferMiss,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_sortInferMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_sortInferError,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_sortInferError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_sortWhnfMiss,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_sortWhnfMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_sortWhnfError,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_sortWhnfError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaProbeTrace.eval,
+  { root := ``Ix.Kernel.RecM.StructEtaProbeTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaProbeTrace.prop,
+  { root := ``Ix.Kernel.RecM.StructEtaProbeTrace.prop,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaProbeTrace.success,
+  { root := ``Ix.Kernel.RecM.StructEtaProbeTrace.success,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaProbeTrace.finishError,
+  { root := ``Ix.Kernel.RecM.StructEtaProbeTrace.finishError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_ruleCount,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_ruleCount,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_recursorMissing,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_recursorMissing,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_recursorError,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_recursorError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_majorInductiveMiss,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_majorInductiveMiss,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_majorInductiveError,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_majorInductiveError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaSelectionTrace.eval,
+  { root := ``Ix.Kernel.RecM.StructEtaSelectionTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaIotaSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.StructEtaIotaSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaIotaSuccessTrace.acceptance,
+  { root := ``Ix.Kernel.RecM.StructEtaIotaSuccessTrace.acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- Rebuild: the successful struct-eta rebuild derives its invariant, frame,
   -- and finite support from the exact projection/application request list.
   -- The registered Theory equation remains an explicit premise.
-  { root := ``Ix.Tc.RecM.StructEtaFieldRequests.support,
+  { root := ``Ix.Kernel.RecM.StructEtaFieldRequests.support,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaFieldRequests.eval,
+  { root := ``Ix.Kernel.RecM.StructEtaFieldRequests.eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaBuildRequests.eval,
+  { root := ``Ix.Kernel.RecM.StructEtaBuildRequests.eval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaIotaSuccessTrace.acceptance_of_requests,
+  { root := ``Ix.Kernel.RecM.StructEtaIotaSuccessTrace.acceptance_of_requests,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- CallbackPrefix: the exact infer-only and optional-catch wrappers preserve the
   -- complete fixed-world invariant while retaining callback mutations.
-  { root := ``Ix.Tc.TcM.withInferOnly_eq,
+  { root := ``Ix.Kernel.TcM.withInferOnly_eq,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.withInferOnly_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.TcM.withInferOnly_whnf_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.inferOnlyRec_run,
+  { root := ``Ix.Kernel.RecM.inferOnlyRec_run,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptional_run,
+  { root := ``Ix.Kernel.RecM.tryOptional_run,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptional_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.tryOptional_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.inferOnlyRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.inferOnlyRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptionalInferOnlyRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.tryOptionalInferOnlyRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptionalWhnfRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.tryOptionalWhnfRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
 
   -- RecursionClassifier: recursion classification now owns its complete concrete state
   -- transaction.  Both physical writes require explicit provenance; the
   -- final write is indexed by the exact classifier execution, and only
   -- errors inside that classifier enter the erase-and-rethrow handler.
-  { root := ``Ix.Tc.CacheInvariant.insertIsRec,
+  { root := ``Ix.Kernel.CacheInvariant.insertIsRec,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.eraseIsRec,
+  { root := ``Ix.Kernel.CacheInvariant.eraseIsRec,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsRecCacheUpdate.insert_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.IsRecCacheUpdate.insert_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsRecCacheUpdate.erase_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.IsRecCacheUpdate.erase_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsRecCacheWriteOracle.of_trusted,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.IsRecCacheWriteOracle.of_trusted,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.getConst_wf,
+  { root := ``Ix.Kernel.TcM.getConst_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.tryGetBlock_wf,
+  { root := ``Ix.Kernel.TcM.tryGetBlock_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.WhnfCallbackSupports.preserves,
+  { root := ``Ix.Kernel.RecM.WhnfCallbackSupports.preserves,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.getMajorInductiveId_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.getMajorInductiveId_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.collectSpine_const_references,
+  { root := ``Ix.Kernel.RecM.collectSpine_const_references,
     standardAxioms := propextOnly,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.getMajorInductiveId_trusted_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.getMajorInductiveId_trusted_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.discoverBlockInductives_wf,
+  { root := ``Ix.Kernel.RecM.discoverBlockInductives_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.computeIsRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.computeIsRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.cacheIsRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.cacheIsRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.eraseCachedIsRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.eraseCachedIsRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.computedIsRecClassify_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.computedIsRecClassify_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.computedIsRecMiss_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.computedIsRecMiss_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.computedIsRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.computedIsRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
 
   -- Classifier: compose the recursion classifier through `isStructLike`, then
   -- exhaust the single-rule recursor lookup and all three caught struct-eta
   -- probes.  Only the explicitly parameterized cache-write, callback, and
   -- successful universe/rebuild authorities remain outside these proofs.
-  { root := ``Ix.Tc.RecM.isStructLike_wf,
-    standardAxioms := standard, nativeAxioms := blake3ContextNative,
+  { root := ``Ix.Kernel.RecM.isStructLike_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptional_state_wf,
+  { root := ``Ix.Kernel.RecM.tryOptional_state_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryOptional_fixed_wf,
+  { root := ``Ix.Kernel.RecM.tryOptional_fixed_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaAfterInductive_wf,
+  { root := ``Ix.Kernel.RecM.tryStructEtaAfterInductive_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_prefix_wf,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_prefix_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_trusted_prefix_wf,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_trusted_prefix_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructEtaIota_wf,
+  { root := ``Ix.Kernel.RecM.tryStructEtaIota_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- RebuildTail: the universe-instantiation/rebuild tail now preserves the complete
   -- invariant from the finite execution request census, including retained
   -- intern-table updates on a non-backtracking walker error.
-  { root := ``Ix.Tc.TcM.instantiateUnivParams_whnf_wf,
+  { root := ``Ix.Kernel.TcM.instantiateUnivParams_whnf_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaBuildRequests.wf,
+  { root := ``Ix.Kernel.RecM.StructEtaBuildRequests.wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishStructEtaAfterSort_wf_of_requests,
+  { root := ``Ix.Kernel.RecM.finishStructEtaAfterSort_wf_of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- CacheShell: both structural-core cache partitions now have explicit
   -- collision-robust write authority, and the actual public dispatcher is
   -- closed conditionally on the remaining exhaustive structural step.
-  { root := ``Ix.Tc.RecM.WhnfCoreCacheWriteOracle.closed,
+  { root := ``Ix.Kernel.RecM.WhnfCoreCacheWriteOracle.closed,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfSuffixModel.coreCacheWriteOracle,
+  { root := ``Ix.Kernel.WhnfSuffixModel.coreCacheWriteOracle,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsNonLeaf_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsNonLeaf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlags_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlags_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -6654,81 +6638,81 @@ private def roots : Array RootAllowance := #[
   -- substitution now share one local structural-step contract.  The fvar
   -- theorem exposes the real unchanged-value safety invariant rather than
   -- inferring closedness or arithmetic bounds from translation alone.
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_fvar_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_fvar_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_letE_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_letE_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_basic_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_basic_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- VariableStep: legacy zeta now derives its semantic weakening from the exact
   -- lift-walker bounds.  The only additional safety fact is the real
   -- UInt64 `idx + 1` no-wrap condition on an actual let-value hit.
-  { root := ``Ix.Tc.CtxRecon.lookupLetVal_liftBounds,
+  { root := ``Ix.Kernel.CtxRecon.lookupLetVal_liftBounds,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.lookupLetVal_noLet,
+  { root := ``Ix.Kernel.TcM.lookupLetVal_noLet,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.zetaVar_liftBounds,
+  { root := ``Ix.Kernel.WhnfMeaning.zetaVar_liftBounds,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_var_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_var_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_basicVar_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_basicVar_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   
   -- RecursiveCallbacks: projection values and application-spine children now have an
   -- explicit finite-support boundary, and both recursive head callbacks are
   -- instantiated directly from the predecessor method-table contract.
-  { root := ``Ix.Tc.RecM.whnfCoreFlagsRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.whnfCoreFlagsRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.headTr,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.headTr,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.projectionValueCallback_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.projectionValueCallback_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applicationHeadCallback_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.applicationHeadCallback_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applicationArgument_support,
+  { root := ``Ix.Kernel.RecM.applicationArgument_support,
     standardAxioms := propextOnly,
     forbiddenDependencies := legacyWholeEnv },
 
   -- ProjectionStep: all projection-step outcomes now satisfy the local structural
   -- contract once the exact helper effect/result boundary is instantiated;
   -- callback and helper errors retain their partial post-state.
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_projection_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_projection_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_basicVarProjection_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_basicVarProjection_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- ApplicationCongruence: the application-head callback is tied to the exact typed suffix,
   -- and Theory application congruence transports head reduction across every
   -- argument rebuilt by the finite production certificate.
-  { root := ``Ix.Tc.RecM.TrAppSpine.toSuffix,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.toSuffix,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applicationHeadCallbackWithSuffix_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.applicationHeadCallbackWithSuffix_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.WhnfMeaning.appHeadRebuild,
+  { root := ``Ix.Kernel.RecM.WhnfMeaning.appHeadRebuild,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
 
   -- ApplicationRebuild: a finite census now executes each dynamic changed-head rebuild and
   -- returns its exact intern frame, support, and transported Theory meaning.
-  { root := ``Ix.Tc.RecM.changedHeadFinish_acceptance,
+  { root := ``Ix.Kernel.RecM.changedHeadFinish_acceptance,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -6736,13 +6720,13 @@ private def roots : Array RootAllowance := #[
   -- ApplicationTails: both non-beta application tails are exhaustive over iota hit,
   -- miss, and error.  Changed-head hits compose rebuild congruence with the
   -- helper result; unchanged misses remain reflexive at the original source.
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appUnchangedIota,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appUnchangedIota,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appUnchanged_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appUnchanged_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfCoreWithFlagsStep_appChanged_wf,
+  { root := ``Ix.Kernel.RecM.whnfCoreWithFlagsStep_appChanged_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -6752,48 +6736,48 @@ private def roots : Array RootAllowance := #[
   -- and derives selected-field support from the concrete collected spine.
   -- Only String preprocessing and the installed lazy-ingress hook remain at
   -- the public helper constructor.
-  { root := ``Ix.Tc.RecM.WhnfCoreInputSupport.spineArg,
+  { root := ``Ix.Kernel.RecM.WhnfCoreInputSupport.spineArg,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjReduceTail_noAccel_wf,
+  { root := ``Ix.Kernel.RecM.tryProjReduceTail_noAccel_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionPrelude.nonString,
+  { root := ``Ix.Kernel.RecM.ProjectionPrelude.nonString,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionPrelude.ofString,
+  { root := ``Ix.Kernel.RecM.ProjectionPrelude.ofString,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjReduce_noAccel_wf,
+  { root := ``Ix.Kernel.RecM.tryProjReduce_noAccel_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionHelper.noAccel,
+  { root := ``Ix.Kernel.RecM.ProjectionHelper.noAccel,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionStringPrelude.ofExpansion,
+  { root := ``Ix.Kernel.RecM.ProjectionStringPrelude.ofExpansion,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionHelper.noAccelOfExpansion,
+  { root := ``Ix.Kernel.RecM.ProjectionHelper.noAccelOfExpansion,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   -- StringExpansion: the remaining String-expansion premise is reduced to a pure,
   -- finite plan.  The actual primitive read, seven prefix interns, recursive
   -- character fold, and final intern preserve the complete K1 invariant and
   -- return the exact structurally translated generated expression.
-  { root := ``Ix.Tc.RecM.strLitListToConstructor_plan_wf,
+  { root := ``Ix.Kernel.RecM.strLitListToConstructor_plan_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.strLitToConstructorWithPrimitives_plan_wf,
+      ``Ix.Kernel.RecM.strLitToConstructorWithPrimitives_plan_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.strLitToConstructor_plan_wf,
+  { root := ``Ix.Kernel.RecM.strLitToConstructor_plan_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionStringExpansion.ofPlans,
+  { root := ``Ix.Kernel.RecM.ProjectionStringExpansion.ofPlans,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionHelper.noAccelOfStringPlans,
+  { root := ``Ix.Kernel.RecM.ProjectionHelper.noAccelOfStringPlans,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   -- LazyIngress: instantiate the generic lazy-fault plumbing with production's
@@ -6801,37 +6785,37 @@ private def roots : Array RootAllowance := #[
   -- covers a successful load, an absent address, and an error-carried partial
   -- environment; hook identity remains visible because `TcState.lazyFault`
   -- otherwise stores an arbitrary function.
-  { root := ``Ix.Tc.LazyIngressEnvFrame.refl,
+  { root := ``Ix.Kernel.LazyIngressEnvFrame.refl,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.LazyIngressEnvFrame.kernelStateWF,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.LazyIngressEnvFrame.kernelStateWF,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.LazyIngressEnvFrame.ctxRecon,
+  { root := ``Ix.Kernel.LazyIngressEnvFrame.ctxRecon,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.LazyIngressEnvFrame.whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.LazyIngressEnvFrame.whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ingressAnonAddrShallow_absent,
+  { root := ``Ix.Kernel.ingressAnonAddrShallow_absent,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AnonIngressRefinement.absentOfVerifiedMiss,
+  { root := ``Ix.Kernel.AnonIngressRefinement.absentOfVerifiedMiss,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AnonIngressRefinement.error,
+  { root := ``Ix.Kernel.AnonIngressRefinement.error,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AnonIngressRefinement.lazyFaultPreserves,
+  { root := ``Ix.Kernel.AnonIngressRefinement.lazyFaultPreserves,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AnonLazyIngressContext,
+  { root := ``Ix.Kernel.AnonLazyIngressContext,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AnonLazyIngressContext.preserves,
+  { root := ``Ix.Kernel.AnonLazyIngressContext.preserves,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.ProjectionHelper.noAccelOfAnonIngress,
+  { root := ``Ix.Kernel.RecM.ProjectionHelper.noAccelOfAnonIngress,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
   -- NatOffset: the actual post-major iota preprocessing path.  Bounded Nat-offset
@@ -6839,64 +6823,64 @@ private def roots : Array RootAllowance := #[
   -- finite String expansion, the policy-selected recursive callback, and the
   -- constructor/struct-eta dispatch all preserve the complete K1 invariant.
   -- Only the ordinary-constructor and struct-eta tails remain named inputs.
-  { root := ``Ix.Tc.RecM.prims_state_wf,
+  { root := ``Ix.Kernel.RecM.prims_state_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatBinArithAddr_state_wf,
+  { root := ``Ix.Kernel.RecM.isNatBinArithAddr_state_wf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natOffsetReaders_state_wf,
+  { root := ``Ix.Kernel.RecM.natOffsetReaders_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natOffset_state_wf,
+  { root := ``Ix.Kernel.RecM.natOffset_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.evalNatOffsetLiteral_state_wf,
+  { root := ``Ix.Kernel.RecM.evalNatOffsetLiteral_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natToConstructor_state_wf,
+  { root := ``Ix.Kernel.RecM.natToConstructor_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.mkNatSucc_state_wf,
+  { root := ``Ix.Kernel.RecM.mkNatSucc_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.mkNatAdd_state_wf,
+  { root := ``Ix.Kernel.RecM.mkNatAdd_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.WF.with_run_eq,
+  { root := ``Ix.Kernel.TcM.WF.with_run_eq,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.OptionalGeneratedInput,
+  { root := ``Ix.Kernel.RecM.OptionalGeneratedInput,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatOffsetCleanupInputOracle,
-    standardAxioms := standardWithoutChoice,
+  { root := ``Ix.Kernel.RecM.NatOffsetCleanupInputOracle,
+    standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.cleanupNatOffsetMajor_state_wf,
+  { root := ``Ix.Kernel.RecM.cleanupNatOffsetMajor_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.cleanupNatOffsetMajor_input_wf,
+  { root := ``Ix.Kernel.RecM.cleanupNatOffsetMajor_input_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryApplyIotaCtorPreserves,
+  { root := ``Ix.Kernel.RecM.TryApplyIotaCtorPreserves,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaIotaPreserves,
+  { root := ``Ix.Kernel.RecM.StructEtaIotaPreserves,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.SelectedStructEtaIotaPreserves,
+  { root := ``Ix.Kernel.RecM.SelectedStructEtaIotaPreserves,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_state_wf,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_state_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.strLitToConstructor_context_wf,
+  { root := ``Ix.Kernel.RecM.strLitToConstructor_context_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaAfterCleanup_state_wf,
+  { root := ``Ix.Kernel.RecM.tryIotaAfterCleanup_state_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaAfterMajorWhnf_state_wf,
+  { root := ``Ix.Kernel.RecM.tryIotaAfterMajorWhnf_state_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- ApplicationRequests--Ingress: finite ordinary-iota, struct-eta, and K-synthesis request
@@ -6904,123 +6888,125 @@ private def roots : Array RootAllowance := #[
   -- exhausts the actual tryIotaWithFlags state path through lazy lookup,
   -- caught probes, both cleanup stages, policy-selected major callbacks,
   -- statistics updates, and the final uncaught DefEq callback.
-  { root := ``Ix.Tc.RecM.IotaArgsInternRequests,
+  { root := ``Ix.Kernel.RecM.IotaArgsInternRequests,
     standardAxioms := standardWithoutQuot, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IotaArgsInternRequests.wfList,
+  { root := ``Ix.Kernel.RecM.IotaArgsInternRequests.wfList,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IotaArgsInternRequests.wfArray,
+  { root := ``Ix.Kernel.RecM.IotaArgsInternRequests.wfArray,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArg_true_state_wf,
+  { root := ``Ix.Kernel.RecM.applyIotaArg_true_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaArgs_true_state_wf,
+  { root := ``Ix.Kernel.RecM.applyIotaArgs_true_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IotaRuleRequests,
+  { root := ``Ix.Kernel.RecM.IotaRuleRequests,
+    standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IotaRuleRequestCensus,
+  { root := ``Ix.Kernel.RecM.IotaRuleRequestCensus,
+    standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.applyIotaRule_state_wf_of_requests,
+  { root := ``Ix.Kernel.RecM.applyIotaRule_state_wf_of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryApplyIotaCtor_state_wf_of_requests,
+  { root := ``Ix.Kernel.RecM.tryApplyIotaCtor_state_wf_of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryApplyIotaCtorPreserves.of_requests,
+  { root := ``Ix.Kernel.RecM.TryApplyIotaCtorPreserves.of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaFinishRequests,
+  { root := ``Ix.Kernel.RecM.StructEtaFinishRequests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaFinishRequestCensus,
+  { root := ``Ix.Kernel.RecM.StructEtaFinishRequestCensus,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaFinishPreserves.of_requests,
+  { root := ``Ix.Kernel.RecM.StructEtaFinishPreserves.of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructEtaIotaPreserves.of_components,
+  { root := ``Ix.Kernel.RecM.StructEtaIotaPreserves.of_components,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaAfterMajorWhnf_state_wf_of_contexts,
+  { root := ``Ix.Kernel.RecM.tryIotaAfterMajorWhnf_state_wf_of_contexts,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqCallbackPreserves,
+  { root := ``Ix.Kernel.RecM.IsDefEqCallbackPreserves,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.WF.tryFinally_const,
+  { root := ``Ix.Kernel.TcM.WF.tryFinally_const,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.enterDispatch_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.enterDispatch_whnf_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.exitDispatch_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.exitDispatch_whnf_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.callIsDefEq_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.callIsDefEq_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.KSynthCandidateRequests,
+  { root := ``Ix.Kernel.RecM.KSynthCandidateRequests,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.KSynthCandidateRequestCensus,
+  { root := ``Ix.Kernel.RecM.KSynthCandidateRequestCensus,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.KSynthCandidateInputs,
+  { root := ``Ix.Kernel.RecM.KSynthCandidateInputs,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.KSynthCandidateInputOracle,
-    standardAxioms := standardWithoutChoice,
+  { root := ``Ix.Kernel.RecM.KSynthCandidateInputOracle,
+    standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.state_wf,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.state_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.verifyKSynthCandidate_state_wf_of_requests,
+  { root := ``Ix.Kernel.RecM.verifyKSynthCandidate_state_wf_of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_state_wf_of_requests,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_state_wf_of_requests,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_state_wf_of_requests,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_state_wf_of_requests,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.verifyKSynthCandidate_state_wf_of_inputs,
+  { root := ``Ix.Kernel.RecM.verifyKSynthCandidate_state_wf_of_inputs,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.selectKSynthCandidate_state_wf_of_inputs,
+  { root := ``Ix.Kernel.RecM.selectKSynthCandidate_state_wf_of_inputs,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.synthCtorWhenK_state_wf_of_inputs,
+  { root := ``Ix.Kernel.RecM.synthCtorWhenK_state_wf_of_inputs,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_state_wf_of_contexts,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_state_wf_of_contexts,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- OptionalReduction: the exhaustive state proof and the direct admission-owned success
   -- boundary assemble the ordinary optional-reduction contract.  The success
   -- boundary contributes support and Theory meaning only; it cannot hide an
   -- error-side or miss-side state assumption.
-  { root := ``Ix.Tc.IotaCallbackFrameOracle,
+  { root := ``Ix.Kernel.IotaCallbackFrameOracle,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.IotaSuccessOracle,
+  { root := ``Ix.Kernel.IotaSuccessOracle,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaWithFlags_optional_wf_of_contexts,
+  { root := ``Ix.Kernel.RecM.tryIotaWithFlags_optional_wf_of_contexts,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   -- Reducer: the structural contract is indexed by the actual universe/context
   -- represented by the cache model.  The assembled theorem feeds OptionalReduction into
   -- the exhaustive syntax step and then through the bounded/cache driver.
-  { root := ``Ix.Tc.StructuralReduction.WF,
+  { root := ``Ix.Kernel.StructuralReduction.WF,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructuralCoreContext,
+  { root := ``Ix.Kernel.RecM.StructuralCoreContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.StructuralCoreContext.wf,
+  { root := ``Ix.Kernel.RecM.StructuralCoreContext.wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -7029,33 +7015,33 @@ private def roots : Array RootAllowance := #[
   -- and successful projection followed by a certified complete-spine
   -- rebuild.  Head meaning is transported through the typed suffix rather
   -- than inferred from expression-address equality.
-  { root := ``Ix.Tc.RecM.tryProjAppReduce_empty,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduce_empty,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduce_notProjection,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduce_notProjection,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduce_projectionWhnfError,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduce_projectionWhnfError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduce_projectionReduceError,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduce_projectionReduceError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduce_projectionNone,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduce_projectionNone,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduce_projectionSome,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduce_projectionSome,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduceFinished_empty_wf,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduceFinished_empty_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProjAppReduceFinished_app_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduceFinished_app_optional_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryProjAppReduceFinished_optional_wf_of_contexts,
+      ``Ix.Kernel.RecM.tryProjAppReduceFinished_optional_wf_of_contexts,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -7063,38 +7049,39 @@ private def roots : Array RootAllowance := #[
   -- classifier miss and all three hits.  Its state proof derives finite
   -- generated-node support at each intern; the reflection boundary owns
   -- only Theory meaning for an observed successful run.
-  { root := ``Ix.Tc.StringReductionSupport,
+  { root := ``Ix.Kernel.StringReductionSupport,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.StringReductionReflection,
+  { root := ``Ix.Kernel.StringReductionReflection,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceString_inv_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceString_inv_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceString_optional_wf_of_reflection,
+  { root := ``Ix.Kernel.RecM.tryReduceString_optional_wf_of_reflection,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
   -- ProjectionDefinition: projection-wrapper reduction covers the real lazy constant lookup,
   -- the generated projection, and every suffix intern.  The request plan
   -- exposes all intermediate support obligations instead of assuming that
   -- support for the final node retroactively makes those interns safe.
-  { root := ``Ix.Tc.ProjectionDefinitionRequestCensus,
+  { root := ``Ix.Kernel.ProjectionDefinitionRequestCensus,
+    standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ProjectionDefinitionReflection,
+  { root := ``Ix.Kernel.ProjectionDefinitionReflection,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.projectionDefinitionFinish_eq,
+  { root := ``Ix.Kernel.RecM.projectionDefinitionFinish_eq,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.FinishAppRequests.finishAppResult_wf,
+  { root := ``Ix.Kernel.RecM.FinishAppRequests.finishAppResult_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceProjectionDefinition_inv_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceProjectionDefinition_inv_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceProjectionDefinition_optional_wf_of_contexts,
+      ``Ix.Kernel.RecM.tryReduceProjectionDefinition_optional_wf_of_contexts,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
   -- Quotient: quotient reduction derives the selected major's support and
@@ -7105,83 +7092,83 @@ private def roots : Array RootAllowance := #[
   -- laws.  Ix owns the complete dynamic trace, exact lift/ind layouts,
   -- normalized `Quot.mk` transport, collision-free base intern, and suffix
   -- reconstruction.
-  { root := ``Ix.Tc.QuotientReductionRequestCensus,
+  { root := ``Ix.Kernel.QuotientReductionRequestCensus,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.QuotientReductionReflection,
+  { root := ``Ix.Kernel.QuotientReductionReflection,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.QuotientReductionLaws,
+  { root := ``Ix.Kernel.QuotientReductionLaws,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.three,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.three,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.four,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.four,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.five,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.five,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrKExprS.const_name,
+  { root := ``Ix.Kernel.RecM.TrKExprS.const_name,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.quotientLiftMeaning,
+  { root := ``Ix.Kernel.RecM.quotientLiftMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.quotientIndMeaning,
+  { root := ``Ix.Kernel.RecM.quotientIndMeaning,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.QuotientSelectedSuccessTrace.complete,
+  { root := ``Ix.Kernel.RecM.QuotientSelectedSuccessTrace.complete,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.QuotientSelectedSuccessTrace.semanticInputs,
+  { root := ``Ix.Kernel.RecM.QuotientSelectedSuccessTrace.semanticInputs,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.QuotientSelectedSuccessTrace.liftMeaning,
+  { root := ``Ix.Kernel.RecM.QuotientSelectedSuccessTrace.liftMeaning,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.QuotientSelectedSuccessTrace.indMeaning,
+  { root := ``Ix.Kernel.RecM.QuotientSelectedSuccessTrace.indMeaning,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.QuotientReductionReflection.of_laws,
+  { root := ``Ix.Kernel.QuotientReductionReflection.of_laws,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryQuotReduceSelected,
+  { root := ``Ix.Kernel.RecM.tryQuotReduceSelected,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryQuotReduceSelected_inv_wf,
+  { root := ``Ix.Kernel.RecM.tryQuotReduceSelected_inv_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryQuotReduce_inv_wf,
+  { root := ``Ix.Kernel.RecM.tryQuotReduce_inv_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryQuotReduce_optional_wf_of_contexts,
+  { root := ``Ix.Kernel.RecM.tryQuotReduce_optional_wf_of_contexts,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
   -- BaseReductions: the five active no-acceleration reducers are assembled into the
   -- exact production base oracle for either successor policy.  Native and
   -- BitVec remain independently discharged by the no-acceleration gate.
-  { root := ``Ix.Tc.RecM.NoDeltaBaseContext,
+  { root := ``Ix.Kernel.RecM.NoDeltaBaseContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NoDeltaBaseContext.oracle,
+  { root := ``Ix.Kernel.RecM.NoDeltaBaseContext.oracle,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   -- Reducer: Reducer's structural reducer and BaseReductions's active base oracle now feed
   -- the real bounded, keyed, transient-aware, cache-writing public
   -- `whnfNoDeltaImpl` shell for every flag and successor policy.
-  { root := ``Ix.Tc.RecM.NoDeltaDriverContext,
+  { root := ``Ix.Kernel.RecM.NoDeltaDriverContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NoDeltaDriverContext.wf,
+  { root := ``Ix.Kernel.RecM.NoDeltaDriverContext.wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -7191,279 +7178,279 @@ private def roots : Array RootAllowance := #[
   -- the bare fallback closes `deltaUnfoldOne`.  The final cache composition
   -- and method knot are indexed by the active universe count; concrete lazy
   -- ingress is carried by `AnonLazyIngressContext`, not a free callback.
-  { root := ``Ix.Tc.OptionalReduction.WFAt,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.OptionalReduction.WFAt,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrustedDeltaBody.meaning,
+  { root := ``Ix.Kernel.TrustedDeltaBody.meaning,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.StableWhnfTheory,
+  { root := ``Ix.Kernel.StableWhnfTheory,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrustedDeltaBody.unfoldCacheProvenance,
+  { root := ``Ix.Kernel.TrustedDeltaBody.unfoldCacheProvenance,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.unfoldConstValue_trusted_wf,
+  { root := ``Ix.Kernel.RecM.unfoldConstValue_trusted_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrustedDeltaCensus,
-    standardAxioms := standard,
+  { root := ``Ix.Kernel.TrustedDeltaCensus,
+    standardAxioms := standard, nativeAxioms := univOnlyNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDeltaUnfold_trusted_wf,
+  { root := ``Ix.Kernel.RecM.tryDeltaUnfold_trusted_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.deltaUnfoldOne_trusted_wf,
+  { root := ``Ix.Kernel.RecM.deltaUnfoldOne_trusted_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrustedDeltaContext,
+  { root := ``Ix.Kernel.RecM.TrustedDeltaContext,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrustedDeltaContext.wfAt,
+  { root := ``Ix.Kernel.RecM.TrustedDeltaContext.wfAt,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.FullWhnfStepContext.ofTrustedDelta,
+  { root := ``Ix.Kernel.RecM.FullWhnfStepContext.ofTrustedDelta,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.WhnfClosedAt,
+  { root := ``Ix.Kernel.Methods.WhnfClosedAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.Methods.methodsN_wfAt,
+  { root := ``Ix.Kernel.Methods.methodsN_wfAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.K1ClosureContext,
+  { root := ``Ix.Kernel.RecM.K1ClosureContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.K1ClosureContext.closedAt,
+  { root := ``Ix.Kernel.RecM.K1ClosureContext.closedAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.AmbientNat.structEtaInferOnlyRun,
+  { root := ``Ix.Kernel.AmbientNat.structEtaInferOnlyRun,
     standardAxioms := standard, nativeAxioms := expressionNameNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structEtaOptionalInferOnlyRun,
+  { root := ``Ix.Kernel.AmbientNat.structEtaOptionalInferOnlyRun,
     standardAxioms := standard, nativeAxioms := expressionNameNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_nonConst,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_nonConst,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_missing,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_missing,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_notConstructor,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_notConstructor,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_lookupError,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_lookupError,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryIotaCtorOrStructEta_constructor,
+  { root := ``Ix.Kernel.RecM.tryIotaCtorOrStructEta_constructor,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structEtaIotaSuccess,
+  { root := ``Ix.Kernel.AmbientNat.structEtaIotaSuccess,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structEtaBuildRequests,
+  { root := ``Ix.Kernel.AmbientNat.structEtaBuildRequests,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structEtaDispatchSuccess,
+  { root := ``Ix.Kernel.AmbientNat.structEtaDispatchSuccess,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structEtaIotaAbsent,
+  { root := ``Ix.Kernel.AmbientNat.structEtaIotaAbsent,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structEtaIotaCaughtInferError,
+  { root := ``Ix.Kernel.AmbientNat.structEtaIotaCaughtInferError,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := legacyWholeEnv },
 
-  { root := ``Ix.Tc.AmbientNat.iotaCleanupOfNatValue,
+  { root := ``Ix.Kernel.AmbientNat.iotaCleanupOfNatValue,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatCleanup,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatCleanup,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatCtorCleanup,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatCtorCleanup,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatMajorWhnf,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatMajorWhnf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatZeroExpand,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatZeroExpand,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatSuccExpand,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatSuccExpand,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatApplyRule,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatApplyRule,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatApplyCtor,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatApplyCtor,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatTryEval,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatTryEval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatStepEval,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatStepEval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaNatCoreEval,
+  { root := ``Ix.Kernel.AmbientNat.iotaNatCoreEval,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaApplyRule,
+  { root := ``Ix.Kernel.AmbientNat.iotaApplyRule,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaApplyCtor,
+  { root := ``Ix.Kernel.AmbientNat.iotaApplyCtor,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.support_le_iotaArgsSupport,
+  { root := ``Ix.Kernel.AmbientNat.support_le_iotaArgsSupport,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaArgsStateInv,
+  { root := ``Ix.Kernel.AmbientNat.iotaArgsStateInv,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaArgsSupport_head,
+  { root := ``Ix.Kernel.AmbientNat.iotaArgsSupport_head,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.iotaArgsSupport_source,
+  { root := ``Ix.Kernel.AmbientNat.iotaArgsSupport_source,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckIotaTransientThreeSegments,
+  { root := ``Ix.Kernel.AmbientNat.appStuckIotaTransientThreeSegments,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaFirstResult,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaFirstResult,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaSecondResult,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaSecondResult,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckHead_constructed,
+  { root := ``Ix.Kernel.AmbientNat.appStuckHead_constructed,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiBetaInner_constructed,
+  { root := ``Ix.Kernel.AmbientNat.multiBetaInner_constructed,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaIntermediate_constructed,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaIntermediate_constructed,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckHead_tr_ctx,
+  { root := ``Ix.Kernel.AmbientNat.appStuckHead_tr_ctx,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.appStuckHead_type_ctx,
+  { root := ``Ix.Kernel.AmbientNat.appStuckHead_type_ctx,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaIntermediate_tr,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaIntermediate_tr,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.support_le_multiIotaSupport,
+  { root := ``Ix.Kernel.AmbientNat.support_le_multiIotaSupport,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaStateInv,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaStateInv,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaSupport_start,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaSupport_start,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaSupport_intermediate,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaSupport_intermediate,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaSupport_head,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaSupport_head,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaSupport_result,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaSupport_result,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaFirstTrace,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaFirstTrace,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaSecondTrace,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaSecondTrace,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaThirdTrace,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaThirdTrace,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaTransientThreeSegments,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaTransientThreeSegments,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaPrefixSlice,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaPrefixSlice,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaFieldSlice,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaFieldSlice,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaTrailingSlice,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaTrailingSlice,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaRuleEval,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaRuleEval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaRuleAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaRuleAcceptance,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaCtorEval,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaCtorEval,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiIotaCtorAcceptance,
+  { root := ``Ix.Kernel.AmbientNat.multiIotaCtorAcceptance,
     standardAxioms := standard, nativeAxioms := levelNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.missingRuleDescriptor,
+  { root := ``Ix.Kernel.AmbientNat.missingRuleDescriptor,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.missingRuleDescriptor_noZeroRule,
+  { root := ``Ix.Kernel.AmbientNat.missingRuleDescriptor_noZeroRule,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.multiBetaMiddleSplit,
+  { root := ``Ix.Kernel.AmbientNat.multiBetaMiddleSplit,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.multiBetaMiddleRebase,
+  { root := ``Ix.Kernel.AmbientNat.multiBetaMiddleRebase,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.linearRecPartsRun,
+  { root := ``Ix.Kernel.AmbientNat.linearRecPartsRun,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.AmbientNat.linearRecPartsTrace,
+  { root := ``Ix.Kernel.AmbientNat.linearRecPartsTrace,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.TcM.LazyFaultPreserves.of_none,
+  { root := ``Ix.Kernel.TcM.LazyFaultPreserves.of_none,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.natRecLiteralParts_wf,
+  { root := ``Ix.Kernel.RecM.natRecLiteralParts_wf,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsPreserves.of_lazy,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsPreserves.of_lazy,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatRecLiteralPartsPreserves.eager,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.NatRecLiteralPartsPreserves.eager,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatLiteralRecursorApp_wf,
+  { root := ``Ix.Kernel.RecM.isNatLiteralRecursorApp_wf,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.isTransientNatLiteralWork_wf,
+  { root := ``Ix.Kernel.RecM.isTransientNatLiteralWork_wf,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.TransientNatWork.preserving,
+  { root := ``Ix.Kernel.RecM.TransientNatWork.preserving,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isTransientNatLiteralWork_noLazy,
+  { root := ``Ix.Kernel.RecM.isTransientNatLiteralWork_noLazy,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.TransientNatWork.eager,
+  { root := ``Ix.Kernel.RecM.TransientNatWork.eager,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -7472,100 +7459,100 @@ private def roots : Array RootAllowance := #[
   -- every partial error state.  The semantic package composes structural and
   -- reducer meanings, while the closed Nat.add fixture makes precedence
   -- executable and records its three canonical-address decisions explicitly.
-  { root := ``Ix.Tc.RecM.tryProjAppReduceFinished_some,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduceFinished_some,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryProjAppReduceFinished_none,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduceFinished_none,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryProjAppReduceFinished_projError,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduceFinished_projError,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.tryProjAppReduceFinished_finishError,
+  { root := ``Ix.Kernel.RecM.tryProjAppReduceFinished_finishError,
     standardAxioms := standard, nativeAxioms := expressionNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_projApp,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_projApp,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_bitvec,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_bitvec,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_nat,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_nat,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_native,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_native,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_string,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_string,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_projectionDef,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_projectionDef,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_quotFull,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_quotFull,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_quotCheap,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_quotCheap,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_doneFull,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_doneFull,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_doneCheap,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_doneCheap,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_projError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_projError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_bitvecError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_bitvecError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_natError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_natError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_nativeError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_nativeError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_stringError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_stringError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_projectionDefError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_projectionDefError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_quotFullError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_quotFullError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_quotCheapError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_quotCheapError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_ofCore,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_ofCore,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_coreError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_coreError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_reducerError,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_reducerError,
     standardAxioms := standard, nativeAxioms := inferNative },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_next_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_next_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_done_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_done_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_error_acceptance,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_error_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatAddReduction,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatAddReduction,
     standardAxioms := standard, nativeAxioms := natReductionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatBranchOrder,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatBranchOrder,
     standardAxioms := standard, nativeAxioms := natBranchOrderNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- primitive reduction: `.noAccel` concretely discharges the native and BitVec optional
   -- reducers.  The five active helpers remain an explicit base oracle, which
   -- now feeds the exhaustive tail, outer step, and public no-delta shell.
-  { root := ``Ix.Tc.RecM.tryReduceNative_noAccel_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNative_noAccel_optional_wf,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceBitvec_noAccel_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceBitvec_noAccel_optional_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaBaseOracle.toNoAccel,
+  { root := ``Ix.Kernel.NoDeltaBaseOracle.toNoAccel,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaReducersStep_noAccel_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaReducersStep_noAccel_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImplStep_noAccel_wf,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImplStep_noAccel_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNoDeltaImpl_noAccel_wf_of_base,
+  { root := ``Ix.Kernel.RecM.whnfNoDeltaImpl_noAccel_wf_of_base,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -7575,69 +7562,69 @@ private def roots : Array RootAllowance := #[
   -- reducer closure.  The world/context interface then binds the active Nat,
   -- String, projection, and quotient IDs to trusted Theory names and scopes
   -- generated results to actual successful helper executions.
-  { root := ``Ix.Tc.Primitives.ofAnonAddrs_canonical,
+  { root := ``Ix.Kernel.Primitives.ofAnonAddrs_canonical,
     standardAxioms := standard, nativeAxioms := canonicalPrimitivesNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfStateInv.noAccel_primitives,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.WhnfStateInv.noAccel_primitives,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfStateInv.accelerated_primitives,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.WhnfStateInv.accelerated_primitives,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.PrimitiveIdAgrees.contains,
+  { root := ``Ix.Kernel.PrimitiveIdAgrees.contains,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.PrimitiveIdAgrees.mono,
+  { root := ``Ix.Kernel.PrimitiveIdAgrees.mono,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaPrimitiveTableAgrees.mono,
+  { root := ``Ix.Kernel.NoDeltaPrimitiveTableAgrees.mono,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaPrimitiveContext.stateTable,
+  { root := ``Ix.Kernel.NoDeltaPrimitiveContext.stateTable,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
   -- Nat reducer callback: the Nat reducer's shared callback/fuel boundary and exact binary
   -- arithmetic hit.  The primitive computation is derived from the bound
-  -- canonical table and Lean4Lean reflection laws; no raw address equality
+  -- canonical table and Ix.Theory.Named reflection laws; no raw address equality
   -- is treated as semantic authority.
-  { root := ``Ix.Tc.WhnfStateInv.set_recFuel,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.WhnfStateInv.set_recFuel,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.WF.tryCatch,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.WF.tryCatch,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfRec_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.whnfRec_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNatReducerArg_post_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.whnfNatReducerArg_post_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNatReducerArg_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.whnfNatReducerArg_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaPrimitiveContext.computeNatBin_defeq,
+  { root := ``Ix.Kernel.NoDeltaPrimitiveContext.computeNatBin_defeq,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrKExprS.of_extractNatLit,
+  { root := ``Ix.Kernel.TrKExprS.of_extractNatLit,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrKExprS.natExprFromValue,
+  { root := ``Ix.Kernel.TrKExprS.natExprFromValue,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrKExprS.natBinExact_inv,
+  { root := ``Ix.Kernel.TrKExprS.natBinExact_inv,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfPost.of_extractNatLit,
+  { root := ``Ix.Kernel.WhnfPost.of_extractNatLit,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.natBinExact,
+  { root := ``Ix.Kernel.WhnfMeaning.natBinExact,
     standardAxioms := standard, sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithExact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithExact,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithExact_acceptance,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithExact_acceptance,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -7645,35 +7632,35 @@ private def roots : Array RootAllowance := #[
   -- generic proof uses trusted-name separation instead of native hash
   -- inequalities, and the finite Bool intern is checked against explicit run
   -- collision freedom and generated-node support.
-  { root := ``Ix.Tc.TcM.intern_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.TcM.intern_whnf_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.intern_whnf_eval,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.TcM.intern_whnf_eval,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.PrimitiveIdAgrees.addr_ne,
+  { root := ``Ix.Kernel.PrimitiveIdAgrees.addr_ne,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaPrimitiveContext.computeNatBin_classifiers,
+  { root := ``Ix.Kernel.NoDeltaPrimitiveContext.computeNatBin_classifiers,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaPrimitiveContext.natPredicate_classifiers,
+  { root := ``Ix.Kernel.NoDeltaPrimitiveContext.natPredicate_classifiers,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.NoDeltaPrimitiveContext.natPredicate_defeq,
+  { root := ``Ix.Kernel.NoDeltaPrimitiveContext.natPredicate_defeq,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrKExprS.boolExprFromDecision,
+  { root := ``Ix.Kernel.TrKExprS.boolExprFromDecision,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_exact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_exact,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredExact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredExact,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredExact_acceptance,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredExact_acceptance,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -7681,118 +7668,118 @@ private def roots : Array RootAllowance := #[
   -- reduction.  Callback errors retain their partial state, arithmetic and
   -- predicate extraction order is pinned, and the complete two-argument
   -- dispatcher preserves the invariant on every outcome.
-  { root := ``Ix.Tc.RecM.WF.withInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.WF.withInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.prims_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.prims_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatBinArithAddr_inv_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.isNatBinArithAddr_inv_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatBinPredAddr_inv_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.isNatBinPredAddr_inv_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNatReducerArg_ok_inv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.whnfNatReducerArg_ok_inv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.whnfNatReducerArg_error_inv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.whnfNatReducerArg_error_inv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_bin_inv_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_bin_inv_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_bin_inv_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_bin_inv_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_argAMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_argAMiss,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_argAError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_argAError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_extractAMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_extractAMiss,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_argBMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_argBMiss,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_argBError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_argBError,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_extractBMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_extractBMiss,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithArgAMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithArgAMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithArgAError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithArgAError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithArgBMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithArgBMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithArgBError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithArgBError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithExtractAMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithExtractAMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithExtractBMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithExtractBMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithComputeMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithComputeMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
   -- binary Nat success: every successful exact-binary Nat run is inverted into its actual
   -- callback/extraction/computation-or-intern trace, then folded into a
   -- semantic optional-reduction Hoare slice.  Predicate precedence remains
   -- operationally exhaustive even before canonical classifier separation.
-  { root := ``Ix.Tc.RecM.isNatBinArithAddr_eval,
+  { root := ``Ix.Kernel.RecM.isNatBinArithAddr_eval,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatBinPredAddr_eval,
+  { root := ``Ix.Kernel.RecM.isNatBinPredAddr_eval,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatBinPredAddr_true,
+  { root := ``Ix.Kernel.RecM.isNatBinPredAddr_true,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredAnyExact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredAnyExact,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatPredicateSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.NatPredicateSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatPredicateSuccessTrace.complete,
+  { root := ``Ix.Kernel.RecM.NatPredicateSuccessTrace.complete,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatBinSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.NatBinSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatBinSuccessTrace.complete,
+  { root := ``Ix.Kernel.RecM.NatBinSuccessTrace.complete,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatBinSuccessTrace.acceptance,
+  { root := ``Ix.Kernel.RecM.NatBinSuccessTrace.acceptance,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_bin_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_bin_optional_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.structuralInvariant_does_not_bind_primitives,
+  { root := ``Ix.Kernel.AmbientNat.structuralInvariant_does_not_bind_primitives,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.productionNoAccelStateInv,
+  { root := ``Ix.Kernel.AmbientNat.productionNoAccelStateInv,
     standardAxioms := standard, nativeAxioms := nameNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noAccelInvariant_rejects_mismatched_primitives,
+  { root := ``Ix.Kernel.AmbientNat.noAccelInvariant_rejects_mismatched_primitives,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -7800,80 +7787,80 @@ private def roots : Array RootAllowance := #[
   -- spine, exact Nat equations are transported over arbitrary unchanged
   -- argument suffixes, and finite rebuild certificates preserve state and
   -- support.  Successful general-spine executions are inverted exhaustively.
-  { root := ``Ix.Tc.RecM.appSpineView_go,
+  { root := ``Ix.Kernel.RecM.appSpineView_go,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.appSpineView_collectSpine,
+  { root := ``Ix.Kernel.RecM.appSpineView_collectSpine,
     standardAxioms := standardWithoutChoice },
-  { root := ``Ix.Tc.RecM.trAppSpine_of_tr,
+  { root := ``Ix.Kernel.RecM.trAppSpine_of_tr,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.argument,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.argument,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.tr,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.tr,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.trAppSpine_of_collectSpine,
+  { root := ``Ix.Kernel.RecM.trAppSpine_of_collectSpine,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TrKExprS.foldlMkApp_initial,
+  { root := ``Ix.Kernel.TrKExprS.foldlMkApp_initial,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.appSameArg,
+  { root := ``Ix.Kernel.WhnfMeaning.appSameArg,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.foldlMkApp,
+  { root := ``Ix.Kernel.WhnfMeaning.foldlMkApp,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.mkAppN,
+  { root := ``Ix.Kernel.WhnfMeaning.mkAppN,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfMeaning.ofSharedSourceTranslation,
+  { root := ``Ix.Kernel.WhnfMeaning.ofSharedSourceTranslation,
     standardAxioms := standard, sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_suffixExact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_suffixExact,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredSuffixExact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredSuffixExact,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithSuffixExact,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithSuffixExact,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binArithSuffix_acceptance,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binArithSuffix_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_binPredSuffix_acceptance,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_binPredSuffix_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatPredicateSuffixSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.NatPredicateSuffixSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatPredicateSuffixSuccessTrace.complete,
+  { root := ``Ix.Kernel.RecM.NatPredicateSuffixSuccessTrace.complete,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSpineSuccessTrace.eval,
+  { root := ``Ix.Kernel.RecM.NatSpineSuccessTrace.eval,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSpineSuccessTrace.complete,
+  { root := ``Ix.Kernel.RecM.NatSpineSuccessTrace.complete,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatAddSuffixSpine,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatAddSuffixSpine,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatAddSuffixFinishRequests,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatAddSuffixFinishRequests,
     standardAxioms := standard,
     nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatAddSuffixReduction,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatAddSuffixReduction,
     standardAxioms := standard, nativeAxioms := natSuffixReductionNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -7882,33 +7869,33 @@ private def roots : Array RootAllowance := #[
   -- with only its observed finite rebuild requests, then interpreted as the
   -- fixed-state optional-reduction Hoare contract.  The over-applied Nat.add
   -- fixture inhabits that execution-indexed coverage boundary.
-  { root := ``Ix.Tc.RecM.finishAppResult_total,
+  { root := ``Ix.Kernel.RecM.finishAppResult_total,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natBinSpine_inputs,
+  { root := ``Ix.Kernel.RecM.natBinSpine_inputs,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatPredicate_spine_nonhit_inv,
+  { root := ``Ix.Kernel.RecM.tryReduceNatPredicate_spine_nonhit_inv,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_spine_nonhit_inv,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_spine_nonhit_inv,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSpineCertifiedSuccess.trace,
+  { root := ``Ix.Kernel.RecM.NatSpineCertifiedSuccess.trace,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSpineCertifiedSuccess.acceptance,
+  { root := ``Ix.Kernel.RecM.NatSpineCertifiedSuccess.acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_spine_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_spine_optional_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatAddSuffixCertifiedSuccess,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatAddSuffixCertifiedSuccess,
     standardAxioms := standard, nativeAxioms := natSuffixCertificateNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.noDeltaNatAddSuffixFinishCoverage,
+  { root := ``Ix.Kernel.AmbientNat.noDeltaNatAddSuffixFinishCoverage,
     standardAxioms := standard, nativeAxioms := natSuffixReductionNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -7918,111 +7905,111 @@ private def roots : Array RootAllowance := #[
   -- cache/state invariant only under explicit per-key provenance.  The
   -- closed Nat.succ fixture runs through the actual dispatcher and bounded
   -- driver without mutating the state.
-  { root := ``Ix.Tc.CacheInvariant.insertNatSuccStuck,
+  { root := ``Ix.Kernel.CacheInvariant.insertNatSuccStuck,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.insertNatSuccStuckList,
+  { root := ``Ix.Kernel.CacheInvariant.insertNatSuccStuckList,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.insertNatSuccStuckArray,
+  { root := ``Ix.Kernel.CacheInvariant.insertNatSuccStuckArray,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSuccStuckCacheUpdate.fold_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.NatSuccStuckCacheUpdate.fold_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIter_entryHit,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIter_entryHit,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIter_entryKeyError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIter_entryKeyError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIter_entryMiss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIter_entryMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIterStep_linearHit,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIterStep_linearHit,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIterStep_linearError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIterStep_linearError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIterStep_whnfError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIterStep_whnfError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIterStep_afterWhnf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIterStep_afterWhnf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccAfterWhnf_literal,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccAfterWhnf_literal,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccAfterWhnf_stuck,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccAfterWhnf_stuck,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.recordNatSuccStuck_eval,
+  { root := ``Ix.Kernel.RecM.recordNatSuccStuck_eval,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.recordNatSuccStuck_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.recordNatSuccStuck_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeel_keyError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeel_keyError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeel_afterKey,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeel_afterKey,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeelAfterKey_hit,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeelAfterKey_hit,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeelAfterKey_miss,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeelAfterKey_miss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeelMiss_keyError,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeelMiss_keyError,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeelMiss_next,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeelMiss_next,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccAfterWhnf_succ,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccAfterWhnf_succ,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_succ_stuck,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_succ_stuck,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_succ_collapse,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_succ_collapse,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseSpine,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseSpine,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseLinearMiss,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseLinearMiss,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseWhnf,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseWhnf,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseExtract,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseExtract,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseStep,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseStep,
     standardAxioms := standard,
     nativeAxioms := contextNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseKey,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseKey,
     standardAxioms := standard,
     nativeAxioms := contextNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseMemoMiss,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseMemoMiss,
     standardAxioms := standard,
     nativeAxioms := expressionNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseIter,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseIter,
     standardAxioms := standard,
     nativeAxioms := contextNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succCollapseReduction,
+  { root := ``Ix.Kernel.AmbientNat.succCollapseReduction,
     standardAxioms := standard,
     nativeAxioms := contextNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
@@ -8032,34 +8019,34 @@ private def roots : Array RootAllowance := #[
   -- provenance; the ghost loop state tracks Nat typing, arbitrary successor
   -- offsets, and every pending marker.  Linear Nat.rec recognition remains
   -- behind its explicit oracle until inductive iota semantics instantiate it.
-  { root := ``Ix.Tc.WhnfCacheValid.natSuccStuck,
+  { root := ``Ix.Kernel.WhnfCacheValid.natSuccStuck,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheProvenance.whnfNatSuccStuck,
+  { root := ``Ix.Kernel.CacheProvenance.whnfNatSuccStuck,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSuccStuckWriteOracle.forWhnfCache,
+  { root := ``Ix.Kernel.RecM.NatSuccStuckWriteOracle.forWhnfCache,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natSucc_hasType,
+  { root := ``Ix.Kernel.RecM.natSucc_hasType,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natSuccSpine_tr,
+  { root := ``Ix.Kernel.RecM.natSuccSpine_tr,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccPeel_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccPeel_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccAfterWhnf_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccAfterWhnf_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIterStep_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIterStep_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccIter_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccIter_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8073,66 +8060,66 @@ private def roots : Array RootAllowance := #[
   -- while successful callback meaning reduces the former exact-arity
   -- assumption to canonical Nat/Bool result-shape separation.  Nat.rec
   -- reflection and that Theory shape fact remain explicit.
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_succ_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_succ_optional_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.NatCollapseRequestCensus.suffix_eq_empty_of_result_shape,
+      ``Ix.Kernel.RecM.NatCollapseRequestCensus.suffix_eq_empty_of_result_shape,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatCollapseRequestCensus.of_no_suffix,
+  { root := ``Ix.Kernel.RecM.NatCollapseRequestCensus.of_no_suffix,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatCollapseRequestCensus.of_result_shape,
+  { root := ``Ix.Kernel.RecM.NatCollapseRequestCensus.of_result_shape,
     standardAxioms := standard, nativeAxioms := contextNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatCollapseRequestCensus.certify,
+  { root := ``Ix.Kernel.RecM.NatCollapseRequestCensus.certify,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatSuccIhStep_wf,
+  { root := ``Ix.Kernel.RecM.isNatSuccIhStep_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatSuccLinearRec_effect_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatSuccLinearRec_effect_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSuccLinearOracle.of_reflection,
+  { root := ``Ix.Kernel.RecM.NatSuccLinearOracle.of_reflection,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_collapse_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_collapse_optional_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_collapse_optional_wf_of_boundaries,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_collapse_optional_wf_of_boundaries,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_stuck_short,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_stuck_short,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryReduceNatWithSuccMode_stuck_optional_wf,
+  { root := ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_stuck_optional_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_stuck_optional_wf_of_boundary,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_stuck_optional_wf_of_boundary,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_optional_wf_of_boundaries,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_optional_wf_of_boundaries,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.tryReduceNatWithSuccMode_optional_wf_of_lazy_boundaries,
+      ``Ix.Kernel.RecM.tryReduceNatWithSuccMode_optional_wf_of_lazy_boundaries,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.AmbientNat.succStuckReduction,
+  { root := ``Ix.Kernel.AmbientNat.succStuckReduction,
     standardAxioms := standard,
     nativeAxioms := contextNative.push nameDecideNative,
     forbiddenDependencies := legacyWholeEnv },
@@ -8140,257 +8127,257 @@ private def roots : Array RootAllowance := #[
   -- K2a: suffix semantics reduce open-context cache validity to one explicit
   -- operational model.  The recursive method table closes by induction from
   -- an exact one-layer contract split between WHNF and Infer/DefEq ownership.
-  { root := ``Ix.Tc.WhnfSuffixModel.keyRepresents,
+  { root := ``Ix.Kernel.WhnfSuffixModel.keyRepresents,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfSuffixModel.cacheWriteOracle,
+  { root := ``Ix.Kernel.WhnfSuffixModel.cacheWriteOracle,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.Methods.LayerWF.of_parts,
+  { root := ``Ix.Kernel.Methods.LayerWF.of_parts,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.Methods.Closed.of_parts,
+  { root := ``Ix.Kernel.Methods.Closed.of_parts,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.Methods.methodsOut_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.methodsOut_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.Methods.methodsN_wf,
+  { root := ``Ix.Kernel.Methods.methodsN_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.runRec_wf,
+  { root := ``Ix.Kernel.TcM.runRec_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- K2a also assigns exact meanings to the remaining cache families.  A
   -- positive DefEq result carries Theory equality; negative results are
   -- intentionally vacuous for the one-way soundness claim.
-  { root := ``Ix.Tc.InferMeaning.mono,
+  { root := ``Ix.Kernel.InferMeaning.mono,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.InferMeaning.post,
+  { root := ``Ix.Kernel.InferMeaning.post,
     standardAxioms := standard, sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.InferCacheValid.mono,
+  { root := ``Ix.Kernel.InferCacheValid.mono,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.inferHitOfMatches,
+  { root := ``Ix.Kernel.CacheInvariant.inferHitOfMatches,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.DefEqMeaning.mono,
+  { root := ``Ix.Kernel.DefEqMeaning.mono,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.DefEqMeaning.of_translations,
+  { root := ``Ix.Kernel.DefEqMeaning.of_translations,
     standardAxioms := standard, sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.DefEqCacheValid.mono,
+  { root := ``Ix.Kernel.DefEqCacheValid.mono,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheProvenance.kernelWhnfMeaningOfMatches,
+  { root := ``Ix.Kernel.CacheProvenance.kernelWhnfMeaningOfMatches,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheProvenance.kernelInferMeaningOfMatches,
+  { root := ``Ix.Kernel.CacheProvenance.kernelInferMeaningOfMatches,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheProvenance.kernelDefEqMeaning,
+  { root := ``Ix.Kernel.CacheProvenance.kernelDefEqMeaning,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
 
   -- K2b: production key executions now generate the canonical operational
   -- context witnesses.  Physical inference/DefEq writes preserve every
   -- cache partition, including the rejection-only same-head failure set.
-  { root := ``Ix.Tc.CacheInvariant.insertInfer,
+  { root := ``Ix.Kernel.CacheInvariant.insertInfer,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.insertInferOnly,
+  { root := ``Ix.Kernel.CacheInvariant.insertInferOnly,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.insertDefEq,
+  { root := ``Ix.Kernel.CacheInvariant.insertDefEq,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.insertDefEqCheap,
+  { root := ``Ix.Kernel.CacheInvariant.insertDefEqCheap,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheInvariant.insertDefEqFailure,
+  { root := ``Ix.Kernel.CacheInvariant.insertDefEqFailure,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_empty,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_empty,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.whnfKey_ctx,
+  { root := ``Ix.Kernel.TcM.whnfKey_ctx,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.operationalWhnfContextKeys.represents,
+  { root := ``Ix.Kernel.operationalWhnfContextKeys.represents,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.operationalWhnfContextKeys.representsCtx,
+  { root := ``Ix.Kernel.operationalWhnfContextKeys.representsCtx,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextDigestSpec.execution,
+  { root := ``Ix.Kernel.ContextDigestSpec.execution,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextDigestSpec.StateValid,
+  { root := ``Ix.Kernel.ContextDigestSpec.StateValid,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextDigestSpec.memoValid,
+  { root := ``Ix.Kernel.ContextDigestSpec.memoValid,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextDigestSpec.preserves,
+  { root := ``Ix.Kernel.ContextDigestSpec.preserves,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_trivial,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_trivial,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_cacheHit,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_cacheHit,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_cacheMiss,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_cacheMiss,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_replay,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_replay,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ContextAddrMemoValid,
+  { root := ``Ix.Kernel.TcM.ContextAddrMemoValid,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.ctxAddrForLbr_memoValid,
+  { root := ``Ix.Kernel.TcM.ctxAddrForLbr_memoValid,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.scopedOperationalWhnfContextKeys.represents,
+  { root := ``Ix.Kernel.scopedOperationalWhnfContextKeys.represents,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.scopedOperationalWhnfContextKeys.representsCtx,
+  { root := ``Ix.Kernel.scopedOperationalWhnfContextKeys.representsCtx,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.scopedOperationalWhnfContextKeys.digest_eq,
+  { root := ``Ix.Kernel.scopedOperationalWhnfContextKeys.digest_eq,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.scopedOperationalWhnfContextKeys.mem,
+  { root := ``Ix.Kernel.scopedOperationalWhnfContextKeys.mem,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.WhnfSuffixModel.operational,
+  { root := ``Ix.Kernel.WhnfSuffixModel.operational,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.inferKey_wf,
+  { root := ``Ix.Kernel.TcM.inferKey_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.inferKey_operational_matches_wf,
+  { root := ``Ix.Kernel.TcM.inferKey_operational_matches_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.inferWith_fullHit,
+  { root := ``Ix.Kernel.RecM.inferWith_fullHit,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.inferWith_inferOnlyHit,
+  { root := ``Ix.Kernel.RecM.inferWith_inferOnlyHit,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.InferCacheUpdate.full_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.InferCacheUpdate.full_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.InferCacheUpdate.inferOnly_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.InferCacheUpdate.inferOnly_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
 
   -- The union-find frame and joint suffix model keep composite context-hash
   -- transport explicit for WHNF, inference, and DefEq.  Collision-robust
   -- provenance constructors quantify over every supported address peer.
-  { root := ``Ix.Tc.TcM.withEquiv_eq,
+  { root := ``Ix.Kernel.TcM.withEquiv_eq,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.withEquiv_whnf_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.TcM.withEquiv_whnf_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.defEqCtxKey_wf,
+  { root := ``Ix.Kernel.TcM.defEqCtxKey_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.defEqCtxKey_operational_matches_wf,
+  { root := ``Ix.Kernel.TcM.defEqCtxKey_operational_matches_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.DefEqMeaning.of_addr_beq,
+  { root := ``Ix.Kernel.DefEqMeaning.of_addr_beq,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.DefEqMeaning.symm,
+  { root := ``Ix.Kernel.DefEqMeaning.symm,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KernelSuffixModel.toWhnfSuffixModel,
+  { root := ``Ix.Kernel.KernelSuffixModel.toWhnfSuffixModel,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KernelSuffixModel.operational,
+  { root := ``Ix.Kernel.KernelSuffixModel.operational,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextSuffixSemantics.whnf,
+  { root := ``Ix.Kernel.ContextSuffixSemantics.whnf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextSuffixSemantics.infer,
+  { root := ``Ix.Kernel.ContextSuffixSemantics.infer,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ContextSuffixSemantics.defEq,
+  { root := ``Ix.Kernel.ContextSuffixSemantics.defEq,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.represents,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.represents,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.StateInScope,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.StateInScope,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.whnfTransport,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.whnfTransport,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.inferTransport,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.inferTransport,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.defEqTransport,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.defEqTransport,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.finiteOperational,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.finiteOperational,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.ScopedKernelSuffixModel.toKernelSuffixModel,
+  { root := ``Ix.Kernel.ScopedKernelSuffixModel.toKernelSuffixModel,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KernelSuffixModel.finiteOperational,
+  { root := ``Ix.Kernel.KernelSuffixModel.finiteOperational,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheProvenance.kernelDefEqMeaningCanonical,
+  { root := ``Ix.Kernel.CacheProvenance.kernelDefEqMeaningCanonical,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KernelSuffixModel.inferProvenance,
+  { root := ``Ix.Kernel.KernelSuffixModel.inferProvenance,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KernelSuffixModel.defEqProvenance,
+  { root := ``Ix.Kernel.KernelSuffixModel.defEqProvenance,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.KernelSuffixModel.defEqFailureProvenance,
+  { root := ``Ix.Kernel.KernelSuffixModel.defEqFailureProvenance,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqCacheUpdate.full_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.DefEqCacheUpdate.full_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqCacheUpdate.cheap_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.DefEqCacheUpdate.cheap_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqCacheUpdate.failure_whnfStateInv,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.DefEqCacheUpdate.failure_whnfStateInv,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
 
   -- First production K2 branches: both inference hit partitions, collision-
   -- safe DefEq address reflexivity, and a positive full DefEq hit including
   -- canonical ordering and its final union-find mutation.
-  { root := ``Ix.Tc.RecM.isDefEq_fullHit_true,
+  { root := ``Ix.Kernel.RecM.isDefEq_fullHit_true,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEq_fullHit_true_acceptance,
+  { root := ``Ix.Kernel.RecM.isDefEq_fullHit_true_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEq_addrEq_wf,
+  { root := ``Ix.Kernel.RecM.isDefEq_addrEq_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.inferWith_fullHit_acceptance,
+  { root := ``Ix.Kernel.RecM.inferWith_fullHit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.inferWith_inferOnlyHit_acceptance,
+  { root := ``Ix.Kernel.RecM.inferWith_inferOnlyHit_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8398,11 +8385,11 @@ private def roots : Array RootAllowance := #[
   -- The memoized proposition classifier closes proof irrelevance's sole
   -- auxiliary cache family.  Positive hits and writes are tied to `Sort 0`
   -- through expression collision freedom and the explicit suffix model.
-  { root := ``Ix.Tc.RecM.isPropType_wf,
+  { root := ``Ix.Kernel.RecM.isPropType_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryProofIrrel_classifier_wf,
+  { root := ``Ix.Kernel.RecM.tryProofIrrel_classifier_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8410,20 +8397,20 @@ private def roots : Array RootAllowance := #[
   -- Lazy delta is a bounded semantic state machine.  These roots expose the
   -- pair invariant, the fuel-bounded closure, and the exact remaining
   -- obligations for one iteration and the stopped continuation.
-  { root := ``Ix.Tc.RecM.DefEqPairInvariant.refl,
+  { root := ``Ix.Kernel.RecM.DefEqPairInvariant.refl,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqPairInvariant.conclude,
+  { root := ``Ix.Kernel.RecM.DefEqPairInvariant.conclude,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.runDefEqLazyDelta_wf,
+  { root := ``Ix.Kernel.RecM.runDefEqLazyDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqInnerAfterProofIrrelevance_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqInnerAfterProofIrrelevance_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqAfterProofIrrelevance.ofLazyDelta,
+  { root := ``Ix.Kernel.RecM.DefEqAfterProofIrrelevance.ofLazyDelta,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -8431,84 +8418,84 @@ private def roots : Array RootAllowance := #[
   -- literal/zero guards and both ordinary Nat-reduction attempts.  Structural
   -- offset decomposition and the post-Nat reducer tiers remain explicit
   -- continuation contracts; negative recognizer results carry no semantics.
-  { root := ``Ix.Tc.RecM.isNatZero_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.isNatZero_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsNatZero.ofContext,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.IsNatZero.ofContext,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqOffset_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqOffset_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqOffset.ofContext,
+  { root := ``Ix.Kernel.RecM.TryDefEqOffset.ofContext,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepAfterOffsetMiss_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepAfterOffsetMiss_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaAfterOffsetMiss.ofNat,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaAfterOffsetMiss.ofNat,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepAfterNatMiss_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepAfterNatMiss_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaAfterNatMiss.ofNoAccel,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaAfterNatMiss.ofNoAccel,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.classifyDeltaHead_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.classifyDeltaHead_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepAfterAcceleratorMiss_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepAfterAcceleratorMiss_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.DefEqLazyDeltaAfterAcceleratorMiss.ofClassification,
+      ``Ix.Kernel.RecM.DefEqLazyDeltaAfterAcceleratorMiss.ofClassification,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryUnfoldProjApp_wf,
+  { root := ``Ix.Kernel.RecM.tryUnfoldProjApp_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepAfterDeltaClassification_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepAfterDeltaClassification_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.DefEqLazyDeltaAfterDeltaClassification.ofProjection,
+      ``Ix.Kernel.RecM.DefEqLazyDeltaAfterDeltaClassification.ofProjection,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.finishDefEqLazyDeltaStep_wf,
+  { root := ``Ix.Kernel.RecM.finishDefEqLazyDeltaStep_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepWithLeftDelta_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepWithLeftDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepWithRightDelta_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepWithRightDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.rankDeltaHead_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.rankDeltaHead_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepAfterProjectionMiss_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepAfterProjectionMiss_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaAfterProjectionMiss.ofRankDispatch,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaAfterProjectionMiss.ofRankDispatch,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepAfterSameHeadMiss_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepAfterSameHeadMiss_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaAfterSameHeadMiss.ofReduction,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaAfterSameHeadMiss.ofReduction,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8517,54 +8504,54 @@ private def roots : Array RootAllowance := #[
   -- congruence, and the rejection-only failure-cache shell.  A cache hit can
   -- only skip the comparison; every positive result still comes from the
   -- semantic same-head proof.
-  { root := ``Ix.Tc.RecM.allDefEqSpineArgs_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.allDefEqSpineArgs_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrAppSpine.defEq_of_zip,
+  { root := ``Ix.Kernel.RecM.TrAppSpine.defEq_of_zip,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.sameDefEqUniverses_sound,
+  { root := ``Ix.Kernel.RecM.sameDefEqUniverses_sound,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.constantHeadsDefEq,
+  { root := ``Ix.Kernel.RecM.constantHeadsDefEq,
     standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.trySameHeadSpine_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.trySameHeadSpine_wf,
+    standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrySameHeadSpine.ofResources,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.TrySameHeadSpine.ofResources,
+    standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.CacheEntry.defEqFailureReferencesAuthorized,
+  { root := ``Ix.Kernel.CacheEntry.defEqFailureReferencesAuthorized,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.DefEqFailureCacheResources.ofKernelSuffixModel,
+  { root := ``Ix.Kernel.DefEqFailureCacheResources.ofKernelSuffixModel,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isRegular_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.isRegular_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.trySameHeadSpineSpeculative_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.trySameHeadSpineSpeculative_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.trySameHeadSpineCached_wf,
+  { root := ``Ix.Kernel.RecM.trySameHeadSpineCached_wf,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TrySameHeadSpineCached.ofResources,
+  { root := ``Ix.Kernel.RecM.TrySameHeadSpineCached.ofResources,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defEqLazyDeltaStepWithEqualRank_wf,
+  { root := ``Ix.Kernel.RecM.defEqLazyDeltaStepWithEqualRank_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaEqualRank.ofPrefix,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaEqualRank.ofPrefix,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaEqualRank.ofKernelResources,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaEqualRank.ofKernelResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8573,20 +8560,20 @@ private def roots : Array RootAllowance := #[
   -- path.  Its only semantic input is an exact successful-run reflection;
   -- recursive equality is transported forward through the common successor
   -- suffix, without assuming offset injectivity or completeness.
-  { root := ``Ix.Tc.TcM.WF.withInvRunEq,
+  { root := ``Ix.Kernel.TcM.WF.withInvRunEq,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natOffsetDecompose_state_wf,
+  { root := ``Ix.Kernel.RecM.natOffsetDecompose_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natOffsetRebuild_state_wf,
+  { root := ``Ix.Kernel.RecM.natOffsetRebuild_state_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqOffsetAfterCandidates_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqOffsetAfterCandidates_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqOffsetAfterCandidates.ofContext,
+  { root := ``Ix.Kernel.RecM.TryDefEqOffsetAfterCandidates.ofContext,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8595,33 +8582,33 @@ private def roots : Array RootAllowance := #[
   -- general app probe reconstructs equality through both typed spines;
   -- structural congruence proves constants and variables directly and
   -- delegates matching projections to one execution-indexed helper contract.
-  { root := ``Ix.Tc.RecM.tryDefEqApp_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.tryDefEqApp_wf,
+    standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqApp.ofResources,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.TryDefEqApp.ofResources,
+    standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryStructuralCongruence_wf,
+  { root := ``Ix.Kernel.RecM.tryStructuralCongruence_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryStructuralCongruence.ofResources,
+  { root := ``Ix.Kernel.RecM.TryStructuralCongruence.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqAfterLazyDeltaStopped_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqAfterLazyDeltaStopped_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqAfterLazyDeltaStopped.ofResources,
+  { root := ``Ix.Kernel.RecM.DefEqAfterLazyDeltaStopped.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaContext.ofKernelResources,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaContext.ofKernelResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.DefEqAfterProofIrrelevance.ofKernelResources,
+  { root := ``Ix.Kernel.RecM.DefEqAfterProofIrrelevance.ofKernelResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8629,11 +8616,11 @@ private def roots : Array RootAllowance := #[
   -- The structural projection callback's bounded lazy-delta driver preserves
   -- the original projected semantics across delta steps, direct projection
   -- reduction, recursive comparison, and normal depth exhaustion.
-  { root := ``Ix.Tc.RecM.lazyDeltaProjReduction_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaProjReduction_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.LazyDeltaProjReduction.ofResources,
+  { root := ``Ix.Kernel.RecM.LazyDeltaProjReduction.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8641,30 +8628,30 @@ private def roots : Array RootAllowance := #[
   -- Direct projection reduction gets state/support closure from the proved
   -- no-acceleration helper and consults semantic reflection only for the
   -- exact successful execution that occurred.
-  { root := ``Ix.Tc.RecM.tryProjReduce_direct_wf,
+  { root := ``Ix.Kernel.RecM.tryProjReduce_direct_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryProjReduce.ofDirectResources,
+  { root := ``Ix.Kernel.RecM.TryProjReduce.ofDirectResources,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
 
   -- The compact projection-loop delta step exposes its two lazy declaration
   -- classifications as a proved prefix; the exact branch continuation sees
   -- only their concrete results.
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStep_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStep_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.LazyDeltaReductionStep.ofClassification,
+  { root := ``Ix.Kernel.RecM.LazyDeltaReductionStep.ofClassification,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepAfterClassification_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepAfterClassification_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.LazyDeltaReductionAfterClassification.ofActive,
+      ``Ix.Kernel.RecM.LazyDeltaReductionAfterClassification.ofActive,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.LazyDeltaReductionStep.ofActive,
+  { root := ``Ix.Kernel.RecM.LazyDeltaReductionStep.ofActive,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -8673,42 +8660,42 @@ private def roots : Array RootAllowance := #[
   -- one- or two-sided unfolding, and equal ranks try same-head congruence
   -- before normalizing both sides.  The final two roots assemble that branch
   -- proof with the already-audited classifier prefix.
-  { root := ``Ix.Tc.RecM.finishLazyDeltaReductionStep_wf,
+  { root := ``Ix.Kernel.RecM.finishLazyDeltaReductionStep_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepWithLeftDelta_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepWithLeftDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepWithRightDelta_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepWithRightDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepAfterSameHeadMiss_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepAfterSameHeadMiss_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepWithEqualRank_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepWithEqualRank_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.defRankId_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.defRankId_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepWithBothDelta_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepWithBothDelta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.lazyDeltaReductionStepAfterActive_wf,
+  { root := ``Ix.Kernel.RecM.lazyDeltaReductionStepAfterActive_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.LazyDeltaReductionAfterActive.ofResources,
+  { root := ``Ix.Kernel.RecM.LazyDeltaReductionAfterActive.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.LazyDeltaReductionStep.ofResources,
+  { root := ``Ix.Kernel.RecM.LazyDeltaReductionStep.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8717,16 +8704,16 @@ private def roots : Array RootAllowance := #[
   -- projection comparison, and structural-congruence projection branch from
   -- named lower reducers.  The exact-run direct projection reflection is the
   -- remaining semantic boundary; the outer loop itself is no longer one.
-  { root := ``Ix.Tc.RecM.ProjectionDeltaClosureResources.loop,
+  { root := ``Ix.Kernel.RecM.ProjectionDeltaClosureResources.loop,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.LazyDeltaProjReduction.ofClosureResources,
+  { root := ``Ix.Kernel.RecM.LazyDeltaProjReduction.ofClosureResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.TryStructuralCongruence.ofProjectionDeltaResources,
+      ``Ix.Kernel.RecM.TryStructuralCongruence.ofProjectionDeltaResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8735,12 +8722,12 @@ private def roots : Array RootAllowance := #[
   -- concrete projection loop and reuses that record's core/quick resources;
   -- only application-spine and final-WHNF contracts remain as sibling inputs.
   { root :=
-      ``Ix.Tc.RecM.StoppedContinuationClosureResources.stopped,
+      ``Ix.Kernel.RecM.StoppedContinuationClosureResources.stopped,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
   { root :=
-      ``Ix.Tc.RecM.DefEqAfterLazyDeltaStopped.ofClosureResources,
+      ``Ix.Kernel.RecM.DefEqAfterLazyDeltaStopped.ofClosureResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8750,73 +8737,73 @@ private def roots : Array RootAllowance := #[
   -- comparison and every constructor in the prefix are now exhaustive
   -- concrete proofs.  The let roots include exact allocation, common-fvar
   -- body opening, context transport, and local-scope restoration.
-  { root := ``Ix.Tc.RecM.isDefEqWhnf_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnf_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnf.ofPhases,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnf.ofPhases,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfApp_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfApp_wf,
+    standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfApp.ofResources,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfApp.ofResources,
+    standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.TcM.openLetWithFV_scope,
+  { root := ``Ix.Kernel.TcM.openLetWithFV_scope,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.withLctxScope_openLetWithFV_wf,
+  { root := ``Ix.Kernel.RecM.withLctxScope_openLetWithFV_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfLet_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfLet_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfLet.ofResources,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfLet.ofResources,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isNatLike_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.isNatLike_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.natSuccOf_wf,
+  { root := ``Ix.Kernel.RecM.natSuccOf_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.NatSuccOf.ofResources,
+  { root := ``Ix.Kernel.RecM.NatSuccOf.ofResources,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqNatAfterLiteral_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqNatAfterLiteral_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqNat_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqNat_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfNat_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfNat_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfNat.ofResources,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfNat.ofResources,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqWhnfAfterStructural_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnfAfterStructural_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnfAfterStructural.ofNat,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnfAfterStructural.ofNat,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfStructural_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfStructural_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfStructural.ofResources,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfStructural.ofResources,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8825,37 +8812,37 @@ private def roots : Array RootAllowance := #[
   -- an explicit term builder.  The builder's lifted source and generated #0
   -- application are translated structurally before the recursive comparison
   -- is composed with Theory eta; the ordered reverse attempt uses symmetry.
-  { root := ``Ix.Tc.TcM.lift_whnf_wf_of_resources,
+  { root := ``Ix.Kernel.TcM.lift_whnf_wf_of_resources,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.compareEtaExpansion_wf,
+  { root := ``Ix.Kernel.RecM.compareEtaExpansion_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryEtaExpansionAfterGuard_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaExpansionAfterGuard_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryEtaExpansion_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaExpansion_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfEtaAfterGuard_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfEtaAfterGuard_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfEta_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfEta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfEta.ofResources,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfEta.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqWhnfAfterNat_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnfAfterNat_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnfAfterNat.ofEta,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnfAfterNat.ofEta,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8863,19 +8850,19 @@ private def roots : Array RootAllowance := #[
   -- The final-WHNF String phase reuses the exact expansion plans proved for
   -- the earlier DefEq tier.  Its optional result preserves the original
   -- two-way short-circuit order; reverse success is justified by symmetry.
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfStringAfterGuard_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfStringAfterGuard_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfString_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfString_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfString.ofContext,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfString.ofContext,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqWhnfAfterEta_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnfAfterEta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnfAfterEta.ofString,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnfAfterEta.ofString,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -8883,25 +8870,25 @@ private def roots : Array RootAllowance := #[
   -- Proof irrelevance is concrete through the memoized proposition
   -- classifier; unit-like and structure-eta soundness remain separately
   -- named contracts until their exact inductive laws are supplied.
-  { root := ``Ix.Tc.RecM.isDefEqWhnfAfterUnit_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnfAfterUnit_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnfAfterUnit.ofClassifier,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnfAfterUnit.ofClassifier,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqWhnfAfterStructEta_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnfAfterStructEta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnfAfterStructEta.ofUnitAndProof,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnfAfterStructEta.ofUnitAndProof,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.isDefEqWhnfAfterString_wf,
+  { root := ``Ix.Kernel.RecM.isDefEqWhnfAfterString_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.IsDefEqWhnfAfterString.ofStructEta,
+  { root := ``Ix.Kernel.RecM.IsDefEqWhnfAfterString.ofStructEta,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := legacyWholeEnv },
 
@@ -8910,19 +8897,19 @@ private def roots : Array RootAllowance := #[
   -- narrow unique-inhabitant law for that trusted zero-index, one-nullary-
   -- constructor shape; it does not recover the legacy whole-environment
   -- inductive oracle.
-  { root := ``Ix.Tc.RecM.isUnitLikeInductive_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.RecM.isUnitLikeInductive_wf,
+    standardAxioms := standard,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.tryDefEqUnit_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqUnit_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
-  { root := ``Ix.Tc.RecM.TryDefEqUnit.ofResources,
+  { root := ``Ix.Kernel.RecM.TryDefEqUnit.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
 
-  { root := ``Ix.Tc.RecM.DefEqLazyDeltaStep.ofKernelResources,
+  { root := ``Ix.Kernel.RecM.DefEqLazyDeltaStep.ofKernelResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := legacyWholeEnv },
@@ -8932,57 +8919,57 @@ private def roots : Array RootAllowance := #[
   -- The positive structure classifier cannot manufacture semantic eta on
   -- its own, and every exported root remains quarantined from both legacy
   -- whole-environment and broad delta-authority paths.
-  { root := ``Ix.Tc.TrKExprS.prj_components,
+  { root := ``Ix.Kernel.TrKExprS.prj_components,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryEtaStructFields_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaStructFields_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.etaExpansionBaseLoop_wf,
+  { root := ``Ix.Kernel.RecM.etaExpansionBaseLoop_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.etaExpansionBase_wf,
+  { root := ``Ix.Kernel.RecM.etaExpansionBase_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryEtaStructAfterTypes_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaStructAfterTypes_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.normalizeEtaStructSource_wf,
+  { root := ``Ix.Kernel.RecM.normalizeEtaStructSource_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryEtaStructAfterConstructor_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaStructAfterConstructor_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryEtaStructAfterNormalization_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaStructAfterNormalization_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryEtaStruct_wf,
+  { root := ``Ix.Kernel.RecM.tryEtaStruct_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.tryDefEqWhnfStructEta_wf,
+  { root := ``Ix.Kernel.RecM.tryDefEqWhnfStructEta_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.TryDefEqWhnfStructEta.ofResources,
+  { root := ``Ix.Kernel.RecM.TryDefEqWhnfStructEta.ofResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
 
   -- The final-WHNF phases are now assembled in exact production order.
-  { root := ``Ix.Tc.RecM.FinalWhnfClosureResources,
+  { root := ``Ix.Kernel.RecM.FinalWhnfClosureResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.FinalWhnfClosureResources.afterStructural,
+  { root := ``Ix.Kernel.RecM.FinalWhnfClosureResources.afterStructural,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.FinalWhnfClosureResources.finalWhnf,
+  { root := ``Ix.Kernel.RecM.FinalWhnfClosureResources.finalWhnf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
@@ -8990,36 +8977,36 @@ private def roots : Array RootAllowance := #[
   -- Recursive DefEq closure: trusted finite expression references authorize
   -- only the two direct roots of an ordinary result entry.  The complete
   -- inner tier then feeds the guarded public cache shell.
-  { root := ``Ix.Tc.CacheEntry.defEqReferencesAuthorized,
+  { root := ``Ix.Kernel.CacheEntry.defEqReferencesAuthorized,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqInner.WF,
+  { root := ``Ix.Kernel.RecM.DefEqInner.WF,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.isDefEq_wf,
+  { root := ``Ix.Kernel.RecM.isDefEq_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqClosureResources,
+  { root := ``Ix.Kernel.RecM.DefEqClosureResources,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqClosureResources.stopped,
+  { root := ``Ix.Kernel.RecM.DefEqClosureResources.stopped,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqClosureResources.lazyDelta,
+  { root := ``Ix.Kernel.RecM.DefEqClosureResources.lazyDelta,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqClosureResources.inner,
+  { root := ``Ix.Kernel.RecM.DefEqClosureResources.inner,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqClosureResources.entryPoint,
+  { root := ``Ix.Kernel.RecM.DefEqClosureResources.entryPoint,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.DefEqClosureResources.nextDefEq_wf,
+  { root := ``Ix.Kernel.RecM.DefEqClosureResources.nextDefEq_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
@@ -9027,21 +9014,21 @@ private def roots : Array RootAllowance := #[
   -- Inference and DefEq consume the same predecessor table and suffix model;
   -- their fixed-universe pair closes before it is joined to the four WHNF
   -- fields.
-  { root := ``Ix.Tc.UncachedInference.Context.nextInfer_wf,
+  { root := ``Ix.Kernel.UncachedInference.Context.nextInfer_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.InferDefEqClosedAt,
+  { root := ``Ix.Kernel.Methods.InferDefEqClosedAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.InferDefEqClosureContext,
+  { root := ``Ix.Kernel.InferDefEqClosureContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.InferDefEqClosureContext.layer,
+  { root := ``Ix.Kernel.InferDefEqClosureContext.layer,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.InferDefEqClosureContext.closedAt,
+  { root := ``Ix.Kernel.InferDefEqClosureContext.closedAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
@@ -9049,29 +9036,29 @@ private def roots : Array RootAllowance := #[
   -- Legacy all-depth six-field knot assembly under the canonical production
   -- cache stack.  These roots remain audited as migration adapters, but the
   -- bounded public interfaces below are forbidden from depending on them.
-  { root := ``Ix.Tc.kernelCacheFallback,
+  { root := ``Ix.Kernel.kernelCacheFallback,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.kernelCacheSemantics_eq_k1,
+  { root := ``Ix.Kernel.kernelCacheSemantics_eq_k1,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.ClosedAt,
+  { root := ``Ix.Kernel.Methods.ClosedAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.ClosedAt.of_parts,
+  { root := ``Ix.Kernel.Methods.ClosedAt.of_parts,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.runRec_wfAt,
+  { root := ``Ix.Kernel.TcM.runRec_wfAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext.closedAt,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext.closedAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext.methodsN,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext.methodsN,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
@@ -9081,7 +9068,7 @@ private def roots : Array RootAllowance := #[
   -- an unbounded successor-sort chain.  The replacement below separates the
   -- finite result footprint from fuel-indexed method-call domains.
   { root :=
-      ``Ix.Tc.FiniteSupportBoundary.SyntaxInferenceResources.no_sort_source,
+      ``Ix.Kernel.FiniteSupportBoundary.SyntaxInferenceResources.no_sort_source,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := k1ForbiddenDependencies },
 
@@ -9089,40 +9076,40 @@ private def roots : Array RootAllowance := #[
   -- method-table depths selected by this run's recursion fuel.  The public
   -- adapters consume the terminal successor-layer domain and have no
   -- `sorryAx` dependency.
-  { root := ``Ix.Tc.Methods.CallDomain.empty_within,
+  { root := ``Ix.Kernel.Methods.CallDomain.empty_within,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.CallDomain.singletonInfer_within,
+  { root := ``Ix.Kernel.Methods.CallDomain.singletonInfer_within,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.methodsOut_wfAtOn,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.methodsOut_wfAtOn,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.CallScheduleAt.methodsN,
+  { root := ``Ix.Kernel.Methods.CallScheduleAt.methodsN,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.CallScheduleAt.nextSelected,
+  { root := ``Ix.Kernel.Methods.CallScheduleAt.nextSelected,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodRunContext,
+  { root := ``Ix.Kernel.RecursiveMethodRunContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.whnf.wf,
+  { root := ``Ix.Kernel.TcM.whnf.wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.infer.wf,
+  { root := ``Ix.Kernel.TcM.infer.wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.isDefEq.wf,
+  { root := ``Ix.Kernel.TcM.isDefEq.wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.SortSchedule.two,
+  { root := ``Ix.Kernel.Methods.SortSchedule.two,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.infer.sort_wf_bounded,
+  { root := ``Ix.Kernel.TcM.infer.sort_wf_bounded,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.infer.sort_wf_fuel_one,
+  { root := ``Ix.Kernel.TcM.infer.sort_wf_fuel_one,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
@@ -9130,382 +9117,382 @@ private def roots : Array RootAllowance := #[
   -- K3 reconstructs the typed source translation from untyped/scoped
   -- checker ingress.  These roots are usable before the final checkConst
   -- assembly and do not depend on its statement placeholder.
-  { root := ``Ix.Tc.KUniv.scoped_iff_toVLevel_wf,
+  { root := ``Ix.Kernel.KUniv.scoped_iff_toVLevel_wf,
     standardAxioms := propextOnly,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.PreTrKExprS.upgradeOfTyped,
+  { root := ``Ix.Kernel.PreTrKExprS.upgradeOfTyped,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TrKExprS.openFVarZero,
+  { root := ``Ix.Kernel.TrKExprS.openFVarZero,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Lean4Lean.VExpr.inst_subst_cons,
+  { root := ``Ix.Theory.Named.VExpr.inst_subst_cons,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawCtxInterp.find?_inl,
+  { root := ``Ix.Kernel.RawCtxInterp.find?_inl,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawCtxInterp.bvars_eq,
+  { root := ``Ix.Kernel.RawCtxInterp.bvars_eq,
     standardAxioms := propextOnly,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawProjRel.none_substCompatible,
+  { root := ``Ix.Kernel.RawProjRel.none_substCompatible,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawExprRel.toPre_of_scoped_aux,
+  { root := ``Ix.Kernel.RawExprRel.toPre_of_scoped_aux,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawExprRel.toPre_of_scoped,
+  { root := ``Ix.Kernel.RawExprRel.toPre_of_scoped,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawDeclRel.toPre_of_scope,
+  { root := ``Ix.Kernel.RawDeclRel.toPre_of_scope,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.PendingDecl.toPre_of_scope,
+  { root := ``Ix.Kernel.PendingDecl.toPre_of_scope,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TypeCheckEvidence.isType,
+  { root := ``Ix.Kernel.TypeCheckEvidence.isType,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.ValueCheckEvidence.hasType,
+  { root := ``Ix.Kernel.ValueCheckEvidence.hasType,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.StandaloneCheckEvidence.accepted,
+  { root := ``Ix.Kernel.StandaloneCheckEvidence.accepted,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.StandaloneCheckResult.accepted,
+  { root := ``Ix.Kernel.StandaloneCheckResult.accepted,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RawDeclRel.wfOfAccepted,
+  { root := ``Ix.Kernel.RawDeclRel.wfOfAccepted,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.PendingDecl.promoteOfAccepted,
+  { root := ``Ix.Kernel.PendingDecl.promoteOfAccepted,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.PendingDecl.checkResultAndPromote,
+  { root := ``Ix.Kernel.PendingDecl.checkResultAndPromote,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_go_sound,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_go_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_sound,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivRootsList_sound,
+  { root := ``Ix.Kernel.RecM.validateUnivRootsList_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivRootsArray_sound,
+  { root := ``Ix.Kernel.RecM.validateUnivRootsArray_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_go_sound,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_go_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_sound,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateConstWellScoped_sound,
+  { root := ``Ix.Kernel.RecM.validateConstWellScoped_sound,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.PendingDecl.toPre_of_validation,
+  { root := ``Ix.Kernel.PendingDecl.toPre_of_validation,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.PendingDecl.checkValidatedResultAndPromote,
+  { root := ``Ix.Kernel.PendingDecl.checkValidatedResultAndPromote,
     standardAxioms := standard,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_go_frame,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_go_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivParamsSeen_frame,
+  { root := ``Ix.Kernel.RecM.validateUnivParamsSeen_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivRootsList_frame,
+  { root := ``Ix.Kernel.RecM.validateUnivRootsList_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateUnivRootsArray_frame,
+  { root := ``Ix.Kernel.RecM.validateUnivRootsArray_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.getConst_frame,
+  { root := ``Ix.Kernel.TcM.getConst_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.hasConst_frame,
+  { root := ``Ix.Kernel.TcM.hasConst_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_go_frame,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_go_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateExprWellScoped_frame,
+  { root := ``Ix.Kernel.RecM.validateExprWellScoped_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.validateConstWellScoped_frame,
+  { root := ``Ix.Kernel.RecM.validateConstWellScoped_frame,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.LazyFaultPreserves.withInferOnly,
+  { root := ``Ix.Kernel.TcM.LazyFaultPreserves.withInferOnly,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkTypePipeline_sound,
+  { root := ``Ix.Kernel.RecM.checkTypePipeline_sound,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkValuePipeline_sound,
+  { root := ``Ix.Kernel.RecM.checkValuePipeline_sound,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.FullInferenceWFAtOn.ofTypedIngress,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.FullInferenceWFAtOn.ofTypedIngress,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.FullInferenceWFAtOn.ofSingletonSort,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.FullInferenceWFAtOn.ofSingletonSort,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.StandalonePipelineResources.singletonSortAxiom,
+  { root := ``Ix.Kernel.StandalonePipelineResources.singletonSortAxiom,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkTypePipeline_bounded_sound,
+  { root := ``Ix.Kernel.RecM.checkTypePipeline_bounded_sound,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkValuePipeline_bounded_sound,
+  { root := ``Ix.Kernel.RecM.checkValuePipeline_bounded_sound,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMember_axiom_sound,
+  { root := ``Ix.Kernel.RecM.checkConstMember_axiom_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMember_defn_sound,
+  { root := ``Ix.Kernel.RecM.checkConstMember_defn_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMember_sound,
+  { root := ``Ix.Kernel.RecM.checkConstMember_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMember_validation_success,
+  { root := ``Ix.Kernel.RecM.checkConstMember_validation_success,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMember_pending_sound,
+  { root := ``Ix.Kernel.RecM.checkConstMember_pending_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMemberFresh_pending_sound,
+  { root := ``Ix.Kernel.RecM.checkConstMemberFresh_pending_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.StandaloneRoute.axiomRoute,
+  { root := ``Ix.Kernel.StandaloneRoute.axiomRoute,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConst_standalone_pending_sound,
+  { root := ``Ix.Kernel.RecM.checkConst_standalone_pending_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkNoUnsafeRefs_go_frame,
+  { root := ``Ix.Kernel.RecM.checkNoUnsafeRefs_go_frame,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkNoUnsafeRefs_frame,
+  { root := ``Ix.Kernel.RecM.checkNoUnsafeRefs_frame,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.KernelStateWF.rebaseWorld,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.KernelStateWF.rebaseWorld,
+    standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.WhnfStateInv.rebaseWorld,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.WhnfStateInv.rebaseWorld,
+    standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.reset_whnf_entry,
+  { root := ``Ix.Kernel.TcM.reset_whnf_entry,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.FullInferPost.of_typed,
+  { root := ``Ix.Kernel.FullInferPost.of_typed,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.WF.withInv,
+  { root := ``Ix.Kernel.TcM.WF.withInv,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferWith_fullHit_pre_acceptance,
+  { root := ``Ix.Kernel.RecM.inferWith_fullHit_pre_acceptance,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_sort_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_sort_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_var_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_var_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_fvar_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_fvar_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_const_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_const_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_nat_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_nat_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_str_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_str_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.FullInferenceStepContext,
+  { root := ``Ix.Kernel.FullInferenceStepContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_app_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_app_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.PreservesInferOnly.strengthenWFValue,
+  { root := ``Ix.Kernel.TcM.PreservesInferOnly.strengthenWFValue,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.PreservesInferOnly.withInferOnly,
+  { root := ``Ix.Kernel.TcM.PreservesInferOnly.withInferOnly,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.PreservesInferOnly.openBinder,
+  { root := ``Ix.Kernel.TcM.PreservesInferOnly.openBinder,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.PreservesInferOnly.inferKey,
+  { root := ``Ix.Kernel.TcM.PreservesInferOnly.inferKey,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.cacheInferResult_preservesInferOnly,
+  { root := ``Ix.Kernel.RecM.cacheInferResult_preservesInferOnly,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.withLctxScope_preservesInferOnly,
+  { root := ``Ix.Kernel.RecM.withLctxScope_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.ensureForallDirect_preservesInferOnly,
+  { root := ``Ix.Kernel.RecM.ensureForallDirect_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.ensureSortDirect_preservesInferOnly,
+  { root := ``Ix.Kernel.RecM.ensureSortDirect_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.methodsOut_preservesInferOnly,
+  { root := ``Ix.Kernel.Methods.methodsOut_preservesInferOnly,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.methodsN_preservesInferOnly,
+  { root := ``Ix.Kernel.Methods.methodsN_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.PreservesInferOnly.isDefEq_full_wf,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.PreservesInferOnly.isDefEq_full_wf,
+    standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.openBinder_scope_base,
+  { root := ``Ix.Kernel.TcM.openBinder_scope_base,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.openBinder_pre_scope,
+  { root := ``Ix.Kernel.TcM.openBinder_pre_scope,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.KExpr.abstractFVarsSpec_instantiateRevSpec_singleton,
+  { root := ``Ix.Kernel.KExpr.abstractFVarsSpec_instantiateRevSpec_singleton,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TrKExprS.closeOpenedFVarZero,
+  { root := ``Ix.Kernel.TrKExprS.closeOpenedFVarZero,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.withLctxScope_openBinder_pre_wf,
+  { root := ``Ix.Kernel.RecM.withLctxScope_openBinder_pre_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_lam_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_lam_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_all_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_all_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.openLet_scope_base,
+  { root := ``Ix.Kernel.TcM.openLet_scope_base,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.openLet_pre_scope,
+  { root := ``Ix.Kernel.TcM.openLet_pre_scope,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.withLctxScope_openLet_pre_wf,
+  { root := ``Ix.Kernel.RecM.withLctxScope_openLet_pre_wf,
     standardAxioms := standard, nativeAxioms := expressionNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_let_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_let_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.ProjectionInference.FullWFAt.of_semantic_and_policy,
+  { root := ``Ix.Kernel.ProjectionInference.FullWFAt.of_semantic_and_policy,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_prj_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_prj_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_full_wf,
+  { root := ``Ix.Kernel.RecM.inferUncached_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferWith_full_wf,
+  { root := ``Ix.Kernel.RecM.inferWith_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.infer_full_wf,
+  { root := ``Ix.Kernel.RecM.infer_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.PreservesInferOnly.instantiateUnivParams,
+  { root := ``Ix.Kernel.TcM.PreservesInferOnly.instantiateUnivParams,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.inferUncached_preservesInferOnly,
+  { root := ``Ix.Kernel.RecM.inferUncached_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.ProjectionInference.preservesInferOnlyAt,
+  { root := ``Ix.Kernel.ProjectionInference.preservesInferOnlyAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.infer_preservesInferOnly_of_whnf,
+  { root := ``Ix.Kernel.RecM.infer_preservesInferOnly_of_whnf,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
 
   -- K3 closes the concrete operational policy and retains the old strong
   -- all-support inference roots below as compatibility artifacts.  The
   -- public checker now consumes the bounded successor-layer resources above.
-  { root := ``Ix.Tc.Methods.next_preservesInferOnly,
+  { root := ``Ix.Kernel.Methods.next_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.inferOnlyClosed,
+  { root := ``Ix.Kernel.Methods.inferOnlyClosed,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.methodsN_concrete_preservesInferOnly,
+  { root := ``Ix.Kernel.Methods.methodsN_concrete_preservesInferOnly,
     standardAxioms := standard, nativeAxioms := inferNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.FullInferenceWFAt,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.FullInferenceWFAt,
+    standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext.fullInferenceContext,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext.fullInferenceContext,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext.next_fullInferenceWFAt,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext.next_fullInferenceWFAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.Methods.methodsOut_fullInferenceWFAt,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.Methods.methodsOut_fullInferenceWFAt,
+    standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext.methodsN_fullInferenceWFAt,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext.methodsN_fullInferenceWFAt,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.RecursiveMethodClosureContext.publicInfer_full_wf,
+  { root := ``Ix.Kernel.RecursiveMethodClosureContext.publicInfer_full_wf,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.checkConst.rollback_on_error,
+  { root := ``Ix.Kernel.TcM.checkConst.rollback_on_error,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.checkConst.rollback_preserves_kernel,
+  { root := ``Ix.Kernel.TcM.checkConst.rollback_preserves_kernel,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.checkConst.wf,
+  { root := ``Ix.Kernel.TcM.checkConst.wf,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.checkConst.rejected_of_no_decl_wf,
+  { root := ``Ix.Kernel.TcM.checkConst.rejected_of_no_decl_wf,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.checkConst.axiom_pending_sound,
+  { root := ``Ix.Kernel.TcM.checkConst.axiom_pending_sound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConstMemberFresh_scoped_pending_evidence,
+  { root := ``Ix.Kernel.RecM.checkConstMemberFresh_scoped_pending_evidence,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
@@ -9515,54 +9502,54 @@ private def roots : Array RootAllowance := #[
   -- singleton-definition adapter consumes K3; inductive/recursor bodies keep
   -- their E2 oracle premise explicit.  Quotients are audited as excluded from
   -- this authority rather than being silently admitted by the block theorem.
-  { root := ``Ix.Tc.ExactCheckBlock.rebaseWorld,
+  { root := ``Ix.Kernel.ExactCheckBlock.rebaseWorld,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.coordinatedBlockIfKind_success_trace,
+  { root := ``Ix.Kernel.RecM.coordinatedBlockIfKind_success_trace,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.classifyBlock_wf,
+  { root := ``Ix.Kernel.RecM.classifyBlock_wf,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.coordinatedBlockFor_some_preserves,
+  { root := ``Ix.Kernel.RecM.coordinatedBlockFor_some_preserves,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.CacheInvariant.replayCoordinatedMember,
+  { root := ``Ix.Kernel.CacheInvariant.replayCoordinatedMember,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.CacheInvariant.rejectsSuccessWithUntrustedMember,
+  { root := ``Ix.Kernel.CacheInvariant.rejectsSuccessWithUntrustedMember,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkCoordinatedBlock_accepted,
+  { root := ``Ix.Kernel.RecM.checkCoordinatedBlock_accepted,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkCoordinatedBlock_rejected,
+  { root := ``Ix.Kernel.RecM.checkCoordinatedBlock_rejected,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkConst_success_disposition,
+  { root := ``Ix.Kernel.RecM.checkConst_success_disposition,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.TcM.checkConst.blockDisposition,
+  { root := ``Ix.Kernel.TcM.checkConst.blockDisposition,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.certifySingletonDefinition,
+  { root := ``Ix.Kernel.RecM.certifySingletonDefinition,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.certifySingletonDefinitionScoped,
+  { root := ``Ix.Kernel.RecM.certifySingletonDefinitionScoped,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.certifyOracleBackedBlock,
+  { root := ``Ix.Kernel.RecM.certifyOracleBackedBlock,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.coordinatedBlockFor_quotient,
+  { root := ``Ix.Kernel.RecM.coordinatedBlockFor_quotient,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.Catalog.quotient_not_coordinated,
+  { root := ``Ix.Kernel.Catalog.quotient_not_coordinated,
     standardAxioms := propextOnly,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
   -- Quotients remain physically standalone, but semantic admission is one
@@ -9570,74 +9557,74 @@ private def roots : Array RootAllowance := #[
   -- equation. The production bridge inverts all four real checkQuot runs,
   -- converts digest equality through a finite collision scope, and publishes
   -- the completed transaction as one exact trusted-log event. Its temporary
-  -- Lean4Lean semantic input is an explicit theorem parameter, not an axiom.
-  { root := ``Ix.Tc.QuotientAdmissionStep.bind,
+  -- Ix.Theory.Named semantic input is an explicit theorem parameter, not an axiom.
+  { root := ``Ix.Kernel.QuotientAdmissionStep.bind,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientAdmissionStep.le,
+  { root := ``Ix.Kernel.QuotientAdmissionStep.le,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.catalogEntries,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.catalogEntries,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.nameAssignments,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.nameAssignments,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.toAddQuot,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.toAddQuot,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.le,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.le,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.quotType,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.quotType,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.quotCtor,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.quotCtor,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.quotLift,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.quotLift,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.quotInd,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.quotInd,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientBundleAdmission.quotientDefEq,
+  { root := ``Ix.Kernel.QuotientBundleAdmission.quotientDefEq,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientAdmission.wf,
+  { root := ``Ix.Kernel.QuotientAdmission.wf,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientAdmission.le,
+  { root := ``Ix.Kernel.QuotientAdmission.le,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkQuot_success_typeAddress,
+  { root := ``Ix.Kernel.RecM.checkQuot_success_typeAddress,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkQuot_success_levels,
+  { root := ``Ix.Kernel.RecM.checkQuot_success_levels,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.RecM.checkQuot_success_type,
+  { root := ``Ix.Kernel.RecM.checkQuot_success_type,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.CheckedQuotientBundle.toAdmission,
+  { root := ``Ix.Kernel.CheckedQuotientBundle.toAdmission,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientAdmission.entry,
+  { root := ``Ix.Kernel.QuotientAdmission.entry,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientAdmission.admit,
+  { root := ``Ix.Kernel.QuotientAdmission.admit,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.QuotientAdmission.newlyTrustedMember,
+  { root := ``Ix.Kernel.QuotientAdmission.newlyTrustedMember,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.CheckedQuotientBundle.admitAtomically,
+  { root := ``Ix.Kernel.CheckedQuotientBundle.admitAtomically,
     standardAxioms := standard, nativeAxioms := levelNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AmbientNat.E0.atomicAdmission,
+  { root := ``Ix.Kernel.AmbientNat.E0.atomicAdmission,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AmbientNat.E0.rejectsPrematureSuccess,
+  { root := ``Ix.Kernel.AmbientNat.E0.rejectsPrematureSuccess,
     standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
 
@@ -9646,124 +9633,124 @@ private def roots : Array RootAllowance := #[
   -- composes successful items in a constructive collapsed-block order.  The
   -- serial roots recover real successful checkConst calls from the public
   -- result array before applying the named C2 success adapter.
-  { root := ``Ix.Tc.WorkCovers.covered,
+  { root := ``Ix.Kernel.WorkCovers.covered,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.WorkCovers.subjectOfCovered,
+  { root := ``Ix.Kernel.WorkCovers.subjectOfCovered,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.VerifyWorld.AcceptsAddress.mono,
+  { root := ``Ix.Kernel.VerifyWorld.AcceptsAddress.mono,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.WorkItemAccepted.mono,
+  { root := ``Ix.Kernel.WorkItemAccepted.mono,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.WorkItemAccepted.acceptsAddress,
+  { root := ``Ix.Kernel.WorkItemAccepted.acceptsAddress,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.WellFoundedBlocks.noTwoCycle,
+  { root := ``Ix.Kernel.WellFoundedBlocks.noTwoCycle,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.acceptedWorkset_subjectWF,
+  { root := ``Ix.Kernel.acceptedWorkset_subjectWF,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IxonEnv.dependencyCatalog_blockOf,
+  { root := ``Ix.Kernel.IxonEnv.dependencyCatalog_blockOf,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IxonEnv.dependencyCatalog_dependsOn_iff,
+  { root := ``Ix.Kernel.IxonEnv.dependencyCatalog_dependsOn_iff,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IxonExpr.DeclReference.target_mem_refs,
+  { root := ``Ix.Kernel.IxonExpr.DeclReference.target_mem_refs,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.IxonConstant.SemanticDependency.target_mem_refs,
+  { root := ``Ix.Kernel.IxonConstant.SemanticDependency.target_mem_refs,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.ExactAnonEntry.getConst,
+  { root := ``Ix.Kernel.ExactAnonEntry.getConst,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.ExactAnonEntry.constant_unique,
+  { root := ``Ix.Kernel.ExactAnonEntry.constant_unique,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.ExactAnonEntry.buildAnonWorkItem_eq,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.ExactAnonEntry.buildAnonWorkItem_eq,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.buildAnonWork_eq_expected,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.buildAnonWork_eq_expected,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.mem_expectedAnonWork_iff,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.mem_expectedAnonWork_iff,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkItem.ofConstantInfo_root,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkItem.ofConstantInfo_root,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkItem.covers_root,
+  { root := ``Ix.Kernel.AnonWorkItem.covers_root,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkItem.ofConstantInfo_primary_mem_targets,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkItem.ofConstantInfo_primary_mem_targets,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.source_covered,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.source_covered,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.covered_is_source,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.covered_is_source,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.expected_primary_mem_targets,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.expected_primary_mem_targets,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.ExactAnonEntry.blockOfAddr_eq_owner,
+  { root := ``Ix.Kernel.ExactAnonEntry.blockOfAddr_eq_owner,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.ExactAnonEntry.blockOfAddr_eq_self,
+  { root := ``Ix.Kernel.ExactAnonEntry.blockOfAddr_eq_self,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.matches_blockOfAddr,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.matches_blockOfAddr,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.expectedAnonWork_covers,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.expectedAnonWork_covers,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.expectedAnonWork_matchesCatalog,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.expectedAnonWork_matchesCatalog,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.buildAnonWork_exact,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.buildAnonWork_exact,
+    standardAxioms := standard,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.finishAnonCheckItem_results,
+  { root := ``Ix.Kernel.finishAnonCheckItem_results,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.runAnonCheckItem_preserves_result,
+  { root := ``Ix.Kernel.runAnonCheckItem_preserves_result,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.runAnonCheckList_preserves_result,
+  { root := ``Ix.Kernel.runAnonCheckList_preserves_result,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.runAnonCheckItem_error_result,
+  { root := ``Ix.Kernel.runAnonCheckItem_error_result,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.serialChecksSucceeded_of_results,
+  { root := ``Ix.Kernel.serialChecksSucceeded_of_results,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.SerialChecksSucceeded.successfulStep,
+  { root := ``Ix.Kernel.SerialChecksSucceeded.successfulStep,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.SerialChecksSucceeded.allAccepted,
+  { root := ``Ix.Kernel.SerialChecksSucceeded.allAccepted,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.checkEnvAnon_eq_serial,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.checkEnvAnon_eq_serial,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.checkEnvAnon_subjectWF,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.checkEnvAnon_subjectWF,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.E1Fixture.exactSubjectsAndAssumptions,
+  { root := ``Ix.Kernel.E1Fixture.exactSubjectsAndAssumptions,
     standardAxioms := standardWithoutChoice,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.E1Fixture.droppingWorkItem_breaks_coverage,
+  { root := ``Ix.Kernel.E1Fixture.droppingWorkItem_breaks_coverage,
     standardAxioms := propextOnly,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.E1Fixture.unresolvedDependency_breaks_closure,
+  { root := ``Ix.Kernel.E1Fixture.unresolvedDependency_breaks_closure,
     standardAxioms := propextOnly,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.E1Fixture.cyclicStandalones_not_wellFounded,
+  { root := ``Ix.Kernel.E1Fixture.cyclicStandalones_not_wellFounded,
     standardAxioms := propextOnly,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
 
@@ -9774,68 +9761,68 @@ private def roots : Array RootAllowance := #[
   -- Separately, the certificate-backed replay adapter consumes already-
   -- installed member provenance, admits exact arrays idempotently, and gives
   -- all-block consumers a path which cannot reach oracle materialization.
-  { root := ``Ix.Tc.SupportedStandaloneResources.promotes,
+  { root := ``Ix.Kernel.SupportedStandaloneResources.promotes,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.SupportedBlockBodyResources.certify,
+  { root := ``Ix.Kernel.SupportedBlockBodyResources.certify,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.SupportedCheckRun.accepts,
+  { root := ``Ix.Kernel.SupportedCheckRun.accepts,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.SupportedCheckFragment.checkSuccessSound,
+  { root := ``Ix.Kernel.SupportedCheckFragment.checkSuccessSound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.AnonWorkEnvWF.checkEnvAnon_supported_subjectWF,
+  { root := ``Ix.Kernel.AnonWorkEnvWF.checkEnvAnon_supported_subjectWF,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.CertificateBackedBlockResources.newlyTrustedMember,
+  { root := ``Ix.Kernel.CertificateBackedBlockResources.newlyTrustedMember,
     standardAxioms := standard,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
-  { root := ``Ix.Tc.CertificateBackedBlockResources.accepts,
-    standardAxioms := standard, nativeAxioms := blake3Native,
+  { root := ``Ix.Kernel.CertificateBackedBlockResources.accepts,
+    standardAxioms := standard,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
-  { root := ``Ix.Tc.CertificateBackedCheckFragment.checkSuccessSound,
+  { root := ``Ix.Kernel.CertificateBackedCheckFragment.checkSuccessSound,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
   { root :=
-      ``Ix.Tc.AnonWorkEnvWF.checkEnvAnon_certificateBacked_subjectWF,
+      ``Ix.Kernel.AnonWorkEnvWF.checkEnvAnon_certificateBacked_subjectWF,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
-  { root := ``Ix.Tc.BooleanEnumerationFixture.subjectWF,
+  { root := ``Ix.Kernel.BooleanEnumerationFixture.subjectWF,
     standardAxioms := standard, nativeAxioms := booleanDriverNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
-  { root := ``Ix.Tc.BooleanSerialized.subjectWF,
+  { root := ``Ix.Kernel.BooleanSerialized.subjectWF,
     standardAxioms := standard, nativeAxioms := serializedBooleanNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
-  { root := ``Ix.Tc.SerializedLiteralBlobs.literalRoundTrip,
+  { root := ``Ix.Kernel.SerializedLiteralBlobs.literalRoundTrip,
     standardAxioms := standard, nativeAxioms := literalRoundTripNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.SerializedLiteralBlobs.malformedConstantRejected,
+  { root := ``Ix.Kernel.SerializedLiteralBlobs.malformedConstantRejected,
     standardAxioms := standard, nativeAxioms := malformedConstantNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.SerializedLiteralBlobs.malformedBlobRejected,
+  { root := ``Ix.Kernel.SerializedLiteralBlobs.malformedBlobRejected,
     standardAxioms := standard, nativeAxioms := malformedBlobNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
   { root :=
-      ``Ix.Tc.SupportedAcceptanceFixture.block_rejects_standalone_route,
+      ``Ix.Kernel.SupportedAcceptanceFixture.block_rejects_standalone_route,
     standardAxioms := propextOnly,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.SupportedAcceptanceFixture.block_rejects_wrong_route,
+  { root := ``Ix.Kernel.SupportedAcceptanceFixture.block_rejects_wrong_route,
     standardAxioms := propextOnly,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
   { root :=
-      ``Ix.Tc.SupportedAcceptanceFixture.certificate_backed_definition_excluded,
+      ``Ix.Kernel.SupportedAcceptanceFixture.certificate_backed_definition_excluded,
     forbiddenDependencies := certificateBackedDriverForbiddenDependencies },
   { root :=
-      ``Ix.Tc.SupportedAcceptanceFixture.booleanFamilyBody_certified,
+      ``Ix.Kernel.SupportedAcceptanceFixture.booleanFamilyBody_certified,
     standardAxioms := standard, nativeAxioms := booleanFamilyBodyNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
@@ -9844,15 +9831,15 @@ private def roots : Array RootAllowance := #[
   -- the joint suffix model explicit; the scoped checker roots below construct
   -- the finite model from their exact public execution certificate.  Two
   -- exact Blake3 address inequalities remain explicit fixture inputs.
-  { root := ``Ix.Tc.PositiveFuelSort.methodContractAtFuelOne,
+  { root := ``Ix.Kernel.PositiveFuelSort.methodContractAtFuelOne,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.fullInferenceAtFuelOne,
+  { root := ``Ix.Kernel.PositiveFuelSort.fullInferenceAtFuelOne,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.pipelines_cover_concreteAxiom,
+  { root := ``Ix.Kernel.PositiveFuelSort.pipelines_cover_concreteAxiom,
     standardAxioms := standard, nativeAxioms := inferNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := boundedKnotForbiddenDependencies },
@@ -9862,26 +9849,26 @@ private def roots : Array RootAllowance := #[
   -- schedule, instantiate `ScopedKernelSuffixModel.finiteOperational`, and
   -- retain `StateInScope` through successful semantic promotion.  None may
   -- pass through the global suffix-model compatibility path.
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.model,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.model,
     standardAxioms := standard, nativeAxioms := contextNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.initialState_inv,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.initialState_inv,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.inference_run,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.inference_run,
     standardAxioms := standard, nativeAxioms := nameContextNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.public_requests,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.public_requests,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.runAssumptions,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.runAssumptions,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.publicContext,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.publicContext,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
-  { root := ``Ix.Tc.PositiveFuelSort.Checker.checked_and_promoted,
+  { root := ``Ix.Kernel.PositiveFuelSort.Checker.checked_and_promoted,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     sorryOrigins := typingDebt,
     forbiddenDependencies := scopedK2SForbiddenDependencies },
@@ -9890,20 +9877,20 @@ private def roots : Array RootAllowance := #[
   -- and exact public checker executions for both verdicts.  Its valid path
   -- carries a concrete acceptance result and promotion; its invalid path
   -- returns the malformed-universe error with exact rollback.
-  { root := ``Ix.Tc.AmbientNat.goodCheckResult,
+  { root := ``Ix.Kernel.AmbientNat.goodCheckResult,
     standardAxioms := standard,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.AmbientNat.initial_good_public,
+  { root := ``Ix.Kernel.AmbientNat.initial_good_public,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.AmbientNat.reset_bad_public,
+  { root := ``Ix.Kernel.AmbientNat.reset_bad_public,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := k1ForbiddenDependencies },
-  { root := ``Ix.Tc.AmbientNat.publicCheckLifecycle,
+  { root := ``Ix.Kernel.AmbientNat.publicCheckLifecycle,
     standardAxioms := standard, nativeAxioms := inductiveNative,
     forbiddenDependencies := k1ForbiddenDependencies }
 ]
 
-run_cmd Ix.Tc.Verify.Audit.check roots
+run_cmd Ix.Kernel.Verify.Audit.check roots
 
-end Ix.Tc.Verify.Audit.Completed
+end Ix.Kernel.Verify.Audit.Completed
diff --git a/Ix/Tc/Verify/Audit/Conditional.lean b/Ix/Kernel/Verify/Audit/Conditional.lean
similarity index 51%
rename from Ix/Tc/Verify/Audit/Conditional.lean
rename to Ix/Kernel/Verify/Audit/Conditional.lean
index 3e95368ec..2796dce90 100644
--- a/Ix/Tc/Verify/Audit/Conditional.lean
+++ b/Ix/Kernel/Verify/Audit/Conditional.lean
@@ -1,35 +1,35 @@
-import Ix.Tc.Verify.Audit.Completed
-import Ix.Tc.Verify.Inductive.MutualRecursorAdmission
+import Ix.Kernel.Verify.Audit.Completed
+import Ix.Kernel.Verify.Inductive.MutualRecursorAdmission
 
 /-!
-# Trust manifest for conditional `Ix.Tc.Verify` roots
+# Trust manifest for conditional `Ix.Kernel.Verify` roots
 
 This manifest is deliberately separate from `Audit.Completed`.  Its roots
-may use only individually named witnesses from `Ix.Tc.Upstream.Pending`, and
+may use only individually named witnesses from `Ix.Kernel.Frontier.Pending`, and
 the exact axiom audit fails as soon as either the pending or native footprint
 changes.  Moving a theorem from here to `Completed` therefore requires
 removing every dependency on the quarantine namespace.
 -/
 
-namespace Ix.Tc.Verify.Audit.Conditional
+namespace Ix.Kernel.Verify.Audit.Conditional
 
-open Ix.Tc.Verify.Audit
+open Ix.Kernel.Verify.Audit
 
 private def standard : Array Lean.Name :=
   #[``propext, ``Classical.choice, ``Quot.sound]
 
 private def mutualRecursorPending : Array Lean.Name := #[
-  ``Ix.Tc.Upstream.Pending.mutualTreePhysicalGenerationWF,
-  ``Ix.Tc.Upstream.Pending.mutualTreePhysicalRulePatternSound
+  ``Ix.Kernel.Frontier.Pending.mutualTreePhysicalGenerationWF,
+  ``Ix.Kernel.Frontier.Pending.mutualTreePhysicalRulePatternSound
 ]
 
 private def roots : Array RootAllowance := #[
-  { root := ``Ix.Tc.MutualTreeFixture.mutualRecursorConditionalClosure,
+  { root := ``Ix.Kernel.MutualTreeFixture.mutualRecursorConditionalClosure,
     standardAxioms := standard,
     pendingAxioms := mutualRecursorPending,
     nativeAxioms := Completed.mutualRecursorConditionalNative }
 ]
 
-run_cmd Ix.Tc.Verify.Audit.check roots
+run_cmd Ix.Kernel.Verify.Audit.check roots
 
-end Ix.Tc.Verify.Audit.Conditional
+end Ix.Kernel.Verify.Audit.Conditional
diff --git a/Ix/Tc/Verify/Audit/SorryFrontier.lean b/Ix/Kernel/Verify/Audit/SorryFrontier.lean
similarity index 66%
rename from Ix/Tc/Verify/Audit/SorryFrontier.lean
rename to Ix/Kernel/Verify/Audit/SorryFrontier.lean
index cad98b7ea..9658ca6f7 100644
--- a/Ix/Tc/Verify/Audit/SorryFrontier.lean
+++ b/Ix/Kernel/Verify/Audit/SorryFrontier.lean
@@ -1,21 +1,21 @@
-import Ix.Tc.Verify.Audit.Completed
-import Ix.Tc.Verify.Audit.Statements
+import Ix.Kernel.Verify.Audit.Completed
+import Ix.Kernel.Verify.Audit.Statements
 
 /-!
-# `Ix.Tc.Verify` source sorry frontier
+# `Ix.Kernel.Verify` source sorry frontier
 
-Fail the build if any declaration defined in an `Ix.Tc.Verify` source module
+Fail the build if any declaration defined in an `Ix.Kernel.Verify` source module
 directly uses `sorryAx` — the elaborated form of a `sorry` token in that
 source. Reading it from the checked environment means `sorry` tokens in
 comments, string/char literals, or nested block comments cannot cause false
 positives. Filtering is by SOURCE MODULE via
 `getModuleIdxFor?`, not declaration name, so macro-emitted constants registered
-under unqualified names are still attributed to their host module. Upstream
-(Lean4Lean) `sorryAx` users are excluded because they live outside the
-`Ix.Tc.Verify` namespace — the distinction `lake build --wfail` cannot make.
+under unqualified names are still attributed to their host module. Named
+specification (`Ix.Theory.Named`) `sorryAx` users are tracked separately because
+their source modules are outside `Ix.Kernel.Verify`.
 
 Runs as a `run_cmd` at elaboration, next to the trust manifest it complements
-(`Ix.Tc.Verify.Audit.check`): a build-time command, not an executable, so it
+(`Ix.Kernel.Verify.Audit.check`): a build-time command, not an executable, so it
 never links the Rust FFI archives an exe over these modules would clash on.
 Importing the audit roots pulls the verified surface into scope; a declaration
 in a Verify module not reachable from those roots is not checked here.
@@ -23,7 +23,7 @@ in a Verify module not reachable from those roots is not checked here.
 
 open Lean Lean.Elab.Command
 
-namespace Ix.Tc.Verify.Audit
+namespace Ix.Kernel.Verify.Audit
 
 /-- Constants referenced directly by a declaration's type or value, following
 the same cases as `Lean.collectAxioms`. The `Lean.` qualifiers are load-bearing:
@@ -39,7 +39,7 @@ private def sorryFrontierDirectConstants : Lean.ConstantInfo → Array Lean.Name
   | .recInfo v => v.type.getUsedConstants
   | .inductInfo v => v.type.getUsedConstants ++ v.ctors
 
-/-- Fail if any `Ix.Tc.Verify` source declaration directly references `sorryAx`. -/
+/-- Fail if any `Ix.Kernel.Verify` source declaration directly references `sorryAx`. -/
 def checkSorryFrontier : CommandElabM Unit := do
   let env ← getEnv
   let moduleNames := env.allImportedModuleNames
@@ -48,15 +48,15 @@ def checkSorryFrontier : CommandElabM Unit := do
     | none => none
     | some idx =>
       let mod := moduleNames[idx.toNat]!
-      if (`Ix.Tc.Verify).isPrefixOf mod && (sorryFrontierDirectConstants info).contains ``sorryAx then some (mod, name) else none
+      if (`Ix.Kernel.Verify).isPrefixOf mod && (sorryFrontierDirectConstants info).contains ``sorryAx then some (mod, name) else none
   let offenders := offenders.toArray.qsort (fun a b => Lean.Name.lt a.1 b.1)
   if offenders.isEmpty then
-    logInfo m!"Ix.Tc.Verify sorry frontier OK: no source declaration uses sorryAx"
+    logInfo m!"Ix.Kernel.Verify sorry frontier OK: no source declaration uses sorryAx"
   else
     let body := String.intercalate "\n"
       (offenders.toList.map fun (mod, name) => s!"  {mod} :: {name}")
-    throwError m!"Ix.Tc.Verify sorry frontier changed — {offenders.size} declaration(s) directly use sorryAx:\n{body}\nResolve the sorry, or extend the Ix.Tc.Verify.Audit trust manifest, only when the verification frontier intentionally changes."
+    throwError m!"Ix.Kernel.Verify sorry frontier changed — {offenders.size} declaration(s) directly use sorryAx:\n{body}\nResolve the sorry, or extend the Ix.Kernel.Verify.Audit trust manifest, only when the verification frontier intentionally changes."
 
 run_cmd checkSorryFrontier
 
-end Ix.Tc.Verify.Audit
+end Ix.Kernel.Verify.Audit
diff --git a/Ix/Tc/Verify/Audit/Statements.lean b/Ix/Kernel/Verify/Audit/Statements.lean
similarity index 50%
rename from Ix/Tc/Verify/Audit/Statements.lean
rename to Ix/Kernel/Verify/Audit/Statements.lean
index 7c4fc3186..976bd7d50 100644
--- a/Ix/Tc/Verify/Audit/Statements.lean
+++ b/Ix/Kernel/Verify/Audit/Statements.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Audit.Basic
-import Ix.Tc.Verify.Audit.Completed
-import Ix.Tc.Verify.Statements
+import Ix.Kernel.Verify.Audit.Basic
+import Ix.Kernel.Verify.Audit.Completed
+import Ix.Kernel.Verify.Statements
 
 /-!
 # Trust manifest for the public checker statement frontier
@@ -8,7 +8,7 @@ import Ix.Tc.Verify.Statements
 All seven roots are concrete results over the bounded production recursion
 schedule and checker.  The three recursive-method adapters have no `sorryAx`
 dependency; the standalone and atomic-block checker roots retain only the two
-named Lean4Lean typing lemmas through their singleton-definition branch.  The
+named Ix.Theory.Named typing lemmas through their singleton-definition branch.  The
 E3-S root executes the exact Boolean serial workset and composes its actual
 runtime success gates with E1 and fixed certificate-backed E2 entries. This
 module permits no local statement placeholder and additionally forbids the
@@ -16,33 +16,33 @@ Boolean/serialized roots from reaching oracle construction, restaging, or
 world materialization.
 -/
 
-namespace Ix.Tc.Verify.Audit.Statements
+namespace Ix.Kernel.Verify.Audit.Statements
 
-open Ix.Tc.Verify.Audit
+open Ix.Kernel.Verify.Audit
 
 private def standard : Array Lean.Name :=
   #[``propext, ``Classical.choice, ``Quot.sound]
 
 private def forallEInv : Lean.Name :=
-  ``Lean4Lean.VEnv.IsDefEqU.forallE_inv_stratified
-private def sortInv : Lean.Name := ``Lean4Lean.VEnv.IsDefEqU.sort_inv
+  ``Ix.Theory.Named.VEnv.IsDefEqU.forallE_inv_stratified
+private def sortInv : Lean.Name := ``Ix.Theory.Named.VEnv.IsDefEqU.sort_inv
 private def checkerDebt : Array Lean.Name := #[forallEInv, sortInv]
 
 private def legacyWholeEnv : Array Lean.Name := #[
-  ``Ix.Tc.AddKInduct,
-  ``Ix.Tc.AddKInduct.to_addInduct,
-  ``Ix.Tc.TrKEnv',
-  ``Ix.Tc.TrKEnv
+  ``Ix.Kernel.AddKInduct,
+  ``Ix.Kernel.AddKInduct.to_addInduct,
+  ``Ix.Kernel.TrKEnv',
+  ``Ix.Kernel.TrKEnv
 ]
 
 private def legacyAllDepthKnot : Array Lean.Name := #[
-  ``Ix.Tc.RecursiveMethodClosureContext,
-  ``Ix.Tc.RecursiveMethodClosureContext.closedAt,
-  ``Ix.Tc.RecursiveMethodClosureContext.methodsN,
-  ``Ix.Tc.RecursiveMethodClosureContext.fullInferenceContext,
-  ``Ix.Tc.RecursiveMethodClosureContext.next_fullInferenceWFAt,
-  ``Ix.Tc.RecursiveMethodClosureContext.methodsN_fullInferenceWFAt,
-  ``Ix.Tc.RecursiveMethodClosureContext.publicInfer_full_wf
+  ``Ix.Kernel.RecursiveMethodClosureContext,
+  ``Ix.Kernel.RecursiveMethodClosureContext.closedAt,
+  ``Ix.Kernel.RecursiveMethodClosureContext.methodsN,
+  ``Ix.Kernel.RecursiveMethodClosureContext.fullInferenceContext,
+  ``Ix.Kernel.RecursiveMethodClosureContext.next_fullInferenceWFAt,
+  ``Ix.Kernel.RecursiveMethodClosureContext.methodsN_fullInferenceWFAt,
+  ``Ix.Kernel.RecursiveMethodClosureContext.publicInfer_full_wf
 ]
 
 private def forbidden : Array Lean.Name :=
@@ -52,14 +52,14 @@ private def forbidden : Array Lean.Name :=
 library, but must not manufacture a global suffix model or pass through the
 old proposition-classifier/run-context path. -/
 private def legacyGlobalSuffix : Array Lean.Name := #[
-  ``Ix.Tc.KernelSuffixModel,
-  ``Ix.Tc.ScopedKernelSuffixModel.toKernelSuffixModel,
-  ``Ix.Tc.PropositionClassifierContext,
-  ``Ix.Tc.RecursiveMethodRunContext,
-  ``Ix.Tc.TcM.whnf.wf_legacy,
-  ``Ix.Tc.TcM.infer.wf_legacy,
-  ``Ix.Tc.TcM.isDefEq.wf_legacy,
-  ``Ix.Tc.TcM.checkConst.wf_legacy
+  ``Ix.Kernel.KernelSuffixModel,
+  ``Ix.Kernel.ScopedKernelSuffixModel.toKernelSuffixModel,
+  ``Ix.Kernel.PropositionClassifierContext,
+  ``Ix.Kernel.RecursiveMethodRunContext,
+  ``Ix.Kernel.TcM.whnf.wf_legacy,
+  ``Ix.Kernel.TcM.infer.wf_legacy,
+  ``Ix.Kernel.TcM.isDefEq.wf_legacy,
+  ``Ix.Kernel.TcM.checkConst.wf_legacy
 ]
 
 private def scopedForbidden : Array Lean.Name :=
@@ -69,79 +69,71 @@ private def scopedForbidden : Array Lean.Name :=
 not regain the retired residual-oracle/world-materialization path through an
 adapter refactor. -/
 private def oracleWorldMaterialization : Array Lean.Name := #[
-  ``Ix.Tc.VerifyWorld.admitOracle,
-  ``Ix.Tc.VerifyWorld.le_admitOracle,
-  ``Ix.Tc.OracleBlockCertificate.admit,
-  ``Ix.Tc.OracleBlockCertificate.admitState,
-  ``Ix.Tc.RecM.certifyOracleBackedBlock,
-  ``Ix.Tc.RecM.certifyOracleBackedAdmittedBlock,
-  ``Ix.Tc.SingletonFamilyCatalogLink.oracle,
-  ``Ix.Tc.SingletonRecursorCatalogLink.oracle,
-  ``Ix.Tc.InductiveOracle.reindex,
-  ``Ix.Tc.InductiveOracle.restageMissing
+  ``Ix.Kernel.VerifyWorld.admitOracle,
+  ``Ix.Kernel.VerifyWorld.le_admitOracle,
+  ``Ix.Kernel.OracleBlockCertificate.admit,
+  ``Ix.Kernel.OracleBlockCertificate.admitState,
+  ``Ix.Kernel.RecM.certifyOracleBackedBlock,
+  ``Ix.Kernel.RecM.certifyOracleBackedAdmittedBlock,
+  ``Ix.Kernel.SingletonFamilyCatalogLink.oracle,
+  ``Ix.Kernel.SingletonRecursorCatalogLink.oracle,
+  ``Ix.Kernel.InductiveOracle.reindex,
+  ``Ix.Kernel.InductiveOracle.restageMissing
 ]
 
 private def certificateBackedForbidden : Array Lean.Name :=
   scopedForbidden ++ oracleWorldMaterialization
 
 private def runNative : Array Lean.Name := #[
-  nativeAxiom `Blake3
-    `Blake3.HasherOps.hash._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Expr
-    `Ix.Tc.KExpr.mkVar._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Level
-    `Ix.Tc.KUniv.mkSucc._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Monad
-    `Ix.Tc.TcM.ctxAddrForLbrUncached._native.native_decide.ax_3
+  nativeAxiom `Ix.Kernel.Expr
+    `Ix.Kernel.KExpr.mkVar._native.native_decide.ax_1,
+  nativeAxiom `Ix.Kernel.Level
+    `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1,
 ]
 
 private def checkConstNative : Array Lean.Name := #[
-  nativeAxiom `Blake3
-    `Blake3.HasherOps.hash._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Expr
-    `Ix.Tc.KExpr.mkVar._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Level
-    `Ix.Tc.KUniv.mkSucc._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Monad
-    `Ix.Tc.TcM.ctxAddrForLbrUncached._native.native_decide.ax_3,
+  nativeAxiom `Ix.Kernel.Expr
+    `Ix.Kernel.KExpr.mkVar._native.native_decide.ax_1,
+  nativeAxiom `Ix.Kernel.Level
+    `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1,
   nativeAxiom `Ix.Environment
     `Ix.Name.mkStr._native.native_decide.ax_1,
-  nativeAxiom `Ix.Tc.Inductive
-    `Ix.Tc.RecM.canonicalAuxOrder._native.native_decide.ax_9
+  nativeAxiom `Ix.Kernel.Inductive
+    `Ix.Kernel.RecM.canonicalAuxOrder._native.native_decide.ax_9
 ]
 
 private def roots : Array RootAllowance := #[
-  { root := ``Ix.Tc.TcM.whnf.wf,
+  { root := ``Ix.Kernel.TcM.whnf.wf,
     standardAxioms := standard, nativeAxioms := runNative,
     forbiddenDependencies := scopedForbidden },
-  { root := ``Ix.Tc.TcM.infer.wf,
+  { root := ``Ix.Kernel.TcM.infer.wf,
     standardAxioms := standard, nativeAxioms := runNative,
     forbiddenDependencies := scopedForbidden },
-  { root := ``Ix.Tc.TcM.isDefEq.wf,
+  { root := ``Ix.Kernel.TcM.isDefEq.wf,
     standardAxioms := standard, nativeAxioms := runNative,
     forbiddenDependencies := scopedForbidden },
-  { root := ``Ix.Tc.TcM.checkConst.wf,
+  { root := ``Ix.Kernel.TcM.checkConst.wf,
     standardAxioms := standard,
     nativeAxioms := checkConstNative,
     sorryOrigins := checkerDebt,
     forbiddenDependencies := scopedForbidden },
-  { root := ``Ix.Tc.TcM.checkConst.blockDisposition,
+  { root := ``Ix.Kernel.TcM.checkConst.blockDisposition,
     standardAxioms := standard,
     nativeAxioms := checkConstNative,
     sorryOrigins := checkerDebt,
     forbiddenDependencies := scopedForbidden },
-  { root := ``Ix.Tc.BooleanEnumerationFixture.subjectWF,
+  { root := ``Ix.Kernel.BooleanEnumerationFixture.subjectWF,
     standardAxioms := standard,
-    nativeAxioms := Ix.Tc.Verify.Audit.Completed.booleanDriverNative,
+    nativeAxioms := Ix.Kernel.Verify.Audit.Completed.booleanDriverNative,
     sorryOrigins := checkerDebt,
     forbiddenDependencies := certificateBackedForbidden },
-  { root := ``Ix.Tc.BooleanSerialized.subjectWF,
+  { root := ``Ix.Kernel.BooleanSerialized.subjectWF,
     standardAxioms := standard,
-    nativeAxioms := Ix.Tc.Verify.Audit.Completed.serializedBooleanNative,
+    nativeAxioms := Ix.Kernel.Verify.Audit.Completed.serializedBooleanNative,
     sorryOrigins := checkerDebt,
     forbiddenDependencies := certificateBackedForbidden }
 ]
 
-run_cmd Ix.Tc.Verify.Audit.check roots
+run_cmd Ix.Kernel.Verify.Audit.check roots
 
-end Ix.Tc.Verify.Audit.Statements
+end Ix.Kernel.Verify.Audit.Statements
diff --git a/Ix/Tc/Verify/Cache.lean b/Ix/Kernel/Verify/Cache.lean
similarity index 99%
rename from Ix/Tc/Verify/Cache.lean
rename to Ix/Kernel/Verify/Cache.lean
index 307893095..d35ea1e8a 100644
--- a/Ix/Tc/Verify/Cache.lean
+++ b/Ix/Kernel/Verify/Cache.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.Env
-import Ix.Tc.Verify.Monad
-import Ix.Tc.Verify.Support
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.Env
+import Ix.Kernel.Verify.Monad
+import Ix.Kernel.Verify.Support
 import Std.Data.HashMap.Lemmas
 import Std.Data.HashSet.Lemmas
 
@@ -56,7 +56,7 @@ does not treat an untagged concrete lookup as trusted merely because it was
 listed here.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-! ## Lookup authority -/
 
@@ -100,7 +100,7 @@ end LookupScope
 /-- The pending target can be acquired as the subject, but cannot be used by
 inference, delta unfolding, definitional equality, or a semantic cache hit. -/
 theorem PendingDecl.lookup_isolation {trProj : RawProjRel}
-    {world : VerifyWorld} {target : KId .anon} {d : Lean4Lean.VDecl}
+    {world : VerifyWorld} {target : KId .anon} {d : Ix.Theory.Named.VDecl}
     (h : PendingDecl trProj world target d) :
     (LookupScope.standalone target).Allows world .subject target ∧
       ¬(LookupScope.standalone target).Allows world .semantic target := by
@@ -492,7 +492,7 @@ theorem mono {semantics : CacheSemantics}
 pending target. This is the cache-hit half of the self-unfolding barrier. -/
 theorem pending_isolation {semantics : CacheSemantics}
     {authority : CacheAuthority} {support : RunSupport} {entry : CacheEntry}
-    {trProj : RawProjRel} {target : KId .anon} {d : Lean4Lean.VDecl}
+    {trProj : RawProjRel} {target : KId .anon} {d : Ix.Theory.Named.VDecl}
     (hpending : PendingDecl trProj authority.world target d)
     (hentry : ¬entry.SubjectScoped)
     (h : CacheProvenance semantics authority support entry) :
@@ -507,7 +507,7 @@ theorem pending_isolation {semantics : CacheSemantics}
 target: there is no active-block authority left. -/
 theorem pending_isolation_stable {semantics : CacheSemantics}
     {authority : CacheAuthority} {support : RunSupport} {entry : CacheEntry}
-    {trProj : RawProjRel} {target : KId .anon} {d : Lean4Lean.VDecl}
+    {trProj : RawProjRel} {target : KId .anon} {d : Ix.Theory.Named.VDecl}
     (hstable : ∀ id, ¬authority.active id)
     (hpending : PendingDecl trProj authority.world target d)
     (h : CacheProvenance semantics authority support entry) :
@@ -1606,4 +1606,4 @@ theorem reset_cache_frame (s : TcState m) :
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/Acceptance.lean b/Ix/Kernel/Verify/Check/Acceptance.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/Acceptance.lean
rename to Ix/Kernel/Verify/Check/Acceptance.lean
index 37fc999c4..39eaf2b06 100644
--- a/Ix/Tc/Verify/Check/Acceptance.lean
+++ b/Ix/Kernel/Verify/Check/Acceptance.lean
@@ -1,6 +1,8 @@
-import Ix.Tc.Verify.Check.DeclarationValidation
-import Ix.Tc.Verify.Infer.SortTypes
-import Ix.Tc.Verify.State
+import Ix.Kernel.Verify.Check.DeclarationValidation
+import Ix.Kernel.Verify.Infer.SortTypes
+import Ix.Kernel.Verify.State
+
+open Ix.Theory (VLevel)
 
 /-!
 # Standalone declaration acceptance and promotion
@@ -18,9 +20,9 @@ This keeps K3's critical implication explicit:
 No field below assumes a `VDecl.WF` transition.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstant VDecl VDefVal VEnv VExpr)
+open Ix.Theory.Named (VConstant VDecl VDefVal VEnv VExpr)
 
 /-! ## Semantic results of the two checker pipelines -/
 
@@ -89,14 +91,14 @@ Only the value-check result is needed by Theory's `VDefVal.WF`; keeping both
 premises makes the operational acceptance boundary exact. -/
 inductive StandaloneCheckEvidence (trProj : RawProjRel)
     (world : VerifyWorld) (support : RunSupport) : VDecl → Prop
-  | axiom {ci : Lean4Lean.VConstVal} :
+  | axiom {ci : Ix.Theory.Named.VConstVal} :
     TypeCheckEvidence trProj world support ci.uvars [] ci.type →
     StandaloneCheckEvidence trProj world support (.axiom ci)
-  | defn {ci : Lean4Lean.VDefVal} :
+  | defn {ci : Ix.Theory.Named.VDefVal} :
     TypeCheckEvidence trProj world support ci.uvars [] ci.type →
     ValueCheckEvidence world ci.uvars [] ci.value ci.type →
     StandaloneCheckEvidence trProj world support (.def ci)
-  | opaque {ci : Lean4Lean.VDefVal} :
+  | opaque {ci : Ix.Theory.Named.VDefVal} :
     TypeCheckEvidence trProj world support ci.uvars [] ci.type →
     ValueCheckEvidence world ci.uvars [] ci.value ci.type →
     StandaloneCheckEvidence trProj world support (.opaque ci)
@@ -258,4 +260,4 @@ theorem checkValidatedResultAndPromote
 
 end PendingDecl
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BinderRoundTrip.lean b/Ix/Kernel/Verify/Check/BinderRoundTrip.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/BinderRoundTrip.lean
rename to Ix/Kernel/Verify/Check/BinderRoundTrip.lean
index 4321a91af..cc6b44acb 100644
--- a/Ix/Tc/Verify/Check/BinderRoundTrip.lean
+++ b/Ix/Kernel/Verify/Check/BinderRoundTrip.lean
@@ -1,17 +1,17 @@
-import Ix.Tc.Verify.Check.PreTranslationScopes
-import Ix.Tc.Verify.Infer.BinderClosing
+import Ix.Kernel.Verify.Check.PreTranslationScopes
+import Ix.Kernel.Verify.Infer.BinderClosing
 
 /-!
 # Binder open/close round trip
 
-The Lean4Lean checker closes a freshly opened binder with
+The Ix.Theory.Named checker closes a freshly opened binder with
 `FVarsIn.abstract_instantiate1`.  Ix uses address-carrying `KExpr` smart
 constructors and separate cached walkers, so K3 needs the corresponding pure
 syntax theorem for `instantiateRevSpec` followed by singleton
 `abstractFVarsSpec`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace KExpr
 
@@ -33,9 +33,9 @@ namespace PreTrKExprS
 
 /-- A pre-translation can mention only fvars registered by its `KVLCtx`. -/
 theorem fvarAbsent
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : PreTrKExprS env uvars nameOf trProj Delta source sourceV)
     {target : FVarId} (hfresh : target ∉ Delta.fvars) :
     source.FVarAbsent target := by
@@ -216,10 +216,10 @@ syntax.  The opening bounds justify the pure round trip; the closing bounds
 justify the production abstraction walker whose translation theorem supplies
 the typed result. -/
 theorem TrKExprS.closeOpenedFVarZero
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {decl : Lean4Lean.VLocalDecl}
-    {body bodyOpen : KExpr .anon} {bodyV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {decl : Ix.Theory.Named.VLocalDecl}
+    {body bodyOpen : KExpr .anon} {bodyV : Ix.Theory.Named.VExpr}
     {fv : FVarId} {deps : List FVarId} {name : Mode.anon.F Name}
     (H : TrKExprS env uvars nameOf trProj
       ((some (fv, deps), decl) :: Delta) bodyOpen bodyV)
@@ -239,4 +239,4 @@ theorem TrKExprS.closeOpenedFVarZero
   rw [hround] at hclosed
   exact hclosed
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockAcceptance.lean b/Ix/Kernel/Verify/Check/BlockAcceptance.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/BlockAcceptance.lean
rename to Ix/Kernel/Verify/Check/BlockAcceptance.lean
index 111168bf5..d0d14584e 100644
--- a/Ix/Tc/Verify/Check/BlockAcceptance.lean
+++ b/Ix/Kernel/Verify/Check/BlockAcceptance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.Acceptance
-import Ix.Tc.Verify.Check.BlockCache
+import Ix.Kernel.Verify.Check.Acceptance
+import Ix.Kernel.Verify.Check.BlockCache
 
 /-!
 # Atomic coordinated-block acceptance
@@ -14,13 +14,13 @@ Legacy ambient inductive-family and recursor blocks may still be admitted
 relative to an explicit `InductiveOracle`. Certificate-backed paths instead
 use `SemanticBlockTransitionCertificate` for an exact Theory-environment
 extension or `ExistingSemanticBlockCertificate` for members already installed
-by that extension. Definition admission is local, but Lean4Lean currently has
+by that extension. Definition admission is local, but Ix.Theory.Named currently has
 no mutual-definition `VDecl`, so the constructive definition theorem below is
 deliberately restricted to production's singleton definition blocks. A
 multi-definition block is not silently decomposed into independent claims.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact promotion specialized to the ordered member array of one physical
 block.  Array order remains available through `ExactCheckBlock`; the trust
@@ -118,7 +118,7 @@ member array are fixed by the theorem statement. -/
 structure SemanticBlockTransitionCertificate (trProj : RawProjRel)
     (world : VerifyWorld) (block : KId .anon)
     (members : Array (KId .anon)) (kind : CheckBlockKind)
-    (afterVEnv : Lean4Lean.VEnv) : Prop where
+    (afterVEnv : Ix.Theory.Named.VEnv) : Prop where
   exactBlock : ExactCheckBlock world block members kind
   fresh : ∀ ⦃id⦄, id ∈ members → ¬world.trusted id
   envLE : world.venv ≤ afterVEnv
@@ -132,7 +132,7 @@ namespace SemanticBlockTransitionCertificate
 preserving all immutable ghost inputs. -/
 def admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
     {block : KId .anon} {members : Array (KId .anon)}
-    {kind : CheckBlockKind} {afterVEnv : Lean4Lean.VEnv}
+    {kind : CheckBlockKind} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : SemanticBlockTransitionCertificate trProj world block
       members kind afterVEnv) : VerifyWorld where
   catalog := world.catalog
@@ -153,7 +153,7 @@ def admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
 /-- The explicit semantic transaction is a monotone world extension. -/
 theorem le_admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
     {block : KId .anon} {members : Array (KId .anon)}
-    {kind : CheckBlockKind} {afterVEnv : Lean4Lean.VEnv}
+    {kind : CheckBlockKind} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : SemanticBlockTransitionCertificate trProj world block
       members kind afterVEnv) :
     world ≤ certificate.admittedWorld :=
@@ -163,7 +163,7 @@ theorem le_admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
 and its per-member provenance. -/
 theorem admit {trProj : RawProjRel} {world : VerifyWorld}
     {block : KId .anon} {members : Array (KId .anon)}
-    {kind : CheckBlockKind} {afterVEnv : Lean4Lean.VEnv}
+    {kind : CheckBlockKind} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : SemanticBlockTransitionCertificate trProj world block
       members kind afterVEnv)
     (hrel : TrustedCatalogRel trProj world) :
@@ -180,7 +180,7 @@ theorem admit {trProj : RawProjRel} {world : VerifyWorld}
 semantic transition. -/
 theorem admitState {trProj : RawProjRel} {world : VerifyWorld}
     {block : KId .anon} {members : Array (KId .anon)}
-    {kind : CheckBlockKind} {afterVEnv : Lean4Lean.VEnv}
+    {kind : CheckBlockKind} {afterVEnv : Ix.Theory.Named.VEnv}
     {state : TcState .anon}
     (certificate : SemanticBlockTransitionCertificate trProj world block
       members kind afterVEnv)
@@ -208,7 +208,7 @@ Every exact physical member must instead provide the same per-constant,
 per-rule, and per-pattern provenance consumed by trusted lookups.
 
 The important generated-recursor use case is deliberately two-phase.
-Lean4Lean's certified family transaction has already installed the generated
+Ix.Theory.Named's certified family transaction has already installed the generated
 recursor and equations in `world.venv`; the separate Ix recursor block remains
 untrusted until its production comparison succeeds. -/
 structure ExistingSemanticBlockCertificate (trProj : RawProjRel)
@@ -252,7 +252,7 @@ theorem le_admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
     (certificate : ExistingSemanticBlockCertificate trProj world block
       members kind) :
     world ≤ certificate.admittedWorld :=
-  ⟨rfl, rfl, rfl, fun {_} hold => Or.inr hold, Lean4Lean.VEnv.LE.rfl⟩
+  ⟨rfl, rfl, rfl, fun {_} hold => Or.inr hold, Ix.Theory.Named.VEnv.LE.rfl⟩
 
 /-- Commit the exact physical block using only its already-installed semantic
 entries.  No `InductiveOracle` is constructed or consumed. -/
@@ -404,7 +404,7 @@ of standalone declarations would be unsound for mutual references until the
 Theory exposes a matching atomic declaration form. -/
 structure SingletonDefinitionCertificate (trProj : RawProjRel)
     (world : VerifyWorld) (block id : KId .anon)
-    (decl : Lean4Lean.VDecl) : Prop where
+    (decl : Ix.Theory.Named.VDecl) : Prop where
   exactBlock : ExactCheckBlock world block #[id] .defn
   pending : PendingDecl trProj world id decl
   accepted : StandaloneAccepted world.venv decl
@@ -415,7 +415,7 @@ namespace SingletonDefinitionCertificate
 transition.  Every accepted member (the singleton) is trusted, and the exact
 promotion theorem rules out unrelated trust growth. -/
 theorem admit {trProj : RawProjRel} {world : VerifyWorld}
-    {block id : KId .anon} {decl : Lean4Lean.VDecl}
+    {block id : KId .anon} {decl : Ix.Theory.Named.VDecl}
     {state : TcState .anon}
     (certificate : SingletonDefinitionCertificate trProj world block id decl)
     (hstate : BlockStateWF trProj state world) :
@@ -446,4 +446,4 @@ theorem admit {trProj : RawProjRel} {world : VerifyWorld}
 
 end SingletonDefinitionCertificate
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockCache.lean b/Ix/Kernel/Verify/Check/BlockCache.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/BlockCache.lean
rename to Ix/Kernel/Verify/Check/BlockCache.lean
index bec3e2b7d..777a0c4ed 100644
--- a/Ix/Tc/Verify/Check/BlockCache.lean
+++ b/Ix/Kernel/Verify/Check/BlockCache.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.BlockIdentity
+import Ix.Kernel.Verify.Check.BlockIdentity
 
 /-!
 # Coordinated block-cache closure
@@ -13,7 +13,7 @@ recovers acceptance of the exact immutable block and therefore cannot certify
 a proper subset or treat the block address as a declaration.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace CacheAuthority
 
@@ -121,4 +121,4 @@ theorem rejectsSuccessWithUntrustedMember
 
 end CacheInvariant
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockClassification.lean b/Ix/Kernel/Verify/Check/BlockClassification.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/BlockClassification.lean
rename to Ix/Kernel/Verify/Check/BlockClassification.lean
index c74b7b60c..aa91fd77a 100644
--- a/Ix/Tc/Verify/Check/BlockClassification.lean
+++ b/Ix/Kernel/Verify/Check/BlockClassification.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.BlockRouting
+import Ix.Kernel.Verify.Check.BlockRouting
 
 /-!
 # Coordinated block classification
@@ -11,7 +11,7 @@ successful classifier result is exactly that kind.  Both success and error
 paths preserve the caller's invariant through lazy ingress.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM.BlockClassFlags
 
@@ -214,4 +214,4 @@ theorem classifyBlock_success_exact
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockDefinition.lean b/Ix/Kernel/Verify/Check/BlockDefinition.lean
similarity index 94%
rename from Ix/Tc/Verify/Check/BlockDefinition.lean
rename to Ix/Kernel/Verify/Check/BlockDefinition.lean
index 395f9a177..573636b84 100644
--- a/Ix/Tc/Verify/Check/BlockDefinition.lean
+++ b/Ix/Kernel/Verify/Check/BlockDefinition.lean
@@ -1,13 +1,13 @@
-import Ix.Tc.Verify.Check.BlockTransaction
-import Ix.Tc.Verify.Check.BlockClassification
-import Ix.Tc.Verify.Check.ScopedStandaloneDriver
-import Ix.Tc.Verify.Check.StandaloneDriver
+import Ix.Kernel.Verify.Check.BlockTransaction
+import Ix.Kernel.Verify.Check.BlockClassification
+import Ix.Kernel.Verify.Check.ScopedStandaloneDriver
+import Ix.Kernel.Verify.Check.StandaloneDriver
 
 /-!
 # Singleton definition blocks
 
 The production definition-block branch iterates `checkConstMemberFresh` over
-the complete array and then publishes the peak DefEq depth.  Lean4Lean does
+the complete array and then publishes the peak DefEq depth.  Ix.Theory.Named does
 not yet have an atomic mutual-definition declaration, so the constructive E0
 bridge is intentionally the singleton specialization.  It extracts the
 actual member run from `checkClassifiedBlock`, invokes K3 without performing
@@ -15,7 +15,7 @@ K3's standalone promotion, and packages that evidence for the enclosing
 atomic block transaction.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -66,7 +66,7 @@ theorem certifySingletonDefinition
       model.keys.uvars calls (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {block requested id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl} {before after : TcState .anon}
+    {decl : Ix.Theory.Named.VDecl} {before after : TcState .anon}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -124,7 +124,7 @@ theorem certifySingletonDefinitionScoped
       (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {block requested id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl} {before after : TcState .anon}
+    {decl : Ix.Theory.Named.VDecl} {before after : TcState .anon}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -170,4 +170,4 @@ theorem certifySingletonDefinitionScoped
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockExecution.lean b/Ix/Kernel/Verify/Check/BlockExecution.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/BlockExecution.lean
rename to Ix/Kernel/Verify/Check/BlockExecution.lean
index 93a1474aa..06e076f2a 100644
--- a/Ix/Tc/Verify/Check/BlockExecution.lean
+++ b/Ix/Kernel/Verify/Check/BlockExecution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.BlockAcceptance
+import Ix.Kernel.Verify.Check.BlockAcceptance
 
 /-!
 # Coordinated block execution traces
@@ -17,7 +17,7 @@ The semantic admission theorem remains in `BlockAcceptance`; this module is
 the operational half needed to join that transaction to production.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -380,4 +380,4 @@ theorem withBlockCheckResult {trProj : RawProjRel}
 
 end BlockStateWF
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockIdentity.lean b/Ix/Kernel/Verify/Check/BlockIdentity.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/BlockIdentity.lean
rename to Ix/Kernel/Verify/Check/BlockIdentity.lean
index c8b60906f..b3e6bc8ef 100644
--- a/Ix/Tc/Verify/Check/BlockIdentity.lean
+++ b/Ix/Kernel/Verify/Check/BlockIdentity.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Driver
-import Ix.Tc.Verify.State
+import Ix.Kernel.Driver
+import Ix.Kernel.Verify.State
 
 /-!
 # Coordinated checker-block identity
@@ -18,7 +18,7 @@ to any of them.  In particular, a catalogued member is still untrusted until
 the atomic acceptance theorem admits the complete array.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-! ## Concrete/world block agreement -/
 
@@ -277,4 +277,4 @@ end MatchesBlockCatalog
 
 end AnonWorkItem
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockNatFixture.lean b/Ix/Kernel/Verify/Check/BlockNatFixture.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/BlockNatFixture.lean
rename to Ix/Kernel/Verify/Check/BlockNatFixture.lean
index 84aa6407b..f53bbba2d 100644
--- a/Ix/Tc/Verify/Check/BlockNatFixture.lean
+++ b/Ix/Kernel/Verify/Check/BlockNatFixture.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.PublicBlocks
-import Ix.Tc.Verify.NatFixture
+import Ix.Kernel.Verify.Check.PublicBlocks
+import Ix.Kernel.Verify.NatFixture
 
 /-!
 # Concrete Nat block fixture for E0
@@ -10,7 +10,7 @@ the adversarial cache rule without pretending that E2 has already connected
 the production inductive checker to the oracle.
 -/
 
-namespace Ix.Tc.AmbientNat.E0
+namespace Ix.Kernel.AmbientNat.E0
 
 /-- Ordered production member array for the Nat family. -/
 def blockMembers : Array (KId .anon) := #[natId, zeroId, succId]
@@ -118,4 +118,4 @@ theorem rejectsPrematureSuccess
   CacheInvariant.rejectsSuccessWithUntrustedMember exactBlock
     (id := zeroId) (by simp [blockMembers]) (fun h => h)
 
-end Ix.Tc.AmbientNat.E0
+end Ix.Kernel.AmbientNat.E0
diff --git a/Ix/Tc/Verify/Check/BlockOracle.lean b/Ix/Kernel/Verify/Check/BlockOracle.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/BlockOracle.lean
rename to Ix/Kernel/Verify/Check/BlockOracle.lean
index 265453653..744ae1c60 100644
--- a/Ix/Tc/Verify/Check/BlockOracle.lean
+++ b/Ix/Kernel/Verify/Check/BlockOracle.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.BlockTransaction
-import Ix.Tc.Verify.Inductive.Certificate
+import Ix.Kernel.Verify.Check.BlockTransaction
+import Ix.Kernel.Verify.Inductive.Certificate
 
 /-!
 # Oracle-backed inductive and recursor blocks
@@ -7,7 +7,7 @@ import Ix.Tc.Verify.Inductive.Certificate
 E0 proves the transaction and cache ordering around production block checks.
 The semantic meaning of a successful inductive/recursor body remains the
 explicit E2b boundary: E2b must connect the actual Ix validators and generated
-recursor patterns to an `InductiveOracle`.  The Lean4Lean
+recursor patterns to an `InductiveOracle`.  The Ix.Theory.Named
 `CertifiedGenerationTransaction` supplies the Theory-owned portion of that
 future construction, but cannot determine Ix addresses, member arrays, or
 checker execution on its own.
@@ -16,7 +16,7 @@ This module packages exactly that remaining boundary and ties it to the real
 classified-body trace.  It introduces no unindexed “block succeeded” axiom.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The E2b resources which remain after E0 has fixed the exact physical
 array and production classifier kind.  The post-state uses temporary block
@@ -90,4 +90,4 @@ theorem certifyOracleBackedAdmittedBlock
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockRouteFrame.lean b/Ix/Kernel/Verify/Check/BlockRouteFrame.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/BlockRouteFrame.lean
rename to Ix/Kernel/Verify/Check/BlockRouteFrame.lean
index bf2096a85..6fd9ad8f7 100644
--- a/Ix/Tc/Verify/Check/BlockRouteFrame.lean
+++ b/Ix/Kernel/Verify/Check/BlockRouteFrame.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.BlockClassification
+import Ix.Kernel.Verify.Check.BlockClassification
 
 /-!
 # State framing for successful coordinated routing
@@ -9,7 +9,7 @@ if routing returns a coordinated block, every lazy lookup and classification
 step preserves the caller's invariant up to the exact post-route state.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -121,4 +121,4 @@ theorem coordinatedBlockFor_some_preserves
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockRouting.lean b/Ix/Kernel/Verify/Check/BlockRouting.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/BlockRouting.lean
rename to Ix/Kernel/Verify/Check/BlockRouting.lean
index 07598a2da..210f2e0fd 100644
--- a/Ix/Tc/Verify/Check/BlockRouting.lean
+++ b/Ix/Kernel/Verify/Check/BlockRouting.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.BlockIdentity
-import Ix.Tc.Verify.Infer.Constants
+import Ix.Kernel.Verify.Check.BlockIdentity
+import Ix.Kernel.Verify.Infer.Constants
 
 /-!
 # Soundness of production block routing
@@ -11,7 +11,7 @@ successful concrete parent lookup is the exact catalogued inductive and that
 the constructor itself belongs to that parent's exact member array.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -295,4 +295,4 @@ theorem coordinatedBlockFor_some_exact
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BlockTransaction.lean b/Ix/Kernel/Verify/Check/BlockTransaction.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/BlockTransaction.lean
rename to Ix/Kernel/Verify/Check/BlockTransaction.lean
index 0ddaf4644..86a4e96b0 100644
--- a/Ix/Tc/Verify/Check/BlockTransaction.lean
+++ b/Ix/Kernel/Verify/Check/BlockTransaction.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.BlockExecution
+import Ix.Kernel.Verify.Check.BlockExecution
 
 /-!
 # Atomic coordinated-block transactions
@@ -16,12 +16,12 @@ There are exactly two currently supported semantic sources:
 * an inductive or recursor block, relative to the explicit inductive oracle
   which E2 must construct from the corresponding production checker.
 
-Lean4Lean does not yet expose an atomic mutual-definition declaration, so no
+Ix.Theory.Named does not yet expose an atomic mutual-definition declaration, so no
 constructor below decomposes a multi-definition production block into a
 sequence of stronger semantic claims.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The complete checker invariant while one exact coordinated block is
 active.  Only structural block caches may use the additional member
@@ -105,7 +105,7 @@ inductive BlockAdmissionEvidence (trProj : RawProjRel)
     (world : VerifyWorld) (support : RunSupport) (block : KId .anon) :
     Array (KId .anon) → CheckBlockKind → Prop
   | singletonDefinition {id : KId .anon} {concrete : KConst .anon}
-      {decl : Lean4Lean.VDecl} :
+      {decl : Ix.Theory.Named.VDecl} :
       PendingDecl trProj world id decl →
       StandaloneCheckResult trProj world support id concrete decl →
       BlockAdmissionEvidence trProj world support block #[id] .defn
@@ -400,4 +400,4 @@ theorem checkCoordinatedBlock_rejected
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/BoundedPipelines.lean b/Ix/Kernel/Verify/Check/BoundedPipelines.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/BoundedPipelines.lean
rename to Ix/Kernel/Verify/Check/BoundedPipelines.lean
index 30055a116..8fd014a12 100644
--- a/Ix/Tc/Verify/Check/BoundedPipelines.lean
+++ b/Ix/Kernel/Verify/Check/BoundedPipelines.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Check.CheckerEvidence
-import Ix.Tc.Verify.Check.FullInferenceKnot
-import Ix.Tc.Verify.Check.RecursiveMethodPolicy
-import Ix.Tc.Verify.RecursiveMethods.CallDomains
+import Ix.Kernel.Verify.Check.CheckerEvidence
+import Ix.Kernel.Verify.Check.FullInferenceKnot
+import Ix.Kernel.Verify.Check.RecursiveMethodPolicy
+import Ix.Kernel.Verify.RecursiveMethods.CallDomains
 
 /-!
 # Bounded standalone-checker pipelines
@@ -19,7 +19,7 @@ type/value calls made by one concrete standalone declaration and the bounded
 follow-up calls made on their results.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -43,7 +43,7 @@ def FullInferenceWFAtOn
     (world : VerifyWorld) (support : RunSupport) (uvars : Nat)
     (calls : CallDomain) (methods : Methods .anon) : Prop :=
   ∀ {Delta : KVLCtx} {s : TcState .anon}
-      {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+      {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
     calls.infer source →
     s.inferOnly = false →
     PreTrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -70,7 +70,7 @@ theorem ofTypedIngress
       uvars calls methods)
     (policy : methods.PreservesInferOnly)
     (upgrade : ∀ {Delta : KVLCtx} {source : KExpr .anon}
-        {sourceV : Lean4Lean.VExpr},
+        {sourceV : Ix.Theory.Named.VExpr},
       calls.infer source →
       PreTrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
       TrKExprS world.venv uvars world.nameOf trProj Delta source sourceV) :
@@ -127,7 +127,7 @@ theorem methodsOut
     (world : VerifyWorld) (support : RunSupport) (uvars : Nat)
     (calls : CallDomain) :
     Methods.FullInferenceWFAtOn semantics trProj world support uvars calls
-      (Ix.Tc.methodsOut : Methods .anon) := by
+      (Ix.Kernel.methodsOut : Methods .anon) := by
   intro Delta s source sourceV hcall hpolicy hsource
   exact TcM.WF.throw fun _ => hpolicy
 
@@ -155,12 +155,12 @@ structure StandalonePipelineResources
   valueInfer : ∀ {value declaredType},
     valueSources value declaredType → calls.infer value
   typeWhnf : ∀ {Delta : KVLCtx} {source : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {inferred : KExpr .anon},
+      {sourceV : Ix.Theory.Named.VExpr} {inferred : KExpr .anon},
     typeSources source →
     FullInferPost trProj world support uvars Delta source sourceV inferred →
     calls.AdmitsEnsureSortDirect inferred
   valueDefEq : ∀ {Delta : KVLCtx} {value declaredType : KExpr .anon}
-      {valueV : Lean4Lean.VExpr} {inferred : KExpr .anon},
+      {valueV : Ix.Theory.Named.VExpr} {inferred : KExpr .anon},
     valueSources value declaredType →
     FullInferPost trProj world support uvars Delta value valueV inferred →
     calls.isDefEq inferred declaredType
@@ -259,7 +259,7 @@ private theorem ensureSortDirect_wfAtOn
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {calls : Methods.CallDomain} {methods : Methods .anon}
     {Delta : KVLCtx} {s : TcState .anon} {input : KExpr .anon}
-    {inputV : Lean4Lean.VExpr}
+    {inputV : Ix.Theory.Named.VExpr}
     (hmethods : Methods.WFAtOn .noAccel semantics trProj world support uvars
       calls (Methods.next methods))
     (hresources : SortComponentResources support)
@@ -320,7 +320,7 @@ theorem checkTypePipeline_bounded_sound
       calls (Methods.next methods))
     (hpolicyMethods : (Methods.next methods).PreservesInferOnly)
     {Delta : KVLCtx} {s after : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceCall : resources.typeSources source)
     (hsource : PreTrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV)
@@ -402,7 +402,7 @@ theorem checkValuePipeline_bounded_sound
       calls (Methods.next methods))
     {Delta : KVLCtx} {s after : TcState .anon}
     {value declaredType : KExpr .anon}
-    {valueV declaredTypeV : Lean4Lean.VExpr}
+    {valueV declaredTypeV : Ix.Theory.Named.VExpr}
     (hvalueCall : resources.valueSources value declaredType)
     (hvalue : PreTrKExprS world.venv uvars world.nameOf trProj Delta value
       valueV)
@@ -471,4 +471,4 @@ theorem checkValuePipeline_bounded_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/CheckConstExecution.lean b/Ix/Kernel/Verify/Check/CheckConstExecution.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/CheckConstExecution.lean
rename to Ix/Kernel/Verify/Check/CheckConstExecution.lean
index fb8678b0d..f74611892 100644
--- a/Ix/Tc/Verify/Check/CheckConstExecution.lean
+++ b/Ix/Kernel/Verify/Check/CheckConstExecution.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.BlockRouteFrame
-import Ix.Tc.Verify.Check.BlockTransaction
+import Ix.Kernel.Verify.Check.BlockRouteFrame
+import Ix.Kernel.Verify.Check.BlockTransaction
 
 /-!
 # Production `checkConst` dispatch traces
@@ -11,7 +11,7 @@ ends at `checkCoordinatedBlock`; the standalone branch ends at
 for one branch from being reused for the other.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -65,4 +65,4 @@ theorem checkConst_success_trace
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/CheckConstTransaction.lean b/Ix/Kernel/Verify/Check/CheckConstTransaction.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/CheckConstTransaction.lean
rename to Ix/Kernel/Verify/Check/CheckConstTransaction.lean
index 5b1bc35bc..57dd9c9b0 100644
--- a/Ix/Tc/Verify/Check/CheckConstTransaction.lean
+++ b/Ix/Kernel/Verify/Check/CheckConstTransaction.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.CheckConstExecution
+import Ix.Kernel.Verify.Check.CheckConstExecution
 
 /-!
 # Semantic assembly for production `checkConst`
@@ -16,7 +16,7 @@ as the route.  Thus the certifier cannot be applied to a TOCTOU-substituted
 block.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Stable kernel state plus E0's physical/ghost block-table agreement. -/
 structure CoordinatedKernelStateWF (semantics : CacheSemantics)
@@ -154,4 +154,4 @@ theorem checkConst_success_disposition
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/CheckerEvidence.lean b/Ix/Kernel/Verify/Check/CheckerEvidence.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/CheckerEvidence.lean
rename to Ix/Kernel/Verify/Check/CheckerEvidence.lean
index adc4a0035..7dc5c6ad8 100644
--- a/Ix/Tc/Verify/Check/CheckerEvidence.lean
+++ b/Ix/Kernel/Verify/Check/CheckerEvidence.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.Acceptance
-import Ix.Tc.Verify.Check.FullInferenceCache
+import Ix.Kernel.Verify.Check.Acceptance
+import Ix.Kernel.Verify.Check.FullInferenceCache
 
 /-!
 # Semantic evidence from the standalone checker pipelines
@@ -14,7 +14,7 @@ The value pipeline is parameterized by the semantic contract for the actual
 `methods.isDefEq` callback used inside recursive inference.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -29,7 +29,7 @@ theorem checkTypePipeline_sound
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars methods)
     {Delta : KVLCtx} {s after : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : PreTrKExprS world.venv model.keys.uvars world.nameOf trProj
       Delta source sourceV)
@@ -96,7 +96,7 @@ theorem checkValuePipeline_sound
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars methods)
     (hdefeq : ∀ {Delta : KVLCtx} {s : TcState .anon}
-        {left right : KExpr .anon} {leftV rightV : Lean4Lean.VExpr},
+        {left right : KExpr .anon} {leftV rightV : Ix.Theory.Named.VExpr},
       support left → support right →
       TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta left
         leftV →
@@ -108,7 +108,7 @@ theorem checkValuePipeline_sound
           world.venv.IsDefEqU model.keys.uvars Delta.toCtx leftV rightV))
     {Delta : KVLCtx} {s after : TcState .anon}
     {value declaredType : KExpr .anon}
-    {valueV declaredTypeV : Lean4Lean.VExpr}
+    {valueV declaredTypeV : Ix.Theory.Named.VExpr}
     (hvalueSupport : support value)
     (hdeclaredSupport : support declaredType)
     (hvalue : PreTrKExprS world.venv model.keys.uvars world.nameOf trProj
@@ -171,4 +171,4 @@ theorem checkValuePipeline_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DeclarationIngress.lean b/Ix/Kernel/Verify/Check/DeclarationIngress.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/DeclarationIngress.lean
rename to Ix/Kernel/Verify/Check/DeclarationIngress.lean
index b2d89361c..5ec9df1e1 100644
--- a/Ix/Tc/Verify/Check/DeclarationIngress.lean
+++ b/Ix/Kernel/Verify/Check/DeclarationIngress.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.PreTranslationIngress
+import Ix.Kernel.Verify.Check.PreTranslationIngress
 
 /-!
 # Standalone declaration ingress
@@ -12,9 +12,9 @@ consumed by the two `checkConstMember` pipelines.
 Neither relation contains a typing judgment or a declaration-WF premise.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDecl VExpr)
+open Ix.Theory.Named (VDecl VExpr)
 
 /-- Successful standalone validation facts, including the no-wrap budget
 needed to interpret the validator's `UInt64` binder depth. -/
@@ -40,7 +40,7 @@ inductive StandaloneScope : KConst .anon -> Prop
 
 /-- Raw standalone correspondence after scoping validation, but before any
 typing has been established. -/
-inductive PreDeclRel (env : Lean4Lean.VEnv)
+inductive PreDeclRel (env : Ix.Theory.Named.VEnv)
     (nameOf : Address -> Option Lean.Name) (trProj : RawProjRel)
     (id : KId .anon) : KConst .anon -> VDecl -> Prop
   | axiom
@@ -74,7 +74,7 @@ namespace RawDeclRel
 /-- The exact raw declaration becomes a pre-translation declaration once the
 production validator's standalone certificate is available. -/
 theorem toPre_of_scope
-    {env : Lean4Lean.VEnv} {nameOf : Address -> Option Lean.Name}
+    {env : Ix.Theory.Named.VEnv} {nameOf : Address -> Option Lean.Name}
     {trProj : RawProjRel} {id : KId .anon}
     (hprojection : trProj.SubstCompatible)
     (hliterals : forall literal, env.ContainsLits literal)
@@ -121,4 +121,4 @@ theorem toPre_of_scope
 
 end PendingDecl
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DeclarationValidation.lean b/Ix/Kernel/Verify/Check/DeclarationValidation.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/DeclarationValidation.lean
rename to Ix/Kernel/Verify/Check/DeclarationValidation.lean
index db8b7cd33..68824d8c1 100644
--- a/Ix/Tc/Verify/Check/DeclarationValidation.lean
+++ b/Ix/Kernel/Verify/Check/DeclarationValidation.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.ValidatorSoundness
-import Ix.Tc.Verify.Check.DeclarationIngress
+import Ix.Kernel.Verify.Check.ValidatorSoundness
+import Ix.Kernel.Verify.Check.DeclarationIngress
 
 /-!
 # Standalone declaration validation
@@ -10,7 +10,7 @@ handled by K3.  Finite-run coverage and no-wrap size budgets are explicit
 resources; neither is inferred from a successful validator return.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Static resources needed to interpret successful standalone validation.
 The size inequalities justify transporting the validator's `UInt64` binder
@@ -110,7 +110,7 @@ namespace PendingDecl
 pending raw declaration into the pre-translation relation. -/
 theorem toPre_of_validation
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
-    {id : KId .anon} {decl : Lean4Lean.VDecl} {concrete : KConst .anon}
+    {id : KId .anon} {decl : Ix.Theory.Named.VDecl} {concrete : KConst .anon}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -126,4 +126,4 @@ theorem toPre_of_validation
 
 end PendingDecl
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqBasicPolicy.lean b/Ix/Kernel/Verify/Check/DefEqBasicPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqBasicPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqBasicPolicy.lean
index 1b2e5ff0e..40402277d 100644
--- a/Ix/Tc/Verify/Check/DefEqBasicPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqBasicPolicy.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.DefEq
-import Ix.Tc.Verify.Check.WhnfHelperPolicy
+import Ix.Kernel.DefEq
+import Ix.Kernel.Verify.Check.WhnfHelperPolicy
 
 /-!
 # Operational policy for basic definitional-equality helpers
@@ -11,7 +11,7 @@ application-spine recursion.  Later DefEq phase proofs build exclusively on
 these concrete lemmas.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM.PreservesInferOnly
 
@@ -464,4 +464,4 @@ theorem tryDefEqWhnfApp_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqCachePolicy.lean b/Ix/Kernel/Verify/Check/DefEqCachePolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqCachePolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqCachePolicy.lean
index 60f09a723..f004e1d63 100644
--- a/Ix/Tc/Verify/Check/DefEqCachePolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqCachePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqPipelinePolicy
+import Ix.Kernel.Verify.Check.DefEqPipelinePolicy
 
 /-!
 # Operational policy for DefEq's cache and recursion shell
@@ -9,7 +9,7 @@ shell around those tiers preserves the same caller policy on success and on
 every error path.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -342,4 +342,4 @@ theorem isDefEq_preservesInferOnly_of_inner
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqEtaPolicy.lean b/Ix/Kernel/Verify/Check/DefEqEtaPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqEtaPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqEtaPolicy.lean
index b2d0f9021..982a052e9 100644
--- a/Ix/Tc/Verify/Check/DefEqEtaPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqEtaPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqPropositionPolicy
+import Ix.Kernel.Verify.Check.DefEqPropositionPolicy
 
 /-!
 # Operational policy for DefEq eta phases
@@ -9,7 +9,7 @@ infer-only type comparison, finite projection-field recursion, and the
 common-base scan.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -358,4 +358,4 @@ theorem tryEtaStruct_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqFinalWhnfPolicy.lean b/Ix/Kernel/Verify/Check/DefEqFinalWhnfPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqFinalWhnfPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqFinalWhnfPolicy.lean
index 086e4cfe4..8f62000c5 100644
--- a/Ix/Tc/Verify/Check/DefEqFinalWhnfPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqFinalWhnfPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqEtaPolicy
+import Ix.Kernel.Verify.Check.DefEqEtaPolicy
 
 /-!
 # Operational policy for final-WHNF definitional equality
@@ -10,7 +10,7 @@ lemmas preserve that exact production order while framing every success and
 partial error state.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -366,4 +366,4 @@ theorem isDefEqWhnf_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqLazyDeltaPolicy.lean b/Ix/Kernel/Verify/Check/DefEqLazyDeltaPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqLazyDeltaPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqLazyDeltaPolicy.lean
index 09ff9bc13..06c25db3d 100644
--- a/Ix/Tc/Verify/Check/DefEqLazyDeltaPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqLazyDeltaPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqProjectionDeltaPolicy
+import Ix.Kernel.Verify.Check.DefEqProjectionDeltaPolicy
 
 /-!
 # Operational policy for the main DefEq lazy-delta loop
@@ -9,7 +9,7 @@ probes, one- and two-sided unfolding, projection-app probes, and the stopped
 continuation into final WHNF comparison.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -476,4 +476,4 @@ theorem isDefEqInnerAfterProofIrrelevance_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqNatPolicy.lean b/Ix/Kernel/Verify/Check/DefEqNatPolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/DefEqNatPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqNatPolicy.lean
index 21675013f..18defcd2e 100644
--- a/Ix/Tc/Verify/Check/DefEqNatPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqNatPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqBasicPolicy
+import Ix.Kernel.Verify.Check.DefEqBasicPolicy
 
 /-!
 # Operational policy for DefEq Nat and String bridges
@@ -9,7 +9,7 @@ successful recursive comparison is routed through the framed predecessor
 method table; all misses and allocation errors preserve the same policy.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -188,4 +188,4 @@ theorem tryStringLitExpansion_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqPipelinePolicy.lean b/Ix/Kernel/Verify/Check/DefEqPipelinePolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqPipelinePolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqPipelinePolicy.lean
index ff1d54d36..7a089cc87 100644
--- a/Ix/Tc/Verify/Check/DefEqPipelinePolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqPipelinePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqLazyDeltaPolicy
+import Ix.Kernel.Verify.Check.DefEqLazyDeltaPolicy
 
 /-!
 # Operational policy for the DefEq comparison pipeline
@@ -8,7 +8,7 @@ lazy-delta policies across the exact production `isDefEqInner` tier order.
 It stops at the cache/depth shell owned by `isDefEq` itself.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -239,4 +239,4 @@ theorem isDefEqInner_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqProjectionDeltaPolicy.lean b/Ix/Kernel/Verify/Check/DefEqProjectionDeltaPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/DefEqProjectionDeltaPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqProjectionDeltaPolicy.lean
index 7a1e5a5ab..16b0a662c 100644
--- a/Ix/Tc/Verify/Check/DefEqProjectionDeltaPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqProjectionDeltaPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqFinalWhnfPolicy
+import Ix.Kernel.Verify.Check.DefEqFinalWhnfPolicy
 
 /-!
 # Operational policy for projection-directed DefEq delta reduction
@@ -9,7 +9,7 @@ callbacks, projection reduction, bounded iteration, and recursive equality
 all preserve the inference-policy bit on success and error.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -454,4 +454,4 @@ theorem tryDefEqApp_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/DefEqPropositionPolicy.lean b/Ix/Kernel/Verify/Check/DefEqPropositionPolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/DefEqPropositionPolicy.lean
rename to Ix/Kernel/Verify/Check/DefEqPropositionPolicy.lean
index 6681c55fb..8d9f85666 100644
--- a/Ix/Tc/Verify/Check/DefEqPropositionPolicy.lean
+++ b/Ix/Kernel/Verify/Check/DefEqPropositionPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqNatPolicy
+import Ix.Kernel.Verify.Check.DefEqNatPolicy
 
 /-!
 # Operational policy for DefEq proposition and unit classifiers
@@ -9,7 +9,7 @@ shells, lazy declaration lookups, WHNF calls, and recursive equality edges
 restore the caller's exact inference policy.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -164,4 +164,4 @@ theorem tryDefEqUnit_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInference.lean b/Ix/Kernel/Verify/Check/FullInference.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/FullInference.lean
rename to Ix/Kernel/Verify/Check/FullInference.lean
index 2eba0b79a..197c96b91 100644
--- a/Ix/Tc/Verify/Check/FullInference.lean
+++ b/Ix/Kernel/Verify/Check/FullInference.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.PreTranslationCompatibility
-import Ix.Tc.Verify.Infer.CacheSoundness
+import Ix.Kernel.Verify.Check.PreTranslationCompatibility
+import Ix.Kernel.Verify.Infer.CacheSoundness
 
 /-!
 # Full inference from untyped checker ingress
@@ -15,9 +15,9 @@ an earlier typed translation, and `PreTrKExprS.upgradeOfTyped` reconciles it
 with the exact translation chosen by the current raw ingress.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Successful full inference both validates the source translation and
 returns a Theory type for that exact translated source. -/
@@ -93,4 +93,4 @@ theorem inferWith_fullHit_pre_acceptance
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceApplications.lean b/Ix/Kernel/Verify/Check/FullInferenceApplications.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/FullInferenceApplications.lean
rename to Ix/Kernel/Verify/Check/FullInferenceApplications.lean
index ec85c364c..263823f25 100644
--- a/Ix/Tc/Verify/Check/FullInferenceApplications.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceApplications.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.FullInferenceLeaves
-import Ix.Tc.Verify.Check.InferencePolicy
+import Ix.Kernel.Verify.Check.FullInferenceLeaves
+import Ix.Kernel.Verify.Check.InferencePolicy
 
 /-!
 # Full inference for applications
@@ -17,9 +17,9 @@ proof must construct this context; an arbitrary `Methods.WFAt` table cannot,
 because its semantic contract does not constrain that policy bit.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Strong recursive services used while reconstructing a typed translation
 from successful full inference.  These are properties of one concrete
@@ -287,7 +287,7 @@ private theorem fullApplicationResult
   exact ⟨hsource, codV.inst aV,
     hresultTr.trKExpr world.venvWF.ordered theory.literalWF
       theory.projections.wf hDelta,
-    Lean4Lean.VEnv.HasType.app hfunAtForall hargAtDom⟩
+    Ix.Theory.Named.VEnv.HasType.app hfunAtForall hargAtDom⟩
 
 /-- Execute the final dependent-codomain substitution after a successful
 full application check.  `runIntern` cannot throw and its exact frame proves
@@ -457,4 +457,4 @@ theorem inferUncached_app_full_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceBinders.lean b/Ix/Kernel/Verify/Check/FullInferenceBinders.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/FullInferenceBinders.lean
rename to Ix/Kernel/Verify/Check/FullInferenceBinders.lean
index fcb7b9a07..6000b42af 100644
--- a/Ix/Tc/Verify/Check/FullInferenceBinders.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceBinders.lean
@@ -1,8 +1,10 @@
-import Ix.Tc.Verify.Check.BinderRoundTrip
-import Ix.Tc.Verify.Check.FullInferenceApplications
-import Ix.Tc.Verify.Infer.ForallTypes
-import Ix.Tc.Verify.Infer.LambdaTypes
-import Ix.Tc.Verify.Infer.LetTypes
+import Ix.Kernel.Verify.Check.BinderRoundTrip
+import Ix.Kernel.Verify.Check.FullInferenceApplications
+import Ix.Kernel.Verify.Infer.ForallTypes
+import Ix.Kernel.Verify.Infer.LambdaTypes
+import Ix.Kernel.Verify.Infer.LetTypes
+
+open Ix.Theory (VLevel)
 
 /-!
 # Full inference for binding forms
@@ -13,9 +15,9 @@ the domain, infer the freshly opened body, and close its newly established
 typed translation back to the original de Bruijn syntax.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -138,7 +140,7 @@ private theorem inferLambdaFullTail_wf
       .lam ⟨u, htySort⟩ htyTr hbodyTr
     exact ⟨hpolicyFinal, hresultSupport, hsourceTr,
       .forallE tyV bodyTyV, hresultTr,
-      Lean4Lean.VEnv.HasType.lam htySort hbodyTy'⟩
+      Ix.Theory.Named.VEnv.HasType.lam htySort hbodyTy'⟩
   · intro _ _ herror
     exact herror
 
@@ -321,7 +323,7 @@ private theorem inferForallFullTail_wf
           world.venvWF.ordered theory.literalWF theory.projections.wf hDelta
     have hforall : world.venv.HasType uvars Delta.toCtx
         (.forallE tyV bodyV) (.sort (.imax u1.toVLevel u2.toVLevel)) :=
-      Lean4Lean.VEnv.HasType.forallE htySort (by simpa using hbodySort)
+      Ix.Theory.Named.VEnv.HasType.forallE htySort (by simpa using hbodySort)
     have hlevelEq := hu1.mkIMax_equiv hcollision hu2
     have hsortEq : world.venv.IsDefEqU uvars Delta.toCtx
         (.sort (.imax u1.toVLevel u2.toVLevel))
@@ -654,4 +656,4 @@ theorem inferUncached_let_full_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceCache.lean b/Ix/Kernel/Verify/Check/FullInferenceCache.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/FullInferenceCache.lean
rename to Ix/Kernel/Verify/Check/FullInferenceCache.lean
index ecb196aa4..17d4a6c3e 100644
--- a/Ix/Tc/Verify/Check/FullInferenceCache.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceCache.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.FullInferenceDispatcher
-import Ix.Tc.Verify.Infer.CacheSoundness
+import Ix.Kernel.Verify.Check.FullInferenceDispatcher
+import Ix.Kernel.Verify.Infer.CacheSoundness
 
 /-!
 # Full-inference cache shell
@@ -11,7 +11,7 @@ translation; misses construct ordinary collision-robust K2 provenance before
 writing the validated cache partition.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace FullUncachedInference.Context
 
@@ -48,7 +48,7 @@ private theorem missTail_full_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars methods)
     {Delta : KVLCtx} {before s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {key : Address × Address}
     (hmatch : model.keys.Matches trProj world before Delta source key)
     (hsourceSupport : support source)
@@ -105,7 +105,7 @@ theorem inferWith_full_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars methods)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : PreTrKExprS world.venv model.keys.uvars world.nameOf trProj
       Delta source sourceV)
@@ -177,7 +177,7 @@ theorem infer_full_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars methods)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : PreTrKExprS world.venv model.keys.uvars world.nameOf trProj
       Delta source sourceV)
@@ -195,4 +195,4 @@ theorem infer_full_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceDispatcher.lean b/Ix/Kernel/Verify/Check/FullInferenceDispatcher.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/FullInferenceDispatcher.lean
rename to Ix/Kernel/Verify/Check/FullInferenceDispatcher.lean
index 6a9c5ad74..0e0549307 100644
--- a/Ix/Tc/Verify/Check/FullInferenceDispatcher.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceDispatcher.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.FullInferenceProjections
-import Ix.Tc.Verify.Infer.Dispatcher
+import Ix.Kernel.Verify.Check.FullInferenceProjections
+import Ix.Kernel.Verify.Infer.Dispatcher
 
 /-!
 # Exhaustive full-mode inference dispatcher
@@ -14,7 +14,7 @@ In particular, neither the ordinary method-table contract nor a successful
 typing postcondition says what `inferOnly` contains after a partial error.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace FullUncachedInference
 
@@ -47,7 +47,7 @@ private theorem strengthenFullLeaf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {source : KExpr .anon}
-    {sourceV : Lean4Lean.VExpr} {methods : Methods .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {methods : Methods .anon}
     (hsemantic : TcM.WF
       (WhnfStateInv .noAccel semantics trProj world support uvars Delta) s
       ((inferUncached inferCall false source).run methods)
@@ -80,7 +80,7 @@ theorem inferUncached_full_wf
     (context : FullUncachedInference.Context initial program requests
       semantics trProj world support uvars methods)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : PreTrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV)
@@ -172,4 +172,4 @@ theorem inferUncached_full_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceKnot.lean b/Ix/Kernel/Verify/Check/FullInferenceKnot.lean
similarity index 94%
rename from Ix/Tc/Verify/Check/FullInferenceKnot.lean
rename to Ix/Kernel/Verify/Check/FullInferenceKnot.lean
index 62bf3218d..b6eedb221 100644
--- a/Ix/Tc/Verify/Check/FullInferenceKnot.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceKnot.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Check.FullInferenceCache
-import Ix.Tc.Verify.Check.RecursiveMethodPolicy
-import Ix.Tc.Verify.RecursiveMethods.Closure
+import Ix.Kernel.Verify.Check.FullInferenceCache
+import Ix.Kernel.Verify.Check.RecursiveMethodPolicy
+import Ix.Kernel.Verify.RecursiveMethods.Closure
 
 /-!
 # Full-inference closure of the production recursion knot
@@ -17,7 +17,7 @@ one outer `RecM.infer` layer uses only the semantic, operational, and strong
 full-inference contracts of its strictly smaller callback table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -29,7 +29,7 @@ def FullInferenceWFAt
     (world : VerifyWorld) (support : RunSupport) (uvars : Nat)
     (methods : Methods .anon) : Prop :=
   ∀ {Delta : KVLCtx} {s : TcState .anon}
-      {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+      {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
     s.inferOnly = false →
     support source →
     PreTrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -159,7 +159,7 @@ theorem methodsN_fullInferenceWFAt
     Methods.FullInferenceWFAt
       (kernelCacheSemantics proposition.model.keys trProj) trProj world support
       proposition.model.keys.uvars
-      (Ix.Tc.methodsN (m := .anon) depth) := by
+      (Ix.Kernel.methodsN (m := .anon) depth) := by
   induction depth with
   | zero =>
       exact Methods.methodsOut_fullInferenceWFAt
@@ -171,14 +171,14 @@ theorem methodsN_fullInferenceWFAt
         (WhnfStateInv .noAccel
           (kernelCacheSemantics proposition.model.keys trProj) trProj world
           support proposition.model.keys.uvars Delta) s
-        ((Methods.next (Ix.Tc.methodsN depth)).infer source)
+        ((Methods.next (Ix.Kernel.methodsN depth)).infer source)
         (fun result after =>
           after.inferOnly = false ∧
             FullInferPost trProj world support proposition.model.keys.uvars
               Delta source sourceV result)
         (fun _ after => after.inferOnly = false)
       exact
-        (context.next_fullInferenceWFAt (Ix.Tc.methodsN depth)
+        (context.next_fullInferenceWFAt (Ix.Kernel.methodsN depth)
           (context.methodsN depth)
           (Methods.methodsN_concrete_preservesInferOnly depth) ih)
           hbefore hsourceSupport hsource
@@ -194,7 +194,7 @@ theorem publicInfer_full_wf
     (context : RecursiveMethodClosureContext initial program requests support
       proposition eligible)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hbefore : s.inferOnly = false)
     (hsourceSupport : support source)
     (hsource : PreTrKExprS world.venv proposition.model.keys.uvars
@@ -209,7 +209,7 @@ theorem publicInfer_full_wf
           FullInferPost trProj world support proposition.model.keys.uvars
             Delta source sourceV result)
       (fun _ after => after.inferOnly = false) := by
-  let methods := Ix.Tc.methodsN (m := .anon) s.recFuel.toNat
+  let methods := Ix.Kernel.methodsN (m := .anon) s.recFuel.toNat
   have hmethods : Methods.WFAt .noAccel
       (kernelCacheSemantics proposition.model.keys trProj) trProj world support
       proposition.model.keys.uvars methods :=
@@ -227,4 +227,4 @@ theorem publicInfer_full_wf
 
 end RecursiveMethodClosureContext
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceLeaves.lean b/Ix/Kernel/Verify/Check/FullInferenceLeaves.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/FullInferenceLeaves.lean
rename to Ix/Kernel/Verify/Check/FullInferenceLeaves.lean
index 768cd9174..46d13aafe 100644
--- a/Ix/Tc/Verify/Check/FullInferenceLeaves.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceLeaves.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Check.FullInference
+import Ix.Kernel.Verify.Check.FullInference
+
+open Ix.Theory (VLevel)
 
 /-!
 # Full inference for untyped leaf ingress
@@ -10,7 +12,7 @@ application and binder constructors remain genuinely new K3 work because
 their typed constructors contain the checks full inference must establish.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -20,7 +22,7 @@ theorem inferUncached_sort_full_wf
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {u : KUniv .anon} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hcollision : support.CollisionFree)
     (hresultSupport : support (KExpr.mkSort (KUniv.mkSucc u)))
@@ -48,7 +50,7 @@ theorem inferUncached_var_full_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {idx : UInt64} {name : Mode.anon.F Name}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hsource : PreTrKExprS world.venv uvars world.nameOf trProj Delta
       (.var idx name info) sourceV)
@@ -75,7 +77,7 @@ theorem inferUncached_fvar_full_wf
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {fv : FVarId} {name : Mode.anon.F Name}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hsafe : FVarInferSafety layer semantics trProj world support uvars
       Delta)
@@ -103,7 +105,7 @@ theorem inferUncached_const_full_wf
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {id : KId .anon}
     {levels : Array (KUniv .anon)} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hfault : TcM.LazyFaultPreserves
       (WhnfStateInv layer semantics trProj world support uvars Delta))
@@ -136,7 +138,7 @@ theorem inferUncached_nat_full_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {n : Nat} {blob : Address}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (context : LiteralInferContext world support)
     (theory : WhnfTheory trProj world uvars)
     (hsource : PreTrKExprS world.venv uvars world.nameOf trProj Delta
@@ -159,7 +161,7 @@ theorem inferUncached_str_full_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {value : String} {blob : Address}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (context : LiteralInferContext world support)
     (theory : WhnfTheory trProj world uvars)
     (hsource : PreTrKExprS world.venv uvars world.nameOf trProj Delta
@@ -179,4 +181,4 @@ theorem inferUncached_str_full_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/FullInferenceProjections.lean b/Ix/Kernel/Verify/Check/FullInferenceProjections.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/FullInferenceProjections.lean
rename to Ix/Kernel/Verify/Check/FullInferenceProjections.lean
index 0c8ed01ac..cfe360bb4 100644
--- a/Ix/Tc/Verify/Check/FullInferenceProjections.lean
+++ b/Ix/Kernel/Verify/Check/FullInferenceProjections.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.FullInferenceBinders
-import Ix.Tc.Verify.Infer.ProjectionTypes
+import Ix.Kernel.Verify.Check.FullInferenceBinders
+import Ix.Kernel.Verify.Infer.ProjectionTypes
 
 /-!
 # Full inference for projections
@@ -15,9 +15,9 @@ policy frame.  A typing proof alone cannot show that a partial error preserved
 for one concrete smaller method table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace ProjectionInference
 
@@ -124,4 +124,4 @@ theorem inferUncached_prj_full_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/InferencePolicy.lean b/Ix/Kernel/Verify/Check/InferencePolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/InferencePolicy.lean
rename to Ix/Kernel/Verify/Check/InferencePolicy.lean
index e4cde5e74..cba828a38 100644
--- a/Ix/Tc/Verify/Check/InferencePolicy.lean
+++ b/Ix/Kernel/Verify/Check/InferencePolicy.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Knot
-import Ix.Tc.Verify.Infer.Applications
-import Ix.Tc.Verify.Whnf.StructEta.CallbackPrefix
-import Ix.Tc.Verify.Whnf.StructEta.RecursionClassifier
+import Ix.Kernel.Verify.Knot
+import Ix.Kernel.Verify.Infer.Applications
+import Ix.Kernel.Verify.Whnf.StructEta.CallbackPrefix
+import Ix.Kernel.Verify.Whnf.StructEta.RecursionClassifier
 
 /-!
 # Inference-policy frames
@@ -19,7 +19,7 @@ smaller callbacks do.  No semantic typing claim is bundled into this
 operational frame.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- An action restores the caller's inference policy on both outcomes. -/
 def TcM.PreservesInferOnly (x : TcM .anon alpha) : Prop :=
@@ -649,7 +649,7 @@ theorem PreservesInferOnly.isDefEq_full_wf
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {methods : Methods .anon}
     {s : TcState .anon} {left right : KExpr .anon}
-    {leftV rightV : Lean4Lean.VExpr}
+    {leftV rightV : Ix.Theory.Named.VExpr}
     (hsemantic : Methods.WFAt layer semantics trProj world support uvars
       methods)
     (hframe : methods.PreservesInferOnly)
@@ -677,4 +677,4 @@ theorem PreservesInferOnly.isDefEq_full_wf
 
 end Methods
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/MemberEvidence.lean b/Ix/Kernel/Verify/Check/MemberEvidence.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/MemberEvidence.lean
rename to Ix/Kernel/Verify/Check/MemberEvidence.lean
index b3e45b2ab..33589ff34 100644
--- a/Ix/Tc/Verify/Check/MemberEvidence.lean
+++ b/Ix/Kernel/Verify/Check/MemberEvidence.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.BoundedPipelines
-import Ix.Tc.Verify.Check.SafetyFrame
+import Ix.Kernel.Verify.Check.BoundedPipelines
+import Ix.Kernel.Verify.Check.SafetyFrame
 
 /-!
 # Semantic evidence from standalone member checking
@@ -14,7 +14,7 @@ successful execution is nevertheless part of the trace from which the
 typing evidence is extracted.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -92,7 +92,7 @@ theorem checkConstMember_axiom_sound
     {id : KId .anon} {name : Mode.anon.F Name}
     {levelParams : Mode.anon.F (Array Name)} {isUnsafe : Bool}
     {levels : UInt64} {type : KExpr .anon}
-    {typeV : Lean4Lean.VExpr}
+    {typeV : Ix.Theory.Named.VExpr}
     (hresources : StandaloneValidationResources support
       (.axio name levelParams isUnsafe levels type))
     (hsourceCall : context.typeSources type)
@@ -166,7 +166,7 @@ theorem checkConstMember_defn_sound
     {safety : Ix.DefinitionSafety} {hints : Lean.ReducibilityHints}
     {levels : UInt64} {type value : KExpr .anon}
     {leanAll : Mode.anon.F (Array (KId .anon))} {block : KId .anon}
-    {typeV valueV : Lean4Lean.VExpr}
+    {typeV valueV : Ix.Theory.Named.VExpr}
     (hresources : StandaloneValidationResources support
       (.defn name levelParams kind safety hints levels type value leanAll
         block))
@@ -350,7 +350,7 @@ theorem checkConstMember_sound
       model.keys.uvars calls (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hingress : PreDeclRel world.venv world.nameOf trProj id concrete decl)
     (hcovers : context.Covers concrete)
     (hresources : StandaloneValidationResources support concrete)
@@ -456,7 +456,7 @@ theorem checkConstMember_pending_sound
       model.keys.uvars calls (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -496,4 +496,4 @@ theorem checkConstMember_pending_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/NatAcceptance.lean b/Ix/Kernel/Verify/Check/NatAcceptance.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/NatAcceptance.lean
rename to Ix/Kernel/Verify/Check/NatAcceptance.lean
index becb4322b..c9de163f8 100644
--- a/Ix/Tc/Verify/Check/NatAcceptance.lean
+++ b/Ix/Kernel/Verify/Check/NatAcceptance.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.NatFixture
-import Ix.Tc.Verify.Check.PublicStandalone
+import Ix.Kernel.Verify.NatFixture
+import Ix.Kernel.Verify.Check.PublicStandalone
+
+open Ix.Theory (VLevel)
 
 /-!
 # Concrete standalone-check acceptance over the ambient Nat world
@@ -17,7 +19,7 @@ cache use, reset, validation, acceptance, and rollback rather than about a
 mock implementation.
 -/
 
-namespace Ix.Tc.AmbientNat
+namespace Ix.Kernel.AmbientNat
 
 def acceptanceEnv : KEnv .anon :=
   { loadedEnv with inferCache :=
@@ -204,14 +206,14 @@ theorem natType_translation :
   · simpa [natType] using
       (TrKExprS.sort (env := worldNat.venv) (nameOf := worldNat.nameOf)
         (trProj := RawProjRel.none) (Δ := []) oneLevel_wf)
-  · exact Lean4Lean.VEnv.IsDefEqU.refl
-      ⟨_, Lean4Lean.VEnv.HasType.sort oneLevel_wf⟩
+  · exact Ix.Theory.Named.VEnv.IsDefEqU.refl
+      ⟨_, Ix.Theory.Named.VEnv.HasType.sort oneLevel_wf⟩
 
 theorem natReference_type :
     worldNat.venv.HasType 0 [] (.const natName [])
       (.sort oneLevel.toVLevel) := by
   exact
-    (Lean4Lean.VEnv.HasType.const (env := natEnv) (U := 0) (Γ := [])
+    (Ix.Theory.Named.VEnv.HasType.const (env := natEnv) (U := 0) (Γ := [])
       (ci := natConstant) (ls := []) natEnv_nat (by simp) rfl)
 
 theorem oneLevel_view :
@@ -224,8 +226,8 @@ theorem oneLevel_view :
     | succ hchild =>
         cases hchild
         exact Or.inl rfl
-  · exact Lean4Lean.VEnv.IsDefEqU.refl
-      ⟨_, Lean4Lean.VEnv.HasType.sort oneLevel_wf⟩
+  · exact Ix.Theory.Named.VEnv.IsDefEqU.refl
+      ⟨_, Ix.Theory.Named.VEnv.HasType.sort oneLevel_wf⟩
 
 theorem goodTypeEvidence :
     TypeCheckEvidence RawProjRel.none worldNat acceptanceSupport 0 []
@@ -549,7 +551,7 @@ structure PublicCheckLifecycle : Prop where
   invalidPending : PendingDecl RawProjRel.none worldGood
     IllTypedPending.targetId IllTypedPending.theoryDecl
   invalidSemantic :
-    ¬∃ env', Lean4Lean.VDecl.WF worldGood.venv
+    ¬∃ env', Ix.Theory.Named.VDecl.WF worldGood.venv
       IllTypedPending.theoryDecl env'
   invalidExecution :
     TcM.checkConst IllTypedPending.targetId resetState =
@@ -582,4 +584,4 @@ def goodSucceeded : Bool :=
 example : goodSucceeded = true := by
   simp [goodSucceeded, initial_good_public]
 
-end Ix.Tc.AmbientNat
+end Ix.Kernel.AmbientNat
diff --git a/Ix/Tc/Verify/Check/PositiveFuelSort.lean b/Ix/Kernel/Verify/Check/PositiveFuelSort.lean
similarity index 94%
rename from Ix/Tc/Verify/Check/PositiveFuelSort.lean
rename to Ix/Kernel/Verify/Check/PositiveFuelSort.lean
index 1469c28a3..39cc0d1be 100644
--- a/Ix/Tc/Verify/Check/PositiveFuelSort.lean
+++ b/Ix/Kernel/Verify/Check/PositiveFuelSort.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Check.BoundedPipelines
-import Ix.Tc.Verify.RecursiveMethods.SortInference
-import Ix.Tc.Verify.RecursiveMethods.ScopedSortInference
-import Ix.Tc.Verify.ScopedSuffix.ClosedContext
+import Ix.Kernel.Verify.Check.BoundedPipelines
+import Ix.Kernel.Verify.RecursiveMethods.SortInference
+import Ix.Kernel.Verify.RecursiveMethods.ScopedSortInference
+import Ix.Kernel.Verify.ScopedSuffix.ClosedContext
 
 /-!
 # Positive-fuel bounded checker witness
@@ -15,7 +15,7 @@ inequalities, strong inference upgrade, and checker pipeline resources are
 all concrete.
 -/
 
-namespace Ix.Tc.PositiveFuelSort
+namespace Ix.Kernel.PositiveFuelSort
 
 def sourceUniv : KUniv .anon := KUniv.mkZero
 def resultUniv : KUniv .anon := KUniv.mkSucc sourceUniv
@@ -118,8 +118,8 @@ def theory (uvars : Nat) :
     intro literal hliteral
     cases literal <;>
       simp [VerifyWorld.empty, VerifyWorld.ofCatalog,
-        Lean4Lean.VEnv.ContainsLits, Lean4Lean.VEnv.contains,
-        Lean4Lean.VEnv.empty] at hliteral
+        Ix.Theory.Named.VEnv.ContainsLits, Ix.Theory.Named.VEnv.contains,
+        Ix.Theory.Named.VEnv.empty] at hliteral
   projections := RawProjRel.none_ok VerifyWorld.empty.venv uvars
 
 /-! ## Concrete run-scoped suffix instance -/
@@ -235,12 +235,12 @@ theorem scopedPublicInference_execution
       result_supported scopedInitialState_baseInv
   have hbody :
       (RecM.inferUncached RecM.inferCall false source).run
-          (Ix.Tc.methodsN (m := .anon) 1) scopedInitialState =
+          (Ix.Kernel.methodsN (m := .anon) 1) scopedInitialState =
         .ok result afterIntern := by
     exact hintern
   have hshell := RecM.inferWith_fullMiss_success
     (inferRec := RecM.inferCall)
-    (methods := Ix.Tc.methodsN (m := .anon) 1)
+    (methods := Ix.Kernel.methodsN (m := .anon) 1)
     (source := source) (ty := result) (key := scopedInferKey)
     (s := scopedInitialState) (sKey := scopedInitialState)
     (sBody := afterIntern) (by rfl) scopedInitialState_inferKey
@@ -277,7 +277,7 @@ theorem methodContractAtFuelOne
       (kernelCacheSemantics model.keys RawProjRel.none)
       RawProjRel.none VerifyWorld.empty support model.keys.uvars
       (.singletonInfer source)
-      (Methods.next (Ix.Tc.methodsN (m := .anon) 1)) := by
+      (Methods.next (Ix.Kernel.methodsN (m := .anon) 1)) := by
   simpa [Methods.SortSchedule.calls] using
     (scheduleAtFuelOne separation model).nextSelected
 
@@ -290,7 +290,7 @@ theorem fullInferenceAtFuelOne
       (kernelCacheSemantics model.keys RawProjRel.none)
       RawProjRel.none VerifyWorld.empty support model.keys.uvars
       (.singletonInfer source)
-      (Methods.next (Ix.Tc.methodsN (m := .anon) 1)) :=
+      (Methods.next (Ix.Kernel.methodsN (m := .anon) 1)) :=
   Methods.FullInferenceWFAtOn.ofSingletonSort
     (methodContractAtFuelOne separation model)
     (Methods.next_preservesInferOnly _
@@ -304,7 +304,7 @@ def pipelinesAtFuelOne
     StandalonePipelineResources
       (kernelCacheSemantics model.keys RawProjRel.none)
       RawProjRel.none VerifyWorld.empty support model.keys.uvars
-      (.singletonInfer source) (Ix.Tc.methodsN (m := .anon) 1) :=
+      (.singletonInfer source) (Ix.Kernel.methodsN (m := .anon) 1) :=
   StandalonePipelineResources.singletonSortAxiom
     (fullInferenceAtFuelOne separation model) sortResources supported_is_sort
 
@@ -317,4 +317,4 @@ theorem pipelines_cover_concreteAxiom
     (pipelinesAtFuelOne separation model).Covers concreteAxiom :=
   .axiom rfl
 
-end Ix.Tc.PositiveFuelSort
+end Ix.Kernel.PositiveFuelSort
diff --git a/Ix/Tc/Verify/Check/PreTranslation.lean b/Ix/Kernel/Verify/Check/PreTranslation.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/PreTranslation.lean
rename to Ix/Kernel/Verify/Check/PreTranslation.lean
index 9f033a626..f2172cdf0 100644
--- a/Ix/Tc/Verify/Check/PreTranslation.lean
+++ b/Ix/Kernel/Verify/Check/PreTranslation.lean
@@ -1,6 +1,8 @@
-import Ix.Tc.Verify.Check.Scoped
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.Trans
+import Ix.Kernel.Verify.Check.Scoped
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.Trans
+
+open Ix.Theory (VLevel)
 
 /-!
 # Untyped structural translation for checker ingress
@@ -18,9 +20,9 @@ premise.  Successful full inference will upgrade this relation to
 declaration.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VEnv VConstant)
+open Ix.Theory.Named (VExpr VEnv VConstant)
 
 variable (env : VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel) in
@@ -146,4 +148,4 @@ theorem contextScoped
 
 end PreTrKExprS
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/PreTranslationCompatibility.lean b/Ix/Kernel/Verify/Check/PreTranslationCompatibility.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/PreTranslationCompatibility.lean
rename to Ix/Kernel/Verify/Check/PreTranslationCompatibility.lean
index f4cf8c3bd..2db1c4c26 100644
--- a/Ix/Tc/Verify/Check/PreTranslationCompatibility.lean
+++ b/Ix/Kernel/Verify/Check/PreTranslationCompatibility.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.PreTranslationIngress
-import Lean4Lean.Theory.Typing.Strong
+import Ix.Kernel.Verify.Check.PreTranslationIngress
+import Ix.Theory.Named.Typing.Strong
 
 /-!
 # Compatibility of raw and typed structural translations
@@ -11,9 +11,9 @@ chosen by the current raw translation and borrows only the typing evidence
 from the checked witness.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VEnv)
+open Ix.Theory.Named (VExpr VEnv)
 
 /-- Upgrade a raw structural translation using any typed translation of the
 same kernel expression in a pairwise-definitionally-equal context. -/
@@ -138,14 +138,14 @@ theorem PreTrKExprS.upgradeBinderCoreOfWF
   | app hpreFn hpreArg ihFn ihArg =>
       simp only [KExpr.binderCore, Bool.and_eq_true] at hcore
       obtain ⟨type, body, hfnType, hargType⟩ :=
-        Lean4Lean.VExpr.WF.app_inv henv.ordered hDelta.toCtx hwf
+        Ix.Theory.Named.VExpr.WF.app_inv henv.ordered hDelta.toCtx hwf
       exact .app hfnType hargType
         (ihFn hDelta hcore.1 ⟨_, hfnType⟩)
         (ihArg hDelta hcore.2 ⟨_, hargType⟩)
   | lam hpreType hpreBody ihType ihBody =>
       simp only [KExpr.binderCore, Bool.and_eq_true] at hcore
       obtain ⟨htype, hbody⟩ :=
-        Lean4Lean.VExpr.WF.lam_inv henv.ordered hDelta.toCtx hwf
+        Ix.Theory.Named.VExpr.WF.lam_inv henv.ordered hDelta.toCtx hwf
       have htypeWF : VExpr.WF env uvars _ _ :=
         ⟨_, htype.choose_spec⟩
       exact .lam htype
@@ -155,7 +155,7 @@ theorem PreTrKExprS.upgradeBinderCoreOfWF
       simp only [KExpr.binderCore, Bool.and_eq_true] at hcore
       obtain ⟨_, hwhole⟩ := hwf
       obtain ⟨htype, hbody⟩ :=
-        Lean4Lean.VEnv.HasType.forallE_inv henv.ordered hwhole
+        Ix.Theory.Named.VEnv.HasType.forallE_inv henv.ordered hwhole
       have htypeWF : VExpr.WF env uvars _ _ :=
         ⟨_, htype.choose_spec⟩
       have hbodyWF : VExpr.WF env uvars _ _ :=
@@ -168,4 +168,4 @@ theorem PreTrKExprS.upgradeBinderCoreOfWF
   | nat => simp [KExpr.binderCore] at hcore
   | str => simp [KExpr.binderCore] at hcore
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/PreTranslationIngress.lean b/Ix/Kernel/Verify/Check/PreTranslationIngress.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/PreTranslationIngress.lean
rename to Ix/Kernel/Verify/Check/PreTranslationIngress.lean
index 9ba869fa1..1bb26dfc7 100644
--- a/Ix/Tc/Verify/Check/PreTranslationIngress.lean
+++ b/Ix/Kernel/Verify/Check/PreTranslationIngress.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Check.PreTranslation
-import Ix.Tc.Verify.Subst
+import Ix.Kernel.Verify.Check.PreTranslation
+import Ix.Kernel.Verify.Subst
+
+open Ix.Theory (VLevel)
 
 /-!
 # Raw-declaration ingress into `PreTrKExprS`
@@ -17,7 +19,7 @@ The main theorem below proves that raw translation plus the syntax-only
 translation required by full inference.  No typing judgment is assumed.
 -/
 
-namespace Lean4Lean.VExpr
+namespace Ix.Theory.Named.VExpr
 
 private def Subst.comp (sigma tau : Subst) : Subst :=
   fun index => (sigma index).subst tau
@@ -32,7 +34,7 @@ private theorem Subst.comp_lift {sigma tau : Subst} :
       rw [lift_eq_lift', lift_eq_lift', lift'_subst, subst_lift']
       congr 1
       funext inner
-      simp [Subst.lift_r, Subst.lift_l, Lean4Lean.Lift.liftVar,
+      simp [Subst.lift_r, Subst.lift_l, Ix.Theory.Named.Lift.liftVar,
         Subst.lift, lift_eq_lift']
 
 private theorem subst_subst {e : VExpr} {sigma tau : Subst} :
@@ -71,11 +73,11 @@ theorem inst_subst_cons (body value : VExpr) (sigma : Subst) :
         (lift_subst_cons (e := VExpr.bvar index)
           (sigma := sigma) (value := value.subst sigma))
 
-end Lean4Lean.VExpr
+end Ix.Theory.Named.VExpr
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLocalDecl)
+open Ix.Theory.Named (VExpr VLocalDecl)
 
 private theorem subst_natLit (value : Nat) (sigma : VExpr.Subst) :
     (VExpr.natLit value).subst sigma = VExpr.natLit value := by
@@ -194,7 +196,7 @@ namespace RawExprRel
 /-- General substitution-aware ingress theorem.  The size bound rules out
 `UInt64` wraparound when the validator descends through a binder. -/
 theorem toPre_of_scoped_aux
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     (hprojection : trProj.SubstCompatible)
     (hliterals : forall literal, env.ContainsLits literal)
@@ -282,7 +284,7 @@ theorem toPre_of_scoped_aux
 /-- Closed declaration ingress: successful scoping turns the exact raw
 Theory term into the `PreTrKExprS` witness consumed by full inference. -/
 theorem toPre_of_scoped
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     (hprojection : trProj.SubstCompatible)
     (hliterals : forall literal, env.ContainsLits literal)
@@ -298,7 +300,7 @@ theorem toPre_of_scoped
 lets, and projections makes their ambient semantic hypotheses unnecessary;
 all remaining premises are syntax-only scoping and exact raw translation. -/
 theorem toPreBinderCore_of_scoped_aux
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     {ctx : List VExpr} {Delta : KVLCtx} {sigma : VExpr.Subst}
     {depth : UInt64} {source : KExpr .anon} {sourceV : VExpr}
@@ -367,7 +369,7 @@ theorem toPreBinderCore_of_scoped_aux
 /-- Closed binder-core declarations enter `PreTrKExprS` without requiring an
 irrelevant primitive-literal environment. -/
 theorem toPreBinderCore_of_scoped
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     {source : KExpr .anon} {sourceV : VExpr}
     (hraw : RawExprRel (uvars := uvars) env nameOf trProj [] source sourceV)
@@ -380,4 +382,4 @@ theorem toPreBinderCore_of_scoped
 
 end RawExprRel
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/PreTranslationOpening.lean b/Ix/Kernel/Verify/Check/PreTranslationOpening.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/PreTranslationOpening.lean
rename to Ix/Kernel/Verify/Check/PreTranslationOpening.lean
index 48f402999..d00ad1670 100644
--- a/Ix/Tc/Verify/Check/PreTranslationOpening.lean
+++ b/Ix/Kernel/Verify/Check/PreTranslationOpening.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.PreTranslation
-import Ix.Tc.Verify.Infer.BinderOpening
+import Ix.Kernel.Verify.Check.PreTranslation
+import Ix.Kernel.Verify.Infer.BinderOpening
 
 /-!
 # Binder opening for untyped checker ingress
@@ -10,9 +10,9 @@ operation as the already verified typed inference path.  This file proves
 that operation preserves the deliberately untyped `PreTrKExprS` relation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VEnv VLocalDecl)
+open Ix.Theory.Named (VExpr VEnv VLocalDecl)
 
 /-- Replacing one de Bruijn binder with its freshly tagged fvar leaves the
 pre-translation's Theory expression unchanged. -/
@@ -187,4 +187,4 @@ theorem PreTrKExprS.openFVarZero
       (KExpr.instantiateRevSpec body #[.mkFVar fv name] 0) bodyV :=
   H.openFVar .zero rfl (by simpa using hfresh) (by simpa using hbound)
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/PreTranslationScopes.lean b/Ix/Kernel/Verify/Check/PreTranslationScopes.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/PreTranslationScopes.lean
rename to Ix/Kernel/Verify/Check/PreTranslationScopes.lean
index 0ed1b2987..d1bf29d5c 100644
--- a/Ix/Tc/Verify/Check/PreTranslationScopes.lean
+++ b/Ix/Kernel/Verify/Check/PreTranslationScopes.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Check.InferencePolicy
-import Ix.Tc.Verify.Check.PreTranslationOpening
-import Ix.Tc.Verify.Infer.BinderScopes
-import Ix.Tc.Verify.Infer.LetScopes
+import Ix.Kernel.Verify.Check.InferencePolicy
+import Ix.Kernel.Verify.Check.PreTranslationOpening
+import Ix.Kernel.Verify.Infer.BinderScopes
+import Ix.Kernel.Verify.Infer.LetScopes
 
 /-!
 # Binder scopes for pre-typed checker ingress
@@ -13,7 +13,7 @@ factored operational binder-opening core with `PreTrKExprS.openFVarZero` and
 the independent inference-policy frame.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -25,7 +25,7 @@ theorem openBinder_pre_scope
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
-    {type body : KExpr .anon} {typeV bodyV : Lean4Lean.VExpr}
+    {type body : KExpr .anon} {typeV bodyV : Ix.Theory.Named.VExpr}
     (htype : TrKExprS world.venv uvars world.nameOf trProj Delta type typeV)
     (htypeType : world.venv.IsType uvars Delta.toCtx typeV)
     (hbody : PreTrKExprS world.venv uvars world.nameOf trProj
@@ -83,7 +83,7 @@ theorem openLet_pre_scope
     {Delta : KVLCtx} {s : TcState .anon}
     {name : Mode.anon.F Name}
     {type value body : KExpr .anon}
-    {typeV valueV bodyV : Lean4Lean.VExpr}
+    {typeV valueV bodyV : Ix.Theory.Named.VExpr}
     (htype : TrKExprS world.venv uvars world.nameOf trProj Delta type typeV)
     (hvalue : TrKExprS world.venv uvars world.nameOf trProj Delta value valueV)
     (hvalueType : world.venv.HasType uvars Delta.toCtx valueV typeV)
@@ -147,7 +147,7 @@ theorem withLctxScope_openBinder_pre_wf
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Delta : KVLCtx} {methods : Methods .anon} {s : TcState .anon}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
-    {type body : KExpr .anon} {typeV bodyV : Lean4Lean.VExpr}
+    {type body : KExpr .anon} {typeV bodyV : Ix.Theory.Named.VExpr}
     (htype : TrKExprS world.venv uvars world.nameOf trProj Delta type typeV)
     (htypeType : world.venv.IsType uvars Delta.toCtx typeV)
     (hbody : PreTrKExprS world.venv uvars world.nameOf trProj
@@ -261,7 +261,7 @@ theorem withLctxScope_openLet_pre_wf
     {Delta : KVLCtx} {methods : Methods .anon} {s : TcState .anon}
     {name : Mode.anon.F Name}
     {type value body : KExpr .anon}
-    {typeV valueV bodyV : Lean4Lean.VExpr}
+    {typeV valueV bodyV : Ix.Theory.Named.VExpr}
     (htype : TrKExprS world.venv uvars world.nameOf trProj Delta type typeV)
     (hvalue : TrKExprS world.venv uvars world.nameOf trProj Delta value valueV)
     (hvalueType : world.venv.HasType uvars Delta.toCtx valueV typeV)
@@ -371,4 +371,4 @@ theorem withLctxScope_openLet_pre_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ProjectionInferencePolicy.lean b/Ix/Kernel/Verify/Check/ProjectionInferencePolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/ProjectionInferencePolicy.lean
rename to Ix/Kernel/Verify/Check/ProjectionInferencePolicy.lean
index 268104ae8..2a5896ce5 100644
--- a/Ix/Tc/Verify/Check/ProjectionInferencePolicy.lean
+++ b/Ix/Kernel/Verify/Check/ProjectionInferencePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.UncachedInferencePolicy
+import Ix.Kernel.Verify.Check.UncachedInferencePolicy
 
 /-!
 # Operational policy for projection inference
@@ -15,7 +15,7 @@ and cache shell, reducing the current inference layer to the current WHNF
 policy over a policy-framed smaller method table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -385,4 +385,4 @@ theorem infer_preservesInferOnly_of_whnf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/PublicBlocks.lean b/Ix/Kernel/Verify/Check/PublicBlocks.lean
similarity index 80%
rename from Ix/Tc/Verify/Check/PublicBlocks.lean
rename to Ix/Kernel/Verify/Check/PublicBlocks.lean
index 3ba1abfb1..3817f3e11 100644
--- a/Ix/Tc/Verify/Check/PublicBlocks.lean
+++ b/Ix/Kernel/Verify/Check/PublicBlocks.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Check.CheckConstTransaction
-import Ix.Tc.Verify.Check.BlockDefinition
-import Ix.Tc.Verify.Check.BlockOracle
-import Ix.Tc.Verify.Check.QuotientBoundary
+import Ix.Kernel.Verify.Check.CheckConstTransaction
+import Ix.Kernel.Verify.Check.BlockDefinition
+import Ix.Kernel.Verify.Check.BlockOracle
+import Ix.Kernel.Verify.Check.QuotientBoundary
 
 /-!
 # Public coordinated-block checker theorem
@@ -13,7 +13,7 @@ the semantic disposition is indexed by the public checker's exact final
 state.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM.checkConst
 
@@ -37,21 +37,21 @@ theorem blockDisposition
       ExactCheckBlock world block members kind →
       id ∈ members →
       RecM.ExactBlockBodySuccessTrace
-        (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat)
+        (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat)
         block id members kind routed bodyAfter →
       CertifiedBlockBodySuccess semantics trProj world support
-        (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat)
+        (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat)
         block id members kind routed bodyAfter)
     (hrun : TcM.checkConst id before = .ok () after) :
     CheckConstSuccessDisposition semantics trProj world support
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat)
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat)
       id before after := by
-  let methods := Ix.Tc.methodsN (m := .anon) before.recFuel.toNat
+  let methods := Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat
   have hbody : (RecM.checkConst id).run methods before = .ok () after := by
     unfold TcM.checkConst TcM.isolateCheckErrors TcM.runRec at hrun
     cases hinner :
         (RecM.checkConst id).run
-          (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat) before with
+          (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat) before with
     | ok value middle =>
         simp only [hinner] at hrun
         cases hrun
@@ -66,4 +66,4 @@ theorem blockDisposition
 
 end TcM.checkConst
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/PublicStandalone.lean b/Ix/Kernel/Verify/Check/PublicStandalone.lean
similarity index 91%
rename from Ix/Tc/Verify/Check/PublicStandalone.lean
rename to Ix/Kernel/Verify/Check/PublicStandalone.lean
index c7bd6312c..dae7ce08d 100644
--- a/Ix/Tc/Verify/Check/PublicStandalone.lean
+++ b/Ix/Kernel/Verify/Check/PublicStandalone.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.ScopedStandaloneDriver
-import Ix.Tc.Verify.RecursiveMethods.Public
+import Ix.Kernel.Verify.Check.ScopedStandaloneDriver
+import Ix.Kernel.Verify.RecursiveMethods.Public
 
 /-!
 # Public standalone constant checking
@@ -16,7 +16,7 @@ definitionally, while standalone definitions may supply a finite routing
 proof for their concrete block environment.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM.checkConst
 
@@ -29,7 +29,7 @@ theorem rollback_on_error
     {err : TcError .anon}
     (hbody :
       (RecM.checkConst id).run
-        (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat) before =
+        (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat) before =
           .error err failed) :
     TcM.checkConst id before =
       .error err (before.restoreCheckCachesOnError failed) := by
@@ -47,7 +47,7 @@ theorem rollback_preserves_kernel
     {err : TcError .anon}
     (hbody :
       (RecM.checkConst id).run
-        (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat) before =
+        (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat) before =
           .error err failed)
     (hbefore : KernelStateWF semantics trProj world support before)
     (hfailedCore : TcStateWF trProj failed world)
@@ -74,8 +74,8 @@ theorem wf_legacy
       (kernelCacheSemantics context.proposition.model.keys trProj)
       trProj world support context.proposition.model.keys.uvars
       (context.calls (before.recFuel.toNat + 1))
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat))
-    {concrete : KConst .anon} {decl : Lean4Lean.VDecl}
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat))
+    {concrete : KConst .anon} {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -88,7 +88,7 @@ theorem wf_legacy
       (WhnfStateInv .noAccel
         (kernelCacheSemantics context.proposition.model.keys trProj) trProj
         world support context.proposition.model.keys.uvars [])
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat) concrete)
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat) concrete)
     (hI : WhnfStateInv .noAccel
       (kernelCacheSemantics context.proposition.model.keys trProj) trProj world
       support context.proposition.model.keys.uvars [] before)
@@ -105,7 +105,7 @@ theorem wf_legacy
           (kernelCacheSemantics context.proposition.model.keys trProj) trProj
           world' support context.proposition.model.keys.uvars [] after ∧
         TrustedDecl trProj world' id decl := by
-  let methods := Ix.Tc.methodsN (m := .anon) before.recFuel.toNat
+  let methods := Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat
   have hmethods : Methods.WFAtOn .noAccel
       (kernelCacheSemantics context.proposition.model.keys trProj) trProj world
       support context.proposition.model.keys.uvars
@@ -123,7 +123,7 @@ theorem wf_legacy
     unfold TcM.checkConst TcM.isolateCheckErrors TcM.runRec at hrun
     cases hinner :
         (RecM.checkConst id).run
-          (Ix.Tc.methodsN before.recFuel.toNat) before with
+          (Ix.Kernel.methodsN before.recFuel.toNat) before with
     | ok value middle =>
         simp only [hinner] at hrun
         cases hrun
@@ -148,8 +148,8 @@ theorem wf
       requests trProj world support)
     (pipelines : ScopedStandalonePipelineResources context.model support
       (context.calls (before.recFuel.toNat + 1))
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat))
-    {concrete : KConst .anon} {decl : Lean4Lean.VDecl}
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat))
+    {concrete : KConst .anon} {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -162,7 +162,7 @@ theorem wf
     (hroute : StandaloneRoute
       (ScopedWhnfStateInv context.model .noAccel
         (kernelCacheSemantics context.model.keys trProj) support [])
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat) concrete)
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat) concrete)
     (hI : ScopedWhnfStateInv context.model .noAccel
       (kernelCacheSemantics context.model.keys trProj) support [] before)
     (hfault : TcM.LazyFaultPreserves
@@ -178,7 +178,7 @@ theorem wf
           support context.model.keys.uvars [] after ∧
         context.model.StateInScope after ∧
         TrustedDecl trProj world' id decl := by
-  let methods := Ix.Tc.methodsN (m := .anon) before.recFuel.toNat
+  let methods := Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat
   have hmethods : Methods.ScopedWFAtOn context.model .noAccel
       (kernelCacheSemantics context.model.keys trProj) support
       (context.calls (before.recFuel.toNat + 1)) (Methods.next methods) := by
@@ -195,7 +195,7 @@ theorem wf
     unfold TcM.checkConst TcM.isolateCheckErrors TcM.runRec at hrun
     cases hinner :
         (RecM.checkConst id).run
-          (Ix.Tc.methodsN before.recFuel.toNat) before with
+          (Ix.Kernel.methodsN before.recFuel.toNat) before with
     | ok value middle =>
         simp only [hinner] at hrun
         cases hrun
@@ -222,8 +222,8 @@ theorem rejected_of_no_decl_wf
       (kernelCacheSemantics context.proposition.model.keys trProj)
       trProj world support context.proposition.model.keys.uvars
       (context.calls (before.recFuel.toNat + 1))
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat))
-    {concrete : KConst .anon} {decl : Lean4Lean.VDecl}
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat))
+    {concrete : KConst .anon} {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -236,7 +236,7 @@ theorem rejected_of_no_decl_wf
       (WhnfStateInv .noAccel
         (kernelCacheSemantics context.proposition.model.keys trProj) trProj
         world support context.proposition.model.keys.uvars [])
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat) concrete)
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat) concrete)
     (hI : WhnfStateInv .noAccel
       (kernelCacheSemantics context.proposition.model.keys trProj) trProj world
       support context.proposition.model.keys.uvars [] before)
@@ -244,7 +244,7 @@ theorem rejected_of_no_decl_wf
       (WhnfStateInv .noAccel
         (kernelCacheSemantics context.proposition.model.keys trProj) trProj
         world support context.proposition.model.keys.uvars []))
-    (hnotWF : ¬∃ world', Lean4Lean.VDecl.WF world.venv decl world') :
+    (hnotWF : ¬∃ world', Ix.Theory.Named.VDecl.WF world.venv decl world') :
     ∃ err failed,
       TcM.checkConst id before = .error err failed ∧
         PendingDecl trProj world id decl := by
@@ -272,10 +272,10 @@ theorem axiom_pending_sound
       (kernelCacheSemantics context.proposition.model.keys trProj)
       trProj world support context.proposition.model.keys.uvars
       (context.calls (before.recFuel.toNat + 1))
-      (Ix.Tc.methodsN (m := .anon) before.recFuel.toNat))
+      (Ix.Kernel.methodsN (m := .anon) before.recFuel.toNat))
     {name : Mode.anon.F Name}
     {levelParams : Mode.anon.F (Array Name)} {isUnsafe : Bool}
-    {levels : UInt64} {type : KExpr .anon} {decl : Lean4Lean.VDecl}
+    {levels : UInt64} {type : KExpr .anon} {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -313,4 +313,4 @@ theorem axiom_pending_sound
 
 end TcM.checkConst
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/QuotientAdmission.lean b/Ix/Kernel/Verify/Check/QuotientAdmission.lean
similarity index 88%
rename from Ix/Tc/Verify/Check/QuotientAdmission.lean
rename to Ix/Kernel/Verify/Check/QuotientAdmission.lean
index d018c0c17..54c609877 100644
--- a/Ix/Tc/Verify/Check/QuotientAdmission.lean
+++ b/Ix/Kernel/Verify/Check/QuotientAdmission.lean
@@ -1,12 +1,12 @@
-import Ix.Tc.Verify.Env
-import Ix.Tc.Primitive
-import Lean4Lean.Theory.Typing.QuotLemmas
+import Ix.Kernel.Verify.Env
+import Ix.Kernel.Primitive
+import Ix.Theory.Named.Typing.QuotLemmas
 
 /-!
 # Atomic quotient admission
 
 `KConst.quot` declarations are physically standalone entries, but their
-semantic meaning is not four independent axioms. Lean4Lean installs `Quot`,
+semantic meaning is not four independent axioms. Ix.Theory.Named installs `Quot`,
 `Quot.mk`, `Quot.lift`, and `Quot.ind` in order and then registers one quotient
 definitional equation. This file records the corresponding address-keyed Ix
 boundary without granting a successful check of any one member authority over
@@ -16,14 +16,14 @@ The relation deliberately retains each intermediate `VEnv`: later primitive
 types mention earlier primitives, so translating all four against the initial
 environment would be false. `QuotientBridge.lean` constructs this relation
 from four exact `checkQuot` successes, scoped collision freedom, and one
-explicit proposition carrying the canonical Lean4Lean semantic transaction.
+explicit proposition carrying the canonical Ix.Theory.Named semantic transaction.
 The theorems below then close the atomic transition without granting authority
 to any prefix.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDecl VEnv VConstant)
+open Ix.Theory.Named (VDecl VEnv VConstant)
 
 /-- One address-keyed quotient insertion in the exact environment where its
 type is interpreted. The final conjunct prevents a prefix from masquerading
@@ -76,7 +76,7 @@ theorem le
 
 end QuotientAdmissionStep
 
-/-- The complete address-keyed analogue of Lean4Lean's four-step
+/-- The complete address-keyed analogue of Ix.Theory.Named's four-step
 `AddQuot1` chain. The final equality installs the quotient defeq only after
 all four exact constants have been added. -/
 def QuotientBundleAdmission
@@ -84,14 +84,14 @@ def QuotientBundleAdmission
     (trProj : RawProjRel) (prims : Primitives .anon)
     (before after : VEnv) : Prop :=
   QuotientAdmissionStep catalog nameOf trProj prims.quotType ``Quot
-    .type Lean4Lean.quotConst (before := before) fun env₁ =>
+    .type Ix.Theory.Named.quotConst (before := before) fun env₁ =>
   QuotientAdmissionStep catalog nameOf trProj prims.quotCtor ``Quot.mk
-    .ctor Lean4Lean.quotMkConst (before := env₁) fun env₂ =>
+    .ctor Ix.Theory.Named.quotMkConst (before := env₁) fun env₂ =>
   QuotientAdmissionStep catalog nameOf trProj prims.quotLift ``Quot.lift
-    .lift Lean4Lean.quotLiftConst (before := env₂) fun env₃ =>
+    .lift Ix.Theory.Named.quotLiftConst (before := env₂) fun env₃ =>
   QuotientAdmissionStep catalog nameOf trProj prims.quotInd ``Quot.ind
-    .ind Lean4Lean.quotIndConst (before := env₃) fun env₄ =>
-  env₄.addDefEq Lean4Lean.quotDefEq = after
+    .ind Ix.Theory.Named.quotIndConst (before := env₃) fun env₄ =>
+  env₄.addDefEq Ix.Theory.Named.quotDefEq = after
 
 /-- The complete semantic acceptance input: the pre-environment already has
 the canonical `Eq`, and the four-member Ix bundle follows the exact atomic
@@ -149,7 +149,7 @@ theorem nameAssignments
   obtain ⟨_, _, _, _, hind, _, _, _, h₄⟩ := h₃
   exact ⟨htype, hctor, hlift, hind⟩
 
-/-- A complete Ix bundle witness executes Lean4Lean's production-order
+/-- A complete Ix bundle witness executes Ix.Theory.Named's production-order
 `addQuot` operation exactly. -/
 theorem toAddQuot
     {catalog : Catalog} {nameOf : Address → Option Lean.Name}
@@ -195,7 +195,7 @@ theorem quotType
     {trProj : RawProjRel} {prims : Primitives .anon}
     {before after : VEnv}
     (h : QuotientBundleAdmission catalog nameOf trProj prims before after) :
-    after.constants ``Quot = some Lean4Lean.quotConst :=
+    after.constants ``Quot = some Ix.Theory.Named.quotConst :=
   VEnv.addQuot_quot h.toAddQuot
 
 /-- The completed bundle installs the exact quotient constructor. -/
@@ -204,7 +204,7 @@ theorem quotCtor
     {trProj : RawProjRel} {prims : Primitives .anon}
     {before after : VEnv}
     (h : QuotientBundleAdmission catalog nameOf trProj prims before after) :
-    after.constants ``Quot.mk = some Lean4Lean.quotMkConst :=
+    after.constants ``Quot.mk = some Ix.Theory.Named.quotMkConst :=
   VEnv.addQuot_quotMk h.toAddQuot
 
 /-- The completed bundle installs the exact computational eliminator. -/
@@ -213,7 +213,7 @@ theorem quotLift
     {trProj : RawProjRel} {prims : Primitives .anon}
     {before after : VEnv}
     (h : QuotientBundleAdmission catalog nameOf trProj prims before after) :
-    after.constants ``Quot.lift = some Lean4Lean.quotLiftConst :=
+    after.constants ``Quot.lift = some Ix.Theory.Named.quotLiftConst :=
   VEnv.addQuot_quotLift h.toAddQuot
 
 /-- The completed bundle installs the exact propositional eliminator. -/
@@ -222,7 +222,7 @@ theorem quotInd
     {trProj : RawProjRel} {prims : Primitives .anon}
     {before after : VEnv}
     (h : QuotientBundleAdmission catalog nameOf trProj prims before after) :
-    after.constants ``Quot.ind = some Lean4Lean.quotIndConst :=
+    after.constants ``Quot.ind = some Ix.Theory.Named.quotIndConst :=
   VEnv.addQuot_quotInd h.toAddQuot
 
 /-- The quotient reduction equation is available only after the entire
@@ -232,14 +232,14 @@ theorem quotientDefEq
     {trProj : RawProjRel} {prims : Primitives .anon}
     {before after : VEnv}
     (h : QuotientBundleAdmission catalog nameOf trProj prims before after) :
-    after.defeqs Lean4Lean.quotDefEq :=
+    after.defeqs Ix.Theory.Named.quotDefEq :=
   VEnv.addQuot_defeq h.toAddQuot
 
 end QuotientBundleAdmission
 
 namespace QuotientAdmission
 
-/-- The complete Ix-side witness constructs one Lean4Lean quotient
+/-- The complete Ix-side witness constructs one Ix.Theory.Named quotient
 declaration transition; no member can be promoted separately. -/
 theorem wf
     {catalog : Catalog} {nameOf : Address → Option Lean.Name}
@@ -260,4 +260,4 @@ theorem le
 
 end QuotientAdmission
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/QuotientBoundary.lean b/Ix/Kernel/Verify/Check/QuotientBoundary.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/QuotientBoundary.lean
rename to Ix/Kernel/Verify/Check/QuotientBoundary.lean
index 05206d38d..1ea1fb437 100644
--- a/Ix/Tc/Verify/Check/QuotientBoundary.lean
+++ b/Ix/Kernel/Verify/Check/QuotientBoundary.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Check.BlockClassification
-import Ix.Tc.Verify.Check.QuotientBridge
-import Ix.Tc.Verify.Check.StandaloneDriver
+import Ix.Kernel.Verify.Check.BlockClassification
+import Ix.Kernel.Verify.Check.QuotientBridge
+import Ix.Kernel.Verify.Check.StandaloneDriver
 
 /-!
 # Quotient checking is not a coordinated-block transaction
@@ -15,7 +15,7 @@ Quotient acceptance therefore uses the separate four-check atomic bridge; it
 never acquires inductive-oracle or block-cache authority through E0.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -103,4 +103,4 @@ theorem quotientRoute
 
 end StandaloneRoute
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/QuotientBridge.lean b/Ix/Kernel/Verify/Check/QuotientBridge.lean
similarity index 94%
rename from Ix/Tc/Verify/Check/QuotientBridge.lean
rename to Ix/Kernel/Verify/Check/QuotientBridge.lean
index a07efa63d..8f32fef69 100644
--- a/Ix/Tc/Verify/Check/QuotientBridge.lean
+++ b/Ix/Kernel/Verify/Check/QuotientBridge.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Check.QuotientAdmission
-import Ix.Tc.Verify.Whnf.RuntimeContracts
-import Ix.Tc.Check
+import Ix.Kernel.Verify.Check.QuotientAdmission
+import Ix.Kernel.Verify.Whnf.RuntimeContracts
+import Ix.Kernel.Check
 
 /-!
 # Production quotient bridge
@@ -13,9 +13,9 @@ collision hypothesis, and commits a completed `QuotientAdmission` as one
 trusted-log event.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VEnv)
+open Ix.Theory.Named (VEnv)
 
 namespace RecM
 
@@ -275,14 +275,14 @@ theorem quotIndLevels_eq
 
 end CheckedQuotientBundle
 
-/-! ## Lean4Lean semantic transaction input -/
+/-! ## Ix.Theory.Named semantic transaction input -/
 
 /-- Canonical semantic proposition for the transaction supplied by
-Lean4Lean's quotient-environment proof. This is deliberately independent of
+Ix.Theory.Named's quotient-environment proof. This is deliberately independent of
 the physical catalog: the production runs above establish that the four
 catalog types are these canonical expressions.
 
-Until Lean4Lean's `addQuot.WF` checker-closure theorem is constructive, callers
+Until Ix.Theory.Named's `addQuot.WF` checker-closure theorem is constructive, callers
 may carry this proposition as the narrow temporary assumption. Making it a
 `Prop` prevents the boundary from supplying executable data. The Ix bridge
 itself introduces no axiom and exposes every premise that the future upstream
@@ -296,39 +296,39 @@ inductive CanonicalQuotientSemanticTransaction
       (quotTypeName : nameOf prims.quotType.addr = some ``Quot)
       (quotTypeTranslated : TrKConstant .safe before nameOf trProj
         (.quot () () .type 1 (RecM.canonicalQuotType prims .type))
-        Lean4Lean.quotConst)
+        Ix.Theory.Named.quotConst)
       (quotTypeRaw : RawExprRel (uvars := 1) before nameOf trProj []
-        (RecM.canonicalQuotType prims .type) Lean4Lean.quotConst.type)
-      (addQuotType : before.addConst ``Quot Lean4Lean.quotConst = some env₁)
+        (RecM.canonicalQuotType prims .type) Ix.Theory.Named.quotConst.type)
+      (addQuotType : before.addConst ``Quot Ix.Theory.Named.quotConst = some env₁)
       (env₂ : VEnv)
       (quotCtorName : nameOf prims.quotCtor.addr = some ``Quot.mk)
       (quotCtorTranslated : TrKConstant .safe env₁ nameOf trProj
         (.quot () () .ctor 1 (RecM.canonicalQuotType prims .ctor))
-        Lean4Lean.quotMkConst)
+        Ix.Theory.Named.quotMkConst)
       (quotCtorRaw : RawExprRel (uvars := 1) env₁ nameOf trProj []
-        (RecM.canonicalQuotType prims .ctor) Lean4Lean.quotMkConst.type)
-      (addQuotCtor : env₁.addConst ``Quot.mk Lean4Lean.quotMkConst = some env₂)
+        (RecM.canonicalQuotType prims .ctor) Ix.Theory.Named.quotMkConst.type)
+      (addQuotCtor : env₁.addConst ``Quot.mk Ix.Theory.Named.quotMkConst = some env₂)
       (env₃ : VEnv)
       (quotLiftName : nameOf prims.quotLift.addr = some ``Quot.lift)
       (quotLiftTranslated : TrKConstant .safe env₂ nameOf trProj
         (.quot () () .lift 2 (RecM.canonicalQuotType prims .lift))
-        Lean4Lean.quotLiftConst)
+        Ix.Theory.Named.quotLiftConst)
       (quotLiftRaw : RawExprRel (uvars := 2) env₂ nameOf trProj []
-        (RecM.canonicalQuotType prims .lift) Lean4Lean.quotLiftConst.type)
-      (addQuotLift : env₂.addConst ``Quot.lift Lean4Lean.quotLiftConst = some env₃)
+        (RecM.canonicalQuotType prims .lift) Ix.Theory.Named.quotLiftConst.type)
+      (addQuotLift : env₂.addConst ``Quot.lift Ix.Theory.Named.quotLiftConst = some env₃)
       (env₄ : VEnv)
       (quotIndName : nameOf prims.quotInd.addr = some ``Quot.ind)
       (quotIndTranslated : TrKConstant .safe env₃ nameOf trProj
         (.quot () () .ind 1 (RecM.canonicalQuotType prims .ind))
-        Lean4Lean.quotIndConst)
+        Ix.Theory.Named.quotIndConst)
       (quotIndRaw : RawExprRel (uvars := 1) env₃ nameOf trProj []
-        (RecM.canonicalQuotType prims .ind) Lean4Lean.quotIndConst.type)
-      (addQuotInd : env₃.addConst ``Quot.ind Lean4Lean.quotIndConst = some env₄)
-      (final : env₄.addDefEq Lean4Lean.quotDefEq = after)
+        (RecM.canonicalQuotType prims .ind) Ix.Theory.Named.quotIndConst.type)
+      (addQuotInd : env₃.addConst ``Quot.ind Ix.Theory.Named.quotIndConst = some env₄)
+      (final : env₄.addDefEq Ix.Theory.Named.quotDefEq = after)
 
 namespace CheckedQuotientBundle
 
-/-- Combine four successful physical checks with the canonical Lean4Lean
+/-- Combine four successful physical checks with the canonical Ix.Theory.Named
 transaction. Production supplies exact roles, arities, and collision-safe
 types; the semantic input supplies the ordered `addQuot` meaning. -/
 theorem toAdmission
@@ -385,7 +385,7 @@ inductive QuotientMembers (prims : Primitives .anon) : KId .anon → Prop
 
 namespace QuotientAdmission
 
-/-- Replaying the single Lean4Lean quotient declaration after a well-formed
+/-- Replaying the single Ix.Theory.Named quotient declaration after a well-formed
 prefix produces a well-formed post-environment. -/
 theorem afterWF
     {catalog : Catalog} {nameOf : Address → Option Lean.Name}
@@ -582,7 +582,7 @@ theorem admittedStateWF
       intern := hstate.intern }
 
 /-- End-to-end quotient bridge: a coherent concrete/ghost state, four exact
-production runs, scoped collision freedom, freshness, and the Lean4Lean
+production runs, scoped collision freedom, freshness, and the Ix.Theory.Named
 semantic transaction yield one exact four-member promotion and one trusted-log
 event while preserving the checker-state invariant. -/
 theorem admitAtomically
@@ -607,4 +607,4 @@ theorem admitAtomically
 
 end CheckedQuotientBundle
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/RecursiveMethodPolicy.lean b/Ix/Kernel/Verify/Check/RecursiveMethodPolicy.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/RecursiveMethodPolicy.lean
rename to Ix/Kernel/Verify/Check/RecursiveMethodPolicy.lean
index 035fec191..573ed87c4 100644
--- a/Ix/Tc/Verify/Check/RecursiveMethodPolicy.lean
+++ b/Ix/Kernel/Verify/Check/RecursiveMethodPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.DefEqCachePolicy
+import Ix.Kernel.Verify.Check.DefEqCachePolicy
 
 /-!
 # Operational closure of the recursive method table
@@ -9,7 +9,7 @@ with the same six-field frame.  This is the non-circular one-layer theorem
 needed to close every finite `methodsN` approximation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -78,4 +78,4 @@ theorem methodsN_concrete_preservesInferOnly (depth : Nat) :
 
 end Methods
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ResetFrame.lean b/Ix/Kernel/Verify/Check/ResetFrame.lean
similarity index 97%
rename from Ix/Tc/Verify/Check/ResetFrame.lean
rename to Ix/Kernel/Verify/Check/ResetFrame.lean
index 7cd4e1bec..94f777c42 100644
--- a/Ix/Tc/Verify/Check/ResetFrame.lean
+++ b/Ix/Kernel/Verify/Check/ResetFrame.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.MemberEvidence
+import Ix.Kernel.Verify.Check.MemberEvidence
 
 /-!
 # Per-constant reset framing
@@ -9,7 +9,7 @@ local-context invariant while retaining the stable kernel/cache state needed
 by the fixed method table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -99,4 +99,4 @@ theorem reset_whnf_entry
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/SafetyFrame.lean b/Ix/Kernel/Verify/Check/SafetyFrame.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/SafetyFrame.lean
rename to Ix/Kernel/Verify/Check/SafetyFrame.lean
index a142a95f2..816416774 100644
--- a/Ix/Tc/Verify/Check/SafetyFrame.lean
+++ b/Ix/Kernel/Verify/Check/SafetyFrame.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.ValidatorFrame
+import Ix.Kernel.Verify.Check.ValidatorFrame
 
 /-!
 # State framing for the unsafe-reference traversal
@@ -9,7 +9,7 @@ state only through optional constant lookup.  Consequently every outcome
 preserves any invariant framed by the installed lazy-ingress hook.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -139,4 +139,4 @@ theorem checkNoUnsafeRefs_frame
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/Scoped.lean b/Ix/Kernel/Verify/Check/Scoped.lean
similarity index 89%
rename from Ix/Tc/Verify/Check/Scoped.lean
rename to Ix/Kernel/Verify/Check/Scoped.lean
index f40b095bb..9f4ced707 100644
--- a/Ix/Tc/Verify/Check/Scoped.lean
+++ b/Ix/Kernel/Verify/Check/Scoped.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Level
-import Ix.Tc.Verify.Totalization
+import Ix.Kernel.Verify.Level
+import Ix.Kernel.Verify.Totalization
+
+open Ix.Theory (VLevel)
 
 /-!
 # Successful well-scopedness validation
@@ -15,7 +17,7 @@ The operational proof below it is kept separate from typing; in particular,
 being admissible.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace KUniv
 
@@ -34,11 +36,11 @@ theorem scoped_iff_toVLevel_wf {u : KUniv m} {bound : Nat} :
     u.Scoped bound ↔ u.toVLevel.WF bound := by
   induction u with
   | zero => rfl
-  | succ u _ ih => simpa [Scoped, toVLevel, Lean4Lean.VLevel.WF] using ih
+  | succ u _ ih => simpa [Scoped, toVLevel, Ix.Theory.VLevel.WF] using ih
   | max a b _ iha ihb =>
-      simp only [Scoped, toVLevel, Lean4Lean.VLevel.WF, iha, ihb]
+      simp only [Scoped, toVLevel, Ix.Theory.VLevel.WF, iha, ihb]
   | imax a b _ iha ihb =>
-      simp only [Scoped, toVLevel, Lean4Lean.VLevel.WF, iha, ihb]
+      simp only [Scoped, toVLevel, Ix.Theory.VLevel.WF, iha, ihb]
   | param => rfl
 
 theorem Scoped.toVLevel_wf {u : KUniv m} {bound : Nat}
@@ -74,4 +76,4 @@ def Scoped (depth : UInt64) (levelBound : Nat) : KExpr m → Prop
 
 end KExpr
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ScopedActiveBlock.lean b/Ix/Kernel/Verify/Check/ScopedActiveBlock.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/ScopedActiveBlock.lean
rename to Ix/Kernel/Verify/Check/ScopedActiveBlock.lean
index 082219fde..4768295e6 100644
--- a/Ix/Tc/Verify/Check/ScopedActiveBlock.lean
+++ b/Ix/Kernel/Verify/Check/ScopedActiveBlock.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Check.BlockTransaction
-import Ix.Tc.Verify.Inductive.StructuralCacheSemantics
-import Ix.Tc.Verify.RecursiveMethods.ScopedInference
+import Ix.Kernel.Verify.Check.BlockTransaction
+import Ix.Kernel.Verify.Inductive.StructuralCacheSemantics
+import Ix.Kernel.Verify.RecursiveMethods.ScopedInference
 
 /-!
 # Run-scoped recursive methods inside an active coordinated block
@@ -18,7 +18,7 @@ WHNF, inference, or DefEq cache entries; that restriction remains enforced by
 can consume the active-member disjunct.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The complete K1/K2 state invariant while one exact coordinated block is
 active, refined by membership in a finite suffix-model state domain. -/
@@ -262,7 +262,7 @@ theorem isDefEq_eq_activeScoped_wf
     {support : RunSupport} {members : Array (KId .anon)}
     {Delta : KVLCtx} {state : TcState .anon}
     {left right : KExpr .anon}
-    {leftV rightV : Lean4Lean.VExpr}
+    {leftV rightV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world model.keys.uvars)
     (same : left = right)
     (leftTranslation : TrKExprS world.venv model.keys.uvars world.nameOf
@@ -296,7 +296,7 @@ theorem isDefEq_eq_activeScoped_wf
         leftTranslation rightTranslation _ answerTrue
       intro _
       exact ⟨leftV, leftV, leftTranslation, leftTranslation,
-        Lean4Lean.VEnv.IsDefEqU.refl
+        Ix.Theory.Named.VEnv.IsDefEqU.refl
           (theory.exprWF hI.context leftTranslation)⟩
 
 end RecM
@@ -384,4 +384,4 @@ theorem methodsOut_activeScopedWFAtOn
 
 end Methods
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ScopedBoundedPipelines.lean b/Ix/Kernel/Verify/Check/ScopedBoundedPipelines.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/ScopedBoundedPipelines.lean
rename to Ix/Kernel/Verify/Check/ScopedBoundedPipelines.lean
index ffdb5cf89..b81ed4d73 100644
--- a/Ix/Tc/Verify/Check/ScopedBoundedPipelines.lean
+++ b/Ix/Kernel/Verify/Check/ScopedBoundedPipelines.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.BoundedPipelines
-import Ix.Tc.Verify.RecursiveMethods.ScopedCallDomains
+import Ix.Kernel.Verify.Check.BoundedPipelines
+import Ix.Kernel.Verify.RecursiveMethods.ScopedCallDomains
 
 /-!
 # Run-scoped standalone-checker pipelines
@@ -9,7 +9,7 @@ every method callback.  It deliberately consumes `Methods.ScopedWFAtOn`
 directly and contains no conversion to the legacy global suffix model.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -21,7 +21,7 @@ def ScopedFullInferenceWFAtOn
     (support : RunSupport) (calls : CallDomain) (methods : Methods .anon) :
     Prop :=
   ∀ {Delta : KVLCtx} {s : TcState .anon}
-      {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+      {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
     calls.infer source →
     s.inferOnly = false →
     PreTrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
@@ -48,7 +48,7 @@ theorem ofTypedIngress
       (kernelCacheSemantics model.keys trProj) support calls methods)
     (policy : methods.PreservesInferOnly)
     (upgrade : ∀ {Delta : KVLCtx} {source : KExpr .anon}
-        {sourceV : Lean4Lean.VExpr},
+        {sourceV : Ix.Theory.Named.VExpr},
       calls.infer source →
       PreTrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
         sourceV →
@@ -104,13 +104,13 @@ structure ScopedStandalonePipelineResources
   valueInfer : ∀ {value declaredType},
     valueSources value declaredType → calls.infer value
   typeWhnf : ∀ {Delta : KVLCtx} {source : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {inferred : KExpr .anon},
+      {sourceV : Ix.Theory.Named.VExpr} {inferred : KExpr .anon},
     typeSources source →
     FullInferPost trProj world support model.keys.uvars Delta source sourceV
       inferred →
     calls.AdmitsEnsureSortDirect inferred
   valueDefEq : ∀ {Delta : KVLCtx} {value declaredType : KExpr .anon}
-      {valueV : Lean4Lean.VExpr} {inferred : KExpr .anon},
+      {valueV : Ix.Theory.Named.VExpr} {inferred : KExpr .anon},
     valueSources value declaredType →
     FullInferPost trProj world support model.keys.uvars Delta value valueV
       inferred →
@@ -176,7 +176,7 @@ private theorem ensureSortDirect_scopedWFAtOn
     {model : ScopedKernelSuffixModel trProj world}
     {support : RunSupport} {calls : Methods.CallDomain}
     {methods : Methods .anon} {Delta : KVLCtx} {s : TcState .anon}
-    {input : KExpr .anon} {inputV : Lean4Lean.VExpr}
+    {input : KExpr .anon} {inputV : Ix.Theory.Named.VExpr}
     (hmethods : Methods.ScopedWFAtOn model .noAccel
       (kernelCacheSemantics model.keys trProj) support calls
       (Methods.next methods))
@@ -239,7 +239,7 @@ theorem checkTypePipeline_scoped_sound
       (Methods.next methods))
     (hpolicyMethods : (Methods.next methods).PreservesInferOnly)
     {Delta : KVLCtx} {s after : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceCall : resources.typeSources source)
     (hsource : PreTrKExprS world.venv model.keys.uvars world.nameOf trProj
       Delta source sourceV)
@@ -330,7 +330,7 @@ theorem checkValuePipeline_scoped_sound
       (Methods.next methods))
     {Delta : KVLCtx} {s after : TcState .anon}
     {value declaredType : KExpr .anon}
-    {valueV declaredTypeV : Lean4Lean.VExpr}
+    {valueV declaredTypeV : Ix.Theory.Named.VExpr}
     (hvalueCall : resources.valueSources value declaredType)
     (hvalue : PreTrKExprS world.venv model.keys.uvars world.nameOf trProj
       Delta value valueV)
@@ -407,4 +407,4 @@ theorem checkValuePipeline_scoped_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ScopedMemberEvidence.lean b/Ix/Kernel/Verify/Check/ScopedMemberEvidence.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/ScopedMemberEvidence.lean
rename to Ix/Kernel/Verify/Check/ScopedMemberEvidence.lean
index d30735c47..450878f28 100644
--- a/Ix/Tc/Verify/Check/ScopedMemberEvidence.lean
+++ b/Ix/Kernel/Verify/Check/ScopedMemberEvidence.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Check.MemberEvidence
-import Ix.Tc.Verify.Check.ScopedBoundedPipelines
-import Ix.Tc.Verify.Check.SafetyFrame
+import Ix.Kernel.Verify.Check.MemberEvidence
+import Ix.Kernel.Verify.Check.ScopedBoundedPipelines
+import Ix.Kernel.Verify.Check.SafetyFrame
 
 /-!
 # Run-scoped evidence from standalone member checking
@@ -12,7 +12,7 @@ state carries the original model's `StateInScope` witness alongside the
 rebased checker invariant.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -79,7 +79,7 @@ theorem checkConstMember_axiom_scoped_sound
     {id : KId .anon} {name : Mode.anon.F Name}
     {levelParams : Mode.anon.F (Array Name)} {isUnsafe : Bool}
     {levels : UInt64} {type : KExpr .anon}
-    {typeV : Lean4Lean.VExpr}
+    {typeV : Ix.Theory.Named.VExpr}
     (hresources : StandaloneValidationResources support
       (.axio name levelParams isUnsafe levels type))
     (hsourceCall : context.typeSources type)
@@ -144,7 +144,7 @@ theorem checkConstMember_defn_scoped_sound
     {safety : Ix.DefinitionSafety} {hints : Lean.ReducibilityHints}
     {levels : UInt64} {type value : KExpr .anon}
     {leanAll : Mode.anon.F (Array (KId .anon))} {block : KId .anon}
-    {typeV valueV : Lean4Lean.VExpr}
+    {typeV valueV : Ix.Theory.Named.VExpr}
     (hresources : StandaloneValidationResources support
       (.defn name levelParams kind safety hints levels type value leanAll
         block))
@@ -319,7 +319,7 @@ theorem checkConstMember_scoped_sound
       (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hingress : PreDeclRel world.venv world.nameOf trProj id concrete decl)
     (hcovers : context.Covers concrete)
     (hresources : StandaloneValidationResources support concrete)
@@ -376,7 +376,7 @@ theorem checkConstMember_scoped_pending_sound
       (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -416,4 +416,4 @@ theorem checkConstMember_scoped_pending_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ScopedPositiveFuelAxiom.lean b/Ix/Kernel/Verify/Check/ScopedPositiveFuelAxiom.lean
similarity index 96%
rename from Ix/Tc/Verify/Check/ScopedPositiveFuelAxiom.lean
rename to Ix/Kernel/Verify/Check/ScopedPositiveFuelAxiom.lean
index bbc0a1d44..8fd04565e 100644
--- a/Ix/Tc/Verify/Check/ScopedPositiveFuelAxiom.lean
+++ b/Ix/Kernel/Verify/Check/ScopedPositiveFuelAxiom.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.PositiveFuelSort
-import Ix.Tc.Verify.Check.PublicStandalone
+import Ix.Kernel.Verify.Check.PositiveFuelSort
+import Ix.Kernel.Verify.Check.PublicStandalone
 
 /-!
 # Executed positive-fuel checker over a finite suffix model
@@ -10,7 +10,7 @@ closed eager states; the method schedule admits exactly the one sort
 inference performed by the checker.
 -/
 
-namespace Ix.Tc.PositiveFuelSort.Checker
+namespace Ix.Kernel.PositiveFuelSort.Checker
 
 open PositiveFuelSort
 
@@ -18,7 +18,7 @@ def targetAddress : Address :=
   ⟨⟨Array.replicate 32 (37 : UInt8)⟩⟩
 
 def targetId : KId .anon := ⟨targetAddress, ()⟩
-def targetName : Lean.Name := `Ix.Tc.Verify.positiveFuelSortAxiom
+def targetName : Lean.Name := `Ix.Kernel.Verify.positiveFuelSortAxiom
 
 def catalog : Catalog := fun id =>
   if id == targetId then some concreteAxiom else none
@@ -39,7 +39,7 @@ def world : VerifyWorld where
     world.nameOf targetId.addr = some targetName := by
   simp [world, targetId]
 
-def declaration : Lean4Lean.VDecl :=
+def declaration : Ix.Theory.Named.VDecl :=
   .axiom { name := targetName, uvars := 0, type := .sort .zero }
 
 theorem rawDeclaration :
@@ -58,7 +58,7 @@ theorem pending :
     rw [hsource] at href
     simp [KExpr.References] at href
   · intro name hname
-    change Lean4Lean.VEnv.empty.constants name = none
+    change Ix.Theory.Named.VEnv.empty.constants name = none
     rfl
 
 def env : KEnv .anon :=
@@ -134,8 +134,8 @@ def theory : WhnfTheory RawProjRel.none world model.keys.uvars where
   literalWF := by
     intro literal hliteral
     cases literal <;>
-      simp [world, Lean4Lean.VEnv.ContainsLits,
-        Lean4Lean.VEnv.contains, Lean4Lean.VEnv.empty] at hliteral
+      simp [world, Ix.Theory.Named.VEnv.ContainsLits,
+        Ix.Theory.Named.VEnv.contains, Ix.Theory.Named.VEnv.empty] at hliteral
   projections := RawProjRel.none_ok world.venv model.keys.uvars
 
 theorem trustedReferences : RecM.TrustedReferences world support := by
@@ -155,14 +155,14 @@ theorem methodContract (separation : AddressSeparation) :
     Methods.ScopedWFAtOn model .noAccel
       (kernelCacheSemantics model.keys RawProjRel.none) support
       (.singletonInfer source)
-      (Methods.next (Ix.Tc.methodsN (m := .anon) 1)) := by
+      (Methods.next (Ix.Kernel.methodsN (m := .anon) 1)) := by
   simpa [Methods.ScopedSortSchedule.calls] using
     (schedule separation).nextSelected
 
 theorem fullInference (separation : AddressSeparation) :
     Methods.ScopedFullInferenceWFAtOn model support
       (.singletonInfer source)
-      (Methods.next (Ix.Tc.methodsN (m := .anon) 1)) :=
+      (Methods.next (Ix.Kernel.methodsN (m := .anon) 1)) :=
   Methods.ScopedFullInferenceWFAtOn.ofSingletonSort
     (methodContract separation)
     (Methods.next_preservesInferOnly _
@@ -170,7 +170,7 @@ theorem fullInference (separation : AddressSeparation) :
 
 def pipelines (separation : AddressSeparation) :
     ScopedStandalonePipelineResources model support
-      (.singletonInfer source) (Ix.Tc.methodsN (m := .anon) 1) :=
+      (.singletonInfer source) (Ix.Kernel.methodsN (m := .anon) 1) :=
   ScopedStandalonePipelineResources.singletonSortAxiom
     (fullInference separation) sortResources supported_is_sort
 
@@ -197,7 +197,7 @@ theorem validationResources :
 
 /-! ## Exact production execution -/
 
-def methods : Methods .anon := Ix.Tc.methodsN 1
+def methods : Methods .anon := Ix.Kernel.methodsN 1
 
 theorem initial_loaded :
     initialState.env.get? targetId = some concreteAxiom := by
@@ -487,4 +487,4 @@ theorem checked_and_promoted (separation : AddressSeparation) :
     hevidence.1.1.rebaseWorld hpromotes.1 hcore,
     hevidence.1.2, htrusted⟩
 
-end Ix.Tc.PositiveFuelSort.Checker
+end Ix.Kernel.PositiveFuelSort.Checker
diff --git a/Ix/Tc/Verify/Check/ScopedPositiveFuelCertificate.lean b/Ix/Kernel/Verify/Check/ScopedPositiveFuelCertificate.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/ScopedPositiveFuelCertificate.lean
rename to Ix/Kernel/Verify/Check/ScopedPositiveFuelCertificate.lean
index b9060b27e..bb9f4a65c 100644
--- a/Ix/Tc/Verify/Check/ScopedPositiveFuelCertificate.lean
+++ b/Ix/Kernel/Verify/Check/ScopedPositiveFuelCertificate.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.ScopedPositiveFuelAxiom
+import Ix.Kernel.Verify.Check.ScopedPositiveFuelAxiom
 
 /-!
 # Execution certificate for the scoped positive-fuel checker
@@ -9,7 +9,7 @@ operation; reset, validation, lookup, routing, and cache insertion are
 certified silent steps.
 -/
 
-namespace Ix.Tc.PositiveFuelSort.Checker
+namespace Ix.Kernel.PositiveFuelSort.Checker
 
 theorem tryGetConst_requests_of_loaded
     {state : TcState .anon} {id : KId .anon} {constant : KConst .anon}
@@ -312,4 +312,4 @@ def publicContext (separation : AddressSeparation) :
   schedule := by
     simpa [initialState] using schedule separation
 
-end Ix.Tc.PositiveFuelSort.Checker
+end Ix.Kernel.PositiveFuelSort.Checker
diff --git a/Ix/Tc/Verify/Check/ScopedStandaloneDriver.lean b/Ix/Kernel/Verify/Check/ScopedStandaloneDriver.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/ScopedStandaloneDriver.lean
rename to Ix/Kernel/Verify/Check/ScopedStandaloneDriver.lean
index adbeeccf0..14df5a649 100644
--- a/Ix/Tc/Verify/Check/ScopedStandaloneDriver.lean
+++ b/Ix/Kernel/Verify/Check/ScopedStandaloneDriver.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.ScopedMemberEvidence
-import Ix.Tc.Verify.Check.StandaloneDriver
+import Ix.Kernel.Verify.Check.ScopedMemberEvidence
+import Ix.Kernel.Verify.Check.StandaloneDriver
 
 /-!
 # Run-scoped standalone per-constant driver
@@ -11,7 +11,7 @@ frame theorem.  Its effect on a suffix model's chosen state domain is
 therefore exposed as a small, explicit contract.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -30,7 +30,7 @@ theorem checkConstMemberFresh_scoped_pending_evidence
       (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -113,7 +113,7 @@ theorem checkConstMemberFresh_scoped_pending_sound
       (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -195,7 +195,7 @@ theorem checkConst_standalone_scoped_pending_sound
       (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -259,4 +259,4 @@ theorem checkConst_standalone_scoped_pending_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/SingletonInductive.lean b/Ix/Kernel/Verify/Check/SingletonInductive.lean
similarity index 92%
rename from Ix/Tc/Verify/Check/SingletonInductive.lean
rename to Ix/Kernel/Verify/Check/SingletonInductive.lean
index 3e8f38327..4e0679e3c 100644
--- a/Ix/Tc/Verify/Check/SingletonInductive.lean
+++ b/Ix/Kernel/Verify/Check/SingletonInductive.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Check.BlockOracle
-import Ix.Tc.Verify.Inductive.IngressExecution
-import Ix.Tc.Verify.Inductive.SingletonIngress
-import Ix.Tc.Verify.Inductive.SingletonOracle
+import Ix.Kernel.Verify.Check.BlockOracle
+import Ix.Kernel.Verify.Inductive.IngressExecution
+import Ix.Kernel.Verify.Inductive.SingletonIngress
+import Ix.Kernel.Verify.Inductive.SingletonOracle
 
 /-!
 # Certificate-backed singleton family blocks
@@ -17,7 +17,7 @@ certifies that block with the enumeration oracle built from its registered
 generated equations.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace SingletonFamilyCatalogLink
 
@@ -26,7 +26,7 @@ for an E0 inductive-block trace. -/
 def blockResources
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     (link : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx)
@@ -49,7 +49,7 @@ one-member production recursor block. -/
 def blockResources
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {family : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx}
@@ -76,7 +76,7 @@ combining E0's exact trace with E2a/E2b's exact catalog link. -/
 theorem certifySingletonFamilyBlock
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     (link : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx)
@@ -95,7 +95,7 @@ combining E0's exact trace with E2a/E2b's generated-rule correspondence. -/
 theorem certifySingletonRecursorBlock
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {family : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx}
@@ -123,7 +123,7 @@ before the family exists semantically. -/
 theorem certifySingletonFamilyBlockPostAdmission
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     (link : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx)
@@ -144,7 +144,7 @@ theorem certifySingletonFamilyBlockPostAdmission
 theorem certifySingletonRecursorBlockPostAdmission
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {family : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx}
@@ -174,7 +174,7 @@ trace prove that none of the linked addresses was already admitted. -/
 theorem certifySingletonFamilyIngressBlock
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {block requested : KId .anon} {before after : TcState .anon}
     (view : SingletonFamilyIngressView trProj after.env world.nameOf tx)
@@ -191,12 +191,12 @@ theorem certifySingletonFamilyIngressBlock
 
 /-- Certify an actual successful singleton recursor block from the recursor
 entry loaded in its production post-state.  The preceding family link fixes
-the constructor order used by both the Ix rule array and Lean4Lean's
+the constructor order used by both the Ix rule array and Ix.Theory.Named's
 generated equations. -/
 theorem certifySingletonRecursorIngressBlock
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {family : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx}
@@ -225,7 +225,7 @@ trace, loaded-catalog invariant, trusted log, and E2a transaction. -/
 theorem certifySingletonFamilyIngressExecution
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {ixonEnv : Ixon.Env} {blockConstant : Ixon.Constant}
     {blockAddr : Address} {ingressBefore ingressAfter : AnonEnv}
@@ -260,7 +260,7 @@ the supported enumeration shape. -/
 theorem certifySingletonRecursorIngressExecution
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {methods : Methods .anon}
-    {source : Lean4Lean.VInductDecl} {theoryAfter : Lean4Lean.VEnv}
+    {source : Ix.Theory.Named.VInductDecl} {theoryAfter : Ix.Theory.Named.VEnv}
     {tx : CertifiedGenerationTransaction source world.venv theoryAfter}
     {family : SingletonFamilyCatalogLink trProj world.catalog world.nameOf
       world.trusted tx}
@@ -294,4 +294,4 @@ theorem certifySingletonRecursorIngressExecution
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/StandaloneDriver.lean b/Ix/Kernel/Verify/Check/StandaloneDriver.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/StandaloneDriver.lean
rename to Ix/Kernel/Verify/Check/StandaloneDriver.lean
index c47ac7633..5e4f707c1 100644
--- a/Ix/Tc/Verify/Check/StandaloneDriver.lean
+++ b/Ix/Kernel/Verify/Check/StandaloneDriver.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.ResetFrame
+import Ix.Kernel.Verify.Check.ResetFrame
 
 /-!
 # Standalone per-constant driver
@@ -10,7 +10,7 @@ catalog agreement proof prevents a successful lazy lookup from silently
 changing which pending declaration is certified.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Operational boundary separating K3 standalone checking from E0 block
 coordination.  The exact production router must preserve the checker
@@ -55,7 +55,7 @@ theorem checkConstMemberFresh_pending_sound
       model.keys.uvars calls (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -136,7 +136,7 @@ theorem checkConstMemberFresh_pending_evidence
       model.keys.uvars calls (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -219,7 +219,7 @@ theorem checkConst_standalone_pending_sound
       model.keys.uvars calls (Methods.next methods))
     (hmethodPolicy : (Methods.next methods).PreservesInferOnly)
     {id : KId .anon} {concrete : KConst .anon}
-    {decl : Lean4Lean.VDecl}
+    {decl : Ix.Theory.Named.VDecl}
     (hprojection : trProj.SubstCompatible)
     (hliterals : ∀ literal, world.venv.ContainsLits literal)
     (hpending : PendingDecl trProj world id decl)
@@ -283,4 +283,4 @@ theorem checkConst_standalone_pending_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/UncachedInferencePolicy.lean b/Ix/Kernel/Verify/Check/UncachedInferencePolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/UncachedInferencePolicy.lean
rename to Ix/Kernel/Verify/Check/UncachedInferencePolicy.lean
index 047063dab..899d59afc 100644
--- a/Ix/Tc/Verify/Check/UncachedInferencePolicy.lean
+++ b/Ix/Kernel/Verify/Check/UncachedInferencePolicy.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.UniverseInstantiationPolicy
-import Ix.Tc.Verify.Check.FullInferenceProjections
+import Ix.Kernel.Verify.Check.UniverseInstantiationPolicy
+import Ix.Kernel.Verify.Check.FullInferenceProjections
 
 /-!
 # Operational policy for uncached inference
@@ -16,7 +16,7 @@ last premise needed to feed this theorem into the already verified inference
 cache shell.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -286,4 +286,4 @@ theorem inferUncached_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/UniverseInstantiationPolicy.lean b/Ix/Kernel/Verify/Check/UniverseInstantiationPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/UniverseInstantiationPolicy.lean
rename to Ix/Kernel/Verify/Check/UniverseInstantiationPolicy.lean
index 32b2c7e55..5fde07bc6 100644
--- a/Ix/Tc/Verify/Check/UniverseInstantiationPolicy.lean
+++ b/Ix/Kernel/Verify/Check/UniverseInstantiationPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.InferencePolicy
+import Ix.Kernel.Verify.Check.InferencePolicy
 
 /-!
 # Inference-policy frame for universe instantiation
@@ -15,7 +15,7 @@ constant-universe array loop, recursive child failures, interning, and memo
 writes on both outcomes.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM.PreservesInferOnly
 
@@ -277,4 +277,4 @@ theorem instantiateUnivParams (e : KExpr .anon)
 
 end TcM.PreservesInferOnly
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ValidationReach.lean b/Ix/Kernel/Verify/Check/ValidationReach.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/ValidationReach.lean
rename to Ix/Kernel/Verify/Check/ValidationReach.lean
index 23181e518..956aeddce 100644
--- a/Ix/Tc/Verify/Check/ValidationReach.lean
+++ b/Ix/Kernel/Verify/Check/ValidationReach.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.Scoped
-import Ix.Tc.Verify.Support
+import Ix.Kernel.Verify.Check.Scoped
+import Ix.Kernel.Verify.Support
 
 /-!
 # Finite syntax support for well-scopedness validation
@@ -15,7 +15,7 @@ connects their finite footprints to an existing `RunSupport`, whose separate
 `CollisionFree` field is consumed by the operational proof.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace KUniv
 
@@ -404,4 +404,4 @@ end ValidationCoverage
 
 end KExpr
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ValidatorFrame.lean b/Ix/Kernel/Verify/Check/ValidatorFrame.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/ValidatorFrame.lean
rename to Ix/Kernel/Verify/Check/ValidatorFrame.lean
index dc4b37e0d..adee2bc3b 100644
--- a/Ix/Tc/Verify/Check/ValidatorFrame.lean
+++ b/Ix/Kernel/Verify/Check/ValidatorFrame.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.DeclarationValidation
-import Ix.Tc.Verify.Whnf.RuntimeContracts
+import Ix.Kernel.Verify.Check.DeclarationValidation
+import Ix.Kernel.Verify.Whnf.RuntimeContracts
 
 /-!
 # State framing for the scoping validators
@@ -11,7 +11,7 @@ starts.  This module proves that every validator outcome preserves an
 arbitrary state invariant whose installed lazy-fault hook preserves it.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -314,4 +314,4 @@ theorem validateConstWellScoped_frame
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/ValidatorSoundness.lean b/Ix/Kernel/Verify/Check/ValidatorSoundness.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/ValidatorSoundness.lean
rename to Ix/Kernel/Verify/Check/ValidatorSoundness.lean
index 9b23fd76e..259f94b5b 100644
--- a/Ix/Tc/Verify/Check/ValidatorSoundness.lean
+++ b/Ix/Kernel/Verify/Check/ValidatorSoundness.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.ValidationReach
+import Ix.Kernel.Verify.Check.ValidationReach
 
 /-!
 # Soundness of the address-memoized scoping validators
@@ -16,7 +16,7 @@ local guards imply full structural scoping.  Address equality is converted
 to syntax equality only through finite-run collision freedom.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashSet)
 
@@ -1220,4 +1220,4 @@ theorem validateExprWellScoped_sound
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfBasicHelperPolicy.lean b/Ix/Kernel/Verify/Check/WhnfBasicHelperPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfBasicHelperPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfBasicHelperPolicy.lean
index 75c10e05c..b09951b81 100644
--- a/Ix/Tc/Verify/Check/WhnfBasicHelperPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfBasicHelperPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfReductionPolicy
+import Ix.Kernel.Verify.Check.WhnfReductionPolicy
 
 /-!
 # Operational policy for non-recursive WHNF helpers
@@ -11,7 +11,7 @@ application-finisher components rather than retained as an independent
 assumption.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -455,4 +455,4 @@ theorem tryQuotReduce_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfBitVecPolicy.lean b/Ix/Kernel/Verify/Check/WhnfBitVecPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfBitVecPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfBitVecPolicy.lean
index c161a1354..19fdef3c7 100644
--- a/Ix/Tc/Verify/Check/WhnfBitVecPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfBitVecPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfNatPolicy
+import Ix.Kernel.Verify.Check.WhnfNatPolicy
 
 /-!
 # Operational inference-policy frame for BitVec reduction
@@ -9,7 +9,7 @@ pipeline.  All recursive WHNF calls, fallback paths, and rebuilt applications
 restore the caller's inference policy.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -489,4 +489,4 @@ theorem tryReduceBitvec_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfDecidablePolicy.lean b/Ix/Kernel/Verify/Check/WhnfDecidablePolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfDecidablePolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfDecidablePolicy.lean
index c3a07dc68..acb0d2b37 100644
--- a/Ix/Tc/Verify/Check/WhnfDecidablePolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfDecidablePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfBitVecPolicy
+import Ix.Kernel.Verify.Check.WhnfBitVecPolicy
 
 /-!
 # Operational inference-policy frame for decidability reduction
@@ -9,7 +9,7 @@ recursive type normalization, canonical proof-term interning, application
 rebuilding, and every accelerator fallback.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -348,4 +348,4 @@ theorem tryReduceDecidable_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfDriverPolicy.lean b/Ix/Kernel/Verify/Check/WhnfDriverPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfDriverPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfDriverPolicy.lean
index a82b59ff0..2736c89b0 100644
--- a/Ix/Tc/Verify/Check/WhnfDriverPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfDriverPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.ProjectionInferencePolicy
+import Ix.Kernel.Verify.Check.ProjectionInferencePolicy
 
 /-!
 # Operational inference-policy frame for WHNF drivers
@@ -14,7 +14,7 @@ individual structural, no-delta, and full-WHNF helper seams; this file ensures
 that no additional policy obligation is hidden in the outer drivers.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -547,4 +547,4 @@ theorem whnf_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfHelperPolicy.lean b/Ix/Kernel/Verify/Check/WhnfHelperPolicy.lean
similarity index 95%
rename from Ix/Tc/Verify/Check/WhnfHelperPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfHelperPolicy.lean
index 28c3653c2..0a97dcae8 100644
--- a/Ix/Tc/Verify/Check/WhnfHelperPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfHelperPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfIotaDispatchPolicy
+import Ix.Kernel.Verify.Check.WhnfIotaDispatchPolicy
 
 /-!
 # Concrete operational policy for every WHNF helper
@@ -10,7 +10,7 @@ quotient reduction, and delta unfolding are all tied to their concrete
 implementations under one fixed predecessor method table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -41,4 +41,4 @@ def concreteWhnfReductionPolicy
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfIotaBasePolicy.lean b/Ix/Kernel/Verify/Check/WhnfIotaBasePolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfIotaBasePolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfIotaBasePolicy.lean
index 5b085de0c..5d4762dca 100644
--- a/Ix/Tc/Verify/Check/WhnfIotaBasePolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfIotaBasePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfDecidablePolicy
+import Ix.Kernel.Verify.Check.WhnfDecidablePolicy
 
 /-!
 # Operational inference-policy frame for iota rule execution
@@ -10,7 +10,7 @@ workers are proved together over their shared fuel, so their production
 fallback behavior remains explicit.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -283,4 +283,4 @@ theorem cleanupNatOffsetMajor_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfIotaDispatchPolicy.lean b/Ix/Kernel/Verify/Check/WhnfIotaDispatchPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfIotaDispatchPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfIotaDispatchPolicy.lean
index 989acfbce..a59f178d5 100644
--- a/Ix/Tc/Verify/Check/WhnfIotaDispatchPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfIotaDispatchPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfIotaSynthesisPolicy
+import Ix.Kernel.Verify.Check.WhnfIotaSynthesisPolicy
 
 /-!
 # Operational inference-policy frame for complete iota dispatch
@@ -10,7 +10,7 @@ major normalization.  Its public theorem covers every branch of production
 the WHNF reducer frame.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 
@@ -267,4 +267,4 @@ theorem tryIotaWithFlags_preservesInferOnly
       exact TcM.PreservesInferOnly.pure none
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfIotaRecursionPolicy.lean b/Ix/Kernel/Verify/Check/WhnfIotaRecursionPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfIotaRecursionPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfIotaRecursionPolicy.lean
index 15597b74f..4af485247 100644
--- a/Ix/Tc/Verify/Check/WhnfIotaRecursionPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfIotaRecursionPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfIotaScopePolicy
+import Ix.Kernel.Verify.Check.WhnfIotaScopePolicy
 
 /-!
 # Operational inference-policy frame for iota recursion classification
@@ -9,7 +9,7 @@ bounded field scanning, legacy-context restoration, provisional and final
 cache writes, and cleanup of the provisional entry on classifier errors.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -309,4 +309,4 @@ theorem computedIsRec_preservesInferOnly
           exact TcM.PreservesInferOnly.throw _
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfIotaScopePolicy.lean b/Ix/Kernel/Verify/Check/WhnfIotaScopePolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/WhnfIotaScopePolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfIotaScopePolicy.lean
index d9edfcdb4..acf05e7da 100644
--- a/Ix/Tc/Verify/Check/WhnfIotaScopePolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfIotaScopePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfIotaBasePolicy
+import Ix.Kernel.Verify.Check.WhnfIotaBasePolicy
 
 /-!
 # Operational inference-policy frame for scoped iota callbacks
@@ -9,7 +9,7 @@ restoration.  These are the scoped callback primitives shared by struct eta
 and K-like constructor synthesis.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 
 namespace TcM.PreservesInferOnly
@@ -186,4 +186,4 @@ theorem getMajorInductiveId_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfIotaSynthesisPolicy.lean b/Ix/Kernel/Verify/Check/WhnfIotaSynthesisPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfIotaSynthesisPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfIotaSynthesisPolicy.lean
index 120274ae3..6a5d68ef9 100644
--- a/Ix/Tc/Verify/Check/WhnfIotaSynthesisPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfIotaSynthesisPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfIotaRecursionPolicy
+import Ix.Kernel.Verify.Check.WhnfIotaRecursionPolicy
 
 /-!
 # Operational inference-policy frame for struct eta and K synthesis
@@ -10,7 +10,7 @@ inference and WHNF probes, universe instantiation, projection rebuilding,
 DefEq validation, and synthesis statistics on acceptance and rejection.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 
@@ -351,4 +351,4 @@ theorem synthCtorWhenK_preservesInferOnly
                 exact TcM.PreservesInferOnly.pure KSynthOutcome.inconclusive
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfNatArgumentPolicy.lean b/Ix/Kernel/Verify/Check/WhnfNatArgumentPolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/WhnfNatArgumentPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfNatArgumentPolicy.lean
index 6727156cd..3e24dd2d1 100644
--- a/Ix/Tc/Verify/Check/WhnfNatArgumentPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfNatArgumentPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfProjectionPolicy
+import Ix.Kernel.Verify.Check.WhnfProjectionPolicy
 
 /-!
 # Operational policy for Nat argument normalization and stuck offsets
@@ -9,7 +9,7 @@ successful callbacks, caught exhaustion, and propagated errors.  It then
 closes the complete `tryNatOffsetStuck` classifier and rebuild path.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -166,4 +166,4 @@ theorem tryNatOffsetStuck_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfNatPolicy.lean b/Ix/Kernel/Verify/Check/WhnfNatPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfNatPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfNatPolicy.lean
index 98ec1977c..1f2de24c9 100644
--- a/Ix/Tc/Verify/Check/WhnfNatPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfNatPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfNativePolicy
+import Ix.Kernel.Verify.Check.WhnfNativePolicy
 
 /-!
 # Operational inference-policy frame for native Nat reduction
@@ -9,7 +9,7 @@ memo, callback and partial-error paths, local Nat-argument fuel, interning,
 and application rebuilding.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -456,4 +456,4 @@ theorem tryReduceNatWithSuccMode_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfNativePolicy.lean b/Ix/Kernel/Verify/Check/WhnfNativePolicy.lean
similarity index 98%
rename from Ix/Tc/Verify/Check/WhnfNativePolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfNativePolicy.lean
index 8a15b3e73..f98686d59 100644
--- a/Ix/Tc/Verify/Check/WhnfNativePolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfNativePolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfNatArgumentPolicy
+import Ix.Kernel.Verify.Check.WhnfNatArgumentPolicy
 
 /-!
 # Operational inference-policy frame for native WHNF reduction
@@ -9,7 +9,7 @@ then owns lazy declaration lookup, universe instantiation, the recursive WHNF
 callback, and restoration of the re-entrancy guard on both outcomes.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -125,4 +125,4 @@ theorem tryReduceNative_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfProjectionPolicy.lean b/Ix/Kernel/Verify/Check/WhnfProjectionPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfProjectionPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfProjectionPolicy.lean
index 21b1fb210..2a9d880af 100644
--- a/Ix/Tc/Verify/Check/WhnfProjectionPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfProjectionPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfBasicHelperPolicy
+import Ix.Kernel.Verify.Check.WhnfBasicHelperPolicy
 
 /-!
 # Operational policy for WHNF projection reduction
@@ -10,7 +10,7 @@ intern operation, lazy constructor lookup, recursive WHNF callback, miss,
 and partial error is covered.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -269,4 +269,4 @@ theorem tryProjReduce_preservesInferOnly
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Check/WhnfReductionPolicy.lean b/Ix/Kernel/Verify/Check/WhnfReductionPolicy.lean
similarity index 99%
rename from Ix/Tc/Verify/Check/WhnfReductionPolicy.lean
rename to Ix/Kernel/Verify/Check/WhnfReductionPolicy.lean
index 5e5696d7d..cfa4705f0 100644
--- a/Ix/Tc/Verify/Check/WhnfReductionPolicy.lean
+++ b/Ix/Kernel/Verify/Check/WhnfReductionPolicy.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.WhnfDriverPolicy
+import Ix.Kernel.Verify.Check.WhnfDriverPolicy
 
 /-!
 # Operational inference-policy frame for WHNF reduction steps
@@ -13,7 +13,7 @@ helper fields are discharged, `reductionPolicy` supplies the complete step
 contract consumed by `WhnfDriverPolicy`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -593,4 +593,4 @@ def WhnfHelperPolicyAt.reductionPolicy
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Kernel/Verify/Consistency.lean b/Ix/Kernel/Verify/Consistency.lean
new file mode 100644
index 000000000..c00dfe950
--- /dev/null
+++ b/Ix/Kernel/Verify/Consistency.lean
@@ -0,0 +1,19 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Verify.Consistency.Level
+import Ix.Kernel.Verify.Consistency.Expr
+import Ix.Kernel.Verify.Consistency.Judgment
+import Ix.Kernel.Verify.Consistency.Infer
+import Ix.Kernel.Verify.Consistency.Audit
+
+/-!
+# Refinement into the set-theoretic consistency model
+
+This library connects production kernel operations to `Ix.Theory`. Each
+transport keeps its representation, arithmetic, and dependency assumptions
+explicit. The component theorems are distinct from a full soundness theorem
+for `checkEnvAnon`.
+-/
diff --git a/Ix/Kernel/Verify/Consistency/Audit.lean b/Ix/Kernel/Verify/Consistency/Audit.lean
new file mode 100644
index 000000000..9fc86756d
--- /dev/null
+++ b/Ix/Kernel/Verify/Consistency/Audit.lean
@@ -0,0 +1,51 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Verify.Consistency.Infer
+import Ix.Kernel.Verify.Audit.Basic
+
+/-! Exact full-dependency boundaries for the direct model-refinement roots.
+No root permits proof holes, implementation bridge axioms, or pending
+metatheory axioms. Native assumptions are enumerated only where a production
+smart constructor or dispatcher still contains a generated native proof. -/
+
+namespace Ix.Kernel.Consistency.Audit
+
+open Kernel.Verify.Audit
+
+private def standard : Array Lean.Name := #[``propext, ``Classical.choice, ``Quot.sound]
+private def levelNative : Lean.Name :=
+  nativeAxiom `Ix.Kernel.Level `Ix.Kernel.KUniv.mkSucc._native.native_decide.ax_1
+private def expressionNative : Lean.Name :=
+  nativeAxiom `Ix.Kernel.Expr `Ix.Kernel.KExpr.mkVar._native.native_decide.ax_1
+
+def roots : Array RootAllowance := #[
+  { root := ``readLevel_eq, standardAxioms := #[``propext] },
+  { root := ``readLevel_eval, standardAxioms := #[``propext] },
+  { root := ``readLevel_wf, standardAxioms := #[``propext] },
+  { root := ``readLevel_eraseMeta, standardAxioms := #[``propext] },
+  { root := ``readLevel_mkSucc, standardAxioms := #[``propext, ``Classical.choice],
+    nativeAxioms := #[levelNative] },
+  { root := ``univEq_sound, standardAxioms := standard },
+  { root := ``univGeq_sound, standardAxioms := standard },
+  { root := ``readExpr?_mkSort, standardAxioms := standard,
+    nativeAxioms := #[expressionNative] },
+  { root := ``readExpr?_eraseMeta, standardAxioms := #[``propext, ``Quot.sound] },
+  { root := ``beq_readExpr?, standardAxioms := #[``propext, ``Quot.sound] },
+  { root := ``internExpr_readExpr?, standardAxioms := #[``propext, ``Quot.sound] },
+  { root := ``ModelTyping.sort, standardAxioms := standard,
+    nativeAxioms := #[expressionNative, levelNative] },
+  { root := ``ModelTyping.of_beq, standardAxioms := standard },
+  { root := ``ModelTyping.internExpr, standardAxioms := standard },
+  { root := ``ModelTyping.internType, standardAxioms := standard },
+  { root := ``ModelTyping.no_false, standardAxioms := standard },
+  { root := ``sort_conversion, standardAxioms := standard },
+  { root := ``inferUncached_sort_sound, standardAxioms := standard,
+    nativeAxioms := #[expressionNative, levelNative] }
+]
+
+run_cmd Kernel.Verify.Audit.check roots
+
+end Ix.Kernel.Consistency.Audit
diff --git a/Ix/Kernel/Verify/Consistency/Expr.lean b/Ix/Kernel/Verify/Consistency/Expr.lean
new file mode 100644
index 000000000..2166660f7
--- /dev/null
+++ b/Ix/Kernel/Verify/Consistency/Expr.lean
@@ -0,0 +1,88 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Verify.Consistency.Level
+import Ix.Kernel.Verify.Expr
+import Ix.Theory.Expr
+
+/-!
+# Reading kernel expressions into the consistency model
+
+References are resolved to explicit block/member/constructor coordinates.
+The reader uses the expression tree, not cached hashes or scope annotations.
+It preserves projections and natural literals, and expands a let by
+capture-avoiding substitution. Free variables, unresolved references, and
+string literals have no reading in this initial fragment.
+
+The theorems below connect the production hash-equality fast path and intern
+table to this reading. Their finite-support collision hypotheses are retained;
+no global hash-injectivity assumption is introduced.
+-/
+
+namespace Ix.Kernel.Consistency
+
+universe u
+variable {β : Type u} {m : Mode}
+
+/-- A structural reading into the new theory. The reference resolver will be
+supplied by the declaration/store refinement; an unknown address fails. -/
+def readExpr? (resolve : Address → Option (Theory.ConstRef β)) :
+    KExpr m → Option (Theory.VExpr β)
+  | .var index _ _ => some (.bvar index.toNat)
+  | .fvar .. => none
+  | .sort level _ => some (.sort (readLevel level))
+  | .const id levels _ => do
+      let ref ← resolve id.addr
+      return .const ref (levels.toList.map readLevel)
+  | .app fn arg _ => do
+      return .app (← readExpr? resolve fn) (← readExpr? resolve arg)
+  | .lam _ _ domain body _ => do
+      return .lam (← readExpr? resolve domain) (← readExpr? resolve body)
+  | .all _ _ domain body _ => do
+      return .forallE (← readExpr? resolve domain) (← readExpr? resolve body)
+  | .letE _ domain value body _ _ => do
+      let _ ← readExpr? resolve domain
+      let value ← readExpr? resolve value
+      let body ← readExpr? resolve body
+      return body.inst value
+  | .prj id index value _ => do
+      let ref ← resolve id.addr
+      return .proj ref index.toNat (← readExpr? resolve value)
+  | .nat value _ _ => some (.natLit value)
+  | .str .. => none
+
+/-- Hashing and display metadata do not change a smart-constructed sort. -/
+@[simp] theorem readExpr?_mkSort
+    (resolve : Address → Option (Theory.ConstRef β)) (u : KUniv m) :
+    readExpr? resolve (KExpr.mkSort u) = some (.sort (readLevel u)) := rfl
+
+/-- Kernel metadata erasure preserves the exact model syntax. -/
+@[simp] theorem readExpr?_eraseMeta
+    (resolve : Address → Option (Theory.ConstRef β)) (e : KExpr m) :
+    readExpr? resolve e.eraseMeta = readExpr? resolve e := by
+  induction e <;>
+    simp_all [readExpr?, KExpr.eraseMeta, KId.eraseMeta,
+      Array.toList_map, List.map_map, Function.comp_def]
+
+/-- The production `BEq` fast path preserves the model reading when the
+specific compared expressions have faithful addresses. -/
+theorem beq_readExpr? {resolve : Address → Option (Theory.ConstRef β)}
+    {left right : KExpr m} (faithful : left.AddrFaithful right)
+    (equal : (left == right) = true) :
+    readExpr? resolve left = readExpr? resolve right := by
+  have erased := faithful (KExpr.beq_def left right ▸ equal)
+  simpa only [readExpr?_eraseMeta] using
+    congrArg (readExpr? resolve) erased
+
+/-- The production intern table preserves the model reading of a candidate.
+Collision-freedom is required only on the table support plus that candidate. -/
+theorem internExpr_readExpr? {resolve : Address → Option (Theory.ConstRef β)}
+    {table : InternTable m} {e : KExpr m} (coherent : table.WF)
+    (faithful : KExpr.KeyCollisionFree fun v => table.ExprSupport v ∨ v = e) :
+    readExpr? resolve (table.internExpr e).1 = readExpr? resolve e := by
+  simpa only [readExpr?_eraseMeta] using
+    congrArg (readExpr? resolve) (table.internExpr_eraseMeta coherent faithful)
+
+end Ix.Kernel.Consistency
diff --git a/Ix/Kernel/Verify/Consistency/Infer.lean b/Ix/Kernel/Verify/Consistency/Infer.lean
new file mode 100644
index 000000000..7c336a005
--- /dev/null
+++ b/Ix/Kernel/Verify/Consistency/Infer.lean
@@ -0,0 +1,47 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Infer
+import Ix.Kernel.Verify.Consistency.Judgment
+
+/-!
+# Production sort inference in the set-theory model
+
+This theorem examines the actual uncached inference dispatcher and its intern
+table update. The intern-table premises are its concrete key coherence and
+collision freedom on the table support plus the newly constructed type.
+No named-calculus typing or checker-soundness assumption is used.
+-/
+
+namespace Ix.Kernel.Consistency
+
+open Theory Theory.Model
+
+universe u v
+variable {β : Type u} {m : Mode}
+
+/-- Every successful execution of the production sort-inference branch
+establishes the model typing postcondition for its actual returned type. -/
+theorem inferUncached_sort_sound
+    {resolve : Address → Option (ConstRef β)}
+    {entries : Model.Environment β} {context : Model.Context β}
+    {inferRec : KExpr m → RecM m (KExpr m)} {inferOnly : Bool}
+    {methods : Methods m} {before after : TcState m}
+    {level : KUniv m} {info : ExprInfo m} {type : KExpr m}
+    (coherent : before.env.intern.WF)
+    (faithful : KExpr.KeyCollisionFree fun e =>
+      before.env.intern.ExprSupport e ∨ e = KExpr.mkSort (KUniv.mkSucc level))
+    (accepted : RecM.inferUncached inferRec inferOnly (.sort level info) methods before =
+      .ok type after) :
+    ModelTyping.{u,v} resolve entries context (.sort level info) type := by
+  change EStateM.Result.ok
+      (before.env.intern.internExpr (KExpr.mkSort (KUniv.mkSucc level))).1
+      { before with env := { before.env with intern :=
+        (before.env.intern.internExpr (KExpr.mkSort (KUniv.mkSucc level))).2 } } =
+    .ok type after at accepted
+  cases accepted
+  exact ModelTyping.internType coherent faithful (ModelTyping.sort level info)
+
+end Ix.Kernel.Consistency
diff --git a/Ix/Kernel/Verify/Consistency/Judgment.lean b/Ix/Kernel/Verify/Consistency/Judgment.lean
new file mode 100644
index 000000000..39def4633
--- /dev/null
+++ b/Ix/Kernel/Verify/Consistency/Judgment.lean
@@ -0,0 +1,118 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Verify.Consistency.Expr
+import Ix.Theory.Certified.Accept
+
+/-!
+# Semantic postcondition for kernel typing
+
+`ModelTyping` states the postcondition that the production inference and
+conversion proofs must establish in the new model. It ties both annotated
+endpoints to the actual `KExpr` trees. It is not defined by checker success,
+and this module does not assume that checker success establishes it.
+
+The current producers transport existing evidence through hash equality and
+interning. The consistency theorem constructs a dependency model from an
+admitted environment and rules out this postcondition at the primitive False.
+The remaining checker refinement must produce the postcondition for each
+successful inference/declaration path.
+-/
+
+namespace Ix.Kernel.Consistency
+
+open Theory Theory.Model Theory.Model.SetTheory
+
+universe u v
+variable {β : Type u} {m : Mode}
+
+/-- An annotated typing judgment whose two erasures read the exact kernel
+term and type. This is a semantic specification, not a runtime acceptance bit. -/
+def ModelTyping (resolve : Address → Option (ConstRef β))
+    (entries : Model.Environment β) (context : Model.Context β)
+    (term type : KExpr m) : Prop :=
+  ∃ e A : AExpr β,
+    readExpr? resolve term = some e.erase ∧
+    readExpr? resolve type = some A.erase ∧
+    TypingClaim.{u,v} entries context e A
+
+namespace ModelTyping
+
+/-- The sort rule applies to the exact source and production successor type. -/
+theorem sort {resolve : Address → Option (ConstRef β)}
+    {entries : Model.Environment β} {context : Model.Context β}
+    (level : KUniv m) (info : ExprInfo m) :
+    ModelTyping.{u,v} resolve entries context (.sort level info)
+      (KExpr.mkSort (KUniv.mkSucc level)) := by
+  refine ⟨.sort (readLevel level), .sort (.succ (readLevel level)), rfl, ?_,
+    TypingClaim.sort _⟩
+  simp only [readExpr?_mkSort, readLevel_mkSucc, AExpr.erase]
+
+/-- Reusing a hash-equal term preserves the semantic typing postcondition
+under the comparison's existing address-faithfulness hypothesis. -/
+theorem of_beq {resolve : Address → Option (ConstRef β)}
+    {entries : Model.Environment β} {context : Model.Context β}
+    {left right type : KExpr m} (faithful : left.AddrFaithful right)
+    (equal : (left == right) = true)
+    (typed : ModelTyping.{u,v} resolve entries context right type) :
+    ModelTyping.{u,v} resolve entries context left type := by
+  obtain ⟨e, A, he, hA, typing⟩ := typed
+  exact ⟨e, A, (beq_readExpr? faithful equal).trans he, hA, typing⟩
+
+/-- Interning a typed candidate preserves its semantic typing postcondition. -/
+theorem internExpr {resolve : Address → Option (ConstRef β)}
+    {entries : Model.Environment β} {context : Model.Context β}
+    {table : InternTable m} {term type : KExpr m}
+    (coherent : table.WF)
+    (faithful : KExpr.KeyCollisionFree fun e => table.ExprSupport e ∨ e = term)
+    (typed : ModelTyping.{u,v} resolve entries context term type) :
+    ModelTyping.{u,v} resolve entries context (table.internExpr term).1 type := by
+  obtain ⟨e, A, he, hA, typing⟩ := typed
+  exact ⟨e, A, (internExpr_readExpr? coherent faithful).trans he, hA, typing⟩
+
+/-- Interning the inferred type also preserves the semantic judgment. -/
+theorem internType {resolve : Address → Option (ConstRef β)}
+    {entries : Model.Environment β} {context : Model.Context β}
+    {table : InternTable m} {term type : KExpr m}
+    (coherent : table.WF)
+    (faithful : KExpr.KeyCollisionFree fun e => table.ExprSupport e ∨ e = type)
+    (typed : ModelTyping.{u,v} resolve entries context term type) :
+    ModelTyping.{u,v} resolve entries context term (table.internExpr type).1 := by
+  obtain ⟨e, A, he, hA, typing⟩ := typed
+  exact ⟨e, A, he, (internExpr_readExpr? coherent faithful).trans hA, typing⟩
+
+/-- A closed kernel typing judgment at primitive False contradicts the
+set-theoretic model. Dependency realizations are constructed by admission. -/
+theorem no_false [DecidableEq β]
+    {resolve : Address → Option (ConstRef β)}
+    {signature : Certified.PrimitiveSignature β} {store : Theory.Store β}
+    (admitted : Certified.AdmittedEnvironment.{u,v} signature store)
+    {term type : KExpr m}
+    (isFalse : readExpr? resolve type = some signature.falseExpr)
+    (typed : ModelTyping.{u,v} resolve admitted.entries [] term type)
+    (V : Type v) [SetTheory V] : False := by
+  obtain ⟨e, A, _he, hA, typing⟩ := typed
+  have erased : A.erase = signature.falseExpr := Option.some.inj (hA.symm.trans isFalse)
+  have falseExpr : A = .const signature.falseType [] := AExpr.eq_const_of_erase_eq erased
+  obtain ⟨constants, compatible⟩ := admitted.model V
+  have member := (typing V constants compatible.realizes [] (fun _ => empty)
+    (Model.Context.valid_nil constants [] (fun _ => empty))).2.2
+  rw [falseExpr] at member
+  simp only [interp, List.map_nil, compatible.falseValue] at member
+  exact not_mem_empty _ member
+
+end ModelTyping
+
+/-- A successful production universe equality supplies semantic conversion
+between the corresponding annotated sorts in every compatible model. -/
+theorem sort_conversion {entries : Model.Environment β} {context : Model.Context β}
+    {left right : KUniv m} (faithful : left.AddrFaithful right)
+    (boundLeft : left.size < UInt64.size) (boundRight : right.size < UInt64.size)
+    (accepted : Kernel.univEq left right = true) :
+    ConversionClaim.{u,v} entries context (.sort (readLevel left)) (.sort (readLevel right)) :=
+  ConversionClaim.sort (Theory.VLevel.equiv_def.mp
+    (univEq_sound faithful boundLeft boundRight accepted))
+
+end Ix.Kernel.Consistency
diff --git a/Ix/Kernel/Verify/Consistency/Level.lean b/Ix/Kernel/Verify/Consistency/Level.lean
new file mode 100644
index 000000000..59441f43d
--- /dev/null
+++ b/Ix/Kernel/Verify/Consistency/Level.lean
@@ -0,0 +1,74 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Kernel.Verify.Level
+import Ix.Theory.VLevel
+
+open Ix.Theory (VLevel)
+
+/-!
+# Kernel universe decisions in the consistency model
+
+The normalization proof and the set-theoretic model share `Theory.VLevel`.
+This module states the production decisions directly in that model. The
+comparison hypotheses are faithfulness of the compared addresses and bounds
+excluding UInt64 overflow.
+-/
+
+namespace Ix.Kernel.Consistency
+
+variable {m : Mode}
+
+/-- Read a kernel universe structurally, without consulting its cached hash. -/
+def readLevel : KUniv m → Theory.VLevel
+  | .zero _ => .zero
+  | .succ u _ => .succ (readLevel u)
+  | .max a b _ => .max (readLevel a) (readLevel b)
+  | .imax a b _ => .imax (readLevel a) (readLevel b)
+  | .param index _ _ => .param index.toNat
+
+/-- Display metadata cannot change a universe's model reading. -/
+@[simp] theorem readLevel_eraseMeta (u : KUniv m) :
+    readLevel u.eraseMeta = readLevel u := by
+  induction u <;> simp_all [KUniv.eraseMeta, readLevel]
+
+/-- The structural reader and the normalization proof use the same syntax. -/
+theorem readLevel_eq (u : KUniv m) : readLevel u = u.toVLevel := by
+  induction u <;> simp_all [readLevel, KUniv.toVLevel]
+
+/-- The production successor constructor preserves the semantic successor. -/
+@[simp] theorem readLevel_mkSucc (u : KUniv m) :
+    readLevel (KUniv.mkSucc u) = .succ (readLevel u) := by
+  rw [readLevel_eq, KUniv.toVLevel_mkSucc, ← readLevel_eq]
+
+/-- The structural reader preserves universe evaluation. -/
+theorem readLevel_eval (levels : List Nat) (u : KUniv m) :
+    (readLevel u).eval levels = u.toVLevel.eval levels := by
+  rw [readLevel_eq]
+
+/-- Reading preserves the existing checker's universe-parameter scope. -/
+theorem readLevel_wf (n : Nat) (u : KUniv m) :
+    (readLevel u).WF n ↔ u.toVLevel.WF n := by
+  rw [readLevel_eq]
+
+/-- Successful production universe equality is equality in the new model. -/
+theorem univEq_sound {u v : KUniv m} (faithful : u.AddrFaithful v)
+    (boundU : u.size < UInt64.size) (boundV : v.size < UInt64.size)
+    (accepted : Kernel.univEq u v = true) : readLevel u ≈ readLevel v := by
+  apply Theory.VLevel.equiv_def.mpr
+  intro levels
+  rw [readLevel_eval, readLevel_eval]
+  exact Ix.Theory.VLevel.equiv_def.mp
+    (Kernel.univEq_sound faithful boundU boundV accepted) levels
+
+/-- Successful production universe comparison is inclusion in the new model. -/
+theorem univGeq_sound {u v : KUniv m} (faithful : u.AddrFaithful v)
+    (boundU : u.size < UInt64.size) (boundV : v.size < UInt64.size)
+    (accepted : Kernel.univGeq u v = true) : readLevel v ≤ readLevel u := by
+  intro levels
+  rw [readLevel_eval, readLevel_eval]
+  exact Kernel.univGeq_sound faithful boundU boundV accepted levels
+
+end Ix.Kernel.Consistency
diff --git a/Ix/Tc/Verify/Ctx.lean b/Ix/Kernel/Verify/Ctx.lean
similarity index 96%
rename from Ix/Tc/Verify/Ctx.lean
rename to Ix/Kernel/Verify/Ctx.lean
index 4e044b8ca..6cc948568 100644
--- a/Ix/Tc/Verify/Ctx.lean
+++ b/Ix/Kernel/Verify/Ctx.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.State
-import Ix.Tc.Lctx
+import Ix.Kernel.Verify.State
+import Ix.Kernel.Lctx
 
 /-!
 # Dual-context reconciliation: `CtxRecon`
@@ -45,9 +45,9 @@ production equations live in `Verify/Totalization`. Preservation lemmas for
 `CtxRecon` over more than one pop remain part of the checker-soundness layer.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VEnv VLocalDecl)
+open Ix.Theory.Named (VExpr VEnv VLocalDecl)
 
 /-! ### List helpers (local, no stdlib-name gambling) -/
 
@@ -441,7 +441,7 @@ theorem bvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
       simp only [List.getElem?_cons_zero] at hb
       cases hb
       refine ⟨Δ, .vlam ty', 0, ?_, ?_, ?_, .vlam h1 h2⟩
-      · simpa [Lean4Lean.VLocalDecl.depth] using
+      · simpa [Ix.Theory.Named.VLocalDecl.depth] using
           KVLCtx.KBVLift.skip (.vlam ty') .refl
       · simp [KVLCtx.find?, KVLCtx.next]
       · simp only [KVLCtx.fvars_cons_none]
@@ -450,10 +450,10 @@ theorem bvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
       simp only [List.getElem?_cons_succ] at hb
       obtain ⟨Δ₀, vd, m, W, hf, hsub, htr⟩ := ih nd hb
       refine ⟨Δ₀, vd, m + 1, ?_, ?_, ?_, htr⟩
-      · simpa [Lean4Lean.VLocalDecl.depth, Nat.add_assoc] using
+      · simpa [Ix.Theory.Named.VLocalDecl.depth, Nat.add_assoc] using
           KVLCtx.KBVLift.skip (.vlam ty') W
       · simp only [KVLCtx.find?, KVLCtx.next, Option.bind_eq_bind, hf]
-        simp [Lean4Lean.VLocalDecl.depth, Lean4Lean.VExpr.liftN_liftN]
+        simp [Ix.Theory.Named.VLocalDecl.depth, Ix.Theory.Named.VExpr.liftN_liftN]
       · simp only [KVLCtx.fvars_cons_none]
         exact hsub
   | @bvar_let bs fs Δ ty₀ val₀ ty' val' H1 h1 h2 h3 ih =>
@@ -463,7 +463,7 @@ theorem bvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
       simp only [List.getElem?_cons_zero] at hb
       cases hb
       refine ⟨Δ, .vlet ty' val', 0, ?_, ?_, ?_, .vlet h1 h2 h3⟩
-      · simpa [Lean4Lean.VLocalDecl.depth] using
+      · simpa [Ix.Theory.Named.VLocalDecl.depth] using
           KVLCtx.KBVLift.skip (.vlet ty' val') .refl
       · simp [KVLCtx.find?, KVLCtx.next]
       · simp only [KVLCtx.fvars_cons_none]
@@ -472,10 +472,10 @@ theorem bvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
       simp only [List.getElem?_cons_succ] at hb
       obtain ⟨Δ₀, vd, m, W, hf, hsub, htr⟩ := ih nd hb
       refine ⟨Δ₀, vd, m, ?_, ?_, ?_, htr⟩
-      · simpa [Lean4Lean.VLocalDecl.depth] using
+      · simpa [Ix.Theory.Named.VLocalDecl.depth] using
           KVLCtx.KBVLift.skip (.vlet ty' val') W
       · simp only [KVLCtx.find?, KVLCtx.next, Option.bind_eq_bind, hf]
-        simp [Lean4Lean.VLocalDecl.depth]
+        simp [Ix.Theory.Named.VLocalDecl.depth]
       · simp only [KVLCtx.fvars_cons_none]
         exact hsub
   | @fvar bs fs Δ fv deps d vd' H1 h1 h2 ih =>
@@ -489,7 +489,7 @@ theorem bvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
     · simpa [Nat.add_assoc] using
         KVLCtx.KBVLift.skip_fvar (fv, deps) vd' hfresh W
     · simp only [KVLCtx.find?, KVLCtx.next, Option.bind_eq_bind, hf]
-      simp [Lean4Lean.VExpr.liftN_liftN]
+      simp [Ix.Theory.Named.VExpr.liftN_liftN]
     · simp only [KVLCtx.fvars_cons_some]
       exact fun x hx => List.mem_cons_of_mem _ (hsub hx)
 
@@ -517,20 +517,20 @@ theorem fvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
     intro nd j fv d hb
     obtain ⟨Δ₀, vd, dn, m, W, hf, hsub, htr⟩ := ih nd hb
     refine ⟨Δ₀, vd, dn + 1, m + 1, ?_, ?_, ?_, htr⟩
-    · simpa [Lean4Lean.VLocalDecl.depth, Nat.add_assoc] using
+    · simpa [Ix.Theory.Named.VLocalDecl.depth, Nat.add_assoc] using
         KVLCtx.KBVLift.skip (.vlam ty') W
     · simp only [KVLCtx.find?, KVLCtx.next, Option.bind_eq_bind, hf]
-      simp [Lean4Lean.VLocalDecl.depth, Lean4Lean.VExpr.liftN_liftN]
+      simp [Ix.Theory.Named.VLocalDecl.depth, Ix.Theory.Named.VExpr.liftN_liftN]
     · simp only [KVLCtx.fvars_cons_none]
       exact hsub
   | @bvar_let bs fs Δ ty₀ val₀ ty' val' H1 h1 h2 h3 ih =>
     intro nd j fv d hb
     obtain ⟨Δ₀, vd, dn, m, W, hf, hsub, htr⟩ := ih nd hb
     refine ⟨Δ₀, vd, dn + 1, m, ?_, ?_, ?_, htr⟩
-    · simpa [Lean4Lean.VLocalDecl.depth] using
+    · simpa [Ix.Theory.Named.VLocalDecl.depth] using
         KVLCtx.KBVLift.skip (.vlet ty' val') W
     · simp only [KVLCtx.find?, KVLCtx.next, Option.bind_eq_bind, hf]
-      simp [Lean4Lean.VLocalDecl.depth]
+      simp [Ix.Theory.Named.VLocalDecl.depth]
     · simp only [KVLCtx.fvars_cons_none]
       exact hsub
   | @fvar bs fs Δ fv₀ deps₀ d₀ vd₀ H1 h1 h2 ih =>
@@ -561,7 +561,7 @@ theorem fvar_frame {bs : List (KExpr .anon × Option (KExpr .anon))}
       · simpa [Nat.add_assoc] using
           KVLCtx.KBVLift.skip_fvar (fv₀, deps₀) vd₀ hfresh W
       · simp [KVLCtx.find?, KVLCtx.next, hne, hf,
-          Lean4Lean.VExpr.liftN_liftN]
+          Ix.Theory.Named.VExpr.liftN_liftN]
       · simp only [KVLCtx.fvars_cons_some]
         exact fun x hx => List.mem_cons_of_mem _ (hsub hx)
 
@@ -675,7 +675,7 @@ private theorem frame_of_read
     (hidx : idx.toNat < s.ctx.size)
     (hty : s.ctx[s.ctx.size - 1 - idx.toNat]? = some ty)
     (hov : s.letVals[s.ctx.size - 1 - idx.toNat]? = some ov) :
-    ∃ (Δ₀ : KVLCtx) (vd : Lean4Lean.VLocalDecl) (m : Nat),
+    ∃ (Δ₀ : KVLCtx) (vd : Ix.Theory.Named.VLocalDecl) (m : Nat),
       KVLCtx.KBVLift Δ₀ Δ (idx.toNat + 1) 0 (vd.depth + m) 0 ∧
       KVLCtx.find? Δ (.inl idx.toNat)
         = some (vd.value.liftN m 0, vd.type.liftN m 0) ∧
@@ -719,13 +719,13 @@ theorem lookupVar {idx : UInt64} {ty : KExpr .anon}
     refine ⟨_, _, hf, ?_⟩
     have hw := h1.weakBV henv htp.weakN W hshift
       (show (0 : UInt64).toNat = 0 from rfl) hbig
-    simpa [Lean4Lean.VLocalDecl.type, Lean4Lean.VLocalDecl.depth,
-      Lean4Lean.VExpr.lift, Lean4Lean.VExpr.liftN_liftN] using hw
+    simpa [Ix.Theory.Named.VLocalDecl.type, Ix.Theory.Named.VLocalDecl.depth,
+      Ix.Theory.Named.VExpr.lift, Ix.Theory.Named.VExpr.liftN_liftN] using hw
   | vlet h1 h2 h3 =>
     refine ⟨_, _, hf, ?_⟩
     have hw := h1.weakBV henv htp.weakN W hshift
       (show (0 : UInt64).toNat = 0 from rfl) hbig
-    simpa [Lean4Lean.VLocalDecl.type, Lean4Lean.VLocalDecl.depth]
+    simpa [Ix.Theory.Named.VLocalDecl.type, Ix.Theory.Named.VLocalDecl.depth]
       using hw
 
 /-- `lookupLetVal`'s soundness core: at a let frame, the lifted stored
@@ -752,7 +752,7 @@ theorem lookupLetVal {idx : UInt64} {ty val : KExpr .anon}
     refine ⟨_, _, hf, ?_⟩
     have hw := h2.weakBV henv htp.weakN W hshift
       (show (0 : UInt64).toNat = 0 from rfl) hbig
-    simpa [Lean4Lean.VLocalDecl.value, Lean4Lean.VLocalDecl.depth]
+    simpa [Ix.Theory.Named.VLocalDecl.value, Ix.Theory.Named.VLocalDecl.depth]
       using hw
 
 /-- Walker-tight sibling of `lookupLetVal`.  The older theorem asks for the
@@ -781,7 +781,7 @@ theorem lookupLetVal_liftBounds {idx : UInt64} {ty val : KExpr .anon}
     refine ⟨_, _, hf, ?_⟩
     have hw := h2.weakBV_lbr henv htp.weakN hcon W hshift
       (show (0 : UInt64).toNat = 0 from rfl) hcut hlift
-    simpa [Lean4Lean.VLocalDecl.value, Lean4Lean.VLocalDecl.depth]
+    simpa [Ix.Theory.Named.VLocalDecl.value, Ix.Theory.Named.VLocalDecl.depth]
       using hw
 
 /-- The fvar-side lookup bridge at the concrete state: a successful
@@ -791,7 +791,7 @@ theorem lookupLetVal_liftBounds {idx : UInt64} {ty val : KExpr .anon}
 theorem lctxFind? {fv : FVarId} {d : LocalDecl .anon}
     (h : CtxRecon env uvars nameOf trProj s Δ)
     (hf : s.lctx.find? fv = some d) :
-    ∃ (Δ₀ : KVLCtx) (vd : Lean4Lean.VLocalDecl) (dn m : Nat),
+    ∃ (Δ₀ : KVLCtx) (vd : Ix.Theory.Named.VLocalDecl) (dn m : Nat),
       KVLCtx.KBVLift Δ₀ Δ dn 0 (vd.depth + m) 0 ∧
       KVLCtx.find? Δ (.inr fv)
         = some (vd.value.liftN m 0, vd.type.liftN m 0) ∧
@@ -846,8 +846,8 @@ theorem lctxFindType {fv : FVarId} {d : LocalDecl .anon}
           (by simpa using (show ty.size < UInt64.size by omega))
         simp [hclosed']
       rw [hid] at hw
-      simpa [LocalDecl.ty, Lean4Lean.VLocalDecl.type,
-        Lean4Lean.VLocalDecl.depth, Lean4Lean.VExpr.liftN_liftN,
+      simpa [LocalDecl.ty, Ix.Theory.Named.VLocalDecl.type,
+        Ix.Theory.Named.VLocalDecl.depth, Ix.Theory.Named.VExpr.liftN_liftN,
         Nat.add_comm] using hw
   | @vlet nm ty val ty' val' hty hval hvalType =>
       have hcon' : KExpr.Constructed ty := by
@@ -863,8 +863,8 @@ theorem lctxFindType {fv : FVarId} {d : LocalDecl .anon}
           (by simpa using (show ty.size < UInt64.size by omega))
         simp [hclosed']
       rw [hid] at hw
-      simpa [LocalDecl.ty, Lean4Lean.VLocalDecl.type,
-        Lean4Lean.VLocalDecl.depth] using hw
+      simpa [LocalDecl.ty, Ix.Theory.Named.VLocalDecl.type,
+        Ix.Theory.Named.VLocalDecl.depth] using hw
 
 /-- A let-valued fvar lookup yields a translation of the concrete stored
     value at the current mixed context, provided that value is closed with
@@ -898,7 +898,7 @@ theorem lctxFindLetVal {fv : FVarId} {nm : Mode.anon.F Name}
         (by simpa using (show val.size < UInt64.size by omega))
       simp [hclosed]
     rw [hid] at hw
-    simpa [Lean4Lean.VLocalDecl.value, Lean4Lean.VLocalDecl.depth] using hw
+    simpa [Ix.Theory.Named.VLocalDecl.value, Ix.Theory.Named.VLocalDecl.depth] using hw
 
 /-- Fvar leaves resolve — the bare `TrKExprS.fvar` premise. -/
 theorem fvar_resolves {fv : FVarId} {d : LocalDecl .anon}
@@ -1154,4 +1154,4 @@ theorem closeFVar {fv : FVarId} {deps : List FVarId} {vd : VLocalDecl}
 
 end CtxRecon
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Decl.lean b/Ix/Kernel/Verify/Decl.lean
similarity index 95%
rename from Ix/Tc/Verify/Decl.lean
rename to Ix/Kernel/Verify/Decl.lean
index 1f0cbb9b1..0d46a008d 100644
--- a/Ix/Tc/Verify/Decl.lean
+++ b/Ix/Kernel/Verify/Decl.lean
@@ -1,7 +1,9 @@
-import Ix.Tc.Verify.World
-import Ix.Tc.Verify.Level
-import Lean4Lean.Verify.Typing.Expr
-import Lean4Lean.Theory.Typing.Lemmas
+import Ix.Kernel.Verify.World
+import Ix.Kernel.Verify.Level
+import Ix.Theory.Named.Verify.Typing.Expr
+import Ix.Theory.Named.Typing.Lemmas
+
+open Ix.Theory (VLevel)
 
 /-!
 # Raw, pending, and trusted declarations
@@ -30,14 +32,14 @@ catalogued, pending, and raw-translatable, but cannot be a well-formed Theory
 declaration in the empty trusted environment.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLevel VEnv VConstant VConstVal VDefVal VDecl)
+open Ix.Theory.Named (VExpr VEnv VConstant VConstVal VDefVal VDecl)
 
 /-- The abstract projection component used by expression translation.
 
 Projection semantics are indexed by the ambient universe-parameter count.
-Lean4Lean's concrete `TrProj` changes that index under universe
+Ix.Theory.Named's concrete `TrProj` changes that index under universe
 instantiation, so erasing it here would make the `instL` law impossible to
 state faithfully.  The raw boundary still carries no closure or typing
 contract; those laws live in `TrProjOK`. -/
@@ -300,7 +302,7 @@ inductive RawDefKindRel (ci : VDefVal) : Ix.DefKind → VDecl → Prop
 
 No constructor asks for `ci.WF` or `d.WF`.  Quotients and inductive-family
 members cannot be represented soundly one constant at a time in
-Lean4Lean.Theory, so they intentionally have no constructor here; their
+Ix.Theory.Named.Theory, so they intentionally have no constructor here; their
 future relation is atomic at the block level. -/
 inductive RawDeclRel (env : VEnv) (nameOf : Address → Option Lean.Name)
     (trProj : RawProjRel) (id : KId .anon) : KConst .anon → VDecl → Prop
@@ -348,7 +350,7 @@ theorem mono {env env' : VEnv} (henv : env ≤ env')
     exact .defn hname (hty.mono henv) (hval.mono henv) hkind
 
 /-- A WF transition for a raw standalone declaration extends its input
-environment.  Lean4Lean does not provide this for arbitrary `VDecl.WF`
+environment.  Ix.Theory.Named does not provide this for arbitrary `VDecl.WF`
 (notably, its abstract `addInduct` has no extension theorem), but it follows
 constructively for exactly the axiom/definition/opaque cases admitted by
 `RawDeclRel`. -/
@@ -359,17 +361,17 @@ theorem wf_le {env env' : VEnv} {nameOf : Address → Option Lean.Name}
   cases hraw with
   | «axiom» =>
     cases hwf with
-    | «axiom» _ hadd => exact Lean4Lean.VEnv.addConst_le hadd
+    | «axiom» _ hadd => exact Ix.Theory.Named.VEnv.addConst_le hadd
   | defn _ _ _ hkind =>
     cases hkind with
     | defn =>
       cases hwf with
       | «def» _ hadd =>
-        exact (Lean4Lean.VEnv.addConst_le hadd).trans
-          Lean4Lean.VEnv.addDefEq_le
+        exact (Ix.Theory.Named.VEnv.addConst_le hadd).trans
+          Ix.Theory.Named.VEnv.addDefEq_le
     | opaq | thm =>
       cases hwf with
-      | «opaque» _ hadd => exact Lean4Lean.VEnv.addConst_le hadd
+      | «opaque» _ hadd => exact Ix.Theory.Named.VEnv.addConst_le hadd
 
 /-- Target freshness rules out self-reference in every expression translated
 by a raw standalone declaration. -/
@@ -450,7 +452,7 @@ theorem lookup {trProj : RawProjRel} {world : VerifyWorld}
     cases hwf with
     | «axiom» hconstant hadd =>
       exact ⟨_, _, .axiom _, hname,
-        hinstalled.constants (Lean4Lean.VEnv.addConst_self hadd)⟩
+        hinstalled.constants (Ix.Theory.Named.VEnv.addConst_self hadd)⟩
   | defn hname hty hval hkind =>
     cases hkind with
     | defn =>
@@ -458,13 +460,13 @@ theorem lookup {trProj : RawProjRel} {world : VerifyWorld}
       | «def» hconstant hadd =>
         exact ⟨_, _, .defn _, hname,
           hinstalled.constants
-            (Lean4Lean.VEnv.addDefEq_le.constants
-              (Lean4Lean.VEnv.addConst_self hadd))⟩
+            (Ix.Theory.Named.VEnv.addDefEq_le.constants
+              (Ix.Theory.Named.VEnv.addConst_self hadd))⟩
     | opaq | thm =>
       cases hwf with
       | «opaque» hconstant hadd =>
         exact ⟨_, _, .opaque _, hname,
-          hinstalled.constants (Lean4Lean.VEnv.addConst_self hadd)⟩
+          hinstalled.constants (Ix.Theory.Named.VEnv.addConst_self hadd)⟩
 
 end TrustedDecl
 
@@ -510,7 +512,7 @@ end PendingDecl
 
 namespace IllTypedPending
 
-def targetName : Lean.Name := `Ix.Tc.Verify.illTypedPending
+def targetName : Lean.Name := `Ix.Kernel.Verify.illTypedPending
 
 /-- A fixed 32-byte address keeps the fixture independent of the Blake3 FFI
 and its generated `native_decide` axiom.  Address coherence is a separate
@@ -569,7 +571,7 @@ theorem theoryConstant_not_wf :
     ¬theoryConstant.toVConstant.WF world.venv := by
   intro hwf
   have hlevel : (VLevel.param 0).WF 0 :=
-    hwf.sort_inv Lean4Lean.VEnv.Ordered.empty
+    hwf.sort_inv Ix.Theory.Named.VEnv.Ordered.empty
   exact (Nat.not_lt_zero 0) hlevel
 
 /-- Consequently there is no Theory declaration-WF step from the pending
@@ -606,4 +608,4 @@ end Loaded
 
 end IllTypedPending
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq.lean b/Ix/Kernel/Verify/DefEq.lean
similarity index 99%
rename from Ix/Tc/Verify/DefEq.lean
rename to Ix/Kernel/Verify/DefEq.lean
index 03a855cb4..9bd1dfb45 100644
--- a/Ix/Tc/Verify/DefEq.lean
+++ b/Ix/Kernel/Verify/DefEq.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Infer
-import Ix.Tc.Verify.Whnf.Closure
+import Ix.Kernel.Verify.Infer
+import Ix.Kernel.Verify.Whnf.Closure
 import Batteries.Data.UInt
 
 /-!
@@ -10,9 +10,9 @@ equality.  A cached `false` (including the narrow failure set) can only reject
 an otherwise valid declaration, so it carries no acceptance claim here.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 private theorem uint64_max_comm (a b : UInt64) : max a b = max b a := by
   apply UInt64.toNat_inj.mp
@@ -227,7 +227,7 @@ theorem of_addr_beq {trProj : RawProjRel} {world : VerifyWorld}
   subst b
   intro _
   exact ⟨va, va, ha, ha,
-    Lean4Lean.VEnv.IsDefEqU.refl (theory.exprWF hctx ha)⟩
+    Ix.Theory.Named.VEnv.IsDefEqU.refl (theory.exprWF hctx ha)⟩
 
 theorem symm {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Delta : KVLCtx} {a b : KExpr .anon} {answer : Bool}
@@ -2836,4 +2836,4 @@ theorem inferWith_inferOnlyHit_acceptance
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/AcceleratorGates.lean b/Ix/Kernel/Verify/DefEq/AcceleratorGates.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/AcceleratorGates.lean
rename to Ix/Kernel/Verify/DefEq/AcceleratorGates.lean
index 0e59621d3..3227e9db3 100644
--- a/Ix/Tc/Verify/DefEq/AcceleratorGates.lean
+++ b/Ix/Kernel/Verify/DefEq/AcceleratorGates.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.NatReduction
-import Ix.Tc.Verify.Whnf.Driver.FullStep
+import Ix.Kernel.Verify.DefEq.NatReduction
+import Ix.Kernel.Verify.Whnf.Driver.FullStep
 
 /-!
 # Lazy-delta accelerator gates
@@ -11,7 +11,7 @@ those four operationally unreachable hit branches from lazy delta and exposes
 the first substantive remaining tail: delta-head classification.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -35,7 +35,7 @@ theorem defEqLazyDeltaStepAfterNatMiss_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {state : TcState .anon}
-    {leftSource rightSource : Lean4Lean.VExpr}
+    {leftSource rightSource : Ix.Theory.Named.VExpr}
     {left right : KExpr .anon}
     (theory : WhnfTheory trProj world uvars)
     (hafter : DefEqLazyDeltaAfterAcceleratorMiss.WFAt .noAccel semantics
@@ -158,4 +158,4 @@ end DefEqLazyDeltaAfterNatMiss
 end RecM
 
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ApplicationSpine.lean b/Ix/Kernel/Verify/DefEq/ApplicationSpine.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/ApplicationSpine.lean
rename to Ix/Kernel/Verify/DefEq/ApplicationSpine.lean
index 7c0704617..f062e5ab0 100644
--- a/Ix/Tc/Verify/DefEq/ApplicationSpine.lean
+++ b/Ix/Kernel/Verify/DefEq/ApplicationSpine.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.SpineArguments
+import Ix.Kernel.Verify.DefEq.SpineArguments
 
 /-!
 # General application-spine comparison
@@ -9,9 +9,9 @@ argument loop.  A positive result is reconstructed through the complete typed
 spines; constructor misses and unequal arities carry no semantic claim.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite support coverage for the head and arguments selected by the exact
 production `collectSpine` executions. -/
@@ -145,4 +145,4 @@ end TryDefEqApp
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/BoolTrue.lean b/Ix/Kernel/Verify/DefEq/BoolTrue.lean
similarity index 99%
rename from Ix/Tc/Verify/DefEq/BoolTrue.lean
rename to Ix/Kernel/Verify/DefEq/BoolTrue.lean
index 6ac0fc3ec..515983494 100644
--- a/Ix/Tc/Verify/DefEq/BoolTrue.lean
+++ b/Ix/Kernel/Verify/DefEq/BoolTrue.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.Structural
+import Ix.Kernel.Verify.DefEq.Structural
 
 /-!
 # Eager Bool.true definitional equality
@@ -9,9 +9,9 @@ Acceptance is sound only when the runtime primitive address is tied to the
 trusted Theory name; address equality by itself is not authority.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Minimal trusted binding for the one primitive read by the eager Boolean
 tier. -/
@@ -316,4 +316,4 @@ theorem DefEqAfterBoolTrue.closesInner
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/CacheBranches.lean b/Ix/Kernel/Verify/DefEq/CacheBranches.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/CacheBranches.lean
rename to Ix/Kernel/Verify/DefEq/CacheBranches.lean
index f200f3670..13a46592d 100644
--- a/Ix/Tc/Verify/DefEq/CacheBranches.lean
+++ b/Ix/Kernel/Verify/DefEq/CacheBranches.lean
@@ -1,15 +1,15 @@
-import Ix.Tc.Verify.DefEq
+import Ix.Kernel.Verify.DefEq
 
 /-!
 # DefEq cache-policy branches
 
 This module verifies cache exits whose state effects depend on cheap mode.
 The semantic manager and guarded root-cache foundations live in
-`Ix.Tc.Verify.DefEq`; the exhaustive cache shell will assemble these branches
+`Ix.Kernel.Verify.DefEq`; the exhaustive cache shell will assemble these branches
 before entering recursive comparison.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -100,7 +100,7 @@ theorem isDefEq_fullHitCheapMode_true_acceptance
     {methods : Methods .anon} {layer : WhnfLayer}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     (model : KernelSuffixModel trProj world)
-    {Delta : KVLCtx} {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     {ctxAddr : Address} {s s1 s2 s3 s4 : TcState .anon}
     (theory : WhnfTheory trProj world model.keys.uvars)
     (hcollision : support.CollisionFree)
@@ -344,7 +344,7 @@ theorem isDefEq_rootCheapHit_true_acceptance
     {methods : Methods .anon} {layer : WhnfLayer}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     (model : KernelSuffixModel trProj world)
-    {Delta : KVLCtx} {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     {ctxAddr : Address} {aRoot bRoot : EqKey}
     {s s1 s2 s3 s4 s5 : TcState .anon}
     (theory : WhnfTheory trProj world model.keys.uvars)
@@ -506,7 +506,7 @@ theorem guardedRootHit_copyBoth
     {layer : WhnfLayer} {trProj : RawProjRel} {world : VerifyWorld}
     {support : RunSupport} (model : KernelSuffixModel trProj world)
     {kind : DefEqCacheKind} {Delta : KVLCtx}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     {ctxAddr : Address} {aRoot bRoot : EqKey} {s : TcState .anon}
     (theory : WhnfTheory trProj world model.keys.uvars)
     (hcollision : support.CollisionFree)
@@ -724,7 +724,7 @@ theorem isDefEq_rootFullHitCheapMode_true_acceptance
     {methods : Methods .anon} {layer : WhnfLayer}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     (model : KernelSuffixModel trProj world)
-    {Delta : KVLCtx} {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     {ctxAddr : Address} {aRoot bRoot : EqKey}
     {s s1 s2 s3 s4 s5 : TcState .anon}
     (theory : WhnfTheory trProj world model.keys.uvars)
@@ -844,4 +844,4 @@ theorem isDefEq_rootFullHitCheapMode_true_acceptance
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/CacheShell.lean b/Ix/Kernel/Verify/DefEq/CacheShell.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/CacheShell.lean
rename to Ix/Kernel/Verify/DefEq/CacheShell.lean
index b6f72ddd9..29630d2fd 100644
--- a/Ix/Tc/Verify/DefEq/CacheShell.lean
+++ b/Ix/Kernel/Verify/DefEq/CacheShell.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.CacheBranches
+import Ix.Kernel.Verify.DefEq.CacheBranches
 
 /-!
 # DefEq cache shell
@@ -10,7 +10,7 @@ final cache write. The bridge theorems below connect the entry-point prefix
 to those production-owned functions.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -252,7 +252,7 @@ private theorem guardedRootResult
     (theory : WhnfTheory trProj world model.keys.uvars)
     (hcollision : support.CollisionFree)
     {kind : DefEqCacheKind} {answer : Bool} {Delta : KVLCtx}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     {ctxAddr : Address} {aRoot bRoot : EqKey} {s : TcState .anon}
     (hI : WhnfStateInv layer (kernelCacheSemantics model.keys trProj)
       trProj world support model.keys.uvars Delta s)
@@ -307,7 +307,7 @@ private theorem applyFullRootResult_wf
     {layer : WhnfLayer} {trProj : RawProjRel} {world : VerifyWorld}
     {support : RunSupport} {model : KernelSuffixModel trProj world}
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr} {ctxAddr : Address}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr} {ctxAddr : Address}
     {answer cheapMode : Bool}
     (hcollision : support.CollisionFree)
     (haSupport : support a) (hbSupport : support b)
@@ -369,7 +369,7 @@ private theorem applyCheapRootResult_wf
     {layer : WhnfLayer} {trProj : RawProjRel} {world : VerifyWorld}
     {support : RunSupport} {model : KernelSuffixModel trProj world}
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr} {ctxAddr : Address}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr} {ctxAddr : Address}
     {answer : Bool}
     (hcollision : support.CollisionFree)
     (haSupport : support a) (hbSupport : support b)
@@ -442,7 +442,7 @@ private theorem applyDirectFullHit_wf
     {layer : WhnfLayer} {trProj : RawProjRel} {world : VerifyWorld}
     {support : RunSupport} {model : KernelSuffixModel trProj world}
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr} {ctxAddr : Address}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr} {ctxAddr : Address}
     {answer cheapMode : Bool}
     (hcollision : support.CollisionFree)
     (haSupport : support a) (hbSupport : support b)
@@ -537,7 +537,7 @@ private theorem applyDirectCheapHit_wf
     {layer : WhnfLayer} {trProj : RawProjRel} {world : VerifyWorld}
     {support : RunSupport} {model : KernelSuffixModel trProj world}
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr} {ctxAddr : Address}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr} {ctxAddr : Address}
     {answer : Bool}
     (hcollision : support.CollisionFree)
     (haSupport : support a) (hbSupport : support b)
@@ -609,7 +609,7 @@ theorem isDefEqAfterRootCacheMiss_wf
     (hcollision : support.CollisionFree)
     (hinner : DefEqInner.WF layer trProj world support model)
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr} {ctxAddr : Address}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr} {ctxAddr : Address}
     {cheapMode : Bool}
     (haSupport : support a) (hbSupport : support b)
     (ha : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta a va)
@@ -770,7 +770,7 @@ theorem isDefEqAfterDirectCacheMiss_wf
     (hcollision : support.CollisionFree)
     (hinner : DefEqInner.WF layer trProj world support model)
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr} {ctxAddr : Address}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr} {ctxAddr : Address}
     {cheapMode : Bool}
     (haSupport : support a) (hbSupport : support b)
     (ha : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta a va)
@@ -907,7 +907,7 @@ theorem isDefEq_wf
     (hcollision : support.CollisionFree)
     (hinner : DefEqInner.WF layer trProj world support model)
     {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     (haSupport : support a) (hbSupport : support b)
     (ha : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta a va)
     (hb : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta b vb)
@@ -1046,4 +1046,4 @@ theorem isDefEq_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/CheapReduction.lean b/Ix/Kernel/Verify/DefEq/CheapReduction.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/CheapReduction.lean
rename to Ix/Kernel/Verify/DefEq/CheapReduction.lean
index 7b68bcd85..52500b8f2 100644
--- a/Ix/Tc/Verify/DefEq/CheapReduction.lean
+++ b/Ix/Kernel/Verify/DefEq/CheapReduction.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.StringLiteral
-import Ix.Tc.Verify.Whnf.NoDelta.Reducer
+import Ix.Kernel.Verify.DefEq.StringLiteral
+import Ix.Kernel.Verify.Whnf.NoDelta.Reducer
 
 /-!
 # Cheap DefEq reduction prefix
@@ -10,9 +10,9 @@ cheap-depth scope itself and composes both passes with address collision
 freedom and the already verified structural comparison.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -332,4 +332,4 @@ end DefEqAfterNoDeltaPass
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/Closure.lean b/Ix/Kernel/Verify/DefEq/Closure.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/Closure.lean
rename to Ix/Kernel/Verify/DefEq/Closure.lean
index 752558a78..15b510c9c 100644
--- a/Ix/Tc/Verify/DefEq/Closure.lean
+++ b/Ix/Kernel/Verify/DefEq/Closure.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.DefEq.CacheShell
-import Ix.Tc.Verify.DefEq.FinalWhnf.Closure
-import Ix.Tc.Verify.DefEq.LazyDeltaClosure
+import Ix.Kernel.Verify.DefEq.CacheShell
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Closure
+import Ix.Kernel.Verify.DefEq.LazyDeltaClosure
 
 /-!
 # Complete definitional-equality closure
@@ -12,7 +12,7 @@ records: projection delta owns the shared Theory/collision/structural facts,
 while final WHNF owns the direct reducer and primitive-expansion facts.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace CacheEntry
 
@@ -176,4 +176,4 @@ end DefEqClosureResources
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/DeltaClassification.lean b/Ix/Kernel/Verify/DefEq/DeltaClassification.lean
similarity index 96%
rename from Ix/Tc/Verify/DefEq/DeltaClassification.lean
rename to Ix/Kernel/Verify/DefEq/DeltaClassification.lean
index 7f3d9525f..db4d21057 100644
--- a/Ix/Tc/Verify/DefEq/DeltaClassification.lean
+++ b/Ix/Kernel/Verify/DefEq/DeltaClassification.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.AcceleratorGates
-import Ix.Tc.Verify.Whnf.Runtime.LazyIngress
+import Ix.Kernel.Verify.DefEq.AcceleratorGates
+import Ix.Kernel.Verify.Whnf.Runtime.LazyIngress
 
 /-!
 # Lazy-delta head classification
@@ -11,7 +11,7 @@ no semantic claim is attached to a negative answer.  This module also closes
 the exact stopped branch where neither head is classified as reducible.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -64,7 +64,7 @@ theorem defEqLazyDeltaStepAfterAcceleratorMiss_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {state : TcState .anon}
-    {leftSource rightSource : Lean4Lean.VExpr}
+    {leftSource rightSource : Ix.Theory.Named.VExpr}
     {left right : KExpr .anon}
     (hfault : TcM.LazyFaultPreserves
       (WhnfStateInv layer semantics trProj world support uvars Delta))
@@ -110,4 +110,4 @@ end DefEqLazyDeltaAfterAcceleratorMiss
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/EqualRankCache.lean b/Ix/Kernel/Verify/DefEq/EqualRankCache.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/EqualRankCache.lean
rename to Ix/Kernel/Verify/DefEq/EqualRankCache.lean
index 30004e11c..b4ce02801 100644
--- a/Ix/Tc/Verify/DefEq/EqualRankCache.lean
+++ b/Ix/Kernel/Verify/DefEq/EqualRankCache.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.SameHeadSpine
+import Ix.Kernel.Verify.DefEq.SameHeadSpine
 
 /-!
 # Equal-rank same-head cache
@@ -9,7 +9,7 @@ proves the exact lookup/attempt/write shell and preserves provenance for the
 single write made after a genuine comparison miss.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Provenance available for every concrete failure marker this run may
 insert. -/
@@ -95,7 +95,7 @@ theorem trySameHeadSpineSpeculative_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {state : TcState .anon}
-    {left right : KExpr .anon} {leftV rightV : Lean4Lean.VExpr}
+    {left right : KExpr .anon} {leftV rightV : Ix.Theory.Named.VExpr}
     (hsame : TrySameHeadSpine.WFAt layer semantics trProj world support
       uvars)
     (hleftSupport : support left) (hrightSupport : support right)
@@ -201,7 +201,7 @@ theorem trySameHeadSpineCached_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {state : TcState .anon}
-    {left right : KExpr .anon} {leftV rightV : Lean4Lean.VExpr}
+    {left right : KExpr .anon} {leftV rightV : Ix.Theory.Named.VExpr}
     (hcache : DefEqFailureCacheResources semantics world support)
     (hsame : TrySameHeadSpine.WFAt layer semantics trProj world support
       uvars)
@@ -275,4 +275,4 @@ end TrySameHeadSpineCached
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/EqualRankPrefix.lean b/Ix/Kernel/Verify/DefEq/EqualRankPrefix.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/EqualRankPrefix.lean
rename to Ix/Kernel/Verify/DefEq/EqualRankPrefix.lean
index c045f9cbf..b8135d0bb 100644
--- a/Ix/Tc/Verify/DefEq/EqualRankPrefix.lean
+++ b/Ix/Kernel/Verify/DefEq/EqualRankPrefix.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.EqualRankCache
+import Ix.Kernel.Verify.DefEq.EqualRankCache
 
 /-!
 # Equal-rank prefix assembly
@@ -8,9 +8,9 @@ attempt, and the already-proved two-sided reduction continuation into the
 complete equal-rank lazy-delta contract.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -118,4 +118,4 @@ end DefEqLazyDeltaEqualRank
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/EqualRankReduction.lean b/Ix/Kernel/Verify/DefEq/EqualRankReduction.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/EqualRankReduction.lean
rename to Ix/Kernel/Verify/DefEq/EqualRankReduction.lean
index 1d95349af..207a6764b 100644
--- a/Ix/Tc/Verify/DefEq/EqualRankReduction.lean
+++ b/Ix/Kernel/Verify/DefEq/EqualRankReduction.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.RankDispatch
+import Ix.Kernel.Verify.DefEq.RankDispatch
 
 /-!
 # Equal-rank two-sided reduction
@@ -9,9 +9,9 @@ four hit/miss combinations in that exact order and feeds every productive
 combination through the common finishing checks.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -148,4 +148,4 @@ end DefEqLazyDeltaAfterSameHeadMiss
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/Application.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/Application.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/Application.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/Application.lean
index 4833994da..75f7b62e2 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/Application.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/Application.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
 
 /-!
 # Final-WHNF application comparison
@@ -8,9 +8,9 @@ constructor-directed final comparison.  Argument equality is requested only
 after function equality succeeds, matching the production order.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite child coverage for supported applications selected by the final
 WHNF comparator. -/
@@ -117,4 +117,4 @@ end TryDefEqWhnfApp
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/Closure.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/Closure.lean
similarity index 91%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/Closure.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/Closure.lean
index b97a2f20a..36c1c5e6b 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/Closure.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/Closure.lean
@@ -1,10 +1,10 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.NatBridge
-import Ix.Tc.Verify.DefEq.FinalWhnf.EtaExpansion
-import Ix.Tc.Verify.DefEq.FinalWhnf.StringExpansion
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructuralPrefix
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructureEta
-import Ix.Tc.Verify.DefEq.FinalWhnf.UnitLike
-import Ix.Tc.Verify.DefEq.PropositionClassifier
+import Ix.Kernel.Verify.DefEq.FinalWhnf.NatBridge
+import Ix.Kernel.Verify.DefEq.FinalWhnf.EtaExpansion
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StringExpansion
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructuralPrefix
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructureEta
+import Ix.Kernel.Verify.DefEq.FinalWhnf.UnitLike
+import Ix.Kernel.Verify.DefEq.PropositionClassifier
 
 /-!
 # Complete final-WHNF comparison
@@ -15,7 +15,7 @@ irrelevance fallbacks.  This module assembles those independently verified
 phases under one canonical K2 suffix model.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Concrete resources for every production phase of `isDefEqWhnf`.  The
@@ -102,4 +102,4 @@ theorem finalWhnf
 end FinalWhnfClosureResources
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/Contracts.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/Contracts.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/Contracts.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/Contracts.lean
index f758d6b91..feae0f768 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/Contracts.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/Contracts.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.StoppedContinuation
+import Ix.Kernel.Verify.DefEq.StoppedContinuation
 
 /-!
 # Final-WHNF comparison contracts
@@ -9,7 +9,7 @@ contracts let their exhaustive proofs be developed independently and then
 compose them back into `isDefEqWhnf`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -19,7 +19,7 @@ def TryDefEqWhnfLet.WFAt (layer : WhnfLayer)
     (world : VerifyWorld) (support : RunSupport) (uvars : Nat) : Prop :=
   ∀ {Delta state leftName rightName ty1 val1 body1 ty2 val2 body2}
       {leftNondep rightNondep : Bool}
-      {leftInfo rightInfo : ExprInfo .anon} {leftV rightV : Lean4Lean.VExpr},
+      {leftInfo rightInfo : ExprInfo .anon} {leftV rightV : Ix.Theory.Named.VExpr},
     support (.letE leftName ty1 val1 body1 leftNondep leftInfo) →
     support (.letE rightName ty2 val2 body2 rightNondep rightInfo) →
     TrKExprS world.venv uvars world.nameOf trProj Delta
@@ -212,7 +212,7 @@ theorem isDefEqWhnf_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {state : TcState .anon}
-    {left right : KExpr .anon} {leftV rightV : Lean4Lean.VExpr}
+    {left right : KExpr .anon} {leftV rightV : Ix.Theory.Named.VExpr}
     (hstructural : TryDefEqWhnfStructural.WFAt layer semantics trProj world
       support uvars)
     (htail : IsDefEqWhnfAfterStructural.WFAt layer semantics trProj world
@@ -255,4 +255,4 @@ end IsDefEqWhnf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/EtaExpansion.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/EtaExpansion.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/EtaExpansion.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/EtaExpansion.lean
index 314f923cc..c61d22b4c 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/EtaExpansion.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/EtaExpansion.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
-import Ix.Tc.Verify.DefEq.ProofIrrelevance
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.ProofIrrelevance
 
 /-!
 # Final-WHNF lambda eta
@@ -12,9 +12,9 @@ cover the exact lift footprint and generated syntax; no semantic eta callback
 is assumed.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite walker and generated-node closure for lambda eta. -/
 structure FinalWhnfEtaResources (support : RunSupport) : Prop where
@@ -55,7 +55,7 @@ theorem lift_whnf_wf_of_resources
           InternUpdateFrame state after) :=
   TcM.runIntern_whnf_wf
     (fun intern hwf hsupport => by
-      have post := Ix.Tc.lift_spec hcollision.expr hbounds.1 hbounds.2.1
+      have post := Ix.Kernel.lift_spec hcollision.expr hbounds.1 hbounds.2.1
         hreach hwf hsupport.expr
       exact ⟨post.1, post.2.1,
         hsupport.of_expr_univs post.2.2
@@ -421,4 +421,4 @@ end IsDefEqWhnfAfterNat
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/LetDeclaration.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/LetDeclaration.lean
similarity index 99%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/LetDeclaration.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/LetDeclaration.lean
index 5445f31de..0814bea5c 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/LetDeclaration.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/LetDeclaration.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
-import Ix.Tc.Verify.Infer.LetScopes
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.Infer.LetScopes
 
 /-!
 # Final-WHNF let-declaration comparison
@@ -11,9 +11,9 @@ opened bodies recursively.  This module verifies that exact scoped program,
 including allocation failure and scope restoration on callback errors.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite constructor descent and body-opening coverage for supported lets.
 The right body is opened with the left let's display name, so body resources
@@ -449,4 +449,4 @@ end TryDefEqWhnfLet
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/NatBridge.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/NatBridge.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/NatBridge.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/NatBridge.lean
index 34562eb1b..47dc6cde8 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/NatBridge.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/NatBridge.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
-import Ix.Tc.Verify.DefEq.NatOffset
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.NatOffset
 
 /-!
 # Final-WHNF Nat bridge
@@ -11,9 +11,9 @@ predecessor equality can therefore be lifted through `Nat.succ` without
 assuming injectivity or reflection beyond the trusted primitive table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Trusted primitive facts and finite support needed by the final Nat
 comparison. -/
@@ -41,9 +41,9 @@ private theorem finalNatLit_hasType
       obtain ⟨ci, hlookup⟩ := htable.natZero.contains hcatalog
       have hci := hprims.natZero hlookup
       subst ci
-      exact Lean4Lean.VEnv.HasType.const hlookup (by simp) rfl
+      exact Ix.Theory.Named.VEnv.HasType.const hlookup (by simp) rfl
   | n + 1 =>
-      Lean4Lean.VEnv.HasType.app
+      Ix.Theory.Named.VEnv.HasType.app
         (natSucc_hasType hcatalog htable hprims)
         (finalNatLit_hasType hcatalog htable hprims n)
 
@@ -135,7 +135,7 @@ theorem natSuccOf_wf
             have hpredTr : TrKExprS world.venv uvars world.nameOf trProj
                 Delta (natExprFromValue predecessor : KExpr .anon)
                 (.natLit predecessor) := by
-              exact .nat (by simpa [Lean4Lean.VEnv.ContainsLits] using
+              exact .nat (by simpa [Ix.Theory.Named.VEnv.ContainsLits] using
                 resources.natContains)
             have hpredType : world.venv.HasType uvars Delta.toCtx
                 (.natLit predecessor) .nat :=
@@ -240,7 +240,7 @@ theorem isDefEqNatAfterLiteral_wf
             have hrightValue := hrightZero rfl
             subst leftV
             subst rightV
-            exact Lean4Lean.VEnv.IsDefEqU.refl <|
+            exact Ix.Theory.Named.VEnv.IsDefEqU.refl <|
               hleft.wf world.venvWF.ordered theory.literalWF
                 theory.projections.wf hI.2.1.wf
       | false =>
@@ -346,7 +346,7 @@ theorem isDefEqNat_wf
   exact RecM.WF.pure fun hI hanswer => by
     have hvalue := eq_of_beq hanswer
     subst_vars
-    exact Lean4Lean.VEnv.IsDefEqU.refl <|
+    exact Ix.Theory.Named.VEnv.IsDefEqU.refl <|
       hleftTr.wf world.venvWF.ordered theory.literalWF
         theory.projections.wf hI.2.1.wf
 
@@ -452,4 +452,4 @@ end IsDefEqWhnfAfterStructural
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/ProofTail.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/ProofTail.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/ProofTail.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/ProofTail.lean
index 019226425..55a884362 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/ProofTail.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/ProofTail.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
-import Ix.Tc.Verify.DefEq.ProofIrrelevance
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.ProofIrrelevance
 
 /-!
 # Final-WHNF proof-irrelevance tail
@@ -9,9 +9,9 @@ module packages it at the final-WHNF seam and composes it with an independently
 verified unit-like shortcut.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -144,4 +144,4 @@ end IsDefEqWhnfAfterString
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/StringExpansion.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/StringExpansion.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/StringExpansion.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/StringExpansion.lean
index c23d6562e..82744e37e 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/StringExpansion.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/StringExpansion.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
-import Ix.Tc.Verify.DefEq.StringLiteral
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.StringLiteral
 
 /-!
 # Final-WHNF String-literal expansion
@@ -9,9 +9,9 @@ final-WHNF comparator.  Each compact literal is expanded by the exact K1 plan,
 whose result translates to the same Theory literal as the source syntax.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -148,4 +148,4 @@ end IsDefEqWhnfAfterEta
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/StructuralPrefix.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructuralPrefix.lean
similarity index 95%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/StructuralPrefix.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/StructuralPrefix.lean
index 8a48063bd..0627c4c00 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/StructuralPrefix.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructuralPrefix.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Application
-import Ix.Tc.Verify.DefEq.FinalWhnf.LetDeclaration
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Application
+import Ix.Kernel.Verify.DefEq.FinalWhnf.LetDeclaration
 
 /-!
 # Final-WHNF structural prefix
@@ -11,9 +11,9 @@ contract so its allocation and dual-body opening proof can be discharged in
 isolation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -75,7 +75,7 @@ theorem tryDefEqWhnfStructural_wf
                     (hleftLookup.symm.trans hrightLookup)
                   have hvalue : leftV = rightV := congrArg Prod.fst hp
                   subst rightV
-                  exact Lean4Lean.VEnv.IsDefEqU.refl hleftWF
+                  exact Ix.Theory.Named.VEnv.IsDefEqU.refl hleftWF
   · rename_i leftU leftInfo rightU rightInfo
     cases hleft with
     | sort hleftWF =>
@@ -153,7 +153,7 @@ theorem tryDefEqWhnfStructural_wf
             hI.2.1.wf
           cases hleft
           cases hright
-          exact Lean4Lean.VEnv.IsDefEqU.refl hleftWF
+          exact Ix.Theory.Named.VEnv.IsDefEqU.refl hleftWF
   · rename_i leftString leftBlob leftInfo rightString rightBlob rightInfo
     cases hvalue : leftString == rightString with
     | false =>
@@ -167,7 +167,7 @@ theorem tryDefEqWhnfStructural_wf
             hI.2.1.wf
           cases hleft
           cases hright
-          exact Lean4Lean.VEnv.IsDefEqU.refl hleftWF
+          exact Ix.Theory.Named.VEnv.IsDefEqU.refl hleftWF
 
 namespace TryDefEqWhnfStructural
 
@@ -189,4 +189,4 @@ end TryDefEqWhnfStructural
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEta.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEta.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/StructureEta.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEta.lean
index b29b620ff..c21041c10 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEta.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEta.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructureEtaTail
-import Ix.Tc.Verify.Infer.Constants
-import Ix.Tc.Verify.Infer.ProjectionTypes
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructureEtaTail
+import Ix.Kernel.Verify.Infer.Constants
+import Ix.Kernel.Verify.Infer.ProjectionTypes
 
 /-!
 # Final-WHNF structure eta
@@ -13,9 +13,9 @@ Theory boundary consumes that token together with the exact constructor
 metadata, typing derivations, and field equations selected by production.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Exact constructor fields retained from the declaration returned by the
 production lookup. -/
@@ -156,7 +156,7 @@ theorem normalizeEtaStructSource_wf
       simp only
       exact RecM.WF.pure fun hI =>
         ⟨hsourceSupport, sourceV, hsource,
-          Lean4Lean.VEnv.IsDefEqU.refl (theory.exprWF hI.2.1 hsource)⟩
+          Ix.Theory.Named.VEnv.IsDefEqU.refl (theory.exprWF hI.2.1 hsource)⟩
 
 /-- Exhaust the size check, structure classifier, both caught inference
 calls, inferred-type comparison, and the verified structure-eta tail for one
@@ -504,4 +504,4 @@ end TryDefEqWhnfStructEta
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaBase.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaBase.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaBase.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaBase.lean
index c8451cf2f..b684ebbdc 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaBase.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaBase.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructureEtaFields
-import Ix.Tc.Verify.DefEq.CheapReduction
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructureEtaFields
+import Ix.Kernel.Verify.DefEq.CheapReduction
 
 /-!
 # Structure-eta common-base scan
@@ -12,9 +12,9 @@ state.  A successful result carries the semantic projection equality for
 each scanned field.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Invert the structural translation of one concrete projection while
 retaining the resolved structure name and raw projection witness. -/
@@ -304,7 +304,7 @@ theorem etaExpansionBaseLoop_wf
             | none =>
                 have hvalueRefl : world.venv.IsDefEqU uvars Delta.toCtx
                     valueV valueV :=
-                  Lean4Lean.VEnv.IsDefEqU.refl
+                  Ix.Theory.Named.VEnv.IsDefEqU.refl
                     (theory.exprWF hIValue.2.1 hvalueTr)
                 exact hcontinue hvalueSupport hvalueTr hvalueRefl
             | some chosen =>
@@ -359,4 +359,4 @@ theorem etaExpansionBase_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaFields.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaFields.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaFields.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaFields.lean
index d291cb45f..988e97f0c 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaFields.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaFields.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.Contracts
+import Ix.Kernel.Verify.DefEq.FinalWhnf.Contracts
 
 /-!
 # Structure-eta field comparison
@@ -11,9 +11,9 @@ structure metadata is not assumed here and remains the responsibility of the
 outer constructor/classifier proof.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -113,4 +113,4 @@ theorem tryEtaStructFields_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaTail.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaTail.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaTail.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaTail.lean
index 0b63558ef..646e4f5fa 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/StructureEtaTail.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/StructureEtaTail.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.StructureEtaBase
+import Ix.Kernel.Verify.DefEq.FinalWhnf.StructureEtaBase
 
 /-!
 # Structure-eta tail after type agreement
@@ -9,9 +9,9 @@ types.  The only semantic input is an eta law indexed by the exact field
 projection equations proved by those loops.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Exact semantic continuation needed after all structure fields agree.
 The outer constructor/classifier proof supplies this from the trusted
@@ -129,4 +129,4 @@ theorem tryEtaStructAfterTypes_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/FinalWhnf/UnitLike.lean b/Ix/Kernel/Verify/DefEq/FinalWhnf/UnitLike.lean
similarity index 96%
rename from Ix/Tc/Verify/DefEq/FinalWhnf/UnitLike.lean
rename to Ix/Kernel/Verify/DefEq/FinalWhnf/UnitLike.lean
index 83418c0ad..e6b5410cb 100644
--- a/Ix/Tc/Verify/DefEq/FinalWhnf/UnitLike.lean
+++ b/Ix/Kernel/Verify/DefEq/FinalWhnf/UnitLike.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.DefEq.FinalWhnf.ProofTail
-import Ix.Tc.Verify.Infer.Constants
-import Ix.Tc.Verify.Whnf.StructEta.RecursionClassifier
+import Ix.Kernel.Verify.DefEq.FinalWhnf.ProofTail
+import Ix.Kernel.Verify.Infer.Constants
+import Ix.Kernel.Verify.Whnf.StructEta.RecursionClassifier
 
 /-!
 # Final-WHNF unit-like equality
@@ -8,15 +8,15 @@ import Ix.Tc.Verify.Whnf.StructEta.RecursionClassifier
 The operational classifier is proved exhaustively against the immutable
 catalog.  Its semantic conclusion uses one deliberately narrow inductive
 law: inhabitants of a type headed by a trusted zero-index inductive with one
-nullary constructor are definitionally equal.  Lean4Lean's current
+nullary constructor are definitionally equal.  Ix.Theory.Named's current
 `VEnv.addInduct` interface does not expose that law, so it remains an explicit
 construction obligation for the inductive-theory bridge rather than being
 inferred from concrete metadata alone.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Constructor metadata accepted by production's unit-like shortcut. -/
 def KConst.IsNullaryConstructor : KConst .anon → Prop
@@ -30,7 +30,7 @@ def KConst.IsUnitLikeInductive (catalog : Catalog) : KConst .anon → Prop
         ∃ ctor, catalog ctors[0]! = some ctor ∧ ctor.IsNullaryConstructor
   | _ => False
 
-/-- Semantic inductive law missing from Lean4Lean's current `addInduct`
+/-- Semantic inductive law missing from Ix.Theory.Named's current `addInduct`
 specification.  It is indexed by the exact trusted catalog shape and by the
 actual structurally translated type selected by production. -/
 structure FinalWhnfUnitTheory (trProj : RawProjRel)
@@ -252,4 +252,4 @@ end TryDefEqUnit
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/LazyDelta.lean b/Ix/Kernel/Verify/DefEq/LazyDelta.lean
similarity index 99%
rename from Ix/Tc/Verify/DefEq/LazyDelta.lean
rename to Ix/Kernel/Verify/DefEq/LazyDelta.lean
index 9a92b1e44..57dd93a2b 100644
--- a/Ix/Tc/Verify/DefEq/LazyDelta.lean
+++ b/Ix/Kernel/Verify/DefEq/LazyDelta.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.ProofIrrelevance
+import Ix.Kernel.Verify.DefEq.ProofIrrelevance
 
 /-!
 # Bounded lazy-delta DefEq closure
@@ -10,9 +10,9 @@ step and the stopped tail.  Individual reduction branches discharge those
 contracts in subsequent modules.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -280,4 +280,4 @@ theorem DefEqAfterProofIrrelevance.ofLazyDelta
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/LazyDeltaClosure.lean b/Ix/Kernel/Verify/DefEq/LazyDeltaClosure.lean
similarity index 93%
rename from Ix/Tc/Verify/DefEq/LazyDeltaClosure.lean
rename to Ix/Kernel/Verify/DefEq/LazyDeltaClosure.lean
index c3a2f4125..1716ac4dc 100644
--- a/Ix/Tc/Verify/DefEq/LazyDeltaClosure.lean
+++ b/Ix/Kernel/Verify/DefEq/LazyDeltaClosure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.LazyDeltaIteration
-import Ix.Tc.Verify.DefEq.StoppedContinuationClosure
+import Ix.Kernel.Verify.DefEq.LazyDeltaIteration
+import Ix.Kernel.Verify.DefEq.StoppedContinuationClosure
 
 /-!
 # Complete lazy-delta tier assembly
@@ -9,7 +9,7 @@ for a stopped pair.  This module joins those independently proved executable
 surfaces under the canonical K2 suffix/cache model.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -58,4 +58,4 @@ end DefEqAfterProofIrrelevance
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/LazyDeltaIteration.lean b/Ix/Kernel/Verify/DefEq/LazyDeltaIteration.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/LazyDeltaIteration.lean
rename to Ix/Kernel/Verify/DefEq/LazyDeltaIteration.lean
index 82913e244..bf6b3180a 100644
--- a/Ix/Tc/Verify/DefEq/LazyDeltaIteration.lean
+++ b/Ix/Kernel/Verify/DefEq/LazyDeltaIteration.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.EqualRankPrefix
-import Ix.Tc.Verify.DefEq.NatOffsetDecomposition
+import Ix.Kernel.Verify.DefEq.EqualRankPrefix
+import Ix.Kernel.Verify.DefEq.NatOffsetDecomposition
 
 /-!
 # Complete lazy-delta iteration assembly
@@ -14,7 +14,7 @@ DefEq, and finite run-scoped resources for same-head comparison and cache
 writes.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -108,4 +108,4 @@ end DefEqLazyDeltaStep
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/LoopFinish.lean b/Ix/Kernel/Verify/DefEq/LoopFinish.lean
similarity index 95%
rename from Ix/Tc/Verify/DefEq/LoopFinish.lean
rename to Ix/Kernel/Verify/DefEq/LoopFinish.lean
index 79e1411de..18a1926f0 100644
--- a/Ix/Tc/Verify/DefEq/LoopFinish.lean
+++ b/Ix/Kernel/Verify/DefEq/LoopFinish.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.ProjectionProbe
+import Ix.Kernel.Verify.DefEq.ProjectionProbe
 
 /-!
 # Lazy-delta loop finishing checks
@@ -9,9 +9,9 @@ the bounded driver.  This module discharges both accepting checks against the
 current pair and transports their result back through the loop invariant.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -63,4 +63,4 @@ theorem finishDefEqLazyDeltaStep_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/NatOffset.lean b/Ix/Kernel/Verify/DefEq/NatOffset.lean
similarity index 96%
rename from Ix/Tc/Verify/DefEq/NatOffset.lean
rename to Ix/Kernel/Verify/DefEq/NatOffset.lean
index 5aeee1ed3..103066960 100644
--- a/Ix/Tc/Verify/DefEq/NatOffset.lean
+++ b/Ix/Kernel/Verify/DefEq/NatOffset.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.LazyDelta
+import Ix.Kernel.Verify.DefEq.LazyDelta
 
 /-!
 # Nat-offset comparison
@@ -9,9 +9,9 @@ the literal case and leaves the latter path behind a separately named
 contract.  In particular, no negative result is assigned semantic meaning.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -182,7 +182,7 @@ theorem ofCandidates
     {uvars : Nat}
     (hafter : TryDefEqOffsetAfterCandidates.WFAt layer semantics trProj
       world support uvars) :
-    Ix.Tc.RecM.TryDefEqOffsetAfterZeroMiss.WFAt layer semantics trProj world
+    Ix.Kernel.RecM.TryDefEqOffsetAfterZeroMiss.WFAt layer semantics trProj world
       support uvars := by
   intro Delta state left right leftV rightV hleftSupport hrightSupport
     hleft hright
@@ -235,7 +235,7 @@ theorem tryDefEqOffsetAfterLiteral_wf
             have hrightValue := hrightZero rfl
             subst leftV
             subst rightV
-            exact Lean4Lean.VEnv.IsDefEqU.refl hleftWF
+            exact Ix.Theory.Named.VEnv.IsDefEqU.refl hleftWF
 
 namespace TryDefEqOffsetAfterLiteral
 
@@ -248,7 +248,7 @@ theorem ofZero
     (hzero : IsNatZero.WFAt layer semantics trProj world support uvars)
     (hafter : TryDefEqOffsetAfterZeroMiss.WFAt layer semantics trProj world
       support uvars) :
-    Ix.Tc.RecM.TryDefEqOffsetAfterLiteral.WFAt layer semantics trProj world
+    Ix.Kernel.RecM.TryDefEqOffsetAfterLiteral.WFAt layer semantics trProj world
       support uvars := by
   intro Delta state left right leftV rightV hleftSupport hrightSupport
     hleft hright
@@ -296,7 +296,7 @@ theorem tryDefEqOffset_wf
   exact RecM.WF.pure fun _ hanswer => by
     have hvalues := eq_of_beq hanswer
     cases hvalues
-    exact Lean4Lean.VEnv.IsDefEqU.refl hleftWF
+    exact Ix.Theory.Named.VEnv.IsDefEqU.refl hleftWF
 
 namespace TryDefEqOffset
 
@@ -308,7 +308,7 @@ theorem ofAfterLiteral
     (theory : WhnfTheory trProj world uvars)
     (hafter : TryDefEqOffsetAfterLiteral.WFAt layer semantics trProj world
       support uvars) :
-    Ix.Tc.RecM.TryDefEqOffset.WFAt layer semantics trProj world support
+    Ix.Kernel.RecM.TryDefEqOffset.WFAt layer semantics trProj world support
       uvars := by
   intro Delta state left right leftV rightV hleftSupport hrightSupport
     hleft hright
@@ -325,7 +325,7 @@ theorem ofContext
     (zeroContext : NatZeroContext world)
     (hafter : TryDefEqOffsetAfterCandidates.WFAt .noAccel semantics trProj
       world support uvars) :
-    Ix.Tc.RecM.TryDefEqOffset.WFAt .noAccel semantics trProj world support
+    Ix.Kernel.RecM.TryDefEqOffset.WFAt .noAccel semantics trProj world support
       uvars :=
   ofAfterLiteral theory <|
     TryDefEqOffsetAfterLiteral.ofZero theory
@@ -336,4 +336,4 @@ end TryDefEqOffset
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/NatOffsetDecomposition.lean b/Ix/Kernel/Verify/DefEq/NatOffsetDecomposition.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/NatOffsetDecomposition.lean
rename to Ix/Kernel/Verify/DefEq/NatOffsetDecomposition.lean
index 5fb8ce726..1d6d5d58e 100644
--- a/Ix/Tc/Verify/DefEq/NatOffsetDecomposition.lean
+++ b/Ix/Kernel/Verify/DefEq/NatOffsetDecomposition.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.NatOffset
-import Ix.Tc.Verify.Whnf.Iota.NatOffset
+import Ix.Kernel.Verify.DefEq.NatOffset
+import Ix.Kernel.Verify.Whnf.Iota.NatOffset
 
 /-!
 # Nat-offset decomposition and reconstruction
@@ -15,9 +15,9 @@ about successful parser/rebuilder executions.  The latter is indexed by the
 exact production runs, so it cannot authorize an unrelated generated term.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace TcM.WF
 
@@ -274,4 +274,4 @@ end TryDefEqOffsetAfterCandidates
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/NatReduction.lean b/Ix/Kernel/Verify/DefEq/NatReduction.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/NatReduction.lean
rename to Ix/Kernel/Verify/DefEq/NatReduction.lean
index 6327d751a..d64d279c0 100644
--- a/Ix/Tc/Verify/DefEq/NatReduction.lean
+++ b/Ix/Kernel/Verify/DefEq/NatReduction.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.NatOffset
+import Ix.Kernel.Verify.DefEq.NatOffset
 
 /-!
 # Lazy-delta Nat reduction
@@ -9,9 +9,9 @@ against the opposite operand.  This module composes the existing optional
 reducer and predecessor DefEq contracts with the lazy-delta pair invariant.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -127,4 +127,4 @@ end DefEqLazyDeltaAfterOffsetMiss
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/OneSidedDelta.lean b/Ix/Kernel/Verify/DefEq/OneSidedDelta.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/OneSidedDelta.lean
rename to Ix/Kernel/Verify/DefEq/OneSidedDelta.lean
index b6c5c8509..cdc0e215c 100644
--- a/Ix/Tc/Verify/DefEq/OneSidedDelta.lean
+++ b/Ix/Kernel/Verify/DefEq/OneSidedDelta.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.LoopFinish
+import Ix.Kernel.Verify.DefEq.LoopFinish
 
 /-!
 # One-sided lazy-delta unfolding
@@ -9,9 +9,9 @@ finishing checks.  This module gives those shared production helpers their
 complete pair-invariant contracts.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -116,4 +116,4 @@ theorem defEqLazyDeltaStepWithRightDelta_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaActive.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaActive.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaActive.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaActive.lean
index 761d03ecb..dab1c786f 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaActive.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaActive.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaRank
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaRank
 
 /-!
 # Active projection-delta branches
@@ -10,9 +10,9 @@ unfold, normalization, and finishing proofs into the exact lower-step
 contract used by the bounded projection driver.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -133,4 +133,4 @@ end LazyDeltaReductionStep
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaClosure.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaClosure.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaClosure.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaClosure.lean
index 35d6e2d1c..c2e8f645e 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaClosure.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaClosure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaActive
-import Ix.Tc.Verify.DefEq.ProjectionProbe
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaActive
+import Ix.Kernel.Verify.DefEq.ProjectionProbe
 
 /-!
 # Projection-directed delta closure
@@ -15,7 +15,7 @@ left here is `DirectProjectionReflection`, indexed by the exact successful
 execution of `tryProjReduce`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -121,4 +121,4 @@ end TryStructuralCongruence
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaEqualRank.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaEqualRank.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaEqualRank.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaEqualRank.lean
index dbb267250..4ccd66b7d 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaEqualRank.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaEqualRank.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.EqualRankCache
-import Ix.Tc.Verify.DefEq.ProjectionDeltaUnfolding
+import Ix.Kernel.Verify.DefEq.EqualRankCache
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaUnfolding
 
 /-!
 # Equal-rank projection-delta reduction
@@ -12,9 +12,9 @@ iteration is intentionally absent here; this proof follows the actual
 compact helper.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -183,4 +183,4 @@ theorem lazyDeltaReductionStepWithEqualRank_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaFinish.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaFinish.lean
similarity index 96%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaFinish.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaFinish.lean
index 7dfe06a60..298e94a1f 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaFinish.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaFinish.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaStep
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaStep
 
 /-!
 # Finishing a productive projection-directed delta step
@@ -9,9 +9,9 @@ reports equality or schedules the transformed pair for another bounded
 iteration.  This module proves that shared finish once.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -64,4 +64,4 @@ theorem finishLazyDeltaReductionStep_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaLoop.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaLoop.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaLoop.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaLoop.lean
index 19e0874b2..e23100fc8 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaLoop.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaLoop.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.StructuralCongruence
+import Ix.Kernel.Verify.DefEq.StructuralCongruence
 
 /-!
 # Projection-directed lazy-delta loop
@@ -10,9 +10,9 @@ final recursive comparison.  This module proves the bounded driver from
 exact contracts for those two lower helpers.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- A supported projection node exposes its value to the projection-directed
 loop. -/
@@ -228,4 +228,4 @@ end LazyDeltaProjReduction
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaRank.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaRank.lean
similarity index 95%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaRank.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaRank.lean
index f36da90b9..b28130a5f 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaRank.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaRank.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaEqualRank
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaEqualRank
 
 /-!
 # Projection-delta rank dispatch
@@ -9,9 +9,9 @@ Rank values carry no semantic authority: every selected helper is proved
 sound independently.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -68,4 +68,4 @@ theorem lazyDeltaReductionStepWithBothDelta_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaStep.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaStep.lean
similarity index 96%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaStep.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaStep.lean
index a95be5e66..49f579a13 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaStep.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaStep.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.DeltaClassification
-import Ix.Tc.Verify.DefEq.ProjectionReduction
+import Ix.Kernel.Verify.DefEq.DeltaClassification
+import Ix.Kernel.Verify.DefEq.ProjectionReduction
 
 /-!
 # Projection-directed delta step
@@ -12,7 +12,7 @@ success, absence, and partial-error behavior through the installed anonymous
 lazy-ingress contract.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -54,7 +54,7 @@ theorem lazyDeltaReductionStepAfterClassification_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {state : TcState .anon}
-    {leftSource rightSource : Lean4Lean.VExpr}
+    {leftSource rightSource : Ix.Theory.Named.VExpr}
     {left right : KExpr .anon} {aHead bHead : Option (KId .anon)}
     {aDelta bDelta : Bool}
     (hactive : LazyDeltaReductionAfterActive.WFAt layer semantics trProj
@@ -99,7 +99,7 @@ theorem lazyDeltaReductionStep_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {state : TcState .anon}
-    {leftSource rightSource : Lean4Lean.VExpr}
+    {leftSource rightSource : Ix.Theory.Named.VExpr}
     {left right : KExpr .anon}
     (ingress : AnonLazyIngressContext .noAccel semantics trProj world
       support)
@@ -151,4 +151,4 @@ end LazyDeltaReductionStep
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionDeltaUnfolding.lean b/Ix/Kernel/Verify/DefEq/ProjectionDeltaUnfolding.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/ProjectionDeltaUnfolding.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionDeltaUnfolding.lean
index 425ab6fa7..430bc046e 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionDeltaUnfolding.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionDeltaUnfolding.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaFinish
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaFinish
 
 /-!
 # One-sided projection-delta unfolding
@@ -9,9 +9,9 @@ finish.  The two theorems here cover both directions, including unfold
 misses and errors from either helper.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -111,4 +111,4 @@ theorem lazyDeltaReductionStepWithRightDelta_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionProbe.lean b/Ix/Kernel/Verify/DefEq/ProjectionProbe.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/ProjectionProbe.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionProbe.lean
index 5e7944929..09131a2a6 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionProbe.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionProbe.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.DeltaClassification
+import Ix.Kernel.Verify.DefEq.DeltaClassification
 
 /-!
 # Lazy-delta projection probe
@@ -10,9 +10,9 @@ closes both asymmetric branches, transporting a successful projection result
 into the loop's pair invariant.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -148,4 +148,4 @@ end DefEqLazyDeltaAfterDeltaClassification
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProjectionReduction.lean b/Ix/Kernel/Verify/DefEq/ProjectionReduction.lean
similarity index 96%
rename from Ix/Tc/Verify/DefEq/ProjectionReduction.lean
rename to Ix/Kernel/Verify/DefEq/ProjectionReduction.lean
index ec0ffd1df..bf151c577 100644
--- a/Ix/Tc/Verify/DefEq/ProjectionReduction.lean
+++ b/Ix/Kernel/Verify/DefEq/ProjectionReduction.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaLoop
-import Ix.Tc.Verify.Whnf.Projection.NoAccelTail
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaLoop
+import Ix.Kernel.Verify.Whnf.Projection.NoAccelTail
 
 /-!
 # Direct projection reduction inside DefEq
@@ -12,9 +12,9 @@ helper execution.  It therefore cannot authorize a different projection,
 input, result, method table, or pair of states.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -106,4 +106,4 @@ end TryProjReduce
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/ProofIrrelevance.lean b/Ix/Kernel/Verify/DefEq/ProofIrrelevance.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/ProofIrrelevance.lean
rename to Ix/Kernel/Verify/DefEq/ProofIrrelevance.lean
index 0dc6175be..69fea4359 100644
--- a/Ix/Tc/Verify/DefEq/ProofIrrelevance.lean
+++ b/Ix/Kernel/Verify/DefEq/ProofIrrelevance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.CheapReduction
-import Ix.Tc.Verify.Whnf.StructEta.CallbackPrefix
+import Ix.Kernel.Verify.DefEq.CheapReduction
+import Ix.Kernel.Verify.Whnf.StructEta.CallbackPrefix
 
 /-!
 # Pre-delta proof irrelevance
@@ -10,9 +10,9 @@ types recursively.  A positive result is justified by Theory proof
 irrelevance; caught callback errors remain ordinary misses.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -170,4 +170,4 @@ end DefEqAfterProofIrrelevance
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/PropositionClassifier.lean b/Ix/Kernel/Verify/DefEq/PropositionClassifier.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/PropositionClassifier.lean
rename to Ix/Kernel/Verify/DefEq/PropositionClassifier.lean
index ddc66951b..28d2118fa 100644
--- a/Ix/Tc/Verify/DefEq/PropositionClassifier.lean
+++ b/Ix/Kernel/Verify/DefEq/PropositionClassifier.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.DefEq.ProofIrrelevance
+import Ix.Kernel.Verify.DefEq.ProofIrrelevance
+
+open Ix.Theory (VLevel)
 
 /-!
 # Memoized proposition classification
@@ -10,9 +12,9 @@ type with the direct K1 reducer, and install only a provenance-certified
 classification.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Resources needed by the concrete proposition classifier.  Direct WHNF
 is the already-closed K1 reducer; inference remains a predecessor-table edge
@@ -226,4 +228,4 @@ theorem tryProofIrrel_classifier_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/RankDispatch.lean b/Ix/Kernel/Verify/DefEq/RankDispatch.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/RankDispatch.lean
rename to Ix/Kernel/Verify/DefEq/RankDispatch.lean
index b0cf3ee57..aabf7fc8c 100644
--- a/Ix/Tc/Verify/DefEq/RankDispatch.lean
+++ b/Ix/Kernel/Verify/DefEq/RankDispatch.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.OneSidedDelta
+import Ix.Kernel.Verify.DefEq.OneSidedDelta
 
 /-!
 # Lazy-delta rank dispatch
@@ -10,9 +10,9 @@ independently.  Their declaration lookups must nevertheless preserve the
 state invariant across lazy ingress.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -134,4 +134,4 @@ end DefEqLazyDeltaAfterProjectionMiss
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/SameHeadSpine.lean b/Ix/Kernel/Verify/DefEq/SameHeadSpine.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/SameHeadSpine.lean
rename to Ix/Kernel/Verify/DefEq/SameHeadSpine.lean
index 85c4dba3c..5dbd00743 100644
--- a/Ix/Tc/Verify/DefEq/SameHeadSpine.lean
+++ b/Ix/Kernel/Verify/DefEq/SameHeadSpine.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.DefEq.SpineArguments
+import Ix.Kernel.Verify.DefEq.SpineArguments
+
+open Ix.Theory (VLevel)
 
 /-!
 # Same-head constant spines
@@ -9,9 +11,9 @@ comparison, and successful recursive comparisons of every raw argument are
 lifted through the complete typed application spine.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLevel)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite support coverage needed by constant-headed spine comparison. -/
 structure SameHeadSpineResources (support : RunSupport) : Prop where
@@ -143,7 +145,7 @@ theorem constantHeadsDefEq
           cases hconst
           obtain ⟨hlength, hpairs⟩ := sameDefEqUniverses_sound hcollision
             hleftLevels hrightLevels hlevels
-          refine ⟨_, Lean4Lean.VEnv.IsDefEq.constDF hleftConst ?_ ?_ ?_ ?_⟩
+          refine ⟨_, Ix.Theory.Named.VEnv.IsDefEq.constDF hleftConst ?_ ?_ ?_ ?_⟩
           · intro level hmem
             obtain ⟨raw, hraw, rfl⟩ := List.mem_map.mp hmem
             exact hleftWF raw (by simpa using hraw)
@@ -284,4 +286,4 @@ end TrySameHeadSpine
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/SpineArguments.lean b/Ix/Kernel/Verify/DefEq/SpineArguments.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/SpineArguments.lean
rename to Ix/Kernel/Verify/DefEq/SpineArguments.lean
index 78cac35f7..d23cdccd9 100644
--- a/Ix/Tc/Verify/DefEq/SpineArguments.lean
+++ b/Ix/Kernel/Verify/DefEq/SpineArguments.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.EqualRankReduction
+import Ix.Kernel.Verify.DefEq.EqualRankReduction
 
 /-!
 # Recursive application-spine arguments
@@ -8,9 +8,9 @@ one left-to-right recursive DefEq loop.  This module proves that loop once
 and gives its positive result a compositional Theory meaning.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -204,10 +204,10 @@ theorem defEq_of_zip
             hleftArgTr hrightArgTr
           have hlastTyped :=
             hlastEq.of_l world.venvWF hDelta.toCtx hleftArg
-          exact ⟨_, Lean4Lean.VEnv.IsDefEq.appDF hcurrentTyped hlastTyped⟩
+          exact ⟨_, Ix.Theory.Named.VEnv.IsDefEq.appDF hcurrentTyped hlastTyped⟩
 
 end TrAppSpine
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/StoppedContinuation.lean b/Ix/Kernel/Verify/DefEq/StoppedContinuation.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/StoppedContinuation.lean
rename to Ix/Kernel/Verify/DefEq/StoppedContinuation.lean
index dde2cdbc3..67b77796d 100644
--- a/Ix/Tc/Verify/DefEq/StoppedContinuation.lean
+++ b/Ix/Kernel/Verify/DefEq/StoppedContinuation.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.ApplicationSpine
-import Ix.Tc.Verify.DefEq.StructuralCongruence
+import Ix.Kernel.Verify.DefEq.ApplicationSpine
+import Ix.Kernel.Verify.DefEq.StructuralCongruence
 
 /-!
 # Stopped lazy-delta continuation
@@ -11,9 +11,9 @@ and the final WHNF comparator in that order.  This module proves that exact
 outer control flow from contracts for its substantive helpers.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 
@@ -190,4 +190,4 @@ end DefEqAfterLazyDeltaStopped
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/StoppedContinuationClosure.lean b/Ix/Kernel/Verify/DefEq/StoppedContinuationClosure.lean
similarity index 94%
rename from Ix/Tc/Verify/DefEq/StoppedContinuationClosure.lean
rename to Ix/Kernel/Verify/DefEq/StoppedContinuationClosure.lean
index 9a0839005..87cb2d2e3 100644
--- a/Ix/Tc/Verify/DefEq/StoppedContinuationClosure.lean
+++ b/Ix/Kernel/Verify/DefEq/StoppedContinuationClosure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.ProjectionDeltaClosure
-import Ix.Tc.Verify.DefEq.StoppedContinuation
+import Ix.Kernel.Verify.DefEq.ProjectionDeltaClosure
+import Ix.Kernel.Verify.DefEq.StoppedContinuation
 
 /-!
 # Stopped-continuation closure
@@ -10,7 +10,7 @@ comparison.  This module constructs that resource record with the structural
 projection branch supplied by the concrete projection-delta closure.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -67,4 +67,4 @@ end DefEqAfterLazyDeltaStopped
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/StringLiteral.lean b/Ix/Kernel/Verify/DefEq/StringLiteral.lean
similarity index 98%
rename from Ix/Tc/Verify/DefEq/StringLiteral.lean
rename to Ix/Kernel/Verify/DefEq/StringLiteral.lean
index 2b33592fc..0a89eb4b4 100644
--- a/Ix/Tc/Verify/DefEq/StringLiteral.lean
+++ b/Ix/Kernel/Verify/DefEq/StringLiteral.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.BoolTrue
-import Ix.Tc.Verify.Whnf.Projection.StringExpansion
+import Ix.Kernel.Verify.DefEq.BoolTrue
+import Ix.Kernel.Verify.Whnf.Projection.StringExpansion
 
 /-!
 # String-literal definitional equality
@@ -11,9 +11,9 @@ stronger fact recorded here: that exact generated term translates to the same
 Theory literal as the compact source syntax.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- A K1 String-expansion plan together with the exact Theory meaning needed
 by DefEq.  Merely knowing that the generated expression has *some*
@@ -200,4 +200,4 @@ end DefEqAfterStringExpansion
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/Structural.lean b/Ix/Kernel/Verify/DefEq/Structural.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/Structural.lean
rename to Ix/Kernel/Verify/DefEq/Structural.lean
index 195fc3905..2fc370351 100644
--- a/Ix/Tc/Verify/DefEq/Structural.lean
+++ b/Ix/Kernel/Verify/DefEq/Structural.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Infer.BinderScopes
-import Ix.Tc.Verify.Infer.Callbacks
-import Ix.Tc.Verify.Infer.SortTypes
+import Ix.Kernel.Verify.Infer.BinderScopes
+import Ix.Kernel.Verify.Infer.Callbacks
+import Ix.Kernel.Verify.Infer.SortTypes
 
 /-!
 # Structural definitional equality
@@ -12,9 +12,9 @@ so its proof must be transported into the first domain's context before the
 recursive callback is invoked.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite resources needed to open both bodies of one quick binder
 comparison with the common production fvar. -/
@@ -220,8 +220,8 @@ theorem quickDefEq_wf
       have hbodyTyped : world.venv.IsDefEq uvars
           (ty1V :: Delta.toCtx) body1V body2V bodyTy :=
         hbodyEq.of_l world.venvWF hDeltaBody.toCtx (by
-          simpa [KVLCtx.toCtx, Lean4Lean.VEnv.HasType] using hbody1Typed)
-      exact (Lean4Lean.VEnv.IsDefEq.lamDF
+          simpa [KVLCtx.toCtx, Ix.Theory.Named.VEnv.HasType] using hbody1Typed)
+      exact (Ix.Theory.Named.VEnv.IsDefEq.lamDF
         hdomainTyped hbodyTyped).toU
     · intro _ _ _
       trivial
@@ -253,7 +253,7 @@ theorem quickDefEq_wf
           (ty1V :: Delta.toCtx) body1V body2V (.sort bodyLevel) :=
         hbodyEq.of_l world.venvWF hDeltaBody.toCtx (by
           simpa [KVLCtx.toCtx] using hbody1Sort)
-      exact (Lean4Lean.VEnv.IsDefEq.forallEDF
+      exact (Ix.Theory.Named.VEnv.IsDefEq.forallEDF
         hdomainTyped hbodyTyped).toU
     · intro _ _ _
       trivial
@@ -315,4 +315,4 @@ end DefEqAfterQuick
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/DefEq/StructuralCongruence.lean b/Ix/Kernel/Verify/DefEq/StructuralCongruence.lean
similarity index 97%
rename from Ix/Tc/Verify/DefEq/StructuralCongruence.lean
rename to Ix/Kernel/Verify/DefEq/StructuralCongruence.lean
index 08b130443..afe7c9131 100644
--- a/Ix/Tc/Verify/DefEq/StructuralCongruence.lean
+++ b/Ix/Kernel/Verify/DefEq/StructuralCongruence.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq.SameHeadSpine
+import Ix.Kernel.Verify.DefEq.SameHeadSpine
 
 /-!
 # Post-delta structural congruence
@@ -10,9 +10,9 @@ other shapes and all failed guards return `false` without a completeness
 claim.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite universe support for constant nodes selected by structural
 congruence. -/
@@ -94,7 +94,7 @@ theorem tryStructuralCongruence_wf
                 (hleftLookup.symm.trans hrightLookup)
               have hvalue : leftV = rightV := congrArg Prod.fst hp
               subst rightV
-              exact Lean4Lean.VEnv.IsDefEqU.refl hleftWF
+              exact Ix.Theory.Named.VEnv.IsDefEqU.refl hleftWF
   · rename_i leftId leftLevels leftInfo rightId rightLevels rightInfo
     exact RecM.WF.pure fun _ hanswer => by
       obtain ⟨hid, hlevels⟩ := Bool.and_eq_true_iff.mp hanswer
@@ -145,4 +145,4 @@ end TryStructuralCongruence
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/BooleanAcceptance.lean b/Ix/Kernel/Verify/Driver/BooleanAcceptance.lean
similarity index 99%
rename from Ix/Tc/Verify/Driver/BooleanAcceptance.lean
rename to Ix/Kernel/Verify/Driver/BooleanAcceptance.lean
index a10caebea..2690273ea 100644
--- a/Ix/Tc/Verify/Driver/BooleanAcceptance.lean
+++ b/Ix/Kernel/Verify/Driver/BooleanAcceptance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Driver.SupportedAcceptance
-import Ix.Tc.Verify.Inductive.EnumerationAcceptance
+import Ix.Kernel.Verify.Driver.SupportedAcceptance
+import Ix.Kernel.Verify.Inductive.EnumerationAcceptance
 
 /-!
 # Certificate-backed Boolean driver acceptance
@@ -20,7 +20,7 @@ then transported to each monotone current world and replayed idempotently;
 neither row constructs or admits an `InductiveOracle`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace BooleanEnumerationFixture
 
@@ -596,4 +596,4 @@ theorem subjectWF :
 
 end BooleanEnumerationFixture
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/Dependencies.lean b/Ix/Kernel/Verify/Driver/Dependencies.lean
similarity index 99%
rename from Ix/Tc/Verify/Driver/Dependencies.lean
rename to Ix/Kernel/Verify/Driver/Dependencies.lean
index 281c211ea..ace78133c 100644
--- a/Ix/Tc/Verify/Driver/Dependencies.lean
+++ b/Ix/Kernel/Verify/Driver/Dependencies.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Driver.Model
+import Ix.Kernel.Verify.Driver.Model
 
 /-!
 # Semantic dependencies of Ixon constants
@@ -15,7 +15,7 @@ the expression constructors which ingress turns into kernel constants:
 * `.nat`/`.str` are data dependencies, not Theory declaration dependencies.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace IxonExpr
 
@@ -179,4 +179,4 @@ theorem dependencyCatalog_dependsOn_iff (env : Ixon.Env)
 
 end IxonEnv
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/Enumeration.lean b/Ix/Kernel/Verify/Driver/Enumeration.lean
similarity index 99%
rename from Ix/Tc/Verify/Driver/Enumeration.lean
rename to Ix/Kernel/Verify/Driver/Enumeration.lean
index 16411f32b..8bb44fac5 100644
--- a/Ix/Tc/Verify/Driver/Enumeration.lean
+++ b/Ix/Kernel/Verify/Driver/Enumeration.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Driver.Dependencies
+import Ix.Kernel.Verify.Driver.Dependencies
 
 /-!
 # Exact `buildAnonWork` enumeration
@@ -14,7 +14,7 @@ Under that structural contract, the production builder succeeds, its
 collapses to its work item's root.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- `Except` carries no `DecidableEq` instance, so the `get`/`peekTag`
 equations of `ExactAnonEntry` cannot otherwise build the instance the
@@ -570,4 +570,4 @@ theorem buildAnonWork_exact {env : Ixon.Env}
 
 end AnonWorkEnvWF
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/Fixtures.lean b/Ix/Kernel/Verify/Driver/Fixtures.lean
similarity index 98%
rename from Ix/Tc/Verify/Driver/Fixtures.lean
rename to Ix/Kernel/Verify/Driver/Fixtures.lean
index 84c9403e4..1d3567768 100644
--- a/Ix/Tc/Verify/Driver/Fixtures.lean
+++ b/Ix/Kernel/Verify/Driver/Fixtures.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Driver.Serial
+import Ix.Kernel.Verify.Driver.Serial
 
 /-!
 # Adversarial E1 fixtures
@@ -9,7 +9,7 @@ coverage, dependency closure, or graph well-foundedness cannot be hidden by
 content-address computation.
 -/
 
-namespace Ix.Tc.E1Fixture
+namespace Ix.Kernel.E1Fixture
 
 def address (byte : UInt8) : Address :=
   ⟨⟨Array.replicate 32 byte⟩⟩
@@ -178,4 +178,4 @@ theorem cyclicStandalones_not_wellFounded :
   · rfl
   · simp [firstItem, secondItem, AnonWorkItem.root]
 
-end Ix.Tc.E1Fixture
+end Ix.Kernel.E1Fixture
diff --git a/Ix/Tc/Verify/Driver/Model.lean b/Ix/Kernel/Verify/Driver/Model.lean
similarity index 99%
rename from Ix/Tc/Verify/Driver/Model.lean
rename to Ix/Kernel/Verify/Driver/Model.lean
index a51e486a0..b10ae7417 100644
--- a/Ix/Tc/Verify/Driver/Model.lean
+++ b/Ix/Kernel/Verify/Driver/Model.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Check.BlockIdentity
+import Ix.Kernel.Verify.Check.BlockIdentity
 
 /-!
 # Workset and dependency model
@@ -16,7 +16,7 @@ and every projection address have the same `blockOf` image.  Standalones map
 to themselves.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-! ## Canonical finite address sets -/
 
@@ -366,4 +366,4 @@ theorem acceptedWorkset_subjectWF
   · intro addr haddr
     exact (hassumptions haddr).mono hfinal
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/Serial.lean b/Ix/Kernel/Verify/Driver/Serial.lean
similarity index 99%
rename from Ix/Tc/Verify/Driver/Serial.lean
rename to Ix/Kernel/Verify/Driver/Serial.lean
index 1a19001f4..1dc079c38 100644
--- a/Ix/Tc/Verify/Driver/Serial.lean
+++ b/Ix/Kernel/Verify/Driver/Serial.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Driver.Enumeration
+import Ix.Kernel.Verify.Driver.Enumeration
 
 /-!
 # Serial `checkEnvAnon` composition
@@ -14,7 +14,7 @@ needed by dependency-order composition.  The serial corollary therefore does
 not assume `AllAccepted` directly.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Every public result row reports success. -/
 def AllCheckResultsSucceeded (results : Array CheckResult) : Prop :=
@@ -226,4 +226,4 @@ theorem checkEnvAnon_subjectWF
 
 end AnonWorkEnvWF
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/SupportedAcceptance.lean b/Ix/Kernel/Verify/Driver/SupportedAcceptance.lean
similarity index 96%
rename from Ix/Tc/Verify/Driver/SupportedAcceptance.lean
rename to Ix/Kernel/Verify/Driver/SupportedAcceptance.lean
index f9c1e422d..e2c019ad2 100644
--- a/Ix/Tc/Verify/Driver/SupportedAcceptance.lean
+++ b/Ix/Kernel/Verify/Driver/SupportedAcceptance.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Check.PublicBlocks
-import Ix.Tc.Verify.Check.PublicStandalone
-import Ix.Tc.Verify.Driver.Serial
+import Ix.Kernel.Verify.Check.PublicBlocks
+import Ix.Kernel.Verify.Check.PublicStandalone
+import Ix.Kernel.Verify.Driver.Serial
 
 /-!
 # Supported production-checker acceptance
@@ -26,7 +26,7 @@ The source-to-kernel route agreement remains an explicit representation
 premise until the later ingress/refinement phase discharges it generically.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace AnonWorkItem
 
@@ -58,8 +58,8 @@ structure SupportedStandaloneResources
     (concrete : KConst .anon) : Type where
   pipelines : ScopedStandalonePipelineResources context.model support
     (context.calls (initial.recFuel.toNat + 1))
-    (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat)
-  decl : Lean4Lean.VDecl
+    (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat)
+  decl : Ix.Theory.Named.VDecl
   projection : trProj.SubstCompatible
   literals : ∀ literal, world.venv.ContainsLits literal
   pending : PendingDecl trProj world id decl
@@ -72,7 +72,7 @@ structure SupportedStandaloneResources
   route : StandaloneRoute
     (ScopedWhnfStateInv context.model .noAccel
       (kernelCacheSemantics context.model.keys trProj) support [])
-    (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat) concrete
+    (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat) concrete
 
 namespace SupportedStandaloneResources
 
@@ -108,7 +108,7 @@ end SupportedStandaloneResources
 /-- Exhaustive body evidence supported by the E3-S adapter.
 
 The first constructor is constructive K3 evidence for the only definition
-block shape currently modeled atomically by Lean4Lean: one definition.  The
+block shape currently modeled atomically by Ix.Theory.Named: one definition.  The
 second constructor keeps the E2 inductive/recursor oracle visible.  In
 particular there is no constructor containing a prebuilt
 `CertifiedBlockBodySuccess`. -/
@@ -122,10 +122,10 @@ inductive SupportedBlockBodyResources
       TcState .anon → TcState .anon → Prop
   | singletonDefinition
       {block requested member : KId .anon} {concrete : KConst .anon}
-      {decl : Lean4Lean.VDecl} {before after : TcState .anon}
+      {decl : Ix.Theory.Named.VDecl} {before after : TcState .anon}
       (pipelines : ScopedStandalonePipelineResources context.model support
         (context.calls (initial.recFuel.toNat + 1))
-        (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat))
+        (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat))
       (projection : trProj.SubstCompatible)
       (literals : ∀ literal, world.venv.ContainsLits literal)
       (pending : PendingDecl trProj world member decl)
@@ -168,17 +168,17 @@ theorem certify
       kind before after)
     (hexact : ExactCheckBlock world block members kind)
     (trace : RecM.ExactBlockBodySuccessTrace
-      (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat)
+      (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat)
       block requested members kind before after) :
     CertifiedBlockBodySuccess
       (kernelCacheSemantics context.model.keys trProj) trProj world support
-      (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat)
+      (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat)
       block requested members kind before after := by
   cases resources with
   | singletonDefinition pipelines projection literals pending catalog
       validation covered collision uvars resetScope initialInv lazyFault
       blocksAfter =>
-      let methods := Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat
+      let methods := Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat
       have hmethods : Methods.ScopedWFAtOn context.model .noAccel
           (kernelCacheSemantics context.model.keys trProj) support
           (context.calls (initial.recFuel.toNat + 1))
@@ -291,7 +291,7 @@ theorem le_admittedWorld
     (resources : CertificateBackedBlockResources world blockAddr primary
       targets) :
     world ≤ resources.admittedWorld :=
-  ⟨rfl, rfl, rfl, fun {_} hold => Or.inr hold, Lean4Lean.VEnv.LE.rfl⟩
+  ⟨rfl, rfl, rfl, fun {_} hold => Or.inr hold, Ix.Theory.Named.VEnv.LE.rfl⟩
 
 /-- Reindex installed semantic entries across an arbitrary monotone current
 world. This is the reusable bridge used by E1 after prior work items have
@@ -391,14 +391,14 @@ structure SupportedCheckRun (world : VerifyWorld) (item : AnonWorkItem)
     TcM.getConst (⟨item.primary, ()⟩ : KId .anon) initial =
         .ok concrete loaded →
     (RecM.coordinatedBlockFor concrete).run
-        (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat) loaded =
+        (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat) loaded =
         .ok selected routed →
     item.SelectedBlockMatches selected
   standalone : ∀ {concrete : KConst .anon} {loaded routed : TcState .anon},
     TcM.getConst (⟨item.primary, ()⟩ : KId .anon) initial =
         .ok concrete loaded →
     (RecM.coordinatedBlockFor concrete).run
-        (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat) loaded =
+        (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat) loaded =
         .ok none routed →
     SupportedStandaloneResources context concrete
   blockBody : ∀ {block : KId .anon} {members : Array (KId .anon)}
@@ -406,7 +406,7 @@ structure SupportedCheckRun (world : VerifyWorld) (item : AnonWorkItem)
     ExactCheckBlock world block members kind →
     (⟨item.primary, ()⟩ : KId .anon) ∈ members →
     RecM.ExactBlockBodySuccessTrace
-      (Ix.Tc.methodsN (m := .anon) initial.recFuel.toNat)
+      (Ix.Kernel.methodsN (m := .anon) initial.recFuel.toNat)
       block (⟨item.primary, ()⟩ : KId .anon) members kind routed
         bodyAfter →
     SupportedBlockBodyResources context block
@@ -668,4 +668,4 @@ theorem checkEnvAnon_supported_subjectWF
 
 end AnonWorkEnvWF
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Driver/SupportedAcceptanceFixtures.lean b/Ix/Kernel/Verify/Driver/SupportedAcceptanceFixtures.lean
similarity index 95%
rename from Ix/Tc/Verify/Driver/SupportedAcceptanceFixtures.lean
rename to Ix/Kernel/Verify/Driver/SupportedAcceptanceFixtures.lean
index 3003e1764..4feb1f616 100644
--- a/Ix/Tc/Verify/Driver/SupportedAcceptanceFixtures.lean
+++ b/Ix/Kernel/Verify/Driver/SupportedAcceptanceFixtures.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Driver.Fixtures
-import Ix.Tc.Verify.Driver.SupportedAcceptance
-import Ix.Tc.Verify.Inductive.EnumerationAcceptance
+import Ix.Kernel.Verify.Driver.Fixtures
+import Ix.Kernel.Verify.Driver.SupportedAcceptance
+import Ix.Kernel.Verify.Inductive.EnumerationAcceptance
 
 /-!
 # Supported-acceptance adversarial and inductive fixtures
@@ -13,7 +13,7 @@ constructor; the only remaining inputs are the explicitly advertised scoped
 recursive context and active cache invariant.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace SupportedAcceptanceFixture
 
@@ -88,7 +88,7 @@ theorem booleanFamilyBody_certified
     CertifiedBlockBodySuccess
       (kernelCacheSemantics context.model.keys RawProjRel.none)
       RawProjRel.none BooleanEnumerationFixture.world support
-      (Ix.Tc.methodsN (m := .anon)
+      (Ix.Kernel.methodsN (m := .anon)
         BooleanEnumerationFixture.checkerInitial.recFuel.toNat)
       BooleanEnumerationFixture.familyBlockId
       BooleanEnumerationFixture.familyId
@@ -103,4 +103,4 @@ theorem booleanFamilyBody_certified
 
 end SupportedAcceptanceFixture
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Env.lean b/Ix/Kernel/Verify/Env.lean
similarity index 98%
rename from Ix/Tc/Verify/Env.lean
rename to Ix/Kernel/Verify/Env.lean
index b3c1283bf..413f7b6b4 100644
--- a/Ix/Tc/Verify/Env.lean
+++ b/Ix/Kernel/Verify/Env.lean
@@ -1,8 +1,10 @@
-import Ix.Tc.Verify.Trans
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.Inductive
-import Ix.Tc.Const
-import Ix.Tc.Env
+import Ix.Kernel.Verify.Trans
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.Inductive
+import Ix.Kernel.Const
+import Ix.Kernel.Env
+
+open Ix.Theory (VLevel)
 
 /-!
 # Environment translation: `KEnv` ↔ `VEnv`
@@ -86,10 +88,10 @@ theorem le_antisymm {a b : Ix.DefinitionSafety} :
 
 end Ix.DefinitionSafety
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
-open Lean4Lean (VExpr VLevel VEnv VConstant VConstVal VDefVal VDecl
+open Ix.Theory.Named (VExpr VEnv VConstant VConstVal VDefVal VDecl
   VInductDecl)
 
 /-! ### Constant safety -/
@@ -417,10 +419,10 @@ arbitrary well-formed Theory constant. It must select the exact constant and
 Lean name installed by `VEnv.addQuot` for the concrete declaration's role. -/
 inductive QuotientConstRel :
     Ix.QuotKind → Lean.Name → VConstant → Prop
-  | quotType : QuotientConstRel .type ``Quot Lean4Lean.quotConst
-  | quotCtor : QuotientConstRel .ctor ``Quot.mk Lean4Lean.quotMkConst
-  | quotLift : QuotientConstRel .lift ``Quot.lift Lean4Lean.quotLiftConst
-  | quotInd : QuotientConstRel .ind ``Quot.ind Lean4Lean.quotIndConst
+  | quotType : QuotientConstRel .type ``Quot Ix.Theory.Named.quotConst
+  | quotCtor : QuotientConstRel .ctor ``Quot.mk Ix.Theory.Named.quotMkConst
+  | quotLift : QuotientConstRel .lift ``Quot.lift Ix.Theory.Named.quotLiftConst
+  | quotInd : QuotientConstRel .ind ``Quot.ind Ix.Theory.Named.quotIndConst
 
 /-- Provenance for one trusted catalog id. Standalone entries retain their
 actual declaration-WF transition. Ambient inductive-family entries retain the
@@ -543,7 +545,7 @@ theorem recursorRule {trProj : RawProjRel} {catalog : Catalog}
       subst c
       exact False.elim hrule
 
-/-- Recover the exact Lean4Lean iota-pattern witness associated with a
+/-- Recover the exact Ix.Theory.Named iota-pattern witness associated with a
 trusted concrete recursor rule. -/
 theorem recursorPattern {trProj : RawProjRel} {catalog : Catalog}
     {nameOf : Address → Option Lean.Name} {env : VEnv}
@@ -1002,7 +1004,7 @@ theorem IllTypedPending.trustedCatalogRel :
 
 namespace WellTypedPromotion
 
-def targetName : Lean.Name := `Ix.Tc.Verify.wellTypedPromotion
+def targetName : Lean.Name := `Ix.Kernel.Verify.wellTypedPromotion
 
 def fixtureAddress : Address :=
   ⟨⟨Array.replicate 32 1⟩⟩
@@ -1060,7 +1062,7 @@ theorem pending : PendingDecl RawProjRel.none world targetId theoryDecl := by
 
 theorem theoryConstant_wf :
     theoryConstant.toVConstant.WF world.venv := by
-  exact ⟨.succ .zero, Lean4Lean.VEnv.HasType.sort (l := .zero) trivial⟩
+  exact ⟨.succ .zero, Ix.Theory.Named.VEnv.HasType.sort (l := .zero) trivial⟩
 
 theorem addConst :
     world.venv.addConst targetName theoryConstant.toVConstant =
@@ -1085,4 +1087,4 @@ theorem promotes :
 
 end WellTypedPromotion
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/EquivalenceManager.lean b/Ix/Kernel/Verify/EquivalenceManager.lean
similarity index 99%
rename from Ix/Tc/Verify/EquivalenceManager.lean
rename to Ix/Kernel/Verify/EquivalenceManager.lean
index 7cc2c4719..0cadc80b9 100644
--- a/Ix/Tc/Verify/EquivalenceManager.lean
+++ b/Ix/Kernel/Verify/EquivalenceManager.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Totalization
-import Ix.Tc.Verify.Expr
+import Ix.Kernel.Verify.Totalization
+import Ix.Kernel.Verify.Expr
 import Batteries.Data.Array.Lemmas
 import Std.Data.HashMap.Lemmas
 
@@ -14,7 +14,7 @@ edge remains semantically valid.  That is sufficient for sound positive
 queries, root representatives, path compression, and union.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace EquivManager
 
@@ -561,4 +561,4 @@ end WF
 
 end EquivManager
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Execution.lean b/Ix/Kernel/Verify/Execution.lean
similarity index 99%
rename from Ix/Tc/Verify/Execution.lean
rename to Ix/Kernel/Verify/Execution.lean
index 7c84bb886..4cac142ea 100644
--- a/Ix/Tc/Verify/Execution.lean
+++ b/Ix/Kernel/Verify/Execution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Support
+import Ix.Kernel.Verify.Support
 
 /-!
 # G3b: execution-indexed finite run assumptions
@@ -23,7 +23,7 @@ skeletons can use its concrete execution and support boundary without
 colliding with their temporary translation-relation placeholders.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- A proof-level decomposition of a `TcM` computation into audited
 interning operations. Lists conservatively include all continuation/handler
@@ -253,4 +253,4 @@ theorem requestBounds {α : Type} {initial : TcState .anon}
 
 end RunAssumptions
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Expr.lean b/Ix/Kernel/Verify/Expr.lean
similarity index 99%
rename from Ix/Tc/Verify/Expr.lean
rename to Ix/Kernel/Verify/Expr.lean
index f7b0c7391..9f27b7c6d 100644
--- a/Ix/Tc/Verify/Expr.lean
+++ b/Ix/Kernel/Verify/Expr.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Env
-import Ix.Tc.Verify.Level
+import Ix.Kernel.Env
+import Ix.Kernel.Verify.Level
 import Std.Data.HashMap.Lemmas
 
 /-!
@@ -31,7 +31,7 @@ module keeps as a named finite-support hypothesis — never a global axiom
 instance.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 variable {m : Mode}
 
@@ -434,4 +434,4 @@ theorem internExpr_addr (hwf : it.WF)
 
 end InternTable
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Frame.lean b/Ix/Kernel/Verify/Frame.lean
similarity index 98%
rename from Ix/Tc/Verify/Frame.lean
rename to Ix/Kernel/Verify/Frame.lean
index 94948ac13..dccb04baa 100644
--- a/Ix/Tc/Verify/Frame.lean
+++ b/Ix/Kernel/Verify/Frame.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Subst
+import Ix.Kernel.Verify.Subst
 
 /-!
 # Intern-table frame lemmas
 
-The expression walkers in `Ix.Tc.Subst` mutate only the expression side of
+The expression walkers in `Ix.Kernel.Subst` mutate only the expression side of
 `InternTable`.  Their semantic master theorems establish expression support
 and table well-formedness, but the run-scoped invariant also tracks the finite
 universe range.  This file proves the missing operational frame directly from
@@ -14,7 +14,7 @@ The small effect predicates make sequential state threading explicit.  They
 are intentionally restricted to anon mode, matching the verified kernel.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- An `InternM` action leaves the universe intern map unchanged. -/
 def InternPreservesUnivs (x : InternM .anon α) : Prop :=
@@ -32,7 +32,7 @@ theorem pure (a : α) : InternPreservesUnivs (pure a) := by
   rfl
 
 theorem runWalk {x : WalkM .anon α} (h : WalkPreservesUnivs x) :
-    InternPreservesUnivs (Ix.Tc.runWalk x) := by
+    InternPreservesUnivs (Ix.Kernel.runWalk x) := by
   intro it
   exact h it {}
 
@@ -53,12 +53,12 @@ theorem bind {x : WalkM .anon α} {f : α → WalkM .anon β}
   exact (hf _ _ _).trans (hx _ _)
 
 theorem scratchGet (key : Address × UInt64) :
-    WalkPreservesUnivs (Ix.Tc.scratchGet? key) := by
+    WalkPreservesUnivs (Ix.Kernel.scratchGet? key) := by
   intro it sc
   rfl
 
 theorem scratchInsert (key : Address × UInt64) (e : KExpr .anon) :
-    WalkPreservesUnivs (Ix.Tc.scratchInsert key e) := by
+    WalkPreservesUnivs (Ix.Kernel.scratchInsert key e) := by
   intro it sc
   rfl
 
@@ -837,4 +837,4 @@ theorem abstractFVars_preservesUnivs (body : KExpr .anon)
   · exact .pure _
   · exact .runWalk (abstractFVarsCached_preservesUnivs body _ _ 0)
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Upstream/Pending.lean b/Ix/Kernel/Verify/Frontier/Pending.lean
similarity index 69%
rename from Ix/Tc/Verify/Upstream/Pending.lean
rename to Ix/Kernel/Verify/Frontier/Pending.lean
index 58ea11c17..56660c6be 100644
--- a/Ix/Tc/Verify/Upstream/Pending.lean
+++ b/Ix/Kernel/Verify/Frontier/Pending.lean
@@ -1,25 +1,25 @@
-import Ix.Tc.Verify.Inductive.BlockPatternSoundness
-import Lean4Lean.Verify.Environment.MutualInductiveFixtures
+import Ix.Kernel.Verify.Inductive.BlockPatternSoundness
+import Ix.Theory.Named.Verify.Environment.MutualInductiveFixtures
 
 /-!
-# Quarantined pending-upstream witnesses
+# Quarantined pending metatheory witnesses
 
 Nothing in this module may state an Ix ingress, address, ownership, checker,
 cache, collision, or workset fact.  Conditional consumers import it directly;
 unconditional completed roots must not depend on it.
 -/
 
-namespace Ix.Tc.Upstream.Pending
+namespace Ix.Kernel.Frontier.Pending
 
-open Lean4Lean
-open Lean4Lean.MutualInductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.MutualInductiveFixtures
 
 /-! ## Physical mutual-family permutation
 
 Ix's canonical mutual SCC order for this fixture is `TreeList, Tree`, while
-the retained Lean declaration order is `Tree, TreeList`.  Lean4Lean can
-compute the exact reversed generation descriptor today; the missing upstream
-piece is a theorem transporting block-generation WF across that family
+the retained Lean declaration order is `Tree, TreeList`. The named specification
+computes the exact reversed generation descriptor; the missing local
+proof transports block-generation WF across that family
 permutation. -/
 
 def mutualTreePhysicalDecl : VInductDecl :=
@@ -33,7 +33,7 @@ def mutualTreePhysicalBlockEnv : VEnv :=
   (VEnv.empty.stageInductiveTypes mutualTreePhysicalDecl.types).get
     (by decide)
 
-/-- Fixture-specific stand-in for the future Lean4Lean permutation theorem
+/-- Fixture-specific stand-in for the missing named-specification permutation theorem
 `VInductDecl.BlockGenerationChecked.permuteFamiliesWF`.
 
 This is a Theory-only statement: it certifies the computed `TreeList, Tree`
@@ -63,15 +63,14 @@ def mutualTreePhysicalCertificate :
   success := mutualTreePhysicalSuccess
   beforeWF := ⟨[], .empty⟩
 
-/-- Fixture-specific stand-in for the future Lean4Lean consumer theorem
+/-- Fixture-specific stand-in for the missing named-specification consumer theorem
 `VInductDecl.BlockCertificate.recursorPatternSound` (the constructive wrapper
 around `BlockGenerationChecked.pat_wf`).
 
-The current pin exposes the exact pattern payload and its registered rule but
-does not yet publish this environment-parametric consumer conclusion without
-the upstream metatheory gap.  Delete this declaration, and replace its sole
-use with that theorem, when the upstream result lands. -/
+The local specification exposes the exact pattern payload and its registered
+rule. This conclusion still requires a metatheory proof. Completing that proof
+must replace this axiom and its sole conditional use. -/
 axiom mutualTreePhysicalRulePatternSound :
   CertifiedBlockRulePatternSound mutualTreePhysicalCertificate
 
-end Ix.Tc.Upstream.Pending
+end Ix.Kernel.Frontier.Pending
diff --git a/Ix/Tc/Verify/Inductive.lean b/Ix/Kernel/Verify/Inductive.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive.lean
rename to Ix/Kernel/Verify/Inductive.lean
index baa2535c2..82567cb06 100644
--- a/Ix/Tc/Verify/Inductive.lean
+++ b/Ix/Kernel/Verify/Inductive.lean
@@ -1,12 +1,14 @@
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.Inductive.Certificate
-import Ix.Tc.Verify.Trans
-import Lean4Lean.Theory.Typing.Pattern
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Kernel.Verify.Trans
+import Ix.Theory.Named.Typing.Pattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Ambient inductive oracle
 
-G2 introduced this interface before Lean4Lean had a usable inductive
+G2 introduced this interface before Ix.Theory.Named had a usable inductive
 specification, so it records the semantic consequences needed by the checker
 directly:
 
@@ -17,7 +19,7 @@ directly:
 * every concrete recursor rule has an explicit, well-formed Theory defeq
   witness headed by that recursor.
 
-Pin A now provides Lean4Lean's proved normalized `GenerationCertificate` and
+Pin A now provides Ix.Theory.Named's proved normalized `GenerationCertificate` and
 `addInductCertified` transaction. `Inductive/Certificate.lean` derives the
 Theory-owned environment, lookup, freshness, and rule-registration facts from
 that certificate. It intentionally cannot supply the Ix-owned catalog/name
@@ -31,9 +33,9 @@ closed Nat model while the recursor clause prevents WHNF proofs from treating
 computation rules as an unrecorded ambient fact.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstant VDefEq VEnv VExpr)
+open Ix.Theory.Named (VConstant VDefEq VEnv VExpr)
 
 /-- Concrete declaration kinds admitted through an ambient inductive block.
 Standalone declarations and quotients cannot cross this boundary. -/
@@ -125,12 +127,12 @@ def KConst.ConstructorAt (c : KConst .anon) (index : Nat)
 
 /-- A Theory expression is an application spine headed by `name`. -/
 inductive HeadConst (name : Lean.Name) : VExpr → Prop
-  | const (levels : List Lean4Lean.VLevel) :
+  | const (levels : List Ix.Theory.VLevel) :
     HeadConst name (.const name levels)
   | app {fn arg : VExpr} : HeadConst name fn → HeadConst name (.app fn arg)
 
 /-- A closed rewrite equation may bind its complete rule telescope before
-the recursor-headed application.  Lean4Lean's generated iota equations and
+the recursor-headed application.  Ix.Theory.Named's generated iota equations and
 production's stored `RecRule.rhs` both use exactly this closed-lambda shape;
 requiring `HeadConst name defeq.lhs` at the outer node would reject every
 nonempty generated rule telescope. -/
@@ -168,7 +170,7 @@ end HeadConstUnderLambdas
 head.  This is the counted form needed to distinguish an iota major from an
 arbitrary later occurrence of the same constructor. -/
 inductive HeadConstN (name : Lean.Name) : Nat → VExpr → Prop
-  | const (levels : List Lean4Lean.VLevel) :
+  | const (levels : List Ix.Theory.VLevel) :
     HeadConstN name 0 (.const name levels)
   | app {arity : Nat} {fn arg : VExpr} :
     HeadConstN name arity fn → HeadConstN name (arity + 1) (.app fn arg)
@@ -178,21 +180,21 @@ namespace HeadConstN
 /-- Matching `varN (const name) arity` exposes exactly that many application
 arguments over `name`. -/
 theorem of_varN_matches {name : Lean.Name} {arity : Nat} {source : VExpr}
-    {levels : List Lean4Lean.VLevel}
-    {captures : ((Lean4Lean.Pattern.const name).varN arity).Path → VExpr}
-    (h : Lean4Lean.Pattern.Matches
-      ((Lean4Lean.Pattern.const name).varN arity)
+    {levels : List Ix.Theory.VLevel}
+    {captures : ((Ix.Theory.Named.Pattern.const name).varN arity).Path → VExpr}
+    (h : Ix.Theory.Named.Pattern.Matches
+      ((Ix.Theory.Named.Pattern.const name).varN arity)
       source levels captures) :
     HeadConstN name arity source := by
   induction arity generalizing source with
   | zero =>
-      change Lean4Lean.Pattern.Matches (.const name)
+      change Ix.Theory.Named.Pattern.Matches (.const name)
         source levels captures at h
       cases h
       exact .const levels
   | succ arity ih =>
-      change Lean4Lean.Pattern.Matches
-        (.var ((Lean4Lean.Pattern.const name).varN arity))
+      change Ix.Theory.Named.Pattern.Matches
+        (.var ((Ix.Theory.Named.Pattern.const name).varN arity))
         source levels captures at h
       cases h with
       | var hprefix =>
@@ -204,8 +206,8 @@ end HeadConstN
 /-- Exact Theory pattern selected by an ordinary constructor iota rule. -/
 def RecursorIotaPattern (recursorName : Lean.Name) (majorIdx : Nat)
     (constructorName : Lean.Name) (constructorArgs : Nat) :
-    Lean4Lean.Pattern :=
-  (Lean4Lean.SimplePattern.iota recursorName majorIdx constructorName
+    Ix.Theory.Named.Pattern :=
+  (Ix.Theory.Named.SimplePattern.iota recursorName majorIdx constructorName
     constructorArgs).toPattern
 
 namespace RecursorIotaPattern
@@ -216,17 +218,17 @@ contains precisely the parameters/motives/minors/indices before it. -/
 theorem matches_shape
     {recursorName constructorName : Lean.Name}
     {majorIdx constructorArgs : Nat} {source : VExpr}
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern recursorName majorIdx constructorName
       constructorArgs).Path → VExpr}
-    (h : Lean4Lean.Pattern.Matches
+    (h : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern recursorName majorIdx constructorName
         constructorArgs) source levels captures) :
     ∃ recursorPrefix major,
       source = .app recursorPrefix major ∧
       HeadConstN recursorName majorIdx recursorPrefix ∧
       HeadConstN constructorName constructorArgs major := by
-  simp only [RecursorIotaPattern, Lean4Lean.SimplePattern.toPattern] at h
+  simp only [RecursorIotaPattern, Ix.Theory.Named.SimplePattern.toPattern] at h
   cases h with
   | app hrecursor hconstructor =>
       exact ⟨_, _, rfl, HeadConstN.of_varN_matches hrecursor,
@@ -342,7 +344,7 @@ end RawRecursorRuleRel
 `RawRecursorRuleRel` records a registered equation and its translated RHS,
 but a recursor-headed expression alone does not determine which argument is
 the major or which constructor rule was selected.  This relation retains the
-missing data in Lean4Lean's own rewrite vocabulary:
+missing data in Ix.Theory.Named's own rewrite vocabulary:
 
 * the rule's exact array index and the production major index;
 * the exact catalogued constructor at that index, including parameter and
@@ -399,14 +401,14 @@ def RecursorRulePattern.Sound (env : VEnv)
   ∀ {env' : VEnv}, env ≤ env' →
     env'.WF →
     ∀ {uvars : Nat} {Gamma : List VExpr} {source : VExpr}
-      {levels : List Lean4Lean.VLevel}
+      {levels : List Ix.Theory.VLevel}
       {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
           pattern.constructorFields.toNat)).Path → VExpr}
       {A : VExpr},
-      Lean4Lean.OnCtx Gamma (env'.IsType uvars) →
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.OnCtx Gamma (env'.IsType uvars) →
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern pattern.recursorName pattern.majorIdx
           pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -436,14 +438,14 @@ def RawRecursorRulePatternRel (env : VEnv) (catalog : Catalog)
   ∀ {env' : VEnv}, env ≤ env' →
     env'.WF →
     ∀ {uvars : Nat} {Gamma : List VExpr} {source : VExpr}
-      {levels : List Lean4Lean.VLevel}
+      {levels : List Ix.Theory.VLevel}
       {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
           pattern.constructorFields.toNat)).Path → VExpr}
       {A : VExpr},
-      Lean4Lean.OnCtx Gamma (env'.IsType uvars) →
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.OnCtx Gamma (env'.IsType uvars) →
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern pattern.recursorName pattern.majorIdx
           pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -668,4 +670,4 @@ def restageMissing
 
 end InductiveOracle
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/AliasFormerAdmission.lean b/Ix/Kernel/Verify/Inductive/AliasFormerAdmission.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/AliasFormerAdmission.lean
rename to Ix/Kernel/Verify/Inductive/AliasFormerAdmission.lean
index f5f84d8e8..e0ad3d12c 100644
--- a/Ix/Tc/Verify/Inductive/AliasFormerAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasFormerAdmission.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.AliasFormerPattern
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.AliasFormerPattern
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Oracle-free family-result-normalizing singleton admission
@@ -12,10 +12,10 @@ the family world.  The sole iota pattern is justified by the registered
 generated equation, not by an inductive oracle.
 -/
 
-namespace Ix.Tc.AliasFormerRecursorFixture
+namespace Ix.Kernel.AliasFormerRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AliasFormerCertificateFixture
 open AliasFormerFixture
 
@@ -403,4 +403,4 @@ theorem aliasFormerAtomicClosure : AliasFormerAtomicClosure where
   iota := AliasFormerPattern.patternRel concreteRule_ruleAt
   familyResultNormalization := AliasFormerCertificateFixture.breadth
 
-end Ix.Tc.AliasFormerRecursorFixture
+end Ix.Kernel.AliasFormerRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasFormerCertificate.lean b/Ix/Kernel/Verify/Inductive/AliasFormerCertificate.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/AliasFormerCertificate.lean
rename to Ix/Kernel/Verify/Inductive/AliasFormerCertificate.lean
index 10f443821..54c3894b8 100644
--- a/Ix/Tc/Verify/Inductive/AliasFormerCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasFormerCertificate.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Inductive.ProducedGenerationTransaction
-import Lean4Lean.Verify.Environment.InductiveFixtures
+import Ix.Kernel.Verify.Inductive.ProducedGenerationTransaction
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
 
 /-!
 # Certified family-result-normalizing fixture
 
 `AliasFormer` is declared with the raw result sort `TypeFamilyAlias`, a
-transparent alias for `Type`.  Lean4Lean's ordinary candidate pipeline
+transparent alias for `Type`.  Ix.Theory.Named's ordinary candidate pipeline
 normalizes that result to `Sort 1` before dependent inductive analysis while
 retaining the raw family and constructor declarations in the generated
 environment.
@@ -15,11 +15,11 @@ anonymous ingress, production checking, and catalog admission are separate
 layers built on this certificate.
 -/
 
-namespace Ix.Tc.AliasFormerCertificateFixture
+namespace Ix.Kernel.AliasFormerCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 noncomputable section
 
@@ -53,8 +53,8 @@ theorem beforeWF : typeFamilyAliasEnv.WF :=
 /-- Exact post-environment selected by that certificate. -/
 def finalEnv : VEnv := aliasFormerFinalEnv
 
-/-- The exact L4L-01E package.  Its producer-shape index is deliberately
-inferred here because Lean4Lean keeps the fixture's concrete shape witness
+/-- The exact Spec-01E package.  Its producer-shape index is deliberately
+inferred here because Ix.Theory.Named keeps the fixture's concrete shape witness
 private while exposing this public dependent existence theorem. -/
 def exactPackage :=
   Classical.choice aliasFormerExactProducedGenerationCandidatePackage_exists
@@ -75,7 +75,7 @@ def exactProducedTransaction :=
       exact aliasFormer_addInductCertified_checked)
     beforeWF
 
-/-- Intentional operational erasure of the exact L4L-01E indices. -/
+/-- Intentional operational erasure of the exact Spec-01E indices. -/
 def producedTransaction :
     ProducedGenerationTransaction typeFamilyAliasEnv finalEnv [] :=
   exactProducedTransaction.toProduced
@@ -191,4 +191,4 @@ theorem certifiedFacts :
 
 end
 
-end Ix.Tc.AliasFormerCertificateFixture
+end Ix.Kernel.AliasFormerCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasFormerFixture.lean b/Ix/Kernel/Verify/Inductive/AliasFormerFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/AliasFormerFixture.lean
rename to Ix/Kernel/Verify/Inductive/AliasFormerFixture.lean
index e31af049b..f18a65ca7 100644
--- a/Ix/Tc/Verify/Inductive/AliasFormerFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasFormerFixture.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.AliasFormerCertificate
-import Ix.Tc.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.AliasFormerCertificate
+import Ix.Kernel.Verify.Ingress.AnonStructural
 
 /-!
 # Production family-result-normalizing fixture
@@ -15,11 +15,11 @@ related to the exact Theory declaration, and promoted before the certified
 family transition; no ambient normalization or inductive oracle is used.
 -/
 
-namespace Ix.Tc.AliasFormerFixture
+namespace Ix.Kernel.AliasFormerFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open AliasFormerCertificateFixture
 open InductiveConcreteFixture
 
@@ -570,4 +570,4 @@ def familyLink : SingletonFamilyCatalogLink RawProjRel.none world.catalog
   interpretation.toCatalogLinkOfEntries familyIngressExecution catalogEntry
     trustedCatalog
 
-end Ix.Tc.AliasFormerFixture
+end Ix.Kernel.AliasFormerFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasFormerPattern.lean b/Ix/Kernel/Verify/Inductive/AliasFormerPattern.lean
similarity index 90%
rename from Ix/Tc/Verify/Inductive/AliasFormerPattern.lean
rename to Ix/Kernel/Verify/Inductive/AliasFormerPattern.lean
index 56723f491..746eb262e 100644
--- a/Ix/Tc/Verify/Inductive/AliasFormerPattern.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasFormerPattern.lean
@@ -1,19 +1,19 @@
-import Ix.Tc.Verify.Inductive.SingletonEnumeration
-import Ix.Tc.Verify.Inductive.AliasFormerRecursorFixture
+import Ix.Kernel.Verify.Inductive.SingletonEnumeration
+import Ix.Kernel.Verify.Inductive.AliasFormerRecursorFixture
 
 /-!
 # Family-result-normalizing enumeration pattern
 
-Once Lean4Lean has normalized `TypeFamilyAlias` to `Type`, `AliasFormer` is
+Once Ix.Theory.Named has normalized `TypeFamilyAlias` to `Type`, `AliasFormer` is
 the one-constructor instance of the certified singleton-enumeration fragment.
 This module proves that exact fragment classification and instantiates the
 generic registered-equation pattern theorem for `AliasFormer.mk`.
 -/
 
-namespace Ix.Tc.AliasFormerPattern
+namespace Ix.Kernel.AliasFormerPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AliasFormerCertificateFixture
 open AliasFormerRecursorFixture
 
@@ -87,4 +87,4 @@ theorem patternRel {rule : RecRule .anon}
   RawRecursorRulePatternRel.of_metadata_sound (metadata hrule)
     (sound hrule)
 
-end Ix.Tc.AliasFormerPattern
+end Ix.Kernel.AliasFormerPattern
diff --git a/Ix/Tc/Verify/Inductive/AliasFormerRecursorFixture.lean b/Ix/Kernel/Verify/Inductive/AliasFormerRecursorFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/AliasFormerRecursorFixture.lean
rename to Ix/Kernel/Verify/Inductive/AliasFormerRecursorFixture.lean
index b29ca8516..0722f0c27 100644
--- a/Ix/Tc/Verify/Inductive/AliasFormerRecursorFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasFormerRecursorFixture.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.AliasFormerFixture
+import Ix.Kernel.Verify.Inductive.AliasFormerFixture
 
 /-!
 # Production `AliasFormer.rec` fixture
@@ -9,11 +9,11 @@ the normalized result `Type`, the stored recursor and iota equation are the
 exact artifacts registered by the certificate for the raw declaration.
 -/
 
-namespace Ix.Tc.AliasFormerRecursorFixture
+namespace Ix.Kernel.AliasFormerRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open AliasFormerCertificateFixture
 open AliasFormerFixture
 open InductiveConcreteFixture
@@ -720,4 +720,4 @@ def recursorLink : SingletonRecursorCatalogLink RawProjRel.none world.catalog
   recursorInterpretation.toCatalogLinkOfEntry recursorIngressExecution
     catalog_recursor trustedCatalog
 
-end Ix.Tc.AliasFormerRecursorFixture
+end Ix.Kernel.AliasFormerRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasRecAdmission.lean b/Ix/Kernel/Verify/Inductive/AliasRecAdmission.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/AliasRecAdmission.lean
rename to Ix/Kernel/Verify/Inductive/AliasRecAdmission.lean
index 7dcc65165..a1027c0ee 100644
--- a/Ix/Tc/Verify/Inductive/AliasRecAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasRecAdmission.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.AliasRecSoundness
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.AliasRecSoundness
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Oracle-free recursive-field-normalizing direct-recursive admission
@@ -12,10 +12,10 @@ the family world.  The sole iota pattern is justified by the registered
 generated equation, not by an inductive oracle.
 -/
 
-namespace Ix.Tc.AliasRecRecursorFixture
+namespace Ix.Kernel.AliasRecRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AliasRecCertificateFixture
 open AliasRecFixture
 
@@ -401,5 +401,5 @@ theorem aliasRecAtomicClosure : AliasRecAtomicClosure where
   iota := AliasRecPattern.patternRel concreteRule_ruleAt
   recursiveFieldNormalization := AliasRecCertificateFixture.breadth
 
-end Ix.Tc.AliasRecRecursorFixture
+end Ix.Kernel.AliasRecRecursorFixture
 
diff --git a/Ix/Tc/Verify/Inductive/AliasRecCertificate.lean b/Ix/Kernel/Verify/Inductive/AliasRecCertificate.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/AliasRecCertificate.lean
rename to Ix/Kernel/Verify/Inductive/AliasRecCertificate.lean
index 0aec2232e..f407a1c63 100644
--- a/Ix/Tc/Verify/Inductive/AliasRecCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasRecCertificate.lean
@@ -1,27 +1,27 @@
-import Ix.Tc.Verify.Inductive.Certificate
-import Lean4Lean.Verify.Environment.InductiveFixtures
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
 
 /-!
 # Certified recursive-field-normalizing fixture
 
 `AliasRec.mk` retains the raw field `RecAlias AliasRec`, where `RecAlias` is
-a transparent identity definition.  Lean4Lean's checked normalization path
+a transparent identity definition.  Ix.Theory.Named's checked normalization path
 unfolds that field to the direct recursive occurrence `AliasRec` before
 dependent inductive analysis, while the generated environment continues to
 store the raw constructor declaration.
 
-Lean4Lean exposes the exact checked generation and its semantic WF theorem,
+Ix.Theory.Named exposes the exact checked generation and its semantic WF theorem,
 but deliberately does not add another fixture-specific public certificate
 wrapper.  This module performs that narrow consumer-side packaging.  Physical
 anonymous ingress, production checking, and catalog admission remain
 separate layers.
 -/
 
-namespace Ix.Tc.AliasRecCertificateFixture
+namespace Ix.Kernel.AliasRecCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 /-- The transparent identity definition preceding `AliasRec`. -/
 def recAliasValue : VDefVal := recAliasVal
@@ -45,7 +45,7 @@ theorem recAliasDeclWF :
 theorem beforeWF : recAliasEnv.WF :=
   ⟨[.def recAliasValue], .decl recAliasDeclWF .empty⟩
 
-/-- Consumer-facing packaging of Lean4Lean's exact checker-produced
+/-- Consumer-facing packaging of Ix.Theory.Named's exact checker-produced
 `AliasRec` generation.  The proof field is erased by `addInductCertified`;
 the executable generation is definitionally the upstream checked artifact. -/
 def certificate : aliasRecRawDecl.GenerationCertificate recAliasEnv where
@@ -155,4 +155,4 @@ theorem certifiedFacts :
     CertifiedGenerationFacts recAliasEnv finalEnv transaction.certificate :=
   transaction.facts
 
-end Ix.Tc.AliasRecCertificateFixture
+end Ix.Kernel.AliasRecCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasRecFixture.lean b/Ix/Kernel/Verify/Inductive/AliasRecFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/AliasRecFixture.lean
rename to Ix/Kernel/Verify/Inductive/AliasRecFixture.lean
index 6106ea15b..4118e5a8b 100644
--- a/Ix/Tc/Verify/Inductive/AliasRecFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasRecFixture.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.AliasRecCertificate
-import Ix.Tc.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.AliasRecCertificate
+import Ix.Kernel.Verify.Ingress.AnonStructural
 
 /-!
 # Production recursive-field-normalizing fixture
@@ -15,11 +15,11 @@ related to the exact Theory declaration, and promoted before the certified
 family transition; no ambient inductive or normalization oracle is used.
 -/
 
-namespace Ix.Tc.AliasRecFixture
+namespace Ix.Kernel.AliasRecFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open AliasRecCertificateFixture
 open InductiveConcreteFixture
 
@@ -569,4 +569,4 @@ def familyLink : SingletonFamilyCatalogLink RawProjRel.none world.catalog
   interpretation.toCatalogLinkOfEntries familyIngressExecution catalogEntry
     trustedCatalog
 
-end Ix.Tc.AliasRecFixture
+end Ix.Kernel.AliasRecFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasRecPattern.lean b/Ix/Kernel/Verify/Inductive/AliasRecPattern.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/AliasRecPattern.lean
rename to Ix/Kernel/Verify/Inductive/AliasRecPattern.lean
index 60dbcf95f..48b6309b8 100644
--- a/Ix/Tc/Verify/Inductive/AliasRecPattern.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasRecPattern.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Inductive.IotaPattern
-import Ix.Tc.Verify.Inductive.AliasRecRecursorFixture
+import Ix.Kernel.Verify.Inductive.IotaPattern
+import Ix.Kernel.Verify.Inductive.AliasRecRecursorFixture
+
+open Ix.Theory (VLevel)
 
 /-!
 # Recursive-field-normalizing direct-recursive iota pattern
@@ -15,10 +17,10 @@ motive, minor premise, and constructor-field captures.  The soundness proof
 beta-reduces that application to the registered equation.
 -/
 
-namespace Ix.Tc.AliasRecPattern
+namespace Ix.Kernel.AliasRecPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AliasRecCertificateFixture
 open AliasRecFixture
 open AliasRecRecursorFixture
@@ -182,5 +184,5 @@ theorem metadata {rule : RecRule .anon}
   simpa only [pattern, mkFieldCount,
     show (1 : UInt64).toNat = 1 from rfl] using hfields
 
-end Ix.Tc.AliasRecPattern
+end Ix.Kernel.AliasRecPattern
 
diff --git a/Ix/Tc/Verify/Inductive/AliasRecRecursorFixture.lean b/Ix/Kernel/Verify/Inductive/AliasRecRecursorFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/AliasRecRecursorFixture.lean
rename to Ix/Kernel/Verify/Inductive/AliasRecRecursorFixture.lean
index 8fc9dcbe3..0f6fb668f 100644
--- a/Ix/Tc/Verify/Inductive/AliasRecRecursorFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasRecRecursorFixture.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.AliasRecFixture
+import Ix.Kernel.Verify.Inductive.AliasRecFixture
 
 /-!
 # Production `AliasRec.rec` fixture
@@ -9,11 +9,11 @@ recursive-field-alias-bearing family.  Its minor premise retains the raw field
 normalized direct-recursive value `motive a`.
 -/
 
-namespace Ix.Tc.AliasRecRecursorFixture
+namespace Ix.Kernel.AliasRecRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open AliasRecCertificateFixture
 open AliasRecFixture
 open InductiveConcreteFixture
@@ -726,4 +726,4 @@ def recursorLink : SingletonRecursorCatalogLink RawProjRel.none world.catalog
   recursorInterpretation.toCatalogLinkOfEntry recursorIngressExecution
     catalog_recursor trustedCatalog
 
-end Ix.Tc.AliasRecRecursorFixture
+end Ix.Kernel.AliasRecRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/AliasRecSoundness.lean b/Ix/Kernel/Verify/Inductive/AliasRecSoundness.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/AliasRecSoundness.lean
rename to Ix/Kernel/Verify/Inductive/AliasRecSoundness.lean
index cbdb4d98d..66a4f4f2e 100644
--- a/Ix/Tc/Verify/Inductive/AliasRecSoundness.lean
+++ b/Ix/Kernel/Verify/Inductive/AliasRecSoundness.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.AliasRecPattern
+import Ix.Kernel.Verify.Inductive.AliasRecPattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Recursive-field-normalizing direct-recursive iota soundness
@@ -12,10 +14,10 @@ throughout; recursive classification comes from the certified normalized
 view.
 -/
 
-namespace Ix.Tc.AliasRecPattern
+namespace Ix.Kernel.AliasRecPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AliasRecCertificateFixture
 open AliasRecFixture
 open AliasRecRecursorFixture
@@ -210,7 +212,7 @@ theorem patternSound {rule : RecRule .anon}
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -233,7 +235,7 @@ theorem patternSound {rule : RecRule .anon}
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, constructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -282,7 +284,7 @@ theorem patternSound {rule : RecRule .anon}
 
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``AliasRec.rec [u]) (generation.recType.instL [u]) := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity
     rw [generationRecursorName] at htyped
     simpa [VInductDecl.GenerationChecked.recursor] using htyped
@@ -306,14 +308,14 @@ theorem patternSound {rule : RecRule .anon}
       (VExpr.appN ((generation.rule 0 normalized).lhs.instL [u])
         [motive, minor])
       (equationFieldType u motive minor) :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorApplied
       hrecursorCommonType hequationLhsCommonType
 
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``AliasRec.mk []) constructorFieldType := by
     simpa [constructorFieldType, normalizedName] using
-      (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+      (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
         hcertifiedConstructorLookup constructorLevelsWF
           hconstructorLevelsArity)
   have hconstructorFieldHead : future.HasType uvars Gamma
@@ -342,7 +344,7 @@ theorem patternSound {rule : RecRule .anon}
     rw [fieldBinders_eq]
     rfl
   have hequationLhsFieldsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hfieldLength hconstructorApplied
       hconstructorFieldHead' hequationFieldHead
   have hequationLhsApplied : future.HasType uvars Gamma
@@ -354,7 +356,7 @@ theorem patternSound {rule : RecRule .anon}
       VExpr.appN_append]
     exact hequationLhsFieldsApplied
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
 
   have hequationLhsApplied' := hequationLhsApplied
@@ -364,7 +366,7 @@ theorem patternSound {rule : RecRule .anon}
         (ruleBinders.map (VExpr.instL [u])).length := by
     simpa only [List.length_cons, List.length_nil, List.length_map] using
       ruleBinders_length.symm
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleArgsLength hequationLhsApplied'
   rw [lhsBody_open] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -399,4 +401,4 @@ theorem patternRel {rule : RecRule .anon}
   RawRecursorRulePatternRel.of_metadata_sound (metadata hrule)
     (patternSound hrule)
 
-end Ix.Tc.AliasRecPattern
+end Ix.Kernel.AliasRecPattern
diff --git a/Ix/Tc/Verify/Inductive/AnnotatedPiAdmission.lean b/Ix/Kernel/Verify/Inductive/AnnotatedPiAdmission.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/AnnotatedPiAdmission.lean
rename to Ix/Kernel/Verify/Inductive/AnnotatedPiAdmission.lean
index c55dc99b7..b5e2899b8 100644
--- a/Ix/Tc/Verify/Inductive/AnnotatedPiAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/AnnotatedPiAdmission.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.AnnotatedPiSoundness
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.AnnotatedPiSoundness
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Oracle-free annotation-normalizing recursive-Pi admission
@@ -12,10 +12,10 @@ the family world.  The sole iota pattern is justified by the registered
 generated equation, not by an inductive oracle.
 -/
 
-namespace Ix.Tc.AnnotatedPiRecursorFixture
+namespace Ix.Kernel.AnnotatedPiRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AnnotatedPiCertificateFixture
 open AnnotatedPiFixture
 
@@ -403,4 +403,4 @@ theorem annotatedPiAtomicClosure : AnnotatedPiAtomicClosure where
   iota := AnnotatedPiPattern.patternRel concreteRule_ruleAt
   annotationNormalization := AnnotatedPiCertificateFixture.breadth
 
-end Ix.Tc.AnnotatedPiRecursorFixture
+end Ix.Kernel.AnnotatedPiRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/AnnotatedPiCertificate.lean b/Ix/Kernel/Verify/Inductive/AnnotatedPiCertificate.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/AnnotatedPiCertificate.lean
rename to Ix/Kernel/Verify/Inductive/AnnotatedPiCertificate.lean
index 258dc2bf2..cef1c052a 100644
--- a/Ix/Tc/Verify/Inductive/AnnotatedPiCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/AnnotatedPiCertificate.lean
@@ -1,26 +1,26 @@
-import Ix.Tc.Verify.Inductive.ProducedGenerationTransaction
-import Lean4Lean.Verify.Environment.InductiveFixtures
+import Ix.Kernel.Verify.Inductive.ProducedGenerationTransaction
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
 
 /-!
 # Certified annotation-normalizing recursive-Pi fixture
 
 `AnnotatedPi.mk` retains the raw binder domain `outParam Prop`, while the
-Lean4Lean analyzer classifies recursion through the normalized domain `Prop`.
+Ix.Theory.Named analyzer classifies recursion through the normalized domain `Prop`.
 This is the first Ix transaction whose certified generation is deliberately
 non-identity: the stored family and generated artifacts preserve raw syntax,
 but recursive classification is owned by the checked view produced by the
-ordinary Lean4Lean candidate pipeline.
+ordinary Ix.Theory.Named candidate pipeline.
 
 The module is still Theory-facing.  Physical anonymous ingress, production
 checking, and catalog admission are separate layers built on this exact
 certificate.
 -/
 
-namespace Ix.Tc.AnnotatedPiCertificateFixture
+namespace Ix.Kernel.AnnotatedPiCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 noncomputable section
 
@@ -51,7 +51,7 @@ theorem outParamDeclWF :
   rfl
 
 /-- Explicit well-formed history for the annotation environment.  The public
-Lean4Lean certificate needs this environment as input, rather than silently
+Ix.Theory.Named certificate needs this environment as input, rather than silently
 treating the reducible annotation as a primitive. -/
 theorem beforeWF : outParamEnv.WF :=
   ⟨[.def outParamValue], .decl outParamDeclWF .empty⟩
@@ -59,8 +59,8 @@ theorem beforeWF : outParamEnv.WF :=
 /-- Exact post-environment selected by that certificate. -/
 def finalEnv : VEnv := annotatedPiFinalEnv
 
-/-- The exact L4L-01E package.  Its producer-shape index is deliberately
-inferred here because Lean4Lean keeps the fixture's concrete shape witness
+/-- The exact Spec-01E package.  Its producer-shape index is deliberately
+inferred here because Ix.Theory.Named keeps the fixture's concrete shape witness
 private while exposing this public dependent existence theorem. -/
 def exactPackage :=
   Classical.choice annotatedPiExactProducedGenerationCandidatePackage_exists
@@ -81,7 +81,7 @@ def exactProducedTransaction :=
       exact annotatedPi_addInductCertified)
     beforeWF
 
-/-- Intentional operational erasure of the exact L4L-01E indices. -/
+/-- Intentional operational erasure of the exact Spec-01E indices. -/
 def producedTransaction :
     ProducedGenerationTransaction outParamEnv finalEnv [] :=
   exactProducedTransaction.toProduced
@@ -211,4 +211,4 @@ theorem certifiedFacts :
 
 end
 
-end Ix.Tc.AnnotatedPiCertificateFixture
+end Ix.Kernel.AnnotatedPiCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/AnnotatedPiFixture.lean b/Ix/Kernel/Verify/Inductive/AnnotatedPiFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/AnnotatedPiFixture.lean
rename to Ix/Kernel/Verify/Inductive/AnnotatedPiFixture.lean
index 1809344e6..225fd5a72 100644
--- a/Ix/Tc/Verify/Inductive/AnnotatedPiFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/AnnotatedPiFixture.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.AnnotatedPiCertificate
-import Ix.Tc.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.AnnotatedPiCertificate
+import Ix.Kernel.Verify.Ingress.AnonStructural
 
 /-!
 # Production annotation-normalizing recursive-Pi fixture
@@ -15,11 +15,11 @@ related to the exact Theory declaration, and promoted before the certified
 family transition; no ambient inductive or normalization oracle is used.
 -/
 
-namespace Ix.Tc.AnnotatedPiFixture
+namespace Ix.Kernel.AnnotatedPiFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open AnnotatedPiCertificateFixture
 open InductiveConcreteFixture
 
@@ -570,4 +570,4 @@ def familyLink : SingletonFamilyCatalogLink RawProjRel.none world.catalog
   interpretation.toCatalogLinkOfEntries familyIngressExecution catalogEntry
     trustedCatalog
 
-end Ix.Tc.AnnotatedPiFixture
+end Ix.Kernel.AnnotatedPiFixture
diff --git a/Ix/Tc/Verify/Inductive/AnnotatedPiPattern.lean b/Ix/Kernel/Verify/Inductive/AnnotatedPiPattern.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/AnnotatedPiPattern.lean
rename to Ix/Kernel/Verify/Inductive/AnnotatedPiPattern.lean
index effa2ef86..44bbca657 100644
--- a/Ix/Tc/Verify/Inductive/AnnotatedPiPattern.lean
+++ b/Ix/Kernel/Verify/Inductive/AnnotatedPiPattern.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Inductive.IotaPattern
-import Ix.Tc.Verify.Inductive.AnnotatedPiRecursorFixture
+import Ix.Kernel.Verify.Inductive.IotaPattern
+import Ix.Kernel.Verify.Inductive.AnnotatedPiRecursorFixture
+
+open Ix.Theory (VLevel)
 
 /-!
 # Annotation-normalizing recursive-Pi iota pattern
@@ -16,10 +18,10 @@ apply it to the motive, minor premise, and constructor field captures.  The
 soundness proof beta-reduces that application to the registered equation.
 -/
 
-namespace Ix.Tc.AnnotatedPiPattern
+namespace Ix.Kernel.AnnotatedPiPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AnnotatedPiCertificateFixture
 open AnnotatedPiFixture
 open AnnotatedPiRecursorFixture
@@ -183,4 +185,4 @@ theorem metadata {rule : RecRule .anon}
   simpa only [pattern, mkFieldCount,
     show (1 : UInt64).toNat = 1 from rfl] using hfields
 
-end Ix.Tc.AnnotatedPiPattern
+end Ix.Kernel.AnnotatedPiPattern
diff --git a/Ix/Tc/Verify/Inductive/AnnotatedPiRecursorFixture.lean b/Ix/Kernel/Verify/Inductive/AnnotatedPiRecursorFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/AnnotatedPiRecursorFixture.lean
rename to Ix/Kernel/Verify/Inductive/AnnotatedPiRecursorFixture.lean
index f317169c2..c2c15a417 100644
--- a/Ix/Tc/Verify/Inductive/AnnotatedPiRecursorFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/AnnotatedPiRecursorFixture.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.AnnotatedPiFixture
+import Ix.Kernel.Verify.Inductive.AnnotatedPiFixture
 
 /-!
 # Production `AnnotatedPi.rec` fixture
@@ -9,11 +9,11 @@ the raw field type `(p : outParam Prop) -> AnnotatedPi` with the normalized
 induction-hypothesis domain `(p : Prop) -> motive (f p)`.
 -/
 
-namespace Ix.Tc.AnnotatedPiRecursorFixture
+namespace Ix.Kernel.AnnotatedPiRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open AnnotatedPiCertificateFixture
 open AnnotatedPiFixture
 open InductiveConcreteFixture
@@ -731,4 +731,4 @@ def recursorLink : SingletonRecursorCatalogLink RawProjRel.none world.catalog
   recursorInterpretation.toCatalogLinkOfEntry recursorIngressExecution
     catalog_recursor trustedCatalog
 
-end Ix.Tc.AnnotatedPiRecursorFixture
+end Ix.Kernel.AnnotatedPiRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/AnnotatedPiSoundness.lean b/Ix/Kernel/Verify/Inductive/AnnotatedPiSoundness.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/AnnotatedPiSoundness.lean
rename to Ix/Kernel/Verify/Inductive/AnnotatedPiSoundness.lean
index 24e74839e..0023a6b7e 100644
--- a/Ix/Tc/Verify/Inductive/AnnotatedPiSoundness.lean
+++ b/Ix/Kernel/Verify/Inductive/AnnotatedPiSoundness.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.AnnotatedPiPattern
+import Ix.Kernel.Verify.Inductive.AnnotatedPiPattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Annotation-normalizing recursive-Pi iota soundness
@@ -11,10 +13,10 @@ already the complete generated-rule telescope.  The reducible `outParam Prop`
 annotation remains present in that raw field binder throughout the argument.
 -/
 
-namespace Ix.Tc.AnnotatedPiPattern
+namespace Ix.Kernel.AnnotatedPiPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open AnnotatedPiCertificateFixture
 open AnnotatedPiFixture
 open AnnotatedPiRecursorFixture
@@ -209,7 +211,7 @@ theorem patternSound {rule : RecRule .anon}
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -232,7 +234,7 @@ theorem patternSound {rule : RecRule .anon}
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, constructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -281,7 +283,7 @@ theorem patternSound {rule : RecRule .anon}
 
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``AnnotatedPi.rec [u]) (generation.recType.instL [u]) := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity
     rw [generationRecursorName] at htyped
     simpa [VInductDecl.GenerationChecked.recursor] using htyped
@@ -305,14 +307,14 @@ theorem patternSound {rule : RecRule .anon}
       (VExpr.appN ((generation.rule 0 normalized).lhs.instL [u])
         [motive, minor])
       (equationFieldType u motive minor) :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorApplied
       hrecursorCommonType hequationLhsCommonType
 
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``AnnotatedPi.mk []) constructorFieldType := by
     simpa [constructorFieldType, normalizedName] using
-      (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+      (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
         hcertifiedConstructorLookup constructorLevelsWF
           hconstructorLevelsArity)
   have hconstructorFieldHead : future.HasType uvars Gamma
@@ -341,7 +343,7 @@ theorem patternSound {rule : RecRule .anon}
     rw [fieldBinders_eq]
     rfl
   have hequationLhsFieldsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hfieldLength hconstructorApplied
       hconstructorFieldHead' hequationFieldHead
   have hequationLhsApplied : future.HasType uvars Gamma
@@ -353,7 +355,7 @@ theorem patternSound {rule : RecRule .anon}
       VExpr.appN_append]
     exact hequationLhsFieldsApplied
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
 
   have hequationLhsApplied' := hequationLhsApplied
@@ -363,7 +365,7 @@ theorem patternSound {rule : RecRule .anon}
         (ruleBinders.map (VExpr.instL [u])).length := by
     simpa only [List.length_cons, List.length_nil, List.length_map] using
       ruleBinders_length.symm
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleArgsLength hequationLhsApplied'
   rw [lhsBody_open] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -399,4 +401,4 @@ theorem patternRel {rule : RecRule .anon}
   RawRecursorRulePatternRel.of_metadata_sound (metadata hrule)
     (patternSound hrule)
 
-end Ix.Tc.AnnotatedPiPattern
+end Ix.Kernel.AnnotatedPiPattern
diff --git a/Ix/Tc/Verify/Inductive/BlockCertificate.lean b/Ix/Kernel/Verify/Inductive/BlockCertificate.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/BlockCertificate.lean
rename to Ix/Kernel/Verify/Inductive/BlockCertificate.lean
index 70672f555..7f9c1c284 100644
--- a/Ix/Tc/Verify/Inductive/BlockCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/BlockCertificate.lean
@@ -1,21 +1,21 @@
-import Lean4Lean.Theory.Typing.InductiveCertificate
+import Ix.Theory.Named.Typing.InductiveCertificate
 
 /-!
 # Certified mutual-inductive block transactions
 
-This is the Theory-only consumer boundary for Lean4Lean's L4L-08 block
+This is the Theory-only consumer boundary for Ix.Theory.Named's Spec-08 block
 generation certificate.  A mutual block is one atomic semantic transaction:
 all family constants are inserted before any constructors, all constructors
 before any recursors, and all recursors before the globally flattened iota
 rules.  It must not be represented as a list of singleton transactions.
 
 As with `CertifiedGenerationTransaction`, this module imports no executable
-Lean4Lean verifier and mentions no Ix address, catalog, or checker state.
+Ix.Theory.Named verifier and mentions no Ix address, catalog, or checker state.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 /-- One successful proof-carrying block generation, together with the
 well-formed Theory environment it extends. -/
@@ -54,7 +54,7 @@ structure CertifiedBlockGenerationFacts {source : VInductDecl}
 
 namespace CertifiedBlockGenerationTransaction
 
-/-- Repackage Ix's historical transaction adapter as Lean4Lean's current
+/-- Repackage Ix's historical transaction adapter as Ix.Theory.Named's current
 consumer certificate.  This is definitionally the same semantic input,
 successful atomic transaction, and pre-environment WF proof; no second
 generation run or compatibility axiom is introduced. -/
@@ -65,7 +65,7 @@ def toBlockCertificate {source : VInductDecl} {before after : VEnv}
   success := tx.success
   beforeWF := tx.beforeWF
 
-/-- Recover L4L-08's exact four-phase trace for the atomic block. -/
+/-- Recover Spec-08's exact four-phase trace for the atomic block. -/
 theorem trace {source : VInductDecl} {before after : VEnv}
     (tx : CertifiedBlockGenerationTransaction source before after) :
     Nonempty (VEnv.AddInductBlockGenerationTrace before after
@@ -102,4 +102,4 @@ theorem facts {source : VInductDecl} {before after : VEnv}
 
 end CertifiedBlockGenerationTransaction
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/BlockPatternSoundness.lean b/Ix/Kernel/Verify/Inductive/BlockPatternSoundness.lean
similarity index 90%
rename from Ix/Tc/Verify/Inductive/BlockPatternSoundness.lean
rename to Ix/Kernel/Verify/Inductive/BlockPatternSoundness.lean
index 122afbf8b..3ac6b51d7 100644
--- a/Ix/Tc/Verify/Inductive/BlockPatternSoundness.lean
+++ b/Ix/Kernel/Verify/Inductive/BlockPatternSoundness.lean
@@ -1,23 +1,25 @@
-import Ix.Tc.Verify.Inductive.BlockCertificate
+import Ix.Kernel.Verify.Inductive.BlockCertificate
+
+open Ix.Theory (VLevel)
 
 /-!
 # Consumer boundary for certified generated-pattern soundness
 
-Lean4Lean's block certificate already identifies the exact generated pattern,
+Ix.Theory.Named's block certificate already identifies the exact generated pattern,
 RHS template, checks, registered equation, and well-formed post-environment
 for every flattened constructor.  The remaining consumer theorem says that a
 well-typed match satisfying those checks is definitionally equal to that RHS
 in every future environment.
 
-This interface is deliberately stated entirely in Lean4Lean's Theory
+This interface is deliberately stated entirely in Ix.Theory.Named's Theory
 vocabulary.  It carries no Ix address, catalog, ownership, ingress, or checker
 claim, so a temporary upstream witness cannot discharge any downstream
 correspondence obligation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 /-- Environment-parametric soundness of one dependent pattern payload.
 Keeping this independent of any certificate makes transport along an equality
@@ -64,4 +66,4 @@ def CertifiedBlockRulePatternSound
       (certificate.generation.ruleCheck certificate.ruleClosure
         (List.mem_of_getElem? entry))
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/CandidateSyntax.lean b/Ix/Kernel/Verify/Inductive/CandidateSyntax.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/CandidateSyntax.lean
rename to Ix/Kernel/Verify/Inductive/CandidateSyntax.lean
index 7f38c432e..97f5d3b15 100644
--- a/Ix/Tc/Verify/Inductive/CandidateSyntax.lean
+++ b/Ix/Kernel/Verify/Inductive/CandidateSyntax.lean
@@ -1,13 +1,13 @@
-import Ix.Tc.Verify.Inductive.PositivityTraceAdapter
-import Ix.Tc.Verify.Totalization
+import Ix.Kernel.Verify.Inductive.PositivityTraceAdapter
+import Ix.Kernel.Verify.Totalization
 
 /-!
-# Exact candidate syntax shared by Ix and Lean4Lean
+# Exact candidate syntax shared by Ix and Ix.Theory.Named
 
 The Theory-level `VExpr` relations used elsewhere in the verification are
 semantic: they deliberately forget binder annotations and concrete free-
 variable identifiers.  Constructor positivity has one stricter boundary.
-Lean4Lean's `isValidIndApp?` inspects the exact kernel `Lean.Expr`, so a
+Ix.Theory.Named's `isValidIndApp?` inspects the exact kernel `Lean.Expr`, so a
 Theory-level definitional-equality result cannot justify that executable
 syntax test.
 
@@ -20,7 +20,7 @@ of those choices and discharges the corresponding field of
 `FlatPositivityTraceTransport` without a semantic oracle.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact correspondence between one Ix positivity expression and one Lean
 kernel candidate expression.  This intentionally excludes syntax erased by
@@ -330,18 +330,18 @@ theorem mentionsAnyAddr_eq_hasIndOcc
     (blocks : CandidateBlockRel nameOf ixAddrs leanConsts)
     (relation : CandidateSyntaxRel nameOf fvarRel levelRel ixExpr leanExpr) :
     exprMentionsAnyAddr ixExpr ixAddrs =
-      Lean4Lean.AddInductive.hasIndOcc leanConsts leanExpr := by
+      Ix.Theory.Named.AddInductive.hasIndOcc leanConsts leanExpr := by
   induction relation with
   | bvar => simp [exprMentionsAnyAddr, exprMentionsAddr,
-      exprMentionsAddr.go, Lean4Lean.AddInductive.hasIndOcc]
+      exprMentionsAddr.go, Ix.Theory.Named.AddInductive.hasIndOcc]
   | fvar => simp [exprMentionsAnyAddr, exprMentionsAddr,
-      exprMentionsAddr.go, Lean4Lean.AddInductive.hasIndOcc]
+      exprMentionsAddr.go, Ix.Theory.Named.AddInductive.hasIndOcc]
   | sort => simp [exprMentionsAnyAddr, exprMentionsAddr,
-      exprMentionsAddr.go, Lean4Lean.AddInductive.hasIndOcc]
+      exprMentionsAddr.go, Ix.Theory.Named.AddInductive.hasIndOcc]
   | @const id ixLevels info leanName leanLevels hname levels =>
       simp only [exprMentionsAnyAddr, exprMentionsAddr_equation,
         exprMentionsAddr_go_const, exprMentionsAddr_go_nil,
-        Lean4Lean.AddInductive.hasIndOcc]
+        Ix.Theory.Named.AddInductive.hasIndOcc]
       have occurrence :
           exprMentionsAddr (.const id ixLevels info) =
             (fun addr => id.addr == addr) := by
@@ -350,11 +350,11 @@ theorem mentionsAnyAddr_eq_hasIndOcc
       rw [occurrence]
       exact blocks hname
   | app fn arg ihFn ihArg =>
-      rw [mentionsAny_app, Lean4Lean.AddInductive.hasIndOcc, ihFn, ihArg]
+      rw [mentionsAny_app, Ix.Theory.Named.AddInductive.hasIndOcc, ihFn, ihArg]
   | forallE domain body ihDomain ihBody =>
-      rw [mentionsAny_all, Lean4Lean.AddInductive.hasIndOcc,
+      rw [mentionsAny_all, Ix.Theory.Named.AddInductive.hasIndOcc,
         ihDomain, ihBody]
 
 end CandidateSyntaxRel
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/Certificate.lean b/Ix/Kernel/Verify/Inductive/Certificate.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive/Certificate.lean
rename to Ix/Kernel/Verify/Inductive/Certificate.lean
index ead590788..06eaa4596 100644
--- a/Ix/Tc/Verify/Inductive/Certificate.lean
+++ b/Ix/Kernel/Verify/Inductive/Certificate.lean
@@ -1,11 +1,11 @@
-import Lean4Lean.Theory.Typing.EnvLemmas
+import Ix.Theory.Named.Typing.EnvLemmas
 
 /-!
 # Certified inductive-generation transactions
 
-This module is the Theory-only consumer boundary for Lean4Lean's normalized
+This module is the Theory-only consumer boundary for Ix.Theory.Named's normalized
 inductive-generation certificate.  It deliberately imports no
-`Lean4Lean.Verify` module and mentions no Ix catalog, address, checker state,
+`Ix.Theory.Named.Verify` module and mentions no Ix catalog, address, checker state,
 or recursor-pattern relation.
 
 `GenerationCertificate` proves that one exact normalized generation is
@@ -20,9 +20,9 @@ checked, how their addresses map to names, or that production iota metadata
 matches the generated Theory rules.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 /-- One successful proof-carrying normalized inductive transaction, together
 with the well-formed input environment needed to extend a Theory history.
@@ -36,7 +36,7 @@ structure CertifiedGenerationTransaction (source : VInductDecl)
   beforeWF : before.WF
 
 /-- The complete Theory-owned consequences of a certified generation
-transaction.  All fields concern only the Lean4Lean source, generated
+transaction.  All fields concern only the Ix.Theory.Named source, generated
 artifacts, and input/output `VEnv`s. -/
 structure CertifiedGenerationFacts {source : VInductDecl}
     (before after : VEnv) (certificate : source.GenerationCertificate before) :
@@ -128,4 +128,4 @@ theorem facts {source : VInductDecl} {before after : VEnv}
 
 end CertifiedGenerationTransaction
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/ConcreteFixture.lean b/Ix/Kernel/Verify/Inductive/ConcreteFixture.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/ConcreteFixture.lean
rename to Ix/Kernel/Verify/Inductive/ConcreteFixture.lean
index 41eb54154..b311259a3 100644
--- a/Ix/Tc/Verify/Inductive/ConcreteFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/ConcreteFixture.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Inductive.IngressExecution
-import Ix.Tc.Verify.Check.PreTranslationCompatibility
+import Ix.Kernel.Verify.Inductive.IngressExecution
+import Ix.Kernel.Verify.Check.PreTranslationCompatibility
+
+open Ix.Theory (VLevel)
 
 /-!
 # Shared executable inductive-fixture support
@@ -11,9 +13,9 @@ core binder syntax returned by anonymous ingress.  Keeping these here avoids
 making indexed-recursive coverage depend on the Boolean enumeration fixture.
 -/
 
-namespace Ix.Tc.InductiveConcreteFixture
+namespace Ix.Kernel.InductiveConcreteFixture
 
-open Lean4Lean (VEnv VExpr)
+open Ix.Theory.Named (VEnv VExpr)
 
 /-- Store a constant at its production content address. -/
 def storeConstant (env : Ixon.Env) (constant : Ixon.Constant) :
@@ -214,4 +216,4 @@ instance kExprScopedDecidable (depth : UInt64) (levelBound : Nat)
     .isFalse fun hscoped =>
       h ((scopedExprB_eq_true_iff depth levelBound expression).mpr hscoped)
 
-end Ix.Tc.InductiveConcreteFixture
+end Ix.Kernel.InductiveConcreteFixture
diff --git a/Ix/Tc/Verify/Inductive/ConstructorPositivityTraversal.lean b/Ix/Kernel/Verify/Inductive/ConstructorPositivityTraversal.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/ConstructorPositivityTraversal.lean
rename to Ix/Kernel/Verify/Inductive/ConstructorPositivityTraversal.lean
index 3a5adfac5..7df19c39f 100644
--- a/Ix/Tc/Verify/Inductive/ConstructorPositivityTraversal.lean
+++ b/Ix/Kernel/Verify/Inductive/ConstructorPositivityTraversal.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.RecursivePositivityTraversal
+import Ix.Kernel.Verify.Inductive.RecursivePositivityTraversal
 
 /-!
 # Complete constructor-positivity traversal
@@ -11,7 +11,7 @@ parameter opening, source-ordered field traversal, and final local-context
 restoration.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact successful execution of the production parameter-opening loop.
 The `short` case records the deliberately permissive result used so A1/A2 can
@@ -366,4 +366,4 @@ theorem checkPositivity_success (methods : Methods m)
   exact .success (checkPositivityCore_success methods hcore) hrestored
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/ConstructorValidationTraversal.lean b/Ix/Kernel/Verify/Inductive/ConstructorValidationTraversal.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/ConstructorValidationTraversal.lean
rename to Ix/Kernel/Verify/Inductive/ConstructorValidationTraversal.lean
index 3b2914fd9..106a2826f 100644
--- a/Ix/Tc/Verify/Inductive/ConstructorValidationTraversal.lean
+++ b/Ix/Kernel/Verify/Inductive/ConstructorValidationTraversal.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.ConstructorPositivityTraversal
+import Ix.Kernel.Verify.Inductive.ConstructorPositivityTraversal
 
 /-!
 # Production constructor-validation traversal
@@ -10,7 +10,7 @@ execution around that call: derived metadata, shared-parameter agreement,
 safety gating, field-universe validation, and constructor-return validation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Successful constructor-metadata validation together with the exact
 physical constructor header selected by its lookup.  The aggregate run alone
@@ -704,4 +704,4 @@ theorem checkInductiveBlockImpl_success (methods : Methods m)
             (checkInductiveMembers_success methods hinductives) hrun
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/EliminationBreadthFixture.lean b/Ix/Kernel/Verify/Inductive/EliminationBreadthFixture.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/EliminationBreadthFixture.lean
rename to Ix/Kernel/Verify/Inductive/EliminationBreadthFixture.lean
index 0592aee14..7d8f4403d 100644
--- a/Ix/Tc/Verify/Inductive/EliminationBreadthFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/EliminationBreadthFixture.lean
@@ -1,14 +1,14 @@
 import Ix.CompileDriver
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.SingletonRecursor
-import Ix.Tc.Verify.Ingress.AnonStructural
-import Lean4Lean.Verify.Environment.EliminationFixturesEq
-import Lean4Lean.Verify.Environment.EliminationFixturesSmall
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.SingletonRecursor
+import Ix.Kernel.Verify.Ingress.AnonStructural
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesEq
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesSmall
 
 /-!
 # Concrete small-elimination and K-target breadth
 
-Lean4Lean's L4L-06 fixtures retain the exact kernel elimination traversal and
+Ix.Theory.Named's Spec-06 fixtures retain the exact kernel elimination traversal and
 align it with the generated Theory metadata.  This module takes the remaining
 Ix step: it compiles those same kernel declarations to production Ixon blocks,
 ingresses the family and recursor projections, and runs both production block
@@ -16,7 +16,7 @@ checkers.
 
 The two cases are deliberately complementary:
 
-* `L4L06SmallSource` keeps its source universe but introduces no fresh
+* `Spec06SmallSource` keeps its source universe but introduces no fresh
   elimination universe; and
 * `Eq` uses large elimination and declares the independently computed K bit.
 
@@ -24,11 +24,11 @@ Thus the shared singleton-recursor relation is exercised at both universe
 layouts and at both values of the physical `k` field.
 -/
 
-namespace Ix.Tc.EliminationBreadthFixture
+namespace Ix.Kernel.EliminationBreadthFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 local instance eliminationAddressDecidableEq : DecidableEq Address :=
   AnonStructural.addressDecidableEq
@@ -686,4 +686,4 @@ theorem kTargetAcceptance : KTargetAcceptance where
   productionLayout := eqPreparationMatches_eq
   productionK := eqComputeKMatches_eq
 
-end Ix.Tc.EliminationBreadthFixture
+end Ix.Kernel.EliminationBreadthFixture
diff --git a/Ix/Tc/Verify/Inductive/EnumerationAcceptance.lean b/Ix/Kernel/Verify/Inductive/EnumerationAcceptance.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/EnumerationAcceptance.lean
rename to Ix/Kernel/Verify/Inductive/EnumerationAcceptance.lean
index fefada66f..23edafca0 100644
--- a/Ix/Tc/Verify/Inductive/EnumerationAcceptance.lean
+++ b/Ix/Kernel/Verify/Inductive/EnumerationAcceptance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.EnumerationFixture
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.EnumerationFixture
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Concrete singleton-enumeration checker acceptance
@@ -10,7 +10,7 @@ constructs its canonical recursor cache; the separate recursor block is then
 checked against that exact generated result.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace BooleanEnumerationFixture
 
@@ -359,8 +359,8 @@ theorem familyOwner :
   directInductiveOwner_inductiveMemberOf familyDirectOwner
 
 private theorem certifiedConstructor_inductiveMemberOf
-    {source : Lean4Lean.VInductDecl} {familyId block : KId .anon}
-    {index : Nat} {sourceConstructor : Lean4Lean.VConstVal}
+    {source : Ix.Theory.Named.VInductDecl} {familyId block : KId .anon}
+    {index : Nat} {sourceConstructor : Ix.Theory.Named.VConstVal}
     {concrete familyConcrete : KConst .anon} {catalog : Catalog}
     (hshape : concrete.IsCertifiedSingletonConstructor source familyId index
       sourceConstructor)
@@ -391,7 +391,7 @@ theorem recursorOwner :
   recursorOwnerNative
 
 private theorem certifiedRecursor_not_inductiveMemberOf
-    {source : Lean4Lean.VInductDecl} {generation : source.GenerationChecked}
+    {source : Ix.Theory.Named.VInductDecl} {generation : source.GenerationChecked}
     {constructorIds : Array (KId .anon)} {concrete : KConst .anon}
     {catalog : Catalog} {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonRecursor source generation
@@ -407,7 +407,7 @@ theorem recursorNotFamilyOwner :
   certifiedRecursor_not_inductiveMemberOf recursorShape
 
 private theorem certifiedFamily_not_recursorMemberOf
-    {source : Lean4Lean.VInductDecl} {generation : source.GenerationChecked}
+    {source : Ix.Theory.Named.VInductDecl} {generation : source.GenerationChecked}
     {constructorIds : Array (KId .anon)} {concrete : KConst .anon}
     {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonFamily source generation
@@ -423,8 +423,8 @@ theorem familyNotRecursorOwner :
   certifiedFamily_not_recursorMemberOf familyShape
 
 private theorem certifiedConstructor_not_recursorMemberOf
-    {source : Lean4Lean.VInductDecl} {familyId : KId .anon}
-    {index : Nat} {sourceConstructor : Lean4Lean.VConstVal}
+    {source : Ix.Theory.Named.VInductDecl} {familyId : KId .anon}
+    {index : Nat} {sourceConstructor : Ix.Theory.Named.VConstVal}
     {concrete : KConst .anon} {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonConstructor source familyId index
       sourceConstructor) :
@@ -729,4 +729,4 @@ theorem endToEndAcceptance : EndToEndAcceptance where
 
 end BooleanEnumerationFixture
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/EnumerationFixture.lean b/Ix/Kernel/Verify/Inductive/EnumerationFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/EnumerationFixture.lean
rename to Ix/Kernel/Verify/Inductive/EnumerationFixture.lean
index 641e2ef46..c02c71f8e 100644
--- a/Ix/Tc/Verify/Inductive/EnumerationFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/EnumerationFixture.lean
@@ -1,22 +1,24 @@
-import Ix.Tc.Verify.Check.SingletonInductive
-import Ix.Tc.Verify.Check.PreTranslationCompatibility
-import Lean4Lean.Theory.InductiveFixtures
+import Ix.Kernel.Verify.Check.SingletonInductive
+import Ix.Kernel.Verify.Check.PreTranslationCompatibility
+import Ix.Theory.Named.InductiveFixtures
+
+open Ix.Theory (VLevel)
 
 /-!
 # Concrete singleton-enumeration fixture
 
 This module closes E2b's executable witness with a two-constructor Boolean
-enumeration.  The Theory side uses Lean4Lean's checked identity-generation
+enumeration.  The Theory side uses Ix.Theory.Named's checked identity-generation
 certificate; the concrete side below is built from the actual Ixon block
 encoding and production anonymous ingress/checker functions.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace BooleanEnumerationFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open VInductDecl
 
 local instance anonKIdDecidableEq : DecidableEq (KId .anon) := fun left right =>
@@ -25,7 +27,7 @@ local instance anonKIdDecidableEq : DecidableEq (KId .anon) := fun left right =>
   else
     .isFalse fun equality => h (by cases equality; exact beq_self_eq_true left)
 
-/-! ## Lean4Lean certificate -/
+/-! ## Ix.Theory.Named certificate -/
 
 def checked : boolDecl.Checked where
   type := boolType
@@ -1275,4 +1277,4 @@ def recursorLink : SingletonRecursorCatalogLink RawProjRel.none world.catalog
 
 end BooleanEnumerationFixture
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/ExactLeanSyntax.lean b/Ix/Kernel/Verify/Inductive/ExactLeanSyntax.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/ExactLeanSyntax.lean
rename to Ix/Kernel/Verify/Inductive/ExactLeanSyntax.lean
index cd080cf0b..c7bfa00c3 100644
--- a/Ix/Tc/Verify/Inductive/ExactLeanSyntax.lean
+++ b/Ix/Kernel/Verify/Inductive/ExactLeanSyntax.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.CandidateSyntax
+import Ix.Kernel.Verify.Inductive.CandidateSyntax
 
 /-!
 # Exact executable comparison for Lean kernel syntax
@@ -17,7 +17,7 @@ separate exact metadata relation.  Every successful comparison is proved to
 imply ordinary Lean equality.
 -/
 
-namespace Ix.Tc.ExactLeanSyntax
+namespace Ix.Kernel.ExactLeanSyntax
 
 /-- Structural equality for universe levels, ignoring their cached `data`
 field and comparing metavariable identifiers through their names. -/
@@ -214,4 +214,4 @@ theorem exceptBool_eq_ok_of_check {outcome : Except ε Bool}
     outcome = .ok expected := by
   cases outcome <;> simp_all [exceptBoolCheck]
 
-end Ix.Tc.ExactLeanSyntax
+end Ix.Kernel.ExactLeanSyntax
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorAcceptance.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorAcceptance.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorAcceptance.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorAcceptance.lean
index 8dbaa86fb..91df67353 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorAcceptance.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorAcceptance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorComparison
-import Ix.Tc.Verify.RecursiveMethods.CallDomains
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorComparison
+import Ix.Kernel.Verify.RecursiveMethods.CallDomains
 
 /-!
 # Semantic acceptance of a generated-recursor candidate
@@ -15,9 +15,9 @@ entry yields a DefEq-quotiented canonical stored type and every same-index
 stored rule.  No coherence-only or whole-comparison oracle is available.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VEnv VExpr VInductDecl)
+open Ix.Theory.Named (VEnv VExpr VInductDecl)
 open GeneratedRecursorSemantics
 
 namespace GeneratedRecursorSemantics
@@ -402,4 +402,4 @@ theorem checkGeneratedRecursorFromCache_canonical
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorAcceptanceClosure.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorAcceptanceClosure.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorAcceptanceClosure.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorAcceptanceClosure.lean
index 034ac7560..78c4e2a5b 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorAcceptanceClosure.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorAcceptanceClosure.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAcceptance
-import Ix.Tc.Verify.Check.ScopedActiveBlock
-import Ix.Tc.Verify.RecursiveMethods.ScopedCallDomains
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAcceptance
+import Ix.Kernel.Verify.Check.ScopedActiveBlock
+import Ix.Kernel.Verify.RecursiveMethods.ScopedCallDomains
 
 /-!
 # Run-scoped generated-recursor acceptance closure
@@ -11,7 +11,7 @@ through K2S's finite successor-layer method contract.  It does not require a
 global DefEq oracle or place every expression in an unbounded call domain.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open GeneratedRecursorSemantics
 
@@ -81,7 +81,7 @@ theorem checkGeneratedRecursorCandidate_canonicalScoped
     {model : ScopedKernelSuffixModel trProj world}
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {support : RunSupport} {calls : Methods.CallDomain}
-    {source : Lean4Lean.VInductDecl}
+    {source : Ix.Theory.Named.VInductDecl}
     {generation : source.GenerationChecked}
     {ty : KExpr .anon} {declaredLvls : UInt64}
     {declaredIsUnsafe : Bool} {params motives minors indices : UInt64}
@@ -121,7 +121,7 @@ theorem checkGeneratedRecursorFromCache_canonicalScoped
     {model : ScopedKernelSuffixModel trProj world}
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {support : RunSupport} {calls : Methods.CallDomain}
-    {source : Lean4Lean.VInductDecl}
+    {source : Ix.Theory.Named.VInductDecl}
     {generation : source.GenerationChecked}
     {recBlock id : KId .anon} {ty : KExpr .anon}
     {declaredLvls : UInt64} {declaredIsUnsafe : Bool}
@@ -171,7 +171,7 @@ theorem checkGeneratedRecursorCandidate_canonicalActiveScoped
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {support : RunSupport} {members : Array (KId .anon)}
     {calls : Methods.CallDomain}
-    {source : Lean4Lean.VInductDecl}
+    {source : Ix.Theory.Named.VInductDecl}
     {generation : source.GenerationChecked}
     {ty : KExpr .anon} {declaredLvls : UInt64}
     {declaredIsUnsafe : Bool} {params motives minors indices : UInt64}
@@ -213,7 +213,7 @@ theorem checkGeneratedRecursorFromCache_canonicalActiveScoped
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {support : RunSupport} {members : Array (KId .anon)}
     {calls : Methods.CallDomain}
-    {source : Lean4Lean.VInductDecl}
+    {source : Ix.Theory.Named.VInductDecl}
     {generation : source.GenerationChecked}
     {recBlock id : KId .anon} {ty : KExpr .anon}
     {declaredLvls : UInt64} {declaredIsUnsafe : Bool}
@@ -257,4 +257,4 @@ theorem checkGeneratedRecursorFromCache_canonicalActiveScoped
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorAdmission.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorAdmission.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorAdmission.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorAdmission.lean
index 063556602..6709d5c35 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorAdmission.lean
@@ -1,12 +1,12 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorInitialInvariant
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorInitialInvariant
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Canonical generated-recursor admission
 
 This module closes the first E2c production recursor transaction.  The
 certified family transaction has already installed `IndexedVec.rec` and its
-two equations in Lean4Lean's Theory environment.  Ix nevertheless keeps the
+two equations in Ix.Theory.Named's Theory environment.  Ix nevertheless keeps the
 separately ingressed recursor block untrusted while
 `checkRecursorMemberImpl` compares its immutable declaration against the
 generated cache.
@@ -19,11 +19,11 @@ pattern, and only then converts active cache authority into stable trust and
 publishes the block-success verdict.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 
 /-! ## Per-member semantic provenance already present after family generation -/
@@ -209,4 +209,4 @@ theorem familyRecursorAtomicClosure : CanonicalRecursorAtomicClosure where
   oneFamily := oneFamilyAtomicClosure
   stable := familyMemberCheckStable
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorCheckerFixture.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorCheckerFixture.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorCheckerFixture.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorCheckerFixture.lean
index cc4db09be..f6fcce8c8 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorCheckerFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorCheckerFixture.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorSelection
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAcceptanceClosure
-import Ix.Tc.Verify.Inductive.GeneratedRecursorCommitFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorSelection
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAcceptanceClosure
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorCommitFixture
 
 /-!
 # Production generated-recursor checker fixture
@@ -15,11 +15,11 @@ Consequently, later semantic closure cannot justify the stored declaration by
 silently reusing the generated artifact's translation.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 open GeneratedRecursorSemantics
 open IndexedRecursiveCertificateFixture
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 /-! ## Actual frozen-cache checker execution -/
 
@@ -112,7 +112,7 @@ theorem familyStoredArtifactTranslations :
       transaction.certificate.generation.recursor.uvars nameOf RawProjRel.none
       recursorConcrete.ty recursorRules := by
   refine ⟨⟨transaction.certificate.generation.recType, ?_⟩, ?_⟩
-  · simpa [Lean4Lean.VInductDecl.GenerationChecked.recursor] using
+  · simpa [Ix.Theory.Named.VInductDecl.GenerationChecked.recursor] using
       recursorTypeTyped
   · intro index hindex
     have indexTwo : index < 2 := by
@@ -371,4 +371,4 @@ theorem familyCacheCheckExecution :
   ⟨familyCacheCheckRun, familyInstalledRecursorCanonical,
     familyStoredArtifactTranslations⟩
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorCommitFixture.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorCommitFixture.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorCommitFixture.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorCommitFixture.lean
index 9704834d3..e922291ff 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorCommitFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorCommitFixture.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorRuleFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorRuleFixture
 
 /-!
 # Production generated-recursor commit fixture
@@ -16,11 +16,11 @@ proofs do not need to trust either a callback-mutated cache type or a
 callback-written rule array.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 open GeneratedRecursorSemantics
 open IndexedRecursiveCertificateFixture
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 local instance generatedCommitAddressDecidableEq : DecidableEq Address :=
   AnonStructural.addressDecidableEq
@@ -257,7 +257,7 @@ theorem familyGeneratedSnapshotType_eq :
   familyGeneratedSnapshotTypeNative
 
 /-- The immutable type selected by the public commit is the exact
-Lean4Lean-generated recursor type. -/
+Ix.Theory.Named-generated recursor type. -/
 theorem familyGeneratedSnapshotTypeCanonical :
     CanonicalTypeS indexedVecFinalEnv nameOf RawProjRel.none
       transaction.certificate.generation
@@ -268,7 +268,7 @@ theorem familyGeneratedSnapshotTypeCanonical :
     [] (familyGeneratedSnapshot[0]'familyGeneratedSnapshotNonempty).ty
       transaction.certificate.generation.recType
   rw [familyGeneratedSnapshotType_eq]
-  simpa [Lean4Lean.VInductDecl.GenerationChecked.recursor] using
+  simpa [Ix.Theory.Named.VInductDecl.GenerationChecked.recursor] using
     recursorTypeTyped
 
 /-- The local completed entry's position-zero rule array is canonical. -/
@@ -336,4 +336,4 @@ theorem familyRuleCommitExecution :
               installed[0] :=
   ⟨familyRuleCommitRun, familyRuleCommitCanonical⟩
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorComparison.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorComparison.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorComparison.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorComparison.lean
index 49b7efd07..66cd7903a 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorComparison.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorComparison.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorSemantics
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorSemantics
 
 /-!
 # Exhaustive generated-recursor comparison
@@ -15,7 +15,7 @@ semantic layer can interpret only these concrete successful DefEq calls; it
 does not receive an oracle for the comparison as a whole.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact successful executions of the positional generated/stored rule
 comparisons, including all state changes made by DefEq. -/
@@ -263,4 +263,4 @@ theorem checkGeneratedRecursorFromCache_success
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorInitialInvariant.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorInitialInvariant.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorInitialInvariant.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorInitialInvariant.lean
index 0ba194afc..125320ce2 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorInitialInvariant.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorInitialInvariant.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorMemberFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorMemberFixture
+
+open Ix.Theory (VLevel)
 
 /-!
 # Concrete generated-recursor ingress invariant
@@ -11,11 +13,11 @@ canonical finite maps; it does not assume injectivity of Blake3 outside that
 run.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 
 local instance initialInvariantKConstDecidableEq :
@@ -294,37 +296,37 @@ private theorem familyMemberResolveExact
 
 private theorem familyMemberNatInfoLookup :
     familyAcceptedWorld.venv.constants ``Nat =
-      some Lean4Lean.InductiveFixtures.natType.toVConstant := by
+      some Ix.Theory.Named.InductiveFixtures.natType.toVConstant := by
   native_decide
 
 private theorem familyMemberZeroInfoLookup :
     familyAcceptedWorld.venv.constants ``Nat.zero =
-      some Lean4Lean.InductiveFixtures.natType.ctors[0].toVConstant := by
+      some Ix.Theory.Named.InductiveFixtures.natType.ctors[0].toVConstant := by
   native_decide
 
 private theorem familyMemberSuccInfoLookup :
     familyAcceptedWorld.venv.constants ``Nat.succ =
-      some Lean4Lean.InductiveFixtures.natType.ctors[1].toVConstant := by
+      some Ix.Theory.Named.InductiveFixtures.natType.ctors[1].toVConstant := by
   native_decide
 
 private theorem familyMemberFamilyInfoLookup :
     familyAcceptedWorld.venv.constants ``IndexedVec =
-      some Lean4Lean.InductiveFixtures.indexedVecType.toVConstant := by
+      some Ix.Theory.Named.InductiveFixtures.indexedVecType.toVConstant := by
   native_decide
 
 private theorem familyMemberNilInfoLookup :
     familyAcceptedWorld.venv.constants ``IndexedVec.nil =
-      some Lean4Lean.InductiveFixtures.indexedVecType.ctors[0].toVConstant := by
+      some Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[0].toVConstant := by
   native_decide
 
 private theorem familyMemberConsInfoLookup :
     familyAcceptedWorld.venv.constants ``IndexedVec.cons =
-      some Lean4Lean.InductiveFixtures.indexedVecType.ctors[1].toVConstant := by
+      some Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[1].toVConstant := by
   native_decide
 
 private theorem familyMemberResolveNatExact :
     TrustedConstRel RawProjRel.none familyAcceptedWorld natId natConcrete
-      ``Nat Lean4Lean.InductiveFixtures.natType.toVConstant := by
+      ``Nat Ix.Theory.Named.InductiveFixtures.natType.toVConstant := by
   apply familyMemberResolveExact familyMemberResolveNat
   · simpa only [familyAcceptedWorld_nameOf_eq] using nameOf_nat
   · exact familyMemberNatInfoLookup
@@ -332,7 +334,7 @@ private theorem familyMemberResolveNatExact :
 private theorem familyMemberResolveZeroExact :
     TrustedConstRel RawProjRel.none familyAcceptedWorld zeroId zeroConcrete
       ``Nat.zero
-      Lean4Lean.InductiveFixtures.natType.ctors[0].toVConstant := by
+      Ix.Theory.Named.InductiveFixtures.natType.ctors[0].toVConstant := by
   apply familyMemberResolveExact familyMemberResolveZero
   · simpa only [familyAcceptedWorld_nameOf_eq] using nameOf_zero
   · exact familyMemberZeroInfoLookup
@@ -340,7 +342,7 @@ private theorem familyMemberResolveZeroExact :
 private theorem familyMemberResolveSuccExact :
     TrustedConstRel RawProjRel.none familyAcceptedWorld succId succConcrete
       ``Nat.succ
-      Lean4Lean.InductiveFixtures.natType.ctors[1].toVConstant := by
+      Ix.Theory.Named.InductiveFixtures.natType.ctors[1].toVConstant := by
   apply familyMemberResolveExact familyMemberResolveSucc
   · simpa only [familyAcceptedWorld_nameOf_eq] using nameOf_succ
   · exact familyMemberSuccInfoLookup
@@ -348,7 +350,7 @@ private theorem familyMemberResolveSuccExact :
 private theorem familyMemberResolveFamilyExact :
     TrustedConstRel RawProjRel.none familyAcceptedWorld familyId familyConcrete
       ``IndexedVec
-      Lean4Lean.InductiveFixtures.indexedVecType.toVConstant := by
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.toVConstant := by
   apply familyMemberResolveExact familyMemberResolveFamily
   · simpa only [familyAcceptedWorld_nameOf_eq] using nameOf_family
   · exact familyMemberFamilyInfoLookup
@@ -356,7 +358,7 @@ private theorem familyMemberResolveFamilyExact :
 private theorem familyMemberResolveNilExact :
     TrustedConstRel RawProjRel.none familyAcceptedWorld nilId nilConcrete
       ``IndexedVec.nil
-      Lean4Lean.InductiveFixtures.indexedVecType.ctors[0].toVConstant := by
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[0].toVConstant := by
   apply familyMemberResolveExact familyMemberResolveNil
   · simpa only [familyAcceptedWorld_nameOf_eq] using nameOf_nil
   · exact familyMemberNilInfoLookup
@@ -364,27 +366,27 @@ private theorem familyMemberResolveNilExact :
 private theorem familyMemberResolveConsExact :
     TrustedConstRel RawProjRel.none familyAcceptedWorld consId consConcrete
       ``IndexedVec.cons
-      Lean4Lean.InductiveFixtures.indexedVecType.ctors[1].toVConstant := by
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[1].toVConstant := by
   apply familyMemberResolveExact familyMemberResolveCons
   · simpa only [familyAcceptedWorld_nameOf_eq] using nameOf_cons
   · exact familyMemberConsInfoLookup
 
 private theorem familyMemberNatTypeHasType :
     familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.natType.type
+      Ix.Theory.Named.InductiveFixtures.natType.type
       (.sort (.succ (.succ .zero))) := by
   type_tac
 
 private theorem familyMemberZeroTypeHasType :
     familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.natType.ctors[0].type
-      Lean4Lean.InductiveFixtures.natType.type := by
+      Ix.Theory.Named.InductiveFixtures.natType.ctors[0].type
+      Ix.Theory.Named.InductiveFixtures.natType.type := by
   have hNat := familyMemberNatInfoLookup
   type_tac
 
 private theorem familyMemberSuccTypeHasType :
     familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.natType.ctors[1].type
+      Ix.Theory.Named.InductiveFixtures.natType.ctors[1].type
       (.sort (.succ .zero)) := by
   have raw : familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
       (.forallE (.const ``Nat []) (.const ``Nat []))
@@ -399,7 +401,7 @@ private theorem familyMemberSuccTypeHasType :
 
 private theorem familyMemberFamilyTypeHasType :
     familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.indexedVecType.type
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.type
       (.sort (.max (.succ .zero) (.succ (.succ (.param 0))))) := by
   have raw : familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
       (.forallE (.sort (.succ (.param 0)))
@@ -418,7 +420,7 @@ private theorem familyMemberFamilyTypeHasType :
 
 private theorem familyMemberNilTypeHasType :
     familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.indexedVecType.ctors[0].type
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[0].type
       (.sort (.succ (.succ (.param 0)))) := by
   have raw : familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
       (.forallE (.sort (.succ (.param 0)))
@@ -455,11 +457,11 @@ private theorem familyMemberNilTypeHasType :
 
 private theorem familyMemberConsTypeHasType :
     familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.indexedVecType.ctors[1].type
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[1].type
       (.sort (.max (.succ (.succ (.param 0)))
         (.max (.succ .zero) (.succ (.param 0))))) := by
   have raw : familyAcceptedWorld.venv.HasType familyMemberModel.keys.uvars []
-      Lean4Lean.InductiveFixtures.indexedVecType.ctors[1].type
+      Ix.Theory.Named.InductiveFixtures.indexedVecType.ctors[1].type
       (.sort (.imax (.succ (.succ (.param 0)))
         (.imax (.succ .zero)
           (.imax (.succ (.param 0))
@@ -1704,4 +1706,4 @@ theorem familyMemberCheckCanonicalConcrete :
     (fun _ support => familyMemberSupport_new support)
     familyMemberInitial_activeInvariant
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorMemberCheck.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorMemberCheck.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorMemberCheck.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorMemberCheck.lean
index 5ff2c1550..bb6320dc7 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorMemberCheck.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorMemberCheck.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAcceptanceClosure
-import Ix.Tc.Verify.Inductive.StructuralCacheSemantics
-import Ix.Tc.Verify.Check.BlockIdentity
-import Ix.Tc.Verify.Whnf.StructEta.ExactMajorTelescope
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAcceptanceClosure
+import Ix.Kernel.Verify.Inductive.StructuralCacheSemantics
+import Ix.Kernel.Verify.Check.BlockIdentity
+import Ix.Kernel.Verify.Whnf.StructEta.ExactMajorTelescope
 
 /-!
 # Generated-recursor member-check handoff
@@ -17,7 +17,7 @@ postulate that the prelude preserves the K2S invariant; subsequent modules
 must prove that from the individual production operations.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open GeneratedRecursorSemantics
 
@@ -939,7 +939,7 @@ theorem checkPreparedRecursorMember_canonicalScoped
     {model : ScopedKernelSuffixModel trProj world}
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {support : RunSupport} {calls : Methods.CallDomain}
-    {source : Lean4Lean.VInductDecl}
+    {source : Ix.Theory.Named.VInductDecl}
     {generation : source.GenerationChecked}
     {id : KId .anon} {prepared : PreparedRecursorMemberCheck .anon}
     {methods : Methods .anon} {initial final : TcState .anon}
@@ -983,7 +983,7 @@ theorem checkPreparedRecursorMember_canonicalActiveScoped
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {support : RunSupport} {members : Array (KId .anon)}
     {calls : Methods.CallDomain}
-    {source : Lean4Lean.VInductDecl}
+    {source : Ix.Theory.Named.VInductDecl}
     {generation : source.GenerationChecked}
     {id : KId .anon} {prepared : PreparedRecursorMemberCheck .anon}
     {methods : Methods .anon} {initial final : TcState .anon}
@@ -1024,4 +1024,4 @@ theorem checkPreparedRecursorMember_canonicalActiveScoped
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorMemberFixture.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorMemberFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorMemberFixture.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorMemberFixture.lean
index 8e50253b5..17324a966 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorMemberFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorMemberFixture.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorCheckerFixture
-import Ix.Tc.Verify.Inductive.GeneratedRecursorMemberCheck
-import Ix.Tc.Verify.Inductive.IndexedBlockValidation
-import Ix.Tc.Verify.Inductive.ResultSortTelescope
-import Ix.Tc.Verify.RecursiveMethods.ScopedInference
-import Ix.Tc.Verify.ScopedSuffix.ClosedContext
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorCheckerFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorMemberCheck
+import Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+import Ix.Kernel.Verify.Inductive.ResultSortTelescope
+import Ix.Kernel.Verify.RecursiveMethods.ScopedInference
+import Ix.Kernel.Verify.ScopedSuffix.ClosedContext
 
 /-!
 # Production recursor-member preparation fixture
@@ -20,12 +20,12 @@ separate operation-level preservation obligations; no whole-prelude oracle is
 introduced.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 open GeneratedRecursorSemantics
 open IndexedRecursiveCertificateFixture
-open Lean4Lean
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveReplayFixtures
 
 local instance generatedMemberAddressDecidableEq : DecidableEq Address :=
   AnonStructural.addressDecidableEq
@@ -44,11 +44,11 @@ local instance generatedMemberKConstDecidableEq : DecidableEq (KConst .anon) :=
   AnonStructural.constDecidableEq
 
 local instance generatedMemberVConstantDecidableEq :
-    DecidableEq Lean4Lean.VConstant := by
+    DecidableEq Ix.Theory.Named.VConstant := by
   intro left right
   cases left
   cases right
-  simp only [Lean4Lean.VConstant.mk.injEq]
+  simp only [Ix.Theory.Named.VConstant.mk.injEq]
   infer_instance
 
 local instance generatedMemberRecRuleDecidableEq :
@@ -160,7 +160,7 @@ theorem familyMemberNatLit_type (value : Nat) :
   induction value with
   | zero =>
       simpa [VExpr.natLit, VExpr.natZero, VExpr.nat, VExpr.instL] using
-        (Lean4Lean.VEnv.HasType.const
+        (Ix.Theory.Named.VEnv.HasType.const
           (env := familyAcceptedWorld.venv)
           (U := familyMemberModel.keys.uvars) (Γ := [])
           (ci := ⟨0, VExpr.nat⟩) (ls := []) familyNatZeroLookup
@@ -169,11 +169,11 @@ theorem familyMemberNatLit_type (value : Nat) :
       have successor : familyAcceptedWorld.venv.HasType
           familyMemberModel.keys.uvars [] (.const ``Nat.succ [])
           (.forallE VExpr.nat VExpr.nat) := by
-        exact Lean4Lean.VEnv.HasType.const familyNatSuccLookup
+        exact Ix.Theory.Named.VEnv.HasType.const familyNatSuccLookup
           (by simp) rfl
       simpa [VExpr.natLit, VExpr.natSucc, VExpr.nat, VExpr.inst,
         VExpr.instL] using
-        Lean4Lean.VEnv.HasType.app successor ih
+        Ix.Theory.Named.VEnv.HasType.app successor ih
 
 /-- The complete literal/projection theory needed by the finite generated-
 artifact comparison schedule.  String literals are impossible because the
@@ -631,7 +631,7 @@ theorem familyMemberInitial_equivalences
     rw [familyMemberInitialEquivEntriesEmpty] at member
     simp at member
 
-/-- Empty runtime stacks reconstruct the empty Lean4Lean local context even
+/-- Empty runtime stacks reconstruct the empty Ix.Theory.Named local context even
 though the environment and its semantic caches are warm. -/
 theorem familyMemberInitial_context :
     CtxRecon familyAcceptedWorld.venv familyMemberModel.keys.uvars
@@ -2435,4 +2435,4 @@ theorem familyMemberCheckCanonicalFromInitialActiveScoped
   rw [familyMemberPreparationRun] at post
   exact familyPreparedMemberCheckCanonicalActiveScoped uvars successor post.1
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorMetadata.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorMetadata.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorMetadata.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorMetadata.lean
index c873b366a..147e0d0eb 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorMetadata.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorMetadata.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.NestedAuxiliaryExpansion
-import Ix.Tc.Verify.Env
+import Ix.Kernel.Verify.Inductive.NestedAuxiliaryExpansion
+import Ix.Kernel.Verify.Env
 
 /-!
 # Generated recursor metadata from the certified flat block
@@ -16,7 +16,7 @@ it makes no assumption about the expression returned by `buildRecType` or the
 state in which that callback succeeds.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace GeneratedRecursorMetadata
 
@@ -634,4 +634,4 @@ theorem buildAndCacheGeneratedRecursors_metadata
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorRuleFixture.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorRuleFixture.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorRuleFixture.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorRuleFixture.lean
index da97d6f17..a4b5738c9 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorRuleFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorRuleFixture.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorTypeFixture
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeFixture
 
 /-!
 # Production generated-recursor rule fixture
@@ -11,15 +11,15 @@ invokes `buildRuleRhs` for both constructors before returning its local batch.
 
 As with the type fixture, total projections have unreachable fallbacks.  The
 public run theorem proves the successful data-bearing branch, and the final
-theorem identifies every returned rule position with Lean4Lean's canonical
+theorem identifies every returned rule position with Ix.Theory.Named's canonical
 normalized-constructor rule.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 open GeneratedRecursorSemantics
 open IndexedRecursiveCertificateFixture
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 local instance generatedRuleKIdDecidableEq : DecidableEq (KId .anon) :=
   AnonStructural.idDecidableEq
@@ -127,7 +127,7 @@ private theorem generationRuleCountNative :
   native_decide
 
 /-- The array returned by the actual complete-rule builder is positionally the
-canonical Lean4Lean rule array for the certified IndexedVec generation. -/
+canonical Ix.Theory.Named rule array for the certified IndexedVec generation. -/
 theorem familyBuildRulesCanonical :
     CanonicalRulesS indexedVecFinalEnv nameOf RawProjRel.none
       transaction.certificate.generation familyBuiltRules := by
@@ -157,7 +157,7 @@ theorem familyCompletedTypeCanonical :
       transaction.certificate.generation familyCompletedRecursor := by
   unfold CanonicalTypeS
   rw [familyCompletedRecursorType_eq]
-  simpa [Lean4Lean.VInductDecl.GenerationChecked.recursor] using
+  simpa [Ix.Theory.Named.VInductDecl.GenerationChecked.recursor] using
     recursorTypeTyped
 
 /-- The actual local result of the rule-population core contains both the
@@ -187,4 +187,4 @@ theorem familyBuildArtifactsExecution :
       transaction.certificate.generation familyCompletedRecursor :=
   ⟨familyRulePopulationRun, familyCompletedArtifactsCanonical⟩
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorSelection.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorSelection.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorSelection.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorSelection.lean
index 15d91f28e..9183b0c16 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorSelection.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorSelection.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAcceptance
-import Ix.Tc.Verify.Check.ScopedActiveBlock
-import Ix.Tc.Verify.RecursiveMethods.ScopedCallDomains
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAcceptance
+import Ix.Kernel.Verify.Check.ScopedActiveBlock
+import Ix.Kernel.Verify.RecursiveMethods.ScopedCallDomains
 
 /-!
 # Generated-recursor selection callbacks
@@ -12,7 +12,7 @@ call is tied to the exact generated array position and the frozen stored type;
 metadata-only iterations are state-pure.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open GeneratedRecursorSemantics
 
@@ -30,7 +30,7 @@ def GeneratedSelectionCallPlan (calls : Methods.CallDomain)
 /-- Closed translations for the stored type and every generated type that
 the finite selection fold can reach. -/
 structure GeneratedSelectionTranslationPlan
-    (env : Lean4Lean.VEnv) (uvars : Nat)
+    (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     (generated : Array (GeneratedRecursor .anon))
     (ty : KExpr .anon) : Prop where
@@ -291,4 +291,4 @@ theorem selectGeneratedRecursorIndex_preservesActiveScoped
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorSemantics.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorSemantics.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorSemantics.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorSemantics.lean
index 79207e2c4..90a3e53e1 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorSemantics.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorSemantics.lean
@@ -1,13 +1,13 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorMetadata
-import Ix.Tc.Verify.Trans
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorMetadata
+import Ix.Kernel.Verify.Trans
 
 /-!
 # Canonical semantics of generated recursor artifacts
 
 This is the representation boundary for E2c's generated artifacts.  It names
 the exact structural correspondence that the production builders must prove:
-the generated type is Lean4Lean's `GenerationChecked.recType`, and rule `i`
-is Lean4Lean's `GenerationChecked.rule i` for constructor `i`.  Rule lookup is
+the generated type is Ix.Theory.Named's `GenerationChecked.recType`, and rule `i`
+is Ix.Theory.Named's `GenerationChecked.rule i` for constructor `i`.  Rule lookup is
 positional; equal bodies at a different index are not interchangeable.
 
 Types and rules are deliberately separate.  The public production commit
@@ -16,14 +16,14 @@ local builder.  `commitGeneratedRecursorRulesAt_canonicalAt` proves that these
 two independently established facts compose across that exact transaction.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VEnv VExpr VInductDecl)
+open Ix.Theory.Named (VEnv VExpr VInductDecl)
 
 namespace GeneratedRecursorSemantics
 
 /-- Exact structural correspondence between one immutable Ix generated type
-and Lean4Lean's canonical mixed recursor type. -/
+and Ix.Theory.Named's canonical mixed recursor type. -/
 def CanonicalTypeS (env : VEnv) (nameOf : Address → Option Lean.Name)
     (trProj : RawProjRel) {source : VInductDecl}
     (generation : source.GenerationChecked)
@@ -32,7 +32,7 @@ def CanonicalTypeS (env : VEnv) (nameOf : Address → Option Lean.Name)
     generation.recType
 
 /-- Exact positional correspondence between one Ix rule array and all rules
-generated by the same Lean4Lean generation. -/
+generated by the same Ix.Theory.Named generation. -/
 structure CanonicalRulesS (env : VEnv)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     {source : VInductDecl} (generation : source.GenerationChecked)
@@ -58,7 +58,7 @@ structure CanonicalArtifactsS (env : VEnv)
 namespace CanonicalRulesS
 
 /-- A positional Ix rule corresponds to the rule at the same position in
-Lean4Lean's public `generatedRules` array. -/
+Ix.Theory.Named's public `generatedRules` array. -/
 theorem generatedRuleAt
     {env : VEnv} {nameOf : Address → Option Lean.Name}
     {trProj : RawProjRel} {source : VInductDecl}
@@ -104,7 +104,7 @@ end CanonicalArtifactsS
 /-! ## Defeq-quotiented form consumed by recursor acceptance -/
 
 /-- Semantic type correspondence after quotienting the structural target by
-Lean4Lean definitional equality. Stored recursors accepted by production need
+Ix.Theory.Named definitional equality. Stored recursors accepted by production need
 this form: `isDefEq` does not imply syntax equality. -/
 def CanonicalType (env : VEnv) (nameOf : Address → Option Lean.Name)
     (trProj : RawProjRel) {source : VInductDecl}
@@ -240,4 +240,4 @@ theorem RecM.commitGeneratedRecursorRulesAt_canonicalAt
 
 end GeneratedRecursorSemantics
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorTypeClosure.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorTypeClosure.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorTypeClosure.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorTypeClosure.lean
index f072f0be9..750eff66d 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorTypeClosure.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorTypeClosure.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorSemantics
-import Ix.Tc.Verify.Whnf
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorSemantics
+import Ix.Kernel.Verify.Whnf
+
+open Ix.Theory (VLevel)
 
 /-!
 # Generated recursor telescope closure
@@ -12,7 +14,7 @@ obtained.
 
 The proof has two deliberately separate parts:
 
-* `closeK`/`closeV` are the exact Ix and Lean4Lean reverse closures;
+* `closeK`/`closeV` are the exact Ix and Ix.Theory.Named reverse closures;
 * `TelescopeS` records each domain at the context in which production built
   it, rather than assuming a relation for the already-closed result.
 
@@ -21,9 +23,9 @@ intern request.  Thus hash-consing cannot silently replace a generated forall
 with a colliding expression.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VEnv VExpr VInductDecl VLevel VLocalDecl)
+open Ix.Theory.Named (VEnv VExpr VInductDecl VLocalDecl)
 
 namespace GeneratedRecursorTypeClosure
 
@@ -34,13 +36,13 @@ def closeK (domains : Array (KExpr .anon)) : Nat → KExpr .anon → KExpr .anon
       closeK domains remaining
         (.mkAll RecM.anonN RecM.anonBi domains[remaining]! body)
 
-/-- Lean4Lean-side closure with the same array positions and order. -/
+/-- Ix.Theory.Named-side closure with the same array positions and order. -/
 def closeV (domains : Array VExpr) : Nat → VExpr → VExpr
   | 0, body => body
   | remaining + 1, body =>
       closeV domains remaining (.forallE domains[remaining]! body)
 
-/-- The flattened target domain list used by Lean4Lean's canonical mixed
+/-- The flattened target domain list used by Ix.Theory.Named's canonical mixed
 recursor type. -/
 def canonicalMajorDomain {source : VInductDecl}
     (generation : source.GenerationChecked) : VExpr :=
@@ -91,7 +93,7 @@ theorem closeV_eq_forallN_take (domains : Array VExpr) (count : Nat)
       simp only [Option.toList_some, VExpr.forallN_append, VExpr.forallN,
         getElem!_def, hindex, Array.getElem?_eq_getElem]
 
-/-- Closing the whole canonical flattened telescope is exactly Lean4Lean's
+/-- Closing the whole canonical flattened telescope is exactly Ix.Theory.Named's
 public mixed recursor type, not merely a definitionally equal variant. -/
 theorem closeV_canonical {source : VInductDecl}
     (generation : source.GenerationChecked) :
@@ -133,7 +135,7 @@ theorem opened_toCtx (base : KVLCtx) (domains : Array VExpr) (count : Nat)
         Array.getElem?_eq_getElem, List.reverse_append, List.reverse_singleton,
         List.cons_append, List.nil_append]
 
-/-- Inversion for a well-formed iterated forall.  Lean4Lean provides the
+/-- Inversion for a well-formed iterated forall.  Ix.Theory.Named provides the
 constructor theorem `IsType.forallN`; the converse is what lets the production
 builder consume the canonical result type one open domain at a time. -/
 theorem isType_forallN_inv
@@ -146,7 +148,7 @@ theorem isType_forallN_inv
   | nil => exact ⟨trivial, h⟩
   | cons domain domains ih =>
       obtain ⟨hdomain, hrest⟩ :=
-        Lean4Lean.VEnv.IsType.forallE_inv henv h
+        Ix.Theory.Named.VEnv.IsType.forallE_inv henv h
       obtain ⟨htelescope, hbody⟩ := ih hrest
       exact ⟨⟨hdomain, htelescope⟩,
         by simpa [List.reverse_cons, List.append_assoc] using hbody⟩
@@ -170,7 +172,7 @@ theorem onTel_isType_getElem
           simpa [List.take, List.reverse_cons, List.append_assoc] using
             ih hrest index htail
 
-/-- Lean4Lean's semantic generation invariant decomposes into precisely the
+/-- Ix.Theory.Named's semantic generation invariant decomposes into precisely the
 flattened target telescope and open body used by the production builder. -/
 theorem canonical_onTel_and_bodyType
     {source : VInductDecl} {generation : source.GenerationChecked}
@@ -252,7 +254,7 @@ namespace TelescopeS
 
 /-- Construct the operation-shaped telescope from only the Ix-to-target
 relations produced by the live builder. All target typing fields are recovered
-from Lean4Lean's generation invariant. -/
+from Ix.Theory.Named's generation invariant. -/
 theorem of_canonical
     {source : VInductDecl} {generation : source.GenerationChecked}
     {env : VEnv}
@@ -330,7 +332,7 @@ theorem close
       have hclosedBodyType :
           env.IsType uvars (opened base targetDomains count).toCtx
             targetBody' :=
-        Lean4Lean.VEnv.IsType.forallE hdomainType hbodyType
+        Ix.Theory.Named.VEnv.IsType.forallE hdomainType hbodyType
       have hprefix : TelescopeS env uvars nameOf trProj base ixDomains
           targetDomains count ixBody' targetBody' :=
         { ixBound := by omega
@@ -521,7 +523,7 @@ structure CanonicalBodyS (support : RunSupport) (env : VEnv)
 
 /-- Once the actual domain/body run establishes its operation-shaped
 postcondition, the real `buildRecType` execution returns a structurally
-canonical Lean4Lean recursor type. This theorem closes all control-flow and
+canonical Ix.Theory.Named recursor type. This theorem closes all control-flow and
 hash-consing obligations after that body boundary. -/
 theorem buildRecType_canonical_of_body
     {support : RunSupport} (hcollision : support.CollisionFree)
@@ -554,4 +556,4 @@ theorem buildRecType_canonical_of_body
 
 end GeneratedRecursorTypeClosure
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/GeneratedRecursorTypeFixture.lean b/Ix/Kernel/Verify/Inductive/GeneratedRecursorTypeFixture.lean
similarity index 92%
rename from Ix/Tc/Verify/Inductive/GeneratedRecursorTypeFixture.lean
rename to Ix/Kernel/Verify/Inductive/GeneratedRecursorTypeFixture.lean
index 3e6d55d85..7411db576 100644
--- a/Ix/Tc/Verify/Inductive/GeneratedRecursorTypeFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/GeneratedRecursorTypeFixture.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorTypeClosure
-import Ix.Tc.Verify.Inductive.IndexedRecursiveAcceptance
-import Ix.Tc.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorTypeClosure
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveAcceptance
+import Ix.Kernel.Verify.Ingress.AnonStructural
 
 /-!
 # Production generated-recursor type fixture
@@ -14,15 +14,15 @@ production helpers.
 
 The fallback values only make the projections total.  The public run
 theorems prove that neither fallback is taken, and the final theorem relates
-the expression returned by that exact execution to Lean4Lean's canonical
+the expression returned by that exact execution to Ix.Theory.Named's canonical
 mixed recursor type.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 open GeneratedRecursorSemantics
 open IndexedRecursiveCertificateFixture
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 local instance generatedTypeKIdDecidableEq : DecidableEq (KId .anon) :=
   AnonStructural.idDecidableEq
@@ -163,7 +163,7 @@ def familyBuiltRecursor : GeneratedRecursor .anon :=
     familyBuildTypeResult
 
 /-- The type produced by the concrete `buildRecType` execution is the exact
-structural translation of Lean4Lean's canonical `IndexedVec` recursor type. -/
+structural translation of Ix.Theory.Named's canonical `IndexedVec` recursor type. -/
 theorem familyBuildTypeCanonical :
     CanonicalTypeS indexedVecFinalEnv nameOf RawProjRel.none
       transaction.certificate.generation familyBuiltRecursor := by
@@ -172,7 +172,7 @@ theorem familyBuildTypeCanonical :
     transaction.certificate.generation.recursor.uvars nameOf RawProjRel.none
     [] familyBuildTypeResult transaction.certificate.generation.recType
   rw [familyBuildTypeResult_eq]
-  simpa [Lean4Lean.VInductDecl.GenerationChecked.recursor] using
+  simpa [Ix.Theory.Named.VInductDecl.GenerationChecked.recursor] using
     recursorTypeTyped
 
 /-- One data-bearing theorem packages the production execution and its exact
@@ -192,4 +192,4 @@ theorem familyBuildTypeExecution :
   simpa [familyBuiltRecursor, RecM.initialGeneratedRecursor] using
     familyBuildTypeRun
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedBlockValidation.lean b/Ix/Kernel/Verify/Inductive/IndexedBlockValidation.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/IndexedBlockValidation.lean
rename to Ix/Kernel/Verify/Inductive/IndexedBlockValidation.lean
index 4c810a83a..32a6ecdc0 100644
--- a/Ix/Tc/Verify/Inductive/IndexedBlockValidation.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedBlockValidation.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.ConstructorValidationTraversal
-import Ix.Tc.Verify.Inductive.IndexedRecursiveAcceptance
-import Ix.Tc.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Inductive.ConstructorValidationTraversal
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveAcceptance
+import Ix.Kernel.Verify.Ingress.AnonStructural
 
 /-!
 # IndexedVec production block-validation trace
@@ -13,7 +13,7 @@ header, constructor order, and safety-gated positivity executions reached by
 that one block run.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 local instance blockValidationIdDecidableEq : DecidableEq (KId .anon) :=
   AnonStructural.idDecidableEq
@@ -471,4 +471,4 @@ theorem indexedVecConsProductionPositivityTrace :
           exact ⟨indLevel, _, _, _, _, _, _, _, _, metadata, parameters, run,
             trace, universes, returnType⟩
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedCandidateOperations.lean b/Ix/Kernel/Verify/Inductive/IndexedCandidateOperations.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/IndexedCandidateOperations.lean
rename to Ix/Kernel/Verify/Inductive/IndexedCandidateOperations.lean
index aa5d2e96e..823ac328c 100644
--- a/Ix/Tc/Verify/Inductive/IndexedCandidateOperations.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedCandidateOperations.lean
@@ -1,19 +1,19 @@
-import Ix.Tc.Verify.Inductive.IndexedCandidateSyntax
-import Ix.Tc.Verify.Inductive.IndexedRecursiveAcceptance
+import Ix.Kernel.Verify.Inductive.IndexedCandidateSyntax
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveAcceptance
 
 /-!
 # IndexedVec candidate operations
 
 The closed syntax relation is not enough once constructor validation opens its
 telescope.  This module follows the same anonymous binder instantiation used
-by `TcM.openBinderAnon`, pairs each minted Ix identifier with Lean4Lean's
+by `TcM.openBinderAnon`, pairs each minted Ix identifier with Ix.Theory.Named's
 corresponding validation identifier, and checks the three actual `cons` field
 domains at which positivity is invoked.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 /-- Domain projection used only after a separately checked constructor shape.
 Returning the source in the impossible fallback keeps the definition total. -/
@@ -430,4 +430,4 @@ theorem tailDomainCandidateSyntax :
           indexedVecConstructorNExpr) :=
   CandidateSyntax.rel_of_check tailDomainCandidateCheckNative
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedCandidateSyntax.lean b/Ix/Kernel/Verify/Inductive/IndexedCandidateSyntax.lean
similarity index 81%
rename from Ix/Tc/Verify/Inductive/IndexedCandidateSyntax.lean
rename to Ix/Kernel/Verify/Inductive/IndexedCandidateSyntax.lean
index d8810062b..3629e913a 100644
--- a/Ix/Tc/Verify/Inductive/IndexedCandidateSyntax.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedCandidateSyntax.lean
@@ -1,23 +1,23 @@
-import Ix.Tc.Verify.Inductive.CandidateSyntax
-import Ix.Tc.Verify.Inductive.IndexedRecursiveFixture
-import Lean4Lean.Verify.Environment.IndexedVecOuterReplay
+import Ix.Kernel.Verify.Inductive.CandidateSyntax
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveFixture
+import Ix.Theory.Named.Verify.Environment.IndexedVecOuterReplay
 
 /-!
 # Exact IndexedVec candidate syntax
 
 This module connects the actual anonymous expressions produced by Ix ingress
-to the exact Lean kernel expressions consumed by Lean4Lean's constructor
+to the exact Lean kernel expressions consumed by Ix.Theory.Named's constructor
 validator.  The relation is deliberately syntactic: positivity occurrence
 and `isValidIndApp?` inspect the candidate expression rather than its Theory
 denotation.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean.InductiveReplayFixtures
-open Lean4Lean.InductiveReplayFixtures.IndexedVecConsReplay
+open Ix.Theory.Named.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures.IndexedVecConsReplay
 
-/-! ## Proof-independent Lean4Lean validation fixture
+/-! ## Proof-independent Ix.Theory.Named validation fixture
 
 The upstream replay exposes the right executable values, but its public
 `indexedVecCtorValidationContext` is projected out of a proof-bearing family
@@ -30,7 +30,7 @@ data.  These are the values E2c relates to production Ix execution.
 /-- Post-family context in which the two IndexedVec constructors are checked.
 It has the validated parameter/index local context and the staged environment
 containing the family constant, without retaining an upstream replay proof. -/
-def indexedVecConstructorContext : Lean4Lean.AddInductive.Context :=
+def indexedVecConstructorContext : Ix.Theory.Named.AddInductive.Context :=
   { indexedVecValidationFamilyContext with env := ctorEnv }
 
 def indexedVecConstructorAlpha : Lean.Expr :=
@@ -45,18 +45,18 @@ def indexedVecConstructorNId : Lean.FVarId :=
 def indexedVecConstructorNExpr : Lean.Expr :=
   indexedVecConstructorContext.freshExpr
 
-def indexedVecConstructorNContext : Lean4Lean.AddInductive.Context :=
+def indexedVecConstructorNContext : Ix.Theory.Named.AddInductive.Context :=
   indexedVecConstructorContext.pushLocalDecl
     consNName .implicit (.const ``Nat [])
 
 def indexedVecConstructorHeadId : Lean.FVarId :=
   indexedVecConstructorNContext.freshFVarId
 
-def indexedVecConstructorHeadContext : Lean4Lean.AddInductive.Context :=
+def indexedVecConstructorHeadContext : Ix.Theory.Named.AddInductive.Context :=
   indexedVecConstructorNContext.pushLocalDecl
     consHeadName .default indexedVecConstructorAlpha
 
-def indexedVecConstructorTailContext : Lean4Lean.AddInductive.Context :=
+def indexedVecConstructorTailContext : Ix.Theory.Named.AddInductive.Context :=
   indexedVecConstructorHeadContext.pushLocalDecl consTailName .default
     (ctorIndexedVecApp indexedVecConstructorAlpha
       indexedVecConstructorNExpr)
@@ -65,13 +65,13 @@ def indexedVecConstructorTailContext : Lean4Lean.AddInductive.Context :=
 one-index family spine.  Writing the finite record directly prevents the
 statement from retaining `CandidateExprTrace.singletonCandidateInductiveStats`
 through an upstream proof object. -/
-def indexedVecConstructorStats : Lean4Lean.AddInductive.InductiveStats where
+def indexedVecConstructorStats : Ix.Theory.Named.AddInductive.InductiveStats where
   lctx := indexedVecConstructorContext.lctx
   levels := [.param `u]
   resultLevel := .succ (.param `u)
   nindices := #[1]
   indConsts :=
-    #[.const ``Lean4Lean.InductiveFixtures.IndexedVec [.param `u]]
+    #[.const ``Ix.Theory.Named.InductiveFixtures.IndexedVec [.param `u]]
   params := #[indexedVecConstructorAlpha]
   isNotZero := true
 
@@ -120,7 +120,7 @@ private theorem consCandidateCheckNative :
   native_decide
 
 /-- The family type selected by production anonymous ingress is exactly the
-Lean4Lean IndexedVec family candidate, modulo irrelevant binder metadata. -/
+Ix.Theory.Named IndexedVec family candidate, modulo irrelevant binder metadata. -/
 theorem familyCandidateSyntax :
     CandidateSyntaxRel nameOf
       (fun ixId leanId => closedFVarMatches ixId leanId = true)
@@ -130,7 +130,7 @@ theorem familyCandidateSyntax :
   CandidateSyntax.rel_of_check familyCandidateCheckNative
 
 /-- The ingressed nil constructor type is the exact candidate validated by
-Lean4Lean. -/
+Ix.Theory.Named. -/
 theorem nilCandidateSyntax :
     CandidateSyntaxRel nameOf
       (fun ixId leanId => closedFVarMatches ixId leanId = true)
@@ -140,7 +140,7 @@ theorem nilCandidateSyntax :
   CandidateSyntax.rel_of_check nilCandidateCheckNative
 
 /-- The ingressed cons constructor type is the exact candidate validated by
-Lean4Lean, including its recursive family application and changing index. -/
+Ix.Theory.Named, including its recursive family application and changing index. -/
 theorem consCandidateSyntax :
     CandidateSyntaxRel nameOf
       (fun ixId leanId => closedFVarMatches ixId leanId = true)
@@ -153,7 +153,7 @@ private theorem candidateBlockSyntaxNative :
     CandidateBlockRel nameOf #[familyId.addr]
       indexedVecConstructorStats.indConsts := by
   rw [show indexedVecConstructorStats.indConsts =
-      #[.const ``Lean4Lean.InductiveFixtures.IndexedVec [.param `u]] by rfl]
+      #[.const ``Ix.Theory.Named.InductiveFixtures.IndexedVec [.param `u]] by rfl]
   intro id leanName hname
   unfold nameOf at hname
   repeat' split at hname
@@ -161,7 +161,7 @@ private theorem candidateBlockSyntaxNative :
   all_goals subst_vars
   all_goals native_decide
 
-/-- The physical singleton-family address and Lean4Lean's singleton constant
+/-- The physical singleton-family address and Ix.Theory.Named's singleton constant
 array make the same occurrence decision.  The proof analyzes the concrete
 ingress name map, so it assumes neither address nor name injectivity. -/
 theorem candidateBlockSyntax :
@@ -169,4 +169,4 @@ theorem candidateBlockSyntax :
       indexedVecConstructorStats.indConsts :=
   candidateBlockSyntaxNative
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedCandidateTransaction.lean b/Ix/Kernel/Verify/Inductive/IndexedCandidateTransaction.lean
similarity index 78%
rename from Ix/Tc/Verify/Inductive/IndexedCandidateTransaction.lean
rename to Ix/Kernel/Verify/Inductive/IndexedCandidateTransaction.lean
index b6ac31279..75bfda340 100644
--- a/Ix/Tc/Verify/Inductive/IndexedCandidateTransaction.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedCandidateTransaction.lean
@@ -1,25 +1,25 @@
-import Ix.Tc.Verify.Inductive.IndexedRecursiveCertificate
-import Ix.Tc.Verify.Inductive.ProducedGenerationTransaction
-import Lean4Lean.Verify.Environment.IndexedVecSemanticReplay
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveCertificate
+import Ix.Kernel.Verify.Inductive.ProducedGenerationTransaction
+import Ix.Theory.Named.Verify.Environment.IndexedVecSemanticReplay
 
 /-!
 # Producer-linked IndexedVec generation transaction
 
 The existing `IndexedVec` certificate is deliberately reconstructed through
 the Theory-only API so its semantic roots keep a minimal trust footprint.
-Lean4Lean also exposes the exact ordinary metadata producer and dependent
+Ix.Theory.Named also exposes the exact ordinary metadata producer and dependent
 semantic package for that same generation.  This module proves those two
 paths meet, without making the producer replay a dependency of the clean
 Theory-only transaction.
 -/
 
-namespace Ix.Tc.IndexedRecursiveCertificateFixture
+namespace Ix.Kernel.IndexedRecursiveCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
-/-- The L4L-01E package retains the exact source declaration and checked
+/-- The Spec-01E package retains the exact source declaration and checked
 generation selected by the ordinary metadata producer. -/
 noncomputable def exactPackage :
     VInductDecl.ExactProducedGenerationCandidatePackage natFinalEnv [`u]
@@ -45,7 +45,7 @@ noncomputable def exactProducedTransaction :
     exact indexedVecSemantic_addInductCertified
   beforeWF := natWF
 
-/-- Intentional operational erasure of the exact L4L-01E indices. -/
+/-- Intentional operational erasure of the exact Spec-01E indices. -/
 noncomputable def producedTransaction :
     ProducedGenerationTransaction natFinalEnv indexedVecFinalEnv [`u] :=
   exactProducedTransaction.toProduced
@@ -66,4 +66,4 @@ before erasure. -/
 theorem producerLinkedFacts : producedTransaction.Facts :=
   producedTransaction.facts
 
-end Ix.Tc.IndexedRecursiveCertificateFixture
+end Ix.Kernel.IndexedRecursiveCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedConstructorPositivity.lean b/Ix/Kernel/Verify/Inductive/IndexedConstructorPositivity.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/IndexedConstructorPositivity.lean
rename to Ix/Kernel/Verify/Inductive/IndexedConstructorPositivity.lean
index 53c4c38a9..84b75ce6a 100644
--- a/Ix/Tc/Verify/Inductive/IndexedConstructorPositivity.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedConstructorPositivity.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.ConstructorPositivityTraversal
-import Ix.Tc.Verify.Inductive.IndexedPositivityTransport
+import Ix.Kernel.Verify.Inductive.ConstructorPositivityTraversal
+import Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
 
 /-!
 # IndexedVec enclosing constructor-positivity execution
@@ -15,7 +15,7 @@ also records the shared-parameter opening, source-ordered bounded field loop,
 and public local-context restoration performed by production.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 /-- Exact result of running production strict positivity on the ingressed
 `IndexedVec.cons` declaration. -/
@@ -57,4 +57,4 @@ theorem indexedVecConsIxPositivityTrace :
       checkerMethods checkerInitial ixConsPositivityAfter :=
   RecM.checkPositivity_success checkerMethods ixConsPositivityRun
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedConstructorValidation.lean b/Ix/Kernel/Verify/Inductive/IndexedConstructorValidation.lean
similarity index 85%
rename from Ix/Tc/Verify/Inductive/IndexedConstructorValidation.lean
rename to Ix/Kernel/Verify/Inductive/IndexedConstructorValidation.lean
index 530ad3a1c..cde7de964 100644
--- a/Ix/Tc/Verify/Inductive/IndexedConstructorValidation.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedConstructorValidation.lean
@@ -1,24 +1,24 @@
-import Ix.Tc.Verify.Inductive.IndexedPositivityTransport
+import Ix.Kernel.Verify.Inductive.IndexedPositivityTransport
 
 /-!
 # IndexedVec constructor-validation trace
 
 This module places the three production-derived positivity artifacts back into
-Lean4Lean's complete retained constructor telescope.  The resulting trace
+Ix.Theory.Named's complete retained constructor telescope.  The resulting trace
 records the shared parameter check, all ordinary field type/universe checks,
 the transported positivity evidence, and the terminal indexed-family
 application.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean.InductiveReplayFixtures
-open Lean4Lean.InductiveReplayFixtures.IndexedVecConsReplay
+open Ix.Theory.Named.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures.IndexedVecConsReplay
 
 private abbrev ConsValidationTrace
-    (context : Lean4Lean.AddInductive.Context) (source : Lean.Expr)
+    (context : Ix.Theory.Named.AddInductive.Context) (source : Lean.Expr)
     (argIdx fuel : Nat) :=
-  Lean4Lean.AddInductive.ConstructorTypeValidationTrace
+  Ix.Theory.Named.AddInductive.ConstructorTypeValidationTrace
     indexedVecConstructorStats false 0 indexedVecKernelCons.name
       context source argIdx fuel
 
@@ -26,13 +26,13 @@ private abbrev ConsValidationTrace
 
 private theorem indexedVecConstructorGetTypeAlphaNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.AddInductive.getType indexedVecConstructorAlpha
+      (Ix.Theory.Named.AddInductive.getType indexedVecConstructorAlpha
         indexedVecConstructorContext)
       (.sort (.succ (.param `u))) = true := by
   native_decide
 
 private theorem indexedVecConstructorGetTypeAlpha :
-    Lean4Lean.AddInductive.getType indexedVecConstructorAlpha
+    Ix.Theory.Named.AddInductive.getType indexedVecConstructorAlpha
         indexedVecConstructorContext =
       .ok (.sort (.succ (.param `u))) :=
   ExactLeanSyntax.exceptExpr_eq_ok_of_check
@@ -40,116 +40,116 @@ private theorem indexedVecConstructorGetTypeAlpha :
 
 private theorem indexedVecConstructorParamIsDefEqNative :
     ExactLeanSyntax.exceptBoolCheck
-      (Lean4Lean.TypeChecker.M.run indexedVecConstructorContext.env
+      (Ix.Theory.Named.TypeChecker.M.run indexedVecConstructorContext.env
         indexedVecConstructorContext.safety
         indexedVecConstructorContext.lctx
         indexedVecConstructorContext.lparams
         indexedVecConstructorContext.fuel
-        (Lean4Lean.TypeChecker.isDefEq
+        (Ix.Theory.Named.TypeChecker.isDefEq
           (.sort (.succ (.param `u)))
           (.sort (.succ (.param `u))))) true = true := by
   native_decide
 
 private theorem indexedVecConstructorParamIsDefEq :
-    Lean4Lean.AddInductive.CandidateIsDefEqStep.Valid
+    Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.Valid
       ⟨indexedVecConstructorContext,
         .sort (.succ (.param `u)), .sort (.succ (.param `u))⟩ := by
-  unfold Lean4Lean.AddInductive.CandidateIsDefEqStep.Valid
+  unfold Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.Valid
   exact ExactLeanSyntax.exceptBool_eq_ok_of_check
     indexedVecConstructorParamIsDefEqNative
 
 private theorem indexedVecConstructorNatEnsureTypeNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run indexedVecConstructorContext.env
+      (Ix.Theory.Named.TypeChecker.M.run indexedVecConstructorContext.env
         indexedVecConstructorContext.safety
         indexedVecConstructorContext.lctx
         indexedVecConstructorContext.lparams
         indexedVecConstructorContext.fuel
-        (Lean4Lean.TypeChecker.ensureType (.const ``Nat [])))
+        (Ix.Theory.Named.TypeChecker.ensureType (.const ``Nat [])))
       (.sort (.succ .zero)) = true := by
   native_decide
 
 private theorem indexedVecConstructorNatEnsureType :
-    Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+    Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
       ⟨indexedVecConstructorContext, .const ``Nat [],
         .sort (.succ .zero)⟩ := by
-  unfold Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+  unfold Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     indexedVecConstructorNatEnsureTypeNative
 
 private theorem indexedVecConstructorAlphaEnsureTypeNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run indexedVecConstructorNContext.env
+      (Ix.Theory.Named.TypeChecker.M.run indexedVecConstructorNContext.env
         indexedVecConstructorNContext.safety
         indexedVecConstructorNContext.lctx
         indexedVecConstructorNContext.lparams
         indexedVecConstructorNContext.fuel
-        (Lean4Lean.TypeChecker.ensureType indexedVecConstructorAlpha))
+        (Ix.Theory.Named.TypeChecker.ensureType indexedVecConstructorAlpha))
       (.sort (.succ (.param `u))) = true := by
   native_decide
 
 private theorem indexedVecConstructorAlphaEnsureType :
-    Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+    Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
       ⟨indexedVecConstructorNContext, indexedVecConstructorAlpha,
         .sort (.succ (.param `u))⟩ := by
-  unfold Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+  unfold Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     indexedVecConstructorAlphaEnsureTypeNative
 
 private theorem indexedVecConstructorTailEnsureTypeNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run indexedVecConstructorHeadContext.env
+      (Ix.Theory.Named.TypeChecker.M.run indexedVecConstructorHeadContext.env
         indexedVecConstructorHeadContext.safety
         indexedVecConstructorHeadContext.lctx
         indexedVecConstructorHeadContext.lparams
         indexedVecConstructorHeadContext.fuel
-        (Lean4Lean.TypeChecker.ensureType
+        (Ix.Theory.Named.TypeChecker.ensureType
           (ctorIndexedVecApp indexedVecConstructorAlpha
             indexedVecConstructorNExpr)))
       (.sort (.succ (.param `u))) = true := by
   native_decide
 
 private theorem indexedVecConstructorTailEnsureType :
-    Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+    Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
       ⟨indexedVecConstructorHeadContext,
         ctorIndexedVecApp indexedVecConstructorAlpha
           indexedVecConstructorNExpr,
         .sort (.succ (.param `u))⟩ := by
-  unfold Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+  unfold Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     indexedVecConstructorTailEnsureTypeNative
 
 private theorem indexedVecConstructorResultIsValidNative :
-    Lean4Lean.AddInductive.isValidIndAppIdx indexedVecConstructorStats
+    Ix.Theory.Named.AddInductive.isValidIndAppIdx indexedVecConstructorStats
       indexedVecConstructorResult 0 = true := by
   native_decide
 
 private theorem indexedVecConstructorConsumeNatNative :
     ExactLeanSyntax.exprCheck
-      (Lean4Lean.AddInductive.consumeTypeAnnotations (.const ``Nat []))
+      (Ix.Theory.Named.AddInductive.consumeTypeAnnotations (.const ``Nat []))
       (.const ``Nat []) = true := by
   native_decide
 
 private theorem indexedVecConstructorConsumeNat :
-    Lean4Lean.AddInductive.consumeTypeAnnotations (.const ``Nat []) =
+    Ix.Theory.Named.AddInductive.consumeTypeAnnotations (.const ``Nat []) =
       .const ``Nat [] :=
   ExactLeanSyntax.expr_eq_of_check indexedVecConstructorConsumeNatNative
 
 private theorem indexedVecConstructorConsumeAlphaNative :
     ExactLeanSyntax.exprCheck
-      (Lean4Lean.AddInductive.consumeTypeAnnotations
+      (Ix.Theory.Named.AddInductive.consumeTypeAnnotations
         indexedVecConstructorAlpha)
       indexedVecConstructorAlpha = true := by
   native_decide
 
 private theorem indexedVecConstructorConsumeAlpha :
-    Lean4Lean.AddInductive.consumeTypeAnnotations
+    Ix.Theory.Named.AddInductive.consumeTypeAnnotations
         indexedVecConstructorAlpha = indexedVecConstructorAlpha :=
   ExactLeanSyntax.expr_eq_of_check indexedVecConstructorConsumeAlphaNative
 
 private theorem indexedVecConstructorConsumeTailNative :
     ExactLeanSyntax.exprCheck
-      (Lean4Lean.AddInductive.consumeTypeAnnotations
+      (Ix.Theory.Named.AddInductive.consumeTypeAnnotations
         (ctorIndexedVecApp indexedVecConstructorAlpha
           indexedVecConstructorNExpr))
       (ctorIndexedVecApp indexedVecConstructorAlpha
@@ -157,7 +157,7 @@ private theorem indexedVecConstructorConsumeTailNative :
   native_decide
 
 private theorem indexedVecConstructorConsumeTail :
-    Lean4Lean.AddInductive.consumeTypeAnnotations
+    Ix.Theory.Named.AddInductive.consumeTypeAnnotations
         (ctorIndexedVecApp indexedVecConstructorAlpha
           indexedVecConstructorNExpr) =
       ctorIndexedVecApp indexedVecConstructorAlpha
@@ -266,19 +266,19 @@ private theorem indexedVecConstructorInstantiateTail :
     indexedVecConstructorInstantiateTailNative
 
 private theorem indexedVecConstructorNatUniverse :
-    Lean4Lean.AddInductive.levelStructGe
+    Ix.Theory.Named.AddInductive.levelStructGe
       indexedVecConstructorStats.resultLevel (.succ .zero) = true := by
   native_decide
 
 private theorem indexedVecConstructorParamUniverse :
-    Lean4Lean.AddInductive.levelStructGe
+    Ix.Theory.Named.AddInductive.levelStructGe
       indexedVecConstructorStats.resultLevel (.succ (.param `u)) = true := by
   native_decide
 
 /-- Complete retained validation of the real `IndexedVec.cons` candidate.
 
 Unlike applying `ConstructorTypeValidationTrace.exists_of_run` to the
-already-known Lean4Lean replay, this construction explicitly installs the
+already-known Ix.Theory.Named replay, this construction explicitly installs the
 three traces transported from the production Ix positivity calls. -/
 theorem indexedVecConsConstructorTypeValidationTrace :
     Nonempty (ConsValidationTrace indexedVecConstructorContext
@@ -392,10 +392,10 @@ theorem indexedVecConsConstructorTypeValidationTrace :
 validator, so the vertical slice reaches the complete method rather than only
 its positivity helper. -/
 theorem indexedVecConsConstructorValidationRun :
-    Lean4Lean.AddInductive.checkConstructorType
+    Ix.Theory.Named.AddInductive.checkConstructorType
       indexedVecConstructorStats false 0 indexedVecKernelCons.name
         indexedVecKernelCons.type indexedVecConstructorContext = .ok () := by
   obtain ⟨trace⟩ := indexedVecConsConstructorTypeValidationTrace
   exact trace.check_run
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedPositivityTransport.lean b/Ix/Kernel/Verify/Inductive/IndexedPositivityTransport.lean
similarity index 90%
rename from Ix/Tc/Verify/Inductive/IndexedPositivityTransport.lean
rename to Ix/Kernel/Verify/Inductive/IndexedPositivityTransport.lean
index 56f054155..c9fda586b 100644
--- a/Ix/Tc/Verify/Inductive/IndexedPositivityTransport.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedPositivityTransport.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.IndexedCandidateOperations
-import Ix.Tc.Verify.Inductive.IndexedProductionPositivity
-import Ix.Tc.Verify.Inductive.ExactLeanSyntax
+import Ix.Kernel.Verify.Inductive.IndexedCandidateOperations
+import Ix.Kernel.Verify.Inductive.IndexedProductionPositivity
+import Ix.Kernel.Verify.Inductive.ExactLeanSyntax
 
 /-!
 # IndexedVec positivity transport
@@ -12,11 +12,11 @@ exact Ix WHNF cache transition, so the correspondence does not silently treat
 the stateful production reducer as a pure function.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
-/-! ## Finite Lean4Lean observations at the trust boundary
+/-! ## Finite Ix.Theory.Named observations at the trust boundary
 
 The upstream replay modules are useful for naming the exact candidate states,
 but their proof lemmas intentionally depend on reflected implementation
@@ -25,25 +25,25 @@ consumed below with private native facts, so the exported transport depends on
 the concrete executions without admitting those reflected equations. -/
 
 private theorem indexedVecNatHasNoIndOccTrusted :
-    Lean4Lean.AddInductive.hasIndOcc
+    Ix.Theory.Named.AddInductive.hasIndOcc
       indexedVecConstructorStats.indConsts (.const ``Nat []) = false := by
   native_decide
 
 private theorem indexedVecAlphaHasNoIndOccTrusted :
-    Lean4Lean.AddInductive.hasIndOcc
+    Ix.Theory.Named.AddInductive.hasIndOcc
       indexedVecConstructorStats.indConsts
         indexedVecConstructorAlpha = false := by
   native_decide
 
 private theorem indexedVecTailHasIndOccTrusted :
-    Lean4Lean.AddInductive.hasIndOcc
+    Ix.Theory.Named.AddInductive.hasIndOcc
       indexedVecConstructorStats.indConsts
         (ctorIndexedVecApp indexedVecConstructorAlpha
           indexedVecConstructorNExpr) = true := by
   native_decide
 
 private theorem indexedVecTailAppIsValidTrusted :
-    Lean4Lean.AddInductive.isValidIndApp?
+    Ix.Theory.Named.AddInductive.isValidIndApp?
       indexedVecConstructorStats
         (ctorIndexedVecApp indexedVecConstructorAlpha
           indexedVecConstructorNExpr) = some 0 := by
@@ -122,48 +122,48 @@ theorem ixConsTailDomainMentionsRoot :
     tailDomainCandidateSyntax]
   exact indexedVecTailHasIndOccTrusted
 
-/-! ## Exact Lean4Lean WHNF observations -/
+/-! ## Exact Ix.Theory.Named WHNF observations -/
 
 private theorem indexedVecNatCandidateWhnfNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run ctorEnv
+      (Ix.Theory.Named.TypeChecker.M.run ctorEnv
         .safe indexedVecConstructorContext.lctx [`u]
-        ({} : Lean4Lean.FuelConfig)
-        (Lean4Lean.TypeChecker.whnf (.const ``Nat [])))
+        ({} : Ix.Theory.Named.FuelConfig)
+        (Ix.Theory.Named.TypeChecker.whnf (.const ``Nat [])))
       (.const ``Nat []) = true := by
   native_decide
 
 theorem indexedVecNatCandidateWhnf :
-    Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+    Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
       ⟨indexedVecConstructorContext, (.const ``Nat []),
         (.const ``Nat [])⟩ := by
-  unfold Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+  unfold Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     indexedVecNatCandidateWhnfNative
 
 private theorem indexedVecAlphaCandidateWhnfNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run ctorEnv
+      (Ix.Theory.Named.TypeChecker.M.run ctorEnv
         .safe indexedVecConstructorNContext.lctx [`u]
-        ({} : Lean4Lean.FuelConfig)
-        (Lean4Lean.TypeChecker.whnf indexedVecConstructorAlpha))
+        ({} : Ix.Theory.Named.FuelConfig)
+        (Ix.Theory.Named.TypeChecker.whnf indexedVecConstructorAlpha))
       indexedVecConstructorAlpha = true := by
   native_decide
 
 theorem indexedVecAlphaCandidateWhnf :
-    Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+    Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
       ⟨indexedVecConstructorNContext, indexedVecConstructorAlpha,
         indexedVecConstructorAlpha⟩ := by
-  unfold Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+  unfold Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     indexedVecAlphaCandidateWhnfNative
 
 private theorem indexedVecTailCandidateWhnfNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run ctorEnv
+      (Ix.Theory.Named.TypeChecker.M.run ctorEnv
         .safe indexedVecConstructorHeadContext.lctx [`u]
-        ({} : Lean4Lean.FuelConfig)
-        (Lean4Lean.TypeChecker.whnf
+        ({} : Ix.Theory.Named.FuelConfig)
+        (Ix.Theory.Named.TypeChecker.whnf
           (ctorIndexedVecApp indexedVecConstructorAlpha
             indexedVecConstructorNExpr)))
       (ctorIndexedVecApp indexedVecConstructorAlpha
@@ -171,12 +171,12 @@ private theorem indexedVecTailCandidateWhnfNative :
   native_decide
 
 theorem indexedVecTailCandidateWhnf :
-    Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+    Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
       ⟨indexedVecConstructorHeadContext,
         ctorIndexedVecApp indexedVecConstructorAlpha indexedVecConstructorNExpr,
         ctorIndexedVecApp indexedVecConstructorAlpha
           indexedVecConstructorNExpr⟩ := by
-  unfold Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+  unfold Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     indexedVecTailCandidateWhnfNative
 
@@ -184,9 +184,9 @@ theorem indexedVecTailCandidateWhnf :
 
 /-- Sources of the three production positivity calls in the `cons`
 constructor.  Each constructor fixes both the actual Ix binder state and the
-corresponding Lean4Lean validation context. -/
+corresponding Ix.Theory.Named validation context. -/
 inductive IndexedPositivitySourceRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | nat : IndexedPositivitySourceRel ixConsNatDomainState
       indexedVecConstructorContext ixConsNatDomain (.const ``Nat [])
@@ -201,7 +201,7 @@ inductive IndexedPositivitySourceRel :
 syntax is the projected production WHNF result, related structurally rather
 than equated by its content address. -/
 inductive IndexedPositivityResultRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | tail {ixResult : KExpr .anon}
       (candidate : CandidateSyntaxRel nameOf
@@ -220,7 +220,7 @@ theorem indexedPositivitySourceMentions
     (relation : IndexedPositivitySourceRel ixState leanContext ixExpr
       leanExpr) :
     exprMentionsAnyAddr ixExpr #[familyId.addr] =
-      Lean4Lean.AddInductive.hasIndOcc
+      Ix.Theory.Named.AddInductive.hasIndOcc
         indexedVecConstructorStats.indConsts leanExpr := by
   cases relation with
   | nat =>
@@ -234,15 +234,15 @@ theorem indexedPositivitySourceMentions
         candidateBlockSyntax tailDomainCandidateSyntax
 
 private theorem indexedPositivityRootFree
-    {ixState : TcState .anon} {leanContext : Lean4Lean.AddInductive.Context}
+    {ixState : TcState .anon} {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource : KExpr .anon} {leanSource : Lean.Expr}
     (relation : IndexedPositivitySourceRel ixState leanContext ixSource
       leanSource)
     (free : exprMentionsAnyAddr ixSource #[familyId.addr] = false) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
-      Lean4Lean.AddInductive.hasIndOcc
+      Ix.Theory.Named.AddInductive.hasIndOcc
         indexedVecConstructorStats.indConsts leanResult = false := by
   cases relation with
   | nat =>
@@ -257,7 +257,7 @@ private theorem indexedPositivityRootFree
 
 private theorem indexedPositivityWhnf
     {ixBefore ixAfter : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource ixResult : KExpr .anon} {leanSource : Lean.Expr}
     (relation : IndexedPositivitySourceRel ixBefore leanContext ixSource
       leanSource)
@@ -265,7 +265,7 @@ private theorem indexedPositivityWhnf
     (run : (RecM.whnf ixSource).run checkerMethods ixBefore =
       .ok ixResult ixAfter) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
       IndexedPositivityResultRel ixAfter leanContext ixResult leanResult := by
   cases relation with
@@ -284,7 +284,7 @@ private theorem indexedPositivityWhnf
         .tail ixConsTailWhnfResultCandidateSyntax⟩
 
 private theorem indexedPositivityForall
-    {ixState : TcState .anon} {leanContext : Lean4Lean.AddInductive.Context}
+    {ixState : TcState .anon} {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixName : Mode.anon.F Name} {ixBinder : Mode.anon.F Lean.BinderInfo}
     {ixDomain ixBody : KExpr .anon} {ixInfo : ExprInfo .anon}
     {leanExpr : Lean.Expr}
@@ -299,13 +299,13 @@ private theorem indexedPositivityForall
           .ok (ixOpen, ixFVar) ixAfterOpen →
         IndexedPositivitySourceRel ixAfterOpen
           (leanContext.pushLocalDecl leanName leanBinder
-            (Lean4Lean.AddInductive.consumeTypeAnnotations leanDomain))
+            (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanDomain))
           ixOpen (leanBody.instantiate1 leanContext.freshExpr) := by
   cases relation with
   | tail candidate => cases candidate
 
 private theorem indexedPositivityDirect
-    {ixState : TcState .anon} {leanContext : Lean4Lean.AddInductive.Context}
+    {ixState : TcState .anon} {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixResult : KExpr .anon} {leanResult : Lean.Expr}
     {id : KId .anon} {us : Array (KUniv .anon)} {info : ExprInfo .anon}
     {args : Array (KExpr .anon)} {groups : Array (PositivityGroup .anon)}
@@ -317,10 +317,10 @@ private theorem indexedPositivityDirect
     (_valid : ValidPositiveRecursiveApplication id us args groups
       #[familyId.addr] checkerMethods ixState final) :
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc
+      Ix.Theory.Named.AddInductive.hasIndOcc
           indexedVecConstructorStats.indConsts leanResult = true ∧
         leanResult.isForall = false ∧
-        Lean4Lean.AddInductive.isValidIndApp?
+        Ix.Theory.Named.AddInductive.isValidIndApp?
           indexedVecConstructorStats leanResult = some targetIdx := by
   cases relation with
   | tail _ =>
@@ -516,10 +516,10 @@ theorem indexedVecTailFlatPositivityTrace :
         ixConsTailPositivityAfter :=
   indexedVecTailFlatPositivityTraceAt 0
 
-/-! ## Lean4Lean constructor-positivity artifacts -/
+/-! ## Ix.Theory.Named constructor-positivity artifacts -/
 
 theorem indexedVecNatConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 1
       indexedVecConstructorContext (.const ``Nat []) (fuel + 1)) :=
   FlatPositivityTraceTransport.constructorPositivityTrace
@@ -527,7 +527,7 @@ theorem indexedVecNatConstructorPositivityTraceAt (fuel : Nat) :
       (indexedVecNatFlatPositivityTraceAt fuel) rfl .nat
 
 theorem indexedVecHeadConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 2
       indexedVecConstructorNContext indexedVecConstructorAlpha (fuel + 1)) :=
   FlatPositivityTraceTransport.constructorPositivityTrace
@@ -535,7 +535,7 @@ theorem indexedVecHeadConstructorPositivityTraceAt (fuel : Nat) :
       (indexedVecHeadFlatPositivityTraceAt fuel) rfl .head
 
 theorem indexedVecTailConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 3
       indexedVecConstructorHeadContext
         (ctorIndexedVecApp indexedVecConstructorAlpha
@@ -545,19 +545,19 @@ theorem indexedVecTailConstructorPositivityTraceAt (fuel : Nat) :
       (indexedVecTailFlatPositivityTraceAt fuel) rfl .tail
 
 theorem indexedVecNatConstructorPositivityTrace :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 1
       indexedVecConstructorContext (.const ``Nat []) 1) :=
   indexedVecNatConstructorPositivityTraceAt 0
 
 theorem indexedVecHeadConstructorPositivityTrace :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 2
       indexedVecConstructorNContext indexedVecConstructorAlpha 1) :=
   indexedVecHeadConstructorPositivityTraceAt 0
 
 theorem indexedVecTailConstructorPositivityTrace :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 3
       indexedVecConstructorHeadContext
         (ctorIndexedVecApp indexedVecConstructorAlpha
@@ -660,7 +660,7 @@ theorem familyConsTailWhnfCandidateSyntax :
 /-- Sources are indexed by the exact states reached by the real family-block
 checker, rather than by a replay from `checkerInitial`. -/
 inductive ProductionIndexedPositivitySourceRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | nat : ProductionIndexedPositivitySourceRel familyConsNatDomainState
       indexedVecConstructorContext familyConsNatDomain (.const ``Nat [])
@@ -675,7 +675,7 @@ inductive ProductionIndexedPositivitySourceRel :
 /-- The mentioned production source has exactly one WHNF result shape in this
 fixture: the recursive `IndexedVec α n` application. -/
 inductive ProductionIndexedPositivityResultRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | tail {ixResult : KExpr .anon}
       (candidate : CandidateSyntaxRel nameOf
@@ -695,7 +695,7 @@ theorem productionIndexedPositivitySourceMentions
     (relation : ProductionIndexedPositivitySourceRel ixState leanContext
       ixExpr leanExpr) :
     exprMentionsAnyAddr ixExpr #[familyId.addr] =
-      Lean4Lean.AddInductive.hasIndOcc
+      Ix.Theory.Named.AddInductive.hasIndOcc
         indexedVecConstructorStats.indConsts leanExpr := by
   cases relation with
   | nat =>
@@ -709,15 +709,15 @@ theorem productionIndexedPositivitySourceMentions
         candidateBlockSyntax familyConsTailDomainCandidateSyntax
 
 private theorem productionIndexedPositivityRootFree
-    {ixState : TcState .anon} {leanContext : Lean4Lean.AddInductive.Context}
+    {ixState : TcState .anon} {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource : KExpr .anon} {leanSource : Lean.Expr}
     (relation : ProductionIndexedPositivitySourceRel ixState leanContext
       ixSource leanSource)
     (free : exprMentionsAnyAddr ixSource #[familyId.addr] = false) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
-      Lean4Lean.AddInductive.hasIndOcc
+      Ix.Theory.Named.AddInductive.hasIndOcc
         indexedVecConstructorStats.indConsts leanResult = false := by
   cases relation with
   | nat =>
@@ -732,7 +732,7 @@ private theorem productionIndexedPositivityRootFree
 
 private theorem productionIndexedPositivityWhnf
     {ixBefore ixAfter : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource ixResult : KExpr .anon} {leanSource : Lean.Expr}
     (relation : ProductionIndexedPositivitySourceRel ixBefore leanContext
       ixSource leanSource)
@@ -740,7 +740,7 @@ private theorem productionIndexedPositivityWhnf
     (run : (RecM.whnf ixSource).run checkerMethods ixBefore =
       .ok ixResult ixAfter) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
       ProductionIndexedPositivityResultRel ixAfter leanContext ixResult
         leanResult := by
@@ -760,7 +760,7 @@ private theorem productionIndexedPositivityWhnf
         .tail familyConsTailWhnfCandidateSyntax⟩
 
 private theorem productionIndexedPositivityForall
-    {ixState : TcState .anon} {leanContext : Lean4Lean.AddInductive.Context}
+    {ixState : TcState .anon} {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixName : Mode.anon.F Name} {ixBinder : Mode.anon.F Lean.BinderInfo}
     {ixDomain ixBody : KExpr .anon} {ixInfo : ExprInfo .anon}
     {leanExpr : Lean.Expr}
@@ -776,13 +776,13 @@ private theorem productionIndexedPositivityForall
           .ok (ixOpen, ixFVar) ixAfterOpen →
         ProductionIndexedPositivitySourceRel ixAfterOpen
           (leanContext.pushLocalDecl leanName leanBinder
-            (Lean4Lean.AddInductive.consumeTypeAnnotations leanDomain))
+            (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanDomain))
           ixOpen (leanBody.instantiate1 leanContext.freshExpr) := by
   cases relation with
   | tail candidate => cases candidate
 
 private theorem productionIndexedPositivityDirect
-    {ixState : TcState .anon} {leanContext : Lean4Lean.AddInductive.Context}
+    {ixState : TcState .anon} {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixResult : KExpr .anon} {leanResult : Lean.Expr}
     {id : KId .anon} {us : Array (KUniv .anon)} {info : ExprInfo .anon}
     {args : Array (KExpr .anon)} {groups : Array (PositivityGroup .anon)}
@@ -794,10 +794,10 @@ private theorem productionIndexedPositivityDirect
     (_valid : ValidPositiveRecursiveApplication id us args groups
       #[familyId.addr] checkerMethods ixState final) :
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc
+      Ix.Theory.Named.AddInductive.hasIndOcc
           indexedVecConstructorStats.indConsts leanResult = true ∧
         leanResult.isForall = false ∧
-        Lean4Lean.AddInductive.isValidIndApp?
+        Ix.Theory.Named.AddInductive.isValidIndApp?
           indexedVecConstructorStats leanResult = some targetIdx := by
   cases relation with
   | tail _ =>
@@ -818,7 +818,7 @@ theorem indexedVecProductionFlatPositivityTransport :
 
 /-! ## Production trace transport at the candidate checker's fuel
 
-Ix enters constructor positivity with `maxWhnfFuel`, while Lean4Lean's retained
+Ix enters constructor positivity with `maxWhnfFuel`, while Ix.Theory.Named's retained
 candidate context has its own inductive fuel.  Fuel cannot be changed for an
 arbitrary recursive trace.  The following lemmas first inspect the traces
 projected from the real production run and only reindex the two branch forms
@@ -921,7 +921,7 @@ theorem indexedVecProductionTailFlatPositivityTraceAt (fuel : Nat) :
         active valid
 
 theorem indexedVecProductionNatConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 1
       indexedVecConstructorContext (.const ``Nat []) (fuel + 1)) :=
   FlatPositivityTraceTransport.constructorPositivityTrace
@@ -930,7 +930,7 @@ theorem indexedVecProductionNatConstructorPositivityTraceAt (fuel : Nat) :
         ProductionIndexedPositivitySourceRel.nat
 
 theorem indexedVecProductionHeadConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 2
       indexedVecConstructorNContext indexedVecConstructorAlpha (fuel + 1)) :=
   FlatPositivityTraceTransport.constructorPositivityTrace
@@ -939,7 +939,7 @@ theorem indexedVecProductionHeadConstructorPositivityTraceAt (fuel : Nat) :
         ProductionIndexedPositivitySourceRel.head
 
 theorem indexedVecProductionTailConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace
       indexedVecConstructorStats indexedVecKernelCons.name 3
       indexedVecConstructorHeadContext
         (ctorIndexedVecApp indexedVecConstructorAlpha
@@ -949,4 +949,4 @@ theorem indexedVecProductionTailConstructorPositivityTraceAt (fuel : Nat) :
       (indexedVecProductionTailFlatPositivityTraceAt fuel) rfl
         ProductionIndexedPositivitySourceRel.tail
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedProducerClosure.lean b/Ix/Kernel/Verify/Inductive/IndexedProducerClosure.lean
similarity index 84%
rename from Ix/Tc/Verify/Inductive/IndexedProducerClosure.lean
rename to Ix/Kernel/Verify/Inductive/IndexedProducerClosure.lean
index b781120ff..82113542d 100644
--- a/Ix/Tc/Verify/Inductive/IndexedProducerClosure.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedProducerClosure.lean
@@ -1,18 +1,18 @@
-import Ix.Tc.Verify.Inductive.GeneratedRecursorAdmission
-import Ix.Tc.Verify.Inductive.IndexedCandidateTransaction
+import Ix.Kernel.Verify.Inductive.GeneratedRecursorAdmission
+import Ix.Kernel.Verify.Inductive.IndexedCandidateTransaction
 
 /-!
 # Producer-linked IndexedVec one-family closure
 
 The trust-minimal `IndexedVec` Theory transaction and the executable
-Lean4Lean candidate replay are intentionally audited separately.  This module
+Ix.Theory.Named candidate replay are intentionally audited separately.  This module
 joins them only at a stronger E2c root: the exact producer-selected package
 erases to the same certificate transaction consumed by the Ix family and
 generated-recursor admission, while all three anonymous ingress calls and both
 production block checks remain explicit.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 open IndexedRecursiveCertificateFixture
 
@@ -38,7 +38,7 @@ structure ProducerLinkedOneFamilyClosure : Prop where
       checkerMethods familyKernelAfter = .ok () recursorKernelAfter
   semantic : CanonicalRecursorAtomicClosure
 
-/-- The exact outer Lean4Lean producer, production Ix executions, and
+/-- The exact outer Ix.Theory.Named producer, production Ix executions, and
 oracle-free one-family semantic closure for the concrete indexed-recursive
 fixture. -/
 theorem producerLinkedOneFamilyClosure : ProducerLinkedOneFamilyClosure where
@@ -51,4 +51,4 @@ theorem producerLinkedOneFamilyClosure : ProducerLinkedOneFamilyClosure where
   recursorChecked := recursorKernelRun
   semantic := familyRecursorAtomicClosure
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedProductionPositivity.lean b/Ix/Kernel/Verify/Inductive/IndexedProductionPositivity.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/IndexedProductionPositivity.lean
rename to Ix/Kernel/Verify/Inductive/IndexedProductionPositivity.lean
index b9095aad8..73668a254 100644
--- a/Ix/Tc/Verify/Inductive/IndexedProductionPositivity.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedProductionPositivity.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.IndexedBlockValidation
-import Ix.Tc.Verify.Inductive.PositivityTraceAdapter
+import Ix.Kernel.Verify.Inductive.IndexedBlockValidation
+import Ix.Kernel.Verify.Inductive.PositivityTraceAdapter
 
 /-!
 # Production-selected IndexedVec positivity
@@ -11,7 +11,7 @@ projected from the `IndexedVec.cons` validation selected by the exact
 states is reconstructed by running positivity a second time.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
 /-- The production-selected constructor is the exact ingressed `cons`
 declaration, not merely some telescope that happened to pass the same
@@ -620,7 +620,7 @@ theorem familyConsResultWhnfTerminal :
 
 /-- Exact three-field view of the positivity traversal selected by the real
 family-block execution.  Besides the complete enclosing loop, the view exposes
-the direct-only flat traces consumed by the Lean4Lean adapter. -/
+the direct-only flat traces consumed by the Ix.Theory.Named adapter. -/
 structure IndexedVecConsProductionFieldProjection : Prop where
   nat : FlatPositivityDomainTrace familyConsPositivityGroups
     #[familyId.addr] checkerMethods maxWhnfFuel.toNat familyConsNatDomain
@@ -910,4 +910,4 @@ theorem indexedVecConsProductionParameterBranch :
   | fields parameters fields =>
       exact ⟨ctorTy, initial, final, .inr ⟨_, _, _, parameters, fields⟩⟩
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedRecursiveAcceptance.lean b/Ix/Kernel/Verify/Inductive/IndexedRecursiveAcceptance.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/IndexedRecursiveAcceptance.lean
rename to Ix/Kernel/Verify/Inductive/IndexedRecursiveAcceptance.lean
index c04eb5156..e5b062822 100644
--- a/Ix/Tc/Verify/Inductive/IndexedRecursiveAcceptance.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedRecursiveAcceptance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.SingletonInductive
-import Ix.Tc.Verify.Inductive.IndexedRecursiveFixture
+import Ix.Kernel.Verify.Check.SingletonInductive
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveFixture
 
 /-!
 # Production acceptance of the indexed-recursive fixture
@@ -10,10 +10,10 @@ ingressed recursor block is compared against that cached result.  Every run
 starts from the exact final anonymous ingress state retained by the fixture.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 
 local instance acceptanceAnonKIdDecidableEq : DecidableEq (KId .anon) :=
@@ -183,8 +183,8 @@ private theorem directInductiveOwner_inductiveMemberOf
     simp_all [IsDirectInductiveOwner, KConst.IsInductiveMemberOf]
 
 private theorem certifiedConstructor_inductiveMemberOf
-    {source : Lean4Lean.VInductDecl} {familyId block : KId .anon}
-    {index : Nat} {sourceConstructor : Lean4Lean.VConstVal}
+    {source : Ix.Theory.Named.VInductDecl} {familyId block : KId .anon}
+    {index : Nat} {sourceConstructor : Ix.Theory.Named.VConstVal}
     {concrete familyConcrete : KConst .anon} {catalog : Catalog}
     (hshape : concrete.IsCertifiedSingletonConstructor source familyId index
       sourceConstructor)
@@ -197,8 +197,8 @@ private theorem certifiedConstructor_inductiveMemberOf
   exact hfamilyOwner
 
 private theorem certifiedConstructor_not_inductiveMemberOf
-    {source : Lean4Lean.VInductDecl} {familyId block : KId .anon}
-    {index : Nat} {sourceConstructor : Lean4Lean.VConstVal}
+    {source : Ix.Theory.Named.VInductDecl} {familyId block : KId .anon}
+    {index : Nat} {sourceConstructor : Ix.Theory.Named.VConstVal}
     {concrete familyConcrete : KConst .anon} {catalog : Catalog}
     (hshape : concrete.IsCertifiedSingletonConstructor source familyId index
       sourceConstructor)
@@ -220,7 +220,7 @@ private theorem certifiedConstructor_not_inductiveMemberOf
       simp [KConst.IsCertifiedSingletonConstructor] at hshape
 
 private theorem certifiedFamily_not_inductiveMemberOf
-    {source : Lean4Lean.VInductDecl} {generation : source.GenerationChecked}
+    {source : Ix.Theory.Named.VInductDecl} {generation : source.GenerationChecked}
     {constructorIds : Array (KId .anon)} {concrete : KConst .anon}
     {catalog : Catalog} {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonFamily source generation
@@ -233,7 +233,7 @@ private theorem certifiedFamily_not_inductiveMemberOf
       KConst.IsInductiveMemberOf, IsDirectInductiveOwner]
 
 private theorem certifiedRecursor_not_inductiveMemberOf
-    {source : Lean4Lean.VInductDecl} {generation : source.GenerationChecked}
+    {source : Ix.Theory.Named.VInductDecl} {generation : source.GenerationChecked}
     {constructorIds : Array (KId .anon)} {concrete : KConst .anon}
     {catalog : Catalog} {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonRecursor source generation
@@ -245,7 +245,7 @@ private theorem certifiedRecursor_not_inductiveMemberOf
       KConst.IsInductiveMemberOf]
 
 private theorem certifiedFamily_not_recursorMemberOf
-    {source : Lean4Lean.VInductDecl} {generation : source.GenerationChecked}
+    {source : Ix.Theory.Named.VInductDecl} {generation : source.GenerationChecked}
     {constructorIds : Array (KId .anon)} {concrete : KConst .anon}
     {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonFamily source generation
@@ -257,8 +257,8 @@ private theorem certifiedFamily_not_recursorMemberOf
       KConst.IsRecursorMemberOf]
 
 private theorem certifiedConstructor_not_recursorMemberOf
-    {source : Lean4Lean.VInductDecl} {familyId : KId .anon}
-    {index : Nat} {sourceConstructor : Lean4Lean.VConstVal}
+    {source : Ix.Theory.Named.VInductDecl} {familyId : KId .anon}
+    {index : Nat} {sourceConstructor : Ix.Theory.Named.VConstVal}
     {concrete : KConst .anon} {block : KId .anon}
     (hshape : concrete.IsCertifiedSingletonConstructor source familyId index
       sourceConstructor) :
@@ -631,4 +631,4 @@ theorem endToEndAcceptance : EndToEndAcceptance where
   admittedRecursor := recursorAtomicAdmission
   rejectsMalformedRecursor := malformedRecursorRun
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedRecursiveCertificate.lean b/Ix/Kernel/Verify/Inductive/IndexedRecursiveCertificate.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/IndexedRecursiveCertificate.lean
rename to Ix/Kernel/Verify/Inductive/IndexedRecursiveCertificate.lean
index 1729e1249..cb47c4ea1 100644
--- a/Ix/Tc/Verify/Inductive/IndexedRecursiveCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedRecursiveCertificate.lean
@@ -1,10 +1,10 @@
-import Ix.Tc.Verify.Inductive.Certificate
-import Lean4Lean.Verify.Environment.InductiveFixtures
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
 
 /-!
 # Certified parameterized, indexed, recursive generation fixture
 
-Lean4Lean's `IndexedVec` fixture is the first certificate in the dependency
+Ix.Theory.Named's `IndexedVec` fixture is the first certificate in the dependency
 whose source is simultaneously parameterized, indexed, and recursive.  This
 module reconstructs it through the Theory-only proof-carrying transaction
 boundary and records the exact breadth facts that distinguish it from E2b's
@@ -14,18 +14,18 @@ The ambient `Nat` environment is reconstructed through its own certified
 transaction instead of importing the implementation-reflection replay proof.
 This is important for the trust manifest: the resulting certificate depends
 only on the accepted Lean axioms, not on persistent-map or reflected-expression
-equations from the `Lean4Lean.Verify` layer.
+equations from the `Ix.Theory.Named.Verify` layer.
 
 Nothing here asserts an Ix catalog correspondence.  That separate link must
 be constructed from production anonymous ingress and checking, so the
 certificate cannot silently choose the concrete declarations it certifies.
 -/
 
-namespace Ix.Tc.IndexedRecursiveCertificateFixture
+namespace Ix.Kernel.IndexedRecursiveCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 /-- The exact proof-carrying transaction that constructs the ambient `Nat`
 environment needed by `IndexedVec`. -/
@@ -117,4 +117,4 @@ theorem certifiedFacts :
       transaction.certificate :=
   transaction.facts
 
-end Ix.Tc.IndexedRecursiveCertificateFixture
+end Ix.Kernel.IndexedRecursiveCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedRecursiveFixture.lean b/Ix/Kernel/Verify/Inductive/IndexedRecursiveFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/IndexedRecursiveFixture.lean
rename to Ix/Kernel/Verify/Inductive/IndexedRecursiveFixture.lean
index 82b0a5bec..22d66da7e 100644
--- a/Ix/Tc/Verify/Inductive/IndexedRecursiveFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedRecursiveFixture.lean
@@ -1,21 +1,21 @@
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.IndexedRecursiveOracle
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveOracle
 
 /-!
 # Concrete parameterized, indexed, recursive fixture
 
-This module connects the certified Lean4Lean `IndexedVec` generation to the
+This module connects the certified Ix.Theory.Named `IndexedVec` generation to the
 actual anonymous Ixon layout.  `Nat`, the family/constructor block, and the
 separate recursor block are ingressed in dependency order.  Later sections
 retain the exact converted entries so the production checker and atomic
 admission theorem consume the same physical declarations.
 -/
 
-namespace Ix.Tc.IndexedRecursiveFixture
+namespace Ix.Kernel.IndexedRecursiveFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 open InductiveConcreteFixture
 
@@ -1291,4 +1291,4 @@ def recursorLink : SingletonRecursorCatalogLink RawProjRel.none world.catalog
   recursorInterpretation.toCatalogLinkOfEntry recursorIngressExecution
     catalog_recursor trustedCatalog
 
-end Ix.Tc.IndexedRecursiveFixture
+end Ix.Kernel.IndexedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/IndexedRecursiveOracle.lean b/Ix/Kernel/Verify/Inductive/IndexedRecursiveOracle.lean
similarity index 93%
rename from Ix/Tc/Verify/Inductive/IndexedRecursiveOracle.lean
rename to Ix/Kernel/Verify/Inductive/IndexedRecursiveOracle.lean
index 3bdc8f8f0..09be3e79a 100644
--- a/Ix/Tc/Verify/Inductive/IndexedRecursiveOracle.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedRecursiveOracle.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.IndexedRecursiveSoundness
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveSoundness
 
 /-!
 # Certificate-backed indexed recursive recursor oracle
@@ -9,11 +9,11 @@ patterns validate a uniform parameter and a changing index; the second rule
 also reconstructs the recursive call at the predecessor index.
 -/
 
-namespace Ix.Tc.IndexedRecursivePattern
+namespace Ix.Kernel.IndexedRecursivePattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 
 /-- The exact two-rule indexed-recursive recursor oracle.  The physical Ix
@@ -84,4 +84,4 @@ def oracle
   change (id ∈ link.members) ↔ id ∈ link.members
   exact Iff.rfl
 
-end Ix.Tc.IndexedRecursivePattern
+end Ix.Kernel.IndexedRecursivePattern
diff --git a/Ix/Tc/Verify/Inductive/IndexedRecursivePattern.lean b/Ix/Kernel/Verify/Inductive/IndexedRecursivePattern.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/IndexedRecursivePattern.lean
rename to Ix/Kernel/Verify/Inductive/IndexedRecursivePattern.lean
index b877f21f9..d7f766f8f 100644
--- a/Ix/Tc/Verify/Inductive/IndexedRecursivePattern.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedRecursivePattern.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Inductive.IndexedRecursiveCertificate
-import Ix.Tc.Verify.Inductive.IotaPattern
+import Ix.Kernel.Verify.Inductive.IndexedRecursiveCertificate
+import Ix.Kernel.Verify.Inductive.IotaPattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Generated iota patterns for the indexed recursive fixture
@@ -11,11 +13,11 @@ three fields and constructs the recursive call at the predecessor index from
 captured recursor and constructor arguments.
 -/
 
-namespace Ix.Tc.IndexedRecursivePattern
+namespace Ix.Kernel.IndexedRecursivePattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 
 def recursorName : Lean.Name := ``IndexedVec.rec
@@ -428,4 +430,4 @@ theorem consPatternMetadata
   simpa only [consPattern, consFieldCount,
     show (3 : UInt64).toNat = 3 from rfl] using hfields
 
-end Ix.Tc.IndexedRecursivePattern
+end Ix.Kernel.IndexedRecursivePattern
diff --git a/Ix/Tc/Verify/Inductive/IndexedRecursiveSoundness.lean b/Ix/Kernel/Verify/Inductive/IndexedRecursiveSoundness.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/IndexedRecursiveSoundness.lean
rename to Ix/Kernel/Verify/Inductive/IndexedRecursiveSoundness.lean
index b7cdf6983..5c2bedecf 100644
--- a/Ix/Tc/Verify/Inductive/IndexedRecursiveSoundness.lean
+++ b/Ix/Kernel/Verify/Inductive/IndexedRecursiveSoundness.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.IndexedRecursivePattern
+import Ix.Kernel.Verify.Inductive.IndexedRecursivePattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Indexed recursive iota soundness
@@ -9,11 +11,11 @@ production WHNF.  All equation shapes below reduce from the retained
 `GenerationChecked.rule`; no independently supplied rewrite law is used.
 -/
 
-namespace Ix.Tc.IndexedRecursivePattern
+namespace Ix.Kernel.IndexedRecursivePattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 open IndexedRecursiveCertificateFixture
 
 private abbrev generation := transaction.certificate.generation
@@ -561,7 +563,7 @@ theorem nilPatternSound
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -586,7 +588,7 @@ theorem nilPatternSound
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, hconstructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -623,7 +625,7 @@ theorem nilPatternSound
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``IndexedVec.rec [v, u])
       (generation.recType.instL [v, u]) := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity
     rw [generationRecursorName] at htyped
     simpa [VInductDecl.GenerationChecked.recursor] using htyped
@@ -639,20 +641,20 @@ theorem nilPatternSound
       (.forallE majorDomain majorBody) := by
     simpa using hrecursorApplied
   obtain ⟨recursorParameterResult, hrecursorParameterApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha])
       (suffixArgs := [motive, nilMinor, consMinor, index])
       hrecursorAppliedSplit
   have hrecursorAlpha : future.HasType uvars Gamma alpha
       (.sort (.succ u)) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hrecursorParameterApplied hrecursorParameterHead
 
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``IndexedVec.nil [constructorU])
       (nilNormalized.raw.toVConstant.type.instL [constructorU]) := by
     simpa [nilNormalizedName] using
-      (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+      (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
         hcertifiedConstructorLookup hconstructorLevelsWF
           hconstructorLevelsArity)
   have hconstructorParameterHead : future.HasType uvars Gamma
@@ -664,7 +666,7 @@ theorem nilPatternSound
     exact hconstructorConstantTyped
   have hconstructorAlpha : future.HasType uvars Gamma constructorAlpha
       (.sort (.succ constructorU)) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hconstructorApplied hconstructorParameterHead
 
   obtain ⟨parameterType, hparameterTyped⟩ := hparameter'
@@ -679,7 +681,7 @@ theorem nilPatternSound
     hrecursorSort.trans hfutureWF hGamma hconstructorSort.symm
   have huniverse : u ≈ constructorU :=
     VLevel.succ_congr_iff.mp
-      (Lean4Lean.VEnv.IsDefEqU.sort_inv hfutureWF hGamma hsorts)
+      (Ix.Theory.Named.VEnv.IsDefEqU.sort_inv hfutureWF hGamma hsorts)
 
   have hnilLookup := hcertifiedConstructorLookup
   rw [nilNormalizedName] at hnilLookup
@@ -717,7 +719,7 @@ theorem nilPatternSound
         [alpha, motive, nilMinor, consMinor, .const ``Nat.zero []]) := by
     refine ⟨indexBody.inst index, ?_⟩
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appDF hrecursorBeforeIndex hindexAtDomain)
+      (Ix.Theory.Named.VEnv.IsDefEq.appDF hrecursorBeforeIndex hindexAtDomain)
   have hrecursorIndexEqTyped : future.IsDefEq uvars Gamma
       (VExpr.appN (.const ``IndexedVec.rec [v, u])
         [alpha, motive, nilMinor, consMinor, index])
@@ -776,18 +778,18 @@ theorem nilPatternSound
       (.forallE majorDomain majorBody) := by
     simpa using hrecursorApplied
   obtain ⟨recursorCommonResult, hrecursorCommonApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha, motive, nilMinor, consMinor])
       (suffixArgs := [index]) hrecursorCommonAppliedSplit
   have hcommonLength :
       [alpha, motive, nilMinor, consMinor].length =
         (commonBinders.map (VExpr.instL [v, u])).length := by simp
   have hequationLhsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorCommonApplied
       hrecursorCommonType hequationLhsCommonType
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
   have hequationRhsApplied :=
     (hequationApplied.of_l hfutureWF hGamma
@@ -800,7 +802,7 @@ theorem nilPatternSound
   have hequationLhsApplied' := hequationLhsApplied
   rw [(generatedRule_shape 0 nilNormalized).1,
     VExpr.instL_lamN] at hequationLhsApplied'
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleBinderLength hequationLhsApplied'
   rw [nilLhsBody_open] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -817,7 +819,7 @@ theorem nilPatternSound
   have hequationRhsApplied' := hequationRhsApplied
   rw [(generatedRule_shape 0 nilNormalized).2.1,
     VExpr.instL_lamN] at hequationRhsApplied'
-  have hrhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hrhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleBinderLength hequationRhsApplied'
   rw [nilRhsBody_open] at hrhsBeta
   have hrhsBeta' : future.IsDefEqU uvars Gamma
@@ -928,7 +930,7 @@ theorem consPatternSound
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -953,7 +955,7 @@ theorem consPatternSound
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, hconstructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -990,7 +992,7 @@ theorem consPatternSound
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``IndexedVec.rec [v, u])
       (generation.recType.instL [v, u]) := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity
     rw [generationRecursorName] at htyped
     simpa [VInductDecl.GenerationChecked.recursor] using htyped
@@ -1006,20 +1008,20 @@ theorem consPatternSound
       (.forallE majorDomain majorBody) := by
     simpa using hrecursorApplied
   obtain ⟨recursorParameterResult, hrecursorParameterApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha])
       (suffixArgs := [motive, nilMinor, consMinor, index])
       hrecursorAppliedSplit
   have hrecursorAlpha : future.HasType uvars Gamma alpha
       (.sort (.succ u)) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hrecursorParameterApplied hrecursorParameterHead
 
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``IndexedVec.cons [constructorU])
       (consNormalized.raw.toVConstant.type.instL [constructorU]) := by
     simpa [consNormalizedName] using
-      (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+      (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
         hcertifiedConstructorLookup hconstructorLevelsWF
           hconstructorLevelsArity)
   have hconstructorParameterHead : future.HasType uvars Gamma
@@ -1034,12 +1036,12 @@ theorem consPatternSound
         ([constructorAlpha] ++ [n, a, as])) majorDomain := by
     simpa using hconstructorApplied
   obtain ⟨constructorParameterResult, hconstructorParameterApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [constructorAlpha]) (suffixArgs := [n, a, as])
       hconstructorAppliedSplit
   have hconstructorAlpha : future.HasType uvars Gamma constructorAlpha
       (.sort (.succ constructorU)) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hconstructorParameterApplied hconstructorParameterHead
 
   obtain ⟨parameterType, hparameterTyped⟩ := hparameter'
@@ -1054,7 +1056,7 @@ theorem consPatternSound
     hrecursorSort.trans hfutureWF hGamma hconstructorSort.symm
   have huniverse : u ≈ constructorU :=
     VLevel.succ_congr_iff.mp
-      (Lean4Lean.VEnv.IsDefEqU.sort_inv hfutureWF hGamma hsorts)
+      (Ix.Theory.Named.VEnv.IsDefEqU.sort_inv hfutureWF hGamma hsorts)
 
   have hconsLookup := hcertifiedConstructorLookup
   rw [consNormalizedName] at hconsLookup
@@ -1094,7 +1096,7 @@ theorem consPatternSound
         [constructorAlpha, n, a, as])
       (VExpr.appN (.const ``IndexedVec.cons [u]) [alpha, n, a, as]) := by
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma
+      (Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma
         hconstructorPrefixEqTyped hconstructorAppliedFromPrefix)
 
   obtain ⟨indexDomain, indexBody, hrecursorBeforeIndex, hindexTyped⟩ :=
@@ -1110,7 +1112,7 @@ theorem consPatternSound
           .app (.const ``Nat.succ []) n]) := by
     refine ⟨indexBody.inst index, ?_⟩
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appDF hrecursorBeforeIndex hindexAtDomain)
+      (Ix.Theory.Named.VEnv.IsDefEq.appDF hrecursorBeforeIndex hindexAtDomain)
   have hrecursorIndexEqTyped : future.IsDefEq uvars Gamma
       (VExpr.appN (.const ``IndexedVec.rec [v, u])
         [alpha, motive, nilMinor, consMinor, index])
@@ -1175,7 +1177,7 @@ theorem consPatternSound
       (.forallE majorDomain majorBody) := by
     simpa using hrecursorApplied
   obtain ⟨recursorCommonResult, hrecursorCommonApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha, motive, nilMinor, consMinor])
       (suffixArgs := [index]) hrecursorCommonAppliedSplit
   have hcommonLength :
@@ -1185,14 +1187,14 @@ theorem consPatternSound
       (VExpr.appN ((generation.rule 1 consNormalized).lhs.instL [v, u])
         [alpha, motive, nilMinor, consMinor])
       (consEquationFieldType v u alpha motive nilMinor consMinor) := by
-    exact Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    exact Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorCommonApplied
       hrecursorCommonType hequationLhsCommonType
 
   have hcanonicalConstructorConstantTyped : future.HasType uvars Gamma
       (.const ``IndexedVec.cons [u])
       (consNormalized.raw.toVConstant.type.instL [u]) := by
-    exact Lean4Lean.VEnv.HasType.const hconsLookup
+    exact Ix.Theory.Named.VEnv.HasType.const hconsLookup
       (fun level hlevel => by
         simp only [List.mem_singleton] at hlevel
         subst level
@@ -1207,7 +1209,7 @@ theorem consPatternSound
   have hcanonicalConstructorPrefix : future.HasType uvars Gamma
       (.app (.const ``IndexedVec.cons [u]) alpha)
       (consConstructorFieldType u alpha) := by
-    have happ := Lean4Lean.VEnv.HasType.app
+    have happ := Ix.Theory.Named.VEnv.HasType.app
       hcanonicalConstructorParameterHead hrecursorAlpha
     simpa [consConstructorFieldType, VExpr.instRev] using happ
   have hcanonicalConstructorApplied : future.HasType uvars Gamma
@@ -1252,7 +1254,7 @@ theorem consPatternSound
       VExpr.instRev, VExpr.instL, VExpr.inst, VExpr.instVar,
       VExpr.telN, VExpr.dropN]
   have hequationLhsFieldsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hfieldLength hcanonicalConstructorApplied
       hconstructorFieldHead' hequationFieldHead
   have hequationLhsApplied : future.HasType uvars Gamma
@@ -1267,7 +1269,7 @@ theorem consPatternSound
       VExpr.appN_append]
     exact hequationLhsFieldsApplied
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
   have hequationRhsApplied :=
     (hequationApplied.of_l hfutureWF hGamma
@@ -1280,7 +1282,7 @@ theorem consPatternSound
   have hequationLhsApplied' := hequationLhsApplied
   rw [(generatedRule_shape 1 consNormalized).1,
     VExpr.instL_lamN] at hequationLhsApplied'
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleBinderLength hequationLhsApplied'
   rw [consLhsBody_open] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -1299,7 +1301,7 @@ theorem consPatternSound
   have hequationRhsApplied' := hequationRhsApplied
   rw [(generatedRule_shape 1 consNormalized).2.1,
     VExpr.instL_lamN] at hequationRhsApplied'
-  have hrhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hrhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleBinderLength hequationRhsApplied'
   rw [consRhsBody_open] at hrhsBeta
   have hrhsBeta' : future.IsDefEqU uvars Gamma
@@ -1366,4 +1368,4 @@ theorem consPatternRel
     (consPatternMetadata link hone hrule)
     (consPatternSound link hrule (family.constructorIds[1]'hone))
 
-end Ix.Tc.IndexedRecursivePattern
+end Ix.Kernel.IndexedRecursivePattern
diff --git a/Ix/Tc/Verify/Inductive/IngressExecution.lean b/Ix/Kernel/Verify/Inductive/IngressExecution.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/IngressExecution.lean
rename to Ix/Kernel/Verify/Inductive/IngressExecution.lean
index ebfc29670..2b27759a0 100644
--- a/Ix/Tc/Verify/Inductive/IngressExecution.lean
+++ b/Ix/Kernel/Verify/Inductive/IngressExecution.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Ingress
-import Ix.Tc.Verify.Inductive.SingletonIngress
+import Ix.Kernel.Ingress
+import Ix.Kernel.Verify.Inductive.SingletonIngress
 
 /-!
 # Anonymous inductive-block ingress execution
@@ -17,7 +17,7 @@ discharge it for their actual projection addresses; no Blake3 injectivity is
 smuggled into the model.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-! ## Flat insertion semantics -/
 
@@ -196,7 +196,7 @@ end AnonBlockIngressSuccessTrace
 
 /-! ## Singleton source interpretations -/
 
-open Lean4Lean (VEnv VInductDecl)
+open Ix.Theory.Named (VEnv VInductDecl)
 
 /-- Ghost interpretation of one production family-block conversion result.
 
@@ -509,4 +509,4 @@ def toCatalogLinkOfEntry
 
 end SingletonRecursorIngressInterpretation
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/IotaPattern.lean b/Ix/Kernel/Verify/Inductive/IotaPattern.lean
similarity index 79%
rename from Ix/Tc/Verify/Inductive/IotaPattern.lean
rename to Ix/Kernel/Verify/Inductive/IotaPattern.lean
index 95788cded..7022c09d1 100644
--- a/Ix/Tc/Verify/Inductive/IotaPattern.lean
+++ b/Ix/Kernel/Verify/Inductive/IotaPattern.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.RuleApplication
+import Ix.Kernel.Verify.Inductive.RuleApplication
+
+open Ix.Theory (VLevel)
 
 /-!
 # Constructive iota-pattern paths
@@ -11,15 +13,15 @@ at a constructor's exact rule index; an off-by-one or reversed-spine adapter
 cannot satisfy the positional theorem.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 /-- The dependent path of the `index`-th (left-to-right) argument captured by
 `pattern.varN arity`. -/
-def IotaVarPath (pattern : Lean4Lean.Pattern) :
+def IotaVarPath (pattern : Ix.Theory.Named.Pattern) :
     (arity : Nat) → Fin arity →
-      (Lean4Lean.Pattern.varN pattern arity).Path
+      (Ix.Theory.Named.Pattern.varN pattern arity).Path
   | 0, index => Fin.elim0 index
   | arity + 1, index =>
       if h : index.val < arity then
@@ -30,35 +32,35 @@ def IotaVarPath (pattern : Lean4Lean.Pattern) :
 /-- Invert a `varN` match to the exact constant-headed argument list and
 identify every dependent capture path with its positional list entry. -/
 theorem iotaVarMatch_spine
-    {name : Lean.Name} {arity : Nat} {source : Lean4Lean.VExpr}
-    {levels : List Lean4Lean.VLevel}
-    {captures : ((Lean4Lean.Pattern.const name).varN arity).Path →
-      Lean4Lean.VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
-      ((Lean4Lean.Pattern.const name).varN arity)
+    {name : Lean.Name} {arity : Nat} {source : Ix.Theory.Named.VExpr}
+    {levels : List Ix.Theory.VLevel}
+    {captures : ((Ix.Theory.Named.Pattern.const name).varN arity).Path →
+      Ix.Theory.Named.VExpr}
+    (hmatch : Ix.Theory.Named.Pattern.Matches
+      ((Ix.Theory.Named.Pattern.const name).varN arity)
       source levels captures) :
-    ∃ arguments : List Lean4Lean.VExpr,
+    ∃ arguments : List Ix.Theory.Named.VExpr,
       arguments.length = arity ∧
-      source = Lean4Lean.VExpr.appN (.const name levels) arguments ∧
+      source = Ix.Theory.Named.VExpr.appN (.const name levels) arguments ∧
       ∀ index : Fin arity,
         arguments[index.val]? = some
           (captures (IotaVarPath (.const name) arity index)) := by
   induction arity generalizing source with
   | zero =>
-      change Lean4Lean.Pattern.Matches (.const name)
+      change Ix.Theory.Named.Pattern.Matches (.const name)
         source levels captures at hmatch
       cases hmatch
       exact ⟨[], rfl, rfl, fun index => Fin.elim0 index⟩
   | succ arity ih =>
-      change Lean4Lean.Pattern.Matches
-        (.var ((Lean4Lean.Pattern.const name).varN arity))
+      change Ix.Theory.Named.Pattern.Matches
+        (.var ((Ix.Theory.Named.Pattern.const name).varN arity))
         source levels captures at hmatch
       cases hmatch with
       | var hprefix =>
           rename_i fn argument prefixCaptures
           obtain ⟨arguments, hlength, rfl, hcaptures⟩ := ih hprefix
           refine ⟨arguments ++ [argument], by simp [hlength], ?_, ?_⟩
-          · rw [Lean4Lean.VExpr.appN_append]
+          · rw [Ix.Theory.Named.VExpr.appN_append]
             rfl
           · intro index
             by_cases hlt : index.val < arity
@@ -117,9 +119,9 @@ def constructorArgumentRhs
 @[simp] theorem recursorArgumentRhs_apply
     (recursorName : Lean.Name) (majorIdx : Nat)
     (constructorName : Lean.Name) (constructorArgs : Nat)
-    (index : Fin majorIdx) (levels : List Lean4Lean.VLevel)
+    (index : Fin majorIdx) (levels : List Ix.Theory.VLevel)
     (captures : (RecursorIotaPattern recursorName majorIdx constructorName
-      constructorArgs).Path → Lean4Lean.VExpr) :
+      constructorArgs).Path → Ix.Theory.Named.VExpr) :
     (recursorArgumentRhs recursorName majorIdx constructorName constructorArgs
       index).apply levels captures =
       captures (recursorArgumentPath recursorName majorIdx constructorName
@@ -128,39 +130,39 @@ def constructorArgumentRhs
 @[simp] theorem constructorArgumentRhs_apply
     (recursorName : Lean.Name) (majorIdx : Nat)
     (constructorName : Lean.Name) (constructorArgs : Nat)
-    (index : Fin constructorArgs) (levels : List Lean4Lean.VLevel)
+    (index : Fin constructorArgs) (levels : List Ix.Theory.VLevel)
     (captures : (RecursorIotaPattern recursorName majorIdx constructorName
-      constructorArgs).Path → Lean4Lean.VExpr) :
+      constructorArgs).Path → Ix.Theory.Named.VExpr) :
     (constructorArgumentRhs recursorName majorIdx constructorName
       constructorArgs index).apply levels captures =
       captures (constructorArgumentPath recursorName majorIdx constructorName
         constructorArgs index) := rfl
 
 /-- A complete iota match exposes both positional application spines.  The
-constructor universe list is existential because Lean4Lean's pattern result
+constructor universe list is existential because Ix.Theory.Named's pattern result
 retains the recursor levels only. -/
 theorem matches_spines
     {recursorName constructorName : Lean.Name}
-    {majorIdx constructorArgs : Nat} {source : Lean4Lean.VExpr}
-    {levels : List Lean4Lean.VLevel}
+    {majorIdx constructorArgs : Nat} {source : Ix.Theory.Named.VExpr}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern recursorName majorIdx constructorName
-      constructorArgs).Path → Lean4Lean.VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+      constructorArgs).Path → Ix.Theory.Named.VExpr}
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern recursorName majorIdx constructorName
         constructorArgs) source levels captures) :
     ∃ recursorArguments constructorLevels constructorArguments,
       recursorArguments.length = majorIdx ∧
       constructorArguments.length = constructorArgs ∧
       source = .app
-        (Lean4Lean.VExpr.appN (.const recursorName levels)
+        (Ix.Theory.Named.VExpr.appN (.const recursorName levels)
           recursorArguments)
-        (Lean4Lean.VExpr.appN (.const constructorName constructorLevels)
+        (Ix.Theory.Named.VExpr.appN (.const constructorName constructorLevels)
           constructorArguments) ∧
       (∀ index : Fin majorIdx,
         recursorArguments[index.val]? = some
           (captures (recursorArgumentPath recursorName majorIdx
             constructorName constructorArgs index))) := by
-  simp only [RecursorIotaPattern, Lean4Lean.SimplePattern.toPattern] at hmatch
+  simp only [RecursorIotaPattern, Ix.Theory.Named.SimplePattern.toPattern] at hmatch
   cases hmatch with
   | app hrecursor hconstructor =>
       obtain ⟨recursorArguments, hrecLength, rfl, hrecCaptures⟩ :=
@@ -178,20 +180,20 @@ constructor equations as well as the recursor-prefix equations: their
 generated RHS and their index-consistency checks mention constructor fields. -/
 theorem matches_spines_full
     {recursorName constructorName : Lean.Name}
-    {majorIdx constructorArgs : Nat} {source : Lean4Lean.VExpr}
-    {levels : List Lean4Lean.VLevel}
+    {majorIdx constructorArgs : Nat} {source : Ix.Theory.Named.VExpr}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern recursorName majorIdx constructorName
-      constructorArgs).Path → Lean4Lean.VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+      constructorArgs).Path → Ix.Theory.Named.VExpr}
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern recursorName majorIdx constructorName
         constructorArgs) source levels captures) :
     ∃ recursorArguments constructorLevels constructorArguments,
       recursorArguments.length = majorIdx ∧
       constructorArguments.length = constructorArgs ∧
       source = .app
-        (Lean4Lean.VExpr.appN (.const recursorName levels)
+        (Ix.Theory.Named.VExpr.appN (.const recursorName levels)
           recursorArguments)
-        (Lean4Lean.VExpr.appN (.const constructorName constructorLevels)
+        (Ix.Theory.Named.VExpr.appN (.const constructorName constructorLevels)
           constructorArguments) ∧
       (∀ index : Fin majorIdx,
         recursorArguments[index.val]? = some
@@ -201,7 +203,7 @@ theorem matches_spines_full
         constructorArguments[index.val]? = some
           (captures (constructorArgumentPath recursorName majorIdx
             constructorName constructorArgs index))) := by
-  simp only [RecursorIotaPattern, Lean4Lean.SimplePattern.toPattern] at hmatch
+  simp only [RecursorIotaPattern, Ix.Theory.Named.SimplePattern.toPattern] at hmatch
   cases hmatch with
   | app hrecursor hconstructor =>
       obtain ⟨recursorArguments, hrecLength, rfl, hrecCaptures⟩ :=
@@ -217,4 +219,4 @@ theorem matches_spines_full
 
 end RecursorIotaPattern
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/MutualBlockCertificate.lean b/Ix/Kernel/Verify/Inductive/MutualBlockCertificate.lean
similarity index 85%
rename from Ix/Tc/Verify/Inductive/MutualBlockCertificate.lean
rename to Ix/Kernel/Verify/Inductive/MutualBlockCertificate.lean
index 9341a10f1..15731b877 100644
--- a/Ix/Tc/Verify/Inductive/MutualBlockCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualBlockCertificate.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.BlockCertificate
-import Lean4Lean.Verify.Environment.MutualInductiveFixtures
+import Ix.Kernel.Verify.Inductive.BlockCertificate
+import Ix.Theory.Named.Verify.Environment.MutualInductiveFixtures
 
 /-!
 # Genuine mutual-block certificate fixture
@@ -10,16 +10,16 @@ globally flattened constructors, one generated recursor per family, and five
 globally flattened iota rules.  Recursive fields target both the sibling
 family and their own family, including one recursive occurrence below a Pi.
 
-This module consumes Lean4Lean's retained L4L-08 certificate through Ix's
+This module consumes Ix.Theory.Named's retained Spec-08 certificate through Ix's
 Theory-only block adapter.  Physical Ix ingress, checker execution, catalog
 linkage, and recursor admission remain separate obligations.
 -/
 
-namespace Ix.Tc.MutualTreeCertificateFixture
+namespace Ix.Kernel.MutualTreeCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.MutualInductiveFixtures
-open Lean4Lean.MutualInductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.MutualInductiveFixtures
+open Ix.Theory.Named.MutualInductiveReplayFixtures
 
 /-- One atomic two-family Theory transaction. -/
 def transaction :
@@ -28,10 +28,10 @@ def transaction :
   success := tree_addInductBlockCertified
   beforeWF := ⟨[], .empty⟩
 
-/-- The same completed transaction exposed through Lean4Lean's latest
+/-- The same completed transaction exposed through Ix.Theory.Named's latest
 consumer API.  In particular, its derived rule-closure and iota-pattern
 theorems are available to the physical recursor link without an Ix axiom. -/
-def lean4leanCertificate :
+def specificationCertificate :
     treeDecl.BlockCertificate VEnv.empty treeFinalEnv :=
   transaction.toBlockCertificate
 
@@ -80,7 +80,7 @@ theorem breadth : BreadthFacts where
   treeListTargetsItself := rfl
 
 /-- Complete block-wide family/constructor/recursor/rule consequences from
-the exact retained L4L-08 transaction. -/
+the exact retained Spec-08 transaction. -/
 theorem certifiedFacts :
     CertifiedBlockGenerationFacts VEnv.empty treeFinalEnv
       transaction.certificate :=
@@ -91,4 +91,4 @@ history, rather than two sequential singleton history entries. -/
 theorem finalEnvWF : treeFinalEnv.WF :=
   transaction.afterWF
 
-end Ix.Tc.MutualTreeCertificateFixture
+end Ix.Kernel.MutualTreeCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/MutualBlockFixture.lean b/Ix/Kernel/Verify/Inductive/MutualBlockFixture.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/MutualBlockFixture.lean
rename to Ix/Kernel/Verify/Inductive/MutualBlockFixture.lean
index 5d1f29d2f..6c7595844 100644
--- a/Ix/Tc/Verify/Inductive/MutualBlockFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualBlockFixture.lean
@@ -1,12 +1,12 @@
 import Ix.CompileDriver
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.MutualBlockCertificate
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.MutualBlockCertificate
 
 /-!
 # Physical mutual `Tree`/`TreeList` fixture
 
 This module compiles the exact kernel metadata already retained by the
-Lean4Lean mutual-inductive replay.  It therefore exercises the same pure Ix
+Ix.Theory.Named mutual-inductive replay.  It therefore exercises the same pure Ix
 compiler used by production instead of maintaining a second handwritten Ixon
 encoding of the two families, five constructors, two recursors, and five
 rules.
@@ -17,10 +17,10 @@ tables are the physical inputs for the mutual checker and semantic-admission
 links built in the following modules.
 -/
 
-namespace Ix.Tc.MutualTreeFixture
+namespace Ix.Kernel.MutualTreeFixture
 
-open Lean4Lean.MutualInductiveFixtures
-open Lean4Lean.MutualInductiveReplayFixtures
+open Ix.Theory.Named.MutualInductiveFixtures
+open Ix.Theory.Named.MutualInductiveReplayFixtures
 open InductiveConcreteFixture
 
 local instance mutualAnonKIdDecidableEq : DecidableEq (KId .anon) :=
@@ -384,4 +384,4 @@ theorem recursorBlockLoaded :
     recursorIngressAfter.getBlock? recursorBlockId = some recursorMembers :=
   recursorBlockLoadedNative
 
-end Ix.Tc.MutualTreeFixture
+end Ix.Kernel.MutualTreeFixture
diff --git a/Ix/Tc/Verify/Inductive/MutualBlockValidation.lean b/Ix/Kernel/Verify/Inductive/MutualBlockValidation.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/MutualBlockValidation.lean
rename to Ix/Kernel/Verify/Inductive/MutualBlockValidation.lean
index 9b98e0427..100317017 100644
--- a/Ix/Tc/Verify/Inductive/MutualBlockValidation.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualBlockValidation.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.SingletonInductive
-import Ix.Tc.Verify.Inductive.MutualBlockFixture
+import Ix.Kernel.Verify.Check.SingletonInductive
+import Ix.Kernel.Verify.Inductive.MutualBlockFixture
 
 /-!
 # Production validation of the mutual `Tree`/`TreeList` blocks
@@ -10,7 +10,7 @@ by the real recursor-block checker for the separately owned physical block.
 No semantic certificate or oracle participates in either execution.
 -/
 
-namespace Ix.Tc.MutualTreeFixture
+namespace Ix.Kernel.MutualTreeFixture
 
 local instance validationAnonKIdDecidableEq : DecidableEq (KId .anon) :=
   fun left right =>
@@ -167,4 +167,4 @@ theorem endToEndExecution : EndToEndExecution where
   familyKernel := familyKernelRun
   recursorKernel := recursorKernelRun
 
-end Ix.Tc.MutualTreeFixture
+end Ix.Kernel.MutualTreeFixture
diff --git a/Ix/Tc/Verify/Inductive/MutualFamily.lean b/Ix/Kernel/Verify/Inductive/MutualFamily.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive/MutualFamily.lean
rename to Ix/Kernel/Verify/Inductive/MutualFamily.lean
index 5501508ea..80b18fa7f 100644
--- a/Ix/Tc/Verify/Inductive/MutualFamily.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualFamily.lean
@@ -1,10 +1,10 @@
-import Ix.Tc.Verify.Check.BlockAcceptance
-import Ix.Tc.Verify.Inductive.BlockCertificate
+import Ix.Kernel.Verify.Check.BlockAcceptance
+import Ix.Kernel.Verify.Inductive.BlockCertificate
 
 /-!
 # Certified mutual-family admission
 
-A Lean4Lean block certificate owns one atomic semantic transaction for every
+A Ix.Theory.Named block certificate owns one atomic semantic transaction for every
 family and constructor in a mutual declaration.  This module supplies the
 Ix-facing representation boundary for the corresponding physical
 family/constructor block.  It does not split the source declaration into
@@ -15,9 +15,9 @@ physical Ix block, although their Theory constants and equations are already
 installed by the same source transaction.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstant VConstVal VEnv VInductDecl)
+open Ix.Theory.Named (VConstant VConstVal VEnv VInductDecl)
 
 /-- Exact concrete kinds permitted in the family/constructor half of a
 mutual-inductive transaction. -/
@@ -55,7 +55,7 @@ end KConst.IsMutualFamilyMember
 
 /-- A concrete member is tied either to one source family or to one source
 constructor of the complete mutual declaration.  The disjunction retains
-the exact source inventory membership used by Lean4Lean's lookup theorems. -/
+the exact source inventory membership used by Ix.Theory.Named's lookup theorems. -/
 def MutualSourceMember (source : VInductDecl) (name : Lean.Name)
     (constant : VConstant) : Prop :=
   (∃ family, family ∈ source.types ∧ name = family.name ∧
@@ -89,7 +89,7 @@ structure MutualFamilyCatalogLink (trProj : RawProjRel)
 namespace MutualFamilyCatalogLink
 
 /-- Derive the exact Theory lookup and constant-WF facts from the current
-Lean4Lean consumer certificate. -/
+Ix.Theory.Named consumer certificate. -/
 theorem translateMember {trProj : RawProjRel} {world : VerifyWorld}
     {source : VInductDecl} {after : VEnv}
     {tx : CertifiedBlockGenerationTransaction source world.venv after}
@@ -154,4 +154,4 @@ theorem transition {trProj : RawProjRel} {world : VerifyWorld}
 
 end MutualFamilyCatalogLink
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/MutualFamilyAdmission.lean b/Ix/Kernel/Verify/Inductive/MutualFamilyAdmission.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/MutualFamilyAdmission.lean
rename to Ix/Kernel/Verify/Inductive/MutualFamilyAdmission.lean
index 1e90ad411..078de4a84 100644
--- a/Ix/Tc/Verify/Inductive/MutualFamilyAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualFamilyAdmission.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Inductive.MutualBlockValidation
-import Ix.Tc.Verify.Inductive.MutualFamily
+import Ix.Kernel.Verify.Inductive.MutualBlockValidation
+import Ix.Kernel.Verify.Inductive.MutualFamily
 
 /-!
 # Atomic mutual `Tree`/`TreeList` family admission
 
 This module joins the production compiler/ingress/checker witness to the
-single Lean4Lean `Tree`/`TreeList` block transaction.  The seven physical
+single Ix.Theory.Named `Tree`/`TreeList` block transaction.  The seven physical
 family/constructor declarations are interpreted in the complete source
 inventory and admitted in one atomic semantic transition.
 
@@ -14,11 +14,11 @@ semantic constants and rules are already installed by this transaction; the
 next recursor-link module supplies their rule and pattern provenance.
 -/
 
-namespace Ix.Tc.MutualTreeFixture
+namespace Ix.Kernel.MutualTreeFixture
 
-open Lean4Lean
-open Lean4Lean.MutualInductiveFixtures
-open Lean4Lean.MutualInductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.MutualInductiveFixtures
+open Ix.Theory.Named.MutualInductiveReplayFixtures
 open MutualTreeCertificateFixture
 
 local instance admissionAnonKIdDecidableEq : DecidableEq (KId .anon) :=
@@ -677,7 +677,7 @@ structure MutualFamilyAtomicClosure : Prop where
   execution : EndToEndExecution
   exactFamily : ExactCheckBlock world familyBlockId familyMembers .inductive'
   exactRecursor : ExactCheckBlock world recursorBlockId recursorMembers .recursor
-  ruleClosure : lean4leanCertificate.generation.RuleClosure
+  ruleClosure : specificationCertificate.generation.RuleClosure
   familyAdmission :
     AtomicBlockAdmission RawProjRel.none world familyAcceptedWorld
       familyBlockId familyMembers .inductive'
@@ -687,8 +687,8 @@ theorem mutualFamilyAtomicClosure : MutualFamilyAtomicClosure where
   execution := endToEndExecution
   exactFamily := exactFamilyBlock
   exactRecursor := exactRecursorBlock
-  ruleClosure := lean4leanCertificate.ruleClosure
+  ruleClosure := specificationCertificate.ruleClosure
   familyAdmission := familyAtomicAdmission
   accepted := familyBlockAccepted
 
-end Ix.Tc.MutualTreeFixture
+end Ix.Kernel.MutualTreeFixture
diff --git a/Ix/Tc/Verify/Inductive/MutualRecursor.lean b/Ix/Kernel/Verify/Inductive/MutualRecursor.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive/MutualRecursor.lean
rename to Ix/Kernel/Verify/Inductive/MutualRecursor.lean
index 3af3791c8..87edab147 100644
--- a/Ix/Tc/Verify/Inductive/MutualRecursor.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualRecursor.lean
@@ -1,21 +1,21 @@
-import Ix.Tc.Verify.Check.PreTranslationCompatibility
-import Ix.Tc.Verify.Inductive.BlockPatternSoundness
-import Ix.Tc.Verify.Inductive.MutualFamily
+import Ix.Kernel.Verify.Check.PreTranslationCompatibility
+import Ix.Kernel.Verify.Inductive.BlockPatternSoundness
+import Ix.Kernel.Verify.Inductive.MutualFamily
 
 /-!
 # Generated recursors of a certified mutual block
 
 This module contains the reusable, representation-neutral part of the second
-physical block in Ix's mutual-inductive layout.  Lean4Lean installs all family
+physical block in Ix's mutual-inductive layout.  Ix.Theory.Named installs all family
 recursors and globally flattened equations in the original atomic source
 transaction; Ix later checks a separately owned recursor block.  The lemmas
 below retain the exact global generated-rule position while permitting each
 physical recursor to dispatch by its family-local constructor index.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstant VConstVal VDefEq VEnv VExpr VInductDecl)
+open Ix.Theory.Named (VConstant VConstVal VDefEq VEnv VExpr VInductDecl)
 
 namespace CertifiedMutualGeneration
 
@@ -51,11 +51,11 @@ namespace CertifiedMutualRecursor
 
 variable {source : VInductDecl} {before after : VEnv}
 
-/-- Repackage Lean4Lean's exact generated RHS/check payload as the finite
+/-- Repackage Ix.Theory.Named's exact generated RHS/check payload as the finite
 pattern record consumed by Ix.  `ruleIndex` is family-local (the physical
 dispatch index); `index` remains the global flattened equation position.
 `argumentArity` is the one explicit representation equality connecting the
-serialized parameter/field split to Lean4Lean's pattern arity. -/
+serialized parameter/field split to Ix.Theory.Named's pattern arity. -/
 def generatedPattern
     (certificate : source.BlockCertificate before after)
     {index : Nat} {constructor : VInductDecl.NormalizedBlockCtor}
@@ -181,4 +181,4 @@ theorem generatedPatternRel
 
 end CertifiedMutualRecursor
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/MutualRecursorAdmission.lean b/Ix/Kernel/Verify/Inductive/MutualRecursorAdmission.lean
similarity index 92%
rename from Ix/Tc/Verify/Inductive/MutualRecursorAdmission.lean
rename to Ix/Kernel/Verify/Inductive/MutualRecursorAdmission.lean
index 721ec6306..f2368aad5 100644
--- a/Ix/Tc/Verify/Inductive/MutualRecursorAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/MutualRecursorAdmission.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Inductive.MutualFamilyAdmission
-import Ix.Tc.Verify.Inductive.MutualRecursor
-import Ix.Tc.Verify.Upstream.Pending
+import Ix.Kernel.Verify.Inductive.MutualFamilyAdmission
+import Ix.Kernel.Verify.Inductive.MutualRecursor
+import Ix.Kernel.Verify.Frontier.Pending
 
 /-!
 # Conditional atomic admission of the mutual `Tree`/`TreeList` recursors
 
-The original Lean4Lean transaction has already installed both generated
+The original Ix.Theory.Named transaction has already installed both generated
 recursors and all five globally flattened equations.  This module proves the
 complete Ix-side correspondence for the separately owned two-member physical
 recursor block: exact family-local dispatch, global equation positions,
@@ -13,27 +13,27 @@ structural translations, constructor metadata, ownership, and admission.
 
 The reversed-order semantic certificate and generated-pattern soundness are
 conditional on two fixture-specific Theory witnesses in
-`Verify.Upstream.Pending`: family-permutation preservation of generation WF,
+`Verify.Frontier.Pending`: family-permutation preservation of generation WF,
 and the certified rule-pattern conclusion.  None of the Ix representation,
 ingress, ownership, or production-execution facts are assumed there.
 -/
 
-namespace Ix.Tc.MutualTreeFixture
+namespace Ix.Kernel.MutualTreeFixture
 
-open Lean4Lean
-open Lean4Lean.MutualInductiveFixtures
-open Lean4Lean.MutualInductiveReplayFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.MutualInductiveFixtures
+open Ix.Theory.Named.MutualInductiveReplayFixtures
 open MutualTreeCertificateFixture
 
 /- The physical compiler canonically orders this SCC as `TreeList, Tree`.
 These private aliases keep every rule index below tied to the exact reversed
-Lean4Lean descriptor certified in the quarantined upstream module. -/
+Ix.Theory.Named descriptor certified in the quarantined upstream module. -/
 private abbrev treeGeneration :=
-  Upstream.Pending.mutualTreePhysicalGeneration
-private abbrev lean4leanCertificate :=
-  Upstream.Pending.mutualTreePhysicalCertificate
+  Frontier.Pending.mutualTreePhysicalGeneration
+private abbrev specificationCertificate :=
+  Frontier.Pending.mutualTreePhysicalCertificate
 private abbrev treeFinalEnv :=
-  Upstream.Pending.mutualTreePhysicalFinalEnv
+  Frontier.Pending.mutualTreePhysicalFinalEnv
 
 local instance anonKIdDecidableEq : DecidableEq (KId .anon) :=
   fun left right =>
@@ -266,7 +266,7 @@ theorem recursorRepresentationFacts : RecursorRepresentationFacts :=
   recursorRepresentationFactsNative
 
 private theorem certificateGeneration_eq :
-    lean4leanCertificate.generation = treeGeneration := rfl
+    specificationCertificate.generation = treeGeneration := rfl
 
 private theorem treeRecTypeRawNative :
     RawExprRel (uvars := treeRecConcrete.lvls.toNat) treeFinalEnv nameOf
@@ -370,8 +370,8 @@ private theorem upgradeRule
       nameOf RawProjRel.none [] rule.rhs
       (treeGeneration.rule index constructor).rhs := by
   let pre := raw.toPreBinderCore_of_scoped binderCore hscoped hsize
-  have ruleWF := (lean4leanCertificate.recursorRuleFacts entry).wf
-  exact pre.upgradeBinderCoreOfWF lean4leanCertificate.afterWF
+  have ruleWF := (specificationCertificate.recursorRuleFacts entry).wf
+  exact pre.upgradeBinderCoreOfWF specificationCertificate.afterWF
     (Delta := []) (hDelta := trivial) binderCore ⟨_, ruleWF.2⟩
 
 theorem leafRuleTyped :
@@ -443,35 +443,35 @@ theorem treeListRecRaw :
 theorem treeRecLookup :
     treeFinalEnv.constants ``Tree.rec =
       some treeRecSource.toVConstant := by
-  have lookup := lean4leanCertificate.recursorLookup
+  have lookup := specificationCertificate.recursorLookup
     (List.mem_of_getElem? treeRecSourceAt)
   simpa [recursorRepresentationFacts.treeRecName] using lookup
 
 theorem treeListRecLookup :
     treeFinalEnv.constants ``TreeList.rec =
       some treeListRecSource.toVConstant := by
-  have lookup := lean4leanCertificate.recursorLookup
+  have lookup := specificationCertificate.recursorLookup
     (List.mem_of_getElem? treeListRecSourceAt)
   simpa [recursorRepresentationFacts.treeListRecName] using lookup
 
 theorem leafRegistered :
     RegisteredRecursorRuleRhsRel treeFinalEnv nameOf RawProjRel.none treeRecId
       treeRecConcrete leafRule (treeGeneration.rule 2 leafNormalized) :=
-  CertifiedMutualRecursor.registeredRule lean4leanCertificate treeRecRaw
+  CertifiedMutualRecursor.registeredRule specificationCertificate treeRecRaw
     treeRecLookup recursorRepresentationFacts.leafRecursorName.symm
     leafEntry leafRuleRaw leafRuleTyped
 
 theorem nodeRegistered :
     RegisteredRecursorRuleRhsRel treeFinalEnv nameOf RawProjRel.none treeRecId
       treeRecConcrete nodeRule (treeGeneration.rule 3 nodeNormalized) :=
-  CertifiedMutualRecursor.registeredRule lean4leanCertificate treeRecRaw
+  CertifiedMutualRecursor.registeredRule specificationCertificate treeRecRaw
     treeRecLookup recursorRepresentationFacts.nodeRecursorName.symm
     nodeEntry nodeRuleRaw nodeRuleTyped
 
 theorem branchRegistered :
     RegisteredRecursorRuleRhsRel treeFinalEnv nameOf RawProjRel.none treeRecId
       treeRecConcrete branchRule (treeGeneration.rule 4 branchNormalized) :=
-  CertifiedMutualRecursor.registeredRule lean4leanCertificate treeRecRaw
+  CertifiedMutualRecursor.registeredRule specificationCertificate treeRecRaw
     treeRecLookup recursorRepresentationFacts.branchRecursorName.symm
     branchEntry branchRuleRaw branchRuleTyped
 
@@ -479,7 +479,7 @@ theorem nilRegistered :
     RegisteredRecursorRuleRhsRel treeFinalEnv nameOf RawProjRel.none
       treeListRecId treeListRecConcrete nilRule
       (treeGeneration.rule 0 nilNormalized) :=
-  CertifiedMutualRecursor.registeredRule lean4leanCertificate treeListRecRaw
+  CertifiedMutualRecursor.registeredRule specificationCertificate treeListRecRaw
     treeListRecLookup recursorRepresentationFacts.nilRecursorName.symm
     nilEntry nilRuleRaw nilRuleTyped
 
@@ -487,34 +487,34 @@ theorem consRegistered :
     RegisteredRecursorRuleRhsRel treeFinalEnv nameOf RawProjRel.none
       treeListRecId treeListRecConcrete consRule
       (treeGeneration.rule 1 consNormalized) :=
-  CertifiedMutualRecursor.registeredRule lean4leanCertificate treeListRecRaw
+  CertifiedMutualRecursor.registeredRule specificationCertificate treeListRecRaw
     treeListRecLookup recursorRepresentationFacts.consRecursorName.symm
     consEntry consRuleRaw consRuleTyped
 
 /-! ## Exact generated patterns -/
 
 def leafPattern : RecursorRulePattern :=
-  CertifiedMutualRecursor.generatedPattern lean4leanCertificate
+  CertifiedMutualRecursor.generatedPattern specificationCertificate
     leafEntry treeLeafId 0 1 1
     recursorRepresentationFacts.leafArgumentArity
 
 def nodePattern : RecursorRulePattern :=
-  CertifiedMutualRecursor.generatedPattern lean4leanCertificate
+  CertifiedMutualRecursor.generatedPattern specificationCertificate
     nodeEntry treeNodeId 1 1 1
     recursorRepresentationFacts.nodeArgumentArity
 
 def branchPattern : RecursorRulePattern :=
-  CertifiedMutualRecursor.generatedPattern lean4leanCertificate
+  CertifiedMutualRecursor.generatedPattern specificationCertificate
     branchEntry treeBranchId 2 1 1
     recursorRepresentationFacts.branchArgumentArity
 
 def nilPattern : RecursorRulePattern :=
-  CertifiedMutualRecursor.generatedPattern lean4leanCertificate
+  CertifiedMutualRecursor.generatedPattern specificationCertificate
     nilEntry treeListNilId 0 1 0
     recursorRepresentationFacts.nilArgumentArity
 
 def consPattern : RecursorRulePattern :=
-  CertifiedMutualRecursor.generatedPattern lean4leanCertificate
+  CertifiedMutualRecursor.generatedPattern specificationCertificate
     consEntry treeListConsId 1 1 2
     recursorRepresentationFacts.consArgumentArity
 
@@ -616,40 +616,40 @@ private theorem consPatternMetadata :
 theorem leafPatternRel :
     RawRecursorRulePatternRel treeFinalEnv catalog nameOf treeRecId
       treeRecConcrete leafRule leafPattern :=
-  CertifiedMutualRecursor.generatedPatternRel lean4leanCertificate
-    Upstream.Pending.mutualTreePhysicalRulePatternSound
+  CertifiedMutualRecursor.generatedPatternRel specificationCertificate
+    Frontier.Pending.mutualTreePhysicalRulePatternSound
     leafEntry treeLeafId 0 1 1
     recursorRepresentationFacts.leafArgumentArity leafPatternMetadata
 
 theorem nodePatternRel :
     RawRecursorRulePatternRel treeFinalEnv catalog nameOf treeRecId
       treeRecConcrete nodeRule nodePattern :=
-  CertifiedMutualRecursor.generatedPatternRel lean4leanCertificate
-    Upstream.Pending.mutualTreePhysicalRulePatternSound
+  CertifiedMutualRecursor.generatedPatternRel specificationCertificate
+    Frontier.Pending.mutualTreePhysicalRulePatternSound
     nodeEntry treeNodeId 1 1 1
     recursorRepresentationFacts.nodeArgumentArity nodePatternMetadata
 
 theorem branchPatternRel :
     RawRecursorRulePatternRel treeFinalEnv catalog nameOf treeRecId
       treeRecConcrete branchRule branchPattern :=
-  CertifiedMutualRecursor.generatedPatternRel lean4leanCertificate
-    Upstream.Pending.mutualTreePhysicalRulePatternSound
+  CertifiedMutualRecursor.generatedPatternRel specificationCertificate
+    Frontier.Pending.mutualTreePhysicalRulePatternSound
     branchEntry treeBranchId 2 1 1
     recursorRepresentationFacts.branchArgumentArity branchPatternMetadata
 
 theorem nilPatternRel :
     RawRecursorRulePatternRel treeFinalEnv catalog nameOf treeListRecId
       treeListRecConcrete nilRule nilPattern :=
-  CertifiedMutualRecursor.generatedPatternRel lean4leanCertificate
-    Upstream.Pending.mutualTreePhysicalRulePatternSound
+  CertifiedMutualRecursor.generatedPatternRel specificationCertificate
+    Frontier.Pending.mutualTreePhysicalRulePatternSound
     nilEntry treeListNilId 0 1 0
     recursorRepresentationFacts.nilArgumentArity nilPatternMetadata
 
 theorem consPatternRel :
     RawRecursorRulePatternRel treeFinalEnv catalog nameOf treeListRecId
       treeListRecConcrete consRule consPattern :=
-  CertifiedMutualRecursor.generatedPatternRel lean4leanCertificate
-    Upstream.Pending.mutualTreePhysicalRulePatternSound
+  CertifiedMutualRecursor.generatedPatternRel specificationCertificate
+    Frontier.Pending.mutualTreePhysicalRulePatternSound
     consEntry treeListConsId 1 1 2
     recursorRepresentationFacts.consArgumentArity consPatternMetadata
 
@@ -657,11 +657,11 @@ theorem consPatternRel :
 
 /-- Historical adapter for the exact `TreeList, Tree` certificate.  This is
 the same computed generation and post-environment exposed by the current
-Lean4Lean consumer package in `Upstream.Pending`. -/
+Ix.Theory.Named consumer package in `Frontier.Pending`. -/
 def physicalTransaction : CertifiedBlockGenerationTransaction
-    Upstream.Pending.mutualTreePhysicalDecl VEnv.empty treeFinalEnv where
-  certificate := Upstream.Pending.mutualTreePhysicalSemantic
-  success := Upstream.Pending.mutualTreePhysicalSuccess
+    Frontier.Pending.mutualTreePhysicalDecl VEnv.empty treeFinalEnv where
+  certificate := Frontier.Pending.mutualTreePhysicalSemantic
+  success := Frontier.Pending.mutualTreePhysicalSuccess
   beforeWF := ⟨[], .empty⟩
 
 private theorem physicalTreeTypeRawNative :
@@ -750,15 +750,15 @@ theorem physicalConsTypeRaw :
 
 structure PhysicalSourceMembershipFacts : Prop where
   leaf : treeLeafSource ∈
-    Upstream.Pending.mutualTreePhysicalDecl.blockConstructorConstants
+    Frontier.Pending.mutualTreePhysicalDecl.blockConstructorConstants
   node : treeNodeSource ∈
-    Upstream.Pending.mutualTreePhysicalDecl.blockConstructorConstants
+    Frontier.Pending.mutualTreePhysicalDecl.blockConstructorConstants
   branch : treeBranchSource ∈
-    Upstream.Pending.mutualTreePhysicalDecl.blockConstructorConstants
+    Frontier.Pending.mutualTreePhysicalDecl.blockConstructorConstants
   nil : treeListNilSource ∈
-    Upstream.Pending.mutualTreePhysicalDecl.blockConstructorConstants
+    Frontier.Pending.mutualTreePhysicalDecl.blockConstructorConstants
   cons : treeListConsSource ∈
-    Upstream.Pending.mutualTreePhysicalDecl.blockConstructorConstants
+    Frontier.Pending.mutualTreePhysicalDecl.blockConstructorConstants
 
 private theorem physicalSourceMembershipFactsNative :
     PhysicalSourceMembershipFacts := by
@@ -784,7 +784,7 @@ def physicalFamilyLink :
         nameOf_treeList, familyMemberShapeFacts.treeListUvars,
         physicalTreeListTypeRaw,
         .inl ⟨treeListType, by
-          simp [Upstream.Pending.mutualTreePhysicalDecl], rfl, rfl⟩⟩
+          simp [Frontier.Pending.mutualTreePhysicalDecl], rfl, rfl⟩⟩
     · exact ⟨treeListNilConcrete, ``TreeList.nil,
         treeListNilSource.toVConstant, catalog_nil,
         familyMemberShapeFacts.nilKind, nameOf_nil,
@@ -801,7 +801,7 @@ def physicalFamilyLink :
         catalog_tree, familyMemberShapeFacts.treeKind, nameOf_tree,
         familyMemberShapeFacts.treeUvars, physicalTreeTypeRaw,
         .inl ⟨treeType, by
-          simp [Upstream.Pending.mutualTreePhysicalDecl], rfl, rfl⟩⟩
+          simp [Frontier.Pending.mutualTreePhysicalDecl], rfl, rfl⟩⟩
     · exact ⟨treeLeafConcrete, ``Tree.leaf,
         treeLeafSource.toVConstant, catalog_leaf,
         familyMemberShapeFacts.leafKind, nameOf_leaf,
@@ -932,7 +932,7 @@ private theorem treeListRecPattern {index : Nat} {rule : RecRule .anon}
 private theorem treeRecSemanticEntry :
     TrustedCatalogEntry RawProjRel.none catalog nameOf treeFinalEnv treeRecId :=
   .ambient catalog_treeRec treeRecRaw treeRecLookup
-    (lean4leanCertificate.afterWF.ordered.constWF treeRecLookup)
+    (specificationCertificate.afterWF.ordered.constWF treeRecLookup)
     (fun {_} hrule => treeRecRule hrule)
     (fun {_ _} hrule => treeRecPattern hrule)
 
@@ -940,7 +940,7 @@ private theorem treeListRecSemanticEntry :
     TrustedCatalogEntry RawProjRel.none catalog nameOf treeFinalEnv
       treeListRecId :=
   .ambient catalog_treeListRec treeListRecRaw treeListRecLookup
-    (lean4leanCertificate.afterWF.ordered.constWF treeListRecLookup)
+    (specificationCertificate.afterWF.ordered.constWF treeListRecLookup)
     (fun {_} hrule => treeListRecRule hrule)
     (fun {_ _} hrule => treeListRecPattern hrule)
 
@@ -1025,7 +1025,7 @@ rule-pattern soundness. -/
 structure MutualRecursorConditionalClosure : Prop where
   execution : EndToEndExecution
   family : MutualFamilyAtomicClosure
-  patternSound : CertifiedBlockRulePatternSound lean4leanCertificate
+  patternSound : CertifiedBlockRulePatternSound specificationCertificate
   physicalFamilyAdmission :
     AtomicBlockAdmission RawProjRel.none world physicalFamilyAcceptedWorld
       familyBlockId familyMembers .inductive'
@@ -1039,7 +1039,7 @@ theorem mutualRecursorConditionalClosure :
     MutualRecursorConditionalClosure where
   execution := endToEndExecution
   family := mutualFamilyAtomicClosure
-  patternSound := Upstream.Pending.mutualTreePhysicalRulePatternSound
+  patternSound := Frontier.Pending.mutualTreePhysicalRulePatternSound
   physicalFamilyAdmission := physicalFamilyAtomicAdmission
   recursorAdmission := familyRecursorAtomicAdmission
   familyAccepted :=
@@ -1047,4 +1047,4 @@ theorem mutualRecursorConditionalClosure :
       familyRecursorAtomicAdmission.promotion.le
   recursorAccepted := familyRecursorBlockAccepted
 
-end Ix.Tc.MutualTreeFixture
+end Ix.Kernel.MutualTreeFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedAdmission.lean b/Ix/Kernel/Verify/Inductive/NestedAdmission.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/NestedAdmission.lean
rename to Ix/Kernel/Verify/Inductive/NestedAdmission.lean
index d5e632520..db073465b 100644
--- a/Ix/Tc/Verify/Inductive/NestedAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedAdmission.lean
@@ -1,19 +1,19 @@
-import Ix.Tc.Verify.Inductive.NestedSemanticTransaction
+import Ix.Kernel.Verify.Inductive.NestedSemanticTransaction
 
 /-!
 # Atomic admission of the nested `LeanTree` source block
 
-This module joins the concrete Ix block to the completed Lean4Lean nested
+This module joins the concrete Ix block to the completed Ix.Theory.Named nested
 transaction.  The physical block contains only the stored `Tree` family and
-`node` constructor.  Lean4Lean's transaction independently flattens the
+`node` constructor.  Ix.Theory.Named's transaction independently flattens the
 nested dependency, checks the restored constants/equations, removes every
 auxiliary name, and commits the source family, constructor, two recursors,
 and two rules at one public `addInductNested` boundary.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
-open Lean4Lean
+open Ix.Theory.Named
 open InductiveConcreteFixture
 
 local instance nestedAdmissionAddressDecidableEq : DecidableEq Address :=
@@ -322,10 +322,10 @@ structure NestedSemanticTransactionClosure : Prop where
       groups rootGroup.addrs #[treeId.addr] checkerMethods nestedWhnfAfter
         positivityAfter
   flatNodeValidation :
-    Lean4Lean.AddInductive.checkConstructorType leanFlatStats false 0
+    Ix.Theory.Named.AddInductive.checkConstructorType leanFlatStats false 0
       leanFlatNode.name leanFlatNode.type leanFlatConstructorContext = .ok ()
   flatWrapValidation :
-    Lean4Lean.AddInductive.checkConstructorType leanFlatStats false 1
+    Ix.Theory.Named.AddInductive.checkConstructorType leanFlatStats false 1
       leanFlatWrap.name leanFlatWrap.type leanFlatConstructorContext = .ok ()
   semantic : SemanticTreeTransactionFacts
   ruleMetadata :
@@ -352,4 +352,4 @@ theorem nestedSemanticTransactionClosure :
   admission := nestedFamilyAtomicAdmission
   accepted := nestedFamilyBlockAccepted
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedAuxiliaryExpansion.lean b/Ix/Kernel/Verify/Inductive/NestedAuxiliaryExpansion.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/NestedAuxiliaryExpansion.lean
rename to Ix/Kernel/Verify/Inductive/NestedAuxiliaryExpansion.lean
index e45a41f02..419c7a945 100644
--- a/Ix/Tc/Verify/Inductive/NestedAuxiliaryExpansion.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedAuxiliaryExpansion.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.NestedPositivityTraversal
+import Ix.Kernel.Verify.Inductive.NestedPositivityTraversal
 
 /-!
 # Nested positivity requests and flat-block auxiliary expansion
@@ -18,7 +18,7 @@ small representation bridge that later block traversal must derive from the
 two executions of the same loaded header.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Equality lawfulness is needed only for the physical `auxSeen` membership
 proofs in this module.  Keep it local so the broader positivity traversal
@@ -1359,4 +1359,4 @@ theorem CompleteNestedPositivityApplicationTrace.producedRequest
   simpa only [NestedPositivityAuxiliaryRequest.ProducedBy] using
     trace.auxiliaryRequest
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/NestedAuxiliaryPositivity.lean b/Ix/Kernel/Verify/Inductive/NestedAuxiliaryPositivity.lean
similarity index 93%
rename from Ix/Tc/Verify/Inductive/NestedAuxiliaryPositivity.lean
rename to Ix/Kernel/Verify/Inductive/NestedAuxiliaryPositivity.lean
index 34de2e3a9..1157bc3ec 100644
--- a/Ix/Tc/Verify/Inductive/NestedAuxiliaryPositivity.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedAuxiliaryPositivity.lean
@@ -1,18 +1,18 @@
-import Ix.Tc.Verify.Inductive.NestedPositivityTransport
+import Ix.Kernel.Verify.Inductive.NestedPositivityTransport
 
 /-!
 # Positivity of a generated nested auxiliary
 
 The outer `Tree.node` field is checked by Ix as the nested application
-`Box Tree`, while Lean4Lean rewrites that application to a generated flat
+`Box Tree`, while Ix.Theory.Named rewrites that application to a generated flat
 family.  This module follows the other half of that transformation: the
 production nested traversal copies `Box.wrap`, strips its `Box` parameter,
 substitutes `Tree`, and checks the resulting `Tree` field.  The retained
-execution is transported to the direct recursive field of Lean4Lean's copied
+execution is transported to the direct recursive field of Ix.Theory.Named's copied
 auxiliary constructor.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 local instance auxiliaryAddressDecidableEq : DecidableEq Address :=
   AnonStructural.addressDecidableEq
@@ -421,17 +421,17 @@ theorem nestedAuxiliaryFieldProductionTrace :
 
 private theorem leanTreeCandidateWhnfNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run leanFlatConstructorContext.env
+      (Ix.Theory.Named.TypeChecker.M.run leanFlatConstructorContext.env
         leanFlatConstructorContext.safety leanFlatConstructorContext.lctx
         leanFlatConstructorContext.lparams leanFlatConstructorContext.fuel
-        (Lean4Lean.TypeChecker.whnf leanTreeExpr))
+        (Ix.Theory.Named.TypeChecker.whnf leanTreeExpr))
       leanTreeExpr = true := by
   native_decide
 
 theorem leanTreeCandidateWhnf :
-    Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+    Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
       ⟨leanFlatConstructorContext, leanTreeExpr, leanTreeExpr⟩ := by
-  unfold Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+  unfold Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     leanTreeCandidateWhnfNative
 
@@ -440,14 +440,14 @@ constructor.  Its state is the state selected by production after reducing
 the copied constructor telescope, rather than a separately initialized
 fixture state. -/
 inductive NestedAuxiliaryPositivitySourceRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | domain : NestedAuxiliaryPositivitySourceRel auxiliaryFieldWhnfAfter
       leanFlatConstructorContext treeExpr leanTreeExpr
 
 /-- Exact post-WHNF syntax relation for the recursive `Tree` field. -/
 inductive NestedAuxiliaryPositivityResultRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | domain {ixResult : KExpr .anon}
       (candidate : CandidateSyntaxRel nestedCandidateNameOf
@@ -460,15 +460,15 @@ inductive NestedAuxiliaryPositivityResultRel :
 
 private theorem nestedAuxiliaryRootFree
     {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource : KExpr .anon} {leanSource : Lean.Expr}
     (relation : NestedAuxiliaryPositivitySourceRel ixState leanContext
       ixSource leanSource)
     (free : exprMentionsAnyAddr ixSource #[treeId.addr] = false) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
         false := by
   cases relation
   rw [auxiliaryTreeMentionsRootNative] at free
@@ -477,7 +477,7 @@ private theorem nestedAuxiliaryRootFree
 set_option maxRecDepth 100000 in
 private theorem nestedAuxiliaryWhnf
     {ixBefore ixAfter : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource ixResult : KExpr .anon} {leanSource : Lean.Expr}
     (relation : NestedAuxiliaryPositivitySourceRel ixBefore leanContext
       ixSource leanSource)
@@ -485,7 +485,7 @@ private theorem nestedAuxiliaryWhnf
     (run : (RecM.whnf ixSource).run checkerMethods ixBefore =
       .ok ixResult ixAfter) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
       NestedAuxiliaryPositivityResultRel ixAfter leanContext ixResult
         leanResult := by
@@ -500,13 +500,13 @@ private theorem nestedAuxiliaryMentions
     (relation : NestedAuxiliaryPositivitySourceRel ixState leanContext ixExpr
       leanExpr) :
     exprMentionsAnyAddr ixExpr #[treeId.addr] =
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanExpr := by
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanExpr := by
   cases relation
   rw [auxiliaryTreeMentionsRootNative, leanTreeOccurs]
 
 private theorem nestedAuxiliaryForall
     {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixName : Mode.anon.F Name} {ixBinder : Mode.anon.F Lean.BinderInfo}
     {ixDomain ixBody : KExpr .anon} {ixInfo : ExprInfo .anon}
     {leanExpr : Lean.Expr}
@@ -522,14 +522,14 @@ private theorem nestedAuxiliaryForall
           .ok (ixOpen, ixFVar) ixAfterOpen →
         NestedAuxiliaryPositivitySourceRel ixAfterOpen
           (leanContext.pushLocalDecl leanName leanBinder
-            (Lean4Lean.AddInductive.consumeTypeAnnotations leanDomain))
+            (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanDomain))
           ixOpen (leanBody.instantiate1 leanContext.freshExpr) := by
   cases relation with
   | domain candidate => cases candidate
 
 private theorem nestedAuxiliaryDirect
     {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixResult : KExpr .anon} {leanResult : Lean.Expr}
     {id : KId .anon} {us : Array (KUniv .anon)} {info : ExprInfo .anon}
     {args : Array (KExpr .anon)}
@@ -542,10 +542,10 @@ private theorem nestedAuxiliaryDirect
     (_valid : ValidPositiveRecursiveApplication id us args traceGroups
       #[treeId.addr] checkerMethods ixState final) :
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
           true ∧
         leanResult.isForall = false ∧
-        Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanResult =
+        Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanResult =
           some targetIdx := by
   cases relation
   exact ⟨0, leanTreeOccurs, rfl, leanTreeTarget⟩
@@ -592,9 +592,9 @@ theorem nestedAuxiliaryFieldProductionTraceAt (fuel : Nat) :
           active valid⟩
 
 /-- The production-derived direct field trace transported at any positive
-Lean4Lean positivity fuel. -/
+Ix.Theory.Named positivity fuel. -/
 theorem nestedAuxiliaryConstructorPositivityTraceAt (fuel : Nat) :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace leanFlatStats
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace leanFlatStats
       leanFlatWrap.name 0 leanFlatConstructorContext leanTreeExpr
         (fuel + 1)) := by
   rcases nestedAuxiliaryFieldProductionTraceAt fuel with
@@ -603,9 +603,9 @@ theorem nestedAuxiliaryConstructorPositivityTraceAt (fuel : Nat) :
     nestedAuxiliaryPositivityTransport trace root .domain
 
 /-- The inner call retained from production's nested traversal constructs the
-exact Lean4Lean positivity trace for the copied auxiliary field. -/
+exact Ix.Theory.Named positivity trace for the copied auxiliary field. -/
 theorem nestedAuxiliaryConstructorPositivityTrace :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace leanFlatStats
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace leanFlatStats
       leanFlatWrap.name 0 leanFlatConstructorContext leanTreeExpr
         (positivityFuel - 3)) := by
   rcases nestedAuxiliaryFieldProductionTrace with
@@ -613,4 +613,4 @@ theorem nestedAuxiliaryConstructorPositivityTrace :
   exact FlatPositivityTraceTransport.constructorPositivityTrace
     nestedAuxiliaryPositivityTransport trace root .domain
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedBlockCertificate.lean b/Ix/Kernel/Verify/Inductive/NestedBlockCertificate.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/NestedBlockCertificate.lean
rename to Ix/Kernel/Verify/Inductive/NestedBlockCertificate.lean
index dd24863b7..0de4f579f 100644
--- a/Ix/Tc/Verify/Inductive/NestedBlockCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedBlockCertificate.lean
@@ -1,10 +1,10 @@
-import Ix.Tc.Verify.Check.BlockAcceptance
-import Lean4Lean.Theory.Typing.InductiveCertificate
+import Ix.Kernel.Verify.Check.BlockAcceptance
+import Ix.Theory.Named.Typing.InductiveCertificate
 
 /-!
 # Certified nested-block transactions
 
-This is the Ix consumer boundary for Lean4Lean's `NestedBlockCertificate`.
+This is the Ix consumer boundary for Ix.Theory.Named's `NestedBlockCertificate`.
 The Theory transaction stores the original source families and constructors,
 then restores every generated recursor and rule before committing them.  The
 Ix-facing link below covers only the physical source block; generated
@@ -15,9 +15,9 @@ after an exhaustive physical catalog link and an `ExactCheckBlock` prove that
 the one nested transaction describes the complete checked block.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstant VConstVal VEnv VInductDecl)
+open Ix.Theory.Named (VConstant VConstVal VEnv VInductDecl)
 
 /-- Exact concrete kinds permitted in the stored source half of a nested
 transaction. -/
@@ -143,4 +143,4 @@ theorem transition {trProj : RawProjRel} {world : VerifyWorld}
 
 end NestedFamilyCatalogLink
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/NestedCandidateSyntax.lean b/Ix/Kernel/Verify/Inductive/NestedCandidateSyntax.lean
similarity index 85%
rename from Ix/Tc/Verify/Inductive/NestedCandidateSyntax.lean
rename to Ix/Kernel/Verify/Inductive/NestedCandidateSyntax.lean
index b787181b6..ca7e07bdf 100644
--- a/Ix/Tc/Verify/Inductive/NestedCandidateSyntax.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedCandidateSyntax.lean
@@ -1,27 +1,27 @@
-import Ix.Tc.Verify.Inductive.ExactLeanSyntax
-import Ix.Tc.Verify.Inductive.NestedRecursiveFixture
-import Lean4Lean.Verify.Environment.InductiveFixtures
+import Ix.Kernel.Verify.Inductive.ExactLeanSyntax
+import Ix.Kernel.Verify.Inductive.NestedRecursiveFixture
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
 
 /-!
-# Lean4Lean candidate produced by nested elimination
+# Ix.Theory.Named candidate produced by nested elimination
 
 The production Ix fixture reaches `Box Tree` and records an auxiliary flat
 member whose physical identity remains the external `Box` address plus its
-exact specialization key.  Lean4Lean represents the same operation
+exact specialization key.  Ix.Theory.Named represents the same operation
 differently: `ElimNestedInductive.run` creates a fresh family constant and
 rewrites both the outer constructor and the copied external constructor to
 refer to that constant.
 
-This module executes that real Lean4Lean transformation for the same
+This module executes that real Ix.Theory.Named transformation for the same
 monomorphic `Box`/`Tree` shape and retains the exact flattened syntax.  The
 fresh auxiliary name is therefore an output of the producer, not a name
 chosen by the transport proof.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 open Lean Meta Elab Term
-open Lean4Lean.InductiveReplayFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
 
 /-! ## Previously declared external family -/
 
@@ -50,8 +50,8 @@ def leanNestedBaseEnv : Lean.Kernel.Environment :=
 
 /-! ## Unflattened source declaration -/
 
-def leanTreeName : Lean.Name := `Ix.Tc.NestedRecursiveFixture.LeanTree
-def leanNodeName : Lean.Name := `Ix.Tc.NestedRecursiveFixture.LeanTree.node
+def leanTreeName : Lean.Name := `Ix.Kernel.NestedRecursiveFixture.LeanTree
+def leanNodeName : Lean.Name := `Ix.Kernel.NestedRecursiveFixture.LeanTree.node
 def leanTreeExpr : Lean.Expr := .const leanTreeName []
 def leanNestedDomain : Lean.Expr := .app (.const ``LeanBox []) leanTreeExpr
 
@@ -63,7 +63,7 @@ def leanTreeSource : Lean.InductiveType :=
         type := .forallE `value leanNestedDomain leanTreeExpr .default }] }
 
 def leanNestedEliminationOutcome :=
-  (Lean4Lean.ElimNestedInductive.run 1000 0 [leanTreeSource]
+  (Ix.Theory.Named.ElimNestedInductive.run 1000 0 [leanTreeSource]
       leanNestedBaseEnv).run'
     { lvls := [], newTypes := #[leanTreeSource] }
 
@@ -196,7 +196,7 @@ theorem leanAuxiliarySource :
 /-! ## Constructor-validation candidate -/
 
 /-- Exact statistics of the two-member flattened mutual block. -/
-def leanFlatStats : Lean4Lean.AddInductive.InductiveStats where
+def leanFlatStats : Ix.Theory.Named.AddInductive.InductiveStats where
   levels := []
   resultLevel := .succ .zero
   nindices := #[0, 0]
@@ -204,16 +204,16 @@ def leanFlatStats : Lean4Lean.AddInductive.InductiveStats where
   params := #[]
   isNotZero := true
 
-def leanFlatFamilyContext : Lean4Lean.AddInductive.Context where
+def leanFlatFamilyContext : Ix.Theory.Named.AddInductive.Context where
   env := leanNestedBaseEnv
   lparams := []
   safety := .safe
   allowPrimitive := false
-  fuel := { ({} : Lean4Lean.FuelConfig) with
+  fuel := { ({} : Ix.Theory.Named.FuelConfig) with
     inductiveFuel := positivityFuel }
 
 def leanFlatDeclarationOutcome :=
-  Lean4Lean.AddInductive.declareInductiveTypes leanFlatStats 0
+  Ix.Theory.Named.AddInductive.declareInductiveTypes leanFlatStats 0
     leanFlatTypes.toArray 1 false leanFlatFamilyContext
 
 def leanFlatConstructorEnv : Lean.Kernel.Environment :=
@@ -221,7 +221,7 @@ def leanFlatConstructorEnv : Lean.Kernel.Environment :=
   | .ok environment => environment
   | .error _ => leanNestedBaseEnv
 
-def leanFlatConstructorContext : Lean4Lean.AddInductive.Context :=
+def leanFlatConstructorContext : Ix.Theory.Named.AddInductive.Context :=
   { leanFlatFamilyContext with env := leanFlatConstructorEnv }
 
 private theorem leanFlatDeclarationSucceededNative :
@@ -240,39 +240,39 @@ theorem leanFlatDeclarationRun :
   cases outcome <;> simp_all
 
 private theorem leanTreeTargetNative :
-    Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanTreeExpr =
+    Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanTreeExpr =
       some 0 := by
   native_decide
 
 theorem leanTreeTarget :
-    Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanTreeExpr =
+    Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanTreeExpr =
       some 0 := leanTreeTargetNative
 
 private theorem leanAuxiliaryTargetNative :
-    Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanAuxiliaryExpr =
+    Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanAuxiliaryExpr =
       some 1 := by
   native_decide
 
 theorem leanAuxiliaryTarget :
-    Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanAuxiliaryExpr =
+    Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanAuxiliaryExpr =
       some 1 := leanAuxiliaryTargetNative
 
 private theorem leanTreeOccursNative :
-    Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanTreeExpr =
+    Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanTreeExpr =
       true := by
   native_decide
 
 theorem leanTreeOccurs :
-    Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanTreeExpr =
+    Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanTreeExpr =
       true := leanTreeOccursNative
 
 private theorem leanAuxiliaryOccursNative :
-    Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts
+    Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts
       leanAuxiliaryExpr = true := by
   native_decide
 
 theorem leanAuxiliaryOccurs :
-    Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts
+    Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts
       leanAuxiliaryExpr = true := leanAuxiliaryOccursNative
 
 /-! ## Exact cross-representation target certificate -/
@@ -289,7 +289,7 @@ private theorem nestedDomainCandidateCheckNative :
       nestedDomain leanNestedDomain = true := by
   native_decide
 
-/-- Before flattening, the actual ingressed Ix domain and Lean4Lean's nested
+/-- Before flattening, the actual ingressed Ix domain and Ix.Theory.Named's nested
 source have the same constant/application syntax. -/
 theorem nestedDomainCandidateSyntax :
     CandidateSyntaxRel nestedCandidateNameOf
@@ -315,11 +315,11 @@ theorem treeCandidateSyntax :
       treeExpr leanTreeExpr :=
   CandidateSyntax.rel_of_check treeCandidateCheckNative
 
-/-- Evidence that the target accepted by Lean4Lean is exactly the auxiliary
+/-- Evidence that the target accepted by Ix.Theory.Named is exactly the auxiliary
 requested and retained by production Ix positivity/flat-block construction.
 
 The certificate keeps both representations visible: candidate syntax first
-identifies `Box Tree`, the Lean4Lean eliminator's reverse map identifies the
+identifies `Box Tree`, the Ix.Theory.Named eliminator's reverse map identifies the
 fresh target with that source, and the Ix request/header/key facts identify
 the physical flat member with the same specialization. -/
 structure NestedAuxiliaryCandidateTarget : Prop where
@@ -347,9 +347,9 @@ structure NestedAuxiliaryCandidateTarget : Prop where
     leanAuxiliarySource? leanAuxiliaryName = some leanNestedDomain
   outerRewrite : leanFlatNode.type =
     .forallE `value leanAuxiliaryExpr leanTreeExpr .default
-  occurs : Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts
+  occurs : Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts
     leanAuxiliaryExpr = true
-  valid : Lean4Lean.AddInductive.isValidIndApp? leanFlatStats
+  valid : Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats
     leanAuxiliaryExpr = some 1
 
 /-- The concrete nested fixture closes every field of the cross-representation
@@ -370,4 +370,4 @@ theorem nestedAuxiliaryCandidateTarget : NestedAuxiliaryCandidateTarget := by
     occurs := leanAuxiliaryOccurs
     valid := leanAuxiliaryTarget }
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedConstructorValidation.lean b/Ix/Kernel/Verify/Inductive/NestedConstructorValidation.lean
similarity index 78%
rename from Ix/Tc/Verify/Inductive/NestedConstructorValidation.lean
rename to Ix/Kernel/Verify/Inductive/NestedConstructorValidation.lean
index 64737cc85..56e4104ea 100644
--- a/Ix/Tc/Verify/Inductive/NestedConstructorValidation.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedConstructorValidation.lean
@@ -1,33 +1,33 @@
-import Ix.Tc.Verify.Inductive.NestedAuxiliaryPositivity
+import Ix.Kernel.Verify.Inductive.NestedAuxiliaryPositivity
 
 /-!
 # Constructor validation for the flattened nested fixture
 
 This module places both production-derived positivity traces into
-Lean4Lean's exact constructor validator.  The outer `Tree.node` field uses the
+Ix.Theory.Named's exact constructor validator.  The outer `Tree.node` field uses the
 nested-production transport, while the generated `Box.wrap` field uses the
 retained copied-constructor traversal.  Both are checked in the same
 two-family environment produced by the real nested eliminator.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 private abbrev NodeValidationTrace
-    (context : Lean4Lean.AddInductive.Context) (source : Lean.Expr)
+    (context : Ix.Theory.Named.AddInductive.Context) (source : Lean.Expr)
     (argIdx fuel : Nat) :=
-  Lean4Lean.AddInductive.ConstructorTypeValidationTrace leanFlatStats false
+  Ix.Theory.Named.AddInductive.ConstructorTypeValidationTrace leanFlatStats false
     0 leanFlatNode.name context source argIdx fuel
 
 private abbrev WrapValidationTrace
-    (context : Lean4Lean.AddInductive.Context) (source : Lean.Expr)
+    (context : Ix.Theory.Named.AddInductive.Context) (source : Lean.Expr)
     (argIdx fuel : Nat) :=
-  Lean4Lean.AddInductive.ConstructorTypeValidationTrace leanFlatStats false
+  Ix.Theory.Named.AddInductive.ConstructorTypeValidationTrace leanFlatStats false
     1 leanFlatWrap.name context source argIdx fuel
 
-def leanFlatNodeFieldContext : Lean4Lean.AddInductive.Context :=
+def leanFlatNodeFieldContext : Ix.Theory.Named.AddInductive.Context :=
   leanFlatConstructorContext.pushLocalDecl `value .default leanAuxiliaryExpr
 
-def leanFlatWrapFieldContext : Lean4Lean.AddInductive.Context :=
+def leanFlatWrapFieldContext : Ix.Theory.Named.AddInductive.Context :=
   leanFlatConstructorContext.pushLocalDecl leanFlatWrapBinderName .default
     leanTreeExpr
 
@@ -35,71 +35,71 @@ def leanFlatWrapFieldContext : Lean4Lean.AddInductive.Context :=
 
 private theorem leanAuxiliaryEnsureTypeNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run leanFlatConstructorContext.env
+      (Ix.Theory.Named.TypeChecker.M.run leanFlatConstructorContext.env
         leanFlatConstructorContext.safety leanFlatConstructorContext.lctx
         leanFlatConstructorContext.lparams leanFlatConstructorContext.fuel
-        (Lean4Lean.TypeChecker.ensureType leanAuxiliaryExpr))
+        (Ix.Theory.Named.TypeChecker.ensureType leanAuxiliaryExpr))
       (.sort (.succ .zero)) = true := by
   native_decide
 
 private theorem leanAuxiliaryEnsureType :
-    Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+    Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
       ⟨leanFlatConstructorContext, leanAuxiliaryExpr,
         .sort (.succ .zero)⟩ := by
-  unfold Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+  unfold Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     leanAuxiliaryEnsureTypeNative
 
 private theorem leanTreeEnsureTypeNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run leanFlatConstructorContext.env
+      (Ix.Theory.Named.TypeChecker.M.run leanFlatConstructorContext.env
         leanFlatConstructorContext.safety leanFlatConstructorContext.lctx
         leanFlatConstructorContext.lparams leanFlatConstructorContext.fuel
-        (Lean4Lean.TypeChecker.ensureType leanTreeExpr))
+        (Ix.Theory.Named.TypeChecker.ensureType leanTreeExpr))
       (.sort (.succ .zero)) = true := by
   native_decide
 
 private theorem leanTreeEnsureType :
-    Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+    Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
       ⟨leanFlatConstructorContext, leanTreeExpr,
         .sort (.succ .zero)⟩ := by
-  unfold Lean4Lean.AddInductive.ConstructorEnsureTypeStep.Valid
+  unfold Ix.Theory.Named.AddInductive.ConstructorEnsureTypeStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check leanTreeEnsureTypeNative
 
 private theorem leanFlatFieldUniverse :
-    Lean4Lean.AddInductive.levelStructGe leanFlatStats.resultLevel
+    Ix.Theory.Named.AddInductive.levelStructGe leanFlatStats.resultLevel
       (.succ .zero) = true := by
   native_decide
 
 private theorem leanTreeTerminalNative :
-    Lean4Lean.AddInductive.isValidIndAppIdx leanFlatStats leanTreeExpr 0 =
+    Ix.Theory.Named.AddInductive.isValidIndAppIdx leanFlatStats leanTreeExpr 0 =
       true := by
   native_decide
 
 private theorem leanAuxiliaryTerminalNative :
-    Lean4Lean.AddInductive.isValidIndAppIdx leanFlatStats
+    Ix.Theory.Named.AddInductive.isValidIndAppIdx leanFlatStats
       leanAuxiliaryExpr 1 = true := by
   native_decide
 
 private theorem consumeLeanAuxiliaryNative :
     ExactLeanSyntax.exprCheck
-      (Lean4Lean.AddInductive.consumeTypeAnnotations leanAuxiliaryExpr)
+      (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanAuxiliaryExpr)
       leanAuxiliaryExpr = true := by
   native_decide
 
 private theorem consumeLeanAuxiliary :
-    Lean4Lean.AddInductive.consumeTypeAnnotations leanAuxiliaryExpr =
+    Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanAuxiliaryExpr =
       leanAuxiliaryExpr :=
   ExactLeanSyntax.expr_eq_of_check consumeLeanAuxiliaryNative
 
 private theorem consumeLeanTreeNative :
     ExactLeanSyntax.exprCheck
-      (Lean4Lean.AddInductive.consumeTypeAnnotations leanTreeExpr)
+      (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanTreeExpr)
       leanTreeExpr = true := by
   native_decide
 
 private theorem consumeLeanTree :
-    Lean4Lean.AddInductive.consumeTypeAnnotations leanTreeExpr =
+    Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanTreeExpr =
       leanTreeExpr :=
   ExactLeanSyntax.expr_eq_of_check consumeLeanTreeNative
 
@@ -160,10 +160,10 @@ theorem leanFlatNodeConstructorTypeValidationTrace :
   rw [consumeLeanAuxiliary, instantiateLeanTree]
   simpa [leanFlatNodeFieldContext, positivityFuel] using terminalTrace
 
-/-- The assembled outer trace replays Lean4Lean's public constructor
+/-- The assembled outer trace replays Ix.Theory.Named's public constructor
 validator. -/
 theorem leanFlatNodeConstructorValidationRun :
-    Lean4Lean.AddInductive.checkConstructorType leanFlatStats false 0
+    Ix.Theory.Named.AddInductive.checkConstructorType leanFlatStats false 0
       leanFlatNode.name leanFlatNode.type leanFlatConstructorContext =
         .ok () := by
   obtain ⟨trace⟩ := leanFlatNodeConstructorTypeValidationTrace
@@ -206,10 +206,10 @@ theorem leanFlatWrapConstructorTypeValidationTrace :
 /-- The generated auxiliary also passes the public constructor validator from
 the production-derived positivity evidence. -/
 theorem leanFlatWrapConstructorValidationRun :
-    Lean4Lean.AddInductive.checkConstructorType leanFlatStats false 1
+    Ix.Theory.Named.AddInductive.checkConstructorType leanFlatStats false 1
       leanFlatWrap.name leanFlatWrap.type leanFlatConstructorContext =
         .ok () := by
   obtain ⟨trace⟩ := leanFlatWrapConstructorTypeValidationTrace
   exact trace.check_run
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedPositivityTransport.lean b/Ix/Kernel/Verify/Inductive/NestedPositivityTransport.lean
similarity index 84%
rename from Ix/Tc/Verify/Inductive/NestedPositivityTransport.lean
rename to Ix/Kernel/Verify/Inductive/NestedPositivityTransport.lean
index 9c64dda7b..4428fe988 100644
--- a/Ix/Tc/Verify/Inductive/NestedPositivityTransport.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedPositivityTransport.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Inductive.NestedCandidateSyntax
+import Ix.Kernel.Verify.Inductive.NestedCandidateSyntax
 
 /-!
 # Transporting the concrete nested positivity branch
 
 This module instantiates `FlattenedPositivityTraceTransport` for the outer
 `Tree.node : Box Tree → Tree` field.  Ix validates the pre-flattening
-`Box Tree` application by recursively traversing `Box.wrap`; Lean4Lean
+`Box Tree` application by recursively traversing `Box.wrap`; Ix.Theory.Named
 validates the post-flattening generated auxiliary as a direct member of the
 two-family mutual block.
 
@@ -15,24 +15,24 @@ complete branch trace and then consumes the audited cross-representation
 target certificate from `NestedCandidateSyntax`.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 /-! ## Exact candidate WHNF -/
 
 private theorem leanAuxiliaryCandidateWhnfNative :
     ExactLeanSyntax.exceptExprCheck
-      (Lean4Lean.TypeChecker.M.run leanFlatConstructorContext.env
+      (Ix.Theory.Named.TypeChecker.M.run leanFlatConstructorContext.env
         leanFlatConstructorContext.safety leanFlatConstructorContext.lctx
         leanFlatConstructorContext.lparams leanFlatConstructorContext.fuel
-        (Lean4Lean.TypeChecker.whnf leanAuxiliaryExpr))
+        (Ix.Theory.Named.TypeChecker.whnf leanAuxiliaryExpr))
       leanAuxiliaryExpr = true := by
   native_decide
 
 theorem leanAuxiliaryCandidateWhnf :
-    Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+    Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
       ⟨leanFlatConstructorContext, leanAuxiliaryExpr,
         leanAuxiliaryExpr⟩ := by
-  unfold Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+  unfold Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
   exact ExactLeanSyntax.exceptExpr_eq_ok_of_check
     leanAuxiliaryCandidateWhnfNative
 
@@ -52,7 +52,7 @@ private theorem nestedResultSpineNative :
 /-! ## Exact operation relations -/
 
 inductive NestedOuterPositivitySourceRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | domain : NestedOuterPositivitySourceRel checkerInitial
       leanFlatConstructorContext nestedDomain leanAuxiliaryExpr
@@ -62,7 +62,7 @@ is the fresh auxiliary produced for that exact application.  The explicit
 shape equality makes impossible result forms eliminable without assuming an
 injective address/content correspondence. -/
 inductive NestedOuterPositivityResultRel :
-    TcState .anon → Lean4Lean.AddInductive.Context →
+    TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop
   | domain {ixResult : KExpr .anon}
       (shape : ixResult = nestedDomain) :
@@ -71,15 +71,15 @@ inductive NestedOuterPositivityResultRel :
 
 private theorem nestedOuterRootFree
     {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource : KExpr .anon} {leanSource : Lean.Expr}
     (relation : NestedOuterPositivitySourceRel ixState leanContext ixSource
       leanSource)
     (free : exprMentionsAnyAddr ixSource #[treeId.addr] = false) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
         false := by
   cases relation
   rw [nestedDomainMentionsRootNative] at free
@@ -87,7 +87,7 @@ private theorem nestedOuterRootFree
 
 private theorem nestedOuterWhnf
     {ixBefore ixAfter : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixSource ixResult : KExpr .anon} {leanSource : Lean.Expr}
     (relation : NestedOuterPositivitySourceRel ixBefore leanContext ixSource
       leanSource)
@@ -95,7 +95,7 @@ private theorem nestedOuterWhnf
     (run : (RecM.whnf ixSource).run checkerMethods ixBefore =
       .ok ixResult ixAfter) :
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
       NestedOuterPositivityResultRel ixAfter leanContext ixResult
         leanResult := by
@@ -109,13 +109,13 @@ private theorem nestedOuterMentions
     (relation : NestedOuterPositivitySourceRel ixState leanContext ixExpr
       leanExpr) :
     exprMentionsAnyAddr ixExpr #[treeId.addr] =
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanExpr := by
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanExpr := by
   cases relation
   rw [nestedDomainMentionsRootNative, leanAuxiliaryOccurs]
 
 private theorem nestedOuterForall
     {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixName : Mode.anon.F Name} {ixBinder : Mode.anon.F Lean.BinderInfo}
     {ixDomain ixBody : KExpr .anon} {ixInfo : ExprInfo .anon}
     {leanExpr : Lean.Expr}
@@ -131,7 +131,7 @@ private theorem nestedOuterForall
           .ok (ixOpen, ixFVar) ixAfterOpen →
         NestedOuterPositivitySourceRel ixAfterOpen
           (leanContext.pushLocalDecl leanName leanBinder
-            (Lean4Lean.AddInductive.consumeTypeAnnotations leanDomain))
+            (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanDomain))
           ixOpen (leanBody.instantiate1 leanContext.freshExpr) := by
   cases relation with
   | domain shape => cases shape
@@ -174,7 +174,7 @@ theorem nestedTraceProducesCanonicalRequest
 
 private theorem nestedOuterDirect
     {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixResult : KExpr .anon} {leanResult : Lean.Expr}
     {id : KId .anon} {us : Array (KUniv .anon)} {info : ExprInfo .anon}
     {args : Array (KExpr .anon)}
@@ -187,10 +187,10 @@ private theorem nestedOuterDirect
     (_valid : ValidPositiveRecursiveApplication id us args traceGroups
       #[treeId.addr] checkerMethods ixState final) :
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
           true ∧
         leanResult.isForall = false ∧
-        Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanResult =
+        Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanResult =
           some targetIdx := by
   cases relation with
   | domain shape =>
@@ -201,7 +201,7 @@ private theorem nestedOuterDirect
 
 private theorem nestedOuterNested
     {fuel : Nat} {ixState : TcState .anon}
-    {leanContext : Lean4Lean.AddInductive.Context}
+    {leanContext : Ix.Theory.Named.AddInductive.Context}
     {ixResult : KExpr .anon} {leanResult : Lean.Expr}
     {id : KId .anon} {us : Array (KUniv .anon)} {info : ExprInfo .anon}
     {args : Array (KExpr .anon)}
@@ -214,10 +214,10 @@ private theorem nestedOuterNested
     (trace : CompleteNestedPositivityApplicationTrace fuel id us args
       traceGroups #[treeId.addr] traceActive checkerMethods ixState final) :
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
+      Ix.Theory.Named.AddInductive.hasIndOcc leanFlatStats.indConsts leanResult =
           true ∧
         leanResult.isForall = false ∧
-        Lean4Lean.AddInductive.isValidIndApp? leanFlatStats leanResult =
+        Ix.Theory.Named.AddInductive.isValidIndApp? leanFlatStats leanResult =
           some targetIdx := by
   cases relation with
   | domain shape =>
@@ -229,7 +229,7 @@ private theorem nestedOuterNested
 
 /-- Complete operation-shaped transport for the outer nested field.  The
 `nested` field is discharged from the exact producer request/flat target
-certificate; it is not a preconstructed Lean4Lean trace. -/
+certificate; it is not a preconstructed Ix.Theory.Named trace. -/
 theorem nestedOuterPositivityTransport :
     FlattenedPositivityTraceTransport leanFlatStats #[treeId.addr]
       checkerMethods NestedOuterPositivitySourceRel
@@ -249,13 +249,13 @@ def nestedOuterProductionTrace : PositivityDomainTrace groups
   RecM.checkPositivityDomainFuel_success checkerMethods positivityRun
 
 /-- The actual nested production execution constructs the exact retained
-Lean4Lean positivity trace for the flattened outer constructor field. -/
+Ix.Theory.Named positivity trace for the flattened outer constructor field. -/
 theorem nestedOuterConstructorPositivityTrace :
-    Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace leanFlatStats
+    Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace leanFlatStats
       leanFlatNode.name 0 leanFlatConstructorContext leanAuxiliaryExpr
         positivityFuel) := by
   exact FlattenedPositivityTraceTransport.constructorPositivityTrace
     nestedOuterPositivityTransport nestedOuterProductionTrace (by rfl)
       .domain
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedPositivityTraversal.lean b/Ix/Kernel/Verify/Inductive/NestedPositivityTraversal.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/NestedPositivityTraversal.lean
rename to Ix/Kernel/Verify/Inductive/NestedPositivityTraversal.lean
index 46a3b46ca..705e51286 100644
--- a/Ix/Tc/Verify/Inductive/NestedPositivityTraversal.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedPositivityTraversal.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.PositivityTraversal
-import Ix.Tc.Verify.Inductive.SpecializationIdentity
+import Ix.Kernel.Verify.Inductive.PositivityTraversal
+import Ix.Kernel.Verify.Inductive.SpecializationIdentity
 
 /-!
 # Nested-family positivity traversal
@@ -15,7 +15,7 @@ the exact loaded inductive header and continues from the real post-lookup
 checker state with the header's concrete arities, block, and constructor list.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Header information read from an external family reached by nested
 positivity traversal. -/
@@ -953,4 +953,4 @@ theorem checkNestedPositivityApplicationFuel_complete
       (checkNestedPositivityApplicationResolvedFuel_success hresolved)⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/NestedRecursiveFixture.lean b/Ix/Kernel/Verify/Inductive/NestedRecursiveFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/NestedRecursiveFixture.lean
rename to Ix/Kernel/Verify/Inductive/NestedRecursiveFixture.lean
index 38b21bf6d..65551c631 100644
--- a/Ix/Tc/Verify/Inductive/NestedRecursiveFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedRecursiveFixture.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.NestedAuxiliaryExpansion
-import Ix.Tc.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.NestedAuxiliaryExpansion
+import Ix.Kernel.Verify.Ingress.AnonStructural
 
 /-!
 # Concrete nested-recursive reachability fixture
@@ -17,7 +17,7 @@ certificate identifies the request extracted from positivity with the exact
 auxiliary member retained by the public builder.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 open InductiveConcreteFixture
 
@@ -571,4 +571,4 @@ theorem nestedAuxiliaryReachability :
     exact ⟨member, by simpa using member_mem, by simp [aux, key_eq]⟩
   simpa using keyList
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedRecursorAdmission.lean b/Ix/Kernel/Verify/Inductive/NestedRecursorAdmission.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/NestedRecursorAdmission.lean
rename to Ix/Kernel/Verify/Inductive/NestedRecursorAdmission.lean
index dae66ce31..e222af38f 100644
--- a/Ix/Tc/Verify/Inductive/NestedRecursorAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedRecursorAdmission.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Inductive.NestedRecursorSoundness
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.NestedRecursorSoundness
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Atomic admission of the nested family and both restored recursors
 
 The aux-aware compiler stores the source `LeanTree` block and a distinct
-two-member recursor block.  Lean4Lean's nested transaction installs the
+two-member recursor block.  Ix.Theory.Named's nested transaction installs the
 source family, constructor, both restored recursors, and both equations in
 one semantic step.  This module reconciles those shapes as two exact physical
 admissions: the source block advances the Theory environment, then the
@@ -13,9 +13,9 @@ already-installed recursor block is admitted with its two concrete iota
 patterns.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
-open Lean4Lean
+open Ix.Theory.Named
 open InductiveConcreteFixture
 
 local instance nestedRecursorAdmissionAddressDecidableEq :
@@ -623,4 +623,4 @@ theorem nestedRecursorAtomicClosure : NestedRecursorAtomicClosure where
   familyAccepted := nestedOneFamilyAtomicClosure.familyAccepted
   recursorAccepted := nestedOneFamilyAtomicClosure.recursorAccepted
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedRecursorFixture.lean b/Ix/Kernel/Verify/Inductive/NestedRecursorFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/NestedRecursorFixture.lean
rename to Ix/Kernel/Verify/Inductive/NestedRecursorFixture.lean
index d7bee2a58..7c7e904ec 100644
--- a/Ix/Tc/Verify/Inductive/NestedRecursorFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedRecursorFixture.lean
@@ -1,5 +1,5 @@
 import Ix.CompileDriver
-import Ix.Tc.Verify.Inductive.NestedAdmission
+import Ix.Kernel.Verify.Inductive.NestedAdmission
 
 /-!
 # Production nested-recursion block for `LeanTree`
@@ -12,7 +12,7 @@ compiled source projections back to the already checked physical families;
 the recursor block is then ingressed and checked after that family block.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 open InductiveConcreteFixture
 
@@ -299,4 +299,4 @@ theorem nestedRecursorKernelRun :
   generalize houtcome : nestedRecursorKernelOutcome = outcome at success ⊢
   cases outcome <;> simp_all [nestedRecursorKernelOutcome]
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedRecursorPattern.lean b/Ix/Kernel/Verify/Inductive/NestedRecursorPattern.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/NestedRecursorPattern.lean
rename to Ix/Kernel/Verify/Inductive/NestedRecursorPattern.lean
index 8ea13cd7e..6cd2ceb2b 100644
--- a/Ix/Tc/Verify/Inductive/NestedRecursorPattern.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedRecursorPattern.lean
@@ -1,20 +1,22 @@
-import Ix.Tc.Verify.Inductive.IotaPattern
-import Ix.Tc.Verify.Inductive.NestedRecursorFixture
+import Ix.Kernel.Verify.Inductive.IotaPattern
+import Ix.Kernel.Verify.Inductive.NestedRecursorFixture
+
+open Ix.Theory (VLevel)
 
 /-!
 # Physical restored-recursion patterns for `LeanTree`
 
 The aux-aware compiler emits one physical recursor for the stored `LeanTree`
-family and one for the flattened `LeanBox LeanTree` dependency.  Lean4Lean's
+family and one for the flattened `LeanBox LeanTree` dependency.  Ix.Theory.Named's
 nested transaction restores those declarations as `LeanTree.rec` and
 `LeanTree.rec_1`, with one registered equation apiece.  This module proves the
 complete representation correspondence and constructs the exact two iota
 patterns consumed by semantic admission.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
-open Lean4Lean
+open Ix.Theory.Named
 open InductiveConcreteFixture
 
 local instance nestedPatternAddressDecidableEq : DecidableEq Address :=
@@ -592,4 +594,4 @@ structure NestedRestoredPatternSound : Prop where
   node : treeNodePattern.Sound semanticTreeEnv
   wrap : treeWrapPattern.Sound semanticTreeEnv
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedRecursorSoundness.lean b/Ix/Kernel/Verify/Inductive/NestedRecursorSoundness.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/NestedRecursorSoundness.lean
rename to Ix/Kernel/Verify/Inductive/NestedRecursorSoundness.lean
index 38b65e320..8eb2198b5 100644
--- a/Ix/Tc/Verify/Inductive/NestedRecursorSoundness.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedRecursorSoundness.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.NestedRecursorPattern
+import Ix.Kernel.Verify.Inductive.NestedRecursorPattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Soundness of the two restored nested iota equations
@@ -11,9 +13,9 @@ single pattern check to identify the physical `LeanBox` parameter with the
 restored specialization `LeanTree`.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
-open Lean4Lean
+open Ix.Theory.Named
 
 /-! ## Shared concrete telescope shapes -/
 
@@ -287,7 +289,7 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -308,7 +310,7 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, constructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -337,7 +339,7 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
 
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``LeanTree.rec [u]) (semanticTreeRec.type.instL [u]) := by
-    simpa using (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    simpa using (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity)
   have hrecursorCommonType : future.HasType uvars Gamma
       (.const ``LeanTree.rec [u])
@@ -360,13 +362,13 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
       (VExpr.appN (semanticTreeNodeRule.lhs.instL [u])
         [motiveTree, motiveBox, nodeMinor, wrapMinor])
       (nodeEquationFieldType u motiveTree motiveBox nodeMinor wrapMinor) :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorApplied
       hrecursorCommonType hequationLhsCommonType
 
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``LeanTree.node []) nodeConstructorFieldType := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedConstructorLookup constructorLevelsWF
         hconstructorLevelsArity
     rw [nodeConstructorTypeInstLNil] at htyped
@@ -404,7 +406,7 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
     rw [nodeFieldBindersEq]
     rfl
   have hequationLhsFieldsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hfieldLength hconstructorApplied
       hconstructorFieldHead' hequationFieldHead
   have hequationLhsApplied : future.HasType uvars Gamma
@@ -419,7 +421,7 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
       VExpr.appN_append]
     exact hequationLhsFieldsApplied
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
 
   have hequationLhsApplied' := hequationLhsApplied
@@ -429,7 +431,7 @@ theorem treeNodePatternSound : treeNodePattern.Sound semanticTreeEnv := by
         (nodeRuleBinders.map (VExpr.instL [u])).length := by
     simpa only [List.length_cons, List.length_nil, List.length_map] using
       nodeRuleBindersLength.symm
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleArgsLength hequationLhsApplied'
   rw [nodeLhsBodyOpen] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -511,7 +513,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -532,7 +534,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, constructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -555,11 +557,11 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``LeanTree.rec_1 [u])
       (semanticTreeRecOne.type.instL [u]) := by
-    simpa using (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    simpa using (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity)
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``LeanBox.wrap []) semanticBoxWrap.type := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedConstructorLookup constructorLevelsWF
         hconstructorLevelsArity
     rw [wrapConstructorTypeInstLNil] at htyped
@@ -575,12 +577,12 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
         ([constructorAlpha] ++ [field])) majorDomain := by
     simpa using hconstructorApplied
   obtain ⟨constructorParameterResult, hconstructorParameterApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [constructorAlpha]) (suffixArgs := [field])
       hconstructorAppliedSplit
   have hconstructorAlpha : future.HasType uvars Gamma constructorAlpha
       (.sort (.succ .zero)) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hconstructorParameterApplied hconstructorParameterHead
   have hparameterAtConstructor : future.IsDefEq uvars Gamma
       constructorAlpha (.const ``LeanTree []) (.sort (.succ .zero)) :=
@@ -606,7 +608,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
       (VExpr.appN (.const ``LeanBox.wrap [])
         [.const ``LeanTree [], field]) := by
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma
+      (Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma
         hconstructorPrefixEqTyped hconstructorAppliedFromPrefix)
   have hconstructorEqTyped : future.IsDefEq uvars Gamma
       (VExpr.appN (.const ``LeanBox.wrap []) [constructorAlpha, field])
@@ -653,7 +655,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
       (VExpr.appN (semanticTreeWrapRule.lhs.instL [u])
         [motiveTree, motiveBox, nodeMinor, wrapMinor])
       (wrapEquationFieldType u motiveTree motiveBox nodeMinor wrapMinor) :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorApplied
       hrecursorCommonType hequationLhsCommonType
 
@@ -661,14 +663,14 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
     hfuture.constants semanticTreeTransactionFacts.sourceFamily
   have htreeConstantTyped : future.HasType uvars Gamma
       (.const ``LeanTree []) (.sort (.succ .zero)) := by
-    have htyped := Lean4Lean.VEnv.HasType.const (U := uvars)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (U := uvars)
       (Γ := Gamma) (ls := []) hcertifiedTreeLookup (by simp) (by rfl)
     rw [treeFamilyTypeInstLNil, treeFamilyTypeShape] at htyped
     exact htyped
   have hcanonicalConstructorPrefix : future.HasType uvars Gamma
       (.app (.const ``LeanBox.wrap []) (.const ``LeanTree []))
       wrapConstructorFieldType := by
-    have happ := Lean4Lean.VEnv.HasType.app
+    have happ := Ix.Theory.Named.VEnv.HasType.app
       hconstructorParameterHead htreeConstantTyped
     change future.HasType uvars Gamma
       (.app (.const ``LeanBox.wrap []) (.const ``LeanTree []))
@@ -715,7 +717,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
     rw [wrapFieldBindersEq]
     rfl
   have hequationLhsFieldsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hfieldLength hcanonicalConstructorApplied
       hconstructorFieldHead' hequationFieldHead
   have hequationLhsApplied : future.HasType uvars Gamma
@@ -730,7 +732,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
       VExpr.appN_append]
     exact hequationLhsFieldsApplied
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
 
   have hequationLhsApplied' := hequationLhsApplied
@@ -740,7 +742,7 @@ theorem treeWrapPatternSound : treeWrapPattern.Sound semanticTreeEnv := by
         (wrapRuleBinders.map (VExpr.instL [u])).length := by
     simpa only [List.length_cons, List.length_nil, List.length_map] using
       wrapRuleBindersLength.symm
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hruleArgsLength hequationLhsApplied'
   rw [wrapLhsBodyOpen] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -788,4 +790,4 @@ theorem treeWrapPatternRel :
   RawRecursorRulePatternRel.of_metadata_sound treeWrapPatternMetadata
     treeWrapPatternSound
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/NestedSemanticTransaction.lean b/Ix/Kernel/Verify/Inductive/NestedSemanticTransaction.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/NestedSemanticTransaction.lean
rename to Ix/Kernel/Verify/Inductive/NestedSemanticTransaction.lean
index 88b8b96ae..feab1157c 100644
--- a/Ix/Tc/Verify/Inductive/NestedSemanticTransaction.lean
+++ b/Ix/Kernel/Verify/Inductive/NestedSemanticTransaction.lean
@@ -1,13 +1,15 @@
-import Ix.Tc.Verify.Inductive.Certificate
-import Ix.Tc.Verify.Inductive.NestedBlockCertificate
-import Ix.Tc.Verify.Inductive.NestedConstructorValidation
-import Lean4Lean.Verify.Environment.NestedReplay
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Kernel.Verify.Inductive.NestedBlockCertificate
+import Ix.Kernel.Verify.Inductive.NestedConstructorValidation
+import Ix.Theory.Named.Verify.Environment.NestedReplay
+
+open Ix.Theory (VLevel)
 
 /-!
 # Semantic transaction for the concrete nested `LeanBox`/`LeanTree` fixture
 
 The operational fixture has already connected Ix ingress and positivity to
-Lean4Lean's flattened constructor validation.  This module keeps the same
+Ix.Theory.Named's flattened constructor validation.  This module keeps the same
 exact names and builds the missing Theory half:
 
 * a certified dependency transaction for `LeanBox`;
@@ -21,12 +23,12 @@ to Lean's stored nested metadata, so they cannot be substituted for semantic
 or physical correspondence evidence.
 -/
 
-namespace Ix.Tc.NestedRecursiveFixture
+namespace Ix.Kernel.NestedRecursiveFixture
 
 open Lean
-open Lean4Lean
-open Lean4Lean.InductiveReplayFixtures
-open Lean4Lean.NestedRepresentation
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveReplayFixtures
+open Ix.Theory.Named.NestedRepresentation
 open VInductDecl
 
 local instance : Inhabited VEnv := ⟨.empty⟩
@@ -520,4 +522,4 @@ theorem semanticTreeTransactionFacts : SemanticTreeTransactionFacts := by
     rw [semanticTreeRules_eq]
     simp [semanticTreeRules]
 
-end Ix.Tc.NestedRecursiveFixture
+end Ix.Kernel.NestedRecursiveFixture
diff --git a/Ix/Tc/Verify/Inductive/OccurrenceClosure.lean b/Ix/Kernel/Verify/Inductive/OccurrenceClosure.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/OccurrenceClosure.lean
rename to Ix/Kernel/Verify/Inductive/OccurrenceClosure.lean
index 2c4f3dec5..d66f5f8fb 100644
--- a/Ix/Tc/Verify/Inductive/OccurrenceClosure.lean
+++ b/Ix/Kernel/Verify/Inductive/OccurrenceClosure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.OccurrenceValidation
-import Ix.Tc.Verify.RecursiveMethods.ScopedCallDomains
+import Ix.Kernel.Verify.Inductive.OccurrenceValidation
+import Ix.Kernel.Verify.RecursiveMethods.ScopedCallDomains
 
 /-!
 # Run-scoped recursive-occurrence closure
@@ -16,7 +16,7 @@ finite `Methods.ScopedCallScheduleAt` and preserves the scoped suffix-state
 witness on every intermediate checker state.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact finite method-call footprint of one parameter-comparison slice. -/
 def PositiveParameterCallPlan (calls : Methods.CallDomain)
@@ -113,4 +113,4 @@ theorem theoryParametersScoped
 
 end RecM.ValidPositiveRecursiveApplicationHeader
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/OccurrenceValidation.lean b/Ix/Kernel/Verify/Inductive/OccurrenceValidation.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/OccurrenceValidation.lean
rename to Ix/Kernel/Verify/Inductive/OccurrenceValidation.lean
index d05995579..2751b612c 100644
--- a/Ix/Tc/Verify/Inductive/OccurrenceValidation.lean
+++ b/Ix/Kernel/Verify/Inductive/OccurrenceValidation.lean
@@ -1,8 +1,8 @@
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.Support
-import Ix.Tc.Verify.Totalization
-import Ix.Tc.Verify.Trans
-import Ix.Tc.Verify.World
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.Support
+import Ix.Kernel.Verify.Totalization
+import Ix.Kernel.Verify.Trans
+import Ix.Kernel.Verify.World
 
 /-!
 # Recursive-occurrence validation
@@ -14,7 +14,7 @@ guard, and the complete state-threaded parameter-definitional-equality loop.
 No semantic inductive oracle is used here.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Header information read from the actual recursive-family declaration. -/
 def KConst.PositiveRecursiveHeader (concrete : KConst m)
@@ -38,7 +38,7 @@ def PositiveUniverseSpecialization (group : PositivityGroup m)
       ∀ i, i < us.size →
         univEq us[i]! (.mkParam i.toUInt64 RecM.anonN : KUniv m) = true
 
-/-- Elementwise form of Lean4Lean's root-family-free index condition. -/
+/-- Elementwise form of Ix.Theory.Named's root-family-free index condition. -/
 def RootIndicesIndependent (args : Array (KExpr m)) (nParams : Nat)
     (rootAddrs : Array Address) : Prop :=
   let indices := args.extract nParams args.size
@@ -109,7 +109,7 @@ def PositiveParameterDefEqContract
     (uvars : Nat) (Delta : KVLCtx) (methods : Methods .anon)
     (invariant : TcState .anon → Prop) : Prop :=
   ∀ {state : TcState .anon} {argument parameter : KExpr .anon}
-      {argumentV parameterV : Lean4Lean.VExpr},
+      {argumentV parameterV : Ix.Theory.Named.VExpr},
     support argument → support parameter →
     TrKExprS world.venv uvars world.nameOf trProj Delta argument
       argumentV →
@@ -375,7 +375,7 @@ theorem ValidPositiveRecursiveApplicationHeader.theoryParameters
   rcases valid with
     ⟨_, _, _, _, afterParameters, _, trace, _, hfinal⟩
   have hsemantic :=
-    Ix.Tc.RecM.PositiveParameterComparisonTrace.theoryDefEq defEq trace
+    Ix.Kernel.RecM.PositiveParameterComparisonTrace.theoryDefEq defEq trace
       hinitial plan
   exact ⟨afterParameters, hsemantic.1, hsemantic.2, hfinal⟩
 
@@ -618,4 +618,4 @@ theorem ValidPositiveRecursiveApplication.run
   | ctor => contradiction
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/OneFamilyAdmission.lean b/Ix/Kernel/Verify/Inductive/OneFamilyAdmission.lean
similarity index 90%
rename from Ix/Tc/Verify/Inductive/OneFamilyAdmission.lean
rename to Ix/Kernel/Verify/Inductive/OneFamilyAdmission.lean
index 0a5a7a039..c51745e5f 100644
--- a/Ix/Tc/Verify/Inductive/OneFamilyAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/OneFamilyAdmission.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Check.BlockAcceptance
+import Ix.Kernel.Verify.Check.BlockAcceptance
 
 /-!
 # Oracle-free one-family generated-recursor admission
 
-Lean4Lean's current public generation certificate covers one inductive family
+Ix.Theory.Named's current public generation certificate covers one inductive family
 at a time. Such a transaction has two distinct physical Ix blocks:
 
 * the family/constructor block advances the certified Theory environment; and
@@ -15,7 +15,7 @@ environment, constructing an `InductiveOracle`, or pretending that a mutual
 declaration is a sequence of singleton declarations.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Complete semantic evidence for the two physical blocks generated by one
 certified inductive family. Freshness of the recursor is stated in the
@@ -25,7 +25,7 @@ structure OneFamilyRecursorCertificate (trProj : RawProjRel)
     (world : VerifyWorld)
     (familyBlock : KId .anon) (familyMembers : Array (KId .anon))
     (recursorBlock : KId .anon) (recursorMembers : Array (KId .anon))
-    (afterVEnv : Lean4Lean.VEnv) : Prop where
+    (afterVEnv : Ix.Theory.Named.VEnv) : Prop where
   family :
     SemanticBlockTransitionCertificate trProj world familyBlock familyMembers
       .inductive' afterVEnv
@@ -39,7 +39,7 @@ namespace OneFamilyRecursorCertificate
 def familyWorld {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) : VerifyWorld :=
   certificate.family.admittedWorld
@@ -49,7 +49,7 @@ admitted. -/
 def admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) : VerifyWorld :=
   certificate.recursor.admittedWorld
@@ -58,7 +58,7 @@ def admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
 theorem familyAdmission {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv)
     (trusted : TrustedCatalogRel trProj world) :
@@ -71,7 +71,7 @@ stage and admits only semantic entries already present in `afterVEnv`. -/
 theorem recursorAdmission {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv)
     (trusted : TrustedCatalogRel trProj world) :
@@ -84,7 +84,7 @@ theorem recursorAdmission {trProj : RawProjRel} {world : VerifyWorld}
 theorem le_admittedWorld {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) :
     world ≤ certificate.admittedWorld :=
@@ -96,7 +96,7 @@ by the family members and the original trusted set. -/
 theorem trusted_iff {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv)
     (id : KId .anon) :
@@ -107,7 +107,7 @@ theorem trusted_iff {trProj : RawProjRel} {world : VerifyWorld}
 @[simp] theorem admittedWorld_venv {trProj : RawProjRel}
     {world : VerifyWorld} {familyBlock : KId .anon}
     {familyMembers : Array (KId .anon)} {recursorBlock : KId .anon}
-    {recursorMembers : Array (KId .anon)} {afterVEnv : Lean4Lean.VEnv}
+    {recursorMembers : Array (KId .anon)} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) :
     certificate.admittedWorld.venv = afterVEnv :=
@@ -116,7 +116,7 @@ theorem trusted_iff {trProj : RawProjRel} {world : VerifyWorld}
 @[simp] theorem admittedWorld_catalog {trProj : RawProjRel}
     {world : VerifyWorld} {familyBlock : KId .anon}
     {familyMembers : Array (KId .anon)} {recursorBlock : KId .anon}
-    {recursorMembers : Array (KId .anon)} {afterVEnv : Lean4Lean.VEnv}
+    {recursorMembers : Array (KId .anon)} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) :
     certificate.admittedWorld.catalog = world.catalog :=
@@ -125,7 +125,7 @@ theorem trusted_iff {trProj : RawProjRel} {world : VerifyWorld}
 @[simp] theorem admittedWorld_blocks {trProj : RawProjRel}
     {world : VerifyWorld} {familyBlock : KId .anon}
     {familyMembers : Array (KId .anon)} {recursorBlock : KId .anon}
-    {recursorMembers : Array (KId .anon)} {afterVEnv : Lean4Lean.VEnv}
+    {recursorMembers : Array (KId .anon)} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) :
     certificate.admittedWorld.blocks = world.blocks :=
@@ -134,7 +134,7 @@ theorem trusted_iff {trProj : RawProjRel} {world : VerifyWorld}
 @[simp] theorem admittedWorld_nameOf {trProj : RawProjRel}
     {world : VerifyWorld} {familyBlock : KId .anon}
     {familyMembers : Array (KId .anon)} {recursorBlock : KId .anon}
-    {recursorMembers : Array (KId .anon)} {afterVEnv : Lean4Lean.VEnv}
+    {recursorMembers : Array (KId .anon)} {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) :
     certificate.admittedWorld.nameOf = world.nameOf :=
@@ -146,7 +146,7 @@ world, not only the two intermediate promotion witnesses. -/
 structure AtomicClosure {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv) : Prop where
   familyAdmission :
@@ -162,7 +162,7 @@ structure AtomicClosure {trProj : RawProjRel} {world : VerifyWorld}
 theorem atomicClosure {trProj : RawProjRel} {world : VerifyWorld}
     {familyBlock : KId .anon} {familyMembers : Array (KId .anon)}
     {recursorBlock : KId .anon} {recursorMembers : Array (KId .anon)}
-    {afterVEnv : Lean4Lean.VEnv}
+    {afterVEnv : Ix.Theory.Named.VEnv}
     (certificate : OneFamilyRecursorCertificate trProj world familyBlock
       familyMembers recursorBlock recursorMembers afterVEnv)
     (trusted : TrustedCatalogRel trProj world) :
@@ -178,4 +178,4 @@ theorem atomicClosure {trProj : RawProjRel} {world : VerifyWorld}
 
 end OneFamilyRecursorCertificate
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/PositivityTraceAdapter.lean b/Ix/Kernel/Verify/Inductive/PositivityTraceAdapter.lean
similarity index 85%
rename from Ix/Tc/Verify/Inductive/PositivityTraceAdapter.lean
rename to Ix/Kernel/Verify/Inductive/PositivityTraceAdapter.lean
index b497aff1e..fb0b62a2c 100644
--- a/Ix/Tc/Verify/Inductive/PositivityTraceAdapter.lean
+++ b/Ix/Kernel/Verify/Inductive/PositivityTraceAdapter.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Inductive.RecursivePositivityTraversal
-import Lean4Lean.Inductive.ValidationTrace
+import Ix.Kernel.Verify.Inductive.RecursivePositivityTraversal
+import Ix.Theory.Named.Reference.Inductive.ValidationTrace
 
 /-!
-# Transporting production positivity into Lean4Lean's retained trace
+# Transporting production positivity into Ix.Theory.Named's retained trace
 
 `PositivityDomainTrace` records the successful Ix execution, while
-Lean4Lean's `ConstructorPositivityTrace` records the corresponding successful
+Ix.Theory.Named's `ConstructorPositivityTrace` records the corresponding successful
 Lean-kernel execution.  These traces cannot be cast into one another: they use
 different expression representations, local contexts, reducers, and state
 models.
@@ -24,7 +24,7 @@ certified flat-block auxiliary expansion rather than supplied through this
 interface.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact successful production positivity traversal for the flat fragment.
 
@@ -97,33 +97,33 @@ end FlatPositivityDomainTrace
 /-- Primitive cross-kernel correspondence needed to transport the flat
 positivity fragment.
 
-`SourceRel` is indexed by the current Ix state and Lean4Lean constructor
+`SourceRel` is indexed by the current Ix state and Ix.Theory.Named constructor
 context so the forall field must relate the *actual* free variable allocated
 by each checker. `ResultRel` separately relates the one WHNF result consumed
 by the branch discriminator. Keeping these phases distinct avoids demanding
 that a post-WHNF cache state be closed under an execution that production
 never performs. The direct field consumes Ix's already-proved logical
-recursive-application invariant; it may not assume the final Lean4Lean trace
+recursive-application invariant; it may not assume the final Ix.Theory.Named trace
 itself. -/
 structure FlatPositivityTraceTransport
-    (stats : Lean4Lean.AddInductive.InductiveStats)
+    (stats : Ix.Theory.Named.AddInductive.InductiveStats)
     (rootAddrs : Array Address) (methods : Methods .anon)
-    (SourceRel ResultRel : TcState .anon → Lean4Lean.AddInductive.Context →
+    (SourceRel ResultRel : TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop) : Prop where
   /-- A syntactically root-free Ix domain has a corresponding successful
-  Lean4Lean WHNF result with no occurrence of the flat block.  Establishing
+  Ix.Theory.Named WHNF result with no occurrence of the flat block.  Establishing
   this field requires the declaration-order/freshness argument that reduction
   of an older constant cannot introduce a newly declared family. -/
   rootFree : ∀ {ixState leanContext ixSource leanSource},
     SourceRel ixState leanContext ixSource leanSource →
     exprMentionsAnyAddr ixSource rootAddrs = false →
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
-      Lean4Lean.AddInductive.hasIndOcc stats.indConsts leanResult = false
+      Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts leanResult = false
 
   /-- One exact successful production WHNF execution on a root-mentioning
-  source corresponds to one exact successful Lean4Lean candidate-WHNF
+  source corresponds to one exact successful Ix.Theory.Named candidate-WHNF
   execution, and their results remain related in the post-Ix state.
 
   Production checks occurrence before entering this branch.  Retaining that
@@ -134,7 +134,7 @@ structure FlatPositivityTraceTransport
     exprMentionsAnyAddr ixSource rootAddrs = true →
     (RecM.whnf ixSource).run methods ixBefore = .ok ixResult ixAfter →
     ∃ leanResult,
-      Lean4Lean.AddInductive.CandidateWhnfStep.Valid
+      Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid
         ⟨leanContext, leanSource, leanResult⟩ ∧
       ResultRel ixAfter leanContext ixResult leanResult
 
@@ -143,11 +143,11 @@ structure FlatPositivityTraceTransport
   mentions : ∀ {ixState leanContext ixExpr leanExpr},
     SourceRel ixState leanContext ixExpr leanExpr →
     exprMentionsAnyAddr ixExpr rootAddrs =
-      Lean4Lean.AddInductive.hasIndOcc stats.indConsts leanExpr
+      Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts leanExpr
 
   /-- A related Ix forall is a Lean forall.  Its domains are related, and the
   two checkers' concrete binder-opening operations produce related bodies in
-  the exact extended Lean4Lean context. -/
+  the exact extended Ix.Theory.Named context. -/
   forallE : ∀ {ixState leanContext ixName ixBinder ixDomain ixBody ixInfo
       leanExpr},
     ResultRel ixState leanContext
@@ -161,11 +161,11 @@ structure FlatPositivityTraceTransport
           .ok (ixOpen, ixFVar) ixAfterOpen →
         SourceRel ixAfterOpen
           (leanContext.pushLocalDecl leanName leanBinder
-            (Lean4Lean.AddInductive.consumeTypeAnnotations leanDomain))
+            (Ix.Theory.Named.AddInductive.consumeTypeAnnotations leanDomain))
           ixOpen (leanBody.instantiate1 leanContext.freshExpr)
 
   /-- A production-validated active-family application becomes a valid flat
-  Lean4Lean target at the same related WHNF node.  Parameter/universe
+  Ix.Theory.Named target at the same related WHNF node.  Parameter/universe
   uniformity and index independence must be discharged from `valid`; they are
   not hidden in a whole-trace premise. -/
   direct : ∀ {ixState leanContext ixResult leanResult id us info args groups
@@ -176,36 +176,36 @@ structure FlatPositivityTraceTransport
     ValidPositiveRecursiveApplication id us args groups rootAddrs methods
       ixState final →
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc stats.indConsts leanResult = true ∧
+      Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts leanResult = true ∧
       leanResult.isForall = false ∧
-      Lean4Lean.AddInductive.isValidIndApp? stats leanResult = some targetIdx
+      Ix.Theory.Named.AddInductive.isValidIndApp? stats leanResult = some targetIdx
 
 namespace FlatPositivityTraceTransport
 
-/-- Assemble Lean4Lean's exact retained positivity trace from a direct-only
+/-- Assemble Ix.Theory.Named's exact retained positivity trace from a direct-only
 successful production trace.
 
 The result is wrapped in `Nonempty` because the Ix execution trace lives in
 `Prop`; this keeps the recursion within propositional elimination while still
-supplying the Type-valued Lean4Lean trace to downstream semantic consumers. -/
+supplying the Type-valued Ix.Theory.Named trace to downstream semantic consumers. -/
 theorem constructorPositivityTrace
-    {stats : Lean4Lean.AddInductive.InductiveStats}
+    {stats : Ix.Theory.Named.AddInductive.InductiveStats}
     {rootAddrs : Array Address} {methods : Methods .anon}
     {SourceRel ResultRel : TcState .anon →
-      Lean4Lean.AddInductive.Context →
+      Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop}
     (transport : FlatPositivityTraceTransport stats rootAddrs methods
       SourceRel ResultRel) :
     ∀ {groups : Array (PositivityGroup .anon)}
       {activeAddrs : Array Address} {fuel : Nat}
       {ixSource : KExpr .anon} {ixInitial ixFinal : TcState .anon}
-      {leanContext : Lean4Lean.AddInductive.Context}
+      {leanContext : Ix.Theory.Named.AddInductive.Context}
       {leanSource : Lean.Expr} {ctor : Lean.Name} {argIdx : Nat}
       (_trace : FlatPositivityDomainTrace groups activeAddrs methods fuel ixSource
         ixInitial ixFinal),
       groups[0]?.map (·.addrs) = some rootAddrs →
       SourceRel ixInitial leanContext ixSource leanSource →
-      Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace stats ctor
+      Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace stats ctor
         argIdx leanContext leanSource fuel)
   | groups, activeAddrs, _, _, _, _, leanContext, leanSource, ctor, argIdx,
       .rootFree (fuel := innerFuel) (rootGroup := rootGroup) root free,
@@ -228,14 +228,14 @@ theorem constructorPositivityTrace
           domainRelated, openRelated⟩ := transport.forallE resultRelated
       subst leanResult
       have leanDomainFree :
-          Lean4Lean.AddInductive.hasIndOcc stats.indConsts leanDomain =
+          Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts leanDomain =
             false := by
         rw [← transport.mentions domainRelated]
         simpa [rootAddrsEq] using domainFree
       have tailRelated := openRelated opening
       obtain ⟨leanTail⟩ := constructorPositivityTrace transport tail
         rootMatches tailRelated
-      cases leanOccurs : Lean4Lean.AddInductive.hasIndOcc stats.indConsts
+      cases leanOccurs : Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts
           (.forallE leanName leanDomain leanBody leanBinder) with
       | false =>
           exact ⟨.absent leanContext leanSource
@@ -277,13 +277,13 @@ remains the theorem below.
 
 Concrete instances must derive this field from an exact auxiliary request,
 its `NestedAuxiliaryHeaderRel`, physical `FlatAuxPresent` evidence, and the
-candidate-level relation identifying that member with the Lean4Lean target.
+candidate-level relation identifying that member with the Ix.Theory.Named target.
 This makes the flat-block correspondence visible at the only control-flow
 point where the two kernels' source syntax differs. -/
 structure FlattenedPositivityTraceTransport
-    (stats : Lean4Lean.AddInductive.InductiveStats)
+    (stats : Ix.Theory.Named.AddInductive.InductiveStats)
     (rootAddrs : Array Address) (methods : Methods .anon)
-    (SourceRel ResultRel : TcState .anon → Lean4Lean.AddInductive.Context →
+    (SourceRel ResultRel : TcState .anon → Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop) : Prop
     extends FlatPositivityTraceTransport stats rootAddrs methods SourceRel
       ResultRel where
@@ -297,37 +297,37 @@ structure FlattenedPositivityTraceTransport
     CompleteNestedPositivityApplicationTrace fuel id us args groups rootAddrs
       activeAddrs methods ixState final →
     ∃ targetIdx,
-      Lean4Lean.AddInductive.hasIndOcc stats.indConsts leanResult = true ∧
+      Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts leanResult = true ∧
       leanResult.isForall = false ∧
-      Lean4Lean.AddInductive.isValidIndApp? stats leanResult = some targetIdx
+      Ix.Theory.Named.AddInductive.isValidIndApp? stats leanResult = some targetIdx
 
 namespace FlattenedPositivityTraceTransport
 
-/-- Assemble Lean4Lean's retained positivity trace from the exhaustive
+/-- Assemble Ix.Theory.Named's retained positivity trace from the exhaustive
 production traversal, including applications eliminated into exact generated
 flat auxiliaries.
 
 As in the direct-only adapter, `Nonempty` keeps elimination of the
-proof-valued Ix trace within `Prop` while exposing Lean4Lean's Type-valued
+proof-valued Ix trace within `Prop` while exposing Ix.Theory.Named's Type-valued
 trace to the enclosing constructor-validation proof. -/
 theorem constructorPositivityTrace
-    {stats : Lean4Lean.AddInductive.InductiveStats}
+    {stats : Ix.Theory.Named.AddInductive.InductiveStats}
     {rootAddrs : Array Address} {methods : Methods .anon}
     {SourceRel ResultRel : TcState .anon →
-      Lean4Lean.AddInductive.Context →
+      Ix.Theory.Named.AddInductive.Context →
       KExpr .anon → Lean.Expr → Prop}
     (transport : FlattenedPositivityTraceTransport stats rootAddrs methods
       SourceRel ResultRel) :
     ∀ {groups : Array (PositivityGroup .anon)}
       {activeAddrs : Array Address} {fuel : Nat}
       {ixSource : KExpr .anon} {ixInitial ixFinal : TcState .anon}
-      {leanContext : Lean4Lean.AddInductive.Context}
+      {leanContext : Ix.Theory.Named.AddInductive.Context}
       {leanSource : Lean.Expr} {ctor : Lean.Name} {argIdx : Nat}
       (_trace : PositivityDomainTrace groups activeAddrs methods fuel ixSource
         ixInitial ixFinal),
       groups[0]?.map (·.addrs) = some rootAddrs →
       SourceRel ixInitial leanContext ixSource leanSource →
-      Nonempty (Lean4Lean.AddInductive.ConstructorPositivityTrace stats ctor
+      Nonempty (Ix.Theory.Named.AddInductive.ConstructorPositivityTrace stats ctor
         argIdx leanContext leanSource fuel)
   | groups, activeAddrs, _, _, _, _, leanContext, leanSource, ctor, argIdx,
       .rootFree (fuel := innerFuel) (rootGroup := rootGroup) root free,
@@ -350,14 +350,14 @@ theorem constructorPositivityTrace
           domainRelated, openRelated⟩ := transport.forallE resultRelated
       subst leanResult
       have leanDomainFree :
-          Lean4Lean.AddInductive.hasIndOcc stats.indConsts leanDomain =
+          Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts leanDomain =
             false := by
         rw [← transport.mentions domainRelated]
         simpa [rootAddrsEq] using domainFree
       have tailRelated := openRelated opening
       obtain ⟨leanTail⟩ := constructorPositivityTrace transport tail
         rootMatches tailRelated
-      cases leanOccurs : Lean4Lean.AddInductive.hasIndOcc stats.indConsts
+      cases leanOccurs : Ix.Theory.Named.AddInductive.hasIndOcc stats.indConsts
           (.forallE leanName leanDomain leanBody leanBinder) with
       | false =>
           exact ⟨.absent leanContext leanSource
@@ -389,4 +389,4 @@ theorem constructorPositivityTrace
 
 end FlattenedPositivityTraceTransport
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/PositivityTraversal.lean b/Ix/Kernel/Verify/Inductive/PositivityTraversal.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/PositivityTraversal.lean
rename to Ix/Kernel/Verify/Inductive/PositivityTraversal.lean
index 4db3e0f54..338a5867d 100644
--- a/Ix/Tc/Verify/Inductive/PositivityTraversal.lean
+++ b/Ix/Kernel/Verify/Inductive/PositivityTraversal.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.OccurrenceValidation
+import Ix.Kernel.Verify.Inductive.OccurrenceValidation
 
 /-!
 # Production positivity traversal
@@ -14,7 +14,7 @@ its real intermediate checker state.  The final theorem composes that equation
 with the oracle-free occurrence invariant from `OccurrenceValidation`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 private theorem runTryCatch (body : RecM m α)
@@ -324,4 +324,4 @@ theorem checkPositivityDomainFuel_forall_negative
   rfl
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/ProducedGenerationTransaction.lean b/Ix/Kernel/Verify/Inductive/ProducedGenerationTransaction.lean
similarity index 91%
rename from Ix/Tc/Verify/Inductive/ProducedGenerationTransaction.lean
rename to Ix/Kernel/Verify/Inductive/ProducedGenerationTransaction.lean
index a142181f7..0f6b94cc2 100644
--- a/Ix/Tc/Verify/Inductive/ProducedGenerationTransaction.lean
+++ b/Ix/Kernel/Verify/Inductive/ProducedGenerationTransaction.lean
@@ -1,25 +1,25 @@
-import Ix.Tc.Verify.Inductive.Certificate
-import Lean4Lean.Verify.Environment.ConstructorValidation
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Theory.Named.Verify.Environment.ConstructorValidation
 
 /-!
 # Producer-linked inductive-generation transactions
 
 `CertifiedGenerationTransaction` is intentionally Theory-only: it retains the
 generation certificate and the exact `VEnv.addInductCertified` result, but it
-does not remember which ordinary Lean4Lean metadata execution selected that
+does not remember which ordinary Ix.Theory.Named metadata execution selected that
 certificate.
 
 For E2c we need both facts at once.  A successful outer producer call must not
 be allowed to justify Theory semantics by itself, and an independently chosen
 Theory certificate must not be passed off as the result of that producer.  The
-record below therefore owns Lean4Lean's dependent
+record below therefore owns Ix.Theory.Named's dependent
 `ProducedGenerationCandidatePackage`, then erases it through the existing
 Theory-only transaction only at the consumer boundary.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 /-- One exact producer-selected singleton package together with its successful
 certified Theory insertion and well-formed input environment.
@@ -98,7 +98,7 @@ end ProducedGenerationTransaction
 
 /-! ## Exact dependent producer transactions -/
 
-/-- The L4L-01E producer closure before source and generation indices are
+/-- The Spec-01E producer closure before source and generation indices are
 erased.  Its type retains the exact raw family, kernel source, producer
 arguments, normalized source declaration, and checked generation selected by
 one successful outer candidate execution.
@@ -110,7 +110,7 @@ generation that merely happens to have the same erased package type. -/
 structure ExactProducedGenerationTransaction
     {source : VInductDecl} {raw : VInductiveType}
     {kernelSource : Lean.InductiveType} {numNested : Nat}
-    {isUnsafe : Bool} {context : Lean4Lean.AddInductive.Context}
+    {isUnsafe : Bool} {context : Ix.Theory.Named.AddInductive.Context}
     (before after : VEnv) (Us : List Name)
     (producedCandidate : VInductDecl.ProducedGenerationShapeCandidate source
       raw kernelSource numNested isUnsafe context)
@@ -129,7 +129,7 @@ consumer boundary. -/
 noncomputable def toProduced
     {source : VInductDecl} {raw : VInductiveType}
     {kernelSource : Lean.InductiveType} {numNested : Nat}
-    {isUnsafe : Bool} {context : Lean4Lean.AddInductive.Context}
+    {isUnsafe : Bool} {context : Ix.Theory.Named.AddInductive.Context}
     {before after : VEnv} {Us : List Name}
     {producedCandidate : VInductDecl.ProducedGenerationShapeCandidate source
       raw kernelSource numNested isUnsafe context}
@@ -144,7 +144,7 @@ noncomputable def toProduced
 @[simp] theorem toProduced_source
     {source : VInductDecl} {raw : VInductiveType}
     {kernelSource : Lean.InductiveType} {numNested : Nat}
-    {isUnsafe : Bool} {context : Lean4Lean.AddInductive.Context}
+    {isUnsafe : Bool} {context : Ix.Theory.Named.AddInductive.Context}
     {before after : VEnv} {Us : List Name}
     {producedCandidate : VInductDecl.ProducedGenerationShapeCandidate source
       raw kernelSource numNested isUnsafe context}
@@ -156,7 +156,7 @@ noncomputable def toProduced
 @[simp] theorem toProduced_generation
     {source : VInductDecl} {raw : VInductiveType}
     {kernelSource : Lean.InductiveType} {numNested : Nat}
-    {isUnsafe : Bool} {context : Lean4Lean.AddInductive.Context}
+    {isUnsafe : Bool} {context : Ix.Theory.Named.AddInductive.Context}
     {before after : VEnv} {Us : List Name}
     {producedCandidate : VInductDecl.ProducedGenerationShapeCandidate source
       raw kernelSource numNested isUnsafe context}
@@ -170,7 +170,7 @@ intentional erasure. -/
 theorem facts
     {source : VInductDecl} {raw : VInductiveType}
     {kernelSource : Lean.InductiveType} {numNested : Nat}
-    {isUnsafe : Bool} {context : Lean4Lean.AddInductive.Context}
+    {isUnsafe : Bool} {context : Ix.Theory.Named.AddInductive.Context}
     {before after : VEnv} {Us : List Name}
     {producedCandidate : VInductDecl.ProducedGenerationShapeCandidate source
       raw kernelSource numNested isUnsafe context}
@@ -181,4 +181,4 @@ theorem facts
 
 end ExactProducedGenerationTransaction
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiAcceptance.lean b/Ix/Kernel/Verify/Inductive/RecursivePiAcceptance.lean
similarity index 95%
rename from Ix/Tc/Verify/Inductive/RecursivePiAcceptance.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiAcceptance.lean
index 23bfa4832..e6df65ae8 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiAcceptance.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiAcceptance.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Check.BlockAcceptance
-import Ix.Tc.Verify.Inductive.RecursivePiFixture
+import Ix.Kernel.Verify.Check.BlockAcceptance
+import Ix.Kernel.Verify.Inductive.RecursivePiFixture
 
 /-!
 # Production acceptance of the recursive-Pi family
@@ -9,7 +9,7 @@ This module joins three independently checked facts about the same physical
 
 * anonymous ingress produced its exact family/constructor member array;
 * the production family checker accepted that exact array; and
-* the Lean4Lean certificate gives every member its stable Theory meaning in
+* the Ix.Theory.Named certificate gives every member its stable Theory meaning in
   one atomic semantic transition.
 
 The result is deliberately limited to the family block. The separately
@@ -17,10 +17,10 @@ generated `Acc.rec` declaration and its recursive-Pi iota rule are the next
 slice.
 -/
 
-namespace Ix.Tc.RecursivePiFixture
+namespace Ix.Kernel.RecursivePiFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open RecursivePiCertificateFixture
 
 local instance acceptanceAnonKIdDecidableEq : DecidableEq (KId .anon) :=
@@ -193,4 +193,4 @@ theorem checkedSemanticAdmission : CheckedSemanticAdmission where
   admitted := familyAtomicAdmission
   recursivePi := breadth
 
-end Ix.Tc.RecursivePiFixture
+end Ix.Kernel.RecursivePiFixture
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiAdmission.lean b/Ix/Kernel/Verify/Inductive/RecursivePiAdmission.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/RecursivePiAdmission.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiAdmission.lean
index 05703e0f3..0d02dcc1b 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiAdmission.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiAdmission.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.RecursivePiSoundness
-import Ix.Tc.Verify.Inductive.OneFamilyAdmission
+import Ix.Kernel.Verify.Inductive.RecursivePiSoundness
+import Ix.Kernel.Verify.Inductive.OneFamilyAdmission
 
 /-!
 # Oracle-free recursive-Pi admission
@@ -12,10 +12,10 @@ No `InductiveOracle`, ambient future-world choice, or sequential stand-in for
 a mutual declaration is used.
 -/
 
-namespace Ix.Tc.RecursivePiRecursorFixture
+namespace Ix.Kernel.RecursivePiRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open RecursivePiCertificateFixture
 open RecursivePiFixture
 
@@ -386,4 +386,4 @@ theorem recursivePiAtomicClosure : RecursivePiAtomicClosure where
   iota := RecursivePiPattern.patternRel concreteRule_ruleAt
   recursivePi := RecursivePiCertificateFixture.breadth
 
-end Ix.Tc.RecursivePiRecursorFixture
+end Ix.Kernel.RecursivePiRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiCertificate.lean b/Ix/Kernel/Verify/Inductive/RecursivePiCertificate.lean
similarity index 89%
rename from Ix/Tc/Verify/Inductive/RecursivePiCertificate.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiCertificate.lean
index da449432e..f6f4a4824 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiCertificate.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiCertificate.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.Certificate
-import Lean4Lean.Theory.InductiveFixtures
+import Ix.Kernel.Verify.Inductive.Certificate
+import Ix.Theory.Named.InductiveFixtures
 
 /-!
 # Certified recursive-Pi generation fixture
@@ -10,18 +10,18 @@ the recursive argument is not a direct family application, and its induction
 hypothesis is itself a function.
 
 This module stays on the Theory-only side of the boundary. It constructs the
-public proof-carrying Lean4Lean transaction directly from `accDecl_wf`; it
+public proof-carrying Ix.Theory.Named transaction directly from `accDecl_wf`; it
 does not import the reflected Lean-environment replay or assert any Ix catalog
 correspondence. Production ingress, constructor traversal, and generated
 recursor comparison remain separate obligations.
 -/
 
-namespace Ix.Tc.RecursivePiCertificateFixture
+namespace Ix.Kernel.RecursivePiCertificateFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 
-/-- The public Lean4Lean certificate for the actual `Acc` declaration. -/
+/-- The public Ix.Theory.Named certificate for the actual `Acc` declaration. -/
 def certificate : accDecl.GenerationCertificate VEnv.empty where
   generation := accChecked.identityGeneration
   wf := (accChecked.wf_of_decl accDecl_wf).identityGeneration .empty
@@ -87,4 +87,4 @@ theorem certifiedFacts :
     CertifiedGenerationFacts VEnv.empty finalEnv transaction.certificate :=
   transaction.facts
 
-end Ix.Tc.RecursivePiCertificateFixture
+end Ix.Kernel.RecursivePiCertificateFixture
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiFixture.lean b/Ix/Kernel/Verify/Inductive/RecursivePiFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/RecursivePiFixture.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiFixture.lean
index 0d288d901..ea6807196 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiFixture.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.ConcreteFixture
-import Ix.Tc.Verify.Inductive.RecursivePiCertificate
+import Ix.Kernel.Verify.Inductive.ConcreteFixture
+import Ix.Kernel.Verify.Inductive.RecursivePiCertificate
 
 /-!
 # Production recursive-Pi fixture
@@ -16,10 +16,10 @@ check. Semantic catalog linkage and generated-recursor admission are layered
 on these exact executions rather than assumed by the fixture.
 -/
 
-namespace Ix.Tc.RecursivePiFixture
+namespace Ix.Kernel.RecursivePiFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open RecursivePiCertificateFixture
 open InductiveConcreteFixture
 
@@ -441,4 +441,4 @@ def familyLink : SingletonFamilyCatalogLink RawProjRel.none world.catalog
   interpretation.toCatalogLinkOfEntries ingressExecution catalogEntry
     trustedCatalog
 
-end Ix.Tc.RecursivePiFixture
+end Ix.Kernel.RecursivePiFixture
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiPattern.lean b/Ix/Kernel/Verify/Inductive/RecursivePiPattern.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/RecursivePiPattern.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiPattern.lean
index e96311acc..d74c85737 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiPattern.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiPattern.lean
@@ -1,11 +1,13 @@
-import Ix.Tc.Verify.Inductive.IotaPattern
-import Ix.Tc.Verify.Inductive.RecursivePiRecursorFixture
+import Ix.Kernel.Verify.Inductive.IotaPattern
+import Ix.Kernel.Verify.Inductive.RecursivePiRecursorFixture
+
+open Ix.Theory (VLevel)
 
 /-!
 # Recursive-Pi iota pattern
 
 The generated `Acc.intro` equation is the first supported iota rule whose
-recursive call occurs beneath a function telescope.  Lean4Lean's pattern RHS
+recursive call occurs beneath a function telescope.  Ix.Theory.Named's pattern RHS
 language intentionally contains only closed constants, applications, and
 captures; it has no primitive lambda constructor.  We retain exact alignment
 with the registered equation by using its complete closed RHS lambda as a
@@ -14,10 +16,10 @@ Beta reduction of that application constructs the two-binder induction
 hypothesis without adding an unverified pattern-language extension.
 -/
 
-namespace Ix.Tc.RecursivePiPattern
+namespace Ix.Kernel.RecursivePiPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open RecursivePiCertificateFixture
 open RecursivePiRecursorFixture
 
@@ -229,4 +231,4 @@ theorem metadata {rule : RecRule .anon}
   simpa only [pattern, introFieldCount,
     show (2 : UInt64).toNat = 2 from rfl] using hfields
 
-end Ix.Tc.RecursivePiPattern
+end Ix.Kernel.RecursivePiPattern
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiRecursorFixture.lean b/Ix/Kernel/Verify/Inductive/RecursivePiRecursorFixture.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/RecursivePiRecursorFixture.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiRecursorFixture.lean
index f73c5de7d..43c7e018e 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiRecursorFixture.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiRecursorFixture.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.RecursivePiAcceptance
+import Ix.Kernel.Verify.Inductive.RecursivePiAcceptance
 
 /-!
 # Production recursive-Pi recursor fixture
@@ -12,10 +12,10 @@ environment. Thus successful comparison exercises the production recursor
 generator and rule builder, not merely the Theory-side certificate.
 -/
 
-namespace Ix.Tc.RecursivePiRecursorFixture
+namespace Ix.Kernel.RecursivePiRecursorFixture
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open RecursivePiCertificateFixture
 open RecursivePiFixture
 open InductiveConcreteFixture
@@ -684,4 +684,4 @@ def recursorLink : SingletonRecursorCatalogLink RawProjRel.none world.catalog
   recursorInterpretation.toCatalogLinkOfEntry recursorIngressExecution
     catalog_recursor trustedCatalog
 
-end Ix.Tc.RecursivePiRecursorFixture
+end Ix.Kernel.RecursivePiRecursorFixture
diff --git a/Ix/Tc/Verify/Inductive/RecursivePiSoundness.lean b/Ix/Kernel/Verify/Inductive/RecursivePiSoundness.lean
similarity index 94%
rename from Ix/Tc/Verify/Inductive/RecursivePiSoundness.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePiSoundness.lean
index cee669019..e880344ef 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePiSoundness.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePiSoundness.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.RecursivePiPattern
+import Ix.Kernel.Verify.Inductive.RecursivePiPattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Recursive-Pi iota soundness
@@ -11,10 +13,10 @@ application, so the functional induction hypothesis beneath two lambdas is
 not reconstructed by an independent rewrite axiom.
 -/
 
-namespace Ix.Tc.RecursivePiPattern
+namespace Ix.Kernel.RecursivePiPattern
 
-open Lean4Lean
-open Lean4Lean.InductiveFixtures
+open Ix.Theory.Named
+open Ix.Theory.Named.InductiveFixtures
 open RecursivePiCertificateFixture
 open RecursivePiRecursorFixture
 
@@ -377,7 +379,7 @@ theorem patternSound {rule : RecRule .anon}
     hconstructorApplied⟩ := htype.app_inv hfutureWF.ordered hGamma
 
   obtain ⟨recursorHeadType, hrecursorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF, hlevelsArity⟩ :=
     hrecursorHeadTyped.const_inv hfutureWF.ordered hGamma
   have hcertifiedRecursorLookup :=
@@ -402,7 +404,7 @@ theorem patternSound {rule : RecRule .anon}
   subst levelTail
 
   obtain ⟨constructorHeadType, hconstructorHeadTyped⟩ :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hconstructorApplied
   obtain ⟨constructorConstant, hconstructorLookup, hconstructorLevelsWF,
     hconstructorLevelsArity⟩ :=
     hconstructorHeadTyped.const_inv hfutureWF.ordered hGamma
@@ -437,7 +439,7 @@ theorem patternSound {rule : RecRule .anon}
 
   have hrecursorConstantTyped : future.HasType uvars Gamma
       (.const ``Acc.rec [v, u]) (generation.recType.instL [v, u]) := by
-    have htyped := Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+    have htyped := Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
       hcertifiedRecursorLookup hlevelsWF hlevelsArity
     rw [generationRecursorName] at htyped
     simpa [VInductDecl.GenerationChecked.recursor] using htyped
@@ -453,19 +455,19 @@ theorem patternSound {rule : RecRule .anon}
       (.forallE majorDomain majorBody) := by
     simpa using hrecursorApplied
   obtain ⟨recursorParameterResult, hrecursorParameterApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha])
       (suffixArgs := [relation, motive, minor, index])
       hrecursorAppliedSplit
   have hrecursorAlpha : future.HasType uvars Gamma alpha (.sort u) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hrecursorParameterApplied hrecursorParameterHead
 
   have hconstructorConstantTyped : future.HasType uvars Gamma
       (.const ``Acc.intro [constructorU])
       (normalized.raw.toVConstant.type.instL [constructorU]) := by
     simpa [normalizedName] using
-      (Lean4Lean.VEnv.HasType.const (Γ := Gamma)
+      (Ix.Theory.Named.VEnv.HasType.const (Γ := Gamma)
         hcertifiedConstructorLookup hconstructorLevelsWF
           hconstructorLevelsArity)
   have hconstructorParameterHead : future.HasType uvars Gamma
@@ -482,13 +484,13 @@ theorem patternSound {rule : RecRule .anon}
       majorDomain := by
     simpa using hconstructorApplied
   obtain ⟨constructorParameterResult, hconstructorParameterApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [constructorAlpha])
       (suffixArgs := [constructorRelation, constructorIndex, recursiveField])
       hconstructorAppliedSplit
   have hconstructorAlpha : future.HasType uvars Gamma constructorAlpha
       (.sort constructorU) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hconstructorParameterApplied hconstructorParameterHead
 
   obtain ⟨parameterType, hparameterTyped⟩ := hparameterEq
@@ -502,7 +504,7 @@ theorem patternSound {rule : RecRule .anon}
       (.sort u) (.sort constructorU) :=
     hrecursorSort.trans hfutureWF hGamma hconstructorSort.symm
   have huniverse : u ≈ constructorU :=
-    Lean4Lean.VEnv.IsDefEqU.sort_inv hfutureWF hGamma hsorts
+    Ix.Theory.Named.VEnv.IsDefEqU.sort_inv hfutureWF hGamma hsorts
 
   have hintroLookup := hcertifiedConstructorLookup
   rw [normalizedName] at hintroLookup
@@ -519,7 +521,7 @@ theorem patternSound {rule : RecRule .anon}
   rw [constructorType_parameter] at hconstructorConstantEq
   have hparameterAtConstructor : future.IsDefEq uvars Gamma
       constructorAlpha alpha (.sort constructorU) :=
-    Lean4Lean.VEnv.IsDefEqU.defeqDF hfutureWF hGamma
+    Ix.Theory.Named.VEnv.IsDefEqU.defeqDF hfutureWF hGamma
       hconstructorSort.symm hparameterTyped.symm
   have hconstructorAlphaPrefixEq : future.IsDefEqU uvars Gamma
       (.app (.const ``Acc.intro [constructorU]) constructorAlpha)
@@ -527,7 +529,7 @@ theorem patternSound {rule : RecRule .anon}
     ⟨_, .appDF hconstructorConstantEq hparameterAtConstructor⟩
 
   obtain ⟨constructorParamsResult, hconstructorParamsApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [constructorAlpha, constructorRelation])
       (suffixArgs := [constructorIndex, recursiveField])
       hconstructorAppliedSplit
@@ -548,11 +550,11 @@ theorem patternSound {rule : RecRule .anon}
       (VExpr.appN (.const ``Acc.intro [u]) [alpha, relation]) := by
     refine ⟨relationBody.inst constructorRelation, ?_⟩
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appDF hconstructorAlphaPrefixEqTyped
+      (Ix.Theory.Named.VEnv.IsDefEq.appDF hconstructorAlphaPrefixEqTyped
         hrelationAtConstructor)
 
   obtain ⟨constructorIndexResult, hconstructorIndexApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs :=
         [constructorAlpha, constructorRelation, constructorIndex])
       (suffixArgs := [recursiveField]) hconstructorAppliedSplit
@@ -575,7 +577,7 @@ theorem patternSound {rule : RecRule .anon}
         [alpha, relation, index]) := by
     refine ⟨indexBody.inst constructorIndex, ?_⟩
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appDF hconstructorParamsEqTyped
+      (Ix.Theory.Named.VEnv.IsDefEq.appDF hconstructorParamsEqTyped
         hindexAtConstructor)
   obtain ⟨fieldDomain, fieldBody, hconstructorIndexHead,
     hrecursiveFieldTyped⟩ :=
@@ -593,7 +595,7 @@ theorem patternSound {rule : RecRule .anon}
       (VExpr.appN (.const ``Acc.intro [u])
         [alpha, relation, index, recursiveField]) := by
     simpa only [VExpr.appN] using
-      (Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma
+      (Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma
         hconstructorIndexEqTyped hconstructorApplied)
   have hconstructorEqTyped : future.IsDefEq uvars Gamma
       (VExpr.appN (.const ``Acc.intro [constructorU])
@@ -652,7 +654,7 @@ theorem patternSound {rule : RecRule .anon}
       (.forallE majorDomain majorBody) := by
     simpa using hrecursorApplied
   obtain ⟨recursorCommonResult, hrecursorCommonApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha, relation, motive, minor])
       (suffixArgs := [index]) hrecursorCommonAppliedSplit
   have hcommonLength :
@@ -662,14 +664,14 @@ theorem patternSound {rule : RecRule .anon}
       (VExpr.appN ((generation.rule 0 normalized).lhs.instL [v, u])
         [alpha, relation, motive, minor])
       (equationFieldType v u alpha relation motive minor) :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hcommonLength hrecursorCommonApplied
       hrecursorCommonType hequationLhsCommonType
 
   have hcanonicalConstructorConstantTyped : future.HasType uvars Gamma
       (.const ``Acc.intro [u])
       (normalized.raw.toVConstant.type.instL [u]) :=
-    Lean4Lean.VEnv.HasType.const hintroLookup
+    Ix.Theory.Named.VEnv.HasType.const hintroLookup
       (fun level hlevel => by
         simp only [List.mem_singleton] at hlevel
         subst level
@@ -682,7 +684,7 @@ theorem patternSound {rule : RecRule .anon}
     rw [← constructorType_parameter]
     exact hcanonicalConstructorConstantTyped
   obtain ⟨recursorParamsResult, hrecursorParamsApplied⟩ :=
-    Lean4Lean.VEnv.HasType.appN_prefix hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.appN_prefix hfutureWF hGamma
       (prefixArgs := [alpha, relation])
       (suffixArgs := [motive, minor, index]) hrecursorAppliedSplit
   have hrecursorAlphaHead : future.HasType uvars Gamma
@@ -690,13 +692,13 @@ theorem patternSound {rule : RecRule .anon}
       (.forallE (relationType alpha)
         (VExpr.dropN 1
           ((VExpr.dropN 1 (generation.recType.instL [v, u])).inst alpha))) := by
-    have happ := Lean4Lean.VEnv.HasType.app hrecursorParameterHead
+    have happ := Ix.Theory.Named.VEnv.HasType.app hrecursorParameterHead
       hrecursorAlpha
     rw [recType_relation] at happ
     exact happ
   have hrecursorRelation : future.HasType uvars Gamma relation
       (relationType alpha) :=
-    Lean4Lean.VEnv.HasType.app_argument_of_head hfutureWF hGamma
+    Ix.Theory.Named.VEnv.HasType.app_argument_of_head hfutureWF hGamma
       hrecursorParamsApplied hrecursorAlphaHead
   have hcanonicalConstructorAlphaHead : future.HasType uvars Gamma
       (.app (.const ``Acc.intro [u]) alpha)
@@ -704,14 +706,14 @@ theorem patternSound {rule : RecRule .anon}
         (VExpr.dropN 1
           ((VExpr.dropN 1
             (normalized.raw.toVConstant.type.instL [u])).inst alpha))) := by
-    have happ := Lean4Lean.VEnv.HasType.app
+    have happ := Ix.Theory.Named.VEnv.HasType.app
       hcanonicalConstructorParameterHead hrecursorAlpha
     rw [constructorType_relation] at happ
     exact happ
   have hcanonicalConstructorPrefix : future.HasType uvars Gamma
       (VExpr.appN (.const ``Acc.intro [u]) [alpha, relation])
       (constructorFieldType u alpha relation) := by
-    have happ := Lean4Lean.VEnv.HasType.app
+    have happ := Ix.Theory.Named.VEnv.HasType.app
       hcanonicalConstructorAlphaHead hrecursorRelation
     change future.HasType uvars Gamma
       (.app (.app (.const ``Acc.intro [u]) alpha) relation)
@@ -757,7 +759,7 @@ theorem patternSound {rule : RecRule .anon}
       VExpr.instL, VExpr.inst, VExpr.instVar,
       VExpr.telN, VExpr.dropN]
   have hequationLhsFieldsApplied :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope_instRev
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope_instRev
       hfutureWF hGamma hfieldLength hcanonicalConstructorApplied
       hconstructorFieldHead' hequationFieldHead
   have hequationLhsApplied : future.HasType uvars Gamma
@@ -772,12 +774,12 @@ theorem patternSound {rule : RecRule .anon}
       VExpr.appN_append]
     exact hequationLhsFieldsApplied
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
 
   have hequationLhsApplied' := hequationLhsApplied
   rw [generatedRule_shape.1, VExpr.instL_lamN] at hequationLhsApplied'
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma (by simp) hequationLhsApplied'
   rw [lhsBody_open] at hlhsBeta
   have hlhsBeta' : future.IsDefEqU uvars Gamma
@@ -818,4 +820,4 @@ theorem patternRel {rule : RecRule .anon}
   RawRecursorRulePatternRel.of_metadata_sound (metadata hrule)
     (patternSound hrule)
 
-end Ix.Tc.RecursivePiPattern
+end Ix.Kernel.RecursivePiPattern
diff --git a/Ix/Tc/Verify/Inductive/RecursivePositivityTraversal.lean b/Ix/Kernel/Verify/Inductive/RecursivePositivityTraversal.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/RecursivePositivityTraversal.lean
rename to Ix/Kernel/Verify/Inductive/RecursivePositivityTraversal.lean
index 8e16bb435..c3ae6c621 100644
--- a/Ix/Tc/Verify/Inductive/RecursivePositivityTraversal.lean
+++ b/Ix/Kernel/Verify/Inductive/RecursivePositivityTraversal.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.NestedPositivityTraversal
+import Ix.Kernel.Verify.Inductive.NestedPositivityTraversal
 
 /-!
 # Exhaustive recursive positivity traversal
@@ -11,7 +11,7 @@ terminal constant spine is either a validated active-family occurrence or a
 fully expanded nested-family traversal.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The WHNF branch discriminator used by positivity after the forall case
 has been excluded. Naming it prevents indexed trace constructors from making
@@ -298,4 +298,4 @@ theorem checkPositivityDomainFuel_success
                         hterminal
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/ResultSortTelescope.lean b/Ix/Kernel/Verify/Inductive/ResultSortTelescope.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/ResultSortTelescope.lean
rename to Ix/Kernel/Verify/Inductive/ResultSortTelescope.lean
index 02f1ec47a..bc22d6e41 100644
--- a/Ix/Tc/Verify/Inductive/ResultSortTelescope.lean
+++ b/Ix/Kernel/Verify/Inductive/ResultSortTelescope.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Inductive
-import Ix.Tc.Verify.Whnf.StructEta.ExactMajorTelescope
+import Ix.Kernel.Inductive
+import Ix.Kernel.Verify.Whnf.StructEta.ExactMajorTelescope
 
 /-!
 # Exact result-sort telescope restoration
@@ -13,7 +13,7 @@ The theorem is deliberately operational.  It grants no authority to a WHNF
 callback and makes no scoped suffix model admit the temporary telescope.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Pure syntax certificate for a fixed forall prefix ending in a sort. -/
@@ -100,4 +100,4 @@ theorem getResultSortLevel_direct_exact
     exact scratch_tryFinally_ok bodyRun cleanup
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/RuleApplication.lean b/Ix/Kernel/Verify/Inductive/RuleApplication.lean
similarity index 98%
rename from Ix/Tc/Verify/Inductive/RuleApplication.lean
rename to Ix/Kernel/Verify/Inductive/RuleApplication.lean
index b79d3f1c1..fcc975464 100644
--- a/Ix/Tc/Verify/Inductive/RuleApplication.lean
+++ b/Ix/Kernel/Verify/Inductive/RuleApplication.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Inductive.SingletonRecursor
+import Ix.Kernel.Verify.Inductive.SingletonRecursor
 
 /-!
 # Applying closed generated equations
 
-Lean4Lean registers generated iota equations as closed lambda telescopes,
+Ix.Theory.Named registers generated iota equations as closed lambda telescopes,
 whereas the production Ix reducer sees the recursor application after that
 telescope has been supplied.  These lemmas isolate the ordinary dependent
 beta reasoning needed to cross that boundary.
@@ -15,7 +15,7 @@ lambda-wrapped equations.  The later singleton pattern compiler must provide
 the exact telescope arguments and use the lemmas below.
 -/
 
-namespace Lean4Lean.VExpr
+namespace Ix.Theory.Named.VExpr
 
 /-- Positional lookup in the reverse de Bruijn range used by generated rule
 telescopes. -/
@@ -51,9 +51,9 @@ theorem instRev_bvar_at (arguments : List VExpr) (index : Nat)
   rw [List.getElem?_eq_getElem hindex] at hrange
   exact Option.some.inj hrange
 
-end Lean4Lean.VExpr
+end Ix.Theory.Named.VExpr
 
-namespace Lean4Lean.VEnv
+namespace Ix.Theory.Named.VEnv
 
 /-- Typing an application spine also types its original head.  This is a
 small inversion helper for the equation-application proofs below. -/
@@ -309,7 +309,7 @@ theorem HasType.beta_head_appN
   exact IsDefEq.appN_same henv hGamma hbeta hsource
 
 /-- Supplying exactly one argument per closed lambda binder beta-reduces to
-Lean4Lean's outer-to-inner `instRev` operation.  This is the reusable semantic
+Ix.Theory.Named's outer-to-inner `instRev` operation.  This is the reusable semantic
 bridge from a registered closed equation to an open generated rule body. -/
 theorem HasType.lamN_appN_beta
     {env : VEnv} {U : Nat} {Gamma : List VExpr}
@@ -360,4 +360,4 @@ theorem HasType.lamN_appN_beta
           simpa only [VExpr.lamN, VExpr.appN, VExpr.instRev,
             Nat.zero_add, hrestLength] using hcombined
 
-end Lean4Lean.VEnv
+end Ix.Theory.Named.VEnv
diff --git a/Ix/Tc/Verify/Inductive/SingletonEnumeration.lean b/Ix/Kernel/Verify/Inductive/SingletonEnumeration.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/SingletonEnumeration.lean
rename to Ix/Kernel/Verify/Inductive/SingletonEnumeration.lean
index b9beebddb..ff64eaac0 100644
--- a/Ix/Tc/Verify/Inductive/SingletonEnumeration.lean
+++ b/Ix/Kernel/Verify/Inductive/SingletonEnumeration.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Inductive.IotaPattern
+import Ix.Kernel.Verify.Inductive.IotaPattern
+
+open Ix.Theory (VLevel)
 
 /-!
 # Certified singleton enumerations
@@ -14,9 +16,9 @@ retained by E2a.  It is therefore a decidable fragment boundary around the
 actual generated artifacts, not a second inductive-declaration model.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstVal VEnv VExpr VInductDecl)
+open Ix.Theory.Named (VConstVal VEnv VExpr VInductDecl)
 
 namespace CertifiedSingletonGeneration
 
@@ -28,7 +30,7 @@ structure IsEnumeration {source : VInductDecl}
   noUniverses : source.uvars = 0
   noParameters : source.nparams = 0
   /-- E2b's enumeration pattern currently covers the ordinary large
-  eliminator.  Small and K elimination use the L4L-06 universe layout and
+  eliminator.  Small and K elimination use the Spec-06 universe layout and
   remain explicit E2c breadth cases. -/
   largeElimination : generation.elimination = .large
   noIndices : generation.block.rawIndices = []
@@ -73,8 +75,8 @@ recursor, independently of the selected elimination mode. -/
     (shape : IsEnumeration generation) :
     generation.sourceLevels = [] := by
   simp [VInductDecl.GenerationChecked.sourceLevels,
-    Lean4Lean.VInductDecl.ElimMode.sourceLevels,
-    Lean4Lean.VLevel.params', shape.noUniverses]
+    Ix.Theory.Named.VInductDecl.ElimMode.sourceLevels,
+    Ix.Theory.VLevel.params', shape.noUniverses]
 
 @[simp] theorem paramsTel_nil {source : VInductDecl}
     {generation : source.GenerationChecked}
@@ -145,7 +147,7 @@ theorem rule_lhs {source : VInductDecl}
     shape.resultIndices_nil hconstructor]
   simp [ruleBinders, VExpr.liftTelN, VExpr.appN,
     VExpr.bvarRevRange, shape.noUniverses, shape.noParameters,
-    Lean4Lean.VLevel.params', shape.largeElimination]
+    Ix.Theory.VLevel.params', shape.largeElimination]
 
 /-- Exact generated right-hand side: enum rule `index` is the corresponding
 minor variable and has no field/IH application suffix. -/
@@ -168,7 +170,7 @@ theorem rule_rhs {source : VInductDecl}
 open a generated enumeration equation. -/
 @[simp] theorem ruleBinders_instL_length {source : VInductDecl}
     {generation : source.GenerationChecked}
-    (levels : List Lean4Lean.VLevel) :
+    (levels : List Ix.Theory.VLevel) :
     ((ruleBinders generation).map (VExpr.instL levels)).length =
       generation.block.ctorPairs.length + 1 := by
   simp
@@ -179,7 +181,7 @@ retains only its final major binder after that common prefix. -/
 theorem recType_instantiated {source : VInductDecl}
     {generation : source.GenerationChecked}
     (shape : IsEnumeration generation)
-    (levels : List Lean4Lean.VLevel) :
+    (levels : List Ix.Theory.VLevel) :
     generation.recType.instL levels =
       VExpr.forallN
         ((ruleBinders generation).map (VExpr.instL levels))
@@ -202,7 +204,7 @@ theorem ruleType_instantiated {source : VInductDecl}
     (shape : IsEnumeration generation)
     {index : Nat} {normalized : VInductDecl.NormalizedCtor}
     (hconstructor : generation.block.ctorPairs[index]? = some normalized)
-    (levels : List Lean4Lean.VLevel) :
+    (levels : List Ix.Theory.VLevel) :
     (generation.rule index normalized).type.instL levels =
       VExpr.forallN
         ((ruleBinders generation).map (VExpr.instL levels))
@@ -224,7 +226,7 @@ theorem ruleLhsBody_instantiated {source : VInductDecl}
     {generation : source.GenerationChecked}
     (shape : IsEnumeration generation)
     (normalized : VInductDecl.NormalizedCtor)
-    (levels : List Lean4Lean.VLevel) (arguments : List VExpr)
+    (levels : List Ix.Theory.VLevel) (arguments : List VExpr)
     (hlevels : levels.length = generation.recUvars)
     (harguments : arguments.length =
       generation.block.ctorPairs.length + 1) :
@@ -245,7 +247,7 @@ theorem ruleLhsBody_instantiated {source : VInductDecl}
           arguments)
         (.const normalized.raw.name []) := by
   simp only [VExpr.instL, VExpr.instL_appN,
-    Lean4Lean.VLevel.inst_map_id hlevels,
+    Ix.Theory.VLevel.inst_map_id hlevels,
     shape.sourceLevels_nil,
     VInductDecl.bvarRevRange_instL]
   change VExpr.instRev
@@ -270,7 +272,7 @@ left-to-right minor argument encoded by the dependent pattern path. -/
 theorem ruleRhsBody_instantiated {source : VInductDecl}
     {generation : source.GenerationChecked}
     (index : Nat) (hindex : index < generation.block.ctorPairs.length)
-    (levels : List Lean4Lean.VLevel) (arguments : List VExpr)
+    (levels : List Ix.Theory.VLevel) (arguments : List VExpr)
     (harguments : arguments.length =
       generation.block.ctorPairs.length + 1) :
     VExpr.instRev
@@ -464,7 +466,7 @@ theorem enumerationPatternMetadata
 
 /-- The compiled enum pattern is semantically justified by the exact
 registered generated equation.  This is the central E2b bridge: a successful
-pattern match is reduced through Lean4Lean's registered equality, rather than
+pattern match is reduced through Ix.Theory.Named's registered equality, rather than
 through an independently postulated iota law. -/
 theorem enumerationPatternSound
     {trProj : RawProjRel} {catalog : Catalog}
@@ -491,7 +493,7 @@ theorem enumerationPatternSound
       generation.block.ctorPairs.length := by
     rw [family.constructorCount, ← generation.rawCtors_eq]
     simp
-  change Lean4Lean.Pattern.Matches
+  change Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern
         (.str generation.block.sourceType.name "rec")
         (family.constructorIds.size + 1) normalized.raw.name 0)
@@ -506,7 +508,7 @@ theorem enumerationPatternSound
     htype.app_inv hfutureWF.ordered hGamma
 
   have hrecursorHead :=
-    Lean4Lean.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
+    Ix.Theory.Named.VEnv.HasType.appN_head hfutureWF hGamma hrecursorApplied
   obtain ⟨recursorHeadType, hrecursorHeadType⟩ := hrecursorHead
   obtain ⟨recursorConstant, hrecursorLookup, hlevelsWF,
     hlevelsArity⟩ :=
@@ -582,7 +584,7 @@ theorem enumerationPatternSound
       (.const (.str generation.block.sourceType.name "rec") levels)
       (generation.recType.instL levels) := by
     simpa [VInductDecl.GenerationChecked.recursor] using
-      (Lean4Lean.VEnv.HasType.const
+      (Ix.Theory.Named.VEnv.HasType.const
         (Γ := Gamma) hcertifiedRecursorLookup hlevelsWF hlevelsArity)
   have hrecursorCommonType : future.HasType uvars Gamma
       (.const (.str generation.block.sourceType.name "rec") levels)
@@ -611,11 +613,11 @@ theorem enumerationPatternSound
       CertifiedSingletonGeneration.IsEnumeration.ruleBinders_length,
       hcount]
   obtain ⟨equationApplicationType, hequationLhsApplied⟩ :=
-    Lean4Lean.VEnv.HasType.transfer_appN_telescope
+    Ix.Theory.Named.VEnv.HasType.transfer_appN_telescope
       hfutureWF hGamma hargumentLength hrecursorApplied
       hrecursorCommonType hequationLhsCommonType
   have hequationApplied :=
-    Lean4Lean.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
+    Ix.Theory.Named.VEnv.IsDefEq.appN_same hfutureWF hGamma hequation
       hequationLhsApplied
   have hequationRhsApplied : future.HasType uvars Gamma
       (VExpr.appN ((generation.rule index normalized).rhs.instL levels)
@@ -639,7 +641,7 @@ theorem enumerationPatternSound
     rw [CertifiedSingletonGeneration.IsEnumeration.rule_lhs shape hnormalized,
       VExpr.instL_lamN] at hcopy
     exact hcopy
-  have hlhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hlhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hargumentLength hequationLhsApplied'
   rw [CertifiedSingletonGeneration.IsEnumeration.ruleLhsBody_instantiated
     shape normalized levels recursorArguments
@@ -668,7 +670,7 @@ theorem enumerationPatternSound
     rw [CertifiedSingletonGeneration.IsEnumeration.rule_rhs shape hnormalized,
       VExpr.instL_lamN] at hcopy
     exact hcopy
-  have hrhsBeta := Lean4Lean.VEnv.HasType.lamN_appN_beta
+  have hrhsBeta := Ix.Theory.Named.VEnv.HasType.lamN_appN_beta
     hfutureWF hGamma hargumentLength hequationRhsApplied'
   have hindexGeneration : index < generation.block.ctorPairs.length := by
     simpa [hcount] using hindex
@@ -713,7 +715,7 @@ theorem enumerationPatternSound
   simpa [SingletonRecursorCatalogLink.enumerationPattern, selected,
     RecursorIotaPattern.recursorArgumentRhs_apply,
     RecursorIotaPattern.recursorArgumentRhs,
-    Lean4Lean.Pattern.RHS.apply] using hresult
+    Ix.Theory.Named.Pattern.RHS.apply] using hresult
 
 /-- Package the finite pattern metadata and its registered-equation proof as
 the exact historical relation consumed by the production iota verifier. -/
@@ -742,4 +744,4 @@ theorem enumerationPatternRel
 
 end SingletonRecursorCatalogLink
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/SingletonFamily.lean b/Ix/Kernel/Verify/Inductive/SingletonFamily.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/SingletonFamily.lean
rename to Ix/Kernel/Verify/Inductive/SingletonFamily.lean
index 0a39133c1..57e960a1a 100644
--- a/Ix/Tc/Verify/Inductive/SingletonFamily.lean
+++ b/Ix/Kernel/Verify/Inductive/SingletonFamily.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Inductive
+import Ix.Kernel.Verify.Inductive
 
 /-!
 # Certified singleton-family admission
 
-This module is the first production-facing half of E2b.  A Lean4Lean
+This module is the first production-facing half of E2b.  A Ix.Theory.Named
 `CertifiedGenerationTransaction` already owns the semantic generation of one
 family, all of its constructors, its recursor, and its iota equations.  What
 that transaction cannot know is which anonymous Ix addresses contain the
@@ -26,9 +26,9 @@ are derived below from the E2a transaction.  The later checker adapter must
 construct this link from ingress plus a successful production block run.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstVal VEnv VExpr VInductDecl)
+open Ix.Theory.Named (VConstVal VEnv VExpr VInductDecl)
 
 /-! ## Header facts retained by normalized generation -/
 
@@ -470,4 +470,4 @@ def oracle
 
 end SingletonFamilyCatalogLink
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/SingletonIngress.lean b/Ix/Kernel/Verify/Inductive/SingletonIngress.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/SingletonIngress.lean
rename to Ix/Kernel/Verify/Inductive/SingletonIngress.lean
index 65f505047..06264b13a 100644
--- a/Ix/Tc/Verify/Inductive/SingletonIngress.lean
+++ b/Ix/Kernel/Verify/Inductive/SingletonIngress.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Inductive.SingletonRecursor
-import Ix.Tc.Verify.Env
+import Ix.Kernel.Verify.Inductive.SingletonRecursor
+import Ix.Kernel.Verify.Env
 
 /-!
 # Loaded singleton-inductive ingress correspondence
@@ -16,7 +16,7 @@ semantic authority to loading:
   recursor block; and
 * `toCatalogLink` transports those representation facts through
   `LoadedAgrees` and derives pre-admission freshness from the trusted log and
-  the Lean4Lean generation transaction.
+  the Ix.Theory.Named generation transaction.
 
 The views contain no catalog lookup, trusted-membership negation, declaration
 WF, or checker-success premise.  In particular, an anonymous `KEnv` entry
@@ -25,9 +25,9 @@ deliberate ghost input and will be constructed from the corresponding Ixon
 ingress trace.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstVal VEnv VInductDecl)
+open Ix.Theory.Named (VConstVal VEnv VInductDecl)
 
 /-! ## Family and constructor ingress -/
 
@@ -124,7 +124,7 @@ theorem familyFresh
     Option.some.inj (hname.symm.trans view.familyName)
   subst name
   have hcollision :
-      (none : Option Lean4Lean.VConstant) = some ci :=
+      (none : Option Ix.Theory.Named.VConstant) = some ci :=
     tx.facts.familyFresh.symm.trans hlookup
   cases hcollision
 
@@ -151,7 +151,7 @@ theorem constructorFresh
       tx.certificate.generation.block.sourceType.ctors :=
     List.mem_of_getElem? hsource
   have hcollision :
-      (none : Option Lean4Lean.VConstant) = some ci :=
+      (none : Option Ix.Theory.Named.VConstant) = some ci :=
     (tx.facts.ctorFresh hsourceMem).symm.trans hlookup
   cases hcollision
 
@@ -288,7 +288,7 @@ theorem recursorFresh
     Option.some.inj (hname.symm.trans view.recursorName)
   subst name
   have hcollision :
-      (none : Option Lean4Lean.VConstant) = some ci :=
+      (none : Option Ix.Theory.Named.VConstant) = some ci :=
     tx.facts.recursorFresh.symm.trans hlookup
   cases hcollision
 
@@ -316,4 +316,4 @@ def toCatalogLink
 
 end SingletonRecursorIngressView
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/SingletonOracle.lean b/Ix/Kernel/Verify/Inductive/SingletonOracle.lean
similarity index 96%
rename from Ix/Tc/Verify/Inductive/SingletonOracle.lean
rename to Ix/Kernel/Verify/Inductive/SingletonOracle.lean
index 276ca8cf4..b35038ec6 100644
--- a/Ix/Tc/Verify/Inductive/SingletonOracle.lean
+++ b/Ix/Kernel/Verify/Inductive/SingletonOracle.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.SingletonEnumeration
+import Ix.Kernel.Verify.Inductive.SingletonEnumeration
 
 /-!
 # Certificate-backed singleton recursor oracle
@@ -10,9 +10,9 @@ generated equations and pattern-soundness theorem rather than an ambient
 reflection premise.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VEnv VInductDecl)
+open Ix.Theory.Named (VEnv VInductDecl)
 
 namespace SingletonRecursorCatalogLink
 
@@ -84,4 +84,4 @@ def oracle
 
 end SingletonRecursorCatalogLink
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/SingletonRecursor.lean b/Ix/Kernel/Verify/Inductive/SingletonRecursor.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/SingletonRecursor.lean
rename to Ix/Kernel/Verify/Inductive/SingletonRecursor.lean
index 489660981..f4e04c4d1 100644
--- a/Ix/Tc/Verify/Inductive/SingletonRecursor.lean
+++ b/Ix/Kernel/Verify/Inductive/SingletonRecursor.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Inductive.SingletonFamily
+import Ix.Kernel.Verify.Inductive.SingletonFamily
 
 /-!
 # Certified singleton-recursor correspondence
 
-The Lean4Lean transaction used by E2a installs a singleton family's recursor
+The Ix.Theory.Named transaction used by E2a installs a singleton family's recursor
 and all of its iota equations atomically with the family.  Anonymous Ix
 ingress does not: the family/constructor block and the recursor block are
 distinct physical blocks.  This module links the latter block to the exact
@@ -16,9 +16,9 @@ compilation is kept for the next module because it has an additional semantic
 obligation beyond raw/structural translation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstVal VDefEq VEnv VExpr VInductDecl)
+open Ix.Theory.Named (VConstVal VDefEq VEnv VExpr VInductDecl)
 
 namespace CertifiedSingletonGeneration
 
@@ -51,7 +51,7 @@ theorem rawConstructorAt {source : VInductDecl}
   exact hmapped
 
 /-- A generated iota equation is recursor-headed below its closed rule
-telescope.  This is the shape actually emitted by Lean4Lean; its outer node
+telescope.  This is the shape actually emitted by Ix.Theory.Named; its outer node
 is never directly a constant-headed application when the telescope is
 nonempty. -/
 theorem generatedRuleHead {source : VInductDecl}
@@ -120,7 +120,7 @@ theorem levels
       VInductDecl.GenerationChecked.recursor]
 
 /-- The physical recursor's declared K bit is exactly the independently
-computed flag retained by the certified Lean4Lean generation. -/
+computed flag retained by the certified Ix.Theory.Named generation. -/
 theorem kTarget
     {source : VInductDecl} {generation : source.GenerationChecked}
     {constructorIds : Array (KId .anon)} {concrete : KConst .anon}
@@ -362,4 +362,4 @@ theorem member_eq
 
 end SingletonRecursorCatalogLink
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/SpecializationIdentity.lean b/Ix/Kernel/Verify/Inductive/SpecializationIdentity.lean
similarity index 97%
rename from Ix/Tc/Verify/Inductive/SpecializationIdentity.lean
rename to Ix/Kernel/Verify/Inductive/SpecializationIdentity.lean
index dbad71590..351868235 100644
--- a/Ix/Tc/Verify/Inductive/SpecializationIdentity.lean
+++ b/Ix/Kernel/Verify/Inductive/SpecializationIdentity.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Inductive.OccurrenceValidation
+import Ix.Kernel.Verify.Inductive.OccurrenceValidation
 
 /-!
 # Nested-inductive specialization identity
@@ -9,7 +9,7 @@ intentionally broader than this identity: syntactically distinct applications
 receive distinct generated auxiliaries even when they denote equal types.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The production specialization key uses structural Boolean equality.  Its
 derived implementation is lawful once raw address equality is known lawful.
@@ -93,4 +93,4 @@ theorem semanticUniverseEquality_does_not_collapse_specialization :
 
 end SpecializationIdentityFixture
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Inductive/StructuralCacheSemantics.lean b/Ix/Kernel/Verify/Inductive/StructuralCacheSemantics.lean
similarity index 99%
rename from Ix/Tc/Verify/Inductive/StructuralCacheSemantics.lean
rename to Ix/Kernel/Verify/Inductive/StructuralCacheSemantics.lean
index 99cf177ee..1a240ec47 100644
--- a/Ix/Tc/Verify/Inductive/StructuralCacheSemantics.lean
+++ b/Ix/Kernel/Verify/Inductive/StructuralCacheSemantics.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq
+import Ix.Kernel.Verify.DefEq
 
 /-!
 # Certified semantics for inductive structural caches
@@ -17,7 +17,7 @@ consumer obligation: the production recursor-member checker validates those
 artifacts exhaustively before accepting a stored recursor.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace CacheAuthority
 
@@ -340,4 +340,4 @@ theorem insertRecursor
 
 end ScopedWhnfStateInv
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer.lean b/Ix/Kernel/Verify/Infer.lean
similarity index 99%
rename from Ix/Tc/Verify/Infer.lean
rename to Ix/Kernel/Verify/Infer.lean
index 8f347c140..b97f376b9 100644
--- a/Ix/Tc/Verify/Infer.lean
+++ b/Ix/Kernel/Verify/Infer.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Suffix
-import Ix.Tc.Verify.Knot
+import Ix.Kernel.Verify.Suffix
+import Ix.Kernel.Verify.Knot
 
 /-!
 # K2 inference semantics
@@ -9,9 +9,9 @@ with its exact Theory meaning.  Algorithmic branch proofs will consume the
 hit and insertion interfaces defined here.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace TcM
 
@@ -349,4 +349,4 @@ theorem inferHitOfMatches {keys : WhnfContextKeys} {trProj : RawProjRel}
 
 end CacheInvariant
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/Applications.lean b/Ix/Kernel/Verify/Infer/Applications.lean
similarity index 97%
rename from Ix/Tc/Verify/Infer/Applications.lean
rename to Ix/Kernel/Verify/Infer/Applications.lean
index 53a71457b..6bee2d1b1 100644
--- a/Ix/Tc/Verify/Infer/Applications.lean
+++ b/Ix/Kernel/Verify/Infer/Applications.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Infer.FunctionTypes
-import Ix.Tc.Verify.Whnf.Beta.LambdaInstantiation
+import Ix.Kernel.Verify.Infer.FunctionTypes
+import Ix.Kernel.Verify.Whnf.Beta.LambdaInstantiation
 
 /-!
 # Application inference
@@ -16,7 +16,7 @@ the exact family of substitution requests reachable after a supported
 codomain has been exposed.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite-support obligations for supported applications that reach the
 uncached inference dispatcher.  Quantifying the final clause over supported
@@ -73,7 +73,7 @@ private theorem applicationResult
     (theory : WhnfTheory trProj world uvars)
     (hDelta : KVLCtx.WF world.venv uvars Delta)
     {a cod : KExpr .anon}
-    {fV aV A B fTyV domV codV : Lean4Lean.VExpr}
+    {fV aV A B fTyV domV codV : Ix.Theory.Named.VExpr}
     (hfun : world.venv.HasType uvars Delta.toCtx fV (.forallE A B))
     (harg : world.venv.HasType uvars Delta.toCtx aV A)
     (hargTr : TrKExprS world.venv uvars world.nameOf trProj Delta a aV)
@@ -114,7 +114,7 @@ private theorem applicationResult
   refine ⟨codV.inst aV, ?_, ?_⟩
   · exact hresultTr.trKExpr world.venvWF.ordered theory.literalWF
       theory.projections.wf hDelta
-  · exact (Lean4Lean.VEnv.HasType.app hfun harg).defeqU_r
+  · exact (Ix.Theory.Named.VEnv.HasType.app hfun harg).defeqU_r
       world.venvWF hDelta hcodInstEq
 
 /-- Execute the final substitution and package its support and Theory
@@ -128,7 +128,7 @@ private theorem finishApplication_wf
     {s : TcState .anon}
     (theory : WhnfTheory trProj world uvars)
     {a cod : KExpr .anon}
-    {fV aV A B fTyV domV codV : Lean4Lean.VExpr}
+    {fV aV A B fTyV domV codV : Ix.Theory.Named.VExpr}
     (hfun : world.venv.HasType uvars Delta.toCtx fV (.forallE A B))
     (harg : world.venv.HasType uvars Delta.toCtx aV A)
     (hargTr : TrKExprS world.venv uvars world.nameOf trProj Delta a aV)
@@ -167,7 +167,7 @@ theorem inferUncached_app_wf
     {world : VerifyWorld} {uvars : Nat} {Delta : KVLCtx}
     {s : TcState .anon} {inferOnly : Bool}
     {f a : KExpr .anon} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
@@ -283,4 +283,4 @@ theorem inferUncached_app_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/BinderClosing.lean b/Ix/Kernel/Verify/Infer/BinderClosing.lean
similarity index 98%
rename from Ix/Tc/Verify/Infer/BinderClosing.lean
rename to Ix/Kernel/Verify/Infer/BinderClosing.lean
index a9773d984..6f4d580f2 100644
--- a/Ix/Tc/Verify/Infer/BinderClosing.lean
+++ b/Ix/Kernel/Verify/Infer/BinderClosing.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.BinderScopes
+import Ix.Kernel.Verify.Infer.BinderScopes
 
 /-!
 # Semantic binder closing for inference
@@ -10,9 +10,9 @@ fvar abstraction retags the concrete expression back to the original
 de Bruijn context without changing its Theory translation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLocalDecl)
+open Ix.Theory.Named (VExpr VLocalDecl)
 
 namespace KVLCtx.RetagFVar
 
@@ -110,7 +110,7 @@ theorem abstractFVarPositions_singleton_miss {fv other : FVarId}
 binder depth.  `Constructed` supplies the no-wrap fact for the `i + 1`
 variable arm; the size bound supplies every recursive `depth + 1`. -/
 theorem TrKExprS.closeFVarSpec
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     {target : KVLCtx} {body : KExpr .anon} {bodyV : VExpr}
@@ -258,7 +258,7 @@ theorem TrKExprS.closeFVarSpec
 
 /-- Entry-depth form used after `openBinder`/`openLet`. -/
 theorem TrKExprS.closeFVarZero
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     {Delta : KVLCtx} {decl : VLocalDecl}
@@ -279,7 +279,7 @@ theorem TrKExprS.closeFVarZero
 /-- The API-level fast path is semantically identical to the singleton
 abstraction specification under its audited bounds. -/
 theorem TrKExprS.closeFVarResult
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     {Delta : KVLCtx} {decl : VLocalDecl}
@@ -432,4 +432,4 @@ theorem close_whnf_wf
 
 end SingletonAbstractionResources
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/BinderOpening.lean b/Ix/Kernel/Verify/Infer/BinderOpening.lean
similarity index 98%
rename from Ix/Tc/Verify/Infer/BinderOpening.lean
rename to Ix/Kernel/Verify/Infer/BinderOpening.lean
index ea9092332..8050b81e1 100644
--- a/Ix/Tc/Verify/Infer/BinderOpening.lean
+++ b/Ix/Kernel/Verify/Infer/BinderOpening.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.ScopedLocals
+import Ix.Kernel.Verify.Infer.ScopedLocals
 
 /-!
 # Semantic binder opening for inference
@@ -10,9 +10,9 @@ that retagging and proves that `instantiateRev` preserves the translated
 Theory expression.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLocalDecl)
+open Ix.Theory.Named (VExpr VLocalDecl)
 
 namespace KVLCtx
 
@@ -125,7 +125,7 @@ end KVLCtx
 /-- Replacing one de Bruijn binder with its freshly tagged fvar leaves the
 Theory expression unchanged. -/
 theorem TrKExprS.openFVar
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     {source : KVLCtx} {body : KExpr .anon} {bodyV : VExpr}
@@ -282,7 +282,7 @@ theorem TrKExprS.openFVar
 
 /-- Entry-depth specialization used by the three production binder branches. -/
 theorem TrKExprS.openFVarZero
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     {Delta : KVLCtx} {decl : VLocalDecl}
@@ -297,4 +297,4 @@ theorem TrKExprS.openFVarZero
       (KExpr.instantiateRevSpec body #[.mkFVar fv name] 0) bodyV :=
   H.openFVar .zero rfl (by simpa using hfresh) (by simpa using hbound)
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/BinderScopes.lean b/Ix/Kernel/Verify/Infer/BinderScopes.lean
similarity index 98%
rename from Ix/Tc/Verify/Infer/BinderScopes.lean
rename to Ix/Kernel/Verify/Infer/BinderScopes.lean
index a5d9281f2..64999d9ea 100644
--- a/Ix/Tc/Verify/Infer/BinderScopes.lean
+++ b/Ix/Kernel/Verify/Infer/BinderScopes.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.BinderOpening
+import Ix.Kernel.Verify.Infer.BinderOpening
 
 /-!
 # Operational binder scopes for inference
@@ -9,9 +9,9 @@ opening a de Bruijn binder.  This module verifies the production
 extension, walker execution, and the allocation-exhaustion error path.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-- Finite closure needed by a generic recursive method contract when it
 opens `body` with a freshly allocated anonymous-mode fvar.  The fvar id is a
@@ -53,7 +53,7 @@ theorem instRev_whnf_wf_of_resources
           InternUpdateFrame s after) :=
   TcM.runIntern_whnf_wf
     (fun it hwf hsupport => by
-      have post := Ix.Tc.instantiateRev_spec hcollision.expr hbounds.1
+      have post := Ix.Kernel.instantiateRev_spec hcollision.expr hbounds.1
         hbounds.2.2 hreach hwf hsupport.expr
       exact ⟨post.1, post.2.1,
         hsupport.of_expr_univs post.2.2
@@ -78,7 +78,7 @@ theorem instRev_whnf_eval_of_resources
       InternUpdateFrame s after :=
   TcM.runIntern_whnf_eval
     (fun it hwf hsupport => by
-      have post := Ix.Tc.instantiateRev_spec hcollision.expr hbounds.1
+      have post := Ix.Kernel.instantiateRev_spec hcollision.expr hbounds.1
         hbounds.2.2 hreach hwf hsupport.expr
       exact ⟨post.1, post.2.1,
         hsupport.of_expr_univs post.2.2
@@ -374,4 +374,4 @@ theorem withLctxScope_openBinder_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/CacheShell.lean b/Ix/Kernel/Verify/Infer/CacheShell.lean
similarity index 99%
rename from Ix/Tc/Verify/Infer/CacheShell.lean
rename to Ix/Kernel/Verify/Infer/CacheShell.lean
index e9166c92e..52a8e40d6 100644
--- a/Ix/Tc/Verify/Infer/CacheShell.lean
+++ b/Ix/Kernel/Verify/Infer/CacheShell.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq
+import Ix.Kernel.Verify.DefEq
 
 /-!
 # Inference cache shell
@@ -9,7 +9,7 @@ partitions and for the full/infer-only miss paths, including partial errors
 before any result is cached.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -217,4 +217,4 @@ theorem inferWith_inferOnlyMiss_error
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/CacheSoundness.lean b/Ix/Kernel/Verify/Infer/CacheSoundness.lean
similarity index 97%
rename from Ix/Tc/Verify/Infer/CacheSoundness.lean
rename to Ix/Kernel/Verify/Infer/CacheSoundness.lean
index 620b3ebc9..54061b764 100644
--- a/Ix/Tc/Verify/Infer/CacheSoundness.lean
+++ b/Ix/Kernel/Verify/Infer/CacheSoundness.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Dispatcher
+import Ix.Kernel.Verify.Infer.Dispatcher
 
 /-!
 # Inference cache soundness
@@ -10,7 +10,7 @@ finite expression collision freedom, suffix transport, and the concrete
 uncached typing result before mutating either cache partition.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -90,7 +90,7 @@ private theorem missTail_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars)
     {Delta : KVLCtx} {before s : TcState .anon} {inferOnly : Bool}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {key : Address × Address}
     (hmatch : model.keys.Matches trProj world before Delta source key)
     (hsourceSupport : support source)
@@ -151,7 +151,7 @@ theorem inferWith_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta
       source sourceV) :
@@ -241,7 +241,7 @@ theorem infer_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta
       source sourceV) :
@@ -272,7 +272,7 @@ theorem nextInfer_wf
       (kernelCacheSemantics model.keys trProj) trProj world support
       model.keys.uvars methods) :
     forall {Delta : KVLCtx} {s : TcState .anon} {source : KExpr .anon}
-        {sourceV : Lean4Lean.VExpr},
+        {sourceV : Ix.Theory.Named.VExpr},
       support source ->
       TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
         sourceV ->
@@ -287,4 +287,4 @@ theorem nextInfer_wf
 
 end UncachedInference.Context
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/Callbacks.lean b/Ix/Kernel/Verify/Infer/Callbacks.lean
similarity index 92%
rename from Ix/Tc/Verify/Infer/Callbacks.lean
rename to Ix/Kernel/Verify/Infer/Callbacks.lean
index fe79547e2..849a4183c 100644
--- a/Ix/Tc/Verify/Infer/Callbacks.lean
+++ b/Ix/Kernel/Verify/Infer/Callbacks.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Literals
+import Ix.Kernel.Verify.Infer.Literals
 
 /-!
 # Inference callback contracts
@@ -9,7 +9,7 @@ and the already-closed direct WHNF implementation used by `ensureSortDirect`
 and `ensureForallDirect`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace DirectWhnf
 
@@ -36,7 +36,7 @@ theorem inferCall_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : support source)
     (htr : TrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV) :
@@ -53,7 +53,7 @@ theorem isDefEqCall_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     (haSupport : support a) (hbSupport : support b)
     (ha : TrKExprS world.venv uvars world.nameOf trProj Delta a va)
     (hb : TrKExprS world.venv uvars world.nameOf trProj Delta b vb) :
@@ -66,4 +66,4 @@ theorem isDefEqCall_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/CheapBeta.lean b/Ix/Kernel/Verify/Infer/CheapBeta.lean
similarity index 98%
rename from Ix/Tc/Verify/Infer/CheapBeta.lean
rename to Ix/Kernel/Verify/Infer/CheapBeta.lean
index 6675d9765..f7feb33a0 100644
--- a/Ix/Tc/Verify/Infer/CheapBeta.lean
+++ b/Ix/Kernel/Verify/Infer/CheapBeta.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Infer.BinderScopes
-import Ix.Tc.Verify.Whnf.Beta.Meaning
-import Ix.Tc.Verify.Whnf.Structural.ApplicationCongruence
+import Ix.Kernel.Verify.Infer.BinderScopes
+import Ix.Kernel.Verify.Whnf.Beta.Meaning
+import Ix.Kernel.Verify.Whnf.Structural.ApplicationCongruence
 
 /-!
 # Audited cheap beta reduction
@@ -12,7 +12,7 @@ invariant.  The Theory-level beta meaning is intentionally a separate layer;
 the operational theorem here cannot silently assume it.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM.BetaPeel
 
@@ -215,7 +215,7 @@ theorem KExpr.cheapBetaReduceResult_meaning
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     (theory : WhnfTheory trProj world uvars) {Delta : KVLCtx}
     (hDelta : KVLCtx.WF world.venv uvars Delta)
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV)
     (hbounds : WalkerRequest.Bounds (.cheapBeta source)) :
@@ -459,4 +459,4 @@ theorem cheapBeta_whnf_wf
 
 end RunAssumptions
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/Constants.lean b/Ix/Kernel/Verify/Infer/Constants.lean
similarity index 96%
rename from Ix/Tc/Verify/Infer/Constants.lean
rename to Ix/Kernel/Verify/Infer/Constants.lean
index 11b35141d..d40014ef9 100644
--- a/Ix/Tc/Verify/Infer/Constants.lean
+++ b/Ix/Kernel/Verify/Infer/Constants.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Infer.LeafCases
-import Ix.Tc.Verify.Whnf.Delta.StableCache
+import Ix.Kernel.Verify.Infer.LeafCases
+import Ix.Kernel.Verify.Whnf.Delta.StableCache
+
+open Ix.Theory (VLevel)
 
 /-!
 # Constant inference
@@ -12,7 +14,7 @@ closure must derive it from declaration admission rather than silently
 upgrading raw syntax correspondence.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -101,7 +103,7 @@ handled separately because production deliberately skips the walker there. -/
 theorem instantiatedType
     {trProj : RawProjRel} {world : VerifyWorld}
     {id : KId .anon} {c : KConst .anon} {name : Lean.Name}
-    {ci : Lean4Lean.VConstant}
+    {ci : Ix.Theory.Named.VConstant}
     (h : TrustedConstRel trProj world id c name ci)
     (htype : TrKExprS world.venv ci.uvars world.nameOf trProj []
       c.ty ci.type)
@@ -138,7 +140,7 @@ theorem instantiatedType
       have hlevels := hciType.levelWF (by trivial)
       simpa only [hzero] using hlevels.1
     have hinst : ci.type.instL [] = ci.type := by
-      simpa [Lean4Lean.VLevel.params] using hciLevels.instL_id
+      simpa [Ix.Theory.VLevel.params] using hciLevels.instL_id
     simpa [hinst] using
       htypeDelta.trKExpr world.venvWF.ordered theory.literalWF
         theory.projections.wf hDelta
@@ -169,7 +171,7 @@ theorem inferUncached_const_wf
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {id : KId .anon}
     {us : Array (KUniv .anon)} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hfault : TcM.LazyFaultPreserves
       (WhnfStateInv layer semantics trProj world support uvars Delta))
@@ -219,7 +221,7 @@ theorem inferUncached_const_wf
           sourceCi.type.instL (us.toList.map KUniv.toVLevel), ?_, ?_⟩
         · exact hrel.instantiatedType htype theory hus harity hspec
             resources hIfinal.2.1.wf
-        · exact Lean4Lean.VEnv.HasType.const hlookup
+        · exact Ix.Theory.Named.VEnv.HasType.const hlookup
             (by
               intro level hlevel
               obtain ⟨source, hsourceLevel, rfl⟩ := List.mem_map.1 hlevel
@@ -230,4 +232,4 @@ theorem inferUncached_const_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/Dispatcher.lean b/Ix/Kernel/Verify/Infer/Dispatcher.lean
similarity index 94%
rename from Ix/Tc/Verify/Infer/Dispatcher.lean
rename to Ix/Kernel/Verify/Infer/Dispatcher.lean
index 5642ebc49..e73864fa0 100644
--- a/Ix/Tc/Verify/Infer/Dispatcher.lean
+++ b/Ix/Kernel/Verify/Infer/Dispatcher.lean
@@ -1,11 +1,11 @@
-import Ix.Tc.Verify.Infer.Applications
-import Ix.Tc.Verify.Infer.Constants
-import Ix.Tc.Verify.Infer.ForallTypes
-import Ix.Tc.Verify.Infer.LambdaTypes
-import Ix.Tc.Verify.Infer.LeafCases
-import Ix.Tc.Verify.Infer.LetTypes
-import Ix.Tc.Verify.Infer.Literals
-import Ix.Tc.Verify.Infer.ProjectionTypes
+import Ix.Kernel.Verify.Infer.Applications
+import Ix.Kernel.Verify.Infer.Constants
+import Ix.Kernel.Verify.Infer.ForallTypes
+import Ix.Kernel.Verify.Infer.LambdaTypes
+import Ix.Kernel.Verify.Infer.LeafCases
+import Ix.Kernel.Verify.Infer.LetTypes
+import Ix.Kernel.Verify.Infer.Literals
+import Ix.Kernel.Verify.Infer.ProjectionTypes
 
 /-!
 # Uncached inference dispatcher
@@ -21,7 +21,7 @@ the syntax-only census facts.  This avoids requiring facts about arbitrary
 invalid states merely to state recursive inference closure.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- State-indexed resources for the legacy de Bruijn-variable inference
 branch.  The translated source establishes that the lookup is in range; this
@@ -104,7 +104,7 @@ theorem inferUncached_wf
     (context : UncachedInference.Context initial program requests semantics
       trProj world support uvars)
     {Delta : KVLCtx} {s : TcState .anon} {inferOnly : Bool}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV) :
@@ -167,4 +167,4 @@ theorem inferUncached_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/ForallTypes.lean b/Ix/Kernel/Verify/Infer/ForallTypes.lean
similarity index 95%
rename from Ix/Tc/Verify/Infer/ForallTypes.lean
rename to Ix/Kernel/Verify/Infer/ForallTypes.lean
index efe4228c5..1f0b3435b 100644
--- a/Ix/Tc/Verify/Infer/ForallTypes.lean
+++ b/Ix/Kernel/Verify/Infer/ForallTypes.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Infer.SortTypes
-import Ix.Tc.Verify.Infer.BinderScopes
+import Ix.Kernel.Verify.Infer.SortTypes
+import Ix.Kernel.Verify.Infer.BinderScopes
+
+open Ix.Theory (VLevel)
 
 /-!
 # Forall inference
@@ -10,7 +12,7 @@ opening and cleanup, the simplifying universe `imax` constructor, and final
 expression interning.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite result closure for `forall` inference.  The premise ranges only
 over the finite universe support of the run, rather than over all levels. -/
@@ -29,7 +31,7 @@ private theorem inferForallTail_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {fv : FVarId} {deps : List FVarId}
-    {tyV bodyV input1 : Lean4Lean.VExpr} {bodyOpen : KExpr .anon}
+    {tyV bodyV input1 : Ix.Theory.Named.VExpr} {bodyOpen : KExpr .anon}
     {u1 : KUniv .anon}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
@@ -78,7 +80,7 @@ private theorem inferForallTail_wf
           hbodyTy.defeqU_r world.venvWF hIfinal.2.1.wf hu2.inputEq
       have hforall : world.venv.HasType uvars Delta.toCtx
           (.forallE tyV bodyV) (.sort (.imax u1.toVLevel u2.toVLevel)) :=
-        Lean4Lean.VEnv.HasType.forallE htySort (by simpa using hbodySort)
+        Ix.Theory.Named.VEnv.HasType.forallE htySort (by simpa using hbodySort)
       have hlevelEq := hu1.mkIMax_equiv hcollision hu2
       have hsortEq : world.venv.IsDefEqU uvars Delta.toCtx
           (.sort (.imax u1.toVLevel u2.toVLevel))
@@ -104,7 +106,7 @@ theorem inferUncached_all_wf
     {s : TcState .anon} {inferOnly : Bool}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
     {ty body : KExpr .anon} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hresources : SortComponentResources support)
@@ -155,4 +157,4 @@ theorem inferUncached_all_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/FunctionTypes.lean b/Ix/Kernel/Verify/Infer/FunctionTypes.lean
similarity index 94%
rename from Ix/Tc/Verify/Infer/FunctionTypes.lean
rename to Ix/Kernel/Verify/Infer/FunctionTypes.lean
index bc62597b0..6e0dd64a6 100644
--- a/Ix/Tc/Verify/Infer/FunctionTypes.lean
+++ b/Ix/Kernel/Verify/Infer/FunctionTypes.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Callbacks
+import Ix.Kernel.Verify.Infer.Callbacks
 
 /-!
 # Function-type exposure for inference
@@ -9,7 +9,7 @@ fallback expose the same semantic view, while retaining finite support for
 the returned domain and codomain.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite-support descent needed after a supported Pi is exposed.  Run
 support is intentionally not globally constructor-closed. -/
@@ -23,7 +23,7 @@ the caller's quotient translation of the original inferred type to the exact
 structural translations of the returned concrete components. -/
 def ForallView (trProj : RawProjRel) (world : VerifyWorld)
     (support : RunSupport) (uvars : Nat) (Delta : KVLCtx)
-    (inputV : Lean4Lean.VExpr) (dom cod : KExpr .anon) : Prop :=
+    (inputV : Ix.Theory.Named.VExpr) (dom cod : KExpr .anon) : Prop :=
   exists domV codV,
     support dom /\ support cod /\
     world.venv.IsType uvars Delta.toCtx domV /\
@@ -39,7 +39,7 @@ private theorem ensureForallWhnf_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {input : KExpr .anon}
-    {inputCoreV inputV : Lean4Lean.VExpr}
+    {inputCoreV inputV : Ix.Theory.Named.VExpr}
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
     (hinputSupport : support input)
@@ -76,7 +76,7 @@ theorem ensureForallDirect_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {input : KExpr .anon}
-    {inputV : Lean4Lean.VExpr}
+    {inputV : Ix.Theory.Named.VExpr}
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
     (hinputSupport : support input)
@@ -103,4 +103,4 @@ theorem ensureForallDirect_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/LambdaTypes.lean b/Ix/Kernel/Verify/Infer/LambdaTypes.lean
similarity index 95%
rename from Ix/Tc/Verify/Infer/LambdaTypes.lean
rename to Ix/Kernel/Verify/Infer/LambdaTypes.lean
index f543138d0..89e931f15 100644
--- a/Ix/Tc/Verify/Infer/LambdaTypes.lean
+++ b/Ix/Kernel/Verify/Infer/LambdaTypes.lean
@@ -1,7 +1,7 @@
-import Ix.Tc.Verify.Infer.CheapBeta
-import Ix.Tc.Verify.Infer.BinderClosing
-import Ix.Tc.Verify.Infer.SortTypes
-import Ix.Tc.Verify.Whnf.Iota.ArgumentExecution
+import Ix.Kernel.Verify.Infer.CheapBeta
+import Ix.Kernel.Verify.Infer.BinderClosing
+import Ix.Kernel.Verify.Infer.SortTypes
+import Ix.Kernel.Verify.Whnf.Iota.ArgumentExecution
 
 /-!
 # Lambda inference
@@ -11,7 +11,7 @@ validation, fresh-fvar binder opening, recursive body inference, cheap beta,
 singleton abstraction, anonymous Pi reconstruction, and scoped cleanup.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite closure for the anonymous Pi nodes produced from supported body
 types.  The body argument ranges only over the finite run support. -/
@@ -29,7 +29,7 @@ private theorem inferLambdaTail_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {fv : FVarId} {deps : List FVarId}
-    {ty bodyOpen : KExpr .anon} {tyV bodyV : Lean4Lean.VExpr}
+    {ty bodyOpen : KExpr .anon} {tyV bodyV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hcheap : CheapBetaResources support)
     (habstract : SingletonAbstractionResources support)
@@ -106,7 +106,7 @@ private theorem inferLambdaTail_wf
         (tyV :: Delta.toCtx) bodyV bodyTyV := by
       simpa [KVLCtx.toCtx] using hbodyTy
     exact ⟨hresultSupport, .forallE tyV bodyTyV, hresultTr,
-      Lean4Lean.VEnv.HasType.lam htySort hbodyTy'⟩
+      Ix.Theory.Named.VEnv.HasType.lam htySort hbodyTy'⟩
   · intro _ _ _
     trivial
 
@@ -118,7 +118,7 @@ private theorem inferLambdaScoped_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
-    {ty body : KExpr .anon} {tyV bodyV : Lean4Lean.VExpr}
+    {ty body : KExpr .anon} {tyV bodyV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hcheap : CheapBetaResources support)
     (habstract : SingletonAbstractionResources support)
@@ -177,7 +177,7 @@ theorem inferUncached_lam_wf
     {s : TcState .anon} {inferOnly : Bool}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
     {ty body : KExpr .anon} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hsorts : SortComponentResources support)
@@ -225,4 +225,4 @@ theorem inferUncached_lam_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/LeafCases.lean b/Ix/Kernel/Verify/Infer/LeafCases.lean
similarity index 96%
rename from Ix/Tc/Verify/Infer/LeafCases.lean
rename to Ix/Kernel/Verify/Infer/LeafCases.lean
index 9ae843527..ca6077b2d 100644
--- a/Ix/Tc/Verify/Infer/LeafCases.lean
+++ b/Ix/Kernel/Verify/Infer/LeafCases.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Infer.CacheShell
+import Ix.Kernel.Verify.Infer.CacheShell
+
+open Ix.Theory (VLevel)
 
 /-!
 # Non-recursive inference cases
@@ -9,7 +11,7 @@ proofs separate makes the semantic boundary explicit: each branch must
 produce a supported concrete type together with a Theory typing derivation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -55,7 +57,7 @@ theorem inferUncached_sort_wf
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {u : KUniv .anon} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hcollision : support.CollisionFree)
     (hresultSupport : support (KExpr.mkSort (KUniv.mkSucc u)))
@@ -79,7 +81,7 @@ theorem inferUncached_sort_wf
             world.venvWF.ordered theory.literalWF theory.projections.wf
             hI.2.1.wf
         · simpa only [KUniv.toVLevel_mkSucc] using
-            (Lean4Lean.VEnv.HasType.sort hu)
+            (Ix.Theory.Named.VEnv.HasType.sort hu)
       · intro _ _ _
         trivial
 
@@ -95,7 +97,7 @@ theorem inferUncached_var_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {idx : UInt64} {name : Mode.anon.F Name}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
       (.var idx name info) sourceV)
@@ -169,7 +171,7 @@ theorem inferUncached_fvar_wf
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon → RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {fv : FVarId} {name : Mode.anon.F Name}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hsafe : FVarInferSafety layer semantics trProj world support uvars
       Delta)
@@ -206,4 +208,4 @@ theorem inferUncached_fvar_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/LetScopes.lean b/Ix/Kernel/Verify/Infer/LetScopes.lean
similarity index 99%
rename from Ix/Tc/Verify/Infer/LetScopes.lean
rename to Ix/Kernel/Verify/Infer/LetScopes.lean
index b2df97c68..a1abc967a 100644
--- a/Ix/Tc/Verify/Infer/LetScopes.lean
+++ b/Ix/Kernel/Verify/Infer/LetScopes.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.BinderScopes
+import Ix.Kernel.Verify.Infer.BinderScopes
 
 /-!
 # Operational let scopes for inference
@@ -8,9 +8,9 @@ pushes an `ldecl` and translates to a Theory `vlet`.  Keeping its proof
 separate makes that semantic distinction visible at the API boundary.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace TcM
 
@@ -304,4 +304,4 @@ theorem withLctxScope_openLet_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/LetTypes.lean b/Ix/Kernel/Verify/Infer/LetTypes.lean
similarity index 95%
rename from Ix/Tc/Verify/Infer/LetTypes.lean
rename to Ix/Kernel/Verify/Infer/LetTypes.lean
index fe98e4165..bc614b75d 100644
--- a/Ix/Tc/Verify/Infer/LetTypes.lean
+++ b/Ix/Kernel/Verify/Infer/LetTypes.lean
@@ -1,9 +1,9 @@
-import Ix.Tc.Verify.Infer.LetScopes
-import Ix.Tc.Verify.Infer.BinderClosing
-import Ix.Tc.Verify.Infer.Substitution
-import Ix.Tc.Verify.Infer.CheapBeta
-import Ix.Tc.Verify.Infer.SortTypes
-import Ix.Tc.Verify.Whnf.Iota.ArgumentExecution
+import Ix.Kernel.Verify.Infer.LetScopes
+import Ix.Kernel.Verify.Infer.BinderClosing
+import Ix.Kernel.Verify.Infer.Substitution
+import Ix.Kernel.Verify.Infer.CheapBeta
+import Ix.Kernel.Verify.Infer.SortTypes
+import Ix.Kernel.Verify.Whnf.Iota.ArgumentExecution
 
 /-!
 # Let inference
@@ -13,7 +13,7 @@ body inference, singleton abstraction, eager value substitution, cheap beta,
 and scoped cleanup for the production `letE` branch.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -25,7 +25,7 @@ private theorem inferLetTail_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {fv : FVarId} {deps : List FVarId}
     {val bodyOpen : KExpr .anon}
-    {tyV valV bodyV : Lean4Lean.VExpr}
+    {tyV valV bodyV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (habstract : SingletonAbstractionResources support)
     (hsubst : SubstitutionResources support)
@@ -96,7 +96,7 @@ private theorem inferLetScoped_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {name : Mode.anon.F Name}
-    {ty val body : KExpr .anon} {tyV valV bodyV : Lean4Lean.VExpr}
+    {ty val body : KExpr .anon} {tyV valV bodyV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (habstract : SingletonAbstractionResources support)
     (hsubst : SubstitutionResources support)
@@ -154,7 +154,7 @@ theorem inferUncached_let_wf
     {s : TcState .anon} {inferOnly : Bool}
     {name : Mode.anon.F Name}
     {ty val body : KExpr .anon} {nondep : Bool} {info : ExprInfo .anon}
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hsorts : SortComponentResources support)
@@ -225,4 +225,4 @@ theorem inferUncached_let_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/Literals.lean b/Ix/Kernel/Verify/Infer/Literals.lean
similarity index 88%
rename from Ix/Tc/Verify/Infer/Literals.lean
rename to Ix/Kernel/Verify/Infer/Literals.lean
index e3caab00f..039f26d01 100644
--- a/Ix/Tc/Verify/Infer/Literals.lean
+++ b/Ix/Kernel/Verify/Infer/Literals.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Constants
+import Ix.Kernel.Verify.Infer.Constants
 
 /-!
 # Literal inference
@@ -11,7 +11,7 @@ constant accepts an empty universe array.  Those representation obligations
 are therefore exposed explicitly below.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact Theory interpretation of the two primitive-table entries read by
 literal inference.  Trust and address-to-name agreement come from
@@ -35,7 +35,7 @@ theorem nat_tr
     (hcatalog : TrustedCatalogRel trProj world)
     (htable : LiteralPrimitiveTableAgrees world prims) :
     TrKExprS world.venv uvars world.nameOf trProj Delta
-      (KExpr.mkConst prims.nat #[]) Lean4Lean.VExpr.nat := by
+      (KExpr.mkConst prims.nat #[]) Ix.Theory.Named.VExpr.nat := by
   rw [KExpr.mkConst_shape]
   obtain ⟨ci, hlookup⟩ := htable.nat.contains hcatalog
   exact
@@ -49,7 +49,7 @@ theorem string_tr
     (hcatalog : TrustedCatalogRel trProj world)
     (htable : LiteralPrimitiveTableAgrees world prims) :
     TrKExprS world.venv uvars world.nameOf trProj Delta
-      (KExpr.mkConst prims.string #[]) Lean4Lean.VExpr.string := by
+      (KExpr.mkConst prims.string #[]) Ix.Theory.Named.VExpr.string := by
   rw [KExpr.mkConst_shape]
   obtain ⟨ci, hlookup⟩ := htable.string.contains hcatalog
   exact
@@ -83,7 +83,7 @@ theorem inferUncached_nat_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon -> RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {n : Nat} {blob : Address}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (context : LiteralInferContext world support)
     (theory : WhnfTheory trProj world uvars)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
@@ -110,14 +110,14 @@ theorem inferUncached_nat_wf
           TcM.intern_whnf_wf context.collisionFree hsupport)
       · intro result final hresult
         rcases hresult with ⟨hIfinal, rfl, _⟩
-        refine ⟨hsupport, Lean4Lean.VExpr.nat, ?_, ?_⟩
+        refine ⟨hsupport, Ix.Theory.Named.VExpr.nat, ?_, ?_⟩
         · exact (htable.nat_tr hcatalog).trKExpr
             world.venvWF.ordered theory.literalWF theory.projections.wf
             hIfinal.2.1.wf
         · have htype0 : world.venv.HasType uvars []
-              (.natLit n) Lean4Lean.VExpr.nat := by
-            simpa [Lean4Lean.VLCtx.toCtx] using
-              (Lean4Lean.TrExprS.natLit
+              (.natLit n) Ix.Theory.Named.VExpr.nat := by
+            simpa [Ix.Theory.Named.VLCtx.toCtx] using
+              (Ix.Theory.Named.TrExprS.natLit
                 (Us := List.replicate uvars Lean.Name.anonymous) (Δ := [])
                 context.theoryPrimitives hcontains n).2
           exact htype0.weak0 world.venvWF (Γ := Delta.toCtx)
@@ -125,7 +125,7 @@ theorem inferUncached_nat_wf
         trivial
 
 /-- A concrete String literal infers the runtime String constant.  The source
-typing is the full Lean4Lean literal construction, including `Char.ofNat` and
+typing is the full Ix.Theory.Named literal construction, including `Char.ofNat` and
 `String.ofList`; the returned type is still the primitive `String` entry. -/
 theorem inferUncached_str_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
@@ -133,7 +133,7 @@ theorem inferUncached_str_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {inferRec : KExpr .anon -> RecM .anon (KExpr .anon)}
     {inferOnly : Bool} {value : String} {blob : Address}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (context : LiteralInferContext world support)
     (theory : WhnfTheory trProj world uvars)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
@@ -160,15 +160,15 @@ theorem inferUncached_str_wf
           TcM.intern_whnf_wf context.collisionFree hsupport)
       · intro result final hresult
         rcases hresult with ⟨hIfinal, rfl, _⟩
-        refine ⟨hsupport, Lean4Lean.VExpr.string, ?_, ?_⟩
+        refine ⟨hsupport, Ix.Theory.Named.VExpr.string, ?_, ?_⟩
         · exact (htable.string_tr hcatalog).trKExpr
             world.venvWF.ordered theory.literalWF theory.projections.wf
             hIfinal.2.1.wf
         · have htype0 : world.venv.HasType uvars []
-              (.trLiteral (.strVal value)) Lean4Lean.VExpr.string := by
-            simpa [Lean4Lean.VExpr.string, Lean4Lean.VLCtx.toCtx,
+              (.trLiteral (.strVal value)) Ix.Theory.Named.VExpr.string := by
+            simpa [Ix.Theory.Named.VExpr.string, Ix.Theory.Named.VLCtx.toCtx,
               Lean.Literal.typeName] using
-              (Lean4Lean.TrExprS.trLiteral world.venvWF.ordered
+              (Ix.Theory.Named.TrExprS.trLiteral world.venvWF.ordered
                 (Us := List.replicate uvars Lean.Name.anonymous) (Δ := [])
                 context.theoryPrimitives (.strVal value) hcontains).2
           exact htype0.weak0 world.venvWF (Γ := Delta.toCtx)
@@ -177,4 +177,4 @@ theorem inferUncached_str_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/ProjectionClassification.lean b/Ix/Kernel/Verify/Infer/ProjectionClassification.lean
similarity index 97%
rename from Ix/Tc/Verify/Infer/ProjectionClassification.lean
rename to Ix/Kernel/Verify/Infer/ProjectionClassification.lean
index f4d490b6d..5ee091fa3 100644
--- a/Ix/Tc/Verify/Infer/ProjectionClassification.lean
+++ b/Ix/Kernel/Verify/Infer/ProjectionClassification.lean
@@ -1,7 +1,7 @@
 import Init.Data.Range.Lemmas
-import Ix.Tc.Verify.Infer.Constants
-import Ix.Tc.Verify.Infer.ProjectionTelescope
-import Ix.Tc.Verify.Whnf.StructEta.RecursionClassifier
+import Ix.Kernel.Verify.Infer.Constants
+import Ix.Kernel.Verify.Infer.ProjectionTelescope
+import Ix.Kernel.Verify.Whnf.StructEta.RecursionClassifier
 
 /-!
 # Projection result-sort classification
@@ -15,7 +15,7 @@ those intermediate bodies have a structural translation in the caller's
 context.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The exact universe-instantiation request selected when the classifier's
 lookup returns the catalogued inductive declaration.  Other declaration
@@ -194,4 +194,4 @@ theorem inductiveAppIsProp_state_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/ProjectionTelescope.lean b/Ix/Kernel/Verify/Infer/ProjectionTelescope.lean
similarity index 94%
rename from Ix/Tc/Verify/Infer/ProjectionTelescope.lean
rename to Ix/Kernel/Verify/Infer/ProjectionTelescope.lean
index 177ac930d..3a10513b3 100644
--- a/Ix/Tc/Verify/Infer/ProjectionTelescope.lean
+++ b/Ix/Kernel/Verify/Infer/ProjectionTelescope.lean
@@ -1,6 +1,6 @@
 import Init.Data.Range.Lemmas
-import Ix.Tc.Verify.Infer.LetTypes
-import Ix.Tc.Verify.Infer.FunctionTypes
+import Ix.Kernel.Verify.Infer.LetTypes
+import Ix.Kernel.Verify.Infer.FunctionTypes
 
 /-!
 # Projection telescope exposure
@@ -11,7 +11,7 @@ WHNF reducer.  This module proves that both paths expose the same supported
 Theory forall view; the diagnostic string affects only the error payload.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- A concrete argument is admissible for every supported Π view that the
 production peeler may expose from `inputV`.  The universal formulation avoids
@@ -19,8 +19,8 @@ choosing a particular structural translation before WHNF has run; translation
 uniqueness makes all successful views definitionally coherent. -/
 def ProjectionArgumentFits (trProj : RawProjRel) (world : VerifyWorld)
     (support : RunSupport) (uvars : Nat) (Delta : KVLCtx)
-    (inputV : Lean4Lean.VExpr) (arg : KExpr .anon) : Prop :=
-  ∀ {dom cod : KExpr .anon} {domV codV : Lean4Lean.VExpr},
+    (inputV : Ix.Theory.Named.VExpr) (arg : KExpr .anon) : Prop :=
+  ∀ {dom cod : KExpr .anon} {domV codV : Ix.Theory.Named.VExpr},
     support dom → support cod →
     world.venv.IsType uvars Delta.toCtx domV →
     world.venv.IsType uvars (domV :: Delta.toCtx) codV →
@@ -41,7 +41,7 @@ theorem peelProjForall_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {input : KExpr .anon}
-    {inputV : Lean4Lean.VExpr} {err : String}
+    {inputV : Ix.Theory.Named.VExpr} {err : String}
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
     (hinputSupport : support input)
@@ -89,7 +89,7 @@ private theorem substProjForallBody_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
-    {inputV : Lean4Lean.VExpr} {dom body arg : KExpr .anon}
+    {inputV : Ix.Theory.Named.VExpr} {dom body arg : KExpr .anon}
     (theory : WhnfTheory trProj world uvars)
     (hsubst : SubstitutionResources support)
     (hcollision : support.CollisionFree)
@@ -136,7 +136,7 @@ private theorem instantiateProjParamBody_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
-    {current arg : KExpr .anon} {currentV : Lean4Lean.VExpr}
+    {current arg : KExpr .anon} {currentV : Ix.Theory.Named.VExpr}
     {err : String}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
@@ -171,7 +171,7 @@ theorem instantiateProjParamStep_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {args : Array (KExpr .anon)} {i : Nat} (hidx : i < args.size)
-    {current : KExpr .anon} {currentV : Lean4Lean.VExpr}
+    {current : KExpr .anon} {currentV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
@@ -215,14 +215,14 @@ replace any intermediate produced by `subst`. -/
 def ProjectionParameterPlan
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
     (uvars : Nat) (Delta : KVLCtx) (args : Array (KExpr .anon)) :
-    List Nat → Lean4Lean.VExpr → Prop
+    List Nat → Ix.Theory.Named.VExpr → Prop
   | [], _ => True
   | i :: indices, currentV =>
       ∃ hidx : i < args.size,
         support (args[i]'hidx) ∧
         ProjectionArgumentFits trProj world support uvars Delta currentV
           (args[i]'hidx) ∧
-        ∀ {next : KExpr .anon} {nextV : Lean4Lean.VExpr},
+        ∀ {next : KExpr .anon} {nextV : Ix.Theory.Named.VExpr},
           support next →
           TrKExpr world.venv uvars world.nameOf trProj Delta next nextV →
           ProjectionParameterPlan trProj world support uvars Delta args
@@ -242,7 +242,7 @@ theorem instantiateProjParamsList_wf
     (hcollision : support.CollisionFree)
     {args : Array (KExpr .anon)} :
     ∀ (indices : List Nat) {current : KExpr .anon}
-        {currentV : Lean4Lean.VExpr} {s : TcState .anon},
+        {currentV : Ix.Theory.Named.VExpr} {s : TcState .anon},
       support current →
       TrKExpr world.venv uvars world.nameOf trProj Delta current currentV →
       ProjectionParameterPlan trProj world support uvars Delta args indices
@@ -289,7 +289,7 @@ theorem instantiateProjParams_wf
     (hsubst : SubstitutionResources support)
     (hcollision : support.CollisionFree)
     {args : Array (KExpr .anon)} {numParams : Nat}
-    {ctorTy : KExpr .anon} {ctorTyV : Lean4Lean.VExpr}
+    {ctorTy : KExpr .anon} {ctorTyV : Ix.Theory.Named.VExpr}
     (hctorSupport : support ctorTy)
     (hctor : TrKExpr world.venv uvars world.nameOf trProj Delta ctorTy
       ctorTyV)
@@ -314,9 +314,9 @@ theorem instantiateProjParams_wf
 supported Π view of the current constructor-field telescope. -/
 def ProjectionFieldResultFits
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
-    (uvars : Nat) (Delta : KVLCtx) (inputV projectedV : Lean4Lean.VExpr) :
+    (uvars : Nat) (Delta : KVLCtx) (inputV projectedV : Ix.Theory.Named.VExpr) :
     Prop :=
-  ∀ {dom body : KExpr .anon} {domV bodyV : Lean4Lean.VExpr},
+  ∀ {dom body : KExpr .anon} {domV bodyV : Ix.Theory.Named.VExpr},
     support dom → support body →
     world.venv.IsType uvars Delta.toCtx domV →
     world.venv.IsType uvars (domV :: Delta.toCtx) bodyV →
@@ -333,8 +333,8 @@ substitutes; it cannot choose the subsequent telescope result. -/
 structure ProjectionFieldStepPlan
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
     (uvars : Nat) (Delta : KVLCtx) (structId : KId .anon)
-    (field : UInt64) (val : KExpr .anon) (projectedV : Lean4Lean.VExpr)
-    (i : Nat) (currentV : Lean4Lean.VExpr) : Prop where
+    (field : UInt64) (val : KExpr .anon) (projectedV : Ix.Theory.Named.VExpr)
+    (i : Nat) (currentV : Ix.Theory.Named.VExpr) : Prop where
   selected : i = field.toNat →
     ProjectionFieldResultFits trProj world support uvars Delta currentV
       projectedV
@@ -347,7 +347,7 @@ structure ProjectionFieldStepPlan
 intermediate telescope yielded to the surrounding traversal. -/
 def ProjectionFieldActionPost
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
-    (uvars : Nat) (Delta : KVLCtx) (projectedV : Lean4Lean.VExpr) :
+    (uvars : Nat) (Delta : KVLCtx) (projectedV : Ix.Theory.Named.VExpr) :
     ForInStep (KExpr .anon) → Prop
   | .done result =>
       support result ∧ InferPost trProj world uvars Delta projectedV result
@@ -363,7 +363,7 @@ private theorem inferProjectionFieldSort_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
-    {dom : KExpr .anon} {domV : Lean4Lean.VExpr}
+    {dom : KExpr .anon} {domV : Ix.Theory.Named.VExpr}
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hsorts : SortComponentResources support)
     (hdomSupport : support dom)
@@ -388,7 +388,7 @@ private theorem finishSelectedProjectionField_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
-    {inputV projectedV : Lean4Lean.VExpr}
+    {inputV projectedV : Ix.Theory.Named.VExpr}
     {dom body : KExpr .anon}
     (theory : WhnfTheory trProj world uvars)
     (hview : ForallView trProj world support uvars Delta inputV dom body)
@@ -418,7 +418,7 @@ private theorem finishPrecedingProjectionField_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon}
     {structId : KId .anon} {i : Nat} {val : KExpr .anon}
-    {inputV projectedV : Lean4Lean.VExpr}
+    {inputV projectedV : Ix.Theory.Named.VExpr}
     {dom body : KExpr .anon}
     (theory : WhnfTheory trProj world uvars)
     (hsubst : SubstitutionResources support)
@@ -455,7 +455,7 @@ theorem inferProjFieldStep_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {structId : KId .anon} {field : UInt64} {val current : KExpr .anon}
     {isPropStruct : Bool} {i : Nat}
-    {currentV projectedV : Lean4Lean.VExpr}
+    {currentV projectedV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
@@ -532,13 +532,13 @@ production fold immediately. -/
 def ProjectionFieldPlan
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
     (uvars : Nat) (Delta : KVLCtx) (structId : KId .anon)
-    (field : UInt64) (val : KExpr .anon) (projectedV : Lean4Lean.VExpr) :
-    List Nat → Lean4Lean.VExpr → Prop
+    (field : UInt64) (val : KExpr .anon) (projectedV : Ix.Theory.Named.VExpr) :
+    List Nat → Ix.Theory.Named.VExpr → Prop
   | [], _ => True
   | i :: indices, currentV =>
       ProjectionFieldStepPlan trProj world support uvars Delta structId field
           val projectedV i currentV ∧
-        ∀ {next : KExpr .anon} {nextV : Lean4Lean.VExpr},
+        ∀ {next : KExpr .anon} {nextV : Ix.Theory.Named.VExpr},
           support next →
           TrKExpr world.venv uvars world.nameOf trProj Delta next nextV →
           ProjectionFieldPlan trProj world support uvars Delta structId field
@@ -549,7 +549,7 @@ def ProjectionFieldPlan
 last yielded telescope and will be rejected by production as unreachable. -/
 def ProjectionFieldLoopPost
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
-    (uvars : Nat) (Delta : KVLCtx) (projectedV : Lean4Lean.VExpr) :
+    (uvars : Nat) (Delta : KVLCtx) (projectedV : Ix.Theory.Named.VExpr) :
     Option (KExpr .anon) × KExpr .anon → Prop
   | (some result, _) =>
       support result ∧ InferPost trProj world uvars Delta projectedV result
@@ -565,7 +565,7 @@ private theorem inferProjFieldLoopStep_wf
     {Delta : KVLCtx} {s : TcState .anon}
     {structId : KId .anon} {field : UInt64} {val current : KExpr .anon}
     {isPropStruct : Bool} {i : Nat}
-    {currentV projectedV : Lean4Lean.VExpr}
+    {currentV projectedV : Ix.Theory.Named.VExpr}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hcomponents : ForallComponentSupport support)
@@ -619,9 +619,9 @@ theorem inferProjFieldsList_wf
     (hsubst : SubstitutionResources support)
     (hcollision : support.CollisionFree)
     {structId : KId .anon} {field : UInt64} {val : KExpr .anon}
-    {isPropStruct : Bool} {projectedV : Lean4Lean.VExpr} :
+    {isPropStruct : Bool} {projectedV : Ix.Theory.Named.VExpr} :
     ∀ (indices : List Nat) {current : KExpr .anon}
-        {currentV : Lean4Lean.VExpr} {s : TcState .anon},
+        {currentV : Ix.Theory.Named.VExpr} {s : TcState .anon},
       support current →
       TrKExpr world.venv uvars world.nameOf trProj Delta current currentV →
       ProjectionFieldPlan trProj world support uvars Delta structId field val
@@ -671,7 +671,7 @@ theorem inferProjFields_wf
     (hsubst : SubstitutionResources support)
     (hcollision : support.CollisionFree)
     {structId : KId .anon} {field : UInt64} {val ctorTy : KExpr .anon}
-    {isPropStruct : Bool} {ctorTyV projectedV : Lean4Lean.VExpr}
+    {isPropStruct : Bool} {ctorTyV projectedV : Ix.Theory.Named.VExpr}
     (hctorSupport : support ctorTy)
     (hctor : TrKExpr world.venv uvars world.nameOf trProj Delta ctorTy
       ctorTyV)
@@ -703,4 +703,4 @@ theorem inferProjFields_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/ProjectionTypes.lean b/Ix/Kernel/Verify/Infer/ProjectionTypes.lean
similarity index 97%
rename from Ix/Tc/Verify/Infer/ProjectionTypes.lean
rename to Ix/Kernel/Verify/Infer/ProjectionTypes.lean
index 80a1762a7..f1e3cfe9a 100644
--- a/Ix/Tc/Verify/Infer/ProjectionTypes.lean
+++ b/Ix/Kernel/Verify/Infer/ProjectionTypes.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.ProjectionClassification
+import Ix.Kernel.Verify.Infer.ProjectionClassification
 
 /-!
 # Projection inference
@@ -19,7 +19,7 @@ edge, error propagation, and composition with the helper—without treating a
 successful helper execution as semantic evidence by itself.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite child coverage for a supported projection source.  Run support is
 finite and intentionally not closed under arbitrary syntax descent. -/
@@ -66,7 +66,7 @@ structure ConstructorTypingPlan
     (trProj : RawProjRel) (world : VerifyWorld) (support : RunSupport)
     (uvars : Nat) (Delta : KVLCtx) (structId : KId .anon)
     (field : UInt64) (val : KExpr .anon)
-    (projectedV : Lean4Lean.VExpr) (args : Array (KExpr .anon))
+    (projectedV : Ix.Theory.Named.VExpr) (args : Array (KExpr .anon))
     (levels : Array (KUniv .anon)) (numParams : Nat)
     (ctorTy : KExpr .anon) : Prop where
   instantiated : ∀ {instantiated : KExpr .anon},
@@ -81,7 +81,7 @@ structure ConstructorTypingPlan
             ([0:numParams] : _root_.Std.Legacy.Range).step)
           instantiatedV ∧
         ∀ {parameterized : KExpr .anon}
-            {parameterizedV : Lean4Lean.VExpr},
+            {parameterizedV : Ix.Theory.Named.VExpr},
           support parameterized →
           TrKExpr world.venv uvars world.nameOf trProj Delta parameterized
             parameterizedV →
@@ -101,7 +101,7 @@ selection, and the source projection witness. -/
 def DeclarationOracle (trProj : RawProjRel) (world : VerifyWorld)
     (support : RunSupport) (uvars : Nat) : Prop :=
   ∀ {Delta : KVLCtx} {structId headId : KId .anon} {field : UInt64}
-      {val : KExpr .anon} {valV projectedV valTyV reducedTyV : Lean4Lean.VExpr}
+      {val : KExpr .anon} {valV projectedV valTyV reducedTyV : Ix.Theory.Named.VExpr}
       {structName : Lean.Name} {levels : Array (KUniv .anon)}
       {headInfo : ExprInfo .anon} {args : Array (KExpr .anon)}
       {indName : Mode.anon.F Name}
@@ -141,7 +141,7 @@ def WF (semantics : CacheSemantics) (trProj : RawProjRel)
     (world : VerifyWorld) (support : RunSupport) (uvars : Nat) : Prop :=
   ∀ {Delta : KVLCtx} {s : TcState .anon}
       {structId : KId .anon} {field : UInt64} {val valTy : KExpr .anon}
-      {valV projectedV : Lean4Lean.VExpr} {structName : Lean.Name},
+      {valV projectedV : Ix.Theory.Named.VExpr} {structName : Lean.Name},
     world.nameOf structId.addr = some structName →
     TrKExprS world.venv uvars world.nameOf trProj Delta val valV →
     trProj uvars Delta.toCtx structName field.toNat valV projectedV →
@@ -190,7 +190,7 @@ theorem inferProj_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {uvars : Nat} {Delta : KVLCtx}
     {s : TcState .anon} {structId : KId .anon} {field : UInt64}
-    {val valTy : KExpr .anon} {valV projectedV : Lean4Lean.VExpr}
+    {val valTy : KExpr .anon} {valV projectedV : Ix.Theory.Named.VExpr}
     {structName : Lean.Name}
     (theory : WhnfTheory trProj world uvars)
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
@@ -355,7 +355,7 @@ theorem inferUncached_prj_wf
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {inferOnly : Bool}
     {structId : KId .anon} {field : UInt64} {val : KExpr .anon}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hinputs : ProjectionValueSupport support)
     (hprojection : ProjectionInference.WF semantics trProj world support
       uvars)
@@ -380,4 +380,4 @@ theorem inferUncached_prj_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/ScopedLocals.lean b/Ix/Kernel/Verify/Infer/ScopedLocals.lean
similarity index 97%
rename from Ix/Tc/Verify/Infer/ScopedLocals.lean
rename to Ix/Kernel/Verify/Infer/ScopedLocals.lean
index 05d5b0013..627a7e0ab 100644
--- a/Ix/Tc/Verify/Infer/ScopedLocals.lean
+++ b/Ix/Kernel/Verify/Infer/ScopedLocals.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Callbacks
+import Ix.Kernel.Verify.Infer.Callbacks
 
 /-!
 # Scoped local contexts for inference
@@ -9,7 +9,7 @@ and failure.  This module connects the operational cleanup to the ghost
 context used by the verification invariant.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 @[simp] theorem LocalContext.truncate_size (lctx : LocalContext m) :
     lctx.truncate lctx.size = lctx := by
@@ -110,7 +110,7 @@ theorem openFVar
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {before after : TcState .anon}
-    {d : LocalDecl .anon} {vd : Lean4Lean.VLocalDecl}
+    {d : LocalDecl .anon} {vd : Ix.Theory.Named.VLocalDecl}
     {deps : List FVarId}
     (hbefore : WhnfStateInv layer semantics trProj world support uvars
       Delta before)
@@ -140,7 +140,7 @@ theorem closeFVar
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {fv : FVarId} {deps : List FVarId}
-    {vd : Lean4Lean.VLocalDecl} {saved : Nat}
+    {vd : Ix.Theory.Named.VLocalDecl} {saved : Nat}
     (h : WhnfStateInv layer semantics trProj world support uvars
       ((some (fv, deps), vd) :: Delta) s)
     (hsaved : saved = Delta.fvars.length) :
@@ -163,7 +163,7 @@ theorem closeFVarAtEntry
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {before after : TcState .anon}
     {fv : FVarId} {deps : List FVarId}
-    {vd : Lean4Lean.VLocalDecl}
+    {vd : Ix.Theory.Named.VLocalDecl}
     (hbefore : WhnfStateInv layer semantics trProj world support uvars
       Delta before)
     (hafter : WhnfStateInv layer semantics trProj world support uvars
@@ -238,4 +238,4 @@ theorem withLctxScope_eq (x : RecM .anon α)
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/SortTypes.lean b/Ix/Kernel/Verify/Infer/SortTypes.lean
similarity index 92%
rename from Ix/Tc/Verify/Infer/SortTypes.lean
rename to Ix/Kernel/Verify/Infer/SortTypes.lean
index ad66c499a..f7d5b5dc3 100644
--- a/Ix/Tc/Verify/Infer/SortTypes.lean
+++ b/Ix/Kernel/Verify/Infer/SortTypes.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Infer.Callbacks
+import Ix.Kernel.Verify.Infer.Callbacks
+
+open Ix.Theory (VLevel)
 
 /-!
 # Sort exposure for inference
@@ -8,7 +10,7 @@ an inferred type.  This module proves the syntactic sort fast path and the
 direct-WHNF fallback against one shared semantic view.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite descent resources for a supported concrete sort.  Smart universe
 constructors compare addresses throughout their argument subtrees and use
@@ -24,7 +26,7 @@ def SortComponentResources (support : RunSupport) : Prop :=
 connects the caller's quotient translation to the selected Theory sort and
 retains exactly the subtree support needed by later smart constructors. -/
 structure SortView (world : VerifyWorld) (support : RunSupport)
-    (uvars : Nat) (Delta : KVLCtx) (inputV : Lean4Lean.VExpr)
+    (uvars : Nat) (Delta : KVLCtx) (inputV : Ix.Theory.Named.VExpr)
     (result : KUniv .anon) : Prop where
   sizeBound : result.size < UInt64.size
   subtermSupport : ∀ x, KUniv.Sub x result → support.univ x
@@ -34,7 +36,7 @@ structure SortView (world : VerifyWorld) (support : RunSupport)
 
 theorem SortView.rootSupport
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
-    {Delta : KVLCtx} {inputV : Lean4Lean.VExpr} {result : KUniv .anon}
+    {Delta : KVLCtx} {inputV : Ix.Theory.Named.VExpr} {result : KUniv .anon}
     (h : SortView world support uvars Delta inputV result) :
     support.univ result :=
   h.subtermSupport result .refl
@@ -46,7 +48,7 @@ comparison made by the smart constructor is covered by the two finite
 subterm footprints retained in the sort views. -/
 theorem mkIMax_equiv
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
-    {DeltaA DeltaB : KVLCtx} {inputA inputB : Lean4Lean.VExpr}
+    {DeltaA DeltaB : KVLCtx} {inputA inputB : Ix.Theory.Named.VExpr}
     {a b : KUniv .anon}
     (hcf : support.CollisionFree)
     (ha : SortView world support uvars DeltaA inputA a)
@@ -73,7 +75,7 @@ private theorem ensureSortWhnf_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {input : KExpr .anon}
-    {inputCoreV inputV : Lean4Lean.VExpr}
+    {inputCoreV inputV : Ix.Theory.Named.VExpr}
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hresources : SortComponentResources support)
     (hinputSupport : support input)
@@ -109,7 +111,7 @@ theorem ensureSortDirect_wf
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {support : RunSupport} {uvars : Nat}
     {Delta : KVLCtx} {s : TcState .anon} {input : KExpr .anon}
-    {inputV : Lean4Lean.VExpr}
+    {inputV : Ix.Theory.Named.VExpr}
     (hwhnf : DirectWhnf.WFAt semantics trProj world support uvars)
     (hresources : SortComponentResources support)
     (hinputSupport : support input)
@@ -136,4 +138,4 @@ theorem ensureSortDirect_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Infer/Substitution.lean b/Ix/Kernel/Verify/Infer/Substitution.lean
similarity index 93%
rename from Ix/Tc/Verify/Infer/Substitution.lean
rename to Ix/Kernel/Verify/Infer/Substitution.lean
index c3308fc95..0a74bf1b1 100644
--- a/Ix/Tc/Verify/Infer/Substitution.lean
+++ b/Ix/Kernel/Verify/Infer/Substitution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Callbacks
+import Ix.Kernel.Verify.Infer.Callbacks
 
 /-!
 # Recursive-result substitution resources
@@ -8,7 +8,7 @@ callback.  Since that body is dynamic, this module exposes the walker through
 a finite support closure rather than static request-list membership.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite operational and arithmetic closure for substitution over
 supported inputs. -/
@@ -44,7 +44,7 @@ theorem whnf_wf
     hbodySupport hargSupport
   apply TcM.WF.mono
     (TcM.runIntern_whnf_wf (fun it hwf hcover => by
-      have post := Ix.Tc.subst_spec hcollision.expr hbody harg hcut hargsz
+      have post := Ix.Kernel.subst_spec hcollision.expr hbody harg hcut hargsz
         hreach hwf hcover.expr
       exact ⟨post.1, post.2.1,
         hcover.of_expr_univs post.2.2
@@ -57,4 +57,4 @@ theorem whnf_wf
 
 end SubstitutionResources
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/InferDefEq/Closure.lean b/Ix/Kernel/Verify/InferDefEq/Closure.lean
similarity index 96%
rename from Ix/Tc/Verify/InferDefEq/Closure.lean
rename to Ix/Kernel/Verify/InferDefEq/Closure.lean
index 58527e9ed..830f4759b 100644
--- a/Ix/Tc/Verify/InferDefEq/Closure.lean
+++ b/Ix/Kernel/Verify/InferDefEq/Closure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq.Closure
-import Ix.Tc.Verify.Infer.CacheSoundness
+import Ix.Kernel.Verify.DefEq.Closure
+import Ix.Kernel.Verify.Infer.CacheSoundness
 
 /-!
 # Recursive inference and definitional-equality closure
@@ -10,7 +10,7 @@ universe induction step: both fields may call a strictly smaller method table,
 and neither proof assumes the next table is already sound.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Concrete resources for the inference and DefEq fields of one production
 method-table layer.  The shared proposition context fixes the suffix model,
@@ -66,4 +66,4 @@ theorem closedAt
 
 end InferDefEqClosureContext
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Ingress/AnonStructural.lean b/Ix/Kernel/Verify/Ingress/AnonStructural.lean
similarity index 94%
rename from Ix/Tc/Verify/Ingress/AnonStructural.lean
rename to Ix/Kernel/Verify/Ingress/AnonStructural.lean
index 77f899f4c..0c3cb779e 100644
--- a/Ix/Tc/Verify/Ingress/AnonStructural.lean
+++ b/Ix/Kernel/Verify/Ingress/AnonStructural.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Const
-import Ix.Tc.Verify.Expr
+import Ix.Kernel.Const
+import Ix.Kernel.Verify.Expr
 
 /-!
 # Structural equality for anonymous kernel values
@@ -14,7 +14,7 @@ left-inverse back to the production datatype.  Equality reflected through
 that left-inverse is therefore structural equality, not hash equality.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace AnonStructural
 
 def addressDecidableEq : DecidableEq Address :=
@@ -63,13 +63,13 @@ structure ExprInfo where
   hasFVars : Bool
   deriving DecidableEq
 
-def ExprInfo.ofKernel (info : Ix.Tc.ExprInfo .anon) : ExprInfo :=
+def ExprInfo.ofKernel (info : Ix.Kernel.ExprInfo .anon) : ExprInfo :=
   ⟨info.addr, info.lbr, info.count0, info.hasFVars⟩
 
-def ExprInfo.toKernel (info : ExprInfo) : Ix.Tc.ExprInfo .anon :=
+def ExprInfo.toKernel (info : ExprInfo) : Ix.Kernel.ExprInfo .anon :=
   ⟨info.addr, info.lbr, info.count0, info.hasFVars, (), (), ()⟩
 
-@[simp] theorem ExprInfo.roundtrip (info : Ix.Tc.ExprInfo .anon) :
+@[simp] theorem ExprInfo.roundtrip (info : Ix.Kernel.ExprInfo .anon) :
     (ofKernel info).toKernel = info := by
   cases info
   rfl
@@ -135,13 +135,13 @@ structure RecRule where
   rhs : Expr
   deriving DecidableEq
 
-def RecRule.ofKernel (rule : Ix.Tc.RecRule .anon) : RecRule :=
+def RecRule.ofKernel (rule : Ix.Kernel.RecRule .anon) : RecRule :=
   ⟨rule.fields, Expr.ofKernel rule.rhs⟩
 
-def RecRule.toKernel (rule : RecRule) : Ix.Tc.RecRule .anon :=
+def RecRule.toKernel (rule : RecRule) : Ix.Kernel.RecRule .anon :=
   ⟨(), rule.fields, rule.rhs.toKernel⟩
 
-@[simp] theorem RecRule.roundtrip (rule : Ix.Tc.RecRule .anon) :
+@[simp] theorem RecRule.roundtrip (rule : Ix.Kernel.RecRule .anon) :
     (ofKernel rule).toKernel = rule := by
   cases rule
   simp [ofKernel, toKernel]
@@ -228,4 +228,4 @@ def constDecidableEq : DecidableEq (KConst .anon) :=
   decidableEqOfRoundtrip Const.ofKernel Const.toKernel Const.roundtrip
 
 end AnonStructural
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Ingress/LiteralBlobs.lean b/Ix/Kernel/Verify/Ingress/LiteralBlobs.lean
similarity index 99%
rename from Ix/Tc/Verify/Ingress/LiteralBlobs.lean
rename to Ix/Kernel/Verify/Ingress/LiteralBlobs.lean
index 41aa8c664..4b266d104 100644
--- a/Ix/Tc/Verify/Ingress/LiteralBlobs.lean
+++ b/Ix/Kernel/Verify/Ingress/LiteralBlobs.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Ingress.AnonStructural
-import Ix.Tc.Verify.Ingress.Representation
+import Ix.Kernel.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Ingress.Representation
 
 /-!
 # Serialized literal/blob ingress
@@ -12,7 +12,7 @@ malformed environments demonstrate that the decoder rejects a constant or a
 blob stored under an address that does not commit to its bytes.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace SerializedLiteralBlobs
 
 local instance addressDecidableEq : DecidableEq Address :=
@@ -462,4 +462,4 @@ theorem malformedBlobRejected :
   IxonEnv.serializedDecodeRejected_of_true malformedBlobRejectedNative
 
 end SerializedLiteralBlobs
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Ingress/Representation.lean b/Ix/Kernel/Verify/Ingress/Representation.lean
similarity index 98%
rename from Ix/Tc/Verify/Ingress/Representation.lean
rename to Ix/Kernel/Verify/Ingress/Representation.lean
index 79640e35e..4711d3c26 100644
--- a/Ix/Tc/Verify/Ingress/Representation.lean
+++ b/Ix/Kernel/Verify/Ingress/Representation.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Driver.Enumeration
-import Ix.Tc.Verify.Driver.Serial
-import Ix.Tc.Verify.Whnf.Runtime.LazyIngress
+import Ix.Kernel.Verify.Driver.Enumeration
+import Ix.Kernel.Verify.Driver.Serial
+import Ix.Kernel.Verify.Whnf.Runtime.LazyIngress
 
 /-!
 # Serialized Ixon representation correspondence
@@ -18,7 +18,7 @@ later Rust transport phase; T0 reasons from the pure decoder and the actual
 Lean eager/lazy ingress functions.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace IxonEnv
 
@@ -261,4 +261,4 @@ def SerializedSubjectWF (bytes : ByteArray) (world : VerifyWorld)
   Nonempty (SerializedSubjectCertificate bytes world dependencies assumptions
     lazyRequests)
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Ingress/SerializedBoolean.lean b/Ix/Kernel/Verify/Ingress/SerializedBoolean.lean
similarity index 99%
rename from Ix/Tc/Verify/Ingress/SerializedBoolean.lean
rename to Ix/Kernel/Verify/Ingress/SerializedBoolean.lean
index 3d5cdaac7..fbd208d02 100644
--- a/Ix/Tc/Verify/Ingress/SerializedBoolean.lean
+++ b/Ix/Kernel/Verify/Ingress/SerializedBoolean.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Driver.BooleanAcceptance
-import Ix.Tc.Verify.Ingress.AnonStructural
-import Ix.Tc.Verify.Ingress.Representation
+import Ix.Kernel.Verify.Driver.BooleanAcceptance
+import Ix.Kernel.Verify.Ingress.AnonStructural
+import Ix.Kernel.Verify.Ingress.Representation
 
 /-!
 # Serialized Boolean acceptance
@@ -11,7 +11,7 @@ decoder, erases anonymous-irrelevant metadata, and reconnects the decoded
 source to the existing E3-S semantic world.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace BooleanSerialized
 
 open BooleanEnumerationFixture
@@ -996,4 +996,4 @@ theorem subjectWF :
   ⟨certificate⟩
 
 end BooleanSerialized
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/InstL.lean b/Ix/Kernel/Verify/InstL.lean
similarity index 95%
rename from Ix/Tc/Verify/InstL.lean
rename to Ix/Kernel/Verify/InstL.lean
index a22da5287..e80a4eb37 100644
--- a/Ix/Tc/Verify/InstL.lean
+++ b/Ix/Kernel/Verify/InstL.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Trans
-import Ix.Tc.Verify.InstUniv
+import Ix.Kernel.Verify.Trans
+import Ix.Kernel.Verify.InstUniv
+
+open Ix.Theory (VLevel)
 
 /-!
 # Universe instantiation tracks `VExpr.instL` through the translation
@@ -20,9 +22,9 @@ The collision-freedom and no-wrap side conditions quantify over
 per level).
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLevel VEnv)
+open Ix.Theory.Named (VExpr VEnv)
 
 /-! ### Level occurrences and the reach set -/
 
@@ -207,25 +209,25 @@ private theorem forall₂_toVLevel {us : Array (KUniv .anon)} :
 spine carries only the literal level `.zero`, which `inst` fixes.) -/
 
 private theorem instL_listCharLit (s : List Char) (ls : List VLevel) :
-    (Lean4Lean.VExpr.listCharLit s).instL ls
-      = Lean4Lean.VExpr.listCharLit s := by
+    (Ix.Theory.Named.VExpr.listCharLit s).instL ls
+      = Ix.Theory.Named.VExpr.listCharLit s := by
   induction s with
   | nil => rfl
   | cons c s ih =>
-    show Lean4Lean.VExpr.app (Lean4Lean.VExpr.app _ (Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.natLit c.toNat).instL ls)))
-      ((Lean4Lean.VExpr.listCharLit s).instL ls) = _
-    rw [Lean4Lean.VExpr.instL_natLit, ih]
+    show Ix.Theory.Named.VExpr.app (Ix.Theory.Named.VExpr.app _ (Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.natLit c.toNat).instL ls)))
+      ((Ix.Theory.Named.VExpr.listCharLit s).instL ls) = _
+    rw [Ix.Theory.Named.VExpr.instL_natLit, ih]
     rfl
 
 private theorem instL_trLiteral (l : Lean.Literal) (ls : List VLevel) :
-    (Lean4Lean.VExpr.trLiteral l).instL ls
-      = Lean4Lean.VExpr.trLiteral l := by
+    (Ix.Theory.Named.VExpr.trLiteral l).instL ls
+      = Ix.Theory.Named.VExpr.trLiteral l := by
   cases l with
-  | natVal v => exact Lean4Lean.VExpr.instL_natLit
+  | natVal v => exact Ix.Theory.Named.VExpr.instL_natLit
   | strVal s =>
-    show Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.listCharLit _).instL ls) = _
+    show Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.listCharLit _).instL ls) = _
     rw [instL_listCharLit]
     rfl
 
@@ -321,7 +323,7 @@ theorem TrKExprS.instL {env : VEnv} {uvars U' : Nat}
       have harr := array_mapM_ok hmus
       have hsize : vs.size = curUs.size := by
         rw [← Array.length_toList, ← Array.length_toList]
-        exact (Lean4Lean.List.Forall₂.length_eq harr).symm
+        exact (Ix.Theory.Named.List.Forall₂.length_eq harr).symm
       have hwf : ∀ w ∈ vs, (KUniv.toVLevel w).WF U' := by
         intro w hw
         obtain ⟨a, _, hab⟩ := forall₂_mem_right harr w (by simpa using hw)
@@ -473,9 +475,9 @@ theorem TrKExprS.instL {env : VEnv} {uvars U' : Nat}
         = .ok (.nat n blob md) := rfl
     rw [hb] at hr
     cases hr
-    rw [show (Lean4Lean.VExpr.natLit n).instL
+    rw [show (Ix.Theory.Named.VExpr.natLit n).instL
           (us.toList.map KUniv.toVLevel)
-        = Lean4Lean.VExpr.natLit n from Lean4Lean.VExpr.instL_natLit]
+        = Ix.Theory.Named.VExpr.natLit n from Ix.Theory.Named.VExpr.instL_natLit]
     exact (TrKExprS.nat l1).trKExpr henv.ordered hlit htp.wf
       (wf_instL_size hus hΔ)
   | @str Δ s blob md l1 =>
@@ -488,4 +490,4 @@ theorem TrKExprS.instL {env : VEnv} {uvars U' : Nat}
     exact (TrKExprS.str l1).trKExpr henv.ordered hlit htp.wf
       (wf_instL_size hus hΔ)
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/InstUniv.lean b/Ix/Kernel/Verify/InstUniv.lean
similarity index 99%
rename from Ix/Tc/Verify/InstUniv.lean
rename to Ix/Kernel/Verify/InstUniv.lean
index 2dff7aa99..c3f2e2d1e 100644
--- a/Ix/Tc/Verify/InstUniv.lean
+++ b/Ix/Kernel/Verify/InstUniv.lean
@@ -1,13 +1,13 @@
-import Ix.Tc.Verify.Subst
-import Ix.Tc.Verify.Monad
-import Ix.Tc.Verify.Level
+import Ix.Kernel.Verify.Subst
+import Ix.Kernel.Verify.Monad
+import Ix.Kernel.Verify.Level
 
 /-!
 # `instantiateUnivParams` memo-soundness
 
 The last of the five expression walkers: universe-parameter substitution
 with per-call address-keyed memoization (`TcM.instUnivInner`,
-`Ix/Tc/Monad.lean`). Unlike the four `WalkM` siblings this one runs over
+`Ix/Kernel/Monad.lean`). Unlike the four `WalkM` siblings this one runs over
 `TcM` — `StateT (HashMap Address (KExpr m)) (TcM m)` — so its soundness
 statement is the first composition of the walker kit with the EStateM
 Hoare kernel (`TcM.WF`): the intern table lives inside `TcState.env`,
@@ -30,11 +30,11 @@ Scope: anon mode, matching the sibling masters (`internKey = addr`,
 `eraseMeta = id`, exact spec equality).
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap)
 open EStateM (Result)
-open Lean4Lean (VLevel)
+open Ix.Theory (VLevel)
 
 /-! ### The pure spec -/
 
diff --git a/Ix/Tc/Verify/Knot.lean b/Ix/Kernel/Verify/Knot.lean
similarity index 99%
rename from Ix/Tc/Verify/Knot.lean
rename to Ix/Kernel/Verify/Knot.lean
index f09d54e96..a4fda3c5c 100644
--- a/Ix/Tc/Verify/Knot.lean
+++ b/Ix/Kernel/Verify/Knot.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf
+import Ix.Kernel.Verify.Whnf
 
 /-!
 # Verification of the recursive method knot
@@ -18,7 +18,7 @@ K1 supplies the four WHNF fields and K2 supplies inference and definitional
 equality.  No theorem below assumes the recursive table is already closed.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -353,4 +353,4 @@ theorem runRec_wfAt
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Level.lean b/Ix/Kernel/Verify/Level.lean
similarity index 98%
rename from Ix/Tc/Verify/Level.lean
rename to Ix/Kernel/Verify/Level.lean
index d4f2e486f..3dfb8d4b5 100644
--- a/Ix/Tc/Verify/Level.lean
+++ b/Ix/Kernel/Verify/Level.lean
@@ -1,16 +1,13 @@
-import Ix.Tc.Level
+import Ix.Kernel.Level
 import Batteries.Recycling.RBTree.Lemmas
-import Lean4Lean.Theory.VLevel
+import Ix.Theory.Named.VLevel
 
 /-!
-# Level slice: `KUniv` soundness against `Lean4Lean.Theory.VLevel`
+# Universe soundness against `Ix.Theory.VLevel`
 
-The first verification slice. This file is also the lean4lean-interop
-spike. Interop outcome (2026-07-21): proof files are **classic** (no `module` header) —
-a `module` file cannot import the classic-import lean4lean dep at all
-(`cannot import non-`module` … from `module``), while classic files import
-module-system `Ix.Tc` fine and see its `@[expose]` bodies. The sanity
-`rfl`-lemmas below certify the cross-boundary unfolding.
+These proofs use classic imports to combine the named specification's helper
+lemmas with the exposed production definitions in `Ix.Kernel`. The `rfl`
+lemmas below verify unfolding across that module boundary.
 
 `KUniv` and `VLevel` align constructor-for-constructor (both carry
 positional params), so the translation `toVLevel` is a total structural
@@ -21,23 +18,22 @@ the headline theorems state that the kernel's `univEq`/`univGeq` decide
 compared pair (the `CollisionFree` pilot: `==` on `KUniv` is Blake3
 address equality, sound only up to hash collisions).
 
-Status: the slice is **sorry-free** — the full chain `univEq_sound` /
-`univGeq_sound` ← `normalizeLevel_eval` ← the 4-way `normalizeAux_eval`
-keystone + `subsumption_eval` (upstream's `Verify/Level.lean:545` is
-still a live sorry there; proven here via the pure per-key model and a
-lex (path length, constant-after-var) strong induction) is closed,
-conditional only on addr-faithfulness and the UInt64 no-wrap bounds.
+The proofs of `univEq_sound` and `univGeq_sound` contain no proof holes.
+They use `normalizeLevel_eval`, the four cases of `normalizeAux_eval`, and
+`subsumption_eval`, with address faithfulness and UInt64 bounds as explicit
+hypotheses. Subsumption is proved using a pure model of each key and strong
+induction on path length and the constant contribution after a variable.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VLevel)
+open Ix.Theory (VLevel)
 
 variable {m : Mode}
 
 namespace KUniv
 
-/-- Translate a kernel level to the lean4lean theory's `VLevel`.
+/-- Translate a kernel level to the shared theory's `VLevel`.
     Structure-preserving; addresses and display names are dropped
     (`VLevel` is the fully anonymous mathematical object). -/
 def toVLevel : KUniv m → VLevel
@@ -72,7 +68,7 @@ def eraseMeta : KUniv m → KUniv .anon
   | param => rfl
 
 /-! Interop sanity checks: these unfold `@[expose]` bodies from
-`Ix.Tc.Level` (smart constructors through `Id.run`) against `VLevel`
+`Ix.Kernel.Level` (smart constructors through `Id.run`) against `VLevel`
 constructors from the classic-import dep — the interop spike proper. -/
 
 theorem toVLevel_mkZero : (mkZero (m := m)).toVLevel = .zero := rfl
@@ -118,15 +114,11 @@ theorem KUniv.toVLevel_of_isZero {v : KUniv m} (h : v.isZero = true) :
 
 /-! ### Denotation of the canonical form
 
-Port of the upstream denotation layer (lean4lean `Verify/Level.lean`,
-`evalParam`/`Node.eval`/`evalPath`/`NormLevel.eval`), leaner here because
-params are positional (no `ls : List Name` plumbing — `evalParam` *is*
-`VLevel.eval`'s param case) but with a genuinely new obligation class: Ix
-stores offsets/constants as `UInt64`, so the normalization bookkeeping's
-`+ 1`s carry no-wrap side conditions, threaded as size bounds
-(`k.toNat + l.size < UInt64.size`). An in-memory `KUniv` can never
-violate them; a 2⁶⁴-succ tower genuinely would wrap and mis-normalize —
-the hypotheses are load-bearing, not pedantry. -/
+This adapts the denotation layer in `Ix.Theory.Named.Verify.Level` to
+positional parameters: `evalParam` is the parameter case of `VLevel.eval`.
+Ix stores offsets and constants as `UInt64`, so additions also require
+bounds preventing wraparound, such as `k.toNat + l.size < UInt64.size`.
+Those bounds are explicit hypotheses throughout the normalization proof. -/
 
 namespace Level
 
@@ -281,7 +273,7 @@ private theorem foldl_max_le {α : Type _} {l : List α} {f : α → Nat}
   | nil => simp
   | cons a l ih =>
     rw [List.foldl_cons, ih, Nat.max_le]
-    simp [List.forall_mem_cons, and_assoc]
+    simp [and_assoc]
 
 theorem NormNode.eval_le {ρ : List Nat} {n : NormNode} {x : Nat} :
     n.eval ρ ≤ x ↔ n.constant.toNat ≤ x ∧ ∀ v ∈ n.vars, v.eval ρ ≤ x := by
@@ -450,14 +442,16 @@ theorem EvalPaths.one_le {ρ : List Nat} {path : Path} {n : Nat}
 private theorem imax_max (a b c : Nat) :
     Lean.Nat.imax a (max b c) = max (Lean.Nat.imax a b) (Lean.Nat.imax a c) := by
   by_cases hb : b = 0 <;> by_cases hc : c = 0 <;>
-    simp [Lean.Nat.imax, hb, hc, Nat.max_eq_max, Nat.max_eq_zero_iff] <;> omega
+    simp [Lean.Nat.imax, hb, hc, Nat.max_eq_max, Nat.max_eq_zero_iff]
+  all_goals omega
 
 /-- `imax(a, imax(b, c)) = max(imax(a, c), imax(b, c))` — the semantic
     content of the `normalizeImaxImax` rewrite. -/
 private theorem imax_imax (a b c : Nat) :
     Lean.Nat.imax a (Lean.Nat.imax b c) = max (Lean.Nat.imax a c) (Lean.Nat.imax b c) := by
   by_cases hc : c = 0 <;> by_cases hb : b = 0 <;>
-    simp [Lean.Nat.imax, hb, hc, Nat.max_eq_max, Nat.max_eq_zero_iff] <;> omega
+    simp [Lean.Nat.imax, hb, hc, Nat.max_eq_max, Nat.max_eq_zero_iff]
+  all_goals omega
 
 /-! #### Insert-eval lemmas -/
 
@@ -738,7 +732,7 @@ private theorem normalizeAux_eval' {ρ : List Nat} :
   | .imax u (.zero b_ad) ad, path, k, acc, hk, hp => by
     simp only [normalizeAux]
     rw [NormLevel.addConst_eval hp]
-    simp [KUniv.toVLevel, VLevel.eval, Lean.Nat.imax]
+    simp [KUniv.toVLevel, VLevel.eval, VLevel.natIMax]
   | .imax u (.succ v b_ad) ad, path, k, acc, hk, hp => by
     have hk1 : (k + 1).toNat = k.toNat + 1 :=
       toNat_add_one (by simp [KUniv.size] at hk; omega)
@@ -928,7 +922,7 @@ private theorem normalizeImaxDispatch_eval' {ρ : List Nat} :
   | a, .zero b_ad, path, k, acc, hk, hp => by
     simp only [normalizeImaxDispatch]
     rw [NormLevel.addConst_eval hp]
-    simp [KUniv.toVLevel, VLevel.eval, Lean.Nat.imax]
+    simp [KUniv.toVLevel, VLevel.eval, VLevel.natIMax]
   | a, .succ v b_ad, path, k, acc, hk, hp => by
     have hsza := KUniv.size_pos a
     have hk1 : (k + 1).toNat = k.toNat + 1 :=
@@ -1182,7 +1176,7 @@ theorem subsumption_eq_model (acc : NormLevel) :
   rw [processEntry]
   refine forIn_id_eq_foldl _ _ _ _ ?_
   rintro ⟨p2, n2⟩ hmem2 n1
-  simp only [letFun, subsumeStep]
+  simp only [subsumeStep]
   split
   · split
     · split
@@ -1789,7 +1783,7 @@ theorem varsOnPath_subsumption {l : NormLevel} (hl : VarsOnPath l) :
       (P := fun (n1f : NormNode) => ∀ v ∈ n1f.vars, v ∈ n1₀.vars) _ _ _ ?_ ?_
     · exact fun v hv => hv
     rintro ⟨p2, n2⟩ hmem2 n1cur hcur v hv
-    simp only [match_id_ite, match_id_bind_unit] at hv
+    simp only [match_id_ite] at hv
     split at hv
     · split at hv
       · split at hv
@@ -2335,8 +2329,7 @@ private theorem le_subsumptionModel_eval {ρ : List Nat} {l : NormLevel}
   exact ⟨CC (p1.length + 1) p1 n1₀ hf (Nat.lt_succ_self _) hnz,
     fun v hv => V (p1.length + 1) p1 n1₀ hf (Nat.lt_succ_self _) hnz v hv⟩
 
-/-- **Fresh** (upstream's live sorry, lean4lean `Verify/Level.lean:545`):
-    the subsumption pass drops only dominated contributions. Needs the
+/-- The subsumption pass drops only dominated contributions. Needs the
     var-placement invariant (stated raw; defeq to `VarsOnPath l`): the
     `maxVarOffset + 1` zeroing branch is justified by a var of the *same*
     entry whose active index contributes ≥ 1 — for raw maps it is
@@ -2400,7 +2393,7 @@ theorem KUniv.isSemanticZero_eq_false {m : Mode} {u : KUniv m}
   rw [KUniv.isSemanticZero, Bool.or_eq_false_iff]
   refine ⟨?_, ?_⟩
   · cases u <;> simp_all [KUniv.isZero, KUniv.toVLevel,
-      Lean4Lean.VLevel.eval]
+      Ix.Theory.VLevel.eval]
   · rw [Bool.eq_false_iff, ne_eq, List.all_eq_true]
     intro hall
     have hzero : Level.NormLevel.eval ρ (Level.normalizeLevel u) = 0 :=
@@ -2417,7 +2410,7 @@ theorem KUniv.toVLevel_equiv_zero_of_isSemanticZero {m : Mode} {u : KUniv m}
     (hu : u.size < UInt64.size) (hzero : u.isSemanticZero = true) :
     KUniv.toVLevel u ≈ .zero := by
   rw [KUniv.isSemanticZero, Bool.or_eq_true] at hzero
-  refine Lean4Lean.VLevel.equiv_def.mpr fun ρ => ?_
+  refine Ix.Theory.VLevel.equiv_def.mpr fun ρ => ?_
   show _ = 0
   rcases hzero with h | h
   · rw [KUniv.toVLevel_of_isZero h]; rfl
@@ -2455,7 +2448,7 @@ theorem normLevelLe_sound {u v : KUniv m}
     universe-equality decision procedure accepts, the translations are
     semantically equal under every parameter assignment. Conditional on
     addr-faithfulness of the compared pair (the `u == v` fast path at
-    Ix/Tc/Level.lean:426 — discharged through the `CollisionFree` pilot)
+    Ix/Kernel/Level.lean:426 — discharged through the `CollisionFree` pilot)
     and the UInt64 no-wrap size bounds. -/
 theorem univEq_sound {u v : KUniv m} (hinj : u.AddrFaithful v)
     (hu : u.size < UInt64.size) (hv : v.size < UInt64.size)
@@ -2468,7 +2461,7 @@ theorem univEq_sound {u v : KUniv m} (hinj : u.AddrFaithful v)
 
 /-- **Soundness of `univGeq`** (headline, Level slice): if the kernel
     accepts `u ≥ v`, then `⟦v⟧ρ ≤ ⟦u⟧ρ` for every assignment. All three
-    disjuncts of Ix/Tc/Level.lean:430 discharged: the addr fast path via
+    disjuncts of Ix/Kernel/Level.lean:430 discharged: the addr fast path via
     addr-faithfulness, `v.isZero` via `VLevel.zero_le`, and the canonical
     order via `normLevelLe_sound`. -/
 theorem univGeq_sound {u v : KUniv m} (hinj : u.AddrFaithful v)
@@ -2482,7 +2475,7 @@ theorem univGeq_sound {u v : KUniv m} (hinj : u.AddrFaithful v)
 
 /-! ### Simplifying smart constructors: `mkMax`/`mkIMax` soundness
 
-`substUniv` (universe instantiation, `Ix/Tc/Monad.lean`) rebuilds with
+`substUniv` (universe instantiation, `Ix/Kernel/Monad.lean`) rebuilds with
 the SIMPLIFYING `mkMax`/`mkIMax` (Lean/Rust parity), so its Theory
 correspondence is an equivalence `≈`, never a syntactic equality. This
 block proves the two constructors sound wrt `VLevel.eval`, conditional
@@ -2979,4 +2972,4 @@ theorem toVLevel_mkIMax_wf {n : Nat} {a b : KUniv m}
 
 end KUniv
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Monad.lean b/Ix/Kernel/Verify/Monad.lean
similarity index 98%
rename from Ix/Tc/Verify/Monad.lean
rename to Ix/Kernel/Verify/Monad.lean
index b49e3b0a0..0d1789cd7 100644
--- a/Ix/Tc/Verify/Monad.lean
+++ b/Ix/Kernel/Verify/Monad.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Knot
+import Ix.Kernel.Knot
 
 /-!
 # EStateM Hoare kernel for `TcM`
@@ -6,7 +6,7 @@ import Ix.Tc.Knot
 The verification's Hoare kernel, core form. `TcM m = EStateM (TcError m)
 (TcState m)` is **non-backtracking**: state written before a throw survives
 `tryCatch` (cache inserts, consumed fuel — load-bearing Rust parity, see
-Ix/Tc/Monad.lean's module doc). So unlike lean4lean's `M.WF` (StateT over
+Ix/Kernel/Monad.lean's module doc). So unlike the named specification's `M.WF` (StateT over
 `Except`, where errors discard state and `throw := nofun`), the triple here
 constrains **both outcomes**: an invariant `I` holds on the post-state of
 success *and* error, `Q` on success, `E` on error (default trivial — most
@@ -18,7 +18,7 @@ immutable catalog and a growing trusted semantic environment; the combinator
 lemmas below carry over verbatim.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 variable {m : Mode}
 
@@ -246,4 +246,4 @@ theorem TcM.tick.wf {I : TcState m → Prop}
   · exact TcM.WF.throw fun _ => ⟨rfl, rfl⟩
   · exact TcM.WF.set (fun hI => hfuel _ hI) (fun _ => rfl)
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/NatFixture.lean b/Ix/Kernel/Verify/NatFixture.lean
similarity index 98%
rename from Ix/Tc/Verify/NatFixture.lean
rename to Ix/Kernel/Verify/NatFixture.lean
index 70c7df3b5..d70bb7426 100644
--- a/Ix/Tc/Verify/NatFixture.lean
+++ b/Ix/Kernel/Verify/NatFixture.lean
@@ -1,6 +1,8 @@
-import Ix.Tc.Verify.Run
-import Ix.Tc.Verify.Whnf
-import Ix.Tc.Verify.Whnf.Structural.BetaBoundary
+import Ix.Kernel.Verify.Run
+import Ix.Kernel.Verify.Whnf
+import Ix.Kernel.Verify.Whnf.Structural.BetaBoundary
+
+open Ix.Theory (VLevel)
 
 /-!
 # G2a ambient-Nat fixture
@@ -11,7 +13,7 @@ inductive/constructor kinds, while the Theory model contains the semantic
 constants those entries denote.  The constants are installed through
 object-language `VDecl.axiom` steps; those are ordinary constructors of the
 Theory judgment, not new Lean axioms.  This is deliberately an ambient model:
-it does not claim an eliminator or pretend that Lean4Lean's still-opaque
+it does not claim an eliminator or pretend that Ix.Theory.Named's still-opaque
 `VEnv.addInduct` has been verified.
 
 The fixture then promotes one ordinary axiom whose type is `Nat` and leaves a
@@ -27,9 +29,9 @@ walker family, and a non-empty `ExecutionRequests` certificate for the exact
 same request list.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VConstant VConstVal VDecl VEnv VExpr VLevel)
+open Ix.Theory.Named (VConstant VConstVal VDecl VEnv VExpr)
 
 namespace AmbientNat
 
@@ -51,7 +53,7 @@ def iotaId : KId .anon := ⟨iotaAddress, ()⟩
 def natName : Lean.Name := `Nat
 def zeroName : Lean.Name := `Nat.zero
 def succName : Lean.Name := `Nat.succ
-def goodName : Lean.Name := `Ix.Tc.Verify.ambientNatWitness
+def goodName : Lean.Name := `Ix.Kernel.Verify.ambientNatWitness
 
 def info (addr : Address) : ExprInfo .anon where
   addr := addr
@@ -1189,7 +1191,7 @@ theorem warmCache_cannotResolvePending (prims : Primitives .anon) :
 
 /-- G4's formal acceptance witness contains both the fresh and nonempty warm
 states, transported provenance, and pending-declaration isolation. The
-executable failed-then-valid regression lives in `Tests.Ix.Tc.CheckTests`. -/
+executable failed-then-valid regression lives in `Tests.Ix.Kernel.CheckTests`. -/
 theorem cacheAcceptance (prims : Primitives .anon) :
     KernelStateWF whnfSemantics RawProjRel.none worldGood support
         (state prims) ∧
@@ -1242,7 +1244,7 @@ theorem betaArg_tr :
 theorem betaA_type :
     worldGood.venv.HasType 0 [] (.const natName [])
       (.sort (.succ .zero)) := by
-  exact Lean4Lean.VEnv.HasType.const (env := worldGood.venv)
+  exact Ix.Theory.Named.VEnv.HasType.const (env := worldGood.venv)
     (U := 0) (Γ := []) (ci := natConstant) (ls := [])
     (by simpa [worldGood, goodEnv, goodName, natName] using natEnv_nat)
     (by intro l hl; simp at hl) rfl
@@ -1250,12 +1252,12 @@ theorem betaA_type :
 theorem betaBody_type :
     worldGood.venv.HasType 0 [(.const natName [])] (.bvar 0)
       (.const natName []) := by
-  exact Lean4Lean.VEnv.HasType.bvar .zero
+  exact Ix.Theory.Named.VEnv.HasType.bvar .zero
 
 theorem betaArg_type :
     worldGood.venv.HasType 0 [] (.const zeroName [])
       (.const natName []) := by
-  exact Lean4Lean.VEnv.HasType.const (env := worldGood.venv)
+  exact Ix.Theory.Named.VEnv.HasType.const (env := worldGood.venv)
     (U := 0) (Γ := []) (ci := zeroConstant) (ls := [])
     (by simpa [worldGood, goodEnv, goodName, zeroName] using natEnv_zero)
     (by intro l hl; simp at hl) rfl
@@ -3316,12 +3318,12 @@ theorem structuralNatLit_type (n : Nat) :
   | succ n ih =>
       have hsucc : worldGood.venv.HasType 0 [] (.const succName [])
           (.forallE (.const natName []) (.const natName [])) := by
-        exact Lean4Lean.VEnv.HasType.const (env := worldGood.venv)
+        exact Ix.Theory.Named.VEnv.HasType.const (env := worldGood.venv)
           (U := 0) (Γ := []) (ci := succConstant) (ls := [])
           (by simpa [worldGood, goodEnv, goodName, succName] using natEnv_succ)
           (by intro l hl; simp at hl) rfl
-      simpa [Lean4Lean.VExpr.inst, VExpr.natLit, VExpr.natSucc, succName] using
-        Lean4Lean.VEnv.HasType.app hsucc ih
+      simpa [Ix.Theory.Named.VExpr.inst, VExpr.natLit, VExpr.natSucc, succName] using
+        Ix.Theory.Named.VEnv.HasType.app hsucc ih
 
 /-- The finite Nat world supplies the uniform literal/projection facts needed
 to compose arbitrary structural trace meanings. -/
@@ -3331,7 +3333,7 @@ def structuralWhnfTheory : WhnfTheory RawProjRel.none worldGood 0 where
     cases literal with
     | natVal n => exact ⟨_, structuralNatLit_type n⟩
     | strVal value =>
-        simp [Lean4Lean.VEnv.ContainsLits, Lean4Lean.VEnv.contains,
+        simp [Ix.Theory.Named.VEnv.ContainsLits, Ix.Theory.Named.VEnv.contains,
           worldGood, goodEnv, natEnv, natEnv₂, natEnv₁, goodName,
           natName, zeroName, succName] at hliteral
   projections := RawProjRel.none_ok worldGood.venv 0
@@ -3343,15 +3345,15 @@ theorem structuralBetaSource_tr :
       betaSource
       (.app (.lam (.const natName []) (.bvar 0)) (.const zeroName [])) := by
   rw [betaSource, betaLam, KExpr.mkApp_shape, KExpr.mkLam_shape]
-  exact .app (Lean4Lean.VEnv.HasType.lam betaA_type betaBody_type)
+  exact .app (Ix.Theory.Named.VEnv.HasType.lam betaA_type betaBody_type)
     betaArg_type (.lam ⟨_, betaA_type⟩ betaTy_tr betaBody_tr) betaArg_tr
 
 theorem structuralBetaSource_type :
     worldGood.venv.HasType 0 []
       (.app (.lam (.const natName []) (.bvar 0)) (.const zeroName []))
       (.const natName []) := by
-  simpa [Lean4Lean.VExpr.inst] using Lean4Lean.VEnv.HasType.app
-    (Lean4Lean.VEnv.HasType.lam betaA_type betaBody_type) betaArg_type
+  simpa [Ix.Theory.Named.VExpr.inst] using Ix.Theory.Named.VEnv.HasType.app
+    (Ix.Theory.Named.VEnv.HasType.lam betaA_type betaBody_type) betaArg_type
 
 theorem structuralBetaSource_constructed : KExpr.Constructed betaSource := by
   unfold betaSource betaLam betaBody
@@ -5053,7 +5055,7 @@ theorem appStuckHead_tr :
 theorem appStuckHead_type :
     worldGood.venv.HasType 0 [] (.const succName [])
       (.forallE (.const natName []) (.const natName [])) := by
-  exact Lean4Lean.VEnv.HasType.const (env := worldGood.venv)
+  exact Ix.Theory.Named.VEnv.HasType.const (env := worldGood.venv)
     (U := 0) (Γ := []) (ci := succConstant) (ls := [])
     (by simpa [worldGood, goodEnv, goodName, succName] using natEnv_succ)
     (by intro l hl; simp at hl) rfl
@@ -5141,13 +5143,13 @@ its source-translation premise impossible.  This identity interpretation is
 nonempty and closed under every structural translation operation. -/
 namespace ProjectionFallback
 
-def projectionName : Lean.Name := `Ix.Tc.Verify.projectionFallback
+def projectionName : Lean.Name := `Ix.Kernel.Verify.projectionFallback
 
 def projectionRel : RawProjRel :=
   fun _ _ _ _ value result => result = value
 
 theorem projectionRel_ok :
-    TrProjOK Lean4Lean.VEnv.empty 0 projectionRel := by
+    TrProjOK Ix.Theory.Named.VEnv.empty 0 projectionRel := by
   refine {
     weakN := ?_
     instN := ?_
@@ -5223,8 +5225,8 @@ def theory : WhnfTheory projectionRel world 0 where
   literalWF := by
     intro literal hliteral
     cases literal <;>
-      simp [Lean4Lean.VEnv.ContainsLits, Lean4Lean.VEnv.contains,
-        Lean4Lean.VEnv.empty, world]
+      simp [Ix.Theory.Named.VEnv.ContainsLits, Ix.Theory.Named.VEnv.contains,
+        Ix.Theory.Named.VEnv.empty, world]
         at hliteral
   projections := projectionRel_ok
 
@@ -5355,10 +5357,10 @@ theorem multiNatTr (Δ : KVLCtx) :
     (by simpa [worldGood, goodEnv, goodName, natName] using natEnv_nat)
     (by intro l hl; simp at hl) rfl
 
-theorem multiNatType (Γ : List Lean4Lean.VExpr) :
+theorem multiNatType (Γ : List Ix.Theory.Named.VExpr) :
     worldGood.venv.HasType 0 Γ (.const natName [])
       (.sort (.succ .zero)) := by
-  exact Lean4Lean.VEnv.HasType.const (env := worldGood.venv)
+  exact Ix.Theory.Named.VEnv.HasType.const (env := worldGood.venv)
     (U := 0) (Γ := Γ) (ci := natConstant) (ls := [])
     (by simpa [worldGood, goodEnv, goodName, natName] using natEnv_nat)
     (by intro l hl; simp at hl) rfl
@@ -5374,12 +5376,12 @@ theorem multiBetaFunTyTr :
     (multiNatTr [])
     (multiNatTr [(none, .vlam (.const natName []))])
 
-theorem multiBetaFunType (Γ : List Lean4Lean.VExpr) :
+theorem multiBetaFunType (Γ : List Ix.Theory.Named.VExpr) :
     worldGood.venv.HasType 0 Γ
       (.forallE (.const natName []) (.const natName []))
-      (.sort ((Lean4Lean.VLevel.succ .zero).imax
-        (Lean4Lean.VLevel.succ .zero))) :=
-  Lean4Lean.VEnv.HasType.forallE (multiNatType Γ)
+      (.sort ((Ix.Theory.VLevel.succ .zero).imax
+        (Ix.Theory.VLevel.succ .zero))) :=
+  Ix.Theory.Named.VEnv.HasType.forallE (multiNatType Γ)
     (multiNatType ((.const natName []) :: Γ))
 
 theorem multiBetaBodyTr :
@@ -5395,8 +5397,8 @@ theorem multiBetaBodyType :
       [(.const natName []),
         (.forallE (.const natName []) (.const natName []))]
       (.bvar 1) (.forallE (.const natName []) (.const natName [])) := by
-  exact Lean4Lean.VEnv.HasType.bvar
-    (Lean4Lean.Lookup.succ (Lean4Lean.Lookup.zero))
+  exact Ix.Theory.Named.VEnv.HasType.bvar
+    (Ix.Theory.Named.Lookup.succ (Ix.Theory.Named.Lookup.zero))
 
 theorem multiBetaInnerTr :
     TrKExprS worldGood.venv 0 worldGood.nameOf RawProjRel.none
@@ -5417,7 +5419,7 @@ theorem multiBetaInnerType :
       (.lam (.const natName []) (.bvar 1))
       (.forallE (.const natName [])
         (.forallE (.const natName []) (.const natName []))) := by
-  exact Lean4Lean.VEnv.HasType.lam
+  exact Ix.Theory.Named.VEnv.HasType.lam
     (multiNatType
       [(.forallE (.const natName []) (.const natName []))])
     multiBetaBodyType
@@ -5438,18 +5440,18 @@ theorem multiBetaLamType :
       (.forallE (.forallE (.const natName []) (.const natName []))
         (.forallE (.const natName [])
           (.forallE (.const natName []) (.const natName [])))) := by
-  exact Lean4Lean.VEnv.HasType.lam (multiBetaFunType []) multiBetaInnerType
+  exact Ix.Theory.Named.VEnv.HasType.lam (multiBetaFunType []) multiBetaInnerType
 
-def multiBetaApp1V : Lean4Lean.VExpr :=
+def multiBetaApp1V : Ix.Theory.Named.VExpr :=
   .app
     (.lam (.forallE (.const natName []) (.const natName []))
       (.lam (.const natName []) (.bvar 1)))
     (.const succName [])
 
-def multiBetaApp2V : Lean4Lean.VExpr :=
+def multiBetaApp2V : Ix.Theory.Named.VExpr :=
   .app multiBetaApp1V (.const zeroName [])
 
-def multiBetaSourceV : Lean4Lean.VExpr :=
+def multiBetaSourceV : Ix.Theory.Named.VExpr :=
   .app multiBetaApp2V (.const zeroName [])
 
 theorem multiBetaApp1Type :
@@ -5457,13 +5459,13 @@ theorem multiBetaApp1Type :
       (.forallE (.const natName [])
         (.forallE (.const natName []) (.const natName []))) := by
   unfold multiBetaApp1V
-  simpa [Lean4Lean.VExpr.inst] using Lean4Lean.VEnv.HasType.app multiBetaLamType appStuckHead_type
+  simpa [Ix.Theory.Named.VExpr.inst] using Ix.Theory.Named.VEnv.HasType.app multiBetaLamType appStuckHead_type
 
 theorem multiBetaApp2Type :
     worldGood.venv.HasType 0 [] multiBetaApp2V
       (.forallE (.const natName []) (.const natName [])) := by
   unfold multiBetaApp2V
-  simpa [Lean4Lean.VExpr.inst] using Lean4Lean.VEnv.HasType.app multiBetaApp1Type betaArg_type
+  simpa [Ix.Theory.Named.VExpr.inst] using Ix.Theory.Named.VEnv.HasType.app multiBetaApp1Type betaArg_type
 
 theorem multiBetaSourceTr :
     TrKExprS worldGood.venv 0 worldGood.nameOf RawProjRel.none []
@@ -5482,7 +5484,7 @@ theorem multiBetaSourceType :
     worldGood.venv.HasType 0 [] multiBetaSourceV
       (.const natName []) := by
   unfold multiBetaSourceV
-  simpa [Lean4Lean.VExpr.inst] using Lean4Lean.VEnv.HasType.app multiBetaApp2Type betaArg_type
+  simpa [Ix.Theory.Named.VExpr.inst] using Ix.Theory.Named.VEnv.HasType.app multiBetaApp2Type betaArg_type
 
 /-- The one dynamically generated trailing application is a real execution
 request, not an unindexed support assumption. -/
@@ -5715,10 +5717,10 @@ theorem appStuckHead_tr_ctx (Delta : KVLCtx) :
     (by simpa [worldGood, goodEnv, goodName, succName] using natEnv_succ)
     (by intro l hl; simp at hl) rfl
 
-theorem appStuckHead_type_ctx (Gamma : List Lean4Lean.VExpr) :
+theorem appStuckHead_type_ctx (Gamma : List Ix.Theory.Named.VExpr) :
     worldGood.venv.HasType 0 Gamma (.const succName [])
       (.forallE (.const natName []) (.const natName [])) := by
-  exact Lean4Lean.VEnv.HasType.const (env := worldGood.venv)
+  exact Ix.Theory.Named.VEnv.HasType.const (env := worldGood.venv)
     (U := 0) (Γ := Gamma) (ci := succConstant) (ls := [])
     (by simpa [worldGood, goodEnv, goodName, succName] using natEnv_succ)
     (by intro l hl; simp at hl) rfl
@@ -6117,8 +6119,8 @@ theorem changedHeadMeaning :
     WhnfMeaning RawProjRel.none worldGood 0 [] changedHeadSource
       changedHeadRebuilt := by
   exact ⟨_, _, changedHeadSourceTr, changedHeadRebuiltTr,
-    Lean4Lean.VEnv.IsDefEqU.refl
-      ⟨_, Lean4Lean.VEnv.HasType.app appStuckHead_type betaArg_type⟩⟩
+    Ix.Theory.Named.VEnv.IsDefEqU.refl
+      ⟨_, Ix.Theory.Named.VEnv.HasType.app appStuckHead_type betaArg_type⟩⟩
 
 def changedHeadSupport : RunSupport :=
   RunSupport.singleton changedHeadRebuilt
@@ -6333,7 +6335,7 @@ theorem linearRecPartsTrace (prims : Primitives .anon) :
 /-- A concrete two-argument recursor prefix mirroring the descriptor fixture's
 major position.  The argument values are immaterial to pattern matching; the
 count and constant head are not. -/
-def linearRecTheoryPrefix : Lean4Lean.VExpr :=
+def linearRecTheoryPrefix : Ix.Theory.Named.VExpr :=
   .app
     (.app (.const ``Nat.rec []) (.const ``Nat []))
     (.const ``Nat [])
@@ -6344,26 +6346,26 @@ theorem linearRecTheoryPrefix_shape :
   simpa using HeadConstN.app
     (HeadConstN.app (HeadConstN.const (name := ``Nat.rec) []))
 
-/-- The zero branch constructs Lean4Lean's real dependent capture map. -/
+/-- The zero branch constructs Ix.Theory.Named's real dependent capture map. -/
 theorem linearRecZeroPatternMatch :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern ``Nat.rec 2 ``Nat.zero 0).Path →
-          Lean4Lean.VExpr),
-      Lean4Lean.Pattern.Matches
+          Ix.Theory.Named.VExpr),
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern ``Nat.rec 2 ``Nat.zero 0)
-        (.app linearRecTheoryPrefix (Lean4Lean.VExpr.natLit 0))
+        (.app linearRecTheoryPrefix (Ix.Theory.Named.VExpr.natLit 0))
         levels captures :=
   RecursorIotaPattern.matches_natZero linearRecTheoryPrefix_shape
 
 /-- The successor branch constructs a capture map whose constructor argument
 is the canonical predecessor numeral. -/
 theorem linearRecSuccPatternMatch :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern ``Nat.rec 2 ``Nat.succ 1).Path →
-          Lean4Lean.VExpr),
-      Lean4Lean.Pattern.Matches
+          Ix.Theory.Named.VExpr),
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern ``Nat.rec 2 ``Nat.succ 1)
-        (.app linearRecTheoryPrefix (Lean4Lean.VExpr.natLit 3))
+        (.app linearRecTheoryPrefix (Ix.Theory.Named.VExpr.natLit 3))
         levels captures := by
   simpa using (RecursorIotaPattern.matches_natSucc
     (predecessor := 2) linearRecTheoryPrefix_shape)
@@ -6395,7 +6397,7 @@ theorem missingRuleDescriptor_noZeroRule :
 argument retains the final argument in a nonempty typed suffix. -/
 theorem multiBetaMiddleSplit :
     ∃ (priorArgs laterArgs : List (KExpr .anon))
-        (priorV majorV : Lean4Lean.VExpr),
+        (priorV majorV : Ix.Theory.Named.VExpr),
       [appStuckHead, betaArg, betaArg] =
           priorArgs ++ betaArg :: laterArgs ∧
       1 = priorArgs.length ∧
@@ -6432,7 +6434,7 @@ Replacing the through-middle prefix by its own translation reconstructs the
 final application rather than silently returning the prefix. -/
 theorem multiBetaMiddleRebase :
     ∃ (priorArgs laterArgs : List (KExpr .anon))
-        (resultV : Lean4Lean.VExpr),
+        (resultV : Ix.Theory.Named.VExpr),
       laterArgs ≠ [] ∧
       TrKExprS worldGood.venv 0 worldGood.nameOf RawProjRel.none []
         (laterArgs.foldl KExpr.mkApp
@@ -6468,4 +6470,4 @@ theorem acceptance (prims : Primitives .anon) :
 
 end AmbientNat
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Projection/Concrete.lean b/Ix/Kernel/Verify/Projection/Concrete.lean
similarity index 75%
rename from Ix/Tc/Verify/Projection/Concrete.lean
rename to Ix/Kernel/Verify/Projection/Concrete.lean
index 1d6279946..0f7d2eaaf 100644
--- a/Ix/Tc/Verify/Projection/Concrete.lean
+++ b/Ix/Kernel/Verify/Projection/Concrete.lean
@@ -1,17 +1,19 @@
-import Ix.Tc.Verify.Decl
-import Ix.Tc.Verify.Trans
-import Lean4Lean.Verify.Typing.Lemmas
+import Ix.Kernel.Verify.Decl
+import Ix.Kernel.Verify.Trans
+import Ix.Theory.Named.Verify.Typing.Lemmas
+
+open Ix.Theory (VLevel)
 
 /-!
-# Concrete Lean4Lean projection adapter
+# Concrete Ix.Theory.Named projection adapter
 
 Ix keeps projection translation abstract so the checker proofs do not depend
 on one implementation of structure projections.  This module closes that
-boundary with Lean4Lean's registered, recursor-encoded `TrProj` relation.
+boundary with Ix.Theory.Named's registered, recursor-encoded `TrProj` relation.
 
 The field mapping is direct:
 
-* `weakN` uses Lean4Lean's general-depth weakening theorem;
+* `weakN` uses Ix.Theory.Named's general-depth weakening theorem;
 * `instN`, `wf`, `uniq`, and `defeqDFC` consume the corresponding fields of
   `TrProj.structuralLaws`;
 * `instL` uses the named universe-instantiation theorem, whose statement is
@@ -19,24 +21,24 @@ The field mapping is direct:
 * `monoU` instantiates with the identity parameter spine and discharges the
   resulting identities from the source context and projection typing data.
 
-Consequently the adapter inherits Lean4Lean's named
+Consequently the adapter inherits Ix.Theory.Named's named
 `VEnv.WF.registeredStructureHeadInversion` debt through projection uniqueness
 and the existing `VEnv.IsDefEqU.forallE_inv_stratified` /
 `VEnv.IsDefEqU.sort_inv` debts through context-defeq/unique typing; it
 introduces no Ix axiom or pending assumption.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (OnCtx VEnv VExpr VLevel)
+open Ix.Theory.Named (OnCtx VEnv VExpr)
 
 namespace RawProjRel
 
-/-- Lean4Lean's concrete, environment-indexed projection semantics in Ix's
+/-- Ix.Theory.Named's concrete, environment-indexed projection semantics in Ix's
 universe-indexed projection slot. -/
-abbrev lean4Lean (env : VEnv) :=
+abbrev named (env : VEnv) :=
   fun uvars ctx structName field major result =>
-    Lean4Lean.TrProj env uvars ctx structName field major result
+    Ix.Theory.Named.TrProj env uvars ctx structName field major result
 
 private theorem vlevelWF_mono {before after : Nat}
     (hle : before ≤ after) :
@@ -69,15 +71,15 @@ private theorem context_instParams_eq {uvars : Nat} :
       simp only [List.map_cons, context_instParams_eq hctx, htype.instL_id]
 
 /-- A concrete projection remains the same projection when only the available
-universe-parameter budget grows.  Lean4Lean supplies universe instantiation;
+universe-parameter budget grows.  Ix.Theory.Named supplies universe instantiation;
 its typing data proves that instantiating with the original parameter spine is
 the identity on the context, major, and computed result. -/
-private theorem lean4Lean_monoU
+private theorem named_monoU
     {env : VEnv} {before after : Nat} {ctx : List VExpr}
     {structName : Lean.Name} {field : Nat} {major result : VExpr}
     (hle : before ≤ after) (hctx : OnCtx ctx (env.IsType before))
-    (hproj : Lean4Lean.TrProj env before ctx structName field major result) :
-    Lean4Lean.TrProj env after ctx structName field major result := by
+    (hproj : Ix.Theory.Named.TrProj env before ctx structName field major result) :
+    Ix.Theory.Named.TrProj env after ctx structName field major result := by
   have hctxLevels := context_levelWF hctx
   have hlevels : ∀ level ∈ VLevel.params before, level.WF after := by
     intro level hlevel
@@ -86,7 +88,7 @@ private theorem lean4Lean_monoU
   have hmajorWF : VExpr.WF env before ctx major :=
     ⟨_, htheory.majorType⟩
   have hresultWF : VExpr.WF env before ctx result :=
-    (show Lean4Lean.TrProj env before ctx structName field major result from
+    (show Ix.Theory.Named.TrProj env before ctx structName field major result from
       ⟨view, levels, params, hname, htheory⟩).wf hmajorWF
   have hmajorLevels : major.LevelWF before :=
     (htheory.majorType.levelWF hctxLevels).1
@@ -94,19 +96,19 @@ private theorem lean4Lean_monoU
   have hresultLevels : result.LevelWF before :=
     (hresultType.levelWF hctxLevels).1
   have hinst :=
-    (show Lean4Lean.TrProj env before ctx structName field major result from
+    (show Ix.Theory.Named.TrProj env before ctx structName field major result from
       ⟨view, levels, params, hname, htheory⟩).instL hlevels
   rw [context_instParams_eq hctxLevels, hmajorLevels.instL_id,
     hresultLevels.instL_id] at hinst
   exact hinst
 
-/-- Lean4Lean's concrete projection relation satisfies every Ix projection
+/-- Ix.Theory.Named's concrete projection relation satisfies every Ix projection
 capability.  The `uvars` index selects the laws used by ordinary checker
 proofs; universe instantiation and monotonicity remain polymorphic because
 declaration translation crosses universe counts. -/
-theorem lean4Lean_ok (henv : VEnv.WF env) (uvars : Nat) :
-    TrProjOK env uvars (lean4Lean env) := by
-  let laws := Lean4Lean.TrProj.structuralLaws henv
+theorem named_ok (henv : VEnv.WF env) (uvars : Nat) :
+    TrProjOK env uvars (named env) := by
+  let laws := Ix.Theory.Named.TrProj.structuralLaws henv
   refine {
     weakN := ?_
     instN := ?_
@@ -116,7 +118,7 @@ theorem lean4Lean_ok (henv : VEnv.WF env) (uvars : Nat) :
     instL := ?_
     monoU := ?_ }
   · intro Γ Γ' n k s i e e' hlift hproj
-    exact Lean4Lean.TrProj.weakN henv.ordered hlift hproj
+    exact Ix.Theory.Named.TrProj.weakN henv.ordered hlift hproj
   · intro Γ₀ e₀ A₀ k Γ₁ Γ s i e e' htype hinst hproj
     exact laws.termSubstitution htype hinst hproj
   · intro Γ s i e e' hproj hwf
@@ -128,7 +130,7 @@ theorem lean4Lean_ok (henv : VEnv.WF env) (uvars : Nat) :
   · intro U U' levels Γ s i e e' hlevels hproj
     exact hproj.instL hlevels
   · intro U U' Γ s i e e' hle hctx hproj
-    exact lean4Lean_monoU hle hctx hproj
+    exact named_monoU hle hctx hproj
 
 end RawProjRel
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Projection/ConcreteFixture.lean b/Ix/Kernel/Verify/Projection/ConcreteFixture.lean
similarity index 80%
rename from Ix/Tc/Verify/Projection/ConcreteFixture.lean
rename to Ix/Kernel/Verify/Projection/ConcreteFixture.lean
index 1772b64cf..1ee609625 100644
--- a/Ix/Tc/Verify/Projection/ConcreteFixture.lean
+++ b/Ix/Kernel/Verify/Projection/ConcreteFixture.lean
@@ -1,10 +1,10 @@
-import Ix.Tc.Verify.Projection.Concrete
-import Lean4Lean.Tests.ProjectionExpressibility
+import Ix.Kernel.Verify.Projection.Concrete
+import Ix.Theory.Named.Fixtures.ProjectionExpressibility
 
 /-!
 # Production-syntax fixture for the concrete projection relation
 
-This fixture connects an actual Ix `KExpr.mkPrj` node to Lean4Lean's
+This fixture connects an actual Ix `KExpr.mkPrj` node to Ix.Theory.Named's
 universe-polymorphic, dependent `DependentRecord` projection fixture.  The
 major is the leading local variable in the exact Theory context retained by
 the registered structure view; the result is the recursor-encoded key
@@ -16,10 +16,10 @@ environment-indexed `TrProj` witness, and the acceptance theorem packages the
 real adapter laws with that production syntax node.
 -/
 
-namespace Ix.Tc.ConcreteProjectionFixture
+namespace Ix.Kernel.ConcreteProjectionFixture
 
-open Lean4Lean (VExpr VLocalDecl)
-open Lean4Lean.Tests.ProjectionExpressibility
+open Ix.Theory.Named (VExpr VLocalDecl)
+open Ix.Theory.Named.Tests.ProjectionExpressibility
 
 def structureAddress : Address :=
   ⟨⟨Array.replicate 32 64⟩⟩
@@ -34,11 +34,11 @@ theorem nameOf_structure :
   simp [nameOf]
 
 abbrev projectionRel :=
-  Ix.Tc.RawProjRel.lean4Lean dependentRecordEnv
+  Ix.Kernel.RawProjRel.named dependentRecordEnv
 
 theorem projectionLaws :
     TrProjOK dependentRecordEnv 2 projectionRel :=
-  Ix.Tc.RawProjRel.lean4Lean_ok dependentRecordEnv_wf 2
+  Ix.Kernel.RawProjRel.named_ok dependentRecordEnv_wf 2
 
 /-- The Verify compatibility witness exposing the registered key projection
 through the concrete relation used by Ix. -/
@@ -48,7 +48,7 @@ theorem keyProjection :
   exact ⟨dependentRecordView, symbolicLevels, symbolicMajorParams, rfl,
     key_representable⟩
 
-/-- The mixed Ix context corresponding definitionally to Lean4Lean's
+/-- The mixed Ix context corresponding definitionally to Ix.Theory.Named's
 `[major, family, α]` Theory context. -/
 def context : KVLCtx :=
   [(none, .vlam symbolicMajorBinderType),
@@ -72,14 +72,14 @@ theorem sourceConstructed : source.Constructed := by
   exact .prj (.var (by decide))
 
 theorem majorRaw :
-    _root_.Ix.Tc.RawExprRel (uvars := 2) dependentRecordEnv nameOf projectionRel
+    _root_.Ix.Kernel.RawExprRel (uvars := 2) dependentRecordEnv nameOf projectionRel
       symbolicContext major symbolicMajor := by
   unfold major
   rw [KExpr.mkVar_shape]
   exact .var
 
 theorem sourceRaw :
-    _root_.Ix.Tc.RawExprRel (uvars := 2) dependentRecordEnv nameOf projectionRel
+    _root_.Ix.Kernel.RawExprRel (uvars := 2) dependentRecordEnv nameOf projectionRel
       symbolicContext source symbolicKeyResult := by
   unfold source
   rw [KExpr.mkPrj_shape]
@@ -101,11 +101,11 @@ theorem sourceStructural :
   exact .prj nameOf_structure majorStructural keyProjection
 
 /-- The same concrete projection survives an increased universe budget via
-the Ix capability derived from Lean4Lean universe instantiation. -/
+the Ix capability derived from Ix.Theory.Named universe instantiation. -/
 theorem keyProjectionAtThree :
     projectionRel 3 symbolicContext ``DependentRecord 0 symbolicMajor
       symbolicKeyResult :=
-  (Ix.Tc.RawProjRel.lean4Lean_ok dependentRecordEnv_wf 3).monoU
+  (Ix.Kernel.RawProjRel.named_ok dependentRecordEnv_wf 3).monoU
     (by omega) contextWF.toCtx keyProjection
 
 /-- P0's concrete vertical slice: a smart-constructor-built Ix projection is
@@ -114,7 +114,7 @@ boundary, using the real registered projection relation and its complete Ix
 law bundle. -/
 theorem acceptance :
     source.Constructed ∧
-      _root_.Ix.Tc.RawExprRel (uvars := 2) dependentRecordEnv nameOf projectionRel
+      _root_.Ix.Kernel.RawExprRel (uvars := 2) dependentRecordEnv nameOf projectionRel
         symbolicContext source symbolicKeyResult ∧
       TrKExprS dependentRecordEnv 2 nameOf projectionRel context source
         symbolicKeyResult ∧
@@ -124,4 +124,4 @@ theorem acceptance :
   ⟨sourceConstructed, sourceRaw, sourceStructural, projectionLaws,
     keyProjectionAtThree⟩
 
-end Ix.Tc.ConcreteProjectionFixture
+end Ix.Kernel.ConcreteProjectionFixture
diff --git a/Ix/Tc/Verify/RecursiveMethods/CallDomains.lean b/Ix/Kernel/Verify/RecursiveMethods/CallDomains.lean
similarity index 98%
rename from Ix/Tc/Verify/RecursiveMethods/CallDomains.lean
rename to Ix/Kernel/Verify/RecursiveMethods/CallDomains.lean
index d9bd2afa1..82fb4b1b9 100644
--- a/Ix/Tc/Verify/RecursiveMethods/CallDomains.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/CallDomains.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Knot
+import Ix.Kernel.Verify.Knot
 
 /-!
 # Fuel-indexed recursive-method call domains
@@ -21,7 +21,7 @@ is the entire run support; `FiniteSupportBoundary` proves why that special case
 cannot be the final public interface for sort-producing runs.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -255,14 +255,14 @@ theorem methodsN
       calls depth) :
     ∀ n, n ≤ depth →
       Methods.WFAtOn layer semantics trProj world scope uvars (calls n)
-        (Ix.Tc.methodsN (m := .anon) n)
+        (Ix.Kernel.methodsN (m := .anon) n)
   | 0, _ =>
       methodsOut_wfAtOn layer semantics trProj world scope uvars (calls 0)
         (schedule.within 0 (Nat.zero_le depth))
   | n + 1, hn => by
       rw [Methods.methodsN_succ]
       exact schedule.step n (Nat.lt_of_succ_le hn)
-        (Ix.Tc.methodsN (m := .anon) n)
+        (Ix.Kernel.methodsN (m := .anon) n)
         (schedule.methodsN n (Nat.le_trans (Nat.le_succ n) hn))
 
 /-- The contract selected at the schedule's terminal depth. -/
@@ -273,7 +273,7 @@ theorem selected
     (schedule : CallScheduleAt layer semantics trProj world scope uvars
       calls depth) :
     Methods.WFAtOn layer semantics trProj world scope uvars (calls depth)
-      (Ix.Tc.methodsN (m := .anon) depth) :=
+      (Ix.Kernel.methodsN (m := .anon) depth) :=
   schedule.methodsN depth (Nat.le_refl depth)
 
 /-- The method body executed by `TcM.runRec` sits one layer above its
@@ -288,9 +288,9 @@ theorem nextSelected
       calls (depth + 1)) :
     Methods.WFAtOn layer semantics trProj world scope uvars
       (calls (depth + 1))
-      (Methods.next (Ix.Tc.methodsN (m := .anon) depth)) :=
+      (Methods.next (Ix.Kernel.methodsN (m := .anon) depth)) :=
   schedule.step depth (Nat.lt_succ_self depth)
-    (Ix.Tc.methodsN (m := .anon) depth)
+    (Ix.Kernel.methodsN (m := .anon) depth)
     (schedule.methodsN depth (Nat.le_succ depth))
 
 end CallScheduleAt
@@ -479,8 +479,8 @@ theorem runRec_wfAtOn
     TcM.WF (WhnfStateInv layer semantics trProj world scope uvars Delta) s
       (TcM.runRec action) Q E := by
   exact
-    haction (Ix.Tc.methodsN (m := .anon) s.recFuel.toNat) schedule.selected
+    haction (Ix.Kernel.methodsN (m := .anon) s.recFuel.toNat) schedule.selected
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/Closure.lean b/Ix/Kernel/Verify/RecursiveMethods/Closure.lean
similarity index 96%
rename from Ix/Tc/Verify/RecursiveMethods/Closure.lean
rename to Ix/Kernel/Verify/RecursiveMethods/Closure.lean
index 784cab9b3..495ea8a56 100644
--- a/Ix/Tc/Verify/RecursiveMethods/Closure.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/Closure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.InferDefEq.Closure
-import Ix.Tc.Verify.Whnf.Closure
+import Ix.Kernel.Verify.InferDefEq.Closure
+import Ix.Kernel.Verify.Whnf.Closure
 
 /-!
 # Complete recursive method-table closure
@@ -10,7 +10,7 @@ cache stack and one predecessor table before `methodsN` can be justified.
 This module performs that final fixed-universe assembly.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The semantic cache layers beneath K1's outer WHNF and delta layers. -/
 def kernelCacheFallback (keys : WhnfContextKeys) (trProj : RawProjRel) :
@@ -75,4 +75,4 @@ theorem methodsN
 
 end RecursiveMethodClosureContext
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/FiniteSupportBoundary.lean b/Ix/Kernel/Verify/RecursiveMethods/FiniteSupportBoundary.lean
similarity index 98%
rename from Ix/Tc/Verify/RecursiveMethods/FiniteSupportBoundary.lean
rename to Ix/Kernel/Verify/RecursiveMethods/FiniteSupportBoundary.lean
index 19bc4d6b9..3d090864c 100644
--- a/Ix/Tc/Verify/RecursiveMethods/FiniteSupportBoundary.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/FiniteSupportBoundary.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Infer.Dispatcher
+import Ix.Kernel.Verify.Infer.Dispatcher
 
 /-!
 # Finite-support boundary for recursive inference
@@ -15,7 +15,7 @@ interface failure explicit so a recursive-method closure cannot accidentally
 hide it behind an uninhabitable premise.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace FiniteSupportBoundary
 
@@ -95,4 +95,4 @@ theorem SyntaxInferenceResources.no_sort_source
 
 end FiniteSupportBoundary
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/Inference.lean b/Ix/Kernel/Verify/RecursiveMethods/Inference.lean
similarity index 96%
rename from Ix/Tc/Verify/RecursiveMethods/Inference.lean
rename to Ix/Kernel/Verify/RecursiveMethods/Inference.lean
index accfac3e7..523189c36 100644
--- a/Ix/Tc/Verify/RecursiveMethods/Inference.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/Inference.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Infer.CacheSoundness
-import Ix.Tc.Verify.RecursiveMethods.CallDomains
+import Ix.Kernel.Verify.Infer.CacheSoundness
+import Ix.Kernel.Verify.RecursiveMethods.CallDomains
 
 /-!
 # Call-domain inference layer
@@ -16,7 +16,7 @@ contains the all-support `SyntaxInferenceResources` field whose sort clause is
 provably uninhabitable for any finite support containing a sort.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Per-layer resources for production inference.  `current` guards only the
 outer calls proved at this layer; `predecessor` governs recursive back-edges
@@ -30,7 +30,7 @@ structure InferenceCallDomainContext
   theory : WhnfTheory trProj world model.keys.uvars
   references : RecM.TrustedReferences world scope
   uncached : ∀ {Delta : KVLCtx} {s : TcState .anon} {inferOnly : Bool}
-      {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+      {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
     current.infer source →
     TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
       sourceV →
@@ -98,7 +98,7 @@ private theorem missTail_wfOn
     {current predecessor : Methods.CallDomain}
     (context : InferenceCallDomainContext scope model current predecessor)
     {Delta : KVLCtx} {before s : TcState .anon} {inferOnly : Bool}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {key : Address × Address}
     (hmatch : model.keys.Matches trProj world before Delta source key)
     (hcall : current.infer source)
@@ -152,7 +152,7 @@ theorem inferWith_wfOn
     {current predecessor : Methods.CallDomain}
     (context : InferenceCallDomainContext scope model current predecessor)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hcall : current.infer source)
     (hsource : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta
       source sourceV) :
@@ -244,7 +244,7 @@ theorem nextInfer_wfAtOn
       (kernelCacheSemantics model.keys trProj) trProj world scope
       model.keys.uvars predecessor predecessorMethods) :
     ∀ {Delta : KVLCtx} {s : TcState .anon}
-        {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+        {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
       current.infer source →
       TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
         sourceV →
@@ -260,4 +260,4 @@ theorem nextInfer_wfAtOn
 
 end InferenceCallDomainContext
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/Public.lean b/Ix/Kernel/Verify/RecursiveMethods/Public.lean
similarity index 94%
rename from Ix/Tc/Verify/RecursiveMethods/Public.lean
rename to Ix/Kernel/Verify/RecursiveMethods/Public.lean
index bd927fd9c..40ca11952 100644
--- a/Ix/Tc/Verify/RecursiveMethods/Public.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/Public.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.RecursiveMethods.CallDomains
-import Ix.Tc.Verify.RecursiveMethods.Closure
-import Ix.Tc.Verify.RecursiveMethods.ScopedCallDomains
+import Ix.Kernel.Verify.RecursiveMethods.CallDomains
+import Ix.Kernel.Verify.RecursiveMethods.Closure
+import Ix.Kernel.Verify.RecursiveMethods.ScopedCallDomains
 
 /-!
 # Public recursive-method soundness over run-scoped bounded call domains
@@ -18,7 +18,7 @@ finite run to infer a sort and return its successor sort without demanding an
 infinite successor-sort closure.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Legacy globally quantified evidence for one public recursive-method run.
 New public roots consume `ScopedRecursiveMethodRunContext` below.  This type
@@ -93,7 +93,7 @@ theorem wf_legacy
     {world : VerifyWorld} {support : RunSupport}
     (context : RecursiveMethodRunContext initial (TcM.whnf e) requests
       trProj world support)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hcall : (context.calls (initial.recFuel.toNat + 1)).whnf e)
     (hsource : TrKExprS world.venv
       context.proposition.model.keys.uvars world.nameOf trProj Delta e
@@ -112,7 +112,7 @@ theorem wf
     {world : VerifyWorld} {support : RunSupport}
     (context : ScopedRecursiveMethodRunContext initial (TcM.whnf e) requests
       trProj world support)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hcall : (context.calls (initial.recFuel.toNat + 1)).whnf e)
     (hsource : TrKExprS world.venv context.model.keys.uvars world.nameOf
       trProj Delta e sourceV) :
@@ -135,7 +135,7 @@ theorem wf_legacy
     {world : VerifyWorld} {support : RunSupport}
     (context : RecursiveMethodRunContext initial (TcM.infer e) requests
       trProj world support)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hcall : (context.calls (initial.recFuel.toNat + 1)).infer e)
     (hsource : TrKExprS world.venv
       context.proposition.model.keys.uvars world.nameOf trProj Delta e
@@ -154,7 +154,7 @@ theorem wf
     {world : VerifyWorld} {support : RunSupport}
     (context : ScopedRecursiveMethodRunContext initial (TcM.infer e) requests
       trProj world support)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hcall : (context.calls (initial.recFuel.toNat + 1)).infer e)
     (hsource : TrKExprS world.venv context.model.keys.uvars world.nameOf
       trProj Delta e sourceV) :
@@ -177,7 +177,7 @@ theorem wf_legacy
     {world : VerifyWorld} {support : RunSupport}
     (context : RecursiveMethodRunContext initial (TcM.isDefEq a b) requests
       trProj world support)
-    {Delta : KVLCtx} {va vb : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {va vb : Ix.Theory.Named.VExpr}
     (hcall : (context.calls (initial.recFuel.toNat + 1)).isDefEq a b)
     (ha : TrKExprS world.venv context.proposition.model.keys.uvars
       world.nameOf trProj Delta a va)
@@ -198,7 +198,7 @@ theorem wf
     {world : VerifyWorld} {support : RunSupport}
     (context : ScopedRecursiveMethodRunContext initial (TcM.isDefEq a b)
       requests trProj world support)
-    {Delta : KVLCtx} {va vb : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {va vb : Ix.Theory.Named.VExpr}
     (hcall : (context.calls (initial.recFuel.toNat + 1)).isDefEq a b)
     (ha : TrKExprS world.venv context.model.keys.uvars world.nameOf trProj
       Delta a va)
@@ -212,4 +212,4 @@ theorem wf
 
 end TcM.isDefEq
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/ScopedCallDomains.lean b/Ix/Kernel/Verify/RecursiveMethods/ScopedCallDomains.lean
similarity index 96%
rename from Ix/Tc/Verify/RecursiveMethods/ScopedCallDomains.lean
rename to Ix/Kernel/Verify/RecursiveMethods/ScopedCallDomains.lean
index a10318c27..1de663397 100644
--- a/Ix/Tc/Verify/RecursiveMethods/ScopedCallDomains.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/ScopedCallDomains.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.DefEq
-import Ix.Tc.Verify.RecursiveMethods.CallDomains
+import Ix.Kernel.Verify.DefEq
+import Ix.Kernel.Verify.RecursiveMethods.CallDomains
 
 /-!
 # Run-scoped recursive-method call domains
@@ -15,7 +15,7 @@ all-depth/global-model interfaces remain compatibility artifacts and are not
 used to justify the scoped schedule below.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace Methods
 
@@ -129,14 +129,14 @@ theorem methodsN
     (schedule : ScopedCallScheduleAt model layer semantics scope calls depth) :
     ∀ n, n ≤ depth →
       ScopedWFAtOn model layer semantics scope (calls n)
-        (Ix.Tc.methodsN (m := .anon) n)
+        (Ix.Kernel.methodsN (m := .anon) n)
   | 0, _ =>
       methodsOut_scopedWFAtOn model layer semantics scope (calls 0)
         (schedule.within 0 (Nat.zero_le depth))
   | n + 1, hn => by
       rw [Methods.methodsN_succ]
       exact schedule.step n (Nat.lt_of_succ_le hn)
-        (Ix.Tc.methodsN (m := .anon) n)
+        (Ix.Kernel.methodsN (m := .anon) n)
         (schedule.methodsN n (Nat.le_trans (Nat.le_succ n) hn))
 
 theorem selected
@@ -146,7 +146,7 @@ theorem selected
     {scope : RunSupport} {calls : Nat → CallDomain} {depth : Nat}
     (schedule : ScopedCallScheduleAt model layer semantics scope calls depth) :
     ScopedWFAtOn model layer semantics scope (calls depth)
-      (Ix.Tc.methodsN (m := .anon) depth) :=
+      (Ix.Kernel.methodsN (m := .anon) depth) :=
   schedule.methodsN depth (Nat.le_refl depth)
 
 theorem nextSelected
@@ -157,9 +157,9 @@ theorem nextSelected
     (schedule : ScopedCallScheduleAt model layer semantics scope calls
       (depth + 1)) :
     ScopedWFAtOn model layer semantics scope (calls (depth + 1))
-      (Methods.next (Ix.Tc.methodsN (m := .anon) depth)) :=
+      (Methods.next (Ix.Kernel.methodsN (m := .anon) depth)) :=
   schedule.step depth (Nat.lt_succ_self depth)
-    (Ix.Tc.methodsN (m := .anon) depth)
+    (Ix.Kernel.methodsN (m := .anon) depth)
     (schedule.methodsN depth (Nat.le_succ depth))
 
 end ScopedCallScheduleAt
@@ -310,8 +310,8 @@ theorem runRec_scoped_wfAtOn
     TcM.WF (ScopedWhnfStateInv model layer semantics scope Delta) s
       (TcM.runRec action) Q E := by
   exact
-    haction (Ix.Tc.methodsN (m := .anon) s.recFuel.toNat) schedule.selected
+    haction (Ix.Kernel.methodsN (m := .anon) s.recFuel.toNat) schedule.selected
 
 end TcM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/ScopedInference.lean b/Ix/Kernel/Verify/RecursiveMethods/ScopedInference.lean
similarity index 98%
rename from Ix/Tc/Verify/RecursiveMethods/ScopedInference.lean
rename to Ix/Kernel/Verify/RecursiveMethods/ScopedInference.lean
index 74e3a81c8..520ceb5e4 100644
--- a/Ix/Tc/Verify/RecursiveMethods/ScopedInference.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/ScopedInference.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Infer.CacheSoundness
-import Ix.Tc.Verify.RecursiveMethods.ScopedCallDomains
+import Ix.Kernel.Verify.Infer.CacheSoundness
+import Ix.Kernel.Verify.RecursiveMethods.ScopedCallDomains
 
 /-!
 # Run-scoped call-domain inference
@@ -13,7 +13,7 @@ No theorem in this module converts a `ScopedKernelSuffixModel` to the legacy
 globally quantified `KernelSuffixModel`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace InternTable
 
@@ -310,7 +310,7 @@ structure ScopedInferenceCallDomainContext
   theory : WhnfTheory trProj world model.keys.uvars
   references : RecM.TrustedReferences world scope
   uncached : ∀ {Delta : KVLCtx} {s : TcState .anon} {inferOnly : Bool}
-      {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+      {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
     current.infer source →
     TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
       sourceV →
@@ -383,7 +383,7 @@ private theorem missTail_scopedWFOn
     (context : ScopedInferenceCallDomainContext scope model current
       predecessor)
     {Delta : KVLCtx} {before s : TcState .anon} {inferOnly : Bool}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {key : Address × Address}
     (hmatch : model.keys.Matches trProj world before Delta source key)
     (hcall : current.infer source)
@@ -438,7 +438,7 @@ theorem inferWith_scopedWFOn
     (context : ScopedInferenceCallDomainContext scope model current
       predecessor)
     {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hcall : current.infer source)
     (hsource : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta
       source sourceV) :
@@ -532,7 +532,7 @@ theorem nextInfer_scopedWFAtOn
       (kernelCacheSemantics model.keys trProj) scope predecessor
       predecessorMethods) :
     ∀ {Delta : KVLCtx} {s : TcState .anon}
-        {source : KExpr .anon} {sourceV : Lean4Lean.VExpr},
+        {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr},
       current.infer source →
       TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta source
         sourceV →
@@ -549,4 +549,4 @@ theorem nextInfer_scopedWFAtOn
 
 end ScopedInferenceCallDomainContext
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/ScopedSortInference.lean b/Ix/Kernel/Verify/RecursiveMethods/ScopedSortInference.lean
similarity index 96%
rename from Ix/Tc/Verify/RecursiveMethods/ScopedSortInference.lean
rename to Ix/Kernel/Verify/RecursiveMethods/ScopedSortInference.lean
index 3111a9e0e..f099c235f 100644
--- a/Ix/Tc/Verify/RecursiveMethods/ScopedSortInference.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/ScopedSortInference.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Infer.LeafCases
-import Ix.Tc.Verify.RecursiveMethods.ScopedInference
+import Ix.Kernel.Verify.Infer.LeafCases
+import Ix.Kernel.Verify.RecursiveMethods.ScopedInference
+
+open Ix.Theory (VLevel)
 
 /-!
 # Positive-fuel inference under a run-scoped suffix model
@@ -11,7 +13,7 @@ recursive callback.  Key memoization, interning, and cache insertion all
 preserve `StateInScope` explicitly.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace ScopedInferenceCallDomainContext
 
@@ -52,7 +54,7 @@ def sort
               world.venvWF.ordered theory.literalWF theory.projections.wf
               hI.1.2.1.wf
           · simpa only [KUniv.toVLevel_mkSucc] using
-              (Lean4Lean.VEnv.HasType.sort hu)
+              (Ix.Theory.Named.VEnv.HasType.sort hu)
         · intro _ _ _
           trivial
 
@@ -161,7 +163,7 @@ theorem sort_scoped_wf_bounded
     (hresultSupport : scope (KExpr.mkSort (KUniv.mkSucc u)))
     (theory : WhnfTheory trProj world model.keys.uvars)
     (references : RecM.TrustedReferences world scope)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta
       (.sort u info) sourceV) :
     TcM.WF
@@ -188,7 +190,7 @@ theorem sort_scoped_wf_fuel_one
     (hresultSupport : scope (KExpr.mkSort (KUniv.mkSucc u)))
     (theory : WhnfTheory trProj world model.keys.uvars)
     (references : RecM.TrustedReferences world scope)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv model.keys.uvars world.nameOf trProj Delta
       (.sort u info) sourceV) :
     TcM.WF
@@ -217,7 +219,7 @@ theorem sort_finiteOperational_wf_fuel_one
     (hresultSupport : scope (KExpr.mkSort (KUniv.mkSucc u)))
     (theory : WhnfTheory trProj world uvars)
     (references : RecM.TrustedReferences world scope)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
       (.sort u info) sourceV) :
     let model := ScopedKernelSuffixModel.finiteOperational spec digestScope
@@ -234,4 +236,4 @@ theorem sort_finiteOperational_wf_fuel_one
 
 end TcM.infer
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/RecursiveMethods/SortInference.lean b/Ix/Kernel/Verify/RecursiveMethods/SortInference.lean
similarity index 96%
rename from Ix/Tc/Verify/RecursiveMethods/SortInference.lean
rename to Ix/Kernel/Verify/RecursiveMethods/SortInference.lean
index 0cac65417..64aa22580 100644
--- a/Ix/Tc/Verify/RecursiveMethods/SortInference.lean
+++ b/Ix/Kernel/Verify/RecursiveMethods/SortInference.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Infer.LeafCases
-import Ix.Tc.Verify.RecursiveMethods.Inference
-import Ix.Tc.Verify.RecursiveMethods.Public
+import Ix.Kernel.Verify.Infer.LeafCases
+import Ix.Kernel.Verify.RecursiveMethods.Inference
+import Ix.Kernel.Verify.RecursiveMethods.Public
 
 /-!
 # A positive-fuel inference schedule
@@ -15,7 +15,7 @@ membership of the result does not make it another inference call, so this
 contract does not demand closure under an infinite tower of successor sorts.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace InferenceCallDomainContext
 
@@ -120,7 +120,7 @@ theorem selected
     Methods.WFAtOn .noAccel (kernelCacheSemantics model.keys trProj)
       trProj world scope model.keys.uvars
       (.singletonInfer (.sort u info))
-      (Ix.Tc.methodsN (m := .anon) 1) := by
+      (Ix.Kernel.methodsN (m := .anon) 1) := by
   simpa [calls] using (one context).selected
 
 /-- The same finite source/result footprint supports every finite table depth:
@@ -184,7 +184,7 @@ theorem sort_wf_bounded
     (hresultSupport : scope (KExpr.mkSort (KUniv.mkSucc u)))
     (theory : WhnfTheory trProj world proposition.model.keys.uvars)
     (references : RecM.TrustedReferences world scope)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv proposition.model.keys.uvars world.nameOf
       trProj Delta (.sort u info) sourceV) :
     TcM.WF
@@ -221,7 +221,7 @@ theorem sort_wf_fuel_one
     (hresultSupport : scope (KExpr.mkSort (KUniv.mkSucc u)))
     (theory : WhnfTheory trProj world proposition.model.keys.uvars)
     (references : RecM.TrustedReferences world scope)
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv proposition.model.keys.uvars world.nameOf
       trProj Delta (.sort u info) sourceV) :
     TcM.WF
@@ -247,4 +247,4 @@ theorem sort_wf_fuel_one
 
 end TcM.infer
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Run.lean b/Ix/Kernel/Verify/Run.lean
similarity index 97%
rename from Ix/Tc/Verify/Run.lean
rename to Ix/Kernel/Verify/Run.lean
index 08f5bc69c..0c53a2472 100644
--- a/Ix/Tc/Verify/Run.lean
+++ b/Ix/Kernel/Verify/Run.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.State
-import Ix.Tc.Verify.Execution
-import Ix.Tc.Verify.Frame
+import Ix.Kernel.Verify.State
+import Ix.Kernel.Verify.Execution
+import Ix.Kernel.Verify.Frame
 
 /-!
 # G3b: execution-indexed run assumptions
@@ -19,7 +19,7 @@ translation relations. The adapter lemmas here project that bundle into the
 existing walker masters and retain both finite intern ranges in post-states.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- State invariant used by run-level adapters and top-level statements. G4
 adds stable-world provenance for every warm cache entry. -/
@@ -122,7 +122,7 @@ theorem lift_spec {α : Type} {initial : TcState .anon}
       (lift e shift cutoff it).2.WF ∧
       support.CoversIntern (lift e shift cutoff it).2 := by
   obtain ⟨hcon, hcut, _⟩ := h.requestBounds hmem
-  have post := Ix.Tc.lift_spec h.collisionFree.expr hcon hcut
+  have post := Ix.Kernel.lift_spec h.collisionFree.expr hcon hcut
     (h.coverage.lift hmem) hwf hsup.expr
   exact ⟨post.1, post.2.1,
     hsup.of_expr_univs post.2.2 (lift_preservesUnivs e shift cutoff it)⟩
@@ -139,7 +139,7 @@ theorem subst_spec {α : Type} {initial : TcState .anon}
       (subst body arg depth it).2.WF ∧
       support.CoversIntern (subst body arg depth it).2 := by
   obtain ⟨hbody, harg, hcut, hargsz, _⟩ := h.requestBounds hmem
-  have post := Ix.Tc.subst_spec h.collisionFree.expr hbody harg hcut hargsz
+  have post := Ix.Kernel.subst_spec h.collisionFree.expr hbody harg hcut hargsz
     (h.coverage.subst hmem) hwf hsup.expr
   exact ⟨post.1, post.2.1,
     hsup.of_expr_univs post.2.2 (subst_preservesUnivs body arg depth it)⟩
@@ -157,7 +157,7 @@ theorem simulSubst_spec {α : Type} {initial : TcState .anon}
       (simulSubst body substs depth it).2.WF ∧
       support.CoversIntern (simulSubst body substs depth it).2 := by
   obtain ⟨hbody, hsubsts, hsizes, hwalk, _⟩ := h.requestBounds hmem
-  have post := Ix.Tc.simulSubst_spec h.collisionFree.expr hbody hsubsts
+  have post := Ix.Kernel.simulSubst_spec h.collisionFree.expr hbody hsubsts
     hsizes hwalk (h.coverage.simulSubst hmem) hwf hsup.expr
   exact ⟨post.1, post.2.1,
     hsup.of_expr_univs post.2.2
@@ -176,7 +176,7 @@ theorem instRev_spec {α : Type} {initial : TcState .anon}
       (instantiateRev body fvars it).2.WF ∧
       support.CoversIntern (instantiateRev body fvars it).2 := by
   obtain ⟨hbody, _, hwalk⟩ := h.requestBounds hmem
-  have post := Ix.Tc.instantiateRev_spec h.collisionFree.expr hbody hwalk
+  have post := Ix.Kernel.instantiateRev_spec h.collisionFree.expr hbody hwalk
     (h.coverage.instRev hmem) hwf hsup.expr
   exact ⟨post.1, post.2.1,
     hsup.of_expr_univs post.2.2
@@ -213,7 +213,7 @@ theorem abstractFVars_support_spec
         rfl
       rw [hrun]
       exact ⟨by simp [KExpr.abstractFVarsResult, hfast], hwf, hsup.expr⟩
-    · have cached := Ix.Tc.abstractFVarsCached_spec
+    · have cached := Ix.Kernel.abstractFVarsCached_spec
           hcollision.expr hbody
           (depth := 0) (it := it) (sc := {}) (by simpa using hwalk)
           hreach hwf hsup.expr
@@ -271,7 +271,7 @@ theorem abstractFVarsCached_spec {α : Type}
         fvars.size.toUInt64 depth (it, sc)) := by
   subst depth
   obtain ⟨hbody, _, hwalk, _⟩ := h.requestBounds hmem
-  exact Ix.Tc.abstractFVarsCached_spec h.collisionFree.expr hbody
+  exact Ix.Kernel.abstractFVarsCached_spec h.collisionFree.expr hbody
     (by simpa using hwalk) (h.coverage.abstractFVars hmem) hwf hsup hsc
 
 theorem instantiateUnivParams_wf {α : Type}
@@ -460,4 +460,4 @@ theorem instUniv_wf {α : Type} {initial : TcState .anon}
 
 end RunAssumptions
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/ScopedSuffix/ClosedContext.lean b/Ix/Kernel/Verify/ScopedSuffix/ClosedContext.lean
similarity index 98%
rename from Ix/Tc/Verify/ScopedSuffix/ClosedContext.lean
rename to Ix/Kernel/Verify/ScopedSuffix/ClosedContext.lean
index fbd6c44f0..f9054d391 100644
--- a/Ix/Tc/Verify/ScopedSuffix/ClosedContext.lean
+++ b/Ix/Kernel/Verify/ScopedSuffix/ClosedContext.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.DefEq
+import Ix.Kernel.Verify.DefEq
 
 /-!
 # Finite suffix model for closed checker states
@@ -13,7 +13,7 @@ proved from `TcM.ctxAddrForLbr_empty`, and the model's state predicate fixes
 the concrete fields needed to derive the empty reconciliation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Concrete eager checker states with no legacy/opened local bindings and
 no driver-owned lazy-ingress hook.
@@ -62,7 +62,7 @@ theorem contextDigestFrame {before after : TcState .anon}
 /-- Reconciliation from a concretely closed state has exactly the empty
 semantic local context. -/
 theorem delta_eq_nil
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {s : TcState .anon} {Delta : KVLCtx}
     (hclosed : ClosedContextState s)
@@ -201,4 +201,4 @@ theorem model_resetPreservesScope
 
 end ClosedContextDigest
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/State.lean b/Ix/Kernel/Verify/State.lean
similarity index 98%
rename from Ix/Tc/Verify/State.lean
rename to Ix/Kernel/Verify/State.lean
index 878541a03..d40d7b0eb 100644
--- a/Ix/Tc/Verify/State.lean
+++ b/Ix/Kernel/Verify/State.lean
@@ -1,8 +1,8 @@
-import Ix.Tc.Verify.Env
-import Ix.Tc.Verify.Monad
-import Ix.Tc.Verify.InstUniv
-import Ix.Tc.Verify.Cache
-import Ix.Tc.Verify.EquivalenceManager
+import Ix.Kernel.Verify.Env
+import Ix.Kernel.Verify.Monad
+import Ix.Kernel.Verify.InstUniv
+import Ix.Kernel.Verify.Cache
+import Ix.Kernel.Verify.EquivalenceManager
 
 /-!
 # The verification world and the run invariant
@@ -32,9 +32,9 @@ through `KernelStateWF` below. Dual-context agreement and the concrete
 reduction/inference/native semantic contracts remain K1/K2 obligations.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDecl VExpr)
+open Ix.Theory.Named (VDecl VExpr)
 
 /-- A concrete checker state is coherent with one verification world.
 
@@ -82,7 +82,7 @@ theorem TcStateWF.load {trProj : RawProjRel} {s : TcState .anon}
 supplied by successful checking.  The concrete state remains unchanged. -/
 theorem TcStateWF.promote {trProj : RawProjRel} {s : TcState .anon}
     {world : VerifyWorld} {id : KId .anon} {d : VDecl}
-    {venv' : Lean4Lean.VEnv}
+    {venv' : Ix.Theory.Named.VEnv}
     (h : TcStateWF trProj s world)
     (hpending : PendingDecl trProj world id d)
     (hwf : VDecl.WF world.venv d venv') :
@@ -395,4 +395,4 @@ theorem TcM.instantiateUnivParams.tcInv
     rw [hrun] at hrunWF
     exact ⟨⟨world, hworld, hrunWF.1⟩, hrunWF.2⟩
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Statements.lean b/Ix/Kernel/Verify/Statements.lean
similarity index 89%
rename from Ix/Tc/Verify/Statements.lean
rename to Ix/Kernel/Verify/Statements.lean
index 5d457294f..b37e30cce 100644
--- a/Ix/Tc/Verify/Statements.lean
+++ b/Ix/Kernel/Verify/Statements.lean
@@ -1,8 +1,8 @@
-import Ix.Tc.Verify.Check.PublicStandalone
-import Ix.Tc.Verify.Check.PublicBlocks
-import Ix.Tc.Verify.Driver.BooleanAcceptance
-import Ix.Tc.Verify.Ingress.SerializedBoolean
-import Ix.Tc.Verify.RecursiveMethods.Public
+import Ix.Kernel.Verify.Check.PublicStandalone
+import Ix.Kernel.Verify.Check.PublicBlocks
+import Ix.Kernel.Verify.Driver.BooleanAcceptance
+import Ix.Kernel.Verify.Ingress.SerializedBoolean
+import Ix.Kernel.Verify.RecursiveMethods.Public
 
 /-!
 # Public checker theorem frontier
@@ -34,7 +34,7 @@ coordinated transaction, physical/ghost identity, and cache-publication
 layers.  Singleton definition blocks are constructive.  Inductive and
 recursor bodies remain relative in the generic adapter to an explicitly
 supplied `InductiveOracle` resource; the public E3-S root instantiates both
-resources from the Lean4Lean Boolean generation certificate.  Quotient
+resources from the Ix.Theory.Named Boolean generation certificate.  Quotient
 semantics, mutual/nested inductives, indexed or parameterized families, and
 multi-definition blocks remain outside this certificate-backed release
 fragment.  Collision, finite-resource, lazy-ingress, source-to-router
diff --git a/Ix/Tc/Verify/Subst.lean b/Ix/Kernel/Verify/Subst.lean
similarity index 99%
rename from Ix/Tc/Verify/Subst.lean
rename to Ix/Kernel/Verify/Subst.lean
index e716a7684..09f265676 100644
--- a/Ix/Tc/Verify/Subst.lean
+++ b/Ix/Kernel/Verify/Subst.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Subst
-import Ix.Tc.Verify.Expr
+import Ix.Kernel.Subst
+import Ix.Kernel.Verify.Expr
 
 /-!
 # Subst slice: `lift`/`subst` walkers against pure specs
@@ -31,7 +31,7 @@ UInt64.size` for the binder-descent `cutoff + 1`s). An in-memory
 expression cannot violate them; a 2⁶⁴-deep tower genuinely would.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 variable {m : Mode}
 
@@ -4740,4 +4740,4 @@ theorem Constructed.abstractFVarsSpec {body : KExpr .anon}
 
 end KExpr
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Suffix.lean b/Ix/Kernel/Verify/Suffix.lean
similarity index 99%
rename from Ix/Tc/Verify/Suffix.lean
rename to Ix/Kernel/Verify/Suffix.lean
index 28df86478..3dc7f5df8 100644
--- a/Ix/Tc/Verify/Suffix.lean
+++ b/Ix/Kernel/Verify/Suffix.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf
+import Ix.Kernel.Verify.Whnf
 
 /-!
 # K2 suffix-context transport boundary
@@ -15,7 +15,7 @@ these clauses prevents either arbitrary-state context identification or bare
 address equality from entering the cache proof.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-! ## Exact production memo behavior -/
 
@@ -589,4 +589,4 @@ theorem cacheWriteOracle {trProj : RawProjRel} {fallback : CacheSemantics}
 
 end WhnfSuffixModel
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Support.lean b/Ix/Kernel/Verify/Support.lean
similarity index 99%
rename from Ix/Tc/Verify/Support.lean
rename to Ix/Kernel/Verify/Support.lean
index 8676da2d2..4fef22776 100644
--- a/Ix/Tc/Verify/Support.lean
+++ b/Ix/Kernel/Verify/Support.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.InstUniv
+import Ix.Kernel.Verify.InstUniv
 import Std.Data.HashMap.Lemmas
 
 /-!
@@ -26,7 +26,7 @@ operations.  Nothing here treats constructor closure as support: that would
 be infinite and would make finite collision freedom impossible.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-! ## Constructive finite predicates -/
 
@@ -803,4 +803,4 @@ theorem mono {before after : List WalkerRequest}
 
 end ResourceBounds
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Totalization.lean b/Ix/Kernel/Verify/Totalization.lean
similarity index 99%
rename from Ix/Tc/Verify/Totalization.lean
rename to Ix/Kernel/Verify/Totalization.lean
index 9f511d6a5..e9eeb84e3 100644
--- a/Ix/Tc/Verify/Totalization.lean
+++ b/Ix/Kernel/Verify/Totalization.lean
@@ -1,6 +1,6 @@
-import Ix.Tc.Verify.Monad
-import Ix.Tc.CanonicalCheck
-import Ix.Tc.Check
+import Ix.Kernel.Verify.Monad
+import Ix.Kernel.CanonicalCheck
+import Ix.Kernel.Check
 
 /-!
 # K0: equations for the total recursive-methods knot
@@ -11,7 +11,7 @@ These equations expose the production definitions needed by the later
 table runs the selected kernel method under the predecessor table.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 variable {m : Mode}
 
@@ -883,4 +883,4 @@ theorem TcM.runRec_directInfer_zero (e : KExpr m) (s : TcState m)
 @[simp] theorem TcM.ensureForall_eq_runRec (e : KExpr m) :
     TcM.ensureForall e = TcM.runRec (RecM.ensureForallDirect e) := rfl
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Trans.lean b/Ix/Kernel/Verify/Trans.lean
similarity index 94%
rename from Ix/Tc/Verify/Trans.lean
rename to Ix/Kernel/Verify/Trans.lean
index 19ddd7929..30cf5d5d4 100644
--- a/Ix/Tc/Verify/Trans.lean
+++ b/Ix/Kernel/Verify/Trans.lean
@@ -1,13 +1,15 @@
-import Ix.Tc.Verify.Subst
-import Ix.Tc.Verify.VLCtx
-import Lean4Lean.Verify.Typing.Expr
-import Lean4Lean.Verify.Typing.Lemmas
-import Lean4Lean.Theory.Typing.Lemmas
+import Ix.Kernel.Verify.Subst
+import Ix.Kernel.Verify.VLCtx
+import Ix.Theory.Named.Verify.Typing.Expr
+import Ix.Theory.Named.Verify.Typing.Lemmas
+import Ix.Theory.Named.Typing.Lemmas
+
+open Ix.Theory (VLevel)
 
 /-!
 # `TrKExprS` — the KExpr ↔ VExpr translation relation
 
-The Ix.Tc restatement of lean4lean's `TrExprS`, rule-for-rule where the
+The Ix.Kernel restatement of the named specification's `TrExprS`, rule-for-rule where the
 source languages agree, with the divergences owned deliberately:
 
 - **Universes are total.** Anon-mode `KUniv` parameters are already de
@@ -46,9 +48,9 @@ Reused from the dep (VExpr-only content, fvar/Expr-agnostic):
 eventually `VEnv.HasPrimitives`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLevel VLocalDecl VEnv VConstant)
+open Ix.Theory.Named (VExpr VLocalDecl VEnv VConstant)
 
 /-- Typing-level context well-formedness, mirroring upstream `VLCtx.WF`:
     fvar-structural freshness plus per-entry `VLocalDecl.WF` (types are
@@ -58,7 +60,7 @@ def KVLCtx.WF (env : VEnv) (U : Nat) : KVLCtx → Prop
   | (ofv, d) :: (Δ : KVLCtx) =>
     KVLCtx.WF env U Δ ∧
     (∀ fv deps, ofv = some (fv, deps) → fv ∉ Δ.fvars ∧ deps ⊆ Δ.fvars) ∧
-    Lean4Lean.VLocalDecl.WF env U Δ.toCtx d
+    Ix.Theory.Named.VLocalDecl.WF env U Δ.toCtx d
 
 theorem KVLCtx.WF.fvwf {env : VEnv} {U : Nat} :
     ∀ {Δ : KVLCtx}, KVLCtx.WF env U Δ → Δ.FVWF
@@ -96,7 +98,7 @@ def VarsScoped (bvars : Nat) (fvars : List FVarId) : KExpr m → Prop
         body.VarsScoped (bvars + 1) fvars
   | .prj _ _ value _ => value.VarsScoped bvars fvars
 
-/-- Structural scope at one mixed Ix/Lean4Lean local context. -/
+/-- Structural scope at one mixed Ix/Ix.Theory.Named local context. -/
 def ContextScoped (Delta : KVLCtx) (e : KExpr m) : Prop :=
   e.VarsScoped Delta.bvars Delta.fvars
 
@@ -334,7 +336,7 @@ inductive KBVLift : KVLCtx → KVLCtx → Nat → Nat → Nat → Nat → Prop
 
 theorem KBVLift.toCtx {Δ Δ' : KVLCtx} {dn dk n k : Nat}
     (W : KBVLift Δ Δ' dn dk n k) :
-    Lean4Lean.Ctx.LiftN n k Δ.toCtx Δ'.toCtx := by
+    Ix.Theory.Named.Ctx.LiftN n k Δ.toCtx Δ'.toCtx := by
   induction W with
   | refl => exact .zero []
   | @skip _ Δ' _ _ d _ ih =>
@@ -474,15 +476,15 @@ protected theorem KBVLift.find? {Δ Δ' : KVLCtx} {dn dk n k : Nat}
   | refl => simp [H]
   | @skip _ Δ' _ _ d _ ih =>
     obtain v | fv := v <;> simp [find?, liftVar, next] <;>
-      exact ⟨_, _, ih H, by simp [Lean4Lean.VExpr.liftN_liftN]⟩
+      exact ⟨_, _, ih H, by simp [Ix.Theory.Named.VExpr.liftN_liftN]⟩
   | @skip_fvar Δ Δ' _ _ fv d hfresh _ ih =>
     obtain v | fv' := v
     · simp [find?, liftVar, next]
-      exact ⟨_, _, ih H, by simp [Lean4Lean.VExpr.liftN_liftN]⟩
+      exact ⟨_, _, ih H, by simp [Ix.Theory.Named.VExpr.liftN_liftN]⟩
     · have hne : ¬fv.1 = fv' := fun hEq =>
         hfresh (hEq ▸ find?_inr_mem H)
       simp [find?, liftVar, next, hne]
-      exact ⟨_, _, ih H, by simp [Lean4Lean.VExpr.liftN_liftN]⟩
+      exact ⟨_, _, ih H, by simp [Ix.Theory.Named.VExpr.liftN_liftN]⟩
   | cons d _ ih =>
     obtain (_ | v) | fv := v <;> simp [liftVar] <;>
       [ (simp [find?, next] at H ⊢; simp [← H]);
@@ -496,43 +498,43 @@ protected theorem KBVLift.find? {Δ Δ' : KVLCtx} {dn dk n k : Nat}
         ( simp [find?, next] at H ⊢
           obtain ⟨e, A, H, rfl, rfl⟩ := H
           refine ⟨_, _, ih H, ?_⟩ )] <;>
-      open Lean4Lean.VLocalDecl in
+      open Ix.Theory.Named.VLocalDecl in
       cases d <;>
-        simp [Lean4Lean.VExpr.lift_liftN', liftN, value, type, depth,
-          Lean4Lean.VExpr.liftN]
+        simp [Ix.Theory.Named.VExpr.lift_liftN', liftN, value, type, depth,
+          Ix.Theory.Named.VExpr.liftN]
 
 end KVLCtx
 
 /-- Closed literal encodings are `liftN`-invariant. -/
 private theorem liftN_natLit (v n k : Nat) :
-    (Lean4Lean.VExpr.natLit v).liftN n k = Lean4Lean.VExpr.natLit v := by
+    (Ix.Theory.Named.VExpr.natLit v).liftN n k = Ix.Theory.Named.VExpr.natLit v := by
   induction v with
   | zero => rfl
   | succ v ih =>
-    show Lean4Lean.VExpr.app _ _ = _
-    rw [show ((Lean4Lean.VExpr.natLit v).liftN n k)
-        = Lean4Lean.VExpr.natLit v from ih]
+    show Ix.Theory.Named.VExpr.app _ _ = _
+    rw [show ((Ix.Theory.Named.VExpr.natLit v).liftN n k)
+        = Ix.Theory.Named.VExpr.natLit v from ih]
     rfl
 
 private theorem liftN_listCharLit (s : List Char) (n k : Nat) :
-    (Lean4Lean.VExpr.listCharLit s).liftN n k
-      = Lean4Lean.VExpr.listCharLit s := by
+    (Ix.Theory.Named.VExpr.listCharLit s).liftN n k
+      = Ix.Theory.Named.VExpr.listCharLit s := by
   induction s with
   | nil => rfl
   | cons c s ih =>
-    show Lean4Lean.VExpr.app (Lean4Lean.VExpr.app _ (Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.natLit c.toNat).liftN n k)))
-      ((Lean4Lean.VExpr.listCharLit s).liftN n k) = _
+    show Ix.Theory.Named.VExpr.app (Ix.Theory.Named.VExpr.app _ (Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.natLit c.toNat).liftN n k)))
+      ((Ix.Theory.Named.VExpr.listCharLit s).liftN n k) = _
     rw [liftN_natLit, ih]
     rfl
 
 private theorem liftN_trLiteral (l : Lean.Literal) (n k : Nat) :
-    (Lean4Lean.VExpr.trLiteral l).liftN n k
-      = Lean4Lean.VExpr.trLiteral l := by
+    (Ix.Theory.Named.VExpr.trLiteral l).liftN n k
+      = Ix.Theory.Named.VExpr.trLiteral l := by
   cases l with
   | natVal v => exact liftN_natLit v n k
   | strVal s =>
-    show Lean4Lean.VExpr.app _ ((Lean4Lean.VExpr.listCharLit _).liftN n k) = _
+    show Ix.Theory.Named.VExpr.app _ ((Ix.Theory.Named.VExpr.listCharLit _).liftN n k) = _
     rw [liftN_listCharLit]
     rfl
 
@@ -541,12 +543,12 @@ private theorem liftN_trLiteral (l : Lean.Literal) (n k : Nat) :
     walker's `UInt64` arguments; `htp` is the trProj-weakening the
     abstract projection parameter must satisfy (upstream `TrProj.weakN`'s
     shape). -/
-theorem TrKExprS.weakBV {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.weakBV {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     {Δ : KVLCtx} {e : KExpr .anon} {e' : VExpr}
@@ -651,13 +653,13 @@ theorem TrKExprS.weakBV {env : Lean4Lean.VEnv} {uvars : Nat}
       (htp W.toCtx htrp)
   | @nat Δ v blob md h =>
     intro Δ' dn dk n k shift cutoff W hshift hcutoff hbig
-    rw [show (Lean4Lean.VExpr.natLit v).liftN n k
-        = Lean4Lean.VExpr.natLit v from liftN_natLit v n k]
+    rw [show (Ix.Theory.Named.VExpr.natLit v).liftN n k
+        = Ix.Theory.Named.VExpr.natLit v from liftN_natLit v n k]
     exact .nat h
   | @str Δ s blob md h =>
     intro Δ' dn dk n k shift cutoff W hshift hcutoff hbig
-    rw [show (Lean4Lean.VExpr.trLiteral (.strVal s)).liftN n k
-        = Lean4Lean.VExpr.trLiteral (.strVal s) from
+    rw [show (Ix.Theory.Named.VExpr.trLiteral (.strVal s)).liftN n k
+        = Ix.Theory.Named.VExpr.trLiteral (.strVal s) from
       liftN_trLiteral (.strVal s) n k]
     exact .str h
 
@@ -692,12 +694,12 @@ private theorem tr_toNat_le_sat1_add_one (x : UInt64) :
     mention only the source expression: `hcut` bounds binder descent and
     `hlift` bounds shifted loose indices.  These are exactly the two
     no-wrap obligations carried by `WalkerRequest.Bounds (.lift ...)`. -/
-theorem TrKExprS.weakBV_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.weakBV_lbr {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     {Δ : KVLCtx} {e : KExpr .anon} {e' : VExpr}
@@ -848,14 +850,14 @@ theorem TrKExprS.weakBV_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
   | @nat Δ v blob info h =>
     cases hcon
     intro Δ' dn dk n k shift cutoff W hshift hcutoff hcut hlift
-    rw [show (Lean4Lean.VExpr.natLit v).liftN n k
-        = Lean4Lean.VExpr.natLit v from liftN_natLit v n k]
+    rw [show (Ix.Theory.Named.VExpr.natLit v).liftN n k
+        = Ix.Theory.Named.VExpr.natLit v from liftN_natLit v n k]
     exact .nat h
   | @str Δ v blob info h =>
     cases hcon
     intro Δ' dn dk n k shift cutoff W hshift hcutoff hcut hlift
-    rw [show (Lean4Lean.VExpr.trLiteral (.strVal v)).liftN n k
-        = Lean4Lean.VExpr.trLiteral (.strVal v) from
+    rw [show (Ix.Theory.Named.VExpr.trLiteral (.strVal v)).liftN n k
+        = Ix.Theory.Named.VExpr.trLiteral (.strVal v) from
       liftN_trLiteral (.strVal v) n k]
     exact .str h
 
@@ -889,7 +891,7 @@ private theorem depth_inst (d : VLocalDecl) (e₀ : VExpr) (k : Nat) :
 
 protected theorem KInstN.toCtx {Δ₀ : KVLCtx} {e₀ A₀ : VExpr}
     {dk k : Nat} {Δ₁ Δ : KVLCtx} (W : KInstN Δ₀ e₀ A₀ dk k Δ₁ Δ) :
-    Lean4Lean.Ctx.InstN Δ₀.toCtx e₀ A₀ k Δ₁.toCtx Δ.toCtx := by
+    Ix.Theory.Named.Ctx.InstN Δ₀.toCtx e₀ A₀ k Δ₁.toCtx Δ.toCtx := by
   induction W with
   | zero => exact .zero
   | @succ dk k Γ Γ' d _ ih =>
@@ -924,7 +926,7 @@ private theorem liftN_depth_inst (d : VLocalDecl) (f e₀ : VExpr)
   cases d with
   | vlam A =>
     show (f.liftN 1).inst e₀ (k + 1) = (f.inst e₀ k).liftN 1
-    exact (Lean4Lean.VExpr.lift_instN_lo f e₀).symm
+    exact (Ix.Theory.Named.VExpr.lift_instN_lo f e₀).symm
   | vlet A v =>
     show (f.liftN 0).inst e₀ (k + 0) = (f.inst e₀ k).liftN 0
     simp
@@ -945,7 +947,7 @@ theorem KInstN.find?_hit {Δ₀ : KVLCtx} {e₀ A₀ : VExpr} {dk k : Nat}
     intro e' A H
     simp [find?, next] at H
     obtain ⟨e, A', H, rfl, rfl⟩ := H
-    rw [liftN_depth_inst, ih H, Lean4Lean.VExpr.liftN_liftN]
+    rw [liftN_depth_inst, ih H, Ix.Theory.Named.VExpr.liftN_liftN]
 
 /-- Below the substitution site: indices are untouched and values
     instantiate pointwise. -/
@@ -964,10 +966,10 @@ theorem KInstN.find?_lt {Δ₀ : KVLCtx} {e₀ A₀ : VExpr} {dk k : Nat}
       obtain ⟨rfl, rfl⟩ := H
       constructor <;>
         · cases d <;>
-            simp [Lean4Lean.VLocalDecl.inst, Lean4Lean.VLocalDecl.value,
-              Lean4Lean.VLocalDecl.type, Lean4Lean.VLocalDecl.depth,
-              Lean4Lean.VExpr.inst, Lean4Lean.VExpr.instVar,
-              Lean4Lean.VExpr.lift_instN_lo]
+            simp [Ix.Theory.Named.VLocalDecl.inst, Ix.Theory.Named.VLocalDecl.value,
+              Ix.Theory.Named.VLocalDecl.type, Ix.Theory.Named.VLocalDecl.depth,
+              Ix.Theory.Named.VExpr.inst, Ix.Theory.Named.VExpr.instVar,
+              Ix.Theory.Named.VExpr.lift_instN_lo]
     | j + 1 =>
       simp [find?, next] at H ⊢
       obtain ⟨e, A', H, rfl, rfl⟩ := H
@@ -988,8 +990,8 @@ theorem KInstN.find?_gt {Δ₀ : KVLCtx} {e₀ A₀ : VExpr} {dk k : Nat}
       simp [find?, next] at H
       obtain ⟨e, A', H, rfl, rfl⟩ := H
       simp only [Nat.add_sub_cancel]
-      rw [show Lean4Lean.VLocalDecl.depth (.vlam A₀) = 1 from rfl,
-        Lean4Lean.VExpr.inst_liftN, Lean4Lean.VExpr.inst_liftN]
+      rw [show Ix.Theory.Named.VLocalDecl.depth (.vlam A₀) = 1 from rfl,
+        Ix.Theory.Named.VExpr.inst_liftN, Ix.Theory.Named.VExpr.inst_liftN]
       exact H
   | @succ dk k Γ Γ' d _ ih =>
     intro j e' A hj H
@@ -1017,8 +1019,8 @@ theorem KInstN.find?_fvar {Δ₀ : KVLCtx} {e₀ A₀ : VExpr} {dk k : Nat}
     intro fv e' A H
     simp [find?, next] at H
     obtain ⟨e, A', H, rfl, rfl⟩ := H
-    rw [show Lean4Lean.VLocalDecl.depth (.vlam A₀) = 1 from rfl,
-      Lean4Lean.VExpr.inst_liftN, Lean4Lean.VExpr.inst_liftN]
+    rw [show Ix.Theory.Named.VLocalDecl.depth (.vlam A₀) = 1 from rfl,
+      Ix.Theory.Named.VExpr.inst_liftN, Ix.Theory.Named.VExpr.inst_liftN]
     exact H
   | @succ dk k Γ Γ' d _ ih =>
     intro fv e' A H
@@ -1088,12 +1090,12 @@ theorem KInstLet.find?_hit {Δ₀ : KVLCtx} {e₀ A₀ : VExpr}
     intro e' A H
     simp [find?, next] at H
     obtain ⟨rfl, rfl⟩ := H
-    simp [Lean4Lean.VLocalDecl.value]
+    simp [Ix.Theory.Named.VLocalDecl.value]
   | @succ dk k Γ Γ' d _ ih =>
     intro e' A H
     simp [find?, next] at H
     obtain ⟨e, A', H, rfl, rfl⟩ := H
-    rw [ih H, Lean4Lean.VExpr.liftN_liftN]
+    rw [ih H, Ix.Theory.Named.VExpr.liftN_liftN]
 
 /-- References below the removed let retain both their index and resolved
     Theory pair. -/
@@ -1129,7 +1131,7 @@ theorem KInstLet.find?_gt {Δ₀ : KVLCtx} {e₀ A₀ : VExpr}
     | j + 1, _ =>
       simp [find?, next] at H
       obtain ⟨e, A', H, rfl, rfl⟩ := H
-      simpa [Lean4Lean.VLocalDecl.depth] using H
+      simpa [Ix.Theory.Named.VLocalDecl.depth] using H
   | @succ dk k Γ Γ' d _ ih =>
     intro j e' A hj H
     match j, hj with
@@ -1153,7 +1155,7 @@ theorem KInstLet.find?_fvar {Δ₀ : KVLCtx} {e₀ A₀ : VExpr}
     intro fv e' A H
     simp [find?, next] at H
     obtain ⟨e, A', H, rfl, rfl⟩ := H
-    simpa [Lean4Lean.VLocalDecl.depth] using H
+    simpa [Ix.Theory.Named.VLocalDecl.depth] using H
   | @succ dk k Γ Γ' d _ ih =>
     intro fv e' A H
     simp [find?, next] at H ⊢
@@ -1164,35 +1166,35 @@ end KVLCtx
 
 /-- Closed literal encodings are `inst`-invariant. -/
 private theorem inst_natLit (v : Nat) (e₀ : VExpr) (k : Nat) :
-    (Lean4Lean.VExpr.natLit v).inst e₀ k = Lean4Lean.VExpr.natLit v := by
+    (Ix.Theory.Named.VExpr.natLit v).inst e₀ k = Ix.Theory.Named.VExpr.natLit v := by
   induction v with
   | zero => rfl
   | succ v ih =>
-    show Lean4Lean.VExpr.app _ _ = _
-    rw [show ((Lean4Lean.VExpr.natLit v).inst e₀ k)
-        = Lean4Lean.VExpr.natLit v from ih]
+    show Ix.Theory.Named.VExpr.app _ _ = _
+    rw [show ((Ix.Theory.Named.VExpr.natLit v).inst e₀ k)
+        = Ix.Theory.Named.VExpr.natLit v from ih]
     rfl
 
 private theorem inst_listCharLit (s : List Char) (e₀ : VExpr) (k : Nat) :
-    (Lean4Lean.VExpr.listCharLit s).inst e₀ k
-      = Lean4Lean.VExpr.listCharLit s := by
+    (Ix.Theory.Named.VExpr.listCharLit s).inst e₀ k
+      = Ix.Theory.Named.VExpr.listCharLit s := by
   induction s with
   | nil => rfl
   | cons c s ih =>
-    show Lean4Lean.VExpr.app (Lean4Lean.VExpr.app _ (Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.natLit c.toNat).inst e₀ k)))
-      ((Lean4Lean.VExpr.listCharLit s).inst e₀ k) = _
+    show Ix.Theory.Named.VExpr.app (Ix.Theory.Named.VExpr.app _ (Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.natLit c.toNat).inst e₀ k)))
+      ((Ix.Theory.Named.VExpr.listCharLit s).inst e₀ k) = _
     rw [inst_natLit, ih]
     rfl
 
 private theorem inst_trLiteral (l : Lean.Literal) (e₀ : VExpr) (k : Nat) :
-    (Lean4Lean.VExpr.trLiteral l).inst e₀ k
-      = Lean4Lean.VExpr.trLiteral l := by
+    (Ix.Theory.Named.VExpr.trLiteral l).inst e₀ k
+      = Ix.Theory.Named.VExpr.trLiteral l := by
   cases l with
   | natVal v => exact inst_natLit v e₀ k
   | strVal s =>
-    show Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.listCharLit _).inst e₀ k) = _
+    show Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.listCharLit _).inst e₀ k) = _
     rw [inst_listCharLit]
     rfl
 
@@ -1201,18 +1203,18 @@ private theorem inst_trLiteral (l : Lean.Literal) (e₀ : VExpr) (k : Nat) :
     the weakening/instantiation closure the abstract projection
     parameter must satisfy (upstream's `TrProj.weakN`/`TrProj.instN`,
     both sorried there). -/
-theorem TrKExprS.instN {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.instN {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     (htpI : ∀ {Γ₀ : List VExpr} {e₀ A₀ : VExpr} {k : Nat}
       {Γ₁ Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
       env.HasType uvars Γ₀ e₀ A₀ →
-      Lean4Lean.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
+      Ix.Theory.Named.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
       trProj uvars Γ₁ s i e e' →
       trProj uvars Γ s i (e.inst e₀ k) (e'.inst e₀ k))
     {Δ₀ : KVLCtx} {arg : KExpr .anon} {e₀' A₀ : VExpr}
@@ -1330,13 +1332,13 @@ theorem TrKExprS.instN {env : Lean4Lean.VEnv} {uvars : Nat}
       (htpI t₀ W.toCtx htrp)
   | @nat Δ₁' v blob md h =>
     intro Δ dk k depth W hdepth hbig
-    rw [show (Lean4Lean.VExpr.natLit v).inst e₀' k
-        = Lean4Lean.VExpr.natLit v from inst_natLit v e₀' k]
+    rw [show (Ix.Theory.Named.VExpr.natLit v).inst e₀' k
+        = Ix.Theory.Named.VExpr.natLit v from inst_natLit v e₀' k]
     exact .nat h
   | @str Δ₁' s blob md h =>
     intro Δ dk k depth W hdepth hbig
-    rw [show (Lean4Lean.VExpr.trLiteral (.strVal s)).inst e₀' k
-        = Lean4Lean.VExpr.trLiteral (.strVal s) from
+    rw [show (Ix.Theory.Named.VExpr.trLiteral (.strVal s)).inst e₀' k
+        = Ix.Theory.Named.VExpr.trLiteral (.strVal s) from
       inst_trLiteral (.strVal s) e₀' k]
     exact .str h
 
@@ -1344,12 +1346,12 @@ theorem TrKExprS.instN {env : Lean4Lean.VEnv} {uvars : Nat}
     context `vlet` leaves the translated Theory expression unchanged.
     This mirrors upstream `TrExprS.instN_let`, while retaining the explicit
     UInt64 resource bound required by `KExpr.substSpec`. -/
-theorem TrKExprS.instN_let {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.instN_let {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     {Δ₀ : KVLCtx} {arg : KExpr .anon} {e₀' A₀ : VExpr}
@@ -1474,12 +1476,12 @@ theorem TrKExprS.instN_let {env : Lean4Lean.VEnv} {uvars : Nat}
 /-- Walker-tight let instantiation.  The bound is the final conjunct of
     `WalkerRequest.Bounds (.subst body arg depth)`, and `harg` is its
     constructed-argument conjunct.  No ambient-context size is needed. -/
-theorem TrKExprS.instN_let_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.instN_let_lbr {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     {Δ₀ : KVLCtx} {arg : KExpr .anon} {e₀' A₀ : VExpr}
@@ -1592,18 +1594,18 @@ theorem TrKExprS.instN_let_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
 
 /-- **Beta step at the API level**: substituting under one `vlam`.
     Upstream `TrExprS.inst`. -/
-theorem TrKExprS.inst {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.inst {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     (htpI : ∀ {Γ₀ : List VExpr} {e₀ A₀ : VExpr} {k : Nat}
       {Γ₁ Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
       env.HasType uvars Γ₀ e₀ A₀ →
-      Lean4Lean.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
+      Ix.Theory.Named.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
       trProj uvars Γ₁ s i e e' →
       trProj uvars Γ s i (e.inst e₀ k) (e'.inst e₀ k))
     {Δ : KVLCtx} {arg body : KExpr .anon} {e₀' A₀ body' : VExpr}
@@ -1618,12 +1620,12 @@ theorem TrKExprS.inst {env : Lean4Lean.VEnv} {uvars : Nat}
 /-- **Explicit-let step at the API level**: substituting under one `vlet`
     preserves the already-inlined Theory translation.  Upstream
     `TrExprS.inst_let`. -/
-theorem TrKExprS.inst_let {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.inst_let {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     {Δ : KVLCtx} {arg body : KExpr .anon} {e₀' A₀ body' : VExpr}
@@ -1637,12 +1639,12 @@ theorem TrKExprS.inst_let {env : Lean4Lean.VEnv} {uvars : Nat}
 
 /-- Explicit-let instantiation with the exact depth-zero substitution
     resource bound, independent of the ambient context size. -/
-theorem TrKExprS.inst_let_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.inst_let_lbr {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     {Δ : KVLCtx} {arg body : KExpr .anon} {e₀' A₀ body' : VExpr}
@@ -1670,7 +1672,7 @@ theorem KVLCtx.vlocalDecl_wf_hasType {env : VEnv} {U : Nat} {Δ : KVLCtx}
 /-- `VLocalDecl.is_liftN` re-keyed: consing an entry lifts the bare
     context by the entry's depth. -/
 theorem KVLCtx.is_liftN {Δ : KVLCtx} {ofv} :
-    ∀ {d}, Lean4Lean.Ctx.LiftN (VLocalDecl.depth d) 0 Δ.toCtx
+    ∀ {d}, Ix.Theory.Named.Ctx.LiftN (VLocalDecl.depth d) 0 Δ.toCtx
       (KVLCtx.toCtx ((ofv, d) :: Δ))
   | .vlam _ => .one
   | .vlet .. => .zero []
@@ -1694,7 +1696,7 @@ theorem KVLCtx.WF.find?_wf {env : VEnv} {U : Nat} (henv : env.Ordered) :
     translation context is `OnCtx`-well-formed. -/
 theorem KVLCtx.WF.toCtx {env : VEnv} {U : Nat} :
     ∀ {Δ : KVLCtx}, KVLCtx.WF env U Δ →
-      Lean4Lean.OnCtx Δ.toCtx (env.IsType U)
+      Ix.Theory.Named.OnCtx Δ.toCtx (env.IsType U)
   | [], _ => ⟨⟩
   | (_, .vlam _) :: _, ⟨hΔ, _, hA⟩ => ⟨hΔ.toCtx, hA⟩
   | (_, .vlet ..) :: _, ⟨hΔ, _, _⟩ => hΔ.toCtx
@@ -1702,7 +1704,7 @@ theorem KVLCtx.WF.toCtx {env : VEnv} {U : Nat} :
 /-- Upstream idiom (Verify/Typing/Lemmas.lean:216): context WF coerces
     to the bare-context `OnCtx` whenever a Theory lemma wants it. -/
 instance {env : VEnv} {U : Nat} {Δ : KVLCtx} :
-    Coe (KVLCtx.WF env U Δ) (Lean4Lean.OnCtx Δ.toCtx (env.IsType U)) :=
+    Coe (KVLCtx.WF env U Δ) (Ix.Theory.Named.OnCtx Δ.toCtx (env.IsType U)) :=
   ⟨KVLCtx.WF.toCtx⟩
 
 /-- A term well-formed in the empty context is well-formed anywhere
@@ -1711,7 +1713,7 @@ private theorem wf_weak0 {env : VEnv} (henv : env.Ordered) {U : Nat}
     {e : VExpr} (h : VExpr.WF env U [] e) (Γ : List VExpr) :
     VExpr.WF env U Γ e := by
   obtain ⟨A, hA⟩ := h
-  have W : Lean4Lean.Ctx.LiftN Γ.length 0 [] (Γ ++ []) := .zero Γ rfl
+  have W : Ix.Theory.Named.Ctx.LiftN Γ.length 0 [] (Γ ++ []) := .zero Γ rfl
   rw [List.append_nil] at W
   have h2 := hA.weakN henv W
   have hce : e.ClosedN 0 := (hA.closedN' henv.closed trivial).1
@@ -1882,7 +1884,7 @@ inductive IsDefEq : KVLCtx → KVLCtx → Prop
   | cons {Δ₁ Δ₂ : KVLCtx} {ofv} {d₁ d₂ : VLocalDecl} :
     IsDefEq Δ₁ Δ₂ →
     (∀ fv deps, ofv = some (fv, deps) → fv ∉ Δ₁.fvars ∧ deps ⊆ Δ₁.fvars) →
-    Lean4Lean.VLocalDecl.IsDefEq env U Δ₁.toCtx d₁ d₂ →
+    Ix.Theory.Named.VLocalDecl.IsDefEq env U Δ₁.toCtx d₁ d₂ →
     IsDefEq ((ofv, d₁) :: Δ₁) ((ofv, d₂) :: Δ₂)
 
 theorem IsDefEq.refl {env : VEnv} {U : Nat} (henv : env.Ordered) :
@@ -1890,7 +1892,7 @@ theorem IsDefEq.refl {env : VEnv} {U : Nat} (henv : env.Ordered) :
   | [], _ => .nil
   | (_, _) :: _, ⟨h1, h2, h3⟩ =>
     .cons (IsDefEq.refl henv h1) h2
-      (Lean4Lean.VLocalDecl.IsDefEq.refl henv h1.toCtx h3)
+      (Ix.Theory.Named.VLocalDecl.IsDefEq.refl henv h1.toCtx h3)
 
 theorem IsDefEq.defeqCtx {env : VEnv} {U : Nat} {Δ₁ Δ₂ : KVLCtx} :
     IsDefEq env U Δ₁ Δ₂ →
@@ -1948,7 +1950,7 @@ theorem IsDefEq.find?_uniq {env : VEnv} {U : Nat} (henv : VEnv.WF env) :
         exact ⟨⟨_, h4⟩, h3⟩
       · simp
         rintro d₁' n₁' H1' rfl rfl d₂' n₂' H2' rfl rfl
-        simpa [Lean4Lean.VLocalDecl.depth, KVLCtx.toCtx] using
+        simpa [Ix.Theory.Named.VLocalDecl.depth, KVLCtx.toCtx] using
           find?_uniq henv hΔ H1' H2'
 
 /-- Transport of `find?`-success along a context defeq (upstream
@@ -1988,19 +1990,19 @@ makes the two targets syntactically equal, so self-defeq suffices — no
 
 /-- Closure properties of the abstract, universe-indexed projection
     translation.  The substitution premise and the universe-index change are
-    kept exactly as Lean4Lean states them; erasing either makes the concrete
+    kept exactly as Ix.Theory.Named states them; erasing either makes the concrete
     `TrProj` impossible to instantiate. -/
 structure TrProjOK (env : VEnv) (uvars : Nat)
     (trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop) :
     Prop where
   weakN : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-    {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+    {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
     trProj uvars Γ s i e e' →
     trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k)
   instN : ∀ {Γ₀ : List VExpr} {e₀ A₀ : VExpr} {k : Nat}
     {Γ₁ Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
     env.HasType uvars Γ₀ e₀ A₀ →
-    Lean4Lean.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
+    Ix.Theory.Named.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
     trProj uvars Γ₁ s i e e' →
     trProj uvars Γ s i (e.inst e₀ k) (e'.inst e₀ k)
   wf : ∀ {Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
@@ -2022,7 +2024,7 @@ structure TrProjOK (env : VEnv) (uvars : Nat)
     trProj U' (Γ.map (VExpr.instL ls)) s i
       (e.instL ls) (e'.instL ls)
   monoU : ∀ {U U' : Nat} {Γ : List VExpr} {s : Lean.Name} {i : Nat}
-    {e e' : VExpr}, U ≤ U' → Lean4Lean.OnCtx Γ (env.IsType U) →
+    {e e' : VExpr}, U ≤ U' → Ix.Theory.Named.OnCtx Γ (env.IsType U) →
     trProj U Γ s i e e' → trProj U' Γ s i e e'
 
 /-- Uniqueness of structural translation up to defeq (upstream
@@ -2225,7 +2227,7 @@ theorem TrKExpr.defeq {env : VEnv} {uvars : Nat}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : VEnv.WF env)
     {m : Mode} {Δ : KVLCtx} {e : KExpr m} {e₁ e₂ : VExpr}
-    (hΔ : Lean4Lean.OnCtx Δ.toCtx (env.IsType uvars))
+    (hΔ : Ix.Theory.Named.OnCtx Δ.toCtx (env.IsType uvars))
     (h1 : TrKExpr env uvars nameOf trProj Δ e e₁)
     (h2 : env.IsDefEqU uvars Δ.toCtx e₁ e₂) :
     TrKExpr env uvars nameOf trProj Δ e e₂ :=
@@ -2239,7 +2241,7 @@ theorem TrKExpr.app {env : VEnv} {uvars : Nat}
     (henv : VEnv.WF env)
     {m : Mode} {Δ : KVLCtx} {f a : KExpr m} {md : ExprInfo m}
     {f' a' A B : VExpr}
-    (hΔ : Lean4Lean.OnCtx Δ.toCtx (env.IsType uvars))
+    (hΔ : Ix.Theory.Named.OnCtx Δ.toCtx (env.IsType uvars))
     (h1 : env.HasType uvars Δ.toCtx f' (.forallE A B))
     (h2 : env.HasType uvars Δ.toCtx a' A)
     (h3 : TrKExpr env uvars nameOf trProj Δ f f')
@@ -2361,4 +2363,4 @@ theorem TrKExpr.prj {env : VEnv} {uvars : Nat}
   have ⟨_, H2'⟩ := htp.defeqDFC hΓ h2.symm H2
   ⟨_, .prj h1 s2 H2', htp.uniq hΓ H2' H2 h2⟩
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/VLCtx.lean b/Ix/Kernel/Verify/VLCtx.lean
similarity index 93%
rename from Ix/Tc/Verify/VLCtx.lean
rename to Ix/Kernel/Verify/VLCtx.lean
index c59e2aaa0..4bde03d5e 100644
--- a/Ix/Tc/Verify/VLCtx.lean
+++ b/Ix/Kernel/Verify/VLCtx.lean
@@ -1,10 +1,12 @@
-import Ix.Tc.Env
-import Lean4Lean.Verify.VLCtx
+import Ix.Kernel.Env
+import Ix.Theory.Named.Verify.VLCtx
+
+open Ix.Theory (VLevel)
 
 /-!
 # `KVLCtx` — the translation-side local context
 
-The Ix.Tc analogue of lean4lean's `VLCtx`: a list of local declarations,
+The Ix.Kernel analogue of the named specification's `VLCtx`: a list of local declarations,
 each optionally tagged with the `FVarId` that addresses it (plus that
 entry's fvar dependency list, used by the well-formedness layer in
 Verify/Ctx.lean). Entries tagged `none` are addressable only by de
@@ -17,7 +19,7 @@ Design notes:
   `VExpr`-valued and fvar-agnostic (Theory-shaped despite living in
   upstream's Verify tree), so its `liftN`/`inst`/`instL` lemmas
   transfer. Only the fvar-keyed list structure is re-stated, keyed by
-  `Ix.Tc.FVarId` (the checker's per-`TypeChecker` `UInt64` ids) instead
+  `Ix.Kernel.FVarId` (the checker's per-`TypeChecker` `UInt64` ids) instead
   of `Lean.FVarId`.
 - `find?` mirrors upstream exactly: a bvar hit on a `vlam` produces
   `.bvar 0` lifted by the depth walked; a hit on a `vlet` produces the
@@ -29,9 +31,9 @@ Design notes:
   only the fvar-structural `FVWF` is here.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VLevel VLocalDecl)
+open Ix.Theory.Named (VExpr VLocalDecl)
 
 /-! Lawfulness of `FVarId` equality (KId pattern) — here because the
 fvar-keyed context machinery needs it from `Trans.lean` on. -/
@@ -126,4 +128,4 @@ def FVWF : KVLCtx → Prop
 
 end KVLCtx
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf.lean b/Ix/Kernel/Verify/Whnf.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf.lean
rename to Ix/Kernel/Verify/Whnf.lean
index d4067df1a..a3113ecbe 100644
--- a/Ix/Tc/Verify/Whnf.lean
+++ b/Ix/Kernel/Verify/Whnf.lean
@@ -1,7 +1,9 @@
-import Ix.Tc.Verify.Ctx
-import Ix.Tc.Verify.Inductive
-import Ix.Tc.Verify.Run
-import Ix.Tc.Verify.State
+import Ix.Kernel.Verify.Ctx
+import Ix.Kernel.Verify.Inductive
+import Ix.Kernel.Verify.Run
+import Ix.Kernel.Verify.State
+
+open Ix.Theory (VLevel)
 
 /-!
 # WHNF soundness boundary
@@ -24,9 +26,9 @@ from this layer and continue through a caller-supplied fallback semantics;
 K2 replaces that fallback with their exact typing contracts.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 open Std (HashSet)
 
 /-! ## Concrete reduction meaning -/
@@ -216,7 +218,7 @@ def InternUpdateFrame (before after : TcState .anon) : Prop :=
 /-- The empty projection relation satisfies every structural closure law
 vacuously.  This is the canonical K1 fixture interpretation for fragments
 that contain no projection nodes. -/
-theorem RawProjRel.none_ok (env : Lean4Lean.VEnv) (uvars : Nat) :
+theorem RawProjRel.none_ok (env : Ix.Theory.Named.VEnv) (uvars : Nat) :
     TrProjOK env uvars RawProjRel.none := by
   constructor <;> intros <;> contradiction
 
@@ -1550,7 +1552,7 @@ theorem letE {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     TrKExprS.inst_let_lbr world.venvWF.ordered theory.projections.weakN
       hvalCon hbody hval hbig
   exact ⟨bodyV, bodyV, hsource, hresult,
-    Lean4Lean.VEnv.IsDefEqU.refl (theory.exprWF hctx hresult)⟩
+    Ix.Theory.Named.VEnv.IsDefEqU.refl (theory.exprWF hctx hresult)⟩
 
 /-- One concrete beta step.  The result is the same `substSpec` computed by
 the verified substitution walker; the proof uses `TrKExprS.instN` and the
@@ -1561,7 +1563,7 @@ theorem beta {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Δ : KVLCtx} {nm : Mode.anon.F Name}
     {bi : Mode.anon.F Lean.BinderInfo}
     {ty body arg : KExpr .anon} {lamMd appMd : ExprInfo .anon}
-    {A bodyV argV B : VExpr} {u : Lean4Lean.VLevel}
+    {A bodyV argV B : VExpr} {u : Ix.Theory.VLevel}
     (hty : TrKExprS world.venv uvars world.nameOf trProj Δ ty A)
     (hbody : TrKExprS world.venv uvars world.nameOf trProj
       ((none, .vlam A) :: Δ) body bodyV)
@@ -1579,7 +1581,7 @@ theorem beta {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
   have hsource : TrKExprS world.venv uvars world.nameOf trProj Δ
       (.app (.lam nm bi ty body lamMd) arg appMd)
       (.app (.lam A bodyV) argV) :=
-    .app (Lean4Lean.VEnv.HasType.lam hA hbodyTy) hargTy hlam harg
+    .app (Ix.Theory.Named.VEnv.HasType.lam hA hbodyTy) hargTy hlam harg
   have hresult : TrKExprS world.venv uvars world.nameOf trProj Δ
       (KExpr.substSpec body arg 0) (bodyV.inst argV) :=
     TrKExprS.instN world.venvWF.ordered projections.weakN
@@ -1630,7 +1632,7 @@ instantiated left- and right-hand sides; mere membership of a raw recursor
 rule does not determine the production argument spine. -/
 theorem registeredDefEq {trProj : RawProjRel} {world : VerifyWorld}
     {uvars : Nat} {Δ : KVLCtx} {source result : KExpr .anon}
-    {df : Lean4Lean.VDefEq} {levels : List Lean4Lean.VLevel}
+    {df : Ix.Theory.Named.VDefEq} {levels : List Ix.Theory.VLevel}
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Δ source
       (df.lhs.instL levels))
     (hresult : TrKExprS world.venv uvars world.nameOf trProj Δ result
@@ -5708,7 +5710,7 @@ theorem appSpineView_collectSpine (e : KExpr m) :
 /-- Translation-indexed spine view.  Each extension retains the exact
 function and argument typing derivations needed for semantic application
 congruence. -/
-inductive TrAppSpine (env : Lean4Lean.VEnv) (uvars : Nat)
+inductive TrAppSpine (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     (Δ : KVLCtx) (head : KExpr .anon) :
     List (KExpr .anon) → VExpr → Prop
@@ -5726,7 +5728,7 @@ inductive TrAppSpine (env : Lean4Lean.VEnv) (uvars : Nat)
 /-- Every structural translation induces the corresponding typed spine
 translation; expression metadata is deliberately absent from the view. -/
 theorem trAppSpine_of_tr
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Δ : KVLCtx} {e : KExpr .anon} {eV : VExpr}
     (h : TrKExprS env uvars nameOf trProj Δ e eV) :
@@ -5757,7 +5759,7 @@ translation and typing derivation.  This is the membership form needed by
 descriptor-driven reducers whose argument positions are discovered only at
 runtime. -/
 theorem argument
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head arg : KExpr .anon}
     {args : List (KExpr .anon)} {resultV : VExpr}
@@ -5777,7 +5779,7 @@ theorem argument
 /-- Rebuild the canonical metadata-free raw spine without changing its
 Theory translation. -/
 theorem tr
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Δ : KVLCtx} {head : KExpr .anon} {args : List (KExpr .anon)}
     {eV : VExpr}
@@ -5797,7 +5799,7 @@ end TrAppSpine
 /-- Re-index a source translation by the head and array returned by the
 actual production `collectSpine`. -/
 theorem trAppSpine_of_collectSpine
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Δ : KVLCtx} {source head : KExpr .anon}
     {args : Array (KExpr .anon)} {sourceV : VExpr}
@@ -7585,7 +7587,7 @@ structure NoDeltaInputSupport (support : RunSupport) : Prop where
     support head ∧ ∀ (i : Nat) (hi : i < args.size), support args[i]
 
 /-- The concrete K1 input for active no-delta primitive proofs. It binds the
-canonical anon table to trusted Theory names, carries Lean4Lean's primitive
+canonical anon table to trusted Theory names, carries Ix.Theory.Named's primitive
 reflection laws, records the quotient lift equation, and scopes generated
 syntax to actual supported executions. This is necessary but intentionally
 not sufficient for `NoDeltaBaseOracle`: helper state frames and branch-level
@@ -7595,7 +7597,7 @@ structure NoDeltaPrimitiveContext (world : VerifyWorld) (support : RunSupport)
   table : ∀ prims, prims.CanonicalAnon →
     NoDeltaPrimitiveTableAgrees world prims
   theoryPrimitives : world.venv.HasPrimitives
-  quotientDefEq : world.venv.defeqs Lean4Lean.quotDefEq
+  quotientDefEq : world.venv.defeqs Ix.Theory.Named.quotDefEq
   collisionFree : support.CollisionFree
   inputs : NoDeltaInputSupport support
   generated : NoDeltaGeneratedSupport support flags natSuccMode
@@ -7616,7 +7618,7 @@ theorem stateTable
 
 /-- `computeNatBin` uses the fixed canonical address table.  Under the
 production table binding, every successful arithmetic result is therefore
-one of Lean4Lean's reflected primitive equations, lifted from the empty
+one of Ix.Theory.Named's reflected primitive equations, lifted from the empty
 universe/local context to the current checker context. -/
 theorem computeNatBin_defeq
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
@@ -8085,7 +8087,7 @@ theorem natPredicate_classifiers
     · simp
 
 /-- Reflect the concrete predicate decision selected by production into the
-corresponding Lean4Lean `Nat.beq` or `Nat.ble` equation. -/
+corresponding Ix.Theory.Named `Nat.beq` or `Nat.ble` equation. -/
 theorem natPredicate_defeq
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {flags : WhnfFlags} {natSuccMode : NatSuccMode}
@@ -8344,7 +8346,7 @@ theorem appSameArg
       have hfunEq := hsourceEq.trans world.venvWF hΔ hdefeq
       have hfunEqTyped := hfunEq.of_l world.venvWF hΔ hsourceType
       have hargEq : world.venv.IsDefEqU uvars Δ.toCtx _ _ :=
-        Lean4Lean.VEnv.IsDefEqU.refl ⟨_, hargType⟩
+        Ix.Theory.Named.VEnv.IsDefEqU.refl ⟨_, hargType⟩
       have hargEqTyped := hargEq.of_l world.venvWF hΔ hargType
       have hresultTr' : TrKExprS world.venv uvars world.nameOf trProj Δ
           (KExpr.mkApp result arg) (.app resultV argV) := by
@@ -11877,14 +11879,14 @@ to a function type in a well-formed context.
 
 This is strictly narrower than `ExactArity` below.  It says nothing about
 production classifiers, concrete spines, method tables, or run support, and
-is the intended target for Lean4Lean's eventual canonical-type
+is the intended target for Ix.Theory.Named's eventual canonical-type
 no-confusion theorem. -/
 structure NatBoolResultShapeSeparation (world : VerifyWorld) : Prop where
   nat : ∀ {uvars : Nat} {Gamma : List VExpr} {A B : VExpr},
-    Lean4Lean.OnCtx Gamma (world.venv.IsType uvars) →
+    Ix.Theory.Named.OnCtx Gamma (world.venv.IsType uvars) →
     ¬ world.venv.IsDefEqU uvars Gamma .nat (.forallE A B)
   bool : ∀ {uvars : Nat} {Gamma : List VExpr} {A B : VExpr},
-    Lean4Lean.OnCtx Gamma (world.venv.IsType uvars) →
+    Ix.Theory.Named.OnCtx Gamma (world.venv.IsType uvars) →
     ¬ world.venv.IsDefEqU uvars Gamma .bool (.forallE A B)
 
 /-- A translated application suffix must be empty when its base has a
@@ -12088,8 +12090,8 @@ theorem of_result_shape
       rw [KExpr.mkApp_shape, KExpr.mkApp_shape]
       exact hbaseMeaningExact
     have hnatType₀ : world.venv.HasType uvars [] (.natLit value) .nat := by
-      simpa [Lean4Lean.VLCtx.toCtx] using
-        (Lean4Lean.TrExprS.natLit
+      simpa [Ix.Theory.Named.VLCtx.toCtx] using
+        (Ix.Theory.Named.TrExprS.natLit
           (Us := List.replicate uvars Lean.Name.anonymous) (Δ := [])
           context.theoryPrimitives (htable.nat.contains hcatalog) value).2
     have hnatType : world.venv.HasType uvars Delta.toCtx
@@ -12206,8 +12208,8 @@ theorem of_result_shape
       exact hbaseMeaningExact
     have hboolType₀ : world.venv.HasType uvars []
         (.boolLit decision) .bool := by
-      simpa [Lean4Lean.VLCtx.toCtx] using
-        (Lean4Lean.TrExprS.boolLit
+      simpa [Ix.Theory.Named.VLCtx.toCtx] using
+        (Ix.Theory.Named.TrExprS.boolLit
           (Us := List.replicate uvars Lean.Name.anonymous) (Δ := [])
           context.theoryPrimitives (htable.boolType.contains hcatalog)
           decision).2
@@ -12857,25 +12859,25 @@ theorem natSucc_hasType
   obtain ⟨ci, hlookup⟩ := htable.natSucc.contains hcatalog
   have hci := hprims.natSucc hlookup
   subst ci
-  exact Lean4Lean.VEnv.HasType.const hlookup (by simp) rfl
+  exact Ix.Theory.Named.VEnv.HasType.const hlookup (by simp) rfl
 
 /-- Successor reconstruction preserves the canonical Nat type. -/
 theorem natSuccIterV_hasType
-    {env : Lean4Lean.VEnv} {uvars : Nat} {Gamma : List VExpr}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat} {Gamma : List VExpr}
     (hsucc : env.HasType uvars Gamma .natSucc (.forallE .nat .nat))
     {value : VExpr} (hvalue : env.HasType uvars Gamma value .nat)
     (offset : Nat) :
     env.HasType uvars Gamma (natSuccIterV offset value) .nat := by
   induction offset with
   | zero => exact hvalue
-  | succ offset ih => exact Lean4Lean.VEnv.HasType.app hsucc ih
+  | succ offset ih => exact Ix.Theory.Named.VEnv.HasType.app hsucc ih
 
 /-- Definitional equality of the current inner Nat lifts through every
 successor already represented by the loop offset. -/
 theorem natSuccIterV_congr
-    {env : Lean4Lean.VEnv} (henv : env.WF)
+    {env : Ix.Theory.Named.VEnv} (henv : env.WF)
     {uvars : Nat} {Gamma : List VExpr}
-    (hGamma : Lean4Lean.OnCtx Gamma (env.IsType uvars))
+    (hGamma : Ix.Theory.Named.OnCtx Gamma (env.IsType uvars))
     (hsucc : env.HasType uvars Gamma .natSucc (.forallE .nat .nat))
     {left right : VExpr}
     (hleft : env.HasType uvars Gamma left .nat)
@@ -12975,7 +12977,7 @@ theorem isNatSuccSpine_wf
 
 /-- Singleton inversion for the typed application-spine view. -/
 theorem trAppSpine_singleton
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : RawProjRel} {Delta : KVLCtx} {head arg : KExpr .anon}
     {resultV : VExpr}
@@ -13037,7 +13039,7 @@ theorem natSuccSpine_tr
   have htypes := hfun.uniqU world.venvWF hDelta.toCtx hsucc
   obtain ⟨⟨_, hdomain⟩, _⟩ :=
     htypes.forallE_inv world.venvWF hDelta.toCtx
-  have hargNat := Lean4Lean.VEnv.HasType.defeqU_r
+  have hargNat := Ix.Theory.Named.VEnv.HasType.defeqU_r
     world.venvWF hDelta.toCtx
     ⟨_, hdomain⟩ harg
   exact ⟨curV, hcur, hargNat, rfl⟩
@@ -13681,7 +13683,7 @@ theorem tryReduceNatWithSuccMode_succ_optional_wf
     hI.1.core.trustedCatalog htable context.theoryPrimitives
   have happType : world.venv.HasType uvars Delta.toCtx
       (.app .natSucc argV) .nat :=
-    Lean4Lean.VEnv.HasType.app hsucc hargType
+    Ix.Theory.Named.VEnv.HasType.app hsucc hargType
   have hsourceEq : world.venv.IsDefEqU uvars Delta.toCtx sourceV
       (natSuccIterV 1 argV) := by
     rw [hsourceV]
@@ -15446,4 +15448,4 @@ theorem whnfNoDeltaImpl_noAccel_wf_of_base
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/ArgumentAlignment.lean b/Ix/Kernel/Verify/Whnf/Beta/ArgumentAlignment.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Beta/ArgumentAlignment.lean
rename to Ix/Kernel/Verify/Whnf/Beta/ArgumentAlignment.lean
index 262fb8489..666541530 100644
--- a/Ix/Tc/Verify/Whnf/Beta/ArgumentAlignment.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/ArgumentAlignment.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.InstantiationChain
+import Ix.Kernel.Verify.Whnf.Beta.InstantiationChain
 
 /-!
 # Align concrete and Theory beta arguments
@@ -9,9 +9,9 @@ the pointwise alignment once, including array/list indexing, so the one-pass
 translation theorem can use the exact selected argument in its variable arm.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 namespace RecM
 
@@ -132,4 +132,4 @@ theorem ofValues
 
 end SimulArgs
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/ConsumptionBoundary.lean b/Ix/Kernel/Verify/Whnf/Beta/ConsumptionBoundary.lean
similarity index 87%
rename from Ix/Tc/Verify/Whnf/Beta/ConsumptionBoundary.lean
rename to Ix/Kernel/Verify/Whnf/Beta/ConsumptionBoundary.lean
index 6355c3b21..0e3cfd9cf 100644
--- a/Ix/Tc/Verify/Whnf/Beta/ConsumptionBoundary.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/ConsumptionBoundary.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.LambdaPeeling
+import Ix.Kernel.Verify.Whnf.Beta.LambdaPeeling
 
 /-!
 # Typed splitting at the multi-beta consumption boundary
@@ -9,7 +9,7 @@ position, retaining both the applications consumed by beta and every
 unconsumed application rebuilt afterward.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 namespace TrAppSuffix
 
@@ -18,13 +18,13 @@ definitional equality while retaining the suffix as a `TrAppSuffix`.  Unlike
 `rebase`, this form is intended for a second structural transformation of the
 replacement prefix before the original trailing arguments are reattached. -/
 theorem rebaseStart
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {start : Lean4Lean.VExpr}
-    {args : List (KExpr .anon)} {resultV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {start : Ix.Theory.Named.VExpr}
+    {args : List (KExpr .anon)} {resultV : Ix.Theory.Named.VExpr}
     (h : TrAppSuffix env uvars nameOf trProj Delta start args resultV)
     (henv : env.WF) (hDelta : KVLCtx.WF env uvars Delta)
-    {replacementV : Lean4Lean.VExpr}
+    {replacementV : Ix.Theory.Named.VExpr}
     (hreplacement : env.IsDefEqU uvars Delta.toCtx start replacementV) :
     exists resultV',
       TrAppSuffix env uvars nameOf trProj Delta replacementV args resultV' /\
@@ -41,15 +41,15 @@ theorem rebaseStart
         hcurrentEq.of_l henv hDelta.toCtx hfun
       exact ⟨.app currentV' argV,
         .app hcurrentSuffix hcurrentType harg hargTr,
-        (Lean4Lean.VEnv.IsDefEq.appDF hcurrentEqAt harg).toU⟩
+        (Ix.Theory.Named.VEnv.IsDefEq.appDF hcurrentEqAt harg).toU⟩
 
 /-- Split a typed application suffix after exactly `n` arguments.  Both
 pieces retain their original typing derivations and production order. -/
 theorem splitAt
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {start : Lean4Lean.VExpr}
-    {args : List (KExpr .anon)} {resultV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {start : Ix.Theory.Named.VExpr}
+    {args : List (KExpr .anon)} {resultV : Ix.Theory.Named.VExpr}
     (h : TrAppSuffix env uvars nameOf trProj Delta start args resultV)
     (n : Nat) (hn : n <= args.length) :
     exists middleV,
@@ -84,9 +84,9 @@ theorem splitAt
 arguments; the second contains exactly the `Array.extract` rebuilt by
 `finishAppResult`. -/
 theorem splitConsume
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {startV resultV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {startV resultV : Ix.Theory.Named.VExpr}
     {start body : KExpr .anon} {args consumed : Array (KExpr .anon)}
     (hconsume : consumeBetaLams start args = (body, consumed))
     (h : TrAppSuffix env uvars nameOf trProj Delta startV args.toList
@@ -108,4 +108,4 @@ theorem splitConsume
 
 end TrAppSuffix
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/DependentContexts.lean b/Ix/Kernel/Verify/Whnf/Beta/DependentContexts.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Beta/DependentContexts.lean
rename to Ix/Kernel/Verify/Whnf/Beta/DependentContexts.lean
index 1041a688a..ce78965bd 100644
--- a/Ix/Tc/Verify/Whnf/Beta/DependentContexts.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/DependentContexts.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.PrefixSemantics
+import Ix.Kernel.Verify.Whnf.Beta.PrefixSemantics
 
 /-!
 # Dependent context chains for simultaneous beta
@@ -10,7 +10,7 @@ syntax binder and transports the abstract projection relation through every
 Theory instantiation.
 -/
 
-namespace Lean4Lean.VLocalDecl
+namespace Ix.Theory.Named.VLocalDecl
 
 /-- Instantiate a declaration by outer-to-inner beta arguments. -/
 def instBetaArgs (d : VLocalDecl) : List VExpr → (depth : Nat) → VLocalDecl
@@ -52,11 +52,11 @@ theorem instBetaArgs_depth (d : VLocalDecl) (args : List VExpr)
       rw [instBetaArgs, VLocalDecl.inst, VExpr.instBetaArgs,
         VExpr.instBetaArgs, ih]
 
-end Lean4Lean.VLocalDecl
+end Ix.Theory.Named.VLocalDecl
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 namespace KVLCtx
 
@@ -279,7 +279,7 @@ theorem projection
     (htpI : ∀ {Γ₀ : List VExpr} {e₀ A₀ : VExpr} {position : Nat}
       {Γ₁ Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
       env.HasType uvars Γ₀ e₀ A₀ →
-      Lean4Lean.Ctx.InstN Γ₀ e₀ A₀ position Γ₁ Γ →
+      Ix.Theory.Named.Ctx.InstN Γ₀ e₀ A₀ position Γ₁ Γ →
       trProj uvars Γ₁ s i e e' →
       trProj uvars Γ s i (e.inst e₀ position) (e'.inst e₀ position))
     {structName : Lean.Name} {field : Nat} {value result : VExpr}
@@ -295,4 +295,4 @@ theorem projection
 
 end KInsts
 end KVLCtx
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/InstantiationChain.lean b/Ix/Kernel/Verify/Whnf/Beta/InstantiationChain.lean
similarity index 95%
rename from Ix/Tc/Verify/Whnf/Beta/InstantiationChain.lean
rename to Ix/Kernel/Verify/Whnf/Beta/InstantiationChain.lean
index 3cf8cf957..740287607 100644
--- a/Ix/Tc/Verify/Whnf/Beta/InstantiationChain.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/InstantiationChain.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.DependentContexts
+import Ix.Kernel.Verify.Whnf.Beta.DependentContexts
 
 /-!
 # The peeled telescope induces a dependent instantiation chain
@@ -10,9 +10,9 @@ context chain itself follows from the recovered lambda declarations and the
 exact Theory argument values.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 namespace RecM.BetaPeel.Tr
 
@@ -52,7 +52,7 @@ theorem contextInsts
         hfun'.lam_inv world.venvWF.ordered hDelta.toCtx
       have hlam' : world.venv.HasType uvars Delta.toCtx
           (.lam A' bodyV') (.forallE A' B') :=
-        Lean4Lean.VEnv.HasType.lam hA' hbodyV'
+        Ix.Theory.Named.VEnv.HasType.lam hA' hbodyV'
       have hforallEq : world.venv.IsDefEqU uvars Delta.toCtx
           (.forallE domain codomain) (.forallE A' B') :=
         hfun'.uniqU world.venvWF hDelta.toCtx hlam'
@@ -75,4 +75,4 @@ theorem contextInsts
       exact hlifted'.append hfinal
 
 end RecM.BetaPeel.Tr
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/LambdaInstantiation.lean b/Ix/Kernel/Verify/Whnf/Beta/LambdaInstantiation.lean
similarity index 83%
rename from Ix/Tc/Verify/Whnf/Beta/LambdaInstantiation.lean
rename to Ix/Kernel/Verify/Whnf/Beta/LambdaInstantiation.lean
index ebc32c44c..754e5b526 100644
--- a/Ix/Tc/Verify/Whnf/Beta/LambdaInstantiation.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/LambdaInstantiation.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.SimultaneousSubstitution
+import Ix.Kernel.Verify.Whnf.Beta.SimultaneousSubstitution
 
 /-!
 # Walker-tight lambda instantiation
@@ -10,57 +10,57 @@ This slice replays the same structural proof using `TrKExprS.weakBV_lbr`, so
 the theorem consumes precisely the final bound carried by `WalkerRequest`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 private theorem instNatLit_bx (v : Nat) (e₀ : VExpr) (k : Nat) :
-    (Lean4Lean.VExpr.natLit v).inst e₀ k = Lean4Lean.VExpr.natLit v := by
+    (Ix.Theory.Named.VExpr.natLit v).inst e₀ k = Ix.Theory.Named.VExpr.natLit v := by
   induction v with
   | zero => rfl
   | succ v ih =>
-    show Lean4Lean.VExpr.app _ _ = _
-    rw [show ((Lean4Lean.VExpr.natLit v).inst e₀ k) =
-        Lean4Lean.VExpr.natLit v from ih]
+    show Ix.Theory.Named.VExpr.app _ _ = _
+    rw [show ((Ix.Theory.Named.VExpr.natLit v).inst e₀ k) =
+        Ix.Theory.Named.VExpr.natLit v from ih]
     rfl
 
 private theorem instListCharLit_bx (s : List Char) (e₀ : VExpr) (k : Nat) :
-    (Lean4Lean.VExpr.listCharLit s).inst e₀ k =
-      Lean4Lean.VExpr.listCharLit s := by
+    (Ix.Theory.Named.VExpr.listCharLit s).inst e₀ k =
+      Ix.Theory.Named.VExpr.listCharLit s := by
   induction s with
   | nil => rfl
   | cons c s ih =>
-    show Lean4Lean.VExpr.app (Lean4Lean.VExpr.app _ (Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.natLit c.toNat).inst e₀ k)))
-      ((Lean4Lean.VExpr.listCharLit s).inst e₀ k) = _
+    show Ix.Theory.Named.VExpr.app (Ix.Theory.Named.VExpr.app _ (Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.natLit c.toNat).inst e₀ k)))
+      ((Ix.Theory.Named.VExpr.listCharLit s).inst e₀ k) = _
     rw [instNatLit_bx, ih]
     rfl
 
 private theorem instTrLiteral_bx (l : Lean.Literal) (e₀ : VExpr) (k : Nat) :
-    (Lean4Lean.VExpr.trLiteral l).inst e₀ k =
-      Lean4Lean.VExpr.trLiteral l := by
+    (Ix.Theory.Named.VExpr.trLiteral l).inst e₀ k =
+      Ix.Theory.Named.VExpr.trLiteral l := by
   cases l with
   | natVal v => exact instNatLit_bx v e₀ k
   | strVal s =>
-    show Lean4Lean.VExpr.app _
-      ((Lean4Lean.VExpr.listCharLit _).inst e₀ k) = _
+    show Ix.Theory.Named.VExpr.app _
+      ((Ix.Theory.Named.VExpr.listCharLit _).inst e₀ k) = _
     rw [instListCharLit_bx]
     rfl
 
 /-- `substSpec` tracks Theory instantiation under the exact loose-binder
 bound carried by a substitution walker request. -/
-theorem TrKExprS.instN_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
+theorem TrKExprS.instN_lbr {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name}
     {trProj : Nat → List VExpr → Lean.Name → Nat → VExpr → VExpr → Prop}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     (htpI : ∀ {Γ₀ : List VExpr} {e₀ A₀ : VExpr} {k : Nat}
       {Γ₁ Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
       env.HasType uvars Γ₀ e₀ A₀ →
-      Lean4Lean.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
+      Ix.Theory.Named.Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
       trProj uvars Γ₁ s i e e' →
       trProj uvars Γ s i (e.inst e₀ k) (e'.inst e₀ k))
     {Δ₀ : KVLCtx} {arg : KExpr .anon} {e₀' A₀ : VExpr}
@@ -167,14 +167,14 @@ theorem TrKExprS.instN_lbr {env : Lean4Lean.VEnv} {uvars : Nat}
     exact .prj h1 (ihval W hdepth (by omega)) (htpI t₀ W.toCtx htrp)
   | @nat Δ₁' v blob md h =>
     intro Δ dk k depth W hdepth hbig
-    rw [show (Lean4Lean.VExpr.natLit v).inst e₀' k =
-        Lean4Lean.VExpr.natLit v from instNatLit_bx v e₀' k]
+    rw [show (Ix.Theory.Named.VExpr.natLit v).inst e₀' k =
+        Ix.Theory.Named.VExpr.natLit v from instNatLit_bx v e₀' k]
     exact .nat h
   | @str Δ₁' s blob md h =>
     intro Δ dk k depth W hdepth hbig
-    rw [show (Lean4Lean.VExpr.trLiteral (.strVal s)).inst e₀' k =
-        Lean4Lean.VExpr.trLiteral (.strVal s) from
+    rw [show (Ix.Theory.Named.VExpr.trLiteral (.strVal s)).inst e₀' k =
+        Ix.Theory.Named.VExpr.trLiteral (.strVal s) from
       instTrLiteral_bx (.strVal s) e₀' k]
     exact .str h
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/LambdaPeeling.lean b/Ix/Kernel/Verify/Whnf/Beta/LambdaPeeling.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Beta/LambdaPeeling.lean
rename to Ix/Kernel/Verify/Whnf/Beta/LambdaPeeling.lean
index edeed4615..0d70cf0f8 100644
--- a/Ix/Tc/Verify/Whnf/Beta/LambdaPeeling.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/LambdaPeeling.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.StepAssembly
+import Ix.Kernel.Verify.Whnf.Structural.StepAssembly
 
 /-!
 # Certified lambda peeling for general beta
@@ -9,7 +9,7 @@ spine was consumed.  This slice gives the loop a structural certificate and
 proves that the returned array is exactly a prefix of the input arguments.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- A sequence of lambda bodies reached by consuming arguments in production
@@ -122,4 +122,4 @@ theorem consumed_append_remaining
 end BetaPeel
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/LiftSubstitution.lean b/Ix/Kernel/Verify/Whnf/Beta/LiftSubstitution.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Beta/LiftSubstitution.lean
rename to Ix/Kernel/Verify/Whnf/Beta/LiftSubstitution.lean
index 722f2e9f3..616c017fd 100644
--- a/Ix/Tc/Verify/Whnf/Beta/LiftSubstitution.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/LiftSubstitution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.SingletonSubstitution
+import Ix.Kernel.Verify.Whnf.Beta.SingletonSubstitution
 
 /-!
 # Lift/substitution cancellation for multi-beta
@@ -9,7 +9,7 @@ remove precisely the added lift.  This file proves that pure syntactic law
 with the same no-wrap discipline as the production walkers.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace KExpr
 
 private theorem toNat_max_bv (a b : UInt64) :
@@ -225,4 +225,4 @@ theorem substSpec_liftSpec_succ
   simpa only [UInt64.add_zero] using h
 
 end KExpr
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/Meaning.lean b/Ix/Kernel/Verify/Whnf/Beta/Meaning.lean
similarity index 94%
rename from Ix/Tc/Verify/Whnf/Beta/Meaning.lean
rename to Ix/Kernel/Verify/Whnf/Beta/Meaning.lean
index c5c25ddeb..9ac67798a 100644
--- a/Ix/Tc/Verify/Whnf/Beta/Meaning.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/Meaning.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.Translation
+import Ix.Kernel.Verify.Whnf.Beta.Translation
 
 /-!
 # Constructive multi-beta meaning
@@ -10,9 +10,9 @@ file assembles those pieces into `BetaPrefixMeaning`, eliminating the last
 semantic oracle specific to general multi-beta.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 namespace RecM
 
@@ -42,4 +42,4 @@ theorem betaManyMeaning (trProj : RawProjRel) (world : VerifyWorld) :
   BetaManyMeaningOracle.of_prefix (betaPrefixMeaning trProj world)
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/PeelTrace.lean b/Ix/Kernel/Verify/Whnf/Beta/PeelTrace.lean
similarity index 81%
rename from Ix/Tc/Verify/Whnf/Beta/PeelTrace.lean
rename to Ix/Kernel/Verify/Whnf/Beta/PeelTrace.lean
index 472647ada..029464ff5 100644
--- a/Ix/Tc/Verify/Whnf/Beta/PeelTrace.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/PeelTrace.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.SemanticCore
+import Ix.Kernel.Verify.Whnf.Beta.SemanticCore
 
 /-!
 # Translated lambda-peel traces
@@ -10,7 +10,7 @@ body.  Subsequent simultaneous-instantiation proofs can therefore reason from
 the actual binder stack rather than only from the number of consumed terms.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 namespace BetaPeel
@@ -19,10 +19,10 @@ namespace BetaPeel
 The final context is the original `Delta` extended by one `vlam` entry per
 consumed argument, in the same innermost-first order used by de Bruijn
 indices. -/
-inductive Tr (env : Lean4Lean.VEnv) (uvars : Nat)
+inductive Tr (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address -> Option Lean.Name) (trProj : RawProjRel)
-    (Delta : KVLCtx) (start : KExpr .anon) (startV : Lean4Lean.VExpr) :
-    List (KExpr .anon) -> KExpr .anon -> KVLCtx -> Lean4Lean.VExpr -> Prop
+    (Delta : KVLCtx) (start : KExpr .anon) (startV : Ix.Theory.Named.VExpr) :
+    List (KExpr .anon) -> KExpr .anon -> KVLCtx -> Ix.Theory.Named.VExpr -> Prop
   | nil
       (hstart : TrKExprS env uvars nameOf trProj Delta start startV) :
       Tr env uvars nameOf trProj Delta start startV [] start Delta startV
@@ -30,7 +30,7 @@ inductive Tr (env : Lean4Lean.VEnv) (uvars : Nat)
       {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
       {ty body : KExpr .anon} {info : ExprInfo .anon}
       {arg : KExpr .anon} {currentDelta : KVLCtx}
-      {A bodyV : Lean4Lean.VExpr}
+      {A bodyV : Ix.Theory.Named.VExpr}
       (hprefix : Tr env uvars nameOf trProj Delta start startV consumed
         (.lam name bi ty body info) currentDelta (.lam A bodyV))
       (hA : env.IsType uvars currentDelta.toCtx A)
@@ -45,11 +45,11 @@ namespace Tr
 /-- The final concrete body in a translated peel trace has the structural
 translation stored at the trace endpoint. -/
 theorem result
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {start : KExpr .anon} {startV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {start : KExpr .anon} {startV : Ix.Theory.Named.VExpr}
     {consumed : List (KExpr .anon)} {body : KExpr .anon}
-    {bodyDelta : KVLCtx} {bodyV : Lean4Lean.VExpr}
+    {bodyDelta : KVLCtx} {bodyV : Ix.Theory.Named.VExpr}
     (h : Tr env uvars nameOf trProj Delta start startV consumed body
       bodyDelta bodyV) :
     TrKExprS env uvars nameOf trProj bodyDelta body bodyV := by
@@ -60,11 +60,11 @@ theorem result
 /-- Every consumed lambda contributes exactly one Theory binder to the final
 mixed context. -/
 theorem bvars
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
-    {Delta : KVLCtx} {start : KExpr .anon} {startV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {start : KExpr .anon} {startV : Ix.Theory.Named.VExpr}
     {consumed : List (KExpr .anon)} {body : KExpr .anon}
-    {bodyDelta : KVLCtx} {bodyV : Lean4Lean.VExpr}
+    {bodyDelta : KVLCtx} {bodyV : Ix.Theory.Named.VExpr}
     (h : Tr env uvars nameOf trProj Delta start startV consumed body
       bodyDelta bodyV) :
     bodyDelta.bvars = Delta.bvars + consumed.length := by
@@ -80,10 +80,10 @@ end Tr
 translated peel trace and an exact structural translation of the final raw
 body under the recovered binder context. -/
 theorem translate
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start body : KExpr .anon}
-    {consumed : List (KExpr .anon)} {startV : Lean4Lean.VExpr}
+    {consumed : List (KExpr .anon)} {startV : Ix.Theory.Named.VExpr}
     (hpeel : BetaPeel start consumed body)
     (hstart : TrKExprS env uvars nameOf trProj Delta start startV) :
     exists bodyDelta bodyV,
@@ -100,4 +100,4 @@ theorem translate
 
 end BetaPeel
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/PrefixSemantics.lean b/Ix/Kernel/Verify/Whnf/Beta/PrefixSemantics.lean
similarity index 95%
rename from Ix/Tc/Verify/Whnf/Beta/PrefixSemantics.lean
rename to Ix/Kernel/Verify/Whnf/Beta/PrefixSemantics.lean
index 5bbfb809a..98fdcabae 100644
--- a/Ix/Tc/Verify/Whnf/Beta/PrefixSemantics.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/PrefixSemantics.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Beta.LambdaInstantiation
+import Ix.Kernel.Verify.Whnf.Beta.LambdaInstantiation
+
+open Ix.Theory (VLevel)
 
 /-!
 # Theory semantics of a peeled beta prefix
@@ -11,13 +13,13 @@ separate one-pass theorem so it need not pretend that sequential intermediate
 terms satisfy production's size bound.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
-end Ix.Tc
+end Ix.Kernel
 
-namespace Lean4Lean.VExpr
+namespace Ix.Theory.Named.VExpr
 
 /-- Instantiate outer-to-inner beta arguments.  The first argument removes
 the outermost remaining binder; the final argument removes the binder at
@@ -124,17 +126,17 @@ theorem instBetaArgs_liftN (e : VExpr) (args : List VExpr) (depth : Nat) :
           (depth + args.length) + 1 := by omega
       rw [hamount, inst_liftN_total, ih]
 
-end Lean4Lean.VExpr
+end Ix.Theory.Named.VExpr
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 namespace RecM.TrAppSuffix
 
 /-- A typed suffix together with the exact Theory argument values in the same
 production order as its concrete arguments. -/
-inductive Values (env : Lean4Lean.VEnv) (uvars : Nat)
+inductive Values (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     (Delta : KVLCtx) (start : VExpr) :
     List (KExpr .anon) → List VExpr → VExpr → Prop
@@ -152,7 +154,7 @@ namespace Values
 
 /-- Every typed suffix exposes its exact Theory argument list. -/
 theorem ofSuffix
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {resultV : VExpr}
@@ -168,7 +170,7 @@ theorem ofSuffix
 /-- The empty concrete suffix has no Theory arguments and leaves its start
 expression unchanged. -/
 theorem nil_inv
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start resultV : VExpr} {argValues : List VExpr}
     (h : Values env uvars nameOf trProj Delta start [] argValues resultV) :
@@ -180,7 +182,7 @@ theorem nil_inv
 
 /-- Exact last-argument view, retaining the Theory-value list. -/
 theorem unsnoc
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {arg : KExpr .anon}
@@ -207,7 +209,7 @@ end Values
 
 /-- Exact last-argument view of a typed suffix. -/
 theorem unsnoc
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {arg : KExpr .anon} {resultV : VExpr}
@@ -263,7 +265,7 @@ theorem theoryMeaning
   induction h generalizing argValues appliedV with
   | nil hstart =>
       obtain ⟨rfl, rfl⟩ := happs.nil_inv
-      exact Lean4Lean.VEnv.IsDefEqU.refl
+      exact Ix.Theory.Named.VEnv.IsDefEqU.refl
         (hstart.wf world.venvWF.ordered theory.literalWF
           theory.projections.wf hDelta)
   | @snoc consumed name bi ty body info arg currentDelta A bodyV hprefix
@@ -281,7 +283,7 @@ theorem theoryMeaning
         hfun'.lam_inv world.venvWF.ordered hDelta.toCtx
       have hlam' : world.venv.HasType uvars Delta.toCtx
           (.lam A' bodyV') (.forallE A' B') :=
-        Lean4Lean.VEnv.HasType.lam hA' hbodyV'
+        Ix.Theory.Named.VEnv.HasType.lam hA' hbodyV'
       have hforallEq : world.venv.IsDefEqU uvars Delta.toCtx
           (.forallE domain codomain) (.forallE A' B') :=
         hfun'.uniqU world.venvWF hDelta.toCtx hlam'
@@ -293,7 +295,7 @@ theorem theoryMeaning
         harg.defeqU_r world.venvWF hDelta.toCtx hdomainEq
       have happCong : world.venv.IsDefEqU uvars Delta.toCtx
           (.app currentV argV) (.app (.lam A' bodyV') argV) :=
-        (Lean4Lean.VEnv.IsDefEq.appDF
+        (Ix.Theory.Named.VEnv.IsDefEq.appDF
           (hprefixEq.of_l world.venvWF hDelta.toCtx hfun) harg).toU
       have hbeta : world.venv.IsDefEqU uvars Delta.toCtx
           (.app (.lam A' bodyV') argV) (bodyV'.inst argV) :=
@@ -303,4 +305,4 @@ theorem theoryMeaning
 
 end RecM.BetaPeel.Tr
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/SemanticCore.lean b/Ix/Kernel/Verify/Whnf/Beta/SemanticCore.lean
similarity index 95%
rename from Ix/Tc/Verify/Whnf/Beta/SemanticCore.lean
rename to Ix/Kernel/Verify/Whnf/Beta/SemanticCore.lean
index e9523bb74..344d60d98 100644
--- a/Ix/Tc/Verify/Whnf/Beta/SemanticCore.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/SemanticCore.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.ConsumptionBoundary
+import Ix.Kernel.Verify.Whnf.Beta.ConsumptionBoundary
 
 /-!
 # Isolate the semantic core of general multi-beta
@@ -11,7 +11,7 @@ substitution theorem, leaving `BetaPrefixMeaning` as the minimal semantic
 statement that must be proved structurally.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Semantic core of production multi-beta.  Starting from a translated
@@ -22,7 +22,7 @@ def BetaPrefixMeaning (trProj : RawProjRel) (world : VerifyWorld) : Prop :=
   forall {uvars : Nat}, WhnfTheory trProj world uvars ->
     forall {Delta : KVLCtx} {start body : KExpr .anon}
       {consumed : Array (KExpr .anon)}
-      {startV consumedV : Lean4Lean.VExpr},
+      {startV consumedV : Ix.Theory.Named.VExpr},
     KVLCtx.WF world.venv uvars Delta ->
     TrKExprS world.venv uvars world.nameOf trProj Delta start startV ->
     BetaPeel start consumed.toList body ->
@@ -63,4 +63,4 @@ theorem of_prefix {trProj : RawProjRel} {world : VerifyWorld}
 
 end BetaManyMeaningOracle
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/SimultaneousSubstitution.lean b/Ix/Kernel/Verify/Whnf/Beta/SimultaneousSubstitution.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Beta/SimultaneousSubstitution.lean
rename to Ix/Kernel/Verify/Whnf/Beta/SimultaneousSubstitution.lean
index b4f6ce3e5..ee51c3db5 100644
--- a/Ix/Tc/Verify/Whnf/Beta/SimultaneousSubstitution.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/SimultaneousSubstitution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.LiftSubstitution
+import Ix.Kernel.Verify.Whnf.Beta.LiftSubstitution
 
 /-!
 # Simultaneous-substitution decomposition
@@ -9,7 +9,7 @@ result is exactly the older simultaneous substitution one binder deeper,
 followed by ordinary beta substitution for the newly peeled argument.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace KExpr
 
 private theorem toNat_toUInt64_bw (k : Nat) :
@@ -691,4 +691,4 @@ theorem simulSubstSpec_cons
   | str => rfl
 
 end KExpr
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/SingletonSubstitution.lean b/Ix/Kernel/Verify/Whnf/Beta/SingletonSubstitution.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Beta/SingletonSubstitution.lean
rename to Ix/Kernel/Verify/Whnf/Beta/SingletonSubstitution.lean
index d621c0169..3129e2d37 100644
--- a/Ix/Tc/Verify/Whnf/Beta/SingletonSubstitution.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/SingletonSubstitution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.PeelTrace
+import Ix.Kernel.Verify.Whnf.Beta.PeelTrace
 
 /-!
 # Singleton simultaneous substitution
@@ -9,7 +9,7 @@ single substitution as a premise.  This slice proves that equality uniformly
 from the same no-wrap bound required by the walker.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace KExpr
 
 /-- A one-element simultaneous substitution is exactly the ordinary single
@@ -118,4 +118,4 @@ theorem simulSubstSpec_singleton
   | str => rfl
 
 end KExpr
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Beta/Translation.lean b/Ix/Kernel/Verify/Whnf/Beta/Translation.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Beta/Translation.lean
rename to Ix/Kernel/Verify/Whnf/Beta/Translation.lean
index 4604d391c..87bcc3835 100644
--- a/Ix/Tc/Verify/Whnf/Beta/Translation.lean
+++ b/Ix/Kernel/Verify/Whnf/Beta/Translation.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.ArgumentAlignment
+import Ix.Kernel.Verify.Whnf.Beta.ArgumentAlignment
 
 /-!
 # One-pass translation of simultaneous beta substitution
@@ -9,9 +9,9 @@ theorems for variables.  No sequential concrete intermediate is constructed,
 so the proof consumes exactly production's original `WalkerRequest.Bounds`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean
+open Ix.Theory.Named
 
 private theorem toNat_toUInt64_cc (value : Nat) :
     value.toUInt64.toNat = value % UInt64.size := by
@@ -61,13 +61,13 @@ theorem TrKExprS.simulSubstBeta
     {trProj : RawProjRel}
     (henv : env.Ordered)
     (htp : ∀ {Γ Γ' : List VExpr} {n k : Nat} {s : Lean.Name} {i : Nat}
-      {e e' : VExpr}, Lean4Lean.Ctx.LiftN n k Γ Γ' →
+      {e e' : VExpr}, Ix.Theory.Named.Ctx.LiftN n k Γ Γ' →
       trProj uvars Γ s i e e' →
       trProj uvars Γ' s i (e.liftN n k) (e'.liftN n k))
     (htpI : ∀ {Γ₀ : List VExpr} {e₀ A₀ : VExpr} {position : Nat}
       {Γ₁ Γ : List VExpr} {s : Lean.Name} {i : Nat} {e e' : VExpr},
       env.HasType uvars Γ₀ e₀ A₀ →
-      Lean4Lean.Ctx.InstN Γ₀ e₀ A₀ position Γ₁ Γ →
+      Ix.Theory.Named.Ctx.InstN Γ₀ e₀ A₀ position Γ₁ Γ →
       trProj uvars Γ₁ s i e e' →
       trProj uvars Γ s i (e.inst e₀ position) (e'.inst e₀ position))
     {base : KVLCtx} {substs : Array (KExpr .anon)}
@@ -354,4 +354,4 @@ theorem TrKExprS.simulSubstBeta
       rw [instBetaArgs_trLiteral_cc]
       exact .str hlit
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Closure.lean b/Ix/Kernel/Verify/Whnf/Closure.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Closure.lean
rename to Ix/Kernel/Verify/Whnf/Closure.lean
index b9d9b284c..6a4acd990 100644
--- a/Ix/Tc/Verify/Whnf/Closure.lean
+++ b/Ix/Kernel/Verify/Whnf/Closure.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Whnf.Delta.OptionalReduction
-import Ix.Tc.Verify.Knot
+import Ix.Kernel.Verify.Whnf.Delta.OptionalReduction
+import Ix.Kernel.Verify.Knot
 
 /-!
 # Four-field fixed-universe WHNF closure
@@ -40,7 +40,7 @@ concrete successful, absent, stuck, and partial-error executions in
 substitute for K2's two missing recursive fields.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- The final K1 cache composition at the universe count encoded by `keys`:
 WHNF expression entries outside, universe-sensitive delta bodies underneath,
@@ -140,4 +140,4 @@ theorem closedAt
 
 end K1ClosureContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/CacheExecution.lean b/Ix/Kernel/Verify/Whnf/Delta/CacheExecution.lean
similarity index 96%
rename from Ix/Tc/Verify/Whnf/Delta/CacheExecution.lean
rename to Ix/Kernel/Verify/Whnf/Delta/CacheExecution.lean
index ddb379603..71e63f63f 100644
--- a/Ix/Tc/Verify/Whnf/Delta/CacheExecution.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/CacheExecution.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Delta.StableCache
+import Ix.Kernel.Verify.Whnf.Delta.StableCache
 
 /-!
 # Certified production unfold-cache execution
@@ -16,7 +16,7 @@ physical paths of production's `unfoldConstValue`:
 No arbitrary head/result write authority is used.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace CacheProvenance
 
@@ -69,14 +69,14 @@ theorem unfoldConstValue_trusted_wf
     (theory : StableWhnfTheory trProj world keys.uvars)
     (hreferences : TrustedReferences world support)
     {id : KId .anon} {concrete : KConst .anon}
-    {ci : Lean4Lean.VDefVal} {kind : Ix.DefKind}
+    {ci : Ix.Theory.Named.VDefVal} {kind : Ix.DefKind}
     {lvls : UInt64} {body : KExpr .anon}
     (trusted : TrustedDeltaBody trProj world id concrete ci kind lvls body)
     {us : Array (KUniv .anon)} {info : ExprInfo .anon}
     (resources : DeltaInstantiationResources us body)
     (hheadSupport : support (.const id us info))
     (hrequest : WalkerRequest.instUniv body us ∈ requests)
-    {Delta : KVLCtx} {headV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {headV : Ix.Theory.Named.VExpr}
     (hhead : TrKExprS world.venv keys.uvars world.nameOf trProj Delta
       (.const id us info) headV)
     {s : TcState .anon} :
@@ -140,4 +140,4 @@ theorem unfoldConstValue_trusted_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/CacheSemantics.lean b/Ix/Kernel/Verify/Whnf/Delta/CacheSemantics.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Delta/CacheSemantics.lean
rename to Ix/Kernel/Verify/Whnf/Delta/CacheSemantics.lean
index 8f721d12c..f679c9e00 100644
--- a/Ix/Tc/Verify/Whnf/Delta/CacheSemantics.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/CacheSemantics.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Delta.Integration
+import Ix.Kernel.Verify.Whnf.Delta.Integration
 
 /-!
 # Semantic unfold-cache entries
@@ -14,7 +14,7 @@ universe count is fixed, matching the `Methods.WFAt` contract used by the
 recursive reducer.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact fixed-universe validity for one unfold-cache entry.  Every
 finite-support source sharing the stored address must reduce to the cached
@@ -126,4 +126,4 @@ theorem unfoldOfMeaning {uvars : Nat} {trProj : RawProjRel}
 
 end CacheProvenance
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/ClosedTranslation.lean b/Ix/Kernel/Verify/Whnf/Delta/ClosedTranslation.lean
similarity index 80%
rename from Ix/Tc/Verify/Whnf/Delta/ClosedTranslation.lean
rename to Ix/Kernel/Verify/Whnf/Delta/ClosedTranslation.lean
index a63aa8a38..cb0b3c6cc 100644
--- a/Ix/Tc/Verify/Whnf/Delta/ClosedTranslation.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/ClosedTranslation.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Delta.CacheSemantics
+import Ix.Kernel.Verify.Whnf.Delta.CacheSemantics
 
 /-!
 # Closed-expression translation under caller contexts
@@ -15,9 +15,9 @@ cases compositional and exposes exactly where projection weakening and
 closedness are used.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr VEnv)
+open Ix.Theory.Named (VExpr VEnv)
 
 namespace KVLCtx
 
@@ -93,24 +93,24 @@ theorem weakRight {env : VEnv} {uvars : Nat}
       exact .const hname hlookup hlevels harity
   | @app inner f arg info f' arg' A B
       hfunTy hargTy hfun harg ihfun iharg =>
-      have hclosed : Lean4Lean.CtxClosed inner.toCtx :=
-        Lean4Lean.VEnv.CtxWF.closed henv hinner.toCtx
+      have hclosed : Ix.Theory.Named.CtxClosed inner.toCtx :=
+        Ix.Theory.Named.VEnv.CtxWF.closed henv hinner.toCtx
       refine .app (A := A) (B := B) ?_ ?_
         (ihfun hinner outer) (iharg hinner outer)
-      · simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+      · simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
           hfunTy.weakR henv hclosed outer.toCtx
-      · simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+      · simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
           hargTy.weakR henv hclosed outer.toCtx
   | @lam inner name bi ty body info ty' body'
       hty htyTr hbodyTr ihty ihbody =>
-      have hclosed : Lean4Lean.CtxClosed inner.toCtx :=
-        Lean4Lean.VEnv.CtxWF.closed henv hinner.toCtx
+      have hclosed : Ix.Theory.Named.CtxClosed inner.toCtx :=
+        Ix.Theory.Named.VEnv.CtxWF.closed henv hinner.toCtx
       have htyOriginal := hty
       obtain ⟨level, htyHasType⟩ := hty
       have hty' :
           env.IsType uvars (KVLCtx.appendOuter inner outer).toCtx ty' := by
         refine ⟨level, ?_⟩
-        simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+        simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
           htyHasType.weakR henv hclosed outer.toCtx
       have hbodyInner :
           KVLCtx.WF env uvars ((none, .vlam ty') :: inner) :=
@@ -118,40 +118,40 @@ theorem weakRight {env : VEnv} {uvars : Nat}
       exact .lam hty' (ihty hinner outer) (ihbody hbodyInner outer)
   | @all inner name bi ty body info ty' body'
       hty hbodyTy htyTr hbodyTr ihty ihbody =>
-      have hclosed : Lean4Lean.CtxClosed inner.toCtx :=
-        Lean4Lean.VEnv.CtxWF.closed henv hinner.toCtx
+      have hclosed : Ix.Theory.Named.CtxClosed inner.toCtx :=
+        Ix.Theory.Named.VEnv.CtxWF.closed henv hinner.toCtx
       have htyOriginal := hty
       obtain ⟨level, htyHasType⟩ := hty
       have hty' :
           env.IsType uvars (KVLCtx.appendOuter inner outer).toCtx ty' := by
         refine ⟨level, ?_⟩
-        simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+        simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
           htyHasType.weakR henv hclosed outer.toCtx
       have hbodyInner :
           KVLCtx.WF env uvars ((none, .vlam ty') :: inner) :=
         ⟨hinner, nofun, htyOriginal⟩
       have hbodyClosed :
-          Lean4Lean.CtxClosed
-            (KVLCtx.toCtx ((none, Lean4Lean.VLocalDecl.vlam ty') :: inner)) :=
-        Lean4Lean.VEnv.CtxWF.closed henv hbodyInner.toCtx
+          Ix.Theory.Named.CtxClosed
+            (KVLCtx.toCtx ((none, Ix.Theory.Named.VLocalDecl.vlam ty') :: inner)) :=
+        Ix.Theory.Named.VEnv.CtxWF.closed henv hbodyInner.toCtx
       obtain ⟨bodyLevel, hbodyHasType⟩ := hbodyTy
       have hbodyTy' :
           env.IsType uvars
             (KVLCtx.appendOuter
-              ((none, Lean4Lean.VLocalDecl.vlam ty') :: inner) outer).toCtx
+              ((none, Ix.Theory.Named.VLocalDecl.vlam ty') :: inner) outer).toCtx
               body' := by
         refine ⟨bodyLevel, ?_⟩
-        simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+        simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
           hbodyHasType.weakR henv hbodyClosed outer.toCtx
       exact .all hty' hbodyTy' (ihty hinner outer)
         (ihbody hbodyInner outer)
   | @letE inner name ty val body nondep info ty' val' body'
       hvalTy htyTr hvalTr hbodyTr ihty ihval ihbody =>
-      have hclosed : Lean4Lean.CtxClosed inner.toCtx :=
-        Lean4Lean.VEnv.CtxWF.closed henv hinner.toCtx
+      have hclosed : Ix.Theory.Named.CtxClosed inner.toCtx :=
+        Ix.Theory.Named.VEnv.CtxWF.closed henv hinner.toCtx
       have hvalTy' :
           env.HasType uvars (KVLCtx.appendOuter inner outer).toCtx val' ty' := by
-        simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+        simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
           hvalTy.weakR henv hclosed outer.toCtx
       have hbodyInner :
           KVLCtx.WF env uvars ((none, .vlet ty' val') :: inner) :=
@@ -160,8 +160,8 @@ theorem weakRight {env : VEnv} {uvars : Nat}
         (ihbody hbodyInner outer)
   | @prj inner sid field val info structName val' result'
       hname hvalTr hproj ihval =>
-      have hclosed : Lean4Lean.CtxClosed inner.toCtx :=
-        Lean4Lean.VEnv.CtxWF.closed henv hinner.toCtx
+      have hclosed : Ix.Theory.Named.CtxClosed inner.toCtx :=
+        Ix.Theory.Named.VEnv.CtxWF.closed henv hinner.toCtx
       have hvalWF : VExpr.WF env uvars inner.toCtx val' :=
         hvalTr.wf henv hlit htp.wf hinner
       have hresultWF : VExpr.WF env uvars inner.toCtx result' :=
@@ -171,9 +171,9 @@ theorem weakRight {env : VEnv} {uvars : Nat}
       have hresultClosed : result'.ClosedN inner.toCtx.length :=
         hresultWF.closedN henv hclosed
       have hlift :
-          Lean4Lean.Ctx.LiftN outer.toCtx.length inner.toCtx.length
+          Ix.Theory.Named.Ctx.LiftN outer.toCtx.length inner.toCtx.length
             inner.toCtx (inner.toCtx ++ outer.toCtx) :=
-        Lean4Lean.Ctx.LiftN.right hclosed outer.toCtx
+        Ix.Theory.Named.Ctx.LiftN.right hclosed outer.toCtx
       have hproj' := htp.weakN hlift hproj
       have hproj'' :
           trProj uvars (KVLCtx.appendOuter inner outer).toCtx structName
@@ -206,13 +206,13 @@ theorem weakRight {env : VEnv} {uvars : Nat}
     (outer : KVLCtx) :
     TrKExpr env uvars nameOf trProj (KVLCtx.appendOuter inner outer) e e' := by
   obtain ⟨structural, hstructural, targetTy, htarget⟩ := H
-  have hclosed : Lean4Lean.CtxClosed inner.toCtx :=
-    Lean4Lean.VEnv.CtxWF.closed henv hinner.toCtx
+  have hclosed : Ix.Theory.Named.CtxClosed inner.toCtx :=
+    Ix.Theory.Named.VEnv.CtxWF.closed henv hinner.toCtx
   refine ⟨structural, hstructural.weakRight henv hlit htp hinner outer,
     targetTy, ?_⟩
-  simpa only [KVLCtx.toCtx_appendOuter, Lean4Lean.VEnv.HasType] using
+  simpa only [KVLCtx.toCtx_appendOuter, Ix.Theory.Named.VEnv.HasType] using
     htarget.weakR henv hclosed outer.toCtx
 
 end TrKExpr
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/Integration.lean b/Ix/Kernel/Verify/Whnf/Delta/Integration.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Delta/Integration.lean
rename to Ix/Kernel/Verify/Whnf/Delta/Integration.lean
index 82f13c2e0..b8af069d3 100644
--- a/Ix/Tc/Verify/Whnf/Delta/Integration.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/Integration.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Delta.UnfoldingState
+import Ix.Kernel.Verify.Whnf.Delta.UnfoldingState
 
 /-!
 # Package delta and the fourth public WHNF field
@@ -15,7 +15,7 @@ theorem below upgrades Reducer's arbitrary-flags `WhnfMeaning` result to the
 `WhnfPost` shape required by `Methods.WhnfLayerWF`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Complete run-scoped authority for production delta unfolding.  The
@@ -93,7 +93,7 @@ theorem publicFlags_wf
     (context : StructuralCoreContext initial program requests keys fallback
       trProj world support Delta flags)
     {source : KExpr .anon} (hsourceSupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF .noAccel
@@ -116,4 +116,4 @@ theorem publicFlags_wf
 
 end StructuralCoreContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/OptionalReduction.lean b/Ix/Kernel/Verify/Whnf/Delta/OptionalReduction.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Delta/OptionalReduction.lean
rename to Ix/Kernel/Verify/Whnf/Delta/OptionalReduction.lean
index 15232910c..e45372c99 100644
--- a/Ix/Tc/Verify/Whnf/Delta/OptionalReduction.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/OptionalReduction.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Delta.SpineUnfolding
+import Ix.Kernel.Verify.Whnf.Delta.SpineUnfolding
 
 /-!
 # Exact delta optional-reducer closure
@@ -9,7 +9,7 @@ the same trusted declaration census and packages the complete reducer in the
 fixed-universe optional contract consumed by the full-WHNF step.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Local run-equation strengthening used to connect a successful lazy
@@ -54,7 +54,7 @@ theorem deltaUnfoldOne_trusted_wf
           (unfoldCacheSemantics keys.uvars trProj fallback))
         trProj world support keys.uvars Delta))
     (hreferences : TrustedReferences world support)
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {s : TcState .anon}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta
@@ -184,4 +184,4 @@ def FullWhnfStepContext.ofTrustedDelta
   delta := delta.wfAt
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/SpineUnfolding.lean b/Ix/Kernel/Verify/Whnf/Delta/SpineUnfolding.lean
similarity index 96%
rename from Ix/Tc/Verify/Whnf/Delta/SpineUnfolding.lean
rename to Ix/Kernel/Verify/Whnf/Delta/SpineUnfolding.lean
index f3793bb80..c11904702 100644
--- a/Ix/Tc/Verify/Whnf/Delta/SpineUnfolding.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/SpineUnfolding.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Delta.CacheExecution
+import Ix.Kernel.Verify.Whnf.Delta.CacheExecution
 
 /-!
 # Trusted spine-aware delta unfolding
@@ -11,7 +11,7 @@ the typed spine to prove that rebuilding preserves the complete source
 meaning.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Run-scoped trusted resolution and resource bounds for every supported
 reducible constant head that delta unfolding may reach.
@@ -29,7 +29,7 @@ structure TrustedDeltaCensus (trProj : RawProjRel) (world : VerifyWorld)
     DeltaBodyShape kind lvls body concrete →
     world.catalog id = some concrete →
     kind ≠ .opaq →
-    ∃ ci : Lean4Lean.VDefVal,
+    ∃ ci : Ix.Theory.Named.VDefVal,
       TrustedDeltaBody trProj world id concrete ci kind lvls body ∧
         DeltaInstantiationResources us body
 
@@ -42,7 +42,7 @@ theorem toPost
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     (theory : WhnfTheory trProj world uvars)
     {Delta : KVLCtx} (hDelta : KVLCtx.WF world.venv uvars Delta)
-    {source result : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source result : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV)
     (h : WhnfMeaning trProj world uvars Delta source result) :
@@ -112,7 +112,7 @@ theorem tryDeltaUnfold_trusted_wf
           (unfoldCacheSemantics keys.uvars trProj fallback))
         trProj world support keys.uvars Delta))
     (hreferences : TrustedReferences world support)
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {s : TcState .anon}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta
@@ -190,4 +190,4 @@ theorem tryDeltaUnfold_trusted_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/StableCache.lean b/Ix/Kernel/Verify/Whnf/Delta/StableCache.lean
similarity index 94%
rename from Ix/Tc/Verify/Whnf/Delta/StableCache.lean
rename to Ix/Kernel/Verify/Whnf/Delta/StableCache.lean
index 33f925cb7..14c01710b 100644
--- a/Ix/Tc/Verify/Whnf/Delta/StableCache.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/StableCache.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Delta.TrustedBody
+import Ix.Kernel.Verify.Whnf.Delta.TrustedBody
+
+open Ix.Theory (VLevel)
 
 /-!
 # Stable trusted delta-cache provenance
@@ -21,7 +23,7 @@ request:
   obligations at every permitted extension.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Theory closure at one universe count for every extension of the world in
 which a stable cache entry may be interpreted. -/
@@ -73,11 +75,11 @@ constant found at the same source node. -/
 theorem sourceInputs
     {trProj : RawProjRel} {world : VerifyWorld}
     {id : KId .anon} {concrete : KConst .anon}
-    {ci : Lean4Lean.VDefVal} {kind : Ix.DefKind}
+    {ci : Ix.Theory.Named.VDefVal} {kind : Ix.DefKind}
     {lvls : UInt64} {body : KExpr .anon}
     (h : TrustedDeltaBody trProj world id concrete ci kind lvls body)
     {uvars : Nat} {us : Array (KUniv .anon)} {info : ExprInfo .anon}
-    {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
       (.const id us info) sourceV) :
     sourceV =
@@ -97,7 +99,7 @@ by the stable cache authority. -/
 theorem futureMeaning
     {trProj : RawProjRel} {world : VerifyWorld}
     {id : KId .anon} {concrete : KConst .anon}
-    {ci : Lean4Lean.VDefVal} {kind : Ix.DefKind}
+    {ci : Ix.Theory.Named.VDefVal} {kind : Ix.DefKind}
     {lvls : UInt64} {body : KExpr .anon}
     (h : TrustedDeltaBody trProj world id concrete ci kind lvls body)
     {uvars : Nat} (theory : StableWhnfTheory trProj world uvars)
@@ -119,7 +121,7 @@ for `UnfoldCacheWriteOracle.write`. -/
 theorem unfoldCacheProvenance
     {trProj : RawProjRel} {world : VerifyWorld}
     {id : KId .anon} {concrete : KConst .anon}
-    {ci : Lean4Lean.VDefVal} {kind : Ix.DefKind}
+    {ci : Ix.Theory.Named.VDefVal} {kind : Ix.DefKind}
     {lvls : UInt64} {body : KExpr .anon}
     (h : TrustedDeltaBody trProj world id concrete ci kind lvls body)
     {uvars : Nat} {fallback : CacheSemantics}
@@ -144,4 +146,4 @@ theorem unfoldCacheProvenance
 
 end TrustedDeltaBody
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/TrustedBody.lean b/Ix/Kernel/Verify/Whnf/Delta/TrustedBody.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Delta/TrustedBody.lean
rename to Ix/Kernel/Verify/Whnf/Delta/TrustedBody.lean
index 723072d15..b42339ef3 100644
--- a/Ix/Tc/Verify/Whnf/Delta/TrustedBody.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/TrustedBody.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Delta.UniverseMonotonicity
+import Ix.Kernel.Verify.Whnf.Delta.UniverseMonotonicity
+
+open Ix.Theory (VLevel)
 
 /-!
 # Exact trusted delta-body semantics
@@ -26,9 +28,9 @@ body unchanged.  ClosedTranslation then weakens the closed body translation into
 caller's arbitrary mixed context.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefVal VEnv VExpr VLevel)
+open Ix.Theory.Named (VDefVal VEnv VExpr)
 
 /-- The exact definition-shaped catalog fields relevant to delta unfolding.
 Keeping this as an indexed proposition lets a certificate retain the complete
@@ -283,4 +285,4 @@ theorem meaning
 
 end TrustedDeltaBody
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/UnfoldingState.lean b/Ix/Kernel/Verify/Whnf/Delta/UnfoldingState.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Delta/UnfoldingState.lean
rename to Ix/Kernel/Verify/Whnf/Delta/UnfoldingState.lean
index c7b7538c1..fa330f0f4 100644
--- a/Ix/Tc/Verify/Whnf/Delta/UnfoldingState.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/UnfoldingState.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Driver.PublicReducers
+import Ix.Kernel.Verify.Whnf.Driver.PublicReducers
 
 /-!
 # Delta unfolding state and support closure
@@ -17,7 +17,7 @@ reflection field: a loaded definition-shaped catalog entry is not by itself
 evidence that its body is the trusted definition installed in `VerifyWorld`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Collision-robust provenance for the universe-instantiated definition body
 cached under the concrete constant-head address. -/
@@ -63,7 +63,7 @@ structure DeltaUnfoldReflection (semantics : CacheSemantics)
     (support : RunSupport) : Prop where
   success : ∀ {uvars : Nat} {Delta : KVLCtx}
       {methods : Methods .anon} {source result : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {s sf : TcState .anon},
+      {sourceV : Ix.Theory.Named.VExpr} {s sf : TcState .anon},
     Methods.WFAt .noAccel semantics trProj world support uvars methods →
     support source →
     TrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -350,4 +350,4 @@ theorem deltaUnfoldOne_optional_wf_of_contexts
         reflection.success hmethods hsourceSupport hsource hI hrunDelta⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Delta/UniverseMonotonicity.lean b/Ix/Kernel/Verify/Whnf/Delta/UniverseMonotonicity.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Delta/UniverseMonotonicity.lean
rename to Ix/Kernel/Verify/Whnf/Delta/UniverseMonotonicity.lean
index 0578a29f9..5341b9b64 100644
--- a/Ix/Tc/Verify/Whnf/Delta/UniverseMonotonicity.lean
+++ b/Ix/Kernel/Verify/Whnf/Delta/UniverseMonotonicity.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Delta.ClosedTranslation
+import Ix.Kernel.Verify.Whnf.Delta.ClosedTranslation
+
+open Ix.Theory (VLevel)
 
 /-!
 # Universe-count monotonicity for structural translation
@@ -15,9 +17,9 @@ Structural translation follows by induction, carrying the source mixed
 context's well-formedness through binder cases.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (OnCtx VEnv VExpr VLevel)
+open Ix.Theory.Named (OnCtx VEnv VExpr)
 
 /-- A well-formed universe level remains well-formed when the available
 parameter count grows. -/
@@ -159,4 +161,4 @@ theorem monoU {env : VEnv} {before after : Nat}
 
 end TrKExprS
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Driver/FullStep.lean b/Ix/Kernel/Verify/Whnf/Driver/FullStep.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Driver/FullStep.lean
rename to Ix/Kernel/Verify/Whnf/Driver/FullStep.lean
index a8745f155..0dc97ef09 100644
--- a/Ix/Tc/Verify/Whnf/Driver/FullStep.lean
+++ b/Ix/Kernel/Verify/Whnf/Driver/FullStep.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.NoDelta.Reducer
+import Ix.Kernel.Verify.Whnf.NoDelta.Reducer
 
 /-!
 # Full-WHNF one-step closure
@@ -14,7 +14,7 @@ boundary: unlike a miss, successful unfolding must justify both support for
 the generated expression and its Theory meaning.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- The Decidable acceleration gate satisfies the optional-reducer contract
@@ -203,4 +203,4 @@ theorem wf
 
 end FullWhnfStepContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Driver/PublicReducers.lean b/Ix/Kernel/Verify/Whnf/Driver/PublicReducers.lean
similarity index 94%
rename from Ix/Tc/Verify/Whnf/Driver/PublicReducers.lean
rename to Ix/Kernel/Verify/Whnf/Driver/PublicReducers.lean
index 220d51446..6755b23fe 100644
--- a/Ix/Tc/Verify/Whnf/Driver/PublicReducers.lean
+++ b/Ix/Kernel/Verify/Whnf/Driver/PublicReducers.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Driver.FullStep
+import Ix.Kernel.Verify.Whnf.Driver.FullStep
 
 /-!
 # Public full-WHNF reducers
@@ -10,7 +10,7 @@ instrumentation, cache hits and writes, and both Nat successor policies.
 This slice supplies FullStep's concrete step to those theorems.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 namespace FullWhnfStepContext
 
@@ -26,7 +26,7 @@ theorem publicMode_wf
       trProj world support Delta)
     (natSuccMode : NatSuccMode) {source : KExpr .anon}
     (hsourceSupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF .noAccel
@@ -56,7 +56,7 @@ theorem publicWhnf_wf
     (context : FullWhnfStepContext initial program requests keys fallback
       trProj world support Delta)
     {source : KExpr .anon} (hsourceSupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF .noAccel
@@ -77,7 +77,7 @@ theorem publicCore_wf
     (context : FullWhnfStepContext initial program requests keys fallback
       trProj world support Delta)
     {source : KExpr .anon} (hsourceSupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF .noAccel
@@ -100,4 +100,4 @@ theorem publicCore_wf
 
 end FullWhnfStepContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/ApplicationRequests.lean b/Ix/Kernel/Verify/Whnf/Iota/ApplicationRequests.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/ApplicationRequests.lean
rename to Ix/Kernel/Verify/Whnf/Iota/ApplicationRequests.lean
index ec61b5aa8..95ba62c0f 100644
--- a/Ix/Tc/Verify/Whnf/Iota/ApplicationRequests.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/ApplicationRequests.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.NatOffset
+import Ix.Kernel.Verify.Whnf.Iota.NatOffset
 
 /-!
 # Finite request closure for ordinary iota application
@@ -16,7 +16,7 @@ The census is indexed by the exact three production argument slices.  Thus a
 certificate for a convenient argument order cannot justify the real helper.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Exact non-transient intern requests for one left-to-right iota argument
@@ -59,7 +59,7 @@ theorem wfList
       rw [List.foldlM_cons, ReaderT.run_bind]
       apply TcM.WF.bind
         (Q₁ := fun next _ => next = KExpr.mkApp result arg)
-      · rw [Ix.Tc.RecM.applyIotaArg_false, ReaderT.run_monadLift]
+      · rw [Ix.Kernel.RecM.applyIotaArg_false, ReaderT.run_monadLift]
         exact TcM.WF.mono
           (TcM.intern_whnf_wf hrun.collisionFree
             (hrun.coverage.internExpr request))
@@ -267,4 +267,4 @@ theorem of_requests
 end TryApplyIotaCtorPreserves
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/ArgumentBranches.lean b/Ix/Kernel/Verify/Whnf/Iota/ArgumentBranches.lean
similarity index 95%
rename from Ix/Tc/Verify/Whnf/Iota/ArgumentBranches.lean
rename to Ix/Kernel/Verify/Whnf/Iota/ArgumentBranches.lean
index 390f1e5ff..efe7f4bc6 100644
--- a/Ix/Tc/Verify/Whnf/Iota/ArgumentBranches.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/ArgumentBranches.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.Substitution
+import Ix.Kernel.Verify.Whnf.Iota.Substitution
 
 /-!
 # Remaining production iota-argument branches
@@ -15,7 +15,7 @@ contracts are the branch-local inputs needed for the subsequent proof of the
 three production application loops.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Every expression shape that bypasses transient beta in `applyIotaArg`.
 Unlike `WhnfCoreNonLambda`, this includes `app`: an intermediate recursor RHS
@@ -63,7 +63,7 @@ theorem appRebuild
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Delta : KVLCtx} {result arg : KExpr .anon}
     {sourceInfo : ExprInfo .anon}
-    {resultV argV A B : Lean4Lean.VExpr}
+    {resultV argV A B : Ix.Theory.Named.VExpr}
     (hresultTy : world.venv.HasType uvars Delta.toCtx resultV
       (.forallE A B))
     (hargTy : world.venv.HasType uvars Delta.toCtx argV A)
@@ -80,8 +80,8 @@ theorem appRebuild
     rw [KExpr.mkApp_shape]
     exact .app hresultTy hargTy hresultTr hargTr
   exact ⟨_, _, hsource, hrebuilt,
-    Lean4Lean.VEnv.IsDefEqU.refl
-      ⟨_, Lean4Lean.VEnv.HasType.app hresultTy hargTy⟩⟩
+    Ix.Theory.Named.VEnv.IsDefEqU.refl
+      ⟨_, Ix.Theory.Named.VEnv.HasType.app hresultTy hargTy⟩⟩
 
 end WhnfMeaning
 
@@ -95,7 +95,7 @@ theorem applyIotaArg_true_nonlam_semantic
     {sourceInfo : ExprInfo .anon}
     (hnonlam : IotaArgNonLambda result)
     (methods : Methods .anon) (s : TcState .anon)
-    {resultV argV A B : Lean4Lean.VExpr}
+    {resultV argV A B : Ix.Theory.Named.VExpr}
     (hresultTy : world.venv.HasType uvars Delta.toCtx resultV
       (.forallE A B))
     (hargTy : world.venv.HasType uvars Delta.toCtx argV A)
@@ -129,7 +129,7 @@ theorem applyIotaArg_false_eval
   obtain ⟨s', hintern, hI', hframe⟩ :=
     TcM.intern_whnf_eval hcollision hsupport hI
   refine ⟨s', ?_, hI', hframe⟩
-  rw [Ix.Tc.RecM.applyIotaArg_false]
+  rw [Ix.Kernel.RecM.applyIotaArg_false]
   exact hintern
 
 /-- Full non-transient per-argument contract: execution is intern-only, the
@@ -144,7 +144,7 @@ theorem applyIotaArg_false_semantic
     (hsupport : support (KExpr.mkApp result arg))
     (hI : WhnfStateInv layer semantics trProj world support uvars Delta s)
     (methods : Methods .anon)
-    {resultV argV A B : Lean4Lean.VExpr}
+    {resultV argV A B : Ix.Theory.Named.VExpr}
     (hresultTy : world.venv.HasType uvars Delta.toCtx resultV
       (.forallE A B))
     (hargTy : world.venv.HasType uvars Delta.toCtx argV A)
@@ -165,4 +165,4 @@ theorem applyIotaArg_false_semantic
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/ArgumentExecution.lean b/Ix/Kernel/Verify/Whnf/Iota/ArgumentExecution.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/ArgumentExecution.lean
rename to Ix/Kernel/Verify/Whnf/Iota/ArgumentExecution.lean
index bdfc4f840..236a8d200 100644
--- a/Ix/Tc/Verify/Whnf/Iota/ArgumentExecution.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/ArgumentExecution.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.ArgumentBranches
+import Ix.Kernel.Verify.Whnf.Iota.ArgumentBranches
+
+open Ix.Theory (VLevel)
 
 /-!
 # Semantic execution of iota argument lists
@@ -17,9 +19,9 @@ finite support, and `WhnfMeaning`; induction then transports the quotient
 translation through every intermediate.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace KExpr
 
@@ -289,7 +291,7 @@ theorem transientLambdaSingletonQuot
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
     {ty body arg : KExpr .anon} {info : ExprInfo .anon}
     {expectedV expectedA expectedB A bodyV argV B : VExpr}
-    {univ : Lean4Lean.VLevel}
+    {univ : Ix.Theory.VLevel}
     {s : TcState .anon}
     (hexpectedTy : world.venv.HasType uvars Delta.toCtx expectedV
       (.forallE expectedA expectedB))
@@ -313,7 +315,7 @@ theorem transientLambdaSingletonQuot
   have hrun :
       (applyIotaArg (.lam name bi ty body info) arg true).run methods s =
         .ok (substNoIntern body arg 0) s := by
-    rw [Ix.Tc.RecM.applyIotaArg_true_lam]
+    rw [Ix.Kernel.RecM.applyIotaArg_true_lam]
     rfl
   have hmeaning := WhnfMeaning.betaNoIntern (trProj := trProj)
     (world := world) (uvars := uvars) (Delta := Delta)
@@ -337,7 +339,7 @@ theorem transientLambdaSingleton
     {uvars : Nat} {Delta : KVLCtx} {methods : Methods .anon}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
     {ty body arg : KExpr .anon} {info : ExprInfo .anon}
-    {A bodyV argV B : VExpr} {univ : Lean4Lean.VLevel}
+    {A bodyV argV B : VExpr} {univ : Ix.Theory.VLevel}
     {s : TcState .anon}
     (projections : TrProjOK world.venv uvars trProj)
     (hty : TrKExprS world.venv uvars world.nameOf trProj Delta ty A)
@@ -356,7 +358,7 @@ theorem transientLambdaSingleton
       methods true (.lam name bi ty body info) (.lam A bodyV) s [arg]
         (substNoIntern body arg 0) (.app (.lam A bodyV) argV) s :=
   transientLambdaSingletonQuot
-    (Lean4Lean.VEnv.HasType.lam hA hbodyTy) hargTy projections
+    (Ix.Theory.Named.VEnv.HasType.lam hA hbodyTy) hargTy projections
     hty hbody harg hA hbodyTy hargTy hbodyCon hargCon hbig hI
     hresultSupport
 
@@ -613,4 +615,4 @@ end ApplyIotaArgsTrace
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/ConstructorDispatch.lean b/Ix/Kernel/Verify/Whnf/Iota/ConstructorDispatch.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/ConstructorDispatch.lean
rename to Ix/Kernel/Verify/Whnf/Iota/ConstructorDispatch.lean
index da8d98de5..b281ccd9a 100644
--- a/Ix/Tc/Verify/Whnf/Iota/ConstructorDispatch.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/ConstructorDispatch.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.SelectedRule
+import Ix.Kernel.Verify.Whnf.Iota.SelectedRule
+
+open Ix.Theory (VLevel)
 
 /-!
 # Ordinary-constructor iota dispatch
@@ -15,9 +17,9 @@ and String-literal expansion.  Those remain separate exhaustive branches;
 the regular theorem cannot silently justify any of them.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefEq VExpr)
+open Ix.Theory.Named (VDefEq VExpr)
 
 namespace KConst
 
@@ -236,12 +238,12 @@ theorem checkedAcceptance_empty
     (hsourceTr : TrKExprS world.venv 0 world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType 0 [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -299,12 +301,12 @@ theorem checkedAcceptance_nonempty
     (hsourceTr : TrKExprS world.venv uvars world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType uvars [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -559,12 +561,12 @@ theorem tryIotaWithFlags_regularCtor_checkedAcceptance_empty
     (hsourceTr : TrKExprS world.venv 0 world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType 0 [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -597,4 +599,4 @@ theorem tryIotaWithFlags_regularCtor_checkedAcceptance_empty
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesis.lean b/Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesis.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesis.lean
rename to Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesis.lean
index 9bcf46184..a6827e46e 100644
--- a/Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesis.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesis.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.StringLiteral
+import Ix.Kernel.Verify.Whnf.Iota.StringLiteral
+
+open Ix.Theory (VLevel)
 
 /-!
 # Successful K-like constructor synthesis
@@ -15,9 +17,9 @@ flag: malformed or untrusted catalog entries may legitimately make any of the
 caught stages return `none`, and callback errors may retain partial state.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefEq VExpr)
+open Ix.Theory.Named (VDefEq VExpr)
 
 namespace RecM
 
@@ -538,12 +540,12 @@ theorem tryIotaWithFlags_kCtor_checkedAcceptance_empty
     {sourceV sourceType : VExpr}
     (hsourceTr : TrKExprS world.venv 0 world.nameOf trProj [] source sourceV)
     (hsourceType : world.venv.HasType 0 [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -575,4 +577,4 @@ theorem tryIotaWithFlags_kCtor_checkedAcceptance_empty
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesisFallback.lean b/Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesisFallback.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesisFallback.lean
rename to Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesisFallback.lean
index 1bc62a92a..3b5a0f0f1 100644
--- a/Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesisFallback.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesisFallback.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.ConstructorSynthesis
+import Ix.Kernel.Verify.Whnf.Iota.ConstructorSynthesis
 
 /-!
 # Exhaustive K-synthesis fallback branches
@@ -16,7 +16,7 @@ malformed-inductive cases (for example an empty constructor array) from the
 defensive repeated-lookup cases without assuming catalog immutability.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -683,4 +683,4 @@ end SynthCtorWhenKSelectionTrace
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/Ingress.lean b/Ix/Kernel/Verify/Whnf/Iota/Ingress.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Iota/Ingress.lean
rename to Ix/Kernel/Verify/Whnf/Iota/Ingress.lean
index b2b209bb7..df8217d32 100644
--- a/Ix/Tc/Verify/Whnf/Iota/Ingress.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/Ingress.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.SynthesisRequests
+import Ix.Kernel.Verify.Whnf.Iota.SynthesisRequests
 
 /-!
 # Actual iota ingress state closure
@@ -16,7 +16,7 @@ from finite run censuses; the remaining callback premises are confined to
 bounded helper scans over open declaration telescopes.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Exhaustive state closure of the actual iota reducer. -/
@@ -46,7 +46,7 @@ theorem tryIotaWithFlags_state_wf_of_contexts
     (hreferences : TrustedReferences world support)
     (hwrites : ∀ id, world.trusted id →
       IsRecCacheWriteOracle semantics world support methods id)
-    (e : KExpr .anon) {sourceV : Lean4Lean.VExpr}
+    (e : KExpr .anon) {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support e)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta e sourceV)
     (flags : WhnfFlags) (s : TcState .anon) :
@@ -58,12 +58,12 @@ theorem tryIotaWithFlags_state_wf_of_contexts
     WhnfStateInv .noAccel semantics trProj world support uvars Delta
   have hpost : ∀ (recId : KId .anon) (recr : IotaInfo .anon)
       (recUs : Array (KUniv .anon)) (spine : Array (KExpr .anon))
-      (major : KExpr .anon) {majorV : Lean4Lean.VExpr}
+      (major : KExpr .anon) {majorV : Ix.Theory.Named.VExpr}
       (after : TcState .anon),
       support major →
       TrKExprS world.venv uvars world.nameOf trProj Delta major majorV →
       support spine[recr.majorIdx]! →
-      ∀ {spineMajorV : Lean4Lean.VExpr},
+      ∀ {spineMajorV : Ix.Theory.Named.VExpr},
       TrKExprS world.venv uvars world.nameOf trProj Delta
         spine[recr.majorIdx]! spineMajorV →
       TcM.WF I after
@@ -186,4 +186,4 @@ theorem tryIotaWithFlags_state_wf_of_contexts
       exact TcM.WF.pure (fun _ => trivial)
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/NatLiteral.lean b/Ix/Kernel/Verify/Whnf/Iota/NatLiteral.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Iota/NatLiteral.lean
rename to Ix/Kernel/Verify/Whnf/Iota/NatLiteral.lean
index 0dba7dc2c..10645e160 100644
--- a/Ix/Tc/Verify/Whnf/Iota/NatLiteral.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/NatLiteral.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.ConstructorDispatch
+import Ix.Kernel.Verify.Whnf.Iota.ConstructorDispatch
+
+open Ix.Theory (VLevel)
 
 /-!
 # Nat-literal iota preprocessing
@@ -14,9 +16,9 @@ WHNF callback after constructing the String spine.  K synthesis and struct
 eta likewise retain their own inference and recursive-WHNF obligations.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefEq VExpr)
+open Ix.Theory.Named (VDefEq VExpr)
 
 namespace RecM
 
@@ -193,12 +195,12 @@ theorem tryIotaWithFlags_natCtor_checkedAcceptance_empty
     (hsourceTr : TrKExprS world.venv 0 world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType 0 [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -231,4 +233,4 @@ theorem tryIotaWithFlags_natCtor_checkedAcceptance_empty
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/NatOffset.lean b/Ix/Kernel/Verify/Whnf/Iota/NatOffset.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Iota/NatOffset.lean
rename to Ix/Kernel/Verify/Whnf/Iota/NatOffset.lean
index 69a561423..fb5b60aca 100644
--- a/Ix/Tc/Verify/Whnf/Iota/NatOffset.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/NatOffset.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Runtime.LazyIngress
+import Ix.Kernel.Verify.Whnf.Runtime.LazyIngress
 
 /-!
 # State closure for iota's Nat-offset preprocessing
@@ -13,7 +13,7 @@ that fact for every input and every invariant, then closes the complete
 cleanup helper without leaving it as an iota runtime premise.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 set_option maxHeartbeats 800000
@@ -235,7 +235,7 @@ structure NatOffsetCleanupInputOracle (trProj : RawProjRel)
     (world : VerifyWorld) (support : RunSupport) : Prop where
   generated :
     ∀ {uvars : Nat} {Delta : KVLCtx} {methods : Methods .anon}
-      {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+      {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
       {before after : TcState .anon} {result : KExpr .anon},
     support source →
     TrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -297,7 +297,7 @@ theorem cleanupNatOffsetMajor_input_wf
     {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {methods : Methods .anon}
     (inputs : NatOffsetCleanupInputOracle trProj world support)
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV)
@@ -638,4 +638,4 @@ theorem tryIotaAfterMajorWhnf_state_wf
       | some cleanedMajor => exact hfinish cleanedMajor false afterCleanup
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/NatPatternMatching.lean b/Ix/Kernel/Verify/Whnf/Iota/NatPatternMatching.lean
similarity index 86%
rename from Ix/Tc/Verify/Whnf/Iota/NatPatternMatching.lean
rename to Ix/Kernel/Verify/Whnf/Iota/NatPatternMatching.lean
index a083c7404..b73b6e318 100644
--- a/Ix/Tc/Verify/Whnf/Iota/NatPatternMatching.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/NatPatternMatching.lean
@@ -1,11 +1,13 @@
-import Ix.Tc.Verify.Whnf.Iota.NatRecognizer
+import Ix.Kernel.Verify.Whnf.Iota.NatRecognizer
+
+open Ix.Theory (VLevel)
 
 /-!
 # Constructive Nat-iota pattern matching
 
 NatRecognizer identifies the exact recursor rule and the literal-major position used
 by the linear Nat recognizer.  This slice crosses the next semantic boundary:
-it constructs Lean4Lean's dependent `Pattern.Matches` capture map from exact
+it constructs Ix.Theory.Named's dependent `Pattern.Matches` capture map from exact
 constant-spine shapes.
 
 The bridge deliberately ends at the application through the major argument.
@@ -14,22 +16,22 @@ can be used to justify the production fast path; silently matching a prefix
 as though it were the whole source would lose over-application semantics.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace HeadConstN
 
 /-- Every exact constant-headed spine constructively matches the corresponding
-`varN` pattern.  The existential capture map is produced by Lean4Lean's own
+`varN` pattern.  The existential capture map is produced by Ix.Theory.Named's own
 `Pattern.Matches.var` constructor at each application. -/
 theorem matches_varN
     {name : Lean.Name} {arity : Nat} {source : VExpr}
     (h : HeadConstN name arity source) :
-    ∃ (levels : List Lean4Lean.VLevel)
-        (captures : ((Lean4Lean.Pattern.const name).varN arity).Path → VExpr),
-      Lean4Lean.Pattern.Matches
-        ((Lean4Lean.Pattern.const name).varN arity)
+    ∃ (levels : List Ix.Theory.VLevel)
+        (captures : ((Ix.Theory.Named.Pattern.const name).varN arity).Path → VExpr),
+      Ix.Theory.Named.Pattern.Matches
+        ((Ix.Theory.Named.Pattern.const name).varN arity)
         source levels captures := by
   induction h with
   | const levels =>
@@ -37,10 +39,10 @@ theorem matches_varN
   | @app arity fn arg hprefix ih =>
       obtain ⟨levels, captures, hmatch⟩ := ih
       refine ⟨levels,
-        (fun path : Option (((Lean4Lean.Pattern.const name).varN arity).Path) =>
+        (fun path : Option (((Ix.Theory.Named.Pattern.const name).varN arity).Path) =>
           path.elim arg captures), ?_⟩
-      simpa only [Lean4Lean.Pattern.varN, Nat.add_comm] using
-        (Lean4Lean.Pattern.Matches.var (a' := arg) hmatch)
+      simpa only [Ix.Theory.Named.Pattern.varN, Nat.add_comm] using
+        (Ix.Theory.Named.Pattern.Matches.var (a' := arg) hmatch)
 
 /-- The canonical Theory numeral zero is a nullary `Nat.zero` spine. -/
 theorem natLit_zero :
@@ -60,7 +62,7 @@ end HeadConstN
 namespace RecursorIotaPattern
 
 /-- Exact recursor and constructor spines construct the dependent match for
-Lean4Lean's ordinary iota pattern.  The recursor levels and both capture maps
+Ix.Theory.Named's ordinary iota pattern.  The recursor levels and both capture maps
 are exactly those built by `Pattern.Matches`; no choice principle is needed. -/
 theorem matches_of_shapes
     {recursorName constructorName : Lean.Name}
@@ -68,10 +70,10 @@ theorem matches_of_shapes
     {recursorPrefix major : VExpr}
     (hrecursor : HeadConstN recursorName majorIdx recursorPrefix)
     (hconstructor : HeadConstN constructorName constructorArgs major) :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern recursorName majorIdx
           constructorName constructorArgs).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern recursorName majorIdx constructorName
           constructorArgs)
         (.app recursorPrefix major) levels captures := by
@@ -80,8 +82,8 @@ theorem matches_of_shapes
   obtain ⟨_, constructorCaptures, hconstructorMatch⟩ :=
     hconstructor.matches_varN
   refine ⟨recursorLevels, Sum.elim recursorCaptures constructorCaptures, ?_⟩
-  simpa only [RecursorIotaPattern, Lean4Lean.SimplePattern.toPattern] using
-    Lean4Lean.Pattern.Matches.app hrecursorMatch hconstructorMatch
+  simpa only [RecursorIotaPattern, Ix.Theory.Named.SimplePattern.toPattern] using
+    Ix.Theory.Named.Pattern.Matches.app hrecursorMatch hconstructorMatch
 
 /-- Constructive matching and the counted-spine view are equivalent.  This
 packages the registered-rule inversion together with the capture-map
@@ -90,10 +92,10 @@ direction. -/
 theorem exists_matches_iff_shapes
     {recursorName constructorName : Lean.Name}
     {majorIdx constructorArgs : Nat} {source : VExpr} :
-    (∃ (levels : List Lean4Lean.VLevel)
+    (∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern recursorName majorIdx
           constructorName constructorArgs).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern recursorName majorIdx constructorName
           constructorArgs)
         source levels captures) ↔
@@ -112,10 +114,10 @@ theorem matches_natZero
     {recursorName : Lean.Name} {majorIdx : Nat}
     {recursorPrefix : VExpr}
     (hrecursor : HeadConstN recursorName majorIdx recursorPrefix) :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern recursorName majorIdx
           ``Nat.zero 0).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern recursorName majorIdx ``Nat.zero 0)
         (.app recursorPrefix (VExpr.natLit 0)) levels captures :=
   matches_of_shapes hrecursor HeadConstN.natLit_zero
@@ -126,10 +128,10 @@ theorem matches_natSucc
     {recursorName : Lean.Name} {majorIdx predecessor : Nat}
     {recursorPrefix : VExpr}
     (hrecursor : HeadConstN recursorName majorIdx recursorPrefix) :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern recursorName majorIdx
           ``Nat.succ 1).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern recursorName majorIdx ``Nat.succ 1)
         (.app recursorPrefix (VExpr.natLit (predecessor + 1)))
         levels captures :=
@@ -175,19 +177,19 @@ end NatRecIotaCase
 namespace RecursorRulePattern
 
 /-- Once the recursor prefix and Nat constructor case are fixed, the exact
-trusted rule pattern has a concrete Lean4Lean match and capture map. -/
+trusted rule pattern has a concrete Ix.Theory.Named match and capture map. -/
 theorem matches_natLiteral
     {pattern : RecursorRulePattern} {major : Nat}
     {recursorPrefix : VExpr}
     (hrecursor : HeadConstN pattern.recursorName pattern.majorIdx
       recursorPrefix)
     (hcase : NatRecIotaCase pattern major) :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern pattern.recursorName
           pattern.majorIdx pattern.constructorName
           (pattern.constructorParams.toNat +
             pattern.constructorFields.toNat)).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern pattern.recursorName pattern.majorIdx
           pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -204,7 +206,7 @@ namespace TrAppSpine
 exactly counted Theory constant spine.  In particular, this theorem does not
 forget how many arguments precede a descriptor-selected major. -/
 theorem headConstN
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {id : KId .anon}
     {us : Array (KUniv .anon)} {info : ExprInfo .anon}
@@ -228,7 +230,7 @@ theorem headConstN
 recursor half of the selected pattern match.  The length equality is an
 explicit prefix-boundary obligation. -/
 theorem matches_natRecRulePrefix
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {id : KId .anon}
     {us : Array (KUniv .anon)} {info : ExprInfo .anon}
@@ -239,12 +241,12 @@ theorem matches_natRecRulePrefix
     (hname : nameOf id.addr = some pattern.recursorName)
     (hlength : args.length = pattern.majorIdx)
     (hcase : NatRecIotaCase pattern major) :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern pattern.recursorName
           pattern.majorIdx pattern.constructorName
           (pattern.constructorParams.toNat +
             pattern.constructorFields.toNat)).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern pattern.recursorName pattern.majorIdx
           pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -264,7 +266,7 @@ pattern provenance.  Constructor shape remains a separate Nat-specific fact,
 so a catalogued rule at index zero or one is not silently assumed to be the
 corresponding Nat rule. -/
 theorem matches_natLiteralPrefix
-    {env : Lean4Lean.VEnv} {catalog : Catalog}
+    {env : Ix.Theory.Named.VEnv} {catalog : Catalog}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {id : KId .anon} {recursor : KConst .anon} {rule : RecRule .anon}
     {pattern : RecursorRulePattern}
@@ -277,12 +279,12 @@ theorem matches_natLiteralPrefix
       (.const id us info) args recursorPrefix)
     (hlength : args.length = pattern.majorIdx)
     (hcase : NatRecIotaCase pattern major) :
-    ∃ (levels : List Lean4Lean.VLevel)
+    ∃ (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern pattern.recursorName
           pattern.majorIdx pattern.constructorName
           (pattern.constructorParams.toNat +
             pattern.constructorFields.toNat)).Path → VExpr),
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern pattern.recursorName pattern.majorIdx
           pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -292,4 +294,4 @@ theorem matches_natLiteralPrefix
 
 end RawRecursorRulePatternRel
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/NatRecognizer.lean b/Ix/Kernel/Verify/Whnf/Iota/NatRecognizer.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Iota/NatRecognizer.lean
rename to Ix/Kernel/Verify/Whnf/Iota/NatRecognizer.lean
index 1ad3dbf2c..72f005f25 100644
--- a/Ix/Tc/Verify/Whnf/Iota/NatRecognizer.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/NatRecognizer.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.RuntimeContracts
+import Ix.Kernel.Verify.Whnf.RuntimeContracts
 
 /-!
 # Linear Nat-recognizer success provenance
@@ -12,7 +12,7 @@ from being applied to a recursor rule or major index that execution never
 selected.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace KId
 
@@ -332,4 +332,4 @@ theorem patternAt
 end TrustedNatRecLiteralParts
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/NatReduction.lean b/Ix/Kernel/Verify/Whnf/Iota/NatReduction.lean
similarity index 91%
rename from Ix/Tc/Verify/Whnf/Iota/NatReduction.lean
rename to Ix/Kernel/Verify/Whnf/Iota/NatReduction.lean
index 9c34fe7d0..4da4e5808 100644
--- a/Ix/Tc/Verify/Whnf/Iota/NatReduction.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/NatReduction.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.NatRuleLayout
+import Ix.Kernel.Verify.Whnf.Iota.NatRuleLayout
+
+open Ix.Theory (VLevel)
 
 /-!
 # Checked Nat-iota reduction through typed suffixes
@@ -16,9 +18,9 @@ inductive-admission/RHS obligations; neither follows from rule-slot existence
 or from a successful pattern match alone.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 namespace TrAppSuffix
@@ -27,7 +29,7 @@ namespace TrAppSuffix
 application is typed.  For a nonempty suffix, the first applicable function
 type is recovered by walking backward through the snoc derivation. -/
 theorem startHasType
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {resultV resultType : VExpr}
@@ -44,7 +46,7 @@ order, and the complete old and new applications remain definitionally
 equal.  In particular, the result expression contains `args`; this theorem
 cannot justify dropping a trailing application. -/
 theorem rebase
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {resultV : VExpr}
@@ -75,7 +77,7 @@ theorem rebase
         simp only [List.foldl_cons, List.foldl_nil]
         rw [KExpr.mkApp_shape]
         exact .app hcurrentType harg hcurrentTr hargTr
-      · exact (Lean4Lean.VEnv.IsDefEq.appDF hcurrentEqAt harg).toU
+      · exact (Ix.Theory.Named.VEnv.IsDefEq.appDF hcurrentEqAt harg).toU
 
 end TrAppSuffix
 end RecM
@@ -86,7 +88,7 @@ namespace RawRecursorRulePatternRel
 environment.  A match is deliberately insufficient: the pattern's explicit
 definitional-equality checks must also be discharged. -/
 theorem checkedReduction
-    {env : Lean4Lean.VEnv} {catalog : Catalog}
+    {env : Ix.Theory.Named.VEnv} {catalog : Catalog}
     {nameOf : Address → Option Lean.Name}
     {id : KId .anon} {recursor : KConst .anon} {rule : RecRule .anon}
     {pattern : RecursorRulePattern}
@@ -94,13 +96,13 @@ theorem checkedReduction
       rule pattern)
     (henv : env.WF)
     {uvars : Nat} {Gamma : List VExpr} {source A : VExpr}
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hGamma : Lean4Lean.OnCtx Gamma (env.IsType uvars))
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hGamma : Ix.Theory.Named.OnCtx Gamma (env.IsType uvars))
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -113,7 +115,7 @@ theorem checkedReduction
       (pattern.rhs.apply levels captures) := by
   rcases hpattern with
     ⟨_, _, _, _, _, _, _, hsound⟩
-  exact hsound Lean4Lean.VEnv.LE.rfl henv hGamma hmatch htype hchecks
+  exact hsound Ix.Theory.Named.VEnv.LE.rfl henv hGamma hmatch htype hchecks
 
 end RawRecursorRulePatternRel
 
@@ -144,12 +146,12 @@ theorem checkedRhsSuffix
     {pattern : RecursorRulePattern}
     (hpattern : RawRecursorRulePatternRel world.venv world.catalog
       world.nameOf id recursor rule pattern)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -177,4 +179,4 @@ theorem checkedRhsSuffix
 
 end NatRecLiteralTranslationSplit
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/NatRuleLayout.lean b/Ix/Kernel/Verify/Whnf/Iota/NatRuleLayout.lean
similarity index 96%
rename from Ix/Tc/Verify/Whnf/Iota/NatRuleLayout.lean
rename to Ix/Kernel/Verify/Whnf/Iota/NatRuleLayout.lean
index cb260928b..6bef289d4 100644
--- a/Ix/Tc/Verify/Whnf/Iota/NatRuleLayout.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/NatRuleLayout.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.NatPatternMatching
+import Ix.Kernel.Verify.Whnf.Iota.NatPatternMatching
+
+open Ix.Theory (VLevel)
 
 /-!
 # Trusted Nat-rule layout and through-major spine splitting
@@ -15,9 +17,9 @@ suffix separately, so later RHS reasoning cannot accidentally discard an
 over-application.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 /-! ## Trusted Nat recursor layout -/
 
@@ -102,7 +104,7 @@ namespace RecM
 
 /-- Typed translation of a left-associated application suffix starting from
 an already translated prefix.  The suffix is stored in production order. -/
-inductive TrAppSuffix (env : Lean4Lean.VEnv) (uvars : Nat)
+inductive TrAppSuffix (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     (Delta : KVLCtx) (start : VExpr) :
     List (KExpr .anon) → VExpr → Prop
@@ -119,7 +121,7 @@ namespace TrAppSuffix
 
 /-- Reattach a certified suffix to a translated concrete prefix. -/
 theorem tr
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {resultV : VExpr}
@@ -144,7 +146,7 @@ namespace TrAppSpine
 argument.  `throughTr` ends exactly after applying the major; `suffixTr`
 accounts for every later argument. -/
 def SplitAt
-    (env : Lean4Lean.VEnv) (uvars : Nat)
+    (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     (Delta : KVLCtx) (head : KExpr .anon)
     (args : List (KExpr .anon)) (majorIdx : Nat)
@@ -164,7 +166,7 @@ def SplitAt
 The proof follows the snoc structure of `TrAppSpine`, distinguishing a hit in
 the prior prefix from the newly appended final argument. -/
 theorem splitAt
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head major : KExpr .anon}
     {args : List (KExpr .anon)} {majorIdx : Nat} {resultV : VExpr}
@@ -210,7 +212,7 @@ end TrAppSpine
 /-- Exact translated decomposition induced by the literal position recorded
 in a successful Nat-recognizer descriptor. -/
 def NatRecLiteralTranslationSplit
-    (env : Lean4Lean.VEnv) (uvars : Nat)
+    (env : Ix.Theory.Named.VEnv) (uvars : Nat)
     (nameOf : Address → Option Lean.Name) (trProj : RawProjRel)
     (Delta : KVLCtx) (id : KId .anon)
     (source : KExpr .anon) (parts : NatRecLiteralParts .anon)
@@ -269,7 +271,7 @@ theorem patternMajor
 The major translation becomes the canonical Theory numeral by inversion of
 the owned literal translation rule. -/
 theorem translatedSplit
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {id : KId .anon} {recursor : KConst .anon}
     {source : KExpr .anon} {parts : NatRecLiteralParts .anon}
@@ -324,7 +326,7 @@ theorem translatedCase
     ∃ (id : KId .anon) (recursor : KConst .anon) (rule : RecRule .anon)
         (pattern : RecursorRulePattern)
         (priorArgs laterArgs : List (KExpr .anon)) (priorV : VExpr)
-        (levels : List Lean4Lean.VLevel)
+        (levels : List Ix.Theory.VLevel)
         (captures : (RecursorIotaPattern pattern.recursorName
           pattern.majorIdx pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -338,7 +340,7 @@ theorem translatedCase
       RawRecursorRulePatternRel world.venv world.catalog world.nameOf
         id recursor rule pattern ∧
       NatRecIotaCase pattern parts.major ∧
-      Lean4Lean.Pattern.Matches
+      Ix.Theory.Named.Pattern.Matches
         (RecursorIotaPattern pattern.recursorName pattern.majorIdx
           pattern.constructorName
           (pattern.constructorParams.toNat +
@@ -363,4 +365,4 @@ end TrustedNatRecLiteralParts
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/OptionalReduction.lean b/Ix/Kernel/Verify/Whnf/Iota/OptionalReduction.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Iota/OptionalReduction.lean
rename to Ix/Kernel/Verify/Whnf/Iota/OptionalReduction.lean
index 286e3fee1..262a58432 100644
--- a/Ix/Tc/Verify/Whnf/Iota/OptionalReduction.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/OptionalReduction.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.Ingress
+import Ix.Kernel.Verify.Whnf.Iota.Ingress
 
 /-!
 # Exhaustive iota optional-reduction contract
@@ -21,7 +21,7 @@ ingress is supplied separately by `AnonLazyIngressContext`, which identifies
 the actual installed `ingressAnonAddrShallow` hook.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Remaining non-method authority used by `tryIotaWithFlags`.
 
@@ -51,7 +51,7 @@ structure IotaSuccessOracle (semantics : CacheSemantics)
     (support : RunSupport) : Prop where
   accept : ∀ {uvars : Nat} {Delta : KVLCtx}
       {methods : Methods .anon} {source : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {flags : WhnfFlags}
+      {sourceV : Ix.Theory.Named.VExpr} {flags : WhnfFlags}
       {s sf : TcState .anon} {result : KExpr .anon},
     Methods.WFAt .noAccel semantics trProj world support uvars methods →
     support source →
@@ -119,4 +119,4 @@ theorem tryIotaWithFlags_optional_wf_of_contexts
         success.accept hmethods hsourceSupport hsource hI hrunIota⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/RuleInstantiation.lean b/Ix/Kernel/Verify/Whnf/Iota/RuleInstantiation.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Iota/RuleInstantiation.lean
rename to Ix/Kernel/Verify/Whnf/Iota/RuleInstantiation.lean
index 5d785cb08..620a82b35 100644
--- a/Ix/Tc/Verify/Whnf/Iota/RuleInstantiation.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/RuleInstantiation.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Whnf.Iota.NatReduction
-import Ix.Tc.Verify.InstL
+import Ix.Kernel.Verify.Whnf.Iota.NatReduction
+import Ix.Kernel.Verify.InstL
+
+open Ix.Theory (VLevel)
 
 /-!
 # Typed registered recursor RHS instantiation
@@ -23,9 +25,9 @@ arguments.  Modeling those applications is the next bridge, and conflating
 the two terms here would be unsound.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefEq VEnv VExpr)
+open Ix.Theory.Named (VDefEq VEnv VExpr)
 
 namespace RegisteredRecursorRuleRhsRel
 
@@ -137,4 +139,4 @@ theorem registeredRhsTyped
 
 end RawRecursorRuleRel
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/RuleSuffixTransport.lean b/Ix/Kernel/Verify/Whnf/Iota/RuleSuffixTransport.lean
similarity index 94%
rename from Ix/Tc/Verify/Whnf/Iota/RuleSuffixTransport.lean
rename to Ix/Kernel/Verify/Whnf/Iota/RuleSuffixTransport.lean
index 31daeebf8..94cc3fb77 100644
--- a/Ix/Tc/Verify/Whnf/Iota/RuleSuffixTransport.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/RuleSuffixTransport.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.RuleInstantiation
+import Ix.Kernel.Verify.Whnf.Iota.RuleInstantiation
+
+open Ix.Theory (VLevel)
 
 /-!
 # Quotient-aware registered RHS suffix transport
@@ -20,9 +22,9 @@ The theorem still does not identify an instantiated registered body with
 sequence remains an explicit subsequent obligation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
 namespace RecM
 namespace TrAppSuffix
@@ -35,7 +37,7 @@ the structural suffix theorem.
 The result is structural again.  In particular, all original concrete suffix
 arguments remain visible in `args.foldl KExpr.mkApp replacement`. -/
 theorem rebaseQuot
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {start : VExpr}
     {args : List (KExpr .anon)} {resultV : VExpr}
@@ -81,12 +83,12 @@ theorem checkedRhsSuffixQuot
     {pattern : RecursorRulePattern}
     (hpattern : RawRecursorRulePatternRel world.venv world.catalog
       world.nameOf id recursor rule pattern)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -115,4 +117,4 @@ theorem checkedRhsSuffixQuot
 end NatRecLiteralTranslationSplit
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/SelectedRule.lean b/Ix/Kernel/Verify/Whnf/Iota/SelectedRule.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/SelectedRule.lean
rename to Ix/Kernel/Verify/Whnf/Iota/SelectedRule.lean
index b53cf19a5..680fd94ca 100644
--- a/Ix/Tc/Verify/Whnf/Iota/SelectedRule.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/SelectedRule.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.ArgumentExecution
+import Ix.Kernel.Verify.Whnf.Iota.ArgumentExecution
+
+open Ix.Theory (VLevel)
 
 /-!
 # Checked execution of one selected iota rule
@@ -17,9 +19,9 @@ certificate, the selected-rule trace proves exact production execution,
 state/intern framing, finite support, and source-to-result `WhnfMeaning`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefEq VExpr)
+open Ix.Theory.Named (VDefEq VExpr)
 
 namespace WhnfMeaning
 
@@ -225,7 +227,7 @@ argument slices is the pattern RHS under the match's levels and captures.
 Current `RawRecursorRuleRel` and `RawRecursorRulePatternRel` do not imply this
 equation because they record their RHS values independently. -/
 def IotaRhsApplicationAligned
-    (pattern : RecursorRulePattern) (levels : List Lean4Lean.VLevel)
+    (pattern : RecursorRulePattern) (levels : List Ix.Theory.VLevel)
     (captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
@@ -605,12 +607,12 @@ theorem checkedMeaning
     (hsourceTr : TrKExprS world.venv uvars world.nameOf trProj Delta source
       sourceV)
     (hsourceType : world.venv.HasType uvars Delta.toCtx sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -662,12 +664,12 @@ theorem checkedAcceptance_empty
     (hsourceTr : TrKExprS world.venv 0 world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType 0 [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -731,12 +733,12 @@ theorem checkedAcceptance_nonempty
     (hsourceTr : TrKExprS world.venv uvars world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType uvars [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -763,4 +765,4 @@ end ApplyIotaRuleTrace
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/StringLiteral.lean b/Ix/Kernel/Verify/Whnf/Iota/StringLiteral.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/StringLiteral.lean
rename to Ix/Kernel/Verify/Whnf/Iota/StringLiteral.lean
index 88c530e6e..8efaddced 100644
--- a/Ix/Tc/Verify/Whnf/Iota/StringLiteral.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/StringLiteral.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.Iota.NatLiteral
+import Ix.Kernel.Verify.Whnf.Iota.NatLiteral
+
+open Ix.Theory (VLevel)
 
 /-!
 # String-literal iota preprocessing
@@ -15,9 +17,9 @@ spines is a separate helper-closure obligation; this file does not disguise
 it as a consequence of the operational callback equation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VDefEq VExpr)
+open Ix.Theory.Named (VDefEq VExpr)
 
 namespace RecM
 
@@ -393,12 +395,12 @@ theorem tryIotaWithFlags_strCtor_checkedAcceptance_empty
     (hsourceTr : TrKExprS world.venv 0 world.nameOf trProj [] source
       sourceV)
     (hsourceType : world.venv.HasType 0 [] sourceV sourceType)
-    {levels : List Lean4Lean.VLevel}
+    {levels : List Ix.Theory.VLevel}
     {captures : (RecursorIotaPattern pattern.recursorName pattern.majorIdx
       pattern.constructorName
       (pattern.constructorParams.toNat +
         pattern.constructorFields.toNat)).Path → VExpr}
-    (hmatch : Lean4Lean.Pattern.Matches
+    (hmatch : Ix.Theory.Named.Pattern.Matches
       (RecursorIotaPattern pattern.recursorName pattern.majorIdx
         pattern.constructorName
         (pattern.constructorParams.toNat +
@@ -431,4 +433,4 @@ theorem tryIotaWithFlags_strCtor_checkedAcceptance_empty
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/StructEtaControl.lean b/Ix/Kernel/Verify/Whnf/Iota/StructEtaControl.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Iota/StructEtaControl.lean
rename to Ix/Kernel/Verify/Whnf/Iota/StructEtaControl.lean
index 199e21469..8ebcb7d67 100644
--- a/Ix/Tc/Verify/Whnf/Iota/StructEtaControl.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/StructEtaControl.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.ConstructorSynthesisFallback
+import Ix.Kernel.Verify.Whnf.Iota.ConstructorSynthesisFallback
 
 /-!
 # Struct-eta iota control-flow closure
@@ -16,7 +16,7 @@ structure-like does not itself manufacture the registered Theory recursor
 equation or projection interpretation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -1035,4 +1035,4 @@ theorem tryIotaCtorOrStructEta_constructor
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/Substitution.lean b/Ix/Kernel/Verify/Whnf/Iota/Substitution.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/Substitution.lean
rename to Ix/Kernel/Verify/Whnf/Iota/Substitution.lean
index a8eb642c8..91994ae4f 100644
--- a/Ix/Tc/Verify/Whnf/Iota/Substitution.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/Substitution.lean
@@ -1,5 +1,7 @@
-import Ix.Tc.Verify.Whnf.Iota.RuleSuffixTransport
-import Ix.Tc.Verify.Totalization
+import Ix.Kernel.Verify.Whnf.Iota.RuleSuffixTransport
+import Ix.Kernel.Verify.Totalization
+
+open Ix.Theory (VLevel)
 
 /-!
 # Transient iota substitution agrees with the verified spec
@@ -17,7 +19,7 @@ uses the equality to expose the production `applyIotaArg` transient-lambda
 branch as the verified substitution spec and as a semantic beta reduction.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace KExpr
 
@@ -268,7 +270,7 @@ theorem applyIotaArg_true_lam_spec
     (hbig : body.size + arg.size < UInt64.size) :
     RecM.applyIotaArg (.lam name bi dom body info) arg true =
       pure (KExpr.substSpec body arg 0) := by
-  rw [Ix.Tc.RecM.applyIotaArg_true_lam,
+  rw [Ix.Kernel.RecM.applyIotaArg_true_lam,
     hbody.substNoIntern_eq_substSpec harg
       (depth := 0)
       (by rw [show (0 : UInt64).toNat = 0 from rfl]; omega) (by omega)]
@@ -299,7 +301,7 @@ theorem betaNoIntern
     {Delta : KVLCtx} {nm : Mode.anon.F Name}
     {bi : Mode.anon.F Lean.BinderInfo}
     {ty body arg : KExpr .anon} {lamMd appMd : ExprInfo .anon}
-    {A bodyV argV B : Lean4Lean.VExpr} {u : Lean4Lean.VLevel}
+    {A bodyV argV B : Ix.Theory.Named.VExpr} {u : Ix.Theory.VLevel}
     (hty : TrKExprS world.venv uvars world.nameOf trProj Delta ty A)
     (hbody : TrKExprS world.venv uvars world.nameOf trProj
       ((none, .vlam A) :: Delta) body bodyV)
@@ -320,4 +322,4 @@ theorem betaNoIntern
 
 end WhnfMeaning
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Iota/SynthesisRequests.lean b/Ix/Kernel/Verify/Whnf/Iota/SynthesisRequests.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Iota/SynthesisRequests.lean
rename to Ix/Kernel/Verify/Whnf/Iota/SynthesisRequests.lean
index 7ecb711cc..69221e64e 100644
--- a/Ix/Tc/Verify/Whnf/Iota/SynthesisRequests.lean
+++ b/Ix/Kernel/Verify/Whnf/Iota/SynthesisRequests.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.RebuildRequests
+import Ix.Kernel.Verify.Whnf.StructEta.RebuildRequests
 
 /-!
 # Finite request closure for K-synthesis
@@ -21,7 +21,7 @@ instantiate it.  No catalog, walker, or generated-expression effect remains
 abstract.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- State-only contract for the actual DefEq back-edge, including production's
@@ -75,7 +75,7 @@ theorem callIsDefEq_wf
     {uvars : Nat} {Delta : KVLCtx} {methods : Methods .anon}
     (hmethods :
       Methods.WFAt layer semantics trProj world support uvars methods)
-    {a b : KExpr .anon} {va vb : Lean4Lean.VExpr}
+    {a b : KExpr .anon} {va vb : Ix.Theory.Named.VExpr}
     (haSupport : support a) (hbSupport : support b)
     (ha : TrKExprS world.venv uvars world.nameOf trProj Delta a va)
     (hb : TrKExprS world.venv uvars world.nameOf trProj Delta b vb)
@@ -136,7 +136,7 @@ def KSynthCandidateInputs
     {params : Nat}
     (plan : KSynthCandidateRequests requests ctorId tyUs tyArgs params)
     (majorTyW : KExpr .anon) : Prop :=
-  ∃ majorTyWV ctorAppV : Lean4Lean.VExpr,
+  ∃ majorTyWV ctorAppV : Ix.Theory.Named.VExpr,
     support majorTyW ∧
       TrKExprS world.venv uvars world.nameOf trProj Delta
         majorTyW majorTyWV ∧
@@ -168,7 +168,7 @@ structure KSynthCandidateInputOracle
     (support : RunSupport) : Prop where
   candidate :
     ∀ {uvars : Nat} {Delta : KVLCtx}
-      {majorTyW : KExpr .anon} {majorTyWV : Lean4Lean.VExpr}
+      {majorTyW : KExpr .anon} {majorTyWV : Ix.Theory.Named.VExpr}
       {tyHeadId indId ctorId : KId .anon}
       {tyUs : Array (KUniv .anon)} {tyInfo : ExprInfo .anon}
       {tyArgs : Array (KExpr .anon)} {params : Nat}
@@ -468,7 +468,7 @@ theorem selectKSynthCandidate_state_wf_of_inputs
     (hfault : TcM.LazyFaultPreserves
       (WhnfStateInv layer semantics trProj world support uvars Delta))
     (candidateInputs : KSynthCandidateInputOracle trProj world support)
-    {majorTyW : KExpr .anon} {majorTyWV : Lean4Lean.VExpr}
+    {majorTyW : KExpr .anon} {majorTyWV : Ix.Theory.Named.VExpr}
     {tyHeadId : KId .anon} {tyUs : Array (KUniv .anon)}
     {tyInfo : ExprInfo .anon} {tyArgs : Array (KExpr .anon)}
     {indId : KId .anon} {params : Nat}
@@ -663,7 +663,7 @@ theorem synthCtorWhenK_state_wf_of_inputs
         (WhnfStateInv layer semantics trProj world support uvars current))
     (hreferences : TrustedReferences world support)
     (candidateInputs : KSynthCandidateInputOracle trProj world support)
-    {major : KExpr .anon} {majorV : Lean4Lean.VExpr}
+    {major : KExpr .anon} {majorV : Ix.Theory.Named.VExpr}
     (hmajorSupport : support major)
     (hmajorTr : TrKExprS world.venv uvars world.nameOf trProj Delta
       major majorV)
@@ -757,4 +757,4 @@ theorem synthCtorWhenK_state_wf_of_inputs
                         afterScan
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/BaseReductions.lean b/Ix/Kernel/Verify/Whnf/NoDelta/BaseReductions.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/NoDelta/BaseReductions.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/BaseReductions.lean
index dc21fcce9..954f38dec 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/BaseReductions.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/BaseReductions.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.NoDelta.QuotientReflection
+import Ix.Kernel.Verify.Whnf.NoDelta.QuotientReflection
 
 /-!
 # Assemble the active no-delta base oracle
@@ -10,7 +10,7 @@ constructs the `NoDeltaBaseOracle` consumed by the already-proved ordered
 no-delta step.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Complete input package for the five active no-delta reducers.
@@ -92,4 +92,4 @@ theorem oracle
 
 end NoDeltaBaseContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/ProjectionApplication.lean b/Ix/Kernel/Verify/Whnf/NoDelta/ProjectionApplication.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/NoDelta/ProjectionApplication.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/ProjectionApplication.lean
index 95a18174d..088ed9097 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/ProjectionApplication.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/ProjectionApplication.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.Reducer
+import Ix.Kernel.Verify.Whnf.Structural.Reducer
 
 /-!
 # Projection-application no-delta field
@@ -14,7 +14,7 @@ boundary supplies meaning for the changed head; and the finite application
 census certifies the exact left-to-right suffix rebuilt by production.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-! ## Exact raw-helper equations -/
@@ -202,7 +202,7 @@ theorem tryProjAppReduceFinished_app_optional_wf
     (horacle : InductiveReductionOracle .noAccel semantics trProj world
       support)
     {f arg : KExpr .anon} {info : ExprInfo .anon} {flags : WhnfFlags}
-    {uvars : Nat} {Delta : KVLCtx} {sourceV : Lean4Lean.VExpr}
+    {uvars : Nat} {Delta : KVLCtx} {sourceV : Ix.Theory.Named.VExpr}
     {s : TcState .anon}
     (hsourceSupport : support (.app f arg info))
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
@@ -340,4 +340,4 @@ theorem tryProjAppReduceFinished_optional_wf_of_contexts
         (hempty := rfl)
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/ProjectionDefinition.lean b/Ix/Kernel/Verify/Whnf/NoDelta/ProjectionDefinition.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/NoDelta/ProjectionDefinition.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/ProjectionDefinition.lean
index 3b0c84de1..0c342d09b 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/ProjectionDefinition.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/ProjectionDefinition.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.NoDelta.StringPrimitive
+import Ix.Kernel.Verify.Whnf.NoDelta.StringPrimitive
 
 /-!
 # Projection-definition no-delta field
@@ -14,7 +14,7 @@ the run support; support for only the final expression is not enough to make
 the intern-table collision argument sound.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite request plan for a recognized projection-wrapper definition.
 
@@ -48,7 +48,7 @@ structure ProjectionDefinitionReflection (semantics : CacheSemantics)
     (support : RunSupport) : Prop where
   success : ∀ {uvars : Nat} {Delta : KVLCtx}
       {methods : Methods .anon} {source result : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {s sf : TcState .anon},
+      {sourceV : Ix.Theory.Named.VExpr} {s sf : TcState .anon},
     Methods.WFAt .noAccel semantics trProj world support uvars methods →
     support source →
     TrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -211,4 +211,4 @@ theorem tryReduceProjectionDefinition_optional_wf_of_contexts
           hrunProjection⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/Quotient.lean b/Ix/Kernel/Verify/Whnf/NoDelta/Quotient.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/NoDelta/Quotient.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/Quotient.lean
index 96eb1258d..9e0341399 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/Quotient.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/Quotient.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.NoDelta.ProjectionDefinition
+import Ix.Kernel.Verify.Whnf.NoDelta.ProjectionDefinition
 
 /-!
 # Quotient no-delta field
@@ -10,7 +10,7 @@ callback errors and every generated intern, from finite input and request
 coverage.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite generated-node plan for one selected quotient reduction.
 
@@ -44,7 +44,7 @@ structure QuotientReductionReflection (semantics : CacheSemantics)
     (support : RunSupport) : Prop where
   success : ∀ {uvars : Nat} {Delta : KVLCtx}
       {methods : Methods .anon} {source result : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {s sf : TcState .anon},
+      {sourceV : Ix.Theory.Named.VExpr} {s sf : TcState .anon},
     Methods.WFAt .noAccel semantics trProj world support uvars methods →
     support source →
     TrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -85,7 +85,7 @@ theorem tryQuotReduceSelected_inv_wf
     (inputs : NoDeltaInputSupport support)
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {uvars : Nat} {Delta : KVLCtx}
-    {source head : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source head : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {args : Array (KExpr .anon)} {prims : Primitives .anon}
     {fIdx majorIdx : Nat} {s : TcState .anon}
     (hsourceSupport : support source)
@@ -164,7 +164,7 @@ theorem tryQuotReduce_inv_wf
     (inputs : NoDeltaInputSupport support)
     {semantics : CacheSemantics} {trProj : RawProjRel}
     {world : VerifyWorld} {uvars : Nat} {Delta : KVLCtx}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {s : TcState .anon}
     (hsourceSupport : support source)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta source
@@ -253,4 +253,4 @@ theorem tryQuotReduce_optional_wf_of_contexts
         reflection.success hmethods hsourceSupport hsource hI hrunQuot⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/QuotientReflection.lean b/Ix/Kernel/Verify/Whnf/NoDelta/QuotientReflection.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/NoDelta/QuotientReflection.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/QuotientReflection.lean
index 38068dd08..549a76cbe 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/QuotientReflection.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/QuotientReflection.lean
@@ -1,4 +1,6 @@
-import Ix.Tc.Verify.Whnf.NoDelta.Quotient
+import Ix.Kernel.Verify.Whnf.NoDelta.Quotient
+
+open Ix.Theory (VLevel)
 
 /-!
 # Quotient reduction reflection
@@ -7,27 +9,27 @@ This module turns the successful production `tryQuotReduce` path into the
 semantic `QuotientReductionReflection` consumed by the no-delta reducer.  The
 only conditional input is a pair of Theory-level contraction laws.  They
 mention no Ix state, addresses, hashes, support predicates, or executions and
-are the narrow temporary interface intended to be replaced by Lean4Lean's
+are the narrow temporary interface intended to be replaced by Ix.Theory.Named's
 constructive quotient result.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VExpr)
+open Ix.Theory.Named (VExpr)
 
-/-- Theory-only quotient contraction laws expected from Lean4Lean L4L-19B.
+/-- Theory-only quotient contraction laws expected from Ix.Theory.Named Spec-19B.
 
 Both laws are deliberately phrased after the quotient major has been related
 to an exact `Quot.mk` application.  The Ix adapter below owns the proof of that
 relation from the real recursive-WHNF callback and owns all concrete spine and
 suffix alignment. -/
-structure QuotientReductionLaws (env : Lean4Lean.VEnv) : Prop where
+structure QuotientReductionLaws (env : Ix.Theory.Named.VEnv) : Prop where
   lift : ∀ {uvars : Nat} {Gamma : List VExpr}
-      {liftLevels mkLevels : List Lean4Lean.VLevel}
+      {liftLevels mkLevels : List Ix.Theory.VLevel}
       {alpha relation beta fn respects ctorAlpha ctorRelation representative
         major : VExpr},
     env.WF →
-    env.defeqs Lean4Lean.quotDefEq →
+    env.defeqs Ix.Theory.Named.quotDefEq →
     VExpr.WF env uvars Gamma
       (.app
         (VExpr.appN (.const ``Quot.lift liftLevels)
@@ -46,7 +48,7 @@ structure QuotientReductionLaws (env : Lean4Lean.VEnv) : Prop where
           major)
         (.app fn representative)
   ind : ∀ {uvars : Nat} {Gamma : List VExpr}
-      {indLevels mkLevels : List Lean4Lean.VLevel}
+      {indLevels mkLevels : List Ix.Theory.VLevel}
       {alpha relation motive fn ctorAlpha ctorRelation representative
         major : VExpr},
     env.WF →
@@ -141,7 +143,7 @@ namespace TrAppSpine
 
 /-- Invert an exact three-argument translated spine. -/
 theorem three
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head a b c : KExpr .anon} {resultV : VExpr}
     (h : TrAppSpine env uvars nameOf trProj Delta head [a, b, c]
@@ -169,7 +171,7 @@ theorem three
 
 /-- Invert an exact four-argument translated spine. -/
 theorem four
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head a b c d : KExpr .anon} {resultV : VExpr}
     (h : TrAppSpine env uvars nameOf trProj Delta head [a, b, c, d]
@@ -201,7 +203,7 @@ theorem four
 
 /-- Invert an exact five-argument translated spine. -/
 theorem five
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head a b c d e : KExpr .anon} {resultV : VExpr}
     (h : TrAppSpine env uvars nameOf trProj Delta head [a, b, c, d, e]
@@ -242,7 +244,7 @@ namespace TrKExprS
 /-- A translated constant whose address has an exact trusted-name binding has
 that name in its Theory syntax. -/
 theorem const_name
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {id : KId .anon} {us : Array (KUniv .anon)}
     {info : ExprInfo .anon} {value : VExpr} {name : Lean.Name}
@@ -265,7 +267,7 @@ theorem quotientLiftMeaning
     (theory : WhnfTheory trProj world uvars)
     (laws : QuotientReductionLaws world.venv)
     (htable : NoDeltaPrimitiveTableAgrees world prims)
-    (hregistered : world.venv.defeqs Lean4Lean.quotDefEq)
+    (hregistered : world.venv.defeqs Ix.Theory.Named.quotDefEq)
     (hDelta : KVLCtx.WF world.venv uvars Delta)
     {source : KExpr .anon} {sourceV : VExpr}
     {id : KId .anon} {us : Array (KUniv .anon)}
@@ -305,7 +307,7 @@ theorem quotientLiftMeaning
     exact htable.quotLift.2
   have hliftHead : liftHeadV =
       .const ``Quot.lift (us.toList.map KUniv.toVLevel) :=
-    Ix.Tc.RecM.TrKExprS.const_name hliftHeadTr hliftName
+    Ix.Kernel.RecM.TrKExprS.const_name hliftHeadTr hliftName
   rw [hliftHead] at hpriorShape
   subst priorV
 
@@ -337,7 +339,7 @@ theorem quotientLiftMeaning
     exact htable.quotCtor.2
   have hmkHead : mkHeadV =
       .const ``Quot.mk (mkUs.toList.map KUniv.toVLevel) :=
-    Ix.Tc.RecM.TrKExprS.const_name hmkHeadTr hmkName
+    Ix.Kernel.RecM.TrKExprS.const_name hmkHeadTr hmkName
   rw [hmkHead] at hmkShape
   subst majorWhnfV
 
@@ -419,7 +421,7 @@ theorem quotientIndMeaning
     exact htable.quotInd.2
   have hindHead : indHeadV =
       .const ``Quot.ind (us.toList.map KUniv.toVLevel) :=
-    Ix.Tc.RecM.TrKExprS.const_name hindHeadTr hindName
+    Ix.Kernel.RecM.TrKExprS.const_name hindHeadTr hindName
   rw [hindHead] at hpriorShape
   subst priorV
 
@@ -451,7 +453,7 @@ theorem quotientIndMeaning
     exact htable.quotCtor.2
   have hmkHead : mkHeadV =
       .const ``Quot.mk (mkUs.toList.map KUniv.toVLevel) :=
-    Ix.Tc.RecM.TrKExprS.const_name hmkHeadTr hmkName
+    Ix.Kernel.RecM.TrKExprS.const_name hmkHeadTr hmkName
   rw [hmkHead] at hmkShape
   subst majorWhnfV
 
@@ -837,4 +839,4 @@ theorem of_laws
       cases hrun
 
 end QuotientReductionReflection
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/Reducer.lean b/Ix/Kernel/Verify/Whnf/NoDelta/Reducer.lean
similarity index 94%
rename from Ix/Tc/Verify/Whnf/NoDelta/Reducer.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/Reducer.lean
index 5e09646ac..316335442 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/Reducer.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/Reducer.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.NoDelta.BaseReductions
+import Ix.Kernel.Verify.Whnf.NoDelta.BaseReductions
 
 /-!
 # Public no-delta reducer
@@ -10,7 +10,7 @@ and collision-robust cache writes.  This slice supplies those two concrete
 components to that shell.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Complete fixed-context input for the public no-delta reducer. -/
@@ -42,7 +42,7 @@ theorem wf
       trProj world support Delta flags)
     (mode : NatSuccMode) {source : KExpr .anon}
     (hsourceSupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF .noAccel (whnfCacheSemantics keys trProj fallback) trProj world
@@ -65,4 +65,4 @@ theorem wf
 
 end NoDeltaDriverContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/NoDelta/StringPrimitive.lean b/Ix/Kernel/Verify/Whnf/NoDelta/StringPrimitive.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/NoDelta/StringPrimitive.lean
rename to Ix/Kernel/Verify/Whnf/NoDelta/StringPrimitive.lean
index 99af60b5d..87d9413d8 100644
--- a/Ix/Tc/Verify/Whnf/NoDelta/StringPrimitive.lean
+++ b/Ix/Kernel/Verify/Whnf/NoDelta/StringPrimitive.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.NoDelta.ProjectionApplication
+import Ix.Kernel.Verify.Whnf.NoDelta.ProjectionApplication
 
 /-!
 # String primitive no-delta field
@@ -13,7 +13,7 @@ exact generated nodes.  Theory computation remains a deliberately narrow
 reflection boundary indexed by an observed successful production run.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Finite generated-node support for the String reducer.
 
@@ -75,7 +75,7 @@ structure StringReductionReflection (semantics : CacheSemantics)
     (support : RunSupport) : Prop where
   success : ∀ {uvars : Nat} {Delta : KVLCtx}
       {methods : Methods .anon} {source result : KExpr .anon}
-      {sourceV : Lean4Lean.VExpr} {s sf : TcState .anon},
+      {sourceV : Ix.Theory.Named.VExpr} {s sf : TcState .anon},
     Methods.WFAt .noAccel semantics trProj world support uvars methods →
     support source →
     TrKExprS world.venv uvars world.nameOf trProj Delta source sourceV →
@@ -281,4 +281,4 @@ theorem tryReduceString_optional_wf_of_reflection
         reflection.success hmethods hsourceSupport hsource hI hrun⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Projection/NoAccelTail.lean b/Ix/Kernel/Verify/Whnf/Projection/NoAccelTail.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Projection/NoAccelTail.lean
rename to Ix/Kernel/Verify/Whnf/Projection/NoAccelTail.lean
index 31ecac194..af1030ea3 100644
--- a/Ix/Tc/Verify/Whnf/Projection/NoAccelTail.lean
+++ b/Ix/Kernel/Verify/Whnf/Projection/NoAccelTail.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.VerifiedStep
+import Ix.Kernel.Verify.Whnf.Structural.VerifiedStep
 
 /-!
 # Concrete no-acceleration projection tail
@@ -13,7 +13,7 @@ Only String-literal construction/normalization and the installed lazy-ingress
 hook remain as explicit premises when the tail is composed below.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 namespace WhnfCoreInputSupport
@@ -267,4 +267,4 @@ theorem noAccel
 end ProjectionHelper
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Projection/StringCallback.lean b/Ix/Kernel/Verify/Whnf/Projection/StringCallback.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Projection/StringCallback.lean
rename to Ix/Kernel/Verify/Whnf/Projection/StringCallback.lean
index eab362128..8d3b1ffbc 100644
--- a/Ix/Tc/Verify/Whnf/Projection/StringCallback.lean
+++ b/Ix/Kernel/Verify/Whnf/Projection/StringCallback.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Projection.NoAccelTail
+import Ix.Kernel.Verify.Whnf.Projection.NoAccelTail
 
 /-!
 # Projection String callback closure
@@ -10,7 +10,7 @@ interned constructor expansion itself: finite support and structural
 translation of the exact generated term.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 attribute [local irreducible] whnfRec strLitToConstructor
@@ -82,4 +82,4 @@ theorem noAccelOfExpansion
 end ProjectionHelper
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Projection/StringExpansion.lean b/Ix/Kernel/Verify/Whnf/Projection/StringExpansion.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Projection/StringExpansion.lean
rename to Ix/Kernel/Verify/Whnf/Projection/StringExpansion.lean
index 1cc3a1b50..ad7a264f4 100644
--- a/Ix/Tc/Verify/Whnf/Projection/StringExpansion.lean
+++ b/Ix/Kernel/Verify/Whnf/Projection/StringExpansion.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Projection.StringCallback
+import Ix.Kernel.Verify.Whnf.Projection.StringCallback
 
 /-!
 # Finite String-constructor expansion plan
@@ -10,7 +10,7 @@ collisions are excluded on the run domain, and the final generated term has
 a structural Theory translation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 def stringCharConst (p : Primitives .anon) : KExpr .anon :=
@@ -376,4 +376,4 @@ theorem noAccelOfStringPlans
 end ProjectionHelper
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/README.md b/Ix/Kernel/Verify/Whnf/README.md
similarity index 97%
rename from Ix/Tc/Verify/Whnf/README.md
rename to Ix/Kernel/Verify/Whnf/README.md
index 5a8806528..f204baea5 100644
--- a/Ix/Tc/Verify/Whnf/README.md
+++ b/Ix/Kernel/Verify/Whnf/README.md
@@ -30,4 +30,4 @@ precise proof-dependency order needed by Lean.
   the boundary with the later `infer`/`isDefEq` closure work.
 
 The foundational semantic definitions remain in the sibling module
-`Ix.Tc.Verify.Whnf` (`../Whnf.lean`).
+`Ix.Kernel.Verify.Whnf` (`../Whnf.lean`).
diff --git a/Ix/Tc/Verify/Whnf/Runtime/LazyIngress.lean b/Ix/Kernel/Verify/Whnf/Runtime/LazyIngress.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/Runtime/LazyIngress.lean
rename to Ix/Kernel/Verify/Whnf/Runtime/LazyIngress.lean
index 568254423..99045d5ce 100644
--- a/Ix/Tc/Verify/Whnf/Runtime/LazyIngress.lean
+++ b/Ix/Kernel/Verify/Whnf/Runtime/LazyIngress.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Whnf.Projection.StringExpansion
-import Ix.Tc.Ingress
+import Ix.Kernel.Verify.Whnf.Projection.StringExpansion
+import Ix.Kernel.Ingress
 
 /-!
 # Concrete anonymous lazy-ingress refinement
@@ -17,7 +17,7 @@ frame.  A separate installed-hook premise identifies the otherwise arbitrary
 function stored in `TcState`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact environment facts needed after one lazy-ingress callback.
 
@@ -324,4 +324,4 @@ theorem noAccelOfAnonIngress
 
 end RecM.ProjectionHelper
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/RuntimeContracts.lean b/Ix/Kernel/Verify/Whnf/RuntimeContracts.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/RuntimeContracts.lean
rename to Ix/Kernel/Verify/Whnf/RuntimeContracts.lean
index 04bdf6ff3..47ae3bf13 100644
--- a/Ix/Tc/Verify/Whnf/RuntimeContracts.lean
+++ b/Ix/Kernel/Verify/Whnf/RuntimeContracts.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf
+import Ix.Kernel.Verify.Whnf
 
 /-!
 # Closing the remaining WHNF runtime contracts
@@ -8,7 +8,7 @@ for eagerly ingressed states and exposes the strictly smaller lazy-ingress
 obligation needed by the same proof in driver-backed states.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -432,4 +432,4 @@ end TransientNatWork
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/CallbackPrefix.lean b/Ix/Kernel/Verify/Whnf/StructEta/CallbackPrefix.lean
similarity index 96%
rename from Ix/Tc/Verify/Whnf/StructEta/CallbackPrefix.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/CallbackPrefix.lean
index d639f48a7..884b7be7f 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/CallbackPrefix.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/CallbackPrefix.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.Rebuild
+import Ix.Kernel.Verify.Whnf.StructEta.Rebuild
 
 /-!
 # Struct-eta callback-prefix preservation
@@ -11,7 +11,7 @@ full fixed-world invariant on success and error; they do not claim that a
 caught callback is state-pure.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -148,7 +148,7 @@ theorem inferOnlyRec_wf
     {uvars : Nat} {Delta : KVLCtx} {methods : Methods .anon}
     (hmethods :
       Methods.WFAt layer semantics trProj world support uvars methods)
-    {s : TcState .anon} {e : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {s : TcState .anon} {e : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : support e)
     (htr : TrKExprS world.venv uvars world.nameOf trProj Delta e sourceV) :
     TcM.WF (WhnfStateInv layer semantics trProj world support uvars Delta) s
@@ -168,7 +168,7 @@ theorem tryOptionalInferOnlyRec_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx}
-    {s : TcState .anon} {e : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {s : TcState .anon} {e : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : support e)
     (htr : TrKExprS world.venv uvars world.nameOf trProj Delta e sourceV) :
     RecM.WF layer semantics trProj world support uvars Delta s
@@ -196,7 +196,7 @@ theorem tryOptionalWhnfRec_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx}
-    {s : TcState .anon} {e : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {s : TcState .anon} {e : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     (hsource : support e)
     (htr : TrKExprS world.venv uvars world.nameOf trProj Delta e sourceV) :
     RecM.WF layer semantics trProj world support uvars Delta s
@@ -220,4 +220,4 @@ theorem tryOptionalWhnfRec_wf
     exact herror
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/Classifier.lean b/Ix/Kernel/Verify/Whnf/StructEta/Classifier.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/StructEta/Classifier.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/Classifier.lean
index 250da9a2e..bc4ef4452 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/Classifier.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/Classifier.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.RecursionClassifier
+import Ix.Kernel.Verify.Whnf.StructEta.RecursionClassifier
 
 /-!
 # Struct-eta classifier state closure
@@ -14,7 +14,7 @@ one constructor and no indices is not, by itself, a Theory proof of the
 struct-eta equation selected later in the reducer.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Exact typed/effect input for the recursor declaration instance scanned by
@@ -174,7 +174,7 @@ theorem tryStructEtaAfterInductive_wf
     (hfault : TcM.LazyFaultPreserves
       (WhnfStateInv layer semantics trProj world support uvars Delta))
     (hwrites : IsRecCacheWriteOracle semantics world support methods indId)
-    {majorV : Lean4Lean.VExpr}
+    {majorV : Ix.Theory.Named.VExpr}
     (hmajorSupport : support spine[recr.majorIdx]!)
     (hmajorTr : TrKExprS world.venv uvars world.nameOf trProj Delta
       spine[recr.majorIdx]! majorV)
@@ -345,7 +345,7 @@ theorem tryStructEtaIota_wf
     (hreferences : TrustedReferences world support)
     (hwrites : ∀ id, world.trusted id →
       IsRecCacheWriteOracle semantics world support methods id)
-    {majorV : Lean4Lean.VExpr}
+    {majorV : Ix.Theory.Named.VExpr}
     (hmajorSupport : support spine[recr.majorIdx]!)
     (hmajorTr : TrKExprS world.venv uvars world.nameOf trProj Delta
       spine[recr.majorIdx]! majorV)
@@ -363,4 +363,4 @@ theorem tryStructEtaIota_wf
     (hwrites indId htrusted) hmajorSupport hmajorTr hfinish
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/ExactMajorTelescope.lean b/Ix/Kernel/Verify/Whnf/StructEta/ExactMajorTelescope.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/StructEta/ExactMajorTelescope.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/ExactMajorTelescope.lean
index d05486bb5..f23a030ac 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/ExactMajorTelescope.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/ExactMajorTelescope.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.ScopedTelescope
+import Ix.Kernel.Verify.Whnf.StructEta.ScopedTelescope
 
 /-!
 # Exact major-premise telescope restoration
@@ -21,7 +21,7 @@ This module proves that fact from:
 No semantic state model is widened to admit the temporary telescope.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 /-- Exact state stack generated exclusively by successful `pushLocal`
 calls.  Unlike `ScratchLamExtension`, this relation retains the operational
@@ -249,4 +249,4 @@ theorem getMajorInductiveId_direct_exact
   exact scratch_tryFinally_ok bodyRun cleanup
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/Rebuild.lean b/Ix/Kernel/Verify/Whnf/StructEta/Rebuild.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/StructEta/Rebuild.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/Rebuild.lean
index dce3929fb..2af833370 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/Rebuild.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/Rebuild.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.StructEtaControl
+import Ix.Kernel.Verify.Whnf.Iota.StructEtaControl
 
 /-!
 # Finite struct-eta rebuild closure
@@ -15,7 +15,7 @@ that the selected recursor rule is a registered Theory equation or that raw
 projections have the required interpretation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Finite request certificate for the projection/application pairs generated
@@ -213,4 +213,4 @@ theorem acceptance_of_requests
 
 end StructEtaIotaSuccessTrace
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/RebuildRequests.lean b/Ix/Kernel/Verify/Whnf/StructEta/RebuildRequests.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/StructEta/RebuildRequests.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/RebuildRequests.lean
index 873c87405..c373b5fb9 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/RebuildRequests.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/RebuildRequests.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Iota.ApplicationRequests
+import Ix.Kernel.Verify.Whnf.Iota.ApplicationRequests
 
 /-!
 # Finite request closure for the struct-eta rebuild tail
@@ -12,7 +12,7 @@ recursor and spine.  The inference probes are derived from `Methods.WF`; only
 the helper-scan and recursion-cache authorities remain.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- The exact finite requests for one successful struct-eta H3 tail. -/
@@ -85,7 +85,7 @@ theorem of_components
     (hreferences : TrustedReferences world support)
     (hwrites : ∀ id, world.trusted id →
       IsRecCacheWriteOracle semantics world support methods id)
-    {majorV : Lean4Lean.VExpr}
+    {majorV : Ix.Theory.Named.VExpr}
     (hmajorSupport : support spine[recr.majorIdx]!)
     (hmajorTr : TrKExprS world.venv uvars world.nameOf trProj Delta
       spine[recr.majorIdx]! majorV) :
@@ -125,7 +125,7 @@ theorem tryIotaAfterMajorWhnf_state_wf_of_contexts
       IsRecCacheWriteOracle semantics world support methods id)
     {flags : WhnfFlags} {recId : KId .anon} {recr : IotaInfo .anon}
     {recUs : Array (KUniv .anon)} {spine : Array (KExpr .anon)}
-    {majorV : Lean4Lean.VExpr}
+    {majorV : Ix.Theory.Named.VExpr}
     (hmajorSupport : support spine[recr.majorIdx]!)
     (hmajorTr : TrKExprS world.venv uvars world.nameOf trProj Delta
       spine[recr.majorIdx]! majorV)
@@ -142,4 +142,4 @@ theorem tryIotaAfterMajorWhnf_state_wf_of_contexts
       hctorInputs hrecInputs hfault hreferences hwrites hmajorSupport hmajorTr)
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/RebuildTail.lean b/Ix/Kernel/Verify/Whnf/StructEta/RebuildTail.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/StructEta/RebuildTail.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/RebuildTail.lean
index 6eb618e19..ff2231721 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/RebuildTail.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/RebuildTail.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.Classifier
+import Ix.Kernel.Verify.Whnf.StructEta.Classifier
 
 /-!
 # Struct-eta universe and rebuild tail
@@ -10,7 +10,7 @@ invariant on success and partial-state error, and a successful RHS is rebuilt
 only through request-certified projection/application interning.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -148,4 +148,4 @@ theorem finishStructEtaAfterSort_wf_of_requests
     exact TcM.WF.pure fun _ => trivial
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/RecursionClassifier.lean b/Ix/Kernel/Verify/Whnf/StructEta/RecursionClassifier.lean
similarity index 99%
rename from Ix/Tc/Verify/Whnf/StructEta/RecursionClassifier.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/RecursionClassifier.lean
index ac04231ff..f667d6cac 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/RecursionClassifier.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/RecursionClassifier.lean
@@ -1,5 +1,5 @@
 import Init.Data.Range.Lemmas
-import Ix.Tc.Verify.Whnf.StructEta.ScopedClassifier
+import Ix.Kernel.Verify.Whnf.StructEta.ScopedClassifier
 
 /-!
 # Recursion-classifier and major-inductive helper effects
@@ -15,7 +15,7 @@ re-entrant eta.  Physical insertion alone is therefore not evidence that
 either Boolean is semantically valid.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -454,7 +454,7 @@ theorem getMajorInductiveId_wf
       TcM.LazyFaultPreserves
         (WhnfStateInv layer semantics trProj world support uvars Delta))
     (hreferences : TrustedReferences world support)
-    {Delta : KVLCtx} {recTy : KExpr .anon} {recTyV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {recTy : KExpr .anon} {recTyV : Ix.Theory.Named.VExpr}
     {s : TcState .anon} (skip : UInt64)
     (hrecSupport : support recTy)
     (hrecTr :
@@ -516,7 +516,7 @@ theorem getMajorInductiveId_trusted_wf
       TcM.LazyFaultPreserves
         (WhnfStateInv layer semantics trProj world support uvars Delta))
     (hreferences : TrustedReferences world support)
-    {Delta : KVLCtx} {recTy : KExpr .anon} {recTyV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {recTy : KExpr .anon} {recTyV : Ix.Theory.Named.VExpr}
     {s : TcState .anon} (skip : UInt64)
     (hrecSupport : support recTy)
     (hrecTr :
@@ -803,4 +803,4 @@ theorem computedIsRec_wf
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/ScopedClassifier.lean b/Ix/Kernel/Verify/Whnf/StructEta/ScopedClassifier.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/StructEta/ScopedClassifier.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/ScopedClassifier.lean
index 1e0a0fc13..b69bee7de 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/ScopedClassifier.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/ScopedClassifier.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.ScopedTelescope
+import Ix.Kernel.Verify.Whnf.StructEta.ScopedTelescope
 
 /-!
 # Scoped recursion-classifier steps
@@ -9,7 +9,7 @@ results and partial-error states before the complete classifier loop is
 assembled.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 def ScratchScopedForInStep
@@ -50,7 +50,7 @@ theorem scratch_computeIsRecParamStep_scoped
       Methods.WFAt layer semantics trProj world support uvars methods)
     (hinputs : ScratchTelescopeInputSupport support)
     {base : KVLCtx} {n : Nat} {current : KVLCtx}
-    {ty : KExpr .anon} {tyV : Lean4Lean.VExpr} {s : TcState .anon}
+    {ty : KExpr .anon} {tyV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hExtension : ScratchLamExtension base n current)
     (hsupport : support ty)
     (htr : TrKExprS world.venv uvars world.nameOf trProj current ty tyV)
@@ -122,7 +122,7 @@ theorem scratch_computeIsRecFieldStep_scoped
     (hinputs : ScratchTelescopeInputSupport support)
     {base : KVLCtx} {n : Nat} {current : KVLCtx}
     {blockAddrs : Array Address}
-    {ty : KExpr .anon} {tyV : Lean4Lean.VExpr} {s : TcState .anon}
+    {ty : KExpr .anon} {tyV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hExtension : ScratchLamExtension base n current)
     (hsupport : support ty)
     (htr : TrKExprS world.venv uvars world.nameOf trProj current ty tyV)
@@ -365,7 +365,7 @@ theorem scratch_computeIsRecCtorBody_scoped
       Methods.WFAt layer semantics trProj world support uvars methods)
     (hinputs : ScratchTelescopeInputSupport support)
     {base : KVLCtx} {ctorTy : KExpr .anon}
-    {ctorTyV : Lean4Lean.VExpr} {s : TcState .anon}
+    {ctorTyV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (nParams : Nat) (blockAddrs : Array Address)
     (hctorSupport : support ctorTy)
     (hctorTr :
@@ -443,7 +443,7 @@ theorem scratch_computeIsRecCtor_wf
       Methods.WFAt layer semantics trProj world support uvars methods)
     (hinputs : ScratchTelescopeInputSupport support)
     {Delta : KVLCtx} {ctorTy : KExpr .anon}
-    {ctorTyV : Lean4Lean.VExpr} {s : TcState .anon}
+    {ctorTyV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (nParams : Nat) (blockAddrs : Array Address)
     (hctorSupport : support ctorTy)
     (hctorTr :
@@ -488,4 +488,4 @@ theorem scratch_computeIsRecCtor_wf
       exact ⟨hFinal, trivial⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/StructEta/ScopedTelescope.lean b/Ix/Kernel/Verify/Whnf/StructEta/ScopedTelescope.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/StructEta/ScopedTelescope.lean
rename to Ix/Kernel/Verify/Whnf/StructEta/ScopedTelescope.lean
index 9931a5689..6d243c270 100644
--- a/Ix/Tc/Verify/Whnf/StructEta/ScopedTelescope.lean
+++ b/Ix/Kernel/Verify/Whnf/StructEta/ScopedTelescope.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.StructEta.CallbackPrefix
+import Ix.Kernel.Verify.Whnf.StructEta.CallbackPrefix
 
 /-!
 # Scoped telescope state
@@ -9,7 +9,7 @@ ambient WHNF state invariant while tracking the temporary lambda extension
 of the caller's context.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 theorem scratch_pushLocal_run
     {ty : KExpr .anon} {s s' : TcState .anon}
@@ -35,7 +35,7 @@ theorem scratch_pushLocal_inv
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s s' : TcState .anon}
-    {ty : KExpr .anon} {tyV : Lean4Lean.VExpr}
+    {ty : KExpr .anon} {tyV : Ix.Theory.Named.VExpr}
     (hI : WhnfStateInv layer semantics trProj world support uvars Delta s)
     (htr : TrKExprS world.venv uvars world.nameOf trProj Delta ty tyV)
     (htype : world.venv.IsType uvars Delta.toCtx tyV)
@@ -60,9 +60,9 @@ theorem scratch_pushLocal_inv
       simpa only [WhnfLayer.StateOK, hprims] using hI.2.2
 
 theorem scratch_lam_back
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
-    {s : TcState .anon} {Delta : KVLCtx} {tyV : Lean4Lean.VExpr}
+    {s : TcState .anon} {Delta : KVLCtx} {tyV : Ix.Theory.Named.VExpr}
     (h : CtxRecon env uvars nameOf trProj s
       ((none, .vlam tyV) :: Delta)) :
     s.letVals.back? = some none := by
@@ -75,9 +75,9 @@ theorem scratch_lam_back
     Array.getLast?_toList] using hhead
 
 theorem scratch_popLocal_run
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address → Option Lean.Name} {trProj : RawProjRel}
-    {s s' : TcState .anon} {Delta : KVLCtx} {tyV : Lean4Lean.VExpr}
+    {s s' : TcState .anon} {Delta : KVLCtx} {tyV : Ix.Theory.Named.VExpr}
     (hctxRecon : CtxRecon env uvars nameOf trProj s
       ((none, .vlam tyV) :: Delta))
     (hrun : TcM.popLocal s = .ok () s') :
@@ -104,7 +104,7 @@ theorem scratch_popLocal_inv
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s s' : TcState .anon}
-    {tyV : Lean4Lean.VExpr}
+    {tyV : Ix.Theory.Named.VExpr}
     (hI : WhnfStateInv layer semantics trProj world support uvars
       ((none, .vlam tyV) :: Delta) s)
     (hrun : TcM.popLocal s = .ok () s') :
@@ -128,7 +128,7 @@ theorem scratch_popLocal_inv
 
 inductive ScratchLamExtension (base : KVLCtx) : Nat → KVLCtx → Prop
   | zero : ScratchLamExtension base 0 base
-  | succ {n : Nat} {current : KVLCtx} {tyV : Lean4Lean.VExpr} :
+  | succ {n : Nat} {current : KVLCtx} {tyV : Ix.Theory.Named.VExpr} :
       ScratchLamExtension base n current →
       ScratchLamExtension base (n + 1) ((none, .vlam tyV) :: current)
 
@@ -581,7 +581,7 @@ theorem scratch_majorInductiveBody_scoped
       TcM.LazyFaultPreserves
         (WhnfStateInv layer semantics trProj world support uvars Delta))
     (hreferences : ScratchTrustedReferences world support)
-    {base : KVLCtx} {recTy : KExpr .anon} {recTyV : Lean4Lean.VExpr}
+    {base : KVLCtx} {recTy : KExpr .anon} {recTyV : Ix.Theory.Named.VExpr}
     {s : TcState .anon} (skip : UInt64)
     (hrecSupport : support recTy)
     (hrecTr : TrKExprS world.venv uvars world.nameOf trProj base recTy recTyV)
@@ -669,7 +669,7 @@ theorem scratch_getMajorInductiveId_wf
       TcM.LazyFaultPreserves
         (WhnfStateInv layer semantics trProj world support uvars Delta))
     (hreferences : ScratchTrustedReferences world support)
-    {Delta : KVLCtx} {recTy : KExpr .anon} {recTyV : Lean4Lean.VExpr}
+    {Delta : KVLCtx} {recTy : KExpr .anon} {recTyV : Ix.Theory.Named.VExpr}
     {s : TcState .anon} (skip : UInt64)
     (hrecSupport : support recTy)
     (hrecTr :
@@ -710,4 +710,4 @@ theorem scratch_getMajorInductiveId_wf
       exact ⟨hFinal, trivial⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/ApplicationCongruence.lean b/Ix/Kernel/Verify/Whnf/Structural/ApplicationCongruence.lean
similarity index 92%
rename from Ix/Tc/Verify/Whnf/Structural/ApplicationCongruence.lean
rename to Ix/Kernel/Verify/Whnf/Structural/ApplicationCongruence.lean
index 1778c5981..40fa133e3 100644
--- a/Ix/Tc/Verify/Whnf/Structural/ApplicationCongruence.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/ApplicationCongruence.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.ProjectionStep
+import Ix.Kernel.Verify.Whnf.Structural.ProjectionStep
 
 /-!
 # Changed-head application congruence
@@ -14,7 +14,7 @@ suffix.  A `FinishAppRequests` certificate then identifies the semantic
 left fold with the expression actually returned by `finishAppResult`.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 namespace TrAppSpine
@@ -23,10 +23,10 @@ namespace TrAppSpine
 suffix.  Unlike `headTr`, this keeps the chosen head translation connected to
 all argument typing derivations. -/
 theorem toSuffix
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head : KExpr .anon}
-    {args : List (KExpr .anon)} {resultV : Lean4Lean.VExpr}
+    {args : List (KExpr .anon)} {resultV : Ix.Theory.Named.VExpr}
     (h : TrAppSpine env uvars nameOf trProj Delta head args resultV) :
     exists headV,
       TrKExprS env uvars nameOf trProj Delta head headV /\
@@ -46,7 +46,7 @@ theorem applicationHeadCallbackWithSuffix_wf
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {f arg head : KExpr .anon} {info : ExprInfo .anon}
-    {args : Array (KExpr .anon)} {sourceV : Lean4Lean.VExpr}
+    {args : Array (KExpr .anon)} {sourceV : Ix.Theory.Named.VExpr}
     {flags : WhnfFlags}
     (hinputs : WhnfCoreInputSupport support)
     (hsupport : support (.app f arg info))
@@ -77,7 +77,7 @@ result. -/
 theorem appHeadRebuild
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Delta : KVLCtx} {source changed rebuilt : KExpr .anon}
-    {args : Array (KExpr .anon)} {sourceV headV : Lean4Lean.VExpr}
+    {args : Array (KExpr .anon)} {sourceV headV : Ix.Theory.Named.VExpr}
     {requests : List WalkerRequest}
     (hDelta : KVLCtx.WF world.venv uvars Delta)
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta source
@@ -99,4 +99,4 @@ theorem appHeadRebuild
 end WhnfMeaning
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/ApplicationRebuild.lean b/Ix/Kernel/Verify/Whnf/Structural/ApplicationRebuild.lean
similarity index 94%
rename from Ix/Tc/Verify/Whnf/Structural/ApplicationRebuild.lean
rename to Ix/Kernel/Verify/Whnf/Structural/ApplicationRebuild.lean
index 92a536dde..bcfb2c8a5 100644
--- a/Ix/Tc/Verify/Whnf/Structural/ApplicationRebuild.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/ApplicationRebuild.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.ApplicationCongruence
+import Ix.Kernel.Verify.Whnf.Structural.ApplicationCongruence
 
 /-!
 # Changed-head rebuild execution
@@ -10,7 +10,7 @@ head callback.  The guard keeps the obligation finite while covering the
 dynamic callback result rather than one hand-picked expression.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Finite request census for rebuilding the complete argument suffix after
@@ -39,7 +39,7 @@ theorem changedHeadFinish_acceptance
     {trProj : RawProjRel} {world : VerifyWorld} {uvars : Nat}
     {Delta : KVLCtx} {methods : Methods .anon} {s : TcState .anon}
     {f arg head changed : KExpr .anon} {info : ExprInfo .anon}
-    {args : Array (KExpr .anon)} {sourceV headV : Lean4Lean.VExpr}
+    {args : Array (KExpr .anon)} {sourceV headV : Ix.Theory.Named.VExpr}
     (hsourceSupport : support (.app f arg info))
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
       (.app f arg info) sourceV)
@@ -68,4 +68,4 @@ theorem changedHeadFinish_acceptance
     hrebuiltSupport, hmeaning⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/ApplicationStep.lean b/Ix/Kernel/Verify/Whnf/Structural/ApplicationStep.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Structural/ApplicationStep.lean
rename to Ix/Kernel/Verify/Whnf/Structural/ApplicationStep.lean
index 2e0af9769..5688fd2c8 100644
--- a/Ix/Tc/Verify/Whnf/Structural/ApplicationStep.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/ApplicationStep.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.BetaBoundary
+import Ix.Kernel.Verify.Whnf.Structural.BetaBoundary
 
 /-!
 # Exhaustive application-step closure
@@ -14,7 +14,7 @@ It uses the run's collision-freedom certificate over the supported callback
 result and original head before rewriting the callback equation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Every outcome of the production application branch satisfies the local
@@ -118,4 +118,4 @@ theorem whnfCoreWithFlagsStep_app_wf
       | str => exact hnonLambda .str hI
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/ApplicationTails.lean b/Ix/Kernel/Verify/Whnf/Structural/ApplicationTails.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Structural/ApplicationTails.lean
rename to Ix/Kernel/Verify/Whnf/Structural/ApplicationTails.lean
index 669994afe..4127fe455 100644
--- a/Ix/Tc/Verify/Whnf/Structural/ApplicationTails.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/ApplicationTails.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.ApplicationRebuild
+import Ix.Kernel.Verify.Whnf.Structural.ApplicationRebuild
 
 /-!
 # Non-beta application tails
@@ -11,7 +11,7 @@ invokes iota on that rebuilt source.  In both cases the ordinary
 error states.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Generic unchanged-head/iota-hit equation.  The older specialized theorem
@@ -62,7 +62,7 @@ theorem whnfCoreWithFlagsStep_appUnchanged_wf
     (hmethods :
       Methods.WFAt layer semantics trProj world support uvars methods)
     (hsourceSupport : support (.app f arg info))
-    {sourceV : Lean4Lean.VExpr}
+    {sourceV : Ix.Theory.Named.VExpr}
     (hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
       (.app f arg info) sourceV)
     (hspine : (.app f arg info : KExpr .anon).collectSpine = (head, args))
@@ -112,7 +112,7 @@ theorem whnfCoreWithFlagsStep_appChanged_wf
     {Delta : KVLCtx} {methods : Methods .anon}
     {s s1 : TcState .anon} {f arg head changed : KExpr .anon}
     {info : ExprInfo .anon} {args : Array (KExpr .anon)}
-    {sourceV headV : Lean4Lean.VExpr} {flags : WhnfFlags}
+    {sourceV headV : Ix.Theory.Named.VExpr} {flags : WhnfFlags}
     (theory : WhnfTheory trProj world uvars)
     (hiota : OptionalReduction.WF layer semantics trProj world support
       (fun source => tryIotaWithFlags source flags))
@@ -165,4 +165,4 @@ theorem whnfCoreWithFlagsStep_appChanged_wf
       exact ⟨hiotaPost.1, hiotaPost.2.1, hmeaning⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/BasicStep.lean b/Ix/Kernel/Verify/Whnf/Structural/BasicStep.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Structural/BasicStep.lean
rename to Ix/Kernel/Verify/Whnf/Structural/BasicStep.lean
index 7243dc066..f9d33dd5c 100644
--- a/Ix/Tc/Verify/Whnf/Structural/BasicStep.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/BasicStep.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.CacheShell
+import Ix.Kernel.Verify.Whnf.Structural.CacheShell
 
 /-!
 # Basic structural-step closure
@@ -14,7 +14,7 @@ stack, and within the current weakening bound.  Naming this state obligation
 prevents a translated-but-stale local value from being accepted silently.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Runtime safety needed by production's unchanged let-fvar return.  This
@@ -161,4 +161,4 @@ theorem whnfCoreWithFlagsStep_basic_wf
   | letE => exact whnfCoreWithFlagsStep_letE_wf hrun hcensus theory
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/BetaBoundary.lean b/Ix/Kernel/Verify/Whnf/Structural/BetaBoundary.lean
similarity index 96%
rename from Ix/Tc/Verify/Whnf/Structural/BetaBoundary.lean
rename to Ix/Kernel/Verify/Whnf/Structural/BetaBoundary.lean
index 39c32284a..5c86dcf30 100644
--- a/Ix/Tc/Verify/Whnf/Structural/BetaBoundary.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/BetaBoundary.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.ApplicationTails
+import Ix.Kernel.Verify.Whnf.Structural.ApplicationTails
 
 /-!
 # General beta branch boundary and execution
@@ -15,7 +15,7 @@ the substitution bounds to the final certified rebuild.  No state effect,
 support fact, or production execution is hidden in that interface.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Finite request census for every dynamic multi-beta branch reachable from
@@ -50,7 +50,7 @@ def BetaManyMeaningOracle (trProj : RawProjRel) (world : VerifyWorld) : Prop :=
       {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
       {ty body body0 : KExpr .anon} {lamInfo : ExprInfo .anon}
       {consumed : Array (KExpr .anon)} {result : KExpr .anon}
-      {sourceV headV : Lean4Lean.VExpr},
+      {sourceV headV : Ix.Theory.Named.VExpr},
     KVLCtx.WF world.venv uvars Delta ->
     TrKExprS world.venv uvars world.nameOf trProj Delta
       (.app f arg info) sourceV ->
@@ -82,7 +82,7 @@ theorem whnfCoreWithFlagsStep_appBeta_wf
     {info : ExprInfo .anon} {args : Array (KExpr .anon)}
     {name : Mode.anon.F Name} {bi : Mode.anon.F Lean.BinderInfo}
     {ty body body0 : KExpr .anon} {lamInfo : ExprInfo .anon}
-    {consumed : Array (KExpr .anon)} {sourceV headV : Lean4Lean.VExpr}
+    {consumed : Array (KExpr .anon)} {sourceV headV : Ix.Theory.Named.VExpr}
     {flags : WhnfFlags}
     (theory : WhnfTheory trProj world uvars)
     (hmeaning : BetaManyMeaningOracle trProj world)
@@ -125,4 +125,4 @@ theorem whnfCoreWithFlagsStep_appBeta_wf
   exact ⟨hI3, hresultSupport, hresultMeaning⟩
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/CacheShell.lean b/Ix/Kernel/Verify/Whnf/Structural/CacheShell.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Structural/CacheShell.lean
rename to Ix/Kernel/Verify/Whnf/Structural/CacheShell.lean
index 7a43392c4..776a977ca 100644
--- a/Ix/Tc/Verify/Whnf/Structural/CacheShell.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/CacheShell.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Whnf.StructEta.RebuildTail
-import Ix.Tc.Verify.Suffix
+import Ix.Kernel.Verify.Whnf.StructEta.RebuildTail
+import Ix.Kernel.Verify.Suffix
 
 /-!
 # Structural-core cache shell
@@ -17,7 +17,7 @@ constructed, this file turns it into the complete public
 Nat bypass, and the legacy-variable prefix.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace RecM
 
@@ -125,7 +125,7 @@ theorem whnfCoreWithFlagsNonLeaf_wf
       stepError)
     (hwrites : WhnfCoreCacheWriteOracle keys trProj fallback world support)
     (hsupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF layer (whnfCacheSemantics keys trProj fallback) trProj world
@@ -275,7 +275,7 @@ theorem whnfCoreWithFlags_wf
       stepError)
     (hwrites : WhnfCoreCacheWriteOracle keys trProj fallback world support)
     (hsupport : support source)
-    {sourceV : Lean4Lean.VExpr} {s : TcState .anon}
+    {sourceV : Ix.Theory.Named.VExpr} {s : TcState .anon}
     (hsource : TrKExprS world.venv keys.uvars world.nameOf trProj Delta source
       sourceV) :
     RecM.WF layer (whnfCacheSemantics keys trProj fallback) trProj world
@@ -389,4 +389,4 @@ theorem coreCacheWriteOracle
 
 end WhnfSuffixModel
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/ProjectionStep.lean b/Ix/Kernel/Verify/Whnf/Structural/ProjectionStep.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Structural/ProjectionStep.lean
rename to Ix/Kernel/Verify/Whnf/Structural/ProjectionStep.lean
index c717b7bdb..5cb237693 100644
--- a/Ix/Tc/Verify/Whnf/Structural/ProjectionStep.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/ProjectionStep.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.RecursiveCallbacks
+import Ix.Kernel.Verify.Whnf.Structural.RecursiveCallbacks
 
 /-!
 # Exhaustive projection-step closure
@@ -18,7 +18,7 @@ with `InductiveReductionOracle`; a syntax-directed helper execution alone is
 not treated as a Theory projection equation.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 namespace ProjectionHelper
@@ -152,4 +152,4 @@ theorem whnfCoreWithFlagsStep_basicVarProjection_wf
         horacle
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/RecursiveCallbacks.lean b/Ix/Kernel/Verify/Whnf/Structural/RecursiveCallbacks.lean
similarity index 93%
rename from Ix/Tc/Verify/Whnf/Structural/RecursiveCallbacks.lean
rename to Ix/Kernel/Verify/Whnf/Structural/RecursiveCallbacks.lean
index 708bcf076..cac2111cc 100644
--- a/Ix/Tc/Verify/Whnf/Structural/RecursiveCallbacks.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/RecursiveCallbacks.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.VariableStep
+import Ix.Kernel.Verify.Whnf.Structural.VariableStep
 
 /-!
 # Structural recursive-callback closure
@@ -16,7 +16,7 @@ only a support boundary; semantic translation of each child is derived from
 the translated parent.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Finite support closure needed by one structural-WHNF iteration.  The app
@@ -38,7 +38,7 @@ theorem whnfCoreFlagsRec_wf
     {layer : WhnfLayer} {semantics : CacheSemantics}
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
-    {source : KExpr .anon} {sourceV : Lean4Lean.VExpr}
+    {source : KExpr .anon} {sourceV : Ix.Theory.Named.VExpr}
     {flags : WhnfFlags}
     (hsource : support source)
     (htr : TrKExprS world.venv uvars world.nameOf trProj Delta source
@@ -55,10 +55,10 @@ namespace TrAppSpine
 
 /-- A typed application spine retains the translation of its raw head. -/
 theorem headTr
-    {env : Lean4Lean.VEnv} {uvars : Nat}
+    {env : Ix.Theory.Named.VEnv} {uvars : Nat}
     {nameOf : Address -> Option Lean.Name} {trProj : RawProjRel}
     {Delta : KVLCtx} {head : KExpr .anon}
-    {args : List (KExpr .anon)} {resultV : Lean4Lean.VExpr}
+    {args : List (KExpr .anon)} {resultV : Ix.Theory.Named.VExpr}
     (h : TrAppSpine env uvars nameOf trProj Delta head args resultV) :
     exists headV,
       TrKExprS env uvars nameOf trProj Delta head headV := by
@@ -76,7 +76,7 @@ theorem projectionValueCallback_wf
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {id : KId .anon} {field : UInt64} {value : KExpr .anon}
-    {info : ExprInfo .anon} {sourceV : Lean4Lean.VExpr}
+    {info : ExprInfo .anon} {sourceV : Ix.Theory.Named.VExpr}
     {flags : WhnfFlags}
     (hinputs : WhnfCoreInputSupport support)
     (hsupport : support (.prj id field value info))
@@ -109,7 +109,7 @@ theorem applicationHeadCallback_wf
     {trProj : RawProjRel} {world : VerifyWorld} {support : RunSupport}
     {uvars : Nat} {Delta : KVLCtx} {s : TcState .anon}
     {f arg head : KExpr .anon} {info : ExprInfo .anon}
-    {args : Array (KExpr .anon)} {sourceV : Lean4Lean.VExpr}
+    {args : Array (KExpr .anon)} {sourceV : Ix.Theory.Named.VExpr}
     {flags : WhnfFlags}
     (hinputs : WhnfCoreInputSupport support)
     (hsupport : support (.app f arg info))
@@ -142,4 +142,4 @@ theorem applicationArgument_support
   (hinputs.app hsupport hspine).2 child hmem
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/Reducer.lean b/Ix/Kernel/Verify/Whnf/Structural/Reducer.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Structural/Reducer.lean
rename to Ix/Kernel/Verify/Whnf/Structural/Reducer.lean
index adc6d8fce..d4e432ab8 100644
--- a/Ix/Tc/Verify/Whnf/Structural/Reducer.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/Reducer.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Verify.Whnf.Structural.VerifiedStep
-import Ix.Tc.Verify.Whnf.Iota.OptionalReduction
+import Ix.Kernel.Verify.Whnf.Structural.VerifiedStep
+import Ix.Kernel.Verify.Whnf.Iota.OptionalReduction
 
 /-!
 # Construct the structural reducer
@@ -16,7 +16,7 @@ state/semantic composition rather than a free `OptionalReduction.WF`
 parameter.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Complete fixed-context input for the production structural reducer.
@@ -115,4 +115,4 @@ theorem wf
 
 end StructuralCoreContext
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/StepAssembly.lean b/Ix/Kernel/Verify/Whnf/Structural/StepAssembly.lean
similarity index 97%
rename from Ix/Tc/Verify/Whnf/Structural/StepAssembly.lean
rename to Ix/Kernel/Verify/Whnf/Structural/StepAssembly.lean
index cfdd1b8f5..34a187746 100644
--- a/Ix/Tc/Verify/Whnf/Structural/StepAssembly.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/StepAssembly.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.ApplicationStep
+import Ix.Kernel.Verify.Whnf.Structural.ApplicationStep
 
 /-!
 # Exhaustive structural-step assembly
@@ -8,7 +8,7 @@ the single local `WhnfStep.WF` consumed by the already verified bounded loop
 and cache shell; no syntax branch remains implicit in a classifier premise.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Exhaustive contract for one actual `whnfCoreWithFlagsStep` iteration. -/
@@ -82,4 +82,4 @@ theorem whnfCoreWithFlagsStep_wf
         (.basicVar (.basic (.leaf .str))) s hsource
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/VariableStep.lean b/Ix/Kernel/Verify/Whnf/Structural/VariableStep.lean
similarity index 98%
rename from Ix/Tc/Verify/Whnf/Structural/VariableStep.lean
rename to Ix/Kernel/Verify/Whnf/Structural/VariableStep.lean
index e81b293f5..e4211a760 100644
--- a/Ix/Tc/Verify/Whnf/Structural/VariableStep.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/VariableStep.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Structural.BasicStep
+import Ix.Kernel.Verify.Whnf.Structural.BasicStep
 
 /-!
 # Legacy-variable structural-step closure
@@ -11,7 +11,7 @@ those walker-tight bounds to the semantic context without introducing the
 older, stronger `Δ.bvars + val.size` assumption.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 namespace TcM
 
@@ -56,7 +56,7 @@ theorem zetaVar_liftBounds
     world.venvWF.ordered htp hidx hshift hty hov hcon hcut hlift
   have hsource : TrKExprS world.venv uvars world.nameOf trProj Delta
       (.var idx name info) e := .var hfind
-  have hwf : Lean4Lean.VExpr.WF world.venv uvars Delta.toCtx e :=
+  have hwf : Ix.Theory.Named.VExpr.WF world.venv uvars Delta.toCtx e :=
     ⟨A, hctx.wf.find?_wf world.venvWF.ordered hfind⟩
   exact ⟨e, e, hsource, hresult, hwf⟩
 
@@ -192,4 +192,4 @@ theorem whnfCoreWithFlagsStep_basicVar_wf
       exact whnfCoreWithFlagsStep_var_wf hrun theory hvar
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/Whnf/Structural/VerifiedStep.lean b/Ix/Kernel/Verify/Whnf/Structural/VerifiedStep.lean
similarity index 96%
rename from Ix/Tc/Verify/Whnf/Structural/VerifiedStep.lean
rename to Ix/Kernel/Verify/Whnf/Structural/VerifiedStep.lean
index 0263c3dd0..44ef665bf 100644
--- a/Ix/Tc/Verify/Whnf/Structural/VerifiedStep.lean
+++ b/Ix/Kernel/Verify/Whnf/Structural/VerifiedStep.lean
@@ -1,4 +1,4 @@
-import Ix.Tc.Verify.Whnf.Beta.Meaning
+import Ix.Kernel.Verify.Whnf.Beta.Meaning
 
 /-!
 # Structural step without a beta oracle
@@ -9,7 +9,7 @@ Theory and translation invariants, so the production structural step can now
 be exposed with only its genuine helper and finite-run boundaries.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 namespace RecM
 
 /-- Exhaustive `whnfCoreWithFlagsStep` closure with general multi-beta proved
@@ -41,4 +41,4 @@ theorem whnfCoreWithFlagsStep_constructive_wf
     hinputs hprojection hinductive (betaManyMeaning trProj world) hiota
 
 end RecM
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Verify/World.lean b/Ix/Kernel/Verify/World.lean
similarity index 98%
rename from Ix/Tc/Verify/World.lean
rename to Ix/Kernel/Verify/World.lean
index f5cad0701..3876b7358 100644
--- a/Ix/Tc/Verify/World.lean
+++ b/Ix/Kernel/Verify/World.lean
@@ -1,5 +1,5 @@
-import Ix.Tc.Env
-import Lean4Lean.Theory.Typing.Env
+import Ix.Kernel.Env
+import Ix.Theory.Named.Typing.Env
 
 /-!
 # Non-circular verification worlds
@@ -13,7 +13,7 @@ whole-`KEnv` relation conflates:
   assigned to each coordinated checker block;
 * `VerifyWorld.trusted`: the ghost index intended to track declarations
   already admitted to the semantic world;
-* `VerifyWorld.venv`: the well-formed Lean4Lean environment for that trusted
+* `VerifyWorld.venv`: the well-formed Ix.Theory.Named environment for that trusted
   world;
 * `LoadedAgrees`: the one-way relation from the concrete lazy-load cache to
   the catalog.
@@ -32,9 +32,9 @@ constants through `TrustedConstRel`. The legacy `TrKEnv` remains only as a
 quarantined compatibility proof interface.
 -/
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
-open Lean4Lean (VEnv)
+open Ix.Theory.Named (VEnv)
 
 /-- Immutable ghost input.  A catalog entry says which concrete declaration
 is committed at an id; it says nothing about that declaration's typing. -/
@@ -356,4 +356,4 @@ theorem VerifyWorld.ofCatalog_loaded_not_trusted {catalog : Catalog}
 
 end CataloguedLoaded
 
-end Ix.Tc
+end Ix.Kernel
diff --git a/Ix/Tc/Whnf.lean b/Ix/Kernel/Whnf.lean
similarity index 99%
rename from Ix/Tc/Whnf.lean
rename to Ix/Kernel/Whnf.lean
index 871e07457..d74511c4f 100644
--- a/Ix/Tc/Whnf.lean
+++ b/Ix/Kernel/Whnf.lean
@@ -1,6 +1,6 @@
 module
 
-public import Ix.Tc.Monad
+public import Ix.Kernel.Monad
 
 /-!
 Mirror: crates/kernel/src/whnf.rs (plus `str_lit_to_constructor` from
@@ -35,7 +35,7 @@ which otherwise descend into Nat.rec towers and trip maxDefEqDepth).
 public section
 @[expose] section
 
-namespace Ix.Tc
+namespace Ix.Kernel
 
 open Std (HashMap HashSet)
 
@@ -90,7 +90,7 @@ def KConst.iotaCtorInfo? : KConst m → Option (Nat × Nat)
   | _ => none
 
 /-- Nat value from a literal or the `Nat.zero` constructor (C++
-    `is_nat_lit_ext` / lean4lean `rawNatLitExt?`). -/
+    `is_nat_lit_ext` / the named specification `rawNatLitExt?`). -/
 def extractNatLit (e : KExpr m) (prims : Primitives m) : Option Nat :=
   match e with
   | .nat val _ _ => some val
@@ -121,7 +121,7 @@ def computeNatBin (addr : Address) (p : PrimAddrs) (a b : Nat) : Option Nat :=
   else if addr == p.natDiv then some (if b == 0 then 0 else a / b)
   else if addr == p.natMod then some (if b == 0 then a else a % b)
   else if addr == p.natPow then
-    -- Matches C++ `ReducePowMaxExp` / lean4lean `reducePowMaxExp`.
+    -- Matches C++ `ReducePowMaxExp` / the named specification `reducePowMaxExp`.
     if b ≤ 16777216 then some (a ^ b) else none
   else if addr == p.natGcd then some (Nat.gcd a b)
   else if addr == p.natLand then some (a &&& b)
@@ -174,7 +174,7 @@ namespace RecM
 Spelled with `tryCatch` and `pure` rather than `try`/`catch` with `return`:
 a `return` inside a `try` block elaborates through the early-return
 transformer, burying the plain `EStateM.tryCatch` this reduces to and that
-`Ix/Tc/Verify/Whnf/Iota/ConstructorSynthesis.lean` reasons about. Both
+`Ix/Kernel/Verify/Whnf/Iota/ConstructorSynthesis.lean` reasons about. Both
 spellings denote the same function. -/
 @[inline] def try? (x : RecM m α) : RecM m (Option α) :=
   tryCatch (do let a ← x; pure (some a)) (fun _ => pure none)
@@ -240,7 +240,7 @@ def strLitListToConstructor (charOfNat cons : KExpr m) :
 /-- `"abc" → String.ofList (List.cons (Char.ofNat 97) … List.nil)` — the
     kernel's string-literal constructor expansion (def_eq.rs
     `str_lit_to_constructor`; `Char.ofNat` + `String.ofList`, matching
-    lean4lean / C++). -/
+    the named specification / C++). -/
 def strLitToConstructor (s : String) : RecM m (KExpr m) := do
   let p ← prims
   let charConst ← TcM.intern (.mkConst p.charType #[])
@@ -488,7 +488,7 @@ def tryApplyIotaCtor (recr : IotaInfo m) (recUs : Array (KUniv m))
     (spine ctorArgs : Array (KExpr m)) (cidx ctorFields : Nat)
     (transient : Bool) : RecM m (Option (KExpr m)) := do
   let some rule := recr.rules[cidx]? | return none
-  -- H6: level arity; H5: fields ≤ ctor args (lean4lean Reduce.lean:75-76).
+  -- H6: level arity; H5: fields ≤ ctor args (the named specification Reduce.lean:75-76).
   if recUs.size.toUInt64 != recr.lvls then
     return none
   if ctorFields > ctorArgs.size then
@@ -789,7 +789,7 @@ def whnfWithNatSuccModeStep (natSuccMode : NatSuccMode)
   if seen.contains cur.addr then
     return .done cur
   let seen := seen.insert cur.addr
-  -- Native reduction runs before nat reduction (lean4lean order).
+  -- Native reduction runs before nat reduction (the named specification order).
   if let some reduced ← tryReduceNative cur then
     return .next (reduced, seen)
   if let some reduced ← tryReduceBitvec cur then
@@ -919,7 +919,7 @@ def whnfCoreWithFlagsStep (cur : KExpr m) (flags : WhnfFlags) :
       | some val => return .next val
       | none => return .done cur
     | .fvar id _ _ =>
-      -- Let-bound fvar zeta-reduction (lean4lean `whnfFVar`).
+      -- Let-bound fvar zeta-reduction (the named specification `whnfFVar`).
       match (← get).lctx.find? id with
       | some (.ldecl _ _ val) => return .next val
       | _ => return .done cur
@@ -1193,7 +1193,7 @@ def tryStructEtaAfterInductive (recUs : Array (KUniv m))
 
 /-- Struct-eta iota: single-rule recursor over a non-recursive one-ctor
     zero-index inductive; rebuild the rule with projections of the major.
-    Prop-typed majors are excluded (lean4lean `toCtorWhenStruct`). -/
+    Prop-typed majors are excluded (the named specification `toCtorWhenStruct`). -/
 def tryStructEtaIota (recId : KId m) (recr : IotaInfo m)
     (recUs : Array (KUniv m)) (spine : Array (KExpr m)) :
     RecM m (Option (KExpr m)) := do
@@ -1973,7 +1973,7 @@ def tryReduceNative (e : KExpr m) : RecM m (Option (KExpr m)) := do
     tryReduceNativeMarker p isReduceBool argId argUs
 
 -- ### `is_rec` verification (inductive.rs `computed_is_rec` — hosted here
--- because struct-likeness needs it; `Ix.Tc.Inductive` reuses it)
+-- because struct-likeness needs it; `Ix.Kernel.Inductive` reuses it)
 
 /-- Finish one constructor-parameter peel after the recursive WHNF callback.
 Naming the post-callback seam keeps the binder mutation equation stable for
@@ -2106,7 +2106,7 @@ attribute [irreducible] tryProjPrepare tryProjReduce
 
 end RecM
 
-end Ix.Tc
+end Ix.Kernel
 
 end
 end
diff --git a/Ix/MultiStark/SystemDeserialize.lean b/Ix/MultiStark/SystemDeserialize.lean
index ee65c7670..51bed17cd 100644
--- a/Ix/MultiStark/SystemDeserialize.lean
+++ b/Ix/MultiStark/SystemDeserialize.lean
@@ -10,7 +10,7 @@ public import Ix.MultiStark.Deserialize
 Aiur port of `crates/aiur/src/vk_codec.rs` — reconstructs the verifier's
 `System<AiurConfig>` from the bytes the prover places on the IO channel.
 
-Wire format (v3, mirrors `vk_codec.rs` — see its module docs for the full
+Wire format (v5, mirrors `vk_codec.rs` — see its module docs for the full
 layout). The multi-stark constraint-IR migration replaced the per-circuit
 *symbolic* AIR (`SymbolicExpression` trees + `LookupAir`) with a *compiled*
 flat base-field node graph, so this reader parses that compiled form:
@@ -75,10 +75,10 @@ def systemDeserialize := ⟦
     Neg(G)
   }
 
-  -- A compiled circuit: the flat node vector, its length, the constraint-root
-  -- NodeIds (`zeros`), and the maximum constraint degree (for the quotient
-  -- degree). The lookups are omitted — their constraints are compiled into
-  -- `zeros`, so the verifier never needs them.
+  -- A compiled circuit retains the flat node vector, its length, user
+  -- constraint-root NodeIds (`zeros`), the combined maximum degree, lookups
+  -- and their group size. The verifier evaluates logUp directly after the
+  -- user roots; logUp constraints are not compiled into `zeros`.
   -- A compiled lookup: multiplicity node id + argument node ids (all into
   -- the graph's lookup prefix). Drives the direct logUp evaluation.
   enum SysLookup { Mk(G, List‹G›) }
diff --git a/Ix/Tc.lean b/Ix/Tc.lean
deleted file mode 100644
index 3f0962a55..000000000
--- a/Ix/Tc.lean
+++ /dev/null
@@ -1,54 +0,0 @@
-module
-
-public import Ix.Tc.Mode
-public import Ix.Tc.Id
-public import Ix.Tc.Level
-public import Ix.Tc.Expr
-public import Ix.Tc.Error
-public import Ix.Tc.Const
-public import Ix.Tc.Equiv
-public import Ix.Tc.Env
-public import Ix.Tc.Primitive
-public import Ix.Tc.Subst
-public import Ix.Tc.Lctx
-public import Ix.Tc.Monad
-public import Ix.Tc.Ingress
-public import Ix.Tc.IngressMeta
-public import Ix.Tc.Egress
-public import Ix.Tc.EgressLean
-public import Ix.Tc.Driver
-public import Ix.Tc.ParCheck
-public import Ix.Tc.Validate
-public import Ix.Tc.Whnf
-public import Ix.Tc.Infer
-public import Ix.Tc.DefEq
-public import Ix.Tc.Knot
-public import Ix.Tc.CanonicalCheck
-public import Ix.Tc.Inductive
-public import Ix.Tc.Check
-
-/-!
-# Ix.Tc — pure-Lean Ix kernel over Ixon
-
-A correctness-first, formalizable port of the Rust Ix kernel
-(`crates/kernel`), operating over the Ixon content-addressed format with
-separated anon and meta modes. Designed for correctness and formalization;
-for performance, use the Rust kernel.
-
-Module map (mirrors `crates/kernel/src/` file-for-file):
-
-| Lean module       | Rust source    |
-|-------------------|----------------|
-| `Ix.Tc.Mode`      | `mode.rs`      |
-| `Ix.Tc.Id`        | `id.rs`        |
-| `Ix.Tc.Error`     | `error.rs`     |
-| `Ix.Tc.Level`     | `level.rs`     |
-| `Ix.Tc.Expr`      | `expr.rs`      |
-| `Ix.Tc.Const`     | `constant.rs`  |
-| `Ix.Tc.Equiv`     | `equiv.rs`     |
-| `Ix.Tc.Env`       | `env.rs`       |
-| `Ix.Tc.Primitive` | `primitive.rs` |
-| `Ix.Tc.Subst`     | `subst.rs`     |
-| `Ix.Tc.Lctx`      | `lctx.rs`      |
-| `Ix.Tc.Monad`     | `tc.rs`        |
--/
diff --git a/Ix/Theory.lean b/Ix/Theory.lean
new file mode 100644
index 000000000..8687dd69f
--- /dev/null
+++ b/Ix/Theory.lean
@@ -0,0 +1,6 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified
diff --git a/Ix/Theory/Certificate/Build.lean b/Ix/Theory/Certificate/Build.lean
new file mode 100644
index 000000000..a8adb93e0
--- /dev/null
+++ b/Ix/Theory/Certificate/Build.lean
@@ -0,0 +1,211 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.OrdinarySource
+import Ix.Theory.Certificate.Standard
+import Ix.Theory.Certificate.Quotient
+import Ix.Theory.Certificate.Structure
+import Ix.Theory.Certificate.Modeled
+import Ix.Theory.Certified.Accept
+
+namespace Ix.Theory.Certificate
+
+open Model Certified
+
+universe u
+variable {β : Type u} [DecidableEq β]
+variable [Hints β]
+
+def hasLiteral : VExpr β → Bool
+  | .natLit _ => true
+  | .app a b | .lam a b | .forallE a b => hasLiteral a || hasLiteral b
+  | .proj _ _ e => hasLiteral e
+  | _ => false
+
+def constantHasLiteral : Const β → Bool
+  | .defn _ _ type body _ => hasLiteral type || hasLiteral body
+  | .induct _ _ _ type ctors _ => hasLiteral type || ctors.any (hasLiteral ·.type)
+  | .recursor _ _ _ _ _ type rules _ _ => hasLiteral type || rules.any (hasLiteral ·.rhs)
+  | .axiom _ type _ | .quot _ _ type => hasLiteral type
+
+def literalDependencies? (natural : Option (ConstRef β)) (used : Bool) : Option (List (ConstRef β)) :=
+  if used then natural.map (fun r => [r]) else some []
+
+inductive DeclarationSource (β : Type u) where
+  | definition (ref : ConstRef β)
+  | ordinary (source recursor : β)
+  | standard (ref : ConstRef β)
+  | quotient (refs : Certified.Quotient.Refs β)
+  | modeled (candidate : Modeled.Candidate β)
+
+structure SourceGroup (β : Type u) where
+  declaration : DeclarationSource β
+  references : List (ConstRef β)
+  dependencies : List (ConstRef β)
+
+def recursorFamily? : VExpr β → Option β
+  | .forallE _ (.forallE A B) => recursorFamily? (.forallE A B)
+  | .forallE A _ => match A.appHead with
+    | .const (.member source 0) _ => some source
+    | _ => none
+  | _ => none
+
+def findRecursor? (store : Store β) (source : β) : Option β :=
+  store.dom.find? fun candidate => match store.blocks candidate with
+    | some ⟨[.recursor _ _ _ _ _ type _ _ .safe]⟩ => recursorFamily? type == some source
+    | _ => false
+
+def ordinaryGroup? (store : Store β) (source recursor : β)
+    (natural : Option (ConstRef β) := none) : Option (SourceGroup β) := do
+  let ⟨[family@(.induct _ _ _ _ ctors .safe)]⟩ ← store.blocks source | none
+  let ⟨[recr@(.recursor _ _ _ _ _ _ _ _ .safe)]⟩ ← store.blocks recursor | none
+  let references := [.member source 0, .member recursor 0] ++
+    (List.range ctors.length).map (.ctor source 0 ·)
+  let literals ← literalDependencies? natural (constantHasLiteral family || constantHasLiteral recr)
+  return ⟨.ordinary source recursor, references,
+    ((family.refs ++ recr.refs).filter fun r => !references.contains r) ++ literals⟩
+
+def quotientGroup (refs : Certified.Quotient.Refs β) : SourceGroup β :=
+  ⟨.quotient refs, Certified.Quotient.kinds.map refs.ref, [refs.eq, refs.eqRefl, refs.eqRec]⟩
+
+def modeledGroup? (store : Store β) (candidate : Modeled.Candidate β)
+    (natural : Option (ConstRef β) := none) : Option (SourceGroup β) := do
+  let references ← Certified.Modeled.sourceRefs? store candidate.source candidate.recursors
+  let sources := references.filterMap (store.lookup ·)
+  let rawReferences := sources.flatMap Const.refs
+  let literals ← literalDependencies? natural (sources.any constantHasLiteral)
+  return ⟨.modeled candidate, references,
+    rawReferences.filter (fun ref => !references.contains ref) ++ candidate.models ++
+      candidate.proofReferences ++ literals⟩
+
+def sourceGroup? (store : Store β) (r : ConstRef β)
+    (natural : Option (ConstRef β) := none) (models : List (Modeled.Candidate β) := []) : Option (SourceGroup β) := do
+  match models.findSome? (fun candidate => do
+    let group ← modeledGroup? store candidate natural
+    if group.references.contains r then some group else none) with
+  | some group => return group
+  | none => pure ⟨⟩
+  match r with
+  | .ctor source 0 _ => ordinaryGroup? store source (← findRecursor? store source) natural
+  | .ctor .. => none
+  | .member source member =>
+    match ← store.lookup r with
+    | .defn _ _ type body .safe =>
+      return ⟨.definition r, [r], type.refs ++ body.refs ++
+        (← literalDependencies? natural (hasLiteral type || hasLiteral body))⟩
+    | .axiom _ type .safe =>
+      match Quotient.refs? store r with
+      | some refs => return quotientGroup refs
+      | none => return ⟨.standard r, [r], type.refs ++ (← literalDependencies? natural (hasLiteral type))⟩
+    | .quot .. => return quotientGroup (← Quotient.refs? store r)
+    | .induct .. =>
+      if member != 0 then none else ordinaryGroup? store source (← findRecursor? store source) natural
+    | .recursor _ _ _ _ _ type _ _ .safe =>
+      if member != 0 then none else ordinaryGroup? store (← recursorFamily? type) source natural
+    | _ => none
+
+/-- Dependency order groups a whole ordinary family and recursor as one unit.
+A cycle, missing reference, or unsupported declaration produces no suggestion. -/
+def dependencyOrder? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (pending visited active : List (ConstRef β))
+    (order : List (DeclarationSource β) := []) (models : List (Modeled.Candidate β) := []) :
+    Option (List (ConstRef β) × List (DeclarationSource β)) :=
+  match fuel, pending with
+  | _, [] => some (visited, order)
+  | 0, _ :: _ => none
+  | fuel + 1, r :: rest =>
+    if r = signature.falseType ∨ r = signature.falseElim ∨ r ∈ visited then
+      dependencyOrder? fuel signature store rest visited active order models
+    else if r ∈ active then none
+    else do
+      let group ← sourceGroup? store r signature.natType models
+      if group.references.any (active.contains ·) then none else do
+        let (visited, order) ← dependencyOrder? fuel signature store
+          group.dependencies visited (group.references ++ active) order models
+        dependencyOrder? fuel signature store rest (visited ++ group.references) active
+          (order ++ [group.declaration]) models
+
+def definitionWitness? (fuel : Nat) (entries : Environment β) (r : ConstRef β)
+    (source : Const β) : Option (DefinitionWitness β) :=
+  match source with
+  | .defn n _ type body .safe => do
+    let T ← inferSource? fuel n entries [] type
+    let .sort l := T.type | none
+    let b ← inferSource? fuel n entries [] body
+    let bw ← castWith? fuel n entries [] b T.expression
+    return ⟨r, annotations T.expression, annotations b.expression, l, T.witness, bw⟩
+  | _ => none
+
+def declarationWitnesses? (fuel : Nat) (store : Store β) (entries : Environment β) :
+    List (DeclarationSource β) → Option (Environment β × List (DeclarationWitness β))
+  | [] => some (entries, [])
+  | .definition r :: rest => do
+    let source ← store.lookup r
+    let witness ← definitionWitness? fuel entries r source
+    let reading ← readDefinition? source witness.typeAnnotations witness.bodyAnnotations
+    let (entries', witnesses) ←
+      declarationWitnesses? fuel store (entries.insert r reading.val.entry) rest
+    return (entries', .definition witness :: witnesses)
+  | .ordinary source recursor :: rest => do
+    let witness ← Ordinary.sourceBlock? fuel entries store source recursor
+    if Hints.natural (β := β) = some (.member source 0) then
+      if witness.shape.shape != Certified.Natural.shape then none else do
+        let (entries', witnesses) ← declarationWitnesses? fuel store
+          (Certified.Natural.environment entries source recursor witness.mode) rest
+        return (entries', .natural witness :: witnesses)
+    else
+      match Structure.witness? fuel entries witness with
+      | some structured =>
+        let (entries', witnesses) ← declarationWitnesses? fuel store
+          (structured.facts.description.publishedEnvironment entries source recursor witness.mode) rest
+        return (entries', .structure structured :: witnesses)
+      | none =>
+        let (entries', witnesses) ← declarationWitnesses? fuel store
+          (witness.shape.shape.publishedEnvironment entries source recursor witness.mode) rest
+        return (entries', .ordinary witness :: witnesses)
+  | .standard ref :: rest => do
+    let source ← store.lookup ref
+    let witness ← Standard.witness? fuel store entries ref source
+    let (entries', witnesses) ← declarationWitnesses? fuel store (entries.insert ref witness.spec.entry) rest
+    return (entries', .standard witness :: witnesses)
+  | .quotient refs :: rest => do
+    let witness ← Quotient.witness? fuel entries refs
+    let (entries', witnesses) ← declarationWitnesses? fuel store (refs.environment entries) rest
+    return (entries', .quotient witness :: witnesses)
+  | .modeled candidate :: rest => do
+    let witness ← candidate.witness? fuel entries store
+    let (entries', witnesses) ← declarationWitnesses? fuel store
+      (Certified.Modeled.environment entries witness.companions) rest
+    return (entries', .modeled witness :: witnesses)
+
+/-- A generic search driver over the exact input store and source syntax.
+This is untrusted preprocessing: the final acceptance call validates the
+entire returned witness again, including the primitive metadata and policy. -/
+def proofWitness? (fuel : Nat) (signature : PrimitiveSignature β)
+    (input : ProofInput β) (models : List (Modeled.Candidate β) := []) : Option (ProofWitness β) :=
+  letI : Hints β := ⟨signature.natType⟩
+  do
+    let literals ← literalDependencies? signature.natType (hasLiteral input.proposition || hasLiteral input.proof)
+    let (_, order) ← dependencyOrder? fuel signature input.store
+      (input.proposition.refs ++ input.proof.refs ++ literals) [] [] [] models
+    let (entries, declarations) ←
+      declarationWitnesses? fuel input.store signature.environment order
+    let P ← inferSource? fuel input.universes entries [] input.proposition
+    let Pw ← castWith? fuel input.universes entries [] P (.sort .zero)
+    let e ← inferSource? fuel input.universes entries [] input.proof
+    let ew ← castWith? fuel input.universes entries [] e P.expression
+    return ⟨declarations, annotations e.expression, annotations P.expression, ew, Pw⟩
+
+/-- Declaration-only search also covers data declarations and complete source
+groups. The independent store validator checks every requested reference. -/
+def storeWitness? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (targets : List (ConstRef β)) (models : List (Modeled.Candidate β) := []) : Option (List (DeclarationWitness β)) :=
+  letI : Hints β := ⟨signature.natType⟩
+  do
+    let (_, order) ← dependencyOrder? fuel signature store targets [] [] [] models
+    let (_, declarations) ← declarationWitnesses? fuel store signature.environment order
+    return declarations
+
+end Ix.Theory.Certificate
diff --git a/Ix/Theory/Certificate/Claims.lean b/Ix/Theory/Certificate/Claims.lean
new file mode 100644
index 000000000..3e799214a
--- /dev/null
+++ b/Ix/Theory/Certificate/Claims.lean
@@ -0,0 +1,50 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Build
+import Ix.Theory.Certified.Claims
+
+namespace Ix.Theory.Certificate
+
+open Model Certified
+
+universe u
+variable {β : Type u} [DecidableEq β] [Hints β]
+
+/-- Untrusted construction of an ordered opaque frontier. The claim checker
+independently re-reads each source type and verifies its formation. -/
+def frontierWitnesses? (fuel : Nat) (store : Store β) (entries : Environment β) :
+    List (ConstRef β) → Option (Environment β × List (FrontierWitness β))
+  | [] => some (entries, [])
+  | ref :: refs => match store.uvars ref, store.type ref with
+    | some universes, some type => do
+      let inferred ← inferSource? fuel universes entries [] type
+      let .sort level := inferred.type | none
+      let witness : FrontierWitness β := ⟨ref, annotations inferred.expression, level, inferred.witness⟩
+      let reading ← readFrontierHeader? store witness
+      let (entries', rest) ← frontierWitnesses? fuel store
+        (entries.insert ref reading.header.entry) refs
+      return (entries', witness :: rest)
+    | _, _ => none
+
+def claimNode? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (frontier subjects : List (ConstRef β)) (models : List (Modeled.Candidate β) := []) : Option (ClaimNode β) :=
+  letI : Hints β := ⟨signature.natType⟩
+  do
+    let (entries, dependencies) ← frontierWitnesses? fuel store signature.environment frontier
+    let (_, order) ← dependencyOrder? fuel signature store subjects frontier [] [] models
+    let (_, declarations) ← declarationWitnesses? fuel store entries order
+    return ⟨subjects, dependencies, declarations⟩
+
+def batchFrontier? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (nodes : List (ClaimNode β)) : Option (List (FrontierWitness β)) :=
+  letI : Hints β := ⟨signature.natType⟩
+  do
+    let subjects := nodes.flatMap (·.subjects)
+    let refs := (nodes.flatMap fun node => node.frontier.map (·.ref)).filter
+      (fun ref => !subjects.contains ref) |>.eraseDups
+    return (← frontierWitnesses? fuel store signature.environment refs).2
+
+end Ix.Theory.Certificate
diff --git a/Ix/Theory/Certificate/Modeled.lean b/Ix/Theory/Certificate/Modeled.lean
new file mode 100644
index 000000000..618fb171f
--- /dev/null
+++ b/Ix/Theory/Certificate/Modeled.lean
@@ -0,0 +1,104 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Quotient
+import Ix.Theory.Certified.Modeled.Admission
+
+/-! Untrusted construction of exact model-companion certificates. Model
+declarations are ordinary earlier checked declarations. This builder derives
+all source headers and rule statements from the store, reads annotations in
+the mapped model environment, and searches for conversion or a supplied
+propositional proof. Its output must pass public declaration admission.
+-/
+
+namespace Ix.Theory.Certificate.Modeled
+
+open Model Certified Certified.Modeled
+
+universe u
+variable {β : Type u} [DecidableEq β] [Hints β]
+
+structure ProofHint (β : Type u) where
+  equality : ConstRef β
+  reflexivity : ConstRef β
+  recursor : ConstRef β
+  proof : VExpr β
+
+/-- A finite untrusted package selects earlier model declarations and optional
+equation proofs. The store remains the source of every original statement. -/
+structure Candidate (β : Type u) where
+  source : β
+  recursors : List (ConstRef β)
+  models : List (ConstRef β)
+  proofs : List (ConstRef β × List (Option (ProofHint β))) := []
+
+def Candidate.hint (candidate : Candidate β) (ref : ConstRef β) (index : Nat) : Option (ProofHint β) := do
+  let (_, proofs) ← candidate.proofs.find? (fun pair => pair.1 == ref)
+  (proofs[index]?).join
+
+def Candidate.proofReferences (candidate : Candidate β) : List (ConstRef β) :=
+  candidate.proofs.flatMap fun (_, proofs) => proofs.flatMap fun proof =>
+    match proof with
+    | none => []
+    | some proof => [proof.equality, proof.reflexivity, proof.recursor] ++ proof.proof.refs
+
+def target (pairs : List (ConstRef β × ConstRef β)) (ref : ConstRef β) : ConstRef β :=
+  ((pairs.find? (fun pair => pair.1 == ref)).map (·.2)).getD ref
+
+def readMapped? (fuel n : Nat) (entries : Environment β)
+    (mapping : ConstRef β → ConstRef β) (raw : VExpr β) : Option (AExpr β) := do
+  let inferred ← inferSource? fuel n entries [] (raw.mapRefs mapping)
+  let annotated ← readAnnotations? n 0 raw (annotations inferred.expression)
+  if annotated.val.mapRefs mapping = inferred.expression then some annotated.val else none
+
+def rule? (fuel : Nat) (entries : Environment β) (mapping : ConstRef β → ConstRef β)
+    (raw : RawRule β) (hint : Option (ProofHint β)) :
+    Option (Signature.Rule β × EquationWitness β) := do
+  let type ← readMapped? fuel raw.universes entries mapping raw.type
+  let lhs ← readMapped? fuel raw.universes entries mapping raw.lhs
+  let rhs ← readMapped? fuel raw.universes entries mapping raw.rhs
+  let rule : Signature.Rule β := ⟨raw.universes, type, lhs, rhs⟩
+  let mapped : Signature.Rule β := ⟨raw.universes, type.mapRefs mapping, lhs.mapRefs mapping, rhs.mapRefs mapping⟩
+  let formation ← Quotient.ruleWitness? fuel entries mapped
+  match hint with
+  | none => do
+    let proof ← conversion? fuel raw.universes entries [] mapped.lhs mapped.rhs
+    return (rule, ⟨formation, .conversion proof⟩)
+  | some hint => do
+    let inferred ← inferSource? fuel raw.universes entries [] hint.proof
+    let expected := Basis.Equality.applied hint.equality formation.level mapped.type mapped.lhs mapped.rhs
+    let proof ← castWith? fuel raw.universes entries [] inferred expected
+    return (rule, ⟨formation, .propositional hint.equality hint.reflexivity hint.recursor inferred.expression proof⟩)
+
+def companion? (fuel : Nat) (entries : Environment β) (store : Store β)
+    (pairs : List (ConstRef β × ConstRef β)) (ref model : ConstRef β)
+    (hints : Nat → Option (ProofHint β)) : Option (Companion β × List (EquationWitness β)) := do
+  let raw ← store.type ref
+  let some universes := store.uvars ref | none
+  let modelEntry ← entries model
+  if modelEntry.universes != universes then none else do
+    let reading ← readAnnotations? universes 0 raw (annotations modelEntry.type)
+    if reading.val.mapRefs (target pairs) != modelEntry.type then none else do
+      let rawRules ← sourceRules? store ref
+      let rules ← rawRules.zipIdx.mapM fun (raw, index) => rule? fuel entries (target pairs) raw (hints index)
+      return (⟨⟨ref, universes, reading.val⟩, model, rules.map (·.1)⟩, rules.map (·.2))
+
+/-- Model targets are positional in the actual source layout. Duplicated
+targets are allowed; their exact types and equations still undergo the same
+check, which supplies semantic justification for auxiliary merging. -/
+def witness? (fuel : Nat) (entries : Environment β) (store : Store β) (source : β)
+    (recursors models : List (ConstRef β))
+    (hints : ConstRef β → Nat → Option (ProofHint β) := fun _ _ => none) : Option (Witness β) := do
+  let refs ← sourceRefs? store source recursors
+  if refs.length != models.length then none else do
+    let pairs := refs.zip models
+    let checked ← pairs.mapM fun (ref, model) => companion? fuel entries store pairs ref model (hints ref)
+    return ⟨source, recursors, checked.map (·.1), checked.map (·.2)⟩
+
+def Candidate.witness? (candidate : Candidate β) (fuel : Nat) (entries : Environment β)
+    (store : Store β) : Option (Witness β) :=
+  Modeled.witness? fuel entries store candidate.source candidate.recursors candidate.models candidate.hint
+
+end Ix.Theory.Certificate.Modeled
diff --git a/Ix/Theory/Certificate/Ordinary.lean b/Ix/Theory/Certificate/Ordinary.lean
new file mode 100644
index 000000000..531f83b72
--- /dev/null
+++ b/Ix/Theory/Certificate/Ordinary.lean
@@ -0,0 +1,98 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Suggest
+import Ix.Theory.Certified.Ordinary.Checked
+
+/-! Untrusted witness construction for a proposed ordinary description. -/
+
+namespace Ix.Theory.Certificate.Ordinary
+
+open Model Certified Certified.Ordinary
+
+universe u
+variable {β : Type u} [DecidableEq β]
+variable [Hints β]
+
+def domains? (fuel n : Nat) (entries : Environment β) :
+    Context β → List (AExpr β) → Option (List (DomainWitness β))
+  | _, [] => some []
+  | Γ, A :: rest => do
+    let typed ← inferAnnotated? fuel n entries Γ A
+    let .sort level := typed.type | none
+    let tail ← domains? fuel n entries (Γ.push A) rest
+    return ⟨level, typed.witness⟩ :: tail
+
+def arguments? (fuel n : Nat) (entries : Environment β) (Γ : Context β) :
+    List (AExpr β) → List (AExpr β) → Option (List (TypingWitness β))
+  | [], [] => some []
+  | A :: domains, a :: args => do
+    let typed ← inferAnnotated? fuel n entries Γ a
+    let witness ← castWith? fuel n entries Γ typed A
+    let tail ← arguments? fuel n entries Γ (Telescope.inst a domains) args
+    return witness :: tail
+  | _, _ => none
+
+def recursive? (fuel : Nat) (entries : Environment β) (shape : Shape β)
+    (ctor : Constructor β) (field : RecursiveField β) : Option (RecursiveWitness β) := do
+  let domains ← domains? fuel shape.universes entries (ctor.context shape) field.domains
+  let indices ← arguments? fuel shape.universes entries
+    (Telescope.context (ctor.context shape) field.domains)
+    (Telescope.lift (ctor.fields.length + field.domains.length) shape.indices) field.indices
+  return ⟨domains, indices⟩
+
+def constructor? (fuel : Nat) (entries : Environment β) (shape : Shape β)
+    (ctor : Constructor β) : Option (ConstructorWitness β) := do
+  let fields ← domains? fuel shape.universes entries shape.parameterContext ctor.fields
+  let indices ← arguments? fuel shape.universes entries (ctor.context shape)
+    (Telescope.lift ctor.fields.length shape.indices) ctor.indices
+  let recursive ← ctor.recursive.mapM (recursive? fuel entries shape ctor)
+  return ⟨fields, indices, recursive⟩
+
+def shape? (fuel : Nat) (entries : Environment β) (shape : Shape β) : Option (ShapeWitness β) := do
+  let parameters ← domains? fuel shape.universes entries [] shape.parameters
+  let indices ← domains? fuel shape.universes entries shape.parameterContext shape.indices
+  let constructors ← shape.constructors.mapM (constructor? fuel entries shape)
+  return ⟨shape, parameters, indices, constructors⟩
+
+def type? (fuel n : Nat) (entries : Environment β) (type : AExpr β) : Option (Shape.TypeWitness β) := do
+  let typed ← inferAnnotated? fuel n entries [] type
+  let .sort level := typed.type | none
+  return ⟨level, typed.witness⟩
+
+def constructorTypes? (fuel : Nat) (entries : Environment β) (shape : Shape β) (source : β) :
+    Option (List (Shape.TypeWitness β)) :=
+  shape.constructors.mapM fun ctor => type? fuel shape.universes (shape.familyEnvironment entries source)
+    (ctor.type shape source)
+
+def recursorType? (fuel : Nat) (entries : Environment β) (shape : Shape β) (source : β)
+    (mode : Inductive.ElimMode) : Option (Shape.TypeWitness β) :=
+  type? fuel (mode.recUvars shape.universes) (shape.constructorEnvironment entries source) (shape.recursorType source mode)
+
+def rule? (fuel : Nat) (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : Inductive.ElimMode) (i : Nat) (ctor : Constructor β) : Option (RuleWitness β) := do
+  let n := mode.recUvars shape.universes
+  let type := shape.ruleType source mode i ctor
+  let typed ← type? fuel n entries type
+  let lhs ← inferAnnotated? fuel n entries [] (shape.ruleLhs source recursor mode i ctor)
+  let lh ← castWith? fuel n entries [] lhs type
+  let rhs ← inferAnnotated? fuel n entries [] (shape.ruleRhs source recursor mode i ctor)
+  let rh ← castWith? fuel n entries [] rhs type
+  return ⟨typed.level, typed.witness, lh, rh⟩
+
+def rules? (fuel : Nat) (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : Inductive.ElimMode) : Option (List (RuleWitness β)) :=
+  shape.constructors.zipIdx.mapM fun (ctor, i) => rule? fuel
+    (shape.recursorEnvironment entries source recursor mode) shape source recursor mode i ctor
+
+def block? (fuel : Nat) (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : Inductive.ElimMode) : Option (BlockWitness β) := do
+  let sw ← shape? fuel entries shape
+  let ct ← constructorTypes? fuel entries shape source
+  let rt ← recursorType? fuel entries shape source mode
+  let rs ← rules? fuel entries shape source recursor mode
+  return ⟨source, recursor, sw, mode, ct, rt, rs⟩
+
+end Ix.Theory.Certificate.Ordinary
diff --git a/Ix/Theory/Certificate/OrdinarySource.lean b/Ix/Theory/Certificate/OrdinarySource.lean
new file mode 100644
index 000000000..663fac582
--- /dev/null
+++ b/Ix/Theory/Certificate/OrdinarySource.lean
@@ -0,0 +1,98 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Ordinary
+
+/-! Untrusted recovery of ordinary descriptions from exact source declarations.
+Every removed context slot is checked by lifting back, and the completed
+description must reproduce all original source metadata and expressions. -/
+
+namespace Ix.Theory.Certificate.Ordinary
+
+open Model Certified Certified.Ordinary
+
+universe u
+variable {β : Type u} [DecidableEq β]
+variable [Hints β]
+
+def telescope : VExpr β → List (VExpr β) × VExpr β
+  | .forallE A B => let (tail, result) := telescope B; (A :: tail, result)
+  | e => ([], e)
+
+def sourceDomains? (fuel n : Nat) (entries : Environment β) :
+    Context β → List (VExpr β) → Option (List (AExpr β))
+  | _, [] => some []
+  | Γ, A :: rest => do
+    let typed ← inferSource? fuel n entries Γ A
+    let .sort _ := typed.type | none
+    let tail ← sourceDomains? fuel n entries (Γ.push typed.expression) rest
+    return typed.expression :: tail
+
+def removeVariables? (count : Nat) (e : VExpr β) : Option (VExpr β) :=
+  let candidate := e.unliftN count 0
+  if candidate.liftN count = e then some candidate else none
+
+def sourceIndices? (fuel : Nat) (entries : Environment β) (shape : Shape β)
+    (source : β) (Γ : Context β) (offset : Nat) (result : VExpr β) :
+    Option (List (AExpr β)) := do
+  if result.appHead != .const (.member source 0) (VLevel.params shape.universes) then none else do
+    let args := result.appArgs []
+    if args.length != shape.parameters.length + shape.indices.length then none else do
+      if args.take shape.parameters.length != VExpr.bvarRevRange offset shape.parameters.length then
+        none
+      else
+        (args.drop shape.parameters.length).mapM fun index => do
+          return (← inferSource? fuel shape.universes entries Γ index).expression
+
+def sourceRecursive? (fuel : Nat) (entries : Environment β) (shape : Shape β)
+    (source : β) (fields : List (AExpr β)) (previous : Nat) (raw : VExpr β) :
+    Option (RecursiveField β) := do
+  let raw ← removeVariables? previous raw
+  let (domains, result) := telescope raw
+  let Γ := Telescope.context shape.parameterContext fields
+  let domains ← sourceDomains? fuel shape.universes entries Γ domains
+  let indices ← sourceIndices? fuel entries shape source (Telescope.context Γ domains)
+    (fields.length + domains.length) result
+  return ⟨domains, indices⟩
+
+def sourceConstructor? (fuel : Nat) (entries : Environment β) (shape : Shape β)
+    (source : β) (raw : Ctor β) : Option (Constructor β) := do
+  let (binders, result) := telescope raw.type
+  if binders.take shape.parameters.length != shape.parameters.map AExpr.erase then none else do
+    let fields := binders.drop shape.parameters.length
+    let ordinary := fields.takeWhile fun A => !A.refs.contains (.member source 0)
+    let recursive := fields.drop ordinary.length
+    let fields ← sourceDomains? fuel shape.universes entries shape.parameterContext ordinary
+    let recursive ← recursive.zipIdx.mapM fun (raw, previous) =>
+      sourceRecursive? fuel entries shape source fields previous raw
+    let result ← removeVariables? recursive.length result
+    let indices ← sourceIndices? fuel entries shape source
+      (Telescope.context shape.parameterContext fields) fields.length result
+    return ⟨fields, recursive, indices⟩
+
+def description? (fuel : Nat) (entries : Environment β) (source : β) (raw : Const β) :
+    Option (Shape β) := do
+  let .induct n p i type constructors .safe := raw | none
+  let (binders, result) := telescope type
+  let .sort level := result | none
+  if binders.length != p + i then none else do
+    let parameters ← sourceDomains? fuel n entries [] (binders.take p)
+    let indices ← sourceDomains? fuel n entries (Telescope.context [] parameters) (binders.drop p)
+    let shape : Shape β := ⟨n, parameters, indices, level, []⟩
+    let constructors ← constructors.mapM (sourceConstructor? fuel entries shape source)
+    let shape := { shape with constructors }
+    if shape.source source = raw then some shape else none
+
+def sourceBlock? (fuel : Nat) (entries : Environment β) (store : Store β)
+    (source recursor : β) : Option (BlockWitness β) := do
+  let ⟨[raw]⟩ ← store.blocks source | none
+  let shape ← description? fuel entries source raw
+  if shape.RecursorSourceMatches store source recursor .small then
+    block? fuel entries shape source recursor .small
+  else if shape.RecursorSourceMatches store source recursor .large then
+    block? fuel entries shape source recursor .large
+  else none
+
+end Ix.Theory.Certificate.Ordinary
diff --git a/Ix/Theory/Certificate/Quotient.lean b/Ix/Theory/Certificate/Quotient.lean
new file mode 100644
index 000000000..b95b434d4
--- /dev/null
+++ b/Ix/Theory/Certificate/Quotient.lean
@@ -0,0 +1,75 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Standard
+import Ix.Theory.Certified.Quotient.Publish
+
+namespace Ix.Theory.Certificate.Quotient
+
+open Model Certified Certified.Quotient
+
+universe u
+variable {β : Type u} [DecidableEq β]
+variable [Hints β]
+
+def memberRefs (store : Store β) : List (ConstRef β) :=
+  store.dom.flatMap fun block =>
+    match store.blocks block with
+    | some value => (List.range value.members.length).map (.member block ·)
+    | none => []
+
+def findSource? (store : Store β) (source : Const β) : Option (ConstRef β) :=
+  (memberRefs store).find? fun r => store.lookup r == some source
+
+/-- Discover the quotient package from an exact lift type. The other members
+are found by declaration content, independently of addresses or source names. -/
+def refsForLift? (store : Store β) (lift : ConstRef β) : Option (Refs β) := do
+  let .quot .lift 2 type ← store.lookup lift | none
+  type.refs.findSome? fun eq => do
+    let .member esource 0 := eq | none
+    let eqRefl := ConstRef.ctor esource 0 0
+    let eqRec ← Standard.recursorFor? store 2 (Certified.Basis.Equality.recType eq eqRefl)
+    type.refs.findSome? fun family => do
+      let refs : Refs β := { eq, type := family, ctor := lift, lift, ind := lift, eqRefl, eqRec, sound := lift }
+      if (refs.source .lift) != .quot .lift 2 type then none else do
+        let ctor ← findSource? store (refs.source .ctor)
+        let refs := { refs with ctor }
+        let ind ← findSource? store (refs.source .ind)
+        let sound ← findSource? store (refs.source .sound)
+        let refs := { refs with ind, sound }
+        if refs.ExactSource store then some refs else none
+
+def refs? (store : Store β) (ref : ConstRef β) : Option (Refs β) :=
+  (memberRefs store).findSome? fun lift => do
+    let refs ← refsForLift? store lift
+    if (kinds.map refs.ref).contains ref then some refs else none
+
+def typeWitnesses? (fuel : Nat) (entries : Environment β) :
+    List (Signature.Header β) → Option (List (Signature.TypeWitness β))
+  | [] => some []
+  | header :: headers => do
+    let inferred ← inferAnnotated? fuel header.universes entries [] header.type
+    let .sort level := inferred.type | none
+    let rest ← typeWitnesses? fuel (entries.insert header.ref header.entry) headers
+    return ⟨level, inferred.witness⟩ :: rest
+
+def ruleWitness? (fuel : Nat) (entries : Environment β) (rule : Signature.Rule β) :
+    Option (Signature.RuleWitness β) := do
+  let type ← inferAnnotated? fuel rule.universes entries [] rule.type
+  let .sort level := type.type | none
+  let lhs ← inferAnnotated? fuel rule.universes entries [] rule.lhs
+  let lhs ← castWith? fuel rule.universes entries [] lhs rule.type
+  let rhs ← inferAnnotated? fuel rule.universes entries [] rule.rhs
+  let rhs ← castWith? fuel rule.universes entries [] rhs rule.type
+  return ⟨level, type.witness, lhs, rhs⟩
+
+def witness? (fuel : Nat) (entries : Environment β) (refs : Refs β) : Option (Witness β) := do
+  let types ← typeWitnesses? fuel entries refs.headers
+  let formed := refs.typeEnvironment entries
+  let liftRule ← ruleWitness? fuel formed refs.liftRule
+  let indRule ← ruleWitness? fuel formed refs.indRule
+  return ⟨refs, types, liftRule, indRule⟩
+
+end Ix.Theory.Certificate.Quotient
diff --git a/Ix/Theory/Certificate/Standard.lean b/Ix/Theory/Certificate/Standard.lean
new file mode 100644
index 000000000..27a505a3f
--- /dev/null
+++ b/Ix/Theory/Certificate/Standard.lean
@@ -0,0 +1,54 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Suggest
+import Ix.Theory.Certified.Standard.Checked
+
+namespace Ix.Theory.Certificate.Standard
+
+open Model Certified Certified.Standard Certified.Basis
+
+universe u
+variable {β : Type u} [DecidableEq β]
+variable [Hints β]
+
+def recursorFor? (store : Store β) (n : Nat) (type : AExpr β) : Option (ConstRef β) :=
+  (store.dom.find? fun source => match store.blocks source with
+    | some ⟨[.recursor m _ _ _ _ raw _ _ .safe]⟩ => m == n && raw == type.erase
+    | _ => false).map (.member · 0)
+
+/-- Recover only known standard schemas, then require exact source erasure.
+All prerequisite interfaces are checked again by standard admission. -/
+def spec? (store : Store β) (type : VExpr β) : Option (Spec β) := do
+  let spec ← match type with
+    | .forallE (.sort .zero) (.forallE (.sort .zero) (.forallE premise result)) => do
+      let .const iff [] := premise.appHead | none
+      let .const eq [.succ .zero] := result.appHead | none
+      let .member isource 0 := iff | none
+      let .member esource 0 := eq | none
+      let ei := ConstRef.ctor esource 0 0
+      let ii := ConstRef.ctor isource 0 0
+      let er ← recursorFor? store 2 (Equality.recType eq ei)
+      let ir ← recursorFor? store 1 (Iff.recType iff ii)
+      return Spec.propext eq ei er iff ii ir
+    | .forallE (.sort (.param 0)) (.forallE premise (.bvar 1)) => do
+      let .const ne [.param 0] := premise.appHead | none
+      let .member source 0 := ne | none
+      let ctor := ConstRef.ctor source 0 0
+      let recursor ← recursorFor? store 1 (Nonempty.recType ne ctor)
+      return Spec.choice ne ctor recursor
+    | _ => none
+  if spec.type.erase = type then some spec else none
+
+def witness? (fuel : Nat) (store : Store β) (entries : Environment β)
+    (ref : ConstRef β) (source : Const β) : Option (Witness β) := do
+  let .axiom _ type .safe := source | none
+  let spec ← spec? store type
+  if spec.source != source then none else do
+    let inferred ← inferAnnotated? fuel spec.universes entries [] spec.type
+    let .sort level := inferred.type | none
+    return ⟨ref, spec, level, inferred.witness⟩
+
+end Ix.Theory.Certificate.Standard
diff --git a/Ix/Theory/Certificate/Structure.lean b/Ix/Theory/Certificate/Structure.lean
new file mode 100644
index 000000000..2e123615b
--- /dev/null
+++ b/Ix/Theory/Certificate/Structure.lean
@@ -0,0 +1,43 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.OrdinarySource
+import Ix.Theory.Certificate.Quotient
+import Ix.Theory.Certified.Structure.Publish
+
+namespace Ix.Theory.Certificate.Structure
+
+open Model Certified Certified.Structure
+
+universe u
+variable {β : Type u} [DecidableEq β]
+variable [Hints β]
+
+def description? (block : Certified.Ordinary.BlockWitness β) : Option (Description β) := do
+  let shape := block.shape.shape
+  let [ctor] := shape.constructors | none
+  let [witness] := block.shape.constructors | none
+  if ctor.fields.length != witness.fields.length then none else
+    let fields := (ctor.fields.zip witness.fields).map fun (domain, witness) => ⟨domain, witness.level⟩
+    let d : Description β := ⟨shape.universes, shape.parameters, fields, shape.level⟩
+    if d.ordinary = shape ∧ fields.all (checkZeroImplies shape.level ·.level) then some d else none
+
+/-- Recover all structure data from the already source-recovered ordinary
+block, then suggest whole typing checks for its dependent projections. -/
+def witness? (fuel : Nat) (entries : Environment β) (block : Certified.Ordinary.BlockWitness β) :
+    Option (Witness β) := do
+  let d ← description? block
+  let [ctor] := block.shape.constructors | none
+  let domains ← Ordinary.domains? fuel d.universes
+    (d.ordinary.publishedEnvironment entries block.source block.recursor block.mode) []
+    (d.projectionDomains block.source)
+  let facts : FactsWitness β := ⟨d, block, ctor.fields.map DomainWitness.typing, domains⟩
+  let stage := d.factEnvironment entries block.source block.recursor block.mode
+  let eta ← Quotient.ruleWitness? fuel stage (d.etaRule block.source)
+  let iota ← d.fields.zipIdx.mapM fun (field, i) => Quotient.ruleWitness? fuel
+    (d.iotaEnvironment entries block.source block.recursor block.mode i) (d.iotaRule block.source i field)
+  return ⟨facts, eta, iota⟩
+
+end Ix.Theory.Certificate.Structure
diff --git a/Ix/Theory/Certificate/Suggest.lean b/Ix/Theory/Certificate/Suggest.lean
new file mode 100644
index 000000000..1b8197d41
--- /dev/null
+++ b/Ix/Theory/Certificate/Suggest.lean
@@ -0,0 +1,417 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Operations
+
+/-!
+# Untrusted certificate suggestions
+
+This bounded producer handles dependent functions with syntactic product
+heads, conservative universe simplification, and conversion certificates.
+Its output is ordinary data.
+Only the certified validator can turn a suggestion into acceptance. Failure
+to find a certificate is a decline and says nothing about untypability.
+-/
+
+namespace Ix.Theory.Certificate
+
+open Model Certified
+
+universe u
+variable {β : Type u} [DecidableEq β]
+
+/-- Untrusted search hints. The public builder derives these from the fixed
+profile; the semantic validator independently checks every resulting fact. -/
+class Hints (β : Type u) where
+  natural : Option (ConstRef β)
+
+instance (priority := low) : Hints β := ⟨none⟩
+
+variable [Hints β]
+
+def annotations : AExpr β → AnnotationTree
+  | .bvar _ | .sort _ | .const .. | .natLit _ => .leaf
+  | .app f a => .app (annotations f) (annotations a)
+  | .lam p A b => .lam p.toRaw (annotations A) (annotations b)
+  | .forallE p A B => .forallE p.toRaw (annotations A) (annotations B)
+  | .proj _ _ e => .proj (annotations e)
+
+structure Suggestion (β : Type u) where
+  expression : AExpr β
+  type : AExpr β
+  witness : TypingWitness β
+
+/-- A limited conversion search. The validator independently rechecks every
+level equality and the type of the expected type. -/
+def cast? (n : Nat) (suggestion : Suggestion β) (type : AExpr β) : Option (TypingWitness β) :=
+  if suggestion.type = type then some suggestion.witness
+  else
+    match suggestion.type, type with
+    | .sort l, .sort l' =>
+      if LevelEq.check n l l' then
+        some (.conv suggestion.type (.succ l') suggestion.witness .sort .sort)
+      else none
+    | _, _ => none
+
+def headConstant? : AExpr β → Option (ConstRef β × List VLevel)
+  | .const r levels => some (r, levels)
+  | .app f _ => headConstant? f
+  | _ => none
+
+def applicationArgs : AExpr β → List (AExpr β) → List (AExpr β)
+  | .app f a, args => applicationArgs f (a :: args)
+  | _, args => args
+
+def lambdaBody : AExpr β → Nat × AExpr β
+  | .lam _ _ body => let (n, result) := lambdaBody body; (n + 1, result)
+  | e => (0, e)
+
+/-- Collect possible arguments of a closed equation telescope. This search
+does not certify matching: the fully instantiated endpoint is compared below
+and every application/beta step is subsequently checked by the validator. -/
+def matchEquationArgs? : AExpr β → AExpr β → List (Option (AExpr β)) → Option (List (Option (AExpr β)))
+  | .bvar i, actual, slots => do
+    let slot ← slots[i]?
+    match slot with
+    | none => some (slots.set i (some actual))
+    | some previous => if previous = actual then some slots else none
+  | .app f x, .app g y, slots => do
+    let slots ← matchEquationArgs? f g slots
+    matchEquationArgs? x y slots
+  | .const r ls, .const q ms, slots => if r = q ∧ ls = ms then some slots else none
+  | .sort l, .sort m, slots => if l = m then some slots else none
+  | .proj r i major, .proj q j actual, slots =>
+    if r = q ∧ i = j then matchEquationArgs? major actual slots else none
+  | .lam .., .lam .., slots | .forallE .., .forallE .., slots => some slots
+  | _, _, _ => none
+
+def instantiateLambdas? : AExpr β → List (AExpr β) → Option (AExpr β)
+  | e, [] => some e
+  | .lam _ _ body, arg :: rest => instantiateLambdas? (body.inst arg) rest
+  | _, _ => none
+
+def equationArguments? (pattern actual : AExpr β) : Option (List (AExpr β)) := do
+  let (count, body) := lambdaBody pattern
+  let slots ← matchEquationArgs? body actual (List.replicate count none)
+  let args ← slots.reverse.mapM id
+  let instantiated ← instantiateLambdas? pattern args
+  if instantiated = actual then some args else none
+
+/-- Suggest the same equation with a different final major proof. The full
+application prefix must still match exactly. A subsequent typed conversion
+must justify replacing that proof; this matcher alone grants no equation. -/
+def equationProofArguments? (pattern actual : AExpr β) : Option (List (AExpr β)) := do
+  let (count, body) := lambdaBody pattern
+  let .app rulePrefix _ := body | none
+  let .app actualPrefix _ := actual | none
+  let slots ← matchEquationArgs? rulePrefix actualPrefix (List.replicate count none)
+  let args ← slots.reverse.mapM id
+  let .app instantiatedPrefix _ ← instantiateLambdas? pattern args | none
+  if instantiatedPrefix = actualPrefix then some args else none
+
+mutual
+def inferSource? (fuel n : Nat) (entries : Environment β) (Γ : Context β) :
+    VExpr β → Option (Suggestion β) :=
+  match fuel with
+  | 0 => fun _ => none
+  | fuel + 1 => fun source =>
+    match source with
+    | .bvar i => do
+      let A ← Γ[i]?
+      return ⟨.bvar i, A, .bvar⟩
+    | .sort l =>
+      if l.WF n then some ⟨.sort l, .sort (.succ l), .sort⟩ else none
+    | .const r ls => do
+      let entry ← entries r
+      if ls.length = entry.universes ∧ ∀ l ∈ ls, l.WF n then
+        return ⟨.const r ls, entry.type.instL ls, .const⟩
+      else none
+    | .forallE A B => do
+      let a ← inferSource? fuel n entries Γ A
+      let a ← normalizeType? fuel n entries Γ a
+      let .sort lA := a.type | none
+      let b ← inferSource? fuel n entries (Γ.push a.expression) B
+      let b ← normalizeType? fuel n entries (Γ.push a.expression) b
+      let .sort lB := b.type | none
+      return ⟨.forallE (zeroCondition lB) a.expression b.expression, .sort (.imax lA lB),
+        .forallE lA lB a.witness b.witness⟩
+    | .lam A body => do
+      let a ← inferSource? fuel n entries Γ A
+      let a ← normalizeType? fuel n entries Γ a
+      let .sort lA := a.type | none
+      let b ← inferSource? fuel n entries (Γ.push a.expression) body
+      let b ← normalizeType? fuel n entries (Γ.push a.expression) b
+      let B ← inferAnnotated? fuel n entries (Γ.push a.expression) b.type
+      let B ← normalizeType? fuel n entries (Γ.push a.expression) B
+      let .sort lB := B.type | none
+      return ⟨.lam (zeroCondition lB) a.expression b.expression,
+        .forallE (zeroCondition lB) a.expression b.type,
+        .lam lA lB b.type a.witness B.witness b.witness⟩
+    | .app f arg => do
+      let fn ← inferSource? fuel n entries Γ f
+      let fn ← normalizeType? fuel n entries Γ fn
+      let .forallE p A B := fn.type | none
+      let a ← inferSource? fuel n entries Γ arg
+      let aw ← castWith? fuel n entries Γ a A
+      return ⟨.app fn.expression a.expression, B.inst a.expression,
+        .app p A B fn.witness aw⟩
+    | .proj ref index major => do
+      let major ← inferSource? fuel n entries Γ major
+      let typed ← normalizeType? fuel n entries Γ major
+      let (owner, ls) ← headConstant? typed.type
+      if owner != ref then none else do
+        let entry ← entries ref
+        if ls.length != entry.universes then none else
+          entry.facts.zipIdx.findSome? fun (fact, factIndex) => do
+            let .typed expression type := fact | none
+            let (_, .proj family field _) := lambdaBody expression | none
+            if family != ref || field != index then none else do
+              let result ← applyFact? fuel n entries Γ
+                ⟨expression.instL ls, type.instL ls, .fact ref factIndex ls⟩
+                (applicationArgs typed.type [] ++ [major.expression])
+              if result.expression = .proj ref index major.expression then some result else none
+    | .natLit value => do
+      let ref ← Hints.natural (β := β)
+      let entry ← entries ref
+      if entry.universes != 0 then none else
+        entry.facts.zipIdx.findSome? fun (fact, i) => match fact with
+          | .natural _ _ => some ⟨.natLit value, .const ref [], .natLit ref i⟩
+          | _ => none
+
+/-- Instantiate an admitted closed typing fact using checked beta results.
+The result retains the actual source projection rather than a replacement
+term with a merely convertible type. -/
+def applyFact? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (fact : Suggestion β) (args : List (AExpr β)) : Option (Suggestion β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 => match args with
+    | [] => some fact
+    | arg :: rest => do
+      let .lam p D body := fact.expression | none
+      let .forallE q A B := fact.type | none
+      if p != q || D != A then none else do
+        let a ← inferAnnotated? fuel n entries Γ arg
+        let aw ← castWith? fuel n entries Γ a D
+        applyFact? fuel n entries Γ ⟨body.inst arg, B.inst arg,
+          .betaResult p D body arg B fact.witness aw⟩ rest
+
+def inferAnnotated? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (e : AExpr β) : Option (Suggestion β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 => do
+    let result ← inferSource? fuel n entries Γ e.erase
+    if result.expression = e then some result else none
+
+/-- Build a conversion certificate rather than normalizing away source
+syntax. The semantic validator checks the target's sort independently. -/
+def castWith? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (suggestion : Suggestion β) (type : AExpr β) : Option (TypingWitness β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    match cast? n suggestion type with
+    | some witness => some witness
+    | none => do
+      let target ← inferAnnotated? fuel n entries Γ type
+      let target ← normalizeType? fuel n entries Γ target
+      let .sort l := target.type | none
+      let witness ← conversion? fuel n entries Γ suggestion.type type
+      return .conv suggestion.type l suggestion.witness target.witness witness
+
+def beta? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (e : AExpr β) : Option (AExpr β × ConversionWitness β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 => do
+    let .app (.lam p D body) arg := e | none
+    let fn ← inferAnnotated? fuel n entries Γ (.lam p D body)
+    let a ← inferAnnotated? fuel n entries Γ arg
+    let aw ← castWith? fuel n entries Γ a D
+    return (body.inst arg, .beta fn.type fn.witness aw)
+
+def eta? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (a b : AExpr β) : Option (ConversionWitness β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 => do
+    let .lam p D body := a | none
+    let fn ← inferAnnotated? fuel n entries Γ b
+    let fn ← normalizeType? fuel n entries Γ fn
+    let .forallE q D' B := fn.type | none
+    if p = q ∧ D = D' ∧ body = .app (b.liftN 1) (.bvar 0) then
+      return .eta B fn.witness
+    else none
+
+/-- A checked beta/delta step may occur in the function of an application. -/
+def headStep? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (e : AExpr β) : Option (AExpr β × ConversionWitness β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    let delta := fun (_ : Unit) => do
+      let .const r ls := e | none
+      let entry ← entries r
+      if ls.length != entry.universes then none else do
+        let body ← entry.body
+        return (body.instL ls, .delta)
+    let app := fun (_ : Unit) => do
+      let .app f x := e | none
+      let (f', w) ← headStep? fuel n entries Γ f <|> equationStep? fuel n entries Γ f
+      return (.app f' x, .app w .refl)
+    let argument := fun (_ : Unit) => do
+      let .app f x := e | none
+      let (x', w) ← headStep? fuel n entries Γ x <|> equationStep? fuel n entries Γ x
+      return (.app f x', .app .refl w)
+    let projection := fun (_ : Unit) => do
+      let .proj r i x := e | none
+      let (x', w) ← headStep? fuel n entries Γ x <|> equationStep? fuel n entries Γ x
+      return (.proj r i x', .proj w)
+    let literal := fun (_ : Unit) => do
+      let .natLit value := e | none
+      let ref ← Hints.natural (β := β)
+      let entry ← entries ref
+      if entry.universes != 0 then none else
+        entry.facts.zipIdx.findSome? fun (fact, i) => match fact with
+          | .natural zero succ => some
+            ((match value with | 0 => .const zero [] | n + 1 => .app (.const succ []) (.natLit n)), .natLiteral ref i)
+          | _ => none
+    beta? fuel n entries Γ e <|> delta () <|> app () <|> argument () <|> projection () <|> literal ()
+
+def equationStep? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (e : AExpr β) : Option (AExpr β × ConversionWitness β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 => do
+    let (ref, levels) : ConstRef β × List VLevel ← match e with
+      | .proj ref _ major => do
+        let typed ← inferAnnotated? fuel n entries Γ major
+        let typed ← normalizeType? fuel n entries Γ typed
+        let (owner, levels) ← headConstant? typed.type
+        if owner = ref then some (ref, levels) else none
+      | _ => do
+        let (ref, levels) ← headConstant? e
+        let owner : ConstRef β := match ref with | .ctor source member _ => .member source member | _ => ref
+        some (owner, levels)
+    let entry ← entries ref
+    if levels.length != entry.universes then none else
+      entry.equations.zipIdx.findSome? fun (law, i) => do
+        let lhs := law.lhs.instL levels
+        let rhs := law.rhs.instL levels
+        let args ← equationArguments? lhs e <|> (do
+          let (_, .app _ constructor) := lambdaBody lhs | none
+          let (.ctor .., _) ← headConstant? constructor | none
+          let .app fn major := e | none
+          let expanded ← etaMajor? fuel n entries Γ major
+          equationArguments? lhs (.app fn expanded)) <|> (do
+          let .app _ major := e | none
+          let typed ← inferAnnotated? fuel n entries Γ major
+          let type ← inferAnnotated? fuel n entries Γ typed.type
+          let _ ← cast? n type (.sort .zero)
+          equationProofArguments? lhs e)
+        let lhsApplied := args.foldl AExpr.app lhs
+        let rhsApplied := args.foldl AExpr.app rhs
+        let beta ← conversion? fuel n entries Γ lhsApplied e
+        let equation := args.foldl (fun w _ => ConversionWitness.app w .refl) (.equation ref i levels)
+        return (rhsApplied, .trans lhsApplied (.symm beta) equation)
+
+/-- A stuck eliminator may use an existing structure's checked eta equation
+to expose its constructor. This only suggests arguments: `equationStep?`
+still constructs and checks conversion of the complete original application
+to the chosen rule's complete instantiated left side. Model companions with
+no eta equation cannot acquire this behavior from the search. -/
+def etaMajor? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (major : AExpr β) : Option (AExpr β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 => do
+    let typed ← inferAnnotated? fuel n entries Γ major
+    let typed ← normalizeType? fuel n entries Γ typed
+    let (family, levels) ← headConstant? typed.type
+    let entry ← entries family
+    if levels.length != entry.universes then none else
+      entry.equations.findSome? fun law => do
+        let arguments := applicationArgs typed.type [] ++ [major]
+        let rhs ← instantiateLambdas? (law.rhs.instL levels) arguments
+        if rhs != major then none else do
+          let lhs ← instantiateLambdas? (law.lhs.instL levels) arguments
+          if lhs = major then none else some lhs
+
+/-- Reduction of an inferred type is accompanied by a conversion witness
+and a fresh formation witness for the resulting type. -/
+def normalizeType? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (suggestion : Suggestion β) : Option (Suggestion β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    match suggestion.type with
+    | .sort _ | .forallE .. => some suggestion
+    | _ =>
+      match headStep? fuel n entries Γ suggestion.type <|> equationStep? fuel n entries Γ suggestion.type with
+      | none => some suggestion
+      | some (type, conversion) => do
+        let formed ← inferAnnotated? fuel n entries Γ type
+        let formed ← normalizeType? fuel n entries Γ formed
+        let .sort level := formed.type | none
+        normalizeType? fuel n entries Γ
+          ⟨suggestion.expression, type, .conv suggestion.type level suggestion.witness formed.witness conversion⟩
+
+def conversion? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (a b : AExpr β) : Option (ConversionWitness β) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    if a = b then some .refl
+    else
+      -- Once a checked reduction is available, follow it without exploring
+      -- alternate reduction orders again after fuel exhaustion.
+      match headStep? fuel n entries Γ a with
+      | some (a', w) => do return .trans a' w (← conversion? fuel n entries Γ a' b)
+      | none => match headStep? fuel n entries Γ b with
+      | some (b', w) => do return .trans b' (← conversion? fuel n entries Γ a b') (.symm w)
+      | none =>
+      let congruence := fun (_ : Unit) =>
+        match a, b with
+        | .sort l, .sort l' => if LevelEq.check n l l' then some .sort else none
+        | .app f x, .app g y => do
+          return .app (← conversion? fuel n entries Γ f g) (← conversion? fuel n entries Γ x y)
+        | .proj r i x, .proj q j y =>
+          if r = q ∧ i = j then (.proj ·) <$> conversion? fuel n entries Γ x y else none
+        | .lam p D body, .lam q D' body' => do
+          if p != q then none else do
+            let domain ← inferAnnotated? fuel n entries Γ D
+            let .sort l := domain.type | none
+            return .lam l domain.witness (← conversion? fuel n entries Γ D D')
+              (← conversion? fuel n entries (Γ.push D) body body')
+        | .forallE p D B, .forallE q D' B' => do
+          if p != q then none else do
+            let domain ← inferAnnotated? fuel n entries Γ D
+            let .sort l := domain.type | none
+            return .forallE l domain.witness (← conversion? fuel n entries Γ D D')
+              (← conversion? fuel n entries (Γ.push D) B B')
+        | _, _ => none
+      let proofIrrel := fun (_ : Unit) => do
+        let left ← inferAnnotated? fuel n entries Γ a
+        let type ← inferAnnotated? fuel n entries Γ left.type
+        let typeWitness ← cast? n type (.sort .zero)
+        let right ← inferAnnotated? fuel n entries Γ b
+        let rightWitness ← castWith? fuel n entries Γ right left.type
+        return .proofIrrel left.type typeWitness left.witness rightWitness
+      eta? fuel n entries Γ a b <|>
+        ((.symm ·) <$> eta? fuel n entries Γ b a) <|> congruence () <|>
+        (match equationStep? fuel n entries Γ a with
+        | some (a', w) => do return .trans a' w (← conversion? fuel n entries Γ a' b)
+        | none => match equationStep? fuel n entries Γ b with
+        | some (b', w) => do return .trans b' (← conversion? fuel n entries Γ a b') (.symm w)
+        | none => proofIrrel ())
+end
+
+def inferenceWitness? (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (source : VExpr β) : Option (InferenceWitness β) := do
+  let suggestion ← inferSource? fuel n entries Γ source
+  return ⟨annotations suggestion.expression, suggestion.type, suggestion.witness⟩
+
+end Ix.Theory.Certificate
diff --git a/Ix/Theory/Certified.lean b/Ix/Theory/Certified.lean
new file mode 100644
index 000000000..0f772d961
--- /dev/null
+++ b/Ix/Theory/Certified.lean
@@ -0,0 +1,48 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Accept
+import Ix.Theory.Certified.Store
+import Ix.Theory.Certified.Source
+import Ix.Theory.Certified.ClaimComposition
+import Ix.Theory.Certified.Operations
+import Ix.Theory.Certified.Ordinary.Admission
+
+/-!
+# Certified-profile mathematical boundary
+
+This target exports a witness validator for dependent functions, declaration
+admission with compatible model extension, and abstract acceptance/model and
+no-False theorems over exact Ix syntax. Declaration checking also constructs
+one compatible model for every requested member and constructor. Connecting
+these results to canonical serialized input and the production Ix.Kernel checker
+requires a separate adapter and refinement proof. Conditional claims check formed
+source headers and extend every compatible frontier model. Aggregation checks
+an acyclic provider order and replays admissions in one shared interface;
+closed bundles construct their model and retain all logical axiom use. The
+Ix claim/byte adapter and backend acceptance have separate refinement roots.
+
+Ordinary-inductive admission constructs indexed carriers and eliminators,
+checks the exact source and stored recursor types and rule endpoints, and
+publishes their proved equations atomically. The supported shape class uses
+ordinary fields followed by independent strictly positive recursive fields.
+Standard propext and choice admission checks exact types and prerequisite
+interfaces and constructs their realizations. Eq K uses typed proof
+irrelevance with admitted computation. Quotient admission constructs its
+carrier, constructor, lift, Prop induction and soundness values and proves
+the complete computation equations. Structure admission produces dependent
+projection facts and whole eta/iota equations, including the checked Prop
+field restriction. Nat admission pins the zero/successor source and proves
+membership and constructor conversion for every numeral. Mutual/nested
+admission checks companions in an earlier model environment and validates
+their complete translated source equations before simultaneous publication.
+Reference restoration, permutation and shared model values have proved
+semantic transport laws. This route supplies no projection, eta or K facts
+for the new families. Other literal forms still need separate producers.
+
+The semantic results explicitly quantify over `V` and `[Model.SetTheory V]`.
+The existence of this set-theoretic model is a mathematical hypothesis, not a
+theorem of Lean. Audit tooling and experimental metatheory are separate targets.
+-/
diff --git a/Ix/Theory/Certified/Accept.lean b/Ix/Theory/Certified/Accept.lean
new file mode 100644
index 000000000..fe209ea45
--- /dev/null
+++ b/Ix/Theory/Certified/Accept.lean
@@ -0,0 +1,139 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Admission
+
+/-!
+# Closed acceptance of the certified profile
+
+Acceptance checks the exact primitive declarations, a dependency-ordered list
+of safe definitions and modeled ordinary blocks, the original proof and proposition readings,
+and both typing certificates. It constructs its dependency model and starts
+from the empty context. This is an abstract Ix-syntax acceptance result;
+serialized bytes, Ix.Kernel execution, claims, and proving backends need their own
+refinement theorems.
+-/
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure ProofInput (β : Type u) where
+  store : Store β
+  universes : Nat
+  proof : VExpr β
+  proposition : VExpr β
+
+structure ProofWitness (β : Type u) where
+  declarations : List (DeclarationWitness β)
+  proofAnnotations : AnnotationTree
+  propositionAnnotations : AnnotationTree
+  proofWitness : TypingWitness β
+  propositionWitness : TypingWitness β
+
+structure CheckedProof (signature : PrimitiveSignature β) (input : ProofInput β) where
+  environment : AdmittedEnvironment.{u,v} signature input.store
+  proof : Reading input.universes 0 input.proof
+  proposition : Reading input.universes 0 input.proposition
+  proofReferences : proof.val.ReferencesIn environment.entries
+  propositionReferences : proposition.val.ReferencesIn environment.entries
+  typing : TypingClaim.{u,v} environment.entries [] proof.val proposition.val
+  isProp : TypingClaim.{u,v} environment.entries [] proposition.val (.sort .zero)
+
+def checkProofCertified (fuel : Nat) (signature : PrimitiveSignature β)
+    (input : ProofInput β) (witness : ProofWitness β) :
+    Option (CheckedProof.{u,v} signature input) := do
+  let initial ← initialize? signature input.store
+  let declarations ← admitDeclarations? fuel initial witness.declarations
+  let proof ← readAnnotations? input.universes 0 input.proof witness.proofAnnotations
+  let proposition ← readAnnotations? input.universes 0 input.proposition witness.propositionAnnotations
+  if he : proof.val.ReferencesIn declarations.val.entries then
+    if hP : proposition.val.ReferencesIn declarations.val.entries then do
+      let hp ← verifyType.{u,v} fuel input.universes declarations.val.entries []
+        proposition.val (.sort .zero) witness.propositionWitness
+      let ht ← verifyType.{u,v} fuel input.universes declarations.val.entries []
+        proof.val proposition.val witness.proofWitness
+      return ⟨declarations.val, proof, proposition, he, hP, ht.down, hp.down⟩
+    else none
+  else none
+
+def acceptsCertified (fuel : Nat) (signature : PrimitiveSignature β)
+    (input : ProofInput β) (witness : ProofWitness β) : Bool :=
+  (checkProofCertified.{u,v} fuel signature input witness).isSome
+
+/-- Acceptance constructs the model; it does not ask the caller to supply a
+realization of unchecked declarations, annotations, or a nonempty context. -/
+theorem accepted_has_model {fuel : Nat} {signature : PrimitiveSignature β}
+    {input : ProofInput β} {witness : ProofWitness β}
+    (h : acceptsCertified.{u,v} fuel signature input witness = true)
+    (V : Type v) [SetTheory V] (levels : List Nat) (env : Nat → V) :
+    ∃ result : CheckedProof.{u,v} signature input,
+      checkProofCertified fuel signature input witness = some result ∧
+      ∃ constants : Assignment β V, signature.Compatible result.environment.entries constants ∧
+        WellDenoted constants levels env result.proof.val ∧
+        WellDenoted constants levels env result.proposition.val ∧
+        interp constants levels env result.proof.val ∈ˢ
+          interp constants levels env result.proposition.val := by
+  unfold acceptsCertified at h
+  cases hc : checkProofCertified.{u,v} fuel signature input witness with
+  | none => simp [hc] at h
+  | some result =>
+    obtain ⟨constants, hM⟩ := result.environment.model V
+    exact ⟨result, rfl, constants, hM,
+      result.typing V constants hM.realizes levels env (Context.valid_nil constants levels env)⟩
+
+/-- The accepted proposition is inhabited in every compatible interpretation
+of the checked dependency interface, not only in the model chosen above. -/
+theorem accepted_proof_sound {fuel : Nat} {signature : PrimitiveSignature β}
+    {input : ProofInput β} {witness : ProofWitness β}
+    (h : acceptsCertified.{u,v} fuel signature input witness = true) :
+    ∃ result : CheckedProof.{u,v} signature input,
+      checkProofCertified fuel signature input witness = some result ∧
+      ∀ (V : Type v) [SetTheory V] (constants : Assignment β V),
+        signature.Compatible result.environment.entries constants → ∀ levels env,
+          interp constants levels env result.proof.val ∈ˢ
+            interp constants levels env result.proposition.val := by
+  unfold acceptsCertified at h
+  cases hc : checkProofCertified.{u,v} fuel signature input witness with
+  | none => simp [hc] at h
+  | some result =>
+    refine ⟨result, rfl, ?_⟩
+    intro V _ constants hM levels env
+    exact (result.typing V constants hM.realizes levels env
+      (Context.valid_nil constants levels env)).2.2
+
+theorem no_proof_of_False {fuel : Nat} {signature : PrimitiveSignature β}
+    {input : ProofInput β} {witness : ProofWitness β}
+    (V : Type v) [SetTheory V]
+    (hFalse : input.proposition = signature.falseExpr)
+    (h : acceptsCertified.{u,v} fuel signature input witness = true) : False := by
+  obtain ⟨result, _, constants, hM, _, _, hmem⟩ :=
+    accepted_has_model h V [] (fun _ => empty)
+  have herase : result.proposition.val.erase = .const signature.falseType [] :=
+    result.proposition.property.1.trans hFalse
+  have he := AExpr.eq_const_of_erase_eq herase
+  rw [he] at hmem
+  simp only [interp, List.map_nil, hM.falseValue] at hmem
+  exact not_mem_empty _ hmem
+
+/-- A source-level empty proposition can also be reached through certified
+definitions or conversions. Its semantic emptiness contradicts acceptance. -/
+theorem no_proof_of_empty {fuel : Nat} {signature : PrimitiveSignature β}
+    {input : ProofInput β} {witness : ProofWitness β}
+    (V : Type v) [SetTheory V]
+    (hempty : ∀ result : CheckedProof.{u,v} signature input,
+      checkProofCertified fuel signature input witness = some result →
+      ∀ constants : Assignment β V, signature.Compatible result.environment.entries constants →
+        interp constants [] (fun _ => empty) result.proposition.val = empty)
+    (h : acceptsCertified.{u,v} fuel signature input witness = true) : False := by
+  obtain ⟨result, hc, constants, hM, _, _, hmem⟩ :=
+    accepted_has_model h V [] (fun _ => empty)
+  rw [hempty result hc constants hM] at hmem
+  exact not_mem_empty _ hmem
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Admission.lean b/Ix/Theory/Certified/Admission.lean
new file mode 100644
index 000000000..a993c1ddb
--- /dev/null
+++ b/Ix/Theory/Certified/Admission.lean
@@ -0,0 +1,245 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Checker
+import Ix.Theory.Certified.Prelude
+import Ix.Theory.Certified.Ordinary.Checked
+import Ix.Theory.Certified.Standard.Checked
+import Ix.Theory.Certified.Quotient.Publish
+import Ix.Theory.Certified.Structure.Publish
+import Ix.Theory.Certified.Natural.Publish
+import Ix.Theory.Certified.Modeled.Source
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def DefinitionReading.entry (reading : DefinitionReading β) : ConstantEntry β :=
+  ⟨reading.universes, reading.type, some reading.body, [], []⟩
+
+/-- Every published dependency has an exact source declaration in the input
+store. The two exceptional forms are the completely pinned primitives. -/
+def EntrySource (signature : PrimitiveSignature β) (store : Store β)
+    (r : ConstRef β) (entry : ConstantEntry β) : Prop :=
+  (r = signature.falseType ∧ entry = PrimitiveSignature.falseEntry ∧
+    store.lookup r = some PrimitiveSignature.falseDeclaration) ∨
+  (r = signature.falseElim ∧ entry = signature.falseElimEntry ∧
+    store.lookup r = some signature.falseElimDeclaration) ∨
+  (∃ (kind : DefKind) (body : AExpr β), entry.body = some body ∧
+    entry.equations = [] ∧ entry.facts = [] ∧
+    store.lookup r = some (.defn entry.universes kind entry.type.erase body.erase .safe)) ∨
+  Ordinary.EntrySource store r entry ∨ Standard.EntrySource store r entry ∨
+    Quotient.EntrySource store r entry ∨ Structure.EntrySource store r entry ∨
+      Natural.EntrySource signature.natType store r entry ∨ Modeled.EntrySource store r entry
+
+/-- An interface may be an explicit conditional frontier. Scope and reference
+closure are checked here; existence of a realization is a separate obligation. -/
+structure CheckedInterface (signature : PrimitiveSignature β) where
+  entries : Environment β
+  wf : entries.WF
+  present : signature.Present entries
+
+/-- The model field is produced by the initialization and admission functions,
+starting with the fixed prelude and extending it with checked bodies. -/
+structure AdmittedEnvironment (signature : PrimitiveSignature β) (store : Store β) where
+  entries : Environment β
+  wf : entries.WF
+  present : signature.Present entries
+  source : ∀ r entry, entries r = some entry → EntrySource signature store r entry
+  model : ∀ (V : Type v) [SetTheory V], ∃ constants : Assignment β V,
+    signature.Compatible entries constants
+
+def AdmittedEnvironment.interface {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) : CheckedInterface signature :=
+  ⟨state.entries, state.wf, state.present⟩
+
+/-- An extension preserves each previously selected interpretation. -/
+structure Extends (signature : PrimitiveSignature β) (entries entries' : Environment β) : Prop where
+  lookup : ∀ r entry, entries r = some entry → entries' r = some entry
+  models : ∀ (V : Type v) [SetTheory V] (constants : Assignment β V),
+    signature.Compatible entries constants → ∃ constants' : Assignment β V,
+      signature.Compatible entries' constants' ∧ Assignment.AgreesOn entries constants constants'
+
+omit [DecidableEq β] in
+theorem Extends.refl (signature : PrimitiveSignature β) (entries : Environment β) :
+    Extends.{u,v} signature entries entries :=
+  ⟨fun _ _ h => h, fun _ _ constants h => ⟨constants, h, fun _ _ _ _ => rfl⟩⟩
+
+omit [DecidableEq β] in
+theorem Extends.trans {signature : PrimitiveSignature β} {a b c : Environment β}
+    (hab : Extends.{u,v} signature a b) (hbc : Extends.{u,v} signature b c) :
+    Extends.{u,v} signature a c := by
+  refine ⟨fun r entry h => hbc.lookup r entry (hab.lookup r entry h), ?_⟩
+  intro V _ constants hM
+  obtain ⟨constants', hM', hagree⟩ := hab.models V constants hM
+  obtain ⟨constants'', hM'', hagree'⟩ := hbc.models V constants' hM'
+  refine ⟨constants'', hM'', ?_⟩
+  intro r entry hr levels
+  exact (hagree' r entry (hab.lookup r entry hr) levels).trans (hagree r entry hr levels)
+
+/-- Admission checks and their universal extension theorem do not require a
+model of a deferred frontier. Every newly published entry has a checked source;
+an existing frontier entry retains its exact interface. -/
+structure CheckedExtension (signature : PrimitiveSignature β) (store : Store β)
+    (input : CheckedInterface signature) where
+  result : CheckedInterface signature
+  extension : Extends.{u,v} signature input.entries result.entries
+  source : ∀ r entry, result.entries r = some entry →
+    input.entries r = some entry ∨ EntrySource signature store r entry
+
+def CheckedExtension.refl {signature : PrimitiveSignature β} {store : Store β}
+    (input : CheckedInterface signature) : CheckedExtension.{u,v} signature store input :=
+  ⟨input, Extends.refl signature input.entries, fun _ _ h => Or.inl h⟩
+
+def CheckedExtension.trans {signature : PrimitiveSignature β} {store : Store β}
+    {input : CheckedInterface signature} (first : CheckedExtension.{u,v} signature store input)
+    (second : CheckedExtension.{u,v} signature store first.result) :
+    CheckedExtension.{u,v} signature store input where
+  result := second.result
+  extension := first.extension.trans second.extension
+  source := by
+    intro r entry h
+    rcases second.source r entry h with old | new
+    · exact first.source r entry old
+    · exact Or.inr new
+
+/-- A closed admission uses the same checked extension and supplies the model
+and source provenance constructed by its earlier successful admissions. -/
+def CheckedExtension.admit {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store)
+    (checked : CheckedExtension.{u,v} signature store state.interface) :
+    { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } :=
+  ⟨{
+    entries := checked.result.entries
+    wf := checked.result.wf
+    present := checked.result.present
+    source := by
+      intro r entry h
+      rcases checked.source r entry h with old | new
+      · exact state.source r entry old
+      · exact new
+    model := by
+      intro V _
+      obtain ⟨constants, hM⟩ := state.model V
+      obtain ⟨constants', hM', _⟩ := checked.extension.models V constants hM
+      exact ⟨constants', hM'⟩
+  }, checked.extension⟩
+
+def initialize? (signature : PrimitiveSignature β) (store : Store β) :
+    Option (AdmittedEnvironment.{u,v} signature store) :=
+  if h : signature.validate store = true then
+    some {
+      entries := signature.environment
+      wf := signature.environment_wf
+      present := signature.present_environment
+      source := by
+        intro r entry hr
+        have hv := (signature.validate_iff store).mp h
+        unfold PrimitiveSignature.environment at hr
+        split at hr
+        next he =>
+          subst r
+          cases Option.some.inj hr
+          exact Or.inl ⟨rfl, rfl, hv.1⟩
+        next =>
+          split at hr
+          next he =>
+            subst r
+            cases Option.some.inj hr
+            exact Or.inr (Or.inl ⟨rfl, rfl, hv.2⟩)
+          next => contradiction
+      model := fun V _ => ⟨signature.assignment, signature.compatible_assignment⟩
+    }
+  else none
+
+structure DefinitionWitness (β : Type u) where
+  ref : ConstRef β
+  typeAnnotations : AnnotationTree
+  bodyAnnotations : AnnotationTree
+  typeLevel : VLevel
+  typeWitness : TypingWitness β
+  bodyWitness : TypingWitness β
+
+def checkDefinitionExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : DefinitionWitness β) :
+    Option (CheckedExtension.{u,v} signature store state) :=
+  match hs : store.lookup witness.ref with
+  | none => none
+  | some source => do
+    let reading : { reading : DefinitionReading β // reading.erase = source } ←
+      readDefinition? source witness.typeAnnotations witness.bodyAnnotations
+    let entry := reading.val.entry
+    if fresh : state.entries witness.ref = none then
+      if hTr : reading.val.type.ReferencesIn state.entries then
+        if hBr : reading.val.body.ReferencesIn state.entries then do
+          let hT ← verifyType.{u,v} fuel reading.val.universes state.entries []
+            reading.val.type (.sort witness.typeLevel) witness.typeWitness
+          let hB ← verifyType.{u,v} fuel reading.val.universes state.entries []
+            reading.val.body reading.val.type witness.bodyWitness
+          have extension : Extends.{u,v} signature state.entries
+              (state.entries.insert witness.ref entry) := by
+            refine ⟨fun _ _ h => Environment.insert_old fresh h, ?_⟩
+            intro V _ constants hM
+            obtain ⟨constants', hM', hagree⟩ := extend_definition (entry := entry) state.wf fresh rfl rfl rfl
+              reading.val.bodyScope hTr hBr hT.down hB.down constants hM.realizes
+            exact ⟨constants', hM.extend signature state.present hM' hagree, hagree⟩
+          let result : CheckedInterface signature := {
+            entries := state.entries.insert witness.ref entry
+            wf := state.wf.insert reading.val.typeScope
+              (fun body hb => by cases Option.some.inj hb; exact reading.val.bodyScope)
+              hTr (fun body hb => by cases Option.some.inj hb; exact hBr)
+              (by simp [entry, DefinitionReading.entry])
+              (by simp [entry, DefinitionReading.entry])
+              (by simp [entry, DefinitionReading.entry])
+              (by simp [entry, DefinitionReading.entry])
+            present := state.present.insert signature fresh
+          }
+          return {
+            result, extension
+            source := by
+              intro r old h
+              dsimp only [result] at h
+              unfold Environment.insert at h
+              split at h
+              next hr =>
+                subst r
+                cases Option.some.inj h
+                refine Or.inr (Or.inr (Or.inr (Or.inl ⟨reading.val.kind, reading.val.body, rfl, rfl, rfl, ?_⟩)))
+                exact hs.trans (congrArg some reading.property.symm)
+              next => exact Or.inl h
+          }
+        else none
+      else none
+    else none
+
+def admitDefinition? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : DefinitionWitness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkDefinitionExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+def admitDefinitions? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) :
+    List (DefinitionWitness β) →
+      Option { result : AdmittedEnvironment.{u,v} signature store //
+        Extends.{u,v} signature state.entries result.entries }
+  | [] => some ⟨state, Extends.refl signature state.entries⟩
+  | witness :: rest => do
+    let step ← admitDefinition? fuel state witness
+    let rest ← admitDefinitions? fuel step.val rest
+    return ⟨rest.val, step.property.trans rest.property⟩
+
+theorem admitDefinition?_extends {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {state : AdmittedEnvironment.{u,v} signature store}
+    {witness : DefinitionWitness β} {result}
+    (_ : admitDefinition? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Basis/Equality.lean b/Ix/Theory/Certified/Basis/Equality.lean
new file mode 100644
index 000000000..bedac20da
--- /dev/null
+++ b/Ix/Theory/Certified/Basis/Equality.lean
@@ -0,0 +1,199 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Basis.Interface
+import Ix.Theory.Certified.Ordinary.Checked
+
+/-! Equality's meaning follows from the admitted former, reflexivity and
+dependent eliminator types, in every compatible model. It does not assume
+that an arbitrary prefix assignment is the model chosen by one producer. -/
+
+namespace Ix.Theory.Certified.Basis.Equality
+
+open Model Model.SetTheory Model.SetModel
+
+universe u v
+variable {β : Type u}
+
+def shape : Ordinary.Shape β :=
+  ⟨1, [.sort (.param 0), .bvar 0], [.bvar 1], .zero, [⟨[], [], [.bvar 0]⟩]⟩
+
+def type : AExpr β :=
+  .forallE .never (.sort (.param 0))
+    (.forallE .never (.bvar 0) (.forallE .never (.bvar 1) (.sort .zero)))
+
+def applied (family : ConstRef β) (l : VLevel) (A a b : AExpr β) : AExpr β :=
+  .appN (.const family [l]) [A, a, b]
+
+def reflexivity (refl : ConstRef β) (l : VLevel) (A a : AExpr β) : AExpr β :=
+  .appN (.const refl [l]) [A, a]
+
+def reflType (family : ConstRef β) : AExpr β :=
+  .forallE .always (.sort (.param 0)) (.forallE .always (.bvar 0)
+    (applied family (.param 0) (.bvar 1) (.bvar 0) (.bvar 0)))
+
+def recType (family refl : ConstRef β) : AExpr β :=
+  .forallE (.param 0) (.sort (.param 1)) <|
+  .forallE (.param 0) (.bvar 0) <|
+  .forallE (.param 0)
+    (.forallE .never (.bvar 1)
+      (.forallE .never (applied family (.param 1) (.bvar 2) (.bvar 1) (.bvar 0)) (.sort (.param 0)))) <|
+  .forallE (.param 0)
+    (.appN (.bvar 0) [.bvar 1, reflexivity refl (.param 1) (.bvar 2) (.bvar 1)]) <|
+  .forallE (.param 0) (.bvar 3) <|
+  .forallE (.param 0) (applied family (.param 1) (.bvar 4) (.bvar 3) (.bvar 0)) <|
+    .appN (.bvar 3) [.bvar 1, .bvar 0]
+
+structure Interface (entries : Environment β) (family refl recursor : ConstRef β) : Prop where
+  former : entries.HasType family 1 type
+  reflexivity : entries.HasType refl 1 (reflType family)
+  elimination : entries.HasType recursor 2 (recType family refl)
+
+instance [DecidableEq β] (entries : Environment β) (family refl recursor : ConstRef β) :
+    Decidable (Interface entries family refl recursor) :=
+  decidable_of_iff (entries.HasType family 1 type ∧ entries.HasType refl 1 (reflType family) ∧
+    entries.HasType recursor 2 (recType family refl))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2⟩, fun h => ⟨h.former, h.reflexivity, h.elimination⟩⟩
+
+theorem shape_type : (shape : Ordinary.Shape β).type = type := rfl
+
+theorem shape_reflType (source : β) :
+    (⟨[], [], [.bvar 0]⟩ : Ordinary.Constructor β).type shape source =
+      reflType (.member source 0) := rfl
+
+theorem shape_recType (source : β) : shape.recursorType source .large =
+    recType (.member source 0) (.ctor source 0 0) := rfl
+
+theorem Interface.of_checked [DecidableEq β] {entries : Environment β} {store : Store β} {source recursor : β}
+    (h : Ordinary.CheckedBlock.{u,v} entries store source recursor shape .large) :
+    Interface (shape.publishedEnvironment entries source recursor .large)
+      (.member source 0) (.ctor source 0 0) (.member recursor 0) := by
+  constructor
+  · refine ⟨shape.familyEntry, ?_, rfl, shape_type⟩
+    exact Environment.insert_old h.recursorChecked.fresh
+      (Environment.overlay_old (Ordinary.Shape.constructorEntries_fresh h.shapeChecked)
+        (Environment.insert_same ..))
+  · refine ⟨shape.constructorEntry source ⟨[], [], [.bvar 0]⟩, ?_, rfl, shape_reflType source⟩
+    apply Environment.insert_old h.recursorChecked.fresh
+    apply Environment.overlay_new
+    simp [Ordinary.Shape.constructorEntries, shape]
+  · exact ⟨shape.publishedRecursorEntry source recursor .large,
+      Environment.insert_same .., rfl, shape_recType source⟩
+
+theorem Interface.of_extension {entries next : Environment β} {family refl recursor : ConstRef β}
+    (h : Interface entries family refl recursor)
+    (hext : ∀ r entry, entries r = some entry → next r = some entry) :
+    Interface next family refl recursor := by
+  constructor
+  all_goals
+    first
+    | obtain ⟨entry, he, hn, ht⟩ := h.former
+      exact ⟨entry, hext _ _ he, hn, ht⟩
+    | obtain ⟨entry, he, hn, ht⟩ := h.reflexivity
+      exact ⟨entry, hext _ _ he, hn, ht⟩
+    | obtain ⟨entry, he, hn, ht⟩ := h.elimination
+      exact ⟨entry, hext _ _ he, hn, ht⟩
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def value (constants : Assignment β V) (family : ConstRef β)
+    (u : Nat) (A a b : V) : V := app (app (app (constants family [u]) A) a) b
+
+noncomputable def reflValue (constants : Assignment β V) (refl : ConstRef β)
+    (u : Nat) (A a : V) : V := app (app (constants refl [u]) A) a
+
+theorem type_interp (constants : Assignment β V) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (type : AExpr β) =
+      piR 1 (univ u) (fun A => piR 1 A (fun _ => piR 1 A (fun _ => univZero))) := by
+  simp [type, interp, VLevel.eval, Valuation.cons, univ_zero]
+
+theorem reflType_interp (constants : Assignment β V) (family : ConstRef β)
+    (u : Nat) (env : Nat → V) :
+    interp constants [u] env (reflType family) =
+      piR 0 (univ u) (fun A => piR 0 A (fun a => value constants family u A a a)) := by
+  simp [reflType, applied, AExpr.appN, value, interp, VLevel.eval, Valuation.cons]
+
+theorem recType_zero_interp (constants : Assignment β V) (family refl : ConstRef β)
+    (u : Nat) (env : Nat → V) :
+    interp constants [0, u] env (recType family refl) =
+      piR 0 (univ u) (fun A => piR 0 A (fun a =>
+        piR 0 (piR 1 A (fun b => piR 1 (value constants family u A a b) (fun _ => univZero)))
+          (fun motive => piR 0 (app (app motive a) (reflValue constants refl u A a))
+            (fun _ => piR 0 A (fun b => piR 0 (value constants family u A a b)
+              (fun h => app (app motive b) h)))))) := by
+  simp [recType, applied, reflexivity, AExpr.appN, value, reflValue, interp, VLevel.eval,
+    Valuation.cons, regime, PropWhen.param, PropWhen.holds, univ_zero]
+
+variable {entries : Environment β} {family refl recursor : ConstRef β}
+  {constants : Assignment β V}
+
+theorem value_mem_univZero (h : Interface entries family refl recursor) (hM : Realizes constants entries)
+    {u : Nat} {A a b : V} (hA : A ∈ˢ univ u) (ha : a ∈ˢ A) (hb : b ∈ˢ A) :
+    value constants family u A a b ∈ˢ univZero := by
+  have ht := h.former.member hM (levels := [u]) rfl (fun _ => empty)
+  rw [type_interp] at ht
+  have h1 : app (constants family [u]) A ∈ˢ
+      piR 1 A (fun _ => piR 1 A (fun _ => univZero)) :=
+    app_mem_piR_pos (by decide : 1 ≠ 0) ht hA
+  have h2 : app (app (constants family [u]) A) a ∈ˢ piR 1 A (fun _ => univZero) :=
+    app_mem_piR_pos (by decide : 1 ≠ 0) h1 ha
+  exact app_mem_piR_pos (by decide : 1 ≠ 0) h2 hb
+
+theorem reflValue_mem (h : Interface entries family refl recursor) (hM : Realizes constants entries)
+    {u : Nat} {A a : V} (hA : A ∈ˢ univ u) (ha : a ∈ˢ A) :
+    reflValue constants refl u A a ∈ˢ value constants family u A a a := by
+  have ht := h.reflexivity.member hM (levels := [u]) rfl (fun _ => empty)
+  rw [reflType_interp] at ht
+  have h1 : app (constants refl [u]) A ∈ˢ piR 0 A (fun x => value constants family u A x x) :=
+    app_mem_piR ht hA (fun _ _ _ => piR_zero_mem_univZero)
+  exact app_mem_piR (B := fun x => value constants family u A x x) h1 ha
+    (fun _ b hb => value_mem_univZero h hM hA hb hb)
+
+theorem exists_of_mem_piR_zero {A f a : V} {B : V → V}
+    (hf : f ∈ˢ piR 0 A B) (ha : a ∈ˢ A) : ∃ b, b ∈ˢ B a := by
+  rw [piR_zero] at hf
+  exact of_mem_truthVal hf a ha
+
+theorem eq_of_mem (h : Interface entries family refl recursor) (hM : Realizes constants entries)
+    {u : Nat} {A a b proof : V} (hA : A ∈ˢ univ u) (ha : a ∈ˢ A) (hb : b ∈ˢ A)
+    (hp : proof ∈ˢ value constants family u A a b) : a = b := by
+  let motive := lamR 1 A (fun b => lamR 1 (value constants family u A a b) (fun _ => eqv a b))
+  have hm : motive ∈ˢ piR 1 A (fun b =>
+      piR 1 (value constants family u A a b) (fun _ => univZero)) :=
+    lamR_mem fun _ _ => lamR_mem fun _ _ => eqv_mem_univZero _ _
+  have hbeta (x q : V) (hx : x ∈ˢ A) (hq : q ∈ˢ value constants family u A a x) :
+      app (app motive x) q = eqv a x := by
+    rw [app_lamR_pos (by decide : 1 ≠ 0) hx, app_lamR_pos (by decide : 1 ≠ 0) hq]
+  have hminor : (pt : V) ∈ˢ app (app motive a) (reflValue constants refl u A a) := by
+    rw [hbeta _ _ ha (reflValue_mem h hM hA ha)]
+    exact pt_mem_eqv_self _
+  have hr := h.elimination.member hM (levels := [0, u]) rfl (fun _ => empty)
+  rw [recType_zero_interp] at hr
+  obtain ⟨rA, hrA⟩ := exists_of_mem_piR_zero hr hA
+  obtain ⟨ra, hra⟩ := exists_of_mem_piR_zero hrA ha
+  obtain ⟨rm, hrm⟩ := exists_of_mem_piR_zero hra hm
+  obtain ⟨ri, hri⟩ := exists_of_mem_piR_zero hrm hminor
+  obtain ⟨rb, hrb⟩ := exists_of_mem_piR_zero hri hb
+  obtain ⟨result, hresult⟩ := exists_of_mem_piR_zero hrb hp
+  rw [hbeta _ _ hb hp] at hresult
+  exact eq_of_mem_eqv hresult
+
+/-- The prerequisite needed by standard axiom realizations is derived from
+admitted types. No equality-meaning oracle is added to the prefix model. -/
+theorem value_eq_eqv (h : Interface entries family refl recursor) (hM : Realizes constants entries)
+    {u : Nat} {A a b : V} (hA : A ∈ˢ univ u) (ha : a ∈ˢ A) (hb : b ∈ˢ A) :
+    value constants family u A a b = eqv a b := by
+  apply univZero_ext (value_mem_univZero h hM hA ha hb) (eqv_mem_univZero _ _)
+  · intro hp
+    have he := eq_of_mem h hM hA ha hb hp
+    subst b
+    exact pt_mem_eqv_self _
+  · intro hp
+    have he := eq_of_mem_eqv hp
+    subst b
+    have hr := reflValue_mem h hM hA ha
+    rwa [eq_pt_of_mem_univZero (value_mem_univZero h hM hA ha ha) hr] at hr
+
+end Ix.Theory.Certified.Basis.Equality
diff --git a/Ix/Theory/Certified/Basis/Iff.lean b/Ix/Theory/Certified/Basis/Iff.lean
new file mode 100644
index 000000000..e5209ba86
--- /dev/null
+++ b/Ix/Theory/Certified/Basis/Iff.lean
@@ -0,0 +1,171 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Basis.Equality
+
+namespace Ix.Theory.Certified.Basis.Iff
+
+open Model Model.SetTheory Model.SetModel
+
+universe u v
+variable {β : Type u}
+
+def arrow (P Q : AExpr β) : AExpr β := .forallE .always P (Q.liftN 1)
+
+def constructor : Ordinary.Constructor β :=
+  ⟨[arrow (.bvar 1) (.bvar 0), arrow (.bvar 1) (.bvar 2)], [], []⟩
+
+def shape : Ordinary.Shape β := ⟨0, [.sort .zero, .sort .zero], [], .zero, [constructor]⟩
+
+def type : AExpr β :=
+  .forallE .never (.sort .zero) (.forallE .never (.sort .zero) (.sort .zero))
+
+def applied (family : ConstRef β) (P Q : AExpr β) : AExpr β := .appN (.const family []) [P, Q]
+
+def introduction (ctor : ConstRef β) (P Q f g : AExpr β) : AExpr β :=
+  .appN (.const ctor []) [P, Q, f, g]
+
+def introType (family : ConstRef β) : AExpr β :=
+  .forallE .always (.sort .zero) <| .forallE .always (.sort .zero) <|
+  .forallE .always (arrow (.bvar 1) (.bvar 0)) <|
+  .forallE .always (arrow (.bvar 1) (.bvar 2)) <|
+    applied family (.bvar 3) (.bvar 2)
+
+def recType (family ctor : ConstRef β) : AExpr β :=
+  .forallE (.param 0) (.sort .zero) <| .forallE (.param 0) (.sort .zero) <|
+  .forallE (.param 0) (.forallE .never (applied family (.bvar 1) (.bvar 0)) (.sort (.param 0))) <|
+  .forallE (.param 0)
+    (.forallE (.param 0) (arrow (.bvar 2) (.bvar 1))
+      (.forallE (.param 0) (arrow (.bvar 2) (.bvar 3))
+        (.app (.bvar 2) (introduction ctor (.bvar 4) (.bvar 3) (.bvar 1) (.bvar 0))))) <|
+  .forallE (.param 0) (applied family (.bvar 3) (.bvar 2)) <|
+    .app (.bvar 2) (.bvar 0)
+
+structure Interface (entries : Environment β) (family ctor recursor : ConstRef β) : Prop where
+  former : entries.HasType family 0 type
+  introduction : entries.HasType ctor 0 (introType family)
+  elimination : entries.HasType recursor 1 (recType family ctor)
+
+instance [DecidableEq β] (entries : Environment β) (family ctor recursor : ConstRef β) :
+    Decidable (Interface entries family ctor recursor) :=
+  decidable_of_iff (entries.HasType family 0 type ∧ entries.HasType ctor 0 (introType family) ∧
+    entries.HasType recursor 1 (recType family ctor))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2⟩, fun h => ⟨h.former, h.introduction, h.elimination⟩⟩
+
+theorem shape_type : (shape : Ordinary.Shape β).type = type := rfl
+theorem shape_introType (source : β) : constructor.type shape source = introType (.member source 0) := rfl
+theorem shape_recType (source : β) : shape.recursorType source .large =
+    recType (.member source 0) (.ctor source 0 0) := rfl
+
+theorem Interface.of_checked [DecidableEq β] {entries : Environment β} {store : Store β} {source recursor : β}
+    (h : Ordinary.CheckedBlock.{u,v} entries store source recursor shape .large) :
+    Interface (shape.publishedEnvironment entries source recursor .large)
+      (.member source 0) (.ctor source 0 0) (.member recursor 0) := by
+  constructor
+  · refine ⟨shape.familyEntry, ?_, rfl, shape_type⟩
+    exact Environment.insert_old h.recursorChecked.fresh
+      (Environment.overlay_old (Ordinary.Shape.constructorEntries_fresh h.shapeChecked)
+        (Environment.insert_same ..))
+  · refine ⟨shape.constructorEntry source constructor, ?_, rfl, shape_introType source⟩
+    apply Environment.insert_old h.recursorChecked.fresh
+    apply Environment.overlay_new
+    simp [Ordinary.Shape.constructorEntries, shape]
+  · exact ⟨shape.publishedRecursorEntry source recursor .large,
+      Environment.insert_same .., rfl, shape_recType source⟩
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def implication (P Q : V) : V := piR 0 P (fun _ => Q)
+noncomputable def value (constants : Assignment β V) (family : ConstRef β) (P Q : V) : V :=
+  app (app (constants family []) P) Q
+noncomputable def introValue (constants : Assignment β V) (ctor : ConstRef β) (P Q f g : V) : V :=
+  app (app (app (app (constants ctor []) P) Q) f) g
+
+theorem type_interp (constants : Assignment β V) (env : Nat → V) :
+    interp constants [] env (type : AExpr β) =
+      piR 1 univZero (fun _ => piR 1 univZero (fun _ => univZero)) := by
+  simp [type, interp, VLevel.eval, univ_zero]
+
+theorem introType_interp (constants : Assignment β V) (family : ConstRef β) (env : Nat → V) :
+    interp constants [] env (introType family) =
+      piR 0 univZero (fun P => piR 0 univZero (fun Q =>
+        piR 0 (implication P Q) (fun _ => piR 0 (implication Q P) (fun _ => value constants family P Q)))) := by
+  simp [introType, arrow, applied, implication, value, AExpr.appN, AExpr.liftN, liftVar,
+    interp, VLevel.eval, Valuation.cons, univ_zero]
+
+theorem recType_zero_interp (constants : Assignment β V) (family ctor : ConstRef β) (env : Nat → V) :
+    interp constants [0] env (recType family ctor) =
+      piR 0 univZero (fun P => piR 0 univZero (fun Q =>
+        piR 0 (piR 1 (value constants family P Q) (fun _ => univZero)) (fun motive =>
+          piR 0 (piR 0 (implication P Q) (fun f => piR 0 (implication Q P)
+            (fun g => app motive (introValue constants ctor P Q f g))))
+          (fun _ => piR 0 (value constants family P Q) (fun h => app motive h))))) := by
+  simp [recType, arrow, applied, introduction, implication, value, introValue,
+    AExpr.appN, AExpr.liftN, liftVar, interp, VLevel.eval, Valuation.cons, regime,
+    PropWhen.param, PropWhen.always, PropWhen.holds, univ_zero]
+
+variable {entries : Environment β} {family ctor recursor : ConstRef β}
+  {constants : Assignment β V}
+
+theorem value_mem_univZero (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {P Q : V} (hP : P ∈ˢ univZero) (hQ : Q ∈ˢ univZero) :
+    value constants family P Q ∈ˢ univZero := by
+  have ht := h.former.member hM (levels := []) rfl (fun _ => empty)
+  rw [type_interp] at ht
+  have h1 : app (constants family []) P ∈ˢ piR 1 univZero (fun _ => univZero) :=
+    app_mem_piR_pos (by decide : 1 ≠ 0) ht hP
+  exact app_mem_piR_pos (by decide : 1 ≠ 0) h1 hQ
+
+theorem introValue_mem (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {P Q f g : V} (hP : P ∈ˢ univZero) (hQ : Q ∈ˢ univZero)
+    (hf : f ∈ˢ implication P Q) (hg : g ∈ˢ implication Q P) :
+    introValue constants ctor P Q f g ∈ˢ value constants family P Q := by
+  have ht := h.introduction.member hM (levels := []) rfl (fun _ => empty)
+  rw [introType_interp] at ht
+  have h1 := app_mem_piR ht hP (fun _ _ _ => piR_zero_mem_univZero)
+  have h2 := app_mem_piR h1 hQ (fun _ _ _ => piR_zero_mem_univZero)
+  have h3 := app_mem_piR h2 hf (fun _ _ _ => piR_zero_mem_univZero)
+  exact app_mem_piR h3 hg (fun _ _ _ => value_mem_univZero h hM hP hQ)
+
+theorem eliminate (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {P Q C proof : V} (hP : P ∈ˢ univZero) (hQ : Q ∈ˢ univZero) (hC : C ∈ˢ univZero)
+    (minor : ∀ f, f ∈ˢ implication P Q → ∀ g, g ∈ˢ implication Q P → (pt : V) ∈ˢ C)
+    (hp : proof ∈ˢ value constants family P Q) : (pt : V) ∈ˢ C := by
+  let motive := lamR 1 (value constants family P Q) (fun _ => C)
+  have hm : motive ∈ˢ piR 1 (value constants family P Q) (fun _ => univZero) :=
+    lamR_mem fun _ _ => hC
+  let minorValue := lamR 0 (implication P Q) (fun _ => lamR 0 (implication Q P) (fun _ => pt))
+  have hminor : minorValue ∈ˢ piR 0 (implication P Q) (fun f => piR 0 (implication Q P)
+      (fun g => app motive (introValue constants ctor P Q f g))) := by
+    apply lamR_mem
+    intro f hf
+    apply lamR_mem
+    intro g hg
+    rw [app_lamR_pos (by decide : 1 ≠ 0) (introValue_mem h hM hP hQ hf hg)]
+    exact minor f hf g hg
+  have hr := h.elimination.member hM (levels := [0]) rfl (fun _ => empty)
+  rw [recType_zero_interp] at hr
+  obtain ⟨rP, hrP⟩ := Equality.exists_of_mem_piR_zero hr hP
+  obtain ⟨rQ, hrQ⟩ := Equality.exists_of_mem_piR_zero hrP hQ
+  obtain ⟨rm, hrm⟩ := Equality.exists_of_mem_piR_zero hrQ hm
+  obtain ⟨ri, hri⟩ := Equality.exists_of_mem_piR_zero hrm hminor
+  obtain ⟨result, hresult⟩ := Equality.exists_of_mem_piR_zero hri hp
+  rw [app_lamR_pos (by decide : 1 ≠ 0) hp] at hresult
+  rwa [eq_pt_of_mem_univZero hC hresult] at hresult
+
+theorem eq_of_mem (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {P Q proof : V} (hP : P ∈ˢ univZero) (hQ : Q ∈ˢ univZero)
+    (hp : proof ∈ˢ value constants family P Q) : P = Q := by
+  have hf : (pt : V) ∈ˢ implication P Q := eliminate h hM hP hQ piR_zero_mem_univZero
+    (fun f hf _ _ => by rwa [eq_pt_of_mem_piR_zero hf] at hf) hp
+  have hg : (pt : V) ∈ˢ implication Q P := eliminate h hM hP hQ piR_zero_mem_univZero
+    (fun _ _ g hg => by rwa [eq_pt_of_mem_piR_zero hg] at hg) hp
+  apply univZero_ext hP hQ
+  · intro hpt
+    simpa only [app_pt] using app_mem_piR hf hpt (fun _ _ _ => hQ)
+  · intro hpt
+    simpa only [app_pt] using app_mem_piR hg hpt (fun _ _ _ => hP)
+
+end Ix.Theory.Certified.Basis.Iff
diff --git a/Ix/Theory/Certified/Basis/Interface.lean b/Ix/Theory/Certified/Basis/Interface.lean
new file mode 100644
index 000000000..761e3ce2e
--- /dev/null
+++ b/Ix/Theory/Certified/Basis/Interface.lean
@@ -0,0 +1,38 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Environment
+
+namespace Ix.Theory.Model.Environment
+
+open SetTheory
+
+universe u v
+variable {β : Type u}
+
+/-- An exact type interface read from an already admitted entry. Bodies and
+equations remain those of that entry; this predicate grants no admission. -/
+def HasType (entries : Environment β) (ref : ConstRef β) (n : Nat) (type : AExpr β) : Prop :=
+  ∃ entry, entries ref = some entry ∧ entry.universes = n ∧ entry.type = type
+
+instance [DecidableEq β] (entries : Environment β) (ref : ConstRef β) (n : Nat) (type : AExpr β) :
+    Decidable (entries.HasType ref n type) :=
+  match h : entries ref with
+  | none => .isFalse (by rintro ⟨entry, he, _⟩; simp [h] at he)
+  | some entry =>
+    if he : entry.universes = n ∧ entry.type = type then
+      .isTrue ⟨entry, h, he⟩
+    else .isFalse (by rintro ⟨other, ho, hu, ht⟩; cases h.symm.trans ho; exact he ⟨hu, ht⟩)
+
+variable {V : Type v} [SetTheory V] {constants : Assignment β V} {entries : Environment β}
+
+theorem HasType.member {ref : ConstRef β} {n : Nat} {type : AExpr β}
+    (h : entries.HasType ref n type) (hM : Realizes constants entries)
+    {levels : List Nat} (hn : levels.length = n) (env : Nat → V) :
+    constants ref levels ∈ˢ interp constants levels env type := by
+  obtain ⟨entry, he, rfl, rfl⟩ := h
+  exact hM.member ref entry he levels hn env
+
+end Ix.Theory.Model.Environment
diff --git a/Ix/Theory/Certified/Basis/Nonempty.lean b/Ix/Theory/Certified/Basis/Nonempty.lean
new file mode 100644
index 000000000..e371e006e
--- /dev/null
+++ b/Ix/Theory/Certified/Basis/Nonempty.lean
@@ -0,0 +1,138 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Basis.Equality
+
+namespace Ix.Theory.Certified.Basis.Nonempty
+
+open Model Model.SetTheory Model.SetModel
+
+universe u v
+variable {β : Type u}
+
+def constructor : Ordinary.Constructor β := ⟨[.bvar 0], [], []⟩
+def shape : Ordinary.Shape β := ⟨1, [.sort (.param 0)], [], .zero, [constructor]⟩
+def type : AExpr β := .forallE .never (.sort (.param 0)) (.sort .zero)
+def applied (family : ConstRef β) (l : VLevel) (A : AExpr β) : AExpr β := .app (.const family [l]) A
+def introduction (ctor : ConstRef β) (l : VLevel) (A a : AExpr β) : AExpr β :=
+  .appN (.const ctor [l]) [A, a]
+def introType (family : ConstRef β) : AExpr β :=
+  .forallE .always (.sort (.param 0)) (.forallE .always (.bvar 0) (applied family (.param 0) (.bvar 1)))
+def recType (family ctor : ConstRef β) : AExpr β :=
+  .forallE .always (.sort (.param 0)) <|
+  .forallE .always (.forallE .never (applied family (.param 0) (.bvar 0)) (.sort .zero)) <|
+  .forallE .always
+    (.forallE .always (.bvar 1)
+      (.app (.bvar 1) (introduction ctor (.param 0) (.bvar 2) (.bvar 0)))) <|
+  .forallE .always (applied family (.param 0) (.bvar 2)) <|
+    .app (.bvar 2) (.bvar 0)
+
+structure Interface (entries : Environment β) (family ctor recursor : ConstRef β) : Prop where
+  former : entries.HasType family 1 type
+  introduction : entries.HasType ctor 1 (introType family)
+  elimination : entries.HasType recursor 1 (recType family ctor)
+
+instance [DecidableEq β] (entries : Environment β) (family ctor recursor : ConstRef β) :
+    Decidable (Interface entries family ctor recursor) :=
+  decidable_of_iff (entries.HasType family 1 type ∧ entries.HasType ctor 1 (introType family) ∧
+    entries.HasType recursor 1 (recType family ctor))
+    ⟨fun h => ⟨h.1, h.2.1, h.2.2⟩, fun h => ⟨h.former, h.introduction, h.elimination⟩⟩
+
+theorem shape_type : (shape : Ordinary.Shape β).type = type := rfl
+theorem shape_introType (source : β) : constructor.type shape source = introType (.member source 0) := rfl
+theorem shape_recType (source : β) : shape.recursorType source .small =
+    recType (.member source 0) (.ctor source 0 0) := rfl
+
+theorem Interface.of_checked [DecidableEq β] {entries : Environment β} {store : Store β} {source recursor : β}
+    (h : Ordinary.CheckedBlock.{u,v} entries store source recursor shape .small) :
+    Interface (shape.publishedEnvironment entries source recursor .small)
+      (.member source 0) (.ctor source 0 0) (.member recursor 0) := by
+  constructor
+  · refine ⟨shape.familyEntry, ?_, rfl, shape_type⟩
+    exact Environment.insert_old h.recursorChecked.fresh
+      (Environment.overlay_old (Ordinary.Shape.constructorEntries_fresh h.shapeChecked)
+        (Environment.insert_same ..))
+  · refine ⟨shape.constructorEntry source constructor, ?_, rfl, shape_introType source⟩
+    apply Environment.insert_old h.recursorChecked.fresh
+    apply Environment.overlay_new
+    simp [Ordinary.Shape.constructorEntries, shape]
+  · exact ⟨shape.publishedRecursorEntry source recursor .small,
+      Environment.insert_same .., rfl, shape_recType source⟩
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def value (constants : Assignment β V) (family : ConstRef β) (u : Nat) (A : V) : V :=
+  app (constants family [u]) A
+noncomputable def introValue (constants : Assignment β V) (ctor : ConstRef β) (u : Nat) (A a : V) : V :=
+  app (app (constants ctor [u]) A) a
+
+theorem type_interp (constants : Assignment β V) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (type : AExpr β) = piR 1 (univ u) (fun _ => univZero) := by
+  simp [type, interp, VLevel.eval, univ_zero]
+
+theorem introType_interp (constants : Assignment β V) (family : ConstRef β) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (introType family) =
+      piR 0 (univ u) (fun A => piR 0 A (fun _ => value constants family u A)) := by
+  simp [introType, applied, value, interp, VLevel.eval, Valuation.cons]
+
+theorem recType_interp (constants : Assignment β V) (family ctor : ConstRef β) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (recType family ctor) =
+      piR 0 (univ u) (fun A =>
+        piR 0 (piR 1 (value constants family u A) (fun _ => univZero)) (fun motive =>
+          piR 0 (piR 0 A (fun a => app motive (introValue constants ctor u A a)))
+            (fun _ => piR 0 (value constants family u A) (fun h => app motive h)))) := by
+  simp [recType, applied, introduction, value, introValue, AExpr.appN, interp,
+    VLevel.eval, Valuation.cons, univ_zero]
+
+variable {entries : Environment β} {family ctor recursor : ConstRef β}
+  {constants : Assignment β V}
+
+theorem value_mem_univZero (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {u : Nat} {A : V} (hA : A ∈ˢ univ u) : value constants family u A ∈ˢ univZero := by
+  have ht := h.former.member hM (levels := [u]) rfl (fun _ => empty)
+  rw [type_interp] at ht
+  exact app_mem_piR_pos (by decide : 1 ≠ 0) ht hA
+
+theorem introValue_mem (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {u : Nat} {A a : V} (hA : A ∈ˢ univ u) (ha : a ∈ˢ A) :
+    introValue constants ctor u A a ∈ˢ value constants family u A := by
+  have ht := h.introduction.member hM (levels := [u]) rfl (fun _ => empty)
+  rw [introType_interp] at ht
+  have h1 := app_mem_piR ht hA (fun _ _ _ => piR_zero_mem_univZero)
+  exact app_mem_piR h1 ha (fun _ _ _ => value_mem_univZero h hM hA)
+
+theorem exists_of_mem (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {u : Nat} {A proof : V} (hA : A ∈ˢ univ u) (hp : proof ∈ˢ value constants family u A) :
+    ∃ a, a ∈ˢ A := by
+  let C : V := truthVal (∃ a, a ∈ˢ A)
+  let motive := lamR 1 (value constants family u A) (fun _ => C)
+  have hm : motive ∈ˢ piR 1 (value constants family u A) (fun _ => univZero) :=
+    lamR_mem fun _ _ => truthVal_mem_univZero _
+  let minor := lamR 0 A (fun _ => pt)
+  have hminor : minor ∈ˢ piR 0 A (fun a => app motive (introValue constants ctor u A a)) := by
+    apply lamR_mem
+    intro a ha
+    rw [app_lamR_pos (by decide : 1 ≠ 0) (introValue_mem h hM hA ha)]
+    exact pt_mem_truthVal ⟨a, ha⟩
+  have hr := h.elimination.member hM (levels := [u]) rfl (fun _ => empty)
+  rw [recType_interp] at hr
+  obtain ⟨rA, hrA⟩ := Equality.exists_of_mem_piR_zero hr hA
+  obtain ⟨rm, hrm⟩ := Equality.exists_of_mem_piR_zero hrA hm
+  obtain ⟨ri, hri⟩ := Equality.exists_of_mem_piR_zero hrm hminor
+  obtain ⟨result, hresult⟩ := Equality.exists_of_mem_piR_zero hri hp
+  rw [app_lamR_pos (by decide : 1 ≠ 0) hp] at hresult
+  exact of_mem_truthVal hresult
+
+theorem value_eq_truthVal (h : Interface entries family ctor recursor) (hM : Realizes constants entries)
+    {u : Nat} {A : V} (hA : A ∈ˢ univ u) :
+    value constants family u A = truthVal (∃ a, a ∈ˢ A) := by
+  apply univZero_ext (value_mem_univZero h hM hA) (truthVal_mem_univZero _)
+  · exact fun hp => pt_mem_truthVal (exists_of_mem h hM hA hp)
+  · intro hp
+    obtain ⟨a, ha⟩ := of_mem_truthVal hp
+    have hc := introValue_mem h hM hA ha
+    rwa [eq_pt_of_mem_univZero (value_mem_univZero h hM hA) hc] at hc
+
+end Ix.Theory.Certified.Basis.Nonempty
diff --git a/Ix/Theory/Certified/Checker.lean b/Ix/Theory/Certified/Checker.lean
new file mode 100644
index 000000000..c2a2aa7d2
--- /dev/null
+++ b/Ix/Theory/Certified/Checker.lean
@@ -0,0 +1,316 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Judgment
+import Ix.Theory.Certified.LevelEq
+
+/-!
+# Executable validation of dependent-function certificates
+
+Witnesses are untrusted trees of rule choices and intermediate syntax. The
+validator checks their exact endpoints, scopes, annotations, and dependency
+lookups. Every recursive success constructs its semantic proof through the
+rule theorems; no semantic proof is an input. Exhausted fuel and unsupported
+syntax fail. Proof fields in successful results are erased during execution.
+-/
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+
+/-- An erased result at the data universe of the checked syntax. This permits
+the proof-producing validator to compose with declaration readers. -/
+structure CheckedClaim (claim : Prop) : Type u where
+  down : claim
+
+mutual
+inductive TypingWitness (β : Type u) where
+  | sort
+  | bvar
+  | const
+  | app (condition : PropWhen) (domain codomain : AExpr β)
+      (fn arg : TypingWitness β)
+  | lam (domainLevel codomainLevel : VLevel) (codomain : AExpr β)
+      (domainType codomainType body : TypingWitness β)
+  | forallE (domainLevel codomainLevel : VLevel)
+      (domainType codomainType : TypingWitness β)
+  | conv (intermediate : AExpr β) (targetLevel : VLevel)
+      (term target : TypingWitness β) (conversion : ConversionWitness β)
+  | fact (ref : ConstRef β) (index : Nat) (levels : List VLevel)
+  | natLit (ref : ConstRef β) (index : Nat)
+  | betaResult (condition : PropWhen) (domain body argument codomain : AExpr β)
+      (lambda argumentWitness : TypingWitness β)
+
+inductive ConversionWitness (β : Type u) where
+  | refl
+  | symm (proof : ConversionWitness β)
+  | trans (middle : AExpr β) (left right : ConversionWitness β)
+  | app (fn arg : ConversionWitness β)
+  | lam (domainLevel : VLevel) (domainType : TypingWitness β)
+      (domain body : ConversionWitness β)
+  | forallE (domainLevel : VLevel) (domainType : TypingWitness β)
+      (domain body : ConversionWitness β)
+  | beta (lambdaType : AExpr β) (lambda arg : TypingWitness β)
+  | eta (codomain : AExpr β) (fn : TypingWitness β)
+  | proofIrrel (type : AExpr β) (typeProof left right : TypingWitness β)
+  | delta
+  | sort
+  | equation (ref : ConstRef β) (index : Nat) (levels : List VLevel)
+  | natLiteral (ref : ConstRef β) (index : Nat)
+  | proj (major : ConversionWitness β)
+end
+
+variable {β : Type u} [DecidableEq β]
+
+mutual
+def verifyType (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (e A : AExpr β) (witness : TypingWitness β) :
+    Option (CheckedClaim.{u} (TypingClaim.{u,v} entries Γ e A)) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    if e.Scope n Γ.length ∧ A.Scope n Γ.length then
+      match e, witness with
+      | .sort l, .sort =>
+        if h : A = .sort (.succ l) then
+          some ⟨by subst A; exact TypingClaim.sort l⟩
+        else none
+      | .bvar i, .bvar =>
+        match h : Γ[i]? with
+        | none => none
+        | some B =>
+          if hA : A = B then some ⟨by subst A; exact TypingClaim.bvar h⟩ else none
+      | .const r ls, .const =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          if hn : ls.length = entry.universes then
+            if hA : A = entry.type.instL ls then
+              some ⟨by subst A; exact TypingClaim.const h hn⟩
+            else none
+          else none
+      | .app f a, .app p D B wf wa =>
+        if hA : A = B.inst a then do
+          let hf ← verifyType fuel n entries Γ f (.forallE p D B) wf
+          let ha ← verifyType fuel n entries Γ a D wa
+          return ⟨by subst A; exact TypingClaim.app hf.down ha.down⟩
+        else none
+      | .lam p D body, .lam lD lB B wD wB wb =>
+        if hp : p = zeroCondition lB then
+          if hA : A = .forallE p D B then do
+            let hD ← verifyType fuel n entries Γ D (.sort lD) wD
+            let hB ← verifyType fuel n entries (Γ.push D) B (.sort lB) wB
+            let hb ← verifyType fuel n entries (Γ.push D) body B wb
+            return ⟨by subst A; exact TypingClaim.lam hD.down hB.down hb.down hp⟩
+          else none
+        else none
+      | .forallE p D B, .forallE lD lB wD wB =>
+        if hp : p = zeroCondition lB then
+          if hA : A = .sort (.imax lD lB) then do
+            let hD ← verifyType fuel n entries Γ D (.sort lD) wD
+            let hB ← verifyType fuel n entries (Γ.push D) B (.sort lB) wB
+            return ⟨by subst A; exact TypingClaim.forallE hD.down hB.down hp⟩
+          else none
+        else none
+      | e, .conv B lA we wA wc => do
+        let he ← verifyType fuel n entries Γ e B we
+        let hA ← verifyType fuel n entries Γ A (.sort lA) wA
+        let hc ← verifyConversion fuel n entries Γ B A wc
+        return ⟨TypingClaim.conv he.down hA.down hc.down⟩
+      | e, .fact r index ls =>
+        match hr : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (.typed value type) =>
+            if hn : ls.length = entry.universes then
+              if ∀ l ∈ ls, l.WF n then
+                if he : e = value.instL ls then
+                  if hA : A = type.instL ls then
+                    some ⟨by subst e A; exact TypingClaim.fact hr (List.mem_of_getElem? hf) hn⟩
+                  else none
+                else none
+              else none
+            else none
+          | _ => none
+      | .natLit value, .natLit r index =>
+        match hr : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (.natural _ _) =>
+            if hn : entry.universes = 0 then
+              if hA : A = .const r [] then
+                some ⟨by subst A; exact TypingClaim.natLit hr (List.mem_of_getElem? hf) hn value⟩
+              else none
+            else none
+          | _ => none
+      | e, .betaResult p D body arg B wl wa =>
+        if he : e = body.inst arg then
+          if hA : A = B.inst arg then do
+            let hl ← verifyType fuel n entries Γ (.lam p D body) (.forallE p D B) wl
+            let ha ← verifyType fuel n entries Γ arg D wa
+            return ⟨by subst e A; exact TypingClaim.betaResult hl.down ha.down⟩
+          else none
+        else none
+      | _, _ => none
+    else none
+
+def verifyConversion (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (a b : AExpr β) (witness : ConversionWitness β) :
+    Option (CheckedClaim.{u} (ConversionClaim.{u,v} entries Γ a b)) :=
+  match fuel with
+  | 0 => none
+  | fuel + 1 =>
+    if a.Scope n Γ.length ∧ b.Scope n Γ.length then
+      match a, b, witness with
+      | a, b, .refl =>
+        if h : a = b then some ⟨by subst b; exact ConversionClaim.refl a⟩ else none
+      | a, b, .symm w => do
+        let h ← verifyConversion fuel n entries Γ b a w
+        return ⟨ConversionClaim.symm h.down⟩
+      | a, b, .trans c w₁ w₂ => do
+        let h₁ ← verifyConversion fuel n entries Γ a c w₁
+        let h₂ ← verifyConversion fuel n entries Γ c b w₂
+        return ⟨ConversionClaim.trans h₁.down h₂.down⟩
+      | .app f a, .app f' a', .app wf wa => do
+        let hf ← verifyConversion fuel n entries Γ f f' wf
+        let ha ← verifyConversion fuel n entries Γ a a' wa
+        return ⟨ConversionClaim.app hf.down ha.down⟩
+      | .proj r i a, .proj r' i' b, .proj w =>
+        if hr : r = r' then
+          if hi : i = i' then do
+            let h ← verifyConversion fuel n entries Γ a b w
+            return ⟨by subst r' i'; exact ConversionClaim.proj h.down⟩
+          else none
+        else none
+      | .lam p D body, .lam p' D' body', .lam lD wD wd wb =>
+        if hp : p = p' then do
+          let hD ← verifyType fuel n entries Γ D (.sort lD) wD
+          let hd ← verifyConversion fuel n entries Γ D D' wd
+          let hb ← verifyConversion fuel n entries (Γ.push D) body body' wb
+          return ⟨by subst p'; exact ConversionClaim.lam hD.down hd.down hb.down⟩
+        else none
+      | .forallE p D B, .forallE p' D' B', .forallE lD wD wd wb =>
+        if hp : p = p' then do
+          let hD ← verifyType fuel n entries Γ D (.sort lD) wD
+          let hd ← verifyConversion fuel n entries Γ D D' wd
+          let hb ← verifyConversion fuel n entries (Γ.push D) B B' wb
+          return ⟨by subst p'; exact ConversionClaim.forallE hD.down hd.down hb.down⟩
+        else none
+      | .app (.lam p D body) arg, result, .beta T wl wa =>
+        if hr : result = body.inst arg then do
+          let hl ← verifyType fuel n entries Γ (.lam p D body) T wl
+          let ha ← verifyType fuel n entries Γ arg D wa
+          return ⟨by subst result; exact ConversionClaim.beta hl.down ha.down⟩
+        else none
+      | .lam p D body, f, .eta B wf =>
+        if hb : body = .app (f.liftN 1) (.bvar 0) then do
+          let hf ← verifyType fuel n entries Γ f (.forallE p D B) wf
+          return ⟨by subst body; exact ConversionClaim.eta hf.down⟩
+        else none
+      | a, b, .proofIrrel A wA wa wb => do
+        let hA ← verifyType fuel n entries Γ A (.sort .zero) wA
+        let ha ← verifyType fuel n entries Γ a A wa
+        let hb ← verifyType fuel n entries Γ b A wb
+        return ⟨ConversionClaim.proofIrrel hA.down ha.down hb.down⟩
+      | .const r ls, b, .delta =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hb : entry.body with
+          | none => none
+          | some body =>
+            if hn : ls.length = entry.universes then
+              if hB : b = body.instL ls then
+                some ⟨by subst b; exact ConversionClaim.delta h hb hn⟩
+              else none
+            else none
+      | .sort l, .sort l', .sort =>
+        if h : LevelEq.check n l l' = true then
+          some ⟨ConversionClaim.sort (LevelEq.check_sound h).2.2⟩
+        else none
+      | a, b, .equation r index ls =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match he : entry.equations[index]? with
+          | none => none
+          | some law =>
+            if hn : ls.length = entry.universes then
+              if hls : ∀ l ∈ ls, l.WF n then
+                if ha : a = law.lhs.instL ls then
+                  if hb : b = law.rhs.instL ls then
+                    some ⟨by
+                      subst a b
+                      exact ConversionClaim.equation h (List.mem_of_getElem? he) hn⟩
+                  else none
+                else none
+              else none
+            else none
+      | .natLit value, result, .natLiteral r index =>
+        match hr : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (.natural zero succ) =>
+            if hn : entry.universes = 0 then
+              match value with
+              | 0 =>
+                if he : result = .const zero [] then
+                  some ⟨by subst result; exact ConversionClaim.natZero hr (List.mem_of_getElem? hf) hn⟩
+                else none
+              | value + 1 =>
+                if he : result = .app (.const succ []) (.natLit value) then
+                  some ⟨by subst result; exact ConversionClaim.natSucc hr (List.mem_of_getElem? hf) hn value⟩
+                else none
+            else none
+          | _ => none
+      | _, _, _ => none
+    else none
+end
+
+/-- Soundness is extracted only from an actual successful execution. The
+dependency model and context are the documented local preconditions; the
+closed acceptance producer must construct them. -/
+theorem verifyType_sound {fuel n : Nat} {entries : Environment β} {Γ : Context β}
+    {e A : AExpr β} {witness : TypingWitness β} {result}
+    (_ : verifyType.{u,v} fuel n entries Γ e A witness = some result) :
+    TypingClaim.{u,v} entries Γ e A := result.down
+
+theorem verifyConversion_sound {fuel n : Nat} {entries : Environment β} {Γ : Context β}
+    {a b : AExpr β} {witness : ConversionWitness β} {result}
+    (_ : verifyConversion.{u,v} fuel n entries Γ a b witness = some result) :
+    ConversionClaim.{u,v} entries Γ a b := result.down
+
+def checkTypeCertified (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (e A : AExpr β) (witness : TypingWitness β) : Bool :=
+  (verifyType.{u,v} fuel n entries Γ e A witness).isSome
+
+def defeqCertified (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (a b : AExpr β) (witness : ConversionWitness β) : Bool :=
+  (verifyConversion.{u,v} fuel n entries Γ a b witness).isSome
+
+theorem checkTypeCertified_sound {fuel n : Nat} {entries : Environment β}
+    {Γ : Context β} {e A : AExpr β} {witness : TypingWitness β}
+    (h : checkTypeCertified.{u,v} fuel n entries Γ e A witness = true) :
+    TypingClaim.{u,v} entries Γ e A := by
+  unfold checkTypeCertified at h
+  cases hr : verifyType.{u,v} fuel n entries Γ e A witness with
+  | none => simp [hr] at h
+  | some result => exact result.down
+
+theorem defeqCertified_sound {fuel n : Nat} {entries : Environment β}
+    {Γ : Context β} {a b : AExpr β} {witness : ConversionWitness β}
+    (h : defeqCertified.{u,v} fuel n entries Γ a b witness = true) :
+    ConversionClaim.{u,v} entries Γ a b := by
+  unfold defeqCertified at h
+  cases hr : verifyConversion.{u,v} fuel n entries Γ a b witness with
+  | none => simp [hr] at h
+  | some result => exact result.down
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/ClaimComposition.lean b/Ix/Theory/Certified/ClaimComposition.lean
new file mode 100644
index 000000000..9c7c05420
--- /dev/null
+++ b/Ix/Theory/Certified/ClaimComposition.lean
@@ -0,0 +1,245 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Claims
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+theorem mem_outstanding {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {nodes : List (CheckedNode.{u,v} fuel signature store)} {ref : ConstRef β} :
+    ref ∈ outstanding nodes ↔ ref ∈ nodeFrontiers nodes ∧ ref ∉ nodeSubjects nodes := by
+  simp [outstanding]
+
+theorem CheckedBatch.exact_subjects {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) :
+    nodeSubjects batch.nodes = inputs.flatMap (·.subjects) := by
+  have h := congrArg (fun nodes => nodes.flatMap (·.subjects)) batch.exactNodes
+  simpa only [nodeSubjects, List.flatMap_map, Function.comp_def] using h
+
+theorem CheckedBatch.exact_frontiers {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) :
+    nodeFrontiers batch.nodes = inputs.flatMap (fun node => node.frontier.map (·.ref)) := by
+  calc
+    nodeFrontiers batch.nodes = batch.nodes.flatMap (fun node => node.input.frontier.map (·.ref)) := by
+      exact congrArg (fun f => batch.nodes.flatMap f) (funext fun node => node.frontier_refs)
+    _ = inputs.flatMap (fun node => node.frontier.map (·.ref)) := by
+      simpa only [List.flatMap_map, Function.comp_def] using
+        congrArg (fun nodes => nodes.flatMap (fun node => node.frontier.map (·.ref))) batch.exactNodes
+
+theorem CheckedBatch.frontier_coverage {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) {ref : ConstRef β} :
+    ref ∈ batch.receipt.frontier.refs ↔
+      (∃ node ∈ inputs, ref ∈ node.frontier.map (·.ref)) ∧
+      ¬ ∃ node ∈ inputs, ref ∈ node.subjects := by
+  rw [batch.exactFrontier, mem_outstanding, batch.exact_subjects, batch.exact_frontiers]
+  simp
+
+/-- Conservative logical-use manifest, including every axiom admitted by a
+leaf and by the final replay. Neither kind of use is structurally discharged. -/
+def CheckedBatch.logicalUses {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) : List (ConstRef β) :=
+  (logicalAxioms store batch.receipt.checked.result.entries ++
+    batch.nodes.flatMap (fun node => logicalAxioms store node.receipt.checked.result.entries)).eraseDups
+
+theorem CheckedBatch.leaf_axiom_retained {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs)
+    {node : CheckedNode.{u,v} fuel signature store} (hn : node ∈ batch.nodes) {ref : ConstRef β}
+    (hr : ref ∈ logicalAxioms store node.receipt.checked.result.entries) :
+    ref ∈ batch.logicalUses := by
+  simp only [logicalUses, List.mem_eraseDups, List.mem_append, List.mem_flatMap]
+  exact Or.inr ⟨node, hn, hr⟩
+
+theorem CheckedBatch.logicalUses_authorized {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) {ref : ConstRef β}
+    (h : ref ∈ batch.logicalUses) :
+    ∃ entry, Standard.EntrySource store ref entry ∨ Quotient.EntrySource store ref entry := by
+  simp only [logicalUses, List.mem_eraseDups, List.mem_append, List.mem_flatMap] at h
+  rcases h with h | ⟨node, _, h⟩
+  · obtain ⟨entry, _, hs⟩ := batch.receipt.logical_axioms_authorized h
+    exact ⟨entry, hs⟩
+  · obtain ⟨entry, _, hs⟩ := node.receipt.logical_axioms_authorized h
+    exact ⟨entry, hs⟩
+
+/-- Every discharged dependency has a provider at a strictly earlier position;
+only an explicit external frontier may lack such a provider. -/
+theorem DependencyOrder.before {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {known : List (ConstRef β)} {nodes : List (CheckedNode.{u,v} fuel signature store)}
+    (order : DependencyOrder known nodes) {index : Nat} {node : CheckedNode.{u,v} fuel signature store}
+    (hn : nodes[index]? = some node) {ref : ConstRef β} (hr : ref ∈ node.receipt.frontier.refs) :
+    ref ∈ known ∨ ∃ previous, previous < index ∧
+      ∃ provider, nodes[previous]? = some provider ∧ ref ∈ provider.input.subjects := by
+  induction order generalizing index with
+  | nil => simp at hn
+  | @cons known first rest available tail ih =>
+    cases index with
+    | zero =>
+      cases Option.some.inj hn
+      exact Or.inl (available ref hr)
+    | succ index =>
+      rcases ih hn with hk | ⟨previous, hp, provider, hs, ho⟩
+      · rcases List.mem_append.mp hk with hk | hk
+        · exact Or.inl hk
+        · exact Or.inr ⟨0, Nat.zero_lt_succ _, first, rfl, hk⟩
+      · exact Or.inr ⟨previous + 1, Nat.succ_lt_succ hp, provider, hs, ho⟩
+
+theorem unique_subject_provider {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {nodes : List (CheckedNode.{u,v} fuel signature store)} (unique : (nodeSubjects nodes).Nodup)
+    {i j : Nat} {a b : CheckedNode.{u,v} fuel signature store}
+    (ha : nodes[i]? = some a) (hb : nodes[j]? = some b) {ref : ConstRef β}
+    (hra : ref ∈ a.input.subjects) (hrb : ref ∈ b.input.subjects) : i = j := by
+  have hp := (List.pairwise_flatMap.mp unique).2
+  obtain ⟨hi, hai⟩ := List.getElem?_eq_some_iff.mp ha
+  obtain ⟨hj, hbj⟩ := List.getElem?_eq_some_iff.mp hb
+  rcases Nat.lt_trichotomy i j with hij | he | hji
+  · have h := List.pairwise_iff_getElem.mp hp i j hi hj hij
+    rw [hai, hbj] at h
+    exact False.elim (h ref hra ref hrb rfl)
+  · exact he
+  · have h := List.pairwise_iff_getElem.mp hp j i hj hi hji
+    rw [hai, hbj] at h
+    exact False.elim (h ref hrb ref hra rfl)
+
+/-- The relation points from a supplying node to a consuming node. Its rank
+is the actual checked schedule position, not a prover-supplied acyclicity flag. -/
+def DependencyEdge {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (nodes : List (CheckedNode.{u,v} fuel signature store)) (provider consumer : Nat) : Prop :=
+  ∃ a b ref, nodes[provider]? = some a ∧ nodes[consumer]? = some b ∧
+    ref ∈ a.input.subjects ∧ ref ∈ b.receipt.frontier.refs ∧
+    ∀ previous, previous < provider → ∀ other, nodes[previous]? = some other → ref ∉ other.input.subjects
+
+theorem first_subject_provider {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {nodes : List (CheckedNode.{u,v} fuel signature store)} {ref : ConstRef β}
+    (h : ref ∈ nodeSubjects nodes) :
+    ∃ index : Nat, ∃ node : CheckedNode.{u,v} fuel signature store,
+      nodes[index]? = some node ∧ ref ∈ node.input.subjects ∧
+      ∀ previous : Nat, previous < index → ∀ other : CheckedNode.{u,v} fuel signature store,
+        nodes[previous]? = some other → ref ∉ other.input.subjects := by
+  induction nodes with
+  | nil => cases h
+  | cons first rest ih =>
+    by_cases hf : ref ∈ first.input.subjects
+    · exact ⟨0, first, rfl, hf, fun previous hp => False.elim (Nat.not_lt_zero previous hp)⟩
+    · have hr : ref ∈ nodeSubjects rest := (List.mem_append.mp h).resolve_left hf
+      obtain ⟨index, node, hn, hs, least⟩ := ih hr
+      refine ⟨index + 1, node, hn, hs, ?_⟩
+      intro previous hp other ho
+      cases previous with
+      | zero => cases Option.some.inj ho; exact hf
+      | succ previous => exact least previous (Nat.lt_of_succ_lt_succ hp) other ho
+
+/-- Shared subjects choose their first checked provider. This supplies an
+actual edge for every discharged frontier member, as opposed to merely
+asserting that a separately supplied graph is acyclic. -/
+theorem DependencyOrder.edge_for {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {known : List (ConstRef β)} {nodes : List (CheckedNode.{u,v} fuel signature store)}
+    (order : DependencyOrder known nodes) {consumer : Nat}
+    {node : CheckedNode.{u,v} fuel signature store} (hn : nodes[consumer]? = some node)
+    {ref : ConstRef β} (hr : ref ∈ node.receipt.frontier.refs) :
+    ref ∈ known ∨ ∃ provider, DependencyEdge nodes provider consumer := by
+  rcases order.before hn hr with hk | ⟨previous, _, owner, ho, hs⟩
+  · exact Or.inl hk
+  · obtain ⟨index, first, hf, hr', least⟩ := first_subject_provider
+      (List.mem_flatMap.mpr ⟨owner, List.mem_of_getElem? ho, hs⟩)
+    exact Or.inr ⟨index, first, node, ref, hf, hn, hr', hr, least⟩
+
+theorem DependencyOrder.rank {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {known : List (ConstRef β)} {nodes : List (CheckedNode.{u,v} fuel signature store)}
+    (order : DependencyOrder known nodes)
+    (external : ∀ ref ∈ known, ref ∉ nodeSubjects nodes) {provider consumer : Nat}
+    (edge : DependencyEdge nodes provider consumer) : provider < consumer := by
+  obtain ⟨a, b, ref, ha, hb, hra, hrb, first⟩ := edge
+  rcases order.before hb hrb with hk | ⟨previous, hp, owner, ho, hr⟩
+  · exact False.elim (external ref hk
+      (List.mem_flatMap.mpr ⟨a, List.mem_of_getElem? ha, hra⟩))
+  · by_cases h : provider < consumer
+    · exact h
+    · have earlier : previous < provider := Nat.lt_of_lt_of_le hp (Nat.le_of_not_gt h)
+      exact False.elim (first previous earlier owner ho hr)
+
+theorem CheckedBatch.external_disjoint {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) {ref : ConstRef β}
+    (h : ref ∈ batch.receipt.frontier.refs ++ [signature.falseType, signature.falseElim]) :
+    ref ∉ nodeSubjects batch.nodes := by
+  intro hs
+  rcases List.mem_append.mp h with hf | hp
+  · exact (mem_outstanding.mp ((batch.exactFrontier ref).mp hf)).2 hs
+  · have fresh := batch.receipt.fresh ref hs
+    rcases List.mem_cons.mp hp with rfl | hp
+    · rw [batch.receipt.frontier.interface.present.1] at fresh; cases fresh
+    · rcases List.mem_cons.mp hp with rfl | hp
+      · rw [batch.receipt.frontier.interface.present.2] at fresh; cases fresh
+      · cases hp
+
+theorem CheckedBatch.acyclic {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) :
+    WellFounded (DependencyEdge batch.nodes) :=
+  Subrelation.wf
+    (fun h => batch.order.rank (fun _ h => batch.external_disjoint h) h)
+    Nat.lt_wfRel.wf
+
+theorem CheckedBatch.no_circular_discharge {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) {a b : Nat}
+    (ab : DependencyEdge batch.nodes a b) (ba : DependencyEdge batch.nodes b a) : False := by
+  have hab := batch.order.rank (fun _ h => batch.external_disjoint h) ab
+  have hba := batch.order.rank (fun _ h => batch.external_disjoint h) ba
+  exact Nat.lt_asymm hab hba
+
+/-- Composition retains the leaf sequence. Validation of any grouping runs
+the same source-bound checker over that complete sequence. -/
+def composeClaims (left right : List (ClaimNode β)) : List (ClaimNode β) := left ++ right
+
+omit [DecidableEq β] in
+theorem composeClaims_assoc (a b c : List (ClaimNode β)) :
+    composeClaims (composeClaims a b) c = composeClaims a (composeClaims b c) :=
+  List.append_assoc ..
+
+theorem checkBatch?_assoc (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (frontier : List (FrontierWitness β)) (a b c : List (ClaimNode β)) :
+    acceptsBatch.{u,v} fuel signature store frontier (composeClaims (composeClaims a b) c) =
+      acceptsBatch.{u,v} fuel signature store frontier (composeClaims a (composeClaims b c)) := by
+  rw [composeClaims_assoc]
+
+/-- Erasing structural obligations has no effect on the model's axiom-use
+manifest. Every recorded axiom retains its exact realized source schema. -/
+theorem CheckedBatch.logical_axioms_authorized {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs) {ref : ConstRef β}
+    (h : ref ∈ logicalAxioms store batch.receipt.checked.result.entries) :
+    ∃ entry, batch.receipt.checked.result.entries ref = some entry ∧
+      (Standard.EntrySource store ref entry ∨ Quotient.EntrySource store ref entry) :=
+  batch.receipt.logical_axioms_authorized h
+
+theorem CheckedBatch.no_False {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs)
+    (closed : batch.receipt.frontier.refs = []) {ref : ConstRef β}
+    (subject : ref ∈ nodeSubjects batch.nodes)
+    (type : store.type ref = some signature.falseExpr)
+    (V : Type v) [SetTheory V] : False := by
+  obtain ⟨constants, hM, subjects⟩ := batch.closed_has_model closed V
+  obtain ⟨entry, _, hs, hm⟩ := subjects ref subject
+  have he : entry.type.erase = .const signature.falseType [] :=
+    Option.some.inj (hs.type.symm.trans type)
+  have hc := AExpr.eq_const_of_erase_eq he
+  have member := hm (List.replicate entry.universes 0) (by simp) (fun _ => empty)
+  rw [hc] at member
+  simp only [interp, List.map_nil, hM.falseValue] at member
+  exact not_mem_empty _ member
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Claims.lean b/Ix/Theory/Certified/Claims.lean
new file mode 100644
index 000000000..c80ce755c
--- /dev/null
+++ b/Ix/Theory/Certified/Claims.lean
@@ -0,0 +1,242 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.LogicalPolicy
+
+/-! A certified claim bundle is an ordered dependency DAG. Aggregation checks
+each conditional leaf, matches its complete deferred headers, and replays its
+admission in one growing interface. Set subtraction alone grants no meaning.
+The checked result extends every compatible interpretation of its remaining
+frontier and constructs a model when that frontier is empty. -/
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure ClaimNode (β : Type u) where
+  subjects : List (ConstRef β)
+  frontier : List (FrontierWitness β)
+  declarations : List (DeclarationWitness β)
+  deriving Inhabited
+
+structure CheckedNode (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β) where
+  input : ClaimNode β
+  receipt : ConditionalStore.{u,v} signature store input.subjects
+  validation : checkConditionalStore? fuel signature store input.frontier input.subjects
+    input.declarations = some receipt
+
+def checkNode? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (node : ClaimNode β) : Option (CheckedNode.{u,v} fuel signature store) :=
+  match h : checkConditionalStore?.{u,v} fuel signature store node.frontier node.subjects node.declarations with
+  | none => none
+  | some receipt => some ⟨node, receipt, h⟩
+
+theorem checkNode?_input {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {node : ClaimNode β} {result : CheckedNode.{u,v} fuel signature store}
+    (h : checkNode? fuel signature store node = some result) : result.input = node := by
+  unfold checkNode? at h
+  split at h
+  · cases h
+  · cases Option.some.inj h; rfl
+
+theorem CheckedNode.frontier_refs {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (node : CheckedNode.{u,v} fuel signature store) :
+    node.receipt.frontier.refs = node.input.frontier.map (·.ref) :=
+  checkFrontier?_refs (checkConditionalStore?_frontier node.validation)
+
+def nodeSubjects {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (nodes : List (CheckedNode.{u,v} fuel signature store)) : List (ConstRef β) :=
+  nodes.flatMap (·.input.subjects)
+
+def nodeFrontiers {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (nodes : List (CheckedNode.{u,v} fuel signature store)) : List (ConstRef β) :=
+  nodes.flatMap (·.receipt.frontier.refs)
+
+def outstanding {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (nodes : List (CheckedNode.{u,v} fuel signature store)) : List (ConstRef β) :=
+  (nodeFrontiers nodes).filter (fun ref => !(nodeSubjects nodes).contains ref) |>.eraseDups
+
+/-- Dependencies refer to the external frontier or to subjects of earlier
+nodes. Internal recursion stays inside one atomic declaration producer. -/
+inductive DependencyOrder {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β} :
+    List (ConstRef β) → List (CheckedNode.{u,v} fuel signature store) → Prop where
+  | nil (known) : DependencyOrder known []
+  | cons {known node rest}
+      (available : ∀ ref ∈ node.receipt.frontier.refs, ref ∈ known)
+      (tail : DependencyOrder (known ++ node.input.subjects) rest) :
+      DependencyOrder known (node :: rest)
+
+omit [DecidableEq β] in
+theorem HeaderPresent.extend {signature : PrimitiveSignature β} {a b : Environment β}
+    (extension : Extends.{u,v} signature a b) {header : Signature.Header β}
+    (h : HeaderPresent a header) : HeaderPresent b header := by
+  obtain ⟨entry, he, hu, ht⟩ := h.entry
+  simp only [HeaderPresent, extension.lookup _ _ he]
+  exact ⟨hu, ht⟩
+
+structure ReplayResult {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (known : List (ConstRef β))
+    (nodes : List (CheckedNode.{u,v} fuel signature store)) where
+  checked : CheckedExtension.{u,v} signature store state
+  order : DependencyOrder known nodes
+  subjects : ∀ ref ∈ nodeSubjects nodes, (checked.result.entries ref).isSome = true
+  frontiers : ∀ node ∈ nodes, ∀ header ∈ node.receipt.frontier.headers,
+    HeaderPresent checked.result.entries header
+
+def Ordinary.BlockWitness.outputs (witness : Ordinary.BlockWitness β) : List (ConstRef β) :=
+  [.member witness.source 0, .member witness.recursor 0] ++
+    (List.range witness.shape.shape.constructors.length).map (.ctor witness.source 0 ·)
+
+def DeclarationWitness.outputs : DeclarationWitness β → List (ConstRef β)
+  | .definition witness => [witness.ref]
+  | .ordinary witness | .natural witness => witness.outputs
+  | .standard witness => [witness.ref]
+  | .quotient witness => Quotient.kinds.map witness.refs.ref
+  | .structure witness => witness.facts.block.outputs
+  | .modeled witness => witness.companions.map (·.header.ref)
+
+/-- Reusing an already available declaration grants no additional equation,
+body or fact: the interface is unchanged. Every other declaration undergoes
+the full admission check. This permits shared, independently checked closures
+without replacing any chosen interpretation. -/
+def replayDeclarations? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) : List (DeclarationWitness β) →
+      Option (CheckedExtension.{u,v} signature store state)
+  | [] => some (CheckedExtension.refl state)
+  | witness :: rest => do
+    let step ← if witness.outputs.all (fun ref => (state.entries ref).isSome) then
+        some (CheckedExtension.refl state)
+      else checkDeclarationExtension?.{u,v} fuel (store := store) state witness
+    let rest ← replayDeclarations? fuel step.result rest
+    return step.trans rest
+
+/-- All semantic checks run again in the shared prefix. This constructs
+compatibility of separately checked leaves instead of selecting unrelated
+models and presuming they agree. Only published subjects discharge frontiers. -/
+def replayNodes? {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (known : List (ConstRef β)) :
+    (nodes : List (CheckedNode.{u,v} fuel signature store)) →
+      Option (ReplayResult state known nodes)
+  | [] => some ⟨CheckedExtension.refl state, .nil known, by simp [nodeSubjects], by simp⟩
+  | node :: nodes =>
+    if available : node.receipt.frontier.refs.all (known.contains ·) = true then
+      if aligned : node.receipt.frontier.headers.all (fun h => decide (HeaderPresent state.entries h)) = true then
+        do
+          let step ← replayDeclarations?.{u,v} fuel (store := store) state node.input.declarations
+          if present : node.input.subjects.all (fun ref => (step.result.entries ref).isSome) = true then do
+            let tail ← replayNodes? step.result (known ++ node.input.subjects) nodes
+            return {
+              checked := step.trans tail.checked
+              order := .cons (by simpa using List.all_eq_true.mp available) tail.order
+              subjects := by
+                intro ref hr
+                rcases List.mem_append.mp hr with hhead | htail
+                · have hp := List.all_eq_true.mp present ref hhead
+                  obtain ⟨entry, he⟩ := Option.isSome_iff_exists.mp hp
+                  exact Option.isSome_iff_exists.mpr ⟨entry, tail.checked.extension.lookup _ _ he⟩
+                · exact tail.subjects ref htail
+              frontiers := by
+                intro other hm header hh
+                rcases List.mem_cons.mp hm with rfl | hm
+                · have h : HeaderPresent state.entries header := of_decide_eq_true
+                    (List.all_eq_true.mp aligned header hh)
+                  exact (h.extend step.extension).extend tail.checked.extension
+                · exact tail.frontiers other hm header hh
+            }
+          else none
+      else none
+    else none
+
+structure CheckedBatch (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (inputs : List (ClaimNode β)) where
+  nodes : List (CheckedNode.{u,v} fuel signature store)
+  exactNodes : nodes.map (·.input) = inputs
+  receipt : ConditionalStore.{u,v} signature store (nodeSubjects nodes)
+  exactFrontier : ∀ ref, ref ∈ receipt.frontier.refs ↔ ref ∈ outstanding nodes
+  order : DependencyOrder
+    (receipt.frontier.refs ++ [signature.falseType, signature.falseElim]) nodes
+  frontiers : ∀ node ∈ nodes, ∀ header ∈ node.receipt.frontier.headers,
+    HeaderPresent receipt.checked.result.entries header
+
+def checkBatch? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (frontier : List (FrontierWitness β)) (inputs : List (ClaimNode β)) :
+    Option (CheckedBatch.{u,v} fuel signature store inputs) :=
+  if inputs.length > fuel then none else
+  match hn : inputs.mapM (checkNode?.{u,v} fuel signature store) with
+  | none => none
+  | some nodes => do
+    let dependencies ← checkFrontier?.{u,v} fuel signature store frontier
+    if exactFrontier : dependencies.refs.all (outstanding nodes |>.contains ·) = true ∧
+        (outstanding nodes).all (dependencies.refs.contains ·) = true then
+      if fresh : (nodeSubjects nodes).all (fun ref => (dependencies.interface.entries ref).isNone) = true then do
+          let replay ← replayNodes? dependencies.interface
+            (dependencies.refs ++ [signature.falseType, signature.falseElim]) nodes
+          return {
+            nodes
+            exactNodes := by
+              have h := mapM_projection (checkNode?.{u,v} fuel signature store) (·.input) id
+                (fun _ _ h => checkNode?_input h) hn
+              simpa using h
+            receipt := ⟨dependencies, replay.checked, fun r hr => Option.isNone_iff_eq_none.mp
+              (List.all_eq_true.mp fresh r hr), replay.subjects⟩
+            exactFrontier := by
+              intro ref
+              constructor
+              · intro hr; simpa using List.all_eq_true.mp exactFrontier.1 ref hr
+              · intro hr; simpa using List.all_eq_true.mp exactFrontier.2 ref hr
+            order := replay.order
+            frontiers := replay.frontiers
+          }
+      else none
+    else none
+
+def acceptsBatch (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (frontier : List (FrontierWitness β)) (inputs : List (ClaimNode β)) : Bool :=
+  (checkBatch?.{u,v} fuel signature store frontier inputs).isSome
+
+/-- Every leaf's deferred interface is interpreted by the same final model. -/
+theorem CheckedBatch.compatible_leaves {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs)
+    (V : Type v) [SetTheory V] (constants : Assignment β V)
+    (hM : signature.Compatible batch.receipt.checked.result.entries constants)
+    {node : CheckedNode.{u,v} fuel signature store} (hn : node ∈ batch.nodes) :
+    signature.Compatible node.receipt.frontier.interface.entries constants :=
+  node.receipt.frontier.compatible batch.receipt.checked.result
+    (batch.frontiers node hn) V constants hM
+
+theorem CheckedFrontier.empty_interface {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) (h : frontier.refs = []) :
+    frontier.interface.entries = signature.environment := by
+  have hh : frontier.headers = [] := List.map_eq_nil_iff.mp h
+  simp [CheckedFrontier.interface, hh, Signature.environment]
+
+/-- A closed aggregate constructs its model from the pinned prelude. No
+realization of a private assumption set is a hypothesis of this theorem. -/
+theorem CheckedBatch.closed_has_model {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {inputs : List (ClaimNode β)}
+    (batch : CheckedBatch.{u,v} fuel signature store inputs)
+    (closed : batch.receipt.frontier.refs = []) (V : Type v) [SetTheory V] :
+    ∃ constants : Assignment β V,
+      signature.Compatible batch.receipt.checked.result.entries constants ∧
+      ∀ ref ∈ nodeSubjects batch.nodes, ∃ entry,
+        batch.receipt.checked.result.entries ref = some entry ∧
+        SourceHeader store ref entry ∧
+        ∀ levels, levels.length = entry.universes → ∀ env,
+          constants ref levels ∈ˢ interp constants levels env entry.type := by
+  have initial : signature.Compatible batch.receipt.frontier.interface.entries
+      (signature.assignment (V := V)) := by
+    rw [batch.receipt.frontier.empty_interface closed]
+    exact signature.compatible_assignment
+  obtain ⟨constants, hM, _, subjects⟩ := batch.receipt.subject_sound V signature.assignment initial
+  refine ⟨constants, hM, ?_⟩
+  intro ref hr
+  obtain ⟨entry, he, _, hs, hm⟩ := subjects ref hr
+  exact ⟨entry, he, hs, fun levels hl env => (hm levels hl env).2⟩
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Frontier.lean b/Ix/Theory/Certified/Frontier.lean
new file mode 100644
index 000000000..1627a6c97
--- /dev/null
+++ b/Ix/Theory/Certified/Frontier.lean
@@ -0,0 +1,279 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Source
+
+/-! Conditional interfaces contain formed, source-bound headers. They carry
+no assumed bodies, equations or primitive facts, and no claim that a model
+exists. Object axioms and quotient primitives must use their semantic
+producers; they cannot be deferred and later erased by frontier subtraction. -/
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def deferredSource (store : Store β) (ref : ConstRef β) : Bool :=
+  match store.lookup ref with
+  | some (.defn _ _ _ _ .safe) | some (.induct _ _ _ _ _ .safe) |
+      some (.recursor _ _ _ _ _ _ _ _ .safe) => true
+  | some _ => false
+  | none => match store.lookupCtor ref with
+    | some ctor => ctor.safety == .safe
+    | none => false
+
+structure FrontierWitness (β : Type u) where
+  ref : ConstRef β
+  annotations : AnnotationTree
+  level : VLevel
+  typing : TypingWitness β
+
+structure FrontierHeader (store : Store β) where
+  header : Signature.Header β
+  source : SourceHeader store header.ref header.entry
+  allowed : deferredSource store header.ref = true
+
+def readFrontierHeader? (store : Store β) (witness : FrontierWitness β) :
+    Option (FrontierHeader store) :=
+  if ha : deferredSource store witness.ref = true then
+    match ht : store.type witness.ref with
+    | none => none
+    | some type => match hn : store.uvars witness.ref with
+      | none => none
+      | some universes => do
+        let reading ← readAnnotations? universes 0 type witness.annotations
+        return {
+          header := ⟨witness.ref, universes, reading.val⟩
+          source := ⟨ht.trans (congrArg some reading.property.1.symm), hn⟩
+          allowed := ha
+        }
+  else none
+
+omit [DecidableEq β] in
+theorem readFrontierHeader?_ref {store : Store β} {witness : FrontierWitness β}
+    {reading : FrontierHeader store} (h : readFrontierHeader? store witness = some reading) :
+    reading.header.ref = witness.ref := by
+  unfold readFrontierHeader? at h
+  split at h
+  · split at h
+    · cases h
+    · split at h
+      · cases h
+      · simp only [bind, Option.bind_eq_some_iff] at h
+        obtain ⟨value, _, h⟩ := h
+        cases Option.some.inj h
+        rfl
+  · cases h
+
+omit [DecidableEq β] in
+theorem mapM_projection {α : Type _} {γ : Type _} {δ : Type _}
+    (f : α → Option γ) (project : γ → δ) (source : α → δ)
+    (step : ∀ a b, f a = some b → project b = source a)
+    {inputs : List α} {outputs : List γ} (h : inputs.mapM f = some outputs) :
+    outputs.map project = inputs.map source := by
+  induction inputs generalizing outputs with
+  | nil => simp only [List.mapM_nil, pure, Option.some.injEq] at h; subst outputs; rfl
+  | cons a rest ih =>
+    simp only [List.mapM_cons, bind, Option.bind_eq_some_iff, pure, Option.some.injEq] at h
+    obtain ⟨b, hb, bs, hbs, rfl⟩ := h
+    simp only [List.map_cons, step a b hb, ih hbs]
+
+structure CheckedFrontier (signature : PrimitiveSignature β) (store : Store β) where
+  readings : List (FrontierHeader store)
+  validated : signature.validate store = true
+  formed : Signature.Formed.{u,v} signature.environment (readings.map (·.header))
+
+def CheckedFrontier.headers {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) : List (Signature.Header β) :=
+  frontier.readings.map (·.header)
+
+def CheckedFrontier.refs {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) : List (ConstRef β) :=
+  frontier.headers.map (·.ref)
+
+def CheckedFrontier.interface {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) : CheckedInterface signature where
+  entries := Signature.environment signature.environment frontier.headers
+  wf := frontier.formed.wf signature.environment_wf
+  present := ⟨frontier.formed.old signature.environment_false,
+    frontier.formed.old signature.environment_falseElim⟩
+
+def checkFrontier? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (witnesses : List (FrontierWitness β)) : Option (CheckedFrontier.{u,v} signature store) := do
+  if hv : signature.validate store = true then
+    if witnesses.length > fuel then none else do
+      let readings ← witnesses.mapM (readFrontierHeader? store)
+      let checked ← Signature.checkTypes.{u,v} fuel signature.environment
+        (readings.map (·.header)) (witnesses.map fun witness => ⟨witness.level, witness.typing⟩)
+      return ⟨readings, hv, checked.down⟩
+  else none
+
+theorem checkFrontier?_refs {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {witnesses : List (FrontierWitness β)} {result : CheckedFrontier.{u,v} signature store}
+    (h : checkFrontier? fuel signature store witnesses = some result) :
+    result.refs = witnesses.map (·.ref) := by
+  unfold checkFrontier? at h
+  split at h
+  · split at h
+    · cases h
+    · simp only [bind, Option.bind_eq_some_iff] at h
+      obtain ⟨readings, hr, formed, _, h⟩ := h
+      cases Option.some.inj h
+      simpa only [CheckedFrontier.refs, CheckedFrontier.headers, List.map_map, Function.comp_def] using
+        mapM_projection (readFrontierHeader? store) (fun r => r.header.ref) (·.ref)
+          (fun _ _ h => readFrontierHeader?_ref h) hr
+  · cases h
+
+theorem CheckedFrontier.header_source {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) {header : Signature.Header β}
+    (h : header ∈ frontier.headers) : SourceHeader store header.ref header.entry := by
+  obtain ⟨reading, _, rfl⟩ := List.mem_map.mp h
+  exact reading.source
+
+/-- A provider may contain additional checked bodies and laws. Its entire
+annotated type and universe arity must match the deferred header exactly. -/
+def HeaderPresent (entries : Environment β) (header : Signature.Header β) : Prop :=
+  match entries header.ref with
+  | none => False
+  | some entry => entry.universes = header.universes ∧ entry.type = header.type
+
+instance (entries : Environment β) (header : Signature.Header β) :
+    Decidable (HeaderPresent entries header) := by
+  unfold HeaderPresent
+  split <;> infer_instance
+
+omit [DecidableEq β] in
+theorem HeaderPresent.entry {entries : Environment β} {header : Signature.Header β}
+    (h : HeaderPresent entries header) :
+    ∃ entry, entries header.ref = some entry ∧
+      entry.universes = header.universes ∧ entry.type = header.type := by
+  unfold HeaderPresent at h
+  cases he : entries header.ref with
+  | none => simp [he] at h
+  | some entry => exact ⟨entry, rfl, by simpa only [he] using h⟩
+
+/-- The compatible interpretation of every provider gives one interpretation
+of the complete deferred view, including shared references and primitive pins. -/
+theorem CheckedFrontier.compatible {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) (provider : CheckedInterface signature)
+    (headers : ∀ header ∈ frontier.headers, HeaderPresent provider.entries header)
+    (V : Type v) [SetTheory V] (constants : Assignment β V)
+    (hM : signature.Compatible provider.entries constants) :
+    signature.Compatible frontier.interface.entries constants := by
+  have old : ∀ r entry, signature.environment r = some entry →
+      provider.entries r = some entry := by
+    intro r entry he
+    unfold PrimitiveSignature.environment at he
+    split at he
+    · subst r; cases Option.some.inj he; exact provider.present.1
+    · split at he
+      · subst r; cases Option.some.inj he; exact provider.present.2
+      · cases he
+  have he : ∀ r entry, frontier.interface.entries r = some entry →
+      ∃ actual, provider.entries r = some actual ∧
+        actual.universes = entry.universes ∧ actual.type = entry.type ∧
+        entry.body = none ∧ entry.equations = [] ∧ entry.facts = [] := by
+    intro r entry hr
+    rcases Signature.environment_source hr with hbase | ⟨header, hh, rfl, rfl⟩
+    · refine ⟨entry, old r entry hbase, rfl, rfl, ?_⟩
+      unfold PrimitiveSignature.environment at hbase
+      split at hbase
+      · cases Option.some.inj hbase; exact ⟨rfl, rfl, rfl⟩
+      · split at hbase
+        · cases Option.some.inj hbase; exact ⟨rfl, rfl, rfl⟩
+        · cases hbase
+    · obtain ⟨actual, ha, hu, ht⟩ := (headers header hh).entry
+      exact ⟨actual, ha, hu, ht, rfl, rfl, rfl⟩
+  refine ⟨?_, hM.falseValue, hM.falseElimValue⟩
+  constructor
+  · intro r entry hr levels hn env
+    obtain ⟨actual, ha, hu, ht, _⟩ := he r entry hr
+    rw [← ht]
+    exact hM.realizes.typeValid r actual ha levels (hn.trans hu.symm) env
+  · intro r entry hr levels hn env
+    obtain ⟨actual, ha, hu, ht, _⟩ := he r entry hr
+    rw [← ht]
+    exact hM.realizes.member r actual ha levels (hn.trans hu.symm) env
+  · intro r entry hr body hb
+    rw [(he r entry hr).choose_spec.2.2.2.1] at hb
+    cases hb
+  · intro r entry hr body hb
+    rw [(he r entry hr).choose_spec.2.2.2.1] at hb
+    cases hb
+  · intro r entry hr law hl
+    rw [(he r entry hr).choose_spec.2.2.2.2.1] at hl
+    cases hl
+  · intro r entry hr fact hf
+    rw [(he r entry hr).choose_spec.2.2.2.2.2] at hf
+    cases hf
+
+structure ConditionalStore (signature : PrimitiveSignature β) (store : Store β)
+    (subjects : List (ConstRef β)) where
+  frontier : CheckedFrontier.{u,v} signature store
+  checked : CheckedExtension.{u,v} signature store frontier.interface
+  fresh : ∀ r ∈ subjects, frontier.interface.entries r = none
+  present : ∀ r ∈ subjects, (checked.result.entries r).isSome = true
+
+def checkConditionalStore? (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (frontier : List (FrontierWitness β)) (subjects : List (ConstRef β))
+    (witness : List (DeclarationWitness β)) : Option (ConditionalStore.{u,v} signature store subjects) := do
+  let dependencies ← checkFrontier?.{u,v} fuel signature store frontier
+  if fresh : subjects.all (fun r => (dependencies.interface.entries r).isNone) = true then
+    let checked ← checkDeclarationExtensions?.{u,v} fuel (store := store) dependencies.interface witness
+    if present : subjects.all (fun r => (checked.result.entries r).isSome) = true then
+      return ⟨dependencies, checked, fun r hr => Option.isNone_iff_eq_none.mp
+        (List.all_eq_true.mp fresh r hr), List.all_eq_true.mp present⟩
+    else none
+  else none
+
+theorem checkConditionalStore?_frontier {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {frontier : List (FrontierWitness β)} {subjects : List (ConstRef β)}
+    {witness : List (DeclarationWitness β)} {result : ConditionalStore.{u,v} signature store subjects}
+    (h : checkConditionalStore? fuel signature store frontier subjects witness = some result) :
+    checkFrontier? fuel signature store frontier = some result.frontier := by
+  unfold checkConditionalStore? at h
+  simp only [bind, Option.bind_eq_some_iff] at h
+  obtain ⟨dependencies, hd, h⟩ := h
+  split at h
+  · simp only [Option.bind_eq_some_iff] at h
+    obtain ⟨checked, _, h⟩ := h
+    split at h
+    · cases Option.some.inj h; exact hd
+    · cases h
+  · cases h
+
+/-- No realization of the frontier is fabricated. Every realization supplied
+by checked dependencies extends compatibly to all the exact subject types. -/
+theorem ConditionalStore.subject_sound {signature : PrimitiveSignature β} {store : Store β}
+    {subjects : List (ConstRef β)} (receipt : ConditionalStore.{u,v} signature store subjects)
+    (V : Type v) [SetTheory V] (constants : Assignment β V)
+    (hM : signature.Compatible receipt.frontier.interface.entries constants) :
+    ∃ constants' : Assignment β V,
+      signature.Compatible receipt.checked.result.entries constants' ∧
+      Assignment.AgreesOn receipt.frontier.interface.entries constants constants' ∧
+      ∀ ref ∈ subjects, ∃ entry, receipt.checked.result.entries ref = some entry ∧
+        EntrySource signature store ref entry ∧ SourceHeader store ref entry ∧
+        ∀ levels, levels.length = entry.universes → ∀ env,
+          WellDenoted constants' levels env entry.type ∧
+          constants' ref levels ∈ˢ interp constants' levels env entry.type := by
+  obtain ⟨constants', hM', ha⟩ := receipt.checked.extension.models V constants hM
+  refine ⟨constants', hM', ha, ?_⟩
+  intro ref hr
+  have hp := receipt.present ref hr
+  cases he : receipt.checked.result.entries ref with
+  | none => simp [he] at hp
+  | some entry =>
+    have hs : EntrySource signature store ref entry := by
+      rcases receipt.checked.source ref entry he with old | new
+      · rw [receipt.fresh ref hr] at old; cases old
+      · exact new
+    refine ⟨entry, rfl, hs, hs.header, ?_⟩
+    intro levels hl env
+    exact ⟨hM'.realizes.typeValid ref entry he levels hl env,
+      hM'.realizes.member ref entry he levels hl env⟩
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Level.lean b/Ix/Theory/Certified/Level.lean
new file mode 100644
index 000000000..787ce5a18
--- /dev/null
+++ b/Ix/Theory/Certified/Level.lean
@@ -0,0 +1,121 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.PropWhen
+
+namespace Ix.Theory.Certified
+
+open VLevel
+
+/-- Compute the exact zero condition of a level. `imax` is zero exactly when
+its right operand is zero; its left operand still needs a scoping check. -/
+def zeroCondition : VLevel → PropWhen
+  | .zero => .always
+  | .succ _ => .never
+  | .max a b => (zeroCondition a).inter (zeroCondition b)
+  | .imax _ b => zeroCondition b
+  | .param i => .param i
+
+theorem zeroCondition_correct (l : VLevel) (values : List Nat) :
+    (zeroCondition l).holds (values.getD · 0) = (l.eval values == 0) := by
+  induction l with
+  | zero => rfl
+  | succ l ih => simp [zeroCondition, eval]
+  | max a b ha hb =>
+    rw [zeroCondition, PropWhen.holds_inter, ha, hb]
+    apply Bool.eq_iff_iff.mpr
+    simp [eval, Nat.max_eq_zero_iff]
+  | imax a b ha hb =>
+    simp only [zeroCondition, hb]
+    apply Bool.eq_iff_iff.mpr
+    by_cases h : b.eval values = 0
+    · simp [eval, natIMax, h]
+    · simp [eval, natIMax, h, Nat.max_eq_zero_iff]
+  | param i => simp [zeroCondition, eval]
+
+theorem zeroCondition_wf {n : Nat} {l : VLevel} (h : l.WF n) :
+    (zeroCondition l).WF n := by
+  induction l with
+  | zero => simp [zeroCondition, PropWhen.always, PropWhen.WF]
+  | succ l ih => trivial
+  | max a b ha hb => exact PropWhen.WF.inter (ha h.1) (hb h.2)
+  | imax a b ha hb => exact hb h.2
+  | param i => simpa [zeroCondition, PropWhen.param, PropWhen.WF, VLevel.WF] using h
+
+/-- Substitute actual anonymous levels into an annotation. Out-of-bounds
+fallback agrees with `VLevel.inst`; successful validation rules it out. -/
+def instCondition (levels : List VLevel) (p : PropWhen) : PropWhen :=
+  p.bind (fun i => zeroCondition (levels.getD i .zero))
+
+theorem zeroCondition_inst (l : VLevel) (levels : List VLevel) :
+    zeroCondition (l.inst levels) = instCondition levels (zeroCondition l) := by
+  induction l with
+  | zero => rfl
+  | succ l ih => rfl
+  | max a b ha hb =>
+    simpa only [zeroCondition, VLevel.inst, instCondition, PropWhen.bind_inter] using
+      congr (congrArg PropWhen.inter ha) hb
+  | imax a b ha hb => exact hb
+  | param i => simp [VLevel.inst, zeroCondition, instCondition]
+
+theorem instCondition_correct (levels : List VLevel) (p : PropWhen) (values : List Nat) :
+    (instCondition levels p).holds (values.getD · 0) =
+      p.holds ((levels.map (VLevel.eval values)).getD · 0) := by
+  apply PropWhen.holds_bind_of
+  intro i
+  rw [zeroCondition_correct]
+  simp only [List.getD_eq_getElem?_getD, List.getElem?_map]
+  cases levels[i]? <;> rfl
+
+theorem instCondition_comp (p : PropWhen) (levels levels' : List VLevel) :
+    instCondition levels' (instCondition levels p) =
+      instCondition (levels.map (VLevel.inst levels')) p := by
+  cases p with
+  | never => rfl
+  | allZero ps hs =>
+    change instCondition levels' (PropWhen.bindList _ ps) = PropWhen.bindList _ ps
+    clear hs
+    induction ps with
+    | nil => rfl
+    | cons i ps ih =>
+      simp only [PropWhen.bindList, instCondition, PropWhen.bind_inter] at ih ⊢
+      rw [ih]
+      congr 1
+      rw [← instCondition, ← zeroCondition_inst]
+      simp only [List.getD_eq_getElem?_getD, List.getElem?_map]
+      cases levels[i]? <;> rfl
+
+/-- Validate the exact claimed condition, its canonical encoding, and every
+universe index of the source level. This is executable and fails closed. -/
+def validateZero? (n : Nat) (l : VLevel) (raw : Option (List Nat)) : Option PropWhen := do
+  if !decide (l.WF n) then none else do
+    let p ← PropWhen.fromRaw? n raw
+    if p = zeroCondition l then some p else none
+
+theorem validateZero?_sound {n : Nat} {l : VLevel} {raw : Option (List Nat)}
+    {p : PropWhen} (h : validateZero? n l raw = some p) :
+    l.WF n ∧ p.toRaw = raw ∧ p.WF n ∧ p = zeroCondition l := by
+  simp only [validateZero?] at h
+  split at h
+  · contradiction
+  next hw =>
+    have hw : l.WF n := by simpa using hw
+    cases he : PropWhen.fromRaw? n raw with
+    | none => simp [he] at h
+    | some q =>
+      simp only [he] at h
+      change (if q = zeroCondition l then some q else none) = some p at h
+      split at h
+      next hq =>
+        cases h
+        obtain ⟨hr, hqw⟩ := PropWhen.fromRaw?_sound he
+        exact ⟨hw, hr, hqw, hq⟩
+      · contradiction
+
+theorem validateZero?_complete {n : Nat} {l : VLevel} (h : l.WF n) :
+    validateZero? n l (zeroCondition l).toRaw = some (zeroCondition l) := by
+  simp [validateZero?, h, PropWhen.fromRaw?_complete (zeroCondition_wf h)]
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/LevelEq.lean b/Ix/Theory/Certified/LevelEq.lean
new file mode 100644
index 000000000..04c431306
--- /dev/null
+++ b/Ix/Theory/Certified/LevelEq.lean
@@ -0,0 +1,116 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Level
+
+namespace Ix.Theory.Certified
+
+namespace LevelEq
+
+/-- A structural upper-bound check, used only when it proves pointwise
+ordering. In particular, a field at u fits a carrier at u+1. -/
+def leq (a b : VLevel) : Bool :=
+  if a = b then true else
+    match a, b with
+    | .zero, _ => true
+    | .max a b, c => leq a c && leq b c
+    | a, .max b c => leq a b || leq a c
+    | .succ a, .succ b => leq a b
+    | a, .succ b => leq a b
+    | .imax a b, c => leq a c && leq b c
+    | _, _ => false
+termination_by sizeOf a + sizeOf b
+
+theorem leq_sound {a b : VLevel} (h : leq a b = true) (values : List Nat) :
+    a.eval values ≤ b.eval values := by
+  unfold leq at h
+  split at h
+  next he => subst b; exact Nat.le_refl _
+  next =>
+    split at h
+    next => exact Nat.zero_le _
+    next a b c =>
+      simp only [Bool.and_eq_true] at h
+      exact Nat.max_le.mpr ⟨leq_sound h.1 values, leq_sound h.2 values⟩
+    next a b c =>
+      simp only [Bool.or_eq_true] at h
+      rcases h with h | h
+      · exact Nat.le_trans (leq_sound h values) (Nat.le_max_left _ _)
+      · exact Nat.le_trans (leq_sound h values) (Nat.le_max_right _ _)
+    next a b => exact Nat.succ_le_succ (leq_sound h values)
+    next a b => exact Nat.le_trans (leq_sound h values) (Nat.le_succ _)
+    next a b c =>
+      simp only [Bool.and_eq_true] at h
+      have hm := Nat.max_le.mpr ⟨leq_sound h.1 values, leq_sound h.2 values⟩
+      change VLevel.natIMax _ _ ≤ _
+      unfold VLevel.natIMax
+      split
+      · exact Nat.zero_le _
+      · exact hm
+    next => contradiction
+termination_by sizeOf a + sizeOf b
+
+/-- Conservative simplification. Failure to identify equivalent levels is a
+decline, never permission to compare their zero conditions as full levels. -/
+def max (a b : VLevel) : VLevel :=
+  match a, b with
+  | .zero, b => b
+  | a, .zero => a
+  | a, b => if leq a b then b else if leq b a then a else .max a b
+
+theorem eval_max (a b : VLevel) (values : List Nat) :
+    (max a b).eval values = Nat.max (a.eval values) (b.eval values) := by
+  unfold max
+  split <;> simp_all [VLevel.eval]
+  split
+  next h => exact (Nat.max_eq_right (leq_sound h values)).symm
+  next =>
+    split
+    next h => exact (Nat.max_eq_left (leq_sound h values)).symm
+    next => rfl
+
+def imax (a b : VLevel) : VLevel :=
+  match a, b with
+  | _, .zero => .zero
+  | a, .succ b => max a (.succ b)
+  | .zero, b => b
+  | a, b => if a = b then a else .imax a b
+
+theorem eval_imax (a b : VLevel) (values : List Nat) :
+    (imax a b).eval values = VLevel.natIMax (a.eval values) (b.eval values) := by
+  unfold imax
+  split
+  · simp [VLevel.eval, VLevel.natIMax]
+  · simp [eval_max, VLevel.eval, VLevel.natIMax]
+  · simp only [VLevel.eval, VLevel.natIMax, Nat.zero_max]
+    split <;> simp_all
+  · split
+    · subst b
+      simp [VLevel.natIMax]
+    · rfl
+
+def normalize : VLevel → VLevel
+  | .zero => .zero
+  | .param i => .param i
+  | .succ a => .succ (normalize a)
+  | .max a b => max (normalize a) (normalize b)
+  | .imax a b => imax (normalize a) (normalize b)
+
+theorem eval_normalize (l : VLevel) (values : List Nat) :
+    (normalize l).eval values = l.eval values := by
+  induction l <;> simp_all [normalize, VLevel.eval, eval_max, eval_imax]
+
+def check (n : Nat) (a b : VLevel) : Bool :=
+  decide (a.WF n ∧ b.WF n) && decide (normalize a = normalize b)
+
+theorem check_sound {n : Nat} {a b : VLevel} (h : check n a b = true) :
+    a.WF n ∧ b.WF n ∧ ∀ values, a.eval values = b.eval values := by
+  simp only [check, Bool.and_eq_true, decide_eq_true_eq] at h
+  refine ⟨h.1.1, h.1.2, fun values => ?_⟩
+  rw [← eval_normalize a values, ← eval_normalize b values, h.2]
+
+end LevelEq
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/LogicalPolicy.lean b/Ix/Theory/Certified/LogicalPolicy.lean
new file mode 100644
index 000000000..974b2dcb0
--- /dev/null
+++ b/Ix/Theory/Certified/LogicalPolicy.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Frontier
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Enumerate source members, retaining exact block and member positions. -/
+def sourceMembers (store : Store β) : List (ConstRef β) :=
+  store.dom.flatMap fun block => match store.blocks block with
+    | none => []
+    | some contents => (List.range contents.members.length).map (.member block ·)
+
+omit [DecidableEq β] in
+theorem lookup_mem_sourceMembers {store : Store β} {ref : ConstRef β} {source : Const β}
+    (h : store.lookup ref = some source) : ref ∈ sourceMembers store := by
+  cases ref with
+  | ctor => cases h
+  | member block index =>
+    cases hb : store.blocks block with
+    | none => simp [Store.lookup, hb] at h
+    | some contents =>
+      have hm : contents.members[index]? = some source := by simpa [Store.lookup, hb] using h
+      have hi : index < contents.members.length := (List.getElem?_eq_some_iff.mp hm).choose
+      apply List.mem_flatMap.mpr
+      refine ⟨block, (store.mem_dom block).mp (by simp [hb]), ?_⟩
+      simp only [hb]
+      exact List.mem_map.mpr ⟨index, List.mem_range.mpr hi, rfl⟩
+
+def isLogicalAxiom (store : Store β) (ref : ConstRef β) : Bool :=
+  match store.lookup ref with
+  | some (.axiom ..) => true
+  | _ => false
+
+/-- The manifest records all admitted source axioms, even unused ones. It is
+computed from source kinds and the actual checked environment; it never
+subtracts checked subjects or trusts a prover's declaration of axiom use. -/
+def logicalAxioms (store : Store β) (entries : Environment β) : List (ConstRef β) :=
+  (sourceMembers store).filter fun ref => isLogicalAxiom store ref && (entries ref).isSome
+
+omit [DecidableEq β] in
+theorem mem_logicalAxioms {store : Store β} {entries : Environment β} {ref : ConstRef β} :
+    ref ∈ logicalAxioms store entries ↔
+      (∃ n type safety, store.lookup ref = some (.axiom n type safety)) ∧
+      ∃ entry, entries ref = some entry := by
+  constructor
+  · intro h
+    obtain ⟨_, h⟩ := List.mem_filter.mp h
+    have hh : isLogicalAxiom store ref = true ∧ (entries ref).isSome = true := by simpa using h
+    obtain ⟨ha, he⟩ := hh
+    have hs : ∃ n type safety, store.lookup ref = some (.axiom n type safety) := by
+      unfold isLogicalAxiom at ha
+      cases hl : store.lookup ref with
+      | none => simp [hl] at ha
+      | some source => cases source <;> simp_all
+    exact ⟨hs, Option.isSome_iff_exists.mp he⟩
+  · rintro ⟨⟨n, type, safety, hs⟩, entry, he⟩
+    exact List.mem_filter.mpr ⟨lookup_mem_sourceMembers hs, by simp [isLogicalAxiom, hs, he]⟩
+
+omit [DecidableEq β] in
+theorem logicalAxioms_monotone {signature : PrimitiveSignature β} {store : Store β}
+    {a b : Environment β} (h : Extends.{u,v} signature a b) {ref : ConstRef β}
+    (hr : ref ∈ logicalAxioms store a) : ref ∈ logicalAxioms store b := by
+  obtain ⟨source, entry, he⟩ := mem_logicalAxioms.mp hr
+  exact mem_logicalAxioms.mpr ⟨source, entry, h.lookup ref entry he⟩
+
+theorem CheckedFrontier.no_axioms {signature : PrimitiveSignature β} {store : Store β}
+    (frontier : CheckedFrontier.{u,v} signature store) {ref : ConstRef β} {entry : ConstantEntry β}
+    {n : Nat} {type : VExpr β} {safety : Safety}
+    (hs : store.lookup ref = some (.axiom n type safety)) :
+    frontier.interface.entries ref ≠ some entry := by
+  intro hr
+  rcases Signature.environment_source hr with old | ⟨header, hh, rfl, _⟩
+  · have hv := (signature.validate_iff store).mp frontier.validated
+    unfold PrimitiveSignature.environment at old
+    split at old
+    · subst ref; rw [hv.1] at hs; cases hs
+    · split at old
+      · subst ref; rw [hv.2] at hs; cases hs
+      · cases old
+  · obtain ⟨reading, _, rfl⟩ := List.mem_map.mp hh
+    have ha := reading.allowed
+    simp [deferredSource, hs] at ha
+
+omit [DecidableEq β] in
+/-- Every object axiom in an admitted interface is one of the exactly realized
+standard schemas or quotient soundness, with its original source preserved. -/
+theorem EntrySource.axiom_policy {signature : PrimitiveSignature β} {store : Store β}
+    {ref : ConstRef β} {entry : ConstantEntry β} {n : Nat} {type : VExpr β} {safety : Safety}
+    (source : EntrySource signature store ref entry)
+    (hs : store.lookup ref = some (.axiom n type safety)) :
+    Standard.EntrySource store ref entry ∨ Quotient.EntrySource store ref entry := by
+  rcases source with ⟨_, _, he⟩ | ⟨_, _, he⟩ | ⟨_, _, _, _, _, he⟩ | h | h | h | h | h | h
+  · rw [he] at hs; cases hs
+  · rw [he] at hs; cases hs
+  · rw [he] at hs; cases hs
+  · rcases h with ⟨shape, block, recursor, mode, hb, hr, h⟩
+    rcases h with ⟨rfl, _⟩ | ⟨index, ctor, _, rfl, _⟩ | ⟨rfl, _⟩
+    · simp [Store.lookup, hb, Ordinary.Shape.source] at hs
+    · cases hs
+    · rcases hr with hr | ⟨_, hr⟩ <;>
+        simp [Store.lookup, hr, Ordinary.Shape.recursorSource] at hs
+  · exact Or.inl h
+  · exact Or.inr h
+  · rcases h with ⟨description, block, recursor, mode, hb, _, rfl, _⟩
+    simp [Store.lookup, hb, Ordinary.Shape.source] at hs
+  · rcases h with ⟨_, block, recursor, mode, hb, _, rfl, _⟩
+    simp [Store.lookup, hb, Ordinary.Shape.source] at hs
+  · exact False.elim (h.not_axiom hs)
+
+theorem ConditionalStore.logical_axioms_authorized {signature : PrimitiveSignature β}
+    {store : Store β} {subjects : List (ConstRef β)}
+    (receipt : ConditionalStore.{u,v} signature store subjects) {ref : ConstRef β}
+    (h : ref ∈ logicalAxioms store receipt.checked.result.entries) :
+    ∃ entry, receipt.checked.result.entries ref = some entry ∧
+      (Standard.EntrySource store ref entry ∨ Quotient.EntrySource store ref entry) := by
+  obtain ⟨⟨n, type, safety, hs⟩, entry, he⟩ := mem_logicalAxioms.mp h
+  refine ⟨entry, he, ?_⟩
+  rcases receipt.checked.source ref entry he with old | new
+  · exact False.elim (receipt.frontier.no_axioms hs old)
+  · exact new.axiom_policy hs
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Modeled/Admission.lean b/Ix/Theory/Certified/Modeled/Admission.lean
new file mode 100644
index 000000000..0eea3996c
--- /dev/null
+++ b/Ix/Theory/Certified/Modeled/Admission.lean
@@ -0,0 +1,59 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Admission
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Simultaneous model companions preserve every earlier interpretation.
+Models and their equation proofs must already be available through preceding
+admissions; the new source block cannot justify its own model. -/
+def checkModeledExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : Modeled.Witness β) :
+    Option (CheckedExtension.{u,v} signature store state) := do
+  let checked ← Modeled.check?.{u,v} fuel state.entries store witness
+  let entries := Modeled.environment state.entries witness.companions
+  have extension : Extends.{u,v} signature state.entries entries := by
+    constructor
+    · intro ref entry he
+      exact Environment.overlay_old checked.down.models.fresh_overlay he
+    · intro V _ constants hM
+      let constants' := Modeled.assignment constants witness.companions
+      have hm := Modeled.assignment_realizes checked.down.models state.wf constants hM.realizes
+      have ha := Modeled.assignment_agrees checked.down.models constants
+      exact ⟨constants', hM.extend signature state.present hm ha, ha⟩
+  let result : CheckedInterface signature := {
+    entries
+    wf := Modeled.environment_wf checked.down.models state.wf
+    present := ⟨extension.lookup _ _ state.present.1, extension.lookup _ _ state.present.2⟩
+  }
+  return {
+    result, extension
+    source := by
+      intro ref entry he
+      dsimp only [result] at he
+      rcases Modeled.publishedEntry_source checked.down he with old | new
+      · exact Or.inl old
+      · exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr new))))))))
+  }
+
+def admitModeled? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : Modeled.Witness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkModeledExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+theorem admitModeled?_extends {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {state : AdmittedEnvironment.{u,v} signature store} {witness : Modeled.Witness β} {result}
+    (_ : admitModeled? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Modeled/Equation.lean b/Ix/Theory/Certified/Modeled/Equation.lean
new file mode 100644
index 000000000..fa270584d
--- /dev/null
+++ b/Ix/Theory/Certified/Modeled/Equation.lean
@@ -0,0 +1,73 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Signature
+import Ix.Theory.Certified.Basis.Equality
+
+/-! Model equations may follow from checked conversion or from a checked
+proof of the realized equality relation. Both complete endpoints and their
+common type are checked before an equation can be published. -/
+
+namespace Ix.Theory.Certified.Modeled
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+inductive EquationProof (β : Type u) where
+  | conversion (witness : ConversionWitness β)
+  | propositional (family reflexivity recursor : ConstRef β)
+      (proof : AExpr β) (witness : TypingWitness β)
+
+structure EquationWitness (β : Type u) where
+  formation : Signature.RuleWitness β
+  proof : EquationProof β
+
+structure CheckedEquation (entries : Environment β) (rule : Signature.Rule β) : Prop where
+  formed : Signature.RuleFormed.{u,v} entries rule
+  equality : ConversionClaim.{u,v} entries [] rule.lhs rule.rhs
+
+omit [DecidableEq β] in
+theorem propositional_equation {entries : Environment β} {family reflexivity recursor : ConstRef β}
+    (interface : Basis.Equality.Interface entries family reflexivity recursor)
+    {rule : Signature.Rule β} {level : VLevel} {proof : AExpr β}
+    (type : TypingClaim.{u,v} entries [] rule.type (.sort level))
+    (lhs : TypingClaim.{u,v} entries [] rule.lhs rule.type)
+    (rhs : TypingClaim.{u,v} entries [] rule.rhs rule.type)
+    (checked : TypingClaim.{u,v} entries [] proof
+      (Basis.Equality.applied family level rule.type rule.lhs rule.rhs)) :
+    ConversionClaim.{u,v} entries [] rule.lhs rule.rhs := by
+  intro V _ constants hM levels env hΓ
+  have htype := (type V constants hM levels env hΓ).2.2
+  have hlhs := (lhs V constants hM levels env hΓ).2.2
+  have hrhs := (rhs V constants hM levels env hΓ).2.2
+  have hproof := (checked V constants hM levels env hΓ).2.2
+  apply Basis.Equality.eq_of_mem interface hM (by simpa only [interp] using htype) hlhs hrhs
+  simpa only [Basis.Equality.applied, AExpr.appN, interp, List.map_cons, List.map_nil,
+    Basis.Equality.value] using hproof
+
+def checkEquation? (fuel : Nat) (entries : Environment β) (rule : Signature.Rule β)
+    (witness : EquationWitness β) : Option (CheckedClaim.{u} (CheckedEquation.{u,v} entries rule)) := do
+  let formed ← Signature.checkRule.{u,v} fuel entries rule witness.formation
+  match witness.proof with
+  | .conversion witness =>
+    let equality ← verifyConversion.{u,v} fuel rule.universes entries [] rule.lhs rule.rhs witness
+    return ⟨formed.down, equality.down⟩
+  | .propositional family reflexivity recursor proof typing =>
+    if hi : Basis.Equality.Interface entries family reflexivity recursor then do
+      let type ← verifyType.{u,v} fuel rule.universes entries [] rule.type
+        (.sort witness.formation.level) witness.formation.type
+      let checked ← verifyType.{u,v} fuel rule.universes entries [] proof
+        (Basis.Equality.applied family witness.formation.level rule.type rule.lhs rule.rhs) typing
+      return ⟨formed.down, propositional_equation hi type.down formed.down.lhs formed.down.rhs checked.down⟩
+    else none
+
+theorem checkEquation?_sound {fuel : Nat} {entries : Environment β} {rule : Signature.Rule β}
+    {witness : EquationWitness β} {result}
+    (_ : checkEquation?.{u,v} fuel entries rule witness = some result) :
+    CheckedEquation.{u,v} entries rule := result.down
+
+end Ix.Theory.Certified.Modeled
diff --git a/Ix/Theory/Certified/Modeled/Source.lean b/Ix/Theory/Certified/Modeled/Source.lean
new file mode 100644
index 000000000..da6dd905f
--- /dev/null
+++ b/Ix/Theory/Certified/Modeled/Source.lean
@@ -0,0 +1,268 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Modeled.Transport
+
+/-! Exact source readings for model companions. The rule reader constructs
+the whole left endpoint from the stored recursor type, specializes the actual
+constructor at the major's universe and parameter arguments, and retains the
+stored right endpoint. It grants no equation until `checkCompanions?` checks
+the corresponding complete equation in the earlier model environment.
+
+Mutual recursors use the store's global constructor offsets. Only rules for
+the recursor's actual major family are published on that recursor. Copies of
+other families' rules in a shared table do not enable a reduction. Restored
+nested auxiliary recursors use their target block's native constructor slots.
+-/
+
+namespace Ix.Theory.Certified.Modeled
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure FamilySource (β : Type u) where
+  universes : Nat
+  parameters : Nat
+  indices : Nat
+  type : VExpr β
+  constructors : List (Ctor β)
+
+def familySource? (store : Store β) (ref : ConstRef β) : Option (FamilySource β) := do
+  let .induct universes parameters indices type constructors .safe ← store.lookup ref | none
+  return ⟨universes, parameters, indices, type, constructors⟩
+
+structure RecursorSource (β : Type u) where
+  universes : Nat
+  parameters : Nat
+  indices : Nat
+  motives : Nat
+  minors : Nat
+  type : VExpr β
+  rules : List (RecRule β)
+
+/-- K is deliberately unavailable on this admission route. It requires its
+own semantic law; a model equation does not grant proof replacement. -/
+def recursorSource? (store : Store β) (ref : ConstRef β) : Option (RecursorSource β) := do
+  let .recursor universes parameters indices motives minors type rules false .safe ← store.lookup ref | none
+  return ⟨universes, parameters, indices, motives, minors, type, rules⟩
+
+def RecursorSource.prefix (source : RecursorSource β) : Nat :=
+  source.parameters + source.motives + source.minors
+
+/-- Unlike `telN`/`dropN`, a short telescope positively declines. -/
+def splitPi? : Nat → VExpr β → Option (List (VExpr β) × VExpr β)
+  | 0, type => some ([], type)
+  | n + 1, .forallE domain body => do
+    let (domains, result) ← splitPi? n body
+    return (domain :: domains, result)
+  | _ + 1, _ => none
+
+def splitLam? : Nat → VExpr β → Option (List (VExpr β) × VExpr β)
+  | 0, expression => some ([], expression)
+  | n + 1, .lam domain body => do
+    let (domains, result) ← splitLam? n body
+    return (domain :: domains, result)
+  | _ + 1, _ => none
+
+def applyPi? : VExpr β → List (VExpr β) → Option (VExpr β)
+  | type, [] => some type
+  | .forallE _ body, argument :: rest => applyPi? (body.inst argument) rest
+  | _, _ :: _ => none
+
+/-- Inspect a constant-headed application through explicit beta redexes.
+Restoration may leave a parameter abstraction applied to its arguments. No
+definition, equation, projection or other conversion is used by this reader.
+The original type and complete equation are still checked without rewriting
+their source erasures. Fuel exhaustion is a positive decline. -/
+def betaHead? : Nat → VExpr β → Option (VExpr β)
+  | 0, _ => none
+  | fuel + 1, .app function argument => do
+    let function ← betaHead? fuel function
+    match function with
+    | .lam _ body => betaHead? fuel (body.inst argument)
+    | _ => some (.app function argument)
+  | _ + 1, expression => some expression
+
+structure MajorSource (β : Type u) where
+  family : ConstRef β
+  levels : List VLevel
+  parameters : List (VExpr β)
+  prefixDomains : List (VExpr β)
+
+/-- Read the actual major, including nested parameter expressions. Removing
+the index frame must round-trip exactly, so parameters cannot secretly depend
+on the fresh result indices. The index arguments themselves are pinned. -/
+def majorSource? (store : Store β) (source : RecursorSource β) : Option (MajorSource β) := do
+  let (prefixDomains, tail) ← splitPi? source.prefix source.type
+  let (_, .forallE major _) ← splitPi? source.indices tail | none
+  let major ← betaHead? 512 major
+  let .const family levels := major.appHead | none
+  let info ← familySource? store family
+  if info.indices != source.indices || levels.length != info.universes then none else do
+    let arguments := major.appArgs []
+    if arguments.length != info.parameters + source.indices then none else do
+      if arguments.drop info.parameters != VExpr.bvarRevRange 0 source.indices then none else do
+        let actual := arguments.take info.parameters
+        let parameters := actual.map (fun p => p.unliftN source.indices 0)
+        if parameters.map (·.liftN source.indices) != actual then none else
+          return ⟨family, levels, parameters, prefixDomains⟩
+
+structure RawRule (β : Type u) where
+  universes : Nat
+  type : VExpr β
+  lhs : VExpr β
+  rhs : VExpr β
+  deriving DecidableEq
+
+def eraseRule (rule : Signature.Rule β) : RawRule β :=
+  ⟨rule.universes, rule.type.erase, rule.lhs.erase, rule.rhs.erase⟩
+
+/-- Construct the exact source rule at a constructor's native flattened slot.
+The specialized field telescope, result family, levels, parameters and indices
+determine its whole common type. The complete stored lambda telescope is
+retained on the right, and `checkEquation?` checks it against that type; beta
+redexes left by restoration need not have identical domain spellings. -/
+def ruleSource? (store : Store β) (recursor : ConstRef β) (source : RecursorSource β)
+    (major : MajorSource β) (constructor : ConstRef β) : Option (RawRule β) := do
+  let .ctor block member _ := constructor | none
+  if major.family != .member block member then none else do
+    let family ← familySource? store major.family
+    let ctor ← store.lookupCtor constructor
+    if ctor.safety != .safe || ctor.uvars != family.universes ||
+        ctor.nparams != family.parameters then none else do
+      let some slot := store.ctorRuleIndex? constructor | none
+      let stored ← source.rules[slot]?
+      if stored.nfields != ctor.nfields then none else do
+        let specialized ← applyPi? ((ctor.type.instL major.levels).liftN source.prefix) major.parameters
+        let (fields, result) ← splitPi? ctor.nfields specialized
+        if result.appHead != .const major.family major.levels then none else do
+          let args := result.appArgs []
+          let parameters := major.parameters.map (·.liftN ctor.nfields)
+          if args.length != ctor.nparams + source.indices || args.take ctor.nparams != parameters then none else do
+            let constructorValue := VExpr.appN (.const constructor major.levels)
+              (parameters ++ VExpr.bvarRevRange 0 ctor.nfields)
+            let callArgs := VExpr.bvarRevRange ctor.nfields source.prefix ++
+              args.drop ctor.nparams ++ [constructorValue]
+            let resultType ← applyPi? (source.type.liftN (source.prefix + ctor.nfields)) callArgs
+            let telescope := major.prefixDomains ++ fields
+            let _ ← splitLam? telescope.length stored.rhs
+            return ⟨source.universes, VExpr.forallN telescope resultType,
+              VExpr.lamN telescope (VExpr.appN (.const recursor ((List.range source.universes).map VLevel.param))
+                callArgs), stored.rhs⟩
+
+def familyConstructors? (store : Store β) (ref : ConstRef β) : Option (List (ConstRef β)) := do
+  let .member block member := ref | none
+  let source ← familySource? store ref
+  return (List.range source.constructors.length).map (.ctor block member ·)
+
+def recursorRules? (store : Store β) (ref : ConstRef β) : Option (List (RawRule β)) := do
+  let source ← recursorSource? store ref
+  let major ← majorSource? store source
+  let constructors ← familyConstructors? store major.family
+  constructors.mapM (ruleSource? store ref source major)
+
+/-- A family or constructor gains no computation, projection, eta or K fact
+from this route. A recursor gains exactly its checked source equations. -/
+def sourceRules? (store : Store β) (ref : ConstRef β) : Option (List (RawRule β)) :=
+  match ref with
+  | .ctor block member _ => do
+    let _ ← familySource? store (.member block member)
+    let ctor ← store.lookupCtor ref
+    if ctor.safety = .safe then some [] else none
+  | .member .. =>
+    match store.lookup ref with
+    | some (.induct _ _ _ _ _ .safe) => some []
+    | some (.recursor ..) => recursorRules? store ref
+    | _ => none
+
+def SourceMatches (store : Store β) (companion : Companion β) : Prop :=
+  store.type companion.header.ref = some companion.header.type.erase ∧
+  store.uvars companion.header.ref = some companion.header.universes ∧
+  sourceRules? store companion.header.ref = some (companion.rules.map eraseRule)
+
+instance (store : Store β) (companion : Companion β) : Decidable (SourceMatches store companion) :=
+  inferInstanceAs (Decidable (_ ∧ _ ∧ _))
+
+def sourceFamilies? (store : Store β) (source : β) : Option (List (ConstRef β)) := do
+  let contents ← store.blocks source
+  if contents.members.isEmpty then none else do
+    contents.members.zipIdx.mapM fun (constant, index) =>
+      match constant with
+      | .induct _ _ _ _ _ .safe => some (.member source index)
+      | _ => none
+
+/-- Public family and constructor order is the actual block/member/constructor
+order. Original recursors come first, in family order; checked auxiliary
+recursors may follow. Each auxiliary's own major and native slots are read
+independently, so a proposed permutation cannot change a rule's owner. -/
+def sourceRefs? (store : Store β) (source : β) (recursors : List (ConstRef β)) :
+    Option (List (ConstRef β)) := do
+  let families ← sourceFamilies? store source
+  if recursors.length < families.length then none else do
+    let majors ← recursors.mapM fun ref => do
+      let info ← recursorSource? store ref
+      let major ← majorSource? store info
+      return major.family
+    if majors.take families.length != families then none else do
+      let members ← families.mapM fun family => do
+        let ctors ← familyConstructors? store family
+        return family :: ctors
+      return members.flatten ++ recursors
+
+structure Witness (β : Type u) where
+  source : β
+  recursors : List (ConstRef β)
+  companions : List (Companion β)
+  equations : List (List (EquationWitness β))
+
+structure Checked (entries : Environment β) (store : Store β) (witness : Witness β) : Prop where
+  layout : sourceRefs? store witness.source witness.recursors = some (witness.companions.map (·.header.ref))
+  source : ∀ companion ∈ witness.companions, SourceMatches store companion
+  models : CheckedCompanions.{u,v} entries witness.companions
+
+def check? (fuel : Nat) (entries : Environment β) (store : Store β) (witness : Witness β) :
+    Option (CheckedClaim.{u} (Checked.{u,v} entries store witness)) :=
+  if hl : sourceRefs? store witness.source witness.recursors = some (witness.companions.map (·.header.ref)) then
+    if hs : ∀ companion ∈ witness.companions, SourceMatches store companion then do
+      let checked ← checkCompanions?.{u,v} fuel entries witness.companions witness.equations
+      return ⟨hl, hs, checked.down⟩
+    else none
+  else none
+
+theorem check?_sound {fuel : Nat} {entries : Environment β} {store : Store β} {witness : Witness β} {result}
+    (_ : check?.{u,v} fuel entries store witness = some result) : Checked.{u,v} entries store witness := result.down
+
+/-- Data-only provenance, kept in each published source entry. -/
+def EntrySource (store : Store β) (ref : ConstRef β) (entry : ConstantEntry β) : Prop :=
+  ∃ decision : DecidableEq β, ∃ companion : Companion β,
+    @SourceMatches β decision store companion ∧ ref = companion.header.ref ∧ entry = companion.entry
+
+omit [DecidableEq β] in
+theorem EntrySource.not_axiom {store : Store β} {ref : ConstRef β} {entry : ConstantEntry β}
+    (source : EntrySource store ref entry) {n : Nat} {type : VExpr β} {safety : Safety}
+    (h : store.lookup ref = some (.axiom n type safety)) : False := by
+  obtain ⟨decision, companion, hm, hr, _⟩ := source
+  letI := decision
+  have hh := hm.2.2
+  rw [← hr] at hh
+  cases ref with
+  | ctor => cases h
+  | member => simp [sourceRules?, h] at hh
+
+theorem publishedEntry_source {entries : Environment β} {store : Store β} {witness : Witness β}
+    (checked : Checked.{u,v} entries store witness) {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : environment entries witness.companions ref = some entry) :
+    entries ref = some entry ∨ EntrySource store ref entry := by
+  unfold environment Environment.overlay additions at h
+  cases hc : lookupCompanion witness.companions ref with
+  | none => simp only [hc, Option.map_none] at h; exact Or.inl h
+  | some companion =>
+    have he : companion.entry = entry := by simpa [hc] using h
+    obtain ⟨hm, hr⟩ := lookupCompanion_sound hc
+    exact Or.inr ⟨inferInstance, companion, checked.source companion hm, hr.symm, he.symm⟩
+
+end Ix.Theory.Certified.Modeled
diff --git a/Ix/Theory/Certified/Modeled/Transport.lean b/Ix/Theory/Certified/Modeled/Transport.lean
new file mode 100644
index 000000000..b568ad910
--- /dev/null
+++ b/Ix/Theory/Certified/Modeled/Transport.lean
@@ -0,0 +1,290 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Modeled.Equation
+import Ix.Theory.Model.ReferenceMap
+
+/-! Simultaneous publication of source companions. Every target is already
+in the checked prefix; exact mapped types and complete model equations are
+validated here. Source kind and stored-rule correspondence are a separate
+mandatory check before this internal result becomes declaration admission. -/
+
+namespace Ix.Theory.Certified.Modeled
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure Companion (β : Type u) where
+  header : Signature.Header β
+  model : ConstRef β
+  rules : List (Signature.Rule β)
+
+def Companion.entry (companion : Companion β) : ConstantEntry β :=
+  ⟨companion.header.universes, companion.header.type, none,
+    companion.rules.map (fun rule => ⟨rule.lhs, rule.rhs⟩), []⟩
+
+def lookupCompanion : List (Companion β) → ConstRef β → Option (Companion β)
+  | [], _ => none
+  | companion :: rest, ref =>
+    if companion.header.ref = ref then some companion else lookupCompanion rest ref
+
+theorem lookupCompanion_sound {companions : List (Companion β)} {ref : ConstRef β} {companion : Companion β}
+    (h : lookupCompanion companions ref = some companion) :
+    companion ∈ companions ∧ companion.header.ref = ref := by
+  induction companions with
+  | nil => cases h
+  | cons head rest ih =>
+    unfold lookupCompanion at h
+    split at h
+    · cases Option.some.inj h
+      exact ⟨List.mem_cons_self, ‹companion.header.ref = ref›⟩
+    · obtain ⟨hm, hr⟩ := ih h
+      exact ⟨List.mem_cons_of_mem _ hm, hr⟩
+
+theorem lookupCompanion_of_mem {companions : List (Companion β)}
+    (unique : (companions.map (·.header.ref)).Nodup) {companion : Companion β}
+    (member : companion ∈ companions) : lookupCompanion companions companion.header.ref = some companion := by
+  induction companions with
+  | nil => cases member
+  | cons head rest ih =>
+    have hu := List.nodup_cons.mp unique
+    rcases List.mem_cons.mp member with rfl | hm
+    · simp [lookupCompanion]
+    · have hne : head.header.ref ≠ companion.header.ref := by
+        intro he
+        apply hu.1
+        change head.header.ref ∈ rest.map (·.header.ref)
+        rw [he]
+        exact List.mem_map.mpr ⟨companion, hm, rfl⟩
+      simp only [lookupCompanion, if_neg hne]
+      exact ih hu.2 hm
+
+def mapping (companions : List (Companion β)) (ref : ConstRef β) : ConstRef β :=
+  match lookupCompanion companions ref with
+  | none => ref
+  | some companion => companion.model
+
+def additions (companions : List (Companion β)) : Environment β :=
+  fun ref => (lookupCompanion companions ref).map Companion.entry
+
+def environment (entries : Environment β) (companions : List (Companion β)) : Environment β :=
+  entries.overlay (additions companions)
+
+def mapRule (companions : List (Companion β)) (rule : Signature.Rule β) : Signature.Rule β :=
+  ⟨rule.universes, rule.type.mapRefs (mapping companions),
+    rule.lhs.mapRefs (mapping companions), rule.rhs.mapRefs (mapping companions)⟩
+
+structure CompanionChecked (entries : Environment β) (companions : List (Companion β))
+    (companion : Companion β) : Prop where
+  modelEntry : ∃ entry, entries companion.model = some entry ∧
+    entry.universes = companion.header.universes ∧
+    entry.type = companion.header.type.mapRefs (mapping companions)
+  scope : companion.header.type.Scope companion.header.universes 0
+  references : companion.header.type.ReferencesIn (environment entries companions)
+  ruleScopes : ∀ rule ∈ companion.rules, rule.universes = companion.header.universes ∧
+    rule.lhs.Scope companion.header.universes 0 ∧ rule.rhs.Scope companion.header.universes 0
+  ruleReferences : ∀ rule ∈ companion.rules,
+    rule.lhs.ReferencesIn (environment entries companions) ∧ rule.rhs.ReferencesIn (environment entries companions)
+  rules : ∀ rule ∈ companion.rules, CheckedEquation.{u,v} entries (mapRule companions rule)
+
+structure CheckedCompanions (entries : Environment β) (companions : List (Companion β)) : Prop where
+  unique : (companions.map (·.header.ref)).Nodup
+  fresh : ∀ companion ∈ companions, entries companion.header.ref = none
+  checked : ∀ companion ∈ companions, CompanionChecked.{u,v} entries companions companion
+
+def checkRules? (fuel : Nat) (entries : Environment β) (companions : List (Companion β)) :
+    (rules : List (Signature.Rule β)) → List (EquationWitness β) →
+    Option (CheckedClaim.{u} (∀ rule ∈ rules, CheckedEquation.{u,v} entries (mapRule companions rule)))
+  | [], [] => some ⟨by simp⟩
+  | rule :: rules, witness :: witnesses => do
+    let first ← checkEquation?.{u,v} fuel entries (mapRule companions rule) witness
+    let rest ← checkRules? fuel entries companions rules witnesses
+    return ⟨by
+      intro candidate h
+      rcases List.mem_cons.mp h with rfl | h
+      · exact first.down
+      · exact rest.down candidate h⟩
+  | _, _ => none
+
+def checkCompanion? (fuel : Nat) (entries : Environment β) (companions : List (Companion β))
+    (companion : Companion β) (witnesses : List (EquationWitness β)) :
+    Option (CheckedClaim.{u} (CompanionChecked.{u,v} entries companions companion)) :=
+  match he : entries companion.model with
+  | none => none
+  | some entry =>
+    if hn : entry.universes = companion.header.universes then
+      if ht : entry.type = companion.header.type.mapRefs (mapping companions) then
+        if hs : companion.header.type.Scope companion.header.universes 0 then
+          if hr : companion.header.type.ReferencesIn (environment entries companions) then
+            if hqs : ∀ rule ∈ companion.rules, rule.universes = companion.header.universes ∧
+                rule.lhs.Scope companion.header.universes 0 ∧ rule.rhs.Scope companion.header.universes 0 then
+              if hqr : ∀ rule ∈ companion.rules,
+                  rule.lhs.ReferencesIn (environment entries companions) ∧
+                  rule.rhs.ReferencesIn (environment entries companions) then do
+                let rules ← checkRules?.{u,v} fuel entries companions companion.rules witnesses
+                return ⟨⟨entry, he, hn, ht⟩, hs, hr, hqs, hqr, rules.down⟩
+              else none
+            else none
+          else none
+        else none
+      else none
+    else none
+
+def checkEach? (fuel : Nat) (entries : Environment β) (companions : List (Companion β)) :
+    (pending : List (Companion β)) → List (List (EquationWitness β)) →
+    Option (CheckedClaim.{u} (∀ companion ∈ pending, CompanionChecked.{u,v} entries companions companion))
+  | [], [] => some ⟨by simp⟩
+  | companion :: rest, witnesses :: remaining => do
+    let first ← checkCompanion?.{u,v} fuel entries companions companion witnesses
+    let others ← checkEach? fuel entries companions rest remaining
+    return ⟨by
+      intro candidate h
+      rcases List.mem_cons.mp h with rfl | h
+      · exact first.down
+      · exact others.down candidate h⟩
+  | _, _ => none
+
+def checkCompanions? (fuel : Nat) (entries : Environment β) (companions : List (Companion β))
+    (witnesses : List (List (EquationWitness β))) :
+    Option (CheckedClaim.{u} (CheckedCompanions.{u,v} entries companions)) :=
+  if hu : (companions.map (·.header.ref)).Nodup then
+    if hf : ∀ companion ∈ companions, entries companion.header.ref = none then do
+      let checked ← checkEach?.{u,v} fuel entries companions companions witnesses
+      return ⟨hu, hf, checked.down⟩
+    else none
+  else none
+
+theorem CheckedCompanions.fixed_old {entries : Environment β} {companions : List (Companion β)}
+    (checked : CheckedCompanions.{u,v} entries companions) {ref : ConstRef β} {entry : ConstantEntry β}
+    (old : entries ref = some entry) : mapping companions ref = ref := by
+  cases hc : lookupCompanion companions ref with
+  | none => simp [mapping, hc]
+  | some companion =>
+    obtain ⟨hm, hr⟩ := lookupCompanion_sound hc
+    have hf := checked.fresh companion hm
+    rw [hr, old] at hf
+    cases hf
+
+theorem CheckedCompanions.fresh_overlay {entries : Environment β} {companions : List (Companion β)}
+    (checked : CheckedCompanions.{u,v} entries companions) : entries.Fresh (additions companions) := by
+  intro ref entry he
+  cases hc : lookupCompanion companions ref with
+  | none => simp [additions, hc] at he
+  | some companion =>
+    obtain ⟨hm, hr⟩ := lookupCompanion_sound hc
+    rw [← hr]
+    exact checked.fresh companion hm
+
+theorem CompanionChecked.closed {entries : Environment β} {companions : List (Companion β)}
+    {companion : Companion β} (checked : CompanionChecked.{u,v} entries companions companion) :
+    EntryClosed (environment entries companions) companion.entry := by
+  constructor
+  · exact checked.scope
+  · intro body h; cases h
+  · exact checked.references
+  · intro body h; cases h
+  · intro law hl
+    obtain ⟨rule, hr, rfl⟩ := List.mem_map.mp hl
+    exact (checked.ruleScopes rule hr).2
+  · intro law hl
+    obtain ⟨rule, hr, rfl⟩ := List.mem_map.mp hl
+    exact checked.ruleReferences rule hr
+  · intro fact hf; cases hf
+  · intro fact hf; cases hf
+
+/-- New entries may refer to one another. All are checked against the final
+finite signature, while old entries retain their established closure. -/
+theorem environment_wf {entries : Environment β} {companions : List (Companion β)}
+    (checked : CheckedCompanions.{u,v} entries companions) (wf : entries.WF) :
+    (environment entries companions).WF := by
+  have hnew : ∀ ref entry, additions companions ref = some entry →
+      EntryClosed (environment entries companions) entry := by
+    intro ref entry he
+    cases hc : lookupCompanion companions ref with
+    | none => simp [additions, hc] at he
+    | some companion =>
+      have hm := (lookupCompanion_sound hc).1
+      have heq : companion.entry = entry := by simpa [additions, hc] using he
+      rw [← heq]
+      exact (checked.checked companion hm).closed
+  constructor
+  all_goals
+    intro ref entry he
+    change entries.overlay (additions companions) ref = some entry at he
+    unfold Environment.overlay at he
+    split at he
+    · cases Option.some.inj he
+      first
+      | exact (hnew _ _ ‹_›).typeScope
+      | exact (hnew _ _ ‹_›).bodyScope
+      | exact (hnew _ _ ‹_›).typeReferences
+      | exact (hnew _ _ ‹_›).bodyReferences
+      | exact (hnew _ _ ‹_›).equationScope
+      | exact (hnew _ _ ‹_›).equationReferences
+      | exact (hnew _ _ ‹_›).factScope
+      | exact (hnew _ _ ‹_›).factReferences
+    · first
+      | exact wf.typeScope ref entry he
+      | exact wf.bodyScope ref entry he
+      | exact (wf.typeReferences ref entry he).overlay
+      | exact fun body hb => (wf.bodyReferences ref entry he body hb).overlay
+      | exact wf.equationScope ref entry he
+      | exact fun law hl => ⟨(wf.equationReferences ref entry he law hl).1.overlay,
+          (wf.equationReferences ref entry he law hl).2.overlay⟩
+      | exact wf.factScope ref entry he
+      | exact fun fact hf => (wf.factReferences ref entry he fact hf).overlay
+
+variable {V : Type v} [SetTheory V]
+
+def assignment (constants : Assignment β V) (companions : List (Companion β)) : Assignment β V :=
+  fun ref levels => constants (mapping companions ref) levels
+
+omit [SetTheory V] in
+theorem assignment_agrees {entries : Environment β} {companions : List (Companion β)}
+    (checked : CheckedCompanions.{u,v} entries companions) (constants : Assignment β V) :
+    Assignment.AgreesOn entries constants (assignment constants companions) := by
+  intro ref entry he levels
+  simp only [assignment, checked.fixed_old he]
+
+theorem assignment_realizes {entries : Environment β} {companions : List (Companion β)}
+    (checked : CheckedCompanions.{u,v} entries companions) (wf : entries.WF)
+    (constants : Assignment β V) (model : Realizes constants entries) :
+    Realizes (assignment constants companions) (environment entries companions) := by
+  apply (model.of_agrees wf (assignment_agrees checked constants)).overlay
+  intro ref entry he
+  cases hc : lookupCompanion companions ref with
+  | none => simp [additions, hc] at he
+  | some companion =>
+    obtain ⟨hm, hr⟩ := lookupCompanion_sound hc
+    have heq : companion.entry = entry := by simpa [additions, hc] using he
+    rw [← heq]
+    have hcomp := checked.checked companion hm
+    obtain ⟨target, ht, hn, htype⟩ := hcomp.modelEntry
+    constructor
+    · intro levels hlevels env
+      have h := model.typeValid companion.model target ht levels (hlevels.trans hn.symm) env
+      rw [htype, wellDenoted_mapRefs] at h
+      exact h
+    · intro levels hlevels env
+      have h := model.member companion.model target ht levels (hlevels.trans hn.symm) env
+      rw [htype, interp_mapRefs] at h
+      change constants (mapping companions ref) levels ∈ˢ
+        interp (fun ref values => constants (mapping companions ref) values) levels env companion.header.type
+      rw [mapping, hc]
+      exact h
+    · intro body hb; cases hb
+    · intro body hb; cases hb
+    · intro law hl levels _ env
+      obtain ⟨rule, hmem, rfl⟩ := List.mem_map.mp hl
+      have h := (hcomp.rules rule hmem).equality V constants model levels env
+        (Context.valid_nil constants levels env)
+      change interp (fun ref values => constants (mapping companions ref) values) levels env rule.lhs =
+        interp (fun ref values => constants (mapping companions ref) values) levels env rule.rhs
+      simpa only [mapRule, interp_mapRefs] using h
+    · intro fact hf; cases hf
+
+end Ix.Theory.Certified.Modeled
diff --git a/Ix/Theory/Certified/Natural/Admission.lean b/Ix/Theory/Certified/Natural/Admission.lean
new file mode 100644
index 000000000..d4b70d298
--- /dev/null
+++ b/Ix/Theory/Certified/Natural/Admission.lean
@@ -0,0 +1,63 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Admission
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Literal support is installed with the canonical Nat model in one atomic
+extension, at the reference selected by the public primitive signature. -/
+def checkNaturalExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : Ordinary.BlockWitness β) :
+    Option (CheckedExtension.{u,v} signature store state) :=
+  match hp : signature.natType with
+  | none => none
+  | some pin => do
+    let checked ← Natural.check.{u,v} fuel state.entries store pin witness
+    let entries := Natural.environment state.entries witness.source witness.recursor witness.mode
+    have extension : Extends.{u,v} signature state.entries entries := by
+      constructor
+      · intro r entry hr
+        exact Natural.environment_old checked.down hr
+      · intro V _ constants hM
+        let constants' := Natural.shape.recursorAssignment constants witness.source witness.recursor witness.mode
+        have hm := Natural.assignment_realizes checked.down state.wf constants hM.realizes
+        have ha := Ordinary.Shape.publishedAssignment_agrees checked.down.block constants
+        exact ⟨constants', hM.extend signature state.present hm ha, ha⟩
+    let result : CheckedInterface signature := {
+      entries
+      wf := Natural.environment_wf checked.down state.wf
+      present := ⟨extension.lookup _ _ state.present.1, extension.lookup _ _ state.present.2⟩
+    }
+    return {
+      result, extension
+      source := by
+        intro r entry hr
+        dsimp only [result] at hr
+        rcases Natural.environment_source checked.down hr with hold | hordinary | hnatural
+        · exact Or.inl hold
+        · exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inl hordinary))))
+        · rw [← hp] at hnatural
+          exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inl hnatural))))))))
+    }
+
+def admitNatural? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : Ordinary.BlockWitness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkNaturalExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+theorem admitNatural?_extends {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {state : AdmittedEnvironment.{u,v} signature store} {witness : Ordinary.BlockWitness β} {result}
+    (_ : admitNatural? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Natural/Checked.lean b/Ix/Theory/Certified/Natural/Checked.lean
new file mode 100644
index 000000000..49939ad6a
--- /dev/null
+++ b/Ix/Theory/Certified/Natural/Checked.lean
@@ -0,0 +1,46 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Natural.Value
+
+namespace Ix.Theory.Certified.Natural
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def fact (source : β) : ConstantFact β := .natural (.ctor source 0 0) (.ctor source 0 1)
+def entry (source : β) : ConstantEntry β := { (shape : Ordinary.Shape β).familyEntry with facts := [fact source] }
+def environment (entries : Environment β) (source recursor : β) (mode : Inductive.ElimMode) : Environment β :=
+  (shape.publishedEnvironment entries source recursor mode).insert (.member source 0) (entry source)
+
+structure Checked (entries : Environment β) (store : Store β) (pin : ConstRef β)
+    (source recursor : β) (mode : Inductive.ElimMode) : Prop where
+  block : Ordinary.CheckedBlock.{u,v} entries store source recursor shape mode
+  primitive : pin = .member source 0
+  references : (fact source).ReferencesIn (shape.publishedEnvironment entries source recursor mode)
+
+/-- Literal support is tied to the profile's selected Nat reference and the
+whole ordinary zero/successor source, not to a diagnostic name or marker. -/
+def check (fuel : Nat) (entries : Environment β) (store : Store β) (pin : ConstRef β)
+    (witness : Ordinary.BlockWitness β) :
+    Option (CheckedClaim.{u} (Checked.{u,v} entries store pin witness.source witness.recursor witness.mode)) :=
+  if hp : pin = .member witness.source 0 then
+    if hs : witness.shape.shape = shape then
+      if hr : (fact witness.source).ReferencesIn
+          (shape.publishedEnvironment entries witness.source witness.recursor witness.mode) then do
+        let block ← Ordinary.checkBlock.{u,v} fuel entries store witness
+        return ⟨⟨hs ▸ block.down, hp, hr⟩⟩
+      else none
+    else none
+  else none
+
+theorem check_sound {fuel : Nat} {entries : Environment β} {store : Store β} {pin : ConstRef β}
+    {witness : Ordinary.BlockWitness β} {result}
+    (_ : check.{u,v} fuel entries store pin witness = some result) :
+    Checked.{u,v} entries store pin witness.source witness.recursor witness.mode := result.down
+
+end Ix.Theory.Certified.Natural
diff --git a/Ix/Theory/Certified/Natural/Publish.lean b/Ix/Theory/Certified/Natural/Publish.lean
new file mode 100644
index 000000000..259d8524d
--- /dev/null
+++ b/Ix/Theory/Certified/Natural/Publish.lean
@@ -0,0 +1,90 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Natural.Checked
+
+namespace Ix.Theory.Certified.Natural
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β] {entries : Environment β} {store : Store β}
+  {pin : ConstRef β} {source recursor : β} {mode : Inductive.ElimMode}
+
+theorem family_lookup (h : Checked.{u,v} entries store pin source recursor mode) :
+    shape.publishedEnvironment entries source recursor mode (.member source 0) = some (shape : Ordinary.Shape β).familyEntry := by
+  apply Environment.insert_old h.block.recursorChecked.fresh
+  simp [Ordinary.Shape.constructorEnvironment, Environment.overlay, Ordinary.Shape.constructorEntries,
+    Ordinary.Shape.familyEnvironment]
+
+theorem environment_wf (h : Checked.{u,v} entries store pin source recursor mode) (hE : entries.WF) :
+    (environment entries source recursor mode).WF := by
+  have hb := Ordinary.Shape.publishedEnvironment_wf h.block hE
+  exact hb.insert (hb.typeScope _ (shape : Ordinary.Shape β).familyEntry (family_lookup h))
+    (by simp [entry, Ordinary.Shape.familyEntry])
+    (hb.typeReferences _ (shape : Ordinary.Shape β).familyEntry (family_lookup h))
+    (by simp [entry, Ordinary.Shape.familyEntry])
+    (by simp [entry, Ordinary.Shape.familyEntry])
+    (by simp [entry, Ordinary.Shape.familyEntry])
+    (by simp [entry, fact, ConstantFact.Scope, shape, Ordinary.Shape.familyEntry])
+    (by simpa only [entry, List.mem_singleton, forall_eq] using h.references)
+
+theorem environment_old (h : Checked.{u,v} entries store pin source recursor mode)
+    {r : ConstRef β} {old : ConstantEntry β} (hr : entries r = some old) :
+    environment entries source recursor mode r = some old := by
+  simp only [environment, Environment.insert,
+    if_neg (fresh_ne (h.block.shapeChecked.fresh _ (List.mem_cons_self ..)) hr)]
+  exact Ordinary.Shape.publishedEnvironment_old h.block hr
+
+variable {V : Type v} [SetTheory V]
+
+theorem assignment_realizes (h : Checked.{u,v} entries store pin source recursor mode)
+    (hE : entries.WF) (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (shape.recursorAssignment constants source recursor mode) (environment entries source recursor mode) := by
+  have hb := Ordinary.Shape.publishedAssignment_realizes h.block hE constants hM
+  have hr := Ordinary.Shape.recursorAssignment_reading h.block.shapeChecked h.block.recursorChecked constants
+  apply hb.insert
+  constructor
+  · exact hb.typeValid _ (shape : Ordinary.Shape β).familyEntry (family_lookup h)
+  · exact hb.member _ (shape : Ordinary.Shape β).familyEntry (family_lookup h)
+  · intro body hb; cases hb
+  · intro body hb; cases hb
+  · intro law hl; cases hl
+  · intro f hf levels hn _
+    cases List.mem_singleton.mp hf
+    have he : levels = [] := List.eq_nil_of_length_eq_zero hn
+    subst levels
+    exact ⟨rfl, meaning h.block.shapeChecked hr.toConstructorReading hM⟩
+
+end Ix.Theory.Certified.Natural
+
+namespace Ix.Theory.Certified.Natural
+
+open Model
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def EntrySource (pin : Option (ConstRef β)) (store : Store β) (r : ConstRef β) (e : ConstantEntry β) : Prop :=
+  pin = some r ∧ ∃ source recursor mode,
+    store.blocks source = some ⟨[shape.source source]⟩ ∧
+    shape.RecursorSourceMatches store source recursor mode ∧ r = .member source 0 ∧ e = entry source
+
+theorem environment_source {entries : Environment β} {store : Store β} {pin : ConstRef β}
+    {source recursor : β} {mode : Inductive.ElimMode}
+    (h : Checked.{u,v} entries store pin source recursor mode) {r : ConstRef β} {e : ConstantEntry β}
+    (hr : environment entries source recursor mode r = some e) :
+    entries r = some e ∨ Ordinary.EntrySource store r e ∨ EntrySource (some pin) store r e := by
+  unfold environment Environment.insert at hr
+  split at hr
+  next he =>
+    cases Option.some.inj hr
+    exact Or.inr (Or.inr ⟨congrArg some (h.primitive.trans he.symm), source, recursor, mode,
+      h.block.shapeChecked.exactSource, h.block.recursorChecked.exactSource, he, rfl⟩)
+  next =>
+    rcases Ordinary.publishedEntry_source h.block hr with hold | hnew
+    · exact Or.inl hold
+    · exact Or.inr (Or.inl hnew)
+
+end Ix.Theory.Certified.Natural
diff --git a/Ix/Theory/Certified/Natural/Value.lean b/Ix/Theory/Certified/Natural/Value.lean
new file mode 100644
index 000000000..526ed0bc9
--- /dev/null
+++ b/Ix/Theory/Certified/Natural/Value.lean
@@ -0,0 +1,120 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Checked
+
+namespace Ix.Theory.Certified.Natural
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.InductiveCodes Ordinary
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+def zeroConstructor : Constructor β := ⟨[], [], []⟩
+def succConstructor : Constructor β := ⟨[], [⟨[], []⟩], []⟩
+def shape : Shape β := ⟨0, [], [], .succ .zero, [zeroConstructor, succConstructor]⟩
+
+variable (constants : Assignment β V)
+
+theorem zero_positions :
+    shape.positions constants [] (fun _ => empty) (inj 0 (pt : V)) = empty := by
+  apply eq_empty
+  intro p hp
+  obtain ⟨i, field, _, hi, _, _⟩ := Shape.mem_positions
+    (shape := shape) (constants := constants) (levels := []) (env := fun _ => empty)
+    (show (shape : Shape β).constructors[0]? = some zeroConstructor from rfl)
+    (xs := []) rfl hp
+  simp [zeroConstructor] at hi
+
+theorem succ_positions :
+    shape.positions constants [] (fun _ => empty) (inj 1 (pt : V)) = sing (inj 0 pt) := by
+  apply ext
+  intro p
+  constructor
+  · intro hp
+    obtain ⟨i, field, ys, hi, hys, rfl⟩ := Shape.mem_positions
+      (shape := shape) (constants := constants) (levels := []) (env := fun _ => empty)
+      (show (shape : Shape β).constructors[1]? = some succConstructor from rfl)
+      (xs := []) rfl hp
+    have he : i = 0 := by
+      have hb := (List.getElem?_eq_some_iff.mp hi).1
+      simp only [succConstructor, List.length_singleton] at hb
+      omega
+    subst i
+    cases Option.some.inj hi
+    cases ys with
+    | nil => exact mem_sing.mpr rfl
+    | cons _ _ => exact hys.elim
+  · intro hp
+    cases mem_sing.mp hp
+    exact Shape.inj_mem_positions (shape := shape) (constants := constants) (levels := []) (env := fun _ => empty)
+      (show (shape : Shape β).constructors[1]? = some succConstructor from rfl)
+      (show (succConstructor : Constructor β).recursive[0]? = some ⟨[], []⟩ from rfl)
+      (xs := []) (ys := []) rfl trivial
+
+theorem zero_value :
+    shape.constructorValue constants [] (fun _ => empty) zeroConstructor 0 [] [] = (Numeral.value 0 : V) := by
+  have hg : shape.branches constants [] (fun _ => empty) zeroConstructor 0 [] [] = (empty : V) := by
+    rw [Shape.branches, mkTower, zero_positions]
+    apply eq_empty
+    intro p hp
+    obtain ⟨x, hx, _⟩ := mem_graph.mp hp
+    exact not_mem_empty x hx
+  rw [Shape.constructorValue, hg]
+  rfl
+
+theorem succ_value (n : V) :
+    shape.constructorValue constants [] (fun _ => empty) succConstructor 1 [] [n] = Numeral.succ n := by
+  have hg : shape.branches constants [] (fun _ => empty) succConstructor 1 [] [n] =
+      graph (fun _ => n) (sing (inj 0 pt)) := by
+    rw [Shape.branches, mkTower, succ_positions]
+    apply graph_congr
+    intro p hp
+    cases mem_sing.mp hp
+    simp only [Shape.branchBody, tag_inj, succConstructor, List.getElem?_cons_zero,
+      List.getD_cons_zero, List.length_nil, projList, Telescope.applyN]
+  rw [Shape.constructorValue, hg]
+  rfl
+
+variable {constants} {entries : Environment β} {store : Store β} {source : β}
+
+/-- Every literal is a member of the exact carrier built for zero/successor.
+This is proved by natural-number induction, not supplied as a certificate. -/
+theorem value_mem (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (n : Nat) :
+    Numeral.value n ∈ˢ shape.familyValue constants [] := by
+  induction n with
+  | zero =>
+    have hm := Shape.constructorValue_mem h hM (Context.valid_nil constants [] (fun _ => empty))
+      (show (shape : Shape β).constructors[0]? = some zeroConstructor from rfl)
+      (xs := []) (fs := []) (by trivial) (by trivial)
+    rw [zero_value] at hm
+    exact hm
+  | succ n ih =>
+    have hm := Shape.constructorValue_mem h hM (Context.valid_nil constants [] (fun _ => empty))
+      (show (shape : Shape β).constructors[1]? = some succConstructor from rfl)
+      (xs := []) (fs := [Numeral.value n]) (by trivial) (show _ ∧ True from ⟨ih, trivial⟩)
+    rw [succ_value] at hm
+    exact hm
+
+theorem meaning (h : CheckedShape.{u,v} entries store source shape)
+    {reading : Assignment β V} (hr : ConstructorReading entries shape source constants reading)
+    (hM : Realizes constants entries) :
+    NaturalMeaning reading (.member source 0) (.ctor source 0 0) (.ctor source 0 1) := by
+  constructor
+  · intro n
+    rw [hr.family [] rfl]
+    exact value_mem h hM n
+  · rw [hr.constructor [] rfl 0 zeroConstructor rfl]
+    exact zero_value constants
+  · intro n
+    rw [hr.constructor [] rfl 1 succConstructor rfl]
+    have he := Shape.constructorClosedValue_apply h hM
+      (show (shape : Shape β).constructors[1]? = some succConstructor from rfl)
+      (levels := []) (ps := []) (xs := []) (fs := [Numeral.value n]) (by trivial) (by trivial)
+      (show _ ∧ True from ⟨value_mem h hM n, trivial⟩)
+    simpa only [Telescope.applyN, Telescope.extend, List.nil_append, succ_value, Numeral.value] using he
+
+end Ix.Theory.Certified.Natural
diff --git a/Ix/Theory/Certified/Operations.lean b/Ix/Theory/Certified/Operations.lean
new file mode 100644
index 000000000..012f2573d
--- /dev/null
+++ b/Ix/Theory/Certified/Operations.lean
@@ -0,0 +1,103 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Checker
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure InferenceWitness (β : Type u) where
+  annotations : AnnotationTree
+  type : AExpr β
+  typing : TypingWitness β
+
+structure InferenceResult (entries : Environment β) (n : Nat) (Γ : Context β)
+    (source : VExpr β) where
+  reading : Reading n Γ.length source
+  type : AExpr β
+  typeScope : type.Scope n Γ.length
+  sound : TypingClaim.{u,v} entries Γ reading.val type
+
+/-- Witness-directed inference. An unchecked type suggestion is accepted only
+after the complete recursive typing validator establishes its meaning. -/
+def inferCertified (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (source : VExpr β) (witness : InferenceWitness β) :
+    Option (InferenceResult.{u,v} entries n Γ source) := do
+  let reading ← readAnnotations? n Γ.length source witness.annotations
+  if hs : witness.type.Scope n Γ.length then do
+    let h ← verifyType.{u,v} fuel n entries Γ reading.val witness.type witness.typing
+    return ⟨reading, witness.type, hs, h.down⟩
+  else none
+
+/-- The permitted head forms, including a stuck application spine. Definitions
+with bodies must be unfolded; unsupported literals and projections fail. -/
+def whnfShape (entries : Environment β) : AExpr β → Bool
+  | .bvar _ | .sort _ | .lam .. | .forallE .. => true
+  | .const r _ => (entries r).any (fun entry => entry.body.isNone)
+  | .app (.lam ..) _ => false
+  | .app f _ => whnfShape entries f
+  | .natLit _ | .proj .. => false
+
+structure WhnfWitness (β : Type u) where
+  source : InferenceWitness β
+  result : AExpr β
+  resultTyping : TypingWitness β
+  conversion : ConversionWitness β
+
+structure WhnfResult (entries : Environment β) (n : Nat) (Γ : Context β)
+    (source : VExpr β) where
+  input : InferenceResult.{u,v} entries n Γ source
+  result : AExpr β
+  resultScope : result.Scope n Γ.length
+  resultShape : whnfShape entries result = true
+  resultTyping : TypingClaim.{u,v} entries Γ result input.type
+  equal : ConversionClaim.{u,v} entries Γ input.reading.val result
+
+/-- Conservative validation rechecks both endpoints and all conversion
+premises, including every actual beta domain. It establishes hereditary
+validity for its result and does not consume an unchecked inference invariant. -/
+def whnfCertified (fuel n : Nat) (entries : Environment β) (Γ : Context β)
+    (source : VExpr β) (witness : WhnfWitness β) :
+    Option (WhnfResult.{u,v} entries n Γ source) := do
+  let input ← inferCertified fuel n entries Γ source witness.source
+  if hs : witness.result.Scope n Γ.length then
+    if hw : whnfShape entries witness.result = true then do
+      let ht ← verifyType.{u,v} fuel n entries Γ witness.result input.type witness.resultTyping
+      let he ← verifyConversion.{u,v} fuel n entries Γ input.reading.val witness.result
+        witness.conversion
+      return ⟨input, witness.result, hs, hw, ht.down, he.down⟩
+    else none
+  else none
+
+theorem inferCertified_sound {fuel n : Nat} {entries : Environment β}
+    {Γ : Context β} {source : VExpr β} {witness : InferenceWitness β}
+    {result : InferenceResult.{u,v} entries n Γ source}
+    (_ : inferCertified fuel n entries Γ source witness = some result) :
+    result.reading.val.erase = source ∧ result.type.Scope n Γ.length ∧
+      TypingClaim.{u,v} entries Γ result.reading.val result.type :=
+  ⟨result.reading.property.1, result.typeScope, result.sound⟩
+
+theorem whnfCertified_sound {fuel n : Nat} {entries : Environment β}
+    {Γ : Context β} {source : VExpr β} {witness : WhnfWitness β}
+    {result : WhnfResult.{u,v} entries n Γ source}
+    (_ : whnfCertified fuel n entries Γ source witness = some result)
+    (V : Type v) [SetTheory V] (constants : Assignment β V)
+    (hM : Realizes constants entries) (levels : List Nat) (env : Nat → V)
+    (hΓ : Γ.Valid constants levels env) :
+    result.input.reading.val.erase = source ∧ whnfShape entries result.result = true ∧
+      WellDenoted constants levels env result.input.reading.val ∧
+      WellDenoted constants levels env result.result ∧
+      interp constants levels env result.input.reading.val =
+        interp constants levels env result.result :=
+  ⟨result.input.reading.property.1, result.resultShape,
+    (result.input.sound V constants hM levels env hΓ).1,
+    (result.resultTyping V constants hM levels env hΓ).1,
+    result.equal V constants hM levels env hΓ⟩
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Ordinary/Admission.lean b/Ix/Theory/Certified/Ordinary/Admission.lean
new file mode 100644
index 000000000..bef0afc9d
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Admission.lean
@@ -0,0 +1,113 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Standard.Admission
+import Ix.Theory.Certified.Quotient.Admission
+import Ix.Theory.Certified.Structure.Admission
+import Ix.Theory.Certified.Natural.Admission
+import Ix.Theory.Certified.Modeled.Admission
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Publish the family, constructors, recursor, and its complete equations
+atomically, after their formation and semantic realization have been produced. -/
+def checkOrdinaryExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : Ordinary.BlockWitness β) :
+    Option (CheckedExtension.{u,v} signature store state) := do
+  let checked ← Ordinary.checkBlock.{u,v} fuel state.entries store witness
+  let shape := witness.shape.shape
+  let entries := shape.publishedEnvironment state.entries witness.source witness.recursor witness.mode
+  have extension : Extends.{u,v} signature state.entries entries := by
+    constructor
+    · intro r entry hr
+      exact Ordinary.Shape.publishedEnvironment_old checked.down hr
+    · intro V _ constants hM
+      let constants' := shape.recursorAssignment constants witness.source witness.recursor witness.mode
+      have hnew := Ordinary.Shape.publishedAssignment_realizes checked.down state.wf constants hM.realizes
+      have hagree := Ordinary.Shape.publishedAssignment_agrees checked.down constants
+      exact ⟨constants', hM.extend signature state.present hnew hagree, hagree⟩
+  let result : CheckedInterface signature := {
+    entries
+    wf := Ordinary.Shape.publishedEnvironment_wf checked.down state.wf
+    present := ⟨extension.lookup _ _ state.present.1, extension.lookup _ _ state.present.2⟩
+  }
+  return {
+    result, extension
+    source := by
+      intro r entry hr
+      dsimp only [result] at hr
+      rcases Ordinary.publishedEntry_source checked.down hr with hold | hnew
+      · exact Or.inl hold
+      · exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inl hnew))))
+  }
+
+def admitOrdinary? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : Ordinary.BlockWitness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkOrdinaryExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+/-- Untrusted declaration choices in dependency order. A signature stage is
+never itself an element of this public admission list. -/
+inductive DeclarationWitness (β : Type u) where
+  | definition (witness : DefinitionWitness β)
+  | ordinary (witness : Ordinary.BlockWitness β)
+  | standard (witness : Standard.Witness β)
+  | quotient (witness : Quotient.Witness β)
+  | structure (witness : Structure.Witness β)
+  | natural (witness : Ordinary.BlockWitness β)
+  | modeled (witness : Modeled.Witness β)
+
+def checkDeclarationExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) : DeclarationWitness β →
+      Option (CheckedExtension.{u,v} signature store state)
+  | .definition witness => checkDefinitionExtension? fuel state witness
+  | .ordinary witness => checkOrdinaryExtension? fuel state witness
+  | .standard witness => checkStandardExtension? fuel state witness
+  | .quotient witness => checkQuotientExtension? fuel state witness
+  | .structure witness => checkStructureExtension? fuel state witness
+  | .natural witness => checkNaturalExtension? fuel state witness
+  | .modeled witness => checkModeledExtension? fuel state witness
+
+def checkDeclarationExtensions? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) : List (DeclarationWitness β) →
+      Option (CheckedExtension.{u,v} signature store state)
+  | [] => some (CheckedExtension.refl state)
+  | witness :: rest => do
+    let step ← checkDeclarationExtension? fuel state witness
+    let rest ← checkDeclarationExtensions? fuel step.result rest
+    return step.trans rest
+
+def admitDeclaration? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) : DeclarationWitness β →
+      Option { result : AdmittedEnvironment.{u,v} signature store //
+        Extends.{u,v} signature state.entries result.entries }
+  | .definition witness => admitDefinition? fuel state witness
+  | .ordinary witness => admitOrdinary? fuel state witness
+  | .standard witness => admitStandard? fuel state witness
+  | .quotient witness => admitQuotient? fuel state witness
+  | .structure witness => admitStructure? fuel state witness
+  | .natural witness => admitNatural? fuel state witness
+  | .modeled witness => admitModeled? fuel state witness
+
+def admitDeclarations? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : List (DeclarationWitness β)) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkDeclarationExtensions?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+theorem admitOrdinary?_extends {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {state : AdmittedEnvironment.{u,v} signature store} {witness : Ordinary.BlockWitness β} {result}
+    (_ : admitOrdinary? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Ordinary/Checked.lean b/Ix/Theory/Certified/Ordinary/Checked.lean
new file mode 100644
index 000000000..75e3d8547
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Checked.lean
@@ -0,0 +1,164 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RuleEquations
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Inductive
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure BlockWitness (β : Type u) where
+  source : β
+  recursor : β
+  shape : ShapeWitness β
+  mode : ElimMode
+  constructorTypes : List (Shape.TypeWitness β)
+  recursorType : Shape.TypeWitness β
+  rules : List (RuleWitness β)
+
+structure CheckedBlock (entries : Environment β) (store : Store β) (source recursor : β)
+    (shape : Shape β) (mode : ElimMode) : Prop where
+  shapeChecked : CheckedShape.{u,v} entries store source shape
+  constructors : shape.ConstructorFormation.{u,v} entries source
+  recursorChecked : shape.RecursorFormation.{u,v} entries store source recursor mode
+  elimination : ModeEvidence.{u,v} entries shape mode
+  rules : ∀ i ctor, shape.constructors[i]? = some ctor →
+    shape.RuleFormation.{u,v} (shape.recursorEnvironment entries source recursor mode) source recursor mode i ctor
+
+def checkBlock (fuel : Nat) (entries : Environment β) (store : Store β) (witness : BlockWitness β) :
+    Option (CheckedClaim.{u} (CheckedBlock.{u,v} entries store witness.source witness.recursor witness.shape.shape witness.mode)) := do
+  let shape ← checkShape.{u,v} fuel entries store witness.source witness.shape
+  let mode ← checkMode.{u,v} fuel entries witness.shape witness.mode
+  let constructors ← witness.shape.shape.checkConstructorTypes.{u,v} fuel entries witness.source
+    witness.shape.shape.constructors witness.constructorTypes
+  let recursor ← witness.shape.shape.checkRecursorType.{u,v} fuel entries store witness.source witness.recursor
+    witness.mode witness.recursorType
+  let rules ← witness.shape.shape.checkRules.{u,v} fuel
+    (witness.shape.shape.recursorEnvironment entries witness.source witness.recursor witness.mode)
+    witness.source witness.recursor witness.mode witness.shape.shape.constructors.zipIdx witness.rules
+  return ⟨⟨shape.down, constructors.down, recursor.down, mode.down, fun i ctor hc =>
+    rules.down ctor i (List.mk_mem_zipIdx_iff_getElem?.mpr hc)⟩⟩
+
+theorem checkBlock_sound {fuel : Nat} {entries : Environment β} {store : Store β} {witness : BlockWitness β}
+    {result} (_ : checkBlock.{u,v} fuel entries store witness = some result) :
+    CheckedBlock.{u,v} entries store witness.source witness.recursor witness.shape.shape witness.mode := result.down
+
+namespace Shape
+
+def publishedRecursorEntry (shape : Shape β) (source recursor : β) (mode : ElimMode) : ConstantEntry β :=
+  { shape.recursorEntry source mode with equations := shape.recursorLaws source recursor mode }
+
+def publishedEnvironment (shape : Shape β) (entries : Environment β) (source recursor : β)
+    (mode : ElimMode) : Environment β :=
+  (shape.constructorEnvironment entries source).insert (.member recursor 0)
+    (shape.publishedRecursorEntry source recursor mode)
+
+omit [DecidableEq β] in
+theorem recursorLaws_member {shape : Shape β} {source recursor : β} {mode : ElimMode}
+    {law : ConstantEquation β} (hl : law ∈ shape.recursorLaws source recursor mode) :
+    ∃ i ctor, shape.constructors[i]? = some ctor ∧
+      law = ⟨shape.ruleLhs source recursor mode i ctor, shape.ruleRhs source recursor mode i ctor⟩ := by
+  obtain ⟨⟨ctor, i⟩, hc, he⟩ := List.mem_map.mp hl
+  exact ⟨i, ctor, List.mk_mem_zipIdx_iff_getElem?.mp hc, he.symm⟩
+
+theorem publishedEnvironment_wf {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode} (h : CheckedBlock.{u,v} entries store source recursor shape mode)
+    (hE : entries.WF) : (shape.publishedEnvironment entries source recursor mode).WF := by
+  have hwf := (recursorEnvironment_wf h.shapeChecked hE h.constructors h.recursorChecked).insert
+    (r := .member recursor 0) (entry := shape.publishedRecursorEntry source recursor mode)
+    h.recursorChecked.closed.typeScope (by simp [publishedRecursorEntry, recursorEntry])
+    h.recursorChecked.closed.typeReferences.insert (by simp [publishedRecursorEntry, recursorEntry])
+    (by
+      intro law hl
+      obtain ⟨i, ctor, hc, rfl⟩ := recursorLaws_member hl
+      exact (h.rules i ctor hc).scope)
+    (by
+      intro law hl
+      obtain ⟨i, ctor, hc, rfl⟩ := recursorLaws_member hl
+      exact (h.rules i ctor hc).references)
+    (by simp [publishedRecursorEntry, recursorEntry]) (by simp [publishedRecursorEntry, recursorEntry])
+  simpa only [publishedEnvironment, recursorEnvironment, Environment.insert_replace] using hwf
+
+theorem publishedEnvironment_old {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode} (h : CheckedBlock.{u,v} entries store source recursor shape mode)
+    {r : ConstRef β} {entry : ConstantEntry β} (hr : entries r = some entry) :
+    shape.publishedEnvironment entries source recursor mode r = some entry :=
+  Environment.insert_old h.recursorChecked.fresh (Environment.overlay_old
+    (constructorEntries_fresh h.shapeChecked) (Environment.insert_old
+      (h.shapeChecked.fresh _ (List.mem_cons_self ..)) hr))
+
+variable {V : Type v} [SetTheory V]
+
+theorem publishedAssignment_realizes {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode} (h : CheckedBlock.{u,v} entries store source recursor shape mode)
+    (hE : entries.WF) (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (shape.recursorAssignment constants source recursor mode)
+      (shape.publishedEnvironment entries source recursor mode) := by
+  have hstage := recursorAssignment_realizes h.shapeChecked hE h.constructors h.recursorChecked h.elimination constants hM
+  have hlocal : EntryRealization (shape.recursorAssignment constants source recursor mode) (.member recursor 0)
+      (shape.publishedRecursorEntry source recursor mode) := by
+    constructor
+    · exact hstage.typeValid (.member recursor 0) (shape.recursorEntry source mode) (Environment.insert_same ..)
+    · exact hstage.member (.member recursor 0) (shape.recursorEntry source mode) (Environment.insert_same ..)
+    · intro body hb; cases hb
+    · intro body hb; cases hb
+    · intro law hl levels hn env
+      obtain ⟨i, ctor, hc, rfl⟩ := recursorLaws_member hl
+      exact produced_rule_eq h.shapeChecked hE h.constructors h.recursorChecked h.elimination hM hn hc (h.rules i ctor hc) env
+    · intro fact hf; cases hf
+  have hm := hstage.insert hlocal
+  simpa only [publishedEnvironment, recursorEnvironment, Environment.insert_replace] using hm
+
+theorem publishedAssignment_agrees {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode} (h : CheckedBlock.{u,v} entries store source recursor shape mode)
+    (constants : Assignment β V) :
+    Assignment.AgreesOn entries constants (shape.recursorAssignment constants source recursor mode) :=
+  (recursorAssignment_reading h.shapeChecked h.recursorChecked constants).agrees
+
+end Shape
+
+/-- Source provenance is data-only. Both blocks and every equation endpoint
+are tied to the exact ordinary description and recursor stored in the input. -/
+def EntrySource (store : Store β) (r : ConstRef β) (entry : ConstantEntry β) : Prop :=
+  ∃ shape : Shape β, ∃ source recursor mode,
+    store.blocks source = some ⟨[shape.source source]⟩ ∧
+    shape.RecursorSourceMatches store source recursor mode ∧
+    ((r = .member source 0 ∧ entry = shape.familyEntry) ∨
+      (∃ i ctor, shape.constructors[i]? = some ctor ∧ r = .ctor source 0 i ∧ entry = shape.constructorEntry source ctor) ∨
+      (r = .member recursor 0 ∧ entry = shape.publishedRecursorEntry source recursor mode))
+
+theorem publishedEntry_source {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode} (h : CheckedBlock.{u,v} entries store source recursor shape mode)
+    {r : ConstRef β} {entry : ConstantEntry β}
+    (hr : shape.publishedEnvironment entries source recursor mode r = some entry) :
+    entries r = some entry ∨ EntrySource store r entry := by
+  have wrap : ∀ entry, ((r = .member source 0 ∧ entry = shape.familyEntry) ∨
+      (∃ i ctor, shape.constructors[i]? = some ctor ∧ r = .ctor source 0 i ∧ entry = shape.constructorEntry source ctor) ∨
+      (r = .member recursor 0 ∧ entry = shape.publishedRecursorEntry source recursor mode)) → EntrySource store r entry :=
+    fun _ hh => ⟨shape, source, recursor, mode, h.shapeChecked.exactSource, h.recursorChecked.exactSource, hh⟩
+  unfold Shape.publishedEnvironment Environment.insert at hr
+  split at hr
+  next he =>
+    cases Option.some.inj hr
+    exact Or.inr (wrap _ (Or.inr (Or.inr ⟨he, rfl⟩)))
+  next =>
+    unfold Shape.constructorEnvironment Environment.overlay at hr
+    split at hr
+    next entry' he =>
+      cases Option.some.inj hr
+      obtain ⟨i, ctor, hr, hc, he'⟩ := Shape.constructorEntries_some he
+      exact Or.inr (wrap _ (Or.inr (Or.inl ⟨i, ctor, hc, hr, he'⟩)))
+    next =>
+      unfold Shape.familyEnvironment Environment.insert at hr
+      split at hr
+      next he =>
+        cases Option.some.inj hr
+        exact Or.inr (wrap _ (Or.inl ⟨he, rfl⟩))
+      next => exact Or.inl hr
+
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/Computation.lean b/Ix/Theory/Certified/Ordinary/Computation.lean
new file mode 100644
index 000000000..00c9c2274
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Computation.lean
@@ -0,0 +1,133 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Eliminator
+
+namespace Ix.Theory.Certified.Ordinary.Shape
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Model.InductiveCodes
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def recursiveCall (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (minors : List V)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels))
+    (xs fs : List V) (j : Nat) (field : RecursiveField β) : V :=
+  Telescope.curry v (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) fun ys =>
+    Telescope.applyN (shape.largeValue constants levels env v m minors hD hlarge)
+      (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys)) ++
+        [Telescope.applyN (fs.getD j empty) ys])
+
+noncomputable def recursiveCalls (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (minors : List V)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels))
+    (ctor : Constructor β) (xs fs : List V) : List V :=
+  ctor.recursive.zipIdx.map fun (field, j) =>
+    shape.recursiveCall constants levels env v m minors hD hlarge xs fs j field
+
+variable {entries : Environment β} {store : Store β} {source : β} {shape : Shape β}
+  {constants : Assignment β V} {levels : List Nat} {env : Nat → V}
+
+theorem ihValue_childResults (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hminors : shape.MinorValuesFit constants levels env v m minors)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels))
+    {i j : Nat} {ctor : Constructor β} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs)
+    {index : V} (hi : index ∈ˢ shape.indexSet constants levels env)
+    (ha : inj i (mkTower xs) ∈ˢ (shape.container constants levels env).shapes index)
+    {g : V} (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p)))
+    (he : g = shape.branches constants levels env ctor i xs fs) :
+    shape.ihValue constants levels env v xs j field
+      (IndexedContainer.childResults hD hi ha hg
+        (IndexedContainer.fold hD hlarge (shape.algebra constants levels env v m minors))) =
+      shape.recursiveCall constants levels env v m minors hD hlarge xs fs j field := by
+  subst g
+  have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+  have hfield := hctor.2.2.2.2 field (List.mem_of_getElem? hf)
+  apply Telescope.curry_congr
+  intro ys hy
+  have hp := inj_mem_positions hc hf (FitsS.length_eq hx) hy
+  have ht := recursiveTarget_fits hctor hfield hM hΓ hx hy
+  have hchild := Telescope.applyN_mem _ (hfs.get hf) hy (recursiveResult_zero hctor hfield hM hΓ hx)
+  rw [IndexedContainer.app_childResults hD hi ha hg _ hp,
+    largeValue_apply h hM hΓ hm hminors hD hlarge ht hchild,
+    IndexedContainer.foldAt_eq hD hlarge _ (mkTower_mem (by decide : 1 ≠ 0) ht) hchild]
+  apply congrArg (IndexedContainer.fold hD hlarge (shape.algebra constants levels env v m minors))
+  apply Subtype.ext
+  simp only [IndexedContainer.child, container,
+    targetIndex_inj constants levels env hc hf (FitsS.length_eq hx) (FitsS.length_eq hy),
+    app_branches hc hf (FitsS.length_eq hx) hy]
+
+theorem ihValues_childResults (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hminors : shape.MinorValuesFit constants levels env v m minors)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels))
+    {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs)
+    {index : V} (hi : index ∈ˢ shape.indexSet constants levels env)
+    (ha : inj i (mkTower xs) ∈ˢ (shape.container constants levels env).shapes index)
+    {g : V} (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p)))
+    (he : g = shape.branches constants levels env ctor i xs fs) :
+    shape.ihValues constants levels env v ctor xs
+      (IndexedContainer.childResults hD hi ha hg
+        (IndexedContainer.fold hD hlarge (shape.algebra constants levels env v m minors))) =
+      shape.recursiveCalls constants levels env v m minors hD hlarge ctor xs fs := by
+  apply List.ext_getElem?
+  intro j
+  simp only [ihValues, recursiveCalls, List.getElem?_map, List.getElem?_zipIdx]
+  cases hf : ctor.recursive[j]? with
+  | none => rfl
+  | some field =>
+    simp only [Option.map_some, Nat.zero_add]
+    exact congrArg some (ihValue_childResults h hM hΓ hm hminors hD hlarge hc hf hx hfs hi ha hg he)
+
+/-- Semantic iota at the original constructor's result indices, with one
+recursive call for each source field and every functional argument. -/
+theorem largeValue_iota (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hminors : shape.MinorValuesFit constants levels env v m minors)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels))
+    {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs) :
+    Telescope.applyN (shape.largeValue constants levels env v m minors hD hlarge)
+      (ctor.indices.map (interp constants levels (Telescope.extend env xs)) ++
+        [shape.constructorValue constants levels env ctor i xs fs]) =
+      Telescope.applyN (minors.getD i empty)
+        (xs ++ fs ++ shape.recursiveCalls constants levels env v m minors hD hlarge ctor xs fs) := by
+  have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+  have ht := constructorResult_fits hctor hM hΓ hx
+  have hi := constructorResult_mem hctor hM hΓ hx
+  have ha : inj i (mkTower xs) ∈ˢ (shape.container constants levels env).shapes
+      (mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs)))) :=
+    mem_sep.mpr ⟨inj_mem_allShapes hc hx, resultIndex_inj constants levels env hc (FitsS.length_eq hx)⟩
+  have hg := branches_mem hc hctor hM hΓ hx hfs
+  have hx' := constructorValue_mem h hM hΓ hc hx hfs
+  rw [largeValue_apply h hM hΓ hm hminors hD hlarge ht hx',
+    IndexedContainer.foldAt_eq hD hlarge _ hi hx']
+  change IndexedContainer.fold hD hlarge _ ⟨(_, IndexedContainer.node _ _ _), _⟩ = _
+  rw [IndexedContainer.fold_node hD hlarge _ hi ha hg]
+  simp only [algebra, tag_inj, hc, ordinaryValues_inj _ (FitsS.length_eq hx)]
+  rw [decodeFields_branches hc hctor hM hΓ hx hfs,
+    ihValues_childResults h hM hΓ hm hminors hD hlarge hc hx hfs hi ha hg rfl]
+
+end Ix.Theory.Certified.Ordinary.Shape
diff --git a/Ix/Theory/Certified/Ordinary/ConstructorStage.lean b/Ix/Theory/Certified/Ordinary/ConstructorStage.lean
new file mode 100644
index 000000000..d2d72a78b
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/ConstructorStage.lean
@@ -0,0 +1,154 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RecursorValue
+import Ix.Theory.Model.Signature
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+namespace Shape
+
+def constructorEntry (shape : Shape β) (source : β) (ctor : Constructor β) : ConstantEntry β :=
+  ⟨shape.universes, ctor.type shape source, none, [], []⟩
+
+def constructorEntries (shape : Shape β) (source : β) : Environment β
+  | .ctor b 0 i => if b = source then (shape.constructors[i]?).map (shape.constructorEntry source) else none
+  | _ => none
+
+theorem constructorEntries_some {shape : Shape β} {source : β} {r : ConstRef β} {entry : ConstantEntry β}
+    (h : shape.constructorEntries source r = some entry) :
+    ∃ i ctor, r = .ctor source 0 i ∧ shape.constructors[i]? = some ctor ∧ entry = shape.constructorEntry source ctor := by
+  cases r with
+  | member _ _ => simp [constructorEntries] at h
+  | ctor b member i =>
+    cases member with
+    | succ _ => simp [constructorEntries] at h
+    | zero =>
+      by_cases hb : b = source
+      · subst b
+        simp only [constructorEntries, ↓reduceIte] at h
+        obtain ⟨ctor, hc, he⟩ := Option.map_eq_some_iff.mp h
+        exact ⟨i, ctor, rfl, hc, he.symm⟩
+      · simp [constructorEntries, hb] at h
+
+def constructorEnvironment (shape : Shape β) (entries : Environment β) (source : β) : Environment β :=
+  (shape.familyEnvironment entries source).overlay (shape.constructorEntries source)
+
+theorem constructorEntries_fresh {entries : Environment β} {store : Store β} {source : β} {shape : Shape β}
+    (h : CheckedShape.{u,v} entries store source shape) :
+    (shape.familyEnvironment entries source).Fresh (shape.constructorEntries source) := by
+  intro r entry hr
+  obtain ⟨i, ctor, rfl, hc, _⟩ := constructorEntries_some hr
+  have hf := h.fresh (.ctor source 0 i) (List.mem_cons_of_mem _
+    (List.mem_map.mpr ⟨i, List.mem_range.mpr (List.getElem?_eq_some_iff.mp hc).1, rfl⟩))
+  simpa [familyEnvironment, Environment.insert] using hf
+
+def ConstructorFormation (entries : Environment β) (shape : Shape β) (source : β) : Prop :=
+  ∀ ctor ∈ shape.constructors,
+    EntryClosed (shape.familyEnvironment entries source) (shape.constructorEntry source ctor) ∧
+    ∃ l, TypingClaim.{u,v} (shape.familyEnvironment entries source) [] (ctor.type shape source) (.sort l)
+
+structure TypeWitness (β : Type u) where
+  level : VLevel
+  witness : TypingWitness β
+
+def checkConstructorTypes (fuel : Nat) (entries : Environment β) (shape : Shape β) (source : β) :
+    (ctors : List (Constructor β)) → List (TypeWitness β) →
+      Option (CheckedClaim.{u} (∀ ctor ∈ ctors,
+        EntryClosed (shape.familyEnvironment entries source) (shape.constructorEntry source ctor) ∧
+        ∃ l, TypingClaim.{u,v} (shape.familyEnvironment entries source) [] (ctor.type shape source) (.sort l)))
+  | [], [] => some ⟨by simp⟩
+  | ctor :: ctors, witness :: witnesses =>
+    if hs : (ctor.type shape source).Scope shape.universes 0 then
+      if hr : (ctor.type shape source).ReferencesIn (shape.familyEnvironment entries source) then do
+        let ht ← verifyType.{u,v} fuel shape.universes (shape.familyEnvironment entries source) []
+          (ctor.type shape source) (.sort witness.level) witness.witness
+        let rest ← checkConstructorTypes fuel entries shape source ctors witnesses
+        return ⟨by
+          intro ctor' hc
+          rcases List.mem_cons.mp hc with rfl | hc
+          · exact ⟨⟨hs, by simp [constructorEntry], hr, by simp [constructorEntry],
+              by simp [constructorEntry], by simp [constructorEntry],
+              by simp [constructorEntry], by simp [constructorEntry]⟩, witness.level, ht.down⟩
+          · exact rest.down ctor' hc⟩
+      else none
+    else none
+  | _, _ => none
+
+theorem constructorEnvironment_wf {entries : Environment β} {store : Store β} {source : β} {shape : Shape β}
+    (h : CheckedShape.{u,v} entries store source shape) (hE : entries.WF)
+    (hT : ConstructorFormation.{u,v} entries shape source) :
+    (shape.constructorEnvironment entries source).WF := by
+  apply (familyEnvironment_wf h hE).overlay
+  intro r entry hr
+  obtain ⟨i, ctor, rfl, hc, rfl⟩ := constructorEntries_some hr
+  exact (hT ctor (List.mem_of_getElem? hc)).1
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def constructorValues (shape : Shape β) (constants : Assignment β V) : Assignment β V
+  | .ctor _ 0 i, levels =>
+    match shape.constructors[i]? with
+    | some ctor => shape.constructorClosedValue constants levels i ctor
+    | none => empty
+  | _, _ => empty
+
+noncomputable def constructorAssignment (shape : Shape β) (constants : Assignment β V) (source : β) : Assignment β V :=
+  (shape.familyAssignment constants source).overlay (shape.constructorValues constants) (shape.constructorEntries source)
+
+theorem constructorAssignment_agreesFamily {entries : Environment β} {store : Store β} {source : β}
+    {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape) (constants : Assignment β V) :
+    Assignment.AgreesOn (shape.familyEnvironment entries source) (shape.familyAssignment constants source)
+      (shape.constructorAssignment constants source) :=
+  Assignment.overlay_agrees (constructorEntries_fresh h) _ _
+
+theorem constructorAssignment_reading {entries : Environment β} {store : Store β} {source : β}
+    {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape) (constants : Assignment β V) :
+    ConstructorReading entries shape source constants (shape.constructorAssignment constants source) where
+  agrees := by
+    intro r entry hr levels
+    exact (constructorAssignment_agreesFamily h constants r entry
+      (Environment.insert_old (h.fresh _ (List.mem_cons_self ..)) hr) levels).trans
+      (familyAssignment_agrees h constants r entry hr levels)
+  family := by
+    intro levels _
+    simp only [constructorAssignment, Assignment.overlay, constructorEntries,
+      familyAssignment, Assignment.insert_same]
+  constructor := by
+    intro levels _ i ctor hc
+    simp only [constructorAssignment, Assignment.overlay, constructorEntries,
+      ↓reduceIte, hc, Option.map_some, constructorValues]
+
+theorem constructorAssignment_realizes {entries : Environment β} {store : Store β} {source : β}
+    {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape) (hE : entries.WF)
+    (hT : ConstructorFormation.{u,v} entries shape source)
+    (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (shape.constructorAssignment constants source) (shape.constructorEnvironment entries source) := by
+  have hr := constructorAssignment_reading h constants
+  have hbase := (familyAssignment_realizes h hE constants hM).of_agrees
+    (familyEnvironment_wf h hE) (constructorAssignment_agreesFamily h constants)
+  apply hbase.overlay
+  intro r entry hentry
+  obtain ⟨i, ctor, rfl, hc, rfl⟩ := constructorEntries_some hentry
+  obtain ⟨hclosed, l, htype⟩ := hT ctor (List.mem_of_getElem? hc)
+  constructor
+  · intro levels hn env
+    exact (htype V _ hbase levels env (Context.valid_nil _ _ _)).1
+  · intro levels hn env
+    rw [hr.constructor levels hn i ctor hc]
+    have hm := constructorClosedValue_mem_source h hr.toFamilyReading hM hn hc
+    rwa [interp_closed (ctor.type shape source) _ levels hclosed.typeScope (fun _ => empty) env] at hm
+  · intro body hb; cases hb
+  · intro body hb; cases hb
+  · intro law hl; simp only [constructorEntry, List.not_mem_nil] at hl
+  · intro fact hf; simp only [constructorEntry, List.not_mem_nil] at hf
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/Constructors.lean b/Ix/Theory/Certified/Ordinary/Constructors.lean
new file mode 100644
index 000000000..a06885be8
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Constructors.lean
@@ -0,0 +1,237 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Container
+
+namespace Ix.Theory.Certified.Ordinary.Shape
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.InductiveCodes
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def carrier (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) : V := (shape.container constants levels env).carrier (shape.level.eval levels)
+
+noncomputable def recursiveSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (xs : List V) (field : RecursiveField β) : V :=
+  Telescope.piN (shape.level.eval levels)
+    (Telescope.interpret constants levels (Telescope.extend env xs) field.domains)
+    (fun ys => app (shape.carrier constants levels env)
+      (mkTower (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys)))))
+
+def RecursiveValuesFit (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (ctor : Constructor β) (xs fs : List V) : Prop :=
+  FitsS (Telescope.simple (ctor.recursive.map (shape.recursiveSet constants levels env xs))) fs
+
+noncomputable def branchBody (ctor : Constructor β) (fs : List V) (p : V) : V :=
+  match ctor.recursive[tag p]? with
+  | none => empty
+  | some field => Telescope.applyN (fs.getD (tag p) empty) (projList field.domains.length (ssnd p))
+
+noncomputable def branches (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (ctor : Constructor β) (i : Nat) (xs fs : List V) : V :=
+  graph (branchBody ctor fs) (shape.positions constants levels env (inj i (mkTower xs)))
+
+noncomputable def constructorValue (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (ctor : Constructor β) (i : Nat) (xs fs : List V) : V :=
+  IndexedContainer.node (shape.level.eval levels) (inj i (mkTower xs))
+    (shape.branches constants levels env ctor i xs fs)
+
+theorem RecursiveValuesFit.get {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {ctor : Constructor β} {xs fs : List V}
+    (h : shape.RecursiveValuesFit constants levels env ctor xs fs)
+    {j : Nat} {field : RecursiveField β} (hf : ctor.recursive[j]? = some field) :
+    fs.getD j empty ∈ˢ shape.recursiveSet constants levels env xs field := by
+  apply Telescope.fits_simple_getD h
+  simp only [List.getElem?_map, hf, Option.map_some]
+
+theorem app_branches {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {ctor : Constructor β} {field : RecursiveField β} {i j : Nat}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field)
+    {xs ys fs : List V} (hx : xs.length = ctor.fields.length)
+    (hy : FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys) :
+    app (shape.branches constants levels env ctor i xs fs) (inj j (mkTower ys)) =
+      Telescope.applyN (fs.getD j empty) ys := by
+  rw [branches, app_graph (inj_mem_positions hc hf hx hy)]
+  simp only [branchBody, tag_inj, hf, ssnd_inj, projList_mkTower _ _ (FitsS.length_eq hy)]
+
+variable {entries : Environment β} {shape : Shape β} {constants : Assignment β V}
+  {levels : List Nat} {env : Nat → V} {ctor : Constructor β}
+
+theorem recursiveSet_mem_univ {field : RecursiveField β}
+    (h : ConstructorEvidence.{u,v} entries shape ctor)
+    (hr : RecursiveEvidence.{u,v} entries shape ctor field) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs) :
+    shape.recursiveSet constants levels env xs field ∈ˢ (univ (shape.level.eval levels) : V) := by
+  apply Telescope.piN_mem_univ
+  · exact fun hw => hr.2.2.1 shape.level rfl V constants hM levels _
+      (h.2.1.valid constants hM levels hΓ hx) hw
+  · intro ys hy
+    exact (shape.container constants levels env).carrier_fibre_mem (shape.level.eval levels)
+      (recursiveTarget_mem h hr hM hΓ hx hy)
+
+theorem recursiveResult_zero {field : RecursiveField β}
+    (h : ConstructorEvidence.{u,v} entries shape ctor)
+    (hr : RecursiveEvidence.{u,v} entries shape ctor field) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hw : shape.level.eval levels = 0) :
+    ∀ ys, FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys →
+      app (shape.carrier constants levels env)
+        (mkTower (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys))))
+          ∈ˢ (univZero : V) := by
+  intro ys hy
+  have hm := (shape.container constants levels env).carrier_fibre_mem (shape.level.eval levels)
+    (recursiveTarget_mem h hr hM hΓ hx hy)
+  simpa only [hw, univ_zero, carrier] using hm
+
+theorem branches_mem {i : Nat} (hc : shape.constructors[i]? = some ctor)
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs) :
+    shape.branches constants levels env ctor i xs fs ∈ˢ
+      piSet (shape.positions constants levels env (inj i (mkTower xs)))
+        (fun p => app (shape.carrier constants levels env)
+          (shape.targetIndex constants levels env (inj i (mkTower xs)) p)) := by
+  apply graph_mem_piSet
+  intro p hp
+  obtain ⟨j, field, ys, hf, hy, rfl⟩ := mem_positions hc (FitsS.length_eq hx) hp
+  simp only [branchBody, tag_inj, hf, ssnd_inj, projList_mkTower _ _ (FitsS.length_eq hy),
+    targetIndex_inj constants levels env hc hf (FitsS.length_eq hx) (FitsS.length_eq hy)]
+  exact Telescope.applyN_mem _ (hfs.get hf) hy
+    (recursiveResult_zero h (h.2.2.2.2 field (List.mem_of_getElem? hf)) hM hΓ hx)
+
+theorem constructorValue_mem {store : Store β} {source : β}
+    (h : CheckedShape.{u,v} entries store source shape) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {i : Nat}
+    (hc : shape.constructors[i]? = some ctor) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs) :
+    shape.constructorValue constants levels env ctor i xs fs ∈ˢ
+      app (shape.carrier constants levels env)
+        (mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs)))) := by
+  have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+  apply IndexedContainer.node_mem_carrier (container_wf h hM hΓ)
+    (constructorResult_mem hctor hM hΓ hx)
+  · exact mem_sep.mpr ⟨inj_mem_allShapes hc hx, resultIndex_inj constants levels env hc (FitsS.length_eq hx)⟩
+  · exact branches_mem hc hctor hM hΓ hx hfs
+
+/-- Reconstruct one recursive function from the container's branch graph.
+Eta will recover the original source function, including at Prop. -/
+noncomputable def decodeField (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (xs : List V) (j : Nat) (field : RecursiveField β) (g : V) : V :=
+  Telescope.curry (shape.level.eval levels)
+    (Telescope.interpret constants levels (Telescope.extend env xs) field.domains)
+    (fun ys => app g (inj j (mkTower ys)))
+
+noncomputable def decodeFields (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (ctor : Constructor β) (xs : List V) (g : V) : List V :=
+  ctor.recursive.zipIdx.map fun (field, j) => shape.decodeField constants levels env xs j field g
+
+theorem getD_decodeFields (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (ctor : Constructor β) (xs : List V) (g : V) {j : Nat} {field : RecursiveField β}
+    (hf : ctor.recursive[j]? = some field) :
+    (shape.decodeFields constants levels env ctor xs g).getD j empty =
+      shape.decodeField constants levels env xs j field g := by
+  simp only [decodeFields, List.getD_eq_getElem?_getD, List.getElem?_map,
+    List.getElem?_zipIdx, hf, Option.map_some, Nat.zero_add, Option.getD_some]
+
+theorem decodeField_mem {i j : Nat} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field)
+    {xs : List V} (hx : xs.length = ctor.fields.length) {g : V}
+    (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p))) :
+    shape.decodeField constants levels env xs j field g ∈ˢ shape.recursiveSet constants levels env xs field := by
+  apply Telescope.curry_mem
+  intro ys hy
+  have hp := app_mem_of_mem_piSet hg (inj_mem_positions hc hf hx hy)
+  rwa [targetIndex_inj constants levels env hc hf hx (FitsS.length_eq hy)] at hp
+
+theorem decodeFields_fit {i : Nat} (hc : shape.constructors[i]? = some ctor)
+    {xs : List V} (hx : xs.length = ctor.fields.length) {g : V}
+    (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p))) :
+    shape.RecursiveValuesFit constants levels env ctor xs (shape.decodeFields constants levels env ctor xs g) := by
+  apply Telescope.fits_simple_map
+  · simp only [decodeFields, List.length_map, List.length_zipIdx]
+  · intro j field hf
+    rw [getD_decodeFields _ _ _ _ _ _ _ hf]
+    exact decodeField_mem hc hf hx hg
+
+theorem applyN_decodeField {i j : Nat} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field)
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs ys : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hy : FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys) {g : V}
+    (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p))) :
+    Telescope.applyN (shape.decodeField constants levels env xs j field g) ys = app g (inj j (mkTower ys)) := by
+  apply Telescope.applyN_curry _ hy
+  · intro zs hz
+    have hm := app_mem_of_mem_piSet hg (inj_mem_positions hc hf (FitsS.length_eq hx) hz)
+    rwa [targetIndex_inj constants levels env hc hf (FitsS.length_eq hx) (FitsS.length_eq hz)] at hm
+  · exact recursiveResult_zero h (h.2.2.2.2 field (List.mem_of_getElem? hf)) hM hΓ hx
+
+theorem decodeField_branches {i j : Nat} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field)
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs) :
+    shape.decodeField constants levels env xs j field (shape.branches constants levels env ctor i xs fs) =
+      fs.getD j empty := by
+  change Telescope.curry _ _ _ = _
+  calc
+    _ = Telescope.curry (shape.level.eval levels)
+        (Telescope.interpret constants levels (Telescope.extend env xs) field.domains)
+        (Telescope.applyN (fs.getD j empty)) := by
+      apply Telescope.curry_congr
+      exact fun ys hy => app_branches hc hf (FitsS.length_eq hx) hy
+    _ = _ := Telescope.curry_applyN _ (hfs.get hf)
+      (recursiveResult_zero h (h.2.2.2.2 field (List.mem_of_getElem? hf)) hM hΓ hx)
+
+theorem decodeFields_branches {i : Nat} (hc : shape.constructors[i]? = some ctor)
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs) :
+    shape.decodeFields constants levels env ctor xs (shape.branches constants levels env ctor i xs fs) = fs := by
+  apply List.ext_getElem
+  · simpa only [decodeFields, List.length_map, List.length_zipIdx] using (FitsS.length_eq hfs).symm
+  · intro j hj hj'
+    have hjc : j < ctor.recursive.length := by
+      simpa only [decodeFields, List.length_map, List.length_zipIdx] using hj
+    have hf := List.getElem?_eq_getElem (l := ctor.recursive) hjc
+    have he := (getD_decodeFields shape constants levels env ctor xs _ hf).trans
+      (decodeField_branches hc hf h hM hΓ hx hfs)
+    simpa only [List.getD_eq_getElem?_getD, List.getElem?_eq_getElem hj,
+      List.getElem?_eq_getElem hj', Option.getD_some] using he
+
+theorem branches_decodeFields {i : Nat} (hc : shape.constructors[i]? = some ctor)
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs) {g : V}
+    (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p))) :
+    shape.branches constants levels env ctor i xs (shape.decodeFields constants levels env ctor xs g) = g := by
+  apply eq_of_mem_piSet_app_eq (branches_mem hc h hM hΓ hx (decodeFields_fit hc (FitsS.length_eq hx) hg)) hg
+  intro p hp
+  obtain ⟨j, field, ys, hf, hy, rfl⟩ := mem_positions hc (FitsS.length_eq hx) hp
+  rw [app_branches hc hf (FitsS.length_eq hx) hy, getD_decodeFields _ _ _ _ _ _ _ hf]
+  apply Telescope.applyN_curry _ hy
+  · intro zs hz
+    have hm := app_mem_of_mem_piSet hg (inj_mem_positions hc hf (FitsS.length_eq hx) hz)
+    rwa [targetIndex_inj constants levels env hc hf (FitsS.length_eq hx) (FitsS.length_eq hz)] at hm
+  · exact recursiveResult_zero h (h.2.2.2.2 field (List.mem_of_getElem? hf)) hM hΓ hx
+
+end Ix.Theory.Certified.Ordinary.Shape
diff --git a/Ix/Theory/Certified/Ordinary/Container.lean b/Ix/Theory/Certified/Ordinary/Container.lean
new file mode 100644
index 000000000..c30fb56ea
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Container.lean
@@ -0,0 +1,266 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Shape
+import Ix.Theory.Model.Inductive.Container
+import Ix.Theory.Model.Inductive.Codes
+
+/-!
+Construct the indexed container from the exact checked source description.
+Shapes contain a constructor tag and its ordinary fields. Positions contain
+a recursive-field tag and that function field's arguments. Indices are
+dependent tuple codes. No carrier, closed member, or semantic law is supplied
+by the witness.
+-/
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.InductiveCodes
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+namespace Shape
+
+noncomputable def indexSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) : V := towerSet 1 (Telescope.interpret constants levels env shape.indices)
+
+noncomputable def ordinaryValues (ctor : Constructor β) (a : V) : List V :=
+  projList ctor.fields.length (ssnd a)
+
+noncomputable def ordinaryEnv (ctor : Constructor β) (env : Nat → V) (a : V) : Nat → V :=
+  Telescope.extend env (ordinaryValues ctor a)
+
+noncomputable def ordinaryFibre (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (i : Nat) : V :=
+  match shape.constructors[i]? with
+  | none => empty
+  | some ctor => towerSet 1 (Telescope.interpret constants levels env ctor.fields)
+
+noncomputable def allShapes (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) : V := sumSet 1 (shape.ordinaryFibre constants levels env)
+
+noncomputable def resultIndex (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (a : V) : V :=
+  match shape.constructors[tag a]? with
+  | none => empty
+  | some ctor => mkTower (ctor.indices.map (interp constants levels (ordinaryEnv ctor env a)))
+
+noncomputable def positionFibre (ctor : Constructor β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (a : V) (i : Nat) : V :=
+  match ctor.recursive[i]? with
+  | none => empty
+  | some field => towerSet 1 (Telescope.interpret constants levels (ordinaryEnv ctor env a) field.domains)
+
+noncomputable def positions (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (a : V) : V :=
+  match shape.constructors[tag a]? with
+  | none => empty
+  | some ctor => sumSet 1 (positionFibre ctor constants levels env a)
+
+noncomputable def targetIndex (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (a p : V) : V :=
+  match shape.constructors[tag a]? with
+  | none => empty
+  | some ctor =>
+    match ctor.recursive[tag p]? with
+    | none => empty
+    | some field =>
+      let args := projList field.domains.length (ssnd p)
+      let extended := Telescope.extend (ordinaryEnv ctor env a) args
+      mkTower (field.indices.map (interp constants levels extended))
+
+noncomputable def container (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) : IndexedContainer V where
+  indices := shape.indexSet constants levels env
+  shapes i := sep (shape.allShapes constants levels env)
+    (fun a => shape.resultIndex constants levels env a = i)
+  positions := shape.positions constants levels env
+  target := shape.targetIndex constants levels env
+
+theorem ordinaryValues_inj {ctor : Constructor β} (i : Nat) {xs : List V}
+    (hlen : xs.length = ctor.fields.length) :
+    ordinaryValues ctor (inj i (mkTower xs)) = xs := by
+  simp only [ordinaryValues, ssnd_inj, projList_mkTower _ _ hlen]
+
+theorem ordinaryEnv_inj {ctor : Constructor β} (env : Nat → V) (i : Nat) {xs : List V}
+    (hlen : xs.length = ctor.fields.length) :
+    ordinaryEnv ctor env (inj i (mkTower xs)) = Telescope.extend env xs := by
+  rw [ordinaryEnv, ordinaryValues_inj i hlen]
+
+theorem resultIndex_inj {shape : Shape β} (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor)
+    {xs : List V} (hlen : xs.length = ctor.fields.length) :
+    shape.resultIndex constants levels env (inj i (mkTower xs)) =
+      mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs))) := by
+  simp only [resultIndex, tag_inj, hc, ordinaryEnv_inj env i hlen]
+
+theorem positions_inj {shape : Shape β} (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor) (x : V) :
+    shape.positions constants levels env (inj i x) =
+      sumSet 1 (positionFibre ctor constants levels env (inj i x)) := by
+  simp only [positions, tag_inj, hc]
+
+theorem targetIndex_inj {shape : Shape β} (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) {i j : Nat} {ctor : Constructor β} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field)
+    {xs ys : List V} (hx : xs.length = ctor.fields.length) (hy : ys.length = field.domains.length) :
+    shape.targetIndex constants levels env (inj i (mkTower xs)) (inj j (mkTower ys)) =
+      mkTower (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys))) := by
+  simp only [targetIndex, tag_inj, hc, hf, ssnd_inj,
+    projList_mkTower _ _ hy, ordinaryEnv_inj env i hx]
+
+theorem mem_allShapes {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {a : V} (ha : a ∈ˢ shape.allShapes constants levels env) :
+    ∃ i ctor xs, shape.constructors[i]? = some ctor ∧
+      FitsS (Telescope.interpret constants levels env ctor.fields) xs ∧ a = inj i (mkTower xs) := by
+  obtain ⟨i, x, hx, rfl⟩ := sumSet_elim (by decide : 1 ≠ 0) ha
+  cases hc : shape.constructors[i]? with
+  | none =>
+    simp only [ordinaryFibre, hc] at hx
+    exact (not_mem_empty x hx).elim
+  | some ctor =>
+    simp only [ordinaryFibre, hc] at hx
+    obtain ⟨hfit, he⟩ := towerSet_elim (by decide : 1 ≠ 0) _ hx
+    exact ⟨i, ctor, _, hc, hfit, congrArg (inj i) he⟩
+
+theorem mem_positions {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor)
+    {xs : List V} (hx : xs.length = ctor.fields.length) {p : V}
+    (hp : p ∈ˢ shape.positions constants levels env (inj i (mkTower xs))) :
+    ∃ j field ys, ctor.recursive[j]? = some field ∧
+      FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys ∧
+      p = inj j (mkTower ys) := by
+  rw [positions_inj constants levels env hc] at hp
+  obtain ⟨j, y, hy, rfl⟩ := sumSet_elim (by decide : 1 ≠ 0) hp
+  cases hf : ctor.recursive[j]? with
+  | none =>
+    simp only [positionFibre, hf] at hy
+    exact (not_mem_empty y hy).elim
+  | some field =>
+    simp only [positionFibre, hf, ordinaryEnv_inj env i hx] at hy
+    obtain ⟨hfit, he⟩ := towerSet_elim (by decide : 1 ≠ 0) _ hy
+    exact ⟨j, field, _, hf, hfit, congrArg (inj j) he⟩
+
+theorem inj_mem_allShapes {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor)
+    {xs : List V} (hxs : FitsS (Telescope.interpret constants levels env ctor.fields) xs) :
+    inj i (mkTower xs) ∈ˢ shape.allShapes constants levels env := by
+  apply inj_mem (by decide : 1 ≠ 0)
+  simpa only [ordinaryFibre, hc] using mkTower_mem (by decide : 1 ≠ 0) hxs
+
+theorem inj_mem_positions {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {i j : Nat} {ctor : Constructor β} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field)
+    {xs ys : List V} (hx : xs.length = ctor.fields.length)
+    (hys : FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys) :
+    inj j (mkTower ys) ∈ˢ shape.positions constants levels env (inj i (mkTower xs)) := by
+  rw [positions_inj constants levels env hc]
+  apply inj_mem (by decide : 1 ≠ 0)
+  simpa only [positionFibre, hf, ordinaryEnv_inj env i hx] using
+    mkTower_mem (by decide : 1 ≠ 0) hys
+
+variable {entries : Environment β} {shape : Shape β} {constants : Assignment β V}
+  {levels : List Nat} {env : Nat → V}
+
+theorem constructorResult_fits {ctor : Constructor β}
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs) :
+    FitsS (Telescope.interpret constants levels env shape.indices)
+      (ctor.indices.map (interp constants levels (Telescope.extend env xs))) := by
+  have hΓ' := h.2.1.valid constants hM levels hΓ hx
+  have ht := h.2.2.2.1 V constants hM levels (Telescope.extend env xs) hΓ'
+  have ht' := (Telescope.fits_lift constants levels (Telescope.extend env xs)
+    ctor.fields.length shape.indices 0 _).mp ht
+  rw [← FitsS.length_eq hx, Telescope.skip_extend] at ht'
+  exact ht'
+
+theorem constructorResult_mem {ctor : Constructor β}
+    (h : ConstructorEvidence.{u,v} entries shape ctor) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs) :
+    mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs))) ∈ˢ
+      shape.indexSet constants levels env :=
+  mkTower_mem (by decide : 1 ≠ 0) (constructorResult_fits h hM hΓ hx)
+
+theorem recursiveTarget_fits {ctor : Constructor β} {field : RecursiveField β}
+    (h : ConstructorEvidence.{u,v} entries shape ctor)
+    (hr : RecursiveEvidence.{u,v} entries shape ctor field) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs ys : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hy : FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys) :
+    FitsS (Telescope.interpret constants levels env shape.indices)
+      (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys))) := by
+  have hΓ' := h.2.1.valid constants hM levels hΓ hx
+  have hΓ'' := hr.2.1.valid constants hM levels hΓ' hy
+  have ht := hr.2.2.2 V constants hM levels _ hΓ''
+  have ht' := (Telescope.fits_lift constants levels (Telescope.extend (Telescope.extend env xs) ys)
+    (ctor.fields.length + field.domains.length) shape.indices 0 _).mp ht
+  rw [← Telescope.extend_append, ← FitsS.length_eq hx, ← FitsS.length_eq hy,
+    ← List.length_append, Telescope.skip_extend] at ht'
+  simpa only [Telescope.extend_append] using ht'
+
+theorem recursiveTarget_mem {ctor : Constructor β} {field : RecursiveField β}
+    (h : ConstructorEvidence.{u,v} entries shape ctor)
+    (hr : RecursiveEvidence.{u,v} entries shape ctor field) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) {xs ys : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hy : FitsS (Telescope.interpret constants levels (Telescope.extend env xs) field.domains) ys) :
+    mkTower (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys))) ∈ˢ
+      shape.indexSet constants levels env :=
+  mkTower_mem (by decide : 1 ≠ 0) (recursiveTarget_fits h hr hM hΓ hx hy)
+
+theorem allShapes_mem
+    (h : ∀ ctor ∈ shape.constructors, ConstructorEvidence.{u,v} entries shape ctor)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    (hw : shape.level.eval levels ≠ 0) :
+    shape.allShapes constants levels env ∈ˢ (univ (shape.level.eval levels) : V) := by
+  apply sum_graph_mem hw
+  intro i
+  cases hc : shape.constructors[i]? with
+  | none => simpa only [ordinaryFibre, hc] using empty_mem_univ (V := V) (shape.level.eval levels)
+  | some ctor =>
+    simp only [ordinaryFibre, hc]
+    apply Telescope.tower_graph_mem hw
+    exact (h ctor (List.mem_of_getElem? hc)).2.2.1 shape.level rfl V constants hM levels env hΓ hw
+
+/-- Every fixed-point premise is produced from checked field sorts and
+dependent index applications. In particular, target-index membership is not
+an assumed container property of the input. -/
+theorem container_wf {store : Store β} {source : β}
+    (h : CheckedShape.{u,v} entries store source shape) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants levels env) :
+    (shape.container constants levels env).WF (shape.level.eval levels) := by
+  constructor
+  · intro hw i hi
+    exact univ_sep_mem (allShapes_mem h.constructors hM hΓ hw)
+  · intro hw i a hi ha
+    obtain ⟨ha, _⟩ := mem_sep.mp ha
+    obtain ⟨j, ctor, xs, hc, hxs, rfl⟩ := mem_allShapes ha
+    change shape.positions constants levels env _ ∈ˢ _
+    rw [positions_inj constants levels env hc]
+    apply sum_graph_mem hw
+    intro k
+    cases hf : ctor.recursive[k]? with
+    | none => simpa only [positionFibre, hf] using empty_mem_univ (V := V) (shape.level.eval levels)
+    | some field =>
+      simp only [positionFibre, hf, ordinaryEnv_inj env j (FitsS.length_eq hxs)]
+      apply Telescope.tower_graph_mem hw
+      have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+      have hfield := hctor.2.2.2.2 field (List.mem_of_getElem? hf)
+      exact hfield.2.2.1 shape.level rfl V constants hM levels _
+        (hctor.2.1.valid constants hM levels hΓ hxs) hw
+  · intro i a p hi ha hp
+    obtain ⟨ha, _⟩ := mem_sep.mp ha
+    obtain ⟨j, ctor, xs, hc, hxs, rfl⟩ := mem_allShapes ha
+    obtain ⟨k, field, ys, hf, hys, rfl⟩ := mem_positions hc (FitsS.length_eq hxs) hp
+    change shape.targetIndex constants levels env _ _ ∈ˢ shape.indexSet constants levels env
+    rw [targetIndex_inj constants levels env hc hf (FitsS.length_eq hxs) (FitsS.length_eq hys)]
+    have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+    exact recursiveTarget_mem hctor (hctor.2.2.2.2 field (List.mem_of_getElem? hf)) hM hΓ hxs hys
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/Eliminator.lean b/Ix/Theory/Certified/Ordinary/Eliminator.lean
new file mode 100644
index 000000000..937c805b2
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Eliminator.lean
@@ -0,0 +1,264 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.LargeElim
+
+namespace Ix.Theory.Certified.Ordinary.Shape
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Model.InductiveCodes
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def motiveSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (motiveLevel : Nat) : V :=
+  Telescope.piN 1 (Telescope.interpret constants levels env shape.indices)
+    (fun is => piR 1 (app (shape.carrier constants levels env) (mkTower is))
+      (fun _ => univ motiveLevel))
+
+noncomputable def motive (shape : Shape β) (m : V) (i x : V) : V :=
+  app (Telescope.applyN m (projList shape.indices.length i)) x
+
+theorem motive_mem {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {v : Nat} {m i x : V}
+    (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hi : i ∈ˢ shape.indexSet constants levels env)
+    (hx : x ∈ˢ app (shape.carrier constants levels env) i) :
+    shape.motive m i x ∈ˢ (univ v : V) := by
+  obtain ⟨hfit, he⟩ := towerSet_elim (by decide : 1 ≠ 0) _ hi
+  have ht := Telescope.applyN_mem _ hm hfit (fun h => (by omega : False).elim)
+  rw [← he] at ht
+  exact app_mem_piR_pos (by decide : 1 ≠ 0) ht hx
+
+noncomputable def ihSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (xs fs : List V) (j : Nat) (field : RecursiveField β) : V :=
+  Telescope.piN v (Telescope.interpret constants levels (Telescope.extend env xs) field.domains)
+    (fun ys => shape.motive m
+      (mkTower (field.indices.map (interp constants levels (Telescope.extend (Telescope.extend env xs) ys))))
+      (Telescope.applyN (fs.getD j empty) ys))
+
+noncomputable def ihTypes (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (ctor : Constructor β) (xs fs : List V) : List V :=
+  ctor.recursive.zipIdx.map fun (field, j) => shape.ihSet constants levels env v m xs fs j field
+
+def IHValuesFit (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (ctor : Constructor β) (xs fs hs : List V) : Prop :=
+  FitsS (Telescope.simple (shape.ihTypes constants levels env v m ctor xs fs)) hs
+
+noncomputable def minorSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (i : Nat) (ctor : Constructor β) : V :=
+  Telescope.piN v (Telescope.interpret constants levels env ctor.fields) fun xs =>
+    Telescope.piN v (Telescope.simple (ctor.recursive.map (shape.recursiveSet constants levels env xs))) fun fs =>
+      Telescope.piN v (Telescope.simple (shape.ihTypes constants levels env v m ctor xs fs)) fun _ =>
+        shape.motive m (mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs))))
+          (shape.constructorValue constants levels env ctor i xs fs)
+
+noncomputable def minorTypes (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) : List V :=
+  shape.constructors.zipIdx.map fun (ctor, i) => shape.minorSet constants levels env v m i ctor
+
+def MinorValuesFit (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (minors : List V) : Prop :=
+  FitsS (Telescope.simple (shape.minorTypes constants levels env v m)) minors
+
+theorem MinorValuesFit.get {shape : Shape β} {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {v : Nat} {m : V} {minors : List V}
+    (h : shape.MinorValuesFit constants levels env v m minors)
+    {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor) :
+    minors.getD i empty ∈ˢ shape.minorSet constants levels env v m i ctor := by
+  apply Telescope.fits_simple_getD h
+  simp only [minorTypes, List.getElem?_map, List.getElem?_zipIdx, hc, Option.map_some, Nat.zero_add]
+
+variable {entries : Environment β} {store : Store β} {source : β} {shape : Shape β}
+  {constants : Assignment β V} {levels : List Nat} {env : Nat → V}
+
+theorem minorResult_mem_univ (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor) {xs fs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs) :
+    shape.motive m (mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs))))
+      (shape.constructorValue constants levels env ctor i xs fs) ∈ˢ (univ v : V) :=
+  motive_mem hm (constructorResult_mem (h.constructors ctor (List.mem_of_getElem? hc)) hM hΓ hx)
+    (constructorValue_mem h hM hΓ hc hx hfs)
+
+theorem minor_apply_mem (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m minor : V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor)
+    (hminor : minor ∈ˢ shape.minorSet constants levels env v m i ctor) {xs fs hs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels env ctor xs fs)
+    (hhs : shape.IHValuesFit constants levels env v m ctor xs fs hs) :
+    Telescope.applyN minor (xs ++ fs ++ hs) ∈ˢ
+      shape.motive m (mkTower (ctor.indices.map (interp constants levels (Telescope.extend env xs))))
+        (shape.constructorValue constants levels env ctor i xs fs) := by
+  simp only [Telescope.applyN_append]
+  have hxstep := Telescope.applyN_mem _ hminor hx (fun hv ys hy => by
+    subst v
+    apply Telescope.piN_zero_mem
+    intro gs hgs
+    apply Telescope.piN_zero_mem
+    intro _ _
+    simpa only [univ_zero] using minorResult_mem_univ h hM hΓ hm hc hy hgs)
+  have hfsstep := Telescope.applyN_mem _ hxstep hfs (fun hv gs hgs => by
+    subst v
+    apply Telescope.piN_zero_mem
+    intro _ _
+    simpa only [univ_zero] using minorResult_mem_univ h hM hΓ hm hc hx hgs)
+  exact Telescope.applyN_mem _ hfsstep hhs (fun hv _ _ => by
+    simpa only [hv, univ_zero] using minorResult_mem_univ h hM hΓ hm hc hx hfs)
+
+noncomputable def ihValue (_shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (xs : List V) (j : Nat) (field : RecursiveField β) (ih : V) : V :=
+  Telescope.curry v (Telescope.interpret constants levels (Telescope.extend env xs) field.domains)
+    (fun ys => app ih (inj j (mkTower ys)))
+
+noncomputable def ihValues (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (ctor : Constructor β) (xs : List V) (ih : V) : List V :=
+  ctor.recursive.zipIdx.map fun (field, j) => shape.ihValue constants levels env v xs j field ih
+
+theorem ihValue_mem (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {i j : Nat} {ctor : Constructor β} {field : RecursiveField β}
+    (hc : shape.constructors[i]? = some ctor) (hf : ctor.recursive[j]? = some field) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs) {g ih : V}
+    (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p)))
+    (hih : ih ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => shape.motive m (shape.targetIndex constants levels env (inj i (mkTower xs)) p) (app g p))) :
+    shape.ihValue constants levels env v xs j field ih ∈ˢ
+      shape.ihSet constants levels env v m xs (shape.decodeFields constants levels env ctor xs g) j field := by
+  apply Telescope.curry_mem
+  intro ys hy
+  have hm := app_mem_of_mem_piSet hih (inj_mem_positions hc hf (FitsS.length_eq hx) hy)
+  rw [targetIndex_inj constants levels env hc hf (FitsS.length_eq hx) (FitsS.length_eq hy)] at hm
+  rw [getD_decodeFields _ _ _ _ _ _ _ hf,
+    applyN_decodeField hc hf (h.constructors ctor (List.mem_of_getElem? hc)) hM hΓ hx hy hg]
+  exact hm
+
+theorem ihValues_fit (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {xs : List V}
+    (hx : FitsS (Telescope.interpret constants levels env ctor.fields) xs) {g ih : V}
+    (hg : g ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => app (shape.carrier constants levels env)
+        (shape.targetIndex constants levels env (inj i (mkTower xs)) p)))
+    (hih : ih ∈ˢ piSet (shape.positions constants levels env (inj i (mkTower xs)))
+      (fun p => shape.motive m (shape.targetIndex constants levels env (inj i (mkTower xs)) p) (app g p))) :
+    shape.IHValuesFit constants levels env v m ctor xs (shape.decodeFields constants levels env ctor xs g)
+      (shape.ihValues constants levels env v ctor xs ih) := by
+  apply Telescope.fits_simple_of_getD
+  · simp only [ihValues, ihTypes, List.length_map, List.length_zipIdx]
+  · intro j A hA
+    simp only [ihTypes, List.getElem?_map, List.getElem?_zipIdx] at hA
+    cases hf : ctor.recursive[j]? with
+    | none => simp [hf] at hA
+    | some field =>
+      simp only [hf, Option.map_some, Nat.zero_add, Option.some.injEq] at hA
+      subst A
+      simp only [ihValues, List.getD_eq_getElem?_getD, List.getElem?_map,
+        List.getElem?_zipIdx, hf, Option.map_some, Nat.zero_add, Option.getD_some]
+      exact ihValue_mem h hM hΓ hc hf hx hg hih
+
+noncomputable def algebra (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (_m : V) (minors : List V) (_i a g ih : V) : V :=
+  match shape.constructors[tag a]? with
+  | none => empty
+  | some ctor =>
+    let xs := ordinaryValues ctor a
+    let fs := shape.decodeFields constants levels env ctor xs g
+    let hs := shape.ihValues constants levels env v ctor xs ih
+    Telescope.applyN (minors.getD (tag a) empty) (xs ++ fs ++ hs)
+
+theorem algebra_typing (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hminors : shape.MinorValuesFit constants levels env v m minors) :
+    (shape.container constants levels env).AlgebraTyping (shape.level.eval levels)
+      (shape.motive m) (shape.algebra constants levels env v m minors) := by
+  intro i hi a ha g hg ih hih
+  obtain ⟨has, hresult⟩ := mem_sep.mp ha
+  obtain ⟨j, ctor, xs, hc, hx, rfl⟩ := mem_allShapes has
+  rw [resultIndex_inj constants levels env hc (FitsS.length_eq hx)] at hresult
+  have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+  have hfs := decodeFields_fit hc (FitsS.length_eq hx) hg
+  have hhs := ihValues_fit (v := v) h hM hΓ hc hx hg hih
+  have hstep := minor_apply_mem h hM hΓ hm hc (hminors.get hc) hx hfs hhs
+  rw [constructorValue, branches_decodeFields hc hctor hM hΓ hx hg, hresult] at hstep
+  simpa only [algebra, tag_inj, hc, ordinaryValues_inj _ (FitsS.length_eq hx)] using hstep
+
+noncomputable def recursorSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) : V :=
+  Telescope.piN v (Telescope.interpret constants levels env shape.indices) fun is =>
+    piR v (app (shape.carrier constants levels env) (mkTower is)) (shape.motive m (mkTower is))
+
+noncomputable def largeValue (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (v : Nat) (m : V) (minors : List V)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels)) : V :=
+  Telescope.curry v (Telescope.interpret constants levels env shape.indices) fun is =>
+    lamR v (app (shape.carrier constants levels env) (mkTower is)) fun x =>
+      IndexedContainer.foldAt hD hlarge (shape.algebra constants levels env v m minors) (mkTower is) x
+
+theorem largeValue_mem (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hminors : shape.MinorValuesFit constants levels env v m minors)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels)) :
+    shape.largeValue constants levels env v m minors hD hlarge ∈ˢ shape.recursorSet constants levels env v m := by
+  apply Telescope.curry_mem
+  intro is his
+  apply lamR_mem
+  intro x hx
+  exact IndexedContainer.foldAt_mem hD hlarge (algebra_typing h hM hΓ hm hminors)
+    (mkTower_mem (by decide : 1 ≠ 0) his) hx
+
+theorem largeValue_apply (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {v : Nat} {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env v)
+    (hminors : shape.MinorValuesFit constants levels env v m minors)
+    (hD : (shape.container constants levels env).WF (shape.level.eval levels))
+    (hlarge : (shape.container constants levels env).LargeElim (shape.level.eval levels))
+    {is : List V} (his : FitsS (Telescope.interpret constants levels env shape.indices) is)
+    {x : V} (hx : x ∈ˢ app (shape.carrier constants levels env) (mkTower is)) :
+    Telescope.applyN (shape.largeValue constants levels env v m minors hD hlarge) (is ++ [x]) =
+      IndexedContainer.foldAt hD hlarge (shape.algebra constants levels env v m minors) (mkTower is) x := by
+  have hi := mkTower_mem (by decide : 1 ≠ 0) his
+  have hleaf ys hys y hy := IndexedContainer.foldAt_mem hD hlarge (algebra_typing h hM hΓ hm hminors)
+    (mkTower_mem (by decide : 1 ≠ 0) hys) (i := mkTower ys) (x := y) hy
+  have hlam ys hys := lamR_mem (v := v) (hleaf ys hys)
+  rw [Telescope.applyN_append]
+  change app (Telescope.applyN (Telescope.curry v _ _) is) x = _
+  simp only [carrier]
+  rw [Telescope.applyN_curry (w := v) _ his hlam (fun hv ys hys => by
+    subst v
+    exact piR_zero_mem_univZero)]
+  exact app_lamR hx (hleaf is his) (fun hv y hy => by
+    simpa only [hv, univ_zero] using motive_mem hm hi hy)
+
+/-- Small elimination constructs the proof point by structural induction.
+It applies equally to empty, singleton, and many-constructor Prop families. -/
+theorem pt_mem_smallRecursorSet (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) (hΓ : shape.parameterContext.Valid constants levels env)
+    {m : V} {minors : List V} (hm : m ∈ˢ shape.motiveSet constants levels env 0)
+    (hminors : shape.MinorValuesFit constants levels env 0 m minors) :
+    (pt : V) ∈ˢ shape.recursorSet constants levels env 0 m := by
+  have helim := IndexedContainer.small_elim (container_wf h hM hΓ)
+    (fun i hi x hx => by simpa only [univ_zero] using motive_mem hm hi hx)
+    (algebra_typing h hM hΓ hm hminors)
+  have hvalue := Telescope.curry_mem (w := 0)
+    (Telescope.interpret constants levels env shape.indices)
+    (R := fun is => piR 0 (app (shape.carrier constants levels env) (mkTower is))
+      (shape.motive m (mkTower is)))
+    (f := fun _ => (pt : V)) (fun is his =>
+      pt_mem_piR_zero_of (fun x hx => helim (mkTower is) (mkTower_mem (by decide : 1 ≠ 0) his) x hx))
+  rwa [Telescope.curry_point] at hvalue
+
+end Ix.Theory.Certified.Ordinary.Shape
diff --git a/Ix/Theory/Certified/Ordinary/Family.lean b/Ix/Theory/Certified/Ordinary/Family.lean
new file mode 100644
index 000000000..2af5d8999
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Family.lean
@@ -0,0 +1,139 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Computation
+import Ix.Theory.Model.Extension
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+theorem eval_params {n : Nat} {levels : List Nat} (h : levels.length = n) :
+    (VLevel.params n).map (VLevel.eval levels) = levels := by
+  apply List.ext_getElem (by simp [h])
+  intro i hi hi'
+  simp only [VLevel.params, List.getElem_map, List.getElem_range, VLevel.eval,
+    List.getD_eq_getElem?_getD, List.getElem?_eq_getElem hi', Option.getD_some]
+
+theorem interp_parameterVars_skip (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (offset count : Nat) :
+    (parameterVars offset count).map (interp constants levels env) =
+      (parameterVars 0 count).map (interp constants levels (Valuation.skip offset 0 env)) := by
+  induction count <;> simp_all [parameterVars, interp, Valuation.skip]
+
+theorem interp_parameterVars_extend (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (xs : List V) :
+    (parameterVars 0 xs.length).map (interp constants levels (Telescope.extend env xs)) = xs := by
+  induction xs generalizing env with
+  | nil => rfl
+  | cons x xs ih =>
+    simp only [List.length_cons, parameterVars, Nat.zero_add, List.map_cons, interp,
+      Telescope.extend, ih]
+    have he := Telescope.extend_beyond (Valuation.cons x env) xs 0
+    simpa only [Nat.add_zero, Valuation.cons_zero] using congrArg (· :: xs) he
+
+theorem interp_parameterVars_middle (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (xs tail : List V) :
+    (parameterVars tail.length xs.length).map
+      (interp constants levels (Telescope.extend (Telescope.extend env xs) tail)) = xs := by
+  rw [interp_parameterVars_skip, Telescope.skip_extend, interp_parameterVars_extend]
+
+namespace Shape
+
+noncomputable def familyValue (shape : Shape β) (constants : Assignment β V) (levels : List Nat) : V :=
+  Telescope.curry 1 (Telescope.interpret constants levels (fun _ => empty) shape.parameters) fun ps =>
+    Telescope.curry 1 (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) shape.indices)
+      (fun is => app (shape.carrier constants levels (Telescope.extend (fun _ => empty) ps)) (mkTower is))
+
+theorem type_typing {entries : Environment β} {store : Store β} {source : β} {shape : Shape β}
+    (h : CheckedShape.{u,v} entries store source shape) :
+    ∃ l, TypingClaim.{u,v} entries [] shape.type (.sort l) := by
+  obtain ⟨l, _, hl⟩ := (h.parameters.append h.indices).forallN (TypingClaim.sort shape.level)
+  exact ⟨l, hl⟩
+
+theorem type_references {entries : Environment β} {store : Store β} {source : β} {shape : Shape β}
+    (h : CheckedShape.{u,v} entries store source shape) : shape.type.ReferencesIn entries :=
+  AExpr.ReferencesIn.forallN h.references (by simp [AExpr.ReferencesIn, AExpr.references])
+
+theorem familyValue_mem (shape : Shape β) (constants : Assignment β V) (levels : List Nat) :
+    shape.familyValue constants levels ∈ˢ interp constants levels (fun _ => empty) shape.type := by
+  simp only [type, AExpr.forallN_append, AExpr.interp_forallN, regime_never, interp]
+  apply Telescope.curry_mem
+  intro ps hps
+  apply Telescope.curry_mem
+  intro is his
+  exact (shape.container constants levels (Telescope.extend (fun _ => empty) ps)).carrier_fibre_mem
+    (shape.level.eval levels) (mkTower_mem (by decide : 1 ≠ 0) his)
+
+theorem familyValue_apply (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    {ps is : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (his : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) shape.indices) is) :
+    Telescope.applyN (shape.familyValue constants levels) (ps ++ is) =
+      app (shape.carrier constants levels (Telescope.extend (fun _ => empty) ps)) (mkTower is) := by
+  have hresult xs ys hys :=
+    (shape.container constants levels (Telescope.extend (fun _ => empty) xs)).carrier_fibre_mem
+      (shape.level.eval levels) (i := mkTower ys) (mkTower_mem (by decide : 1 ≠ 0) hys)
+  have hinner xs := Telescope.curry_mem (w := 1)
+    (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) xs) shape.indices) (hresult xs)
+  simp only [familyValue, carrier]
+  rw [Telescope.applyN_append,
+    Telescope.applyN_curry (w := 1) _ hps (fun xs _ => hinner xs) (fun h => (by omega : False).elim)]
+  exact Telescope.applyN_curry _ his (hresult ps) (fun h => (by omega : False).elim)
+
+def familyEntry (shape : Shape β) : ConstantEntry β := ⟨shape.universes, shape.type, none, [], []⟩
+
+def familyEnvironment [DecidableEq β] (shape : Shape β) (entries : Environment β) (source : β) : Environment β :=
+  entries.insert (.member source 0) shape.familyEntry
+
+noncomputable def familyAssignment [DecidableEq β] (shape : Shape β) (constants : Assignment β V)
+    (source : β) : Assignment β V := constants.insert (.member source 0) (shape.familyValue constants)
+
+theorem familyEnvironment_wf [DecidableEq β] {entries : Environment β} {store : Store β} {source : β}
+    {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape) (hE : entries.WF) :
+    (shape.familyEnvironment entries source).WF :=
+  hE.insert h.scope (by simp [familyEntry]) (type_references h) (by simp [familyEntry])
+    (by simp [familyEntry]) (by simp [familyEntry])
+    (by simp [familyEntry]) (by simp [familyEntry])
+
+theorem familyAssignment_agrees [DecidableEq β] {entries : Environment β} {store : Store β} {source : β}
+    {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape) (constants : Assignment β V) :
+    Assignment.AgreesOn entries constants (shape.familyAssignment constants source) :=
+  Assignment.insert_agrees (h.fresh _ (List.mem_cons_self ..)) constants (shape.familyValue constants)
+
+/-- The family signature receives its constructed carrier before constructor
+or recursor checking. This is an internal stage with no reduction equations. -/
+theorem familyAssignment_realizes [DecidableEq β] {entries : Environment β} {store : Store β} {source : β}
+    {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape) (hE : entries.WF)
+    (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (shape.familyAssignment constants source) (shape.familyEnvironment entries source) := by
+  have hagree := familyAssignment_agrees h constants
+  have hrefs := type_references h
+  obtain ⟨l, htype⟩ := type_typing h
+  apply (hM.of_agrees hE hagree).insert
+  constructor
+  · intro levels hn env
+    exact (hagree.wellDenoted hrefs levels env).mpr
+      (htype V constants hM levels env (Context.valid_nil constants levels env)).1
+  · intro levels hn env
+    change shape.familyAssignment constants source (.member source 0) levels ∈ˢ
+      interp (shape.familyAssignment constants source) levels env shape.type
+    rw [hagree.interp hrefs levels env, familyAssignment, Assignment.insert_same]
+    have hm := shape.familyValue_mem constants levels
+    rwa [interp_closed shape.type constants levels h.scope (fun _ => empty) env] at hm
+  · intro body hb
+    cases hb
+  · intro body hb
+    cases hb
+  · intro law hl
+    simp only [familyEntry, List.not_mem_nil] at hl
+  · intro fact hf
+    simp only [familyEntry, List.not_mem_nil] at hf
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/LargeElim.lean b/Ix/Theory/Certified/Ordinary/LargeElim.lean
new file mode 100644
index 000000000..976aa0736
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/LargeElim.lean
@@ -0,0 +1,65 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Constructors
+import Ix.Theory.Model.Inductive.Recursor
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower
+
+universe u v
+variable {β : Type u}
+
+def LargeEvidence (entries : Environment β) (shape : Shape β) : Prop :=
+  (∀ levels, shape.level.eval levels ≠ 0) ∨ shape.constructors = [] ∨
+    ∃ ctor, shape.constructors = [ctor] ∧
+      TelescopeProp.{u,v} entries shape.parameterContext ctor.fields shape.level
+
+def checkLarge [DecidableEq β] (fuel : Nat) (entries : Environment β) (witness : ShapeWitness β) :
+    Option (CheckedClaim.{u} (LargeEvidence.{u,v} entries witness.shape)) :=
+  if hp : zeroCondition witness.shape.level = .never then
+    some ⟨Or.inl (by
+      intro levels he
+      have hz := zeroCondition_correct witness.shape.level levels
+      simp only [hp, PropWhen.holds_never, he, beq_self_eq_true, Bool.false_eq_true] at hz)⟩
+  else
+    match hc : witness.shape.constructors, witness.constructors with
+    | [], [] => some ⟨Or.inr (Or.inl hc)⟩
+    | [ctor], [proof] => do
+      let fields ← verifyPropTelescope.{u,v} fuel witness.shape.universes entries witness.shape.level
+        witness.shape.parameterContext ctor.fields proof.fields
+      return ⟨Or.inr (Or.inr ⟨ctor, hc, fields.down⟩)⟩
+    | _, _ => none
+
+theorem checkLarge_sound [DecidableEq β] {fuel : Nat} {entries : Environment β} {witness : ShapeWitness β}
+    {result} (_ : checkLarge.{u,v} fuel entries witness = some result) :
+    LargeEvidence.{u,v} entries witness.shape := result.down
+
+variable {V : Type v} [SetTheory V]
+
+theorem Shape.container_large {entries : Environment β} {shape : Shape β}
+    (hlarge : LargeEvidence.{u,v} entries shape) {constants : Assignment β V}
+    (hM : Realizes constants entries) {levels : List Nat} {env : Nat → V}
+    (hΓ : shape.parameterContext.Valid constants levels env) :
+    (shape.container constants levels env).LargeElim (shape.level.eval levels) := by
+  intro hw i hi a b ha hb
+  rcases hlarge with hpos | hempty | ⟨ctor, hsingle, hprop⟩
+  · exact (hpos levels hw).elim
+  · obtain ⟨j, ctor, xs, hc, _, _⟩ := Shape.mem_allShapes (mem_sep.mp ha).1
+    simp only [hempty, List.getElem?_nil] at hc
+    contradiction
+  · obtain ⟨j, ca, xs, hca, hxs, rfl⟩ := Shape.mem_allShapes (mem_sep.mp ha).1
+    obtain ⟨k, cb, ys, hcb, hys, rfl⟩ := Shape.mem_allShapes (mem_sep.mp hb).1
+    have hj : j = 0 := by cases j <;> simp_all
+    have hk : k = 0 := by cases k <;> simp_all
+    subst j k
+    have heca : ctor = ca := by simpa only [hsingle, List.getElem?_cons_zero, Option.some.injEq] using hca
+    have hecb : ctor = cb := by simpa only [hsingle, List.getElem?_cons_zero, Option.some.injEq] using hcb
+    subst ca cb
+    have he := Telescope.fits_unique_of_prop (hprop V constants hM levels env hΓ hw) hxs hys
+    rw [he]
+
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/Reading.lean b/Ix/Theory/Certified/Ordinary/Reading.lean
new file mode 100644
index 000000000..86a5cb955
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Reading.lean
@@ -0,0 +1,309 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Family
+
+namespace Ix.Theory.Model
+
+open SetTheory SetTheory.Tower
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+theorem Assignment.AgreesOn.telescope {entries : Environment β} {constants constants' : Assignment β V}
+    (h : Assignment.AgreesOn entries constants constants') {domains : List (AExpr β)}
+    (hrefs : ∀ A ∈ domains, A.ReferencesIn entries) (levels : List Nat) (env : Nat → V) :
+    Telescope.interpret constants' levels env domains = Telescope.interpret constants levels env domains := by
+  induction domains generalizing env with
+  | nil => rfl
+  | cons A rest ih =>
+    simp only [Telescope.interpret, h.interp (hrefs A (List.mem_cons_self ..))]
+    congr 1
+    funext x
+    exact ih (fun D hd => hrefs D (List.mem_cons_of_mem A hd)) _
+
+end Ix.Theory.Model
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+/-- Interface preserved while signatures are staged. The initial producer
+installs the constructed family; subsequent fresh members preserve it. -/
+structure FamilyReading (entries : Environment β) (shape : Shape β) (source : β)
+    (constants reading : Assignment β V) : Prop where
+  agrees : Assignment.AgreesOn entries constants reading
+  family : ∀ levels, levels.length = shape.universes →
+    reading (.member source 0) levels = shape.familyValue constants levels
+
+theorem Shape.familyAssignment_reading [DecidableEq β] {entries : Environment β} {store : Store β}
+    {source : β} {shape : Shape β} (h : CheckedShape.{u,v} entries store source shape)
+    (constants : Assignment β V) :
+    FamilyReading entries shape source constants (shape.familyAssignment constants source) :=
+  ⟨Shape.familyAssignment_agrees h constants, fun _ _ => Assignment.insert_same ..⟩
+
+namespace Shape
+
+variable {entries : Environment β} {shape : Shape β} {source : β}
+  {constants reading : Assignment β V} {levels : List Nat}
+
+theorem familyApp_interp (h : FamilyReading entries shape source constants reading)
+    (hn : levels.length = shape.universes) {ps extra : List V} {indices : List (AExpr β)}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (his : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) shape.indices)
+      (indices.map (interp reading levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) extra)))) :
+    interp reading levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) extra)
+      (shape.familyApp source extra.length indices) =
+      app (shape.carrier constants levels (Telescope.extend (fun _ => empty) ps))
+        (mkTower (indices.map (interp reading levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) extra)))) := by
+  have hp : (parameterVars extra.length shape.parameters.length).map
+      (interp reading levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) extra)) = ps := by
+    rw [interp_parameterVars_skip, Telescope.skip_extend, ← FitsS.length_eq hps,
+      interp_parameterVars_extend]
+  rw [familyApp, AExpr.interp_appN]
+  simp only [interp, eval_params hn, h.family levels hn, List.map_append, hp]
+  exact familyValue_apply shape constants levels hps his
+
+theorem recursiveType_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {ctor : Constructor β} {field : RecursiveField β}
+    (hc : ctor ∈ shape.constructors) (hf : field ∈ ctor.recursive) {ps xs previous : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) xs) :
+    interp reading levels (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) previous)
+      ((field.type shape source ctor.fields.length).liftN previous.length) =
+      shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs field := by
+  have hctor := h.constructors ctor hc
+  have hfield := hctor.2.2.2.2 field hf
+  have hΓ := h.parameters.valid constants hM levels (Context.valid_nil constants levels (fun _ => empty)) hps
+  rw [interp_liftN, Telescope.skip_extend, RecursiveField.type, AExpr.interp_forallN,
+    hr.agrees.telescope (fun A ha => hfield.1 A (List.mem_append_left _ ha))]
+  apply Telescope.piN_zero_agree (regime_zeroCondition shape.level levels)
+  intro ys hys
+  have he : field.indices.map (interp reading levels
+        (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) ys)) =
+      field.indices.map (interp constants levels
+        (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) ys)) :=
+    List.map_congr_left fun e he => hr.agrees.interp (hfield.1 e (List.mem_append_right _ he)) levels _
+  have hit := recursiveTarget_fits hctor hfield hM hΓ hxs hys
+  have hit' : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) shape.indices)
+      (field.indices.map (interp reading levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) (xs ++ ys)))) := by
+    simpa only [Telescope.extend_append, he] using hit
+  have happ := familyApp_interp hr hn hps hit'
+  simpa only [List.length_append, FitsS.length_eq hxs, FitsS.length_eq hys,
+    Telescope.extend_append, he] using happ
+
+theorem recursiveForall_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {fields : List (RecursiveField β)} (hf : ∀ field ∈ fields, field ∈ ctor.recursive) {ps xs : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (previous : List V) (B : AExpr β) :
+    interp reading levels (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) previous)
+      (.forallN (zeroCondition shape.level)
+        (recursiveTypesFrom shape source ctor.fields.length fields previous.length) B) =
+      Telescope.piN (shape.level.eval levels)
+        (Telescope.simple (fields.map (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs)))
+        (fun fs => interp reading levels
+          (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) previous) fs) B) := by
+  induction fields generalizing previous with
+  | nil => rfl
+  | cons field fields ih =>
+    simp only [recursiveTypesFrom, List.zipIdx_cons, List.map_cons, AExpr.forallN, interp]
+    rw [recursiveType_interp h hr hM hn hc (hf field (List.mem_cons_self ..)) hps hxs]
+    apply piR_zero_agree (regime_zeroCondition shape.level levels)
+    intro x _
+    have htail := ih (fun f hm => hf f (List.mem_cons_of_mem field hm)) (previous ++ [x])
+    simpa only [recursiveTypesFrom, List.length_append, List.length_singleton,
+      Telescope.extend_append, Telescope.extend] using htail
+
+theorem piN_recursiveTypes {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {fields : List (RecursiveField β)} (hf : ∀ field ∈ fields, field ∈ ctor.recursive) {ps xs : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (previous : List V) (w : Nat) (R : List V → V) :
+    Telescope.piN w (Telescope.interpret reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) previous)
+      (recursiveTypesFrom shape source ctor.fields.length fields previous.length)) R =
+      Telescope.piN w
+        (Telescope.simple (fields.map (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs))) R := by
+  induction fields generalizing previous R with
+  | nil => rfl
+  | cons field fields ih =>
+    change piR w (interp reading levels _ ((field.type shape source ctor.fields.length).liftN previous.length)) _ =
+      piR w (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs field) _
+    rw [recursiveType_interp h hr hM hn hc (hf field (List.mem_cons_self ..)) hps hxs]
+    congr 1
+    funext f
+    have ht := ih (fun f hf' => hf f (List.mem_cons_of_mem field hf')) (previous ++ [f]) (fun fs => R (f :: fs))
+    have hlen : (previous ++ [f]).length = previous.length + 1 := by simp
+    rw [hlen] at ht
+    simpa only [recursiveTypesFrom, List.length_append, List.length_singleton,
+      Telescope.extend_append, Telescope.extend] using ht
+
+theorem curry_recursiveTypes {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {fields : List (RecursiveField β)} (hf : ∀ field ∈ fields, field ∈ ctor.recursive) {ps xs : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (previous : List V) (w : Nat) (f : List V → V) :
+    Telescope.curry w (Telescope.interpret reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) previous)
+      (recursiveTypesFrom shape source ctor.fields.length fields previous.length)) f =
+      Telescope.curry w
+        (Telescope.simple (fields.map (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs))) f := by
+  induction fields generalizing previous f with
+  | nil => rfl
+  | cons field fields ih =>
+    change lamR w (interp reading levels _ ((field.type shape source ctor.fields.length).liftN previous.length)) _ =
+      lamR w (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs field) _
+    rw [recursiveType_interp h hr hM hn hc (hf field (List.mem_cons_self ..)) hps hxs]
+    congr 1
+    funext x
+    have ht := ih (fun f hf' => hf f (List.mem_cons_of_mem field hf')) (previous ++ [x]) (fun xs => f (x :: xs))
+    have hlen : (previous ++ [x]).length = previous.length + 1 := by simp
+    rw [hlen] at ht
+    simpa only [recursiveTypesFrom, List.length_append, List.length_singleton,
+      Telescope.extend_append, Telescope.extend] using ht
+
+theorem constructorResult_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {ps xs fs : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hlen : fs.length = ctor.recursive.length) :
+    interp reading levels (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) fs)
+      (shape.familyApp source (ctor.fields.length + ctor.recursive.length)
+        (ctor.indices.map (AExpr.liftN ctor.recursive.length ·))) =
+      app (shape.carrier constants levels (Telescope.extend (fun _ => empty) ps))
+        (mkTower (ctor.indices.map (interp constants levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs)))) := by
+  have hctor := h.constructors ctor hc
+  have hΓ := h.parameters.valid constants hM levels (Context.valid_nil constants levels (fun _ => empty)) hps
+  have he : (ctor.indices.map (AExpr.liftN ctor.recursive.length ·)).map
+      (interp reading levels (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) fs)) =
+      ctor.indices.map (interp constants levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs)) := by
+    rw [List.map_map]
+    apply List.map_congr_left
+    intro e he
+    simp only [Function.comp_def, interp_liftN, ← hlen, Telescope.skip_extend,
+      hr.agrees.interp (hctor.1 e (List.mem_append_right _ he))]
+  have hit := constructorResult_fits hctor hM hΓ hxs
+  have hit' : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) shape.indices)
+      ((ctor.indices.map (AExpr.liftN ctor.recursive.length ·)).map
+        (interp reading levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) (xs ++ fs)))) := by
+    simpa only [Telescope.extend_append, he] using hit
+  have happ := familyApp_interp hr hn hps hit'
+  simpa only [List.length_append, FitsS.length_eq hxs, hlen, Telescope.extend_append, he] using happ
+
+noncomputable def constructorSet (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (ctor : Constructor β) : V :=
+  Telescope.piN (shape.level.eval levels)
+    (Telescope.interpret constants levels (fun _ => empty) shape.parameters) fun ps =>
+      Telescope.piN (shape.level.eval levels)
+        (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) fun xs =>
+          Telescope.piN (shape.level.eval levels)
+            (Telescope.simple (ctor.recursive.map (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs)))
+            (fun _ => app (shape.carrier constants levels (Telescope.extend (fun _ => empty) ps))
+              (mkTower (ctor.indices.map (interp constants levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs)))))
+
+theorem constructorType_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors) :
+    interp reading levels (fun _ => empty) (ctor.type shape source) = shape.constructorSet constants levels ctor := by
+  have hctor := h.constructors ctor hc
+  rw [Constructor.type, AExpr.interp_forallN,
+    hr.agrees.telescope (fun A hA => h.references A (List.mem_append_left _ hA))]
+  apply Telescope.piN_zero_agree (regime_zeroCondition shape.level levels)
+  intro ps hps
+  rw [AExpr.interp_forallN,
+    hr.agrees.telescope (fun A hA => hctor.1 A (List.mem_append_left _ hA))]
+  apply Telescope.piN_zero_agree (regime_zeroCondition shape.level levels)
+  intro xs hxs
+  rw [Constructor.recursiveTypes]
+  have ht := recursiveForall_interp h hr hM hn hc (fun _ h => h) hps hxs []
+    (shape.familyApp source (ctor.fields.length + ctor.recursive.length)
+      (ctor.indices.map (AExpr.liftN ctor.recursive.length ·)))
+  simp only [Telescope.extend, List.length_nil] at ht
+  rw [ht]
+  apply Telescope.piN_congr
+  intro fs hfs
+  exact constructorResult_interp h hr hM hn hc hps hxs (by simpa using FitsS.length_eq hfs)
+
+noncomputable def constructorClosedValue (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (i : Nat) (ctor : Constructor β) : V :=
+  Telescope.curry (shape.level.eval levels)
+    (Telescope.interpret constants levels (fun _ => empty) shape.parameters) fun ps =>
+      Telescope.curry (shape.level.eval levels)
+        (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) fun xs =>
+          Telescope.curry (shape.level.eval levels)
+            (Telescope.simple (ctor.recursive.map (shape.recursiveSet constants levels (Telescope.extend (fun _ => empty) ps) xs)))
+            (fun fs => shape.constructorValue constants levels (Telescope.extend (fun _ => empty) ps) ctor i xs fs)
+
+theorem constructorClosedValue_mem {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) {i : Nat} {ctor : Constructor β} (hc : shape.constructors[i]? = some ctor) :
+    shape.constructorClosedValue constants levels i ctor ∈ˢ shape.constructorSet constants levels ctor := by
+  apply Telescope.curry_mem
+  intro ps hps
+  apply Telescope.curry_mem
+  intro xs hxs
+  apply Telescope.curry_mem
+  intro fs hfs
+  have hΓ := h.parameters.valid constants hM levels (Context.valid_nil constants levels (fun _ => empty)) hps
+  exact constructorValue_mem h hM hΓ hc hxs hfs
+
+theorem constructorClosedValue_mem_source {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) :
+    shape.constructorClosedValue constants levels i ctor ∈ˢ interp reading levels (fun _ => empty) (ctor.type shape source) := by
+  rw [constructorType_interp h hr hM hn (List.mem_of_getElem? hc)]
+  exact constructorClosedValue_mem h hM hc
+
+theorem constructorClosedValue_apply {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hM : Realizes constants entries) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps xs fs : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants levels (Telescope.extend (fun _ => empty) ps) ctor xs fs) :
+    Telescope.applyN (shape.constructorClosedValue constants levels i ctor) (ps ++ xs ++ fs) =
+      shape.constructorValue constants levels (Telescope.extend (fun _ => empty) ps) ctor i xs fs := by
+  have hresult (ps : List V) hps xs hxs fs hfs := constructorValue_mem h hM
+    (h.parameters.valid constants hM levels (xs := ps) (Context.valid_nil constants levels (fun _ => empty)) hps)
+    hc (xs := xs) hxs (fs := fs) hfs
+  have hbound (ps : List V) hps xs hxs :
+      app (shape.carrier constants levels (Telescope.extend (fun _ => empty) ps))
+        (mkTower (ctor.indices.map (interp constants levels (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs))))
+        ∈ˢ (univ (shape.level.eval levels) : V) :=
+    (shape.container constants levels (Telescope.extend (fun _ => empty) ps)).carrier_fibre_mem _
+      (constructorResult_mem (h.constructors ctor (List.mem_of_getElem? hc)) hM
+        (h.parameters.valid constants hM levels (xs := ps) (Context.valid_nil constants levels (fun _ => empty)) hps) hxs)
+  have hrec ps hps xs hxs := Telescope.curry_mem (w := shape.level.eval levels) _ (hresult ps hps xs hxs)
+  have hfields ps hps := Telescope.curry_mem (w := shape.level.eval levels) _ (hrec ps hps)
+  rw [constructorClosedValue, Telescope.applyN_append, Telescope.applyN_append,
+    Telescope.applyN_curry _ hps hfields (fun hw ps hps => by
+      rw [hw]
+      apply Telescope.piN_zero_mem
+      intro xs hxs
+      apply Telescope.piN_zero_mem
+      intro _ _
+      simpa only [hw, univ_zero] using hbound ps hps xs hxs),
+    Telescope.applyN_curry _ hxs (hrec ps hps) (fun hw xs hxs => by
+      rw [hw]
+      apply Telescope.piN_zero_mem
+      intro _ _
+      simpa only [hw, univ_zero] using hbound ps hps xs hxs)]
+  exact Telescope.applyN_curry _ hfs (hresult ps hps xs hxs)
+    (fun hw _ _ => by simpa only [hw, univ_zero] using hbound ps hps xs hxs)
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/RecursorReading.lean b/Ix/Theory/Certified/Ordinary/RecursorReading.lean
new file mode 100644
index 000000000..65ba51332
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RecursorReading.lean
@@ -0,0 +1,415 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RecursorSyntax
+
+namespace Ix.Theory.Inductive.ElimMode
+
+theorem sourceLevels_eval (mode : ElimMode) {levels : List Nat} {sourceUvars : Nat}
+    (h : levels.length = mode.recUvars sourceUvars) :
+    (mode.sourceLevels sourceUvars).map (VLevel.eval levels) = mode.sourceArgs levels := by
+  apply List.ext_get (by simp [sourceLevels, sourceArgs_length mode h])
+  intro i hi _
+  have hi' : i < sourceUvars := by simpa [sourceLevels] using hi
+  have bound : i + mode.offset < levels.length := by rw [h, recUvars]; omega
+  simp [sourceLevels, VLevel.params', VLevel.eval, sourceArgs,
+    List.getD_eq_getElem?_getD, List.getElem?_eq_getElem bound, Nat.add_comm]
+
+end Ix.Theory.Inductive.ElimMode
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Inductive
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+structure ConstructorReading (entries : Environment β) (shape : Shape β) (source : β)
+    (constants reading : Assignment β V) : Prop extends FamilyReading entries shape source constants reading where
+  constructor : ∀ levels, levels.length = shape.universes → ∀ i ctor,
+    shape.constructors[i]? = some ctor →
+    reading (.ctor source 0 i) levels = shape.constructorClosedValue constants levels i ctor
+
+namespace Shape
+
+variable {entries : Environment β} {shape : Shape β} {source : β}
+  {constants reading : Assignment β V} {levels : List Nat} {mode : ElimMode}
+
+theorem motiveType_interp (hr : FamilyReading entries shape source constants reading)
+    (hn : levels.length = mode.recUvars shape.universes) {ps : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hrefs : ∀ A ∈ shape.indices, A.ReferencesIn entries) :
+    interp reading levels (Telescope.extend (fun _ => empty) ps) (shape.motiveType source mode) =
+      shape.motiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) := by
+  rw [motiveType, AExpr.interp_forallN, Telescope.piN_instL, mode.sourceLevels_eval hn,
+    hr.agrees.telescope hrefs]
+  apply Telescope.piN_congr
+  intro is his
+  have hvars := interp_parameterVars_extend reading (mode.sourceArgs levels)
+    (Telescope.extend (fun _ => empty) ps) is
+  rw [FitsS.length_eq his] at hvars
+  have hit : FitsS (Telescope.interpret constants (mode.sourceArgs levels)
+      (Telescope.extend (fun _ => empty) ps) shape.indices)
+      ((parameterVars 0 shape.indices.length).map
+        (interp reading (mode.sourceArgs levels)
+          (Telescope.extend (Telescope.extend (fun _ => empty) ps) is))) := by
+    simpa only [hvars] using his
+  have happ := familyApp_interp hr (mode.sourceArgs_length hn) hps hit
+  simp only [interp, regime_never, interp_instL, mode.sourceLevels_eval hn,
+    FitsS.length_eq his, hvars] at happ ⊢
+  rw [happ]
+
+theorem minorFields_piN {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {ps : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (m : V) (w : Nat) (R : List V → V) :
+    Telescope.piN w (Telescope.interpret reading levels
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (shape.minorFields source mode ctor)) R =
+      Telescope.piN w
+        (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields)
+        (fun xs => Telescope.piN w
+          (Telescope.simple (ctor.recursive.map
+            (shape.recursiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) xs)))
+          (fun fs => R (xs ++ fs))) := by
+  rw [minorFields, Telescope.piN_lift, Valuation.skip_succ_cons, Valuation.skip_zero,
+    Telescope.piN_instL, mode.sourceLevels_eval hn, Telescope.piN_append,
+    hr.agrees.telescope (fun A ha => (h.constructors ctor hc).1 A (List.mem_append_left _ ha))]
+  apply Telescope.piN_congr
+  intro xs hxs
+  have ht := piN_recursiveTypes h hr hM (mode.sourceArgs_length hn) hc (fun _ h => h) hps hxs [] w
+    (fun fs => R (xs ++ fs))
+  simpa only [Constructor.recursiveTypes, List.length_nil, Telescope.extend] using ht
+
+theorem ihType_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {j : Nat} {field : RecursiveField β} (hf : ctor.recursive[j]? = some field)
+    {ps xs fs : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : fs.length = ctor.recursive.length) (m : V) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs)
+      (shape.ihType mode ctor j field) =
+      shape.ihSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) m xs fs j field := by
+  have hctor := h.constructors ctor hc
+  have hfield := hctor.2.2.2.2 field (List.mem_of_getElem? hf)
+  have hΓ := h.parameters.valid constants hM (mode.sourceArgs levels)
+    (Context.valid_nil constants (mode.sourceArgs levels) (fun _ => empty)) hps
+  have hxlen := FitsS.length_eq hxs
+  have hskip : Valuation.skip 1 ctor.fields.length
+      (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) =
+      Telescope.extend (Telescope.extend (fun _ => empty) ps) xs := by
+    simpa only [List.length_singleton, Telescope.extend, hxlen] using
+      Telescope.skip_middle (Telescope.extend (fun _ => empty) ps) [m] xs
+  rw [ihType, AExpr.interp_forallN, Telescope.piN_lift, ← hfs, Telescope.skip_extend,
+    Telescope.piN_lift, hskip, Telescope.piN_instL, mode.sourceLevels_eval hn,
+    hr.agrees.telescope (fun A ha => hfield.1 A (List.mem_append_left _ ha))]
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro ys hys
+  have hylen := FitsS.length_eq hys
+  have hit := recursiveTarget_fits hctor hfield hM hΓ hxs hys
+  have hidx : field.indices.map (fun e => interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend
+        (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) ys)
+      (((e.instL (mode.sourceLevels shape.universes)).liftN 1
+        (ctor.fields.length + field.domains.length)).liftN ctor.recursive.length field.domains.length)) =
+      field.indices.map (interp constants (mode.sourceArgs levels)
+        (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) ys)) := by
+    apply List.map_congr_left
+    intro e he
+    rw [interp_liftN, ← hfs, ← hylen, Telescope.skip_middle, interp_liftN]
+    rw [show ctor.fields.length + ys.length = ys.length + ctor.fields.length by omega,
+      Telescope.skip_extend_at, hskip, interp_instL, mode.sourceLevels_eval hn,
+      hr.agrees.interp (hfield.1 e (List.mem_append_right _ he))]
+  have hmvar : Telescope.extend (Telescope.extend (Telescope.extend
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) ys
+      (ctor.fields.length + ctor.recursive.length + field.domains.length) = m := by
+    rw [← hxlen, ← hfs, ← hylen]
+    have ht := Telescope.extend_beyond (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (xs ++ fs ++ ys) 0
+    simpa only [List.length_append, Nat.add_zero, Telescope.extend_append, Valuation.cons_zero] using ht
+  have hfvar : Telescope.extend (Telescope.extend (Telescope.extend
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) ys
+      (ctor.recursive.length - 1 - j + field.domains.length) = fs.getD j empty := by
+    rw [← hfs, ← hylen, Nat.add_comm, Telescope.extend_beyond,
+      Telescope.extend_getD _ _ j (by
+        rw [hfs]
+        exact (List.getElem?_eq_some_iff.mp hf).1)]
+  have hvars := interp_parameterVars_extend reading levels
+    (Telescope.extend (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) ys
+  rw [hylen] at hvars
+  simp only [hfs, AExpr.interp_appN, interp, List.map_append, List.map_map, Function.comp_def,
+    List.map_cons, List.map_nil, Telescope.applyN_append, Telescope.applyN, hmvar, hfvar, hvars, hidx]
+  rw [motive, projList_mkTower _ _ (FitsS.length_eq hit)]
+
+theorem ihTypes_piN {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {ps xs fs : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : fs.length = ctor.recursive.length) (m : V) (w : Nat) (R : List V → V) :
+    Telescope.piN w (Telescope.interpret reading levels
+      (Telescope.extend (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs)
+      (shape.ihTypesSyntax mode ctor)) R =
+      Telescope.piN w (Telescope.simple (shape.ihTypes constants (mode.sourceArgs levels)
+        (Telescope.extend (fun _ => empty) ps) (mode.motiveLevel.eval levels) m ctor xs fs)) R := by
+  have ht := Telescope.piN_independent reading levels
+    (Telescope.extend (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs)
+    (ctor.recursive.zipIdx.map fun (field, j) => shape.ihType mode ctor j field) [] w R
+  simp only [List.length_nil, Telescope.extend] at ht
+  rw [ihTypesSyntax, ht]
+  have he : ((ctor.recursive.zipIdx.map fun (field, j) => shape.ihType mode ctor j field).map
+      (interp reading levels (Telescope.extend
+        (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs))) =
+      shape.ihTypes constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) m ctor xs fs := by
+    apply List.ext_getElem?
+    intro j
+    simp only [ihTypes, List.getElem?_map, List.getElem?_zipIdx]
+    cases hf : ctor.recursive[j]? with
+    | none => rfl
+    | some field =>
+      simp only [Option.map_some, Nat.zero_add]
+      exact congrArg some (ihType_interp h hr hM hn hc hf hps hxs hfs m)
+  rw [he]
+
+theorem constructorVars_interp (hr : ConstructorReading entries shape source constants reading)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) (ps extra fields tail : List V)
+    (hps : ps.length = shape.parameters.length) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) extra) fields) tail)
+      (.appN (.const (.ctor source 0 i) (mode.sourceLevels shape.universes))
+        (parameterVars (extra.length + fields.length + tail.length) shape.parameters.length ++
+          parameterVars tail.length fields.length)) =
+      Telescope.applyN (shape.constructorClosedValue constants (mode.sourceArgs levels) i ctor) (ps ++ fields) := by
+  have hp := interp_parameterVars_middle reading levels (fun _ => empty) ps (extra ++ fields ++ tail)
+  simp only [List.length_append, hps, Telescope.extend_append] at hp
+  have hf := interp_parameterVars_middle reading levels
+    (Telescope.extend (Telescope.extend (fun _ => empty) ps) extra) fields tail
+  simp only [AExpr.interp_appN, interp, mode.sourceLevels_eval hn,
+    hr.constructor _ (mode.sourceArgs_length hn) i ctor hc, List.map_append, hp, hf]
+
+theorem minorResult_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : ConstructorReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps xs fs hs : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor xs fs)
+    (hhs : hs.length = ctor.recursive.length) (m : V) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend
+        (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) hs)
+      (shape.minorResult source mode i ctor) =
+      shape.motive m
+        (mkTower (ctor.indices.map (interp constants (mode.sourceArgs levels)
+          (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs))))
+        (shape.constructorValue constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor i xs fs) := by
+  have hxlen := FitsS.length_eq hxs
+  have hflen : fs.length = ctor.recursive.length := by simpa using FitsS.length_eq hfs
+  have hctor := h.constructors ctor (List.mem_of_getElem? hc)
+  have hΓ := h.parameters.valid constants hM (mode.sourceArgs levels)
+    (Context.valid_nil constants (mode.sourceArgs levels) (fun _ => empty)) hps
+  have hit := constructorResult_fits hctor hM hΓ hxs
+  have hcv := constructorVars_interp hr hn hc ps [m] (xs ++ fs) hs (FitsS.length_eq hps)
+  rw [← List.append_assoc, constructorClosedValue_apply h hM hc hps hxs hfs] at hcv
+  simp only [List.length_singleton, List.length_append, hxlen, hflen, hhs,
+    Telescope.extend_append, Telescope.extend, Nat.add_assoc] at hcv
+  have hidx : ctor.indices.map (fun e => interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend
+        (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) hs)
+      (((e.instL (mode.sourceLevels shape.universes)).liftN 1 ctor.fields.length).liftN
+        (ctor.recursive.length + ctor.recursive.length))) =
+      ctor.indices.map (interp constants (mode.sourceArgs levels)
+        (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs)) := by
+    apply List.map_congr_left
+    intro e he
+    rw [interp_liftN, show ctor.recursive.length + ctor.recursive.length = (fs ++ hs).length by simp [hflen, hhs],
+      ← Telescope.extend_append, Telescope.skip_extend, interp_liftN, ← hxlen]
+    have ht := Telescope.skip_middle (Telescope.extend (fun _ => empty) ps) [m] xs
+    simp only [List.length_singleton, Telescope.extend] at ht
+    rw [ht, interp_instL, mode.sourceLevels_eval hn,
+      hr.agrees.interp (hctor.1 e (List.mem_append_right _ he))]
+  have hmvar : Telescope.extend (Telescope.extend (Telescope.extend
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) xs) fs) hs
+      (ctor.fields.length + ctor.recursive.length + ctor.recursive.length) = m := by
+    have ht := Telescope.extend_beyond (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (xs ++ fs ++ hs) 0
+    simpa only [List.length_append, Nat.add_zero, Telescope.extend_append, Valuation.cons_zero,
+      hxlen, hflen, hhs] using ht
+  simp only [Nat.add_assoc] at hmvar
+  rw [minorResult, AExpr.interp_appN]
+  simp only [interp, hmvar, List.map_append, List.map_map, Function.comp_def, hidx,
+    List.map_cons, List.map_nil, Telescope.applyN_append, Telescope.applyN, Nat.add_assoc, hcv]
+  rw [motive, projList_mkTower _ _ (FitsS.length_eq hit)]
+
+theorem minorType_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : ConstructorReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (m : V) :
+    interp reading levels (Valuation.cons m (Telescope.extend (fun _ => empty) ps))
+      (shape.minorType source mode i ctor) =
+      shape.minorSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) m i ctor := by
+  rw [minorType, AExpr.interp_forallN, minorFields_piN h hr.toFamilyReading hM hn
+    (List.mem_of_getElem? hc) hps]
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro xs hxs
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro fs hfs
+  have hflen : fs.length = ctor.recursive.length := by simpa using FitsS.length_eq hfs
+  rw [Telescope.extend_append, AExpr.interp_forallN,
+    ihTypes_piN h hr.toFamilyReading hM hn (List.mem_of_getElem? hc) hps hxs hflen]
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro hs hhs
+  exact minorResult_interp h hr hM hn hc hps hxs hfs
+    (by simpa only [ihTypes, List.length_map, List.length_zipIdx] using FitsS.length_eq hhs) m
+
+theorem minorTypes_piN {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : ConstructorReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ps : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (m : V) (w : Nat) (R : List V → V) :
+    Telescope.piN w (Telescope.interpret reading levels
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (shape.minorTypesSyntax source mode)) R =
+      Telescope.piN w (Telescope.simple (shape.minorTypes constants (mode.sourceArgs levels)
+        (Telescope.extend (fun _ => empty) ps) (mode.motiveLevel.eval levels) m)) R := by
+  have ht := Telescope.piN_independent reading levels
+    (Valuation.cons m (Telescope.extend (fun _ => empty) ps))
+    (shape.constructors.zipIdx.map fun (ctor, i) => shape.minorType source mode i ctor) [] w R
+  simp only [List.length_nil, Telescope.extend] at ht
+  rw [minorTypesSyntax, ht]
+  have he : ((shape.constructors.zipIdx.map fun (ctor, i) => shape.minorType source mode i ctor).map
+      (interp reading levels (Valuation.cons m (Telescope.extend (fun _ => empty) ps)))) =
+      shape.minorTypes constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) m := by
+    apply List.ext_getElem?
+    intro i
+    simp only [minorTypes, List.getElem?_map, List.getElem?_zipIdx]
+    cases hc : shape.constructors[i]? with
+    | none => rfl
+    | some ctor =>
+      simp only [Option.map_some, Nat.zero_add]
+      exact congrArg some (minorType_interp h hr hM hn hc hps m)
+  rw [he]
+
+theorem minorTypes_curry {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : ConstructorReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ps : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (m : V) (w : Nat) (f : List V → V) :
+    Telescope.curry w (Telescope.interpret reading levels
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (shape.minorTypesSyntax source mode)) f =
+      Telescope.curry w (Telescope.simple (shape.minorTypes constants (mode.sourceArgs levels)
+        (Telescope.extend (fun _ => empty) ps) (mode.motiveLevel.eval levels) m)) f := by
+  have ht := Telescope.curry_independent reading levels
+    (Valuation.cons m (Telescope.extend (fun _ => empty) ps))
+    (shape.constructors.zipIdx.map fun (ctor, i) => shape.minorType source mode i ctor) [] w f
+  simp only [List.length_nil, Telescope.extend] at ht
+  rw [minorTypesSyntax, ht]
+  have he : ((shape.constructors.zipIdx.map fun (ctor, i) => shape.minorType source mode i ctor).map
+      (interp reading levels (Valuation.cons m (Telescope.extend (fun _ => empty) ps)))) =
+      shape.minorTypes constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) m := by
+    apply List.ext_getElem?
+    intro i
+    simp only [minorTypes, List.getElem?_map, List.getElem?_zipIdx]
+    cases hc : shape.constructors[i]? with
+    | none => rfl
+    | some ctor =>
+      simp only [Option.map_some, Nat.zero_add]
+      exact congrArg some (minorType_interp h hr hM hn hc hps m)
+  rw [he]
+
+theorem recursorTail_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading)
+    (hn : levels.length = mode.recUvars shape.universes) {ps minors : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hlen : minors.length = shape.constructors.length) (m : V) :
+    interp reading levels (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors)
+      (shape.recursorTail source mode) =
+      shape.recursorSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+        (mode.motiveLevel.eval levels) m := by
+  have hcommon : 1 + shape.constructors.length = (m :: minors).length := by simp [hlen, Nat.add_comm]
+  have hskip : Valuation.skip (1 + shape.constructors.length) 0
+      (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors) =
+      Telescope.extend (fun _ => empty) ps := by
+    simpa only [← hcommon, Telescope.extend] using
+      Telescope.skip_extend (Telescope.extend (fun _ => empty) ps) (m :: minors)
+  rw [recursorTail, AExpr.interp_forallN, Telescope.piN_lift, hskip,
+    Telescope.piN_instL, mode.sourceLevels_eval hn,
+    hr.agrees.telescope (fun A ha => h.references A (List.mem_append_right _ ha))]
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro is his
+  have hil := FitsS.length_eq his
+  have hvars := interp_parameterVars_extend reading (mode.sourceArgs levels)
+    (Telescope.extend (fun _ => empty) ps) is
+  rw [hil] at hvars
+  have hit : FitsS (Telescope.interpret constants (mode.sourceArgs levels)
+      (Telescope.extend (fun _ => empty) ps) shape.indices)
+      ((parameterVars 0 shape.indices.length).map
+        (interp reading (mode.sourceArgs levels)
+          (Telescope.extend (Telescope.extend (fun _ => empty) ps) is))) := by
+    simpa only [hvars] using his
+  have happ := familyApp_interp hr (mode.sourceArgs_length hn) hps hit
+  simp only [hil, hvars] at happ
+  have hskip' : Valuation.skip (1 + shape.constructors.length) shape.indices.length
+      (Telescope.extend (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors) is) =
+      Telescope.extend (Telescope.extend (fun _ => empty) ps) is := by
+    simpa only [← hcommon, Telescope.extend, hil] using
+      Telescope.skip_middle (Telescope.extend (fun _ => empty) ps) (m :: minors) is
+  rw [interp, interp_liftN, hskip', interp_instL, mode.sourceLevels_eval hn, happ]
+  apply piR_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro x _
+  have hmvar : Valuation.cons x
+      (Telescope.extend (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors) is)
+      (shape.constructors.length + shape.indices.length + 1) = m := by
+    rw [Valuation.cons_succ]
+    have ht := Telescope.extend_beyond (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (minors ++ is) 0
+    simpa only [List.length_append, Nat.add_zero, hlen, hil, Telescope.extend_append, Valuation.cons_zero] using ht
+  have hisvars := interp_parameterVars_middle reading levels
+    (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors) is [x]
+  simp only [List.length_singleton, hil, Telescope.extend] at hisvars
+  simp only [AExpr.interp_appN, interp, hmvar, List.map_append, hisvars, List.map_cons,
+    List.map_nil, Valuation.cons_zero, Telescope.applyN_append, Telescope.applyN]
+  rw [motive, projList_mkTower _ _ hil]
+
+noncomputable def closedRecursorSet (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (mode : ElimMode) : V :=
+  let ls := mode.sourceArgs levels
+  let v := mode.motiveLevel.eval levels
+  Telescope.piN v (Telescope.interpret constants ls (fun _ => empty) shape.parameters) fun ps =>
+    piR v (shape.motiveSet constants ls (Telescope.extend (fun _ => empty) ps) v) fun m =>
+      Telescope.piN v (Telescope.simple (shape.minorTypes constants ls (Telescope.extend (fun _ => empty) ps) v m))
+        (fun _ => shape.recursorSet constants ls (Telescope.extend (fun _ => empty) ps) v m)
+
+theorem recursorType_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : ConstructorReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) :
+    interp reading levels (fun _ => empty) (shape.recursorType source mode) =
+      shape.closedRecursorSet constants levels mode := by
+  rw [recursorType, AExpr.interp_forallN, Telescope.piN_instL, mode.sourceLevels_eval hn,
+    hr.agrees.telescope (fun A ha => h.references A (List.mem_append_left _ ha))]
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro ps hps
+  rw [interp, motiveType_interp hr.toFamilyReading hn hps
+    (fun A ha => h.references A (List.mem_append_right _ ha))]
+  apply piR_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro m _
+  rw [AExpr.interp_forallN, minorTypes_piN h hr hM hn hps]
+  apply Telescope.piN_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro minors hminors
+  exact recursorTail_interp h hr.toFamilyReading hn hps
+    (by simpa only [minorTypes, List.length_map, List.length_zipIdx] using FitsS.length_eq hminors) m
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/RecursorStage.lean b/Ix/Theory/Certified/Ordinary/RecursorStage.lean
new file mode 100644
index 000000000..9ef6c73c5
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RecursorStage.lean
@@ -0,0 +1,163 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.ConstructorStage
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Inductive
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+namespace Shape
+
+def recursorEntry (shape : Shape β) (source : β) (mode : ElimMode) : ConstantEntry β :=
+  ⟨mode.recUvars shape.universes, shape.recursorType source mode, none, [], []⟩
+
+def recursorSource (shape : Shape β) (source recursor : β) (mode : ElimMode) (k : Bool := false) : Const β :=
+  .recursor (mode.recUvars shape.universes) shape.parameters.length shape.indices.length 1
+    shape.constructors.length (shape.recursorType source mode).erase
+    (shape.constructors.zipIdx.map fun (ctor, i) =>
+      ⟨ctor.fields.length + ctor.recursive.length, (shape.ruleRhs source recursor mode i ctor).erase⟩)
+    k .safe
+
+/-- K metadata is supported for a singleton proposition whose constructor has
+no fields. Replacing a major proof still requires a typed proof-irrelevance
+certificate at the exact constructor result, followed by the admitted rule. -/
+def SupportsK (shape : Shape β) : Prop :=
+  shape.level = .zero ∧ ∃ ctor, shape.constructors = [ctor] ∧ ctor.fields = [] ∧ ctor.recursive = []
+
+instance (shape : Shape β) : Decidable shape.SupportsK :=
+  match h : shape.constructors with
+  | [ctor] => decidable_of_iff (shape.level = .zero ∧ ctor.fields = [] ∧ ctor.recursive = []) (by
+      simp [SupportsK, h])
+  | [] => .isFalse (by simp [SupportsK, h])
+  | _ :: _ :: _ => .isFalse (by simp [SupportsK, h])
+
+def RecursorSourceMatches (shape : Shape β) (store : Store β) (source recursor : β) (mode : ElimMode) : Prop :=
+  store.blocks recursor = some ⟨[shape.recursorSource source recursor mode]⟩ ∨
+    (shape.SupportsK ∧ store.blocks recursor = some ⟨[shape.recursorSource source recursor mode true]⟩)
+
+instance (shape : Shape β) (store : Store β) (source recursor : β) (mode : ElimMode) :
+    Decidable (shape.RecursorSourceMatches store source recursor mode) := by
+  unfold RecursorSourceMatches
+  infer_instance
+
+def recursorLaws (shape : Shape β) (source recursor : β) (mode : ElimMode) : List (ConstantEquation β) :=
+  shape.constructors.zipIdx.map fun (ctor, i) =>
+    ⟨shape.ruleLhs source recursor mode i ctor, shape.ruleRhs source recursor mode i ctor⟩
+
+def recursorEnvironment (shape : Shape β) (entries : Environment β) (source recursor : β)
+    (mode : ElimMode) : Environment β :=
+  (shape.constructorEnvironment entries source).insert (.member recursor 0) (shape.recursorEntry source mode)
+
+structure RecursorFormation (entries : Environment β) (store : Store β) (shape : Shape β)
+    (source recursor : β) (mode : ElimMode) : Prop where
+  exactSource : shape.RecursorSourceMatches store source recursor mode
+  fresh : shape.constructorEnvironment entries source (.member recursor 0) = none
+  closed : EntryClosed (shape.constructorEnvironment entries source) (shape.recursorEntry source mode)
+  typing : ∃ l, TypingClaim.{u,v} (shape.constructorEnvironment entries source) []
+    (shape.recursorType source mode) (.sort l)
+
+def checkRecursorType (fuel : Nat) (entries : Environment β) (store : Store β) (shape : Shape β)
+    (source recursor : β) (mode : ElimMode) (witness : TypeWitness β) :
+    Option (CheckedClaim.{u} (RecursorFormation.{u,v} entries store shape source recursor mode)) :=
+  if hsource : shape.RecursorSourceMatches store source recursor mode then
+    if hfresh : shape.constructorEnvironment entries source (.member recursor 0) = none then
+      if hs : (shape.recursorType source mode).Scope (mode.recUvars shape.universes) 0 then
+        if hr : (shape.recursorType source mode).ReferencesIn (shape.constructorEnvironment entries source) then do
+          let ht ← verifyType.{u,v} fuel (mode.recUvars shape.universes) (shape.constructorEnvironment entries source) []
+            (shape.recursorType source mode) (.sort witness.level) witness.witness
+          return ⟨⟨hsource, hfresh, ⟨hs, by simp [recursorEntry], hr, by simp [recursorEntry],
+            by simp [recursorEntry], by simp [recursorEntry],
+            by simp [recursorEntry], by simp [recursorEntry]⟩, witness.level, ht.down⟩⟩
+        else none
+      else none
+    else none
+  else none
+
+theorem recursorEnvironment_wf {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode}
+    (h : CheckedShape.{u,v} entries store source shape) (hE : entries.WF)
+    (hC : ConstructorFormation.{u,v} entries shape source)
+    (hR : RecursorFormation.{u,v} entries store shape source recursor mode) :
+    (shape.recursorEnvironment entries source recursor mode).WF :=
+  (constructorEnvironment_wf h hE hC).insert hR.closed.typeScope hR.closed.bodyScope
+    hR.closed.typeReferences hR.closed.bodyReferences hR.closed.equationScope hR.closed.equationReferences
+    hR.closed.factScope hR.closed.factReferences
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def recursorAssignment (shape : Shape β) (constants : Assignment β V)
+    (source recursor : β) (mode : ElimMode) : Assignment β V :=
+  (shape.constructorAssignment constants source).insert (.member recursor 0)
+    (fun levels => shape.closedRecursorValue constants levels mode)
+
+end Shape
+
+variable {V : Type v} [SetTheory V]
+
+structure RecursorReading (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : ElimMode) (constants reading : Assignment β V) : Prop
+    extends ConstructorReading entries shape source constants reading where
+  recursor : ∀ levels, levels.length = mode.recUvars shape.universes →
+    reading (.member recursor 0) levels = shape.closedRecursorValue constants levels mode
+
+namespace Shape
+
+theorem recursorAssignment_agreesConstructors {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode}
+    (hR : RecursorFormation.{u,v} entries store shape source recursor mode) (constants : Assignment β V) :
+    Assignment.AgreesOn (shape.constructorEnvironment entries source) (shape.constructorAssignment constants source)
+      (shape.recursorAssignment constants source recursor mode) := Assignment.insert_agrees hR.fresh _ _
+
+theorem recursorAssignment_reading {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode} (h : CheckedShape.{u,v} entries store source shape)
+    (hR : RecursorFormation.{u,v} entries store shape source recursor mode) (constants : Assignment β V) :
+    RecursorReading entries shape source recursor mode constants (shape.recursorAssignment constants source recursor mode) := by
+  have hr := constructorAssignment_reading h constants
+  have ha := recursorAssignment_agreesConstructors hR constants
+  constructor
+  · constructor
+    · constructor
+      · intro r entry he levels
+        exact (ha r entry (Environment.overlay_old (constructorEntries_fresh h)
+          (Environment.insert_old (h.fresh _ (List.mem_cons_self ..)) he)) levels).trans (hr.agrees r entry he levels)
+      · intro levels hn
+        exact (ha _ _ (Environment.overlay_old (constructorEntries_fresh h) (Environment.insert_same ..)) levels).trans
+          (hr.family levels hn)
+    · intro levels hn i ctor hc
+      exact (ha _ (shape.constructorEntry source ctor) (Environment.overlay_new (by
+        simp only [constructorEntries, ↓reduceIte, hc, Option.map_some])) levels).trans (hr.constructor levels hn i ctor hc)
+  · intro levels _
+    exact Assignment.insert_same ..
+
+theorem recursorAssignment_realizes {entries : Environment β} {store : Store β} {source recursor : β}
+    {shape : Shape β} {mode : ElimMode}
+    (h : CheckedShape.{u,v} entries store source shape) (hE : entries.WF)
+    (hC : ConstructorFormation.{u,v} entries shape source)
+    (hR : RecursorFormation.{u,v} entries store shape source recursor mode)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (shape.recursorAssignment constants source recursor mode) (shape.recursorEnvironment entries source recursor mode) := by
+  have hr := recursorAssignment_reading h hR constants
+  have hbase := (constructorAssignment_realizes h hE hC constants hM).of_agrees
+    (constructorEnvironment_wf h hE hC) (recursorAssignment_agreesConstructors hR constants)
+  obtain ⟨l, ht⟩ := hR.typing
+  apply hbase.insert
+  constructor
+  · intro levels hn env
+    exact (ht V _ hbase levels env (Context.valid_nil _ _ _)).1
+  · intro levels hn env
+    rw [hr.recursor levels hn]
+    have hm := closedRecursorValue_mem_source h hr.toConstructorReading hmode hM hn
+    rwa [interp_closed (shape.recursorType source mode) _ levels hR.closed.typeScope (fun _ => empty) env] at hm
+  · intro body hb; cases hb
+  · intro body hb; cases hb
+  · intro law hl; simp only [recursorEntry, List.not_mem_nil] at hl
+  · intro fact hf; simp only [recursorEntry, List.not_mem_nil] at hf
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/RecursorSyntax.lean b/Ix/Theory/Certified/Ordinary/RecursorSyntax.lean
new file mode 100644
index 000000000..41ceed1b6
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RecursorSyntax.lean
@@ -0,0 +1,155 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Reading
+import Ix.Theory.Inductive.Levels
+
+/-!
+Annotated ordinary recursor syntax. Every source expression is transported
+through the explicit source-universe map; the motive keeps its own universe.
+The generated syntax is subsequently compared with the complete stored type
+and rule, and is checked for formation before any equation is published.
+-/
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Inductive
+
+universe u
+variable {β : Type u}
+
+namespace Shape
+
+def motiveType (shape : Shape β) (source : β) (mode : ElimMode) : AExpr β :=
+  .forallN .never (shape.indices.map (AExpr.instL (mode.sourceLevels shape.universes))) <|
+    .forallE .never
+      ((shape.familyApp source shape.indices.length (parameterVars 0 shape.indices.length)).instL
+        (mode.sourceLevels shape.universes))
+      (.sort mode.motiveLevel)
+
+def minorFields (shape : Shape β) (source : β) (mode : ElimMode) (ctor : Constructor β) :
+    List (AExpr β) :=
+  Telescope.lift 1 ((ctor.fields ++ ctor.recursiveTypes shape source).map
+    (AExpr.instL (mode.sourceLevels shape.universes)))
+
+def ihType (shape : Shape β) (mode : ElimMode) (ctor : Constructor β)
+    (j : Nat) (field : RecursiveField β) : AExpr β :=
+  let sl := mode.sourceLevels shape.universes
+  let a := ctor.fields.length
+  let b := ctor.recursive.length
+  let d := field.domains.length
+  .forallN (zeroCondition mode.motiveLevel)
+    (Telescope.lift b (Telescope.lift 1 (field.domains.map (AExpr.instL sl)) a))
+    (.appN (.bvar (a + b + d))
+      (field.indices.map (fun e => ((e.instL sl).liftN 1 (a + d)).liftN b d) ++
+        [.appN (.bvar (b - 1 - j + d)) (parameterVars 0 d)]))
+
+def ihTypesSyntax (shape : Shape β) (mode : ElimMode) (ctor : Constructor β) : List (AExpr β) :=
+  Telescope.independent (ctor.recursive.zipIdx.map fun (field, j) => shape.ihType mode ctor j field)
+
+def minorResult (shape : Shape β) (source : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  let sl := mode.sourceLevels shape.universes
+  let a := ctor.fields.length
+  let b := ctor.recursive.length
+  .appN (.bvar (a + b + b))
+    (ctor.indices.map (fun e => ((e.instL sl).liftN 1 a).liftN (b + b)) ++
+      [.appN (.const (.ctor source 0 i) sl)
+        (parameterVars (1 + a + b + b) shape.parameters.length ++ parameterVars b (a + b))])
+
+def minorType (shape : Shape β) (source : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .forallN (zeroCondition mode.motiveLevel) (shape.minorFields source mode ctor) <|
+    .forallN (zeroCondition mode.motiveLevel) (shape.ihTypesSyntax mode ctor) <|
+      shape.minorResult source mode i ctor
+
+def minorTypesSyntax (shape : Shape β) (source : β) (mode : ElimMode) : List (AExpr β) :=
+  Telescope.independent (shape.constructors.zipIdx.map fun (ctor, i) => shape.minorType source mode i ctor)
+
+def recursorTail (shape : Shape β) (source : β) (mode : ElimMode) : AExpr β :=
+  let sl := mode.sourceLevels shape.universes
+  let pv := zeroCondition mode.motiveLevel
+  let c := shape.constructors.length
+  let n := shape.indices.length
+  .forallN pv (Telescope.lift (1 + c) (shape.indices.map (AExpr.instL sl))) <|
+    .forallE pv
+      (((shape.familyApp source n (parameterVars 0 n)).instL sl).liftN (1 + c) n)
+      (.appN (.bvar (c + n + 1)) (parameterVars 1 n ++ [.bvar 0]))
+
+def recursorType (shape : Shape β) (source : β) (mode : ElimMode) : AExpr β :=
+  let pv := zeroCondition mode.motiveLevel
+  .forallN pv (shape.parameters.map (AExpr.instL (mode.sourceLevels shape.universes))) <|
+    .forallE pv (shape.motiveType source mode) <|
+      .forallN pv (shape.minorTypesSyntax source mode) <|
+        shape.recursorTail source mode
+
+def ruleBinders (shape : Shape β) (source : β) (mode : ElimMode) (ctor : Constructor β) :
+    List (AExpr β) :=
+  shape.parameters.map (AExpr.instL (mode.sourceLevels shape.universes)) ++
+    [shape.motiveType source mode] ++ shape.minorTypesSyntax source mode ++
+    Telescope.lift (1 + shape.constructors.length)
+      ((ctor.fields ++ ctor.recursiveTypes shape source).map
+        (AExpr.instL (mode.sourceLevels shape.universes)))
+
+def ruleCall (shape : Shape β) (recursor : β) (mode : ElimMode)
+    (ctor : Constructor β) (j : Nat) (field : RecursiveField β) : AExpr β :=
+  let sl := mode.sourceLevels shape.universes
+  let common := 1 + shape.constructors.length
+  let a := ctor.fields.length
+  let b := ctor.recursive.length
+  let d := field.domains.length
+  .lamN (zeroCondition mode.motiveLevel)
+    (Telescope.lift b (Telescope.lift common (field.domains.map (AExpr.instL sl)) a))
+    (.appN (.const (.member recursor 0) (mode.recLevels shape.universes))
+      (parameterVars (a + b + d) (shape.parameters.length + common) ++
+        field.indices.map (fun e => ((e.instL sl).liftN common (a + d)).liftN b d) ++
+        [.appN (.bvar (b - 1 - j + d)) (parameterVars 0 d)]))
+
+def ruleRhsBody (shape : Shape β) (recursor : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .appN (.bvar (shape.constructors.length - 1 - i + ctor.fields.length + ctor.recursive.length))
+    (parameterVars 0 (ctor.fields.length + ctor.recursive.length) ++
+      ctor.recursive.zipIdx.map (fun (field, j) => shape.ruleCall recursor mode ctor j field))
+
+def ruleRhs (shape : Shape β) (source recursor : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .lamN (zeroCondition mode.motiveLevel) (shape.ruleBinders source mode ctor)
+    (shape.ruleRhsBody recursor mode i ctor)
+
+def ruleIndices (shape : Shape β) (mode : ElimMode) (ctor : Constructor β) : List (AExpr β) :=
+  ctor.indices.map fun e =>
+    ((e.instL (mode.sourceLevels shape.universes)).liftN (1 + shape.constructors.length)
+      ctor.fields.length).liftN ctor.recursive.length
+
+def ruleConstructor (shape : Shape β) (source : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  let n := ctor.fields.length + ctor.recursive.length
+  .appN (.const (.ctor source 0 i) (mode.sourceLevels shape.universes))
+    (parameterVars (1 + shape.constructors.length + n) shape.parameters.length ++ parameterVars 0 n)
+
+def ruleResult (shape : Shape β) (source : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .appN (.bvar (shape.constructors.length + ctor.fields.length + ctor.recursive.length))
+    (shape.ruleIndices mode ctor ++ [shape.ruleConstructor source mode i ctor])
+
+def ruleType (shape : Shape β) (source : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .forallN (zeroCondition mode.motiveLevel) (shape.ruleBinders source mode ctor)
+    (shape.ruleResult source mode i ctor)
+
+def ruleLhsBody (shape : Shape β) (source recursor : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .appN (.const (.member recursor 0) (mode.recLevels shape.universes))
+    (parameterVars (ctor.fields.length + ctor.recursive.length)
+      (shape.parameters.length + 1 + shape.constructors.length) ++
+      shape.ruleIndices mode ctor ++ [shape.ruleConstructor source mode i ctor])
+
+def ruleLhs (shape : Shape β) (source recursor : β) (mode : ElimMode) (i : Nat)
+    (ctor : Constructor β) : AExpr β :=
+  .lamN (zeroCondition mode.motiveLevel) (shape.ruleBinders source mode ctor)
+    (shape.ruleLhsBody source recursor mode i ctor)
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/RecursorValue.lean b/Ix/Theory/Certified/Ordinary/RecursorValue.lean
new file mode 100644
index 000000000..cffca1022
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RecursorValue.lean
@@ -0,0 +1,136 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RecursorReading
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Inductive
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+def ModeEvidence (entries : Environment β) (shape : Shape β) : ElimMode → Prop
+  | .small => True
+  | .large => LargeEvidence.{u,v} entries shape
+
+def checkMode [DecidableEq β] (fuel : Nat) (entries : Environment β) (witness : ShapeWitness β)
+    (mode : ElimMode) : Option (CheckedClaim.{u} (ModeEvidence.{u,v} entries witness.shape mode)) :=
+  match mode with
+  | .small => some ⟨trivial⟩
+  | .large => checkLarge fuel entries witness
+
+namespace Shape
+
+noncomputable def recursorAt (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (mode : ElimMode) (m : V) (minors : List V) : V := by
+  classical
+  exact match mode with
+  | .small => pt
+  | .large =>
+    if hD : (shape.container constants (mode.sourceArgs levels) env).WF
+        (shape.level.eval (mode.sourceArgs levels)) then
+      if hlarge : (shape.container constants (mode.sourceArgs levels) env).LargeElim
+          (shape.level.eval (mode.sourceArgs levels)) then
+        shape.largeValue constants (mode.sourceArgs levels) env (mode.motiveLevel.eval levels) m minors hD hlarge
+      else pt
+    else pt
+
+theorem recursorAt_large (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (m : V) (minors : List V)
+    (hD : (shape.container constants (ElimMode.large.sourceArgs levels) env).WF
+      (shape.level.eval (ElimMode.large.sourceArgs levels)))
+    (hlarge : (shape.container constants (ElimMode.large.sourceArgs levels) env).LargeElim
+      (shape.level.eval (ElimMode.large.sourceArgs levels))) :
+    shape.recursorAt constants levels env .large m minors =
+      shape.largeValue constants (ElimMode.large.sourceArgs levels) env
+        (ElimMode.large.motiveLevel.eval levels) m minors hD hlarge := by
+  simp only [recursorAt, dif_pos hD, dif_pos hlarge]
+
+theorem recursorSet_zero (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (m : V) :
+    shape.recursorSet constants levels env 0 m ∈ˢ (univZero : V) :=
+  Telescope.piN_zero_mem _ (fun _ _ => piR_zero_mem_univZero)
+
+variable {entries : Environment β} {shape : Shape β} {source : β} {store : Store β}
+  {constants : Assignment β V} {levels : List Nat} {env : Nat → V} {mode : ElimMode}
+
+theorem recursorAt_mem (h : CheckedShape.{u,v} entries store source shape)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries)
+    (hΓ : shape.parameterContext.Valid constants (mode.sourceArgs levels) env)
+    {m : V} {minors : List V}
+    (hm : m ∈ˢ shape.motiveSet constants (mode.sourceArgs levels) env (mode.motiveLevel.eval levels))
+    (hminors : shape.MinorValuesFit constants (mode.sourceArgs levels) env (mode.motiveLevel.eval levels) m minors) :
+    shape.recursorAt constants levels env mode m minors ∈ˢ
+      shape.recursorSet constants (mode.sourceArgs levels) env (mode.motiveLevel.eval levels) m := by
+  cases mode with
+  | small => exact pt_mem_smallRecursorSet h hM hΓ hm hminors
+  | large =>
+    rw [recursorAt_large _ _ _ _ _ _ (container_wf h hM hΓ) (container_large hmode hM hΓ)]
+    exact largeValue_mem h hM hΓ hm hminors _ _
+
+noncomputable def closedRecursorValue (shape : Shape β) (constants : Assignment β V)
+    (levels : List Nat) (mode : ElimMode) : V :=
+  let ls := mode.sourceArgs levels
+  let v := mode.motiveLevel.eval levels
+  Telescope.curry v (Telescope.interpret constants ls (fun _ => empty) shape.parameters) fun ps =>
+    lamR v (shape.motiveSet constants ls (Telescope.extend (fun _ => empty) ps) v) fun m =>
+      Telescope.curry v (Telescope.simple (shape.minorTypes constants ls (Telescope.extend (fun _ => empty) ps) v m))
+        (fun minors => shape.recursorAt constants levels (Telescope.extend (fun _ => empty) ps) mode m minors)
+
+theorem closedRecursorValue_mem (h : CheckedShape.{u,v} entries store source shape)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries) :
+    shape.closedRecursorValue constants levels mode ∈ˢ shape.closedRecursorSet constants levels mode := by
+  apply Telescope.curry_mem
+  intro ps hps
+  apply lamR_mem
+  intro m hm
+  apply Telescope.curry_mem
+  intro minors hminors
+  exact recursorAt_mem h hmode hM
+    (h.parameters.valid constants hM (mode.sourceArgs levels)
+      (Context.valid_nil constants (mode.sourceArgs levels) (fun _ => empty)) hps) hm hminors
+
+theorem closedRecursorValue_mem_source (h : CheckedShape.{u,v} entries store source shape)
+    {reading : Assignment β V} (hr : ConstructorReading entries shape source constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) :
+    shape.closedRecursorValue constants levels mode ∈ˢ
+      interp reading levels (fun _ => empty) (shape.recursorType source mode) := by
+  rw [recursorType_interp h hr hM hn]
+  exact closedRecursorValue_mem h hmode hM
+
+theorem closedRecursorValue_apply (h : CheckedShape.{u,v} entries store source shape)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries) {ps : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    {m : V} {minors : List V}
+    (hm : m ∈ˢ shape.motiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels))
+    (hminors : shape.MinorValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels) m minors) :
+    Telescope.applyN (shape.closedRecursorValue constants levels mode) (ps ++ [m] ++ minors) =
+      shape.recursorAt constants levels (Telescope.extend (fun _ => empty) ps) mode m minors := by
+  have hbody (ps : List V) hps m hm minors hminors := recursorAt_mem h hmode hM
+    (h.parameters.valid constants hM (mode.sourceArgs levels) (xs := ps)
+      (Context.valid_nil constants (mode.sourceArgs levels) (fun _ => empty)) hps)
+    (m := m) hm (minors := minors) hminors
+  have hminor ps hps m hm := Telescope.curry_mem (w := mode.motiveLevel.eval levels) _ (hbody ps hps m hm)
+  have hmotive ps hps := lamR_mem (v := mode.motiveLevel.eval levels) (hminor ps hps)
+  rw [closedRecursorValue, Telescope.applyN_append, Telescope.applyN_append,
+    Telescope.applyN_curry _ hps hmotive (fun hv _ _ => by
+      rw [hv]
+      exact piR_zero_mem_univZero)]
+  change Telescope.applyN (app (lamR _ _ _) m) minors = _
+  rw [app_lamR hm (hminor ps hps) (fun hv _ _ => by
+    rw [hv]
+    apply Telescope.piN_zero_mem
+    intro _ _
+    exact recursorSet_zero _ _ _ _ _)]
+  exact Telescope.applyN_curry _ hminors (hbody ps hps m hm) (fun hv _ _ => by
+    rw [hv]
+    exact recursorSet_zero _ _ _ _ _)
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/RuleChecks.lean b/Ix/Theory/Certified/Ordinary/RuleChecks.lean
new file mode 100644
index 000000000..874c81654
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RuleChecks.lean
@@ -0,0 +1,90 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RecursorStage
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model Model.SetTheory Model.SetModel Inductive
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure RuleWitness (β : Type u) where
+  typeLevel : VLevel
+  typeWitness : TypingWitness β
+  lhsWitness : TypingWitness β
+  rhsWitness : TypingWitness β
+
+namespace Shape
+
+/-- These checks run against the formed recursor signature with no equations.
+They establish the whole closed rule's type, both endpoint memberships, and
+the syntactic scope/reference facts needed when its equation is published. -/
+structure RuleFormation (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : ElimMode) (i : Nat) (ctor : Constructor β) : Prop where
+  scope : (shape.ruleLhs source recursor mode i ctor).Scope (mode.recUvars shape.universes) 0 ∧
+    (shape.ruleRhs source recursor mode i ctor).Scope (mode.recUvars shape.universes) 0
+  references : (shape.ruleLhs source recursor mode i ctor).ReferencesIn entries ∧
+    (shape.ruleRhs source recursor mode i ctor).ReferencesIn entries
+  type : ∃ l, TypingClaim.{u,v} entries [] (shape.ruleType source mode i ctor) (.sort l) ∧
+    (mode = .small → ∀ levels, l.eval levels = 0)
+  lhs : TypingClaim.{u,v} entries [] (shape.ruleLhs source recursor mode i ctor) (shape.ruleType source mode i ctor)
+  rhs : TypingClaim.{u,v} entries [] (shape.ruleRhs source recursor mode i ctor) (shape.ruleType source mode i ctor)
+
+def checkRule (fuel : Nat) (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : ElimMode) (i : Nat) (ctor : Constructor β) (witness : RuleWitness β) :
+    Option (CheckedClaim.{u} (RuleFormation.{u,v} entries shape source recursor mode i ctor)) :=
+  if hs : (shape.ruleLhs source recursor mode i ctor).Scope (mode.recUvars shape.universes) 0 ∧
+      (shape.ruleRhs source recursor mode i ctor).Scope (mode.recUvars shape.universes) 0 then
+    if hr : (shape.ruleLhs source recursor mode i ctor).ReferencesIn entries ∧
+        (shape.ruleRhs source recursor mode i ctor).ReferencesIn entries then
+      if hsmall : mode = .small → LevelEq.check (mode.recUvars shape.universes) witness.typeLevel .zero = true then do
+        let ht ← verifyType.{u,v} fuel (mode.recUvars shape.universes) entries []
+          (shape.ruleType source mode i ctor) (.sort witness.typeLevel) witness.typeWitness
+        let hl ← verifyType.{u,v} fuel (mode.recUvars shape.universes) entries []
+          (shape.ruleLhs source recursor mode i ctor) (shape.ruleType source mode i ctor) witness.lhsWitness
+        let hh ← verifyType.{u,v} fuel (mode.recUvars shape.universes) entries []
+          (shape.ruleRhs source recursor mode i ctor) (shape.ruleType source mode i ctor) witness.rhsWitness
+        return ⟨⟨hs, hr, ⟨witness.typeLevel, ht.down, by
+          intro he levels
+          exact (LevelEq.check_sound (hsmall he)).2.2 levels⟩, hl.down, hh.down⟩⟩
+      else none
+    else none
+  else none
+
+def checkRules (fuel : Nat) (entries : Environment β) (shape : Shape β) (source recursor : β)
+    (mode : ElimMode) : (ctors : List (Constructor β × Nat)) → List (RuleWitness β) →
+      Option (CheckedClaim.{u} (∀ ctor i, (ctor, i) ∈ ctors →
+        RuleFormation.{u,v} entries shape source recursor mode i ctor))
+  | [], [] => some ⟨by simp⟩
+  | (ctor, i) :: ctors, witness :: witnesses => do
+    let rule ← checkRule fuel entries shape source recursor mode i ctor witness
+    let rest ← checkRules fuel entries shape source recursor mode ctors witnesses
+    return ⟨by
+      intro ctor' i' hc
+      rcases List.mem_cons.mp hc with he | hc
+      · cases he; exact rule.down
+      · exact rest.down ctor' i' hc⟩
+  | _, _ => none
+
+variable {V : Type v} [SetTheory V]
+
+omit [DecidableEq β] in
+theorem small_rule_eq {entries : Environment β} {shape : Shape β} {source recursor : β}
+    {i : Nat} {ctor : Constructor β}
+    (h : RuleFormation.{u,v} entries shape source recursor .small i ctor)
+    (constants : Assignment β V) (hM : Realizes constants entries) (levels : List Nat) (env : Nat → V) :
+    interp constants levels env (shape.ruleLhs source recursor .small i ctor) =
+      interp constants levels env (shape.ruleRhs source recursor .small i ctor) := by
+  obtain ⟨l, ht, hz⟩ := h.type
+  have hΓ := Context.valid_nil constants levels env
+  have hprop := (ht V constants hM levels env hΓ).2.2
+  rw [interp, hz rfl levels, univ_zero] at hprop
+  exact subsingleton_of_mem_univZero hprop (h.lhs V constants hM levels env hΓ).2.2
+    (h.rhs V constants hM levels env hΓ).2.2
+
+end Shape
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Ordinary/RuleEquations.lean b/Ix/Theory/Certified/Ordinary/RuleEquations.lean
new file mode 100644
index 000000000..9af9d737b
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RuleEquations.lean
@@ -0,0 +1,115 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RuleReading
+
+namespace Ix.Theory.Certified.Ordinary.Shape
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Inductive
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+  {entries : Environment β} {shape : Shape β} {source recursor : β}
+  {constants reading : Assignment β V} {levels : List Nat} {mode : ElimMode}
+
+theorem ruleFields_curry {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {ps minors : List V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hmlen : minors.length = shape.constructors.length) (m : V) (w : Nat) (f : List V → V) :
+    Telescope.curry w (Telescope.interpret reading levels
+      (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors)
+      (Telescope.lift (1 + shape.constructors.length) ((ctor.fields ++ ctor.recursiveTypes shape source).map
+        (AExpr.instL (mode.sourceLevels shape.universes))))) f =
+      Telescope.curry w
+        (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields)
+        (fun xs => Telescope.curry w
+          (Telescope.simple (ctor.recursive.map
+            (shape.recursiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) xs)))
+          (fun fs => f (xs ++ fs))) := by
+  have hskip : Valuation.skip (1 + shape.constructors.length) 0
+      (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors) =
+      Telescope.extend (fun _ => empty) ps := by
+    have ht := Telescope.skip_extend (Telescope.extend (fun _ => empty) ps) (m :: minors)
+    simpa only [List.length_cons, hmlen, Telescope.extend, Nat.add_comm] using ht
+  rw [Telescope.curry_lift, hskip, Telescope.curry_instL, mode.sourceLevels_eval hn,
+    Telescope.curry_append,
+    hr.agrees.telescope (fun A ha => (h.constructors ctor hc).1 A (List.mem_append_left _ ha))]
+  apply Telescope.curry_congr
+  intro xs hxs
+  have ht := curry_recursiveTypes h hr hM (mode.sourceArgs_length hn) hc (fun _ h => h) hps hxs [] w
+    (fun fs => f (xs ++ fs))
+  simpa only [Constructor.recursiveTypes, List.length_nil, Telescope.extend] using ht
+
+/-- Equality of the complete lambda-abstracted rule, including parameters,
+the motive, every minor premise, and all constructor fields. -/
+theorem large_rule_eq {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : RecursorReading entries shape source recursor .large constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape .large) (hM : Realizes constants entries)
+    (hn : levels.length = ElimMode.large.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) :
+    interp reading levels (fun _ => empty) (shape.ruleLhs source recursor .large i ctor) =
+      interp reading levels (fun _ => empty) (shape.ruleRhs source recursor .large i ctor) := by
+  simp only [ruleLhs, ruleRhs, ruleBinders, AExpr.lamN_append, AExpr.interp_lamN,
+    Telescope.curry_instL, ElimMode.sourceLevels_eval _ hn,
+    hr.agrees.telescope (fun A ha => h.references A (List.mem_append_left _ ha))]
+  apply Telescope.curry_congr
+  intro ps hps
+  change lamR _ (interp reading levels _ (shape.motiveType source .large)) _ = lamR _ _ _
+  rw [motiveType_interp hr.toFamilyReading hn hps (fun A ha => h.references A (List.mem_append_right _ ha))]
+  apply lamR_congr
+  intro m hm
+  change Telescope.curry _ (Telescope.interpret reading levels
+    (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (shape.minorTypesSyntax source .large)) _ =
+    Telescope.curry _ (Telescope.interpret reading levels
+      (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) (shape.minorTypesSyntax source .large)) _
+  simp only [Telescope.extend]
+  simp only [minorTypes_curry h hr.toConstructorReading hM hn hps m]
+  apply Telescope.curry_congr
+  intro minors hminors
+  have hmlen : minors.length = shape.constructors.length := by
+    simpa only [minorTypes, List.length_map, List.length_zipIdx] using FitsS.length_eq hminors
+  simp only [ruleFields_curry h hr.toFamilyReading hM hn (List.mem_of_getElem? hc) hps hmlen m]
+  apply Telescope.curry_congr
+  intro xs hxs
+  apply Telescope.curry_congr
+  intro fs hfs
+  simp only [Telescope.extend_append]
+  exact large_ruleBody_eq h hr hmode hM hn hc hps hxs hfs hm hminors
+
+theorem large_rule_eq_closed {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : RecursorReading entries shape source recursor .large constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape .large) (hM : Realizes constants entries)
+    (hn : levels.length = ElimMode.large.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor)
+    (hscope : (shape.ruleLhs source recursor .large i ctor).Scope (ElimMode.large.recUvars shape.universes) 0 ∧
+      (shape.ruleRhs source recursor .large i ctor).Scope (ElimMode.large.recUvars shape.universes) 0)
+    (env : Nat → V) :
+    interp reading levels env (shape.ruleLhs source recursor .large i ctor) =
+      interp reading levels env (shape.ruleRhs source recursor .large i ctor) := by
+  rw [← interp_closed _ _ _ hscope.1 (fun _ => empty) env,
+    ← interp_closed _ _ _ hscope.2 (fun _ => empty) env]
+  exact large_rule_eq h hr hmode hM hn hc
+
+variable [DecidableEq β]
+
+theorem produced_rule_eq {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hE : entries.WF) (hC : ConstructorFormation.{u,v} entries shape source)
+    (hR : RecursorFormation.{u,v} entries store shape source recursor mode)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor)
+    (hRule : RuleFormation.{u,v} (shape.recursorEnvironment entries source recursor mode)
+      shape source recursor mode i ctor) (env : Nat → V) :
+    interp (shape.recursorAssignment constants source recursor mode) levels env (shape.ruleLhs source recursor mode i ctor) =
+      interp (shape.recursorAssignment constants source recursor mode) levels env (shape.ruleRhs source recursor mode i ctor) := by
+  cases mode with
+  | small =>
+    exact small_rule_eq hRule _ (recursorAssignment_realizes h hE hC hR hmode constants hM) levels env
+  | large =>
+    exact large_rule_eq_closed h (recursorAssignment_reading h hR constants) hmode hM hn hc hRule.scope env
+
+end Ix.Theory.Certified.Ordinary.Shape
diff --git a/Ix/Theory/Certified/Ordinary/RuleReading.lean b/Ix/Theory/Certified/Ordinary/RuleReading.lean
new file mode 100644
index 000000000..ab200fac7
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/RuleReading.lean
@@ -0,0 +1,270 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.RuleChecks
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+theorem Assignment.AgreesOn.interp_inserted {entries : Environment β}
+    {constants reading : Assignment β V} (h : Assignment.AgreesOn entries constants reading)
+    (levels : List Nat) (sourceLevels : List VLevel) (env : Nat → V)
+    (shared xs fs ys : List V) {e : AExpr β} (hrefs : e.ReferencesIn entries) :
+    Model.interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend env shared) xs) fs) ys)
+      (((e.instL sourceLevels).liftN shared.length (xs.length + ys.length)).liftN fs.length ys.length) =
+      Model.interp constants (sourceLevels.map (VLevel.eval levels)) (Telescope.extend (Telescope.extend env xs) ys) e := by
+  rw [interp_liftN, Telescope.skip_middle, interp_liftN,
+    show xs.length + ys.length = ys.length + xs.length by omega,
+    Telescope.skip_extend_at, Telescope.skip_middle, interp_instL, h.interp hrefs]
+
+end Ix.Theory.Model
+
+namespace Ix.Theory.Certified.Ordinary.Shape
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Inductive
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def recursorCall (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (mode : ElimMode) (m : V) (minors xs fs : List V) (j : Nat) (field : RecursiveField β) : V :=
+  Telescope.curry (mode.motiveLevel.eval levels)
+    (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend env xs) field.domains) fun ys =>
+      Telescope.applyN (shape.recursorAt constants levels env mode m minors)
+        (field.indices.map (interp constants (mode.sourceArgs levels) (Telescope.extend (Telescope.extend env xs) ys)) ++
+          [Telescope.applyN (fs.getD j empty) ys])
+
+noncomputable def recursorCalls (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (mode : ElimMode) (m : V) (minors : List V) (ctor : Constructor β) (xs fs : List V) : List V :=
+  ctor.recursive.zipIdx.map fun (field, j) => shape.recursorCall constants levels env mode m minors xs fs j field
+
+theorem recursorCall_large (shape : Shape β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (m : V) (minors xs fs : List V) (j : Nat) (field : RecursiveField β)
+    (hD : (shape.container constants (ElimMode.large.sourceArgs levels) env).WF
+      (shape.level.eval (ElimMode.large.sourceArgs levels)))
+    (hlarge : (shape.container constants (ElimMode.large.sourceArgs levels) env).LargeElim
+      (shape.level.eval (ElimMode.large.sourceArgs levels))) :
+    shape.recursorCall constants levels env .large m minors xs fs j field =
+      shape.recursiveCall constants (ElimMode.large.sourceArgs levels) env
+        (ElimMode.large.motiveLevel.eval levels) m minors hD hlarge xs fs j field := by
+  simp only [recursorCall, recursiveCall, recursorAt_large _ _ _ _ _ _ hD hlarge]
+
+variable {entries : Environment β} {shape : Shape β} {source recursor : β}
+  {constants reading : Assignment β V} {levels : List Nat} {mode : ElimMode}
+
+theorem ruleCall_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : RecursorReading entries shape source recursor mode constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    {j : Nat} {field : RecursiveField β} (hf : ctor.recursive[j]? = some field)
+    {ps xs fs minors : List V} {m : V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : fs.length = ctor.recursive.length)
+    (hm : m ∈ˢ shape.motiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels))
+    (hminors : shape.MinorValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels) m minors) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)
+      (shape.ruleCall recursor mode ctor j field) =
+      shape.recursorCall constants levels (Telescope.extend (fun _ => empty) ps) mode m minors xs fs j field := by
+  have hctor := h.constructors ctor hc
+  have hfield := hctor.2.2.2.2 field (List.mem_of_getElem? hf)
+  have hplen := FitsS.length_eq hps
+  have hxlen := FitsS.length_eq hxs
+  have hmlen : minors.length = shape.constructors.length := by
+    simpa only [minorTypes, List.length_map, List.length_zipIdx] using FitsS.length_eq hminors
+  have hcommon : 1 + shape.constructors.length = (m :: minors).length := by simp [hmlen, Nat.add_comm]
+  have hskip : Valuation.skip (1 + shape.constructors.length) ctor.fields.length
+      (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) =
+      Telescope.extend (Telescope.extend (fun _ => empty) ps) xs := by
+    simpa only [← hcommon, hxlen] using Telescope.skip_middle (Telescope.extend (fun _ => empty) ps) (m :: minors) xs
+  rw [ruleCall, AExpr.interp_lamN, Telescope.curry_lift, ← hfs, Telescope.skip_extend,
+    Telescope.curry_lift, hskip, Telescope.curry_instL, mode.sourceLevels_eval hn,
+    hr.agrees.telescope (fun A ha => hfield.1 A (List.mem_append_left _ ha))]
+  apply Telescope.curry_zero_agree (regime_zeroCondition mode.motiveLevel levels)
+  intro ys hys
+  have hylen := FitsS.length_eq hys
+  have hprefix := interp_parameterVars_middle reading levels (fun _ => empty) (ps ++ [m] ++ minors) (xs ++ fs ++ ys)
+  simp only [List.length_append, List.length_singleton, Telescope.extend_append, Telescope.extend,
+    hplen, hxlen, hfs, hmlen, hylen, Nat.add_assoc] at hprefix
+  have hidx : field.indices.map (fun e => interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps)
+        (m :: minors)) xs) fs) ys)
+      (((e.instL (mode.sourceLevels shape.universes)).liftN (1 + shape.constructors.length)
+        (ctor.fields.length + field.domains.length)).liftN ctor.recursive.length field.domains.length)) =
+      field.indices.map (interp constants (mode.sourceArgs levels)
+        (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs) ys)) := by
+    apply List.map_congr_left
+    intro e he
+    have ht := hr.agrees.interp_inserted levels (mode.sourceLevels shape.universes)
+      (Telescope.extend (fun _ => empty) ps) (m :: minors) xs fs ys (hfield.1 e (List.mem_append_right _ he))
+    simpa only [mode.sourceLevels_eval hn, ← hcommon, hxlen, hfs, hylen] using ht
+  have hfvar : Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps)
+      (m :: minors)) xs) fs) ys (ctor.recursive.length - 1 - j + field.domains.length) = fs.getD j empty := by
+    rw [← hfs, ← hylen, Nat.add_comm, Telescope.extend_beyond,
+      Telescope.extend_getD _ _ j (by rw [hfs]; exact (List.getElem?_eq_some_iff.mp hf).1)]
+  have hvars := interp_parameterVars_extend reading levels
+    (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs) ys
+  rw [hylen] at hvars
+  simp only [Telescope.extend] at hidx hfvar hvars
+  simp only [hfs, AExpr.interp_appN, interp, ElimMode.recLevels, eval_params hn,
+    hr.recursor _ hn, List.map_append, List.map_map, Function.comp_def, List.map_cons,
+    List.map_nil, hidx, hfvar, hvars, Nat.add_assoc, Telescope.extend, hprefix]
+  rw [Telescope.applyN_append, Telescope.applyN_append, closedRecursorValue_apply h hmode hM hps hm hminors,
+    Telescope.applyN_append]
+
+theorem ruleConstructor_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : ConstructorReading entries shape source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps xs fs minors : List V} (m : V)
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor xs fs)
+    (hmlen : minors.length = shape.constructors.length) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)
+      (shape.ruleConstructor source mode i ctor) =
+      shape.constructorValue constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor i xs fs := by
+  have hflen : fs.length = ctor.recursive.length := by simpa using FitsS.length_eq hfs
+  have ht := constructorVars_interp hr hn hc ps (m :: minors) (xs ++ fs) [] (FitsS.length_eq hps)
+  rw [← List.append_assoc, constructorClosedValue_apply h hM hc hps hxs hfs] at ht
+  simpa only [ruleConstructor, List.length_cons, List.length_nil, List.length_append,
+    hmlen, FitsS.length_eq hxs, hflen, Nat.add_zero, Nat.zero_add, Telescope.extend_append, Telescope.extend,
+    Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using ht
+
+theorem ruleIndices_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : FamilyReading entries shape source constants reading)
+    (hn : levels.length = mode.recUvars shape.universes) {ctor : Constructor β} (hc : ctor ∈ shape.constructors)
+    (ps xs fs minors : List V) (m : V) (hxlen : xs.length = ctor.fields.length)
+    (hflen : fs.length = ctor.recursive.length) (hmlen : minors.length = shape.constructors.length) :
+    (shape.ruleIndices mode ctor).map (interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)) =
+      ctor.indices.map (interp constants (mode.sourceArgs levels)
+        (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs)) := by
+  rw [ruleIndices, List.map_map]
+  apply List.map_congr_left
+  intro e he
+  have ht := hr.agrees.interp_inserted levels (mode.sourceLevels shape.universes)
+    (Telescope.extend (fun _ => empty) ps) (m :: minors) xs fs []
+    ((h.constructors ctor hc).1 e (List.mem_append_right _ he))
+  simpa only [mode.sourceLevels_eval hn, List.length_cons, List.length_nil, Nat.add_zero, Nat.zero_add,
+    hxlen, hflen, hmlen, Telescope.extend, Nat.add_comm, Function.comp_def] using ht
+
+theorem ruleLhsBody_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : RecursorReading entries shape source recursor mode constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps xs fs minors : List V} {m : V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor xs fs)
+    (hm : m ∈ˢ shape.motiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels))
+    (hminors : shape.MinorValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels) m minors) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)
+      (shape.ruleLhsBody source recursor mode i ctor) =
+      Telescope.applyN (shape.recursorAt constants levels (Telescope.extend (fun _ => empty) ps) mode m minors)
+        (ctor.indices.map (interp constants (mode.sourceArgs levels) (Telescope.extend (Telescope.extend (fun _ => empty) ps) xs)) ++
+          [shape.constructorValue constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor i xs fs]) := by
+  have hflen : fs.length = ctor.recursive.length := by simpa using FitsS.length_eq hfs
+  have hmlen : minors.length = shape.constructors.length := by
+    simpa only [minorTypes, List.length_map, List.length_zipIdx] using FitsS.length_eq hminors
+  have hprefix := interp_parameterVars_middle reading levels (fun _ => empty) (ps ++ [m] ++ minors) (xs ++ fs)
+  simp only [List.length_append, List.length_singleton, Telescope.extend_append, Telescope.extend,
+    FitsS.length_eq hps, FitsS.length_eq hxs, hflen, hmlen] at hprefix
+  have hcv := ruleConstructor_interp h hr.toConstructorReading hM hn hc m hps hxs hfs hmlen
+  have hidx := ruleIndices_interp h hr.toFamilyReading hn (List.mem_of_getElem? hc)
+    ps xs fs minors m (FitsS.length_eq hxs) hflen hmlen
+  simp only [Telescope.extend] at hcv hidx
+  rw [ruleLhsBody, AExpr.interp_appN]
+  simp only [interp, ElimMode.recLevels, eval_params hn, hr.recursor _ hn, List.map_append,
+    List.map_cons, List.map_nil, hcv, hidx, Telescope.extend, hprefix]
+  rw [Telescope.applyN_append, Telescope.applyN_append, closedRecursorValue_apply h hmode hM hps hm hminors,
+    Telescope.applyN_append]
+
+theorem ruleRhsBody_interp {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : RecursorReading entries shape source recursor mode constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape mode) (hM : Realizes constants entries)
+    (hn : levels.length = mode.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps xs fs minors : List V} {m : V}
+    (hps : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor xs fs)
+    (hm : m ∈ˢ shape.motiveSet constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels))
+    (hminors : shape.MinorValuesFit constants (mode.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (mode.motiveLevel.eval levels) m minors) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)
+      (shape.ruleRhsBody recursor mode i ctor) =
+      Telescope.applyN (minors.getD i empty)
+        (xs ++ fs ++ shape.recursorCalls constants levels (Telescope.extend (fun _ => empty) ps) mode m minors ctor xs fs) := by
+  have hflen : fs.length = ctor.recursive.length := by simpa using FitsS.length_eq hfs
+  have hmlen : minors.length = shape.constructors.length := by
+    simpa only [minorTypes, List.length_map, List.length_zipIdx] using FitsS.length_eq hminors
+  have hmvar : Telescope.extend
+      (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs
+      (shape.constructors.length - 1 - i + ctor.fields.length + ctor.recursive.length) = minors.getD i empty := by
+    have ht := (Telescope.extend_beyond (Telescope.extend (Valuation.cons m (Telescope.extend (fun _ => empty) ps)) minors)
+      (xs ++ fs) (minors.length - 1 - i)).trans
+      (Telescope.extend_getD _ minors i (by rw [hmlen]; exact (List.getElem?_eq_some_iff.mp hc).1))
+    simpa only [List.length_append, hmlen, FitsS.length_eq hxs, hflen,
+      Telescope.extend_append, Telescope.extend, Nat.add_comm, Nat.add_assoc, Nat.add_left_comm] using ht
+  have hfields := interp_parameterVars_extend reading levels
+    (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) (xs ++ fs)
+  simp only [List.length_append, FitsS.length_eq hxs, hflen, Telescope.extend_append] at hfields
+  have hcalls : (ctor.recursive.zipIdx.map fun (field, j) => shape.ruleCall recursor mode ctor j field).map
+      (interp reading levels (Telescope.extend
+        (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)) =
+      shape.recursorCalls constants levels (Telescope.extend (fun _ => empty) ps) mode m minors ctor xs fs := by
+    apply List.ext_getElem?
+    intro j
+    simp only [recursorCalls, List.getElem?_map, List.getElem?_zipIdx]
+    cases hf : ctor.recursive[j]? with
+    | none => rfl
+    | some field =>
+      simp only [Option.map_some, Nat.zero_add]
+      exact congrArg some (ruleCall_interp h hr hmode hM hn (List.mem_of_getElem? hc) hf hps hxs hflen hm hminors)
+  rw [ruleRhsBody, AExpr.interp_appN]
+  simp only [interp, hmvar, List.map_append, hfields, hcalls]
+
+theorem large_ruleBody_eq {store : Store β} (h : CheckedShape.{u,v} entries store source shape)
+    (hr : RecursorReading entries shape source recursor .large constants reading)
+    (hmode : ModeEvidence.{u,v} entries shape .large) (hM : Realizes constants entries)
+    (hn : levels.length = ElimMode.large.recUvars shape.universes) {i : Nat} {ctor : Constructor β}
+    (hc : shape.constructors[i]? = some ctor) {ps xs fs minors : List V} {m : V}
+    (hps : FitsS (Telescope.interpret constants (ElimMode.large.sourceArgs levels) (fun _ => empty) shape.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants (ElimMode.large.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor.fields) xs)
+    (hfs : shape.RecursiveValuesFit constants (ElimMode.large.sourceArgs levels) (Telescope.extend (fun _ => empty) ps) ctor xs fs)
+    (hm : m ∈ˢ shape.motiveSet constants (ElimMode.large.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (ElimMode.large.motiveLevel.eval levels))
+    (hminors : shape.MinorValuesFit constants (ElimMode.large.sourceArgs levels) (Telescope.extend (fun _ => empty) ps)
+      (ElimMode.large.motiveLevel.eval levels) m minors) :
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)
+      (shape.ruleLhsBody source recursor .large i ctor) =
+    interp reading levels
+      (Telescope.extend (Telescope.extend (Telescope.extend (Telescope.extend (fun _ => empty) ps) (m :: minors)) xs) fs)
+      (shape.ruleRhsBody recursor .large i ctor) := by
+  rw [ruleLhsBody_interp h hr hmode hM hn hc hps hxs hfs hm hminors,
+    ruleRhsBody_interp h hr hmode hM hn hc hps hxs hfs hm hminors]
+  have hΓ := h.parameters.valid constants hM (ElimMode.large.sourceArgs levels)
+    (Context.valid_nil constants (ElimMode.large.sourceArgs levels) (fun _ => empty)) hps
+  have hD := container_wf h hM hΓ
+  have hlarge := container_large hmode hM hΓ
+  rw [recursorAt_large _ _ _ _ _ _ hD hlarge]
+  simp only [recursorCalls, recursorCall_large _ _ _ _ _ _ _ _ _ _ hD hlarge]
+  exact largeValue_iota h hM hΓ hm hminors hD hlarge hc hxs hfs
+
+end Ix.Theory.Certified.Ordinary.Shape
diff --git a/Ix/Theory/Certified/Ordinary/Shape.lean b/Ix/Theory/Certified/Ordinary/Shape.lean
new file mode 100644
index 000000000..7ae8b8037
--- /dev/null
+++ b/Ix/Theory/Certified/Ordinary/Shape.lean
@@ -0,0 +1,212 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Telescope
+import Ix.Theory.Model.Support
+import Ix.Theory.Store
+
+/-!
+An executable producer for the ordinary container shape class. All ordinary
+fields precede recursive fields. A recursive field is a dependent function
+over checked external domains returning this family with the same parameters
+and checked indices. Its domains and indices cannot depend on other recursive
+fields. Exact source comparison, formation, and universe bounds are checked
+here; publishing recursor equations requires the later realization producer.
+-/
+
+namespace Ix.Theory.Certified.Ordinary
+
+open Model
+
+universe u v
+
+structure RecursiveField (β : Type u) where
+  domains : List (AExpr β)
+  indices : List (AExpr β)
+deriving DecidableEq
+
+structure Constructor (β : Type u) where
+  fields : List (AExpr β)
+  recursive : List (RecursiveField β)
+  indices : List (AExpr β)
+deriving DecidableEq
+
+structure Shape (β : Type u) where
+  universes : Nat
+  parameters : List (AExpr β)
+  indices : List (AExpr β)
+  level : VLevel
+  constructors : List (Constructor β)
+deriving DecidableEq
+
+variable {β : Type u}
+
+def parameterVars (offset : Nat) : Nat → List (AExpr β)
+  | 0 => []
+  | n + 1 => .bvar (offset + n) :: parameterVars offset n
+
+@[simp] theorem erase_parameterVars (offset count : Nat) :
+    (parameterVars (β := β) offset count).map AExpr.erase = VExpr.bvarRevRange offset count := by
+  induction count <;> simp_all [parameterVars, VExpr.bvarRevRange, AExpr.erase]
+
+def Shape.familyApp (shape : Shape β) (source : β) (offset : Nat)
+    (indices : List (AExpr β)) : AExpr β :=
+  .appN (.const (.member source 0) (VLevel.params shape.universes))
+    (parameterVars offset shape.parameters.length ++ indices)
+
+def Shape.type (shape : Shape β) : AExpr β :=
+  .forallN .never (shape.parameters ++ shape.indices) (.sort shape.level)
+
+def RecursiveField.type (field : RecursiveField β) (shape : Shape β)
+    (source : β) (ordinaryFields : Nat) : AExpr β :=
+  .forallN (zeroCondition shape.level) field.domains
+    (shape.familyApp source (ordinaryFields + field.domains.length) field.indices)
+
+def recursiveTypesFrom (shape : Shape β) (source : β) (ordinaryFields : Nat)
+    (fields : List (RecursiveField β)) (offset : Nat) : List (AExpr β) :=
+  (fields.zipIdx offset).map fun (field, previous) =>
+    (field.type shape source ordinaryFields).liftN previous
+
+def Constructor.recursiveTypes (ctor : Constructor β) (shape : Shape β) (source : β) : List (AExpr β) :=
+  recursiveTypesFrom shape source ctor.fields.length ctor.recursive 0
+
+def Constructor.type (ctor : Constructor β) (shape : Shape β) (source : β) : AExpr β :=
+  .forallN (zeroCondition shape.level) shape.parameters <|
+    .forallN (zeroCondition shape.level) ctor.fields <|
+      .forallN (zeroCondition shape.level) (ctor.recursiveTypes shape source) <|
+        shape.familyApp source (ctor.fields.length + ctor.recursive.length)
+          (ctor.indices.map (AExpr.liftN ctor.recursive.length ·))
+
+def Constructor.source (ctor : Constructor β) (shape : Shape β) (source : β) : Ctor β :=
+  ⟨shape.universes, shape.parameters.length, ctor.fields.length + ctor.recursive.length,
+    (ctor.type shape source).erase, .safe⟩
+
+def Shape.source (shape : Shape β) (source : β) : Const β :=
+  .induct shape.universes shape.parameters.length shape.indices.length shape.type.erase
+    (shape.constructors.map (Constructor.source · shape source)) .safe
+
+def Shape.references (shape : Shape β) (source : β) : List (ConstRef β) :=
+  .member source 0 :: (List.range shape.constructors.length).map (.ctor source 0 ·)
+
+def Shape.parameterContext (shape : Shape β) : Context β := Telescope.context [] shape.parameters
+
+def Constructor.context (ctor : Constructor β) (shape : Shape β) : Context β :=
+  Telescope.context shape.parameterContext ctor.fields
+
+def RecursiveEvidence (entries : Environment β) (shape : Shape β) (ctor : Constructor β)
+    (field : RecursiveField β) : Prop :=
+  (∀ e ∈ field.domains ++ field.indices, e.ReferencesIn entries) ∧
+  Telescope.Formed.{u,v} entries (ctor.context shape) field.domains ∧
+  TelescopeBound.{u,v} entries (ctor.context shape) field.domains (some shape.level) ∧
+  ArgumentsFit.{u,v} entries (Telescope.context (ctor.context shape) field.domains)
+    (Telescope.lift (ctor.fields.length + field.domains.length) shape.indices) field.indices
+
+def ConstructorEvidence (entries : Environment β) (shape : Shape β) (ctor : Constructor β) : Prop :=
+  (∀ e ∈ ctor.fields ++ ctor.indices, e.ReferencesIn entries) ∧
+  Telescope.Formed.{u,v} entries shape.parameterContext ctor.fields ∧
+  TelescopeBound.{u,v} entries shape.parameterContext ctor.fields (some shape.level) ∧
+  ArgumentsFit.{u,v} entries (ctor.context shape)
+    (Telescope.lift ctor.fields.length shape.indices) ctor.indices ∧
+  ∀ field ∈ ctor.recursive, RecursiveEvidence.{u,v} entries shape ctor field
+
+/-- This is checked shape/formation evidence, not an admitted environment or
+a premise asserting that an inductive has a model. -/
+structure CheckedShape (entries : Environment β) (store : Store β) (source : β)
+    (shape : Shape β) : Prop where
+  exactSource : store.blocks source = some ⟨[shape.source source]⟩
+  fresh : ∀ r ∈ shape.references source, entries r = none
+  references : ∀ e ∈ shape.parameters ++ shape.indices, e.ReferencesIn entries
+  scope : shape.type.Scope shape.universes 0
+  constructorScope : ∀ ctor ∈ shape.constructors, (ctor.type shape source).Scope shape.universes 0
+  parameters : Telescope.Formed.{u,v} entries [] shape.parameters
+  indices : Telescope.Formed.{u,v} entries shape.parameterContext shape.indices
+  constructors : ∀ ctor ∈ shape.constructors, ConstructorEvidence.{u,v} entries shape ctor
+
+structure RecursiveWitness (β : Type u) where
+  domains : List (DomainWitness β)
+  indices : List (TypingWitness β)
+
+structure ConstructorWitness (β : Type u) where
+  fields : List (DomainWitness β)
+  indices : List (TypingWitness β)
+  recursive : List (RecursiveWitness β)
+
+structure ShapeWitness (β : Type u) where
+  shape : Shape β
+  parameters : List (DomainWitness β)
+  indices : List (DomainWitness β)
+  constructors : List (ConstructorWitness β)
+
+variable [DecidableEq β]
+
+def checkRecursive (fuel : Nat) (entries : Environment β) (shape : Shape β)
+    (ctor : Constructor β) : (fields : List (RecursiveField β)) → List (RecursiveWitness β) →
+      Option (CheckedClaim.{u} (∀ field ∈ fields, RecursiveEvidence.{u,v} entries shape ctor field))
+  | [], [] => some ⟨by simp⟩
+  | field :: fields, witness :: witnesses =>
+    if hrefs : ∀ e ∈ field.domains ++ field.indices, e.ReferencesIn entries then do
+      let domains ← verifyTelescope.{u,v} fuel shape.universes entries (some shape.level)
+        (ctor.context shape) field.domains witness.domains
+      let indices ← verifyArguments.{u,v} fuel shape.universes entries
+        (Telescope.context (ctor.context shape) field.domains)
+        (Telescope.lift (ctor.fields.length + field.domains.length) shape.indices)
+        field.indices witness.indices
+      let rest ← checkRecursive fuel entries shape ctor fields witnesses
+      return ⟨by
+        intro field' hf
+        rcases List.mem_cons.mp hf with rfl | hf
+        · exact ⟨hrefs, domains.down.1, domains.down.2, indices.down⟩
+        · exact rest.down field' hf⟩
+    else none
+  | _, _ => none
+
+def checkConstructors (fuel : Nat) (entries : Environment β) (shape : Shape β) :
+    (ctors : List (Constructor β)) → List (ConstructorWitness β) →
+      Option (CheckedClaim.{u} (∀ ctor ∈ ctors, ConstructorEvidence.{u,v} entries shape ctor))
+  | [], [] => some ⟨by simp⟩
+  | ctor :: ctors, witness :: witnesses =>
+    if hrefs : ∀ e ∈ ctor.fields ++ ctor.indices, e.ReferencesIn entries then do
+      let fields ← verifyTelescope.{u,v} fuel shape.universes entries (some shape.level)
+        shape.parameterContext ctor.fields witness.fields
+      let indices ← verifyArguments.{u,v} fuel shape.universes entries (ctor.context shape)
+        (Telescope.lift ctor.fields.length shape.indices) ctor.indices witness.indices
+      let recursive ← checkRecursive fuel entries shape ctor ctor.recursive witness.recursive
+      let rest ← checkConstructors fuel entries shape ctors witnesses
+      return ⟨by
+        intro ctor' hc
+        rcases List.mem_cons.mp hc with rfl | hc
+        · exact ⟨hrefs, fields.down.1, fields.down.2, indices.down, recursive.down⟩
+        · exact rest.down ctor' hc⟩
+    else none
+  | _, _ => none
+
+def checkShape (fuel : Nat) (entries : Environment β) (store : Store β) (source : β)
+    (witness : ShapeWitness β) :
+    Option (CheckedClaim.{u} (CheckedShape.{u,v} entries store source witness.shape)) :=
+  let shape := witness.shape
+  if hs : store.blocks source = some ⟨[shape.source source]⟩ then
+    if hfresh : ∀ r ∈ shape.references source, entries r = none then
+      if hrefs : ∀ e ∈ shape.parameters ++ shape.indices, e.ReferencesIn entries then
+        if hscope : shape.type.Scope shape.universes 0 then
+          if hctors : ∀ ctor ∈ shape.constructors, (ctor.type shape source).Scope shape.universes 0 then do
+            let parameters ← verifyTelescope.{u,v} fuel shape.universes entries none []
+              shape.parameters witness.parameters
+            let indices ← verifyTelescope.{u,v} fuel shape.universes entries none
+              shape.parameterContext shape.indices witness.indices
+            let constructors ← checkConstructors fuel entries shape shape.constructors witness.constructors
+            return ⟨⟨hs, hfresh, hrefs, hscope, hctors,
+              parameters.down.1, indices.down.1, constructors.down⟩⟩
+          else none
+        else none
+      else none
+    else none
+  else none
+
+theorem checkShape_sound {fuel : Nat} {entries : Environment β} {store : Store β} {source : β}
+    {witness : ShapeWitness β} {result}
+    (_ : checkShape.{u,v} fuel entries store source witness = some result) :
+    CheckedShape.{u,v} entries store source witness.shape := result.down
+
+end Ix.Theory.Certified.Ordinary
diff --git a/Ix/Theory/Certified/Policy.lean b/Ix/Theory/Certified/Policy.lean
new file mode 100644
index 000000000..0b69e92aa
--- /dev/null
+++ b/Ix/Theory/Certified/Policy.lean
@@ -0,0 +1,131 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Annotated
+import Ix.Theory.Store
+
+/-!
+# Primitive identity and the initial declaration policy
+
+The profile admits ordinary safe definitions, theorems and opaque declarations
+only with a checked body. Initialization excludes object-language axioms;
+the separate standard admission branch realizes supported exact schemas. Empty-inductive
+primitives are selected by exact references and complete declaration shapes.
+This is the policy/reading layer; the semantic checker must validate each body
+before publishing a declaration as accepted.
+-/
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u
+variable {β : Type u}
+
+/-- The public configuration fixes these references. Diagnostic names and
+semantic equality cannot select primitives or identify authenticated bytes. -/
+structure PrimitiveSignature (β : Type u) where
+  falseType : ConstRef β
+  falseElim : ConstRef β
+  distinct : falseType ≠ falseElim
+  natType : Option (ConstRef β) := none
+
+namespace PrimitiveSignature
+
+def falseExpr (signature : PrimitiveSignature β) : VExpr β :=
+  .const signature.falseType []
+
+/-- `False.rec.{u} : (motive : False → Sort u) → (x : False) → motive x`. -/
+def falseElimType (signature : PrimitiveSignature β) : VExpr β :=
+  .forallE (.forallE signature.falseExpr (.sort (.param 0)))
+    (.forallE signature.falseExpr (.app (.bvar 1) (.bvar 0)))
+
+def falseDeclaration : Const β := .induct 0 0 0 (.sort .zero) [] .safe
+
+def falseElimDeclaration (signature : PrimitiveSignature β) : Const β :=
+  .recursor 1 0 0 1 0 signature.falseElimType [] false .safe
+
+/-- A decidable match on the whole declaration, including rule and constructor
+lists, safety, universe arity, and recursor counts. -/
+def validate [DecidableEq β] (signature : PrimitiveSignature β) (store : Store β) : Bool :=
+  store.lookup signature.falseType == some falseDeclaration &&
+    store.lookup signature.falseElim == some signature.falseElimDeclaration
+
+theorem validate_iff [DecidableEq β] (signature : PrimitiveSignature β) (store : Store β) :
+    signature.validate store = true ↔
+      store.lookup signature.falseType = some falseDeclaration ∧
+      store.lookup signature.falseElim = some signature.falseElimDeclaration := by
+  simp [validate]
+
+def rename (mapping : AddressEquiv β γ) (signature : PrimitiveSignature β) :
+    PrimitiveSignature γ where
+  falseType := signature.falseType.rename mapping
+  falseElim := signature.falseElim.rename mapping
+  distinct := fun h => signature.distinct (ConstRef.rename_injective mapping h)
+  natType := signature.natType.map (ConstRef.rename mapping)
+
+@[simp] theorem falseExpr_rename (mapping : AddressEquiv β γ)
+    (signature : PrimitiveSignature β) :
+    (signature.rename mapping).falseExpr = signature.falseExpr.rename mapping := rfl
+
+@[simp] theorem falseElimType_rename (mapping : AddressEquiv β γ)
+    (signature : PrimitiveSignature β) :
+    (signature.rename mapping).falseElimType = signature.falseElimType.rename mapping := rfl
+
+/-- The fixed annotation of the eliminator's type. The motive space is always
+a positive sort; the remaining binders follow the result universe parameter. -/
+def falseElimReading (signature : PrimitiveSignature β) : AExpr β :=
+  .forallE (.param 0)
+    (.forallE .never (.const signature.falseType []) (.sort (.param 0)))
+    (.forallE (.param 0) (.const signature.falseType []) (.app (.bvar 1) (.bvar 0)))
+
+@[simp] theorem erase_falseElimReading (signature : PrimitiveSignature β) :
+    signature.falseElimReading.erase = signature.falseElimType := rfl
+
+theorem falseElimReading_scoped (signature : PrimitiveSignature β) :
+    signature.falseElimReading.Scope 1 0 := by
+  simp [falseElimReading, AExpr.Scope, PropWhen.WF, PropWhen.param, VLevel.WF]
+
+end PrimitiveSignature
+
+/-- Data retained only after the declaration-kind and structural checks.
+The body has not yet passed the semantic type checker. -/
+structure DefinitionReading (β : Type u) where
+  universes : Nat
+  kind : DefKind
+  type : AExpr β
+  body : AExpr β
+  typeScope : type.Scope universes 0
+  bodyScope : body.Scope universes 0
+
+def DefinitionReading.erase (entry : DefinitionReading β) : Const β :=
+  .defn entry.universes entry.kind entry.type.erase entry.body.erase .safe
+
+/-- The definition-like declaration reading branch. Missing
+opaque bodies, arbitrary axioms, unsafe declarations, and unmodeled primitive
+kinds cannot acquire a successful reading through this function. -/
+def readDefinition? (source : Const β) (typeTree bodyTree : AnnotationTree) :
+    Option { entry : DefinitionReading β // entry.erase = source } :=
+  match source with
+  | .defn n kind type body .safe => do
+    let type' ← readAnnotations? n 0 type typeTree
+    let body' ← readAnnotations? n 0 body bodyTree
+    return ⟨⟨n, kind, type'.val, body'.val, type'.property.2, body'.property.2⟩,
+      by simp [DefinitionReading.erase, type'.property.1, body'.property.1]⟩
+  | _ => none
+
+theorem axiom_rejected (n : Nat) (type : VExpr β) (safety : Safety)
+    (typeTree bodyTree : AnnotationTree) :
+    readDefinition? (.axiom n type safety) typeTree bodyTree = none := rfl
+
+theorem unsafe_definition_rejected (n : Nat) (kind : DefKind) (type body : VExpr β)
+    (typeTree bodyTree : AnnotationTree) :
+    readDefinition? (.defn n kind type body .unsafe) typeTree bodyTree = none := rfl
+
+theorem partial_definition_rejected (n : Nat) (kind : DefKind) (type body : VExpr β)
+    (typeTree bodyTree : AnnotationTree) :
+    readDefinition? (.defn n kind type body .partial) typeTree bodyTree = none := rfl
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Prelude.lean b/Ix/Theory/Certified/Prelude.lean
new file mode 100644
index 000000000..6fb0fd351
--- /dev/null
+++ b/Ix/Theory/Certified/Prelude.lean
@@ -0,0 +1,247 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Policy
+import Ix.Theory.Model.Extension
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory Model.SetModel
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+namespace PrimitiveSignature
+
+variable (signature : PrimitiveSignature β)
+
+def falseEntry : ConstantEntry β := ⟨0, .sort .zero, none, [], []⟩
+def falseElimEntry : ConstantEntry β := ⟨1, signature.falseElimReading, none, [], []⟩
+
+def environment [DecidableEq β] : Environment β := fun r =>
+  if r = signature.falseType then some falseEntry
+  else if r = signature.falseElim then some signature.falseElimEntry
+  else none
+
+@[simp] theorem environment_false [DecidableEq β] :
+    signature.environment signature.falseType = some falseEntry := by
+  simp [environment]
+
+@[simp] theorem environment_falseElim [DecidableEq β] :
+    signature.environment signature.falseElim = some signature.falseElimEntry := by
+  simp [environment, Ne.symm signature.distinct]
+
+theorem environment_equations [DecidableEq β] {r : ConstRef β} {entry : ConstantEntry β}
+    (h : signature.environment r = some entry) : entry.equations = [] := by
+  unfold environment at h
+  split at h
+  · cases Option.some.inj h; rfl
+  · split at h
+    · cases Option.some.inj h; rfl
+    · contradiction
+
+def Present (entries : Environment β) : Prop :=
+  entries signature.falseType = some falseEntry ∧
+    entries signature.falseElim = some signature.falseElimEntry
+
+theorem environment_facts [DecidableEq β] {r : ConstRef β} {entry : ConstantEntry β}
+    (h : signature.environment r = some entry) : entry.facts = [] := by
+  unfold environment at h
+  split at h
+  · cases Option.some.inj h; rfl
+  · split at h
+    · cases Option.some.inj h; rfl
+    · contradiction
+
+theorem present_environment [DecidableEq β] : signature.Present signature.environment :=
+  ⟨signature.environment_false, signature.environment_falseElim⟩
+
+theorem Present.insert [DecidableEq β] {entries : Environment β} {r : ConstRef β}
+    {entry : ConstantEntry β} (h : signature.Present entries) (fresh : entries r = none) :
+    signature.Present (entries.insert r entry) :=
+  ⟨Environment.insert_old fresh h.1, Environment.insert_old fresh h.2⟩
+
+/-- Compatibility fixes primitive values in addition to declaration membership.
+In particular, membership in Prop cannot choose the meaning of False. -/
+structure Compatible (entries : Environment β) (constants : Assignment β V) : Prop where
+  realizes : Realizes constants entries
+  falseValue : ∀ levels, constants signature.falseType levels = empty
+  falseElimValue : ∀ levels,
+    constants signature.falseElim levels = Model.falseElimValue (levels.getD 0 0)
+
+theorem Compatible.extend {entries entries' : Environment β}
+    {constants constants' : Assignment β V}
+    (h : signature.Compatible entries constants) (present : signature.Present entries)
+    (hM : Realizes constants' entries')
+    (agree : Assignment.AgreesOn entries constants constants') :
+    signature.Compatible entries' constants' where
+  realizes := hM
+  falseValue levels := (agree _ _ present.1 levels).trans (h.falseValue levels)
+  falseElimValue levels := (agree _ _ present.2 levels).trans (h.falseElimValue levels)
+
+noncomputable def assignment [DecidableEq β] : Assignment β V := fun r levels =>
+  if r = signature.falseType then falseValue
+  else if r = signature.falseElim then falseElimValue (levels.getD 0 0)
+  else empty
+
+@[simp] theorem assignment_false [DecidableEq β] (levels : List Nat) :
+    signature.assignment signature.falseType levels = (empty : V) := by
+  simp [assignment, falseValue]
+
+@[simp] theorem assignment_falseElim [DecidableEq β] (levels : List Nat) :
+    signature.assignment signature.falseElim levels = (falseElimValue (levels.getD 0 0) : V) := by
+  simp [assignment, Ne.symm signature.distinct]
+
+theorem interp_falseElimReading (constants : Assignment β V)
+    (hfalse : constants signature.falseType [] = empty)
+    (levels : List Nat) (env : Nat → V) :
+    interp constants levels env signature.falseElimReading =
+      (Model.falseElimType (levels.getD 0 0) : V) := by
+  have hz : regime (.param 0) levels = 0 ↔ levels.getD 0 0 = 0 :=
+    regime_zeroCondition (.param 0) levels
+  simp only [falseElimReading, interp, List.map_nil, hfalse, regime_never,
+    VLevel.eval, Valuation.cons_succ, Valuation.cons_zero, Model.falseElimType]
+  have hdom : piR 1 (empty : V) (fun _ => univ (levels.getD 0 0)) =
+      piR (levels.getD 0 0 + 1) empty (fun _ => univ (levels.getD 0 0)) :=
+    piR_zero_agree (by simp) (fun _ _ => rfl)
+  rw [hdom]
+  apply piR_zero_agree hz
+  intro motive _
+  exact piR_zero_agree hz (fun _ _ => rfl)
+
+theorem wellDenoted_falseElimReading (constants : Assignment β V)
+    (hfalse : constants signature.falseType [] = empty)
+    (levels : List Nat) (env : Nat → V) :
+    WellDenoted constants levels env signature.falseElimReading := by
+  have hz : regime (.param 0) levels = 0 ↔ levels.getD 0 0 = 0 :=
+    regime_zeroCondition (.param 0) levels
+  simp only [falseElimReading, WellDenoted, interp, List.map_nil, hfalse,
+    regime_never, VLevel.eval, Valuation.cons_succ, Valuation.cons_zero]
+  refine ⟨⟨trivial, fun _ _ => trivial, levels.getD 0 0 + 1, by simp,
+    fun _ _ => univ_mem_univ _⟩, ?_, levels.getD 0 0, hz, ?_⟩
+  · intro motive _
+    exact ⟨trivial, fun x hx => (not_mem_empty x hx).elim, levels.getD 0 0, hz,
+      fun x hx => (not_mem_empty x hx).elim⟩
+  · intro motive _
+    have hpi := piR_mem_univ (V := V) (a := 0) (b := levels.getD 0 0)
+      (B := fun x => app motive x) (empty_mem_univ 0)
+      (fun x hx => (not_mem_empty x hx).elim)
+    rw [← piR_zero_agree hz (fun _ _ => rfl)] at hpi
+    have hi : VLevel.natIMax 0 (levels.getD 0 0) = levels.getD 0 0 := by
+      unfold VLevel.natIMax
+      split
+      · exact Eq.symm ‹_ = 0›
+      · exact Nat.zero_max _
+    simpa only [hi] using hpi
+
+/-- A produced interpretation of the fixed, two-entry prelude. All later
+declaration extensions must preserve these exact values. -/
+theorem realizes [DecidableEq β] :
+    Realizes (signature.assignment : Assignment β V) signature.environment := by
+  constructor
+  · intro r entry h levels _ env
+    unfold environment at h
+    split at h
+    next hr =>
+      cases Option.some.inj h
+      exact trivial
+    next hr =>
+      split at h
+      next he =>
+        cases Option.some.inj h
+        exact signature.wellDenoted_falseElimReading _ (signature.assignment_false []) levels env
+      next => contradiction
+  · intro r entry h levels _ env
+    unfold environment at h
+    split at h
+    next hr =>
+      subst r
+      cases Option.some.inj h
+      simpa only [assignment_false, falseEntry, interp, VLevel.eval] using
+        (empty_mem_univ 0 : (empty : V) ∈ˢ univ 0)
+    next hr =>
+      split at h
+      next he =>
+        subst r
+        cases Option.some.inj h
+        simp only [falseElimEntry, assignment_falseElim,
+          interp_falseElimReading _ _ (signature.assignment_false [])]
+        exact falseElimValue_mem _
+      next => contradiction
+  · intro r entry h body hb levels _ env
+    unfold environment at h
+    split at h
+    · cases Option.some.inj h; contradiction
+    · split at h
+      · cases Option.some.inj h; contradiction
+      · contradiction
+
+  · intro r entry h body hb levels _ env
+    unfold environment at h
+    split at h
+    · cases Option.some.inj h; contradiction
+    · split at h
+      · cases Option.some.inj h; contradiction
+      · contradiction
+
+  · intro r entry h equation he
+    simp only [signature.environment_equations h, List.not_mem_nil] at he
+
+  · intro r entry h fact hf
+    simp only [signature.environment_facts h, List.not_mem_nil] at hf
+
+theorem compatible_assignment [DecidableEq β] :
+    signature.Compatible signature.environment (signature.assignment : Assignment β V) :=
+  ⟨signature.realizes, signature.assignment_false, signature.assignment_falseElim⟩
+
+theorem environment_wf [DecidableEq β] : signature.environment.WF := by
+  have hrefs : signature.falseElimReading.ReferencesIn signature.environment := by
+    intro r hr
+    simp only [falseElimReading, AExpr.references, List.append_nil,
+      List.mem_append, List.mem_singleton, or_self] at hr
+    subst r
+    simp
+  constructor
+  · intro r entry h
+    unfold environment at h
+    split at h
+    · cases Option.some.inj h; exact trivial
+    · split at h
+      · cases Option.some.inj h; exact signature.falseElimReading_scoped
+      · contradiction
+  · intro r entry h body hb
+    unfold environment at h
+    split at h
+    · cases Option.some.inj h; contradiction
+    · split at h
+      · cases Option.some.inj h; contradiction
+      · contradiction
+  · intro r entry h
+    unfold environment at h
+    split at h
+    · cases Option.some.inj h
+      simp [falseEntry, AExpr.ReferencesIn, AExpr.references]
+    · split at h
+      · cases Option.some.inj h; exact hrefs
+      · contradiction
+  · intro r entry h body hb
+    unfold environment at h
+    split at h
+    · cases Option.some.inj h; contradiction
+    · split at h
+      · cases Option.some.inj h; contradiction
+      · contradiction
+  · intro r entry h equation he
+    simp only [signature.environment_equations h, List.not_mem_nil] at he
+  · intro r entry h equation he
+    simp only [signature.environment_equations h, List.not_mem_nil] at he
+  · intro r entry h fact hf
+    simp only [signature.environment_facts h, List.not_mem_nil] at hf
+  · intro r entry h fact hf
+    simp only [signature.environment_facts h, List.not_mem_nil] at hf
+
+end PrimitiveSignature
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/PropWhen.lean b/Ix/Theory/Certified/PropWhen.lean
new file mode 100644
index 000000000..0c164d66a
--- /dev/null
+++ b/Ix/Theory/Certified/PropWhen.lean
@@ -0,0 +1,330 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.VLevel
+
+/-!
+# Checked zero conditions for anonymous universe parameters
+
+A condition is either never true or says that a finite set of parameter
+indices are all zero. Strictly increasing lists give one representation for
+each finite set. The empty set is the condition that always holds.
+
+These conditions describe only whether a level is zero. They do not identify
+levels: for example, `Sort 1` and `Sort 2` both have condition `never`.
+The decoder checks bounds independently, including for conditions that are
+always false. Level well-formedness must also be checked on the source level.
+-/
+
+namespace Ix.Theory.Certified
+
+namespace IndexSet
+
+def insert (x : Nat) : List Nat → List Nat
+  | [] => [x]
+  | y :: ys =>
+    if x < y then x :: y :: ys
+    else if x = y then y :: ys
+    else y :: insert x ys
+
+@[simp] theorem mem_insert {z x : Nat} {xs : List Nat} :
+    z ∈ insert x xs ↔ z = x ∨ z ∈ xs := by
+  induction xs with
+  | nil => simp [insert]
+  | cons y ys ih =>
+    simp only [insert]
+    split
+    · simp
+    · split
+      · subst x; simp
+      · simp only [List.mem_cons, ih, or_left_comm]
+
+theorem sorted_insert {x : Nat} {xs : List Nat}
+    (h : xs.Pairwise (· < ·)) : (insert x xs).Pairwise (· < ·) := by
+  induction xs with
+  | nil => simp [insert]
+  | cons y ys ih =>
+    obtain ⟨hy, hs⟩ := List.pairwise_cons.mp h
+    simp only [insert]
+    split
+    next hxy =>
+      apply List.pairwise_cons.mpr
+      exact ⟨fun z hz => (List.mem_cons.mp hz).elim (fun e => e ▸ hxy)
+        (fun hz => Nat.lt_trans hxy (hy z hz)), h⟩
+    next hxy =>
+      split
+      · exact h
+      next hne =>
+        apply List.pairwise_cons.mpr
+        refine ⟨?_, ih hs⟩
+        intro z hz
+        rcases mem_insert.mp hz with rfl | hz
+        · omega
+        · exact hy z hz
+
+def normalize : List Nat → List Nat
+  | [] => []
+  | x :: xs => insert x (normalize xs)
+
+@[simp] theorem mem_normalize {z : Nat} {xs : List Nat} :
+    z ∈ normalize xs ↔ z ∈ xs := by
+  induction xs <;> simp [normalize, *]
+
+theorem sorted_normalize (xs : List Nat) : (normalize xs).Pairwise (· < ·) := by
+  induction xs with
+  | nil => exact .nil
+  | cons x xs ih => exact sorted_insert ih
+
+/-- Equality of increasing lists is determined by their members. -/
+theorem eq_of_members {xs ys : List Nat}
+    (hx : xs.Pairwise (· < ·)) (hy : ys.Pairwise (· < ·))
+    (hm : ∀ i, i ∈ xs ↔ i ∈ ys) : xs = ys := by
+  induction xs generalizing ys with
+  | nil =>
+    symm
+    exact List.eq_nil_iff_forall_not_mem.mpr fun i hi => by simpa using (hm i).mpr hi
+  | cons x xs ih =>
+    cases ys with
+    | nil => simpa using (hm x).mp (List.mem_cons_self ..)
+    | cons y ys =>
+      obtain ⟨hxmin, hxs⟩ := List.pairwise_cons.mp hx
+      obtain ⟨hymin, hys⟩ := List.pairwise_cons.mp hy
+      have hxy : x = y := by
+        have hxmem := (hm x).mp (List.mem_cons_self ..)
+        have hymem := (hm y).mpr (List.mem_cons_self ..)
+        simp only [List.mem_cons] at hxmem hymem
+        rcases hxmem with h | h
+        · exact h
+        rcases hymem with h' | h'
+        · exact h'.symm
+        have := hxmin y h'
+        have := hymin x h
+        omega
+      subst y
+      congr 1
+      apply ih hxs hys
+      intro i
+      have hxi : i ∈ xs → i ≠ x := fun hi e => by
+        have := hxmin i hi
+        omega
+      have hyi : i ∈ ys → i ≠ x := fun hi e => by
+        have := hymin i hi
+        omega
+      specialize hm i
+      simp only [List.mem_cons] at hm
+      by_cases hie : i = x
+      · subst i; simp_all
+      · simpa [hie] using hm
+
+end IndexSet
+
+inductive PropWhen where
+  | never
+  | allZero (params : List Nat) (sorted : params.Pairwise (· < ·))
+deriving DecidableEq, Repr
+
+namespace PropWhen
+
+def always : PropWhen := .allZero [] .nil
+
+def ofList (params : List Nat) : PropWhen :=
+  .allZero (IndexSet.normalize params) (IndexSet.sorted_normalize params)
+
+def param (i : Nat) : PropWhen := .allZero [i] (by simp)
+
+def toRaw : PropWhen → Option (List Nat)
+  | .never => none
+  | .allZero ps _ => some ps
+
+theorem toRaw_injective {p q : PropWhen} (h : p.toRaw = q.toRaw) : p = q := by
+  cases p <;> cases q <;> simp_all [toRaw]
+
+def holds (valuation : Nat → Nat) : PropWhen → Bool
+  | .never => false
+  | .allZero ps _ => ps.all (valuation · == 0)
+
+@[simp] theorem holds_never (v : Nat → Nat) : holds v .never = false := rfl
+
+@[simp] theorem holds_always (v : Nat → Nat) : holds v always = true := rfl
+
+@[simp] theorem holds_param (v : Nat → Nat) (i : Nat) :
+    holds v (param i) = (v i == 0) := by simp [holds, param]
+
+@[simp] theorem holds_ofList (v : Nat → Nat) (ps : List Nat) :
+    holds v (ofList ps) = ps.all (v · == 0) := by
+  apply Bool.eq_iff_iff.mpr
+  simp [holds, ofList, List.all_eq_true]
+
+private theorem holds_separator (ps : List Nat) (hs : ps.Pairwise (· < ·)) (i : Nat) :
+    holds (fun j => if j = i then 1 else 0) (.allZero ps hs) = decide (i ∉ ps) := by
+  apply Bool.eq_iff_iff.mpr
+  simp only [holds, List.all_eq_true, beq_iff_eq, decide_eq_true_eq]
+  constructor
+  · intro h hi
+    have := h i hi
+    simp at this
+  · intro h j hj
+    have hji : j ≠ i := fun e => h (e ▸ hj)
+    simp [hji]
+
+/-- The representation is canonical, including the distinction between
+`never` and a nonempty set of zero requirements. -/
+theorem eq_of_holds {p q : PropWhen}
+    (h : ∀ v : Nat → Nat, holds v p = holds v q) : p = q := by
+  cases p with
+  | never =>
+    cases q with
+    | never => rfl
+    | allZero qs hq => simpa [holds] using h (fun _ => 0)
+  | allZero ps hp =>
+    cases q with
+    | never => simpa [holds] using h (fun _ => 0)
+    | allZero qs hq =>
+      have hm : ∀ i, i ∈ ps ↔ i ∈ qs := by
+        intro i
+        have hi := h (fun j => if j = i then 1 else 0)
+        rw [holds_separator, holds_separator] at hi
+        have hn : i ∉ ps ↔ i ∉ qs := by simpa using Bool.eq_iff_iff.mp hi
+        by_cases hp' : i ∈ ps <;> by_cases hq' : i ∈ qs <;> simp_all
+      have := IndexSet.eq_of_members hp hq hm
+      subst qs
+      rfl
+
+theorem eq_iff_holds (p q : PropWhen) :
+    p = q ↔ ∀ v : Nat → Nat, holds v p = holds v q :=
+  ⟨fun h _ => h ▸ rfl, eq_of_holds⟩
+
+/-- All named parameters are in scope; this is separate from the zero test. -/
+def WF (n : Nat) : PropWhen → Prop
+  | .never => True
+  | .allZero ps _ => ∀ i ∈ ps, i < n
+
+instance {n : Nat} {p : PropWhen} : Decidable (WF n p) := by
+  cases p <;> unfold WF <;> infer_instance
+
+/-- Decode the canonical representation. Malformed ordering and out-of-range
+indices are rejected, rather than silently normalized or defaulted to zero. -/
+def fromRaw? (n : Nat) : Option (List Nat) → Option PropWhen
+  | none => some .never
+  | some ps =>
+    if hs : ps.Pairwise (· < ·) then
+      if ∀ i ∈ ps, i < n then some (.allZero ps hs) else none
+    else none
+
+theorem fromRaw?_sound {n : Nat} {raw : Option (List Nat)} {p : PropWhen}
+    (h : fromRaw? n raw = some p) : p.toRaw = raw ∧ p.WF n := by
+  cases raw with
+  | none => simp [fromRaw?] at h; subst p; simp [toRaw, WF]
+  | some ps =>
+    simp only [fromRaw?] at h
+    split at h
+    · split at h
+      next hb => cases h; exact ⟨rfl, hb⟩
+      · contradiction
+    · contradiction
+
+theorem fromRaw?_complete {n : Nat} {p : PropWhen} (h : p.WF n) :
+    fromRaw? n p.toRaw = some p := by
+  cases p with
+  | never => rfl
+  | allZero ps hs => simp_all [fromRaw?, toRaw, WF]
+
+def inter : PropWhen → PropWhen → PropWhen
+  | .allZero ps _, .allZero qs _ => ofList (ps ++ qs)
+  | _, _ => .never
+
+@[simp] theorem holds_inter (v : Nat → Nat) (p q : PropWhen) :
+    holds v (inter p q) = (holds v p && holds v q) := by
+  apply Bool.eq_iff_iff.mpr
+  cases p <;> cases q <;>
+    simp [inter, holds, ofList, List.all_eq_true, or_imp, forall_and]
+
+theorem inter_comm (p q : PropWhen) : inter p q = inter q p := by
+  apply eq_of_holds; intro v; simp [Bool.and_comm]
+
+theorem inter_assoc (p q r : PropWhen) : inter (inter p q) r = inter p (inter q r) := by
+  apply eq_of_holds; intro v; simp [Bool.and_assoc]
+
+@[simp] theorem inter_always (p : PropWhen) : inter p always = p := by
+  apply eq_of_holds; intro v; simp
+
+@[simp] theorem always_inter (p : PropWhen) : inter always p = p := by
+  rw [inter_comm, inter_always]
+
+@[simp] theorem inter_self (p : PropWhen) : inter p p = p := by
+  apply eq_of_holds; intro v; simp
+
+theorem WF.inter {n : Nat} {p q : PropWhen} (hp : p.WF n) (hq : q.WF n) :
+    (p.inter q).WF n := by
+  cases p <;> cases q <;>
+    simp_all [PropWhen.inter, ofList, PropWhen.WF, or_imp]
+
+def bindList (f : Nat → PropWhen) : List Nat → PropWhen
+  | [] => always
+  | i :: ps => inter (f i) (bindList f ps)
+
+def bind (f : Nat → PropWhen) : PropWhen → PropWhen
+  | .never => .never
+  | .allZero ps _ => bindList f ps
+
+theorem holds_bindList (v : Nat → Nat) (f : Nat → PropWhen) (ps : List Nat) :
+    holds v (bindList f ps) = ps.all (fun i => holds v (f i)) := by
+  induction ps <;> simp [bindList, *]
+
+theorem holds_bind (v : Nat → Nat) (f : Nat → PropWhen) (p : PropWhen) :
+    holds v (bind f p) = holds (fun i => if holds v (f i) then 0 else 1) p := by
+  cases p with
+  | never => rfl
+  | allZero ps hs =>
+    change holds v (bindList f ps) =
+      ps.all (fun i => (if holds v (f i) then 0 else 1) == 0)
+    rw [holds_bindList]
+    apply List.all_congr rfl
+    intro i
+    cases holds v (f i) <;> rfl
+
+theorem holds_bind_of (v w : Nat → Nat) (f : Nat → PropWhen) (p : PropWhen)
+    (h : ∀ i, holds v (f i) = (w i == 0)) : holds v (bind f p) = holds w p := by
+  cases p with
+  | never => rfl
+  | allZero ps hs =>
+    change holds v (bindList f ps) = ps.all (w · == 0)
+    rw [holds_bindList]
+    exact List.all_congr rfl h
+
+@[simp] theorem bind_never (f : Nat → PropWhen) : bind f .never = .never := rfl
+
+@[simp] theorem bind_always (f : Nat → PropWhen) : bind f always = always := rfl
+
+@[simp] theorem bind_param (f : Nat → PropWhen) (i : Nat) : bind f (param i) = f i := by
+  simp [bind, param, bindList]
+
+theorem bind_inter (f : Nat → PropWhen) (p q : PropWhen) :
+    bind f (inter p q) = inter (bind f p) (bind f q) := by
+  apply eq_of_holds
+  intro v
+  simp only [holds_bind, holds_inter]
+
+@[simp] theorem bind_id (p : PropWhen) : bind param p = p := by
+  apply eq_of_holds
+  intro v
+  exact holds_bind_of v v param p (fun i => holds_param v i)
+
+theorem bindList_wf {n : Nat} {f : Nat → PropWhen} {ps : List Nat}
+    (h : ∀ i ∈ ps, (f i).WF n) : (bindList f ps).WF n := by
+  induction ps with
+  | nil => simp [bindList, always, WF]
+  | cons i ps ih =>
+    exact WF.inter (h i (by simp)) (ih fun j hj => h j (by simp [hj]))
+
+theorem WF.bind {n k : Nat} {f : Nat → PropWhen} {p : PropWhen}
+    (hp : p.WF k) (h : ∀ i, i < k → (f i).WF n) : (bind f p).WF n := by
+  cases p with
+  | never => trivial
+  | allZero ps hs => exact bindList_wf fun i hi => h i (hp i hi)
+
+end PropWhen
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Quotient/Admission.lean b/Ix/Theory/Certified/Quotient/Admission.lean
new file mode 100644
index 000000000..3359186dc
--- /dev/null
+++ b/Ix/Theory/Certified/Quotient/Admission.lean
@@ -0,0 +1,57 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Admission
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Publish the exact quotient primitive package only after all source and
+formation checks. Its values and computation laws are produced internally. -/
+def checkQuotientExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : Quotient.Witness β) :
+    Option (CheckedExtension.{u,v} signature store state) := do
+  let checked ← Quotient.check.{u,v} fuel state.entries store witness
+  let refs := witness.refs
+  have extension : Extends.{u,v} signature state.entries (refs.environment state.entries) := by
+    constructor
+    · exact fun _ _ h => Quotient.environment_old checked.down h
+    · intro V _ constants hM
+      let constants' := refs.assignment constants
+      have ha := Quotient.assignment_agrees checked.down constants
+      have hm := Quotient.assignment_realizes checked.down state.wf constants hM.realizes
+      exact ⟨constants', hM.extend signature state.present hm ha, ha⟩
+  let result : CheckedInterface signature := {
+    entries := refs.environment state.entries
+    wf := Quotient.environment_wf checked.down state.wf
+    present := ⟨extension.lookup _ _ state.present.1, extension.lookup _ _ state.present.2⟩
+  }
+  return {
+    result, extension
+    source := by
+      intro r entry hr
+      dsimp only [result] at hr
+      rcases Quotient.environment_source checked.down hr with hold | hnew
+      · exact Or.inl hold
+      · exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inl hnew))))))
+  }
+
+def admitQuotient? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : Quotient.Witness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkQuotientExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+theorem admitQuotient?_extends {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {state : AdmittedEnvironment.{u,v} signature store} {witness : Quotient.Witness β} {result}
+    (_ : admitQuotient? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Quotient/Checked.lean b/Ix/Theory/Certified/Quotient/Checked.lean
new file mode 100644
index 000000000..4179e66a5
--- /dev/null
+++ b/Ix/Theory/Certified/Quotient/Checked.lean
@@ -0,0 +1,179 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Quotient.Reading
+import Ix.Theory.Certified.Signature
+
+namespace Ix.Theory.Certified.Quotient
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+theorem mem_kinds (kind : Kind) : kind ∈ kinds := by cases kind <;> simp [kinds]
+
+def Refs.header (refs : Refs β) (kind : Kind) : Signature.Header β :=
+  ⟨refs.ref kind, kind.universes, refs.entryType kind⟩
+
+def Refs.headers (refs : Refs β) : List (Signature.Header β) := kinds.map refs.header
+
+def Refs.typeEnvironment (refs : Refs β) (entries : Environment β) : Environment β :=
+  Signature.environment entries refs.headers
+
+def Refs.liftRule (refs : Refs β) : Signature.Rule β :=
+  ⟨2, liftRuleType refs, liftRuleLhs refs, liftRuleRhs refs⟩
+
+def Refs.indRule (refs : Refs β) : Signature.Rule β :=
+  ⟨1, indRuleType refs, indRuleLhs refs, indRuleRhs refs⟩
+
+def Refs.ExactSource (refs : Refs β) (store : Store β) : Prop :=
+  ∀ kind ∈ kinds, store.lookup (refs.ref kind) = some (refs.source kind)
+
+def Refs.Fresh (refs : Refs β) (entries : Environment β) : Prop :=
+  ∀ kind ∈ kinds, entries (refs.ref kind) = none
+
+instance (refs : Refs β) (store : Store β) : Decidable (refs.ExactSource store) :=
+  inferInstanceAs (Decidable (∀ kind ∈ kinds, store.lookup (refs.ref kind) = some (refs.source kind)))
+
+instance (refs : Refs β) (entries : Environment β) : Decidable (refs.Fresh entries) :=
+  inferInstanceAs (Decidable (∀ kind ∈ kinds, entries (refs.ref kind) = none))
+
+structure Witness (β : Type u) where
+  refs : Refs β
+  types : List (Signature.TypeWitness β)
+  liftRule : Signature.RuleWitness β
+  indRule : Signature.RuleWitness β
+
+structure Checked (entries : Environment β) (store : Store β) (refs : Refs β) : Prop where
+  exactSource : refs.ExactSource store
+  fresh : refs.Fresh entries
+  equality : Basis.Equality.Interface entries refs.eq refs.eqRefl refs.eqRec
+  types : Signature.Formed.{u,v} entries refs.headers
+  liftRule : Signature.RuleFormed.{u,v} (refs.typeEnvironment entries) refs.liftRule
+  indRule : Signature.RuleFormed.{u,v} (refs.typeEnvironment entries) refs.indRule
+
+def check (fuel : Nat) (entries : Environment β) (store : Store β) (witness : Witness β) :
+    Option (CheckedClaim.{u} (Checked.{u,v} entries store witness.refs)) :=
+  if hs : witness.refs.ExactSource store then
+    if hf : witness.refs.Fresh entries then
+      if he : Basis.Equality.Interface entries witness.refs.eq witness.refs.eqRefl witness.refs.eqRec then do
+        let ht ← Signature.checkTypes.{u,v} fuel entries witness.refs.headers witness.types
+        let hl ← Signature.checkRule.{u,v} fuel (witness.refs.typeEnvironment entries) witness.refs.liftRule witness.liftRule
+        let hi ← Signature.checkRule.{u,v} fuel (witness.refs.typeEnvironment entries) witness.refs.indRule witness.indRule
+        return ⟨⟨hs, hf, he, ht.down, hl.down, hi.down⟩⟩
+      else none
+    else none
+  else none
+
+theorem check_sound {fuel : Nat} {entries : Environment β} {store : Store β} {witness : Witness β}
+    {result} (_ : check.{u,v} fuel entries store witness = some result) :
+    Checked.{u,v} entries store witness.refs := result.down
+
+omit [DecidableEq β] in
+theorem Refs.ExactSource.injective {refs : Refs β} {store : Store β} (h : refs.ExactSource store) :
+    Function.Injective refs.ref := by
+  intro a b he
+  have ha := h a (mem_kinds a)
+  have hb := h b (mem_kinds b)
+  rw [he, hb] at ha
+  have hs := Option.some.inj ha
+  cases a <;> cases b <;> simp [Refs.source] at hs <;> rfl
+
+def Refs.kind? (refs : Refs β) (r : ConstRef β) : Option Kind :=
+  if r = refs.type then some .type else
+  if r = refs.ctor then some .ctor else
+  if r = refs.lift then some .lift else
+  if r = refs.ind then some .ind else
+  if r = refs.sound then some .sound else none
+
+theorem Refs.kind?_same {refs : Refs β} {store : Store β} (h : refs.ExactSource store) (kind : Kind) :
+    refs.kind? (refs.ref kind) = some kind := by
+  have he (a b : Kind) (hne : a ≠ b) : refs.ref a ≠ refs.ref b := fun hab => hne (h.injective hab)
+  have ht := he .ctor .type (by decide)
+  have hlt := he .lift .type (by decide)
+  have hlc := he .lift .ctor (by decide)
+  have hit := he .ind .type (by decide)
+  have hic := he .ind .ctor (by decide)
+  have hil := he .ind .lift (by decide)
+  have hst := he .sound .type (by decide)
+  have hsc := he .sound .ctor (by decide)
+  have hsl := he .sound .lift (by decide)
+  have hsi := he .sound .ind (by decide)
+  cases kind <;> simp_all [Refs.kind?, Refs.ref]
+
+theorem Refs.kind?_sound {refs : Refs β} {r : ConstRef β} {kind : Kind}
+    (h : refs.kind? r = some kind) : r = refs.ref kind := by
+  unfold Refs.kind? at h
+  split at h
+  · cases Option.some.inj h; assumption
+  · split at h
+    · cases Option.some.inj h; assumption
+    · split at h
+      · cases Option.some.inj h; assumption
+      · split at h
+        · cases Option.some.inj h; assumption
+        · split at h
+          · cases Option.some.inj h; assumption
+          · contradiction
+
+variable {entries : Environment β} {store : Store β} {refs : Refs β}
+
+theorem typeEnvironment_lookup (h : Checked.{u,v} entries store refs) (kind : Kind) :
+    refs.typeEnvironment entries (refs.ref kind) = some (refs.header kind).entry :=
+  h.types.lookup (List.mem_map.mpr ⟨kind, mem_kinds kind, rfl⟩)
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def Refs.assignment (refs : Refs β) (constants : Assignment β V) : Assignment β V :=
+  fun r levels => match refs.kind? r with
+    | some kind => refs.value constants kind levels
+    | none => constants r levels
+
+theorem assignment_same (h : Checked.{u,v} entries store refs) (constants : Assignment β V)
+    (kind : Kind) (levels : List Nat) :
+    refs.assignment constants (refs.ref kind) levels = refs.value constants kind levels := by
+  simp only [Refs.assignment, Refs.kind?_same h.exactSource]
+
+theorem assignment_agrees (h : Checked.{u,v} entries store refs) (constants : Assignment β V) :
+    Assignment.AgreesOn entries constants (refs.assignment constants) := by
+  intro r entry hr levels
+  unfold Refs.assignment
+  cases hk : refs.kind? r with
+  | none => rfl
+  | some kind =>
+    have he := Refs.kind?_sound hk
+    have hf := h.fresh kind (mem_kinds kind)
+    rw [← he, hr] at hf
+    contradiction
+
+theorem assignment_reading (h : Checked.{u,v} entries store refs) (constants : Assignment β V) :
+    Reading (refs.assignment constants) refs := by
+  have heq (levels) : refs.assignment constants refs.eq levels = constants refs.eq levels := by
+    obtain ⟨entry, he, _, _⟩ := h.equality.former
+    exact assignment_agrees h constants _ _ he levels
+  constructor
+  · intro u
+    exact assignment_same h constants .type [u]
+  · intro u
+    exact assignment_same h constants .ctor [u]
+  · intro u v
+    rw [show refs.lift = refs.ref .lift from rfl, assignment_same h constants]
+    simp [Refs.value, liftValue, invariantSet, Basis.Equality.value, heq]
+  · intro u
+    exact assignment_same h constants .ind [u]
+  · intro u
+    exact assignment_same h constants .sound [u]
+
+theorem typeAssignment_realizes (h : Checked.{u,v} entries store refs) (hE : entries.WF)
+    (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (refs.assignment constants) (refs.typeEnvironment entries) := by
+  have hm := hM.of_agrees hE (assignment_agrees h constants)
+  apply h.types.realizes hm
+  intro header hh levels hn env
+  obtain ⟨kind, _, rfl⟩ := List.mem_map.mp hh
+  exact value_mem (assignment_reading h constants) h.equality hm kind levels hn env
+
+end Ix.Theory.Certified.Quotient
diff --git a/Ix/Theory/Certified/Quotient/Publish.lean b/Ix/Theory/Certified/Quotient/Publish.lean
new file mode 100644
index 000000000..938df6a02
--- /dev/null
+++ b/Ix/Theory/Certified/Quotient/Publish.lean
@@ -0,0 +1,195 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Quotient.Checked
+
+namespace Ix.Theory.Certified.Quotient
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def Refs.environment (refs : Refs β) (entries : Environment β) : Environment β :=
+  fun r => match refs.kind? r with
+    | some kind => some (refs.entry kind)
+    | none => entries r
+
+variable {entries : Environment β} {store : Store β} {refs : Refs β}
+
+theorem environment_same (h : Checked.{u,v} entries store refs) (kind : Kind) :
+    refs.environment entries (refs.ref kind) = some (refs.entry kind) := by
+  simp only [Refs.environment, Refs.kind?_same h.exactSource]
+
+theorem environment_old (h : Checked.{u,v} entries store refs) {r : ConstRef β}
+    {entry : ConstantEntry β} (hr : entries r = some entry) : refs.environment entries r = some entry := by
+  unfold Refs.environment
+  cases hk : refs.kind? r with
+  | none => exact hr
+  | some kind =>
+    have he := Refs.kind?_sound hk
+    have hf := h.fresh kind (mem_kinds kind)
+    rw [← he, hr] at hf
+    contradiction
+
+theorem environment_cases {r : ConstRef β} {entry : ConstantEntry β}
+    (hr : refs.environment entries r = some entry) :
+    entries r = some entry ∨ ∃ kind, r = refs.ref kind ∧ entry = refs.entry kind := by
+  unfold Refs.environment at hr
+  split at hr
+  · exact Or.inr ⟨_, Refs.kind?_sound ‹_›, (Option.some.inj hr).symm⟩
+  · exact Or.inl hr
+
+theorem environment_covers_types (h : Checked.{u,v} entries store refs) {r : ConstRef β}
+    {entry : ConstantEntry β} (hr : refs.typeEnvironment entries r = some entry) :
+    (refs.environment entries r).isSome := by
+  rcases Signature.environment_source hr with hold | ⟨header, hm, he, _⟩
+  · simp only [environment_old h hold, Option.isSome_some]
+  · obtain ⟨kind, _, rfl⟩ := List.mem_map.mp hm
+    subst r
+    simp only [Refs.header, environment_same h, Option.isSome_some]
+
+theorem references_from_types (h : Checked.{u,v} entries store refs) {e : AExpr β}
+    (hr : e.ReferencesIn (refs.typeEnvironment entries)) : e.ReferencesIn (refs.environment entries) := by
+  intro r he
+  have hh := hr r he
+  cases ht : refs.typeEnvironment entries r with
+  | none => simp [ht] at hh
+  | some entry => exact environment_covers_types h ht
+
+theorem references_from_old (h : Checked.{u,v} entries store refs) {e : AExpr β}
+    (hr : e.ReferencesIn entries) : e.ReferencesIn (refs.environment entries) := by
+  intro r he
+  have hh := hr r he
+  cases ht : entries r with
+  | none => simp [ht] at hh
+  | some entry => simp only [environment_old h ht, Option.isSome_some]
+
+theorem fact_references_from_old (h : Checked.{u,v} entries store refs) {fact : ConstantFact β}
+    (hr : fact.ReferencesIn entries) : fact.ReferencesIn (refs.environment entries) := by
+  intro r he
+  have hh := hr r he
+  cases ht : entries r with
+  | none => simp [ht] at hh
+  | some entry => simp only [environment_old h ht, Option.isSome_some]
+
+theorem equation_scope (h : Checked.{u,v} entries store refs) (kind : Kind)
+    {law : ConstantEquation β} (hl : law ∈ refs.equations kind) :
+    law.lhs.Scope kind.universes 0 ∧ law.rhs.Scope kind.universes 0 := by
+  cases kind with
+  | type | ctor | sound => cases hl
+  | lift =>
+    have he := List.mem_singleton.mp hl
+    subst law
+    exact h.liftRule.scope.2
+  | ind =>
+    have he := List.mem_singleton.mp hl
+    subst law
+    exact h.indRule.scope.2
+
+theorem equation_references (h : Checked.{u,v} entries store refs) (kind : Kind)
+    {law : ConstantEquation β} (hl : law ∈ refs.equations kind) :
+    law.lhs.ReferencesIn (refs.environment entries) ∧ law.rhs.ReferencesIn (refs.environment entries) := by
+  cases kind with
+  | type | ctor | sound => cases hl
+  | lift =>
+    have he := List.mem_singleton.mp hl
+    subst law
+    exact ⟨references_from_types h h.liftRule.references.2.1, references_from_types h h.liftRule.references.2.2⟩
+  | ind =>
+    have he := List.mem_singleton.mp hl
+    subst law
+    exact ⟨references_from_types h h.indRule.references.2.1, references_from_types h h.indRule.references.2.2⟩
+
+theorem entry_closed (h : Checked.{u,v} entries store refs) (hE : entries.WF) (kind : Kind) :
+    EntryClosed (refs.environment entries) (refs.entry kind) := by
+  have ht := h.types.wf hE
+  have hl := typeEnvironment_lookup h kind
+  constructor
+  · exact ht.typeScope _ (refs.header kind).entry hl
+  · intro body hb; cases hb
+  · exact references_from_types h (ht.typeReferences _ (refs.header kind).entry hl)
+  · intro body hb; cases hb
+  · exact fun _ hh => equation_scope h kind hh
+  · exact fun _ hh => equation_references h kind hh
+  · intro fact hf; cases hf
+  · intro fact hf; cases hf
+
+theorem environment_wf (h : Checked.{u,v} entries store refs) (hE : entries.WF) :
+    (refs.environment entries).WF := by
+  have hc : ∀ r entry, refs.environment entries r = some entry → EntryClosed (refs.environment entries) entry := by
+    intro r entry hr
+    rcases environment_cases hr with hold | ⟨kind, _, rfl⟩
+    · exact ⟨hE.typeScope _ _ hold, hE.bodyScope _ _ hold,
+        references_from_old h (hE.typeReferences _ _ hold),
+        fun body hb => references_from_old h (hE.bodyReferences _ _ hold body hb),
+        hE.equationScope _ _ hold,
+        fun law hl => ⟨references_from_old h (hE.equationReferences _ _ hold law hl).1,
+          references_from_old h (hE.equationReferences _ _ hold law hl).2⟩,
+        hE.factScope _ _ hold,
+        fun fact hf => fact_references_from_old h (hE.factReferences _ _ hold fact hf)⟩
+    · exact entry_closed h hE kind
+  exact ⟨fun r e hr => (hc r e hr).typeScope, fun r e hr => (hc r e hr).bodyScope,
+    fun r e hr => (hc r e hr).typeReferences, fun r e hr => (hc r e hr).bodyReferences,
+    fun r e hr => (hc r e hr).equationScope, fun r e hr => (hc r e hr).equationReferences,
+    fun r e hr => (hc r e hr).factScope, fun r e hr => (hc r e hr).factReferences⟩
+
+/-- The exact five source declarations, including the safe soundness axiom,
+determine each published type and computation equation. -/
+def EntrySource (store : Store β) (r : ConstRef β) (entry : ConstantEntry β) : Prop :=
+  ∃ refs : Refs β, ∃ kind, refs.ExactSource store ∧ r = refs.ref kind ∧ entry = refs.entry kind
+
+theorem environment_source (h : Checked.{u,v} entries store refs) {r : ConstRef β} {entry : ConstantEntry β}
+    (hr : refs.environment entries r = some entry) : entries r = some entry ∨ EntrySource store r entry := by
+  rcases environment_cases hr with hold | ⟨kind, he, hv⟩
+  · exact Or.inl hold
+  · exact Or.inr ⟨refs, kind, h.exactSource, he, hv⟩
+
+variable {V : Type v} [SetTheory V]
+
+theorem equation_value (h : Checked.{u,v} entries store refs) (hE : entries.WF)
+    (constants : Assignment β V) (hM : Realizes constants entries) (kind : Kind)
+    {law : ConstantEquation β} (hl : law ∈ refs.equations kind)
+    (levels : List Nat) (hn : levels.length = kind.universes) (env : Nat → V) :
+    interp (refs.assignment constants) levels env law.lhs = interp (refs.assignment constants) levels env law.rhs := by
+  cases kind with
+  | type | ctor | sound => cases hl
+  | lift =>
+    have he := List.mem_singleton.mp hl
+    subst law
+    cases levels with
+    | nil => cases hn
+    | cons u tail =>
+      obtain ⟨v, rfl⟩ := List.length_eq_one_iff.mp (Nat.succ.inj hn)
+      exact liftRule_eq (assignment_reading h constants) h.equality
+        (hM.of_agrees hE (assignment_agrees h constants)) u v env
+  | ind =>
+    have he := List.mem_singleton.mp hl
+    subst law
+    exact indRule_eq _ _ _ _
+
+theorem assignment_realizes (h : Checked.{u,v} entries store refs) (hE : entries.WF)
+    (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (refs.assignment constants) (refs.environment entries) := by
+  have hs := typeAssignment_realizes h hE constants hM
+  have ho := hM.of_agrees hE (assignment_agrees h constants)
+  have he : ∀ r entry, refs.environment entries r = some entry → EntryRealization (refs.assignment constants) r entry := by
+    intro r entry hr
+    rcases environment_cases hr with hold | ⟨kind, rfl, rfl⟩
+    · exact ⟨ho.typeValid _ _ hold, ho.member _ _ hold, ho.bodyValid _ _ hold,
+        ho.bodyValue _ _ hold, ho.equationValue _ _ hold, ho.factMeaning _ _ hold⟩
+    · have ht := typeEnvironment_lookup h kind
+      constructor
+      · exact hs.typeValid _ (refs.header kind).entry ht
+      · exact hs.member _ (refs.header kind).entry ht
+      · intro body hb; cases hb
+      · intro body hb; cases hb
+      · exact fun law hl => equation_value h hE constants hM kind hl
+      · intro fact hf; cases hf
+  exact ⟨fun r e hr => (he r e hr).typeValid, fun r e hr => (he r e hr).member,
+    fun r e hr => (he r e hr).bodyValid, fun r e hr => (he r e hr).bodyValue,
+    fun r e hr => (he r e hr).equationValue, fun r e hr => (he r e hr).factMeaning⟩
+
+end Ix.Theory.Certified.Quotient
diff --git a/Ix/Theory/Certified/Quotient/Reading.lean b/Ix/Theory/Certified/Quotient/Reading.lean
new file mode 100644
index 000000000..3a0706afc
--- /dev/null
+++ b/Ix/Theory/Certified/Quotient/Reading.lean
@@ -0,0 +1,184 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Quotient.Value
+
+namespace Ix.Theory.Certified.Quotient
+
+open Model Model.SetTheory Model.SetModel
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def Refs.value (refs : Refs β) (constants : Assignment β V)
+    (kind : Kind) (levels : List Nat) : V :=
+  match kind with
+  | .type => formerValue (levels.getD 0 0)
+  | .ctor => constructorValue (levels.getD 0 0)
+  | .lift => liftValue constants refs.eq (levels.getD 0 0) (levels.getD 1 0)
+  | .ind | .sound => pt
+
+/-- This reading is proved for the internally constructed assignment. It is
+not a field of an input certificate. -/
+structure Reading (constants : Assignment β V) (refs : Refs β) : Prop where
+  former : ∀ u, constants refs.type [u] = formerValue u
+  ctor : ∀ u, constants refs.ctor [u] = constructorValue u
+  lift : ∀ u v, constants refs.lift [u, v] = liftValue constants refs.eq u v
+  ind : ∀ u, constants refs.ind [u] = pt
+  sound : ∀ u, constants refs.sound [u] = pt
+
+noncomputable def formerAt (constants : Assignment β V) (refs : Refs β) (u : Nat) (A R : V) : V :=
+  app (app (constants refs.type [u]) A) R
+
+noncomputable def constructorAt (constants : Assignment β V) (refs : Refs β) (u : Nat) (A R a : V) : V :=
+  app (app (app (constants refs.ctor [u]) A) R) a
+
+variable {constants : Assignment β V} {refs : Refs β}
+
+theorem formerAt_eq (h : Reading constants refs) {u : Nat} {A R : V}
+    (hA : A ∈ˢ univ u) (hR : R ∈ˢ relationSet A) : formerAt constants refs u A R = quotSet u A R := by
+  rw [formerAt, h.former]
+  exact formerValue_apply hA hR
+
+theorem constructorAt_eq (h : Reading constants refs) {u : Nat} {A R a : V}
+    (hA : A ∈ˢ univ u) (hR : R ∈ˢ relationSet A) (ha : a ∈ˢ A) :
+    constructorAt constants refs u A R a = quotClass u A R a := by
+  rw [constructorAt, h.ctor]
+  exact constructorValue_apply hA hR ha
+
+theorem typeType_interp (constants : Assignment β V) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (typeType : AExpr β) = formerSet u := by
+  simp [typeType, relationType, formerSet, relationSet, interp, VLevel.eval, Valuation.cons, univ_zero]
+
+theorem ctorType_interp (h : Reading constants refs) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (ctorType refs) = constructorSet u := by
+  simp [ctorType, applied, AExpr.appN, relationType, interp, VLevel.eval, Valuation.cons, regime, PropWhen.param, PropWhen.holds, univ_zero]
+  change piR (bit u) (univ u) (fun A => piR (bit u) (relationSet A) (fun R =>
+    piR (bit u) A (fun _ => formerAt constants refs u A R))) = constructorSet u
+  apply piR_congr
+  intro A hA
+  apply piR_congr
+  intro R hR
+  simp only [formerAt_eq h hA hR]
+
+theorem liftType_interp (h : Reading constants refs) (u v : Nat) (env : Nat → V) :
+    interp constants [u, v] env (liftType refs) = liftSet constants refs.eq u v := by
+  simp [liftType, liftPrefix, AExpr.forallN, invariantType, Basis.Equality.applied,
+    relationType, applied, AExpr.appN, interp, VLevel.eval,
+    Valuation.cons, regime, PropWhen.param, PropWhen.holds, univ_zero]
+  change piR (bit v) (univ u) (fun A => piR (bit v) (relationSet A) (fun R =>
+    piR (bit v) (univ v) (fun B => piR (bit v) (piR (bit v) A (fun _ => B)) (fun f =>
+      piR (bit v) (invariantSet constants refs.eq v A R B f) (fun _ =>
+        piR (bit v) (formerAt constants refs u A R) (fun _ => B)))))) = liftSet constants refs.eq u v
+  apply piR_congr
+  intro A hA
+  apply piR_congr
+  intro R hR
+  simp only [formerAt_eq h hA hR]
+
+theorem indType_interp (h : Reading constants refs) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (indType refs) = indSet u := by
+  simp [indType, indPrefix, AExpr.forallN, relationType, applied, constructed, AExpr.appN,
+    interp, VLevel.eval, Valuation.cons,
+    regime, PropWhen.holds, univ_zero]
+  change piR 0 (univ u) (fun A => piR 0 (relationSet A) (fun R =>
+    piR 0 (piR 1 (formerAt constants refs u A R) (fun _ => univZero)) (fun motive =>
+      piR 0 (piR 0 A (fun a => app motive (constructorAt constants refs u A R a))) (fun _ =>
+        piR 0 (formerAt constants refs u A R) (fun q => app motive q))))) = indSet u
+  apply piR_congr
+  intro A hA
+  apply piR_congr
+  intro R hR
+  simp only [formerAt_eq h hA hR]
+  apply piR_congr
+  intro motive _
+  have he : piR 0 A (fun a => app motive (constructorAt constants refs u A R a)) =
+      piR 0 A (fun a => app motive (quotClass u A R a)) := by
+    apply piR_congr
+    intro a ha
+    rw [constructorAt_eq h hA hR ha]
+  rw [he]
+
+theorem soundType_interp (h : Reading constants refs) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (soundType refs) = soundSet constants refs.eq u := by
+  simp [soundType, relationType, applied, constructed, Basis.Equality.applied, AExpr.appN,
+    interp, VLevel.eval, Valuation.cons,
+    regime, PropWhen.holds, univ_zero]
+  change piR 0 (univ u) (fun A => piR 0 (relationSet A) (fun R =>
+    piR 0 A (fun a => piR 0 A (fun b => piR 0 (app (app R a) b) (fun _ =>
+      Basis.Equality.value constants refs.eq u (formerAt constants refs u A R)
+        (constructorAt constants refs u A R a) (constructorAt constants refs u A R b)))))) =
+    soundSet constants refs.eq u
+  apply piR_congr
+  intro A hA
+  apply piR_congr
+  intro R hR
+  apply piR_congr
+  intro a ha
+  apply piR_congr
+  intro b hb
+  simp only [formerAt_eq h hA hR, constructorAt_eq h hA hR ha, constructorAt_eq h hA hR hb]
+
+theorem value_mem {entries : Environment β} (h : Reading constants refs)
+    (hE : Basis.Equality.Interface entries refs.eq refs.eqRefl refs.eqRec) (hM : Realizes constants entries)
+    (kind : Kind) (levels : List Nat) (hn : levels.length = kind.universes) (env : Nat → V) :
+    constants (refs.ref kind) levels ∈ˢ interp constants levels env (refs.entryType kind) := by
+  cases kind with
+  | type =>
+    obtain ⟨u, rfl⟩ := List.length_eq_one_iff.mp hn
+    rw [Refs.ref, h.former, Refs.entryType, typeType_interp]
+    exact formerValue_mem u
+  | ctor =>
+    obtain ⟨u, rfl⟩ := List.length_eq_one_iff.mp hn
+    rw [Refs.ref, h.ctor, Refs.entryType, ctorType_interp h]
+    exact constructorValue_mem u
+  | lift =>
+    cases levels with
+    | nil => cases hn
+    | cons u tail =>
+      obtain ⟨v, rfl⟩ := List.length_eq_one_iff.mp (Nat.succ.inj hn)
+      rw [Refs.ref, h.lift, Refs.entryType, liftType_interp h]
+      exact liftValue_mem constants refs.eq u v
+  | ind =>
+    obtain ⟨u, rfl⟩ := List.length_eq_one_iff.mp hn
+    rw [Refs.ref, h.ind, Refs.entryType, indType_interp h]
+    exact indValue_mem u
+  | sound =>
+    obtain ⟨u, rfl⟩ := List.length_eq_one_iff.mp hn
+    rw [Refs.ref, h.sound, Refs.entryType, soundType_interp h]
+    exact soundValue_mem hE hM u
+
+/-- Equality of the complete lambda endpoints published as the primitive
+computation law, for every environment and both universe regimes. -/
+theorem liftRule_eq {entries : Environment β} (h : Reading constants refs)
+    (hE : Basis.Equality.Interface entries refs.eq refs.eqRefl refs.eqRec) (hM : Realizes constants entries)
+    (u v : Nat) (env : Nat → V) :
+    interp constants [u, v] env (liftRuleLhs refs) = interp constants [u, v] env (liftRuleRhs refs) := by
+  simp [liftRuleLhs, liftRuleRhs, liftRuleBinders, liftPrefix, List.cons_append, List.nil_append,
+    AExpr.lamN, relationType, invariantType, Basis.Equality.applied, AExpr.appN, constructed,
+    interp, VLevel.eval, Valuation.cons, regime, PropWhen.param, PropWhen.holds, univ_zero]
+  apply lamR_congr
+  intro A hA
+  apply lamR_congr
+  intro R hR
+  apply lamR_congr
+  intro B hB
+  apply lamR_congr
+  intro f hf
+  apply lamR_congr
+  intro proof hp
+  apply lamR_congr
+  intro a ha
+  change app (app (app (app (app (app (constants refs.lift [u, v]) A) R) B) f) proof)
+    (constructorAt constants refs u A R a) = app f a
+  rw [h.lift, constructorAt_eq h hA hR ha]
+  exact liftValue_apply hE hM hA hR hB hf hp ha
+
+theorem indRule_eq (constants : Assignment β V) (refs : Refs β) (levels : List Nat) (env : Nat → V) :
+    interp constants levels env (indRuleLhs refs) = interp constants levels env (indRuleRhs refs) := by
+  simp only [indRuleLhs, indRuleRhs, indRuleBinders, indPrefix, List.cons_append, List.nil_append,
+    AExpr.lamN, interp, regime_always, lamR_zero]
+
+end Ix.Theory.Certified.Quotient
diff --git a/Ix/Theory/Certified/Quotient/Syntax.lean b/Ix/Theory/Certified/Quotient/Syntax.lean
new file mode 100644
index 000000000..b7499de97
--- /dev/null
+++ b/Ix/Theory/Certified/Quotient/Syntax.lean
@@ -0,0 +1,144 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Basis.Equality
+import Ix.Theory.Quot
+
+namespace Ix.Theory.Certified.Quotient
+
+open Model
+
+universe u
+variable {β : Type u}
+
+/-- The five quotient declarations are realized together. References may be
+members of different authenticated blocks. Equality must already be admitted. -/
+structure Refs (β : Type u) extends Store.QuotRefs β where
+  eqRefl : ConstRef β
+  eqRec : ConstRef β
+  sound : ConstRef β
+  deriving DecidableEq
+
+inductive Kind where
+  | type | ctor | lift | ind | sound
+  deriving DecidableEq
+
+def kinds : List Kind := [.type, .ctor, .lift, .ind, .sound]
+
+def Refs.ref (refs : Refs β) : Kind → ConstRef β
+  | .type => refs.type
+  | .ctor => refs.ctor
+  | .lift => refs.lift
+  | .ind => refs.ind
+  | .sound => refs.sound
+
+def Kind.universes : Kind → Nat
+  | .lift => 2
+  | _ => 1
+
+def relationType : AExpr β :=
+  .forallE .never (.bvar 0) (.forallE .never (.bvar 1) (.sort .zero))
+
+def applied (refs : Refs β) (l : VLevel) (A R : AExpr β) : AExpr β :=
+  .appN (.const refs.type [l]) [A, R]
+
+def constructed (refs : Refs β) (l : VLevel) (A R a : AExpr β) : AExpr β :=
+  .appN (.const refs.ctor [l]) [A, R, a]
+
+def typeType : AExpr β :=
+  .forallE .never (.sort (.param 0)) (.forallE .never relationType (.sort (.param 0)))
+
+def ctorType (refs : Refs β) : AExpr β :=
+  .forallE (.param 0) (.sort (.param 0)) <|
+  .forallE (.param 0) relationType <|
+  .forallE (.param 0) (.bvar 1) <|
+    applied refs (.param 0) (.bvar 2) (.bvar 1)
+
+/-- In the context `A, R, B, f`, invariance of `f` under `R`. -/
+def invariantType (refs : Refs β) : AExpr β :=
+  .forallE .always (.bvar 3) <|
+  .forallE .always (.bvar 4) <|
+  .forallE .always (.appN (.bvar 4) [.bvar 1, .bvar 0]) <|
+    Basis.Equality.applied refs.eq (.param 1) (.bvar 4)
+      (.app (.bvar 3) (.bvar 2)) (.app (.bvar 3) (.bvar 1))
+
+def liftPrefix (refs : Refs β) : List (AExpr β) :=
+  [.sort (.param 0), relationType, .sort (.param 1),
+    .forallE (.param 1) (.bvar 2) (.bvar 1), invariantType refs]
+
+def liftType (refs : Refs β) : AExpr β :=
+  .forallN (.param 1) (liftPrefix refs) <|
+    .forallE (.param 1) (applied refs (.param 0) (.bvar 4) (.bvar 3)) (.bvar 3)
+
+def indPrefix (refs : Refs β) : List (AExpr β) :=
+  [.sort (.param 0), relationType,
+    .forallE .never (applied refs (.param 0) (.bvar 1) (.bvar 0)) (.sort .zero),
+    .forallE .always (.bvar 2)
+      (.app (.bvar 1) (constructed refs (.param 0) (.bvar 3) (.bvar 2) (.bvar 0)))]
+
+def indType (refs : Refs β) : AExpr β :=
+  .forallN .always (indPrefix refs) <|
+    .forallE .always (applied refs (.param 0) (.bvar 3) (.bvar 2)) (.app (.bvar 2) (.bvar 0))
+
+def soundType (refs : Refs β) : AExpr β :=
+  .forallE .always (.sort (.param 0)) <|
+  .forallE .always relationType <|
+  .forallE .always (.bvar 1) <|
+  .forallE .always (.bvar 2) <|
+  .forallE .always (.appN (.bvar 2) [.bvar 1, .bvar 0]) <|
+    Basis.Equality.applied refs.eq (.param 0)
+      (applied refs (.param 0) (.bvar 4) (.bvar 3))
+      (constructed refs (.param 0) (.bvar 4) (.bvar 3) (.bvar 2))
+      (constructed refs (.param 0) (.bvar 4) (.bvar 3) (.bvar 1))
+
+def Refs.entryType (refs : Refs β) : Kind → AExpr β
+  | .type => typeType
+  | .ctor => ctorType refs
+  | .lift => liftType refs
+  | .ind => indType refs
+  | .sound => soundType refs
+
+def Refs.source (refs : Refs β) : Kind → Const β
+  | .type => .quot .type 1 typeType.erase
+  | .ctor => .quot .ctor 1 (ctorType refs).erase
+  | .lift => .quot .lift 2 (liftType refs).erase
+  | .ind => .quot .ind 1 (indType refs).erase
+  | .sound => .axiom 1 (soundType refs).erase .safe
+
+def liftRuleBinders (refs : Refs β) : List (AExpr β) := liftPrefix refs ++ [.bvar 4]
+def liftRuleType (refs : Refs β) : AExpr β := .forallN (.param 1) (liftRuleBinders refs) (.bvar 3)
+def liftRuleLhs (refs : Refs β) : AExpr β :=
+  .lamN (.param 1) (liftRuleBinders refs) <|
+    .appN (.const refs.lift [.param 0, .param 1])
+      [.bvar 5, .bvar 4, .bvar 3, .bvar 2, .bvar 1,
+        constructed refs (.param 0) (.bvar 5) (.bvar 4) (.bvar 0)]
+def liftRuleRhs (refs : Refs β) : AExpr β :=
+  .lamN (.param 1) (liftRuleBinders refs) (.app (.bvar 2) (.bvar 0))
+
+def indRuleBinders (refs : Refs β) : List (AExpr β) := indPrefix refs ++ [.bvar 3]
+def indRuleType (refs : Refs β) : AExpr β :=
+  .forallN .always (indRuleBinders refs) <|
+    .app (.bvar 2) (constructed refs (.param 0) (.bvar 4) (.bvar 3) (.bvar 0))
+def indRuleLhs (refs : Refs β) : AExpr β :=
+  .lamN .always (indRuleBinders refs) <|
+    .appN (.const refs.ind [.param 0]) [.bvar 4, .bvar 3, .bvar 2, .bvar 1,
+      constructed refs (.param 0) (.bvar 4) (.bvar 3) (.bvar 0)]
+def indRuleRhs (refs : Refs β) : AExpr β :=
+  .lamN .always (indRuleBinders refs) (.app (.bvar 1) (.bvar 0))
+
+def Refs.equations (refs : Refs β) : Kind → List (ConstantEquation β)
+  | .lift => [⟨liftRuleLhs refs, liftRuleRhs refs⟩]
+  | .ind => [⟨indRuleLhs refs, indRuleRhs refs⟩]
+  | _ => []
+
+def Refs.entry (refs : Refs β) (kind : Kind) : ConstantEntry β :=
+  ⟨kind.universes, refs.entryType kind, none, refs.equations kind, []⟩
+
+theorem typeType_erase : (typeType : AExpr β).erase = Store.Quotient.typeType := rfl
+theorem ctorType_erase (refs : Refs β) : (ctorType refs).erase = Store.Quotient.ctorType refs.toQuotRefs := rfl
+theorem liftType_erase (refs : Refs β) : (liftType refs).erase = Store.Quotient.liftType refs.toQuotRefs := rfl
+theorem indType_erase (refs : Refs β) : (indType refs).erase = Store.Quotient.indType refs.toQuotRefs := rfl
+
+end Ix.Theory.Certified.Quotient
diff --git a/Ix/Theory/Certified/Quotient/Value.lean b/Ix/Theory/Certified/Quotient/Value.lean
new file mode 100644
index 000000000..45794753e
--- /dev/null
+++ b/Ix/Theory/Certified/Quotient/Value.lean
@@ -0,0 +1,185 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Quotient.Syntax
+import Ix.Theory.Model.SetTheory.Derive.Quot
+
+namespace Ix.Theory.Certified.Quotient
+
+open Model Model.SetTheory Model.SetModel
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+def bit (u : Nat) : Nat := if u = 0 then 0 else 1
+
+noncomputable def relationSet (A : V) : V :=
+  piR 1 A (fun _ => piR 1 A (fun _ => univZero))
+
+noncomputable def formerValue (u : Nat) : V :=
+  lamR 1 (univ u) (fun A => lamR 1 (relationSet A) (fun R => quotSet u A R))
+
+noncomputable def constructorValue (u : Nat) : V :=
+  lamR (bit u) (univ u) (fun A => lamR (bit u) (relationSet A) (fun R =>
+    lamR (bit u) A (fun a => quotClass u A R a)))
+
+noncomputable def invariantSet (constants : Assignment β V) (eq : ConstRef β)
+    (v : Nat) (A R B f : V) : V :=
+  piR 0 A (fun a => piR 0 A (fun b => piR 0 (app (app R a) b)
+    (fun _ => Basis.Equality.value constants eq v B (app f a) (app f b))))
+
+noncomputable def liftValue (constants : Assignment β V) (eq : ConstRef β) (u v : Nat) : V :=
+  lamR (bit v) (univ u) (fun A => lamR (bit v) (relationSet A) (fun R =>
+    lamR (bit v) (univ v) (fun B => lamR (bit v) (piR (bit v) A (fun _ => B)) (fun f =>
+      lamR (bit v) (invariantSet constants eq v A R B f) (fun _ =>
+        lamR (bit v) (quotSet u A R) (fun q => app f (qrep u A R q)))))))
+
+noncomputable def formerSet (u : Nat) : V :=
+  piR 1 (univ u) (fun A => piR 1 (relationSet A) (fun _ => univ u))
+
+noncomputable def constructorSet (u : Nat) : V :=
+  piR (bit u) (univ u) (fun A => piR (bit u) (relationSet A) (fun R =>
+    piR (bit u) A (fun _ => quotSet u A R)))
+
+noncomputable def liftSet (constants : Assignment β V) (eq : ConstRef β) (u v : Nat) : V :=
+  piR (bit v) (univ u) (fun A => piR (bit v) (relationSet A) (fun R =>
+    piR (bit v) (univ v) (fun B => piR (bit v) (piR (bit v) A (fun _ => B)) (fun f =>
+      piR (bit v) (invariantSet constants eq v A R B f) (fun _ =>
+        piR (bit v) (quotSet u A R) (fun _ => B))))))
+
+noncomputable def indSet (u : Nat) : V :=
+  piR 0 (univ u) (fun A => piR 0 (relationSet A) (fun R =>
+    piR 0 (piR 1 (quotSet u A R) (fun _ => univZero)) (fun motive =>
+      piR 0 (piR 0 A (fun a => app motive (quotClass u A R a))) (fun _ =>
+        piR 0 (quotSet u A R) (fun q => app motive q)))))
+
+noncomputable def soundSet (constants : Assignment β V) (eq : ConstRef β) (u : Nat) : V :=
+  piR 0 (univ u) (fun A => piR 0 (relationSet A) (fun R =>
+    piR 0 A (fun a => piR 0 A (fun b => piR 0 (app (app R a) b) (fun _ =>
+      Basis.Equality.value constants eq u (quotSet u A R)
+        (quotClass u A R a) (quotClass u A R b))))))
+
+theorem app_mem_bit {u : Nat} {A B f a : V} (hB : B ∈ˢ univ u)
+    (hf : f ∈ˢ piR (bit u) A (fun _ => B)) (ha : a ∈ˢ A) : app f a ∈ˢ B := by
+  apply app_mem_piR hf ha
+  intro hu _ _
+  have he : u = 0 := by simpa [bit] using hu
+  simpa [he, univ_zero] using hB
+
+theorem formerValue_mem (u : Nat) : (formerValue u : V) ∈ˢ formerSet u := by
+  apply lamR_mem
+  intro A hA
+  exact lamR_mem fun _ _ => quotSet_mem_univ hA
+
+theorem constructorValue_mem (u : Nat) : (constructorValue u : V) ∈ˢ constructorSet u := by
+  apply lamR_mem
+  intro A _
+  apply lamR_mem
+  intro R _
+  exact lamR_mem fun _ ha => quotClass_mem ha
+
+theorem formerValue_apply {u : Nat} {A R : V} (hA : A ∈ˢ univ u) (hR : R ∈ˢ relationSet A) :
+    app (app (formerValue u) A) R = quotSet u A R := by
+  rw [formerValue, app_lamR_pos (by decide : 1 ≠ 0) hA,
+    app_lamR_pos (by decide : 1 ≠ 0) hR]
+
+theorem constructorValue_apply {u : Nat} {A R a : V}
+    (hA : A ∈ˢ univ u) (hR : R ∈ˢ relationSet A) (ha : a ∈ˢ A) :
+    app (app (app (constructorValue u) A) R) a = quotClass u A R a := by
+  by_cases hu : u = 0
+  · subst u
+    simp [constructorValue, bit, lamR_zero, app_pt, quotClass]
+  · simp only [constructorValue, bit, if_neg hu]
+    rw [app_lamR_pos (by decide : 1 ≠ 0) hA,
+      app_lamR_pos (by decide : 1 ≠ 0) hR, app_lamR_pos (by decide : 1 ≠ 0) ha]
+
+theorem liftValue_mem (constants : Assignment β V) (eq : ConstRef β) (u v : Nat) :
+    liftValue constants eq u v ∈ˢ liftSet constants eq u v := by
+  apply lamR_mem
+  intro A _
+  apply lamR_mem
+  intro R _
+  apply lamR_mem
+  intro B hB
+  apply lamR_mem
+  intro f hf
+  apply lamR_mem
+  intro _ _
+  apply lamR_mem
+  intro q hq
+  exact app_mem_bit hB hf (qrep_spec hq).1
+
+theorem indValue_mem (u : Nat) : (pt : V) ∈ˢ indSet u := by
+  apply pt_mem_piR_zero_of
+  intro A _
+  apply pt_mem_piR_zero_of
+  intro R _
+  apply pt_mem_piR_zero_of
+  intro motive hm
+  apply pt_mem_piR_zero_of
+  intro f hf
+  apply pt_mem_piR_zero_of
+  intro q hq
+  obtain ⟨a, ha, rfl⟩ := quotClass_surj hq
+  have hprop : ∀ x, x ∈ˢ quotSet u A R → app motive x ∈ˢ univZero :=
+    fun _ hx => app_mem_piR_pos (by decide : 1 ≠ 0) hm hx
+  have hf' : app f a ∈ˢ app motive (quotClass u A R a) :=
+    app_mem_piR hf ha (fun _ a ha => hprop _ (quotClass_mem ha))
+  rwa [eq_pt_of_mem_univZero (hprop _ (quotClass_mem ha)) hf'] at hf'
+
+theorem soundValue_mem {entries : Environment β} {constants : Assignment β V} {eq refl recursor : ConstRef β}
+    (hE : Basis.Equality.Interface entries eq refl recursor) (hM : Realizes constants entries) (u : Nat) :
+    (pt : V) ∈ˢ soundSet constants eq u := by
+  apply pt_mem_piR_zero_of
+  intro A hA
+  apply pt_mem_piR_zero_of
+  intro R _
+  apply pt_mem_piR_zero_of
+  intro a ha
+  apply pt_mem_piR_zero_of
+  intro b hb
+  apply pt_mem_piR_zero_of
+  intro h hh
+  rw [Basis.Equality.value_eq_eqv hE hM (quotSet_mem_univ hA) (quotClass_mem ha) (quotClass_mem hb),
+    quotSound ha hb hh]
+  exact pt_mem_eqv_self _
+
+theorem invariant_of_mem {entries : Environment β} {constants : Assignment β V}
+    {eq refl recursor : ConstRef β} (hE : Basis.Equality.Interface entries eq refl recursor)
+    (hM : Realizes constants entries) {v : Nat} {A R B f h : V}
+    (hB : B ∈ˢ univ v) (hf : f ∈ˢ piR (bit v) A (fun _ => B))
+    (hh : h ∈ˢ invariantSet constants eq v A R B f) :
+    ∀ a b, a ∈ˢ A → b ∈ˢ A → (∃ w, w ∈ˢ app (app R a) b) → app f a = app f b := by
+  intro a b ha hb ⟨w, hw⟩
+  obtain ⟨ha', hha⟩ := Basis.Equality.exists_of_mem_piR_zero hh ha
+  obtain ⟨hb', hhb⟩ := Basis.Equality.exists_of_mem_piR_zero hha hb
+  obtain ⟨q, hq⟩ := Basis.Equality.exists_of_mem_piR_zero hhb hw
+  exact Basis.Equality.eq_of_mem hE hM hB (app_mem_bit hB hf ha) (app_mem_bit hB hf hb) hq
+
+/-- The whole quotient-lift application computes for any typed invariant
+function. Both the Prop and graph regimes are included. -/
+theorem liftValue_apply {entries : Environment β} {constants : Assignment β V}
+    {eq refl recursor : ConstRef β} (hE : Basis.Equality.Interface entries eq refl recursor)
+    (hM : Realizes constants entries) {u v : Nat} {A R B f h a : V}
+    (hA : A ∈ˢ univ u) (hR : R ∈ˢ relationSet A) (hB : B ∈ˢ univ v)
+    (hf : f ∈ˢ piR (bit v) A (fun _ => B))
+    (hh : h ∈ˢ invariantSet constants eq v A R B f) (ha : a ∈ˢ A) :
+    app (app (app (app (app (app (liftValue constants eq u v) A) R) B) f) h)
+      (quotClass u A R a) = app f a := by
+  by_cases hv : v = 0
+  · subst v
+    have he : f = pt := eq_pt_of_mem_piR_zero hf
+    simp [liftValue, bit, lamR_zero, he, app_pt]
+  · simp only [liftValue, bit, if_neg hv]
+    rw [app_lamR_pos (by decide : 1 ≠ 0) hA,
+      app_lamR_pos (by decide : 1 ≠ 0) hR,
+      app_lamR_pos (by decide : 1 ≠ 0) hB,
+      app_lamR_pos (by decide : 1 ≠ 0) (by simpa only [bit, if_neg hv] using hf),
+      app_lamR_pos (by decide : 1 ≠ 0) hh,
+      app_lamR_pos (by decide : 1 ≠ 0) (quotClass_mem ha)]
+    have hs := qrep_spec (u := u) (R := R) (quotClass_mem ha)
+    exact app_eq_of_quotClass_eq hA hs.1 ha (invariant_of_mem hE hM hB hf hh) hs.2.symm
+
+end Ix.Theory.Certified.Quotient
diff --git a/Ix/Theory/Certified/Signature.lean b/Ix/Theory/Certified/Signature.lean
new file mode 100644
index 000000000..240fdd808
--- /dev/null
+++ b/Ix/Theory/Certified/Signature.lean
@@ -0,0 +1,162 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Checker
+import Ix.Theory.Model.Signature
+
+/-! Internal formation of a finite signature. These operations publish no
+admitted environment: membership and every computation equation must still
+be constructed by the caller's semantic producer. -/
+
+namespace Ix.Theory.Certified.Signature
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure Header (β : Type u) where
+  ref : ConstRef β
+  universes : Nat
+  type : AExpr β
+
+def Header.entry (header : Header β) : ConstantEntry β :=
+  ⟨header.universes, header.type, none, [], []⟩
+
+def environment (entries : Environment β) : List (Header β) → Environment β
+  | [] => entries
+  | header :: rest => environment (entries.insert header.ref header.entry) rest
+
+structure TypeWitness (β : Type u) where
+  level : VLevel
+  typing : TypingWitness β
+
+inductive Formed : Environment β → List (Header β) → Prop where
+  | nil (entries) : Formed entries []
+  | cons {entries header rest} (fresh : entries header.ref = none)
+      (scope : header.type.Scope header.universes 0) (references : header.type.ReferencesIn entries)
+      {level : VLevel} (typing : TypingClaim.{u,v} entries [] header.type (.sort level))
+      (tail : Formed (entries.insert header.ref header.entry) rest) : Formed entries (header :: rest)
+
+def checkTypes (fuel : Nat) (entries : Environment β) : (headers : List (Header β)) →
+    List (TypeWitness β) → Option (CheckedClaim.{u} (Formed.{u,v} entries headers))
+  | [], [] => some ⟨.nil entries⟩
+  | header :: headers, witness :: witnesses =>
+    if hf : entries header.ref = none then
+      if hs : header.type.Scope header.universes 0 then
+        if hr : header.type.ReferencesIn entries then do
+          let ht ← verifyType.{u,v} fuel header.universes entries [] header.type (.sort witness.level) witness.typing
+          let rest ← checkTypes fuel (entries.insert header.ref header.entry) headers witnesses
+          return ⟨.cons hf hs hr ht.down rest.down⟩
+        else none
+      else none
+    else none
+  | _, _ => none
+
+theorem checkTypes_sound {fuel : Nat} {entries : Environment β} {headers : List (Header β)}
+    {witnesses : List (TypeWitness β)} {result}
+    (_ : checkTypes.{u,v} fuel entries headers witnesses = some result) : Formed.{u,v} entries headers := result.down
+
+theorem Formed.old {entries : Environment β} {headers : List (Header β)}
+    (h : Formed.{u,v} entries headers) {r : ConstRef β} {entry : ConstantEntry β}
+    (hr : entries r = some entry) : environment entries headers r = some entry := by
+  induction h with
+  | nil => exact hr
+  | cons hf _ _ _ _ ih => exact ih (Environment.insert_old hf hr)
+
+theorem Formed.lookup {entries : Environment β} {headers : List (Header β)}
+    (h : Formed.{u,v} entries headers) {header : Header β} (hm : header ∈ headers) :
+    environment entries headers header.ref = some header.entry := by
+  induction h with
+  | nil => cases hm
+  | @cons entries hd rest hf hs hr level ht tail ih =>
+    rcases List.mem_cons.mp hm with he | hm
+    · subst header
+      exact tail.old (Environment.insert_same ..)
+    · exact ih hm
+
+theorem environment_source {entries : Environment β} {headers : List (Header β)}
+    {r : ConstRef β} {entry : ConstantEntry β} (h : environment entries headers r = some entry) :
+    entries r = some entry ∨ ∃ header ∈ headers, r = header.ref ∧ entry = header.entry := by
+  induction headers generalizing entries with
+  | nil => exact Or.inl h
+  | cons header rest ih =>
+    rcases ih h with hold | ⟨hd, hm, he, hv⟩
+    · unfold Environment.insert at hold
+      split at hold
+      · exact Or.inr ⟨header, List.mem_cons_self, ‹r = header.ref›, (Option.some.inj hold).symm⟩
+      · exact Or.inl hold
+    · exact Or.inr ⟨hd, List.mem_cons_of_mem _ hm, he, hv⟩
+
+theorem Formed.wf {entries : Environment β} {headers : List (Header β)}
+    (h : Formed.{u,v} entries headers) (hE : entries.WF) : (environment entries headers).WF := by
+  induction h with
+  | nil => exact hE
+  | cons _ hs hr _ _ ih =>
+    apply ih
+    exact hE.insert hs (by simp [Header.entry]) hr (by simp [Header.entry])
+      (by simp [Header.entry]) (by simp [Header.entry])
+      (by simp [Header.entry]) (by simp [Header.entry])
+
+structure Rule (β : Type u) where
+  universes : Nat
+  type : AExpr β
+  lhs : AExpr β
+  rhs : AExpr β
+
+structure RuleWitness (β : Type u) where
+  level : VLevel
+  type : TypingWitness β
+  lhs : TypingWitness β
+  rhs : TypingWitness β
+
+structure RuleFormed (entries : Environment β) (rule : Rule β) : Prop where
+  scope : rule.type.Scope rule.universes 0 ∧ rule.lhs.Scope rule.universes 0 ∧ rule.rhs.Scope rule.universes 0
+  references : rule.type.ReferencesIn entries ∧ rule.lhs.ReferencesIn entries ∧ rule.rhs.ReferencesIn entries
+  type : ∃ level, TypingClaim.{u,v} entries [] rule.type (.sort level)
+  lhs : TypingClaim.{u,v} entries [] rule.lhs rule.type
+  rhs : TypingClaim.{u,v} entries [] rule.rhs rule.type
+
+/-- Both complete endpoints are checked against their common formed type,
+before the environment has acquired the new computation equations. -/
+def checkRule (fuel : Nat) (entries : Environment β) (rule : Rule β) (witness : RuleWitness β) :
+    Option (CheckedClaim.{u} (RuleFormed.{u,v} entries rule)) :=
+  if hs : rule.type.Scope rule.universes 0 ∧ rule.lhs.Scope rule.universes 0 ∧ rule.rhs.Scope rule.universes 0 then
+    if hr : rule.type.ReferencesIn entries ∧ rule.lhs.ReferencesIn entries ∧ rule.rhs.ReferencesIn entries then do
+      let ht ← verifyType.{u,v} fuel rule.universes entries [] rule.type (.sort witness.level) witness.type
+      let hl ← verifyType.{u,v} fuel rule.universes entries [] rule.lhs rule.type witness.lhs
+      let hh ← verifyType.{u,v} fuel rule.universes entries [] rule.rhs rule.type witness.rhs
+      return ⟨⟨hs, hr, ⟨witness.level, ht.down⟩, hl.down, hh.down⟩⟩
+    else none
+  else none
+
+variable {V : Type v} [SetTheory V]
+open SetTheory
+
+/-- Formation supplies hereditary validity. The caller supplies membership
+from the concrete mathematical values, in the same assignment throughout. -/
+theorem Formed.realizes {entries : Environment β} {headers : List (Header β)}
+    (h : Formed.{u,v} entries headers) {constants : Assignment β V} (hM : Realizes constants entries)
+    (members : ∀ header ∈ headers, ∀ levels, levels.length = header.universes → ∀ env,
+      constants header.ref levels ∈ˢ interp constants levels env header.type) :
+    Realizes constants (environment entries headers) := by
+  induction h with
+  | nil => exact hM
+  | cons _ _ _ ht _ ih =>
+    apply ih
+    · apply hM.insert
+      constructor
+      · intro levels _ env
+        exact (ht V constants hM levels env (Context.valid_nil constants levels env)).1
+      · intro levels hn env
+        exact members _ List.mem_cons_self levels hn env
+      · intro body hb; cases hb
+      · intro body hb; cases hb
+      · intro law hl; cases hl
+      · intro fact hf; cases hf
+    · intro header hm
+      exact members header (List.mem_cons_of_mem _ hm)
+
+end Ix.Theory.Certified.Signature
diff --git a/Ix/Theory/Certified/Source.lean b/Ix/Theory/Certified/Source.lean
new file mode 100644
index 000000000..741b8a99f
--- /dev/null
+++ b/Ix/Theory/Certified/Source.lean
@@ -0,0 +1,153 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Store
+
+/-! Every admitted entry retains the exact type and universe arity of its
+source member or constructor. Semantic facts and equations add evidence;
+they do not replace the authenticated declaration's statement. -/
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u}
+
+structure SourceHeader (store : Store β) (ref : ConstRef β) (entry : ConstantEntry β) : Prop where
+  type : store.type ref = some entry.type.erase
+  universes : store.uvars ref = some entry.universes
+
+namespace Ordinary.Shape
+
+theorem family_sourceHeader {store : Store β} {shape : Ordinary.Shape β} {source : β}
+    (h : store.blocks source = some ⟨[shape.source source]⟩) :
+    SourceHeader store (.member source 0) shape.familyEntry := by
+  constructor <;> simp [Store.type, Store.uvars, Store.lookup, h, Shape.source, familyEntry,
+    Const.type, Const.uvars]
+
+theorem constructor_sourceHeader {store : Store β} {shape : Ordinary.Shape β} {source : β}
+    {index : Nat} {ctor : Ordinary.Constructor β}
+    (h : store.blocks source = some ⟨[shape.source source]⟩)
+    (hc : shape.constructors[index]? = some ctor) :
+    SourceHeader store (.ctor source 0 index) (shape.constructorEntry source ctor) := by
+  constructor <;> simp [Store.type, Store.uvars, Store.lookup, Store.lookupCtor, h,
+    Shape.source, List.getElem?_map, hc, Ordinary.Constructor.source, constructorEntry]
+
+theorem recursor_sourceHeader {store : Store β} {shape : Ordinary.Shape β} {source recursor : β}
+    {mode : Inductive.ElimMode} (h : shape.RecursorSourceMatches store source recursor mode) :
+    SourceHeader store (.member recursor 0) (shape.publishedRecursorEntry source recursor mode) := by
+  rcases h with h | ⟨_, h⟩ <;>
+    constructor <;> simp [Store.type, Store.uvars, Store.lookup, h,
+      recursorSource, publishedRecursorEntry, recursorEntry, Const.type, Const.uvars]
+
+end Ordinary.Shape
+
+theorem Ordinary.EntrySource.header {store : Store β} {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : Ordinary.EntrySource store ref entry) : SourceHeader store ref entry := by
+  rcases h with ⟨shape, source, recursor, mode, hs, hr, h⟩
+  rcases h with ⟨rfl, rfl⟩ | ⟨index, ctor, hc, rfl, rfl⟩ | ⟨rfl, rfl⟩
+  · exact shape.family_sourceHeader hs
+  · exact shape.constructor_sourceHeader hs hc
+  · exact shape.recursor_sourceHeader hr
+
+theorem Standard.EntrySource.header {store : Store β} {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : Standard.EntrySource store ref entry) : SourceHeader store ref entry := by
+  rcases h with ⟨spec, hs, rfl⟩
+  constructor <;> simp [Store.type, Store.uvars, hs, Standard.Spec.source, Standard.Spec.entry,
+    Const.type, Const.uvars]
+
+theorem Quotient.EntrySource.header {store : Store β} {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : Quotient.EntrySource store ref entry) : SourceHeader store ref entry := by
+  rcases h with ⟨refs, kind, hs, rfl, rfl⟩
+  have he := hs kind (by cases kind <;> simp [Quotient.kinds])
+  constructor <;> cases kind <;>
+    simp [Store.type, Store.uvars, he, Quotient.Refs.source, Quotient.Refs.entry,
+      Quotient.Refs.entryType, Quotient.Kind.universes, Const.type, Const.uvars]
+
+theorem Structure.EntrySource.header {store : Store β} {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : Structure.EntrySource store ref entry) : SourceHeader store ref entry := by
+  rcases h with ⟨description, source, recursor, mode, hs, _, rfl, rfl⟩
+  exact ⟨(description.ordinary.family_sourceHeader hs).type,
+    (description.ordinary.family_sourceHeader hs).universes⟩
+
+theorem Natural.EntrySource.header {pin : Option (ConstRef β)} {store : Store β}
+    {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : Natural.EntrySource pin store ref entry) : SourceHeader store ref entry := by
+  rcases h with ⟨_, source, recursor, mode, hs, _, rfl, rfl⟩
+  exact ⟨(Ordinary.Shape.family_sourceHeader hs).type,
+    (Ordinary.Shape.family_sourceHeader hs).universes⟩
+
+theorem Modeled.EntrySource.header {store : Store β} {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : Modeled.EntrySource store ref entry) : SourceHeader store ref entry := by
+  obtain ⟨_, companion, hs, rfl, rfl⟩ := h
+  exact ⟨hs.1, hs.2.1⟩
+
+/-- This covers every enabled admission form, including pinned primitives,
+definition bodies, ordinary constructors and all C4 semantic extensions. -/
+theorem EntrySource.header {signature : PrimitiveSignature β} {store : Store β}
+    {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : EntrySource signature store ref entry) : SourceHeader store ref entry := by
+  rcases h with ⟨rfl, rfl, hs⟩ | ⟨rfl, rfl, hs⟩ | ⟨kind, body, _, _, _, hs⟩ | h | h | h | h | h | h
+  · constructor <;> simp [Store.type, Store.uvars, hs, PrimitiveSignature.falseDeclaration,
+      PrimitiveSignature.falseEntry, Const.type, Const.uvars, AExpr.erase]
+  · constructor <;> simp [Store.type, Store.uvars, hs, PrimitiveSignature.falseElimDeclaration,
+      PrimitiveSignature.falseElimEntry, Const.type, Const.uvars]
+  · constructor <;> simp [Store.type, Store.uvars, hs, Const.type, Const.uvars]
+  · exact h.header
+  · exact h.header
+  · exact h.header
+  · exact h.header
+  · exact h.header
+  · exact h.header
+
+theorem AdmittedEnvironment.sourceHeader {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) {ref : ConstRef β} {entry : ConstantEntry β}
+    (h : state.entries ref = some entry) : SourceHeader store ref entry :=
+  (state.source ref entry h).header
+
+/-- Every requested declaration is tied to its original source header and
+is valid in each compatible interpretation of the admitted interface. -/
+theorem CheckedStore.subject_sound {signature : PrimitiveSignature β} {store : Store β}
+    {subjects : List (ConstRef β)} (result : CheckedStore.{u,v} signature store subjects)
+    {ref : ConstRef β} (h : ref ∈ subjects) :
+    ∃ entry, result.environment.entries ref = some entry ∧
+      SourceHeader store ref entry ∧
+      ∀ (V : Type v) [SetTheory V] (constants : Assignment β V),
+        signature.Compatible result.environment.entries constants →
+        ∀ levels, levels.length = entry.universes → ∀ env,
+          WellDenoted constants levels env entry.type ∧
+          constants ref levels ∈ˢ interp constants levels env entry.type := by
+  have hp := result.targetsPresent ref h
+  cases he : result.environment.entries ref with
+  | none => simp [he] at hp
+  | some entry =>
+    refine ⟨entry, rfl, result.environment.sourceHeader he, ?_⟩
+    intro V _ constants hM levels hl env
+    exact ⟨hM.realizes.typeValid ref entry he levels hl env,
+      hM.realizes.member ref entry he levels hl env⟩
+
+/-- The exact source type has an inhabitant in a model constructed by the
+checker; the source header is not an additional caller hypothesis. -/
+theorem accepted_store_source_sound [DecidableEq β] {fuel : Nat} {signature : PrimitiveSignature β}
+    {store : Store β} {subjects : List (ConstRef β)} {witness : List (DeclarationWitness β)}
+    (h : acceptsStoreCertified.{u,v} fuel signature store subjects witness = true)
+    (V : Type v) [SetTheory V] :
+    ∃ result : CheckedStore.{u,v} signature store subjects,
+      checkStoreCertified fuel signature store subjects witness = some result ∧
+      ∃ constants : Assignment β V,
+        signature.Compatible result.environment.entries constants ∧
+        ∀ ref ∈ subjects, ∃ entry, result.environment.entries ref = some entry ∧
+          SourceHeader store ref entry ∧
+          ∀ levels, levels.length = entry.universes → ∀ env,
+            WellDenoted constants levels env entry.type ∧
+            constants ref levels ∈ˢ interp constants levels env entry.type := by
+  obtain ⟨result, checked, constants, compatible, _⟩ := accepted_store_has_model h V
+  refine ⟨result, checked, constants, compatible, ?_⟩
+  intro ref hr
+  obtain ⟨entry, he, hs, hm⟩ := result.subject_sound hr
+  exact ⟨entry, he, hs, hm V constants compatible⟩
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Standard/Admission.lean b/Ix/Theory/Certified/Standard/Admission.lean
new file mode 100644
index 000000000..4fa38b320
--- /dev/null
+++ b/Ix/Theory/Certified/Standard/Admission.lean
@@ -0,0 +1,61 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Admission
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Standard axiom schemas acquire values only after exact source, prerequisite
+interface, and whole-type checks. No caller-supplied realization is accepted. -/
+def checkStandardExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : Standard.Witness β) :
+    Option (CheckedExtension.{u,v} signature store state) := do
+  let checked ← Standard.check.{u,v} fuel state.entries store witness
+  have extension : Extends.{u,v} signature state.entries
+      (state.entries.insert witness.ref witness.spec.entry) := by
+    constructor
+    · exact fun _ _ h => Environment.insert_old checked.down.fresh h
+    · intro V _ constants hM
+      let constants' := Standard.assignment constants witness
+      have ha := Standard.assignment_agrees checked.down constants
+      have hm := Standard.assignment_realizes checked.down state.wf constants hM.realizes
+      exact ⟨constants', hM.extend signature state.present hm ha, ha⟩
+  let result : CheckedInterface signature := {
+    entries := state.entries.insert witness.ref witness.spec.entry
+    wf := Standard.environment_wf checked.down state.wf
+    present := state.present.insert signature checked.down.fresh
+  }
+  return {
+    result, extension
+    source := by
+      intro r entry hr
+      dsimp only [result] at hr
+      unfold Environment.insert at hr
+      split at hr
+      next he =>
+        subst r
+        cases Option.some.inj hr
+        exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inl ⟨witness.spec, checked.down.exactSource, rfl⟩)))))
+      next => exact Or.inl hr
+  }
+
+def admitStandard? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : Standard.Witness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkStandardExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+theorem admitStandard?_extends {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {state : AdmittedEnvironment.{u,v} signature store} {witness : Standard.Witness β} {result}
+    (_ : admitStandard? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Standard/Checked.lean b/Ix/Theory/Certified/Standard/Checked.lean
new file mode 100644
index 000000000..f2cd6dc34
--- /dev/null
+++ b/Ix/Theory/Certified/Standard/Checked.lean
@@ -0,0 +1,89 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Standard.Realization
+
+namespace Ix.Theory.Certified.Standard
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure Witness (β : Type u) where
+  ref : ConstRef β
+  spec : Spec β
+  level : VLevel
+  typing : TypingWitness β
+
+structure Checked (entries : Environment β) (store : Store β) (witness : Witness β) : Prop where
+  exactSource : store.lookup witness.ref = some witness.spec.source
+  fresh : entries witness.ref = none
+  prerequisites : witness.spec.Prerequisites entries
+  scope : witness.spec.type.Scope witness.spec.universes 0
+  references : witness.spec.type.ReferencesIn entries
+  typing : TypingClaim.{u,v} entries [] witness.spec.type (.sort witness.level)
+
+def check (fuel : Nat) (entries : Environment β) (store : Store β) (witness : Witness β) :
+    Option (CheckedClaim.{u} (Checked.{u,v} entries store witness)) :=
+  if hs : store.lookup witness.ref = some witness.spec.source then
+    if hf : entries witness.ref = none then
+      if hp : witness.spec.Prerequisites entries then
+        if hc : witness.spec.type.Scope witness.spec.universes 0 then
+          if hr : witness.spec.type.ReferencesIn entries then do
+            let ht ← verifyType.{u,v} fuel witness.spec.universes entries []
+              witness.spec.type (.sort witness.level) witness.typing
+            return ⟨⟨hs, hf, hp, hc, hr, ht.down⟩⟩
+          else none
+        else none
+      else none
+    else none
+  else none
+
+theorem check_sound {fuel : Nat} {entries : Environment β} {store : Store β} {witness : Witness β}
+    {result} (_ : check.{u,v} fuel entries store witness = some result) :
+    Checked.{u,v} entries store witness := result.down
+
+def EntrySource (store : Store β) (ref : ConstRef β) (entry : ConstantEntry β) : Prop :=
+  ∃ spec : Spec β, store.lookup ref = some spec.source ∧ entry = spec.entry
+
+variable {entries : Environment β} {store : Store β} {witness : Witness β}
+
+theorem environment_wf (h : Checked.{u,v} entries store witness) (hE : entries.WF) :
+    (entries.insert witness.ref witness.spec.entry).WF := by
+  apply hE.insert h.scope (by simp [Spec.entry]) h.references
+    (by simp [Spec.entry]) (by simp [Spec.entry]) (by simp [Spec.entry])
+    (by simp [Spec.entry]) (by simp [Spec.entry])
+
+variable {V : Type v} [SetTheory V]
+
+noncomputable def assignment (constants : Assignment β V) (witness : Witness β) : Assignment β V :=
+  constants.insert witness.ref (witness.spec.value constants)
+
+theorem assignment_agrees (h : Checked.{u,v} entries store witness) (constants : Assignment β V) :
+    Assignment.AgreesOn entries constants (assignment constants witness) :=
+  Assignment.insert_agrees h.fresh _ _
+
+theorem assignment_realizes (h : Checked.{u,v} entries store witness) (hE : entries.WF)
+    (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (assignment constants witness) (entries.insert witness.ref witness.spec.entry) := by
+  have ha := assignment_agrees h constants
+  apply (hM.of_agrees hE ha).insert
+  constructor
+  · intro levels hn env
+    exact (h.typing V (assignment constants witness) (hM.of_agrees hE ha) levels env
+      (Context.valid_nil (assignment constants witness) levels env)).1
+  · intro levels hn env
+    change (assignment constants witness) witness.ref levels ∈ˢ
+      interp (assignment constants witness) levels env witness.spec.type
+    rw [ha.interp h.references]
+    rw [assignment, Assignment.insert_same]
+    exact witness.spec.value_mem h.prerequisites hM levels hn env
+  · intro body hb; cases hb
+  · intro body hb; cases hb
+  · intro law hl; simp only [Spec.entry, List.not_mem_nil] at hl
+  · intro fact hf; simp only [Spec.entry, List.not_mem_nil] at hf
+
+end Ix.Theory.Certified.Standard
diff --git a/Ix/Theory/Certified/Standard/Realization.lean b/Ix/Theory/Certified/Standard/Realization.lean
new file mode 100644
index 000000000..5a7d3e534
--- /dev/null
+++ b/Ix/Theory/Certified/Standard/Realization.lean
@@ -0,0 +1,127 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Basis.Iff
+import Ix.Theory.Certified.Basis.Nonempty
+
+/-! Realizations of the exact standard propext and choice types. Their
+prerequisite meanings follow from admitted inductive interfaces in every
+compatible prefix model, rather than being new semantic assumptions. -/
+
+namespace Ix.Theory.Certified.Standard
+
+open Model Model.SetTheory Model.SetModel Basis
+
+universe u v
+variable {β : Type u}
+
+inductive Spec (β : Type u) where
+  | propext (eq eqRefl eqRec iff iffIntro iffRec : ConstRef β)
+  | choice (nonempty intro recursor : ConstRef β)
+
+def Spec.universes : Spec β → Nat
+  | .propext .. => 0
+  | .choice .. => 1
+
+def propextType (eq iff : ConstRef β) : AExpr β :=
+  .forallE .always (.sort .zero) <| .forallE .always (.sort .zero) <|
+  .forallE .always (Iff.applied iff (.bvar 1) (.bvar 0)) <|
+    Equality.applied eq (.succ .zero) (.sort .zero) (.bvar 2) (.bvar 1)
+
+def choiceType (nonempty : ConstRef β) : AExpr β :=
+  .forallE (.param 0) (.sort (.param 0)) <|
+  .forallE (.param 0) (Nonempty.applied nonempty (.param 0) (.bvar 0)) (.bvar 1)
+
+def Spec.type : Spec β → AExpr β
+  | .propext eq _ _ iff _ _ => propextType eq iff
+  | .choice nonempty _ _ => choiceType nonempty
+
+def Spec.Prerequisites (entries : Environment β) : Spec β → Prop
+  | .propext eq eqRefl eqRec iff iffIntro iffRec =>
+    Equality.Interface entries eq eqRefl eqRec ∧ Iff.Interface entries iff iffIntro iffRec
+  | .choice nonempty intro recursor => Nonempty.Interface entries nonempty intro recursor
+
+instance [DecidableEq β] (entries : Environment β) (spec : Spec β) :
+    Decidable (spec.Prerequisites entries) := by cases spec <;> unfold Spec.Prerequisites <;> infer_instance
+
+def Spec.entry (spec : Spec β) : ConstantEntry β := ⟨spec.universes, spec.type, none, [], []⟩
+def Spec.source (spec : Spec β) : Const β := .axiom spec.universes spec.type.erase .safe
+
+variable {V : Type v} [SetTheory V]
+
+open Classical in
+noncomputable def chooseSet (A : V) : V :=
+  if h : ∃ a, a ∈ˢ A then Classical.choose h else empty
+
+theorem chooseSet_mem {A : V} (h : ∃ a, a ∈ˢ A) : chooseSet A ∈ˢ A := by
+  rw [chooseSet, dif_pos h]
+  exact Classical.choose_spec h
+
+noncomputable def choiceValue (constants : Assignment β V) (nonempty : ConstRef β) (u : Nat) : V :=
+  lamR (if u = 0 then 0 else 1) (univ u) (fun A =>
+    lamR (if u = 0 then 0 else 1) (Nonempty.value constants nonempty u A) (fun _ => chooseSet A))
+
+noncomputable def Spec.value (spec : Spec β) (constants : Assignment β V) (levels : List Nat) : V :=
+  match spec with
+  | .propext .. => pt
+  | .choice nonempty _ _ => choiceValue constants nonempty (levels.getD 0 0)
+
+theorem propextType_interp (constants : Assignment β V) (eq iff : ConstRef β) (env : Nat → V) :
+    interp constants [] env (propextType eq iff) =
+      piR 0 univZero (fun P => piR 0 univZero (fun Q =>
+        piR 0 (Iff.value constants iff P Q) (fun _ => Equality.value constants eq 1 univZero P Q))) := by
+  simp [propextType, Iff.applied, Equality.applied, Iff.value, Equality.value,
+    AExpr.appN, interp, VLevel.eval, Valuation.cons, univ_zero]
+
+theorem choiceType_interp (constants : Assignment β V) (nonempty : ConstRef β) (u : Nat) (env : Nat → V) :
+    interp constants [u] env (choiceType nonempty) =
+      piR (if u = 0 then 0 else 1) (univ u) (fun A =>
+        piR (if u = 0 then 0 else 1) (Nonempty.value constants nonempty u A) (fun _ => A)) := by
+  simp [choiceType, Nonempty.applied, Nonempty.value, interp, VLevel.eval, Valuation.cons,
+    regime, PropWhen.param, PropWhen.holds]
+
+theorem propextValue_mem {entries : Environment β} {constants : Assignment β V}
+    {eq eqRefl eqRec iff iffIntro iffRec : ConstRef β}
+    (hE : Equality.Interface entries eq eqRefl eqRec)
+    (hI : Iff.Interface entries iff iffIntro iffRec) (hM : Realizes constants entries) (env : Nat → V) :
+    (pt : V) ∈ˢ interp constants [] env (propextType eq iff) := by
+  rw [propextType_interp]
+  apply pt_mem_piR_zero_of
+  intro P hP
+  apply pt_mem_piR_zero_of
+  intro Q hQ
+  apply pt_mem_piR_zero_of
+  intro proof hp
+  rw [Equality.value_eq_eqv hE hM (by simpa only [univ_zero] using univ_mem_univ (V := V) 0) hP hQ]
+  have he := Iff.eq_of_mem hI hM hP hQ hp
+  subst Q
+  exact pt_mem_eqv_self _
+
+theorem choiceValue_mem {entries : Environment β} {constants : Assignment β V}
+    {nonempty intro recursor : ConstRef β}
+    (h : Nonempty.Interface entries nonempty intro recursor) (hM : Realizes constants entries)
+    (u : Nat) (env : Nat → V) :
+    choiceValue constants nonempty u ∈ˢ interp constants [u] env (choiceType nonempty) := by
+  rw [choiceType_interp]
+  apply lamR_mem
+  intro A hA
+  apply lamR_mem
+  intro proof hp
+  exact chooseSet_mem (Nonempty.exists_of_mem h hM hA hp)
+
+theorem Spec.value_mem {entries : Environment β} {constants : Assignment β V}
+    (spec : Spec β) (h : spec.Prerequisites entries) (hM : Realizes constants entries)
+    (levels : List Nat) (hn : levels.length = spec.universes) (env : Nat → V) :
+    spec.value constants levels ∈ˢ interp constants levels env spec.type := by
+  cases spec with
+  | propext eq eqRefl eqRec iff iffIntro iffRec =>
+    have he : levels = [] := List.length_eq_zero_iff.mp hn
+    subst levels
+    exact propextValue_mem h.1 h.2 hM env
+  | choice nonempty intro recursor =>
+    obtain ⟨u, rfl⟩ := List.length_eq_one_iff.mp hn
+    exact choiceValue_mem h hM u env
+
+end Ix.Theory.Certified.Standard
diff --git a/Ix/Theory/Certified/Store.lean b/Ix/Theory/Certified/Store.lean
new file mode 100644
index 000000000..2087aad95
--- /dev/null
+++ b/Ix/Theory/Certified/Store.lean
@@ -0,0 +1,69 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Admission
+
+/-! Certification of requested declarations, including data declarations.
+Logical proof acceptance additionally checks the requested proposition is in
+Prop. A declaration certificate constructs a compatible model for every
+requested type, body and admitted computation rule. -/
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure CheckedStore (signature : PrimitiveSignature β) (store : Store β)
+    (targets : List (ConstRef β)) where
+  environment : AdmittedEnvironment.{u,v} signature store
+  targetsPresent : ∀ r ∈ targets, (environment.entries r).isSome = true
+
+def checkStoreCertified (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (targets : List (ConstRef β)) (witness : List (DeclarationWitness β)) :
+    Option (CheckedStore.{u,v} signature store targets) := do
+  let initial ← initialize? signature store
+  let admitted ← admitDeclarations? fuel initial witness
+  if h : targets.all (fun r => (admitted.val.entries r).isSome) = true then
+    return ⟨admitted.val, List.all_eq_true.mp h⟩
+  else none
+
+def acceptsStoreCertified (fuel : Nat) (signature : PrimitiveSignature β) (store : Store β)
+    (targets : List (ConstRef β)) (witness : List (DeclarationWitness β)) : Bool :=
+  (checkStoreCertified.{u,v} fuel signature store targets witness).isSome
+
+/-- Successful admission constructs one compatible model for the entire
+requested interface, at every permitted universe instance. -/
+theorem accepted_store_has_model {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {targets : List (ConstRef β)} {witness : List (DeclarationWitness β)}
+    (h : acceptsStoreCertified.{u,v} fuel signature store targets witness = true)
+    (V : Type v) [SetTheory V] :
+    ∃ result : CheckedStore.{u,v} signature store targets,
+      checkStoreCertified fuel signature store targets witness = some result ∧
+      ∃ constants : Assignment β V,
+        signature.Compatible result.environment.entries constants ∧
+        ∀ r ∈ targets, ∃ entry, result.environment.entries r = some entry ∧
+          EntrySource signature store r entry ∧
+          ∀ levels, levels.length = entry.universes → ∀ env : Nat → V,
+            WellDenoted constants levels env entry.type ∧
+            constants r levels ∈ˢ interp constants levels env entry.type := by
+  unfold acceptsStoreCertified at h
+  cases hc : checkStoreCertified.{u,v} fuel signature store targets witness with
+  | none => simp [hc] at h
+  | some result =>
+    obtain ⟨constants, hM⟩ := result.environment.model V
+    refine ⟨result, rfl, constants, hM, ?_⟩
+    intro r hr
+    have present := result.targetsPresent r hr
+    cases he : result.environment.entries r with
+    | none => simp [he] at present
+    | some entry =>
+      refine ⟨entry, rfl, result.environment.source r entry he, ?_⟩
+      intro levels hl env
+      exact ⟨hM.realizes.typeValid r entry he levels hl env,
+        hM.realizes.member r entry he levels hl env⟩
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Structure/Admission.lean b/Ix/Theory/Certified/Structure/Admission.lean
new file mode 100644
index 000000000..894546f1f
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Admission.lean
@@ -0,0 +1,62 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Admission
+
+namespace Ix.Theory.Certified
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+/-- Construct the structure and its projection facts in one extension of the
+original prefix. This never strengthens an already admitted arbitrary model
+by assuming that it used this producer's concrete field representation. -/
+def checkStructureExtension? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : CheckedInterface signature) (witness : Structure.Witness β) :
+    Option (CheckedExtension.{u,v} signature store state) := do
+  let checked ← Structure.check.{u,v} fuel state.entries store witness
+  let d := witness.facts.description
+  let block := witness.facts.block
+  let entries := d.publishedEnvironment state.entries block.source block.recursor block.mode
+  have extension : Extends.{u,v} signature state.entries entries := by
+    constructor
+    · intro r entry hr
+      exact d.publishedEnvironment_old checked.down hr
+    · intro V _ constants hM
+      let constants' := d.ordinary.recursorAssignment constants block.source block.recursor block.mode
+      have hm := d.publishedAssignment_realizes checked.down state.wf constants hM.realizes
+      have ha := Ordinary.Shape.publishedAssignment_agrees checked.down.facts.block constants
+      exact ⟨constants', hM.extend signature state.present hm ha, ha⟩
+  let result : CheckedInterface signature := {
+    entries
+    wf := d.publishedEnvironment_wf checked.down state.wf
+    present := ⟨extension.lookup _ _ state.present.1, extension.lookup _ _ state.present.2⟩
+  }
+  return {
+    result, extension
+    source := by
+      intro r entry hr
+      dsimp only [result] at hr
+      rcases Structure.publishedEntry_source checked.down hr with hold | hordinary | hstructure
+      · exact Or.inl hold
+      · exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inl hordinary))))
+      · exact Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inr (Or.inl hstructure)))))))
+  }
+
+def admitStructure? (fuel : Nat) {signature : PrimitiveSignature β} {store : Store β}
+    (state : AdmittedEnvironment.{u,v} signature store) (witness : Structure.Witness β) :
+    Option { result : AdmittedEnvironment.{u,v} signature store //
+      Extends.{u,v} signature state.entries result.entries } := do
+  let checked ← checkStructureExtension?.{u,v} fuel (store := store) state.interface witness
+  return checked.admit state
+
+theorem admitStructure?_extends {fuel : Nat} {signature : PrimitiveSignature β} {store : Store β}
+    {state : AdmittedEnvironment.{u,v} signature store} {witness : Structure.Witness β} {result}
+    (_ : admitStructure? fuel state witness = some result) :
+    Extends.{u,v} signature state.entries result.val.entries := result.property
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Certified/Structure/Checked.lean b/Ix/Theory/Certified/Structure/Checked.lean
new file mode 100644
index 000000000..66cc121a2
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Checked.lean
@@ -0,0 +1,117 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Structure.Computation
+import Ix.Theory.Certified.Signature
+
+namespace Ix.Theory.Certified.Structure
+
+open Model
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def Description.factEntry (d : Description β) (source : β) : ConstantEntry β :=
+  { d.ordinary.familyEntry with facts := d.facts source }
+
+def Description.factEnvironment (d : Description β) (entries : Environment β) (source recursor : β)
+    (mode : Inductive.ElimMode) : Environment β :=
+  (d.ordinary.publishedEnvironment entries source recursor mode).insert (.member source 0) (d.factEntry source)
+
+/-- Field i may use the already produced equations for earlier fields when
+checking its dependent result. Its own equation is absent from this stage. -/
+def Description.iotaEnvironment (d : Description β) (entries : Environment β) (source recursor : β)
+    (mode : Inductive.ElimMode) (count : Nat) : Environment β :=
+  (d.ordinary.publishedEnvironment entries source recursor mode).insert (.member source 0)
+    { d.factEntry source with equations := ((d.equations source).drop 1).take count }
+
+structure FactsWitness (β : Type u) where
+  description : Description β
+  block : Ordinary.BlockWitness β
+  fields : List (TypingWitness β)
+  domains : List (DomainWitness β)
+
+structure FactsChecked (entries : Environment β) (store : Store β) (d : Description β)
+    (source recursor : β) (mode : Inductive.ElimMode) : Prop where
+  block : Ordinary.CheckedBlock.{u,v} entries store source recursor d.ordinary mode
+  fields : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields
+  domains : Telescope.Formed.{u,v} (d.ordinary.publishedEnvironment entries source recursor mode) []
+    (d.projectionDomains source)
+  scope : ∀ fact ∈ d.facts source, fact.Scope d.universes
+  references : ∀ fact ∈ d.facts source,
+    fact.ReferencesIn (d.ordinary.publishedEnvironment entries source recursor mode)
+
+def checkFacts (fuel : Nat) (entries : Environment β) (store : Store β) (witness : FactsWitness β) :
+    Option (CheckedClaim.{u} (FactsChecked.{u,v} entries store witness.description
+      witness.block.source witness.block.recursor witness.block.mode)) :=
+  let d := witness.description
+  let block := witness.block
+  if he : block.shape.shape = d.ordinary then
+    if hs : ∀ fact ∈ d.facts block.source, fact.Scope d.universes then
+      if hr : ∀ fact ∈ d.facts block.source,
+          fact.ReferencesIn (d.ordinary.publishedEnvironment entries block.source block.recursor block.mode) then do
+        let hb ← Ordinary.checkBlock.{u,v} fuel entries store block
+        let hf ← checkFields.{u,v} fuel d.universes entries d.level d.ordinary.parameterContext d.fields witness.fields
+        let hd ← verifyTelescope.{u,v} fuel d.universes
+          (d.ordinary.publishedEnvironment entries block.source block.recursor block.mode) none []
+          (d.projectionDomains block.source) witness.domains
+        return ⟨⟨he ▸ hb.down, hf.down, hd.down.1, hs, hr⟩⟩
+      else none
+    else none
+  else none
+
+def Description.etaRule (d : Description β) (source : β) : Signature.Rule β :=
+  ⟨d.universes, .forallN (zeroCondition d.level) (d.projectionDomains source)
+    (d.ordinary.familyApp source 1 []), d.etaLhs source, d.etaRhs source⟩
+
+def Description.iotaRule (d : Description β) (source : β) (i : Nat) (field : Field β) : Signature.Rule β :=
+  ⟨d.universes, .forallN (zeroCondition field.level) (d.parameters ++ d.constructor.fields)
+    (field.domain.liftN (d.fields.length - i)), d.iotaLhs source i field, d.iotaRhs i field⟩
+
+structure Witness (β : Type u) where
+  facts : FactsWitness β
+  eta : Signature.RuleWitness β
+  iota : List (Signature.RuleWitness β)
+
+structure Checked (entries : Environment β) (store : Store β) (d : Description β)
+    (source recursor : β) (mode : Inductive.ElimMode) : Prop where
+  facts : FactsChecked.{u,v} entries store d source recursor mode
+  eta : Signature.RuleFormed.{u,v} (d.factEnvironment entries source recursor mode) (d.etaRule source)
+  iota : ∀ field i, (field, i) ∈ d.fields.zipIdx →
+    Signature.RuleFormed.{u,v} (d.iotaEnvironment entries source recursor mode i) (d.iotaRule source i field)
+
+def checkIota (fuel : Nat) (entries : Environment β) (d : Description β) (source recursor : β)
+    (mode : Inductive.ElimMode) :
+    (fields : List (Field β × Nat)) → List (Signature.RuleWitness β) →
+      Option (CheckedClaim.{u} (∀ field i, (field, i) ∈ fields →
+        Signature.RuleFormed.{u,v} (d.iotaEnvironment entries source recursor mode i) (d.iotaRule source i field)))
+  | [], [] => some ⟨by simp⟩
+  | (field, i) :: fields, witness :: witnesses => do
+    let ht ← Signature.checkRule.{u,v} fuel (d.iotaEnvironment entries source recursor mode i) (d.iotaRule source i field) witness
+    let rest ← checkIota fuel entries d source recursor mode fields witnesses
+    return ⟨by
+      intro field' j hj
+      rcases List.mem_cons.mp hj with he | hj
+      · cases he; exact ht.down
+      · exact rest.down field' j hj⟩
+  | _, _ => none
+
+def check (fuel : Nat) (entries : Environment β) (store : Store β) (witness : Witness β) :
+    Option (CheckedClaim.{u} (Checked.{u,v} entries store witness.facts.description
+      witness.facts.block.source witness.facts.block.recursor witness.facts.block.mode)) := do
+  let facts ← checkFacts.{u,v} fuel entries store witness.facts
+  let d := witness.facts.description
+  let block := witness.facts.block
+  let stage := d.factEnvironment entries block.source block.recursor block.mode
+  let eta ← Signature.checkRule.{u,v} fuel stage (d.etaRule block.source) witness.eta
+  let iota ← checkIota.{u,v} fuel entries d block.source block.recursor block.mode d.fields.zipIdx witness.iota
+  return ⟨⟨facts.down, eta.down, iota.down⟩⟩
+
+theorem check_sound {fuel : Nat} {entries : Environment β} {store : Store β} {witness : Witness β}
+    {result} (_ : check.{u,v} fuel entries store witness = some result) :
+    Checked.{u,v} entries store witness.facts.description witness.facts.block.source
+      witness.facts.block.recursor witness.facts.block.mode := result.down
+
+end Ix.Theory.Certified.Structure
diff --git a/Ix/Theory/Certified/Structure/Computation.lean b/Ix/Theory/Certified/Structure/Computation.lean
new file mode 100644
index 000000000..a6fffc68f
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Computation.lean
@@ -0,0 +1,84 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Structure.Reading
+
+namespace Ix.Theory.Certified.Structure.Description
+
+open Model Model.SetTheory Model.SetTheory.Tower Model.SetModel Ordinary
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+  {d : Description β} {entries : Environment β} {store : Store β} {source : β}
+  {constants reading : Assignment β V} {levels : List Nat}
+
+theorem constructorApp_interp (h : CheckedShape.{u,v} entries store source d.ordinary)
+    (hr : ConstructorReading entries d.ordinary source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = d.universes) {ps xs : List V}
+    (hps : FitsS (Telescope.interpret constants levels (fun _ => empty) d.parameters) ps)
+    (hxs : FitsS (Telescope.interpret constants levels (Telescope.extend (fun _ => empty) ps) d.constructor.fields) xs)
+    (env : Nat → V) (args : List (AExpr β)) (hargs : args.map (interp reading levels env) = ps ++ xs) :
+    interp reading levels env (.appN (.const (.ctor source 0 0) (VLevel.params d.universes)) args) =
+      d.ordinary.constructorValue constants levels (Telescope.extend (fun _ => empty) ps) d.constructor 0 xs [] := by
+  rw [AExpr.interp_appN, interp, eval_params hn, hr.constructor levels hn 0 d.constructor rfl, hargs]
+  simpa only [List.append_nil] using Shape.constructorClosedValue_apply h hM
+    (show d.ordinary.constructors[0]? = some d.constructor from rfl) hps hxs
+    (show d.ordinary.RecursiveValuesFit constants levels (Telescope.extend (fun _ => empty) ps) d.constructor xs [] from trivial)
+
+theorem eta_eq (h : CheckedShape.{u,v} entries store source d.ordinary)
+    (hF : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields)
+    (hr : ConstructorReading entries d.ordinary source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = d.universes) :
+    interp reading levels (fun _ => empty) (d.etaLhs source) =
+      interp reading levels (fun _ => empty) (d.etaRhs source) := by
+  simp only [etaLhs, etaRhs, projectionDomains, AExpr.lamN_append, AExpr.interp_lamN,
+    hr.agrees.telescope (fun A hA => h.references A (by simpa [ordinary] using hA))]
+  apply Telescope.curry_congr
+  intro ps hps
+  change lamR _ (interp reading levels _ (d.ordinary.familyApp source 0 [])) _ = lamR _ _ _
+  apply lamR_congr
+  intro x hx
+  have he := Shape.familyApp_interp hr.toFamilyReading hn (extra := []) (indices := []) hps (by trivial)
+  have hx' : x ∈ˢ app (d.ordinary.carrier constants levels (Telescope.extend (fun _ => empty) ps)) pt := by
+    simpa only [List.length_nil, List.map_nil, mkTower, Telescope.extend] using he ▸ hx
+  have hΓ := h.parameters.valid constants hM levels (Context.valid_nil constants levels (fun _ => empty)) hps
+  have hxs := d.projections_fit h hF hM hΓ hx'
+  change interp reading levels (Valuation.cons x _) (.appN _ _) = x
+  rw [d.constructorApp_interp h hr hM hn hps hxs _ _ (by
+    rw [List.map_append, projections_interp, interp_parameterVars_skip,
+      Valuation.skip_succ_cons, Valuation.skip_zero, ← FitsS.length_eq hps, interp_parameterVars_extend]
+    rfl)]
+  exact d.constructor_eta h hM hΓ hx'
+
+theorem iota_eq (h : CheckedShape.{u,v} entries store source d.ordinary)
+    (hF : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields)
+    (hr : ConstructorReading entries d.ordinary source constants reading) (hM : Realizes constants entries)
+    (hn : levels.length = d.universes) {i : Nat} {field : Field β} (hi : d.fields[i]? = some field) :
+    interp reading levels (fun _ => empty) (d.iotaLhs source i field) =
+      interp reading levels (fun _ => empty) (d.iotaRhs i field) := by
+  simp only [iotaLhs, iotaRhs, AExpr.lamN_append, AExpr.interp_lamN,
+    hr.agrees.telescope (fun A hA => h.references A (by simpa [ordinary] using hA))]
+  apply Telescope.curry_congr
+  intro ps hps
+  rw [hr.agrees.telescope (fun A hA => (h.constructors d.constructor (by simp [ordinary])).1 A
+    (List.mem_append_left _ hA))]
+  apply Telescope.curry_congr
+  intro xs hxs
+  have hΓ := h.parameters.valid constants hM levels (Context.valid_nil constants levels (fun _ => empty)) hps
+  have hlen : xs.length = d.fields.length := by simpa [constructor] using FitsS.length_eq hxs
+  have hib := (List.getElem?_eq_some_iff.mp hi).1
+  change projectValue i (interp reading levels _ (.appN _ _)) = _
+  rw [d.constructorApp_interp h hr hM hn hps hxs _ _ (by
+    rw [← Telescope.extend_append]
+    have hlength : (ps ++ xs).length = d.parameters.length + d.fields.length := by
+      rw [List.length_append, FitsS.length_eq hps, hlen]
+    rw [← hlength, interp_parameterVars_extend])]
+  have he := congrArg (fun zs : List V => zs.getD i empty) (d.constructor_iota hF hM hΓ hxs)
+  rw [projectValues_getD _ _ _ hib] at he
+  rw [he]
+  symm
+  simpa only [interp, hlen] using Telescope.extend_getD (Telescope.extend (fun _ => empty) ps) xs i (by omega)
+
+end Ix.Theory.Certified.Structure.Description
diff --git a/Ix/Theory/Certified/Structure/Publish.lean b/Ix/Theory/Certified/Structure/Publish.lean
new file mode 100644
index 000000000..0360343c5
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Publish.lean
@@ -0,0 +1,161 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Structure.Checked
+
+namespace Ix.Theory.Certified.Structure
+
+open Model Model.SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+theorem ordinary_family_lookup {entries : Environment β} {store : Store β}
+    {source recursor : β} {shape : Ordinary.Shape β} {mode : Inductive.ElimMode}
+    (h : Ordinary.CheckedBlock.{u,v} entries store source recursor shape mode) :
+    shape.publishedEnvironment entries source recursor mode (.member source 0) = some shape.familyEntry := by
+  apply Environment.insert_old h.recursorChecked.fresh
+  simp [Ordinary.Shape.constructorEnvironment, Environment.overlay, Ordinary.Shape.constructorEntries,
+    Ordinary.Shape.familyEnvironment]
+
+namespace Description
+
+def publishedEntry (d : Description β) (source : β) : ConstantEntry β :=
+  { d.factEntry source with equations := d.equations source }
+
+def publishedEnvironment (d : Description β) (entries : Environment β) (source recursor : β)
+    (mode : Inductive.ElimMode) : Environment β :=
+  (d.ordinary.publishedEnvironment entries source recursor mode).insert (.member source 0) (d.publishedEntry source)
+
+variable {d : Description β} {entries : Environment β} {store : Store β}
+  {source recursor : β} {mode : Inductive.ElimMode}
+
+theorem iotaEnvironment_references {i : Nat} {e : AExpr β}
+    (h : e.ReferencesIn (d.iotaEnvironment entries source recursor mode i)) :
+    e.ReferencesIn (d.factEnvironment entries source recursor mode) := by
+  intro r hr
+  have he := h r hr
+  by_cases heq : r = .member source 0
+  · simp [factEnvironment, Environment.insert, heq]
+  · simpa only [iotaEnvironment, factEnvironment, Environment.insert, if_neg heq] using he
+
+theorem factEnvironment_wf (h : FactsChecked.{u,v} entries store d source recursor mode) (hE : entries.WF) :
+    (d.factEnvironment entries source recursor mode).WF := by
+  have hbase := Ordinary.Shape.publishedEnvironment_wf h.block hE
+  have hfam := ordinary_family_lookup h.block
+  exact hbase.insert (hbase.typeScope _ d.ordinary.familyEntry hfam) (by simp [factEntry, Ordinary.Shape.familyEntry])
+    (hbase.typeReferences _ d.ordinary.familyEntry hfam) (by simp [factEntry, Ordinary.Shape.familyEntry])
+    (by simp [factEntry, Ordinary.Shape.familyEntry]) (by simp [factEntry, Ordinary.Shape.familyEntry])
+    h.scope h.references
+
+theorem publishedEnvironment_wf (h : Checked.{u,v} entries store d source recursor mode) (hE : entries.WF) :
+    (d.publishedEnvironment entries source recursor mode).WF := by
+  have hbase := d.factEnvironment_wf h.facts hE
+  have hwf := hbase.insert (r := .member source 0) (entry := d.publishedEntry source)
+    (hbase.typeScope _ (d.factEntry source) (Environment.insert_same ..))
+    (by simp [publishedEntry, factEntry, Ordinary.Shape.familyEntry])
+    (hbase.typeReferences _ (d.factEntry source) (Environment.insert_same ..))
+    (by simp [publishedEntry, factEntry, Ordinary.Shape.familyEntry])
+    (by
+      intro law hl
+      rcases List.mem_cons.mp hl with he | hrest
+      · cases he; exact h.eta.scope.2
+      · obtain ⟨⟨field, i⟩, hfi, he⟩ := List.mem_map.mp hrest
+        cases he
+        exact (h.iota field i hfi).scope.2)
+    (by
+      intro law hl
+      rcases List.mem_cons.mp hl with he | hrest
+      · cases he; exact h.eta.references.2
+      · obtain ⟨⟨field, i⟩, hfi, he⟩ := List.mem_map.mp hrest
+        cases he
+        exact ⟨iotaEnvironment_references (h.iota field i hfi).references.2.1,
+          iotaEnvironment_references (h.iota field i hfi).references.2.2⟩)
+    h.facts.scope (fun fact hf => (h.facts.references fact hf).insert)
+  simpa only [publishedEnvironment, factEnvironment, Environment.insert_replace] using hwf
+
+theorem publishedEnvironment_old (h : Checked.{u,v} entries store d source recursor mode)
+    {r : ConstRef β} {entry : ConstantEntry β} (hr : entries r = some entry) :
+    d.publishedEnvironment entries source recursor mode r = some entry := by
+  simp only [publishedEnvironment, Environment.insert,
+    if_neg (fresh_ne (h.facts.block.shapeChecked.fresh _ (List.mem_cons_self ..)) hr)]
+  exact Ordinary.Shape.publishedEnvironment_old h.facts.block hr
+
+variable {V : Type v} [SetTheory V]
+
+theorem factAssignment_realizes (h : FactsChecked.{u,v} entries store d source recursor mode)
+    (hE : entries.WF) (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (d.ordinary.recursorAssignment constants source recursor mode)
+      (d.factEnvironment entries source recursor mode) := by
+  have hbase := Ordinary.Shape.publishedAssignment_realizes h.block hE constants hM
+  have hr := Ordinary.Shape.recursorAssignment_reading h.block.shapeChecked h.block.recursorChecked constants
+  apply hbase.insert
+  constructor
+  · exact hbase.typeValid _ d.ordinary.familyEntry (ordinary_family_lookup h.block)
+  · exact hbase.member _ d.ordinary.familyEntry (ordinary_family_lookup h.block)
+  · intro body hb; cases hb
+  · intro body hb; cases hb
+  · intro law hl; cases hl
+  · intro fact hf levels hn env
+    obtain ⟨⟨field, i⟩, hi, rfl⟩ := List.mem_map.mp hf
+    have hscope := h.scope _ (List.mem_map.mpr ⟨(field, i), hi, rfl⟩)
+    exact d.projection_meaning h.block.shapeChecked h.fields hr.toFamilyReading hM hn hbase h.domains
+      (List.mk_mem_zipIdx_iff_getElem?.mp hi) hscope env
+
+theorem publishedAssignment_realizes (h : Checked.{u,v} entries store d source recursor mode)
+    (hE : entries.WF) (constants : Assignment β V) (hM : Realizes constants entries) :
+    Realizes (d.ordinary.recursorAssignment constants source recursor mode)
+      (d.publishedEnvironment entries source recursor mode) := by
+  have hbase := d.factAssignment_realizes h.facts hE constants hM
+  have hr := Ordinary.Shape.recursorAssignment_reading h.facts.block.shapeChecked h.facts.block.recursorChecked constants
+  have hlocal : EntryRealization (d.ordinary.recursorAssignment constants source recursor mode)
+      (.member source 0) (d.publishedEntry source) := by
+    constructor
+    · exact hbase.typeValid _ (d.factEntry source) (Environment.insert_same ..)
+    · exact hbase.member _ (d.factEntry source) (Environment.insert_same ..)
+    · intro body hb; cases hb
+    · intro body hb; cases hb
+    · intro law hl levels hn env
+      rcases List.mem_cons.mp hl with he | hrest
+      · cases he
+        exact (interp_closed (d.etaLhs source) _ levels h.eta.scope.2.1 (fun _ => empty) env).symm.trans
+          ((d.eta_eq h.facts.block.shapeChecked h.facts.fields hr.toConstructorReading hM hn).trans
+            (interp_closed (d.etaRhs source) _ levels h.eta.scope.2.2 (fun _ => empty) env))
+      · obtain ⟨⟨field, i⟩, hfi, he⟩ := List.mem_map.mp hrest
+        cases he
+        exact (interp_closed (d.iotaLhs source i field) _ levels (h.iota field i hfi).scope.2.1 (fun _ => empty) env).symm.trans
+          ((d.iota_eq h.facts.block.shapeChecked h.facts.fields hr.toConstructorReading hM hn
+            (List.mk_mem_zipIdx_iff_getElem?.mp hfi)).trans
+            (interp_closed (d.iotaRhs i field) _ levels (h.iota field i hfi).scope.2.2 (fun _ => empty) env))
+    · exact hbase.factMeaning _ (d.factEntry source) (Environment.insert_same ..)
+  simpa only [publishedEnvironment, factEnvironment, Environment.insert_replace] using hbase.insert hlocal
+
+end Description
+
+/-- The enhanced family entry has an exact source shape and exact recursor;
+the projection facts and equations are wholly computed from that shape. -/
+def EntrySource (store : Store β) (r : ConstRef β) (entry : ConstantEntry β) : Prop :=
+  ∃ d : Description β, ∃ source recursor mode,
+    store.blocks source = some ⟨[d.ordinary.source source]⟩ ∧
+    d.ordinary.RecursorSourceMatches store source recursor mode ∧
+    r = .member source 0 ∧ entry = d.publishedEntry source
+
+theorem publishedEntry_source {entries : Environment β} {store : Store β}
+    {d : Description β} {source recursor : β} {mode : Inductive.ElimMode}
+    (h : Checked.{u,v} entries store d source recursor mode) {r : ConstRef β} {entry : ConstantEntry β}
+    (hr : d.publishedEnvironment entries source recursor mode r = some entry) :
+    entries r = some entry ∨ Ordinary.EntrySource store r entry ∨ EntrySource store r entry := by
+  unfold Description.publishedEnvironment Environment.insert at hr
+  split at hr
+  next he =>
+    cases Option.some.inj hr
+    exact Or.inr (Or.inr ⟨d, source, recursor, mode, h.facts.block.shapeChecked.exactSource,
+      h.facts.block.recursorChecked.exactSource, he, rfl⟩)
+  next =>
+    rcases Ordinary.publishedEntry_source h.facts.block hr with hold | hnew
+    · exact Or.inl hold
+    · exact Or.inr (Or.inl hnew)
+
+end Ix.Theory.Certified.Structure
diff --git a/Ix/Theory/Certified/Structure/Reading.lean b/Ix/Theory/Certified/Structure/Reading.lean
new file mode 100644
index 000000000..8d2c2b7ec
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Reading.lean
@@ -0,0 +1,149 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Structure.Value
+
+namespace Ix.Theory.Certified.Structure
+
+open Model Model.SetTheory Model.SetTheory.Tower
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+theorem FieldsFormed.field_reading {entries : Environment β} {w : VLevel} {Γ : Context β}
+    {fields : List (Field β)} (h : FieldsFormed.{u,v} entries w Γ fields)
+    (constants : Assignment β V) (hM : Realizes constants entries) (levels : List Nat)
+    {env : Nat → V} (hΓ : Γ.Valid constants levels env) {xs : List V}
+    (hxs : FitsS (Telescope.interpret constants levels env (fields.map Field.domain)) xs)
+    {i : Nat} {field : Field β} (hf : fields[i]? = some field) :
+    WellDenoted constants levels (Telescope.extend env (xs.take i)) field.domain ∧
+      interp constants levels (Telescope.extend env (xs.take i)) field.domain ∈ˢ
+        (univ (field.level.eval levels) : V) ∧
+      xs.getD i empty ∈ˢ interp constants levels (Telescope.extend env (xs.take i)) field.domain := by
+  induction h generalizing env xs i with
+  | nil => simp at hf
+  | @cons Γ head rest hA hz htail ih =>
+    cases xs with
+    | nil => exact hxs.elim
+    | cons x xs =>
+      have ht := hA V constants hM levels env hΓ
+      cases i with
+      | zero =>
+        cases Option.some.inj hf
+        exact ⟨ht.1, ht.2.2, hxs.1⟩
+      | succ i =>
+        exact ih (hΓ.push ht.1 hxs.1) hxs.2 hf
+
+theorem projections_interp (source : β) (count : Nat) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) :
+    (projections source count).map (interp constants levels env) = projectValues count (env 0) := by
+  apply List.ext_get (by simp [projections, projectValues_length])
+  intro i hi hj
+  have hic : i < count := by simpa [projections] using hi
+  simpa only [List.get_eq_getElem, projections, List.getElem_map, List.getElem_range, interp, projectValue, projectValues] using
+    (projList_get count i (ssnd (sfst (env 0))) hic).symm
+
+theorem projectionValuation (env : Nat → V) (x : V) (i : Nat) :
+    Valuation.skip 1 i (Telescope.extend (Valuation.cons x env) (projectValues i x)) =
+      Telescope.extend env (projectValues i x) := by
+  simpa only [projectValues_length, Nat.add_zero, Valuation.skip_succ_cons, Valuation.skip_zero] using
+    Telescope.skip_extend_at (Valuation.cons x env) (projectValues i x) 1 0
+
+theorem fieldResult_interp (source : β) (i : Nat) (field : Field β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (x : V) :
+    interp constants levels (Valuation.cons x env) (fieldResult source i field) =
+      interp constants levels (Telescope.extend env (projectValues i x)) field.domain := by
+  rw [fieldResult, AExpr.interp_instRev, projections_interp, interp_liftN]
+  exact congrArg (fun env => interp constants levels env field.domain) (projectionValuation env x i)
+
+theorem fieldResult_wellDenoted (source : β) (i : Nat) (field : Field β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (x : V)
+    (hf : WellDenoted constants levels (Telescope.extend env (projectValues i x)) field.domain) :
+    WellDenoted constants levels (Valuation.cons x env) (fieldResult source i field) := by
+  apply AExpr.wellDenoted_instRev
+  · intro e he
+    obtain ⟨j, _, rfl⟩ := List.mem_map.mp he
+    trivial
+  · rw [projections_interp, wellDenoted_liftN]
+    simpa only [Valuation.cons, projectionValuation] using hf
+
+namespace Description
+
+variable {d : Description β} {entries : Environment β} {store : Store β} {source : β}
+  {constants reading : Assignment β V} {levels : List Nat}
+
+/-- The dependent result uses the projections of the very same major value.
+Its formation is derived from the checked field telescope in the old model. -/
+theorem fieldResult_meaning (h : Ordinary.CheckedShape.{u,v} entries store source d.ordinary)
+    (hF : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields)
+    (hr : Ordinary.FamilyReading entries d.ordinary source constants reading)
+    (hM : Realizes constants entries) {env : Nat → V}
+    (hΓ : d.ordinary.parameterContext.Valid constants levels env) {i : Nat} {field : Field β}
+    (hi : d.fields[i]? = some field) {x : V}
+    (hx : x ∈ˢ app (d.ordinary.carrier constants levels env) pt) :
+    WellDenoted reading levels (Valuation.cons x env) (fieldResult source i field) ∧
+      interp reading levels (Valuation.cons x env) (fieldResult source i field) ∈ˢ
+        (univ (field.level.eval levels) : V) ∧
+      projectValue i x ∈ˢ interp reading levels (Valuation.cons x env) (fieldResult source i field) := by
+  have hib := (List.getElem?_eq_some_iff.mp hi).1
+  have hxs := d.projections_fit h hF hM hΓ hx
+  have ht := hF.field_reading constants hM levels hΓ hxs hi
+  rw [projectValues_take _ _ _ (Nat.le_of_lt hib), projectValues_getD _ _ _ hib] at ht
+  have href : field.domain.ReferencesIn entries :=
+    (h.constructors d.constructor (by simp [ordinary])).1 field.domain
+      (by simpa [constructor] using List.mem_map.mpr ⟨field, List.mem_of_getElem? hi, rfl⟩)
+  refine ⟨fieldResult_wellDenoted source i field reading levels env x ?_, ?_, ?_⟩
+  · exact (hr.agrees.wellDenoted href levels _).mpr ht.1
+  · rw [fieldResult_interp, hr.agrees.interp href]
+    exact ht.2.1
+  · rw [fieldResult_interp, hr.agrees.interp href]
+    exact ht.2.2
+
+theorem projection_meaning (h : Ordinary.CheckedShape.{u,v} entries store source d.ordinary)
+    (hF : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields)
+    (hr : Ordinary.FamilyReading entries d.ordinary source constants reading)
+    (hM : Realizes constants entries) (hn : levels.length = d.universes)
+    {stage : Environment β} (hstage : Realizes reading stage)
+    (hD : Telescope.Formed.{u,v} stage [] (d.projectionDomains source))
+    {i : Nat} {field : Field β} (hi : d.fields[i]? = some field)
+    (hs : (d.projection source i field).Scope d.universes 0 ∧
+      (d.projectionType source i field).Scope d.universes 0) (env : Nat → V) :
+    (ConstantFact.typed (d.projection source i field) (d.projectionType source i field)).Meaning
+      reading (.member source 0) levels env := by
+  obtain ⟨_, _, ht⟩ := hD.lamN_semantics reading hstage levels
+    (.proj (.member source 0) i (.bvar 0)) (fieldResult source i field) field.level
+  have hm := ht (fun _ => empty) (Context.valid_nil reading levels (fun _ => empty)) (by
+    intro args hargs
+    obtain ⟨ps, zs, rfl, hps, hzs⟩ := (Telescope.fits_append_iff reading levels (fun _ => empty)
+      d.parameters [d.ordinary.familyApp source 0 []] args).mp hargs
+    have hp := hr.agrees.telescope (fun A hA => h.references A (by simpa [ordinary] using hA)) levels (fun _ => empty)
+    rw [hp] at hps
+    cases zs with
+    | nil => exact hzs.elim
+    | cons x rest =>
+      cases rest with
+      | cons _ _ => exact hzs.2.elim
+      | nil =>
+        have he := Ordinary.Shape.familyApp_interp hr hn (extra := []) (indices := []) hps (by trivial)
+        have hx : x ∈ˢ app (d.ordinary.carrier constants levels (Telescope.extend (fun _ => empty) ps)) pt := by
+          simpa only [List.length_nil, List.map_nil, mkTower, Telescope.extend] using he ▸ hzs.1
+        have hΓ := h.parameters.valid constants hM levels (Context.valid_nil constants levels (fun _ => empty)) hps
+        have ht := d.fieldResult_meaning h hF hr hM hΓ hi hx
+        simpa only [Telescope.extend_append, Telescope.extend, interp, Valuation.cons_zero, WellDenoted] using
+          (show True ∧ WellDenoted reading levels (Valuation.cons x (Telescope.extend (fun _ => empty) ps))
+              (fieldResult source i field) ∧
+            projectValue i x ∈ˢ interp reading levels (Valuation.cons x (Telescope.extend (fun _ => empty) ps))
+              (fieldResult source i field) ∧
+            interp reading levels (Valuation.cons x (Telescope.extend (fun _ => empty) ps))
+              (fieldResult source i field) ∈ˢ (univ (field.level.eval levels) : V) from
+            ⟨trivial, ht.1, ht.2.2, ht.2.1⟩))
+  refine ⟨(wellDenoted_closed _ reading levels hs.1 (fun _ => empty) env).mp hm.1,
+    (wellDenoted_closed _ reading levels hs.2 (fun _ => empty) env).mp hm.2.1, ?_⟩
+  rw [← interp_closed _ reading levels hs.1 (fun _ => empty) env,
+    ← interp_closed _ reading levels hs.2 (fun _ => empty) env]
+  exact hm.2.2.1
+
+end Description
+end Ix.Theory.Certified.Structure
diff --git a/Ix/Theory/Certified/Structure/Syntax.lean b/Ix/Theory/Certified/Structure/Syntax.lean
new file mode 100644
index 000000000..92d513150
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Syntax.lean
@@ -0,0 +1,111 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Ordinary.Checked
+import Ix.Theory.Model.TelescopeSemantics
+
+namespace Ix.Theory.Certified.Structure
+
+open Model
+
+universe u v
+variable {β : Type u}
+
+structure Field (β : Type u) where
+  domain : AExpr β
+  level : VLevel
+deriving DecidableEq
+
+/-- A single nonrecursive constructor with dependent fields. The additional
+field sorts license projections out of a proof-valued structure. -/
+structure Description (β : Type u) where
+  universes : Nat
+  parameters : List (AExpr β)
+  fields : List (Field β)
+  level : VLevel
+deriving DecidableEq
+
+def Description.constructor (d : Description β) : Ordinary.Constructor β :=
+  ⟨d.fields.map Field.domain, [], []⟩
+
+def Description.ordinary (d : Description β) : Ordinary.Shape β :=
+  ⟨d.universes, d.parameters, [], d.level, [d.constructor]⟩
+
+def projections (source : β) (count : Nat) : List (AExpr β) :=
+  (List.range count).map fun i => .proj (.member source 0) i (.bvar 0)
+
+/-- Insert the major premise below preceding fields, then substitute their
+actual projections in outermost-first order. -/
+def fieldResult (source : β) (index : Nat) (field : Field β) : AExpr β :=
+  (field.domain.liftN 1 index).instRev (projections source index)
+
+def Description.projectionDomains (d : Description β) (source : β) : List (AExpr β) :=
+  d.parameters ++ [d.ordinary.familyApp source 0 []]
+
+def Description.projection (d : Description β) (source : β) (i : Nat) (field : Field β) : AExpr β :=
+  .lamN (zeroCondition field.level) (d.projectionDomains source) (.proj (.member source 0) i (.bvar 0))
+
+def Description.projectionType (d : Description β) (source : β) (i : Nat) (field : Field β) : AExpr β :=
+  .forallN (zeroCondition field.level) (d.projectionDomains source) (fieldResult source i field)
+
+def Description.facts (d : Description β) (source : β) : List (ConstantFact β) :=
+  d.fields.zipIdx.map fun (field, i) => .typed (d.projection source i field) (d.projectionType source i field)
+
+def Description.etaLhs (d : Description β) (source : β) : AExpr β :=
+  .lamN (zeroCondition d.level) (d.projectionDomains source)
+    (.appN (.const (.ctor source 0 0) (VLevel.params d.universes))
+      (Ordinary.parameterVars 1 d.parameters.length ++ projections source d.fields.length))
+
+def Description.etaRhs (d : Description β) (source : β) : AExpr β :=
+  .lamN (zeroCondition d.level) (d.projectionDomains source) (.bvar 0)
+
+def Description.iotaLhs (d : Description β) (source : β) (i : Nat) (field : Field β) : AExpr β :=
+  .lamN (zeroCondition field.level) (d.parameters ++ d.constructor.fields)
+    (.proj (.member source 0) i (.appN (.const (.ctor source 0 0) (VLevel.params d.universes))
+      (Ordinary.parameterVars 0 (d.parameters.length + d.fields.length))))
+
+def Description.iotaRhs (d : Description β) (i : Nat) (field : Field β) : AExpr β :=
+  .lamN (zeroCondition field.level) (d.parameters ++ d.constructor.fields)
+    (.bvar (d.fields.length - 1 - i))
+
+def Description.equations (d : Description β) (source : β) : List (ConstantEquation β) :=
+  ⟨d.etaLhs source, d.etaRhs source⟩ :: d.fields.zipIdx.map fun (field, i) =>
+    ⟨d.iotaLhs source i field, d.iotaRhs i field⟩
+
+inductive FieldsFormed (entries : Environment β) (w : VLevel) : Context β → List (Field β) → Prop
+  | nil {Γ} : FieldsFormed entries w Γ []
+  | cons {Γ field rest}
+      (domain : TypingClaim.{u,v} entries Γ field.domain (.sort field.level))
+      (proofField : ∀ levels, w.eval levels = 0 → field.level.eval levels = 0)
+      (tail : FieldsFormed entries w (Γ.push field.domain) rest) :
+      FieldsFormed entries w Γ (field :: rest)
+
+theorem FieldsFormed.formed {entries : Environment β} {w : VLevel} {Γ : Context β}
+    {fields : List (Field β)} (h : FieldsFormed.{u,v} entries w Γ fields) :
+    Telescope.Formed.{u,v} entries Γ (fields.map Field.domain) := by
+  induction h with
+  | nil => exact .nil
+  | cons hA _ _ ih => exact .cons _ hA ih
+
+theorem FieldsFormed.prop {entries : Environment β} {w : VLevel} {Γ : Context β}
+    {fields : List (Field β)} (h : FieldsFormed.{u,v} entries w Γ fields) :
+    TelescopeProp.{u,v} entries Γ (fields.map Field.domain) w := by
+  induction h with
+  | nil => exact TelescopeProp.nil entries _ w
+  | cons hA hz _ ih => exact TelescopeProp.cons hA hz ih
+
+def checkFields [DecidableEq β] (fuel n : Nat) (entries : Environment β) (w : VLevel) :
+    (Γ : Context β) → (fields : List (Field β)) → List (TypingWitness β) →
+      Option (CheckedClaim.{u} (FieldsFormed.{u,v} entries w Γ fields))
+  | _, [], [] => some ⟨.nil⟩
+  | Γ, field :: fields, witness :: witnesses =>
+    if hz : checkZeroImplies w field.level = true then do
+      let hA ← verifyType.{u,v} fuel n entries Γ field.domain (.sort field.level) witness
+      let rest ← checkFields fuel n entries w (Γ.push field.domain) fields witnesses
+      return ⟨.cons hA.down (checkZeroImplies_sound hz) rest.down⟩
+    else none
+  | _, _, _ => none
+
+end Ix.Theory.Certified.Structure
diff --git a/Ix/Theory/Certified/Structure/Value.lean b/Ix/Theory/Certified/Structure/Value.lean
new file mode 100644
index 000000000..0595f507a
--- /dev/null
+++ b/Ix/Theory/Certified/Structure/Value.lean
@@ -0,0 +1,141 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Structure.Syntax
+
+namespace Ix.Theory.Certified.Structure
+
+open Model Model.SetTheory Model.SetTheory.Tower
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def projectValues (count : Nat) (x : V) : List V :=
+  projList count (ssnd (sfst x))
+
+theorem projectValues_length (count : Nat) (x : V) :
+    (projectValues count x).length = count := projList_length ..
+
+theorem projectValues_getD (count i : Nat) (x : V) (hi : i < count) :
+    (projectValues count x).getD i empty = projectValue i x := by
+  rw [List.getD_eq_getElem?_getD, List.getElem?_eq_getElem
+    (show i < (projectValues count x).length by simpa only [projectValues_length] using hi), Option.getD_some]
+  exact projList_get count i (ssnd (sfst x)) hi
+
+theorem projectValues_take (count i : Nat) (x : V) (hi : i ≤ count) :
+    (projectValues count x).take i = projectValues i x := projList_take count i _ hi
+
+theorem projectValues_node (count : Nat) (xs : List V) (hlen : xs.length = count) (g : V) :
+    projectValues count (spair (inj 0 (mkTower xs)) g) = xs := by
+  simp only [projectValues, sfst_spair, ssnd_inj, projList_mkTower _ _ hlen]
+
+theorem projectValues_pt (count : Nat) :
+    projectValues count (pt : V) = List.replicate count pt := by
+  simp only [projectValues, sfst_pt, ssnd_pt, projList_pt]
+
+namespace Description
+
+variable (d : Description β) (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+
+theorem positions_empty (xs : List V) (hlen : xs.length = d.constructor.fields.length) :
+    d.ordinary.positions constants levels env (inj 0 (mkTower xs)) = empty := by
+  apply ext
+  intro p
+  constructor
+  · intro hp
+    obtain ⟨j, field, _, hj, _, _⟩ := Ordinary.Shape.mem_positions
+      (show d.ordinary.constructors[0]? = some d.constructor from rfl) hlen hp
+    simp [constructor] at hj
+  · intro hp
+    exact (not_mem_empty p hp).elim
+
+theorem branches_empty (xs : List V) (hlen : xs.length = d.constructor.fields.length) :
+    d.ordinary.branches constants levels env d.constructor 0 xs [] = empty := by
+  rw [Ordinary.Shape.branches, d.positions_empty constants levels env xs hlen]
+  apply ext
+  intro p
+  constructor
+  · intro hp
+    obtain ⟨x, hx, _⟩ := mem_graph.mp hp
+    exact (not_mem_empty x hx).elim
+  · intro hp
+    exact (not_mem_empty p hp).elim
+
+theorem constructorValue_eq (xs : List V) (hlen : xs.length = d.constructor.fields.length) :
+    d.ordinary.constructorValue constants levels env d.constructor 0 xs [] =
+      IndexedContainer.node (d.level.eval levels) (inj 0 (mkTower xs)) empty := by
+  rw [Ordinary.Shape.constructorValue, d.branches_empty constants levels env xs hlen]
+  rfl
+
+variable {d constants levels env} {entries : Environment β} {store : Store β} {source : β}
+
+theorem carrier_member (h : Ordinary.CheckedShape.{u,v} entries store source d.ordinary)
+    (hM : Realizes constants entries) (hΓ : d.ordinary.parameterContext.Valid constants levels env)
+    {x : V} (hx : x ∈ˢ app (d.ordinary.carrier constants levels env) pt) :
+    ∃ xs, FitsS (Telescope.interpret constants levels env d.constructor.fields) xs ∧
+      x = IndexedContainer.node (d.level.eval levels) (inj 0 (mkTower xs)) empty := by
+  rw [Ordinary.Shape.carrier, IndexedContainer.carrier_eq (Ordinary.Shape.container_wf h hM hΓ)
+    (show (pt : V) ∈ˢ (d.ordinary.container constants levels env).indices from pt_mem_unitSet)] at hx
+  obtain ⟨a, ha, g, hg, rfl⟩ := IndexedContainer.mem_fibre.mp hx
+  obtain ⟨i, ctor, xs, hc, hxs, rfl⟩ := Ordinary.Shape.mem_allShapes (mem_sep.mp ha).1
+  have hi : i = 0 := by
+    have hi := (List.getElem?_eq_some_iff.mp hc).1
+    simp only [ordinary, List.length_singleton] at hi
+    omega
+  subst i
+  have he : ctor = d.constructor := by simpa only [ordinary, List.getElem?_cons_zero, Option.some.injEq] using hc.symm
+  subst ctor
+  have hg' : g = empty := by
+    change g ∈ˢ piSet (d.ordinary.positions constants levels env _) _ at hg
+    rw [d.positions_empty constants levels env xs (FitsS.length_eq hxs)] at hg
+    rw [← eq_graph_app_of_mem_piSet hg]
+    apply ext
+    intro p
+    constructor
+    · intro hp
+      obtain ⟨x, hx, _⟩ := mem_graph.mp hp
+      exact (not_mem_empty x hx).elim
+    · intro hp
+      exact (not_mem_empty p hp).elim
+  exact ⟨xs, hxs, congrArg (IndexedContainer.node (d.level.eval levels) (inj 0 (mkTower xs))) hg'⟩
+
+theorem projections_fit (h : Ordinary.CheckedShape.{u,v} entries store source d.ordinary)
+    (hF : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields)
+    (hM : Realizes constants entries) (hΓ : d.ordinary.parameterContext.Valid constants levels env)
+    {x : V} (hx : x ∈ˢ app (d.ordinary.carrier constants levels env) pt) :
+    FitsS (Telescope.interpret constants levels env d.constructor.fields) (projectValues d.fields.length x) := by
+  obtain ⟨xs, hxs, rfl⟩ := carrier_member h hM hΓ hx
+  have hlen : xs.length = d.fields.length := by simpa [constructor] using FitsS.length_eq hxs
+  by_cases hw : d.level.eval levels = 0
+  · rw [IndexedContainer.node, if_pos hw, projectValues_pt]
+    simpa only [constructor, List.length_map] using fitsS_replicate_of_prop (hF.prop V constants hM levels env hΓ hw) hxs
+  · rw [IndexedContainer.node, if_neg hw, projectValues_node _ xs hlen]
+    exact hxs
+
+theorem constructor_eta (h : Ordinary.CheckedShape.{u,v} entries store source d.ordinary)
+    (hM : Realizes constants entries) (hΓ : d.ordinary.parameterContext.Valid constants levels env)
+    {x : V} (hx : x ∈ˢ app (d.ordinary.carrier constants levels env) pt) :
+    d.ordinary.constructorValue constants levels env d.constructor 0 (projectValues d.fields.length x) [] = x := by
+  obtain ⟨xs, hxs, rfl⟩ := carrier_member h hM hΓ hx
+  rw [d.constructorValue_eq constants levels env _ (by simp [constructor, projectValues_length])]
+  by_cases hw : d.level.eval levels = 0
+  · simp only [IndexedContainer.node, if_pos hw]
+  · simp only [IndexedContainer.node, if_neg hw,
+      projectValues_node _ xs (by simpa [constructor] using FitsS.length_eq hxs)]
+
+theorem constructor_iota (hF : FieldsFormed.{u,v} entries d.level d.ordinary.parameterContext d.fields)
+    (hM : Realizes constants entries) (hΓ : d.ordinary.parameterContext.Valid constants levels env)
+    {xs : List V} (hxs : FitsS (Telescope.interpret constants levels env d.constructor.fields) xs) :
+    projectValues d.fields.length (d.ordinary.constructorValue constants levels env d.constructor 0 xs []) = xs := by
+  have hlen := FitsS.length_eq hxs
+  rw [d.constructorValue_eq constants levels env xs hlen]
+  by_cases hw : d.level.eval levels = 0
+  · rw [IndexedContainer.node, if_pos hw, projectValues_pt]
+    exact Telescope.fits_unique_of_prop (hF.prop V constants hM levels env hΓ hw)
+      (by simpa only [List.length_map] using fitsS_replicate_of_prop (hF.prop V constants hM levels env hΓ hw) hxs) hxs
+  · rw [IndexedContainer.node, if_neg hw, projectValues_node _ xs (by simpa [constructor] using hlen)]
+
+end Description
+end Ix.Theory.Certified.Structure
diff --git a/Ix/Theory/Certified/Telescope.lean b/Ix/Theory/Certified/Telescope.lean
new file mode 100644
index 000000000..06c831053
--- /dev/null
+++ b/Ix/Theory/Certified/Telescope.lean
@@ -0,0 +1,172 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Checker
+import Ix.Theory.Model.Inductive.Telescope
+
+namespace Ix.Theory.Certified
+
+open Model Model.SetTheory Model.SetTheory.Tower
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+structure DomainWitness (β : Type u) where
+  level : VLevel
+  typing : TypingWitness β
+
+/-- A positive carrier bounds each field domain. Prop carriers may quantify
+over larger domains; this does not by itself license large elimination. -/
+def checkDomainBound (n : Nat) (bound : Option VLevel) (level : VLevel) : Bool :=
+  match bound with
+  | none => true
+  | some w => LevelEq.check n w .zero || LevelEq.check n (.max level w) w
+
+theorem checkDomainBound_sound {n : Nat} {bound : Option VLevel} {level : VLevel}
+    (h : checkDomainBound n bound level = true) :
+    ∀ w, bound = some w → ∀ levels,
+      w.eval levels ≠ 0 → level.eval levels ≤ w.eval levels := by
+  intro w hw levels hpos
+  subst bound
+  simp only [checkDomainBound, Bool.or_eq_true] at h
+  rcases h with h | h
+  · exact (hpos ((LevelEq.check_sound h).2.2 levels)).elim
+  · have he := (LevelEq.check_sound h).2.2 levels
+    change max (level.eval levels) (w.eval levels) = w.eval levels at he
+    exact he ▸ Nat.le_max_left _ _
+
+/-- Bounds are consequences of checked field sorts, uniformly over every
+compatible model and satisfying prefix. -/
+def TelescopeBound (entries : Environment β) (Γ : Context β) (domains : List (AExpr β))
+    (bound : Option VLevel) : Prop :=
+  ∀ w, bound = some w → ∀ (V : Type v) [SetTheory V] (constants : Assignment β V),
+    Realizes constants entries → ∀ levels env, Γ.Valid constants levels env →
+    w.eval levels ≠ 0 → BoundS (w.eval levels) (Telescope.interpret constants levels env domains)
+
+omit [DecidableEq β] in
+theorem TelescopeBound.nil (entries : Environment β) (Γ : Context β) (bound : Option VLevel) :
+    TelescopeBound.{u,v} entries Γ [] bound := fun _ _ _ _ _ _ _ _ _ _ => trivial
+
+omit [DecidableEq β] in
+theorem TelescopeBound.cons {entries : Environment β} {Γ : Context β}
+    {A : AExpr β} {rest : List (AExpr β)} {bound : Option VLevel} {l : VLevel}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort l))
+    (hl : ∀ w, bound = some w → ∀ levels, w.eval levels ≠ 0 → l.eval levels ≤ w.eval levels)
+    (hrest : TelescopeBound.{u,v} entries (Γ.push A) rest bound) :
+    TelescopeBound.{u,v} entries Γ (A :: rest) bound := by
+  intro w hw V _ constants hM levels env hΓ hpos
+  have htype := hA V constants hM levels env hΓ
+  refine ⟨univ_mono (hl w hw levels hpos) _ htype.2.2, ?_⟩
+  intro x hx
+  exact hrest w hw V constants hM levels (Valuation.cons x env) (hΓ.push htype.1 hx) hpos
+
+/-- A finite witness contains only proposed sorts and typing rule choices.
+Every domain is checked in the context extended by its actual predecessors. -/
+def verifyTelescope (fuel n : Nat) (entries : Environment β) (bound : Option VLevel) :
+    (Γ : Context β) → (domains : List (AExpr β)) → List (DomainWitness β) →
+      Option (CheckedClaim.{u} (Telescope.Formed.{u,v} entries Γ domains ∧
+        TelescopeBound.{u,v} entries Γ domains bound))
+  | Γ, [], [] => some ⟨⟨.nil, TelescopeBound.nil entries Γ bound⟩⟩
+  | Γ, A :: rest, witness :: witnesses =>
+    if hl : checkDomainBound n bound witness.level = true then do
+      let hA ← verifyType.{u,v} fuel n entries Γ A (.sort witness.level) witness.typing
+      let hrest ← verifyTelescope fuel n entries bound (Γ.push A) rest witnesses
+      return ⟨⟨.cons witness.level hA.down hrest.down.1,
+        TelescopeBound.cons hA.down (checkDomainBound_sound hl) hrest.down.2⟩⟩
+    else none
+  | _, _, _ => none
+
+theorem verifyTelescope_sound {fuel n : Nat} {entries : Environment β} {bound : Option VLevel}
+    {Γ : Context β} {domains : List (AExpr β)} {witnesses : List (DomainWitness β)}
+    {result} (_ : verifyTelescope.{u,v} fuel n entries bound Γ domains witnesses = some result) :
+    Telescope.Formed.{u,v} entries Γ domains ∧ TelescopeBound.{u,v} entries Γ domains bound :=
+  result.down
+
+/-- Indices are checked against their actual dependent telescope, with every
+earlier argument substituted before the next check. -/
+def ArgumentsFit (entries : Environment β) (Γ : Context β)
+    (domains args : List (AExpr β)) : Prop :=
+  ∀ (V : Type v) [SetTheory V] (constants : Assignment β V), Realizes constants entries →
+    ∀ levels env, Γ.Valid constants levels env →
+      FitsS (Telescope.interpret constants levels env domains) (args.map (interp constants levels env))
+
+omit [DecidableEq β] in
+theorem ArgumentsFit.nil (entries : Environment β) (Γ : Context β) :
+    ArgumentsFit.{u,v} entries Γ [] [] := fun _ _ _ _ _ _ _ => trivial
+
+omit [DecidableEq β] in
+theorem ArgumentsFit.cons {entries : Environment β} {Γ : Context β}
+    {A a : AExpr β} {domains args : List (AExpr β)}
+    (ha : TypingClaim.{u,v} entries Γ a A)
+    (hrest : ArgumentsFit.{u,v} entries Γ (Telescope.inst a domains) args) :
+    ArgumentsFit.{u,v} entries Γ (A :: domains) (a :: args) := by
+  intro V _ constants hM levels env hΓ
+  refine ⟨(ha V constants hM levels env hΓ).2.2, ?_⟩
+  have h := (Telescope.fits_inst constants levels env a domains 0 _).mp
+    (hrest V constants hM levels env hΓ)
+  simpa only [Valuation.skip_zero, Valuation.insert_zero] using h
+
+def verifyArguments (fuel n : Nat) (entries : Environment β) (Γ : Context β) :
+    (domains args : List (AExpr β)) → List (TypingWitness β) →
+      Option (CheckedClaim.{u} (ArgumentsFit.{u,v} entries Γ domains args))
+  | [], [], [] => some ⟨ArgumentsFit.nil entries Γ⟩
+  | A :: domains, a :: args, witness :: witnesses => do
+      let ha ← verifyType.{u,v} fuel n entries Γ a A witness
+      let hrest ← verifyArguments fuel n entries Γ (Telescope.inst a domains) args witnesses
+      return ⟨ArgumentsFit.cons ha.down hrest.down⟩
+  | _, _, _ => none
+
+theorem verifyArguments_sound {fuel n : Nat} {entries : Environment β} {Γ : Context β}
+    {domains args : List (AExpr β)} {witnesses : List (TypingWitness β)}
+    {result} (_ : verifyArguments.{u,v} fuel n entries Γ domains args witnesses = some result) :
+    ArgumentsFit.{u,v} entries Γ domains args := result.down
+
+def checkZeroImplies (a b : VLevel) : Bool :=
+  decide ((zeroCondition a).inter (zeroCondition b) = zeroCondition a)
+
+theorem checkZeroImplies_sound {a b : VLevel} (h : checkZeroImplies a b = true)
+    (levels : List Nat) (ha : a.eval levels = 0) : b.eval levels = 0 := by
+  have he : (zeroCondition a).inter (zeroCondition b) = zeroCondition a := of_decide_eq_true h
+  have hv := congrArg (PropWhen.holds (levels.getD · 0)) he
+  simpa only [PropWhen.holds_inter, zeroCondition_correct, ha, beq_self_eq_true,
+    Bool.true_and, beq_iff_eq] using hv
+
+def TelescopeProp (entries : Environment β) (Γ : Context β) (domains : List (AExpr β))
+    (atLevel : VLevel) : Prop :=
+  ∀ (V : Type v) [SetTheory V] (constants : Assignment β V), Realizes constants entries →
+    ∀ levels env, Γ.Valid constants levels env → atLevel.eval levels = 0 →
+      PropS (Telescope.interpret constants levels env domains)
+
+omit [DecidableEq β] in
+theorem TelescopeProp.nil (entries : Environment β) (Γ : Context β) (atLevel : VLevel) :
+    TelescopeProp.{u,v} entries Γ [] atLevel := fun _ _ _ _ _ _ _ _ => trivial
+
+omit [DecidableEq β] in
+theorem TelescopeProp.cons {entries : Environment β} {Γ : Context β}
+    {A : AExpr β} {rest : List (AExpr β)} {atLevel l : VLevel}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort l))
+    (hl : ∀ levels, atLevel.eval levels = 0 → l.eval levels = 0)
+    (htail : TelescopeProp.{u,v} entries (Γ.push A) rest atLevel) :
+    TelescopeProp.{u,v} entries Γ (A :: rest) atLevel := by
+  intro V _ constants hM levels env hΓ hz
+  have htype := hA V constants hM levels env hΓ
+  refine ⟨?_, fun x hx => htail V constants hM levels _ (hΓ.push htype.1 hx) hz⟩
+  simpa only [interp, hl levels hz, univ_zero] using htype.2.2
+
+/-- The singleton exception checks proof-valued ordinary fields. Merely
+having one constructor is insufficient for large elimination from Prop. -/
+def verifyPropTelescope (fuel n : Nat) (entries : Environment β) (atLevel : VLevel) :
+    (Γ : Context β) → (domains : List (AExpr β)) → List (DomainWitness β) →
+      Option (CheckedClaim.{u} (TelescopeProp.{u,v} entries Γ domains atLevel))
+  | Γ, [], [] => some ⟨TelescopeProp.nil entries Γ atLevel⟩
+  | Γ, A :: rest, witness :: witnesses =>
+    if hl : checkZeroImplies atLevel witness.level = true then do
+      let hA ← verifyType.{u,v} fuel n entries Γ A (.sort witness.level) witness.typing
+      let htail ← verifyPropTelescope fuel n entries atLevel (Γ.push A) rest witnesses
+      return ⟨TelescopeProp.cons hA.down (checkZeroImplies_sound hl) htail.down⟩
+    else none
+  | _, _, _ => none
+
+end Ix.Theory.Certified
diff --git a/Ix/Theory/Const.lean b/Ix/Theory/Const.lean
new file mode 100644
index 000000000..59800d894
--- /dev/null
+++ b/Ix/Theory/Const.lean
@@ -0,0 +1,165 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Expr
+
+namespace Ix.Theory
+
+/-- Whether a declaration participates in the safe kernel fragment. -/
+inductive Safety where
+  | safe
+  | «unsafe»
+  | «partial»
+  deriving DecidableEq, Repr
+
+/-- The reduction behavior of a definition-like constant. -/
+inductive DefKind where
+  | definition
+  | theorem
+  | opaque
+  deriving DecidableEq, Repr
+
+/-- The four primitive constants that make up Lean's quotient interface. -/
+inductive QuotKind where
+  | type
+  | ctor
+  | lift
+  | ind
+  deriving DecidableEq, Repr
+
+/-- Trusted constructor metadata nested under its inductive family. -/
+structure Ctor (β : Type u) where
+  uvars : Nat
+  nparams : Nat
+  nfields : Nat
+  type : VExpr β
+  safety : Safety
+  deriving DecidableEq
+
+/-- One recursor reduction rule, positional in its constructor list. -/
+structure RecRule (β : Type u) where
+  nfields : Nat
+  rhs : VExpr β
+  deriving DecidableEq
+
+/-- Anonymous constant data stored in a content-addressed block. -/
+inductive Const (β : Type u) where
+  | axiom (uvars : Nat) (type : VExpr β) (safety : Safety)
+  | defn (uvars : Nat) (kind : DefKind) (type value : VExpr β)
+      (safety : Safety)
+  | quot (kind : QuotKind) (uvars : Nat) (type : VExpr β)
+  | induct (uvars nparams nindices : Nat) (type : VExpr β)
+      (ctors : List (Ctor β)) (safety : Safety)
+  | recursor (uvars nparams nindices nmotives nminors : Nat) (type : VExpr β)
+      (rules : List (RecRule β)) (k : Bool) (safety : Safety)
+  deriving DecidableEq
+
+/-- A content-addressed unit. Members are ordered and addressed positionally. -/
+structure Block (β : Type u) where
+  members : List (Const β)
+  deriving DecidableEq
+
+/-- A compact tag shared by ordinary members and nested constructors. -/
+inductive ConstKind where
+  | axiom
+  | defn (kind : DefKind)
+  | quot (kind : QuotKind)
+  | induct
+  | ctor
+  | recursor
+  deriving DecidableEq, Repr
+
+namespace Ctor
+
+def refs (ctor : Ctor β) : List (ConstRef β) := ctor.type.refs
+
+/-- Syntactic closure of a constructor declaration. -/
+def Closed (ctor : Ctor β) : Prop := ctor.type.Closed
+
+/-- The constructor's declared field telescope, excluding shared parameters. -/
+def fieldTypes (ctor : Ctor β) : List (VExpr β) :=
+  (ctor.type.telN (ctor.nparams + ctor.nfields)).drop ctor.nparams
+
+/-- Whether a field type refers to any member of the indicated block. -/
+def recursiveInBlock [DecidableEq β] (ctor : Ctor β) (block : β) : Bool :=
+  ctor.fieldTypes.any fun field =>
+    field.refs.any fun ref => ref.block == block
+
+end Ctor
+
+namespace RecRule
+
+def refs (rule : RecRule β) : List (ConstRef β) := rule.rhs.refs
+
+/-- Syntactic closure of a stored recursor rule. -/
+def Closed (rule : RecRule β) : Prop := rule.rhs.Closed
+
+end RecRule
+
+namespace Const
+
+/-- Every trusted expression carried by a constant is term-variable closed. -/
+def Closed : Const β → Prop
+  | .axiom _ type _ => type.Closed
+  | .defn _ _ type value _ => type.Closed ∧ value.Closed
+  | .quot _ _ type => type.Closed
+  | .induct _ _ _ type ctors _ =>
+      type.Closed ∧ ∀ ctor ∈ ctors, ctor.Closed
+  | .recursor _ _ _ _ _ type rules _ _ =>
+      type.Closed ∧ ∀ rule ∈ rules, rule.Closed
+
+/-- Number of constructors contributed to a block's flattened rule order. -/
+def ctorCount : Const β → Nat
+  | .induct _ _ _ _ ctors _ => ctors.length
+  | _ => 0
+
+def kind : Const β → ConstKind
+  | .axiom .. => .axiom
+  | .defn _ kind .. => .defn kind
+  | .quot kind .. => .quot kind
+  | .induct .. => .induct
+  | .recursor .. => .recursor
+
+def uvars : Const β → Nat
+  | .axiom uvars .. | .defn uvars .. | .induct uvars .. |
+    .recursor uvars .. => uvars
+  | .quot _ uvars _ => uvars
+
+def type : Const β → VExpr β
+  | .axiom _ type _ | .defn _ _ type _ _ | .quot _ _ type |
+    .induct _ _ _ type _ _ | .recursor _ _ _ _ _ type _ _ _ => type
+
+theorem Closed.type_closed {constant : Const β}
+    (closed : constant.Closed) : constant.type.Closed := by
+  cases constant <;> simp_all [Closed, type]
+
+/-- Every external reference occurring in a member's trusted expressions. -/
+def refs : Const β → List (ConstRef β)
+  | .axiom _ type _ => type.refs
+  | .defn _ _ type value _ => type.refs ++ value.refs
+  | .quot _ _ type => type.refs
+  | .induct _ _ _ type ctors _ => type.refs ++ ctors.flatMap Ctor.refs
+  | .recursor _ _ _ _ _ type rules _ _ => type.refs ++ rules.flatMap RecRule.refs
+
+end Const
+
+namespace Block
+
+/-- Every constant stored in a block is syntactically closed. -/
+def Closed (block : Block β) : Prop :=
+  ∀ constant ∈ block.members, constant.Closed
+
+theorem Closed.member {block : Block β} (closed : block.Closed)
+    {index : Nat} {constant : Const β}
+    (found : block.members[index]? = some constant) : constant.Closed :=
+  closed constant (List.mem_iff_getElem?.2 ⟨index, found⟩)
+
+/-- References from all member types, values, constructor types, and recursor rules. -/
+def refs (block : Block β) : List (ConstRef β) :=
+  block.members.flatMap Const.refs
+
+end Block
+
+end Ix.Theory
diff --git a/Ix/Theory/Expr.lean b/Ix/Theory/Expr.lean
new file mode 100644
index 000000000..cfa7f5ba6
--- /dev/null
+++ b/Ix/Theory/Expr.lean
@@ -0,0 +1,284 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Ref
+import Ix.Theory.VLevel
+
+/-!
+# Anonymous kernel expressions
+
+`VExpr β` is the binder-name-free term syntax used by the Theory. Constants
+refer to members of content-addressed blocks through `ConstRef β`; projections
+and natural-number literals remain structural instead of being expanded by a
+front-end translation.
+-/
+
+namespace Ix.Theory
+
+inductive VExpr (β : Type u) where
+  | bvar (deBruijnIndex : Nat)
+  | sort (u : VLevel)
+  | const (ref : ConstRef β) (levels : List VLevel)
+  | app (fn arg : VExpr β)
+  | lam (binderType body : VExpr β)
+  | forallE (binderType body : VExpr β)
+  | proj (ref : ConstRef β) (index : Nat) (expr : VExpr β)
+  | natLit (value : Nat)
+deriving DecidableEq, Hashable
+
+instance : Inhabited (VExpr β) := ⟨.sort .zero⟩
+
+/-- Shift a de Bruijn index by `n` when it is at or above cutoff `k`. -/
+def liftVar (n i : Nat) (k := 0) : Nat := if i < k then i else n + i
+
+namespace VExpr
+
+/-- Iterated application, with arguments ordered from left to right. -/
+def appN (f : VExpr β) : List (VExpr β) → VExpr β
+  | [] => f
+  | a :: as => (f.app a).appN as
+
+variable (n : Nat) in
+/-- Insert `n` variables at cutoff `k`. -/
+def liftN : VExpr β → (k : _ := 0) → VExpr β
+  | .bvar i, k => .bvar (liftVar n i k)
+  | .sort u, _ => .sort u
+  | .const r us, _ => .const r us
+  | .app fn arg, k => .app (fn.liftN k) (arg.liftN k)
+  | .lam ty body, k => .lam (ty.liftN k) (body.liftN (k + 1))
+  | .forallE ty body, k => .forallE (ty.liftN k) (body.liftN (k + 1))
+  | .proj r i e, k => .proj r i (e.liftN k)
+  | .natLit value, _ => .natLit value
+
+abbrev lift (e : VExpr β) : VExpr β := liftN 1 e
+
+/-- Every free de Bruijn index in the expression is below `k`. -/
+def ClosedN : VExpr β → (k : _ := 0) → Prop
+  | .bvar i, k => i < k
+  | .sort .., _ | .const .., _ | .natLit .., _ => True
+  | .app fn arg, k => fn.ClosedN k ∧ arg.ClosedN k
+  | .lam ty body, k => ty.ClosedN k ∧ body.ClosedN (k + 1)
+  | .forallE ty body, k => ty.ClosedN k ∧ body.ClosedN (k + 1)
+  | .proj _ _ e, k => e.ClosedN k
+
+abbrev Closed (e : VExpr β) : Prop := ClosedN e
+
+variable (levels : List VLevel) in
+/-- Instantiate the universe parameters in an expression. -/
+def instL : VExpr β → VExpr β
+  | .bvar i => .bvar i
+  | .sort u => .sort (u.inst levels)
+  | .const r us => .const r (us.map (VLevel.inst levels))
+  | .app fn arg => .app fn.instL arg.instL
+  | .lam ty body => .lam ty.instL body.instL
+  | .forallE ty body => .forallE ty.instL body.instL
+  | .proj r i e => .proj r i e.instL
+  | .natLit value => .natLit value
+
+/-- Replace interpreted constant occurrences by closed values, instantiated
+at the occurrence's universe arguments. Projection annotations remain store
+references; only expression-position constants are interpreted. -/
+def substConst (interp : ConstRef β → Option (VExpr β)) :
+    VExpr β → VExpr β
+  | .bvar index => .bvar index
+  | .sort level => .sort level
+  | .const ref levels =>
+      match interp ref with
+      | some value => value.instL levels
+      | none => .const ref levels
+  | .app function argument =>
+      .app (function.substConst interp) (argument.substConst interp)
+  | .lam domain body =>
+      .lam (domain.substConst interp) (body.substConst interp)
+  | .forallE domain body =>
+      .forallE (domain.substConst interp) (body.substConst interp)
+  | .proj ref field expression =>
+      .proj ref field (expression.substConst interp)
+  | .natLit value => .natLit value
+
+/-- All universe parameters in an expression are below `U`. -/
+def LevelWF (U : Nat) : VExpr β → Prop
+  | .bvar _ | .natLit _ => True
+  | .sort l => l.WF U
+  | .const _ levels => ∀ l ∈ levels, l.WF U
+  | .app e₁ e₂ | .lam e₁ e₂ | .forallE e₁ e₂ => e₁.LevelWF U ∧ e₂.LevelWF U
+  | .proj _ _ e => e.LevelWF U
+
+/-- Instantiate de Bruijn index `k` in a single variable occurrence. -/
+def instVar (i : Nat) (e : VExpr β) (k := 0) : VExpr β :=
+  if i < k then .bvar i else if i = k then liftN k e else .bvar (i - 1)
+
+/-- Instantiate de Bruijn index `k` throughout an expression. -/
+def inst : VExpr β → VExpr β → (k : _ := 0) → VExpr β
+  | .bvar i, e, k => instVar i e k
+  | .sort u, _, _ => .sort u
+  | .const r us, _, _ => .const r us
+  | .app fn arg, e, k => .app (fn.inst e k) (arg.inst e k)
+  | .lam ty body, e, k => .lam (ty.inst e k) (body.inst e (k + 1))
+  | .forallE ty body, e, k => .forallE (ty.inst e k) (body.inst e (k + 1))
+  | .proj r i p, e, k => .proj r i (p.inst e k)
+  | .natLit value, _, _ => .natLit value
+
+/-- Remove `n` variables at cutoff `k`, using `default` for missing terms. -/
+def unliftN (e : VExpr β) (n k : Nat) : VExpr β :=
+  match n with
+  | 0 => e
+  | n + 1 => unliftN (e.inst default k) n k
+
+/-- Structural form of `Skips`. -/
+def Skips' (n : Nat) : VExpr β → (k : _ := 0) → Prop
+  | .bvar i, k => i < k + n → i < k
+  | .sort .., _ | .const .., _ | .natLit .., _ => True
+  | .app fn arg, k => fn.Skips' n k ∧ arg.Skips' n k
+  | .lam ty body, k => ty.Skips' n k ∧ body.Skips' n (k + 1)
+  | .forallE ty body, k => ty.Skips' n k ∧ body.Skips' n (k + 1)
+  | .proj _ _ e, k => e.Skips' n k
+
+/-- `[bvar (off+m-1), ..., bvar off]`. -/
+def bvarRevRange (off : Nat) : Nat → List (VExpr β)
+  | 0 => []
+  | m + 1 => .bvar (off + m) :: bvarRevRange off m
+
+/-- Iterated lambda; the binder list is outermost first. -/
+def lamN : List (VExpr β) → VExpr β → VExpr β
+  | [], e => e
+  | A :: As, e => .lam A (lamN As e)
+
+/-- Iterated pi; the binder list is outermost first. -/
+def forallN : List (VExpr β) → VExpr β → VExpr β
+  | [], e => e
+  | A :: As, e => .forallE A (forallN As e)
+
+/-- Insert `n` binders below a telescope at depth `k`. -/
+def liftTelN (n : Nat) : List (VExpr β) → Nat → List (VExpr β)
+  | [], _ => []
+  | A :: As, k => A.liftN n k :: liftTelN n As (k + 1)
+
+/-- The first `n` binder types of an iterated pi, outermost first. -/
+def telN : Nat → VExpr β → List (VExpr β)
+  | 0, _ => []
+  | n + 1, .forallE A rest => A :: telN n rest
+  | _ + 1, _ => []
+
+/-- Strip up to `n` binders from an iterated pi. -/
+def dropN : Nat → VExpr β → VExpr β
+  | 0, e => e
+  | n + 1, .forallE _ rest => dropN n rest
+  | _ + 1, e => e
+
+/-- The result after all leading pi binders. -/
+def resultOf : VExpr β → VExpr β
+  | .forallE _ rest => resultOf rest
+  | e => e
+
+/-- Collect application arguments, outermost first. -/
+def appArgs : VExpr β → List (VExpr β) → List (VExpr β)
+  | .app f a, acc => appArgs f (a :: acc)
+  | _, acc => acc
+
+/-- Remove every application node and return its head. -/
+def appHead : VExpr β → VExpr β
+  | .app f _ => appHead f
+  | e => e
+
+/-- Instantiate a term under each entry of a telescope. -/
+def instTelN (a : VExpr β) : List (VExpr β) → Nat → List (VExpr β)
+  | [], _ => []
+  | A :: As, k => A.inst a k :: instTelN a As (k + 1)
+
+/-- Consume an outermost-first argument list from a body. -/
+def instRev : VExpr β → List (VExpr β) → VExpr β
+  | C, [] => C
+  | C, e :: es => instRev (C.inst e es.length) es
+
+/-- Consume an outermost-first argument list above a fixed binder offset. -/
+def instRevAt : VExpr β → List (VExpr β) → Nat → VExpr β
+  | e, [], _ => e
+  | e, a :: as, k => instRevAt (e.inst a (k + as.length)) as k
+
+/-- Whether an expression mentions a particular constant reference. -/
+def mentions [DecidableEq β] : VExpr β → ConstRef β → Bool
+  | .bvar _, _ | .sort _, _ | .natLit _, _ => false
+  | .const r _, target => decide (r = target)
+  | .app e₁ e₂, target | .lam e₁ e₂, target | .forallE e₁ e₂, target =>
+    e₁.mentions target || e₂.mentions target
+  | .proj r _ e, target => decide (r = target) || e.mentions target
+
+/-- All constant references occurring in an expression, including projection heads. -/
+def refs : VExpr β → List (ConstRef β)
+  | .bvar _ | .sort _ | .natLit _ => []
+  | .const r _ => [r]
+  | .app e₁ e₂ | .lam e₁ e₂ | .forallE e₁ e₂ => e₁.refs ++ e₂.refs
+  | .proj r _ e => r :: e.refs
+
+end VExpr
+
+/-- A context embedding represented by skips and retained binders. -/
+inductive Lift : Type where
+  | refl
+  | skip (tail : Lift)
+  | cons (tail : Lift)
+
+namespace Lift
+
+@[simp] def skipN (l : Lift) : Nat → Lift
+  | 0 => l
+  | n + 1 => .skip (skipN l n)
+
+@[simp] def consN (l : Lift) : Nat → Lift
+  | 0 => l
+  | n + 1 => .cons (consN l n)
+
+@[simp] def comp (l₁ l₂ : Lift) : Lift :=
+  match l₂, l₁ with
+  | .refl, l₁ => l₁
+  | .skip l₂, l₁ => .skip (l₁.comp l₂)
+  | .cons l₂, .refl => .cons l₂
+  | .cons l₂, .skip l₁ => .skip (l₁.comp l₂)
+  | .cons l₂, .cons l₁ => .cons (l₁.comp l₂)
+
+@[simp] def dom : Lift → Nat
+  | .refl => 0
+  | .skip l => l.dom
+  | .cons l => l.dom + 1
+
+@[simp] def size : Lift → Nat
+  | .refl => 0
+  | .skip l | .cons l => l.size + 1
+
+@[simp] def depth : Lift → Nat
+  | .refl => 0
+  | .skip l => l.depth + 1
+  | .cons l => l.depth
+
+@[simp] protected def liftVar : Lift → Nat → Nat
+  | .refl, n => n
+  | .skip l, n => l.liftVar n + 1
+  | .cons _, 0 => 0
+  | .cons l, n + 1 => l.liftVar n + 1
+
+@[simp] def diff : Lift → Lift → Lift
+  | .refl, _ => .refl
+  | l, .refl => l
+  | .skip l₁, .skip l₂ | .cons l₁, .skip l₂ => diff l₁ l₂
+  | .skip l₁, .cons l₂ => .skip (diff l₁ l₂)
+  | .cons l₁, .cons l₂ => .cons (l₁.diff l₂)
+
+end Lift
+
+namespace VExpr
+
+@[simp] def lift' : VExpr β → Lift → VExpr β
+  | .bvar i, ρ => .bvar (ρ.liftVar i)
+  | .sort u, _ => .sort u
+  | .const r us, _ => .const r us
+  | .app fn arg, ρ => .app (fn.lift' ρ) (arg.lift' ρ)
+  | .lam ty body, ρ => .lam (ty.lift' ρ) (body.lift' ρ.cons)
+  | .forallE ty body, ρ => .forallE (ty.lift' ρ) (body.lift' ρ.cons)
+  | .proj r i e, ρ => .proj r i (e.lift' ρ)
+  | .natLit value, _ => .natLit value
+
+end VExpr
+end Ix.Theory
diff --git a/Ix/Theory/Inductive/Levels.lean b/Ix/Theory/Inductive/Levels.lean
new file mode 100644
index 000000000..5b54f8a4a
--- /dev/null
+++ b/Ix/Theory/Inductive/Levels.lean
@@ -0,0 +1,124 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.VLevel
+
+/-!
+The universe layout shared by recursor generation and its computation rules.
+Large elimination reserves the first recursor universe for the motive;
+constructors and source families receive only the remaining universes.
+-/
+
+namespace Ix.Theory
+
+namespace VLevel
+
+/-- `count` consecutive universe parameters beginning at `offset`. -/
+def params' (count offset : Nat) : List VLevel :=
+  (List.range count).map fun index => .param (index + offset)
+
+@[simp] theorem params'_length : (params' count offset).length = count := by
+  simp [params']
+
+end VLevel
+
+namespace Inductive
+
+/-- Whether a recursor may eliminate into a fresh universe or only into Prop. -/
+inductive ElimMode where
+  | large
+  | small
+  deriving DecidableEq, Repr
+
+namespace ElimMode
+
+def ofBool : Bool → ElimMode
+  | false => .small
+  | true => .large
+
+/-- Universe-slot offset occupied by the large-elimination motive. -/
+def offset : ElimMode → Nat
+  | .large => 1
+  | .small => 0
+
+def recUvars (mode : ElimMode) (sourceUvars : Nat) : Nat :=
+  sourceUvars + mode.offset
+
+def motiveLevel : ElimMode → VLevel
+  | .large => .param 0
+  | .small => .zero
+
+def sourceLevels (mode : ElimMode) (sourceUvars : Nat) : List VLevel :=
+  VLevel.params' sourceUvars mode.offset
+
+def recLevels (mode : ElimMode) (sourceUvars : Nat) : List VLevel :=
+  VLevel.params (mode.recUvars sourceUvars)
+
+/-- Actual arguments of the source family/constructor at a recursor instance.
+The recursor and its rule RHS retain the complete argument list. -/
+def sourceArgs (mode : ElimMode) (levels : List α) : List α :=
+  levels.drop mode.offset
+
+@[simp] theorem large_offset : ElimMode.large.offset = 1 := rfl
+@[simp] theorem small_offset : ElimMode.small.offset = 0 := rfl
+
+@[simp] theorem large_recUvars (sourceUvars : Nat) :
+    ElimMode.large.recUvars sourceUvars = sourceUvars + 1 := rfl
+
+@[simp] theorem small_recUvars (sourceUvars : Nat) :
+    ElimMode.small.recUvars sourceUvars = sourceUvars := by
+  simp [recUvars, offset]
+
+@[simp] theorem small_sourceArgs (levels : List α) :
+    ElimMode.small.sourceArgs levels = levels := rfl
+
+@[simp] theorem large_sourceArgs_cons (motive : α) (levels : List α) :
+    ElimMode.large.sourceArgs (motive :: levels) = levels := rfl
+
+@[simp] theorem map_sourceArgs (mode : ElimMode) (f : α → β) (levels : List α) :
+    (mode.sourceArgs levels).map f = mode.sourceArgs (levels.map f) := by
+  simp [sourceArgs]
+
+theorem sourceArgs_length (mode : ElimMode) {levels : List α} {sourceUvars : Nat}
+    (h : levels.length = mode.recUvars sourceUvars) :
+    (mode.sourceArgs levels).length = sourceUvars := by
+  simp [sourceArgs, h, recUvars]
+
+theorem sourceArgs_wf (mode : ElimMode) {levels : List VLevel}
+    (h : ∀ level ∈ levels, level.WF U) :
+    ∀ level ∈ mode.sourceArgs levels, level.WF U := by
+  intro level hl
+  exact h level (List.mem_of_mem_drop hl)
+
+theorem sourceLevels_wf (mode : ElimMode) (sourceUvars : Nat) :
+    ∀ level ∈ mode.sourceLevels sourceUvars, level.WF (mode.recUvars sourceUvars) := by
+  simp [sourceLevels, VLevel.params', VLevel.WF, recUvars]
+
+/-- Generation's symbolic source map selects exactly the source arguments
+of a concrete recursor instance. This also covers equal-arity small elimination. -/
+theorem sourceLevels_inst (mode : ElimMode) {levels : List VLevel} {sourceUvars : Nat}
+    (h : levels.length = mode.recUvars sourceUvars) :
+    (mode.sourceLevels sourceUvars).map (VLevel.inst levels) = mode.sourceArgs levels := by
+  apply List.ext_get (by simp [sourceLevels, sourceArgs_length mode h])
+  intro i hi _
+  have hi' : i < sourceUvars := by simpa [sourceLevels] using hi
+  have bound : i + mode.offset < levels.length := by
+    rw [h, recUvars]
+    omega
+  simp [sourceLevels, VLevel.params', VLevel.inst, sourceArgs,
+    List.getD_eq_getElem?_getD, List.getElem?_eq_getElem bound, Nat.add_comm]
+
+theorem sourceArgs_recLevels (mode : ElimMode) (sourceUvars : Nat) :
+    mode.sourceArgs (mode.recLevels sourceUvars) = mode.sourceLevels sourceUvars := by
+  have h := sourceLevels_inst mode (sourceUvars := sourceUvars)
+    (levels := mode.recLevels sourceUvars)
+    (by simp [recLevels])
+  rw [← h]
+  exact (List.map_congr_left (g := id) fun level hl =>
+    VLevel.inst_id (mode.sourceLevels_wf sourceUvars level hl)).trans (List.map_id _)
+
+end ElimMode
+end Inductive
+end Ix.Theory
diff --git a/Ix/Theory/LICENSE b/Ix/Theory/LICENSE
new file mode 100644
index 000000000..c13342b95
--- /dev/null
+++ b/Ix/Theory/LICENSE
@@ -0,0 +1,234 @@
+Lean4Ix licensing
+=================
+
+Copyright (c) 2026 Argument Computer Corporation
+
+This file is derived from lean4lean and has been modified by Argument Computer Corporation.
+The Apache License, Version 2.0 text reproduced below is unchanged.
+
+Except for third-party or upstream material that is separately identified,
+Lean4Ix is licensed, at your option, under either:
+
+  * the MIT License, as published in LICENSE-MIT; or
+  * the Apache License, Version 2.0, published in LICENSE-APACHE and
+    reproduced below.
+
+SPDX-License-Identifier: MIT OR Apache-2.0
+
+This grant covers material copyrighted by Argument Computer Corporation and
+any upstream material that its applicable license permits Argument Computer
+Corporation to sublicense under these terms. Work derived from lean4lean or
+other upstream projects may retain its original licensing, copyright,
+attribution, notice, and modification requirements.
+
+To the maximum extent permitted by those upstream licenses, our intent is to
+incorporate, distribute, and, where permitted, sublicense that work as part of
+the unified Lean4Ix package under the MIT OR Apache-2.0 licensing choice. We
+preserve all notices required by the applicable upstream licenses and comply
+with every condition necessary to incorporate and redistribute that work.
+Where an upstream license does not permit this unified dual licensing, its
+terms continue to control the
+affected material. Nothing in this notice grants rights beyond those provided
+by the applicable upstream licenses.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/Ix/Theory/LICENSE-APACHE b/Ix/Theory/LICENSE-APACHE
new file mode 100644
index 000000000..261eeb9e9
--- /dev/null
+++ b/Ix/Theory/LICENSE-APACHE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/Ix/Theory/LICENSE-MIT b/Ix/Theory/LICENSE-MIT
new file mode 100644
index 000000000..7590c7281
--- /dev/null
+++ b/Ix/Theory/LICENSE-MIT
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Argument Computer Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/Ix/Theory/Model/Annotated.lean b/Ix/Theory/Model/Annotated.lean
new file mode 100644
index 000000000..cf7bc21af
--- /dev/null
+++ b/Ix/Theory/Model/Annotated.lean
@@ -0,0 +1,221 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Level
+import Ix.Theory.Rename
+
+/-!
+# Annotated readings of exact anonymous expressions
+
+Every binder occurrence carries its own zero condition. These are structural
+readings, not evidence of typing: the semantic checker must establish that
+each condition describes the inferred codomain sort in the current context.
+
+The operations below preserve erasure exactly, including block/member and
+constructor positions, level arguments, projection heads, and literals.
+-/
+
+namespace Ix.Theory.Model
+
+open Certified
+
+inductive AExpr (β : Type u) where
+  | bvar (index : Nat)
+  | sort (level : VLevel)
+  | const (ref : ConstRef β) (levels : List VLevel)
+  | app (fn arg : AExpr β)
+  | lam (condition : PropWhen) (domain body : AExpr β)
+  | forallE (condition : PropWhen) (domain body : AExpr β)
+  | proj (ref : ConstRef β) (field : Nat) (major : AExpr β)
+  | natLit (value : Nat)
+deriving DecidableEq
+
+namespace AExpr
+
+def erase : AExpr β → VExpr β
+  | .bvar i => .bvar i
+  | .sort l => .sort l
+  | .const r ls => .const r ls
+  | .app f a => .app f.erase a.erase
+  | .lam _ a b => .lam a.erase b.erase
+  | .forallE _ a b => .forallE a.erase b.erase
+  | .proj r i e => .proj r i e.erase
+  | .natLit v => .natLit v
+
+theorem eq_const_of_erase_eq {e : AExpr β} {r : ConstRef β} {ls : List VLevel}
+    (h : e.erase = .const r ls) : e = .const r ls := by
+  cases e <;> simp_all [erase]
+
+/-- Scope of syntax and annotations, independently of semantic validity. -/
+def Scope (universes depth : Nat) : AExpr β → Prop
+  | .bvar i => i < depth
+  | .sort l => l.WF universes
+  | .const _ ls => ∀ l ∈ ls, l.WF universes
+  | .app f a => f.Scope universes depth ∧ a.Scope universes depth
+  | .lam p a b | .forallE p a b =>
+    p.WF universes ∧ a.Scope universes depth ∧ b.Scope universes (depth + 1)
+  | .proj _ _ e => e.Scope universes depth
+  | .natLit _ => True
+
+instance decidableScope {n k : Nat} : ∀ {e : AExpr β}, Decidable (e.Scope n k)
+  | .bvar i => inferInstanceAs (Decidable (i < k))
+  | .sort l => VLevel.decidable_WF (l := l)
+  | .const _ ls => inferInstanceAs (Decidable (∀ l ∈ ls, VLevel.WF n l))
+  | .app f a => @instDecidableAnd _ _ (decidableScope (e := f)) (decidableScope (e := a))
+  | .lam p A b | .forallE p A b =>
+    @instDecidableAnd _ _ (inferInstanceAs (Decidable (p.WF n)))
+      (@instDecidableAnd _ _ (decidableScope (e := A)) (decidableScope (e := b)))
+  | .proj _ _ e => decidableScope (e := e)
+  | .natLit _ => instDecidableTrue
+
+theorem Scope.erase {u k : Nat} {e : AExpr β} (h : e.Scope u k) :
+    e.erase.LevelWF u ∧ e.erase.ClosedN k := by
+  induction e generalizing k with
+  | bvar i => exact ⟨trivial, h⟩
+  | sort l => exact ⟨h, trivial⟩
+  | const r ls => exact ⟨h, trivial⟩
+  | app f a hf ha =>
+    exact ⟨⟨(hf h.1).1, (ha h.2).1⟩, ⟨(hf h.1).2, (ha h.2).2⟩⟩
+  | lam p a b ha hb | forallE p a b ha hb =>
+    exact ⟨⟨(ha h.2.1).1, (hb h.2.2).1⟩, ⟨(ha h.2.1).2, (hb h.2.2).2⟩⟩
+  | proj r i e ih => exact ih h
+  | natLit v => exact ⟨trivial, trivial⟩
+
+def liftN (count : Nat) : AExpr β → (cutoff : Nat := 0) → AExpr β
+  | .bvar i, k => .bvar (liftVar count i k)
+  | .sort l, _ => .sort l
+  | .const r ls, _ => .const r ls
+  | .app f a, k => .app (f.liftN count k) (a.liftN count k)
+  | .lam p a b, k => .lam p (a.liftN count k) (b.liftN count (k + 1))
+  | .forallE p a b, k => .forallE p (a.liftN count k) (b.liftN count (k + 1))
+  | .proj r i e, k => .proj r i (e.liftN count k)
+  | .natLit v, _ => .natLit v
+
+@[simp] theorem erase_liftN (e : AExpr β) (n k : Nat) :
+    (e.liftN n k).erase = e.erase.liftN n k := by
+  induction e generalizing k <;> simp_all [liftN, erase, VExpr.liftN]
+
+def instVar (i : Nat) (a : AExpr β) (k : Nat) : AExpr β :=
+  if i < k then .bvar i else if i = k then a.liftN k else .bvar (i - 1)
+
+def inst : AExpr β → AExpr β → (cutoff : Nat := 0) → AExpr β
+  | .bvar i, a, k => instVar i a k
+  | .sort l, _, _ => .sort l
+  | .const r ls, _, _ => .const r ls
+  | .app f a, e, k => .app (f.inst e k) (a.inst e k)
+  | .lam p a b, e, k => .lam p (a.inst e k) (b.inst e (k + 1))
+  | .forallE p a b, e, k => .forallE p (a.inst e k) (b.inst e (k + 1))
+  | .proj r i e, a, k => .proj r i (e.inst a k)
+  | .natLit v, _, _ => .natLit v
+
+@[simp] theorem erase_inst (e a : AExpr β) (k : Nat) :
+    (e.inst a k).erase = e.erase.inst a.erase k := by
+  induction e generalizing k with
+  | bvar i =>
+    by_cases hi : i < k
+    · simp [inst, erase, VExpr.inst, instVar, VExpr.instVar, hi]
+    · by_cases he : i = k <;>
+        simp [inst, erase, VExpr.inst, instVar, VExpr.instVar, hi, he]
+  | _ => simp_all [inst, erase, VExpr.inst]
+
+def instL (levels : List VLevel) : AExpr β → AExpr β
+  | .bvar i => .bvar i
+  | .sort l => .sort (l.inst levels)
+  | .const r ls => .const r (ls.map (VLevel.inst levels))
+  | .app f a => .app (f.instL levels) (a.instL levels)
+  | .lam p a b => .lam (instCondition levels p) (a.instL levels) (b.instL levels)
+  | .forallE p a b => .forallE (instCondition levels p) (a.instL levels) (b.instL levels)
+  | .proj r i e => .proj r i (e.instL levels)
+  | .natLit v => .natLit v
+
+@[simp] theorem erase_instL (e : AExpr β) (ls : List VLevel) :
+    (e.instL ls).erase = e.erase.instL ls := by
+  induction e <;> simp_all [instL, erase, VExpr.instL]
+
+theorem instL_instL (e : AExpr β) (ls ls' : List VLevel) :
+    (e.instL ls).instL ls' = e.instL (ls.map (VLevel.inst ls')) := by
+  induction e <;>
+    simp_all [instL, VLevel.inst_inst, instCondition_comp, List.map_map, Function.comp_def]
+
+def rename (mapping : β → γ) : AExpr β → AExpr γ
+  | .bvar i => .bvar i
+  | .sort l => .sort l
+  | .const r ls => .const (r.rename mapping) ls
+  | .app f a => .app (f.rename mapping) (a.rename mapping)
+  | .lam p a b => .lam p (a.rename mapping) (b.rename mapping)
+  | .forallE p a b => .forallE p (a.rename mapping) (b.rename mapping)
+  | .proj r i e => .proj (r.rename mapping) i (e.rename mapping)
+  | .natLit v => .natLit v
+
+@[simp] theorem erase_rename (e : AExpr β) (mapping : β → γ) :
+    (e.rename mapping).erase = e.erase.rename mapping := by
+  induction e <;> simp_all [rename, erase, VExpr.rename]
+
+end AExpr
+
+/-- Untrusted annotations are indexed by occurrence, not a shared node ID.
+Leaf syntax comes from the source expression and cannot be changed here. -/
+inductive AnnotationTree where
+  | leaf
+  | app (fn arg : AnnotationTree)
+  | lam (condition : Option (List Nat)) (domain body : AnnotationTree)
+  | forallE (condition : Option (List Nat)) (domain body : AnnotationTree)
+  | proj (major : AnnotationTree)
+deriving DecidableEq, Repr
+
+private def readCondition? (n : Nat) (raw : Option (List Nat)) :
+    Option { p : PropWhen // p.toRaw = raw ∧ p.WF n } :=
+  match h : PropWhen.fromRaw? n raw with
+  | none => none
+  | some p => some ⟨p, PropWhen.fromRaw?_sound h⟩
+
+universe u
+variable {β : Type u}
+
+/-- Exact, scoped reading produced by the structural validator. -/
+abbrev Reading (n k : Nat) (source : VExpr β) :=
+  { e : AExpr β // e.erase = source ∧ e.Scope n k }
+
+/-- Check shape, canonical conditions, and every term/universe index against
+the exact input occurrence. Typing must subsequently validate binder meaning.
+Proof fields are erased at runtime; every data check below is executable. -/
+def readAnnotations? (n k : Nat) (source : VExpr β) (tree : AnnotationTree) :
+    Option (Reading n k source) :=
+  match source, tree with
+  | .bvar i, .leaf => if h : i < k then some ⟨.bvar i, rfl, h⟩ else none
+  | .sort l, .leaf => if h : l.WF n then some ⟨.sort l, rfl, h⟩ else none
+  | .const r ls, .leaf =>
+    if h : ∀ l ∈ ls, l.WF n then some ⟨.const r ls, rfl, h⟩ else none
+  | .app f a, .app tf ta => do
+    let f' ← readAnnotations? n k f tf
+    let a' ← readAnnotations? n k a ta
+    return ⟨.app f'.val a'.val,
+      by simp [AExpr.erase, f'.property.1, a'.property.1],
+      f'.property.2, a'.property.2⟩
+  | .lam a b, .lam raw ta tb =>
+    match readCondition? n raw with
+    | none => none
+    | some p => do
+      let a' ← readAnnotations? n k a ta
+      let b' ← readAnnotations? n (k + 1) b tb
+      return ⟨.lam p.val a'.val b'.val,
+        by simp [AExpr.erase, a'.property.1, b'.property.1],
+        p.property.2, a'.property.2, b'.property.2⟩
+  | .forallE a b, .forallE raw ta tb =>
+    match readCondition? n raw with
+    | none => none
+    | some p => do
+      let a' ← readAnnotations? n k a ta
+      let b' ← readAnnotations? n (k + 1) b tb
+      return ⟨.forallE p.val a'.val b'.val,
+        by simp [AExpr.erase, a'.property.1, b'.property.1],
+        p.property.2, a'.property.2, b'.property.2⟩
+  | .proj r i e, .proj te => do
+    let e' ← readAnnotations? n k e te
+    return ⟨.proj r i e'.val, by simp [AExpr.erase, e'.property.1], e'.property.2⟩
+  | .natLit v, .leaf => some ⟨.natLit v, rfl, trivial⟩
+  | _, _ => none
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Context.lean b/Ix/Theory/Model/Context.lean
new file mode 100644
index 000000000..f4579d895
--- /dev/null
+++ b/Ix/Theory/Model/Context.lean
@@ -0,0 +1,56 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.WellDenoted
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+/-- All entries are expressed in the full current context. Pushing a binder
+lifts both its type and every existing entry. -/
+abbrev Context (β : Type u) := List (AExpr β)
+
+def Context.push (A : AExpr β) (Γ : Context β) : Context β :=
+  A.liftN 1 :: Γ.map (AExpr.liftN 1 ·)
+
+def Context.Valid (constants : Assignment β V) (levels : List Nat)
+    (Γ : Context β) (env : Nat → V) : Prop :=
+  ∀ i A, Γ[i]? = some A →
+    WellDenoted constants levels env A ∧ env i ∈ˢ interp constants levels env A
+
+theorem Context.valid_nil (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) : Context.Valid constants levels [] env := by
+  intro i A h
+  simp at h
+
+omit [SetTheory V] in
+@[simp] theorem Valuation.skip_one_cons (x : V) (env : Nat → V) :
+    Valuation.skip 1 0 (Valuation.cons x env) = env := by
+  funext i
+  simp [Valuation.skip, Nat.add_comm 1 i]
+
+theorem Context.Valid.push {constants : Assignment β V} {levels : List Nat}
+    {Γ : Context β} {env : Nat → V} {A : AExpr β} {x : V}
+    (hΓ : Γ.Valid constants levels env) (hA : WellDenoted constants levels env A)
+    (hx : x ∈ˢ interp constants levels env A) :
+    (Γ.push A).Valid constants levels (Valuation.cons x env) := by
+  intro i B hi
+  cases i with
+  | zero =>
+    simp only [Context.push, List.getElem?_cons_zero, Option.some.injEq] at hi
+    subst B
+    simpa only [wellDenoted_liftN, interp_liftN, Valuation.skip_one_cons,
+      Valuation.cons_zero] using And.intro hA hx
+  | succ i =>
+    simp only [Context.push, List.getElem?_cons_succ, List.getElem?_map] at hi
+    obtain ⟨C, hC, rfl⟩ := Option.map_eq_some_iff.mp hi
+    simpa only [wellDenoted_liftN, interp_liftN, Valuation.skip_one_cons,
+      Valuation.cons_succ] using hΓ i C hC
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Environment.lean b/Ix/Theory/Model/Environment.lean
new file mode 100644
index 000000000..7bd16fbcd
--- /dev/null
+++ b/Ix/Theory/Model/Environment.lean
@@ -0,0 +1,76 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Context
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u v
+
+/-- A closed equation includes the whole rule telescope as lambdas. Its data
+does not authorize reduction; an admitted model must establish its equality. -/
+structure ConstantEquation (β : Type u) where
+  lhs : AExpr β
+  rhs : AExpr β
+deriving DecidableEq
+
+/-- Data describing additional proved behavior of an admitted declaration.
+Only semantic producers may publish these facts; the certificate supplies
+no proof of their meaning. -/
+inductive ConstantFact (β : Type u) where
+  | typed (expression type : AExpr β)
+  | natural (zero succ : ConstRef β)
+deriving DecidableEq
+
+structure NaturalMeaning {β : Type u} {V : Type v} [SetTheory V]
+    (constants : Assignment β V) (family zero succ : ConstRef β) : Prop where
+  member : ∀ n, Numeral.value n ∈ˢ constants family []
+  zeroValue : constants zero [] = Numeral.value 0
+  succValue : ∀ n, SetTheory.app (constants succ []) (Numeral.value n) = Numeral.value (n + 1)
+
+def ConstantFact.Meaning {β : Type u} {V : Type v} [SetTheory V]
+    (constants : Assignment β V) (owner : ConstRef β) (levels : List Nat) (env : Nat → V) :
+    ConstantFact β → Prop
+  | .typed e type => WellDenoted constants levels env e ∧ WellDenoted constants levels env type ∧
+      interp constants levels env e ∈ˢ interp constants levels env type
+  | .natural zero succ => levels = [] ∧ NaturalMeaning constants owner zero succ
+
+/-- An entry becomes available to the checker only after admission of its
+primitive realization, safe checked body, or atomic inductive realization.
+An absent body does not license axioms or reduction equations. -/
+structure ConstantEntry (β : Type u) where
+  universes : Nat
+  type : AExpr β
+  body : Option (AExpr β)
+  equations : List (ConstantEquation β) := []
+  facts : List (ConstantFact β) := []
+
+abbrev Environment (β : Type u) := ConstRef β → Option (ConstantEntry β)
+
+/-- Meaning of an exact dependency interface. A declaration producer must
+establish these facts for every universe instance and context valuation. -/
+structure Realizes {β : Type u} {V : Type v} [SetTheory V]
+    (constants : Assignment β V) (entries : Environment β) : Prop where
+  typeValid : ∀ r entry, entries r = some entry → ∀ levels,
+    levels.length = entry.universes → ∀ env,
+      WellDenoted constants levels env entry.type
+  member : ∀ r entry, entries r = some entry → ∀ levels,
+    levels.length = entry.universes → ∀ env,
+      constants r levels ∈ˢ interp constants levels env entry.type
+  bodyValid : ∀ r entry, entries r = some entry → ∀ body, entry.body = some body →
+    ∀ levels, levels.length = entry.universes → ∀ env,
+      WellDenoted constants levels env body
+  bodyValue : ∀ r entry, entries r = some entry → ∀ body, entry.body = some body →
+    ∀ levels, levels.length = entry.universes → ∀ env,
+      constants r levels = interp constants levels env body
+  equationValue : ∀ r entry, entries r = some entry → ∀ equation ∈ entry.equations,
+    ∀ levels, levels.length = entry.universes → ∀ env,
+      interp constants levels env equation.lhs = interp constants levels env equation.rhs
+  factMeaning : ∀ r entry, entries r = some entry → ∀ fact ∈ entry.facts,
+    ∀ levels, levels.length = entry.universes → ∀ env, fact.Meaning constants r levels env
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Extension.lean b/Ix/Theory/Model/Extension.lean
new file mode 100644
index 000000000..ca67eb91b
--- /dev/null
+++ b/Ix/Theory/Model/Extension.lean
@@ -0,0 +1,346 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Support
+import Ix.Theory.Model.Judgment
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u v
+variable {β : Type u} [DecidableEq β]
+
+def Environment.insert (entries : Environment β) (r : ConstRef β)
+    (entry : ConstantEntry β) : Environment β :=
+  fun q => if q = r then some entry else entries q
+
+def Assignment.insert (constants : Assignment β V) (r : ConstRef β)
+    (value : List Nat → V) : Assignment β V :=
+  fun q levels => if q = r then value levels else constants q levels
+
+/-- All exact old references retain their values at every universe instance. -/
+def Assignment.AgreesOn (entries : Environment β) (constants constants' : Assignment β V) : Prop :=
+  ∀ r entry, entries r = some entry → ∀ levels, constants' r levels = constants r levels
+
+@[simp] theorem Environment.insert_same (entries : Environment β) (r : ConstRef β)
+    (entry : ConstantEntry β) : entries.insert r entry r = some entry := by
+  simp only [insert, ↓reduceIte]
+
+theorem Environment.insert_replace (entries : Environment β) (r : ConstRef β)
+    (old entry : ConstantEntry β) : (entries.insert r old).insert r entry = entries.insert r entry := by
+  funext q
+  by_cases h : q = r <;> simp [insert, h]
+
+@[simp] theorem Assignment.insert_same (constants : Assignment β V) (r : ConstRef β)
+    (value : List Nat → V) (levels : List Nat) :
+    constants.insert r value r levels = value levels := by
+  simp only [insert, ↓reduceIte]
+
+omit [DecidableEq β] in
+theorem fresh_ne {entries : Environment β} {r q : ConstRef β} {entry : ConstantEntry β}
+    (fresh : entries r = none) (h : entries q = some entry) : q ≠ r := by
+  intro hqr
+  subst q
+  rw [fresh] at h
+  contradiction
+
+theorem Environment.insert_old {entries : Environment β} {r q : ConstRef β}
+    {entry old : ConstantEntry β} (fresh : entries r = none) (h : entries q = some old) :
+    entries.insert r entry q = some old := by
+  simp only [insert, if_neg (fresh_ne fresh h), h]
+
+theorem Assignment.insert_agrees {entries : Environment β} {r : ConstRef β}
+    (fresh : entries r = none) (constants : Assignment β V) (value : List Nat → V) :
+    Assignment.AgreesOn entries constants (constants.insert r value) := by
+  intro q entry h levels
+  simp only [Assignment.insert, if_neg (fresh_ne fresh h)]
+
+theorem AExpr.ReferencesIn.insert {entries : Environment β} {r : ConstRef β}
+    {entry : ConstantEntry β} {e : AExpr β} (h : e.ReferencesIn entries) :
+    e.ReferencesIn (entries.insert r entry) := by
+  intro q hq
+  unfold Environment.insert
+  split
+  · rfl
+  · exact h q hq
+
+theorem ConstantFact.ReferencesIn.insert {entries : Environment β} {r : ConstRef β}
+    {entry : ConstantEntry β} {fact : ConstantFact β} (h : fact.ReferencesIn entries) :
+    fact.ReferencesIn (entries.insert r entry) := by
+  intro q hq
+  unfold Environment.insert
+  split
+  · rfl
+  · exact h q hq
+
+theorem Environment.WF.insert {entries : Environment β} {r : ConstRef β}
+    {entry : ConstantEntry β} (hE : entries.WF)
+    (hTs : entry.type.Scope entry.universes 0)
+    (hBs : ∀ body, entry.body = some body → body.Scope entry.universes 0)
+    (hTr : entry.type.ReferencesIn entries)
+    (hBr : ∀ body, entry.body = some body → body.ReferencesIn entries)
+    (hQs : ∀ equation ∈ entry.equations,
+      equation.lhs.Scope entry.universes 0 ∧ equation.rhs.Scope entry.universes 0)
+    (hQr : ∀ equation ∈ entry.equations,
+      equation.lhs.ReferencesIn entries ∧ equation.rhs.ReferencesIn entries)
+    (hFs : ∀ fact ∈ entry.facts, fact.Scope entry.universes)
+    (hFr : ∀ fact ∈ entry.facts, fact.ReferencesIn entries) :
+    (entries.insert r entry).WF := by
+  constructor
+  · intro q old h
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact hTs
+    · exact hE.typeScope q old h
+  · intro q old h body hb
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact hBs body hb
+    · exact hE.bodyScope q old h body hb
+  · intro q old h
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact hTr.insert
+    · exact (hE.typeReferences q old h).insert
+  · intro q old h body hb
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact (hBr body hb).insert
+    · exact (hE.bodyReferences q old h body hb).insert
+  · intro q old h equation he
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact hQs equation he
+    · exact hE.equationScope q old h equation he
+  · intro q old h equation he
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h
+      exact ⟨(hQr equation he).1.insert, (hQr equation he).2.insert⟩
+    · exact ⟨(hE.equationReferences q old h equation he).1.insert,
+        (hE.equationReferences q old h equation he).2.insert⟩
+  · intro q old h fact hf
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact hFs fact hf
+    · exact hE.factScope q old h fact hf
+  · intro q old h fact hf
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h; exact (hFr fact hf).insert
+    · exact (hE.factReferences q old h fact hf).insert
+
+variable {V : Type v} [SetTheory V]
+
+omit [DecidableEq β] in
+theorem Assignment.AgreesOn.interp {entries : Environment β}
+    {constants constants' : Assignment β V}
+    (h : Assignment.AgreesOn entries constants constants')
+    {e : AExpr β} (he : e.ReferencesIn entries) (levels : List Nat) (env : Nat → V) :
+    interp constants' levels env e = interp constants levels env e := by
+  apply interp_congr_constants
+  intro r hr ls
+  have hl := he r hr
+  cases hE : entries r with
+  | none => simp [hE] at hl
+  | some entry => exact h r entry hE ls
+
+omit [DecidableEq β] in
+theorem Assignment.AgreesOn.wellDenoted {entries : Environment β}
+    {constants constants' : Assignment β V}
+    (h : Assignment.AgreesOn entries constants constants')
+    {e : AExpr β} (he : e.ReferencesIn entries) (levels : List Nat) (env : Nat → V) :
+    WellDenoted constants' levels env e ↔ WellDenoted constants levels env e := by
+  apply wellDenoted_congr_constants
+  intro r hr ls
+  have hl := he r hr
+  cases hE : entries r with
+  | none => simp [hE] at hl
+  | some entry => exact h r entry hE ls
+
+omit [DecidableEq β] in
+theorem Assignment.AgreesOn.factMeaning {entries : Environment β}
+    {constants constants' : Assignment β V} (h : Assignment.AgreesOn entries constants constants')
+    {r : ConstRef β} {entry : ConstantEntry β} (hr : entries r = some entry)
+    {fact : ConstantFact β} (hf : fact.ReferencesIn entries) (levels : List Nat) (env : Nat → V)
+    (hm : fact.Meaning constants r levels env) : fact.Meaning constants' r levels env := by
+  have heq (q) (hq : q ∈ fact.references) (ls) : constants' q ls = constants q ls := by
+    have hv := hf q hq
+    cases he : entries q with
+    | none => simp [he] at hv
+    | some value => exact h q value he ls
+  cases fact with
+  | typed e type =>
+    have her : e.ReferencesIn entries := fun q hq => hf q (List.mem_append_left _ hq)
+    have htr : type.ReferencesIn entries := fun q hq => hf q (List.mem_append_right _ hq)
+    simpa only [ConstantFact.Meaning, h.wellDenoted her, h.wellDenoted htr,
+      h.interp her, h.interp htr] using hm
+  | natural zero succ =>
+    refine ⟨hm.1, ?_⟩
+    have hz := heq zero (by simp [ConstantFact.references]) []
+    have hs := heq succ (by simp [ConstantFact.references]) []
+    constructor
+    · intro n; rw [h r entry hr []]; exact hm.2.member n
+    · rw [hz]; exact hm.2.zeroValue
+    · intro n; rw [hs]; exact hm.2.succValue n
+
+omit [DecidableEq β] in
+theorem Realizes.of_agrees {entries : Environment β} {constants constants' : Assignment β V}
+    (hM : Realizes constants entries) (hE : entries.WF)
+    (h : Assignment.AgreesOn entries constants constants') : Realizes constants' entries where
+  typeValid r entry hr levels hn env :=
+    (h.wellDenoted (hE.typeReferences r entry hr) levels env).mpr (hM.typeValid r entry hr levels hn env)
+  member r entry hr levels hn env := by
+    rw [h r entry hr levels, h.interp (hE.typeReferences r entry hr) levels env]
+    exact hM.member r entry hr levels hn env
+  bodyValid r entry hr body hb levels hn env :=
+    (h.wellDenoted (hE.bodyReferences r entry hr body hb) levels env).mpr
+      (hM.bodyValid r entry hr body hb levels hn env)
+  bodyValue r entry hr body hb levels hn env := by
+    rw [h r entry hr levels, h.interp (hE.bodyReferences r entry hr body hb) levels env]
+    exact hM.bodyValue r entry hr body hb levels hn env
+  equationValue r entry hr law hl levels hn env := by
+    rw [h.interp (hE.equationReferences r entry hr law hl).1 levels env,
+      h.interp (hE.equationReferences r entry hr law hl).2 levels env]
+    exact hM.equationValue r entry hr law hl levels hn env
+  factMeaning r entry hr fact hf levels hn env :=
+    h.factMeaning hr (hE.factReferences r entry hr fact hf) levels env
+      (hM.factMeaning r entry hr fact hf levels hn env)
+
+/-- Local mathematical realization package. Admission constructs every field;
+certificate data cannot supply this proof package. -/
+structure EntryRealization (constants : Assignment β V) (r : ConstRef β)
+    (entry : ConstantEntry β) : Prop where
+  typeValid : ∀ levels, levels.length = entry.universes → ∀ env,
+    WellDenoted constants levels env entry.type
+  member : ∀ levels, levels.length = entry.universes → ∀ env,
+    constants r levels ∈ˢ interp constants levels env entry.type
+  bodyValid : ∀ body, entry.body = some body → ∀ levels, levels.length = entry.universes → ∀ env,
+    WellDenoted constants levels env body
+  bodyValue : ∀ body, entry.body = some body → ∀ levels, levels.length = entry.universes → ∀ env,
+    constants r levels = interp constants levels env body
+  equationValue : ∀ law ∈ entry.equations, ∀ levels, levels.length = entry.universes → ∀ env,
+    interp constants levels env law.lhs = interp constants levels env law.rhs
+  factMeaning : ∀ fact ∈ entry.facts, ∀ levels, levels.length = entry.universes → ∀ env,
+    fact.Meaning constants r levels env
+
+theorem Realizes.insert {entries : Environment β} {constants : Assignment β V}
+    {r : ConstRef β} {entry : ConstantEntry β} (hM : Realizes constants entries)
+    (h : EntryRealization constants r entry) : Realizes constants (entries.insert r entry) := by
+  constructor
+  · intro q old hq
+    unfold Environment.insert at hq
+    split at hq
+    · cases Option.some.inj hq; exact h.typeValid
+    · exact hM.typeValid q old hq
+  · intro q old hq
+    unfold Environment.insert at hq
+    split at hq
+    next he => subst q; cases Option.some.inj hq; exact h.member
+    next => exact hM.member q old hq
+  · intro q old hq
+    unfold Environment.insert at hq
+    split at hq
+    · cases Option.some.inj hq; exact h.bodyValid
+    · exact hM.bodyValid q old hq
+  · intro q old hq
+    unfold Environment.insert at hq
+    split at hq
+    next he => subst q; cases Option.some.inj hq; exact h.bodyValue
+    next => exact hM.bodyValue q old hq
+  · intro q old hq
+    unfold Environment.insert at hq
+    split at hq
+    · cases Option.some.inj hq; exact h.equationValue
+    · exact hM.equationValue q old hq
+  · intro q old hq
+    unfold Environment.insert at hq
+    split at hq
+    next he => subst q; cases Option.some.inj hq; exact h.factMeaning
+    next => exact hM.factMeaning q old hq
+
+/-- Safe-definition admission extends every compatible old model. The new
+value is constructed from the checked body in that very model. -/
+theorem extend_definition {entries : Environment β} {r : ConstRef β}
+    {entry : ConstantEntry β} {body : AExpr β} {level : VLevel}
+    (hE : entries.WF) (fresh : entries r = none) (hb : entry.body = some body)
+    (hq : entry.equations = []) (hf : entry.facts = [])
+    (hBs : body.Scope entry.universes 0)
+    (hTr : entry.type.ReferencesIn entries) (hBr : body.ReferencesIn entries)
+    (hT : TypingClaim.{u,v} entries [] entry.type (.sort level))
+    (hB : TypingClaim.{u,v} entries [] body entry.type)
+    (constants : Assignment β V) (hM : Realizes constants entries) :
+    ∃ constants' : Assignment β V,
+      Realizes constants' (entries.insert r entry) ∧
+        Assignment.AgreesOn entries constants constants' := by
+  let constants' := constants.insert r (fun levels => interp constants levels (fun _ => empty) body)
+  have hagree : Assignment.AgreesOn entries constants constants' := by
+    intro q old h levels
+    simp only [constants', Assignment.insert, if_neg (fresh_ne fresh h)]
+  have hnew (levels : List Nat) (env : Nat → V) :
+      constants' r levels = interp constants levels env body := by
+    simp only [constants', Assignment.insert, ↓reduceIte]
+    exact interp_closed body constants levels hBs _ env
+  refine ⟨constants', ?_, hagree⟩
+  constructor
+  · intro q old h levels _ env
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h
+      exact (hagree.wellDenoted hTr levels env).mpr
+        (hT V constants hM levels env (Context.valid_nil constants levels env)).1
+    · exact (hagree.wellDenoted (hE.typeReferences q old h) levels env).mpr
+        (hM.typeValid q old h levels ‹_› env)
+  · intro q old h levels _ env
+    unfold Environment.insert at h
+    split at h
+    next hqr =>
+      subst q
+      cases Option.some.inj h
+      rw [hnew levels env, hagree.interp hTr levels env]
+      exact (hB V constants hM levels env (Context.valid_nil constants levels env)).2.2
+    next =>
+      rw [hagree q old h levels, hagree.interp (hE.typeReferences q old h) levels env]
+      exact hM.member q old h levels ‹_› env
+  · intro q old h b hb' levels _ env
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h
+      have he : body = b := Option.some.inj (hb.symm.trans hb')
+      subst b
+      exact (hagree.wellDenoted hBr levels env).mpr
+        (hB V constants hM levels env (Context.valid_nil constants levels env)).1
+    · exact (hagree.wellDenoted (hE.bodyReferences q old h b hb') levels env).mpr
+        (hM.bodyValid q old h b hb' levels ‹_› env)
+  · intro q old h b hb' levels _ env
+    unfold Environment.insert at h
+    split at h
+    next hqr =>
+      subst q
+      cases Option.some.inj h
+      have he : body = b := Option.some.inj (hb.symm.trans hb')
+      subst b
+      rw [hnew levels env, hagree.interp hBr levels env]
+    next =>
+      rw [hagree q old h levels, hagree.interp (hE.bodyReferences q old h b hb') levels env]
+      exact hM.bodyValue q old h b hb' levels ‹_› env
+  · intro q old h equation he levels hn env
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h
+      simp only [hq, List.not_mem_nil] at he
+    · rw [hagree.interp (hE.equationReferences q old h equation he).1 levels env,
+        hagree.interp (hE.equationReferences q old h equation he).2 levels env]
+      exact hM.equationValue q old h equation he levels hn env
+  · intro q old h fact hfact levels hn env
+    unfold Environment.insert at h
+    split at h
+    · cases Option.some.inj h
+      simp only [hf, List.not_mem_nil] at hfact
+    · exact hagree.factMeaning h (hE.factReferences q old h fact hfact) levels env
+        (hM.factMeaning q old h fact hfact levels hn env)
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Inductive/Codes.lean b/Ix/Theory/Model/Inductive/Codes.lean
new file mode 100644
index 000000000..0f2551dce
--- /dev/null
+++ b/Ix/Theory/Model/Inductive/Codes.lean
@@ -0,0 +1,43 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Inductive.Telescope
+import Ix.Theory.Model.SetModel.TaggedSum
+
+namespace Ix.Theory.Model.InductiveCodes
+
+open SetTheory SetTheory.Tower
+
+universe u
+variable {V : Type u} [SetTheory V]
+
+open Classical in
+noncomputable def natIndex (x : V) : Nat :=
+  if h : ∃ i, x = vnat i then Classical.choose h else 0
+
+theorem natIndex_vnat (i : Nat) : natIndex (vnat i : V) = i := by
+  unfold natIndex
+  rw [dif_pos ⟨i, rfl⟩]
+  exact (vnat_inj (Classical.choose_spec (⟨i, rfl⟩ : ∃ j, (vnat i : V) = vnat j))).symm
+
+noncomputable def tag (x : V) : Nat := natIndex (sfst x)
+
+@[simp] theorem tag_inj (i : Nat) (x : V) : tag (inj i x) = i := by
+  simp only [tag, sfst_inj, natIndex_vnat]
+
+theorem sum_graph_mem {w : Nat} (hw : w ≠ 0) {f : Nat → V}
+    (hf : ∀ i, f i ∈ˢ (univ w : V)) : sumSet 1 f ∈ˢ (univ w : V) := by
+  cases w with
+  | zero => exact (hw rfl).elim
+  | succ w =>
+    unfold sumSet
+    rw [sigmaSet_pos (by decide : 1 ≠ 0)]
+    apply (univ_isTGUniverse hw).sigmaPairs_mem (omega_mem_univ_succ w)
+    intro k hk
+    obtain ⟨i, rfl⟩ := mem_omega_iff.mp hk
+    rw [natFibre_vnat]
+    exact hf i
+
+end Ix.Theory.Model.InductiveCodes
diff --git a/Ix/Theory/Model/Inductive/Container.lean b/Ix/Theory/Model/Inductive/Container.lean
new file mode 100644
index 000000000..0b8ad1103
--- /dev/null
+++ b/Ix/Theory/Model/Inductive/Container.lean
@@ -0,0 +1,192 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.SetModel.Container
+
+/-!
+Indexed strictly positive carriers over the explicit set-theory interface.
+This supplies a carrier and its induction principle from shape/position data;
+the source validator must construct the bounds and target-index proofs.
+No field postulates a fixed point, constructor law, or recursor law.
+-/
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u
+
+structure IndexedContainer (V : Type u) where
+  indices : V
+  shapes : V → V
+  positions : V → V
+  target : V → V → V
+
+namespace IndexedContainer
+
+variable {V : Type u} [SetTheory V]
+
+structure WF (D : IndexedContainer V) (w : Nat) : Prop where
+  shapes_mem : w ≠ 0 → ∀ i, i ∈ˢ D.indices → D.shapes i ∈ˢ (univ w : V)
+  positions_mem : w ≠ 0 → ∀ i a, i ∈ˢ D.indices → a ∈ˢ D.shapes i →
+    D.positions a ∈ˢ (univ w : V)
+  target_mem : ∀ i a p, i ∈ˢ D.indices → a ∈ˢ D.shapes i → p ∈ˢ D.positions a →
+    D.target a p ∈ˢ D.indices
+
+noncomputable def node (w : Nat) (a g : V) : V :=
+  if w = 0 then pt else spair a g
+
+noncomputable def fibre (D : IndexedContainer V) (w : Nat) (X i : V) : V :=
+  sigmaSet w (D.shapes i) fun a => piSet (D.positions a) fun p => app X (D.target a p)
+
+noncomputable def step (D : IndexedContainer V) (w : Nat) : V :=
+  graph (fun X => graph (D.fibre w X) D.indices) (famSpace w D.indices)
+
+noncomputable def carrier (D : IndexedContainer V) (w : Nat) : V :=
+  lfpFamSet w D.indices (D.step w)
+
+theorem node_mem_fibre {D : IndexedContainer V} {w : Nat} {X i a g : V}
+    (ha : a ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app X (D.target a p))) :
+    node w a g ∈ˢ D.fibre w X i := by
+  by_cases hw : w = 0
+  · subst w
+    exact pt_mem_sigma ha hg
+  · simpa only [node, if_neg hw, fibre] using spair_mem hw ha hg
+
+theorem mem_fibre {D : IndexedContainer V} {w : Nat} {X i x : V} :
+    x ∈ˢ D.fibre w X i ↔ ∃ a, a ∈ˢ D.shapes i ∧
+      ∃ g, g ∈ˢ piSet (D.positions a) (fun p => app X (D.target a p)) ∧ x = node w a g := by
+  constructor
+  · intro hx
+    obtain ⟨a, g, ha, hg, hz, hp⟩ := mem_sigma_elim hx
+    refine ⟨a, ha, g, hg, ?_⟩
+    by_cases hw : w = 0
+    · simpa only [node, if_pos hw] using hz hw
+    · simpa only [node, if_neg hw] using hp hw
+  · rintro ⟨a, ha, g, hg, rfl⟩
+    exact node_mem_fibre ha hg
+
+theorem app_step {D : IndexedContainer V} {w : Nat} {X : V}
+    (hX : X ∈ˢ famSpace w D.indices) :
+    app (D.step w) X = graph (D.fibre w X) D.indices := app_graph hX
+
+theorem app_app_step {D : IndexedContainer V} {w : Nat} {X i : V}
+    (hX : X ∈ˢ famSpace w D.indices) (hi : i ∈ˢ D.indices) :
+    app (app (D.step w) X) i = D.fibre w X i := by
+  rw [app_step hX, app_graph hi]
+
+theorem piSet_mono {A : V} {B C : V → V} (h : ∀ a, a ∈ˢ A → B a ⊆ˢ C a) :
+    piSet A B ⊆ˢ piSet A C := by
+  intro g hg
+  obtain ⟨hsub, htotal⟩ := mem_piSet.mp hg
+  refine mem_piSet.mpr ⟨?_, htotal⟩
+  intro q hq
+  obtain ⟨a, ha, b, hb, rfl⟩ := mem_sigmaPairs.mp (hsub q hq)
+  exact mem_sigmaPairs.mpr ⟨a, ha, b, h a ha b hb, rfl⟩
+
+theorem step_maps {D : IndexedContainer V} {w : Nat} (hD : D.WF w) :
+    MapsFam w D.indices (D.step w) := by
+  intro X hX
+  rw [app_step hX]
+  refine graph_mem_famSpace fun i hi => ?_
+  by_cases hw : w = 0
+  · subst w
+    simpa only [fibre, sigmaSet_zero, univ_zero] using truthVal_mem_univZero
+      (∃ a, a ∈ˢ D.shapes i ∧ ∃ g, g ∈ˢ piSet (D.positions a)
+        (fun p => app X (D.target a p)))
+  · rw [fibre, sigmaSet_pos hw]
+    let hU := univ_isTGUniverse (V := V) hw
+    refine hU.sigmaPairs_mem (hD.shapes_mem hw i hi) fun a ha => ?_
+    exact hU.piSet_mem (hD.positions_mem hw i a hi ha) fun p hp =>
+      famSpace_app hX (hD.target_mem i a p hi ha hp)
+
+theorem step_mono {D : IndexedContainer V} {w : Nat} (hD : D.WF w) :
+    MonoFam w D.indices (D.step w) := by
+  intro X Y hX hY hXY i hi x hx
+  rw [app_app_step hX hi] at hx
+  rw [app_app_step hY hi]
+  obtain ⟨a, ha, g, hg, rfl⟩ := mem_fibre.mp hx
+  exact node_mem_fibre ha (piSet_mono
+    (fun p hp => hXY _ (hD.target_mem i a p hi ha hp)) g hg)
+
+/-- The closed member needed by the fixed-point theorem is constructed.
+At Prop the top truth family suffices; positive sorts use accessible codes. -/
+theorem closed_exists {D : IndexedContainer V} {w : Nat} (hD : D.WF w) :
+    ∃ L, IsClosedFam w D.indices (D.step w) L := by
+  by_cases hw : w = 0
+  · subst w
+    let L := graph (fun _ => (unitSet : V)) D.indices
+    have hL : L ∈ˢ famSpace 0 D.indices :=
+      graph_mem_famSpace fun _ _ => unitSet_mem_univ 0
+    refine ⟨L, hL, ?_⟩
+    intro i hi x hx
+    rw [app_app_step hL hi] at hx
+    obtain ⟨a, _, g, _, rfl⟩ := mem_fibre.mp hx
+    simpa [L, app_graph hi, node] using (pt_mem_unitSet (V := V))
+  · apply container_closed_exists hw (fun X => app (D.step w) X)
+      D.shapes D.positions D.target spair
+      (hD.shapes_mem hw) (hD.positions_mem hw) hD.target_mem
+    · intro i a g hi ha hg
+      let hU := univ_isTGUniverse (V := V) hw
+      simpa only [spair] using hU.kpair_mem (empty_mem_univ w)
+        (hU.transitive (hD.shapes_mem hw i hi) ha) hg
+    · intro X hX i hi x hx
+      rw [app_app_step hX hi] at hx
+      obtain ⟨a, ha, g, hg, h⟩ := mem_fibre.mp hx
+      exact ⟨a, ha, g, hg, by simpa only [node, if_neg hw] using h⟩
+
+theorem carrier_mem (D : IndexedContainer V) (w : Nat) :
+    D.carrier w ∈ˢ famSpace w D.indices := lfpFamSet_mem _ _ _
+
+theorem carrier_fibre_mem (D : IndexedContainer V) (w : Nat) {i : V}
+    (hi : i ∈ˢ D.indices) : app (D.carrier w) i ∈ˢ (univ w : V) :=
+  famSpace_app (D.carrier_mem w) hi
+
+theorem carrier_eq {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {i : V} (hi : i ∈ˢ D.indices) :
+    app (D.carrier w) i = D.fibre w (D.carrier w) i := by
+  rw [← app_app_step (D.carrier_mem w) hi]
+  exact (app_lfpFamSet_eq (closed_exists hD) (step_mono hD) (step_maps hD) hi).symm
+
+theorem node_mem_carrier {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {i a g : V} (hi : i ∈ˢ D.indices) (ha : a ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p))) :
+    node w a g ∈ˢ app (D.carrier w) i := by
+  rw [carrier_eq hD hi]
+  exact node_mem_fibre ha hg
+
+/-- Structural induction supplies hypotheses at every recursive position,
+including all arguments of recursive function fields. -/
+theorem induction {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (P : V → V → Prop)
+    (hstep : ∀ i, i ∈ˢ D.indices → ∀ a, a ∈ˢ D.shapes i → ∀ g,
+      g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)) →
+      (∀ p, p ∈ˢ D.positions a → P (D.target a p) (app g p)) → P i (node w a g)) :
+    ∀ i, i ∈ˢ D.indices → ∀ x, x ∈ˢ app (D.carrier w) i → P i x := by
+  apply lfpFamSet_induction (closed_exists hD) (step_mono hD) P
+  intro i hi x hx
+  let X := graph (fun i => sep (app (D.carrier w) i) (P i)) D.indices
+  have hX : X ∈ˢ famSpace w D.indices :=
+    graph_mem_famSpace fun i hi => univ_sep_mem (D.carrier_fibre_mem w hi)
+  change x ∈ˢ app (app (D.step w) X) i at hx
+  rw [app_app_step hX hi] at hx
+  obtain ⟨a, ha, g, hg, rfl⟩ := mem_fibre.mp hx
+  have hchild (p : V) (hp : p ∈ˢ D.positions a) :
+      app g p ∈ˢ app (D.carrier w) (D.target a p) ∧ P (D.target a p) (app g p) := by
+    have h := app_mem_of_mem_piSet hg hp
+    rw [show X = graph (fun i => sep (app (D.carrier w) i) (P i)) D.indices from rfl,
+      app_graph (hD.target_mem i a p hi ha hp)] at h
+    exact mem_sep.mp h
+  apply hstep i hi a ha g
+  · apply piSet_mono (B := fun p => app X (D.target a p)) _ g hg
+    intro p hp y hy
+    rw [show X = graph (fun i => sep (app (D.carrier w) i) (P i)) D.indices from rfl,
+      app_graph (hD.target_mem i a p hi ha hp)] at hy
+    exact (mem_sep.mp hy).1
+  · exact fun p hp => (hchild p hp).2
+
+end IndexedContainer
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Inductive/Recursor.lean b/Ix/Theory/Model/Inductive/Recursor.lean
new file mode 100644
index 000000000..0c3acc373
--- /dev/null
+++ b/Ix/Theory/Model/Inductive/Recursor.lean
@@ -0,0 +1,218 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Inductive.Container
+
+/-!
+Recursion over indexed carriers. Large elimination requires recoverable
+constructor data: automatic in positive sorts, and derived from singleton
+shape fibres at Prop. Accessibility is proved by the carrier's induction
+principle. No well-founded recursion or computation law is assumed.
+-/
+
+namespace Ix.Theory.Model.IndexedContainer
+
+open SetTheory
+
+universe u
+variable {V : Type u} [SetTheory V]
+
+abbrev Element (D : IndexedContainer V) (w : Nat) :=
+  { ix : V × V // ix.1 ∈ˢ D.indices ∧ ix.2 ∈ˢ app (D.carrier w) ix.1 }
+
+/-- At Prop every constructor value is the proof point. Large elimination
+therefore needs at most one shape at each index. The source producer checks
+this criterion; positive carriers need no singleton restriction. -/
+def LargeElim (D : IndexedContainer V) (w : Nat) : Prop :=
+  w = 0 → ∀ i, i ∈ˢ D.indices → ∀ a b,
+    a ∈ˢ D.shapes i → b ∈ˢ D.shapes i → a = b
+
+theorem largeElim_of_pos (D : IndexedContainer V) {w : Nat} (hw : w ≠ 0) :
+    D.LargeElim w := fun h => False.elim (hw h)
+
+theorem node_inj {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) {i a b g h : V}
+    (hi : i ∈ˢ D.indices) (ha : a ∈ˢ D.shapes i) (hb : b ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)))
+    (hh : h ∈ˢ piSet (D.positions b) (fun p => app (D.carrier w) (D.target b p)))
+    (he : node w a g = node w b h) : a = b ∧ g = h := by
+  by_cases hw : w = 0
+  · subst w
+    have hab := hlarge rfl i hi a b ha hb
+    subst b
+    refine ⟨rfl, eq_of_mem_piSet_app_eq hg hh ?_⟩
+    intro p hp
+    have hP : app (D.carrier 0) (D.target a p) ∈ˢ (univZero : V) := by
+      simpa only [univ_zero] using D.carrier_fibre_mem 0 (hD.target_mem i a p hi ha hp)
+    exact (eq_pt_of_mem_univZero hP (app_mem_of_mem_piSet (a := p) hg hp)).trans
+      (eq_pt_of_mem_univZero hP (app_mem_of_mem_piSet (a := p) hh hp)).symm
+  · apply kpair_inj
+    simpa only [node, if_neg hw, spair] using he
+
+def Child (D : IndexedContainer V) (w : Nat) (child parent : D.Element w) : Prop :=
+  ∃ a, a ∈ˢ D.shapes parent.val.1 ∧ ∃ g,
+    g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)) ∧
+    parent.val.2 = node w a g ∧ ∃ p, p ∈ˢ D.positions a ∧
+      child.val = (D.target a p, app g p)
+
+theorem child_wellFounded {D : IndexedContainer V} {w : Nat}
+    (hD : D.WF w) (hlarge : D.LargeElim w) : WellFounded (D.Child w) := by
+  constructor
+  rintro ⟨⟨i, x⟩, hi, hx⟩
+  apply D.induction hD (fun i x => ∀ h : i ∈ˢ D.indices ∧ x ∈ˢ app (D.carrier w) i,
+    Acc (D.Child w) ⟨(i, x), h⟩) ?_ i hi x hx ⟨hi, hx⟩
+  intro i hi a ha g hg ih h
+  constructor
+  intro y hy
+  obtain ⟨b, hb, g', hg', he, p, hp, hyp⟩ := hy
+  obtain ⟨rfl, rfl⟩ := node_inj hD hlarge hi ha hb hg hg' he
+  have hy' : y = ⟨(D.target a p, app g p),
+      hD.target_mem i a p hi ha hp, app_mem_of_mem_piSet hg hp⟩ := Subtype.ext hyp
+  rw [hy']
+  exact ih p hp ⟨hD.target_mem i a p hi ha hp, app_mem_of_mem_piSet hg hp⟩
+
+structure NodeView (D : IndexedContainer V) (w : Nat) (z : D.Element w) where
+  shape : V
+  branches : V
+  shape_mem : shape ∈ˢ D.shapes z.val.1
+  branches_mem : branches ∈ˢ piSet (D.positions shape)
+    (fun p => app (D.carrier w) (D.target shape p))
+  equation : z.val.2 = node w shape branches
+
+noncomputable def view {D : IndexedContainer V} {w : Nat}
+    (hD : D.WF w) (z : D.Element w) : D.NodeView w z :=
+  let ex := mem_fibre.mp ((carrier_eq hD z.property.1) ▸ z.property.2)
+  let a := Classical.choose ex
+  let ha := Classical.choose_spec ex
+  let g := Classical.choose ha.2
+  let hg := Classical.choose_spec ha.2
+  ⟨a, g, ha.1, hg.1, hg.2⟩
+
+noncomputable def child {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {i a g : V} (hi : i ∈ˢ D.indices) (ha : a ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)))
+    (p : V) (hp : p ∈ˢ D.positions a) : D.Element w :=
+  ⟨(D.target a p, app g p), hD.target_mem i a p hi ha hp, app_mem_of_mem_piSet hg hp⟩
+
+theorem child_rel {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {z : D.Element w} (v : D.NodeView w z) {p : V} (hp : p ∈ˢ D.positions v.shape) :
+    D.Child w (child hD z.property.1 v.shape_mem v.branches_mem p hp) z :=
+  ⟨v.shape, v.shape_mem, v.branches, v.branches_mem, v.equation, p, hp, rfl⟩
+
+noncomputable def childResults {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {i a g : V} (hi : i ∈ˢ D.indices) (ha : a ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)))
+    (r : D.Element w → V) : V :=
+  open Classical in
+  graph (fun p => if hp : p ∈ˢ D.positions a then r (child hD hi ha hg p hp) else empty)
+    (D.positions a)
+
+theorem app_childResults {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {i a g : V} (hi : i ∈ˢ D.indices) (ha : a ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)))
+    (r : D.Element w → V) {p : V} (hp : p ∈ˢ D.positions a) :
+    app (childResults hD hi ha hg r) p = r (child hD hi ha hg p hp) := by
+  simp only [childResults, app_graph hp, dif_pos hp]
+
+noncomputable def foldStep {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (algebra : V → V → V → V → V) (z : D.Element w)
+    (r : ∀ y, D.Child w y z → V) : V :=
+  open Classical in
+  let v := view hD z
+  algebra z.val.1 v.shape v.branches
+    (graph (fun p => if hp : p ∈ˢ D.positions v.shape then
+      r (child hD z.property.1 v.shape_mem v.branches_mem p hp) (child_rel hD v hp)
+      else empty) (D.positions v.shape))
+
+noncomputable def fold {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) (algebra : V → V → V → V → V) : D.Element w → V :=
+  (child_wellFounded hD hlarge).fix (foldStep hD algebra)
+
+theorem fold_eq_view {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) (algebra : V → V → V → V → V) (z : D.Element w) :
+    fold hD hlarge algebra z =
+      algebra z.val.1 (view hD z).shape (view hD z).branches
+        (childResults hD z.property.1 (view hD z).shape_mem (view hD z).branches_mem
+          (fold hD hlarge algebra)) := by
+  rw [fold, WellFounded.fix_eq]
+  rfl
+
+theorem fold_node {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) (algebra : V → V → V → V → V)
+    {i a g : V} (hi : i ∈ˢ D.indices) (ha : a ∈ˢ D.shapes i)
+    (hg : g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p))) :
+    fold hD hlarge algebra ⟨(i, node w a g), hi, node_mem_carrier hD hi ha hg⟩ =
+      algebra i a g (childResults hD hi ha hg (fold hD hlarge algebra)) := by
+  let z : D.Element w := ⟨(i, node w a g), hi, node_mem_carrier hD hi ha hg⟩
+  have inj := node_inj hD hlarge hi ha (view hD z).shape_mem hg
+    (view hD z).branches_mem (view hD z).equation
+  change fold hD hlarge algebra z = _
+  rw [fold_eq_view]
+  simp only [← inj.1, ← inj.2]
+  rfl
+
+def AlgebraTyping (D : IndexedContainer V) (w : Nat)
+    (M : V → V → V) (algebra : V → V → V → V → V) : Prop :=
+  ∀ i, i ∈ˢ D.indices → ∀ a, a ∈ˢ D.shapes i → ∀ g,
+    g ∈ˢ piSet (D.positions a) (fun p => app (D.carrier w) (D.target a p)) →
+    ∀ ih, ih ∈ˢ piSet (D.positions a) (fun p => M (D.target a p) (app g p)) →
+      algebra i a g ih ∈ˢ M i (node w a g)
+
+theorem fold_mem {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) {M : V → V → V} {algebra : V → V → V → V → V}
+    (ha : D.AlgebraTyping w M algebra) (z : D.Element w) :
+    fold hD hlarge algebra z ∈ˢ M z.val.1 z.val.2 := by
+  induction z using (child_wellFounded hD hlarge).induction with
+  | h z ih =>
+    rw [fold_eq_view]
+    let v := view hD z
+    have hresults : childResults hD z.property.1 v.shape_mem v.branches_mem
+        (fold hD hlarge algebra) ∈ˢ
+        piSet (D.positions v.shape) (fun p => M (D.target v.shape p) (app v.branches p)) := by
+      apply graph_mem_piSet
+      intro p hp
+      simpa only [dif_pos hp, child] using
+        ih (child hD z.property.1 v.shape_mem v.branches_mem p hp) (child_rel hD v hp)
+    have hstep := ha z.val.1 z.property.1 v.shape v.shape_mem v.branches v.branches_mem
+      _ hresults
+    exact (congrArg (fun x => _ ∈ˢ M z.val.1 x) v.equation).mpr hstep
+
+/-- Total form used inside function graphs. Only typed domain elements reach
+the recursive branch; the value outside that domain is irrelevant. -/
+noncomputable def foldAt {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) (algebra : V → V → V → V → V) (i x : V) : V :=
+  open Classical in
+  if h : i ∈ˢ D.indices ∧ x ∈ˢ app (D.carrier w) i then
+    fold hD hlarge algebra ⟨(i, x), h⟩ else empty
+
+theorem foldAt_eq {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) (algebra : V → V → V → V → V) {i x : V}
+    (hi : i ∈ˢ D.indices) (hx : x ∈ˢ app (D.carrier w) i) :
+    foldAt hD hlarge algebra i x = fold hD hlarge algebra ⟨(i, x), hi, hx⟩ := by
+  simp only [foldAt, dif_pos (And.intro hi hx)]
+
+theorem foldAt_mem {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    (hlarge : D.LargeElim w) {M : V → V → V} {algebra : V → V → V → V → V}
+    (ha : D.AlgebraTyping w M algebra) {i x : V}
+    (hi : i ∈ˢ D.indices) (hx : x ∈ˢ app (D.carrier w) i) :
+    foldAt hD hlarge algebra i x ∈ˢ M i x := by
+  rw [foldAt_eq hD hlarge algebra hi hx]
+  exact fold_mem hD hlarge ha _
+
+/-- Small elimination does not need constructor injectivity. A Prop-valued
+motive follows directly by structural induction, even for many constructors. -/
+theorem small_elim {D : IndexedContainer V} {w : Nat} (hD : D.WF w)
+    {M : V → V → V} {algebra : V → V → V → V → V}
+    (hM : ∀ i, i ∈ˢ D.indices → ∀ x, x ∈ˢ app (D.carrier w) i → M i x ∈ˢ (univZero : V))
+    (ha : D.AlgebraTyping w M algebra) :
+    ∀ i, i ∈ˢ D.indices → ∀ x, x ∈ˢ app (D.carrier w) i → (pt : V) ∈ˢ M i x := by
+  apply D.induction hD (fun i x => (pt : V) ∈ˢ M i x)
+  intro i hi a ha' g hg ih
+  have hstep := ha i hi a ha' g hg (graph (fun _ => (pt : V)) (D.positions a))
+    (graph_mem_piSet ih)
+  have he := eq_pt_of_mem_univZero (hM i hi _ (node_mem_carrier hD hi ha' hg)) hstep
+  rwa [he] at hstep
+
+end Ix.Theory.Model.IndexedContainer
diff --git a/Ix/Theory/Model/Inductive/Telescope.lean b/Ix/Theory/Model/Inductive/Telescope.lean
new file mode 100644
index 000000000..01d0ddf80
--- /dev/null
+++ b/Ix/Theory/Model/Inductive/Telescope.lean
@@ -0,0 +1,585 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Judgment
+import Ix.Theory.Model.Support
+import Ix.Theory.Model.SetModel.TupleTower
+
+/-!
+Dependent telescopes used by inductive parameters, indices, constructor
+fields, and recursive function domains. Curried functions and tuple codes
+share the same fitting relation. Computation requires fitting arguments,
+including when a function is represented by the proof point.
+-/
+
+namespace Ix.Theory.Model.Telescope
+
+open SetTheory SetTheory.Tower SetModel
+
+universe u v
+variable {V : Type v} [SetTheory V]
+
+noncomputable def piN (w : Nat) : {n : Nat} → TeleS V n → (List V → V) → V
+  | _, .nil, R => R []
+  | _, .cons A B, R => piR w A (fun x => piN w (B x) (fun xs => R (x :: xs)))
+
+noncomputable def curry (w : Nat) : {n : Nat} → TeleS V n → (List V → V) → V
+  | _, .nil, f => f []
+  | _, .cons A B, f => lamR w A (fun x => curry w (B x) (fun xs => f (x :: xs)))
+
+noncomputable def applyN : V → List V → V
+  | f, [] => f
+  | f, x :: xs => applyN (app f x) xs
+
+theorem applyN_append (f : V) (xs ys : List V) :
+    applyN f (xs ++ ys) = applyN (applyN f xs) ys := by
+  induction xs generalizing f <;> simp_all [applyN]
+
+theorem curry_mem {w : Nat} : ∀ {n} (T : TeleS V n) {f R : List V → V},
+    (∀ xs, FitsS T xs → f xs ∈ˢ R xs) → curry w T f ∈ˢ piN w T R
+  | _, .nil, _, _, hf => hf [] trivial
+  | _, .cons _ B, _, _, hf =>
+    lamR_mem fun x hx => curry_mem (B x) (fun xs hxs => hf (x :: xs) ⟨hx, hxs⟩)
+
+theorem piN_zero_mem : ∀ {n} (T : TeleS V n) {R : List V → V},
+    (∀ xs, FitsS T xs → R xs ∈ˢ (univZero : V)) →
+      piN 0 T R ∈ˢ (univZero : V)
+  | _, .nil, _, hR => hR [] trivial
+  | _, .cons _ _, _, _ => piR_zero_mem_univZero
+
+theorem applyN_mem {w : Nat} : ∀ {n} (T : TeleS V n) {f : V} {R : List V → V}
+    {xs : List V}, f ∈ˢ piN w T R → FitsS T xs →
+    (w = 0 → ∀ ys, FitsS T ys → R ys ∈ˢ (univZero : V)) →
+      applyN f xs ∈ˢ R xs
+  | _, .nil, _, _, [], hf, _, _ => hf
+  | _, .cons _ B, _, R, x :: xs, hf, hxs, hR => by
+    apply applyN_mem (B x) (R := fun ys => R (x :: ys))
+      (app_mem_piR hf hxs.1 ?_) hxs.2
+    · intro hw ys hys
+      exact hR hw (x :: ys) ⟨hxs.1, hys⟩
+    · intro hw y hy
+      subst w
+      exact piN_zero_mem (B y) (fun ys hys => hR rfl (y :: ys) ⟨hy, hys⟩)
+
+theorem applyN_curry {w : Nat} : ∀ {n} (T : TeleS V n) {f R : List V → V}
+    {xs : List V}, FitsS T xs →
+    (∀ ys, FitsS T ys → f ys ∈ˢ R ys) →
+    (w = 0 → ∀ ys, FitsS T ys → R ys ∈ˢ (univZero : V)) →
+      applyN (curry w T f) xs = f xs
+  | _, .nil, _, _, [], _, _, _ => rfl
+  | _, .cons _ B, f, R, x :: xs, hxs, hf, hR => by
+    change applyN (app (lamR w _ _) x) xs = f (x :: xs)
+    rw [app_lamR hxs.1 (B := fun y => piN w (B y) (fun ys => R (y :: ys)))
+      (fun y hy => curry_mem (B y) (fun ys hys => hf (y :: ys) ⟨hy, hys⟩))
+      (fun hw y hy => by
+        subst w
+        exact piN_zero_mem (B y) (fun ys hys => hR rfl (y :: ys) ⟨hy, hys⟩))]
+    exact applyN_curry (B x) hxs.2
+      (fun ys hys => hf (x :: ys) ⟨hxs.1, hys⟩)
+      (fun hw ys hys => hR hw (x :: ys) ⟨hxs.1, hys⟩)
+
+theorem curry_congr {w : Nat} : ∀ {n} (T : TeleS V n) {f g : List V → V},
+    (∀ xs, FitsS T xs → f xs = g xs) → curry w T f = curry w T g
+  | _, .nil, _, _, h => h [] trivial
+  | _, .cons _ B, _, _, h =>
+    lamR_congr fun x hx => curry_congr (B x) (fun xs hxs => h (x :: xs) ⟨hx, hxs⟩)
+
+theorem piN_zero_agree {w w' : Nat} (hw : w = 0 ↔ w' = 0) :
+    ∀ {n} (T : TeleS V n) {R R' : List V → V},
+      (∀ xs, FitsS T xs → R xs = R' xs) → piN w T R = piN w' T R'
+  | _, .nil, _, _, h => h [] trivial
+  | _, .cons _ B, _, _, h =>
+    piR_zero_agree hw fun x hx => piN_zero_agree hw (B x) (fun xs hxs => h (x :: xs) ⟨hx, hxs⟩)
+
+theorem piN_congr {w : Nat} {n : Nat} (T : TeleS V n) {R R' : List V → V}
+    (h : ∀ xs, FitsS T xs → R xs = R' xs) : piN w T R = piN w T R' :=
+  piN_zero_agree Iff.rfl T h
+
+theorem curry_zero_agree {w w' : Nat} (hw : w = 0 ↔ w' = 0) :
+    ∀ {n} (T : TeleS V n) {f f' : List V → V},
+      (∀ xs, FitsS T xs → f xs = f' xs) → curry w T f = curry w' T f'
+  | _, .nil, _, _, h => h [] trivial
+  | _, .cons _ B, _, _, h =>
+    lamR_zero_agree hw fun x hx => curry_zero_agree hw (B x) (fun xs hxs => h (x :: xs) ⟨hx, hxs⟩)
+
+theorem curry_point : ∀ {n} (T : TeleS V n), curry 0 T (fun _ => (pt : V)) = pt
+  | _, .nil => rfl
+  | _, .cons _ _ => lamR_zero
+
+theorem curry_applyN {w : Nat} : ∀ {n} (T : TeleS V n) {f : V} {R : List V → V},
+    f ∈ˢ piN w T R →
+    (w = 0 → ∀ ys, FitsS T ys → R ys ∈ˢ (univZero : V)) →
+      curry w T (applyN f) = f
+  | _, .nil, _, _, _, _ => rfl
+  | _, .cons _ B, _, R, hf, hR => by
+    change lamR w _ (fun x => curry w (B x) (applyN (app _ x))) = _
+    calc
+      _ = lamR w _ (fun x => app _ x) := by
+        apply lamR_congr
+        intro x hx
+        apply curry_applyN (B x) (R := fun ys => R (x :: ys))
+          (app_mem_piR hf hx ?_)
+        · intro hw ys hys
+          exact hR hw (x :: ys) ⟨hx, hys⟩
+        · intro hw y hy
+          subst w
+          exact piN_zero_mem (B y) (fun ys hys => hR rfl (y :: ys) ⟨hy, hys⟩)
+      _ = _ := lamR_eta hf
+
+/-- Tuple codes always preserve their fields, even when a family itself is
+Prop-valued. The carrier bounds are needed only at positive sorts. -/
+theorem tower_graph_mem {w : Nat} (hw : w ≠ 0) : ∀ {n} (T : TeleS V n),
+    BoundS w T → towerSet 1 T ∈ˢ (univ w : V)
+  | _, .nil, _ => unitSet_mem_univ w
+  | _, .cons _ B, hB => by
+    change sigmaSet 1 _ _ ∈ˢ (univ w : V)
+    rw [sigmaSet_pos (by decide : 1 ≠ 0)]
+    exact (univ_isTGUniverse hw).sigmaPairs_mem hB.1
+      (fun x hx => tower_graph_mem hw (B x) (hB.2 x hx))
+
+theorem piN_mem_univ {w : Nat} : ∀ {n} (T : TeleS V n) {R : List V → V},
+    (w ≠ 0 → BoundS w T) → (∀ xs, FitsS T xs → R xs ∈ˢ (univ w : V)) →
+      piN w T R ∈ˢ (univ w : V)
+  | _, .nil, _, _, hR => hR [] trivial
+  | _, .cons A B, R, hT, hR => by
+    by_cases hw : w = 0
+    · subst w
+      exact univ_zero (V := V) ▸ piR_zero_mem_univZero
+    · change piR w A (fun x => piN w (B x) (fun xs => R (x :: xs))) ∈ˢ (univ w : V)
+      rw [piR_pos hw]
+      apply (univ_isTGUniverse hw).piSet_mem (hT hw).1
+      intro x hx
+      exact piN_mem_univ (B x) (fun _ => (hT hw).2 x hx)
+        (fun xs hxs => hR (x :: xs) ⟨hx, hxs⟩)
+
+def simple : (domains : List V) → TeleS V domains.length
+  | [] => .nil
+  | A :: rest => .cons A (fun _ => simple rest)
+
+theorem fits_simple_getD : ∀ {domains xs : List V}, FitsS (simple domains) xs →
+    ∀ {i A}, domains[i]? = some A → xs.getD i empty ∈ˢ A
+  | [], [], _, _, _, h => by simp at h
+  | _ :: _, _ :: _, h, 0, _, hA => by
+    cases Option.some.inj hA
+    exact h.1
+  | _ :: _, _ :: _, h, i + 1, _, hA => fits_simple_getD h.2 hA
+
+theorem fits_simple_of_getD : ∀ {domains xs : List V}, xs.length = domains.length →
+    (∀ i A, domains[i]? = some A → xs.getD i empty ∈ˢ A) → FitsS (simple domains) xs
+  | [], [], _, _ => trivial
+  | _ :: _, _ :: _, hlen, h =>
+    ⟨h 0 _ rfl, fits_simple_of_getD (Nat.succ.inj hlen) (fun i A hA => h (i + 1) A hA)⟩
+
+theorem fits_simple_map {α : Type u} (f : α → V) (domains : List α) (xs : List V)
+    (hlen : xs.length = domains.length)
+    (h : ∀ i a, domains[i]? = some a → xs.getD i empty ∈ˢ f a) :
+    FitsS (simple (domains.map f)) xs := by
+  apply fits_simple_of_getD (hlen.trans (List.length_map ..).symm)
+  intro i A hA
+  obtain ⟨a, ha, rfl⟩ := Option.map_eq_some_iff.mp
+    ((List.getElem?_map (l := domains) (f := f)).symm.trans hA)
+  exact h i a ha
+
+theorem fits_unique_of_prop : ∀ {n} {T : TeleS V n} {xs ys : List V},
+    PropS T → FitsS T xs → FitsS T ys → xs = ys
+  | _, .nil, [], [], _, _, _ => rfl
+  | _, .cons _ B, x :: xs, y :: ys, hT, hx, hy => by
+    have he := subsingleton_of_mem_univZero hT.1 hx.1 hy.1
+    subst y
+    exact congrArg (x :: ·) (fits_unique_of_prop (T := B x) (hT.2 x hx.1) hx.2 hy.2)
+
+variable {β : Type u}
+
+def context (Γ : Context β) : List (AExpr β) → Context β
+  | [] => Γ
+  | A :: rest => context (Γ.push A) rest
+
+def extend (env : Nat → V) : List V → Nat → V
+  | [] => env
+  | x :: xs => extend (Valuation.cons x env) xs
+
+omit [SetTheory V] in
+theorem extend_beyond (env : Nat → V) (xs : List V) (i : Nat) :
+    extend env xs (xs.length + i) = env i := by
+  induction xs generalizing env i with
+  | nil => simp [extend]
+  | cons x xs ih =>
+    simpa only [extend, List.length_cons, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm,
+      Valuation.cons_succ] using ih (Valuation.cons x env) (i + 1)
+
+theorem extend_getD (env : Nat → V) (xs : List V) (i : Nat) (hi : i < xs.length) :
+    extend env xs (xs.length - 1 - i) = xs.getD i empty := by
+  induction xs generalizing env i with
+  | nil => simp at hi
+  | cons x xs ih =>
+    cases i with
+    | zero =>
+      simpa only [extend, List.length_cons, Nat.add_sub_cancel, Nat.sub_zero,
+        List.getD_cons_zero, Valuation.cons_zero, Nat.add_zero] using
+        extend_beyond (Valuation.cons x env) xs 0
+    | succ i =>
+      have hidx : (x :: xs).length - 1 - (i + 1) = xs.length - 1 - i := by simp; omega
+      rw [hidx]
+      exact ih (Valuation.cons x env) i (by simpa using hi)
+
+omit [SetTheory V] in
+theorem skip_extend (env : Nat → V) (xs : List V) :
+    Valuation.skip xs.length 0 (extend env xs) = env := by
+  funext i
+  simpa only [Valuation.skip, Nat.not_lt_zero, ↓reduceIte] using extend_beyond env xs i
+
+omit [SetTheory V] in
+theorem extend_append (env : Nat → V) (xs ys : List V) :
+    extend env (xs ++ ys) = extend (extend env xs) ys := by
+  induction xs generalizing env <;> simp_all [extend]
+
+omit [SetTheory V] in
+theorem skip_extend_at (env : Nat → V) (xs : List V) (count cutoff : Nat) :
+    Valuation.skip count (xs.length + cutoff) (extend env xs) =
+      extend (Valuation.skip count cutoff env) xs := by
+  induction xs generalizing env cutoff with
+  | nil => simp only [List.length_nil, Nat.zero_add, extend]
+  | cons x xs ih =>
+    simpa only [extend, List.length_cons, Nat.add_assoc, Nat.add_comm, Nat.add_left_comm,
+      Valuation.skip_cons] using ih (Valuation.cons x env) (cutoff + 1)
+
+omit [SetTheory V] in
+theorem skip_middle (env : Nat → V) (middle tail : List V) :
+    Valuation.skip middle.length tail.length (extend (extend env middle) tail) = extend env tail := by
+  simpa only [Nat.add_zero, skip_extend] using skip_extend_at (extend env middle) tail middle.length 0
+
+noncomputable def interpret (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) : (domains : List (AExpr β)) → TeleS V domains.length
+  | [] => .nil
+  | A :: rest => .cons (interp constants levels env A)
+    (fun x => interpret constants levels (Valuation.cons x env) rest)
+
+theorem piN_append (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (left right : List (AExpr β)) (w : Nat) (R : List V → V) :
+    piN w (interpret constants levels env (left ++ right)) R =
+      piN w (interpret constants levels env left) (fun xs =>
+        piN w (interpret constants levels (extend env xs) right) (fun ys => R (xs ++ ys))) := by
+  induction left generalizing env R with
+  | nil => rfl
+  | cons A rest ih =>
+    change piR w _ _ = piR w _ _
+    congr 1
+    funext x
+    exact ih (Valuation.cons x env) (fun xs => R (x :: xs))
+
+theorem curry_append (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (left right : List (AExpr β)) (w : Nat) (f : List V → V) :
+    curry w (interpret constants levels env (left ++ right)) f =
+      curry w (interpret constants levels env left) (fun xs =>
+        curry w (interpret constants levels (extend env xs) right) (fun ys => f (xs ++ ys))) := by
+  induction left generalizing env f with
+  | nil => rfl
+  | cons A rest ih =>
+    change lamR w _ _ = lamR w _ _
+    congr 1
+    funext x
+    exact ih (Valuation.cons x env) (fun xs => f (x :: xs))
+
+def lift (count : Nat) : List (AExpr β) → (cutoff : Nat := 0) → List (AExpr β)
+  | [], _ => []
+  | A :: rest, k => A.liftN count k :: lift count rest (k + 1)
+
+def inst (arg : AExpr β) : List (AExpr β) → (cutoff : Nat := 0) → List (AExpr β)
+  | [], _ => []
+  | A :: rest, k => A.inst arg k :: inst arg rest (k + 1)
+
+/-- A telescope of domains that all live in the same outer context. -/
+def independent : List (AExpr β) → (offset : Nat := 0) → List (AExpr β)
+  | [], _ => []
+  | A :: rest, offset => A.liftN offset :: independent rest (offset + 1)
+
+theorem piN_independent (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (domains : List (AExpr β)) (previous : List V) (w : Nat) (R : List V → V) :
+    piN w (interpret constants levels (extend env previous) (independent domains previous.length)) R =
+      piN w (simple (domains.map (interp constants levels env))) R := by
+  induction domains generalizing previous R with
+  | nil => rfl
+  | cons A rest ih =>
+    change piR w (interp constants levels (extend env previous) (A.liftN previous.length)) _ = piR w _ _
+    rw [interp_liftN, skip_extend]
+    congr 1
+    funext x
+    have ht := ih (previous ++ [x]) (fun xs => R (x :: xs))
+    have hlen : (previous ++ [x]).length = previous.length + 1 := by simp
+    rw [hlen] at ht
+    simpa only [extend_append, extend] using ht
+
+theorem curry_independent (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (domains : List (AExpr β)) (previous : List V) (w : Nat) (f : List V → V) :
+    curry w (interpret constants levels (extend env previous) (independent domains previous.length)) f =
+      curry w (simple (domains.map (interp constants levels env))) f := by
+  induction domains generalizing previous f with
+  | nil => rfl
+  | cons A rest ih =>
+    change lamR w (interp constants levels (extend env previous) (A.liftN previous.length)) _ = lamR w _ _
+    rw [interp_liftN, skip_extend]
+    congr 1
+    funext x
+    have ht := ih (previous ++ [x]) (fun xs => f (x :: xs))
+    have hlen : (previous ++ [x]).length = previous.length + 1 := by simp
+    rw [hlen] at ht
+    simpa only [extend_append, extend] using ht
+
+@[simp] theorem length_lift (count : Nat) (domains : List (AExpr β)) (k : Nat) :
+    (lift count domains k).length = domains.length := by
+  induction domains generalizing k <;> simp_all [lift]
+
+@[simp] theorem length_inst (arg : AExpr β) (domains : List (AExpr β)) (k : Nat) :
+    (inst arg domains k).length = domains.length := by
+  induction domains generalizing k <;> simp_all [inst]
+
+theorem fits_lift (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (count : Nat) (domains : List (AExpr β)) (k : Nat) (xs : List V) :
+    FitsS (interpret constants levels env (lift count domains k)) xs ↔
+      FitsS (interpret constants levels (Valuation.skip count k env) domains) xs := by
+  induction domains generalizing env k xs with
+  | nil => rfl
+  | cons A rest ih =>
+    cases xs with
+    | nil => rfl
+    | cons x xs =>
+      simp only [lift, interpret, FitsS, interp_liftN, ih, Valuation.skip_cons]
+
+theorem fits_inst (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (arg : AExpr β) (domains : List (AExpr β)) (k : Nat) (xs : List V) :
+    FitsS (interpret constants levels env (inst arg domains k)) xs ↔
+      FitsS (interpret constants levels
+        (Valuation.insert k (interp constants levels (Valuation.skip k 0 env) arg) env) domains) xs := by
+  induction domains generalizing env k xs with
+  | nil => rfl
+  | cons A rest ih =>
+    cases xs with
+    | nil => rfl
+    | cons x xs =>
+      simp only [inst, interpret, FitsS, interp_inst, ih,
+        Valuation.skip_succ_cons, Valuation.insert_cons]
+
+theorem piN_lift (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (count : Nat) (domains : List (AExpr β)) (cutoff w : Nat) (R : List V → V) :
+    piN w (interpret constants levels env (lift count domains cutoff)) R =
+      piN w (interpret constants levels (Valuation.skip count cutoff env) domains) R := by
+  induction domains generalizing env cutoff R with
+  | nil => rfl
+  | cons A rest ih =>
+    simp only [lift, interpret, piN, interp_liftN]
+    congr 1
+    funext x
+    simpa only [Valuation.skip_cons] using ih (Valuation.cons x env) (cutoff + 1) (fun xs => R (x :: xs))
+
+theorem curry_lift (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (count : Nat) (domains : List (AExpr β)) (cutoff w : Nat) (f : List V → V) :
+    curry w (interpret constants levels env (lift count domains cutoff)) f =
+      curry w (interpret constants levels (Valuation.skip count cutoff env) domains) f := by
+  induction domains generalizing env cutoff f with
+  | nil => rfl
+  | cons A rest ih =>
+    simp only [lift, interpret, curry, interp_liftN]
+    congr 1
+    funext x
+    simpa only [Valuation.skip_cons] using ih (Valuation.cons x env) (cutoff + 1) (fun xs => f (x :: xs))
+
+theorem piN_instL (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (sourceLevels : List VLevel) (domains : List (AExpr β)) (w : Nat) (R : List V → V) :
+    piN w (interpret constants levels env (domains.map (AExpr.instL sourceLevels))) R =
+      piN w (interpret constants (sourceLevels.map (VLevel.eval levels)) env domains) R := by
+  induction domains generalizing env R with
+  | nil => rfl
+  | cons A rest ih =>
+    change piR w (interp constants levels env (A.instL sourceLevels))
+      (fun x => piN w (interpret constants levels (Valuation.cons x env)
+        (rest.map (AExpr.instL sourceLevels))) (fun xs => R (x :: xs))) =
+      piR w (interp constants (sourceLevels.map (VLevel.eval levels)) env A) _
+    rw [interp_instL]
+    congr 1
+    funext x
+    exact ih (Valuation.cons x env) (fun xs => R (x :: xs))
+
+theorem curry_instL (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (sourceLevels : List VLevel) (domains : List (AExpr β)) (w : Nat) (f : List V → V) :
+    curry w (interpret constants levels env (domains.map (AExpr.instL sourceLevels))) f =
+      curry w (interpret constants (sourceLevels.map (VLevel.eval levels)) env domains) f := by
+  induction domains generalizing env f with
+  | nil => rfl
+  | cons A rest ih =>
+    change lamR w (interp constants levels env (A.instL sourceLevels))
+      (fun x => curry w (interpret constants levels (Valuation.cons x env)
+        (rest.map (AExpr.instL sourceLevels))) (fun xs => f (x :: xs))) =
+      lamR w (interp constants (sourceLevels.map (VLevel.eval levels)) env A) _
+    rw [interp_instL]
+    congr 1
+    funext x
+    exact ih (Valuation.cons x env) (fun xs => f (x :: xs))
+
+theorem fits_instL (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (sourceLevels : List VLevel) (domains : List (AExpr β)) (xs : List V) :
+    FitsS (interpret constants levels env (domains.map (AExpr.instL sourceLevels))) xs ↔
+      FitsS (interpret constants (sourceLevels.map (VLevel.eval levels)) env domains) xs := by
+  induction domains generalizing env xs with
+  | nil => rfl
+  | cons A rest ih =>
+    cases xs with
+    | nil => rfl
+    | cons x xs =>
+      change (x ∈ˢ interp constants levels env (A.instL sourceLevels) ∧
+        FitsS (interpret constants levels (Valuation.cons x env) (rest.map (AExpr.instL sourceLevels))) xs) ↔ _
+      simp only [interp_instL, ih, interpret, FitsS]
+
+/-- Every field sort is derived by the same semantic typing relation as an
+ordinary term. The executable producer checks each successive context. -/
+inductive Formed (entries : Environment β) : Context β → List (AExpr β) → Prop
+  | nil {Γ} : Formed entries Γ []
+  | cons {Γ A rest} (level : VLevel)
+      (domain : TypingClaim.{u,v} entries Γ A (.sort level))
+      (tail : Formed entries (Γ.push A) rest) : Formed entries Γ (A :: rest)
+
+theorem Formed.valid {entries : Environment β} {Γ : Context β} {domains : List (AExpr β)}
+    (h : Formed.{u,v} entries Γ domains) (constants : Assignment β V)
+    (hM : Realizes constants entries) (levels : List Nat) :
+    ∀ {env xs}, Γ.Valid constants levels env → FitsS (interpret constants levels env domains) xs →
+      (context Γ domains).Valid constants levels (extend env xs) := by
+  induction h with
+  | nil =>
+    intro env xs hΓ hxs
+    cases xs with
+    | nil => exact hΓ
+    | cons _ _ => exact hxs.elim
+  | cons l hA hrest ih =>
+    intro env xs hΓ hxs
+    cases xs with
+    | nil => exact hxs.elim
+    | cons x xs =>
+      exact ih (env := Valuation.cons x env) (xs := xs)
+        (hΓ.push (hA V constants hM levels env hΓ).1 hxs.1) hxs.2
+
+theorem Formed.append {entries : Environment β} {Γ : Context β} {left right : List (AExpr β)}
+    (hl : Formed.{u,v} entries Γ left) (hr : Formed.{u,v} entries (context Γ left) right) :
+    Formed.{u,v} entries Γ (left ++ right) := by
+  induction hl with
+  | nil => exact hr
+  | cons l hA hrest ih => exact .cons l hA (ih hr)
+
+end Ix.Theory.Model.Telescope
+
+namespace Ix.Theory.Model.AExpr
+
+open Certified
+universe u v
+variable {β : Type u}
+
+def forallN (p : PropWhen) : List (AExpr β) → AExpr β → AExpr β
+  | [], B => B
+  | A :: rest, B => .forallE p A (forallN p rest B)
+
+def lamN (p : PropWhen) : List (AExpr β) → AExpr β → AExpr β
+  | [], body => body
+  | A :: rest, body => .lam p A (lamN p rest body)
+
+def appN (f : AExpr β) : List (AExpr β) → AExpr β
+  | [] => f
+  | x :: xs => appN (.app f x) xs
+
+theorem forallN_append (p : PropWhen) (left right : List (AExpr β)) (B : AExpr β) :
+    forallN p (left ++ right) B = forallN p left (forallN p right B) := by
+  induction left <;> simp_all [forallN]
+
+theorem lamN_append (p : PropWhen) (left right : List (AExpr β)) (body : AExpr β) :
+    lamN p (left ++ right) body = lamN p left (lamN p right body) := by
+  induction left <;> simp_all [lamN]
+
+theorem appN_append (f : AExpr β) (left right : List (AExpr β)) :
+    appN f (left ++ right) = appN (appN f left) right := by
+  induction left generalizing f <;> simp_all [appN]
+
+theorem ReferencesIn.forallN {entries : Environment β} {p : PropWhen}
+    {domains : List (AExpr β)} {B : AExpr β}
+    (hD : ∀ A ∈ domains, A.ReferencesIn entries) (hB : B.ReferencesIn entries) :
+    (forallN p domains B).ReferencesIn entries := by
+  induction domains with
+  | nil => exact hB
+  | cons A rest ih =>
+    have hA := hD A (List.mem_cons_self ..)
+    have ht := ih (fun D h => hD D (List.mem_cons_of_mem A h))
+    intro r hr
+    exact (List.mem_append.mp hr).elim (hA r) (ht r)
+
+theorem ReferencesIn.lamN {entries : Environment β} {p : PropWhen}
+    {domains : List (AExpr β)} {body : AExpr β}
+    (hD : ∀ A ∈ domains, A.ReferencesIn entries) (hb : body.ReferencesIn entries) :
+    (lamN p domains body).ReferencesIn entries := by
+  induction domains with
+  | nil => exact hb
+  | cons A rest ih =>
+    have hA := hD A (List.mem_cons_self ..)
+    have ht := ih (fun D h => hD D (List.mem_cons_of_mem A h))
+    intro r hr
+    exact (List.mem_append.mp hr).elim (hA r) (ht r)
+
+@[simp] theorem erase_forallN (p : PropWhen) (domains : List (AExpr β)) (B : AExpr β) :
+    (forallN p domains B).erase = VExpr.forallN (domains.map erase) B.erase := by
+  induction domains <;> simp_all [forallN, erase, VExpr.forallN]
+
+@[simp] theorem erase_lamN (p : PropWhen) (domains : List (AExpr β)) (B : AExpr β) :
+    (lamN p domains B).erase = VExpr.lamN (domains.map erase) B.erase := by
+  induction domains <;> simp_all [lamN, erase, VExpr.lamN]
+
+@[simp] theorem erase_appN (f : AExpr β) (args : List (AExpr β)) :
+    (appN f args).erase = VExpr.appN f.erase (args.map erase) := by
+  induction args generalizing f <;> simp_all [appN, erase, VExpr.appN]
+
+variable {V : Type v} [SetTheory V]
+
+theorem interp_forallN (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (p : PropWhen) (domains : List (AExpr β)) (B : AExpr β) :
+    interp constants levels env (forallN p domains B) =
+      Telescope.piN (regime p levels) (Telescope.interpret constants levels env domains)
+        (fun xs => interp constants levels (Telescope.extend env xs) B) := by
+  induction domains generalizing env with
+  | nil => rfl
+  | cons A rest ih =>
+    simp only [forallN, interp, Telescope.interpret, Telescope.piN, Telescope.extend, ih]
+
+theorem interp_lamN (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (p : PropWhen) (domains : List (AExpr β)) (body : AExpr β) :
+    interp constants levels env (lamN p domains body) =
+      Telescope.curry (regime p levels) (Telescope.interpret constants levels env domains)
+        (fun xs => interp constants levels (Telescope.extend env xs) body) := by
+  induction domains generalizing env with
+  | nil => rfl
+  | cons A rest ih =>
+    simp only [lamN, interp, Telescope.interpret, Telescope.curry, Telescope.extend, ih]
+
+theorem interp_appN (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (f : AExpr β) (args : List (AExpr β)) :
+    interp constants levels env (appN f args) =
+      Telescope.applyN (interp constants levels env f) (args.map (interp constants levels env)) := by
+  induction args generalizing f <;> simp_all [appN, interp, Telescope.applyN]
+
+end Ix.Theory.Model.AExpr
+
+namespace Ix.Theory.Model.Telescope
+
+open Certified
+universe u v
+variable {β : Type u}
+
+/-- Formed domains give formation of the entire product telescope. Every
+outer binder has the zero condition of the final result sort. -/
+theorem Formed.forallN {entries : Environment β} {Γ : Context β} {domains : List (AExpr β)}
+    (h : Formed.{u,v} entries Γ domains) {B : AExpr β} {b : VLevel}
+    (hB : TypingClaim.{u,v} entries (context Γ domains) B (.sort b)) :
+    ∃ l, zeroCondition l = zeroCondition b ∧
+      TypingClaim.{u,v} entries Γ (.forallN (zeroCondition b) domains B) (.sort l) := by
+  induction h with
+  | nil => exact ⟨b, rfl, hB⟩
+  | cons a hA hrest ih =>
+    obtain ⟨l, hl, htail⟩ := ih hB
+    exact ⟨.imax a l, hl, TypingClaim.forallE hA htail hl.symm⟩
+
+end Ix.Theory.Model.Telescope
diff --git a/Ix/Theory/Model/Instantiation.lean b/Ix/Theory/Model/Instantiation.lean
new file mode 100644
index 000000000..dcaef4529
--- /dev/null
+++ b/Ix/Theory/Model/Instantiation.lean
@@ -0,0 +1,96 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Inductive.Telescope
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+omit [SetTheory V] in
+theorem Valuation.insert_extend_at (env : Nat → V) (xs : List V) (a : V) (k : Nat) :
+    Valuation.insert (xs.length + k) a (Telescope.extend env xs) =
+      Telescope.extend (Valuation.insert k a env) xs := by
+  induction xs generalizing env k with
+  | nil => simp only [List.length_nil, Nat.zero_add, Telescope.extend]
+  | cons x xs ih =>
+    simpa only [List.length_cons, Telescope.extend, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm, Valuation.insert_cons] using ih (Valuation.cons x env) (k + 1)
+
+omit [SetTheory V] in
+theorem Valuation.insert_extend (env : Nat → V) (xs : List V) (a : V) :
+    Valuation.insert xs.length a (Telescope.extend env xs) =
+      Telescope.extend (Valuation.cons a env) xs := by
+  simpa only [Nat.add_zero, Valuation.insert_zero] using Valuation.insert_extend_at env xs a 0
+
+namespace AExpr
+
+/-- Simultaneous substitution of an outermost-first field list. -/
+def instRev : AExpr β → List (AExpr β) → AExpr β
+  | e, [] => e
+  | e, a :: rest => instRev (e.inst a rest.length) rest
+
+theorem erase_instRev (e : AExpr β) (args : List (AExpr β)) :
+    (e.instRev args).erase = e.erase.instRev (args.map AExpr.erase) := by
+  induction args generalizing e <;> simp_all [instRev, VExpr.instRev]
+
+theorem interp_instRev (e : AExpr β) (args : List (AExpr β)) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) :
+    interp constants levels env (e.instRev args) =
+      interp constants levels (Telescope.extend env (args.map (interp constants levels env))) e := by
+  induction args generalizing e with
+  | nil => rfl
+  | cons a rest ih =>
+    rw [instRev, ih, interp_inst]
+    have hlen : (rest.map (interp constants levels env)).length = rest.length := List.length_map ..
+    rw [← hlen, Telescope.skip_extend, Valuation.insert_extend]
+    rfl
+
+theorem wellDenoted_instRev (e : AExpr β) (args : List (AExpr β)) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V)
+    (ha : ∀ a ∈ args, WellDenoted constants levels env a)
+    (he : WellDenoted constants levels
+      (Telescope.extend env (args.map (interp constants levels env))) e) :
+    WellDenoted constants levels env (e.instRev args) := by
+  induction args generalizing e with
+  | nil => exact he
+  | cons a rest ih =>
+    apply ih (e.inst a rest.length) (fun b hb => ha b (List.mem_cons_of_mem _ hb))
+    have hlen : (rest.map (interp constants levels env)).length = rest.length := List.length_map ..
+    apply wellDenoted_inst
+    · simpa only [← hlen, Telescope.skip_extend] using ha a List.mem_cons_self
+    · simpa only [← hlen, Telescope.skip_extend, Valuation.insert_extend, List.map_cons, Telescope.extend] using he
+
+end AExpr
+
+theorem wellDenoted_congr_env (e : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) {n k : Nat} (hs : e.Scope n k) (env env' : Nat → V)
+    (h : ∀ i, i < k → env i = env' i) :
+    WellDenoted constants levels env e ↔ WellDenoted constants levels env' e := by
+  induction e generalizing k env env' with
+  | app f a hf ha =>
+    simp only [WellDenoted, hf hs.1 env env' h, ha hs.2 env env' h,
+      interp_congr_env f constants levels hs.1 env env' h,
+      interp_congr_env a constants levels hs.2 env env' h]
+  | lam p A b hA hb | forallE p A b hA hb =>
+    have hcons (x : V) : ∀ i, i < k + 1 → Valuation.cons x env i = Valuation.cons x env' i := by
+      intro i hi
+      cases i with
+      | zero => rfl
+      | succ i => exact h i (by omega)
+    simp only [WellDenoted, hA hs.2.1 env env' h, interp_congr_env A constants levels hs.2.1 env env' h,
+      hb hs.2.2 _ _ (hcons _), interp_congr_env b constants levels hs.2.2 _ _ (hcons _)]
+  | proj _ _ e ih => exact ih hs env env' h
+  | _ => rfl
+
+theorem wellDenoted_closed (e : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) {n : Nat} (hs : e.Scope n 0) (env env' : Nat → V) :
+    WellDenoted constants levels env e ↔ WellDenoted constants levels env' e :=
+  wellDenoted_congr_env e constants levels hs env env' (fun _ h => (Nat.not_lt_zero _ h).elim)
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Interpret.lean b/Ix/Theory/Model/Interpret.lean
new file mode 100644
index 000000000..90b71cba6
--- /dev/null
+++ b/Ix/Theory/Model/Interpret.lean
@@ -0,0 +1,150 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Annotated
+import Ix.Theory.Model.PrimitiveValues
+import Ix.Theory.Model.Value
+
+/-!
+# Total interpretation of annotated Ix syntax
+
+Constants are interpreted through an explicit assignment, whose compatibility
+with checked declarations is a separate invariant. This definition does not
+traverse store references. Projections use the uniform ordinary-node field
+decoder, and literals use fixed numeral values. Typing either requires
+additional facts whose meanings are constructed during declaration admission.
+-/
+
+namespace Ix.Theory.Model
+
+open SetTheory SetModel
+
+universe u v w
+
+namespace Valuation
+
+def cons (x : V) (env : Nat → V) : Nat → V
+  | 0 => x
+  | i + 1 => env i
+
+@[simp] theorem cons_zero (x : V) (env : Nat → V) : cons x env 0 = x := rfl
+@[simp] theorem cons_succ (x : V) (env : Nat → V) (i : Nat) : cons x env (i + 1) = env i := rfl
+
+def skip (count cutoff : Nat) (env : Nat → V) : Nat → V :=
+  fun i => if i < cutoff then env i else env (count + i)
+
+def insert (cutoff : Nat) (x : V) (env : Nat → V) : Nat → V :=
+  fun i => if i < cutoff then env i else if i = cutoff then x else env (i - 1)
+
+@[simp] theorem skip_zero (env : Nat → V) : skip 0 0 env = env := by
+  funext i; simp [skip]
+
+@[simp] theorem skip_cons (n k : Nat) (x : V) (env : Nat → V) :
+    skip n (k + 1) (cons x env) = cons x (skip n k env) := by
+  funext i
+  cases i <;> simp [skip, cons]
+
+@[simp] theorem insert_cons (k : Nat) (x y : V) (env : Nat → V) :
+    insert (k + 1) x (cons y env) = cons y (insert k x env) := by
+  funext i
+  cases i with
+  | zero => simp [insert]
+  | succ i =>
+    by_cases h : i < k
+    · simp [insert, h]
+    · by_cases e : i = k
+      · simp [insert, e]
+      · have hi : i ≠ 0 := by omega
+        cases i with
+        | zero => exact (hi rfl).elim
+        | succ i => simp [insert, h, e]
+
+@[simp] theorem insert_zero (x : V) (env : Nat → V) : insert 0 x env = cons x env := by
+  funext i; cases i <;> simp [insert]
+
+@[simp] theorem skip_succ_cons (n : Nat) (x : V) (env : Nat → V) :
+    skip (n + 1) 0 (cons x env) = skip n 0 env := by
+  funext i
+  simp [skip, show n + 1 + i = (n + i) + 1 by omega]
+
+end Valuation
+
+/-- A value for every exact reference and concrete universe argument list. -/
+abbrev Assignment (β : Type u) (V : Type v) := ConstRef β → List Nat → V
+
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+noncomputable def interp (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) : AExpr β → V
+  | .bvar i => env i
+  | .sort l => univ (l.eval levels)
+  | .const r ls => constants r (ls.map (VLevel.eval levels))
+  | .app f a => app (interp constants levels env f) (interp constants levels env a)
+  | .lam p a b => lamR (regime p levels) (interp constants levels env a)
+    (fun x => interp constants levels (Valuation.cons x env) b)
+  | .forallE p a b => piR (regime p levels) (interp constants levels env a)
+    (fun x => interp constants levels (Valuation.cons x env) b)
+  | .proj _ i e => projectValue i (interp constants levels env e)
+  | .natLit n => Numeral.value n
+
+theorem interp_liftN (e : AExpr β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (n k : Nat) :
+    interp constants levels env (e.liftN n k) =
+      interp constants levels (Valuation.skip n k env) e := by
+  induction e generalizing k env with
+  | bvar i => simp [AExpr.liftN, interp, liftVar, Valuation.skip]; split <;> rfl
+  | lam p a b ha hb | forallE p a b ha hb =>
+    simp only [AExpr.liftN, interp, ha]
+    congr 1
+    funext x
+    rw [hb, Valuation.skip_cons]
+  | _ => simp_all [AExpr.liftN, interp]
+
+theorem interp_inst (e a : AExpr β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (k : Nat) :
+    interp constants levels env (e.inst a k) =
+      interp constants levels
+        (Valuation.insert k (interp constants levels (Valuation.skip k 0 env) a) env) e := by
+  induction e generalizing k env with
+  | bvar i =>
+    by_cases h : i < k
+    · simp [AExpr.inst, AExpr.instVar, interp, Valuation.insert, h]
+    · by_cases h' : i = k <;>
+        simp [AExpr.inst, AExpr.instVar, interp, Valuation.insert, h, h', interp_liftN]
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [AExpr.inst, interp, hA]
+    congr 1
+    funext x
+    rw [hb, Valuation.skip_succ_cons, Valuation.insert_cons]
+  | _ => simp_all [AExpr.inst, interp]
+
+theorem interp_instL (e : AExpr β) (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) (ls : List VLevel) :
+    interp constants levels env (e.instL ls) =
+      interp constants (ls.map (VLevel.eval levels)) env e := by
+  induction e generalizing env with
+  | const r us =>
+    simp [AExpr.instL, interp, List.map_map, Function.comp_def, VLevel.eval_inst]
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [AExpr.instL, interp, hA, regime_instCondition]
+    congr 1
+    funext x
+    exact hb _
+  | _ => simp_all [AExpr.instL, interp, VLevel.eval_inst]
+
+theorem interp_rename {γ : Type w} (e : AExpr β) (mapping : β → γ)
+    (constants : Assignment β V) (constants' : Assignment γ V)
+    (h : ∀ r ls, constants' (r.rename mapping) ls = constants r ls)
+    (levels : List Nat) (env : Nat → V) :
+    interp constants' levels env (e.rename mapping) = interp constants levels env e := by
+  induction e generalizing env with
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [AExpr.rename, interp, hA]
+    congr 1
+    funext x
+    exact hb _
+  | _ => simp_all [AExpr.rename, interp]
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Judgment.lean b/Ix/Theory/Model/Judgment.lean
new file mode 100644
index 000000000..17fe19535
--- /dev/null
+++ b/Ix/Theory/Model/Judgment.lean
@@ -0,0 +1,280 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Environment
+
+/-!
+# Semantic contracts and their rule producers
+
+These specifications quantify over every compatible dependency assignment,
+universe valuation, and satisfying context. The executable validator uses the
+proved rules below to construct these propositions; they are never unchecked
+witness fields supplied by its caller.
+-/
+
+namespace Ix.Theory.Model
+
+open SetTheory SetModel Certified
+
+universe u v
+variable {β : Type u}
+
+/-- Membership together with the hereditary invariants for term and type. -/
+def TypingClaim (entries : Environment β) (Γ : Context β) (e A : AExpr β) : Prop :=
+  ∀ (V : Type v) [SetTheory V] (constants : Assignment β V),
+    Realizes constants entries → ∀ levels env, Γ.Valid constants levels env →
+      WellDenoted constants levels env e ∧ WellDenoted constants levels env A ∧
+        interp constants levels env e ∈ˢ interp constants levels env A
+
+/-- Equality is a congruence on the total interpretation. Conversion does not
+manufacture typing or hereditary validity of either endpoint. -/
+def ConversionClaim (entries : Environment β) (Γ : Context β) (a b : AExpr β) : Prop :=
+  ∀ (V : Type v) [SetTheory V] (constants : Assignment β V),
+    Realizes constants entries → ∀ levels env, Γ.Valid constants levels env →
+      interp constants levels env a = interp constants levels env b
+
+variable {entries : Environment β} {Γ : Context β}
+
+namespace TypingClaim
+
+theorem sort (l : VLevel) : TypingClaim.{u,v} entries Γ (.sort l) (.sort (.succ l)) := by
+  intro V _ constants _ levels env _
+  exact ⟨trivial, trivial, univ_mem_univ _⟩
+
+theorem bvar {i : Nat} {A : AExpr β} (h : Γ[i]? = some A) :
+    TypingClaim.{u,v} entries Γ (.bvar i) A := by
+  intro V _ constants _ levels env hΓ
+  exact ⟨trivial, hΓ i A h⟩
+
+theorem const {r : ConstRef β} {entry : ConstantEntry β} {ls : List VLevel}
+    (h : entries r = some entry) (hn : ls.length = entry.universes) :
+    TypingClaim.{u,v} entries Γ (.const r ls) (entry.type.instL ls) := by
+  intro V _ constants hM levels env _
+  have hlen : (ls.map (VLevel.eval levels)).length = entry.universes := by simpa using hn
+  refine ⟨trivial, (wellDenoted_instL ..).mpr (hM.typeValid r entry h _ hlen env), ?_⟩
+  simpa only [interp, interp_instL] using hM.member r entry h _ hlen env
+
+theorem forallE {A B : AExpr β} {a b : VLevel} {p : PropWhen}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort a))
+    (hB : TypingClaim.{u,v} entries (Γ.push A) B (.sort b))
+    (hp : p = zeroCondition b) :
+    TypingClaim.{u,v} entries Γ (.forallE p A B) (.sort (.imax a b)) := by
+  intro V _ constants hM levels env hΓ
+  obtain ⟨hAw, _, hAm⟩ := hA V constants hM levels env hΓ
+  have hBx x hx := hB V constants hM levels (Valuation.cons x env) (hΓ.push hAw hx)
+  have hz : regime p levels = 0 ↔ b.eval levels = 0 := by
+    rw [hp]; exact regime_zeroCondition ..
+  refine ⟨⟨hAw, fun x hx => (hBx x hx).1,
+    b.eval levels, hz, fun x hx => (hBx x hx).2.2⟩, trivial, ?_⟩
+  exact annotated_pi_mem_univ hp hAm (fun x hx => (hBx x hx).2.2)
+
+theorem lam {A B body : AExpr β} {a b : VLevel} {p : PropWhen}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort a))
+    (hB : TypingClaim.{u,v} entries (Γ.push A) B (.sort b))
+    (hbody : TypingClaim.{u,v} entries (Γ.push A) body B)
+    (hp : p = zeroCondition b) :
+    TypingClaim.{u,v} entries Γ (.lam p A body) (.forallE p A B) := by
+  intro V _ constants hM levels env hΓ
+  obtain ⟨hAw, _, _⟩ := hA V constants hM levels env hΓ
+  have hBx x hx := hB V constants hM levels (Valuation.cons x env) (hΓ.push hAw hx)
+  have hbodyx x hx := hbody V constants hM levels (Valuation.cons x env) (hΓ.push hAw hx)
+  have hz : regime p levels = 0 ↔ b.eval levels = 0 := by
+    rw [hp]; exact regime_zeroCondition ..
+  refine ⟨⟨hAw, fun x hx => (hbodyx x hx).1, b.eval levels,
+    (fun x => interp constants levels (Valuation.cons x env) B), hz,
+    fun x hx => ⟨(hbodyx x hx).2.2, (hBx x hx).2.2⟩⟩, ?_, ?_⟩
+  · exact (forallE hA hB hp V constants hM levels env hΓ).1
+  · exact lamR_mem (fun x hx => (hbodyx x hx).2.2)
+
+theorem app {f a A B : AExpr β} {p : PropWhen}
+    (hf : TypingClaim.{u,v} entries Γ f (.forallE p A B))
+    (ha : TypingClaim.{u,v} entries Γ a A) :
+    TypingClaim.{u,v} entries Γ (.app f a) (B.inst a) := by
+  intro V _ constants hM levels env hΓ
+  obtain ⟨hfw, hpw, hfm⟩ := hf V constants hM levels env hΓ
+  obtain ⟨haw, _, ham⟩ := ha V constants hM levels env hΓ
+  obtain ⟨_, hBw, bv, hz, hBm⟩ := hpw
+  have hfm' : interp constants levels env f ∈ˢ
+      piR bv (interp constants levels env A)
+        (fun x => interp constants levels (Valuation.cons x env) B) := by
+    simpa only [interp, piR_zero_agree hz (fun _ _ => rfl)] using hfm
+  refine ⟨⟨hfw, haw, bv, interp constants levels env A,
+    (fun x => interp constants levels (Valuation.cons x env) B), hfm', ham, hBm⟩,
+    ?_, ?_⟩
+  · apply wellDenoted_inst
+    · simpa using haw
+    · simpa using hBw _ ham
+  · simp only [interp_inst, Valuation.skip_zero, Valuation.insert_zero]
+    apply app_mem_piR hfm' ham
+    intro hzero x hx
+    simpa only [hzero, univ_zero] using hBm x hx
+
+theorem conv {e A B : AExpr β} {l : VLevel}
+    (he : TypingClaim.{u,v} entries Γ e A)
+    (hB : TypingClaim.{u,v} entries Γ B (.sort l))
+    (hEq : ConversionClaim.{u,v} entries Γ A B) :
+    TypingClaim.{u,v} entries Γ e B := by
+  intro V _ constants hM levels env hΓ
+  obtain ⟨hew, _, hem⟩ := he V constants hM levels env hΓ
+  exact ⟨hew, (hB V constants hM levels env hΓ).1,
+    hEq V constants hM levels env hΓ ▸ hem⟩
+
+/-- Closed typed facts come only from an admitted semantic producer. -/
+theorem fact {r : ConstRef β} {entry : ConstantEntry β} {e A : AExpr β} {ls : List VLevel}
+    (hr : entries r = some entry) (hf : .typed e A ∈ entry.facts) (hn : ls.length = entry.universes) :
+    TypingClaim.{u,v} entries Γ (e.instL ls) (A.instL ls) := by
+  intro V _ constants hM levels env _
+  have hh := hM.factMeaning r entry hr (.typed e A) hf (ls.map (VLevel.eval levels))
+    (by simpa using hn) env
+  simpa only [ConstantFact.Meaning, wellDenoted_instL, interp_instL] using hh
+
+theorem natLit {r zero succ : ConstRef β} {entry : ConstantEntry β}
+    (hr : entries r = some entry) (hf : .natural zero succ ∈ entry.facts)
+    (hn : entry.universes = 0) (value : Nat) :
+    TypingClaim.{u,v} entries Γ (.natLit value) (.const r []) := by
+  intro V _ constants hM _ env _
+  have hh := hM.factMeaning r entry hr (.natural zero succ) hf [] (by simpa using hn.symm) env
+  exact ⟨trivial, trivial, hh.2.member value⟩
+
+/-- A typed lambda application gives a typed result of beta reduction,
+including the hereditary validity of that result. -/
+theorem betaResult {p : PropWhen} {D body arg B : AExpr β}
+    (hl : TypingClaim.{u,v} entries Γ (.lam p D body) (.forallE p D B))
+    (ha : TypingClaim.{u,v} entries Γ arg D) :
+    TypingClaim.{u,v} entries Γ (body.inst arg) (B.inst arg) := by
+  intro V _ constants hM levels env hΓ
+  have hl' := hl V constants hM levels env hΓ
+  have ha' := ha V constants hM levels env hΓ
+  have happ := app hl ha V constants hM levels env hΓ
+  have hbeta := wellDenoted_beta hl'.1 ha'.1 ha'.2.2
+  exact ⟨hbeta.1, happ.2.1, hbeta.2 ▸ happ.2.2⟩
+
+end TypingClaim
+
+namespace ConversionClaim
+
+theorem natZero {r zero succ : ConstRef β} {entry : ConstantEntry β}
+    (hr : entries r = some entry) (hf : .natural zero succ ∈ entry.facts) (hn : entry.universes = 0) :
+    ConversionClaim.{u,v} entries Γ (.natLit 0) (.const zero []) := by
+  intro V _ constants hM _ env _
+  have hh := hM.factMeaning r entry hr (.natural zero succ) hf [] (by simpa using hn.symm) env
+  exact hh.2.zeroValue.symm
+
+theorem natSucc {r zero succ : ConstRef β} {entry : ConstantEntry β}
+    (hr : entries r = some entry) (hf : .natural zero succ ∈ entry.facts) (hn : entry.universes = 0) (value : Nat) :
+    ConversionClaim.{u,v} entries Γ (.natLit (value + 1)) (.app (.const succ []) (.natLit value)) := by
+  intro V _ constants hM _ env _
+  have hh := hM.factMeaning r entry hr (.natural zero succ) hf [] (by simpa using hn.symm) env
+  exact (hh.2.succValue value).symm
+
+theorem refl (e : AExpr β) : ConversionClaim.{u,v} entries Γ e e := by
+  intro V _ constants hM levels env hΓ
+  rfl
+
+theorem symm {a b : AExpr β} (h : ConversionClaim.{u,v} entries Γ a b) :
+    ConversionClaim.{u,v} entries Γ b a := by
+  intro V _ constants hM levels env hΓ
+  exact (h V constants hM levels env hΓ).symm
+
+theorem trans {a b c : AExpr β} (h : ConversionClaim.{u,v} entries Γ a b)
+    (h' : ConversionClaim.{u,v} entries Γ b c) :
+    ConversionClaim.{u,v} entries Γ a c := by
+  intro V _ constants hM levels env hΓ
+  exact (h V constants hM levels env hΓ).trans (h' V constants hM levels env hΓ)
+
+theorem app {f f' a a' : AExpr β} (hf : ConversionClaim.{u,v} entries Γ f f')
+    (ha : ConversionClaim.{u,v} entries Γ a a') :
+    ConversionClaim.{u,v} entries Γ (.app f a) (.app f' a') := by
+  intro V _ constants hM levels env hΓ
+  simp only [interp, hf V constants hM levels env hΓ, ha V constants hM levels env hΓ]
+
+theorem proj {r : ConstRef β} {i : Nat} {a b : AExpr β}
+    (h : ConversionClaim.{u,v} entries Γ a b) :
+    ConversionClaim.{u,v} entries Γ (.proj r i a) (.proj r i b) := by
+  intro V _ constants hM levels env hΓ
+  exact congrArg (projectValue i) (h V constants hM levels env hΓ)
+
+theorem lam {A A' b b' : AExpr β} {p : PropWhen} {l : VLevel}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort l))
+    (hdom : ConversionClaim.{u,v} entries Γ A A')
+    (hbody : ConversionClaim.{u,v} entries (Γ.push A) b b') :
+    ConversionClaim.{u,v} entries Γ (.lam p A b) (.lam p A' b') := by
+  intro V _ constants hM levels env hΓ
+  have hAw := (hA V constants hM levels env hΓ).1
+  simp only [interp]
+  rw [← hdom V constants hM levels env hΓ]
+  apply lamR_congr
+  intro x hx
+  exact hbody V constants hM levels _ (hΓ.push hAw hx)
+
+theorem forallE {A A' B B' : AExpr β} {p : PropWhen} {l : VLevel}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort l))
+    (hdom : ConversionClaim.{u,v} entries Γ A A')
+    (hbody : ConversionClaim.{u,v} entries (Γ.push A) B B') :
+    ConversionClaim.{u,v} entries Γ (.forallE p A B) (.forallE p A' B') := by
+  intro V _ constants hM levels env hΓ
+  have hAw := (hA V constants hM levels env hΓ).1
+  simp only [interp]
+  rw [← hdom V constants hM levels env hΓ]
+  apply piR_congr
+  intro x hx
+  exact hbody V constants hM levels _ (hΓ.push hAw hx)
+
+theorem beta {p : PropWhen} {A b a T : AExpr β}
+    (hl : TypingClaim.{u,v} entries Γ (.lam p A b) T)
+    (ha : TypingClaim.{u,v} entries Γ a A) :
+    ConversionClaim.{u,v} entries Γ (.app (.lam p A b) a) (b.inst a) := by
+  intro V _ constants hM levels env hΓ
+  have hl' := (hl V constants hM levels env hΓ).1
+  obtain ⟨haw, _, ham⟩ := ha V constants hM levels env hΓ
+  exact (wellDenoted_beta hl' haw ham).2
+
+theorem eta {p : PropWhen} {A B f : AExpr β}
+    (hf : TypingClaim.{u,v} entries Γ f (.forallE p A B)) :
+    ConversionClaim.{u,v} entries Γ (.lam p A (.app (f.liftN 1) (.bvar 0))) f := by
+  intro V _ constants hM levels env hΓ
+  have hfm := (hf V constants hM levels env hΓ).2.2
+  simp only [interp, interp_liftN, Valuation.skip_one_cons, Valuation.cons_zero]
+  exact lamR_eta hfm
+
+theorem proofIrrel {A a b : AExpr β}
+    (hA : TypingClaim.{u,v} entries Γ A (.sort .zero))
+    (ha : TypingClaim.{u,v} entries Γ a A)
+    (hb : TypingClaim.{u,v} entries Γ b A) :
+    ConversionClaim.{u,v} entries Γ a b := by
+  intro V _ constants hM levels env hΓ
+  have hAm := (hA V constants hM levels env hΓ).2.2
+  have ham := (ha V constants hM levels env hΓ).2.2
+  have hbm := (hb V constants hM levels env hΓ).2.2
+  exact subsingleton_of_mem_univZero
+    (by simpa only [interp, VLevel.eval, univ_zero] using hAm) ham hbm
+
+theorem delta {r : ConstRef β} {entry : ConstantEntry β} {body : AExpr β}
+    {ls : List VLevel} (h : entries r = some entry) (hb : entry.body = some body)
+    (hn : ls.length = entry.universes) :
+    ConversionClaim.{u,v} entries Γ (.const r ls) (body.instL ls) := by
+  intro V _ constants hM levels env _
+  have hlen : (ls.map (VLevel.eval levels)).length = entry.universes := by simpa using hn
+  simpa only [interp, interp_instL] using hM.bodyValue r entry h body hb _ hlen env
+
+theorem sort {l l' : VLevel} (h : ∀ values, l.eval values = l'.eval values) :
+    ConversionClaim.{u,v} entries Γ (.sort l) (.sort l') := by
+  intro V _ constants hM levels env hΓ
+  simp only [interp, h]
+
+/-- Only an equation of the selected admitted entry may be instantiated.
+Typing of its applications remains a separate checker obligation. -/
+theorem equation {r : ConstRef β} {entry : ConstantEntry β}
+    {law : ConstantEquation β} {ls : List VLevel}
+    (h : entries r = some entry) (he : law ∈ entry.equations)
+    (hn : ls.length = entry.universes) :
+    ConversionClaim.{u,v} entries Γ (law.lhs.instL ls) (law.rhs.instL ls) := by
+  intro V _ constants hM levels env _
+  have hlen : (ls.map (VLevel.eval levels)).length = entry.universes := by simpa using hn
+  simpa only [interp_instL] using hM.equationValue r entry h law he _ hlen env
+
+end ConversionClaim
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/PrimitiveValues.lean b/Ix/Theory/Model/PrimitiveValues.lean
new file mode 100644
index 000000000..802f66b5f
--- /dev/null
+++ b/Ix/Theory/Model/PrimitiveValues.lean
@@ -0,0 +1,38 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.SetModel.TaggedSum
+
+namespace Ix.Theory.Model
+
+open SetTheory SetTheory.Tower
+
+universe u
+variable {V : Type u} [SetTheory V]
+
+/-- The ordinary container stores a tagged tuple as the first component of
+its node. These total destructors also fix the proof point. Ownership and
+field legality are obligations of the certified projection rule. -/
+noncomputable def projectValue (field : Nat) (value : V) : V :=
+  projS field (ssnd (sfst value))
+
+theorem projectValue_pt (field : Nat) : projectValue field (pt : V) = pt := by
+  simp only [projectValue, sfst_pt, ssnd_pt, projS_pt]
+
+theorem projectValue_node (field tag : Nat) (fields : List V) (branches : V) :
+    projectValue field (spair (inj tag (mkTower fields)) branches) = projS field (mkTower fields) := by
+  simp only [projectValue, sfst_spair, ssnd_inj]
+
+namespace Numeral
+
+noncomputable def zero : V := spair (inj 0 pt) empty
+noncomputable def succ (n : V) : V := spair (inj 1 pt) (graph (fun _ => n) (sing (inj 0 pt)))
+noncomputable def value : Nat → V
+  | 0 => zero
+  | n + 1 => succ (value n)
+
+end Numeral
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/ReferenceMap.lean b/Ix/Theory/Model/ReferenceMap.lean
new file mode 100644
index 000000000..3e345d050
--- /dev/null
+++ b/Ix/Theory/Model/ReferenceMap.lean
@@ -0,0 +1,168 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Support
+
+/-! Whole-reference substitution for independently checked model companions.
+A constructor may map to a definition, so this operation is more general
+than renaming a block address while retaining its member/constructor tag. -/
+
+namespace Ix.Theory
+
+universe u v w x
+variable {β : Type u} {γ : Type v} {δ : Type w}
+
+def VExpr.mapRefs (mapping : ConstRef β → ConstRef γ) : VExpr β → VExpr γ
+  | .bvar i => .bvar i
+  | .sort level => .sort level
+  | .const ref levels => .const (mapping ref) levels
+  | .app f a => .app (f.mapRefs mapping) (a.mapRefs mapping)
+  | .lam type body => .lam (type.mapRefs mapping) (body.mapRefs mapping)
+  | .forallE type body => .forallE (type.mapRefs mapping) (body.mapRefs mapping)
+  | .proj ref index major => .proj (mapping ref) index (major.mapRefs mapping)
+  | .natLit n => .natLit n
+
+namespace Model
+
+def AExpr.mapRefs (mapping : ConstRef β → ConstRef γ) : AExpr β → AExpr γ
+  | .bvar i => .bvar i
+  | .sort level => .sort level
+  | .const ref levels => .const (mapping ref) levels
+  | .app f a => .app (f.mapRefs mapping) (a.mapRefs mapping)
+  | .lam condition type body => .lam condition (type.mapRefs mapping) (body.mapRefs mapping)
+  | .forallE condition type body => .forallE condition (type.mapRefs mapping) (body.mapRefs mapping)
+  | .proj ref index major => .proj (mapping ref) index (major.mapRefs mapping)
+  | .natLit n => .natLit n
+
+@[simp] theorem AExpr.erase_mapRefs (e : AExpr β) (mapping : ConstRef β → ConstRef γ) :
+    (e.mapRefs mapping).erase = e.erase.mapRefs mapping := by
+  induction e <;> simp_all [AExpr.mapRefs, AExpr.erase, VExpr.mapRefs]
+
+@[simp] theorem AExpr.scope_mapRefs (e : AExpr β) (mapping : ConstRef β → ConstRef γ) (n k : Nat) :
+    (e.mapRefs mapping).Scope n k ↔ e.Scope n k := by
+  induction e generalizing k <;> simp_all [AExpr.mapRefs, AExpr.Scope]
+
+@[simp] theorem AExpr.references_mapRefs (e : AExpr β) (mapping : ConstRef β → ConstRef γ) :
+    (e.mapRefs mapping).references = e.references.map mapping := by
+  induction e <;> simp_all [AExpr.mapRefs, AExpr.references]
+
+@[simp] theorem AExpr.mapRefs_liftN (e : AExpr β) (mapping : ConstRef β → ConstRef γ) (n k : Nat) :
+    (e.liftN n k).mapRefs mapping = (e.mapRefs mapping).liftN n k := by
+  induction e generalizing k <;> simp_all [AExpr.mapRefs, AExpr.liftN]
+
+@[simp] theorem AExpr.mapRefs_inst (e a : AExpr β) (mapping : ConstRef β → ConstRef γ) (k : Nat) :
+    (e.inst a k).mapRefs mapping = (e.mapRefs mapping).inst (a.mapRefs mapping) k := by
+  induction e generalizing k with
+  | bvar i =>
+    by_cases hi : i < k
+    · simp [AExpr.inst, AExpr.instVar, AExpr.mapRefs, hi]
+    · by_cases he : i = k <;> simp [AExpr.inst, AExpr.instVar, AExpr.mapRefs, hi, he]
+  | _ => simp_all [AExpr.inst, AExpr.mapRefs]
+
+@[simp] theorem AExpr.mapRefs_instL (e : AExpr β) (mapping : ConstRef β → ConstRef γ) (levels : List VLevel) :
+    (e.instL levels).mapRefs mapping = (e.mapRefs mapping).instL levels := by
+  induction e <;> simp_all [AExpr.instL, AExpr.mapRefs]
+
+@[simp] theorem AExpr.mapRefs_id (e : AExpr β) : e.mapRefs id = e := by
+  induction e <;> simp_all [AExpr.mapRefs]
+
+theorem AExpr.mapRefs_comp (e : AExpr β) (first : ConstRef β → ConstRef γ) (second : ConstRef γ → ConstRef δ) :
+    (e.mapRefs first).mapRefs second = e.mapRefs (second ∘ first) := by
+  induction e <;> simp_all [AExpr.mapRefs, Function.comp_def]
+
+theorem AExpr.mapRefs_congr (e : AExpr β) (first second : ConstRef β → ConstRef γ)
+    (h : ∀ ref ∈ e.references, first ref = second ref) : e.mapRefs first = e.mapRefs second := by
+  induction e with
+  | const ref levels => simp [AExpr.mapRefs, h ref (by simp [AExpr.references])]
+  | app f a hf ha | lam condition f a hf ha | forallE condition f a hf ha =>
+    simp only [AExpr.mapRefs,
+      hf (fun ref hr => h ref (List.mem_append_left _ hr)),
+      ha (fun ref hr => h ref (List.mem_append_right _ hr))]
+  | proj ref index major ih =>
+    simp only [AExpr.mapRefs, h ref (List.mem_cons_self), ih (fun ref hr => h ref (List.mem_cons_of_mem _ hr))]
+  | _ => rfl
+
+/-- Restoration needs an inverse only on the references actually used by
+the restored expression. Unrelated auxiliaries are outside the premise. -/
+theorem AExpr.mapRefs_restore (e : AExpr β) (forward : ConstRef β → ConstRef γ)
+    (backward : ConstRef γ → ConstRef β)
+    (h : ∀ ref ∈ e.references, backward (forward ref) = ref) :
+    (e.mapRefs forward).mapRefs backward = e := by
+  rw [AExpr.mapRefs_comp, e.mapRefs_congr (backward ∘ forward) id h, AExpr.mapRefs_id]
+
+variable {V : Type x} [SetTheory V]
+
+theorem interp_mapRefs (e : AExpr β) (mapping : ConstRef β → ConstRef γ)
+    (constants : Assignment γ V) (levels : List Nat) (env : Nat → V) :
+    interp constants levels env (e.mapRefs mapping) =
+      interp (fun ref values => constants (mapping ref) values) levels env e := by
+  induction e generalizing env with
+  | lam condition type body ht hb | forallE condition type body ht hb =>
+    simp only [AExpr.mapRefs, interp, ht]
+    congr 1
+    funext value
+    exact hb _
+  | _ => simp_all [AExpr.mapRefs, interp]
+
+theorem wellDenoted_mapRefs (e : AExpr β) (mapping : ConstRef β → ConstRef γ)
+    (constants : Assignment γ V) (levels : List Nat) (env : Nat → V) :
+    WellDenoted constants levels env (e.mapRefs mapping) ↔
+      WellDenoted (fun ref values => constants (mapping ref) values) levels env e := by
+  induction e generalizing env with
+  | lam condition type body ht hb | forallE condition type body ht hb =>
+    simp only [AExpr.mapRefs, WellDenoted, ht, hb, interp_mapRefs]
+  | _ => simp_all [AExpr.mapRefs, WellDenoted, interp_mapRefs]
+
+/-- A permutation changes addresses and pulls the assignment back through its
+inverse. Only references actually used by the expression need an inverse. -/
+theorem interp_mapRefs_permutation (e : AExpr β) (forward : ConstRef β → ConstRef γ)
+    (backward : ConstRef γ → ConstRef β) (constants : Assignment β V)
+    (inverse : ∀ ref ∈ e.references, backward (forward ref) = ref)
+    (levels : List Nat) (env : Nat → V) :
+    interp (fun ref values => constants (backward ref) values) levels env (e.mapRefs forward) =
+      interp constants levels env e := by
+  rw [interp_mapRefs]
+  exact interp_congr_constants e _ constants
+    (fun ref hr values => congrArg (fun r => constants r values) (inverse ref hr)) levels env
+
+theorem wellDenoted_mapRefs_permutation (e : AExpr β) (forward : ConstRef β → ConstRef γ)
+    (backward : ConstRef γ → ConstRef β) (constants : Assignment β V)
+    (inverse : ∀ ref ∈ e.references, backward (forward ref) = ref)
+    (levels : List Nat) (env : Nat → V) :
+    WellDenoted (fun ref values => constants (backward ref) values) levels env (e.mapRefs forward) ↔
+      WellDenoted constants levels env e := by
+  rw [wellDenoted_mapRefs]
+  exact wellDenoted_congr_constants e _ constants
+    (fun ref hr values => congrArg (fun r => constants r values) (inverse ref hr)) levels env
+
+/-- Restoring the retained reference support preserves the entire interpreted
+expression, including binder annotations and both sides of a rule. -/
+theorem interp_mapRefs_restore (e : AExpr β) (forward : ConstRef β → ConstRef γ)
+    (backward : ConstRef γ → ConstRef β) (constants : Assignment β V)
+    (inverse : ∀ ref ∈ e.references, backward (forward ref) = ref)
+    (levels : List Nat) (env : Nat → V) :
+    interp constants levels env ((e.mapRefs forward).mapRefs backward) = interp constants levels env e := by
+  rw [e.mapRefs_restore forward backward inverse]
+
+/-- Equivalent model auxiliaries may share a representative. No injectivity
+is needed: the checked consumer must establish agreement of their values. -/
+theorem interp_mapRefs_merge (e : AExpr β) (before : Assignment β V) (after : Assignment γ V)
+    (mapping : ConstRef β → ConstRef γ)
+    (agree : ∀ ref ∈ e.references, ∀ levels, before ref levels = after (mapping ref) levels)
+    (levels : List Nat) (env : Nat → V) :
+    interp before levels env e = interp after levels env (e.mapRefs mapping) := by
+  rw [interp_mapRefs]
+  exact interp_congr_constants e before _ agree levels env
+
+theorem wellDenoted_mapRefs_merge (e : AExpr β) (before : Assignment β V) (after : Assignment γ V)
+    (mapping : ConstRef β → ConstRef γ)
+    (agree : ∀ ref ∈ e.references, ∀ levels, before ref levels = after (mapping ref) levels)
+    (levels : List Nat) (env : Nat → V) :
+    WellDenoted before levels env e ↔ WellDenoted after levels env (e.mapRefs mapping) := by
+  rw [wellDenoted_mapRefs]
+  exact wellDenoted_congr_constants e before _ agree levels env
+
+end Model
+end Ix.Theory
diff --git a/Ix/Theory/Model/SetModel/Container.lean b/Ix/Theory/Model/SetModel/Container.lean
new file mode 100644
index 000000000..de3a279a5
--- /dev/null
+++ b/Ix/Theory/Model/SetModel/Container.lean
@@ -0,0 +1,665 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetModel/Container.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetModel.RecGraph
+public import Ix.Theory.Model.SetModel.Iter
+public import Ix.Theory.Model.SetTheory.Derive.Choice
+
+@[expose] public section
+
+/-!
+# The closure witness of a member container (task #202, Stage B)
+
+A recursive family with function-space slots (`WType`, `PSet`, …) is the
+least fixed point of a functor whose fibres contain *functions* from
+member domains into the family's own fibres.  Its least pre-fixed point
+(`lfpFamSet`) needs a CLOSED MEMBER family to be intersected from; for
+finitary blocks that is the ω-iterate, for `Prop`-valued ones the top
+family — with a function-space slot at `Sort w`, `w ≠ 0`, neither works
+(the family's ranks are unbounded below the universe).
+
+This module exhibits the witness abstractly, for a functor `Φ` on
+families over an index set `I` PRESENTED AS A CONTAINER: every element
+of `Φ X` at `i` is `mk a g` for a shape `a ∈ A i` and a function `g`
+from the shape's positions `B a` into the fibres of `X` at the targets
+`tgt a p` (`helim`); shapes and position sets are members of `univ w`.
+The witness is the family of DECODED TREE CODES: a code is a set of
+labelled paths (a subset of a member `codeSpace t` built from the shapes
+and positions reachable from `t`), decoding is the recursion theorem
+(`RecGraph`) along the immediate-subcode relation on the accessible
+codes, and the decoded family is closed because a constructor step on
+decoded subcodes is the decoding of the assembled code (`mkCode`).
+Membership comes from replacement (`image_mem`) alone — the fibres are
+images of members — so no injection and no size argument beyond the
+universe's own closure is needed.  Everything here is over the bare
+`SetTheory` interface; no syntax.
+
+The index set `I` need not be a member of any universe (an index type
+may live above the family's sort): the reachable shapes are collected
+by depth (`shapesN`) through the shapes and positions only, which ARE
+members; no index is ever put inside a set.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+open Ix.Theory.Model.SetTheory.Tower (natUnion mem_natUnion natUnion_mem_univ_pos)
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-! ## Pair projections on `kpair` -/
+
+
+/-! ## The spaces reachable from an index -/
+
+section Spaces
+
+variable (A B : V → V) (tgt : V → V → V)
+
+/-- The shapes reachable from `t` in exactly `n` steps. -/
+noncomputable def shapesN (t : V) : Nat → V
+  | 0 => A t
+  | n + 1 => sUnion (image (fun a => sUnion (image (fun p => A (tgt a p)) (B a))) (shapesN t n))
+
+/-- The shapes reachable from `t`. -/
+noncomputable def shapes (t : V) : V := natUnion (shapesN A B tgt t)
+
+/-- The positions of the reachable shapes. -/
+noncomputable def positions (t : V) : V := sUnion (image B (shapes A B tgt t))
+
+/-- Paths of length `n`: nested pairs of positions, the first step
+outermost, `pt` the empty path. -/
+noncomputable def pathsN (t : V) : Nat → V
+  | 0 => unitSet
+  | n + 1 => sigmaPairs (positions A B tgt t) (fun _ => pathsN t n)
+
+/-- The paths from `t`. -/
+noncomputable def paths (t : V) : V := natUnion (pathsN A B tgt t)
+
+/-- The code space at `t`: the sets of labelled paths. -/
+noncomputable def codeSpace (t : V) : V :=
+  power (sigmaPairs (paths A B tgt t) (fun _ => shapes A B tgt t))
+
+variable {A B tgt}
+
+theorem mem_shapesN_succ {t x : V} {n : Nat} :
+    x ∈ˢ shapesN A B tgt t (n + 1) ↔
+      ∃ a, a ∈ˢ shapesN A B tgt t n ∧ ∃ p, p ∈ˢ B a ∧ x ∈ˢ A (tgt a p) := by
+  show x ∈ˢ sUnion (image _ _) ↔ _
+  rw [mem_sUnion]
+  constructor
+  · rintro ⟨y, hy, hxy⟩
+    obtain ⟨a, ha, rfl⟩ := mem_image.mp hy
+    obtain ⟨z, hz, hxz⟩ := mem_sUnion.mp hxy
+    obtain ⟨p, hp, rfl⟩ := mem_image.mp hz
+    exact ⟨a, ha, p, hp, hxz⟩
+  · rintro ⟨a, ha, p, hp, hx⟩
+    exact ⟨_, mem_image.mpr ⟨a, ha, rfl⟩, mem_sUnion.mpr ⟨_, mem_image.mpr ⟨p, hp, rfl⟩, hx⟩⟩
+
+theorem mem_shapes {t x : V} : x ∈ˢ shapes A B tgt t ↔ ∃ n, x ∈ˢ shapesN A B tgt t n :=
+  mem_natUnion
+
+theorem mem_positions {t p : V} :
+    p ∈ˢ positions A B tgt t ↔ ∃ a, a ∈ˢ shapes A B tgt t ∧ p ∈ˢ B a := by
+  show p ∈ˢ sUnion (image B _) ↔ _
+  rw [mem_sUnion]
+  constructor
+  · rintro ⟨y, hy, hpy⟩
+    obtain ⟨a, ha, rfl⟩ := mem_image.mp hy
+    exact ⟨a, ha, hpy⟩
+  · rintro ⟨a, ha, hp⟩
+    exact ⟨B a, mem_image.mpr ⟨a, ha, rfl⟩, hp⟩
+
+theorem mem_paths {t x : V} : x ∈ˢ paths A B tgt t ↔ ∃ n, x ∈ˢ pathsN A B tgt t n :=
+  mem_natUnion
+
+theorem pt_mem_paths (t : V) : (pt : V) ∈ˢ paths A B tgt t :=
+  mem_paths.mpr ⟨0, pt_mem_unitSet⟩
+
+theorem mem_pathsN_succ {t x : V} {n : Nat} :
+    x ∈ˢ pathsN A B tgt t (n + 1) ↔
+      ∃ p, p ∈ˢ positions A B tgt t ∧ ∃ q, q ∈ˢ pathsN A B tgt t n ∧ x = kpair p q :=
+  mem_sigmaPairs
+
+/-- Paths are closed under consing a position. -/
+theorem kpair_mem_paths {t p q : V} (hp : p ∈ˢ positions A B tgt t) (hq : q ∈ˢ paths A B tgt t) :
+    kpair p q ∈ˢ paths A B tgt t := by
+  obtain ⟨n, hn⟩ := mem_paths.mp hq
+  exact mem_paths.mpr ⟨n + 1, mem_pathsN_succ.mpr ⟨p, hp, q, hn, rfl⟩⟩
+
+/-- A path's tail is a path (and its head a position). -/
+theorem paths_uncons {t p q : V} (h : kpair p q ∈ˢ paths A B tgt t) :
+    p ∈ˢ positions A B tgt t ∧ q ∈ˢ paths A B tgt t := by
+  obtain ⟨n, hn⟩ := mem_paths.mp h
+  cases n with
+  | zero =>
+    exact absurd (mem_unitSet_iff.mp hn).symm (pt_ne_kpair p q)
+  | succ n =>
+    obtain ⟨p', hp', q', hq', heq⟩ := mem_pathsN_succ.mp hn
+    obtain ⟨rfl, rfl⟩ := kpair_inj heq
+    exact ⟨hp', mem_paths.mpr ⟨n, hq'⟩⟩
+
+theorem mem_codeSpace {t S : V} :
+    S ∈ˢ codeSpace A B tgt t ↔
+      ∀ x, x ∈ˢ S → ∃ q, q ∈ˢ paths A B tgt t ∧ ∃ a, a ∈ˢ shapes A B tgt t ∧ x = kpair q a := by
+  show S ∈ˢ power _ ↔ _
+  rw [mem_power]
+  constructor
+  · intro h x hx
+    exact mem_sigmaPairs.mp (h x hx)
+  · intro h x hx
+    obtain ⟨q, hq, a, ha, rfl⟩ := h x hx
+    exact mem_sigmaPairs.mpr ⟨q, hq, a, ha, rfl⟩
+
+/-! ### Membership in the universe -/
+
+section Univ
+
+variable {w : Nat} (hw : w ≠ 0) {I : V}
+  (hA : ∀ i, i ∈ˢ I → A i ∈ˢ (univ w : V))
+  (hB : ∀ i a, i ∈ˢ I → a ∈ˢ A i → B a ∈ˢ (univ w : V))
+  (htgt : ∀ i a p, i ∈ˢ I → a ∈ˢ A i → p ∈ˢ B a → tgt a p ∈ˢ I)
+include hw hA hB htgt
+
+omit hw hA hB in
+/-- Every reachable shape is a shape at some index. -/
+theorem shapesN_sub {t : V} (ht : t ∈ˢ I) :
+    ∀ n a, a ∈ˢ shapesN A B tgt t n → ∃ i, i ∈ˢ I ∧ a ∈ˢ A i
+  | 0, a, ha => ⟨t, ht, ha⟩
+  | n + 1, a, ha => by
+    obtain ⟨a', ha', p, hp, hx⟩ := mem_shapesN_succ.mp ha
+    obtain ⟨i, hi, hai⟩ := shapesN_sub ht n a' ha'
+    exact ⟨tgt a' p, htgt i a' p hi hai hp, hx⟩
+
+theorem shapesN_mem {t : V} (ht : t ∈ˢ I) : ∀ n, shapesN A B tgt t n ∈ˢ (univ w : V)
+  | 0 => hA t ht
+  | n + 1 => by
+    have hU := univ_isTGUniverse (V := V) hw
+    show sUnion (image _ _) ∈ˢ _
+    refine hU.famUnion_mem (shapesN_mem ht n) fun a ha => ?_
+    obtain ⟨i, hi, hai⟩ := shapesN_sub htgt ht n a ha
+    refine hU.famUnion_mem (hB i a hi hai) fun p hp => ?_
+    exact hA _ (htgt i a p hi hai hp)
+
+theorem shapes_mem {t : V} (ht : t ∈ˢ I) : shapes A B tgt t ∈ˢ (univ w : V) :=
+  natUnion_mem_univ_pos hw (shapesN_mem hw hA hB htgt ht)
+
+omit hw hA hB in
+theorem shapes_sub {t a : V} (ht : t ∈ˢ I) (ha : a ∈ˢ shapes A B tgt t) :
+    ∃ i, i ∈ˢ I ∧ a ∈ˢ A i := by
+  obtain ⟨n, hn⟩ := mem_shapes.mp ha
+  exact shapesN_sub htgt ht n a hn
+
+theorem positions_mem {t : V} (ht : t ∈ˢ I) : positions A B tgt t ∈ˢ (univ w : V) := by
+  have hU := univ_isTGUniverse (V := V) hw
+  refine hU.famUnion_mem (shapes_mem hw hA hB htgt ht) fun a ha => ?_
+  obtain ⟨i, hi, hai⟩ := shapes_sub htgt ht ha
+  exact hB i a hi hai
+
+theorem pathsN_mem {t : V} (ht : t ∈ˢ I) : ∀ n, pathsN A B tgt t n ∈ˢ (univ w : V)
+  | 0 => unitSet_mem_univ w
+  | n + 1 => (univ_isTGUniverse hw).sigmaPairs_mem (positions_mem hw hA hB htgt ht)
+      fun _ _ => pathsN_mem ht n
+
+theorem paths_mem {t : V} (ht : t ∈ˢ I) : paths A B tgt t ∈ˢ (univ w : V) :=
+  natUnion_mem_univ_pos hw (pathsN_mem hw hA hB htgt ht)
+
+theorem codeSpace_mem {t : V} (ht : t ∈ˢ I) : codeSpace A B tgt t ∈ˢ (univ w : V) := by
+  have hU := univ_isTGUniverse (V := V) hw
+  exact hU.power_mem (hU.sigmaPairs_mem (paths_mem hw hA hB htgt ht)
+    fun _ _ => shapes_mem hw hA hB htgt ht)
+
+end Univ
+
+/-! ### The spaces grow along a step -/
+
+section Step
+
+variable {t a p : V} (ha : a ∈ˢ A t) (hp : p ∈ˢ B a)
+include ha hp
+
+theorem shapesN_step_sub : ∀ n, shapesN A B tgt (tgt a p) n ⊆ˢ shapesN A B tgt t (n + 1)
+  | 0 => fun x hx => mem_shapesN_succ.mpr ⟨a, ha, p, hp, hx⟩
+  | n + 1 => fun x hx => by
+    obtain ⟨a', ha', p', hp', hx'⟩ := mem_shapesN_succ.mp hx
+    exact mem_shapesN_succ.mpr ⟨a', shapesN_step_sub n a' ha', p', hp', hx'⟩
+
+theorem shapes_step_sub : shapes A B tgt (tgt a p) ⊆ˢ shapes A B tgt t := by
+  intro x hx
+  obtain ⟨n, hn⟩ := mem_shapes.mp hx
+  exact mem_shapes.mpr ⟨n + 1, shapesN_step_sub ha hp n x hn⟩
+
+theorem positions_step_sub : positions A B tgt (tgt a p) ⊆ˢ positions A B tgt t := by
+  intro x hx
+  obtain ⟨a', ha', hx'⟩ := mem_positions.mp hx
+  exact mem_positions.mpr ⟨a', shapes_step_sub ha hp a' ha', hx'⟩
+
+theorem pathsN_step_sub : ∀ n, pathsN A B tgt (tgt a p) n ⊆ˢ pathsN A B tgt t n
+  | 0 => Subset.refl _
+  | n + 1 => fun x hx => by
+    obtain ⟨p', hp', q, hq, rfl⟩ := mem_pathsN_succ.mp hx
+    exact mem_pathsN_succ.mpr ⟨p', positions_step_sub ha hp p' hp', q, pathsN_step_sub n q hq, rfl⟩
+
+theorem paths_step_sub : paths A B tgt (tgt a p) ⊆ˢ paths A B tgt t := by
+  intro x hx
+  obtain ⟨n, hn⟩ := mem_paths.mp hx
+  exact mem_paths.mpr ⟨n, pathsN_step_sub ha hp n x hn⟩
+
+/-- A position of a root shape is a position of the root's space. -/
+theorem mem_positions_of_root : p ∈ˢ positions A B tgt t :=
+  mem_positions.mpr ⟨a, mem_shapes.mpr ⟨0, ha⟩, hp⟩
+
+end Step
+
+end Spaces
+
+/-! ## Codes: the root label, the subcodes, the assembly -/
+
+section Codes
+
+variable (B : V → V)
+
+/-- The labels at the empty path. -/
+noncomputable def rootLabels (S : V) : V := image ssnd (sep S fun pr => sfst pr = pt)
+
+/-- A code has a root: some label sits at the empty path. -/
+def HasRoot (S : V) : Prop := ∃ a, kpair pt a ∈ˢ S
+
+/-- The root label (a choice among the labels at the empty path). -/
+noncomputable def lab (S : V) : V := schoice (rootLabels S)
+
+/-- The subcode at position `p`: the labelled paths under `p`, the
+first step stripped. -/
+noncomputable def subCode (S p : V) : V :=
+  image (fun pr => kpair (ssnd (sfst pr)) (ssnd pr)) (sep S fun pr => ∃ q, sfst pr = kpair p q)
+
+/-- The code of a tree with root shape `a` and subcodes `app g p` at
+the positions `p ∈ B a`: the root pair and every subcode's pairs with
+the position prepended. -/
+noncomputable def mkCode (a g : V) : V :=
+  binUnion (sing (kpair pt a))
+    (sUnion (image (fun p => image (fun pr => kpair (kpair p (sfst pr)) (ssnd pr)) (app g p)) (B a)))
+
+variable {B}
+
+theorem mem_mkCode {a g x : V} :
+    x ∈ˢ mkCode B a g ↔
+      x = kpair pt a ∨ ∃ p, p ∈ˢ B a ∧ ∃ pr, pr ∈ˢ app g p ∧ x = kpair (kpair p (sfst pr)) (ssnd pr) := by
+  unfold mkCode
+  rw [mem_binUnion, mem_sing, mem_sUnion]
+  refine or_congr Iff.rfl ⟨?_, ?_⟩
+  · rintro ⟨y, hy, hxy⟩
+    obtain ⟨p, hp, rfl⟩ := mem_image.mp hy
+    obtain ⟨pr, hpr, rfl⟩ := mem_image.mp hxy
+    exact ⟨p, hp, pr, hpr, rfl⟩
+  · rintro ⟨p, hp, pr, hpr, rfl⟩
+    exact ⟨_, mem_image.mpr ⟨p, hp, rfl⟩, mem_image.mpr ⟨pr, hpr, rfl⟩⟩
+
+theorem mem_rootLabels {S x : V} :
+    x ∈ˢ rootLabels S ↔ ∃ pr, pr ∈ˢ S ∧ sfst pr = pt ∧ ssnd pr = x := by
+  unfold rootLabels
+  rw [mem_image]
+  constructor
+  · rintro ⟨pr, hpr, rfl⟩
+    exact ⟨pr, (mem_sep.mp hpr).1, (mem_sep.mp hpr).2, rfl⟩
+  · rintro ⟨pr, hpr, h1, rfl⟩
+    exact ⟨pr, mem_sep.mpr ⟨hpr, h1⟩, rfl⟩
+
+theorem hasRoot_mkCode (a g : V) : HasRoot (mkCode B a g) :=
+  ⟨a, mem_mkCode.mpr (Or.inl rfl)⟩
+
+theorem rootLabels_mkCode (a g : V) : rootLabels (mkCode B a g) = sing a := by
+  apply ext
+  intro x
+  rw [mem_rootLabels, mem_sing]
+  constructor
+  · rintro ⟨pr, hpr, h1, rfl⟩
+    rcases mem_mkCode.mp hpr with rfl | ⟨p, -, pr', -, rfl⟩
+    · exact ssnd_kpair _ _
+    · rw [sfst_kpair] at h1
+      exact absurd h1.symm (pt_ne_kpair _ _)
+  · rintro rfl
+    exact ⟨kpair pt x, mem_mkCode.mpr (Or.inl rfl), sfst_kpair _ _, ssnd_kpair _ _⟩
+
+theorem lab_mkCode (a g : V) : lab (mkCode B a g) = a := by
+  unfold lab
+  rw [rootLabels_mkCode]
+  exact mem_sing.mp (schoice_mem (mem_sing.mpr rfl))
+
+/-- The subcode of an assembled code at a position is the subcode put
+there (the codes' elements being labelled paths). -/
+theorem subCode_mkCode {a g p : V} (hp : p ∈ˢ B a)
+    (hpairs : ∀ x, x ∈ˢ app g p → ∃ q b, x = kpair q b) :
+    subCode (mkCode B a g) p = app g p := by
+  apply ext
+  intro x
+  unfold subCode
+  rw [mem_image]
+  constructor
+  · rintro ⟨pr, hpr, rfl⟩
+    obtain ⟨hmem, q, hq⟩ := mem_sep.mp hpr
+    rcases mem_mkCode.mp hmem with rfl | ⟨p', hp', pr', hpr', rfl⟩
+    · rw [sfst_kpair] at hq
+      exact absurd hq (pt_ne_kpair _ _)
+    · rw [sfst_kpair] at hq
+      obtain ⟨rfl, rfl⟩ := kpair_inj hq
+      obtain ⟨q', b, rfl⟩ := hpairs pr' hpr'
+      simp only [sfst_kpair, ssnd_kpair]
+      exact hpr'
+  · intro hx
+    obtain ⟨q, b, rfl⟩ := hpairs x hx
+    refine ⟨kpair (kpair p q) b, mem_sep.mpr ⟨mem_mkCode.mpr (Or.inr ⟨p, hp, kpair q b, hx, ?_⟩), q, sfst_kpair _ _⟩, ?_⟩
+    · rw [sfst_kpair, ssnd_kpair]
+    · rw [sfst_kpair, ssnd_kpair, ssnd_kpair]
+
+section InSpace
+
+variable {A : V → V} {tgt : V → V → V}
+
+theorem codeSpace_pairs {t S : V} (hS : S ∈ˢ codeSpace A B tgt t) :
+    ∀ x, x ∈ˢ S → ∃ q a, x = kpair q a := by
+  intro x hx
+  obtain ⟨q, -, a, -, rfl⟩ := mem_codeSpace.mp hS x hx
+  exact ⟨q, a, rfl⟩
+
+/-- Subcodes stay in the code space. -/
+theorem subCode_mem_codeSpace {t S p : V} (hS : S ∈ˢ codeSpace A B tgt t) :
+    subCode S p ∈ˢ codeSpace A B tgt t := by
+  rw [mem_codeSpace]
+  intro x hx
+  unfold subCode at hx
+  obtain ⟨pr, hpr, rfl⟩ := mem_image.mp hx
+  obtain ⟨hmem, q, hq⟩ := mem_sep.mp hpr
+  obtain ⟨q', hq', a, ha, rfl⟩ := mem_codeSpace.mp hS pr hmem
+  rw [sfst_kpair] at hq
+  subst hq
+  rw [sfst_kpair, ssnd_kpair, ssnd_kpair]
+  exact ⟨q, (paths_uncons hq').2, a, ha, rfl⟩
+
+/-- The assembled code of a root shape at `t` and subcodes at the
+targets is in the code space at `t`. -/
+theorem mkCode_mem_codeSpace {t a g : V} (ha : a ∈ˢ A t)
+    (hg : ∀ p, p ∈ˢ B a → app g p ∈ˢ codeSpace A B tgt (tgt a p)) :
+    mkCode B a g ∈ˢ codeSpace A B tgt t := by
+  rw [mem_codeSpace]
+  intro x hx
+  rcases mem_mkCode.mp hx with rfl | ⟨p, hp, pr, hpr, rfl⟩
+  · exact ⟨pt, pt_mem_paths t, a, mem_shapes.mpr ⟨0, ha⟩, rfl⟩
+  · obtain ⟨q, hq, b, hb, rfl⟩ := mem_codeSpace.mp (hg p hp) pr hpr
+    rw [sfst_kpair, ssnd_kpair]
+    refine ⟨kpair p q, kpair_mem_paths (mem_positions_of_root ha hp) (paths_step_sub ha hp q hq),
+      b, shapes_step_sub ha hp b hb, rfl⟩
+
+end InSpace
+
+end Codes
+
+/-! ## Decoding: the recursion theorem along the subcodes -/
+
+section Decode
+
+variable (A B : V → V) (tgt : V → V → V) (I : V) (w : Nat) (mk : V → V → V)
+
+/-- All codes at all indices (a set; membership in a universe is not
+needed for a recursion index set). -/
+noncomputable def allCodes : V := sUnion (image (codeSpace A B tgt) I)
+
+open Classical in
+/-- The immediate subcodes of a code with a root. -/
+noncomputable def codePred (S : V) : V :=
+  if HasRoot S then image (subCode S) (B (lab S)) else empty
+
+open Classical in
+/-- The decoding step: the container's builder at the root label (a
+shape at some index) and the decoded subcodes (the point off the
+guard). -/
+noncomputable def codeStep (S g : V) : V :=
+  if HasRoot S ∧ ∃ i, i ∈ˢ I ∧ lab S ∈ˢ A i then
+    mk (lab S) (graph (fun p => app g (subCode S p)) (B (lab S)))
+  else pt
+
+/-- The decoding graph: the recursion theorem's least fixed point at
+level `w + 1`, bounded by `univ w`. -/
+noncomputable def decodeGraph : V :=
+  recGraph (w + 1) (allCodes A B tgt I) (codePred B) (fun _ => univ w) (codeStep A B I mk)
+
+/-- The accessible codes. -/
+noncomputable def accCodes : V := accFam (allCodes A B tgt I) (codePred B) (fun _ => True)
+
+/-- The decoding: the selector of the decoding graph. -/
+noncomputable def decode (S : V) : V := recSel (decodeGraph A B tgt I w mk) S
+
+variable {A B tgt I w mk}
+
+theorem mem_allCodes {S : V} : S ∈ˢ allCodes A B tgt I ↔ ∃ t, t ∈ˢ I ∧ S ∈ˢ codeSpace A B tgt t := by
+  unfold allCodes
+  rw [mem_sUnion]
+  constructor
+  · rintro ⟨y, hy, hS⟩
+    obtain ⟨t, ht, rfl⟩ := mem_image.mp hy
+    exact ⟨t, ht, hS⟩
+  · rintro ⟨t, ht, hS⟩
+    exact ⟨_, mem_image.mpr ⟨t, ht, rfl⟩, hS⟩
+
+theorem codePred_of_root {S : V} (h : HasRoot S) : codePred B S = image (subCode S) (B (lab S)) := by
+  unfold codePred; exact if_pos h
+
+theorem codePred_of_not {S : V} (h : ¬ HasRoot S) : codePred B S = empty := by
+  unfold codePred; exact if_neg h
+
+theorem codePred_sub {S : V} (hS : S ∈ˢ allCodes A B tgt I) : codePred B S ⊆ˢ allCodes A B tgt I := by
+  intro x hx
+  by_cases h : HasRoot S
+  · rw [codePred_of_root h] at hx
+    obtain ⟨p, -, rfl⟩ := mem_image.mp hx
+    obtain ⟨t, ht, hSt⟩ := mem_allCodes.mp hS
+    exact mem_allCodes.mpr ⟨t, ht, subCode_mem_codeSpace hSt⟩
+  · rw [codePred_of_not h] at hx
+    exact absurd hx (not_mem_empty x)
+
+/-- **Accessibility, unfolded**: a code is accessible iff its immediate
+subcodes are. -/
+theorem accFam_iff {J : V} {pred : V → V} {Cond : V → Prop} (hpred : ∀ i, i ∈ˢ J → pred i ⊆ˢ J)
+    {i : V} (hi : i ∈ˢ J) :
+    (∃ y, y ∈ˢ app (accFam J pred Cond) i) ↔
+      Cond i ∧ ∀ j, j ∈ˢ pred i → ∃ y, y ∈ˢ app (accFam J pred Cond) j := by
+  have h := app_lfpFamSet_eq (F := accStep J pred Cond) ⟨_, accStep_closed (pred := pred) (Cond := Cond)⟩
+    (accStep_mono hpred) accStep_maps hi
+  unfold accFam
+  rw [← h, app_app_accStep (lfpFamSet_mem _ _ _) hi]
+  unfold accFibre
+  constructor
+  · rintro ⟨y, hy⟩
+    exact (mem_truthVal.mp hy).1
+  · intro hc
+    exact ⟨pt, mem_truthVal.mpr ⟨hc, rfl⟩⟩
+
+theorem accCodes_iff {S : V} (hS : S ∈ˢ allCodes A B tgt I) :
+    (∃ y, y ∈ˢ app (accCodes A B tgt I) S) ↔
+      ∀ S', S' ∈ˢ codePred B S → ∃ y, y ∈ˢ app (accCodes A B tgt I) S' := by
+  unfold accCodes
+  rw [accFam_iff (fun _ hS' => codePred_sub hS') hS]
+  exact ⟨fun h => h.2, fun h => ⟨trivial, h⟩⟩
+
+section Facts
+
+variable {w : Nat} (hw : w ≠ 0)
+  (hB : ∀ i a, i ∈ˢ I → a ∈ˢ A i → B a ∈ˢ (univ w : V))
+  (hmkU : ∀ i a g, i ∈ˢ I → a ∈ˢ A i → g ∈ˢ (univ w : V) → mk a g ∈ˢ (univ w : V))
+include hw hB hmkU
+
+omit hw hB hmkU in
+theorem decodeGraph_hB : ∀ S, S ∈ˢ allCodes A B tgt I → (univ w : V) ∈ˢ (univ (w + 1) : V) :=
+  fun _ _ => univ_mem_univ w
+
+/-- The step lands in the bound: the builder at members. -/
+theorem codeStep_mem {S g : V} (hS : S ∈ˢ allCodes A B tgt I)
+    (hg : g ∈ˢ piSet (codePred B S) fun j => app (decodeGraph A B tgt I w mk) j) :
+    codeStep A B I mk S g ∈ˢ (univ w : V) := by
+  have hU := univ_isTGUniverse (V := V) hw
+  unfold codeStep
+  split
+  · next h =>
+    obtain ⟨hroot, i, hi, hlab⟩ := h
+    have hBl : B (lab S) ∈ˢ (univ w : V) := hB i _ hi hlab
+    refine hmkU i _ _ hi hlab ?_
+    -- the graph of the decoded subcodes over the member position set
+    unfold graph
+    refine hU.image_mem hBl fun p hp => ?_
+    refine hU.kpair_mem hBl (hU.transitive hBl hp) ?_
+    -- the value: in the decoding graph's fibre, bounded by the universe
+    have hpred : subCode S p ∈ˢ codePred B S := by
+      rw [codePred_of_root hroot]
+      exact mem_image.mpr ⟨p, hp, rfl⟩
+    have hv := app_mem_of_mem_piSet hg hpred
+    unfold decodeGraph at hv
+    rw [app_recGraph_eq decodeGraph_hB (fun _ hS' => codePred_sub hS')
+      (codePred_sub hS _ hpred)] at hv
+    exact (mem_recGraphFibre.mp hv).1
+  · exact hU.pt_mem (empty_mem_univ w)
+
+theorem decodeGraph_hst : ∀ S, S ∈ˢ allCodes A B tgt I →
+    ∀ g, g ∈ˢ piSet (codePred B S) (fun j => app (decodeGraph A B tgt I w mk) j) →
+      codeStep A B I mk S g ∈ˢ (univ w : V) :=
+  fun _ hS _ hg => codeStep_mem hw hB hmkU hS hg
+
+/-- **Accessible codes decode uniquely**: the decoding graph's fibre is
+a singleton. -/
+theorem decode_unique {S : V} (hS : S ∈ˢ allCodes A B tgt I)
+    (hacc : ∃ y, y ∈ˢ app (accCodes A B tgt I) S) :
+    (∃ v, v ∈ˢ app (decodeGraph A B tgt I w mk) S) ∧
+      ∀ v v', v ∈ˢ app (decodeGraph A B tgt I w mk) S → v' ∈ˢ app (decodeGraph A B tgt I w mk) S →
+        v = v' :=
+  recGraph_exists_unique decodeGraph_hB (fun _ hS' => codePred_sub hS')
+    (decodeGraph_hst hw hB hmkU) S hS _ hacc.choose_spec
+
+/-- The decoding of an accessible code is a member. -/
+theorem decode_mem_univ {S : V} (hS : S ∈ˢ allCodes A B tgt I)
+    (hacc : ∃ y, y ∈ˢ app (accCodes A B tgt I) S) :
+    decode A B tgt I w mk S ∈ˢ (univ w : V) := by
+  have hv := recSel_mem (decode_unique hw hB hmkU hS hacc).1
+  unfold decodeGraph at hv
+  rw [app_recGraph_eq decodeGraph_hB (fun _ hS' => codePred_sub hS') hS] at hv
+  exact (mem_recGraphFibre.mp hv).1
+
+/-- **The decoding equation** at an accessible code with a root: the
+builder at the root label and the decoded subcodes. -/
+theorem decode_eq {S : V} (hS : S ∈ˢ allCodes A B tgt I)
+    (hacc : ∃ y, y ∈ˢ app (accCodes A B tgt I) S) (hroot : HasRoot S)
+    (hlab : ∃ i, i ∈ˢ I ∧ lab S ∈ˢ A i) :
+    decode A B tgt I w mk S
+      = mk (lab S) (graph (fun p => decode A B tgt I w mk (subCode S p)) (B (lab S))) := by
+  have hP : ∀ j, j ∈ˢ codePred B S →
+      (∃ v, v ∈ˢ app (decodeGraph A B tgt I w mk) j) ∧
+      ∀ v v', v ∈ˢ app (decodeGraph A B tgt I w mk) j → v' ∈ˢ app (decodeGraph A B tgt I w mk) j →
+        v = v' :=
+    fun j hj => decode_unique hw hB hmkU (codePred_sub hS j hj) ((accCodes_iff hS).mp hacc j hj)
+  have heq := recSel_eq decodeGraph_hB (fun _ hS' => codePred_sub hS') hS
+    (decode_unique hw hB hmkU hS hacc).1 hP
+  unfold decode
+  unfold decodeGraph at heq ⊢
+  rw [heq]
+  unfold codeStep
+  rw [if_pos ⟨hroot, hlab⟩]
+  congr 1
+  refine graph_congr fun p hp => ?_
+  rw [app_graph (show subCode S p ∈ˢ codePred B S from by
+    rw [codePred_of_root hroot]; exact mem_image.mpr ⟨p, hp, rfl⟩)]
+
+omit hw hB hmkU in
+/-- An assembled code of accessible subcodes is accessible. -/
+theorem acc_mkCode {t a g : V} (ht : t ∈ˢ I) (ha : a ∈ˢ A t)
+    (hg : ∀ p, p ∈ˢ B a → app g p ∈ˢ codeSpace A B tgt (tgt a p))
+    (hacc : ∀ p, p ∈ˢ B a → ∃ y, y ∈ˢ app (accCodes A B tgt I) (app g p)) :
+    ∃ y, y ∈ˢ app (accCodes A B tgt I) (mkCode B a g) := by
+  have hS : mkCode B a g ∈ˢ allCodes A B tgt I :=
+    mem_allCodes.mpr ⟨t, ht, mkCode_mem_codeSpace ha hg⟩
+  rw [accCodes_iff hS]
+  intro S' hS'
+  rw [codePred_of_root (hasRoot_mkCode a g), lab_mkCode] at hS'
+  obtain ⟨p, hp, rfl⟩ := mem_image.mp hS'
+  rw [subCode_mkCode hp (codeSpace_pairs (hg p hp))]
+  exact hacc p hp
+
+end Facts
+
+end Decode
+
+/-! ## The closure witness -/
+
+/-- **A member container has a closed member family**: the family of
+the decoded accessible codes.  The functor `Φ` on families over `I` is
+presented as a container by `helim` — every element of `Φ X` at `i` is
+`mk a g` for a shape `a ∈ A i` and a function `g` from the positions
+`B a` into the fibres of `X` at the targets `tgt a p`; shapes and
+position sets are members of `univ w`, the builder keeps members.  The
+decoded family's fibres are images of members (replacement), and a
+constructor step on decoded subcodes decodes the assembled code. -/
+theorem container_closed_exists {w : Nat} (hw : w ≠ 0) {I : V} (Φ : V → V)
+    (A B : V → V) (tgt : V → V → V) (mk : V → V → V)
+    (hA : ∀ i, i ∈ˢ I → A i ∈ˢ (univ w : V))
+    (hB : ∀ i a, i ∈ˢ I → a ∈ˢ A i → B a ∈ˢ (univ w : V))
+    (htgt : ∀ i a p, i ∈ˢ I → a ∈ˢ A i → p ∈ˢ B a → tgt a p ∈ˢ I)
+    (hmkU : ∀ i a g, i ∈ˢ I → a ∈ˢ A i → g ∈ˢ (univ w : V) → mk a g ∈ˢ (univ w : V))
+    (helim : ∀ X, X ∈ˢ famSpace w I → ∀ i, i ∈ˢ I → ∀ x, x ∈ˢ app (Φ X) i →
+      ∃ a, a ∈ˢ A i ∧ ∃ g, g ∈ˢ piSet (B a) (fun p => app X (tgt a p)) ∧ x = mk a g) :
+    ∃ L, L ∈ˢ famSpace w I ∧ FamLe I (Φ L) L := by
+  have hU := univ_isTGUniverse (V := V) hw
+  let Lf : V → V := fun i => image (decode A B tgt I w mk)
+    (sep (codeSpace A B tgt i) fun S =>
+      (∃ y, y ∈ˢ app (accCodes A B tgt I) S) ∧ HasRoot S ∧ lab S ∈ˢ A i)
+  have hLmem : graph Lf I ∈ˢ famSpace w I := by
+    refine graph_mem_famSpace fun i hi => ?_
+    refine hU.image_mem (hU.sep_mem (codeSpace_mem hw hA hB htgt hi)) fun S hS => ?_
+    obtain ⟨hSi, hacc, -, -⟩ := mem_sep.mp hS
+    exact decode_mem_univ hw hB hmkU (mem_allCodes.mpr ⟨i, hi, hSi⟩) hacc
+  refine ⟨graph Lf I, hLmem, ?_⟩
+  intro i hi x hx
+  obtain ⟨a, ha, g, hg, rfl⟩ := helim _ hLmem i hi x hx
+  -- every subtree is the decoding of an accessible code at its target
+  have hsub : ∀ p, p ∈ˢ B a → ∃ S, S ∈ˢ codeSpace A B tgt (tgt a p) ∧
+      (∃ y, y ∈ˢ app (accCodes A B tgt I) S) ∧ HasRoot S ∧ lab S ∈ˢ A (tgt a p) ∧
+      decode A B tgt I w mk S = app g p := by
+    intro p hp
+    have hgp := app_mem_of_mem_piSet hg hp
+    rw [app_graph (htgt i a p hi ha hp)] at hgp
+    obtain ⟨S, hS, hdec⟩ := mem_image.mp hgp
+    obtain ⟨hSi, hacc, hroot, hlab⟩ := mem_sep.mp hS
+    exact ⟨S, hSi, hacc, hroot, hlab, hdec.symm⟩
+  classical
+  let cs : V → V := fun p => if h : p ∈ˢ B a then Classical.choose (hsub p h) else empty
+  have hcs : ∀ p, p ∈ˢ B a → cs p ∈ˢ codeSpace A B tgt (tgt a p) ∧
+      (∃ y, y ∈ˢ app (accCodes A B tgt I) (cs p)) ∧ HasRoot (cs p) ∧ lab (cs p) ∈ˢ A (tgt a p) ∧
+      decode A B tgt I w mk (cs p) = app g p := by
+    intro p hp
+    have hcp : cs p = Classical.choose (hsub p hp) := by
+      show (if h : p ∈ˢ B a then Classical.choose (hsub p h) else empty) = _
+      rw [dif_pos hp]
+    rw [hcp]
+    exact Classical.choose_spec (hsub p hp)
+  have hgS : ∀ p, p ∈ˢ B a → app (graph cs (B a)) p = cs p := fun p hp => app_graph hp
+  have hSmem : mkCode B a (graph cs (B a)) ∈ˢ codeSpace A B tgt i :=
+    mkCode_mem_codeSpace ha fun p hp => by rw [hgS p hp]; exact (hcs p hp).1
+  have hSacc : ∃ y, y ∈ˢ app (accCodes A B tgt I) (mkCode B a (graph cs (B a))) :=
+    acc_mkCode hi ha (fun p hp => by rw [hgS p hp]; exact (hcs p hp).1)
+      (fun p hp => by rw [hgS p hp]; exact (hcs p hp).2.1)
+  rw [app_graph hi]
+  refine mem_image.mpr ⟨mkCode B a (graph cs (B a)),
+    mem_sep.mpr ⟨hSmem, hSacc, hasRoot_mkCode a _, by rw [lab_mkCode]; exact ha⟩, ?_⟩
+  rw [decode_eq hw hB hmkU (mem_allCodes.mpr ⟨i, hi, hSmem⟩) hSacc (hasRoot_mkCode a _)
+    ⟨i, hi, by rw [lab_mkCode]; exact ha⟩, lab_mkCode]
+  congr 1
+  refine (eq_graph_app_of_mem_piSet hg).symm.trans (graph_congr fun p hp => ?_)
+  rw [subCode_mkCode hp (fun x hx => codeSpace_pairs (hcs p hp).1 x (by rwa [hgS p hp] at hx)),
+    hgS p hp]
+  exact ((hcs p hp).2.2.2.2).symm
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetModel/Iter.lean b/Ix/Theory/Model/SetModel/Iter.lean
new file mode 100644
index 000000000..ac009bc78
--- /dev/null
+++ b/Ix/Theory/Model/SetModel/Iter.lean
@@ -0,0 +1,107 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetModel/Iter.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetModel.TaggedSum
+
+@[expose] public section
+
+/-!
+# The ω-iterate of a set functor (task #188)
+
+The one place iteration survives in the recursive-type model: the
+carrier is the Knaster–Tarski least pre-fixed point
+(`Ix.Theory/Model/SetTheory/Derive/Lfp.lean`), and every law about it assumes a
+CLOSED MEMBER of the universe exists.  For a *finitary* tower functor
+that witness is the ω-iterate
+
+    iterF Φ 0 = ∅,   iterF Φ (n+1) = Φ (iterF Φ n),   iterU Φ = ⋃ₙ iterF Φ n
+
+— a countable union of members of `univ w`, hence a member (`ω ∈ univ
+w` at `w ≥ 1`, `omega_mem_univ_succ`; at `w = 0` truth values), and
+closed under `Φ` whenever every member of `Φ (iterU Φ)` already lies in
+some `Φ (iterF Φ n)` (`iterU_closed_of` — the finitary condition,
+discharged for the tower functor in `Ix.Theory/Model/Semantics/Tower/FixLeaf.lean`
+by bounding the ranks of a tuple's finitely many recursive fields).
+The union is also where the recursor's semantic fixed point is built
+by rank recursion.
+
+Everything here is over the bare `SetTheory` interface; no syntax.
+-/
+
+namespace Ix.Theory.Model.SetTheory.Tower
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The finite iterates of a set functor from the empty set. -/
+noncomputable def iterF (Φ : V → V) : Nat → V
+  | 0 => empty
+  | n + 1 => Φ (iterF Φ n)
+
+@[simp] theorem iterF_zero (Φ : V → V) : iterF Φ 0 = empty := rfl
+@[simp] theorem iterF_succ (Φ : V → V) (n : Nat) : iterF Φ (n + 1) = Φ (iterF Φ n) := rfl
+
+/-- The union of a countable family `f 0 ∪ f 1 ∪ …` (the ω-indexed union
+through the tag fibre). -/
+noncomputable def natUnion (f : Nat → V) : V :=
+  sUnion (image (natFibre f) omega)
+
+theorem mem_natUnion {f : Nat → V} {x : V} : x ∈ˢ natUnion f ↔ ∃ n, x ∈ˢ f n := by
+  unfold natUnion
+  rw [mem_sUnion]
+  constructor
+  · rintro ⟨y, hy, hxy⟩
+    obtain ⟨k, hk, rfl⟩ := mem_image.mp hy
+    obtain ⟨n, rfl, hfib⟩ := natFibre_of_mem f hk
+    rw [hfib] at hxy
+    exact ⟨n, hxy⟩
+  · rintro ⟨n, hn⟩
+    exact ⟨natFibre f (vnat n), mem_image.mpr ⟨vnat n, vnat_mem_omega n, rfl⟩,
+      by rw [natFibre_vnat]; exact hn⟩
+
+/-- **Formation** (graph regime): a countable union of members of a
+positive level is a member. -/
+theorem natUnion_mem_univ_pos {w : Nat} (hw : w ≠ 0) {f : Nat → V}
+    (h : ∀ n, f n ∈ˢ (univ w : V)) : natUnion f ∈ˢ (univ w : V) := by
+  obtain ⟨w', rfl⟩ : ∃ w', w = w' + 1 := ⟨w - 1, by omega⟩
+  unfold natUnion
+  refine (univ_isTGUniverse (Nat.succ_ne_zero w')).famUnion_mem (omega_mem_univ_succ w') ?_
+  intro k hk
+  obtain ⟨n, rfl, hfib⟩ := natFibre_of_mem f hk
+  rw [hfib]
+  exact h n
+
+/-- **Formation** (squash regime): a union of truth values is a truth
+value. -/
+theorem natUnion_mem_univZero {f : Nat → V} (h : ∀ n, f n ∈ˢ (univZero : V)) :
+    natUnion f ∈ˢ (univZero : V) := by
+  rw [mem_univZero]
+  intro x hx
+  obtain ⟨n, hn⟩ := mem_natUnion.mp hx
+  exact (mem_univZero.mp (h n)) x hn
+
+/-- The ω-iterate: the union of the finite iterates. -/
+noncomputable def iterU (Φ : V → V) : V := natUnion (iterF Φ)
+
+theorem mem_iterU {Φ : V → V} {x : V} : x ∈ˢ iterU Φ ↔ ∃ n, x ∈ˢ iterF Φ n :=
+  mem_natUnion
+
+/-- **Closure** under a finitary functor: if every member of
+`Φ (iterU Φ)` lies in some finite stage's image, the ω-iterate is
+closed. -/
+theorem iterU_closed_of {Φ : V → V}
+    (hfin : ∀ x, x ∈ˢ Φ (iterU Φ) → ∃ n, x ∈ˢ Φ (iterF Φ n)) :
+    Φ (iterU Φ) ⊆ˢ iterU Φ := by
+  intro x hx
+  obtain ⟨n, hn⟩ := hfin x hx
+  exact mem_iterU.mpr ⟨n + 1, hn⟩
+
+end Ix.Theory.Model.SetTheory.Tower
diff --git a/Ix/Theory/Model/SetModel/Ops.lean b/Ix/Theory/Model/SetModel/Ops.lean
new file mode 100644
index 000000000..23d5d2b8a
--- /dev/null
+++ b/Ix/Theory/Model/SetModel/Ops.lean
@@ -0,0 +1,366 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetModel/Ops.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Univ
+
+@[expose] public section
+
+/-!
+# The two-regime product and abstraction (task #151, tier B)
+
+`piR`/`lamR` are the **annotation-driven** dependent product and
+abstraction: they read a numeral — the codomain sort of the binder,
+supplied by the annotation pass — and dispatch on it, rather than
+inspecting the semantic value the way the domain-relative collapse
+(`pcol`/`piC`/`lamC`, `Ix.Theory/Model/SetTheory/Derive/Pi.lean` — deleted at
+task #221, unread since these operators replaced it) does.
+
+* **`v = 0` — the truth-value (squash) regime.**  `piR 0 A B` is the
+  truth value `[∀ x ∈ A, B x inhabited]`, `lamR 0 A F` is the canonical
+  proof.  Propositions are subsets of the canonical one-element set
+  `unitSet = {pt}`, so proof irrelevance and impredicativity are both
+  immediate: *a product landing in `Prop` is small whatever its domain
+  is* (`piR_zero_mem_univZero`), with no size or universe side
+  condition anywhere.
+* **`v ≠ 0` — the graph regime.**  `piR v A B` is `piSet A B`, the set
+  of total single-valued function graphs over `A`; `lamR v A F` is the
+  literal graph.  **No collapse, no proof point**: a member of a
+  positive-regime product is a graph, is never `pt`
+  (`not_pt_mem_piR_pos`), determines its own domain
+  (`piR_dom_unique`, with *no* `≠ pt` side condition), and applies to
+  the canonical junk `∅` off that domain (`app_off_dom_piR_pos`).
+
+The operators are the pre-#100 `SetTheory.pi`/`SetTheory.lam` (see the
+git history of `Derive/Pi.lean`), restated in this namespace so that
+`Ix.Theory/Model/SetTheory/*` is untouched; the law battery below is that file's,
+plus the *inversion* laws that only the annotation-driven definition can
+have (`mem_piR_pos`, `piR_dom_unique`, `not_pt_mem_piR_pos`).
+
+**On `pt`.**  The proof point appears in exactly one place: the `v = 0`
+branch of `lamR`, as the canonical inhabitant of a true proposition.
+That is forced — `SetTheory`'s `univ 0 = power unitSet` fixes the
+canonical one-element set, so the unique element of a true truth value
+*is* `pt` — and it is not a collapse: no clause here tests a value, and
+the graph regime never produces, contains, or consults it.  So `pt` is
+*demoted, not deleted*: deleting it is not achievable — it would mean
+re-deriving `univZero` over a different singleton, and renaming the
+canonical point changes nothing — and not needed, because nothing here
+tests for it.
+-/
+
+namespace Ix.Theory.Model.SetModel
+
+open SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The dependent product at codomain sort `v`: a truth value at `0`,
+the set of function graphs above it. -/
+noncomputable def piR (v : Nat) (A : V) (B : V → V) : V :=
+  if v = 0 then truthVal (∀ x, x ∈ˢ A → ∃ y, y ∈ˢ B x) else piSet A B
+
+/-- Abstraction at codomain sort `v`: the canonical proof at `0`, the
+literal function graph above it. -/
+noncomputable def lamR (v : Nat) (A : V) (F : V → V) : V :=
+  if v = 0 then pt else graph F A
+
+/-! ## The two branches -/
+
+theorem piR_zero {A : V} {B : V → V} :
+    piR 0 A B = truthVal (∀ x, x ∈ˢ A → ∃ y, y ∈ˢ B x) := if_pos rfl
+
+theorem piR_pos {v : Nat} (hv : v ≠ 0) {A : V} {B : V → V} :
+    piR v A B = piSet A B := if_neg hv
+
+theorem lamR_zero {A : V} {F : V → V} : lamR 0 A F = (pt : V) := if_pos rfl
+
+theorem lamR_pos {v : Nat} (hv : v ≠ 0) {A : V} {F : V → V} :
+    lamR v A F = graph F A := if_neg hv
+
+/-! ## Congruence -/
+
+theorem piR_congr {v : Nat} {A : V} {B B' : V → V}
+    (h : ∀ x, x ∈ˢ A → B x = B' x) : piR v A B = piR v A B' := by
+  rcases Nat.eq_zero_or_pos v with rfl | hv
+  · rw [piR_zero, piR_zero]
+    exact truthVal_congr
+      ⟨fun hi x hx => h x hx ▸ hi x hx, fun hi x hx => (h x hx).symm ▸ hi x hx⟩
+  · rw [piR_pos (Nat.pos_iff_ne_zero.mp hv), piR_pos (Nat.pos_iff_ne_zero.mp hv)]
+    exact piSet_congr h
+
+theorem lamR_congr {v : Nat} {A : V} {F F' : V → V}
+    (h : ∀ x, x ∈ˢ A → F x = F' x) : lamR v A F = lamR v A F' := by
+  rcases Nat.eq_zero_or_pos v with rfl | hv
+  · rw [lamR_zero, lamR_zero]
+  · rw [lamR_pos (Nat.pos_iff_ne_zero.mp hv), lamR_pos (Nat.pos_iff_ne_zero.mp hv)]
+    exact graph_congr h
+
+/-! ## Zero-agreement
+
+`piR`/`lamR` read their numeral **only through the `v = 0` test**, so
+annotations that agree on zero-ness are interchangeable.  This is the
+pre-#100 `pi_congr_zero_agree`/`lam_congr_zero_agree` pair, and it is
+what lets a λ-tower carry its *result* sort at every binder rather than
+the exact `imax` fold: in `(a₁ : A₁) → … → (aₙ : Aₙ) → T` the sort of
+each suffix is `imax (…) r` with `r` the sort of `T`, and
+`imax x y = 0 ↔ y = 0`.  See `Interp/Value.lean`'s annotation
+convention. -/
+
+theorem piR_zero_agree {v v' : Nat} (hz : v = 0 ↔ v' = 0) {A : V}
+    {B B' : V → V} (h : ∀ x, x ∈ˢ A → B x = B' x) : piR v A B = piR v' A B' := by
+  by_cases hv : v = 0
+  · rw [hv, hz.mp hv]; exact piR_congr h
+  · have hv' : v' ≠ 0 := fun h0 => hv (hz.mpr h0)
+    rw [piR_pos hv, piR_pos hv']
+    exact piSet_congr h
+
+theorem lamR_zero_agree {v v' : Nat} (hz : v = 0 ↔ v' = 0) {A : V}
+    {F F' : V → V} (h : ∀ x, x ∈ˢ A → F x = F' x) : lamR v A F = lamR v' A F' := by
+  by_cases hv : v = 0
+  · rw [hv, hz.mp hv, lamR_zero, lamR_zero]
+  · have hv' : v' ≠ 0 := fun h0 => hv (hz.mpr h0)
+    rw [lamR_pos hv, lamR_pos hv']
+    exact graph_congr h
+
+/-- `imax`'s zero test is its codomain's — the arithmetic behind the
+tower convention. -/
+theorem imax_eq_zero_iff (x y : Nat) :
+    (if y = 0 then 0 else Nat.max x y) = 0 ↔ y = 0 := by
+  by_cases hy : y = 0
+  · simp [hy]
+  · rw [if_neg hy]
+    exact ⟨fun h => absurd (Nat.le_zero.mp (h ▸ Nat.le_max_right x y)) hy,
+      fun h => absurd h hy⟩
+
+/-! ## Introduction, elimination, beta, eta -/
+
+/-- Introduction: fibre-wise members abstract into the product.  At
+`v = 0` the premise itself witnesses every fibre inhabited. -/
+theorem lamR_mem {v : Nat} {A : V} {F B : V → V}
+    (hF : ∀ x, x ∈ˢ A → F x ∈ˢ B x) : lamR v A F ∈ˢ piR v A B := by
+  rcases Nat.eq_zero_or_pos v with rfl | hv
+  · rw [lamR_zero, piR_zero]
+    exact pt_mem_truthVal fun x hx => ⟨F x, hF x hx⟩
+  · rw [lamR_pos (Nat.pos_iff_ne_zero.mp hv), piR_pos (Nat.pos_iff_ne_zero.mp hv)]
+    exact graph_mem_piSet hF
+
+/-- Introduction across zero-agreeing annotations: a tower annotated
+with its result sort still inhabits the product annotated with the
+exact `imax`. -/
+theorem lamR_mem_zero_agree {v v' : Nat} (hz : v = 0 ↔ v' = 0) {A : V}
+    {F B : V → V} (hF : ∀ x, x ∈ˢ A → F x ∈ˢ B x) : lamR v A F ∈ˢ piR v' A B := by
+  rw [lamR_zero_agree hz (fun _ _ => rfl) (F' := F)]
+  exact lamR_mem hF
+
+/-- **Proof irrelevance at products**: inhabitants of a `Prop`-valued
+product are the canonical proof. -/
+theorem eq_pt_of_mem_piR_zero {A f : V} {B : V → V} (hf : f ∈ˢ piR 0 A B) :
+    f = pt := by
+  rw [piR_zero] at hf; exact eq_pt_of_mem_truthVal hf
+
+/-- **Squash-regime introduction from inhabitation.**  At `v = 0` the
+product is a truth value, so membership of the canonical proof needs
+only that every fibre is *inhabited* — strictly weaker than
+`lamR_mem`'s pointwise `F x ∈ˢ B x`, and the form every tower whose
+value carries no regime tag has to use at kind `0`
+(`Interp/BasisOk.lean`, the `psigmaMk` finding). -/
+theorem pt_mem_piR_zero {A : V} {B : V → V}
+    (h : ∀ x, x ∈ˢ A → ∃ y, y ∈ˢ B x) : (pt : V) ∈ˢ piR 0 A B := by
+  rw [piR_zero]; exact pt_mem_truthVal h
+
+/-- The pointwise form, matching the collapse lane's
+`pt_mem_piC_iff.mpr` so the `pt`-valued towers port line for line. -/
+theorem pt_mem_piR_zero_of {A : V} {B : V → V}
+    (h : ∀ x, x ∈ˢ A → (pt : V) ∈ˢ B x) : (pt : V) ∈ˢ piR 0 A B :=
+  pt_mem_piR_zero fun x hx => ⟨pt, h x hx⟩
+
+/-- Elimination.  The fibre premise is needed only at `v = 0`, where
+the fibres must be truth values. -/
+theorem app_mem_piR {v : Nat} {A f a : V} {B : V → V}
+    (hf : f ∈ˢ piR v A B) (ha : a ∈ˢ A)
+    (hB0 : v = 0 → ∀ x, x ∈ˢ A → B x ∈ˢ (univZero : V)) : app f a ∈ˢ B a := by
+  rcases Nat.eq_zero_or_pos v with rfl | hv
+  · have hfp : f = pt := eq_pt_of_mem_piR_zero hf
+    rw [piR_zero] at hf
+    obtain ⟨y, hy⟩ := of_mem_truthVal hf a ha
+    rw [hfp, app_pt]
+    rwa [eq_pt_of_mem_univZero (hB0 rfl a ha) hy] at hy
+  · rw [piR_pos (Nat.pos_iff_ne_zero.mp hv)] at hf
+    exact app_mem_of_mem_piSet hf ha
+
+/-- Elimination in the graph regime: no fibre premise at all. -/
+theorem app_mem_piR_pos {v : Nat} {A f a : V} {B : V → V} (hv : v ≠ 0)
+    (hf : f ∈ˢ piR v A B) (ha : a ∈ˢ A) : app f a ∈ˢ B a := by
+  rw [piR_pos hv] at hf; exact app_mem_of_mem_piSet hf ha
+
+/-- Beta, conditional on domain membership (set-theoretic functions
+have set domains). -/
+theorem app_lamR {v : Nat} {A a : V} {F B : V → V}
+    (ha : a ∈ˢ A) (hF : ∀ x, x ∈ˢ A → F x ∈ˢ B x)
+    (hB0 : v = 0 → ∀ x, x ∈ˢ A → B x ∈ˢ (univZero : V)) :
+    app (lamR v A F) a = F a := by
+  rcases Nat.eq_zero_or_pos v with rfl | hv
+  · rw [lamR_zero, app_pt]
+    exact (eq_pt_of_mem_univZero (hB0 rfl a ha) (hF a ha)).symm
+  · rw [lamR_pos (Nat.pos_iff_ne_zero.mp hv)]
+    exact app_graph ha
+
+/-- **Beta in the graph regime**: application of an abstraction on its
+domain computes, with no typing premise whatsoever — it is literally
+`app_graph`. -/
+theorem app_lamR_pos {v : Nat} {A a : V} {F : V → V} (hv : v ≠ 0)
+    (ha : a ∈ˢ A) : app (lamR v A F) a = F a := by
+  rw [lamR_pos hv]; exact app_graph ha
+
+/-- **Off-domain application in the graph regime** — `app_lamR_pos`'s
+complement.  The rigidity a *type former*'s application is inverted
+with: off its domain a graph-regime abstraction applies to the
+canonical junk `∅`, which has no members, so an inhabited application
+forces its argument into the domain.  Added for the caps tier's
+pinned-pair η row (task #161). -/
+theorem app_lamR_of_not_mem {v : Nat} {A a : V} {F : V → V} (hv : v ≠ 0)
+    (ha : ¬ a ∈ˢ A) : app (lamR v A F) a = (empty : V) := by
+  rw [lamR_pos hv]; exact app_graph_of_not_mem ha
+
+/-- Graph-regime abstractions are graphs, never the proof point. -/
+theorem lamR_ne_pt {v : Nat} {A : V} {F : V → V} (hv : v ≠ 0) :
+    lamR v A F ≠ pt := by rw [lamR_pos hv]; exact graph_ne_pt
+
+/-- Eta: a member of a product is the abstraction of its
+applications. -/
+theorem lamR_eta {v : Nat} {A f : V} {B : V → V} (hf : f ∈ˢ piR v A B) :
+    lamR v A (fun x => app f x) = f := by
+  rcases Nat.eq_zero_or_pos v with rfl | hv
+  · rw [lamR_zero, eq_pt_of_mem_piR_zero hf]
+  · have hv' : v ≠ 0 := Nat.pos_iff_ne_zero.mp hv
+    rw [piR_pos hv'] at hf
+    rw [lamR_pos hv']
+    exact eq_graph_app_of_mem_piSet hf
+
+/-- Function extensionality for product members: on-domain agreement is
+total agreement.  At `v = 0` both sides are the canonical proof; above
+it both are graphs over `A`, whose off-domain applications are the same
+canonical junk. -/
+theorem eq_of_mem_piR_app_eq {v : Nat} {A f g : V} {B B' : V → V}
+    (hf : f ∈ˢ piR v A B) (hg : g ∈ˢ piR v A B')
+    (h : ∀ x, x ∈ˢ A → app f x = app g x) : f = g := by
+  rw [← lamR_eta hf, ← lamR_eta hg]; exact lamR_congr h
+
+/-! ## The graph regime: inversion and junk-freeness
+
+These are the laws the collapse cannot have.  Under `piC` a product
+member is either a graph *or* the proof point (`mem_piC_cases`), so
+every consumer dispatches; here the annotation has already decided, and
+membership in a positive-regime product is *by definition* graph-hood. -/
+
+/-- **The prized inversion.**  A member of a graph-regime product is a
+graph whose domain is exactly the product's domain, whose applications
+land pointwise in the fibres, which is never the proof point, and which
+applies to the canonical junk `∅` off the domain.  Every clause is by
+definition of `piSet`; nothing about `B` is used. -/
+theorem mem_piR_pos {v : Nat} {A f : V} {B : V → V} (hv : v ≠ 0)
+    (hf : f ∈ˢ piR v A B) :
+    graph (fun x => app f x) A = f ∧
+    (∀ x, x ∈ˢ A → app f x ∈ˢ B x) ∧
+    (∀ a, ¬ a ∈ˢ A → app f a = empty) ∧
+    f ≠ pt := by
+  rw [piR_pos hv] at hf
+  exact ⟨eq_graph_app_of_mem_piSet hf, fun x hx => app_mem_of_mem_piSet hf hx,
+    fun a ha => app_off_dom_of_mem_piSet hf ha, ne_pt_of_mem_piSet hf⟩
+
+/-- The proof point never inhabits a graph-regime product — for *any*
+domain and *any* fibre family, in particular a universe-valued one.
+This is the removal of the collapse's universe-cohabitation wall, where
+`pt ∈ˢ piC A (fun _ => univ 0)` holds at an unknown-empty domain. -/
+theorem not_pt_mem_piR_pos {v : Nat} {A : V} {B : V → V} (hv : v ≠ 0) :
+    ¬ (pt : V) ∈ˢ piR v A B :=
+  fun h => (mem_piR_pos hv h).2.2.2 rfl
+
+/-- A graph-regime member applied off the domain is canonical junk —
+never a proof point, never anything a consumer must dispatch on. -/
+theorem app_off_dom_piR_pos {v : Nat} {A f a : V} {B : V → V} (hv : v ≠ 0)
+    (hf : f ∈ˢ piR v A B) (ha : ¬ a ∈ˢ A) : app f a = empty :=
+  (mem_piR_pos hv hf).2.2.1 a ha
+
+/-- **Domain uniqueness, unconditional.**  A graph determines its own
+domain, so membership in two graph-regime products identifies their
+domains — with no `≠ pt` side condition (`piC_dom_unique` needs one,
+and supplying it is what the collapse made hard). -/
+theorem piR_dom_unique {v v' : Nat} {A A' f : V} {B B' : V → V}
+    (hv : v ≠ 0) (hv' : v' ≠ 0)
+    (h1 : f ∈ˢ piR v A B) (h2 : f ∈ˢ piR v' A' B') : A = A' := by
+  rw [piR_pos hv] at h1
+  rw [piR_pos hv'] at h2
+  obtain ⟨hsub, htot⟩ := mem_piSet.mp h1
+  obtain ⟨hsub', htot'⟩ := mem_piSet.mp h2
+  refine ext fun x => ⟨fun hx => ?_, fun hx => ?_⟩
+  · obtain ⟨y, hy, -⟩ := htot x hx
+    obtain ⟨x2, hx2, y2, -, hp⟩ := mem_sigmaPairs.mp (hsub' _ hy)
+    obtain ⟨rfl, rfl⟩ := kpair_inj hp
+    exact hx2
+  · obtain ⟨y, hy, -⟩ := htot' x hx
+    obtain ⟨x2, hx2, y2, -, hp⟩ := mem_sigmaPairs.mp (hsub _ hy)
+    obtain ⟨rfl, rfl⟩ := kpair_inj hp
+    exact hx2
+
+/-! ## The truth-value regime -/
+
+/-- **Impredicativity.**  A product landing in `Prop` is a truth value
+— for an arbitrary domain `A` and arbitrary fibres, with no size
+condition.  This is the one place a set-theoretic model of Lean has to
+say something, and here it is the `v = 0` branch of a numeral test. -/
+theorem piR_zero_mem_univZero {A : V} {B : V → V} :
+    piR 0 A B ∈ˢ (univZero : V) := by
+  rw [piR_zero]; exact truthVal_mem_univZero _
+
+/-- Members of a truth value are all equal: the `v = 0` regime is
+subsingleton-valued. -/
+theorem subsingleton_of_mem_univZero {T x y : V} (hT : T ∈ˢ (univZero : V))
+    (hx : x ∈ˢ T) (hy : y ∈ˢ T) : x = y :=
+  (eq_pt_of_mem_univZero hT hx).trans (eq_pt_of_mem_univZero hT hy).symm
+
+/-- Proof irrelevance for the squash regime, in subsingleton form. -/
+theorem piR_zero_subsingleton {A x y : V} {B : V → V}
+    (hx : x ∈ˢ piR 0 A B) (hy : y ∈ˢ piR 0 A B) : x = y :=
+  (eq_pt_of_mem_piR_zero hx).trans (eq_pt_of_mem_piR_zero hy).symm
+
+/-- The empty-domain product is truth — in the graph regime too, where
+it is the singleton `{∅}` of the empty graph rather than a collapsed
+point.  (Contrast `piC_empty`, where *every* empty-domain product is
+`unitSet` and *every* empty-domain abstraction collapses to `pt` — the
+countermodel that blocked the #100 flip.) -/
+theorem piR_pos_empty {v : Nat} (hv : v ≠ 0) (B : V → V) :
+    piR v (empty : V) B = sing (empty : V) := by
+  rw [piR_pos hv]
+  refine ext fun f => ?_
+  rw [mem_sing, mem_piSet]
+  constructor
+  · rintro ⟨hsub, -⟩
+    refine eq_empty fun z hz => ?_
+    obtain ⟨x, hx, -⟩ := mem_sigmaPairs.mp (hsub z hz)
+    exact not_mem_empty x hx
+  · rintro rfl
+    exact ⟨fun z hz => absurd hz (not_mem_empty z),
+      fun x hx => absurd hx (not_mem_empty x)⟩
+
+/-- Empty-domain abstraction in the graph regime is the empty graph,
+**not** the proof point: the annotation, not the (vacuous) value test,
+decides.  This is exactly the clause whose collapse analogue
+(`lamC_empty`) produced the #100 countermodel. -/
+theorem lamR_pos_empty {v : Nat} (hv : v ≠ 0) (F : V → V) :
+    lamR v (empty : V) F = (empty : V) := by
+  rw [lamR_pos hv]
+  refine eq_empty fun z hz => ?_
+  obtain ⟨x, hx, -⟩ := mem_graph.mp hz
+  exact not_mem_empty x hx
+
+end Ix.Theory.Model.SetModel
diff --git a/Ix/Theory/Model/SetModel/RecGraph.lean b/Ix/Theory/Model/SetModel/RecGraph.lean
new file mode 100644
index 000000000..675de1d68
--- /dev/null
+++ b/Ix/Theory/Model/SetModel/RecGraph.lean
@@ -0,0 +1,270 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetModel/RecGraph.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.LfpFam
+import Ix.Theory.Model.SetTheory.Derive.Pt
+@[expose] public section
+
+/-!
+# The recursion theorem by lfp induction (task #202, Stage A2)
+
+The recursive squash regime's large eliminator: the family lives at
+`Prop` (its fibres are truth values, the sole proof the point) and the
+recursor eliminates into `Sort ℓ`, `ℓ ≠ 0`.  The recursor's value at an
+index `i` is determined by the recursion equation `R i = st i (R on the
+predecessors of i)` — well-founded along the family's least fixed
+point, which is why it exists and is unique.
+
+This module states that abstractly, `Expr`-free: over an index set `I`
+with predecessor sets `pred i ⊆ I`, a bound `B i ∈ univ ℓ` and a step
+`st i g` (`g` a choice function of predecessor values), the GRAPH
+functor `recGraphStep` sends a family `S` to the family of values
+`st i g` for `g ∈ Π_{j ∈ pred i} S j` (within `B i`); it is monotone
+and `B` is a closed family, so its least fixed point `recGraph` exists,
+and at every index whose `Acc`-family fibre (`accFam`: inhabited iff
+`Cond i` and every predecessor's fibre is) is inhabited, `recGraph`'s
+fibre is a SINGLETON (`recGraph_exists_unique`) — by
+`lfpFamSet_induction` on the `Acc` family: the predecessors' fibres
+are singletons, the graph of their elements witnesses existence
+(`app_lfpFamSet_eq`), and any element is the step at that same choice
+function, by function extensionality on `piSet`.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+section RecGraph
+
+variable (ℓ : Nat) (I : V) (pred : V → V) (B : V → V) (st : V → V → V)
+
+/-- The graph functor's fibre at `i` over the family `S`. -/
+noncomputable def recGraphFibre (S i : V) : V :=
+  sep (B i) fun v => ∃ g, g ∈ˢ piSet (pred i) (fun j => app S j) ∧ v = st i g
+
+/-- The graph functor on families over `I`, as a set-function on the
+family space. -/
+noncomputable def recGraphStep : V :=
+  graph (fun S => graph (fun i => recGraphFibre pred B st S i) I) (famSpace ℓ I)
+
+/-- **The recursor's graph**: the least fixed point of the graph
+functor. -/
+noncomputable def recGraph : V := lfpFamSet ℓ I (recGraphStep ℓ I pred B st)
+
+variable {ℓ I pred B st}
+
+theorem app_recGraphStep {S : V} (hS : S ∈ˢ famSpace ℓ I) :
+    app (recGraphStep ℓ I pred B st) S = graph (fun i => recGraphFibre pred B st S i) I :=
+  app_graph hS
+
+theorem app_app_recGraphStep {S i : V} (hS : S ∈ˢ famSpace ℓ I) (hi : i ∈ˢ I) :
+    app (app (recGraphStep ℓ I pred B st) S) i = recGraphFibre pred B st S i := by
+  rw [app_recGraphStep hS, app_graph hi]
+
+theorem mem_recGraphFibre {S i v : V} :
+    v ∈ˢ recGraphFibre pred B st S i ↔
+      v ∈ˢ B i ∧ ∃ g, g ∈ˢ piSet (pred i) (fun j => app S j) ∧ v = st i g :=
+  mem_sep
+
+/-- The functor maps the family space into itself. -/
+theorem recGraphStep_maps (hB : ∀ i, i ∈ˢ I → B i ∈ˢ (univ ℓ : V)) :
+    MapsFam ℓ I (recGraphStep ℓ I pred B st) := by
+  intro S hS
+  rw [app_recGraphStep hS]
+  exact graph_mem_famSpace fun i hi => univ_sep_mem (hB i hi)
+
+/-- The functor is monotone: more predecessor values, more steps. -/
+theorem recGraphStep_mono (hpred : ∀ i, i ∈ˢ I → pred i ⊆ˢ I) :
+    MonoFam ℓ I (recGraphStep ℓ I pred B st) := by
+  intro X Y hX hY hle i hi v hv
+  rw [app_app_recGraphStep hX hi] at hv
+  rw [app_app_recGraphStep hY hi]
+  obtain ⟨hvB, g, hg, rfl⟩ := mem_recGraphFibre.mp hv
+  refine mem_recGraphFibre.mpr ⟨hvB, g, ?_, rfl⟩
+  obtain ⟨hsub, htot⟩ := mem_piSet.mp hg
+  refine mem_piSet.mpr ⟨fun p hp => ?_, htot⟩
+  obtain ⟨j, hj, y, hy, rfl⟩ := mem_sigmaPairs.mp (hsub p hp)
+  exact mem_sigmaPairs.mpr ⟨j, hj, y, hle j (hpred i hi j hj) y hy, rfl⟩
+
+/-- The bound is a closed family. -/
+theorem recGraphStep_closed (hB : ∀ i, i ∈ˢ I → B i ∈ˢ (univ ℓ : V)) :
+    IsClosedFam ℓ I (recGraphStep ℓ I pred B st) (graph B I) := by
+  refine ⟨graph_mem_famSpace hB, fun i hi v hv => ?_⟩
+  rw [app_app_recGraphStep (graph_mem_famSpace hB) hi] at hv
+  rw [app_graph hi]
+  exact (mem_recGraphFibre.mp hv).1
+
+/-- **The fixed-point equation**, fibrewise. -/
+theorem app_recGraph_eq (hB : ∀ i, i ∈ˢ I → B i ∈ˢ (univ ℓ : V))
+    (hpred : ∀ i, i ∈ˢ I → pred i ⊆ˢ I) {i : V} (hi : i ∈ˢ I) :
+    app (recGraph ℓ I pred B st) i = recGraphFibre pred B st (recGraph ℓ I pred B st) i := by
+  unfold recGraph
+  rw [← app_lfpFamSet_eq ⟨_, recGraphStep_closed hB⟩ (recGraphStep_mono hpred)
+    (recGraphStep_maps hB) hi, app_app_recGraphStep (lfpFamSet_mem _ _ _) hi]
+
+end RecGraph
+
+/-! ## The `Acc` family -/
+
+section AccFam
+
+variable (I : V) (pred : V → V) (Cond : V → Prop)
+
+/-- The `Acc` functor's fibre: inhabited iff the side condition holds
+and every predecessor's fibre is inhabited. -/
+noncomputable def accFibre (X i : V) : V :=
+  truthVal (Cond i ∧ ∀ j, j ∈ˢ pred i → ∃ y, y ∈ˢ app X j)
+
+noncomputable def accStep : V :=
+  graph (fun X => graph (fun i => accFibre pred Cond X i) I) (famSpace 0 I)
+
+/-- **The `Acc` family**: the least fixed point of the `Acc` functor at
+`Prop`. -/
+noncomputable def accFam : V := lfpFamSet 0 I (accStep I pred Cond)
+
+variable {I pred Cond}
+
+theorem app_app_accStep {X i : V} (hX : X ∈ˢ famSpace 0 I) (hi : i ∈ˢ I) :
+    app (app (accStep I pred Cond) X) i = accFibre pred Cond X i := by
+  unfold accStep
+  rw [app_graph hX, app_graph hi]
+
+theorem accStep_maps : MapsFam 0 I (accStep I pred Cond) := by
+  intro X hX
+  unfold accStep
+  rw [app_graph hX]
+  refine graph_mem_famSpace fun i _ => ?_
+  rw [univ_zero]
+  exact truthVal_mem_univZero _
+
+theorem accStep_mono (hpred : ∀ i, i ∈ˢ I → pred i ⊆ˢ I) : MonoFam 0 I (accStep I pred Cond) := by
+  intro X Y hX hY hle i hi x hx
+  rw [app_app_accStep hX hi] at hx
+  rw [app_app_accStep hY hi]
+  obtain ⟨⟨hc, hall⟩, rfl⟩ := mem_truthVal.mp hx
+  refine mem_truthVal.mpr ⟨⟨hc, fun j hj => ?_⟩, rfl⟩
+  obtain ⟨y, hy⟩ := hall j hj
+  exact ⟨y, hle j (hpred i hi j hj) y hy⟩
+
+theorem accStep_closed : IsClosedFam 0 I (accStep I pred Cond) (graph (fun _ => unitSet) I) := by
+  refine ⟨graph_mem_famSpace fun _ _ => by rw [univ_zero]; exact mem_univZero.mpr (Subset.refl _),
+    fun i hi x hx => ?_⟩
+  rw [app_app_accStep (graph_mem_famSpace fun _ _ => by
+    rw [univ_zero]; exact mem_univZero.mpr (Subset.refl _)) hi] at hx
+  rw [app_graph hi]
+  obtain ⟨-, rfl⟩ := mem_truthVal.mp hx
+  exact pt_mem_unitSet
+
+end AccFam
+
+/-! ## The recursion theorem -/
+
+section RecTheorem
+
+variable {ℓ : Nat} {I : V} {pred : V → V} {B : V → V} {st : V → V → V} {Cond : V → Prop}
+
+/-- **The local step**: at an index whose predecessors' fibres are all
+singletons, the recursor's graph has exactly one value. -/
+theorem recGraph_singleton_of_preds (hB : ∀ i, i ∈ˢ I → B i ∈ˢ (univ ℓ : V))
+    (hpred : ∀ i, i ∈ˢ I → pred i ⊆ˢ I)
+    {i : V} (hi : i ∈ˢ I)
+    (hst : ∀ g, g ∈ˢ piSet (pred i) (fun j => app (recGraph ℓ I pred B st) j) → st i g ∈ˢ B i)
+    (hP : ∀ j, j ∈ˢ pred i → (∃ v, v ∈ˢ app (recGraph ℓ I pred B st) j) ∧
+      ∀ v v', v ∈ˢ app (recGraph ℓ I pred B st) j → v' ∈ˢ app (recGraph ℓ I pred B st) j →
+        v = v') :
+    (∃ v, v ∈ˢ app (recGraph ℓ I pred B st) i) ∧
+      ∀ v v', v ∈ˢ app (recGraph ℓ I pred B st) i → v' ∈ˢ app (recGraph ℓ I pred B st) i →
+        v = v' := by
+  -- the choice function of the predecessors' values
+  have hchoice : ∀ j, ∃ v, j ∈ˢ pred i → v ∈ˢ app (recGraph ℓ I pred B st) j := fun j =>
+    Classical.byCases (fun h : j ∈ˢ pred i => ⟨_, fun _ => Classical.choose_spec (hP j h).1⟩)
+      (fun h => ⟨pt, fun h' => absurd h' h⟩)
+  have hu : ∀ j, j ∈ˢ pred i →
+      Classical.choose (hchoice j) ∈ˢ app (recGraph ℓ I pred B st) j :=
+    fun j hj => Classical.choose_spec (hchoice j) hj
+  have hg : graph (fun j => Classical.choose (hchoice j)) (pred i)
+      ∈ˢ piSet (pred i) (fun j => app (recGraph ℓ I pred B st) j) := graph_mem_piSet hu
+  -- any value at `i` is the step at that choice function
+  have key : ∀ v, v ∈ˢ app (recGraph ℓ I pred B st) i →
+      v = st i (graph (fun j => Classical.choose (hchoice j)) (pred i)) := by
+    intro v hv
+    rw [app_recGraph_eq hB hpred hi] at hv
+    obtain ⟨-, g', hg', rfl⟩ := mem_recGraphFibre.mp hv
+    congr 1
+    rw [← eq_graph_app_of_mem_piSet hg']
+    exact graph_congr fun j hj => (hP j hj).2 _ _ (app_mem_of_mem_piSet hg' hj) (hu j hj)
+  refine ⟨⟨st i (graph (fun j => Classical.choose (hchoice j)) (pred i)), ?_⟩,
+    fun v v' hv hv' => by rw [key v hv, key v' hv']⟩
+  rw [app_recGraph_eq hB hpred hi]
+  exact mem_recGraphFibre.mpr ⟨hst _ hg, _, hg, rfl⟩
+
+/-- The graph's selector: the fibre's element (the point off the graph). -/
+noncomputable def recSel (G : V) (i : V) : V :=
+  open Classical in
+  if h : ∃ v, v ∈ˢ app G i then Classical.choose h else pt
+
+theorem recSel_mem {G i : V} (h : ∃ v, v ∈ˢ app G i) : recSel G i ∈ˢ app G i := by
+  unfold recSel
+  rw [dif_pos h]
+  exact Classical.choose_spec h
+
+/-- **The recursion equation** at an index whose fibre and whose
+predecessors' fibres are singletons: the selector's value is the step
+at the selector's graph over the predecessors. -/
+theorem recSel_eq (hB : ∀ i, i ∈ˢ I → B i ∈ˢ (univ ℓ : V))
+    (hpred : ∀ i, i ∈ˢ I → pred i ⊆ˢ I) {i : V} (hi : i ∈ˢ I)
+    (hPi : ∃ v, v ∈ˢ app (recGraph ℓ I pred B st) i)
+    (hP : ∀ j, j ∈ˢ pred i → (∃ v, v ∈ˢ app (recGraph ℓ I pred B st) j) ∧
+      ∀ v v', v ∈ˢ app (recGraph ℓ I pred B st) j → v' ∈ˢ app (recGraph ℓ I pred B st) j →
+        v = v') :
+    recSel (recGraph ℓ I pred B st) i
+      = st i (graph (fun j => recSel (recGraph ℓ I pred B st) j) (pred i)) := by
+  have hv := recSel_mem hPi
+  rw [app_recGraph_eq hB hpred hi] at hv
+  obtain ⟨-, g', hg', hst⟩ := mem_recGraphFibre.mp hv
+  rw [hst]
+  congr 1
+  rw [← eq_graph_app_of_mem_piSet hg']
+  exact graph_congr fun j hj =>
+    (hP j hj).2 _ _ (app_mem_of_mem_piSet hg' hj) (recSel_mem (hP j hj).1)
+
+/-- **The recursion theorem by lfp induction**: at every index whose
+`Acc`-family fibre is inhabited, the recursor's graph has exactly one
+value. -/
+theorem recGraph_exists_unique (hB : ∀ i, i ∈ˢ I → B i ∈ˢ (univ ℓ : V))
+    (hpred : ∀ i, i ∈ˢ I → pred i ⊆ˢ I)
+    (hst : ∀ i, i ∈ˢ I → ∀ g, g ∈ˢ piSet (pred i) (fun j => app (recGraph ℓ I pred B st) j) →
+      st i g ∈ˢ B i) :
+    ∀ i, i ∈ˢ I → ∀ x, x ∈ˢ app (accFam I pred Cond) i →
+      (∃ v, v ∈ˢ app (recGraph ℓ I pred B st) i) ∧
+      ∀ v v', v ∈ˢ app (recGraph ℓ I pred B st) i → v' ∈ˢ app (recGraph ℓ I pred B st) i →
+        v = v' := by
+  refine lfpFamSet_induction ⟨_, accStep_closed (pred := pred) (Cond := Cond)⟩ (accStep_mono hpred)
+    (fun i _ => (∃ v, v ∈ˢ app (recGraph ℓ I pred B st) i) ∧
+      ∀ v v', v ∈ˢ app (recGraph ℓ I pred B st) i → v' ∈ˢ app (recGraph ℓ I pred B st) i →
+        v = v') ?_
+  intro i hi x hx
+  have hsubmem : graph (fun i => sep (app (lfpFamSet 0 I (accStep I pred Cond)) i)
+      (fun _ => (∃ v, v ∈ˢ app (recGraph ℓ I pred B st) i) ∧
+        ∀ v v', v ∈ˢ app (recGraph ℓ I pred B st) i → v' ∈ˢ app (recGraph ℓ I pred B st) i →
+          v = v')) I ∈ˢ famSpace 0 I :=
+    graph_mem_famSpace fun i hi => univ_sep_mem (famSpace_app (lfpFamSet_mem _ _ _) hi)
+  rw [app_app_accStep hsubmem hi] at hx
+  obtain ⟨⟨-, hall⟩, -⟩ := mem_truthVal.mp hx
+  refine recGraph_singleton_of_preds hB hpred hi (hst i hi) fun j hj => ?_
+  obtain ⟨y, hy⟩ := hall j hj
+  rw [app_graph (hpred i hi j hj)] at hy
+  exact (mem_sep.mp hy).2
+
+end RecTheorem
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetModel/TaggedSum.lean b/Ix/Theory/Model/SetModel/TaggedSum.lean
new file mode 100644
index 000000000..83620708b
--- /dev/null
+++ b/Ix/Theory/Model/SetModel/TaggedSum.lean
@@ -0,0 +1,186 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetModel/TaggedSum.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetModel.TupleTower
+
+@[expose] public section
+
+/-!
+# The tagged disjoint union (task #175 sum-types)
+
+The semantic carrier of a directly-installed inductive with **any
+number of constructors other than one**: a value is the pair of a
+**numeral tag** — the constructor's index, a finite ordinal
+`vnat i ∈ ω` — and that constructor's tuple tower
+(`Ix.Theory/Model/SetModel/TupleTower.lean`):
+
+    sumSet w f = sigmaSet w ω (natFibre f)        f i = the i-th tower
+    inj i a    = spair (vnat i) a
+
+`natFibre f` is the fibre function over `ω`: `f i` at `vnat i`, junk
+(`empty`) off the numerals — never consulted there, since every member
+of `ω` is a unique numeral (`mem_omega_iff`/`vnat_inj`).  The same
+function is the **case split** the recursor performs: on a member
+`inj i a` the recursor reads `i` back through `natFibre` and applies
+the `i`-th branch to `a` (`sumRec`).
+
+Both regimes ride one definition: `sigmaSet` reads `w` only through
+its zero test, so at `w = 0` the carrier is the truth value "some
+constructor's tower is inhabited" (`sumSet_zero_elim`) with every
+member the proof point, and above `0` it is the set of tagged pairs
+(`sumSet_elim`).  The tag domain `ω` sits in `univ w` for every `w ≥ 1`
+(`omega_mem_univ_succ` + cumulativity), which is where the carrier's
+formation lands (`sumSet_mem_univ`); at `w = 0` no bound is needed
+(`sumSet_zero_mem_univZero`).
+
+Everything here is over the bare `SetTheory` interface; no syntax.
+-/
+
+namespace Ix.Theory.Model.SetTheory.Tower
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+open Classical in
+/-- The fibre function over the numerals: `f i` at `vnat i`, junk off
+the numerals. -/
+noncomputable def natFibre (f : Nat → V) (k : V) : V :=
+  if h : ∃ i, k = vnat i then f (Classical.choose h) else empty
+
+theorem natFibre_vnat (f : Nat → V) (i : Nat) : natFibre f (vnat i) = f i := by
+  unfold natFibre
+  rw [dif_pos ⟨i, rfl⟩]
+  congr 1
+  exact (vnat_inj (Classical.choose_spec (⟨i, rfl⟩ : ∃ i', (vnat i : V) = vnat i'))).symm
+
+/-- Every member of `ω` is a numeral, at which the fibre is the
+named set. -/
+theorem natFibre_of_mem (f : Nat → V) {k : V} (hk : k ∈ˢ (omega : V)) :
+    ∃ i, k = vnat i ∧ natFibre f k = f i := by
+  obtain ⟨i, rfl⟩ := mem_omega_iff.mp hk
+  exact ⟨i, rfl, natFibre_vnat f i⟩
+
+/-- Fibre functions agreeing on the numerals agree on `ω`. -/
+theorem natFibre_congr {f g : Nat → V} (h : ∀ i, f i = g i) (k : V) :
+    natFibre f k = natFibre g k := by
+  unfold natFibre
+  split
+  · rw [h]
+  · rfl
+
+/-- **The tagged sum carrier.** -/
+noncomputable def sumSet (w : Nat) (f : Nat → V) : V :=
+  sigmaSet w omega (natFibre f)
+
+/-- **The injection** of constructor `i`. -/
+noncomputable def inj (i : Nat) (a : V) : V := spair (vnat i) a
+
+/-- The recursor's case split: the branch selected by the tag, applied
+to the payload (`natFibre` over the branches). -/
+noncomputable def sumRec (r : Nat → V → V) (x : V) : V :=
+  natFibre (fun i => r i (ssnd x)) (sfst x)
+
+/-! ## Laws -/
+
+theorem sumSet_congr {w : Nat} {f g : Nat → V} (h : ∀ i, f i = g i) :
+    sumSet w f = sumSet w g := by
+  unfold sumSet
+  exact sigma_congr fun k _ => natFibre_congr h k
+
+/-- **Intro** (graph regime): the injection of a fitting payload is in
+the carrier. -/
+theorem inj_mem {w : Nat} (hw : w ≠ 0) {f : Nat → V} {i : Nat} {a : V}
+    (ha : a ∈ˢ f i) : inj i a ∈ˢ sumSet w f := by
+  unfold inj sumSet
+  refine spair_mem hw (vnat_mem_omega i) ?_
+  rw [natFibre_vnat]
+  exact ha
+
+/-- **Intro** (squash regime): the carrier at `w = 0` holds the point
+whenever some constructor's tower is inhabited. -/
+theorem pt_mem_sumSet_zero {f : Nat → V} {i : Nat} {a : V} (ha : a ∈ˢ f i) :
+    (pt : V) ∈ˢ sumSet 0 f := by
+  unfold sumSet
+  exact pt_mem_sigma (a := vnat i) (b := a) (vnat_mem_omega i)
+    (by rw [natFibre_vnat]; exact ha)
+
+/-- **Elim** (graph regime): every carrier member is the injection of
+a fitting payload. -/
+theorem sumSet_elim {w : Nat} (hw : w ≠ 0) {f : Nat → V} {x : V}
+    (hx : x ∈ˢ sumSet w f) : ∃ i a, a ∈ˢ f i ∧ x = inj i a := by
+  unfold sumSet at hx
+  obtain ⟨k, a, hk, ha, -, hpos⟩ := mem_sigma_elim hx
+  obtain ⟨i, rfl, hfib⟩ := natFibre_of_mem f hk
+  rw [hfib] at ha
+  exact ⟨i, a, ha, hpos hw⟩
+
+/-- **Elim** (squash regime): a `w = 0` carrier member is the point,
+and some constructor's tower is inhabited. -/
+theorem sumSet_zero_elim {f : Nat → V} {x : V} (hx : x ∈ˢ sumSet 0 f) :
+    x = pt ∧ ∃ i a, a ∈ˢ f i := by
+  unfold sumSet at hx
+  obtain ⟨k, a, hk, ha, hz, -⟩ := mem_sigma_elim hx
+  obtain ⟨i, rfl, hfib⟩ := natFibre_of_mem f hk
+  rw [hfib] at ha
+  exact ⟨hz rfl, i, a, ha⟩
+
+/-- **Tag disjointness and injectivity**: equal injections have equal
+tags and payloads. -/
+theorem inj_inj {i j : Nat} {a b : V} (h : inj i a = inj j b) : i = j ∧ a = b := by
+  unfold inj at h
+  have h1 := congrArg sfst h
+  have h2 := congrArg ssnd h
+  rw [sfst_spair, sfst_spair] at h1
+  rw [ssnd_spair, ssnd_spair] at h2
+  exact ⟨vnat_inj h1, h2⟩
+
+theorem sfst_inj (i : Nat) (a : V) : sfst (inj i a) = vnat i := sfst_spair _ _
+theorem ssnd_inj (i : Nat) (a : V) : ssnd (inj i a) = a := ssnd_spair _ _
+
+/-- **Formation** (graph regime): with every tower in `univ w`, the
+carrier is too — the tag domain `ω` sits in every `univ w` above `0`. -/
+theorem sumSet_mem_univ {w : Nat} (hw : w ≠ 0) {f : Nat → V}
+    (hf : ∀ i, f i ∈ˢ (univ w : V)) : sumSet w f ∈ˢ (univ w : V) := by
+  obtain ⟨w', rfl⟩ : ∃ w', w = w' + 1 := ⟨w - 1, by omega⟩
+  have hω : (omega : V) ∈ˢ univ (w' + 1) := omega_mem_univ_succ w'
+  have h := sigma_mem_univ (u := w' + 1) (v := w' + 1) (B := natFibre f) hω (fun k hk => by
+    obtain ⟨i, rfl, hfib⟩ := natFibre_of_mem f hk
+    rw [hfib]
+    exact hf i)
+  rwa [show Nat.max (w' + 1) (w' + 1) = w' + 1 from Nat.max_self _] at h
+
+/-- **Formation** (squash regime), unconditional. -/
+theorem sumSet_zero_mem_univZero (f : Nat → V) : sumSet 0 f ∈ˢ (univZero : V) := by
+  unfold sumSet
+  rw [sigmaSet_zero]
+  exact truthVal_mem_univZero _
+
+/-- **Iota** for the case split — unconditional. -/
+theorem sumRec_inj (r : Nat → V → V) (i : Nat) (a : V) : sumRec r (inj i a) = r i a := by
+  unfold sumRec
+  rw [sfst_inj, ssnd_inj, natFibre_vnat]
+
+/-- **Storage hygiene**: the carrier is never the proof point. -/
+theorem sumSet_ne_pt {w : Nat} (f : Nat → V) : sumSet w f ≠ (pt : V) := sigmaSet_ne_pt
+
+/-! ## Degeneracy checks -/
+
+/-- Zero constructors: the carrier is empty in the graph regime. -/
+example {w : Nat} (hw : w ≠ 0) {x : V} (hx : x ∈ˢ sumSet w (fun _ => (empty : V))) : False := by
+  obtain ⟨i, a, ha, -⟩ := sumSet_elim hw hx
+  exact not_mem_empty a ha
+
+/-- Two constructors: the two injections are distinct. -/
+example (a b : V) : inj 0 a ≠ inj 1 b := fun h => by
+  have := (inj_inj h).1
+  omega
+
+end Ix.Theory.Model.SetTheory.Tower
diff --git a/Ix/Theory/Model/SetModel/TupleTower.lean b/Ix/Theory/Model/SetModel/TupleTower.lean
new file mode 100644
index 000000000..dd3b3283b
--- /dev/null
+++ b/Ix/Theory/Model/SetModel/TupleTower.lean
@@ -0,0 +1,424 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetModel/TupleTower.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Sigma
+
+@[expose] public section
+
+/-!
+# The uniform tuple model: unit-terminated pair towers (agent/tuple-model)
+
+The semantic carrier construction for directly-installed structures
+(DESIGN.md, "AMENDMENT — the uniform tuple model"): every qualifying
+structure's carrier is the **right-nested pair tower with unit
+terminator**
+
+    towerSet w ⟨F₀, …, F_{n−1}⟩ = F₀ ⋉ (F₁ ⋉ (… ⋉ (F_{n−1} ⋉ unitSet)))
+
+(each `⋉` a `sigmaSet w`, dependency right-nested along the field
+telescope), the constructor is the uniform tupler `mkTower`, and the
+semantic projection family is ONE definition depending only on the
+index:
+
+    projS i = sfst ∘ ssnd^i        (structure-independent)
+
+The unit terminator is what buys index-only uniformity: with a bare
+tail the last field would be read by `ssnd^{n−1}` (no `sfst`), making
+the family depend on the arity — i.e. on the structure.  It also
+gives the 0/1-field degeneracies for free (`n = 0`: the carrier is
+`unitSet`, members exactly `pt = mkTower []`; `n = 1`: members are
+`spair a pt` and `projS 0 = sfst` is lawful).
+
+**ProjCoherence by uniform tupling**: the constructor is one
+instantiation-independent function with global left inverses
+(`kpair_inj` iterated), so the parked study's boundary predicate is
+discharged by representation — tier form `mkTower_inj`, proved through
+the iota law alone.
+
+**No `pw` datum — `pt` is separate from pairs** (user refinement,
+2026-09-04): the interface keeps the proof point apart from every
+Kuratowski pair (`pt_ne_kpair`, the `Derive/Pt.lean` selection
+principle, surfaced as `sfst_pt`/`ssnd_pt`; the task-#109 pt-freshness
+battery is the systematic form), so the destructors fix `pt` and
+`projS i pt = pt` holds outright.  A `Prop` structure's element
+denotes `pt` and its proof fields denote `pt`, so projection-of-`pt`
+is the *correct* answer by proof irrelevance — iota and membership
+hold with one uniform `projS`, no per-structure variant.  The squash
+membership law carries the proof-field premise `PropS` (every field
+set a truth value — the levelwise `structSort = 0 → fieldSort = 0`
+bound); that is not a datum on the projection but the per-use
+legality the checker's own `infer_proj` Prop restriction discharges.
+The two regimes are disjoint by the same separation: graph-regime
+members of a nonempty tower are never `pt` (`tower_mem_ne_pt`, from
+`ptFresh_sigmaSet_pos`), squash members are exactly `pt`.
+
+Everything here is over the bare `SetTheory` interface; no syntax, no
+environment.  Kernel wiring is out of scope (post-B4; see the DESIGN
+handoff record).
+-/
+
+namespace Ix.Theory.Model.SetTheory.Tower
+
+universe u
+
+/-- A dependent field-set telescope over `V`, indexed by its length:
+field `i`'s set may depend on the values of fields `0..i−1`. -/
+inductive TeleS (V : Type u) : Nat → Type u where
+  | nil : TeleS V 0
+  | cons {n : Nat} (A : V) (B : V → TeleS V n) : TeleS V (n + 1)
+
+variable {V : Type u} [SetTheory V]
+
+/-- `FitsS T as`: the value list `as` fits the telescope `T` — right
+length, each value in its field's set at the earlier values. -/
+def FitsS : {n : Nat} → TeleS V n → List V → Prop
+  | _, .nil, [] => True
+  | _, .nil, _ :: _ => False
+  | _, .cons _ _, [] => False
+  | _, .cons A B, a :: as => a ∈ˢ A ∧ FitsS (B a) as
+
+/-- The carrier: the right-nested `sigmaSet w` tower over the
+telescope, terminated by `unitSet`. -/
+noncomputable def towerSet (w : Nat) : {n : Nat} → TeleS V n → V
+  | _, .nil => unitSet
+  | _, .cons A B => sigmaSet w A (fun a => towerSet w (B a))
+
+/-- The uniform tupler: the right-nested Kuratowski pair tower with
+`pt` (the sole member of `unitSet`) as terminator. -/
+noncomputable def mkTower : List V → V
+  | [] => pt
+  | a :: as => spair a (mkTower as)
+
+/-- **The uniform semantic projection family**: `projS i = sfst ∘
+ssnd^i`.  One definition for every structure and every index. -/
+noncomputable def projS : Nat → V → V
+  | 0, x => sfst x
+  | i + 1, x => projS i (ssnd x)
+
+/-- The first-`n` projection tuple of a value. -/
+noncomputable def projList : Nat → V → List V
+  | 0, _ => []
+  | n + 1, x => sfst x :: projList n (ssnd x)
+
+/-- The `k`-fold second projection (task #210 Part A): the tuple tower
+below `k` leading pair components — `projS (i + k) x = projS i (dropS k
+x)`, so a projection table with offset `k` reads its fields off
+`dropS k` of the subject (`k = 1` at the fixpoint route's tagged
+tower, whose first component is the constructor tag). -/
+noncomputable def dropS : Nat → V → V
+  | 0, x => x
+  | k + 1, x => dropS k (ssnd x)
+
+theorem projS_add_dropS : ∀ (i k : Nat) (x : V), projS (i + k) x = projS i (dropS k x)
+  | _, 0, _ => rfl
+  | i, k + 1, x => by
+    show projS (i + k) (ssnd x) = projS i (dropS k (ssnd x))
+    exact projS_add_dropS i k (ssnd x)
+
+theorem dropS_pt : ∀ k : Nat, dropS k (pt : V) = pt
+  | 0 => rfl
+  | k + 1 => by show dropS k (ssnd pt) = pt; rw [ssnd_pt, dropS_pt k]
+
+/-- The `i`-th field set of a telescope at a prefix valuation
+(`empty` out of range — never consumed in range). -/
+noncomputable def teleNth : {n : Nat} → TeleS V n → Nat → List V → V
+  | _, .nil, _, _ => empty
+  | _, .cons A _, 0, _ => A
+  | _, .cons _ B, i + 1, a :: as => teleNth (B a) i as
+  | _, .cons _ _, _ + 1, [] => empty
+
+/-- `PropS T`: every field set is a truth value, hereditarily — the
+levelwise `structSort = 0 → fieldSort = 0` bound, telescope-side. -/
+def PropS : {n : Nat} → TeleS V n → Prop
+  | _, .nil => True
+  | _, .cons A B => A ∈ˢ (univZero : V) ∧ ∀ a, a ∈ˢ A → PropS (B a)
+
+/-- `BoundS w T`: every field set lives in `univ w`, hereditarily —
+the formation premise (per-field sorts `≤ w` via cumulativity). -/
+def BoundS (w : Nat) : {n : Nat} → TeleS V n → Prop
+  | _, .nil => True
+  | _, .cons A B => A ∈ˢ (univ w : V) ∧ ∀ a, a ∈ˢ A → BoundS w (B a)
+
+/-! ## Auxiliary lemmas -/
+
+theorem FitsS.length_eq : ∀ {n} {T : TeleS V n} {as : List V},
+    FitsS T as → as.length = n
+  | _, .nil, [], _ => rfl
+  | _, .cons _ _, _ :: _, h =>
+    congrArg Nat.succ (FitsS.length_eq h.2)
+
+theorem projList_length : ∀ (n : Nat) (x : V), (projList n x).length = n
+  | 0, _ => rfl
+  | n + 1, x => congrArg Nat.succ (projList_length n (ssnd x))
+
+theorem projList_get : ∀ (n i : Nat) (x : V) (h : i < n),
+    (projList n x)[i]'((projList_length n x).symm ▸ h) = projS i x
+  | _ + 1, 0, _, _ => rfl
+  | n + 1, i + 1, x, h =>
+    projList_get n i (ssnd x) (Nat.lt_of_succ_lt_succ h)
+
+theorem projList_take : ∀ (n i : Nat) (x : V), i ≤ n →
+    (projList n x).take i = projList i x
+  | _, 0, _, _ => rfl
+  | n + 1, i + 1, x, h => by
+    show sfst x :: (projList n (ssnd x)).take i = sfst x :: projList i (ssnd x)
+    rw [projList_take n i (ssnd x) (Nat.le_of_succ_le_succ h)]
+
+theorem projList_mkTower : ∀ (n : Nat) (as : List V), as.length = n →
+    projList n (mkTower as) = as
+  | 0, [], _ => rfl
+  | n + 1, a :: as, h => by
+    show sfst (spair a (mkTower as)) :: projList n (ssnd (spair a (mkTower as)))
+      = a :: as
+    rw [sfst_spair, ssnd_spair, projList_mkTower n as (Nat.succ.inj h)]
+
+theorem projList_mkTower_append : ∀ (as bs : List V), projList as.length (mkTower (as ++ bs)) = as
+  | [], _ => rfl
+  | a :: as, bs => by
+    show sfst (spair a (mkTower (as ++ bs))) :: projList as.length (ssnd (spair a (mkTower (as ++ bs))))
+      = a :: as
+    rw [sfst_spair, ssnd_spair, projList_mkTower_append as bs]
+
+theorem projList_pt : ∀ n : Nat, projList n (pt : V) = List.replicate n pt
+  | 0 => rfl
+  | n + 1 => by
+    show sfst (pt : V) :: projList n (ssnd (pt : V)) = pt :: List.replicate n pt
+    rw [sfst_pt, ssnd_pt, projList_pt n]
+
+/-- `projS` fixes `pt`: the interface's pt-vs-pair separation
+(`sfst_pt`/`ssnd_pt`, from `pt_ne_kpair`) makes projection-of-`pt`
+return `pt` — the correct proof-field answer, with no separate
+`Prop`-structure variant. -/
+theorem projS_pt : ∀ i : Nat, projS i (pt : V) = pt
+  | 0 => sfst_pt
+  | i + 1 => by rw [projS, ssnd_pt, projS_pt i]
+
+/-- `FitsS` reads off `teleNth` membership: each fitting value is in
+its field's set at the earlier values. -/
+theorem fitsS_mem_teleNth : ∀ {n} {T : TeleS V n} {as : List V},
+    (hf : FitsS T as) → ∀ (i : Nat) (h : i < n),
+    as[i]'(FitsS.length_eq hf ▸ h) ∈ˢ teleNth T i (as.take i)
+  | _, .cons _ _, _ :: _, hf, 0, _ => hf.1
+  | _, .cons _ B, a :: as, hf, i + 1, h =>
+    fitsS_mem_teleNth (T := B a) (as := as) hf.2 i (Nat.lt_of_succ_lt_succ h)
+
+/-- `PropS` forces every fitting value to `pt`, so the all-`pt` list
+fits whenever anything does. -/
+theorem fitsS_replicate_of_prop : ∀ {n} {T : TeleS V n} {as : List V},
+    PropS T → FitsS T as → FitsS T (List.replicate n pt)
+  | _, .nil, [], _, _ => trivial
+  | _, .cons _ B, a :: as, hP, hf => by
+    have ha : a = pt := eq_pt_of_mem_univZero hP.1 hf.1
+    show (pt : V) ∈ˢ _ ∧ FitsS (B pt) (List.replicate _ pt)
+    exact ⟨ha ▸ hf.1, ha ▸ fitsS_replicate_of_prop (hP.2 a hf.1) hf.2⟩
+
+/-! ## The law families (frozen in the DESIGN amendment) -/
+
+/-- **Intro** (graph regime): a fitting tuple's tower is in the
+carrier. -/
+theorem mkTower_mem {w : Nat} (hw : w ≠ 0) :
+    ∀ {n} {T : TeleS V n} {as : List V},
+    FitsS T as → mkTower as ∈ˢ towerSet w T
+  | _, .nil, [], _ => pt_mem_unitSet
+  | _, .cons _ B, a :: _, hf =>
+    spair_mem hw hf.1 (mkTower_mem hw (T := B a) hf.2)
+
+/-- **Intro** (squash regime): the carrier at `w = 0` is the truth
+value of fittability. -/
+theorem pt_mem_tower : ∀ {n} {T : TeleS V n} {as : List V},
+    FitsS T as → (pt : V) ∈ˢ towerSet 0 T
+  | _, .nil, [], _ => pt_mem_unitSet
+  | _, .cons _ B, a :: _, hf =>
+    pt_mem_sigma hf.1 (pt_mem_tower (T := B a) hf.2)
+
+/-- **Iota — UNCONDITIONAL**: no membership premise, no level.  The
+checker's `.proj`/`mk` reduction is denotation-sound with no typing of
+the fields at all. -/
+theorem projS_mkTower : ∀ (i : Nat) (as : List V) (h : i < as.length),
+    projS i (mkTower as) = as[i]
+  | 0, a :: as, _ => by
+    show sfst (spair a (mkTower as)) = a
+    exact sfst_spair a (mkTower as)
+  | i + 1, a :: as, h => by
+    show projS i (ssnd (spair a (mkTower as))) = as[i]'(Nat.lt_of_succ_lt_succ h)
+    rw [ssnd_spair]
+    exact projS_mkTower i as (Nat.lt_of_succ_lt_succ h)
+
+/-- The projection list of a point-terminated tower is the fields'
+prefix (task #210: the fixpoint route's constructor payload). -/
+theorem projList_mkTower_take {fs : List V} {i : Nat} (hi : i ≤ fs.length) :
+    projList i (mkTower (fs ++ [pt])) = fs.take i := by
+  have h1 : projList (fs.length + 1) (mkTower (fs ++ [pt])) = fs ++ [pt] := projList_mkTower _ _ (by simp)
+  have h2 := projList_take (fs.length + 1) i (mkTower (fs ++ [pt])) (by omega)
+  rw [h1, List.take_append_of_le_length hi] at h2
+  exact h2.symm
+
+/-- A field projection of a point-terminated tower, `getD`-form. -/
+theorem projS_mkTower_getD {fs : List V} {i : Nat} (hi : i < fs.length) :
+    projS i (mkTower (fs ++ [pt])) = fs.getD i pt := by
+  rw [projS_mkTower i (fs ++ [pt]) (by simp; omega), List.getElem_append_left hi,
+    List.getD_eq_getElem?_getD, List.getElem?_eq_getElem hi, Option.getD_some]
+
+/-- **Eta + elim** (graph regime): every carrier member IS the tower
+of its own projections, and those projections fit the telescope. -/
+theorem towerSet_elim {w : Nat} (hw : w ≠ 0) :
+    ∀ {n} (T : TeleS V n) {x : V}, x ∈ˢ towerSet w T →
+    FitsS T (projList n x) ∧ x = mkTower (projList n x)
+  | _, .nil, x, hx => ⟨trivial, mem_unitSet_iff.mp hx⟩
+  | _, .cons A B, x, hx => by
+    obtain ⟨a, b, ha, hb, -, hpos⟩ :=
+      mem_sigma_elim (A := A) (B := fun a => towerSet w (B a)) hx
+    have hx' : x = spair a b := hpos hw
+    subst hx'
+    obtain ⟨hfit, heta⟩ := towerSet_elim hw (B a) hb
+    constructor
+    · show sfst (spair a b) ∈ˢ A ∧ FitsS (B (sfst (spair a b)))
+        (projList _ (ssnd (spair a b)))
+      rw [sfst_spair, ssnd_spair]
+      exact ⟨ha, hfit⟩
+    · show spair a b
+        = spair (sfst (spair a b)) (mkTower (projList _ (ssnd (spair a b))))
+      rw [sfst_spair, ssnd_spair, ← heta]
+
+/-- **Elim** (squash regime): a `w = 0` carrier member is `pt`, and
+some tuple fits. -/
+theorem towerSet_zero_elim : ∀ {n} (T : TeleS V n) {x : V},
+    x ∈ˢ towerSet 0 T → x = pt ∧ ∃ as, FitsS T as
+  | _, .nil, x, hx => ⟨mem_unitSet_iff.mp hx, [], trivial⟩
+  | _, .cons A B, x, hx => by
+    obtain ⟨a, b, ha, hb, hz, -⟩ :=
+      mem_sigma_elim (A := A) (B := fun a => towerSet 0 (B a)) hx
+    obtain ⟨-, as, hfit⟩ := towerSet_zero_elim (B a) hb
+    exact ⟨hz rfl, a :: as, ha, hfit⟩
+
+/-- **Membership** (graph regime): the `i`-th projection lands in the
+`i`-th field set at the earlier projections. -/
+theorem projS_mem {w : Nat} (hw : w ≠ 0) {n} {T : TeleS V n} {x : V}
+    (hx : x ∈ˢ towerSet w T) (i : Nat) (h : i < n) :
+    projS i x ∈ˢ teleNth T i (projList i x) := by
+  obtain ⟨hfit, -⟩ := towerSet_elim hw T hx
+  have hm := fitsS_mem_teleNth hfit i h
+  rw [projList_take n i x (Nat.le_of_lt h)] at hm
+  rw [← projList_get n i x h]
+  exact hm
+
+/-- **Membership** (squash regime): the SAME statement, with the
+proof-field premise `PropS` in place of `w ≠ 0` — every member is
+`pt`, `projS` fixes it, and every truth-value field set at the
+all-`pt` prefix contains it (proof irrelevance, semantically). -/
+theorem projS_mem_zero {n} {T : TeleS V n} {x : V} (hP : PropS T)
+    (hx : x ∈ˢ towerSet 0 T) (i : Nat) (h : i < n) :
+    projS i x ∈ˢ teleNth T i (projList i x) := by
+  obtain ⟨rfl, as, hfit⟩ := towerSet_zero_elim T hx
+  have hrep := fitsS_replicate_of_prop hP hfit
+  have hm := fitsS_mem_teleNth hrep i h
+  rw [List.take_replicate, Nat.min_eq_left (Nat.le_of_lt h),
+    List.getElem_replicate] at hm
+  rw [projS_pt, projList_pt]
+  exact hm
+
+/-- **Coherence by uniform tupling**: `ProjCoh` holds by
+representation — equal towers of equal arity have equal components.
+Proved through the iota law alone (`kpair_inj` iterated). -/
+theorem mkTower_inj {as bs : List V} (hlen : as.length = bs.length)
+    (h : mkTower as = mkTower bs) : as = bs := by
+  apply List.ext_getElem hlen
+  intro i h1 h2
+  rw [← projS_mkTower i as h1, ← projS_mkTower i bs h2, h]
+
+/-- **The recursor, DERIVED** (graph regime): large-elimination typing
+and iota for `r := m ∘ projList n`, with eta (`towerSet_elim`) as the
+load-bearing step of the typing — the probe's `builtModel_recElimU2`,
+promoted to every arity and dependency shape. -/
+theorem towerRec {w : Nat} (hw : w ≠ 0) {n} (T : TeleS V n)
+    (M : V → V) (m : List V → V)
+    (hm : ∀ as, FitsS T as → m as ∈ˢ M (mkTower as)) :
+    ∃ r : V → V, (∀ x, x ∈ˢ towerSet w T → r x ∈ˢ M x) ∧
+      (∀ as, FitsS T as → r (mkTower as) = m as) := by
+  refine ⟨fun x => m (projList n x), fun x hx => ?_, fun as hf => ?_⟩
+  · obtain ⟨hfit, heta⟩ := towerSet_elim hw T hx
+    have := hm _ hfit
+    rwa [← heta] at this
+  · show m (projList n (mkTower as)) = m as
+    rw [projList_mkTower n as hf.length_eq]
+
+/-- **The recursor at squash**: constant elimination is lawful — the
+semantic form of subsingleton elimination (the minor's value must be
+instantiation-independent, which all-proof-field instantiations
+satisfy with `m = pt`). -/
+theorem towerRec_zero {n} (T : TeleS V n) (M : V → V) (m : V)
+    (hm : (∃ as, FitsS T as) → m ∈ˢ M pt) :
+    ∀ x, x ∈ˢ towerSet 0 T → m ∈ˢ M x := by
+  intro x hx
+  obtain ⟨rfl, hex⟩ := towerSet_zero_elim T hx
+  exact hm hex
+
+/-- **Formation**: the carrier lives at the structure's own level,
+given the per-field bound (cumulativity is applied by the consumer
+when a field's sort is `< w`). -/
+theorem towerSet_mem_univ {w : Nat} : ∀ {n} (T : TeleS V n),
+    BoundS w T → towerSet w T ∈ˢ (univ w : V)
+  | _, .nil, _ => unitSet_mem_univ w
+  | _, .cons A B, hb => by
+    simp only [towerSet]
+    have h := sigma_mem_univ (u := w) (v := w) hb.1
+      (fun a ha => towerSet_mem_univ (B a) (hb.2 a ha))
+    rwa [show Nat.max w w = w from Nat.max_self w] at h
+
+/-- **Formation, squash regime — UNCONDITIONAL**: at `w = 0` the
+carrier is a truth value with no field bounds at all (`sigmaSet 0`
+truncates whatever its arguments are), so definitely-`Prop`
+structures with arbitrary-sorted data fields (`Exists`) still get a
+lawful carrier; only their *projections* wait on `PropS`. -/
+theorem towerSet_zero_mem_univZero : ∀ {n} (T : TeleS V n),
+    towerSet 0 T ∈ˢ (univZero : V)
+  | _, .nil => univ_zero (V := V) ▸ unitSet_mem_univ 0
+  | _, .cons _ B => by
+    show sigmaSet 0 _ (fun a => towerSet 0 (B a)) ∈ˢ (univZero : V)
+    rw [sigmaSet_zero]
+    exact truthVal_mem_univZero _
+
+/-- **Storage hygiene**: a tower carrier is never the proof point
+(the task-#100 collapse-era non-`pt`-ness of stored values). -/
+theorem towerSet_ne_pt {w : Nat} : ∀ {n} (T : TeleS V n),
+    towerSet w T ≠ (pt : V)
+  | _, .nil => fun h =>
+    truthVal_ne_pt True ((truthVal_eq_unitSet trivial).trans h)
+  | _, .cons _ _ => sigmaSet_ne_pt
+
+/-- **The 0-field degeneracy**: the empty tower is `unitSet` at every
+level — hence unit-likeness (next lemma) and, at `w = 0`, the correct
+truth value `⟦True⟧`. -/
+theorem towerSet_nil {w : Nat} : towerSet w (.nil : TeleS V 0) = unitSet := by
+  rfl
+
+/-- Unit-likeness at `n = 0`: any two members are equal. -/
+theorem tower_nil_unitlike {w : Nat} {x y : V}
+    (hx : x ∈ˢ towerSet w (.nil : TeleS V 0))
+    (hy : y ∈ˢ towerSet w (.nil : TeleS V 0)) : x = y :=
+  (mem_unitSet_iff.mp hx).trans (mem_unitSet_iff.mp hy).symm
+
+/-! ## Degeneracy checks (build-time regressions) -/
+
+/-- `n = 1`: the terminator makes `projS 0 = sfst` lawful — the sole
+field of a one-field tower reads back. -/
+example (a : V) : projS 0 (mkTower [a]) = a :=
+  projS_mkTower 0 [a] (by simp)
+
+/-- `n = 2`: both indices read back through the one uniform family. -/
+example (a b : V) : projS 0 (mkTower [a, b]) = a ∧ projS 1 (mkTower [a, b]) = b :=
+  ⟨projS_mkTower 0 [a, b] (by simp), projS_mkTower 1 [a, b] (by simp)⟩
+
+/-- `n = 0`: the empty tower's sole member is `mkTower []`. -/
+example {w : Nat} {x : V} (hx : x ∈ˢ towerSet w (.nil : TeleS V 0)) :
+    x = mkTower [] :=
+  mem_unitSet_iff.mp hx
+
+end Ix.Theory.Model.SetTheory.Tower
diff --git a/Ix/Theory/Model/SetTheory/Core.lean b/Ix/Theory/Model/SetTheory/Core.lean
new file mode 100644
index 000000000..f6baf1797
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Core.lean
@@ -0,0 +1,166 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Core.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+@[expose] public section
+
+/-!
+# The axiomatic core: ZF⁻ plus an ω-chain of Grothendieck universes
+
+The `SetTheory` class below is the *entire* axiomatic interface of the
+consistency proof; every operator and law the model construction uses
+(`Ix.Theory/Model/SetTheory/Basic.lean`) is *derived* from it in
+`Ix.Theory/Model/SetTheory/Derive/*`, never assumed.
+
+The set-theoretic axioms are **extensionality, pairing, union, power
+set, regularity, the replacement scheme, and an ω-chain of
+Grothendieck universes** `univChain 0 ∈ univChain 1 ∈ …` —
+universehood stated as the matrix of Tarski's Axiom A (A. Tarski,
+*Über unerreichbare Kardinalzahlen*, Fund. Math. 30 (1938), 68–89)
+strengthened with a transitivity clause, i.e. as Grothendieck
+universes (SGA 4, Exp. I, Appendix).  Infinity and choice are
+derivable and therefore absent.
+
+This calibrates the axiomatic strength to exactly what the checker
+consumes — the ω-indexed tower `univ 0, univ 1, univ 2, …` — and to
+the known consistency strength of Lean itself: ZFC plus a strictly
+increasing ω-sequence of inaccessible cardinals — the
+`OmegaInaccessibles` hypothesis
+`∃ κ : ℕ → Cardinal, StrictMono κ ∧ ∀ n, (κ n).IsInaccessible`
+of Mario Carneiro, *The Type Theory of Lean*, master's thesis,
+Carnegie Mellon University, 2019, §1.2.  Under that hypothesis the intended
+model takes `univChain n := V_{κ n}`.  This is strictly weaker than
+full Tarski–Grothendieck set theory (Tarski's Axiom A places a
+universe above *every* set, a proper class of inaccessibles; cf. the
+Mizar axiomatics, A. Trybulec, *Tarski Grothendieck Set Theory*,
+Formalized Mathematics 1(1), 1990).
+
+Deliberate deviations from a first-order presentation:
+
+* **Replacement** is a Lean-level scheme: the image operator takes an
+  arbitrary function `V → V`.  This is the usual strengthening when the
+  ambient logic can quantify over class functions; `V_κ` for `κ`
+  inaccessible still satisfies it.
+* **Choice is not a field.**  A first-order axiomatization must assert
+  choice; here the ambient logic is Lean with `Classical.choice`, and
+  every set-level form of choice over `V` (the global selector
+  `schoice`, and the Jech-form choice-function statement, *Set Theory*,
+  §5) is a *theorem* — replacement applied to a classically chosen
+  selector.  See `Ix.Theory/Model/SetTheory/Derive/Choice.lean`.  Asserting it
+  here would add redundant axiomatic content; global choice is supplied
+  by the meta-logic, not by this class.
+* **No `nonempty` field.**  First-order logic's nonempty domain is
+  implied: `univChain` already exhibits elements of `V`.
+
+Everything else — the empty set, separation, ordered pairs, infinity,
+function graphs, the universe tower, quotients — is constructed in
+`Ix.Theory/Model/SetTheory/Derive/*`.
+-/
+
+namespace Ix.Theory.Model
+
+universe u
+
+/-- `y` and `u` are equinumerous: some (meta-level) function restricts to
+a bijection from the members of `y` onto the members of `u`.  This is the
+notion Tarski's Axiom A is stated with; using a Lean-level function keeps
+ordered pairs out of the core (a first-order presentation instead
+describes set-level bijections by formulas).  For the intended models this is
+equivalent: a set-level bijection yields a meta-level one by choice, and
+the axiom's disjunction is only ever *used* by refuting this side via a
+diagonal argument (`Derive/Universe.lean`). -/
+def Equinumerous {V : Type u} (mem : V → V → Prop) (y u : V) : Prop :=
+  ∃ f : V → V,
+    (∀ z, mem z y → mem (f z) u) ∧
+    (∀ z z', mem z y → mem z' y → f z = f z' → z = z') ∧
+    (∀ w, mem w u → ∃ z, mem z y ∧ f z = w)
+
+/-- The matrix of Tarski's Axiom A (Tarski 1938), strengthened with the
+transitivity clause: `u` is a Grothendieck universe (SGA 4, Exp. I,
+Appendix).  The four clauses, in order:
+
+1. *transitivity*: members of members are members — the clause that
+   distinguishes a Grothendieck universe from a bare Tarski one, and
+   what makes the empty set fall out of regularity;
+2. *subsets of members are members*;
+3. *power sets stay inside*: some member contains all subsets of a
+   member (with clause 2 this makes `power y` itself a member);
+4. *inaccessibility*: a subset of `u` is equinumerous with `u` or a
+   member.  Dropping the equinumerosity disjunct is **inconsistent**
+   (`u ⊆ u` would force `u ∈ u`, against regularity). -/
+def IsTGUniverse {V : Type u} (mem : V → V → Prop) (u : V) : Prop :=
+  (∀ y z, mem y u → mem z y → mem z u) ∧
+  (∀ y z, mem y u → (∀ w, mem w z → mem w y) → mem z u) ∧
+  (∀ y, mem y u → ∃ p, mem p u ∧ ∀ z, (∀ w, mem w z → mem w y) → mem z p) ∧
+  (∀ y, (∀ w, mem w y → mem w u) → Equinumerous mem y u ∨ mem y u)
+
+/-- A model of set theory of exactly the strength the checker needs:
+membership, the six ZF⁻ axioms (extensionality, pairing, union, power
+set, regularity, Lean-level replacement), and an ω-chain of
+Grothendieck universes.  Infinity is derivable; choice is inherited
+from the meta-logic (`Classical.choice`); see the module docstring. -/
+class SetTheory (V : Type u) where
+  /-- Set membership. -/
+  Mem : V → V → Prop
+  /-- Extensionality: sets with the same members are equal. -/
+  ext : ∀ {x y : V}, (∀ z, Mem z x ↔ Mem z y) → x = y
+  /-- Pairing: the unordered pair. -/
+  upair : V → V → V
+  /-- Characterization of the unordered pair. -/
+  mem_upair : ∀ {z a b : V}, Mem z (upair a b) ↔ z = a ∨ z = b
+  /-- Union: the union of the members. -/
+  sUnion : V → V
+  /-- Characterization of the union. -/
+  mem_sUnion : ∀ {z x : V}, Mem z (sUnion x) ↔ ∃ y, Mem y x ∧ Mem z y
+  /-- Power set. -/
+  power : V → V
+  /-- Characterization of the power set: members are the subsets. -/
+  mem_power : ∀ {z x : V}, Mem z (power x) ↔ ∀ w, Mem w z → Mem w x
+  /-- Regularity: every nonempty set has an `∈`-minimal member. -/
+  regularity : ∀ x : V, (∃ y, Mem y x) → ∃ y, Mem y x ∧ ¬ ∃ z, Mem z y ∧ Mem z x
+  /-- Replacement, as a Lean-level scheme: the image of a set under an
+  arbitrary function `V → V`. -/
+  image : (V → V) → V → V
+  /-- Characterization of the replacement image. -/
+  mem_image : ∀ {f : V → V} {a z : V}, Mem z (image f a) ↔ ∃ w, Mem w a ∧ z = f w
+  /-- An ω-chain of Grothendieck universes: the sets interpreting the
+  universe tower (Carneiro's ω-many inaccessibles, op. cit.;
+  intended model `V_{κ n}`). -/
+  univChain : Nat → V
+  /-- The chain increases strictly: each universe is a member of the
+  next. -/
+  univChain_mem : ∀ n : Nat, Mem (univChain n) (univChain (n + 1))
+  /-- Each chain member is a Grothendieck universe (Tarski's Axiom A
+  matrix with transitivity, `IsTGUniverse`). -/
+  univChain_tg : ∀ n : Nat, IsTGUniverse Mem (univChain n)
+
+namespace SetTheory
+
+@[inherit_doc] scoped infix:50 " ∈ˢ " => Mem
+
+variable {V : Type u} [SetTheory V]
+
+/-- Subset, from membership. -/
+protected def Subset (x y : V) : Prop := ∀ z, z ∈ˢ x → z ∈ˢ y
+
+@[inherit_doc] scoped infix:50 " ⊆ˢ " => SetTheory.Subset
+
+theorem Subset.refl (x : V) : x ⊆ˢ x := fun _ hz => hz
+
+theorem Subset.trans {x y z : V} (h₁ : x ⊆ˢ y) (h₂ : y ⊆ˢ z) : x ⊆ˢ z :=
+  fun w hw => h₂ w (h₁ w hw)
+
+theorem Subset.antisymm {x y : V} (h₁ : x ⊆ˢ y) (h₂ : y ⊆ˢ x) : x = y :=
+  ext fun z => ⟨h₁ z, h₂ z⟩
+
+theorem mem_power_iff_subset {z x : V} : z ∈ˢ power x ↔ z ⊆ˢ x := mem_power
+
+end SetTheory
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/SetTheory/Derive/Choice.lean b/Ix/Theory/Model/SetTheory/Derive/Choice.lean
new file mode 100644
index 000000000..1b58066b5
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Choice.lean
@@ -0,0 +1,75 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Choice.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Graphs
+
+@[expose] public section
+
+/-!
+# Choice: the global selector, and the eighth axiom as a theorem
+
+A first-order development of Tarski–Grothendieck set theory asserts (or
+derives from Axiom A) an axiom of choice, because it cannot reach the
+meta-level.  Here the meta-logic is Lean with `Classical.choice`, so
+choice over `V` is *derived*:
+
+* `schoice : V → V` — a global selector, `schoice A ∈ A` whenever `A`
+  is inhabited (Lean-level choice on the membership predicate);
+* `set_choice` — the Jech-form statement (*Set Theory*, §5): every
+  family has a *set* choice function, obtained as the replacement
+  graph of `schoice`, spelled through `kpair` as a single-valued set
+  of ordered pairs.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+open Classical in
+/-- Global choice: a uniform selection from nonempty sets.  On sets
+without members (and only there) it returns the set itself. -/
+noncomputable def schoice (A : V) : V :=
+  if h : ∃ x, x ∈ˢ A then Classical.choose h else A
+
+theorem schoice_mem {A x : V} (hx : x ∈ˢ A) : schoice A ∈ˢ A := by
+  unfold schoice
+  rw [dif_pos ⟨x, hx⟩]
+  exact Classical.choose_spec (⟨x, hx⟩ : ∃ x, x ∈ˢ A)
+
+/-- The axiom of choice, Jech-form, as a theorem: every family `X` has
+a set-level choice function — a single-valued set of pairs, total on
+`X`, selecting a member from every inhabited `A ∈ X`. -/
+theorem set_choice (X : V) :
+    ∃ f : V,
+      (∀ A c, kpair A c ∈ˢ f → A ∈ˢ X) ∧
+      (∀ A, A ∈ˢ X → ∃ c, kpair A c ∈ˢ f ∧ ∀ c', kpair A c' ∈ˢ f → c' = c) ∧
+      (∀ A c, kpair A c ∈ˢ f → (∃ x, x ∈ˢ A) → c ∈ˢ A) := by
+  refine ⟨graph schoice X, ?_, ?_, ?_⟩
+  · intro A c hp
+    obtain ⟨A', hA', hp'⟩ := mem_graph.mp hp
+    obtain ⟨rfl, -⟩ := kpair_inj hp'
+    exact hA'
+  · intro A hA
+    refine ⟨schoice A, mem_graph.mpr ⟨A, hA, rfl⟩, ?_⟩
+    intro c' hc'
+    obtain ⟨A', -, hp'⟩ := mem_graph.mp hc'
+    obtain ⟨rfl, rfl⟩ := kpair_inj hp'
+    rfl
+  · intro A c hp ⟨x, hx⟩
+    obtain ⟨A', -, hp'⟩ := mem_graph.mp hp
+    obtain ⟨rfl, rfl⟩ := kpair_inj hp'
+    exact schoice_mem hx
+
+/- Opaque interface operator (see `Derive/Empty.lean`). -/
+attribute [irreducible] schoice
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Empty.lean b/Ix/Theory/Model/SetTheory/Derive/Empty.lean
new file mode 100644
index 000000000..2c202a614
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Empty.lean
@@ -0,0 +1,79 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Empty.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Core
+
+@[expose] public section
+
+/-!
+# The empty set, derived
+
+The transitivity clause in `IsTGUniverse` makes this cheap —
+`univChain 1` is inhabited (by `univChain 0`) and transitive, so
+regularity's `∈`-minimal member of it has no members at all.
+
+Also here: the small consequences of regularity everything downstream
+wants — `x ∉ x` and the impossibility of membership 2-cycles.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+theorem empty_exists : ∃ e : V, ∀ z, ¬ z ∈ˢ e := by
+  obtain ⟨htrans, -, -, -⟩ := univChain_tg (V := V) 1
+  obtain ⟨y, hy, hmin⟩ :=
+    regularity (univChain (V := V) 1) ⟨univChain 0, univChain_mem 0⟩
+  exact ⟨y, fun z hz => hmin ⟨z, hz, htrans y z hy hz⟩⟩
+
+/-- The empty set. -/
+noncomputable def empty : V := Classical.choose empty_exists
+
+theorem not_mem_empty (z : V) : ¬ z ∈ˢ (empty : V) :=
+  Classical.choose_spec empty_exists z
+
+theorem eq_empty {x : V} (h : ∀ z, ¬ z ∈ˢ x) : x = empty :=
+  ext fun z => ⟨fun hz => absurd hz (h z), fun hz => absurd hz (not_mem_empty z)⟩
+
+theorem eq_empty_iff {x : V} : x = empty ↔ ∀ z, ¬ z ∈ˢ x :=
+  ⟨fun h z => h ▸ not_mem_empty z, eq_empty⟩
+
+theorem ne_empty_of_mem {x z : V} (h : z ∈ˢ x) : x ≠ empty :=
+  fun he => not_mem_empty z (he ▸ h)
+
+theorem nonempty_of_ne_empty {x : V} (h : x ≠ empty) : ∃ z, z ∈ˢ x :=
+  Classical.byContradiction fun hn => h (eq_empty fun z hz => hn ⟨z, hz⟩)
+
+theorem empty_subset (x : V) : (empty : V) ⊆ˢ x :=
+  fun z hz => absurd hz (not_mem_empty z)
+
+/-- No set is a member of itself (regularity at `{x}`). -/
+theorem not_mem_self (x : V) : ¬ x ∈ˢ x := by
+  intro hx
+  obtain ⟨y, hy, hmin⟩ := regularity (upair x x) ⟨x, mem_upair.mpr (Or.inl rfl)⟩
+  have hyx : y = x := by rcases mem_upair.mp hy with h | h <;> exact h
+  subst hyx
+  exact hmin ⟨y, hx, mem_upair.mpr (Or.inl rfl)⟩
+
+/- Interface operators are opaque from here on (as the legacy class
+projections were): consumers reason only through the laws, never by
+unfolding.  Everything above this line may use the definition. -/
+attribute [irreducible] empty
+
+/-- No membership 2-cycles (regularity at `{a, b}`). -/
+theorem no_two_cycle {a b : V} (hab : a ∈ˢ b) (hba : b ∈ˢ a) : False := by
+  obtain ⟨y, hy, hmin⟩ := regularity (upair a b) ⟨a, mem_upair.mpr (Or.inl rfl)⟩
+  rcases mem_upair.mp hy with h | h <;> subst h
+  · exact hmin ⟨b, hba, mem_upair.mpr (Or.inr rfl)⟩
+  · exact hmin ⟨a, hab, mem_upair.mpr (Or.inl rfl)⟩
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Graphs.lean b/Ix/Theory/Model/SetTheory/Derive/Graphs.lean
new file mode 100644
index 000000000..4449e747b
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Graphs.lean
@@ -0,0 +1,252 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Graphs.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Pt
+
+@[expose] public section
+
+/-!
+# Function graphs, application, and the raw dependent-function set
+
+* `graph F A = {⟨x, F x⟩ : x ∈ A}` — the set-theoretic function graph
+  (replacement); never equal to `pt`, since `pt`'s element `ptTag` has
+  an empty member and so is not a Kuratowski pair.
+* `app f a = ⋃ {y : ⟨a, y⟩ ∈ f}` — untagged application on non-`pt`
+  arguments; `app pt a = pt` is the tag that makes proofs degenerate
+  (`app_pt` in the `SetTheory` interface).
+* `sigmaPairs A B = {⟨x, y⟩ : x ∈ A, y ∈ B x}` — the raw dependent
+  pair set (also the `w ≠ 0` sigma).
+* `piSet A B ⊆ power (sigmaPairs A B)` — the total single-valued
+  graphs: the `v ≠ 0` dependent product.
+
+The level-`0` truncations (`lam 0 = pt`, `pi 0` a truth value) were
+layered on top in `Derive/Pi.lean`, deleted at task #221: the model
+reads the *annotation-driven* `piR`/`lamR` (`SetModel/Ops.lean`), which
+dispatch on the annotation instead of collapsing.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The function graph `{⟨x, F x⟩ : x ∈ A}`. -/
+noncomputable def graph (F : V → V) (A : V) : V :=
+  image (fun x => kpair x (F x)) A
+
+theorem mem_graph {F : V → V} {A p : V} :
+    p ∈ˢ graph F A ↔ ∃ x, x ∈ˢ A ∧ p = kpair x (F x) := mem_image
+
+theorem graph_ne_pt {F : V → V} {A : V} : graph F A ≠ (pt : V) := by
+  intro h
+  obtain ⟨x, -, hx⟩ :=
+    mem_graph.mp (h ▸ ptTag_mem_pt : (ptTag : V) ∈ˢ graph F A)
+  exact ptTag_ne_kpair x (F x) hx
+
+theorem graph_congr {F F' : V → V} {A : V} (h : ∀ x, x ∈ˢ A → F x = F' x) :
+    graph F A = graph F' A :=
+  image_congr fun x hx => by rw [h x hx]
+
+open Classical in
+/-- Tagged set-theoretic application: the union of the values paired
+with `a` in `f` — except at the proof point, which applies to `pt`
+again. -/
+noncomputable def app (f a : V) : V :=
+  if f = pt then pt else sUnion (sep (sUnion (sUnion f)) (fun y => kpair a y ∈ˢ f))
+
+theorem app_pt (a : V) : app (pt : V) a = pt := by
+  unfold app; exact if_pos rfl
+
+/-- Application computes on single-valued positions. -/
+theorem app_eq_of_unique {f a b : V} (hf : f ≠ pt) (hab : kpair a b ∈ˢ f)
+    (huniq : ∀ y, kpair a y ∈ˢ f → y = b) : app f a = b := by
+  unfold app
+  rw [if_neg hf]
+  have : sep (sUnion (sUnion f)) (fun y => kpair a y ∈ˢ f) = sing b := by
+    apply ext fun z => ?_
+    rw [mem_sep, mem_sing]
+    constructor
+    · exact fun ⟨_, hz⟩ => huniq z hz
+    · rintro rfl
+      refine ⟨?_, hab⟩
+      exact mem_sUnion.mpr ⟨upair a z, mem_sUnion.mpr ⟨kpair a z, hab, mem_upair_right _ _⟩,
+        mem_upair_right a z⟩
+  rw [this, sUnion_sing]
+
+/-- Beta on graphs. -/
+theorem app_graph {F : V → V} {A a : V} (ha : a ∈ˢ A) :
+    app (graph F A) a = F a := by
+  refine app_eq_of_unique graph_ne_pt (mem_graph.mpr ⟨a, ha, rfl⟩) ?_
+  intro y hy
+  obtain ⟨x, -, hx⟩ := mem_graph.mp hy
+  obtain ⟨rfl, rfl⟩ := kpair_inj hx
+  rfl
+
+/-- The raw dependent pair set `{⟨x, y⟩ : x ∈ A, y ∈ B x}`. -/
+noncomputable def sigmaPairs (A : V) (B : V → V) : V :=
+  sUnion (image (fun x => image (fun y => kpair x y) (B x)) A)
+
+theorem mem_sigmaPairs {A p : V} {B : V → V} :
+    p ∈ˢ sigmaPairs A B ↔ ∃ x, x ∈ˢ A ∧ ∃ y, y ∈ˢ B x ∧ p = kpair x y := by
+  unfold sigmaPairs
+  rw [mem_sUnion]
+  constructor
+  · rintro ⟨s, hs, hps⟩
+    obtain ⟨x, hx, rfl⟩ := mem_image.mp hs
+    obtain ⟨y, hy, rfl⟩ := mem_image.mp hps
+    exact ⟨x, hx, y, hy, rfl⟩
+  · rintro ⟨x, hx, y, hy, rfl⟩
+    exact ⟨image (fun y => kpair x y) (B x), mem_image.mpr ⟨x, hx, rfl⟩,
+      mem_image.mpr ⟨y, hy, rfl⟩⟩
+
+theorem sigmaPairs_congr {A : V} {B B' : V → V}
+    (h : ∀ x, x ∈ˢ A → B x = B' x) : sigmaPairs A B = sigmaPairs A B' := by
+  unfold sigmaPairs
+  congr 1
+  exact image_congr fun x hx => by rw [h x hx]
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.sigmaPairs_mem {U A : V} {B : V → V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hA : A ∈ˢ U)
+    (hB : ∀ x, x ∈ˢ A → B x ∈ˢ U) : sigmaPairs A B ∈ˢ U :=
+  hU.famUnion_mem hA fun x hx =>
+    hU.image_mem (hB x hx) fun _y hy =>
+      hU.kpair_mem hA (hU.transitive hA hx) (hU.transitive (hB x hx) hy)
+
+/-- The set of total single-valued dependent graphs on `A` with fibres
+`B`: the `v ≠ 0` dependent product. -/
+noncomputable def piSet (A : V) (B : V → V) : V :=
+  sep (power (sigmaPairs A B))
+    (fun f => ∀ x, x ∈ˢ A → ∃ y, kpair x y ∈ˢ f ∧ ∀ y', kpair x y' ∈ˢ f → y' = y)
+
+theorem mem_piSet {A f : V} {B : V → V} :
+    f ∈ˢ piSet A B ↔ f ⊆ˢ sigmaPairs A B ∧
+      ∀ x, x ∈ˢ A → ∃ y, kpair x y ∈ˢ f ∧ ∀ y', kpair x y' ∈ˢ f → y' = y := by
+  unfold piSet
+  rw [mem_sep, mem_power_iff_subset]
+
+theorem piSet_congr {A : V} {B B' : V → V}
+    (h : ∀ x, x ∈ˢ A → B x = B' x) : piSet A B = piSet A B' := by
+  unfold piSet
+  rw [sigmaPairs_congr h]
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.piSet_mem {U A : V} {B : V → V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hA : A ∈ˢ U)
+    (hB : ∀ x, x ∈ˢ A → B x ∈ˢ U) : piSet A B ∈ˢ U :=
+  hU.mem_of_subset_mem (hU.power_mem (hU.sigmaPairs_mem hA hB)) sep_subset
+
+theorem graph_mem_piSet {A : V} {B F : V → V}
+    (hF : ∀ x, x ∈ˢ A → F x ∈ˢ B x) : graph F A ∈ˢ piSet A B := by
+  rw [mem_piSet]
+  constructor
+  · intro p hp
+    obtain ⟨x, hx, rfl⟩ := mem_graph.mp hp
+    exact mem_sigmaPairs.mpr ⟨x, hx, F x, hF x hx, rfl⟩
+  · intro x hx
+    refine ⟨F x, mem_graph.mpr ⟨x, hx, rfl⟩, ?_⟩
+    intro y' hy'
+    obtain ⟨x', -, hx'⟩ := mem_graph.mp hy'
+    obtain ⟨rfl, rfl⟩ := kpair_inj hx'
+    rfl
+
+theorem ne_pt_of_mem_piSet {A f : V} {B : V → V} (hf : f ∈ˢ piSet A B) :
+    f ≠ pt := by
+  rintro rfl
+  have := (mem_piSet.mp hf).1 ptTag ptTag_mem_pt
+  obtain ⟨x, -, y, -, hy⟩ := mem_sigmaPairs.mp this
+  exact ptTag_ne_kpair x y hy
+
+theorem app_mem_of_mem_piSet {A f a : V} {B : V → V}
+    (hf : f ∈ˢ piSet A B) (ha : a ∈ˢ A) : app f a ∈ˢ B a := by
+  obtain ⟨hsub, htot⟩ := mem_piSet.mp hf
+  obtain ⟨y, hy, huniq⟩ := htot a ha
+  rw [app_eq_of_unique (ne_pt_of_mem_piSet hf) hy huniq]
+  obtain ⟨x', -, y', hy', hp⟩ := mem_sigmaPairs.mp (hsub _ hy)
+  obtain ⟨rfl, rfl⟩ := kpair_inj hp
+  exact hy'
+
+/-- Eta: a member of `piSet A B` is the graph of its own application. -/
+theorem eq_graph_app_of_mem_piSet {A f : V} {B : V → V}
+    (hf : f ∈ˢ piSet A B) : graph (fun x => app f x) A = f := by
+  obtain ⟨hsub, htot⟩ := mem_piSet.mp hf
+  apply ext fun p => ?_
+  rw [mem_graph]
+  constructor
+  · rintro ⟨x, hx, rfl⟩
+    obtain ⟨y, hy, huniq⟩ := htot x hx
+    rwa [app_eq_of_unique (ne_pt_of_mem_piSet hf) hy huniq]
+  · intro hp
+    obtain ⟨x, hx, y, -, rfl⟩ := mem_sigmaPairs.mp (hsub p hp)
+    obtain ⟨y', hy', huniq⟩ := htot x hx
+    refine ⟨x, hx, ?_⟩
+    rw [app_eq_of_unique (ne_pt_of_mem_piSet hf) hy' huniq, huniq y hp]
+
+/-- Members of `piSet A' B` that are graphs over `A` pin the domain:
+every `x ∈ A'` lies in `A`. -/
+theorem graph_dom_of_mem_piSet {A A' : V} {B F : V → V}
+    (hf : graph F A ∈ˢ piSet A' B) : ∀ x, x ∈ˢ A' → x ∈ˢ A := by
+  intro x hx
+  obtain ⟨y, hy, -⟩ := (mem_piSet.mp hf).2 x hx
+  obtain ⟨x', hx', hp⟩ := mem_graph.mp hy
+  obtain ⟨rfl, rfl⟩ := kpair_inj hp
+  exact hx'
+
+/-! ### Off-domain and junk behavior of `app`
+
+`app` is total: on a non-`pt` value with no pair at the argument —
+in particular off a graph's domain, or on the canonical junk value
+`empty` itself — it returns `empty`.  These lemmas record that a
+graph's off-domain behavior is *canonical*: two graphs over the same
+domain that agree on the domain agree everywhere, which is what makes
+a **total** equality between interpreted function towers equivalent to
+pointwise agreement on fitting inputs (`eq_of_mem_piSet_app_eq`, and
+`eq_of_mem_pi_app_eq`, deleted with `Derive/Pi.lean` at task #221). -/
+
+theorem app_eq_empty_of_not_mem {f a : V} (hf : f ≠ pt)
+    (h : ∀ y, ¬ kpair a y ∈ˢ f) : app f a = empty := by
+  unfold app
+  rw [if_neg hf]
+  refine eq_empty fun z hz => ?_
+  obtain ⟨y, hy, -⟩ := mem_sUnion.mp hz
+  exact h y (mem_sep.mp hy).2
+
+/-- `app` off a graph's domain is the canonical junk value. -/
+theorem app_graph_of_not_mem {F : V → V} {A a : V} (ha : ¬ a ∈ˢ A) :
+    app (graph F A) a = empty := by
+  refine app_eq_empty_of_not_mem graph_ne_pt fun y hy => ?_
+  obtain ⟨x, hx, hp⟩ := mem_graph.mp hy
+  obtain ⟨rfl, rfl⟩ := kpair_inj hp
+  exact ha hx
+
+/-- `app` on the canonical junk value returns junk: junk propagates
+through applications. -/
+theorem app_empty (a : V) : app (empty : V) a = empty :=
+  app_eq_empty_of_not_mem (Ne.symm pt_ne_empty)
+    (fun _y hy => not_mem_empty _ hy)
+
+/-- A member of `piSet` applied off the domain is junk. -/
+theorem app_off_dom_of_mem_piSet {A f a : V} {B : V → V}
+    (hf : f ∈ˢ piSet A B) (ha : ¬ a ∈ˢ A) : app f a = empty := by
+  rw [← eq_graph_app_of_mem_piSet hf, app_graph_of_not_mem ha]
+
+/-- Function extensionality for members of the raw dependent product:
+two total single-valued graphs over the same domain that agree under
+application on every domain member are equal (off the domain both
+apply to canonical junk, so nothing else distinguishes them). -/
+theorem eq_of_mem_piSet_app_eq {A f g : V} {B B' : V → V}
+    (hf : f ∈ˢ piSet A B) (hg : g ∈ˢ piSet A B')
+    (h : ∀ x, x ∈ˢ A → app f x = app g x) : f = g := by
+  rw [← eq_graph_app_of_mem_piSet hf, ← eq_graph_app_of_mem_piSet hg]
+  exact graph_congr h
+
+/- Opaque interface operator (see `Derive/Empty.lean`). -/
+attribute [irreducible] app
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Lfp.lean b/Ix/Theory/Model/SetTheory/Derive/Lfp.lean
new file mode 100644
index 000000000..be3793ea7
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Lfp.lean
@@ -0,0 +1,162 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Lfp.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Univ
+
+@[expose] public section
+
+/-!
+# Least pre-fixed points inside a universe (task #188)
+
+The carrier of a directly installed **recursive** inductive type is the
+Knaster–Tarski least pre-fixed point of its constructor-tower functor,
+taken *inside* a universe:
+
+    lfpSet w F = ⋂ { X ∈ univ w | F X ⊆ X }
+
+where `F` is a set-level function (a graph over `univ w`, so `F X` is
+`app F X`).  The intersection is realised as a separation over a
+(classically chosen) closed member — `{x ∈ L₀ | x lies in every
+`F`-closed member of `univ w`}` — so it is a set, and a *subset of a
+member* of `univ w`, hence a member.  When NO closed member exists the
+definition returns the empty set instead.  That junk value is what
+makes the operator **total** at the type `(Sort w → Sort w) → Sort w`:
+`lfpSet w F ∈ univ w` for every `F` (`lfpSet_mem_univ`), so the basis
+constant `lfp` needs no certificate argument.  Every LAW below assumes
+a closed member exists (`∃ L, IsClosedIn w F L`) — the semantic side
+exhibits one (the ω-iterate of a finitary tower functor,
+`Ix.Theory/Model/SetModel/Iter.lean`).
+
+Under that hypothesis and monotonicity the standard facts hold: the
+least pre-fixed point is a fixed point (`lfpSet_closed`,
+`lfpSet_fixed`), and it is contained in every closed member
+(`lfpSet_subset`) — which IS structural induction (`lfpSet_induction`):
+a property closed under the functor holds on the whole carrier.  No
+rank, no ordinal, no iteration is consulted by the recursor's laws.
+
+The RECURSOR of a recursive type needs no operator of its own: it is a
+fixed point of its one-step unfolding, selected by the basis
+`Classical.choice` from the (spelled) sigma type of fixed points
+(`Ix.Theory/Model/Semantics/Tower/FixRec.lean`).
+
+Everything here is over the bare `SetTheory` interface; no syntax.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-! ## Universe helpers -/
+
+/-- A subset of a member of `univ w` is a member: at `w = 0` members of
+`univZero` are the subsets of `unitSet`; above, the Grothendieck
+clause. -/
+theorem univ_mem_of_subset_mem {w : Nat} {y z : V} (hy : y ∈ˢ (univ w : V)) (hz : z ⊆ˢ y) :
+    z ∈ˢ (univ w : V) := by
+  rcases Nat.eq_zero_or_pos w with rfl | hw
+  · rw [univ_zero] at hy ⊢
+    rw [mem_univZero] at hy ⊢
+    exact hz.trans hy
+  · exact (univ_isTGUniverse (Nat.pos_iff_ne_zero.mp hw)).mem_of_subset_mem hy hz
+
+/-- Separation stays inside every level. -/
+theorem univ_sep_mem {w : Nat} {a : V} {p : V → Prop} (ha : a ∈ˢ (univ w : V)) :
+    sep a p ∈ˢ (univ w : V) :=
+  univ_mem_of_subset_mem ha sep_subset
+
+/-! ## The least pre-fixed point -/
+
+/-- An `F`-closed member of `univ w`: a pre-fixed point of `app F`. -/
+def IsClosedIn (w : Nat) (F X : V) : Prop :=
+  X ∈ˢ (univ w : V) ∧ app F X ⊆ˢ X
+
+open Classical in
+/-- **The least pre-fixed point of `F` inside `univ w`** — the
+intersection of the `F`-closed members of `univ w` when there is one
+(separated from a chosen closed member), the empty set otherwise (see
+the module docstring). -/
+noncomputable def lfpSet (w : Nat) (F : V) : V :=
+  if h : ∃ L, IsClosedIn w F L then
+    sep (Classical.choose h) (fun x => ∀ X, IsClosedIn w F X → x ∈ˢ X)
+  else empty
+
+theorem lfpSet_of_not {w : Nat} {F : V} (h : ¬ ∃ L, IsClosedIn w F L) :
+    lfpSet w F = empty := by
+  unfold lfpSet; exact dif_neg h
+
+theorem mem_lfpSet {w : Nat} {F x : V} (h : ∃ L, IsClosedIn w F L) :
+    x ∈ˢ lfpSet w F ↔ ∀ X, IsClosedIn w F X → x ∈ˢ X := by
+  unfold lfpSet
+  rw [dif_pos h, mem_sep]
+  exact ⟨fun hx => hx.2, fun hx => ⟨hx _ (Classical.choose_spec h), hx⟩⟩
+
+/-- **Leastness**: the least pre-fixed point lies in every closed
+member. -/
+theorem lfpSet_subset {w : Nat} {F X : V} (hX : IsClosedIn w F X) : lfpSet w F ⊆ˢ X :=
+  fun _x hx => (mem_lfpSet ⟨X, hX⟩).mp hx X hX
+
+/-- **Formation, unconditional**: the least pre-fixed point is a member
+of the universe — a subset of a closed member when there is one, the
+empty set otherwise. -/
+theorem lfpSet_mem_univ (w : Nat) (F : V) : lfpSet w F ∈ˢ (univ w : V) := by
+  by_cases h : ∃ L, IsClosedIn w F L
+  · obtain ⟨L, hL⟩ := h
+    exact univ_mem_of_subset_mem hL.1 (lfpSet_subset hL)
+  · rw [lfpSet_of_not h]; exact empty_mem_univ w
+
+/-- Monotonicity of a set-level functor on the universe. -/
+def MonoIn (w : Nat) (F : V) : Prop :=
+  ∀ X Y, X ∈ˢ (univ w : V) → Y ∈ˢ (univ w : V) → X ⊆ˢ Y → app F X ⊆ˢ app F Y
+
+/-- The functor maps the universe into itself. -/
+def MapsIn (w : Nat) (F : V) : Prop :=
+  ∀ X, X ∈ˢ (univ w : V) → app F X ∈ˢ (univ w : V)
+
+/-- **Closure**: the least pre-fixed point is a pre-fixed point. -/
+theorem lfpSet_closed {w : Nat} {F : V} (h : ∃ L, IsClosedIn w F L)
+    (hmono : MonoIn w F) : app F (lfpSet w F) ⊆ˢ lfpSet w F := by
+  intro x hx
+  rw [mem_lfpSet h]
+  intro X hX
+  exact hX.2 x (hmono _ _ (lfpSet_mem_univ w F) hX.1 (lfpSet_subset hX) x hx)
+
+/-- **The fixed-point equation's other half**: the least pre-fixed
+point is a post-fixed point, because its image is itself closed. -/
+theorem lfpSet_fixed {w : Nat} {F : V} (h : ∃ L, IsClosedIn w F L)
+    (hmono : MonoIn w F) (hmaps : MapsIn w F) : lfpSet w F ⊆ˢ app F (lfpSet w F) := by
+  refine lfpSet_subset ⟨hmaps _ (lfpSet_mem_univ w F), ?_⟩
+  exact hmono _ _ (hmaps _ (lfpSet_mem_univ w F)) (lfpSet_mem_univ w F)
+    (lfpSet_closed h hmono)
+
+/-- The fixed-point equation. -/
+theorem lfpSet_eq {w : Nat} {F : V} (h : ∃ L, IsClosedIn w F L)
+    (hmono : MonoIn w F) (hmaps : MapsIn w F) : app F (lfpSet w F) = lfpSet w F :=
+  Subset.antisymm (lfpSet_closed h hmono) (lfpSet_fixed h hmono hmaps)
+
+/-- **Structural induction**: a property closed under the functor on
+the carrier holds on the whole carrier — the members of the carrier
+satisfying it form a closed member of the universe, in which the
+carrier lies by leastness. -/
+theorem lfpSet_induction {w : Nat} {F : V} (h : ∃ L, IsClosedIn w F L)
+    (hmono : MonoIn w F) (P : V → Prop)
+    (hP : ∀ x, x ∈ˢ app F (sep (lfpSet w F) P) → P x) :
+    ∀ x, x ∈ˢ lfpSet w F → P x := by
+  intro x hx
+  have hS : IsClosedIn w F (sep (lfpSet w F) P) := by
+    refine ⟨univ_sep_mem (lfpSet_mem_univ w F), fun y hy => ?_⟩
+    rw [mem_sep]
+    refine ⟨?_, hP y hy⟩
+    exact lfpSet_closed h hmono y
+      (hmono _ _ (univ_sep_mem (lfpSet_mem_univ w F)) (lfpSet_mem_univ w F) sep_subset y hy)
+  exact (mem_sep.mp (lfpSet_subset hS x hx)).2
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/LfpFam.lean b/Ix/Theory/Model/SetTheory/Derive/LfpFam.lean
new file mode 100644
index 000000000..7123ed505
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/LfpFam.lean
@@ -0,0 +1,170 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/LfpFam.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Lfp
+import Ix.Theory.Model.SetTheory.Derive.Graphs
+@[expose] public section
+
+/-!
+# Least pre-fixed points of family functors (task #188, indexed)
+
+The carrier of a directly installed recursive **family** `T : I → Sort w`
+is the least pre-fixed point of its constructor-tower functor acting on
+FAMILIES — graphs over the index-tuple set `I` with values in `univ w`
+(`famSpace`), ordered pointwise (`FamLe`).  This is `Lfp.lean` fibrewise:
+
+    lfpFamSet w I F = i ↦ {x ∈ L₀ i | ∀ closed X, x ∈ X i}
+
+over a classically chosen closed family `L₀` (the empty family when
+there is none — TOTAL, so the basis constant `lfpFam` needs no
+certificate: `lfpFamSet_mem`).  Under a closed member and monotonicity
+the least pre-fixed family is a fixed point (`lfpFamSet_eq`) and
+supports fibrewise structural induction (`lfpFamSet_induction`); the
+closed member is exhibited by the semantics (the ω-iterate family, per
+fibre — `Ix.Theory/Model/SetModel/Iter.lean`'s `natUnion`).
+
+Everything here is over the bare `SetTheory` interface; no syntax.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The family space over `I`: graphs into `univ w`. -/
+noncomputable def famSpace (w : Nat) (I : V) : V := piSet I fun _ => univ w
+
+/-- The pointwise order on families over `I`. -/
+def FamLe (I X Y : V) : Prop := ∀ i, i ∈ˢ I → app X i ⊆ˢ app Y i
+
+theorem FamLe.refl (I X : V) : FamLe I X X := fun _ _ => Subset.refl _
+
+theorem FamLe.trans {I X Y Z : V} (h₁ : FamLe I X Y) (h₂ : FamLe I Y Z) : FamLe I X Z :=
+  fun i hi => Subset.trans (h₁ i hi) (h₂ i hi)
+
+/-- An `F`-closed family: a pre-fixed point of `app F` in the family
+space. -/
+def IsClosedFam (w : Nat) (I F X : V) : Prop :=
+  X ∈ˢ famSpace w I ∧ FamLe I (app F X) X
+
+theorem famSpace_app {w : Nat} {I X i : V} (hX : X ∈ˢ famSpace w I) (hi : i ∈ˢ I) :
+    app X i ∈ˢ (univ w : V) :=
+  app_mem_of_mem_piSet hX hi
+
+/-- Members of the family space agreeing pointwise are equal. -/
+theorem famSpace_ext {w : Nat} {I X Y : V} (hX : X ∈ˢ famSpace w I) (hY : Y ∈ˢ famSpace w I)
+    (h : ∀ i, i ∈ˢ I → app X i = app Y i) : X = Y :=
+  eq_of_mem_piSet_app_eq hX hY h
+
+/-- A graph with fibres in `univ w` is in the family space. -/
+theorem graph_mem_famSpace {w : Nat} {I : V} {G : V → V} (h : ∀ i, i ∈ˢ I → G i ∈ˢ (univ w : V)) :
+    graph G I ∈ˢ famSpace w I :=
+  graph_mem_piSet h
+
+open Classical in
+/-- **The least pre-fixed family of `F` over `I`** — fibrewise the
+intersection of the closed families when there is one (separated from
+a chosen closed family), the empty family otherwise. -/
+noncomputable def lfpFamSet (w : Nat) (I F : V) : V :=
+  if h : ∃ L, IsClosedFam w I F L then
+    graph (fun i => sep (app (Classical.choose h) i)
+      (fun x => ∀ X, IsClosedFam w I F X → x ∈ˢ app X i)) I
+  else graph (fun _ => empty) I
+
+theorem lfpFamSet_of_not {w : Nat} {I F : V} (h : ¬ ∃ L, IsClosedFam w I F L) :
+    lfpFamSet w I F = graph (fun _ => empty) I := by
+  unfold lfpFamSet; exact dif_neg h
+
+theorem mem_app_lfpFamSet {w : Nat} {I F i x : V} (h : ∃ L, IsClosedFam w I F L) (hi : i ∈ˢ I) :
+    x ∈ˢ app (lfpFamSet w I F) i ↔ ∀ X, IsClosedFam w I F X → x ∈ˢ app X i := by
+  unfold lfpFamSet
+  rw [dif_pos h, app_graph hi, mem_sep]
+  exact ⟨fun hx => hx.2, fun hx => ⟨hx _ (Classical.choose_spec h), hx⟩⟩
+
+/-- **Leastness**: the least pre-fixed family lies in every closed
+family. -/
+theorem lfpFamSet_le {w : Nat} {I F X : V} (hX : IsClosedFam w I F X) :
+    FamLe I (lfpFamSet w I F) X :=
+  fun _ hi _x hx => (mem_app_lfpFamSet ⟨X, hX⟩ hi).mp hx X hX
+
+/-- **Formation, unconditional**: the least pre-fixed family is in the
+family space. -/
+theorem lfpFamSet_mem (w : Nat) (I F : V) : lfpFamSet w I F ∈ˢ famSpace w I := by
+  by_cases h : ∃ L, IsClosedFam w I F L
+  · unfold lfpFamSet
+    rw [dif_pos h]
+    exact graph_mem_famSpace fun _ hi =>
+      univ_sep_mem (famSpace_app (Classical.choose_spec h).1 hi)
+  · rw [lfpFamSet_of_not h]
+    exact graph_mem_famSpace fun _ _ => empty_mem_univ w
+
+/-- Monotonicity of a family functor on the family space. -/
+def MonoFam (w : Nat) (I F : V) : Prop :=
+  ∀ X Y, X ∈ˢ famSpace w I → Y ∈ˢ famSpace w I → FamLe I X Y → FamLe I (app F X) (app F Y)
+
+/-- The functor maps the family space into itself. -/
+def MapsFam (w : Nat) (I F : V) : Prop :=
+  ∀ X, X ∈ˢ famSpace w I → app F X ∈ˢ famSpace w I
+
+/-- **Closure**: the least pre-fixed family is a pre-fixed point. -/
+theorem lfpFamSet_closed {w : Nat} {I F : V} (h : ∃ L, IsClosedFam w I F L)
+    (hmono : MonoFam w I F) : FamLe I (app F (lfpFamSet w I F)) (lfpFamSet w I F) := by
+  intro i hi x hx
+  rw [mem_app_lfpFamSet h hi]
+  intro X hX
+  exact hX.2 i hi x (hmono _ _ (lfpFamSet_mem w I F) hX.1 (lfpFamSet_le hX) i hi x hx)
+
+/-- The least pre-fixed family is a post-fixed point. -/
+theorem lfpFamSet_fixed {w : Nat} {I F : V} (h : ∃ L, IsClosedFam w I F L)
+    (hmono : MonoFam w I F) (hmaps : MapsFam w I F) :
+    FamLe I (lfpFamSet w I F) (app F (lfpFamSet w I F)) := by
+  refine lfpFamSet_le ⟨hmaps _ (lfpFamSet_mem w I F), ?_⟩
+  exact hmono _ _ (hmaps _ (lfpFamSet_mem w I F)) (lfpFamSet_mem w I F)
+    (lfpFamSet_closed h hmono)
+
+/-- The fixed-point equation, fibrewise. -/
+theorem app_lfpFamSet_eq {w : Nat} {I F : V} (h : ∃ L, IsClosedFam w I F L)
+    (hmono : MonoFam w I F) (hmaps : MapsFam w I F) {i : V} (hi : i ∈ˢ I) :
+    app (app F (lfpFamSet w I F)) i = app (lfpFamSet w I F) i :=
+  Subset.antisymm (lfpFamSet_closed h hmono i hi) (lfpFamSet_fixed h hmono hmaps i hi)
+
+/-- The fixed-point equation. -/
+theorem lfpFamSet_eq {w : Nat} {I F : V} (h : ∃ L, IsClosedFam w I F L)
+    (hmono : MonoFam w I F) (hmaps : MapsFam w I F) :
+    app F (lfpFamSet w I F) = lfpFamSet w I F :=
+  famSpace_ext (hmaps _ (lfpFamSet_mem w I F)) (lfpFamSet_mem w I F)
+    fun _ hi => app_lfpFamSet_eq h hmono hmaps hi
+
+/-- **Structural induction**, fibrewise: a property closed under the
+functor on the carrier holds on the whole carrier. -/
+theorem lfpFamSet_induction {w : Nat} {I F : V} (h : ∃ L, IsClosedFam w I F L)
+    (hmono : MonoFam w I F) (P : V → V → Prop)
+    (hP : ∀ i, i ∈ˢ I → ∀ x,
+      x ∈ˢ app (app F (graph (fun i => sep (app (lfpFamSet w I F) i) (P i)) I)) i → P i x) :
+    ∀ i, i ∈ˢ I → ∀ x, x ∈ˢ app (lfpFamSet w I F) i → P i x := by
+  intro i hi x hx
+  have hSmem : graph (fun i => sep (app (lfpFamSet w I F) i) (P i)) I ∈ˢ famSpace w I :=
+    graph_mem_famSpace fun i hi => univ_sep_mem (famSpace_app (lfpFamSet_mem w I F) hi)
+  have hSle : FamLe I (graph (fun i => sep (app (lfpFamSet w I F) i) (P i)) I) (lfpFamSet w I F) := by
+    intro i hi y hy
+    rw [app_graph hi] at hy
+    exact (mem_sep.mp hy).1
+  have hS : IsClosedFam w I F (graph (fun i => sep (app (lfpFamSet w I F) i) (P i)) I) := by
+    refine ⟨hSmem, fun i hi y hy => ?_⟩
+    rw [app_graph hi, mem_sep]
+    refine ⟨?_, hP i hi y hy⟩
+    exact lfpFamSet_closed h hmono i hi y
+      (hmono _ _ hSmem (lfpFamSet_mem w I F) hSle i hi y hy)
+  have := lfpFamSet_le hS i hi x hx
+  rw [app_graph hi] at this
+  exact (mem_sep.mp this).2
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Omega.lean b/Ix/Theory/Model/SetTheory/Derive/Omega.lean
new file mode 100644
index 000000000..4eabed9d0
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Omega.lean
@@ -0,0 +1,142 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Omega.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Universe
+
+@[expose] public section
+
+/-!
+# Infinity, derived: the finite ordinals
+
+Infinity is derived from the universe chain + Replacement: an
+*inhabited* Grothendieck universe is an inductive *set* — it contains
+`∅` and is closed under the von Neumann successor `n ↦ n ∪ {n}`
+(von Neumann 1923) by the pairing/union closures — so `ω` can be
+separated out of one as the members of *every* inductive set.
+Leastness is then definitional.  The inductive universe used is
+`univChain 1`: it is inhabited by `univChain 0` (note `univChain 0`
+itself need not be — the empty set satisfies `IsTGUniverse`
+vacuously).
+
+`vnat : Nat → V` names the members of `ω` from the meta-level; every
+member of `ω` is a unique `vnat k` (`mem_omega_iff`, `vnat_inj`),
+which is what makes recursion on `ω` cheap in `Derive/Natrec.lean`.
+
+`ω` itself is a *member* of any universe that has the inductive
+universe `univChain 1` as a member — arranged for the tower in
+`Derive/Univ.lean`.  (Mere universehood does not suffice: `V_ω` is a
+Tarski universe without `ω`.)
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The von Neumann successor `n ∪ {n}`. -/
+noncomputable def vsucc (n : V) : V := binUnion n (sing n)
+
+theorem mem_vsucc {z n : V} : z ∈ˢ vsucc n ↔ z ∈ˢ n ∨ z = n := by
+  rw [vsucc, mem_binUnion, mem_sing]
+
+theorem self_mem_vsucc (n : V) : n ∈ˢ vsucc n := mem_vsucc.mpr (Or.inr rfl)
+
+theorem vsucc_ne_empty (n : V) : vsucc n ≠ empty :=
+  ne_empty_of_mem (self_mem_vsucc n)
+
+/-- An inductive set: contains `∅`, closed under the successor. -/
+def Inductive (I : V) : Prop :=
+  (empty : V) ∈ˢ I ∧ ∀ n, n ∈ˢ I → vsucc n ∈ˢ I
+
+/-- An inhabited Grothendieck universe is an inductive set. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.inductive_self {U y : V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hy : y ∈ˢ U) : Inductive U :=
+  ⟨hU.empty_mem hy, fun _n hn =>
+    hU.binUnion_mem hy hn (hU.sing_mem hy hn)⟩
+
+theorem univChain_one_inductive : Inductive (univChain 1 : V) :=
+  (univChain_tg 1).inductive_self (univChain_mem 0)
+
+/-- The finite ordinals: the members of every inductive set, separated
+from the inductive universe `univChain 1`. -/
+noncomputable def omega : V :=
+  sep (univChain 1) (fun n => ∀ I : V, Inductive I → n ∈ˢ I)
+
+theorem mem_omega {n : V} : n ∈ˢ (omega : V) ↔ ∀ I : V, Inductive I → n ∈ˢ I := by
+  rw [omega, mem_sep]
+  exact ⟨fun h => h.2, fun h => ⟨h _ univChain_one_inductive, h⟩⟩
+
+theorem omega_subset_inductive {I : V} (hI : Inductive I) : (omega : V) ⊆ˢ I :=
+  fun _ hn => mem_omega.mp hn I hI
+
+theorem omega_inductive : Inductive (omega : V) := by
+  constructor
+  · exact mem_omega.mpr fun I hI => hI.1
+  · intro n hn
+    exact mem_omega.mpr fun I hI => hI.2 n (mem_omega.mp hn I hI)
+
+theorem empty_mem_omega : (empty : V) ∈ˢ omega := omega_inductive.1
+
+theorem vsucc_mem_omega {n : V} (hn : n ∈ˢ (omega : V)) : vsucc n ∈ˢ (omega : V) :=
+  omega_inductive.2 n hn
+
+/-- The `k`-th von Neumann natural. -/
+noncomputable def vnat : Nat → V
+  | 0 => empty
+  | k + 1 => vsucc (vnat k)
+
+theorem vnat_mem_omega : ∀ k, (vnat k : V) ∈ˢ omega
+  | 0 => empty_mem_omega
+  | k + 1 => vsucc_mem_omega (vnat_mem_omega k)
+
+/-- Every finite ordinal is named by a meta-level natural. -/
+theorem mem_omega_iff {n : V} : n ∈ˢ (omega : V) ↔ ∃ k, n = vnat k := by
+  constructor
+  · intro hn
+    have hind : Inductive (sep (omega : V) (fun n => ∃ k, n = vnat k)) := by
+      constructor
+      · exact mem_sep.mpr ⟨empty_mem_omega, 0, rfl⟩
+      · intro m hm
+        obtain ⟨hmo, k, rfl⟩ := mem_sep.mp hm
+        exact mem_sep.mpr ⟨vsucc_mem_omega hmo, k + 1, rfl⟩
+    exact (mem_sep.mp (omega_subset_inductive hind n hn)).2
+  · rintro ⟨k, rfl⟩
+    exact vnat_mem_omega k
+
+theorem vnat_mem_vnat_of_lt : ∀ {k l : Nat}, k < l → (vnat k : V) ∈ˢ vnat l := by
+  intro k l hkl
+  induction l with
+  | zero => exact absurd hkl (Nat.not_lt_zero k)
+  | succ l ih =>
+    rcases Nat.lt_succ_iff_lt_or_eq.mp hkl with h | rfl
+    · exact mem_vsucc.mpr (Or.inl (ih h))
+    · exact self_mem_vsucc _
+
+theorem vnat_inj {k l : Nat} (h : (vnat k : V) = vnat l) : k = l := by
+  rcases Nat.lt_trichotomy k l with hlt | heq | hgt
+  · exact absurd (h ▸ vnat_mem_vnat_of_lt (V := V) hlt) (not_mem_self _)
+  · exact heq
+  · exact absurd (h ▸ vnat_mem_vnat_of_lt (V := V) hgt) (not_mem_self _)
+
+theorem omega_subset_univChain_one : (omega : V) ⊆ˢ univChain 1 := sep_subset
+
+/-- `ω` is a member of any universe having the inductive universe
+`univChain 1` as a member. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.omega_mem {U : V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (h1 : (univChain 1 : V) ∈ˢ U) :
+    (omega : V) ∈ˢ U :=
+  hU.mem_of_subset_mem h1 omega_subset_univChain_one
+
+/- Opaque interface operator (see `Derive/Empty.lean`).  `vsucc` stays
+reducible: `Derive/Natrec.lean` computes with it through `vnat`. -/
+attribute [irreducible] omega
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Pair.lean b/Ix/Theory/Model/SetTheory/Derive/Pair.lean
new file mode 100644
index 000000000..cdaf20257
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Pair.lean
@@ -0,0 +1,128 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Pair.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Sep
+
+@[expose] public section
+
+/-!
+# Singletons, binary unions, and Kuratowski ordered pairs
+
+Singleton and ordered pair are derived from the unordered pair — the
+Kuratowski pair `⟨a, b⟩ := {{a}, {a, b}}` (Kuratowski, Fund. Math. 2
+(1921)); binary union is the union of an unordered pair.  The payoff
+lemmas are the
+injectivity of the Kuratowski pair and the fact that an ordered pair is
+never `{∅}` — the tag that keeps the proof point `pt` apart from
+function graphs (`Derive/Pt.lean`, `Derive/Graphs.lean`).
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The singleton `{a}`. -/
+noncomputable def sing (a : V) : V := upair a a
+
+theorem mem_sing {z a : V} : z ∈ˢ sing a ↔ z = a := by
+  rw [sing, mem_upair]; exact ⟨fun h => h.elim id id, Or.inl⟩
+
+theorem sing_inj {a b : V} (h : sing a = sing b) : a = b :=
+  mem_sing.mp (h ▸ mem_sing.mpr rfl)
+
+theorem sUnion_sing (a : V) : sUnion (sing a) = a :=
+  ext fun z => by
+    rw [mem_sUnion]
+    constructor
+    · rintro ⟨y, hy, hz⟩; rwa [mem_sing.mp hy] at hz
+    · exact fun hz => ⟨a, mem_sing.mpr rfl, hz⟩
+
+/-- Binary union `a ∪ b := ⋃ {a, b}`. -/
+noncomputable def binUnion (a b : V) : V := sUnion (upair a b)
+
+theorem mem_binUnion {z a b : V} : z ∈ˢ binUnion a b ↔ z ∈ˢ a ∨ z ∈ˢ b := by
+  rw [binUnion, mem_sUnion]
+  constructor
+  · rintro ⟨y, hy, hz⟩
+    rcases mem_upair.mp hy with h | h <;> subst h
+    · exact Or.inl hz
+    · exact Or.inr hz
+  · rintro (hz | hz)
+    · exact ⟨a, mem_upair.mpr (Or.inl rfl), hz⟩
+    · exact ⟨b, mem_upair.mpr (Or.inr rfl), hz⟩
+
+/-- The Kuratowski ordered pair `⟨a, b⟩ = {{a}, {a, b}}`. -/
+noncomputable def kpair (a b : V) : V := upair (sing a) (upair a b)
+
+theorem upair_eq_sing {a b c : V} (h : upair a b = sing c) : a = c ∧ b = c := by
+  constructor
+  · exact mem_sing.mp (h ▸ mem_upair.mpr (Or.inl rfl))
+  · exact mem_sing.mp (h ▸ mem_upair.mpr (Or.inr rfl))
+
+theorem mem_upair_left (a b : V) : a ∈ˢ upair a b := mem_upair.mpr (Or.inl rfl)
+theorem mem_upair_right (a b : V) : b ∈ˢ upair a b := mem_upair.mpr (Or.inr rfl)
+
+theorem upair_comm (a b : V) : upair a b = upair b a :=
+  ext fun z => by rw [mem_upair, mem_upair]; exact Or.comm
+
+/-- First-component injectivity of the Kuratowski pair. -/
+theorem kpair_inj_left {a b c d : V} (h : kpair a b = kpair c d) : a = c := by
+  have hac : sing a ∈ˢ kpair c d := h ▸ mem_upair_left (sing a) (upair a b)
+  rcases mem_upair.mp hac with h1 | h1
+  · exact sing_inj h1
+  · -- `{a} = {c, d}`, so `c = a` (and `d = a`).
+    obtain ⟨hc, -⟩ := upair_eq_sing (h1.symm)
+    exact hc.symm
+
+theorem kpair_inj {a b c d : V} (h : kpair a b = kpair c d) : a = c ∧ b = d := by
+  obtain rfl : a = c := kpair_inj_left h
+  refine ⟨rfl, ?_⟩
+  -- `{a, b} ∈ {{a}, {a, d}}` and `{a, d} ∈ {{a}, {a, b}}`.
+  have hb : upair a b ∈ˢ kpair a d := by
+    rw [← h]; exact mem_upair_right _ _
+  have hd : upair a d ∈ˢ kpair a b := by
+    rw [h]; exact mem_upair_right _ _
+  rcases mem_upair.mp hb with h1 | h1
+  · -- `{a, b} = {a}`, so `b = a`; then `{a, d}` collapses too, so `d = a = b`.
+    obtain ⟨-, hba⟩ := upair_eq_sing h1
+    rcases mem_upair.mp hd with h2 | h2
+    · obtain ⟨-, hda⟩ := upair_eq_sing h2
+      exact hba.trans hda.symm
+    · -- `{a, d} = {a, b}`: `d` is `a` or `b`, and `b = a` closes both.
+      rcases mem_upair.mp (h2 ▸ mem_upair_right a d) with hda | hdb
+      · exact hba.trans hda.symm
+      · exact hdb.symm
+  · -- `{a, b} = {a, d}`: `b` is `a` or `d`.
+    rcases mem_upair.mp (h1 ▸ mem_upair_right a b) with hba | hbd
+    · -- `b = a`; then `d ∈ {a, d} = {a, b} = {a, a}`, so `d = a = b`.
+      rcases mem_upair.mp (h1.symm ▸ mem_upair_right a d) with hda | hdb
+      · exact hba.trans hda.symm
+      · exact hdb.symm
+    · exact hbd
+
+theorem kpair_ne_empty {a b : V} : kpair a b ≠ empty :=
+  ne_empty_of_mem (mem_upair_left (sing a) (upair a b))
+
+/-- Every member of a Kuratowski pair is nonempty — the fact that keeps
+`{∅}` (the proof point) out of the pair/graph world. -/
+theorem mem_kpair_nonempty {a b z : V} (hz : z ∈ˢ kpair a b) : ∃ w, w ∈ˢ z := by
+  rcases mem_upair.mp hz with h | h <;> subst h
+  · exact ⟨a, mem_sing.mpr rfl⟩
+  · exact ⟨a, mem_upair_left a b⟩
+
+theorem mem_sUnion_kpair_left (a b : V) : a ∈ˢ sUnion (kpair a b) :=
+  mem_sUnion.mpr ⟨sing a, mem_upair_left _ _, mem_sing.mpr rfl⟩
+
+theorem mem_sUnion_kpair_right (a b : V) : b ∈ˢ sUnion (kpair a b) :=
+  mem_sUnion.mpr ⟨upair a b, mem_upair_right _ _, mem_upair_right a b⟩
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Pt.lean b/Ix/Theory/Model/SetTheory/Derive/Pt.lean
new file mode 100644
index 000000000..4b6bc036a
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Pt.lean
@@ -0,0 +1,240 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Pt.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Universe
+
+@[expose] public section
+
+/-!
+# The proof point, truth values, `univ 0`, and `eqv`
+
+* `pt := {ptTag}` with `ptTag := {∅, {{∅}}}` — the tagged proof
+  point: the canonical inhabitant of every true proposition.  The tag
+  is chosen so that **no data-value encoding produces `pt`** (task
+  #109; the battery was `Derive/PtFresh.lean`, deleted at task #221 with
+the collapse it served).  Selection principle:
+  `pt` must be a singleton whose element (a) has an *empty* member —
+  so neither the tag nor `pt` is a Kuratowski pair, pair elements
+  being nonempty (the anti-pair tag `Derive/Graphs.lean` exploits, one
+  level up from the old `pt = {∅}`); (b) is *not a singleton* — else
+  `pt = {{a}} = kpair a a`, a writable pair value; (c) is not `∅` —
+  else `pt = {∅} = vnat 1`, a writable numeral (the old collision);
+  and (d) has members that **cohabit no writable type** — else `pt` is
+  a writable singleton quotient class (`{2}` = the class of
+  `Quot.mk (· = 2 ∧ · = 2) 2` killed the `{vnat 2}` candidate).
+  `ptTag`'s members `∅` and `{{∅}} = kpair ∅ ∅` live in `Nat` resp.
+  pair types only, and no writable type hosts both.
+* `unitSet := {pt}` — the true truth value, and the model of `PUnit`.
+* `univZero := power unitSet = {∅, {pt}}` — the set of truth values,
+  the `U₀ = {∅, {•}}` of Mario Carneiro, *The Type Theory of Lean*,
+  master's thesis, Carnegie Mellon University, 2019; stating it as a
+  power set makes
+  "members of `univ 0` are subsets of `{pt}`" definitional, and
+  propositional extensionality one application of `ext`.
+* `truthVal p` — the truth value of a meta-level proposition, `{pt}`
+  if `p` holds and `∅` otherwise (classical); `eqv x y` is
+  `truthVal (x = y)`.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The proof-point tag `{∅, {{∅}}}` (see the module docstring for the
+selection principle). -/
+noncomputable def ptTag : V := upair empty (sing (sing empty))
+
+theorem mem_ptTag {z : V} :
+    z ∈ˢ (ptTag : V) ↔ z = empty ∨ z = sing (sing empty) := mem_upair
+
+theorem empty_mem_ptTag : (empty : V) ∈ˢ ptTag :=
+  mem_ptTag.mpr (Or.inl rfl)
+
+theorem ptTag_ne_empty : (ptTag : V) ≠ empty :=
+  ne_empty_of_mem empty_mem_ptTag
+
+/-- The tag is not a singleton: its two members `∅` and `{{∅}}`
+differ.  (Blocks `pt = kpair a a = {{a}}`.) -/
+theorem ptTag_ne_sing (a : V) : (ptTag : V) ≠ sing a := by
+  intro h
+  obtain ⟨h1, h2⟩ := upair_eq_sing h
+  exact ne_empty_of_mem (mem_sing.mpr rfl) (h2.trans h1.symm)
+
+/-- The tag is not a Kuratowski pair: `∅` is among its members, while
+every member of a pair is nonempty. -/
+theorem ptTag_ne_kpair (a b : V) : (ptTag : V) ≠ kpair a b := by
+  intro h
+  obtain ⟨w, hw⟩ := mem_kpair_nonempty (h ▸ empty_mem_ptTag)
+  exact not_mem_empty w hw
+
+/-- The proof point `pt = {ptTag}`. -/
+noncomputable def pt : V := sing ptTag
+
+theorem mem_pt {z : V} : z ∈ˢ (pt : V) ↔ z = ptTag := mem_sing
+
+theorem ptTag_mem_pt : (ptTag : V) ∈ˢ pt := mem_pt.mpr rfl
+
+theorem pt_ne_empty : (pt : V) ≠ empty :=
+  ne_empty_of_mem ptTag_mem_pt
+
+/-- `pt` is not a Kuratowski pair: `pt` is a singleton, so the pair
+would be degenerate (`kpair a a = {{a}}`), forcing the tag to be the
+singleton `{a}` — which it is not. -/
+theorem pt_ne_kpair (a b : V) : (pt : V) ≠ kpair a b := by
+  intro h
+  obtain ⟨h1, -⟩ := upair_eq_sing h.symm
+  exact ptTag_ne_sing a h1.symm
+
+/-- `pt` is not a member of its own tag (blocks the two-step membership
+cycle `pt ∈ ptTag ∈ pt` that `not_mem_self` cannot see). -/
+theorem pt_not_mem_ptTag : ¬ (pt : V) ∈ˢ ptTag := by
+  intro h
+  rcases mem_ptTag.mp h with hpe | hps
+  · exact pt_ne_empty hpe
+  · have hm := ptTag_mem_pt (V := V)
+    rw [hps] at hm
+    exact ptTag_ne_sing empty (mem_sing.mp hm)
+
+/-- The canonical singleton `{pt}`: the true truth value. -/
+noncomputable def unitSet : V := sing pt
+
+theorem mem_unitSet_iff {z : V} : z ∈ˢ (unitSet : V) ↔ z = pt := mem_sing
+
+theorem pt_mem_unitSet : (pt : V) ∈ˢ unitSet := mem_unitSet_iff.mpr rfl
+
+theorem unitSet_ne_empty : (unitSet : V) ≠ empty :=
+  ne_empty_of_mem pt_mem_unitSet
+
+/-- The interpretation of `Sort 0`: the set `{∅, {pt}}` of truth
+values, stated as the power set of `{pt}`. -/
+noncomputable def univZero : V := power unitSet
+
+theorem mem_univZero {T : V} : T ∈ˢ (univZero : V) ↔ T ⊆ˢ unitSet :=
+  mem_power_iff_subset
+
+/-- Members of `univ 0` have at most the proof point as element. -/
+theorem eq_pt_of_mem_univZero {T x : V} (hT : T ∈ˢ (univZero : V))
+    (hx : x ∈ˢ T) : x = pt :=
+  mem_unitSet_iff.mp (mem_univZero.mp hT x hx)
+
+/-- Propositional extensionality: truth values with the same
+`pt`-membership are equal. -/
+theorem univZero_ext {A B : V} (hA : A ∈ˢ (univZero : V))
+    (hB : B ∈ˢ (univZero : V)) (hab : pt ∈ˢ A → pt ∈ˢ B)
+    (hba : pt ∈ˢ B → pt ∈ˢ A) : A = B :=
+  ext fun z =>
+    ⟨fun hz => by
+       have h := eq_pt_of_mem_univZero hA hz; subst h; exact hab hz,
+     fun hz => by
+       have h := eq_pt_of_mem_univZero hB hz; subst h; exact hba hz⟩
+
+open Classical in
+/-- The truth value of a meta-level proposition: `{pt}` if it holds,
+`∅` otherwise. -/
+noncomputable def truthVal (p : Prop) : V := if p then unitSet else empty
+
+theorem mem_truthVal {p : Prop} {z : V} :
+    z ∈ˢ (truthVal p : V) ↔ p ∧ z = pt := by
+  unfold truthVal
+  split
+  · next hp => exact ⟨fun hz => ⟨hp, mem_unitSet_iff.mp hz⟩, fun ⟨_, hz⟩ => hz ▸ pt_mem_unitSet⟩
+  · next hp =>
+    exact ⟨fun hz => absurd hz (not_mem_empty z), fun ⟨h, _⟩ => absurd h hp⟩
+
+theorem pt_mem_truthVal {p : Prop} (hp : p) : (pt : V) ∈ˢ truthVal p :=
+  mem_truthVal.mpr ⟨hp, rfl⟩
+
+theorem of_mem_truthVal {p : Prop} {z : V} (hz : z ∈ˢ (truthVal p : V)) : p :=
+  (mem_truthVal.mp hz).1
+
+theorem eq_pt_of_mem_truthVal {p : Prop} {z : V} (hz : z ∈ˢ (truthVal p : V)) :
+    z = pt :=
+  (mem_truthVal.mp hz).2
+
+theorem truthVal_eq_unitSet {p : Prop} (hp : p) : (truthVal p : V) = unitSet := by
+  unfold truthVal; exact if_pos hp
+
+theorem truthVal_eq_empty {p : Prop} (hp : ¬ p) : (truthVal p : V) = empty := by
+  unfold truthVal; exact if_neg hp
+
+/-- Truth values are `∅` or `{pt}` — never the point `{∅}` itself. -/
+theorem truthVal_ne_pt (p : Prop) : (truthVal p : V) ≠ pt := by
+  intro h
+  by_cases hp : p
+  · rw [truthVal_eq_unitSet hp] at h
+    have hm := pt_mem_unitSet (V := V)
+    rw [h] at hm
+    exact not_mem_self (pt : V) hm
+  · rw [truthVal_eq_empty hp] at h
+    exact pt_ne_empty h.symm
+
+theorem truthVal_congr {p q : Prop} (h : p ↔ q) :
+    (truthVal p : V) = truthVal q := by
+  rcases Classical.em p with hp | hp
+  · rw [truthVal_eq_unitSet hp, truthVal_eq_unitSet (h.mp hp)]
+  · rw [truthVal_eq_empty hp, truthVal_eq_empty (fun hq => hp (h.mpr hq))]
+
+theorem truthVal_mem_univZero (p : Prop) :
+    (truthVal p : V) ∈ˢ univZero := by
+  rcases Classical.em p with hp | hp
+  · rw [truthVal_eq_unitSet hp]
+    exact mem_univZero.mpr (Subset.refl _)
+  · rw [truthVal_eq_empty hp]
+    exact mem_univZero.mpr (empty_subset _)
+
+/-- Every member of `univ 0` is the truth value of its own
+inhabitedness. -/
+theorem mem_univZero_eq_truthVal {T : V} (hT : T ∈ˢ (univZero : V)) :
+    T = truthVal (pt ∈ˢ T) := by
+  rcases Classical.em ((pt : V) ∈ˢ T) with hp | hp
+  · rw [truthVal_eq_unitSet hp]
+    exact ext fun z => ⟨fun hz => eq_pt_of_mem_univZero hT hz ▸ pt_mem_unitSet,
+      fun hz => mem_unitSet_iff.mp hz ▸ hp⟩
+  · rw [truthVal_eq_empty hp]
+    exact eq_empty fun z hz => hp (eq_pt_of_mem_univZero hT hz ▸ hz)
+
+/-- The truth value of an equality. -/
+noncomputable def eqv (x y : V) : V := truthVal (x = y)
+
+theorem eqv_mem_univZero (x y : V) : eqv x y ∈ˢ (univZero : V) :=
+  truthVal_mem_univZero _
+
+theorem eq_of_mem_eqv {a x y : V} (h : a ∈ˢ eqv x y) : x = y :=
+  of_mem_truthVal h
+
+theorem pt_mem_eqv_self (x : V) : (pt : V) ∈ˢ eqv x x :=
+  pt_mem_truthVal rfl
+
+/-- `pt`, `unitSet`, `univZero` and truth values live in every
+(inhabited) Grothendieck universe. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.pt_mem {U y : V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hy : y ∈ˢ U) : (pt : V) ∈ˢ U :=
+  hU.sing_mem hy (hU.upair_mem hy (hU.empty_mem hy)
+    (hU.sing_mem hy (hU.sing_mem hy (hU.empty_mem hy))))
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.unitSet_mem {U y : V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hy : y ∈ˢ U) : (unitSet : V) ∈ˢ U :=
+  hU.sing_mem hy (hU.pt_mem hy)
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.univZero_mem {U y : V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hy : y ∈ˢ U) : (univZero : V) ∈ˢ U :=
+  hU.power_mem (hU.unitSet_mem hy)
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.truthVal_mem {U y : V}
+    (hU : IsTGUniverse (Mem (V := V)) U) (hy : y ∈ˢ U) (p : Prop) :
+    (truthVal p : V) ∈ˢ U :=
+  hU.transitive (hU.univZero_mem hy) (truthVal_mem_univZero p)
+
+/- Opaque interface operators (see `Derive/Empty.lean`). -/
+attribute [irreducible] ptTag pt unitSet eqv
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Quot.lean b/Ix/Theory/Model/SetTheory/Derive/Quot.lean
new file mode 100644
index 000000000..4e2355e72
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Quot.lean
@@ -0,0 +1,234 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Quot.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Univ
+
+@[expose] public section
+
+/-!
+# Quotients
+
+`quotSet u A R` is, for `u ≠ 0`, the set of equivalence classes of the
+equivalence closure of "`app (app R a) b` is inhabited" on `A` (classes
+by separation, the class set by replacement); for `u = 0` the base
+lives in `Prop`, everything collapses to the proof point, and the
+quotient is `image (fun _ => pt) A` — the truth value `[A inhabited]`.
+
+`quotLift` lifts `f` to the quotient as the graph of
+`q ↦ app f (representative of q)` (representatives by choice) — except
+when `f` is the proof point, where the lift is the proof point too.
+That tag is what makes the beta law `app (quotLift …) (quotClass … a) =
+app f a` hold with *no typing premise on `f`* (matching the interface):
+a `pt`-tagged `f` beta-reduces to `pt` on both sides, any other `f`
+goes through the representative and the invariance premise, with the
+`u = 0` collapse handled by `A ⊆ {pt}` (from `A ∈ univ 0`).
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The equivalence closure, on `A`, of "`app (app R a) b` is
+inhabited". -/
+inductive QuotRel (A R : V) : V → V → Prop where
+  | base {a b : V} : a ∈ˢ A → b ∈ˢ A → (∃ w, w ∈ˢ app (app R a) b) →
+      QuotRel A R a b
+  | refl {a : V} : a ∈ˢ A → QuotRel A R a a
+  | symm {a b : V} : QuotRel A R a b → QuotRel A R b a
+  | trans {a b c : V} : QuotRel A R a b → QuotRel A R b c → QuotRel A R a c
+
+theorem QuotRel.mem {A R a b : V} (h : QuotRel A R a b) : a ∈ˢ A ∧ b ∈ˢ A := by
+  induction h with
+  | base ha hb _ => exact ⟨ha, hb⟩
+  | refl ha => exact ⟨ha, ha⟩
+  | symm _ ih => exact ⟨ih.2, ih.1⟩
+  | trans _ _ ih₁ ih₂ => exact ⟨ih₁.1, ih₂.2⟩
+
+/-- The `QuotRel`-class of `a` in `A`. -/
+noncomputable def qclass (A R a : V) : V := sep A (fun b => QuotRel A R a b)
+
+theorem mem_qclass {A R a b : V} :
+    b ∈ˢ qclass A R a ↔ b ∈ˢ A ∧ QuotRel A R a b := mem_sep
+
+theorem self_mem_qclass {A R a : V} (ha : a ∈ˢ A) : a ∈ˢ qclass A R a :=
+  mem_qclass.mpr ⟨ha, QuotRel.refl ha⟩
+
+theorem qclass_eq_of_rel {A R a b : V} (h : QuotRel A R a b) :
+    qclass A R a = qclass A R b :=
+  ext fun z => by
+    rw [mem_qclass, mem_qclass]
+    exact ⟨fun ⟨hz, hr⟩ => ⟨hz, (h.symm).trans hr⟩,
+           fun ⟨hz, hr⟩ => ⟨hz, h.trans hr⟩⟩
+
+theorem rel_of_qclass_eq {A R a b : V} (ha : a ∈ˢ A) (_hb : b ∈ˢ A)
+    (h : qclass A R a = qclass A R b) : QuotRel A R a b :=
+  (mem_qclass.mp (h ▸ self_mem_qclass ha)).2.symm
+
+open Classical in
+/-- The quotient (see module docs). -/
+noncomputable def quotSet (u : Nat) (A R : V) : V :=
+  if u = 0 then image (fun _ => pt) A else image (fun a => qclass A R a) A
+
+open Classical in
+/-- The class of `a` in the quotient. -/
+noncomputable def quotClass (u : Nat) (A R a : V) : V :=
+  if u = 0 then pt else qclass A R a
+
+theorem quotClass_mem {u : Nat} {A R a : V} (ha : a ∈ˢ A) :
+    quotClass u A R a ∈ˢ quotSet u A R := by
+  unfold quotClass quotSet
+  split
+  · exact mem_image.mpr ⟨a, ha, rfl⟩
+  · exact mem_image.mpr ⟨a, ha, rfl⟩
+
+theorem quotClass_surj {u : Nat} {A R q : V} (hq : q ∈ˢ quotSet u A R) :
+    ∃ a, a ∈ˢ A ∧ q = quotClass u A R a := by
+  unfold quotSet at hq
+  unfold quotClass
+  split at hq
+  · next h =>
+    obtain ⟨a, ha, rfl⟩ := mem_image.mp hq
+    exact ⟨a, ha, (if_pos h).symm⟩
+  · next h =>
+    obtain ⟨a, ha, rfl⟩ := mem_image.mp hq
+    exact ⟨a, ha, (if_neg h).symm⟩
+
+/-- A class formed at ONE pair of parameters that lands in the quotient
+of ANOTHER: its representative lies in the second parameter's carrier,
+and the class is the second quotient's class of that same
+representative.  Nothing relates the two parameter pairs — at a positive
+level the first class is a `qclass` of the second's, and at level zero
+both classes are the point and the second carrier is inhabited because
+the quotient is. -/
+theorem quotClass_of_mem_quotSet {u : Nat} {Aset R A' R' a : V}
+    (hAset : Aset ∈ˢ (univ u : V)) (hA' : A' ∈ˢ (univ u : V)) (ha : a ∈ˢ A')
+    (hmem : quotClass u A' R' a ∈ˢ quotSet u Aset R) :
+    a ∈ˢ Aset ∧ quotClass u A' R' a = quotClass u Aset R a := by
+  obtain ⟨b, hb, hcls⟩ := quotClass_surj hmem
+  by_cases hu : u = 0
+  · subst hu
+    refine ⟨?_, by unfold quotClass; rw [if_pos rfl, if_pos rfl]⟩
+    rw [univ_zero] at hA' hAset
+    rw [eq_pt_of_mem_univZero hA' ha, ← eq_pt_of_mem_univZero hAset hb]
+    exact hb
+  · unfold quotClass at hcls ⊢
+    rw [if_neg hu, if_neg hu] at hcls
+    rw [if_neg hu, if_neg hu]
+    have hab : a ∈ˢ qclass Aset R b := by rw [← hcls]; exact self_mem_qclass ha
+    obtain ⟨haA, hrel⟩ := mem_qclass.mp hab
+    exact ⟨haA, hcls.trans (qclass_eq_of_rel hrel)⟩
+
+theorem quotSound {u : Nat} {A R a b w : V} (ha : a ∈ˢ A) (hb : b ∈ˢ A)
+    (hw : w ∈ˢ app (app R a) b) : quotClass u A R a = quotClass u A R b := by
+  unfold quotClass
+  split
+  · rfl
+  · exact qclass_eq_of_rel (QuotRel.base ha hb ⟨w, hw⟩)
+
+theorem quotSet_mem_univ {u : Nat} {A R : V} (hA : A ∈ˢ (univ u : V)) :
+    quotSet u A R ∈ˢ (univ u : V) := by
+  unfold quotSet
+  split
+  · next h =>
+    subst h
+    rw [univ_zero]
+    refine mem_univZero.mpr fun z hz => ?_
+    obtain ⟨-, -, rfl⟩ := mem_image.mp hz
+    exact pt_mem_unitSet
+  · next h =>
+    refine (univ_isTGUniverse h).mem_of_subset_mem
+      ((univ_isTGUniverse h).power_mem hA) fun z hz => ?_
+    obtain ⟨a, -, rfl⟩ := mem_image.mp hz
+    exact mem_power.mpr fun w hw => (mem_qclass.mp hw).1
+
+open Classical in
+/-- A representative of a quotient class, by choice. -/
+noncomputable def qrep (u : Nat) (A R q : V) : V :=
+  if h : ∃ a, a ∈ˢ A ∧ q = quotClass u A R a then Classical.choose h else empty
+
+theorem qrep_spec {u : Nat} {A R q : V} (hq : q ∈ˢ quotSet u A R) :
+    qrep u A R q ∈ˢ A ∧ q = quotClass u A R (qrep u A R q) := by
+  unfold qrep
+  rw [dif_pos (quotClass_surj hq)]
+  exact Classical.choose_spec (quotClass_surj hq)
+
+/-- The invariance premise extends from the base relation to its
+equivalence closure. -/
+theorem app_eq_of_rel {A R f a b : V}
+    (hinv : ∀ a' b', a' ∈ˢ A → b' ∈ˢ A → (∃ w, w ∈ˢ app (app R a') b') →
+      app f a' = app f b')
+    (h : QuotRel A R a b) : app f a = app f b := by
+  induction h with
+  | base ha hb hw => exact hinv _ _ ha hb hw
+  | refl _ => rfl
+  | symm _ ih => exact ih.symm
+  | trans _ _ ih₁ ih₂ => exact ih₁.trans ih₂
+
+/-- Equal classes have equal `f`-values: by closure invariance at
+`u ≠ 0`, and by the `A ⊆ {pt}` collapse at `u = 0`. -/
+theorem app_eq_of_quotClass_eq {u : Nat} {A R f a b : V}
+    (hA : A ∈ˢ (univ u : V)) (ha : a ∈ˢ A) (hb : b ∈ˢ A)
+    (hinv : ∀ a' b', a' ∈ˢ A → b' ∈ˢ A → (∃ w, w ∈ˢ app (app R a') b') →
+      app f a' = app f b')
+    (hq : quotClass u A R a = quotClass u A R b) : app f a = app f b := by
+  unfold quotClass at hq
+  split at hq
+  · next h =>
+    subst h
+    rw [univ_zero] at hA
+    rw [eq_pt_of_mem_univZero hA ha, eq_pt_of_mem_univZero hA hb]
+  · exact app_eq_of_rel hinv (rel_of_qclass_eq ha hb hq)
+
+/-! ## pt-freshness refutation evidence (task #109)
+
+Quotient types are **not** unconditionally pt-fresh, for *any*
+constructible proof point: classes are arbitrary nonempty subsets of
+the base, so with base `ptTag` itself and a total relation the class
+set is exactly `{ptTag} = pt`.  Never resurrect a `quotSet_ne_pt`; the
+#109 syntactic freshness guards exclude `Quot`-typed slots instead.
+(The base `ptTag` is not the interpretation of any *writable* type —
+the obstruction is semantic, in the ∀-A-R quantification of the model
+lemmas.  The old `pt = {∅}` was the unique choice immune to this — the
+empty set is never a class — which is exactly what the re-choice
+trades for data freshness.) -/
+
+theorem quotSet_eq_pt_countermodel :
+    ∃ A R : V, quotSet 1 A R = pt := by
+  refine ⟨ptTag, graph (fun _ => graph (fun _ => unitSet) ptTag) ptTag, ?_⟩
+  have hrel : ∀ a b : V, a ∈ˢ (ptTag : V) → b ∈ˢ (ptTag : V) →
+      QuotRel ptTag (graph (fun _ => graph (fun _ => unitSet) ptTag) ptTag)
+        a b := by
+    intro a b ha hb
+    refine QuotRel.base ha hb ⟨pt, ?_⟩
+    rw [app_graph ha, app_graph hb]
+    exact pt_mem_unitSet
+  have hclass : ∀ a : V, a ∈ˢ (ptTag : V) →
+      qclass ptTag (graph (fun _ => graph (fun _ => unitSet) ptTag) ptTag) a
+        = ptTag := by
+    intro a ha
+    apply ext fun z => ?_
+    rw [mem_qclass]
+    exact ⟨fun h => h.1, fun hz => ⟨hz, hrel a z ha hz⟩⟩
+  unfold quotSet
+  rw [if_neg Nat.one_ne_zero]
+  apply ext fun z => ?_
+  rw [mem_image, mem_pt]
+  constructor
+  · rintro ⟨a, ha, rfl⟩
+    exact hclass a ha
+  · rintro rfl
+    exact ⟨empty, empty_mem_ptTag, (hclass empty empty_mem_ptTag).symm⟩
+
+/- Opaque interface operators (see `Derive/Empty.lean`). -/
+attribute [irreducible] quotSet quotClass
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Sep.lean b/Ix/Theory/Model/SetTheory/Derive/Sep.lean
new file mode 100644
index 000000000..71f78d3f0
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Sep.lean
@@ -0,0 +1,74 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Sep.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Empty
+
+@[expose] public section
+
+/-!
+# Separation, derived from replacement
+
+The classical trick: to separate `{x ∈ a : p x}`, either the result is
+empty (take `empty`), or some witness `w₀ ∈ a` with `p w₀` exists and
+the total function `x ↦ if p x then x else w₀` replaces `a` onto
+exactly the separated set (the default value `w₀` is already a member
+of it).  The detour is forced because replacement's antecedent demands
+totality.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+open Classical in
+/-- Separation: `{x ∈ a : p x}`, for an arbitrary meta-level predicate. -/
+noncomputable def sep (a : V) (p : V → Prop) : V :=
+  if h : ∃ x, x ∈ˢ a ∧ p x then
+    image (fun x => if p x then x else Classical.choose h) a
+  else empty
+
+theorem mem_sep {a z : V} {p : V → Prop} : z ∈ˢ sep a p ↔ z ∈ˢ a ∧ p z := by
+  unfold sep
+  split
+  · next h =>
+    obtain ⟨hw₀a, hw₀p⟩ := Classical.choose_spec h
+    rw [mem_image]
+    constructor
+    · rintro ⟨w, hw, rfl⟩
+      split
+      · next hpw => exact ⟨hw, hpw⟩
+      · exact ⟨hw₀a, hw₀p⟩
+    · rintro ⟨hz, hp⟩
+      exact ⟨z, hz, by simp [hp]⟩
+  · next h =>
+    constructor
+    · intro hz; exact absurd hz (not_mem_empty z)
+    · intro ⟨hz, hp⟩; exact absurd ⟨z, hz, hp⟩ h
+
+theorem sep_subset {a : V} {p : V → Prop} : sep a p ⊆ˢ a :=
+  fun _ hz => (mem_sep.mp hz).1
+
+theorem sep_congr {a : V} {p q : V → Prop} (h : ∀ x, x ∈ˢ a → (p x ↔ q x)) :
+    sep a p = sep a q :=
+  ext fun z => by
+    rw [mem_sep, mem_sep]
+    exact ⟨fun ⟨hz, hp⟩ => ⟨hz, (h z hz).mp hp⟩, fun ⟨hz, hq⟩ => ⟨hz, (h z hz).mpr hq⟩⟩
+
+/-- Image congruence, the companion fact. -/
+theorem image_congr {a : V} {f g : V → V} (h : ∀ x, x ∈ˢ a → f x = g x) :
+    image f a = image g a :=
+  ext fun z => by
+    rw [mem_image, mem_image]
+    exact ⟨fun ⟨w, hw, hz⟩ => ⟨w, hw, hz.trans (h w hw)⟩,
+           fun ⟨w, hw, hz⟩ => ⟨w, hw, hz.trans (h w hw).symm⟩⟩
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Sigma.lean b/Ix/Theory/Model/SetTheory/Derive/Sigma.lean
new file mode 100644
index 000000000..5bbcd9e6f
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Sigma.lean
@@ -0,0 +1,158 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Sigma.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Univ
+
+@[expose] public section
+
+/-!
+# Dependent pairs, with the level-0 truncation
+
+`sigmaSet w A B` is, for `w ≠ 0`, the raw pair set `sigmaPairs A B`
+(Kuratowski pairs `⟨a, b⟩` with `a ∈ A`, `b ∈ B a`); for `w = 0` the
+truth value `[∃ a ∈ A, B a inhabited]` (the `Prop` collapse).
+
+`spair` is the Kuratowski pair; `sfst`/`ssnd` extract the components
+classically (well-defined by `kpair_inj`) and default to `pt` on
+non-pairs — in particular on `pt` itself, which is never a pair, so
+`sfst pt = ssnd pt = pt` holds by the tag.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+open Classical in
+/-- Dependent pair set at level `w` (see module docs). -/
+noncomputable def sigmaSet (w : Nat) (A : V) (B : V → V) : V :=
+  if w = 0 then truthVal (∃ x, x ∈ˢ A ∧ ∃ y, y ∈ˢ B x) else sigmaPairs A B
+
+/-- Pairing: the Kuratowski pair. -/
+noncomputable def spair (a b : V) : V := kpair a b
+
+open Classical in
+/-- First projection, `pt` on non-pairs. -/
+noncomputable def sfst (p : V) : V :=
+  if h : ∃ a b, p = kpair a b then Classical.choose h else pt
+
+open Classical in
+/-- Second projection, `pt` on non-pairs. -/
+noncomputable def ssnd (p : V) : V :=
+  if h : ∃ a b, p = kpair a b then Classical.choose (Classical.choose_spec h)
+  else pt
+
+theorem sigmaSet_zero {A : V} {B : V → V} :
+    sigmaSet 0 A B = truthVal (∃ x, x ∈ˢ A ∧ ∃ y, y ∈ˢ B x) := by
+  unfold sigmaSet; exact if_pos rfl
+
+theorem sigmaSet_pos {w : Nat} (hw : w ≠ 0) {A : V} {B : V → V} :
+    sigmaSet w A B = sigmaPairs A B := by
+  unfold sigmaSet; exact if_neg hw
+
+theorem sigma_congr {w : Nat} {A : V} {B B' : V → V}
+    (h : ∀ x, x ∈ˢ A → B x = B' x) : sigmaSet w A B = sigmaSet w A B' := by
+  rcases Nat.eq_zero_or_pos w with rfl | hw
+  · rw [sigmaSet_zero, sigmaSet_zero]
+    refine truthVal_congr ⟨?_, ?_⟩
+    · rintro ⟨x, hx, y, hy⟩; exact ⟨x, hx, y, h x hx ▸ hy⟩
+    · rintro ⟨x, hx, y, hy⟩; exact ⟨x, hx, y, (h x hx).symm ▸ hy⟩
+  · rw [sigmaSet_pos (Nat.pos_iff_ne_zero.mp hw), sigmaSet_pos (Nat.pos_iff_ne_zero.mp hw)]
+    exact sigmaPairs_congr h
+
+theorem spair_mem {w : Nat} {A : V} {B : V → V} {a b : V} (hw : w ≠ 0)
+    (ha : a ∈ˢ A) (hb : b ∈ˢ B a) : spair a b ∈ˢ sigmaSet w A B := by
+  rw [sigmaSet_pos hw]
+  exact mem_sigmaPairs.mpr ⟨a, ha, b, hb, rfl⟩
+
+theorem pt_mem_sigma {A : V} {B : V → V} {a b : V}
+    (ha : a ∈ˢ A) (hb : b ∈ˢ B a) : (pt : V) ∈ˢ sigmaSet 0 A B := by
+  rw [sigmaSet_zero]
+  exact pt_mem_truthVal ⟨a, ha, b, hb⟩
+
+theorem mem_sigma_elim {w : Nat} {A : V} {B : V → V} {t : V}
+    (ht : t ∈ˢ sigmaSet w A B) :
+    ∃ a b, a ∈ˢ A ∧ b ∈ˢ B a ∧ (w = 0 → t = pt) ∧ (w ≠ 0 → t = spair a b) := by
+  rcases Nat.eq_zero_or_pos w with rfl | hw
+  · rw [sigmaSet_zero] at ht
+    obtain ⟨a, ha, b, hb⟩ := of_mem_truthVal ht
+    exact ⟨a, b, ha, hb, fun _ => eq_pt_of_mem_truthVal ht, fun h0 => absurd rfl h0⟩
+  · have hw' : w ≠ 0 := Nat.pos_iff_ne_zero.mp hw
+    rw [sigmaSet_pos hw'] at ht
+    obtain ⟨a, ha, b, hb, rfl⟩ := mem_sigmaPairs.mp ht
+    exact ⟨a, b, ha, hb, fun h0 => absurd h0 hw', fun _ => rfl⟩
+
+theorem sfst_spair (a b : V) : sfst (spair a b) = a := by
+  unfold sfst spair
+  rw [dif_pos ⟨a, b, rfl⟩]
+  have hs := Classical.choose_spec
+    (⟨a, b, rfl⟩ : ∃ a' b', (kpair a b : V) = kpair a' b')
+  have hs2 := Classical.choose_spec hs
+  exact (kpair_inj hs2).1.symm
+
+theorem ssnd_spair (a b : V) : ssnd (spair a b) = b := by
+  unfold ssnd spair
+  rw [dif_pos ⟨a, b, rfl⟩]
+  have hs := Classical.choose_spec
+    (⟨a, b, rfl⟩ : ∃ a' b', (kpair a b : V) = kpair a' b')
+  have hs2 := Classical.choose_spec hs
+  exact (kpair_inj hs2).2.symm
+
+theorem spair_eq_kpair (a b : V) : spair a b = kpair a b := by unfold spair; rfl
+theorem sfst_kpair (a b : V) : sfst (kpair a b) = a := by rw [← spair_eq_kpair]; exact sfst_spair a b
+theorem ssnd_kpair (a b : V) : ssnd (kpair a b) = b := by rw [← spair_eq_kpair]; exact ssnd_spair a b
+
+theorem sfst_pt : sfst (pt : V) = pt := by
+  unfold sfst
+  rw [dif_neg]
+  rintro ⟨a, b, h⟩
+  exact pt_ne_kpair a b h
+
+theorem ssnd_pt : ssnd (pt : V) = pt := by
+  unfold ssnd
+  rw [dif_neg]
+  rintro ⟨a, b, h⟩
+  exact pt_ne_kpair a b h
+
+/-- A pair set is never the proof point: at level `0` it is a truth
+value, at positive levels its members are Kuratowski pairs while `pt`'s
+one member is `∅`.  (The collapse-era replacement for tag-based
+non-`pt`-ness of stored pair-set values, task #100.) -/
+theorem sigmaSet_ne_pt {w : Nat} {A : V} {B : V → V} :
+    sigmaSet w A B ≠ (pt : V) := by
+  rcases Nat.eq_zero_or_pos w with rfl | hw
+  · rw [sigmaSet_zero]
+    exact truthVal_ne_pt _
+  · rw [sigmaSet_pos (Nat.pos_iff_ne_zero.mp hw)]
+    intro h
+    have hmem : (ptTag : V) ∈ˢ sigmaPairs A B := by
+      rw [h]
+      exact ptTag_mem_pt
+    obtain ⟨a, -, b, -, hp⟩ := mem_sigmaPairs.mp hmem
+    exact ptTag_ne_kpair a b hp
+
+/-- Formation along the tower, at the joint level `max u v`. -/
+theorem sigma_mem_univ {u v : Nat} {A : V} {B : V → V}
+    (hA : A ∈ˢ (univ u : V)) (hB : ∀ x, x ∈ˢ A → B x ∈ˢ (univ v : V)) :
+    sigmaSet (Nat.max u v) A B ∈ˢ (univ (Nat.max u v) : V) := by
+  rcases Nat.eq_zero_or_pos (Nat.max u v) with hw | hw
+  · rw [hw, sigmaSet_zero, univ_zero]
+    exact truthVal_mem_univZero _
+  · have hw' : Nat.max u v ≠ 0 := Nat.pos_iff_ne_zero.mp hw
+    rw [sigmaSet_pos hw']
+    exact (univ_isTGUniverse hw').sigmaPairs_mem
+      (univ_mono (Nat.le_max_left u v) A hA)
+      (fun x hx => univ_mono (Nat.le_max_right u v) _ (hB x hx))
+
+/- Opaque interface operators (see `Derive/Empty.lean`). -/
+attribute [irreducible] sigmaSet spair sfst ssnd
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Univ.lean b/Ix/Theory/Model/SetTheory/Derive/Univ.lean
new file mode 100644
index 000000000..75b8523cf
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Univ.lean
@@ -0,0 +1,110 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Univ.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Graphs
+public import Ix.Theory.Model.SetTheory.Derive.Omega
+
+@[expose] public section
+
+/-!
+# The universe tower
+
+`univ 0` is the set of truth values (`univZero`, the `U₀` of Mario
+Carneiro, *The Type Theory of Lean*, master's thesis, Carnegie Mellon
+University, 2019);
+`univ (n+1)` is the chain universe `univChain (n+2)`.  The tower
+starts two levels up the chain so that every positive level has the
+inductive set `univChain 1` as a member — which is what puts `ω`
+inside every positive level (a bare universe need not contain `ω`;
+`V_ω` is one — and `univChain 0` need not be inhabited, the empty set
+satisfying `IsTGUniverse` vacuously, so `univChain 1` is the first chain
+member known to be inductive).  `univ 0 ∈ univ 1` because `univZero`
+is built from `∅` by pairing/power closure inside the inhabited
+universe `univChain 1 ∈ univChain 2`.  Cumulativity holds because
+positive levels are transitive and each level is a member of the
+next.
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+/-- The universe tower interpreting `Sort n`. -/
+noncomputable def univ : Nat → V
+  | 0 => univZero
+  | n + 1 => univChain (n + 2)
+
+theorem univ_zero : (univ 0 : V) = univZero := by rfl
+
+/-- Positive levels are Grothendieck universes. -/
+theorem univ_isTGUniverse {n : Nat} (hn : n ≠ 0) :
+    IsTGUniverse (Mem (V := V)) (univ n) := by
+  match n, hn with
+  | m + 1, _ => exact univChain_tg _
+
+theorem univChain_one_mem_univ_succ (n : Nat) :
+    (univChain 1 : V) ∈ˢ univ (n + 1) :=
+  univChain_mem_of_lt (Nat.succ_lt_succ n.succ_pos)
+
+theorem univ_mem_univ (n : Nat) : (univ n : V) ∈ˢ univ (n + 1) := by
+  match n with
+  | 0 =>
+    exact (univChain_tg 2).transitive (univChain_mem 1)
+      ((univChain_tg 1).univZero_mem (univChain_mem 0))
+  | m + 1 => exact univChain_mem (m + 2)
+
+theorem univ_subset_succ (n : Nat) : (univ n : V) ⊆ˢ univ (n + 1) :=
+  (univ_isTGUniverse (Nat.succ_ne_zero n)).subset_of_mem (univ_mem_univ n)
+
+theorem univ_mono {m n : Nat} (h : m ≤ n) : (univ m : V) ⊆ˢ univ n := by
+  induction n with
+  | zero => cases Nat.le_zero.mp h; exact Subset.refl _
+  | succ n ih =>
+    rcases Nat.lt_succ_iff_lt_or_eq.mp (Nat.lt_succ_of_le h) with h' | rfl
+    · exact (ih (Nat.lt_succ_iff.mp h')).trans (univ_subset_succ n)
+    · exact Subset.refl _
+
+/-- **The universe tower is injective.**  `univ u ∈ˢ univ (u+1) ⊆ˢ univ v`
+whenever `u < v`, so an equality of two levels' universes would put a set
+inside itself, against regularity (`not_mem_self`).
+
+Note what this does *not* say, and what nothing can: the tower is
+**cumulative** (`univ_mono`), so a *membership* `x ∈ˢ univ u` fixes only
+a lower bound on `u` and two memberships of one value never determine a
+level.  Injectivity of `univ` itself is the only handle on levels the
+tower offers, and every consumer that needs "the sort is `u`" has to
+reach it through an equality of universes, not through a typing. -/
+theorem univ_inj {u v : Nat} (h : (univ u : V) = univ v) : u = v := by
+  rcases Nat.lt_trichotomy u v with hlt | heq | hgt
+  · exact absurd (h ▸ univ_mono (V := V) hlt _ (univ_mem_univ u))
+      (not_mem_self (univ v : V))
+  · exact heq
+  · exact absurd (h ▸ univ_mono (V := V) hgt _ (univ_mem_univ v))
+      (not_mem_self (univ u : V))
+
+theorem omega_mem_univ_succ (n : Nat) : (omega : V) ∈ˢ univ (n + 1) :=
+  (univ_isTGUniverse (Nat.succ_ne_zero n)).omega_mem (univChain_one_mem_univ_succ n)
+
+theorem empty_mem_univ : ∀ n : Nat, (empty : V) ∈ˢ univ n
+  | 0 => mem_univZero.mpr (empty_subset _)
+  | n + 1 =>
+    (univ_isTGUniverse (Nat.succ_ne_zero n)).empty_mem (univChain_one_mem_univ_succ n)
+
+theorem unitSet_mem_univ : ∀ n : Nat, (unitSet : V) ∈ˢ univ n
+  | 0 => mem_univZero.mpr (Subset.refl _)
+  | n + 1 =>
+    (univ_isTGUniverse (Nat.succ_ne_zero n)).unitSet_mem (univChain_one_mem_univ_succ n)
+
+/- Opaque interface operator (see `Derive/Empty.lean`). -/
+attribute [irreducible] univ
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/SetTheory/Derive/Universe.lean b/Ix/Theory/Model/SetTheory/Derive/Universe.lean
new file mode 100644
index 000000000..6ae805d1f
--- /dev/null
+++ b/Ix/Theory/Model/SetTheory/Derive/Universe.lean
@@ -0,0 +1,175 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source: ConLeche/SetTheory/Derive/Universe.lean
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespace and import paths adapted to Ix.Theory.Model.
+-/
+
+module
+
+public import Ix.Theory.Model.SetTheory.Derive.Pair
+
+@[expose] public section
+
+/-!
+# Grothendieck universes: the diagonal argument and the closure laws
+
+The engine room, recovering the Grothendieck-universe closure laws
+(SGA 4, Exp. I, Appendix) from the Axiom-A matrix `IsTGUniverse`
+(Tarski 1938) — applied downstream to the chain members `univChain n`.
+The inaccessibility clause offers, for any subset `S ⊆ u`, the
+disjunction `S ≈ u ∨ S ∈ u`; the single lemma `covered_mem` turns it
+into a closure property by refuting the first disjunct with Cantor's
+diagonal whenever `S` is covered by a function from a *member* of `u`.
+Everything else — pairing, power, binary union, replacement images,
+`⋃` of a member — reduces to it (`⋃` via a two-step surjection
+argument ending in a membership 2-cycle).
+-/
+
+namespace Ix.Theory.Model.SetTheory
+
+universe u
+
+variable {V : Type u} [SetTheory V]
+
+section IsTGUniverse
+
+variable {U : V} (hU : IsTGUniverse (Mem (V := V)) U)
+
+include hU
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.transitive : ∀ {y z : V}, y ∈ˢ U → z ∈ˢ y → z ∈ˢ U :=
+  fun {y z} hy hz => hU.1 y z hy hz
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.mem_of_subset_mem : ∀ {y z : V}, y ∈ˢ U → z ⊆ˢ y → z ∈ˢ U :=
+  fun {y z} hy hz => hU.2.1 y z hy hz
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.subset_of_mem {y : V} (hy : y ∈ˢ U) : y ⊆ˢ U :=
+  fun _ hz => hU.transitive hy hz
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.power_mem {y : V} (hy : y ∈ˢ U) : power y ∈ˢ U := by
+  obtain ⟨p, hp, hsub⟩ := hU.2.2.1 y hy
+  exact hU.mem_of_subset_mem hp fun z hz => hsub z (mem_power.mp hz)
+
+/-- Cantor's diagonal, in the form everything downstream uses: a subset
+of `U` covered by the image of a *member* of `U` is itself a member.
+The equinumerosity disjunct is refuted by diagonalizing the covering
+composed with the would-be surjection onto `U`. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.covered_mem {I S : V} {F : V → V}
+    (hI : I ∈ˢ U) (hS : S ⊆ˢ U)
+    (hcov : ∀ b, b ∈ˢ S → ∃ x, x ∈ˢ I ∧ F x = b) : S ∈ˢ U := by
+  rcases hU.2.2.2 S hS with ⟨f, -, -, hsurj⟩ | hmem
+  · -- `f : S ↠ U`; diagonalize `x ↦ f (F x) : I ↠ U` at
+    -- `D := {x ∈ I : x ∉ f (F x)}`.
+    exfalso
+    have hDU : sep I (fun x => ¬ x ∈ˢ f (F x)) ∈ˢ U :=
+      hU.mem_of_subset_mem hI sep_subset
+    obtain ⟨b, hbS, hfb⟩ := hsurj _ hDU
+    obtain ⟨j, hjI, hFj⟩ := hcov b hbS
+    have hGj : f (F j) = sep I (fun x => ¬ x ∈ˢ f (F x)) := by rw [hFj, hfb]
+    have hiff : j ∈ˢ sep I (fun x => ¬ x ∈ˢ f (F x)) ↔
+        ¬ j ∈ˢ sep I (fun x => ¬ x ∈ˢ f (F x)) := by
+      constructor
+      · intro hj
+        have := (mem_sep.mp hj).2
+        rwa [hGj] at this
+      · intro hn
+        exact mem_sep.mpr ⟨hjI, by rwa [hGj]⟩
+    rcases Classical.em (j ∈ˢ sep I (fun x => ¬ x ∈ˢ f (F x))) with hj | hj
+    · exact hiff.mp hj hj
+    · exact hj (hiff.mpr hj)
+  · exact hmem
+
+/-- Replacement closure: the image of a member under a fibre-wise
+member-valued function is a member. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.image_mem {A : V} {F : V → V}
+    (hA : A ∈ˢ U) (hF : ∀ x, x ∈ˢ A → F x ∈ˢ U) : image F A ∈ˢ U :=
+  hU.covered_mem hA
+    (fun z hz => by
+      obtain ⟨w, hw, rfl⟩ := mem_image.mp hz
+      exact hF w hw)
+    (fun b hb => by
+      obtain ⟨w, hw, rfl⟩ := mem_image.mp hb
+      exact ⟨w, hw, rfl⟩)
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.empty_mem {y : V} (hy : y ∈ˢ U) : (empty : V) ∈ˢ U :=
+  hU.mem_of_subset_mem hy (empty_subset y)
+
+open Classical in
+/-- Pairing closure, via `covered_mem` from the two-element member
+`power (power ∅) = {∅, {∅}}`. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.upair_mem {a b y : V} (hy : y ∈ˢ U)
+    (ha : a ∈ˢ U) (hb : b ∈ˢ U) : upair a b ∈ˢ U := by
+  have h2 : power (power (empty : V)) ∈ˢ U :=
+    (hU.empty_mem hy |> hU.power_mem) |> hU.power_mem
+  refine hU.covered_mem (F := fun x => if x = empty then a else b) h2 ?_ ?_
+  · intro z hz
+    rcases mem_upair.mp hz with h | h <;> subst h <;> assumption
+  · intro z hz
+    rcases mem_upair.mp hz with h | h <;> subst h
+    · exact ⟨empty, mem_power.mpr (empty_subset _), by simp⟩
+    · refine ⟨power empty, mem_power.mpr (Subset.refl _), ?_⟩
+      have hne : power (empty : V) ≠ empty :=
+        ne_empty_of_mem (mem_power.mpr (Subset.refl _))
+      simp [hne]
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.sing_mem {a y : V} (hy : y ∈ˢ U) (ha : a ∈ˢ U) :
+    sing a ∈ˢ U := hU.upair_mem hy ha ha
+
+/-- `⋃` closure.  A surjection `f : ⋃s ↠ U` would make `U` the union
+of the member `S = {f-image of w : w ∈ s}`, putting `S ∈ U ⊆ ⋃S` — a
+2-cycle. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.sUnion_mem {s : V} (hs : s ∈ˢ U) : sUnion s ∈ˢ U := by
+  have hsub : sUnion s ⊆ˢ U := fun z hz => by
+    obtain ⟨y, hy, hzy⟩ := mem_sUnion.mp hz
+    exact hU.transitive (hU.transitive hs hy) hzy
+  rcases hU.2.2.2 (sUnion s) hsub with ⟨f, hinto, -, hsurj⟩ | hmem
+  · exfalso
+    -- For each `w ∈ s`, the `f`-image of `w` is a member of `U` …
+    have himg : ∀ w, w ∈ˢ s → image f w ∈ˢ U := fun w hw =>
+      hU.image_mem (hU.transitive hs hw) fun x hx =>
+        hinto x (mem_sUnion.mpr ⟨w, hw, hx⟩)
+    -- … so the set of all these images is a member too …
+    have hS : image (fun w => image f w) s ∈ˢ U :=
+      hU.image_mem hs fun w hw => himg w hw
+    -- … but `U ⊆ ⋃(that set)`, giving `S ∈ U ⊆ ⋃S`: a 2-cycle.
+    obtain ⟨x, hx, hfx⟩ := hsurj _ hS
+    obtain ⟨w, hw, hxw⟩ := mem_sUnion.mp hx
+    have : image (fun w => image f w) s ∈ˢ image f w :=
+      hfx ▸ mem_image.mpr ⟨x, hxw, rfl⟩
+    exact no_two_cycle this (mem_image.mpr ⟨w, hw, rfl⟩)
+  · exact hmem
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.binUnion_mem {a b y : V} (hy : y ∈ˢ U)
+    (ha : a ∈ˢ U) (hb : b ∈ˢ U) : binUnion a b ∈ˢ U :=
+  hU.sUnion_mem (hU.upair_mem hy ha hb)
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.kpair_mem {a b y : V} (hy : y ∈ˢ U)
+    (ha : a ∈ˢ U) (hb : b ∈ˢ U) : kpair a b ∈ˢ U :=
+  hU.upair_mem hy (hU.sing_mem hy ha) (hU.upair_mem hy ha hb)
+
+theorem _root_.Ix.Theory.Model.IsTGUniverse.sep_mem {a : V} {p : V → Prop} (ha : a ∈ˢ U) :
+    sep a p ∈ˢ U :=
+  hU.mem_of_subset_mem ha sep_subset
+
+/-- Union of a member-indexed family of members. -/
+theorem _root_.Ix.Theory.Model.IsTGUniverse.famUnion_mem {A : V} {F : V → V}
+    (hA : A ∈ˢ U) (hF : ∀ x, x ∈ˢ A → F x ∈ˢ U) :
+    sUnion (image F A) ∈ˢ U :=
+  hU.sUnion_mem (hU.image_mem hA hF)
+
+end IsTGUniverse
+
+/-- Chain membership generalizes along the ordering, by transitivity
+of the higher universe. -/
+theorem univChain_mem_of_lt {m n : Nat} (h : m < n) :
+    (univChain m : V) ∈ˢ univChain n := by
+  induction n with
+  | zero => exact absurd h (Nat.not_lt_zero m)
+  | succ n ih =>
+    rcases Nat.lt_succ_iff_lt_or_eq.mp h with h' | rfl
+    · exact (univChain_tg (n + 1)).transitive (univChain_mem n) (ih h')
+    · exact univChain_mem m
+
+end Ix.Theory.Model.SetTheory
diff --git a/Ix/Theory/Model/Signature.lean b/Ix/Theory/Model/Signature.lean
new file mode 100644
index 000000000..fd69a8e35
--- /dev/null
+++ b/Ix/Theory/Model/Signature.lean
@@ -0,0 +1,159 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Extension
+
+namespace Ix.Theory.Model
+
+universe u v
+variable {β : Type u}
+
+/-- An internal signature overlay does not by itself admit declarations. -/
+def Environment.overlay (entries additions : Environment β) : Environment β :=
+  fun r => match additions r with
+    | some entry => some entry
+    | none => entries r
+
+def Assignment.overlay (constants values : Assignment β V) (additions : Environment β) : Assignment β V :=
+  fun r levels => match additions r with
+    | some _ => values r levels
+    | none => constants r levels
+
+def Environment.Fresh (entries additions : Environment β) : Prop :=
+  ∀ r entry, additions r = some entry → entries r = none
+
+theorem Environment.overlay_new {entries additions : Environment β} {r : ConstRef β}
+    {entry : ConstantEntry β} (h : additions r = some entry) :
+    entries.overlay additions r = some entry := by simp only [overlay, h]
+
+theorem Environment.overlay_old {entries additions : Environment β}
+    (hf : entries.Fresh additions) {r : ConstRef β} {entry : ConstantEntry β}
+    (h : entries r = some entry) : entries.overlay additions r = some entry := by
+  cases ha : additions r with
+  | none => simpa only [overlay, ha] using h
+  | some new => have he := hf r new ha; rw [h] at he; contradiction
+
+theorem Assignment.overlay_agrees {entries additions : Environment β} (hf : entries.Fresh additions)
+    (constants values : Assignment β V) : Assignment.AgreesOn entries constants (constants.overlay values additions) := by
+  intro r entry hr levels
+  cases ha : additions r with
+  | none => simp only [overlay, ha]
+  | some new => have he := hf r new ha; rw [hr] at he; contradiction
+
+theorem AExpr.ReferencesIn.overlay {entries additions : Environment β} {e : AExpr β}
+    (h : e.ReferencesIn entries) : e.ReferencesIn (entries.overlay additions) := by
+  intro r hr
+  cases ha : additions r with
+  | none => simpa only [Environment.overlay, ha] using h r hr
+  | some _ => simp only [Environment.overlay, ha, Option.isSome_some]
+
+theorem ConstantFact.ReferencesIn.overlay {entries additions : Environment β} {fact : ConstantFact β}
+    (h : fact.ReferencesIn entries) : fact.ReferencesIn (entries.overlay additions) := by
+  intro r hr
+  cases ha : additions r with
+  | none => simpa only [Environment.overlay, ha] using h r hr
+  | some _ => simp only [Environment.overlay, ha, Option.isSome_some]
+
+/-- The syntactic closure needed for a signature entry. Formation and the
+value's membership are separate obligations and cannot be supplied by data. -/
+structure EntryClosed (entries : Environment β) (entry : ConstantEntry β) : Prop where
+  typeScope : entry.type.Scope entry.universes 0
+  bodyScope : ∀ body, entry.body = some body → body.Scope entry.universes 0
+  typeReferences : entry.type.ReferencesIn entries
+  bodyReferences : ∀ body, entry.body = some body → body.ReferencesIn entries
+  equationScope : ∀ law ∈ entry.equations,
+    law.lhs.Scope entry.universes 0 ∧ law.rhs.Scope entry.universes 0
+  equationReferences : ∀ law ∈ entry.equations,
+    law.lhs.ReferencesIn entries ∧ law.rhs.ReferencesIn entries
+  factScope : ∀ fact ∈ entry.facts, fact.Scope entry.universes
+  factReferences : ∀ fact ∈ entry.facts, fact.ReferencesIn entries
+
+theorem Environment.WF.overlay {entries additions : Environment β} (hE : entries.WF)
+    (hN : ∀ r entry, additions r = some entry → EntryClosed entries entry) :
+    (entries.overlay additions).WF := by
+  constructor
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).typeScope
+    · exact hE.typeScope r entry hr
+  · intro r entry hr body hb
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).bodyScope body hb
+    · exact hE.bodyScope r entry hr body hb
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).typeReferences.overlay
+    · exact (hE.typeReferences r entry hr).overlay
+  · intro r entry hr body hb
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact ((hN _ _ ‹_›).bodyReferences body hb).overlay
+    · exact (hE.bodyReferences r entry hr body hb).overlay
+  · intro r entry hr law hl
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).equationScope law hl
+    · exact hE.equationScope r entry hr law hl
+  · intro r entry hr law hl
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr
+      exact ⟨((hN _ _ ‹_›).equationReferences law hl).1.overlay,
+        ((hN _ _ ‹_›).equationReferences law hl).2.overlay⟩
+    · exact ⟨(hE.equationReferences r entry hr law hl).1.overlay,
+        (hE.equationReferences r entry hr law hl).2.overlay⟩
+  · intro r entry hr fact hf
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).factScope fact hf
+    · exact hE.factScope r entry hr fact hf
+  · intro r entry hr fact hf
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact ((hN _ _ ‹_›).factReferences fact hf).overlay
+    · exact (hE.factReferences r entry hr fact hf).overlay
+
+variable {V : Type v} [SetTheory V]
+
+theorem Realizes.overlay {entries additions : Environment β} {constants : Assignment β V}
+    (hM : Realizes constants entries)
+    (hN : ∀ r entry, additions r = some entry → EntryRealization constants r entry) :
+    Realizes constants (entries.overlay additions) := by
+  constructor
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).typeValid
+    · exact hM.typeValid r entry hr
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).member
+    · exact hM.member r entry hr
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).bodyValid
+    · exact hM.bodyValid r entry hr
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).bodyValue
+    · exact hM.bodyValue r entry hr
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).equationValue
+    · exact hM.equationValue r entry hr
+  · intro r entry hr
+    unfold Environment.overlay at hr
+    split at hr
+    · cases Option.some.inj hr; exact (hN _ _ ‹_›).factMeaning
+    · exact hM.factMeaning r entry hr
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/Support.lean b/Ix/Theory/Model/Support.lean
new file mode 100644
index 000000000..f6902993d
--- /dev/null
+++ b/Ix/Theory/Model/Support.lean
@@ -0,0 +1,126 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Environment
+
+namespace Ix.Theory.Model
+
+open SetTheory
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+namespace AExpr
+
+def references : AExpr β → List (ConstRef β)
+  | .bvar _ | .sort _ | .natLit _ => []
+  | .const r _ => [r]
+  | .app f a | .lam _ f a | .forallE _ f a => f.references ++ a.references
+  | .proj r _ e => r :: e.references
+
+def ReferencesIn (entries : Environment β) (e : AExpr β) : Prop :=
+  ∀ r ∈ e.references, (entries r).isSome = true
+
+instance {entries : Environment β} {e : AExpr β} : Decidable (e.ReferencesIn entries) :=
+  inferInstanceAs (Decidable (∀ r ∈ e.references, (entries r).isSome = true))
+
+end AExpr
+
+def ConstantFact.Scope (n : Nat) : ConstantFact β → Prop
+  | .typed e type => e.Scope n 0 ∧ type.Scope n 0
+  | .natural .. => n = 0
+
+def ConstantFact.references : ConstantFact β → List (ConstRef β)
+  | .typed e type => e.references ++ type.references
+  | .natural zero succ => [zero, succ]
+
+def ConstantFact.ReferencesIn (entries : Environment β) (fact : ConstantFact β) : Prop :=
+  ∀ r ∈ fact.references, (entries r).isSome = true
+
+instance {n : Nat} {fact : ConstantFact β} : Decidable (fact.Scope n) := by
+  cases fact <;> unfold ConstantFact.Scope <;> infer_instance
+
+instance {entries : Environment β} {fact : ConstantFact β} : Decidable (fact.ReferencesIn entries) :=
+  inferInstanceAs (Decidable (∀ r ∈ fact.references, (entries r).isSome = true))
+
+theorem interp_congr_constants (e : AExpr β) (constants constants' : Assignment β V)
+    (h : ∀ r ∈ e.references, ∀ ls, constants r ls = constants' r ls)
+    (levels : List Nat) (env : Nat → V) :
+    interp constants levels env e = interp constants' levels env e := by
+  induction e generalizing env with
+  | const r ls => exact h r (by simp [AExpr.references]) _
+  | app f a hf ha =>
+    have hf' := hf (fun r hr => h r (List.mem_append_left _ hr)) env
+    have ha' := ha (fun r hr => h r (List.mem_append_right _ hr)) env
+    simp only [interp, hf', ha']
+  | lam p A b hA hb | forallE p A b hA hb =>
+    have hA' := hA (fun r hr => h r (List.mem_append_left _ hr)) env
+    simp only [interp, hA']
+    congr 1
+    funext x
+    exact hb (fun r hr => h r (List.mem_append_right _ hr)) _
+  | proj r i e ih =>
+    simp only [interp, ih (fun q hq => h q (List.mem_cons_of_mem _ hq)) env]
+  | _ => rfl
+
+theorem wellDenoted_congr_constants (e : AExpr β) (constants constants' : Assignment β V)
+    (h : ∀ r ∈ e.references, ∀ ls, constants r ls = constants' r ls)
+    (levels : List Nat) (env : Nat → V) :
+    WellDenoted constants levels env e ↔ WellDenoted constants' levels env e := by
+  induction e generalizing env with
+  | app f a hf ha =>
+    have hfr := fun r hr => h r (List.mem_append_left _ hr)
+    have har := fun r hr => h r (List.mem_append_right _ hr)
+    simp only [WellDenoted, hf hfr, ha har, interp_congr_constants _ _ _ hfr,
+      interp_congr_constants _ _ _ har]
+  | lam p A b hA hb | forallE p A b hA hb =>
+    have hAr := fun r hr => h r (List.mem_append_left _ hr)
+    have hbr := fun r hr => h r (List.mem_append_right _ hr)
+    simp only [WellDenoted, hA hAr, hb hbr, interp_congr_constants _ _ _ hAr,
+      interp_congr_constants _ _ _ hbr]
+  | proj r i e ih => exact ih (fun q hq => h q (List.mem_cons_of_mem _ hq)) env
+  | _ => rfl
+
+theorem interp_congr_env (e : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) {n k : Nat} (hs : e.Scope n k) (env env' : Nat → V)
+    (h : ∀ i, i < k → env i = env' i) :
+    interp constants levels env e = interp constants levels env' e := by
+  induction e generalizing k env env' with
+  | bvar i => exact h i hs
+  | app f a hf ha => simp only [interp, hf hs.1 env env' h, ha hs.2 env env' h]
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [interp, hA hs.2.1 env env' h]
+    congr 1
+    funext x
+    apply hb hs.2.2
+    intro i hi
+    cases i with
+    | zero => rfl
+    | succ i => exact h i (by omega)
+  | proj r i e ih => simp only [interp, ih hs env env' h]
+  | _ => rfl
+
+theorem interp_closed (e : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) {n : Nat} (hs : e.Scope n 0) (env env' : Nat → V) :
+    interp constants levels env e = interp constants levels env' e :=
+  interp_congr_env e constants levels hs env env' (fun _ h => (Nat.not_lt_zero _ h).elim)
+
+/-- Syntactic closure of an admitted interface. Semantic realizability remains
+a separate, produced fact. -/
+structure Environment.WF (entries : Environment β) : Prop where
+  typeScope : ∀ r entry, entries r = some entry → entry.type.Scope entry.universes 0
+  bodyScope : ∀ r entry, entries r = some entry → ∀ body, entry.body = some body →
+    body.Scope entry.universes 0
+  typeReferences : ∀ r entry, entries r = some entry → entry.type.ReferencesIn entries
+  bodyReferences : ∀ r entry, entries r = some entry → ∀ body, entry.body = some body →
+    body.ReferencesIn entries
+  equationScope : ∀ r entry, entries r = some entry → ∀ equation ∈ entry.equations,
+    equation.lhs.Scope entry.universes 0 ∧ equation.rhs.Scope entry.universes 0
+  equationReferences : ∀ r entry, entries r = some entry → ∀ equation ∈ entry.equations,
+    equation.lhs.ReferencesIn entries ∧ equation.rhs.ReferencesIn entries
+  factScope : ∀ r entry, entries r = some entry → ∀ fact ∈ entry.facts, fact.Scope entry.universes
+  factReferences : ∀ r entry, entries r = some entry → ∀ fact ∈ entry.facts, fact.ReferencesIn entries
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/TelescopeSemantics.lean b/Ix/Theory/Model/TelescopeSemantics.lean
new file mode 100644
index 000000000..855662026
--- /dev/null
+++ b/Ix/Theory/Model/TelescopeSemantics.lean
@@ -0,0 +1,81 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Instantiation
+
+namespace Ix.Theory.Model.Telescope
+
+open SetTheory SetTheory.Tower SetModel Certified
+
+universe u v
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+theorem fits_append_iff (constants : Assignment β V) (levels : List Nat) (env : Nat → V)
+    (left right : List (AExpr β)) (xs : List V) :
+    FitsS (interpret constants levels env (left ++ right)) xs ↔
+      ∃ ys zs, xs = ys ++ zs ∧ FitsS (interpret constants levels env left) ys ∧
+        FitsS (interpret constants levels (extend env ys) right) zs := by
+  induction left generalizing env xs with
+  | nil =>
+    constructor
+    · intro h
+      exact ⟨[], xs, rfl, trivial, h⟩
+    · rintro ⟨ys, zs, rfl, hy, hz⟩
+      cases ys with
+      | nil => exact hz
+      | cons _ _ => exact hy.elim
+  | cons A rest ih =>
+    constructor
+    · intro h
+      cases xs with
+      | nil => exact h.elim
+      | cons x xs =>
+        obtain ⟨ys, zs, rfl, hy, hz⟩ := (ih (Valuation.cons x env) xs).mp h.2
+        exact ⟨x :: ys, zs, rfl, ⟨h.1, hy⟩, hz⟩
+    · rintro ⟨ys, zs, rfl, hy, hz⟩
+      cases ys with
+      | nil => exact hy.elim
+      | cons y ys => exact ⟨hy.1, (ih (Valuation.cons y env) (ys ++ zs)).mpr ⟨ys, zs, rfl, hy.2, hz⟩⟩
+
+/-- Close a pointwise semantic fact over a formed telescope. The result
+includes hereditary validity of both complete endpoints and a uniform sort
+for the resulting product. It does not assume a model for any new fact. -/
+theorem Formed.lamN_semantics {entries : Environment β} {Γ : Context β}
+    {domains : List (AExpr β)} (h : Formed.{u,v} entries Γ domains)
+    (constants : Assignment β V) (hM : Realizes constants entries) (levels : List Nat)
+    (body B : AExpr β) (b : VLevel) :
+    ∃ l, zeroCondition l = zeroCondition b ∧ ∀ env, Γ.Valid constants levels env →
+      (∀ xs, FitsS (interpret constants levels env domains) xs →
+        let env' := extend env xs
+        WellDenoted constants levels env' body ∧ WellDenoted constants levels env' B ∧
+          interp constants levels env' body ∈ˢ interp constants levels env' B ∧
+          interp constants levels env' B ∈ˢ (univ (b.eval levels) : V)) →
+      WellDenoted constants levels env (.lamN (zeroCondition b) domains body) ∧
+        WellDenoted constants levels env (.forallN (zeroCondition b) domains B) ∧
+        interp constants levels env (.lamN (zeroCondition b) domains body) ∈ˢ
+          interp constants levels env (.forallN (zeroCondition b) domains B) ∧
+        interp constants levels env (.forallN (zeroCondition b) domains B) ∈ˢ
+          (univ (l.eval levels) : V) := by
+  induction h with
+  | nil => exact ⟨b, rfl, fun env _ hb => hb [] trivial⟩
+  | @cons Γ A rest a hA hrest ih =>
+    obtain ⟨l, hl, ih⟩ := ih
+    refine ⟨.imax a l, hl, ?_⟩
+    intro env hΓ hb
+    have hAt := hA V constants hM levels env hΓ
+    have ht x hx := ih (Valuation.cons x env) (hΓ.push hAt.1 hx)
+      (fun xs hxs => hb (x :: xs) ⟨hx, hxs⟩)
+    have hz : regime (zeroCondition b) levels = 0 ↔ l.eval levels = 0 := by
+      rw [← hl]
+      exact regime_zeroCondition ..
+    refine ⟨⟨hAt.1, fun x hx => (ht x hx).1, l.eval levels,
+      (fun x => interp constants levels (Valuation.cons x env) (.forallN (zeroCondition b) rest B)),
+      hz, fun x hx => ⟨(ht x hx).2.2.1, (ht x hx).2.2.2⟩⟩,
+      ⟨hAt.1, fun x hx => (ht x hx).2.1, l.eval levels, hz,
+        fun x hx => (ht x hx).2.2.2⟩, ?_, ?_⟩
+    · exact lamR_mem (fun x hx => (ht x hx).2.2.1)
+    · exact annotated_pi_mem_univ hl.symm hAt.2.2 (fun x hx => (ht x hx).2.2.2)
+
+end Ix.Theory.Model.Telescope
diff --git a/Ix/Theory/Model/Value.lean b/Ix/Theory/Model/Value.lean
new file mode 100644
index 000000000..b710b905f
--- /dev/null
+++ b/Ix/Theory/Model/Value.lean
@@ -0,0 +1,90 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.SetModel.Ops
+import Ix.Theory.Certified.Level
+
+namespace Ix.Theory.Model
+
+open SetTheory SetModel Certified
+
+/-- Only zero versus positive matters to the set-theoretic binder operators. -/
+def regime (p : PropWhen) (values : List Nat) : Nat :=
+  if p.holds (values.getD · 0) then 0 else 1
+
+@[simp] theorem regime_zeroCondition (l : VLevel) (values : List Nat) :
+    regime (zeroCondition l) values = 0 ↔ l.eval values = 0 := by
+  unfold regime
+  rw [zeroCondition_correct]
+  by_cases h : l.eval values = 0 <;> simp [h]
+
+@[simp] theorem regime_always (values : List Nat) : regime .always values = 0 := rfl
+
+@[simp] theorem regime_never (values : List Nat) : regime .never values = 1 := rfl
+
+@[simp] theorem regime_instCondition (p : PropWhen) (ls : List VLevel) (values : List Nat) :
+    regime (instCondition ls p) values = regime p (ls.map (VLevel.eval values)) := by
+  unfold regime
+  rw [instCondition_correct]
+
+universe u
+variable {V : Type u} [SetTheory V]
+
+/-- The universe bound for the actual product operator, including an
+arbitrary-size domain when the codomain sort is zero. -/
+theorem piR_mem_univ {a b : Nat} {A : V} {B : V → V}
+    (hA : A ∈ˢ univ a) (hB : ∀ x, x ∈ˢ A → B x ∈ˢ univ b) :
+    piR b A B ∈ˢ univ (VLevel.natIMax a b) := by
+  cases b with
+  | zero =>
+    change piR 0 A B ∈ˢ univ 0
+    rw [univ_zero]
+    exact piR_zero_mem_univZero
+  | succ b =>
+    have hn : Nat.max a (b + 1) ≠ 0 :=
+      Nat.ne_of_gt (Nat.lt_of_lt_of_le (Nat.zero_lt_succ b) (Nat.le_max_right a (b + 1)))
+    simp only [VLevel.natIMax, Nat.add_one_ne_zero, ↓reduceIte]
+    rw [piR_pos (Nat.succ_ne_zero b)]
+    apply (univ_isTGUniverse hn).piSet_mem
+    · exact univ_mono (Nat.le_max_left ..) A hA
+    · intro x hx
+      exact univ_mono (Nat.le_max_right ..) (B x) (hB x hx)
+
+theorem annotated_pi_mem_univ {a : Nat} {b : VLevel} {p : PropWhen}
+    {values : List Nat} {A : V} {B : V → V}
+    (hp : p = zeroCondition b)
+    (hA : A ∈ˢ univ a) (hB : ∀ x, x ∈ˢ A → B x ∈ˢ univ (b.eval values)) :
+    piR (regime p values) A B ∈ˢ univ (VLevel.natIMax a (b.eval values)) := by
+  subst p
+  rw [piR_zero_agree (regime_zeroCondition b values) (fun _ _ => rfl)]
+  exact piR_mem_univ hA hB
+
+/-- The fixed empty proposition used by the certified primitive signature. -/
+noncomputable def falseValue : V := empty
+
+theorem falseValue_uninhabited (x : V) : ¬ x ∈ˢ (falseValue : V) := not_mem_empty x
+
+theorem falseValue_has_sort : (falseValue : V) ∈ˢ univ 0 := empty_mem_univ 0
+
+/-- Type of dependent elimination from the empty proposition. -/
+noncomputable def falseElimType (level : Nat) : V :=
+  piR level (piR (level + 1) empty (fun _ => univ level)) fun motive =>
+    piR level empty (fun x => app motive x)
+
+/-- The empty eliminator is a function graph at positive sorts and the proof
+point at sort zero. Its type is inhabited because its second domain is empty. -/
+noncomputable def falseElimValue (level : Nat) : V :=
+  lamR level (piR (level + 1) empty (fun _ => univ level)) fun _ =>
+    lamR level empty (fun _ => empty)
+
+theorem falseElimValue_mem (level : Nat) :
+    (falseElimValue level : V) ∈ˢ falseElimType level := by
+  apply lamR_mem
+  intro motive _
+  apply lamR_mem
+  intro x hx
+  exact (not_mem_empty x hx).elim
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/Model/WellDenoted.lean b/Ix/Theory/Model/WellDenoted.lean
new file mode 100644
index 000000000..2cfb83cb2
--- /dev/null
+++ b/Ix/Theory/Model/WellDenoted.lean
@@ -0,0 +1,148 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Model.Interpret
+
+/-!
+# Hereditary validity of annotated expressions
+
+Application carries domain membership, and both binder forms carry a
+codomain universe whose zero test agrees with the annotation. The invariant
+is a semantic specification, not input accepted on trust: checker rules must
+construct it. Projection validity follows its major premise; literal validity
+is structural. Their membership still requires admitted primitive facts.
+-/
+
+namespace Ix.Theory.Model
+
+open SetTheory SetModel
+
+universe u v w
+variable {β : Type u} {V : Type v} [SetTheory V]
+
+def WellDenoted (constants : Assignment β V) (levels : List Nat)
+    (env : Nat → V) : AExpr β → Prop
+  | .bvar _ | .sort _ | .const .. => True
+  | .app f a =>
+    WellDenoted constants levels env f ∧ WellDenoted constants levels env a ∧
+      ∃ (v : Nat) (A : V) (B : V → V),
+        interp constants levels env f ∈ˢ piR v A B ∧
+        interp constants levels env a ∈ˢ A ∧
+        ∀ x, x ∈ˢ A → B x ∈ˢ univ v
+  | .lam p A b =>
+    WellDenoted constants levels env A ∧
+      (∀ x, x ∈ˢ interp constants levels env A →
+        WellDenoted constants levels (Valuation.cons x env) b) ∧
+      ∃ (v : Nat) (B : V → V), (regime p levels = 0 ↔ v = 0) ∧
+        ∀ x, x ∈ˢ interp constants levels env A →
+          interp constants levels (Valuation.cons x env) b ∈ˢ B x ∧
+          B x ∈ˢ univ v
+  | .forallE p A B =>
+    WellDenoted constants levels env A ∧
+      (∀ x, x ∈ˢ interp constants levels env A →
+        WellDenoted constants levels (Valuation.cons x env) B) ∧
+      ∃ v : Nat, (regime p levels = 0 ↔ v = 0) ∧
+        ∀ x, x ∈ˢ interp constants levels env A →
+          interp constants levels (Valuation.cons x env) B ∈ˢ univ v
+  | .proj _ _ e => WellDenoted constants levels env e
+  | .natLit _ => True
+
+theorem wellDenoted_liftN (e : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (n k : Nat) :
+    WellDenoted constants levels env (e.liftN n k) ↔
+      WellDenoted constants levels (Valuation.skip n k env) e := by
+  induction e generalizing k env with
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [AExpr.liftN, WellDenoted, hA, hb, interp_liftN, Valuation.skip_cons]
+  | _ => simp_all [AExpr.liftN, WellDenoted, interp_liftN]
+
+/-- Substitution also needs hereditary validity of the substituted argument.
+Interpretation equality alone cannot supply this fact. -/
+theorem wellDenoted_inst (e a : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (k : Nat)
+    (ha : WellDenoted constants levels (Valuation.skip k 0 env) a)
+    (he : WellDenoted constants levels
+      (Valuation.insert k (interp constants levels (Valuation.skip k 0 env) a) env) e) :
+    WellDenoted constants levels env (e.inst a k) := by
+  induction e generalizing k env with
+  | bvar i =>
+    by_cases hi : i < k
+    · simp [AExpr.inst, AExpr.instVar, hi, WellDenoted]
+    · by_cases hik : i = k
+      · simpa [AExpr.inst, AExpr.instVar, hi, hik, wellDenoted_liftN] using ha
+      · simp [AExpr.inst, AExpr.instVar, hi, hik, WellDenoted]
+  | app f b hf hb =>
+    rcases he with ⟨hfw, hbw, v, A, B, hfm, hbm, hB⟩
+    exact ⟨hf env k ha hfw, hb env k ha hbw, v, A, B,
+      by simpa only [interp_inst] using hfm,
+      by simpa only [interp_inst] using hbm, hB⟩
+  | lam p A b hA hb =>
+    rcases he with ⟨hAw, hbw, v, B, hz, hB⟩
+    refine ⟨hA env k ha hAw, ?_, v, B, hz, ?_⟩
+    · intro x hx
+      apply hb (Valuation.cons x env) (k + 1)
+      · simpa only [Valuation.skip_succ_cons] using ha
+      · simp only [Valuation.skip_succ_cons, Valuation.insert_cons]
+        exact hbw x (by simpa only [interp_inst] using hx)
+    · intro x hx
+      simpa only [interp_inst, Valuation.skip_succ_cons, Valuation.insert_cons] using
+        hB x (by simpa only [interp_inst] using hx)
+  | forallE p A b hA hb =>
+    rcases he with ⟨hAw, hbw, v, hz, hB⟩
+    refine ⟨hA env k ha hAw, ?_, v, hz, ?_⟩
+    · intro x hx
+      apply hb (Valuation.cons x env) (k + 1)
+      · simpa only [Valuation.skip_succ_cons] using ha
+      · simp only [Valuation.skip_succ_cons, Valuation.insert_cons]
+        exact hbw x (by simpa only [interp_inst] using hx)
+    · intro x hx
+      simpa only [interp_inst, Valuation.skip_succ_cons, Valuation.insert_cons] using
+        hB x (by simpa only [interp_inst] using hx)
+  | proj _ _ e ih => exact ih env k ha he
+  | _ => exact he
+
+theorem wellDenoted_instL (e : AExpr β) (constants : Assignment β V)
+    (levels : List Nat) (env : Nat → V) (ls : List VLevel) :
+    WellDenoted constants levels env (e.instL ls) ↔
+      WellDenoted constants (ls.map (VLevel.eval levels)) env e := by
+  induction e generalizing env with
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [AExpr.instL, WellDenoted, hA, hb, interp_instL, regime_instCondition]
+  | _ => simp_all [AExpr.instL, WellDenoted, interp_instL]
+
+theorem wellDenoted_rename {γ : Type w} (e : AExpr β) (mapping : β → γ)
+    (constants : Assignment β V) (constants' : Assignment γ V)
+    (h : ∀ r ls, constants' (r.rename mapping) ls = constants r ls)
+    (levels : List Nat) (env : Nat → V) :
+    WellDenoted constants' levels env (e.rename mapping) ↔
+      WellDenoted constants levels env e := by
+  induction e generalizing env with
+  | lam p A b hA hb | forallE p A b hA hb =>
+    simp only [AExpr.rename, WellDenoted, hA, hb, interp_rename _ _ _ _ h]
+  | _ => simp_all [AExpr.rename, WellDenoted, interp_rename _ _ _ _ h]
+
+/-- Conservative beta uses the actual lambda domain even in the proof regime.
+The application invariant's possibly different product domain is insufficient
+for this step when the lambda's value is the proof point. -/
+theorem wellDenoted_beta {constants : Assignment β V} {levels : List Nat}
+    {env : Nat → V} {p : Certified.PropWhen} {A b a : AExpr β}
+    (hl : WellDenoted constants levels env (.lam p A b))
+    (haw : WellDenoted constants levels env a)
+    (ha : interp constants levels env a ∈ˢ interp constants levels env A) :
+    WellDenoted constants levels env (b.inst a) ∧
+      interp constants levels env (.app (.lam p A b) a) =
+        interp constants levels env (b.inst a) := by
+  rcases hl with ⟨_, hbw, v, B, hz, hB⟩
+  constructor
+  · apply wellDenoted_inst
+    · simpa using haw
+    · simpa using hbw _ ha
+  · simp only [interp, interp_inst, Valuation.skip_zero, Valuation.insert_zero]
+    apply app_lamR ha (fun x hx => (hB x hx).1)
+    intro hp x hx
+    have hv := hz.mp hp
+    simpa only [hv, univ_zero] using (hB x hx).2
+
+end Ix.Theory.Model
diff --git a/Ix/Theory/NOTICE b/Ix/Theory/NOTICE
new file mode 100644
index 000000000..60eaca747
--- /dev/null
+++ b/Ix/Theory/NOTICE
@@ -0,0 +1,51 @@
+Lean4Ix notices
+================
+
+Copyright (c) 2026 Argument Computer Corporation
+
+Lean4Ix is based on lean4lean:
+
+  https://github.com/digama0/lean4lean
+
+The lean4lean-derived portions were received under the Apache License,
+Version 2.0. Their original copyright, attribution, licensing, and
+modification-notice requirements continue to apply. The repository history
+and retained per-file notices provide the detailed provenance of those
+portions.
+
+The executable kernel model is itself derived from the Lean 4 kernel. Certain
+files also identify more specific Apache-2.0 sources in their headers:
+
+  * Main.lean contains code copied from leanprover-community/import-graph.
+  * Lean4Lean/Std/ToExpr.lean contains code from mathlib.
+  * Lean4Lean/Verify/QSort.lean is adapted from Lean 4's qsort verification.
+
+Lean 4, Batteries, import-graph, and mathlib are distributed under the Apache
+License, Version 2.0. When a Lean4Ix distribution includes their code or
+artifacts, preserve the license and notice material shipped with them.
+
+Lean4Ix/Model/SetTheory and Lean4Ix/Model/SetModel contain a port of the
+con-leche set-theoretic foundation, dependent-function operators, least
+fixed points, tuple and container constructions, and recursor graphs,
+received under the Apache License, Version 2.0:
+
+  https://github.com/leanprover/con-leche
+  revision 86cd20a65660d757cedc81561a44579099b565d0
+
+The port retains the upstream license in LICENSE-APACHE. Per-file headers
+identify the original files and modifications. The exact source and ported
+file hashes are recorded in docs/consistency/con-leche-port.json. This upstream
+code remains subject to Apache-2.0; the repository's dual-license default does
+not relicense it.
+
+The generated lake-manifest.json dependency lock and the single-value
+lean-toolchain toolchain pin may differ from their lean4lean counterparts.
+They are mechanical package metadata governed by the licensing and
+modification notices distributed with this repository.
+
+Except where a contribution or upstream component is explicitly identified
+under different terms, contributions intentionally submitted for inclusion in
+Lean4Ix are accepted under the same MIT OR Apache-2.0 choice described in
+LICENSE, LICENSE-MIT, and LICENSE-APACHE.
+
+This NOTICE is informational and does not modify any applicable license.
diff --git a/Ix/Theory/Named/ConstructorValidityFixtures.lean b/Ix/Theory/Named/ConstructorValidityFixtures.lean
new file mode 100644
index 000000000..7d5348b7b
--- /dev/null
+++ b/Ix/Theory/Named/ConstructorValidityFixtures.lean
@@ -0,0 +1,176 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.InductiveFixtures
+
+open Ix.Theory (VLevel)
+
+/-!
+# Constructor-validity parity fixtures
+
+Focused singleton declarations for Spec-05.  The positive declarations retain
+real kernel metadata while remaining inside the already-supported large-
+elimination and non-K fragment.  The failed declarations pin the nearest
+Lean elaborator/kernel rejection for each neighboring positivity or universe
+branch; `#guard_msgs` rolls every failed declaration back.
+-/
+
+namespace Ix.Theory.Named
+namespace InductiveFixtures
+open VInductDecl
+
+universe u
+
+/-! ## Type-valued dependency and positivity matrix -/
+
+/-- A source-ordered constructor covering the non-Prop universe boundary,
+dependent proof fields, direct recursion, a recursive function, and an
+independent/dependent suffix after both recursive outer fields. -/
+inductive ConstructorValidityMatrix (α : Type u) (P : α → Prop) : Type u where
+  | mk (x : α) (proof : P x)
+      (direct : ConstructorValidityMatrix α P)
+      (function : (y : α) → ConstructorValidityMatrix α P)
+      (later : α) (laterProof : P later) :
+      ConstructorValidityMatrix α P
+
+def constructorValidityMatrixType : VInductiveType where
+  name := ``ConstructorValidityMatrix
+  uvars := 1
+  type := vconst(type_of% @ConstructorValidityMatrix).type
+  ctors := [⟨vconst(type_of% @ConstructorValidityMatrix.mk),
+    ``ConstructorValidityMatrix.mk⟩]
+
+def constructorValidityMatrixDecl : VInductDecl :=
+  ⟨1, 2, [constructorValidityMatrixType]⟩
+
+example : constructorValidityMatrixDecl.stage3 = true := rfl
+
+def constructorValidityMatrixChecked : constructorValidityMatrixDecl.Checked :=
+  constructorValidityMatrixDecl.checked?.get (by decide)
+
+def constructorValidityMatrixGenerationChecked :
+    GenerationChecked constructorValidityMatrixDecl :=
+  (identityGeneration? constructorValidityMatrixDecl).get (by decide)
+
+private def spec05PermC (constant : VConstant)
+    (levels : List VLevel) : VConstant :=
+  ⟨constant.uvars, constant.type.instL levels⟩
+
+example : constructorValidityMatrixGenerationChecked.recursor =
+    spec05PermC (vconst(type_of% @ConstructorValidityMatrix.rec))
+      [.param 1, .param 0] := rfl
+
+example : constructorValidityMatrixChecked.resultLevel =
+    .succ (.param 0) := rfl
+
+example : constructorValidityMatrixChecked.constructors[0].fields.length = 6 :=
+  rfl
+
+example : constructorValidityMatrixChecked.constructors[0].recursive.map
+    (fun position => (position.fieldIndex, position.binders.length)) =
+      [(2, 0), (3, 1)] := rfl
+
+example :
+    constructorValidityMatrixGenerationChecked.generatedRules.length = 1 :=
+  rfl
+
+/-! ## Prop-valued recursive-function universe boundary -/
+
+/-- The ordinary field `a : α` reaches the impredicative-Prop constructor
+universe branch.  The varying recursive target prevents parameter promotion,
+and the single constructor remains a legitimate non-K large eliminator. -/
+inductive PropRecursiveBoundary (α : Type u) : α → Prop where
+  | mk (a : α) (next : (b : α) → PropRecursiveBoundary α b) :
+      PropRecursiveBoundary α a
+
+def propRecursiveBoundaryType : VInductiveType where
+  name := ``PropRecursiveBoundary
+  uvars := 1
+  type := vconst(type_of% @PropRecursiveBoundary).type
+  ctors := [⟨vconst(type_of% @PropRecursiveBoundary.mk),
+    ``PropRecursiveBoundary.mk⟩]
+
+def propRecursiveBoundaryDecl : VInductDecl :=
+  ⟨1, 1, [propRecursiveBoundaryType]⟩
+
+example : propRecursiveBoundaryDecl.stage3 = true := rfl
+
+def propRecursiveBoundaryChecked : propRecursiveBoundaryDecl.Checked :=
+  propRecursiveBoundaryDecl.checked?.get (by decide)
+
+def propRecursiveBoundaryGenerationChecked :
+    GenerationChecked propRecursiveBoundaryDecl :=
+  (identityGeneration? propRecursiveBoundaryDecl).get (by decide)
+
+example : propRecursiveBoundaryGenerationChecked.recursor =
+    spec05PermC (vconst(type_of% @PropRecursiveBoundary.rec))
+      [.param 1, .param 0] := rfl
+
+example : propRecursiveBoundaryChecked.resultLevel = .zero := rfl
+
+example : propRecursiveBoundaryChecked.constructors[0].fields.length = 2 := rfl
+
+example : propRecursiveBoundaryChecked.constructors[0].recursive.map
+    (fun position => (position.fieldIndex, position.binders.length)) =
+      [(1, 1)] := rfl
+
+example : propRecursiveBoundaryGenerationChecked.generatedRules.length = 1 :=
+  rfl
+
+/-! ## Nearest-kernel rejection matrix -/
+
+namespace KernelDifferential
+
+opaque Spec05TypeBox : Type → Type
+opaque Spec05ProofBox : Type → Prop
+opaque Spec05DepProofBox (α : Type) : α → Prop
+
+/--
+error: (kernel) arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05NestedNegative.mk' has a non positive occurrence of the datatypes being declared
+-/
+#guard_msgs (whitespace := lax) in
+inductive Spec05NestedNegative : Type where
+  | mk : ((Spec05NestedNegative → Prop) → Spec05NestedNegative) →
+      Spec05NestedNegative
+
+/--
+error: (kernel) arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05FamilyNonrecursive.mk' contains a non valid occurrence of the datatypes being declared
+-/
+#guard_msgs (whitespace := lax) in
+inductive Spec05FamilyNonrecursive : Type where
+  | mk : Spec05TypeBox Spec05FamilyNonrecursive → Spec05FamilyNonrecursive
+
+/--
+error: (kernel) arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05FamilyProof.mk' contains a non valid occurrence of the datatypes being declared
+-/
+#guard_msgs (whitespace := lax) in
+inductive Spec05FamilyProof : Type where
+  | mk : Spec05ProofBox Spec05FamilyProof → Spec05FamilyProof
+
+/--
+error: (kernel) arg #2 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05RecursiveDependency.mk' contains a non valid occurrence of the datatypes being declared
+-/
+#guard_msgs (whitespace := lax) in
+inductive Spec05RecursiveDependency : Type where
+  | mk (recursive : Spec05RecursiveDependency)
+      (proof : Spec05DepProofBox Spec05RecursiveDependency recursive) :
+      Spec05RecursiveDependency
+
+/--
+error: Invalid universe level in constructor `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05UniverseReject.mk`: Parameter `α` has type
+  Type
+at universe level
+  2
+which is not less than or equal to the inductive type's resulting universe level
+  1
+-/
+#guard_msgs (whitespace := lax) in
+inductive Spec05UniverseReject : Type where
+  | mk (α : Type) : Spec05UniverseReject
+
+end KernelDifferential
+end InductiveFixtures
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Fixtures/ProjectionExpressibility.lean b/Ix/Theory/Named/Fixtures/ProjectionExpressibility.lean
new file mode 100644
index 000000000..e5c89c2ca
--- /dev/null
+++ b/Ix/Theory/Named/Fixtures/ProjectionExpressibility.lean
@@ -0,0 +1,1307 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Meta
+import Ix.Theory.Named.Projection
+import Ix.Theory.Named.Typing.InductiveLemmas
+
+open Ix.Theory (VLevel)
+
+/-!
+# Projection expressibility fixtures
+
+The main fixture is simultaneously parameterized, universe-polymorphic, and
+dependent: the final field type mentions the preceding projection.  It is
+small enough that the complete recursor encoding remains definitionally
+inspectable.
+-/
+
+namespace Ix.Theory.Named.Tests.ProjectionExpressibility
+
+open Ix.Theory.Named VInductDecl
+
+universe u v
+
+structure DependentRecord (α : Type u) (family : α → Type v) where
+  key : α
+  value : family key
+
+def dependentRecordCtor : VConstVal :=
+  ⟨vconst(type_of% @DependentRecord.mk), ``DependentRecord.mk⟩
+
+def dependentRecordType : VInductiveType where
+  name := ``DependentRecord
+  uvars := 2
+  type := vconst(type_of% @DependentRecord).type
+  ctors := [dependentRecordCtor]
+
+def dependentRecordDecl : VInductDecl :=
+  ⟨2, 2, [dependentRecordType]⟩
+
+example : dependentRecordDecl.checked?.isSome = true := rfl
+
+def dependentRecordChecked : dependentRecordDecl.Checked :=
+  dependentRecordDecl.checked?.get (by decide)
+
+def dependentRecordGeneration : dependentRecordDecl.GenerationChecked :=
+  dependentRecordChecked.identityGeneration
+
+def dependentRecordView : VStructureView where
+  source := dependentRecordDecl
+  generation := dependentRecordGeneration
+  constructor := dependentRecordGeneration.block.ctorPairs[0]
+  constructor_eq := rfl
+  raw_indices_eq := rfl
+  checked_indices_eq := rfl
+  recursive_eq := rfl
+  fieldSorts := [.succ (.param 0), .succ (.param 1)]
+  fieldSorts_length := rfl
+
+def dependentRecordEnv : VEnv :=
+  (VEnv.empty.addInductGeneration dependentRecordGeneration).get (by decide)
+
+theorem dependentRecord_add :
+    VEnv.empty.addInductGeneration dependentRecordGeneration =
+      some dependentRecordEnv := rfl
+
+theorem dependentRecord_trace :
+    Nonempty (VEnv.AddInductGenerationTrace VEnv.empty
+      dependentRecordEnv dependentRecordGeneration) :=
+  VEnv.addInductGeneration_trace dependentRecord_add
+
+theorem dependentRecordDecl_wf :
+    dependentRecordDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = dependentRecordType :=
+    List.mem_singleton.1 (by simpa [dependentRecordDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · exact ⟨⟨_, by type_tac⟩, ⟨⟨_, by type_tac⟩, trivial⟩⟩
+  · intro c hc
+    have hc' : c = dependentRecordCtor := by
+      simpa [dependentRecordType] using hc
+    subst c
+    constructor
+    · simp [dependentRecordDecl, dependentRecordType,
+        dependentRecordCtor, VInductDecl.fieldsWF,
+        VInductDecl.ctorFields, VInductDecl.isRecField,
+        VInductDecl.recArg?, VInductDecl.recTarget?,
+        VInductDecl.recFieldIdxs, VInductDecl.sortLevel,
+        VExpr.dropN, VExpr.resultOf, VExpr.appHead,
+        VExpr.appArgs]
+      exact ⟨
+        ⟨VLevel.succ (.param 0), by type_tac, VLevel.le_max_left⟩,
+        ⟨VLevel.succ (.param 1), by type_tac, VLevel.le_max_right⟩⟩
+    · simp [dependentRecordDecl, dependentRecordType,
+        dependentRecordCtor, VInductDecl.ctorFields,
+        VInductDecl.recFieldIdxs, VInductDecl.sortLevel,
+        VExpr.dropN, VExpr.resultOf, VExpr.forallN,
+        VExpr.liftTelN, VExpr.appArgs]
+      exact .nil
+
+theorem dependentRecordGeneration_wf :
+    dependentRecordGeneration.WF VEnv.empty :=
+  (dependentRecordChecked.wf_of_decl
+    dependentRecordDecl_wf).identityGeneration .empty
+
+theorem dependentRecordEnv_ordered : dependentRecordEnv.Ordered :=
+  VEnv.addInductGeneration_WF .empty dependentRecordGeneration_wf
+    dependentRecord_add
+
+theorem dependentRecordEnv_wf : dependentRecordEnv.WF :=
+  ⟨[.induct dependentRecordDecl],
+    .decl (.induct dependentRecordGeneration_wf dependentRecord_add) .empty⟩
+
+theorem dependentRecord_generation_semantics :
+    dependentRecordView.GenerationSemantics dependentRecordEnv := by
+  rcases dependentRecord_trace with ⟨trace⟩
+  exact .ofGenerationTrace dependentRecordGeneration_wf trace
+
+theorem dependentRecord_registered :
+    dependentRecordView.Registered dependentRecordEnv := by
+  rcases dependentRecord_trace with ⟨trace⟩
+  refine {
+    family := trace.family_lookup
+    constructor := ?_
+    recursor := trace.rec_lookup
+    rules := fun _ h => trace.rule_mem h }
+  apply trace.ctor_lookup
+  rw [← dependentRecordGeneration.rawCtors_eq]
+  exact List.mem_map.2 ⟨dependentRecordView.constructor,
+    by
+      change dependentRecordView.constructor ∈
+        dependentRecordView.generation.block.ctorPairs
+      rw [dependentRecordView.constructor_eq]
+      simp,
+    rfl⟩
+
+theorem dependentRecord_view_wf :
+    dependentRecordView.WF dependentRecordEnv := by
+  refine {
+    toRegistered := dependentRecord_registered
+    generationSemantics := dependentRecord_generation_semantics
+    parameters := ?_
+    parameters_length := rfl
+    fieldTelescope := ?_
+    smallFields := ?_ }
+  · exact ⟨⟨_, by type_tac⟩, ⟨⟨_, by type_tac⟩, trivial⟩⟩
+  · exact .cons (by type_tac) (.cons (by type_tac) .nil)
+  · intro h
+    change VInductDecl.ElimMode.large = .small at h
+    contradiction
+
+/-- The checked artifact retains both parameters and exactly the two
+dependent fields from the real kernel declaration. -/
+example : dependentRecordGeneration.block.rawParams =
+    [.sort (.succ (.param 0)),
+      .forallE (.bvar 0) (.sort (.succ (.param 1)))] := rfl
+
+example : dependentRecordView.fields =
+    [.bvar 1, .app (.bvar 1) (.bvar 0)] := rfl
+
+example : dependentRecordGeneration.elimination = .large := rfl
+
+private def permC (ci : VConstant) (levels : List VLevel) : VConstant :=
+  ⟨ci.uvars, ci.type.instL levels⟩
+
+example : dependentRecordGeneration.recursor =
+    permC (vconst(type_of% @DependentRecord.rec))
+      [.param 1, .param 2, .param 0] := rfl
+
+def symbolicLevels : List VLevel := [.param 0, .param 1]
+
+/-- Parameters in the context `[family, α]`, outermost first. -/
+def symbolicParams : List VExpr := [.bvar 1, .bvar 0]
+
+def symbolicStructureType : VExpr :=
+  dependentRecordView.structureType symbolicLevels symbolicParams
+
+example : dependentRecordView.specializedFields symbolicLevels symbolicParams =
+    [.bvar 1, .app (.bvar 1) (.bvar 0)] := rfl
+
+def keyCode : VStructureView.ProjectionCode :=
+  (dependentRecordView.projectionCodes symbolicLevels symbolicParams)[0]
+
+def valueCode : VStructureView.ProjectionCode :=
+  (dependentRecordView.projectionCodes symbolicLevels symbolicParams)[1]
+
+/-- Constructor reduction selects the first field for `key`. -/
+example : keyCode.minor =
+    .lam (.bvar 1)
+      (.lam (.app (.bvar 1) (.bvar 0)) (.bvar 1)) := rfl
+
+/-- Constructor reduction selects the second field for `value`. -/
+example : valueCode.minor =
+    .lam (.bvar 1)
+      (.lam (.app (.bvar 1) (.bvar 0)) (.bvar 0)) := rfl
+
+/-- The first field type is `α`. -/
+example : keyCode.typeFn =
+    .lam symbolicStructureType (.bvar 2) := rfl
+
+/-- The dependent second field type is `family (key major)`: the earlier
+projection program occurs in the later motive, rather than being supplied by
+an unconstrained witness. -/
+example : valueCode.typeFn =
+    .lam symbolicStructureType
+      (.app (.bvar 1) (.app keyCode.projector.lift (.bvar 0))) := rfl
+
+example : dependentRecordView.projectionLevels keyCode.fieldSort symbolicLevels =
+    [.succ (.param 0), .param 0, .param 1] := rfl
+
+example : dependentRecordView.projectionLevels valueCode.fieldSort symbolicLevels =
+    [.succ (.param 1), .param 0, .param 1] := rfl
+
+example : dependentRecordView.project? symbolicLevels symbolicParams 2 (.bvar 0) =
+    none := rfl
+
+/-- Eta reconstruction uses every generated projector in constructor-field
+order, including the projector whose motive depends on the earlier field. -/
+example : dependentRecordView.etaRebuild symbolicLevels symbolicParams
+    (.bvar 0) =
+      VExpr.appN (.const ``DependentRecord.mk symbolicLevels)
+        (symbolicParams ++
+          [.app keyCode.projector (.bvar 0),
+            .app valueCode.projector (.bvar 0)]) := rfl
+
+/-! A fully constrained `VEnv.TrProj` witness in a universe-polymorphic
+local context. -/
+
+def symbolicAlphaType : VExpr := .sort (.succ (.param 0))
+
+def symbolicFamilyType : VExpr :=
+  .forallE (.bvar 0) (.sort (.succ (.param 1)))
+
+/-- The major binder type is written over `[family, α]`. -/
+def symbolicMajorBinderType : VExpr :=
+  dependentRecordView.structureType symbolicLevels [.bvar 1, .bvar 0]
+
+def symbolicContext : List VExpr :=
+  [symbolicMajorBinderType, symbolicFamilyType, symbolicAlphaType]
+
+/-- The same parameters as seen under the major binder. -/
+def symbolicMajorParams : List VExpr := [.bvar 2, .bvar 1]
+
+def symbolicMajor : VExpr := .bvar 0
+
+theorem symbolicLevels_wf :
+    ∀ level ∈ symbolicLevels, level.WF 2 := by
+  simp [symbolicLevels, VLevel.WF]
+
+theorem symbolicParams_spine :
+    ∃ resultLevel, dependentRecordEnv.SpineWF 2 symbolicContext
+      (dependentRecordView.familyType.instL symbolicLevels)
+      symbolicMajorParams (.sort resultLevel) := by
+  refine ⟨.max (.succ (.param 0)) (.succ (.param 1)),
+    .cons (by type_tac) ?_⟩
+  exact .cons (by type_tac) .nil
+
+theorem symbolicMajor_hasType :
+    dependentRecordEnv.HasType 2 symbolicContext symbolicMajor
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams) := by
+  exact .bvar .zero
+
+def symbolicKeyCode : VStructureView.ProjectionCode :=
+  (dependentRecordView.projectionCodes symbolicLevels symbolicMajorParams)[0]
+
+def symbolicValueCode : VStructureView.ProjectionCode :=
+  (dependentRecordView.projectionCodes symbolicLevels symbolicMajorParams)[1]
+
+def symbolicFieldContext : List VExpr :=
+  [.app (.bvar 3) (.bvar 0), .bvar 3,
+    dependentRecordView.structureType symbolicLevels symbolicMajorParams] ++
+    symbolicContext
+
+def symbolicConstructorApp : VExpr :=
+  dependentRecordView.projectionConstructorApp symbolicLevels
+    (symbolicMajorParams.map (VExpr.liftN 1))
+    [.bvar 3, .app (.bvar 3) (.bvar 0)]
+
+def symbolicInnerStructureType : VExpr :=
+  dependentRecordView.structureType symbolicLevels [.bvar 5, .bvar 4]
+
+theorem symbolicConstructor_hasType :
+    dependentRecordEnv.HasType 2 symbolicFieldContext symbolicConstructorApp
+      symbolicInnerStructureType := by
+  have hc := VEnv.HasType.const
+    (Γ := symbolicFieldContext) dependentRecord_view_wf.constructor
+      symbolicLevels_wf (by rfl)
+  have hα : dependentRecordEnv.HasType 2 symbolicFieldContext
+      (.bvar 5) (.sort (.succ (.param 0))) := by
+    type_tac
+  have hFamily : dependentRecordEnv.HasType 2 symbolicFieldContext
+      (.bvar 4) (.forallE (.bvar 5) (.sort (.succ (.param 1)))) := by
+    type_tac
+  have hKey : dependentRecordEnv.HasType 2 symbolicFieldContext
+      (.bvar 1) (.bvar 5) := by
+    type_tac
+  have hValue : dependentRecordEnv.HasType 2 symbolicFieldContext
+      (.bvar 0) (.app (.bvar 4) (.bvar 1)) := by
+    type_tac
+  have hcα := hc.app hα
+  have hcFamily := hcα.app hFamily
+  have hcKey := hcFamily.app hKey
+  have hcValue := hcKey.app hValue
+  change dependentRecordEnv.HasType 2 symbolicFieldContext
+    symbolicConstructorApp symbolicInnerStructureType at hcValue
+  exact hcValue
+
+private def takeLamDomains : Nat → VExpr → List VExpr
+  | 0, _ => []
+  | n + 1, .lam A body => A :: takeLamDomains n body
+  | _ + 1, _ => []
+
+private def dropLamBody : Nat → VExpr → VExpr
+  | 0, e => e
+  | n + 1, .lam _ body => dropLamBody n body
+  | _ + 1, e => e
+
+private def dropForallBody : Nat → VExpr → VExpr
+  | 0, e => e
+  | n + 1, .forallE _ body => dropForallBody n body
+  | _ + 1, e => e
+
+theorem symbolicStructure_isType : dependentRecordEnv.IsType 2 symbolicContext
+    (dependentRecordView.structureType symbolicLevels symbolicMajorParams) := by
+  obtain ⟨resultLevel, hspine⟩ := symbolicParams_spine
+  have hfamily := VEnv.HasType.const
+    (Γ := symbolicContext) dependentRecord_view_wf.family
+      symbolicLevels_wf (by rfl)
+  exact ⟨resultLevel, by
+    simpa [VStructureView.structureType] using hspine.hasType_appN hfamily⟩
+
+theorem symbolicMajorBinder_isType : dependentRecordEnv.IsType 2
+    [symbolicFamilyType, symbolicAlphaType] symbolicMajorBinderType := by
+  let resultLevel := VLevel.max (.succ (.param 0)) (.succ (.param 1))
+  have hspine : dependentRecordEnv.SpineWF 2
+      [symbolicFamilyType, symbolicAlphaType]
+      (dependentRecordView.familyType.instL symbolicLevels)
+      [.bvar 1, .bvar 0] (.sort resultLevel) := by
+    refine .cons (by type_tac) ?_
+    exact .cons (by type_tac) .nil
+  have hfamily := VEnv.HasType.const
+    (Γ := [symbolicFamilyType, symbolicAlphaType])
+      dependentRecord_view_wf.family symbolicLevels_wf (by rfl)
+  exact ⟨resultLevel, by
+    simpa [symbolicMajorBinderType, VStructureView.structureType] using
+      hspine.hasType_appN hfamily⟩
+
+theorem symbolicFieldContext_wf :
+    OnCtx symbolicFieldContext (dependentRecordEnv.IsType 2) := by
+  refine ⟨?_, ⟨_, by type_tac⟩⟩
+  refine ⟨?_, ⟨_, by type_tac⟩⟩
+  refine ⟨?_, symbolicStructure_isType⟩
+  refine ⟨?_, symbolicMajorBinder_isType⟩
+  refine ⟨?_, ⟨_, by type_tac⟩⟩
+  exact ⟨trivial, ⟨_, by type_tac⟩⟩
+
+def symbolicKeyMotive : VExpr := symbolicKeyCode.typeFn.liftN 3
+
+def symbolicKeyMinor : VExpr := symbolicKeyCode.minor.liftN 3
+
+def symbolicKeyRuleLevels : List VLevel :=
+  dependentRecordView.projectionLevels symbolicKeyCode.fieldSort symbolicLevels
+
+def symbolicKeyRule : VDefEq := dependentRecordGeneration.generatedRules[0]
+
+def symbolicKeyRuleType : VExpr :=
+  .forallE (.sort (.succ (.param 0)))
+    (.forallE (.forallE (.bvar 0) (.sort (.succ (.param 1))))
+      (.forallE
+        (.forallE
+          (dependentRecordView.structureType symbolicLevels [.bvar 1, .bvar 0])
+          (.sort (.succ (.param 0))))
+        (.forallE
+          (.forallE (.bvar 2)
+            (.forallE (.app (.bvar 2) (.bvar 0))
+              (.app (.bvar 2)
+                (.app
+                  (.app
+                    (.app
+                      (.app (.const ``DependentRecord.mk symbolicLevels)
+                        (.bvar 4))
+                      (.bvar 3))
+                    (.bvar 1))
+                  (.bvar 0)))))
+          (.forallE (.bvar 3)
+            (.forallE (.app (.bvar 3) (.bvar 0))
+              (.app (.bvar 3)
+                (.app
+                  (.app
+                    (.app
+                      (.app (.const ``DependentRecord.mk symbolicLevels)
+                        (.bvar 5))
+                      (.bvar 4))
+                    (.bvar 1))
+                  (.bvar 0))))))))
+
+theorem symbolicKeyRuleType_eq :
+    symbolicKeyRule.type.instL symbolicKeyRuleLevels =
+      symbolicKeyRuleType := rfl
+
+def symbolicKeyRuleArgs : List VExpr :=
+  [.bvar 5, .bvar 4, symbolicKeyMotive, symbolicKeyMinor,
+    .bvar 1, .bvar 0]
+
+def symbolicKeyRuleResult : VExpr :=
+  VExpr.instRev (dropForallBody 6 symbolicKeyRuleType) symbolicKeyRuleArgs
+
+theorem symbolicKeyRule_spine :
+    dependentRecordEnv.SpineWF 2 symbolicFieldContext
+      (symbolicKeyRule.type.instL symbolicKeyRuleLevels)
+      symbolicKeyRuleArgs symbolicKeyRuleResult := by
+  rw [symbolicKeyRuleType_eq]
+  unfold symbolicKeyRuleArgs symbolicKeyRuleResult
+  refine .cons (by type_tac) ?_
+  refine .cons (by type_tac) ?_
+  refine .cons ?_ ?_
+  · have hMotiveShape : symbolicKeyMotive =
+        .lam
+          ((dependentRecordView.structureType symbolicLevels
+            symbolicMajorParams).liftN 3)
+          (.bvar 6) := rfl
+    rw [hMotiveShape]
+    obtain ⟨structureLevel, hstructure⟩ :=
+      symbolicStructure_isType.weakN dependentRecordEnv_ordered
+        (Ctx.LiftN.zero
+          [.app (.bvar 3) (.bvar 0), .bvar 3,
+            dependentRecordView.structureType symbolicLevels
+              symbolicMajorParams])
+    exact VEnv.HasType.lam (u := structureLevel) hstructure (by type_tac)
+  · refine .cons ?_ ?_
+    · change dependentRecordEnv.HasType 2 symbolicFieldContext
+        symbolicKeyMinor
+        (.forallE (.bvar 5)
+          (.forallE (.app (.bvar 5) (.bvar 0))
+            (.app (symbolicKeyMotive.liftN 2)
+              (.app
+                (.app
+                  (.app
+                    (.app (.const ``DependentRecord.mk symbolicLevels)
+                      (.bvar 7))
+                    (.bvar 6))
+                  (.bvar 1))
+                (.bvar 0)))))
+      have hMinorShape : symbolicKeyMinor =
+          .lam (.bvar 5)
+            (.lam (.app (.bvar 5) (.bvar 0)) (.bvar 1)) := rfl
+      rw [hMinorShape]
+      refine .lam (by type_tac) ?_
+      refine .lam (by type_tac) ?_
+      have hMotiveLiftShape : symbolicKeyMotive.liftN 2 =
+          .lam
+            (dependentRecordView.structureType symbolicLevels
+              [.bvar 7, .bvar 6])
+            (.bvar 8) := rfl
+      rw [hMotiveLiftShape]
+      let innerCtor : VExpr :=
+        .app
+          (.app
+            (.app
+              (.app (.const ``DependentRecord.mk symbolicLevels) (.bvar 7))
+              (.bvar 6))
+            (.bvar 1))
+          (.bvar 0)
+      let innerStructure : VExpr :=
+        dependentRecordView.structureType symbolicLevels [.bvar 7, .bvar 6]
+      have hkey : dependentRecordEnv.HasType 2
+          ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+          (.bvar 1) (.bvar 7) := by
+        type_tac
+      have hctor : dependentRecordEnv.HasType 2
+          ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+          innerCtor innerStructure := by
+        have hc := VEnv.HasType.const
+          (Γ := ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 ::
+            symbolicFieldContext))
+          dependentRecord_view_wf.constructor symbolicLevels_wf (by rfl)
+        have hα : dependentRecordEnv.HasType 2
+            ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+            (.bvar 7) (.sort (.succ (.param 0))) := by
+          type_tac
+        have hFamily : dependentRecordEnv.HasType 2
+            ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+            (.bvar 6)
+            (.forallE (.bvar 7) (.sort (.succ (.param 1)))) := by
+          type_tac
+        have hValue : dependentRecordEnv.HasType 2
+            ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+            (.bvar 0) (.app (.bvar 6) (.bvar 1)) := by
+          type_tac
+        have hcValue := (((hc.app hα).app hFamily).app hkey).app hValue
+        change dependentRecordEnv.HasType 2
+          ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+          innerCtor innerStructure at hcValue
+        exact hcValue
+      have hbody : dependentRecordEnv.HasType 2
+          (innerStructure :: (.app (.bvar 5) (.bvar 0)) :: .bvar 5 ::
+            symbolicFieldContext)
+          (.bvar 8) (.sort (.succ (.param 0))) := by
+        dsimp [innerStructure]
+        type_tac
+      have hbetaRaw := VEnv.IsDefEq.beta hbody hctor
+      have hbeta : dependentRecordEnv.IsDefEq 2
+          ((.app (.bvar 5) (.bvar 0)) :: .bvar 5 :: symbolicFieldContext)
+          (.app (.lam innerStructure (.bvar 8)) innerCtor)
+          (.bvar 7) (.sort (.succ (.param 0))) := by
+        simpa [innerCtor, innerStructure, VExpr.inst, VExpr.instVar] using hbetaRaw
+      exact hbeta.symm.defeq hkey
+    · refine .cons (by type_tac) ?_
+      exact .cons (by type_tac) .nil
+
+def symbolicKeyRuleBinders : List VExpr :=
+  takeLamDomains 6 (symbolicKeyRule.lhs.instL symbolicKeyRuleLevels)
+
+def symbolicKeyRuleLhsBody : VExpr :=
+  dropLamBody 6 (symbolicKeyRule.lhs.instL symbolicKeyRuleLevels)
+
+def symbolicKeyRuleRhsBody : VExpr :=
+  dropLamBody 6 (symbolicKeyRule.rhs.instL symbolicKeyRuleLevels)
+
+def symbolicKeyRuleTypeBody : VExpr :=
+  dropForallBody 6 (symbolicKeyRule.type.instL symbolicKeyRuleLevels)
+
+theorem symbolicKeyRule_lhs_shape :
+    symbolicKeyRule.lhs.instL symbolicKeyRuleLevels =
+      VExpr.lamN symbolicKeyRuleBinders symbolicKeyRuleLhsBody := rfl
+
+theorem symbolicKeyRule_rhs_shape :
+    symbolicKeyRule.rhs.instL symbolicKeyRuleLevels =
+      VExpr.lamN symbolicKeyRuleBinders symbolicKeyRuleRhsBody := rfl
+
+theorem symbolicKeyRule_type_shape :
+    symbolicKeyRule.type.instL symbolicKeyRuleLevels =
+      VExpr.forallN symbolicKeyRuleBinders symbolicKeyRuleTypeBody := rfl
+
+theorem symbolicKeyRuleBinders_length : symbolicKeyRuleBinders.length = 6 := rfl
+
+theorem symbolicKeyRuleArgs_length : symbolicKeyRuleArgs.length = 6 := rfl
+
+theorem symbolicKeyRule_registered : dependentRecordEnv.defeqs symbolicKeyRule := by
+  apply dependentRecord_view_wf.rules
+  decide
+
+theorem symbolicKeyRule_levels_wf :
+    ∀ level ∈ symbolicKeyRuleLevels, level.WF 2 := by
+  decide
+
+theorem symbolicKeyRule_levels_length :
+    symbolicKeyRuleLevels.length = symbolicKeyRule.uvars := by
+  decide
+
+theorem symbolicKeyRule_reduces : dependentRecordEnv.IsDefEqU 2
+    symbolicFieldContext
+    (VExpr.instRev symbolicKeyRuleLhsBody symbolicKeyRuleArgs)
+    (VExpr.instRev symbolicKeyRuleRhsBody symbolicKeyRuleArgs) := by
+  have hextra : dependentRecordEnv.IsDefEq 2 symbolicFieldContext
+      (symbolicKeyRule.lhs.instL symbolicKeyRuleLevels)
+      (symbolicKeyRule.rhs.instL symbolicKeyRuleLevels)
+      (symbolicKeyRule.type.instL symbolicKeyRuleLevels) :=
+    .extra symbolicKeyRule_registered symbolicKeyRule_levels_wf
+      symbolicKeyRule_levels_length
+  have happlied := hextra.appN_congr symbolicKeyRule_spine
+  have hlhsType := hextra.hasType.1
+  rw [symbolicKeyRule_lhs_shape] at hlhsType
+  obtain ⟨hlhsTel, lhsType, hlhsBody⟩ := VEnv.HasType.lamN_wf
+    dependentRecordEnv_ordered symbolicFieldContext_wf hlhsType
+  have hlhsSpine := symbolicKeyRule_spine
+  rw [symbolicKeyRule_type_shape] at hlhsSpine
+  have hlhsRetarget := hlhsSpine.retarget
+    (symbolicKeyRuleArgs_length.trans symbolicKeyRuleBinders_length.symm)
+    lhsType
+  have hcollapseL := VEnv.IsDefEq.appN_lamN dependentRecordEnv_ordered
+    hlhsTel hlhsBody hlhsRetarget
+      (symbolicKeyRuleArgs_length.trans symbolicKeyRuleBinders_length.symm)
+  have hrhsType := hextra.hasType.2
+  rw [symbolicKeyRule_rhs_shape] at hrhsType
+  obtain ⟨hrhsTel, rhsType, hrhsBody⟩ := VEnv.HasType.lamN_wf
+    dependentRecordEnv_ordered symbolicFieldContext_wf hrhsType
+  have hrhsSpine := symbolicKeyRule_spine
+  rw [symbolicKeyRule_type_shape] at hrhsSpine
+  have hrhsRetarget := hrhsSpine.retarget
+    (symbolicKeyRuleArgs_length.trans symbolicKeyRuleBinders_length.symm)
+    rhsType
+  have hcollapseR := VEnv.IsDefEq.appN_lamN dependentRecordEnv_ordered
+    hrhsTel hrhsBody hrhsRetarget
+      (symbolicKeyRuleArgs_length.trans symbolicKeyRuleBinders_length.symm)
+  rw [symbolicKeyRule_lhs_shape, symbolicKeyRule_rhs_shape] at happlied
+  exact VEnv.IsDefEqU.trans dependentRecordEnv_wf symbolicFieldContext_wf
+    ⟨_, hcollapseL.symm⟩
+    (VEnv.IsDefEqU.trans dependentRecordEnv_wf symbolicFieldContext_wf
+      ⟨_, happlied⟩ ⟨_, hcollapseR⟩)
+
+theorem symbolicKeyProjector_hasType :
+    dependentRecordEnv.HasType 2 symbolicContext symbolicKeyCode.projector
+      (.forallE
+        (dependentRecordView.structureType symbolicLevels symbolicMajorParams)
+        (.app symbolicKeyCode.typeFn.lift (.bvar 0))) := by
+  obtain ⟨resultLevel, hspine⟩ := symbolicParams_spine
+  have hfamily := VEnv.HasType.const
+    (Γ := symbolicContext) dependentRecord_view_wf.family
+      symbolicLevels_wf (by rfl)
+  have hstructure : dependentRecordEnv.HasType 2 symbolicContext
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams)
+      (.sort resultLevel) := by
+    simpa [VStructureView.structureType] using hspine.hasType_appN hfamily
+  have W : Ctx.LiftN 1 0 symbolicContext
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext) := .one
+  change dependentRecordEnv.HasType 2 symbolicContext (.lam _ _)
+    (.forallE _ _)
+  refine .lam hstructure ?_
+  change dependentRecordEnv.HasType 2
+    (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+      symbolicContext)
+    (VExpr.appN
+      (.const dependentRecordView.recursorName
+        (dependentRecordView.projectionLevels
+          symbolicKeyCode.fieldSort symbolicLevels))
+      (symbolicMajorParams.map (VExpr.liftN 1) ++
+        [symbolicKeyCode.typeFn.lift, symbolicKeyCode.minor.lift,
+          .bvar 0]))
+    (.app symbolicKeyCode.typeFn.lift (.bvar 0))
+  apply dependentRecord_view_wf.recursorProjection_hasType
+    dependentRecordEnv_ordered symbolicLevels symbolicLevels_wf rfl
+    (symbolicMajorParams.map (VExpr.liftN 1)) (by rfl)
+    (fieldSort := symbolicKeyCode.fieldSort)
+  · refine ⟨resultLevel, ?_⟩
+    have hfamilyClosed :
+        (dependentRecordView.familyType.instL symbolicLevels).ClosedN 0 := by
+      simpa using
+        (dependentRecordEnv_ordered.closedC
+          dependentRecord_view_wf.family).instL
+    have hspine' := hspine.weakN dependentRecordEnv_ordered W
+    rw [hfamilyClosed.liftN_eq (Nat.zero_le _)] at hspine'
+    simpa [VExpr.liftN] using hspine'
+  · change VLevel.WF 2 (.succ (.param 0))
+    decide
+  · rfl
+  · exact ⟨resultLevel, by
+      simpa [VExpr.liftN] using hstructure.weakN dependentRecordEnv_ordered W⟩
+  · change dependentRecordEnv.HasType 2
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      (.lam
+        (dependentRecordView.structureType symbolicLevels
+          (symbolicMajorParams.map (VExpr.liftN 1)))
+        (.bvar 4))
+      (.forallE
+        (dependentRecordView.structureType symbolicLevels
+          (symbolicMajorParams.map (VExpr.liftN 1)))
+        (.sort (.succ (.param 0))))
+    refine VEnv.HasType.lam (u := resultLevel) ?_ (by type_tac)
+    simpa [VExpr.liftN] using
+      hstructure.weakN dependentRecordEnv_ordered W
+  · change dependentRecordEnv.HasType 2
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      (.lam (.bvar 3)
+        (.lam (.app (.bvar 3) (.bvar 0)) (.bvar 1)))
+      (.forallE (.bvar 3)
+        (.forallE (.app (.bvar 3) (.bvar 0))
+          (.app
+            (.lam
+              (.app
+                (.app (.const ``DependentRecord symbolicLevels) (.bvar 5))
+                (.bvar 4))
+              (.bvar 6))
+            (.app
+              (.app
+                (.app
+                  (.app (.const ``DependentRecord.mk symbolicLevels)
+                    (.bvar 5))
+                  (.bvar 4))
+                (.bvar 1))
+              (.bvar 0)))))
+    refine .lam (by type_tac) ?_
+    refine .lam (by type_tac) ?_
+    have hkey : dependentRecordEnv.HasType 2
+        ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+          dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+          symbolicContext)
+        (.bvar 1) (.bvar 5) := by
+      type_tac
+    apply (show dependentRecordEnv.IsDefEq 2
+      ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+        dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      (.bvar 5)
+      (.app
+        (.lam
+          (.app
+            (.app (.const ``DependentRecord symbolicLevels) (.bvar 5))
+            (.bvar 4))
+          (.bvar 6))
+        (.app
+          (.app
+            (.app
+              (.app (.const ``DependentRecord.mk symbolicLevels) (.bvar 5))
+              (.bvar 4))
+            (.bvar 1))
+          (.bvar 0)))
+      (.sort (.succ (.param 0))) from ?_).defeq hkey
+    let S : VExpr :=
+      .app
+        (.app (.const ``DependentRecord symbolicLevels) (.bvar 5))
+        (.bvar 4)
+    let ctorApp : VExpr :=
+      .app
+        (.app
+          (.app
+            (.app (.const ``DependentRecord.mk symbolicLevels) (.bvar 5))
+            (.bvar 4))
+          (.bvar 1))
+        (.bvar 0)
+    have hbody : dependentRecordEnv.HasType 2
+        (S :: (.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+          dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+          symbolicContext)
+        (.bvar 6) (.sort (.succ (.param 0))) := by
+      dsimp [S]
+      type_tac
+    have hctor : dependentRecordEnv.HasType 2
+        ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+          dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+          symbolicContext)
+        ctorApp S := by
+      have hc := VEnv.HasType.const
+        (Γ := ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+          dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+          symbolicContext))
+        dependentRecord_view_wf.constructor symbolicLevels_wf (by rfl)
+      have hα : dependentRecordEnv.HasType 2
+          ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.bvar 5) (.sort (.succ (.param 0))) := by
+        type_tac
+      have hFamily : dependentRecordEnv.HasType 2
+          ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.bvar 4)
+          (.forallE (.bvar 5) (.sort (.succ (.param 1)))) := by
+        type_tac
+      have hKey : dependentRecordEnv.HasType 2
+          ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.bvar 1) (.bvar 5) := by
+        type_tac
+      have hValue : dependentRecordEnv.HasType 2
+          ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.bvar 0) (.app (.bvar 4) (.bvar 1)) := by
+        type_tac
+      have hcα := hc.app hα
+      have hcFamily := hcα.app hFamily
+      have hcKey := hcFamily.app hKey
+      have hcValue := hcKey.app hValue
+      change dependentRecordEnv.HasType 2
+        ((.app (.bvar 3) (.bvar 0)) :: .bvar 3 ::
+          dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+          symbolicContext)
+        ctorApp S at hcValue
+      exact hcValue
+    have hbeta := VEnv.IsDefEq.beta hbody hctor
+    simpa [S, ctorApp, VExpr.inst, VExpr.instVar] using hbeta.symm
+  · exact .bvar .zero
+
+def symbolicKeyProjectorBody : VExpr :=
+  match symbolicKeyCode.projector.liftN 3 with
+  | .lam _ body => body
+  | expression => expression
+
+theorem symbolicKeyProjector_lift_shape :
+    symbolicKeyCode.projector.liftN 3 =
+      .lam symbolicInnerStructureType symbolicKeyProjectorBody := by
+  decide
+
+theorem symbolicKeyProjector_beta_shape :
+    symbolicKeyProjectorBody.inst symbolicConstructorApp =
+      VExpr.instRev symbolicKeyRuleLhsBody symbolicKeyRuleArgs := by
+  decide
+
+theorem symbolicKeyRule_rhs_result_shape :
+    VExpr.instRev symbolicKeyRuleRhsBody symbolicKeyRuleArgs =
+      .app (.app symbolicKeyMinor (.bvar 1)) (.bvar 0) := by
+  decide
+
+/-- The generated key projector computes on the generated constructor by
+the registered recursor iota rule. -/
+theorem symbolicKey_constructor_defeq : dependentRecordEnv.IsDefEq 2
+    symbolicFieldContext
+    (.app (symbolicKeyCode.projector.liftN 3) symbolicConstructorApp)
+    (.bvar 1) (.bvar 5) := by
+  have W3 : Ctx.LiftN 3 0 symbolicContext symbolicFieldContext :=
+    .zero [.app (.bvar 3) (.bvar 0), .bvar 3,
+      dependentRecordView.structureType symbolicLevels symbolicMajorParams]
+  have hprojector := symbolicKeyProjector_hasType.weakN
+    dependentRecordEnv_ordered W3
+  rw [symbolicKeyProjector_lift_shape] at hprojector
+  obtain ⟨_, ⟨projectorBodyType, hprojectorBody⟩⟩ :=
+    hprojector.lam_inv dependentRecordEnv_ordered symbolicFieldContext_wf
+  have hprojectorBeta := VEnv.IsDefEq.beta hprojectorBody
+    symbolicConstructor_hasType
+  rw [← symbolicKeyProjector_lift_shape,
+    symbolicKeyProjector_beta_shape] at hprojectorBeta
+  have hprojectorToRule : dependentRecordEnv.IsDefEqU 2
+      symbolicFieldContext
+      (.app (symbolicKeyCode.projector.liftN 3) symbolicConstructorApp)
+      (VExpr.instRev symbolicKeyRuleLhsBody symbolicKeyRuleArgs) :=
+    ⟨projectorBodyType.inst symbolicConstructorApp, hprojectorBeta⟩
+
+  have houterBody : dependentRecordEnv.HasType 2
+      ((.bvar 5) :: symbolicFieldContext)
+      (.lam (.app (.bvar 5) (.bvar 0)) (.bvar 1))
+      (.forallE (.app (.bvar 5) (.bvar 0)) (.bvar 7)) := by
+    refine .lam (by type_tac) (by type_tac)
+  have hkey : dependentRecordEnv.HasType 2 symbolicFieldContext
+      (.bvar 1) (.bvar 5) := by
+    type_tac
+  have houterBeta := VEnv.IsDefEq.beta houterBody hkey
+  change dependentRecordEnv.IsDefEq 2 symbolicFieldContext
+    (.app symbolicKeyMinor (.bvar 1)) _ _ at houterBeta
+  have hvalue : dependentRecordEnv.HasType 2 symbolicFieldContext
+      (.bvar 0) (.app (.bvar 4) (.bvar 1)) := by
+    type_tac
+  have houterApplied := VEnv.IsDefEq.appDF houterBeta hvalue
+  have hinnerBody : dependentRecordEnv.HasType 2
+      ((.app (.bvar 4) (.bvar 1)) :: symbolicFieldContext)
+      (.bvar 2) (.bvar 6) := by
+    type_tac
+  have hinnerBeta := VEnv.IsDefEq.beta hinnerBody hvalue
+  have hminorToKey := houterApplied.trans hinnerBeta
+  rw [← symbolicKeyRule_rhs_result_shape] at hminorToKey
+  have hresult := VEnv.IsDefEqU.trans dependentRecordEnv_wf
+    symbolicFieldContext_wf hprojectorToRule
+    (VEnv.IsDefEqU.trans dependentRecordEnv_wf symbolicFieldContext_wf
+      symbolicKeyRule_reduces ⟨_, hminorToKey⟩)
+  exact hresult.of_r dependentRecordEnv_wf symbolicFieldContext_wf hkey
+
+def symbolicValueTypeFnBody : VExpr :=
+  .app (.bvar 5)
+    (.app (symbolicKeyCode.projector.liftN 4) (.bvar 0))
+
+theorem symbolicValueTypeFn_lift_shape :
+    symbolicValueCode.typeFn.lift.liftN 2 =
+      .lam symbolicInnerStructureType symbolicValueTypeFnBody := by
+  decide
+
+theorem symbolicValueTypeFn_beta_shape :
+    symbolicValueTypeFnBody.inst symbolicConstructorApp =
+      .app (.bvar 4)
+        (.app (symbolicKeyCode.projector.liftN 3)
+          symbolicConstructorApp) := by
+  decide
+
+theorem symbolicValueTypeFnBody_hasType : dependentRecordEnv.HasType 2
+    (symbolicInnerStructureType :: symbolicFieldContext)
+    symbolicValueTypeFnBody (.sort (.succ (.param 1))) := by
+  have W4 : Ctx.LiftN 4 0 symbolicContext
+      (symbolicInnerStructureType :: symbolicFieldContext) :=
+    .zero [symbolicInnerStructureType,
+      .app (.bvar 3) (.bvar 0), .bvar 3,
+      dependentRecordView.structureType symbolicLevels symbolicMajorParams]
+  have hkeyProjector := symbolicKeyProjector_hasType.weakN
+    dependentRecordEnv_ordered W4
+  have hkeyAtMajor := hkeyProjector.app (VEnv.HasType.bvar (.zero))
+  change dependentRecordEnv.HasType 2
+    (symbolicInnerStructureType :: symbolicFieldContext) _
+    (.app
+      (.lam
+        (dependentRecordView.structureType symbolicLevels
+          [.bvar 6, .bvar 5])
+        (.bvar 7))
+      (.bvar 0)) at hkeyAtMajor
+  have hkeyBetaRaw : dependentRecordEnv.IsDefEq 2
+      (symbolicInnerStructureType :: symbolicFieldContext)
+      (.app
+        (.lam
+          (dependentRecordView.structureType symbolicLevels
+            [.bvar 6, .bvar 5])
+          (.bvar 7))
+        (.bvar 0))
+      ((VExpr.bvar 7).inst (.bvar 0))
+      ((VExpr.sort (.succ (.param 0))).inst (.bvar 0)) := by
+    apply VEnv.IsDefEq.beta
+    · type_tac
+    · exact .bvar .zero
+  have hkeyBeta : dependentRecordEnv.IsDefEq 2
+      (symbolicInnerStructureType :: symbolicFieldContext)
+      (.app
+        (.lam
+          (dependentRecordView.structureType symbolicLevels
+            [.bvar 6, .bvar 5])
+          (.bvar 7))
+        (.bvar 0))
+      (.bvar 6) (.sort (.succ (.param 0))) := by
+    simpa [VExpr.inst, VExpr.instVar] using hkeyBetaRaw
+  have hkeyAtMajor' := hkeyBeta.defeq hkeyAtMajor
+  have hfamily : dependentRecordEnv.HasType 2
+      (symbolicInnerStructureType :: symbolicFieldContext)
+      (.bvar 5)
+      (.forallE (.bvar 6) (.sort (.succ (.param 1)))) := by
+    type_tac
+  exact hfamily.app hkeyAtMajor'
+
+theorem symbolicValueProjector_hasType :
+    dependentRecordEnv.HasType 2 symbolicContext symbolicValueCode.projector
+      (.forallE
+        (dependentRecordView.structureType symbolicLevels symbolicMajorParams)
+        (.app symbolicValueCode.typeFn.lift (.bvar 0))) := by
+  obtain ⟨resultLevel, hspine⟩ := symbolicParams_spine
+  have hfamily := VEnv.HasType.const
+    (Γ := symbolicContext) dependentRecord_view_wf.family
+      symbolicLevels_wf (by rfl)
+  have hstructure : dependentRecordEnv.HasType 2 symbolicContext
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams)
+      (.sort resultLevel) := by
+    simpa [VStructureView.structureType] using hspine.hasType_appN hfamily
+  have W : Ctx.LiftN 1 0 symbolicContext
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext) := .one
+  change dependentRecordEnv.HasType 2 symbolicContext (.lam _ _)
+    (.forallE _ _)
+  refine .lam hstructure ?_
+  change dependentRecordEnv.HasType 2
+    (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+      symbolicContext)
+    (VExpr.appN
+      (.const dependentRecordView.recursorName
+        (dependentRecordView.projectionLevels
+          symbolicValueCode.fieldSort symbolicLevels))
+      (symbolicMajorParams.map (VExpr.liftN 1) ++
+        [symbolicValueCode.typeFn.lift, symbolicValueCode.minor.lift,
+          .bvar 0]))
+    (.app symbolicValueCode.typeFn.lift (.bvar 0))
+  apply dependentRecord_view_wf.recursorProjection_hasType
+    dependentRecordEnv_ordered symbolicLevels symbolicLevels_wf rfl
+    (symbolicMajorParams.map (VExpr.liftN 1)) (by rfl)
+    (fieldSort := symbolicValueCode.fieldSort)
+  · refine ⟨resultLevel, ?_⟩
+    have hfamilyClosed :
+        (dependentRecordView.familyType.instL symbolicLevels).ClosedN 0 := by
+      simpa using
+        (dependentRecordEnv_ordered.closedC
+          dependentRecord_view_wf.family).instL
+    have hspine' := hspine.weakN dependentRecordEnv_ordered W
+    rw [hfamilyClosed.liftN_eq (Nat.zero_le _)] at hspine'
+    simpa [VExpr.liftN] using hspine'
+  · change VLevel.WF 2 (.succ (.param 1))
+    decide
+  · rfl
+  · exact ⟨resultLevel, by
+      simpa [VExpr.liftN] using hstructure.weakN dependentRecordEnv_ordered W⟩
+  · change dependentRecordEnv.HasType 2
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      symbolicValueCode.typeFn.lift
+      (.forallE
+        (dependentRecordView.structureType symbolicLevels
+          (symbolicMajorParams.map (VExpr.liftN 1)))
+        (.sort (.succ (.param 1))))
+    change dependentRecordEnv.HasType 2
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      (.lam
+        (dependentRecordView.structureType symbolicLevels
+          (symbolicMajorParams.map (VExpr.liftN 1)))
+        (.app (.bvar 3)
+          (.app (symbolicKeyCode.projector.lift.liftN 1 1) (.bvar 0))))
+      (.forallE
+        (dependentRecordView.structureType symbolicLevels
+          (symbolicMajorParams.map (VExpr.liftN 1)))
+        (.sort (.succ (.param 1))))
+    refine VEnv.HasType.lam (u := resultLevel) ?_ ?_
+    · simpa [VExpr.liftN] using
+        hstructure.weakN dependentRecordEnv_ordered W
+    · have Wbody : Ctx.LiftN 1 0
+          (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (dependentRecordView.structureType symbolicLevels
+              (symbolicMajorParams.map (VExpr.liftN 1)) ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext) := .one
+      have hkeyProjector :=
+        (symbolicKeyProjector_hasType.weakN dependentRecordEnv_ordered W).weakN
+          dependentRecordEnv_ordered Wbody
+      have hkeyAtMajor := hkeyProjector.app (VEnv.HasType.bvar (.zero))
+      have hkeyTypeFn : symbolicKeyCode.typeFn =
+          .lam
+            (dependentRecordView.structureType symbolicLevels symbolicMajorParams)
+            (.bvar 3) := rfl
+      rw [hkeyTypeFn] at hkeyAtMajor
+      change dependentRecordEnv.HasType 2
+        (dependentRecordView.structureType symbolicLevels
+            (symbolicMajorParams.map (VExpr.liftN 1)) ::
+          dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+          symbolicContext)
+        _
+        (.app
+          (.lam
+            (dependentRecordView.structureType symbolicLevels
+              [.bvar 4, .bvar 3])
+            (.bvar 5))
+          (.bvar 0)) at hkeyAtMajor
+      have hkeyBetaRaw : dependentRecordEnv.IsDefEq 2
+          (dependentRecordView.structureType symbolicLevels
+              (symbolicMajorParams.map (VExpr.liftN 1)) ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.app
+            (.lam
+              (dependentRecordView.structureType symbolicLevels
+                [.bvar 4, .bvar 3])
+              (.bvar 5))
+            (.bvar 0))
+          ((VExpr.bvar 5).inst (.bvar 0))
+          ((VExpr.sort (.succ (.param 0))).inst (.bvar 0)) := by
+        apply VEnv.IsDefEq.beta
+        · type_tac
+        · exact .bvar .zero
+      have hkeyBeta : dependentRecordEnv.IsDefEq 2
+          (dependentRecordView.structureType symbolicLevels
+              (symbolicMajorParams.map (VExpr.liftN 1)) ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.app
+            (.lam
+              (dependentRecordView.structureType symbolicLevels
+                [.bvar 4, .bvar 3])
+              (.bvar 5))
+            (.bvar 0))
+          (.bvar 4) (.sort (.succ (.param 0))) := by
+        simpa [VExpr.inst, VExpr.instVar] using hkeyBetaRaw
+      have hkeyAtMajor' := hkeyBeta.defeq hkeyAtMajor
+      have hprojectorLift :
+          VExpr.liftN 1 (VExpr.liftN 1 symbolicKeyCode.projector) =
+          symbolicKeyCode.projector.lift.liftN 1 1 := rfl
+      rw [hprojectorLift] at hkeyAtMajor'
+      have hfamilyAtMajor : dependentRecordEnv.HasType 2
+          (dependentRecordView.structureType symbolicLevels
+              (symbolicMajorParams.map (VExpr.liftN 1)) ::
+            dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+            symbolicContext)
+          (.bvar 3)
+          (.forallE (.bvar 4) (.sort (.succ (.param 1)))) := by
+        type_tac
+      exact hfamilyAtMajor.app hkeyAtMajor'
+  · change dependentRecordEnv.HasType 2
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      (.lam (.bvar 3)
+        (.lam (.app (.bvar 3) (.bvar 0)) (.bvar 0)))
+      (dependentRecordView.projectionMinorType symbolicLevels
+        (symbolicMajorParams.map (VExpr.liftN 1))
+        (dependentRecordView.specializedFields symbolicLevels
+          (symbolicMajorParams.map (VExpr.liftN 1)))
+        symbolicValueCode.typeFn.lift)
+    have hfields : dependentRecordView.specializedFields symbolicLevels
+        (symbolicMajorParams.map (VExpr.liftN 1)) =
+        [.bvar 3, .app (.bvar 3) (.bvar 0)] := rfl
+    rw [hfields]
+    change dependentRecordEnv.HasType 2
+      (dependentRecordView.structureType symbolicLevels symbolicMajorParams ::
+        symbolicContext)
+      (.lam (.bvar 3)
+        (.lam (.app (.bvar 3) (.bvar 0)) (.bvar 0)))
+      (.forallE (.bvar 3)
+        (.forallE (.app (.bvar 3) (.bvar 0))
+          (.app (symbolicValueCode.typeFn.lift.liftN 2)
+            (dependentRecordView.projectionConstructorApp symbolicLevels
+              (symbolicMajorParams.map (VExpr.liftN 1))
+              [.bvar 3, .app (.bvar 3) (.bvar 0)]))))
+    refine .lam (by type_tac) ?_
+    refine .lam (by type_tac) ?_
+    have htargetBeta := VEnv.IsDefEq.beta
+      symbolicValueTypeFnBody_hasType symbolicConstructor_hasType
+    rw [← symbolicValueTypeFn_lift_shape,
+      symbolicValueTypeFn_beta_shape] at htargetBeta
+    have hfamily : dependentRecordEnv.HasType 2 symbolicFieldContext
+        (.bvar 4)
+        (.forallE (.bvar 5) (.sort (.succ (.param 1)))) := by
+      type_tac
+    have htargetToNatural := htargetBeta.trans
+      (VEnv.IsDefEq.appDF hfamily symbolicKey_constructor_defeq)
+    have hvalue : dependentRecordEnv.HasType 2 symbolicFieldContext
+        (.bvar 0) (.app (.bvar 4) (.bvar 1)) := by
+      type_tac
+    exact htargetToNatural.defeq' hvalue
+  · exact .bvar .zero
+
+def symbolicKeyResult : VExpr :=
+  .app symbolicKeyCode.projector symbolicMajor
+
+def symbolicValueResult : VExpr :=
+  .app symbolicValueCode.projector symbolicMajor
+
+theorem key_representable :
+    dependentRecordEnv.TrProj 2 symbolicContext dependentRecordView
+      symbolicLevels symbolicMajorParams 0 symbolicMajor symbolicKeyResult := by
+  refine {
+    viewWF := dependentRecord_view_wf
+    levelsWF := symbolicLevels_wf
+    levels_length := rfl
+    params_length := rfl
+    paramsSpine := symbolicParams_spine
+    majorType := symbolicMajor_hasType
+    program := ⟨symbolicKeyCode, rfl, rfl,
+      symbolicKeyProjector_hasType⟩ }
+
+theorem value_representable :
+    dependentRecordEnv.TrProj 2 symbolicContext dependentRecordView
+      symbolicLevels symbolicMajorParams 1 symbolicMajor symbolicValueResult := by
+  refine {
+    viewWF := dependentRecord_view_wf
+    levelsWF := symbolicLevels_wf
+    levels_length := rfl
+    params_length := rfl
+    paramsSpine := symbolicParams_spine
+    majorType := symbolicMajor_hasType
+    program := ⟨symbolicValueCode, rfl, rfl,
+      symbolicValueProjector_hasType⟩ }
+
+/-- The one generated iota equation used by both projection programs is
+actually registered in the final Theory environment. -/
+example : dependentRecordGeneration.generatedRules.length = 1 := rfl
+
+theorem dependentRecord_rules_registered :
+    ∀ rule ∈ dependentRecordGeneration.generatedRules,
+      dependentRecordEnv.defeqs rule :=
+  dependentRecord_view_wf.rules
+
+/-! ## Frozen legacy surface
+
+The seven fields below preserve the exact pre-Spec-13 theorem shapes.  They
+are intentionally only statement data: constructing this bundle would
+reintroduce the old proof obligations.  In particular, `wf` permits
+unrelated contexts, `uniq` permits unrelated structure names, and every
+field omits the environment, universe instantiation, and parameter spine. -/
+
+abbrev LegacyTrProj :=
+  List VExpr → Name → Nat → VExpr → VExpr → Prop
+
+structure LegacyProjectionLaws (R : LegacyTrProj) : Prop where
+  weak : ∀ {n Γ Γ' s i e e'},
+    Ctx.Lift' n Γ Γ' → R Γ s i e e' →
+      R Γ' s i (e.lift' n) (e'.lift' n)
+  inverseWeakening : ∀ {env U l Γ Γ' s i e e'},
+    VEnv.WF env → OnCtx Γ' (env.IsType U) → Ctx.Lift' l Γ Γ' →
+      R Γ' s i (e.lift' l) e' → ∃ result, R Γ s i e result
+  contextDefEq : ∀ {env U Γ₁ Γ₂ s i e₁ e₂ result},
+    VEnv.WF env → env.IsDefEqCtx U [] Γ₁ Γ₂ →
+      env.IsDefEqU U Γ₁ e₁ e₂ → R Γ₁ s i e₁ result →
+        ∃ result', R Γ₂ s i e₂ result'
+  wellFormed : ∀ {env U Δ Γ s i e result},
+    R Δ s i e result → VExpr.WF env U Γ e →
+      VExpr.WF env U Γ result
+  unique : ∀ {env U Γ₁ Γ₂ s₁ s₂ i e₁ e₂ result₁ result₂},
+    VEnv.WF env → env.IsDefEqCtx U [] Γ₁ Γ₂ →
+      R Γ₁ s₁ i e₁ result₁ → R Γ₂ s₂ i e₂ result₂ →
+        env.IsDefEqU U Γ₁ e₁ e₂ →
+          env.IsDefEqU U Γ₁ result₁ result₂
+  termSubstitution : ∀ {Γ₀ Γ₁ Γ s i e e' e₀ A₀ k},
+    Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ → R Γ₁ s i e e' →
+      R Γ s i (e.inst e₀ k) (e'.inst e₀ k)
+  universeInstantiation : ∀ {U' Γ s i e e'} {ls : List VLevel},
+    (∀ level ∈ ls, level.WF U') → R Γ s i e e' →
+      R (Γ.map (VExpr.instL ls)) s i (e.instL ls) (e'.instL ls)
+
+/-! ## Zero-field behavior -/
+
+universe w
+
+structure EmptyRecord (α : Type w) where
+
+def emptyRecordCtor : VConstVal :=
+  ⟨vconst(type_of% @EmptyRecord.mk), ``EmptyRecord.mk⟩
+
+def emptyRecordType : VInductiveType where
+  name := ``EmptyRecord
+  uvars := 1
+  type := vconst(type_of% @EmptyRecord).type
+  ctors := [emptyRecordCtor]
+
+def emptyRecordDecl : VInductDecl :=
+  ⟨1, 1, [emptyRecordType]⟩
+
+example : emptyRecordDecl.checked?.isSome = true := rfl
+
+def emptyRecordChecked : emptyRecordDecl.Checked :=
+  emptyRecordDecl.checked?.get (by decide)
+
+def emptyRecordGeneration : emptyRecordDecl.GenerationChecked :=
+  emptyRecordChecked.identityGeneration
+
+def emptyRecordView : VStructureView where
+  source := emptyRecordDecl
+  generation := emptyRecordGeneration
+  constructor := emptyRecordGeneration.block.ctorPairs[0]
+  constructor_eq := rfl
+  raw_indices_eq := rfl
+  checked_indices_eq := rfl
+  recursive_eq := rfl
+  fieldSorts := []
+  fieldSorts_length := rfl
+
+def emptyRecordEnv : VEnv :=
+  (VEnv.empty.addInductGeneration emptyRecordGeneration).get (by decide)
+
+theorem emptyRecord_add :
+    VEnv.empty.addInductGeneration emptyRecordGeneration =
+      some emptyRecordEnv := rfl
+
+theorem emptyRecord_trace :
+    Nonempty (VEnv.AddInductGenerationTrace VEnv.empty
+      emptyRecordEnv emptyRecordGeneration) :=
+  VEnv.addInductGeneration_trace emptyRecord_add
+
+theorem emptyRecordDecl_wf : emptyRecordDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = emptyRecordType :=
+    List.mem_singleton.1 (by simpa [emptyRecordDecl] using hty)
+  subst ty
+  refine ⟨⟨⟨_, by type_tac⟩, trivial⟩, ?_⟩
+  intro c hc
+  have hc' : c = emptyRecordCtor := by
+    simpa [emptyRecordType] using hc
+  subst c
+  constructor
+  · simp [emptyRecordDecl, emptyRecordType, emptyRecordCtor,
+      VInductDecl.fieldsWF, VInductDecl.ctorFields,
+      VExpr.dropN]
+  · simp [emptyRecordDecl, emptyRecordType, emptyRecordCtor,
+      VInductDecl.ctorFields, VInductDecl.recFieldIdxs,
+      VInductDecl.sortLevel, VExpr.dropN, VExpr.resultOf,
+      VExpr.forallN, VExpr.liftTelN, VExpr.appArgs]
+    exact .nil
+
+theorem emptyRecordGeneration_wf :
+    emptyRecordGeneration.WF VEnv.empty :=
+  (emptyRecordChecked.wf_of_decl
+    emptyRecordDecl_wf).identityGeneration .empty
+
+theorem emptyRecord_generation_semantics :
+    emptyRecordView.GenerationSemantics emptyRecordEnv := by
+  rcases emptyRecord_trace with ⟨trace⟩
+  exact .ofGenerationTrace emptyRecordGeneration_wf trace
+
+theorem emptyRecord_registered : emptyRecordView.Registered emptyRecordEnv := by
+  rcases emptyRecord_trace with ⟨trace⟩
+  refine {
+    family := trace.family_lookup
+    constructor := ?_
+    recursor := trace.rec_lookup
+    rules := fun _ h => trace.rule_mem h }
+  apply trace.ctor_lookup
+  rw [← emptyRecordGeneration.rawCtors_eq]
+  exact List.mem_map.2 ⟨emptyRecordView.constructor,
+    by
+      change emptyRecordView.constructor ∈
+        emptyRecordView.generation.block.ctorPairs
+      rw [emptyRecordView.constructor_eq]
+      simp,
+    rfl⟩
+
+theorem emptyRecord_view_wf : emptyRecordView.WF emptyRecordEnv := by
+  refine {
+    toRegistered := emptyRecord_registered
+    generationSemantics := emptyRecord_generation_semantics
+    parameters := ⟨⟨_, by type_tac⟩, trivial⟩
+    parameters_length := rfl
+    fieldTelescope := .nil
+    smallFields := ?_ }
+  intro _ level hlevel
+  change level ∈ ([] : List VLevel) at hlevel
+  contradiction
+
+example : emptyRecordView.fields = [] := rfl
+
+example : emptyRecordView.projectionCodes [.param 0] [.bvar 0] = [] := rfl
+
+theorem emptyRecord_project_none (idx : Nat) (major : VExpr) :
+    emptyRecordView.project? [.param 0] [.bvar 0] idx major = none := by
+  simp [VStructureView.project?, show
+    emptyRecordView.projectionCodes [.param 0] [.bvar 0] = [] from rfl]
+
+#guard_named_axioms Ix.Theory.Named.Tests.ProjectionExpressibility.dependentRecord_view_wf [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.Tests.ProjectionExpressibility.key_representable [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.Tests.ProjectionExpressibility.value_representable [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.Tests.ProjectionExpressibility.emptyRecord_project_none [propext, Classical.choice, Quot.sound]
+
+end Ix.Theory.Named.Tests.ProjectionExpressibility
diff --git a/Ix/Theory/Named/Inductive.lean b/Ix/Theory/Named/Inductive.lean
new file mode 100644
index 000000000..2e67b9fd2
--- /dev/null
+++ b/Ix/Theory/Named/Inductive.lean
@@ -0,0 +1,3045 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.VDecl
+import Ix.Theory.Named.Typing.Basic
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+deriving instance DecidableEq for VLevel
+deriving instance DecidableEq for VExpr
+
+/-- Syntactic underapproximation of `VLevel.IsNeverZero`,
+mirroring `Lean.Level.isNeverZero`. -/
+def _root_.Ix.Theory.VLevel.isNeverZero : VLevel → Bool
+  | .zero | .param _ => false
+  | .succ _ => true
+  | .max l₁ l₂ => l₁.isNeverZero || l₂.isNeverZero
+  | .imax _ l₂ => l₂.isNeverZero
+
+instance VExpr.decClosedN : ∀ (e : VExpr) (k : Nat), Decidable (e.ClosedN k)
+  | .bvar i, k => inferInstanceAs (Decidable (i < k))
+  | .sort .., _ | .const .., _ => inferInstanceAs (Decidable True)
+  | .app e1 e2, k => @instDecidableAnd _ _ (decClosedN e1 k) (decClosedN e2 k)
+  | .lam e1 e2, k => @instDecidableAnd _ _ (decClosedN e1 k) (decClosedN e2 (k+1))
+  | .forallE e1 e2, k => @instDecidableAnd _ _ (decClosedN e1 k) (decClosedN e2 (k+1))
+
+instance VExpr.decLevelWF : ∀ (e : VExpr) (U : Nat), Decidable (e.LevelWF U)
+  | .bvar _, _ => inferInstanceAs (Decidable True)
+  | .sort l, U => VLevel.decidable_WF (n := U) (l := l)
+  | .const _ ls, U => inferInstanceAs (Decidable (∀ l ∈ ls, l.WF U))
+  | .app e1 e2, U | .lam e1 e2, U | .forallE e1 e2, U =>
+    @instDecidableAnd _ _ (decLevelWF e1 U) (decLevelWF e2 U)
+
+def VExpr.hasConst (n : Name) : VExpr → Bool
+  | .bvar _ | .sort _ => false
+  | .const c _ => c == n
+  | .app e1 e2 | .lam e1 e2 | .forallE e1 e2 => e1.hasConst n || e2.hasConst n
+
+/-- Context lifting changes only bound-variable indices and therefore
+preserves the constants occurring in a Theory expression. -/
+@[simp] theorem VExpr.hasConst_lift' (expression : VExpr) (lift : Lift)
+    (name : Name) :
+    (expression.lift' lift).hasConst name = expression.hasConst name := by
+  induction expression generalizing lift <;>
+    simp [VExpr.hasConst, *]
+
+/-- `[.bvar (off+m-1), ..., .bvar off]`: the spine referring to the last `m`
+binders, skipping the innermost `off`. -/
+def VExpr.bvarRevRange (off : Nat) : Nat → List VExpr
+  | 0 => []
+  | m+1 => .bvar (off + m) :: bvarRevRange off m
+
+/-- Iterated lambda; the binder list is outermost first. -/
+def VExpr.lamN : List VExpr → VExpr → VExpr
+  | [], e => e
+  | A :: As, e => .lam A (lamN As e)
+
+/-- Iterated pi; the binder list is outermost first. -/
+def VExpr.forallN : List VExpr → VExpr → VExpr
+  | [], e => e
+  | A :: As, e => .forallE A (forallN As e)
+
+/-- Insert `n` binders below a telescope at depth `k`: the entry at depth
+`j` within the telescope lifts by `n` at cutoff `k+j`. -/
+def VExpr.liftTelN (n : Nat) : List VExpr → Nat → List VExpr
+  | [], _ => []
+  | A :: As, k => A.liftN n k :: liftTelN n As (k+1)
+
+/-- The first `n` binder types of an iterated pi, outermost first. -/
+def VExpr.telN : Nat → VExpr → List VExpr
+  | 0, _ => []
+  | n+1, .forallE A rest => A :: telN n rest
+  | _+1, _ => []
+
+/-- Strip `n` binders from an iterated pi. -/
+def VExpr.dropN : Nat → VExpr → VExpr
+  | 0, e => e
+  | n+1, .forallE _ rest => dropN n rest
+  | _+1, e => e
+
+/-- The result of an iterated pi. -/
+def VExpr.resultOf : VExpr → VExpr
+  | .forallE _ rest => resultOf rest
+  | e => e
+
+/-- The application spine arguments, outermost first. -/
+def VExpr.appArgs : VExpr → List VExpr → List VExpr
+  | .app f a, acc => appArgs f (a :: acc)
+  | _, acc => acc
+
+def VExpr.appHead : VExpr → VExpr
+  | .app f _ => appHead f
+  | e => e
+
+/-- The levels `[.param k, ..., .param (n+k-1)]`; `VLevel.params` shifted by `k`.
+The recursor universe list is the elimination level (`.param 0`) followed by
+the declaration's levels shifted by one, so declaration-world expressions
+enter the recursor's universe context via `instL (params' n 1)`. -/
+def _root_.Ix.Theory.VLevel.params' (n k : Nat) : List VLevel := (List.range n).map fun i => .param (i + k)
+
+/-- Well-formedness of a binder telescope over a context. -/
+def VEnv.OnTel (env : VEnv) (U : Nat) : List VExpr → List VExpr → Prop
+  | _, [] => True
+  | Γ, A :: As => env.IsType U Γ A ∧ OnTel env U (A :: Γ) As
+
+/-- Pointwise definitional equality of two binder telescopes, checked in the
+context generated by the left (raw) telescope. This is deliberately stronger
+than whole-`forall` equality: it is the structural evidence a normalizer must
+produce so mixed raw/view artifacts never need `forall` injectivity to recover
+their binder alignment. -/
+def VEnv.TelDefEq (env : VEnv) (U : Nat) :
+    List VExpr → List VExpr → List VExpr → Prop
+  | _, [], [] => True
+  | Γ, A :: As, A' :: As' =>
+    (∃ u, env.IsDefEq U Γ A A' (.sort u)) ∧
+      TelDefEq env U (A :: Γ) As As'
+  | _, _, _ => False
+
+namespace VInductDecl
+
+variable (U : Nat) (T : Name) (np : Nat)
+
+/-- The result sort of an inductive type past its parameters and
+indices. -/
+def sortLevel (ty : VInductiveType) : VLevel :=
+  match VExpr.resultOf (VExpr.dropN np ty.type) with
+  | .sort l => l
+  | _ => .zero
+
+/-- Constructor field types, outermost first. -/
+def ctorFields : VExpr → List VExpr
+  | .forallE B rest => B :: ctorFields rest
+  | _ => []
+
+/-- The block type applied to its parameters, seen from `off` binders past
+the parameter telescope (declaration universes). -/
+def recApp (off : Nat) : VExpr :=
+  VExpr.appN (.const T (VLevel.params U)) (VExpr.bvarRevRange off np)
+
+/-- Is `B` a direct recursive occurrence at field depth `j`: the block
+constant applied to the parameter variables and `ni` block-free index
+arguments. -/
+def isRecField (ni j : Nat) (B : VExpr) : Bool :=
+  VExpr.appHead B == .const T (VLevel.params U) &&
+  (VExpr.appArgs B []).length == np + ni &&
+  (VExpr.appArgs B []).take np == VExpr.bvarRevRange j np &&
+  ((VExpr.appArgs B []).drop np).all fun e => !e.hasConst T
+
+/-- The index arguments of a recursive occurrence (or of a constructor's
+result). -/
+def recFieldIdxs (B : VExpr) : List VExpr := (VExpr.appArgs B []).drop np
+
+/-- One recursive constructor argument after normalization. `binders` is the
+possibly empty Pi telescope leading to the recursive target. `fieldIndex`
+addresses the constructor field itself, while target indices live under both
+the preceding constructor fields and these binders. `targetType` is the
+source-ordered family ordinal retained by block analysis; it remains zero in
+the one-family compatibility analyzer. -/
+structure RecArg where
+  fieldIndex : Nat
+  binders : List VExpr
+  targetType : Nat
+  indices : List VExpr
+
+/-- Whether an expression mentions any family in a block.  Mutual analysis
+uses one block-wide name set in family formers, recursive-Pi domains, and
+recursive indices; checking only the current family would miss negative
+occurrences of its siblings. -/
+def _root_.Ix.Theory.Named.VExpr.hasAnyConst (names : List Name) (e : VExpr) : Bool :=
+  names.any e.hasConst
+
+/-- The part of a family declaration needed to recognize a recursive target.
+The position of a header in `familyHeaders` is the `RecArg.targetType` stored
+by the block analyzer. -/
+structure FamilyHeader where
+  name : Name
+  indices : Nat
+
+/-- Family headers in declaration order. -/
+def familyHeaders (np : Nat) (types : List VInductiveType) :
+    List FamilyHeader :=
+  types.map fun ty =>
+    ⟨ty.name, (ctorFields (VExpr.dropN np ty.type)).length⟩
+
+/-- Recognize an application of any family in a mutual block.  The returned
+ordinal is its exact position in `headers`; parameter arguments must be the
+shared parameter variables and every index must be free of all block
+families. -/
+def blockTarget? (U np j : Nat) (headers : List FamilyHeader)
+    (names : List Name) (B : VExpr) : Option (Nat × List VExpr) :=
+  let head := B.appHead
+  let args := B.appArgs []
+  let rec loop (target : Nat) : List FamilyHeader →
+      Option (Nat × List VExpr)
+    | [] => none
+    | header :: headers =>
+      if head == .const header.name (VLevel.params U) &&
+          args.length == np + header.indices &&
+          args.take np == VExpr.bvarRevRange j np &&
+          (args.drop np).all fun e => !e.hasAnyConst names then
+        some (target, args.drop np)
+      else
+        loop (target + 1) headers
+  loop 0 headers
+
+/-- Recognize a recursive mutual target below a possibly empty positive Pi
+telescope.  No block family may occur in a Pi domain. -/
+def blockRecTarget? (U np : Nat) (headers : List FamilyHeader)
+    (names : List Name) : Nat → VExpr →
+      Option (List VExpr × Nat × List VExpr)
+  | j, .forallE A rest =>
+    if A.hasAnyConst names then none
+    else
+      match blockRecTarget? U np headers names (j+1) rest with
+      | some (binders, target, indices) =>
+        some (A :: binders, target, indices)
+      | none => none
+  | j, B =>
+    match blockTarget? U np j headers names B with
+    | some (target, indices) => some ([], target, indices)
+    | none => none
+
+/-- Analyze one constructor field against every family in a block. -/
+def blockRecArg? (U np : Nat) (headers : List FamilyHeader)
+    (names : List Name) (j : Nat) (B : VExpr) : Option RecArg :=
+  match blockRecTarget? U np headers names j B with
+  | some (binders, targetType, indices) =>
+    some { fieldIndex := j, binders, targetType, indices }
+  | none => none
+
+/-- Recursive arguments in source field order, with block-relative target
+ordinals. -/
+def blockRecArgs (U np : Nat) (headers : List FamilyHeader)
+    (names : List Name) : List VExpr → (j : Nat := 0) → List RecArg
+  | [], _ => []
+  | B :: Bs, j =>
+    match blockRecArg? U np headers names j B with
+    | some r => r :: blockRecArgs U np headers names Bs (j+1)
+    | none => blockRecArgs U np headers names Bs (j+1)
+
+/-- Positional mutual recursive classification for every constructor field.
+Unlike `blockRecArgs`, this list retains `none` entries, giving semantic
+consumers an exact field-by-field alignment without rerunning the analyzer. -/
+def blockRecArgsAt (U np : Nat) (headers : List FamilyHeader)
+    (names : List Name) : List VExpr → (j : Nat := 0) →
+      List (Option RecArg)
+  | [], _ => []
+  | B :: Bs, j =>
+    blockRecArg? U np headers names j B ::
+      blockRecArgsAt U np headers names Bs (j + 1)
+
+/-- A mutual constructor field is either a positive recursive target of some
+family in the block or is free of every block family. -/
+def blockStage3Field (U np : Nat) (headers : List FamilyHeader)
+    (names : List Name) (j : Nat) (B : VExpr) : Bool :=
+  (blockRecArg? U np headers names j B).isSome ||
+    !B.hasAnyConst names
+
+/-- Structural mutual constructor shape.  Fields may target any family, but
+the constructor result must target its owning family ordinal. -/
+def blockStage3Ctor (U np : Nat) (headers : List FamilyHeader)
+    (names : List Name) (owner : Nat) : Nat → VExpr → Bool
+  | j, .forallE B rest =>
+    blockStage3Field U np headers names j B &&
+      blockStage3Ctor U np headers names owner (j+1) rest
+  | j, result =>
+    match blockTarget? U np j headers names result with
+    | some (target, _) => target == owner
+    | none => false
+
+/-- Recognize the kernel's one-family `isRecArg` shape in raw VExpr normal
+form. Pi domains must be free of the family (the local strict-positivity
+condition); the terminal target must be the family applied to the declaration
+parameters and family-free indices. The returned telescope is outermost first.
+-/
+def recTarget? (ni : Nat) : Nat → VExpr → Option (List VExpr × List VExpr)
+  | j, .forallE A rest =>
+    if A.hasConst T then none
+    else
+      match recTarget? ni (j+1) rest with
+      | some (As, idxs) => some (A :: As, idxs)
+      | none => none
+  | j, B =>
+    if isRecField U T np ni j B then some ([], recFieldIdxs np B) else none
+
+/-- Analyze a constructor field as a recursive argument, retaining its outer
+field position and the complete binder telescope leading to the target. -/
+def recArg? (ni j : Nat) (B : VExpr) : Option RecArg :=
+  match recTarget? U T np ni j B with
+  | some (binders, indices) =>
+    some { fieldIndex := j, binders, targetType := 0, indices }
+  | none => none
+
+/-- Recursive arguments of a constructor field telescope, in field order. -/
+def recArgs (ni : Nat) : List VExpr → (j : Nat := 0) → List RecArg
+  | [], _ => []
+  | B :: Bs, j =>
+    match recArg? U T np ni j B with
+    | some r => r :: recArgs ni Bs (j+1)
+    | none => recArgs ni Bs (j+1)
+
+/-- Positional one-family recursive classification retained for compatibility
+with the block-wide checked-constructor representation. -/
+def recArgsAt (ni : Nat) : List VExpr → (j : Nat := 0) →
+    List (Option RecArg)
+  | [], _ => []
+  | B :: Bs, j => recArg? U T np ni j B :: recArgsAt ni Bs (j + 1)
+
+/-- Positions of the directly recursive fields, with their index
+arguments (`j` counts binders past the parameters). -/
+def recPairs (ni : Nat) : List VExpr → (j : Nat := 0) → List (Nat × List VExpr)
+  | [], _ => []
+  | B :: Bs, j =>
+    if isRecField U T np ni j B then (j, recFieldIdxs np B) :: recPairs ni Bs (j+1)
+    else recPairs ni Bs (j+1)
+
+/-- Induction-hypothesis binder types for the recursive positions with
+their (recursor-universe) index arguments, at depth `p` past the `m`
+field binders in context `params ++ [motive]`: the `p`-th is
+`motive idxs xⱼ`, the index arguments shifted from field depth `j` (past
+the parameters, no motive) into position. -/
+def ihsFrom (m : Nat) : List (Nat × List VExpr) → Nat → List VExpr
+  | [], _ => []
+  | (j, idxs) :: rs, p =>
+    VExpr.appN (.bvar (m+p))
+      ((idxs.map fun e => (e.liftN 1 j).liftN (m-j+p)) ++ [.bvar (m-1-j+p)]) ::
+    ihsFrom m rs (p+1)
+
+/-- A stage-3 field is either an analyzed recursive argument (possibly under
+a strictly-positive Pi telescope) or a type not mentioning the block at all.
+The analyzer rejects family occurrences in recursive-Pi domains and indices.
+-/
+def stage3Field (ni j : Nat) (B : VExpr) : Bool :=
+  (recArg? U T np ni j B).isSome || !B.hasConst T
+
+/-- Stage-3 constructor type past the parameters: a telescope of stage-3
+fields ending in the block's type constant applied to the parameters and
+block-free index arguments. -/
+def stage3Ctor (ni : Nat) : Nat → VExpr → Bool
+  | j, .forallE B rest => stage3Field U T np ni j B && stage3Ctor ni (j+1) rest
+  | j, e => isRecField U T np ni j e
+
+/-- Levels that are structurally forced to evaluate to zero. This is the
+environment-free fragment needed to recognize proof-valued constructor
+fields; Verify supplies the exact ordinary-checker sort observations. -/
+def _root_.Ix.Theory.VLevel.isDefinitelyZero : VLevel → Bool
+  | .zero => true
+  | .max l₁ l₂ => l₁.isDefinitelyZero && l₂.isDefinitelyZero
+  | .imax _ l₂ => l₂.isDefinitelyZero
+  | .param _ | .succ _ => false
+
+/-- Partial local type synthesis used only to recognize fields whose inferred
+sort is structurally `Prop`. Constants and terms requiring reduction remain
+unknown and are conservatively treated as data. -/
+def inferLocalType? (Γ : List VExpr) : VExpr → Option VExpr
+  | .bvar i => Γ[i]?
+  | .sort l => some (.sort (.succ l))
+  | .const _ _ => none
+  | .app f a => do
+    let .forallE _ body ← inferLocalType? Γ f | none
+    return body.inst a
+  | .lam A body => do
+    let bodyType ← inferLocalType? (A :: Γ) body
+    return .forallE A bodyType
+  | .forallE A body => do
+    let .sort u ← inferLocalType? Γ A | none
+    let .sort v ← inferLocalType? (A :: Γ) body | none
+    return .sort (.imax u v)
+
+/-- Whether the partial local synthesis proves that a binder is a proof. -/
+def knownProofField (Γ : List VExpr) (B : VExpr) : Bool :=
+  match inferLocalType? Γ B with
+  | some (.sort l) => l.isDefinitelyZero
+  | _ => false
+
+/-- The kernel's singleton large-elimination criterion. Recursive arguments
+and proof fields impose no recovery condition; every remaining data field
+must occur literally in the constructor result's index spine. The proof-field
+test is a conservative environment-free reflection here and is connected to
+the exact checker result by Verify. -/
+def subsingletonOK (ni : Nat) (ct : VExpr) : Bool :=
+  let Bs := ctorFields (VExpr.dropN np ct)
+  let m := Bs.length
+  let ridx := recFieldIdxs np (VExpr.resultOf (VExpr.dropN np ct))
+  let rec loop (Γ : List VExpr) (j : Nat) : List VExpr → Bool
+    | [] => true
+    | B :: Bs =>
+      ((recArg? U T np ni j B).isSome || knownProofField Γ B ||
+        ridx.contains (.bvar (m-1-j))) &&
+      loop (B :: Γ) (j+1) Bs
+  loop (VExpr.telN np ct).reverse 0 Bs
+
+/-- Large elimination: a never-zero result sort, or the (syntactic)
+subsingleton criterion. -/
+def largeElim (ni : Nat) (ty : VInductiveType) : Bool :=
+  (sortLevel np ty).isNeverZero ||
+  match ty.ctors with
+  | [] => true
+  | [c] => subsingletonOK U T np ni c.type
+  | _ => false
+
+/-- The constructor-shape fragment of the kernel's K-target test. Only the
+visible shared-parameter prefix may precede the constructor result. -/
+def isKTargetCtor (nparams : Nat) : Nat → VExpr → Bool
+  | i, .forallE _ body =>
+      i < nparams && isKTargetCtor nparams (i + 1) body
+  | _, _ => true
+
+/-- Whether a checked one-family declaration receives the kernel's K-like
+recursor reduction flag. This decision is deliberately independent of
+`largeElim`: K eligibility must never be used to bypass the ordinary
+large-elimination criterion. -/
+def isKTarget (np : Nat) (resultLevel : VLevel)
+    (ty : VInductiveType) : Bool :=
+  resultLevel == .zero &&
+    match ty.ctors with
+    | [ctor] => isKTargetCtor np 0 ctor.type
+    | _ => false
+
+/-- A family type is checked before its own constant is declared, so neither
+its parameter nor index domains may already mention the family. This is the
+one-family form of `checkInductiveTypes`' pre-environment type check. -/
+def typeFormerOK (np : Nat) (ty : VInductiveType) : Bool :=
+  (VExpr.telN np ty.type).all (fun e => !e.hasConst ty.name) &&
+  (ctorFields (VExpr.dropN np ty.type)).all (fun e => !e.hasConst ty.name)
+
+/-- The direct indexed recursion checks proved by the Stage-3 metatheory. -/
+def stage3DirectCore (U np : Nat) (ty : VInductiveType) : Bool :=
+  let ni := (ctorFields (VExpr.dropN np ty.type)).length
+  ty.uvars == U &&
+  (VExpr.telN np ty.type).length == np &&
+  (match VExpr.resultOf (VExpr.dropN np ty.type) with
+    | .sort l => decide (l.WF U)
+    | _ => false) &&
+  typeFormerOK np ty &&
+  ty.ctors.all fun c => c.uvars == U &&
+    VExpr.telN np c.type == VExpr.telN np ty.type &&
+    stage3Ctor U ty.name np ni 0 (VExpr.dropN np c.type)
+
+/-- Names reserved by a one-family transaction, in insertion order. -/
+def generatedNames (ty : VInductiveType) : List Name :=
+  ty.name :: (ty.ctors.map (fun c => c.name) ++ [.str ty.name "rec"])
+
+/-- Internal duplicate/collision check, matching the sequential kernel name
+reservations before any object becomes observable. -/
+def namesOK (ty : VInductiveType) : Bool := decide (generatedNames ty).Nodup
+
+/-- Kernel metadata types are closed before checking. Keeping this in the
+computational descriptor prevents `addInduct` from accepting a hand-built
+declaration with loose variables even when its result spine has the expected
+head. -/
+def closedOK (ty : VInductiveType) : Bool :=
+  decide (ty.type.ClosedN 0) && ty.ctors.all fun c => decide (c.type.ClosedN 0)
+
+/-- Every universe annotation in the family and constructor metadata must
+refer to one of the declaration's universe parameters. The result-sort check
+alone is insufficient: bad parameters or fields can hide an out-of-range
+level while leaving the result universe valid. -/
+def levelsOK (U : Nat) (ty : VInductiveType) : Bool :=
+  decide (ty.type.LevelWF U) && ty.ctors.all fun c => decide (c.type.LevelWF U)
+
+/-- The boolean core of the current one-family checker. Keeping this named
+separately from `checked?` lets proofs unpack the accepted checks while all
+consumers obtain their normalized data from the same descriptor. -/
+def stage3Core : VInductDecl → Bool
+  | ⟨U, np, [ty]⟩ =>
+    stage3DirectCore U np ty && (namesOK ty && (closedOK ty && levelsOK U ty))
+  | _ => false
+
+/-- Family names in exact declaration order. -/
+def familyNames (types : List VInductiveType) : List Name :=
+  types.map (·.name)
+
+/-- The shared parameter telescope selected by the first family.  Empty
+blocks are rejected by `checkedBlock?`; defining this total function keeps the
+dependent traversal itself free of a singleton/nonempty witness. -/
+def blockParams (np : Nat) : List VInductiveType → List VExpr
+  | [] => []
+  | ty :: _ => VExpr.telN np ty.type
+
+/-- A family former in a mutual block is checked before any family constant
+is staged, so every parameter and index domain must be free of every family
+in the block. -/
+def blockTypeFormerOK (np : Nat) (names : List Name)
+    (ty : VInductiveType) : Bool :=
+  (VExpr.telN np ty.type).all (fun e => !e.hasAnyConst names) &&
+    (ctorFields (VExpr.dropN np ty.type)).all
+      (fun e => !e.hasAnyConst names)
+
+/-- Names reserved by the mutual pipeline: all families, then all constructors
+in family/source order, then one recursor per family.  Validation retains this
+order as checked data, and the block transaction inserts the same three
+constant phases before installing generated rules. -/
+def blockGeneratedNames (types : List VInductiveType) : List Name :=
+  types.map (·.name) ++
+    types.flatMap (fun ty => ty.ctors.map (·.name)) ++
+    types.map (fun ty => .str ty.name "rec")
+
+/-- Block-wide duplicate/collision check for all future generated names. -/
+def blockNamesOK (types : List VInductiveType) : Bool :=
+  decide (blockGeneratedNames types).Nodup
+
+/-- Environment-free structural representation check for one family in a
+mutual block.  It checks raw metadata anatomy and cross-family positivity.
+Environment-sensitive normalization, shared-result-universe semantics, and
+staging are supplied separately by `ValidatedBlock.WF` and
+`ValidationCertificate`. -/
+def blockFamilyCore (source : VInductDecl) (params : List VExpr)
+    (owner : Nat) (ty : VInductiveType) : Bool :=
+  let names := familyNames source.types
+  let headers := familyHeaders source.nparams source.types
+  ty.uvars == source.uvars &&
+    params.length == source.nparams &&
+    VExpr.telN source.nparams ty.type == params &&
+    (match VExpr.resultOf (VExpr.dropN source.nparams ty.type) with
+      | .sort l => decide (l.WF source.uvars)
+      | _ => false) &&
+    blockTypeFormerOK source.nparams names ty &&
+    closedOK ty && levelsOK source.uvars ty &&
+    ty.ctors.all fun c =>
+      c.uvars == source.uvars &&
+        VExpr.telN source.nparams c.type == params &&
+        blockStage3Ctor source.uvars source.nparams headers names owner 0
+          (VExpr.dropN source.nparams c.type)
+
+/-- Constructor identities retained across normalization. Types may change by
+WHNF/definitional equality, but names, universe arities, order, and count may
+not. -/
+def sameCtorHeaders : List VConstVal → List VConstVal → Bool
+  | [], [] => true
+  | c :: cs, c' :: cs' =>
+    c.name == c'.name && c.uvars == c'.uvars && sameCtorHeaders cs cs'
+  | _, _ => false
+
+/-- Family identities retained across normalization. -/
+def sameTypeHeaders : List VInductiveType → List VInductiveType → Bool
+  | [], [] => true
+  | ty :: tys, ty' :: tys' =>
+    ty.name == ty'.name && ty.uvars == ty'.uvars &&
+      sameCtorHeaders ty.ctors ty'.ctors && sameTypeHeaders tys tys'
+  | _, _ => false
+
+/-- Computational coherence between stored kernel metadata and a normalized
+analysis view. Normalization may change expression payloads only; declaration
+arity and every generated identity remain fixed. -/
+def normalizationShape (source view : VInductDecl) : Bool :=
+  source.uvars == view.uvars &&
+    source.nparams == view.nparams &&
+    sameTypeHeaders source.types view.types
+
+/-- Constructor headers are reflexively coherent. Kept computational so the
+identity normalization below reduces without an external oracle. -/
+theorem sameCtorHeaders_refl : ∀ cs, sameCtorHeaders cs cs = true
+  | [] => rfl
+  | c :: cs => by
+    change ((c.name == c.name) && (c.uvars == c.uvars) &&
+      sameCtorHeaders cs cs) = true
+    rw [beq_self_eq_true, beq_self_eq_true, sameCtorHeaders_refl]
+    rfl
+
+/-- Family headers are reflexively coherent. -/
+theorem sameTypeHeaders_refl : ∀ tys, sameTypeHeaders tys tys = true
+  | [] => rfl
+  | ty :: tys => by
+    change ((ty.name == ty.name) && (ty.uvars == ty.uvars) &&
+      sameCtorHeaders ty.ctors ty.ctors && sameTypeHeaders tys tys) = true
+    rw [beq_self_eq_true, beq_self_eq_true, sameCtorHeaders_refl,
+      sameTypeHeaders_refl]
+    rfl
+
+theorem normalizationShape_refl (source : VInductDecl) :
+    normalizationShape source source = true := by
+  change ((source.uvars == source.uvars) &&
+    (source.nparams == source.nparams) &&
+    sameTypeHeaders source.types source.types) = true
+  rw [beq_self_eq_true, beq_self_eq_true, sameTypeHeaders_refl]
+  rfl
+
+/-- A named, environment-independent normalization boundary. `source` is the
+stored declaration whose constants must be added to the Theory environment;
+`view` is the WHNF/defeq-normalized syntax inspected by the inductive
+analyzer. The boolean coherence proof prevents normalization from changing
+declaration identities or ordering. -/
+structure Normalization (source : VInductDecl) where
+  view : VInductDecl
+  shape_eq : normalizationShape source view = true
+
+/-- Construct a normalization boundary by computation. -/
+def normalization? (source view : VInductDecl) : Option (Normalization source) :=
+  if h : normalizationShape source view then some ⟨view, h⟩ else none
+
+/-- Identity normalization is the compatibility path for declarations already
+in the analyzer's raw VExpr normal form. -/
+def Normalization.identity (source : VInductDecl) : Normalization source where
+  view := source
+  shape_eq := normalizationShape_refl source
+
+/-- Semantic validity of a one-family normalization view. The family type is
+definitionally equal in the input environment; constructor types are
+definitionally equal after the raw family constant has been introduced, which
+matches the staging of the kernel's inductive check. `Normalization.BlockWF`
+is the arbitrary-block counterpart. -/
+def Normalization.WF {source : VInductDecl} (norm : Normalization source)
+    (env : VEnv) : Prop :=
+  ∃ raw view,
+    source.types = [raw] ∧ norm.view.types = [view] ∧
+    env.IsDefEqU source.uvars [] raw.type view.type ∧
+    ∀ envT, env.addConst raw.name raw.toVConstant = some envT →
+      List.Forall₂
+        (fun rawCtor viewCtor =>
+          envT.IsDefEqU source.uvars [] rawCtor.type viewCtor.type)
+        raw.ctors view.ctors
+
+/-- Stage every raw family constant, in source order, without adding any
+constructors, recursors, or reduction rules.  This is the Theory image of the
+environment used by Lean between `declareInductiveTypes` and
+`checkConstructors`; it is deliberately validation-only. -/
+def _root_.Ix.Theory.Named.VEnv.stageInductiveTypes (env : VEnv)
+    (types : List VInductiveType) : Option VEnv :=
+  types.foldlM (fun env type =>
+    env.addConst type.name type.toVConstant) env
+
+/-- Semantic validity of a normalization view for an arbitrary mutual block.
+
+Every family type is compared in the common input environment.  The exact raw
+family list is then staged as one source-ordered fold, and every constructor
+comparison is performed in the resulting shared environment.  The nested
+`Forall₂` relations retain family and constructor order and cannot truncate a
+reordered or shorter view. -/
+def Normalization.BlockWF {source : VInductDecl}
+    (norm : Normalization source) (env blockEnv : VEnv) : Prop :=
+  env.stageInductiveTypes source.types = some blockEnv ∧
+    List.Forall₂
+      (fun raw view =>
+        env.IsDefEqU source.uvars [] raw.type view.type ∧
+          List.Forall₂
+            (fun rawCtor viewCtor =>
+              blockEnv.IsDefEqU source.uvars []
+                rawCtor.type viewCtor.type)
+            raw.ctors view.ctors)
+      source.types norm.view.types
+
+/-- Whether the recursor may eliminate into a fresh universe or is confined
+to `Prop`. -/
+inductive ElimMode where
+  | large
+  | small
+  deriving DecidableEq, Repr
+
+/-- Interpret the ordinary checker's Boolean large-elimination result in the
+consumer-neutral Theory representation. -/
+def ElimMode.ofBool : Bool → ElimMode
+  | false => .small
+  | true => .large
+
+@[simp] theorem ElimMode.ofBool_false : ElimMode.ofBool false = .small := rfl
+@[simp] theorem ElimMode.ofBool_true : ElimMode.ofBool true = .large := rfl
+
+/-- Universe-slot offset used by recursor metadata. Large elimination inserts
+the fresh motive universe before the declaration universes; small elimination
+adds no universe parameter. -/
+def ElimMode.offset : ElimMode → Nat
+  | .large => 1
+  | .small => 0
+
+/-- Universe arity of the generated recursor. -/
+abbrev ElimMode.recUvars (mode : ElimMode) (U : Nat) : Nat := U + mode.offset
+
+/-- The motive's result level in the recursor universe context. -/
+def ElimMode.motiveLevel : ElimMode → VLevel
+  | .large => .param 0
+  | .small => .zero
+
+/-- Declaration universes as seen by the recursor. Large elimination shifts
+them past the fresh motive level; small elimination retains their order. -/
+abbrev ElimMode.sourceLevels (mode : ElimMode) (U : Nat) : List VLevel :=
+  VLevel.params' U mode.offset
+
+/-- Identity universe arguments for recursive calls to the generated
+recursor. -/
+abbrev ElimMode.recLevels (mode : ElimMode) (U : Nat) : List VLevel :=
+  VLevel.params (mode.recUvars U)
+
+@[simp] theorem ElimMode.large_offset : ElimMode.large.offset = 1 := rfl
+@[simp] theorem ElimMode.small_offset : ElimMode.small.offset = 0 := rfl
+
+@[simp] theorem ElimMode.large_recUvars (U : Nat) :
+    ElimMode.large.recUvars U = U + 1 := rfl
+
+@[simp] theorem ElimMode.small_recUvars (U : Nat) :
+    ElimMode.small.recUvars U = U := by
+  simp [ElimMode.recUvars, ElimMode.offset]
+
+@[simp] theorem ElimMode.large_sourceLevels (U : Nat) :
+    ElimMode.large.sourceLevels U = VLevel.params' U 1 := rfl
+
+@[simp] theorem ElimMode.small_sourceLevels (U : Nat) :
+    ElimMode.small.sourceLevels U = VLevel.params U := rfl
+
+@[simp] theorem ElimMode.large_motiveLevel :
+    ElimMode.large.motiveLevel = .param 0 := rfl
+
+@[simp] theorem ElimMode.small_motiveLevel :
+    ElimMode.small.motiveLevel = .zero := rfl
+
+/-- Environment-free elimination analysis used by the raw compatibility
+path. Verify's ordinary checker replay refines the singleton criterion with
+the exact inferred field sorts. -/
+def eliminationMode (U : Nat) (T : Name) (np ni : Nat)
+    (ty : VInductiveType) : ElimMode :=
+  if largeElim U T np ni ty then .large else .small
+
+/-- Normalized data for one constructor. -/
+structure CheckedCtor where
+  value : VConstVal
+  fields : List VExpr
+  recursive : List RecArg
+  recursiveAt : List (Option RecArg)
+  resultIndices : List VExpr
+
+def CheckedCtor.ofDirect (U : Nat) (T : Name) (np ni : Nat)
+    (c : VConstVal) : CheckedCtor where
+  value := c
+  fields := ctorFields (VExpr.dropN np c.type)
+  recursive := recArgs U T np ni (ctorFields (VExpr.dropN np c.type))
+  recursiveAt := recArgsAt U T np ni (ctorFields (VExpr.dropN np c.type))
+  resultIndices := recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))
+
+/-- Analyze one constructor against the complete source-ordered family block.
+Unlike `ofDirect`, recursive descriptors retain the ordinal of a sibling
+target instead of forcing `targetType := 0`. -/
+def CheckedCtor.ofBlock (source : VInductDecl)
+    (c : VConstVal) : CheckedCtor where
+  value := c
+  fields := ctorFields (VExpr.dropN source.nparams c.type)
+  recursive := blockRecArgs source.uvars source.nparams
+    (familyHeaders source.nparams source.types) (familyNames source.types)
+    (ctorFields (VExpr.dropN source.nparams c.type))
+  recursiveAt := blockRecArgsAt source.uvars source.nparams
+    (familyHeaders source.nparams source.types) (familyNames source.types)
+    (ctorFields (VExpr.dropN source.nparams c.type))
+  resultIndices := recFieldIdxs source.nparams
+    (VExpr.resultOf (VExpr.dropN source.nparams c.type))
+
+/-- Checked representation of one family at its exact block ordinal.  The
+family itself is a type index rather than a replaceable field; this prevents a
+descriptor from being reused for another position or declaration. -/
+structure CheckedFamily (source : VInductDecl) (params : List VExpr)
+    (ordinal : Nat) (type : VInductiveType) where
+  params_eq : VExpr.telN source.nparams type.type = params
+  indices : List VExpr
+  indices_eq : indices = ctorFields (VExpr.dropN source.nparams type.type)
+  resultLevel : VLevel
+  result_eq : VExpr.resultOf (VExpr.dropN source.nparams type.type) =
+    .sort resultLevel
+  constructors : List CheckedCtor
+  constructors_eq : constructors = type.ctors.map (CheckedCtor.ofBlock source)
+  accepted : blockFamilyCore source params ordinal type = true
+
+/-- Recover the source family indexing a checked family. -/
+def CheckedFamily.value {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {type : VInductiveType}
+    (_ : CheckedFamily source params ordinal type) : VInductiveType :=
+  type
+
+/-- Recover the block-relative ordinal indexing a checked family. -/
+def CheckedFamily.ordinal {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {type : VInductiveType}
+    (_ : CheckedFamily source params ordinal type) : Nat :=
+  ordinal
+
+/-- A genuinely dependent family spine.  Its list index is the exact suffix
+of `source.types`, and its natural-number index is the ordinal of that
+suffix's head.  Consequently neither family order nor recursive-target
+numbering is represented by an unchecked parallel list. -/
+inductive CheckedFamilies (source : VInductDecl) (params : List VExpr) :
+    Nat → List VInductiveType → Type where
+  | nil {ordinal : Nat} : CheckedFamilies source params ordinal []
+  | cons {ordinal : Nat} {type : VInductiveType}
+      {types : List VInductiveType}
+      (head : CheckedFamily source params ordinal type)
+      (tail : CheckedFamilies source params (ordinal + 1) types) :
+      CheckedFamilies source params ordinal (type :: types)
+
+namespace CheckedFamilies
+
+/-- Erase only the dependent evidence, retaining exact family source order. -/
+def values {source : VInductDecl} {params : List VExpr} :
+    {ordinal : Nat} → {types : List VInductiveType} →
+      CheckedFamilies source params ordinal types → List VInductiveType
+  | _, _, .nil => []
+  | _, _, .cons head tail => head.value :: values tail
+
+/-- Erasing a dependent family spine recovers its exact source-list index. -/
+@[simp] theorem values_eq {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {types : List VInductiveType}
+    (families : CheckedFamilies source params ordinal types) :
+    families.values = types := by
+  induction families with
+  | nil => rfl
+  | cons head tail ih =>
+    simp only [values, CheckedFamily.value]
+    rw [ih]
+
+/-- Family ordinals in the same order as `values`. -/
+def ordinals {source : VInductDecl} {params : List VExpr} :
+    {ordinal : Nat} → {types : List VInductiveType} →
+      CheckedFamilies source params ordinal types → List Nat
+  | _, _, .nil => []
+  | _, _, .cons head tail => head.ordinal :: ordinals tail
+
+/-- Per-family index telescopes in declaration order. -/
+def indices {source : VInductDecl} {params : List VExpr} :
+    {ordinal : Nat} → {types : List VInductiveType} →
+      CheckedFamilies source params ordinal types → List (List VExpr)
+  | _, _, .nil => []
+  | _, _, .cons head tail => head.indices :: indices tail
+
+/-- Per-family result levels in declaration order. -/
+def resultLevels {source : VInductDecl} {params : List VExpr} :
+    {ordinal : Nat} → {types : List VInductiveType} →
+      CheckedFamilies source params ordinal types → List VLevel
+  | _, _, .nil => []
+  | _, _, .cons head tail => head.resultLevel :: resultLevels tail
+
+/-- Ordered constructor descriptors, grouped by source family. -/
+def constructors {source : VInductDecl} {params : List VExpr} :
+    {ordinal : Nat} → {types : List VInductiveType} →
+      CheckedFamilies source params ordinal types → List (List CheckedCtor)
+  | _, _, .nil => []
+  | _, _, .cons head tail => head.constructors :: constructors tail
+
+/-- Family names projected from the dependent source spine. -/
+def names {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {types : List VInductiveType}
+    (families : CheckedFamilies source params ordinal types) : List Name :=
+  families.values.map (·.name)
+
+/-- Constructor names retain both family order and within-family order. -/
+def constructorNames {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {types : List VInductiveType}
+    (families : CheckedFamilies source params ordinal types) :
+    List (List Name) :=
+  families.constructors.map fun constructors =>
+    constructors.map (·.value.name)
+
+/-- Recursive target ordinals retain family, constructor, and field order. -/
+def recursiveTargets {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {types : List VInductiveType}
+    (families : CheckedFamilies source params ordinal types) :
+    List (List (List Nat)) :=
+  families.constructors.map fun constructors =>
+    constructors.map fun constructor =>
+      constructor.recursive.map (·.targetType)
+
+end CheckedFamilies
+
+/-- Check one family while retaining every computed representation component.
+This is a pure structural pass; no environment or generated constant is an
+input. -/
+def checkedFamily? (source : VInductDecl) (params : List VExpr)
+    (ordinal : Nat) (type : VInductiveType) :
+    Option (CheckedFamily source params ordinal type) :=
+  let indices := ctorFields (VExpr.dropN source.nparams type.type)
+  match hresult : VExpr.resultOf (VExpr.dropN source.nparams type.type) with
+  | .sort resultLevel =>
+    if hparams : VExpr.telN source.nparams type.type = params then
+      if haccepted : blockFamilyCore source params ordinal type then
+        some {
+          params_eq := hparams
+          indices
+          indices_eq := rfl
+          resultLevel
+          result_eq := hresult
+          constructors := type.ctors.map (CheckedCtor.ofBlock source)
+          constructors_eq := rfl
+          accepted := haccepted }
+      else none
+    else none
+  | _ => none
+
+/-- Analyze an arbitrary source-ordered family list into the dependent spine.
+The ordinal advances together with the list index. -/
+def checkedFamilies? (source : VInductDecl) (params : List VExpr) :
+    (ordinal : Nat) → (types : List VInductiveType) →
+      Option (CheckedFamilies source params ordinal types)
+  | _, [] => some .nil
+  | ordinal, type :: types => do
+    let head ← checkedFamily? source params ordinal type
+    let tail ← checkedFamilies? source params (ordinal + 1) types
+    return .cons head tail
+
+/-- Source-indexed checked representation of a complete inductive block.
+Shared parameters are stored once; every per-family component lives in the
+dependent `families` spine indexed by `source.types` itself.  This is the
+Spec-08A analysis boundary and intentionally has no generation or insertion
+projection. -/
+structure CheckedBlock (source : VInductDecl) where
+  params : List VExpr
+  params_eq : params = blockParams source.nparams source.types
+  params_length : params.length = source.nparams
+  families : CheckedFamilies source params 0 source.types
+  nonempty : source.types.isEmpty = false
+  names : List Name
+  names_eq : names = blockGeneratedNames source.types
+  names_nodup : names.Nodup
+
+/-- Analyze a complete block without singleton destructuring.  Empty blocks,
+inconsistent raw parameter surfaces, malformed families/constructors, and
+block-wide generated-name collisions are rejected before a descriptor is
+returned. -/
+def checkedBlock? (source : VInductDecl) : Option source.CheckedBlock :=
+  let params := blockParams source.nparams source.types
+  if hnonempty : source.types.isEmpty = false then
+    if hparams : params.length = source.nparams then
+      if hnames : (blockGeneratedNames source.types).Nodup then
+        match checkedFamilies? source params 0 source.types with
+        | some families => some {
+            params
+            params_eq := rfl
+            params_length := hparams
+            families
+            nonempty := hnonempty
+            names := blockGeneratedNames source.types
+            names_eq := rfl
+            names_nodup := hnames }
+        | none => none
+      else none
+    else none
+  else none
+
+/-- Analyze the normalized view of an arbitrary source block.  The
+`Normalization` index fixes every family and constructor header while the
+dependent `CheckedBlock` fixes the complete normalized family order. -/
+def Normalization.checkedBlock? {source : VInductDecl}
+    (norm : Normalization source) : Option norm.view.CheckedBlock :=
+  norm.view.checkedBlock?
+
+/-- One accepted raw/view mutual block.  Unlike the legacy
+`NormalizedChecked`, this type performs no singleton projection and exposes no
+generation operation. -/
+structure NormalizedCheckedBlock (source : VInductDecl) where
+  normalization : Normalization source
+  checked : normalization.view.CheckedBlock
+  checked_eq : normalization.checkedBlock? = some checked
+
+/-- Analyze one normalization boundary and retain the exact dependent block
+descriptor that accepted its view. -/
+def Normalization.checkBlock? {source : VInductDecl}
+    (norm : Normalization source) : Option (NormalizedCheckedBlock source) :=
+  match hchecked : norm.checkedBlock? with
+  | some checked => some ⟨norm, checked, hchecked⟩
+  | none => none
+
+/-- Construct and analyze a raw/view mutual normalization in one
+computational transaction. -/
+def normalizedCheckedBlock? (source view : VInductDecl) :
+    Option (NormalizedCheckedBlock source) := do
+  let norm ← normalization? source view
+  norm.checkBlock?
+
+/-- Compatibility analyzer for a block already in analyzer normal form. -/
+def identityCheckedBlock? (source : VInductDecl) :
+    Option (NormalizedCheckedBlock source) :=
+  (Normalization.identity source).checkBlock?
+
+/-- The validator-owned shared result universe paired with one exact checked
+normalization view.  Universe equality is semantic (`VLevel.Equiv`) and is
+therefore certified by `ValidatedBlock.WF`, not guessed by the structural
+analyzer. -/
+structure ValidatedBlock (source : VInductDecl) where
+  block : NormalizedCheckedBlock source
+  resultLevel : VLevel
+
+/-- Data-bearing compatibility result for the one-family generation path.
+`CheckedBlock` and `ValidatedBlock` provide the public block-wide analysis and
+validation; this legacy singleton projection remains available for existing
+one-family certificates.  The descriptor is dependent on its source
+declaration, so it cannot silently describe a different block. -/
+structure Checked (source : VInductDecl) where
+  type : VInductiveType
+  types_eq : source.types = [type]
+  params : List VExpr
+  params_eq : params = VExpr.telN source.nparams type.type
+  indices : List VExpr
+  indices_eq : indices = ctorFields (VExpr.dropN source.nparams type.type)
+  resultLevel : VLevel
+  result_eq : VExpr.resultOf (VExpr.dropN source.nparams type.type) = .sort resultLevel
+  elimination : ElimMode
+  elimination_eq : elimination =
+    eliminationMode source.uvars type.name source.nparams indices.length type
+  kTarget : Bool
+  kTarget_eq : kTarget = isKTarget source.nparams resultLevel type
+  names : List Name
+  names_eq : names = generatedNames type
+  constructors : List CheckedCtor
+  constructors_eq : constructors = type.ctors.map
+    (CheckedCtor.ofDirect source.uvars type.name source.nparams indices.length)
+  accepted : stage3Core source = true
+
+/-- Analyze the current direct-indexed class once and retain every normalized
+component needed downstream. This is intentionally an `Option` rather than a
+boolean so successful checking cannot discard the analysis it just computed. -/
+def checked? : (decl : VInductDecl) → Option decl.Checked
+  | ⟨U, np, [ty]⟩ =>
+    match hresult : VExpr.resultOf (VExpr.dropN np ty.type) with
+    | .sort l =>
+      if h : stage3Core ⟨U, np, [ty]⟩ then
+        let indices := ctorFields (VExpr.dropN np ty.type)
+        some {
+          type := ty
+          types_eq := rfl
+          params := VExpr.telN np ty.type
+          params_eq := rfl
+          indices
+          indices_eq := rfl
+          resultLevel := l
+          result_eq := hresult
+          elimination := eliminationMode U ty.name np indices.length ty
+          elimination_eq := rfl
+          kTarget := isKTarget np l ty
+          kTarget_eq := rfl
+          names := generatedNames ty
+          names_eq := rfl
+          constructors := ty.ctors.map (CheckedCtor.ofDirect U ty.name np indices.length)
+          constructors_eq := rfl
+          accepted := h }
+      else none
+    | _ => none
+  | _ => none
+
+/-- A checked descriptor is proof-irrelevantly unique for its source
+declaration. Every data field is fixed by the equations stored in `Checked`;
+the remaining fields are propositions. -/
+theorem Checked.unique {decl : VInductDecl}
+    (a b : decl.Checked) : a = b := by
+  have htype : a.type = b.type := by
+    have hb := b.types_eq
+    rw [a.types_eq] at hb
+    injection hb
+  have hparams : a.params = b.params := by
+    rw [a.params_eq, b.params_eq, htype]
+  have hindices : a.indices = b.indices := by
+    rw [a.indices_eq, b.indices_eq, htype]
+  have hlevel : a.resultLevel = b.resultLevel := by
+    have hb := b.result_eq
+    rw [← htype, a.result_eq] at hb
+    injection hb
+  have helim : a.elimination = b.elimination := by
+    rw [a.elimination_eq, b.elimination_eq, htype, hindices]
+  have hkTarget : a.kTarget = b.kTarget := by
+    rw [a.kTarget_eq, b.kTarget_eq, htype, hlevel]
+  have hnames : a.names = b.names := by
+    rw [a.names_eq, b.names_eq, htype]
+  have hctors : a.constructors = b.constructors := by
+    rw [a.constructors_eq, b.constructors_eq, htype, hindices]
+  cases a
+  cases b
+  simp_all
+
+/-- Possessing a checked descriptor proves that the analyzer succeeds. This
+is kept separate from uniqueness because reducing the dependent match in
+`checked?` only needs its Boolean success result. -/
+theorem Checked.analyzer_isSome {decl : VInductDecl}
+    (checked : decl.Checked) : decl.checked?.isSome = true := by
+  cases decl with
+  | mk U np types =>
+      rcases checked with
+        ⟨type, types_eq, params, params_eq,
+          indices, indices_eq, resultLevel, result_eq,
+          elimination, elimination_eq, kTarget, kTarget_eq, names, names_eq,
+          constructors, constructors_eq, accepted⟩
+      change types = [type] at types_eq
+      subst types
+      subst params
+      subst indices
+      subst kTarget
+      subst names
+      subst constructors
+      change (VExpr.dropN np type.type).resultOf =
+        .sort resultLevel at result_eq
+      simp only [VInductDecl.checked?]
+      split <;> simp_all
+
+/-- Every `Checked` value is the exact data-bearing result returned by the
+analyzer. Consumers can therefore package an already-retained witness without
+running or choosing a second analysis. -/
+theorem Checked.analyzer_eq {decl : VInductDecl}
+    (checked : decl.Checked) : decl.checked? = some checked := by
+  cases h : decl.checked? with
+  | none =>
+      have his := checked.analyzer_isSome
+      simp [h] at his
+  | some actual =>
+      exact congrArg some (actual.unique checked)
+
+/-- The layout fragment of `stage3DirectCore` needed to pair an identity
+normalization position-for-position. -/
+theorem Checked.direct_layout {decl : VInductDecl}
+    (checked : decl.Checked) :
+    (VExpr.telN decl.nparams checked.type.type).length = decl.nparams ∧
+      ∀ c ∈ checked.type.ctors,
+        (VExpr.telN decl.nparams c.type).length = decl.nparams := by
+  cases decl with
+  | mk U np types =>
+      have htypes : types = [checked.type] := checked.types_eq
+      have hcore := checked.accepted
+      simp only [stage3Core, htypes, Bool.and_eq_true] at hcore
+      have hdirect := hcore.1
+      simp only [stage3DirectCore, Bool.and_eq_true, beq_iff_eq,
+        List.all_eq_true] at hdirect
+      obtain ⟨⟨⟨⟨-, hparams⟩, -⟩, -⟩, hctors⟩ := hdirect
+      refine ⟨hparams, fun c hc => ?_⟩
+      rw [(hctors c hc).1.2]
+      exact hparams
+
+/-- Analyze an explicit normalized view without consulting the environment.
+Semantic soundness is supplied separately by `Normalization.WF`; this split
+matches the existing `Checked`/`Checked.WF` contract. -/
+def Normalization.checked? {source : VInductDecl} (norm : Normalization source) :
+    Option norm.view.Checked :=
+  norm.view.checked?
+
+/-- Acceptance of an explicit normalized view. -/
+def Normalization.accepted {source : VInductDecl} (norm : Normalization source) : Bool :=
+  norm.checked?.isSome
+
+/-- One accepted raw/view pair. The raw declaration remains the index of this
+object; every WHNF-sensitive decision is retained in the single checked view
+that produced `checked_eq`. -/
+structure NormalizedChecked (source : VInductDecl) where
+  normalization : Normalization source
+  sourceType : VInductiveType
+  source_types_eq : source.types = [sourceType]
+  checked : normalization.view.Checked
+  checked_eq : normalization.checked? = some checked
+
+/-- Analyze a normalization once and retain the exact dependent checked
+descriptor that drove acceptance. -/
+def Normalization.check? {source : VInductDecl} (norm : Normalization source) :
+    Option (NormalizedChecked source) :=
+  match hsource : source.types with
+  | [sourceType] =>
+    match hchecked : norm.checked? with
+    | some checked => some ⟨norm, sourceType, hsource, checked, hchecked⟩
+    | none => none
+  | _ => none
+
+/-- Construct and analyze a raw/view pair in one computational transaction. -/
+def normalizedChecked? (source view : VInductDecl) : Option (NormalizedChecked source) := do
+  let norm ← normalization? source view
+  norm.check?
+
+/-- Compatibility analyzer for metadata already accepted in raw syntax. -/
+def identityChecked? (source : VInductDecl) : Option (NormalizedChecked source) :=
+  (Normalization.identity source).check?
+
+/-- Repackage an already-retained analyzer witness through the identity
+normalization boundary. This is the compatibility block used by the public
+`Checked` artifact accessors. -/
+def Checked.identityBlock {decl : VInductDecl}
+    (checked : decl.Checked) : NormalizedChecked decl where
+  normalization := Normalization.identity decl
+  sourceType := checked.type
+  source_types_eq := checked.types_eq
+  checked := checked
+  checked_eq := checked.analyzer_eq
+
+/-- One raw constructor paired, by position, with the checked descriptor from
+the normalized view. The raw value owns kernel-observable binder syntax;
+`view` owns WHNF-sensitive recursive classification and result indices. -/
+structure NormalizedCtor where
+  raw : VConstVal
+  view : CheckedCtor
+
+/-- Positional pairing used by the mixed artifact layer. A separate layout
+check below rejects unequal list lengths instead of relying on `zip`'s
+truncation behavior. -/
+def pairNormalizedCtors : List VConstVal → List CheckedCtor → List NormalizedCtor
+  | raw :: raws, view :: views =>
+    ⟨raw, view⟩ :: pairNormalizedCtors raws views
+  | _, _ => []
+
+/-- Raw constructor fields, kept distinct from the normalized fields stored in
+the checked view. -/
+def NormalizedCtor.rawFields (ctor : NormalizedCtor) (np : Nat) : List VExpr :=
+  ctorFields (VExpr.dropN np ctor.raw.type)
+
+/-- All stored raw constructor binders, including the constructor's own
+parameter prefix. -/
+def NormalizedCtor.declaredBinders (ctor : NormalizedCtor) (np : Nat) :
+    List VExpr :=
+  VExpr.telN np ctor.raw.type ++ ctor.rawFields np
+
+/-- The result retained in the stored raw constructor type. -/
+def NormalizedCtor.rawResult (ctor : NormalizedCtor) (np : Nat) : VExpr :=
+  VExpr.resultOf (VExpr.dropN np ctor.raw.type)
+
+/-- The structural facts required before raw binders and normalized recursive
+facts may drive one artifact. Semantic defeq remains the responsibility of
+`Normalization.WF`; this Boolean only certifies positional layout. -/
+def NormalizedCtor.generationShape (np : Nat) (ctor : NormalizedCtor) : Bool :=
+  ctor.raw.name == ctor.view.value.name &&
+    ctor.raw.uvars == ctor.view.value.uvars &&
+    (VExpr.telN np ctor.raw.type).length == np &&
+    (ctor.rawFields np).length == ctor.view.fields.length
+
+def NormalizedChecked.rawParams {source : VInductDecl}
+    (block : NormalizedChecked source) : List VExpr :=
+  VExpr.telN source.nparams block.sourceType.type
+
+def NormalizedChecked.rawIndices {source : VInductDecl}
+    (block : NormalizedChecked source) : List VExpr :=
+  ctorFields (VExpr.dropN source.nparams block.sourceType.type)
+
+/-- The raw family result after its parameter and index binders. -/
+def NormalizedChecked.rawResult {source : VInductDecl}
+    (block : NormalizedChecked source) : VExpr :=
+  VExpr.resultOf (VExpr.dropN source.nparams block.sourceType.type)
+
+/-- Whether a stored parameter domain has one of the four top-level type
+annotations consumed by Lean before it creates the common recursor parameter
+telescope.  Ordinary reducible constants are intentionally not inspected:
+their raw syntax remains observable in generated kernel metadata. -/
+def _root_.Ix.Theory.Named.VExpr.hasTypeAnnotation : VExpr → Bool
+  | .app (.const name _) _ =>
+    name == ``_root_.outParam || name == ``_root_.semiOutParam
+  | .app (.app (.const name _) _) _ =>
+    name == ``_root_.optParam || name == ``_root_.autoParam
+  | _ => false
+
+/-- Parameter surface emitted by recursor generation. Annotation wrappers use
+the analyzer-owned consumed view; every other parameter keeps the stored raw
+domain even when its WHNF differs. -/
+def generationParam (raw view : VExpr) : VExpr :=
+  if raw.hasTypeAnnotation then view else raw
+
+/-- Positional common-parameter telescope used by generated artifacts. -/
+def generationParams : List VExpr → List VExpr → List VExpr
+  | raw :: raws, view :: views =>
+    generationParam raw view :: generationParams raws views
+  | _, _ => []
+
+@[simp] theorem generationParams_self :
+    ∀ params, generationParams params params = params
+  | [] => rfl
+  | param :: params => by
+    simp [generationParams, generationParam, generationParams_self params]
+
+theorem generationParams_length_of_eq :
+    ∀ {raw view : List VExpr}, raw.length = view.length →
+      (generationParams raw view).length = raw.length
+  | [], [], _ => rfl
+  | _ :: _, _ :: _, h => by
+    simp only [generationParams, List.length_cons]
+    exact congrArg Nat.succ
+      (generationParams_length_of_eq (Nat.succ.inj h))
+
+def NormalizedChecked.generationParams {source : VInductDecl}
+    (block : NormalizedChecked source) : List VExpr :=
+  VInductDecl.generationParams block.rawParams block.checked.params
+
+def NormalizedChecked.ctorPairs {source : VInductDecl}
+    (block : NormalizedChecked source) : List NormalizedCtor :=
+  pairNormalizedCtors block.sourceType.ctors block.checked.constructors
+
+/-- Executable layout gate for mixed raw/view generation. It proves that every
+raw binder position has exactly one normalized analysis position without
+claiming that their expression payloads are syntactically equal. -/
+def NormalizedChecked.generationShape {source : VInductDecl}
+    (block : NormalizedChecked source) : Bool :=
+  block.rawParams.length == source.nparams &&
+    block.rawParams.length == block.checked.params.length &&
+    block.rawIndices.length == block.checked.indices.length &&
+    block.ctorPairs.length == block.sourceType.ctors.length &&
+    block.ctorPairs.length == block.checked.constructors.length &&
+    block.ctorPairs.all (NormalizedCtor.generationShape source.nparams)
+
+/-- Pairing a constructor list with its direct checked analysis preserves its
+length and satisfies every per-constructor identity-layout check. -/
+theorem pairNormalizedCtors_ofDirect_generationShape
+    (U : Nat) (T : Name) (np ni : Nat) :
+    ∀ (cs : List VConstVal),
+      (∀ c ∈ cs, (VExpr.telN np c.type).length = np) →
+      let pairs := pairNormalizedCtors cs
+        (cs.map (CheckedCtor.ofDirect U T np ni))
+      pairs.length = cs.length ∧
+        pairs.all (NormalizedCtor.generationShape np) = true
+  | [], _ => by simp [pairNormalizedCtors]
+  | c :: cs, h => by
+      have hc := h c (.head _)
+      have hcs : ∀ c ∈ cs, (VExpr.telN np c.type).length = np :=
+        fun c hc => h c (.tail _ hc)
+      have ih := pairNormalizedCtors_ofDirect_generationShape
+        U T np ni cs hcs
+      simp [pairNormalizedCtors, NormalizedCtor.generationShape,
+        CheckedCtor.ofDirect, NormalizedCtor.rawFields, hc, ih]
+
+/-- A normalized checked block whose raw outer telescopes are positionally
+usable by artifact generation. This is still analysis data, not semantic
+normalization evidence; preservation additionally requires
+`NormalizedChecked.WF`. -/
+structure GenerationChecked (source : VInductDecl) where
+  block : NormalizedChecked source
+  shape_eq : block.generationShape = true
+
+/-- Identity normalization always satisfies the mixed generator's positional
+layout gate. The only non-reflexive facts are the parameter and constructor
+parameter lengths already certified by Stage 3. -/
+theorem Checked.identityBlock_generationShape {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityBlock.generationShape = true := by
+  have hp : (VExpr.telN decl.nparams checked.type.type).length =
+      decl.nparams := checked.direct_layout.1
+  have hcs : ∀ c ∈ checked.type.ctors,
+      (VExpr.telN decl.nparams c.type).length = decl.nparams :=
+    checked.direct_layout.2
+  have hpairs := pairNormalizedCtors_ofDirect_generationShape
+    decl.uvars checked.type.name decl.nparams checked.indices.length
+    checked.type.ctors hcs
+  simp only [NormalizedChecked.generationShape, Bool.and_eq_true,
+    beq_iff_eq, Checked.identityBlock, NormalizedChecked.rawParams,
+    NormalizedChecked.rawIndices, NormalizedChecked.ctorPairs]
+  rw [checked.params_eq, checked.indices_eq, checked.constructors_eq]
+  simp only [List.length_map]
+  exact ⟨⟨⟨⟨⟨hp, trivial⟩, trivial⟩, hpairs.1⟩,
+    hpairs.1⟩, hpairs.2⟩
+
+/-- Canonical mixed-generation witness for a declaration already accepted in
+raw analyzer normal form. -/
+def Checked.identityGeneration {decl : VInductDecl}
+    (checked : decl.Checked) : GenerationChecked decl where
+  block := checked.identityBlock
+  shape_eq := checked.identityBlock_generationShape
+
+@[simp] theorem Checked.identityGeneration_sourceType
+    {decl : VInductDecl} (checked : decl.Checked) :
+    checked.identityGeneration.block.sourceType = checked.type := rfl
+
+@[simp] theorem Checked.identityGeneration_checked
+    {decl : VInductDecl} (checked : decl.Checked) :
+    checked.identityGeneration.block.checked = checked := rfl
+
+def NormalizedChecked.generation? {source : VInductDecl}
+    (block : NormalizedChecked source) : Option (GenerationChecked source) :=
+  if h : block.generationShape then some ⟨block, h⟩ else none
+
+def Normalization.generation? {source : VInductDecl}
+    (norm : Normalization source) : Option (GenerationChecked source) := do
+  let block ← norm.check?
+  block.generation?
+
+def normalizedGeneration? (source view : VInductDecl) :
+    Option (GenerationChecked source) := do
+  let block ← normalizedChecked? source view
+  block.generation?
+
+def identityGeneration? (source : VInductDecl) :
+    Option (GenerationChecked source) := do
+  let block ← identityChecked? source
+  block.generation?
+
+/-- Compatibility acceptance predicate for the legacy one-family checked
+descriptor.  The public block-wide predicate is `stage3`, defined once the
+mutual generation descriptor is available below. -/
+def singletonStage3 (decl : VInductDecl) : Bool := decl.checked?.isSome
+
+/-- The parameter telescope in the recursor's universe context. -/
+def paramsTel (ty : VInductiveType) (mode : ElimMode := .large) : List VExpr :=
+  (VExpr.telN np ty.type).map (VExpr.instL (mode.sourceLevels U))
+
+/-- The index telescope in the recursor's universe context (at parameter
+depth). -/
+def idxTel (ty : VInductiveType) (mode : ElimMode := .large) : List VExpr :=
+  (ctorFields (VExpr.dropN np ty.type)).map
+    (VExpr.instL (mode.sourceLevels U))
+
+/-- `recApp` in the recursor's universe context. -/
+def recApp' (off : Nat) (mode : ElimMode := .large) : VExpr :=
+  VExpr.appN (.const T (mode.sourceLevels U)) (VExpr.bvarRevRange off np)
+
+/-- `motive : ∀ indices, T params indices → Sort u`, in context
+`params`. -/
+def motiveType (ty : VInductiveType) (mode : ElimMode := .large) : VExpr :=
+  let ni := (idxTel U np ty mode).length
+  VExpr.forallN (idxTel U np ty mode)
+    (.forallE (VExpr.appN (.const T (mode.sourceLevels U))
+      (VExpr.bvarRevRange ni np ++ VExpr.bvarRevRange 0 ni))
+      (.sort mode.motiveLevel))
+
+/-- Constructor fields in the recursor's universe context (still at
+parameter depth, no motive shift). -/
+def ctorFieldsR (c : VConstVal) (mode : ElimMode := .large) : List VExpr :=
+  (ctorFields (VExpr.dropN np c.type)).map
+    (VExpr.instL (mode.sourceLevels U))
+
+/-- The recursive positions of a constructor with their index arguments,
+in the recursor's universe context. -/
+def recPairsR (ni : Nat) (c : VConstVal)
+    (mode : ElimMode := .large) : List (Nat × List VExpr) :=
+  (recPairs U T np ni (ctorFields (VExpr.dropN np c.type))).map
+    fun (j, idxs) => (j, idxs.map (VExpr.instL (mode.sourceLevels U)))
+
+/-- A recursive-argument descriptor transported into the recursor's universe
+context. Telescope dependency is preserved because universe instantiation does
+not change term-variable indices. -/
+def RecArg.instL (r : RecArg) (ls : List VLevel) : RecArg where
+  fieldIndex := r.fieldIndex
+  binders := r.binders.map (VExpr.instL ls)
+  targetType := r.targetType
+  indices := r.indices.map (VExpr.instL ls)
+
+/-- Recursive constructor arguments, including recursive Pi arguments, in the
+recursor universe context. -/
+def recArgsR (ni : Nat) (c : VConstVal)
+    (mode : ElimMode := .large) : List RecArg :=
+  (recArgs U T np ni (ctorFields (VExpr.dropN np c.type))).map
+    fun r => r.instL (mode.sourceLevels U)
+
+/-- The result index arguments of a constructor, recursor universes (at
+result depth: past the parameters and all fields, no motive). -/
+def ctorIdxs (c : VConstVal) (mode : ElimMode := .large) : List VExpr :=
+  (recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))).map
+    (VExpr.instL (mode.sourceLevels U))
+
+/-- The minor premise for one constructor, in context `params ++ [motive]`:
+`∀ fields, ∀ ihs, motive idxs (ctor params fields)`, with one induction
+hypothesis per directly recursive field. The fields shift by one for the
+interposed motive. -/
+def minorType (ty : VInductiveType) (c : VConstVal)
+    (mode : ElimMode := .large) : VExpr :=
+  let Bs := ctorFieldsR U np c mode
+  let m := Bs.length
+  let ni := (idxTel U np ty mode).length
+  let rsP := recPairsR U T np ni c mode
+  let r := rsP.length
+  VExpr.forallN (VExpr.liftTelN 1 Bs 0)
+    (VExpr.forallN (ihsFrom m rsP 0)
+      (VExpr.appN (.bvar (m+r))
+        (((ctorIdxs U np c mode).map fun e => (e.liftN 1 m).liftN r) ++
+          [VExpr.appN (.const c.name (mode.sourceLevels U))
+            (VExpr.bvarRevRange (r+m+1) np ++ VExpr.bvarRevRange r m)])))
+
+/-- Binder telescope of a functional induction hypothesis. Starting from the
+recursive argument's own telescope, insert the motive below the preceding
+constructor fields, then insert the current/later fields and earlier induction
+hypotheses above them. -/
+def RecArg.minorBinders (m p : Nat) (r : RecArg) : List VExpr :=
+  VExpr.liftTelN (m - r.fieldIndex + p)
+    (VExpr.liftTelN 1 r.binders r.fieldIndex) 0
+
+/-- The induction-hypothesis type generated for one recursive argument. For a
+direct recursive field this reduces to `motive indices field`; under a Pi it
+is `∀ xs, motive indices (field xs)`. -/
+def RecArg.minorIH (m p : Nat) (r : RecArg) : VExpr :=
+  let n := r.binders.length
+  VExpr.forallN (r.minorBinders m p)
+    (VExpr.appN (.bvar (m+p+n))
+      ((r.indices.map fun e =>
+          (e.liftN 1 (r.fieldIndex+n)).liftN (m-r.fieldIndex+p) n) ++
+        [VExpr.appN (.bvar (m-1-r.fieldIndex+p+n))
+          (VExpr.bvarRevRange 0 n)]))
+
+/-- Functional induction-hypothesis telescope, one entry per recursive
+constructor argument. -/
+def ihsFromRecArgs (m : Nat) : List RecArg → Nat → List VExpr
+  | [], _ => []
+  | r :: rs, p => r.minorIH m p :: ihsFromRecArgs m rs (p+1)
+
+/-- General one-family minor premise, extending `minorType` to recursive
+arguments beneath Pi telescopes. -/
+def minorTypeRec (ty : VInductiveType) (c : VConstVal)
+    (mode : ElimMode := .large) : VExpr :=
+  let Bs := ctorFieldsR U np c mode
+  let m := Bs.length
+  let ni := (idxTel U np ty mode).length
+  let rs := recArgsR U T np ni c mode
+  let r := rs.length
+  VExpr.forallN (VExpr.liftTelN 1 Bs 0)
+    (VExpr.forallN (ihsFromRecArgs m rs 0)
+      (VExpr.appN (.bvar (m+r))
+        (((ctorIdxs U np c mode).map fun e => (e.liftN 1 m).liftN r) ++
+          [VExpr.appN (.const c.name (mode.sourceLevels U))
+            (VExpr.bvarRevRange (r+m+1) np ++ VExpr.bvarRevRange r m)])))
+
+def minorTypesRec (ty : VInductiveType) : List VConstVal →
+    (i : Nat := 0) → (mode : ElimMode := .large) → List VExpr
+  | [], _, _ => []
+  | c :: cs, i, mode =>
+    VExpr.liftN i (minorTypeRec U T np ty c mode) ::
+      minorTypesRec ty cs (i+1) mode
+
+def recTypeRec (ty : VInductiveType)
+    (mode : ElimMode := .large) : VExpr :=
+  let k := ty.ctors.length
+  let ni := (idxTel U np ty mode).length
+  VExpr.forallN (paramsTel U np ty mode) <|
+    .forallE (motiveType U T np ty mode) <|
+      VExpr.forallN (minorTypesRec U T np ty ty.ctors (mode := mode)) <|
+        VExpr.forallN (VExpr.liftTelN (k+1) (idxTel U np ty mode) 0) <|
+          .forallE (VExpr.appN (.const T (mode.sourceLevels U))
+            (VExpr.bvarRevRange (ni+k+1) np ++ VExpr.bvarRevRange 0 ni)) <|
+            .app (VExpr.appN (.bvar (ni+k+1)) (VExpr.bvarRevRange 1 ni)) (.bvar 0)
+
+def recConstRec (ty : VInductiveType)
+    (mode : ElimMode := .large) : VConstant :=
+  ⟨mode.recUvars U, recTypeRec U T np ty mode⟩
+
+/-- The telescope introduced around a functional recursive call in an iota
+RHS. It is the source Pi telescope transported under the recursor's common
+arguments and the complete constructor-field context. -/
+def RecArg.ruleBinders (m k : Nat) (r : RecArg) : List VExpr :=
+  VExpr.liftTelN (m-r.fieldIndex)
+    (VExpr.liftTelN (k+1) r.binders r.fieldIndex) 0
+
+/-- Recursive call contributed to an iota RHS. Direct recursion reduces to a
+plain call; a recursive Pi argument produces a lambda applying the field to
+the freshly bound arguments before recurring. -/
+def RecArg.ruleCall (m k : Nat) (recBase : VExpr) (r : RecArg) : VExpr :=
+  let n := r.binders.length
+  VExpr.lamN (r.ruleBinders m k)
+    (VExpr.appN (recBase.liftN n)
+      ((r.indices.map fun e =>
+          (e.liftN (k+1) (r.fieldIndex+n)).liftN (m-r.fieldIndex) n) ++
+        [VExpr.appN (.bvar (m-1-r.fieldIndex+n))
+          (VExpr.bvarRevRange 0 n)]))
+
+/-- The functional-IH type expected of `ruleCall` in the complete iota-rule
+context. Keeping this normalization named makes the preservation proof and
+the generated RHS share one de Bruijn convention. -/
+def RecArg.ruleIH (m k : Nat) (r : RecArg) : VExpr :=
+  let n := r.binders.length
+  VExpr.forallN (r.ruleBinders m k)
+    (VExpr.appN (.bvar (k+m+n))
+      ((r.indices.map fun e =>
+          (e.liftN (k+1) (r.fieldIndex+n)).liftN (m-r.fieldIndex) n) ++
+        [VExpr.appN (.bvar (m-1-r.fieldIndex+n))
+          (VExpr.bvarRevRange 0 n)]))
+
+/-- Functional-IH telescope in an iota-rule context. Each entry is weakened
+past the preceding IH binders, while its base type is exactly `ruleIH`. -/
+def ruleIHs (m k : Nat) : List RecArg → Nat → List VExpr
+  | [], _ => []
+  | r :: rs, p => (r.ruleIH m k).liftN p :: ruleIHs m k rs (p+1)
+
+def ruleRec (ty : VInductiveType) (i : Nat) (c : VConstVal)
+    (mode : ElimMode := .large) : VDefEq :=
+  let k := ty.ctors.length
+  let Bs := ctorFieldsR U np c mode
+  let m := Bs.length
+  let ni := (idxTel U np ty mode).length
+  let rs := recArgsR U T np ni c mode
+  let binders := paramsTel U np ty mode ++
+    motiveType U T np ty mode ::
+      minorTypesRec U T np ty ty.ctors (mode := mode) ++
+    VExpr.liftTelN (k+1) Bs 0
+  let recBase := VExpr.appN (.const (.str T "rec") (mode.recLevels U))
+    (VExpr.bvarRevRange m (np+k+1))
+  let idxR := (ctorIdxs U np c mode).map fun e => e.liftN (k+1) m
+  let ctorApp := VExpr.appN (.const c.name (mode.sourceLevels U))
+    (VExpr.bvarRevRange (m+k+1) np ++ VExpr.bvarRevRange 0 m)
+  let ihs := rs.map fun r => r.ruleCall m k recBase
+  { uvars := mode.recUvars U
+    lhs := VExpr.lamN binders (VExpr.appN recBase (idxR ++ [ctorApp]))
+    rhs := VExpr.lamN binders
+      (VExpr.appN (.bvar (k-1-i+m)) (VExpr.bvarRevRange 0 m ++ ihs))
+    type := VExpr.forallN binders (VExpr.appN (.bvar (k+m)) (idxR ++ [ctorApp])) }
+
+def rulesRec (ty : VInductiveType)
+    (mode : ElimMode := .large) : List VDefEq :=
+  ty.ctors.zipIdx.map fun (c, i) => ruleRec U T np ty i c mode
+
+/-- Minor premise types in position: the `i`-th lives under
+`params ++ motive` and the previous `i` minors. -/
+def minorTypes (ty : VInductiveType) : List VConstVal → (i : Nat := 0) → List VExpr
+  | [], _ => []
+  | c :: cs, i => VExpr.liftN i (minorType U T np ty c) :: minorTypes ty cs (i+1)
+
+/-- The recursor type `∀ params, ∀ (motive : ∀ indices, T params indices →
+Sort u) (minors..) (indices..) (t : T params indices), motive indices t`. -/
+def recType (ty : VInductiveType) : VExpr :=
+  let k := ty.ctors.length
+  let ni := (idxTel U np ty).length
+  VExpr.forallN (paramsTel U np ty) <|
+    .forallE (motiveType U T np ty) <|
+      VExpr.forallN (minorTypes U T np ty ty.ctors) <|
+        VExpr.forallN (VExpr.liftTelN (k+1) (idxTel U np ty) 0) <|
+          .forallE (VExpr.appN (.const T (VLevel.params' U 1))
+            (VExpr.bvarRevRange (ni+k+1) np ++ VExpr.bvarRevRange 0 ni)) <|
+            .app (VExpr.appN (.bvar (ni+k+1)) (VExpr.bvarRevRange 1 ni)) (.bvar 0)
+
+def recConst (ty : VInductiveType) : VConstant := ⟨U + 1, recType U T np ty⟩
+
+/-- The iota rule for the `i`-th constructor, as a closed defeq between
+lambda telescopes over `params ++ motive :: minors ++ fields` (the same
+shape as `quotDefEq`, and the same telescope the kernel's
+`RecursorRule.rhs` binds). The left body is the `SimplePattern.iota`
+spine: the recursor applied to the parameters, motive, minors and the
+constructor's result indices, with a constructor-headed major. -/
+def rule (ty : VInductiveType) (i : Nat) (c : VConstVal) : VDefEq :=
+  let k := ty.ctors.length
+  let Bs := ctorFieldsR U np c
+  let m := Bs.length
+  let ni := (idxTel U np ty).length
+  let rsP := recPairsR U T np ni c
+  let binders := paramsTel U np ty ++
+    motiveType U T np ty :: minorTypes U T np ty ty.ctors ++
+    VExpr.liftTelN (k+1) Bs 0
+  let recBase := VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+    (VExpr.bvarRevRange m (np+k+1))
+  let idxR := (ctorIdxs U np c).map fun e => e.liftN (k+1) m
+  let ctorApp := VExpr.appN (.const c.name (VLevel.params' U 1))
+    (VExpr.bvarRevRange (m+k+1) np ++ VExpr.bvarRevRange 0 m)
+  let ihs := rsP.map fun (j, idxs) =>
+    VExpr.appN recBase
+      ((idxs.map fun e => (e.liftN (k+1) j).liftN (m-j)) ++ [.bvar (m-1-j)])
+  { uvars := U + 1
+    lhs := VExpr.lamN binders (VExpr.appN recBase (idxR ++ [ctorApp]))
+    rhs := VExpr.lamN binders
+      (VExpr.appN (.bvar (k-1-i+m)) (VExpr.bvarRevRange 0 m ++ ihs))
+    type := VExpr.forallN binders (VExpr.appN (.bvar (k+m)) (idxR ++ [ctorApp])) }
+
+def rules (ty : VInductiveType) : List VDefEq :=
+  ty.ctors.zipIdx.map fun (c, i) => rule U T np ty i c
+
+namespace NormalizedCtor
+
+/-- Raw field binders transported to the recursor universe context. -/
+def fieldsR (ctor : NormalizedCtor) (U np : Nat)
+    (mode : ElimMode := .large) : List VExpr :=
+  (ctor.rawFields np).map (VExpr.instL (mode.sourceLevels U))
+
+/-- Normalized recursive classifications transported without re-peeling the
+raw constructor type. -/
+def recArgsR (ctor : NormalizedCtor) (U : Nat)
+    (mode : ElimMode := .large) : List RecArg :=
+  ctor.view.recursive.map fun r => r.instL (mode.sourceLevels U)
+
+/-- Normalized constructor-result indices in recursor universes. -/
+def resultIndicesR (ctor : NormalizedCtor) (U : Nat)
+    (mode : ElimMode := .large) : List VExpr :=
+  ctor.view.resultIndices.map (VExpr.instL (mode.sourceLevels U))
+
+end NormalizedCtor
+
+/-! ## Mixed raw/view artifacts
+
+These definitions are additive until their preservation theorem is complete.
+Raw family/constructor telescopes supply emitted binder syntax; the checked
+view supplies result indices and recursive-argument classification. No helper
+below re-runs `recArg?` on raw metadata.
+-/
+
+namespace GenerationChecked
+
+/-- Elimination mode retained by the single checked analysis. -/
+abbrev elimination {source : VInductDecl} (gen : GenerationChecked source) :
+    ElimMode :=
+  gen.block.checked.elimination
+
+/-- K-like reduction flag retained by the single checked analysis. It is
+metadata for reduction and does not select the elimination mode. -/
+abbrev kTarget {source : VInductDecl} (gen : GenerationChecked source) : Bool :=
+  gen.block.checked.kTarget
+
+/-- Universe arity of this generated recursor. -/
+abbrev recUvars {source : VInductDecl} (gen : GenerationChecked source) : Nat :=
+  gen.elimination.recUvars source.uvars
+
+/-- Declaration universes in this recursor's universe context. -/
+abbrev sourceLevels {source : VInductDecl}
+    (gen : GenerationChecked source) : List VLevel :=
+  gen.elimination.sourceLevels source.uvars
+
+/-- Result level of the motive. -/
+abbrev motiveLevel {source : VInductDecl}
+    (gen : GenerationChecked source) : VLevel :=
+  gen.elimination.motiveLevel
+
+/-- Identity universe arguments of recursive recursor calls. -/
+abbrev recLevels {source : VInductDecl}
+    (gen : GenerationChecked source) : List VLevel :=
+  gen.elimination.recLevels source.uvars
+
+/-- Kernel-observable family-parameter telescope in recursor universes.
+
+Lean consumes the four parameter annotations before emission, but otherwise
+retains stored syntax rather than replacing reducible aliases by their WHNF. -/
+def paramsTel {source : VInductDecl} (gen : GenerationChecked source) :
+    List VExpr :=
+  gen.block.generationParams.map
+    (VExpr.instL gen.sourceLevels)
+
+/-- Raw index-binder telescope in recursor universes. -/
+def idxTel {source : VInductDecl} (gen : GenerationChecked source) :
+    List VExpr :=
+  gen.block.rawIndices.map (VExpr.instL gen.sourceLevels)
+
+/-- Mixed motive: raw index binders, normalized index arity, and the retained
+raw family identity. -/
+def motiveType {source : VInductDecl} (gen : GenerationChecked source) : VExpr :=
+  let ni := gen.idxTel.length
+  VExpr.forallN gen.idxTel
+    (.forallE
+      (VExpr.appN
+        (.const gen.block.sourceType.name gen.sourceLevels)
+        (VExpr.bvarRevRange ni source.nparams ++ VExpr.bvarRevRange 0 ni))
+      (.sort gen.motiveLevel))
+
+/-- One mixed minor premise. Raw fields are bound verbatim, while induction
+hypotheses and constructor result indices come from the checked view. -/
+def minorType {source : VInductDecl} (ctor : NormalizedCtor)
+    (mode : ElimMode := .large) : VExpr :=
+  let Bs := ctor.fieldsR source.uvars source.nparams mode
+  let m := Bs.length
+  let rs := ctor.recArgsR source.uvars mode
+  let r := rs.length
+  VExpr.forallN (VExpr.liftTelN 1 Bs 0)
+    (VExpr.forallN (ihsFromRecArgs m rs 0)
+      (VExpr.appN (.bvar (m+r))
+        ((ctor.resultIndicesR source.uvars mode |>.map fun e =>
+            (e.liftN 1 m).liftN r) ++
+          [VExpr.appN
+            (.const ctor.raw.name (mode.sourceLevels source.uvars))
+            (VExpr.bvarRevRange (r+m+1) source.nparams ++
+              VExpr.bvarRevRange r m)])))
+
+def minorTypesAux {source : VInductDecl} (gen : GenerationChecked source) :
+    List NormalizedCtor → (i : Nat := 0) → List VExpr
+  | [], _ => []
+  | ctor :: ctors, i =>
+    VExpr.liftN i (minorType (source := source) ctor gen.elimination) ::
+      gen.minorTypesAux ctors (i+1)
+
+def minorTypes {source : VInductDecl} (gen : GenerationChecked source) :
+    List VExpr :=
+  gen.minorTypesAux gen.block.ctorPairs
+
+/-- Mixed recursor type. Its binder surface is raw, but every
+WHNF-sensitive choice was retained by the checked view. -/
+def recType {source : VInductDecl} (gen : GenerationChecked source) : VExpr :=
+  let k := gen.block.ctorPairs.length
+  let ni := gen.idxTel.length
+  VExpr.forallN gen.paramsTel <|
+    .forallE gen.motiveType <|
+      VExpr.forallN gen.minorTypes <|
+        VExpr.forallN (VExpr.liftTelN (k+1) gen.idxTel 0) <|
+          .forallE
+            (VExpr.appN
+              (.const gen.block.sourceType.name
+                gen.sourceLevels)
+              (VExpr.bvarRevRange (ni+k+1) source.nparams ++
+                VExpr.bvarRevRange 0 ni)) <|
+            .app
+              (VExpr.appN (.bvar (ni+k+1)) (VExpr.bvarRevRange 1 ni))
+              (.bvar 0)
+
+def recursor {source : VInductDecl} (gen : GenerationChecked source) :
+    VConstant :=
+  ⟨gen.recUvars, gen.recType⟩
+
+/-- One mixed iota rule. Raw fields and constructor names are observable in
+the rule telescope; normalized recursive descriptors determine recursive calls
+and normalized result indices determine the major's index spine. -/
+def rule {source : VInductDecl} (gen : GenerationChecked source)
+    (i : Nat) (ctor : NormalizedCtor) : VDefEq :=
+  let k := gen.block.ctorPairs.length
+  let Bs := ctor.fieldsR source.uvars source.nparams gen.elimination
+  let m := Bs.length
+  let rs := ctor.recArgsR source.uvars gen.elimination
+  let binders := gen.paramsTel ++
+    gen.motiveType :: gen.minorTypes ++
+    VExpr.liftTelN (k+1) Bs 0
+  let recBase := VExpr.appN
+    (.const (.str gen.block.sourceType.name "rec")
+      gen.recLevels)
+    (VExpr.bvarRevRange m (source.nparams+k+1))
+  let idxR := ctor.resultIndicesR source.uvars gen.elimination |>.map fun e =>
+    e.liftN (k+1) m
+  let ctorApp := VExpr.appN
+    (.const ctor.raw.name gen.sourceLevels)
+    (VExpr.bvarRevRange (m+k+1) source.nparams ++
+      VExpr.bvarRevRange 0 m)
+  let ihs := rs.map fun r => r.ruleCall m k recBase
+  { uvars := gen.recUvars
+    lhs := VExpr.lamN binders (VExpr.appN recBase (idxR ++ [ctorApp]))
+    rhs := VExpr.lamN binders
+      (VExpr.appN (.bvar (k-1-i+m)) (VExpr.bvarRevRange 0 m ++ ihs))
+    type := VExpr.forallN binders
+      (VExpr.appN (.bvar (k+m)) (idxR ++ [ctorApp])) }
+
+def generatedRules {source : VInductDecl} (gen : GenerationChecked source) :
+    List VDefEq :=
+  gen.block.ctorPairs.zipIdx.map fun (ctor, i) => gen.rule i ctor
+
+end GenerationChecked
+
+namespace Checked
+
+@[simp] theorem identityGeneration_elimination {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.elimination = checked.elimination := rfl
+
+@[simp] theorem identityGeneration_kTarget {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.kTarget = checked.kTarget := rfl
+
+@[simp] theorem identityGeneration_recUvars {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.recUvars =
+      checked.elimination.recUvars decl.uvars := rfl
+
+@[simp] theorem identityGeneration_sourceLevels {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.sourceLevels =
+      checked.elimination.sourceLevels decl.uvars := rfl
+
+@[simp] theorem identityGeneration_motiveLevel {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.motiveLevel = checked.elimination.motiveLevel := rfl
+
+@[simp] theorem identityGeneration_recLevels {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.recLevels =
+      checked.elimination.recLevels decl.uvars := rfl
+
+private theorem identity_paramsTel {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.paramsTel =
+      VInductDecl.paramsTel decl.uvars decl.nparams checked.type
+        checked.elimination := by
+  simp [GenerationChecked.paramsTel, VInductDecl.paramsTel,
+    GenerationChecked.sourceLevels, GenerationChecked.elimination,
+    NormalizedChecked.generationParams, NormalizedChecked.rawParams,
+    Checked.identityGeneration, Checked.identityBlock, checked.params_eq]
+
+private theorem identity_idxTel {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.idxTel =
+      VInductDecl.idxTel decl.uvars decl.nparams checked.type
+        checked.elimination := rfl
+
+private theorem identity_motiveType {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.motiveType =
+      VInductDecl.motiveType decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination := rfl
+
+private theorem identity_minorType {decl : VInductDecl}
+    (checked : decl.Checked) (c : VConstVal) :
+    GenerationChecked.minorType (source := decl)
+      ⟨c, CheckedCtor.ofDirect decl.uvars checked.type.name decl.nparams
+        checked.indices.length c⟩ checked.elimination =
+      VInductDecl.minorTypeRec decl.uvars checked.type.name decl.nparams
+        checked.type c checked.elimination := by
+  have hni : checked.indices.length =
+      (VInductDecl.idxTel decl.uvars decl.nparams checked.type
+        checked.elimination).length := by
+    rw [checked.indices_eq]
+    simp [VInductDecl.idxTel]
+  rw [hni]
+  rfl
+
+private theorem identity_minorTypesAux {decl : VInductDecl}
+    (checked : decl.Checked) :
+    ∀ (cs : List VConstVal) (i : Nat),
+      checked.identityGeneration.minorTypesAux
+        (pairNormalizedCtors cs
+          (cs.map (CheckedCtor.ofDirect decl.uvars checked.type.name
+            decl.nparams checked.indices.length))) i =
+      VInductDecl.minorTypesRec decl.uvars checked.type.name decl.nparams
+        checked.type cs i checked.elimination
+  | [], _ => rfl
+  | c :: cs, i => by
+      simp [pairNormalizedCtors, GenerationChecked.minorTypesAux,
+        VInductDecl.minorTypesRec, identity_minorType,
+        identity_minorTypesAux checked cs (i+1)]
+
+private theorem identity_minorTypes {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.minorTypes =
+      VInductDecl.minorTypesRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.type.ctors (mode := checked.elimination) := by
+  unfold GenerationChecked.minorTypes
+  simp only [Checked.identityGeneration, Checked.identityBlock,
+    NormalizedChecked.ctorPairs]
+  rw [checked.constructors_eq]
+  exact identity_minorTypesAux checked checked.type.ctors 0
+
+private theorem identity_recType {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.recType =
+      VInductDecl.recTypeRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination := by
+  simp only [GenerationChecked.recType, VInductDecl.recTypeRec]
+  rw [identity_paramsTel checked, identity_motiveType checked,
+    identity_minorTypes checked, identity_idxTel checked]
+  simp only [Checked.identityGeneration, Checked.identityBlock,
+    NormalizedChecked.ctorPairs]
+  rw [checked.constructors_eq,
+    pairNormalizedCtors_ofDirect_generationShape
+      decl.uvars checked.type.name decl.nparams checked.indices.length
+      checked.type.ctors checked.direct_layout.2 |>.1]
+
+private theorem identity_recursor {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.recursor =
+      VInductDecl.recConstRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination := by
+  unfold GenerationChecked.recursor VInductDecl.recConstRec
+  rw [identity_recType checked]
+  simp [GenerationChecked.recUvars, GenerationChecked.elimination,
+    Checked.identityGeneration, Checked.identityBlock]
+
+private theorem identity_rule {decl : VInductDecl}
+    (checked : decl.Checked) (i : Nat) (c : VConstVal) :
+    checked.identityGeneration.rule i
+        ⟨c, CheckedCtor.ofDirect decl.uvars checked.type.name decl.nparams
+          checked.indices.length c⟩ =
+      VInductDecl.ruleRec decl.uvars checked.type.name decl.nparams
+        checked.type i c checked.elimination := by
+  have hni : checked.indices.length =
+      (VInductDecl.idxTel decl.uvars decl.nparams checked.type
+        checked.elimination).length := by
+    rw [checked.indices_eq]
+    simp [VInductDecl.idxTel]
+  have hk : checked.identityGeneration.block.ctorPairs.length =
+      checked.type.ctors.length := by
+    simp only [Checked.identityGeneration, Checked.identityBlock,
+      NormalizedChecked.ctorPairs]
+    rw [checked.constructors_eq]
+    exact (pairNormalizedCtors_ofDirect_generationShape
+      decl.uvars checked.type.name decl.nparams checked.indices.length
+      checked.type.ctors checked.direct_layout.2).1
+  unfold GenerationChecked.rule VInductDecl.ruleRec
+  rw [identity_paramsTel checked, identity_motiveType checked,
+    identity_minorTypes checked, hk, hni]
+  rfl
+
+private theorem identity_rulesAux {decl : VInductDecl}
+    (checked : decl.Checked) :
+    ∀ (cs : List VConstVal) (n : Nat),
+      List.map
+        (fun (ctor, i) => checked.identityGeneration.rule i ctor)
+        (List.zipIdx
+          (pairNormalizedCtors cs
+            (cs.map (CheckedCtor.ofDirect decl.uvars checked.type.name
+              decl.nparams checked.indices.length))) n) =
+      List.map
+        (fun (c, i) =>
+          VInductDecl.ruleRec decl.uvars checked.type.name decl.nparams
+            checked.type i c checked.elimination)
+        (List.zipIdx cs n)
+  | [], _ => rfl
+  | c :: cs, n => by
+      simp [pairNormalizedCtors, List.zipIdx, identity_rule,
+        identity_rulesAux checked cs (n+1)]
+
+private theorem identity_generatedRules {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.identityGeneration.generatedRules =
+      VInductDecl.rulesRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination := by
+  unfold GenerationChecked.generatedRules VInductDecl.rulesRec
+  simp only [Checked.identityGeneration, Checked.identityBlock,
+    NormalizedChecked.ctorPairs]
+  rw [checked.constructors_eq]
+  exact identity_rulesAux checked checked.type.ctors 0
+
+/-- Public motive generation is the identity-normalization specialization of
+the mixed raw/view implementation. -/
+def motiveType {decl : VInductDecl} (checked : decl.Checked) : VExpr :=
+  checked.identityGeneration.motiveType
+
+/-- Public minor generation is the identity-normalization specialization of
+the mixed raw/view implementation. -/
+def minorTypes {decl : VInductDecl} (checked : decl.Checked) : List VExpr :=
+  checked.identityGeneration.minorTypes
+
+/-- Public recursor generation is the identity-normalization specialization
+of the mixed raw/view implementation. -/
+def recursor {decl : VInductDecl} (checked : decl.Checked) : VConstant :=
+  checked.identityGeneration.recursor
+
+/-- Public iota-rule generation is the identity-normalization specialization
+of the mixed raw/view implementation. -/
+def generatedRules {decl : VInductDecl} (checked : decl.Checked) : List VDefEq :=
+  checked.identityGeneration.generatedRules
+
+/-- The public motive retains the exact legacy identity-normal form. -/
+theorem motiveType_eq_legacy {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.motiveType =
+      VInductDecl.motiveType decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination :=
+  identity_motiveType checked
+
+/-- The public minor telescope retains the exact legacy identity-normal
+form, including functional recursive arguments. -/
+theorem minorTypes_eq_legacy {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.minorTypes =
+      VInductDecl.minorTypesRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.type.ctors (mode := checked.elimination) :=
+  identity_minorTypes checked
+
+/-- The public recursor retains the exact legacy identity-normal form while
+being generated by the mixed implementation. -/
+theorem recursor_eq_legacy {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.recursor =
+      VInductDecl.recConstRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination :=
+  identity_recursor checked
+
+/-- The public iota-rule list retains the exact legacy identity-normal form
+while being generated by the mixed implementation. -/
+theorem generatedRules_eq_legacy {decl : VInductDecl}
+    (checked : decl.Checked) :
+    checked.generatedRules =
+      VInductDecl.rulesRec decl.uvars checked.type.name decl.nparams
+        checked.type checked.elimination :=
+  identity_generatedRules checked
+
+end Checked
+
+/-! ## Mutual raw/view artifacts
+
+The singleton generator above remains the compatibility proof surface while
+the block generator below mirrors `AddInductive.mkRecInfos`: all motives are
+introduced in family order, all constructor minors are then flattened in
+family/constructor order, and every recursive descriptor selects its target
+family by the ordinal retained by `CheckedCtor.ofBlock`.
+-/
+
+/-- Erased data for one member of the dependent checked-family spine.  The
+ordinal and normalized family value travel with the projections they index,
+so later positional pairing does not manufacture a parallel family order. -/
+structure CheckedFamilyData where
+  ordinal : Nat
+  value : VInductiveType
+  indices : List VExpr
+  resultLevel : VLevel
+  constructors : List CheckedCtor
+
+namespace CheckedFamilies
+
+/-- Erase a dependent checked-family spine without changing its order. -/
+def data {source : VInductDecl} {params : List VExpr} :
+    {ordinal : Nat} → {types : List VInductiveType} →
+      CheckedFamilies source params ordinal types → List CheckedFamilyData
+  | _, _, .nil => []
+  | _, _, .cons head tail =>
+      { ordinal := head.ordinal
+        value := head.value
+        indices := head.indices
+        resultLevel := head.resultLevel
+        constructors := head.constructors } :: data tail
+
+end CheckedFamilies
+
+/-- One stored family paired positionally with the checked normalized family
+that drove generation.  Stored family/index syntax remains observable in
+metadata; the view owns recursive classification and result indices. -/
+structure NormalizedFamily where
+  raw : VInductiveType
+  view : CheckedFamilyData
+
+/-- Positional family pairing.  `blockGenerationShape` separately proves
+that neither side is truncated. -/
+def pairNormalizedFamilies :
+    List VInductiveType → List CheckedFamilyData → List NormalizedFamily
+  | raw :: raws, view :: views =>
+      ⟨raw, view⟩ :: pairNormalizedFamilies raws views
+  | _, _ => []
+
+def NormalizedFamily.rawParams (family : NormalizedFamily) (np : Nat) :
+    List VExpr :=
+  VExpr.telN np family.raw.type
+
+def NormalizedFamily.rawIndices (family : NormalizedFamily) (np : Nat) :
+    List VExpr :=
+  ctorFields (VExpr.dropN np family.raw.type)
+
+def NormalizedFamily.ctorPairs (family : NormalizedFamily) :
+    List NormalizedCtor :=
+  pairNormalizedCtors family.raw.ctors family.view.constructors
+
+/-- One flattened constructor together with its source-family identity. -/
+structure NormalizedBlockCtor where
+  owner : Nat
+  familyName : Name
+  familyIndices : List VExpr
+  ctor : NormalizedCtor
+
+def NormalizedFamily.blockCtors (family : NormalizedFamily) :
+    List NormalizedBlockCtor :=
+  family.ctorPairs.map fun ctor =>
+    { owner := family.view.ordinal
+      familyName := family.raw.name
+      familyIndices := family.view.indices
+      ctor }
+
+/-- Per-family layout gate for mutual mixed generation. -/
+def NormalizedFamily.generationShape (np : Nat)
+    (family : NormalizedFamily) : Bool :=
+  family.raw.name == family.view.value.name &&
+    family.raw.uvars == family.view.value.uvars &&
+    (family.rawParams np).length == np &&
+    (family.rawIndices np).length == family.view.indices.length &&
+    family.ctorPairs.length == family.raw.ctors.length &&
+    family.ctorPairs.length == family.view.constructors.length &&
+    family.ctorPairs.all (NormalizedCtor.generationShape np)
+
+def NormalizedCheckedBlock.rawParams {source : VInductDecl}
+    (_block : NormalizedCheckedBlock source) : List VExpr :=
+  blockParams source.nparams source.types
+
+def NormalizedCheckedBlock.familyPairs {source : VInductDecl}
+    (block : NormalizedCheckedBlock source) : List NormalizedFamily :=
+  pairNormalizedFamilies source.types block.checked.families.data
+
+def NormalizedCheckedBlock.flatCtors {source : VInductDecl}
+    (block : NormalizedCheckedBlock source) : List NormalizedBlockCtor :=
+  block.familyPairs.flatMap (·.blockCtors)
+
+/-- Executable positional gate for a complete normalized block.  It checks
+the shared parameter surface, every family/index position, and every
+constructor position before raw and checked syntax are mixed. -/
+def NormalizedCheckedBlock.blockGenerationShape {source : VInductDecl}
+    (block : NormalizedCheckedBlock source) : Bool :=
+  block.rawParams.length == source.nparams &&
+    block.rawParams.length == block.checked.params.length &&
+    block.familyPairs.length == source.types.length &&
+    block.familyPairs.length == block.checked.families.data.length &&
+    block.familyPairs.all
+      (NormalizedFamily.generationShape source.nparams) &&
+    block.familyPairs.all fun family =>
+      family.raw.uvars == source.uvars &&
+        family.ctorPairs.all fun ctor => ctor.raw.uvars == source.uvars
+
+/-- A validator-owned mutual normalization whose raw/view positions are
+usable by artifact generation. -/
+structure BlockGenerationChecked (source : VInductDecl) where
+  validated : ValidatedBlock source
+  shape_eq : validated.block.blockGenerationShape = true
+
+def ValidatedBlock.generation? {source : VInductDecl}
+    (validated : ValidatedBlock source) :
+    Option (BlockGenerationChecked source) :=
+  if h : validated.block.blockGenerationShape then
+    some ⟨validated, h⟩
+  else none
+
+/-- The common result level selected by an identity-normalized checked block.
+The empty fallback is unreachable after `checkedBlock?`, but keeps the
+executable analyzer total. -/
+def CheckedBlock.firstResultLevel {source : VInductDecl}
+    (checked : CheckedBlock source) : VLevel :=
+  checked.families.resultLevels.head?.getD .zero
+
+/-- Analyze an already-normalized arbitrary block for mutual generation,
+without any singleton destructuring. -/
+def identityBlockGeneration? (source : VInductDecl) :
+    Option (BlockGenerationChecked source) := do
+  let block ← identityCheckedBlock? source
+  let validated : ValidatedBlock source :=
+    { block
+      resultLevel := block.checked.firstResultLevel }
+  validated.generation?
+
+/-- Public structural acceptance is exact block-generation readiness.  This
+retains the complete source-ordered mutual descriptor instead of projecting a
+singleton family and then rebuilding generation data. -/
+def stage3 (source : VInductDecl) : Bool :=
+  source.identityBlockGeneration?.isSome
+
+namespace BlockGenerationChecked
+
+abbrev block {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    NormalizedCheckedBlock source :=
+  gen.validated.block
+
+abbrev checked {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.block.normalization.view.CheckedBlock :=
+  gen.block.checked
+
+def families {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    List NormalizedFamily :=
+  gen.block.familyPairs
+
+def flatCtors {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    List NormalizedBlockCtor :=
+  gen.block.flatCtors
+
+abbrev familyCount {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : Nat :=
+  gen.families.length
+
+abbrev minorCount {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : Nat :=
+  gen.flatCtors.length
+
+/-- Whether the accepted block contains any recursive constructor argument.
+For a positive checked block this is the kernel's `inductInfo.isRec` decision
+expressed through the analyzer-owned recursive descriptors. -/
+def isRec {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : Bool :=
+  gen.flatCtors.any fun constructor =>
+    !constructor.ctor.view.recursive.isEmpty
+
+/-- Whether some recursive argument is hidden beneath a function telescope,
+matching the kernel's `inductInfo.isReflexive` flag. -/
+def isReflexive {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : Bool :=
+  gen.flatCtors.any fun constructor =>
+    constructor.ctor.view.recursive.any fun recursive =>
+      !recursive.binders.isEmpty
+
+/-- The block large-elimination decision.  A non-Prop common result admits
+large elimination; at `Prop`, only the kernel's singleton exception can do
+so.  In particular every genuinely mutual Prop block is small. -/
+def elimination {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : ElimMode :=
+  if gen.validated.resultLevel.isNeverZero then .large
+  else
+    match gen.families with
+    | [family] =>
+      if largeElim source.uvars family.raw.name source.nparams
+          family.view.indices.length family.view.value then .large else .small
+    | _ => .small
+
+/-- K-like reduction is a singleton-only kernel flag. -/
+def kTarget {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : Bool :=
+  match gen.families with
+  | [family] =>
+    isKTarget source.nparams gen.validated.resultLevel family.view.value
+  | _ => false
+
+abbrev recUvars {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : Nat :=
+  gen.elimination.recUvars source.uvars
+
+abbrev sourceLevels {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VLevel :=
+  gen.elimination.sourceLevels source.uvars
+
+abbrev motiveLevel {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : VLevel :=
+  gen.elimination.motiveLevel
+
+abbrev recLevels {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VLevel :=
+  gen.elimination.recLevels source.uvars
+
+/-- Shared emitted parameters in recursor universes. -/
+def paramsTel {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VExpr :=
+  generationParams gen.block.rawParams gen.block.checked.params |>.map
+    (VExpr.instL gen.sourceLevels)
+
+def familyNameAt {source : VInductDecl}
+    (gen : BlockGenerationChecked source) (ordinal : Nat) : Name :=
+  (gen.families[ordinal]?).map (fun family => family.raw.name) |>.getD .anonymous
+
+def idxTel {source : VInductDecl} (gen : BlockGenerationChecked source)
+    (family : NormalizedFamily) : List VExpr :=
+  (family.rawIndices source.nparams).map (VExpr.instL gen.sourceLevels)
+
+/-- One family motive before preceding motives have been inserted. -/
+def motiveType {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (family : NormalizedFamily) : VExpr :=
+  let indices := gen.idxTel family
+  let ni := indices.length
+  VExpr.forallN indices
+    (.forallE
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange ni source.nparams ++
+          VExpr.bvarRevRange 0 ni))
+      (.sort gen.motiveLevel))
+
+/-- Motives in kernel order.  Each later motive is weakened past all earlier
+motives while retaining the shared parameter context. -/
+def motiveTypesAux {source : VInductDecl}
+    (gen : BlockGenerationChecked source) :
+    List NormalizedFamily → (i : Nat := 0) → List VExpr
+  | [], _ => []
+  | family :: families, i =>
+    (gen.motiveType family).liftN i ::
+      gen.motiveTypesAux families (i + 1)
+
+def motiveTypes {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VExpr :=
+  gen.motiveTypesAux gen.families
+
+/-- Binder telescope of one mutual functional induction hypothesis. -/
+def blockMinorBinders (d m p : Nat) (r : RecArg) : List VExpr :=
+  VExpr.liftTelN (m - r.fieldIndex + p)
+    (VExpr.liftTelN d r.binders r.fieldIndex) 0
+
+/-- Mutual induction hypothesis routed to the recursive argument's target
+motive. -/
+def blockMinorIH (d m p : Nat) (r : RecArg) : VExpr :=
+  let n := r.binders.length
+  VExpr.forallN (blockMinorBinders d m p r)
+    (VExpr.appN (.bvar (d - 1 - r.targetType + m + p + n))
+      ((r.indices.map fun e =>
+          (e.liftN d (r.fieldIndex + n)).liftN
+            (m - r.fieldIndex + p) n) ++
+        [VExpr.appN (.bvar (m - 1 - r.fieldIndex + p + n))
+          (VExpr.bvarRevRange 0 n)]))
+
+def blockIHsFromRecArgs (d m : Nat) : List RecArg → Nat → List VExpr
+  | [], _ => []
+  | r :: rs, p =>
+    blockMinorIH d m p r :: blockIHsFromRecArgs d m rs (p + 1)
+
+/-- One constructor minor in the context of all block motives. -/
+def minorType {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (constructor : NormalizedBlockCtor) : VExpr :=
+  let d := gen.familyCount
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams gen.elimination
+  let m := Bs.length
+  let rs := constructor.ctor.recArgsR source.uvars gen.elimination
+  let r := rs.length
+  VExpr.forallN (VExpr.liftTelN d Bs 0)
+    (VExpr.forallN (blockIHsFromRecArgs d m rs 0)
+      (VExpr.appN (.bvar (d - 1 - constructor.owner + m + r))
+        ((constructor.ctor.resultIndicesR source.uvars gen.elimination |>.map
+            fun e => (e.liftN d m).liftN r) ++
+          [VExpr.appN (.const constructor.ctor.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange (r + m + d) source.nparams ++
+              VExpr.bvarRevRange r m)])))
+
+/-- Globally flattened constructor minors in family/constructor order. -/
+def minorTypesAux {source : VInductDecl}
+    (gen : BlockGenerationChecked source) :
+    List NormalizedBlockCtor → (i : Nat := 0) → List VExpr
+  | [], _ => []
+  | constructor :: constructors, i =>
+    (gen.minorType constructor).liftN i ::
+      gen.minorTypesAux constructors (i + 1)
+
+def minorTypes {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VExpr :=
+  gen.minorTypesAux gen.flatCtors
+
+/-- One recursor type for the selected family, sharing every motive and minor
+with the other family recursors. -/
+def recType {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (family : NormalizedFamily) : VExpr :=
+  let d := gen.familyCount
+  let k := gen.minorCount
+  let indices := gen.idxTel family
+  let ni := indices.length
+  VExpr.forallN gen.paramsTel <|
+    VExpr.forallN gen.motiveTypes <|
+      VExpr.forallN gen.minorTypes <|
+        VExpr.forallN (VExpr.liftTelN (d + k) indices 0) <|
+          .forallE
+            (VExpr.appN (.const family.raw.name gen.sourceLevels)
+              (VExpr.bvarRevRange (ni + d + k) source.nparams ++
+                VExpr.bvarRevRange 0 ni)) <|
+            .app
+              (VExpr.appN
+                (.bvar (d - 1 - family.view.ordinal + k + ni + 1))
+                (VExpr.bvarRevRange 1 ni))
+              (.bvar 0)
+
+def recursor {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (family : NormalizedFamily) : VConstant :=
+  ⟨gen.recUvars, gen.recType family⟩
+
+/-- Named generated recursors in family order. -/
+def recursors {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VConstVal :=
+  gen.families.map fun family =>
+    ⟨gen.recursor family, .str family.raw.name "rec"⟩
+
+/-- Telescope introduced around a mutual recursive rule call. -/
+def blockRuleBinders (common m : Nat) (r : RecArg) : List VExpr :=
+  VExpr.liftTelN (m - r.fieldIndex)
+    (VExpr.liftTelN common r.binders r.fieldIndex) 0
+
+/-- Recursive iota-rule call routed to the target family's recursor. -/
+def blockRuleCall (common m : Nat) (recBase : VExpr)
+    (r : RecArg) : VExpr :=
+  let n := r.binders.length
+  VExpr.lamN (blockRuleBinders common m r)
+    (VExpr.appN (recBase.liftN n)
+      ((r.indices.map fun e =>
+          (e.liftN common (r.fieldIndex + n)).liftN
+            (m - r.fieldIndex) n) ++
+        [VExpr.appN (.bvar (m - 1 - r.fieldIndex + n))
+          (VExpr.bvarRevRange 0 n)]))
+
+def recBase {source : VInductDecl}
+    (gen : BlockGenerationChecked source) (m target : Nat) : VExpr :=
+  VExpr.appN
+    (.const (.str (gen.familyNameAt target) "rec") gen.recLevels)
+    (VExpr.bvarRevRange m
+      (source.nparams + gen.familyCount + gen.minorCount))
+
+/-- One mutual iota rule at its global flattened minor ordinal. -/
+def rule {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (minorIndex : Nat) (constructor : NormalizedBlockCtor) : VDefEq :=
+  let d := gen.familyCount
+  let k := gen.minorCount
+  let common := d + k
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams gen.elimination
+  let m := Bs.length
+  let rs := constructor.ctor.recArgsR source.uvars gen.elimination
+  let binders := gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes ++
+    VExpr.liftTelN common Bs 0
+  let ownerRecBase := gen.recBase m constructor.owner
+  let idxR := constructor.ctor.resultIndicesR source.uvars gen.elimination |>.map
+    fun e => e.liftN common m
+  let ctorApp := VExpr.appN
+    (.const constructor.ctor.raw.name gen.sourceLevels)
+    (VExpr.bvarRevRange (m + common) source.nparams ++
+      VExpr.bvarRevRange 0 m)
+  let ihs := rs.map fun recursive =>
+    blockRuleCall common m (gen.recBase m recursive.targetType) recursive
+  { uvars := gen.recUvars
+    lhs := VExpr.lamN binders
+      (VExpr.appN ownerRecBase (idxR ++ [ctorApp]))
+    rhs := VExpr.lamN binders
+      (VExpr.appN (.bvar (k - 1 - minorIndex + m))
+        (VExpr.bvarRevRange 0 m ++ ihs))
+    type := VExpr.forallN binders
+      (VExpr.appN
+        (.bvar (d - 1 - constructor.owner + k + m))
+        (idxR ++ [ctorApp])) }
+
+def generatedRules {source : VInductDecl}
+    (gen : BlockGenerationChecked source) : List VDefEq :=
+  gen.flatCtors.zipIdx.map fun (constructor, i) =>
+    gen.rule i constructor
+
+end BlockGenerationChecked
+
+/-- Semantic evidence for a recursive argument beneath a Pi telescope. The
+binder domains are checked over the constructor context before the recursive
+field; its terminal index spine is checked underneath those binders. -/
+def RecArg.WF (r : RecArg) (env : VEnv) (l : VLevel) (Is : List VExpr)
+    (Γ : List VExpr) : Prop :=
+  VEnv.OnTel env U Γ r.binders ∧
+  env.SpineWF U (r.binders.reverse ++ Γ)
+    (VExpr.forallN (VExpr.liftTelN (r.fieldIndex + r.binders.length) Is 0)
+      (.sort l))
+    r.indices (.sort l)
+
+/-- Semantic well-formedness of every constructor field in a mutual block.
+
+Recursive fields may end in any source-indexed family and may sit below a Pi
+telescope.  Their target ordinal selects the corresponding index telescope
+from `familyIndices`.  A non-recursive field must be a block-free type in the
+pre-family environment and obey the common result-universe bound. -/
+def blockFieldsWF (source : VInductDecl) (env : VEnv)
+    (resultLevel : VLevel) (familyIndices : List (List VExpr)) :
+    List VExpr → Nat → List VExpr → Prop
+  | _, _, [] => True
+  | Γ, j, B :: Bs =>
+    (match blockRecArg? source.uvars source.nparams
+        (familyHeaders source.nparams source.types)
+        (familyNames source.types) j B with
+      | some recursive =>
+        match familyIndices[recursive.targetType]? with
+        | some indices =>
+          recursive.WF source.uvars env resultLevel indices Γ
+        | none => False
+      | none =>
+        ∃ u, env.HasType source.uvars Γ B (.sort u) ∧
+          (resultLevel = .zero ∨ u ≤ resultLevel)) ∧
+      blockFieldsWF source env resultLevel familyIndices
+        (B :: Γ) (j + 1) Bs
+
+/-- Interpret the analyzer-retained positional classifications rather than
+recomputing recursive recognition from field syntax.  The list lengths and
+field indices are checked in the proposition, while each recursive target
+selects its exact source-ordered family index telescope. -/
+def checkedBlockFieldsWF (env : VEnv) (U : Nat)
+    (resultLevel : VLevel) (familyIndices : List (List VExpr)) :
+    List VExpr → List (Option RecArg) → List VExpr → Nat → Prop
+  | [], [], _, _ => True
+  | B :: Bs, classification :: classifications, Γ, j =>
+    (match classification with
+      | some recursive =>
+        recursive.fieldIndex = j ∧
+          match familyIndices[recursive.targetType]? with
+          | some indices => recursive.WF U env resultLevel indices Γ
+          | none => False
+      | none =>
+        ∃ u, env.HasType U Γ B (.sort u) ∧
+          (resultLevel = .zero ∨ u ≤ resultLevel)) ∧
+      checkedBlockFieldsWF env U resultLevel familyIndices
+        Bs classifications (B :: Γ) (j + 1)
+  | _, _, _, _ => False
+
+/-- Interpret a dependent source-ordered family spine at one shared result
+universe.  Family formers and the block-free portions of constructor fields
+are interpreted in the common pre-family environment.  Recursive targets are
+reduced to their selected family index telescopes, so this layer does not
+pretend that generated constants or recursors already exist. -/
+def CheckedFamilies.WF {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {types : List VInductiveType}
+    (families : CheckedFamilies source params ordinal types)
+    (env : VEnv) (resultLevel : VLevel)
+    (familyIndices : List (List VExpr)) : Prop :=
+  match families with
+  | .nil => True
+  | .cons head tail =>
+    head.resultLevel ≈ resultLevel ∧
+      VEnv.OnTel env source.uvars [] (params ++ head.indices) ∧
+      (∀ constructor ∈ head.constructors,
+        blockFieldsWF source env resultLevel familyIndices
+            params.reverse 0 constructor.fields ∧
+          env.SpineWF source.uvars
+            (constructor.fields.reverse ++ params.reverse)
+            (VExpr.forallN
+              (VExpr.liftTelN constructor.fields.length head.indices 0)
+              (.sort resultLevel))
+            constructor.resultIndices (.sort resultLevel)) ∧
+      tail.WF env resultLevel familyIndices
+
+/-- Erased semantic fold over the exact projections of a dependent checked
+family spine.  `CheckedBlock.WF` uses this presentation so concrete checked
+descriptors obtained by computation reduce through their public projections
+without exposing proof fields stored inside `Option.get`. -/
+def checkedFamilyListsWF (source : VInductDecl) (params : List VExpr)
+    (env : VEnv) (resultLevel : VLevel)
+    (familyIndices : List (List VExpr)) :
+    List VLevel → List (List VExpr) → List (List CheckedCtor) → Prop
+  | [], [], [] => True
+  | level :: levels, indices :: indicesTail,
+      constructors :: constructorsTail =>
+    level ≈ resultLevel ∧
+      VEnv.OnTel env source.uvars [] (params ++ indices) ∧
+      (∀ constructor ∈ constructors,
+        checkedBlockFieldsWF env source.uvars resultLevel familyIndices
+            constructor.fields constructor.recursiveAt params.reverse 0 ∧
+          env.SpineWF source.uvars
+            (constructor.fields.reverse ++ params.reverse)
+            (VExpr.forallN
+              (VExpr.liftTelN constructor.fields.length indices 0)
+              (.sort resultLevel))
+            constructor.resultIndices (.sort resultLevel)) ∧
+      checkedFamilyListsWF source params env resultLevel familyIndices
+        levels indicesTail constructorsTail
+  | _, _, _ => False
+
+/-- Environment-indexed semantics of a structurally checked mutual block.
+The common `resultLevel` is explicit and every family result is required to be
+semantically equivalent to it. -/
+def CheckedBlock.WF {source : VInductDecl}
+    (checked : source.CheckedBlock) (env : VEnv)
+    (resultLevel : VLevel) : Prop :=
+  checkedFamilyListsWF source checked.params env resultLevel
+    checked.families.indices checked.families.resultLevels
+    checked.families.indices checked.families.constructors
+
+/-- Complete Theory semantics of one validator-owned mutual normalization.
+Normalization compares raw family types before staging and raw constructor
+types after all-family staging; the checked view supplies the block-wide
+strict-positivity and result-spine interpretation. -/
+def ValidatedBlock.WF {source : VInductDecl}
+    (validated : ValidatedBlock source) (env blockEnv : VEnv) : Prop :=
+  validated.block.normalization.BlockWF env blockEnv ∧
+    validated.block.checked.WF env validated.resultLevel
+
+/-- Consumer-facing validation-only package.  It deliberately contains no
+generated motive, recursor, rule, or environment insertion beyond the
+temporary all-family validation stage. -/
+structure ValidationCertificate (source : VInductDecl) (env : VEnv) where
+  validated : ValidatedBlock source
+  blockEnv : VEnv
+  wf : validated.WF env blockEnv
+
+/-- Semantic well-formedness of constructor fields over the pre-environment.
+Direct recursive fields retain the Stage-3 spine contract. A recursive Pi
+field additionally carries a well-formed binder telescope and the terminal
+index spine below it. Non-recursive fields are well-formed types; non-Prop
+families retain the universe bound, while Prop uses Lean's impredicative
+exception. -/
+def fieldsWF (env : VEnv) (l : VLevel) (Is : List VExpr) :
+    List VExpr → Nat → List VExpr → Prop
+  | _, _, [] => True
+  | Γ, j, B :: Bs =>
+    (isRecField U T np Is.length j B = true ∨
+      (∃ r, recArg? U T np Is.length j B = some r ∧ r.binders ≠ [] ∧
+        r.WF U env l Is Γ) ∨
+      recArg? U T np Is.length j B = none ∧
+        ∃ u, env.HasType U Γ B (.sort u) ∧ (l = .zero ∨ u ≤ l)) ∧
+    (isRecField U T np Is.length j B = true →
+      env.SpineWF U Γ (VExpr.forallN (VExpr.liftTelN j Is 0) (.sort l))
+        (recFieldIdxs np B) (.sort l)) ∧
+    fieldsWF env l Is (B :: Γ) (j+1) Bs
+
+/-- Environment-indexed semantic evidence for a successful structural
+analysis. This is the one-family counterpart of the kernel's `checkType` and
+constructor checking passes: `Checked` owns normalized syntax, while
+`Checked.WF` proves that syntax meaningful over the input environment. -/
+def Checked.WF {decl : VInductDecl} (checked : decl.Checked) (env : VEnv) : Prop :=
+  VEnv.OnTel env decl.uvars [] (checked.params ++ checked.indices) ∧
+  ∀ c ∈ checked.type.ctors,
+    fieldsWF decl.uvars checked.type.name decl.nparams env checked.resultLevel
+      checked.indices checked.params.reverse 0
+      (ctorFields (VExpr.dropN decl.nparams c.type)) ∧
+    env.SpineWF decl.uvars
+      ((ctorFields (VExpr.dropN decl.nparams c.type)).reverse ++ checked.params.reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN (ctorFields (VExpr.dropN decl.nparams c.type)).length
+          checked.indices 0)
+        (.sort checked.resultLevel))
+      (recFieldIdxs decl.nparams (VExpr.resultOf (VExpr.dropN decl.nparams c.type)))
+      (.sort checked.resultLevel)
+
+/-- Semantic certificate for an accepted raw/view pair. The normalization
+justifies the raw metadata against the view, while `Checked.WF` justifies the
+view's analyzer facts in the same input Theory environment. -/
+def NormalizedChecked.WF {source : VInductDecl}
+    (block : NormalizedChecked source) (env : VEnv) : Prop :=
+  block.normalization.WF env ∧ block.checked.WF env
+
+/-- The binders emitted for one mixed minor/rule: the checked family
+parameters followed by the stored raw constructor fields.
+
+Lean consumes parameter annotations while checking the family and uses those
+checked locals when it builds the recursor. Constructor fields, by contrast,
+retain their stored surface syntax. -/
+def NormalizedCtor.emittedBinders {source : VInductDecl}
+    (block : NormalizedChecked source) (ctor : NormalizedCtor) : List VExpr :=
+  block.checked.params ++ ctor.rawFields source.nparams
+
+/-- The normalized binders whose semantic analysis drives the mixed artifact.
+These expressions are never emitted in place of their raw partners. -/
+def NormalizedCtor.viewBinders {source : VInductDecl}
+    (block : NormalizedChecked source) (ctor : NormalizedCtor) : List VExpr :=
+  block.checked.params ++ ctor.view.fields
+
+/-- The normalized constructor result reconstructed with the retained raw
+family identity. It is interpreted in either of the raw contexts certified
+below. -/
+def NormalizedCtor.resultTarget {source : VInductDecl}
+    (block : NormalizedChecked source) (ctor : NormalizedCtor) : VExpr :=
+  VExpr.appN (.const block.sourceType.name (VLevel.params source.uvars))
+    (VExpr.bvarRevRange (ctor.rawFields source.nparams).length source.nparams ++
+      ctor.view.resultIndices)
+
+/-- Staged semantic evidence for one raw/view constructor pair.
+
+`declaredTel`/`declaredResult` validate the exact stored constructor type so it
+can be inserted. `emittedTel`/`emittedResult` validate the binder context used
+by mixed minors and rules. The two raw parameter prefixes may be merely
+definitionally equal; recording both paths therefore anticipates the kernel's
+constructor-parameter behavior without assuming syntactic equality. -/
+structure NormalizedCtor.WF {source : VInductDecl}
+    (block : NormalizedChecked source) (ctor : NormalizedCtor)
+    (env : VEnv) : Prop where
+  declaredTel :
+    env.TelDefEq source.uvars []
+      (ctor.declaredBinders source.nparams) (ctor.viewBinders block)
+  declaredResult :
+    env.IsDefEq source.uvars (ctor.declaredBinders source.nparams).reverse
+      (ctor.rawResult source.nparams) (ctor.resultTarget block)
+      (.sort block.checked.resultLevel)
+  emittedTel :
+    env.TelDefEq source.uvars []
+      (ctor.emittedBinders block) (ctor.viewBinders block)
+  emittedResult :
+    env.IsDefEq source.uvars (ctor.emittedBinders block).reverse
+      (ctor.rawResult source.nparams) (ctor.resultTarget block)
+      (.sort block.checked.resultLevel)
+
+/-- Semantic certificate for a generation-ready raw/view block.
+
+The family telescope/result are certified before family insertion.
+Constructor certificates are quantified over the exact environment produced
+by inserting the raw family constant. This staging is essential for aliases
+whose constructor fields mention that family. No field of this structure is a
+normalization oracle: every equality is an ordinary Theory derivation. -/
+structure GenerationChecked.WF {source : VInductDecl}
+    (gen : GenerationChecked source) (env : VEnv) : Prop where
+  blockWF : gen.block.WF env
+  familyTel :
+    env.TelDefEq source.uvars []
+      (gen.block.rawParams ++ gen.block.rawIndices)
+      (gen.block.checked.params ++ gen.block.checked.indices)
+  familyResult :
+    env.IsDefEq source.uvars
+      (gen.block.rawParams ++ gen.block.rawIndices).reverse
+      gen.block.rawResult (.sort gen.block.checked.resultLevel)
+      (.sort (.succ gen.block.checked.resultLevel))
+  ctors :
+    ∀ envT, env.addConst gen.block.sourceType.name
+        gen.block.sourceType.toVConstant = some envT →
+      ∀ ctor ∈ gen.block.ctorPairs, ctor.WF gen.block envT
+
+/-! ### Mutual generation certificates -/
+
+def NormalizedFamily.rawResult (family : NormalizedFamily) (np : Nat) :
+    VExpr :=
+  VExpr.resultOf (VExpr.dropN np family.raw.type)
+
+def NormalizedBlockCtor.declaredBinders {source : VInductDecl}
+    (constructor : NormalizedBlockCtor) : List VExpr :=
+  constructor.ctor.declaredBinders source.nparams
+
+/-- Constructor binders used by generated mutual artifacts before universe
+instantiation. -/
+def NormalizedBlockCtor.emittedBinders {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (constructor : NormalizedBlockCtor) : List VExpr :=
+  gen.block.checked.params ++ constructor.ctor.rawFields source.nparams
+
+def NormalizedBlockCtor.viewBinders {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (constructor : NormalizedBlockCtor) : List VExpr :=
+  gen.block.checked.params ++ constructor.ctor.view.fields
+
+def NormalizedBlockCtor.rawResult {source : VInductDecl}
+    (constructor : NormalizedBlockCtor) : VExpr :=
+  constructor.ctor.rawResult source.nparams
+
+/-- Normalized constructor result reconstructed with the stored owner name. -/
+def NormalizedBlockCtor.resultTarget {source : VInductDecl}
+    (_gen : BlockGenerationChecked source)
+    (constructor : NormalizedBlockCtor) : VExpr :=
+  VExpr.appN
+    (.const constructor.familyName (VLevel.params source.uvars))
+    (VExpr.bvarRevRange
+        (constructor.ctor.rawFields source.nparams).length source.nparams ++
+      constructor.ctor.view.resultIndices)
+
+/-- Granular raw/view semantics for one mutual family. -/
+structure NormalizedFamily.WF {source : VInductDecl}
+    (gen : BlockGenerationChecked source) (family : NormalizedFamily)
+    (env : VEnv) : Prop where
+  familyTel :
+    env.TelDefEq source.uvars []
+      (family.rawParams source.nparams ++ family.rawIndices source.nparams)
+      (gen.block.checked.params ++ family.view.indices)
+  familyResult :
+    env.IsDefEq source.uvars
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams).reverse
+      (family.rawResult source.nparams)
+      (.sort gen.validated.resultLevel)
+      (.sort (.succ gen.validated.resultLevel))
+
+/-- Declaration-stage raw/view semantics for one constructor after every
+family has been staged. -/
+structure NormalizedBlockCtor.WF {source : VInductDecl}
+    (gen : BlockGenerationChecked source)
+    (constructor : NormalizedBlockCtor) (env : VEnv) : Prop where
+  declaredTel :
+    env.TelDefEq source.uvars []
+      (NormalizedBlockCtor.declaredBinders (source := source) constructor)
+      (NormalizedBlockCtor.viewBinders gen constructor)
+  declaredResult :
+    env.IsDefEq source.uvars
+      (NormalizedBlockCtor.declaredBinders
+        (source := source) constructor).reverse
+      (NormalizedBlockCtor.rawResult (source := source) constructor)
+      (NormalizedBlockCtor.resultTarget gen constructor)
+      (.sort gen.validated.resultLevel)
+  emittedTel :
+    env.TelDefEq source.uvars []
+      (NormalizedBlockCtor.emittedBinders gen constructor)
+      (NormalizedBlockCtor.viewBinders gen constructor)
+  emittedResult :
+    env.IsDefEq source.uvars
+      (NormalizedBlockCtor.emittedBinders gen constructor).reverse
+      (NormalizedBlockCtor.rawResult (source := source) constructor)
+      (NormalizedBlockCtor.resultTarget gen constructor)
+      (.sort gen.validated.resultLevel)
+  owner : ∃ family ∈ gen.families,
+    family.view.ordinal = constructor.owner ∧
+      family.raw.name = constructor.familyName ∧
+      family.view.indices = constructor.familyIndices
+  recursive : ∀ recursive ∈ constructor.ctor.view.recursive,
+    ∃ family ∈ gen.families,
+      family.view.ordinal = recursive.targetType ∧
+        (∃ B,
+          constructor.ctor.view.fields[recursive.fieldIndex]? = some B ∧
+            B = VExpr.forallN recursive.binders
+              (VExpr.appN
+                (.const family.raw.name (VLevel.params source.uvars))
+                (VExpr.bvarRevRange
+                    (recursive.fieldIndex + recursive.binders.length)
+                    source.nparams ++ recursive.indices))) ∧
+        recursive.WF source.uvars env gen.validated.resultLevel
+          family.view.indices
+          ((constructor.ctor.view.fields.take recursive.fieldIndex).reverse ++
+            gen.block.checked.params.reverse)
+  resultSpine :
+    env.SpineWF source.uvars
+      (constructor.ctor.view.fields.reverse ++
+        gen.block.checked.params.reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN constructor.ctor.view.fields.length
+          constructor.familyIndices 0)
+        (.sort gen.validated.resultLevel))
+      constructor.ctor.view.resultIndices
+      (.sort gen.validated.resultLevel)
+
+/-- Semantic input to block artifact preservation.  No field assumes a
+generated motive, minor, recursor, or rule typing judgment. -/
+structure BlockGenerationChecked.WF {source : VInductDecl}
+    (gen : BlockGenerationChecked source) (env blockEnv : VEnv) : Prop where
+  blockWF : gen.validated.WF env blockEnv
+  resultLevelWF : gen.validated.resultLevel.WF source.uvars
+  paramsTel :
+    env.TelDefEq source.uvars [] gen.block.rawParams
+      gen.block.checked.params
+  families : ∀ family ∈ gen.families, family.WF gen env
+  constructors :
+    ∀ constructor ∈ gen.flatCtors,
+      NormalizedBlockCtor.WF gen constructor blockEnv
+
+/-- Consumer-facing semantic package for one generation-ready inductive
+declaration.  The executable transaction inspects only `generation`; `wf` is
+the ordinary Theory certificate used by preservation and is never a
+normalization oracle.
+
+Verify can erase checker-specific candidate provenance to this boundary
+before handing a normalized transaction to downstream consumers. -/
+structure GenerationCertificate (source : VInductDecl) (env : VEnv) where
+  generation : GenerationChecked source
+  wf : generation.WF env
+
+/-- Consumer-facing proof-carrying mutual generation package. -/
+structure BlockGenerationCertificate (source : VInductDecl) (env : VEnv) where
+  generation : BlockGenerationChecked source
+  blockEnv : VEnv
+  wf : generation.WF env blockEnv
+
+end VInductDecl
+
+/-- Legacy declaration-level semantic contract for one-family compatibility.
+Block-wide preservation consumes `BlockGenerationChecked.WF` directly. -/
+def VInductDecl.WF (env : VEnv) (decl : VInductDecl) : Prop :=
+  decl.singletonStage3 ∧
+  ∀ ty ∈ decl.types,
+    VEnv.OnTel env decl.uvars []
+      (VExpr.telN decl.nparams ty.type ++
+        VInductDecl.ctorFields (VExpr.dropN decl.nparams ty.type)) ∧
+    ∀ c ∈ ty.ctors,
+      VInductDecl.fieldsWF decl.uvars ty.name decl.nparams env
+        (VInductDecl.sortLevel decl.nparams ty)
+        (VInductDecl.ctorFields (VExpr.dropN decl.nparams ty.type))
+        (VExpr.telN decl.nparams ty.type).reverse 0
+        (VInductDecl.ctorFields (VExpr.dropN decl.nparams c.type)) ∧
+      env.SpineWF decl.uvars
+        ((VInductDecl.ctorFields (VExpr.dropN decl.nparams c.type)).reverse ++
+          (VExpr.telN decl.nparams ty.type).reverse)
+        (VExpr.forallN
+          (VExpr.liftTelN (VInductDecl.ctorFields (VExpr.dropN decl.nparams c.type)).length
+            (VInductDecl.ctorFields (VExpr.dropN decl.nparams ty.type)) 0)
+          (.sort (VInductDecl.sortLevel decl.nparams ty)))
+        (VInductDecl.recFieldIdxs decl.nparams
+          (VExpr.resultOf (VExpr.dropN decl.nparams c.type)))
+        (.sort (VInductDecl.sortLevel decl.nparams ty))
+
+/-- Raw family constants of a block in source order. -/
+def VInductDecl.blockTypeConstants (source : VInductDecl) :
+    List VConstVal :=
+  source.types.map (·.toVConstVal)
+
+/-- Raw constructor constants flattened in family/constructor order. -/
+def VInductDecl.blockConstructorConstants (source : VInductDecl) :
+    List VConstVal :=
+  source.types.flatMap (·.ctors)
+
+/-- The single computational transaction for a generation-ready raw/view
+block. Stored family and constructor constants come from the raw source;
+recursor and rules come from the mixed artifact implementation. Semantic
+validity is a theorem premise, never an input to this computation. -/
+def VEnv.addInductGeneration {source : VInductDecl}
+    (env : VEnv) (gen : source.GenerationChecked) : Option VEnv := do
+  let ty := gen.block.sourceType
+  let env ← env.addConst ty.name ty.toVConstant
+  let env ← ty.ctors.foldlM
+    (fun env c => env.addConst c.name c.toVConstant) env
+  let env ← env.addConst (.str ty.name "rec") gen.recursor
+  return gen.generatedRules.foldl VEnv.addDefEq env
+
+/-- The block-wide generation transaction.  Its four phases deliberately
+match the kernel's visibility boundaries: every family is present before any
+constructor, every constructor before any recursor, and every recursor before
+the first reduction rule. -/
+def VEnv.addInductBlockGeneration {source : VInductDecl}
+    (env : VEnv) (gen : source.BlockGenerationChecked) : Option VEnv := do
+  let env ← source.blockTypeConstants.foldlM
+    (fun env type => env.addConst type.name type.toVConstant) env
+  let env ← source.blockConstructorConstants.foldlM
+    (fun env constructor => env.addConst constructor.name constructor.toVConstant) env
+  let env ← gen.recursors.foldlM
+    (fun env recursor => env.addConst recursor.name recursor.toVConstant) env
+  return gen.generatedRules.foldl VEnv.addDefEq env
+
+/-- Public proof-carrying wrapper around `addInductGeneration`.
+
+The certificate's proof is erased and does not influence computation.  This
+entry point lets a verified producer expose a non-identity normalization
+without exposing its checker trace or asking a consumer to remember a
+separate preservation premise. -/
+def VEnv.addInductCertified {source : VInductDecl}
+    (env : VEnv) (certificate : source.GenerationCertificate env) :
+    Option VEnv :=
+  env.addInductGeneration certificate.generation
+
+/-- Proof-carrying wrapper for a block-wide generation transaction.  The
+certificate is erased from computation. -/
+def VEnv.addInductBlockCertified {source : VInductDecl}
+    (env : VEnv) (certificate : source.BlockGenerationCertificate env) :
+    Option VEnv :=
+  env.addInductBlockGeneration certificate.generation
+
+@[simp] theorem VEnv.addInductCertified_eq_addInductGeneration
+    {source : VInductDecl} (env : VEnv)
+    (certificate : source.GenerationCertificate env) :
+    env.addInductCertified certificate =
+      env.addInductGeneration certificate.generation :=
+  rfl
+
+@[simp] theorem VEnv.addInductBlockCertified_eq_addInductBlockGeneration
+    {source : VInductDecl} (env : VEnv)
+    (certificate : source.BlockGenerationCertificate env) :
+    env.addInductBlockCertified certificate =
+      env.addInductBlockGeneration certificate.generation :=
+  rfl
+
+/-- Exact intermediate states of a successful normalized inductive
+transaction. Stable lookup, freshness, monotonicity, and preservation
+consequences are derived from this one trace in the typing layer. -/
+structure VEnv.AddInductGenerationTrace {source : VInductDecl}
+    (env env' : VEnv) (gen : source.GenerationChecked) where
+  typeEnv : VEnv
+  ctorEnv : VEnv
+  recEnv : VEnv
+  addType :
+    env.addConst gen.block.sourceType.name
+      gen.block.sourceType.toVConstant = some typeEnv
+  addCtors :
+    gen.block.sourceType.ctors.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) typeEnv =
+        some ctorEnv
+  addRec :
+    ctorEnv.addConst (.str gen.block.sourceType.name "rec")
+      gen.recursor = some recEnv
+  addRules :
+    gen.generatedRules.foldl VEnv.addDefEq recEnv = env'
+
+/-- Exact phase boundaries of a successful block-wide generation
+transaction. -/
+structure VEnv.AddInductBlockGenerationTrace {source : VInductDecl}
+    (env env' : VEnv) (gen : source.BlockGenerationChecked) where
+  typeEnv : VEnv
+  ctorEnv : VEnv
+  recEnv : VEnv
+  addTypes :
+    source.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) env =
+        some typeEnv
+  addCtors :
+    source.blockConstructorConstants.foldlM
+      (fun env constructor => env.addConst constructor.name constructor.toVConstant) typeEnv =
+        some ctorEnv
+  addRecs :
+    gen.recursors.foldlM
+      (fun env recursor => env.addConst recursor.name recursor.toVConstant)
+      ctorEnv = some recEnv
+  addRules :
+    gen.generatedRules.foldl VEnv.addDefEq recEnv = env'
+
+/-- The raw-normal-form API analyzes and inserts a complete mutual block. -/
+def VEnv.addInduct (env : VEnv) (decl : VInductDecl) : Option VEnv := do
+  let generation ← decl.identityBlockGeneration?
+  env.addInductBlockGeneration generation
+
+/-- Compatibility wrapper for the pre-Spec-08C one-family raw transaction.
+
+Unlike `addInduct`, this deliberately projects the legacy `Checked` artifact
+and therefore rejects every genuinely mutual declaration.  It remains only
+for a deprecation window so existing one-family consumers can separate their
+API migration from the semantic switch to block-wide generation. -/
+@[deprecated VEnv.addInduct (since := "2026-08-07")]
+def VEnv.addInductSingleton (env : VEnv) (decl : VInductDecl) : Option VEnv := do
+  let checked ← decl.checked?
+  env.addInductGeneration checked.identityGeneration
+
+/-- The compatibility wrapper is exactly the former identity-normalization
+transaction; it is not a second block-generation path. -/
+@[simp, deprecated VEnv.addInduct (since := "2026-08-07")]
+theorem VEnv.addInductSingleton_eq_addInductGeneration
+    (env : VEnv) (decl : VInductDecl) :
+    env.addInductSingleton decl =
+      decl.checked? >>= fun checked =>
+        env.addInductGeneration checked.identityGeneration :=
+  rfl
+
+/-- The raw public API is transparently the identity-normalization
+specialization of the normalized block transaction. -/
+theorem VEnv.addInduct_eq_addInductBlockGeneration
+    (env : VEnv) (decl : VInductDecl) :
+    env.addInduct decl =
+      decl.identityBlockGeneration? >>= fun generation =>
+        env.addInductBlockGeneration generation :=
+  rfl
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductSingleton_eq_addInductGeneration [propext, Classical.choice, Quot.sound]
+
+/-- Stable, consumer-facing consequences of a successful `addInduct`
+transaction. This deliberately hides the internal `foldlM` sequence: a
+caller receives the complete output environment and all generated objects, or
+`addInduct` returns `none` without exposing an intermediate environment. -/
+structure VEnv.AddInductSuccess (env env' : VEnv) (decl : VInductDecl) : Prop where
+  generation : ∃ generation, decl.identityBlockGeneration? = some generation
+  accepted : decl.stage3 = true
+  le : env ≤ env'
+  type_fresh : ∀ ty ∈ decl.types, env.constants ty.name = none
+  type_lookup : ∀ ty ∈ decl.types, env'.constants ty.name = some ty.toVConstant
+  ctor_fresh : ∀ ty ∈ decl.types, ∀ c ∈ ty.ctors, env.constants c.name = none
+  ctor_lookup : ∀ ty ∈ decl.types, ∀ c ∈ ty.ctors,
+    env'.constants c.name = some c.toVConstant
+  rec_fresh : ∀ generation, decl.identityBlockGeneration? = some generation →
+    ∀ recursor ∈ generation.recursors, env.constants recursor.name = none
+  rec_lookup : ∀ generation, decl.identityBlockGeneration? = some generation →
+    ∀ recursor ∈ generation.recursors,
+      env'.constants recursor.name = some recursor.toVConstant
+  rule_mem : ∀ generation, decl.identityBlockGeneration? = some generation →
+    ∀ df ∈ generation.generatedRules, env'.defeqs df
diff --git a/Ix/Theory/Named/InductiveFixtures.lean b/Ix/Theory/Named/InductiveFixtures.lean
new file mode 100644
index 000000000..f1b2ff3be
--- /dev/null
+++ b/Ix/Theory/Named/InductiveFixtures.lean
@@ -0,0 +1,2897 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Inductive
+import Ix.Theory.Named.Meta
+import Ix.Theory.Named.Typing.InductiveLemmas
+import Ix.Theory.Named.Typing.Meta
+
+open Ix.Theory (VLevel)
+
+/-! Adequacy fixtures for `VEnv.addInduct` (stage 3): run the generator on
+hand-written declarations and check the output against the real kernel's
+constants, translated by the `vconst`/`vdefeq` macros. A mismatch in
+telescope order, universe conventions, or de Bruijn arithmetic fails these
+`rfl`s. -/
+
+namespace Ix.Theory.Named
+namespace InductiveFixtures
+open VInductDecl
+
+/-- Permute the universe parameters of a translated constant. The `vconst`
+and `vdefeq` macros number universes by occurrence order (declaration
+levels first), while the kernel's recursors put the elimination level
+first; these fixtures compare via the explicit permutation. -/
+private def permC (ci : VConstant) (ls : List VLevel) : VConstant :=
+  ⟨ci.uvars, ci.type.instL ls⟩
+
+private def permE (df : VDefEq) (ls : List VLevel) : VDefEq :=
+  ⟨df.uvars, df.lhs.instL ls, df.rhs.instL ls, df.type.instL ls⟩
+
+/-! ## Nat -/
+
+def natType : VInductiveType where
+  name := ``Nat
+  uvars := 0
+  type := vexpr(Type)
+  ctors := [⟨vconst(type_of% @Nat.zero), ``Nat.zero⟩, ⟨vconst(type_of% @Nat.succ), ``Nat.succ⟩]
+
+def natDecl : VInductDecl := ⟨0, 0, [natType]⟩
+
+example : natDecl.stage3 = true := rfl
+
+/-- The shared checked analysis retains the normalized declaration data that
+generation and verification consume. -/
+def natChecked : natDecl.Checked := natDecl.checked?.get (by decide)
+
+/-- Identity normalization packages the existing raw-normal-form path without
+changing its analyzer result. -/
+def natNormalizedChecked : NormalizedChecked natDecl :=
+  (identityChecked? natDecl).get (by decide)
+
+def natGenerationChecked : GenerationChecked natDecl :=
+  (identityGeneration? natDecl).get (by decide)
+
+/-- The public block descriptor specializes to the same singleton metadata. -/
+def natBlockGenerationChecked : BlockGenerationChecked natDecl :=
+  (identityBlockGeneration? natDecl).get (by decide)
+
+example : natNormalizedChecked.normalization.view = natDecl := rfl
+example : natNormalizedChecked.checked.type = natType := rfl
+example : (normalizedChecked? natDecl natDecl).isSome = true := rfl
+example : (identityChecked? natDecl).isSome = natDecl.checked?.isSome :=
+  identityChecked?_isSome natDecl
+example : natGenerationChecked.block = natNormalizedChecked := rfl
+example : natGenerationChecked.block.ctorPairs.length = 2 := rfl
+example : natGenerationChecked.motiveType = natChecked.motiveType := rfl
+example : natGenerationChecked.minorTypes = natChecked.minorTypes := rfl
+example : natGenerationChecked.recursor = natChecked.recursor := rfl
+example : natGenerationChecked.generatedRules = natChecked.generatedRules := rfl
+
+example : natChecked.type = natType := rfl
+example : natChecked.params = [] := rfl
+example : natChecked.indices = [] := rfl
+example : natChecked.resultLevel = .succ .zero := rfl
+example : natChecked.elimination = .large := rfl
+example : natChecked.kTarget = false := rfl
+example : natGenerationChecked.kTarget = false := rfl
+example : natChecked.constructors.length = 2 := rfl
+example : natChecked.constructors[1].recursive.length = 1 := rfl
+example : natChecked.constructors[1].recursive[0].fieldIndex = 0 := rfl
+example : natChecked.constructors[1].recursive[0].binders = [] := rfl
+example : natChecked.recursor = recConst 0 ``Nat 0 natType := rfl
+example : natChecked.generatedRules = rules 0 ``Nat 0 natType := rfl
+example : natChecked.type.type.LevelWF natDecl.uvars := natChecked.type_levelWF
+example : ∀ c ∈ natChecked.type.ctors, c.type.LevelWF natDecl.uvars :=
+  fun _ hc => natChecked.ctor_levelWF hc
+
+/-- The generated recursor is exactly the kernel's `Nat.rec`. -/
+example : recConst 0 ``Nat 0 natType = vconst(type_of% @Nat.rec) := rfl
+
+/-- The generated iota rules are exactly the kernel's reduction rules for
+`Nat.rec`, phrased as closed lambda-telescope defeqs like `quotDefEq`. -/
+example : (rules 0 ``Nat 0 natType)[0]? =
+    some (vdefeq(motive z s => @Nat.rec motive z s .zero ≡ z)) := rfl
+
+example : (rules 0 ``Nat 0 natType)[1]? =
+    some (vdefeq(motive z s n => @Nat.rec motive z s (.succ n) ≡ s n (@Nat.rec motive z s n))) :=
+  rfl
+
+example : (VEnv.empty.addInduct natDecl).isSome = true := rfl
+
+example : (VEnv.empty.addInduct natDecl).map (·.constants ``Nat) =
+    some (some natType.toVConstant) := rfl
+
+example : (VEnv.empty.addInduct natDecl).map (·.constants ``Nat.rec) =
+    some (some (recConst 0 ``Nat 0 natType)) := rfl
+
+/-- The successor iota rule is registered in the output environment. -/
+example : ∀ env', VEnv.empty.addInduct natDecl = some env' →
+    env'.defeqs (rule 0 ``Nat 0 natType 1 ⟨vconst(type_of% @Nat.succ), ``Nat.succ⟩) := by
+  rintro env' ⟨⟩; exact .inl rfl
+
+/-! ## Bool -/
+
+def boolType : VInductiveType where
+  name := ``Bool
+  uvars := 0
+  type := vexpr(Type)
+  ctors := [⟨vconst(type_of% @Bool.false), ``Bool.false⟩, ⟨vconst(type_of% @Bool.true), ``Bool.true⟩]
+
+def boolDecl : VInductDecl := ⟨0, 0, [boolType]⟩
+
+example : boolDecl.stage3 = true := rfl
+
+example : recConst 0 ``Bool 0 boolType = vconst(type_of% @Bool.rec) := rfl
+
+example : (rules 0 ``Bool 0 boolType)[0]? =
+    some (vdefeq(motive f t => @Bool.rec motive f t .false ≡ f)) := rfl
+
+example : (rules 0 ``Bool 0 boolType)[1]? =
+    some (vdefeq(motive f t => @Bool.rec motive f t .true ≡ t)) := rfl
+
+/-! ## Unit/Empty edge shapes
+
+`Unit` is a reducible alias for `PUnit` on this Lean revision, so the actual
+one-constructor kernel metadata is recorded under `PUnit`. Together with
+`Empty`, these fixtures exercise the one- and zero-constructor generation
+paths without inventing an alias-level recursor that the kernel does not
+declare. -/
+
+def punitType : VInductiveType where
+  name := ``PUnit
+  uvars := 1
+  type := vconst(type_of% @PUnit).type
+  ctors := [⟨vconst(type_of% @PUnit.unit), ``PUnit.unit⟩]
+
+def punitDecl : VInductDecl := ⟨1, 0, [punitType]⟩
+
+example : punitDecl.stage3 = true := rfl
+
+def punitChecked : punitDecl.Checked := punitDecl.checked?.get (by decide)
+
+def punitGenerationChecked : GenerationChecked punitDecl :=
+  (identityGeneration? punitDecl).get (by decide)
+
+example : punitChecked.params = [] := rfl
+example : punitChecked.indices = [] := rfl
+example : punitChecked.resultLevel = .param 0 := rfl
+example : punitChecked.elimination = .large := rfl
+example : punitChecked.kTarget = false := rfl
+example : punitChecked.constructors.length = 1 := rfl
+example : punitChecked.constructors[0].fields = [] := rfl
+example : punitChecked.constructors[0].recursive = [] := rfl
+example : punitGenerationChecked.block.ctorPairs.length = 1 := rfl
+example : punitGenerationChecked.minorTypes.length = 1 := rfl
+example : punitGenerationChecked.generatedRules.length = 1 := rfl
+
+/-- The one-constructor recursor retains the fresh elimination universe before
+the source universe, and its sole minor occurs before the major. -/
+example : punitGenerationChecked.recursor =
+    permC (vconst(type_of% @PUnit.rec)) [.param 1, .param 0] := rfl
+
+example : punitGenerationChecked.generatedRules[0]? =
+    some (permE
+      (vdefeq((motive : PUnit.{u} → Sort v) unit =>
+        @PUnit.rec.{v, u} motive unit @PUnit.unit.{u} ≡ unit))
+      [.param 1, .param 0]) := rfl
+
+theorem punitDecl_wf : punitDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = punitType :=
+    List.mem_singleton.1 (by simpa [punitDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change True
+    trivial
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    constructor
+    · change True
+      trivial
+    · exact .nil
+
+def punitEnv : VEnv :=
+  (VEnv.empty.addInduct punitDecl).get (by decide)
+
+/-- The public checked transaction and the normalized generation core are the
+same computation for this identity-normalized edge fixture. -/
+example : VEnv.empty.addInduct punitDecl =
+    VEnv.empty.addInductGeneration punitGenerationChecked := rfl
+
+theorem punitEnv_ordered : punitEnv.Ordered :=
+  VEnv.addInductGeneration_WF .empty
+    ((punitChecked.wf_of_decl punitDecl_wf).identityGeneration .empty) rfl
+
+def emptyType : VInductiveType where
+  name := ``Empty
+  uvars := 0
+  type := vconst(type_of% @Empty).type
+  ctors := []
+
+def emptyDecl : VInductDecl := ⟨0, 0, [emptyType]⟩
+
+example : emptyDecl.stage3 = true := rfl
+
+def emptyChecked : emptyDecl.Checked := emptyDecl.checked?.get (by decide)
+
+def emptyGenerationChecked : GenerationChecked emptyDecl :=
+  (identityGeneration? emptyDecl).get (by decide)
+
+def emptyBlockGenerationChecked : BlockGenerationChecked emptyDecl :=
+  (identityBlockGeneration? emptyDecl).get (by decide)
+
+example : emptyChecked.params = [] := rfl
+example : emptyChecked.indices = [] := rfl
+example : emptyChecked.resultLevel = .succ .zero := rfl
+example : emptyChecked.elimination = .large := rfl
+example : emptyChecked.kTarget = false := rfl
+example : emptyChecked.constructors = [] := rfl
+example : emptyGenerationChecked.block.ctorPairs = [] := rfl
+example : emptyGenerationChecked.minorTypes = [] := rfl
+example : emptyGenerationChecked.generatedRules = [] := rfl
+
+/-- Empty elimination has a motive and major but no constructor minor. -/
+example : emptyGenerationChecked.recursor =
+    vconst(type_of% @Empty.rec) := rfl
+
+theorem emptyDecl_wf : emptyDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = emptyType :=
+    List.mem_singleton.1 (by simpa [emptyDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change True
+    trivial
+  · intro c hc
+    simp [emptyType] at hc
+
+def emptyEnv : VEnv :=
+  (VEnv.empty.addInduct emptyDecl).get (by decide)
+
+example : VEnv.empty.addInduct emptyDecl =
+    VEnv.empty.addInductGeneration emptyGenerationChecked := rfl
+
+theorem emptyEnv_ordered : emptyEnv.Ordered :=
+  VEnv.addInductGeneration_WF .empty
+    ((emptyChecked.wf_of_decl emptyDecl_wf).identityGeneration .empty) rfl
+
+/-! ## List: one parameter, a dependent field, direct recursion -/
+
+def listType : VInductiveType where
+  name := ``List
+  uvars := 1
+  type := vconst(type_of% @List).type
+  ctors := [⟨vconst(type_of% @List.nil), ``List.nil⟩, ⟨vconst(type_of% @List.cons), ``List.cons⟩]
+
+def listDecl : VInductDecl := ⟨1, 1, [listType]⟩
+
+example : listDecl.stage3 = true := rfl
+
+/-- The generated recursor is exactly the kernel's `List.rec`, with the
+occurrence-ordered `vconst` universes permuted to the kernel's
+elimination-level-first convention. -/
+example : recConst 1 ``List 1 listType =
+    permC (vconst(type_of% @List.rec)) [.param 1, .param 0] := rfl
+
+example : (rules 1 ``List 1 listType)[0]? =
+    some (permE (vdefeq(α motive n c => @List.rec α motive n c (@List.nil α) ≡ n))
+      [.param 1, .param 0]) := rfl
+
+example : (rules 1 ``List 1 listType)[1]? =
+    some (permE (vdefeq(α motive n c hd tl =>
+        @List.rec α motive n c (@List.cons α hd tl) ≡
+          c hd tl (@List.rec α motive n c tl)))
+      [.param 1, .param 0]) := rfl
+
+example : (VEnv.empty.addInduct listDecl).isSome = true := rfl
+
+/-! ## Prod: two parameters, no recursion -/
+
+def prodType : VInductiveType where
+  name := ``Prod
+  uvars := 2
+  type := vconst(type_of% @Prod).type
+  ctors := [⟨vconst(type_of% @Prod.mk), ``Prod.mk⟩]
+
+def prodDecl : VInductDecl := ⟨2, 2, [prodType]⟩
+
+example : prodDecl.stage3 = true := rfl
+
+example : recConst 2 ``Prod 2 prodType =
+    permC (vconst(type_of% @Prod.rec)) [.param 1, .param 2, .param 0] := rfl
+
+example : (rules 2 ``Prod 2 prodType)[0]? =
+    some (permE (vdefeq(α β motive mk a b =>
+        @Prod.rec α β motive mk (@Prod.mk α β a b) ≡ mk a b))
+      [.param 1, .param 2, .param 0]) := rfl
+
+/-! ## Option: one parameter, two constructors -/
+
+def optionType : VInductiveType where
+  name := ``Option
+  uvars := 1
+  type := vconst(type_of% @Option).type
+  ctors := [⟨vconst(type_of% @Option.none), ``Option.none⟩,
+    ⟨vconst(type_of% @Option.some), ``Option.some⟩]
+
+def optionDecl : VInductDecl := ⟨1, 1, [optionType]⟩
+
+example : optionDecl.stage3 = true := rfl
+
+example : recConst 1 ``Option 1 optionType =
+    permC (vconst(type_of% @Option.rec)) [.param 1, .param 0] := rfl
+
+example : (rules 1 ``Option 1 optionType)[0]? =
+    some (permE (vdefeq(α motive n s => @Option.rec α motive n s (@Option.none α) ≡ n))
+      [.param 1, .param 0]) := rfl
+
+example : (rules 1 ``Option 1 optionType)[1]? =
+    some (permE (vdefeq(α motive n s a => @Option.rec α motive n s (@Option.some α a) ≡ s a))
+      [.param 1, .param 0]) := rfl
+
+/-! ## Eq: parameters, one index, Prop-valued with subsingleton
+elimination -/
+
+def eqType : VInductiveType where
+  name := ``Eq
+  uvars := 1
+  type := vconst(type_of% @Eq).type
+  ctors := [⟨vconst(type_of% @Eq.refl), ``Eq.refl⟩]
+
+def eqDecl : VInductDecl := ⟨1, 2, [eqType]⟩
+
+example : eqDecl.stage3 = true := rfl
+
+def eqChecked : eqDecl.Checked := eqDecl.checked?.get (by decide)
+
+def eqGenerationChecked : GenerationChecked eqDecl :=
+  (identityGeneration? eqDecl).get (by decide)
+
+example : eqChecked.params = [.sort (.param 0), .bvar 0] := rfl
+example : eqChecked.indices = [.bvar 1] := rfl
+example : eqChecked.resultLevel = .zero := rfl
+example : eqChecked.elimination = .large := rfl
+example : eqChecked.kTarget = true := rfl
+example : eqGenerationChecked.kTarget = true := rfl
+example : eqChecked.constructors[0].resultIndices = [.bvar 0] := rfl
+example : eqChecked.recursor = recConst 1 ``Eq 2 eqType := rfl
+example : eqGenerationChecked.motiveType = eqChecked.motiveType := rfl
+example : eqGenerationChecked.minorTypes = eqChecked.minorTypes := rfl
+example : eqGenerationChecked.recursor = eqChecked.recursor := rfl
+example : eqGenerationChecked.generatedRules = eqChecked.generatedRules := rfl
+
+/-- The generated recursor is exactly the kernel's `Eq.rec`. -/
+example : recConst 1 ``Eq 2 eqType =
+    permC (vconst(type_of% @Eq.rec)) [.param 1, .param 0] := rfl
+
+example : (rules 1 ``Eq 2 eqType)[0]? =
+    some (permE (vdefeq(α a motive r =>
+      @Eq.rec α a motive r a (@Eq.refl α a) ≡ r)) [.param 1, .param 0]) := rfl
+
+example : (VEnv.empty.addInduct eqDecl).isSome = true := rfl
+
+/-! ## HEq: two indices, one of them a sort -/
+
+def heqType : VInductiveType where
+  name := ``HEq
+  uvars := 1
+  type := vconst(type_of% @HEq).type
+  ctors := [⟨vconst(type_of% @HEq.refl), ``HEq.refl⟩]
+
+def heqDecl : VInductDecl := ⟨1, 2, [heqType]⟩
+
+example : heqDecl.stage3 = true := rfl
+
+example : recConst 1 ``HEq 2 heqType =
+    permC (vconst(type_of% @HEq.rec)) [.param 1, .param 0] := rfl
+
+example : (rules 1 ``HEq 2 heqType)[0]? =
+    some (permE (vdefeq((α : Sort u) (a : α)
+        (motive : {β : Sort u} → (b : β) → HEq a b → Sort v)
+        (r : @motive α a (@HEq.refl α a)) =>
+      @HEq.rec α a (@motive) r α a (@HEq.refl α a) ≡ r)) [.param 1, .param 0]) := rfl
+
+/-! ## IndexedVec: recursive occurrence at a changing index -/
+
+inductive IndexedVec (α : Type u) : Nat → Type u where
+  | nil : IndexedVec α Nat.zero
+  | cons {n} : α → IndexedVec α n → IndexedVec α (Nat.succ n)
+
+def indexedVecType : VInductiveType where
+  name := ``IndexedVec
+  uvars := 1
+  type := vconst(type_of% @IndexedVec).type
+  ctors := [⟨vconst(type_of% @IndexedVec.nil), ``IndexedVec.nil⟩,
+    ⟨vconst(type_of% @IndexedVec.cons), ``IndexedVec.cons⟩]
+
+def indexedVecDecl : VInductDecl := ⟨1, 1, [indexedVecType]⟩
+
+example : indexedVecDecl.stage3 = true := rfl
+
+def indexedVecChecked : indexedVecDecl.Checked :=
+  indexedVecDecl.checked?.get (by decide)
+
+def indexedVecGenerationChecked : GenerationChecked indexedVecDecl :=
+  (identityGeneration? indexedVecDecl).get (by decide)
+
+example : indexedVecChecked.params = [.sort (.succ (.param 0))] := rfl
+example : indexedVecChecked.indices = [.const ``Nat []] := rfl
+example : indexedVecChecked.resultLevel = .succ (.param 0) := rfl
+example : indexedVecChecked.elimination = .large := rfl
+example : indexedVecChecked.constructors.length = 2 := rfl
+example : indexedVecChecked.constructors[1].fields.length = 3 := rfl
+example : indexedVecChecked.constructors[1].recursive.length = 1 := rfl
+example : indexedVecChecked.constructors[1].recursive[0].fieldIndex = 2 := rfl
+example : indexedVecChecked.constructors[1].recursive[0].binders = [] := rfl
+example : indexedVecChecked.constructors[1].recursive[0].targetType = 0 := rfl
+example : indexedVecChecked.constructors[1].recursive[0].indices = [.bvar 1] := rfl
+example : indexedVecChecked.constructors[1].resultIndices =
+    [VExpr.app (VExpr.const ``Nat.succ []) (VExpr.bvar 2)] := rfl
+example : indexedVecChecked.recursor =
+    recConst 1 ``IndexedVec 1 indexedVecType := rfl
+example : indexedVecChecked.generatedRules =
+    rules 1 ``IndexedVec 1 indexedVecType := rfl
+example : indexedVecGenerationChecked.motiveType =
+    indexedVecChecked.motiveType := rfl
+example : indexedVecGenerationChecked.minorTypes =
+    indexedVecChecked.minorTypes := rfl
+example : indexedVecGenerationChecked.recursor =
+    indexedVecChecked.recursor := rfl
+example : indexedVecGenerationChecked.generatedRules =
+    indexedVecChecked.generatedRules := rfl
+
+/-- Semantic clients can migrate from the legacy declaration-level contract
+to the normalized descriptor without re-analyzing its syntax. -/
+example {env : VEnv} (h : indexedVecDecl.WF env) :
+    indexedVecChecked.WF env :=
+  indexedVecChecked.wf_of_decl h
+
+/-- The descriptor contract remains definitionally compatible with existing
+preservation clients while that migration is in progress. -/
+example {env : VEnv} (h : indexedVecChecked.WF env) :
+    indexedVecDecl.WF env :=
+  indexedVecChecked.to_declWF rfl h
+
+example : recConst 1 ``IndexedVec 1 indexedVecType =
+    permC (vconst(type_of% @IndexedVec.rec)) [.param 1, .param 0] := rfl
+
+example : (rules 1 ``IndexedVec 1 indexedVecType)[0]? =
+    some (permE (vdefeq((α : Type u)
+      (motive : (n : Nat) → IndexedVec α n → Sort v)
+      (nil : motive Nat.zero (@IndexedVec.nil α))
+      (cons : {n : Nat} → (a : α) → (as : IndexedVec α n) →
+        motive n as → motive (Nat.succ n) (@IndexedVec.cons α n a as)) =>
+      @IndexedVec.rec α motive nil (@cons) Nat.zero (@IndexedVec.nil α) ≡ nil))
+      [.param 1, .param 0]) := rfl
+
+example : (rules 1 ``IndexedVec 1 indexedVecType)[1]? =
+    some (permE (vdefeq((α : Type u)
+      (motive : (n : Nat) → IndexedVec α n → Sort v)
+      (nil : motive Nat.zero (@IndexedVec.nil α))
+      (cons : {n : Nat} → (a : α) → (as : IndexedVec α n) →
+        motive n as → motive (Nat.succ n) (@IndexedVec.cons α n a as))
+      (n : Nat) (a : α) (as : IndexedVec α n) =>
+      @IndexedVec.rec α motive nil (@cons) (Nat.succ n)
+          (@IndexedVec.cons α n a as) ≡
+        @cons n a as (@IndexedVec.rec α motive nil (@cons) n as)))
+      [.param 1, .param 0]) := rfl
+
+example : (VEnv.empty.addInduct indexedVecDecl).isSome = true := rfl
+
+/-- Consumers obtain constructor lookup without unfolding the transactional
+constructor fold. -/
+example : ∀ env', VEnv.empty.addInduct indexedVecDecl = some env' →
+    env'.constants ``IndexedVec.cons = some indexedVecType.ctors[1].toVConstant := by
+  intro env' hadd
+  exact VEnv.addInduct_ctor_lookup hadd (.head _) (.tail _ (.head _))
+
+/-- The complete all-or-nothing postcondition is available from the same
+successful call. -/
+example : ∀ env', VEnv.empty.addInduct indexedVecDecl = some env' →
+    VEnv.AddInductSuccess VEnv.empty env' indexedVecDecl :=
+  fun _ => VEnv.addInduct_success
+
+/-- The transaction certificate exposes the exact block-generation result for
+ix-like consumers without re-running structural analysis. -/
+example : ∀ env', VEnv.empty.addInduct indexedVecDecl = some env' →
+    ∃ generation,
+      indexedVecDecl.identityBlockGeneration? = some generation :=
+  fun _ => VEnv.addInduct_generation
+
+/-! ## Acc: recursive argument beneath a Pi telescope
+
+`Acc.intro`'s recursive field is a function taking two arguments, and its
+induction hypothesis is itself a two-argument function. This fixture exercises
+the complete public checked/generation/transaction path, not a side generator. -/
+
+def accType : VInductiveType where
+  name := ``Acc
+  uvars := 1
+  type := vconst(type_of% @Acc).type
+  ctors := [⟨vconst(type_of% @Acc.intro), ``Acc.intro⟩]
+
+def accDecl : VInductDecl := ⟨1, 2, [accType]⟩
+
+example : accDecl.stage3 = true := rfl
+
+def accChecked : accDecl.Checked := accDecl.checked?.get (by decide)
+
+def accGenerationChecked : GenerationChecked accDecl :=
+  (identityGeneration? accDecl).get (by decide)
+
+def accBlockGenerationChecked : BlockGenerationChecked accDecl :=
+  (identityBlockGeneration? accDecl).get (by decide)
+
+def accRecArgs : List RecArg :=
+  recArgs 1 ``Acc 2 1 (ctorFields (VExpr.dropN 2 accType.ctors[0].type))
+
+example : (ctorFields (VExpr.dropN 2 accType.ctors[0].type)).length = 2 := rfl
+example : accRecArgs.length = 1 := rfl
+example : accRecArgs[0].fieldIndex = 1 := rfl
+example : accRecArgs[0].binders.length = 2 := rfl
+example : accRecArgs[0].targetType = 0 := rfl
+example : accRecArgs[0].indices = [.bvar 1] := rfl
+example : accChecked.type = accType := rfl
+example : accChecked.constructors[0].recursive = accRecArgs := rfl
+example : accChecked.recursor = recConstRec 1 ``Acc 2 accType := rfl
+example : accChecked.generatedRules = rulesRec 1 ``Acc 2 accType := rfl
+example : accGenerationChecked.motiveType = accChecked.motiveType := rfl
+example : accGenerationChecked.minorTypes = accChecked.minorTypes := rfl
+example : accGenerationChecked.recursor = accChecked.recursor := rfl
+example : accGenerationChecked.generatedRules = accChecked.generatedRules := rfl
+
+/-- The generalized recursor type is definitionally the kernel's `Acc.rec`,
+including its functional induction hypothesis. -/
+example : recConstRec 1 ``Acc 2 accType =
+    permC (vconst(type_of% @Acc.rec)) [.param 1, .param 0] := rfl
+
+/-- The generalized iota RHS recurs under both binders of the recursive
+function argument, exactly as Lean's kernel rule does. -/
+example : (rulesRec 1 ``Acc 2 accType)[0]? =
+    some (permE (vdefeq((α : Sort u) (r : α → α → Prop)
+      (motive : (a : α) → Acc r a → Sort v)
+      (intro : (a : α) → (h : (b : α) → r b a → Acc r b) →
+        ((b : α) → (hba : r b a) → motive b (h b hba)) →
+        motive a (@Acc.intro α r a h))
+      (a : α) (h : (b : α) → r b a → Acc r b) =>
+      @Acc.rec α r motive intro a (@Acc.intro α r a h) ≡
+        intro a h (fun b hba => @Acc.rec α r motive intro b (h b hba))))
+      [.param 1, .param 0]) := rfl
+
+/-- Recursive-Pi declarations now run through the same all-or-nothing public
+transaction as direct recursive declarations. -/
+example : (VEnv.empty.addInduct accDecl).isSome = true := rfl
+
+example : (VEnv.empty.addInduct accDecl).map (·.constants ``Acc.rec) =
+    some (some (recConstRec 1 ``Acc 2 accType)) := rfl
+
+example : ∀ env', VEnv.empty.addInduct accDecl = some env' →
+    env'.defeqs (ruleRec 1 ``Acc 2 accType 0 accType.ctors[0]) := by
+  intro env' hadd
+  apply VEnv.addInduct_rule_mem hadd
+    (generation := accBlockGenerationChecked) rfl
+  change ruleRec 1 ``Acc 2 accType 0 accType.ctors[0] ∈
+    accBlockGenerationChecked.generatedRules
+  exact .head _
+
+example : ∀ env', VEnv.empty.addInduct accDecl = some env' →
+    VEnv.AddInductSuccess VEnv.empty env' accDecl :=
+  fun _ => VEnv.addInduct_success
+
+/-- `Acc` satisfies the semantic declaration contract, including the
+impredicative-Prop exception for its universe-polymorphic index field and the
+typed telescope beneath its recursive Pi argument. -/
+theorem accDecl_wf : accDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = accType := List.mem_singleton.1 (by simpa [accDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change VEnv.empty.OnTel 1 []
+      [.sort (.param 0),
+        .forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)),
+        .bvar 1]
+    exact ⟨⟨_, by type_tac⟩, ⟨⟨_, by type_tac⟩, ⟨⟨_, by type_tac⟩, trivial⟩⟩⟩
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    constructor
+    · change fieldsWF 1 ``Acc 2 VEnv.empty .zero [.bvar 1]
+        [.forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)), .sort (.param 0)] 0
+        [.bvar 1,
+          .forallE (.bvar 2)
+            (.forallE (.app (.app (.bvar 2) (.bvar 0)) (.bvar 1))
+              (.app (.app (.app (.const ``Acc [.param 0]) (.bvar 4)) (.bvar 3))
+                (.bvar 1)))]
+      refine ⟨?_, ?_, ?_⟩
+      · exact .inr (.inr ⟨rfl, .param 0, by type_tac, .inl rfl⟩)
+      · intro h
+        change false = true at h
+        contradiction
+      · dsimp only [fieldsWF]
+        refine ⟨?_, ?_, trivial⟩
+        · refine .inr (.inl ⟨accRecArgs[0], rfl, ?_, ?_⟩)
+          · decide
+          · change
+              VEnv.empty.OnTel 1
+                  [.bvar 1,
+                    .forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)),
+                    .sort (.param 0)]
+                  [.bvar 2, .app (.app (.bvar 2) (.bvar 0)) (.bvar 1)] ∧
+                VEnv.empty.SpineWF 1
+                  [.app (.app (.bvar 2) (.bvar 0)) (.bvar 1), .bvar 2,
+                    .bvar 1,
+                    .forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)),
+                    .sort (.param 0)]
+                  (.forallE (.bvar 4) (.sort .zero)) [.bvar 1] (.sort .zero)
+            constructor
+            · exact ⟨⟨_, by type_tac⟩, ⟨⟨_, by type_tac⟩, trivial⟩⟩
+            · exact .cons (by type_tac) .nil
+        · intro h
+          change false = true at h
+          contradiction
+    · change VEnv.empty.SpineWF 1
+        [.forallE (.bvar 2)
+            (.forallE (.app (.app (.bvar 2) (.bvar 0)) (.bvar 1))
+              (.app (.app (.app (.const ``Acc [.param 0]) (.bvar 4)) (.bvar 3))
+                (.bvar 1))),
+          .bvar 1,
+          .forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)),
+          .sort (.param 0)]
+        (.forallE (.bvar 3) (.sort .zero)) [.bvar 1] (.sort .zero)
+      exact .cons (by type_tac) .nil
+
+/-- The concrete public Acc transaction preserves environment order. -/
+def accEnv : VEnv := (VEnv.empty.addInduct accDecl).get (by decide)
+
+example : accEnv.Ordered :=
+  VEnv.addInductGeneration_WF .empty
+    ((accChecked.wf_of_decl accDecl_wf).identityGeneration .empty) rfl
+
+/-- A collision at the generated recursor name still rejects the whole Acc
+transaction; no recursive-Pi special case bypasses freshness. -/
+def accRecCollisionEnv : VEnv :=
+  (VEnv.empty.addConst ``Acc.rec ⟨0, .sort .zero⟩).get (by decide)
+
+example : accRecCollisionEnv.addInduct accDecl = none :=
+  VEnv.addInduct_eq_none_of_rec_present
+    (generation := accBlockGenerationChecked) rfl (.head _) ⟨_, rfl⟩
+
+/-! ## AnnotatedPi: recursive Pi normalization below a constructor field
+
+Lean retains `outParam` in the constructor's raw recursive-function domain,
+while inductive analysis consumes it before recognizing the recursive target.
+This fixture combines the annotation and recursive-Pi seams in one declaration
+and keeps the raw binder syntax in generated artifacts. -/
+
+inductive AnnotatedPi : Type where
+  | mk : ((p : outParam Prop) → AnnotatedPi) → AnnotatedPi
+
+def outParamDefEq : VDefEq :=
+  vdefeq(@outParam ≡ fun (α : Sort u) => α)
+
+def outParamConstEnv : VEnv :=
+  (VEnv.empty.addConst ``outParam (vconst(type_of% @outParam))).get
+    (by decide)
+
+def outParamEnv : VEnv := outParamConstEnv.addDefEq outParamDefEq
+
+theorem outParamConstant_wf :
+    (vconst(type_of% @outParam) : VConstant).WF VEnv.empty := by
+  exact ⟨_, VEnv.HasType.forallE
+    (VEnv.HasType.sort (by decide))
+    (VEnv.HasType.sort (by decide))⟩
+
+theorem outParamConstEnv_ordered : outParamConstEnv.Ordered := by
+  apply VEnv.Ordered.const VEnv.Ordered.empty
+    (ci := vconst(type_of% @outParam))
+  · exact outParamConstant_wf
+  · rfl
+
+theorem outParamEnv_ordered : outParamEnv.Ordered := by
+  apply VEnv.Ordered.defeq outParamConstEnv_ordered
+  constructor
+  · exact VEnv.HasType.const0 rfl
+      (outParamConstant_wf.mono
+        (VEnv.addConst_le (by rfl :
+          VEnv.empty.addConst ``outParam (vconst(type_of% @outParam)) =
+            some outParamConstEnv)))
+  · exact VEnv.HasType.lam
+      (VEnv.HasType.sort (by decide))
+      (VEnv.HasType.bvar .zero)
+
+def annotatedPiRawType : VInductiveType where
+  name := ``AnnotatedPi
+  uvars := 0
+  type := vconst(type_of% @AnnotatedPi).type
+  ctors := [⟨vconst(type_of% @AnnotatedPi.mk), ``AnnotatedPi.mk⟩]
+
+def annotatedPiRawDecl : VInductDecl := ⟨0, 0, [annotatedPiRawType]⟩
+
+def annotatedPiViewCtor : VConstVal where
+  name := ``AnnotatedPi.mk
+  uvars := 0
+  type := .forallE
+    (.forallE (.sort .zero) (.const ``AnnotatedPi []))
+    (.const ``AnnotatedPi [])
+
+def annotatedPiViewType : VInductiveType :=
+  { annotatedPiRawType with ctors := [annotatedPiViewCtor] }
+
+def annotatedPiViewDecl : VInductDecl := ⟨0, 0, [annotatedPiViewType]⟩
+
+example : annotatedPiRawType.ctors[0].type =
+    .forallE
+      (.forallE
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        (.const ``AnnotatedPi []))
+      (.const ``AnnotatedPi []) := rfl
+
+example : annotatedPiViewDecl.checked?.isSome = true := rfl
+example : normalizationShape annotatedPiRawDecl annotatedPiViewDecl = true :=
+  rfl
+
+def annotatedPiNormalization : Normalization annotatedPiRawDecl where
+  view := annotatedPiViewDecl
+  shape_eq := rfl
+
+def annotatedPiViewChecked : annotatedPiViewDecl.Checked :=
+  annotatedPiViewDecl.checked?.get (by decide)
+
+def annotatedPiBlock : NormalizedChecked annotatedPiRawDecl :=
+  annotatedPiNormalization.check?.get (by decide)
+
+def annotatedPiGenerationChecked : GenerationChecked annotatedPiRawDecl :=
+  annotatedPiBlock.generation?.get (by decide)
+
+def annotatedPiRecArg : RecArg where
+  fieldIndex := 0
+  binders := [.sort .zero]
+  targetType := 0
+  indices := []
+
+example : annotatedPiViewChecked.constructors[0].recursive =
+    [annotatedPiRecArg] := rfl
+
+example : annotatedPiGenerationChecked.block.ctorPairs[0].rawFields 0 =
+    [.forallE
+      (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+      (.const ``AnnotatedPi [])] := rfl
+
+example : annotatedPiGenerationChecked.recursor =
+    vconst(type_of% @AnnotatedPi.rec) := rfl
+
+example : annotatedPiGenerationChecked.generatedRules[0].rhs =
+    (vdefeq((motive : AnnotatedPi → Sort u)
+      (mk : (f : (p : outParam Prop) → AnnotatedPi) →
+        ((p : Prop) → motive (f p)) → motive (@AnnotatedPi.mk f))
+      (f : (p : outParam Prop) → AnnotatedPi) =>
+      @AnnotatedPi.rec motive mk (@AnnotatedPi.mk f) ≡
+        mk f (fun p => @AnnotatedPi.rec motive mk (f p)))).rhs := rfl
+
+/-- The normalized recursive-Pi view is semantically well formed without
+using the annotation definition; the raw-to-view bridge is supplied later by
+the exact checker candidate. -/
+theorem annotatedPiViewDecl_wf : annotatedPiViewDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = annotatedPiViewType :=
+    List.mem_singleton.1 (by simpa [annotatedPiViewDecl] using hty)
+  subst ty
+  refine ⟨by trivial, ?_⟩
+  intro c hc
+  have hc' : c = annotatedPiViewCtor :=
+    List.mem_singleton.1 (by simpa [annotatedPiViewType] using hc)
+  subst c
+  constructor
+  · change fieldsWF 0 ``AnnotatedPi 0 VEnv.empty (.succ .zero) [] [] 0
+      [.forallE (.sort .zero) (.const ``AnnotatedPi [])]
+    refine ⟨?_, ?_, trivial⟩
+    · right
+      left
+      refine ⟨annotatedPiRecArg, ?_, ?_, ?_⟩
+      · rfl
+      · simp [annotatedPiRecArg]
+      · exact ⟨⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩, .nil⟩
+    · intro h
+      change false = true at h
+      contradiction
+  · change VEnv.empty.SpineWF 0
+      [.forallE (.sort .zero) (.const ``AnnotatedPi [])]
+      (.sort (.succ .zero)) [] (.sort (.succ .zero))
+    exact .nil
+
+theorem annotatedPiViewChecked_wf :
+    annotatedPiViewChecked.WF outParamEnv := by
+  apply VInductDecl.Checked.WF.mono
+    ((VEnv.addConst_le (by rfl :
+      VEnv.empty.addConst ``outParam (vconst(type_of% @outParam)) =
+        some outParamConstEnv)).trans VEnv.addDefEq_le)
+  exact annotatedPiViewChecked.wf_of_decl annotatedPiViewDecl_wf
+
+/-! ## AnnotatedParam: definitionally equal constructor parameters
+
+Family validation consumes the `outParam` annotation before recording its
+parameter local. Constructor metadata retains the annotation, so the ordinary
+validator must use definitional equality rather than syntax when it checks the
+constructor's parameter prefix. -/
+
+inductive AnnotatedParam (alpha : outParam Type) : Type where
+  | mk : AnnotatedParam alpha
+
+def annotatedParamRawType : VInductiveType where
+  name := ``AnnotatedParam
+  uvars := 0
+  type := vconst(type_of% @AnnotatedParam).type
+  ctors := [⟨vconst(type_of% @AnnotatedParam.mk), ``AnnotatedParam.mk⟩]
+
+def annotatedParamRawDecl : VInductDecl :=
+  ⟨0, 1, [annotatedParamRawType]⟩
+
+def annotatedParamViewCtor : VConstVal where
+  name := ``AnnotatedParam.mk
+  uvars := 0
+  type := .forallE (.sort (.succ .zero))
+    (.app (.const ``AnnotatedParam []) (.bvar 0))
+
+def annotatedParamViewType : VInductiveType where
+  name := ``AnnotatedParam
+  uvars := 0
+  type := .forallE (.sort (.succ .zero)) (.sort (.succ .zero))
+  ctors := [annotatedParamViewCtor]
+
+def annotatedParamViewDecl : VInductDecl :=
+  ⟨0, 1, [annotatedParamViewType]⟩
+
+example : annotatedParamRawType.type =
+    .forallE
+      (.app (.const ``outParam [.succ (.succ .zero)])
+        (.sort (.succ .zero)))
+      (.sort (.succ .zero)) := rfl
+
+example : annotatedParamRawType.ctors[0].type =
+    .forallE
+      (.app (.const ``outParam [.succ (.succ .zero)])
+        (.sort (.succ .zero)))
+      (.app (.const ``AnnotatedParam []) (.bvar 0)) := rfl
+
+example : annotatedParamViewDecl.checked?.isSome = true := rfl
+example : normalizationShape annotatedParamRawDecl annotatedParamViewDecl =
+    true := rfl
+
+def annotatedParamNormalization : Normalization annotatedParamRawDecl where
+  view := annotatedParamViewDecl
+  shape_eq := rfl
+
+def annotatedParamViewChecked : annotatedParamViewDecl.Checked :=
+  annotatedParamViewDecl.checked?.get (by decide)
+
+def annotatedParamBlock : NormalizedChecked annotatedParamRawDecl :=
+  annotatedParamNormalization.check?.get (by decide)
+
+def annotatedParamGenerationChecked :
+    GenerationChecked annotatedParamRawDecl :=
+  annotatedParamBlock.generation?.get (by decide)
+
+example : annotatedParamGenerationChecked.recursor =
+    vconst(type_of% @AnnotatedParam.rec) := rfl
+
+example : annotatedParamGenerationChecked.generatedRules[0]? =
+    some (vdefeq((alpha : Type)
+      (motive : AnnotatedParam alpha → Sort u)
+      (mk : motive (@AnnotatedParam.mk alpha)) =>
+      @AnnotatedParam.rec alpha motive mk (@AnnotatedParam.mk alpha) ≡ mk)) := rfl
+
+/-- The raw parameter domain retained by kernel metadata before annotation
+consumption. -/
+def annotatedParamRawDomain : VExpr :=
+  .app (.const ``outParam [.succ (.succ .zero)])
+    (.sort (.succ .zero))
+
+/-- The stored `outParam Type` parameter and the checked `Type` parameter are
+definitionally equal in the exact pre-declaration environment. -/
+theorem annotatedParamRawDomain_defeq :
+    outParamEnv.IsDefEq 0 [] annotatedParamRawDomain
+      (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) := by
+  have hfn : outParamEnv.IsDefEq 0 []
+      (.const ``outParam [.succ (.succ .zero)])
+      (.lam (.sort (.succ (.succ .zero))) (.bvar 0))
+      (.forallE (.sort (.succ (.succ .zero)))
+        (.sort (.succ (.succ .zero)))) := by
+    simpa [outParamDefEq, VExpr.instL, VLevel.inst] using
+      (VEnv.IsDefEq.extra (env := outParamEnv) (uvars := 0) (Γ := [])
+        (df := outParamDefEq) (ls := [.succ (.succ .zero)])
+        (by simp [outParamEnv, VEnv.addDefEq])
+        (by simp; decide) rfl)
+  have harg : outParamEnv.HasType 0 []
+      (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) :=
+    VEnv.HasType.sort (by decide)
+  exact (VEnv.IsDefEq.appDF hfn harg).trans
+    (VEnv.IsDefEq.beta (VEnv.HasType.bvar .zero) harg)
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.annotatedParamRawDomain_defeq [propext, Quot.sound]
+
+/-- The annotation-consumed declaration accepted by the structural analyzer
+has the ordinary direct semantic interpretation. -/
+theorem annotatedParamViewDecl_wf :
+    annotatedParamViewDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = annotatedParamViewType :=
+    List.mem_singleton.1 (by
+      simpa [annotatedParamViewDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change VEnv.OnTel VEnv.empty 0 [] [.sort (.succ .zero)]
+    exact ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+  · intro c hc
+    have hc' : c = annotatedParamViewCtor :=
+      List.mem_singleton.1 (by
+        simpa [annotatedParamViewType] using hc)
+    subst c
+    exact ⟨trivial, .nil⟩
+
+/-- Exact Theory environment after staging the stored family constant. -/
+def annotatedParamTypeEnv : VEnv :=
+  (outParamEnv.addConst annotatedParamRawType.name
+    annotatedParamRawType.toVConstant).get (by decide)
+
+theorem annotatedParamTypeEnv_ordered :
+    annotatedParamTypeEnv.Ordered := by
+  have hbody : outParamEnv.HasType 0 [annotatedParamRawDomain]
+      (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) :=
+    VEnv.HasType.sort (by decide)
+  apply VEnv.Ordered.const (n := annotatedParamRawType.name)
+    (ci := annotatedParamRawType.toVConstant)
+    outParamEnv_ordered
+  · exact ⟨.imax (.succ (.succ .zero)) (.succ (.succ .zero)),
+      VEnv.HasType.forallE
+        (VEnv.IsDefEq.hasType annotatedParamRawDomain_defeq).1 hbody⟩
+  · rfl
+
+private theorem annotatedParamFamilyApp_hasType (domain : VExpr)
+    (hdomain : annotatedParamTypeEnv.HasType 0 [domain]
+      (.bvar 0) annotatedParamRawDomain) :
+    annotatedParamTypeEnv.HasType 0 [domain]
+      (.app (.const ``AnnotatedParam []) (.bvar 0))
+      (.sort (.succ .zero)) := by
+  apply VEnv.HasType.app
+    (A := annotatedParamRawDomain) (B := .sort (.succ .zero))
+  · simpa [annotatedParamRawType, annotatedParamRawDomain,
+        VExpr.instL, VLevel.inst] using
+      VEnv.HasType.const (env := annotatedParamTypeEnv) (U := 0)
+        (Γ := [domain]) (c := ``AnnotatedParam)
+        (ci := annotatedParamRawType.toVConstant) (ls := [])
+        (VEnv.addConst_self (show
+          outParamEnv.addConst annotatedParamRawType.name
+            annotatedParamRawType.toVConstant =
+              some annotatedParamTypeEnv from rfl))
+        (by simp) rfl
+  · exact hdomain
+
+theorem annotatedParamRawCtorBody_hasType :
+    annotatedParamTypeEnv.HasType 0 [annotatedParamRawDomain]
+      (.app (.const ``AnnotatedParam []) (.bvar 0))
+      (.sort (.succ .zero)) := by
+  apply annotatedParamFamilyApp_hasType
+  simpa [annotatedParamRawDomain, VExpr.liftN] using
+    (VEnv.HasType.bvar (env := annotatedParamTypeEnv) (U := 0)
+      (Lookup.zero (Γ := []) (ty := annotatedParamRawDomain)))
+
+theorem annotatedParamCheckedCtorBody_hasType :
+    annotatedParamTypeEnv.HasType 0 [.sort (.succ .zero)]
+      (.app (.const ``AnnotatedParam []) (.bvar 0))
+      (.sort (.succ .zero)) := by
+  apply annotatedParamFamilyApp_hasType
+  have hb : annotatedParamTypeEnv.HasType 0 [.sort (.succ .zero)]
+      (.bvar 0) (.sort (.succ .zero)) := by
+    simpa [VExpr.liftN] using
+      (VEnv.HasType.bvar (env := annotatedParamTypeEnv) (U := 0)
+        (Lookup.zero (Γ := []) (ty := .sort (.succ .zero))))
+  have hd := annotatedParamRawDomain_defeq.mono
+    (VEnv.addConst_le (show
+      outParamEnv.addConst annotatedParamRawType.name
+        annotatedParamRawType.toVConstant =
+          some annotatedParamTypeEnv from rfl))
+  exact (hd.weak0 annotatedParamTypeEnv_ordered).symm.defeq hb
+
+/-- The raw family and constructor metadata are semantically related to the
+annotation-consumed analyzer view at their exact declaration stages. -/
+theorem annotatedParamNormalization_wf :
+    annotatedParamNormalization.WF outParamEnv := by
+  refine ⟨annotatedParamRawType, annotatedParamViewType,
+    rfl, rfl, ?_, ?_⟩
+  · have hbody : outParamEnv.HasType 0 [annotatedParamRawDomain]
+        (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) :=
+      VEnv.HasType.sort (by decide)
+    exact ⟨_, VEnv.IsDefEq.forallEDF
+      annotatedParamRawDomain_defeq hbody⟩
+  · intro envT hadd
+    have henv : envT = annotatedParamTypeEnv := by
+      have : some envT = some annotatedParamTypeEnv :=
+        hadd.symm.trans (show
+          outParamEnv.addConst annotatedParamRawType.name
+            annotatedParamRawType.toVConstant =
+              some annotatedParamTypeEnv from rfl)
+      exact Option.some.inj this
+    subst envT
+    exact .cons ⟨_, VEnv.IsDefEq.forallEDF
+      (annotatedParamRawDomain_defeq.mono
+        (VEnv.addConst_le (show
+          outParamEnv.addConst annotatedParamRawType.name
+            annotatedParamRawType.toVConstant =
+              some annotatedParamTypeEnv from rfl)))
+      annotatedParamRawCtorBody_hasType⟩ .nil
+
+theorem annotatedParamViewChecked_wf :
+    annotatedParamViewChecked.WF outParamEnv := by
+  apply VInductDecl.Checked.WF.mono
+    ((VEnv.addConst_le (by rfl :
+      VEnv.empty.addConst ``outParam (vconst(type_of% @outParam)) =
+        some outParamConstEnv)).trans VEnv.addDefEq_le)
+  exact annotatedParamViewChecked.wf_of_decl annotatedParamViewDecl_wf
+
+/-- The mixed generation value uses the checked parameter for emitted
+recursor binders while retaining the raw constructor surface, and all four
+raw/view telescope/result obligations hold in their respective contexts. -/
+theorem annotatedParamGenerationChecked_wf :
+    annotatedParamGenerationChecked.WF outParamEnv := by
+  refine {
+    blockWF := ⟨annotatedParamNormalization_wf,
+      annotatedParamViewChecked_wf⟩
+    familyTel := ?_
+    familyResult := ?_
+    ctors := ?_ }
+  · change outParamEnv.TelDefEq 0 [] [annotatedParamRawDomain]
+      [.sort (.succ .zero)]
+    exact ⟨⟨_, annotatedParamRawDomain_defeq⟩, trivial⟩
+  · exact VEnv.HasType.sort (by decide)
+  · intro envT hadd ctor hctor
+    have henv : envT = annotatedParamTypeEnv := by
+      have : some envT = some annotatedParamTypeEnv :=
+        hadd.symm.trans (show
+          outParamEnv.addConst annotatedParamRawType.name
+            annotatedParamRawType.toVConstant =
+              some annotatedParamTypeEnv from rfl)
+      exact Option.some.inj this
+    subst envT
+    change ctor ∈ [⟨annotatedParamRawType.ctors[0],
+      annotatedParamViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    refine {
+      declaredTel := ⟨⟨_, annotatedParamRawDomain_defeq.mono
+        (VEnv.addConst_le (show
+          outParamEnv.addConst annotatedParamRawType.name
+            annotatedParamRawType.toVConstant =
+              some annotatedParamTypeEnv from rfl))⟩, trivial⟩
+      declaredResult := annotatedParamRawCtorBody_hasType
+      emittedTel := ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+      emittedResult := annotatedParamCheckedCtorBody_hasType }
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.annotatedParamGenerationChecked_wf [propext, Quot.sound]
+
+/-! ## Explicit normalization boundary
+
+Lean stores reducible aliases in inductive metadata even though
+`checkInductiveTypes`, positivity, and recursive-argument recognition inspect
+their WHNF. These kernel-accepted declarations demonstrate why raw metadata
+cannot simply be assumed normalized. Their explicit views exercise the new
+environment-independent `Normalization` boundary; semantic defeq evidence and
+raw-syntax-preserving artifact generation remain separate obligations.
+-/
+
+abbrev TypeFamilyAlias := Type
+
+inductive AliasFormer : TypeFamilyAlias where
+  | mk : AliasFormer
+
+def aliasFormerRawType : VInductiveType where
+  name := ``AliasFormer
+  uvars := 0
+  type := vconst(type_of% @AliasFormer).type
+  ctors := [⟨vconst(type_of% @AliasFormer.mk), ``AliasFormer.mk⟩]
+
+def aliasFormerRawDecl : VInductDecl := ⟨0, 0, [aliasFormerRawType]⟩
+
+example : aliasFormerRawType.type = .const ``TypeFamilyAlias [] := rfl
+example : aliasFormerRawDecl.checked? = none := rfl
+
+def aliasFormerViewType : VInductiveType :=
+  { aliasFormerRawType with type := .sort (.succ .zero) }
+
+def aliasFormerViewDecl : VInductDecl := ⟨0, 0, [aliasFormerViewType]⟩
+
+example : aliasFormerViewDecl.checked?.isSome = true := rfl
+example : normalizationShape aliasFormerRawDecl aliasFormerViewDecl = true := rfl
+
+def aliasFormerNormalization : Normalization aliasFormerRawDecl where
+  view := aliasFormerViewDecl
+  shape_eq := rfl
+
+def aliasFormerViewChecked : aliasFormerViewDecl.Checked :=
+  aliasFormerViewDecl.checked?.get (by decide)
+
+def aliasFormerBlock : NormalizedChecked aliasFormerRawDecl :=
+  aliasFormerNormalization.check?.get (by decide)
+
+def aliasFormerGenerationChecked : GenerationChecked aliasFormerRawDecl :=
+  aliasFormerBlock.generation?.get (by decide)
+
+example : aliasFormerNormalization.accepted = true := rfl
+example : (normalizedChecked? aliasFormerRawDecl aliasFormerViewDecl).isSome = true := rfl
+example : aliasFormerBlock.checked.type = aliasFormerViewType := rfl
+example : aliasFormerGenerationChecked.recursor =
+    vconst(type_of% @AliasFormer.rec) := rfl
+example : aliasFormerGenerationChecked.generatedRules[0]? =
+    some (vdefeq(motive mk =>
+      @AliasFormer.rec motive mk AliasFormer.mk ≡ mk)) := rfl
+example : ∃ raw,
+    aliasFormerRawDecl.types = [raw] ∧
+    raw.name = aliasFormerBlock.checked.type.name ∧
+    raw.uvars = aliasFormerBlock.checked.type.uvars ∧
+    List.Forall₂ CtorHeaderEq raw.ctors aliasFormerBlock.checked.type.ctors :=
+  aliasFormerBlock.source_anatomy
+
+def typeFamilyAliasDefEq : VDefEq := vdefeq(TypeFamilyAlias ≡ Type)
+
+def typeFamilyAliasConstEnv : VEnv :=
+  (VEnv.empty.addConst ``TypeFamilyAlias
+    (vconst(type_of% @TypeFamilyAlias))).get (by decide)
+
+def typeFamilyAliasEnv : VEnv :=
+  typeFamilyAliasConstEnv.addDefEq typeFamilyAliasDefEq
+
+theorem typeFamilyAliasConstant_wf :
+    (vconst(type_of% @TypeFamilyAlias) : VConstant).WF
+      VEnv.empty := by
+  exact ⟨_, VEnv.HasType.sort (by decide)⟩
+
+theorem typeFamilyAliasConstEnv_ordered :
+    typeFamilyAliasConstEnv.Ordered := by
+  apply VEnv.Ordered.const VEnv.Ordered.empty
+    (ci := vconst(type_of% @TypeFamilyAlias))
+  · exact typeFamilyAliasConstant_wf
+  · rfl
+
+theorem typeFamilyAliasEnv_ordered :
+    typeFamilyAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq typeFamilyAliasConstEnv_ordered
+  constructor
+  · exact VEnv.HasType.const0 rfl
+      (typeFamilyAliasConstant_wf.mono
+        (VEnv.addConst_le (by rfl :
+          VEnv.empty.addConst ``TypeFamilyAlias
+            (vconst(type_of% @TypeFamilyAlias)) =
+              some typeFamilyAliasConstEnv)))
+  · exact VEnv.HasType.sort (by decide)
+
+/-- The explicit family-type view is not merely shape-compatible: the stored
+alias and its WHNF are definitionally equal in the pre-environment, and the
+unchanged constructor remains equal after inserting the raw family constant.
+-/
+theorem aliasFormerNormalization_wf :
+    aliasFormerNormalization.WF typeFamilyAliasEnv := by
+  refine ⟨aliasFormerRawType, aliasFormerViewType, rfl, rfl, ?_, ?_⟩
+  · refine ⟨_, .extra (df := typeFamilyAliasDefEq) (ls := []) ?_
+      (fun _ h => nomatch h) rfl⟩
+    simp [typeFamilyAliasEnv, VEnv.addDefEq]
+  · intro envT hadd
+    exact .cons
+      ⟨_, .constDF (VEnv.addConst_self hadd) (by simp) (by simp) rfl .nil⟩
+      .nil
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerNormalization_wf [propext, Quot.sound]
+
+/-- The normalized view is a semantically well-formed direct declaration in
+the same pre-environment. -/
+theorem aliasFormerViewDecl_wf :
+    aliasFormerViewDecl.WF typeFamilyAliasEnv := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = aliasFormerViewType :=
+    List.mem_singleton.1 (by simpa [aliasFormerViewDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · trivial
+  · intro c hc
+    have hc' : c = aliasFormerRawType.ctors[0] :=
+      List.mem_singleton.1 (by
+        simpa [aliasFormerViewType, aliasFormerRawType] using hc)
+    subst c
+    exact ⟨trivial, .nil⟩
+
+/-- The paired block carries both the semantic normalization certificate and
+the checked normalized view required by downstream generation. -/
+theorem aliasFormerBlock_wf : aliasFormerBlock.WF typeFamilyAliasEnv := by
+  refine ⟨aliasFormerNormalization_wf, ?_⟩
+  change aliasFormerViewChecked.WF typeFamilyAliasEnv
+  exact aliasFormerViewChecked.wf_of_decl aliasFormerViewDecl_wf
+
+theorem aliasFormerGenerationChecked_wf :
+    aliasFormerGenerationChecked.WF typeFamilyAliasEnv := by
+  refine {
+    blockWF := aliasFormerBlock_wf
+    familyTel := by trivial
+    familyResult := ?_
+    ctors := ?_ }
+  · change typeFamilyAliasEnv.IsDefEq 0 []
+      (.const ``TypeFamilyAlias []) (.sort (.succ .zero))
+      (.sort (.succ (.succ .zero)))
+    exact .extra (df := typeFamilyAliasDefEq) (ls := [])
+      (by simp [typeFamilyAliasEnv, VEnv.addDefEq])
+      (fun _ h => nomatch h) rfl
+  · intro envT hadd ctor hctor
+    change ctor ∈
+      [⟨aliasFormerRawType.ctors[0], aliasFormerViewChecked.constructors[0]⟩]
+      at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    have hfamily₀ : envT.HasType 0 []
+        (.const aliasFormerGenerationChecked.block.sourceType.name [])
+        (aliasFormerGenerationChecked.block.sourceType.type.instL []) :=
+      .const (VEnv.addConst_self hadd) (by simp) (by rfl)
+    change envT.HasType 0 [] (.const ``AliasFormer [])
+      (.const ``TypeFamilyAlias []) at hfamily₀
+    have halias₀ : typeFamilyAliasEnv.IsDefEq 0 []
+        (.const ``TypeFamilyAlias []) (.sort (.succ .zero))
+        (.sort (.succ (.succ .zero))) :=
+      .extra (df := typeFamilyAliasDefEq) (ls := [])
+        (by simp [typeFamilyAliasEnv, VEnv.addDefEq])
+        (fun _ h => nomatch h) rfl
+    have halias := halias₀.mono (VEnv.addConst_le hadd)
+    have hfamily : envT.IsDefEq 0 []
+        (.const ``AliasFormer []) (.const ``AliasFormer [])
+        (.sort (.succ .zero)) :=
+      halias.defeq hfamily₀
+    exact {
+      declaredTel := by trivial
+      declaredResult := hfamily
+      emittedTel := by trivial
+      emittedResult := hfamily }
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerBlock_wf [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerGenerationChecked_wf [propext, Quot.sound]
+
+/-- The non-identity family-alias case executes the same normalized
+transaction used by the public identity wrapper. -/
+def aliasFormerFinalEnv : VEnv :=
+  (typeFamilyAliasEnv.addInductGeneration
+    aliasFormerGenerationChecked).get (by decide)
+
+theorem aliasFormer_addInductGeneration :
+    typeFamilyAliasEnv.addInductGeneration
+      aliasFormerGenerationChecked =
+        some aliasFormerFinalEnv := rfl
+
+theorem aliasFormerFinalEnv_trace :
+    Nonempty (VEnv.AddInductGenerationTrace
+      typeFamilyAliasEnv aliasFormerFinalEnv
+      aliasFormerGenerationChecked) :=
+  VEnv.addInductGeneration_trace aliasFormer_addInductGeneration
+
+theorem aliasFormerFinalEnv_le :
+    typeFamilyAliasEnv ≤ aliasFormerFinalEnv := by
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.le
+
+theorem aliasFormerFinalEnv_family_fresh :
+    typeFamilyAliasEnv.constants ``AliasFormer = none := by
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.family_fresh
+
+theorem aliasFormerFinalEnv_family_lookup :
+    aliasFormerFinalEnv.constants ``AliasFormer =
+      some aliasFormerRawType.toVConstant := by
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.family_lookup
+
+theorem aliasFormerFinalEnv_ctor_fresh :
+    ∀ c ∈ aliasFormerRawType.ctors,
+      typeFamilyAliasEnv.constants c.name = none := by
+  intro c hc
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.ctor_fresh hc
+
+theorem aliasFormerFinalEnv_ctor_lookup :
+    ∀ c ∈ aliasFormerRawType.ctors,
+      aliasFormerFinalEnv.constants c.name =
+        some c.toVConstant := by
+  intro c hc
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.ctor_lookup hc
+
+theorem aliasFormerFinalEnv_rec_fresh :
+    typeFamilyAliasEnv.constants ``AliasFormer.rec = none := by
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.rec_fresh
+
+theorem aliasFormerFinalEnv_rec_lookup :
+    aliasFormerFinalEnv.constants ``AliasFormer.rec =
+      some (vconst(type_of% @AliasFormer.rec)) := by
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.rec_lookup
+
+theorem aliasFormerFinalEnv_rule_mem :
+    ∀ df ∈ aliasFormerGenerationChecked.generatedRules,
+      aliasFormerFinalEnv.defeqs df := by
+  intro df hdf
+  rcases aliasFormerFinalEnv_trace with ⟨H⟩
+  exact H.rule_mem hdf
+
+theorem aliasFormerFinalEnv_iota_mem :
+    aliasFormerFinalEnv.defeqs
+      (vdefeq(motive mk =>
+        @AliasFormer.rec motive mk AliasFormer.mk ≡ mk)) := by
+  apply aliasFormerFinalEnv_rule_mem
+  exact .head _
+
+theorem aliasFormerFinalEnv_ordered :
+    aliasFormerFinalEnv.Ordered :=
+  VEnv.addInductGeneration_WF
+    typeFamilyAliasEnv_ordered
+    aliasFormerGenerationChecked_wf
+    aliasFormer_addInductGeneration
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerFinalEnv_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerFinalEnv_family_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerFinalEnv_ctor_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerFinalEnv_rec_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerFinalEnv_iota_mem [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasFormerFinalEnv_ordered [propext, Classical.choice, Quot.sound]
+
+abbrev RecAlias (α : Sort u) := α
+
+inductive AliasRec : Type where
+  | mk : RecAlias AliasRec → AliasRec
+
+def aliasRecRawType : VInductiveType where
+  name := ``AliasRec
+  uvars := 0
+  type := vconst(type_of% @AliasRec).type
+  ctors := [⟨vconst(type_of% @AliasRec.mk), ``AliasRec.mk⟩]
+
+def aliasRecRawDecl : VInductDecl := ⟨0, 0, [aliasRecRawType]⟩
+
+def aliasRecRawField : VExpr :=
+  (VExpr.const ``RecAlias [.succ .zero]).app (VExpr.const ``AliasRec [])
+
+example : ctorFields aliasRecRawType.ctors[0].type = [aliasRecRawField] := rfl
+example : aliasRecRawDecl.checked? = none := rfl
+
+def aliasRecViewCtor : VConstVal :=
+  { aliasRecRawType.ctors[0] with
+    type := .forallE (.const ``AliasRec []) (.const ``AliasRec []) }
+
+def aliasRecViewType : VInductiveType :=
+  { aliasRecRawType with ctors := [aliasRecViewCtor] }
+
+def aliasRecViewDecl : VInductDecl := ⟨0, 0, [aliasRecViewType]⟩
+
+example : aliasRecViewDecl.checked?.isSome = true := rfl
+example : normalizationShape aliasRecRawDecl aliasRecViewDecl = true := rfl
+
+def aliasRecNormalization : Normalization aliasRecRawDecl where
+  view := aliasRecViewDecl
+  shape_eq := rfl
+
+def aliasRecViewChecked : aliasRecViewDecl.Checked :=
+  aliasRecViewDecl.checked?.get (by decide)
+
+def aliasRecBlock : NormalizedChecked aliasRecRawDecl :=
+  aliasRecNormalization.check?.get (by decide)
+
+def aliasRecGenerationChecked : GenerationChecked aliasRecRawDecl :=
+  aliasRecBlock.generation?.get (by decide)
+
+example : aliasRecNormalization.accepted = true := rfl
+example : (normalizedChecked? aliasRecRawDecl aliasRecViewDecl).isSome = true := rfl
+example : aliasRecBlock.checked.type = aliasRecViewType := rfl
+example : ∃ raw,
+    aliasRecRawDecl.types = [raw] ∧
+    raw.name = aliasRecBlock.checked.type.name ∧
+    raw.uvars = aliasRecBlock.checked.type.uvars ∧
+    List.Forall₂ CtorHeaderEq raw.ctors aliasRecBlock.checked.type.ctors :=
+  aliasRecBlock.source_anatomy
+example : aliasRecViewChecked.constructors[0].fields = [.const ``AliasRec []] := rfl
+example : aliasRecViewChecked.constructors[0].recursive.length = 1 := rfl
+example : aliasRecViewChecked.constructors[0].recursive[0].binders = [] := rfl
+example : aliasRecGenerationChecked.block.ctorPairs[0].rawFields 0 =
+    [aliasRecRawField] := rfl
+example : (ctorFields aliasRecGenerationChecked.minorTypes[0])[0]? =
+    some aliasRecRawField := rfl
+example : aliasRecGenerationChecked.recursor =
+    vconst(type_of% @AliasRec.rec) := rfl
+example : aliasRecGenerationChecked.generatedRules[0]? =
+    some (vdefeq(motive mk a =>
+      @AliasRec.rec motive mk (@AliasRec.mk a) ≡
+        mk a (@AliasRec.rec motive mk a))) := rfl
+
+def recAliasDefEq : VDefEq :=
+  vdefeq(@RecAlias ≡ fun (α : Sort u) => α)
+
+def recAliasConstEnv : VEnv :=
+  (VEnv.empty.addConst ``RecAlias (vconst(type_of% @RecAlias))).get (by decide)
+
+def recAliasEnv : VEnv := recAliasConstEnv.addDefEq recAliasDefEq
+
+theorem recAliasConstant_wf :
+    (vconst(type_of% @RecAlias) : VConstant).WF VEnv.empty := by
+  apply VEnv.IsType.forallE
+  · exact ⟨_, VEnv.HasType.sort (by decide)⟩
+  · exact ⟨_, VEnv.HasType.sort (by decide)⟩
+
+theorem recAliasConstEnv_ordered :
+    recAliasConstEnv.Ordered := by
+  apply VEnv.Ordered.const VEnv.Ordered.empty
+    (ci := vconst(type_of% @RecAlias))
+  · exact recAliasConstant_wf
+  · rfl
+
+theorem recAliasEnv_ordered :
+    recAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq recAliasConstEnv_ordered
+  constructor
+  · exact VEnv.HasType.const0 rfl
+      (recAliasConstant_wf.mono
+        (VEnv.addConst_le (by rfl :
+          VEnv.empty.addConst ``RecAlias
+            (vconst(type_of% @RecAlias)) =
+              some recAliasConstEnv)))
+  · exact VEnv.HasType.lam
+      (VEnv.HasType.sort (by decide))
+      (VEnv.HasType.bvar .zero)
+
+/-- The raw aliased field and the normalized recursive target are
+definitionally equal after the raw family constant has been inserted. -/
+theorem aliasRecField_defeq {envT : VEnv}
+    (hadd : recAliasEnv.addConst ``AliasRec aliasRecRawType.toVConstant =
+      some envT) :
+    envT.IsDefEq 0 [] aliasRecRawField (.const ``AliasRec [])
+      (.sort (.succ .zero)) := by
+  have hlookup :
+      envT.constants ``AliasRec = some aliasRecRawType.toVConstant :=
+    VEnv.addConst_self hadd
+  have hfamily : envT.HasType 0 [] (.const ``AliasRec [])
+      (.sort (.succ .zero)) :=
+    .constDF hlookup (fun _ h => nomatch h) (fun _ h => nomatch h) rfl .nil
+  have hdelta : envT.IsDefEq 0 []
+      (.const ``RecAlias [.succ .zero])
+      (.lam (.sort (.succ .zero)) (.bvar 0))
+      (.forallE (.sort (.succ .zero)) (.sort (.succ .zero))) := by
+    apply VEnv.IsDefEq.extra
+      (df := recAliasDefEq) (ls := [.succ .zero]) (Γ := [])
+    · exact (VEnv.addConst_le hadd).defeqs (by
+        simp [recAliasEnv, VEnv.addDefEq])
+    · intro l hl
+      simp only [List.mem_singleton] at hl
+      subst l
+      decide
+    · rfl
+  have happ := VEnv.IsDefEq.appDF hdelta hfamily
+  have hbeta : envT.IsDefEq 0 []
+      (.app (.lam (.sort (.succ .zero)) (.bvar 0)) (.const ``AliasRec []))
+      (.const ``AliasRec []) (.sort (.succ .zero)) :=
+    .beta (.bvar .zero) hfamily
+  exact happ.trans hbeta
+
+/-- The raw family result remains well typed under the raw aliased field
+binder. -/
+theorem aliasRecResult_hasType {envT : VEnv}
+    (hadd : recAliasEnv.addConst ``AliasRec aliasRecRawType.toVConstant =
+      some envT) :
+    envT.HasType 0 [aliasRecRawField] (.const ``AliasRec [])
+      (.sort (.succ .zero)) :=
+  .constDF (VEnv.addConst_self hadd) (fun _ h => nomatch h)
+    (fun _ h => nomatch h) rfl .nil
+
+/-- Field WHNF is also justified semantically. The constructor comparison is
+staged after insertion of the raw `AliasRec` family constant, and derives
+`RecAlias AliasRec ≡ AliasRec` by delta, application congruence, and beta.
+-/
+theorem aliasRecNormalization_wf :
+    aliasRecNormalization.WF recAliasEnv := by
+  refine ⟨aliasRecRawType, aliasRecViewType, rfl, rfl, ?_, ?_⟩
+  · exact ⟨_, by type_tac⟩
+  · intro envT hadd
+    exact .cons
+      ⟨_, .forallEDF (aliasRecField_defeq hadd)
+        (aliasRecResult_hasType hadd)⟩
+      .nil
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecNormalization_wf [propext, Quot.sound]
+
+/-- The normalized direct-recursive view satisfies the semantic declaration
+contract independently of the raw aliased field syntax. -/
+theorem aliasRecViewDecl_wf : aliasRecViewDecl.WF recAliasEnv := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = aliasRecViewType :=
+    List.mem_singleton.1 (by simpa [aliasRecViewDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · trivial
+  · intro c hc
+    have hc' : c = aliasRecViewCtor :=
+      List.mem_singleton.1 (by simpa [aliasRecViewType] using hc)
+    subst c
+    refine ⟨?_, .nil⟩
+    exact ⟨.inl rfl, fun _ => .nil, trivial⟩
+
+/-- Recursive-field recognition is certified on the normalized view while the
+paired block continues to retain the raw aliased constructor syntax. -/
+theorem aliasRecBlock_wf : aliasRecBlock.WF recAliasEnv := by
+  refine ⟨aliasRecNormalization_wf, ?_⟩
+  change aliasRecViewChecked.WF recAliasEnv
+  exact aliasRecViewChecked.wf_of_decl aliasRecViewDecl_wf
+
+theorem aliasRecGenerationChecked_wf :
+    aliasRecGenerationChecked.WF recAliasEnv := by
+  refine {
+    blockWF := aliasRecBlock_wf
+    familyTel := by trivial
+    familyResult := by
+      exact .sortDF (by decide) (by decide) rfl
+    ctors := ?_ }
+  intro envT hadd ctor hctor
+  change recAliasEnv.addConst ``AliasRec aliasRecRawType.toVConstant =
+    some envT at hadd
+  change ctor ∈
+    [⟨aliasRecRawType.ctors[0], aliasRecViewChecked.constructors[0]⟩]
+    at hctor
+  obtain rfl := List.mem_singleton.1 hctor
+  have hfield := aliasRecField_defeq hadd
+  have hresult := aliasRecResult_hasType hadd
+  exact {
+    declaredTel := ⟨⟨_, hfield⟩, trivial⟩
+    declaredResult := hresult
+    emittedTel := ⟨⟨_, hfield⟩, trivial⟩
+    emittedResult := hresult }
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecBlock_wf [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecGenerationChecked_wf [propext, Quot.sound]
+
+/-- The recursive-field alias case preserves the raw aliased constructor
+binder while using the normalized view to generate recursion artifacts. -/
+def aliasRecFinalEnv : VEnv :=
+  (recAliasEnv.addInductGeneration
+    aliasRecGenerationChecked).get (by decide)
+
+theorem aliasRec_addInductGeneration :
+    recAliasEnv.addInductGeneration aliasRecGenerationChecked =
+      some aliasRecFinalEnv := rfl
+
+theorem aliasRecFinalEnv_trace :
+    Nonempty (VEnv.AddInductGenerationTrace
+      recAliasEnv aliasRecFinalEnv aliasRecGenerationChecked) :=
+  VEnv.addInductGeneration_trace aliasRec_addInductGeneration
+
+theorem aliasRecFinalEnv_le :
+    recAliasEnv ≤ aliasRecFinalEnv := by
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.le
+
+theorem aliasRecFinalEnv_family_fresh :
+    recAliasEnv.constants ``AliasRec = none := by
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.family_fresh
+
+theorem aliasRecFinalEnv_family_lookup :
+    aliasRecFinalEnv.constants ``AliasRec =
+      some aliasRecRawType.toVConstant := by
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.family_lookup
+
+theorem aliasRecFinalEnv_ctor_fresh :
+    ∀ c ∈ aliasRecRawType.ctors,
+      recAliasEnv.constants c.name = none := by
+  intro c hc
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.ctor_fresh hc
+
+theorem aliasRecFinalEnv_ctor_lookup :
+    ∀ c ∈ aliasRecRawType.ctors,
+      aliasRecFinalEnv.constants c.name =
+        some c.toVConstant := by
+  intro c hc
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.ctor_lookup hc
+
+theorem aliasRecFinalEnv_rec_fresh :
+    recAliasEnv.constants ``AliasRec.rec = none := by
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.rec_fresh
+
+theorem aliasRecFinalEnv_rec_lookup :
+    aliasRecFinalEnv.constants ``AliasRec.rec =
+      some (vconst(type_of% @AliasRec.rec)) := by
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.rec_lookup
+
+theorem aliasRecFinalEnv_rule_mem :
+    ∀ df ∈ aliasRecGenerationChecked.generatedRules,
+      aliasRecFinalEnv.defeqs df := by
+  intro df hdf
+  rcases aliasRecFinalEnv_trace with ⟨H⟩
+  exact H.rule_mem hdf
+
+theorem aliasRecFinalEnv_iota_mem :
+    aliasRecFinalEnv.defeqs
+      (vdefeq(motive mk a =>
+        @AliasRec.rec motive mk (@AliasRec.mk a) ≡
+          mk a (@AliasRec.rec motive mk a))) := by
+  apply aliasRecFinalEnv_rule_mem
+  exact .head _
+
+theorem aliasRecFinalEnv_ordered :
+    aliasRecFinalEnv.Ordered :=
+  VEnv.addInductGeneration_WF
+    recAliasEnv_ordered
+    aliasRecGenerationChecked_wf
+    aliasRec_addInductGeneration
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecFinalEnv_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecFinalEnv_family_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecFinalEnv_ctor_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecFinalEnv_rec_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecFinalEnv_iota_mem [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.aliasRecFinalEnv_ordered [propext, Classical.choice, Quot.sound]
+
+/-! ## Normalization differential matrix
+
+The isolated `AliasFormer` and `AliasRec` fixtures above establish that Lean
+retains reducible aliases at family results and direct recursive targets.  The
+single indexed declaration below covers every remaining normalization
+position in one real kernel payload: parameter and index domains, ordinary
+fields, direct recursion, recursion hidden behind a Pi-producing alias, and
+beta/let redexes retained in alias definitions.  Its view is deliberately
+written out so changes to either Lean's stored metadata or the Theory
+normalizer fail by computation.
+-/
+
+abbrev MatrixBetaAlias (alpha : Sort u) :=
+  (fun type : Sort u => type) alpha
+
+abbrev MatrixLetAlias (alpha : Sort u) :=
+  let type := alpha
+  type
+
+abbrev MatrixPiAlias (alpha : Sort u) := (proof : Prop) → alpha
+
+abbrev MatrixIndexAlias
+    (index : TypeFamilyAlias) : TypeFamilyAlias := index
+
+inductive NormalizationMatrix (alpha : TypeFamilyAlias) :
+    TypeFamilyAlias → Type 1 where
+  | mk (index : TypeFamilyAlias)
+      (ordinary : RecAlias Prop)
+      (beta : MatrixBetaAlias Prop)
+      (letBound : MatrixLetAlias Prop)
+      (direct : RecAlias
+        (NormalizationMatrix alpha (MatrixIndexAlias index)))
+      (piHidden : MatrixPiAlias
+        (NormalizationMatrix alpha (MatrixIndexAlias index)))
+      (betaRecursive : MatrixBetaAlias
+        (NormalizationMatrix alpha (MatrixIndexAlias index)))
+      (letRecursive : MatrixLetAlias
+        (NormalizationMatrix alpha (MatrixIndexAlias index))) :
+      NormalizationMatrix alpha (MatrixIndexAlias index)
+
+def normalizationMatrixRawType : VInductiveType where
+  name := ``NormalizationMatrix
+  uvars := 0
+  type := vconst(type_of% @NormalizationMatrix).type
+  ctors := [⟨vconst(type_of% @NormalizationMatrix.mk),
+    ``NormalizationMatrix.mk⟩]
+
+def normalizationMatrixRawDecl : VInductDecl :=
+  ⟨0, 1, [normalizationMatrixRawType]⟩
+
+def normalizationMatrixTarget (alpha index : VExpr) : VExpr :=
+  (VExpr.const ``NormalizationMatrix []).app alpha |>.app
+    ((VExpr.const ``MatrixIndexAlias []).app index)
+
+def normalizationMatrixViewCtorType : VExpr :=
+  .forallE (.sort (.succ .zero)) <|
+  .forallE (.sort (.succ .zero)) <|
+  .forallE (.sort .zero) <|
+  .forallE (.sort .zero) <|
+  .forallE (.sort .zero) <|
+  .forallE (normalizationMatrixTarget (.bvar 4) (.bvar 3)) <|
+  .forallE (.forallE (.sort .zero)
+    (normalizationMatrixTarget (.bvar 6) (.bvar 5))) <|
+  .forallE (normalizationMatrixTarget (.bvar 6) (.bvar 5)) <|
+  .forallE (normalizationMatrixTarget (.bvar 7) (.bvar 6)) <|
+  normalizationMatrixTarget (.bvar 8) (.bvar 7)
+
+def normalizationMatrixViewCtor : VConstVal :=
+  { normalizationMatrixRawType.ctors[0] with
+    type := normalizationMatrixViewCtorType }
+
+def normalizationMatrixViewType : VInductiveType :=
+  { normalizationMatrixRawType with
+    type := .forallE (.sort (.succ .zero))
+      (.forallE (.sort (.succ .zero))
+        (.sort (.succ (.succ .zero))))
+    ctors := [normalizationMatrixViewCtor] }
+
+def normalizationMatrixViewDecl : VInductDecl :=
+  ⟨0, 1, [normalizationMatrixViewType]⟩
+
+example : normalizationMatrixRawType.type =
+    (VExpr.const ``TypeFamilyAlias []).forallE
+      ((VExpr.const ``TypeFamilyAlias []).forallE
+        (VExpr.sort (.succ (.succ .zero)))) := rfl
+
+example : normalizationMatrixRawType.ctors[0].type =
+    vconst(type_of% @NormalizationMatrix.mk).type := rfl
+
+example : normalizationMatrixRawDecl.checked? = none := rfl
+example : normalizationMatrixViewDecl.checked?.isSome = true := rfl
+example : normalizationShape normalizationMatrixRawDecl
+    normalizationMatrixViewDecl = true := rfl
+
+def normalizationMatrixNormalization :
+    Normalization normalizationMatrixRawDecl where
+  view := normalizationMatrixViewDecl
+  shape_eq := rfl
+
+def normalizationMatrixViewChecked :
+    normalizationMatrixViewDecl.Checked :=
+  normalizationMatrixViewDecl.checked?.get (by decide)
+
+def normalizationMatrixBlock :
+    NormalizedChecked normalizationMatrixRawDecl :=
+  normalizationMatrixNormalization.check?.get (by decide)
+
+def normalizationMatrixGenerationChecked :
+    GenerationChecked normalizationMatrixRawDecl :=
+  normalizationMatrixBlock.generation?.get (by decide)
+
+example : normalizationMatrixNormalization.accepted = true := rfl
+example : (normalizedChecked? normalizationMatrixRawDecl
+    normalizationMatrixViewDecl).isSome = true := rfl
+example : normalizationMatrixBlock.checked.type =
+    normalizationMatrixViewType := rfl
+example : normalizationMatrixViewChecked.params =
+    [.sort (.succ .zero)] := rfl
+example : normalizationMatrixViewChecked.indices =
+    [.sort (.succ .zero)] := rfl
+example : normalizationMatrixViewChecked.constructors[0].fields.length = 8 :=
+  rfl
+example : normalizationMatrixViewChecked.constructors[0].recursive.length = 4 :=
+  rfl
+example : normalizationMatrixViewChecked.constructors[0].recursive.map
+    (fun position => (position.fieldIndex, position.binders.length)) =
+      [(4, 0), (5, 1), (6, 0), (7, 0)] := rfl
+example : normalizationMatrixGenerationChecked.recursor =
+    vconst(type_of% @NormalizationMatrix.rec) := rfl
+example : normalizationMatrixGenerationChecked.generatedRules[0]? =
+    some (vdefeq(alpha motive mk index ordinary beta letBound direct
+      piHidden betaRecursive letRecursive =>
+      @NormalizationMatrix.rec alpha motive mk (MatrixIndexAlias index)
+          (@NormalizationMatrix.mk alpha index ordinary beta letBound direct
+            piHidden betaRecursive letRecursive) ≡
+        mk index ordinary beta letBound direct piHidden betaRecursive
+          letRecursive
+          (@NormalizationMatrix.rec alpha motive mk
+            (MatrixIndexAlias index) direct)
+          (fun proof => @NormalizationMatrix.rec alpha motive mk
+            (MatrixIndexAlias index) (piHidden proof))
+          (@NormalizationMatrix.rec alpha motive mk
+            (MatrixIndexAlias index) betaRecursive)
+          (@NormalizationMatrix.rec alpha motive mk
+            (MatrixIndexAlias index) letRecursive))) := rfl
+example : normalizationMatrixGenerationChecked.generatedRules.length = 1 := rfl
+
+/-! The semantic pre-environment contains the exact reducible definitions
+whose WHNFs justify the normalized descriptor.  Each abbreviation is added
+as a constant followed by its delta equation so the final transaction uses
+the same staged environment discipline as ordinary declarations. -/
+
+def normalizationMatrixRecAliasConstEnv : VEnv :=
+  (typeFamilyAliasEnv.addConst ``RecAlias
+    (vconst(type_of% @RecAlias))).get (by decide)
+
+def normalizationMatrixRecAliasEnv : VEnv :=
+  normalizationMatrixRecAliasConstEnv.addDefEq recAliasDefEq
+
+theorem normalizationMatrixRecAliasEnv_ordered :
+    normalizationMatrixRecAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq
+  · apply VEnv.Ordered.const (n := ``RecAlias)
+      (ci := vconst(type_of% @RecAlias))
+      (env' := normalizationMatrixRecAliasConstEnv)
+      typeFamilyAliasEnv_ordered
+    · exact ⟨_, by type_tac⟩
+    · rfl
+  · have hlookup : normalizationMatrixRecAliasConstEnv.constants
+        ``RecAlias = some (vconst(type_of% @RecAlias)) := rfl
+    constructor <;> type_tac
+
+def matrixBetaAliasDefEq : VDefEq :=
+  vdefeq(@MatrixBetaAlias ≡ fun (alpha : Sort u) =>
+    (fun type : Sort u => type) alpha)
+
+def normalizationMatrixBetaAliasConstEnv : VEnv :=
+  (normalizationMatrixRecAliasEnv.addConst ``MatrixBetaAlias
+    (vconst(type_of% @MatrixBetaAlias))).get (by decide)
+
+def normalizationMatrixBetaAliasEnv : VEnv :=
+  normalizationMatrixBetaAliasConstEnv.addDefEq matrixBetaAliasDefEq
+
+theorem normalizationMatrixBetaAliasEnv_ordered :
+    normalizationMatrixBetaAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq
+  · apply VEnv.Ordered.const (n := ``MatrixBetaAlias)
+      (ci := vconst(type_of% @MatrixBetaAlias))
+      (env' := normalizationMatrixBetaAliasConstEnv)
+      normalizationMatrixRecAliasEnv_ordered
+    · exact ⟨_, by type_tac⟩
+    · rfl
+  · have hlookup : normalizationMatrixBetaAliasConstEnv.constants
+        ``MatrixBetaAlias = some (vconst(type_of% @MatrixBetaAlias)) := rfl
+    constructor <;> type_tac
+
+def matrixLetAliasDefEq : VDefEq :=
+  vdefeq(@MatrixLetAlias ≡ fun (alpha : Sort u) =>
+    let type := alpha
+    type)
+
+def normalizationMatrixLetAliasConstEnv : VEnv :=
+  (normalizationMatrixBetaAliasEnv.addConst ``MatrixLetAlias
+    (vconst(type_of% @MatrixLetAlias))).get (by decide)
+
+def normalizationMatrixLetAliasEnv : VEnv :=
+  normalizationMatrixLetAliasConstEnv.addDefEq matrixLetAliasDefEq
+
+theorem normalizationMatrixLetAliasEnv_ordered :
+    normalizationMatrixLetAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq
+  · apply VEnv.Ordered.const (n := ``MatrixLetAlias)
+      (ci := vconst(type_of% @MatrixLetAlias))
+      (env' := normalizationMatrixLetAliasConstEnv)
+      normalizationMatrixBetaAliasEnv_ordered
+    · exact ⟨_, by type_tac⟩
+    · rfl
+  · have hlookup : normalizationMatrixLetAliasConstEnv.constants
+        ``MatrixLetAlias = some (vconst(type_of% @MatrixLetAlias)) := rfl
+    constructor <;> type_tac
+
+def matrixPiAliasDefEq : VDefEq :=
+  vdefeq(@MatrixPiAlias ≡ fun (alpha : Sort u) =>
+    (proof : Prop) → alpha)
+
+def normalizationMatrixPiAliasConstEnv : VEnv :=
+  (normalizationMatrixLetAliasEnv.addConst ``MatrixPiAlias
+    (vconst(type_of% @MatrixPiAlias))).get (by decide)
+
+def normalizationMatrixPiAliasEnv : VEnv :=
+  normalizationMatrixPiAliasConstEnv.addDefEq matrixPiAliasDefEq
+
+theorem normalizationMatrixPiAliasEnv_ordered :
+    normalizationMatrixPiAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq
+  · apply VEnv.Ordered.const (n := ``MatrixPiAlias)
+      (ci := vconst(type_of% @MatrixPiAlias))
+      (env' := normalizationMatrixPiAliasConstEnv)
+      normalizationMatrixLetAliasEnv_ordered
+    · exact ⟨_, by type_tac⟩
+    · rfl
+  · have hlookup : normalizationMatrixPiAliasConstEnv.constants
+        ``MatrixPiAlias = some (vconst(type_of% @MatrixPiAlias)) := rfl
+    constructor
+    · type_tac
+    · apply VEnv.HasType.lam
+      · exact VEnv.HasType.sort (by decide)
+      · apply VEnv.IsDefEq.defeq
+          (VEnv.IsDefEq.sortDF
+            (l := .imax (.succ .zero) (.param 0))
+            (l' := .param 0) (by decide) (by decide) (by
+              rw [VLevel.equiv_def]
+              intro ls
+              simp only [VLevel.eval, Nat.zero_add]
+              let n := ls.getD 0 0
+              change Lean.Nat.imax 1 n = n
+              by_cases h : n = 0
+              · simp [Lean.Nat.imax, h]
+              · have hn : 1 ≤ n := Nat.one_le_iff_ne_zero.mpr h
+                simp [Lean.Nat.imax, h, Nat.max_eq_right hn]))
+        exact VEnv.HasType.forallE
+          (VEnv.HasType.sort (by decide))
+          (VEnv.HasType.bvar (.succ .zero))
+
+def matrixIndexAliasDefEq : VDefEq :=
+  vdefeq(MatrixIndexAlias ≡ fun index : TypeFamilyAlias => index)
+
+def normalizationMatrixIndexAliasConstEnv : VEnv :=
+  (normalizationMatrixPiAliasEnv.addConst ``MatrixIndexAlias
+    (vconst(type_of% @MatrixIndexAlias))).get (by decide)
+
+def normalizationMatrixAliasEnv : VEnv :=
+  normalizationMatrixIndexAliasConstEnv.addDefEq matrixIndexAliasDefEq
+
+theorem normalizationMatrixAliasEnv_ordered :
+    normalizationMatrixAliasEnv.Ordered := by
+  apply VEnv.Ordered.defeq
+  · apply VEnv.Ordered.const (n := ``MatrixIndexAlias)
+      (ci := vconst(type_of% @MatrixIndexAlias))
+      (env' := normalizationMatrixIndexAliasConstEnv)
+      normalizationMatrixPiAliasEnv_ordered
+    · have hfamily : normalizationMatrixPiAliasEnv.constants
+          ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+      exact ⟨_, by type_tac⟩
+    · rfl
+  · have hfamily : normalizationMatrixIndexAliasConstEnv.constants
+        ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+    have hlookup : normalizationMatrixIndexAliasConstEnv.constants
+        ``MatrixIndexAlias = some (vconst(type_of% @MatrixIndexAlias)) := rfl
+    constructor <;> type_tac
+
+theorem normalizationMatrixRecAliasEnv_le_betaAliasEnv :
+    normalizationMatrixRecAliasEnv ≤ normalizationMatrixBetaAliasEnv :=
+  (VEnv.addConst_le (by rfl : normalizationMatrixRecAliasEnv.addConst
+    ``MatrixBetaAlias (vconst(type_of% @MatrixBetaAlias)) =
+      some normalizationMatrixBetaAliasConstEnv)).trans VEnv.addDefEq_le
+
+theorem normalizationMatrixBetaAliasEnv_le_letAliasEnv :
+    normalizationMatrixBetaAliasEnv ≤ normalizationMatrixLetAliasEnv :=
+  (VEnv.addConst_le (by rfl : normalizationMatrixBetaAliasEnv.addConst
+    ``MatrixLetAlias (vconst(type_of% @MatrixLetAlias)) =
+      some normalizationMatrixLetAliasConstEnv)).trans VEnv.addDefEq_le
+
+theorem normalizationMatrixLetAliasEnv_le_piAliasEnv :
+    normalizationMatrixLetAliasEnv ≤ normalizationMatrixPiAliasEnv :=
+  (VEnv.addConst_le (by rfl : normalizationMatrixLetAliasEnv.addConst
+    ``MatrixPiAlias (vconst(type_of% @MatrixPiAlias)) =
+      some normalizationMatrixPiAliasConstEnv)).trans VEnv.addDefEq_le
+
+theorem normalizationMatrixPiAliasEnv_le_aliasEnv :
+    normalizationMatrixPiAliasEnv ≤ normalizationMatrixAliasEnv :=
+  (VEnv.addConst_le (by rfl : normalizationMatrixPiAliasEnv.addConst
+    ``MatrixIndexAlias (vconst(type_of% @MatrixIndexAlias)) =
+      some normalizationMatrixIndexAliasConstEnv)).trans VEnv.addDefEq_le
+
+theorem normalizationMatrixRecAliasEnv_le_aliasEnv :
+    normalizationMatrixRecAliasEnv ≤ normalizationMatrixAliasEnv :=
+  normalizationMatrixRecAliasEnv_le_betaAliasEnv.trans <|
+    normalizationMatrixBetaAliasEnv_le_letAliasEnv.trans <|
+      normalizationMatrixLetAliasEnv_le_piAliasEnv.trans
+        normalizationMatrixPiAliasEnv_le_aliasEnv
+
+theorem typeFamilyAliasEnv_le_normalizationMatrixAliasEnv :
+    typeFamilyAliasEnv ≤ normalizationMatrixAliasEnv := by
+  exact ((VEnv.addConst_le (by rfl : typeFamilyAliasEnv.addConst ``RecAlias
+    (vconst(type_of% @RecAlias)) =
+      some normalizationMatrixRecAliasConstEnv)).trans VEnv.addDefEq_le).trans
+        normalizationMatrixRecAliasEnv_le_aliasEnv
+
+theorem normalizationMatrix_typeFamilyAliasDefEq_mem :
+    normalizationMatrixAliasEnv.defeqs typeFamilyAliasDefEq :=
+  typeFamilyAliasEnv_le_normalizationMatrixAliasEnv.defeqs
+    VEnv.addDefEq_self
+
+theorem normalizationMatrix_recAliasDefEq_mem :
+    normalizationMatrixAliasEnv.defeqs recAliasDefEq :=
+  normalizationMatrixRecAliasEnv_le_aliasEnv.defeqs VEnv.addDefEq_self
+
+theorem normalizationMatrix_betaAliasDefEq_mem :
+    normalizationMatrixAliasEnv.defeqs matrixBetaAliasDefEq :=
+  (normalizationMatrixBetaAliasEnv_le_letAliasEnv.trans <|
+    normalizationMatrixLetAliasEnv_le_piAliasEnv.trans
+      normalizationMatrixPiAliasEnv_le_aliasEnv).defeqs VEnv.addDefEq_self
+
+theorem normalizationMatrix_letAliasDefEq_mem :
+    normalizationMatrixAliasEnv.defeqs matrixLetAliasDefEq :=
+  (normalizationMatrixLetAliasEnv_le_piAliasEnv.trans
+    normalizationMatrixPiAliasEnv_le_aliasEnv).defeqs VEnv.addDefEq_self
+
+theorem normalizationMatrix_piAliasDefEq_mem :
+    normalizationMatrixAliasEnv.defeqs matrixPiAliasDefEq :=
+  normalizationMatrixPiAliasEnv_le_aliasEnv.defeqs VEnv.addDefEq_self
+
+theorem normalizationMatrixTypeFamily_defeq {env : VEnv} {U : Nat}
+    {Γ : List VExpr} (henv : normalizationMatrixAliasEnv ≤ env) :
+    env.IsDefEq U Γ (VExpr.const ``TypeFamilyAlias [])
+      (VExpr.sort (.succ .zero))
+      (VExpr.sort (.succ (.succ .zero))) := by
+  exact .extra (df := typeFamilyAliasDefEq) (ls := [])
+    (henv.defeqs normalizationMatrix_typeFamilyAliasDefEq_mem)
+    (fun _ h => nomatch h) rfl
+
+theorem normalizationMatrixRecAlias_app_defeq {env : VEnv} {U : Nat}
+    {Γ : List VExpr} {u : VLevel} {A : VExpr} (hu : u.WF U)
+    (henv : normalizationMatrixAliasEnv ≤ env)
+    (hA : env.HasType U Γ A (VExpr.sort u)) :
+    env.IsDefEq U Γ ((VExpr.const ``RecAlias [u]).app A) A
+      (VExpr.sort u) := by
+  have hdelta : env.IsDefEq U Γ (VExpr.const ``RecAlias [u])
+      (VExpr.lam (VExpr.sort u) (VExpr.bvar 0))
+      (VExpr.forallE (VExpr.sort u) (VExpr.sort u)) :=
+    .extra (df := recAliasDefEq) (ls := [u])
+      (henv.defeqs normalizationMatrix_recAliasDefEq_mem)
+      (by simpa using hu) rfl
+  have hbeta := VEnv.IsDefEq.beta (VEnv.IsDefEq.bvar .zero) hA
+  exact (VEnv.IsDefEq.appDF hdelta hA).trans (by
+    simpa [VExpr.inst, VExpr.instVar, VExpr.liftN] using hbeta)
+
+theorem normalizationMatrixBetaAlias_app_defeq {env : VEnv} {U : Nat}
+    {Γ : List VExpr} {u : VLevel} {A : VExpr} (hu : u.WF U)
+    (henv : normalizationMatrixAliasEnv ≤ env)
+    (hA : env.HasType U Γ A (VExpr.sort u)) :
+    env.IsDefEq U Γ ((VExpr.const ``MatrixBetaAlias [u]).app A) A
+      (VExpr.sort u) := by
+  have hdelta : env.IsDefEq U Γ (VExpr.const ``MatrixBetaAlias [u])
+      (VExpr.lam (VExpr.sort u)
+        ((VExpr.lam (VExpr.sort u) (VExpr.bvar 0)).app (VExpr.bvar 0)))
+      (VExpr.forallE (VExpr.sort u) (VExpr.sort u)) :=
+    .extra (df := matrixBetaAliasDefEq) (ls := [u])
+      (henv.defeqs normalizationMatrix_betaAliasDefEq_mem)
+      (by simpa using hu) rfl
+  have hbody : env.HasType U (VExpr.sort u :: Γ)
+      ((VExpr.lam (VExpr.sort u) (VExpr.bvar 0)).app (VExpr.bvar 0))
+      (VExpr.sort u) :=
+    VEnv.HasType.app
+      (VEnv.HasType.lam (VEnv.HasType.sort hu) (VEnv.HasType.bvar .zero))
+      (VEnv.HasType.bvar .zero)
+  have houterBeta := VEnv.IsDefEq.beta hbody hA
+  have houter := (VEnv.IsDefEq.appDF hdelta hA).trans (by
+    simpa [VExpr.inst, VExpr.instVar, VExpr.liftN] using houterBeta)
+  have hinnerBeta := VEnv.IsDefEq.beta (VEnv.IsDefEq.bvar .zero) hA
+  exact houter.trans (by
+    simpa [VExpr.inst, VExpr.instVar, VExpr.liftN] using hinnerBeta)
+
+theorem normalizationMatrixLetAlias_app_defeq {env : VEnv} {U : Nat}
+    {Γ : List VExpr} {u : VLevel} {A : VExpr} (hu : u.WF U)
+    (henv : normalizationMatrixAliasEnv ≤ env)
+    (hA : env.HasType U Γ A (VExpr.sort u)) :
+    env.IsDefEq U Γ ((VExpr.const ``MatrixLetAlias [u]).app A) A
+      (VExpr.sort u) := by
+  have hdelta : env.IsDefEq U Γ (VExpr.const ``MatrixLetAlias [u])
+      (VExpr.lam (VExpr.sort u) (VExpr.bvar 0))
+      (VExpr.forallE (VExpr.sort u) (VExpr.sort u)) :=
+    .extra (df := matrixLetAliasDefEq) (ls := [u])
+      (henv.defeqs normalizationMatrix_letAliasDefEq_mem)
+      (by simpa using hu) rfl
+  have hbeta := VEnv.IsDefEq.beta (VEnv.IsDefEq.bvar .zero) hA
+  exact (VEnv.IsDefEq.appDF hdelta hA).trans (by
+    simpa [VExpr.inst, VExpr.instVar, VExpr.liftN] using hbeta)
+
+private theorem normalizationMatrix_one_imax_equiv (u : VLevel) :
+    .imax (.succ .zero) u ≈ u := by
+  rw [VLevel.equiv_def]
+  intro ls
+  simp only [VLevel.eval, Nat.zero_add]
+  let n := u.eval ls
+  change Lean.Nat.imax 1 n = n
+  by_cases h : n = 0
+  · simp [Lean.Nat.imax, h]
+  · have hn : 1 ≤ n := Nat.one_le_iff_ne_zero.mpr h
+    simp [Lean.Nat.imax, h, Nat.max_eq_right hn]
+
+theorem normalizationMatrixPiAlias_app_defeq {env : VEnv} {U : Nat}
+    {Γ : List VExpr} {u : VLevel} {A : VExpr} (hu : u.WF U)
+    (henv : normalizationMatrixAliasEnv ≤ env)
+    (hA : env.HasType U Γ A (VExpr.sort u)) :
+    env.IsDefEq U Γ ((VExpr.const ``MatrixPiAlias [u]).app A)
+      (VExpr.forallE (VExpr.sort .zero) A.lift) (VExpr.sort u) := by
+  have hdelta : env.IsDefEq U Γ (VExpr.const ``MatrixPiAlias [u])
+      (VExpr.lam (VExpr.sort u)
+        (VExpr.forallE (VExpr.sort .zero) (VExpr.bvar 1)))
+      (VExpr.forallE (VExpr.sort u) (VExpr.sort u)) :=
+    .extra (df := matrixPiAliasDefEq) (ls := [u])
+      (henv.defeqs normalizationMatrix_piAliasDefEq_mem)
+      (by simpa using hu) rfl
+  have hbody : env.HasType U (VExpr.sort u :: Γ)
+      (VExpr.forallE (VExpr.sort .zero) (VExpr.bvar 1))
+      (VExpr.sort u) := by
+    apply VEnv.IsDefEq.defeq
+      (VEnv.IsDefEq.sortDF
+        (l := .imax (.succ .zero) u) (l' := u)
+        ⟨trivial, hu⟩ hu (normalizationMatrix_one_imax_equiv u))
+    exact VEnv.HasType.forallE (VEnv.HasType.sort (by trivial))
+      (VEnv.HasType.bvar (.succ .zero))
+  have hbeta := VEnv.IsDefEq.beta hbody hA
+  exact (VEnv.IsDefEq.appDF hdelta hA).trans (by
+    simpa [VExpr.inst, VExpr.instVar, VExpr.liftN] using hbeta)
+
+theorem normalizationMatrixIndexAlias_app_hasType {env : VEnv} {U : Nat}
+    {Γ : List VExpr} {index : VExpr}
+    (henv : normalizationMatrixAliasEnv ≤ env)
+    (hindex : env.HasType U Γ index (VExpr.sort (.succ .zero))) :
+    env.HasType U Γ ((VExpr.const ``MatrixIndexAlias []).app index)
+      (VExpr.sort (.succ .zero)) := by
+  have hfn : env.HasType U Γ (VExpr.const ``MatrixIndexAlias [])
+      ((VExpr.const ``TypeFamilyAlias []).forallE
+        (VExpr.const ``TypeFamilyAlias [])) :=
+    .constDF (henv.constants (by rfl : normalizationMatrixAliasEnv.constants
+        ``MatrixIndexAlias = some (vconst(type_of% @MatrixIndexAlias))))
+      (fun _ h => nomatch h) (fun _ h => nomatch h) rfl .nil
+  have hindexRaw := (normalizationMatrixTypeFamily_defeq henv).defeq' hindex
+  exact (normalizationMatrixTypeFamily_defeq henv).defeq
+    (VEnv.HasType.app hfn hindexRaw)
+
+theorem normalizationMatrixTarget_hasType {env : VEnv} {U : Nat}
+    {Γ : List VExpr} {alpha index : VExpr}
+    (henv : normalizationMatrixAliasEnv ≤ env)
+    (hfamily : env.constants ``NormalizationMatrix =
+      some normalizationMatrixRawType.toVConstant)
+    (halpha : env.HasType U Γ alpha (VExpr.const ``TypeFamilyAlias []))
+    (hindex : env.HasType U Γ index (VExpr.const ``TypeFamilyAlias [])) :
+    env.HasType U Γ (normalizationMatrixTarget alpha index)
+      (VExpr.sort (.succ (.succ .zero))) := by
+  have hfn : env.HasType U Γ (VExpr.const ``NormalizationMatrix [])
+      (VExpr.forallE (VExpr.const ``TypeFamilyAlias [])
+        (VExpr.forallE (VExpr.const ``TypeFamilyAlias [])
+          (VExpr.sort (.succ (.succ .zero))))) :=
+    .constDF hfamily (fun _ h => nomatch h) (fun _ h => nomatch h)
+      rfl .nil
+  have hindexFn : env.HasType U Γ (VExpr.const ``MatrixIndexAlias [])
+      ((VExpr.const ``TypeFamilyAlias []).forallE
+        (VExpr.const ``TypeFamilyAlias [])) :=
+    .constDF (henv.constants (by rfl : normalizationMatrixAliasEnv.constants
+        ``MatrixIndexAlias = some (vconst(type_of% @MatrixIndexAlias))))
+      (fun _ h => nomatch h) (fun _ h => nomatch h) rfl .nil
+  exact VEnv.HasType.app (VEnv.HasType.app hfn halpha)
+    (VEnv.HasType.app hindexFn hindex)
+
+theorem normalizationMatrixNormalization_wf :
+    normalizationMatrixNormalization.WF normalizationMatrixAliasEnv := by
+  refine ⟨normalizationMatrixRawType, normalizationMatrixViewType,
+    rfl, rfl, ?_, ?_⟩
+  · refine ⟨VExpr.sort (.imax (.succ (.succ .zero))
+        (.imax (.succ (.succ .zero))
+          (.succ (.succ (.succ .zero))))), ?_⟩
+    change normalizationMatrixAliasEnv.IsDefEq 0 []
+      ((VExpr.const ``TypeFamilyAlias []).forallE
+        ((VExpr.const ``TypeFamilyAlias []).forallE
+          (VExpr.sort (.succ (.succ .zero)))))
+      ((VExpr.sort (.succ .zero)).forallE
+        ((VExpr.sort (.succ .zero)).forallE
+          (VExpr.sort (.succ (.succ .zero)))))
+      (VExpr.sort (.imax (.succ (.succ .zero))
+        (.imax (.succ (.succ .zero))
+          (.succ (.succ (.succ .zero))))))
+    apply VEnv.IsDefEq.forallEDF
+    · exact normalizationMatrixTypeFamily_defeq .rfl
+    · apply VEnv.IsDefEq.forallEDF
+      · exact normalizationMatrixTypeFamily_defeq .rfl
+      · exact VEnv.IsDefEq.sortDF (by decide) (by decide) rfl
+  · intro envT hadd
+    have henv : normalizationMatrixAliasEnv ≤ envT :=
+      VEnv.addConst_le hadd
+    have htypeFamily : envT.constants ``TypeFamilyAlias =
+        some (vconst(type_of% @TypeFamilyAlias)) :=
+      henv.constants (by rfl)
+    have hrecAlias : envT.constants ``RecAlias =
+        some (vconst(type_of% @RecAlias)) :=
+      henv.constants (by rfl)
+    have hbetaAlias : envT.constants ``MatrixBetaAlias =
+        some (vconst(type_of% @MatrixBetaAlias)) :=
+      henv.constants (by rfl)
+    have hletAlias : envT.constants ``MatrixLetAlias =
+        some (vconst(type_of% @MatrixLetAlias)) :=
+      henv.constants (by rfl)
+    have hpiAlias : envT.constants ``MatrixPiAlias =
+        some (vconst(type_of% @MatrixPiAlias)) :=
+      henv.constants (by rfl)
+    have hindexAlias : envT.constants ``MatrixIndexAlias =
+        some (vconst(type_of% @MatrixIndexAlias)) :=
+      henv.constants (by rfl)
+    have hfamily : envT.constants ``NormalizationMatrix =
+        some normalizationMatrixRawType.toVConstant :=
+      VEnv.addConst_self hadd
+    exact .cons ⟨_, by
+      apply VEnv.IsDefEq.forallEDF
+      · exact normalizationMatrixTypeFamily_defeq henv
+      · apply VEnv.IsDefEq.forallEDF
+        · exact normalizationMatrixTypeFamily_defeq henv
+        · apply VEnv.IsDefEq.forallEDF
+          · exact normalizationMatrixRecAlias_app_defeq
+              (by decide) henv (by type_tac)
+          · apply VEnv.IsDefEq.forallEDF
+            · exact normalizationMatrixBetaAlias_app_defeq
+                (by decide) henv (by type_tac)
+            · apply VEnv.IsDefEq.forallEDF
+              · exact normalizationMatrixLetAlias_app_defeq
+                  (by decide) henv (by type_tac)
+              · apply VEnv.IsDefEq.forallEDF
+                · exact normalizationMatrixRecAlias_app_defeq
+                    (by decide) henv (by type_tac)
+                · apply VEnv.IsDefEq.forallEDF
+                  · exact normalizationMatrixPiAlias_app_defeq
+                      (by decide) henv (by type_tac)
+                  · apply VEnv.IsDefEq.forallEDF
+                    · exact normalizationMatrixBetaAlias_app_defeq
+                        (by decide) henv (by type_tac)
+                    · apply VEnv.IsDefEq.forallEDF
+                      · exact normalizationMatrixLetAlias_app_defeq
+                          (by decide) henv (by type_tac)
+                      · type_tac⟩ .nil
+
+theorem normalizationMatrixViewChecked_wf :
+    normalizationMatrixViewChecked.WF normalizationMatrixAliasEnv := by
+  refine ⟨?_, ?_⟩
+  · change normalizationMatrixAliasEnv.OnTel 0 []
+      [VExpr.sort (.succ .zero), VExpr.sort (.succ .zero)]
+    exact ⟨⟨_, by type_tac⟩, ⟨⟨_, by type_tac⟩, trivial⟩⟩
+  · intro c hc
+    change c ∈ [normalizationMatrixViewCtor] at hc
+    have hc' : c = normalizationMatrixViewCtor :=
+      List.mem_singleton.1 hc
+    subst c
+    constructor
+    · change fieldsWF 0 ``NormalizationMatrix 1
+        normalizationMatrixAliasEnv (.succ (.succ .zero))
+        [VExpr.sort (.succ .zero)] [VExpr.sort (.succ .zero)] 0
+        [VExpr.sort (.succ .zero), VExpr.sort .zero,
+          VExpr.sort .zero, VExpr.sort .zero,
+          normalizationMatrixTarget (.bvar 4) (.bvar 3),
+          (VExpr.sort .zero).forallE
+            (normalizationMatrixTarget (.bvar 6) (.bvar 5)),
+          normalizationMatrixTarget (.bvar 6) (.bvar 5),
+          normalizationMatrixTarget (.bvar 7) (.bvar 6)]
+      refine ⟨?_, ?_, ?_⟩
+      · exact .inr (.inr ⟨rfl, .succ (.succ .zero), by type_tac,
+          .inr (VLevel.le_refl _)⟩)
+      · intro h
+        change false = true at h
+        contradiction
+      · refine ⟨?_, ?_, ?_⟩
+        · exact .inr (.inr ⟨rfl, .succ .zero, by type_tac,
+            .inr VLevel.le_succ⟩)
+        · intro h
+          change false = true at h
+          contradiction
+        · refine ⟨?_, ?_, ?_⟩
+          · exact .inr (.inr ⟨rfl, .succ .zero, by type_tac,
+              .inr VLevel.le_succ⟩)
+          · intro h
+            change false = true at h
+            contradiction
+          · refine ⟨?_, ?_, ?_⟩
+            · exact .inr (.inr ⟨rfl, .succ .zero, by type_tac,
+                .inr VLevel.le_succ⟩)
+            · intro h
+              change false = true at h
+              contradiction
+            · refine ⟨?_, ?_, ?_⟩
+              · exact .inl rfl
+              · intro _
+                exact .cons
+                  (normalizationMatrixIndexAlias_app_hasType .rfl
+                    (by type_tac)) .nil
+              · refine ⟨?_, ?_, ?_⟩
+                · refine .inr (.inl ⟨_, rfl, by decide, ?_⟩)
+                  constructor
+                  · exact ⟨⟨_, by type_tac⟩, trivial⟩
+                  · exact .cons
+                      (normalizationMatrixIndexAlias_app_hasType .rfl
+                        (by type_tac)) .nil
+                · intro h
+                  change false = true at h
+                  contradiction
+                · refine ⟨?_, ?_, ?_⟩
+                  · exact .inl rfl
+                  · intro _
+                    exact .cons
+                      (normalizationMatrixIndexAlias_app_hasType .rfl
+                        (by type_tac)) .nil
+                  · refine ⟨?_, ?_, trivial⟩
+                    · exact .inl rfl
+                    · intro _
+                      exact .cons
+                        (normalizationMatrixIndexAlias_app_hasType .rfl
+                          (by type_tac)) .nil
+    · exact .cons
+        (normalizationMatrixIndexAlias_app_hasType .rfl (by type_tac)) .nil
+
+theorem normalizationMatrixBlock_wf :
+    normalizationMatrixBlock.WF normalizationMatrixAliasEnv :=
+  ⟨normalizationMatrixNormalization_wf,
+    normalizationMatrixViewChecked_wf⟩
+
+theorem normalizationMatrixGenerationChecked_wf :
+    normalizationMatrixGenerationChecked.WF normalizationMatrixAliasEnv := by
+  refine {
+    blockWF := normalizationMatrixBlock_wf
+    familyTel := ?_
+    familyResult := ?_
+    ctors := ?_ }
+  · refine ⟨⟨_, normalizationMatrixTypeFamily_defeq .rfl⟩, ?_⟩
+    exact ⟨⟨_, normalizationMatrixTypeFamily_defeq .rfl⟩, trivial⟩
+  · exact VEnv.IsDefEq.sortDF (by decide) (by decide) rfl
+  · intro envT hadd ctor hctor
+    change ctor ∈
+      [⟨normalizationMatrixRawType.ctors[0],
+        normalizationMatrixViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    have henv : normalizationMatrixAliasEnv ≤ envT :=
+      VEnv.addConst_le hadd
+    have hfamily : envT.constants ``NormalizationMatrix =
+        some normalizationMatrixRawType.toVConstant :=
+      VEnv.addConst_self hadd
+    have hindexAlias : envT.constants ``MatrixIndexAlias =
+        some (vconst(type_of% @MatrixIndexAlias)) :=
+      henv.constants (by rfl)
+    refine {
+      declaredTel := ?_
+      declaredResult := ?_
+      emittedTel := ?_
+      emittedResult := ?_ }
+    · refine ⟨⟨_, normalizationMatrixTypeFamily_defeq henv⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixTypeFamily_defeq henv⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixRecAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixBetaAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixLetAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixRecAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixPiAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixBetaAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      exact ⟨⟨_, normalizationMatrixLetAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, trivial⟩
+    · exact normalizationMatrixTarget_hasType henv hfamily
+        (by type_tac) (by type_tac)
+    · refine ⟨⟨_, by type_tac⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixTypeFamily_defeq henv⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixRecAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixBetaAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixLetAlias_app_defeq
+        (by decide) henv (by type_tac)⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixRecAlias_app_defeq
+        (by decide) henv (by
+          exact normalizationMatrixTarget_hasType henv hfamily
+            ((normalizationMatrixTypeFamily_defeq henv).defeq'
+              (by type_tac))
+            (by type_tac))⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixPiAlias_app_defeq
+        (by decide) henv (by
+          exact normalizationMatrixTarget_hasType henv hfamily
+            ((normalizationMatrixTypeFamily_defeq henv).defeq'
+              (by type_tac))
+            (by type_tac))⟩, ?_⟩
+      refine ⟨⟨_, normalizationMatrixBetaAlias_app_defeq
+        (by decide) henv (by
+          exact normalizationMatrixTarget_hasType henv hfamily
+            ((normalizationMatrixTypeFamily_defeq henv).defeq'
+              (by type_tac))
+            (by type_tac))⟩, ?_⟩
+      exact ⟨⟨_, normalizationMatrixLetAlias_app_defeq
+        (by decide) henv (by
+          exact normalizationMatrixTarget_hasType henv hfamily
+            ((normalizationMatrixTypeFamily_defeq henv).defeq'
+              (by type_tac))
+            (by type_tac))⟩, trivial⟩
+    · exact normalizationMatrixTarget_hasType henv hfamily
+        ((normalizationMatrixTypeFamily_defeq henv).defeq'
+          (by type_tac))
+        (by type_tac)
+
+def normalizationMatrixFinalEnv : VEnv :=
+  (normalizationMatrixAliasEnv.addInductGeneration
+    normalizationMatrixGenerationChecked).get (by decide)
+
+theorem normalizationMatrix_addInductGeneration :
+    normalizationMatrixAliasEnv.addInductGeneration
+      normalizationMatrixGenerationChecked =
+        some normalizationMatrixFinalEnv := rfl
+
+theorem normalizationMatrixFinalEnv_trace :
+    Nonempty (VEnv.AddInductGenerationTrace normalizationMatrixAliasEnv
+      normalizationMatrixFinalEnv normalizationMatrixGenerationChecked) :=
+  VEnv.addInductGeneration_trace normalizationMatrix_addInductGeneration
+
+theorem normalizationMatrixFinalEnv_family_lookup :
+    normalizationMatrixFinalEnv.constants ``NormalizationMatrix =
+      some normalizationMatrixRawType.toVConstant := by
+  rcases normalizationMatrixFinalEnv_trace with ⟨H⟩
+  exact H.family_lookup
+
+theorem normalizationMatrixFinalEnv_ctor_lookup :
+    normalizationMatrixFinalEnv.constants ``NormalizationMatrix.mk =
+      some normalizationMatrixRawType.ctors[0].toVConstant := by
+  rcases normalizationMatrixFinalEnv_trace with ⟨H⟩
+  exact H.ctor_lookup (.head _)
+
+theorem normalizationMatrixFinalEnv_rec_lookup :
+    normalizationMatrixFinalEnv.constants ``NormalizationMatrix.rec =
+      some (vconst(type_of% @NormalizationMatrix.rec)) := by
+  rcases normalizationMatrixFinalEnv_trace with ⟨H⟩
+  exact H.rec_lookup
+
+theorem normalizationMatrixFinalEnv_iota_mem :
+    normalizationMatrixFinalEnv.defeqs
+      (vdefeq(alpha motive mk index ordinary beta letBound direct
+        piHidden betaRecursive letRecursive =>
+        @NormalizationMatrix.rec alpha motive mk (MatrixIndexAlias index)
+            (@NormalizationMatrix.mk alpha index ordinary beta letBound direct
+              piHidden betaRecursive letRecursive) ≡
+          mk index ordinary beta letBound direct piHidden betaRecursive
+            letRecursive
+            (@NormalizationMatrix.rec alpha motive mk
+              (MatrixIndexAlias index) direct)
+            (fun proof => @NormalizationMatrix.rec alpha motive mk
+              (MatrixIndexAlias index) (piHidden proof))
+            (@NormalizationMatrix.rec alpha motive mk
+              (MatrixIndexAlias index) betaRecursive)
+            (@NormalizationMatrix.rec alpha motive mk
+              (MatrixIndexAlias index) letRecursive))) := by
+  rcases normalizationMatrixFinalEnv_trace with ⟨H⟩
+  apply H.rule_mem
+  exact .head _
+
+theorem normalizationMatrixFinalEnv_ordered :
+    normalizationMatrixFinalEnv.Ordered :=
+  VEnv.addInductGeneration_WF normalizationMatrixAliasEnv_ordered
+    normalizationMatrixGenerationChecked_wf
+    normalizationMatrix_addInductGeneration
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.normalizationMatrixNormalization_wf [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.normalizationMatrixViewChecked_wf [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.normalizationMatrixGenerationChecked_wf [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.normalizationMatrixFinalEnv_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.normalizationMatrixFinalEnv_iota_mem [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.normalizationMatrixFinalEnv_ordered [propext, Classical.choice, Quot.sound]
+
+/-! ## Checked-analysis rejection fixtures -/
+
+/-
+The next three declarations are kernel-side differential fixtures for the
+recursive-Pi rejection branches. `#guard_msgs` checks the actual elaborator /
+kernel outcome while rolling the failed declaration back, so the VExpr
+fixtures below can independently exercise the Theory analyzer and public
+transaction.
+-/
+
+namespace KernelDifferential
+
+/--
+error: (kernel) arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.KernelRejectRecDomain.mk' has a non positive occurrence of the datatypes being declared
+-/
+#guard_msgs (whitespace := lax) in
+inductive KernelRejectRecDomain : Type where
+  | mk : (KernelRejectRecDomain → KernelRejectRecDomain) → KernelRejectRecDomain
+
+/--
+error: Mismatched inductive type parameter in
+  KernelRejectRecTarget β
+The provided argument
+  β
+is not definitionally equal to the expected parameter
+  α
+
+Note: The value of parameter `α` must be fixed throughout the inductive declaration. Consider making this parameter an index if it must vary.
+-/
+#guard_msgs (whitespace := lax) in
+inductive KernelRejectRecTarget (α : Type) : Type where
+  | mk : ((β : Type) → KernelRejectRecTarget β) → KernelRejectRecTarget α
+
+/--
+error: (kernel) arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.KernelRejectRecIndex.mk' contains a non valid occurrence of the datatypes being declared
+-/
+#guard_msgs (whitespace := lax) in
+inductive KernelRejectRecIndex : Type → Type where
+  | mk : ((n : Nat) → KernelRejectRecIndex (KernelRejectRecIndex Nat)) →
+    KernelRejectRecIndex Nat
+
+end KernelDifferential
+
+/-- A recursive function argument may not mention the family in one of its
+binder domains. This is the raw-VExpr counterpart of
+`KernelRejectRecDomain`. -/
+def recDomainTypeName : Name := .mkSimple "RecDomainFixture"
+
+def recDomainCtorName : Name := .str recDomainTypeName "mk"
+
+def recDomainField : VExpr :=
+  .forallE (.const recDomainTypeName []) (.const recDomainTypeName [])
+
+def recDomainType : VInductiveType where
+  name := recDomainTypeName
+  uvars := 0
+  type := .sort (.succ .zero)
+  ctors := [⟨⟨0, .forallE recDomainField (.const recDomainTypeName [])⟩,
+    recDomainCtorName⟩]
+
+def recDomainDecl : VInductDecl := ⟨0, 0, [recDomainType]⟩
+
+example : namesOK recDomainType = true := rfl
+example : closedOK recDomainType = true := rfl
+example : levelsOK 0 recDomainType = true := rfl
+example : typeFormerOK 0 recDomainType = true := rfl
+example : largeElim 0 recDomainTypeName 0 0 recDomainType = true := rfl
+example : recTarget? 0 recDomainTypeName 0 0 0 recDomainField = none := rfl
+example : stage3Field 0 recDomainTypeName 0 0 0 recDomainField = false := rfl
+example : stage3DirectCore 0 0 recDomainType = false := rfl
+example : recDomainDecl.checked? = none := rfl
+example : VEnv.empty.addInduct recDomainDecl = none := rfl
+
+/-- A recursive target below a Pi must retain the declaration's fixed
+parameters. Here the terminal target uses the locally bound `β` instead of
+the outer parameter, matching `KernelRejectRecTarget`. -/
+def recTargetTypeName : Name := .mkSimple "RecTargetFixture"
+
+def recTargetCtorName : Name := .str recTargetTypeName "mk"
+
+def recTargetField : VExpr :=
+  .forallE (.sort (.succ .zero))
+    ((VExpr.const recTargetTypeName []).app (VExpr.bvar 0))
+
+def recTargetType : VInductiveType where
+  name := recTargetTypeName
+  uvars := 0
+  type := .forallE (.sort (.succ .zero)) (.sort (.succ .zero))
+  ctors := [⟨⟨0,
+    .forallE (.sort (.succ .zero))
+      (.forallE recTargetField
+        ((VExpr.const recTargetTypeName []).app (VExpr.bvar 1)))⟩,
+    recTargetCtorName⟩]
+
+def recTargetDecl : VInductDecl := ⟨0, 1, [recTargetType]⟩
+
+example : namesOK recTargetType = true := rfl
+example : closedOK recTargetType = true := rfl
+example : levelsOK 0 recTargetType = true := rfl
+example : typeFormerOK 1 recTargetType = true := rfl
+example : largeElim 0 recTargetTypeName 1 0 recTargetType = true := rfl
+example : isRecField 0 recTargetTypeName 1 0 1
+    ((VExpr.const recTargetTypeName []).app (VExpr.bvar 0)) = false := rfl
+example : recTarget? 0 recTargetTypeName 1 0 0 recTargetField = none := rfl
+example : stage3Field 0 recTargetTypeName 1 0 0 recTargetField = false := rfl
+example : stage3DirectCore 0 1 recTargetType = false := rfl
+example : recTargetDecl.checked? = none := rfl
+example : VEnv.empty.addInduct recTargetDecl = none := rfl
+
+/-- Recursive target indices must be free of the family. The inner
+`RecIndexFixture Nat` occurs inside the outer recursive target's index,
+matching `KernelRejectRecIndex`. -/
+def recIndexTypeName : Name := .mkSimple "RecIndexFixture"
+
+def recIndexCtorName : Name := .str recIndexTypeName "mk"
+
+def recIndexTarget : VExpr :=
+  (VExpr.const recIndexTypeName []).app
+    ((VExpr.const recIndexTypeName []).app (VExpr.const ``Nat []))
+
+def recIndexField : VExpr := .forallE (VExpr.const ``Nat []) recIndexTarget
+
+def recIndexType : VInductiveType where
+  name := recIndexTypeName
+  uvars := 0
+  type := .forallE (.sort (.succ .zero)) (.sort (.succ .zero))
+  ctors := [⟨⟨0,
+    .forallE recIndexField
+      ((VExpr.const recIndexTypeName []).app (VExpr.const ``Nat []))⟩,
+    recIndexCtorName⟩]
+
+def recIndexDecl : VInductDecl := ⟨0, 0, [recIndexType]⟩
+
+example : namesOK recIndexType = true := rfl
+example : closedOK recIndexType = true := rfl
+example : levelsOK 0 recIndexType = true := rfl
+example : typeFormerOK 0 recIndexType = true := rfl
+example : largeElim 0 recIndexTypeName 0 1 recIndexType = true := rfl
+example : isRecField 0 recIndexTypeName 0 1 1 recIndexTarget = false := rfl
+example : recTarget? 0 recIndexTypeName 0 1 0 recIndexField = none := rfl
+example : stage3Field 0 recIndexTypeName 0 1 0 recIndexField = false := rfl
+example : stage3DirectCore 0 0 recIndexType = false := rfl
+example : recIndexDecl.checked? = none := rfl
+example : VEnv.empty.addInduct recIndexDecl = none := rfl
+
+/-- The old direct-recursion shape alone admits duplicate constructor names;
+the shared I2 descriptor rejects the block before a partial transaction. -/
+def duplicateCtorTypeName : Name := .mkSimple "DuplicateCtorFixture"
+
+def duplicateCtorName : Name := .str duplicateCtorTypeName "mk"
+
+def duplicateCtorType : VInductiveType where
+  name := duplicateCtorTypeName
+  uvars := 0
+  type := VExpr.sort (.succ .zero)
+  ctors := [⟨⟨0, VExpr.const duplicateCtorTypeName []⟩, duplicateCtorName⟩,
+    ⟨⟨0, VExpr.const duplicateCtorTypeName []⟩, duplicateCtorName⟩]
+
+def duplicateCtorDecl : VInductDecl := ⟨0, 0, [duplicateCtorType]⟩
+
+example : stage3DirectCore 0 0 duplicateCtorType = true := rfl
+example : namesOK duplicateCtorType = false := rfl
+example : duplicateCtorDecl.checked? = none := rfl
+example : VEnv.empty.addInduct duplicateCtorDecl = none := rfl
+
+/-- Internal uniqueness covers collisions between different generated roles,
+not only two constructors with the same name. -/
+def typeCtorAliasName : Name := .mkSimple "TypeCtorAliasFixture"
+
+def typeCtorAliasType : VInductiveType where
+  name := typeCtorAliasName
+  uvars := 0
+  type := VExpr.sort (.succ .zero)
+  ctors := [⟨⟨0, VExpr.const typeCtorAliasName []⟩, typeCtorAliasName⟩]
+
+def typeCtorAliasDecl : VInductDecl := ⟨0, 0, [typeCtorAliasType]⟩
+
+example : stage3DirectCore 0 0 typeCtorAliasType = true := rfl
+example : namesOK typeCtorAliasType = false := rfl
+example : typeCtorAliasDecl.checked? = none := rfl
+
+def ctorRecAliasTypeName : Name := .mkSimple "CtorRecAliasFixture"
+
+def ctorRecAliasType : VInductiveType where
+  name := ctorRecAliasTypeName
+  uvars := 0
+  type := VExpr.sort (.succ .zero)
+  ctors := [⟨⟨0, VExpr.const ctorRecAliasTypeName []⟩,
+    .str ctorRecAliasTypeName "rec"⟩]
+
+def ctorRecAliasDecl : VInductDecl := ⟨0, 0, [ctorRecAliasType]⟩
+
+example : stage3DirectCore 0 0 ctorRecAliasType = true := rfl
+example : namesOK ctorRecAliasType = false := rfl
+example : ctorRecAliasDecl.checked? = none := rfl
+
+/-- A constructor result with a loose index variable has the expected direct
+head/spine shape, but is not legal closed kernel metadata. -/
+def looseIndexTypeName : Name := .mkSimple "LooseIndexFixture"
+
+def looseIndexCtorName : Name := .str looseIndexTypeName "mk"
+
+def looseIndexType : VInductiveType where
+  name := looseIndexTypeName
+  uvars := 0
+  type := VExpr.forallE (VExpr.const ``Nat []) (VExpr.sort (.succ .zero))
+  ctors := [⟨⟨0, (VExpr.const looseIndexTypeName []).app (.bvar 0)⟩,
+    looseIndexCtorName⟩]
+
+def looseIndexDecl : VInductDecl := ⟨0, 0, [looseIndexType]⟩
+
+example : stage3DirectCore 0 0 looseIndexType = true := rfl
+example : closedOK looseIndexType = false := rfl
+example : looseIndexDecl.checked? = none := rfl
+example : VEnv.empty.addInduct looseIndexDecl = none := rfl
+
+/-- The family type is checked before its own constant exists. A self
+occurrence hidden in a parameter domain must therefore be rejected even when
+the constructor result has the otherwise expected head and parameter spine. -/
+def selfParamTypeName : Name := .mkSimple "SelfParamFixture"
+
+def selfParamCtorName : Name := .str selfParamTypeName "mk"
+
+def selfParamType : VInductiveType where
+  name := selfParamTypeName
+  uvars := 0
+  type := VExpr.forallE (VExpr.const selfParamTypeName []) (VExpr.sort (.succ .zero))
+  ctors := [⟨⟨0, VExpr.forallE (VExpr.const selfParamTypeName [])
+    ((VExpr.const selfParamTypeName []).app (.bvar 0))⟩, selfParamCtorName⟩]
+
+def selfParamDecl : VInductDecl := ⟨0, 1, [selfParamType]⟩
+
+example : typeFormerOK 1 selfParamType = false := rfl
+example : closedOK selfParamType = true := rfl
+example : levelsOK 0 selfParamType = true := rfl
+example : selfParamDecl.checked? = none := rfl
+example : VEnv.empty.addInduct selfParamDecl = none := rfl
+
+/-- An out-of-range universe can hide in a parameter while the result sort and
+direct constructor shape remain valid. `levelsOK` checks the complete metadata
+rather than only the result. -/
+def badParamLevelTypeName : Name := .mkSimple "BadParamLevelFixture"
+
+def badParamLevelCtorName : Name := .str badParamLevelTypeName "mk"
+
+def badParamLevelType : VInductiveType where
+  name := badParamLevelTypeName
+  uvars := 0
+  type := VExpr.forallE (VExpr.sort (.param 0)) (VExpr.sort (.succ .zero))
+  ctors := [⟨⟨0, VExpr.forallE (VExpr.sort (.param 0))
+    ((VExpr.const badParamLevelTypeName []).app (.bvar 0))⟩, badParamLevelCtorName⟩]
+
+def badParamLevelDecl : VInductDecl := ⟨0, 1, [badParamLevelType]⟩
+
+example : stage3DirectCore 0 1 badParamLevelType = true := rfl
+example : closedOK badParamLevelType = true := rfl
+example : levelsOK 0 badParamLevelType = false := rfl
+example : badParamLevelDecl.checked? = none := rfl
+example : VEnv.empty.addInduct badParamLevelDecl = none := rfl
+
+/-- Constructor fields receive the same full universe-range check. -/
+def badCtorLevelTypeName : Name := .mkSimple "BadCtorLevelFixture"
+
+def badCtorLevelCtorName : Name := .str badCtorLevelTypeName "mk"
+
+def badCtorLevelType : VInductiveType where
+  name := badCtorLevelTypeName
+  uvars := 0
+  type := VExpr.sort (.succ .zero)
+  ctors := [⟨⟨0, VExpr.forallE (VExpr.sort (.param 0))
+    (VExpr.const badCtorLevelTypeName [])⟩, badCtorLevelCtorName⟩]
+
+def badCtorLevelDecl : VInductDecl := ⟨0, 0, [badCtorLevelType]⟩
+
+example : stage3DirectCore 0 0 badCtorLevelType = true := rfl
+example : closedOK badCtorLevelType = true := rfl
+example : levelsOK 0 badCtorLevelType = false := rfl
+example : badCtorLevelDecl.checked? = none := rfl
+example : VEnv.empty.addInduct badCtorLevelDecl = none := rfl
+
+/-- A non-sort family result never reaches descriptor construction. -/
+def nonSortResultTypeName : Name := .mkSimple "NonSortResultFixture"
+
+def nonSortResultType : VInductiveType where
+  name := nonSortResultTypeName
+  uvars := 0
+  type := VExpr.const ``Nat []
+  ctors := []
+
+def nonSortResultDecl : VInductDecl := ⟨0, 0, [nonSortResultType]⟩
+
+example : stage3DirectCore 0 0 nonSortResultType = false := rfl
+example : nonSortResultDecl.checked? = none := rfl
+example : VEnv.empty.addInduct nonSortResultDecl = none := rfl
+
+/-- A constructor must return the family being declared, not merely any
+well-formed closed type. -/
+def wrongCtorHeadTypeName : Name := .mkSimple "WrongCtorHeadFixture"
+
+def wrongCtorHeadCtorName : Name := .str wrongCtorHeadTypeName "mk"
+
+def wrongCtorHeadType : VInductiveType where
+  name := wrongCtorHeadTypeName
+  uvars := 0
+  type := VExpr.sort (.succ .zero)
+  ctors := [⟨⟨0, VExpr.const ``Nat []⟩, wrongCtorHeadCtorName⟩]
+
+def wrongCtorHeadDecl : VInductDecl := ⟨0, 0, [wrongCtorHeadType]⟩
+
+example : stage3DirectCore 0 0 wrongCtorHeadType = false := rfl
+example : wrongCtorHeadDecl.checked? = none := rfl
+example : VEnv.empty.addInduct wrongCtorHeadDecl = none := rfl
+
+/-- Constructor result parameters must be the declaration's parameter
+variables in order, not arbitrary closed expressions of a plausible shape. -/
+def wrongParamSpineTypeName : Name := .mkSimple "WrongParamSpineFixture"
+
+def wrongParamSpineCtorName : Name := .str wrongParamSpineTypeName "mk"
+
+def wrongParamSpineType : VInductiveType where
+  name := wrongParamSpineTypeName
+  uvars := 0
+  type := VExpr.forallE (VExpr.sort (.succ .zero)) (VExpr.sort (.succ .zero))
+  ctors := [⟨⟨0, VExpr.forallE (VExpr.sort (.succ .zero))
+    ((VExpr.const wrongParamSpineTypeName []).app (.sort .zero))⟩,
+    wrongParamSpineCtorName⟩]
+
+def wrongParamSpineDecl : VInductDecl := ⟨0, 1, [wrongParamSpineType]⟩
+
+example : stage3DirectCore 0 1 wrongParamSpineType = false := rfl
+example : wrongParamSpineDecl.checked? = none := rfl
+example : VEnv.empty.addInduct wrongParamSpineDecl = none := rfl
+
+/-- `nparams` cannot exceed the actual leading pi telescope. -/
+def shortParamDecl : VInductDecl := ⟨0, 1, [natType]⟩
+
+example : stage3DirectCore 0 1 natType = false := rfl
+example : shortParamDecl.checked? = none := rfl
+example : VEnv.empty.addInduct shortParamDecl = none := rfl
+
+/-- Declaration, family, and constructor universe counts must agree even when
+the expressions themselves happen not to mention a level parameter. -/
+def badTypeUvars : VInductiveType := { natType with uvars := 1 }
+def badTypeUvarsDecl : VInductDecl := ⟨0, 0, [badTypeUvars]⟩
+
+example : stage3DirectCore 0 0 badTypeUvars = false := rfl
+example : badTypeUvarsDecl.checked? = none := rfl
+
+def badCtorUvarsType : VInductiveType :=
+  { natType with ctors := [{ natType.ctors[0] with uvars := 1 }, natType.ctors[1]] }
+def badCtorUvarsDecl : VInductDecl := ⟨0, 0, [badCtorUvarsType]⟩
+
+example : stage3DirectCore 0 0 badCtorUvarsType = false := rfl
+example : badCtorUvarsDecl.checked? = none := rfl
+
+/-! Environment-relative collisions are checked transactionally, after the
+environment-independent descriptor has established internal `Nodup`. -/
+
+def ctorCollisionEnv : VEnv :=
+  (VEnv.empty.addConst ``Nat.zero ⟨0, .sort .zero⟩).get (by decide)
+
+example : ctorCollisionEnv.constants ``Nat.zero = some ⟨0, .sort .zero⟩ := rfl
+example : ctorCollisionEnv.addInduct natDecl = none :=
+  VEnv.addInduct_eq_none_of_ctor_present (.head _) (.head _) ⟨_, rfl⟩
+
+def recCollisionEnv : VEnv :=
+  (VEnv.empty.addConst ``Nat.rec ⟨0, .sort .zero⟩).get (by decide)
+
+example : recCollisionEnv.constants ``Nat.rec = some ⟨0, .sort .zero⟩ := rfl
+example : recCollisionEnv.addInduct natDecl = none :=
+  VEnv.addInduct_eq_none_of_rec_present
+    (generation := natBlockGenerationChecked) rfl (.head _) ⟨_, rfl⟩
+
+/-! ## Small elimination -/
+
+/-- `Or` is the canonical small-elimination family: its motive remains in
+`Prop`, so the generated recursor introduces no fresh universe parameter. -/
+def orType : VInductiveType where
+  name := ``Or
+  uvars := 0
+  type := vconst(type_of% @Or).type
+  ctors := [⟨vconst(type_of% @Or.inl), ``Or.inl⟩,
+    ⟨vconst(type_of% @Or.inr), ``Or.inr⟩]
+
+def orDecl : VInductDecl := ⟨0, 2, [orType]⟩
+
+def orChecked : orDecl.Checked := orDecl.checked?.get (by decide)
+
+example : orDecl.stage3 = true := rfl
+example : orChecked.elimination = .small := rfl
+example : orChecked.kTarget = false := rfl
+example : orChecked.recursor.uvars = 0 := rfl
+example : orChecked.recursor = vconst(type_of% @Or.rec) := rfl
+example : orChecked.generatedRules[0]? =
+    some (vdefeq(a b motive inl inr h =>
+      @Or.rec a b motive inl inr (@Or.inl a b h) ≡ inl h)) := rfl
+example : orChecked.generatedRules[1]? =
+    some (vdefeq(a b motive inl inr h =>
+      @Or.rec a b motive inl inr (@Or.inr a b h) ≡ inr h)) := rfl
+example : (VEnv.empty.addInduct orDecl).isSome = true := rfl
+
+/-- `And` is the canonical singleton-Prop exception: both constructor fields
+are proofs, so Lean legitimately gives it a large eliminator with one fresh
+universe parameter. -/
+def andType : VInductiveType where
+  name := ``And
+  uvars := 0
+  type := vconst(type_of% @And).type
+  ctors := [⟨vconst(type_of% @And.intro), ``And.intro⟩]
+
+def andDecl : VInductDecl := ⟨0, 2, [andType]⟩
+
+def andChecked : andDecl.Checked := andDecl.checked?.get (by decide)
+
+example : andDecl.stage3 = true := rfl
+example : andChecked.elimination = .large := rfl
+/-- Large elimination and K eligibility are independent: `And` has the
+singleton-proof elimination exception, but its constructor has fields. -/
+example : andChecked.kTarget = false := rfl
+example : andChecked.recursor.uvars = 1 := rfl
+example : andChecked.recursor = vconst(type_of% @And.rec) := rfl
+example : andChecked.generatedRules[0]? =
+    some (vdefeq(a b motive intro left right =>
+      @And.rec a b motive intro (@And.intro a b left right) ≡
+        intro left right)) := rfl
+example : (VEnv.empty.addInduct andDecl).isSome = true := rfl
+
+/-! ## Conservativity: malformed declarations and name collisions refuse. -/
+
+/-- A name collision rejects the whole transaction. -/
+example (env : VEnv) (h : env.contains ``Nat) : env.addInduct natDecl = none :=
+  VEnv.addInduct_eq_none_of_type_present (.head _) h
diff --git a/Ix/Theory/Named/LICENSE b/Ix/Theory/Named/LICENSE
new file mode 100644
index 000000000..261eeb9e9
--- /dev/null
+++ b/Ix/Theory/Named/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/Ix/Theory/Named/Literals.lean b/Ix/Theory/Named/Literals.lean
new file mode 100644
index 000000000..47a31b000
--- /dev/null
+++ b/Ix/Theory/Named/Literals.lean
@@ -0,0 +1,682 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Inductive
+import Ix.Theory.Named.Typing.Strong
+
+open Ix.Theory (VLevel)
+
+/-! # Theory encodings of Lean literals and primitive reflection
+
+This file contains only `VExpr`/`VEnv` semantics.  Traversal of `Lean.Expr`
+and `Literal.toConstructor` belongs to the Verify translation layer.
+-/
+
+namespace Ix.Theory.Named
+open Lean
+
+def VEnv.ContainsLits (env : VEnv) : Literal → Prop
+  | .natVal _ => env.contains ``Nat
+  | .strVal _ => env.contains ``Char.ofNat ∧ env.contains ``String.ofList
+
+def VExpr.bool : VExpr := .const ``Bool []
+def VExpr.boolTrue : VExpr := .const ``Bool.true []
+def VExpr.boolFalse : VExpr := .const ``Bool.false []
+def VExpr.boolLit : Bool → VExpr
+  | .false => .boolFalse
+  | .true => .boolTrue
+
+def VExpr.nat : VExpr := .const ``Nat []
+def VExpr.natZero : VExpr := .const ``Nat.zero []
+def VExpr.natSucc : VExpr := .const ``Nat.succ []
+def VExpr.natLit : Nat → VExpr
+  | 0 => .natZero
+  | n+1 => .app .natSucc (.natLit n)
+
+def VExpr.char : VExpr := .const ``Char []
+def VExpr.string : VExpr := .const ``String []
+def VExpr.stringOfList : VExpr := .const ``String.ofList []
+def VExpr.listChar : VExpr := .app (.const ``List [.zero]) .char
+def VExpr.listCharNil : VExpr := .app (.const ``List.nil [.zero]) .char
+def VExpr.listCharCons : VExpr := .app (.const ``List.cons [.zero]) .char
+def VExpr.charOfNat : VExpr := .const ``Char.ofNat []
+def VExpr.listCharLit : List Char → VExpr
+  | [] => .listCharNil
+  | a :: as =>
+    .app (.app .listCharCons (.app .charOfNat (.natLit a.toNat))) (.listCharLit as)
+
+def VExpr.trLiteral : Literal → VExpr
+  | .natVal n => .natLit n
+  | .strVal s => .app .stringOfList (.listCharLit s.toList)
+
+def VExpr.literalType : Literal → VExpr
+  | .natVal _ => .nat
+  | .strVal _ => .string
+
+/-! ## Exact prelude artifacts
+
+`ContainsLits` deliberately records only name occurrence.  The declarations
+below describe the exact Theory artifacts that make those names meaningful.
+The inductive recursors and iota rules are generated by the same
+consumer-neutral Theory machinery used by `VEnv.addInduct`.
+-/
+
+namespace LiteralPrelude
+
+def boolFalse : VConstVal :=
+  { name := ``Bool.false, uvars := 0, type := .bool }
+
+def boolTrue : VConstVal :=
+  { name := ``Bool.true, uvars := 0, type := .bool }
+
+def boolType : VInductiveType where
+  name := ``Bool
+  uvars := 0
+  type := .sort (.succ .zero)
+  ctors := [boolFalse, boolTrue]
+
+def boolRec : VConstant := VInductDecl.recConst 0 ``Bool 0 boolType
+def boolIotas : List VDefEq := VInductDecl.rules 0 ``Bool 0 boolType
+
+def natZero : VConstVal :=
+  { name := ``Nat.zero, uvars := 0, type := .nat }
+
+def natSucc : VConstVal :=
+  { name := ``Nat.succ, uvars := 0, type := .forallE .nat .nat }
+
+def natType : VInductiveType where
+  name := ``Nat
+  uvars := 0
+  type := .sort (.succ .zero)
+  ctors := [natZero, natSucc]
+
+def natRec : VConstant := VInductDecl.recConst 0 ``Nat 0 natType
+def natIotas : List VDefEq := VInductDecl.rules 0 ``Nat 0 natType
+
+def char : VConstant := { uvars := 0, type := .sort (.succ .zero) }
+def charOfNat : VConstant := { uvars := 0, type := .forallE .nat .char }
+
+def listNil : VConstVal where
+  name := ``List.nil
+  uvars := 1
+  type := .forallE (.sort (.succ (.param 0)))
+    (.app (.const ``List [.param 0]) (.bvar 0))
+
+def listCons : VConstVal where
+  name := ``List.cons
+  uvars := 1
+  type := .forallE (.sort (.succ (.param 0))) <|
+    .forallE (.bvar 0) <|
+      .forallE (.app (.const ``List [.param 0]) (.bvar 1))
+        (.app (.const ``List [.param 0]) (.bvar 2))
+
+def listType : VInductiveType where
+  name := ``List
+  uvars := 1
+  type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+  ctors := [listNil, listCons]
+
+def listRec : VConstant := VInductDecl.recConst 1 ``List 1 listType
+def listIotas : List VDefEq := VInductDecl.rules 1 ``List 1 listType
+
+def string : VConstant := { uvars := 0, type := .sort (.succ .zero) }
+def stringOfList : VConstant :=
+  { uvars := 0, type := .forallE .listChar .string }
+
+end LiteralPrelude
+
+/-- The exact kernel-facing prelude fragment needed to interpret Theory
+literals.  In contrast with `ContainsLits`, this records declaration types,
+recursors, iota rules, and an ordered construction history. -/
+structure VEnv.PreludeReady (env : VEnv) : Prop where
+  ordered : env.Ordered
+  bool : env.constants ``Bool = some LiteralPrelude.boolType.toVConstant
+  boolFalse : env.constants ``Bool.false =
+    some LiteralPrelude.boolFalse.toVConstant
+  boolTrue : env.constants ``Bool.true =
+    some LiteralPrelude.boolTrue.toVConstant
+  boolRec : env.constants ``Bool.rec = some LiteralPrelude.boolRec
+  boolIotas : ∀ df ∈ LiteralPrelude.boolIotas, env.defeqs df
+  nat : env.constants ``Nat = some LiteralPrelude.natType.toVConstant
+  natZero : env.constants ``Nat.zero =
+    some LiteralPrelude.natZero.toVConstant
+  natSucc : env.constants ``Nat.succ =
+    some LiteralPrelude.natSucc.toVConstant
+  natRec : env.constants ``Nat.rec = some LiteralPrelude.natRec
+  natIotas : ∀ df ∈ LiteralPrelude.natIotas, env.defeqs df
+  char : env.constants ``Char = some LiteralPrelude.char
+  charOfNat : env.constants ``Char.ofNat = some LiteralPrelude.charOfNat
+  list : env.constants ``List = some LiteralPrelude.listType.toVConstant
+  listNil : env.constants ``List.nil =
+    some LiteralPrelude.listNil.toVConstant
+  listCons : env.constants ``List.cons =
+    some LiteralPrelude.listCons.toVConstant
+  listRec : env.constants ``List.rec = some LiteralPrelude.listRec
+  listIotas : ∀ df ∈ LiteralPrelude.listIotas, env.defeqs df
+  string : env.constants ``String = some LiteralPrelude.string
+  stringOfList : env.constants ``String.ofList = some LiteralPrelude.stringOfList
+
+namespace VEnv.PreludeReady
+
+/-- Exact prelude artifacts transport across environment inclusion.  The
+target ordering premise is necessary because arbitrary `VEnv.LE` growth may
+append an ill-typed declaration. -/
+theorem mono {env env' : VEnv} (H : env.PreludeReady) (henv : env ≤ env')
+    (hordered : env'.Ordered) : env'.PreludeReady where
+  ordered := hordered
+  bool := henv.constants H.bool
+  boolFalse := henv.constants H.boolFalse
+  boolTrue := henv.constants H.boolTrue
+  boolRec := henv.constants H.boolRec
+  boolIotas := fun df hdf => henv.defeqs (H.boolIotas df hdf)
+  nat := henv.constants H.nat
+  natZero := henv.constants H.natZero
+  natSucc := henv.constants H.natSucc
+  natRec := henv.constants H.natRec
+  natIotas := fun df hdf => henv.defeqs (H.natIotas df hdf)
+  char := henv.constants H.char
+  charOfNat := henv.constants H.charOfNat
+  list := henv.constants H.list
+  listNil := henv.constants H.listNil
+  listCons := henv.constants H.listCons
+  listRec := henv.constants H.listRec
+  listIotas := fun df hdf => henv.defeqs (H.listIotas df hdf)
+  string := henv.constants H.string
+  stringOfList := henv.constants H.stringOfList
+
+/-- Any successful well-formed constant insertion preserves readiness.  It is
+necessarily unrelated to the ready prelude: all of those names are already
+occupied, while `addConst` succeeds only at a fresh name. -/
+theorem addConst {env env' : VEnv} (H : env.PreludeReady)
+    (hci : ci.WF env) (hadd : env.addConst name ci = some env') :
+    env'.PreludeReady :=
+  H.mono (VEnv.addConst_le hadd) (.const H.ordered hci hadd)
+
+/-- Adding a well-formed unrelated definitional equation preserves prelude
+readiness. -/
+theorem addDefEq {env : VEnv} (H : env.PreludeReady) (hdf : df.WF env) :
+    (env.addDefEq df).PreludeReady :=
+  H.mono VEnv.addDefEq_le (.defeq H.ordered hdf)
+
+/-- A ready prelude contains every name used by the direct literal encoding. -/
+theorem containsLits {env : VEnv} (H : env.PreludeReady) :
+    ∀ l, env.ContainsLits l
+  | .natVal _ => ⟨_, H.nat⟩
+  | .strVal _ => ⟨⟨_, H.charOfNat⟩, ⟨_, H.stringOfList⟩⟩
+
+end VEnv.PreludeReady
+
+def VEnv.ReflectsNatNatNat (env : VEnv) (fc : Name) (f : Nat → Nat → Nat) :=
+  env.contains fc →
+  ∀ a b, env.IsDefEqU 0 []
+    (.app (.app (.const fc []) (.natLit a)) (.natLit b)) (.natLit (f a b))
+
+def VEnv.ReflectsNatNatBool (env : VEnv) (fc : Name) (f : Nat → Nat → Bool) :=
+  env.contains fc →
+  ∀ a b, env.IsDefEqU 0 []
+    (.app (.app (.const fc []) (.natLit a)) (.natLit b)) (.boolLit (f a b))
+
+structure VEnv.HasPrimitives (env : VEnv) : Prop where
+  bool : env.contains ``Bool → env.contains ``Bool.false ∧ env.contains ``Bool.true
+  boolFalse : env.constants ``Bool.false = some ci → ci = { uvars := 0, type := .bool }
+  boolTrue : env.constants ``Bool.true = some ci → ci = { uvars := 0, type := .bool }
+  nat : env.contains ``Nat → env.contains ``Nat.zero ∧ env.contains ``Nat.succ
+  natZero : env.constants ``Nat.zero = some ci → ci = { uvars := 0, type := .nat }
+  natSucc : env.constants ``Nat.succ = some ci →
+    ci = { uvars := 0, type := .forallE .nat .nat }
+  natAdd : env.ReflectsNatNatNat ``Nat.add Nat.add
+  natSub : env.ReflectsNatNatNat ``Nat.sub Nat.sub
+  natMul : env.ReflectsNatNatNat ``Nat.mul Nat.mul
+  natPow : env.ReflectsNatNatNat ``Nat.pow Nat.pow
+  natGcd : env.ReflectsNatNatNat ``Nat.gcd Nat.gcd
+  natMod : env.ReflectsNatNatNat ``Nat.mod Nat.mod
+  natDiv : env.ReflectsNatNatNat ``Nat.div Nat.div
+  natBEq : env.ReflectsNatNatBool ``Nat.beq Nat.beq
+  natBLE : env.ReflectsNatNatBool ``Nat.ble Nat.ble
+  natLAnd : env.ReflectsNatNatNat ``Nat.land Nat.land
+  natLOr : env.ReflectsNatNatNat ``Nat.lor Nat.lor
+  natXor : env.ReflectsNatNatNat ``Nat.xor Nat.xor
+  natShiftLeft : env.ReflectsNatNatNat ``Nat.shiftLeft Nat.shiftLeft
+  natShiftRight : env.ReflectsNatNatNat ``Nat.shiftRight Nat.shiftRight
+  charOfNat : env.constants ``Char.ofNat = some ci →
+    ci = { uvars := 0, type := .forallE .nat .char }
+  stringOfList : env.constants ``String.ofList = some ci →
+    ci = { uvars := 0, type := .forallE .listChar .string } ∧
+    env.HasType 0 [] .listCharNil .listChar ∧
+    env.HasType 0 [] .listCharCons (.forallE .char <| .forallE .listChar .listChar)
+
+/-- A well-formed Boolean literal can only occur when the corresponding
+Boolean declaration is present. -/
+theorem VExpr.WF.boolLit_has_type (wf : env.Ordered)
+    (henv : env.HasPrimitives) (hΓ : OnCtx Γ (env.IsType U))
+    (H : VExpr.WF env U Γ (.boolLit b)) : env.contains ``Bool := by
+  suffices env.HasType U Γ (.boolLit b) .bool by
+    have ⟨_, H⟩ := this.isType wf hΓ
+    have ⟨_, H, _⟩ := VEnv.HasType.const_inv wf hΓ H
+    exact ⟨_, H⟩
+  cases b with
+    have ⟨_, h1, h2, h3⟩ :=
+      let ⟨_, H⟩ := H
+      VEnv.HasType.const_inv wf hΓ H
+  | false => cases henv.boolFalse h1; exact .const h1 h2 h3
+  | true => cases henv.boolTrue h1; exact .const h1 h2 h3
+
+/-- The primitive constants whose Theory reflections are tracked by
+`VEnv.HasPrimitives`. `Nat.pred` and `Nat.bitwise` are kernel primitive names
+too, but they have no dedicated fields in that contract. -/
+def VEnv.reflectedPrimitiveNames : List Name := [
+  ``Bool, ``Bool.false, ``Bool.true,
+  ``Nat, ``Nat.zero, ``Nat.succ,
+  ``Nat.add, ``Nat.sub, ``Nat.mul, ``Nat.pow,
+  ``Nat.gcd, ``Nat.mod, ``Nat.div, ``Nat.beq, ``Nat.ble,
+  ``Nat.land, ``Nat.lor, ``Nat.xor,
+  ``Nat.shiftLeft, ``Nat.shiftRight,
+  ``Char.ofNat, ``String.ofList]
+
+/-- An environment containing none of the hard-coded reflected primitive
+names satisfies the primitive-reflection contract vacuously. -/
+theorem VEnv.HasPrimitives.of_avoids
+    {env : VEnv}
+    (h : ∀ n ∈ VEnv.reflectedPrimitiveNames, env.constants n = none) :
+    env.HasPrimitives := by
+  have noContains (n) (hn : n ∈ VEnv.reflectedPrimitiveNames) :
+      ¬env.contains n := by
+    rintro ⟨ci, hci⟩
+    rw [h n hn] at hci
+    contradiction
+  have noLookup (n) (hn : n ∈ VEnv.reflectedPrimitiveNames)
+      {ci} (hci : env.constants n = some ci) : False := by
+    rw [h n hn] at hci
+    contradiction
+  exact {
+    bool := fun hc =>
+      (noContains ``Bool (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    boolFalse := fun hci =>
+      (noLookup ``Bool.false
+        (by simp [VEnv.reflectedPrimitiveNames]) hci).elim
+    boolTrue := fun hci =>
+      (noLookup ``Bool.true
+        (by simp [VEnv.reflectedPrimitiveNames]) hci).elim
+    nat := fun hc =>
+      (noContains ``Nat (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natZero := fun hci =>
+      (noLookup ``Nat.zero
+        (by simp [VEnv.reflectedPrimitiveNames]) hci).elim
+    natSucc := fun hci =>
+      (noLookup ``Nat.succ
+        (by simp [VEnv.reflectedPrimitiveNames]) hci).elim
+    natAdd := fun hc =>
+      (noContains ``Nat.add
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natSub := fun hc =>
+      (noContains ``Nat.sub
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natMul := fun hc =>
+      (noContains ``Nat.mul
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natPow := fun hc =>
+      (noContains ``Nat.pow
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natGcd := fun hc =>
+      (noContains ``Nat.gcd
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natMod := fun hc =>
+      (noContains ``Nat.mod
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natDiv := fun hc =>
+      (noContains ``Nat.div
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natBEq := fun hc =>
+      (noContains ``Nat.beq
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natBLE := fun hc =>
+      (noContains ``Nat.ble
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natLAnd := fun hc =>
+      (noContains ``Nat.land
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natLOr := fun hc =>
+      (noContains ``Nat.lor
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natXor := fun hc =>
+      (noContains ``Nat.xor
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natShiftLeft := fun hc =>
+      (noContains ``Nat.shiftLeft
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    natShiftRight := fun hc =>
+      (noContains ``Nat.shiftRight
+        (by simp [VEnv.reflectedPrimitiveNames]) hc).elim
+    charOfNat := fun hci =>
+      (noLookup ``Char.ofNat
+        (by simp [VEnv.reflectedPrimitiveNames]) hci).elim
+    stringOfList := fun hci =>
+      (noLookup ``String.ofList
+        (by simp [VEnv.reflectedPrimitiveNames]) hci).elim }
+
+/-- A fresh Theory constant leaves every other lookup unchanged. -/
+theorem VEnv.addConst_other
+    {env env' : VEnv} {name other : Name} {ci : VConstant}
+    (hadd : env.addConst name ci = some env')
+    (hne : name ≠ other) :
+    env'.constants other = env.constants other := by
+  unfold VEnv.addConst at hadd
+  split at hadd <;> cases hadd
+  simp [hne]
+
+/-- Inserting a non-reflected constant preserves the primitive-reflection
+contract. -/
+theorem VEnv.HasPrimitives.addConst
+    {env env' : VEnv} {name : Name} {ci : VConstant}
+    (H : env.HasPrimitives)
+    (hname : name ∉ VEnv.reflectedPrimitiveNames)
+    (hadd : env.addConst name ci = some env') :
+    env'.HasPrimitives := by
+  have lookup (other : Name) (hother : other ∈ VEnv.reflectedPrimitiveNames) :
+      env'.constants other = env.constants other :=
+    VEnv.addConst_other hadd (by
+      intro equality
+      apply hname
+      simpa only [equality] using hother)
+  have oldContains (other : Name)
+      (hother : other ∈ VEnv.reflectedPrimitiveNames) :
+      env'.contains other → env.contains other := by
+    rintro ⟨value, hvalue⟩
+    exact ⟨value, by simpa only [lookup other hother] using hvalue⟩
+  have newContains (other : Name) :
+      env.contains other → env'.contains other := by
+    rintro ⟨value, hvalue⟩
+    exact ⟨value, (VEnv.addConst_le hadd).constants hvalue⟩
+  have hle := VEnv.addConst_le hadd
+  exact {
+    bool := fun h => by
+      obtain ⟨hfalse, htrue⟩ := H.bool (oldContains ``Bool
+        (by simp [VEnv.reflectedPrimitiveNames]) h)
+      exact ⟨newContains _ hfalse, newContains _ htrue⟩
+    boolFalse := fun h => H.boolFalse (by
+      simpa only [lookup ``Bool.false
+        (by simp [VEnv.reflectedPrimitiveNames])] using h)
+    boolTrue := fun h => H.boolTrue (by
+      simpa only [lookup ``Bool.true
+        (by simp [VEnv.reflectedPrimitiveNames])] using h)
+    nat := fun h => by
+      obtain ⟨hzero, hsucc⟩ := H.nat (oldContains ``Nat
+        (by simp [VEnv.reflectedPrimitiveNames]) h)
+      exact ⟨newContains _ hzero, newContains _ hsucc⟩
+    natZero := fun h => H.natZero (by
+      simpa only [lookup ``Nat.zero
+        (by simp [VEnv.reflectedPrimitiveNames])] using h)
+    natSucc := fun h => H.natSucc (by
+      simpa only [lookup ``Nat.succ
+        (by simp [VEnv.reflectedPrimitiveNames])] using h)
+    natAdd := fun h a b =>
+      (H.natAdd (oldContains ``Nat.add
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natSub := fun h a b =>
+      (H.natSub (oldContains ``Nat.sub
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natMul := fun h a b =>
+      (H.natMul (oldContains ``Nat.mul
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natPow := fun h a b =>
+      (H.natPow (oldContains ``Nat.pow
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natGcd := fun h a b =>
+      (H.natGcd (oldContains ``Nat.gcd
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natMod := fun h a b =>
+      (H.natMod (oldContains ``Nat.mod
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natDiv := fun h a b =>
+      (H.natDiv (oldContains ``Nat.div
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natBEq := fun h a b =>
+      (H.natBEq (oldContains ``Nat.beq
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natBLE := fun h a b =>
+      (H.natBLE (oldContains ``Nat.ble
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natLAnd := fun h a b =>
+      (H.natLAnd (oldContains ``Nat.land
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natLOr := fun h a b =>
+      (H.natLOr (oldContains ``Nat.lor
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natXor := fun h a b =>
+      (H.natXor (oldContains ``Nat.xor
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natShiftLeft := fun h a b =>
+      (H.natShiftLeft (oldContains ``Nat.shiftLeft
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    natShiftRight := fun h a b =>
+      (H.natShiftRight (oldContains ``Nat.shiftRight
+        (by simp [VEnv.reflectedPrimitiveNames]) h) a b).mono hle
+    charOfNat := fun h => H.charOfNat (by
+      simpa only [lookup ``Char.ofNat
+        (by simp [VEnv.reflectedPrimitiveNames])] using h)
+    stringOfList := fun h => by
+      obtain ⟨hconstant, hnil, hcons⟩ := H.stringOfList (by
+        simpa only [lookup ``String.ofList
+          (by simp [VEnv.reflectedPrimitiveNames])] using h)
+      exact ⟨hconstant, hnil.mono hle, hcons.mono hle⟩ }
+
+variable! {env env' : VEnv} (henv : env ≤ env') in
+theorem VEnv.ContainsLits.mono : ∀ {l}, env.ContainsLits l → env'.ContainsLits l
+  | .natVal _, ⟨_, H⟩ => ⟨_, henv.constants H⟩
+  | .strVal _, ⟨⟨_, H1⟩, ⟨_, H2⟩⟩ =>
+    ⟨⟨_, henv.constants H1⟩, ⟨_, henv.constants H2⟩⟩
+
+namespace VEnv.PreludeReady
+
+theorem boolFalse_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``Bool.false = some { uvars := 0, type := VExpr.bool } := by
+  simpa [LiteralPrelude.boolFalse] using H.boolFalse
+
+theorem boolTrue_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``Bool.true = some { uvars := 0, type := VExpr.bool } := by
+  simpa [LiteralPrelude.boolTrue] using H.boolTrue
+
+theorem natZero_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``Nat.zero = some { uvars := 0, type := VExpr.nat } := by
+  simpa [LiteralPrelude.natZero] using H.natZero
+
+theorem natSucc_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``Nat.succ =
+      some { uvars := 0, type := VExpr.forallE .nat .nat } := by
+  simpa [LiteralPrelude.natSucc] using H.natSucc
+
+theorem char_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``Char =
+      some { uvars := 0, type := VExpr.sort (.succ .zero) } := by
+  simpa [LiteralPrelude.char] using H.char
+
+theorem charOfNat_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``Char.ofNat =
+      some { uvars := 0, type := VExpr.forallE .nat .char } := by
+  simpa [LiteralPrelude.charOfNat] using H.charOfNat
+
+theorem stringOfList_lookup {env : VEnv} (H : env.PreludeReady) :
+    env.constants ``String.ofList =
+      some { uvars := 0, type := VExpr.forallE .listChar .string } := by
+  simpa [LiteralPrelude.stringOfList] using H.stringOfList
+
+theorem boolLit_hasType {env : VEnv} (H : env.PreludeReady) (b : Bool) :
+    env.HasType U Γ (.boolLit b) .bool := by
+  cases b
+  · exact .const H.boolFalse_lookup nofun rfl
+  · exact .const H.boolTrue_lookup nofun rfl
+
+theorem natLit_hasType {env : VEnv} (H : env.PreludeReady) (n : Nat) :
+    env.HasType U Γ (.natLit n) .nat := by
+  induction n with
+  | zero => exact .const H.natZero_lookup nofun rfl
+  | succ n ih =>
+    simpa [VExpr.natLit, VExpr.natSucc, VExpr.nat, VExpr.instL, VExpr.inst] using
+      VEnv.HasType.app
+        (VEnv.HasType.const (ls := []) H.natSucc_lookup (by simp) rfl) ih
+
+theorem charOfNat_hasType {env : VEnv} (H : env.PreludeReady) :
+    env.HasType U Γ .charOfNat (.forallE .nat .char) :=
+  .const H.charOfNat_lookup nofun rfl
+
+theorem listCharNil_hasType {env : VEnv} (H : env.PreludeReady) :
+    env.HasType U Γ .listCharNil .listChar := by
+  have hnil : env.constants ``List.nil = some {
+      uvars := 1
+      type := VExpr.forallE (.sort (.succ (.param 0)))
+        (.app (.const ``List [.param 0]) (.bvar 0)) } := by
+    simpa [LiteralPrelude.listNil] using H.listNil
+  exact .app (.const hnil (by simp [VLevel.WF]) rfl)
+    (.const H.char_lookup nofun rfl)
+
+theorem listCharCons_hasType {env : VEnv} (H : env.PreludeReady) :
+    env.HasType U Γ .listCharCons
+      (.forallE .char <| .forallE .listChar .listChar) := by
+  have hcons : env.constants ``List.cons = some {
+      uvars := 1
+      type := VExpr.forallE (.sort (.succ (.param 0))) <|
+        .forallE (.bvar 0) <|
+          .forallE (.app (.const ``List [.param 0]) (.bvar 1))
+            (.app (.const ``List [.param 0]) (.bvar 2)) } := by
+    simpa [LiteralPrelude.listCons] using H.listCons
+  exact .app (.const hcons (by simp [VLevel.WF]) rfl)
+    (.const H.char_lookup nofun rfl)
+
+theorem listCharLit_hasType {env : VEnv} (H : env.PreludeReady)
+    (cs : List Char) : env.HasType U Γ (.listCharLit cs) .listChar := by
+  induction cs with
+  | nil => exact H.listCharNil_hasType
+  | cons c cs ih =>
+    exact (H.listCharCons_hasType.app
+      (H.charOfNat_hasType.app (H.natLit_hasType c.toNat))).app ih
+
+theorem trLiteral_hasType {env : VEnv} (H : env.PreludeReady) (l : Literal) :
+    env.HasType U Γ (.trLiteral l) (.literalType l) := by
+  cases l with
+  | natVal n => simpa [VExpr.trLiteral, VExpr.literalType] using H.natLit_hasType n
+  | strVal s =>
+    simpa [VExpr.trLiteral, VExpr.literalType, VExpr.stringOfList, VExpr.string,
+      VExpr.instL, VExpr.inst] using
+      VEnv.HasType.app
+        (VEnv.HasType.const (ls := []) H.stringOfList_lookup (by simp) rfl)
+        (H.listCharLit_hasType s.toList)
+
+/-- Exact readiness, not name occurrence alone, makes a direct literal
+encoding well-formed.  Pattern matching the containment witness ensures the
+literal-facing premise is checked against the exact ready lookup. -/
+theorem trLiteral_wf {env : VEnv} (H : env.PreludeReady) (l : Literal)
+    (hcontains : env.ContainsLits l) :
+    VExpr.WF env U [] (.trLiteral l) := by
+  cases l with
+  | natVal n =>
+    obtain ⟨ci, hci⟩ := hcontains
+    have : ci = LiteralPrelude.natType.toVConstant := by
+      exact (Option.some.inj (H.nat.symm.trans hci)).symm
+    subst ci
+    exact ⟨_, H.trLiteral_hasType (.natVal n)⟩
+  | strVal s =>
+    obtain ⟨⟨charOfNat, hcharOfNat⟩, ⟨stringOfList, hstringOfList⟩⟩ := hcontains
+    have : charOfNat = LiteralPrelude.charOfNat := by
+      exact (Option.some.inj (H.charOfNat.symm.trans hcharOfNat)).symm
+    subst charOfNat
+    have : stringOfList = LiteralPrelude.stringOfList := by
+      exact (Option.some.inj (H.stringOfList.symm.trans hstringOfList)).symm
+    subst stringOfList
+    exact ⟨_, H.trLiteral_hasType (.strVal s)⟩
+
+end VEnv.PreludeReady
+
+@[simp] theorem VExpr.instL_boolFalse : VExpr.boolFalse.instL ls = VExpr.boolFalse := by
+  simp [boolFalse, instL]
+
+@[simp] theorem VExpr.instL_boolTrue : VExpr.boolTrue.instL ls = VExpr.boolTrue := by
+  simp [boolTrue, instL]
+
+@[simp] theorem VExpr.instL_boolLit : (VExpr.boolLit b).instL ls = VExpr.boolLit b := by
+  cases b <;> simp [boolLit]
+
+@[simp] theorem VExpr.liftN_boolLit : (VExpr.boolLit b).liftN n k = VExpr.boolLit b := by
+  cases b <;> rfl
+
+@[simp] theorem VExpr.lift'_boolLit : (VExpr.boolLit b).lift' ρ = VExpr.boolLit b := by
+  cases b <;> rfl
+
+@[simp] theorem VExpr.inst_boolLit : (VExpr.boolLit b).inst e k = VExpr.boolLit b := by
+  cases b <;> rfl
+
+@[simp] theorem VExpr.instL_natZero : VExpr.natZero.instL ls = .natZero := by
+  simp [natZero, instL]
+
+@[simp] theorem VExpr.instL_natSucc : VExpr.natSucc.instL ls = .natSucc := by
+  simp [natSucc, instL]
+
+@[simp] theorem VExpr.instL_natLit : (VExpr.natLit n).instL ls = VExpr.natLit n := by
+  induction n <;> simp [*, natLit, instL]
+
+@[simp] theorem VExpr.liftN_natLit : (VExpr.natLit a).liftN n k = VExpr.natLit a := by
+  induction a <;> simp [natLit, natZero, natSucc, VExpr.liftN, *]
+
+@[simp] theorem VExpr.lift'_natLit : (VExpr.natLit a).lift' ρ = VExpr.natLit a := by
+  induction a <;> simp [natLit, natZero, natSucc, VExpr.lift', *]
+
+@[simp] theorem VExpr.inst_natLit : (VExpr.natLit a).inst e k = VExpr.natLit a := by
+  induction a <;> simp [natLit, natZero, natSucc, VExpr.inst, *]
+
+@[simp] theorem VExpr.liftN_listCharLit :
+    (VExpr.listCharLit cs).liftN n k = VExpr.listCharLit cs := by
+  induction cs <;>
+    simp [listCharLit, listCharNil, listCharCons, char, charOfNat, VExpr.liftN, *]
+
+@[simp] theorem VExpr.lift'_listCharLit :
+    (VExpr.listCharLit cs).lift' ρ = VExpr.listCharLit cs := by
+  induction cs <;>
+    simp [listCharLit, listCharNil, listCharCons, char, charOfNat, VExpr.lift', *]
+
+@[simp] theorem VExpr.inst_listCharLit :
+    (VExpr.listCharLit cs).inst e k = VExpr.listCharLit cs := by
+  induction cs <;>
+    simp [listCharLit, listCharNil, listCharCons, char, charOfNat, VExpr.inst, *]
+
+@[simp] theorem VExpr.instL_listCharLit :
+    (VExpr.listCharLit cs).instL ls = VExpr.listCharLit cs := by
+  induction cs <;>
+    simp [listCharLit, listCharNil, listCharCons, char, charOfNat,
+      VExpr.instL, VLevel.inst, *]
+
+@[simp] theorem VExpr.liftN_trLiteral :
+    (VExpr.trLiteral l).liftN n k = VExpr.trLiteral l := by
+  cases l <;> simp [trLiteral, stringOfList, VExpr.liftN]
+
+@[simp] theorem VExpr.lift'_trLiteral :
+    (VExpr.trLiteral l).lift' ρ = VExpr.trLiteral l := by
+  cases l <;> simp [trLiteral, stringOfList, VExpr.lift']
+
+@[simp] theorem VExpr.inst_trLiteral :
+    (VExpr.trLiteral l).inst e k = VExpr.trLiteral l := by
+  cases l <;> simp [trLiteral, stringOfList, VExpr.inst]
+
+@[simp] theorem VExpr.instL_trLiteral :
+    (VExpr.trLiteral l).instL ls = VExpr.trLiteral l := by
+  cases l <;> simp [trLiteral, stringOfList, VExpr.instL]
+
+theorem VEnv.HasPrimitives.nat_of_charOfNat (wf : Ordered env)
+    (henv : env.HasPrimitives) (H : env.contains ``Char.ofNat) : env.contains ``Nat := by
+  let ⟨_, H⟩ := H
+  have ⟨_, H⟩ := wf.constWF (henv.charOfNat H ▸ H)
+  let ⟨⟨_, H⟩, _⟩ := H.forallE_inv wf
+  let ⟨_, H, _⟩ := H.const_inv (Γ := []) wf (by trivial)
+  exact ⟨_, H⟩
+
+#guard_named_axioms Ix.Theory.Named.VEnv.PreludeReady.mono [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.PreludeReady.addConst [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.PreludeReady.addDefEq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.PreludeReady.trLiteral_wf [propext, Classical.choice, Quot.sound]
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/LocalContext.lean b/Ix/Theory/Named/LocalContext.lean
new file mode 100644
index 000000000..43edc5356
--- /dev/null
+++ b/Ix/Theory/Named/LocalContext.lean
@@ -0,0 +1,150 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.UniqueTyping
+
+open Ix.Theory (VLevel)
+
+/-! # Theory local declarations
+
+The implementation-independent core of a local context.  `VLocalDecl` only
+mentions Theory expressions; the `Lean.FVarId` bookkeeping used by the
+verified Lean-expression translator remains in `Ix.Theory.Named.Verify.VLCtx`.
+-/
+
+namespace Ix.Theory.Named
+open VEnv
+
+inductive VLocalDecl where
+  | vlam (type : VExpr)
+  | vlet (type value : VExpr)
+
+def VLocalDecl.depth : VLocalDecl → Nat
+  | .vlam .. => 1
+  | .vlet .. => 0
+
+def VLocalDecl.value : VLocalDecl → VExpr
+  | .vlam .. => .bvar 0
+  | .vlet _ e => e
+
+def VLocalDecl.type' : VLocalDecl → VExpr
+  | .vlam A
+  | .vlet A _ => A
+
+def VLocalDecl.type : VLocalDecl → VExpr
+  | .vlam A => A.lift
+  | .vlet A _ => A
+
+def VLocalDecl.lift' : VLocalDecl → Lift → VLocalDecl
+  | .vlam A, n => .vlam (A.lift' n)
+  | .vlet A e, n => .vlet (A.lift' n) (e.lift' n)
+
+def VLocalDecl.liftN : VLocalDecl → Nat → Nat → VLocalDecl
+  | .vlam A, n, k => .vlam (A.liftN n k)
+  | .vlet A e, n, k => .vlet (A.liftN n k) (e.liftN n k)
+
+def VLocalDecl.inst : VLocalDecl → VExpr → (k : Nat := 0) → VLocalDecl
+  | .vlam A, e₀, k => .vlam (A.inst e₀ k)
+  | .vlet A e, e₀, k => .vlet (A.inst e₀ k) (e.inst e₀ k)
+
+def VLocalDecl.instL : VLocalDecl → List VLevel → VLocalDecl
+  | .vlam A, ls => .vlam (A.instL ls)
+  | .vlet A e, ls => .vlet (A.instL ls) (e.instL ls)
+
+def VLocalDecl.WF (env : VEnv) (U : Nat) (Γ : List VExpr) : VLocalDecl → Prop
+  | .vlam type => env.IsType U Γ type
+  | .vlet type value => env.HasType U Γ value type
+
+def VLocalDecl.ClosedN : VLocalDecl → (k : Nat := 0) → Prop
+  | .vlam A, k => A.ClosedN k
+  | .vlet A e, k => A.ClosedN k ∧ e.ClosedN k
+
+variable! (env : VEnv) (U : Nat) (Γ : List VExpr) in
+inductive VLocalDecl.IsDefEq : VLocalDecl → VLocalDecl → Prop
+  | vlam : env.IsDefEq U Γ type₁ type₂ (.sort u) →
+      VLocalDecl.IsDefEq (.vlam type₁) (.vlam type₂)
+  | vlet :
+    env.IsDefEq U Γ value₁ value₂ type₁ → env.IsDefEq U Γ type₁ type₂ (.sort u) →
+    VLocalDecl.IsDefEq (.vlet type₁ value₁) (.vlet type₂ value₂)
+
+theorem VLocalDecl.lift'_consN_skipN {d : VLocalDecl} :
+    d.lift' (.consN (.skipN .refl n) k) = d.liftN n k := by
+  cases d <;> simp [VLocalDecl.lift', VLocalDecl.liftN, VExpr.lift'_consN_skipN]
+
+nonrec theorem VLocalDecl.WF.weakN (henv : env.Ordered) (W : Ctx.LiftN n k Γ Γ') :
+    ∀ {d}, WF env U Γ d → WF env U Γ' (d.liftN n k)
+  | .vlam _, H | .vlet .., H => H.weakN henv W
+
+nonrec theorem VLocalDecl.WF.instN (henv : env.Ordered) (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (h₀ : env.HasType U Γ₀ e₀ A₀) : ∀ {d}, WF env U Γ₁ d → WF env U Γ (d.inst e₀ k)
+  | .vlam _, H | .vlet .., H => H.instN henv W h₀
+
+nonrec theorem VLocalDecl.WF.instL {env : VEnv} (hls : ∀ l ∈ ls, l.WF U') :
+    ∀ {d}, WF env ls.length Γ d → WF env U' (Γ.map (·.instL ls)) (d.instL ls)
+  | .vlam _, H | .vlet .., H => H.instL hls
+
+@[simp] theorem VLocalDecl.lift'_depth {d : VLocalDecl} : (d.lift' n).depth = d.depth := by
+  cases d <;> rfl
+
+theorem VLocalDecl.lift'_comp {d : VLocalDecl} :
+    d.lift' (.comp l₁ l₂) = (d.lift' l₁).lift' l₂ := by
+  cases d <;> simp [VLocalDecl.lift', VExpr.lift'_comp]
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U))
+    (W : Ctx.Lift' n Γ Γ') in
+theorem VLocalDecl.weak'_iff :
+    VLocalDecl.WF env U Γ' (d.lift' n) ↔ VLocalDecl.WF env U Γ d :=
+  match d with
+  | .vlam .. => IsType.weak'_iff henv hΓ' W
+  | .vlet .. => HasType.weak'_iff henv hΓ' W
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U))
+    (W : Ctx.LiftN n k Γ Γ') in
+theorem VLocalDecl.weakN_iff :
+    VLocalDecl.WF env U Γ' (d.liftN n k) ↔ VLocalDecl.WF env U Γ d :=
+  match d with
+  | .vlam .. => IsType.weakN_iff henv hΓ' W
+  | .vlet .. => HasType.weakN_iff henv hΓ' W
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (IsType env U)) in
+theorem VLocalDecl.IsDefEq.refl :
+    ∀ {d}, VLocalDecl.WF env U Γ d → VLocalDecl.IsDefEq env U Γ d d
+  | .vlam _, ⟨_, h1⟩ => .vlam h1
+  | .vlet .., h1 => let ⟨_, h2⟩ := h1.isType henv hΓ; .vlet h1 h2
+
+theorem VLocalDecl.IsDefEq.wf :
+    VLocalDecl.IsDefEq env U Γ d₁ d₂ → VLocalDecl.WF env U Γ d₁
+  | .vlam h3 => ⟨_, h3.hasType.1⟩
+  | .vlet h3 _ => h3.hasType.1
+
+theorem VLocalDecl.IsDefEq.mono (henv : env ≤ env') :
+    VLocalDecl.IsDefEq env U Γ d₁ d₂ → VLocalDecl.IsDefEq env' U Γ d₁ d₂
+  | .vlam h => .vlam (h.mono henv)
+  | .vlet h₁ h₂ => .vlet (h₁.mono henv) (h₂.mono henv)
+
+theorem VLocalDecl.IsDefEq.symm :
+    VLocalDecl.IsDefEq env U Γ d₁ d₂ → VLocalDecl.IsDefEq env U Γ d₂ d₁
+  | .vlam h1 => .vlam h1.symm
+  | .vlet h1 h2 => .vlet (h2.defeqDF h1.symm) h2.symm
+
+theorem VLocalDecl.IsDefEq.defeqDFC (henv : Ordered env)
+    (hΓ : IsDefEqCtx env U Γ₀ Γ₁ Γ₂) :
+    VLocalDecl.IsDefEq env U Γ₁ d₁ d₂ → VLocalDecl.IsDefEq env U Γ₂ d₁ d₂
+  | .vlam h1 => .vlam (h1.defeqDFC henv hΓ)
+  | .vlet h1 h2 => .vlet (h1.defeqDFC henv hΓ) (h2.defeqDFC henv hΓ)
+
+#guard_named_axioms Ix.Theory.Named.VLocalDecl.WF.weakN [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VLocalDecl.weakN_iff [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VLocalDecl.IsDefEq.defeqDFC [propext, Quot.sound]
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Meta.lean b/Ix/Theory/Named/Meta.lean
new file mode 100644
index 000000000..eefcfc9b9
--- /dev/null
+++ b/Ix/Theory/Named/Meta.lean
@@ -0,0 +1,120 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Batteries.Lean.Expr
+import Ix.Theory.Named.Std.Control
+import Ix.Theory.Named.Std.ToExpr
+import Ix.Theory.Named.VEnv
+import Ix.Theory.Named.Reference.Inductive.Reduce
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+namespace Meta
+open Lean Meta Elab Term
+
+def expandProj (structName : Name) (idx : Nat) (e : Expr) : MetaM Expr := do
+  let failed {α} : Unit → MetaM α := fun _ => do
+    throwError "invalid projection{indentExpr (mkProj structName idx e)}"
+  let ival ← getConstInfoInduct structName
+  let [ctor] := ival.ctors | failed ()
+  let ctorInfo ← getConstInfoCtor ctor
+  unless idx < ctorInfo.numFields do failed ()
+  let args : Array Term ← (Array.range ctorInfo.numFields).mapM fun _ => do
+    `($(mkIdent (← mkFreshId)):ident)
+  let args' ← args.mapM fun x => `(Lean.Parser.Term.funBinder| $x)
+  let casesOn := mkCIdent (mkCasesOnName structName)
+  TermElabM.run' do
+    let stx ← `($casesOn:ident $(← e.toSyntax) fun $args'* => $(args[idx]!))
+    elabTerm stx (← inferType (.proj structName idx e))
+
+partial def expandExpr (e : Expr) : MetaM Expr :=
+  Meta.transform e
+    (pre := fun
+      | .mdata _ e => return .visit e
+      | .proj s i e => return .continue (← expandProj s i e)
+      | e@(.mvar _) => return .continue (← instantiateMVars e)
+      | _ => return .continue)
+
+variable (ls : List Name) (fvarToIdx : FVarIdMap Nat) in
+partial def ofExpr : Expr → (k :_:= 0) → MetaM VExpr
+  | .bvar i, _ => return .bvar i
+  | .sort u, _ => return .sort (← VLevel.ofLevel ls u)
+  | .const c us, _ => return .const c (← liftM <| us.mapM (VLevel.ofLevel ls))
+  | .app fn arg, k => return .app (← ofExpr fn k) (← ofExpr arg k)
+  | .lam _ ty body _, k => return .lam (← ofExpr ty k) (← ofExpr body (k+1))
+  | .forallE _ ty body _, k => return .forallE (← ofExpr ty k) (← ofExpr body (k+1))
+  | .mdata _ e, k => ofExpr e k
+  | .lit l, k => ofExpr l.toConstructor k
+  | .letE _ _ value body _, k => return (← ofExpr body (k+1)).inst (← ofExpr value k)
+  | e@(.proj ..), _ => throwError "invalid expression {e}"
+  | e@(.mvar ..), _ => throwError "expression contains metavariables {e}"
+  | .fvar e, k => do
+    if let some i := fvarToIdx.get? e then return .bvar (i+k)
+    let lctx ← getLCtx
+    let some e := (do (← lctx.find? e).value?) | throwError "undeclared free var {Expr.fvar e}"
+    ofExpr e
+
+deriving instance ToExpr for VLevel
+deriving instance ToExpr for VExpr
+deriving instance ToExpr for VConstant
+deriving instance ToExpr for VDefEq
+
+def toVExprWrapper (bis : Option (TSyntaxArray ``Parser.Term.funBinder))
+    (x : FVarIdMap Nat → TermElabM α) : TermElabM α := do
+  withLevelNames [] <|
+  elabFunBinders (bis.getD #[]) none fun xs _ =>
+  withAutoBoundImplicit <|
+  x <|
+  xs.foldr (fun fvar (n, m) => (n+1, m.insert fvar.fvarId! n)) (0, ({}:FVarIdMap Nat)) |>.2
+
+def elabForVExpr (e : Expr) : TermElabM Expr := do
+  let e ← levelMVarToParam e
+  if ← logUnassignedUsingErrorInfos (← getMVars e) then throwAbortCommand
+  expandExpr e
+
+def toVExprCore (bis : Option (TSyntaxArray ``Parser.Term.funBinder))
+    (e : Term) : TermElabM (Nat × VExpr) := do
+  toVExprWrapper bis fun map => do
+    let e ← elabForVExpr (← elabTerm e none)
+    let ls := (← getLevelNames).reverse
+    return (ls.length, ← ofExpr ls map e)
+
+syntax "vexpr(" atomic(Parser.Term.funBinder* " ⊢ ")? term ")" : term
+
+elab_rules : term
+  | `(vexpr($[$bis* ⊢]? $e:term)) => return toExpr (← toVExprCore bis e).2
+
+syntax "vconst(" atomic(Parser.Term.funBinder* " ⊢ ")? term ")" : term
+
+elab_rules : term
+  | `(vconst($[$bis* ⊢]? $e:term)) => do
+    let (n, ve) ← toVExprCore bis e
+    return toExpr (⟨n, ve⟩ : VConstant)
+
+syntax "vdefeq(" atomic(Parser.Term.funBinder* " ⊢ ")?
+  atomic(Parser.Term.funBinder* " => ")? term " ≡ " term ")" : term
+
+elab_rules : term
+  | `(vdefeq($[$bis* ⊢]? $[$args* =>]? $e₁:term ≡ $e₂:term)) => do
+    toVExprWrapper bis fun map => do
+      let (e₁, e₂) ← match args with
+        | some args => pure (← `(fun $args* => $e₁), ← `(fun $args* => $e₂))
+        | none => pure (e₁, e₂)
+      let e₁ ← elabTerm e₁ none
+      let ty ← inferType e₁
+      let e₂ ← elabTerm e₂ ty
+      let e₁ ← elabForVExpr e₁
+      let e₂ ← elabForVExpr e₂
+      let ty ← elabForVExpr ty
+      let ls := (← getLevelNames).reverse
+      return toExpr {
+        uvars := ls.length
+        lhs := ← ofExpr ls map e₁
+        rhs := ← ofExpr ls map e₂
+        type := ← ofExpr ls map ty
+      : VDefEq }
diff --git a/Ix/Theory/Named/MutualInductiveFixtures.lean b/Ix/Theory/Named/MutualInductiveFixtures.lean
new file mode 100644
index 000000000..23cfbdb48
--- /dev/null
+++ b/Ix/Theory/Named/MutualInductiveFixtures.lean
@@ -0,0 +1,199 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Inductive
+import Ix.Theory.Named.Meta
+
+/-!
+# Mutual public-generation fixtures
+
+These real kernel declarations pin shared parameters, per-family
+indices/results, constructor order, and cross-family recursive target
+ordinals at the `VInductDecl.CheckedBlock` boundary, then exercise the
+block-wide public generation transaction added by Spec-08C.  The Verify mutual
+fixture supplies semantic preservation, complete kernel metadata comparison,
+and environment replay.
+-/
+
+namespace Ix.Theory.Named.MutualInductiveFixtures
+
+open VInductDecl
+
+universe u
+
+/-! ## Unindexed Tree/TreeList -/
+
+mutual
+
+inductive Tree (α : Type u) : Type u where
+  | leaf : α → Tree α
+  | node : TreeList α → Tree α
+  | branch : (α → TreeList α) → Tree α
+
+inductive TreeList (α : Type u) : Type u where
+  | nil : TreeList α
+  | cons : Tree α → TreeList α → TreeList α
+
+end
+
+def treeType : VInductiveType where
+  name := ``Tree
+  uvars := 1
+  type := vconst(type_of% @Tree).type
+  ctors := [⟨vconst(type_of% @Tree.leaf), ``Tree.leaf⟩,
+    ⟨vconst(type_of% @Tree.node), ``Tree.node⟩,
+    ⟨vconst(type_of% @Tree.branch), ``Tree.branch⟩]
+
+def treeListType : VInductiveType where
+  name := ``TreeList
+  uvars := 1
+  type := vconst(type_of% @TreeList).type
+  ctors := [⟨vconst(type_of% @TreeList.nil), ``TreeList.nil⟩,
+    ⟨vconst(type_of% @TreeList.cons), ``TreeList.cons⟩]
+
+def treeDecl : VInductDecl :=
+  ⟨1, 1, [treeType, treeListType]⟩
+
+def treeChecked : treeDecl.CheckedBlock :=
+  treeDecl.checkedBlock?.get (by decide)
+
+/-- Block-wide generation data for the real unindexed mutual declaration. -/
+def treeGeneration : BlockGenerationChecked treeDecl :=
+  treeDecl.identityBlockGeneration?.get (by decide)
+
+example : treeChecked.params = [.sort (.succ (.param 0))] := rfl
+example : treeChecked.families.values = [treeType, treeListType] := rfl
+example : treeChecked.families.ordinals = [0, 1] := rfl
+example : treeChecked.families.names = [``Tree, ``TreeList] := rfl
+example : treeChecked.families.indices = [[], []] := rfl
+example : treeChecked.families.resultLevels =
+    [.succ (.param 0), .succ (.param 0)] := rfl
+example : treeChecked.families.constructorNames =
+    [[``Tree.leaf, ``Tree.node, ``Tree.branch],
+      [``TreeList.nil, ``TreeList.cons]] := rfl
+example : treeChecked.families.recursiveTargets =
+    [[[], [1], [1]], [[], [0, 1]]] := rfl
+example : treeChecked.names =
+    [``Tree, ``TreeList, ``Tree.leaf, ``Tree.node, ``Tree.branch,
+      ``TreeList.nil, ``TreeList.cons, ``Tree.rec, ``TreeList.rec] := rfl
+
+example : treeGeneration.families.map (·.raw.name) =
+    [``Tree, ``TreeList] := rfl
+example : treeGeneration.motiveTypes.length = 2 := rfl
+example : treeGeneration.minorTypes.length = 5 := rfl
+example : treeGeneration.recursors.map (·.name) =
+    [``Tree.rec, ``TreeList.rec] := rfl
+example : treeGeneration.generatedRules.length = 5 := rfl
+
+example : treeChecked.families.constructors[0][1].recursive[0].fieldIndex = 0 := rfl
+example : treeChecked.families.constructors[0][1].recursive[0].targetType = 1 := rfl
+example : treeChecked.families.constructors[0][2].recursive[0].fieldIndex = 0 := rfl
+example : treeChecked.families.constructors[0][2].recursive[0].binders.length = 1 := rfl
+example : treeChecked.families.constructors[0][2].recursive[0].targetType = 1 := rfl
+example : treeChecked.families.constructors[1][1].recursive[0].targetType = 0 := rfl
+example : treeChecked.families.constructors[1][1].recursive[1].targetType = 1 := rfl
+
+/-! ## Indexed mutual block -/
+
+mutual
+
+inductive IndexedTree (α : Type u) : Nat → Type u where
+  | leaf : α → IndexedTree α .zero
+  | node {n : Nat} : IndexedTreeList α n → IndexedTree α (.succ n)
+
+inductive IndexedTreeList (α : Type u) : Nat → Type u where
+  | nil : IndexedTreeList α .zero
+  | cons {n : Nat} :
+      IndexedTree α n → IndexedTreeList α n → IndexedTreeList α (.succ n)
+
+end
+
+def indexedTreeType : VInductiveType where
+  name := ``IndexedTree
+  uvars := 1
+  type := vconst(type_of% @IndexedTree).type
+  ctors := [⟨vconst(type_of% @IndexedTree.leaf), ``IndexedTree.leaf⟩,
+    ⟨vconst(type_of% @IndexedTree.node), ``IndexedTree.node⟩]
+
+def indexedTreeListType : VInductiveType where
+  name := ``IndexedTreeList
+  uvars := 1
+  type := vconst(type_of% @IndexedTreeList).type
+  ctors := [⟨vconst(type_of% @IndexedTreeList.nil), ``IndexedTreeList.nil⟩,
+    ⟨vconst(type_of% @IndexedTreeList.cons), ``IndexedTreeList.cons⟩]
+
+def indexedTreeDecl : VInductDecl :=
+  ⟨1, 1, [indexedTreeType, indexedTreeListType]⟩
+
+def indexedTreeChecked : indexedTreeDecl.CheckedBlock :=
+  indexedTreeDecl.checkedBlock?.get (by decide)
+
+/-- Block-wide generation data for the real indexed mutual declaration. -/
+def indexedTreeGeneration : BlockGenerationChecked indexedTreeDecl :=
+  indexedTreeDecl.identityBlockGeneration?.get (by decide)
+
+example : indexedTreeChecked.params = [.sort (.succ (.param 0))] := rfl
+example : indexedTreeChecked.families.values =
+    [indexedTreeType, indexedTreeListType] := rfl
+example : indexedTreeChecked.families.ordinals = [0, 1] := rfl
+example : indexedTreeChecked.families.names =
+    [``IndexedTree, ``IndexedTreeList] := rfl
+example : indexedTreeChecked.families.indices =
+    [[.const ``Nat []], [.const ``Nat []]] := rfl
+example : indexedTreeChecked.families.resultLevels =
+    [.succ (.param 0), .succ (.param 0)] := rfl
+example : indexedTreeChecked.families.constructorNames =
+    [[``IndexedTree.leaf, ``IndexedTree.node],
+      [``IndexedTreeList.nil, ``IndexedTreeList.cons]] := rfl
+example : indexedTreeChecked.families.recursiveTargets =
+    [[[], [1]], [[], [0, 1]]] := rfl
+
+example : indexedTreeGeneration.families.map (·.raw.name) =
+    [``IndexedTree, ``IndexedTreeList] := rfl
+example : indexedTreeGeneration.motiveTypes.length = 2 := rfl
+example : indexedTreeGeneration.minorTypes.length = 4 := rfl
+example : indexedTreeGeneration.recursors.map (·.name) =
+    [``IndexedTree.rec, ``IndexedTreeList.rec] := rfl
+example : indexedTreeGeneration.generatedRules.length = 4 := rfl
+
+example : indexedTreeChecked.families.constructors[0][0].resultIndices =
+    [.const ``Nat.zero []] := rfl
+example : indexedTreeChecked.families.constructors[0][1].resultIndices =
+    [.app (.const ``Nat.succ []) (.bvar 1)] := rfl
+example : indexedTreeChecked.families.constructors[1][0].resultIndices =
+    [.const ``Nat.zero []] := rfl
+example : indexedTreeChecked.families.constructors[1][1].resultIndices =
+    [.app (.const ``Nat.succ []) (.bvar 2)] := rfl
+example : indexedTreeChecked.families.constructors[0][1].recursive[0].fieldIndex = 1 := rfl
+example : indexedTreeChecked.families.constructors[0][1].recursive[0].targetType = 1 := rfl
+example : indexedTreeChecked.families.constructors[0][1].recursive[0].indices =
+    [.bvar 0] := rfl
+example : indexedTreeChecked.families.constructors[1][1].recursive[0].fieldIndex = 1 := rfl
+example : indexedTreeChecked.families.constructors[1][1].recursive[0].targetType = 0 := rfl
+example : indexedTreeChecked.families.constructors[1][1].recursive[1].fieldIndex = 2 := rfl
+example : indexedTreeChecked.families.constructors[1][1].recursive[1].targetType = 1 := rfl
+
+/-! ## Public block-wide boundary -/
+
+example : treeDecl.stage3 = true := rfl
+example : indexedTreeDecl.stage3 = true := rfl
+example : VEnv.empty.addInduct treeDecl =
+    VEnv.empty.addInductBlockGeneration treeGeneration := rfl
+example : VEnv.empty.addInduct indexedTreeDecl =
+    VEnv.empty.addInductBlockGeneration indexedTreeGeneration := rfl
+example : (VEnv.empty.addInduct treeDecl).isSome = true := rfl
+example : (VEnv.empty.addInduct indexedTreeDecl).isSome = true := rfl
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.checkedBlock? [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveFixtures.treeChecked [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveFixtures.indexedTreeChecked [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CheckedFamilies.values_eq [propext, Quot.sound]
+
+end Ix.Theory.Named.MutualInductiveFixtures
diff --git a/Ix/Theory/Named/NOTICE b/Ix/Theory/Named/NOTICE
new file mode 100644
index 000000000..d1c829112
--- /dev/null
+++ b/Ix/Theory/Named/NOTICE
@@ -0,0 +1,116 @@
+Named kernel specification and implementation proof support
+Derived from Lean4Lean (digama0/lean4lean) and the Argument Computer
+development line (argumentcomputer/lean4ix), revision
+a4188d7c2979378d85c6bb41fdd96c3a48a71371.
+Original contributors retain their copyrights. Apache License 2.0;
+see LICENSE in this directory. Modified for Ix namespace/import paths
+and shared universe semantics. Only the transitive source dependency
+closure of the existing kernel/compiler verification was retained.
+The standalone checker application, build infrastructure, benchmarks,
+and remaining test suite were not imported.
+
+Original module	Local source	Original SHA-256
+Lean4Lean.Declaration	Ix/Theory/Named/Reference/Declaration.lean	cefbf66e2134bec472aa9fd643122a3052bbbfd12ab04e6dbd85fe21e32fb0fa
+Lean4Lean.Environment	Ix/Theory/Named/Reference/Environment.lean	8de5b7407e225c96ed4116bc46e2e3bad5009b6bfb0cb4f68d4ce2799eff4f11
+Lean4Lean.Environment.Basic	Ix/Theory/Named/Reference/Environment/Basic.lean	cc39f3a7ae819fed332407c01239dc604a49c8a5dffb379564aade970ff1bcf9
+Lean4Lean.Expr	Ix/Theory/Named/Reference/Expr.lean	6cb6f0e5df484973fc282bb86968bb51a1c73ec32d726010b1d7b2133229ac81
+Lean4Lean.ForEachExprV	Ix/Theory/Named/Reference/ForEachExprV.lean	260167ef5e882a5bd2482734dd72749b809857dbe99bc2aa32e28c6b4b2fb37e
+Lean4Lean.FuelConfig	Ix/Theory/Named/Reference/FuelConfig.lean	3ab65df013711059ef867c2683a7516b77cea87a526cf47c1772e9c8a529d35a
+Lean4Lean.Inductive.Add	Ix/Theory/Named/Reference/Inductive/Add.lean	17dda89d60cac89cba4fc9a4db8233eee8199ce7aee4de337bcd677d076eceb6
+Lean4Lean.Inductive.EliminationTrace	Ix/Theory/Named/Reference/Inductive/EliminationTrace.lean	d14f7bc2aeb2037701ac12d0217f405b94812fdc441942458656bb543627d095
+Lean4Lean.Inductive.Reduce	Ix/Theory/Named/Reference/Inductive/Reduce.lean	c6daf4dcec4ffc6c27a64e1054500ec025646d6d15c7c2d61c1323e4928dcc17
+Lean4Lean.Inductive.ValidationTrace	Ix/Theory/Named/Reference/Inductive/ValidationTrace.lean	7b4e36920a1286b319237a4db632acfac09e203cb3699835fa7440e31f52bbbd
+Lean4Lean.Instantiate	Ix/Theory/Named/Reference/Instantiate.lean	ae08b31657faf3b54de22688ae287d0bff362c573d6a2dd09f12f417b1975ec2
+Lean4Lean.Level	Ix/Theory/Named/Reference/Level.lean	75932c6c1d406cbbf75e60c56b75e4a9b33f743651f5aa50814c7c369edbed76
+Lean4Lean.List	Ix/Theory/Named/Reference/List.lean	4ddde2232aff649a50a8d1bec44e9495e2387dd3fcc29833d4f9c67c514431a4
+Lean4Lean.LocalContext	Ix/Theory/Named/Reference/LocalContext.lean	5baf7b6b379cbbd3902578c5da9d454558031b52f2af508481bc4647c0d91a1b
+Lean4Lean.Primitive	Ix/Theory/Named/Reference/Primitive.lean	a8407d6fdb55c15225c5535b89a1c647af7b20729adb810b9887372b1a9ea745
+Lean4Lean.PtrEq	Ix/Theory/Named/Reference/PtrEq.lean	395e6b6907e548582d9e40e37f5344d6919e597500608c597048e621f27f0aa2
+Lean4Lean.Quot	Ix/Theory/Named/Reference/Quot.lean	79c51dae8b2ac0e09537aaabfb32075fe4a9d5dd34a1a78d47a88229a74926c5
+Lean4Lean.Std.Basic	Ix/Theory/Named/Std/Basic.lean	885fd60674f7ceec447d20b56f34a2945dccc9d1193041d552162b7220ba6d67
+Lean4Lean.Std.Control	Ix/Theory/Named/Std/Control.lean	71dd61bc6bb315f1590ae79e276ada1c0c5c8eb31e67b0f994ed29f92b05fcc2
+Lean4Lean.Std.HashMap	Ix/Theory/Named/Std/HashMap.lean	67afa618c36314613b553eb95dafbbf7c5cca01b9e7d8749b4c024de966c37db
+Lean4Lean.Std.NodupKeys	Ix/Theory/Named/Std/NodupKeys.lean	b0a5f079a7f034f0c436de4ca120fd07197775cba26c625d2a2e1c8054ef460e
+Lean4Lean.Std.Ord	Ix/Theory/Named/Std/Ord.lean	26380558d7e4fd742274d4f4d9396eb2d10feaa0ad945cfd57c0a37b12a04fa4
+Lean4Lean.Std.PersistentHashMap	Ix/Theory/Named/Std/PersistentHashMap.lean	c619b8962018a8b4fe3afb9fb0ee7c77bb92e75c323fc3f849ed4d8c199a4c59
+Lean4Lean.Std.SMap	Ix/Theory/Named/Std/SMap.lean	574b0996076ccb5814ba381f13f288259fbb821abd33c20f9b891bac6c1e1fb0
+Lean4Lean.Std.ToExpr	Ix/Theory/Named/Std/ToExpr.lean	5068adbd3d6c0b2d33ec84420efd66e8025dad2b6ed7171b7d10d1453db08e82
+Lean4Lean.Std.VariableBang	Ix/Theory/Named/Std/VariableBang.lean	783456566db97120957903fc5beccf549507ed8e1f0fcd76cde4d0175f02a012
+Lean4Lean.Tests.ProjectionExpressibility	Ix/Theory/Named/Fixtures/ProjectionExpressibility.lean	ee30b121ece1f5ea7ca2bb315b8e02557b75b5ef33a9986edb12b7b7dab76de0
+Lean4Lean.Theory.ConstructorValidityFixtures	Ix/Theory/Named/ConstructorValidityFixtures.lean	4743314f7fd0e0323463cc7fd403a68792c5e0dabbdbcaaba9e1289136527cde
+Lean4Lean.Theory.Inductive	Ix/Theory/Named/Inductive.lean	5cf6f5c19b301396b35d141a90b6b0281ae984e0e64c502d657d6dc15fb5dc57
+Lean4Lean.Theory.InductiveFixtures	Ix/Theory/Named/InductiveFixtures.lean	4e663484b880adc47045c4d3760456e3c9192951ff9b0f188eea34eff5adcc55
+Lean4Lean.Theory.Literals	Ix/Theory/Named/Literals.lean	cfb64f593c6e3643d83d479d29129d0e73522327529143ef41fd62e162d6998a
+Lean4Lean.Theory.LocalContext	Ix/Theory/Named/LocalContext.lean	e31fe96e8ec2e2718c65bd2eb8a4b9c01286d54956d1a4a23ef47b83706c7d1f
+Lean4Lean.Theory.Meta	Ix/Theory/Named/Meta.lean	37f47b54a8b855ee7f0c4f2a322fb3c7ad319d1749861c386d9b966142f2c8b7
+Lean4Lean.Theory.MutualInductiveFixtures	Ix/Theory/Named/MutualInductiveFixtures.lean	907e4cc7a7855eec5b32bf22457baf0eb482b15529e56d8eb2f2369eaaf79414
+Lean4Lean.Theory.NestedInductive	Ix/Theory/Named/NestedInductive.lean	c88720c864cd7a4c62d44b116779c7ddb93aacd2b9b51c2fea87e4c1afeddfaf
+Lean4Lean.Theory.NestedInductiveFixtures	Ix/Theory/Named/NestedInductiveFixtures.lean	2b31e2f7691a631007a5a3e4c83227515476c13d812c391e7ab111ceba4b8d99
+Lean4Lean.Theory.Projection	Ix/Theory/Named/Projection.lean	9f5108d2192b951a2b8ee05f102fe03bea5c40563f4f10fa27b74c34853884e6
+Lean4Lean.Theory.Quot	Ix/Theory/Named/Quot.lean	3742bc54150fb1b410d5807cd64355cc169fd6ea809dbb71662dc9d28a64c617
+Lean4Lean.Theory.SingletonParity	Ix/Theory/Named/SingletonParity.lean	018c3ea29f04d2274bd47362ed09d959ab3873abf59f0ad23c79afb03f37eb52
+Lean4Lean.Theory.Typing.Basic	Ix/Theory/Named/Typing/Basic.lean	24827047806ee6ffb9af8ed457143cbb6b0c57326557e0f433339840272114a5
+Lean4Lean.Theory.Typing.Env	Ix/Theory/Named/Typing/Env.lean	72949fadf8565117631d4ce822a2d44ebd671843e52a70a8617f0c9c85411cfa
+Lean4Lean.Theory.Typing.EnvLemmas	Ix/Theory/Named/Typing/EnvLemmas.lean	bd9f777d16b60d6bfa74e5e4e2dbf2423df1c1478c38970144a849078623e80b
+Lean4Lean.Theory.Typing.InductiveCertificate	Ix/Theory/Named/Typing/InductiveCertificate.lean	ef4b4970be4680efda15c6ed921584f30d174a462c2643c6bb60c43d2248d353
+Lean4Lean.Theory.Typing.InductiveLemmas	Ix/Theory/Named/Typing/InductiveLemmas.lean	90bb4f3964705de120018360d7bcf14ab81f05c621fd7c0c0c49539af301fa77
+Lean4Lean.Theory.Typing.InductivePattern	Ix/Theory/Named/Typing/InductivePattern.lean	45480de8808c6311c0635ab0afc7fcdbe0c3534558cb1902f7d97d80886c423a
+Lean4Lean.Theory.Typing.InductivePatternWF	Ix/Theory/Named/Typing/InductivePatternWF.lean	884955ce4111aed9540b7d02ebc2469aa26168a8efa476b2ee1cdd01ee402926
+Lean4Lean.Theory.Typing.Injectivity	Ix/Theory/Named/Typing/Injectivity.lean	e7233bde95305b46aa1d22d3e13e21aea93f7e3f903eeb46865c226ffe0bba88
+Lean4Lean.Theory.Typing.Lemmas	Ix/Theory/Named/Typing/Lemmas.lean	f183e28ec58a52dadba983cb53a55537cb9a497d9e8e4f78d2c2ca4cc9427a38
+Lean4Lean.Theory.Typing.Meta	Ix/Theory/Named/Typing/Meta.lean	16b0fb88d6719cdd1293108ca2520c1ef2c601819ef5562d0aa7c2d007021d9b
+Lean4Lean.Theory.Typing.NestedInductiveLemmas	Ix/Theory/Named/Typing/NestedInductiveLemmas.lean	f1dcef8e876386abfbebc5a36ca751dafaa75257b7c6c9f506c7447c4be9cd49
+Lean4Lean.Theory.Typing.Pattern	Ix/Theory/Named/Typing/Pattern.lean	db05a0847000f4d3e2a69f4b053112bfca31dbc2b11082a804052bb44562f4e3
+Lean4Lean.Theory.Typing.QuotLemmas	Ix/Theory/Named/Typing/QuotLemmas.lean	63abdab93b43679259fc25df480afa1b2086edc8cf52cca5b08b2f36be847309
+Lean4Lean.Theory.Typing.Strong	Ix/Theory/Named/Typing/Strong.lean	266fbcb98287ad2f53c0c7ed11960aaa620471b71d4289def448ec259019d46a
+Lean4Lean.Theory.Typing.UniqueTyping	Ix/Theory/Named/Typing/UniqueTyping.lean	c297cd16f1ec43d6ea4fba930ddd490555cf212d59389f39765beb986dde5a3f
+Lean4Lean.Theory.VDecl	Ix/Theory/Named/VDecl.lean	94f3032a2aa1e9e71056b1373fb456b242ede7405c88abe593e7f8432f760a66
+Lean4Lean.Theory.VEnv	Ix/Theory/Named/VEnv.lean	16c9bb411f7482d5c08585a278b8ad8209eb8deb023bcb77f7bad675825a83a9
+Lean4Lean.Theory.VExpr	Ix/Theory/Named/VExpr.lean	469c797a6eaee8883060470e0830dbe56b4b64f7ca91d9ae63304e288849ac8c
+Lean4Lean.Theory.VLevel	Ix/Theory/Named/VLevel.lean	a570dff7d2065ca64acd1bb920628ec332b4e39f18a2dc423cbf3a7bd469ba58
+Lean4Lean.TypeChecker	Ix/Theory/Named/Reference/TypeChecker.lean	40f99258932cfa5f2c99a2c2b5f7b59b467c10348cd238b70453f95e61dd7383
+Lean4Lean.Verify.Axioms	Ix/Theory/Named/Verify/Axioms.lean	4c890728353a1df1b754b09bec3635b75bbfade362aff83a35005b2f316f5863
+Lean4Lean.Verify.Environment.Basic	Ix/Theory/Named/Verify/Environment/Basic.lean	161d0abd5c8f4a8a8a09db2ab3bdcd988171aba2c7dcb4a997bd6a8cb32a89ae
+Lean4Lean.Verify.Environment.ConstructorValidation	Ix/Theory/Named/Verify/Environment/ConstructorValidation.lean	2ce3772020b93feed5e88a0a27d3dcdcb32801b0aca24c7c1e5fb694d9cf382e
+Lean4Lean.Verify.Environment.ConstructorValidityMatrix	Ix/Theory/Named/Verify/Environment/ConstructorValidityMatrix.lean	4245035c98958b93c3daefa2efd78f1f0c9779d5bd2a5633db0c2f60958b88b7
+Lean4Lean.Verify.Environment.Elimination	Ix/Theory/Named/Verify/Environment/Elimination.lean	89365c4a39346bcd7b1f94b7f568a272e4e02b64ff1b897df38f598079890011
+Lean4Lean.Verify.Environment.EliminationFixturesCommon	Ix/Theory/Named/Verify/Environment/EliminationFixturesCommon.lean	1a2dbd72b2538f673c5080abd023c639bee0c200f9d2fd832158f312f726e8b9
+Lean4Lean.Verify.Environment.EliminationFixturesEdges	Ix/Theory/Named/Verify/Environment/EliminationFixturesEdges.lean	86aaa7338723cdc0005d3646b68c77099ad8e1c113ac283b9d6048783bda4910
+Lean4Lean.Verify.Environment.EliminationFixturesEq	Ix/Theory/Named/Verify/Environment/EliminationFixturesEq.lean	371f2bd76c849048b8c27b741af65214e6345374e09c1658e00eceef0bd5e9d4
+Lean4Lean.Verify.Environment.EliminationFixturesEqNat	Ix/Theory/Named/Verify/Environment/EliminationFixturesEqNat.lean	08d2a0352b9a7652ee0c3296b8e6de36e3f3d16b44c77fa962855b355412479a
+Lean4Lean.Verify.Environment.EliminationFixturesNat	Ix/Theory/Named/Verify/Environment/EliminationFixturesNat.lean	5fc23bf4dacc65a476fa6416fbf548c75b563574aad7d1c670d28df5a27ce541
+Lean4Lean.Verify.Environment.EliminationFixturesOrAnd	Ix/Theory/Named/Verify/Environment/EliminationFixturesOrAnd.lean	993466ee37f03b2f7494116d58dca184614f32308b851d0bceb275ddd4c3a79f
+Lean4Lean.Verify.Environment.EliminationFixturesSmall	Ix/Theory/Named/Verify/Environment/EliminationFixturesSmall.lean	65d5114cba03dbc1e25b5ec644f35d72ac27dc370a376a37536ffb8c9d4e1409
+Lean4Lean.Verify.Environment.IndexedVecCandidate	Ix/Theory/Named/Verify/Environment/IndexedVecCandidate.lean	ba5fc7e4d21f85c1fbd091bdcdecc51c7c252a00329c6e4ce41cf703cfbfb280
+Lean4Lean.Verify.Environment.IndexedVecConsReplay	Ix/Theory/Named/Verify/Environment/IndexedVecConsReplay.lean	5fc8c9d63d58a208f0318894f9ba77d87cff021f2dc413575da4e8e5ae42d738
+Lean4Lean.Verify.Environment.IndexedVecConstructors	Ix/Theory/Named/Verify/Environment/IndexedVecConstructors.lean	effb4340d8f020607ef34f0bb0195ee5e4217f15385e0c690b354c1c2aa23b04
+Lean4Lean.Verify.Environment.IndexedVecOuterReplay	Ix/Theory/Named/Verify/Environment/IndexedVecOuterReplay.lean	b15ebd574638b1f728439045f06b85421402dabfcc1df1e92fda97198d7de7e8
+Lean4Lean.Verify.Environment.IndexedVecSemanticReplay	Ix/Theory/Named/Verify/Environment/IndexedVecSemanticReplay.lean	d2793f18d3052acac81951e18e01d5a5a20c3569cae1d831e3064c251bcf05c9
+Lean4Lean.Verify.Environment.InductiveFixtures	Ix/Theory/Named/Verify/Environment/InductiveFixtures.lean	5da7e485923a6e5d9db14361844d48c9628f22b7088072d861f9d24e01acd934
+Lean4Lean.Verify.Environment.Lemmas	Ix/Theory/Named/Verify/Environment/Lemmas.lean	fe1c3fcec718f780e29af9051b62a906b3f6aa53502ac8740d01f8477ab49576
+Lean4Lean.Verify.Environment.MutualInductiveFixtures	Ix/Theory/Named/Verify/Environment/MutualInductiveFixtures.lean	cab86779e590746367fb013f95ecb48f0a3f86b06a56ccf1ac43ae7fec78514d
+Lean4Lean.Verify.Environment.NestedReplay	Ix/Theory/Named/Verify/Environment/NestedReplay.lean	c76e7291e064a68f64b3d545de4c887fd8321950d514b485832dce76108bfa28
+Lean4Lean.Verify.Environment.NestedRepresentation	Ix/Theory/Named/Verify/Environment/NestedRepresentation.lean	7e5cd82cf41d35a6844d2cbc1f5af67ab5ccad33f81e199984e4017348487b2d
+Lean4Lean.Verify.Environment.NestedTransformation	Ix/Theory/Named/Verify/Environment/NestedTransformation.lean	fd1aefd95d4374e0ae87cff11b10c468b7743c822f0f4cbb1a4f3923baee0b0f
+Lean4Lean.Verify.Environment.Normalization	Ix/Theory/Named/Verify/Environment/Normalization.lean	a9df5c28f597dc88f0cc496a1ad8a2c189ef82fddd194007e2bda7de15c27cdc
+Lean4Lean.Verify.Environment.NormalizationMatrix	Ix/Theory/Named/Verify/Environment/NormalizationMatrix.lean	0495afd91d4770ec0dc998431828b370c65b4cc1b894994c06b4a50525b44342
+Lean4Lean.Verify.Environment.SingletonParityMatrix	Ix/Theory/Named/Verify/Environment/SingletonParityMatrix.lean	abc03daf11487f774a89f18506995d3e1f45e817f99dcc361219da73dd586322
+Lean4Lean.Verify.Environment.SingletonParityReplay	Ix/Theory/Named/Verify/Environment/SingletonParityReplay.lean	19cf222cf463ad9882c7c2ce278150678310b00141fa712684cb68061d1761c2
+Lean4Lean.Verify.Expr	Ix/Theory/Named/Verify/Expr.lean	520da96e974f708a15b738479cea37bdc3458adaca6523975f69b15f7bf52cd4
+Lean4Lean.Verify.Level	Ix/Theory/Named/Verify/Level.lean	66f0ffcb59ae63498e8c6fb9cee87fa4003c67f1628fb87ec7661714975a4e02
+Lean4Lean.Verify.LevelStd	Ix/Theory/Named/Verify/LevelStd.lean	8aada81455e9c6a88eba0dcce86e30daf34ec9215e26ae4dfc9f396a49b8f57c
+Lean4Lean.Verify.LocalContext	Ix/Theory/Named/Verify/LocalContext.lean	91718812c4d727d27f8723e039b5e7d490e03a7d8bb4163ffed26ee1df030fe8
+Lean4Lean.Verify.Name	Ix/Theory/Named/Verify/Name.lean	8a3ae08cc776deba9354b28010327470f241e4c924c335dff142b3f8ec326c78
+Lean4Lean.Verify.NameGenerator	Ix/Theory/Named/Verify/NameGenerator.lean	3d7305876fcfc487c625aaee8c737a4bdb1a80b62f70a4fc3cfeaf3cf39219af
+Lean4Lean.Verify.NormLt	Ix/Theory/Named/Verify/NormLt.lean	970149d18191ecbd889136507e6dd68ea43b833b6170ab825b69a90b4561e2f5
+Lean4Lean.Verify.QSort	Ix/Theory/Named/Verify/QSort.lean	79cbf8f96fb223526690c12333a095aa87ecf7d889b4ba2abacd328609550b9a
+Lean4Lean.Verify.TypeChecker	Ix/Theory/Named/Verify/TypeChecker.lean	0a8441fa3354c7002b2b4b7491f04eaac94bd137d7eaaf8a1859bae0af6f58be
+Lean4Lean.Verify.TypeChecker.Basic	Ix/Theory/Named/Verify/TypeChecker/Basic.lean	a9cc58cb6b86a6f84b30f41f520f3b9f26a30bdd56885107efc6f3e03b3df8dc
+Lean4Lean.Verify.TypeChecker.InferType	Ix/Theory/Named/Verify/TypeChecker/InferType.lean	ddc9fa7ec80b958169d6515a92a723dbe6042ca4b3cdd7d6cfcc6fb859b1f90f
+Lean4Lean.Verify.TypeChecker.IsDefEq	Ix/Theory/Named/Verify/TypeChecker/IsDefEq.lean	3b9d09d09029eec24514e9905dd00c7435ba103717e506a46939818a80a39c9b
+Lean4Lean.Verify.TypeChecker.Reduce	Ix/Theory/Named/Verify/TypeChecker/Reduce.lean	ddc6abecc09ad21769b83b857d11bbecd3859be58debab62360fa9d9a5ec31cf
+Lean4Lean.Verify.TypeChecker.WHNF	Ix/Theory/Named/Verify/TypeChecker/WHNF.lean	745637e76413130151c0fb21401a3ee10cbb420aa8c9de4203afff147c2bd9cd
+Lean4Lean.Verify.Typing.ConditionallyTyped	Ix/Theory/Named/Verify/Typing/ConditionallyTyped.lean	2df5d00a10e4497b631a4d2a90b93cf811ab13cbfb735234a5815963928c3255
+Lean4Lean.Verify.Typing.Expr	Ix/Theory/Named/Verify/Typing/Expr.lean	2f9cb98009b6dcd0d45ec4b967e22756f4af1a32a4d45949ad5b4152b8e416c5
+Lean4Lean.Verify.Typing.Lemmas	Ix/Theory/Named/Verify/Typing/Lemmas.lean	ac1a2960dc945d5d9b5b998b438da6dd7ad6160b08a646f3e2c0b56cede54669
+Lean4Lean.Verify.VLCtx	Ix/Theory/Named/Verify/VLCtx.lean	f99f9fb85d79b2f9acd201323cc493f737285c34c064fc2bc68680c595878aa3
diff --git a/Ix/Theory/Named/NestedInductive.lean b/Ix/Theory/Named/NestedInductive.lean
new file mode 100644
index 000000000..2b469231a
--- /dev/null
+++ b/Ix/Theory/Named/NestedInductive.lean
@@ -0,0 +1,534 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Inductive
+
+open Ix.Theory (VLevel)
+
+/-!
+# Nested-inductive flattening (Spec-09B)
+
+The Theory mirror of the kernel's `ElimNestedInductive` transformation,
+following the committed Spec-09A design
+(`Ix.Theory.Named/Verify/Environment/NestedRepresentation.lean`): the stored
+payload of a nested declaration is the source `VInductDecl`, and nested
+support flows through an additive artifact coupling
+
+1. the flattened mutual block, an ordinary `VInductDecl` handled by the
+   existing arbitrary-block analyzer, and
+2. one auxiliary specification per auxiliary family — the Theory analog of
+   the kernel's `aux2nested` map.
+
+`nestedElimination?` computes both from the source declaration plus the
+caller-supplied metadata of the previously declared inductives that are
+nested into (`NestedTargetBlock`).  Keeping the target metadata an explicit
+input keeps this analyzer environment-free, exactly like `checked?`;
+`NestedTargetBlock.WF` separately ties the supplied copy to a Theory
+environment.
+
+The transformation mirrors the kernel phase for phase:
+
+- An application `I Ds is` is a nested occurrence when `I` is a family of a
+  supplied target block, the spine covers at least `I`'s parameters, and
+  the parametric arguments `Ds` mention a family of the growing flattened
+  block.  Parametric arguments that also mention a constructor-local binder
+  reject the declaration (the kernel's "parameters cannot contain local
+  variables"), and matched occurrences are rewritten without descending
+  into the emitted replacement, exactly like `Expr.replace`.
+- One auxiliary family is created per family of `I`'s block, in `all`
+  order, with `I`'s family and constructor types level-instantiated at the
+  occurrence's levels and parameter-instantiated at `Ds`; auxiliary
+  constructor bodies are queued and flattened by the same loop until the
+  block is stable.
+- Auxiliary names are canonical: `(`_nested` ++ familyName).appendIndexAfter i`
+  with a global counter, matching the kernel's choice whenever the ambient
+  environment contains no colliding `_nested.*` constant.  The Spec-09A
+  collision probe shows the choice is erased from all final artifacts, and
+  in-block collisions are rejected downstream by `blockNamesOK` exactly
+  where the kernel's `checkName` rejects its own collisions.
+
+Acceptance (`nestedStage3`) is flattening success plus generation
+readiness of the flattened block through the unchanged Spec-08 machinery.
+No generated recursor, rule, or environment replay is claimed at this
+checkpoint; the restoration substitution over generation artifacts is
+Spec-09C's obligation.
+-/
+
+namespace Ix.Theory.Named
+
+deriving instance DecidableEq for VConstant
+deriving instance DecidableEq for VDefEq
+deriving instance DecidableEq for VConstVal
+deriving instance DecidableEq for VInductiveType
+deriving instance DecidableEq for VInductDecl
+
+/-- Does `e` mention, through a loose bvar, one of the `k` binders directly
+below its root?  `d` counts binders passed inside `e` itself. -/
+def VExpr.hasLooseBelow (k : Nat) : VExpr → (d : Nat := 0) → Bool
+  | .bvar i, d => d ≤ i && i - d < k
+  | .sort _, _ | .const .., _ => false
+  | .app e1 e2, d => e1.hasLooseBelow k d || e2.hasLooseBelow k d
+  | .lam e1 e2, d | .forallE e1 e2, d =>
+      e1.hasLooseBelow k d || e2.hasLooseBelow k (d+1)
+
+/-- Lower every loose bvar of `e` by `n`.  Total; meaningful only when no
+loose bvar lies below `n`, which callers establish with `hasLooseBelow`. -/
+def VExpr.lowerN (n : Nat) : VExpr → (d : Nat := 0) → VExpr
+  | .bvar i, d => if i < d then .bvar i else .bvar (i - n)
+  | .sort l, _ => .sort l
+  | .const c ls, _ => .const c ls
+  | .app e1 e2, d => .app (e1.lowerN n d) (e2.lowerN n d)
+  | .lam e1 e2, d => .lam (e1.lowerN n d) (e2.lowerN n (d+1))
+  | .forallE e1 e2, d => .forallE (e1.lowerN n d) (e2.lowerN n (d+1))
+
+namespace VInductDecl
+
+/-- Simultaneous outermost-first parameter substitution: the first list
+element replaces the outermost of the `args.length` innermost loose bvars.
+The same shape as `instantiateRev` on the implementation side. -/
+def instRevParams : VExpr → List VExpr → VExpr
+  | C, [] => C
+  | C, e :: es => instRevParams (C.inst e es.length) es
+
+/-- Substitute the leading `np`-binder telescope of `ty` simultaneously at
+`args` (outermost parameter first), mirroring the kernel's
+`instantiateForallParams`.  Fails when `ty` exposes fewer than `np`
+binders. -/
+def instTelescope (np : Nat) (ty : VExpr) (args : List VExpr) :
+    Option VExpr := do
+  guard (args.length == np)
+  guard ((VExpr.telN np ty).length == np)
+  return instRevParams (VExpr.dropN np ty) args
+
+/-- One previously declared mutual block that nested occurrences may point
+into.  `families` is the complete block in `all` order, in that block's own
+universe parameters; a copy is supplied so the analyzer stays
+environment-free, and `NestedTargetBlock.WF` ties the copy to an
+environment. -/
+structure NestedTargetBlock where
+  nparams : Nat
+  families : List VInductiveType
+
+/-- The supplied target copy agrees with the environment's stored
+constants. -/
+structure NestedTargetBlock.WF (env : VEnv) (block : NestedTargetBlock) :
+    Prop where
+  families : ∀ f ∈ block.families,
+    env.constants f.name = some f.toVConstVal.toVConstant
+  ctors : ∀ f ∈ block.families, ∀ c ∈ f.ctors,
+    env.constants c.name = some c.toVConstant
+
+def NestedTargetsWF (env : VEnv) (targets : List NestedTargetBlock) : Prop :=
+  ∀ t ∈ targets, t.WF env
+
+/-- One auxiliary family created by nested elimination: the Theory analog
+of one `aux2nested` binding.  `values` are the parametric arguments `Ds`,
+open over the block parameters (innermost bvar = last parameter), in
+declaration level-world. -/
+structure NestedAuxSpec where
+  aux : Name
+  target : Name
+  levels : List VLevel
+  values : List VExpr
+  deriving DecidableEq
+
+/-- The nested occurrence this auxiliary family abbreviates: `I Ds`. -/
+def NestedAuxSpec.value (spec : NestedAuxSpec) : VExpr :=
+  (VExpr.const spec.target spec.levels).appN spec.values
+
+/-- The flattening result: the flattened mutual block plus one auxiliary
+specification per auxiliary family, in flattened family order.  When the
+source contains no nested occurrence, `flat` is the source itself and
+`specs` is empty. -/
+structure NestedElimination (source : VInductDecl) where
+  flat : VInductDecl
+  specs : List NestedAuxSpec
+
+namespace ElimNested
+
+/-- Growing flattening state.  `types` extends the source families with the
+auxiliary families; `specs` aligns with `types.drop ntypes`. -/
+structure State where
+  types : Array VInductiveType
+  specs : Array NestedAuxSpec
+  nextIdx : Nat := 1
+
+variable (targets : List NestedTargetBlock) (uvars np : Nat)
+
+/-- The target block owning family `c`, ignoring names that are currently
+part of the flattened block itself (the kernel only recognizes previously
+*declared* inductives). -/
+def findTarget? (st : State) (c : Name) : Option NestedTargetBlock :=
+  if st.types.any (·.name == c) then none
+  else targets.find? fun t => t.families.any (·.name == c)
+
+/-- Register the auxiliary families for one first-seen nested occurrence
+`I Ds` and return the auxiliary family name standing for `I` itself.
+`doms` is the discovering constructor's parameter telescope, and `values`
+are the parametric arguments in parameter-world. -/
+def registerAux (st : State) (block : NestedTargetBlock) (I : Name)
+    (ls : List VLevel) (doms values : List VExpr) :
+    Option (Name × State) := do
+  let mut st := st
+  let mut result := none
+  for J in block.families do
+    if J.uvars != ls.length then failure
+    let auxName := (`_nested ++ J.name).appendIndexAfter st.nextIdx
+    let auxType ← instTelescope block.nparams (J.type.instL ls) values
+    let mut auxCtors : List VConstVal := []
+    for c in J.ctors do
+      let ctype ← instTelescope block.nparams (c.type.instL ls) values
+      auxCtors := auxCtors ++
+        [⟨⟨uvars, VExpr.forallN doms ctype⟩, c.name.replacePrefix J.name auxName⟩]
+    let auxFamily : VInductiveType :=
+      { name := auxName, uvars, type := VExpr.forallN doms auxType
+        ctors := auxCtors }
+    st :=
+      { types := st.types.push auxFamily
+        specs := st.specs.push ⟨auxName, J.name, ls, values⟩
+        nextIdx := st.nextIdx + 1 }
+    if J.name == I then result := some auxName
+  match result with
+  | some auxName => return (auxName, st)
+  | none => none
+
+/-- Rewrite one constructor-body subterm at binder depth `k`, mirroring
+`replaceAllNested`: matched occurrences are replaced without descending
+into the replacement; unmatched nodes recurse into their children. -/
+def replace (doms : List VExpr) :
+    VExpr → (k : Nat) → State → Option (VExpr × State)
+  | e@(.app f a), k, st => do
+      match rewrite? e k st with
+      | some result => result
+      | none =>
+          let (f', st) ← replace doms f k st
+          let (a', st) ← replace doms a k st
+          return (.app f' a', st)
+  | e@(.const ..), k, st => (rewrite? e k st).getD (some (e, st))
+  | .lam ty body, k, st => do
+      let (ty', st) ← replace doms ty k st
+      let (body', st) ← replace doms body (k+1) st
+      return (.lam ty' body', st)
+  | .forallE ty body, k, st => do
+      let (ty', st) ← replace doms ty k st
+      let (body', st) ← replace doms body (k+1) st
+      return (.forallE ty' body', st)
+  | e, _, st => some (e, st)
+  where
+  /-- `some (some ..)` rewrites the node, `some none` is a hard rejection,
+  `none` leaves the node to the structural recursion. -/
+  rewrite? (e : VExpr) (k : Nat) (st : State) :
+      Option (Option (VExpr × State)) := do
+    let .const c ls := VExpr.appHead e | none
+    let args := e.appArgs []
+    let block ← findTarget? targets st c
+    guard (block.nparams ≤ args.length)
+    guard (0 < block.nparams)
+    let ds := args.take block.nparams
+    let names := st.types.toList.map (·.name)
+    guard (ds.any (·.hasAnyConst names))
+    -- the kernel's "nested inductive datatypes parameters cannot contain
+    -- local variables" rejection
+    if ds.any (·.hasLooseBelow k) then return none
+    let values := ds.map (·.lowerN k)
+    let key := (VExpr.const c ls).appN values
+    let rest := args.drop block.nparams
+    let recover (auxName : Name) (st : State) : VExpr × State :=
+      ((VExpr.const auxName (VLevel.params uvars)).appN
+        (VExpr.bvarRevRange k np ++ rest), st)
+    match st.specs.find? (·.value == key) with
+    | some spec => return some (recover spec.aux st)
+    | none =>
+        match registerAux uvars st block c ls doms values with
+        | some (auxName, st) => return some (recover auxName st)
+        | none => return none
+
+/-- Flatten every constructor of every block family, including the queued
+auxiliary families, until the block is stable.  `fuel` mirrors the
+kernel's `inductiveFuel` bound on the same loop. -/
+def run (fuel : Nat) (i : Nat) (st : State) : Option State :=
+  match fuel with
+  | 0 => none
+  | fuel+1 =>
+    if h : i < st.types.size then
+      let ty := st.types[i]
+      let step := ty.ctors.foldlM (init := ([], st)) fun (acc, st) c => do
+        let doms := VExpr.telN np c.type
+        guard (doms.length == np)
+        let (body, st) ← replace targets uvars np doms (VExpr.dropN np c.type) 0 st
+        return (acc ++ [{ c with type := VExpr.forallN doms body }], st)
+      match step with
+      | some (ctors, st) =>
+          run fuel (i+1) { st with types := st.types.set! i { ty with ctors } }
+      | none => none
+    else some st
+
+end ElimNested
+
+/-- Flatten one source declaration against the supplied target blocks.
+Returns the flattened block plus the auxiliary specifications; the
+identity result (`flat = source`, no specs) is returned when nothing is
+nested. -/
+def nestedElimination? (targets : List NestedTargetBlock)
+    (source : VInductDecl) (fuel : Nat := 1000) :
+    Option (NestedElimination source) := do
+  let st ← ElimNested.run targets source.uvars source.nparams fuel 0
+    { types := source.types.toArray, specs := #[] }
+  return { flat := { source with types := st.types.toList }
+           specs := st.specs.toList }
+
+/-- The number of auxiliary families, matching the stored
+`InductiveVal.numNested` of an accepted nested declaration. -/
+def NestedElimination.numNested {source : VInductDecl}
+    (elim : NestedElimination source) : Nat :=
+  elim.specs.length
+
+/-- A flattened declaration accepted by the unchanged arbitrary-block
+machinery: the complete Spec-09B validation gate.  Positivity, name, level,
+anatomy, and generation-shape checking of the flattened block reuse the
+Spec-08 analyzers verbatim. -/
+structure NestedBlockChecked (source : VInductDecl) where
+  elim : NestedElimination source
+  generation : BlockGenerationChecked elim.flat
+
+def nestedBlockChecked? (targets : List NestedTargetBlock)
+    (source : VInductDecl) (fuel : Nat := 1000) :
+    Option (NestedBlockChecked source) := do
+  let elim ← nestedElimination? targets source fuel
+  let generation ← elim.flat.identityBlockGeneration?
+  return ⟨elim, generation⟩
+
+/-- Structural acceptance for a nested declaration. -/
+def nestedStage3 (targets : List NestedTargetBlock)
+    (source : VInductDecl) (fuel : Nat := 1000) : Bool :=
+  (nestedBlockChecked? targets source fuel).isSome
+
+/-! ## Restoration (Spec-09C)
+
+The restoration substitution σ maps the flattened block's generation
+artifacts back to the stored metadata surface: auxiliary family constants
+become their nested values, auxiliary constructor constants become the
+target block's constructors applied to the instantiated value's own
+arguments, and auxiliary recursor constants are renamed onto the main
+family's `appendIndexAfter` inventory.  On an application spine headed by
+an auxiliary family or constructor, the first `nparams` spine arguments
+are consumed by the value instantiation, mirroring
+`ElimNestedInductive.Result.restoreNested`; generated artifacts always
+apply auxiliary constants to at least the block parameters (the kernel
+asserts exactly this), so the identity fallback on an under-applied
+auxiliary head is unreachable from real artifacts and merely keeps σ
+total. -/
+
+/-- One σ replacement entry.  `value` is already in the level world of the
+artifact being restored (`instL`-spliced by the caller for recursor-world
+artifacts). -/
+structure RestoreEntry where
+  aux : Name
+  np : Nat
+  value : VExpr
+  deriving DecidableEq
+
+def findRestoreCtor (entries : List RestoreEntry) (c : Name) :
+    Option (RestoreEntry × Name) :=
+  entries.findSome? fun entry =>
+    if entry.aux.isPrefixOf c && c != entry.aux then
+      some (entry, c.replacePrefix entry.aux .anonymous)
+    else none
+
+/-- σ on one expression, bottom-up: a replacement fires at the innermost
+spine node where an auxiliary head has collected exactly its block-parameter
+count, and enclosing applications extend the already-restored value.  On
+generated artifacts — where auxiliary constants are always applied to at
+least the block parameters and never occur inside another auxiliary spine's
+arguments — this coincides with `restoreNested`'s top-down
+replace-without-descending pass.  `recMap` renames auxiliary recursor
+constants and is consulted before the constructor-prefix case, exactly like
+`restoreNested`'s `auxRec` map. -/
+def restoreExpr (entries : List RestoreEntry) (recMap : List (Name × Name)) :
+    VExpr → VExpr
+  | .bvar i => .bvar i
+  | .sort l => .sort l
+  | .lam ty body => .lam (restoreExpr entries recMap ty) (restoreExpr entries recMap body)
+  | .forallE ty body =>
+      .forallE (restoreExpr entries recMap ty) (restoreExpr entries recMap body)
+  | .app f a =>
+      let e := VExpr.app (restoreExpr entries recMap f) (restoreExpr entries recMap a)
+      (restoreSpine e).getD e
+  | e@(.const ..) => (restoreSpine e).getD e
+  where
+  /-- Fire one replacement at a completed spine.  The head constant is
+  still unrestored exactly when no inner node completed its parameter
+  count. -/
+  restoreSpine (e : VExpr) : Option VExpr :=
+    match VExpr.appHead e with
+    | .const c ls =>
+      let args := e.appArgs []
+      match recMap.find? (·.1 == c) with
+      | some (_, newName) =>
+          if args.isEmpty then some (VExpr.const newName ls) else none
+      | none =>
+      match entries.find? (·.aux == c) with
+      | some entry =>
+          if args.length == entry.np then
+            some (instRevParams entry.value args)
+          else none
+      | none =>
+      match findRestoreCtor entries c with
+      | some (entry, suffix) =>
+          if args.length == entry.np then
+            let value := instRevParams entry.value args
+            match VExpr.appHead value with
+            | .const iname ils =>
+                some ((VExpr.const (iname ++ suffix) ils).appN (value.appArgs []))
+            | _ => none
+          else none
+      | none => none
+    | _ => none
+
+namespace NestedBlockChecked
+
+variable {source : VInductDecl}
+
+/-- The main family name owning the restored recursor inventory. -/
+def mainName (_nested : NestedBlockChecked source) : Name :=
+  match source.types with
+  | ty :: _ => ty.name
+  | [] => .anonymous
+
+/-- Auxiliary recursor renaming: the `i`-th auxiliary family's recursor
+becomes `mainName.rec_(i+1)`, matching `mkAuxRecNameMap`. -/
+def recMap (nested : NestedBlockChecked source) : List (Name × Name) :=
+  nested.elim.specs.mapIdx fun i spec =>
+    (.str spec.aux "rec", ((.str nested.mainName "rec" : Name)).appendIndexAfter (i + 1))
+
+/-- σ entries in declaration level-world (constructor-type restorations). -/
+def declEntries (nested : NestedBlockChecked source) : List RestoreEntry :=
+  nested.elim.specs.map fun spec =>
+    ⟨spec.aux, source.nparams, spec.value⟩
+
+/-- σ entries spliced into recursor level-world by the elimination
+offset. -/
+def recEntries (nested : NestedBlockChecked source) : List RestoreEntry :=
+  nested.elim.specs.map fun spec =>
+    ⟨spec.aux, source.nparams,
+      spec.value.instL (VLevel.params' source.uvars
+        (nested.generation.recUvars - source.uvars))⟩
+
+/-- σ on a recursor-world artifact. -/
+def restoreRec (nested : NestedBlockChecked source) (e : VExpr) : VExpr :=
+  restoreExpr nested.recEntries nested.recMap e
+
+/-- The restored recursor inventory: the flattened block's recursors with
+auxiliary names renamed and every type restored.  Source-family recursors
+keep their `.str name "rec"` names. -/
+def recursors (nested : NestedBlockChecked source) : List VConstVal :=
+  nested.generation.recursors.map fun r =>
+    ⟨⟨r.uvars, nested.restoreRec r.type⟩,
+      ((nested.recMap.find? (·.1 == r.name)).map (·.2)).getD r.name⟩
+
+/-- The restored rule inventory, in the flattened block's globally ordered
+rule order. -/
+def generatedRules (nested : NestedBlockChecked source) : List VDefEq :=
+  nested.generation.generatedRules.map fun df =>
+    { df with
+        lhs := nested.restoreRec df.lhs
+        rhs := nested.restoreRec df.rhs
+        type := nested.restoreRec df.type }
+
+end NestedBlockChecked
+
+end VInductDecl
+
+/-- The nested transaction: the four-phase shape of
+`addInductBlockGeneration` with the *source* families and constructors as
+the stored payload and the *restored* recursors and rules as the generated
+artifacts.  No auxiliary constant enters the environment. -/
+def VEnv.addInductNested {source : VInductDecl} (env : VEnv)
+    (nested : source.NestedBlockChecked) : Option VEnv := do
+  let env ← source.blockTypeConstants.foldlM
+    (fun env type => env.addConst type.name type.toVConstant) env
+  let env ← source.blockConstructorConstants.foldlM
+    (fun env constructor => env.addConst constructor.name constructor.toVConstant) env
+  let env ← nested.recursors.foldlM
+    (fun env recursor => env.addConst recursor.name recursor.toVConstant) env
+  return nested.generatedRules.foldl VEnv.addDefEq env
+
+namespace VInductDecl
+
+/-- Chained constant well-formedness along an `addConst` fold: each
+constant is well formed in the environment already holding every earlier
+one. -/
+def NestedConstsWF (env : VEnv) : List VConstVal → Prop
+  | [] => True
+  | c :: cs => c.toVConstant.WF env ∧
+      ∀ env', env.addConst c.name c.toVConstant = some env' →
+        NestedConstsWF env' cs
+
+/-- Chained rule well-formedness along an `addDefEq` fold. -/
+def NestedRulesWF (env : VEnv) : List VDefEq → Prop
+  | [] => True
+  | df :: dfs => df.WF env ∧ NestedRulesWF (env.addDefEq df) dfs
+
+/-- Semantic input to nested preservation: the four transaction phases are
+well formed at their exact insertion environments.  The phase environments
+are determined by the deterministic constant folds, so each later field
+takes the earlier folds as hypotheses; a fixture discharges them by
+computation.  Inhabiting this package from the flattened block's staged
+semantic certificate is the σ-transport route recorded by the Spec-09A
+design note; fixtures may equally inhabit it from direct checker
+executions on the restored artifacts. -/
+structure NestedBlockChecked.WF {source : VInductDecl}
+    (nested : NestedBlockChecked source) (env : VEnv) : Prop where
+  types : NestedConstsWF env source.blockTypeConstants
+  ctors : ∀ {typeEnv},
+    source.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) env =
+        some typeEnv →
+    NestedConstsWF typeEnv source.blockConstructorConstants
+  recs : ∀ {typeEnv ctorEnv},
+    source.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) env =
+        some typeEnv →
+    source.blockConstructorConstants.foldlM
+      (fun env constructor => env.addConst constructor.name constructor.toVConstant)
+      typeEnv = some ctorEnv →
+    NestedConstsWF ctorEnv nested.recursors
+  rules : ∀ {typeEnv ctorEnv recEnv},
+    source.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) env =
+        some typeEnv →
+    source.blockConstructorConstants.foldlM
+      (fun env constructor => env.addConst constructor.name constructor.toVConstant)
+      typeEnv = some ctorEnv →
+    nested.recursors.foldlM
+      (fun env recursor => env.addConst recursor.name recursor.toVConstant)
+      ctorEnv = some recEnv →
+    NestedRulesWF recEnv nested.generatedRules
+
+end VInductDecl
+
+/-- Exact phase boundaries of a successful nested transaction. -/
+structure VEnv.AddInductNestedTrace {source : VInductDecl}
+    (env env' : VEnv) (nested : source.NestedBlockChecked) where
+  typeEnv : VEnv
+  ctorEnv : VEnv
+  recEnv : VEnv
+  addTypes :
+    source.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) env =
+        some typeEnv
+  addCtors :
+    source.blockConstructorConstants.foldlM
+      (fun env constructor => env.addConst constructor.name constructor.toVConstant)
+      typeEnv = some ctorEnv
+  addRecs :
+    nested.recursors.foldlM
+      (fun env recursor => env.addConst recursor.name recursor.toVConstant)
+      ctorEnv = some recEnv
+  addRules :
+    nested.generatedRules.foldl VEnv.addDefEq recEnv = env'
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/NestedInductiveFixtures.lean b/Ix/Theory/Named/NestedInductiveFixtures.lean
new file mode 100644
index 000000000..8ca84b912
--- /dev/null
+++ b/Ix/Theory/Named/NestedInductiveFixtures.lean
@@ -0,0 +1,329 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.NestedInductive
+
+/-!
+# Nested flattening fixtures (Spec-09B)
+
+Executable pins for `nestedElimination?` on the two ladder fixtures — a
+universe-polymorphic rose tree through `List` and a nested indexed family
+through a `PVec`-style vector — plus the nearest structural rejections.
+Every family, constructor, auxiliary specification, and acceptance bit is
+compared against a hand-written expected descriptor.  The kernel
+differential for the same shapes lives in
+`Ix.Theory.Named/Verify/Environment/NestedTransformation.lean`.
+-/
+
+namespace Ix.Theory.Named.NestedInductiveFixtures
+
+open VInductDecl
+
+/-! ## Target blocks
+
+Hand-written copies of the nested-into metadata, in each block's own
+universe parameters; the Verify differential checks the same shapes
+against Lean's stored metadata. -/
+
+/-- `List` as a nested target: one family, one parameter. -/
+def listTarget : NestedTargetBlock where
+  nparams := 1
+  families :=
+    [{ name := `List
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors :=
+         [⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.app (.const `List [.param 0]) (.bvar 0))⟩, `List.nil⟩,
+          ⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.forallE (.bvar 0)
+               (.forallE (.app (.const `List [.param 0]) (.bvar 1))
+                 (.app (.const `List [.param 0]) (.bvar 2))))⟩, `List.cons⟩] }]
+
+/-- A `PVec`-style indexed vector as a nested target: one parameter, one
+`Nat` index, indices spelled with `Nat.zero`/`Nat.succ`. -/
+def pvecTarget : NestedTargetBlock where
+  nparams := 1
+  families :=
+    [{ name := `PVec
+       uvars := 0
+       type := .forallE (.sort (.succ .zero))
+         (.forallE (.const `Nat []) (.sort (.succ .zero)))
+       ctors :=
+         [⟨⟨0, .forallE (.sort (.succ .zero))
+             (.app (.app (.const `PVec []) (.bvar 0)) (.const `Nat.zero []))⟩,
+           `PVec.nil⟩,
+          ⟨⟨0, .forallE (.sort (.succ .zero))
+             (.forallE (.bvar 0)
+               (.forallE (.const `Nat [])
+                 (.forallE (.app (.app (.const `PVec []) (.bvar 2)) (.bvar 0))
+                   (.app (.app (.const `PVec []) (.bvar 3))
+                     (.app (.const `Nat.succ []) (.bvar 1))))))⟩,
+           `PVec.cons⟩] }]
+
+/-! ## Rose tree through `List` -/
+
+def roseAux : Lean.Name := (`_nested ++ `List).appendIndexAfter 1
+
+/-- `inductive Rose (α : Type u) | node : α → List (Rose α) → Rose α` -/
+def roseSource : VInductDecl where
+  uvars := 1
+  nparams := 1
+  types :=
+    [{ name := `Rose
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors :=
+         [⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.forallE (.bvar 0)
+               (.forallE (.app (.const `List [.param 0])
+                   (.app (.const `Rose [.param 0]) (.bvar 1)))
+                 (.app (.const `Rose [.param 0]) (.bvar 2))))⟩, `Rose.node⟩] }]
+
+/-- The expected flattened rose block: the rewritten source family plus one
+auxiliary family, exactly the shapes pinned against the kernel by the
+Spec-09A probes. -/
+def roseFlat : VInductDecl where
+  uvars := 1
+  nparams := 1
+  types :=
+    [{ name := `Rose
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors :=
+         [⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.forallE (.bvar 0)
+               (.forallE (.app (.const roseAux [.param 0]) (.bvar 1))
+                 (.app (.const `Rose [.param 0]) (.bvar 2))))⟩, `Rose.node⟩] },
+     { name := roseAux
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors :=
+         [⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.app (.const roseAux [.param 0]) (.bvar 0))⟩, roseAux ++ `nil⟩,
+          ⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.forallE (.app (.const `Rose [.param 0]) (.bvar 0))
+               (.forallE (.app (.const roseAux [.param 0]) (.bvar 1))
+                 (.app (.const roseAux [.param 0]) (.bvar 2))))⟩,
+           roseAux ++ `cons⟩] }]
+
+/-- The expected auxiliary specification: `List (Rose α)`, open over the
+block parameter. -/
+def roseSpec : NestedAuxSpec where
+  aux := roseAux
+  target := `List
+  levels := [.param 0]
+  values := [.app (.const `Rose [.param 0]) (.bvar 0)]
+
+def roseElim? : Option (NestedElimination roseSource) :=
+  nestedElimination? [listTarget] roseSource
+
+#guard roseElim?.isSome
+#guard (roseElim?.map fun elim => elim.flat == roseFlat).getD false
+#guard (roseElim?.map fun elim => elim.specs == [roseSpec]).getD false
+#guard (roseElim?.map (·.numNested)).getD 0 == 1
+#guard roseFlat.stage3
+#guard nestedStage3 [listTarget] roseSource
+-- acceptance behavior of the raw analyzers on the source is unchanged
+#guard !roseSource.stage3
+
+/-! ## Nested indexed family through `PVec` -/
+
+def nvAux : Lean.Name := (`_nested ++ `PVec).appendIndexAfter 1
+
+/-- `inductive NV | node : (n : Nat) → PVec NV n → NV` -/
+def nvSource : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := `NV
+       uvars := 0
+       type := .sort (.succ .zero)
+       ctors :=
+         [⟨⟨0, .forallE (.const `Nat [])
+             (.forallE (.app (.app (.const `PVec []) (.const `NV []))
+                 (.bvar 0))
+               (.const `NV []))⟩, `NV.node⟩] }]
+
+/-- The expected flattened indexed block: the auxiliary family keeps the
+`Nat` index, its `nil` instantiates the index at `Nat.zero`, and its
+`cons` retains sibling recursion through `NV` plus the successor index. -/
+def nvFlat : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := `NV
+       uvars := 0
+       type := .sort (.succ .zero)
+       ctors :=
+         [⟨⟨0, .forallE (.const `Nat [])
+             (.forallE (.app (.const nvAux []) (.bvar 0))
+               (.const `NV []))⟩, `NV.node⟩] },
+     { name := nvAux
+       uvars := 0
+       type := .forallE (.const `Nat []) (.sort (.succ .zero))
+       ctors :=
+         [⟨⟨0, .app (.const nvAux []) (.const `Nat.zero [])⟩, nvAux ++ `nil⟩,
+          ⟨⟨0, .forallE (.const `NV [])
+             (.forallE (.const `Nat [])
+               (.forallE (.app (.const nvAux []) (.bvar 0))
+                 (.app (.const nvAux [])
+                   (.app (.const `Nat.succ []) (.bvar 1)))))⟩,
+           nvAux ++ `cons⟩] }]
+
+/-- The expected specification: the closed partial application `PVec NV`;
+the index argument stays behind on each occurrence. -/
+def nvSpec : NestedAuxSpec where
+  aux := nvAux
+  target := `PVec
+  levels := []
+  values := [.const `NV []]
+
+def nvElim? : Option (NestedElimination nvSource) :=
+  nestedElimination? [pvecTarget] nvSource
+
+#guard nvElim?.isSome
+#guard (nvElim?.map fun elim => elim.flat == nvFlat).getD false
+#guard (nvElim?.map fun elim => elim.specs == [nvSpec]).getD false
+#guard nvFlat.stage3
+#guard nestedStage3 [pvecTarget] nvSource
+#guard !nvSource.stage3
+
+/-! ## Nearest structural rejections -/
+
+/-- A parametric argument mentioning a constructor-local binder:
+`node : (n : Nat) → List (Loose n) → Loose` — the kernel's "parameters
+cannot contain local variables" class.  Flattening itself rejects. -/
+def looseSource : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := `Loose
+       uvars := 0
+       type := .sort (.succ .zero)
+       ctors :=
+         [⟨⟨0, .forallE (.const `Nat [])
+             (.forallE (.app (.const `List [.zero])
+                 (.app (.const `Loose []) (.bvar 0)))
+               (.const `Loose []))⟩, `Loose.node⟩] }]
+
+#guard (nestedElimination? [listTarget] looseSource).isNone
+#guard !nestedStage3 [listTarget] looseSource
+
+/-- A well-scoped but ill-shaped parametric argument:
+`node : Bad → List (Bad Nat.zero) → Bad` flattens, but the auxiliary
+constructor then mentions `Bad` applied off the parameter spine, which the
+unchanged block analyzer rejects. -/
+def badAppSource : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := `Bad
+       uvars := 0
+       type := .sort (.succ .zero)
+       ctors :=
+         [⟨⟨0, .forallE (.const `Bad [])
+             (.forallE (.app (.const `List [.zero])
+                 (.app (.const `Bad []) (.const `Nat.zero [])))
+               (.const `Bad []))⟩, `Bad.node⟩] }]
+
+#guard (nestedElimination? [listTarget] badAppSource).isSome
+#guard !nestedStage3 [listTarget] badAppSource
+
+-- Without the `List` target metadata the occurrence is not recognized,
+-- the flattened block is the source itself, and the unchanged analyzer
+-- rejects the under-a-foreign-head family mention.
+#guard (nestedElimination? [] roseSource).isSome
+#guard ((nestedElimination? [] roseSource).map
+  fun elim => elim.flat == roseSource && elim.specs == []).getD false
+#guard !nestedStage3 [] roseSource
+
+/-- A source family occupying the first canonical auxiliary name collides
+with the created auxiliary family; `blockNamesOK` rejects the flattened
+block exactly where the kernel's `checkName` rejects its own duplicate
+insertion. -/
+def collisionSource : VInductDecl where
+  uvars := 1
+  nparams := 1
+  types :=
+    [{ name := `Rose
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors :=
+         [⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.forallE (.bvar 0)
+               (.forallE (.app (.const `List [.param 0])
+                   (.app (.const `Rose [.param 0]) (.bvar 1)))
+                 (.app (.const `Rose [.param 0]) (.bvar 2))))⟩, `Rose.node⟩] },
+     { name := (`_nested ++ `List).appendIndexAfter 1
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors := [] }]
+
+#guard (nestedElimination? [listTarget] collisionSource).isSome
+#guard !nestedStage3 [listTarget] collisionSource
+
+/-! ## Restoration pins (Spec-09C)
+
+Structural pins for the restored generation artifacts; the exact
+comparison against Lean's stored recursor types and rule RHSs lives in the
+Verify differential. -/
+
+def roseNested? : Option (NestedBlockChecked roseSource) :=
+  nestedBlockChecked? [listTarget] roseSource
+
+def nvNested? : Option (NestedBlockChecked nvSource) :=
+  nestedBlockChecked? [pvecTarget] nvSource
+
+#guard roseNested?.isSome
+#guard nvNested?.isSome
+
+-- the restored recursor inventory: one per source family plus one per
+-- auxiliary family, on the main family's `appendIndexAfter` names
+#guard (roseNested?.map fun n => n.recursors.map (·.name)).getD [] ==
+  [`Rose.rec, ((.str `Rose "rec" : Lean.Name)).appendIndexAfter 1]
+#guard (nvNested?.map fun n => n.recursors.map (·.name)).getD [] ==
+  [`NV.rec, ((.str `NV "rec" : Lean.Name)).appendIndexAfter 1]
+
+def roseAuxConsts : List Lean.Name :=
+  [roseAux, roseAux ++ `nil, roseAux ++ `cons, .str roseAux "rec"]
+
+def nvAuxConsts : List Lean.Name :=
+  [nvAux, nvAux ++ `nil, nvAux ++ `cons, .str nvAux "rec"]
+
+/-- No auxiliary constant survives restoration in any recursor type or
+rule component. -/
+def restoredClean {source : VInductDecl} (auxConsts : List Lean.Name)
+    (nested : NestedBlockChecked source) : Bool :=
+  nested.recursors.all (fun r => !VExpr.hasAnyConst auxConsts r.type) &&
+    nested.generatedRules.all fun df =>
+      !VExpr.hasAnyConst auxConsts df.lhs &&
+        !VExpr.hasAnyConst auxConsts df.rhs &&
+        !VExpr.hasAnyConst auxConsts df.type
+
+#guard (roseNested?.map (restoredClean roseAuxConsts)).getD false
+#guard (nvNested?.map (restoredClean nvAuxConsts)).getD false
+
+-- the globally flattened rule inventory: one node rule plus the two
+-- restored `List`/`PVec` rules
+#guard (roseNested?.map fun n => n.generatedRules.length).getD 0 == 3
+#guard (nvNested?.map fun n => n.generatedRules.length).getD 0 == 3
+
+-- the nested transaction inserts the source payload and the restored
+-- recursors, and no auxiliary constant
+def roseNestedEnv? : Option VEnv := do
+  VEnv.empty.addInductNested (← roseNested?)
+
+#guard roseNestedEnv?.isSome
+#guard (roseNestedEnv?.map fun env =>
+  (env.constants `Rose).isSome && (env.constants `Rose.node).isSome &&
+    (env.constants `Rose.rec).isSome &&
+    (env.constants (((.str `Rose "rec" : Lean.Name)).appendIndexAfter 1)).isSome &&
+    (env.constants roseAux).isNone &&
+    (env.constants (roseAux ++ `cons)).isNone &&
+    (env.constants (.str roseAux "rec")).isNone).getD false
+
+end Ix.Theory.Named.NestedInductiveFixtures
diff --git a/Ix/Theory/Named/Projection.lean b/Ix/Theory/Named/Projection.lean
new file mode 100644
index 000000000..b4ed1ed5c
--- /dev/null
+++ b/Ix/Theory/Named/Projection.lean
@@ -0,0 +1,3518 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.InductivePatternWF
+
+open Ix.Theory (VLevel)
+
+/-!
+# Structure projections
+
+This module is the consumer-neutral projection boundary.  A projection is
+not determined by a structure name and field number alone: universe
+instantiations, parameters, the constructor telescope, and the generated
+recursor/iota package all affect its meaning.  `VStructureView` retains that
+data from the same checked artifact used by inductive generation.
+
+Projection terms are encoded with the generated recursor.  Earlier
+projections occur in the motive of a dependent later projection, so one view
+determines both the projected term and its dependent result type.  No
+projection-function name map or unconstrained metadata witness is involved.
+-/
+
+namespace Ix.Theory.Named
+
+open VInductDecl
+
+/-- Instantiate an outermost-first argument list at a fixed offset.
+
+The `k` variables below the substituted telescope remain bound.  Each
+argument is lifted past them before it replaces the then-outermost variable.
+This is the operation needed to specialize constructor parameters while
+retaining the preceding dependent fields. -/
+def VExpr.instRevAt : VExpr → List VExpr → Nat → VExpr
+  | e, [], _ => e
+  | e, a :: as, k => instRevAt (e.inst a (k + as.length)) as k
+
+theorem VExpr.instRevAt_zero (e : VExpr) (args : List VExpr) :
+    e.instRevAt args 0 = e.instRev args := by
+  induction args generalizing e with
+  | nil => rfl
+  | cons arg args ih =>
+      simp only [VExpr.instRevAt, VExpr.instRev]
+      simpa using ih (e := e.inst arg args.length)
+
+private theorem VExpr.instRevAt_closedN (args : List VExpr)
+    {C : VExpr} {k : Nat} (hC : C.ClosedN k) :
+    C.instRevAt args k = C := by
+  induction args generalizing C with
+  | nil => rfl
+  | cons arg args ih =>
+      simp only [VExpr.instRevAt]
+      rw [hC.instN_eq (by omega)]
+      exact ih hC
+
+private theorem VExpr.instRev_forallE_projection
+    (A B : VExpr) (args : List VExpr) :
+    VExpr.instRev (.forallE A B) args =
+      .forallE (VExpr.instRev A args)
+        (VExpr.instRevAt B args 1) := by
+  induction args generalizing A B with
+  | nil => rfl
+  | cons arg args ih =>
+      simp only [VExpr.instRev, VExpr.inst]
+      rw [ih]
+      congr 1
+      simp only [VExpr.instRevAt]
+      rw [show 1 + args.length = args.length + 1 by omega]
+
+private theorem VExpr.instRevAt_forallE_projection
+    (A B : VExpr) (args : List VExpr) (k : Nat) :
+    VExpr.instRevAt (.forallE A B) args k =
+      .forallE (VExpr.instRevAt A args k)
+        (VExpr.instRevAt B args (k + 1)) := by
+  induction args generalizing A B with
+  | nil => rfl
+  | cons arg args ih =>
+      simp only [VExpr.instRevAt, VExpr.inst]
+      rw [ih]
+      congr 1
+      rw [show k + args.length + 1 = k + 1 + args.length by omega]
+
+private theorem VExpr.instRevAt_forallN_projection
+    (As : List VExpr) (B : VExpr) (args : List VExpr) (k : Nat) :
+    VExpr.instRevAt (VExpr.forallN As B) args k =
+      VExpr.forallN
+        (As.zipIdx k |>.map fun x => x.1.instRevAt args x.2)
+        (B.instRevAt args (k + As.length)) := by
+  induction As generalizing k with
+  | nil => rfl
+  | cons A As ih =>
+      simp only [VExpr.forallN, VExpr.instRevAt_forallE_projection,
+        List.zipIdx, List.map_cons, List.length_cons]
+      rw [ih]
+      rw [show k + 1 + As.length = k + (As.length + 1) by omega]
+
+theorem VExpr.instRev_forallN_projection
+    (As : List VExpr) (B : VExpr) (args : List VExpr) :
+    VExpr.instRev (VExpr.forallN As B) args =
+      VExpr.forallN
+        (As.zipIdx.map fun x => x.1.instRevAt args x.2)
+        (B.instRevAt args As.length) := by
+  cases As with
+  | nil => simp [VExpr.forallN, VExpr.instRevAt_zero]
+  | cons A As =>
+      simp only [VExpr.forallN, VExpr.instRev_forallE_projection,
+        List.zipIdx, List.map_cons, List.length_cons]
+      rw [VExpr.instRevAt_forallN_projection]
+      rw [VExpr.instRevAt_zero]
+      congr 2
+      rw [Nat.add_comm]
+
+/-- Consume a syntactic prefix of dependent `forall` binders, instantiating
+them outermost-first. -/
+def VExpr.consumeForalls? : VExpr → List VExpr → Option VExpr
+  | e, [] => some e
+  | .forallE _ body, arg :: args => consumeForalls? (body.inst arg) args
+  | _, _ :: _ => none
+
+theorem VExpr.consumeForalls?_append (e : VExpr)
+    (left right : List VExpr) :
+    e.consumeForalls? (left ++ right) =
+      (e.consumeForalls? left).bind fun cursor =>
+        cursor.consumeForalls? right := by
+  induction left generalizing e with
+  | nil => rfl
+  | cons arg left ih =>
+      cases e <;> simp [VExpr.consumeForalls?, ih]
+
+theorem VExpr.instTelN_getElem? (arg : VExpr) (fields : List VExpr)
+    (k i : Nat) :
+    (VExpr.instTelN arg fields k)[i]? =
+      fields[i]?.map fun field => field.inst arg (k + i) := by
+  induction fields generalizing k i with
+  | nil => simp [VExpr.instTelN]
+  | cons field fields ih =>
+      cases i with
+      | zero => simp [VExpr.instTelN]
+      | succ i =>
+          simp only [VExpr.instTelN, List.getElem?_cons_succ]
+          simpa only [Nat.add_assoc, Nat.add_comm,
+            Nat.add_left_comm] using ih (k + 1) i
+
+/-- Consuming `args` from a telescope exposes the next original binder with
+exactly those arguments substituted. -/
+theorem VExpr.consumeForalls?_forallN_domain
+    (fields : List VExpr) (result : VExpr) (args : List VExpr)
+    (hlen : args.length < fields.length) :
+    ∃ field body,
+      fields[args.length]? = some field ∧
+      VExpr.consumeForalls? (VExpr.forallN fields result) args =
+        some (.forallE (field.instRevAt args 0) body) := by
+  induction args generalizing fields result with
+  | nil =>
+      cases fields with
+      | nil => simp at hlen
+      | cons field fields =>
+          exact ⟨field, VExpr.forallN fields result, rfl, rfl⟩
+  | cons arg args ih =>
+      cases fields with
+      | nil => simp at hlen
+      | cons field fields =>
+          have hlen' : args.length <
+              (VExpr.instTelN arg fields 0).length := by
+            simpa [VExpr.instTelN_length] using hlen
+          obtain ⟨field', body, hfield', hconsume⟩ :=
+            ih (VExpr.instTelN arg fields 0)
+              (result.inst arg fields.length) hlen'
+          rw [VExpr.instTelN_getElem?] at hfield'
+          obtain ⟨original, horiginal, rfl⟩ := Option.map_eq_some_iff.1 hfield'
+          refine ⟨original, body, by simpa using horiginal, ?_⟩
+          simp only [VExpr.forallN, VExpr.consumeForalls?,
+            VExpr.instN_forallN]
+          simp only [Nat.zero_add]
+          simpa only [VExpr.instRevAt, Nat.zero_add] using hconsume
+
+@[simp] theorem VExpr.instL_instRevAt (e : VExpr) (as : List VExpr)
+    (k : Nat) :
+    (e.instRevAt as k).instL ls =
+      (e.instL ls).instRevAt (as.map (VExpr.instL ls)) k := by
+  induction as generalizing e with
+  | nil => rfl
+  | cons a as ih =>
+      simp only [VExpr.instRevAt, List.map_cons]
+      simpa only [VExpr.instL_instN, List.length_map] using
+        ih (e := e.inst a (k + as.length))
+
+private theorem VExpr.instL_lamN_projection (ls : List VLevel) :
+    ∀ (As : List VExpr) (e : VExpr),
+      (VExpr.lamN As e).instL ls =
+        VExpr.lamN (As.map (VExpr.instL ls)) (e.instL ls)
+  | [], _ => rfl
+  | _ :: As, e => by
+      simp only [VExpr.lamN, VExpr.instL, List.map_cons]
+      rw [VExpr.instL_lamN_projection ls As e]
+
+private theorem VExpr.liftN_lamN_projection (n : Nat) :
+    ∀ (As : List VExpr) (e : VExpr) (k : Nat),
+      (VExpr.lamN As e).liftN n k =
+        VExpr.lamN (VExpr.liftTelN n As k)
+          (e.liftN n (k + As.length))
+  | [], _, _ => rfl
+  | _ :: As, e, k => by
+      simp only [VExpr.lamN, VExpr.liftN, VExpr.liftTelN,
+        List.length_cons]
+      rw [VExpr.liftN_lamN_projection n As e (k + 1)]
+      rw [show k + 1 + As.length = k + (As.length + 1) by omega]
+
+private theorem VExpr.instN_lamN_projection (a : VExpr) :
+    ∀ (As : List VExpr) (e : VExpr) (k : Nat),
+      (VExpr.lamN As e).inst a k =
+        VExpr.lamN (VExpr.instTelN a As k)
+          (e.inst a (k + As.length))
+  | [], _, _ => rfl
+  | _ :: As, e, k => by
+      simp only [VExpr.lamN, VExpr.inst, VExpr.instTelN,
+        List.length_cons]
+      rw [VExpr.instN_lamN_projection a As e (k + 1)]
+      rw [show k + 1 + As.length = k + (As.length + 1) by omega]
+
+private theorem VExpr.liftN_lift_projection (e : VExpr) (n k : Nat) :
+    e.lift.liftN n (k + 1) = (e.liftN n k).lift :=
+  (VExpr.lift_liftN' e k).symm
+
+private theorem VExpr.liftN_liftAt_projection
+    (e : VExpr) (n k i : Nat) :
+    (e.liftN 1 i).liftN n (k + 1 + i) =
+      (e.liftN n (k + i)).liftN 1 i := by
+  symm
+  simpa only [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+    VExpr.liftN_liftN_comm e 1 n i (k + i) (by omega)
+
+private theorem VExpr.liftTelN_liftAt_projection (As : List VExpr)
+    (n k i : Nat) :
+    VExpr.liftTelN n (VExpr.liftTelN 1 As i) (k + 1 + i) =
+      VExpr.liftTelN 1 (VExpr.liftTelN n As (k + i)) i := by
+  induction As generalizing i with
+  | nil => rfl
+  | cons A As ih =>
+      simp only [VExpr.liftTelN]
+      rw [VExpr.liftN_liftAt_projection A n k i]
+      congr 1
+      simpa only [Nat.add_assoc] using ih (i + 1)
+
+private theorem VExpr.liftTelN_lift_projection (As : List VExpr)
+    (n k : Nat) :
+    VExpr.liftTelN n (VExpr.liftTelN 1 As 0) (k + 1) =
+      VExpr.liftTelN 1 (VExpr.liftTelN n As k) 0 := by
+  simpa using VExpr.liftTelN_liftAt_projection As n k 0
+
+private theorem VExpr.instN_liftAt_projection
+    (e a : VExpr) (k i : Nat) :
+    (e.liftN 1 i).inst a (k + 1 + i) =
+      (e.inst a (k + i)).liftN 1 i := by
+  symm
+  simpa only [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+    VExpr.liftN_instN_lo 1 e a (k + i) i (by omega)
+
+private theorem VExpr.instTelN_liftAt_projection (As : List VExpr)
+    (a : VExpr) (k i : Nat) :
+    VExpr.instTelN a (VExpr.liftTelN 1 As i) (k + 1 + i) =
+      VExpr.liftTelN 1 (VExpr.instTelN a As (k + i)) i := by
+  induction As generalizing i with
+  | nil => rfl
+  | cons A As ih =>
+      simp only [VExpr.liftTelN, VExpr.instTelN]
+      rw [VExpr.instN_liftAt_projection A a k i]
+      congr 1
+      simpa only [Nat.add_assoc] using ih (i + 1)
+
+private theorem VExpr.instTelN_lift_projection (As : List VExpr)
+    (a : VExpr) (k : Nat) :
+    VExpr.instTelN a (VExpr.liftTelN 1 As 0) (k + 1) =
+      VExpr.liftTelN 1 (VExpr.instTelN a As k) 0 := by
+  simpa using VExpr.instTelN_liftAt_projection As a k 0
+
+private theorem VExpr.instN_instRevAt_lift_projection
+    (e : VExpr) (args : List VExpr) (a : VExpr) (i : Nat) :
+    ((e.liftN 1 i).instRevAt args (i + 1)).inst a i =
+      e.instRevAt args i := by
+  induction args generalizing e with
+  | nil => exact VExpr.inst_liftN1 e a i
+  | cons arg args ih =>
+      simp only [VExpr.instRevAt]
+      rw [show i + 1 + args.length = args.length + 1 + i by omega,
+        VExpr.instN_liftAt_projection e arg args.length i]
+      simpa only [Nat.add_comm] using
+        ih (e := e.inst arg (args.length + i))
+
+private theorem VExpr.instTelN_instRevAt_lift_projection
+    (fields : List VExpr) (args : List VExpr) (a : VExpr)
+    (start : Nat) :
+    VExpr.instTelN a
+        ((VExpr.liftTelN 1 fields start).zipIdx (start + 1) |>.map
+          fun x => x.1.instRevAt args x.2)
+        start =
+      (fields.zipIdx start |>.map
+        fun x => x.1.instRevAt args x.2) := by
+  induction fields generalizing start with
+  | nil => rfl
+  | cons field fields ih =>
+      simp only [VExpr.liftTelN, List.zipIdx, List.map_cons,
+        VExpr.instTelN]
+      rw [VExpr.instN_instRevAt_lift_projection]
+      congr 1
+      simpa only [Nat.add_assoc] using ih (start + 1)
+
+private theorem VExpr.inst_liftN_top (e a : VExpr) (n : Nat) :
+    (e.liftN (n + 1)).inst a n = e.liftN n := by
+  rw [← VExpr.liftN'_liftN' (e := e) (n1 := n) (n2 := 1)
+    (k1 := 0) (k2 := n) (Nat.zero_le _) (by omega)]
+  exact VExpr.inst_liftN (e.liftN n) a
+
+private theorem VExpr.instRevAt_liftN_len (args : List VExpr)
+    (e : VExpr) (k : Nat) :
+    (e.liftN (k + args.length)).instRevAt args k = e.liftN k := by
+  induction args with
+  | nil => rfl
+  | cons arg args ih =>
+      simp only [List.length_cons, VExpr.instRevAt]
+      rw [show k + (args.length + 1) = (k + args.length) + 1 by omega,
+        VExpr.inst_liftN_top]
+      exact ih
+
+private theorem VExpr.instRevAt_bvar_lt_cons (args : List VExpr)
+    (arg : VExpr) (k i : Nat) (hi : i < k + args.length) :
+    (VExpr.bvar i).instRevAt (arg :: args) k =
+      (VExpr.bvar i).instRevAt args k := by
+  simp only [VExpr.instRevAt]
+  congr 1
+  simp [VExpr.inst, VExpr.instVar, hi]
+
+private theorem VExpr.map_instRevAt_bvarRevRange
+    (args : List VExpr) (k : Nat) :
+    (VExpr.bvarRevRange k args.length).map
+        (fun e => e.instRevAt args k) =
+      args.map (VExpr.liftN k) := by
+  induction args with
+  | nil => rfl
+  | cons arg args ih =>
+      simp only [List.length_cons, VExpr.bvarRevRange,
+        List.map_cons]
+      congr 1
+      · simp only [VExpr.instRevAt]
+        rw [show (VExpr.bvar (k + args.length)).inst arg
+              (k + args.length) = arg.liftN (k + args.length) by
+            simp [VExpr.inst, VExpr.instVar]]
+        exact VExpr.instRevAt_liftN_len args arg k
+      · rw [← ih]
+        apply List.map_congr_left
+        intro e he
+        obtain ⟨i, rfl, _, hi⟩ := VExpr.mem_bvarRevRange he
+        exact VExpr.instRevAt_bvar_lt_cons args arg k i (by omega)
+
+private theorem VExpr.instRevAt_appN_projection
+    (f : VExpr) (es : List VExpr) (args : List VExpr) (k : Nat) :
+    (VExpr.appN f es).instRevAt args k =
+      VExpr.appN (f.instRevAt args k)
+        (es.map fun e => e.instRevAt args k) := by
+  induction args generalizing f es with
+  | nil => simp [VExpr.instRevAt, List.map_id']
+  | cons arg args ih =>
+      simp only [VExpr.instRevAt, VExpr.instN_appN]
+      rw [ih]
+      simp only [List.map_map, Function.comp_def]
+
+private theorem VExpr.map_instRevAt_closedN (args es : List VExpr)
+    (k : Nat) (hclosed : ∀ e ∈ es, e.ClosedN k) :
+    es.map (fun e => e.instRevAt args k) = es := by
+  induction es with
+  | nil => rfl
+  | cons e es ih =>
+      simp only [List.map_cons]
+      rw [VExpr.instRevAt_closedN args (hclosed e (.head _))]
+      congr 1
+      exact ih (fun e he => hclosed e (.tail _ he))
+
+private theorem VExpr.map_instN_closedN (a : VExpr) (es : List VExpr)
+    (k : Nat) (hclosed : ∀ e ∈ es, e.ClosedN k) :
+    es.map (fun e => e.inst a k) = es := by
+  induction es with
+  | nil => rfl
+  | cons e es ih =>
+      simp only [List.map_cons]
+      rw [(hclosed e (.head _)).instN_eq (Nat.le_refl _)]
+      congr 1
+      exact ih (fun e he => hclosed e (.tail _ he))
+
+private theorem VExpr.map_instN_liftN_top
+    (es : List VExpr) (a : VExpr) (n : Nat) :
+    (es.map (VExpr.liftN (n + 1))).map
+        (fun e => e.inst a n) =
+      es.map (VExpr.liftN n) := by
+  rw [List.map_map]
+  apply List.map_congr_left
+  intro e _
+  exact VExpr.inst_liftN_top e a n
+
+private theorem VExpr.projectionMinorBody_shape
+    (constructorName : Name) (levels : List VLevel)
+    (params : List VExpr) (m : Nat) (typeFn : VExpr) :
+    ((VExpr.appN (.bvar m)
+          [VExpr.appN (.const constructorName levels)
+            (VExpr.bvarRevRange (m + 1) params.length ++
+              VExpr.bvarRevRange 0 m)]).instRevAt params (m + 1)).inst
+        typeFn m =
+      .app (typeFn.liftN m)
+        (VExpr.appN (.const constructorName levels)
+          (params.map (VExpr.liftN m) ++
+            VExpr.bvarRevRange 0 m)) := by
+  have hmotiveR : (VExpr.bvar m).instRevAt params (m + 1) =
+      .bvar m := VExpr.instRevAt_closedN params (by
+        exact Nat.lt_succ_self m)
+  have hconstR : (VExpr.const constructorName levels).instRevAt
+      params (m + 1) = .const constructorName levels :=
+    VExpr.instRevAt_closedN params (by trivial)
+  have hfieldsR := VExpr.map_instRevAt_closedN params
+    (VExpr.bvarRevRange 0 m) (m + 1)
+    (bvarRevRange_closedN m 0 (m + 1) (by omega))
+  have hmotiveI : (VExpr.bvar m).inst typeFn m =
+      typeFn.liftN m := by simp [VExpr.inst, VExpr.instVar]
+  have hconstI : (VExpr.const constructorName levels).inst typeFn m =
+      .const constructorName levels := by rfl
+  have hparamsI := VExpr.map_instN_liftN_top params typeFn m
+  have hfieldsI := VExpr.map_instN_closedN typeFn
+    (VExpr.bvarRevRange 0 m) m
+    (bvarRevRange_closedN m 0 m (by omega))
+  rw [VExpr.instRevAt_appN_projection, hmotiveR]
+  simp only [List.map_singleton]
+  rw [VExpr.instRevAt_appN_projection, hconstR, List.map_append,
+    VExpr.map_instRevAt_bvarRevRange, hfieldsR]
+  rw [VExpr.instN_appN, hmotiveI]
+  simp only [List.map_singleton]
+  rw [VExpr.instN_appN, hconstI, List.map_append,
+    hparamsI, hfieldsI]
+  rfl
+
+private theorem VExpr.projectionMajorTail_shape
+    (familyName : Name) (levels : List VLevel)
+    (params : List VExpr) (typeFn : VExpr) :
+    (((VExpr.forallE
+          (VExpr.appN (.const familyName levels)
+            (VExpr.bvarRevRange 2 params.length))
+          (.app (.appN (.bvar 2) []) (.bvar 0))).instRevAt
+        params 2).inst typeFn 1) =
+      VExpr.forallE
+        (VExpr.appN (.const familyName levels)
+          (params.map (VExpr.liftN 1)))
+        (.app (typeFn.liftN 2) (.bvar 0)) := by
+  have hconstR : (VExpr.const familyName levels).instRevAt
+      params 2 = .const familyName levels :=
+    VExpr.instRevAt_closedN params (by trivial)
+  have hbodyR :
+      (VExpr.app (VExpr.appN (.bvar 2) []) (.bvar 0)).instRevAt
+          params 3 =
+        VExpr.app (VExpr.appN (.bvar 2) []) (.bvar 0) :=
+    VExpr.instRevAt_closedN params (by
+      change 2 < 3 ∧ 0 < 3
+      omega)
+  rw [VExpr.instRevAt_forallE_projection,
+    VExpr.instRevAt_appN_projection, hconstR,
+    VExpr.map_instRevAt_bvarRevRange, hbodyR]
+  simp only [VExpr.inst]
+  congr 1
+  · rw [VExpr.instN_appN]
+    have hconstI : (VExpr.const familyName levels).inst typeFn 1 =
+        .const familyName levels := by rfl
+    rw [hconstI, VExpr.map_instN_liftN_top]
+
+theorem VExpr.liftN_instRevAt (e : VExpr) (as : List VExpr)
+    (i k n : Nat) :
+    (e.instRevAt as i).liftN n (k + i) =
+      (e.liftN n (k + i + as.length)).instRevAt
+        (as.map fun a => a.liftN n k) i := by
+  induction as generalizing e with
+  | nil => simp [VExpr.instRevAt]
+  | cons a as ih =>
+      simp only [VExpr.instRevAt, List.map_cons]
+      rw [ih]
+      simp only [List.length_cons, List.length_map]
+      rw [show k + i + as.length = k + (i + as.length) by omega,
+        VExpr.liftN_instN_hi]
+      congr 3 <;> omega
+
+theorem VExpr.instN_instRevAt (e : VExpr) (as : List VExpr)
+    (i k : Nat) (a : VExpr) :
+    (e.instRevAt as i).inst a (k + i) =
+      (e.inst a (k + i + as.length)).instRevAt
+        (as.map fun arg => arg.inst a k) i := by
+  induction as generalizing e with
+  | nil => simp [VExpr.instRevAt]
+  | cons arg as ih =>
+      simp only [VExpr.instRevAt, List.map_cons]
+      rw [ih]
+      simp only [List.length_cons, List.length_map]
+      rw [show k + i + as.length = k + (i + as.length) by omega,
+        VExpr.inst_inst_hi]
+      congr 3 <;> omega
+
+/-- A telescope whose entries have the exact retained sort levels. -/
+inductive VEnv.OnSortTel (env : VEnv) (U : Nat) :
+    List VExpr → List VExpr → List VLevel → Prop where
+  | nil : OnSortTel env U Γ [] []
+  | cons :
+      env.HasType U Γ A (.sort u) →
+      OnSortTel env U (A :: Γ) As us →
+      OnSortTel env U Γ (A :: As) (u :: us)
+
+private theorem onCtx_levelWFProjection {env : VEnv} {U : Nat} :
+    ∀ {Γ : List VExpr}, OnCtx Γ (env.IsType U) →
+      OnCtx Γ fun _ A => A.LevelWF U
+  | [], _ => trivial
+  | _ :: _, ⟨hΓ, ⟨_, hA⟩⟩ =>
+      let hΓ' := onCtx_levelWFProjection hΓ
+      ⟨hΓ', (hA.levelWF hΓ').1⟩
+
+/-- Every retained sort selected from a checked sort telescope is a
+well-formed universe at the ambient universe bound. -/
+theorem VEnv.OnSortTel.sortWF {env : VEnv} {U : Nat}
+    : ∀ {Γ : List VExpr} {As : List VExpr} {us : List VLevel},
+      OnCtx Γ (env.IsType U) → env.OnSortTel U Γ As us →
+      ∀ {i : Nat} {u : VLevel}, us[i]? = some u → u.WF U
+  | _, [], [], _, .nil, _, _, h => by simp at h
+  | _, _ :: _, _ :: _, hΓ, .cons hA hT, 0, _, h => by
+      injection h with h
+      subst h
+      exact (hA.levelWF (onCtx_levelWFProjection hΓ)).2.2
+  | Γ, A :: As, u₀ :: us, hΓ, .cons hA hT, i + 1, u, h => by
+      exact VEnv.OnSortTel.sortWF (env := env) (U := U)
+        (Γ := A :: Γ) (As := As) (us := us)
+        ⟨hΓ, ⟨u₀, hA⟩⟩ hT (by simpa using h)
+
+private theorem VEnv.OnTel.monoProjection {env env' : VEnv}
+    (henv : env ≤ env') (H : env.OnTel U Γ As) : env'.OnTel U Γ As := by
+  induction As generalizing Γ with
+  | nil => trivial
+  | cons _ _ ih =>
+      exact ⟨H.1.mono henv, ih H.2⟩
+
+theorem VEnv.OnSortTel.mono {env env' : VEnv} (henv : env ≤ env')
+    (H : env.OnSortTel U Γ As us) : env'.OnSortTel U Γ As us := by
+  induction H with
+  | nil => exact .nil
+  | cons hA _ ih => exact .cons (hA.mono henv) ih
+
+/-- Forget the retained sort labels, preserving the underlying telescope
+well-formedness judgment. -/
+theorem VEnv.OnSortTel.toOnTel {env : VEnv} :
+    ∀ {U : Nat} {Γ As : List VExpr} {us : List VLevel},
+      env.OnSortTel U Γ As us → env.OnTel U Γ As
+  | _, _, [], [], .nil => trivial
+  | _, _, _ :: _, _ :: _, .cons hA hT =>
+      ⟨⟨_, hA⟩, VEnv.OnSortTel.toOnTel hT⟩
+
+theorem VEnv.OnSortTel.instL {env : VEnv} {U U' : Nat}
+    (hlevels : ∀ level ∈ levels, level.WF U') :
+    ∀ {Γ As us}, env.OnSortTel U Γ As us →
+      env.OnSortTel U' (Γ.map (VExpr.instL levels))
+        (As.map (VExpr.instL levels))
+        (us.map (VLevel.inst levels))
+  | _, [], [], .nil => .nil
+  | _, _ :: _, _ :: _, .cons hA hT =>
+      .cons (hA.instL hlevels) (VEnv.OnSortTel.instL hlevels hT)
+
+theorem VEnv.OnSortTel.weakN {env : VEnv} (henv : env.Ordered)
+    {U n k : Nat} {Γ Γ' : List VExpr} (W : Ctx.LiftN n k Γ Γ') :
+    ∀ {As us}, env.OnSortTel U Γ As us →
+      env.OnSortTel U Γ' (VExpr.liftTelN n As k) us
+  | [], [], .nil => .nil
+  | _ :: _, _ :: _, .cons hA hT =>
+      .cons (hA.weakN henv W)
+        (VEnv.OnSortTel.weakN henv W.succ hT)
+
+private theorem VEnv.OnSortTel.instN {env : VEnv} (henv : env.Ordered)
+    {U : Nat} {Γ₀ : List VExpr} {e₀ A₀ : VExpr}
+    (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    ∀ {As : List VExpr} {us : List VLevel} {k : Nat}
+      {Γ Γ' : List VExpr},
+      Ctx.InstN Γ₀ e₀ A₀ k Γ Γ' →
+      env.OnSortTel U Γ As us →
+      env.OnSortTel U Γ' (VExpr.instTelN e₀ As k) us
+  | [], [], _, _, _, _, .nil => .nil
+  | _ :: _, _ :: _, _, _, _, W, .cons hA hT =>
+      .cons (hA.instN henv W h₀)
+        (VEnv.OnSortTel.instN henv h₀ W.succ hT)
+
+private theorem VExpr.instRevAt_instTelN_cons
+    (fields : List VExpr) (a : VExpr) (as : List VExpr) :
+    ((VExpr.instTelN a fields as.length).zipIdx.map fun (field, i) =>
+        VExpr.instRevAt field as i) =
+      (fields.zipIdx.map fun (field, i) =>
+        VExpr.instRevAt field (a :: as) i) := by
+  suffices ∀ (start k : Nat), k = as.length + start →
+      ((VExpr.instTelN a fields k).zipIdx start |>.map
+          fun (field, i) => VExpr.instRevAt field as i) =
+        (fields.zipIdx start |>.map fun (field, i) =>
+          VExpr.instRevAt field (a :: as) i) by
+    simpa using this 0 as.length (by omega)
+  intro start k hk
+  induction fields generalizing start k with
+  | nil => rfl
+  | cons field fields ih =>
+      simp only [VExpr.instTelN, List.zipIdx, List.map_cons,
+        VExpr.instRevAt]
+      rw [hk]
+      congr 1
+      · congr 2 <;> omega
+      · exact ih (start + 1) (as.length + start + 1) (by omega)
+
+theorem VExpr.instRevAt_map_instL_zipIdx
+    (fields : List VExpr) (levels : List VLevel)
+    (params : List VExpr) (start : Nat := 0) :
+    ((fields.map (VExpr.instL levels)).zipIdx start |>.map
+        fun (field, i) => VExpr.instRevAt field params i) =
+      (fields.zipIdx start |>.map fun (field, i) =>
+        VExpr.instRevAt (field.instL levels) params i) := by
+  induction fields generalizing start with
+  | nil => rfl
+  | cons field fields ih =>
+      simp only [List.map_cons, List.zipIdx]
+      congr 1
+      exact ih (start + 1)
+
+private theorem VEnv.OnSortTel.instRevParams {env : VEnv}
+    (henv : env.Ordered) {U : Nat} :
+    ∀ {Γ params args fields sorts resultLevel},
+      env.SpineWF U Γ (VExpr.forallN params (.sort resultLevel))
+        args (.sort resultLevel) →
+      args.length = params.length →
+      env.OnSortTel U (params.reverse ++ Γ) fields sorts →
+      env.OnSortTel U Γ
+        (fields.zipIdx.map fun (field, i) =>
+          VExpr.instRevAt field args i) sorts
+  | _, [], [], fields, sorts, _, hspine, _, hfields => by
+      simpa [VExpr.instRevAt] using hfields
+  | _, [], _ :: _, _, _, _, _, hlen, _ => by simp at hlen
+  | Γ, param :: params, arg :: args, fields, sorts, resultLevel,
+      .cons harg hrest, hlen, hfields => by
+      have hparams : args.length = params.length := by simpa using hlen
+      have W := Ctx.InstN.consTel (Γ₀ := Γ) (e₀ := arg)
+        (A₀ := param) params (.zero)
+      have hfields' : env.OnSortTel U
+          ((VExpr.instTelN arg params 0).reverse ++ Γ)
+          (VExpr.instTelN arg fields params.length) sorts := by
+        apply VEnv.OnSortTel.instN henv harg W
+        simpa [List.append_assoc] using hfields
+      have hrest' : env.SpineWF U Γ
+          (VExpr.forallN (VExpr.instTelN arg params 0)
+            (.sort resultLevel)) args (.sort resultLevel) := by
+        simpa [VExpr.instN_forallN, VExpr.inst] using hrest
+      have hout := VEnv.OnSortTel.instRevParams henv
+        hrest' (by simpa [VExpr.instTelN_length] using hparams) hfields'
+      rw [← hparams, VExpr.instRevAt_instTelN_cons] at hout
+      exact hout
+
+/-- Extend a well-formed ambient context by a well-formed telescope. -/
+theorem VEnv.OnTel.toOnCtx {env : VEnv} {U : Nat} :
+    ∀ {As Γ}, env.OnTel U Γ As → OnCtx Γ (env.IsType U) →
+      OnCtx (As.reverse ++ Γ) (env.IsType U)
+  | [], _, _, hΓ => by simpa using hΓ
+  | A :: As, Γ, ⟨hA, hAs⟩, hΓ => by
+      simpa [List.append_assoc] using
+        VEnv.OnTel.toOnCtx hAs (Γ := A :: Γ) ⟨hΓ, hA⟩
+
+private theorem VEnv.OnSortTel.closedAt {env : VEnv} {U : Nat}
+    (henv : env.Ordered) :
+    ∀ {As us Γ}, env.OnSortTel U Γ As us → CtxClosed Γ →
+      ∀ {i : Nat} {field : VExpr}, As[i]? = some field →
+        field.ClosedN (Γ.length + i)
+  | _, _, _, .nil, _, i, _, h => by simp at h
+  | _ :: _, _ :: _, Γ, .cons hA hAs, hΓ, 0, _, h => by
+      simp only [List.getElem?_cons_zero] at h
+      cases h
+      simpa using hA.closedN henv hΓ
+  | A :: As, _ :: _, Γ, .cons hA hAs, hΓ, i + 1, field, h => by
+      simp only [List.getElem?_cons_succ] at h
+      have hclosed : A.ClosedN Γ.length := hA.closedN henv hΓ
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using
+        VEnv.OnSortTel.closedAt henv hAs ⟨hΓ, hclosed⟩ h
+
+private theorem VEnv.OnTel.liftTelN_eq {env : VEnv} {U : Nat}
+    (henv : env.Ordered) :
+    ∀ {As Γ}, env.OnTel U Γ As → CtxClosed Γ → ∀ n,
+      VExpr.liftTelN n As Γ.length = As
+  | [], _, _, _, _ => rfl
+  | A :: As, Γ, ⟨hA, hAs⟩, hΓ, n => by
+      obtain ⟨_, hA⟩ := hA
+      have hclosed : A.ClosedN Γ.length := hA.closedN henv hΓ
+      simp only [VExpr.liftTelN, hclosed.liftN_eq (Nat.le_refl _)]
+      simpa using VEnv.OnTel.liftTelN_eq henv hAs ⟨hΓ, hclosed⟩ n
+
+private theorem VEnv.OnSortTel.liftTelN_eq {env : VEnv} {U : Nat}
+    (henv : env.Ordered) :
+    ∀ {As us Γ}, env.OnSortTel U Γ As us → CtxClosed Γ → ∀ n,
+      VExpr.liftTelN n As Γ.length = As
+  | [], [], _, .nil, _, _ => rfl
+  | A :: As, _ :: us, Γ, .cons hA hAs, hΓ, n => by
+      have hclosed : A.ClosedN Γ.length := hA.closedN henv hΓ
+      simp only [VExpr.liftTelN, hclosed.liftN_eq (Nat.le_refl _)]
+      simpa using VEnv.OnSortTel.liftTelN_eq henv hAs ⟨hΓ, hclosed⟩ n
+
+/-- The checked, generated description of a nonrecursive structure.
+
+`generation` supplies the exact family, constructor, recursor, and iota rule
+artifacts.  The shape fields restrict that general one-family artifact to the
+kernel class on which `.proj` is meaningful: no indices, exactly one
+constructor, and no recursive constructor arguments.  `fieldSorts` records
+the motive universe required by each projection; `WF` below ties every entry
+to the corresponding dependent constructor field type. -/
+structure VStructureView where
+  source : VInductDecl
+  generation : source.GenerationChecked
+  constructor : NormalizedCtor
+  constructor_eq : generation.block.ctorPairs = [constructor]
+  raw_indices_eq : generation.block.rawIndices = []
+  checked_indices_eq : generation.block.checked.indices = []
+  recursive_eq : constructor.view.recursive = []
+  fieldSorts : List VLevel
+  fieldSorts_length :
+    fieldSorts.length = (constructor.rawFields source.nparams).length
+
+namespace VStructureView
+
+abbrev name (view : VStructureView) : Name :=
+  view.generation.block.sourceType.name
+
+abbrev constructorName (view : VStructureView) : Name :=
+  view.constructor.raw.name
+
+def recursorName (view : VStructureView) : Name :=
+  .str view.name "rec"
+
+abbrev uvars (view : VStructureView) : Nat := view.source.uvars
+
+abbrev nparams (view : VStructureView) : Nat := view.source.nparams
+
+abbrev familyType (view : VStructureView) : VExpr :=
+  view.generation.block.sourceType.type
+
+def constructorParams (view : VStructureView) : List VExpr :=
+  VExpr.telN view.nparams view.constructor.raw.type
+
+def fields (view : VStructureView) : List VExpr :=
+  view.constructor.rawFields view.nparams
+
+/-- The instantiated structure type `S.{levels} params`. -/
+def structureType (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) : VExpr :=
+  VExpr.appN (.const view.name levels) params
+
+/-- Specialize declaration universes and constructor parameters, retaining
+the preceding field binders of each dependent field. -/
+def specializedFields (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) : List VExpr :=
+  view.fields.zipIdx.map fun (field, i) =>
+    VExpr.instRevAt (field.instL levels) params i
+
+private theorem specializedFieldsAux_liftN
+    (rawFields : List VExpr) (levels : List VLevel)
+    (params : List VExpr) (p start n k : Nat)
+    (hparams : params.length = p)
+    (hclosed : ∀ (j : Nat) (field : VExpr),
+      rawFields[j]? = some field →
+        field.ClosedN (p + start + j)) :
+    (rawFields.zipIdx start |>.map fun (field, i) =>
+      VExpr.instRevAt (field.instL levels)
+        (params.map fun param => param.liftN n k) i) =
+    VExpr.liftTelN n
+      (rawFields.zipIdx start |>.map fun (field, i) =>
+        VExpr.instRevAt (field.instL levels) params i)
+      (k + start) := by
+  induction rawFields generalizing start with
+  | nil => rfl
+  | cons field rawFields ih =>
+      have hfield : (field.instL levels).ClosedN (p + start + 0) :=
+        VExpr.ClosedN.instL (ls := levels) (hclosed 0 field (by rfl))
+      have hrawLift :
+          (field.instL levels).liftN n
+              (k + start + params.length) = field.instL levels :=
+        hfield.liftN_eq (by rw [hparams]; omega)
+      have hhead := VExpr.liftN_instRevAt
+        (field.instL levels) params start k n
+      rw [hrawLift] at hhead
+      have htail := ih (start := start + 1)
+        (fun j tailField htailField => by
+          have := hclosed (j + 1) tailField (by simpa using htailField)
+          simpa only [Nat.add_assoc, Nat.add_left_comm,
+            Nat.add_comm] using this)
+      simp only [List.zipIdx, List.map_cons, VExpr.liftTelN]
+      rw [← hhead]
+      exact congrArg
+        (List.cons (VExpr.liftN n
+          ((field.instL levels).instRevAt params start) (k + start)))
+        (by simpa only [Nat.add_assoc] using htail)
+
+private theorem specializedFieldsAux_instN
+    (rawFields : List VExpr) (levels : List VLevel)
+    (params : List VExpr) (p start k : Nat) (a : VExpr)
+    (hparams : params.length = p)
+    (hclosed : ∀ (j : Nat) (field : VExpr),
+      rawFields[j]? = some field →
+        field.ClosedN (p + start + j)) :
+    (rawFields.zipIdx start |>.map fun (field, i) =>
+      VExpr.instRevAt (field.instL levels)
+        (params.map fun param => param.inst a k) i) =
+    VExpr.instTelN a
+      (rawFields.zipIdx start |>.map fun (field, i) =>
+        VExpr.instRevAt (field.instL levels) params i)
+      (k + start) := by
+  induction rawFields generalizing start with
+  | nil => rfl
+  | cons field rawFields ih =>
+      have hfield : (field.instL levels).ClosedN (p + start + 0) :=
+        VExpr.ClosedN.instL (ls := levels) (hclosed 0 field (by rfl))
+      have hrawInst :
+          (field.instL levels).inst a
+              (k + start + params.length) = field.instL levels :=
+        hfield.instN_eq (by rw [hparams]; omega)
+      have hhead := VExpr.instN_instRevAt
+        (field.instL levels) params start k a
+      rw [hrawInst] at hhead
+      have htail := ih (start := start + 1)
+        (fun j tailField htailField => by
+          have := hclosed (j + 1) tailField (by simpa using htailField)
+          simpa only [Nat.add_assoc, Nat.add_left_comm,
+            Nat.add_comm] using this)
+      simp only [List.zipIdx, List.map_cons, VExpr.instTelN]
+      rw [← hhead]
+      exact congrArg
+        (List.cons (VExpr.inst
+          ((field.instL levels).instRevAt params start) a (k + start)))
+        (by simpa only [Nat.add_assoc] using htail)
+
+/-- Universe arguments supplied to the generated recursor for a projection
+whose result type inhabits `Sort fieldSort`. -/
+def projectionLevels (view : VStructureView)
+    (fieldSort : VLevel) (levels : List VLevel) : List VLevel :=
+  match view.generation.elimination with
+  | .large => fieldSort :: levels
+  | .small => levels
+
+/-- The two expressions generated for one field.  `typeFn` is the dependent
+field type as a function of the structure value; `projector` is a recursor
+program implementing the projection. -/
+structure ProjectionCode where
+  fieldSort : VLevel
+  typeFn : VExpr
+  minor : VExpr
+  projector : VExpr
+
+@[ext] theorem ProjectionCode.ext {left right : ProjectionCode}
+    (fieldSort : left.fieldSort = right.fieldSort)
+    (typeFn : left.typeFn = right.typeFn)
+    (minor : left.minor = right.minor)
+    (projector : left.projector = right.projector) : left = right := by
+  cases left
+  cases right
+  simp_all
+
+def ProjectionCode.liftN (code : ProjectionCode)
+    (n k : Nat) : ProjectionCode where
+  fieldSort := code.fieldSort
+  typeFn := code.typeFn.liftN n k
+  minor := code.minor.liftN n k
+  projector := code.projector.liftN n k
+
+def ProjectionCode.instN (code : ProjectionCode)
+    (a : VExpr) (k : Nat) : ProjectionCode where
+  fieldSort := code.fieldSort
+  typeFn := code.typeFn.inst a k
+  minor := code.minor.inst a k
+  projector := code.projector.inst a k
+
+def ProjectionCode.instL (code : ProjectionCode)
+    (ls : List VLevel) : ProjectionCode where
+  fieldSort := code.fieldSort.inst ls
+  typeFn := code.typeFn.instL ls
+  minor := code.minor.instL ls
+  projector := code.projector.instL ls
+
+/-- The constructor-headed major used by a projection minor after all fields
+have been introduced. -/
+def projectionConstructorApp (view : VStructureView)
+    (levels : List VLevel) (params fields : List VExpr) : VExpr :=
+  VExpr.appN (.const view.constructorName levels)
+    (params.map (VExpr.liftN fields.length) ++
+      VExpr.bvarRevRange 0 fields.length)
+
+/-- The one-constructor, nonrecursive minor premise expected by the generated
+recursor after parameters and a projection motive have been supplied. -/
+def projectionMinorType (view : VStructureView)
+    (levels : List VLevel) (params fields : List VExpr)
+    (typeFn : VExpr) : VExpr :=
+  VExpr.forallN fields
+    (.app (typeFn.liftN fields.length)
+      (view.projectionConstructorApp levels params fields))
+
+@[simp] theorem projectionLevels_instL (view : VStructureView)
+    (fieldSort : VLevel) (levels ls : List VLevel) :
+    (view.projectionLevels fieldSort levels).map (VLevel.inst ls) =
+      view.projectionLevels (fieldSort.inst ls)
+        (levels.map (VLevel.inst ls)) := by
+  unfold projectionLevels
+  split <;> rfl
+
+@[simp] theorem structureType_instL (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (ls : List VLevel) :
+    (view.structureType levels params).instL ls =
+      view.structureType (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls)) := by
+  simp [structureType, VExpr.instL_appN, VExpr.instL]
+
+@[simp] theorem structureType_liftN (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (n k : Nat) :
+    (view.structureType levels params).liftN n k =
+      view.structureType levels
+        (params.map fun param => param.liftN n k) := by
+  simp [structureType, VExpr.liftN_appN, VExpr.liftN]
+
+@[simp] theorem structureType_instN (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (a : VExpr) (k : Nat) :
+    (view.structureType levels params).inst a k =
+      view.structureType levels
+        (params.map fun param => param.inst a k) := by
+  simp [structureType, VExpr.instN_appN, VExpr.inst]
+
+@[simp] theorem specializedFields_instL (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (ls : List VLevel) :
+    (view.specializedFields levels params).map (VExpr.instL ls) =
+      view.specializedFields (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls)) := by
+  simp [specializedFields, VExpr.instL_instRevAt, VExpr.instL_instL, Function.comp_def]
+
+private def projectionCode (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType field : VExpr) (fieldSort : VLevel) (i : Nat)
+    (previous : List ProjectionCode) : ProjectionCode :=
+  let previousAtMajor := previous.map fun code =>
+    .app code.projector.lift (.bvar 0)
+  let motiveBody := VExpr.instRevAt
+    (field.liftN 1 i) previousAtMajor 0
+  let typeFn := .lam structType motiveBody
+  let minor := VExpr.lamN allFields
+    (.bvar (allFields.length - 1 - i))
+  let recursor := .const view.recursorName
+    (view.projectionLevels fieldSort levels)
+  let projector := .lam structType <| VExpr.appN recursor <|
+    params.map (VExpr.liftN 1) ++
+      [typeFn.lift, minor.lift, .bvar 0]
+  { fieldSort, typeFn, minor, projector }
+
+private theorem projectionCode_liftN (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType field : VExpr) (fieldSort : VLevel) (i : Nat)
+    (previous : List ProjectionCode) (n k : Nat)
+    (hprevious : previous.length = i)
+    (hi : i < allFields.length) :
+    (projectionCode view levels params allFields structType field
+      fieldSort i previous).liftN n k =
+    projectionCode view levels
+      (params.map fun param => param.liftN n k)
+      (VExpr.liftTelN n allFields k)
+      (structType.liftN n k) (field.liftN n (k + i)) fieldSort i
+      (previous.map fun code => code.liftN n k) := by
+  have hfieldLift :
+      (field.liftN 1 i).liftN n (k + 1 + i) =
+        (field.liftN n (k + i)).liftN 1 i :=
+    VExpr.liftN_liftAt_projection field n k i
+  have hpreviousLift :
+      (previous.map fun code =>
+        VExpr.app code.projector.lift (.bvar 0)).map
+          (fun (e : VExpr) => e.liftN n (k + 1)) =
+      (previous.map fun code => code.liftN n k).map fun code =>
+        VExpr.app code.projector.lift (.bvar 0) := by
+    simp [ProjectionCode.liftN, VExpr.liftN,
+      VExpr.liftN_lift_projection, List.map_map,
+      Function.comp_def]
+  have hmotive :
+      ((field.liftN 1 i).instRevAt
+          (previous.map fun code =>
+            VExpr.app code.projector.lift (.bvar 0)) 0).liftN n (k + 1) =
+      ((field.liftN n (k + i)).liftN 1 i).instRevAt
+          ((previous.map fun code => code.liftN n k).map fun code =>
+            VExpr.app code.projector.lift (.bvar 0)) 0 := by
+    rw [VExpr.liftN_instRevAt]
+    rw [List.length_map, hprevious, hfieldLift, hpreviousLift]
+  have hminorBody :
+      VExpr.liftN n (.bvar (allFields.length - 1 - i))
+          (k + allFields.length) =
+        .bvar (allFields.length - 1 - i) := by
+    simp only [VExpr.liftN]
+    rw [liftVar_lt]
+    omega
+  have hminorVar :
+      liftVar n (allFields.length - 1 - i)
+          (k + allFields.length) = allFields.length - 1 - i := by
+    rw [liftVar_lt]
+    omega
+  have hminorNestedVar :
+      liftVar n (liftVar 1 (allFields.length - 1 - i)
+          allFields.length) (k + 1 + allFields.length) =
+        liftVar 1 (allFields.length - 1 - i) allFields.length := by
+    have hinner : liftVar 1 (allFields.length - 1 - i)
+        allFields.length = allFields.length - 1 - i :=
+      liftVar_lt (by omega)
+    rw [hinner, liftVar_lt (by omega)]
+  have hmotiveLift :
+      (((field.liftN 1 i).instRevAt
+          (previous.map fun code =>
+            VExpr.app code.projector.lift (.bvar 0)) 0).liftN 1 1).liftN
+          n (k + 1 + 1) =
+      (((field.liftN n (k + i)).liftN 1 i).instRevAt
+          ((previous.map fun code => code.liftN n k).map fun code =>
+            VExpr.app code.projector.lift (.bvar 0)) 0).liftN 1 1 := by
+    rw [VExpr.liftN_liftAt_projection]
+    exact congrArg (fun e => e.liftN 1 1) hmotive
+  apply ProjectionCode.ext
+  · rfl
+  · simp [projectionCode, ProjectionCode.liftN, VExpr.liftN,
+      hmotive]
+  · simp [projectionCode, ProjectionCode.liftN,
+      VExpr.liftN_lamN_projection, VExpr.liftTelN_length,
+      hminorBody]
+  · simp [projectionCode, ProjectionCode.liftN, VExpr.liftN,
+      VExpr.liftN_appN, VExpr.liftN_lamN_projection,
+      VExpr.liftTelN_length, VExpr.liftN_lift_projection,
+      VExpr.liftTelN_lift_projection, List.map_append,
+      List.map_map, Function.comp_def, hmotive, hmotiveLift,
+      hminorNestedVar]
+
+private theorem projectionCode_instN (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType field : VExpr) (fieldSort : VLevel) (i : Nat)
+    (previous : List ProjectionCode) (a : VExpr) (k : Nat)
+    (hprevious : previous.length = i)
+    (hi : i < allFields.length) :
+    (projectionCode view levels params allFields structType field
+      fieldSort i previous).instN a k =
+    projectionCode view levels
+      (params.map fun param => param.inst a k)
+      (VExpr.instTelN a allFields k)
+      (structType.inst a k) (field.inst a (k + i)) fieldSort i
+      (previous.map fun code => code.instN a k) := by
+  have hfieldInst :
+      (field.liftN 1 i).inst a (k + 1 + i) =
+        (field.inst a (k + i)).liftN 1 i :=
+    VExpr.instN_liftAt_projection field a k i
+  have hpreviousInst :
+      (previous.map fun code =>
+        VExpr.app code.projector.lift (.bvar 0)).map
+          (fun (e : VExpr) => e.inst a (k + 1)) =
+      (previous.map fun code => code.instN a k).map fun code =>
+        VExpr.app code.projector.lift (.bvar 0) := by
+    simp [ProjectionCode.instN, VExpr.inst, VExpr.instVar,
+      ← VExpr.lift_instN_lo, List.map_map, Function.comp_def]
+  have hmotive :
+      ((field.liftN 1 i).instRevAt
+          (previous.map fun code =>
+            VExpr.app code.projector.lift (.bvar 0)) 0).inst a (k + 1) =
+      ((field.inst a (k + i)).liftN 1 i).instRevAt
+          ((previous.map fun code => code.instN a k).map fun code =>
+            VExpr.app code.projector.lift (.bvar 0)) 0 := by
+    rw [VExpr.instN_instRevAt]
+    rw [List.length_map, hprevious, hfieldInst, hpreviousInst]
+  have hminorVar :
+      VExpr.instVar (allFields.length - 1 - i) a
+          (k + allFields.length) =
+        .bvar (allFields.length - 1 - i) := by
+    simp [VExpr.instVar, show
+      allFields.length - 1 - i < k + allFields.length by omega]
+  apply ProjectionCode.ext
+  · rfl
+  · simp [projectionCode, ProjectionCode.instN, VExpr.inst, hmotive]
+  · simp [projectionCode, ProjectionCode.instN, VExpr.inst,
+      VExpr.instN_lamN_projection, VExpr.instTelN_length,
+      hminorVar]
+  · simp [projectionCode, ProjectionCode.instN, VExpr.inst, VExpr.instN_appN,
+      VExpr.instN_lamN_projection, VExpr.instTelN_length, ← VExpr.lift_instN_lo, List.map_append,
+      List.map_map, Function.comp_def, hmotive, hminorVar]
+
+private def projectionCodes.go (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr)
+    (allFields : List VExpr) (structType : VExpr) :
+    List VExpr → List VLevel → Nat → List ProjectionCode →
+      List ProjectionCode
+  | field :: fields, fieldSort :: fieldSorts, i, previous =>
+      let code := projectionCode view levels params allFields structType
+        field fieldSort i previous
+      code :: projectionCodes.go view levels params allFields structType
+        fields fieldSorts (i + 1) (previous ++ [code])
+  | _, _, _, _ => []
+
+private theorem projectionCodes.go_instN (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType : VExpr) (fields : List VExpr)
+    (fieldSorts : List VLevel) (i : Nat)
+    (previous : List ProjectionCode) (a : VExpr) (k : Nat)
+    (hprevious : previous.length = i)
+    (hfields : i + fields.length = allFields.length) :
+    (projectionCodes.go view levels params allFields structType
+        fields fieldSorts i previous).map
+      (fun code => code.instN a k) =
+    projectionCodes.go view levels
+      (params.map fun param => param.inst a k)
+      (VExpr.instTelN a allFields k) (structType.inst a k)
+      (VExpr.instTelN a fields (k + i)) fieldSorts i
+      (previous.map fun code => code.instN a k) := by
+  induction fields generalizing fieldSorts i previous with
+  | nil =>
+      cases fieldSorts <;> simp [projectionCodes.go, VExpr.instTelN]
+  | cons field fields ih =>
+      cases fieldSorts with
+      | nil => simp [projectionCodes.go]
+      | cons fieldSort fieldSorts =>
+          have hi : i < allFields.length := by
+            simp only [List.length_cons] at hfields
+            omega
+          have hcode := projectionCode_instN view levels params allFields
+            structType field fieldSort i previous a k hprevious hi
+          simp only [projectionCodes.go, List.map_cons,
+            VExpr.instTelN]
+          rw [hcode]
+          congr 1
+          have hprevious' :
+              (previous ++ [projectionCode view levels params allFields
+                structType field fieldSort i previous]).length = i + 1 := by
+            simp [hprevious]
+          have hfields' : i + 1 + fields.length = allFields.length := by
+            simp only [List.length_cons] at hfields
+            omega
+          simpa only [List.map_append, List.map_singleton,
+            hcode, Nat.add_assoc] using
+              ih fieldSorts (i + 1)
+                (previous ++ [projectionCode view levels params allFields
+                  structType field fieldSort i previous])
+                hprevious' hfields'
+
+private theorem projectionCode_instL (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType field : VExpr) (fieldSort : VLevel) (i : Nat)
+    (previous : List ProjectionCode) (ls : List VLevel) :
+    (projectionCode view levels params allFields structType field
+      fieldSort i previous).instL ls =
+    projectionCode view
+      (levels.map (VLevel.inst ls))
+      (params.map (VExpr.instL ls))
+      (allFields.map (VExpr.instL ls))
+      (structType.instL ls) (field.instL ls) (fieldSort.inst ls) i
+      (previous.map fun code => code.instL ls) := by
+  simp [projectionCode, ProjectionCode.instL, VExpr.instL,
+    VExpr.instL_instRevAt, VExpr.instL_lamN_projection,
+    VExpr.instL_appN, VExpr.instL_liftN,
+    List.map_append, List.map_map, Function.comp_def]
+
+private theorem projectionCodes.go_instL (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType : VExpr) (fields : List VExpr)
+    (fieldSorts : List VLevel) (i : Nat)
+    (previous : List ProjectionCode) (ls : List VLevel) :
+    (projectionCodes.go view levels params allFields structType
+        fields fieldSorts i previous).map
+      (fun code => code.instL ls) =
+    projectionCodes.go view
+      (levels.map (VLevel.inst ls))
+      (params.map (VExpr.instL ls))
+      (allFields.map (VExpr.instL ls))
+      (structType.instL ls)
+      (fields.map (VExpr.instL ls))
+      (fieldSorts.map (VLevel.inst ls)) i
+      (previous.map fun code => code.instL ls) := by
+  induction fields generalizing fieldSorts i previous with
+  | nil => simp [projectionCodes.go]
+  | cons field fields ih =>
+      cases fieldSorts with
+      | nil => simp [projectionCodes.go]
+      | cons fieldSort fieldSorts =>
+          simp only [projectionCodes.go, List.map_cons,
+            projectionCode_instL]
+          congr 1
+          simpa only [List.map_append, List.map_singleton,
+            projectionCode_instL] using
+            ih fieldSorts (i + 1)
+              (previous ++ [projectionCode view levels params allFields
+                structType field fieldSort i previous])
+
+private theorem projectionCodes.go_liftN (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType : VExpr) (fields : List VExpr)
+    (fieldSorts : List VLevel) (i : Nat)
+    (previous : List ProjectionCode) (n k : Nat)
+    (hprevious : previous.length = i)
+    (hfields : i + fields.length = allFields.length) :
+    (projectionCodes.go view levels params allFields structType
+        fields fieldSorts i previous).map
+      (fun code => code.liftN n k) =
+    projectionCodes.go view levels
+      (params.map fun param => param.liftN n k)
+      (VExpr.liftTelN n allFields k) (structType.liftN n k)
+      (VExpr.liftTelN n fields (k + i)) fieldSorts i
+      (previous.map fun code => code.liftN n k) := by
+  induction fields generalizing fieldSorts i previous with
+  | nil =>
+      cases fieldSorts <;> simp [projectionCodes.go, VExpr.liftTelN]
+  | cons field fields ih =>
+      cases fieldSorts with
+      | nil => simp [projectionCodes.go]
+      | cons fieldSort fieldSorts =>
+          have hi : i < allFields.length := by
+            simp only [List.length_cons] at hfields
+            omega
+          have hcode := projectionCode_liftN view levels params allFields
+            structType field fieldSort i previous n k hprevious hi
+          simp only [projectionCodes.go, List.map_cons,
+            VExpr.liftTelN]
+          rw [hcode]
+          congr 1
+          have hprevious' :
+              (previous ++ [projectionCode view levels params allFields
+                structType field fieldSort i previous]).length = i + 1 := by
+            simp [hprevious]
+          have hfields' : i + 1 + fields.length = allFields.length := by
+            simp only [List.length_cons] at hfields
+            omega
+          simpa only [List.map_append, List.map_singleton,
+            hcode, Nat.add_assoc] using
+              ih fieldSorts (i + 1)
+                (previous ++ [projectionCode view levels params allFields
+                  structType field fieldSort i previous])
+                hprevious' hfields'
+
+/-- All field projections, in constructor-field order. -/
+def projectionCodes (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) : List ProjectionCode :=
+  let fields := view.specializedFields levels params
+  projectionCodes.go view levels params fields
+    (view.structureType levels params) fields
+      (view.fieldSorts.map (VLevel.inst levels)) 0 []
+
+private theorem projectionCodes.go_length (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType : VExpr) :
+    ∀ (fields : List VExpr) (fieldSorts : List VLevel)
+      (i : Nat) (previous : List ProjectionCode),
+      fields.length = fieldSorts.length →
+      (projectionCodes.go view levels params allFields structType
+        fields fieldSorts i previous).length = fields.length
+  | [], [], _, _, _ => rfl
+  | [], _ :: _, _, _, h => by simp at h
+  | _ :: _, [], _, _, h => by simp at h
+  | field :: fields, fieldSort :: fieldSorts, i, previous, h => by
+      simp only [List.length_cons] at h ⊢
+      simp only [projectionCodes.go, List.length_cons]
+      exact congrArg Nat.succ <|
+        projectionCodes.go_length view levels params allFields structType
+          fields fieldSorts (i + 1)
+          (previous ++ [projectionCode view levels params allFields
+            structType field fieldSort i previous]) (Nat.succ.inj h)
+
+@[simp] theorem projectionCodes_length (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) :
+    (view.projectionCodes levels params).length =
+      (view.specializedFields levels params).length := by
+  apply projectionCodes.go_length
+  simp [VStructureView.specializedFields, VStructureView.fields,
+    view.fieldSorts_length]
+
+/-- Semantic arguments substituted while walking to a later dependent
+projection field. -/
+def projectionArgs (view : VStructureView) (levels : List VLevel)
+    (params : List VExpr) (count : Nat) (major : VExpr) : List VExpr :=
+  (view.projectionCodes levels params).take count |>.map fun code =>
+    .app code.projector major
+
+/-- Rebuild a structure value from all of its canonical generated
+projections.  This is syntax only: `ProgramsWF.projectionArgsSpine` below
+supplies the rule-independent typing evidence, while any equality between
+this term and `major` remains an explicit definitional-equality capability. -/
+def etaRebuild (view : VStructureView) (levels : List VLevel)
+    (params : List VExpr) (major : VExpr) : VExpr :=
+  VExpr.appN (.const view.constructorName levels)
+    (params ++ view.projectionArgs levels params
+      (view.specializedFields levels params).length major)
+
+@[simp] theorem projectionArgs_length (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (count : Nat)
+    (major : VExpr) (hcount : count ≤
+      (view.projectionCodes levels params).length) :
+    (view.projectionArgs levels params count major).length = count := by
+  simp only [projectionArgs, List.length_map, List.length_take]
+  exact Nat.min_eq_left hcount
+
+theorem projectionArgs_succ (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (count : Nat)
+    (major : VExpr) {code : ProjectionCode}
+    (hcode : (view.projectionCodes levels params)[count]? = some code) :
+    view.projectionArgs levels params (count + 1) major =
+      view.projectionArgs levels params count major ++
+        [.app code.projector major] := by
+  simp only [projectionArgs, List.take_add_one, hcode, Option.toList_some,
+    List.map_append, List.map_singleton]
+
+private theorem projectionCodes.go_get?_typeFn (view : VStructureView)
+    (levels : List VLevel) (params allFields : List VExpr)
+    (structType : VExpr) :
+    ∀ {fields : List VExpr} {fieldSorts : List VLevel}
+      {i : Nat} {previous : List ProjectionCode} {j : Nat}
+      {code : ProjectionCode},
+      (projectionCodes.go view levels params allFields structType
+        fields fieldSorts i previous)[j]? = some code →
+      ∃ field,
+        fields[j]? = some field ∧
+        code.typeFn = .lam structType
+          ((field.liftN 1 (i + j)).instRevAt
+            ((previous ++
+              (projectionCodes.go view levels params allFields structType
+                fields fieldSorts i previous).take j).map fun prior =>
+                .app prior.projector.lift (.bvar 0)) 0) := by
+  intro fields
+  induction fields with
+  | nil =>
+      intro fieldSorts i previous j code h
+      cases fieldSorts <;> simp [projectionCodes.go] at h
+  | cons field fields ih =>
+      intro fieldSorts i previous j code h
+      cases fieldSorts with
+      | nil => simp [projectionCodes.go] at h
+      | cons fieldSort fieldSorts =>
+          let head := projectionCode view levels params allFields structType
+            field fieldSort i previous
+          cases j with
+          | zero =>
+              change some head = some code at h
+              injection h with hcode
+              subst code
+              refine ⟨field, rfl, ?_⟩
+              simp [head, projectionCode]
+          | succ j =>
+              simp only [projectionCodes.go, List.getElem?_cons_succ] at h
+              obtain ⟨tailField, htailField, htypeFn⟩ :=
+                ih (fieldSorts := fieldSorts) (i := i + 1)
+                  (previous := previous ++ [head]) h
+              refine ⟨tailField, by simpa using htailField, ?_⟩
+              have hpref :
+                  previous ++
+                    (projectionCodes.go view levels params allFields structType
+                      (field :: fields) (fieldSort :: fieldSorts) i previous).take
+                        (j + 1) =
+                    (previous ++ [head]) ++
+                      (projectionCodes.go view levels params allFields structType
+                        fields fieldSorts (i + 1)
+                          (previous ++ [head])).take j := by
+                simp [head, projectionCodes.go, List.append_assoc]
+              rw [hpref]
+              simpa only [Nat.add_assoc, Nat.add_comm,
+                Nat.add_left_comm] using htypeFn
+
+/-- The generated type function at field `idx` is the corresponding
+specialized constructor field with all earlier generated projectors
+substituted at the major premise. -/
+theorem projectionCodes_get?_typeFn (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) {idx : Nat}
+    {code : ProjectionCode}
+    (hcode : (view.projectionCodes levels params)[idx]? = some code) :
+    ∃ field,
+      (view.specializedFields levels params)[idx]? = some field ∧
+      code.typeFn = .lam (view.structureType levels params)
+        ((field.liftN 1 idx).instRevAt
+          ((view.projectionCodes levels params).take idx |>.map fun prior =>
+            .app prior.projector.lift (.bvar 0)) 0) := by
+  unfold projectionCodes at hcode ⊢
+  simpa using projectionCodes.go_get?_typeFn view levels params
+    (view.specializedFields levels params)
+    (view.structureType levels params) hcode
+
+private theorem projectionCodes.go_get?_program_shape
+    (view : VStructureView) (levels : List VLevel)
+    (params allFields : List VExpr) (structType : VExpr) :
+    ∀ {fields : List VExpr} {fieldSorts : List VLevel}
+      {i : Nat} {previous : List ProjectionCode} {j : Nat}
+      {code : ProjectionCode},
+      (projectionCodes.go view levels params allFields structType
+        fields fieldSorts i previous)[j]? = some code →
+      ∃ fieldSort,
+        fieldSorts[j]? = some fieldSort ∧
+          code.fieldSort = fieldSort ∧
+          code.minor = VExpr.lamN allFields
+            (.bvar (allFields.length - 1 - (i + j))) ∧
+          code.projector = .lam structType
+            (VExpr.appN
+              (.const view.recursorName
+                (view.projectionLevels code.fieldSort levels))
+              (params.map (VExpr.liftN 1) ++
+                [code.typeFn.lift, code.minor.lift, .bvar 0])) := by
+  intro fields
+  induction fields with
+  | nil =>
+      intro fieldSorts i previous j code h
+      cases fieldSorts <;> simp [projectionCodes.go] at h
+  | cons field fields ih =>
+      intro fieldSorts i previous j code h
+      cases fieldSorts with
+      | nil => simp [projectionCodes.go] at h
+      | cons fieldSort fieldSorts =>
+          let head := projectionCode view levels params allFields structType
+            field fieldSort i previous
+          cases j with
+          | zero =>
+              change some head = some code at h
+              injection h with hcode
+              subst code
+              simp [head, projectionCode]
+          | succ j =>
+              simp only [projectionCodes.go, List.getElem?_cons_succ] at h
+              have hout := ih (fieldSorts := fieldSorts) (i := i + 1)
+                (previous := previous ++ [head]) h
+              simpa only [List.getElem?_cons_succ, Nat.add_assoc, Nat.add_comm,
+                Nat.add_left_comm] using hout
+
+/-- A selected projection code retains the exact selecting minor and
+recursor program emitted by `projectionCodes`. -/
+theorem projectionCodes_get?_program_shape (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) {idx : Nat}
+    {code : ProjectionCode}
+    (hcode : (view.projectionCodes levels params)[idx]? = some code) :
+    ∃ fieldSort,
+      (view.fieldSorts.map (VLevel.inst levels))[idx]? = some fieldSort ∧
+        code.fieldSort = fieldSort ∧
+        code.minor = VExpr.lamN (view.specializedFields levels params)
+          (.bvar ((view.specializedFields levels params).length - 1 - idx)) ∧
+        code.projector = .lam (view.structureType levels params)
+          (VExpr.appN
+            (.const view.recursorName
+              (view.projectionLevels code.fieldSort levels))
+            (params.map (VExpr.liftN 1) ++
+              [code.typeFn.lift, code.minor.lift, .bvar 0])) := by
+  unfold projectionCodes at hcode
+  simpa using projectionCodes.go_get?_program_shape view levels params
+    (view.specializedFields levels params)
+    (view.structureType levels params) hcode
+
+/-- Applying a generated projection's type function to its major premise
+substitutes that major into every earlier generated projector. -/
+theorem projectionCodes_get?_typeFn_beta (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) {idx : Nat}
+    {code : ProjectionCode}
+    (hcode : (view.projectionCodes levels params)[idx]? = some code)
+    (major : VExpr) :
+    ∃ field typeBody,
+      (view.specializedFields levels params)[idx]? = some field ∧
+      code.typeFn = .lam (view.structureType levels params) typeBody ∧
+      typeBody.inst major =
+        field.instRevAt
+          ((view.projectionCodes levels params).take idx |>.map fun prior =>
+            .app prior.projector major) 0 := by
+  obtain ⟨field, hfield, htypeFn⟩ :=
+    view.projectionCodes_get?_typeFn levels params hcode
+  let codes := view.projectionCodes levels params
+  have hidx : idx < codes.length :=
+    (List.getElem?_eq_some_iff.1 hcode).1
+  have htake : (codes.take idx).length = idx := by
+    simp [List.length_take, Nat.min_eq_left (Nat.le_of_lt hidx)]
+  have htake' :
+      ((view.projectionCodes levels params).take idx).length = idx := by
+    simpa [codes] using htake
+  refine ⟨field, _, hfield, htypeFn, ?_⟩
+  rw [VExpr.instN_instRevAt]
+  rw [List.length_map, htake']
+  simp only [Nat.zero_add, VExpr.inst_liftN1]
+  congr 1
+  induction (view.projectionCodes levels params).take idx with
+  | nil => rfl
+  | cons prior previous ih =>
+      simp only [List.map_cons]
+      rw [ih]
+      simp only [VExpr.inst, VExpr.inst_lift, VExpr.instVar_zero]
+
+@[simp] theorem projectionCodes_instL (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr) (ls : List VLevel) :
+    (view.projectionCodes levels params).map
+        (fun code => code.instL ls) =
+      view.projectionCodes (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls)) := by
+  simp [projectionCodes, projectionCodes.go_instL,
+    VLevel.inst_inst, List.map_map, Function.comp_def]
+
+/-- The dependent result type of projection `idx`, applied to `major`. -/
+def projectionType? (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr)
+    (idx : Nat) (major : VExpr) : Option VExpr := do
+  let code ← (view.projectionCodes levels params)[idx]?
+  return .app code.typeFn major
+
+/-- The recursor encoding of projection `idx`, applied to `major`. -/
+def project? (view : VStructureView)
+    (levels : List VLevel) (params : List VExpr)
+    (idx : Nat) (major : VExpr) : Option VExpr := do
+  let code ← (view.projectionCodes levels params)[idx]?
+  return .app code.projector major
+
+/-- A proof-carrying boundary for the programs generated by
+`projectionCodes`.  Generation fixes the program syntax, while this
+certificate records the remaining semantic fact needed by consumers: every
+selected projector is well typed at every well-formed instantiation.
+
+This is intentionally separate from `VStructureView.WF`.  The latter is the
+certificate produced by ordinary inductive generation; accepting primitive
+projection syntax is a later capability boundary and must not silently add a
+structure-eta rule to Theory's definitional equality. -/
+def ProgramsWF (view : VStructureView) (env : VEnv) : Prop :=
+  ∀ {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+      {params : List VExpr} {idx : Nat} {code : ProjectionCode},
+    OnCtx Γ (env.IsType U) →
+    (∀ level ∈ levels, level.WF U) →
+    levels.length = view.uvars →
+    params.length = view.nparams →
+    (∃ resultLevel, env.SpineWF U Γ (view.familyType.instL levels)
+      params (.sort resultLevel)) →
+    (view.projectionCodes levels params)[idx]? = some code →
+    env.HasType U Γ code.projector
+      (.forallE (view.structureType levels params)
+        (.app code.typeFn.lift (.bvar 0)))
+
+/-- A certified projector is typed by the exact constructor-telescope domain
+exposed after substituting all earlier projections. -/
+theorem ProgramsWF.projector_hasType_field
+    {view : VStructureView} {env : VEnv}
+    (self : view.ProgramsWF env) (henv : env.WF)
+    {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+    {params : List VExpr} {idx : Nat} {code : ProjectionCode}
+    (hΓ : OnCtx Γ (env.IsType U))
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    (hparamsLength : params.length = view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    (hcode : (view.projectionCodes levels params)[idx]? = some code)
+    {major : VExpr}
+    (hmajor : env.HasType U Γ major (view.structureType levels params)) :
+    ∃ field typeBody,
+      (view.specializedFields levels params)[idx]? = some field ∧
+      code.typeFn = .lam (view.structureType levels params) typeBody ∧
+      env.HasType U Γ (.app code.projector major)
+        (field.instRevAt (view.projectionArgs levels params idx major) 0) := by
+  obtain ⟨field, typeBody, hfield, htypeFn, htypeBody⟩ :=
+    view.projectionCodes_get?_typeFn_beta levels params hcode major
+  have hprojector := self hΓ hlevels hlevelsLength hparamsLength
+    hparamsSpine hcode
+  have happ : env.HasType U Γ (.app code.projector major)
+      (.app code.typeFn major) := by
+    simpa only [VExpr.inst, VExpr.inst_lift, VExpr.instVar_zero] using
+      hprojector.app hmajor
+  rw [htypeFn] at happ
+  obtain ⟨sortLevel, hredexType⟩ := happ.isType henv hΓ
+  obtain ⟨A, B, hlam, harg⟩ := hredexType.app_inv henv hΓ
+  obtain ⟨⟨_, hstructType⟩, _, hbodyType⟩ :=
+    hlam.lam_inv henv hΓ
+  have hfunTypeEq := hlam.uniqU henv hΓ
+    (hstructType.lam hbodyType)
+  obtain ⟨⟨_, hdomainEq⟩, _⟩ :=
+    hfunTypeEq.forallE_inv henv hΓ
+  have harg' := harg.defeqU_r henv hΓ ⟨_, hdomainEq⟩
+  have hbeta : env.IsDefEqU U Γ
+      (.app (.lam (view.structureType levels params) typeBody) major)
+      (typeBody.inst major) :=
+    ⟨_, VEnv.IsDefEq.beta hbodyType harg'⟩
+  have hout := happ.defeqU_r henv hΓ hbeta
+  rw [htypeBody] at hout
+  refine ⟨field, typeBody, hfield, htypeFn, ?_⟩
+  simpa [projectionArgs] using hout
+
+private theorem ProgramsWF.projectionArgsSpineAux
+    {view : VStructureView} {env : VEnv}
+    (self : view.ProgramsWF env) (henv : env.WF)
+    {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+    {params : List VExpr}
+    (hΓ : OnCtx Γ (env.IsType U))
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    (hparamsLength : params.length = view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    {major : VExpr}
+    (hmajor : env.HasType U Γ major (view.structureType levels params))
+    (tailResult : VExpr) :
+    ∀ {count : Nat},
+      count ≤ (view.specializedFields levels params).length →
+      ∃ cursor,
+        VExpr.consumeForalls?
+            (VExpr.forallN (view.specializedFields levels params) tailResult)
+            (view.projectionArgs levels params count major) = some cursor ∧
+          env.SpineWF U Γ
+            (VExpr.forallN (view.specializedFields levels params) tailResult)
+            (view.projectionArgs levels params count major) cursor := by
+  intro count hcount
+  induction count with
+  | zero =>
+      exact ⟨_, rfl, .nil⟩
+  | succ count ih =>
+      have hcountLt : count <
+          (view.specializedFields levels params).length := by omega
+      have hcodeIdx : count <
+          (view.projectionCodes levels params).length := by
+        simpa using hcountLt
+      let code := (view.projectionCodes levels params)[count]
+      have hcode :
+          (view.projectionCodes levels params)[count]? = some code :=
+        List.getElem?_eq_getElem hcodeIdx
+      have hargsLength :
+          (view.projectionArgs levels params count major).length = count :=
+        view.projectionArgs_length levels params count major
+          (Nat.le_of_lt hcodeIdx)
+      obtain ⟨cursor, hconsume, hspine⟩ :=
+        ih (Nat.le_of_lt hcountLt)
+      obtain ⟨field, semanticBody, hfield, hconsumeDomain⟩ :=
+        VExpr.consumeForalls?_forallN_domain
+          (view.specializedFields levels params) tailResult
+          (view.projectionArgs levels params count major)
+          (by simpa [hargsLength] using hcountLt)
+      have hcursorShape : cursor =
+          .forallE
+            (field.instRevAt
+              (view.projectionArgs levels params count major) 0)
+            semanticBody :=
+        Option.some.inj (hconsume.symm.trans hconsumeDomain)
+      subst cursor
+      obtain ⟨field', _, hfield', _, hprojectorField⟩ :=
+        self.projector_hasType_field henv hΓ hlevels hlevelsLength
+          hparamsLength hparamsSpine hcode hmajor
+      have hfieldEq : field' = field :=
+        Option.some.inj
+          (hfield'.symm.trans (by simpa [hargsLength] using hfield))
+      subst field'
+      refine ⟨semanticBody.inst (.app code.projector major), ?_, ?_⟩
+      · rw [view.projectionArgs_succ levels params count major hcode]
+        rw [VExpr.consumeForalls?_append, hconsumeDomain]
+        rfl
+      · rw [view.projectionArgs_succ levels params count major hcode]
+        exact hspine.snoc hprojectorField
+
+/-- All canonical generated projections of a well-typed major form a single
+well-typed dependent constructor-field spine.  This theorem deliberately
+stops at typing: it does not assert structure eta. -/
+theorem ProgramsWF.projectionArgsSpine
+    {view : VStructureView} {env : VEnv}
+    (self : view.ProgramsWF env) (henv : env.WF)
+    {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+    {params : List VExpr}
+    (hΓ : OnCtx Γ (env.IsType U))
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    (hparamsLength : params.length = view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    {major : VExpr}
+    (hmajor : env.HasType U Γ major (view.structureType levels params))
+    (tailResult : VExpr) :
+    env.SpineWF U Γ
+      (VExpr.forallN (view.specializedFields levels params) tailResult)
+      (view.projectionArgs levels params
+        (view.specializedFields levels params).length major)
+      (VExpr.instRev tailResult
+        (view.projectionArgs levels params
+          (view.specializedFields levels params).length major)) := by
+  obtain ⟨_, _, hspine⟩ := self.projectionArgsSpineAux henv hΓ hlevels
+    hlevelsLength hparamsLength hparamsSpine hmajor tailResult
+    (Nat.le_refl _)
+  apply hspine.retarget
+  · exact view.projectionArgs_length levels params
+      (view.specializedFields levels params).length major (by simp)
+
+/-- Applying the complete canonical projection spine to a constructor prefix
+is well typed.  The constructor-prefix premise is kept explicit so this
+lemma remains independent of any proposed structure-eta equality rule. -/
+theorem ProgramsWF.etaRebuild_hasType_of_constructorPrefix
+    {view : VStructureView} {env : VEnv}
+    (self : view.ProgramsWF env) (henv : env.WF)
+    {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+    {params : List VExpr}
+    (hΓ : OnCtx Γ (env.IsType U))
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    (hparamsLength : params.length = view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    {major : VExpr}
+    (hmajor : env.HasType U Γ major (view.structureType levels params))
+    (hconstructorPrefix : env.HasType U Γ
+      (VExpr.appN (.const view.constructorName levels) params)
+      (VExpr.forallN (view.specializedFields levels params)
+        ((view.structureType levels params).liftN
+          (view.specializedFields levels params).length))) :
+    env.HasType U Γ (view.etaRebuild levels params major)
+      (view.structureType levels params) := by
+  have hfields := self.projectionArgsSpine henv hΓ hlevels hlevelsLength
+    hparamsLength hparamsSpine hmajor
+    ((view.structureType levels params).liftN
+      (view.specializedFields levels params).length)
+  have hrebuild := hfields.hasType_appN hconstructorPrefix
+  let args := view.projectionArgs levels params
+    (view.specializedFields levels params).length major
+  have hargsLength :
+      args.length = (view.specializedFields levels params).length :=
+    view.projectionArgs_length levels params
+      (view.specializedFields levels params).length major (by simp)
+  have hlift :
+      (view.structureType levels params).liftN
+          (view.specializedFields levels params).length =
+        (view.structureType levels params).liftN args.length :=
+    congrArg (view.structureType levels params).liftN hargsLength.symm
+  have hresult :
+      VExpr.instRev
+        ((view.structureType levels params).liftN
+          (view.specializedFields levels params).length)
+        args =
+        view.structureType levels params := by
+    calc
+      _ = VExpr.instRev
+          ((view.structureType levels params).liftN args.length) args :=
+        congrArg (VExpr.instRev · args) hlift
+      _ = view.structureType levels params :=
+        VExpr.instRev_liftN_len args _
+  rw [hresult] at hrebuild
+  simpa [etaRebuild, VExpr.appN_append] using hrebuild
+
+/-- Exact registration of the checked structure artifact in a Theory
+environment.  These are concrete lookups and generated iota rules, not an
+oracle supplied by a projection consumer. -/
+structure Registered (view : VStructureView) (env : VEnv) : Prop where
+  family : env.constants view.name =
+    some view.generation.block.sourceType.toVConstant
+  constructor : env.constants view.constructorName =
+    some view.constructor.raw.toVConstant
+  recursor : env.constants view.recursorName =
+    some view.generation.recursor
+  rules : ∀ rule ∈ view.generation.generatedRules, env.defeqs rule
+
+/-- The semantic fragment of `GenerationEnv` that remains monotone under an
+arbitrary environment extension.  Ordering is supplied by the structural-law
+caller; exact constant/rule registration is carried separately by
+`Registered`. -/
+structure GenerationSemantics (view : VStructureView) (env : VEnv) : Prop where
+  checked : view.generation.block.checked.WF env
+  familyTelescope :
+    env.TelDefEq view.uvars []
+      (view.generation.block.rawParams ++
+        view.generation.block.rawIndices)
+      (view.generation.block.checked.params ++
+        view.generation.block.checked.indices)
+  familyResult :
+    env.IsDefEq view.uvars
+      (view.generation.block.rawParams ++
+        view.generation.block.rawIndices).reverse
+      view.generation.block.rawResult
+      (.sort view.generation.block.checked.resultLevel)
+      (.sort (.succ view.generation.block.checked.resultLevel))
+  constructor : view.constructor.WF view.generation.block env
+
+/-- Semantic well-formedness of one structure view in its registered
+environment.  The retained sort list is checked against the exact raw
+dependent field telescope. -/
+structure WF (view : VStructureView) (env : VEnv) : Prop
+    extends VStructureView.Registered view env where
+  generationSemantics : VStructureView.GenerationSemantics view env
+  parameters : env.OnTel view.uvars []
+    view.generation.block.checked.params
+  parameters_length :
+    view.generation.block.checked.params.length = view.nparams
+  fieldTelescope : env.OnSortTel view.uvars
+    view.generation.block.checked.params.reverse
+      view.fields view.fieldSorts
+  smallFields : view.generation.elimination = .small →
+    ∀ level ∈ view.fieldSorts, level = .zero
+
+theorem WF.rule_mem (self : VStructureView.WF view env) {df : VDefEq}
+    (h : df ∈ VInductDecl.GenerationChecked.generatedRules view.generation) :
+    VEnv.defeqs env df :=
+  self.rules df h
+
+/-- The semantic capability required by structure-eta consumers.
+
+`VStructureView.WF` and `ProgramsWF` account for the registered structure
+artifact and the typing of its generated projectors.  This property records
+only the additional equality that those rule-independent certificates do not
+derive: rebuilding every canonical projection is definitionally equal to the
+original major premise.  Keeping it as an explicit environment capability
+prevents checker verification from silently extending `VEnv.IsDefEq`. -/
+def _root_.Ix.Theory.Named.VEnv.HasStructureEta (env : VEnv) : Prop :=
+  ∀ (view : VStructureView), view.WF env → view.ProgramsWF env →
+    ∀ {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+      {params : List VExpr} {major : VExpr},
+      OnCtx Γ (env.IsType U) →
+      (∀ level ∈ levels, level.WF U) →
+      levels.length = view.uvars →
+      params.length = view.nparams →
+      (∃ resultLevel, env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel)) →
+      env.HasType U Γ major (view.structureType levels params) →
+      env.IsDefEq U Γ (view.etaRebuild levels params major) major
+        (view.structureType levels params)
+
+theorem Registered.mono {env env' : VEnv} (henv : env ≤ env')
+    (self : VStructureView.Registered view env) :
+    VStructureView.Registered view env' where
+  family := henv.1 self.family
+  constructor := henv.1 self.constructor
+  recursor := henv.1 self.recursor
+  rules := fun rule hrule => henv.2 (self.rules rule hrule)
+
+theorem GenerationSemantics.mono {env env' : VEnv} (henv : env ≤ env')
+    (self : VStructureView.GenerationSemantics view env) :
+    VStructureView.GenerationSemantics view env' where
+  checked := self.checked.mono henv
+  familyTelescope := self.familyTelescope.mono henv
+  familyResult := self.familyResult.mono henv
+  constructor := self.constructor.mono henv
+
+/-- Recover the monotone semantic fragment of a generated structure from the
+ordinary generation certificate and the exact successful transaction trace. -/
+theorem GenerationSemantics.ofGenerationTrace {pre env : VEnv}
+    (hgen : view.generation.WF pre)
+    (trace : VEnv.AddInductGenerationTrace pre env view.generation) :
+    VStructureView.GenerationSemantics view env := by
+  have htypeFinal : trace.typeEnv ≤ env := by
+    have hctors :=
+      (ctorFold_spec view.generation.block.sourceType.ctors
+        trace.addCtors).1
+    have hrec := VEnv.addConst_le trace.addRec
+    have hrules : trace.recEnv ≤ env := by
+      simpa only [trace.addRules] using
+        (rulesFold_spec view.generation.generatedRules trace.recEnv).1
+    exact hctors.trans (hrec.trans hrules)
+  have hpreFinal := trace.le
+  refine {
+    checked := hgen.blockWF.2.mono hpreFinal
+    familyTelescope := hgen.familyTel.mono hpreFinal
+    familyResult := hgen.familyResult.mono hpreFinal
+    constructor := ?_ }
+  have hconstructor :
+      view.constructor ∈ view.generation.block.ctorPairs := by
+    simp [view.constructor_eq]
+  exact (hgen.ctors trace.typeEnv trace.addType view.constructor
+    hconstructor).mono htypeFinal
+
+theorem WF.mono {env env' : VEnv} (henv : env ≤ env')
+    (self : VStructureView.WF view env) : VStructureView.WF view env' where
+  toRegistered := self.toRegistered.mono henv
+  generationSemantics := self.generationSemantics.mono henv
+  parameters := self.parameters.monoProjection henv
+  parameters_length := self.parameters_length
+  fieldTelescope := self.fieldTelescope.mono henv
+  smallFields := self.smallFields
+
+/-- Reassemble the standard generated-artifact invariant when an ordered
+environment is available. -/
+theorem WF.toGenerationEnv (self : VStructureView.WF view env)
+    (henv : env.Ordered) :
+    VInductDecl.GenerationEnv view.generation env where
+  ord := henv
+  checked := self.generationSemantics.checked
+  familyTel := self.generationSemantics.familyTelescope
+  familyResult := self.generationSemantics.familyResult
+  ctorWF := by
+    intro ctor hctor
+    rw [view.constructor_eq] at hctor
+    simp only [List.mem_singleton] at hctor
+    subst ctor
+    exact self.generationSemantics.constructor
+  familyConst := self.family
+  ctorConst := by
+    intro ctor hctor
+    rw [view.constructor_eq] at hctor
+    simp only [List.mem_singleton] at hctor
+    subst ctor
+    exact self.constructor
+
+theorem WF.field_closed (self : VStructureView.WF view env)
+    (henv : env.Ordered) {i : Nat} {field : VExpr}
+    (hfield : view.fields[i]? = some field) :
+    field.ClosedN (view.nparams + i) := by
+  have hparamsCtx : OnCtx
+      view.generation.block.checked.params.reverse
+      (env.IsType view.uvars) :=
+    by simpa using VEnv.OnTel.toOnCtx self.parameters (by trivial)
+  have hclosed := VEnv.OnSortTel.closedAt henv self.fieldTelescope
+    (VEnv.CtxWF.closed henv hparamsCtx) hfield
+  simpa [self.parameters_length] using hclosed
+
+theorem WF.specializedFields_liftN
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    (levels : List VLevel) (params : List VExpr)
+    (hparams : params.length = view.nparams) (n k : Nat) :
+    view.specializedFields levels
+        (params.map fun param => param.liftN n k) =
+      VExpr.liftTelN n (view.specializedFields levels params) k := by
+  simpa [specializedFields] using
+    specializedFieldsAux_liftN view.fields levels params view.nparams
+      0 n k hparams
+      (fun j field hfield => by
+        simpa using self.field_closed henv hfield)
+
+theorem WF.specializedFields_instN
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    (levels : List VLevel) (params : List VExpr)
+    (hparams : params.length = view.nparams) (a : VExpr) (k : Nat) :
+    view.specializedFields levels
+        (params.map fun param => param.inst a k) =
+      VExpr.instTelN a (view.specializedFields levels params) k := by
+  simpa [specializedFields] using
+    specializedFieldsAux_instN view.fields levels params view.nparams
+      0 k a hparams
+      (fun j field hfield => by
+        simpa using self.field_closed henv hfield)
+
+private theorem projectionLevels_length (view : VStructureView)
+    (fieldSort : VLevel) (levels : List VLevel)
+    (hlevels : levels.length = view.uvars) :
+    (view.projectionLevels fieldSort levels).length =
+      view.generation.recUvars := by
+  unfold projectionLevels
+  cases h : view.generation.elimination <;>
+    simp [VInductDecl.GenerationChecked.recUvars,
+      VInductDecl.ElimMode.recUvars, h, hlevels]
+
+private theorem projectionLevels_wf (view : VStructureView)
+    {U : Nat} (fieldSort : VLevel) (levels : List VLevel)
+    (hfieldSort : fieldSort.WF U)
+    (hlevels : ∀ level ∈ levels, level.WF U) :
+    ∀ level ∈ view.projectionLevels fieldSort levels, level.WF U := by
+  unfold projectionLevels
+  cases view.generation.elimination <;> simp_all
+
+private theorem sourceLevels_projectionLevels (view : VStructureView)
+    (fieldSort : VLevel) (levels : List VLevel)
+    (hlevels : levels.length = view.uvars) :
+    view.generation.sourceLevels.map
+        (VLevel.inst (view.projectionLevels fieldSort levels)) = levels := by
+  unfold VInductDecl.GenerationChecked.sourceLevels
+  unfold VInductDecl.ElimMode.sourceLevels projectionLevels
+  cases h : view.generation.elimination
+  ·
+    change (VLevel.params' view.uvars 1).map
+      (VLevel.inst (fieldSort :: levels)) = levels
+    have hshift :
+        (VLevel.params' view.uvars 1).map
+            (VLevel.inst (fieldSort :: levels)) =
+          (VLevel.params view.uvars).map (VLevel.inst levels) := by
+      simp [VLevel.params', VLevel.params, List.map_map,
+        Function.comp_def, VLevel.inst,
+        List.getD_eq_getElem?_getD]
+    rw [hshift]
+    exact VLevel.inst_map_id hlevels
+  ·
+    change (VLevel.params' view.uvars 0).map
+      (VLevel.inst levels) = levels
+    have hzero : VLevel.params' view.uvars 0 =
+        VLevel.params view.uvars := by
+      simp [VLevel.params', VLevel.params]
+    rw [hzero]
+    exact VLevel.inst_map_id hlevels
+
+private theorem motiveLevel_projectionLevels (view : VStructureView)
+    (fieldSort : VLevel) (levels : List VLevel) :
+    view.generation.motiveLevel.inst
+        (view.projectionLevels fieldSort levels) =
+      match view.generation.elimination with
+      | .large => fieldSort
+      | .small => .zero := by
+  unfold VInductDecl.GenerationChecked.motiveLevel
+  unfold VInductDecl.ElimMode.motiveLevel projectionLevels
+  cases view.generation.elimination <;> rfl
+
+private theorem WF.motiveLevel_projectionLevels
+    (self : VStructureView.WF view env)
+    (fieldSort : VLevel) (hfieldSort : fieldSort ∈ view.fieldSorts)
+    (levels : List VLevel) :
+    view.generation.motiveLevel.inst
+        (view.projectionLevels (fieldSort.inst levels) levels) =
+      fieldSort.inst levels := by
+  rw [VStructureView.motiveLevel_projectionLevels]
+  cases hmode : view.generation.elimination with
+  | large => rfl
+  | small =>
+      rw [self.smallFields hmode fieldSort hfieldSort]
+      rfl
+
+@[simp] theorem WF.projectionCodes_liftN
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    (levels : List VLevel) (params : List VExpr)
+    (hparams : params.length = view.nparams) (n k : Nat) :
+    (view.projectionCodes levels params).map
+        (fun code => code.liftN n k) =
+      view.projectionCodes levels
+        (params.map fun param => param.liftN n k) := by
+  unfold projectionCodes
+  rw [self.specializedFields_liftN henv levels params hparams n k]
+  rw [← structureType_liftN]
+  apply projectionCodes.go_liftN
+  · rfl
+  · simp
+
+@[simp] theorem WF.projectionCodes_instN
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    (levels : List VLevel) (params : List VExpr)
+    (hparams : params.length = view.nparams) (a : VExpr) (k : Nat) :
+    (view.projectionCodes levels params).map
+        (fun code => code.instN a k) =
+      view.projectionCodes levels
+        (params.map fun param => param.inst a k) := by
+  unfold projectionCodes
+  rw [self.specializedFields_instN henv levels params hparams a k]
+  rw [← structureType_instN]
+  apply projectionCodes.go_instN
+  · rfl
+  · simp
+
+/-- The exact lower-layer structure-eta descriptor generated by a checked
+structure view.  Its projector syntax is the deterministic projector program
+list already certified by the view; the proof fields are only the three
+syntactic naturality laws required by Theory transport. -/
+def WF.toStructEta (self : VStructureView.WF view env)
+    (henv : env.Ordered) : VStructEta where
+  uvars := view.uvars
+  nparams := view.nparams
+  nfields := view.fields.length
+  familyName := view.name
+  familyType := view.familyType
+  constructorName := view.constructorName
+  projectors := fun levels params =>
+    (view.projectionCodes levels params).map (·.projector)
+  projectors_length := by
+    intro levels params _ _
+    simp [VStructureView.specializedFields, VStructureView.fields]
+  projectors_liftN := by
+    intro levels params n k hparams
+    have h := self.projectionCodes_liftN henv levels params hparams n k
+    simpa [List.map_map, ProjectionCode.liftN, Function.comp_def] using
+      congrArg (List.map (·.projector)) h
+  projectors_instN := by
+    intro levels params a k hparams
+    have h := self.projectionCodes_instN henv levels params hparams a k
+    simpa [List.map_map, ProjectionCode.instN, Function.comp_def] using
+      congrArg (List.map (·.projector)) h
+  projectors_instL := by
+    intro levels params ls
+    have h := projectionCodes_instL view levels params ls
+    simpa [List.map_map, ProjectionCode.instL, Function.comp_def] using
+      congrArg (List.map (·.projector)) h
+
+@[simp] theorem WF.toStructEta_structureType
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    (levels : List VLevel) (params : List VExpr) :
+    (self.toStructEta henv).structureType levels params =
+      view.structureType levels params := rfl
+
+@[simp] theorem WF.toStructEta_rebuild
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    (levels : List VLevel) (params : List VExpr) (major : VExpr) :
+    (self.toStructEta henv).rebuild levels params major =
+      view.etaRebuild levels params major := by
+  simp only [VStructEta.rebuild, VStructEta.projectionArgs, WF.toStructEta,
+    VStructureView.etaRebuild, VStructureView.projectionArgs]
+  rw [← view.projectionCodes_length levels params, List.take_length]
+  simp [List.map_map, Function.comp_def]
+
+end VStructureView
+
+namespace VEnv
+
+/-- Registered checked views supply the former semantic structure-eta
+capability.  The registry contributes only membership; subject reduction is
+recovered from the ordered environment, and the equality itself is the
+primitive `IsDefEq.structEta` step. -/
+theorem hasStructureEta_of_registry (henv : env.Ordered)
+    (registered : ∀ (view : VStructureView)
+      (hview : view.WF env) (_ : view.ProgramsWF env),
+      env.structEtas (hview.toStructEta henv)) :
+    env.HasStructureEta := by
+  intro view hview programs U Γ levels params major hΓ hlevels
+    hlevelsLength hparamsLength hparamsSpine hmajor
+  let rule := hview.toStructEta henv
+  have hregistered : env.structEtas rule := registered view hview programs
+  have hruleWF : rule.WF env := henv.structEtaWF hregistered
+  obtain ⟨resultLevel, hparamsSpine⟩ := hparamsSpine
+  have hrebuild := hruleWF.rebuild_hasType VEnv.LE.rfl hΓ hlevels
+    hlevelsLength hparamsLength ⟨resultLevel, hparamsSpine⟩ hmajor
+  have heta := IsDefEq.structEta hregistered hlevels hlevelsLength
+    hparamsLength hparamsSpine hmajor hrebuild
+  simpa [rule] using heta
+
+private theorem SpineWF.monoProjection {env env' : VEnv}
+    (henv : env ≤ env') :
+    ∀ {A es B}, env.SpineWF U Γ A es B → env'.SpineWF U Γ A es B
+  | _, _, _, h => h.mono henv
+
+/-- The view-facing direction of `TelDefEq.spine_sort`: arguments checked
+against the retained raw telescope also consume its definitionally equal
+view telescope. -/
+theorem TelDefEq.spine_sort_view
+    {env : VEnv} {U : Nat} (henv : env.Ordered) :
+    ∀ {Γ As As' es l}, env.TelDefEq U Γ As As' →
+      env.SpineWF U Γ (VExpr.forallN As (.sort l)) es (.sort l) →
+      es.length = As.length →
+      env.SpineWF U Γ (VExpr.forallN As' (.sort l)) es (.sort l)
+  | _, [], [], [], _, _, hspine, _ => by simpa using hspine
+  | _, [], [], _ :: _, _, _, _, hlen => by simp at hlen
+  | Γ, A :: As, A' :: As', e :: es, l, ⟨⟨_, hA⟩, hT⟩,
+      .cons he hrest, hlen => by
+    have heView : env.HasType U Γ e A' := hA.defeq he
+    have hTinst := TelDefEq.instN henv he (.zero) hT
+    have hrest' : env.SpineWF U Γ
+        (VExpr.forallN (VExpr.instTelN e As 0) (.sort l))
+        es (.sort l) := by
+      simpa [VExpr.instN_forallN, VExpr.inst] using hrest
+    have hlen' : es.length = As.length := by simpa using hlen
+    have hlenInst :
+        es.length = (VExpr.instTelN e As 0).length := by
+      rw [VExpr.instTelN_length]
+      exact hlen'
+    have hout := TelDefEq.spine_sort_view henv
+      hTinst hrest' hlenInst
+    refine .cons heView ?_
+    simpa [VExpr.instN_forallN, VExpr.inst] using hout
+
+/-- Parameters accepted by the structure family also consume the stored raw
+constructor parameter prefix.  This is the semantic bridge used by the
+kernel projection checker before it traverses the constructor fields. -/
+theorem _root_.Ix.Theory.Named.VStructureView.WF.constructorParamsSpine
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    {U : Nat} {Γ : List VExpr} (levels : List VLevel)
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (_hlevelsLength : levels.length = view.uvars)
+    (params : List VExpr) (hparamsLength : params.length = view.nparams)
+    (paramsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    (target : VExpr) :
+    env.SpineWF U Γ
+      (VExpr.forallN
+        (view.constructorParams.map (VExpr.instL levels))
+        target) params (VExpr.instRev target params) := by
+  let S := self.toGenerationEnv henv
+  obtain ⟨resultLevel, hspine⟩ := paramsSpine
+  have hrawLength :
+      view.generation.block.rawParams.length = view.nparams :=
+    view.generation.shape.1
+  have hspineShape : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (view.generation.block.rawResult.instL levels))
+      params (.sort resultLevel) := by
+    simpa [VStructureView.familyType,
+      VInductDecl.NormalizedChecked.rawType_eq,
+      view.raw_indices_eq, VExpr.instL_forallN,
+      VExpr.forallN] using hspine
+  have hparamsRaw : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (.sort .zero)) params (.sort .zero) := by
+    have hout := hspineShape.retarget
+      (by simpa [hrawLength] using hparamsLength) (.sort .zero)
+    rw [VExpr.instRev_closedN params (by trivial)] at hout
+    exact hout
+  have hfamilyDefEq := S.rawParams_defeq.instL hlevels
+  have hrawLift : VExpr.liftTelN Γ.length
+      (view.generation.block.rawParams.map (VExpr.instL levels)) 0 =
+      view.generation.block.rawParams.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      hfamilyDefEq.raw_onTel (by trivial) Γ.length
+  have hcheckedLift : VExpr.liftTelN Γ.length
+      (view.generation.block.checked.params.map (VExpr.instL levels)) 0 =
+      view.generation.block.checked.params.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      (hfamilyDefEq.view_onTel henv) (by trivial) Γ.length
+  have hfamilyDefEqΓ := hfamilyDefEq.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hrawLift, hcheckedLift] at hfamilyDefEqΓ
+  simp only [List.append_nil] at hfamilyDefEqΓ
+  have hparamsChecked : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.checked.params.map (VExpr.instL levels))
+        (.sort .zero)) params (.sort .zero) :=
+    TelDefEq.spine_sort_view henv hfamilyDefEqΓ hparamsRaw
+      (by simpa [hrawLength] using hparamsLength)
+  have hconstructorMem :
+      view.constructor ∈ view.generation.block.ctorPairs := by
+    simp [view.constructor_eq]
+  have hconstructorShape :=
+    view.generation.shape.2.2.2.2.2 view.constructor hconstructorMem
+  have hconstructorDefEq₀ :=
+    ((S.ctorWF view.constructor hconstructorMem).declaredTel.take
+      view.nparams).instL hlevels
+  have hconstructorDefEq : env.TelDefEq U []
+      (view.constructorParams.map (VExpr.instL levels))
+      (view.generation.block.checked.params.map (VExpr.instL levels)) := by
+    simpa [VStructureView.constructorParams,
+      VInductDecl.NormalizedCtor.declaredBinders,
+      VInductDecl.NormalizedCtor.viewBinders,
+      hconstructorShape.2.2.1, self.parameters_length] using
+        hconstructorDefEq₀
+  have hconstructorRawLift : VExpr.liftTelN Γ.length
+      (view.constructorParams.map (VExpr.instL levels)) 0 =
+      view.constructorParams.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      hconstructorDefEq.raw_onTel (by trivial) Γ.length
+  have hconstructorCheckedLift : VExpr.liftTelN Γ.length
+      (view.generation.block.checked.params.map (VExpr.instL levels)) 0 =
+      view.generation.block.checked.params.map (VExpr.instL levels) :=
+    hcheckedLift
+  have hconstructorDefEqΓ := hconstructorDefEq.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hconstructorRawLift, hconstructorCheckedLift] at hconstructorDefEqΓ
+  simp only [List.append_nil] at hconstructorDefEqΓ
+  have hout := TelDefEq.spine_sort henv hconstructorDefEqΓ hparamsChecked
+    (by simpa [VStructureView.constructorParams] using
+      hparamsLength.trans hconstructorShape.2.2.1.symm)
+  exact hout.retarget
+    (by simpa [VStructureView.constructorParams] using
+      hparamsLength.trans hconstructorShape.2.2.1.symm) target
+
+/-- Recover the structure-family parameter spine from the corresponding
+constructor-parameter prefix.  This is the converse consumer bridge needed
+when a checker recognizes a fully applied constructor before it knows the
+family application carried by its result type. -/
+theorem _root_.Ix.Theory.Named.VStructureView.WF.familyParamsSpine_of_constructor
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    {U : Nat} {Γ : List VExpr} (levels : List VLevel)
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (_hlevelsLength : levels.length = view.uvars)
+    (params : List VExpr) (hparamsLength : params.length = view.nparams)
+    {target cursor : VExpr}
+    (constructorSpine : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.constructorParams.map (VExpr.instL levels)) target)
+      params cursor)
+    (resultLevel : VLevel)
+    (hresult : view.generation.block.rawResult = .sort resultLevel) :
+    env.SpineWF U Γ (view.familyType.instL levels) params
+      (.sort (resultLevel.inst levels)) := by
+  let S := self.toGenerationEnv henv
+  have hrawLength :
+      view.generation.block.rawParams.length = view.nparams :=
+    view.generation.shape.1
+  have hconstructorMem :
+      view.constructor ∈ view.generation.block.ctorPairs := by
+    simp [view.constructor_eq]
+  have hconstructorShape :=
+    view.generation.shape.2.2.2.2.2 view.constructor hconstructorMem
+  have hconstructorLength : params.length =
+      (view.constructorParams.map (VExpr.instL levels)).length := by
+    simpa [VStructureView.constructorParams] using
+      hparamsLength.trans hconstructorShape.2.2.1.symm
+  have hparamsConstructor : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.constructorParams.map (VExpr.instL levels)) (.sort .zero))
+      params (.sort .zero) := by
+    have hout := constructorSpine.retarget hconstructorLength (.sort .zero)
+    rw [VExpr.instRev_closedN params (by trivial)] at hout
+    exact hout
+  have hfamilyDefEq := S.rawParams_defeq.instL hlevels
+  have hrawLift : VExpr.liftTelN Γ.length
+      (view.generation.block.rawParams.map (VExpr.instL levels)) 0 =
+      view.generation.block.rawParams.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      hfamilyDefEq.raw_onTel (by trivial) Γ.length
+  have hcheckedLift : VExpr.liftTelN Γ.length
+      (view.generation.block.checked.params.map (VExpr.instL levels)) 0 =
+      view.generation.block.checked.params.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      (hfamilyDefEq.view_onTel henv) (by trivial) Γ.length
+  have hfamilyDefEqΓ := hfamilyDefEq.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hrawLift, hcheckedLift] at hfamilyDefEqΓ
+  simp only [List.append_nil] at hfamilyDefEqΓ
+  have hconstructorDefEq₀ :=
+    ((S.ctorWF view.constructor hconstructorMem).declaredTel.take
+      view.nparams).instL hlevels
+  have hconstructorDefEq : env.TelDefEq U []
+      (view.constructorParams.map (VExpr.instL levels))
+      (view.generation.block.checked.params.map (VExpr.instL levels)) := by
+    simpa [VStructureView.constructorParams,
+      VInductDecl.NormalizedCtor.declaredBinders,
+      VInductDecl.NormalizedCtor.viewBinders,
+      hconstructorShape.2.2.1, self.parameters_length] using
+        hconstructorDefEq₀
+  have hconstructorRawLift : VExpr.liftTelN Γ.length
+      (view.constructorParams.map (VExpr.instL levels)) 0 =
+      view.constructorParams.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      hconstructorDefEq.raw_onTel (by trivial) Γ.length
+  have hconstructorDefEqΓ := hconstructorDefEq.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hconstructorRawLift, hcheckedLift] at hconstructorDefEqΓ
+  simp only [List.append_nil] at hconstructorDefEqΓ
+  have hparamsChecked : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.checked.params.map (VExpr.instL levels))
+        (.sort .zero)) params (.sort .zero) :=
+    VEnv.TelDefEq.spine_sort_view henv hconstructorDefEqΓ
+      hparamsConstructor hconstructorLength
+  have hrawParamsLength : params.length =
+      (view.generation.block.rawParams.map (VExpr.instL levels)).length := by
+    simpa [hrawLength] using hparamsLength
+  have hparamsRaw : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (.sort .zero)) params (.sort .zero) :=
+    VEnv.TelDefEq.spine_sort henv hfamilyDefEqΓ hparamsChecked
+      hrawParamsLength
+  have hout := hparamsRaw.retarget hrawParamsLength
+    (.sort (resultLevel.inst levels))
+  rw [VExpr.instRev_closedN params (by trivial)] at hout
+  simpa [VStructureView.familyType,
+    VInductDecl.NormalizedChecked.rawType_eq,
+    view.raw_indices_eq, hresult, VExpr.instL_forallN,
+    VExpr.forallN, VExpr.instL] using hout
+
+theorem _root_.Ix.Theory.Named.VStructureView.WF.specializedFields_onSortTel
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    {U : Nat} {Γ : List VExpr} (levels : List VLevel)
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (_hlevelsLength : levels.length = view.uvars)
+    (params : List VExpr) (hparamsLength : params.length = view.nparams)
+    (paramsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel)) :
+    env.OnSortTel U Γ (view.specializedFields levels params)
+      (view.fieldSorts.map (VLevel.inst levels)) := by
+  let S := self.toGenerationEnv henv
+  obtain ⟨resultLevel, hspine⟩ := paramsSpine
+  have hrawLength :
+      view.generation.block.rawParams.length = view.nparams :=
+    view.generation.shape.1
+  have hspineShape : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (view.generation.block.rawResult.instL levels))
+      params (.sort resultLevel) := by
+    simpa [VStructureView.familyType,
+      VInductDecl.NormalizedChecked.rawType_eq,
+      view.raw_indices_eq, VExpr.instL_forallN,
+      VExpr.forallN] using hspine
+  have hparamsRaw : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (.sort resultLevel)) params (.sort resultLevel) := by
+    have hout := hspineShape.retarget
+      (by simpa [hrawLength] using hparamsLength)
+      (.sort resultLevel)
+    rw [VExpr.instRev_closedN params (by trivial)] at hout
+    exact hout
+  have hrawChecked := S.rawParams_defeq.instL hlevels
+  have hrawLift := VEnv.OnTel.liftTelN_eq henv
+    hrawChecked.raw_onTel (by trivial) Γ.length
+  have hcheckedLift := VEnv.OnTel.liftTelN_eq henv
+    (hrawChecked.view_onTel henv) (by trivial) Γ.length
+  have hrawLift' : VExpr.liftTelN Γ.length
+      (view.generation.block.rawParams.map (VExpr.instL levels)) 0 =
+      view.generation.block.rawParams.map (VExpr.instL levels) := by
+    simpa using hrawLift
+  have hcheckedLift' : VExpr.liftTelN Γ.length
+      (view.generation.block.checked.params.map (VExpr.instL levels)) 0 =
+      view.generation.block.checked.params.map (VExpr.instL levels) := by
+    simpa using hcheckedLift
+  have hrawCheckedΓ := hrawChecked.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hrawLift', hcheckedLift'] at hrawCheckedΓ
+  simp only [List.append_nil] at hrawCheckedΓ
+  have hparamsChecked : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.checked.params.map
+          (VExpr.instL levels)) (.sort resultLevel))
+      params (.sort resultLevel) := by
+    exact TelDefEq.spine_sort_view henv hrawCheckedΓ hparamsRaw
+      (by simpa [hrawLength] using hparamsLength)
+  have hfields := self.fieldTelescope.instL hlevels
+  have hcheckedParams := self.parameters.instL hlevels
+  have Wparams := Ctx.LiftN.consTel
+    (view.generation.block.checked.params.map (VExpr.instL levels))
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hcheckedLift'] at Wparams
+  have hcheckedCtx : OnCtx
+      (view.generation.block.checked.params.reverse.map
+        (VExpr.instL levels)) (env.IsType U) := by
+    simpa [List.map_reverse] using
+      VEnv.OnTel.toOnCtx hcheckedParams (by trivial)
+  have hfieldLift := VEnv.OnSortTel.liftTelN_eq henv hfields
+    (VEnv.CtxWF.closed henv hcheckedCtx) Γ.length
+  have hfieldsΓ := VEnv.OnSortTel.weakN henv
+    (by simpa [List.map_reverse] using Wparams) hfields
+  simp only [List.length_reverse, List.length_map] at hfieldLift
+  rw [hfieldLift] at hfieldsΓ
+  have hspecialized := VEnv.OnSortTel.instRevParams henv
+    hparamsChecked (by simpa [self.parameters_length] using hparamsLength)
+    (by simpa [List.map_reverse] using hfieldsΓ)
+  rw [VExpr.instRevAt_map_instL_zipIdx] at hspecialized
+  simpa [VStructureView.specializedFields] using hspecialized
+
+private theorem _root_.Ix.Theory.Named.VStructureView.WF.generationParamsSpine
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    {U : Nat} {Γ : List VExpr} (levels : List VLevel)
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    (params : List VExpr) (hparamsLength : params.length = view.nparams)
+    (paramsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    (fieldSort : VLevel) :
+    env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.paramsTel.map
+          (VExpr.instL
+            (view.projectionLevels fieldSort levels)))
+        (.sort fieldSort)) params (.sort fieldSort) := by
+  let S := self.toGenerationEnv henv
+  obtain ⟨resultLevel, hspine⟩ := paramsSpine
+  have hrawLength :
+      view.generation.block.rawParams.length = view.nparams :=
+    view.generation.shape.1
+  have hspineShape : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (view.generation.block.rawResult.instL levels))
+      params (.sort resultLevel) := by
+    simpa [VStructureView.familyType,
+      VInductDecl.NormalizedChecked.rawType_eq,
+      view.raw_indices_eq, VExpr.instL_forallN,
+      VExpr.forallN] using hspine
+  have hparamsRaw : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.rawParams.map (VExpr.instL levels))
+        (.sort fieldSort)) params (.sort fieldSort) := by
+    have hout := hspineShape.retarget
+      (by simpa [hrawLength] using hparamsLength) (.sort fieldSort)
+    rw [VExpr.instRev_closedN params (by trivial)] at hout
+    exact hout
+  have hrawChecked := S.rawParams_defeq.instL hlevels
+  have hrawLift : VExpr.liftTelN Γ.length
+      (view.generation.block.rawParams.map (VExpr.instL levels)) 0 =
+      view.generation.block.rawParams.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      hrawChecked.raw_onTel (by trivial) Γ.length
+  have hcheckedLift : VExpr.liftTelN Γ.length
+      (view.generation.block.checked.params.map (VExpr.instL levels)) 0 =
+      view.generation.block.checked.params.map (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      (hrawChecked.view_onTel henv) (by trivial) Γ.length
+  have hrawCheckedΓ := hrawChecked.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hrawLift, hcheckedLift] at hrawCheckedΓ
+  simp only [List.append_nil] at hrawCheckedΓ
+  have hparamsChecked : env.SpineWF U Γ
+      (VExpr.forallN
+        (view.generation.block.checked.params.map
+          (VExpr.instL levels)) (.sort fieldSort))
+      params (.sort fieldSort) :=
+    TelDefEq.spine_sort_view henv hrawCheckedΓ hparamsRaw
+      (by simpa [hrawLength] using hparamsLength)
+  have hgenerationChecked := S.generationParams_defeq.instL hlevels
+  have hgenerationLift : VExpr.liftTelN Γ.length
+      (view.generation.block.generationParams.map
+        (VExpr.instL levels)) 0 =
+      view.generation.block.generationParams.map
+        (VExpr.instL levels) := by
+    simpa using VEnv.OnTel.liftTelN_eq henv
+      hgenerationChecked.raw_onTel (by trivial) Γ.length
+  have hcheckedLift₂ : VExpr.liftTelN Γ.length
+      (view.generation.block.checked.params.map
+        (VExpr.instL levels)) 0 =
+      view.generation.block.checked.params.map
+        (VExpr.instL levels) := hcheckedLift
+  have hgenerationCheckedΓ := hgenerationChecked.weakN henv
+    (Ctx.LiftN.zero (n := Γ.length) (Γ := []) Γ)
+  rw [hgenerationLift, hcheckedLift₂] at hgenerationCheckedΓ
+  simp only [List.append_nil] at hgenerationCheckedΓ
+  have hparamsGeneration := TelDefEq.spine_sort henv
+    hgenerationCheckedΓ hparamsChecked
+    (by simpa [S.generationParams_length] using hparamsLength)
+  have hsource := VStructureView.sourceLevels_projectionLevels
+    view fieldSort levels
+    hlevelsLength
+  have hparamsTel :
+      view.generation.paramsTel.map
+          (VExpr.instL (view.projectionLevels fieldSort levels)) =
+        view.generation.block.generationParams.map
+          (VExpr.instL levels) := by
+    simp [VInductDecl.GenerationChecked.paramsTel,
+      List.map_map, Function.comp_def, VExpr.instL_instL, hsource]
+  rw [hparamsTel]
+  exact hparamsGeneration
+
+theorem _root_.Ix.Theory.Named.VStructureView.WF.recursorProjection_hasType
+    (self : VStructureView.WF view env) (henv : env.Ordered)
+    {U : Nat} {Γ : List VExpr} (levels : List VLevel)
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    (params : List VExpr) (hparamsLength : params.length = view.nparams)
+    (paramsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    (fieldSort : VLevel)
+    (hfieldSort : fieldSort.WF U)
+    (hmotiveLevel :
+      view.generation.motiveLevel.inst
+          (view.projectionLevels fieldSort levels) = fieldSort)
+    (_structIsType : env.IsType U Γ
+      (view.structureType levels params))
+    {typeFn minor major : VExpr}
+    (typeFnType : env.HasType U Γ typeFn
+      (.forallE (view.structureType levels params) (.sort fieldSort)))
+    (minorType : env.HasType U Γ minor
+      (view.projectionMinorType levels params
+        (view.specializedFields levels params) typeFn))
+    (majorType : env.HasType U Γ major
+      (view.structureType levels params)) :
+    env.HasType U Γ
+      (VExpr.appN (.const view.recursorName
+        (view.projectionLevels fieldSort levels))
+        (params ++ [typeFn, minor, major]))
+      (.app typeFn major) := by
+  let gen := view.generation
+  let S := self.toGenerationEnv henv
+  let pLevels := view.projectionLevels fieldSort levels
+  let k := gen.block.ctorPairs.length
+  let ni := gen.idxTel.length
+  let recRest : VExpr :=
+    VExpr.forallN gen.minorTypes <|
+      VExpr.forallN (VExpr.liftTelN (k + 1) gen.idxTel 0) <|
+        .forallE
+          (VExpr.appN (.const gen.block.sourceType.name gen.sourceLevels)
+            (VExpr.bvarRevRange (ni + k + 1) view.nparams ++
+              VExpr.bvarRevRange 0 ni))
+          (.app
+            (VExpr.appN (.bvar (ni + k + 1))
+              (VExpr.bvarRevRange 1 ni))
+            (.bvar 0))
+  let recTail : VExpr := .forallE gen.motiveType recRest
+  have hrec : env.HasType U Γ
+      (.const view.recursorName pLevels)
+      ((VExpr.forallN gen.paramsTel recTail).instL pLevels) := by
+    have hout := VEnv.HasType.const (Γ := Γ) self.recursor
+      (VStructureView.projectionLevels_wf view fieldSort levels
+        hfieldSort hlevels)
+      (VStructureView.projectionLevels_length view fieldSort levels
+        hlevelsLength)
+    simpa [gen, pLevels, recTail, recRest, k, ni,
+      VStructureView.recursorName,
+      VInductDecl.GenerationChecked.recursor,
+      VInductDecl.GenerationChecked.recType] using hout
+  have hparams := self.generationParamsSpine henv levels hlevels
+    hlevelsLength params hparamsLength paramsSpine fieldSort
+  have hparamsTelLength : params.length =
+      (gen.paramsTel.map (VExpr.instL pLevels)).length := by
+    simp [gen, VInductDecl.GenerationChecked.paramsTel,
+      S.generationParams_length, hparamsLength]
+  have hparamsFull := hparams.retarget hparamsTelLength
+    (recTail.instL pLevels)
+  have hparamsFull' : env.SpineWF U Γ
+      ((VExpr.forallN gen.paramsTel recTail).instL pLevels)
+      params (VExpr.instRev (recTail.instL pLevels) params) := by
+    simpa [VExpr.instL_forallN] using hparamsFull
+  have hmotiveShape :
+      VExpr.instRev (recTail.instL pLevels) params =
+        .forallE
+          (.forallE (view.structureType levels params) (.sort fieldSort))
+          (VExpr.instRevAt (recRest.instL pLevels) params 1) := by
+    change VExpr.instRev
+      (.forallE (gen.motiveType.instL pLevels)
+        (recRest.instL pLevels)) params = _
+    have hconst : VExpr.instRev
+        (.const view.generation.block.sourceType.name levels) params =
+        .const view.generation.block.sourceType.name levels :=
+      VExpr.instRev_closedN params (by trivial)
+    have hrange :
+        (VExpr.bvarRevRange 0 view.source.nparams).map
+            (VExpr.instRev · params) = params := by
+      have hparamsLength' : params.length = view.source.nparams :=
+        hparamsLength
+      rw [← hparamsLength']
+      exact VExpr.map_instRev_bvarRevRange params
+    have hrangeL :
+        (VExpr.bvarRevRange 0 view.source.nparams).map
+            (fun x => (x.instL pLevels).instRev params) = params := by
+      calc
+        _ = ((VExpr.bvarRevRange 0 view.source.nparams).map
+              (VExpr.instL pLevels)).map (VExpr.instRev · params) := by
+            rw [List.map_map]
+            rfl
+        _ = params := by
+          rw [VExpr.bvarRevRange_map_instL]
+          exact hrange
+    have hsort :
+        (VExpr.sort fieldSort).instRevAt params 1 =
+          .sort fieldSort :=
+      VExpr.instRevAt_closedN params (by trivial)
+    rw [VExpr.instRev_forallE_projection]
+    congr 1
+    simp [gen, pLevels,
+      VInductDecl.GenerationChecked.motiveType,
+      VInductDecl.GenerationChecked.idxTel,
+      view.raw_indices_eq, VExpr.forallN, VExpr.bvarRevRange,
+      VExpr.instL, VExpr.instL_appN,
+      VExpr.instRev_forallE_projection,
+      VExpr.instRev_appN, Function.comp_def,
+      hconst, hrangeL, hsort, hmotiveLevel,
+      VStructureView.structureType,
+      VStructureView.sourceLevels_projectionLevels view fieldSort levels
+        hlevelsLength]
+  rw [hmotiveShape] at hparamsFull'
+  have hwithMotive := hparamsFull'.snoc typeFnType
+  have hconstructorMem :
+      view.constructor ∈ view.generation.block.ctorPairs := by
+    simp [view.constructor_eq]
+  have hresultIndices : view.constructor.view.resultIndices = [] := by
+    apply List.length_eq_zero_iff.1
+    rw [S.viewResultIndices_length hconstructorMem]
+    simp [view.checked_indices_eq]
+  have hminorShape :
+      ((VExpr.instRevAt (recRest.instL pLevels) params 1).inst typeFn) =
+        .forallE (view.projectionMinorType levels params
+            (view.specializedFields levels params) typeFn)
+          (.forallE (view.structureType levels params).lift
+            (.app (typeFn.liftN 2) (.bvar 0))) := by
+    simp [gen, pLevels, recRest, k, ni, VInductDecl.GenerationChecked.minorTypes,
+      VInductDecl.GenerationChecked.minorTypesAux, VInductDecl.GenerationChecked.minorType,
+      VInductDecl.GenerationChecked.idxTel, VInductDecl.NormalizedCtor.fieldsR,
+      VInductDecl.NormalizedCtor.recArgsR, VInductDecl.NormalizedCtor.resultIndicesR,
+      VInductDecl.ihsFromRecArgs, VStructureView.projectionMinorType,
+      VStructureView.projectionConstructorApp, view.constructor_eq, view.raw_indices_eq,
+      hresultIndices, view.recursive_eq, VExpr.instL_forallN, VExpr.instL_appN,
+      VExpr.liftTelN_instL, VExpr.instL_instL, VExpr.instN_forallN, VExpr.instTelN,
+      VExpr.instRevAt_forallN_projection, List.map_append, VExpr.bvarRevRange, List.map_append,
+      List.map_map, Function.comp_def,
+      VStructureView.sourceLevels_projectionLevels view fieldSort levels hlevelsLength]
+    change VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · have hfieldTel :=
+        VExpr.instTelN_instRevAt_lift_projection
+          ((view.constructor.rawFields view.source.nparams).map
+            (VExpr.instL levels)) params typeFn 0
+      rw [VExpr.instRevAt_map_instL_zipIdx] at hfieldTel
+      have hfieldTel' :
+          VExpr.instTelN typeFn
+              ((VExpr.liftTelN 1
+                  ((view.constructor.rawFields view.source.nparams).map
+                    (VExpr.instL levels)) 0).zipIdx 1 |>.map
+                fun x => x.1.instRevAt params x.2) 0 =
+            view.specializedFields levels params := by
+        simpa [VStructureView.specializedFields,
+          VStructureView.fields] using hfieldTel
+      rw [hfieldTel']
+      congr 1
+      have hsourceLevels :=
+        VStructureView.sourceLevels_projectionLevels view fieldSort levels
+          hlevelsLength
+      change
+        (VLevel.params' view.source.uvars
+            view.generation.elimination.offset).map
+              (VLevel.inst pLevels) = levels at hsourceLevels
+      have hliftedLength :
+          (VExpr.liftTelN 1
+              ((view.constructor.rawFields view.source.nparams).map
+                (VExpr.instL levels)) 0).length =
+            (view.constructor.rawFields view.source.nparams).length := by
+        rw [VExpr.liftTelN_length]
+        simp
+      have hspecializedLength :
+          (view.specializedFields levels params).length =
+            (view.constructor.rawFields view.source.nparams).length := by
+        simp [VStructureView.specializedFields,
+          VStructureView.fields]
+      simp only [VExpr.forallN, VExpr.instL, VExpr.bvarRevRange_map_instL, hliftedLength,
+        hspecializedLength]
+      rw [hsourceLevels]
+      have hbody :=
+        VExpr.projectionMinorBody_shape view.constructorName levels
+          params (view.constructor.rawFields view.source.nparams).length
+          typeFn
+      rw [hparamsLength] at hbody
+      simpa only [Nat.add_comm] using hbody
+    · have hsourceLevels :=
+        VStructureView.sourceLevels_projectionLevels view fieldSort levels
+          hlevelsLength
+      change
+        (VLevel.params' view.source.uvars
+            view.generation.elimination.offset).map
+              (VLevel.inst pLevels) = levels at hsourceLevels
+      simp only [VExpr.forallN, VExpr.liftTelN, List.zipIdx_nil, List.map_nil, VExpr.instTelN,
+        VExpr.instL, VExpr.instL_appN, VExpr.bvarRevRange_map_instL, VExpr.instL]
+      rw [hsourceLevels]
+      simpa [gen, hparamsLength, VStructureView.structureType] using
+        (VExpr.projectionMajorTail_shape view.name levels params typeFn)
+  rw [hminorShape] at hwithMotive
+  have hwithMinor := hwithMotive.snoc minorType
+  have hwithMajor : env.SpineWF U Γ
+      ((VExpr.forallN gen.paramsTel recTail).instL pLevels)
+      (params ++ [typeFn, minor, major]) (.app typeFn major) := by
+    have majorType' : env.HasType U Γ major
+        ((view.structureType levels params).lift.inst minor) := by
+      rw [VExpr.inst_lift]
+      exact majorType
+    have hout := hwithMinor.snoc majorType'
+    have htypeFnMinor :
+        (typeFn.liftN 2).inst minor 1 = typeFn.lift := by
+      rw [← VExpr.liftN_liftN typeFn 1 1,
+        VExpr.instN_liftAt_projection, VExpr.inst_lift]
+    have hminorVar : VExpr.instVar 0 minor 1 = .bvar 0 := by
+      simp [VExpr.instVar]
+    have hresult :
+        (((typeFn.liftN 2).app (.bvar 0)).inst minor 1).inst major =
+          typeFn.app major := by
+      simp only [VExpr.inst]
+      rw [htypeFnMinor, VExpr.inst_lift]
+      rw [hminorVar]
+      simp only [VExpr.inst]
+      rw [VExpr.instVar_zero]
+    rw [hresult] at hout
+    simpa [List.append_assoc] using hout
+  exact hwithMajor.hasType_appN hrec
+
+theorem SpineWF.instNProjection {env : VEnv} {U k : Nat}
+    {Γ₀ Γ₁ Γ : List VExpr} {e₀ A₀ : VExpr}
+    (henv : env.Ordered)
+    (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    ∀ {es : List VExpr} {A B : VExpr}, env.SpineWF U Γ₁ A es B →
+      env.SpineWF U Γ (A.inst e₀ k)
+        (es.map fun e => e.inst e₀ k) (B.inst e₀ k)
+  | _, _, _, h => h.instN henv W h₀
+
+/-- A generated projector computes on the matching generated constructor
+once the registered rule's capture spine has been checked.  This is the
+exact iota layer; constructor-head and parameter-prefix alignment are kept
+outside this theorem. -/
+theorem _root_.Ix.Theory.Named.VStructureView.WF.projector_constructor_exact
+    (self : VStructureView.WF view env) (henv : env.WF)
+    {U : Nat} {Γ : List VExpr} (hΓ : OnCtx Γ (env.IsType U))
+    {levels : List VLevel} (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = view.uvars)
+    {params : List VExpr} (hparamsLength : params.length = view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      env.SpineWF U Γ (view.familyType.instL levels)
+        params (.sort resultLevel))
+    {idx : Nat} {code : VStructureView.ProjectionCode}
+    (hcode : (view.projectionCodes levels params)[idx]? = some code)
+    (hprojector : env.HasType U Γ code.projector
+      (.forallE (view.structureType levels params)
+        (.app code.typeFn.lift (.bvar 0))))
+    {fields : List VExpr} (hfieldsLength :
+      fields.length = (view.specializedFields levels params).length)
+    {field : VExpr} (hfield : fields[idx]? = some field)
+    (hctorType : env.HasType U Γ
+      (VExpr.appN (.const view.constructorName levels) (params ++ fields))
+      (view.structureType levels params))
+    (hfieldsSpine : env.SpineWF U Γ
+      (VExpr.forallN (view.specializedFields levels params) (.sort .zero))
+      fields (.sort .zero))
+    {B : VExpr}
+    (hcaps : env.SpineWF U Γ
+      ((view.generation.rule 0 view.constructor).type.instL
+        (view.projectionLevels code.fieldSort levels))
+      (params ++ [code.typeFn, code.minor] ++ fields) B) :
+    env.IsDefEqU U Γ
+      (.app code.projector
+        (VExpr.appN (.const view.constructorName levels) (params ++ fields)))
+      field := by
+  obtain ⟨fieldSort, hfieldSort, hcodeSort, hminorShape,
+      hprojectorShape⟩ :=
+    view.projectionCodes_get?_program_shape levels params hcode
+  have hsortTel := self.specializedFields_onSortTel henv.ordered
+    levels hlevels hlevelsLength params hparamsLength hparamsSpine
+  have hfieldSortWF : code.fieldSort.WF U := by
+    rw [hcodeSort]
+    exact hsortTel.sortWF hΓ hfieldSort
+  let pLevels := view.projectionLevels code.fieldSort levels
+  have hpLevelsWF : ∀ level ∈ pLevels, level.WF U :=
+    VStructureView.projectionLevels_wf view code.fieldSort levels
+      hfieldSortWF hlevels
+  have hpLevelsLength : pLevels.length = view.generation.recUvars :=
+    VStructureView.projectionLevels_length view code.fieldSort levels
+      hlevelsLength
+  have hruleMem : view.generation.rule 0 view.constructor ∈
+      view.generation.generatedRules := by
+    simp [VInductDecl.GenerationChecked.generatedRules,
+      view.constructor_eq]
+  have hregistered := self.rule_mem hruleMem
+  have hruleWF := henv.ordered.defEqWF hregistered
+  rw [hprojectorShape] at hprojector
+  obtain ⟨_, ⟨projectorBodyType, hprojectorBody⟩⟩ :=
+    hprojector.lam_inv henv.ordered hΓ
+  have hprojectorBeta := VEnv.IsDefEq.beta hprojectorBody hctorType
+  have hprojectorToRule : env.IsDefEqU U Γ
+      (.app code.projector
+        (VExpr.appN (.const view.constructorName levels) (params ++ fields)))
+      (VExpr.appN (.const view.recursorName pLevels)
+        (params ++ [code.typeFn, code.minor,
+          VExpr.appN (.const view.constructorName levels)
+            (params ++ fields)])) := by
+    refine ⟨projectorBodyType.inst
+      (VExpr.appN (.const view.constructorName levels) (params ++ fields)), ?_⟩
+    rw [hprojectorShape]
+    simpa [pLevels, VExpr.inst, VExpr.instN_appN, VExpr.inst_lift,
+      VExpr.instVar_zero,
+      List.map_append, List.map_map, Function.comp_def] using
+        hprojectorBeta
+  let gen := view.generation
+  let Bs := view.constructor.fieldsR view.source.uvars view.source.nparams
+    gen.elimination
+  let m := Bs.length
+  let rs := view.constructor.recArgsR view.source.uvars gen.elimination
+  let binders := gen.paramsTel ++ gen.motiveType :: gen.minorTypes ++
+    VExpr.liftTelN (gen.block.ctorPairs.length + 1) Bs 0
+  let recBase := VExpr.appN
+    (.const (.str gen.block.sourceType.name "rec") gen.recLevels)
+    (VExpr.bvarRevRange m (view.source.nparams +
+      gen.block.ctorPairs.length + 1))
+  let idxR := view.constructor.resultIndicesR view.source.uvars
+    gen.elimination |>.map fun expression =>
+      expression.liftN (gen.block.ctorPairs.length + 1) m
+  let ctorApp := VExpr.appN
+    (.const view.constructor.raw.name gen.sourceLevels)
+    (VExpr.bvarRevRange (m + gen.block.ctorPairs.length + 1)
+        view.source.nparams ++ VExpr.bvarRevRange 0 m)
+  let ihs := rs.map fun recursive =>
+    recursive.ruleCall m gen.block.ctorPairs.length recBase
+  let lhsBody := VExpr.appN recBase (idxR ++ [ctorApp])
+  let rhsBody := VExpr.appN
+    (.bvar (gen.block.ctorPairs.length - 1 - 0 + m))
+    (VExpr.bvarRevRange 0 m ++ ihs)
+  let typeBody := VExpr.appN
+    (.bvar (gen.block.ctorPairs.length + m)) (idxR ++ [ctorApp])
+  have hlhs₀ := hruleWF.1
+  change env.HasType gen.recUvars [] (VExpr.lamN binders lhsBody)
+    (VExpr.forallN binders typeBody) at hlhs₀
+  have hrhs₀ := hruleWF.2
+  change env.HasType gen.recUvars [] (VExpr.lamN binders rhsBody)
+    (VExpr.forallN binders typeBody) at hrhs₀
+  have hlhs : env.HasType U Γ
+      ((VExpr.lamN binders lhsBody).instL pLevels)
+      ((VExpr.forallN binders typeBody).instL pLevels) :=
+    (hlhs₀.instL hpLevelsWF).weak0 henv.ordered
+  have hrhs : env.HasType U Γ
+      ((VExpr.lamN binders rhsBody).instL pLevels)
+      ((VExpr.forallN binders typeBody).instL pLevels) :=
+    (hrhs₀.instL hpLevelsWF).weak0 henv.ordered
+  rw [VExpr.instL_lamN, VExpr.instL_forallN] at hlhs hrhs
+  have hcaps' : env.SpineWF U Γ
+      (VExpr.forallN (binders.map (VExpr.instL pLevels))
+        (typeBody.instL pLevels))
+      (params ++ [code.typeFn, code.minor] ++ fields) B := by
+    change env.SpineWF U Γ
+      ((VExpr.forallN binders typeBody).instL pLevels)
+      (params ++ [code.typeFn, code.minor] ++ fields) B at hcaps
+    simpa only [VExpr.instL_forallN] using hcaps
+  let S := self.toGenerationEnv henv.ordered
+  have hparamsTelLength : gen.paramsTel.length = view.nparams := by
+    simp [gen, VInductDecl.GenerationChecked.paramsTel,
+      S.generationParams_length]
+  have hspecializedLength :
+      (view.specializedFields levels params).length =
+        (view.constructor.rawFields view.nparams).length := by
+    simp [VStructureView.specializedFields, VStructureView.fields]
+  have hBsLength : Bs.length =
+      (view.constructor.rawFields view.nparams).length := by
+    simpa [Bs] using
+      (VInductDecl.NormalizedCtor.fieldsR_length
+        (source := view.source) view.constructor
+        (mode := gen.elimination))
+  have hcapturesLength :
+      (params ++ [code.typeFn, code.minor] ++ fields).length =
+        (binders.map (VExpr.instL pLevels)).length := by
+    simp only [List.length_append, List.length_cons, List.length_nil,
+      List.length_map, VExpr.liftTelN_length, binders]
+    rw [hparamsLength, hfieldsLength, hspecializedLength,
+      hparamsTelLength, gen.minorTypes_length, view.constructor_eq,
+      hBsLength]
+    simp
+  obtain ⟨hlhsTel, lhsType, hlhsBody⟩ :=
+    VEnv.HasType.lamN_wf henv.ordered hΓ hlhs
+  obtain ⟨hrhsTel, rhsType, hrhsBody⟩ :=
+    VEnv.HasType.lamN_wf henv.ordered hΓ hrhs
+  have hlhsSpine := hcaps'.retarget hcapturesLength lhsType
+  have hrhsSpine := hcaps'.retarget hcapturesLength rhsType
+  have hcollapseL := VEnv.IsDefEq.appN_lamN henv.ordered
+    hlhsTel hlhsBody hlhsSpine hcapturesLength
+  have hcollapseR := VEnv.IsDefEq.appN_lamN henv.ordered
+    hrhsTel hrhsBody hrhsSpine hcapturesLength
+  have hregisteredRule : env.IsDefEq U Γ
+      ((view.generation.rule 0 view.constructor).lhs.instL pLevels)
+      ((view.generation.rule 0 view.constructor).rhs.instL pLevels)
+      ((view.generation.rule 0 view.constructor).type.instL pLevels) :=
+    .extra hregistered hpLevelsWF hpLevelsLength
+  have happlied := VEnv.IsDefEq.appN_congr hregisteredRule hcaps
+  rw [show (view.generation.rule 0 view.constructor).lhs =
+      VExpr.lamN binders lhsBody from rfl,
+    show (view.generation.rule 0 view.constructor).rhs =
+      VExpr.lamN binders rhsBody from rfl,
+    VExpr.instL_lamN] at happlied
+  simp only [VExpr.instL_lamN] at happlied
+  have hiotaBodies : env.IsDefEqU U Γ
+      (VExpr.instRev (lhsBody.instL pLevels)
+        (params ++ [code.typeFn, code.minor] ++ fields))
+      (VExpr.instRev (rhsBody.instL pLevels)
+        (params ++ [code.typeFn, code.minor] ++ fields)) :=
+    VEnv.IsDefEqU.trans henv hΓ ⟨_, hcollapseL.symm⟩
+      (VEnv.IsDefEqU.trans henv hΓ ⟨_, happlied⟩ ⟨_, hcollapseR⟩)
+  have hconstructorMem : view.constructor ∈
+      view.generation.block.ctorPairs := by
+    simp [view.constructor_eq]
+  have hresultIndices : view.constructor.view.resultIndices = [] := by
+    apply List.length_eq_zero_iff.1
+    rw [S.viewResultIndices_length hconstructorMem]
+    simp [view.checked_indices_eq]
+  have hfieldsLengthRaw : fields.length = m := by
+    exact hfieldsLength.trans (hspecializedLength.trans hBsLength.symm)
+  have hprefixLength :
+      (params ++ [code.typeFn, code.minor]).length = view.nparams + 2 := by
+    simp [hparamsLength]
+  have hcapturesLength' :
+      (params ++ [code.typeFn, code.minor] ++ fields).length =
+        view.nparams + 2 + m := by
+    simp [hparamsLength, hfieldsLengthRaw]
+    omega
+  have hsegCommon :
+      (VExpr.bvarRevRange m (view.nparams + 2)).map
+          (VExpr.instRev ·
+            (params ++ [code.typeFn, code.minor] ++ fields)) =
+        params ++ [code.typeFn, code.minor] := by
+    have h := VExpr.map_instRev_bvarRevRange_seg
+      (params ++ [code.typeFn, code.minor] ++ fields)
+      (view.nparams + 2) m (by rw [hcapturesLength']; omega)
+    rw [← hparamsLength] at h ⊢
+    rw [show (params ++ [code.typeFn, code.minor] ++ fields).length -
+        m - (params.length + 2) = 0 by
+          simp only [List.length_append, List.length_cons, List.length_nil]
+          rw [hfieldsLengthRaw]
+          omega,
+      List.drop_zero] at h
+    rw [List.take_append,
+      show params.length + 2 =
+        (params ++ [code.typeFn, code.minor]).length by simp,
+      List.take_length] at h
+    simpa using h
+  have hsegParams :
+      (VExpr.bvarRevRange (m + 2) view.nparams).map
+          (VExpr.instRev ·
+            (params ++ [code.typeFn, code.minor] ++ fields)) = params := by
+    have h := VExpr.map_instRev_bvarRevRange_seg
+      (params ++ [code.typeFn, code.minor] ++ fields)
+      view.nparams (m + 2) (by rw [hcapturesLength']; omega)
+    rw [← hparamsLength] at h ⊢
+    rw [show (params ++ [code.typeFn, code.minor] ++ fields).length -
+        (m + 2) - params.length = 0 by
+          simp only [List.length_append, List.length_cons, List.length_nil]
+          rw [hfieldsLengthRaw]
+          omega,
+      List.drop_zero] at h
+    simpa using h
+  have hsegFields :
+      (VExpr.bvarRevRange 0 m).map
+          (VExpr.instRev ·
+            (params ++ [code.typeFn, code.minor] ++ fields)) = fields := by
+    have h := VExpr.map_instRev_bvarRevRange_seg
+      (params ++ [code.typeFn, code.minor] ++ fields) m 0
+      (by rw [hcapturesLength']; omega)
+    rw [show (params ++ [code.typeFn, code.minor] ++ fields).length -
+        0 - m = view.nparams + 2 by rw [hcapturesLength']; omega,
+      show view.nparams + 2 =
+        (params ++ [code.typeFn, code.minor]).length by
+          exact hprefixLength.symm,
+      List.drop_left] at h
+    have htake : fields.take m = fields :=
+      List.take_of_length_le (Nat.le_of_eq hfieldsLengthRaw)
+    rw [htake] at h
+    exact h
+  have hsourceLevels := VStructureView.sourceLevels_projectionLevels
+    view code.fieldSort levels hlevelsLength
+  have hrecLevels : gen.recLevels.map (VLevel.inst pLevels) = pLevels := by
+    exact VLevel.inst_map_id hpLevelsLength
+  have hrecConst :
+      VExpr.instRev
+          ((.const (.str gen.block.sourceType.name "rec") gen.recLevels :
+            VExpr).instL pLevels)
+          (params ++ [code.typeFn, code.minor] ++ fields) =
+        .const view.recursorName pLevels := by
+    rw [VExpr.instRev_closedN _ (by trivial)]
+    simp only [VExpr.instL]
+    rw [hrecLevels]
+    rfl
+  have hsegCommonL :
+      (VExpr.bvarRevRange m (view.nparams + 2)).map
+          (fun expression => VExpr.instRev (expression.instL pLevels)
+            (params ++ [code.typeFn, code.minor] ++ fields)) =
+        params ++ [code.typeFn, code.minor] := by
+    calc
+      _ = ((VExpr.bvarRevRange m (view.nparams + 2)).map
+            (VExpr.instL pLevels)).map
+          (VExpr.instRev ·
+            (params ++ [code.typeFn, code.minor] ++ fields)) := by
+          rw [List.map_map]
+          exact List.map_congr_left fun _ _ => rfl
+      _ = _ := by
+        rw [VExpr.bvarRevRange_map_instL]
+        exact hsegCommon
+  have hsegParamsL :
+      (VExpr.bvarRevRange (m + 2) view.nparams).map
+          (fun expression => VExpr.instRev (expression.instL pLevels)
+            (params ++ [code.typeFn, code.minor] ++ fields)) = params := by
+    calc
+      _ = ((VExpr.bvarRevRange (m + 2) view.nparams).map
+            (VExpr.instL pLevels)).map
+          (VExpr.instRev ·
+            (params ++ [code.typeFn, code.minor] ++ fields)) := by
+          rw [List.map_map]
+          exact List.map_congr_left fun _ _ => rfl
+      _ = _ := by
+        rw [VExpr.bvarRevRange_map_instL]
+        exact hsegParams
+  have hsegFieldsL :
+      (VExpr.bvarRevRange 0 m).map
+          (fun expression => VExpr.instRev (expression.instL pLevels)
+            (params ++ [code.typeFn, code.minor] ++ fields)) = fields := by
+    calc
+      _ = ((VExpr.bvarRevRange 0 m).map
+            (VExpr.instL pLevels)).map
+          (VExpr.instRev ·
+            (params ++ [code.typeFn, code.minor] ++ fields)) := by
+          rw [List.map_map]
+          exact List.map_congr_left fun _ _ => rfl
+      _ = _ := by
+        rw [VExpr.bvarRevRange_map_instL]
+        exact hsegFields
+  have hidxRNil : idxR = [] := by
+    simp [idxR, VInductDecl.NormalizedCtor.resultIndicesR,
+      hresultIndices]
+  have hrecBaseShape :
+      VExpr.instRev (recBase.instL pLevels)
+          (params ++ [code.typeFn, code.minor] ++ fields) =
+        VExpr.appN (.const view.recursorName pLevels)
+          (params ++ [code.typeFn, code.minor]) := by
+    rw [show recBase = VExpr.appN
+        (.const (.str gen.block.sourceType.name "rec") gen.recLevels)
+        (VExpr.bvarRevRange m (view.nparams + 2)) by
+          unfold recBase
+          rw [view.constructor_eq]
+          rfl,
+      VExpr.instL_appN, VExpr.instRev_appN, hrecConst]
+    rw [List.map_map]
+    exact congrArg (VExpr.appN (.const view.recursorName pLevels))
+      hsegCommonL
+  have hctorShape :
+      VExpr.instRev (ctorApp.instL pLevels)
+          (params ++ [code.typeFn, code.minor] ++ fields) =
+        VExpr.appN (.const view.constructorName levels)
+          (params ++ fields) := by
+    rw [show ctorApp = VExpr.appN
+        (.const view.constructorName gen.sourceLevels)
+        (VExpr.bvarRevRange (m + 2) view.nparams ++
+          VExpr.bvarRevRange 0 m) by
+          unfold ctorApp
+          rw [view.constructor_eq]
+          rfl,
+      VExpr.instL_appN, VExpr.instRev_appN]
+    rw [VExpr.instRev_closedN _ (by trivial)]
+    simp only [VExpr.instL]
+    rw [hsourceLevels]
+    simp only [List.map_append, List.map_map, Function.comp_def]
+    rw [hsegParamsL, hsegFieldsL]
+  have hleftShape :
+      VExpr.instRev (lhsBody.instL pLevels)
+          (params ++ [code.typeFn, code.minor] ++ fields) =
+        VExpr.appN (.const view.recursorName pLevels)
+          (params ++ [code.typeFn, code.minor,
+            VExpr.appN (.const view.constructorName levels)
+              (params ++ fields)]) := by
+    rw [show lhsBody = VExpr.appN recBase (idxR ++ [ctorApp]) by
+          rfl,
+      VExpr.instL_appN, VExpr.instRev_appN, hrecBaseShape, hidxRNil,
+      List.nil_append]
+    simp only [List.map_cons, List.map_nil, hctorShape]
+    rw [← VExpr.appN_append]
+    simp only [List.append_assoc]
+    rfl
+  have hminorCapture :
+      VExpr.instRev (.bvar m)
+          (params ++ [code.typeFn, code.minor] ++ fields) =
+        code.minor := by
+    have h := VExpr.map_instRev_bvarRevRange_seg
+      (params ++ [code.typeFn, code.minor] ++ fields) 1 m
+      (by rw [hcapturesLength']; omega)
+    rw [show (params ++ [code.typeFn, code.minor] ++ fields).length -
+        m - 1 = params.length + 1 by
+          rw [hcapturesLength', hparamsLength]
+          omega] at h
+    simpa [VExpr.bvarRevRange] using h
+  have hrightBodyShape :
+      rhsBody = VExpr.appN (.bvar m) (VExpr.bvarRevRange 0 m) := by
+    simp [rhsBody, ihs, rs, gen,
+      VInductDecl.NormalizedCtor.recArgsR, view.recursive_eq,
+      view.constructor_eq]
+  have hrightShape :
+      VExpr.instRev (rhsBody.instL pLevels)
+          (params ++ [code.typeFn, code.minor] ++ fields) =
+        VExpr.appN code.minor fields := by
+    rw [hrightBodyShape, VExpr.instL_appN,
+      VExpr.bvarRevRange_map_instL, VExpr.instRev_appN]
+    simp only [VExpr.instL]
+    rw [hminorCapture, hsegFields]
+  rw [hleftShape, hrightShape] at hiotaBodies
+  obtain ⟨selectedType, hselectedType, -⟩ :=
+    view.projectionCodes_get?_typeFn levels params hcode
+  have hidxLt : idx < (view.specializedFields levels params).length :=
+    (List.getElem?_eq_some_iff.1 hselectedType).1
+  let q := (view.specializedFields levels params).length - 1 - idx
+  have hqLt : q < (view.specializedFields levels params).length := by
+    simp only [q]
+    omega
+  have hselectedReverse :
+      (view.specializedFields levels params).reverse[q]? =
+        some selectedType := by
+    rw [List.getElem?_reverse hqLt,
+      show (view.specializedFields levels params).length - 1 - q = idx by
+        simp only [q]
+        omega,
+      hselectedType]
+  have hselectedCtx :
+      ((view.specializedFields levels params).reverse ++ Γ)[q]? =
+        some selectedType := by
+    rw [List.getElem?_append_left (by simpa using hqLt),
+      hselectedReverse]
+  have hminorBodyType : env.HasType U
+      ((view.specializedFields levels params).reverse ++ Γ)
+      (.bvar q) (selectedType.liftN (q + 1)) :=
+    .bvar (Lookup.of_getElem? hselectedCtx)
+  have hminorSpine := hfieldsSpine.retarget hfieldsLength
+    (selectedType.liftN (q + 1))
+  have hminorBetaRaw := VEnv.IsDefEq.appN_lamN henv.ordered
+    hsortTel.toOnTel hminorBodyType hminorSpine hfieldsLength
+  have hfieldInst : VExpr.instRev (.bvar q) fields = field := by
+    have h := VExpr.map_instRev_bvarRevRange_seg fields 1 q
+      (by rw [hfieldsLength]; exact Nat.add_one_le_iff.2 hqLt)
+    rw [show fields.length - q - 1 = idx by
+      rw [hfieldsLength]
+      simp only [q]
+      omega] at h
+    obtain ⟨hidxFields, hfieldGet⟩ :=
+      List.getElem?_eq_some_iff.1 hfield
+    rw [List.drop_eq_getElem_cons hidxFields, hfieldGet,
+      List.take_succ_cons] at h
+    simpa [VExpr.bvarRevRange] using h
+  have hminorBeta : env.IsDefEqU U Γ
+      (VExpr.appN code.minor fields) field := by
+    refine ⟨VExpr.instRev (selectedType.liftN (q + 1)) fields, ?_⟩
+    rw [hminorShape]
+    simpa only [hfieldInst] using hminorBetaRaw
+  exact VEnv.IsDefEqU.trans henv hΓ hprojectorToRule
+    (VEnv.IsDefEqU.trans henv hΓ hiotaBodies hminorBeta)
+
+/-- Environment-indexed projection semantics.
+
+The universe and parameter spines are explicit.  The major premise must have
+the exact instantiated structure type, and the result is the unique program
+computed by the registered view. -/
+structure TrProj (env : VEnv) (U : Nat) (Γ : List VExpr)
+    (view : VStructureView) (levels : List VLevel) (params : List VExpr)
+    (idx : Nat) (major result : VExpr) : Prop where
+  viewWF : VStructureView.WF view env
+  levelsWF : ∀ level ∈ levels, level.WF U
+  levels_length : levels.length = view.uvars
+  params_length : params.length = view.nparams
+  paramsSpine : ∃ resultLevel,
+    env.SpineWF U Γ (view.familyType.instL levels)
+      params (.sort resultLevel)
+  majorType : env.HasType U Γ major (view.structureType levels params)
+  program : ∃ code : VStructureView.ProjectionCode,
+    (view.projectionCodes levels params)[idx]? = some code ∧
+      result = .app code.projector major ∧
+      env.HasType U Γ code.projector
+        (.forallE (view.structureType levels params)
+          (.app code.typeFn.lift (.bvar 0)))
+
+/-- The projection-specific output of registered constructor-head inversion.
+
+This package performs no iota computation.  It only aligns a constructor
+normal form and one selected runtime argument with the canonical registered
+view, and supplies the typed spines needed by
+`projector_constructor_exact`. -/
+structure ProjectionConstructorAlignment (env : VEnv) (U : Nat)
+    (Γ : List VExpr) (view : VStructureView) (levels : List VLevel)
+    (params : List VExpr) (idx : Nat)
+    (code : VStructureView.ProjectionCode)
+    (runtimeConstructorName : Name) (runtimeMajor runtimeField : VExpr) where
+  constructor_name_eq : runtimeConstructorName = view.constructorName
+  fields : List VExpr
+  field : VExpr
+  fields_length :
+    fields.length = (view.specializedFields levels params).length
+  field_get : fields[idx]? = some field
+  constructorType : env.HasType U Γ
+    (VExpr.appN (.const view.constructorName levels) (params ++ fields))
+    (view.structureType levels params)
+  fieldsSpine : env.SpineWF U Γ
+    (VExpr.forallN (view.specializedFields levels params) (.sort .zero))
+    fields (.sort .zero)
+  captures : ∃ B, env.SpineWF U Γ
+    ((view.generation.rule 0 view.constructor).type.instL
+      (view.projectionLevels code.fieldSort levels))
+    (params ++ [code.typeFn, code.minor] ++ fields) B
+  major_eq : env.IsDefEqU U Γ runtimeMajor
+    (VExpr.appN (.const view.constructorName levels) (params ++ fields))
+  field_eq : env.IsDefEqU U Γ runtimeField field
+
+/-- Consume registered-head alignment with the separately proved exact iota
+theorem.  This keeps the transitional injectivity boundary from hiding the
+projection computation itself. -/
+theorem TrProj.projector_constructor_aligned
+    (self : VEnv.TrProj env U Γ view levels params idx major result)
+    (henv : env.WF) (hΓ : OnCtx Γ (env.IsType U))
+    {code : VStructureView.ProjectionCode}
+    (hcode : (view.projectionCodes levels params)[idx]? = some code)
+    (hprojector : env.HasType U Γ code.projector
+      (.forallE (view.structureType levels params)
+        (.app code.typeFn.lift (.bvar 0))))
+    {runtimeMajor runtimeField : VExpr}
+    {runtimeConstructorName : Name}
+    (alignment : ProjectionConstructorAlignment env U Γ view levels params idx
+      code runtimeConstructorName runtimeMajor runtimeField) :
+    env.IsDefEqU U Γ (.app code.projector runtimeMajor) runtimeField := by
+  have hmajorEq := alignment.major_eq.of_r henv hΓ
+    alignment.constructorType
+  have hmajorCongr : env.IsDefEqU U Γ
+      (.app code.projector runtimeMajor)
+      (.app code.projector
+        (VExpr.appN (.const view.constructorName levels)
+          (params ++ alignment.fields))) :=
+    ⟨_, hprojector.appDF hmajorEq⟩
+  obtain ⟨captureType, hcaptures⟩ := alignment.captures
+  have hiota := self.viewWF.projector_constructor_exact henv hΓ
+    self.levelsWF self.levels_length self.params_length self.paramsSpine
+    hcode hprojector alignment.fields_length alignment.field_get
+    alignment.constructorType alignment.fieldsSpine hcaptures
+  exact VEnv.IsDefEqU.trans henv hΓ hmajorCongr
+    (VEnv.IsDefEqU.trans henv hΓ hiota alignment.field_eq.symm)
+
+theorem TrProj.project_eq
+    (self : VEnv.TrProj env U Γ view levels params idx major result) :
+    VStructureView.project? view levels params idx major = some result := by
+  obtain ⟨code, hcode, rfl, -⟩ := self.program
+  simp [VStructureView.project?, hcode]
+
+theorem TrProj.type_eq
+    (self : VEnv.TrProj env U Γ view levels params idx major result) :
+    ∃ code : VStructureView.ProjectionCode,
+      VStructureView.projectionType? view levels params idx major =
+        some (VExpr.app code.typeFn major) := by
+  obtain ⟨code, hcode, _, -⟩ := self.program
+  exact ⟨code, by simp [VStructureView.projectionType?, hcode]⟩
+
+/-- A fixed checked view, universe/parameter instantiation, field index, and
+major determine the projection result syntactically. -/
+theorem TrProj.result_eq
+    (self : VEnv.TrProj env U Γ view levels params idx major result)
+    (other : VEnv.TrProj env U Γ view levels params idx major result') :
+    result = result' :=
+  Option.some.inj (self.project_eq.symm.trans other.project_eq)
+
+/-- Projection evidence is stable when the registered environment is
+extended without changing any existing constants or reduction rules. -/
+theorem TrProj.mono {env env' : VEnv} (henv : env ≤ env')
+    (self : VEnv.TrProj env U Γ view levels params idx major result) :
+    VEnv.TrProj env' U Γ view levels params idx major result where
+  viewWF := self.viewWF.mono henv
+  levelsWF := self.levelsWF
+  levels_length := self.levels_length
+  params_length := self.params_length
+  paramsSpine := self.paramsSpine.imp fun _ h => h.monoProjection henv
+  majorType := self.majorType.mono henv
+  program := self.program.imp fun _ ⟨hcode, hresult, htype⟩ =>
+    ⟨hcode, hresult, htype.mono henv⟩
+
+/-- Weakening acts pointwise on the explicit parameters, major, and computed
+projection program. -/
+theorem TrProj.weakN (henv : env.Ordered)
+    (W : Ctx.LiftN n k Γ Γ')
+    (self : VEnv.TrProj env U Γ view levels params idx major result) :
+    VEnv.TrProj env U Γ' view levels
+      (params.map fun param => param.liftN n k) idx
+      (major.liftN n k) (result.liftN n k) := by
+  refine {
+    viewWF := self.viewWF
+    levelsWF := self.levelsWF
+    levels_length := self.levels_length
+    params_length := by simpa using self.params_length
+    paramsSpine := ?_
+    majorType := by simpa using self.majorType.weakN henv W
+    program := ?_ }
+  · have hfamilyClosed : (view.familyType.instL levels).ClosedN 0 := by
+      simpa using (henv.closedC self.viewWF.family).instL
+    obtain ⟨resultLevel, hspine⟩ := self.paramsSpine
+    refine ⟨resultLevel, ?_⟩
+    have hspine' := hspine.weakN henv W
+    rw [hfamilyClosed.liftN_eq (Nat.zero_le _)] at hspine'
+    simpa [VExpr.liftN] using hspine'
+  · obtain ⟨code, hcode, rfl, htype⟩ := self.program
+    refine ⟨code.liftN n k, ?_, rfl, ?_⟩
+    rw [← self.viewWF.projectionCodes_liftN henv levels params
+      self.params_length n k]
+    simp only [List.getElem?_map, hcode, Option.map_some]
+    simpa [VStructureView.ProjectionCode.liftN, VExpr.liftN,
+      VExpr.liftN_lift_projection] using htype.weakN henv W
+
+/-- General context lifting, derived one inserted binder at a time from
+`weakN`. -/
+theorem TrProj.weak' (henv : env.Ordered)
+    (W : Ctx.Lift' l Γ Γ')
+    (self : VEnv.TrProj env U Γ view levels params idx major result) :
+    VEnv.TrProj env U Γ' view levels
+      (params.map fun param => param.lift' l) idx
+      (major.lift' l) (result.lift' l) := by
+  generalize hdepth : l.depth = depth
+  induction depth generalizing l Γ' with
+  | zero =>
+      have hctx := W.depth_zero hdepth
+      subst Γ'
+      simpa [VExpr.lift'_depth_zero (l := l) hdepth] using self
+  | succ depth ih =>
+      obtain ⟨tail, k, rfl, rfl⟩ := Lift.depth_succ hdepth
+      obtain ⟨Γ₁, W₁, W₂⟩ := W.of_cons_skip
+      have h := (ih W₁ Lift.depth_consN).weakN henv W₂
+      rw [Lift.consN_skip_eq]
+      have hlift : ∀ e : VExpr,
+          e.lift' ((tail.consN k).comp
+              (Lift.refl.skip.consN k)) =
+            (e.lift' (tail.consN k)).liftN 1 k := by
+        intro e
+        rw [VExpr.lift'_comp, ← Lift.skipN_one,
+          VExpr.lift'_consN_skipN]
+      have hparams :
+          params.map (fun param => param.lift' ((tail.consN k).comp
+              (Lift.refl.skip.consN k))) =
+            (params.map fun param => param.lift' (tail.consN k)).map
+              (fun param => param.liftN 1 k) := by
+        rw [List.map_map]
+        exact List.map_congr_left fun param _ => hlift param
+      rw [hparams, hlift major, hlift result]
+      exact h
+
+/-- Substitution acts pointwise on the explicit parameters, major, and
+computed projection program. -/
+theorem TrProj.instN (henv : env.Ordered)
+    (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (h₀ : env.HasType U Γ₀ e₀ A₀)
+    (self : VEnv.TrProj env U Γ₁ view levels params idx major result) :
+    VEnv.TrProj env U Γ view levels
+      (params.map fun param => param.inst e₀ k) idx
+      (major.inst e₀ k) (result.inst e₀ k) := by
+  refine {
+    viewWF := self.viewWF
+    levelsWF := self.levelsWF
+    levels_length := self.levels_length
+    params_length := by simpa using self.params_length
+    paramsSpine := ?_
+    majorType := by simpa using self.majorType.instN henv W h₀
+    program := ?_ }
+  · have hfamilyClosed : (view.familyType.instL levels).ClosedN 0 := by
+      simpa using (henv.closedC self.viewWF.family).instL
+    obtain ⟨resultLevel, hspine⟩ := self.paramsSpine
+    refine ⟨resultLevel, ?_⟩
+    have hspine' := hspine.instNProjection henv W h₀
+    rw [hfamilyClosed.instN_eq (Nat.zero_le _)] at hspine'
+    simpa [VExpr.inst] using hspine'
+  · obtain ⟨code, hcode, rfl, htype⟩ := self.program
+    refine ⟨code.instN e₀ k, ?_, rfl, ?_⟩
+    rw [← self.viewWF.projectionCodes_instN henv levels params
+      self.params_length e₀ k]
+    simp only [List.getElem?_map, hcode, Option.map_some]
+    simpa [VStructureView.ProjectionCode.instN, VExpr.inst,
+      ← VExpr.lift_instN_lo] using htype.instN henv W h₀
+
+/-- Transport projection evidence to a definitionally equal context and a
+new major already checked against the same instantiated structure type. -/
+theorem TrProj.defeqDFC (henv : env.Ordered)
+    (hΓ : env.IsDefEqCtx U Γ₀ Γ₁ Γ₂)
+    (majorType' : env.HasType U Γ₂ major'
+      (view.structureType levels params))
+    (self : VEnv.TrProj env U Γ₁ view levels params idx major result) :
+    ∃ result', VEnv.TrProj env U Γ₂ view levels params idx major' result' := by
+  obtain ⟨code, hcode, -, htype⟩ := self.program
+  refine ⟨.app code.projector major', {
+    viewWF := self.viewWF
+    levelsWF := self.levelsWF
+    levels_length := self.levels_length
+    params_length := self.params_length
+    paramsSpine := self.paramsSpine.imp fun _ h => h.defeqDFC henv hΓ
+    majorType := majorType'
+    program := ⟨code, hcode, rfl,
+      htype.defeqDFC henv hΓ⟩ }⟩
+
+/-- Universe instantiation acts pointwise on the explicit structure
+universes and parameters, and on the recursor program they determine. -/
+theorem TrProj.instL {ls : List VLevel}
+    (hls : ∀ level ∈ ls, level.WF U')
+    (self : VEnv.TrProj env U Γ view levels params idx major result) :
+    VEnv.TrProj env U' (Γ.map (VExpr.instL ls)) view
+      (levels.map (VLevel.inst ls))
+      (params.map (VExpr.instL ls)) idx
+      (major.instL ls) (result.instL ls) := by
+  refine {
+    viewWF := self.viewWF
+    levelsWF := ?_
+    levels_length := by simpa using self.levels_length
+    params_length := by simpa using self.params_length
+    paramsSpine := ?_
+    majorType := by simpa using self.majorType.instL hls
+    program := ?_ }
+  · intro level hlevel
+    obtain ⟨sourceLevel, hsourceLevel, rfl⟩ := List.mem_map.1 hlevel
+    exact VLevel.WF.inst hls
+  · obtain ⟨resultLevel, hspine⟩ := self.paramsSpine
+    refine ⟨resultLevel.inst ls, ?_⟩
+    simpa [VExpr.instL, VExpr.instL_instL] using hspine.instL hls
+  · obtain ⟨code, hcode, rfl, htype⟩ := self.program
+    refine ⟨code.instL ls, ?_, ?_, ?_⟩
+    · rw [← VStructureView.projectionCodes_instL]
+      simp only [List.getElem?_map, hcode, Option.map_some]
+    · rfl
+    · simpa [VStructureView.ProjectionCode.instL, VExpr.instL,
+        VExpr.instL_liftN] using htype.instL hls
+
+/-- The registered-structure constant-head inversion boundary.
+
+The four conclusions are the projection-specific eliminators supplied by
+constant-head injectivity: a type assigned to a syntactically weakened major
+recovers an instantiation below the inserted context; definitionally equal
+majors recover the same registered view/instantiation strongly enough for the
+generated projector programs to be definitionally equal; a runtime
+constructor head recovers the registered constructor name; and that head plus
+one selected argument is aligned with the registered constructor and field.
+The last conclusion deliberately provides only typed alignment—the iota step
+remains the proved `projector_constructor_exact` theorem.
+
+Its eventual proof uses `IsDefEqU.weakN_iff` together with injectivity of
+registered inductive heads.  Keeping the boundary in Theory makes the
+temporary Spec-16/17 dependency explicit instead of leaving Verify's
+structural laws as local holes. -/
+structure RegisteredStructureHeadInversion (env : VEnv) : Prop where
+  weak'_inv :
+    ∀ {U : Nat} {Γ Γ' : List VExpr} {view : VStructureView}
+      {levels : List VLevel} {params : List VExpr} {idx : Nat}
+      {major result : VExpr} {lift : Lift},
+      OnCtx Γ' (env.IsType U) →
+      Ctx.Lift' lift Γ Γ' →
+      env.TrProj U Γ' view levels params idx (major.lift' lift) result →
+      ∃ params' result',
+        env.TrProj U Γ view levels params' idx major result'
+  unique :
+    ∀ {U : Nat} {Γ₁ Γ₂ : List VExpr}
+      {view₁ view₂ : VStructureView}
+      {levels₁ levels₂ : List VLevel} {params₁ params₂ : List VExpr}
+      {idx : Nat} {major₁ major₂ result₁ result₂ : VExpr},
+      env.IsDefEqCtx U [] Γ₁ Γ₂ →
+      env.TrProj U Γ₁ view₁ levels₁ params₁ idx major₁ result₁ →
+      env.TrProj U Γ₂ view₂ levels₂ params₂ idx major₂ result₂ →
+      env.IsDefEqU U Γ₁ major₁ major₂ →
+      env.IsDefEqU U Γ₁ result₁ result₂
+  constructor_name_inv :
+    ∀ {U : Nat} {Γ : List VExpr} {view : VStructureView}
+      {levels : List VLevel} {params : List VExpr} {idx : Nat}
+      {major result runtimeMajor : VExpr}
+      {constructorName : Name} {constructorLevels : List VLevel}
+      {constructorArgs : List VExpr},
+      OnCtx Γ (env.IsType U) →
+      env.TrProj U Γ view levels params idx major result →
+      runtimeMajor = VExpr.appN
+        (.const constructorName constructorLevels) constructorArgs →
+      env.IsDefEqU U Γ runtimeMajor major →
+      constructorName = view.constructorName
+  constructor_inv :
+    ∀ {U : Nat} {Γ : List VExpr} {view : VStructureView}
+      {levels : List VLevel} {params : List VExpr} {idx : Nat}
+      {major result : VExpr} {code : VStructureView.ProjectionCode}
+      {runtimeMajor runtimeField : VExpr}
+      {constructorName : Name} {constructorLevels : List VLevel}
+      {constructorArgs : List VExpr},
+      OnCtx Γ (env.IsType U) →
+      env.TrProj U Γ view levels params idx major result →
+      (view.projectionCodes levels params)[idx]? = some code →
+      runtimeMajor = VExpr.appN
+        (.const constructorName constructorLevels) constructorArgs →
+      constructorArgs[view.nparams + idx]? = some runtimeField →
+      env.IsDefEqU U Γ runtimeMajor major →
+      Nonempty (ProjectionConstructorAlignment env U Γ view levels params idx
+        code constructorName runtimeMajor runtimeField)
+
+set_option warn.sorry false in
+/-- Public Tier-R registered-head inversion statement.  Spec-16/17 discharge
+the underlying constant-head theorem; projection structural laws consume only
+this stable interface and therefore shed `sorryAx` automatically when it is
+proved. -/
+theorem WF.registeredStructureHeadInversion
+    (self : VEnv.WF env) : RegisteredStructureHeadInversion env := by
+  sorry
+
+#guard_named_axioms Ix.Theory.Named.VEnv.WF.registeredStructureHeadInversion [propext, sorryAx, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.TrProj.result_eq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.TrProj.mono [propext, Quot.sound]
+
+end VEnv
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Quot.lean b/Ix/Theory/Named/Quot.lean
new file mode 100644
index 000000000..c509fcef0
--- /dev/null
+++ b/Ix/Theory/Named/Quot.lean
@@ -0,0 +1,27 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.VEnv
+import Ix.Theory.Named.Meta
+
+namespace Ix.Theory.Named
+
+def eqConst := vconst(type_of% @Eq)
+def quotConst := vconst(type_of% @Quot)
+def quotMkConst := vconst(type_of% @Quot.mk)
+def quotLiftConst := vconst(type_of% @Quot.lift)
+def quotIndConst := vconst(type_of% @Quot.ind)
+def quotDefEq := vdefeq(α r β f c a => @Quot.lift α r β f c (Quot.mk r a) ≡ f a)
+
+def VEnv.QuotReady (env : VEnv) : Prop :=
+  env.constants ``Eq = some eqConst
+
+def VEnv.addQuot (env : VEnv) : Option VEnv := do
+  let env ← env.addConst ``Quot quotConst
+  let env ← env.addConst ``Quot.mk quotMkConst
+  let env ← env.addConst ``Quot.lift quotLiftConst
+  let env ← env.addConst ``Quot.ind quotIndConst
+  env.addDefEq quotDefEq
diff --git a/Ix/Theory/Named/Reference/Declaration.lean b/Ix/Theory/Named/Reference/Declaration.lean
new file mode 100644
index 000000000..5b9ed8970
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Declaration.lean
@@ -0,0 +1,33 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Declaration
+
+
+namespace Lean
+
+/--
+The value of a constant for the purpose of delta reduction: definitions and theorems have one,
+opaques do not. This mirrors the C++ `constant_info::has_value()`/`get_value()` pair.
+
+This is deliberately *not* `ConstantInfo.value?`, whose meaning changed in lean4#12973: it now
+excludes theorems, but `constant_info::has_value()` was left untouched by that PR, so the kernel
+still delta-unfolds theorems: `type_checker::is_delta` uses this predicate to select candidates,
+and `instantiate_value_lparams` uses it before reading their values.
+-/
+def ConstantInfo.deltaValue? : ConstantInfo → Option Expr
+  | .defnInfo {value, ..} => some value
+  | .thmInfo {value, ..} => some value
+  | _ => none
+
+namespace ReducibilityHints
+
+def lt' : ReducibilityHints → ReducibilityHints → Bool -- lean4#2750
+  | _,           .opaque     => false
+  | .abbrev,     _           => false
+  | .opaque,     _           => true
+  | _,           .abbrev     => true
+  | .regular d₁, .regular d₂ => d₁ < d₂
diff --git a/Ix/Theory/Named/Reference/Environment.lean b/Ix/Theory/Named/Reference/Environment.lean
new file mode 100644
index 000000000..8bc74f3f6
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Environment.lean
@@ -0,0 +1,125 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Reference.TypeChecker
+import Ix.Theory.Named.Reference.Quot
+import Ix.Theory.Named.Reference.Inductive.Add
+import Ix.Theory.Named.Reference.Primitive
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open TypeChecker Kernel Environment
+
+open private Lean.Kernel.Environment.add from Lean.Environment
+
+def checkConstantVal (env : Environment) (v : ConstantVal) (allowPrimitive := false) : M Unit := do
+  checkName env v.name allowPrimitive
+  checkDuplicatedUnivParams v.levelParams
+  checkNoMVarNoFVar env v.name v.type
+  let sort ← checkType v.type
+  _ ← ensureSort sort v.type
+
+def addAxiom (env : Environment) (v : AxiomVal) (check := true) (fuel : FuelConfig := {}) :
+    Except Exception Environment := do
+  if check then
+    _ ← (checkConstantVal env v.toConstantVal).run env
+      (safety := if v.isUnsafe then .unsafe else .safe) (lparams := v.levelParams) (fuel := fuel)
+  return env.add (.axiomInfo v)
+
+def addDefinition (env : Environment) (v : DefinitionVal)
+    (check := true) (fuel : FuelConfig := {}) : Except Exception Environment := do
+  if let .unsafe := v.safety then
+    -- Meta definition can be recursive.
+    -- So, we check the header, add, and then type check the body.
+    if check then
+      _ ← (checkConstantVal env v.toConstantVal).run env
+        (safety := .unsafe) (lparams := v.levelParams) (fuel := fuel)
+    let env' := env.add (.axiomInfo { v with isUnsafe := true })
+    if check then
+      checkNoMVarNoFVar env' v.name v.value
+      M.run env' (safety := .unsafe) (lctx := {}) (lparams := v.levelParams) (fuel := fuel) do
+        let valType ← TypeChecker.checkType v.value
+        if !(← isDefEq valType v.type) then
+          throw <| .declTypeMismatch env' (.defnDecl v) valType
+  else if check then
+    M.run env (safety := .safe) (lctx := {}) (lparams := v.levelParams) (fuel := fuel) do
+      checkConstantVal env v.toConstantVal (← checkPrimitiveDef v)
+      checkNoMVarNoFVar env v.name v.value
+      let valType ← TypeChecker.checkType v.value
+      if !(← isDefEq valType v.type) then
+        throw <| .declTypeMismatch env (.defnDecl v) valType
+  return env.add (.defnInfo v)
+
+def addTheorem (env : Environment) (v : TheoremVal) (check := true) (fuel : FuelConfig := {}) :
+    Except Exception Environment := do
+  if check then
+    -- TODO(Leo): we must add support for handling tasks here
+    M.run env (safety := .safe) (lctx := {}) (lparams := v.levelParams) (fuel := fuel) do
+      checkConstantVal env v.toConstantVal
+      if !(← isProp v.type) then
+        throw <| .thmTypeIsNotProp env v.name v.type
+      checkNoMVarNoFVar env v.name v.value
+      let valType ← TypeChecker.checkType v.value
+      if !(← isDefEq valType v.type) then
+        throw <| .declTypeMismatch env (.thmDecl v) valType
+  return env.add (.thmInfo v)
+
+def addOpaque (env : Environment) (v : OpaqueVal) (check := true) (fuel : FuelConfig := {}) :
+    Except Exception Environment := do
+  if check then
+    M.run env (safety := .safe) (lctx := {}) (lparams := v.levelParams) (fuel := fuel) do
+      checkConstantVal env v.toConstantVal
+      checkNoMVarNoFVar env v.name v.value
+      let valType ← TypeChecker.checkType v.value
+      if !(← isDefEq valType v.type) then
+        throw <| .declTypeMismatch env (.opaqueDecl v) valType
+  return env.add (.opaqueInfo v)
+
+def addMutual (env : Environment) (vs : List DefinitionVal)
+    (check := true) (fuel : FuelConfig := {}) : Except Exception Environment := do
+  let v₀ :: _ := vs | throw <| .other "invalid empty mutual definition"
+  if let .safe := v₀.safety then
+    throw <| .other "invalid mutual definition, declaration is not tagged as unsafe/partial"
+  if check then
+    M.run env (safety := v₀.safety) (lctx := {}) (lparams := v₀.levelParams) (fuel := fuel) do
+      let mut found : NameSet := {}
+      for v in vs do
+        if v.safety != v₀.safety then
+          throw <| .other
+            "invalid mutual definition, declarations must have the same safety annotation"
+        -- The whole block is checked under one set of level parameters, so they must agree;
+        -- lean4#14608 adds the same check to the C++ kernel.
+        if v.levelParams != v₀.levelParams then
+          throw <| .other
+            "invalid mutual definition, declarations must have the same universe level parameters"
+        if found.contains v.name then
+          throw <| .other s!"invalid mutual definition, duplicate declaration name '{v.name}'"
+        found := found.insert v.name
+        checkConstantVal env v.toConstantVal
+  let env' := vs.foldl (init := env) fun env' v =>
+    env'.add (.axiomInfo { v with isUnsafe := v₀.safety == .unsafe })
+  if check then
+    M.run env' (safety := v₀.safety) (lctx := {}) (lparams := v₀.levelParams) (fuel := fuel) do
+      for v in vs do
+        checkNoMVarNoFVar env' v.name v.value
+        let valType ← TypeChecker.checkType v.value
+        if !(← isDefEq valType v.type) then
+          throw <| .declTypeMismatch env' (.mutualDefnDecl vs) valType
+  return vs.foldl (fun env' v => env'.add (.defnInfo v)) env
+
+/-- Type check given declaration and add it to the environment -/
+def addDecl (env : Environment) (decl : Declaration) (check := true) (fuel : FuelConfig := {}) :
+    Except Exception Environment := do
+  match decl with
+  | .axiomDecl v => addAxiom env v check fuel
+  | .defnDecl v => addDefinition env v check fuel
+  | .thmDecl v => addTheorem env v check fuel
+  | .opaqueDecl v => addOpaque env v check fuel
+  | .mutualDefnDecl v => addMutual env v check fuel
+  | .quotDecl => addQuot env
+  | .inductDecl lparams nparams types isUnsafe =>
+    let allowPrimitive ← checkPrimitiveInductive env lparams nparams types isUnsafe
+    addInductive env lparams nparams types isUnsafe allowPrimitive fuel
diff --git a/Ix/Theory/Named/Reference/Environment/Basic.lean b/Ix/Theory/Named/Reference/Environment/Basic.lean
new file mode 100644
index 000000000..9ac92b87c
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Environment/Basic.lean
@@ -0,0 +1,226 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Environment
+import Batteries.Tactic.OpenPrivate
+
+namespace Lean.Kernel.Environment
+
+def contains (env : Environment) (n : Name) : Bool :=
+  env.constants.contains n
+
+def get (env : Environment) (n : Name) : Except Exception ConstantInfo :=
+  match env.find? n with
+  | some ci => pure ci
+  | none => throw <| .unknownConstant env n
+
+def checkDuplicatedUnivParams : List Name → Except Exception Unit
+  | [] => pure ()
+  | p :: ls => do
+    if p ∈ ls then
+      throw <| .other
+        s!"failed to add declaration to environment, duplicate universe level parameter: '{p}'"
+    checkDuplicatedUnivParams ls
+
+def checkNoMVar (env : Environment) (n : Name) (e : Expr) : Except Exception Unit := do
+  if e.hasMVar then
+    throw <| .declHasMVars env n e
+
+def checkNoFVar (env : Environment) (n : Name) (e : Expr) : Except Exception Unit := do
+  if e.hasFVar then
+    throw <| .declHasFVars env n e
+
+def checkNoMVarNoFVar (env : Environment) (n : Name) (e : Expr) : Except Exception Unit := do
+  checkNoMVar env n e
+  checkNoFVar env n e
+
+def primitives : NameSet := .ofList [
+  ``Bool, ``Bool.false, ``Bool.true,
+  ``Nat, ``Nat.zero, ``Nat.succ,
+  ``Nat.add, ``Nat.pred, ``Nat.sub, ``Nat.mul, ``Nat.pow,
+  ``Nat.gcd, ``Nat.mod, ``Nat.div, ``Nat.beq, ``Nat.ble,
+  ``Nat.bitwise, ``Nat.land, ``Nat.lor, ``Nat.xor,
+  ``Nat.shiftLeft, ``Nat.shiftRight,
+  ``String.ofList, ``Char.ofNat]
+
+/--
+Returns true iff `constName` is a non-recursive inductive datatype that has only one constructor and no indices.
+
+Such types have special kernel support (e.g. the eta rule).
+This must be in sync with `is_non_rec_structure()`.
+-/
+def isNonRecStructure (env : Environment) (constName : Name) : Bool :=
+  match env.find? constName with
+  | some (.inductInfo { isRec := false, ctors := [_], numIndices := 0, .. }) => true
+  | _ => false
+
+/-- A one-constructor, unindexed structure whose constructor and generated
+recursor have both reached the host environment.  Family metadata is staged
+before either artifact is inserted; projection verification may only demand a
+registered Theory view at this later boundary.
+
+Unlike `isNonRecStructure`, projection readiness deliberately does not inspect
+`InductiveVal.isRec`: Lean emits primitive projections for recursive structures
+too (including nested-recursive structures in the Lean prelude). -/
+def isProjectionReadyStructure (env : Environment) (constName : Name) : Bool :=
+  match env.constants.find?' constName with
+  | some (.inductInfo { ctors := [ctor], numIndices := 0, .. }) =>
+    match env.constants.find?' ctor,
+        env.constants.find?' (mkRecName constName) with
+    | some (.ctorInfo _), some (.recInfo _) => true
+    | _, _ => false
+  | _ => false
+
+theorem isProjectionReadyStructure_false_of_no_ctorInfo
+    {env : Environment} {name : Name} {info : InductiveVal}
+    (hfind : env.constants.find?' name = some (.inductInfo info))
+    (hnoCtor : ∀ ctor ctorInfo,
+      env.constants.find?' ctor ≠ some (.ctorInfo ctorInfo)) :
+    env.isProjectionReadyStructure name = false := by
+  cases info
+  rename_i constant numParams numIndices all ctors numNested isRec isUnsafe isReflexive
+  cases constant
+  unfold isProjectionReadyStructure
+  rw [hfind]
+  cases numIndices with
+  | succ _ => rfl
+  | zero =>
+    cases ctors with
+    | nil => rfl
+    | cons ctor rest =>
+      cases rest with
+      | cons _ _ => rfl
+      | nil =>
+        cases hctor : env.constants.find?' ctor with
+        | none => simp [hctor]
+        | some info =>
+          cases info <;> simp_all
+
+theorem isProjectionReadyStructure_false_of_numIndices_ne
+    {env : Environment} {name : Name} {info : InductiveVal}
+    (hfind : env.constants.find?' name = some (.inductInfo info))
+    (hindices : info.numIndices ≠ 0) :
+    env.isProjectionReadyStructure name = false := by
+  cases info
+  simp_all [isProjectionReadyStructure]
+
+theorem isProjectionReadyStructure_false_of_not_found
+    {env : Environment} {name : Name}
+    (hfind : env.constants.find?' name = none) :
+    env.isProjectionReadyStructure name = false := by
+  simp [isProjectionReadyStructure, hfind]
+
+def checkName (env : Environment) (n : Name)
+    (allowPrimitive := false) : Except Exception Unit := do
+  if env.contains n then
+    throw <| .alreadyDeclared env n
+  unless allowPrimitive do
+    if primitives.contains n then
+      throw <| .other s!"unexpected use of primitive name {n}"
+
+open private subsumesInfo Kernel.Environment.mk EnvironmentHeader.mk moduleNames
+  moduleNameMap parts toEffectiveImport getData? from Lean.Environment
+
+def empty (mainModule : Name) (trustLevel : UInt32 := 0) : Environment :=
+  Kernel.Environment.mk
+    (constants := {})
+    (quotInit := false)
+    (diagnostics := {})
+    (const2ModIdx := {})
+    (extensions := #[])
+    (irBaseExts := #[])
+    (header := EnvironmentHeader.mk
+      (mainModule := mainModule)
+      (trustLevel := trustLevel)
+      (isModule := false)
+      (imports := #[])
+      (regions := #[])
+      (modules := #[])
+      (moduleName2Idx := {})
+      (importAllModules := #[])
+      (moduleData := #[]))
+
+/-- A minimal kernel environment backed by an explicit constant map.
+
+This is used by verified staged checks (for example, while an inductive family
+has been inserted but its constructors have not). Such states are real kernel
+checking stages but are not importable modules, so they intentionally carry no
+extensions or module metadata. -/
+def ofConstants (mainModule : Name) (constants : ConstMap)
+    (quotInit := false) (trustLevel : UInt32 := 0) : Environment :=
+  Kernel.Environment.mk
+    (constants := constants)
+    (quotInit := quotInit)
+    (diagnostics := {})
+    (const2ModIdx := {})
+    (extensions := #[])
+    (irBaseExts := #[])
+    (header := EnvironmentHeader.mk
+      (mainModule := mainModule)
+      (trustLevel := trustLevel)
+      (isModule := false)
+      (imports := #[])
+      (regions := #[])
+      (modules := #[])
+      (moduleName2Idx := {})
+      (importAllModules := #[])
+      (moduleData := #[]))
+
+def throwAlreadyImported (s : ImportState) (const2ModIdx : Std.HashMap Name ModuleIdx)
+    (modIdx : Nat) (cname : Name) : Except Exception α := do
+  let modName := (moduleNames s)[modIdx]!
+  let constModName := (moduleNames s)[const2ModIdx[cname]!.toNat]!
+  throw <| .other
+    s!"import {modName} failed, environment already contains '{cname}' from {constModName}"
+
+def finalizeImport (s : ImportState) (imports : Array Import) (mainModule : Name)
+    (trustLevel : UInt32 := 0) : Except Exception Environment := do
+  let modules := (moduleNames s).filterMap ((moduleNameMap s)[·]?)
+  let moduleData ← modules.mapM fun mod => do
+    let some data := getData? mod .private |
+      throw <| .other s!"missing data file for module {mod.module}"
+    return data
+  let numConsts := moduleData.foldl (init := 0) fun numConsts data => Id.run do
+    numConsts + data.constants.size
+  let mut const2ModIdx := .emptyWithCapacity (capacity := numConsts)
+  let mut constantMap := .emptyWithCapacity (capacity := numConsts)
+  for h : modIdx in *...moduleData.size do
+    let data := moduleData[modIdx]
+    for cname in data.constNames, cinfo in data.constants do
+      match constantMap.getThenInsertIfNew? cname cinfo with
+      | (cinfoPrev?, constantMap') =>
+        constantMap := constantMap'
+        if let some cinfoPrev := cinfoPrev? then
+          -- Recall that the map has not been modified when `cinfoPrev? = some _`.
+          if subsumesInfo constantMap cinfo cinfoPrev then
+            constantMap := constantMap.insert cname cinfo
+          else if !subsumesInfo constantMap cinfoPrev cinfo then
+            throwAlreadyImported s const2ModIdx modIdx cname
+      const2ModIdx := const2ModIdx.insertIfNew cname modIdx
+    for cname in data.extraConstNames do
+      const2ModIdx := const2ModIdx.insertIfNew cname modIdx
+  let mut moduleName2Idx := {}
+  for _h : idx in [0:modules.size] do
+    let mod := modules[idx]
+    moduleName2Idx := moduleName2Idx.insert mod.module idx
+
+  return Kernel.Environment.mk
+    (constants := SMap.fromHashMap constantMap false)
+    (quotInit := !imports.isEmpty) -- We assume `Init.Prelude` initializes quotient module
+    (diagnostics := {})
+    (const2ModIdx := const2ModIdx)
+    (extensions := #[])
+    (irBaseExts := #[])
+    (header := EnvironmentHeader.mk
+      (mainModule := mainModule)
+      (trustLevel := trustLevel)
+      (isModule := false)
+      (imports := imports)
+      (regions := modules.flatMap (parts · |>.map (·.2)))
+      (modules := modules.map toEffectiveImport)
+      (moduleName2Idx := moduleName2Idx)
+      (importAllModules := #[])
+      (moduleData := moduleData))
diff --git a/Ix/Theory/Named/Reference/Expr.lean b/Ix/Theory/Named/Reference/Expr.lean
new file mode 100644
index 000000000..78a87bd2a
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Expr.lean
@@ -0,0 +1,138 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Environment
+
+namespace Lean
+namespace Expr
+
+def prop : Expr := .sort .zero
+
+/-- Transparent structural equality with the non-strict binder behavior used
+by kernel expression comparison.  Unlike `Expr.eqv`, this definition is
+available to the kernel evaluator, so checker branch proofs do not require an
+opaque implementation equation. -/
+def structuralEq : Expr → Expr → Bool
+  | .bvar i, .bvar j
+  | .fvar i, .fvar j
+  | .mvar i, .mvar j
+  | .sort i, .sort j
+  | .lit i, .lit j => i == j
+  | .const name levels, .const name' levels' =>
+      name == name' && levels == levels'
+  | .app fn arg, .app fn' arg' =>
+      structuralEq fn fn' && structuralEq arg arg'
+  | .lam _ domain body _, .lam _ domain' body' _
+  | .forallE _ domain body _, .forallE _ domain' body' _ =>
+      structuralEq domain domain' && structuralEq body body'
+  | .letE _ type value body nondep,
+      .letE _ type' value' body' nondep' =>
+      structuralEq type type' && structuralEq value value' &&
+        structuralEq body body' && nondep == nondep'
+  | .mdata data expr, .mdata data' expr' =>
+      structuralEq expr expr' && data.entries == data'.entries
+  | .proj typeName index struct, .proj typeName' index' struct' =>
+      structuralEq struct struct' && typeName == typeName' && index == index'
+  | _, _ => false
+
+def arrow (d b : Expr) : Expr := .forallE `a d b .default
+
+def lam0 (ty e : Expr) : Expr := .lam `_ ty e default
+
+namespace ReplaceImpl
+
+unsafe abbrev ReplaceT := StateT (PtrMap Expr Expr)
+
+@[inline]
+unsafe def cacheT [Monad m] (key : Expr) (result : Expr) : ReplaceT m Expr := do
+  modify (·.insert key result)
+  pure result
+
+@[specialize]
+unsafe def replaceUnsafeT [Monad m] (f? : Expr → m (Option Expr)) (e : Expr) : ReplaceT m Expr := do
+  let rec @[specialize] visit (e : Expr) := do
+    if let some result := (← get).find? e then
+      return result
+    match ← f? e with
+    | some eNew => cacheT e eNew
+    | none      => match e with
+      | Expr.forallE _ d b _   => cacheT e <| e.updateForallE! (← visit d) (← visit b)
+      | Expr.lam _ d b _       => cacheT e <| e.updateLambdaE! (← visit d) (← visit b)
+      | Expr.mdata _ b         => cacheT e <| e.updateMData! (← visit b)
+      | Expr.letE _ t v b nd   => cacheT e <| e.updateLet! (← visit t) (← visit v) (← visit b) nd
+      | Expr.app f a           => cacheT e <| e.updateApp! (← visit f) (← visit a)
+      | Expr.proj _ _ b        => cacheT e <| e.updateProj! (← visit b)
+      | e                      => pure e
+  visit e
+
+@[inline]
+unsafe def replaceUnsafe' [Monad m] (f? : Expr → m (Option Expr)) (e : Expr) : m Expr :=
+  (replaceUnsafeT f? e).run' mkPtrMap
+
+end ReplaceImpl
+
+/- TODO: use withPtrAddr, withPtrEq to avoid unsafe tricks above.
+   We also need an invariant at `State` and proofs for the `uget` operations. -/
+
+@[specialize]
+def replaceNoCacheT [Monad m] (f? : Expr → m (Option Expr)) (e : Expr) : m Expr := do
+  match ← f? e with
+  | some eNew => pure eNew
+  | none => match e with
+    | .forallE _ d b _ =>
+      return e.updateForallE! (← replaceNoCacheT f? d) (← replaceNoCacheT f? b)
+    | .lam _ d b _ =>
+      return e.updateLambdaE! (← replaceNoCacheT f? d) (← replaceNoCacheT f? b)
+    | .mdata _ b =>
+      return e.updateMData! (← replaceNoCacheT f? b)
+    | .letE _ t v b nd =>
+      return e.updateLet!
+        (← replaceNoCacheT f? t) (← replaceNoCacheT f? v) (← replaceNoCacheT f? b) nd
+    | .app f a =>
+      return e.updateApp! (← replaceNoCacheT f? f) (← replaceNoCacheT f? a)
+    | .proj _ _ b =>
+      return e.updateProj! (← replaceNoCacheT f? b)
+    | e => return e
+
+@[implemented_by ReplaceImpl.replaceUnsafe']
+partial def replaceM [Monad m] (f? : Expr → m (Option Expr)) (e : Expr) : m Expr :=
+  e.replaceNoCacheT f?
+
+def natZero : Expr := .const ``Nat.zero []
+def natSucc : Expr := .const ``Nat.succ []
+
+def isConstructorApp?' (env : Kernel.Environment) (e : Expr) : Option Name := do
+  let .const fn _ := e.getAppFn | none
+  let .ctorInfo _ ← env.find? fn | none
+  return fn
+
+def natLitToConstructor : Nat → Expr
+  | 0 => natZero
+  | n+1 => .app natSucc (.lit (.natVal n))
+
+def strLitToConstructor (s : String) : Expr :=
+  let char := .const ``Char []
+  let listNil := .app (.const ``List.nil [.zero]) char
+  let listCons := .app (.const ``List.cons [.zero]) char
+  let stringMk := .const ``String.ofList []
+  let charOfNat := .const ``Char.ofNat []
+  .app stringMk <| s.toList.foldr (init := listNil) fun c e => -- TODO: use String.foldr
+    .app (.app listCons <| .app charOfNat (.lit (.natVal c.toNat))) e
+
+end Expr
+
+namespace Literal
+
+def toConstructor : Literal → Expr
+  | .natVal n => .natLitToConstructor n
+  | .strVal s => .strLitToConstructor s
+
+/-- Return the type of a literal value. -/
+def typeName : Literal → Name
+  | .natVal _ => ``Nat
+  | .strVal _ => ``String
+
+end Literal
diff --git a/Ix/Theory/Named/Reference/ForEachExprV.lean b/Ix/Theory/Named/Reference/ForEachExprV.lean
new file mode 100644
index 000000000..02bc56362
--- /dev/null
+++ b/Ix/Theory/Named/Reference/ForEachExprV.lean
@@ -0,0 +1,36 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Expr
+import Lean.Util.MonadCache
+
+/-!
+This is the same as `Expr.forEach` but it uses `StateT` instead of `StateRefT` to avoid opaques.
+-/
+namespace Lean
+variable {ω : Type} {m : Type → Type} [Monad m]
+
+namespace ForEachExprV
+def visit (g : Expr → m Bool) (e : Expr) : MonadStateCacheT Expr Unit m Unit :=
+  checkCache e fun _ => do
+    if (← g e) then
+      match e with
+      | Expr.forallE _ d b _   => do visit g d; visit g b
+      | Expr.lam _ d b _       => do visit g d; visit g b
+      | Expr.letE _ t v b _    => do visit g t; visit g v; visit g b
+      | Expr.app f a           => do visit g f; visit g a
+      | Expr.mdata _ b         => visit g b
+      | Expr.proj _ _ b        => visit g b
+      | _                      => pure ()
+
+end ForEachExprV
+
+/-- Apply `f` to each sub-expression of `e`. If `f t` returns false, then t's children are not visited. -/
+@[inline] def Expr.forEachV' (e : Expr) (f : Expr → m Bool) : m Unit :=
+  (ForEachExprV.visit f e).run
+
+@[inline] def Expr.forEachV (e : Expr) (f : Expr → m Unit) : m Unit :=
+  e.forEachV' fun e => do f e; pure true
diff --git a/Ix/Theory/Named/Reference/FuelConfig.lean b/Ix/Theory/Named/Reference/FuelConfig.lean
new file mode 100644
index 000000000..88e8c02a4
--- /dev/null
+++ b/Ix/Theory/Named/Reference/FuelConfig.lean
@@ -0,0 +1,41 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Data.Json.FromToJson
+
+namespace Ix.Theory.Named
+
+/--
+Bounds for the various fixed-fuel loops inside the kernel.
+
+Every field is a positive `Nat`; on exhaustion the corresponding loop throws
+`.deterministicTimeout` (whnf-family) or `.deepRecursion` (structural /
+mutual-recursion loops).
+
+Defaults are set so mathlib passes. Since lean4#13956 the native kernel bounds
+its mutually recursive type-checker entry points using `maxRecDepth`.
+The named reference implementation instead keeps separate, explicit fuel for those calls and for loops
+that need structural termination witnesses; these counters also provide a
+deterministic defensive check against runaway reductions.
+-/
+structure FuelConfig where
+  /-- `whnf'` unfold-loop, non-eager path (`TypeChecker.lean` whnf'). -/
+  whnf        : Nat := 100000
+  /-- `whnf'` unfold-loop, `eagerReduce` path. -/
+  whnfEager   : Nat := 1000000
+  /-- `lazyDeltaReduction.loop`. -/
+  lazyDelta   : Nat := 1000
+  /-- `etaExpand.loop.loop2`. -/
+  etaExpand   : Nat := 1000
+  /-- Starting fuel for `Methods.withFuel` (bounds mutual whnf/isDefEq depth). -/
+  recDepth    : Nat := 10000
+  /-- Shared fuel for the structural loops in `Inductive/Add.lean`. -/
+  inductiveFuel : Nat := 1000
+  /-- Upper bound, in bytes, on the `Nat` numerals the kernel will accept or compute while
+  reducing `Nat` literals. Bounds the memory and time a single reduction can consume. The
+  native kernel spells this bound `LEAN_NAT_MAX_SIZE` and defaults it to the same 128 MB. -/
+  natMaxSize : Nat := 134217728 -- 128 MB; a literal so `simp` cannot renormalize it
+  deriving Repr, Inhabited, Lean.FromJson, Lean.ToJson
diff --git a/Ix/Theory/Named/Reference/Inductive/Add.lean b/Ix/Theory/Named/Reference/Inductive/Add.lean
new file mode 100644
index 000000000..7a7c29a38
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Inductive/Add.lean
@@ -0,0 +1,2941 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Batteries.Data.List.Basic
+import Ix.Theory.Named.Reference.Environment.Basic
+import Ix.Theory.Named.Reference.TypeChecker
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+open private Lean.Kernel.Environment.add from Lean.Environment
+
+namespace AddInductive
+open TypeChecker
+
+structure RecInfo where
+  motive : Expr
+  minors : Array Expr
+  indices : Array Expr
+  major : Expr
+  deriving Inhabited
+
+structure InductiveStats where
+  lctx : LocalContext := {}
+  levels : List Level
+  resultLevel : Level
+  nindices : Array Nat := #[]
+  indConsts : Array Expr
+  params : Array Expr
+  isNotZero : Bool
+  deriving Inhabited
+
+/-- Explicit initial state for family validation. Naming this value keeps the
+executable producer and its exact-result lemmas independent of the opaque
+compiler-generated `Inhabited` instance. -/
+def InductiveStats.initial (levels : List Level) : InductiveStats where
+  levels := levels
+  resultLevel := .zero
+  indConsts := #[]
+  params := #[]
+  isNotZero := false
+
+structure Context where
+  env : Environment
+  lctx : LocalContext := {}
+  lparams : List Name
+  ngen : NameGenerator := { namePrefix := `_ind_fresh }
+  safety : DefinitionSafety
+  allowPrimitive : Bool
+  fuel : FuelConfig := {}
+
+/-- Checker context represented by an inductive-add context. Candidate traces
+retain the latter so Verify can recover this exact former value. -/
+def Context.toTypeChecker (context : Context) : TypeChecker.Context where
+  env := context.env
+  lctx := context.lctx
+  safety := context.safety
+  lparams := context.lparams
+  fuel := context.fuel
+
+/-- The exact free variable allocated by the next `withLocalDecl` in an
+inductive-add context. -/
+def Context.freshFVarId (context : Context) : FVarId :=
+  ⟨context.ngen.curr⟩
+
+def Context.freshExpr (context : Context) : Expr :=
+  .fvar context.freshFVarId
+
+/-- Context seen by the body of the next `withLocalDecl`.  Naming this update
+lets candidate traces index a Pi body by the actual reader context used by the
+producer, rather than retaining an unrelated context as unchecked data. -/
+def Context.pushLocalDecl (context : Context)
+    (name : Name) (binderInfo : BinderInfo) (type : Expr) : Context :=
+  { context with
+    lctx := context.lctx.mkLocalDecl context.freshFVarId name type binderInfo
+    ngen := context.ngen.next }
+
+abbrev M := ReaderT Context <| Except Exception
+
+instance : MonadLocalNameGenerator M where
+  withFreshId f c := f c.ngen.curr { c with ngen := c.ngen.next }
+
+instance (priority := low) : MonadLift TypeChecker.M M where
+  monadLift x c := x.run c.env c.safety c.lctx c.lparams (fuel := c.fuel)
+
+@[simp] theorem liftTypeChecker_apply (x : TypeChecker.M α) (c : Context) :
+    (liftM x : M α) c =
+      x.run c.env c.safety c.lctx c.lparams (fuel := c.fuel) :=
+  rfl
+
+@[simp] theorem liftExcept_apply (x : Except Exception α) (c : Context) :
+    (liftM x : M α) c = x :=
+  rfl
+
+instance (priority := low+1) : MonadWithReaderOf LocalContext M where
+  withReader f x := withReader (fun c => { c with lctx := f c.lctx }) x
+
+instance : MonadLCtx M where
+  getLCtx := return (← read).lctx
+
+@[simp] theorem withLocalDecl_apply
+    (name : Name) (binderInfo : BinderInfo) (type : Expr)
+    (k : Expr → M α) (context : Context) :
+    withLocalDecl name binderInfo type k context =
+      k context.freshExpr
+        (context.pushLocalDecl name binderInfo type) := by
+  rfl
+
+@[inline] def withEnv (env : Environment) (x : M α) : M α :=
+  withReader (fun c => { c with env }) x
+
+/-- Run an action under a different universe parameter list. The recursors are checked under
+their own parameters, which carry the extra eliminator level the declaration itself lacks. -/
+@[inline] def withLParams (lparams : List Name) (x : M α) : M α :=
+  withReader (fun c => { c with lparams }) x
+
+/-- Run a closed-metadata action without inheriting validation-local
+declarations.  All other reader fields, including the staged environment and
+fuel, are preserved exactly. -/
+@[inline] def withEmptyLocalContext (x : M α) : M α :=
+  withReader (fun c : Context => { c with lctx := {} }) x
+
+@[simp] theorem withEmptyLocalContext_apply (x : M α) (context : Context) :
+    withEmptyLocalContext x context = x { context with lctx := {} } := by
+  rfl
+
+def getType (fvar : Expr) : M Expr :=
+  return ((← getLCtx).get! fvar.fvarId!).type
+
+/-- Transparent binder-annotation peeling used by inductive checking.
+
+Lean's `Expr.consumeTypeAnnotations` is an opaque partial implementation.  A
+kernel proof of an exact successful inductive pass cannot reduce through that
+helper, so using it directly would require a separate contract axiom for every
+annotated binder.  This structural mirror covers the same four top-level
+annotations and is regression-checked against Lean's helper below at the
+candidate boundary. -/
+def consumeTypeAnnotations : (source : Expr) → Expr
+  | .app (.app (.const name levels) type) default =>
+    if name = ``_root_.optParam then
+      consumeTypeAnnotations type
+    else if name = ``_root_.autoParam then
+      consumeTypeAnnotations type
+    else
+      .app (.app (.const name levels) type) default
+  | .app (.const name levels) type =>
+    if name = ``_root_.outParam then
+      consumeTypeAnnotations type
+    else if name = ``_root_.semiOutParam then
+      consumeTypeAnnotations type
+    else
+      .app (.const name levels) type
+  | source => source
+termination_by source => sizeOf source
+
+/-- Transparent structural equality used only as a fast path before the
+normalization-based universe comparison. -/
+def levelStructEq : Level → Level → Bool
+  | .zero, .zero => true
+  | .succ u, .succ v => levelStructEq u v
+  | .max u₁ u₂, .max v₁ v₂ | .imax u₁ u₂, .imax v₁ v₂ =>
+    levelStructEq u₁ v₁ && levelStructEq u₂ v₂
+  | .param u, .param v => u == v
+  | .mvar u, .mvar v => u == v
+  | _, _ => false
+
+/-- Transparent sufficient comparison for the common structural universe
+cases used by constructor fields.  Every universe is at least zero, successor
+is monotone, and otherwise exact structural equality is sufficient.  Cases
+outside this deliberately small relation continue to the standard
+normalization-based `Level.geq` comparison below. -/
+def levelStructGe : Level → Level → Bool
+  | _, .zero => true
+  | .succ u, .succ v => levelStructGe u v
+  | u, v => levelStructEq u v
+
+def checkInductiveTypes
+    (nparams : Nat) (indTypes : Array InductiveType)
+    (k : InductiveStats → M α) : M α := do
+  let rec loopInd dIdx stats : M α := do
+    if _h : dIdx < indTypes.size then
+      let indType := indTypes[dIdx]
+      let env := (← read).env
+      let type := indType.type
+      env.checkNoMVarNoFVar indType.name type
+      _ ← checkType type
+      let rec loop stats type i nindices fuel k : M α := match fuel with
+      | 0 => throw .deepRecursion
+      | fuel+1 => do
+        if let .forallE name dom body bi := type then
+          if i < nparams then
+            if stats.indConsts.isEmpty then
+              withLocalDecl name bi (consumeTypeAnnotations dom) fun param => do
+                let stats := { stats with params := stats.params.push param }
+                let type := body.instantiate1 param
+                loop stats (← whnf type) (i + 1) nindices fuel k
+            else
+              let param := stats.params[i]!
+              unless ← isDefEq dom (← getType param) do
+                throw <| .other "parameters of all inductive datatypes must match"
+              let type := body.instantiate1 param
+              loop stats (← whnf type) (i + 1) nindices fuel k
+          else
+            withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+              let type := body.instantiate1 arg
+              loop stats (← whnf type) i (nindices + 1) fuel k
+        else
+          if i != nparams then
+            throw <| .other "number of parameters mismatch in inductive datatype declaration"
+          k type stats nindices
+      let fuel := (← readThe Context).fuel.inductiveFuel
+      loop stats (← whnf type) 0 0 fuel fun type stats nindices => show M α from do
+      let type ← ensureSort type
+      let mut stats := stats
+      let resultLevel := type.sortLevel!
+      if stats.indConsts.isEmpty then
+        let lctx := (← read).lctx
+        stats := { stats with lctx, resultLevel, isNotZero := resultLevel.isNeverZero }
+      else if !resultLevel.isEquiv stats.resultLevel then
+        throw <| .other "mutually inductive types must live in the same universe"
+      stats := { stats with
+        nindices := stats.nindices.push nindices
+        indConsts := stats.indConsts.push (.const indType.name stats.levels) }
+      loopInd (dIdx + 1) stats
+    else
+      k <|
+        assert! stats.levels.length == (← read).lparams.length
+        assert! stats.nindices.size == indTypes.size
+        assert! stats.indConsts.size == indTypes.size
+        assert! stats.params.size == nparams
+        stats
+  termination_by indTypes.size - dIdx
+  loopInd 0 (InductiveStats.initial ((← read).lparams.map .param))
+
+/-- Exact singleton result of the family-validation pass when the family type
+normalizes directly to a sort. This is the non-telescope producer seam used by
+end-to-end candidate certificates: the executable pass selects every retained
+statistic, while callers supply only the ordinary checker runs it consumed. -/
+def singletonInductiveStats (context : Context)
+    (indType : InductiveType) (resultLevel : Level) : InductiveStats where
+  lctx := context.lctx
+  levels := context.lparams.map .param
+  resultLevel := resultLevel
+  nindices := #[0]
+  indConsts := #[.const indType.name (context.lparams.map .param)]
+  params := #[]
+  isNotZero := resultLevel.isNeverZero
+
+theorem checkInductiveTypes_singleton_zero_of_whnf_sort
+    (context : Context) (indType : InductiveType)
+    (inferred : Expr) (resultLevel : Level)
+    (k : InductiveStats → M α)
+    (hfuel : 0 < context.fuel.inductiveFuel)
+    (hclosed :
+      context.env.checkNoMVarNoFVar indType.name indType.type = .ok ())
+    (hcheck :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.checkType indType.type) =
+        .ok inferred)
+    (hwhnf :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.whnf indType.type) =
+        .ok (.sort resultLevel))
+    (hensure :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel
+          (TypeChecker.ensureSort (.sort resultLevel)) =
+        .ok (.sort resultLevel)) :
+    checkInductiveTypes 0 #[indType] k context =
+      k (singletonInductiveStats context indType resultLevel) context := by
+  cases hfuel_eq : context.fuel.inductiveFuel with
+  | zero => omega
+  | succ fuel =>
+    simp [checkInductiveTypes, checkInductiveTypes.loopInd, checkInductiveTypes.loopInd.loop,
+      singletonInductiveStats, readThe, MonadReader.read, MonadReaderOf.read, ReaderT.read,
+      ReaderT.bind, Bind.bind, Pure.pure, Except.bind, Except.pure, liftTypeChecker_apply, hclosed,
+      hcheck, hwhnf, hensure, hfuel_eq, InductiveStats.initial, Expr.sortLevel!]
+
+/-- Transparent occurrence test for constants in the inductive block.
+
+Lean's `Expr.find?` is an opaque native traversal.  Using it here makes the
+kernel's recursive-family and positivity decisions impossible to reduce in an
+exact producer theorem without postulating a separate contract for that
+traversal.  This structural version follows the same expression children and
+keeps those decisions computational in the logic as well as at runtime. -/
+def hasIndOcc (indConsts : Array Expr) : Expr → Bool
+  | .const name _ => indConsts.any fun I => I.constName! == name
+  | .app fn arg => hasIndOcc indConsts fn || hasIndOcc indConsts arg
+  | .lam _ domain body _ | .forallE _ domain body _ =>
+    hasIndOcc indConsts domain || hasIndOcc indConsts body
+  | .letE _ type value body _ =>
+    hasIndOcc indConsts type || hasIndOcc indConsts value ||
+      hasIndOcc indConsts body
+  | .mdata _ body | .proj _ _ body => hasIndOcc indConsts body
+  | _ => false
+
+/-- Return true if declaration is recursive -/
+def isRec (indTypes : Array InductiveType) (indConsts : Array Expr) : Bool :=
+  let rec loop
+    | .forallE _ dom body _ => hasIndOcc indConsts dom || loop body
+    | _ => false
+  indTypes.any fun indType => indType.ctors.any fun ctor => loop ctor.type
+
+/-- Return true if the given declaration is reflexive.
+
+Remark: We say an inductive type `T` is reflexive if it
+contains at least one constructor that takes as an argument a
+function returning `T'` where `T'` is another inductive datatype (possibly equal to `T`)
+in the same mutual declaration. -/
+def isReflexive (indTypes : Array InductiveType) (indConsts : Array Expr) : Bool :=
+  let rec loop
+    | .forallE _ dom body _ => dom.isForall && hasIndOcc indConsts dom || loop body
+    | _ => false
+  indTypes.any fun indType => indType.ctors.any fun ctor => loop ctor.type
+
+def declareInductiveTypes (stats : InductiveStats) (numParams : Nat)
+    (indTypes : Array InductiveType) (numNested : Nat) (isUnsafe : Bool) : M Environment :=
+  fun c =>
+  let all := indTypes.map (·.name) |>.toList
+  let infos := indTypes.zipWith (bs := stats.nindices) fun indType numIndices =>
+    { indType with
+      numParams, numIndices, all, numNested, isUnsafe
+      levelParams := c.lparams
+      ctors := indType.ctors.map (·.name)
+      isRec := isRec indTypes stats.indConsts
+      isReflexive := isReflexive indTypes stats.indConsts }
+  infos.foldlM (init := c.env) fun env info => do
+    env.checkName info.name c.allowPrimitive
+    return env.add (.inductInfo info)
+
+/-- The exact kernel family record assembled for a singleton inductive block.
+Naming it exposes the value installed by `declareInductiveTypes` without
+asking a replay proof to duplicate the producer's record construction. -/
+def singletonDeclaredInfo (stats : InductiveStats) (numParams numIndices : Nat)
+    (indType : InductiveType) (numNested : Nat) (isUnsafe : Bool)
+    (context : Context) : InductiveVal :=
+  { indType with
+    numParams, numIndices, all := [indType.name], numNested, isUnsafe
+    levelParams := context.lparams
+    ctors := indType.ctors.map (·.name)
+    isRec := isRec #[indType] stats.indConsts
+    isReflexive := isReflexive #[indType] stats.indConsts }
+
+/-- A successful singleton family declaration installs exactly the family
+record assembled by the executable producer.  The result equation supplies
+the name-check evidence; replay callers provide only the validator's exact
+singleton index count. -/
+theorem declareInductiveTypes_singleton_constants
+    (stats : InductiveStats) (numParams numIndices : Nat)
+    (indType : InductiveType) (numNested : Nat) (isUnsafe : Bool)
+    (context : Context) (familyEnv : Environment)
+    (hnindices : stats.nindices = #[numIndices])
+    (hdeclare :
+      declareInductiveTypes stats numParams #[indType] numNested isUnsafe context =
+        .ok familyEnv) :
+    familyEnv.constants =
+      context.env.constants.insert indType.name
+        (.inductInfo <| singletonDeclaredInfo stats numParams numIndices
+          indType numNested isUnsafe context) := by
+  unfold declareInductiveTypes at hdeclare
+  rw [hnindices] at hdeclare
+  cases hcheck : context.env.checkName indType.name context.allowPrimitive with
+  | error error =>
+      simp [hcheck, Bind.bind, Except.bind, Pure.pure, Except.pure] at hdeclare
+  | ok _ =>
+      simp [hcheck, Bind.bind, Except.bind, Pure.pure, Except.pure] at hdeclare
+      exact congrArg Kernel.Environment.constants hdeclare.symm
+
+/-- A successful singleton family declaration changes only the constant map;
+in particular it preserves the kernel's quotient-initialization flag. -/
+theorem declareInductiveTypes_singleton_quotInit
+    (stats : InductiveStats) (numParams numIndices : Nat)
+    (indType : InductiveType) (numNested : Nat) (isUnsafe : Bool)
+    (context : Context) (familyEnv : Environment)
+    (hnindices : stats.nindices = #[numIndices])
+    (hdeclare :
+      declareInductiveTypes stats numParams #[indType] numNested isUnsafe context =
+        .ok familyEnv) :
+    familyEnv.quotInit = context.env.quotInit := by
+  unfold declareInductiveTypes at hdeclare
+  rw [hnindices] at hdeclare
+  cases hcheck : context.env.checkName indType.name context.allowPrimitive with
+  | error error =>
+      simp [hcheck, Bind.bind, Except.bind, Pure.pure, Except.pure] at hdeclare
+  | ok _ =>
+      simp [hcheck, Bind.bind, Except.bind, Pure.pure, Except.pure] at hdeclare
+      subst familyEnv
+      rfl
+
+/-- Family declaration observes only the environment, universe parameters,
+and primitive-name policy of its reader context.  In particular, the local
+telescope and fresh-name generator retained by family validation do not alter
+the staged environment it produces. -/
+theorem declareInductiveTypes_context_eq
+    (stats : InductiveStats) (numParams : Nat)
+    (indTypes : Array InductiveType) (numNested : Nat)
+    (isUnsafe : Bool) (left right : Context)
+    (henv : left.env = right.env)
+    (hlparams : left.lparams = right.lparams)
+    (hallow : left.allowPrimitive = right.allowPrimitive) :
+    declareInductiveTypes stats numParams indTypes numNested isUnsafe left =
+      declareInductiveTypes stats numParams indTypes numNested isUnsafe right := by
+  unfold declareInductiveTypes
+  rw [henv, hlparams, hallow]
+
+def isValidIndAppIdx (stats : InductiveStats) (t : Expr) (i : Nat) : Bool :=
+  t.withApp fun I args => Id.run do
+  unless I == stats.indConsts[i]! && args.size == stats.params.size + stats.nindices[i]! do
+    return false
+  for i in [:stats.params.size] do
+    if stats.params[i]! != args[i]! then return false
+  for i in [stats.params.size:args.size] do
+    if hasIndOcc stats.indConsts args[i]! then return false
+  true
+
+def isValidIndApp? (stats : InductiveStats) (t : Expr) : Option Nat := do
+  for i in [:stats.indConsts.size] do
+    if isValidIndAppIdx stats t i then
+      return i
+  none
+
+theorem isValidIndApp?_singleton_zero
+    (stats : InductiveStats) (t : Expr)
+    (hsize : stats.indConsts.size = 1)
+    (hvalid : isValidIndAppIdx stats t 0 = true) :
+    isValidIndApp? stats t = some 0 := by
+  unfold isValidIndApp?
+  simp [hsize, hvalid]
+
+def isRecArg (stats : InductiveStats) (t : Expr) : M (Option Nat) := do
+  loop t (← readThe Context).fuel.inductiveFuel
+where
+  loop t
+  | 0 => throw .deepRecursion
+  | fuel+1 => do
+    let t ← whnf t
+    let .forallE name dom body bi := t | return isValidIndApp? stats t
+    withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+    loop (body.instantiate1 arg) fuel
+
+def checkPositivity (stats : InductiveStats) (t : Expr) (ctor : Name) (idx : Nat) :
+    M Unit := do loop t (← readThe Context).fuel.inductiveFuel where
+  loop t
+  | 0 => throw .deepRecursion
+  | fuel+1 => do
+    let t ← whnf t
+    if !hasIndOcc stats.indConsts t then return
+    if let .forallE name dom body bi := t then
+      if hasIndOcc stats.indConsts dom then
+        throw <| .other s!"arg #{idx + 1} of '{ctor}' \
+          has a non positive occurrence of the datatypes being declared"
+      withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+      loop (body.instantiate1 arg) fuel
+    else if let none := isValidIndApp? stats t then
+      throw <| .other s!"arg #{idx + 1} of '{ctor}' \
+        has a non valid occurrence of the datatypes being declared"
+
+/-- Validate the parameter/field telescope and terminal family application of
+one constructor. This is factored from the outer traversal so successful
+executions can be retained without reproducing compiler-expanded `for` loops. -/
+def checkConstructorType (stats : InductiveStats) (isUnsafe : Bool)
+    (idx : Nat) (n : Name) (t : Expr) : M Unit := do
+  loop t 0 (← readThe Context).fuel.inductiveFuel
+where
+  loop t i
+  | 0 => throw .deepRecursion
+  | fuel+1 => do
+    if let .forallE name dom body bi := t then
+      if let some param := stats.params[i]? then
+        unless ← isDefEq dom (← getType param) do
+          throw <| .other
+            s!"arg #{i + 1} of '{n}' does not match inductive datatype parameters"
+        loop (body.instantiate1 param) (i + 1) fuel
+      else
+        let s ← ensureType dom
+        -- Equal levels are reflexively admissible, so discharge that common
+        -- case before consulting the full normalization comparison.
+        if levelStructGe stats.resultLevel s.sortLevel! then
+          pure ()
+        else
+          unless stats.resultLevel.isAlwaysZero || stats.resultLevel.geq s.sortLevel! do
+            throw <| .other s!"universe level of type_of(arg #{i + 1}) of '{n}' \
+              is too big for the corresponding inductive datatype"
+        if !isUnsafe then
+          checkPositivity stats dom n i
+        withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+          loop (body.instantiate1 arg) (i + 1) fuel
+    else if !isValidIndAppIdx stats t idx then
+      throw <| .other s!"invalid return type for '{n}'"
+
+/-- Validate constructors in source order while retaining the duplicate-name
+accumulator as the fold result. -/
+def checkConstructorFold (env : Environment) (stats : InductiveStats)
+    (isUnsafe : Bool) (idx : Nat) (seen : NameSet)
+    (ctors : List Constructor) : M NameSet := match ctors with
+  | [] => pure seen
+  | ctor :: ctors => do
+    let n := ctor.name
+    if seen.contains n then
+      throw <| .other s!"duplicate constructor name '{n}'"
+    let seen := seen.insert n
+    let t := ctor.type
+    env.checkNoMVarNoFVar n t
+    -- Constructor metadata has just been established to contain no free
+    -- variables. Its full closed-type check does not inherit family locals;
+    -- parameter matching in `checkConstructorType` deliberately does.
+    _ ← withEmptyLocalContext do checkType t
+    checkConstructorType stats isUnsafe idx n t
+    checkConstructorFold env stats isUnsafe idx seen ctors
+
+/-- The named family recursion of `checkConstructors`.  Naming the loop keeps
+the executable shell and its validation-trace mirror aligned without depending
+on proof terms synthesized by `for` notation. -/
+def checkConstructorsLoop (env : Environment) (stats : InductiveStats)
+    (isUnsafe : Bool) : Nat → List InductiveType → M Unit
+  | _, [] => pure ()
+  | idx, indType :: rest => do
+    _ ← checkConstructorFold env stats isUnsafe idx {} indType.ctors
+    checkConstructorsLoop env stats isUnsafe (idx + 1) rest
+
+def checkConstructors (indTypes : Array InductiveType)
+    (stats : InductiveStats) (isUnsafe : Bool) : M Unit := do
+  let env ← getEnv
+  checkConstructorsLoop env stats isUnsafe 0 indTypes.toList
+
+/-- One observed WHNF node in the executable normalization-candidate pass.
+The complete `AddInductive.Context` is retained because Verify must replay the
+same environment, safety mode, local context, level parameters, transparency,
+and checker fuel before the observation acquires semantic authority. -/
+structure CandidateWhnfStep where
+  context : Context
+  source : Expr
+  result : Expr
+
+/-- Exact ordinary-checker execution represented by one retained step. -/
+def CandidateWhnfStep.Valid (step : CandidateWhnfStep) : Prop :=
+  TypeChecker.M.run step.context.env step.context.safety
+      step.context.lctx step.context.lparams step.context.fuel
+      (TypeChecker.whnf step.source) =
+    .ok step.result
+
+/-- The result of evaluating one WHNF step together with the equality that
+certifies the observation. -/
+structure CandidateWhnfObservation (context : Context) (source : Expr) where
+  result : Expr
+  valid : CandidateWhnfStep.Valid ⟨context, source, result⟩
+
+def observeCandidateWhnf (context : Context) (source : Expr) :
+    Except Exception (CandidateWhnfObservation context source) :=
+  match hrun :
+      TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.whnf source) with
+  | .error err => .error err
+  | .ok result => .ok ⟨result, hrun⟩
+
+theorem observeCandidateWhnf_of_run
+    (context : Context) (source result : Expr)
+    (hrun : CandidateWhnfStep.Valid ⟨context, source, result⟩) :
+    observeCandidateWhnf context source = .ok ⟨result, hrun⟩ := by
+  change
+    TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.whnf source) =
+      .ok result at hrun
+  unfold observeCandidateWhnf
+  split
+  · simp_all
+  · rename_i observed hobserved
+    have : observed = result := by simp_all
+    subst observed
+    rfl
+
+/-- Recover the state-bearing recursive checker execution erased by
+`TypeChecker.M.run`. This is the exact `WhnfRun.run_eq` boundary used by
+Verify; no final state is guessed or chosen. -/
+theorem CandidateWhnfStep.innerRun
+    (step : CandidateWhnfStep) (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel + 1)
+    (hvalid : step.Valid) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.whnf' step.source
+          (TypeChecker.Methods.withFuel recursionFuel)
+          step.context.toTypeChecker
+          ({} : TypeChecker.State) =
+        .ok (step.result, state) := by
+  unfold CandidateWhnfStep.Valid at hvalid
+  unfold TypeChecker.M.run TypeChecker.whnf TypeChecker.RecM.run at hvalid
+  simp [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, StateT.bind, Except.bind, Bind.bind,
+    StateT.pure, Except.pure, Pure.pure,
+    StateT.run', Functor.map, Except.map] at hvalid
+  rw [hdepth] at hvalid
+  simp only [TypeChecker.Methods.withFuel,
+    TypeChecker.Inner.whnf] at hvalid
+  cases hinner :
+      TypeChecker.Inner.whnf' step.source
+        (TypeChecker.Methods.withFuel recursionFuel)
+        { env := step.context.env
+          lctx := step.context.lctx
+          safety := step.context.safety
+          lparams := step.context.lparams
+          fuel := step.context.fuel }
+        ({} : TypeChecker.State) with
+  | error err => simp [hinner] at hvalid
+  | ok pair =>
+    rcases pair with ⟨observed, state⟩
+    have : observed = step.result := by
+      simpa [hinner] using hvalid
+    subst observed
+    exact ⟨state, by
+      simpa [Context.toTypeChecker] using hinner⟩
+
+/-- One full, non-inference-only type-check observation retained by the
+candidate producer. -/
+structure CandidateCheckTypeStep where
+  context : Context
+  source : Expr
+  inferred : Expr
+
+def CandidateCheckTypeStep.Valid
+    (step : CandidateCheckTypeStep) : Prop :=
+  TypeChecker.M.run step.context.env step.context.safety
+      step.context.lctx step.context.lparams step.context.fuel
+      (TypeChecker.checkType step.source) =
+    .ok step.inferred
+
+structure CandidateCheckTypeObservation
+    (context : Context) (source : Expr) where
+  inferred : Expr
+  valid : CandidateCheckTypeStep.Valid ⟨context, source, inferred⟩
+
+def observeCandidateCheckType (context : Context) (source : Expr) :
+    Except Exception (CandidateCheckTypeObservation context source) :=
+  match hrun :
+      TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.checkType source) with
+  | .error err => .error err
+  | .ok inferred => .ok ⟨inferred, hrun⟩
+
+theorem observeCandidateCheckType_of_run
+    (context : Context) (source inferred : Expr)
+    (hrun : CandidateCheckTypeStep.Valid
+      ⟨context, source, inferred⟩) :
+    observeCandidateCheckType context source =
+      .ok ⟨inferred, hrun⟩ := by
+  change
+    TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.checkType source) =
+      .ok inferred at hrun
+  unfold observeCandidateCheckType
+  split
+  · simp_all
+  · rename_i observed hobserved
+    have : observed = inferred := by simp_all
+    subst observed
+    rfl
+
+/-- Recover the state-bearing full-check execution erased by `M.run`. -/
+theorem CandidateCheckTypeStep.innerRun
+    (step : CandidateCheckTypeStep) (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel)
+    (hvalid : step.Valid) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.inferType step.source false
+          (TypeChecker.Methods.withFuel recursionFuel)
+          step.context.toTypeChecker
+          ({} : TypeChecker.State) =
+        .ok (step.inferred, state) := by
+  unfold CandidateCheckTypeStep.Valid at hvalid
+  unfold TypeChecker.M.run TypeChecker.checkType
+    TypeChecker.RecM.run at hvalid
+  simp [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, StateT.bind, Except.bind, Bind.bind,
+    StateT.pure, Except.pure, Pure.pure,
+    StateT.run', Functor.map, Except.map] at hvalid
+  rw [hdepth] at hvalid
+  cases hinner :
+      TypeChecker.Inner.inferType step.source false
+        (TypeChecker.Methods.withFuel recursionFuel)
+        { env := step.context.env
+          lctx := step.context.lctx
+          safety := step.context.safety
+          lparams := step.context.lparams
+          fuel := step.context.fuel }
+        ({} : TypeChecker.State) with
+  | error err => simp [hinner] at hvalid
+  | ok pair =>
+    rcases pair with ⟨observed, state⟩
+    have : observed = step.inferred := by
+      simpa [hinner] using hvalid
+    subst observed
+    exact ⟨state, by
+      simpa [Context.toTypeChecker] using hinner⟩
+
+/-- One exact successful definitional-equality observation retained by the
+candidate producer. The result is fixed to `true`; a negative checker result
+is not evidence and aborts candidate construction. -/
+structure CandidateIsDefEqStep where
+  context : Context
+  lhs : Expr
+  rhs : Expr
+
+def CandidateIsDefEqStep.Valid
+    (step : CandidateIsDefEqStep) : Prop :=
+  TypeChecker.M.run step.context.env step.context.safety
+      step.context.lctx step.context.lparams step.context.fuel
+      (TypeChecker.isDefEq step.lhs step.rhs) =
+    .ok true
+
+structure CandidateIsDefEqObservation
+    (context : Context) (lhs rhs : Expr) : Type where
+  valid : CandidateIsDefEqStep.Valid ⟨context, lhs, rhs⟩
+
+def observeCandidateIsDefEq
+    (context : Context) (lhs rhs : Expr) :
+    Except Exception (CandidateIsDefEqObservation context lhs rhs) :=
+  match hrun :
+      TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.isDefEq lhs rhs) with
+  | .error err => .error err
+  | .ok false =>
+    .error (.other "normalization candidate changed a binder domain")
+  | .ok true => .ok ⟨hrun⟩
+
+theorem observeCandidateIsDefEq_of_run
+    (context : Context) (lhs rhs : Expr)
+    (hrun : CandidateIsDefEqStep.Valid ⟨context, lhs, rhs⟩) :
+    observeCandidateIsDefEq context lhs rhs = .ok ⟨hrun⟩ := by
+  change
+    TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.isDefEq lhs rhs) =
+      .ok true at hrun
+  unfold observeCandidateIsDefEq
+  split
+  · simp_all
+  · simp_all
+  · rfl
+
+/-- Recover the state-bearing equality execution erased by `M.run`. -/
+theorem CandidateIsDefEqStep.innerRun
+    (step : CandidateIsDefEqStep) (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel)
+    (hvalid : step.Valid) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEq step.lhs step.rhs
+          (TypeChecker.Methods.withFuel recursionFuel)
+          step.context.toTypeChecker
+          ({} : TypeChecker.State) =
+        .ok (true, state) := by
+  unfold CandidateIsDefEqStep.Valid at hvalid
+  unfold TypeChecker.M.run TypeChecker.isDefEq
+    TypeChecker.RecM.run at hvalid
+  simp [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, StateT.bind, Except.bind, Bind.bind,
+    StateT.pure, Except.pure, Pure.pure,
+    StateT.run', Functor.map, Except.map] at hvalid
+  rw [hdepth] at hvalid
+  cases hinner :
+      TypeChecker.Inner.isDefEq step.lhs step.rhs
+        (TypeChecker.Methods.withFuel recursionFuel)
+        { env := step.context.env
+          lctx := step.context.lctx
+          safety := step.context.safety
+          lparams := step.context.lparams
+          fuel := step.context.fuel }
+        ({} : TypeChecker.State) with
+  | error err => simp [hinner] at hvalid
+  | ok pair =>
+    rcases pair with ⟨observed, state⟩
+    have : observed = true := by
+      simpa [hinner] using hvalid
+    subst observed
+    exact ⟨state, by
+      simpa [Context.toTypeChecker] using hinner⟩
+
+/-- Source-indexed retained full-check execution. -/
+structure CandidateCheckTypeRun (source : Expr) where
+  step : CandidateCheckTypeStep
+  source_eq : step.source = source
+  valid : step.Valid
+
+def buildCandidateCheckType
+    (source : Expr) : M (CandidateCheckTypeRun source) := do
+  let context ← readThe Context
+  match observeCandidateCheckType context source with
+  | .error err => throw err
+  | .ok ⟨inferred, valid⟩ =>
+    return ⟨⟨context, source, inferred⟩, rfl, valid⟩
+
+/-- Structural certificate for the four top-level binder-domain annotations
+peeled by `Expr.consumeTypeAnnotations`.
+
+The certificate exposes which application argument survives. Verify can
+therefore recover a strict translation and free-variable facts for the
+consumed domain from the translated raw domain, without assigning semantic
+authority to Lean's opaque helper. -/
+inductive CandidateTypeAnnotationTrace : Expr → Expr → Type where
+  | identity (source : Expr) :
+      CandidateTypeAnnotationTrace source source
+  | outParam (levels : List Level) (type : Expr)
+      (inner : CandidateTypeAnnotationTrace type consumed) :
+      CandidateTypeAnnotationTrace
+        (.app (.const ``outParam levels) type) consumed
+  | semiOutParam (levels : List Level) (type : Expr)
+      (inner : CandidateTypeAnnotationTrace type consumed) :
+      CandidateTypeAnnotationTrace
+        (.app (.const ``semiOutParam levels) type) consumed
+  | optParam (levels : List Level) (type default : Expr)
+      (inner : CandidateTypeAnnotationTrace type consumed) :
+      CandidateTypeAnnotationTrace
+        (.app (.app (.const ``optParam levels) type) default) consumed
+  | autoParam (levels : List Level) (type tactic : Expr)
+      (inner : CandidateTypeAnnotationTrace type consumed) :
+      CandidateTypeAnnotationTrace
+        (.app (.app (.const ``autoParam levels) type) tactic) consumed
+
+namespace CandidateTypeAnnotationTrace
+
+/-- Transparent structural mirror of the top-level peeling algorithm. -/
+def build : (source : Expr) → Sigma (CandidateTypeAnnotationTrace source)
+  | .app (.app (.const name levels) type) default =>
+    if hopt : name = ``_root_.optParam then by
+      subst name
+      let ⟨consumed, inner⟩ := build type
+      exact ⟨consumed, .optParam levels type default inner⟩
+    else if hauto : name = ``_root_.autoParam then by
+      subst name
+      let ⟨consumed, inner⟩ := build type
+      exact ⟨consumed, .autoParam levels type default inner⟩
+    else
+      ⟨.app (.app (.const name levels) type) default, .identity _⟩
+  | .app (.const name levels) type =>
+    if hout : name = ``_root_.outParam then by
+      subst name
+      let ⟨consumed, inner⟩ := build type
+      exact ⟨consumed, .outParam levels type inner⟩
+    else if hsemi : name = ``_root_.semiOutParam then by
+      subst name
+      let ⟨consumed, inner⟩ := build type
+      exact ⟨consumed, .semiOutParam levels type inner⟩
+    else
+      ⟨.app (.const name levels) type, .identity _⟩
+  | source => ⟨source, .identity source⟩
+termination_by source => sizeOf source
+
+/-- The structural annotation builder computes the same transparent peeling
+used by inductive validation.  This deliberately relates two definitions in
+this module, not Lean's opaque `Expr.consumeTypeAnnotations`. -/
+theorem build_consumed (source : Expr) :
+    (build source).1 = consumeTypeAnnotations source := by
+  fun_induction build source <;> simp_all [consumeTypeAnnotations]
+
+end CandidateTypeAnnotationTrace
+
+/-- A structural peeling certificate. Verify assigns semantic authority only
+to the trace; compatibility with Lean's opaque helper is retained as a
+differential executable check rather than a proof axiom. -/
+structure CandidateTypeAnnotations (source : Expr) where
+  consumed : Expr
+  trace : CandidateTypeAnnotationTrace source consumed
+
+def buildCandidateTypeAnnotations
+    (source : Expr) : Except Exception (CandidateTypeAnnotations source) :=
+  let ⟨consumed, trace⟩ := CandidateTypeAnnotationTrace.build source
+  .ok ⟨consumed, trace⟩
+
+namespace CandidateTypeAnnotations
+
+/-- Operational compatibility with this module's transparent annotation
+peeling.  Semantic consumers still rely on `trace` plus the retained
+definitional-equality execution; `Matches` is used to replay the executable
+family-validation path exactly. -/
+def Matches (annotations : CandidateTypeAnnotations source) : Prop :=
+  annotations.consumed = consumeTypeAnnotations source
+
+theorem matches_of_build
+    (annotations : CandidateTypeAnnotations source)
+    (hbuild : buildCandidateTypeAnnotations source = .ok annotations) :
+    annotations.Matches := by
+  unfold buildCandidateTypeAnnotations at hbuild
+  cases htrace : CandidateTypeAnnotationTrace.build source with
+  | mk consumed trace =>
+    simp only [Except.ok.injEq] at hbuild
+    subst annotations
+    simpa [Matches, htrace] using
+      CandidateTypeAnnotationTrace.build_consumed source
+
+end CandidateTypeAnnotations
+
+/-- Differential check pinning the transparent implementation to Lean's
+opaque helper. This is executable regression evidence, not a logical premise
+of the candidate producer. -/
+def candidateTypeAnnotationsAgree (source : Expr) : Bool :=
+  let ⟨consumed, _⟩ := CandidateTypeAnnotationTrace.build source
+  consumed.equal source.consumeTypeAnnotations
+
+/-- Context- and source-indexed tree underlying one candidate expression.
+The recursive indices are important: a Pi-domain trace uses the exact parent
+context, while its body trace uses precisely `Context.pushLocalDecl` with the
+structurally certified annotation-consumed domain and the corresponding fresh
+free variable. The retained equality run relates that local declaration back
+to the raw binder syntax. Thus expression position, annotation handling, and
+checker-context provenance are enforced by the type rather than being
+invariants of the producer alone. -/
+inductive CandidateExprTrace : Context → Expr → Type where
+  | terminal (context : Context) (source inferred result : Expr)
+      (checked : CandidateCheckTypeStep.Valid
+        ⟨context, source, inferred⟩)
+      (valid : CandidateWhnfStep.Valid ⟨context, source, result⟩) :
+      CandidateExprTrace context source
+  | forallE (context : Context) (source : Expr)
+      (inferred : Expr)
+      (name : Name) (domain body : Expr)
+      (binderInfo : BinderInfo)
+      (fresh : context.lctx.find? context.freshFVarId = none)
+      (annotations : CandidateTypeAnnotations domain)
+      (annotationsEq : CandidateIsDefEqStep.Valid
+        ⟨context, domain, annotations.consumed⟩)
+      (checked : CandidateCheckTypeStep.Valid
+        ⟨context, source, inferred⟩)
+      (valid : CandidateWhnfStep.Valid
+        ⟨context, source, .forallE name domain body binderInfo⟩)
+      (domainCandidate : CandidateExprTrace context domain)
+      (bodyCandidate : CandidateExprTrace
+        (context.pushLocalDecl name binderInfo annotations.consumed)
+        (body.instantiate1 context.freshExpr)) :
+      CandidateExprTrace context source
+
+namespace CandidateExprTrace
+
+/-- The main Pi spine exposed by candidate WHNF was already present in the
+stored source syntax at every traversed body position.
+
+This is the structural precondition needed by mixed generation: it permits
+normalization inside binder domains and at the terminal result, but it does
+not let WHNF invent or remove the raw binders that generation must emit. -/
+def storedSpine :
+    {context : Context} → {source : Expr} →
+      CandidateExprTrace context source → Bool
+  | _, _, .terminal .. => true
+  | _, _, .forallE _ source _ name domain body binderInfo _ _ _ _ _ _
+      bodyCandidate =>
+    Expr.structuralEq source (.forallE name domain body binderInfo) &&
+      storedSpine bodyCandidate
+
+/-- Number of stored Pi binders on the main (body) path of a candidate. -/
+def spineLength :
+    {context : Context} → {source : Expr} →
+      CandidateExprTrace context source → Nat
+  | _, _, .terminal .. => 0
+  | _, _, .forallE _ _ _ _ _ _ _ _ _ _ _ _ _ bodyCandidate =>
+    bodyCandidate.spineLength + 1
+
+/-- The exact full-check observation at the root of a candidate trace. -/
+def rootCheck :
+    CandidateExprTrace context source →
+      CandidateCheckTypeObservation context source
+  | .terminal _ _ inferred _ checked _ => ⟨inferred, checked⟩
+  | .forallE _ _ inferred _ _ _ _ _ _ _ checked _ _ _ =>
+    ⟨inferred, checked⟩
+
+/-- The exact WHNF result at the root, before recursively normalized domains
+and bodies are reassembled into `view`. -/
+def rootWhnf : CandidateExprTrace context source → Expr
+  | .terminal _ _ _ result _ _ => result
+  | .forallE _ _ _ name domain body binderInfo _ _ _ _ _ _ _ =>
+    .forallE name domain body binderInfo
+
+theorem rootWhnf_valid (candidate : CandidateExprTrace context source) :
+    CandidateWhnfStep.Valid ⟨context, source, candidate.rootWhnf⟩ := by
+  cases candidate <;> assumption
+
+/-- Reader context reached after following the complete main Π spine. -/
+def terminalContext : CandidateExprTrace context source → Context
+  | .terminal context _ _ _ _ _ => context
+  | .forallE _ _ _ _ _ _ _ _ _ _ _ _ _ bodyCandidate =>
+    bodyCandidate.terminalContext
+
+theorem terminalContext_lparams
+    (candidate : CandidateExprTrace context source) :
+    candidate.terminalContext.lparams = context.lparams := by
+  induction candidate with
+  | terminal => rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    simpa [terminalContext, Context.pushLocalDecl] using body_ih
+
+/-- Following the main candidate Π spine preserves the kernel environment. -/
+theorem terminalContext_env
+    (candidate : CandidateExprTrace context source) :
+    candidate.terminalContext.env = context.env := by
+  induction candidate with
+  | terminal => rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    simpa [terminalContext, Context.pushLocalDecl] using body_ih
+
+/-- Following the main candidate Π spine preserves the primitive-name
+policy used by family declaration. -/
+theorem terminalContext_allowPrimitive
+    (candidate : CandidateExprTrace context source) :
+    candidate.terminalContext.allowPrimitive = context.allowPrimitive := by
+  induction candidate with
+  | terminal => rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    simpa [terminalContext, Context.pushLocalDecl] using body_ih
+
+/-- Following the main candidate Π spine changes only the local context and
+name generator; it preserves the checker safety mode. -/
+theorem terminalContext_safety
+    (candidate : CandidateExprTrace context source) :
+    candidate.terminalContext.safety = context.safety := by
+  induction candidate with
+  | terminal => rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    simpa [terminalContext, Context.pushLocalDecl] using body_ih
+
+/-- Following the main candidate Π spine preserves the checker fuel
+configuration. -/
+theorem terminalContext_fuel
+    (candidate : CandidateExprTrace context source) :
+    candidate.terminalContext.fuel = context.fuel := by
+  induction candidate with
+  | terminal => rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    simpa [terminalContext, Context.pushLocalDecl] using body_ih
+
+/-- Non-Π result reached after following the complete main Π spine. -/
+def terminalResult : CandidateExprTrace context source → Expr
+  | .terminal _ _ _ result _ _ => result
+  | .forallE _ _ _ _ _ _ _ _ _ _ _ _ _ bodyCandidate =>
+    bodyCandidate.terminalResult
+
+/-- The first `count` local expressions allocated along the main Π spine.
+These are exactly the expressions accumulated as inductive parameters when
+`count` is the declaration's `nparams`. -/
+def parameterList :
+    (count : Nat) → CandidateExprTrace context source → List Expr
+  | 0, _ => []
+  | _ + 1, .terminal .. => []
+  | count + 1,
+      .forallE context _ _ _ _ _ _ _ _ _ _ _ _ bodyCandidate =>
+    context.freshExpr :: bodyCandidate.parameterList count
+
+theorem parameterList_length
+    (candidate : CandidateExprTrace context source)
+    (hcount : count ≤ candidate.spineLength) :
+    (candidate.parameterList count).length = count := by
+  induction candidate generalizing count with
+  | terminal =>
+    simp [spineLength] at hcount
+    subst count
+    rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    cases count with
+    | zero => rfl
+    | succ count =>
+      simp only [parameterList, List.length_cons]
+      rw [body_ih]
+      simpa [spineLength] using hcount
+
+/-- Every annotation choice on the main Π spine matches the transparent
+peeling operation used by `checkInductiveTypes`.  This is operational
+provenance, separate from the semantic raw/consumed equality stored at each
+candidate node. -/
+def validationAnnotations :
+    CandidateExprTrace context source → Prop
+  | .terminal .. => True
+  | .forallE _ _ _ _ _ _ _ _ annotations _ _ _ _ bodyCandidate =>
+    annotations.Matches ∧ bodyCandidate.validationAnnotations
+
+/-- Replay the inner family-telescope validator from a candidate's exact main
+Π spine. The first `remaining` binders extend `stats.params`; every later
+binder contributes an index. The theorem is independent of any fixture and
+preserves the exact terminal reader context reached by the executable loop. -/
+theorem checkInductiveTypes_loop_of_candidate
+    (candidate : CandidateExprTrace context source)
+    (stats : InductiveStats) (nparams i nindices fuel : Nat)
+    (remaining : Nat) (k : Expr → InductiveStats → Nat → M α)
+    (hi : i + remaining = nparams)
+    (hcount : remaining ≤ candidate.spineLength)
+    (hfuel : candidate.spineLength < fuel)
+    (hempty : stats.indConsts.isEmpty = true)
+    (hannotations : candidate.validationAnnotations)
+    (hterminal : candidate.terminalResult.isForall = false) :
+    checkInductiveTypes.loopInd.loop nparams stats candidate.rootWhnf
+        i nindices fuel k context =
+      k candidate.terminalResult
+        { stats with
+          params := stats.params ++
+            (candidate.parameterList remaining).toArray }
+        (nindices + (candidate.spineLength - remaining))
+        candidate.terminalContext := by
+  induction candidate generalizing i nindices fuel remaining stats with
+  | terminal context source inferred result checked valid =>
+    simp only [spineLength] at hcount hfuel
+    have hremaining : remaining = 0 := by omega
+    subst remaining
+    have hi' : i = nparams := by omega
+    subst i
+    cases stats
+    cases fuel with
+    | zero => omega
+    | succ fuel =>
+      cases result <;>
+        simp_all [rootWhnf, terminalResult, terminalContext, parameterList,
+          spineLength, checkInductiveTypes.loopInd.loop, Expr.isForall]
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked valid domainCandidate bodyCandidate
+      domain_ih body_ih =>
+    rcases hannotations with ⟨hmatch, hbodyAnnotations⟩
+    cases remaining with
+    | zero =>
+      have hi' : i = nparams := by omega
+      subst i
+      have hbodyFuel : bodyCandidate.spineLength < fuel - 1 := by
+        simp only [spineLength] at hfuel
+        omega
+      have hbodyCount : 0 ≤ bodyCandidate.spineLength := Nat.zero_le _
+      have hvalid := bodyCandidate.rootWhnf_valid
+      change TypeChecker.M.run _ _ _ _ _
+          (TypeChecker.whnf (body.instantiate1 context.freshExpr)) =
+        .ok bodyCandidate.rootWhnf at hvalid
+      rw [show fuel = (fuel - 1) + 1 by omega]
+      simp only [rootWhnf, checkInductiveTypes.loopInd.loop,
+        Nat.lt_irrefl, if_false, withLocalDecl_apply]
+      rw [← hmatch]
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [hvalid]
+      simp only [Except.bind]
+      rw [body_ih stats nparams (nindices + 1) (fuel - 1) 0 rfl
+        hbodyCount hbodyFuel hempty hbodyAnnotations hterminal]
+      simp [terminalResult, terminalContext, parameterList, spineLength,
+        Nat.add_comm, Nat.add_assoc]
+    | succ remaining =>
+      have hil : i < nparams := by omega
+      have hbodyCount : remaining ≤ bodyCandidate.spineLength := by
+        simp only [spineLength] at hcount
+        omega
+      have hbodyFuel : bodyCandidate.spineLength < fuel - 1 := by
+        simp only [spineLength] at hfuel
+        omega
+      have hvalid := bodyCandidate.rootWhnf_valid
+      change TypeChecker.M.run _ _ _ _ _
+          (TypeChecker.whnf (body.instantiate1 context.freshExpr)) =
+        .ok bodyCandidate.rootWhnf at hvalid
+      rw [show fuel = (fuel - 1) + 1 by omega]
+      simp only [rootWhnf, checkInductiveTypes.loopInd.loop, hil, if_true,
+        hempty, withLocalDecl_apply]
+      rw [← hmatch]
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [hvalid]
+      simp only [Except.bind]
+      rw [body_ih { stats with
+          params := stats.params.push context.freshExpr }
+        (i + 1) nindices (fuel - 1) remaining (by omega)
+        hbodyCount hbodyFuel (by simpa using hempty) hbodyAnnotations
+        hterminal]
+      simp [terminalResult, terminalContext, parameterList, spineLength]
+
+/-- Exact singleton statistics selected by a candidate family spine with an
+arbitrary parameter/index split. -/
+def singletonCandidateInductiveStats
+    (indType : InductiveType)
+    (candidate : CandidateExprTrace context indType.type)
+    (nparams : Nat) (resultLevel : Level) : InductiveStats where
+  lctx := candidate.terminalContext.lctx
+  levels := context.lparams.map .param
+  resultLevel := resultLevel
+  nindices := #[candidate.spineLength - nparams]
+  indConsts := #[.const indType.name (context.lparams.map .param)]
+  params := (candidate.parameterList nparams).toArray
+  isNotZero := resultLevel.isNeverZero
+
+/-- A source-indexed candidate family spine discharges the complete singleton
+family-validation pass for any number of parameters and indices.  The result
+records the same local expressions, terminal context, index count, universe,
+and family constant selected by the executable validator. -/
+theorem checkInductiveTypes_singleton_of_candidate
+    (indType : InductiveType)
+    (candidate : CandidateExprTrace context indType.type)
+    (nparams : Nat) (resultLevel : Level)
+    (k : InductiveStats → M α)
+    (hclosed :
+      context.env.checkNoMVarNoFVar indType.name indType.type = .ok ())
+    (hcount : nparams ≤ candidate.spineLength)
+    (hfuel : candidate.spineLength < context.fuel.inductiveFuel)
+    (hannotations : candidate.validationAnnotations)
+    (hterminal : candidate.terminalResult = .sort resultLevel)
+    (hensure :
+      TypeChecker.M.run candidate.terminalContext.env
+          candidate.terminalContext.safety candidate.terminalContext.lctx
+          candidate.terminalContext.lparams candidate.terminalContext.fuel
+          (TypeChecker.ensureSort (.sort resultLevel)) =
+        .ok (.sort resultLevel)) :
+    checkInductiveTypes nparams #[indType] k context =
+      k (candidate.singletonCandidateInductiveStats
+        indType nparams resultLevel) candidate.terminalContext := by
+  have hcheck := candidate.rootCheck.valid
+  have hwhnf := candidate.rootWhnf_valid
+  change TypeChecker.M.run context.env context.safety context.lctx
+      context.lparams context.fuel (TypeChecker.checkType indType.type) =
+    .ok candidate.rootCheck.inferred at hcheck
+  change TypeChecker.M.run context.env context.safety context.lctx
+      context.lparams context.fuel (TypeChecker.whnf indType.type) =
+    .ok candidate.rootWhnf at hwhnf
+  have hterminalForall : candidate.terminalResult.isForall = false := by
+    rw [hterminal]
+    rfl
+  have hterminalLparams :
+      candidate.terminalContext.lparams = context.lparams :=
+    candidate.terminalContext_lparams
+  have hparameterLength := candidate.parameterList_length hcount
+  unfold checkInductiveTypes
+  simp only [readThe, MonadReader.read, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure, Except.pure, Except.bind]
+  rw [checkInductiveTypes.loopInd.eq_1]
+  have hsize : 0 < #[indType].size := by simp
+  rw [dif_pos hsize]
+  rw [show #[indType][0] = indType by rfl]
+  simp only [readThe, MonadReader.read, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure, Except.pure, Except.bind,
+    liftTypeChecker_apply, hclosed, hcheck, hwhnf]
+  rw [candidate.checkInductiveTypes_loop_of_candidate
+    (stats := InductiveStats.initial (context.lparams.map .param))
+    (nparams := nparams) (i := 0) (nindices := 0)
+    (fuel := context.fuel.inductiveFuel) (remaining := nparams)
+    (hi := Nat.zero_add nparams) (hcount := hcount) (hfuel := hfuel)
+    (hempty := rfl) (hannotations := hannotations)
+    (hterminal := hterminalForall)]
+  rw [hterminal]
+  simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+  rw [hensure]
+  simp only [Except.bind]
+  rw [if_pos (show ((InductiveStats.initial
+      (List.map Level.param context.lparams)).indConsts).isEmpty = true from
+    rfl)]
+  simp only [Expr.sortLevel!, InductiveStats.initial, Nat.zero_add]
+  simp only [ReaderT.bind, Bind.bind, Except.pure, Except.bind]
+  rw [checkInductiveTypes.loopInd.eq_1]
+  have hdone : ¬1 < #[indType].size := by simp
+  rw [dif_neg hdone]
+  simp only [readThe, MonadReader.read, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure, Except.pure, Except.bind]
+  simp [singletonCandidateInductiveStats, hterminalLparams,
+    hparameterLength]
+
+/-- Exact successful singleton family-validation execution retained at the
+candidate selected by `buildNormalizationCandidate`.
+
+The executable validator owns the parameter/index split, result universe,
+statistics, and terminal reader context. Keeping the universally quantified
+continuation equation makes this a decomposition of the real
+`checkInductiveTypes` call rather than a fixture-specific success flag. The
+semantic interpretation of the retained candidate remains in Verify. -/
+structure FamilyValidationRun
+    (indType : InductiveType)
+    {context : Context}
+    (candidate : CandidateExprTrace context indType.type) where
+  nparams : Nat
+  resultLevel : Level
+  stats : InductiveStats
+  stats_eq : stats = candidate.singletonCandidateInductiveStats
+    indType nparams resultLevel
+  terminal_eq : candidate.terminalResult = Expr.sort resultLevel
+  run : ∀ {α} (k : InductiveStats → M α),
+    checkInductiveTypes nparams #[indType] k context =
+      k stats candidate.terminalContext
+
+/-- The retained singleton validation run exposes exactly the candidate view
+parameter expressions selected by the executable family pass. -/
+def FamilyValidationRun.parameters
+    (run : FamilyValidationRun indType candidate) : List Expr :=
+  candidate.parameterList run.nparams
+
+/-- The retained singleton validation run exposes the number of candidate
+view indices following the selected parameter prefix. -/
+def FamilyValidationRun.numIndices
+    (run : FamilyValidationRun indType candidate) : Nat :=
+  candidate.spineLength - run.nparams
+
+/-- Candidate expression reconstructed from the traced WHNF/Pi tree. -/
+def view : CandidateExprTrace context source → Expr
+  | .terminal _ _ _ result _ _ => result
+  | .forallE context _ _ name _ _ binderInfo _ _ _ _ _ domain body =>
+    .forallE name domain.view
+      (body.view.abstract #[context.freshExpr]) binderInfo
+
+/-- Preorder list of all retained checker observations. -/
+def steps : CandidateExprTrace context source → List CandidateWhnfStep
+  | .terminal context source _ result _ _ => [{ context, source, result }]
+  | .forallE context source _ name domain body binderInfo _ _ _ _ _
+      domainCandidate bodyCandidate =>
+    { context, source,
+      result := .forallE name domain body binderInfo } ::
+      domainCandidate.steps ++ bodyCandidate.steps
+
+/-- Preorder list of all retained full-check observations. -/
+def checkSteps : CandidateExprTrace context source → List CandidateCheckTypeStep
+  | .terminal context source inferred _ _ _ =>
+    [{ context, source, inferred }]
+  | .forallE context source inferred _ _ _ _ _ _ _ _ _
+      domainCandidate bodyCandidate =>
+    { context, source, inferred } ::
+      domainCandidate.checkSteps ++ bodyCandidate.checkSteps
+
+/-- Preorder list of all retained binder-domain equality observations. -/
+def isDefEqSteps :
+    CandidateExprTrace context source → List CandidateIsDefEqStep
+  | .terminal .. => []
+  | .forallE context _ _ _ domain _ _ _ annotations _ _ _
+      domainCandidate bodyCandidate =>
+    { context, lhs := domain, rhs := annotations.consumed } ::
+      domainCandidate.isDefEqSteps ++ bodyCandidate.isDefEqSteps
+
+/-- Every retained WHNF observation is an exact checker execution. -/
+theorem allValid : (candidate : CandidateExprTrace context source) →
+    ∀ step ∈ candidate.steps, step.Valid
+  | .terminal context source _ result _ valid, step, h => by
+    simp only [steps, List.mem_singleton] at h
+    subst step
+    exact valid
+  | .forallE _ _ _ _ _ _ _ _ _ _ _ valid domain body, step, h => by
+    simp only [steps, List.mem_cons, List.mem_append] at h
+    rcases h with (rfl | h) | h
+    · exact valid
+    · exact domain.allValid step h
+    · exact body.allValid step h
+
+/-- Every retained full-check observation is an exact checker execution. -/
+theorem allChecksValid : (candidate : CandidateExprTrace context source) →
+    ∀ step ∈ candidate.checkSteps, step.Valid
+  | .terminal context source inferred _ checked _, step, h => by
+    simp only [checkSteps, List.mem_singleton] at h
+    subst step
+    exact checked
+  | .forallE _ _ _ _ _ _ _ _ _ _ checked _ domain body, step, h => by
+    simp only [checkSteps, List.mem_cons, List.mem_append] at h
+    rcases h with (rfl | h) | h
+    · exact checked
+    · exact domain.allChecksValid step h
+    · exact body.allChecksValid step h
+
+/-- Every retained binder-domain equality is an exact successful checker
+execution. -/
+theorem allIsDefEqValid : (candidate : CandidateExprTrace context source) →
+    ∀ step ∈ candidate.isDefEqSteps, step.Valid
+  | .terminal .., step, h => by simp [isDefEqSteps] at h
+  | .forallE _ _ _ _ _ _ _ _ _ annotationsEq _ _ domain body,
+      step, h => by
+    simp only [isDefEqSteps, List.mem_cons, List.mem_append] at h
+    rcases h with (rfl | h) | h
+    · exact annotationsEq
+    · exact domain.allIsDefEqValid step h
+    · exact body.allIsDefEqValid step h
+
+end CandidateExprTrace
+
+/-- Source-indexed trace for one candidate expression. The tree records the
+full-check and WHNF observations at every inspected node and retains the exact
+positional split through Pi domains and instantiated bodies. Every node
+carries the exact checker-run equalities produced by
+`observeCandidateCheckType` and `observeCandidateWhnf`; Theory translation and
+semantic refinement are intentionally separate. -/
+structure CandidateExpr (source : Expr) where
+  context : Context
+  trace : CandidateExprTrace context source
+
+def CandidateExpr.view (candidate : CandidateExpr source) : Expr :=
+  candidate.trace.view
+
+def CandidateExpr.steps
+    (candidate : CandidateExpr source) : List CandidateWhnfStep :=
+  candidate.trace.steps
+
+def CandidateExpr.checkSteps
+    (candidate : CandidateExpr source) :
+    List CandidateCheckTypeStep :=
+  candidate.trace.checkSteps
+
+def CandidateExpr.isDefEqSteps
+    (candidate : CandidateExpr source) :
+    List CandidateIsDefEqStep :=
+  candidate.trace.isDefEqSteps
+
+theorem CandidateExpr.step_valid
+    (candidate : CandidateExpr source)
+    (hstep : step ∈ candidate.steps) :
+    step.Valid :=
+  candidate.trace.allValid step hstep
+
+theorem CandidateExpr.checkStep_valid
+    (candidate : CandidateExpr source)
+    (hstep : step ∈ candidate.checkSteps) :
+    step.Valid :=
+  candidate.trace.allChecksValid step hstep
+
+theorem CandidateExpr.isDefEqStep_valid
+    (candidate : CandidateExpr source)
+    (hstep : step ∈ candidate.isDefEqSteps) :
+    step.Valid :=
+  candidate.trace.allIsDefEqValid step hstep
+
+/-- Normalize exactly the expression positions inspected by inductive
+analysis. Each node is fully checked and then exposed with the ordinary
+checker `whnf`; Pi domains retain their raw syntax, while bodies are traversed
+under the structurally certified annotation-consumed local declarations used
+by kernel checking. Every raw/consumed domain pair is also checked by an exact
+successful ordinary-checker `isDefEq` run. The recursion budget is the
+configured inductive fuel, while every checker run uses the configured
+transparency/fuel.
+
+The returned trace is only a candidate analysis view and operational
+provenance. It is not stored in the kernel environment and acquires semantic
+authority only after Verify reconstructs and refines every retained checker
+run. -/
+def buildCandidateExpr (e : Expr) : M (CandidateExpr e) := do
+  let context ← readThe Context
+  return ⟨context, ← loop context e context.fuel.inductiveFuel⟩
+where
+  loop (context : Context) (e : Expr) :
+      Nat → Except Exception (CandidateExprTrace context e)
+    | 0 => throw .deepRecursion
+    | fuel + 1 => do
+      match observeCandidateCheckType context e with
+      | .error err => throw err
+      | .ok ⟨inferred, checked⟩ =>
+        match observeCandidateWhnf context e with
+        | .error err => throw err
+        | .ok ⟨view, valid⟩ =>
+          match view, valid with
+          | .forallE name domain body binderInfo, valid =>
+            match hfresh : context.lctx.find? context.freshFVarId with
+            | some _ =>
+              throw (Exception.other
+                "normalization candidate generated a duplicate free variable")
+            | none =>
+              let annotations ← buildCandidateTypeAnnotations domain
+              let ⟨annotationsEq⟩ ← observeCandidateIsDefEq
+                context domain annotations.consumed
+              let domainCandidate ← loop context domain fuel
+              let bodyContext :=
+                context.pushLocalDecl name binderInfo
+                  annotations.consumed
+              let bodyCandidate ← loop bodyContext
+                (body.instantiate1 context.freshExpr) fuel
+              return .forallE context e inferred name domain body
+                binderInfo hfresh annotations annotationsEq checked valid
+                domainCandidate bodyCandidate
+          | result, valid =>
+            return .terminal context e inferred result checked valid
+
+/-- One terminal recursive step of `buildCandidateExpr`, with its traversal
+budget made explicit. This is the reusable reduction seam for exact producer
+fixtures; all semantic evidence remains the ordinary checker executions
+stored in the resulting trace. -/
+theorem buildCandidateExpr_loop_of_whnf_nonForall
+    (context : Context) (e inferred view : Expr) (fuel : Nat)
+    (hcheck : CandidateCheckTypeStep.Valid
+      ⟨context, e, inferred⟩)
+    (hrun : CandidateWhnfStep.Valid ⟨context, e, view⟩)
+    (hview : view.isForall = false) :
+    buildCandidateExpr.loop context e (fuel + 1) =
+      .ok (.terminal context e inferred view hcheck hrun) := by
+  unfold buildCandidateExpr.loop
+  rw [observeCandidateCheckType_of_run context e inferred hcheck]
+  rw [observeCandidateWhnf_of_run context e view hrun]
+  cases view <;>
+    simp_all [Expr.isForall, Pure.pure, Except.pure]
+
+/-- One forall recursive step of `buildCandidateExpr`, exposing the exact
+child executions used at the decremented traversal budget. -/
+theorem buildCandidateExpr_loop_of_whnf_forall
+    (context : Context) (e inferred : Expr) (fuel : Nat)
+    (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+    (hfresh : context.lctx.find? context.freshFVarId = none)
+    (annotations : CandidateTypeAnnotations domain)
+    (hannotations :
+      buildCandidateTypeAnnotations domain = .ok annotations)
+    (hannotationsEq : CandidateIsDefEqStep.Valid
+      ⟨context, domain, annotations.consumed⟩)
+    (hcheck : CandidateCheckTypeStep.Valid
+      ⟨context, e, inferred⟩)
+    (hrun : CandidateWhnfStep.Valid
+      ⟨context, e, .forallE name domain body binderInfo⟩)
+    (domainCandidate : CandidateExprTrace context domain)
+    (bodyCandidate : CandidateExprTrace
+      (context.pushLocalDecl name binderInfo annotations.consumed)
+      (body.instantiate1 context.freshExpr))
+    (hdomain :
+      buildCandidateExpr.loop context domain fuel =
+        .ok domainCandidate)
+    (hbody :
+      buildCandidateExpr.loop
+          (context.pushLocalDecl name binderInfo annotations.consumed)
+          (body.instantiate1 context.freshExpr) fuel =
+        .ok bodyCandidate) :
+    buildCandidateExpr.loop context e (fuel + 1) =
+      .ok (.forallE context e inferred name domain body binderInfo
+        hfresh annotations hannotationsEq hcheck hrun
+        domainCandidate bodyCandidate) := by
+  unfold buildCandidateExpr.loop
+  simp only [observeCandidateCheckType_of_run context e inferred hcheck,
+    observeCandidateWhnf_of_run context e
+      (.forallE name domain body binderInfo) hrun]
+  split
+  · simp_all
+  · simp [Bind.bind, Except.bind, hannotations,
+      observeCandidateIsDefEq_of_run context domain
+        annotations.consumed hannotationsEq,
+      hdomain, hbody, Pure.pure, Except.pure]
+
+/-- Every annotation choice on a successfully built candidate main spine
+comes from the transparent annotation builder used by the ordinary producer.
+This recovers validator-replay provenance from the executable traversal
+itself; callers do not supply an independent annotation premise. -/
+theorem CandidateExprTrace.validationAnnotations_of_loop
+    {context : Context} {source : Expr} {fuel : Nat}
+    {candidate : CandidateExprTrace context source}
+    (h : buildCandidateExpr.loop context source fuel = .ok candidate) :
+    candidate.validationAnnotations := by
+  fun_induction buildCandidateExpr.loop context source fuel <;>
+    simp_all
+  case case5 =>
+    simp only [Bind.bind, Except.bind] at h
+    repeat' split at h
+    all_goals try simp_all [Functor.map, Except.map]
+    repeat' split at h
+    all_goals try simp_all
+    subst candidate
+    constructor
+    · apply CandidateTypeAnnotations.matches_of_build
+      assumption
+    · apply_assumption
+      assumption
+  case case6 =>
+    simp only [Pure.pure, Except.pure, Except.ok.injEq] at h
+    subst candidate
+    trivial
+
+/-- A successful ordinary candidate-expression call carries the complete
+annotation provenance needed to replay family validation. -/
+theorem CandidateExpr.validationAnnotations_of_build
+    {context : Context} {source : Expr}
+    {candidate : CandidateExpr source}
+    (h : buildCandidateExpr source context = .ok candidate) :
+    candidate.trace.validationAnnotations := by
+  unfold buildCandidateExpr at h
+  simp [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure, Except.bind, Except.pure] at h
+  split at h <;> try simp_all
+  simp [ReaderT.pure, Pure.pure, Except.pure] at h
+  subst candidate
+  apply CandidateExprTrace.validationAnnotations_of_loop
+  assumption
+
+/-- The context stored at the root of a successful expression candidate is
+the exact reader context in which the ordinary builder was executed. -/
+theorem CandidateExpr.context_eq_of_build
+    {context : Context} {source : Expr}
+    {candidate : CandidateExpr source}
+    (h : buildCandidateExpr source context = .ok candidate) :
+    candidate.context = context := by
+  unfold buildCandidateExpr at h
+  simp [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure, Except.bind, Except.pure] at h
+  split at h <;> try simp_all
+  simp [ReaderT.pure, Pure.pure, Except.pure] at h
+  subst candidate
+  rfl
+
+/-- Erase the operational trace and retain only the analysis expression. -/
+def normalizeCandidateExpr (e : Expr) : M Expr := do
+  return (← buildCandidateExpr e).view
+
+/-- A successful ordinary WHNF run to a non-Pi expression is exactly one
+terminal step of the candidate traversal. This exposes the operational seam
+used by Verify without duplicating the `ReaderT`/checker lift plumbing in
+every certificate. -/
+theorem buildCandidateExpr_of_whnf_nonForall
+    (context : Context) (e inferred view : Expr)
+    (hfuel : 0 < context.fuel.inductiveFuel)
+    (hcheck :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.checkType e) =
+        .ok inferred)
+    (hrun :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.whnf e) =
+        .ok view)
+    (hview : view.isForall = false) :
+    buildCandidateExpr e context =
+      .ok ⟨context, .terminal context e inferred view hcheck hrun⟩ := by
+  cases hf : context.fuel.inductiveFuel with
+  | zero => omega
+  | succ fuel =>
+    cases hresult :
+        TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.whnf e) with
+    | error err => simp [hresult] at hrun
+    | ok result =>
+      have : result = view := by simpa [hresult] using hrun
+      subst result
+      unfold buildCandidateExpr
+      unfold buildCandidateExpr.loop
+      simp [readThe, MonadReaderOf.read, ReaderT.read,
+        ReaderT.bind, Bind.bind, Pure.pure, Except.bind, Except.pure,
+        hf, observeCandidateCheckType_of_run context e inferred hcheck,
+        observeCandidateWhnf_of_run context e view hrun]
+      cases view <;>
+        simp_all [ReaderT.pure, Pure.pure, Except.pure, Expr.isForall]
+
+theorem normalizeCandidateExpr_of_whnf_nonForall
+    (context : Context) (e inferred view : Expr)
+    (hfuel : 0 < context.fuel.inductiveFuel)
+    (hcheck :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.checkType e) =
+        .ok inferred)
+    (hrun :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.whnf e) =
+        .ok view)
+    (hview : view.isForall = false) :
+    normalizeCandidateExpr e context = .ok view := by
+  simp [normalizeCandidateExpr, ReaderT.bind, Bind.bind,
+    ReaderT.pure, Pure.pure, Except.bind, Except.pure,
+    CandidateExpr.view, CandidateExprTrace.view,
+    buildCandidateExpr_of_whnf_nonForall context e inferred view
+      hfuel hcheck hrun hview]
+
+/-- A dependent list retains the exact source position of each candidate. -/
+inductive CandidateList {α : Type} (F : α → Type) : List α → Type
+  | nil : CandidateList F []
+  | cons : F a → CandidateList F as → CandidateList F (a :: as)
+
+namespace CandidateList
+
+def toList (f : (a : α) → F a → β) :
+    CandidateList F source → List β
+  | .nil => []
+  | .cons head tail => f _ head :: tail.toList f
+
+/-- Eliminate a source-indexed singleton without a partial list operation. -/
+def singleton : CandidateList F [source] → F source
+  | .cons head .nil => head
+
+/-- A source-indexed singleton list is completely determined by its total
+singleton projection.  This eta law lets retained producer witnesses be
+reindexed at staged singleton APIs without inspecting or replacing their
+candidate payload. -/
+theorem singleton_eta (candidates : CandidateList F [source]) :
+    candidates = .cons candidates.singleton .nil := by
+  cases candidates with
+  | cons head tail =>
+      cases tail
+      rfl
+
+end CandidateList
+
+/-- Candidate for one constructor; its header is always taken from `source`. -/
+structure CandidateConstructor (source : Constructor) where
+  type : CandidateExpr source.type
+
+def CandidateConstructor.view
+    (candidate : CandidateConstructor source) : Constructor :=
+  { source with type := candidate.type.view }
+
+/-- Candidate for one family type, computed before raw family insertion. -/
+structure CandidateFamilyType (source : InductiveType) where
+  type : CandidateExpr source.type
+
+/-- Complete candidate for one family, with constructor traces computed only
+after raw family insertion. -/
+structure CandidateFamily (source : InductiveType) where
+  familyType : CandidateFamilyType source
+  constructors :
+    CandidateList CandidateConstructor source.ctors
+
+/-- Project the pre-family candidate spine from a complete dependent family
+candidate list without erasing source indices or using a parallel list. -/
+def CandidateList.familyTypes :
+    {sources : List InductiveType} →
+      CandidateList CandidateFamily sources →
+      CandidateList CandidateFamilyType sources
+  | [], .nil => .nil
+  | _ :: _, .cons family families =>
+    .cons family.familyType families.familyTypes
+
+def CandidateFamily.view (candidate : CandidateFamily source) : InductiveType :=
+  { source with
+    type := candidate.familyType.type.view
+    ctors := candidate.constructors.toList fun _ ctor => ctor.view }
+
+def normalizeCandidateConstructor
+    (ctor : Constructor) : M (CandidateConstructor ctor) := do
+  return ⟨← buildCandidateExpr ctor.type⟩
+
+/-- The root context stored by a successful constructor normalization is the
+exact post-family reader context used for that traversal. -/
+theorem CandidateConstructor.context_eq_of_normalize
+    {context : Context} {source : Constructor}
+    {candidate : CandidateConstructor source}
+    (h : normalizeCandidateConstructor source context = .ok candidate) :
+    candidate.type.context = context := by
+  unfold normalizeCandidateConstructor at h
+  simp only [ReaderT.bind, Bind.bind] at h
+  cases hbuild : buildCandidateExpr source.type context with
+  | error error =>
+      simp [Except.bind, hbuild] at h
+  | ok type =>
+      simp [Except.bind, ReaderT.pure, Pure.pure, Except.pure, hbuild] at h
+      subst candidate
+      exact CandidateExpr.context_eq_of_build hbuild
+
+def normalizeCandidateFamilyType
+    (indType : InductiveType) : M (CandidateFamilyType indType) := do
+  return ⟨← buildCandidateExpr indType.type⟩
+
+/-- A successful family-type normalization carries the annotation provenance
+of its underlying executable expression traversal. -/
+theorem CandidateFamilyType.validationAnnotations_of_normalize
+    {context : Context} {source : InductiveType}
+    {candidate : CandidateFamilyType source}
+    (h : normalizeCandidateFamilyType source context = .ok candidate) :
+    candidate.type.trace.validationAnnotations := by
+  unfold normalizeCandidateFamilyType at h
+  simp only [ReaderT.bind, Bind.bind] at h
+  cases hbuild : buildCandidateExpr source.type context with
+  | error error =>
+      simp [Except.bind, hbuild] at h
+  | ok type =>
+      simp [Except.bind, ReaderT.pure, Pure.pure, Except.pure, hbuild] at h
+      subst candidate
+      exact type.validationAnnotations_of_build hbuild
+
+/-- The root context stored by a successful family-type normalization is the
+exact pre-family reader context used for that traversal. -/
+theorem CandidateFamilyType.context_eq_of_normalize
+    {context : Context} {source : Lean.InductiveType}
+    {candidate : CandidateFamilyType source}
+    (h : normalizeCandidateFamilyType source context = .ok candidate) :
+    candidate.type.context = context := by
+  unfold normalizeCandidateFamilyType at h
+  simp only [ReaderT.bind, Bind.bind] at h
+  cases hbuild : buildCandidateExpr source.type context with
+  | error error =>
+      simp [Except.bind, hbuild] at h
+  | ok type =>
+      simp [Except.bind, ReaderT.pure, Pure.pure, Except.pure, hbuild] at h
+      subst candidate
+      exact CandidateExpr.context_eq_of_build hbuild
+
+def normalizeCandidateConstructorList :
+    (ctors : List Constructor) →
+      M (CandidateList CandidateConstructor ctors)
+  | [] => return .nil
+  | ctor :: ctors => do
+    return .cons (← normalizeCandidateConstructor ctor)
+      (← normalizeCandidateConstructorList ctors)
+
+def normalizeCandidateFamilyTypeList :
+    (types : List InductiveType) →
+      M (CandidateList CandidateFamilyType types)
+  | [] => return .nil
+  | indType :: types => do
+    return .cons (← normalizeCandidateFamilyType indType)
+      (← normalizeCandidateFamilyTypeList types)
+
+def normalizeCandidateFamilyList :
+    {types : List InductiveType} →
+      CandidateList CandidateFamilyType types →
+      M (CandidateList CandidateFamily types)
+  | [], .nil => return .nil
+  | indType :: _, .cons familyType tail => do
+    return .cons
+      { familyType,
+        constructors := ←
+          normalizeCandidateConstructorList indType.ctors }
+      (← normalizeCandidateFamilyList tail)
+
+/-- Exact successful traversal of an arbitrary source-indexed family-type
+list. The dependent indices prevent a proof for one metadata position from
+being reused at another position or from silently truncating the source. -/
+inductive CandidateFamilyTypeListProduced (context : Context) :
+    {sources : List InductiveType} →
+      CandidateList CandidateFamilyType sources → Prop where
+  | nil : CandidateFamilyTypeListProduced context .nil
+  | cons
+      (head : normalizeCandidateFamilyType source context = .ok candidate)
+      (tail : CandidateFamilyTypeListProduced context candidates) :
+      CandidateFamilyTypeListProduced context (.cons candidate candidates)
+
+/-- A source-indexed family-type traversal determines the complete executable
+list result for any length, without a fixture-specific list reduction. -/
+theorem CandidateFamilyTypeListProduced.normalize
+    {sources : List InductiveType}
+    {candidates : CandidateList CandidateFamilyType sources}
+    (run : CandidateFamilyTypeListProduced context candidates) :
+    normalizeCandidateFamilyTypeList sources context = .ok candidates := by
+  induction run with
+  | nil => rfl
+  | cons head tail ih =>
+    unfold normalizeCandidateFamilyTypeList
+    simp only [ReaderT.bind, Bind.bind]
+    rw [head, ih]
+    rfl
+
+/-- A successful singleton family-type traversal retains the annotation
+provenance of the exact candidate selected at its sole source position. -/
+theorem CandidateFamilyTypeListProduced.singleton_validationAnnotations
+    {context : Context} {source : Lean.InductiveType}
+    {candidates : CandidateList CandidateFamilyType [source]}
+    (run : CandidateFamilyTypeListProduced context candidates) :
+    candidates.singleton.type.trace.validationAnnotations := by
+  cases run with
+  | cons head tail =>
+      cases tail
+      exact CandidateFamilyType.validationAnnotations_of_normalize head
+
+/-- A successful singleton family-type traversal stores its exact traversal
+context at the candidate root. -/
+theorem CandidateFamilyTypeListProduced.singleton_context_eq
+    {context : Context} {source : Lean.InductiveType}
+    {candidates : CandidateList CandidateFamilyType [source]}
+    (run : CandidateFamilyTypeListProduced context candidates) :
+    candidates.singleton.type.context = context := by
+  cases run with
+  | cons head tail =>
+      cases tail
+      exact CandidateFamilyType.context_eq_of_normalize head
+
+/-- Exact successful traversal of an arbitrary source-indexed constructor
+list in one post-family context. Every candidate remains indexed by its source
+constructor, so ordering, length, and header provenance are preserved by the
+type rather than recovered from an erased list equality. -/
+inductive CandidateConstructorListProduced (context : Context) :
+    {sources : List Constructor} →
+      CandidateList CandidateConstructor sources → Prop where
+  | nil : CandidateConstructorListProduced context .nil
+  | cons
+      (head : normalizeCandidateConstructor source context = .ok candidate)
+      (tail : CandidateConstructorListProduced context candidates) :
+      CandidateConstructorListProduced context (.cons candidate candidates)
+
+/-- A source-indexed constructor traversal determines the complete executable
+list result for any length, with no `zip`, partial lookup, or fixture-specific
+cons-chain reduction. -/
+theorem CandidateConstructorListProduced.normalize
+    {sources : List Constructor}
+    {candidates : CandidateList CandidateConstructor sources}
+    (run : CandidateConstructorListProduced context candidates) :
+    normalizeCandidateConstructorList sources context = .ok candidates := by
+  induction run with
+  | nil => rfl
+  | cons head tail ih =>
+    unfold normalizeCandidateConstructorList
+    simp only [ReaderT.bind, Bind.bind]
+    rw [head, ih]
+    rfl
+
+/-- A successful singleton constructor traversal stores its exact traversal
+context at the candidate root. -/
+theorem CandidateConstructorListProduced.singleton_context_eq
+    {context : Context} {source : Constructor}
+    {candidates : CandidateList CandidateConstructor [source]}
+    (run : CandidateConstructorListProduced context candidates) :
+    candidates.singleton.type.context = context := by
+  cases run with
+  | cons head tail =>
+      cases tail
+      exact CandidateConstructor.context_eq_of_normalize head
+
+/-- Exact successful assembly of complete family candidates from an already
+source-indexed family-type list. Each constructor traversal is tied to the
+corresponding family source, and the tail remains tied to the remaining family
+sources. This is the reusable ordered-list boundary needed before mutual-block
+staging. -/
+inductive CandidateFamilyListProduced (context : Context) :
+    {sources : List InductiveType} →
+      CandidateList CandidateFamilyType sources →
+      CandidateList CandidateFamily sources → Prop where
+  | nil : CandidateFamilyListProduced context .nil .nil
+  | cons
+      (constructors : CandidateConstructorListProduced
+        context family.constructors)
+      (tail : CandidateFamilyListProduced context familyTypes families) :
+      CandidateFamilyListProduced context
+        (.cons family.familyType familyTypes) (.cons family families)
+
+/-- Source-indexed family assembly determines the exact executable family-list
+result for arbitrary list lengths. -/
+theorem CandidateFamilyListProduced.normalize
+    {sources : List InductiveType}
+    {familyTypes : CandidateList CandidateFamilyType sources}
+    {families : CandidateList CandidateFamily sources}
+    (run : CandidateFamilyListProduced context familyTypes families) :
+    normalizeCandidateFamilyList familyTypes context = .ok families := by
+  induction run with
+  | nil => rfl
+  | cons constructors tail ih =>
+    unfold normalizeCandidateFamilyList
+    simp only [ReaderT.bind, Bind.bind]
+    rw [constructors.normalize, ih]
+    rfl
+
+/-- Singleton family assembly reuses, without replacement, the family-type
+candidate produced in the pre-family environment. -/
+theorem CandidateFamilyListProduced.singleton_familyType
+    {context : Context} {source : Lean.InductiveType}
+    {familyTypes : CandidateList CandidateFamilyType [source]}
+    {families : CandidateList CandidateFamily [source]}
+    (run : CandidateFamilyListProduced context familyTypes families) :
+    families.singleton.familyType = familyTypes.singleton := by
+  cases run with
+  | cons constructors tail =>
+      cases tail
+      rfl
+
+/-- Singleton family assembly exposes the exact source-indexed constructor
+traversal retained for its sole family. -/
+theorem CandidateFamilyListProduced.singleton_constructors
+    {context : Context} {source : Lean.InductiveType}
+    {familyTypes : CandidateList CandidateFamilyType [source]}
+    {families : CandidateList CandidateFamily [source]}
+    (run : CandidateFamilyListProduced context familyTypes families) :
+    CandidateConstructorListProduced context
+      families.singleton.constructors := by
+  cases run with
+  | cons constructors tail =>
+      cases tail
+      exact constructors
+
+/-- A successful singleton family assembly can be reindexed directly by the
+family-type payload retained in its assembled result.  This dependent eta law
+avoids rewriting the input list underneath the execution witness. -/
+theorem CandidateFamilyListProduced.singleton_reindex
+    {context : Context} {source : Lean.InductiveType}
+    {familyTypes : CandidateList CandidateFamilyType [source]}
+    {families : CandidateList CandidateFamily [source]}
+    (run : CandidateFamilyListProduced context familyTypes families) :
+    CandidateFamilyListProduced context
+      (.cons families.singleton.familyType .nil) families := by
+  cases run with
+  | cons constructors tail =>
+      cases tail
+      exact .cons constructors .nil
+
+/-- Shape-preserving output of the executable normalization-candidate pass.
+The dependent family/constructor lists prevent positional provenance from
+being silently reused for a different inductive request. Names, ordering, and
+record headers come from the indexed source; only expression payloads are
+reconstructed from candidate traces. -/
+structure NormalizationCandidate (source : List InductiveType) where
+  families : CandidateList CandidateFamily source
+
+def NormalizationCandidate.view
+    (candidate : NormalizationCandidate source) : List InductiveType :=
+  candidate.families.toList fun _ family => family.view
+
+/-- One exact family-type traversal result together with the source-indexed
+operational witness that produced it.  The witness is provenance for later
+Verify staging; it carries no Theory semantics. -/
+structure CandidateFamilyTypeListExecution (context : Context)
+    (sources : List InductiveType) where
+  candidates : CandidateList CandidateFamilyType sources
+  produced : CandidateFamilyTypeListProduced context candidates
+
+/-- Run the existing family-type normalizer while retaining its exact
+source-ordered traversal equations.  Errors and candidate data are unchanged. -/
+def executeCandidateFamilyTypeList (context : Context) :
+    (sources : List InductiveType) →
+      Except Exception (CandidateFamilyTypeListExecution context sources)
+  | [] => .ok ⟨.nil, .nil⟩
+  | source :: sources =>
+      match hhead : normalizeCandidateFamilyType source context with
+      | .error error => .error error
+      | .ok head =>
+          match executeCandidateFamilyTypeList context sources with
+          | .error error => .error error
+          | .ok tail => .ok {
+              candidates := .cons head tail.candidates
+              produced := .cons (by simpa using hhead) tail.produced }
+
+/-- One exact constructor traversal result together with its source-indexed
+operational witness. -/
+structure CandidateConstructorListExecution (context : Context)
+    (sources : List Constructor) where
+  candidates : CandidateList CandidateConstructor sources
+  produced : CandidateConstructorListProduced context candidates
+
+/-- Run the existing constructor normalizer while retaining its exact
+source-ordered traversal equations. -/
+def executeCandidateConstructorList (context : Context) :
+    (sources : List Constructor) →
+      Except Exception (CandidateConstructorListExecution context sources)
+  | [] => .ok ⟨.nil, .nil⟩
+  | source :: sources =>
+      match hhead : normalizeCandidateConstructor source context with
+      | .error error => .error error
+      | .ok head =>
+          match executeCandidateConstructorList context sources with
+          | .error error => .error error
+          | .ok tail => .ok {
+              candidates := .cons head tail.candidates
+              produced := .cons (by simpa using hhead) tail.produced }
+
+/-- One exact family/constructor assembly result together with both dependent
+source lists retained by the ordinary traversal. -/
+structure CandidateFamilyListExecution (context : Context)
+    {sources : List InductiveType}
+    (familyTypes : CandidateList CandidateFamilyType sources) where
+  candidates : CandidateList CandidateFamily sources
+  produced : CandidateFamilyListProduced context familyTypes candidates
+
+/-- Run the existing family assembler while retaining each constructor-list
+execution.  This is an operational refinement of
+`normalizeCandidateFamilyList`, not an additional acceptance premise. -/
+def executeCandidateFamilyList (context : Context) :
+    {sources : List InductiveType} →
+    (familyTypes : CandidateList CandidateFamilyType sources) →
+      Except Exception (CandidateFamilyListExecution context familyTypes)
+  | [], .nil => .ok ⟨.nil, .nil⟩
+  | source :: _, .cons familyType familyTypes =>
+      match executeCandidateConstructorList context source.ctors with
+      | .error error => .error error
+      | .ok constructors =>
+          match executeCandidateFamilyList context familyTypes with
+          | .error error => .error error
+          | .ok tail =>
+            let family : CandidateFamily source := {
+              familyType
+              constructors := constructors.candidates }
+            .ok {
+              candidates := .cons family tail.candidates
+              produced := by
+                change CandidateFamilyListProduced context
+                  (.cons family.familyType familyTypes)
+                  (.cons family tail.candidates)
+                exact .cons constructors.produced tail.produced }
+
+/-- Detailed operational result of `buildNormalizationCandidate`.
+
+The ordinary result erases to `candidate`.  The remaining fields retain the
+validator-selected statistics, intermediate environment, and exact list
+traversals already executed by the same call.  Verify uses these equations as
+staging provenance; all semantic authority still comes from the D1--D4
+interpreters. -/
+structure NormalizationCandidateExecution
+    (nparams : Nat) (types : List InductiveType)
+    (numNested : Nat) (isUnsafe : Bool) (candidateContext : Context) where
+  validationContext : Context
+  stats : InductiveStats
+  familyTypes : CandidateFamilyTypeListExecution
+    { candidateContext with lctx := {} } types
+  familyEnv : Environment
+  declareRun : declareInductiveTypes stats nparams types.toArray
+    numNested isUnsafe validationContext = .ok familyEnv
+  constructorRun : checkConstructors types.toArray stats isUnsafe
+    { validationContext with env := familyEnv } = .ok ()
+  families : CandidateFamilyListExecution
+    { candidateContext with env := familyEnv, lctx := {} }
+    familyTypes.candidates
+
+def NormalizationCandidateExecution.candidate
+    (execution : NormalizationCandidateExecution nparams types numNested
+      isUnsafe candidateContext) : NormalizationCandidate types :=
+  ⟨execution.families.candidates⟩
+
+/-- The post-family half of the detailed ordinary execution. -/
+def buildNormalizationCandidateExecutionAfterValidation
+    (nparams : Nat) (types : List InductiveType)
+    (numNested : Nat) (isUnsafe : Bool) (candidateContext : Context)
+    (stats : InductiveStats) :
+    M (NormalizationCandidateExecution nparams types numNested isUnsafe
+      candidateContext) :=
+  fun validationContext =>
+    match executeCandidateFamilyTypeList
+        { candidateContext with lctx := {} } types with
+    | .error error => .error error
+    | .ok familyTypes =>
+      match hdeclare : declareInductiveTypes stats nparams types.toArray
+          numNested isUnsafe validationContext with
+      | .error error => .error error
+      | .ok familyEnv =>
+        match hconstructors : checkConstructors types.toArray stats isUnsafe
+            { validationContext with env := familyEnv } with
+        | .error error => .error error
+        | .ok () =>
+          match executeCandidateFamilyList
+              { candidateContext with env := familyEnv, lctx := {} }
+              familyTypes.candidates with
+          | .error error => .error error
+          | .ok families => .ok {
+              validationContext
+              stats
+              familyTypes
+              familyEnv
+              declareRun := by simpa using hdeclare
+              constructorRun := by simpa using hconstructors
+              families }
+
+/-- A retained successful post-validation execution exposes exactly the
+statistics and reader context supplied by the family validator. -/
+theorem NormalizationCandidateExecution.fields_of_afterValidation
+    (execution : NormalizationCandidateExecution nparams types numNested
+      isUnsafe candidateContext)
+    (stats : InductiveStats) (validationContext : Context)
+    (h : buildNormalizationCandidateExecutionAfterValidation nparams types
+        numNested isUnsafe candidateContext stats validationContext =
+      .ok execution) :
+    execution.stats = stats ∧
+      execution.validationContext = validationContext := by
+  unfold buildNormalizationCandidateExecutionAfterValidation at h
+  repeat' split at h
+  all_goals try simp_all
+  subst execution
+  exact ⟨rfl, rfl⟩
+
+/-- Execute the ordinary singleton/mutual candidate pass while retaining the
+exact operational provenance erased by the public candidate result. -/
+def buildNormalizationCandidateExecution
+    (nparams : Nat) (types : List InductiveType)
+    (numNested : Nat) (isUnsafe : Bool) (candidateContext : Context) :
+    Except Exception (NormalizationCandidateExecution nparams types
+      numNested isUnsafe candidateContext) :=
+  checkInductiveTypes nparams types.toArray (fun stats =>
+    buildNormalizationCandidateExecutionAfterValidation nparams types
+      numNested isUnsafe candidateContext stats) candidateContext
+
+/-- Run the generic one-pass candidate producer at the same two environments
+as kernel inductive checking: family types in the input environment, then
+constructor types after insertion of every raw family constant.
+
+This repeats the ordinary family/constructor validity checks so a candidate
+cannot be obtained from metadata already rejected at those stages. The Theory
+analyzer and Verify semantic certificate remain separate downstream gates. -/
+def buildNormalizationCandidate
+    (nparams : Nat) (types : List InductiveType)
+    (numNested : Nat) (isUnsafe : Bool) :
+    M (NormalizationCandidate types) :=
+  -- Family validation retains its parameter/index telescope while invoking
+  -- the continuation.  That context is required by `checkConstructors`, whose
+  -- parameter checks refer to the free variables recorded in `stats`, but it
+  -- is not part of the closed metadata being normalized.  Snapshot the entry
+  -- context so both candidate traversals use one stable fresh-name provenance
+  -- and an empty local context; only the staged kernel environment changes.
+  fun candidateContext =>
+  let indTypes := types.toArray
+  checkInductiveTypes nparams indTypes (fun stats => do
+    let familyTypes ←
+      withReader (fun _ : Context => { candidateContext with lctx := {} }) do
+        normalizeCandidateFamilyTypeList types
+    let familyEnv ←
+      declareInductiveTypes stats nparams indTypes numNested isUnsafe
+    withEnv familyEnv do
+      checkConstructors indTypes stats isUnsafe
+      let families ←
+        withReader (fun _ : Context =>
+          { candidateContext with env := familyEnv, lctx := {} }) do
+          normalizeCandidateFamilyList familyTypes
+      return ⟨families⟩) candidateContext
+
+/-- Erase a retained successful execution back to the unchanged public
+candidate producer.  The family-validation equation supplies the continuation
+boundary selected by `checkInductiveTypes`; every later rewrite comes from an
+operation already stored in `execution`. -/
+theorem NormalizationCandidateExecution.produces
+    (execution : NormalizationCandidateExecution nparams types numNested
+      isUnsafe candidateContext)
+    (validationRun : ∀ {α} (k : InductiveStats → M α),
+      checkInductiveTypes nparams types.toArray k candidateContext =
+        k execution.stats execution.validationContext) :
+    buildNormalizationCandidate nparams types numNested isUnsafe
+        candidateContext = .ok execution.candidate := by
+  unfold buildNormalizationCandidate
+  rw [validationRun]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [show
+    (withReader (fun _ : Context =>
+        { candidateContext with lctx := {} })
+      (normalizeCandidateFamilyTypeList types)) execution.validationContext =
+        .ok execution.familyTypes.candidates by
+      change normalizeCandidateFamilyTypeList types
+        { candidateContext with lctx := {} } = _
+      exact execution.familyTypes.produced.normalize]
+  simp only [Except.bind]
+  rw [execution.declareRun]
+  unfold withEnv
+  change (ReaderT.bind
+      (checkConstructors types.toArray execution.stats isUnsafe)
+      (fun _ => ReaderT.bind
+        (withReader (fun _ : Context =>
+          { candidateContext with
+            env := execution.familyEnv, lctx := {} })
+          (normalizeCandidateFamilyList execution.familyTypes.candidates))
+        (fun families => pure
+          (⟨families⟩ : NormalizationCandidate types))))
+      ({ execution.validationContext with
+        env := execution.familyEnv } : Context) = _
+  simp only [ReaderT.bind, Bind.bind]
+  rw [execution.constructorRun]
+  simp only [Except.bind]
+  rw [show
+    (withReader (fun _ : Context =>
+        { candidateContext with
+          env := execution.familyEnv, lctx := {} })
+      (normalizeCandidateFamilyList execution.familyTypes.candidates))
+      { execution.validationContext with env := execution.familyEnv } =
+        .ok execution.families.candidates by
+      change normalizeCandidateFamilyList execution.familyTypes.candidates
+        { candidateContext with env := execution.familyEnv, lctx := {} } = _
+      exact execution.families.produced.normalize]
+  rfl
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.buildCandidateExpr [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.observeCandidateIsDefEq_of_run [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_nonForall [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_forall [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateTypeAnnotationTrace.build [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateTypeAnnotationTrace.build_consumed [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.buildCandidateTypeAnnotations [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateTypeAnnotations.matches_of_build [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.buildCandidateCheckType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.buildNormalizationCandidate [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateFamilyTypeListProduced.normalize [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateConstructorListProduced.normalize [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateFamilyListProduced.normalize [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateList.singleton []
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.storedSpine [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.spineLength [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.rootWhnf_valid [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.terminalContext_lparams [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.parameterList_length [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.checkInductiveTypes_loop_of_candidate [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.checkInductiveTypes_singleton_of_candidate [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.FamilyValidationRun [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.FamilyValidationRun.parameters [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExprTrace.FamilyValidationRun.numIndices [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExpr.step_valid [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExpr.checkStep_valid [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateExpr.isDefEqStep_valid [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateWhnfStep.innerRun [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateCheckTypeStep.innerRun [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.innerRun [propext, Classical.choice, Quot.sound]
+
+def declareConstructors (stats : InductiveStats)
+    (indTypes : Array InductiveType) (isUnsafe : Bool) : M Environment :=
+  fun c => indTypes.foldlM (init := c.env) fun env indType => do
+    let (_, env) ← indType.ctors.foldlM (init := (0, env)) fun (cidx, env) ctor => do
+      let type := ctor.type
+      let rec arity i
+        | .forallE _ _ body _ => arity (i+1) body
+        | _ => i
+      let arity := arity 0 type
+      env.checkName ctor.name c.allowPrimitive
+      pure (cidx + 1, env.add <| .ctorInfo {
+        type, cidx, isUnsafe
+        levelParams := c.lparams
+        name := ctor.name
+        induct := indType.name
+        numParams := stats.params.size
+        numFields := assert! arity ≥ stats.params.size; arity - stats.params.size
+      })
+    pure env
+
+/-- Return true if recursor can map into any universe -/
+def isLargeEliminator (stats : InductiveStats) (indTypes : Array InductiveType) : M Bool := do
+  if stats.isNotZero then return true
+  let #[indType] := indTypes | return false
+  match indType.ctors with
+  | [] => return true
+  | [ctor] =>
+    let rec loop type i toCheck
+    | 0 => throw .deepRecursion
+    | fuel+1 => do
+      if let .forallE name dom body bi := type then
+        withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+          let mut toCheck := toCheck
+          if i ≥ stats.params.size then
+            if !(← ensureType dom).sortLevel!.isAlwaysZero then
+              toCheck := toCheck.push arg
+          loop (body.instantiate1 arg) (i + 1) toCheck fuel
+      else
+        return toCheck.all type.getAppArgs.contains
+    loop ctor.type 0 #[] (← readThe Context).fuel.inductiveFuel
+  | _ => return false
+
+/-- Search the kernel's elimination-universe name sequence (`u`, `u_1`, …)
+for its first entry not already used by the inductive declaration.  Among
+`lparams.length + 1` distinct candidates at least one is available; the
+zero-fuel branch is therefore only a totality fallback. -/
+def getFreshElimParam.loop (lparams : List Name) (u : Name) (i : Nat) :
+    Nat → Name
+  | 0 => u
+  | fuel + 1 =>
+      if lparams.contains u then
+        loop lparams ((`u).appendIndexAfter i) (i + 1) fuel
+      else
+        u
+
+def getFreshElimParam (lparams : List Name) : Name :=
+  getFreshElimParam.loop lparams `u 1 (lparams.length + 1)
+
+def getElimLevel (stats : InductiveStats) (indTypes : Array InductiveType) :
+    M Level := do
+  unless ← isLargeEliminator stats indTypes do return .zero
+  let {lparams, ..} ← read
+  return .param (getFreshElimParam lparams)
+
+/-- The constructor-shape fragment of the kernel's K-target test. A visible
+Pi is accepted only while it belongs to the shared parameter prefix; the
+first visible field makes the target ineligible. -/
+def isKTargetCtor (nparams : Nat) : Nat → Expr → Bool
+  | i, .forallE _ _ body _ => i < nparams && isKTargetCtor nparams (i + 1) body
+  | _, _ => true
+
+def isKTarget (stats : InductiveStats) (indTypes : Array InductiveType) : M Bool := do
+  let #[indType] := indTypes | return false
+  unless stats.resultLevel.isAlwaysZero do return false
+  let [ctor] := indType.ctors | return false
+  return isKTargetCtor stats.params.size 0 ctor.type
+
+@[inline] def getIIndices (stats : InductiveStats) (t : Expr) : Nat × Array Expr :=
+  ((isValidIndApp? stats t).get!, t.getAppArgs[stats.params.size:])
+
+-- FIXME: The function below has been exploded into nested loops as standalone functions
+-- because I couldn't get them all to compile together as `let rec`s.
+namespace mkRecInfos
+
+def loopArgs1 (stats : InductiveStats) (type : Expr) (i : Nat) (indices : Array Expr)
+    (fuel : Nat) (k : Array Expr → M α) : M α := match fuel with
+  | 0 => throw .deepRecursion
+  | fuel+1 => do
+    if let .forallE name dom body bi := type then
+      if i < stats.params.size then
+        loopArgs1 stats (← whnf <| body.instantiate1 stats.params[i]!) (i + 1) indices fuel k
+      else
+        withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+        loopArgs1 stats (← whnf <| body.instantiate1 arg) i (indices.push arg) fuel k
+    else
+      k indices
+
+variable (stats : InductiveStats) (indTypes : Array InductiveType) (elimLevel : Level) in
+def loopInd1 (dIdx : Nat) (recInfos : Array RecInfo) (k : Array RecInfo → M α) : M α := do
+  if _h : dIdx < indTypes.size then
+    let ctx ← readThe Context
+    loopArgs1 stats (← whnf indTypes[dIdx].type) 0 #[] ctx.fuel.inductiveFuel fun indices =>
+    let tTy := mkAppN (mkAppN stats.indConsts[dIdx]! stats.params) indices
+    withLocalDecl `t .default (consumeTypeAnnotations tTy) fun major => do
+    let lctx ← getLCtx
+    let motiveTy := lctx.mkForall indices <| lctx.mkForall #[major] <| .sort elimLevel
+    let name := if indTypes.size > 1 then (`motive).appendIndexAfter (dIdx+1) else `motive
+    withLocalDecl name .default (consumeTypeAnnotations motiveTy) fun motive => do
+    loopInd1 (dIdx + 1) (recInfos.push { motive, minors := #[], indices, major }) k
+  else
+    k recInfos
+termination_by indTypes.size - dIdx
+
+variable (stats : InductiveStats) in
+def loopCtorArgs (t : Expr) (k : Expr → Array Expr → Array Expr → M α) : M α := do
+  loop t 0 #[] #[] (← readThe Context).fuel.inductiveFuel
+where
+  loop t i bu u
+  | 0 => throw .deepRecursion
+  | fuel+1 => do
+    if let .forallE name dom body bi := t then
+      if let some param := stats.params[i]? then
+        loop (body.instantiate1 param) (i + 1) bu u fuel
+      else
+        withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+        let bu := bu.push arg
+        let u := if (← isRecArg stats dom).isSome then u.push arg else u
+        loop (body.instantiate1 arg) (i + 1) bu u fuel
+    else k t bu u
+
+def loopUArgs (ui : Expr) (k : Expr → Array Expr → M α) : M α := do
+  loop (← whnf (← inferType ui)) #[] (← readThe Context).fuel.inductiveFuel
+where
+  loop uiTy xs
+  | 0 => throw .deepRecursion
+  | fuel+1 => do
+    if let .forallE name dom body bi := uiTy then
+      withLocalDecl name bi (consumeTypeAnnotations dom) fun arg => do
+      loop (← whnf <| body.instantiate1 arg) (xs.push arg) fuel
+    else
+      k uiTy xs
+
+variable (stats : InductiveStats) (u : Array Expr) (recInfos : Array RecInfo) in
+def loopU (i : Nat) (v : Array Expr) (k : Array Expr → M α) : M α := do
+  if _h : i < u.size then
+    let ui := u[i]
+    let viTy ← loopUArgs ui fun uiTy xs => do
+      let (itIdx, itIndices) := getIIndices stats uiTy
+      return (← getLCtx).mkForall xs <|
+        .app (mkAppN recInfos[itIdx]!.motive itIndices) (mkAppN ui xs)
+    let vName := ((← getLCtx).get! ui.fvarId!).userName.appendAfter "_ih"
+    withLocalDecl vName .default (consumeTypeAnnotations viTy) fun vi => do
+    loopU (i + 1) (v.push vi) k
+  else
+    k v
+termination_by u.size - i
+
+variable (stats : InductiveStats) (indTypeName : Name) (dIdx : Nat) in
+def loopCtors (recInfos : Array RecInfo)
+    (ctors : List Constructor) (k : Array RecInfo → M α) : M α := match ctors with
+  | ctor::ctors =>
+    loopCtorArgs stats ctor.type fun t bu u => do
+    let (itIdx, itIndices) := getIIndices stats t
+    let introApp := mkAppN (mkAppN (.const ctor.name stats.levels) stats.params) bu
+    let motiveApp := Expr.app (mkAppN recInfos[itIdx]!.motive itIndices) introApp
+    loopU stats u recInfos 0 #[] fun v => do
+    let lctx ← getLCtx
+    let minorTy := lctx.mkForall bu <| lctx.mkForall v motiveApp
+    let minorName := ctor.name.replacePrefix indTypeName .anonymous
+    withLocalDecl minorName .default (consumeTypeAnnotations minorTy) fun minor => do
+    let recInfos := recInfos.modify dIdx fun s => { s with minors := s.minors.push minor }
+    loopCtors recInfos ctors k
+  | [] => k recInfos
+
+variable (stats : InductiveStats) (indTypes : Array InductiveType) in
+def loopInd2 (dIdx : Nat) (recInfos : Array RecInfo) (k : Array RecInfo → M α) : M α := do
+  if _h : dIdx < indTypes.size then
+    let indType := indTypes[dIdx]
+    let indTypeName := indType.name
+    loopCtors stats indTypeName dIdx recInfos indType.ctors fun recInfos =>
+    loopInd2 (dIdx + 1) recInfos k
+  else
+    k recInfos
+termination_by indTypes.size - dIdx
+
+end mkRecInfos
+
+def mkRecInfos (stats : InductiveStats) (indTypes : Array InductiveType)
+    (elimLevel : Level) (k : Array RecInfo → M α) : M α :=
+  mkRecInfos.loopInd1 stats indTypes elimLevel 0 #[] fun recInfos =>
+  mkRecInfos.loopInd2 stats indTypes 0 recInfos k
+
+def getRecLevels (elimLevel : Level) (levels : List Level) : List Level :=
+  if elimLevel.isParam then elimLevel :: levels else levels
+
+def getRecLevelParams (elimLevel : Level) (lparams : List Name) : List Name :=
+  if let .param u := elimLevel then u :: lparams else lparams
+
+def mkRecRules (indTypes : Array InductiveType) (elimLevel : Level) (stats : InductiveStats)
+    (dIdx : Nat) (motives : Array Expr) (minors : Array Expr) :
+    StateT Nat M (List RecursorRule) := do
+  let d := indTypes[dIdx]!
+  let lvls := getRecLevels elimLevel stats.levels
+  let mut rules := #[]
+  for ctor in d.ctors do
+    let rule ← fun minorIdx => mkRecInfos.loopCtorArgs stats ctor.type fun _ bu u =>
+      let rec loopU i (v : Array Expr) k := do
+        if _h : i < u.size then
+          let ui := u[i]
+          let val ← mkRecInfos.loopUArgs ui fun uiTy xs => do
+            let (itIdx, itIndices) := getIIndices stats uiTy
+            let val := .const (mkRecName indTypes[itIdx]!.name) lvls
+            let val := mkAppN (mkAppN (mkAppN (mkAppN val stats.params) motives) minors) itIndices
+            return (← getLCtx).mkLambda xs <| val.app (mkAppN ui xs)
+          loopU (i + 1) (v.push val) k
+        else
+          k v
+      termination_by u.size - i
+      loopU 0 #[] fun v => do
+      let lctx ← getLCtx
+      let rule := {
+        ctor := ctor.name
+        nfields := bu.size
+        rhs := lctx.mkLambda stats.params <| lctx.mkLambda motives <|
+          lctx.mkLambda minors <| lctx.mkLambda bu <|
+          mkAppN (mkAppN minors[minorIdx]! bu) v
+      }
+      return (rule, minorIdx + 1)
+    rules := rules.push rule
+  return rules.toList
+
+/-- Defensively type-checks the generated recursors.
+
+`run` installs a recursor and its computation rules without re-checking them. This verifies that
+(1) each recursor's type is well typed, and (2) each computation rule is type-preserving: reducing
+the recursor applied to a constructor yields a term whose type is the recursor's declared result
+type. This catches a recursor whose minor-premise type and reduction rule disagree; checking only
+that a rule's right-hand side has *some* type is insufficient, because an under-applied minor
+premise is still a well-typed (function) term. -/
+def checkRecursors (indTypes : Array InductiveType) (elimLevel : Level)
+    (stats : InductiveStats) (motives minors : Array Expr) : M Unit := do
+  let {lparams, ..} ← read
+  let lvls := getRecLevels elimLevel stats.levels
+  withLParams (getRecLevelParams elimLevel lparams) do
+  for h : dIdx in [:indTypes.size] do
+    let indType := indTypes[dIdx]
+    let recName := mkRecName indType.name
+    let recCi ← (← read).env.get recName
+    -- (1) The recursor type must be well typed.
+    _ ← (TypeChecker.checkType recCi.type : TypeChecker.M Expr)
+    let recPre := mkAppN (mkAppN (mkAppN (.const recName lvls) stats.params) motives) minors
+    -- (2) Each computation rule must preserve types.
+    for ctor in indType.ctors do
+      mkRecInfos.loopCtorArgs stats ctor.type fun t bu _ => do
+        let (_, itIndices) := getIIndices stats t
+        let introApp := mkAppN (mkAppN (.const ctor.name stats.levels) stats.params) bu
+        let lhs := (mkAppN recPre itIndices).app introApp
+        let expected ← inferType lhs
+        let reduct ← whnf lhs
+        let actual ← inferType reduct
+        unless ← isDefEq actual expected do
+          throw <| .other s!"generated recursor computation rule for '{ctor.name
+            }' is not type-preserving"
+
+def run (nparams : Nat) (types : List InductiveType) (numNested : Nat) : M Environment := do
+  let isUnsafe := (← read).safety != .safe
+  let indTypes := types.toArray
+  let {lparams, ..} ← read
+  Environment.checkDuplicatedUnivParams lparams
+  checkInductiveTypes nparams indTypes fun stats => do
+  withEnv (← declareInductiveTypes stats nparams indTypes numNested isUnsafe) do
+  checkConstructors indTypes stats isUnsafe
+  withEnv (← declareConstructors stats indTypes isUnsafe) do
+  let elimLevel ← getElimLevel stats indTypes
+  mkRecInfos stats indTypes elimLevel fun recInfos => do
+  let motives := recInfos.map (·.motive)
+  let minors := recInfos.flatMap (·.minors)
+  let numMinors := minors.size
+  let numMotives := motives.size
+  let all := indTypes.map (·.name) |>.toList
+  let lctx ← getLCtx
+  let k ← isKTarget stats indTypes
+  let isUnsafe := (← read).safety != .safe
+  StateT.run' (s := 0) do
+  let mut env ← getEnv
+  let {allowPrimitive, ..} ← read
+  for h : dIdx in [:indTypes.size] do
+    let indType := indTypes[dIdx]
+    let info := recInfos[dIdx]!
+    let ty :=
+      lctx.mkForall stats.params <|
+      lctx.mkForall motives <|
+      lctx.mkForall minors <|
+      lctx.mkForall info.indices <|
+      lctx.mkForall #[info.major] <|
+      .app (mkAppN info.motive info.indices) info.major
+    let rules ← mkRecRules indTypes elimLevel stats dIdx motives minors
+    let name := mkRecName indType.name
+    env.checkName name allowPrimitive
+    env := env.add <| .recInfo {
+      levelParams := getRecLevelParams elimLevel lparams
+      type := ty.inferImplicit 1000 false -- note: flag has reversed polarity from C++
+      numParams := stats.params.size
+      numIndices := stats.nindices[dIdx]!
+      name, all, numMotives, numMinors, rules, k, isUnsafe
+    }
+  withEnv env <| checkRecursors indTypes elimLevel stats motives minors
+  pure env
+
+end AddInductive
+
+namespace ElimNestedInductive
+
+structure Result where
+  ngen : NameGenerator
+  nparams : Nat
+  lctx : LocalContext
+  params : Array Expr -- the fvars declared in `lctx`
+  aux2nested : NameMap Expr -- exprs are open over `params`, like the C++ `m_aux2nested`
+  types : List InductiveType
+
+instance [MonadStateOf NameGenerator m] : MonadNameGenerator m where
+  getNGen := get
+  setNGen := set
+
+namespace Result
+
+def getNestedIfAuxCtor (r : Result) (env' : Environment) (c : Name) : Option (Expr × Name) := do
+  let .ctorInfo { induct, .. } ← env'.find? c | none
+  return (← r.aux2nested.find? induct, induct)
+
+def restoreCtorName (r : Result) (env' : Environment) (c : Name) : Name := Id.run do
+  let (e, name) := (r.getNestedIfAuxCtor env' c).get!
+  let .const I _ := e.getAppFn | unreachable!
+  c.replacePrefix name I
+
+def restoreNested (r : Result) (env' : Environment) (e : Expr)
+    (auxRec : NameMap Name := {}) : Expr :=
+  Id.run <| StateT.run' (s := { namePrefix := `_nested_fresh : NameGenerator }) do
+  let pi := e.isForall
+  let mut e := e
+  let mut As := #[]
+  let mut lctx : LocalContext := {}
+  for _ in [:r.nparams] do
+    match e with
+    | .forallE name dom body bi | .lam name dom body bi =>
+      let id := ⟨← mkFreshId⟩
+      lctx := lctx.mkLocalDecl id name dom bi
+      let arg := .fvar id
+      e := body.instantiate1 arg
+      As := As.push arg
+    | _ => unreachable!
+  e := e.replace fun t => do
+    if let .const c ls := t then
+      if let some recName := auxRec.find? c then
+        return .const recName ls
+    let .const c _ := t.getAppFn | none
+    if let some nested := r.aux2nested.find? c then
+      let args := t.getAppArgs
+      assert! args.size ≥ r.nparams
+      return mkAppRange ((nested.abstract r.params).instantiateRev As) r.nparams args.size args
+    let (nested, auxI_name) ← r.getNestedIfAuxCtor env' c
+    let args := t.getAppArgs
+    assert! args.size ≥ r.nparams
+    let nested' := (nested.abstract r.params).instantiateRev As
+    nested'.withApp fun I I_args => do
+    let .const I_c I_ls := I | unreachable!
+    let c' := .const (c.replacePrefix auxI_name I_c) I_ls
+    return mkAppRange (mkAppN c' I_args) r.nparams args.size args
+  return if pi then lctx.mkForall As e else lctx.mkLambda As e
+
+end Result
+
+structure State where
+  ngen : NameGenerator := { namePrefix := `_nested_fresh }
+  nestedAux : Array (Expr × Name) := {}
+  lvls : List Level
+  newTypes : Array InductiveType
+  nextIdx : Nat := 1
+  deriving Inhabited
+
+abbrev M := ReaderT Environment <| StateT State <| Except Exception
+
+instance : MonadNameGenerator M where
+  getNGen := return (← get).ngen
+  setNGen ngen := modify fun s => { s with ngen }
+
+-- TODO: remove partial
+partial def mkUniqueName (n : Name) : M Name := fun env s =>
+  let rec loop i :=
+    let r := n.appendIndexAfter i
+    if env.contains r then
+      loop (i + 1)
+    else
+      pure (r, { s with nextIdx := i + 1 })
+  loop s.nextIdx
+
+def illFormed : Exception :=
+  .other "invalid nested inductive datatype, ill-formed declaration"
+
+def replaceParams (params : Array Expr) (e : Expr) (As : Array Expr) : M Expr := do
+  assert! As.size == params.size
+  return (e.abstract As).instantiateRev params
+
+/-- IF `e` is of the form `I Ds is` where
+  1) `I` is a nested inductive datatype (i.e., a previously declared inductive datatype),
+  2) the parametric arguments `Ds` do not contain loose bound variables, and do contain inductive datatypes in `m_new_types`
+THEN return the `inductive_val` in the `constant_info` associated with `I`.
+Otherwise, return none. -/
+def isNestedInductiveApp? (e : Expr) : M (Option InductiveVal) := do
+  if !e.isApp then return none
+  let .const fn _ := e.getAppFn | return none
+  let env ← read
+  let some (.inductInfo ci) := env.find? fn | return none
+  let args := e.getAppArgs
+  if ci.numParams > args.size then return none
+  let mut isNested := false
+  let mut looseBVars := false
+  for i in [0:ci.numParams] do
+    if args[i]!.hasLooseBVars then
+      looseBVars := true
+    let newTypes := (← get).newTypes
+    if let some _ := args[i]!.find? fun
+      | .const t _ => newTypes.any fun ty => t == ty.name
+      | _ => false
+    then
+      isNested := true
+  if !isNested then return none
+  if looseBVars then
+    throw <| .other s!"invalid nested inductive datatype '{fn}', \
+      nested inductive datatypes parameters cannot contain local variables."
+  return some ci
+
+def instantiateForallParams (e : Expr) (hi : Nat) (params : Array Expr) :
+    Except Exception Expr := do
+  let mut e := e
+  for _ in [:hi] do
+    let .forallE _ _ body _ := e | throw illFormed
+    e := body
+  return e.instantiateRevRange 0 hi params
+
+/-- If `e` is a nested occurrence `I Ds is`, return `Iaux As is` -/
+def replaceIfNested (lctx : LocalContext) (params : Array Expr) (As : Array Expr) (e : Expr) :
+    M (Option Expr) := do
+  let some I_val ← isNestedInductiveApp? e | return none
+  e.withApp fun fn args => do
+  let .const I_name I_lvls := fn | unreachable!
+  let I_nparams := I_val.numParams
+  assert! I_nparams ≤ args.size
+  let IAs := mkAppRange fn 0 I_nparams args -- `I As`
+  let Iparams ← replaceParams params IAs As
+  let st ← get
+  if let some auxI_name := st.nestedAux.findSome? fun (e, n) =>
+    if e == Iparams then some n else none
+  then
+    return mkAppRange (mkAppN (.const auxI_name st.lvls) As) I_nparams args.size args
+  let mut result := none
+  let env ← read
+  for J_name in I_val.all do
+    let .inductInfo J_info ← env.get J_name | unreachable!
+    let J := .const J_name I_lvls
+    let JAs := mkAppRange J 0 I_nparams args
+    let auxJ_name ← mkUniqueName (`_nested ++ J_name)
+    let auxJ_type := J_info.type.instantiateLevelParams J_info.levelParams I_lvls
+    let auxJ_type := lctx.mkForall As <| ← instantiateForallParams auxJ_type I_nparams args
+    let JAs' ← replaceParams params JAs As
+    modify fun st => { st with nestedAux := st.nestedAux.push (JAs', auxJ_name) }
+    if J_name == I_name then
+      result := some <|
+        mkAppRange (mkAppN (.const auxJ_name (← get).lvls) As) I_nparams args.size args
+    let auxJ_ctors ← J_info.ctors.mapM fun J_ctor_name => do
+      let J_ctor_info ← env.get J_ctor_name
+      -- auxJ_cnstr_type still has references to `J`, this will be fixed later when we process it.
+      let auxJ_ctor_name := J_ctor_name.replacePrefix J_name auxJ_name
+      let auxJ_ctor_type := J_ctor_info.type.instantiateLevelParams J_ctor_info.levelParams I_lvls
+      let auxJ_ctor_type ← instantiateForallParams auxJ_ctor_type I_nparams args
+      return { name := auxJ_ctor_name, type := lctx.mkForall As auxJ_ctor_type }
+    let newType := { name := auxJ_name, type := auxJ_type, ctors := auxJ_ctors }
+    modify fun st => { st with newTypes := st.newTypes.push newType }
+  assert! result.isSome
+  return result
+
+def replaceAllNested (lctx : LocalContext) (params : Array Expr) (As : Array Expr) (e : Expr) :
+    M Expr := e.replaceM (replaceIfNested lctx params As)
+
+def withParams (type : Expr) (nparams : Nat)
+    (k : LocalContext → Expr → Array Expr → M α) : M α := loop {} type #[] nparams where
+  loop lctx type params
+  | 0 => k lctx type params
+  | i+1 => do
+    let .forallE name dom body bi := type
+      | throw <| .other "invalid inductive datatype declaration, incorrect number of parameters"
+    let id := ⟨← mkFreshId⟩
+    let lctx := lctx.mkLocalDecl id name dom bi
+    let arg := .fvar id
+    loop lctx (body.instantiate1 arg) (params.push arg) i
+
+def run (fuel nparams : Nat) (types : List InductiveType) : M Result := do
+  let I :: _ := types
+    | throw <| .other s!"invalid empty (mutual) inductive datatype declaration, \
+        it must contain at least one inductive type."
+  withParams I.type nparams fun lctx _ params => do
+  let rec loop i
+  | 0 => throw <| .other "deep recursion: ElimNestedInductive.run.loop"
+  | fuel+1 => do
+    let s ← get
+    if _h : i < s.newTypes.size then
+      let indType := s.newTypes[i]
+      let ctors ← indType.ctors.mapM fun ctor => do
+        withParams ctor.type nparams fun lctx ctorType As => do
+        assert! As.size == nparams
+        return { ctor with type := lctx.mkForall As (← replaceAllNested lctx params As ctorType) }
+      modify fun s => { s with newTypes := s.newTypes.set! i { indType with ctors } }
+      loop (i+1) fuel
+    else
+      let aux2nested := s.nestedAux.foldl (fun m (e, n) => m.insert n e) {}
+      return {
+        ngen := s.ngen
+        nparams := params.size
+        lctx := lctx
+        params := params
+        aux2nested := aux2nested
+        types := s.newTypes.toList }
+  loop 0 fuel
+end ElimNestedInductive
+
+def mkAuxRecNameMap (env' : Environment) (types : List InductiveType) :
+    List Name × NameMap Name := Id.run do
+  let mainType :: _ := types | unreachable!
+  let ntypes := types.length
+  let mainName := mainType.name
+  let some (.inductInfo mainInfo) := env'.find? mainName | unreachable!
+  let allNames := mainInfo.all
+  assert! allNames.length > ntypes
+  let mut oldRecNames := #[]
+  let mut recMap : NameMap Name := {}
+  let mut nextIdx := 1
+  for indName in allNames.drop ntypes do
+    let oldRecName := mkRecName indName
+    let newRecName := (mkRecName mainName).appendIndexAfter nextIdx
+    nextIdx := nextIdx + 1
+    recMap := recMap.insert oldRecName newRecName
+    oldRecNames := oldRecNames.push oldRecName
+  return (oldRecNames.toList, recMap)
+
+def checkNoNestedAux (n : Name) (e : Expr) : Except Exception Unit := do
+  if (e.find? fun
+      | .const c _ => (`_nested).isPrefixOf c
+      | .proj s _ _ => (`_nested).isPrefixOf s
+      | _ => false).isSome then
+    throw <| .other s!"invalid declaration '{n}', it uses the reserved prefix '_nested'"
+
+/-- Checks the occurrence of a datatype being declared at the head of `e`, if there is one.
+Returns `true` when the occurrence was checked and `e`'s subterms need not be revisited. -/
+def checkUniformIndOcc (lvls : List Level) (indNames : List Name) (nparams : Nat)
+    (e : Expr) (offset : Nat) : Except Exception Bool := do
+  let .const c ls := e.getAppFn | return false
+  unless indNames.contains c do return false
+  let args := e.getAppArgs
+  -- Over-applied: descend, so that occurrences in the indices are checked too. The parameter
+  -- application itself is visited as a subterm of `e` and checked then.
+  if args.size > nparams then return false
+  let ok := args.size == nparams && offset ≥ nparams && ls == lvls
+    && (List.range nparams).all fun i => args[i]! == .bvar (offset - 1 - i)
+  unless ok do
+    throw <| .other s!"invalid occurrence of datatype '{c}' being declared: it must be applied \
+      to the parameters and universe levels of the mutual declaration"
+  return true
+
+/-- Checks that every occurrence of a datatype being declared in `e` is applied to the
+declaration's universe levels and to its parameters, which at binder depth `offset` are the bound
+variables `#(offset-1) … #(offset-nparams)`. That those binders really are the parameters is
+established later, by the parameter check in `checkConstructors`. -/
+def checkUniformIndOccsIn (lvls : List Level) (indNames : List Name) (nparams : Nat) :
+    Expr → Nat → Except Exception Unit
+  | e, offset => do
+    if ← checkUniformIndOcc lvls indNames nparams e offset then return
+    match e with
+    | .forallE _ d b _ | .lam _ d b _ =>
+      checkUniformIndOccsIn lvls indNames nparams d offset
+      checkUniformIndOccsIn lvls indNames nparams b (offset + 1)
+    | .letE _ t v b _ =>
+      checkUniformIndOccsIn lvls indNames nparams t offset
+      checkUniformIndOccsIn lvls indNames nparams v offset
+      checkUniformIndOccsIn lvls indNames nparams b (offset + 1)
+    | .app f a =>
+      checkUniformIndOccsIn lvls indNames nparams f offset
+      checkUniformIndOccsIn lvls indNames nparams a offset
+    | .mdata _ b => checkUniformIndOccsIn lvls indNames nparams b offset
+    | .proj _ _ b => checkUniformIndOccsIn lvls indNames nparams b offset
+    | _ => pure ()
+
+/-- Runs `checkUniformIndOccsIn` over every constructor type of the declaration.
+
+Later phases inspect the constructor types modulo `whnf`, which can erase an occurrence (as in
+`(fun _ => Unit) (T Nat)`), and the parametric arguments of a nested occurrence are dropped from
+the auxiliary declaration altogether, so a non-uniform occurrence could escape checking there.
+Reduction never creates an occurrence of a datatype being declared, since those are not yet in the
+environment, so checking the syntactic occurrences here covers all of them. -/
+def checkUniformIndOccs (lparams : List Name) (nparams : Nat) (types : List InductiveType) :
+    Except Exception Unit := do
+  let lvls := lparams.map Level.param
+  let indNames := types.map (·.name)
+  for indType in types do
+    for ctor in indType.ctors do
+      checkUniformIndOccsIn lvls indNames nparams ctor.type 0
+
+def Environment.addInductive (env : Environment) (lparams : List Name) (nparams : Nat)
+    (types : List InductiveType) (isUnsafe allowPrimitive : Bool) (fuel : FuelConfig := {}) :
+    Except Exception Environment := do
+  for indType in types do
+    env.checkNoMVarNoFVar indType.name indType.type
+    for ctor in indType.ctors do
+      env.checkNoMVarNoFVar ctor.name ctor.type
+      checkNoNestedAux ctor.name ctor.type
+  checkUniformIndOccs lparams nparams types
+  let res ← ElimNestedInductive.run fuel.inductiveFuel nparams types env
+    |>.run' { lvls := lparams.map .param, newTypes := types.toArray }
+  let numNested := res.aux2nested.size
+  let safety := if isUnsafe then .unsafe else .safe
+  let env' ← AddInductive.run nparams res.types numNested
+    { env, allowPrimitive, lparams, fuel, safety }
+  if numNested = 0 then return env'
+  let allIndNames := types.map (·.name)
+  let (recNames', recNameMap') := mkAuxRecNameMap env' types
+  (·.2) <$> StateT.run (s := env) do
+  let processRec recName := do
+    let newRecName := recNameMap'.getD recName recName
+    let some (.recInfo recInfo) := env'.find? recName | unreachable!
+    let newRecType := res.restoreNested env' recInfo.type recNameMap'
+    let newRules ← recInfo.rules.mapM fun rule => do
+      let newRhs := res.restoreNested env' rule.rhs recNameMap'
+      let newCtorName := if newRecName == recName then rule.ctor else
+        res.restoreCtorName env' rule.ctor
+      return { rule with ctor := newCtorName, rhs := newRhs }
+    (← MonadState.get).checkName newRecName allowPrimitive
+    modify (·.add <| .recInfo { recInfo with
+      name := newRecName, type := newRecType, all := allIndNames, rules := newRules })
+  for indType in types do
+    let some (.inductInfo ind) := env'.find? indType.name | unreachable!
+    (← get).checkName ind.name allowPrimitive
+    modify (·.add <| .inductInfo { ind with all := allIndNames })
+    for ctorName in ind.ctors do
+      let some (.ctorInfo ctor) := env'.find? ctorName | unreachable!
+      let newType := res.restoreNested env' ctor.type
+      (← get).checkName ctor.name allowPrimitive
+      modify (·.add <| .ctorInfo { ctor with type := newType })
+    processRec (mkRecName indType.name)
+  recNames'.forM processRec
+  TypeChecker.M.run (← get) (safety := safety) (lctx := res.lctx)
+      (lparams := lparams) (fuel := fuel) do
+    res.aux2nested.forM fun _ e => do _ ← TypeChecker.checkType e
diff --git a/Ix/Theory/Named/Reference/Inductive/EliminationTrace.lean b/Ix/Theory/Named/Reference/Inductive/EliminationTrace.lean
new file mode 100644
index 000000000..3295fdb18
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Inductive/EliminationTrace.lean
@@ -0,0 +1,581 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Reference.Inductive.ValidationTrace
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+namespace AddInductive
+open TypeChecker
+
+/-- Exact successful traversal of the singleton-constructor branch of
+`isLargeEliminator`. Non-parameter fields retain the precise `ensureType`
+observation used to decide whether their local is relevant to the terminal
+index-occurrence check. -/
+inductive LargeEliminatorLoopTrace (stats : InductiveStats) :
+    (context : Context) → (source : Expr) → (argIdx : Nat) →
+      (toCheck : Array Expr) → (fuel : Nat) → (result : Bool) → Type where
+  | parameter
+      (context : Context) (fuel argIdx : Nat) (toCheck : Array Expr)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (isParameter : argIdx < stats.params.size)
+      (tail : LargeEliminatorLoopTrace stats
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) toCheck fuel result) :
+      LargeEliminatorLoopTrace stats context
+        (.forallE name domain body binderInfo) argIdx toCheck (fuel + 1) result
+  | proofField
+      (context : Context) (fuel argIdx : Nat) (toCheck : Array Expr)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (sortResult : Expr)
+      (isField : argIdx ≥ stats.params.size)
+      (ensureType : ConstructorEnsureTypeStep.Valid
+        ⟨context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain), domain, sortResult⟩)
+      (isProp : sortResult.sortLevel!.isAlwaysZero = true)
+      (tail : LargeEliminatorLoopTrace stats
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) toCheck fuel result) :
+      LargeEliminatorLoopTrace stats context
+        (.forallE name domain body binderInfo) argIdx toCheck (fuel + 1) result
+  | dataField
+      (context : Context) (fuel argIdx : Nat) (toCheck : Array Expr)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (sortResult : Expr)
+      (isField : argIdx ≥ stats.params.size)
+      (ensureType : ConstructorEnsureTypeStep.Valid
+        ⟨context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain), domain, sortResult⟩)
+      (isProp : sortResult.sortLevel!.isAlwaysZero = false)
+      (tail : LargeEliminatorLoopTrace stats
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1)
+        (toCheck.push context.freshExpr) fuel result) :
+      LargeEliminatorLoopTrace stats context
+        (.forallE name domain body binderInfo) argIdx toCheck (fuel + 1) result
+  | terminal
+      (context : Context) (source : Expr) (fuel argIdx : Nat)
+      (toCheck : Array Expr) (notForall : source.isForall = false) :
+      LargeEliminatorLoopTrace stats context source argIdx toCheck (fuel + 1)
+        (toCheck.all source.getAppArgs.contains)
+
+namespace LargeEliminatorLoopTrace
+
+def parameterCount
+    (trace : LargeEliminatorLoopTrace stats context source argIdx toCheck
+      fuel result) : Nat :=
+  match trace with
+  | .parameter (tail := tail) .. => tail.parameterCount + 1
+  | .proofField (tail := tail) .. => tail.parameterCount
+  | .dataField (tail := tail) .. => tail.parameterCount
+  | .terminal .. => 0
+
+def proofFieldCount
+    (trace : LargeEliminatorLoopTrace stats context source argIdx toCheck
+      fuel result) : Nat :=
+  match trace with
+  | .parameter (tail := tail) .. => tail.proofFieldCount
+  | .proofField (tail := tail) .. => tail.proofFieldCount + 1
+  | .dataField (tail := tail) .. => tail.proofFieldCount
+  | .terminal .. => 0
+
+def dataFieldCount
+    (trace : LargeEliminatorLoopTrace stats context source argIdx toCheck
+      fuel result) : Nat :=
+  match trace with
+  | .parameter (tail := tail) .. => tail.dataFieldCount
+  | .proofField (tail := tail) .. => tail.dataFieldCount
+  | .dataField (tail := tail) .. => tail.dataFieldCount + 1
+  | .terminal .. => 0
+
+/-- Erasing the retained singleton trace replays the exact ordinary checker
+loop, including every `ensureType` call and local declaration. -/
+theorem run
+    (trace : LargeEliminatorLoopTrace stats context source argIdx toCheck
+      fuel result) :
+    isLargeEliminator.loop stats source argIdx toCheck fuel context =
+      .ok result := by
+  induction trace with
+  | parameter context fuel argIdx toCheck name domain body binderInfo
+      isParameter tail ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega]
+      rw [isLargeEliminator.loop.eq_2, withLocalDecl_apply]
+      have notField : ¬ argIdx ≥ stats.params.size :=
+        Nat.not_le.mpr isParameter
+      simp only [notField, if_false, Bind.bind]
+      exact ih
+  | proofField context fuel argIdx toCheck name domain body binderInfo
+      sortResult isField ensureStep isProp tail ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega]
+      rw [isLargeEliminator.loop.eq_2, withLocalDecl_apply]
+      simp only [isField, if_true, ReaderT.bind, Bind.bind,
+        liftTypeChecker_apply]
+      rw [ensureStep]
+      simp only [Except.bind, isProp, Bool.not_true, Bool.false_eq_true, if_false]
+      exact ih
+  | dataField context fuel argIdx toCheck name domain body binderInfo
+      sortResult isField ensureStep isProp tail ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega]
+      rw [isLargeEliminator.loop.eq_2, withLocalDecl_apply]
+      simp only [isField, if_true, ReaderT.bind, Bind.bind,
+        liftTypeChecker_apply]
+      rw [ensureStep]
+      simp only [Except.bind, isProp, Bool.not_false, if_true]
+      exact ih
+  | terminal context source fuel argIdx toCheck notForall =>
+      cases source <;>
+        simp_all [isLargeEliminator.loop, ReaderT.pure, Pure.pure,
+          Except.pure, Expr.isForall]
+
+/-- Execute the singleton branch once while retaining the exact branch and
+checker observations that produced its Boolean result. -/
+def buildExecution (stats : InductiveStats) (context : Context)
+    (source : Expr) (argIdx : Nat) (toCheck : Array Expr) :
+    (fuel : Nat) → Except Exception
+      (Sigma fun result => LargeEliminatorLoopTrace stats context source
+        argIdx toCheck fuel result)
+  | 0 => .error .deepRecursion
+  | fuel + 1 =>
+      match hforall : source.isForall with
+      | false => .ok ⟨toCheck.all source.getAppArgs.contains,
+          .terminal context source fuel argIdx toCheck hforall⟩
+      | true =>
+        match source with
+        | .forallE name domain body binderInfo =>
+          let nextContext := context.pushLocalDecl name binderInfo
+            (consumeTypeAnnotations domain)
+          let nextSource := body.instantiate1 context.freshExpr
+          if isParameter : argIdx < stats.params.size then
+            match buildExecution stats nextContext nextSource (argIdx + 1)
+                toCheck fuel with
+            | .error error => .error error
+            | .ok ⟨result, tail⟩ => .ok ⟨result,
+                .parameter context fuel argIdx toCheck name domain body
+                  binderInfo isParameter tail⟩
+          else
+            match hensure : TypeChecker.M.run nextContext.env nextContext.safety
+                nextContext.lctx nextContext.lparams nextContext.fuel
+                (TypeChecker.ensureType domain) with
+            | .error error => .error error
+            | .ok sortResult =>
+                if isProp : sortResult.sortLevel!.isAlwaysZero then
+                  match buildExecution stats nextContext nextSource
+                      (argIdx + 1) toCheck fuel with
+                  | .error error => .error error
+                  | .ok ⟨result, tail⟩ => .ok ⟨result,
+                      .proofField context fuel argIdx toCheck name domain body
+                        binderInfo sortResult (Nat.le_of_not_gt isParameter)
+                        hensure isProp tail⟩
+                else
+                  match buildExecution stats nextContext nextSource
+                      (argIdx + 1) (toCheck.push context.freshExpr) fuel with
+                  | .error error => .error error
+                  | .ok ⟨result, tail⟩ => .ok ⟨result,
+                      .dataField context fuel argIdx toCheck name domain body
+                        binderInfo sortResult (Nat.le_of_not_gt isParameter)
+                        hensure (by
+                          cases h : sortResult.sortLevel!.isAlwaysZero <;> simp_all)
+                        tail⟩
+        | _ => .error <| .other
+            "large-eliminator source shape disagrees with isForall"
+
+end LargeEliminatorLoopTrace
+
+/-- The source identity and exact loop retained when the singleton branch of
+`isLargeEliminator` is selected. -/
+structure LargeEliminatorSingletonExecution
+    (stats : InductiveStats) (indTypes : Array InductiveType)
+    (context : Context) (result : Bool) where
+  indType : InductiveType
+  indTypes_eq : indTypes = #[indType]
+  ctor : Constructor
+  ctors_eq : indType.ctors = [ctor]
+  trace : LargeEliminatorLoopTrace stats context ctor.type 0 #[]
+    context.fuel.inductiveFuel result
+
+/-- One exact successful execution of `isLargeEliminator`. The ordinary
+equation is always retained; the singleton payload additionally exposes all
+field-sort observations made by the executable. -/
+structure LargeEliminatorExecution
+    (stats : InductiveStats) (indTypes : Array InductiveType)
+    (context : Context) where
+  result : Bool
+  singleton : Option
+    (LargeEliminatorSingletonExecution stats indTypes context result)
+  run_eq : isLargeEliminator stats indTypes context = .ok result
+
+namespace LargeEliminatorExecution
+
+/-- Execute the ordinary decision and retain a transparent refinement of its
+singleton traversal. -/
+def buildExecution (stats : InductiveStats) (indTypes : Array InductiveType)
+    (context : Context) :
+    Except Exception (LargeEliminatorExecution stats indTypes context) :=
+  match hrun : isLargeEliminator stats indTypes context with
+  | .error error => .error error
+  | .ok result =>
+      if stats.isNotZero then
+        .ok { result, singleton := none, run_eq := hrun }
+      else
+        match htypes : indTypes with
+        | #[indType] =>
+            match hctors : indType.ctors with
+            | [ctor] =>
+                match LargeEliminatorLoopTrace.buildExecution stats context
+                    ctor.type 0 #[] context.fuel.inductiveFuel with
+                | .error error => .error error
+                | .ok ⟨traceResult, trace⟩ =>
+                    if hsame : traceResult = result then
+                      .ok {
+                        result
+                        singleton := some {
+                          indType
+                          indTypes_eq := rfl
+                          ctor
+                          ctors_eq := hctors
+                          trace := hsame ▸ trace }
+                        run_eq := by simpa only [htypes] using hrun }
+                    else
+                      .error <| .other
+                        "large-eliminator trace disagrees with ordinary result"
+            | _ => .ok {
+                result
+                singleton := none
+                run_eq := by simpa only [htypes] using hrun }
+        | _ => .ok {
+            result
+            singleton := none
+            run_eq := by simpa only [htypes] using hrun }
+
+end LargeEliminatorExecution
+
+/-- Exact `getElimLevel` execution paired with the retained large-elimination
+decision that controls it. `level_eq` exposes both the zero and fresh-parameter
+branches without unfolding the monadic checker again. -/
+structure ElimLevelExecution
+    (stats : InductiveStats) (indTypes : Array InductiveType)
+    (context : Context) where
+  large : LargeEliminatorExecution stats indTypes context
+  level : Level
+  level_eq : level = if large.result then
+    .param (getFreshElimParam context.lparams) else .zero
+  run_eq : getElimLevel stats indTypes context = .ok level
+
+namespace ElimLevelExecution
+
+/-- Recompose `getElimLevel` from the retained exact large-elimination run. -/
+theorem run_of_large
+    (large : LargeEliminatorExecution stats indTypes context) :
+    getElimLevel stats indTypes context = .ok
+      (if large.result then .param (getFreshElimParam context.lparams)
+        else .zero) := by
+  unfold getElimLevel
+  simp only [ReaderT.bind, Bind.bind]
+  rw [large.run_eq]
+  cases large.result <;> rfl
+
+def buildExecution (stats : InductiveStats) (indTypes : Array InductiveType)
+    (context : Context) :
+    Except Exception (ElimLevelExecution stats indTypes context) := do
+  let large ← LargeEliminatorExecution.buildExecution stats indTypes context
+  let level := if large.result then
+    .param (getFreshElimParam context.lparams) else .zero
+  pure {
+    large
+    level
+    level_eq := rfl
+    run_eq := run_of_large large }
+
+theorem level_eq_zero (execution : ElimLevelExecution stats indTypes context)
+    (small : execution.large.result = false) :
+    execution.level = .zero := by
+  rw [execution.level_eq, small]
+  rfl
+
+theorem level_eq_param
+    (execution : ElimLevelExecution stats indTypes context)
+    (large : execution.large.result = true) :
+    execution.level = .param (getFreshElimParam context.lparams) := by
+  rw [execution.level_eq, large]
+  rfl
+
+/-- A small eliminator preserves the source universe-level order in recursor
+applications. -/
+theorem recLevels_eq_small
+    (execution : ElimLevelExecution stats indTypes context)
+    (small : execution.large.result = false) (levels : List Level) :
+    getRecLevels execution.level levels = levels := by
+  rw [execution.level_eq_zero small]
+  rfl
+
+/-- A large eliminator prepends its fresh elimination level to every source
+universe used by recursive calls. -/
+theorem recLevels_eq_large
+    (execution : ElimLevelExecution stats indTypes context)
+    (large : execution.large.result = true) (levels : List Level) :
+    getRecLevels execution.level levels =
+      .param (getFreshElimParam context.lparams) :: levels := by
+  rw [execution.level_eq_param large]
+  rfl
+
+/-- A small eliminator preserves the stored source level-parameter order. -/
+theorem recLevelParams_eq_small
+    (execution : ElimLevelExecution stats indTypes context)
+    (small : execution.large.result = false) (lparams : List Name) :
+    getRecLevelParams execution.level lparams = lparams := by
+  rw [execution.level_eq_zero small]
+  rfl
+
+/-- A large eliminator stores the fresh elimination parameter before every
+source level parameter. -/
+theorem recLevelParams_eq_large
+    (execution : ElimLevelExecution stats indTypes context)
+    (large : execution.large.result = true) (lparams : List Name) :
+    getRecLevelParams execution.level lparams =
+      getFreshElimParam context.lparams :: lparams := by
+  rw [execution.level_eq_param large]
+  rfl
+
+end ElimLevelExecution
+
+/-- Exact traversal of the constructor-shape fragment of `isKTarget`. The
+trace stops at the first visible non-parameter binder, just as the executable
+does; it never treats K eligibility as evidence for large elimination. -/
+inductive KTargetCtorTrace (nparams : Nat) :
+    (source : Expr) → (argIdx : Nat) → (result : Bool) → Type where
+  | parameter
+      (argIdx : Nat) (name : Name) (domain body : Expr)
+      (binderInfo : BinderInfo)
+      (isParameter : argIdx < nparams)
+      (tail : KTargetCtorTrace nparams body (argIdx + 1) result) :
+      KTargetCtorTrace nparams (.forallE name domain body binderInfo)
+        argIdx result
+  | field
+      (argIdx : Nat) (name : Name) (domain body : Expr)
+      (binderInfo : BinderInfo)
+      (isField : argIdx ≥ nparams) :
+      KTargetCtorTrace nparams (.forallE name domain body binderInfo)
+        argIdx false
+  | terminal
+      (source : Expr) (argIdx : Nat)
+      (notForall : source.isForall = false) :
+      KTargetCtorTrace nparams source argIdx true
+
+namespace KTargetCtorTrace
+
+def parameterCount
+    (trace : KTargetCtorTrace nparams source argIdx result) : Nat :=
+  match trace with
+  | .parameter (tail := tail) .. => tail.parameterCount + 1
+  | .field .. => 0
+  | .terminal .. => 0
+
+/-- The K-target walk stops at the first visible constructor field, so this
+count is either zero or one. -/
+def fieldCount
+    (trace : KTargetCtorTrace nparams source argIdx result) : Nat :=
+  match trace with
+  | .parameter (tail := tail) .. => tail.fieldCount
+  | .field .. => 1
+  | .terminal .. => 0
+
+/-- Erasing the retained constructor trace yields the exact Boolean consumed
+by `isKTarget`. -/
+theorem run
+    (trace : KTargetCtorTrace nparams source argIdx result) :
+    isKTargetCtor nparams argIdx source = result := by
+  induction trace with
+  | parameter argIdx name domain body binderInfo isParameter tail ih =>
+      simp [isKTargetCtor, isParameter, ih]
+  | field argIdx name domain body binderInfo isField =>
+      have notParameter : ¬ argIdx < nparams := Nat.not_lt.mpr isField
+      simp [isKTargetCtor, notParameter]
+  | terminal source argIdx notForall =>
+      cases source <;> simp_all [isKTargetCtor, Expr.isForall]
+
+/-- Compute the K-target constructor branch while retaining the exact point
+where the parameter prefix ends. -/
+def buildExecution (nparams : Nat) :
+    (source : Expr) → (argIdx : Nat) →
+      Sigma fun result => KTargetCtorTrace nparams source argIdx result
+  | .bvar i, argIdx => ⟨true, .terminal (.bvar i) argIdx rfl⟩
+  | .fvar id, argIdx => ⟨true, .terminal (.fvar id) argIdx rfl⟩
+  | .mvar id, argIdx => ⟨true, .terminal (.mvar id) argIdx rfl⟩
+  | .sort level, argIdx => ⟨true, .terminal (.sort level) argIdx rfl⟩
+  | .const name levels, argIdx =>
+      ⟨true, .terminal (.const name levels) argIdx rfl⟩
+  | .app fn arg, argIdx => ⟨true, .terminal (.app fn arg) argIdx rfl⟩
+  | .lam name domain body binderInfo, argIdx =>
+      ⟨true, .terminal (.lam name domain body binderInfo) argIdx rfl⟩
+  | .forallE name domain body binderInfo, argIdx =>
+      if isParameter : argIdx < nparams then
+        let ⟨result, tail⟩ := buildExecution nparams body (argIdx + 1)
+        ⟨result, .parameter argIdx name domain body binderInfo
+          isParameter tail⟩
+      else
+        ⟨false, .field argIdx name domain body binderInfo
+          (Nat.le_of_not_gt isParameter)⟩
+  | .letE name type value body nondep, argIdx =>
+      ⟨true, .terminal (.letE name type value body nondep) argIdx rfl⟩
+  | .lit literal, argIdx => ⟨true, .terminal (.lit literal) argIdx rfl⟩
+  | .mdata data expr, argIdx =>
+      ⟨true, .terminal (.mdata data expr) argIdx rfl⟩
+  | .proj typeName idx struct, argIdx =>
+      ⟨true, .terminal (.proj typeName idx struct) argIdx rfl⟩
+
+end KTargetCtorTrace
+
+/-- The singleton-Prop branch data of one exact `isKTarget` execution. -/
+structure KTargetSingletonExecution
+    (stats : InductiveStats) (indTypes : Array InductiveType)
+    (result : Bool) where
+  indType : InductiveType
+  indTypes_eq : indTypes = #[indType]
+  resultLevelZero : stats.resultLevel.isAlwaysZero = true
+  ctor : Constructor
+  ctors_eq : indType.ctors = [ctor]
+  trace : KTargetCtorTrace stats.params.size ctor.type 0 result
+
+/-- One exact successful execution of `isKTarget`. The ordinary monadic
+equation is always retained; a singleton candidate additionally exposes the
+constructor-prefix trace that decided its flag. -/
+structure KTargetExecution
+    (stats : InductiveStats) (indTypes : Array InductiveType)
+    (context : Context) where
+  result : Bool
+  singleton : Option (KTargetSingletonExecution stats indTypes result)
+  run_eq : isKTarget stats indTypes context = .ok result
+
+namespace KTargetExecution
+
+def buildExecution (stats : InductiveStats)
+    (indTypes : Array InductiveType) (context : Context) :
+    Except Exception (KTargetExecution stats indTypes context) :=
+  match hrun : isKTarget stats indTypes context with
+  | .error error => .error error
+  | .ok result =>
+      match _htypes : indTypes with
+      | #[indType] =>
+          if hzero : stats.resultLevel.isAlwaysZero then
+            match hctors : indType.ctors with
+            | [ctor] =>
+                let ⟨traceResult, trace⟩ :=
+                  KTargetCtorTrace.buildExecution stats.params.size ctor.type 0
+                if hsame : traceResult = result then
+                  .ok {
+                    result
+                    singleton := some {
+                      indType
+                      indTypes_eq := rfl
+                      resultLevelZero := hzero
+                      ctor
+                      ctors_eq := hctors
+                      trace := hsame ▸ trace }
+                    run_eq := hrun }
+                else
+                  .error <| .other
+                    "K-target trace disagrees with ordinary result"
+            | _ => .ok { result, singleton := none, run_eq := hrun }
+          else
+            .ok { result, singleton := none, run_eq := hrun }
+      | _ => .ok { result, singleton := none, run_eq := hrun }
+
+end KTargetExecution
+
+/-- The normalization/validation execution extended through constructor
+declaration and the exact elimination-level and K-target decisions used by
+`run`. This is an operational refinement only: erasing the added fields leaves the existing
+normalization candidate and checker equations unchanged. -/
+structure NormalizationEliminationExecution
+    (nparams : Nat) (types : List InductiveType)
+    (numNested : Nat) (isUnsafe : Bool) (candidateContext : Context) where
+  normalization : NormalizationCandidateExecution nparams types numNested
+    isUnsafe candidateContext
+  constructorEnv : Environment
+  declareConstructorsRun :
+    declareConstructors normalization.stats types.toArray isUnsafe
+      { normalization.validationContext with
+        env := normalization.familyEnv } = .ok constructorEnv
+  elimination : ElimLevelExecution normalization.stats types.toArray
+    { normalization.validationContext with env := constructorEnv }
+  kTarget : KTargetExecution normalization.stats types.toArray
+    { normalization.validationContext with env := constructorEnv }
+
+namespace NormalizationEliminationExecution
+
+def candidate
+    (execution : NormalizationEliminationExecution nparams types numNested
+      isUnsafe candidateContext) : NormalizationCandidate types :=
+  execution.normalization.candidate
+
+/-- Execute the existing detailed candidate producer, declare the already
+validated constructors, and retain both recursor decisions at precisely the
+post-constructor context used by `run`. -/
+def buildExecution
+    (nparams : Nat) (types : List InductiveType)
+    (numNested : Nat) (isUnsafe : Bool) (candidateContext : Context) :
+    Except Exception (NormalizationEliminationExecution nparams types
+      numNested isUnsafe candidateContext) := do
+  let normalization ← buildNormalizationCandidateExecution nparams types
+    numNested isUnsafe candidateContext
+  let constructorContext : Context :=
+    { normalization.validationContext with env := normalization.familyEnv }
+  match hdeclare : declareConstructors normalization.stats types.toArray
+      isUnsafe constructorContext with
+  | .error error => .error error
+  | .ok constructorEnv =>
+      let eliminationContext : Context :=
+        { normalization.validationContext with env := constructorEnv }
+      match ElimLevelExecution.buildExecution normalization.stats
+          types.toArray eliminationContext with
+      | .error error => .error error
+      | .ok elimination =>
+          match KTargetExecution.buildExecution normalization.stats
+              types.toArray eliminationContext with
+          | .error error => .error error
+          | .ok kTarget => .ok {
+              normalization
+              constructorEnv
+              declareConstructorsRun := by
+                simpa [constructorContext] using hdeclare
+              elimination := by simpa [eliminationContext] using elimination
+              kTarget := by simpa [eliminationContext] using kTarget }
+
+/-- The level list supplied to generated recursive calls. -/
+def recLevels
+    (execution : NormalizationEliminationExecution nparams types numNested
+      isUnsafe candidateContext) : List Level :=
+  getRecLevels execution.elimination.level execution.normalization.stats.levels
+
+/-- The level-parameter list stored in generated recursor metadata. -/
+def recLevelParams
+    (execution : NormalizationEliminationExecution nparams types numNested
+      isUnsafe candidateContext) : List Name :=
+  getRecLevelParams execution.elimination.level
+    execution.normalization.validationContext.lparams
+
+end NormalizationEliminationExecution
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.KTargetCtorTrace.run [propext]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.KTargetExecution.buildExecution [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.LargeEliminatorLoopTrace.run [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.LargeEliminatorExecution.buildExecution [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ElimLevelExecution.run_of_large [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ElimLevelExecution.recLevelParams_eq_large [propext, Classical.choice, Quot.sound]
+
+end AddInductive
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Reference/Inductive/Reduce.lean b/Ix/Theory/Named/Reference/Inductive/Reduce.lean
new file mode 100644
index 000000000..8ce22e259
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Inductive/Reduce.lean
@@ -0,0 +1,120 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Structure
+import Ix.Theory.Named.Reference.Expr
+import Ix.Theory.Named.Reference.Environment.Basic
+
+namespace Ix.Theory.Named
+open Lean hiding Environment
+open Kernel
+
+section
+variable [Monad m] (env : Environment)
+    (whnf : Expr → m Expr) (inferType : Expr → m Expr) (isDefEq : Expr → Expr → m Bool)
+    (isNeverProp : Expr → m Bool)
+
+def getFirstCtor (dName : Name) : Option Name := do
+  let some (.inductInfo info) := env.find? dName | none
+  info.ctors.head?
+
+def mkNullaryCtor (type : Expr) (nparams : Nat) : Option Expr :=
+  type.withApp fun d args => do
+  let .const dName ls := d | none
+  let name ← getFirstCtor env dName
+  return mkAppRange (.const name ls) 0 nparams args
+
+/-- When `e` has the type of a K-like inductive, converts it into a constructor application.
+
+For instance if we have `e : Eq a a`, it is converted into `Eq.refl a` (which it is definitionally
+equal to by proof irrelevance). Note that the indices of `e`'s type must match those of the
+constructor application (for instance, `e : Eq a b` cannot be converted if `a` and `b` are not
+defeq). -/
+def toCtorWhenK (rval : RecursorVal) (e : Expr) : m Expr := do
+  assert! rval.k
+  let appType ← whnf (← inferType e)
+  let .const appTypeI _ := appType.getAppFn | return e
+  if appTypeI != rval.getMajorInduct then return e
+  if appType.hasExprMVar then
+    let appTypeArgs := appType.getAppArgs
+    for h : i in [rval.numParams:appTypeArgs.size] do
+      if appTypeArgs[i].hasExprMVar then return e
+  let some newCtorApp := mkNullaryCtor env appType rval.numParams | return e
+  -- check that the indices of types of `e` and `newCtorApp` match
+  unless ← isDefEq appType (← inferType newCtorApp) do return e
+  return newCtorApp
+
+def expandEtaStruct (eType e : Expr) : Expr :=
+  eType.withApp fun I args => Id.run do
+  let .const I ls := I | return e
+  let some ctor := getFirstCtor env I | return e
+  let some (.ctorInfo info) := env.find? ctor | unreachable!
+  let mut result := mkAppRange (.const ctor ls) 0 info.numParams args
+  for i in [:info.numFields] do
+    result := .app result (.proj I i e)
+  pure result
+
+/-- When `e` is of non-recursive structure type, and that type is not a proposition, converts `e`
+into a constructor application using projections.
+
+For instance if we have `e : α × β`, it is converted into `Prod.mk α β e.1 e.2` (which is
+definitionally equal to `e` by struct eta). -/
+def toCtorWhenStruct (inductName : Name) (e : Expr) : m Expr := do
+  if !env.isNonRecStructure inductName || (e.isConstructorApp?' env).isSome then
+    return e
+  let eType ← whnf (← inferType e)
+  if !eType.getAppFn.isConstOf inductName then return e
+  -- Lean tests `is_prop eType` and declines to expand when it holds; the named specification instead requires
+  -- the level to be *never* zero, so an uncertain level declines too (see `divergences.md`).
+  -- Either way the level comes from a sort-ensuring check, so a non-sort type raises a kernel
+  -- error rather than reaching an unreachable branch.
+  unless ← isNeverProp eType do return e
+  return expandEtaStruct env eType e
+
+def getRecRuleFor (rval : RecursorVal) (major : Expr) : Option RecursorRule := do
+  let .const fn _ := major.getAppFn | none
+  rval.rules.find? (·.ctor == fn)
+
+/-- Performs recursor reduction on `e` (returning `none` if not applicable).
+
+For recursor reduction to occur, `e` must be a recursor application where the major premise is
+either a complete constructor application, a `Nat` or `String` literal, or of a K- or
+structure-like inductive type (in each case it is converted into an equivalent constructor
+application). The reduction is done by applying the `RecursorRule.rhs` associated with the
+constructor to everything before the indices in the recursor application (its parameters, motives
+and minor premises) and then to the fields of the constructor application; any arguments after the
+major premise are re-applied to the result. -/
+def inductiveReduceRec [Monad m] (env : Environment) (e : Expr)
+    (whnf : Expr → m Expr) (inferType : Expr → m Expr) (isDefEq : Expr → Expr → m Bool)
+    (isNeverProp : Expr → m Bool) :
+    m (Option Expr) := do
+  let .const recFn ls := e.getAppFn | return none
+  let some (.recInfo info) := env.find? recFn | return none
+  let recArgs := e.getAppArgs
+  let majorIdx := info.getMajorIdx
+  let some major := recArgs[majorIdx]? | return none
+  let mut major := major
+  if info.k then
+    major ← toCtorWhenK env whnf inferType isDefEq info major
+  match ← whnf major with
+  | .lit (.natVal n) => major := .natLitToConstructor n
+  | .lit (.strVal s) => major ← whnf (.strLitToConstructor s)
+  | e => major ← toCtorWhenStruct env whnf inferType isNeverProp info.getMajorInduct e
+  let some rule := getRecRuleFor info major | return none
+  let majorArgs := major.getAppArgs
+  if rule.nfields > majorArgs.size then return none
+  if ls.length != info.levelParams.length then return none
+  let mut rhs := rule.rhs.instantiateLevelParams info.levelParams ls
+  -- get the parameters, motives and minor premises from the recursor application (recursor rules
+  -- don't need the indices, as these are determined by the constructor and its parameters/fields)
+  rhs := mkAppRange rhs 0 info.getFirstIndexIdx recArgs
+  -- get fields from constructor application
+  rhs := mkAppRange rhs (majorArgs.size - rule.nfields) majorArgs.size majorArgs
+  if majorIdx + 1 < recArgs.size then
+    rhs := mkAppRange rhs (majorIdx + 1) recArgs.size recArgs
+  return rhs
+
+end
diff --git a/Ix/Theory/Named/Reference/Inductive/ValidationTrace.lean b/Ix/Theory/Named/Reference/Inductive/ValidationTrace.lean
new file mode 100644
index 000000000..b757d208d
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Inductive/ValidationTrace.lean
@@ -0,0 +1,1600 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Reference.Inductive.Add
+
+set_option linter.unusedSimpArgs false
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+namespace AddInductive
+open TypeChecker
+
+/-- The constructor root check runs with no validation-local declarations,
+while retaining every other field of the post-family checker context. -/
+def Context.withEmptyLocalContext (context : Context) : Context :=
+  { context with lctx := {} }
+
+/-- One exact successful `ensureType` execution used for an ordinary
+constructor field. -/
+structure ConstructorEnsureTypeStep where
+  context : Context
+  source : Expr
+  result : Expr
+
+def ConstructorEnsureTypeStep.Valid
+    (step : ConstructorEnsureTypeStep) : Prop :=
+  TypeChecker.M.run step.context.env step.context.safety
+      step.context.lctx step.context.lparams step.context.fuel
+      (TypeChecker.ensureType step.source) =
+    .ok step.result
+
+/-- The two successful universe branches of `checkConstructors`: either the
+transparent structural comparison succeeds, or the exact fallback comparison
+does. Keeping the branch choice prevents a trace from silently replacing the
+executable universe test with a stronger premise. -/
+inductive ConstructorUniverseTrace (resultLevel fieldLevel : Level) : Type where
+  | structural
+      (valid : levelStructGe resultLevel fieldLevel = true) :
+      ConstructorUniverseTrace resultLevel fieldLevel
+  | fallback
+      (structuralFailed : levelStructGe resultLevel fieldLevel = false)
+      (valid : (resultLevel.isAlwaysZero || resultLevel.geq fieldLevel) = true) :
+      ConstructorUniverseTrace resultLevel fieldLevel
+
+namespace ConstructorUniverseTrace
+
+/-- A field rejected by both executable universe comparisons cannot have a
+successful universe trace. -/
+theorem not_nonempty_of_rejected
+    (structuralRejected : levelStructGe resultLevel fieldLevel = false)
+    (fallbackRejected :
+      (resultLevel.isAlwaysZero || resultLevel.geq fieldLevel) = false) :
+    ¬ Nonempty (ConstructorUniverseTrace resultLevel fieldLevel) := by
+  rintro ⟨trace⟩
+  cases trace with
+  | structural valid => simp_all
+  | fallback _ valid => simp_all
+
+end ConstructorUniverseTrace
+
+/-- Complete successful traversal of `checkPositivity.loop`, indexed by the
+exact source expression, checker context, and remaining fuel. The recursive
+constructor records the precise local declaration used by the executable
+traversal; the terminal constructor records the accepted recursive target. -/
+inductive ConstructorPositivityTrace
+    (stats : InductiveStats) (ctor : Name) (argIdx : Nat) :
+    (context : Context) → (source : Expr) → (fuel : Nat) → Type where
+  | absent
+      (context : Context) (source result : Expr) (fuel : Nat)
+      (whnf : CandidateWhnfStep.Valid ⟨context, source, result⟩)
+      (occurs : hasIndOcc stats.indConsts result = false) :
+      ConstructorPositivityTrace stats ctor argIdx context source (fuel + 1)
+  | forallE
+      (context : Context) (source : Expr) (fuel : Nat)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (whnf : CandidateWhnfStep.Valid
+        ⟨context, source, .forallE name domain body binderInfo⟩)
+      (occurs : hasIndOcc stats.indConsts
+        (.forallE name domain body binderInfo) = true)
+      (domainFree : hasIndOcc stats.indConsts domain = false)
+      (tail : ConstructorPositivityTrace stats ctor argIdx
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) fuel) :
+      ConstructorPositivityTrace stats ctor argIdx context source (fuel + 1)
+  | target
+      (context : Context) (source result : Expr) (fuel targetIdx : Nat)
+      (whnf : CandidateWhnfStep.Valid ⟨context, source, result⟩)
+      (occurs : hasIndOcc stats.indConsts result = true)
+      (terminal : result.isForall = false)
+      (valid : isValidIndApp? stats result = some targetIdx) :
+      ConstructorPositivityTrace stats ctor argIdx context source (fuel + 1)
+
+namespace ConstructorPositivityTrace
+
+/-- Observable recursive-target data retained by the positivity traversal.
+`binderDepth` counts positive Pi domains traversed before the terminal family
+application. -/
+structure Target where
+  familyIdx : Nat
+  binderDepth : Nat
+  deriving DecidableEq, Repr
+
+/-- Erase proof fields while retaining the exact sibling-family ordinal and
+positive-Pi depth selected by the executable positivity run. -/
+def target? :
+    ConstructorPositivityTrace stats ctor argIdx context source fuel →
+      Option Target
+  | .absent _ _ _ _ _ _ => none
+  | .forallE _ _ _ _ _ _ _ _ _ _ tail =>
+      tail.target?.map fun target =>
+        { target with binderDepth := target.binderDepth + 1 }
+  | .target _ _ _ _ familyIdx _ _ _ _ =>
+      some { familyIdx, binderDepth := 0 }
+
+/-- Erasing a positivity trace replays the exact executable traversal. -/
+theorem run
+    (trace : ConstructorPositivityTrace stats ctor argIdx context source fuel) :
+    checkPositivity.loop stats ctor argIdx source fuel context = .ok () := by
+  induction trace with
+  | absent context source result fuel whnf occurs =>
+      unfold checkPositivity.loop
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [whnf]
+      simp only [Except.bind]
+      rw [occurs]
+      rfl
+  | forallE context source fuel name domain body binderInfo whnf occurs
+      domainFree tail ih =>
+      unfold checkPositivity.loop
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [whnf]
+      simp only [Except.bind]
+      rw [occurs]
+      simp only [Bool.not_true, Bool.false_eq_true, if_false,
+        ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+        Except.bind, Except.pure]
+      rw [domainFree]
+      simp only [Bool.false_eq_true, if_false, withLocalDecl_apply]
+      exact ih
+  | target context source result fuel targetIdx whnf occurs terminal valid =>
+      unfold checkPositivity.loop
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [whnf]
+      simp only [Except.bind]
+      rw [occurs]
+      simp only [Bool.not_true, Bool.false_eq_true, if_false,
+        ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+        Except.bind, Except.pure]
+      cases result <;>
+        simp_all [Expr.isForall, ReaderT.pure, Pure.pure, Except.pure]
+
+/-- Every successful executable positivity traversal decomposes into the
+source-indexed trace above. -/
+theorem exists_of_run
+    (success : checkPositivity.loop stats ctor argIdx source fuel context =
+      .ok ()) :
+    Nonempty (ConstructorPositivityTrace stats ctor argIdx
+      context source fuel) := by
+  induction fuel generalizing context source with
+  | zero =>
+      rw [checkPositivity.loop.eq_1] at success
+      change Except.error Exception.deepRecursion = Except.ok () at success
+      contradiction
+  | succ fuel ih =>
+      rw [checkPositivity.loop.eq_2] at success
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply] at success
+      cases hwhnf : TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.whnf source) with
+      | error err => simp_all [Except.bind]
+      | ok result =>
+          rw [hwhnf] at success
+          simp only [Except.bind] at success
+          cases hocc : hasIndOcc stats.indConsts result with
+          | false => exact ⟨.absent context source result fuel hwhnf hocc⟩
+          | true =>
+            rw [hocc] at success
+            simp only [Bool.not_true, Bool.false_eq_true, if_false,
+              ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+              Except.bind, Except.pure] at success
+            cases result
+            case forallE name domain body binderInfo =>
+                simp only at success
+                cases hdomain : hasIndOcc stats.indConsts domain with
+                | false =>
+                  rw [hdomain] at success
+                  simp only [Bool.false_eq_true, if_false,
+                    withLocalDecl_apply] at success
+                  obtain ⟨tail⟩ := ih success
+                  exact ⟨.forallE context source fuel name domain body
+                    binderInfo hwhnf hocc hdomain tail⟩
+                | true =>
+                  rw [hdomain] at success
+                  change Except.error _ = Except.ok () at success
+                  contradiction
+            all_goals
+              simp only at success
+              cases hvalid : isValidIndApp? stats _ with
+              | none =>
+                  rw [hvalid] at success
+                  change Except.error _ = Except.ok () at success
+                  contradiction
+              | some targetIdx =>
+                  exact ⟨.target context source _ fuel targetIdx
+                    hwhnf hocc rfl hvalid⟩
+
+/-- Execute the positivity traversal while retaining its exact dependent
+trace as data. Unlike `exists_of_run`, this decomposition is transparent and
+therefore remains available to later executable alignment audits; erasing the
+result with `run` recovers the ordinary checker execution. -/
+def buildExecution (stats : InductiveStats) (ctor : Name) (argIdx : Nat)
+    (context : Context) (source : Expr) :
+    (fuel : Nat) → Except Exception
+      (ConstructorPositivityTrace stats ctor argIdx context source fuel)
+  | 0 => .error .deepRecursion
+  | fuel + 1 =>
+      match hwhnf : TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel (TypeChecker.whnf source) with
+      | .error error => .error error
+      | .ok result =>
+          match hoccurs : hasIndOcc stats.indConsts result with
+          | false => .ok (.absent context source result fuel hwhnf hoccurs)
+          | true =>
+              match hforall : result.isForall with
+              | true =>
+                  match result with
+                  | .forallE name domain body binderInfo =>
+                      match hdomain : hasIndOcc stats.indConsts domain with
+                      | true => .error <| .other
+                          s!"arg #{argIdx + 1} of '{ctor}' has a non positive occurrence of the datatypes being declared"
+                      | false =>
+                          match buildExecution stats ctor argIdx
+                              (context.pushLocalDecl name binderInfo
+                                (consumeTypeAnnotations domain))
+                              (body.instantiate1 context.freshExpr) fuel with
+                          | .error error => .error error
+                          | .ok tail => .ok (.forallE context source fuel name
+                              domain body binderInfo hwhnf hoccurs hdomain tail)
+                  | _ => .error <| .other
+                      "positivity WHNF shape disagrees with isForall"
+              | false =>
+                  match hvalid : isValidIndApp? stats result with
+                  | none => .error <| .other
+                      s!"arg #{argIdx + 1} of '{ctor}' has a non valid occurrence of the datatypes being declared"
+                  | some targetIdx => .ok (.target context source result fuel
+                      targetIdx hwhnf hoccurs hforall hvalid)
+
+/-- The transparent decomposition succeeds on every input accepted by the
+executable positivity traversal, so retained-trace construction needs no
+choice principle. -/
+theorem buildExecution_ok_of_run
+    (success : checkPositivity.loop stats ctor argIdx source fuel context =
+      .ok ()) :
+    ∃ trace, buildExecution stats ctor argIdx context source fuel =
+      .ok trace := by
+  induction fuel generalizing context source with
+  | zero =>
+      rw [checkPositivity.loop.eq_1] at success
+      change Except.error Exception.deepRecursion = Except.ok () at success
+      contradiction
+  | succ fuel ih =>
+      rw [checkPositivity.loop.eq_2] at success
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply] at success
+      unfold buildExecution
+      split
+      next error heq =>
+        rw [heq] at success
+        simp [Except.bind] at success
+      next result heq =>
+        rw [heq] at success
+        simp only [Except.bind] at success
+        split
+        next hoccurs => exact ⟨_, rfl⟩
+        next hoccurs =>
+          rw [hoccurs] at success
+          simp only [Bool.not_true, Bool.false_eq_true, if_false,
+            ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+            Except.bind, Except.pure] at success
+          cases result <;> simp only [Expr.isForall] <;> simp only at success
+          case forallE name domain body binderInfo =>
+            split
+            next hdomain =>
+              rw [hdomain] at success
+              change Except.error _ = Except.ok () at success
+              contradiction
+            next hdomain =>
+              rw [hdomain] at success
+              have tailSuccess :
+                  checkPositivity.loop stats ctor argIdx
+                    (body.instantiate1 context.freshExpr) fuel
+                    (context.pushLocalDecl name binderInfo
+                      (consumeTypeAnnotations domain)) = .ok () := success
+              obtain ⟨tail, htail⟩ := ih tailSuccess
+              rw [htail]
+              exact ⟨_, rfl⟩
+          all_goals
+            split
+            next hvalid =>
+              rw [hvalid] at success
+              change Except.error _ = Except.ok () at success
+              contradiction
+            next targetIdx hvalid => exact ⟨_, rfl⟩
+
+/-- An exact positivity failure, including its diagnostic payload, excludes a
+successful trace at precisely that source/context/fuel position. -/
+theorem not_nonempty_of_error
+    (failure : checkPositivity.loop stats ctor argIdx source fuel context =
+      .error err) :
+    ¬ Nonempty (ConstructorPositivityTrace stats ctor argIdx
+      context source fuel) := by
+  rintro ⟨trace⟩
+  have success := trace.run
+  rw [failure] at success
+  contradiction
+
+end ConstructorPositivityTrace
+
+/-- Whether positivity was executed or skipped by the exact `isUnsafe`
+branch of constructor validation. -/
+inductive ConstructorPositivityModeTrace
+    (stats : InductiveStats) (isUnsafe : Bool)
+    (ctor : Name) (argIdx : Nat) (context : Context) (source : Expr) : Type where
+  | skipped
+      (isUnsafe_eq : isUnsafe = true) :
+      ConstructorPositivityModeTrace stats isUnsafe ctor argIdx context source
+  | safe
+      (isUnsafe_eq : isUnsafe = false)
+      (trace : ConstructorPositivityTrace stats ctor argIdx context source
+        context.fuel.inductiveFuel) :
+      ConstructorPositivityModeTrace stats isUnsafe ctor argIdx context source
+
+namespace ConstructorPositivityModeTrace
+
+/-- Observable recursive target for the exact safe/unsafe positivity branch.
+Unsafe validation deliberately exposes no positivity claim. -/
+def target? :
+    ConstructorPositivityModeTrace
+      stats isUnsafe ctor argIdx context source →
+      Option ConstructorPositivityTrace.Target
+  | .skipped _ => none
+  | .safe _ trace => trace.target?
+
+theorem run
+    (trace : ConstructorPositivityModeTrace
+      stats isUnsafe ctor argIdx context source) :
+    (if !isUnsafe then checkPositivity stats source ctor argIdx else pure ())
+        context = .ok () := by
+  cases trace with
+  | skipped h => simp [h, ReaderT.pure, Pure.pure, Except.pure]
+  | safe h trace =>
+      simp only [h, Bool.not_false, if_true]
+      unfold checkPositivity
+      simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+        ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+        Except.bind, Except.pure] using trace.run
+
+/-- Execute the recorded positivity branch and then an exact continuation. -/
+theorem bind_run
+    (trace : ConstructorPositivityModeTrace
+      stats isUnsafe ctor argIdx context source)
+    (next : M α) (result : α)
+    (nextRun : next context = .ok result) :
+    (do
+      if !isUnsafe then checkPositivity stats source ctor argIdx
+      next) context = .ok result := by
+  cases trace with
+  | skipped h =>
+      simp [h, nextRun, ReaderT.bind, Bind.bind,
+        ReaderT.pure, Pure.pure, Except.bind, Except.pure]
+  | safe h trace =>
+      have positivityRun :
+          checkPositivity stats source ctor argIdx context = .ok () := by
+        unfold checkPositivity
+        simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+          ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+          Except.bind, Except.pure] using trace.run
+      simp [h, positivityRun, nextRun, ReaderT.bind, Bind.bind,
+        ReaderT.pure, Pure.pure, Except.bind, Except.pure]
+
+/-- A successful executable positivity branch determines whether validation
+was skipped for an unsafe declaration or supplies the full safe trace. -/
+theorem exists_of_run
+    (success :
+      (if !isUnsafe then checkPositivity stats source ctor argIdx else pure ())
+        context = .ok ()) :
+    Nonempty (ConstructorPositivityModeTrace
+      stats isUnsafe ctor argIdx context source) := by
+  cases hUnsafe : isUnsafe with
+  | false =>
+      simp only [hUnsafe, Bool.not_false, if_true] at success
+      unfold checkPositivity at success
+      simp only [readThe, MonadReaderOf.read, ReaderT.read,
+        ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+        Except.bind, Except.pure] at success
+      obtain ⟨trace⟩ := ConstructorPositivityTrace.exists_of_run success
+      exact ⟨.safe rfl trace⟩
+  | true => exact ⟨.skipped rfl⟩
+
+/-- Transparently retain the exact safe/unsafe positivity branch selected by
+constructor validation. -/
+def buildExecution (stats : InductiveStats) (isUnsafe : Bool)
+    (ctor : Name) (argIdx : Nat) (context : Context) (source : Expr) :
+    Except Exception
+      (ConstructorPositivityModeTrace stats isUnsafe ctor argIdx context source) :=
+  match isUnsafe with
+  | true => .ok (.skipped rfl)
+  | false =>
+      match ConstructorPositivityTrace.buildExecution stats ctor argIdx
+          context source context.fuel.inductiveFuel with
+      | .error error => .error error
+      | .ok trace => .ok (.safe rfl trace)
+
+/-- The retained safe/unsafe branch decomposition succeeds whenever the
+executable positivity branch does. -/
+theorem buildExecution_ok_of_run
+    (success :
+      (if !isUnsafe then checkPositivity stats source ctor argIdx else pure ())
+        context = .ok ()) :
+    ∃ trace, buildExecution stats isUnsafe ctor argIdx context source =
+      .ok trace := by
+  cases isUnsafe with
+  | true => exact ⟨_, rfl⟩
+  | false =>
+      simp only [Bool.not_false, if_true] at success
+      unfold checkPositivity at success
+      simp only [readThe, MonadReaderOf.read, ReaderT.read,
+        ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+        Except.bind, Except.pure] at success
+      obtain ⟨trace, htrace⟩ :=
+        ConstructorPositivityTrace.buildExecution_ok_of_run success
+      unfold buildExecution
+      rw [htrace]
+      exact ⟨_, rfl⟩
+
+/-- Failure of the exact safe/unsafe positivity branch excludes its retained
+mode trace without changing the executable diagnostic. -/
+theorem not_nonempty_of_error
+    (failure :
+      (if !isUnsafe then checkPositivity stats source ctor argIdx else pure ())
+        context = .error err) :
+    ¬ Nonempty (ConstructorPositivityModeTrace
+      stats isUnsafe ctor argIdx context source) := by
+  rintro ⟨trace⟩
+  have success := trace.run
+  rw [failure] at success
+  contradiction
+
+end ConstructorPositivityModeTrace
+
+/-- Exact successful validation of one constructor type from its root through
+its parameter prefix, ordinary fields, positivity checks, and terminal family
+application. Every recursive index is selected by the executable traversal. -/
+inductive ConstructorTypeValidationTrace
+    (stats : InductiveStats) (isUnsafe : Bool)
+    (familyIdx : Nat) (ctor : Name) :
+    (context : Context) → (source : Expr) →
+      (argIdx fuel : Nat) → Type where
+  | parameter
+      (context : Context) (fuel argIdx : Nat)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (param parameterType : Expr)
+      (parameterAt : stats.params[argIdx]? = some param)
+      (parameterTypeRun : getType param context = .ok parameterType)
+      (defeq : CandidateIsDefEqStep.Valid
+        ⟨context, domain, parameterType⟩)
+      (tail : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context (body.instantiate1 param) (argIdx + 1) fuel) :
+      ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context (.forallE name domain body binderInfo) argIdx (fuel + 1)
+  | ordinary
+      (context : Context) (fuel argIdx : Nat)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (sortResult : Expr)
+      (noParameter : stats.params[argIdx]? = none)
+      (ensureType : ConstructorEnsureTypeStep.Valid
+        ⟨context, domain, sortResult⟩)
+      (universeTrace : ConstructorUniverseTrace
+        stats.resultLevel sortResult.sortLevel!)
+      (positivity : ConstructorPositivityModeTrace
+        stats isUnsafe ctor argIdx context domain)
+      (tail : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) fuel) :
+      ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context (.forallE name domain body binderInfo) argIdx (fuel + 1)
+  | terminal
+      (context : Context) (source : Expr) (fuel argIdx : Nat)
+      (terminal : source.isForall = false)
+      (valid : isValidIndAppIdx stats source familyIdx = true) :
+      ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context source argIdx (fuel + 1)
+
+namespace ConstructorTypeValidationTrace
+
+/-- Field-ordered recursive-target observations for one constructor. Parameter
+binders are omitted; every ordinary constructor field contributes one slot. -/
+def targets :
+    ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel →
+      List (Option ConstructorPositivityTrace.Target)
+  | .parameter _ _ _ _ _ _ _ _ _ _ _ _ tail => tail.targets
+  | .ordinary _ _ _ _ _ _ _ _ _ _ _ positivity tail =>
+      positivity.target? :: tail.targets
+  | .terminal _ _ _ _ _ _ => []
+
+/-- Erasing one constructor-type trace replays the exact inner
+`checkConstructorType.loop` execution. -/
+theorem run
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel) :
+    checkConstructorType.loop stats isUnsafe familyIdx ctor source argIdx fuel
+        context = .ok () := by
+  induction trace with
+  | parameter context fuel argIdx name domain body binderInfo param
+      parameterType parameterAt parameterTypeRun defeq tail ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega]
+      rw [checkConstructorType.loop.eq_2]
+      rw [parameterAt]
+      simp only [ReaderT.bind, Bind.bind]
+      rw [parameterTypeRun]
+      simp only [Except.bind, liftTypeChecker_apply]
+      rw [defeq]
+      simp only [if_true, ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+        Except.bind, Except.pure]
+      exact ih
+  | ordinary context fuel argIdx name domain body binderInfo sortResult noParameter
+      ensureType universeTrace positivity tail ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega]
+      rw [checkConstructorType.loop.eq_2]
+      rw [noParameter]
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [ensureType]
+      simp only [Except.bind]
+      let next : M PUnit :=
+        withLocalDecl name binderInfo (consumeTypeAnnotations domain) fun arg =>
+          checkConstructorType.loop stats isUnsafe familyIdx ctor
+            (body.instantiate1 arg) (argIdx + 1) fuel
+      have nextRun : next context = .ok () := by
+        simp only [next, withLocalDecl_apply]
+        exact ih
+      have restRun :
+          (do
+            if !isUnsafe then checkPositivity stats domain ctor argIdx
+            next) context = .ok () :=
+        positivity.bind_run next () nextRun
+      cases universeTrace with
+      | structural valid =>
+          rw [valid]
+          simp only [if_true, ReaderT.pure, Pure.pure,
+            ReaderT.bind, Bind.bind, Except.bind, Except.pure]
+          exact restRun
+      | fallback structuralFailed valid =>
+          rw [structuralFailed, valid]
+          simp only [Bool.true_eq_false, Bool.not_true, if_false,
+            Bool.false_eq_true,
+            ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+            Except.bind, Except.pure]
+          exact restRun
+  | terminal context source fuel argIdx terminal valid =>
+      rw [show fuel + 1 = Nat.succ fuel by omega]
+      cases source <;>
+        simp_all [checkConstructorType.loop, Expr.isForall,
+          ReaderT.pure, Pure.pure, Except.pure]
+
+/-- Every successful one-constructor telescope traversal decomposes into the
+exact parameter, field, universe, positivity, and terminal trace. -/
+theorem exists_of_run
+    (success :
+      checkConstructorType.loop stats isUnsafe familyIdx ctor source argIdx fuel
+        context = .ok ()) :
+    Nonempty (ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel) := by
+  induction fuel generalizing context source argIdx with
+  | zero =>
+      rw [checkConstructorType.loop.eq_1] at success
+      change Except.error Exception.deepRecursion = Except.ok () at success
+      contradiction
+  | succ fuel ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega] at success
+      cases source
+      case forallE name domain body binderInfo =>
+        rw [checkConstructorType.loop.eq_2] at success
+        simp only at success
+        cases hparam : stats.params[argIdx]? with
+        | some param =>
+            rw [hparam] at success
+            simp only [ReaderT.bind, Bind.bind] at success
+            cases hget : getType param context with
+            | error err => simp_all [Except.bind]
+            | ok parameterType =>
+                rw [hget] at success
+                simp only [Except.bind, liftTypeChecker_apply] at success
+                cases hdefeq : TypeChecker.M.run context.env context.safety
+                    context.lctx context.lparams context.fuel
+                    (TypeChecker.isDefEq domain parameterType) with
+                | error err => simp_all [Except.bind]
+                | ok equal =>
+                    rw [hdefeq] at success
+                    simp only [Except.bind] at success
+                    cases equal with
+                    | false =>
+                        change Except.error _ = Except.ok () at success
+                        contradiction
+                    | true =>
+                        simp only [if_true, ReaderT.pure, Pure.pure,
+                          ReaderT.bind, Bind.bind, Except.bind,
+                          Except.pure] at success
+                        obtain ⟨tail⟩ := ih success
+                        exact ⟨.parameter context fuel argIdx name domain body
+                          binderInfo param parameterType hparam hget hdefeq tail⟩
+        | none =>
+            rw [hparam] at success
+            simp only [ReaderT.bind, Bind.bind,
+              liftTypeChecker_apply] at success
+            cases hensure : TypeChecker.M.run context.env context.safety
+                context.lctx context.lparams context.fuel
+                (TypeChecker.ensureType domain) with
+            | error err => simp_all [Except.bind]
+            | ok sortResult =>
+                rw [hensure] at success
+                simp only [Except.bind] at success
+                have finish
+                    (universeTrace : ConstructorUniverseTrace
+                      stats.resultLevel sortResult.sortLevel!)
+                    (restSuccess :
+                      (do
+                        if !isUnsafe then
+                          checkPositivity stats domain ctor argIdx
+                        withLocalDecl name binderInfo
+                            (consumeTypeAnnotations domain) fun arg =>
+                          checkConstructorType.loop stats isUnsafe familyIdx ctor
+                            (body.instantiate1 arg) (argIdx + 1) fuel)
+                        context = .ok ()) :
+                    Nonempty (ConstructorTypeValidationTrace stats isUnsafe
+                      familyIdx ctor context
+                      (.forallE name domain body binderInfo) argIdx (fuel + 1)) := by
+                  cases isUnsafe with
+                  | false =>
+                      simp only [Bool.not_false, if_true,
+                        ReaderT.bind, Bind.bind] at restSuccess
+                      cases hpos : checkPositivity stats domain ctor argIdx context with
+                      | error err => simp_all [Except.bind]
+                      | ok typeUnit =>
+                          cases typeUnit
+                          rw [hpos] at restSuccess
+                          simp only [Except.bind, withLocalDecl_apply] at restSuccess
+                          have hposLoop :
+                              checkPositivity.loop stats ctor argIdx domain
+                                  context.fuel.inductiveFuel context = .ok () := by
+                            unfold checkPositivity at hpos
+                            simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+                              ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+                              Except.bind, Except.pure] using hpos
+                          obtain ⟨positivityTrace⟩ :=
+                            ConstructorPositivityTrace.exists_of_run hposLoop
+                          obtain ⟨tail⟩ := ih restSuccess
+                          exact ⟨.ordinary context fuel argIdx name domain body
+                            binderInfo sortResult hparam hensure universeTrace
+                            (.safe rfl positivityTrace) tail⟩
+                  | true =>
+                      simp only [Bool.not_true, if_false,
+                        ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+                        Except.bind, Except.pure,
+                        withLocalDecl_apply] at restSuccess
+                      obtain ⟨tail⟩ := ih restSuccess
+                      exact ⟨.ordinary context fuel argIdx name domain body
+                        binderInfo sortResult hparam hensure universeTrace
+                        (.skipped rfl) tail⟩
+                cases hstruct : levelStructGe stats.resultLevel
+                    sortResult.sortLevel! with
+                | true =>
+                    rw [hstruct] at success
+                    simp only [if_true, ReaderT.pure, Pure.pure,
+                      ReaderT.bind, Bind.bind, Except.bind,
+                      Except.pure] at success
+                    exact finish (.structural hstruct) success
+                | false =>
+                    rw [hstruct] at success
+                    simp only [Bool.false_eq_true, if_false] at success
+                    cases hfallback :
+                        (stats.resultLevel.isAlwaysZero ||
+                          stats.resultLevel.geq sortResult.sortLevel!) with
+                    | false =>
+                        rw [hfallback] at success
+                        change Except.error _ = Except.ok () at success
+                        contradiction
+                    | true =>
+                        rw [hfallback] at success
+                        simp only [Bool.true_eq_false, Bool.not_true, if_false,
+                          ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+                          Except.bind, Except.pure] at success
+                        exact finish (.fallback hstruct hfallback) success
+      all_goals
+        unfold checkConstructorType.loop at success
+        simp only at success
+        cases hvalid : isValidIndAppIdx stats _ familyIdx with
+        | false =>
+            rw [hvalid] at success
+            change Except.error _ = Except.ok () at success
+            contradiction
+        | true =>
+            exact ⟨.terminal context _ fuel argIdx rfl hvalid⟩
+
+/-- Execute one constructor telescope while retaining the exact parameter,
+universe, positivity, and terminal choices made by the ordinary validator.
+The returned data is transparent, so later executable gates can inspect the
+same trace without selecting it through `Classical.choice`. -/
+def buildExecution (stats : InductiveStats) (isUnsafe : Bool)
+    (familyIdx : Nat) (ctor : Name) (context : Context) (source : Expr)
+    (argIdx : Nat) :
+    (fuel : Nat) → Except Exception
+      (ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context source argIdx fuel)
+  | 0 => .error .deepRecursion
+  | fuel + 1 =>
+      match hforall : source.isForall with
+      | false =>
+          match hvalid : isValidIndAppIdx stats source familyIdx with
+          | false => .error <| .other s!"invalid return type for '{ctor}'"
+          | true => .ok (.terminal context source fuel argIdx hforall hvalid)
+      | true =>
+          match source with
+          | .forallE name domain body binderInfo =>
+              match hparam : stats.params[argIdx]? with
+              | some param =>
+                  match hget : getType param context with
+                  | .error error => .error error
+                  | .ok parameterType =>
+                      match hdefeq : TypeChecker.M.run context.env
+                          context.safety context.lctx context.lparams
+                          context.fuel
+                          (TypeChecker.isDefEq domain parameterType) with
+                      | .error error => .error error
+                      | .ok false => .error <| .other
+                          s!"arg #{argIdx + 1} of '{ctor}' does not match inductive datatype parameters"
+                      | .ok true =>
+                          match buildExecution stats isUnsafe familyIdx ctor
+                              context (body.instantiate1 param) (argIdx + 1)
+                              fuel with
+                          | .error error => .error error
+                          | .ok tail => .ok (.parameter context fuel argIdx
+                              name domain body binderInfo param parameterType
+                              hparam hget hdefeq tail)
+              | none =>
+                  match hensure : TypeChecker.M.run context.env context.safety
+                      context.lctx context.lparams context.fuel
+                      (TypeChecker.ensureType domain) with
+                  | .error error => .error error
+                  | .ok sortResult =>
+                      let finish (universeTrace : ConstructorUniverseTrace
+                          stats.resultLevel sortResult.sortLevel!) :=
+                        match ConstructorPositivityModeTrace.buildExecution
+                            stats isUnsafe ctor argIdx context domain with
+                        | .error error => .error error
+                        | .ok positivity =>
+                            match buildExecution stats isUnsafe familyIdx ctor
+                                (context.pushLocalDecl name binderInfo
+                                  (consumeTypeAnnotations domain))
+                                (body.instantiate1 context.freshExpr)
+                                (argIdx + 1) fuel with
+                            | .error error => .error error
+                            | .ok tail => .ok (.ordinary context fuel argIdx
+                                name domain body binderInfo sortResult hparam
+                                hensure universeTrace positivity tail)
+                      match hstruct : levelStructGe stats.resultLevel
+                          sortResult.sortLevel! with
+                      | true => finish (.structural hstruct)
+                      | false =>
+                          match hfallback : stats.resultLevel.isAlwaysZero ||
+                              stats.resultLevel.geq sortResult.sortLevel! with
+                          | false => .error <| .other
+                              s!"universe level of type_of(arg #{argIdx + 1}) of '{ctor}' is too big for the corresponding inductive datatype"
+                          | true => finish (.fallback hstruct hfallback)
+          | _ => .error <| .other
+              "constructor source shape disagrees with isForall"
+
+/-- The transparent telescope decomposition succeeds on every constructor
+type accepted by the inner executable validator. -/
+theorem buildExecution_ok_of_run
+    (success :
+      checkConstructorType.loop stats isUnsafe familyIdx ctor source argIdx fuel
+        context = .ok ()) :
+    ∃ trace, buildExecution stats isUnsafe familyIdx ctor context source
+      argIdx fuel = .ok trace := by
+  induction fuel generalizing context source argIdx with
+  | zero =>
+      rw [checkConstructorType.loop.eq_1] at success
+      change Except.error Exception.deepRecursion = Except.ok () at success
+      contradiction
+  | succ fuel ih =>
+      rw [show fuel + 1 = Nat.succ fuel by omega] at success
+      cases source
+      case forallE name domain body binderInfo =>
+        rw [checkConstructorType.loop.eq_2] at success
+        simp only at success
+        unfold buildExecution
+        simp only [Expr.isForall]
+        split
+        next param hparam =>
+          rw [hparam] at success
+          simp only [ReaderT.bind, Bind.bind] at success
+          split
+          next error heq =>
+            rw [heq] at success
+            simp [Except.bind] at success
+          next parameterType heq =>
+            rw [heq] at success
+            simp only [Except.bind, liftTypeChecker_apply] at success
+            split
+            next error heq2 =>
+              rw [heq2] at success
+              simp [Except.bind] at success
+            next heq2 =>
+              rw [heq2] at success
+              simp only [Except.bind] at success
+              change Except.error _ = Except.ok () at success
+              contradiction
+            next heq2 =>
+              rw [heq2] at success
+              simp only [Except.bind, if_true, ReaderT.pure, Pure.pure,
+                ReaderT.bind, Bind.bind, Except.pure] at success
+              obtain ⟨tail, htail⟩ := ih success
+              rw [htail]
+              exact ⟨_, rfl⟩
+        next hparam =>
+          rw [hparam] at success
+          simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply] at success
+          split
+          next error heq =>
+            rw [heq] at success
+            simp [Except.bind] at success
+          next sortResult heq =>
+            rw [heq] at success
+            simp only [Except.bind] at success
+            have finish :
+                (do
+                  if !isUnsafe then checkPositivity stats domain ctor argIdx
+                  withLocalDecl name binderInfo (consumeTypeAnnotations domain)
+                      fun arg =>
+                    checkConstructorType.loop stats isUnsafe familyIdx ctor
+                      (body.instantiate1 arg) (argIdx + 1) fuel)
+                    context = .ok () →
+                (∃ positivity,
+                  ConstructorPositivityModeTrace.buildExecution stats isUnsafe
+                    ctor argIdx context domain = .ok positivity) ∧
+                ∃ tail,
+                  buildExecution stats isUnsafe familyIdx ctor
+                    (context.pushLocalDecl name binderInfo
+                      (consumeTypeAnnotations domain))
+                    (body.instantiate1 context.freshExpr) (argIdx + 1) fuel =
+                    .ok tail := by
+              intro restSuccess
+              cases isUnsafe with
+              | false =>
+                  simp only [Bool.not_false, if_true,
+                    ReaderT.bind, Bind.bind] at restSuccess
+                  cases hpos : checkPositivity stats domain ctor argIdx
+                      context with
+                  | error err => simp_all [Except.bind]
+                  | ok posUnit =>
+                      cases posUnit
+                      rw [hpos] at restSuccess
+                      simp only [Except.bind,
+                        withLocalDecl_apply] at restSuccess
+                      have hpmSuccess :
+                          (if !false then
+                            checkPositivity stats domain ctor argIdx
+                          else pure ()) context = .ok () := by
+                        simpa using hpos
+                      exact ⟨ConstructorPositivityModeTrace.buildExecution_ok_of_run
+                        hpmSuccess, ih restSuccess⟩
+              | true =>
+                  simp only [Bool.not_true, if_false,
+                    ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+                    Except.bind, Except.pure,
+                    withLocalDecl_apply] at restSuccess
+                  have hpmSuccess :
+                      (if !true then
+                        checkPositivity stats domain ctor argIdx
+                      else pure ()) context = .ok () := by
+                    simp [ReaderT.pure, Pure.pure, Except.pure]
+                  exact ⟨ConstructorPositivityModeTrace.buildExecution_ok_of_run
+                    hpmSuccess, ih restSuccess⟩
+            split
+            next hstruct =>
+              rw [hstruct] at success
+              simp only [if_true, ReaderT.pure, Pure.pure,
+                ReaderT.bind, Bind.bind, Except.bind, Except.pure] at success
+              obtain ⟨⟨positivity, hpm⟩, tail, htail⟩ := finish success
+              rw [hpm, htail]
+              exact ⟨_, rfl⟩
+            next hstruct =>
+              rw [hstruct] at success
+              simp only [Bool.false_eq_true, if_false] at success
+              split
+              next hfallback =>
+                rw [hfallback] at success
+                change Except.error _ = Except.ok () at success
+                contradiction
+              next hfallback =>
+                rw [hfallback] at success
+                simp only [Bool.true_eq_false, Bool.not_true, if_false,
+                  ReaderT.pure, Pure.pure, ReaderT.bind, Bind.bind,
+                  Except.bind, Except.pure] at success
+                obtain ⟨⟨positivity, hpm⟩, tail, htail⟩ := finish success
+                rw [hpm, htail]
+                exact ⟨_, rfl⟩
+      all_goals
+        unfold checkConstructorType.loop at success
+        simp only at success
+        unfold buildExecution
+        simp only [Expr.isForall]
+        split
+        next hvalid =>
+          rw [hvalid] at success
+          change Except.error _ = Except.ok () at success
+          contradiction
+        next hvalid => exact ⟨_, rfl⟩
+
+/-- Erasing the inner trace also replays the public one-constructor checker,
+including its exact context-fuel read. -/
+theorem check_run
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source 0 context.fuel.inductiveFuel) :
+    checkConstructorType stats isUnsafe familyIdx ctor source context = .ok () := by
+  unfold checkConstructorType
+  simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure] using trace.run
+
+/-- Any exact inner constructor-telescope failure excludes a trace at that
+same parameter/field/terminal position and retains the original error value. -/
+theorem not_nonempty_of_error
+    (failure :
+      checkConstructorType.loop stats isUnsafe familyIdx ctor source argIdx fuel
+        context = .error err) :
+    ¬ Nonempty (ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel) := by
+  rintro ⟨trace⟩
+  have success := trace.run
+  rw [failure] at success
+  contradiction
+
+end ConstructorTypeValidationTrace
+
+/-- Source-ordered validation of a constructor list. The `seen` index makes
+duplicate-name checks part of the trace and prevents reordering or omission.
+Root closedness and full type checking are retained before the recursive type
+trace, exactly as in `checkConstructors`. -/
+inductive ConstructorListValidationTrace
+    (stats : InductiveStats) (isUnsafe : Bool)
+    (familyIdx : Nat) (context : Context) :
+    NameSet → List Constructor → Type where
+  | nil (seen : NameSet) :
+      ConstructorListValidationTrace stats isUnsafe familyIdx context seen []
+  | cons
+      (seen : NameSet) (head : Constructor) (tail : List Constructor)
+      (fresh : seen.contains head.name = false)
+      (closed : context.env.checkNoMVarNoFVar head.name head.type = .ok ())
+      (rootCheck : CandidateCheckTypeObservation
+        context.withEmptyLocalContext head.type)
+      (typeTrace : ConstructorTypeValidationTrace
+        stats isUnsafe familyIdx head.name context head.type 0
+        context.fuel.inductiveFuel)
+      (tailTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+        context (seen.insert head.name) tail) :
+      ConstructorListValidationTrace stats isUnsafe familyIdx context
+        seen (head :: tail)
+
+namespace ConstructorListValidationTrace
+
+/-- Constructor-ordered positivity observations for one family. -/
+def targets :
+    ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors →
+      List (List (Option ConstructorPositivityTrace.Target))
+  | .nil _ => []
+  | .cons _ _ _ _ _ _ typeTrace tailTrace =>
+      typeTrace.targets :: tailTrace.targets
+
+/-- Execute the source-ordered constructor fold while retaining its exact
+dependent validation trace.  Every stored equation is obtained from the same
+checker call made by `checkConstructorFold`; no semantic premise participates
+in acceptance. -/
+def buildExecution (stats : InductiveStats) (isUnsafe : Bool)
+    (familyIdx : Nat) (context : Context) :
+    (seen : NameSet) → (constructors : List Constructor) →
+      Except Exception
+        (ConstructorListValidationTrace stats isUnsafe familyIdx context
+          seen constructors)
+  | seen, [] => .ok (.nil seen)
+  | seen, head :: tail =>
+      match hfresh : seen.contains head.name with
+      | true => .error <| .other s!"duplicate constructor name '{head.name}'"
+      | false =>
+          match hclosed : context.env.checkNoMVarNoFVar
+              head.name head.type with
+          | .error error => .error error
+          | .ok () =>
+              match hroot : TypeChecker.M.run context.env context.safety {}
+                  context.lparams context.fuel
+                  (TypeChecker.checkType head.type) with
+              | .error error => .error error
+              | .ok inferred =>
+                  let rootCheck : CandidateCheckTypeObservation
+                      context.withEmptyLocalContext head.type :=
+                    ⟨inferred, by
+                      simpa only [CandidateCheckTypeStep.Valid,
+                        Context.withEmptyLocalContext] using hroot⟩
+                  match ConstructorTypeValidationTrace.buildExecution stats
+                      isUnsafe familyIdx head.name context head.type 0
+                      context.fuel.inductiveFuel with
+                  | .error error => .error error
+                  | .ok typeTrace =>
+                      match buildExecution stats isUnsafe familyIdx context
+                          (seen.insert head.name) tail with
+                      | .error error => .error error
+                      | .ok tailTrace => .ok (.cons seen head tail hfresh
+                          hclosed rootCheck typeTrace tailTrace)
+
+end ConstructorListValidationTrace
+
+/-- A transparent presentation of the constructor portion of the executable
+validator, discarding only the final duplicate-name accumulator. -/
+def checkConstructorList
+    (stats : InductiveStats) (isUnsafe : Bool) (familyIdx : Nat)
+    (context : Context) (seen : NameSet) (ctors : List Constructor) :
+    Except Exception Unit := do
+  _ ← checkConstructorFold context.env stats isUnsafe familyIdx seen ctors context
+  pure ()
+
+/-- For one family, the named list recursion is exactly the array/list shell
+of the real constructor validator. -/
+theorem checkConstructors_singleton_eq_checkConstructorList
+    (indType : InductiveType) (stats : InductiveStats)
+    (isUnsafe : Bool) (context : Context) :
+    checkConstructors #[indType] stats isUnsafe context =
+      checkConstructorList stats isUnsafe 0 context {} indType.ctors := by
+  unfold checkConstructors
+  simp only [ReaderT.bind, Bind.bind]
+  rw [liftTypeChecker_apply]
+  have hget :
+      TypeChecker.M.run context.env context.safety context.lctx
+          context.lparams context.fuel TypeChecker.getEnv =
+        .ok context.env := by rfl
+  rw [hget]
+  simp only [Except.bind]
+  simp only [checkConstructorsLoop]
+  unfold checkConstructorList
+  simp only [ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+
+namespace ConstructorListValidationTrace
+
+def finalSeen : NameSet → List Constructor → NameSet
+  | seen, [] => seen
+  | seen, head :: tail => finalSeen (seen.insert head.name) tail
+
+/-- Exact inversion for a nonempty source list. In particular the recursive
+trace is indexed by the literal source tail and the accumulator obtained from
+the literal source head, so omission, insertion, duplication, or reordering
+cannot be hidden behind an unindexed traversal. -/
+theorem nonempty_cons_iff_exact_source :
+    Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen (head :: tail)) ↔
+      seen.contains head.name = false ∧
+      context.env.checkNoMVarNoFVar head.name head.type = .ok () ∧
+      Nonempty (CandidateCheckTypeObservation
+        context.withEmptyLocalContext head.type) ∧
+      Nonempty (ConstructorTypeValidationTrace stats isUnsafe familyIdx
+        head.name context head.type 0 context.fuel.inductiveFuel) ∧
+      Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+        context (seen.insert head.name) tail) := by
+  constructor
+  · rintro ⟨trace⟩
+    cases trace with
+    | cons _ _ _ fresh closed rootCheck typeTrace tailTrace =>
+        exact ⟨fresh, closed, ⟨rootCheck⟩, ⟨typeTrace⟩, ⟨tailTrace⟩⟩
+  · rintro ⟨fresh, closed, ⟨rootCheck⟩, ⟨typeTrace⟩, ⟨tailTrace⟩⟩
+    exact ⟨.cons seen head tail fresh closed rootCheck typeTrace tailTrace⟩
+
+/-- A duplicate at the current source position fails before all later
+constructor phases, exactly as in the executable fold. -/
+theorem not_nonempty_of_duplicate
+    (duplicate : seen.contains head.name = true) :
+    ¬ Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen (head :: tail)) := by
+  intro trace
+  have fresh := (nonempty_cons_iff_exact_source.mp trace).1
+  simp_all
+
+/-- A closedness error at the current source position excludes the trace before
+the root type check or constructor telescope is entered. -/
+theorem not_nonempty_of_closedness_error
+    (failure : context.env.checkNoMVarNoFVar head.name head.type = .error err) :
+    ¬ Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen (head :: tail)) := by
+  intro trace
+  have closed := (nonempty_cons_iff_exact_source.mp trace).2.1
+  rw [failure] at closed
+  contradiction
+
+/-- A closed-root `checkType` error excludes the trace at that exact source
+constructor, before parameter and field validation. -/
+theorem not_nonempty_of_root_error
+    (failure : TypeChecker.M.run context.env context.safety {}
+      context.lparams context.fuel (TypeChecker.checkType head.type) =
+        .error err) :
+    ¬ Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen (head :: tail)) := by
+  intro trace
+  obtain ⟨rootCheck⟩ :=
+    (nonempty_cons_iff_exact_source.mp trace).2.2.1
+  have success := rootCheck.valid
+  change TypeChecker.M.run context.withEmptyLocalContext.env
+      context.withEmptyLocalContext.safety
+      context.withEmptyLocalContext.lctx
+      context.withEmptyLocalContext.lparams
+      context.withEmptyLocalContext.fuel
+      (TypeChecker.checkType head.type) = .ok rootCheck.inferred at success
+  simp only [Context.withEmptyLocalContext] at success
+  rw [failure] at success
+  contradiction
+
+/-- An inner parameter, field, universe, positivity, recursive-target, or
+terminal-family error excludes the trace at the current constructor. -/
+theorem not_nonempty_of_type_error
+    (failure : checkConstructorType stats isUnsafe familyIdx
+      head.name head.type context = .error err) :
+    ¬ Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen (head :: tail)) := by
+  intro trace
+  obtain ⟨typeTrace⟩ :=
+    (nonempty_cons_iff_exact_source.mp trace).2.2.2.1
+  have success := typeTrace.check_run
+  rw [failure] at success
+  contradiction
+
+/-- Erasing an ordered trace replays the exact stateful constructor fold. -/
+theorem fold_run
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen ctors) :
+    checkConstructorFold context.env stats isUnsafe familyIdx seen ctors context =
+      .ok (finalSeen seen ctors) := by
+  induction trace with
+  | nil => rfl
+  | cons seen head tail fresh closed rootCheck typeTrace tailTrace ih =>
+      have hroot := rootCheck.valid
+      change TypeChecker.M.run context.withEmptyLocalContext.env
+          context.withEmptyLocalContext.safety
+          context.withEmptyLocalContext.lctx
+          context.withEmptyLocalContext.lparams
+          context.withEmptyLocalContext.fuel
+          (TypeChecker.checkType head.type) =
+        .ok rootCheck.inferred at hroot
+      simp only [Context.withEmptyLocalContext] at hroot
+      unfold checkConstructorFold
+      simp only
+      rw [fresh]
+      simp only [Bool.false_eq_true, if_false,
+        ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+        Except.bind, Except.pure]
+      rw [closed]
+      simp only [ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+        Except.bind, Except.pure, liftExcept_apply]
+      rw [withEmptyLocalContext_apply]
+      rw [liftTypeChecker_apply]
+      rw [hroot]
+      simp only [Except.bind, readThe, MonadReaderOf.read, ReaderT.read,
+        ReaderT.pure, Pure.pure, Except.pure]
+      rw [typeTrace.check_run]
+      change checkConstructorFold context.env stats isUnsafe familyIdx
+        (seen.insert head.name) tail context =
+          .ok (finalSeen (seen.insert head.name) tail)
+      exact ih
+
+/-- Any successful stateful constructor fold decomposes into the complete
+source-ordered list trace; the final accumulator value itself is irrelevant. -/
+theorem exists_of_fold_run
+    (success : checkConstructorFold context.env stats isUnsafe familyIdx
+      seen ctors context = .ok result) :
+    Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen ctors) := by
+  induction ctors generalizing seen result with
+  | nil => exact ⟨.nil seen⟩
+  | cons head tail ih =>
+      unfold checkConstructorFold at success
+      simp only at success
+      cases hfresh : seen.contains head.name with
+      | true =>
+          rw [hfresh] at success
+          change Except.error _ = Except.ok result at success
+          contradiction
+      | false =>
+          rw [hfresh] at success
+          simp only [Bool.false_eq_true, if_false,
+            ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+            Except.bind, Except.pure] at success
+          cases hclosed : context.env.checkNoMVarNoFVar
+              head.name head.type with
+          | error err => simp_all [liftExcept_apply, Except.bind]
+          | ok closedResult =>
+              cases closedResult
+              rw [hclosed] at success
+              simp only [liftExcept_apply, Except.bind] at success
+              rw [withEmptyLocalContext_apply, liftTypeChecker_apply] at success
+              cases hroot : TypeChecker.M.run context.env context.safety {}
+                  context.lparams context.fuel
+                  (TypeChecker.checkType head.type) with
+              | error err => simp_all [Except.bind]
+              | ok inferred =>
+                  rw [hroot] at success
+                  simp only [Except.bind] at success
+                  cases htype : checkConstructorType stats isUnsafe familyIdx
+                      head.name head.type context with
+                  | error err => simp_all [Except.bind]
+                  | ok typeResult =>
+                      cases typeResult
+                      rw [htype] at success
+                      simp only [Except.bind, ReaderT.pure, Pure.pure,
+                        Except.pure] at success
+                      have htypeLoop :
+                          checkConstructorType.loop stats isUnsafe familyIdx
+                              head.name head.type 0 context.fuel.inductiveFuel
+                              context = .ok () := by
+                        unfold checkConstructorType at htype
+                        simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+                          ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+                          Except.bind, Except.pure] using htype
+                      obtain ⟨typeTrace⟩ :=
+                        ConstructorTypeValidationTrace.exists_of_run htypeLoop
+                      have rootCheck : CandidateCheckTypeObservation
+                          context.withEmptyLocalContext head.type :=
+                        ⟨inferred, by
+                          simpa only [CandidateCheckTypeStep.Valid,
+                            Context.withEmptyLocalContext] using hroot⟩
+                      change checkConstructorFold context.env stats isUnsafe
+                        familyIdx (seen.insert head.name) tail context =
+                          .ok result at success
+                      obtain ⟨tailTrace⟩ := ih success
+                      exact ⟨.cons seen head tail hfresh hclosed rootCheck
+                        typeTrace tailTrace⟩
+
+/-- The transparent list decomposition succeeds on every constructor list
+accepted by the executable stateful fold. -/
+theorem buildExecution_ok_of_fold_run
+    (success : checkConstructorFold context.env stats isUnsafe familyIdx
+      seen ctors context = .ok result) :
+    ∃ trace, buildExecution stats isUnsafe familyIdx context seen ctors =
+      .ok trace := by
+  induction ctors generalizing seen result with
+  | nil => exact ⟨_, rfl⟩
+  | cons head tail ih =>
+      unfold checkConstructorFold at success
+      simp only at success
+      unfold buildExecution
+      split
+      next hfresh =>
+        rw [hfresh] at success
+        change Except.error _ = Except.ok result at success
+        contradiction
+      next hfresh =>
+        rw [hfresh] at success
+        simp only [Bool.false_eq_true, if_false,
+          ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+          Except.bind, Except.pure] at success
+        split
+        next error heq =>
+          rw [heq] at success
+          simp [liftExcept_apply, Except.bind] at success
+        next heq =>
+          rw [heq] at success
+          simp only [liftExcept_apply, Except.bind] at success
+          rw [withEmptyLocalContext_apply, liftTypeChecker_apply] at success
+          split
+          next error heq2 =>
+            rw [heq2] at success
+            simp [Except.bind] at success
+          next inferred heq2 =>
+            rw [heq2] at success
+            simp only [Except.bind] at success
+            cases htype : checkConstructorType stats isUnsafe familyIdx
+                head.name head.type context with
+            | error err => simp_all [Except.bind]
+            | ok typeResult =>
+                cases typeResult
+                rw [htype] at success
+                simp only [Except.bind, ReaderT.pure, Pure.pure,
+                  Except.pure] at success
+                have htypeLoop :
+                    checkConstructorType.loop stats isUnsafe familyIdx
+                        head.name head.type 0 context.fuel.inductiveFuel
+                        context = .ok () := by
+                  unfold checkConstructorType at htype
+                  simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+                    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+                    Except.bind, Except.pure] using htype
+                obtain ⟨typeTrace, hT⟩ :=
+                  ConstructorTypeValidationTrace.buildExecution_ok_of_run
+                    htypeLoop
+                rw [hT]
+                change checkConstructorFold context.env stats isUnsafe
+                  familyIdx (seen.insert head.name) tail context =
+                    .ok result at success
+                obtain ⟨tailTrace, htl⟩ := ih success
+                rw [htl]
+                exact ⟨_, rfl⟩
+
+/-- The stateful list fold's exact error value excludes a complete trace for
+that same source list and incoming duplicate-name accumulator. -/
+theorem not_nonempty_of_fold_error
+    (failure : checkConstructorFold context.env stats isUnsafe familyIdx
+      seen ctors context = .error err) :
+    ¬ Nonempty (ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen ctors) := by
+  rintro ⟨trace⟩
+  have success := trace.fold_run
+  rw [failure] at success
+  contradiction
+
+/-- Erasing an ordered list trace replays the transparent list validator. -/
+theorem run
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen ctors) :
+    checkConstructorList stats isUnsafe familyIdx context seen ctors = .ok () := by
+  unfold checkConstructorList
+  rw [trace.fold_run]
+  rfl
+
+end ConstructorListValidationTrace
+
+/-! ## Arbitrary mutual-block validation owners -/
+
+/-- The exact result selected when the ordinary family validator reaches its
+continuation.  Retaining the reader context matters: later constructor
+validation uses the shared parameters and local declarations installed by
+that very run. -/
+structure FamilyValidationBlockResult where
+  stats : InductiveStats
+  validationContext : Context
+
+/-- Observe the successful continuation of `checkInductiveTypes` without
+changing any validation branch or error. -/
+def observeFamilyValidationBlock (nparams : Nat)
+    (indTypes : List InductiveType) (context : Context) :
+    Except Exception FamilyValidationBlockResult :=
+  checkInductiveTypes nparams indTypes.toArray
+    (fun stats => fun validationContext =>
+      .ok ⟨stats, validationContext⟩) context
+
+/-- Complete retained family-validation run for an arbitrary source-ordered
+block.
+
+`run` is the real validator execution, so every later family has already
+passed the kernel's definitional parameter comparison and result-level
+equivalence phase.  The remaining equations expose the terminal invariants
+which Lean asserts before invoking the continuation. -/
+structure FamilyValidationBlockRun (nparams : Nat)
+    (indTypes : List InductiveType) (context : Context) where
+  result : FamilyValidationBlockResult
+  run : observeFamilyValidationBlock nparams indTypes context = .ok result
+  params_size : result.stats.params.size = nparams
+  nindices_size : result.stats.nindices.size = indTypes.length
+  indConsts_size : result.stats.indConsts.size = indTypes.length
+
+namespace FamilyValidationBlockRun
+
+/-- Execute and retain the ordinary family validator.  The explicit terminal
+checks mirror its internal assertions and make malformed instrumentation fail
+instead of yielding a weaker certificate. -/
+def buildExecution (nparams : Nat) (indTypes : List InductiveType)
+    (context : Context) :
+    Except Exception (FamilyValidationBlockRun nparams indTypes context) :=
+  match hrun : observeFamilyValidationBlock nparams indTypes context with
+  | .error error => .error error
+  | .ok result =>
+    if hparams : result.stats.params.size = nparams then
+      if hnindices : result.stats.nindices.size = indTypes.length then
+        if hconsts : result.stats.indConsts.size = indTypes.length then
+          .ok {
+            result
+            run := hrun
+            params_size := hparams
+            nindices_size := hnindices
+            indConsts_size := hconsts }
+        else .error (.other "family-validation constant-count invariant failed")
+      else .error (.other "family-validation index-count invariant failed")
+    else .error (.other "family-validation parameter-count invariant failed")
+
+/-- Shared parameters selected by the first family and definitionally checked
+against every later family. -/
+def parameters (run : FamilyValidationBlockRun nparams indTypes context) :
+    Array Expr :=
+  run.result.stats.params
+
+/-- Common result universe selected by the first family and equivalence-
+checked against every later family. -/
+def resultLevel (run : FamilyValidationBlockRun nparams indTypes context) :
+    Level :=
+  run.result.stats.resultLevel
+
+end FamilyValidationBlockRun
+
+/-- Source-indexed constructor traces for every family in a block.  The
+natural index advances with the source list, so a trace for one family cannot
+be reused at another family ordinal. -/
+inductive ConstructorBlockValidationTraces
+    (stats : InductiveStats) (isUnsafe : Bool) (context : Context) :
+    Nat → List InductiveType → Type where
+  | nil {familyIdx : Nat} :
+      ConstructorBlockValidationTraces stats isUnsafe context familyIdx []
+  | cons {familyIdx : Nat} {type : InductiveType}
+      {types : List InductiveType}
+      (head : ConstructorListValidationTrace stats isUnsafe familyIdx
+        context {} type.ctors)
+      (tail : ConstructorBlockValidationTraces stats isUnsafe context
+        (familyIdx + 1) types) :
+      ConstructorBlockValidationTraces stats isUnsafe context familyIdx
+        (type :: types)
+
+namespace ConstructorBlockValidationTraces
+
+/-- Family-, constructor-, and field-ordered recursive-target matrix selected
+by the executable arbitrary-block validator. -/
+def targets :
+    ConstructorBlockValidationTraces stats isUnsafe context familyIdx types →
+      List (List (List (Option ConstructorPositivityTrace.Target)))
+  | .nil => []
+  | .cons head tail => head.targets :: tail.targets
+
+/-- Execute each source-indexed list trace in the one shared post-family
+context. -/
+def buildExecution (stats : InductiveStats) (isUnsafe : Bool)
+    (context : Context) :
+    (familyIdx : Nat) → (types : List InductiveType) →
+      Except Exception
+        (ConstructorBlockValidationTraces stats isUnsafe context
+          familyIdx types)
+  | _, [] => .ok .nil
+  | familyIdx, type :: types =>
+    match ConstructorListValidationTrace.buildExecution stats isUnsafe
+        familyIdx context {} type.ctors with
+    | .error error => .error error
+    | .ok head =>
+      match buildExecution stats isUnsafe context (familyIdx + 1) types with
+      | .error error => .error error
+      | .ok tail => .ok (.cons head tail)
+
+end ConstructorBlockValidationTraces
+
+/-- Complete operational constructor-validation owner for an arbitrary
+mutual block.  `run` is the actual block call; `traces` retains every
+family/constructor/field branch, including cross-family target ordinals and
+recursive-Pi paths. -/
+structure ConstructorBlockValidationRun
+    (indTypes : List InductiveType) (stats : InductiveStats)
+    (isUnsafe : Bool) (context : Context) where
+  traces : ConstructorBlockValidationTraces stats isUnsafe context 0 indTypes
+  run : checkConstructors indTypes.toArray stats isUnsafe context = .ok ()
+
+namespace ConstructorBlockValidationRun
+
+/-- Execute the real block validator and retain the exact dependent trace
+hierarchy for that same source list. -/
+def buildExecution (indTypes : List InductiveType)
+    (stats : InductiveStats) (isUnsafe : Bool) (context : Context) :
+    Except Exception
+      (ConstructorBlockValidationRun indTypes stats isUnsafe context) :=
+  match hrun : checkConstructors indTypes.toArray stats isUnsafe context with
+  | .error error => .error error
+  | .ok () =>
+    match ConstructorBlockValidationTraces.buildExecution stats isUnsafe
+        context 0 indTypes with
+    | .error error => .error error
+    | .ok traces => .ok ⟨traces, hrun⟩
+
+end ConstructorBlockValidationRun
+
+/-- The complete retained operational constructor-validation run for one
+singleton family. -/
+structure ConstructorValidationRun
+    (indType : InductiveType) (stats : InductiveStats)
+    (isUnsafe : Bool) (context : Context) where
+  trace : ConstructorListValidationTrace stats isUnsafe 0 context {}
+    indType.ctors
+
+namespace ConstructorValidationRun
+
+/-- Transparent decomposition of the ordinary singleton constructor
+validator.  Successful output is executable data rather than a
+`Classical.choice`, which lets subsequent D2/D3 audits compute over the exact
+retained branch structure. -/
+def buildExecution (indType : InductiveType) (stats : InductiveStats)
+    (isUnsafe : Bool) (context : Context) :
+    Except Exception
+      (ConstructorValidationRun indType stats isUnsafe context) :=
+  match ConstructorListValidationTrace.buildExecution stats isUnsafe 0
+      context {} indType.ctors with
+  | .error error => .error error
+  | .ok trace => .ok ⟨trace⟩
+
+/-- The transparent singleton decomposition succeeds on every source family
+accepted by the real constructor validator. -/
+theorem buildExecution_ok_of_run
+    (success : checkConstructors #[indType] stats isUnsafe context = .ok ()) :
+    ∃ validation, buildExecution indType stats isUnsafe context =
+      .ok validation := by
+  rw [checkConstructors_singleton_eq_checkConstructorList] at success
+  unfold checkConstructorList at success
+  cases hfold : checkConstructorFold context.env stats isUnsafe 0 {}
+      indType.ctors context with
+  | error err => simp_all [Functor.map, Except.map]
+  | ok result =>
+      obtain ⟨trace, htrace⟩ :=
+        ConstructorListValidationTrace.buildExecution_ok_of_fold_run hfold
+      unfold buildExecution
+      rw [htrace]
+      exact ⟨_, rfl⟩
+
+/-- Recomposition: retained operational evidence replays the real singleton
+`checkConstructors` execution exactly. -/
+theorem run
+    (validation : ConstructorValidationRun indType stats isUnsafe context) :
+    checkConstructors #[indType] stats isUnsafe context = .ok () := by
+  rw [checkConstructors_singleton_eq_checkConstructorList]
+  exact validation.trace.run
+
+/-- Decomposition: every successful real singleton `checkConstructors` run
+has complete retained operational evidence. -/
+theorem nonempty_of_run
+    (success : checkConstructors #[indType] stats isUnsafe context = .ok ()) :
+    Nonempty (ConstructorValidationRun indType stats isUnsafe context) := by
+  rw [checkConstructors_singleton_eq_checkConstructorList] at success
+  unfold checkConstructorList at success
+  cases hfold : checkConstructorFold context.env stats isUnsafe 0 {}
+      indType.ctors context with
+  | error err =>
+      simp_all [Functor.map, Except.map]
+  | ok result =>
+      obtain ⟨trace⟩ :=
+        ConstructorListValidationTrace.exists_of_fold_run hfold
+      exact ⟨⟨trace⟩⟩
+
+/-- Choose the operational shape supplied by a successful run by replaying
+the transparent decomposition.  The success premise only discharges the
+impossible error branch, so the retained evidence is computed by
+`buildExecution` rather than selected through `Classical.choice`. -/
+def of_run
+    (success : checkConstructors #[indType] stats isUnsafe context = .ok ()) :
+    ConstructorValidationRun indType stats isUnsafe context :=
+  match h : buildExecution indType stats isUnsafe context with
+  | .ok validation => validation
+  | .error _ => absurd (buildExecution_ok_of_run success) (by simp [h])
+
+/-- Exact decomposition/recomposition contract for singleton constructor
+validation. -/
+theorem nonempty_iff_checkConstructors_ok :
+    Nonempty (ConstructorValidationRun indType stats isUnsafe context) ↔
+      checkConstructors #[indType] stats isUnsafe context = .ok () := by
+  constructor
+  · rintro ⟨validation⟩
+    exact validation.run
+  · exact nonempty_of_run
+
+/-- Any phase-specific executable error excludes a successful retained run. -/
+theorem not_nonempty_of_error
+    (failure : checkConstructors #[indType] stats isUnsafe context = .error err) :
+    ¬ Nonempty (ConstructorValidationRun indType stats isUnsafe context) := by
+  intro validation
+  have success := nonempty_iff_checkConstructors_ok.mp validation
+  rw [failure] at success
+  contradiction
+
+end ConstructorValidationRun
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.FamilyValidationBlockRun.buildExecution [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorBlockValidationRun.buildExecution [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorListValidationTrace.nonempty_cons_iff_exact_source [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorValidationRun.run [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorValidationRun.nonempty_of_run [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorValidationRun.of_run [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorValidationRun.nonempty_iff_checkConstructors_ok [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorValidationRun.not_nonempty_of_error [propext, Classical.choice, Quot.sound]
+
+end AddInductive
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Reference/Instantiate.lean b/Ix/Theory/Named/Reference/Instantiate.lean
new file mode 100644
index 000000000..6319abab3
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Instantiate.lean
@@ -0,0 +1,39 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Expr
+import Lean.LocalContext
+import Lean.Util.InstantiateLevelParams
+
+namespace Lean
+namespace Expr
+
+/-- Beta-reduces an application `(fun x₁ ... xₙ => b) a₁ ... aₙ aₙ₊₁ ... aₘ` in the two cases where
+no substitution is needed: to `b aₙ₊₁ ... aₘ` when `b` has no loose bound variables, and to
+`aᵢ aₙ₊₁ ... aₘ` when `b` is the bound variable `xᵢ`. In any other case `e` is returned unchanged —
+this is what makes it cheap. -/
+def cheapBetaReduce (e : Expr) : Expr := Id.run do
+  if !e.isApp then return e
+  let fn := e.getAppFn
+  if !fn.isLambda then return e
+  let args := e.getAppArgs
+  let rec cont i fn :=
+    if !fn.hasLooseBVars then
+      mkAppRange fn i args.size args
+    else if let .bvar n := fn then
+      assert! n < i
+      mkAppRange args[i - n - 1]! i args.size args
+    else
+      e
+  let rec loop i fn :=
+    if i < args.size then
+      match fn with
+      | .lam _ _ body .. => loop (i + 1) body
+      | _ => cont i fn
+    else cont i fn
+  return loop 0 fn
+
+end Expr
diff --git a/Ix/Theory/Named/Reference/Level.lean b/Ix/Theory/Named/Reference/Level.lean
new file mode 100644
index 000000000..b774b0555
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Level.lean
@@ -0,0 +1,412 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean
+import Ix.Theory.Named.Reference.List
+
+namespace Lean.Level
+
+def forEach [Monad m] (l : Level) (f : Level → m Bool) : m Unit := do
+  if !(← f l) then return
+  match l with
+  | .succ l => l.forEach f
+  | .max l₁ l₂ | .imax l₁ l₂ => l₁.forEach f; l₂.forEach f
+  | .zero | .param .. | .mvar .. => pure ()
+
+/-- Returns `some n` if level parameter `n` appears in `l` and `n ∉ ps`. -/
+def getUndefParam (l : Level) (ps : List Name) : Option Name := Id.run do
+  (·.2) <$> StateT.run (s := none) do
+    l.forEach fun l => do
+      if !l.hasParam || (← get).isSome then
+        return false
+      if let .param n := l then
+        if n ∉ ps then
+          set (some n)
+      return true
+
+/-!
+## Level normalization
+
+Based on Yoan Géran, "A Canonical Form for Universe Levels in Impredicative Type Theory"
+<https://lmf.cnrs.fr/downloads/Perso/long.pdf>.
+-/
+
+namespace Normalize
+
+local instance namedOrdName : Ord Name := ⟨Name.cmp⟩
+
+/-- represents v+n -/
+structure VarNode where
+  var : Name
+  offset : Nat
+  deriving BEq, Ord, Repr
+
+/-- A key-value pair `vs => { const, var }` in NormLevel represents
+the max of `C(vs, const)` and `V(vs, v, n)` for each `v+n ∈ var`, using the `C` and `V` sublevel
+functions from <https://lmf.cnrs.fr/downloads/Perso/long.pdf>. -/
+structure Node where
+  const : Nat := 0
+  var : List VarNode := []
+  deriving Repr, Inhabited
+
+instance : BEq Node where
+  beq n₁ n₂ := n₁.const == n₂.const && n₁.var == n₂.var
+instance : Ord Node where
+  compare n₁ n₂ := compare n₁.const n₂.const |>.then <| compare n₁.var n₂.var
+
+def Node.isEmpty (n : Node) : Bool := n.const == 0 && n.var.isEmpty
+
+def subset (cmp : α → α → Ordering) : List α → List α → Bool
+  | [], _ => true
+  | _, [] => false
+  | x :: xs, y :: ys =>
+    match cmp x y with
+    | .lt => false
+    | .eq => subset cmp xs ys
+    | .gt => subset cmp (x :: xs) ys
+
+def orderedInsert (cmp : α → α → Ordering) (a : α) : List α → Option (List α)
+  | [] => some [a]
+  | b :: l =>
+    match cmp a b with
+    | .lt => some (a :: b :: l)
+    | .eq => none
+    | .gt => (orderedInsert cmp a l).map (b :: ·)
+
+@[reducible] def NormLevel := Std.TreeMap (List Name) Node compare
+  deriving Repr
+
+instance : BEq NormLevel where
+  beq l₁ l₂ :=
+    (l₁.all fun p n => l₂.get? p == some n) &&
+    (l₂.all fun p n => l₁.get? p == some n)
+
+def VarNode.addVar (v : Name) (k : Nat) : List VarNode → List VarNode
+  | [] => [⟨v, k⟩]
+  | v' :: l =>
+    match Name.cmp v v'.var with
+    | .lt => ⟨v, k⟩ :: v' :: l
+    | .eq => ⟨v, v'.offset.max k⟩ :: l
+    | .gt => v' :: addVar v k l
+
+def NormLevel.addVar (v : Name) (k : Nat) (path' : List Name) (s : NormLevel) : NormLevel :=
+  s.modify path' fun n => { n with var := VarNode.addVar v k n.var }
+
+def NormLevel.addNode (v : Name) (k : Nat) (path' : List Name) (s : NormLevel) : NormLevel :=
+  s.alter path' fun
+    | none => some { var := [⟨v, k⟩] }
+    | some n => some { n with var := VarNode.addVar v k n.var }
+
+def NormLevel.addConst (k : Nat) (path : List Name) (acc : NormLevel) : NormLevel :=
+  if k = 0 || k = 1 && !path.isEmpty then acc else
+  acc.alter path fun
+    | none => some { const := k }
+    | some n => some { n with const := k.max n.const }
+
+def normalizeAux (l : Level) (path : List Name) (k : Nat) (acc : NormLevel) : NormLevel :=
+  match l with
+  | .zero | .imax _ .zero => acc.addConst k path
+  | .succ u => normalizeAux u path (k+1) acc
+  | .max u v => normalizeAux u path k acc |> normalizeAux v path k
+  | .imax u (.succ v) => normalizeAux u path k acc |> normalizeAux v path (k+1)
+  | .imax u (.max v w) => normalizeAux (.imax u v) path k acc |> normalizeAux (.imax u w) path k
+  | .imax u (.imax v w) => normalizeAux (.imax u w) path k acc |> normalizeAux (.imax v w) path k
+  | .imax u (.param v) =>
+    match orderedInsert Name.cmp v path with
+    | some path' => acc.addConst k path |>.addNode v k path' |> normalizeAux u path' k
+    | none =>
+      let acc := if k = 0 then acc else acc.addVar v k path
+      normalizeAux u path k acc
+  | .mvar _ | .imax _ (.mvar _) => acc -- unreachable
+  | .param v =>
+    match orderedInsert Name.cmp v path with
+    | some path' => acc.addConst k path |>.addNode v k path'
+    | none => if k = 0 then acc else acc.addVar v k path
+
+def subsumeVars : List VarNode → List VarNode → List VarNode
+  | [], _ => []
+  | xs, [] => xs
+  | x :: xs, y :: ys =>
+    match Name.cmp x.var y.var with
+    | .lt => x :: subsumeVars xs (y :: ys)
+    | .eq => if x.offset ≤ y.offset then subsumeVars xs ys else x :: subsumeVars xs ys
+    | .gt => subsumeVars (x :: xs) ys
+
+/-- Remove from `n₁` the sublevels dominated by `n₂`, whose condition set is a subset of
+`n₁`'s: `C(c)` is dominated by `C(c')` when `c ≤ c'` and by `V(x+k)` when `c ≤ k + 1`, and
+`V(x+k)` is dominated by `V(x+k')` when `k ≤ k'`.
+
+`same` says the two sit at the *same* condition set, where a variable may still discharge the
+constant but the variables must not discharge themselves. -/
+def Node.subsumeBy (same : Bool) (n₁ n₂ : Node) : Node :=
+  let n₁ :=
+    if n₁.const = 0 ||
+      (same || n₁.const > n₂.const) &&
+      (n₂.var.isEmpty || n₁.const > n₂.var.foldl (·.max ·.offset) 0 + 1)
+    then n₁ else { n₁ with const := 0 }
+  if same || n₂.var.isEmpty then n₁ else { n₁ with var := subsumeVars n₁.var n₂.var }
+
+/-- Remove the parts of the sublevels at `(p₁, n₁)` that are dominated by the sublevels
+at `(p₂, n₂)`. -/
+def Node.subsume (p₁ : List Name) (n₁ : Node) (p₂ : List Name) (n₂ : Node) : Node :=
+  if subset compare p₂ p₁ then n₁.subsumeBy (p₁.length == p₂.length) n₂ else n₁
+
+/-- Remove the parts of the sublevels at `(p₁, n₁)` dominated by other entries of the map. -/
+def NormLevel.minimize (acc : NormLevel) (p₁ : List Name) (n₁ : Node) : Node :=
+  acc.foldl (init := n₁) (Node.subsume p₁)
+
+def NormLevel.subsumption (acc : NormLevel) : NormLevel :=
+  acc.foldl (init := acc) fun acc p₁ n₁ =>
+    let n := acc.minimize p₁ n₁
+    if n.isEmpty then acc.erase p₁ else acc.insert p₁ n
+
+def normalize (l : Level) : NormLevel :=
+  Normalize.normalizeAux l [] 0 {} |>.subsumption
+
+/-- Sublevel comparison, following Theorem 39 of the paper: `l₁ ≤ l₂` iff every sublevel
+of `l₁` is dominated by some sublevel of `l₂`, where
+`C(E, L) ≤ C(F, K) ↔ F ⊆ E ∧ L ≤ K`, `C(E, L) ≤ V(F, x, K) ↔ F ⊆ E ∧ L ≤ K + 1`,
+and `V(E, x, L) ≤ V(F, y, K) ↔ F ⊆ E ∧ x = y ∧ L ≤ K`.
+
+Each sublevel picks its own dominator, and a node bundles several of them, so it is not
+enough to look for a single entry of `l₂` dominating a whole node of `l₁`: for
+`imax 2 v ≤ max 2 v` the constant is dominated at `∅` and the variable at `{v}`. Instead
+each entry of `l₂` discharges what it can from the sublevels of `n₁` that are still
+outstanding, which is the same `subsumeBy` step minimization uses; the node is dominated
+once nothing is left, and the fold stops there. -/
+def NormLevel.le (l₁ l₂ : NormLevel) : Bool :=
+  l₁.all fun p₁ n₁ =>
+    -- `none` means nothing is left to discharge, which stops the fold
+    Option.isNone <| l₂.foldlM (init := n₁) (m := Option) fun n p₂ n₂ =>
+      if subset compare p₂ p₁ then
+        let n := n.subsumeBy false n₂
+        if n.isEmpty then none else some n
+      else some n
+
+/-!
+Reconstruction of a `Level` from a `NormLevel`.
+
+The paper's canonical form is a set of sublevels `C(S, k)`, `V(S, v+k)`; it does not address
+which such sets are expressible as level expressions. Reifying a sublevel with conditions `S`
+requires nesting it under an imax chain `imax (… imax (imax (_) v₁) …) vₙ` where
+`{v₁, …, vₙ} = S`, and each edge of such a chain itself contributes the sublevel
+`V(S', vᵢ, 0)` where `S'` is the set of conditions up to that point. So a chain order is
+admissible only if each such edge contribution is dominated by the canonical form, i.e.
+there is some `V(T, vᵢ+k)` with `T ⊆ S'` among the sublevels. Canonical forms produced by
+`normalizeAux` always admit at least one such order for every key
+(each key is the condition set of some `imax` chain suffix of the input, whose edges put
+the required `V` entries at subsets of the key, and subsumption only moves coverage to
+smaller sets).
+
+To make the output canonical, the choice of chain must depend only on the canonical
+sublevels, not on incidental map keys (which record which `imax` chains appeared
+syntactically in the input). For each key we take the lexicographically least admissible
+chain, computed greedily. This is well-defined: domination of `V(S', v, 0)` is monotone
+in `S'`, so extending the set of conditions added so far never invalidates other elements,
+and a greedy choice never needs to be revisited (checking that the remainder stays
+completable before committing to each element). -/
+
+/-- Is the edge contribution `V(acc ∪ {a}, a, 0)` dominated by the normal form?
+True iff some `V(T, a+k)` with `T ⊆ acc ∪ {a}` is present. -/
+def NormLevel.addable (s : NormLevel) (a : Name) (acc : List Name) : Bool :=
+  s.any fun p n => n.var.any (·.var == a) && subset compare (p.erase a) acc
+
+/-- Can the elements of `rem` be added to the condition set `acc` one at a time, each
+addition being `addable` at that point? Since `addable` is monotone in `acc`, adding any
+addable element preserves completability, so a greedy check is complete. -/
+def NormLevel.feasible (s : NormLevel) (acc rem : List Name) : Bool :=
+  go rem.length acc rem
+where
+  go : Nat → List Name → List Name → Bool
+  | 0, _, rem => rem.isEmpty
+  | fuel+1, acc, rem =>
+    match rem.find? (s.addable · acc) with
+    | none => rem.isEmpty
+    | some a => go fuel ((orderedInsert Name.cmp a acc).getD acc) (rem.erase a)
+
+/-- The lexicographically least admissible imax chain building the condition set `p`,
+listed innermost (last-added) first: at each step, remove the least element that is
+`addable` on top of the rest and whose remainder is still completable.
+This depends only on the sublevels of `s`, not on its key set, so equal normal forms
+reify to equal levels. (The fallback returns the remaining set in sorted order;
+it is not reachable for normal forms produced by `normalizeAux`.) -/
+def NormLevel.lexChain (s : NormLevel) : Nat → List Name → List Name
+  | 0, p => p
+  | fuel+1, p =>
+    match p.find? fun a => s.addable a (p.erase a) && s.feasible [] (p.erase a) with
+    | some a => a :: s.lexChain fuel (p.erase a)
+    | none => p
+
+structure Tree where
+  const : Nat
+  var : List VarNode
+  child : List (Name × Tree)
+  deriving Inhabited
+
+def modifyAt [Inhabited α] (f : α → α) (n : Name) : List (Name × α) → List (Name × α)
+  | [] => [(n, f default)]
+  | (x, v) :: l =>
+    match Name.cmp n x with
+    | .lt => (n, f default) :: (x, v) :: l
+    | .eq => (x, f v) :: l
+    | .gt => (x, v) :: modifyAt f n l
+
+def Tree.modify (path : List Name) (f : Tree → Tree) (t : Tree) : Tree :=
+  match path with
+  | [] => f t
+  | a :: p => modify p (t := t) fun t => { t with child := modifyAt f a t.child }
+
+def NormLevel.toTree (acc : NormLevel) : Tree :=
+  acc.foldl (init := ⟨0, [], []⟩) fun t p n =>
+    let path := acc.lexChain p.length p
+    -- the edge into this tree node already contributes `V(p, v, 0)` for the innermost
+    -- chain element `v`, so an explicit `v+0` entry would be redundant
+    let var := if let v :: _ := path then subsumeVars n.var [⟨v, 0⟩] else n.var
+    t.modify path fun t => { t with const := n.const, var }
+
+/-- If the subtree behind an edge labelled `a` holds nothing but the sublevel `V(_, a, k)`,
+return `k`.
+
+Such an edge contributes `imax (a+k) a`, which differs from the plain `a+k` only at `a = 0`,
+where the plain form gives `k` instead of `0`. So the guard may be dropped, and the child
+written as just `a+k`, whenever the node's constant is at least `k` — and if the constant is
+*exactly* `k`, it may then be dropped itself, since `a+k ≥ k`. Without this, `u+1` would reify
+to `max 1 (imax (u+1) u)` rather than to itself, and the canonical form would be roughly twice
+the size of the input on typical levels. -/
+def Tree.plainOffset? (a : Name) : Tree → Option Nat
+  | ⟨0, [], []⟩ => some 0
+  | ⟨0, [v], []⟩ => if v.var == a then some v.offset else none
+  | _ => none
+
+def Tree.reify : Tree → Level
+  | { const, var, child } =>
+    let l := child.foldr (mkChild const) none
+    let l := var.foldr (init := l) fun n r =>
+      some (mkMax (addOffset (.param n.var) n.offset) r)
+    match l with
+    | none => ofNat const
+    | some l =>
+      if const == 0 || child.any fun c => plainOffset? c.1 c.2 == some const then l
+      else max (ofNat const) l
+where
+  mkMax (l : Level) : Option Level → Level
+  | none => l
+  | some u => max l u
+  mkChild (const : Nat)
+  | (n, t), r =>
+    match plainOffset? n t with
+    | some k =>
+      if k ≤ const then mkMax (addOffset (.param n) k) r
+      else mkMax (imax (reify t) (.param n)) r
+    | none => mkMax (imax (reify t) (.param n)) r
+
+/-!
+### Fast path for levels without an essential `imax`
+
+Levels arising in practice are almost always built from `zero`, `succ`, `max` and `param`
+alone: `mkLevelIMax'` already discharges `imax _ 0`, `imax _ (_+1)`, `imax a a` and
+`imax ≤1 _` where the kernel builds levels, and in a census of the 522k level comparisons
+performed while checking Lean+Std+Batteries, 99.8% of the levels reaching them were
+`imax`-free.
+
+Such a level's canonical form is flat: its sublevels are `C(∅, K)` and one `V({x}, x, kₓ)`
+per parameter, nothing is ever subsumed (a condition set is `∅` or a singleton, and the `C`
+node carries no variables), and each `imax` chain is a single edge. So the whole `NormLevel`
+can be replaced by a sorted merge, and the tree read off directly. Note that every parameter
+occurrence contributes its offset to the constant as well, so `K` dominates every `kₓ` and
+the reified children never need their `imax` guard.
+-/
+
+/-- The map a run of flat data stands for: the constant at the root (absent when zero) and
+`V({x}, x, k)` at each singleton key. Note this inserts the keys in sorted order, whereas
+`normalizeAux` inserts them in traversal order, so the two build the same entries in
+differently balanced trees — everything downstream compares maps entry by entry. -/
+def toNormLevel (c : Nat) (vs : List VarNode) : NormLevel :=
+  vs.foldl (fun s v => s.insert [v.var] ⟨0, [v]⟩)
+    (if c = 0 then {} else (∅ : NormLevel).insert [] ⟨c, []⟩)
+
+/-- Collect the largest constant and the largest offset of each parameter, throwing the
+`NormLevel` built from what has been collected so far on reaching an `imax`, so that
+`normalizeAux` picks up from there rather than retraversing. -/
+def flatAux : Level → Nat → Nat × List VarNode → Except NormLevel (Nat × List VarNode)
+  | .zero, k, (c, vs) => .ok (Nat.max c k, vs)
+  | .succ l, k, acc => flatAux l (k+1) acc
+  | .max a b, k, acc =>
+    match flatAux a k acc with
+    | .ok acc => flatAux b k acc
+    | .error s => .error (normalizeAux b [] k s)
+  | .param x, k, (c, vs) => .ok (Nat.max c k, VarNode.addVar x k vs)
+  | .mvar _, _, acc => .ok acc
+  | l@(.imax ..), k, (c, vs) => .error (normalizeAux l [] k (toNormLevel c vs))
+
+/-- The tree `toTree` builds for a flat level: the constant at the root, and one child per
+parameter holding `V({x}, x, kₓ)` — dropped when `kₓ = 0`, as the edge already provides it. -/
+def flatTree (c : Nat) (vs : List VarNode) : Tree :=
+  ⟨c, [], vs.map fun v => (v.var, ⟨0, if v.offset == 0 then [] else [v], []⟩)⟩
+
+end Normalize
+
+def normalize' (l : Level) : Level :=
+  match Normalize.flatAux l 0 (0, []) with
+  | .ok (c, vs) => (Normalize.flatTree c vs).reify
+  | .error s => s.subsumption.toTree.reify
+
+/-- A transparent structural equality test for levels.  Unlike `Level.beq`,
+this test has no opaque runtime contract, so its successful branch can be used
+directly by the verified checker. -/
+def isStructEq : Level → Level → Bool
+  | .zero, .zero => true
+  | .succ u, .succ v => isStructEq u v
+  | .max u₁ u₂, .max v₁ v₂
+  | .imax u₁ u₂, .imax v₁ v₂ => isStructEq u₁ v₁ && isStructEq u₂ v₂
+  | .param u, .param v => u == v
+  | .mvar ⟨u⟩, .mvar ⟨v⟩ => u == v
+  | _, _ => false
+
+/-- Core's `isEquiv` is sound but incomplete, so it can be used as a fast path: when it
+accepts, the levels really are equivalent, and when it rejects we fall back to the complete
+check. Over the 261k level comparisons performed while checking Lean+Std+Batteries this
+filter decided every single real equivalence, leaving only the genuinely inequivalent 0.1%
+to the fallback — and it is roughly 20× cheaper than normalizing. -/
+def isEquiv' (u v : Level) : Bool :=
+  isEquiv u v || Normalize.normalize u == Normalize.normalize v
+
+def isEquivList : List Level → List Level → Bool := List.all2 isEquiv'
+
+/-- Core's `geq` as a fast path, on the same grounds as `isEquiv'`. -/
+def geq' (u v : Level) : Bool :=
+  geq u v || (Normalize.normalize v).le (Normalize.normalize u)
+
+-- local elab "normalize " l:level : command => do
+--   Elab.Command.runTermElabM fun _ => do
+--     logInfo m!"{normalize' (← Elab.Term.elabLevel l)}"
+--     -- logInfo m!"{repr <| Normalize.normalize (← Elab.Term.elabLevel l) }"
+
+-- local elab "normalize " l:level " ≤ " l':level : command => do
+--   Elab.Command.runTermElabM fun _ => do
+--     logInfo m!"{geq' (← Elab.Term.elabLevel l') (← Elab.Term.elabLevel l)}"
+--     -- logInfo m!"{repr <| Normalize.normalize (← Elab.Term.elabLevel l)}"
+--     -- logInfo m!"{repr <| Normalize.normalize (← Elab.Term.elabLevel l')}"
+
+-- universe u v w
+-- /-- info: max 1 u -/
+-- #guard_msgs (whitespace := lax) in normalize max u 1
+-- /-- info: u -/
+-- #guard_msgs (whitespace := lax) in normalize imax 1 u
+-- /-- info: max 1 (imax (u + 1) u) -/
+-- #guard_msgs (whitespace := lax) in normalize u+1
+-- /-- info: imax 2 u -/
+-- #guard_msgs (whitespace := lax) in normalize imax 2 u
+-- /-- info: max v (imax (imax u v) w) -/
+-- #guard_msgs (whitespace := lax) in normalize max w (imax (imax u w) v)
+-- /-- info: max v (imax (imax u v) w) -/
+-- #guard_msgs (whitespace := lax) in normalize max (imax (imax u v) w) (imax (imax u w) v)
+-- /-- info: u -/
+-- #guard_msgs (whitespace := lax) in normalize imax u u
+-- /-- info: max 1 (imax (u + 1) u) -/
+-- #guard_msgs (whitespace := lax) in normalize imax u (u+1)
+-- /-- info: max 1 (imax (max (v + 1) (imax (u + 1) u)) v) -/
+-- #guard_msgs (whitespace := lax) in normalize imax u v + 1
diff --git a/Ix/Theory/Named/Reference/List.lean b/Ix/Theory/Named/Reference/List.lean
new file mode 100644
index 000000000..42447a15f
--- /dev/null
+++ b/Ix/Theory/Named/Reference/List.lean
@@ -0,0 +1,11 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+
+@[specialize] def List.all2 (R : α → α → Bool) : List α → List α → Bool
+  | a1 :: as1, a2 :: as2 => R a1 a2 && all2 R as1 as2
+  | [], [] => true
+  | _, _ => false
diff --git a/Ix/Theory/Named/Reference/LocalContext.lean b/Ix/Theory/Named/Reference/LocalContext.lean
new file mode 100644
index 000000000..7417de5e6
--- /dev/null
+++ b/Ix/Theory/Named/Reference/LocalContext.lean
@@ -0,0 +1,27 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.LocalContext
+
+namespace Ix.Theory.Named
+open Lean
+
+class MonadLocalNameGenerator (m : Type u → Type v) where
+  withFreshId : (Name → m α) → m α
+export MonadLocalNameGenerator (withFreshId)
+
+instance [MonadLocalNameGenerator m] : MonadLocalNameGenerator (ReaderT ρ m) where
+  withFreshId f c := withFreshId (f · c)
+
+@[inline] def withLocalDecl [Monad m] [MonadLocalNameGenerator m] [MonadWithReaderOf LocalContext m]
+    (name : Name) (bi : BinderInfo) (ty : Expr) (k : Expr → m α) : m α :=
+  withFreshId fun id => do
+  withReader (·.mkLocalDecl ⟨id⟩ name ty bi) <| k <| .fvar ⟨id⟩
+
+@[inline] def withLetDecl [Monad m] [MonadLocalNameGenerator m] [MonadWithReaderOf LocalContext m]
+    (name : Name) (ty val : Expr) (k : Expr → m α) : m α :=
+  withFreshId fun id => do
+  withReader (·.mkLetDecl ⟨id⟩ name ty val) <| k <| .fvar ⟨id⟩
diff --git a/Ix/Theory/Named/Reference/Primitive.lean b/Ix/Theory/Named/Reference/Primitive.lean
new file mode 100644
index 000000000..bfed975dd
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Primitive.lean
@@ -0,0 +1,498 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Reference.TypeChecker
+import Ix.Theory.Named.Reference.Environment.Basic
+
+namespace Ix.Theory.Named
+namespace Environment
+open Lean hiding Environment Exception
+open Kernel TypeChecker
+
+deriving instance ToExpr for LevelMVarId
+deriving instance ToExpr for Level
+deriving instance ToExpr for MVarId
+deriving instance ToExpr for BinderInfo
+deriving instance ToExpr for String.Pos.Raw
+deriving instance ToExpr for Substring.Raw
+deriving instance ToExpr for SourceInfo
+deriving instance ToExpr for Syntax
+deriving instance ToExpr for DataValue
+deriving instance ToExpr for KVMap
+deriving instance ToExpr for Expr
+
+elab (name := microQq) "q(" e:term ")" : term =>
+  return toExpr (← instantiateMVars (← Elab.Term.elabTerm e none))
+
+structure Reflection where
+  type : Expr
+  ofTrue : Expr
+  ofFalse : Expr
+  toDec : Expr
+
+def Reflection.defn₁ : Reflection where
+  type := q(fun p b => ∀ {q : Prop}, ((b = true → p) → (¬b = true → ¬p) → q) → q)
+  ofTrue := q(fun p (H : ∀ {q : Prop}, ((true = true → p) → (¬true = true → ¬p) → q) → q) =>
+    H fun h _ => h rfl)
+  ofFalse := q(fun p (H : ∀ {q : Prop}, ((false = true → p) → (¬false = true → ¬p) → q) → q) =>
+    H fun _ h => h Bool.noConfusion)
+  toDec := q(fun p b (H : ∀ {q : Prop}, ((b = true → p) → (¬b = true → ¬p) → q) → q) =>
+    if h : b = true then isTrue (H fun h' _ => h' h) else isFalse (H fun _ h' => h' h))
+
+def Reflection.defn₂ : Reflection where
+  type := q(fun p b => ∀ {q : Prop}, ((b = true → p) → (b = false → ¬p) → q) → q)
+  ofTrue := q(fun p (H : ∀ {q : Prop}, ((true = true → p) → (true = false → ¬p) → q) → q) =>
+    H fun h _ => h rfl)
+  ofFalse := q(fun p (H : ∀ {q : Prop}, ((false = true → p) → (false = false → ¬p) → q) → q) =>
+    H fun _ h => h rfl)
+  toDec := q(fun p b (H : ∀ {q : Prop}, ((b = true → p) → (b = false → ¬p) → q) → q) =>
+    b.casesOn (motive := fun b' => b = b' → Decidable p)
+      (fun h => isFalse (H fun _ h' => h' h)) (fun h => isTrue (H fun h' _ => h' h)) rfl)
+
+def Reflection.check (r : Reflection) (fail : ∀ {α}, M α) : M Unit := do
+  unless ← isDefEq (← checkType r.type) q(Prop → Bool → Prop) do fail
+
+inductive ConditionImpl where
+  | bool
+  | reflectNatNat (asBool : Expr) (reflect : Reflection) (proof : Expr)
+
+structure Condition where
+  prop : Expr
+  dec : Expr
+  impl : ConditionImpl
+
+def Condition.natLE : Condition where
+  prop := q(@LE.le Nat _)
+  dec := q(Nat.decLe)
+  impl := .reflectNatNat
+    (asBool := q(Nat.ble))
+    (reflect := .defn₁)
+    (proof := q(fun n m {q : Prop} (H : _ → _ → q) =>
+      H (@Nat.le_of_ble_eq_true n m) (@Nat.not_le_of_not_ble_eq_true n m)))
+
+def Condition.natEq : Condition where
+  prop := q(@Eq Nat)
+  dec := q(Nat.decEq)
+  impl := .reflectNatNat
+    (asBool := q(Nat.beq))
+    (reflect := .defn₂)
+    (proof := q(fun n m {q : Prop} (H : _ → _ → q) =>
+      H (@Nat.eq_of_beq_eq_true n m) (@Nat.ne_of_beq_eq_false n m)))
+
+def Condition.bool : Condition where
+  prop := q(fun x : Bool => x = true)
+  dec := q(fun x => Bool.decEq x true)
+  impl := .bool
+
+def Reflection.ite (r : Reflection) : Expr :=
+  .lam0 q(Prop) <| .lam0 q(Bool) <| .lam0 (mkApp2 r.type (.bvar 1) (.bvar 0)) <|
+    .lam0 q(Type) <| mkApp3 q(@_root_.ite.{1}) (.bvar 0) (.bvar 3)
+      (mkApp3 r.toDec (.bvar 3) (.bvar 2) (.bvar 1))
+
+def Reflection.natDITE (r : Reflection) : Expr :=
+  .lam0 q(Prop) <| .lam0 q(Bool) <| .lam0 (mkApp2 r.type (.bvar 1) (.bvar 0)) <|
+    mkApp2 q(@dite Nat) (.bvar 2) (mkApp3 r.toDec (.bvar 2) (.bvar 1) (.bvar 0))
+
+def Reflection.checkITE (r : Reflection) (fail : ∀ {α}, M α) : M Unit := do
+  unless ← isDefEq (← checkType r.ite) (.arrow q(Prop) <| .arrow q(Bool) <|
+    .arrow (mkApp2 r.type (.bvar 1) (.bvar 0)) q(∀ α : Type, α → α → α)) do fail
+  withLocalDecl `p .default q(Prop) fun p => do
+  withLocalDecl `H .default (mkApp2 r.type p q(true)) fun H => do
+    unless ← isDefEq (mkApp3 r.ite p q(true) H) q(fun α : Type => fun a _ : α => a) do fail
+  withLocalDecl `H .default (mkApp2 r.type p q(false)) fun H => do
+    unless ← isDefEq (mkApp3 r.ite p q(false) H) q(fun α : Type => fun _ a : α => a) do fail
+
+def Reflection.checkNatDITE (r : Reflection) (fail : ∀ {α}, M α) : M Unit := do
+  unless ← isDefEq (← checkType q(Not)) q(Prop → Prop) do fail
+  unless ← isDefEq (← checkType r.natDITE) (.arrow q(Prop) <| .arrow q(Bool) <|
+    .arrow (mkApp2 r.type (.bvar 1) (.bvar 0)) <|
+    .arrow (.arrow (.bvar 2) q(Nat)) <| .arrow (.arrow (mkApp q(Not) (.bvar 3)) q(Nat)) <|
+    q(Nat)) do fail
+  unless ← isDefEq (← checkType r.ofTrue) (.arrow q(Prop) <|
+    .arrow (mkApp2 r.type (.bvar 0) q(true)) (.bvar 1)) do fail
+  unless ← isDefEq (← checkType r.ofFalse) (.arrow q(Prop) <|
+    .arrow (mkApp2 r.type (.bvar 0) q(false)) (mkApp q(Not) (.bvar 1))) do fail
+  withLocalDecl `p .default q(Prop) fun p => do
+  withLocalDecl `a .default (.arrow p q(Nat)) fun a => do
+  withLocalDecl `b .default (.arrow (mkApp q(Not) p) q(Nat)) fun b => do
+  withLocalDecl `H .default (mkApp2 r.type p q(true)) fun H => do
+    unless ← isDefEq (mkApp5 r.natDITE p q(true) H a b) (mkApp a (mkApp2 r.ofTrue p H)) do fail
+  withLocalDecl `H .default (mkApp2 r.type p q(false)) fun H => do
+    unless ← isDefEq (mkApp5 r.natDITE p q(false) H a b) (mkApp b (mkApp2 r.ofFalse p H)) do fail
+
+def Condition.check (cond : Condition) (fail : ∀ {α}, M α)
+    (ite := false) (dite := false) : M Unit := do
+  _ ← checkType cond.dec
+  match cond.impl with
+  | .reflectNatNat asBool reflect proof =>
+    unless ← isDefEq (← inferType cond.prop) q(Nat → Nat → Prop) do fail
+    reflect.check fail
+    if ite then reflect.checkITE fail
+    if dite then reflect.checkNatDITE fail
+    let y := .bvar 0; let x := .bvar 1
+    let e := .lam0 q(Nat) <| .lam0 q(Nat) <| mkApp3 reflect.toDec
+      (mkApp2 cond.prop x y) (mkApp2 asBool x y) (mkApp2 proof x y)
+    _ ← checkType e
+    unless ← isDefEq (← inferType asBool) q(Nat → Nat → Bool) do fail
+    unless ← isProp (← inferType proof) do fail
+    unless ← isDefEq e cond.dec do fail
+  | .bool =>
+    unless ← isDefEq (← inferType cond.prop) q(Bool → Prop) do fail
+    let b := .bvar 0
+    if ite then
+      let natITE := .lam0 q(Bool) <|
+        mkApp2 q(@_root_.ite Nat) (mkApp cond.prop b) (mkApp cond.dec b)
+      unless ← isDefEq (← checkType natITE) q(Bool → Nat → Nat → Nat) do fail
+      unless ← isDefEq (mkApp natITE q(true)) q(fun a _ : Nat => a) do fail
+      unless ← isDefEq (mkApp natITE q(false)) q(fun _ a : Nat => a) do fail
+    if dite then throw <| .other "unsupported"
+
+protected def Condition.ite (cond : Condition) (α : Expr) (args : Array Expr) (t e : Expr) : Expr :=
+  mkApp5 q(@ite.{1}) α (mkAppN cond.prop args) (mkAppN cond.dec args) t e
+
+protected def Condition.dite (cond : Condition) (args: Array Expr) (t e : Expr) : Expr :=
+  mkApp4 q(@dite Nat) (mkAppN cond.prop args) (mkAppN cond.dec args)
+    (.lam0 (mkAppN cond.prop args) t)
+    (.lam0 (mkApp q(Not) (mkAppN cond.prop args)) e)
+
+protected def Condition.decide (cond : Condition) (args : Array Expr) : Expr :=
+  cond.ite q(Bool) args q(true) q(false)
+
+def unfoldWellFounded (e : Expr) (fvs : Array Expr) (eq_def : Expr) (fail : ∀ {α}, M α) : M Expr := do
+  let .app (.app _ lhs) rhs := eq_def.getForallBody.instantiateRev fvs | fail
+  let orig := lhs.getAppFn
+  let rhs := rhs.replace fun e' => if e' == orig then some e else none
+  let .app e1 wfn ← whnf (mkAppN e fvs) | fail
+  e1.withApp fun accRec args => do
+  let #[α,r,_,_,n] := args | fail
+  let .const ``Acc.rec [_, u] := accRec | fail
+  let .app wf _ := wfn | fail
+  let L := .lam0 α <| .lam0 (mkApp2 r (.bvar 0) n) (mkApp wf (.bvar 1))
+  let wfn' := mkApp4 (.const ``Acc.intro [u]) α r n L
+  let p ← inferType wfn
+  unless ← isProp p do fail
+  unless ← isDefEq p (← checkType wfn') do fail
+  _ ← checkType rhs
+  unless ← isDefEq (e1.app wfn') rhs do fail
+  return (← getLCtx).mkLambda fvs rhs
+
+def lambdaTelescope (e : Expr) (k : Array Expr → Expr → M α) : M α := loop #[] e where
+  loop fvars
+  | .lam x dom body bi =>
+    let d := dom.instantiateRev fvars
+    withLocalDecl x bi d fun fv => do
+      let fvars := fvars.push fv
+      loop fvars body
+  | e => k fvars (e.instantiateRev fvars)
+
+def forallTelescope (e : Expr) (k : Array Expr → Expr → M α) : M α := loop #[] e where
+  loop fvars
+  | .forallE x dom body bi =>
+    let d := dom.instantiateRev fvars
+    withLocalDecl x bi d fun fv => do
+      let fvars := fvars.push fv
+      loop fvars body
+  | e => k fvars (e.instantiateRev fvars)
+
+def unfoldNatWellFounded (e : Expr) (fvs : Array Expr) (eq_def : Expr) (fail : ∀ {α}, M α) : M Expr := do
+  let succ := mkApp q(Nat.succ)
+  let defeq1 a b := isDefEq (.arrow q(Nat) a) (.arrow q(Nat) b)
+  let x := .bvar 0
+  let .app (.app _ lhs) rhs := eq_def.getForallBody.instantiateRev fvs | fail
+  let orig := lhs.getAppFn
+  let rhs := rhs.replace fun e' => if e' == orig then some e else none
+  let e1 ← whnfCore (mkAppN e fvs) -- get _unary
+  let e1 ← unfoldDefinition e1 -- get fix
+  (← whnfCore e1).withApp fun fix args => do
+  let .const ``WellFounded.Nat.fix [_, _] := fix | fail
+  let #[α,motive,f,F,a₀] := args | fail
+  let fixFn := mkAppN fix #[α,motive,f,F]
+  withLocalDecl `a .default (← inferType a₀) fun a => do
+  -- prove |- fix α motive f F a ≡ go α motive f F (eager (f a)) a [proof]
+  let e1 ← unfoldDefinition (.app fixFn a) -- get fix.go
+  let e1 ← whnfCore e1
+  e1.withApp fun fixGo args => do
+    let #[α',motive',f',F',fuel,a',_] := args | fail
+    unless (α, motive, f, F, a) == (α', motive', f', F', a') do fail
+    let .app eager n := fuel | fail
+    unless ← isDefEq n (succ (.app f a)) do fail
+    -- prove |- eager n = if beq n n = true then n else n
+    unless (← getEnv).contains ``Nat.beq do fail
+    let c := Condition.bool; c.check (fail) (ite := true)
+    unless ← defeq1 (mkApp eager x) (c.ite q(Nat) #[mkApp2 (.const ``Nat.beq []) x x] x x) do fail
+    -- prove |- go α motive f F (succ t) x hfuel ≡ F x fun y hy => go α motive f F t y [proof]
+    let go' ← unfoldDefinition fixGo -- get fix
+    lambdaTelescope go' fun fvs go' => do
+    let #[_,_,_,F,t] := fvs | fail
+    let .app natRec t' := go' | fail
+    unless !natRec.containsFVar t.fvarId! && t == t' do fail
+    _ ← checkType (succ t)
+    let gor ← whnfCore (.app natRec (succ t))
+    lambdaTelescope gor fun fvs gor => do
+    let #[x,_] := fvs | fail
+    let .app Fx ih := gor | fail
+    unless .app F x == Fx do fail
+    lambdaTelescope ih fun fvs ih => do
+    let #[y,_] := fvs | fail
+    let .app ih _ := ih | fail
+    unless ih == .app (.app natRec t) y do fail
+  -- prove |- rhs ≡ F x fun y _ => fix α motive f F y
+  let .forallE _ dom _ _ ← inferType (.app F a₀) | fail
+  let ih' ← forallTelescope dom fun fvs _ => do
+    let #[y,_] := fvs | fail
+    return (← getLCtx).mkLambda fvs (.app fixFn y)
+  have rhs' := mkApp2 F a₀ ih'
+  _ ← checkType rhs'
+  unless ← isDefEq rhs rhs' do fail
+  return (← getLCtx).mkLambda fvs rhs
+
+def checkPrimitiveDef (v : DefinitionVal) : M Bool := do
+  unless v.safety == .safe do return false
+  let fail {α} : M α := throw <| .other s!"invalid form for primitive def {v.name}"
+  let tru := q(true)
+  let fal := q(false)
+  let zero := q(Nat.zero)
+  let succ := mkApp q(Nat.succ)
+  let pred := mkApp q(Nat.pred)
+  let add := mkApp2 q(Nat.add)
+  let sub := mkApp2 q(Nat.sub)
+  let mul := mkApp2 q(Nat.mul)
+  let mod := mkApp2 q(Nat.mod)
+  let div := mkApp2 q(Nat.div)
+  let one := succ zero
+  let two := succ one
+  let defeq1 a b := isDefEq (.arrow q(Nat) a) (.arrow q(Nat) b)
+  let defeq2 a b := defeq1 (.arrow q(Nat) a) (.arrow q(Nat) b)
+  let x := .bvar 0
+  let y := .bvar 1
+  let env ← getEnv
+  match v.name with
+  | ``Nat.add =>
+    unless env.contains ``Nat && v.levelParams.isEmpty do fail
+    -- add : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let add := mkApp2 v.value
+    -- add x 0 ≡ x
+    unless ← defeq1 (add x zero) x do fail
+    -- add y (succ x) ≡ succ (add y x)
+    unless ← defeq2 (add y (succ x)) (succ (add y x)) do fail
+  | ``Nat.pred =>
+    unless env.contains ``Nat && v.levelParams.isEmpty do fail
+    -- pred : Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat) do fail
+    let pred := mkApp v.value
+    unless ← isDefEq (pred zero) zero do fail
+    unless ← defeq1 (pred (succ x)) x do fail
+  | ``Nat.sub =>
+    unless env.contains ``Nat.pred && v.levelParams.isEmpty do fail
+    -- sub : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let sub := mkApp2 v.value
+    unless ← defeq1 (sub x zero) x do fail
+    unless ← defeq2 (sub y (succ x)) (pred (sub y x)) do fail
+  | ``Nat.mul =>
+    unless env.contains ``Nat.add && v.levelParams.isEmpty do fail
+    -- mul : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let mul := mkApp2 v.value
+    unless ← defeq1 (mul x zero) zero do fail
+    unless ← defeq2 (mul y (succ x)) (add (mul y x) y) do fail
+  | ``Nat.pow =>
+    unless env.contains ``Nat.mul && v.levelParams.isEmpty do fail
+    -- pow : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let pow := mkApp2 v.value
+    unless ← defeq1 (pow x zero) one do fail
+    unless ← defeq2 (pow y (succ x)) (mul (pow y x) y) do fail
+  | ``Nat.mod =>
+    unless env.contains ``Nat.sub && env.contains ``Bool && v.levelParams.isEmpty do fail
+    -- mod : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let mod := mkApp2 v.value
+    unless ← defeq1 (mod zero x) zero do fail
+    unless ← isDefEq (← checkType q(@LE.le Nat _)) q(Nat → Nat → Prop) do fail
+    let le := mkApp2 q(@LE.le Nat _)
+    unless ← isDefEq (← checkType q(Nat.modCore.go))
+      q(∀ n, Nat.succ Nat.zero ≤ n → ∀ fuel x : Nat, Nat.succ x ≤ fuel → Nat) do fail
+    let go := mkApp5 q(Nat.modCore.go)
+    let c := Condition.natLE; c.check fail (ite := true) (dite := true)
+    withLocalDecl `x .default q(Nat) fun x => do
+    withLocalDecl `y .default q(Nat) fun y => do
+    let sx := succ x
+    let e := c.ite q(Nat) #[y, sx] (c.dite #[one, y]
+      (go y (.bvar 0) (succ sx) sx (mkApp q(Nat.lt_succ_self) sx)) sx) sx
+    _ ← checkType e
+    unless ← isDefEq (mod sx y) e do fail
+    withLocalDecl `hy .default (le one y) fun hy => do
+    withLocalDecl `fuel .default q(Nat) fun fuel => do
+    withLocalDecl `h .default (le (succ x) (succ fuel)) fun h => do
+    let e := c.dite #[y, x] (go y hy fuel (sub x y)
+      (mkApp6 q(@Nat.div_rec_fuel_lemma) x y fuel hy (.bvar 0) h)) x
+    _ ← checkType e
+    unless ← isDefEq (go y hy (succ fuel) x h) e do fail
+  | ``Nat.div =>
+    unless env.contains ``Nat.sub && env.contains ``Bool && v.levelParams.isEmpty do fail
+    -- div : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let div := mkApp2 v.value
+    let c := Condition.natLE; c.check fail (dite := true)
+    unless ← isDefEq (← checkType q(@LE.le Nat _)) q(Nat → Nat → Prop) do fail
+    let le := mkApp2 q(@LE.le Nat _)
+    unless ← isDefEq (← checkType q(Nat.div.go))
+      q(∀ y, Nat.succ Nat.zero ≤ y → ∀ fuel x : Nat, Nat.succ x ≤ fuel → Nat) do fail
+    let go := mkApp5 q(Nat.div.go)
+    withLocalDecl `x .default q(Nat) fun x => do
+    withLocalDecl `y .default q(Nat) fun y => do
+    let e := c.dite #[one, y] (go y (.bvar 0) (succ x) x (mkApp q(Nat.lt_succ_self) x)) zero
+    _ ← checkType e
+    unless ← isDefEq (div x y) e do fail
+    withLocalDecl `hy .default (le one y) fun hy => do
+    withLocalDecl `fuel .default q(Nat) fun fuel => do
+    withLocalDecl `h .default (le (succ x) (succ fuel)) fun h => do
+    let e := c.dite #[y, x] (succ (go y hy fuel (sub x y)
+      (mkApp6 q(@Nat.div_rec_fuel_lemma) x y fuel hy (.bvar 0) h))) zero
+    _ ← checkType e
+    unless ← isDefEq (go y hy (succ fuel) x h) e do fail
+  | ``Nat.gcd =>
+    unless env.contains ``Nat.mod && v.levelParams.isEmpty do fail
+    -- gcd : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    withLocalDecl `m .default q(Nat) fun m => do
+    withLocalDecl `n .default q(Nat) fun n => do
+    let gcd' ← unfoldNatWellFounded v.value #[m, n] q(type_of% Nat.gcd.eq_def) fail
+    let gcd' := mkApp2 gcd'
+    let gcd := mkApp2 v.value
+    unless ← isDefEq (gcd' zero m) m do fail
+    unless ← isDefEq (gcd' (succ n) m) (gcd (mod m (succ n)) (succ n)) do fail
+  | ``Nat.beq =>
+    unless env.contains ``Nat && env.contains ``Bool && v.levelParams.isEmpty do fail
+    -- beq : Nat → Nat → Bool
+    unless ← isDefEq v.type q(Nat → Nat → Bool) do fail
+    let beq := mkApp2 v.value
+    unless ← isDefEq (beq zero zero) tru do fail
+    unless ← defeq1 (beq zero (succ x)) fal do fail
+    unless ← defeq1 (beq (succ x) zero) fal do fail
+    unless ← defeq2 (beq (succ y) (succ x)) (beq y x) do fail
+  | ``Nat.ble =>
+    unless env.contains ``Nat && env.contains ``Bool && v.levelParams.isEmpty do fail
+    -- ble : Nat → Nat → Bool
+    unless ← isDefEq v.type q(Nat → Nat → Bool) do fail
+    let ble := mkApp2 v.value
+    unless ← isDefEq (ble zero zero) tru do fail
+    unless ← defeq1 (ble zero (succ x)) tru do fail
+    unless ← defeq1 (ble (succ x) zero) fal do fail
+    unless ← defeq2 (ble (succ y) (succ x)) (ble y x) do fail
+  | ``Nat.bitwise =>
+    unless env.contains ``Nat && env.contains ``Bool && v.levelParams.isEmpty do fail
+    -- bitwise : Nat → Nat → Nat
+    unless ← isDefEq v.type q((Bool → Bool → Bool) → Nat → Nat → Nat) do fail
+    withLocalDecl `f .default q(Bool → Bool → Bool) fun f => do
+    withLocalDecl `n .default q(Nat) fun n => do
+    withLocalDecl `m .default q(Nat) fun m => do
+    let bitwise' ← unfoldNatWellFounded v.value #[f, n, m] q(type_of% Nat.bitwise.eq_def) fail
+    let bitwise := mkApp3 v.value
+    let c := Condition.natEq; c.check fail (ite := true)
+    let bc := Condition.bool; bc.check fail (ite := true)
+    let e :=
+      c.ite q(Nat) #[n, zero] (bc.ite q(Nat) #[mkApp2 f q(false) q(true)] m zero) <|
+      c.ite q(Nat) #[m, zero] (bc.ite q(Nat) #[mkApp2 f q(true) q(false)] n zero) <|
+      let n' := div n two
+      let m' := div m two
+      let b₁ := c.decide #[mod n two, one]
+      let b₂ := c.decide #[mod m two, one]
+      let r := bitwise f n' m'
+      bc.ite q(Nat) #[mkApp2 f b₁ b₂] (add (add r r) one) (add r r)
+    _ ← checkType e
+    unless ← isDefEq (mkApp3 bitwise' f n m) e do fail
+  | ``Nat.land =>
+    unless env.contains ``Nat.bitwise && v.levelParams.isEmpty do fail
+    -- land : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let .app (.const ``Nat.bitwise []) and := v.value | fail
+    let and := mkApp2 and
+    unless ← defeq1 (and fal x) fal do fail
+    unless ← defeq1 (and tru x) x do fail
+  | ``Nat.lor =>
+    unless env.contains ``Nat.bitwise && v.levelParams.isEmpty do fail
+    -- lor : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let .app (.const ``Nat.bitwise []) or := v.value | fail
+    let or := mkApp2 or
+    unless ← defeq1 (or fal x) x do fail
+    unless ← defeq1 (or tru x) tru do fail
+  | ``Nat.xor =>
+    unless env.contains ``Nat.bitwise && v.levelParams.isEmpty do fail
+    -- xor : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let .app (.const ``Nat.bitwise []) xor := v.value | fail
+    let xor := mkApp2 xor
+    unless ← isDefEq (xor fal fal) fal do fail
+    unless ← isDefEq (xor tru fal) tru do fail
+    unless ← isDefEq (xor fal tru) tru do fail
+    unless ← isDefEq (xor tru tru) fal do fail
+  | ``Nat.shiftLeft =>
+    unless env.contains ``Nat.mul && v.levelParams.isEmpty do fail
+    -- shiftLeft : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let shl := mkApp2 v.value
+    unless ← defeq1 (shl x zero) x do fail
+    unless ← defeq2 (shl x (succ y)) (shl (mul two x) y) do fail
+  | ``Nat.shiftRight =>
+    unless env.contains ``Nat.div && v.levelParams.isEmpty do fail
+    -- shiftRight : Nat → Nat → Nat
+    unless ← isDefEq v.type q(Nat → Nat → Nat) do fail
+    let shr := mkApp2 v.value
+    unless ← defeq1 (shr x zero) x do fail
+    unless ← defeq2 (shr x (succ y)) (div (shr x y) two) do fail
+  | ``Char.ofNat =>
+    unless env.contains ``Nat && v.levelParams.isEmpty do fail
+    -- Char : Type
+    _ ← ensureType q(Char)
+    -- @Char.ofNat : Nat → Char
+    unless ← isDefEq v.type q(Nat → Char) do fail
+  | ``String.ofList =>
+    unless v.levelParams.isEmpty do fail
+    -- Char : Type
+    _ ← ensureType q(Char)
+    -- List Char : Type
+    _ ← ensureType q(List Char)
+    -- @List.nil.{0} Char : List Char
+    unless ← isDefEq (← checkType q(List.nil (α := Char))) q(List Char) do fail
+    -- @List.cons.{0} Char : Char → List Char → List Char
+    unless ← isDefEq (← checkType q(List.cons (α := Char))) q(Char → List Char → List Char) do fail
+    -- String.ofList : List Char → String
+    unless ← isDefEq v.type q(List Char → String) do fail
+  | _ => return false
+  return true
+
+def checkPrimitiveInductive (_env : Environment) (lparams : List Name) (nparams : Nat)
+    (types : List InductiveType) (isUnsafe : Bool) : Except Exception Bool := do
+  unless !isUnsafe && lparams.isEmpty && nparams == 0 do return false
+  let [type] := types | return false
+  unless type.type == .sort (.succ .zero) do return false
+  let fail {α} : Except Exception α :=
+    throw <| .other s!"invalid form for primitive inductive {type.name}"
+  match type.name with
+  | ``Bool =>
+    let [⟨``Bool.false, .const ``Bool []⟩, ⟨``Bool.true, .const ``Bool []⟩] := type.ctors | fail
+  | ``Nat =>
+    let [
+      ⟨``Nat.zero, .const ``Nat []⟩,
+      ⟨``Nat.succ, .forallE _ (.const ``Nat []) (.const ``Nat []) _⟩
+    ] := type.ctors | fail
+  | _ => return false
+  return true
+
+-- Self-test to ensure that the primitives check at compile time
+run_meta
+  let env ← Lean.getEnv
+  for c in Environment.primitives do
+    match env.find? c with
+    | some (.defnInfo v) =>
+      let (.true, _) ← Elab.Term.TermElabM.run (checkPrimitiveDef { v with })
+        | throwError "{v.name}"
+    | some (.inductInfo _) | some (.ctorInfo _) => pure ()
+    | r => throwError "unexpected primitive: {r.map (·.name)}"
diff --git a/Ix/Theory/Named/Reference/PtrEq.lean b/Ix/Theory/Named/Reference/PtrEq.lean
new file mode 100644
index 000000000..36f715bbd
--- /dev/null
+++ b/Ix/Theory/Named/Reference/PtrEq.lean
@@ -0,0 +1,28 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Declaration
+
+namespace Ix.Theory.Named
+open Lean
+
+/--
+Pointer equality is not a safe function, but the kernel uses it anyway for some fast paths.
+We cannot use `withPtrEq` because it is not a mere optimization before a true equality test -
+the kernel actually has different behavior (will reject some inputs that it would not otherwise)
+if identical objects spontaneously get different addresses.
+
+We use this function to try to isolate uses of pointer equality in the kernel,
+and type-restrict it to avoid thorny questions about equality of closures or the like.
+-/
+opaque ptrEqExpr (a b : Expr) : Bool := unsafe ptrAddrUnsafe a == ptrAddrUnsafe b
+
+axiom ptrEqExpr_eq : ptrEqExpr a b → a = b
+
+/-- See `ptrEqExpr`. -/
+opaque ptrEqConstantInfo (a b : ConstantInfo) : Bool := unsafe ptrAddrUnsafe a == ptrAddrUnsafe b
+
+axiom ptrEqConstantInfo_eq : ptrEqConstantInfo a b → a = b
diff --git a/Ix/Theory/Named/Reference/Quot.lean b/Ix/Theory/Named/Reference/Quot.lean
new file mode 100644
index 000000000..15f320647
--- /dev/null
+++ b/Ix/Theory/Named/Reference/Quot.lean
@@ -0,0 +1,126 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Batteries.Tactic.OpenPrivate
+import Ix.Theory.Named.Reference.Environment.Basic
+import Ix.Theory.Named.Reference.Expr
+import Ix.Theory.Named.Reference.Instantiate
+import Ix.Theory.Named.Reference.LocalContext
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+open private Lean.Kernel.Environment.add markQuotInit from Lean.Environment
+
+abbrev ExprBuildT (m) := ReaderT LocalContext <| ReaderT NameGenerator m
+
+def ExprBuildT.run [Monad m] (x : ExprBuildT m α) : m α := x {} {}
+
+instance : MonadLocalNameGenerator (ExprBuildT m) where
+  withFreshId x c ngen := x ngen.curr c ngen.next
+
+def checkEqType (env : Environment) : Except Exception Unit := do
+  let fail {α} (s : String) : Except Exception α :=
+    throw <| .other s!"failed to initialize quot module, {s}"
+  let .inductInfo info ← env.get ``Eq | fail "environment does not have 'Eq' type"
+  let [u] := info.levelParams | fail "unexpected number of universe params at 'Eq' type"
+  let [eqRefl] := info.ctors | fail "unexpected number of constructors for 'Eq' type"
+  ExprBuildT.run do
+    withLocalDecl `α .implicit (.sort (.param u)) fun α => do
+      if info.type != ((← read).mkForall #[α] <| .arrow α <| .arrow α .prop) then
+        fail "'Eq' has an expected type"
+    let info ← env.get eqRefl
+    let [u] := info.levelParams
+      | fail "unexpected number of universe params at 'Eq' type constructor"
+    withLocalDecl `α .implicit (.sort (.param u)) fun α => do
+      withLocalDecl `a .default α fun a => do
+        if info.type != ((← read).mkForall #[α, a] <| mkApp3 (.const ``Eq [.param u]) α a a) then
+          fail "unexpected type for 'Eq' type constructor"
+
+def Environment.addQuot (env : Environment) : Except Exception Environment := do
+  if env.quotInit then return env
+  checkEqType env
+  env.checkName ``Quot
+  env.checkName ``Quot.mk
+  env.checkName ``Quot.lift
+  env.checkName ``Quot.ind
+  ExprBuildT.run do
+  let u := .param `u
+  withLocalDecl `α .implicit (.sort u) fun α => do
+  let env ← withLocalDecl `r .default (.arrow α (.arrow α .prop)) fun r => do
+    -- constant Quot.{u} {α : Sort u} (r : α → α → Prop) : Sort u
+    let env := env.add <| .quotInfo {
+      name := ``Quot, kind := .type, levelParams := [`u]
+      type := (← read).mkForall #[α, r] <| .sort u
+    }
+    withLocalDecl `a .default α fun a => do
+      -- constant Quot.mk.{u} {α : Sort u} (r : α → α → Prop) (a : α) : @Quot.{u} α r
+      return env.add <| .quotInfo {
+        name := ``Quot.mk, kind := .ctor, levelParams := [`u]
+        type := (← read).mkForall #[α, r, a] <| mkApp2 (.const ``Quot [u]) α r
+      }
+  withLocalDecl `r .implicit (.arrow α (.arrow α .prop)) fun r => do
+  let quot_r := mkApp2 (.const ``Quot [u]) α r
+  withLocalDecl `a .default α fun a => do
+  let v := .param `v
+  let env ← withLocalDecl `β .implicit (.sort v) fun β => do
+    withLocalDecl `f .default (.arrow α β) fun f => do
+    withLocalDecl `b .default α fun b => do
+    let rab := mkApp2 r a b
+    let fa_eq_fb := mkApp3 (.const ``Eq [v]) β (.app f a) (.app f b)
+    let sanity := (← read).mkForall #[a, b] <| .arrow rab fa_eq_fb
+    -- constant Quot.lift.{u, v} {α : Sort u} {r : α → α → Prop} {β : Sort v} (f : α → β) :
+    --   (∀ a b : α, r a b → f a = f b) → @Quot.{u} α r → β
+    return env.add <| .quotInfo {
+      name := ``Quot.lift, kind := .lift, levelParams := [`u, `v]
+      type := (← read).mkForall #[α, r, β, f] <| .arrow sanity <| .arrow quot_r β
+    }
+  let quotMk_a := mkApp3 (.const ``Quot.mk [u]) α r a
+  withLocalDecl `β .implicit (.arrow quot_r .prop) fun β => do
+  let all_quot := (← read).mkForall #[a] <| .app β quotMk_a
+  withLocalDecl `q .implicit quot_r fun q => do
+  -- constant Quot.ind.{u} {α : Sort u} {r : α → α → Prop} {β : @Quot.{u} α r → Prop} :
+  --   (∀ a : α, β (@Quot.mk.{u} α r a)) → ∀ q : @Quot.{u} α r, β q
+  let env := env.add <| .quotInfo {
+    name := ``Quot.ind, kind := .ind, levelParams := [`u]
+    type := (← read).mkForall #[α, r, β] <|
+      .forallE `mk all_quot ((← read).mkForall #[q] <| .app β q) .default
+  }
+  return markQuotInit env
+
+/-- Reduces the head application of a quotient eliminator as follows:
+
+```
+Quot.lift.{u, v} {α : Sort u} {r : α → α → Prop} {β : Sort v} (f : α → β) :
+  (∀ a b : α, r a b → f a = f b) → @Quot.{u} α r → β
+
+Quot.lift f h (Quot.mk r a) ... ⟶ f a ...
+```
+
+```
+Quot.ind.{u} {α : Sort u} {r : α → α → Prop} {β : @Quot.{u} α r → Prop} :
+  (∀ a : α, β (@Quot.mk.{u} α r a)) → ∀ q : @Quot.{u} α r, β q
+
+Quot.ind p (Quot.mk r a) ... ⟶ p a ...
+```
+-/
+def quotReduceRec [Monad m] (e : Expr) (whnf : Expr → m Expr) : m (Option Expr) := do
+  let .const fn _ := e.getAppFn | return none
+  let cont mkPos argPos := do
+    let args := e.getAppArgs
+    if h : mkPos < args.size then
+      let mk ← whnf args[mkPos]
+      if !mk.isAppOfArity ``Quot.mk 3 then return none
+      let mut r := Expr.app args[argPos]! mk.appArg!
+      let elimArity := mkPos + 1
+      if elimArity < args.size then
+        r := mkAppRange r elimArity args.size args
+      return some r
+    else return none
+  if fn == ``Quot.lift then cont 5 3
+  else if fn == ``Quot.ind then cont 4 3
+  else return none
diff --git a/Ix/Theory/Named/Reference/TypeChecker.lean b/Ix/Theory/Named/Reference/TypeChecker.lean
new file mode 100644
index 000000000..67027532e
--- /dev/null
+++ b/Ix/Theory/Named/Reference/TypeChecker.lean
@@ -0,0 +1,1074 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Reference.Declaration
+import Ix.Theory.Named.Reference.PtrEq
+import Ix.Theory.Named.Reference.Level
+import Ix.Theory.Named.Reference.Quot
+import Ix.Theory.Named.Reference.Inductive.Reduce
+import Ix.Theory.Named.Reference.Instantiate
+import Ix.Theory.Named.Reference.ForEachExprV
+import Ix.Theory.Named.Reference.FuelConfig
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+abbrev InferCache := ExprMap Expr
+
+structure TypeChecker.State where
+  ngen : NameGenerator := { namePrefix := `_kernel_fresh, idx := 0 }
+  inferTypeI : InferCache := {}
+  inferTypeC : InferCache := {}
+  whnfCoreCache : ExprMap Expr := {}
+  whnfCache : ExprMap Expr := {}
+  success : Std.HashSet (Expr × Expr) := {}
+  failure : Std.HashSet (Expr × Expr) := {}
+  unfold : ExprMap Expr := {}
+
+structure TypeChecker.Context where
+  env : Environment
+  lctx : LocalContext := {}
+  safety : DefinitionSafety := .safe
+  eagerReduce := false
+  lparams : List Name := []
+  fuel : FuelConfig := {}
+
+namespace TypeChecker
+
+abbrev M := ReaderT Context <| StateT State <| Except Exception
+
+def M.run (env : Environment) (safety : DefinitionSafety := .safe)
+    (lctx : LocalContext := {}) (lparams : List Name := []) (fuel : FuelConfig := {})
+    (x : M α) : Except Exception α :=
+  x { env, safety, lctx, lparams, fuel } |>.run' {}
+
+def M.runTermElab (m : M α) (safety := DefinitionSafety.safe) : Elab.Term.TermElabM α := do
+  ofExceptKernelException <| m.run (env := (← getEnv).toKernelEnv)
+    (lctx := ← getLCtx) (safety := safety) (lparams := (← get).levelNames)
+
+instance : MonadLift M Elab.Term.TermElabM := ⟨M.runTermElab⟩
+
+def getEnv : M Environment := return (← read).env
+
+instance : MonadLCtx M where
+  getLCtx := return (← read).lctx
+
+instance [Monad m] : MonadNameGenerator (StateT State m) where
+  getNGen := return (← get).ngen
+  setNGen ngen := modify fun s => { s with ngen }
+
+instance : MonadLocalNameGenerator M where
+  withFreshId x := do x (← mkFreshId)
+
+instance (priority := low) : MonadWithReaderOf LocalContext M where
+  withReader f := withReader fun s => { s with lctx := f s.lctx }
+
+structure Methods where
+  protected isDefEqCore : Expr → Expr → M Bool
+  protected whnfCore (e : Expr) (cheapProj := false) : M Expr
+  protected whnf (e : Expr) : M Expr
+  protected inferType (e : Expr) (inferOnly : Bool) : M Expr
+
+abbrev RecM := ReaderT Methods M
+
+inductive ReductionStatus where
+  | continue (tn sn : Expr)
+  | unknown (tn sn : Expr)
+  | bool (b : Bool)
+
+namespace Inner
+
+/-- Reduces `e` to its weak-head normal form. -/
+def whnf (e : Expr) : RecM Expr := fun m => m.whnf e
+
+@[inline] def withLCtx [MonadWithReaderOf LocalContext m] (lctx : LocalContext) (x : m α) : m α :=
+  withReader (fun _ => lctx) x
+
+/-- Ensures that `e` is defeq to some `e' := .sort ..`, returning `e'`. If not, throws an error with
+`s` (the expression required to be a sort). -/
+def ensureSortCore (e s : Expr) : RecM Expr := do
+  if e.isSort then return e
+  let e ← whnf e
+  if e.isSort then return e
+  throw <| .typeExpected (← getEnv) (← getLCtx) s
+
+/-- Ensures that `e` is defeq to some `e' := .forallE ..`, returning `e'`. If not, throws an error
+with `s := f a` (the application requiring `f` to be of function type). -/
+def ensureForallCore (e s : Expr) : RecM Expr := do
+  if e.isForall then return e
+  let e ← whnf e
+  if e.isForall then return e
+  throw <| .funExpected (← getEnv) (← getLCtx) s
+
+/-- Upper bound on the size in bytes of `n`'s runtime representation, mirroring the kernel's
+`lean_nat_size_in_bytes`: a scalar occupies one machine word, and a bignum occupies its GMP limb
+count times the limb size. -/
+def natSizeInBytes (n : Nat) : Nat :=
+  let bits := n.log2 + 1
+  -- `n` is boxed once it no longer fits in a machine word minus its tag bit.
+  if bits ≤ 63 then 8 else 8 * ((bits + 63) / 64)
+
+/-- Rejects a `Nat` numeral whose size exceeds `natMaxSize`. `numBytes` is an upper bound on the
+numeral's size, so this may be called before computing it. -/
+def checkNatSize (numBytes : Nat) : RecM Unit := do
+  if numBytes > (← readThe Context).fuel.natMaxSize then
+    throw <| .other "the kernel refused a `Nat` numeral because its size exceeds the maximum; \
+      raise the `natMaxSize` bound to allow it"
+
+/-- `Nat.pow` and `Nat.shiftLeft` take their second argument (the exponent, resp. the shift
+amount) as a machine `UInt32` in the kernel, so reject one that does not fit rather than
+overflowing. -/
+def checkCountArg (count : Nat) (op : String) : RecM Unit := do
+  if count ≥ UInt32.size then
+    throw <| .other s!"the kernel refused to evaluate `{op}` because its second argument does \
+      not fit in a 32-bit unsigned integer"
+
+/-- Bounds the numerals entering the kernel (e.g. source literals) by the same limit `reduceNat`
+enforces on the ones it computes. -/
+def checkLitSize (l : Literal) : RecM Unit := do
+  if let .natVal n := l then checkNatSize (natSizeInBytes n)
+
+/-- `checkNatSize`, conditionally: the size check the binary `Nat` operations that can grow a
+numeral without bound run on their result. -/
+def checkNatSizeIf (checkSize : Bool) (numBytes : Nat) : RecM Unit := do
+  if checkSize then checkNatSize numBytes
+
+/-- Rejects `base ^ exp` when it would exceed `natMaxSize`, without forming it: the result
+occupies at most `natSizeInBytes base * exp` bytes (a `base` of `0` or `1` yields `0`/`1`), and
+the bound is compared by division so the product is never formed either. -/
+def checkPowSize (base exp : Nat) : RecM Unit := do
+  checkCountArg exp "Nat.pow"
+  if base > 1 && exp != 0 && natSizeInBytes base > (← readThe Context).fuel.natMaxSize / exp then
+    throw <| .other "the kernel refused to evaluate `Nat.pow` because the result would exceed \
+      the maximum numeral size; raise the `natMaxSize` bound to allow it"
+
+/-- Rejects `v <<< shift` when it would exceed `natMaxSize`, without forming it: the result is
+`v * 2 ^ shift`, which occupies about `natSizeInBytes v + shift / 8` bytes. `0 <<< _` is `0`. -/
+def checkShiftLeftSize (v shift : Nat) : RecM Unit := do
+  if v != 0 then
+    checkCountArg shift "Nat.shiftLeft"
+    checkNatSize (natSizeInBytes v + shift / 8 + 1)
+
+/-- Checks that `l` does not contain any level parameters not found in the context `tc`. -/
+def checkLevel (tc : Context) (l : Level) : Except Exception Unit := do
+  if let some n2 := l.getUndefParam tc.lparams then
+    throw <| .other s!"invalid reference to undefined universe level parameter '{n2}'"
+
+def inferFVar (tc : Context) (name : FVarId) : Except Exception Expr := do
+  if let some decl := tc.lctx.find? name then
+    return decl.type
+  throw <| .other "unknown free variable"
+
+/-- Infers the type of `.const name ls`. -/
+def inferConstant (tc : Context) (name : Name) (ls : List Level) (inferOnly : Bool) :
+    Except Exception Expr := do
+  let e := Expr.const name ls
+  let info ← tc.env.get name
+  let ps := info.levelParams
+  if ps.length != ls.length then
+    throw <| .other s!"incorrect number of universe levels parameters for '{e
+      }', #{ps.length} expected, #{ls.length} provided"
+  if !inferOnly then
+    if info.isUnsafe && tc.safety != .unsafe then
+      throw <| .other s!"invalid declaration, it uses unsafe declaration '{e}'"
+    if let .defnInfo v := info then
+      if v.safety == .partial && tc.safety == .safe then
+        throw <| .other
+          s!"invalid declaration, safe declaration must not contain partial declaration '{e}'"
+    for l in ls do
+      checkLevel tc l
+  return info.instantiateTypeLevelParams ls
+
+/-- Infers the type of expression `e`. If `inferOnly := false`, this function throws an error
+whenever `e` is not typeable according to Lean's algorithmic typing judgment (barring resource
+exhaustion: it may also throw `.deterministicTimeout` or `.deepRecursion` on a typeable term).
+Setting `inferOnly := true` optimizes to avoid unnecessary checks in the case that `e` is already
+known to be well-typed. -/
+def inferType (e : Expr) (inferOnly := true) : RecM Expr := fun m => m.inferType e inferOnly
+
+/-- Infers the type of lambda expression `e`. -/
+def inferLambda (e : Expr) (inferOnly : Bool) : RecM Expr := loop #[] e where
+  loop fvars : Expr → RecM Expr
+  | .lam name dom body bi => do
+    let d := dom.instantiateRev fvars
+    if !inferOnly then
+      _ ← ensureSortCore (← inferType d inferOnly) d
+    withLocalDecl name bi d fun fv => do
+      let fvars := fvars.push fv
+      loop fvars body
+  | e => do
+    let r ← inferType (e.instantiateRev fvars) inferOnly
+    let r := r.cheapBetaReduce
+    return (← getLCtx).mkForall fvars r
+
+/-- Infers the type of for-all expression `e`. -/
+def inferForall (e : Expr) (inferOnly : Bool) : RecM Expr := loop #[] #[] e where
+  loop fvars us : Expr → RecM Expr
+  | .forallE name dom body bi => do
+    let d := dom.instantiateRev fvars
+    let t1 ← ensureSortCore (← inferType d inferOnly) d
+    let us := us.push t1.sortLevel!
+    withLocalDecl name bi d fun fv =>
+      loop (fvars.push fv) us body
+  | e => do
+    let r ← inferType (e.instantiateRev fvars) inferOnly
+    let s ← ensureSortCore r e
+    return .sort <| us.foldr mkLevelIMax' s.sortLevel!
+
+/-- Whether `t` and `s` have already been found definitionally equal.
+
+The pair is keyed on the order of the two hashes, so a later query finds the entry whichever way
+round it presents the pair. This is a plain set of pairs rather than an equivalence-closure
+structure on purpose: `isDefEq` is a sound but incomplete semi-decision procedure and so is not
+transitive, and taking the transitive closure of its successes would make its result depend on the
+order in which pairs were checked (lean4#14806). -/
+def succeededBefore (success : Std.HashSet (Expr × Expr)) (t s : Expr) : Bool :=
+  if t.hash < s.hash then
+    success.contains (t, s)
+  else if t.hash > s.hash then
+    success.contains (s, t)
+  else
+    success.contains (t, s) || success.contains (s, t)
+
+@[inherit_doc succeededBefore]
+def cacheSuccess (t s : Expr) : M Unit := do
+  let k := if t.hash ≤ s.hash then (t, s) else (s, t)
+  modify fun st => { st with success := st.success.insert k }
+
+/-- Returns whether `t` and `s` are definitionally equal according to Lean's algorithmic
+definitional equality judgment.
+
+NOTE: This function does not do any typechecking of its own on `t` and `s`. So, when this is used as
+part of a typechecking routine, it is expected that they are already well-typed (that is, that
+`checkType t` and `checkType s` did not/would not throw an error). This is what justifies the
+internal uses of `inferType` at its default `inferOnly := true`: on a well-typed subterm the fast
+path returns the same type the checking path would have. -/
+def isDefEqCore (t s : Expr) : RecM Bool := fun m => m.isDefEqCore t s
+
+@[inherit_doc isDefEqCore]
+def isDefEq (t s : Expr) : RecM Bool := do
+  -- Syntactically equivalent expressions are definitionally equal without consulting or
+  -- extending the success cache.  Besides avoiding needless work, this keeps exact checker
+  -- executions compositional when an application argument has precisely the declared domain
+  -- type.
+  if t == s then return true
+  let r ← isDefEqCore t s
+  if r then
+    cacheSuccess t s
+  pure r
+
+/-- Infers the type of application `e`, assuming that `e` is already well-typed. -/
+def inferApp (e : Expr) : RecM Expr := do
+  e.withApp fun f args =>
+  let rec loop fType j i : RecM Expr :=
+    if i < args.size then
+      match fType with
+      | .forallE _ _ body _ => loop body j (i+1)
+      | _ => do
+        let fType := fType.instantiateRevRange j i args
+        let fType := (← ensureForallCore fType e).bindingBody!
+        loop fType i (i+1)
+    else
+      return fType.instantiateRevRange j args.size args
+  do loop (← inferType f) 0 0
+
+/-- Infers the type of let-expression `e`. -/
+def inferLet (e : Expr) (inferOnly : Bool) : RecM Expr := loop #[] e where
+  loop fvars : Expr → RecM Expr
+  | .letE name type val body _ => do
+    let type := type.instantiateRev fvars
+    let val := val.instantiateRev fvars
+    if !inferOnly then
+      _ ← ensureSortCore (← inferType type inferOnly) type
+      let valType ← inferType val inferOnly
+      if !(← isDefEq valType type) then
+        throw <| .letTypeMismatch (← getEnv) (← getLCtx) name valType type
+    withLetDecl name type val fun fv =>
+      loop (fvars.push fv) body
+  | e => do
+    let r ← inferType (e.instantiateRev fvars) inferOnly
+    let r := r.cheapBetaReduce
+    return (← getLCtx).mkForall fvars r
+
+/-- Gets the universe level of the sort that `e`'s type is defeq to, failing if `e` is not
+a type. -/
+def getSortLevel (e : Expr) : RecM Level := do
+  let .sort u ← ensureSortCore (← inferType e) e | unreachable!
+  return u
+
+/-- Checks if `e` is a proposition, that is, if its type is a sort whose level normalizes to
+zero. -/
+def isProp (e : Expr) : RecM Bool := return (← getSortLevel e).isAlwaysZero
+
+/-- Checks if `e` is definitely not a proposition, that is, if its type is a sort whose level
+cannot normalize to zero under any instantiation. This is strictly stronger than `!(← isProp e)`,
+which also holds for the levels that could go either way. -/
+def isNeverProp (e : Expr) : RecM Bool := return (← getSortLevel e).isNeverZero
+
+def invalidProj (e : Expr) : RecM α := do
+  throw <| .invalidProj (← getEnv) (← getLCtx) e
+
+def inferProjParams (proj : Expr) : List Expr → Expr → RecM Expr
+  | [], r => pure r
+  | arg :: args, r => do
+    let .forallE _ _ body _ ← whnf r | invalidProj proj
+    inferProjParams proj args (body.instantiate1 arg)
+
+def inferProjFields (proj : Expr) (typeName : Name)
+    (struct : Expr) (maybePropType : Bool) :
+    Nat → Nat → Expr → RecM Expr
+  | _, 0, r => pure r
+  | fieldIdx, count + 1, r => do
+    let .forallE _ dom body _ ← whnf r | invalidProj proj
+    if body.hasLooseBVars && maybePropType then
+      -- prop structs cannot have non-prop dependent fields
+      if !(← isProp dom) then invalidProj proj
+    inferProjFields proj typeName struct maybePropType (fieldIdx + 1) count
+      (body.instantiate1 (.proj typeName fieldIdx struct))
+
+/-- Infers the type of structure projection `e`. -/
+def inferProj (typeName : Name) (idx : Nat) (struct structType : Expr) : RecM Expr := do
+  let e := Expr.proj typeName idx struct
+  let type ← whnf structType
+  type.withApp fun I args => do
+  let env ← getEnv
+  let .const I_name I_levels := I | invalidProj e
+  if typeName != I_name then invalidProj e
+  let .inductInfo I_val ← env.get I_name | invalidProj e
+  let [c] := I_val.ctors | invalidProj e
+  unless env.isProjectionReadyStructure I_name do invalidProj e
+  if args.size != I_val.numParams + I_val.numIndices then invalidProj e
+  let c_info ← env.get c
+  let .ctorInfo ctorInfo := c_info | invalidProj e
+  unless idx < ctorInfo.numFields do invalidProj e
+  let r ← inferProjParams e (args.toList.take I_val.numParams)
+    (c_info.instantiateTypeLevelParams I_levels)
+  let maybePropType := !(← getSortLevel type).isNeverZero
+  let r ← inferProjFields e I_name struct maybePropType 0 idx r
+  let .forallE _ dom _ _ ← whnf r | invalidProj e
+  if maybePropType then if !(← isProp dom) then invalidProj e
+  return dom
+
+@[inherit_doc inferType]
+def inferType' (e : Expr) (inferOnly : Bool) : RecM Expr := do
+  if e.hasLooseBVars then
+    throw <| .other
+      s!"type checker does not support loose bound variables, \
+         replace them with free variables before invoking it"
+  let state ← get
+  if let some r := (cond inferOnly state.inferTypeI state.inferTypeC)[e]? then
+    return r
+  let r ← match e with
+    | .lit l =>
+      checkLitSize l
+      if !inferOnly then
+        match l with
+        | .natVal _ => _ ← (← getEnv).get ``Nat
+        | .strVal _ => _ ← (← getEnv).get ``Char.ofNat; _ ← (← getEnv).get ``String.ofList
+      pure (mkConst l.typeName)
+    | .mdata _ e => inferType' e inferOnly
+    | .proj s idx e => inferProj s idx e (← inferType' e inferOnly)
+    | .fvar n => inferFVar (← readThe Context) n
+    | .mvar _ => throw <| .other "kernel type checker does not support meta variables"
+    | .bvar _ => unreachable!
+    | .sort l =>
+      if !inferOnly then
+        checkLevel (← readThe Context) l
+      pure <| .sort (.succ l)
+    | .const c ls => inferConstant (← readThe Context) c ls inferOnly
+    | .lam .. => inferLambda e inferOnly
+    | .forallE .. => inferForall e inferOnly
+    | .app f a =>
+      if inferOnly then
+        inferApp e
+      else
+        let fType ← ensureForallCore (← inferType' f inferOnly) e
+        let aType ← inferType' a inferOnly
+        let dType := fType.bindingDomain!
+        -- it can be shown that if `e` is typeable as `T`, then `T` is typeable as `Sort l`
+        -- for some universe level `l`, so this use of `isDefEq` is valid
+        let ok ← if a.isAppOfArity ``eagerReduce 2 then
+          withTheReader Context (fun s => {s with eagerReduce := true}) <|
+            isDefEq dType aType
+        else
+          isDefEq dType aType
+        if !ok then throw <| .appTypeMismatch (← getEnv) (← getLCtx) e fType aType
+        pure <| fType.bindingBody!.instantiate1 a
+    | .letE .. => inferLet e inferOnly
+  modify fun s => cond inferOnly
+    { s with inferTypeI := s.inferTypeI.insert e r }
+    { s with inferTypeC := s.inferTypeC.insert e r }
+  return r
+
+/-- Reduces `e` to its weak-head normal form, without unfolding definitions. This is a conservative
+version of `whnf` (which does unfold definitions), to be used for efficiency purposes.
+
+Setting `cheapProj` to `true` will cause the struct argument to be reduced "lazily" (using
+`whnfCore` rather than `whnf`) when reducing struct projections, and suppresses caching of the
+result. This can be a useful optimization if we're checking the definitional equality of two struct
+projections of the same projection, where we might save some work by directly checking if the struct
+arguments are defeq (rather than eagerly applying a projection).
+
+The kernel has a companion `cheap_rec` flag doing the same for the major premise of a recursor, but
+nothing has set it since lean4#9275 removed the old compiler, so it is omitted here. -/
+def whnfCore (e : Expr) (cheapProj := false) : RecM Expr :=
+  fun m => m.whnfCore e cheapProj
+
+def reduceRecursor (e : Expr) : RecM (Option Expr) := do
+  let env ← getEnv
+  if env.quotInit then
+    if let some r ← quotReduceRec e whnf then
+      return r
+  if let some r ← inductiveReduceRec env e whnf inferType isDefEq isNeverProp then
+    return r
+  return none
+
+/-- Reduces the free variable `e`: to the `whnfCore` of its definition if `e` is a let variable,
+and to itself if it is a lambda variable. -/
+def whnfFVar (e : Expr) (cheapProj : Bool) : RecM Expr := do
+  if let some (.ldecl (value := v) ..) := (← getLCtx).find? e.fvarId! then
+    return ← whnfCore v cheapProj
+  return e
+
+/-- Reduces a projection of `struct` at index `idx` (when `struct` is reducible to a constructor
+application). -/
+def reduceProj (idx : Nat) (struct : Expr) (cheapProj : Bool) : RecM (Option Expr) := do
+  let mut c ← (if cheapProj then whnfCore struct cheapProj else whnf struct)
+  if let .lit (.strVal s) := c then
+    c ← whnf (.strLitToConstructor s)
+  c.withApp fun mk args => do
+  let .const mkC _ := mk | return none
+  let env ← getEnv
+  let .ctorInfo mkInfo ← env.get mkC | return none
+  return args[mkInfo.numParams + idx]?
+
+def isLetFVar (lctx : LocalContext) (fvar : FVarId) : Bool :=
+  lctx.find? fvar matches some (.ldecl ..)
+
+@[inherit_doc whnfCore]
+def whnfCore' (e : Expr) (cheapProj := false) : RecM Expr := do
+  match e with
+  | .bvar .. | .sort .. | .mvar .. | .forallE .. | .const .. | .lam .. | .lit .. => return e
+  | .mdata _ e => return ← whnfCore' e cheapProj
+  | .fvar id => if !isLetFVar (← getLCtx) id then return e
+  | .app .. | .letE .. | .proj .. => pure ()
+  if let some r := (← get).whnfCoreCache[e]? then
+    return r
+  let rec save r := do
+    if !cheapProj then
+      modify fun s => { s with whnfCoreCache := s.whnfCoreCache.insert e r }
+    return r
+  match e with
+  | .bvar .. | .sort .. | .mvar .. | .forallE .. | .const .. | .lam .. | .lit ..
+  | .mdata .. => unreachable!
+  | .fvar _ => return ← whnfFVar e cheapProj
+  | .app .. =>
+    -- beta-reduce at the head as much as possible, apply any remaining `rargs`
+    -- to the resulting expression, and re-run `whnfCore`
+    e.withAppRev fun f0 rargs => do
+    -- the head may still be a let variable/binding, projection, or mdata-wrapped expression
+    let f ← whnfCore f0 cheapProj
+    if let .lam _ _ body _ := f then
+      let rec loop m (f : Expr) : RecM Expr :=
+        let rec cont := do
+          let r := f.instantiateRange (rargs.size - m) rargs.size rargs
+          let r := r.mkAppRevRange 0 (rargs.size - m) rargs
+          save <|← whnfCore r cheapProj
+        if let .lam _ _ body _ := f then
+          if m < rargs.size then loop (m + 1) body
+          else cont
+        else cont
+      loop 1 body
+    else if Expr.structuralEq f f0 then
+      if let some r ← reduceRecursor e then
+        whnfCore r cheapProj
+      else
+        pure e
+    else
+      let r := f.mkAppRevRange 0 rargs.size rargs
+      -- the recursive call re-decomposes `r` and reaches the `f == f0` branch above, so
+      -- `reduceRecursor` is still applied; adding arguments can only enable further normalization
+      -- if the head reduced to a partial recursor application
+      save <|← whnfCore r cheapProj
+  | .letE _ _ val body _ =>
+    save <|← whnfCore (body.instantiate1 val) cheapProj
+  | .proj _ idx s =>
+    if let some m ← reduceProj idx s cheapProj then
+      save <|← whnfCore m cheapProj
+    else
+      save e
+
+/-- Checks if the head of `e` is a constant that can be delta-reduced, applied to the right number
+of universe levels, returning its `ConstantInfo` if so. See `ConstantInfo.deltaValue?` for which
+constants qualify. -/
+def isDelta (env : Environment) (e : Expr) : Option ConstantInfo := do
+  if let .const c ls := e.getAppFn then
+    if let some ci := env.find? c then
+      if ci.deltaValue?.isSome && ls.length == ci.numLevelParams then
+        return ci
+  none
+
+def instantiateDeltaValue (ci : ConstantInfo) (ls : List Level) : Expr :=
+  ci.deltaValue?.get!.instantiateLevelParams ci.levelParams ls
+
+/-- If `e` is itself a constant that can be delta-reduced, returns its value with the constant's
+level parameters instantiated. Unlike `unfoldDefinition`, this does not look through applications:
+`e` must be a `.const`. -/
+def unfoldDefinitionCore (e : Expr) : RecM (Option Expr) := do
+  let .const _ ls := e | return none
+  let env ← getEnv
+  let some d := isDelta env e | return none
+  unless 0 < ls.length do return some (instantiateDeltaValue d ls)
+  if let some r := (← get).unfold[e]? then return some r
+  let r := instantiateDeltaValue d ls
+  modify fun s => { s with unfold := s.unfold.insert e r }
+  return some r
+
+/-- Unfolds the definition at the head of the application `e` (or `e` itself if it is not an
+application). -/
+def unfoldDefinition (e : Expr) : RecM (Option Expr) := do
+  if e.isApp then
+    let f0 := e.getAppFn
+    let some f ← unfoldDefinitionCore f0 | return none
+    let rargs := e.getAppRevArgs
+    return f.mkAppRevRange 0 rargs.size rargs
+  else
+    unfoldDefinitionCore e
+
+def reduceNative (_env : Environment) (e : Expr) : Except Exception (Option Expr) := do
+  let .app f (.const c _) := e | return none
+  if Expr.structuralEq f (.const ``reduceBool []) then
+    throw <| .other s!"the named specification does not support 'reduceBool {c}' reduction"
+  else if Expr.structuralEq f (.const ``reduceNat []) then
+    throw <| .other s!"the named specification does not support 'reduceNat {c}' reduction"
+  return none
+
+def rawNatLitExt? (e : Expr) : Option Nat := if e == .natZero then some 0 else e.rawNatLit?
+
+/-- Reduces the application `f a b` to a Nat literal if `a` and `b` can be reduced to Nat literals.
+
+`checkSize` bounds the size of the result, for the operations that can grow a numeral without
+bound when iterated. Their operands are already bounded, so computing the result before checking
+it is cheap.
+
+Note: `f` should have an (efficient) external implementation. -/
+def reduceBinNatOp (f : Nat → Nat → Nat) (a b : Expr) (checkSize := false) : RecM (Option Expr) := do
+  let some v1 := rawNatLitExt? (← whnf a) | return none
+  let some v2 := rawNatLitExt? (← whnf b) | return none
+  checkNatSizeIf checkSize (natSizeInBytes (f v1 v2))
+  return some <| .lit <| .natVal <| f v1 v2
+
+/-- Reduces `Nat.pow a b`. Unlike the other binary operations this bounds the result *before*
+computing it, since a small exponent already denotes an unrepresentable numeral. -/
+def reducePow (a b : Expr) : RecM (Option Expr) := do
+  let some base := rawNatLitExt? (← whnf a) | return none
+  let some exp := rawNatLitExt? (← whnf b) | return none
+  checkPowSize base exp
+  return some <| .lit <| .natVal <| Nat.pow base exp
+
+/-- Reduces `Nat.shiftLeft a b`, bounding the result before computing it. -/
+def reduceShiftLeft (a b : Expr) : RecM (Option Expr) := do
+  let some v := rawNatLitExt? (← whnf a) | return none
+  let some shift := rawNatLitExt? (← whnf b) | return none
+  checkShiftLeftSize v shift
+  return some <| .lit <| .natVal <| v <<< shift
+
+/-- Reduces the application `f a b` to a boolean expression if `a` and `b` can be reduced to Nat
+literals.
+
+Note: `f` should have an (efficient) external implementation. -/
+def reduceBinNatPred (f : Nat → Nat → Bool) (a b : Expr) : RecM (Option Expr) := do
+  let some v1 := rawNatLitExt? (← whnf a) | return none
+  let some v2 := rawNatLitExt? (← whnf b) | return none
+  return toExpr <| f v1 v2
+
+/-- Reduces `e` to a literal if possible, where the unary operation `Nat.succ` and the binary
+operations and predicates with an external implementation may be applied: `Nat.add`, `Nat.sub`,
+`Nat.mul`, `Nat.pow`, `Nat.gcd`, `Nat.mod`, `Nat.div`, `Nat.land`, `Nat.lor`, `Nat.xor`,
+`Nat.shiftLeft`, `Nat.shiftRight` produce a `Nat` literal, while the predicates `Nat.beq` and
+`Nat.ble` produce a `Bool` literal. -/
+def reduceNat (e : Expr) : RecM (Option Expr) := do
+  let nargs := e.getAppNumArgs
+  if nargs == 1 then
+    let f := e.appFn!
+    if Expr.structuralEq f (.const ``Nat.succ []) then
+      let some v := rawNatLitExt? (← whnf e.appArg!) | return none
+      checkNatSize (natSizeInBytes (v + 1))
+      return some <| .lit <| .natVal <| v + 1
+  else if nargs == 2 then
+    let .app (.app (.const f _) a) b := e | return none
+    if f == ``Nat.add then return ← reduceBinNatOp Nat.add a b (checkSize := true)
+    if f == ``Nat.sub then return ← reduceBinNatOp Nat.sub a b (checkSize := true)
+    if f == ``Nat.mul then return ← reduceBinNatOp Nat.mul a b (checkSize := true)
+    if f == ``Nat.pow then return ← reducePow a b
+    if f == ``Nat.gcd then return ← reduceBinNatOp Nat.gcd a b
+    if f == ``Nat.mod then return ← reduceBinNatOp Nat.mod a b
+    if f == ``Nat.div then return ← reduceBinNatOp Nat.div a b
+    if f == ``Nat.beq then return ← reduceBinNatPred Nat.beq a b
+    if f == ``Nat.ble then return ← reduceBinNatPred Nat.ble a b
+    if f == ``Nat.land then return ← reduceBinNatOp Nat.land a b
+    if f == ``Nat.lor then return ← reduceBinNatOp Nat.lor a b
+    if f == ``Nat.xor then return ← reduceBinNatOp Nat.xor a b
+    if f == ``Nat.shiftLeft then return ← reduceShiftLeft a b
+    if f == ``Nat.shiftRight then return ← reduceBinNatOp Nat.shiftRight a b
+  return none
+
+@[inherit_doc whnf]
+def whnf' (e : Expr) : RecM Expr := do
+  -- Do not cache easy cases
+  match e with
+  | .bvar .. | .sort .. | .mvar .. | .forallE .. | .lit .. => return e
+  | .mdata _ e => return ← whnf' e
+  | .fvar id =>
+    if !isLetFVar (← getLCtx) id then
+      return e
+  | .lam .. | .app .. | .const .. | .letE .. | .proj .. => pure ()
+  -- check cache
+  if let some r := (← get).whnfCache[e]? then
+    return r
+  let rec loop t
+  | 0 => throw .deterministicTimeout
+  | fuel+1 => do
+    let env ← getEnv
+    let t ← whnfCore' t
+    if let some t ← reduceNative env t then return t
+    if let some t ← reduceNat t then return t
+    let some t ← unfoldDefinition t | return t
+    loop t fuel
+  let ctx ← readThe Context
+  let r ← loop e <| if ctx.eagerReduce then ctx.fuel.whnfEager else ctx.fuel.whnf
+  modify fun s => { s with whnfCache := s.whnfCache.insert e r }
+  return r
+
+/-- If `t` and `s` are lambda expressions, checks that their domains are defeq and recurses on the
+bodies, substituting in a new free variable for that binder (this substitution is delayed for
+efficiency purposes using the `subst` parameter). Otherwise, does a normal defeq check. -/
+def isDefEqLambda (t s : Expr) (subst : Array Expr := #[]) : RecM Bool :=
+  match t, s with
+  | .lam _ tDom tBody _, .lam name sDom sBody bi => do
+    let sType ← if tDom == sDom then pure none else
+      let sType := sDom.instantiateRev subst
+      let tType := tDom.instantiateRev subst
+      if !(← isDefEq tType sType) then return false
+      pure (some sType)
+    if tBody.hasLooseBVars || sBody.hasLooseBVars then
+      let sType := sType.getD (sDom.instantiateRev subst)
+      withLocalDecl name bi sType fun fv => do
+        isDefEqLambda tBody sBody (subst.push fv)
+    else
+      isDefEqLambda tBody sBody (subst.push default)
+  | t, s => isDefEq (t.instantiateRev subst) (s.instantiateRev subst)
+
+/-- If `t` and `s` are for-all expressions, checks that their domains are defeq and recurses on the
+bodies, substituting in a new free variable for that binder (this substitution is delayed for
+efficiency purposes using the `subst` parameter). Otherwise, does a normal defeq check. -/
+def isDefEqForall (t s : Expr) (subst : Array Expr := #[]) : RecM Bool :=
+  match t, s with
+  | .forallE _ tDom tBody _, .forallE name sDom sBody bi => do
+    let sType ← if tDom == sDom then pure none else
+      let sType := sDom.instantiateRev subst
+      let tType := tDom.instantiateRev subst
+      if !(← isDefEq tType sType) then return false
+      pure (some sType)
+    if tBody.hasLooseBVars || sBody.hasLooseBVars then
+      let sType := sType.getD (sDom.instantiateRev subst)
+      withLocalDecl name bi sType fun fv =>
+        isDefEqForall tBody sBody (subst.push fv)
+    else
+      isDefEqForall tBody sBody (subst.push default)
+  | t, s => isDefEq (t.instantiateRev subst) (s.instantiateRev subst)
+
+/-- Decides definitional equality of `t` and `s` in the cases that can be settled without
+reduction, returning `.undef` to defer to the calling function otherwise.
+
+It returns `.true` if they are α-equivalent or have previously been checked for definitional
+equality, and otherwise decides two sorts by level equivalence and two literals by equality,
+returning `.false` where these disagree. Two lambdas or two for-alls are handed to
+`isDefEqLambda`/`isDefEqForall`, which may return either. All remaining cases — including two
+constants, two free variables, two applications and two projections — are deferred. -/
+def quickIsDefEq (t s : Expr) : RecM LBool := do
+  -- cheap structural check, plus the positive `isDefEq` cache
+  if t == s || succeededBefore (← get).success t s then return .true
+  match t, s with
+  | .lam .., .lam .. => toLBoolM <| isDefEqLambda t s
+  | .forallE .., .forallE .. => toLBoolM <| isDefEqForall t s
+  | .sort a1, .sort a2 => pure (a1.isEquiv' a2).toLBool
+  | .mdata _ a1, .mdata _ a2 => toLBoolM <| isDefEq a1 a2
+  | .mvar .., .mvar .. => unreachable!
+  | .lit a1, .lit a2 => pure (a1 == a2).toLBool
+  | _, _ => return .undef
+
+/-- Assuming that `t` and `s` have the same function heads, returns true if they are applications
+with definitionally equal arguments (in which case they are defeq), and false otherwise (deferring
+further defeq checking to caller). -/
+def isDefEqArgs (t s : Expr) : RecM Bool := do
+  match t, s with
+  | .app tf ta, .app sf sa =>
+    if !(← isDefEq ta sa) then return false
+    isDefEqArgs tf sf
+  | .app .., _ | _, .app .. => return false
+  | _, _ => return true
+
+/-- Assuming `t` and `s` are WHNF, checks if they are defeq on account of `t` being an η-expansion
+of `s`.
+
+Assuming that `s` has a function type `(x : A) → B x`, it η-expands to `fun (x : A) => s x`
+(which it is definitionally equal to by the η rule). -/
+def tryEtaExpansionCore (t s : Expr) : RecM Bool := do
+  if t.isLambda && !s.isLambda then
+    let .forallE name ty _ bi ← whnf (← inferType s) | return false
+    isDefEq t (.lam name ty (.app s (.bvar 0)) bi)
+  else return false
+
+@[inherit_doc tryEtaExpansionCore]
+def tryEtaExpansion (t s : Expr) : RecM Bool :=
+  tryEtaExpansionCore t s <||> tryEtaExpansionCore s t
+
+/-- One field comparison in the structure-eta fast path.  Naming the
+callback keeps the executable range loop and its verification aligned without
+depending on proof terms synthesized by `for` notation. -/
+def tryEtaStructFieldStep (t : Expr) (induct : Name) (numParams : Nat)
+    (args : Array Expr) (i : Nat) (_ : i ∈ [numParams:args.size])
+    (_ : Option Bool × PUnit) :
+    RecM (ForInStep (Option Bool × PUnit)) := do
+  let b ← isDefEq (.proj induct (i - numParams) t) args[i]
+  if b = true then
+    pure (.yield ⟨none, PUnit.unit⟩)
+  else
+    pure (.done ⟨some false, PUnit.unit⟩)
+
+/-- Assuming `t` and `s` in WHNF, checks if they are defeq on account of `s` being defeq to the
+struct-η-expansion of `t`.
+
+Assuming that `t` has a non-recursive structure type `S` with constructor `S.mk` and projections
+`pᵢ`, it struct-η-expands to `S.mk (p₁ t) ... (pₙ t)` (which it is definitionally equal to by the
+struct-η rule). -/
+def tryEtaStructCore (t s : Expr) : RecM Bool := do
+  let .const f _ := s.getAppFn | return false
+  let env ← getEnv
+  let .ctorInfo fInfo ← env.get f | return false
+  unless s.getAppNumArgs == fInfo.numParams + fInfo.numFields do return false
+  unless env.isNonRecStructure fInfo.induct do return false
+  unless ← isDefEq (← inferType t) (← inferType s) do return false
+  let args := s.getAppArgs
+  -- since `t` is in WHNF, and assuming it is not a constructor application, this projection
+  -- cannot reduce (so we are directly checking if `s` is defeq to the struct-η-expansion of `t`)
+  let r ← forIn' [fInfo.numParams:args.size] ⟨none, PUnit.unit⟩
+    (tryEtaStructFieldStep t fInfo.induct fInfo.numParams args)
+  match r.1 with
+  | none => return true
+  | some b => return b
+
+@[inherit_doc tryEtaStructCore]
+def tryEtaStruct (t s : Expr) : RecM Bool :=
+  -- when `t` and `s` are both constructor applications, `isDefEqApp` has already compared their
+  -- arguments and returned false, and the projections in `tryEtaStructCore` reduce back to those
+  -- same arguments, so both calls below merely redo that work. The kernel has the same redundancy.
+  tryEtaStructCore t s <||> tryEtaStructCore s t
+
+/-- Checks if applications `t` and `s` (should be WHNF) are defeq on account of their function heads
+and arguments being defeq. -/
+def isDefEqApp (t s : Expr) : RecM Bool := do
+  unless t.isApp && s.isApp do return false
+  t.withApp fun tf tArgs =>
+  s.withApp fun sf sArgs => do
+  if _h : tArgs.size = sArgs.size then
+    unless ← isDefEq tf sf do return false
+    let rec loop i := do
+      if _h : i < tArgs.size then
+        unless ← isDefEq tArgs[i] sArgs[i] do return false
+        loop (i+1)
+      else return true
+    loop 0
+  else return false
+
+/-- Checks if `t` and `s` are definitionally equivalent according to proof irrelevance (that is,
+they are proofs of the same proposition). -/
+def isDefEqProofIrrel (t s : Expr) : RecM LBool := do
+  let tType ← inferType t
+  if !(← isProp tType) then return .undef
+  toLBoolM <| isDefEq tType (← inferType s)
+
+def failedBefore (failure : Std.HashSet (Expr × Expr)) (t s : Expr) : Bool :=
+  if t.hash < s.hash then
+    failure.contains (t, s)
+  else if t.hash > s.hash then
+    failure.contains (s, t)
+  else
+    failure.contains (t, s) || failure.contains (s, t)
+
+def cacheFailure (t s : Expr) : M Unit := do
+  let k := if t.hash ≤ s.hash then (t, s) else (s, t)
+  modify fun st => { st with failure := st.failure.insert k }
+
+def tryUnfoldProjApp (e : Expr) : RecM (Option Expr) := do
+  let f := e.getAppFn
+  if !f.isProj then return none
+  let e' ← whnfCore e
+  return if e' != e then e' else none
+
+/-- Performs a single step of δ-reduction on `tn`, `sn`, or both (according to optimizations)
+followed by weak-head normalization (without further δ-reduction). Returns `.bool` if the resulting
+terms are settled by `quickIsDefEq`, or if they are applications of the same defined constant with
+defeq args. Otherwise returns `.continue`, indicating to the calling `lazyDeltaReduction` that
+δ-reduction is to be continued.
+
+If neither side has a δ-reducible head, returns `.unknown` with the terms unchanged, leaving further
+defeq-checking to `isDefEqCore'`. Note that these are weak-head normal forms with respect to
+`cheapProj := true`, so a projection at the head may still be reducible. -/
+def lazyDeltaReductionStep (tn sn : Expr) : RecM ReductionStatus := do
+  let env ← getEnv
+  let delta e := do whnfCore (← unfoldDefinition e).get! (cheapProj := true)
+  let cont tn sn :=
+    return match ← quickIsDefEq tn sn with
+    | .undef => .continue tn sn
+    | .true => .bool true
+    | .false => .bool false
+  match isDelta env tn, isDelta env sn with
+  | none, none => return .unknown tn sn
+  | some _, none =>
+    -- `sn` was normalized with `cheapProj := true`, so a projection at its head may not have been
+    -- reduced; `tryUnfoldProjApp` retries it with the struct argument fully normalized
+    if let some sn' ← tryUnfoldProjApp sn then
+      cont tn sn'
+    else
+      cont (← delta tn) sn
+  | none, some _ =>
+    if let some tn' ← tryUnfoldProjApp tn then
+      cont tn' sn
+    else
+      cont tn (← delta sn)
+  | some dt, some ds =>
+    let ht := dt.hints
+    let hs := ds.hints
+    if ht.lt' hs then
+      cont tn (← delta sn)
+    else if hs.lt' ht then
+      cont (← delta tn) sn
+    else
+      if tn.isApp && sn.isApp && ptrEqConstantInfo dt ds && dt.hints.isRegular
+        && !failedBefore (← get).failure tn sn
+      then
+        if Level.isEquivList tn.getAppFn.constLevels! sn.getAppFn.constLevels! then
+          if ← isDefEqArgs tn sn then
+            return .bool true
+        cacheFailure tn sn
+      cont (← delta tn) (← delta sn)
+
+@[inline] def isNatZero (t : Expr) : Bool :=
+  t == .natZero || t matches .lit (.natVal 0)
+
+def isNatSuccOf? : Expr → Option Expr
+  | .lit (.natVal (n+1)) => return .lit (.natVal n)
+  | .app (.const ``Nat.succ _) e => return e
+  | _ => none
+
+/-- Returns `.true` if `t` and `s` are both zero, either as a literal or as `Nat.zero`. If they are
+both successors of natural numbers `t'` and `s'`, either as literals or `Nat.succ` applications,
+checks that `t'` and `s'` are definitionally equal. Otherwise, defers to the calling function. -/
+def isDefEqOffset (t s : Expr) : RecM LBool := do
+  if isNatZero t && isNatZero s then
+    return .true
+  match isNatSuccOf? t, isNatSuccOf? s with
+  | some t', some s' => toLBoolM <| isDefEqCore t' s'
+  | _, _ => return .undef
+
+/-- Repeatedly δ-reduces the `cheapProj := true` weak-head normal forms `tn` and `sn` until the
+question is settled. Returns `.bool` if:
+- they are both zero or both natural number successors (as literals or `Nat.succ` applications)
+- one of them can be converted to a natural number/boolean literal
+- a `lazyDeltaReductionStep` settles them
+
+Otherwise returns `.unknown` with the reduced terms, deferring to the calling function. Throws
+`.deterministicTimeout` after `FuelConfig.lazyDelta` steps. -/
+def lazyDeltaReduction (tn sn : Expr) : RecM ReductionStatus := do
+  loop tn sn (← readThe Context).fuel.lazyDelta
+where
+  loop tn sn
+  | 0 => throw .deterministicTimeout
+  | fuel+1 => do
+    let r ← isDefEqOffset tn sn
+    if r != .undef then return .bool (r == .true)
+    if !tn.hasFVar && !sn.hasFVar || (← readThe Context).eagerReduce then
+      if let some tn' ← reduceNat tn then
+        return .bool (← isDefEqCore tn' sn)
+      else if let some sn' ← reduceNat sn then
+        return .bool (← isDefEqCore tn sn')
+    let env ← getEnv
+    if let some tn' ← reduceNative env tn then
+      return .bool (← isDefEqCore tn' sn)
+    else if let some sn' ← reduceNative env sn then
+      return .bool (← isDefEqCore tn sn')
+    match ← lazyDeltaReductionStep tn sn with
+    | .continue tn sn => loop tn sn fuel
+    | r => return r
+
+/-- If `t` is a string literal and `s` is a `String.ofList` application, checks that they are defeq
+after expanding `t` into a `String.ofList` application of an explicit character list. Otherwise,
+defers to the calling function. -/
+def tryStringLitExpansionCore (t s : Expr) : RecM LBool := do
+  let .lit (.strVal st) := t | return .undef
+  let .app sf _ := s | return .undef
+  unless sf == .const ``String.ofList [] do return .undef
+  toLBoolM <| isDefEqCore (.strLitToConstructor st) s
+
+@[inherit_doc tryStringLitExpansionCore]
+def tryStringLitExpansion (t s : Expr) : RecM LBool := do
+  match ← tryStringLitExpansionCore t s with
+  | .undef => tryStringLitExpansionCore s t
+  | r => return r
+
+/-- Checks if `t` and `s` are defeq on account of both being of a unit type (a type with one
+constructor without any fields or indices). -/
+def isDefEqUnitLike (t s : Expr) : RecM Bool := do
+  let tType ← whnf (← inferType t)
+  let .const I _ := tType.getAppFn | return false
+  let env ← getEnv
+  let .inductInfo { isRec := false, ctors := [c], numIndices := 0, .. } ← env.get I
+    | return false
+  let .ctorInfo { numFields := 0, .. } ← env.get c | return false
+  isDefEqCore tType (← inferType s)
+
+@[inherit_doc isDefEqCore]
+def isDefEqCore' (t s : Expr) : RecM Bool := do
+  let r ← quickIsDefEq t s
+  if r != .undef then return r == .true
+
+  if (!t.hasFVar || (← readThe Context).eagerReduce) && s.isConstOf ``true then
+    if (← whnf t).isConstOf ``true then return true
+
+  let tn ← whnfCore t (cheapProj := true)
+  let sn ← whnfCore s (cheapProj := true)
+
+  if !(ptrEqExpr tn t && ptrEqExpr sn s) then
+    let r ← quickIsDefEq tn sn
+    if r != .undef then return r == .true
+
+  let r ← isDefEqProofIrrel tn sn
+  if r != .undef then return r == .true
+
+  match ← lazyDeltaReduction tn sn with
+  | .continue .. => unreachable!
+  | .bool b => return b
+  | .unknown tn sn =>
+
+  match tn, sn with
+  | .const tf tl, .const sf sl =>
+    if tf == sf && Level.isEquivList tl sl then return true
+  | .fvar tv, .fvar sv => if tv == sv then return true
+  | .proj _ ti te, .proj _ si se =>
+    -- optimized by the previous reduction functions using `cheapProj := true`
+    if ti == si then if ← isDefEq te se then return true
+  | _, _ => pure ()
+
+  -- the previous reduction functions used `cheapProj := true`, so we may not have a complete WHNF
+  let tnn ← whnfCore tn
+  let snn ← whnfCore sn
+  if !(ptrEqExpr tnn tn && ptrEqExpr snn sn) then
+    -- if projection reduced, need to re-run (as we may not have a WHNF)
+    return ← isDefEqCore tnn snn
+
+  -- tn and sn are both in WHNF
+  if ← isDefEqApp tn sn then return true
+  if ← tryEtaExpansion tn sn then return true
+  if ← tryEtaStruct tn sn then return true
+  let r ← tryStringLitExpansion tn sn
+  if r != .undef then return r == .true
+  if ← isDefEqUnitLike tn sn then return true
+  return false
+
+end Inner
+
+open Inner
+
+def Methods.withFuel : Nat → Methods
+  | 0 =>
+    { isDefEqCore := fun _ _ => throw .deepRecursion
+      whnfCore := fun _ _ => throw .deepRecursion
+      whnf := fun _ => throw .deepRecursion
+      inferType := fun _ _ => throw .deepRecursion }
+  | n + 1 =>
+    { isDefEqCore := fun t s => isDefEqCore' t s (withFuel n)
+      whnfCore := fun e p => whnfCore' e p (withFuel n)
+      whnf := fun e => whnf' e (withFuel n)
+      inferType := fun e i => inferType' e i (withFuel n) }
+
+/-- Runs `x` with a limit on the recursion depth, taken from `FuelConfig.recDepth`. -/
+def RecM.run (x : RecM α) : M α := do x (Methods.withFuel (← readThe Context).fuel.recDepth)
+
+def RecM.runTermElab (x : RecM α) (safety := DefinitionSafety.safe) : Elab.Term.TermElabM α :=
+  x.run.runTermElab safety
+
+instance : MonadLift RecM Elab.Term.TermElabM := ⟨RecM.runTermElab⟩
+
+@[inherit_doc whnf']
+def whnf (e : Expr) : M Expr := (Inner.whnf e).run
+
+def whnfCore (e : Expr) : M Expr := (Inner.whnfCore e).run
+
+def unfoldDefinition (e : Expr) : M Expr := return (← (Inner.unfoldDefinition e).run).getD e
+
+/-- Infers the type of expression `e`. Note that this uses the optimization `inferOnly := true`, and
+so should only be used for the purpose of type inference on terms that are known to be well-typed.
+To typecheck terms for the first time, use `checkType`. -/
+def inferType (e : Expr) : M Expr := (Inner.inferType e).run
+
+/-- Infers the type of expression `e` and checks that `e` is well-typed according to Lean's typing
+judgment.
+
+Use `inferType` to infer type alone. -/
+def checkType (e : Expr) : M Expr := (Inner.inferType e (inferOnly := false)).run
+
+@[inherit_doc isDefEqCore]
+def isDefEq (t s : Expr) : M Bool := (Inner.isDefEq t s).run
+
+@[inherit_doc Inner.isProp]
+def isProp (t : Expr) : M Bool := (Inner.isProp t).run
+
+@[inherit_doc ensureSortCore]
+def ensureSort (t : Expr) (s := t) : M Expr := (ensureSortCore t s).run
+
+@[inherit_doc ensureForallCore]
+def ensureForall (t : Expr) (s := t) : M Expr := (ensureForallCore t s).run
+
+/-- Ensures that `e` is a type/proposition. If it is not, throws an error. -/
+def ensureType (e : Expr) : M Expr := do ensureSort (← inferType e) e
+
+def etaExpand (e : Expr) : M Expr :=
+  let rec loop fvars
+  | .lam name dom body bi => do
+    let d := dom.instantiateRev fvars
+    withLocalDecl name bi d fun fv => do
+      let fvars := fvars.push fv
+      loop fvars body
+  | it => do
+    let itType ← whnf <| ← inferType <| it.instantiateRev fvars
+    if !itType.isForall then return e
+    let rec loop2 fvars args
+    | 0, _ => throw .deepRecursion
+    | fuel + 1, .forallE name dom body bi => do
+      let d := dom.instantiateRev fvars
+      withLocalDecl name bi d fun arg => do
+        let fvars := fvars.push arg
+        let args := args.push arg
+        loop2 fvars args fuel <| ← whnf <| body.instantiate1 arg
+    | _, it => return (← getLCtx).mkLambda fvars (mkAppN it args)
+    loop2 fvars #[] (← readThe Context).fuel.etaExpand itType
+  loop #[] e
+
+-- for testing:
+
+-- example : "hi" = sorry := by
+--   run_tac
+--     let env ← Lean.getEnv
+--     let lctx ← getLCtx
+--     let (_, lhs, _) := (← Elab.Tactic.getMainTarget).eq?.get!
+--     logInfo lhs
+--     let ty ← show M _ from withReader ({· with env := .empty `h}) (inferType lhs)
+--     logInfo ty
+--     let sort ← inferType ty
+--     logInfo sort
diff --git a/Ix/Theory/Named/SingletonParity.lean b/Ix/Theory/Named/SingletonParity.lean
new file mode 100644
index 000000000..32a76e7d4
--- /dev/null
+++ b/Ix/Theory/Named/SingletonParity.lean
@@ -0,0 +1,186 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.InductiveFixtures
+
+open Ix.Theory (VLevel)
+
+/-!
+# Complete singleton-family parity inputs
+
+This module is the Theory-side inventory for Spec-07.  Each row owns the exact
+raw declaration together with the one checked generation artifact consumed by
+the kernel differential and environment-replay matrix.  `Unit` is represented
+honestly by the kernel's polymorphic `PUnit` family; the reducible `Unit`
+definition itself is pinned on the Verify side.
+-/
+
+namespace Ix.Theory.Named.InductiveFixtures
+
+open VInductDecl
+
+private def permC07 (constant : VConstant) (levels : List VLevel) :
+    VConstant :=
+  ⟨constant.uvars, constant.type.instL levels⟩
+
+/-! ## Checked artifacts for the pre-existing fixed rows -/
+
+def boolChecked : boolDecl.Checked := boolDecl.checked?.get (by decide)
+
+def boolGenerationChecked : GenerationChecked boolDecl :=
+  (identityGeneration? boolDecl).get (by decide)
+
+def listChecked : listDecl.Checked := listDecl.checked?.get (by decide)
+
+def listGenerationChecked : GenerationChecked listDecl :=
+  (identityGeneration? listDecl).get (by decide)
+
+def optionChecked : optionDecl.Checked := optionDecl.checked?.get (by decide)
+
+def optionGenerationChecked : GenerationChecked optionDecl :=
+  (identityGeneration? optionDecl).get (by decide)
+
+def prodChecked : prodDecl.Checked := prodDecl.checked?.get (by decide)
+
+def prodGenerationChecked : GenerationChecked prodDecl :=
+  (identityGeneration? prodDecl).get (by decide)
+
+def heqChecked : heqDecl.Checked := heqDecl.checked?.get (by decide)
+
+def heqGenerationChecked : GenerationChecked heqDecl :=
+  (identityGeneration? heqDecl).get (by decide)
+
+def orGenerationChecked : GenerationChecked orDecl :=
+  (identityGeneration? orDecl).get (by decide)
+
+def andGenerationChecked : GenerationChecked andDecl :=
+  (identityGeneration? andDecl).get (by decide)
+
+/-! ## Fin -/
+
+def finType : VInductiveType where
+  name := ``Fin
+  uvars := 0
+  type := vconst(type_of% @Fin).type
+  ctors := [⟨vconst(type_of% @Fin.mk), ``Fin.mk⟩]
+
+def finDecl : VInductDecl := ⟨0, 1, [finType]⟩
+
+def finChecked : finDecl.Checked := finDecl.checked?.get (by decide)
+
+def finGenerationChecked : GenerationChecked finDecl :=
+  (identityGeneration? finDecl).get (by decide)
+
+example : finDecl.stage3 = true := rfl
+example : finChecked.params = [.const ``Nat []] := rfl
+example : finChecked.indices = [] := rfl
+example : finChecked.resultLevel = .succ .zero := rfl
+example : finChecked.elimination = .large := rfl
+example : finChecked.kTarget = false := rfl
+example : finChecked.constructors.length = 1 := rfl
+example : finChecked.constructors[0].fields.length = 2 := rfl
+example : finChecked.constructors[0].recursive = [] := rfl
+example : finGenerationChecked.recursor =
+    vconst(type_of% @Fin.rec) := rfl
+
+/-! ## Vector -/
+
+def vectorType : VInductiveType where
+  name := ``Vector
+  uvars := 1
+  type := vconst(type_of% @Vector).type
+  ctors := [⟨vconst(type_of% @Vector.mk), ``Vector.mk⟩]
+
+def vectorDecl : VInductDecl := ⟨1, 2, [vectorType]⟩
+
+def vectorChecked : vectorDecl.Checked := vectorDecl.checked?.get (by decide)
+
+def vectorGenerationChecked : GenerationChecked vectorDecl :=
+  (identityGeneration? vectorDecl).get (by decide)
+
+example : vectorDecl.stage3 = true := rfl
+example : vectorChecked.params =
+    [.sort (.succ (.param 0)), .const ``Nat []] := rfl
+example : vectorChecked.indices = [] := rfl
+example : vectorChecked.resultLevel = .succ (.param 0) := rfl
+example : vectorChecked.elimination = .large := rfl
+example : vectorChecked.kTarget = false := rfl
+example : vectorChecked.constructors.length = 1 := rfl
+example : vectorChecked.constructors[0].fields.length = 2 := rfl
+example : vectorChecked.constructors[0].recursive = [] := rfl
+example : vectorGenerationChecked.recursor =
+    permC07 (vconst(type_of% @Vector.rec)) [.param 1, .param 0] := rfl
+
+/-! ## One authoritative singleton artifact inventory -/
+
+/-- A source-indexed singleton artifact.  Merely constructing a row proves
+that the public checked analyzer accepted that exact raw declaration and that
+all downstream generation data came from the same checked path. -/
+structure SingletonParityArtifact where
+  label : Name
+  source : VInductDecl
+  generation : source.GenerationChecked
+
+namespace SingletonParityArtifact
+
+def typeName (artifact : SingletonParityArtifact) : Name :=
+  artifact.generation.block.sourceType.name
+
+def constructorNames (artifact : SingletonParityArtifact) : List Name :=
+  artifact.generation.block.sourceType.ctors.map (·.name)
+
+end SingletonParityArtifact
+
+/-- The fixed Spec-07 positive matrix, in roadmap order.  The `Unit` row points
+to `PUnit`, matching the actual v4.31 kernel representation rather than
+inventing alias-level inductive metadata. -/
+def singletonPositiveArtifacts : List SingletonParityArtifact :=
+  [⟨``Nat, natDecl, natGenerationChecked⟩,
+    ⟨``Bool, boolDecl, boolGenerationChecked⟩,
+    ⟨``List, listDecl, listGenerationChecked⟩,
+    ⟨``Option, optionDecl, optionGenerationChecked⟩,
+    ⟨``Prod, prodDecl, prodGenerationChecked⟩,
+    ⟨``Unit, punitDecl, punitGenerationChecked⟩,
+    ⟨``Empty, emptyDecl, emptyGenerationChecked⟩,
+    ⟨``Or, orDecl, orGenerationChecked⟩,
+    ⟨``And, andDecl, andGenerationChecked⟩,
+    ⟨``Eq, eqDecl, eqGenerationChecked⟩,
+    ⟨``HEq, heqDecl, heqGenerationChecked⟩,
+    ⟨``Fin, finDecl, finGenerationChecked⟩,
+    ⟨``Vector, vectorDecl, vectorGenerationChecked⟩,
+    ⟨``Acc, accDecl, accGenerationChecked⟩]
+
+/-- The focused non-identity normalization rows retained alongside the fixed
+standard-library matrix. -/
+def singletonNormalizationArtifacts : List SingletonParityArtifact :=
+  [⟨``AliasFormer, aliasFormerRawDecl, aliasFormerGenerationChecked⟩,
+    ⟨``AliasRec, aliasRecRawDecl, aliasRecGenerationChecked⟩,
+    ⟨``NormalizationMatrix, normalizationMatrixRawDecl,
+      normalizationMatrixGenerationChecked⟩,
+    ⟨``AnnotatedPi, annotatedPiRawDecl, annotatedPiGenerationChecked⟩,
+    ⟨``AnnotatedParam, annotatedParamRawDecl,
+      annotatedParamGenerationChecked⟩]
+
+example : singletonPositiveArtifacts.length = 14 := rfl
+example : singletonPositiveArtifacts.map (·.label) =
+    [``Nat, ``Bool, ``List, ``Option, ``Prod, ``Unit, ``Empty, ``Or, ``And,
+      ``Eq, ``HEq, ``Fin, ``Vector, ``Acc] := rfl
+example : singletonPositiveArtifacts.map (·.typeName) =
+    [``Nat, ``Bool, ``List, ``Option, ``Prod, ``PUnit, ``Empty, ``Or, ``And,
+      ``Eq, ``HEq, ``Fin, ``Vector, ``Acc] := rfl
+example : singletonNormalizationArtifacts.length = 5 := rfl
+
+/-!
+The inventory roots are trust-sensitive: pin their exact logical closure so
+later fixture refactors cannot silently import a broader proof surface.
+-/
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.singletonPositiveArtifacts [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveFixtures.singletonNormalizationArtifacts [propext, Quot.sound]
+
+end Ix.Theory.Named.InductiveFixtures
diff --git a/Ix/Theory/Named/Std/AxiomAudit.lean b/Ix/Theory/Named/Std/AxiomAudit.lean
new file mode 100644
index 000000000..816ae3cbb
--- /dev/null
+++ b/Ix/Theory/Named/Std/AxiomAudit.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean.Elab.Command
+import Lean.Util.FoldConsts
+
+/-!
+# Exact axiom checks for named-specification proofs
+
+The checked sets use resolved declaration names, independent of pretty-print
+width and dependency traversal order. Both missing and additional axioms fail
+the check; a namespace migration cannot silently widen the recorded boundary.
+-/
+
+open Lean Elab Command
+
+namespace Ix.Theory.Named.AxiomAudit
+
+/-- Traverse checked declarations directly. Imported axiom summaries can
+omit dependencies of mutually recursive declaration groups. -/
+def directConstants : ConstantInfo → Array Name
+  | .axiomInfo v => v.type.getUsedConstants
+  | .defnInfo v => v.type.getUsedConstants ++ v.value.getUsedConstants
+  | .thmInfo v => v.type.getUsedConstants ++ v.value.getUsedConstants
+  | .opaqueInfo v => v.type.getUsedConstants ++ v.value.getUsedConstants
+  | .quotInfo _ => #[]
+  | .ctorInfo v => v.type.getUsedConstants
+  | .recInfo v => v.type.getUsedConstants
+  | .inductInfo v => v.type.getUsedConstants ++ v.ctors
+
+structure State where
+  visited : NameSet := {}
+  names : Array Name := #[]
+  origins : Array Name := #[]
+  axioms : Array Name := #[]
+
+structure Node where
+  isAxiom : Bool := false
+  dependencies : Array Name := #[]
+
+/-- Direct dependencies may be reused across roots in one fixed environment.
+Reachability and axiom sets are always computed afresh for each root. -/
+abbrev Cache := NameMap Node
+
+abbrev M := ReaderT Environment (StateM (State × Cache))
+
+partial def visit (name : Name) : M Unit := do
+  let (state, cache) ← get
+  unless state.visited.contains name do
+    let env ← read
+    let (node, cache) := match cache.find? name with
+      | some node => (node, cache)
+      | none =>
+        let node : Node := match env.checked.get.find? name with
+          | some info =>
+            { isAxiom := (info matches .axiomInfo _)
+              dependencies := directConstants info }
+          | none => {}
+        (node, cache.insert name node)
+    let state := { state with
+      visited := state.visited.insert name
+      names := state.names.push name
+      axioms := if node.isAxiom then state.axioms.push name else state.axioms
+      origins := if name != ``sorryAx && node.dependencies.contains ``sorryAx then
+        state.origins.push name else state.origins }
+    set (state, cache)
+    node.dependencies.forM visit
+
+def collectCached (env : Environment) (root : Name) (cache : Cache) : State × Cache :=
+  ((visit root).run env).run ({}, cache) |>.2
+
+def collect (env : Environment) (root : Name) : State :=
+  (collectCached env root {}).1
+
+end Ix.Theory.Named.AxiomAudit
+
+syntax (name := guardNamedAxioms)
+  "#guard_named_axioms " ident " [" ident,* "]" : command
+
+elab_rules : command
+  | `(#guard_named_axioms $root:ident [$axioms:ident,*]) => do
+    let rootName ← liftCoreM <| realizeGlobalConstNoOverloadWithInfo root
+    let expected ← axioms.getElems.mapM fun axiomSyntax =>
+      liftCoreM <| realizeGlobalConstNoOverloadWithInfo axiomSyntax
+    let actual := (Ix.Theory.Named.AxiomAudit.collect (← getEnv) rootName).axioms
+    unless actual.qsort Name.lt == expected.qsort Name.lt do
+      let missing := expected.filter (!actual.contains ·)
+      let additional := actual.filter (!expected.contains ·)
+      throwError m!"axiom boundary changed for {rootName}\n\
+        expected but absent: {missing}\nactual but unlisted: {additional}"
+
+-- Exercise both rejection directions as well as successful exact checks.
+#guard_named_axioms Eq.refl []
+#guard_named_axioms propext [propext]
+
+-- A constructor depends on its full inductive definition, including siblings.
+private inductive AuditFixture : Prop where
+  | plain
+  | withAxiom (proof : propext (Iff.rfl : True ↔ True) = rfl)
+
+#guard_named_axioms AuditFixture.plain [propext]
+
+run_cmd do
+  let env ← getEnv
+  let (first, cache) := Ix.Theory.Named.AxiomAudit.collectCached env
+    ``AuditFixture.plain {}
+  let (independent, cache) := Ix.Theory.Named.AxiomAudit.collectCached env ``Eq.refl cache
+  let (sibling, _) := Ix.Theory.Named.AxiomAudit.collectCached env
+    ``AuditFixture.withAxiom cache
+  unless first.axioms == #[``propext] && independent.axioms.isEmpty &&
+      sibling.axioms == #[``propext] do
+    throwError "cached axiom traversal changed a root's dependency boundary"
+
+/--
+error: axiom boundary changed for propext
+expected but absent: []
+actual but unlisted: [propext]
+-/
+#guard_msgs (whitespace := lax) in
+#guard_named_axioms propext []
+
+/--
+error: axiom boundary changed for Eq.refl
+expected but absent: [propext]
+actual but unlisted: []
+-/
+#guard_msgs (whitespace := lax) in
+#guard_named_axioms Eq.refl [propext]
diff --git a/Ix/Theory/Named/Std/Basic.lean b/Ix/Theory/Named/Std/Basic.lean
new file mode 100644
index 000000000..1e411e673
--- /dev/null
+++ b/Ix/Theory/Named/Std/Basic.lean
@@ -0,0 +1,270 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Batteries.CodeAction
+import Batteries.Data.Array.Lemmas
+import Batteries.Data.HashMap.Basic
+import Batteries.Tactic.SeqFocus
+
+open Std
+
+/-
+These are stdlib-shaped lemmas that live in the root namespace upstream (mathlib, or eventually
+batteries/core). Declaring them under root here would make `import Mathlib` and `import Ix.Theory.Named`
+conflict.
+
+So instead, we declare them in `namespace Ix.Theory.Named`. Consumers of this file need an
+`open Ix.Theory.Named`, which is what keeps `h.length_eq`-style dot notation working.
+
+Beware also that `Ix.Theory.Named.List` now exists: an `open (scoped) List` under an `open Ix.Theory.Named`
+resolves to it, so such opens are written `_root_.List`.
+-/
+namespace Ix.Theory.Named
+open List Ix.Theory.Named
+
+attribute [simp] Option.bind_eq_some_iff List.filterMap_cons
+
+theorem Option.beq_some_iff [BEq α] {a : Option α} {b : α} :
+    a == some b ↔ ∃ a', a = some a' ∧ a' == b := by cases a <;> simp
+
+protected theorem Nat.le_iff_exists_add {a b : Nat} : a ≤ b ↔ ∃ c, b = a + c :=
+  ⟨fun h => ⟨_, (Nat.add_sub_cancel' h).symm⟩, fun ⟨_, h⟩ => h ▸ Nat.le_add_right ..⟩
+
+protected theorem Nat.le_iff_exists_add' {a b : Nat} : a ≤ b ↔ ∃ c, b = c + a := by
+  simp [Nat.add_comm, Nat.le_iff_exists_add]
+
+protected theorem List.Forall₂.rfl
+    {R : α → α → Prop} {l : List α} (h : ∀ a ∈ l, R a a) : l.Forall₂ R l := by
+  induction l with
+  | nil => constructor
+  | cons _ _ ih => simp at h; exact .cons h.1 (ih h.2)
+
+@[simp] theorem List.forall₂_nil_left_iff {l} : Forall₂ R nil l ↔ l = nil :=
+  ⟨fun H => by cases H; rfl, by rintro rfl; exact Forall₂.nil⟩
+
+@[simp] theorem List.forall₂_nil_right_iff {l} : Forall₂ R l nil ↔ l = nil :=
+  ⟨fun H => by cases H; rfl, by rintro rfl; exact Forall₂.nil⟩
+
+theorem List.forall₂_cons_left_iff {a l u} :
+    Forall₂ R (a :: l) u ↔ ∃ b u', R a b ∧ Forall₂ R l u' ∧ u = b :: u' :=
+  Iff.intro
+    (fun h => match u, h with | b :: u', Forall₂.cons h₁ h₂ => ⟨b, u', h₁, h₂, rfl⟩)
+    (fun h => match u, h with | _, ⟨_, _, h₁, h₂, rfl⟩ => Forall₂.cons h₁ h₂)
+
+theorem List.forall₂_cons_right_iff {b l u} :
+    Forall₂ R u (b :: l) ↔ ∃ a u', R a b ∧ Forall₂ R u' l ∧ u = a :: u' :=
+  Iff.intro
+    (fun h => match u, h with | b :: u', Forall₂.cons h₁ h₂ => ⟨b, u', h₁, h₂, rfl⟩)
+    (fun h => match u, h with | _, ⟨_, _, h₁, h₂, rfl⟩ => Forall₂.cons h₁ h₂)
+
+theorem List.Forall₂.imp (H : ∀ a b, R a b → S a b)
+    {l₁ l₂} (h : Forall₂ R l₁ l₂) : Forall₂ S l₁ l₂ := by
+  induction h <;> constructor <;> [(apply H; assumption); assumption]
+
+theorem List.Forall₂.trans (H : ∀ a b c, R a b → S b c → T a c)
+    {l₁ l₂ l₃} (h₁ : Forall₂ R l₁ l₂) (h₂ : Forall₂ S l₂ l₃) : Forall₂ T l₁ l₃ := by
+  induction h₁ generalizing l₃ <;> cases h₂ <;> constructor <;> solve_by_elim
+
+theorem List.Forall₂.and {l₁ l₂} (h₁ : Forall₂ R l₁ l₂) (h₂ : Forall₂ S l₁ l₂) :
+    Forall₂ (fun x y => R x y ∧ S x y) l₁ l₂ := by induction h₁ <;> simp_all
+
+theorem List.Forall₂.and_mem {l₁ l₂} (H : Forall₂ R l₁ l₂) :
+    Forall₂ (fun x y => R x y ∧ x ∈ l₁ ∧ y ∈ l₂) l₁ l₂ :=
+  .trans (fun _ _ _ h1 h2 => ⟨h1.1 ▸ h2.1, h1.2, h2.2⟩)
+    (.rfl (R := fun x y => x = y ∧ x ∈ l₁) fun _ h => ⟨rfl, h⟩) <|
+  .trans (T := fun x y => R x y ∧ y ∈ l₂) (fun _ _ _ h1 h2 => by exact ⟨h2.1 ▸ h1, h2.2⟩) H <|
+  .rfl (R := fun x y => x = y ∧ y ∈ l₂) fun _ h => ⟨rfl, h⟩
+
+theorem List.Forall₂.zipWith_l {l₁ l₂} (H : ∀ a b, R a b → S a (f a b)) (h : Forall₂ R l₁ l₂) :
+    Forall₂ S l₁ (l₁.zipWith f l₂) := by induction h <;> simp [*]
+
+@[simp] theorem List.forall₂_map_left_iff {f : γ → α} :
+    ∀ {l u}, Forall₂ R (map f l) u ↔ Forall₂ (fun c b => R (f c) b) l u
+  | [], _ => by simp only [map, forall₂_nil_left_iff]
+  | a :: l, _ => by simp only [map, forall₂_cons_left_iff, forall₂_map_left_iff]
+
+@[simp] theorem List.forall₂_map_right_iff {f : γ → β} :
+    ∀ {l u}, Forall₂ R l (map f u) ↔ Forall₂ (fun a c => R a (f c)) l u
+  | _, [] => by simp only [map, forall₂_nil_right_iff]
+  | _, b :: u => by simp only [map, forall₂_cons_right_iff, forall₂_map_right_iff]
+
+theorem List.Forall₂.flip : ∀ {a b}, Forall₂ (flip R) b a → Forall₂ R a b
+  | _, _, .nil => .nil
+  | _, _, .cons h₁ h₂ => .cons h₁ (flip h₂)
+
+theorem List.Forall₂.forall_exists_l {l₁ l₂} (h : Forall₂ R l₁ l₂) : ∀ a ∈ l₁, ∃ b ∈ l₂, R a b := by
+  induction h with simp [*] | cons _ _ ih => exact fun a h => .inr (ih _ h)
+
+theorem List.Forall₂.forall_exists_r {l₁ l₂} (h : Forall₂ R l₁ l₂) : ∀ b ∈ l₂, ∃ a ∈ l₁, R a b :=
+  h.flip.forall_exists_l
+
+theorem List.Forall₂.length_eq : ∀ {l₁ l₂}, Forall₂ R l₁ l₂ → length l₁ = length l₂
+  | _, _, .nil => rfl
+  | _, _, .cons _ h₂ => congrArg Nat.succ <| Forall₂.length_eq h₂
+
+theorem List.forall₂_eq {l₁ l₂ : List α} : Forall₂ Eq l₁ l₂ ↔ l₁ = l₂ :=
+  ⟨fun h => by induction h <;> simp_all, (· ▸ .rfl fun _ _ => rfl)⟩
+
+theorem List.Forall₂.append_of_left : ∀ {l₁ l₂ r₁ r₂}, length l₁ = length l₂ →
+    (Forall₂ R (l₁ ++ r₁) (l₂ ++ r₂) ↔ Forall₂ R l₁ l₂ ∧ Forall₂ R r₁ r₂)
+  | [], [], _, _, _ => by simp
+  | a::l₁, b::l₂, _, _, eq => by simp [append_of_left (Nat.succ_inj.1 eq), and_assoc]
+
+theorem List.Forall₂.append_of_right {l₁ l₂ r₁ r₂} (H : length r₁ = length r₂) :
+    Forall₂ R (l₁ ++ r₁) (l₂ ++ r₂) ↔ Forall₂ R l₁ l₂ ∧ Forall₂ R r₁ r₂ := by
+  refine ⟨fun h => (append_of_left ?_).1 h, fun h => (append_of_left h.1.length_eq).2 h⟩
+  simpa [H] using h.length_eq
+
+theorem List.Forall₂.reverse : Forall₂ R l.reverse l'.reverse ↔ Forall₂ R l l' := by
+  induction l generalizing l' <;> cases l' <;> simp [List.Forall₂.append_of_right, and_comm, *]
+
+theorem List.map_id''' {f : α → α} (l : List α) (h : ∀ x ∈ l, f x = x) : map f l = l := by
+  induction l <;> simp_all
+
+theorem List.map_fst_lookup {f : α → β} [BEq β] (l : List α) (b : β) :
+    (l.map (fun a => (f a, a))).lookup b = l.find? fun a => b == f a := by
+  induction l <;> simp_all [lookup, find?]
+
+def List.All (P : α → Prop) : List α → Prop
+  | [] => True
+  | a::as => P a ∧ All P as
+
+theorem List.All.imp {P Q : α → Prop} (h : ∀ a, P a → Q a) : ∀ {l : List α}, l.All P → l.All Q
+  | [] => id
+  | _::_ => And.imp (h _) (List.All.imp h)
+
+theorem List.append_eq_append_of_length_le {a b c d : List α} (h : length a ≤ length c) :
+  a ++ b = c ++ d ↔ ∃ a', c = a ++ a' ∧ b = a' ++ d := by
+  rw [append_eq_append_iff, or_iff_left_iff_imp]
+  rintro ⟨c', rfl, rfl⟩
+  rw [← Nat.add_zero c.length, length_append,
+    Nat.add_le_add_iff_left, Nat.le_zero, length_eq_zero_iff] at h
+  subst h; exact ⟨[], by simp⟩
+
+@[simp] theorem List.nodup_reverse {l : List α} : Nodup (reverse l) ↔ Nodup l :=
+  pairwise_reverse.trans <| by simp only [Nodup, Ne, eq_comm]
+
+theorem List.foldl_congr
+    (H : ∀ a, ∀ x ∈ l, f a x = g a x) : foldl f a l = foldl g a l := by
+  induction l generalizing a <;> simp_all
+
+theorem List.idxOf_eq_length_iff [BEq α] [LawfulBEq α]
+    {a : α} {l : List α} : idxOf a l = length l ↔ a ∉ l := by
+  induction l with
+  | nil => exact iff_of_true rfl not_mem_nil
+  | cons b l ih =>
+    simp only [length, mem_cons, idxOf_cons]
+    rw [cond_eq_ite]
+    split <;> rename_i h <;> simp at h
+    · exact iff_of_false (by rintro ⟨⟩) fun H => H <| Or.inl h.symm
+    · simp only [Ne.symm h, false_or]
+      rw [← ih]
+      exact Nat.succ_inj
+
+theorem List.perm_cons_of_mem {l : List α} (h : a ∈ l) : ∃ l', l.Perm (a :: l') := by
+  obtain ⟨l₁, l₂, rfl⟩ := List.append_of_mem h; exact ⟨_, List.perm_middle⟩
+
+instance [BEq α] [LawfulBEq α] : PartialEquivBEq α where
+  symm h := by simp at *; exact h.symm
+  trans h1 h2 := by simp at *; exact h1.trans h2
+
+theorem beq_comm [BEq α] [PartialEquivBEq α] (a b : α) : (a == b) = (b == a) :=
+  Bool.eq_iff_iff.2 ⟨PartialEquivBEq.symm, PartialEquivBEq.symm⟩
+
+theorem List.mapM_eq_some {f : α → Option β} {l : List α} {l' : List β} :
+    l.mapM f = some l' ↔ List.Forall₂ (f · = some ·) l l' := by
+  induction l generalizing l' with
+  | nil => simp only [mapM_nil, pure, Option.some.injEq, forall₂_nil_left_iff, @eq_comm _ l']
+  | cons x l ih =>
+    simp [mapM_cons, Bind.bind, pure, Option.bind_eq_some_iff, Option.some.injEq,
+      forall₂_cons_left_iff, @eq_comm _ l', exists_and_left, ih]
+
+@[simp] theorem Option.bind_eq_none'' {o : Option α} {f : α → Option β} :
+    o.bind f = none ↔ ∀ a, o = some a → f a = none := by cases o <;> simp
+
+@[simp] theorem Option.forall_ne_some {o : Option α} : (∀ a, o ≠ some a) ↔ o = none := by
+  cases o <;> simp
+
+@[simp] theorem Option.orElse_eq_none {a : Option α} {b : Unit → Option α} :
+    a.orElse b = none ↔ a = none ∧ b () = none := by
+  cases a <;> simp [Option.orElse]
+
+inductive ReflTransGen (R : α → α → Prop) (a : α) : α → Prop where
+  | rfl : ReflTransGen R a a
+  | tail : ReflTransGen R a b → R b c → ReflTransGen R a c
+
+inductive ReflTransGen' (R : α → α → Prop) (c : α) : α → Prop where
+  | rfl : ReflTransGen' R c c
+  | head : R a b → ReflTransGen' R c b → ReflTransGen' R c a
+
+theorem ReflTransGen.trans
+    (H1 : ReflTransGen R a b) (H2 : ReflTransGen R b c) : ReflTransGen R a c := by
+  induction H2 with
+  | rfl => exact H1
+  | tail h1 h2 ih => exact ih.tail h2
+
+@[elab_as_elim] theorem ReflTransGen.headIndOn {P : (a : α) → ReflTransGen R a z → Prop}
+    (rfl : P z .rfl)
+    (head : ∀ {x y} (h1 : R x y) (h2 : ReflTransGen R y z),
+      P y h2 → P x (.trans (.tail .rfl h1) h2))
+    (H : ReflTransGen R a z) : P a H := by
+  induction H with
+  | rfl => exact rfl
+  | tail h1 h2 ih => exact ih (head h2 .rfl rfl) fun a1 a2 => head a1 (.tail a2 h2)
+
+instance [BEq α] [PartialEquivBEq α] [BEq β] [PartialEquivBEq β] : PartialEquivBEq (α × β) where
+  symm := by simp [(· == ·)]; grind [BEq.symm]
+  trans := by simp [(· == ·)]; grind [BEq.trans]
+
+instance [BEq α] [EquivBEq α] [BEq β] [EquivBEq β] : EquivBEq (α × β) where
+  rfl := by simp [(· == ·)]
+
+instance [BEq α] [Hashable α] [LawfulHashable α] [BEq β] [Hashable β] [LawfulHashable β] :
+    LawfulHashable (α × β) where
+  hash_eq a b h := by
+    simp [(· == ·)] at h
+    simp [hash, LawfulHashable.hash_eq _ _ h.1, LawfulHashable.hash_eq _ _ h.2]
+
+instance [BEq α] [PartialEquivBEq α] : PartialEquivBEq (List α) where
+  symm := by
+    simp [(· == ·)]; intro a b
+    induction a generalizing b <;> cases b <;> simp [List.beq]; grind [BEq.symm]
+  trans := by
+    simp [(· == ·)]; intro a b c
+    induction a generalizing b c <;> cases b <;> simp [List.beq]
+    cases c <;> simp [List.beq]; grind [BEq.trans]
+
+instance [BEq α] [EquivBEq α] : EquivBEq (List α) where
+  rfl {a} := by simp [(· == ·)]; induction a <;> simp [List.beq, *]
+
+end Ix.Theory.Named
+
+namespace BitVec
+
+variable (n : Nat)
+
+instance : TransOrd (BitVec n) :=
+  TransOrd.compareOfLessAndEq_of_antisymm_of_trans_of_total_of_not_le
+    BitVec.le_antisymm BitVec.le_trans BitVec.le_total BitVec.not_le
+
+instance : LawfulEqOrd (BitVec n) where
+  eq_of_compare := compareOfLessAndEq_eq_eq BitVec.le_refl BitVec.not_le |>.mp
+
+end BitVec
+
+namespace UInt64
+
+variable (n : Nat)
+
+instance : TransOrd UInt64 :=
+  TransOrd.compareOfLessAndEq_of_antisymm_of_trans_of_total_of_not_le
+    UInt64.le_antisymm UInt64.le_trans UInt64.le_total UInt64.not_le
+
+instance : LawfulEqOrd UInt64 where
+  eq_of_compare := compareOfLessAndEq_eq_eq UInt64.le_refl UInt64.not_le |>.mp
+
+end UInt64
+
diff --git a/Ix/Theory/Named/Std/Control.lean b/Ix/Theory/Named/Std/Control.lean
new file mode 100644
index 000000000..b515508ac
--- /dev/null
+++ b/Ix/Theory/Named/Std/Control.lean
@@ -0,0 +1,8 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+
+instance [Alternative m] : MonadLift Option m := ⟨fun | none => failure | some a => pure a⟩
diff --git a/Ix/Theory/Named/Std/HashMap.lean b/Ix/Theory/Named/Std/HashMap.lean
new file mode 100644
index 000000000..4b24f52a2
--- /dev/null
+++ b/Ix/Theory/Named/Std/HashMap.lean
@@ -0,0 +1,105 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Std.Data.HashMap.Lemmas
+import Lean
+
+namespace Std.Internal.List
+
+namespace Const
+
+def containsKey [BEq α] (a : α) : List (α × β) → Bool
+  | [] => false
+  | ⟨k, _⟩ :: l => k == a || containsKey a l
+
+def replaceEntry [BEq α] (k : α) (v : β) : List (α × β) → List (α × β)
+  | [] => []
+  | ⟨k', v'⟩ :: l => bif k' == k then ⟨k, v⟩ :: l else ⟨k', v'⟩ :: replaceEntry k v l
+
+def insertEntry [BEq α] (k : α) (v : β) (l : List (α × β)) : List (α × β) :=
+  bif containsKey k l then replaceEntry k v l else (k, v) :: l
+
+theorem insertEntry_perm_filter [BEq α] [PartialEquivBEq α]
+    (k : α) (v : β) {l : List (α × β)} (hl : l.Pairwise (fun a b => (a.1 == b.1) = false)) :
+    (insertEntry k v l).Perm <| (k, v) :: l.filter (¬k == ·.1) := by
+  unfold insertEntry
+  cases eq : containsKey k l <;> simp
+  · rw [List.filter_eq_self.2]
+    induction l <;> simp_all [containsKey, BEq.comm]; assumption
+  · induction l <;> simp_all [-List.pairwise_cons, containsKey, replaceEntry, List.filter, BEq.comm]
+    revert eq; cases h : k == _ <;> intro eq <;> simp_all
+    rename_i ih
+    · exact .trans (.cons _ ih) (.swap ..)
+    · rw [List.filter_eq_self.2]
+      intro ⟨a, b⟩ h'
+      have := hl.1 a b h'
+      refine Decidable.by_contra fun h2 => ?_
+      simp at h2
+      cases h2.symm.trans (BEq.congr_left h ▸ this)
+
+end Const
+
+theorem Const.containsKey_map [BEq α] (l : List ((_ : α) × β)) :
+    Const.containsKey k (l.map (fun x => (x.1, x.2))) = List.containsKey k l := by
+  induction l <;> simp [List.containsKey, Const.containsKey, *]
+
+theorem Const.replaceEntry_map [BEq α] (l : List ((_ : α) × β)) :
+    Const.replaceEntry k v (l.map (fun x => (x.1, x.2))) =
+    (List.replaceEntry k v l).map (fun x => (x.1, x.2)) := by
+  induction l <;> simp [List.replaceEntry, Const.replaceEntry, *]
+  cases _ == k <;> simp
+
+theorem Const.insertEntry_map [BEq α] (l : List ((_ : α) × β)) :
+    Const.insertEntry k v (l.map (fun x => (x.1, x.2))) =
+    (List.insertEntry k v l).map (fun x => (x.1, x.2)) := by
+  simp [List.insertEntry, Const.insertEntry, Const.containsKey_map, Const.replaceEntry_map]
+  cases List.containsKey k l <;> simp
+
+end Std.Internal.List
+
+namespace Std.DHashMap
+open Std.Internal.List Internal.Raw Internal.Raw₀
+
+variable [BEq α] [Hashable α] [EquivBEq α] [LawfulHashable α]
+
+theorem insert_perm_insertEntry (m : DHashMap α β) (a b) :
+    (insert m a b).toList.Perm (insertEntry a b m.toList) := by
+  simp [toList, toList_eq_toListModel]
+  exact toListModel_insert (WF.out m.2)
+
+theorem Const.insert_perm_insertEntry (m : DHashMap α fun _ => β) (a b) :
+    (Const.toList (insert m a b)).Perm (Const.insertEntry a b (Const.toList m)) := by
+  simp [Const.toList, Const.toList_eq_toListModel_map, Const.insertEntry_map]
+  exact (toListModel_insert (WF.out m.2)).map _
+
+end Std.DHashMap
+
+namespace Std.HashMap
+open Internal.List
+
+variable [BEq α] [Hashable α] [LawfulHashable α]
+
+theorem insert_toList [EquivBEq α] (m : HashMap α β) :
+    (insert m a b).toList.Perm ((a, b) :: m.toList.filter (¬a == ·.1)) := by
+  refine (DHashMap.Const.insert_perm_insertEntry m.1 a b).trans ?_
+  exact Const.insertEntry_perm_filter _ _ distinct_keys_toList
+
+theorem getElem?_eq_lookup_toList [LawfulBEq α] (m : HashMap α β) (a : α) :
+    m[a]? = m.toList.lookup a := by
+  apply Option.ext fun b => ?_
+  rw [← mem_toList_iff_getElem?_eq_some]
+  have := distinct_keys_toList (m := m); revert this
+  induction m.toList <;> intro H <;> simp_all [List.lookup]
+  split <;> simp_all [Prod.ext_iff]
+  simp [eq_comm]
+  rw [List.lookup_eq_none_iff.2]; · simp
+  simp; exact H.1
+
+theorem mem_of_getElem? [EquivBEq α] {m : HashMap α β} (h : m[a]? = some b) : a ∈ m := by
+  refine Decidable.by_contra fun h' => ?_
+  cases (getElem?_eq_none h').symm.trans h
+
+end Std.HashMap
diff --git a/Ix/Theory/Named/Std/NodupKeys.lean b/Ix/Theory/Named/Std/NodupKeys.lean
new file mode 100644
index 000000000..62418056c
--- /dev/null
+++ b/Ix/Theory/Named/Std/NodupKeys.lean
@@ -0,0 +1,45 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Batteries.Data.List.Perm
+import Batteries.Tactic.SeqFocus
+
+namespace List
+def NodupKeys (l : List (α × β)) : Prop := Nodup (l.map (·.1))
+
+theorem nodupKeys_iff_pairwise {l : List (α × β)} :
+    NodupKeys l ↔ Pairwise (fun a b => a.1 ≠ b.1) l := pairwise_map
+
+theorem NodupKeys.filter {l : List (α × β)} (p : α × β → Bool)
+    (H : NodupKeys l) : NodupKeys (l.filter p) := pairwise_map.2 <| (pairwise_map.1 H).filter _
+
+@[simp] theorem nodupKeys_cons : NodupKeys (a::l) ↔ (∀ a' ∈ l, a.1 ≠ a'.1) ∧ NodupKeys l := by
+  simp [nodupKeys_iff_pairwise]
+
+theorem Perm.nodupKeys_iff {l₁ l₂ : List (α × β)} (h : l₁ ~ l₂) :
+    NodupKeys l₁ ↔ NodupKeys l₂ := (h.map _).nodup_iff
+
+theorem Perm.lookup_eq [BEq α] [LawfulBEq α]
+    {l₁ l₂ : List (α × β)} (h : l₁ ~ l₂) (nd : l₁.NodupKeys) : l₁.lookup a = l₂.lookup a := by
+  induction h with
+  | nil => rfl
+  | cons _ _ ih => simp [lookup]; split <;> [rfl; exact ih (pairwise_cons.1 nd).2]
+  | swap _ h ih =>
+    simp at nd
+    simp [lookup]; split <;> split <;> rename_i h1 _ h2 <;> try rfl
+    simp at h1 h2; cases nd.1.1 (by rw [← h1, h2])
+  | trans h1 _ ih1 ih2 => exact (ih1 nd).trans (ih2 (h1.nodupKeys_iff.1 nd))
+
+theorem NodupKeys.lookup_eq_some [BEq α] [LawfulBEq α]
+    {l : List (α × β)} (nd : l.NodupKeys) : l.lookup a = some b ↔ (a, b) ∈ l := by
+  induction l with
+  | nil => simp
+  | cons p l ih =>
+    let (a', b') := p
+    simp [lookup] at nd ⊢; split <;> rename_i h
+    · simp at h; subst a'; simp [eq_comm]
+      exact (nomatch nd.1 _ _ · rfl)
+    · simp at h; simp [h, ih nd.2]
diff --git a/Ix/Theory/Named/Std/Ord.lean b/Ix/Theory/Named/Std/Ord.lean
new file mode 100644
index 000000000..ba02e49f8
--- /dev/null
+++ b/Ix/Theory/Named/Std/Ord.lean
@@ -0,0 +1,58 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Init.Data.Order.Ord
+
+/-!
+A device for proving `Std.TransCmp` for comparisons defined by *lexicographic products*, used for
+`Lean.Name.cmp` in `Ix.Theory.Named.Verify.Name` and for the level order in `Ix.Theory.Named.Verify.NormLt`.
+
+Transitivity of a lexicographic product needs more than transitivity of its components: when the
+first components compare `.eq` one has to know they compare `.eq` *in both directions* before the
+second components can be consulted. Recursive comparisons therefore do not prove `isLE_trans` at a
+triple `(a, b, c)` from `isLE_trans` at the sub-triple alone; one needs its rotations too. `Rot`
+below packages the three rotations, which is exactly the statement that goes through the induction.
+-/
+
+namespace Ix.Theory.Named
+open Std
+
+/-- The three rotations of transitivity for a comparison at a triple `a`, `b`, `c`, where
+`x = cmp a b`, `y = cmp b c`, `z = cmp a c`. Note that the second and third components are the
+first one at the rotated triples `(c, a, b)` and `(b, c, a)`, rewritten with `Ordering.swap`. -/
+def Rot (x y z : Ordering) : Prop :=
+  (x.isLE → y.isLE → z.isLE) ∧
+  (z.swap.isLE → x.isLE → y.swap.isLE) ∧
+  (y.isLE → z.swap.isLE → x.swap.isLE)
+
+/-- Lexicographic products satisfy `Rot` if the components do. The second component's rotations
+are only required when the first components are all `.eq`; this matters when the second component
+is a comparison that is only meaningful where the first component does not already decide, as for
+the level order, whose structural component compares unrelated constructors as `.eq`. -/
+theorem Rot.then' : Rot x y z → (x = .eq → y = .eq → z = .eq → Rot x' y' z') →
+    Rot (x.then x') (y.then y') (z.then z') := by
+  cases x <;> cases y <;> simp_all [Rot]; cases z <;> simp
+
+theorem Rot.then {x y z x' y' z' : Ordering}
+    (R : Rot x y z) (R' : Rot x' y' z') : Rot (x.then x') (y.then y') (z.then z') :=
+  R.then' fun _ _ _ => R'
+
+/-- Any `TransCmp` gives `Rot` at every triple: the rotations are `isLE_trans` at the rotated
+triples, rewritten with `OrientedCmp.eq_swap`. -/
+theorem Rot.of_transCmp {α} {cmp : α → α → Ordering} [TransCmp cmp] (a b c : α) :
+    Rot (cmp a b) (cmp b c) (cmp a c) := by
+  refine ⟨fun h₁ h₂ => TransCmp.isLE_trans h₁ h₂, fun h₁ h₂ => ?_, fun h₁ h₂ => ?_⟩ <;>
+    rw [← OrientedCmp.eq_swap (cmp := cmp)] at * <;>
+    exact TransCmp.isLE_trans h₁ h₂
+
+/-- `Rot` at every triple, plus orientedness, is exactly `TransCmp`. -/
+theorem TransCmp.of_rot {α} {cmp : α → α → Ordering}
+    (swap : ∀ a b : α, cmp a b = (cmp b a).swap)
+    (rot : ∀ a b c : α, Rot (cmp a b) (cmp b c) (cmp a c)) : TransCmp cmp where
+  eq_swap := swap ..
+  isLE_trans h₁ h₂ := (rot ..).1 h₁ h₂
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Std/PersistentHashMap.lean b/Ix/Theory/Named/Std/PersistentHashMap.lean
new file mode 100644
index 000000000..b5c3cff01
--- /dev/null
+++ b/Ix/Theory/Named/Std/PersistentHashMap.lean
@@ -0,0 +1,48 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Data.SMap
+import Std.Data.HashMap.Lemmas
+import Ix.Theory.Named.Verify.Axioms
+
+namespace Lean.PersistentHashMap
+
+@[simp] theorem toList'_empty [BEq α] [Hashable α] :
+    (.empty : PersistentHashMap α β).toList' = [] := by
+  have this n : @Node.toList' α β (.entries ⟨.replicate n .null⟩) = [] := by
+    simp [Node.toList']
+    induction n <;> simp [*, List.replicate_succ]
+  apply this
+
+@[simp] theorem toList'_empty' [BEq α] [Hashable α] :
+    ({} : PersistentHashMap α β).toList' = [] := toList'_empty
+
+theorem find?_isSome {α β} [BEq α] [Hashable α]
+    (m : PersistentHashMap α β) (a : α) : m.contains a = (m.find? a).isSome := findAux_isSome ..
+
+theorem WF.nodupKeys [BEq α] [Hashable α]
+    [LawfulBEq α] [LawfulHashable α]
+    {m : PersistentHashMap α β} (h : WF m) : m.toList'.NodupKeys := by
+  induction h with
+  | empty => simp; exact .nil
+  | insert h1 ih =>
+    refine (h1.toList'_insert ..).nodupKeys_iff.2 (List.nodupKeys_cons.2 ⟨?_, ih.filter _⟩)
+    rintro _ h3 rfl
+    simpa using (List.mem_filter.1 h3).2
+
+variable [BEq α] [LawfulBEq α] [Hashable α] [LawfulHashable α] in
+theorem WF.find?_insert {s : PersistentHashMap α β} (h : s.WF) :
+    (s.insert k v).find? x = if k == x then some v else s.find? x := by
+  rw [h.insert.find?_eq, h.find?_eq, BEq.comm,
+    (h.toList'_insert ..).lookup_eq h.insert.nodupKeys, List.lookup]
+  cases eq : x == k <;> simp
+  induction s.toList' with
+  | nil => rfl
+  | cons kv l ih =>
+    simp [List.filter]; split <;> simp [List.lookup, *]
+    split <;> [skip; rfl]
+    rename_i h1 _ h2
+    simp at h1 h2; simp [h1, h2] at eq
diff --git a/Ix/Theory/Named/Std/SMap.lean b/Ix/Theory/Named/Std/SMap.lean
new file mode 100644
index 000000000..592aacf7d
--- /dev/null
+++ b/Ix/Theory/Named/Std/SMap.lean
@@ -0,0 +1,83 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Data.SMap
+import Std.Data.HashMap.Lemmas
+import Ix.Theory.Named.Std.HashMap
+import Ix.Theory.Named.Std.PersistentHashMap
+
+namespace Lean.SMap
+
+variable [BEq α] [Hashable α]
+structure WF (s : SMap α β) where
+  map₂ : s.map₂.WF
+  stage : s.stage₁ → s.map₂ = .empty
+  disjoint : s.map₂.contains a → ¬a ∈ s.map₁
+
+theorem WF.empty : WF ({} : SMap α β) := ⟨.empty, fun _ => rfl, by simp⟩
+
+protected nonrec theorem WF.insert [LawfulBEq α] [LawfulHashable α] {s : SMap α β}
+    (h : s.WF) (k : α) (v : β) (hn : s.find? k = none) : (s.insert k v).WF := by
+  unfold insert; split
+  · refine ⟨h.map₂, h.stage, fun _ h' => ?_⟩
+    have := h.stage
+    simp_all [find?, PersistentHashMap.find?_isSome, PersistentHashMap.WF.empty.find?_eq]
+  · refine ⟨h.map₂.insert .., nofun, fun h1 => ?_⟩
+    simp_all [PersistentHashMap.find?_isSome, h.map₂.find?_insert]
+    revert ‹_›; split
+    · simp_all [find?]
+    · exact h.disjoint ∘ by simp [PersistentHashMap.find?_isSome]
+
+variable [LawfulBEq α] [LawfulHashable α] in
+theorem WF.find?_insert {s : SMap α β} (h : s.WF) :
+    (s.insert k v).find? x = if k == x then some v else s.find? x := by
+  unfold insert; split <;> simp [find?]
+  · exact Std.HashMap.getElem?_insert (α := α)
+  · rw [h.map₂.find?_insert]; split <;> rfl
+
+noncomputable def toList' [BEq α] [Hashable α] (m : SMap α β) :
+    List (α × β) := m.map₂.toList' ++ m.map₁.toList
+
+open scoped _root_.List in
+theorem WF.toList'_insert {α β} [BEq α] [LawfulBEq α] [Hashable α] [LawfulHashable α]
+    {m : SMap α β} (wf : WF m) (a : α) (b : β)
+    (h : m.find? a = none) :
+    (m.insert a b).toList' ~ (a, b) :: m.toList' := by
+  unfold insert; split <;> simp [toList']
+  · have : EquivBEq α := inferInstance; clear ‹LawfulBEq _›
+    have := wf.stage rfl; simp [find?] at this h; subst this; simp
+    refine (List.filter_eq_self.2 ?_ ▸ Std.HashMap.insert_toList (α := α) .. :)
+    rintro ⟨a', b⟩ h
+    refine Decidable.by_contra fun h2 => ?_
+    simp at h2
+    have := Std.HashMap.getElem?_eq_some_iff_exists_beq_and_mem_toList.2 ⟨_, h2, h⟩
+    exact ‹¬_› (Std.HashMap.mem_of_getElem? this)
+  · refine .append_right (l₂ := _::_) _ ?_
+    refine (List.filter_eq_self.2 ?_ ▸ wf.map₂.toList'_insert .. :)
+    rintro ⟨a', b⟩ h'
+    have := wf.map₂.find?_eq a
+    simp_all [find?]; rintro rfl
+    exact h.1 _ _ h' rfl
+
+theorem WF.find?_eq {α β} [BEq α] [Hashable α] [LawfulBEq α] [LawfulHashable α]
+    {m : SMap α β} (wf : WF m) (a : α) : m.find? a = m.toList'.lookup a := by
+  simp [find?]; split
+  · cases wf.stage rfl
+    simp [toList']
+    exact Std.HashMap.getElem?_eq_lookup_toList ..
+  · simp [toList', List.lookup_append, wf.map₂.find?_eq]
+    cases List.lookup a .. <;> simp [Std.HashMap.getElem?_eq_lookup_toList]
+
+theorem WF.find?'_eq_find? {α β} [BEq α] [Hashable α] [EquivBEq α] [LawfulHashable α]
+    {m : SMap α β} (wf : WF m) (a : α) : m.find?' a = m.find? a := by
+  simp [find?, find?']; split; · rfl
+  rename_i m₁ m₂
+  cases e1 : m₁[a]? <;> cases e2 : m₂.find? a <;> simp
+  cases wf.disjoint (by simp [PersistentHashMap.find?_isSome, e2]) (Std.HashMap.mem_of_getElem? e1)
+
+theorem find?_isSome {α β} [BEq α] [Hashable α] [EquivBEq α] [LawfulHashable α]
+    (m : SMap α β) (a : α) : m.contains a = (m.find? a).isSome := by
+  simp [find?, contains]; split <;> simp [← PersistentHashMap.find?_isSome, Bool.or_comm]
diff --git a/Ix/Theory/Named/Std/ToExpr.lean b/Ix/Theory/Named/Std/ToExpr.lean
new file mode 100644
index 000000000..10f05c232
--- /dev/null
+++ b/Ix/Theory/Named/Std/ToExpr.lean
@@ -0,0 +1,73 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+/-
+Copyright (c) 2023 Kyle Miller. All rights reserved.
+Released under Apache 2.0 license as described in the file LICENSE.
+Authors: Kyle Miller
+-/
+import Lean
+
+/-! # `ToExpr` instances for Mathlib
+
+This module should be imported by any module that intends to define `ToExpr` instances.
+It provides necessary dependencies (the `Lean.ToLevel` class) and it also overrides the instances
+that come from core Lean 4 that do not handle universe polymorphism.
+(See the module `Lean.ToExpr` for the instances that are overridden.)
+
+In addition, we provide some additional `ToExpr` instances for core definitions.
+-/
+
+set_option autoImplicit true
+
+namespace Mathlib
+open Lean
+
+deriving instance ToExpr for Int
+
+deriving instance ToExpr for ULift
+
+/-- Hand-written instance since `PUnit` is a `Sort` rather than a `Type`. -/
+instance [ToLevel.{u}] : ToExpr PUnit.{u+1} where
+  toExpr _ := mkConst ``PUnit.unit [toLevel.{u+1}]
+  toTypeExpr := mkConst ``PUnit [toLevel.{u+1}]
+
+deriving instance ToExpr for String.Pos.Raw
+deriving instance ToExpr for Substring.Raw
+deriving instance ToExpr for SourceInfo
+deriving instance ToExpr for Syntax.Preresolved
+deriving instance ToExpr for Syntax
+
+open DataValue in
+/-- Core of a hand-written `ToExpr` handler for `MData`.
+Uses the `KVMap.set*` functions rather than going into the internals
+of the `KVMap` data structure. -/
+private def toExprMData (md : MData) : Expr := Id.run do
+  let mut e := mkConst ``MData.empty
+  for (k, v) in md do
+    let k := toExpr k
+    e := match v with
+          | ofString v => mkApp3 (mkConst ``KVMap.setString) e k (mkStrLit v)
+          | ofBool v   => mkApp3 (mkConst ``KVMap.setBool) e k (toExpr v)
+          | ofName v   => mkApp3 (mkConst ``KVMap.setName) e k (toExpr v)
+          | ofNat v    => mkApp3 (mkConst ``KVMap.setNat) e k (mkNatLit v)
+          | ofInt v    => mkApp3 (mkConst ``KVMap.setInt) e k (toExpr v)
+          | ofSyntax v => mkApp3 (mkConst ``KVMap.setSyntax) e k (toExpr v)
+  return e
+
+instance : ToExpr MData where
+  toExpr := toExprMData
+  toTypeExpr := mkConst ``MData
+
+deriving instance ToExpr for FVarId
+deriving instance ToExpr for MVarId
+deriving instance ToExpr for LevelMVarId
+deriving instance ToExpr for Level
+deriving instance ToExpr for BinderInfo
+deriving instance ToExpr for Literal
+deriving instance ToExpr for Expr
+
+end Mathlib
diff --git a/Ix/Theory/Named/Std/VariableBang.lean b/Ix/Theory/Named/Std/VariableBang.lean
new file mode 100644
index 000000000..6adf62d4d
--- /dev/null
+++ b/Ix/Theory/Named/Std/VariableBang.lean
@@ -0,0 +1,22 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean
+
+macro "variable!" args:(ppSpace colGt bracketedBinder)+ " in"
+    cmd:ppDedent(command) : command => do
+  let mut incls := #[]
+  for a in args do
+    match a with
+    | `(bracketedBinder| ($as* $[: $_]?))
+    | `(bracketedBinder| {$as* $[: $_]?})
+    | `(bracketedBinder| ⦃$as* $[: $_]?⦄) =>
+      for a in as do
+        match a with | `(_) => pure () | _ => incls := incls.push ⟨a.raw⟩
+    | `(bracketedBinder| [$a : $_]) =>
+      match a with | `(_) => pure () | _ => incls := incls.push ⟨a.raw⟩
+    | _ => pure ()
+  `(command| variable $args* in include $incls* in $(⟨cmd.raw⟩))
diff --git a/Ix/Theory/Named/Typing/Basic.lean b/Ix/Theory/Named/Typing/Basic.lean
new file mode 100644
index 000000000..fe962ac82
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Basic.lean
@@ -0,0 +1,141 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.VEnv
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Ix.Theory.Named
+
+inductive Lookup : List VExpr → Nat → VExpr → Prop where
+  | zero : Lookup (ty::Γ) 0 ty.lift
+  | succ : Lookup Γ n ty → Lookup (A::Γ) (n+1) ty.lift
+
+/-- A context-wide predicate, exposing each binder in its preceding context. -/
+def OnCtx (Γ : List VExpr) (P : List VExpr → VExpr → Prop) : Prop :=
+  match Γ with
+  | [] => True
+  | A::Γ => OnCtx Γ P ∧ P Γ A
+
+namespace VEnv
+
+section
+set_option hygiene false
+local notation:65 Γ " ⊢ " e " : " A:30 => IsDefEq Γ e e A
+local notation:65 Γ " ⊢ " e1 " ≡ " e2 " : " A:30 => IsDefEq Γ e1 e2 A
+variable (env : VEnv) (uvars : Nat)
+
+mutual
+
+inductive IsDefEq : List VExpr → VExpr → VExpr → VExpr → Prop where
+  | bvar : Lookup Γ i A → Γ ⊢ .bvar i : A
+  | symm : Γ ⊢ e ≡ e' : A → Γ ⊢ e' ≡ e : A
+  | trans : Γ ⊢ e₁ ≡ e₂ : A → Γ ⊢ e₂ ≡ e₃ : A → Γ ⊢ e₁ ≡ e₃ : A
+  | sortDF :
+    l.WF uvars → l'.WF uvars → l ≈ l' →
+    Γ ⊢ .sort l ≡ .sort l' : .sort (.succ l)
+  | constDF :
+    env.constants c = some ci →
+    (∀ l ∈ ls, l.WF uvars) →
+    (∀ l ∈ ls', l.WF uvars) →
+    ls.length = ci.uvars →
+    List.Forall₂ (· ≈ ·) ls ls' →
+    Γ ⊢ .const c ls ≡ .const c ls' : ci.type.instL ls
+  | appDF :
+    Γ ⊢ f ≡ f' : .forallE A B →
+    Γ ⊢ a ≡ a' : A →
+    Γ ⊢ .app f a ≡ .app f' a' : B.inst a
+  | lamDF :
+    Γ ⊢ A ≡ A' : .sort u →
+    A::Γ ⊢ body ≡ body' : B →
+    Γ ⊢ .lam A body ≡ .lam A' body' : .forallE A B
+  | forallEDF :
+    Γ ⊢ A ≡ A' : .sort u →
+    A::Γ ⊢ body ≡ body' : .sort v →
+    Γ ⊢ .forallE A body ≡ .forallE A' body' : .sort (.imax u v)
+  | defeqDF : Γ ⊢ A ≡ B : .sort u → Γ ⊢ e1 ≡ e2 : A → Γ ⊢ e1 ≡ e2 : B
+  | beta :
+    A::Γ ⊢ e : B → Γ ⊢ e' : A →
+    Γ ⊢ .app (.lam A e) e' ≡ e.inst e' : B.inst e'
+  | eta :
+    Γ ⊢ e : .forallE A B →
+    Γ ⊢ .lam A (.app e.lift (.bvar 0)) ≡ e : .forallE A B
+  | structEta :
+    env.structEtas rule →
+    (∀ level ∈ levels, level.WF uvars) →
+    levels.length = rule.uvars →
+    params.length = rule.nparams →
+    SpineWF Γ (rule.familyType.instL levels) params (.sort resultLevel) →
+    Γ ⊢ major : rule.structureType levels params →
+    Γ ⊢ rule.rebuild levels params major :
+      rule.structureType levels params →
+    Γ ⊢ rule.rebuild levels params major ≡ major :
+      rule.structureType levels params
+  | proofIrrel :
+    Γ ⊢ p : .sort .zero → Γ ⊢ h : p → Γ ⊢ h' : p →
+    Γ ⊢ h ≡ h' : p
+  | extra :
+    env.defeqs df → (∀ l ∈ ls, l.WF uvars) → ls.length = df.uvars →
+    Γ ⊢ df.lhs.instL ls ≡ df.rhs.instL ls : df.type.instL ls
+
+/-- Typing of an application spine against an iterated pi type: peeling the
+expressions of `es` off `A` one instantiation at a time ends at `B`.
+
+This judgment is mutually inductive with `IsDefEq` so rules whose validity
+depends on an exact application spine retain induction hypotheses for every
+argument typing derivation. -/
+inductive SpineWF : List VExpr → VExpr → List VExpr → VExpr → Prop where
+  | nil : SpineWF Γ A [] A
+  | cons :
+    IsDefEq Γ e e A₁ →
+    SpineWF Γ (A₂.inst e) es B →
+    SpineWF Γ (.forallE A₁ A₂) (e :: es) B
+
+end
+
+end
+
+def HasType (env : VEnv) (U : Nat) (Γ : List VExpr) (e A : VExpr) : Prop :=
+  IsDefEq env U Γ e e A
+
+def IsType (env : VEnv) (U : Nat) (Γ : List VExpr) (A : VExpr) : Prop :=
+  ∃ u, env.HasType U Γ A (.sort u)
+
+def IsDefEqU (env : VEnv) (U : Nat) (Γ : List VExpr) (e₁ e₂ : VExpr) :=
+  ∃ A, env.IsDefEq U Γ e₁ e₂ A
+
+end VEnv
+
+def VExpr.WF (env : VEnv) (U : Nat) (Γ : List VExpr) (e : VExpr) := env.IsDefEqU U Γ e e
+
+def VConstant.WF (env : VEnv) (ci : VConstant) : Prop := env.IsType ci.uvars [] ci.type
+
+def VDefEq.WF (env : VEnv) (df : VDefEq) : Prop :=
+  env.HasType df.uvars [] df.lhs df.type ∧ env.HasType df.uvars [] df.rhs df.type
+
+/-- Subject-reduction package attached to a registered structure-eta
+descriptor.  It consumes the exact family parameter spine but contains no
+equality premise. -/
+structure VStructEta.WF (rule : VStructEta) (env : VEnv) : Prop where
+  /-- The retained family declaration is a closed constant type.  This is the
+  syntactic fact which lets an exact parameter-spine certificate survive term
+  weakening and substitution. -/
+  familyType_closed : rule.familyType.ClosedN
+  rebuild_hasType :
+    ∀ {env' : VEnv}, env ≤ env' →
+      ∀ {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+      {params : List VExpr} {major : VExpr},
+      OnCtx Γ (env'.IsType U) →
+      (∀ level ∈ levels, level.WF U) →
+      levels.length = rule.uvars →
+      params.length = rule.nparams →
+      (∃ resultLevel,
+        env'.SpineWF U Γ (rule.familyType.instL levels)
+          params (.sort resultLevel)) →
+      env'.HasType U Γ major (rule.structureType levels params) →
+      env'.HasType U Γ (rule.rebuild levels params major)
+        (rule.structureType levels params)
diff --git a/Ix/Theory/Named/Typing/Env.lean b/Ix/Theory/Named/Typing/Env.lean
new file mode 100644
index 000000000..b3e009d29
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Env.lean
@@ -0,0 +1,79 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.Basic
+import Ix.Theory.Named.VDecl
+import Ix.Theory.Named.Quot
+import Ix.Theory.Named.Inductive
+import Ix.Theory.Named.NestedInductive
+
+namespace Ix.Theory.Named
+
+def VDefVal.WF (env : VEnv) (ci : VDefVal) : Prop := env.HasType ci.uvars [] ci.value ci.type
+
+/-- Add a block of constants, without their defining equations. -/
+def VEnv.addConsts (env : VEnv) (cis : List VDefVal) : Option VEnv :=
+  cis.foldlM (fun env ci => env.addConst ci.name ci.toVConstant) env
+
+/-- Add the defining equations of a block, after all of its constants. -/
+def VEnv.addDefEqs (env : VEnv) (cis : List VDefVal) : VEnv :=
+  cis.foldl (fun env ci => env.addDefEq ci.toDefEq) env
+
+inductive VDecl.WF : VEnv → VDecl → VEnv → Prop where
+  | axiom :
+    ci.WF env →
+    env.addConst ci.name ci.toVConstant = some env' →
+    VDecl.WF env (.axiom ci) env'
+  | def :
+    ci.WF env →
+    env.addConst ci.name ci.toVConstant = some env' →
+    VDecl.WF env (.def ci) (env'.addDefEq ci.toDefEq)
+  | mutualDef :
+    (∀ ci ∈ cis, ci.toVConstant.WF env) →
+    env.addConsts cis = some env' →
+    (∀ ci ∈ cis, ci.WF env') →
+    VDecl.WF env (.mutualDef cis) (env'.addDefEqs cis)
+  | opaque :
+    ci.WF env →
+    env.addConst ci.name ci.toVConstant = some env' →
+    VDecl.WF env (.opaque ci) env'
+  | example :
+    ci.WF env →
+    VDecl.WF env (.example ci) env
+  | quot :
+    env.QuotReady →
+    env.addQuot = some env' →
+    VDecl.WF env .quot env'
+  | induct {gen : decl.GenerationChecked} :
+    gen.WF env →
+    env.addInductGeneration gen = some env' →
+    VDecl.WF env (.induct decl) env'
+  | inductBlock {gen : decl.BlockGenerationChecked} :
+    gen.WF env blockEnv →
+    env.addInductBlockGeneration gen = some env' →
+    VDecl.WF env (.induct decl) env'
+  | inductNested {nested : decl.NestedBlockChecked} :
+    nested.WF env →
+    env.addInductNested nested = some env' →
+    VDecl.WF env (.induct decl) env'
+
+inductive VEnv.WF' : List VDecl → VEnv → Prop where
+  | empty : VEnv.WF' [] .empty
+  | decl {env} : VDecl.WF env d env' → env.WF' ds → env'.WF' (d::ds)
+  /-- A checked structure-eta descriptor is an environment capability, not a
+  source declaration.  Keep it in the environment history without inventing
+  a `VDecl`; its subject-reduction certificate is exactly the premise used by
+  `Ordered.structEta`. -/
+  | structEta {env : VEnv} {rule : VStructEta} : rule.WF env → env.WF' ds →
+      (env.addStructEta rule).WF' ds
+
+def VEnv.WF (env : VEnv) : Prop := ∃ ds, VEnv.WF' ds env
+
+/- A normalized inductive history entry carries only the standard Theory
+logical baseline; in particular it cannot import Verify's implementation
+axioms into `VEnv.WF`. -/
+#guard_named_axioms Ix.Theory.Named.VDecl.WF.induct [propext, Quot.sound]
diff --git a/Ix/Theory/Named/Typing/EnvLemmas.lean b/Ix/Theory/Named/Typing/EnvLemmas.lean
new file mode 100644
index 000000000..892e68530
--- /dev/null
+++ b/Ix/Theory/Named/Typing/EnvLemmas.lean
@@ -0,0 +1,120 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Lemmas
+import Ix.Theory.Named.Typing.Env
+import Ix.Theory.Named.Typing.QuotLemmas
+import Ix.Theory.Named.Typing.InductiveLemmas
+import Ix.Theory.Named.Typing.NestedInductiveLemmas
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+theorem VEnv.addConsts_le {env env' : VEnv} : ∀ {cis}, env.addConsts cis = some env' → env ≤ env'
+  | [], h => by cases h; exact .rfl
+  | _ :: _, h => by
+    simp [VEnv.addConsts, Option.bind_eq_some_iff] at h
+    obtain ⟨_, h1, h2⟩ := h
+    exact (addConst_le h1).trans (addConsts_le h2)
+
+theorem VEnv.addConst_eq_none {env : VEnv} {name ci}
+    (h : env.constants name = none) : ∃ env', env.addConst name ci = some env' := by
+  unfold VEnv.addConst; rw [h]; exact ⟨_, rfl⟩
+
+theorem VEnv.addConst_constants_eq {env env' : VEnv} {name ci}
+    (h : env.addConst name ci = some env') :
+    env'.constants = fun n => if name = n then some ci else env.constants n := by
+  unfold VEnv.addConst at h; split at h <;> cases h; rfl
+
+/-- A block of constants can be added as long as each name is fresh and the block has no
+duplicates; the latter is what `addMutual`'s `found` set checks. -/
+theorem VEnv.exists_addConsts {env : VEnv} : ∀ {cis : List VDefVal},
+    (∀ ci ∈ cis, env.constants ci.name = none) → (cis.map (·.name)).Nodup →
+    ∃ env', env.addConsts cis = some env'
+  | [], _, _ => ⟨_, rfl⟩
+  | ci :: cis, hfresh, hnd => by
+    obtain ⟨env₁, h₁⟩ := VEnv.addConst_eq_none (ci := ci.toVConstant) (hfresh _ (.head _))
+    rw [List.map_cons, List.nodup_cons] at hnd
+    have ⟨env₂, h₂⟩ := VEnv.exists_addConsts (env := env₁) (cis := cis) (fun c hc => ?_) hnd.2
+    · exact ⟨env₂, by simp [VEnv.addConsts, h₁]; exact h₂⟩
+    · rw [VEnv.addConst_constants_eq h₁]
+      have : ci.name ≠ c.name := fun h => hnd.1 (List.mem_map.2 ⟨c, hc, h.symm⟩)
+      simp [this, hfresh c (.tail _ hc)]
+
+theorem VEnv.addConsts_congr {env : VEnv} : ∀ {cis cis' : List VDefVal},
+    List.Forall₂ (fun a b => a.toVConstVal = b.toVConstVal) cis cis' →
+    env.addConsts cis = env.addConsts cis'
+  | [], [], _ => rfl
+  | a :: _, b :: _, .cons h t => by
+    have h1 : a.name = b.name := congrArg VConstVal.name h
+    have h2 : a.toVConstant = b.toVConstant := congrArg VConstVal.toVConstant h
+    show (env.addConst a.name a.toVConstant).bind _ = (env.addConst b.name b.toVConstant).bind _
+    rw [h1, h2]
+    cases env.addConst b.name b.toVConstant
+    · rfl
+    · exact VEnv.addConsts_congr t
+
+theorem VEnv.addConsts_ordered {env env' : VEnv} : ∀ {cis}, Ordered env →
+    (∀ ci ∈ cis, ci.toVConstant.WF env) → env.addConsts cis = some env' → Ordered env'
+  | [], h, _, e => by cases e; exact h
+  | _ :: _, h, hw, e => by
+    simp [VEnv.addConsts, Option.bind_eq_some_iff] at e
+    obtain ⟨_, h1, h2⟩ := e
+    refine VEnv.addConsts_ordered (.const h (hw _ (.head _)) h1) (fun c hc => ?_) h2
+    exact (hw c (.tail _ hc)).mono (VEnv.addConst_le h1)
+
+theorem VEnv.addConsts_constants {env env' : VEnv} : ∀ {cis}, env.addConsts cis = some env' →
+    ∀ ci ∈ cis, env'.constants ci.name = some ci.toVConstant
+  | [], _, _, hc => nomatch hc
+  | _ :: _, e, c, hc => by
+    simp [VEnv.addConsts, Option.bind_eq_some_iff] at e
+    obtain ⟨_, h1, h2⟩ := e
+    cases hc with
+    | head => exact (VEnv.addConsts_le h2).constants (VEnv.addConst_self h1)
+    | tail _ hc => exact VEnv.addConsts_constants h2 c hc
+
+theorem VEnv.addDefEqs_ordered : ∀ {env : VEnv} {cis}, Ordered env →
+    (∀ ci ∈ cis, env.constants ci.name = some ci.toVConstant) →
+    (∀ ci ∈ cis, ci.WF env) → Ordered (env.addDefEqs cis)
+  | _, [], h, _, _ => h
+  | env, ci :: cis, h, hmem, hw => by
+    have hci : ci.WF env := hw _ (.head _)
+    have hord : Ordered (env.addDefEq ci.toDefEq) := by
+      refine .defeq h ⟨?_, hci⟩
+      simp [VDefVal.toDefEq]
+      rw [← (hci.levelWF ⟨⟩).2.2.instL_id]
+      exact .const (hmem _ (.head _)) VLevel.id_WF (by simp)
+    show Ordered ((env.addDefEq ci.toDefEq).addDefEqs cis)
+    refine VEnv.addDefEqs_ordered hord (fun c hc => ?_) (fun c hc => ?_)
+    · exact (VEnv.addDefEq_le (df := ci.toDefEq)).constants (hmem c (.tail _ hc))
+    · exact (hw c (.tail _ hc)).mono VEnv.addDefEq_le
+
+theorem VEnv.WF.ordered : WF env → Ordered env
+  | ⟨ds, H⟩ => by
+    induction H with
+    | empty => exact .empty
+    | decl h _ ih =>
+      cases h with
+      | «axiom» h1 h2 => exact .const ih h1 h2
+      | @«def» env env' ci h1 h2 =>
+        refine .defeq (.const ih (h1.isType ih ⟨⟩) h2) ⟨?_, ?_⟩
+        · simp [VDefVal.toDefEq]
+          rw [← (h1.levelWF ⟨⟩).2.2.instL_id]
+          exact .const (addConst_self h2) VLevel.id_WF (by simp)
+        · exact h1.mono (addConst_le h2)
+      | mutualDef h0 h1 h2 =>
+        exact VEnv.addDefEqs_ordered (VEnv.addConsts_ordered ih h0 h1)
+          (VEnv.addConsts_constants h1) h2
+      | «opaque» h1 h2 => exact .const ih (h1.isType ih ⟨⟩) h2
+      | «example» _ => exact ih
+      | quot h1 h2 => exact addQuot_WF ih h1 h2
+      | induct h1 h2 => exact addInductGeneration_WF ih h1 h2
+      | inductBlock h1 h2 => exact addInductBlockGeneration_WF ih h1 h2
+      | inductNested h1 h2 => exact VEnv.addInductNested_WF ih h1 h2
+    | structEta hwf _ ih => exact .structEta ih hwf
+
+instance : CoeOut (VEnv.WF env) env.Ordered := ⟨(·.ordered)⟩
diff --git a/Ix/Theory/Named/Typing/InductiveCertificate.lean b/Ix/Theory/Named/Typing/InductiveCertificate.lean
new file mode 100644
index 000000000..3f0afdf3e
--- /dev/null
+++ b/Ix/Theory/Named/Typing/InductiveCertificate.lean
@@ -0,0 +1,514 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.EnvLemmas
+import Ix.Theory.Named.Typing.InductivePattern
+import Ix.Theory.Named.Typing.NestedInductiveLemmas
+
+/-!
+# Consumer certificates for completed inductive blocks
+
+`BlockGenerationCertificate` is the semantic input to the block transaction.
+This module packages that input with one successful transaction and a
+well-formed dependency environment, then exports the stable consequences a
+consumer needs.  The package contains only Theory values and proofs: no
+implementation metadata, checker state, or normalization execution crosses
+this boundary.
+
+In particular, `BlockCertificate.ruleClosure` derives the closed payload
+required by the generated-pattern API from the registered, well-formed iota
+rules in the completed environment.  A consumer therefore does not need a
+second closedness assumption in order to use `IotaPat`.
+-/
+
+namespace Ix.Theory.Named
+
+namespace VInductDecl
+
+/-- One successful proof-carrying block transaction over an explicit
+dependency environment. -/
+structure BlockCertificate (source : VInductDecl) (before after : VEnv) where
+  semantic : source.BlockGenerationCertificate before
+  success : before.addInductBlockCertified semantic = some after
+  beforeWF : before.WF
+
+namespace BlockCertificate
+
+variable {source : VInductDecl} {before after : VEnv}
+
+/-- Package the ordinary raw `addInduct` entry point once its accepted block
+descriptor and semantic proof are known.  This is the compatibility bridge
+for consumers that still execute `addInduct`; no second transaction is run. -/
+def ofAddInduct
+    (generation : source.BlockGenerationChecked) (blockEnv : VEnv)
+    (hidentity : source.identityBlockGeneration? = some generation)
+    (hwf : generation.WF before blockEnv) (hbefore : before.WF)
+    (hadd : before.addInduct source = some after) :
+    BlockCertificate source before after where
+  semantic := ⟨generation, blockEnv, hwf⟩
+  success := by
+    unfold VEnv.addInduct at hadd
+    rw [hidentity] at hadd
+    exact hadd
+  beforeWF := hbefore
+
+/-- The exact generation descriptor retained by a completed block. -/
+abbrev generation (certificate : BlockCertificate source before after) :
+    source.BlockGenerationChecked :=
+  certificate.semantic.generation
+
+/-- Recover the four exact insertion phases of the completed block. -/
+theorem trace (certificate : BlockCertificate source before after) :
+    Nonempty (VEnv.AddInductBlockGenerationTrace before after
+      certificate.generation) :=
+  VEnv.addInductBlockCertified_trace certificate.success
+
+/-- The completed transaction is a genuine block declaration step. -/
+theorem declWF (certificate : BlockCertificate source before after) :
+    VDecl.WF before (.induct source) after := by
+  apply VDecl.WF.inductBlock certificate.semantic.wf
+  simpa only [VEnv.addInductBlockCertified_eq_addInductBlockGeneration] using
+    certificate.success
+
+/-- Extend the dependency-environment history with the certified block. -/
+theorem afterWF (certificate : BlockCertificate source before after) :
+    after.WF := by
+  rcases certificate.beforeWF with ⟨decls, hdecls⟩
+  exact ⟨.induct source :: decls, hdecls.decl certificate.declWF⟩
+
+/-- A completed block only grows its dependency environment. -/
+theorem envLE (certificate : BlockCertificate source before after) :
+    before ≤ after := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.le
+
+/-- Compatibility spelling for consumers of the historical
+`addInduct_le` growth theorem. -/
+theorem addInduct_le (certificate : BlockCertificate source before after) :
+    before ≤ after :=
+  certificate.envLE
+
+/-- Compatibility spelling for the preservation result traditionally
+exported as `addInduct_WF`. -/
+theorem addInduct_WF (certificate : BlockCertificate source before after) :
+    after.WF :=
+  certificate.afterWF
+
+/-- Recover success through the ordinary raw API when this certificate's
+descriptor is the declaration's identity descriptor. -/
+theorem addInduct
+    (certificate : BlockCertificate source before after)
+    (hidentity : source.identityBlockGeneration? =
+      some certificate.generation) :
+    before.addInduct source = some after := by
+  unfold VEnv.addInduct
+  rw [hidentity]
+  simpa [VEnv.addInductBlockCertified] using certificate.success
+
+/-- Every source family has its exact stored Theory value in the completed
+environment. -/
+theorem familyLookup (certificate : BlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types) :
+    after.constants family.name = some family.toVConstant := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.family_lookup hfamily
+
+/-- Every flattened source constructor has its exact stored Theory value in
+the completed environment. -/
+theorem constructorLookup
+    (certificate : BlockCertificate source before after)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ source.blockConstructorConstants) :
+    after.constants constructor.name = some constructor.toVConstant := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.ctor_lookup hconstructor
+
+/-- Every generated family recursor has its exact Theory value in the
+completed environment. -/
+theorem recursorLookup
+    (certificate : BlockCertificate source before after)
+    {recursor : VConstVal}
+    (hrecursor : recursor ∈ certificate.generation.recursors) :
+    after.constants recursor.name = some recursor.toVConstant := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.rec_lookup hrecursor
+
+/-- A source family name was fresh at the dependency boundary. -/
+theorem familyFresh (certificate : BlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types) :
+    before.constants family.name = none := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.family_fresh hfamily
+
+/-- A flattened source constructor name was fresh at the dependency
+boundary. -/
+theorem constructorFresh
+    (certificate : BlockCertificate source before after)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ source.blockConstructorConstants) :
+    before.constants constructor.name = none := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.ctor_fresh hconstructor
+
+/-- A generated recursor name was fresh at the dependency boundary. -/
+theorem recursorFresh
+    (certificate : BlockCertificate source before after)
+    {recursor : VConstVal}
+    (hrecursor : recursor ∈ certificate.generation.recursors) :
+    before.constants recursor.name = none := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.rec_fresh hrecursor
+
+/-- Every generated rule is registered by the completed transaction. -/
+theorem ruleRegistered
+    (certificate : BlockCertificate source before after)
+    {rule : VDefEq}
+    (hrule : rule ∈ certificate.generation.generatedRules) :
+    after.defeqs rule := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.rule_mem hrule
+
+/-- Every generated rule is well formed in the completed environment. -/
+theorem ruleWF
+    (certificate : BlockCertificate source before after)
+    {rule : VDefEq}
+    (hrule : rule ∈ certificate.generation.generatedRules) :
+    rule.WF after :=
+  certificate.afterWF.ordered.defEqWF (certificate.ruleRegistered hrule)
+
+/-- An exact family lookup is unique.  This small eliminator is convenient
+for consumers that translate their own family representation to a Theory
+constant and then compare it with the certificate inventory. -/
+theorem familyLookup_unique
+    (certificate : BlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types)
+    {constant : VConstant}
+    (hlookup : after.constants family.name = some constant) :
+    constant = family.toVConstant := by
+  exact Option.some.inj (hlookup.symm.trans (certificate.familyLookup hfamily))
+
+/-- An exact constructor lookup is unique. -/
+theorem constructorLookup_unique
+    (certificate : BlockCertificate source before after)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ source.blockConstructorConstants)
+    {constant : VConstant}
+    (hlookup : after.constants constructor.name = some constant) :
+    constant = constructor.toVConstant := by
+  exact Option.some.inj
+    (hlookup.symm.trans (certificate.constructorLookup hconstructor))
+
+/-- An exact generated-recursor lookup is unique. -/
+theorem recursorLookup_unique
+    (certificate : BlockCertificate source before after)
+    {recursor : VConstVal}
+    (hrecursor : recursor ∈ certificate.generation.recursors)
+    {constant : VConstant}
+    (hlookup : after.constants recursor.name = some constant) :
+    constant = recursor.toVConstant := by
+  exact Option.some.inj
+    (hlookup.symm.trans (certificate.recursorLookup hrecursor))
+
+private theorem rule_mem_generatedRules
+    (generation : source.BlockGenerationChecked)
+    {i : Nat} {constructor : NormalizedBlockCtor}
+    (hentry : generation.flatCtors[i]? = some constructor) :
+    generation.rule i constructor ∈ generation.generatedRules := by
+  apply List.mem_map.2
+  refine ⟨(constructor, i), ?_, rfl⟩
+  apply List.mem_of_getElem? (i := i)
+  rw [List.getElem?_zipIdx, hentry, Option.map_some, Nat.zero_add]
+
+private theorem closedN_lamN_body :
+    ∀ {binders : List VExpr} {body : VExpr} {k : Nat},
+      (VExpr.lamN binders body).ClosedN k →
+        body.ClosedN (k + binders.length)
+  | [], _, _, h => by
+      simpa only [VExpr.lamN, List.length_nil, Nat.add_zero] using h
+  | _ :: binders, body, k, h => by
+      have hbody := closedN_lamN_body (binders := binders)
+        (body := body) (k := k + 1) h.2
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using hbody
+
+private theorem closedN_lamN_replace :
+    ∀ {binders : List VExpr} {body body' : VExpr} {k : Nat},
+      (VExpr.lamN binders body).ClosedN k →
+      body'.ClosedN (k + binders.length) →
+        (VExpr.lamN binders body').ClosedN k
+  | [], _, _, _, _, hbody' => by
+      simpa only [VExpr.lamN, List.length_nil, Nat.add_zero] using hbody'
+  | _ :: binders, body, body', k, h, hbody' => by
+      refine ⟨h.1, closedN_lamN_replace (binders := binders)
+        (body := body) (body' := body') (k := k + 1) h.2 ?_⟩
+      simpa [Nat.add_assoc, Nat.add_comm, Nat.add_left_comm] using hbody'
+
+private theorem closedN_appN_function :
+    ∀ {function : VExpr} {arguments : List VExpr} {k : Nat},
+      (VExpr.appN function arguments).ClosedN k → function.ClosedN k
+  | _, [], _, h => by simpa only [VExpr.appN] using h
+  | function, argument :: arguments, k, h =>
+      (closedN_appN_function (function := function.app argument)
+        (arguments := arguments) (k := k) h).1
+
+private theorem closedN_appN_argument
+    {function : VExpr} {arguments : List VExpr} {k : Nat}
+    (hclosed : (VExpr.appN function arguments).ClosedN k)
+    {argument : VExpr} (hargument : argument ∈ arguments) :
+    argument.ClosedN k := by
+  induction arguments generalizing function with
+  | nil => simp at hargument
+  | cons head tail ih =>
+    rcases List.mem_cons.1 hargument with heq | htail
+    · rw [heq]
+      exact (closedN_appN_function
+        (function := function.app head) (arguments := tail)
+        (k := k) hclosed).2
+    · exact ih (function := function.app head) hclosed htail
+
+/-- The successful block transaction supplies the closedness bundle required
+by `IotaPat`.  Closedness is derived from the registered rules and the
+completed environment's ordinary WF history; it is not an additional
+consumer assumption. -/
+theorem ruleClosure
+    (certificate : BlockCertificate source before after) :
+    certificate.generation.RuleClosure := by
+  constructor
+  · intro i constructor hentry
+    have hmem := rule_mem_generatedRules certificate.generation hentry
+    exact (certificate.ruleWF hmem).2.closedN
+      certificate.afterWF.ordered trivial
+  · intro constructor hconstructor expression hexpression
+    obtain ⟨i, hentry⟩ := List.mem_iff_getElem?.1 hconstructor
+    have hmem := rule_mem_generatedRules certificate.generation hentry
+    have hlhs := (certificate.ruleWF hmem).1.closedN
+      certificate.afterWF.ordered trivial
+    rw [certificate.generation.rule_lhs i constructor] at hlhs
+    have hbody := closedN_lamN_body hlhs
+    have hexpression' : expression ∈
+        certificate.generation.ruleIdx constructor ++
+          [certificate.generation.ruleCtorApp constructor] :=
+      List.mem_append.2 (.inl hexpression)
+    have hclosed : expression.ClosedN
+        (certificate.generation.ruleBinders constructor).length := by
+      apply closedN_appN_argument
+        (function := certificate.generation.recBase
+          (certificate.generation.ruleFieldCount constructor)
+          constructor.owner)
+        (arguments := certificate.generation.ruleIdx constructor ++
+          [certificate.generation.ruleCtorApp constructor])
+      · simpa only [BlockGenerationChecked.ruleLhsBody, List.length_nil,
+          Nat.zero_add] using hbody
+      · exact hexpression'
+    apply closedN_lamN_replace hlhs
+    simpa using hclosed
+
+/-- The exact generated pattern and payload associated with one flattened
+rule entry. -/
+theorem recursorPattern
+    (certificate : BlockCertificate source before after)
+    {i : Nat} {constructor : NormalizedBlockCtor}
+    (hentry : certificate.generation.ruleEntry i constructor) :
+    certificate.generation.IotaPat certificate.ruleClosure
+      ((certificate.generation.rulePattern constructor).toPattern)
+      (certificate.generation.ruleRHS certificate.ruleClosure hentry,
+        certificate.generation.ruleCheck certificate.ruleClosure
+          (List.mem_of_getElem? hentry)) :=
+  .mk hentry
+
+/-- Rule-level consumer bundle: exact global position, generated-list
+membership, registration, well-formedness, and the corresponding Spec-10
+pattern all come from the same completed block. -/
+structure RecursorRuleFacts
+    (certificate : BlockCertificate source before after)
+    (i : Nat) (constructor : NormalizedBlockCtor) : Prop where
+  entry : certificate.generation.ruleEntry i constructor
+  member : certificate.generation.rule i constructor ∈
+    certificate.generation.generatedRules
+  registered : after.defeqs (certificate.generation.rule i constructor)
+  wf : (certificate.generation.rule i constructor).WF after
+  pattern : certificate.generation.IotaPat certificate.ruleClosure
+    ((certificate.generation.rulePattern constructor).toPattern)
+    (certificate.generation.ruleRHS certificate.ruleClosure entry,
+      certificate.generation.ruleCheck certificate.ruleClosure
+        (List.mem_of_getElem? entry))
+
+/-- Assemble all rule facts without a consumer-supplied semantic premise. -/
+theorem recursorRuleFacts
+    (certificate : BlockCertificate source before after)
+    {i : Nat} {constructor : NormalizedBlockCtor}
+    (hentry : certificate.generation.ruleEntry i constructor) :
+    certificate.RecursorRuleFacts i constructor := by
+  have hmember := rule_mem_generatedRules certificate.generation hentry
+  exact {
+    entry := hentry
+    member := hmember
+    registered := certificate.ruleRegistered hmember
+    wf := certificate.ruleWF hmember
+    pattern := certificate.recursorPattern hentry }
+
+end BlockCertificate
+
+/-! ## Completed nested transactions -/
+
+/-- One successful proof-carrying nested transaction over an explicit
+dependency environment.  As with `BlockCertificate`, this package contains
+only Theory artifacts. -/
+structure NestedBlockCertificate
+    (source : VInductDecl) (before after : VEnv) where
+  nested : source.NestedBlockChecked
+  semantic : nested.WF before
+  success : before.addInductNested nested = some after
+  beforeWF : before.WF
+
+namespace NestedBlockCertificate
+
+variable {source : VInductDecl} {before after : VEnv}
+
+/-- Recover the exact four-phase nested transaction trace. -/
+theorem trace (certificate : NestedBlockCertificate source before after) :
+    Nonempty (VEnv.AddInductNestedTrace before after certificate.nested) :=
+  VEnv.addInductNested_trace certificate.success
+
+/-- The nested completion is a genuine inductive declaration step. -/
+theorem declWF (certificate : NestedBlockCertificate source before after) :
+    VDecl.WF before (.induct source) after :=
+  .inductNested certificate.semantic certificate.success
+
+/-- Extend the dependency-environment history with the nested block. -/
+theorem afterWF (certificate : NestedBlockCertificate source before after) :
+    after.WF := by
+  rcases certificate.beforeWF with ⟨decls, hdecls⟩
+  exact ⟨.induct source :: decls, hdecls.decl certificate.declWF⟩
+
+/-- A completed nested transaction only grows its dependency environment. -/
+theorem envLE (certificate : NestedBlockCertificate source before after) :
+    before ≤ after :=
+  VEnv.addInductNested_le certificate.success
+
+/-- Nested analogue of the public block growth result. -/
+theorem addInduct_le
+    (certificate : NestedBlockCertificate source before after) :
+    before ≤ after :=
+  certificate.envLE
+
+/-- Nested analogue of the public block preservation result. -/
+theorem addInduct_WF
+    (certificate : NestedBlockCertificate source before after) :
+    after.WF :=
+  certificate.afterWF
+
+/-- Every stored source family has its exact final value. -/
+theorem familyLookup (certificate : NestedBlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types) :
+    after.constants family.name = some family.toVConstant := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.family_lookup hfamily
+
+/-- Every stored source constructor has its exact final value. -/
+theorem constructorLookup
+    (certificate : NestedBlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types)
+    {constructor : VConstVal} (hconstructor : constructor ∈ family.ctors) :
+    after.constants constructor.name = some constructor.toVConstant := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.ctor_lookup hfamily hconstructor
+
+/-- Every restored recursor has its exact final value. -/
+theorem recursorLookup
+    (certificate : NestedBlockCertificate source before after)
+    {recursor : VConstVal} (hrecursor : recursor ∈ certificate.nested.recursors) :
+    after.constants recursor.name = some recursor.toVConstant := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.rec_lookup hrecursor
+
+/-- Every source family name was fresh at the dependency boundary. -/
+theorem familyFresh (certificate : NestedBlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types) :
+    before.constants family.name = none := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.family_fresh hfamily
+
+/-- Every flattened source constructor name was fresh at the dependency
+boundary. -/
+theorem constructorFresh
+    (certificate : NestedBlockCertificate source before after)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ source.blockConstructorConstants) :
+    before.constants constructor.name = none := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.ctor_fresh hconstructor
+
+/-- Every restored recursor name was fresh at the dependency boundary. -/
+theorem recursorFresh
+    (certificate : NestedBlockCertificate source before after)
+    {recursor : VConstVal} (hrecursor : recursor ∈ certificate.nested.recursors) :
+    before.constants recursor.name = none := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.rec_fresh hrecursor
+
+/-- Every restored rule is registered in the completed environment. -/
+theorem ruleRegistered
+    (certificate : NestedBlockCertificate source before after)
+    {rule : VDefEq} (hrule : rule ∈ certificate.nested.generatedRules) :
+    after.defeqs rule := by
+  rcases certificate.trace with ⟨trace⟩
+  exact trace.rule_mem hrule
+
+/-- Every registered restored rule is well formed. -/
+theorem ruleWF
+    (certificate : NestedBlockCertificate source before after)
+    {rule : VDefEq} (hrule : rule ∈ certificate.nested.generatedRules) :
+    rule.WF after :=
+  certificate.afterWF.ordered.defEqWF (certificate.ruleRegistered hrule)
+
+/-- Exact family lookups are unique. -/
+theorem familyLookup_unique
+    (certificate : NestedBlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types)
+    {constant : VConstant}
+    (hlookup : after.constants family.name = some constant) :
+    constant = family.toVConstant :=
+  Option.some.inj (hlookup.symm.trans (certificate.familyLookup hfamily))
+
+/-- Exact constructor lookups are unique. -/
+theorem constructorLookup_unique
+    (certificate : NestedBlockCertificate source before after)
+    {family : VInductiveType} (hfamily : family ∈ source.types)
+    {constructor : VConstVal} (hconstructor : constructor ∈ family.ctors)
+    {constant : VConstant}
+    (hlookup : after.constants constructor.name = some constant) :
+    constant = constructor.toVConstant :=
+  Option.some.inj
+    (hlookup.symm.trans (certificate.constructorLookup hfamily hconstructor))
+
+/-- Exact restored-recursor lookups are unique. -/
+theorem recursorLookup_unique
+    (certificate : NestedBlockCertificate source before after)
+    {recursor : VConstVal} (hrecursor : recursor ∈ certificate.nested.recursors)
+    {constant : VConstant}
+    (hlookup : after.constants recursor.name = some constant) :
+    constant = recursor.toVConstant :=
+  Option.some.inj
+    (hlookup.symm.trans (certificate.recursorLookup hrecursor))
+
+end NestedBlockCertificate
+
+end VInductDecl
+
+end Ix.Theory.Named
+
+/-! ## Exact Theory trust guards -/
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockCertificate.afterWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockCertificate.ruleClosure [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockCertificate.recursorRuleFacts [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NestedBlockCertificate.afterWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NestedBlockCertificate.ruleWF [propext, Classical.choice, Quot.sound]
diff --git a/Ix/Theory/Named/Typing/InductiveLemmas.lean b/Ix/Theory/Named/Typing/InductiveLemmas.lean
new file mode 100644
index 000000000..398afdeec
--- /dev/null
+++ b/Ix/Theory/Named/Typing/InductiveLemmas.lean
@@ -0,0 +1,14628 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.Lemmas
+import Ix.Theory.Named.Typing.Env
+import Ix.Theory.Named.Typing.Meta
+import Ix.Theory.Named.Typing.Strong
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+/- Lean 4.31 no longer unfolds these structural recursors implicitly in a
+number of `simp`/`simpa` calls below.  Keep the compatibility normalization
+local to this proof module: all rules only reduce on a visible constructor. -/
+attribute [local simp] VExpr.appN VExpr.bvarRevRange VExpr.forallN VExpr.lamN
+  VExpr.liftTelN VExpr.liftN VExpr.inst VExpr.instL VLevel.inst
+
+/-! ## Basic facts about the stage-1 generation helpers -/
+
+end Ix.Theory.Named
+
+namespace Ix.Theory.VLevel
+
+theorem params'_length : (params' n k).length = n := by simp [params']
+
+theorem params'_wf : ∀ l ∈ params' n k, l.WF (n + k) := by
+  simp only [params', List.mem_map, List.mem_range]
+  rintro _ ⟨i, hi, rfl⟩; exact Nat.add_lt_add_right hi _
+
+theorem params'_one_wf : ∀ l ∈ params' n 1, l.WF (n + 1) := params'_wf
+
+theorem params_map_inst_params' :
+    (params n).map (VLevel.inst (params' n k)) = params' n k :=
+  inst_map_id params'_length
+
+end Ix.Theory.VLevel
+
+namespace Ix.Theory.Named
+
+attribute [local simp] VExpr.appN VExpr.bvarRevRange VExpr.forallN VExpr.lamN
+  VExpr.liftTelN VExpr.liftN VExpr.inst VExpr.instL VLevel.inst
+
+namespace VExpr
+
+theorem forallN_append (As Bs : List VExpr) (e : VExpr) :
+    forallN (As ++ Bs) e = forallN As (forallN Bs e) := by
+  induction As with
+  | nil => rfl
+  | cons A As ih => simp [forallN, ih]
+
+theorem instL_forallN (ls : List VLevel) (As : List VExpr) (e : VExpr) :
+    (forallN As e).instL ls = forallN (As.map (instL ls)) (e.instL ls) := by
+  induction As with
+  | nil => rfl
+  | cons A As ih => simp [forallN, instL, ih]
+
+/-- Substituting a variable for the sole loose variable is a lift. -/
+theorem inst_bvar_of_closedN (h : ClosedN e (k+1)) :
+    e.inst (.bvar n) k = e.liftN n k := by
+  induction e generalizing k with simp_all [ClosedN, inst, liftN]
+  | bvar i =>
+    simp only [instVar]
+    rcases Nat.lt_trichotomy i k with h' | rfl | h'
+    · simp [h', liftVar_lt h']
+    · simp [liftVar_le (Nat.le_refl _), liftN]
+    · omega
+
+theorem ClosedN.appN {f : VExpr} (hf : f.ClosedN k) {as : List VExpr}
+    (has : ∀ a ∈ as, ClosedN a k) : (appN f as).ClosedN k := by
+  induction as generalizing f with
+  | nil => exact hf
+  | cons a as ih =>
+    exact ih ⟨hf, has _ (.head _)⟩ fun a h => has _ (.tail _ h)
+
+theorem LevelWF.appN {f : VExpr} (hf : f.LevelWF U) {as : List VExpr}
+    (has : ∀ a ∈ as, LevelWF U a) : (appN f as).LevelWF U := by
+  induction as generalizing f with
+  | nil => exact hf
+  | cons a as ih =>
+    exact ih ⟨hf, has _ (.head _)⟩ fun a h => has _ (.tail _ h)
+
+theorem LevelWF.forallN {As : List VExpr} (hAs : ∀ A ∈ As, LevelWF U A)
+    {e : VExpr} (he : e.LevelWF U) : (forallN As e).LevelWF U := by
+  induction As with
+  | nil => exact he
+  | cons A As ih =>
+    exact ⟨hAs _ (.head _), ih fun A h => hAs _ (.tail _ h)⟩
+
+theorem LevelWF.lamN {As : List VExpr} (hAs : ∀ A ∈ As, LevelWF U A)
+    {e : VExpr} (he : e.LevelWF U) : (lamN As e).LevelWF U := by
+  induction As with
+  | nil => exact he
+  | cons A As ih =>
+    exact ⟨hAs _ (.head _), ih fun A h => hAs _ (.tail _ h)⟩
+
+theorem appN_append (f : VExpr) : ∀ (as bs : List VExpr),
+    f.appN (as ++ bs) = (f.appN as).appN bs
+  | [], _ => rfl
+  | a :: as, bs => appN_append (f.app a) as bs
+
+theorem bvarRevRange_liftN_low : ∀ (m off n : Nat),
+    (bvarRevRange off m).map (liftN n · 0) = bvarRevRange (n + off) m
+  | 0, _, _ => rfl
+  | m+1, off, n => by
+    show VExpr.bvar _ :: _ = VExpr.bvar _ :: _
+    rw [bvarRevRange_liftN_low m off n]
+    congr 2
+    show liftVar n (off + m) 0 = n + off + m
+    rw [liftVar_le (Nat.zero_le _)]; omega
+
+theorem bvarRevRange_liftN_high : ∀ (m off n k : Nat), off + m ≤ k →
+    (bvarRevRange off m).map (liftN n · k) = bvarRevRange off m
+  | 0, _, _, _, _ => rfl
+  | m+1, off, n, k, h => by
+    show VExpr.bvar _ :: _ = VExpr.bvar _ :: _
+    rw [bvarRevRange_liftN_high m off n k (by omega)]
+    congr 2
+    exact liftVar_lt (by omega)
+
+/-- Instantiating at a fresh (lifted-over) position is the identity. -/
+theorem inst_liftN1 : ∀ (e a : VExpr) (k : Nat), (e.liftN 1 k).inst a k = e := by
+  intro e
+  induction e with intro a k
+  | bvar j =>
+    show VExpr.instVar (liftVar 1 j k) a k = .bvar j
+    unfold liftVar VExpr.instVar
+    split
+    · rfl
+    · next h =>
+      rw [if_neg (by omega), if_neg (by omega)]
+      congr 1; omega
+  | sort | const => rfl
+  | app f b ihf ihb => simp [liftN, inst, ihf, ihb]
+  | lam A b ihA ihb | forallE A b ihA ihb => simp [liftN, inst, ihA, ihb]
+
+/-- Lifting a telescope of closed binders acts only on the body. -/
+theorem liftN_forallN_closed : ∀ {As : List VExpr}, (∀ A ∈ As, A.ClosedN 0) →
+    ∀ (e : VExpr) (n k : Nat),
+    (forallN As e).liftN n k = forallN As (e.liftN n (k + As.length))
+  | [], _, e, n, k => rfl
+  | A :: As, hAs, e, n, k => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    rw [(hAs _ (.head _)).liftN_eq (Nat.zero_le _),
+      liftN_forallN_closed (fun A h => hAs _ (.tail _ h)) e n (k+1),
+      show k+1+As.length = k+(As.length+1) from by omega]
+    rfl
+
+/-- Lifting through a dependent telescope. -/
+theorem liftN_forallN (n : Nat) : ∀ (tel : List VExpr) (X : VExpr) (k : Nat),
+    (forallN tel X).liftN n k = forallN (liftTelN n tel k) (X.liftN n (k + tel.length))
+  | [], _, _ => rfl
+  | A :: tel, X, k => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    rw [liftN_forallN n tel X (k+1),
+      show k+1+tel.length = k+(tel.length+1) from by omega]
+    rfl
+
+theorem liftTelN_length (n : Nat) : ∀ (tel : List VExpr) (k : Nat),
+    (liftTelN n tel k).length = tel.length
+  | [], _ => rfl
+  | _ :: tel, k => by simp [liftTelN, liftTelN_length n tel (k+1)]
+
+theorem liftTelN_liftTelN (a b : Nat) : ∀ (tel : List VExpr) (k : Nat),
+    liftTelN b (liftTelN a tel k) k = liftTelN (a+b) tel k
+  | [], _ => rfl
+  | A :: tel, k => by
+    show _ :: _ = _ :: _
+    rw [liftN'_liftN_hi, liftTelN_liftTelN a b tel (k+1)]
+
+theorem liftTelN_getElem? (n : Nat) : ∀ (tel : List VExpr) (k q : Nat),
+    (liftTelN n tel k)[q]? = tel[q]?.map fun A => A.liftN n (k+q)
+  | [], _, q => by simp [liftTelN]
+  | A :: tel, k, 0 => by simp [liftTelN]
+  | A :: tel, k, q+1 => by
+    simp only [liftTelN, List.getElem?_cons_succ]
+    rw [liftTelN_getElem? n tel (k+1) q, show k+1+q = k+(q+1) from by omega]
+
+theorem liftTelN_take (n : Nat) : ∀ (tel : List VExpr) (k q : Nat),
+    (liftTelN n tel k).take q = liftTelN n (tel.take q) k
+  | [], _, q => by simp [liftTelN]
+  | A :: tel, k, 0 => rfl
+  | A :: tel, k, q+1 => by
+    show A.liftN n k :: (liftTelN n tel (k+1)).take q = _
+    rw [liftTelN_take n tel (k+1) q]
+    rfl
+
+/-- Merging a telescope lift over another when the outer cutoff sits right
+past the inner lift. -/
+theorem liftTelN_liftTelN_hi (a b : Nat) : ∀ (tel : List VExpr) (k : Nat),
+    liftTelN b (liftTelN a tel k) (k + a) = liftTelN (a + b) tel k
+  | [], _ => rfl
+  | A :: tel, k => by
+    show (A.liftN a k).liftN b (k+a) :: _ = _
+    rw [liftN'_liftN' (Nat.le_add_right _ _) (by omega),
+      show k + a + 1 = (k+1) + a from by omega,
+      liftTelN_liftTelN_hi a b tel (k+1)]
+    rfl
+
+/-- `liftTelN_liftTelN_hi` with the outer cutoff generalized, for
+syntactic rewriting. -/
+theorem liftTelN_liftTelN_hi' (a b : Nat) (tel : List VExpr) (k : Nat) {cut : Nat}
+    (hcut : cut = k + a) :
+    liftTelN b (liftTelN a tel k) cut = liftTelN (a + b) tel k := by
+  rw [hcut]; exact liftTelN_liftTelN_hi a b tel k
+
+/-- Merge telescope lifts when the outer cutoff lies anywhere inside the
+range opened by the inner lift. This is the shape needed when new ambient
+binders are inserted below a recursive argument's own Pi telescope. -/
+theorem liftTelN_liftTelN_mid (a b : Nat) : ∀ (tel : List VExpr) (k cut : Nat),
+    k ≤ cut → cut ≤ a + k →
+    liftTelN b (liftTelN a tel k) cut = liftTelN (a+b) tel k
+  | [], _, _, _, _ => rfl
+  | A :: tel, k, cut, h₁, h₂ => by
+    show (A.liftN a k).liftN b cut :: _ = _
+    rw [VExpr.liftN'_liftN' h₁ h₂,
+      liftTelN_liftTelN_mid a b tel (k+1) (cut+1)
+        (Nat.succ_le_succ h₁) (by omega)]
+    rfl
+
+theorem liftTelN_instL (ls : List VLevel) (n : Nat) : ∀ (tel : List VExpr) (k : Nat),
+    (liftTelN n tel k).map (instL ls) = liftTelN n (tel.map (instL ls)) k
+  | [], _ => rfl
+  | A :: tel, k => by
+    show (A.liftN n k).instL ls :: _ = (A.instL ls).liftN n k :: _
+    rw [instL_liftN, liftTelN_instL ls n tel (k+1)]
+
+/-- Pulling a lift out of the middle of a two-step lift: the outer lift at
+the seam between the two inner ones lands on the variables the innermost
+lift moved. -/
+theorem liftN_liftN_mid : ∀ (e : VExpr) {j c : Nat} (k d : Nat), c ≤ j →
+    ((e.liftN 1 j).liftN d c).liftN k (j + d) = (e.liftN (k+1) j).liftN d c := by
+  intro e
+  induction e with intro j c k d hc
+  | bvar i =>
+    show VExpr.bvar (liftVar k (liftVar d (liftVar 1 i j) c) (j+d)) =
+      .bvar (liftVar d (liftVar (k+1) i j) c)
+    congr 1
+    rcases Nat.lt_or_ge i j with h1 | h1
+    · rw [liftVar_lt h1, liftVar_lt (show i < j from h1)]
+      rcases Nat.lt_or_ge i c with h2 | h2
+      · rw [liftVar_lt h2, liftVar_lt (show i < j+d from by omega)]
+      · rw [liftVar_le h2, liftVar_lt (show d+i < j+d from by omega)]
+    · rw [liftVar_le h1, liftVar_le h1,
+        liftVar_le (show c ≤ 1+i from by omega),
+        liftVar_le (show c ≤ k+1+i from by omega),
+        liftVar_le (show j+d ≤ d+(1+i) from by omega)]
+      omega
+  | sort | const => intros; rfl
+  | app f a ihf iha => simp [liftN, ihf _ _ hc, iha _ _ hc]
+  | lam A b ihA ihb | forallE A b ihA ihb =>
+    simp only [liftN]
+    refine congr (congrArg _ (ihA _ _ hc)) ?_
+    have := ihb (j := j+1) (c := c+1) k d (by omega)
+    rwa [show j+1+d = j+d+1 from by omega] at this
+
+/-- Telescope form of `liftN_liftN_mid`. The outer lift is inserted at the
+seam between the lift below the telescope and the lift that opened the
+telescope's original ambient context. -/
+theorem liftTelN_liftN_mid : ∀ (tel : List VExpr) {j c : Nat} (k d : Nat), c ≤ j →
+    liftTelN k (liftTelN d (liftTelN 1 tel j) c) (j+d) =
+      liftTelN d (liftTelN (k+1) tel j) c
+  | [], _, _, _, _, _ => rfl
+  | A :: tel, j, c, k, d, hc => by
+    show ((A.liftN 1 j).liftN d c).liftN k (j+d) :: _ =
+      (A.liftN (k+1) j).liftN d c :: _
+    rw [liftN_liftN_mid A k d hc]
+    congr 1
+    rw [show j+d+1 = j+1+d from by omega]
+    exact liftTelN_liftN_mid tel k d (Nat.succ_le_succ hc)
+
+/-- Disjoint lifts commute: an outer lift below an inner one slides past
+it, pushing the inner cutoff up. -/
+theorem liftN_liftN_comm : ∀ (e : VExpr) (n k c K : Nat), c ≤ K →
+    (e.liftN k K).liftN n c = (e.liftN n c).liftN k (K + n) := by
+  intro e
+  induction e with intro n k c K hc
+  | bvar i =>
+    show VExpr.bvar (liftVar n (liftVar k i K) c) = .bvar (liftVar k (liftVar n i c) (K+n))
+    congr 1
+    rcases Nat.lt_or_ge i c with h2 | h2
+    · rw [liftVar_lt (show i < K from by omega), liftVar_lt h2,
+        liftVar_lt (show i < K+n from by omega)]
+    · rcases Nat.lt_or_ge i K with h1 | h1
+      · rw [liftVar_lt h1, liftVar_le h2,
+          liftVar_lt (show n+i < K+n from by omega)]
+      · rw [liftVar_le h1, liftVar_le (show c ≤ k+i from by omega), liftVar_le h2,
+          liftVar_le (show K+n ≤ n+i from by omega)]
+        omega
+  | sort | const => intros; rfl
+  | app f a ihf iha => simp [liftN, ihf _ _ _ _ hc, iha _ _ _ _ hc]
+  | lam A b ihA ihb | forallE A b ihA ihb =>
+    simp only [liftN]
+    refine congr (congrArg _ (ihA _ _ _ _ hc)) ?_
+    have := ihb n k (c+1) (K+1) (by omega)
+    rwa [show K+1+n = K+n+1 from by omega] at this
+
+/-- Generalized form of `liftN_liftN_mid`: expanding an arbitrary lift at
+the seam above a disjoint lower lift adds the new width to that arbitrary
+lift. -/
+theorem liftN_liftN_midN (e : VExpr) {j c : Nat}
+    (a k d : Nat) (hc : c ≤ j) :
+    ((e.liftN a j).liftN d c).liftN k (j+d) =
+      (e.liftN (a+k) j).liftN d c := by
+  rw [← liftN_liftN_comm (e.liftN a j) d k c j hc]
+  rw [liftN'_liftN_hi]
+
+/-- Telescope form of `liftN_liftN_midN`. -/
+theorem liftTelN_liftN_midN :
+    ∀ (tel : List VExpr) {j c : Nat} (a k d : Nat), c ≤ j →
+      liftTelN k (liftTelN d (liftTelN a tel j) c) (j+d) =
+        liftTelN d (liftTelN (a+k) tel j) c
+  | [], _, _, _, _, _, _ => rfl
+  | A :: tel, j, c, a, k, d, hc => by
+    show ((A.liftN a j).liftN d c).liftN k (j+d) :: _ = _
+    rw [liftN_liftN_midN A a k d hc]
+    congr 1
+    rw [show j+d+1 = j+1+d from by omega]
+    exact liftTelN_liftN_midN tel a k d (Nat.succ_le_succ hc)
+
+/-- Instantiation under a telescope: the entry at depth `q` instantiates
+at `k+q`. -/
+def instTelN (a : VExpr) : List VExpr → Nat → List VExpr
+  | [], _ => []
+  | A :: As, k => A.inst a k :: instTelN a As (k+1)
+
+attribute [local simp] instTelN
+
+theorem instTelN_length (a : VExpr) : ∀ (tel : List VExpr) (k : Nat),
+    (instTelN a tel k).length = tel.length
+  | [], _ => rfl
+  | _ :: tel, k => by simp [instTelN, instTelN_length a tel (k+1)]
+
+theorem instN_forallN (a : VExpr) : ∀ (tel : List VExpr) (X : VExpr) (k : Nat),
+    (forallN tel X).inst a k = forallN (instTelN a tel k) (X.inst a (k + tel.length))
+  | [], _, _ => rfl
+  | A :: tel, X, k => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    rw [instN_forallN a tel X (k+1),
+      show k+1+tel.length = k+(tel.length+1) from by omega]
+    rfl
+
+/-- Iterated instantiation of a body under `es.length` binders, consuming
+the spine outermost-first. -/
+def instRev : VExpr → List VExpr → VExpr
+  | C, [] => C
+  | C, e :: es => instRev (C.inst e es.length) es
+
+theorem instRev_closedN : ∀ (es : List VExpr) {C : VExpr}, C.ClosedN 0 →
+    instRev C es = C
+  | [], _, _ => rfl
+  | e :: es, C, hC => by
+    show instRev (C.inst e es.length) es = C
+    rw [hC.instN_eq (Nat.zero_le _)]
+    exact instRev_closedN es hC
+
+theorem instRev_bvar_ge : ∀ (es : List VExpr) {i : Nat}, es.length ≤ i →
+    instRev (.bvar i) es = .bvar (i - es.length)
+  | [], i, _ => by simp [instRev]
+  | e :: es, i, h => by
+    have h' : es.length < i := by
+      simp only [List.length_cons] at h
+      omega
+    show instRev ((VExpr.bvar i).inst e es.length) es = _
+    rw [show (VExpr.bvar i).inst e es.length = .bvar (i-1) from by
+        show VExpr.instVar i e es.length = _
+        unfold VExpr.instVar
+        rw [if_neg (by omega), if_neg (by omega)],
+      instRev_bvar_ge es (by omega)]
+    congr 1
+    simp only [List.length_cons]
+    omega
+
+/-- The spine consumes a fully lifted body without a trace. -/
+theorem instRev_liftN_len : ∀ (es : List VExpr) (X : VExpr),
+    instRev (X.liftN es.length) es = X
+  | [], X => by simp [instRev, liftN_zero]
+  | e :: es, X => by
+    show instRev ((X.liftN (es.length+1)).inst e es.length) es = X
+    rw [show X.liftN (es.length+1) = (X.liftN es.length).liftN 1 es.length from
+        (liftN'_liftN' (Nat.zero_le _) (by omega)).symm,
+      inst_liftN]
+    exact instRev_liftN_len es X
+
+theorem instRev_bvar_lt_cons (es : List VExpr) (e : VExpr) {i : Nat} (hi : i < es.length) :
+    instRev (.bvar i) (e :: es) = instRev (.bvar i) es := by
+  show instRev ((VExpr.bvar i).inst e es.length) es = _
+  congr 1
+  show VExpr.instVar i e es.length = .bvar i
+  unfold VExpr.instVar
+  rw [if_pos hi]
+
+theorem mem_bvarRevRange : ∀ {m off : Nat} {x : VExpr}, x ∈ bvarRevRange off m →
+    ∃ i, x = .bvar i ∧ off ≤ i ∧ i < off + m
+  | m+1, off, x, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · exact ⟨off + m, rfl, by omega, by omega⟩
+    · obtain ⟨i, rfl, h1, h2⟩ := mem_bvarRevRange h
+      exact ⟨i, rfl, h1, by omega⟩
+
+/-- The last `es.length` variables consume to the spine itself. -/
+theorem map_instRev_bvarRevRange : ∀ (es : List VExpr),
+    (bvarRevRange 0 es.length).map (instRev · es) = es
+  | [] => rfl
+  | e :: es => by
+    show instRev (.bvar (0 + es.length)) (e :: es) ::
+      (bvarRevRange 0 es.length).map (instRev · (e :: es)) = e :: es
+    congr 1
+    · show instRev ((VExpr.bvar (0 + es.length)).inst e es.length) es = e
+      rw [Nat.zero_add,
+        show (VExpr.bvar es.length).inst e es.length = e.liftN es.length from by
+          show VExpr.instVar es.length e es.length = _
+          unfold VExpr.instVar
+          rw [if_neg (Nat.lt_irrefl _), if_pos rfl]]
+      exact instRev_liftN_len es e
+    · rw [List.map_congr_left fun x hx => ?_, map_instRev_bvarRevRange es]
+      obtain ⟨i, rfl, -, h2⟩ := mem_bvarRevRange hx
+      exact instRev_bvar_lt_cons es e (by omega)
+
+theorem map_instRev_bvarRevRange_ge (es : List VExpr) : ∀ (q off : Nat),
+    es.length ≤ off →
+    (bvarRevRange off q).map (instRev · es) = bvarRevRange (off - es.length) q
+  | 0, _, _ => rfl
+  | q+1, off, h => by
+    show instRev (.bvar (off+q)) es :: _ = _
+    rw [instRev_bvar_ge es (by omega), map_instRev_bvarRevRange_ge es q off h]
+    congr 2
+    omega
+
+theorem instRev_appN (es : List VExpr) : ∀ (f : VExpr) (as : List VExpr),
+    instRev (appN f as) es = appN (instRev f es) (as.map (instRev · es)) := by
+  induction es with intro f as
+  | nil => simp [instRev, List.map_id']
+  | cons e es ih =>
+    show instRev ((appN f as).inst e es.length) es = _
+    rw [instN_appN, ih]
+    simp [instRev, List.map_map, Function.comp_def]
+
+theorem instRev_forallE_sort (u : VLevel) : ∀ (es : List VExpr) (D : VExpr),
+    instRev (.forallE D (.sort u)) es = .forallE (instRev D es) (.sort u)
+  | [], _ => rfl
+  | e :: es, D => instRev_forallE_sort u es (D.inst e es.length)
+
+theorem bvarRevRange_append : ∀ (m k : Nat),
+    bvarRevRange k m ++ bvarRevRange 0 k = bvarRevRange 0 (k + m)
+  | 0, k => by simp [bvarRevRange]
+  | m+1, k => by
+    show VExpr.bvar (k + m) :: (bvarRevRange k m ++ bvarRevRange 0 k) = _
+    rw [bvarRevRange_append m k, show k + (m+1) = (k+m)+1 from rfl]
+    show _ = VExpr.bvar (0 + (k+m)) :: bvarRevRange 0 (k+m)
+    rw [Nat.zero_add]
+
+theorem appHead_appN : ∀ (as : List VExpr) (f : VExpr), (appN f as).appHead = f.appHead
+  | [], _ => rfl
+  | a :: as, f => appHead_appN as (f.app a)
+
+theorem appArgs_appN : ∀ (as acc : List VExpr) (f : VExpr),
+    (appN f as).appArgs acc = f.appArgs (as ++ acc)
+  | [], _, _ => rfl
+  | a :: as, acc, f => by
+    show (VExpr.appN (f.app a) as).appArgs acc = _
+    rw [appArgs_appN as acc (f.app a)]
+    rfl
+
+theorem appN_appHead_appArgs : ∀ (e : VExpr) (acc : List VExpr),
+    appN e.appHead (e.appArgs acc) = appN e acc
+  | .app f a, acc => by
+    show appN f.appHead (f.appArgs (a :: acc)) = _
+    rw [appN_appHead_appArgs f (a :: acc)]
+    rfl
+  | .bvar _, _ | .sort _, _ | .const _ _, _ | .lam _ _, _ | .forallE _ _, _ => rfl
+
+end VExpr
+
+/-! ## Anatomy of the stage-3 predicate -/
+
+namespace VInductDecl
+
+/-- A constructor-type telescope splits as fields over the result. -/
+theorem forallN_ctorFields_resultOf : ∀ (e : VExpr),
+    VExpr.forallN (ctorFields e) e.resultOf = e
+  | .forallE B rest => congrArg (VExpr.forallE B) (forallN_ctorFields_resultOf rest)
+  | .bvar _ | .sort _ | .const _ _ | .app _ _ | .lam _ _ => rfl
+
+/-- Unpack a recursive-field check into its structural content. -/
+theorem isRecField_eq {U T np ni j B} (h : isRecField U T np ni j B = true) :
+    B = VExpr.appN (.const T (VLevel.params U))
+      (VExpr.bvarRevRange j np ++ recFieldIdxs np B) ∧
+    (recFieldIdxs np B).length = ni ∧
+    ∀ e ∈ recFieldIdxs np B, e.hasConst T = false := by
+  simp only [isRecField, Bool.and_eq_true, beq_iff_eq, List.all_eq_true] at h
+  obtain ⟨⟨⟨h1, h2⟩, h3⟩, h4⟩ := h
+  refine ⟨?_, ?_, fun e he => by simpa [Bool.not_eq_true'] using h4 e he⟩
+  · have hB : B = VExpr.appN B.appHead (B.appArgs []) :=
+      (VExpr.appN_appHead_appArgs B []).symm
+    conv => lhs; rw [hB, h1,
+      show VExpr.appArgs B [] =
+        (VExpr.appArgs B []).take np ++ (VExpr.appArgs B []).drop np from
+        (List.take_append_drop ..).symm,
+      h3]
+    rfl
+  · simp only [recFieldIdxs, List.length_drop, h2]
+    omega
+
+/-- Unpack recursive-argument analysis beneath a possibly empty Pi telescope.
+The terminal family application is seen under both the preceding constructor
+fields (`j`) and the returned recursive binders. -/
+theorem recTarget?_eq {U T np ni j B As idxs}
+    (h : recTarget? U T np ni j B = some (As, idxs)) :
+    B = VExpr.forallN As
+      (VExpr.appN (.const T (VLevel.params U))
+        (VExpr.bvarRevRange (j + As.length) np ++ idxs)) ∧
+    idxs.length = ni ∧
+    (∀ e ∈ idxs, e.hasConst T = false) ∧
+    ∀ (q : Nat) (A : VExpr), As[q]? = some A → A.hasConst T = false := by
+  induction B generalizing j As idxs with
+  | forallE A rest _ ih =>
+    simp only [recTarget?] at h
+    split at h
+    · contradiction
+    · next hA =>
+      split at h
+      · next As' idxs' hrest =>
+        simp only [Option.some.injEq, Prod.mk.injEq] at h
+        obtain ⟨rfl, rfl⟩ := h
+        obtain ⟨hshape, hlen, hfree, hbinders⟩ := ih hrest
+        refine ⟨?_, hlen, hfree, ?_⟩
+        · show VExpr.forallE A rest = VExpr.forallE A _
+          rw [hshape, show j + 1 + As'.length = j + (As'.length + 1) from by omega]
+          simp only [List.length_cons]
+        · intro q A' hq
+          match q, hq with
+          | 0, hq =>
+            obtain rfl : A = A' := by simpa using hq
+            cases hAT : A.hasConst T with
+            | false => rfl
+            | true => exact (hA hAT).elim
+          | q+1, hq => exact hbinders q A' (by simpa using hq)
+      · contradiction
+  | bvar i | sort i | const i | app i i | lam i i =>
+    simp only [recTarget?] at h
+    split at h
+    · next hrec =>
+      simp only [Option.some.injEq, Prod.mk.injEq] at h
+      obtain ⟨rfl, rfl⟩ := h
+      obtain ⟨hshape, hlen, hfree⟩ := isRecField_eq hrec
+      exact ⟨by simpa using hshape, hlen, hfree, by simp⟩
+    · contradiction
+
+/-- Public recursive-argument anatomy, including the stable field and
+one-family target indices carried by the descriptor. -/
+theorem recArg?_eq {U T np ni j B r}
+    (h : recArg? U T np ni j B = some r) :
+    r.fieldIndex = j ∧ r.targetType = 0 ∧
+    B = VExpr.forallN r.binders
+      (VExpr.appN (.const T (VLevel.params U))
+        (VExpr.bvarRevRange (j + r.binders.length) np ++ r.indices)) ∧
+    r.indices.length = ni ∧
+    (∀ e ∈ r.indices, e.hasConst T = false) ∧
+    ∀ (q : Nat) (A : VExpr), r.binders[q]? = some A → A.hasConst T = false := by
+  unfold recArg? at h
+  split at h
+  · next binders indices htarget =>
+    simp only [Option.some.injEq] at h
+    subst r
+    obtain ⟨hshape, hlen, hfree, hbinders⟩ := recTarget?_eq htarget
+    exact ⟨rfl, rfl, hshape, hlen, hfree, hbinders⟩
+  · contradiction
+
+/-- With no Pi binders, recursive-argument recognition is exactly the direct
+recursive-field check. -/
+theorem recTarget?_nil {U T np ni j B idxs}
+    (h : recTarget? U T np ni j B = some ([], idxs)) :
+    isRecField U T np ni j B = true ∧ idxs = recFieldIdxs np B := by
+  cases B with
+  | forallE A rest =>
+    simp only [recTarget?] at h
+    split at h
+    · contradiction
+    · cases hrest : recTarget? U T np ni (j+1) rest with
+      | none => simp [hrest] at h
+      | some out =>
+        obtain ⟨As, is⟩ := out
+        simp [hrest] at h
+  | bvar i | sort i | const i | app i i | lam i i =>
+    simp only [recTarget?] at h
+    split at h
+    · next hrec =>
+      simp only [Option.some.injEq, Prod.mk.injEq] at h
+      exact ⟨hrec, h.2.symm⟩
+    · contradiction
+
+theorem recArg?_nil {U T np ni j B r}
+    (h : recArg? U T np ni j B = some r) (hr : r.binders = []) :
+    isRecField U T np ni j B = true ∧ r.indices = recFieldIdxs np B := by
+  unfold recArg? at h
+  split at h
+  · next binders indices htarget =>
+    simp only [Option.some.injEq] at h
+    subst r
+    simp only at hr
+    subst binders
+    exact recTarget?_nil htarget
+  · contradiction
+
+/-- A direct recursive-field success normalizes to the descriptor with an
+empty binder telescope. -/
+theorem recArg?_of_isRecField {U T np ni j B}
+    (h : isRecField U T np ni j B = true) :
+    recArg? U T np ni j B = some
+      { fieldIndex := j, binders := [], targetType := 0,
+        indices := recFieldIdxs np B } := by
+  cases B with
+  | forallE A rest => simp [isRecField, VExpr.appHead] at h
+  | bvar i | sort i | const i | app i i | lam i i =>
+    simp_all [recArg?, recTarget?]
+
+theorem stage3Ctor_eq {U T np ni} : ∀ {j₀ : Nat} {e : VExpr},
+    stage3Ctor U T np ni j₀ e = true →
+    e = VExpr.forallN (ctorFields e)
+      (VExpr.appN (.const T (VLevel.params U))
+        (VExpr.bvarRevRange (j₀ + (ctorFields e).length) np ++
+          recFieldIdxs np e.resultOf)) ∧
+    (recFieldIdxs np e.resultOf).length = ni ∧
+    (∀ x ∈ recFieldIdxs np e.resultOf, x.hasConst T = false) ∧
+    ∀ q B, (ctorFields e)[q]? = some B → stage3Field U T np ni (j₀ + q) B = true := by
+  intro j₀ e h
+  induction e generalizing j₀ with
+  | forallE B rest _ ih =>
+    rw [show stage3Ctor U T np ni j₀ (.forallE B rest) =
+      (stage3Field U T np ni j₀ B && stage3Ctor U T np ni (j₀+1) rest) from rfl,
+      Bool.and_eq_true] at h
+    have ⟨ih1, ih2, ih3, ih4⟩ := ih h.2
+    refine ⟨?_, ih2, ih3, ?_⟩
+    · show VExpr.forallE _ _ = VExpr.forallE _ _
+      conv => lhs; rw [ih1]
+      rw [show j₀+1+(ctorFields rest).length = j₀+((ctorFields rest).length+1) from by omega]
+      rfl
+    · intro q B' hB'
+      match q, hB' with
+      | 0, hB' =>
+        obtain rfl : B = B' := by simpa [ctorFields] using hB'
+        exact h.1
+      | q+1, hB' =>
+        have := ih4 q B' (by simpa [ctorFields] using hB')
+        rwa [show j₀+1+q = j₀+(q+1) from by omega] at this
+  | bvar i =>
+    exact ⟨(isRecField_eq h).1, (isRecField_eq h).2.1, (isRecField_eq h).2.2,
+      fun q B h' => by simp [ctorFields] at h'⟩
+  | sort l =>
+    exact ⟨(isRecField_eq h).1, (isRecField_eq h).2.1, (isRecField_eq h).2.2,
+      fun q B h' => by simp [ctorFields] at h'⟩
+  | const c ls =>
+    exact ⟨(isRecField_eq h).1, (isRecField_eq h).2.1, (isRecField_eq h).2.2,
+      fun q B h' => by simp [ctorFields] at h'⟩
+  | app f a _ _ =>
+    exact ⟨(isRecField_eq h).1, (isRecField_eq h).2.1, (isRecField_eq h).2.2,
+      fun q B h' => by simp [ctorFields] at h'⟩
+  | lam A b _ _ =>
+    exact ⟨(isRecField_eq h).1, (isRecField_eq h).2.1, (isRecField_eq h).2.2,
+      fun q B h' => by simp [ctorFields] at h'⟩
+
+/-- Failure of the legacy singleton predicate is exactly failure to produce
+the one-family checked descriptor. -/
+theorem checked?_eq_none_iff {decl : VInductDecl} :
+    decl.checked? = none ↔ decl.singletonStage3 = false := by
+  unfold singletonStage3
+  cases decl.checked? <;> simp
+
+/-- Successful singleton acceptance retains the descriptor rather than
+discarding it. -/
+theorem exists_checked_of_singletonStage3 {decl : VInductDecl}
+    (h : decl.singletonStage3 = true) :
+    ∃ checked, decl.checked? = some checked := by
+  unfold singletonStage3 at h
+  cases hc : decl.checked? with
+  | none => simp [hc] at h
+  | some checked => exact ⟨checked, rfl⟩
+
+/-- Public Stage-3 rejection is exactly failure to retain a complete mutual
+generation descriptor. -/
+theorem identityBlockGeneration?_eq_none_iff {decl : VInductDecl} :
+    decl.identityBlockGeneration? = none ↔ decl.stage3 = false := by
+  unfold stage3
+  cases decl.identityBlockGeneration? <;> simp
+
+/-- Public Stage-3 acceptance retains the exact block descriptor used by the
+transaction. -/
+theorem exists_blockGeneration_of_stage3 {decl : VInductDecl}
+    (h : decl.stage3 = true) :
+    ∃ generation, decl.identityBlockGeneration? = some generation := by
+  unfold stage3 at h
+  cases hgeneration : decl.identityBlockGeneration? with
+  | none => simp [hgeneration] at h
+  | some generation => exact ⟨generation, rfl⟩
+
+/-- Proof-level constructor-header coherence exported from the computational
+normalization-shape check. -/
+def CtorHeaderEq (source view : VConstVal) : Prop :=
+  source.name = view.name ∧ source.uvars = view.uvars
+
+/-- Proof-level family-header coherence, including constructor order. -/
+def TypeHeaderEq (source view : VInductiveType) : Prop :=
+  source.name = view.name ∧ source.uvars = view.uvars ∧
+    List.Forall₂ CtorHeaderEq source.ctors view.ctors
+
+theorem sameCtorHeaders_iff_forall₂ : ∀ {source view},
+    sameCtorHeaders source view = true ↔
+      List.Forall₂ CtorHeaderEq source view
+  | [], [] => ⟨fun _ => .nil, fun _ => rfl⟩
+  | [], _ :: _ => by
+    constructor
+    · intro h; exact Bool.noConfusion h
+    · intro h; nomatch h
+  | _ :: _, [] => by
+    constructor
+    · intro h; exact Bool.noConfusion h
+    · intro h; nomatch h
+  | source :: sources, view :: views => by
+    constructor
+    · intro h
+      simp only [sameCtorHeaders, Bool.and_eq_true, beq_iff_eq] at h
+      exact .cons ⟨h.1.1, h.1.2⟩ (sameCtorHeaders_iff_forall₂.1 h.2)
+    · intro h
+      obtain ⟨hhead, htail⟩ := List.forall₂_cons.1 h
+      simp only [sameCtorHeaders, Bool.and_eq_true, beq_iff_eq]
+      exact ⟨⟨hhead.1, hhead.2⟩, sameCtorHeaders_iff_forall₂.2 htail⟩
+
+theorem sameTypeHeaders_iff_forall₂ : ∀ {source view},
+    sameTypeHeaders source view = true ↔
+      List.Forall₂ TypeHeaderEq source view
+  | [], [] => ⟨fun _ => .nil, fun _ => rfl⟩
+  | [], _ :: _ => by
+    constructor
+    · intro h; exact Bool.noConfusion h
+    · intro h; nomatch h
+  | _ :: _, [] => by
+    constructor
+    · intro h; exact Bool.noConfusion h
+    · intro h; nomatch h
+  | source :: sources, view :: views => by
+    constructor
+    · intro h
+      simp only [sameTypeHeaders, Bool.and_eq_true, beq_iff_eq] at h
+      exact .cons
+        ⟨h.1.1.1, h.1.1.2, sameCtorHeaders_iff_forall₂.1 h.1.2⟩
+        (sameTypeHeaders_iff_forall₂.1 h.2)
+    · intro h
+      obtain ⟨hhead, htail⟩ := List.forall₂_cons.1 h
+      simp only [sameTypeHeaders, Bool.and_eq_true, beq_iff_eq]
+      exact ⟨⟨⟨hhead.1, hhead.2.1⟩,
+        sameCtorHeaders_iff_forall₂.2 hhead.2.2⟩,
+        sameTypeHeaders_iff_forall₂.2 htail⟩
+
+/-- Every accepted normalization preserves declaration arity and all
+family/constructor identities in order. -/
+theorem Normalization.shape {source : VInductDecl}
+    (norm : Normalization source) :
+    source.uvars = norm.view.uvars ∧
+    source.nparams = norm.view.nparams ∧
+    List.Forall₂ TypeHeaderEq source.types norm.view.types := by
+  have h := norm.shape_eq
+  simp only [normalizationShape, Bool.and_eq_true, beq_iff_eq,
+    sameTypeHeaders_iff_forall₂] at h
+  exact ⟨h.1.1, h.1.2, h.2⟩
+
+/-- The singleton source family paired with the checked singleton analysis
+view. This is the raw payload future normalized generation must insert. -/
+theorem NormalizedChecked.source_anatomy {source : VInductDecl}
+    (block : NormalizedChecked source) :
+    ∃ raw,
+      source.types = [raw] ∧
+      raw.name = block.checked.type.name ∧
+      raw.uvars = block.checked.type.uvars ∧
+      List.Forall₂ CtorHeaderEq raw.ctors block.checked.type.ctors := by
+  have htypes := block.normalization.shape.2.2
+  rw [block.source_types_eq, block.checked.types_eq] at htypes
+  obtain ⟨htype, -⟩ := List.forall₂_cons.1 htypes
+  exact ⟨block.sourceType, block.source_types_eq,
+    htype.1, htype.2.1, htype.2.2⟩
+
+theorem NormalizedChecked.uvars_eq {source : VInductDecl}
+    (block : NormalizedChecked source) :
+    source.uvars = block.normalization.view.uvars :=
+  block.normalization.shape.1
+
+theorem NormalizedChecked.nparams_eq {source : VInductDecl}
+    (block : NormalizedChecked source) :
+    source.nparams = block.normalization.view.nparams :=
+  block.normalization.shape.2.1
+
+/-- Unpack the complete executable layout certificate used by mixed
+raw/view generation. -/
+theorem GenerationChecked.shape {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.block.rawParams.length = source.nparams ∧
+    gen.block.rawParams.length = gen.block.checked.params.length ∧
+    gen.block.rawIndices.length = gen.block.checked.indices.length ∧
+    gen.block.ctorPairs.length = gen.block.sourceType.ctors.length ∧
+    gen.block.ctorPairs.length = gen.block.checked.constructors.length ∧
+    ∀ ctor ∈ gen.block.ctorPairs,
+      ctor.raw.name = ctor.view.value.name ∧
+      ctor.raw.uvars = ctor.view.value.uvars ∧
+      (VExpr.telN source.nparams ctor.raw.type).length = source.nparams ∧
+      (ctor.rawFields source.nparams).length = ctor.view.fields.length := by
+  have h := gen.shape_eq
+  simp only [NormalizedChecked.generationShape,
+    NormalizedCtor.generationShape, Bool.and_eq_true, beq_iff_eq,
+    List.all_eq_true] at h
+  obtain ⟨⟨⟨⟨⟨hparams, hparams'⟩, hindices⟩, hraws⟩, hviews⟩,
+    hctors⟩ := h
+  refine ⟨hparams, hparams', hindices, hraws, hviews, ?_⟩
+  intro ctor hctor
+  obtain ⟨⟨⟨hname, hU⟩, htel⟩, hfields⟩ := hctors ctor hctor
+  exact ⟨hname, hU, htel, hfields⟩
+
+theorem pairNormalizedCtors_map_raw :
+    ∀ (raws : List VConstVal) (views : List CheckedCtor),
+      raws.length = views.length →
+      (pairNormalizedCtors raws views).map (·.raw) = raws
+  | [], [], _ => rfl
+  | raw :: raws, view :: views, h => by
+    simp only [pairNormalizedCtors, List.map_cons, List.cons.injEq, true_and]
+    apply pairNormalizedCtors_map_raw
+    simpa using h
+
+theorem pairNormalizedCtors_map_view :
+    ∀ (raws : List VConstVal) (views : List CheckedCtor),
+      raws.length = views.length →
+      (pairNormalizedCtors raws views).map (·.view) = views
+  | [], [], _ => rfl
+  | raw :: raws, view :: views, h => by
+    simp only [pairNormalizedCtors, List.map_cons, List.cons.injEq, true_and]
+    apply pairNormalizedCtors_map_view
+    simpa using h
+
+/-- Membership in an identity pairing recovers the single raw constructor
+that supplied both sides of the pair. -/
+theorem pairNormalizedCtors_map_self_mem
+    {U : Nat} {T : Name} {np ni : Nat} :
+    ∀ {cs : List VConstVal} {ctor : NormalizedCtor},
+      ctor ∈ pairNormalizedCtors cs
+        (cs.map (CheckedCtor.ofDirect U T np ni)) →
+      ∃ c ∈ cs, ctor =
+        ⟨c, CheckedCtor.ofDirect U T np ni c⟩
+  | [], _, h => by simp [pairNormalizedCtors] at h
+  | c :: cs, ctor, h => by
+    simp only [List.map_cons, pairNormalizedCtors, List.mem_cons] at h
+    rcases h with rfl | h
+    · exact ⟨c, .head _, rfl⟩
+    · obtain ⟨c', hc', rfl⟩ :=
+        pairNormalizedCtors_map_self_mem h
+      exact ⟨c', .tail _ hc', rfl⟩
+
+/-- Every raw constructor occurs in its canonical identity pair. -/
+theorem pairNormalizedCtors_map_self_contains
+    {U : Nat} {T : Name} {np ni : Nat} :
+    ∀ {cs : List VConstVal} {c : VConstVal},
+      c ∈ cs →
+      (⟨c, CheckedCtor.ofDirect U T np ni c⟩ :
+        NormalizedCtor) ∈
+        pairNormalizedCtors cs
+          (cs.map (CheckedCtor.ofDirect U T np ni))
+  | _ :: _, _, .head _ => .head _
+  | _ :: _, _, .tail _ hc =>
+      .tail _ (pairNormalizedCtors_map_self_contains hc)
+
+/-- The identity generation path pairs each stored constructor with its own
+direct analyzer descriptor. -/
+theorem Checked.identityGeneration_ctor
+    {source : VInductDecl} (checked : source.Checked)
+    {ctor : NormalizedCtor}
+    (hctor : ctor ∈ checked.identityGeneration.block.ctorPairs) :
+    ∃ c ∈ checked.type.ctors, ctor =
+      ⟨c, CheckedCtor.ofDirect source.uvars checked.type.name
+        source.nparams checked.indices.length c⟩ := by
+  apply pairNormalizedCtors_map_self_mem
+  simpa only [Checked.identityGeneration, Checked.identityBlock,
+    NormalizedChecked.ctorPairs, checked.constructors_eq] using hctor
+
+/-- Positional pairing neither drops nor reorders raw constructors. -/
+theorem GenerationChecked.rawCtors_eq {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.block.ctorPairs.map (·.raw) = gen.block.sourceType.ctors := by
+  apply pairNormalizedCtors_map_raw
+  exact gen.shape.2.2.2.1.symm.trans gen.shape.2.2.2.2.1
+
+/-- Every checked constructor appears in the same paired position. -/
+theorem GenerationChecked.viewCtors_eq {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.block.ctorPairs.map (·.view) = gen.block.checked.constructors := by
+  apply pairNormalizedCtors_map_view
+  exact gen.shape.2.2.2.1.symm.trans gen.shape.2.2.2.2.1
+
+/-! ### Block-generation positional facts -/
+
+theorem pairNormalizedFamilies_map_raw :
+    ∀ (raws : List VInductiveType) (views : List CheckedFamilyData),
+      raws.length = views.length →
+      (pairNormalizedFamilies raws views).map (·.raw) = raws
+  | [], [], _ => rfl
+  | raw :: raws, view :: views, h => by
+    simp only [pairNormalizedFamilies, List.map_cons,
+      List.cons.injEq, true_and]
+    apply pairNormalizedFamilies_map_raw
+    simpa using h
+
+theorem pairNormalizedFamilies_map_view :
+    ∀ (raws : List VInductiveType) (views : List CheckedFamilyData),
+      raws.length = views.length →
+      (pairNormalizedFamilies raws views).map (·.view) = views
+  | [], [], _ => rfl
+  | raw :: raws, view :: views, h => by
+    simp only [pairNormalizedFamilies, List.map_cons,
+      List.cons.injEq, true_and]
+    apply pairNormalizedFamilies_map_view
+    simpa using h
+
+/-- Unpack the executable positional gate for mutual generation. -/
+theorem BlockGenerationChecked.shape {source : VInductDecl}
+    (gen : BlockGenerationChecked source) :
+    gen.block.rawParams.length = source.nparams ∧
+      gen.block.rawParams.length = gen.block.checked.params.length ∧
+      gen.families.length = source.types.length ∧
+      gen.families.length = gen.block.checked.families.data.length ∧
+      ∀ family ∈ gen.families,
+        family.raw.name = family.view.value.name ∧
+        family.raw.uvars = family.view.value.uvars ∧
+        (family.rawParams source.nparams).length = source.nparams ∧
+        (family.rawIndices source.nparams).length =
+          family.view.indices.length ∧
+        family.ctorPairs.length = family.raw.ctors.length ∧
+        family.ctorPairs.length = family.view.constructors.length ∧
+        ∀ ctor ∈ family.ctorPairs,
+          ctor.raw.name = ctor.view.value.name ∧
+          ctor.raw.uvars = ctor.view.value.uvars ∧
+          (VExpr.telN source.nparams ctor.raw.type).length =
+            source.nparams ∧
+          (ctor.rawFields source.nparams).length = ctor.view.fields.length := by
+  have h := gen.shape_eq
+  simp only [NormalizedCheckedBlock.blockGenerationShape,
+    NormalizedFamily.generationShape, NormalizedCtor.generationShape,
+    Bool.and_eq_true, beq_iff_eq, List.all_eq_true] at h
+  obtain ⟨h, -⟩ := h
+  obtain ⟨⟨⟨⟨hparams, hparams'⟩, hraws⟩, hviews⟩, hfamilies⟩ := h
+  refine ⟨hparams, hparams', hraws, hviews, ?_⟩
+  intro family hfamily
+  obtain ⟨⟨⟨⟨⟨⟨hname, hU⟩, htel⟩, hindices⟩,
+    hrawCtors⟩, hviewCtors⟩, hctors⟩ := hfamilies family hfamily
+  refine ⟨hname, hU, htel, hindices, hrawCtors, hviewCtors, ?_⟩
+  intro ctor hctor
+  obtain ⟨⟨⟨hctorName, hctorU⟩, hctorTel⟩, hctorFields⟩ :=
+    hctors ctor hctor
+  exact ⟨hctorName, hctorU, hctorTel, hctorFields⟩
+
+theorem BlockGenerationChecked.family_uvars {source : VInductDecl}
+    (gen : BlockGenerationChecked source) {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    family.raw.uvars = source.uvars := by
+  have h := gen.shape_eq
+  simp only [NormalizedCheckedBlock.blockGenerationShape,
+    Bool.and_eq_true, beq_iff_eq, List.all_eq_true] at h
+  exact (h.2 family hfamily).1
+
+theorem BlockGenerationChecked.ctor_uvars {source : VInductDecl}
+    (gen : BlockGenerationChecked source) {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) {ctor : NormalizedCtor}
+    (hctor : ctor ∈ family.ctorPairs) :
+    ctor.raw.uvars = source.uvars := by
+  have h := gen.shape_eq
+  simp only [NormalizedCheckedBlock.blockGenerationShape,
+    Bool.and_eq_true, beq_iff_eq, List.all_eq_true] at h
+  exact (h.2 family hfamily).2 ctor hctor
+
+theorem BlockGenerationChecked.families_map_raw {source : VInductDecl}
+    (gen : BlockGenerationChecked source) :
+    gen.families.map (·.raw) = source.types := by
+  apply pairNormalizedFamilies_map_raw
+  exact gen.shape.2.2.1.symm.trans gen.shape.2.2.2.1
+
+theorem NormalizedFamily.ctorPairs_map_raw
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    family.ctorPairs.map (·.raw) = family.raw.ctors := by
+  apply pairNormalizedCtors_map_raw
+  exact (gen.shape.2.2.2.2 family hfamily).2.2.2.2.1.symm.trans
+    (gen.shape.2.2.2.2 family hfamily).2.2.2.2.2.1
+
+@[simp] theorem NormalizedFamily.blockCtors_map_raw
+    (family : NormalizedFamily) :
+    family.blockCtors.map (·.ctor.raw) = family.ctorPairs.map (·.raw) := by
+  unfold NormalizedFamily.blockCtors
+  induction family.ctorPairs with
+  | nil => rfl
+  | cons ctor ctors ih =>
+    simp only [List.map_cons, List.cons.injEq, true_and]
+    exact ih
+
+theorem flatMap_congr_of_mem {α β : Type} (xs : List α)
+    (f g : α → List β) (h : ∀ x ∈ xs, f x = g x) :
+    xs.flatMap f = xs.flatMap g := by
+  induction xs with
+  | nil => rfl
+  | cons x xs ih =>
+    simp only [List.flatMap_cons]
+    rw [h x (.head _), ih (fun y hy => h y (.tail _ hy))]
+
+theorem map_flatMap_eq {α β γ : Type} (xs : List α)
+    (f : α → List β) (g : β → γ) :
+    (xs.flatMap f).map g = xs.flatMap (fun x => (f x).map g) := by
+  induction xs with
+  | nil => rfl
+  | cons x xs ih =>
+    simp only [List.flatMap_cons, List.map_append]
+    rw [ih]
+
+theorem BlockGenerationChecked.flatCtors_map_raw
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.flatCtors.map (·.ctor.raw) = source.blockConstructorConstants := by
+  rw [VInductDecl.blockConstructorConstants, ← gen.families_map_raw]
+  unfold BlockGenerationChecked.flatCtors NormalizedCheckedBlock.flatCtors
+  rw [map_flatMap_eq]
+  simp only [List.flatMap_map]
+  apply flatMap_congr_of_mem
+  intro family hfamily
+  rw [family.blockCtors_map_raw]
+  exact family.ctorPairs_map_raw hfamily
+
+theorem BlockGenerationChecked.flatCtor_uvars
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    constructor.ctor.raw.uvars = source.uvars := by
+  simp only [BlockGenerationChecked.flatCtors,
+    NormalizedCheckedBlock.flatCtors, List.mem_flatMap] at hconstructor
+  obtain ⟨family, hfamily, hconstructor⟩ := hconstructor
+  simp only [NormalizedFamily.blockCtors, List.mem_map] at hconstructor
+  obtain ⟨ctor, hctor, rfl⟩ := hconstructor
+  exact gen.ctor_uvars hfamily hctor
+
+/-- The validation staging fold is definitionally the family-constant phase
+of block generation, modulo the explicit `toVConstVal` map. -/
+theorem blockTypeConstants_foldlM_eq_stageInductiveTypes
+    (env : VEnv) (source : VInductDecl) :
+    source.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) env =
+      env.stageInductiveTypes source.types := by
+  unfold VInductDecl.blockTypeConstants VEnv.stageInductiveTypes
+  induction source.types generalizing env with
+  | nil => rfl
+  | cons type types ih =>
+    simp only [List.map_cons, List.foldlM_cons]
+    apply Option.bind_congr
+    intro env' _
+    exact ih env'
+
+/-- Identity normalization is computationally the legacy analyzer. -/
+theorem Normalization.identity_checked? (source : VInductDecl) :
+    (Normalization.identity source).checked? = source.checked? := rfl
+
+/-- A successful normalized analysis retains the exact normalization that was
+analyzed; callers do not need to restate this projection as an unrelated
+equality. -/
+theorem Normalization.check?_normalization
+    {source : VInductDecl} {norm : Normalization source}
+    {block : NormalizedChecked source}
+    (h : norm.check? = some block) :
+    block.normalization = norm := by
+  unfold Normalization.check? at h
+  split at h <;> try contradiction
+  split at h <;> try contradiction
+  cases h
+  rfl
+
+/-- A successful generation analysis is indexed by the same normalization
+retained in its checked block. -/
+theorem Normalization.generation?_normalization
+    {source : VInductDecl} {norm : Normalization source}
+    {generation : GenerationChecked source}
+    (h : norm.generation? = some generation) :
+    generation.block.normalization = norm := by
+  unfold Normalization.generation? at h
+  obtain ⟨block, hblock, hgeneration⟩ :=
+    Option.bind_eq_some_iff.mp h
+  have hnorm := Normalization.check?_normalization hblock
+  unfold NormalizedChecked.generation? at hgeneration
+  split at hgeneration
+  · have hgeneration' := Option.some.inj hgeneration
+    rw [← hgeneration']
+    exact hnorm
+  · contradiction
+
+theorem identityChecked?_isSome (source : VInductDecl) :
+    (identityChecked? source).isSome = source.checked?.isSome := by
+  obtain ⟨U, np, types⟩ := source
+  cases types with
+  | nil => rfl
+  | cons type types =>
+    cases types with
+    | nil =>
+      unfold identityChecked? Normalization.check?
+      split
+      · next sourceType hsource =>
+        have htype : type = sourceType := by simpa using hsource
+        subst sourceType
+        split
+        · next checked hchecked =>
+          rw [← Normalization.identity_checked?]
+          exact (congrArg (fun x => x.isSome) hchecked).symm
+        · next hchecked =>
+          rw [← Normalization.identity_checked?]
+          exact (congrArg (fun x => x.isSome) hchecked).symm
+      · next hsource => exact (hsource type rfl).elim
+    | cons type' types => rfl
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Normalization.shape [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizedChecked.source_anatomy [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.shape [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.rawCtors_eq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.viewCtors_eq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Normalization.check?_normalization [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Normalization.generation?_normalization [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.identityChecked?_isSome [propext, Classical.choice, Quot.sound]
+
+/- Identity-normalization compatibility is part of the public artifact
+boundary. The conversion itself is computational; its proof fields inherit
+the standard `Classical.choice` dependency already present in
+`Normalization.identity`'s reflexive header check. -/
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.analyzer_eq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.identityBlock_generationShape [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.motiveType_eq_legacy [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.minorTypes_eq_legacy [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.recursor_eq_legacy [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.generatedRules_eq_legacy [propext, Classical.choice, Quot.sound]
+
+/-- The four executable checks retained by a successful descriptor. Keeping
+this bridge centralized lets the public proof API expose logical facts without
+each consumer re-destructing `stage3Core`. -/
+theorem Checked.analysis_accepted {decl : VInductDecl} (checked : decl.Checked) :
+    stage3DirectCore decl.uvars decl.nparams checked.type = true ∧
+    namesOK checked.type = true ∧ closedOK checked.type = true ∧
+    levelsOK decl.uvars checked.type = true := by
+  cases decl with
+  | mk U np tys =>
+    have htypes : tys = [checked.type] := checked.types_eq
+    have hcore := checked.accepted
+    simp only [stage3Core, htypes, Bool.and_eq_true] at hcore
+    exact ⟨hcore.1, hcore.2.1, hcore.2.2.1, hcore.2.2.2⟩
+
+/-- Every successful descriptor has pairwise-distinct generated type,
+constructor, and recursor names. Downstream proofs should consume this fact
+instead of unfolding the boolean analyzer. -/
+theorem Checked.names_nodup {decl : VInductDecl} (checked : decl.Checked) :
+    checked.names.Nodup := by
+  rw [checked.names_eq]
+  exact of_decide_eq_true (by simpa [namesOK] using checked.analysis_accepted.2.1)
+
+/-- A checked family's type metadata has no loose term variables. -/
+theorem Checked.type_closed {decl : VInductDecl} (checked : decl.Checked) :
+    checked.type.type.ClosedN 0 := by
+  have hclosed := checked.analysis_accepted.2.2.1
+  simp only [closedOK, Bool.and_eq_true, List.all_eq_true] at hclosed
+  exact of_decide_eq_true hclosed.1
+
+/-- Every constructor type retained by a successful descriptor has no loose
+term variables. -/
+theorem Checked.ctor_closed {decl : VInductDecl} (checked : decl.Checked)
+    {ctor : VConstVal} (hctor : ctor ∈ checked.type.ctors) : ctor.type.ClosedN 0 := by
+  have hclosed := checked.analysis_accepted.2.2.1
+  simp only [closedOK, Bool.and_eq_true, List.all_eq_true] at hclosed
+  exact of_decide_eq_true (hclosed.2 ctor hctor)
+
+/-- Every universe annotation in a checked family's type is in range. -/
+theorem Checked.type_levelWF {decl : VInductDecl} (checked : decl.Checked) :
+    checked.type.type.LevelWF decl.uvars := by
+  have hlevels := checked.analysis_accepted.2.2.2
+  simp only [levelsOK, Bool.and_eq_true, List.all_eq_true] at hlevels
+  exact of_decide_eq_true hlevels.1
+
+/-- Every universe annotation in a checked constructor type is in range. -/
+theorem Checked.ctor_levelWF {decl : VInductDecl} (checked : decl.Checked)
+    {ctor : VConstVal} (hctor : ctor ∈ checked.type.ctors) :
+    ctor.type.LevelWF decl.uvars := by
+  have hlevels := checked.analysis_accepted.2.2.2
+  simp only [levelsOK, Bool.and_eq_true, List.all_eq_true] at hlevels
+  exact of_decide_eq_true (hlevels.2 ctor hctor)
+
+/-- The direct one-family facts carried by the descriptor, including the
+new pre-declaration prohibition on self-reference in parameter/index domains. -/
+theorem Checked.direct_anatomy {decl : VInductDecl} (checked : decl.Checked) :
+    checked.type.uvars = decl.uvars ∧ checked.params.length = decl.nparams ∧
+    checked.resultLevel.WF decl.uvars ∧
+    (∀ P ∈ checked.params, P.hasConst checked.type.name = false) ∧
+    (∀ I ∈ checked.indices, I.hasConst checked.type.name = false) ∧
+    ∀ c ∈ checked.type.ctors, c.uvars = decl.uvars ∧
+      VExpr.telN decl.nparams c.type = VExpr.telN decl.nparams checked.type.type ∧
+      stage3Ctor decl.uvars checked.type.name decl.nparams checked.indices.length 0
+        (VExpr.dropN decl.nparams c.type) = true := by
+  have hdirect := checked.analysis_accepted.1
+  simp only [stage3DirectCore, Bool.and_eq_true, beq_iff_eq,
+    List.all_eq_true] at hdirect
+  obtain ⟨⟨⟨⟨hU, hparams⟩, hresult⟩, hformer⟩, hctors⟩ := hdirect
+  simp only [typeFormerOK, Bool.and_eq_true, List.all_eq_true] at hformer
+  refine ⟨hU, by simpa [checked.params_eq] using hparams, ?_, ?_, ?_, ?_⟩
+  · rw [checked.result_eq] at hresult
+    simpa using hresult
+  · simpa [checked.params_eq] using hformer.1
+  · simpa [checked.indices_eq] using hformer.2
+  · intro c hc
+    simpa [checked.indices_eq, and_assoc] using hctors c hc
+
+/-- The raw family payload has the source declaration's universe arity. -/
+theorem NormalizedChecked.sourceType_uvars_eq {source : VInductDecl}
+    (block : NormalizedChecked source) :
+    block.sourceType.uvars = source.uvars := by
+  obtain ⟨raw, hsource, _, hrawU, _⟩ := block.source_anatomy
+  have hraw : raw = block.sourceType := by
+    simpa using hsource.symm.trans block.source_types_eq
+  subst raw
+  exact hrawU.trans
+    (block.checked.direct_anatomy.1.trans block.uvars_eq.symm)
+
+/-- The raw and checked family identities agree. -/
+theorem NormalizedChecked.sourceType_name_eq {source : VInductDecl}
+    (block : NormalizedChecked source) :
+    block.sourceType.name = block.checked.type.name := by
+  obtain ⟨raw, hsource, hname, _, _⟩ := block.source_anatomy
+  have hraw : raw = block.sourceType := by
+    simpa using hsource.symm.trans block.source_types_eq
+  subst raw
+  exact hname
+
+/-- Every paired raw constructor has the source declaration's universe
+arity. -/
+theorem GenerationChecked.ctor_uvars_eq {source : VInductDecl}
+    (gen : GenerationChecked source) {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    ctor.raw.uvars = source.uvars := by
+  have hview : ctor.view ∈ gen.block.checked.constructors := by
+    rw [← gen.viewCtors_eq]
+    exact List.mem_map.2 ⟨ctor, hctor, rfl⟩
+  rw [gen.block.checked.constructors_eq] at hview
+  have hviewU :
+      ctor.view.value.uvars = gen.block.normalization.view.uvars := by
+    obtain ⟨c, hc, hcview⟩ := List.mem_map.1 hview
+    rw [← hcview]
+    exact (gen.block.checked.direct_anatomy.2.2.2.2.2 c hc).1
+  have hpairU := (gen.shape.2.2.2.2.2 ctor hctor).2.1
+  exact hpairU.trans (hviewU.trans gen.block.uvars_eq.symm)
+
+/-- A paired checked constructor is exactly the direct analyzer result for
+the corresponding constructor in the normalized view. The statement is
+rewritten to the raw block's public header, whose equality is certified by
+normalization shape. -/
+theorem GenerationChecked.viewCtor_ofDirect {source : VInductDecl}
+    (gen : GenerationChecked source) {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    ∃ c ∈ gen.block.checked.type.ctors,
+      ctor.view = CheckedCtor.ofDirect source.uvars
+        gen.block.sourceType.name source.nparams
+        gen.block.checked.indices.length c := by
+  have hview : ctor.view ∈ gen.block.checked.constructors := by
+    rw [← gen.viewCtors_eq]
+    exact List.mem_map.2 ⟨ctor, hctor, rfl⟩
+  rw [gen.block.checked.constructors_eq] at hview
+  obtain ⟨c, hc, hcview⟩ := List.mem_map.1 hview
+  refine ⟨c, hc, ?_⟩
+  rw [gen.block.uvars_eq, gen.block.nparams_eq,
+    gen.block.sourceType_name_eq]
+  exact hcview.symm
+
+/-- Re-index declaration well-formedness onto the normalized checked data. -/
+theorem Checked.wf_of_decl {decl : VInductDecl} (checked : decl.Checked)
+    (hdecl : decl.WF env) : checked.WF env := by
+  obtain ⟨-, hwf⟩ := hdecl
+  obtain ⟨htel, hctors⟩ := hwf checked.type (by
+    rw [checked.types_eq]
+    exact .head _)
+  have hsort : sortLevel decl.nparams checked.type = checked.resultLevel := by
+    simp only [sortLevel, checked.result_eq]
+  unfold Checked.WF
+  refine ⟨?_, fun c hc => ?_⟩
+  · simpa [checked.params_eq, checked.indices_eq] using htel
+  · simpa [checked.params_eq, checked.indices_eq, hsort] using hctors c hc
+
+/-- Normalized semantic evidence reconstructs the legacy declaration-level
+`WF` contract. This is the compatibility direction used while clients migrate
+to `Checked.WF`. -/
+theorem Checked.to_declWF {decl : VInductDecl} (checked : decl.Checked)
+    (hchecked : decl.checked? = some checked) (hwf : checked.WF env) : decl.WF env := by
+  refine ⟨by simp [singletonStage3, hchecked], ?_⟩
+  intro ty hty
+  rw [checked.types_eq] at hty
+  obtain rfl := List.mem_singleton.1 hty
+  have hsort : sortLevel decl.nparams checked.type = checked.resultLevel := by
+    simp only [sortLevel, checked.result_eq]
+  unfold Checked.WF at hwf
+  simpa [checked.params_eq, checked.indices_eq, hsort] using hwf
+
+/-- The environment-indexed declaration contract is exactly the existence of
+the analyzer result together with semantic evidence for its normalized data. -/
+theorem wf_iff_exists_checked {decl : VInductDecl} :
+    decl.WF env ↔ ∃ checked, decl.checked? = some checked ∧ checked.WF env := by
+  constructor
+  · intro hdecl
+    obtain ⟨checked, hchecked⟩ := exists_checked_of_singletonStage3 hdecl.1
+    exact ⟨checked, hchecked, checked.wf_of_decl hdecl⟩
+  · rintro ⟨checked, hchecked, hwf⟩
+    exact checked.to_declWF hchecked hwf
+
+/- Keep the first exported descriptor invariants on the same accepted Theory
+axiom baseline as the transaction API. -/
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.names_nodup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.type_closed [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.ctor_closed [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.analysis_accepted [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.type_levelWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.ctor_levelWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.direct_anatomy [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.wf_of_decl [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.to_declWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.wf_iff_exists_checked [propext, Quot.sound]
+
+/-- Unpack `stage3` for a declaration already known (from `addInduct`
+success) to have a singleton type list. -/
+theorem singletonStage3_anatomy {U np ty}
+    (h : singletonStage3 ⟨U, np, [ty]⟩ = true) :
+    ty.uvars = U ∧ (VExpr.telN np ty.type).length = np ∧
+    (∃ l, VExpr.resultOf (VExpr.dropN np ty.type) = .sort l ∧ l.WF U) ∧
+    (∀ I ∈ ctorFields (VExpr.dropN np ty.type), I.hasConst ty.name = false) ∧
+    ∀ c ∈ ty.ctors, c.uvars = U ∧
+      VExpr.telN np c.type = VExpr.telN np ty.type ∧
+      stage3Ctor U ty.name np (ctorFields (VExpr.dropN np ty.type)).length 0
+        (VExpr.dropN np c.type) = true := by
+  obtain ⟨checked, -⟩ := exists_checked_of_singletonStage3 h
+  have hcore := checked.accepted
+  simp only [stage3Core, Bool.and_eq_true] at hcore
+  have hdirect := hcore.1
+  simp only [stage3DirectCore, Bool.and_eq_true, beq_iff_eq,
+    List.all_eq_true] at hdirect
+  obtain ⟨⟨⟨⟨h1, h2⟩, h3⟩, h4⟩, h6⟩ := hdirect
+  simp only [typeFormerOK, Bool.and_eq_true, List.all_eq_true] at h4
+  refine ⟨h1, h2, ?_, fun I hI => by simpa [Bool.not_eq_true'] using h4.2 I hI,
+    fun c hc => by simpa [and_assoc] using h6 c hc⟩
+  split at h3
+  · next l heq => exact ⟨l, heq, by simpa using h3⟩
+  · exact Bool.noConfusion h3
+
+end VInductDecl
+
+/-! ## Context and spine lemmas -/
+
+theorem Lookup.append {A : VExpr} : ∀ (Δ : List VExpr) {Γ},
+    Lookup (Δ ++ A :: Γ) Δ.length (A.liftN (Δ.length + 1))
+  | [], _ => .zero
+  | B :: Δ, Γ => by
+    simpa [← VExpr.liftN_succ] using (Lookup.append (A := A) Δ (Γ := Γ)).succ (A := B)
+
+theorem Lookup.append_closed {A : VExpr} (hA : A.ClosedN 0) (Δ : List VExpr) {Γ} :
+    Lookup (Δ ++ A :: Γ) Δ.length A := by
+  simpa [hA.liftN_eq (Nat.zero_le _)] using Lookup.append (A := A) Δ (Γ := Γ)
+
+theorem Lookup.of_getElem? : ∀ {Γ : List VExpr} {i : Nat} {A : VExpr},
+    Γ[i]? = some A → Lookup Γ i (A.liftN (i+1))
+  | B :: _, 0, A, h => by
+    obtain rfl : B = A := by simpa using h
+    exact .zero
+  | B :: Γ, i+1, A, h => by
+    have := Lookup.of_getElem? (Γ := Γ) (i := i) (A := A) (by simpa using h)
+    simpa [← VExpr.liftN_succ] using this.succ (A := B)
+
+theorem Lookup.of_getElem?_closed {Γ : List VExpr} {i : Nat} {A : VExpr}
+    (h : Γ[i]? = some A) (hA : A.ClosedN 0) : Lookup Γ i A := by
+  simpa [hA.liftN_eq (Nat.zero_le _)] using Lookup.of_getElem? h
+
+/-- Right-associated: the element right past a two-part prefix. -/
+theorem getElem?_rstack3 {α} (Δ mid : List α) (a : α) (Γ : List α) {i : Nat}
+    (h : i = Δ.length + mid.length) : (Δ ++ (mid ++ a :: Γ))[i]? = some a := by
+  rw [List.getElem?_append_right (by omega), List.getElem?_append_right (by omega),
+    show i - Δ.length - mid.length = 0 from by omega]
+  rfl
+
+/-- Right-associated: an element inside the middle block. -/
+theorem getElem?_rstack_mid {α} (Δ mid Γ : List α) {i : Nat}
+    (h1 : Δ.length ≤ i) (h2 : i - Δ.length < mid.length) :
+    (Δ ++ (mid ++ Γ))[i]? = mid[i - Δ.length]? := by
+  rw [List.getElem?_append_right h1, List.getElem?_append_left h2]
+
+/-- The element right past a two-part prefix. -/
+theorem getElem?_stack3 {α} (Δ mid Γ : List α) (a : α) {i : Nat}
+    (h : i = Δ.length + mid.length) : (Δ ++ mid ++ a :: Γ)[i]? = some a := by
+  rw [List.append_assoc, List.getElem?_append_right (by omega),
+    show i - Δ.length = mid.length from by omega,
+    List.getElem?_append_right (Nat.le_refl _), Nat.sub_self]
+  rfl
+
+/-- An element inside the middle block of a three-part context. -/
+theorem getElem?_stack_mid {α} (Δ mid Γ : List α) {i : Nat}
+    (h1 : Δ.length ≤ i) (h2 : i - Δ.length < mid.length) :
+    (Δ ++ mid ++ Γ)[i]? = mid[i - Δ.length]? := by
+  rw [List.append_assoc, List.getElem?_append_right h1,
+    List.getElem?_append_left h2]
+
+namespace VEnv
+
+/-- A typed Theory expression cannot mention a constant absent from its
+environment. -/
+theorem HasType.hasConst_false_of_absent
+    {env : VEnv} {U : Nat} {Γ : List VExpr}
+    {name : Name} {e A : VExpr}
+    (henv : env.Ordered) (hΓ : OnCtx Γ (env.IsType U))
+    (absent : env.constants name = none)
+    (typed : env.HasType U Γ e A) :
+    e.hasConst name = false := by
+  induction e generalizing Γ A with
+  | bvar | sort => rfl
+  | const constant levels =>
+      by_cases equality : constant = name
+      · subst constant
+        obtain ⟨ci, present, levelWF, arity⟩ :=
+          typed.const_inv henv hΓ
+        rw [absent] at present
+        contradiction
+      · simp [VExpr.hasConst, equality]
+  | app function argument functionIH argumentIH =>
+      obtain ⟨domain, body, functionType, argumentType⟩ :=
+        typed.app_inv henv hΓ
+      simp only [VExpr.hasConst, functionIH hΓ functionType,
+        argumentIH hΓ argumentType, Bool.false_or]
+  | lam domain body domainIH bodyIH =>
+      obtain ⟨domainType, bodyWF⟩ := typed.lam_inv henv hΓ
+      obtain ⟨domainLevel, domainHasType⟩ := domainType
+      obtain ⟨bodyType, bodyHasType⟩ := bodyWF
+      have nextContextWF : OnCtx (domain :: Γ) (env.IsType U) := by
+        change OnCtx Γ (env.IsType U) ∧ env.IsType U Γ domain
+        exact ⟨hΓ, ⟨domainLevel, domainHasType⟩⟩
+      simp only [VExpr.hasConst, domainIH hΓ domainHasType,
+        bodyIH nextContextWF bodyHasType, Bool.false_or]
+  | forallE domain body domainIH bodyIH =>
+      obtain ⟨domainType, bodyType⟩ := typed.forallE_inv henv
+      obtain ⟨domainLevel, domainHasType⟩ := domainType
+      obtain ⟨bodyLevel, bodyHasType⟩ := bodyType
+      have nextContextWF : OnCtx (domain :: Γ) (env.IsType U) := by
+        change OnCtx Γ (env.IsType U) ∧ env.IsType U Γ domain
+        exact ⟨hΓ, ⟨domainLevel, domainHasType⟩⟩
+      simp only [VExpr.hasConst, domainIH hΓ domainHasType,
+        bodyIH nextContextWF bodyHasType, Bool.false_or]
+
+/-- The spine `bvarRevRange Δ.length As.length` selects exactly the binders
+`As` (reversed into the context past `Δ`), when all of `As` are closed. -/
+theorem hasType_bvarRevRange {env : VEnv} {U : Nat} :
+    ∀ {As : List VExpr}, (∀ A ∈ As, A.ClosedN 0) → ∀ {Δ Γ₀ : List VExpr},
+    List.Forall₂ (env.HasType U (Δ ++ As.reverse ++ Γ₀))
+      (VExpr.bvarRevRange Δ.length As.length) As
+  | [], _, _, _ => .nil
+  | A :: As, h, Δ, Γ₀ => by
+    refine .cons (.bvar ?_) ?_
+    · have := Lookup.append_closed (h _ (.head _)) (Δ ++ As.reverse) (Γ := Γ₀)
+      simpa [List.append_assoc] using this
+    · have := hasType_bvarRevRange (env := env) (U := U) (As := As)
+        (fun A h' => h _ (.tail _ h')) (Δ := Δ) (Γ₀ := A :: Γ₀)
+      simpa [List.append_assoc] using this
+
+theorem ClosedN.forallN_of_all {As : List VExpr} (hAs : ∀ A ∈ As, A.ClosedN 0)
+    {B : VExpr} (hB : B.ClosedN 0) {k : Nat} : (VExpr.forallN As B).ClosedN k := by
+  induction As generalizing k with
+  | nil => exact hB.mono (Nat.zero_le _)
+  | cons A As ih =>
+    exact ⟨(hAs _ (.head _)).mono (Nat.zero_le _), ih fun A h => hAs _ (.tail _ h)⟩
+
+/-- Substituting a variable for the innermost binder of a lifted term is a
+smaller lift: the telescope-self-application identity. Unconditional. -/
+theorem _root_.Ix.Theory.Named.VExpr.liftN_succ_inst_bvar (e : VExpr) :
+    ∀ (s k : Nat), (e.liftN (s+1) (k+1)).inst (.bvar s) k = e.liftN s k := by
+  induction e with intro s k
+  | bvar j =>
+    show VExpr.instVar (liftVar (s+1) j (k+1)) (.bvar s) k = .bvar (liftVar s j k)
+    unfold liftVar
+    rcases Nat.lt_trichotomy j k with h | rfl | h
+    · rw [if_pos (Nat.lt_succ_of_lt h), if_pos h]
+      simp [VExpr.instVar, h]
+    · rw [if_pos (Nat.lt_succ_self _), if_neg (Nat.lt_irrefl _)]
+      show VExpr.instVar j (.bvar s) j = _
+      rw [show VExpr.instVar j (.bvar s) j = (VExpr.bvar s).liftN j from by
+        unfold VExpr.instVar; rw [if_neg (Nat.lt_irrefl _), if_pos rfl]]
+      show VExpr.bvar (liftVar j s) = _
+      rw [liftVar_base, Nat.add_comm]
+    · rw [if_neg (by omega), if_neg (by omega)]
+      simp only [VExpr.instVar]
+      rw [if_neg (by omega), if_neg (by omega)]
+      congr 1; omega
+  | sort | const => intros; rfl
+  | app f a ihf iha => simp [VExpr.liftN, VExpr.inst, ihf, iha]
+  | lam A b ihA ihb | forallE A b ihA ihb =>
+    simp [VExpr.liftN, VExpr.inst, ihA s k, ihb s (k+1)]
+
+/-- Applying `f : (∀ As, B).liftN Δ.length` to the spine of variables
+referring to its own binders, sitting in the context right below `Δ`.
+The lift on the type in the hypothesis is what makes the invariant close
+over the recursion; no closedness is needed. -/
+theorem HasType.appN_selfSpine {env : VEnv} {U : Nat} :
+    ∀ {As : List VExpr} {B : VExpr} {Δ Γ : List VExpr} {f},
+    env.HasType U (Δ ++ As.reverse ++ Γ) f
+      ((VExpr.forallN As B).liftN (Δ.length + As.length)) →
+    env.HasType U (Δ ++ As.reverse ++ Γ)
+      (f.appN (VExpr.bvarRevRange Δ.length As.length)) (B.liftN Δ.length)
+  | [], B, Δ, Γ, f, hf => by simpa using hf
+  | A :: As, B, Δ, Γ, f, hf => by
+    have harg : env.HasType U (Δ ++ (A :: As).reverse ++ Γ)
+        (.bvar (Δ.length + As.length)) (A.liftN (Δ.length + As.length + 1)) := by
+      have := Lookup.append (A := A) (Δ ++ As.reverse) (Γ := Γ)
+      simp only [List.length_append, List.length_reverse] at this
+      exact .bvar (by simpa [List.append_assoc, Nat.add_assoc] using this)
+    have happ := HasType.app hf harg
+    simp only [List.length_cons, Nat.add_succ] at happ
+    rw [VExpr.liftN_succ_inst_bvar] at happ
+    have := HasType.appN_selfSpine (As := As) (B := B) (Δ := Δ) (Γ := A :: Γ)
+      (f := f.app (.bvar (Δ.length + As.length))) (by simpa [List.append_assoc] using happ)
+    simpa [List.append_assoc, VExpr.bvarRevRange] using this
+
+/-- The closed-telescope entry point for `appN_selfSpine`. -/
+theorem HasType.appN_selfSpine' {env : VEnv} {U : Nat}
+    {As : List VExpr} {B : VExpr} {Δ Γ : List VExpr} {f}
+    (hcl : (VExpr.forallN As B).ClosedN 0)
+    (hf : env.HasType U (Δ ++ As.reverse ++ Γ) f (VExpr.forallN As B)) :
+    env.HasType U (Δ ++ As.reverse ++ Γ)
+      (f.appN (VExpr.bvarRevRange Δ.length As.length)) (B.liftN Δ.length) :=
+  HasType.appN_selfSpine (by rwa [hcl.liftN_eq (Nat.zero_le _)])
+
+/-- Application of a closed non-dependent telescope. -/
+theorem HasType.appN_closed {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {As : List VExpr}, (∀ A ∈ As, A.ClosedN 0) → ∀ {B : VExpr}, B.ClosedN 0 →
+    ∀ {f args}, env.HasType U Γ f (VExpr.forallN As B) →
+    List.Forall₂ (env.HasType U Γ) args As →
+    env.HasType U Γ (f.appN args) B
+  | [], _, _, _, _, _, hf, .nil => hf
+  | A :: As, hAs, B, hB, f, a :: as, hf, .cons ha hargs => by
+    have h2 : env.HasType U Γ (f.app a) ((VExpr.forallN As B).inst a) := .app hf ha
+    rw [(ClosedN.forallN_of_all (fun A h => hAs _ (.tail _ h)) hB).instN_eq
+      (Nat.zero_le _)] at h2
+    exact appN_closed (fun A h => hAs _ (.tail _ h)) hB (f := f.app a) h2 hargs
+
+theorem isType_forallN_free {env : VEnv} {U : Nat} {As : List VExpr}
+    (hAs : ∀ A ∈ As, ∀ Γ, env.IsType U Γ A)
+    {B : VExpr} (hB : ∀ Γ, env.IsType U Γ B) : ∀ Γ, env.IsType U Γ (VExpr.forallN As B) := by
+  induction As with
+  | nil => exact hB
+  | cons A As ih =>
+    exact fun Γ => (hAs _ (.head _) Γ).forallE
+      (ih (fun A h => hAs _ (.tail _ h)) (A :: Γ))
+
+theorem HasType.lamN {env : VEnv} {U : Nat} : ∀ {As Γ body B},
+    OnTel env U Γ As → env.HasType U (As.reverse ++ Γ) body B →
+    env.HasType U Γ (VExpr.lamN As body) (VExpr.forallN As B)
+  | [], _, _, _, _, hb => hb
+  | A :: As, Γ, body, B, ⟨⟨_, hA⟩, hT⟩, hb =>
+    HasType.lam hA (HasType.lamN hT (by simpa [List.append_assoc] using hb))
+
+theorem IsType.forallN {env : VEnv} {U : Nat} : ∀ {As Γ B},
+    OnTel env U Γ As → env.IsType U (As.reverse ++ Γ) B →
+    env.IsType U Γ (VExpr.forallN As B)
+  | [], _, _, _, hB => hB
+  | A :: As, Γ, B, ⟨hA, hT⟩, hB =>
+    IsType.forallE hA (IsType.forallN hT (by simpa [List.append_assoc] using hB))
+
+theorem onTel_of_free {env : VEnv} {U : Nat} : ∀ {As Γ},
+    (∀ A ∈ As, ∀ Γ', env.IsType U Γ' A) → OnTel env U Γ As
+  | [], _, _ => trivial
+  | _ :: _, _, h =>
+    ⟨h _ (.head _) _, onTel_of_free fun _ h' Γ' => h _ (.tail _ h') Γ'⟩
+
+theorem OnTel.append {env : VEnv} {U : Nat} : ∀ {As Bs Γ},
+    OnTel env U Γ As → OnTel env U (As.reverse ++ Γ) Bs → OnTel env U Γ (As ++ Bs)
+  | [], _, _, _, h2 => h2
+  | _ :: As, Bs, Γ, ⟨hA, h1⟩, h2 =>
+    ⟨hA, OnTel.append h1 (by simpa [List.append_assoc] using h2)⟩
+
+theorem OnTel.of_append {env : VEnv} {U : Nat} : ∀ {As Bs Γ},
+    OnTel env U Γ (As ++ Bs) → OnTel env U Γ As ∧ OnTel env U (As.reverse ++ Γ) Bs
+  | [], _, _, h => ⟨trivial, h⟩
+  | A :: As, Bs, Γ, ⟨hA, hT⟩ => by
+    obtain ⟨h1, h2⟩ := OnTel.of_append (As := As) hT
+    exact ⟨⟨hA, h1⟩, by simpa [List.append_assoc] using h2⟩
+
+/-- Push a context lift under a reversed telescope: inserting binders below
+shifts each telescope entry at its own depth. -/
+theorem _root_.Ix.Theory.Named.Ctx.LiftN.consTel {n : Nat} : ∀ (As : List VExpr) {k : Nat}
+    {Γ Γ' : List VExpr}, Ctx.LiftN n k Γ Γ' →
+    Ctx.LiftN n (As.length + k) (As.reverse ++ Γ)
+      ((VExpr.liftTelN n As k).reverse ++ Γ')
+  | [], k, Γ, Γ', W => by simpa using W
+  | A :: As, k, Γ, Γ', W => by
+    have h := Ctx.LiftN.consTel As (Ctx.LiftN.succ (A := A) W)
+    rw [show As.length + (k+1) = (A :: As).length + k from by simp; omega] at h
+    simpa [VExpr.liftTelN, List.append_assoc] using h
+
+/-- Weakening a telescope: inserting binders at depth `k` of the context
+shifts each entry at its own depth. -/
+theorem OnTel.weakN {env : VEnv} {U n : Nat} (henv : env.Ordered) :
+    ∀ {As Γ Γ' k}, Ctx.LiftN n k Γ Γ' → OnTel env U Γ As →
+    OnTel env U Γ' (VExpr.liftTelN n As k)
+  | [], _, _, _, _, _ => trivial
+  | _ :: _, _, _, _, W, ⟨hA, hT⟩ =>
+    ⟨hA.weakN henv W, OnTel.weakN henv W.succ hT⟩
+
+/-- Universe instantiation of a telescope. -/
+theorem OnTel.instL {env : VEnv} {U U' : Nat} {ls : List VLevel}
+    (hls : ∀ l ∈ ls, l.WF U') :
+    ∀ {As Γ}, OnTel env U Γ As →
+    OnTel env U' (Γ.map (VExpr.instL ls)) (As.map (VExpr.instL ls))
+  | [], _, _ => trivial
+  | _ :: As, Γ, ⟨hA, hT⟩ =>
+    ⟨hA.instL hls, by simpa using OnTel.instL hls (As := As) (Γ := _ :: Γ) hT⟩
+
+/-! ### Spine typing -/
+
+theorem SpineWF.hasType_appN {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {es : List VExpr} {A B f : VExpr}, env.SpineWF U Γ A es B →
+    env.HasType U Γ f A → env.HasType U Γ (f.appN es) B := by
+  intro es
+  induction es with intro A B f h hf
+  | nil => cases h; exact hf
+  | cons e es ih =>
+      cases h with
+      | cons he hrest =>
+        exact ih hrest (hf.app he)
+
+/-- Concatenate two adjacent, well-typed application spines. -/
+theorem SpineWF.append {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {es : List VExpr} {A B : VExpr}, env.SpineWF U Γ A es B →
+      ∀ {es' : List VExpr} {C : VExpr}, env.SpineWF U Γ B es' C →
+        env.SpineWF U Γ A (es ++ es') C
+  | [], _, _, .nil, _, _, h' => h'
+  | _ :: _, _, _, .cons he hrest, _, _, h' =>
+      .cons he (SpineWF.append hrest h')
+
+/-- Split a well-typed application spine at an explicit list prefix. -/
+theorem SpineWF.split {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {front suffix : List VExpr} {A B : VExpr},
+      env.SpineWF U Γ A (front ++ suffix) B →
+      ∃ cursor, env.SpineWF U Γ A front cursor ∧
+        env.SpineWF U Γ cursor suffix B
+  | [], suffix, A, B, h => ⟨A, .nil, by simpa using h⟩
+  | _ :: front, suffix, _, _, .cons he hrest => by
+      obtain ⟨cursor, hfront, hsuffix⟩ := SpineWF.split hrest
+      exact ⟨cursor, .cons he hfront, hsuffix⟩
+
+/-- Extend a well-typed application spine by one final argument. -/
+theorem SpineWF.snoc {env : VEnv} {U : Nat} {Γ : List VExpr} {e D C : VExpr} :
+    ∀ {es : List VExpr} {A : VExpr}, env.SpineWF U Γ A es (.forallE D C) →
+    env.HasType U Γ e D → env.SpineWF U Γ A (es ++ [e]) (C.inst e)
+  | [], _, .nil, he => .cons he .nil
+  | _ :: _, _, .cons ha hrest, he =>
+    .cons ha (SpineWF.snoc hrest he)
+
+/-- Retarget a spine judgment along a pi with the same domains: the
+result is the iterated instantiation of the new codomain. -/
+theorem SpineWF.retarget {env : VEnv} {U : Nat} {Γ : List VExpr} {es : List VExpr} :
+    ∀ {Δ : List VExpr} {C B : VExpr}, env.SpineWF U Γ (VExpr.forallN Δ C) es B →
+    es.length = Δ.length → ∀ (C' : VExpr),
+    env.SpineWF U Γ (VExpr.forallN Δ C') es (VExpr.instRev C' es) := by
+  induction es with intro Δ C B h hlen C'
+  | nil =>
+    obtain rfl : Δ = [] := by
+      cases Δ with
+      | nil => rfl
+      | cons _ _ => simp at hlen
+    cases h
+    exact .nil
+  | cons e es ih =>
+    cases Δ with
+    | nil => simp at hlen
+    | cons A Δ =>
+      cases h with
+      | cons he hrest =>
+        have hlen' : es.length = Δ.length := by simpa using hlen
+        refine .cons he ?_
+        rw [VExpr.instN_forallN] at hrest
+        have := ih hrest (by simp [VExpr.instTelN_length, hlen']) (C'.inst e Δ.length)
+        show env.SpineWF U Γ ((VExpr.forallN Δ C').inst e) es
+          (VExpr.instRev (C'.inst e es.length) es)
+        rw [VExpr.instN_forallN, Nat.zero_add, hlen']
+        exact this
+
+/-- A spine consuming a full telescope and ending in the same sort has
+exactly one argument per telescope binder. -/
+theorem SpineWF.forallN_sort_length
+    {env : VEnv} {U : Nat} {Γ : List VExpr} {l : VLevel} :
+    ∀ {As es}, env.SpineWF U Γ (VExpr.forallN As (.sort l)) es (.sort l) →
+      es.length = As.length
+  | [], [], _ => rfl
+  | [], _ :: _, h => by cases h
+  | _ :: _, [], h => by cases h
+  | A :: As, e :: es, h => by
+    cases h with
+    | cons he hrest =>
+      rw [VExpr.instN_forallN] at hrest
+      have hlen := SpineWF.forallN_sort_length hrest
+      simpa [VExpr.instTelN_length] using congrArg Nat.succ hlen
+
+end VEnv
+
+/-! ## The induction-hypothesis telescope under lifting -/
+
+namespace VInductDecl
+
+/-- `ihsFrom` after the motive-directed lift into the rule context. -/
+def ihsR (m k : Nat) : List (Nat × List VExpr) → Nat → List VExpr
+  | [], _ => []
+  | (j, idxs) :: rs, p =>
+    VExpr.appN (.bvar (k + (m + p)))
+      ((idxs.map fun e => ((e.liftN 1 j).liftN (m-j+p)).liftN k (m+p)) ++
+        [.bvar (m-1-j+p)]) ::
+    ihsR m k rs (p+1)
+
+/-- Recursive-field positions are bounded by the field count. -/
+theorem recPairs_lt {U : Nat} {T : Name} {np ni : Nat} : ∀ {Bs : List VExpr} {j₀ : Nat},
+    ∀ q ∈ recPairs U T np ni Bs j₀, q.1 < j₀ + Bs.length
+  | B :: Bs, j₀, q, h => by
+    unfold recPairs at h
+    split at h
+    · rcases List.mem_cons.1 h with rfl | h
+      · simp
+      · have := recPairs_lt _ h
+        simp only [List.length_cons]; omega
+    · have := recPairs_lt _ h
+      simp only [List.length_cons]; omega
+
+theorem recPairs_ge {U : Nat} {T : Name} {np ni : Nat} : ∀ {Bs : List VExpr} {j₀ : Nat},
+    ∀ q ∈ recPairs U T np ni Bs j₀, j₀ ≤ q.1
+  | _ :: Bs, j₀, q, h => by
+    unfold recPairs at h
+    split at h
+    · rcases List.mem_cons.1 h with rfl | h
+      · exact Nat.le_refl _
+      · exact Nat.le_of_succ_le (recPairs_ge _ h)
+    · exact Nat.le_of_succ_le (recPairs_ge _ h)
+
+/-- Recursive positions really hold a recursive field, and the recorded
+index arguments are its index arguments. -/
+theorem recPairs_getElem {U : Nat} {T : Name} {np ni : Nat} : ∀ {Bs : List VExpr} {j₀ : Nat},
+    ∀ q ∈ recPairs U T np ni Bs j₀, ∃ B, Bs[q.1 - j₀]? = some B ∧
+      isRecField U T np ni q.1 B = true ∧ q.2 = recFieldIdxs np B
+  | B :: Bs, j₀, q, h => by
+    unfold recPairs at h
+    split at h
+    · next heq =>
+      rcases List.mem_cons.1 h with rfl | h
+      · exact ⟨B, by simp, heq, rfl⟩
+      · have h1 := recPairs_ge _ h
+        obtain ⟨B', hB', hrec, hidx⟩ := recPairs_getElem _ h
+        refine ⟨B', ?_, hrec, hidx⟩
+        rw [show q.1 - j₀ = (q.1 - (j₀+1)) + 1 from by omega]
+        simpa using hB'
+    · have h1 := recPairs_ge _ h
+      obtain ⟨B', hB', hrec, hidx⟩ := recPairs_getElem _ h
+      refine ⟨B', ?_, hrec, hidx⟩
+      rw [show q.1 - j₀ = (q.1 - (j₀+1)) + 1 from by omega]
+      simpa using hB'
+
+/-- Every analyzed recursive argument names a field within the source
+telescope. -/
+theorem recArgs_lt {U : Nat} {T : Name} {np ni : Nat} : ∀ {Bs : List VExpr} {j₀ : Nat},
+    ∀ r ∈ recArgs U T np ni Bs j₀, r.fieldIndex < j₀ + Bs.length
+  | B :: Bs, j₀, r, h => by
+    unfold recArgs at h
+    split at h
+    · next r₀ hr₀ =>
+      rcases List.mem_cons.1 h with rfl | h
+      · have hj := (recArg?_eq hr₀).1
+        simp only [List.length_cons]
+        omega
+      · have := recArgs_lt _ h
+        simp only [List.length_cons]; omega
+    · have := recArgs_lt _ h
+      simp only [List.length_cons]; omega
+
+/-- Recursive-argument field positions never precede the starting depth. -/
+theorem recArgs_ge {U : Nat} {T : Name} {np ni : Nat} : ∀ {Bs : List VExpr} {j₀ : Nat},
+    ∀ r ∈ recArgs U T np ni Bs j₀, j₀ ≤ r.fieldIndex
+  | _ :: Bs, j₀, r, h => by
+    unfold recArgs at h
+    split at h
+    · next r₀ hr₀ =>
+      rcases List.mem_cons.1 h with rfl | h
+      · simp [(recArg?_eq hr₀).1]
+      · exact Nat.le_of_succ_le (recArgs_ge _ h)
+    · exact Nat.le_of_succ_le (recArgs_ge _ h)
+
+/-- An analyzed recursive argument is backed by the field at its recorded
+position, and re-analysis returns the same normalized descriptor. -/
+theorem recArgs_getElem {U : Nat} {T : Name} {np ni : Nat} :
+    ∀ {Bs : List VExpr} {j₀ : Nat}, ∀ r ∈ recArgs U T np ni Bs j₀,
+    ∃ B, Bs[r.fieldIndex - j₀]? = some B ∧
+      recArg? U T np ni r.fieldIndex B = some r
+  | B :: Bs, j₀, r, h => by
+    unfold recArgs at h
+    split at h
+    · next r₀ hr₀ =>
+      rcases List.mem_cons.1 h with rfl | h
+      · have hj := (recArg?_eq hr₀).1
+        subst hj
+        exact ⟨B, by simp, hr₀⟩
+      · have hge := recArgs_ge _ h
+        obtain ⟨B', hB', hr⟩ := recArgs_getElem _ h
+        refine ⟨B', ?_, hr⟩
+        rw [show r.fieldIndex - j₀ = (r.fieldIndex - (j₀+1)) + 1 from by omega]
+        simpa using hB'
+    · have hge := recArgs_ge _ h
+      obtain ⟨B', hB', hr⟩ := recArgs_getElem _ h
+      refine ⟨B', ?_, hr⟩
+      rw [show r.fieldIndex - j₀ = (r.fieldIndex - (j₀+1)) + 1 from by omega]
+      simpa using hB'
+
+theorem ihsFrom_liftN (m k : Nat) : ∀ (rs : List (Nat × List VExpr)),
+    (∀ q ∈ rs, q.1 < m) → ∀ (p : Nat) (X : VExpr),
+    (VExpr.forallN (ihsFrom m rs p) X).liftN k (m + p) =
+    VExpr.forallN (ihsR m k rs p) (X.liftN k (m + p + rs.length))
+  | [], _, _, _ => rfl
+  | (j, idxs) :: rs, hm, p, X => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN_appN, List.map_append, List.map_map,
+        show ((VExpr.bvar (m+p)).liftN k (m+p)) = .bvar (k+(m+p)) from by
+          show VExpr.bvar (liftVar k (m+p) (m+p)) = _
+          rw [liftVar_le (Nat.le_refl _)],
+        show ([VExpr.bvar (m-1-j+p)]).map (VExpr.liftN k · (m+p)) =
+            [VExpr.bvar (m-1-j+p)] from by
+          show [VExpr.bvar (liftVar k (m-1-j+p) (m+p))] = _
+          rw [liftVar_lt (show m-1-j+p < m+p from by
+            have := hm _ (List.Mem.head _); simp at this; omega)]]
+      rfl
+    · rw [show m + p + 1 = m + (p+1) from rfl,
+        ihsFrom_liftN m k rs (fun q h => hm q (.tail _ h)) (p+1) X,
+        show m + (p+1) + rs.length = m + p + (rs.length+1) from by omega]
+      rfl
+
+/-- `ihsFrom_liftN` with the cutoff generalized, for syntactic rewriting. -/
+theorem ihsFrom_liftN' (m k : Nat) (rs : List (Nat × List VExpr))
+    (hm : ∀ q ∈ rs, q.1 < m) (p : Nat) (X : VExpr) {cut : Nat} (hcut : cut = m + p) :
+    (VExpr.forallN (ihsFrom m rs p) X).liftN k cut =
+    VExpr.forallN (ihsR m k rs p) (X.liftN k (m + p + rs.length)) := by
+  rw [hcut]; exact ihsFrom_liftN m k rs hm p X
+
+theorem ihsR_liftN1 (m k : Nat) : ∀ (rs : List (Nat × List VExpr)) (p c : Nat), c ≤ p →
+    (∀ q ∈ rs, q.1 < m) → ∀ (X : VExpr),
+    VExpr.forallN (ihsR m k rs (p+1)) (X.liftN 1 (c + rs.length)) =
+    (VExpr.forallN (ihsR m k rs p) X).liftN 1 c
+  | [], p, c, _, _, X => by simp [ihsR, VExpr.forallN]
+  | (j, idxs) :: rs, p, c, hc, hm, X => by
+    have hjm : j < m := by have := hm _ (List.Mem.head _); simpa using this
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN_appN, List.map_append, List.map_map,
+        show ((VExpr.bvar (k+(m+p))).liftN 1 c) = .bvar (k+(m+(p+1))) from by
+          show VExpr.bvar (liftVar 1 (k+(m+p)) c) = _
+          rw [liftVar_le (by omega)]
+          congr 1; omega,
+        show ([VExpr.bvar (m-1-j+p)]).map (VExpr.liftN 1 · c) =
+            [VExpr.bvar (m-1-j+(p+1))] from by
+          show [VExpr.bvar (liftVar 1 (m-1-j+p) c)] = _
+          rw [liftVar_le (by omega)]
+          congr 2; omega]
+      refine congrArg (VExpr.appN _) (congrArg (· ++ [VExpr.bvar (m-1-j+(p+1))]) ?_)
+      refine List.map_congr_left fun e _ => .symm ?_
+      show (((e.liftN 1 j).liftN (m-j+p)).liftN k (m+p)).liftN 1 c = _
+      rw [VExpr.liftN_liftN_comm _ 1 k c (m+p) (by omega),
+        show ((e.liftN 1 j).liftN (m-j+p)).liftN 1 c =
+          (e.liftN 1 j).liftN (m-j+(p+1)) from by
+          rw [VExpr.liftN'_liftN' (Nat.zero_le _) (by omega)]
+          rfl]
+      rfl
+    · rw [show c + ((j, idxs) :: rs).length = (c+1) + rs.length from by simp; omega]
+      exact ihsR_liftN1 m k rs (p+1) (c+1) (by omega) (fun q h => hm q (.tail _ h)) X
+
+theorem ihsFrom_length (m : Nat) : ∀ (rs : List (Nat × List VExpr)) (p : Nat),
+    (ihsFrom m rs p).length = rs.length
+  | [], _ => rfl
+  | (_, _) :: rs, p => by simp [ihsFrom, ihsFrom_length m rs (p+1)]
+
+theorem ihsFromRecArgs_length (m : Nat) : ∀ (rs : List RecArg) (p : Nat),
+    (ihsFromRecArgs m rs p).length = rs.length
+  | [], _ => rfl
+  | _ :: rs, p => by simp [ihsFromRecArgs, ihsFromRecArgs_length m rs (p+1)]
+
+theorem minorTypes_length (U : Nat) (T : Name) (np : Nat) (ty : VInductiveType) :
+    ∀ (cs : List VConstVal) (i : Nat), (minorTypes U T np ty cs i).length = cs.length
+  | [], _ => rfl
+  | _ :: cs, i => by simp [minorTypes, minorTypes_length U T np ty cs (i+1)]
+
+theorem minorTypesRec_length (U : Nat) (T : Name) (np : Nat) (ty : VInductiveType) :
+    ∀ (cs : List VConstVal) (i : Nat), (minorTypesRec U T np ty cs i).length = cs.length
+  | [], _ => rfl
+  | _ :: cs, i => by
+    simp [minorTypesRec, minorTypesRec_length U T np ty cs (i+1)]
+
+theorem bvarRevRange_liftN_ge : ∀ (m off n k : Nat), k ≤ off →
+    (VExpr.bvarRevRange off m).map (VExpr.liftN n · k) = VExpr.bvarRevRange (n + off) m
+  | 0, _, _, _, _ => rfl
+  | m+1, off, n, k, h => by
+    show VExpr.bvar _ :: _ = VExpr.bvar _ :: _
+    rw [bvarRevRange_liftN_ge m off n k h]
+    congr 2
+    show liftVar n (off + m) k = n + off + m
+    rw [liftVar_le (by omega)]; omega
+
+theorem bvarRevRange_instL : ∀ (m off : Nat) (ls : List VLevel),
+    (VExpr.bvarRevRange off m).map (VExpr.instL ls) = VExpr.bvarRevRange off m
+  | 0, _, _ => rfl
+  | m+1, off, ls => by
+    show _ :: _ = _ :: _
+    rw [bvarRevRange_instL m off ls]
+    rfl
+
+/-- The transported type of an analyzed recursive field is exactly its
+generated functional-IH domain telescope followed by the transported family
+target. -/
+theorem recArg_minor_fieldType {U : Nat} {T : Name} {np ni : Nat}
+    {B : VExpr} {r₀ : RecArg}
+    (hr : recArg? U T np ni r₀.fieldIndex B = some r₀)
+    (m p : Nat) (hj : r₀.fieldIndex < m)
+    (mode : ElimMode := .large) :
+    let ls := mode.sourceLevels U
+    let r := r₀.instL ls
+    ((B.instL ls).liftN 1 r.fieldIndex).liftN
+        (m-r.fieldIndex+p) =
+      VExpr.forallN (r.minorBinders m p)
+        (VExpr.appN (.const T ls)
+          (VExpr.bvarRevRange (m+p+r.binders.length+1) np ++
+            r.indices.map fun e =>
+              (e.liftN 1 (r.fieldIndex+r.binders.length)).liftN
+                (m-r.fieldIndex+p) r.binders.length)) := by
+  dsimp only
+  obtain ⟨-, -, hB, -, -, -⟩ := recArg?_eq hr
+  conv => lhs; rw [hB]
+  simp only [RecArg.instL, VExpr.instL_forallN, VExpr.instL_appN,
+    List.map_append, bvarRevRange_instL,
+    show (VExpr.const T (VLevel.params U)).instL (mode.sourceLevels U) =
+      .const T (mode.sourceLevels U) from by
+        simp [VExpr.instL, ElimMode.sourceLevels,
+          VLevel.params_map_inst_params'],
+    VExpr.liftN_forallN, VExpr.liftN_appN]
+  simp only [List.length_map, VExpr.liftTelN_length, Nat.zero_add]
+  rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    show
+      m - r₀.fieldIndex + p + (1 + (r₀.fieldIndex + r₀.binders.length)) =
+        m + p + r₀.binders.length + 1 from by omega]
+  simp only [List.map_map, RecArg.minorBinders]
+  apply congrArg (VExpr.forallN _)
+  apply congrArg (VExpr.appN (.const T (mode.sourceLevels U)))
+  apply congrArg (VExpr.bvarRevRange (m + p + r₀.binders.length + 1) np ++ ·)
+  apply List.map_congr_left
+  intro e _
+  simp only [Function.comp_apply]
+
+/-- Rule-context analogue of `recArg_minor_fieldType`: transport a recursive
+field beneath the motive and all constructor minors, then beneath the later
+constructor fields. -/
+theorem recArg_rule_fieldType {U : Nat} {T : Name} {np ni : Nat}
+    {B : VExpr} {r₀ : RecArg}
+    (hr : recArg? U T np ni r₀.fieldIndex B = some r₀)
+    (m k : Nat) (hj : r₀.fieldIndex < m)
+    (mode : ElimMode := .large) :
+    let ls := mode.sourceLevels U
+    let r := r₀.instL ls
+    ((B.instL ls).liftN (k+1) r.fieldIndex).liftN
+        (m-r.fieldIndex) =
+      VExpr.forallN (r.ruleBinders m k)
+        (VExpr.appN (.const T ls)
+          (VExpr.bvarRevRange (m+k+r.binders.length+1) np ++
+            r.indices.map fun e =>
+              (e.liftN (k+1) (r.fieldIndex+r.binders.length)).liftN
+                (m-r.fieldIndex) r.binders.length)) := by
+  dsimp only
+  obtain ⟨-, -, hB, -, -, -⟩ := recArg?_eq hr
+  conv => lhs; rw [hB]
+  simp only [RecArg.instL, VExpr.instL_forallN, VExpr.instL_appN,
+    List.map_append, bvarRevRange_instL,
+    show (VExpr.const T (VLevel.params U)).instL (mode.sourceLevels U) =
+      .const T (mode.sourceLevels U) from by
+        simp [VExpr.instL, ElimMode.sourceLevels,
+          VLevel.params_map_inst_params'],
+    VExpr.liftN_forallN, VExpr.liftN_appN]
+  simp only [List.length_map, VExpr.liftTelN_length, Nat.zero_add]
+  rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    show m - r₀.fieldIndex + (k + 1 + (r₀.fieldIndex + r₀.binders.length)) =
+      m + k + r₀.binders.length + 1 from by omega]
+  simp only [List.map_map, RecArg.ruleBinders]
+  apply congrArg (VExpr.forallN _)
+  apply congrArg (VExpr.appN (.const T (mode.sourceLevels U)))
+  apply congrArg (VExpr.bvarRevRange (m+k+r₀.binders.length+1) np ++ ·)
+  apply List.map_congr_left
+  intro e _
+  simp only [Function.comp_apply]
+
+theorem RecArg.minorBinders_shift (r : RecArg) (m p : Nat) :
+    r.minorBinders m p =
+      VExpr.liftTelN p (r.minorBinders m 0) 0 := by
+  simp only [RecArg.minorBinders, Nat.add_zero]
+  rw [VExpr.liftTelN_liftTelN]
+
+/-- The `p` parameter of a minor IH is exactly weakening over the `p`
+previous IH binders. -/
+theorem RecArg.minorIH_shift (r : RecArg) (m p : Nat)
+    (hj : r.fieldIndex < m) :
+    r.minorIH m p = (r.minorIH m 0).liftN p := by
+  simp only [RecArg.minorIH, VExpr.liftN_forallN]
+  rw [← r.minorBinders_shift m p]
+  rw [show (r.minorBinders m 0).length = r.binders.length by
+    simp [RecArg.minorBinders, VExpr.liftTelN_length], Nat.zero_add]
+  apply congrArg (VExpr.forallN _)
+  rw [VExpr.liftN_appN, List.map_append, List.map_map]
+  show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+  congr 1
+  · rw [show (VExpr.bvar (m + 0 + r.binders.length)).liftN
+        p r.binders.length = .bvar (m+p+r.binders.length) from by
+      simp only [VExpr.liftN]
+      rw [liftVar_le (by omega)]
+      congr 1
+      omega]
+  · congr 1
+    · apply List.map_congr_left
+      intro e _
+      simp only [Function.comp_apply, Nat.add_zero]
+      rw [VExpr.liftN'_liftN_hi]
+    · congr 1
+      simp only [Nat.add_zero, VExpr.liftN_appN]
+      rw [show (VExpr.bvar (m - 1 - r.fieldIndex + r.binders.length)).liftN
+          p r.binders.length =
+          .bvar (m - 1 - r.fieldIndex + p + r.binders.length) from by
+        simp only [VExpr.liftN]
+        rw [liftVar_le (by omega)]
+        congr 1
+        omega,
+        VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+
+/-- Lifting a base minor-IH through the constructor-minor stack produces the
+normal form expected of the corresponding recursive call in an iota rule. -/
+theorem RecArg.minorIH_zero_lift_ruleIH (r : RecArg) (m k : Nat)
+    (hj : r.fieldIndex < m) :
+    (r.minorIH m 0).liftN k m = r.ruleIH m k := by
+  simp only [RecArg.minorIH, RecArg.ruleIH, VExpr.liftN_forallN,
+    VExpr.liftTelN_length, RecArg.minorBinders, RecArg.ruleBinders, Nat.add_zero]
+  congr 1
+  · rw [show m = r.fieldIndex + (m-r.fieldIndex) from by omega]
+    rw [show r.fieldIndex + (m-r.fieldIndex) - r.fieldIndex =
+      m-r.fieldIndex from by omega]
+    rw [VExpr.liftTelN_liftN_mid r.binders k (m-r.fieldIndex) (Nat.zero_le _)]
+  · congr 1
+    rw [VExpr.liftN_appN, List.map_append, List.map_map]
+    show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+    congr 1
+    · simp only [VExpr.liftN]
+      rw [liftVar_le (Nat.le_refl _)]
+      congr 1
+      omega
+    · congr 1
+      · apply List.map_congr_left
+        intro e _
+        simp only [Function.comp_apply]
+        rw [show m + r.binders.length =
+            (r.fieldIndex + r.binders.length) + (m-r.fieldIndex) from by omega,
+          VExpr.liftN_liftN_mid e k (m-r.fieldIndex) (by omega)]
+      · congr 1
+        simp only [VExpr.liftN_appN]
+        rw [show (VExpr.bvar (m - 1 - r.fieldIndex + r.binders.length)).liftN
+            k (m + r.binders.length) =
+            .bvar (m - 1 - r.fieldIndex + r.binders.length) from by
+              simp only [VExpr.liftN]
+              rw [liftVar_lt (by omega)],
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+
+/-- General normalization for a minor-IH already shifted past `p` earlier IH
+binders. In rule context it is the base `ruleIH`, weakened by the same `p`. -/
+theorem RecArg.minorIH_lift_ruleIH (r : RecArg) (m k p : Nat)
+    (hj : r.fieldIndex < m) :
+    (r.minorIH m p).liftN k (m+p) = (r.ruleIH m k).liftN p := by
+  rw [r.minorIH_shift m p hj]
+  rw [← VExpr.liftN_liftN_comm (r.minorIH m 0) p k 0 m (Nat.zero_le _)]
+  rw [r.minorIH_zero_lift_ruleIH m k hj]
+
+theorem ruleIHs_length (m k : Nat) : ∀ (rs : List RecArg) (p : Nat),
+    (ruleIHs m k rs p).length = rs.length
+  | [], _ => rfl
+  | _ :: rs, p => by simp [ruleIHs, ruleIHs_length m k rs (p+1)]
+
+/-- Lifting the generalized minor-IH telescope into a rule context normalizes
+each entry to `ruleIHs`; this is the list form of
+`RecArg.minorIH_lift_ruleIH`. -/
+theorem ihsFromRecArgs_liftN (m k : Nat) : ∀ (rs : List RecArg),
+    (∀ r ∈ rs, r.fieldIndex < m) → ∀ (p : Nat) (X : VExpr),
+    (VExpr.forallN (ihsFromRecArgs m rs p) X).liftN k (m+p) =
+      VExpr.forallN (ruleIHs m k rs p) (X.liftN k (m+p+rs.length))
+  | [], _, _, _ => rfl
+  | r :: rs, hm, p, X => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · exact r.minorIH_lift_ruleIH m k p (hm r (.head _))
+    · rw [show m+p+1 = m+(p+1) from by omega,
+        ihsFromRecArgs_liftN m k rs (fun q hq => hm q (.tail _ hq)) (p+1) X,
+        show m+(p+1)+rs.length = m+p+((r :: rs).length) from by simp; omega]
+
+theorem ihsFromRecArgs_liftN' (m k : Nat) (rs : List RecArg)
+    (hm : ∀ r ∈ rs, r.fieldIndex < m) (p : Nat) (X : VExpr)
+    {cut : Nat} (hcut : cut = m+p) :
+    (VExpr.forallN (ihsFromRecArgs m rs p) X).liftN k cut =
+      VExpr.forallN (ruleIHs m k rs p) (X.liftN k (m+p+rs.length)) := by
+  rw [hcut]
+  exact ihsFromRecArgs_liftN m k rs hm p X
+
+/-- Weakening a normalized functional-IH telescope by one binder is the same
+as incrementing its starting depth. -/
+theorem ruleIHs_liftN1 (m k : Nat) : ∀ (rs : List RecArg) (p c : Nat), c ≤ p →
+    ∀ (X : VExpr),
+    VExpr.forallN (ruleIHs m k rs (p+1)) (X.liftN 1 (c+rs.length)) =
+      (VExpr.forallN (ruleIHs m k rs p) X).liftN 1 c
+  | [], p, c, _, X => by simp [ruleIHs, VExpr.forallN]
+  | r :: rs, p, c, hc, X => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN'_liftN' (Nat.zero_le _) hc]
+    · rw [show c+(r :: rs).length = (c+1)+rs.length from by simp; omega]
+      exact ruleIHs_liftN1 m k rs (p+1) (c+1) (by omega) X
+
+/-- The key normalization: lifting a parameter spine past `off` binders. -/
+theorem recApp'_liftN {U : Nat} {T : Name} {np : Nat} {n k off : Nat} (h : k ≤ off) :
+    (recApp' U T np off).liftN n k = recApp' U T np (n + off) := by
+  simp only [recApp', VExpr.liftN_appN]
+  rw [bvarRevRange_liftN_ge _ _ _ _ h]
+  rfl
+
+theorem recApp_liftN {U : Nat} {T : Name} {np : Nat} {n k off : Nat} (h : k ≤ off) :
+    (recApp U T np off).liftN n k = recApp U T np (n + off) := by
+  simp only [recApp, VExpr.liftN_appN]
+  rw [bvarRevRange_liftN_ge _ _ _ _ h]
+  rfl
+
+theorem recApp_instL {U : Nat} {T : Name} {np off : Nat} :
+    (recApp U T np off).instL (VLevel.params' U 1) = recApp' U T np off := by
+  simp only [recApp, recApp', VExpr.instL_appN]
+  rw [bvarRevRange_instL]
+  simp [VExpr.instL, VLevel.params_map_inst_params', ElimMode.sourceLevels,
+    ElimMode.offset]
+
+theorem recApp'_congr {U : Nat} {T : Name} {np : Nat} {off off' : Nat}
+    (h : off = off') : recApp' U T np off = recApp' U T np off' := h ▸ rfl
+
+theorem _root_.Ix.Theory.Named.VExpr.bvarRevRange_congr {off off' : Nat} (m : Nat)
+    (h : off = off') : VExpr.bvarRevRange off m = VExpr.bvarRevRange off' m := h ▸ rfl
+
+theorem _root_.Ix.Theory.Named.VExpr.bvarRevRange_congr' {m m' : Nat} (off : Nat)
+    (h : m = m') : VExpr.bvarRevRange off m = VExpr.bvarRevRange off m' := h ▸ rfl
+
+theorem bvarRevRange_closedN : ∀ (m off k : Nat), off + m ≤ k →
+    ∀ e ∈ VExpr.bvarRevRange off m, e.ClosedN k
+  | 0, _, _, _, _, h => nomatch h
+  | m+1, off, k, hk, e, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · exact show off + m < k by omega
+    · exact bvarRevRange_closedN m off k (by omega) e h
+
+theorem bvarRevRange_levelWF {Uv : Nat} : ∀ (m off : Nat),
+    ∀ e ∈ VExpr.bvarRevRange off m, e.LevelWF Uv
+  | 0, _, _, h => nomatch h
+  | m+1, off, e, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · trivial
+    · exact bvarRevRange_levelWF m off e h
+
+theorem ihsFrom_levelWF {Uv : Nat} {m : Nat} : ∀ (rs : List (Nat × List VExpr)) (p : Nat),
+    (∀ q ∈ rs, ∀ e ∈ q.2, e.LevelWF Uv) → ∀ e ∈ ihsFrom m rs p, e.LevelWF Uv
+  | (j, idxs) :: rs, p, hidx, e, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · refine VExpr.LevelWF.appN (f := .bvar (m+p)) trivial fun e he => ?_
+      rcases List.mem_append.1 he with he | he
+      · obtain ⟨e₀, he₀, rfl⟩ := List.mem_map.1 he
+        exact ((hidx _ (List.Mem.head _) e₀ he₀).liftN).liftN
+      · rcases List.mem_cons.1 he with rfl | he
+        · trivial
+        · cases he
+    · exact ihsFrom_levelWF rs (p+1) (fun q hq => hidx q (.tail _ hq)) e h
+
+/-- Closedness of a telescope of closed binders over an open body. -/
+theorem _root_.Ix.Theory.Named.VExpr.ClosedN.forallN_closed_binders :
+    ∀ {As : List VExpr}, (∀ A ∈ As, A.ClosedN 0) →
+    ∀ {X : VExpr} {k : Nat}, X.ClosedN (k + As.length) →
+    (VExpr.forallN As X).ClosedN k
+  | [], _, _, _, hX => hX
+  | _ :: As, hAs, X, k, hX =>
+    ⟨(hAs _ (.head _)).mono (Nat.zero_le _),
+      VExpr.ClosedN.forallN_closed_binders (fun A h => hAs _ (.tail _ h))
+        (by rw [show k+1+As.length = k+(As.length+1) from by omega]; exact hX)⟩
+
+end VInductDecl
+
+namespace VExpr
+
+theorem forallN_telN_dropN : ∀ (n : Nat) (e : VExpr),
+    forallN (telN n e) (dropN n e) = e
+  | 0, _ => rfl
+  | n+1, .forallE A rest => congrArg (VExpr.forallE A) (forallN_telN_dropN n rest)
+  | _+1, .bvar _ | _+1, .sort _ | _+1, .const _ _ | _+1, .app _ _ | _+1, .lam _ _ => rfl
+
+theorem resultOf_forallN : ∀ (As : List VExpr) (B : VExpr),
+    resultOf (forallN As B) = resultOf B
+  | [], _ => rfl
+  | _ :: As, B => resultOf_forallN As B
+
+theorem resultOf_appN_app (f a : VExpr) :
+    ∀ es, resultOf ((f.app a).appN es) = (f.app a).appN es
+  | [] => rfl
+  | b :: bs => resultOf_appN_app (f.app a) b bs
+
+theorem resultOf_appN_const (T : Name) (ls : List VLevel) :
+    ∀ es, resultOf ((VExpr.const T ls).appN es) =
+      (VExpr.const T ls).appN es
+  | [] => rfl
+  | a :: as => resultOf_appN_app (VExpr.const T ls) a as
+
+end VExpr
+
+namespace VEnv
+
+theorem OnTel.mono {env env' : VEnv} {U : Nat} (henv : env ≤ env') :
+    ∀ {As Γ}, OnTel env U Γ As → OnTel env' U Γ As
+  | [], _, _ => trivial
+  | _ :: _, _, ⟨hA, hT⟩ => ⟨hA.mono henv, OnTel.mono henv hT⟩
+
+/-- A well-formed telescope is pointwise definitionally equal to itself. -/
+theorem OnTel.telDefEq_refl {env : VEnv} {U : Nat} :
+    ∀ {Γ As}, OnTel env U Γ As → TelDefEq env U Γ As As
+  | _, [], _ => trivial
+  | _, _ :: _, ⟨⟨u, hA⟩, hT⟩ =>
+    ⟨⟨u, hA⟩, OnTel.telDefEq_refl hT⟩
+
+/-- A structural telescope equality has equal arity. -/
+theorem TelDefEq.length_eq {env : VEnv} {U : Nat} :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' → As.length = As'.length
+  | _, [], [], _ => rfl
+  | _, _ :: _, _ :: _, ⟨_, hT⟩ =>
+    congrArg Nat.succ (TelDefEq.length_eq hT)
+
+/-- The raw side of a structural telescope equality is a well-formed
+telescope. -/
+theorem TelDefEq.raw_onTel {env : VEnv} {U : Nat} :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' → OnTel env U Γ As
+  | _, [], [], _ => trivial
+  | _, _ :: _, _ :: _, ⟨⟨_, hA⟩, hT⟩ =>
+    ⟨⟨_, hA.hasType.1⟩, TelDefEq.raw_onTel hT⟩
+
+/-- Extend a structural telescope equality by an identical, well-formed
+suffix. The suffix is checked in the completed left-hand context, exactly as
+required by `TelDefEq`'s raw-context convention. -/
+theorem TelDefEq.append_refl {env : VEnv} {U : Nat} :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' →
+      ∀ {Bs}, OnTel env U (As.reverse ++ Γ) Bs →
+        TelDefEq env U Γ (As ++ Bs) (As' ++ Bs)
+  | _, [], [], _, _, hBs => by
+      simpa using hBs.telDefEq_refl
+  | Γ, A :: As, A' :: As', ⟨hA, hT⟩, Bs, hBs => by
+      refine ⟨hA, ?_⟩
+      apply TelDefEq.append_refl hT
+      simpa [List.reverse_cons, List.append_assoc] using hBs
+
+/-- Structural telescope equality is monotone in the environment. -/
+theorem TelDefEq.mono {env env' : VEnv} {U : Nat} (henv : env ≤ env') :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' → TelDefEq env' U Γ As As'
+  | _, [], [], _ => trivial
+  | _, _ :: _, _ :: _, ⟨⟨u, hA⟩, hT⟩ =>
+    ⟨⟨u, hA.mono henv⟩, TelDefEq.mono henv hT⟩
+
+/-- Instantiate every universe in a structural telescope equality. -/
+theorem TelDefEq.instL {env : VEnv} {U U' : Nat} {ls : List VLevel}
+    (hls : ∀ l ∈ ls, l.WF U') :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' →
+      TelDefEq env U' (Γ.map (VExpr.instL ls))
+        (As.map (VExpr.instL ls)) (As'.map (VExpr.instL ls))
+  | _, [], [], _ => trivial
+  | _, _ :: As, _ :: As', ⟨⟨u, hA⟩, hT⟩ => by
+    refine ⟨⟨u.inst ls, hA.instL hls⟩, ?_⟩
+    simpa using TelDefEq.instL hls hT
+
+/-- Extend an existing definitionally equal context by a structurally equal
+raw/view telescope. -/
+theorem TelDefEq.extendCtx {env : VEnv} {U : Nat} {Γ₀ : List VExpr} :
+    ∀ {Γ Γ' As As'}, IsDefEqCtx env U Γ₀ Γ Γ' →
+      TelDefEq env U Γ As As' →
+      IsDefEqCtx env U Γ₀ (As.reverse ++ Γ) (As'.reverse ++ Γ')
+  | Γ, Γ', [], [], hΓ, _ => by simpa using hΓ
+  | Γ, Γ', _ :: As, _ :: As', hΓ, ⟨⟨_, hA⟩, hT⟩ => by
+    simpa [List.reverse_cons, List.append_assoc] using
+      TelDefEq.extendCtx (.succ hΓ hA) hT
+
+/-- The completed raw and view contexts of a structural telescope equality
+are definitionally equal over their common prefix. -/
+theorem TelDefEq.ctx {env : VEnv} {U : Nat} {Γ As As' : List VExpr}
+    (h : TelDefEq env U Γ As As') :
+    IsDefEqCtx env U Γ (As.reverse ++ Γ) (As'.reverse ++ Γ) :=
+  h.extendCtx .zero
+
+/-- Any aligned prefix remains a structural telescope equality. -/
+theorem TelDefEq.take {env : VEnv} {U : Nat} :
+    ∀ (n : Nat) {Γ As As'}, TelDefEq env U Γ As As' →
+      TelDefEq env U Γ (As.take n) (As'.take n)
+  | 0, _, _, _, _ => trivial
+  | _ + 1, _, [], [], _ => trivial
+  | n + 1, _, _ :: _, _ :: _, ⟨hA, hT⟩ =>
+    ⟨hA, TelDefEq.take n hT⟩
+
+/-- Drop an aligned prefix, retaining the exact raw context accumulated by
+the removed binders. -/
+theorem TelDefEq.drop {env : VEnv} {U : Nat} :
+    ∀ (n : Nat) {Γ As As'}, TelDefEq env U Γ As As' →
+      TelDefEq env U ((As.take n).reverse ++ Γ)
+        (As.drop n) (As'.drop n)
+  | 0, _, _, _, h => by simpa using h
+  | _ + 1, _, [], [], _ => trivial
+  | n + 1, Γ, A :: As, _ :: As', ⟨_, hT⟩ => by
+    have h := TelDefEq.drop n hT
+    simpa [List.take_succ_cons, List.drop_succ_cons,
+      List.reverse_cons, List.append_assoc] using h
+
+/-- Recover the pointwise equality at one aligned binder position together
+with its exact preceding raw context. -/
+theorem TelDefEq.getElem? {env : VEnv} {U : Nat} :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' →
+      ∀ {n A A'}, As[n]? = some A → As'[n]? = some A' →
+        ∃ u, env.IsDefEq U ((As.take n).reverse ++ Γ) A A' (.sort u)
+  | _, [], [], _, n, _, _, hA, _ => by simp at hA
+  | Γ, _ :: As, _ :: As', ⟨hhead, htail⟩, 0, A, A', hA, hA' => by
+    simp only [List.getElem?_cons_zero, Option.some.injEq] at hA hA'
+    subst A
+    subst A'
+    simpa using hhead
+  | Γ, A₀ :: As, A₀' :: As', ⟨_, htail⟩, n + 1, A, A', hA, hA' => by
+    simp only [List.getElem?_cons_succ] at hA hA'
+    have h := TelDefEq.getElem? htail hA hA'
+    simpa [List.take_succ_cons, List.reverse_cons, List.append_assoc] using h
+
+/-- Weakening preserves structural telescope equality and shifts both
+surfaces at their binder-relative cutoffs. -/
+theorem TelDefEq.weakN {env : VEnv} {U n : Nat} (ord : env.Ordered)
+    {Γ Γ' : List VExpr} {k : Nat} (W : Ctx.LiftN n k Γ Γ') :
+    ∀ {As As'}, TelDefEq env U Γ As As' →
+      TelDefEq env U Γ'
+        (VExpr.liftTelN n As k) (VExpr.liftTelN n As' k)
+  | [], [], _ => trivial
+  | _ :: As, _ :: As', ⟨⟨u, hA⟩, hT⟩ => by
+    refine ⟨⟨u, hA.weakN ord W⟩, ?_⟩
+    simpa [VExpr.liftTelN] using TelDefEq.weakN ord W.succ hT
+
+/-- Substitute one typed term through a structural telescope equality. -/
+theorem TelDefEq.instN {env : VEnv} {U : Nat} (ord : env.Ordered)
+    {Γ₀ : List VExpr} {e₀ A₀ : VExpr}
+    (h₀ : env.HasType U Γ₀ e₀ A₀) {k : Nat} {Γ₁ Γ : List VExpr}
+    (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ) :
+    ∀ {As As'}, TelDefEq env U Γ₁ As As' →
+      TelDefEq env U Γ
+        (VExpr.instTelN e₀ As k) (VExpr.instTelN e₀ As' k)
+  | [], [], _ => trivial
+  | _ :: As, _ :: As', ⟨⟨u, hA⟩, hT⟩ => by
+    refine ⟨⟨u, by simpa using hA.instN ord h₀ W⟩, ?_⟩
+    simpa [VExpr.instTelN] using
+      TelDefEq.instN ord h₀ W.succ hT
+
+/-- Pointwise telescope equality extends to the corresponding iterated Pi
+types once their terminal bodies are definitionally equal in the completed
+raw context. This is the construction-side counterpart of `spine_sort`; it
+does not require Pi injectivity. -/
+theorem TelDefEq.forallN_defeq {env : VEnv} {U : Nat} :
+    ∀ {Γ As As' C C' u},
+      TelDefEq env U Γ As As' →
+      env.IsDefEq U (As.reverse ++ Γ) C C' (.sort u) →
+      ∃ v, env.IsDefEq U Γ
+        (VExpr.forallN As C) (VExpr.forallN As' C') (.sort v)
+  | _, [], [], _, _, u, _, hC => ⟨u, hC⟩
+  | Γ, A :: As, A' :: As', C, C', u,
+      ⟨⟨uA, hA⟩, hT⟩, hC => by
+    have hC' : env.IsDefEq U (As.reverse ++ A :: Γ)
+        C C' (.sort u) := by
+      simpa [List.reverse_cons, List.append_assoc] using hC
+    obtain ⟨v, hbody⟩ :=
+      TelDefEq.forallN_defeq hT hC'
+    exact ⟨.imax uA v, .forallEDF hA hbody⟩
+
+/-- A fully applied spine accepted by the view telescope is also accepted by
+the raw telescope. This is the substitution-aware consumer of `TelDefEq`;
+it avoids any appeal to whole-Pi injectivity. -/
+theorem TelDefEq.spine_sort {env : VEnv} {U : Nat} (ord : env.Ordered) :
+    ∀ {Γ As As' es l}, TelDefEq env U Γ As As' →
+      env.SpineWF U Γ (VExpr.forallN As' (.sort l)) es (.sort l) →
+      es.length = As.length →
+      env.SpineWF U Γ (VExpr.forallN As (.sort l)) es (.sort l)
+  | _, [], [], [], _, _, hsp, _ => by simpa using hsp
+  | _, [], [], _ :: _, _, _, _, hlen => by simp at hlen
+  | Γ, A :: As, A' :: As', e :: es, l, ⟨⟨_, hA⟩, hT⟩,
+      .cons he hrest, hlen => by
+    have heRaw : env.HasType U Γ e A := hA.defeq' he
+    have hTinst := TelDefEq.instN ord heRaw (.zero) hT
+    have hrest' : env.SpineWF U Γ
+        (VExpr.forallN (VExpr.instTelN e As' 0) (.sort l))
+        es (.sort l) := by
+      simpa [VExpr.instN_forallN] using hrest
+    have hlen' : es.length = As.length := by simpa using hlen
+    have hlenInst :
+        es.length = (VExpr.instTelN e As 0).length := by
+      rw [VExpr.instTelN_length]
+      exact hlen'
+    have hout := TelDefEq.spine_sort ord hTinst hrest' hlenInst
+    refine .cons heRaw ?_
+    simpa [VExpr.instN_forallN] using hout
+
+/-- Extend a definitionally equal context by the same well-formed telescope
+on both sides. -/
+theorem OnTel.extendDefEqCtx {env : VEnv} {U : Nat} {Γ₀ Γ₁ Γ₂ : List VExpr}
+    (hΓ : IsDefEqCtx env U Γ₀ Γ₁ Γ₂) :
+    ∀ {As}, OnTel env U Γ₁ As →
+      IsDefEqCtx env U Γ₀ (As.reverse ++ Γ₁) (As.reverse ++ Γ₂)
+  | [], _ => by simpa using hΓ
+  | _ :: As, ⟨⟨_, hA⟩, hT⟩ => by
+    simpa [List.reverse_cons, List.append_assoc] using
+      OnTel.extendDefEqCtx (.succ hΓ hA) hT
+
+/-- Transport a telescope across definitionally equal base contexts. -/
+theorem OnTel.defeqDFC {env : VEnv} {U : Nat} (ord : env.Ordered)
+    {Γ₀ Γ₁ Γ₂ : List VExpr} (hΓ : IsDefEqCtx env U Γ₀ Γ₁ Γ₂) :
+    ∀ {As}, OnTel env U Γ₁ As → OnTel env U Γ₂ As
+  | [], _ => trivial
+  | _ :: As, ⟨hA, hT⟩ => by
+    obtain ⟨u, hAt⟩ := hA
+    exact ⟨⟨u, hAt.defeqDFC ord hΓ⟩,
+      OnTel.defeqDFC ord (.succ hΓ hAt) hT⟩
+
+/-- The view side of a structural telescope equality is itself well formed.
+Each tail is transported from the accumulated raw context to the accumulated
+view context before recursion continues. -/
+theorem TelDefEq.view_onTel {env : VEnv} {U : Nat} (ord : env.Ordered) :
+    ∀ {Γ As As'}, TelDefEq env U Γ As As' → OnTel env U Γ As'
+  | _, [], [], _ => trivial
+  | _, _ :: _, _ :: _, ⟨⟨u, hA⟩, hT⟩ =>
+      ⟨⟨u, hA.hasType.2⟩,
+        (TelDefEq.view_onTel ord hT).defeqDFC ord
+          (.succ .zero hA)⟩
+
+/-- Transport a structural telescope equality across definitionally equal
+base contexts while retaining its raw/view surfaces. -/
+theorem TelDefEq.defeqDFC {env : VEnv} {U : Nat} (ord : env.Ordered)
+    {Γ₀ Γ₁ Γ₂ : List VExpr} (hΓ : IsDefEqCtx env U Γ₀ Γ₁ Γ₂) :
+    ∀ {As As'}, TelDefEq env U Γ₁ As As' → TelDefEq env U Γ₂ As As'
+  | [], [], _ => trivial
+  | A :: As, _ :: As', ⟨⟨u, hA⟩, hT⟩ => by
+      have hA' := hA.defeqDFC ord hΓ
+      refine ⟨⟨u, hA'⟩, ?_⟩
+      exact TelDefEq.defeqDFC ord
+        (.succ hΓ hA.hasType.1) hT
+
+/-- Select Lean's kernel-observable parameter surface without losing the
+structural equality to the analyzer-owned parameter telescope. Ordinary
+parameters keep the raw domain; annotated parameters use the checked domain.
+-/
+theorem TelDefEq.generationParams {env : VEnv} {U : Nat}
+    (ord : env.Ordered) :
+    ∀ {Γ raw view}, TelDefEq env U Γ raw view →
+      TelDefEq env U Γ (VInductDecl.generationParams raw view) view
+  | _, [], [], _ => trivial
+  | Γ, raw :: raws, view :: views, ⟨⟨u, head⟩, tail⟩ => by
+    simp only [VInductDecl.generationParams,
+      VInductDecl.generationParam]
+    split
+    · refine ⟨⟨u, head.hasType.2⟩, ?_⟩
+      exact (TelDefEq.generationParams ord tail).defeqDFC ord
+        (.succ (.zero (Γ₀ := Γ)) head)
+    · exact ⟨⟨u, head⟩, TelDefEq.generationParams ord tail⟩
+
+#guard_named_axioms Ix.Theory.Named.VEnv.TelDefEq.generationParams [propext, Quot.sound]
+
+/-- Transport application-spine typing across definitionally equal
+contexts. -/
+theorem SpineWF.defeqDFC {env : VEnv} {U : Nat} (ord : env.Ordered)
+    {Γ₀ Γ₁ Γ₂ : List VExpr} (hΓ : IsDefEqCtx env U Γ₀ Γ₁ Γ₂) :
+    ∀ {A es B}, SpineWF env U Γ₁ A es B → SpineWF env U Γ₂ A es B
+  | _, [], _, .nil => .nil
+  | _, _ :: _, _, .cons he hT =>
+    .cons (he.defeqDFC ord hΓ) (SpineWF.defeqDFC ord hΓ hT)
+
+#guard_named_axioms Ix.Theory.Named.VEnv.TelDefEq.raw_onTel [propext]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.TelDefEq.instL [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.TelDefEq.ctx [propext]
+
+end VEnv
+
+namespace VInductDecl
+open VEnv
+
+/-- The exact raw family telescope accepted for generation is well formed in
+the pre-environment. -/
+theorem GenerationChecked.WF.rawFamily_onTel {source : VInductDecl}
+    {gen : GenerationChecked source} {env : VEnv} (h : gen.WF env) :
+    env.OnTel source.uvars []
+      (gen.block.rawParams ++ gen.block.rawIndices) :=
+  h.familyTel.raw_onTel
+
+/-- The granular family telescope/result contract proves that the stored raw
+family constant can be inserted without appealing to whole-`forall`
+injectivity. -/
+theorem GenerationChecked.WF.rawFamily_isType {source : VInductDecl}
+    {gen : GenerationChecked source} {env : VEnv} (h : gen.WF env) :
+    env.IsType source.uvars [] gen.block.sourceType.type := by
+  rw [← VExpr.forallN_telN_dropN source.nparams gen.block.sourceType.type,
+    ← forallN_ctorFields_resultOf
+      (VExpr.dropN source.nparams gen.block.sourceType.type),
+    ← VExpr.forallN_append]
+  have hresult₀ : env.IsType source.uvars
+      (gen.block.rawParams ++ gen.block.rawIndices).reverse
+      gen.block.rawResult :=
+    ⟨_, h.familyResult.hasType.1⟩
+  have hresult : env.IsType source.uvars
+      ((gen.block.rawParams ++ gen.block.rawIndices).reverse ++ [])
+      gen.block.rawResult := by
+    simpa using hresult₀
+  have hout := IsType.forallN h.rawFamily_onTel hresult
+  simpa [NormalizedChecked.rawParams, NormalizedChecked.rawIndices,
+    NormalizedChecked.rawResult] using hout
+
+/-- The exact raw telescope stored in a paired constructor is well formed in
+the post-family environment. -/
+theorem NormalizedCtor.WF.rawDeclared_onTel {source : VInductDecl}
+    {block : NormalizedChecked source} {ctor : NormalizedCtor} {env : VEnv}
+    (h : ctor.WF block env) :
+    env.OnTel source.uvars [] (ctor.declaredBinders source.nparams) :=
+  h.declaredTel.raw_onTel
+
+/-- The granular constructor telescope/result contract proves that the exact
+stored raw constructor can be inserted. -/
+theorem NormalizedCtor.WF.rawDeclared_isType {source : VInductDecl}
+    {block : NormalizedChecked source} {ctor : NormalizedCtor} {env : VEnv}
+    (h : ctor.WF block env) :
+    env.IsType source.uvars [] ctor.raw.type := by
+  rw [← VExpr.forallN_telN_dropN source.nparams ctor.raw.type,
+    ← forallN_ctorFields_resultOf (VExpr.dropN source.nparams ctor.raw.type),
+    ← VExpr.forallN_append]
+  have hresult₀ : env.IsType source.uvars
+      (ctor.declaredBinders source.nparams).reverse
+      (ctor.rawResult source.nparams) :=
+    ⟨_, h.declaredResult.hasType.1⟩
+  have hresult : env.IsType source.uvars
+      ((ctor.declaredBinders source.nparams).reverse ++ [])
+      (ctor.rawResult source.nparams) := by
+    simpa using hresult₀
+  have hout := IsType.forallN h.rawDeclared_onTel hresult
+  simpa [NormalizedCtor.declaredBinders, NormalizedCtor.rawFields,
+    NormalizedCtor.rawResult] using hout
+
+/-- The raw family/field telescope actually emitted in mixed artifacts is
+well formed independently of the constructor's stored parameter surface. -/
+theorem NormalizedCtor.WF.rawEmitted_onTel {source : VInductDecl}
+    {block : NormalizedChecked source} {ctor : NormalizedCtor} {env : VEnv}
+    (h : ctor.WF block env) :
+    env.OnTel source.uvars [] (ctor.emittedBinders block) :=
+  h.emittedTel.raw_onTel
+
+/-- A granular constructor certificate is monotone after its staged family
+insertion. -/
+theorem NormalizedCtor.WF.mono {source : VInductDecl}
+    {block : NormalizedChecked source} {ctor : NormalizedCtor}
+    {env env' : VEnv} (henv : env ≤ env') (h : ctor.WF block env) :
+    ctor.WF block env' where
+  declaredTel := h.declaredTel.mono henv
+  declaredResult := h.declaredResult.mono henv
+  emittedTel := h.emittedTel.mono henv
+  emittedResult := h.emittedResult.mono henv
+
+/-- Retrieve the insertion-ready proof for any paired raw constructor in the
+precise post-family environment named by the block certificate. -/
+theorem GenerationChecked.WF.rawCtor_isType {source : VInductDecl}
+    {gen : GenerationChecked source} {env envT : VEnv} (h : gen.WF env)
+    (hadd : env.addConst gen.block.sourceType.name
+      gen.block.sourceType.toVConstant = some envT)
+    {ctor : NormalizedCtor} (hctor : ctor ∈ gen.block.ctorPairs) :
+    envT.IsType source.uvars [] ctor.raw.type :=
+  (h.ctors envT hadd ctor hctor).rawDeclared_isType
+
+/-! Mutual declaration-stage consequences. -/
+
+theorem NormalizedFamily.WF.rawFamily_onTel {source : VInductDecl}
+    {gen : BlockGenerationChecked source} {family : NormalizedFamily}
+    {env : VEnv} (h : family.WF gen env) :
+    env.OnTel source.uvars []
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams) :=
+  h.familyTel.raw_onTel
+
+theorem NormalizedFamily.WF.rawFamily_isType {source : VInductDecl}
+    {gen : BlockGenerationChecked source} {family : NormalizedFamily}
+    {env : VEnv} (h : family.WF gen env) :
+    env.IsType source.uvars [] family.raw.type := by
+  rw [← VExpr.forallN_telN_dropN source.nparams family.raw.type,
+    ← forallN_ctorFields_resultOf
+      (VExpr.dropN source.nparams family.raw.type),
+    ← VExpr.forallN_append]
+  have hresult₀ : env.IsType source.uvars
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams).reverse
+      (family.rawResult source.nparams) :=
+    ⟨_, h.familyResult.hasType.1⟩
+  have hresult : env.IsType source.uvars
+      ((family.rawParams source.nparams ++
+        family.rawIndices source.nparams).reverse ++ [])
+      (family.rawResult source.nparams) := by
+    simpa using hresult₀
+  have hout := IsType.forallN h.rawFamily_onTel hresult
+  simpa [NormalizedFamily.rawParams, NormalizedFamily.rawIndices,
+    NormalizedFamily.rawResult] using hout
+
+theorem NormalizedFamily.WF.mono {source : VInductDecl}
+    {gen : BlockGenerationChecked source} {family : NormalizedFamily}
+    {env env' : VEnv} (henv : env ≤ env') (h : family.WF gen env) :
+    family.WF gen env' where
+  familyTel := h.familyTel.mono henv
+  familyResult := h.familyResult.mono henv
+
+theorem NormalizedBlockCtor.WF.rawDeclared_onTel
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {constructor : NormalizedBlockCtor} {env : VEnv}
+    (h : NormalizedBlockCtor.WF gen constructor env) :
+    env.OnTel source.uvars []
+      (NormalizedBlockCtor.declaredBinders
+        (source := source) constructor) :=
+  h.declaredTel.raw_onTel
+
+theorem NormalizedBlockCtor.WF.rawDeclared_isType
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {constructor : NormalizedBlockCtor} {env : VEnv}
+    (h : NormalizedBlockCtor.WF gen constructor env) :
+    env.IsType source.uvars [] constructor.ctor.raw.type := by
+  rw [← VExpr.forallN_telN_dropN source.nparams
+      constructor.ctor.raw.type,
+    ← forallN_ctorFields_resultOf
+      (VExpr.dropN source.nparams constructor.ctor.raw.type),
+    ← VExpr.forallN_append]
+  have hresult₀ : env.IsType source.uvars
+      (NormalizedBlockCtor.declaredBinders
+        (source := source) constructor).reverse
+      (NormalizedBlockCtor.rawResult
+        (source := source) constructor) :=
+    ⟨_, h.declaredResult.hasType.1⟩
+  have hresult : env.IsType source.uvars
+      ((NormalizedBlockCtor.declaredBinders
+        (source := source) constructor).reverse ++ [])
+      (NormalizedBlockCtor.rawResult
+        (source := source) constructor) := by
+    simpa using hresult₀
+  have hout := IsType.forallN h.rawDeclared_onTel hresult
+  simpa [NormalizedBlockCtor.declaredBinders,
+    NormalizedBlockCtor.rawResult, NormalizedCtor.declaredBinders,
+    NormalizedCtor.rawFields, NormalizedCtor.rawResult] using hout
+
+theorem NormalizedBlockCtor.WF.rawEmitted_onTel
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {constructor : NormalizedBlockCtor} {env : VEnv}
+    (h : NormalizedBlockCtor.WF gen constructor env) :
+    env.OnTel source.uvars []
+      (NormalizedBlockCtor.emittedBinders gen constructor) :=
+  h.emittedTel.raw_onTel
+
+theorem NormalizedBlockCtor.WF.mono
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {constructor : NormalizedBlockCtor} {env env' : VEnv}
+    (henv : env ≤ env') (h : NormalizedBlockCtor.WF gen constructor env) :
+    NormalizedBlockCtor.WF gen constructor env' where
+  declaredTel := h.declaredTel.mono henv
+  declaredResult := h.declaredResult.mono henv
+  emittedTel := h.emittedTel.mono henv
+  emittedResult := h.emittedResult.mono henv
+  owner := h.owner
+  recursive := fun recursive hrecursive => by
+    obtain ⟨family, hfamily, hordinal, hfield, hwf⟩ :=
+      h.recursive recursive hrecursive
+    exact ⟨family, hfamily, hordinal, hfield,
+      ⟨hwf.1.mono henv, hwf.2.mono henv⟩⟩
+  resultSpine := h.resultSpine.mono henv
+
+theorem BlockGenerationChecked.WF.rawFamily_isType
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {env blockEnv : VEnv} (h : gen.WF env blockEnv)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    env.IsType source.uvars [] family.raw.type :=
+  (h.families family hfamily).rawFamily_isType
+
+theorem BlockGenerationChecked.WF.rawCtor_isType
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {env blockEnv : VEnv} (h : gen.WF env blockEnv)
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    blockEnv.IsType source.uvars [] constructor.ctor.raw.type :=
+  (h.constructors constructor hconstructor).rawDeclared_isType
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.WF.rawFamily_isType [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.WF.rawCtor_isType [propext, Quot.sound]
+
+theorem RecArg.WF.mono {env env' : VEnv} {U : Nat} {l : VLevel}
+    {Is Γ : List VExpr} {r : RecArg} (henv : env ≤ env')
+    (h : r.WF U env l Is Γ) : r.WF U env' l Is Γ :=
+  ⟨h.1.mono henv, h.2.mono henv⟩
+
+/-- The checked recursive/non-recursive field interpretation is monotone in
+the environment. -/
+theorem checkedBlockFieldsWF_mono {env env' : VEnv} {U : Nat}
+    {resultLevel : VLevel} {familyIndices : List (List VExpr)}
+    (henv : env ≤ env') : ∀ {fields classifications Γ j},
+    checkedBlockFieldsWF env U resultLevel familyIndices
+      fields classifications Γ j →
+    checkedBlockFieldsWF env' U resultLevel familyIndices
+      fields classifications Γ j
+  | [], [], _, _, _ => trivial
+  | [], _ :: _, _, _, h => by
+    simp [checkedBlockFieldsWF] at h
+  | _ :: _, [], _, _, h => by
+    simp [checkedBlockFieldsWF] at h
+  | B :: Bs, none :: classifications, Γ, j,
+      ⟨⟨u, hB, hlevel⟩, htail⟩ =>
+    ⟨⟨u, hB.mono henv, hlevel⟩,
+      checkedBlockFieldsWF_mono henv htail⟩
+  | B :: Bs, some recursive :: classifications, Γ, j, h => by
+    simp only [checkedBlockFieldsWF] at h ⊢
+    obtain ⟨⟨hfield, hrecursive⟩, htail⟩ := h
+    refine ⟨⟨hfield, ?_⟩,
+      checkedBlockFieldsWF_mono henv htail⟩
+    cases htarget : familyIndices[recursive.targetType]? with
+    | none => simp [htarget] at hrecursive
+    | some indices =>
+      rw [htarget] at hrecursive
+      exact hrecursive.mono henv
+
+/-- The erased family-spine semantics is monotone in the environment. -/
+theorem checkedFamilyListsWF_mono {source : VInductDecl}
+    {params : List VExpr} {env env' : VEnv} {resultLevel : VLevel}
+    {familyIndices : List (List VExpr)} (henv : env ≤ env') :
+    ∀ levels indices constructors,
+      checkedFamilyListsWF source params env resultLevel familyIndices
+        levels indices constructors →
+      checkedFamilyListsWF source params env' resultLevel familyIndices
+        levels indices constructors := by
+  intro levels
+  induction levels with
+  | nil =>
+    intro indices constructors h
+    cases indices <;> cases constructors <;>
+      simp_all [checkedFamilyListsWF]
+  | cons level levels ih =>
+    intro indices constructors h
+    cases indices with
+    | nil => simp [checkedFamilyListsWF] at h
+    | cons index indices =>
+      cases constructors with
+      | nil => simp [checkedFamilyListsWF] at h
+      | cons familyConstructors constructors =>
+        simp only [checkedFamilyListsWF] at h ⊢
+        obtain ⟨hlevel, hindices, hconstructors, htail⟩ := h
+        exact ⟨hlevel, hindices.mono henv,
+          fun constructor hconstructor =>
+            ⟨checkedBlockFieldsWF_mono henv
+                (hconstructors constructor hconstructor).1,
+              (hconstructors constructor hconstructor).2.mono henv⟩,
+          ih indices constructors htail⟩
+
+theorem CheckedBlock.WF.mono {source : VInductDecl}
+    {checked : source.CheckedBlock} {env env' : VEnv}
+    {resultLevel : VLevel} (henv : env ≤ env')
+    (h : checked.WF env resultLevel) :
+    checked.WF env' resultLevel :=
+  checkedFamilyListsWF_mono henv _ _ _ h
+
+/-- Transport recursive-argument evidence across definitionally equal base
+contexts. The private binder telescope is transported first, then the
+terminal family-index spine is transported beneath that same telescope. -/
+theorem RecArg.WF.defeqDFC {env : VEnv} {U : Nat} {l : VLevel}
+    {Is Γ₀ Γ₁ Γ₂ : List VExpr} {r : RecArg} (ord : env.Ordered)
+    (hΓ : env.IsDefEqCtx U Γ₀ Γ₁ Γ₂)
+    (h : r.WF U env l Is Γ₁) : r.WF U env l Is Γ₂ := by
+  have htel := h.1.defeqDFC ord hΓ
+  have hctx := h.1.extendDefEqCtx hΓ
+  exact ⟨htel, h.2.defeqDFC ord hctx⟩
+
+theorem fieldsWF_mono {U : Nat} {T : Name} {np : Nat} {env env' : VEnv} {l : VLevel}
+    {Is : List VExpr} (henv : env ≤ env') : ∀ {Γ j Bs},
+    fieldsWF U T np env l Is Γ j Bs → fieldsWF U T np env' l Is Γ j Bs
+  | _, _, [], _ => trivial
+  | _, _, _ :: _, ⟨hB, hSp, hT⟩ => by
+    refine ⟨?_, fun hrec => (hSp hrec).mono henv, fieldsWF_mono henv hT⟩
+    rcases hB with hrec | hfun | ⟨hnone, u, h, hl⟩
+    · exact .inl hrec
+    · obtain ⟨r, hr, hne, hwf⟩ := hfun
+      exact .inr (.inl ⟨r, hr, hne, hwf.mono henv⟩)
+    · exact .inr (.inr ⟨hnone, u, h.mono henv, hl⟩)
+
+/-- The checked-view semantic certificate is monotone in the environment. -/
+theorem Checked.WF.mono {decl : VInductDecl} {checked : decl.Checked}
+    {env env' : VEnv} (henv : env ≤ env') (h : checked.WF env) :
+    checked.WF env' := by
+  unfold Checked.WF at h ⊢
+  refine ⟨h.1.mono henv, fun c hc => ?_⟩
+  exact ⟨fieldsWF_mono henv (h.2 c hc).1, (h.2 c hc).2.mono henv⟩
+
+/-- Exact syntactic decomposition of an accepted family view into its
+parameter telescope, index telescope, and terminal sort. -/
+theorem Checked.type_eq
+    {source : VInductDecl} (checked : source.Checked) :
+    checked.type.type =
+      VExpr.forallN checked.params
+        (VExpr.forallN checked.indices (.sort checked.resultLevel)) := by
+  rw [← VExpr.forallN_telN_dropN source.nparams checked.type.type,
+    ← forallN_ctorFields_resultOf
+      (VExpr.dropN source.nparams checked.type.type),
+    checked.result_eq, checked.params_eq, checked.indices_eq]
+
+/-- The semantic checker contract types the family before that family is
+inserted. This is the exact premise needed by the first transaction step. -/
+theorem Checked.WF.family_isType
+    {source : VInductDecl} {checked : source.Checked}
+    {env : VEnv} (h : checked.WF env) :
+    env.IsType source.uvars [] checked.type.type := by
+  rw [← VExpr.forallN_telN_dropN source.nparams checked.type.type,
+    ← forallN_ctorFields_resultOf
+      (VExpr.dropN source.nparams checked.type.type),
+    checked.result_eq, ← VExpr.forallN_append]
+  exact IsType.forallN
+    (by simpa [checked.params_eq, checked.indices_eq] using h.1)
+    ⟨_, HasType.sort checked.direct_anatomy.2.2.1⟩
+
+/-- Once the retained family constant has the checked family type, the
+checked constructor-result spine types the exact normalized family
+application.  This fact depends only on analyzer semantics and the constant's
+ordinary typing judgment; callers do not need to restate result typing for
+each constructor candidate. -/
+theorem GenerationChecked.checkedResultTarget_hasType
+    {source : VInductDecl} (gen : GenerationChecked source)
+    {env : VEnv} (henv : env.Ordered)
+    (hchecked : gen.block.checked.WF env)
+    (familyConst : env.HasType source.uvars []
+      (.const gen.block.sourceType.name (VLevel.params source.uvars))
+      gen.block.checked.type.type)
+    {ctor : NormalizedCtor} (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.HasType source.uvars (ctor.viewBinders gen.block).reverse
+      (ctor.resultTarget gen.block)
+      (.sort gen.block.checked.resultLevel) := by
+  have htype := gen.block.checked.type_eq
+  have hfamily : env.HasType source.uvars
+      (ctor.view.fields.reverse ++ gen.block.checked.params.reverse)
+      (VExpr.appN
+        (.const gen.block.sourceType.name (VLevel.params source.uvars))
+        (VExpr.bvarRevRange ctor.view.fields.length
+          gen.block.checked.params.length))
+      (VExpr.forallN
+        (VExpr.liftTelN ctor.view.fields.length
+          gen.block.checked.indices 0)
+        (.sort gen.block.checked.resultLevel)) := by
+    have hconst : env.HasType source.uvars
+        (ctor.view.fields.reverse ++
+          gen.block.checked.params.reverse ++ [])
+        (.const gen.block.sourceType.name (VLevel.params source.uvars))
+        (VExpr.forallN gen.block.checked.params
+          (VExpr.forallN gen.block.checked.indices
+            (.sort gen.block.checked.resultLevel))) := by
+      simpa only [htype] using familyConst.weak0 henv
+    have happ := HasType.appN_selfSpine'
+      (As := gen.block.checked.params)
+      (B := VExpr.forallN gen.block.checked.indices
+        (.sort gen.block.checked.resultLevel))
+      (Δ := ctor.view.fields.reverse) (Γ := [])
+      (by simpa only [← htype] using gen.block.checked.type_closed)
+      hconst
+    rw [List.length_reverse, VExpr.liftN_forallN] at happ
+    simpa using happ
+  have hspine : env.SpineWF source.uvars
+      (ctor.view.fields.reverse ++ gen.block.checked.params.reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN ctor.view.fields.length
+          gen.block.checked.indices 0)
+        (.sort gen.block.checked.resultLevel))
+      ctor.view.resultIndices
+      (.sort gen.block.checked.resultLevel) := by
+    obtain ⟨c, hc, hview⟩ := gen.viewCtor_ofDirect hctor
+    have h := (hchecked.2 c hc).2
+    rw [hview]
+    simpa [CheckedCtor.ofDirect, gen.block.uvars_eq,
+      gen.block.nparams_eq] using h
+  have hresult := hspine.hasType_appN hfamily
+  rw [← VExpr.appN_append] at hresult
+  have hparams : gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hfields := (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+  rw [hparams, ← hfields] at hresult
+  simpa [NormalizedCtor.viewBinders,
+    NormalizedCtor.resultTarget] using hresult
+
+/-- A paired checked constructor's stored view type is exactly its analyzed
+binder telescope followed by the normalized family result application. -/
+theorem GenerationChecked.viewCtorType_eq
+    {source : VInductDecl} (gen : GenerationChecked source)
+    {ctor : NormalizedCtor} (hctor : ctor ∈ gen.block.ctorPairs) :
+    ctor.view.value.type =
+      VExpr.forallN (ctor.viewBinders gen.block)
+        (ctor.resultTarget gen.block) := by
+  obtain ⟨c, hc, hview⟩ := gen.viewCtor_ofDirect hctor
+  have hcAn := gen.block.checked.direct_anatomy.2.2.2.2.2 c hc
+  have htype := VExpr.forallN_telN_dropN
+    gen.block.normalization.view.nparams c.type
+  rw [hcAn.2.1, (stage3Ctor_eq hcAn.2.2).1] at htype
+  have hfields := (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+  have hfields' :
+      (ctor.rawFields gen.block.normalization.view.nparams).length =
+        (ctorFields (VExpr.dropN
+          gen.block.normalization.view.nparams c.type)).length := by
+    simpa [gen.block.nparams_eq, hview,
+      CheckedCtor.ofDirect] using hfields
+  simpa [← VExpr.forallN_append, NormalizedCtor.viewBinders,
+    NormalizedCtor.resultTarget, hview, hfields',
+    CheckedCtor.ofDirect, gen.block.uvars_eq,
+    gen.block.nparams_eq, gen.block.sourceType_name_eq,
+    gen.block.checked.params_eq, Nat.zero_add] using htype.symm
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.type_eq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.viewCtorType_eq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationChecked.checkedResultTarget_hasType [propext, Quot.sound]
+
+/-- Final-environment invariant for mixed raw/view generation. It contains
+only facts stable after the raw family and constructors have been inserted;
+the staged pre-family/post-family split remains in `GenerationChecked.WF`. -/
+theorem GenerationChecked.sourceLevels_wf {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    ∀ l ∈ gen.sourceLevels, l.WF gen.recUvars :=
+  VLevel.params'_wf
+
+@[simp] theorem GenerationChecked.sourceLevels_eq {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.sourceLevels =
+      VLevel.params' source.uvars gen.elimination.offset := rfl
+
+@[simp] theorem GenerationChecked.recUvars_eq {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.recUvars = source.uvars + gen.elimination.offset := rfl
+
+@[simp] theorem GenerationChecked.recLevels_eq {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.recLevels = VLevel.params gen.recUvars := rfl
+
+theorem GenerationChecked.sourceLevels_length {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.sourceLevels.length = source.uvars :=
+  VLevel.params'_length
+
+theorem GenerationChecked.motiveLevel_wf {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.motiveLevel.WF gen.recUvars := by
+  cases h : gen.elimination <;>
+    simp [GenerationChecked.motiveLevel,
+      GenerationChecked.recUvars, ElimMode.recUvars,
+      ElimMode.offset, ElimMode.motiveLevel, VLevel.WF, h]
+
+theorem GenerationChecked.recLevels_wf {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    ∀ l ∈ gen.recLevels, l.WF gen.recUvars :=
+  VLevel.params_wf
+
+theorem GenerationChecked.recLevels_length {source : VInductDecl}
+    (gen : GenerationChecked source) :
+    gen.recLevels.length = gen.recUvars :=
+  VLevel.params_length
+
+structure GenerationEnv {source : VInductDecl}
+    (gen : GenerationChecked source) (env : VEnv) : Prop where
+  ord : env.Ordered
+  checked : gen.block.checked.WF env
+  familyTel :
+    env.TelDefEq source.uvars []
+      (gen.block.rawParams ++ gen.block.rawIndices)
+      (gen.block.checked.params ++ gen.block.checked.indices)
+  familyResult :
+    env.IsDefEq source.uvars
+      (gen.block.rawParams ++ gen.block.rawIndices).reverse
+      gen.block.rawResult (.sort gen.block.checked.resultLevel)
+      (.sort (.succ gen.block.checked.resultLevel))
+  ctorWF :
+    ∀ ctor ∈ gen.block.ctorPairs, ctor.WF gen.block env
+  familyConst :
+    env.constants gen.block.sourceType.name =
+      some gen.block.sourceType.toVConstant
+  ctorConst :
+    ∀ ctor ∈ gen.block.ctorPairs,
+      env.constants ctor.raw.name = some ctor.raw.toVConstant
+
+/-- Promote a staged generation certificate into the final invariant once the
+transaction supplies environment growth and exact raw constant lookups. -/
+theorem GenerationChecked.WF.toGenerationEnv {source : VInductDecl}
+    {gen : GenerationChecked source} {pre envT env : VEnv}
+    (h : gen.WF pre)
+    (hadd : pre.addConst gen.block.sourceType.name
+      gen.block.sourceType.toVConstant = some envT)
+    (hlePre : pre ≤ env) (hleT : envT ≤ env) (ord : env.Ordered)
+    (hfamily : env.constants gen.block.sourceType.name =
+      some gen.block.sourceType.toVConstant)
+    (hctors : ∀ ctor ∈ gen.block.ctorPairs,
+      env.constants ctor.raw.name = some ctor.raw.toVConstant) :
+    GenerationEnv gen env where
+  ord := ord
+  checked := h.blockWF.2.mono hlePre
+  familyTel := h.familyTel.mono hlePre
+  familyResult := h.familyResult.mono hlePre
+  ctorWF := fun ctor hctor => (h.ctors envT hadd ctor hctor).mono hleT
+  familyConst := hfamily
+  ctorConst := hctors
+
+theorem BlockGenerationChecked.sourceLevels_wf {source : VInductDecl}
+    (gen : BlockGenerationChecked source) :
+    ∀ l ∈ gen.sourceLevels, l.WF gen.recUvars :=
+  VLevel.params'_wf
+
+@[simp] theorem BlockGenerationChecked.sourceLevels_eq
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.sourceLevels =
+      VLevel.params' source.uvars gen.elimination.offset := rfl
+
+@[simp] theorem BlockGenerationChecked.recUvars_eq
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.recUvars = source.uvars + gen.elimination.offset := rfl
+
+@[simp] theorem BlockGenerationChecked.recLevels_eq
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.recLevels = VLevel.params gen.recUvars := rfl
+
+theorem BlockGenerationChecked.sourceLevels_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.sourceLevels.length = source.uvars :=
+  VLevel.params'_length
+
+theorem BlockGenerationChecked.motiveLevel_wf
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.motiveLevel.WF gen.recUvars := by
+  cases h : gen.elimination <;>
+    simp [BlockGenerationChecked.motiveLevel,
+      BlockGenerationChecked.recUvars, ElimMode.recUvars,
+      ElimMode.offset, ElimMode.motiveLevel, VLevel.WF, h]
+
+theorem BlockGenerationChecked.recLevels_wf
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    ∀ l ∈ gen.recLevels, l.WF gen.recUvars :=
+  VLevel.params_wf
+
+theorem BlockGenerationChecked.recLevels_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.recLevels.length = gen.recUvars :=
+  VLevel.params_length
+
+/-- Stable final-environment invariant for mutual artifact generation. -/
+structure BlockGenerationEnv {source : VInductDecl}
+    (gen : BlockGenerationChecked source) (env : VEnv) : Prop where
+  ord : env.Ordered
+  resultLevelWF : gen.validated.resultLevel.WF source.uvars
+  checked :
+    gen.block.checked.WF env gen.validated.resultLevel
+  paramsTel :
+    env.TelDefEq source.uvars [] gen.block.rawParams
+      gen.block.checked.params
+  familyWF : ∀ family ∈ gen.families, family.WF gen env
+  ctorWF : ∀ constructor ∈ gen.flatCtors,
+    NormalizedBlockCtor.WF gen constructor env
+  familyConst : ∀ family ∈ gen.families,
+    env.constants family.raw.name = some family.raw.toVConstant
+  ctorConst : ∀ constructor ∈ gen.flatCtors,
+    env.constants constructor.ctor.raw.name =
+      some constructor.ctor.raw.toVConstant
+
+theorem BlockGenerationChecked.WF.toBlockGenerationEnv
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {pre blockEnv env : VEnv} (h : gen.WF pre blockEnv)
+    (hlePre : pre ≤ env) (hleBlock : blockEnv ≤ env)
+    (ord : env.Ordered)
+    (hfamilies : ∀ family ∈ gen.families,
+      env.constants family.raw.name = some family.raw.toVConstant)
+    (hctors : ∀ constructor ∈ gen.flatCtors,
+      env.constants constructor.ctor.raw.name =
+        some constructor.ctor.raw.toVConstant) :
+    BlockGenerationEnv gen env where
+  ord := ord
+  resultLevelWF := h.resultLevelWF
+  checked := h.blockWF.2.mono hlePre
+  paramsTel := h.paramsTel.mono hlePre
+  familyWF := fun family hfamily =>
+    (h.families family hfamily).mono hlePre
+  ctorWF := fun constructor hconstructor =>
+    (h.constructors constructor hconstructor).mono hleBlock
+  familyConst := hfamilies
+  ctorConst := hctors
+
+theorem NormalizedFamily.rawType_eq {source : VInductDecl}
+    (family : NormalizedFamily) :
+    family.raw.type =
+      VExpr.forallN (family.rawParams source.nparams)
+        (VExpr.forallN (family.rawIndices source.nparams)
+          (family.rawResult source.nparams)) := by
+  conv => lhs
+          rw [← VExpr.forallN_telN_dropN source.nparams family.raw.type,
+            ← forallN_ctorFields_resultOf
+              (VExpr.dropN source.nparams family.raw.type)]
+  rfl
+
+namespace BlockGenerationEnv
+
+variable {source : VInductDecl} {gen : BlockGenerationChecked source}
+  {env : VEnv} (S : BlockGenerationEnv gen env)
+include S
+
+theorem mono {env' : VEnv} (henv : env ≤ env') (ord : env'.Ordered) :
+    BlockGenerationEnv gen env' where
+  ord := ord
+  resultLevelWF := S.resultLevelWF
+  checked := S.checked.mono henv
+  paramsTel := S.paramsTel.mono henv
+  familyWF := fun family hfamily => (S.familyWF family hfamily).mono henv
+  ctorWF := fun constructor hconstructor =>
+    (S.ctorWF constructor hconstructor).mono henv
+  familyConst := fun family hfamily =>
+    henv.constants (S.familyConst family hfamily)
+  ctorConst := fun constructor hconstructor =>
+    henv.constants (S.ctorConst constructor hconstructor)
+
+theorem generationParams_defeq :
+    env.TelDefEq source.uvars []
+      (generationParams gen.block.rawParams gen.block.checked.params)
+      gen.block.checked.params :=
+  S.paramsTel.generationParams S.ord
+
+theorem generationParams_length :
+    (generationParams gen.block.rawParams
+      gen.block.checked.params).length = source.nparams := by
+  exact (generationParams_length_of_eq S.paramsTel.length_eq).trans
+    gen.shape.1
+
+theorem generationParams_ctx :
+    env.IsDefEqCtx source.uvars []
+      (generationParams gen.block.rawParams
+        gen.block.checked.params).reverse
+      gen.block.checked.params.reverse := by
+  simpa using S.generationParams_defeq.ctx
+
+theorem generationParams_ctx_rec :
+    env.IsDefEqCtx gen.recUvars [] gen.paramsTel.reverse
+      (gen.block.checked.params.map
+        (VExpr.instL gen.sourceLevels)).reverse := by
+  have h := S.generationParams_defeq.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simpa [BlockGenerationChecked.paramsTel, List.map_reverse] using h.ctx
+
+theorem rawFamily_onTel {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.OnTel source.uvars []
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams) :=
+  (S.familyWF family hfamily).familyTel.raw_onTel
+
+theorem familyConst_decl {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) {Γ : List VExpr} :
+    env.HasType source.uvars Γ
+      (.const family.raw.name (VLevel.params source.uvars))
+      family.raw.type := by
+  have hwf : family.raw.toVConstant.WF env := by
+    show env.IsType family.raw.uvars [] family.raw.type
+    rw [gen.family_uvars hfamily]
+    exact (S.familyWF family hfamily).rawFamily_isType
+  have h := HasType.const0 (S.familyConst family hfamily) hwf
+  rw [gen.family_uvars hfamily] at h
+  exact h.weak0 S.ord
+
+theorem ctorConst_decl {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) {Γ : List VExpr} :
+    env.HasType source.uvars Γ
+      (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+      constructor.ctor.raw.type := by
+  have hwf : constructor.ctor.raw.toVConstant.WF env := by
+    show env.IsType constructor.ctor.raw.uvars []
+      constructor.ctor.raw.type
+    rw [gen.flatCtor_uvars hconstructor]
+    exact (S.ctorWF constructor hconstructor).rawDeclared_isType
+  have h := HasType.const0 (S.ctorConst constructor hconstructor) hwf
+  rw [gen.flatCtor_uvars hconstructor] at h
+  exact h.weak0 S.ord
+
+theorem rawParams_defeq {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.TelDefEq source.uvars []
+      (family.rawParams source.nparams) gen.block.checked.params := by
+  have h := (S.familyWF family hfamily).familyTel.take source.nparams
+  have hraw :
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams).take source.nparams =
+        family.rawParams source.nparams := by
+    let Ps := family.rawParams source.nparams
+    let Is := family.rawIndices source.nparams
+    have hlen : Ps.length = source.nparams :=
+      (gen.shape.2.2.2.2 family hfamily).2.2.1
+    change (Ps ++ Is).take source.nparams = Ps
+    rw [← hlen, List.take_append, List.take_length]
+    simp
+  have hviewLen : gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hview :
+      (gen.block.checked.params ++ family.view.indices).take
+          source.nparams = gen.block.checked.params := by
+    rw [← hviewLen, List.take_append, List.take_length]
+    simp
+  rw [hraw, hview] at h
+  exact h
+
+theorem emittedFamilyTel {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.TelDefEq source.uvars []
+      (family.rawParams source.nparams ++ family.rawIndices source.nparams)
+      (gen.block.checked.params ++ family.rawIndices source.nparams) := by
+  have hindices : env.OnTel source.uvars
+      (family.rawParams source.nparams).reverse
+      (family.rawIndices source.nparams) := by
+    simpa using (S.rawFamily_onTel hfamily).of_append.2
+  exact (S.rawParams_defeq hfamily).append_refl (by simpa using hindices)
+
+theorem emittedFamily_onTel {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.OnTel source.uvars []
+      (gen.block.checked.params ++ family.rawIndices source.nparams) :=
+  (S.emittedFamilyTel hfamily).view_onTel S.ord
+
+theorem generationFamilyTel {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.TelDefEq source.uvars []
+      (generationParams gen.block.rawParams gen.block.checked.params ++
+        family.rawIndices source.nparams)
+      (gen.block.checked.params ++ family.rawIndices source.nparams) := by
+  have hindicesChecked : env.OnTel source.uvars
+      gen.block.checked.params.reverse (family.rawIndices source.nparams) := by
+    simpa using (S.emittedFamily_onTel hfamily).of_append.2
+  have hindicesGeneration : env.OnTel source.uvars
+      (generationParams gen.block.rawParams
+        gen.block.checked.params).reverse
+      (family.rawIndices source.nparams) :=
+    hindicesChecked.defeqDFC S.ord
+      (S.generationParams_ctx.symm S.ord)
+  exact S.generationParams_defeq.append_refl
+    (by simpa using hindicesGeneration)
+
+theorem generationFamily_onTel {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.OnTel source.uvars []
+      (generationParams gen.block.rawParams gen.block.checked.params ++
+        family.rawIndices source.nparams) :=
+  (S.generationFamilyTel hfamily).raw_onTel
+
+theorem emittedFamily_ctx {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.IsDefEqCtx source.uvars []
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams).reverse
+      (gen.block.checked.params ++
+        family.rawIndices source.nparams).reverse := by
+  simpa using (S.emittedFamilyTel hfamily).ctx
+
+theorem generationFamily_ctx {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.IsDefEqCtx source.uvars []
+      (generationParams gen.block.rawParams gen.block.checked.params ++
+        family.rawIndices source.nparams).reverse
+      (gen.block.checked.params ++
+        family.rawIndices source.nparams).reverse := by
+  simpa using (S.generationFamilyTel hfamily).ctx
+
+theorem familyConst_emitted_decl {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.HasType source.uvars []
+      (.const family.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (gen.block.checked.params ++ family.rawIndices source.nparams)
+        (family.rawResult source.nparams)) := by
+  have hc : env.HasType source.uvars []
+      (.const family.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (family.rawParams source.nparams ++ family.rawIndices source.nparams)
+        (family.rawResult source.nparams)) := by
+    rw [VExpr.forallN_append, ← family.rawType_eq]
+    exact S.familyConst_decl hfamily
+  obtain ⟨_, htel⟩ := (S.emittedFamilyTel hfamily).forallN_defeq
+    (by simpa [VEnv.HasType] using
+      (S.familyWF family hfamily).familyResult.hasType.1)
+  exact htel.defeq hc
+
+theorem familyConst_generation_decl {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.HasType source.uvars []
+      (.const family.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (generationParams gen.block.rawParams gen.block.checked.params ++
+          family.rawIndices source.nparams)
+        (family.rawResult source.nparams)) := by
+  have hresultChecked :=
+    (S.familyWF family hfamily).familyResult.defeqDFC S.ord
+      (S.emittedFamily_ctx hfamily)
+  have hresultGeneration := hresultChecked.defeqDFC S.ord
+    ((S.generationFamily_ctx hfamily).symm S.ord)
+  obtain ⟨_, htel⟩ := (S.generationFamilyTel hfamily).forallN_defeq
+    (by simpa [VEnv.HasType] using hresultGeneration.hasType.1)
+  exact htel.defeq' (S.familyConst_emitted_decl hfamily)
+
+theorem familyApp_hasType {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.HasType gen.recUvars
+      ((gen.idxTel family).reverse ++ gen.paramsTel.reverse)
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (gen.idxTel family).length source.nparams ++
+          VExpr.bvarRevRange 0 (gen.idxTel family).length))
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+  let ls := gen.sourceLevels
+  have hconst₀ := (S.familyConst_generation_decl hfamily).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hconst₁ : env.HasType gen.recUvars []
+      (.const family.raw.name ls)
+      (VExpr.forallN (gen.paramsTel ++ gen.idxTel family)
+        ((family.rawResult source.nparams).instL ls)) := by
+    simpa [ls, BlockGenerationChecked.paramsTel,
+      BlockGenerationChecked.idxTel, VExpr.instL_forallN,
+      VExpr.instL, VLevel.params_map_inst_params'] using hconst₀
+  have hclosed :
+      (VExpr.forallN (gen.paramsTel ++ gen.idxTel family)
+        ((family.rawResult source.nparams).instL ls)).ClosedN 0 :=
+    (hconst₁.closedN' S.ord.closed trivial).2.2
+  have hconst : env.HasType gen.recUvars
+      ((gen.paramsTel ++ gen.idxTel family).reverse)
+      (.const family.raw.name ls)
+      (VExpr.forallN (gen.paramsTel ++ gen.idxTel family)
+        ((family.rawResult source.nparams).instL ls)) :=
+    hconst₁.weak0 S.ord
+  have happ := HasType.appN_selfSpine'
+    (Δ := []) (Γ := []) hclosed (by simpa using hconst)
+  simp only [List.length_nil, VExpr.liftN_zero, List.nil_append,
+    List.append_nil] at happ
+  have hlen : (gen.paramsTel ++ gen.idxTel family).length =
+      (gen.idxTel family).length + source.nparams := by
+    simp only [List.length_append, BlockGenerationChecked.paramsTel,
+      BlockGenerationChecked.idxTel, List.length_map]
+    rw [S.generationParams_length]
+    omega
+  rw [VExpr.bvarRevRange_congr' 0 hlen,
+    ← VExpr.bvarRevRange_append] at happ
+  have hresult := (S.familyWF family hfamily).familyResult.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simp only [List.map_reverse] at hresult
+  have hctxChecked := ((S.emittedFamilyTel hfamily).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf).ctx
+  simp only [List.map_nil, List.append_nil] at hctxChecked
+  have hresultChecked := hresult.defeqDFC S.ord hctxChecked
+  have hctxGeneration := ((S.generationFamilyTel hfamily).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf).ctx
+  simp only [List.map_nil, List.append_nil] at hctxGeneration
+  have hresultGeneration := hresultChecked.defeqDFC S.ord
+    (hctxGeneration.symm S.ord)
+  have hresult' : env.IsDefEq gen.recUvars
+      ((gen.idxTel family).reverse ++ gen.paramsTel.reverse)
+      ((family.rawResult source.nparams).instL ls)
+      (.sort (gen.validated.resultLevel.inst ls))
+      (.sort (.succ (gen.validated.resultLevel.inst ls))) := by
+    simpa [ls, BlockGenerationChecked.paramsTel,
+      BlockGenerationChecked.idxTel, List.map_reverse, VLevel.inst] using
+      hresultGeneration
+  exact hresult'.defeq (by
+    simpa [List.reverse_append] using happ)
+
+theorem motive_isType {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.IsType gen.recUvars gen.paramsTel.reverse
+      (gen.motiveType family) := by
+  have htel₀ := (S.generationFamily_onTel hfamily).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have htel : env.OnTel gen.recUvars []
+      (gen.paramsTel ++ gen.idxTel family) := by
+    simpa [BlockGenerationChecked.paramsTel,
+      BlockGenerationChecked.idxTel] using htel₀
+  have hidx : env.OnTel gen.recUvars gen.paramsTel.reverse
+      (gen.idxTel family) := by
+    simpa using htel.of_append.2
+  refine IsType.forallN hidx ?_
+  exact ⟨_, by
+    simpa [BlockGenerationChecked.motiveType] using
+      HasType.forallE (S.familyApp_hasType hfamily)
+        (HasType.sort gen.motiveLevel_wf)⟩
+
+end BlockGenerationEnv
+
+/-- Exact decomposition of the stored raw family type. -/
+theorem NormalizedChecked.rawType_eq {source : VInductDecl}
+    (block : NormalizedChecked source) :
+    block.sourceType.type =
+      VExpr.forallN block.rawParams
+        (VExpr.forallN block.rawIndices block.rawResult) := by
+  conv => lhs
+          rw [← VExpr.forallN_telN_dropN source.nparams
+            block.sourceType.type,
+            ← forallN_ctorFields_resultOf
+              (VExpr.dropN source.nparams block.sourceType.type)]
+  rfl
+
+/-- Exact decomposition of a stored raw constructor type into its declared
+parameter/field telescope and terminal result. -/
+theorem NormalizedCtor.rawType_eq {source : VInductDecl}
+    (ctor : NormalizedCtor) :
+    ctor.raw.type =
+      VExpr.forallN (ctor.declaredBinders source.nparams)
+        (ctor.rawResult source.nparams) := by
+  conv => lhs
+          rw [← VExpr.forallN_telN_dropN source.nparams
+            ctor.raw.type,
+            ← forallN_ctorFields_resultOf
+              (VExpr.dropN source.nparams ctor.raw.type)]
+  rw [NormalizedCtor.declaredBinders, NormalizedCtor.rawFields,
+    NormalizedCtor.rawResult, ← VExpr.forallN_append]
+
+namespace GenerationEnv
+
+variable {source : VInductDecl} {gen : GenerationChecked source}
+  {env : VEnv} (S : GenerationEnv gen env)
+include S
+-- `S` is included throughout so every lemma below is reachable as `S.lemma`,
+-- including those whose statement and proof never mention it.
+set_option linter.unusedSectionVars false
+
+/-- The final mixed-generation invariant is monotone once the larger
+environment is known to remain ordered. -/
+theorem mono {env' : VEnv} (henv : env ≤ env') (ord : env'.Ordered) :
+    GenerationEnv gen env' where
+  ord := ord
+  checked := S.checked.mono henv
+  familyTel := S.familyTel.mono henv
+  familyResult := S.familyResult.mono henv
+  ctorWF := fun ctor hctor => (S.ctorWF ctor hctor).mono henv
+  familyConst := henv.constants S.familyConst
+  ctorConst := fun ctor hctor => henv.constants (S.ctorConst ctor hctor)
+
+/-- The checked result universe is well formed at the source declaration's
+universe arity. -/
+theorem resultLevel_WF :
+    gen.block.checked.resultLevel.WF source.uvars := by
+  rw [gen.block.uvars_eq]
+  exact gen.block.checked.direct_anatomy.2.2.1
+
+theorem rawFamily_onTel :
+    env.OnTel source.uvars []
+      (gen.block.rawParams ++ gen.block.rawIndices) :=
+  S.familyTel.raw_onTel
+
+/-- The family parameter prefix is structurally definitionally equal to the
+checked locals retained by validation. -/
+theorem rawParams_defeq :
+    env.TelDefEq source.uvars [] gen.block.rawParams
+      gen.block.checked.params := by
+  have h := S.familyTel.take source.nparams
+  have hraw :
+      (gen.block.rawParams ++ gen.block.rawIndices).take source.nparams =
+        gen.block.rawParams := by
+    rw [← gen.shape.1, List.take_append, List.take_length]
+    simp
+  have hviewLen : gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hview :
+      (gen.block.checked.params ++ gen.block.checked.indices).take
+          source.nparams = gen.block.checked.params := by
+    rw [← hviewLen, List.take_append, List.take_length]
+    simp
+  rw [hraw, hview] at h
+  exact h
+
+/-- Raw and checked parameter contexts denote the same local telescope. -/
+theorem rawParams_ctx :
+    env.IsDefEqCtx source.uvars [] gen.block.rawParams.reverse
+      gen.block.checked.params.reverse :=
+  by simpa using S.rawParams_defeq.ctx
+
+/-- The exact parameter surface emitted in recursor metadata remains
+definitionally equal to the analyzer-owned parameters. -/
+theorem generationParams_defeq :
+    env.TelDefEq source.uvars [] gen.block.generationParams
+      gen.block.checked.params := by
+  exact S.rawParams_defeq.generationParams S.ord
+
+theorem generationParams_ctx :
+    env.IsDefEqCtx source.uvars [] gen.block.generationParams.reverse
+      gen.block.checked.params.reverse :=
+  by simpa using S.generationParams_defeq.ctx
+
+theorem generationParams_length :
+    gen.block.generationParams.length = source.nparams := by
+  have hrawView := S.rawParams_defeq.length_eq
+  exact (VInductDecl.generationParams_length_of_eq hrawView).trans
+    gen.shape.1
+
+theorem generationParams_ctx_rec :
+    env.IsDefEqCtx (gen.recUvars) [] gen.paramsTel.reverse
+      (gen.block.checked.params.map
+        (VExpr.instL (gen.sourceLevels))).reverse := by
+  have h := S.generationParams_defeq.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simpa [GenerationChecked.paramsTel, List.map_reverse] using h.ctx
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.generationParams_defeq [propext, Quot.sound]
+
+/-- Stored constructor fields are well formed over the exact generated
+parameter surface after universe transport. -/
+theorem generationFields_onTel_rec {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.OnTel (gen.recUvars) gen.paramsTel.reverse
+      (ctor.fieldsR source.uvars source.nparams gen.elimination) := by
+  have hemitted := (S.ctorWF ctor hctor).rawEmitted_onTel
+  have hfields₀ := (OnTel.of_append
+    (As := gen.block.checked.params) hemitted).2
+  have hfields₁ := hfields₀.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hfieldsChecked : env.OnTel (gen.recUvars)
+      (gen.block.checked.params.map
+        (VExpr.instL (gen.sourceLevels))).reverse
+      (ctor.fieldsR source.uvars source.nparams gen.elimination) := by
+    simpa [NormalizedCtor.fieldsR, List.map_reverse] using hfields₁
+  exact hfieldsChecked.defeqDFC S.ord
+    (S.generationParams_ctx_rec.symm S.ord)
+
+theorem generationFieldPrefix_ctx_rec {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) (j : Nat) :
+    env.IsDefEqCtx (gen.recUvars) []
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination |>.take j).reverse ++
+        gen.paramsTel.reverse)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination |>.take j).reverse ++
+        (gen.block.checked.params.map
+          (VExpr.instL (gen.sourceLevels))).reverse) := by
+  have hfields := S.generationFields_onTel_rec hctor
+  rw [← List.take_append_drop j
+    (ctor.fieldsR source.uvars source.nparams gen.elimination)] at hfields
+  exact (hfields.of_append.1).extendDefEqCtx
+    S.generationParams_ctx_rec
+
+/-- The family telescope used by generated artifacts keeps raw index syntax
+but uses the checked parameter prefix consumed by validation. -/
+theorem emittedFamilyTel :
+    env.TelDefEq source.uvars []
+      (gen.block.rawParams ++ gen.block.rawIndices)
+      (gen.block.checked.params ++ gen.block.rawIndices) := by
+  have hindices : env.OnTel source.uvars gen.block.rawParams.reverse
+      gen.block.rawIndices := by
+    simpa using S.rawFamily_onTel.of_append.2
+  exact S.rawParams_defeq.append_refl (by simpa using hindices)
+
+/-- The emitted mixed family telescope is well formed. -/
+theorem emittedFamily_onTel :
+    env.OnTel source.uvars []
+      (gen.block.checked.params ++ gen.block.rawIndices) :=
+  S.emittedFamilyTel.view_onTel S.ord
+
+/-- Replace the checked parameter prefix by the kernel-observable generation
+surface while leaving the stored raw index telescope unchanged. -/
+theorem generationFamilyTel :
+    env.TelDefEq source.uvars []
+      (gen.block.generationParams ++ gen.block.rawIndices)
+      (gen.block.checked.params ++ gen.block.rawIndices) := by
+  have hindicesChecked : env.OnTel source.uvars
+      gen.block.checked.params.reverse gen.block.rawIndices := by
+    simpa using S.emittedFamily_onTel.of_append.2
+  have hindicesGeneration : env.OnTel source.uvars
+      gen.block.generationParams.reverse gen.block.rawIndices :=
+    hindicesChecked.defeqDFC S.ord
+      (S.generationParams_ctx.symm S.ord)
+  exact S.generationParams_defeq.append_refl
+    (by simpa using hindicesGeneration)
+
+theorem generationFamily_onTel :
+    env.OnTel source.uvars []
+      (gen.block.generationParams ++ gen.block.rawIndices) :=
+  S.generationFamilyTel.raw_onTel
+
+theorem generationFamily_ctx :
+    env.IsDefEqCtx source.uvars []
+      (gen.block.generationParams ++ gen.block.rawIndices).reverse
+      (gen.block.checked.params ++ gen.block.rawIndices).reverse :=
+  by simpa using S.generationFamilyTel.ctx
+
+/-- Completed raw and emitted family contexts are definitionally equal. -/
+theorem emittedFamily_ctx :
+    env.IsDefEqCtx source.uvars []
+      (gen.block.rawParams ++ gen.block.rawIndices).reverse
+      (gen.block.checked.params ++ gen.block.rawIndices).reverse :=
+  by simpa using S.emittedFamilyTel.ctx
+
+theorem rawFamily_isType :
+    env.IsType source.uvars [] gen.block.sourceType.type := by
+  rw [gen.block.rawType_eq, ← VExpr.forallN_append]
+  have hresult₀ : env.IsType source.uvars
+      (gen.block.rawParams ++ gen.block.rawIndices).reverse
+      gen.block.rawResult :=
+    ⟨_, S.familyResult.hasType.1⟩
+  have hresult : env.IsType source.uvars
+      ((gen.block.rawParams ++ gen.block.rawIndices).reverse ++ [])
+      gen.block.rawResult := by
+    simpa using hresult₀
+  exact IsType.forallN S.rawFamily_onTel hresult
+
+theorem rawCtor_isType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.IsType source.uvars [] ctor.raw.type :=
+  (S.ctorWF ctor hctor).rawDeclared_isType
+
+/-- The raw family constant at declaration universes, in any context. -/
+theorem familyConst_decl {Γ : List VExpr} :
+    env.HasType source.uvars Γ
+      (.const gen.block.sourceType.name (VLevel.params source.uvars))
+      gen.block.sourceType.type := by
+  have hwf : gen.block.sourceType.toVConstant.WF env := by
+    show env.IsType gen.block.sourceType.uvars []
+      gen.block.sourceType.type
+    rw [gen.block.sourceType_uvars_eq]
+    exact S.rawFamily_isType
+  have h := HasType.const0 S.familyConst hwf
+  rw [gen.block.sourceType_uvars_eq] at h
+  exact h.weak0 S.ord
+
+/-- A stored raw constructor constant at declaration universes, in any
+context. -/
+theorem ctorConst_decl {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {Γ : List VExpr} :
+    env.HasType source.uvars Γ
+      (.const ctor.raw.name (VLevel.params source.uvars))
+      ctor.raw.type := by
+  have hwf : ctor.raw.toVConstant.WF env := by
+    show env.IsType ctor.raw.uvars [] ctor.raw.type
+    rw [gen.ctor_uvars_eq hctor]
+    exact S.rawCtor_isType hctor
+  have h := HasType.const0 (S.ctorConst ctor hctor) hwf
+  rw [gen.ctor_uvars_eq hctor] at h
+  exact h.weak0 S.ord
+
+/-- The stored constructor constant applied to the checked-parameter/raw-field
+self-spine emitted by mixed artifacts. The constructor's declared parameter
+prefix need only be definitionally equal to this checked family prefix. -/
+theorem ctorApp_emitted_decl {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.HasType source.uvars
+      ((ctor.rawFields source.nparams).reverse ++
+        gen.block.checked.params.reverse)
+      (VExpr.appN
+        (.const ctor.raw.name (VLevel.params source.uvars))
+        (VExpr.bvarRevRange
+            (ctor.rawFields source.nparams).length source.nparams ++
+          VExpr.bvarRevRange 0
+            (ctor.rawFields source.nparams).length))
+      (ctor.resultTarget gen.block) := by
+  let E := ctor.emittedBinders gen.block
+  let V := ctor.viewBinders gen.block
+  have hc : env.HasType source.uvars []
+      (.const ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN (ctor.declaredBinders source.nparams)
+        (ctor.rawResult source.nparams)) := by
+    rw [← ctor.rawType_eq]
+    exact S.ctorConst_decl hctor
+  obtain ⟨_, hdecl⟩ :=
+    (S.ctorWF ctor hctor).declaredTel.forallN_defeq
+      (by
+        simpa using (S.ctorWF ctor hctor).declaredResult)
+  have hview : env.HasType source.uvars []
+      (.const ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN V (ctor.resultTarget gen.block)) := by
+    simpa [V] using hdecl.defeq hc
+  have hresult : env.HasType source.uvars E.reverse
+      (ctor.resultTarget gen.block)
+      (.sort gen.block.checked.resultLevel) := by
+    simpa [E] using
+      (S.ctorWF ctor hctor).emittedResult.hasType.2
+  obtain ⟨_, hemit⟩ :=
+    (S.ctorWF ctor hctor).emittedTel.forallN_defeq
+      (by simpa [E, VEnv.HasType] using hresult)
+  have hcE₀ : env.HasType source.uvars []
+      (.const ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN E (ctor.resultTarget gen.block)) := by
+    exact hemit.defeq' (by simpa [V] using hview)
+  have hclosed :
+      (VExpr.forallN E (ctor.resultTarget gen.block)).ClosedN 0 :=
+    (hcE₀.closedN' S.ord.closed trivial).2.2
+  have hcE : env.HasType source.uvars E.reverse
+      (.const ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN E (ctor.resultTarget gen.block)) :=
+    hcE₀.weak0 S.ord
+  have happ := HasType.appN_selfSpine'
+    (As := E) (B := ctor.resultTarget gen.block)
+    (Δ := []) (Γ := []) hclosed (by simpa using hcE)
+  simp only [List.length_nil, VExpr.liftN_zero,
+    List.nil_append, List.append_nil] at happ
+  have hEctx :
+      E.reverse =
+        (ctor.rawFields source.nparams).reverse ++
+          gen.block.checked.params.reverse := by
+    simp [E, NormalizedCtor.emittedBinders,
+      List.reverse_append]
+  have hElen :
+      E.length =
+        (ctor.rawFields source.nparams).length +
+          source.nparams := by
+    have hp : gen.block.checked.params.length = source.nparams :=
+      gen.shape.2.1.symm.trans gen.shape.1
+    simp [E, NormalizedCtor.emittedBinders, hp]
+    omega
+  rw [hEctx, hElen,
+    ← VExpr.bvarRevRange_append source.nparams
+      (ctor.rawFields source.nparams).length] at happ
+  exact happ
+
+/-- The raw family constant instantiated into recursor universes. -/
+theorem familyConst_rec {Γ : List VExpr} :
+    env.HasType (gen.recUvars) Γ
+      (.const gen.block.sourceType.name
+        (gen.sourceLevels))
+      (gen.block.sourceType.type.instL
+        (gen.sourceLevels)) := by
+  have h := (S.familyConst_decl (Γ := [])).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  rw [show
+    (VExpr.const gen.block.sourceType.name
+      (VLevel.params source.uvars)).instL
+        (gen.sourceLevels) =
+      .const gen.block.sourceType.name
+        (gen.sourceLevels) by
+    simp [VExpr.instL, VLevel.params_map_inst_params']] at h
+  exact h.weak0 S.ord
+
+/-- The raw family type decomposed in recursor universes. -/
+theorem rawType_rec_eq :
+    gen.block.sourceType.type.instL (gen.sourceLevels) =
+      VExpr.forallN
+        (gen.block.rawParams.map
+          (VExpr.instL (gen.sourceLevels)))
+        (VExpr.forallN gen.idxTel
+          (gen.block.rawResult.instL
+            (gen.sourceLevels))) := by
+  rw [gen.block.rawType_eq, VExpr.instL_forallN,
+    VExpr.instL_forallN]
+  rfl
+
+/-- The family constant may be viewed through the checked-parameter/raw-index
+telescope emitted by generated artifacts. -/
+theorem familyConst_emitted_decl :
+    env.HasType source.uvars []
+      (.const gen.block.sourceType.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (gen.block.checked.params ++ gen.block.rawIndices)
+        gen.block.rawResult) := by
+  have hc : env.HasType source.uvars []
+      (.const gen.block.sourceType.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (gen.block.rawParams ++ gen.block.rawIndices)
+        gen.block.rawResult) := by
+    rw [VExpr.forallN_append, ← gen.block.rawType_eq]
+    exact S.familyConst_decl
+  obtain ⟨_, htel⟩ := S.emittedFamilyTel.forallN_defeq
+    (by simpa [VEnv.HasType] using S.familyResult.hasType.1)
+  exact htel.defeq hc
+
+/-- The family constant viewed through the exact parameter syntax retained
+by generated kernel metadata. -/
+theorem familyConst_generation_decl :
+    env.HasType source.uvars []
+      (.const gen.block.sourceType.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (gen.block.generationParams ++ gen.block.rawIndices)
+        gen.block.rawResult) := by
+  have hresultChecked := S.familyResult.defeqDFC S.ord
+    S.emittedFamily_ctx
+  have hresultGeneration := hresultChecked.defeqDFC S.ord
+    (S.generationFamily_ctx.symm S.ord)
+  obtain ⟨_, htel⟩ := S.generationFamilyTel.forallN_defeq
+    (by simpa [VEnv.HasType] using hresultGeneration.hasType.1)
+  exact htel.defeq' S.familyConst_emitted_decl
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.familyConst_generation_decl [propext, Quot.sound]
+
+/-- The family applied to its checked-parameter/raw-index self-spine has the
+normalized result sort. -/
+theorem familyApp_hasType :
+    env.HasType (gen.recUvars)
+      (gen.idxTel.reverse ++ gen.paramsTel.reverse)
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange gen.idxTel.length source.nparams ++
+          VExpr.bvarRevRange 0 gen.idxTel.length))
+      (.sort
+        (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))) := by
+  let ls := gen.sourceLevels
+  have hconst₀ := S.familyConst_generation_decl.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hconst₁ : env.HasType (gen.recUvars) []
+      (.const gen.block.sourceType.name ls)
+      (VExpr.forallN (gen.paramsTel ++ gen.idxTel)
+        (gen.block.rawResult.instL ls)) := by
+    simpa [ls, GenerationChecked.paramsTel,
+      GenerationChecked.idxTel, VExpr.instL_forallN,
+      VExpr.instL, VLevel.params_map_inst_params'] using hconst₀
+  have hcanonicalClosed :
+      (VExpr.forallN (gen.paramsTel ++ gen.idxTel)
+        (gen.block.rawResult.instL ls)).ClosedN 0 := by
+    exact (hconst₁.closedN' S.ord.closed trivial).2.2
+  have hconst : env.HasType (gen.recUvars)
+      ((gen.paramsTel ++ gen.idxTel).reverse)
+      (.const gen.block.sourceType.name ls)
+      (VExpr.forallN (gen.paramsTel ++ gen.idxTel)
+        (gen.block.rawResult.instL ls)) :=
+    hconst₁.weak0 S.ord
+  have happ := HasType.appN_selfSpine'
+    (Δ := []) (Γ := []) hcanonicalClosed (by
+      simpa using hconst)
+  simp only [List.length_nil, VExpr.liftN_zero, List.nil_append,
+    List.append_nil] at happ
+  have hlen :
+      (gen.paramsTel ++ gen.idxTel).length =
+        gen.idxTel.length + source.nparams := by
+    simp only [List.length_append, GenerationChecked.paramsTel,
+      GenerationChecked.idxTel, List.length_map]
+    rw [S.generationParams_length]
+    omega
+  rw [VExpr.bvarRevRange_congr' 0 hlen,
+    ← VExpr.bvarRevRange_append] at happ
+  have hresult := S.familyResult.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simp only [List.map_reverse] at hresult
+  have hctxChecked := (S.emittedFamilyTel.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf).ctx
+  simp only [List.map_nil, List.append_nil] at hctxChecked
+  have hresultChecked := hresult.defeqDFC S.ord hctxChecked
+  have hctxGeneration := (S.generationFamilyTel.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf).ctx
+  simp only [List.map_nil, List.append_nil] at hctxGeneration
+  have hresultGeneration := hresultChecked.defeqDFC S.ord
+    (hctxGeneration.symm S.ord)
+  have hresult' : env.IsDefEq (gen.recUvars)
+      (gen.idxTel.reverse ++ gen.paramsTel.reverse)
+      (gen.block.rawResult.instL ls)
+      (.sort (gen.block.checked.resultLevel.inst ls))
+      (.sort (.succ (gen.block.checked.resultLevel.inst ls))) := by
+    simpa [ls, GenerationChecked.paramsTel, GenerationChecked.idxTel,
+      List.map_reverse, VLevel.inst] using hresultGeneration
+  exact hresult'.defeq (by
+    simpa [List.reverse_append] using happ)
+
+/-- The mixed motive is a well-formed type over the checked parameter
+context. -/
+theorem motive_isType :
+    env.IsType (gen.recUvars) gen.paramsTel.reverse
+      gen.motiveType := by
+  have htel₀ := S.generationFamily_onTel.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have htel :
+      env.OnTel (gen.recUvars) []
+        (gen.paramsTel ++ gen.idxTel) := by
+    simpa [GenerationChecked.paramsTel, GenerationChecked.idxTel] using htel₀
+  have hidx : env.OnTel (gen.recUvars) gen.paramsTel.reverse
+      gen.idxTel := by
+    simpa using htel.of_append.2
+  refine IsType.forallN hidx ?_
+  exact ⟨_, by
+    simpa [GenerationChecked.motiveType] using
+      HasType.forallE S.familyApp_hasType
+        (HasType.sort gen.motiveLevel_wf)⟩
+
+end GenerationEnv
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.motive_isType [propext, Quot.sound]
+
+theorem BlockGenerationChecked.motiveTypesAux_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    ∀ (families : List NormalizedFamily) (i : Nat),
+      (gen.motiveTypesAux families i).length = families.length
+  | [], _ => rfl
+  | _ :: families, i => by
+    simp only [BlockGenerationChecked.motiveTypesAux, List.length_cons]
+    rw [gen.motiveTypesAux_length families (i + 1)]
+
+theorem BlockGenerationChecked.motiveTypes_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.motiveTypes.length = gen.familyCount := by
+  unfold BlockGenerationChecked.motiveTypes
+  exact gen.motiveTypesAux_length gen.families 0
+
+/-- Pairing arbitrary stored families with a dependent checked-family spine
+does not change the checked ordinal at any surviving position. -/
+theorem CheckedFamilies.pairNormalizedFamilies_getElem?_ordinal
+    {source : VInductDecl} {params : List VExpr}
+    {ordinal : Nat} {types : List VInductiveType}
+    (families : CheckedFamilies source params ordinal types) :
+    ∀ {raws i family},
+      (pairNormalizedFamilies raws families.data)[i]? = some family →
+      family.view.ordinal = ordinal + i := by
+  induction families with
+  | nil =>
+    intro raws i family h
+    simp [CheckedFamilies.data, pairNormalizedFamilies] at h
+  | @cons ordinal type types head tail ih =>
+    intro raws i family h
+    cases raws with
+    | nil => simp [pairNormalizedFamilies] at h
+    | cons raw raws =>
+      cases i with
+      | zero =>
+        simp only [CheckedFamilies.data, pairNormalizedFamilies,
+          List.getElem?_cons_zero] at h
+        injection h with hfamily
+        subst family
+        rfl
+      | succ i =>
+        simp only [CheckedFamilies.data, pairNormalizedFamilies,
+          List.getElem?_cons_succ] at h
+        have hord := ih h
+        omega
+
+/-- Every retained family is found at its checked source ordinal. -/
+theorem BlockGenerationChecked.family_getElem?_ordinal
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    gen.families[family.view.ordinal]? = some family := by
+  obtain ⟨i, hi⟩ := List.mem_iff_getElem?.1 hfamily
+  have hi' :
+      (pairNormalizedFamilies source.types
+        gen.block.checked.families.data)[i]? = some family := by
+    simpa [BlockGenerationChecked.families,
+      NormalizedCheckedBlock.familyPairs] using hi
+  have hord :=
+    CheckedFamilies.pairNormalizedFamilies_getElem?_ordinal
+      gen.block.checked.families hi'
+  have hord' : family.view.ordinal = i := by
+    simpa using hord
+  rwa [hord']
+
+theorem BlockGenerationChecked.family_ordinal_lt
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    family.view.ordinal < gen.familyCount := by
+  obtain ⟨h, -⟩ := List.getElem?_eq_some_iff.1
+    (gen.family_getElem?_ordinal hfamily)
+  exact h
+
+/-- Selecting a retained family by its checked ordinal recovers its exact
+raw constant name. -/
+@[simp] theorem BlockGenerationChecked.familyNameAt_ordinal
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    gen.familyNameAt family.view.ordinal = family.raw.name := by
+  simp [BlockGenerationChecked.familyNameAt,
+    gen.family_getElem?_ordinal hfamily]
+
+/-- Positional lookup through the progressively weakened mutual motive
+telescope. -/
+theorem BlockGenerationChecked.motiveTypesAux_getElem?
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    ∀ (families : List NormalizedFamily) (i q : Nat),
+      (gen.motiveTypesAux families i)[q]? =
+        families[q]?.map fun family =>
+          (gen.motiveType family).liftN (i + q)
+  | [], _, q => by simp [BlockGenerationChecked.motiveTypesAux]
+  | _ :: _, _, 0 => by simp [BlockGenerationChecked.motiveTypesAux]
+  | _ :: families, i, q + 1 => by
+    simp only [BlockGenerationChecked.motiveTypesAux,
+      List.getElem?_cons_succ]
+    rw [gen.motiveTypesAux_getElem? families (i + 1) q,
+      show i + 1 + q = i + (q + 1) by omega]
+
+theorem BlockGenerationChecked.motiveTypes_getElem?_ordinal
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    gen.motiveTypes[family.view.ordinal]? =
+      some ((gen.motiveType family).liftN family.view.ordinal) := by
+  rw [show gen.motiveTypes = gen.motiveTypesAux gen.families 0 from rfl,
+    gen.motiveTypesAux_getElem?]
+  rw [gen.family_getElem?_ordinal hfamily]
+  simp
+
+/-- Paired block constructors retain the raw/view field arity certified by
+normalization. -/
+theorem BlockGenerationChecked.flatCtor_fields_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    (constructor.ctor.rawFields source.nparams).length =
+      constructor.ctor.view.fields.length := by
+  simp only [BlockGenerationChecked.flatCtors,
+    NormalizedCheckedBlock.flatCtors, List.mem_flatMap] at hconstructor
+  obtain ⟨family, hfamily, hconstructor⟩ := hconstructor
+  simp only [NormalizedFamily.blockCtors, List.mem_map] at hconstructor
+  obtain ⟨ctor, hctor, rfl⟩ := hconstructor
+  exact ((gen.shape.2.2.2.2 family hfamily).2.2.2.2.2.2
+    ctor hctor).2.2.2
+
+/-- Syntactic lifting law for any member of the mutual motive telescope. -/
+theorem BlockGenerationChecked.motiveType_liftN
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    (family : NormalizedFamily) (n : Nat) :
+    (gen.motiveType family).liftN n =
+      VExpr.forallN (VExpr.liftTelN n (gen.idxTel family) 0)
+        (.forallE
+          (VExpr.appN
+            (.const family.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange (n + (gen.idxTel family).length)
+                source.nparams ++
+              VExpr.bvarRevRange 0 (gen.idxTel family).length))
+          (.sort gen.motiveLevel)) := by
+  rw [show gen.motiveType family =
+      VExpr.forallN (gen.idxTel family)
+        (.forallE
+          (VExpr.appN
+            (.const family.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange (gen.idxTel family).length source.nparams ++
+              VExpr.bvarRevRange 0 (gen.idxTel family).length))
+          (.sort gen.motiveLevel)) from rfl,
+    VExpr.liftN_forallN]
+  refine congrArg _ ?_
+  show VExpr.forallE _ _ = VExpr.forallE _ _
+  refine congr (congrArg _ ?_) rfl
+  rw [VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+  rfl
+
+/-- Apply a selected mutual motive variable to its target-family indices and
+a typed major premise. -/
+theorem BlockGenerationChecked.motiveVarApp_hasType
+    {source : VInductDecl} (gen : BlockGenerationChecked source)
+    (family : NormalizedFamily) {env : VEnv} {l : VLevel}
+    {Γ : List VExpr} {K q : Nat} {idxs : List VExpr} {a : VExpr}
+    (hM : env.HasType gen.recUvars Γ (.bvar K)
+      ((gen.motiveType family).liftN (q + K + 1)))
+    (hidx : env.SpineWF gen.recUvars Γ
+      (VExpr.forallN
+        (VExpr.liftTelN (q + K + 1) (gen.idxTel family) 0)
+        (.sort l))
+      idxs (.sort l))
+    (hlen : idxs.length = (gen.idxTel family).length)
+    (ha : env.HasType gen.recUvars Γ a
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (q + K + 1) source.nparams ++ idxs))) :
+    env.HasType gen.recUvars Γ
+      (VExpr.appN (.bvar K) (idxs ++ [a]))
+      (.sort gen.motiveLevel) := by
+  rw [gen.motiveType_liftN family] at hM
+  have hshape := hidx.retarget
+    (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (q + K + 1 + (gen.idxTel family).length)
+            source.nparams ++
+          VExpr.bvarRevRange 0 (gen.idxTel family).length))
+      (.sort gen.motiveLevel))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _
+      (C := .const family.raw.name gen.sourceLevels) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _ (by rw [hlen]; omega),
+    show q + K + 1 + (gen.idxTel family).length - idxs.length =
+      q + K + 1 from by rw [hlen]; omega,
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hApp := hshape.hasType_appN hM
+  rw [VExpr.appN_append]
+  exact HasType.app hApp (by simpa using ha)
+
+/-- A recursive raw field, after inserting the full mutual motive telescope
+and the constructor-local binders, is the family application expected by its
+generated induction hypothesis. -/
+theorem blockMinor_fieldType_of_eq
+    {source : VInductDecl} {familyName : Name}
+    {B : VExpr} {r₀ : RecArg}
+    (hB : B = VExpr.forallN r₀.binders
+      (VExpr.appN (.const familyName (VLevel.params source.uvars))
+        (VExpr.bvarRevRange
+            (r₀.fieldIndex + r₀.binders.length) source.nparams ++
+          r₀.indices)))
+    (d m p : Nat) (hj : r₀.fieldIndex < m)
+    (mode : ElimMode := .large) :
+    let ls := mode.sourceLevels source.uvars
+    let r := r₀.instL ls
+    ((B.instL ls).liftN d r.fieldIndex).liftN
+        (m - r.fieldIndex + p) =
+      VExpr.forallN
+        (BlockGenerationChecked.blockMinorBinders d m p r)
+        (VExpr.appN (.const familyName ls)
+          (VExpr.bvarRevRange
+              (m + p + r.binders.length + d) source.nparams ++
+            r.indices.map fun e =>
+              (e.liftN d (r.fieldIndex + r.binders.length)).liftN
+                (m - r.fieldIndex + p) r.binders.length)) := by
+  dsimp only
+  conv => lhs; rw [hB]
+  simp only [RecArg.instL, VExpr.instL_forallN, VExpr.instL_appN,
+    List.map_append, bvarRevRange_instL,
+    show (VExpr.const familyName (VLevel.params source.uvars)).instL
+        (mode.sourceLevels source.uvars) =
+      .const familyName (mode.sourceLevels source.uvars) from by
+        simp [VExpr.instL, ElimMode.sourceLevels,
+          VLevel.params_map_inst_params'],
+    VExpr.liftN_forallN, VExpr.liftN_appN]
+  simp only [List.length_map, VExpr.liftTelN_length, Nat.zero_add]
+  rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    show m - r₀.fieldIndex + p +
+        (d + (r₀.fieldIndex + r₀.binders.length)) =
+      m + p + r₀.binders.length + d from by omega]
+  simp only [List.map_map,
+    BlockGenerationChecked.blockMinorBinders]
+  apply congrArg (VExpr.forallN _)
+  apply congrArg (VExpr.appN
+    (.const familyName (mode.sourceLevels source.uvars)))
+  apply congrArg
+    (VExpr.bvarRevRange (m + p + r₀.binders.length + d)
+      source.nparams ++ ·)
+  apply List.map_congr_left
+  intro e _
+  simp only [Function.comp_apply]
+
+/-- Raw mixed fields preserve their arity under recursor-universe
+instantiation. -/
+theorem NormalizedCtor.fieldsR_length {source : VInductDecl}
+    (ctor : NormalizedCtor) {mode : ElimMode} :
+    (ctor.fieldsR source.uvars source.nparams mode).length =
+      (ctor.rawFields source.nparams).length :=
+  List.length_map ..
+
+/-- Pointwise lookup through the raw mixed field universe transport. -/
+theorem NormalizedCtor.fieldsR_getElem? {source : VInductDecl}
+    {ctor : NormalizedCtor} {q : Nat} {mode : ElimMode} :
+    (ctor.fieldsR source.uvars source.nparams mode)[q]? =
+      (ctor.rawFields source.nparams)[q]?.map
+        (VExpr.instL (mode.sourceLevels source.uvars)) :=
+  List.getElem?_map ..
+
+/-- Unpack one mixed recursive descriptor to the retained declaration-level
+descriptor from the checked view. -/
+theorem NormalizedCtor.recArgsR_mem {source : VInductDecl}
+    {ctor : NormalizedCtor} {r : RecArg} {mode : ElimMode}
+    (hr : r ∈ ctor.recArgsR source.uvars mode) :
+    ∃ r₀, r₀ ∈ ctor.view.recursive ∧
+      r = r₀.instL (mode.sourceLevels source.uvars) := by
+  obtain ⟨r₀, hr₀, rfl⟩ := List.mem_map.1 hr
+  exact ⟨r₀, hr₀, rfl⟩
+
+theorem liftTelN_congr {a a' : Nat} (tel : List VExpr) (k : Nat)
+    (h : a = a') :
+    VExpr.liftTelN a tel k = VExpr.liftTelN a' tel k := h ▸ rfl
+
+theorem BlockGenerationChecked.blockIHsFromRecArgs_length (d m : Nat) :
+    ∀ (rs : List RecArg) (p : Nat),
+      (BlockGenerationChecked.blockIHsFromRecArgs d m rs p).length = rs.length
+  | [], _ => rfl
+  | _ :: rs, p => by
+    simp [BlockGenerationChecked.blockIHsFromRecArgs,
+      BlockGenerationChecked.blockIHsFromRecArgs_length d m rs (p + 1)]
+
+/-- Rule-context normal form of one mutual induction hypothesis. The
+recursive result is routed to the motive selected by `targetType`. -/
+def BlockGenerationChecked.blockRuleIH
+    (d k m : Nat) (r : RecArg) : VExpr :=
+  let n := r.binders.length
+  VExpr.forallN
+    (BlockGenerationChecked.blockRuleBinders (d+k) m r)
+    (VExpr.appN
+      (.bvar (d - 1 - r.targetType + k + m + n))
+      ((r.indices.map fun e =>
+          (e.liftN (d+k) (r.fieldIndex+n)).liftN
+            (m-r.fieldIndex) n) ++
+        [VExpr.appN (.bvar (m-1-r.fieldIndex+n))
+          (VExpr.bvarRevRange 0 n)]))
+
+/-- Rule-context induction hypotheses, weakened past their preceding
+hypothesis binders. -/
+def BlockGenerationChecked.blockRuleIHs (d k m : Nat) :
+    List RecArg → Nat → List VExpr
+  | [], _ => []
+  | r :: rs, p =>
+    (BlockGenerationChecked.blockRuleIH d k m r).liftN p ::
+      BlockGenerationChecked.blockRuleIHs d k m rs (p+1)
+
+theorem BlockGenerationChecked.blockMinorBinders_shift
+    (d : Nat) (r : RecArg) (m p : Nat) :
+    BlockGenerationChecked.blockMinorBinders d m p r =
+      VExpr.liftTelN p
+        (BlockGenerationChecked.blockMinorBinders d m 0 r) 0 := by
+  simp only [BlockGenerationChecked.blockMinorBinders, Nat.add_zero]
+  rw [VExpr.liftTelN_liftTelN]
+
+/-- The shift parameter of a mutual minor IH is precisely weakening past
+the preceding IH binders. -/
+theorem BlockGenerationChecked.blockMinorIH_shift
+    (d : Nat) (r : RecArg) (m p : Nat) (hj : r.fieldIndex < m) :
+    BlockGenerationChecked.blockMinorIH d m p r =
+      (BlockGenerationChecked.blockMinorIH d m 0 r).liftN p := by
+  simp only [BlockGenerationChecked.blockMinorIH,
+    VExpr.liftN_forallN]
+  rw [← BlockGenerationChecked.blockMinorBinders_shift d r m p]
+  rw [show
+      (BlockGenerationChecked.blockMinorBinders d m 0 r).length =
+        r.binders.length by
+      simp [BlockGenerationChecked.blockMinorBinders,
+        VExpr.liftTelN_length],
+    Nat.zero_add]
+  apply congrArg (VExpr.forallN _)
+  rw [VExpr.liftN_appN, List.map_append, List.map_map]
+  show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+  congr 1
+  · rw [show
+      (VExpr.bvar
+        (d - 1 - r.targetType + m + 0 + r.binders.length)).liftN
+          p r.binders.length =
+        .bvar (d - 1 - r.targetType + m + p + r.binders.length) from by
+      simp only [VExpr.liftN]
+      rw [liftVar_le (by omega)]
+      congr 1
+      ac_rfl]
+  · congr 1
+    · apply List.map_congr_left
+      intro e _
+      simp only [Function.comp_apply, Nat.add_zero]
+      rw [VExpr.liftN'_liftN_hi]
+    · congr 1
+      simp only [Nat.add_zero, VExpr.liftN_appN]
+      rw [show
+          (VExpr.bvar
+            (m - 1 - r.fieldIndex + r.binders.length)).liftN
+              p r.binders.length =
+            .bvar (m - 1 - r.fieldIndex + p + r.binders.length) from by
+          simp only [VExpr.liftN]
+          rw [liftVar_le (by omega)]
+          congr 1
+          omega,
+        VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+
+/-- Lifting a base mutual minor IH through all constructor minors yields the
+rule-context normal form. -/
+theorem BlockGenerationChecked.blockMinorIH_zero_lift_ruleIH
+    (d : Nat) (r : RecArg) (m k : Nat) (hj : r.fieldIndex < m) :
+    (BlockGenerationChecked.blockMinorIH d m 0 r).liftN k m =
+      BlockGenerationChecked.blockRuleIH d k m r := by
+  simp only [BlockGenerationChecked.blockMinorIH,
+    BlockGenerationChecked.blockRuleIH,
+    BlockGenerationChecked.blockMinorBinders,
+    BlockGenerationChecked.blockRuleBinders,
+    VExpr.liftN_forallN, VExpr.liftTelN_length, Nat.add_zero]
+  congr 1
+  · rw [show m = r.fieldIndex + (m-r.fieldIndex) by omega]
+    rw [show r.fieldIndex + (m-r.fieldIndex) - r.fieldIndex =
+      m-r.fieldIndex by omega]
+    rw [VExpr.liftTelN_liftN_midN r.binders d k
+      (m-r.fieldIndex) (Nat.zero_le _)]
+  · congr 1
+    rw [VExpr.liftN_appN, List.map_append, List.map_map]
+    show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+    congr 1
+    · simp only [VExpr.liftN]
+      rw [liftVar_le (by omega)]
+      congr 1
+      ac_rfl
+    · congr 1
+      · apply List.map_congr_left
+        intro e _
+        simp only [Function.comp_apply]
+        rw [show m + r.binders.length =
+            (r.fieldIndex+r.binders.length) + (m-r.fieldIndex) by omega,
+          VExpr.liftN_liftN_midN e d k (m-r.fieldIndex) (by omega)]
+      · congr 1
+        simp only [VExpr.liftN_appN]
+        rw [show
+            (VExpr.bvar
+              (m - 1 - r.fieldIndex + r.binders.length)).liftN
+                k (m+r.binders.length) =
+              .bvar (m - 1 - r.fieldIndex + r.binders.length) from by
+            simp only [VExpr.liftN]
+            rw [liftVar_lt (by omega)],
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+
+/-- General mutual minor-IH normalization after `p` earlier hypotheses. -/
+theorem BlockGenerationChecked.blockMinorIH_lift_ruleIH
+    (d : Nat) (r : RecArg) (m k p : Nat)
+    (hj : r.fieldIndex < m) :
+    (BlockGenerationChecked.blockMinorIH d m p r).liftN k (m+p) =
+      (BlockGenerationChecked.blockRuleIH d k m r).liftN p := by
+  rw [BlockGenerationChecked.blockMinorIH_shift d r m p hj]
+  rw [← VExpr.liftN_liftN_comm
+    (BlockGenerationChecked.blockMinorIH d m 0 r)
+    p k 0 m (Nat.zero_le _)]
+  rw [BlockGenerationChecked.blockMinorIH_zero_lift_ruleIH d r m k hj]
+
+theorem BlockGenerationChecked.blockRuleIHs_length (d k m : Nat) :
+    ∀ (rs : List RecArg) (p : Nat),
+      (BlockGenerationChecked.blockRuleIHs d k m rs p).length = rs.length
+  | [], _ => rfl
+  | _ :: rs, p => by
+    simp [BlockGenerationChecked.blockRuleIHs,
+      BlockGenerationChecked.blockRuleIHs_length d k m rs (p+1)]
+
+/-- Lift the complete mutual minor-IH telescope into rule context. -/
+theorem BlockGenerationChecked.blockIHs_liftN (d m k : Nat) :
+    ∀ (rs : List RecArg),
+    (∀ r ∈ rs, r.fieldIndex < m) → ∀ (p : Nat) (X : VExpr),
+    (VExpr.forallN
+      (BlockGenerationChecked.blockIHsFromRecArgs d m rs p) X).liftN
+        k (m+p) =
+      VExpr.forallN
+        (BlockGenerationChecked.blockRuleIHs d k m rs p)
+        (X.liftN k (m+p+rs.length))
+  | [], _, _, _ => rfl
+  | r :: rs, hm, p, X => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · exact BlockGenerationChecked.blockMinorIH_lift_ruleIH
+        d r m k p (hm r (.head _))
+    · rw [show m+p+1 = m+(p+1) by omega,
+        BlockGenerationChecked.blockIHs_liftN d m k rs
+          (fun q hq => hm q (.tail _ hq)) (p+1) X,
+        show m+(p+1)+rs.length =
+          m+p+(r :: rs).length from by simp; omega]
+
+theorem BlockGenerationChecked.blockIHs_liftN'
+    (d m k : Nat) (rs : List RecArg)
+    (hm : ∀ r ∈ rs, r.fieldIndex < m)
+    (p : Nat) (X : VExpr) {cut : Nat} (hcut : cut = m+p) :
+    (VExpr.forallN
+      (BlockGenerationChecked.blockIHsFromRecArgs d m rs p) X).liftN
+        k cut =
+      VExpr.forallN
+        (BlockGenerationChecked.blockRuleIHs d k m rs p)
+        (X.liftN k (m+p+rs.length)) := by
+  rw [hcut]
+  exact BlockGenerationChecked.blockIHs_liftN d m k rs hm p X
+
+theorem BlockGenerationChecked.blockRuleIHs_liftN1 (d k m : Nat) :
+    ∀ (rs : List RecArg) (p c : Nat), c ≤ p → ∀ (X : VExpr),
+    VExpr.forallN
+      (BlockGenerationChecked.blockRuleIHs d k m rs (p+1))
+      (X.liftN 1 (c+rs.length)) =
+      (VExpr.forallN
+        (BlockGenerationChecked.blockRuleIHs d k m rs p) X).liftN 1 c
+  | [], p, c, _, X => by
+    simp [BlockGenerationChecked.blockRuleIHs, VExpr.forallN]
+  | r :: rs, p, c, hc, X => by
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN'_liftN' (Nat.zero_le _) hc]
+    · rw [show c+(r :: rs).length = (c+1)+rs.length from by
+          simp
+          omega]
+      exact BlockGenerationChecked.blockRuleIHs_liftN1
+        d k m rs (p+1) (c+1) (by omega) X
+
+/-- Consume one routed recursive-call term for every mutual rule IH. -/
+theorem hasType_appN_blockRuleIHs
+    {source : VInductDecl} {gen : BlockGenerationChecked source}
+    {env : VEnv} {Γ : List VExpr} {d m k : Nat}
+    {argOf : RecArg → VExpr} {Dfin : VExpr} :
+    ∀ {rs : List RecArg} {g : VExpr},
+    (∀ r ∈ rs, env.HasType gen.recUvars Γ (argOf r)
+      (BlockGenerationChecked.blockRuleIH d k m r)) →
+    env.HasType gen.recUvars Γ g
+      (VExpr.forallN
+        (BlockGenerationChecked.blockRuleIHs d k m rs 0)
+        (Dfin.liftN rs.length)) →
+    env.HasType gen.recUvars Γ (g.appN (rs.map argOf)) Dfin
+  | [], g, _, hg => by
+    simpa [BlockGenerationChecked.blockRuleIHs] using hg
+  | r :: rs, g, hargs, hg => by
+    have happ := VEnv.HasType.app hg (by
+      simpa [BlockGenerationChecked.blockRuleIHs] using
+        hargs r (.head _))
+    simp only [List.length_cons] at happ
+    rw [show Dfin.liftN (rs.length+1) =
+        (Dfin.liftN rs.length).liftN 1 (0+rs.length) from by
+          rw [Nat.zero_add,
+            VExpr.liftN'_liftN' (Nat.zero_le _) (by omega)],
+      BlockGenerationChecked.blockRuleIHs_liftN1
+        d k m rs 0 0 (Nat.le_refl _) (Dfin.liftN rs.length),
+      VExpr.inst_liftN1] at happ
+    exact hasType_appN_blockRuleIHs
+      (rs := rs) (fun q hq => hargs q (.tail _ hq)) happ
+
+theorem BlockGenerationChecked.minorTypesAux_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    ∀ (constructors : List NormalizedBlockCtor) (i : Nat),
+      (gen.minorTypesAux constructors i).length = constructors.length
+  | [], _ => rfl
+  | _ :: constructors, i => by
+    simp [BlockGenerationChecked.minorTypesAux,
+      gen.minorTypesAux_length constructors (i + 1)]
+
+theorem BlockGenerationChecked.minorTypes_length
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    gen.minorTypes.length = gen.minorCount := by
+  simpa [BlockGenerationChecked.minorTypes] using
+    gen.minorTypesAux_length gen.flatCtors 0
+
+/-- Positional lookup through the progressively weakened flattened mutual
+minor telescope. -/
+theorem BlockGenerationChecked.minorTypesAux_getElem?
+    {source : VInductDecl} (gen : BlockGenerationChecked source) :
+    ∀ (constructors : List NormalizedBlockCtor) (i q : Nat),
+      (gen.minorTypesAux constructors i)[q]? =
+        constructors[q]?.map fun constructor =>
+          (gen.minorType constructor).liftN (i+q)
+  | [], _, q => by simp [BlockGenerationChecked.minorTypesAux]
+  | _ :: _, _, 0 => by simp [BlockGenerationChecked.minorTypesAux]
+  | _ :: constructors, i, q+1 => by
+    simp only [BlockGenerationChecked.minorTypesAux,
+      List.getElem?_cons_succ]
+    rw [gen.minorTypesAux_getElem? constructors (i+1) q,
+      show i+1+q = i+(q+1) by omega]
+
+namespace BlockGenerationEnv
+
+variable {source : VInductDecl} {gen : BlockGenerationChecked source}
+  {env : VEnv} (S : BlockGenerationEnv gen env)
+include S
+
+theorem paramsTel_onTel :
+    env.OnTel gen.recUvars [] gen.paramsTel := by
+  have h := S.generationParams_defeq.raw_onTel.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simpa [BlockGenerationChecked.paramsTel] using h
+
+theorem motiveTypesAux_onTel
+    (families : List NormalizedFamily)
+    (hsub : ∀ family ∈ families, family ∈ gen.families)
+    (Δ : List VExpr) (i : Nat) (hΔ : Δ.length = i) :
+    env.OnTel gen.recUvars (Δ ++ gen.paramsTel.reverse)
+      (gen.motiveTypesAux families i) := by
+  induction families generalizing Δ i with
+  | nil => trivial
+  | cons family families ih =>
+    exact ⟨by
+      rw [← hΔ]
+      exact (S.motive_isType (hsub family (.head _))).weakN S.ord
+        (.zero Δ),
+    ih (fun family hfamily => hsub family (.tail _ hfamily))
+      (_ :: Δ) (i + 1) (by simp [hΔ])⟩
+
+theorem motiveTypes_onTel :
+    env.OnTel gen.recUvars gen.paramsTel.reverse gen.motiveTypes := by
+  simpa [BlockGenerationChecked.motiveTypes] using
+    motiveTypesAux_onTel S gen.families (fun _ h => h) [] 0 rfl
+
+/-- Constructor fields instantiated for recursor generation are well typed
+over the generation parameter telescope. -/
+theorem generationFields_onTel_rec
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    env.OnTel gen.recUvars gen.paramsTel.reverse
+      (constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination) := by
+  have hemitted := (S.ctorWF constructor hconstructor).rawEmitted_onTel
+  have hfields₀ := (VEnv.OnTel.of_append
+    (As := gen.block.checked.params) hemitted).2
+  have hfields₁ := hfields₀.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hfieldsChecked : env.OnTel gen.recUvars
+      (gen.block.checked.params.map
+        (VExpr.instL gen.sourceLevels)).reverse
+      (constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination) := by
+    simpa [NormalizedCtor.fieldsR, List.map_reverse] using hfields₁
+  exact hfieldsChecked.defeqDFC S.ord
+    (S.generationParams_ctx_rec.symm S.ord)
+
+/-- The checked and generation parameter contexts stay definitionally equal
+beneath every instantiated constructor-field prefix. -/
+theorem generationFieldPrefix_ctx_rec
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) (j : Nat) :
+    env.IsDefEqCtx gen.recUvars []
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination |>.take j).reverse ++ gen.paramsTel.reverse)
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination |>.take j).reverse ++
+        (gen.block.checked.params.map
+          (VExpr.instL gen.sourceLevels)).reverse) := by
+  have hfields := S.generationFields_onTel_rec hconstructor
+  rw [← List.take_append_drop j
+    (constructor.ctor.fieldsR source.uvars source.nparams
+      gen.elimination)] at hfields
+  exact (hfields.of_append.1).extendDefEqCtx
+    S.generationParams_ctx_rec
+
+/-- Definitionally equal raw/view contexts at any mutual constructor-field
+prefix. -/
+theorem emittedPrefix_ctx {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) (j : Nat) :
+    env.IsDefEqCtx source.uvars []
+      ((constructor.ctor.rawFields source.nparams |>.take j).reverse ++
+        gen.block.checked.params.reverse)
+      ((constructor.ctor.view.fields.take j).reverse ++
+        gen.block.checked.params.reverse) := by
+  have h := ((S.ctorWF constructor hconstructor).emittedTel.take
+    (source.nparams + j)).ctx
+  have hviewLen :
+      gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hraw :
+      (gen.block.checked.params ++
+        constructor.ctor.rawFields source.nparams).take
+          (source.nparams + j) =
+        gen.block.checked.params ++
+          (constructor.ctor.rawFields source.nparams).take j := by
+    rw [← hviewLen]
+    rw [List.take_append, List.take_of_length_le (by omega)]
+    simp
+  have hview :
+      (gen.block.checked.params ++ constructor.ctor.view.fields).take
+          (source.nparams + j) =
+        gen.block.checked.params ++
+          constructor.ctor.view.fields.take j := by
+    rw [← hviewLen]
+    rw [List.take_append, List.take_of_length_le (by omega)]
+    simp
+  simp only [NormalizedBlockCtor.emittedBinders,
+    NormalizedBlockCtor.viewBinders] at h
+  rw [hraw, hview] at h
+  simpa [List.reverse_append] using h
+
+/-- Pointwise raw/view field-domain equality for a mutual constructor, in
+the preceding raw context. -/
+theorem emittedField_defeq {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    {j : Nat} {B B' : VExpr}
+    (hB : (constructor.ctor.rawFields source.nparams)[j]? = some B)
+    (hB' : constructor.ctor.view.fields[j]? = some B') :
+    ∃ u, env.IsDefEq source.uvars
+      ((constructor.ctor.rawFields source.nparams |>.take j).reverse ++
+        gen.block.checked.params.reverse)
+      B B' (.sort u) := by
+  have hviewLen :
+      gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hraw :
+      getElem?
+        (gen.block.checked.params ++
+          constructor.ctor.rawFields source.nparams)
+        (source.nparams + j) = some B := by
+    rw [List.getElem?_append_right (by rw [hviewLen]; omega), hviewLen]
+    simpa using hB
+  have hview :
+      getElem?
+        (gen.block.checked.params ++ constructor.ctor.view.fields)
+        (source.nparams + j) = some B' := by
+    rw [List.getElem?_append_right (by rw [hviewLen]; omega), hviewLen]
+    simpa using hB'
+  obtain ⟨u, h⟩ :=
+    (S.ctorWF constructor hconstructor).emittedTel.getElem? hraw hview
+  have htake :
+      (gen.block.checked.params ++
+        constructor.ctor.rawFields source.nparams).take
+          (source.nparams + j) =
+        gen.block.checked.params ++
+          (constructor.ctor.rawFields source.nparams).take j := by
+    rw [← hviewLen]
+    rw [List.take_append, List.take_of_length_le (by omega)]
+    simp
+  simp only [NormalizedBlockCtor.emittedBinders] at h
+  rw [htake, List.reverse_append] at h
+  exact ⟨u, by simpa using h⟩
+
+/-- The generated and checked index telescopes of every family are
+definitionally equal after universe instantiation. -/
+theorem familyIndexTel_defeq_rec {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.TelDefEq gen.recUvars gen.paramsTel.reverse
+      (gen.idxTel family)
+      (family.view.indices.map (VExpr.instL gen.sourceLevels)) := by
+  have h := (S.familyWF family hfamily).familyTel.drop source.nparams
+  have hrawTake :
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams).take source.nparams =
+        family.rawParams source.nparams := by
+    let Ps := family.rawParams source.nparams
+    let Is := family.rawIndices source.nparams
+    have hlen : Ps.length = source.nparams :=
+      (gen.shape.2.2.2.2 family hfamily).2.2.1
+    change (Ps ++ Is).take source.nparams = Ps
+    rw [← hlen, List.take_append, List.take_length]
+    simp
+  have hrawDrop :
+      (family.rawParams source.nparams ++
+        family.rawIndices source.nparams).drop source.nparams =
+        family.rawIndices source.nparams := by
+    let Ps := family.rawParams source.nparams
+    let Is := family.rawIndices source.nparams
+    have hlen : Ps.length = source.nparams :=
+      (gen.shape.2.2.2.2 family hfamily).2.2.1
+    change (Ps ++ Is).drop source.nparams = Is
+    rw [← hlen, List.drop_append]
+    simp
+  have hviewLen : gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hviewDrop :
+      (gen.block.checked.params ++ family.view.indices).drop
+          source.nparams = family.view.indices := by
+    rw [← hviewLen, List.drop_append]
+    simp
+  rw [hrawTake, hrawDrop, hviewDrop] at h
+  simp only [List.append_nil] at h
+  have hparams : env.IsDefEqCtx source.uvars []
+      (family.rawParams source.nparams).reverse
+      gen.block.checked.params.reverse := by
+    simpa using (S.rawParams_defeq hfamily).ctx
+  have hemitted := h.defeqDFC S.ord hparams
+  have hgeneration := hemitted.defeqDFC S.ord
+    (S.generationParams_ctx.symm S.ord)
+  have hrec := hgeneration.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simpa [BlockGenerationChecked.paramsTel,
+    BlockGenerationChecked.idxTel, List.map_reverse] using hrec
+
+/-- Transport the analyzer's recursive-argument certificate from checked
+source syntax to the generated field and target-family index telescopes, then
+weaken it beneath arbitrary motive/local prefixes. -/
+theorem recArg_transport
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    {r₀ : RecArg} {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families)
+    (hsem : r₀.WF source.uvars env gen.validated.resultLevel
+      family.view.indices
+      ((constructor.ctor.view.fields.take r₀.fieldIndex).reverse ++
+        gen.block.checked.params.reverse))
+    (hjlt : r₀.fieldIndex < constructor.ctor.view.fields.length)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    let r := r₀.instL gen.sourceLevels
+    let As := VExpr.liftTelN d
+      (VExpr.liftTelN g r.binders r.fieldIndex) 0
+    env.OnTel gen.recUvars
+        (As₂ ++ ((VExpr.liftTelN g
+          ((constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination).take r.fieldIndex) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse))) As ∧
+      env.SpineWF gen.recUvars
+        (As.reverse ++
+          (As₂ ++ ((VExpr.liftTelN g
+            ((constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).take r.fieldIndex) 0).reverse ++
+            (mid ++ gen.paramsTel.reverse))))
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (r.fieldIndex + r.binders.length + g + d)
+            (gen.idxTel family) 0)
+          (.sort (gen.validated.resultLevel.inst gen.sourceLevels)))
+        (r.indices.map fun e =>
+          (e.liftN g (r.fieldIndex + r.binders.length)).liftN d
+            r.binders.length)
+        (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+  dsimp only
+  let ls := gen.sourceLevels
+  have hjraw :
+      r₀.fieldIndex <
+        (constructor.ctor.rawFields source.nparams).length := by
+    rw [gen.flatCtor_fields_length hconstructor]
+    exact hjlt
+  have hraw := hsem.defeqDFC S.ord
+    ((S.emittedPrefix_ctx hconstructor r₀.fieldIndex).symm S.ord)
+  have htel₁ := hraw.1.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hsp₁ := hraw.2.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have htelChecked : env.OnTel gen.recUvars
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination |>.take r₀.fieldIndex).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (r₀.binders.map (VExpr.instL ls)) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse, List.map_take] using htel₁
+  have hspChecked : env.SpineWF gen.recUvars
+      ((r₀.binders.map (VExpr.instL ls)).reverse ++
+        ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination |>.take r₀.fieldIndex).reverse ++
+          (gen.block.checked.params.map (VExpr.instL ls)).reverse))
+      (VExpr.instL ls
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (r₀.fieldIndex + r₀.binders.length)
+            family.view.indices 0)
+          (.sort gen.validated.resultLevel)))
+      (r₀.indices.map (VExpr.instL ls))
+      (VExpr.instL ls (.sort gen.validated.resultLevel)) := by
+    simpa [List.map_append, List.map_reverse,
+      NormalizedCtor.fieldsR, List.map_take] using hsp₁
+  have hprefix :=
+    S.generationFieldPrefix_ctx_rec hconstructor r₀.fieldIndex
+  have htelGeneration := htelChecked.defeqDFC S.ord
+    (hprefix.symm S.ord)
+  have hfull := htelGeneration.extendDefEqCtx hprefix
+  have hspGeneration := hspChecked.defeqDFC S.ord (hfull.symm S.ord)
+  simp only [VExpr.instL_forallN,
+    VExpr.liftTelN_instL] at htelGeneration hspGeneration
+  have hjlen :
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination).take r₀.fieldIndex).length = r₀.fieldIndex := by
+    simp only [NormalizedCtor.fieldsR, List.length_take,
+      List.length_map]
+    omega
+  have hidxField := (S.familyIndexTel_defeq_rec hfamily).weakN S.ord
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse)
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination).take r₀.fieldIndex).reverse)
+  rw [List.length_reverse, hjlen] at hidxField
+  have hidxPrivate := hidxField.weakN S.ord
+    (Ctx.LiftN.zero
+      (Γ := ((constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination).take r₀.fieldIndex).reverse ++
+        gen.paramsTel.reverse)
+      (r₀.binders.map (VExpr.instL ls)).reverse)
+  simp only [List.length_reverse, List.length_map] at hidxPrivate
+  rw [VExpr.liftTelN_liftTelN,
+    VExpr.liftTelN_liftTelN] at hidxPrivate
+  have hidxLenView := hsem.2.forallN_sort_length
+  simp only [VExpr.liftTelN_length] at hidxLenView
+  have hidxLen :
+      (r₀.indices.map (VExpr.instL ls)).length =
+        (VExpr.liftTelN
+          (r₀.fieldIndex + r₀.binders.length)
+          (gen.idxTel family) 0).length := by
+    simp only [List.length_map, VExpr.liftTelN_length,
+      BlockGenerationChecked.idxTel]
+    exact hidxLenView.trans
+      (gen.shape.2.2.2.2 family hfamily).2.2.2.1.symm
+  have hspRaw :=
+    hidxPrivate.spine_sort S.ord hspGeneration hidxLen
+  have W₁ := Ctx.LiftN.consTel (n := mid.length)
+    ((constructor.ctor.fieldsR source.uvars source.nparams
+      gen.elimination).take r₀.fieldIndex)
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [hjlen, Nat.add_zero] at W₁
+  have htel₂ := htelGeneration.weakN S.ord W₁
+  have hsp₂ := hspRaw.weakN S.ord
+    (Ctx.LiftN.consTel
+      (r₀.binders.map (VExpr.instL ls)) W₁)
+  rw [hg] at htel₂ hsp₂
+  have W₂ := Ctx.LiftN.zero
+    (Γ := (VExpr.liftTelN g
+        ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).take r₀.fieldIndex) 0).reverse ++
+      (mid ++ gen.paramsTel.reverse)) As₂ (h := hd)
+  have htel₃ := htel₂.weakN S.ord W₂
+  have hsp₃ := hsp₂.weakN S.ord
+    (Ctx.LiftN.consTel
+      (VExpr.liftTelN g
+        (r₀.binders.map (VExpr.instL ls)) r₀.fieldIndex) W₂)
+  refine ⟨?_, ?_⟩
+  · simpa [ls, RecArg.instL, List.append_assoc] using htel₃
+  · simp only [List.length_map, VExpr.liftTelN_length,
+      Nat.add_zero] at hsp₃
+    rw [VExpr.liftN_forallN, VExpr.liftN_forallN,
+      VExpr.liftTelN_liftTelN_hi'
+        (r₀.fieldIndex + r₀.binders.length) g _ 0 (by omega),
+      VExpr.liftTelN_liftTelN_mid
+        (r₀.fieldIndex + r₀.binders.length + g) d _ 0
+        r₀.binders.length (Nat.zero_le _) (by omega)] at hsp₃
+    rw [show r₀.binders.length + r₀.fieldIndex =
+      r₀.fieldIndex + r₀.binders.length from Nat.add_comm _ _] at hsp₃
+    simpa [ls, RecArg.instL, VExpr.instL, VExpr.liftN,
+      List.map_map, Function.comp_def, List.append_assoc] using hsp₃
+
+theorem recArgMinor_isType {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) {r : RecArg}
+    (hrmem : r ∈ constructor.ctor.recArgsR source.uvars gen.elimination)
+    (Δ : List VExpr) (p : Nat) (hΔ : Δ.length = p) :
+    env.IsType gen.recUvars
+      (Δ ++
+        (VExpr.liftTelN gen.familyCount
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+      (BlockGenerationChecked.blockMinorIH gen.familyCount
+        (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).length p r) := by
+  obtain ⟨r₀, hr₀, rfl⟩ :=
+    NormalizedCtor.recArgsR_mem hrmem
+  obtain ⟨family, hfamily, hord, ⟨Bview, hBview, hshape⟩, hsem⟩ :=
+    (S.ctorWF constructor hconstructor).recursive r₀ hr₀
+  let ls := gen.sourceLevels
+  let r := r₀.instL ls
+  let d := gen.familyCount
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams
+    gen.elimination
+  let m := Bs.length
+  let j := r₀.fieldIndex
+  let Fs := VExpr.liftTelN d Bs 0
+  let As := BlockGenerationChecked.blockMinorBinders d m p r
+  let idxs := r.indices.map fun e =>
+    (e.liftN d (r.fieldIndex + r.binders.length)).liftN
+      (m - r.fieldIndex + p) r.binders.length
+  let Γ := Δ ++ Fs.reverse ++
+    (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+  let q := family.view.ordinal
+  let K := d - 1 - r.targetType + m + p + r.binders.length
+  have hjview : r₀.fieldIndex < constructor.ctor.view.fields.length :=
+    (List.getElem?_eq_some_iff.1 hBview).1
+  have hjm : j < m := by
+    have hfields := gen.flatCtor_fields_length hconstructor
+    simp only [j, m, Bs, NormalizedCtor.fieldsR_length]
+    omega
+  have hjraw :
+      r₀.fieldIndex <
+        (constructor.ctor.rawFields source.nparams).length := by
+    simpa [j, m, Bs, NormalizedCtor.fieldsR_length] using hjm
+  let Braw :=
+    (constructor.ctor.rawFields source.nparams)[r₀.fieldIndex]
+  have hBraw :
+      (constructor.ctor.rawFields source.nparams)[r₀.fieldIndex]? =
+        some Braw :=
+    List.getElem?_eq_getElem hjraw
+  have hd : gen.motiveTypes.reverse.length = d := by
+    simp [d, gen.motiveTypes_length]
+  have hd' : gen.motiveTypes.length = d := by
+    simpa using hd
+  have hFsLen : Fs.length = m := by
+    simp [Fs, m, VExpr.liftTelN_length]
+  have hstackLen :
+      (Δ ++ (Fs.drop j).reverse).length = m - j + p := by
+    simp only [List.length_append, List.length_reverse,
+      List.length_drop, hFsLen, hΔ]
+    omega
+  have ht := S.recArg_transport hconstructor hfamily hsem hjview
+    gen.motiveTypes.reverse hd
+    (Δ ++ (Fs.drop j).reverse) hstackLen
+  simp only [RecArg.instL] at ht
+  have hctx :
+      (Δ ++ (Fs.drop j).reverse) ++
+          ((VExpr.liftTelN d (Bs.take j) 0).reverse ++
+            (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)) = Γ := by
+    dsimp only [Γ, Fs]
+    rw [← VExpr.liftTelN_take, List.append_assoc,
+      ← List.append_assoc
+        ((VExpr.liftTelN d Bs 0).drop j).reverse,
+      ← List.reverse_append, List.take_append_drop,
+      ← List.append_assoc]
+  dsimp only [j] at ht hctx
+  have htel : env.OnTel gen.recUvars Γ As := by
+    rw [hctx] at ht
+    simpa [r, As, m, j, Bs, RecArg.instL,
+      BlockGenerationChecked.blockMinorBinders] using ht.1
+  have hsp : env.SpineWF gen.recUvars
+      (As.reverse ++ Γ)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (m + p + r.binders.length + d) (gen.idxTel family) 0)
+        (.sort (gen.validated.resultLevel.inst ls)))
+      idxs
+      (.sort (gen.validated.resultLevel.inst ls)) := by
+    rw [hctx] at ht
+    simpa [r, As, idxs, m, j, Bs, d, ls, RecArg.instL,
+      BlockGenerationChecked.blockMinorBinders,
+      List.append_assoc,
+      show j + r₀.binders.length + d + (m - j + p) =
+        m + p + r₀.binders.length + d from by omega] using ht.2
+  have hF : Γ[m - 1 - j + p]? =
+      some ((Braw.instL ls).liftN d j) := by
+    dsimp only [Γ, Fs]
+    rw [getElem?_stack_mid Δ
+        (VExpr.liftTelN d Bs 0).reverse
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+        (i := m - 1 - j + p) (by rw [hΔ]; omega)
+        (by simp only [hΔ, List.length_reverse,
+          VExpr.liftTelN_length]; omega),
+      show m - 1 - j + p - Δ.length = m - 1 - j from by
+        rw [hΔ]
+        omega,
+      List.getElem?_reverse (by rw [hFsLen]; omega),
+      VExpr.liftTelN_length,
+      show m - 1 - (m - 1 - j) = j from by omega,
+      VExpr.liftTelN_getElem?,
+      NormalizedCtor.fieldsR_getElem?, hBraw]
+    simp [ls]
+  have hlu := Lookup.of_getElem? hF
+  rw [show m - 1 - j + p + 1 = m - j + p from by omega] at hlu
+  dsimp only [j, r] at hlu
+  have hf0 := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars) hlu
+  obtain ⟨u, hdom₀⟩ :=
+    S.emittedField_defeq hconstructor hBraw hBview
+  have hdom₁ := hdom₀.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hdomChecked : env.IsDefEq gen.recUvars
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination |>.take r₀.fieldIndex).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (Braw.instL ls) (Bview.instL ls) ((VExpr.sort u).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse, List.map_take] using hdom₁
+  have hprefix :=
+    S.generationFieldPrefix_ctx_rec hconstructor r₀.fieldIndex
+  have hdomGeneration := hdomChecked.defeqDFC S.ord
+    (hprefix.symm S.ord)
+  have hjlen : (Bs.take r₀.fieldIndex).length =
+      r₀.fieldIndex := by
+    simp only [Bs, NormalizedCtor.fieldsR,
+      List.length_take, List.length_map]
+    omega
+  have Wmid := Ctx.LiftN.consTel (n := d)
+    (Bs.take r₀.fieldIndex)
+    (Ctx.LiftN.zero (n := d) (Γ := gen.paramsTel.reverse)
+      gen.motiveTypes.reverse (h := hd))
+  rw [hjlen, Nat.add_zero] at Wmid
+  have hdom₂ := hdomGeneration.weakN S.ord Wmid
+  have Wstack := Ctx.LiftN.zero
+    (Γ := (VExpr.liftTelN d (Bs.take j) 0).reverse ++
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+    (Δ ++ (Fs.drop j).reverse) (h := hstackLen)
+  have hdom₃ := hdom₂.weakN S.ord Wstack
+  rw [hctx] at hdom₃
+  have hfView := hdom₃.defeq hf0
+  have hfield := blockMinor_fieldType_of_eq hshape d m p
+    (by simpa [j] using hjm) gen.elimination
+  simp only [RecArg.instL] at hfield
+  rw [hfield] at hfView
+  have hf := hfView.weakN S.ord
+    (Ctx.LiftN.zero (Γ := Γ) As.reverse)
+  have hmajor := VEnv.HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars)
+    (As := As)
+    (B := VExpr.appN
+      (.const family.raw.name ls)
+      (VExpr.bvarRevRange
+        (m + p + r.binders.length + d) source.nparams ++ idxs))
+    (Δ := []) (Γ := Γ) (by
+      simpa [As, r, idxs, j, d, ls, RecArg.instL,
+        List.length_reverse, List.map_map,
+        Function.comp_def] using hf)
+  simp only [List.length_nil, VExpr.liftN_zero,
+    List.nil_append] at hmajor
+  have hAsLen : As.length = r.binders.length := by
+    simp [As, BlockGenerationChecked.blockMinorBinders,
+      VExpr.liftTelN_length]
+  have hmajor' : env.HasType gen.recUvars (As.reverse ++ Γ)
+      ((VExpr.bvar (m - 1 - r.fieldIndex + p + As.length)).appN
+        (VExpr.bvarRevRange 0 As.length))
+      (VExpr.appN
+        (.const family.raw.name ls)
+        (VExpr.bvarRevRange
+          (m + p + r.binders.length + d) source.nparams ++ idxs)) := by
+    simpa [As, d, r, RecArg.instL,
+      BlockGenerationChecked.blockMinorBinders,
+      VExpr.liftN, liftVar_le, Nat.add_comm] using hmajor
+  rw [hAsLen] at hmajor'
+  have hq : q < d := by
+    simpa [q, d] using gen.family_ordinal_lt hfamily
+  have hmot : gen.motiveTypes.reverse[d - 1 - q]? =
+      some ((gen.motiveType family).liftN q) := by
+    rw [List.getElem?_reverse (by rw [hd']; omega),
+      show gen.motiveTypes.length - 1 - (d - 1 - q) = q from by
+        rw [hd']
+        omega,
+      gen.motiveTypes_getElem?_ordinal hfamily]
+  have hM0 := getElem?_rstack_mid
+    (As.reverse ++ (Δ ++ Fs.reverse))
+    gen.motiveTypes.reverse gen.paramsTel.reverse
+    (i := K)
+    (by
+      simp only [List.length_append, List.length_reverse,
+        hAsLen, hΔ, hFsLen]
+      dsimp only [K, q, d, r]
+      simp only [RecArg.instL]
+      omega)
+    (by
+      simp only [List.length_append, List.length_reverse,
+        hAsLen, hΔ, hFsLen, hd]
+      dsimp only [K, q, d, r]
+      simp only [RecArg.instL]
+      omega)
+  have hdiff :
+      K - (As.reverse ++ (Δ ++ Fs.reverse)).length = d - 1 - q := by
+    simp only [List.length_append, List.length_reverse,
+      hAsLen, hΔ, hFsLen]
+    dsimp only [K, q, d, r]
+    simp only [RecArg.instL]
+    omega
+  rw [hdiff, hmot] at hM0
+  have hMget : (As.reverse ++ Γ)[K]? =
+      some ((gen.motiveType family).liftN q) := by
+    simpa [Γ, List.append_assoc] using hM0
+  have hMraw := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars)
+    (Lookup.of_getElem? hMget)
+  have hM : env.HasType gen.recUvars (As.reverse ++ Γ) (.bvar K)
+      ((gen.motiveType family).liftN (q + K + 1)) := by
+    simpa [VExpr.liftN_liftN, Nat.add_assoc] using hMraw
+  have hlen : idxs.length = (gen.idxTel family).length := by
+    simp only [idxs, List.length_map,
+      BlockGenerationChecked.idxTel]
+    have hidx := hsem.2.forallN_sort_length
+    simp only [VExpr.liftTelN_length] at hidx
+    simpa [r, RecArg.instL] using hidx.trans
+      (gen.shape.2.2.2.2 family hfamily).2.2.2.1.symm
+  have hshift : q + K + 1 = m + p + r.binders.length + d := by
+    dsimp only [q, K, d, r]
+    simp only [RecArg.instL]
+    omega
+  have hbody := gen.motiveVarApp_hasType family
+    (q := q) (K := K)
+    hM (by simpa [hshift] using hsp) hlen
+      (by simpa [hshift] using hmajor')
+  refine VEnv.IsType.forallN htel ⟨gen.motiveLevel, ?_⟩
+  simpa [BlockGenerationChecked.blockMinorIH,
+    r, As, idxs, m, d, K, q, Γ, Fs, Bs,
+    List.append_assoc] using hbody
+
+/-- The global mutual-IH telescope for one constructor is well formed at
+every recursive suffix. -/
+theorem ihs_onTel {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    ∀ (rsSuf : List RecArg),
+    (∀ r ∈ rsSuf,
+      r ∈ constructor.ctor.recArgsR source.uvars gen.elimination) →
+    ∀ (Δ : List VExpr) (p : Nat), Δ.length = p →
+    env.OnTel gen.recUvars
+      (Δ ++
+        (VExpr.liftTelN gen.familyCount
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+      (BlockGenerationChecked.blockIHsFromRecArgs gen.familyCount
+        (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).length rsSuf p)
+  | [], _, _, _, _ => trivial
+  | r :: rsSuf, hqs, Δ, p, hΔ =>
+    ⟨S.recArgMinor_isType hconstructor
+        (hqs r (.head _)) Δ p hΔ,
+      BlockGenerationEnv.ihs_onTel hconstructor rsSuf
+        (fun q hq => hqs q (.tail _ hq))
+        (_ :: Δ) (p + 1) (by simp [hΔ])⟩
+
+theorem viewResultIndices_length
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    constructor.ctor.view.resultIndices.length =
+      constructor.familyIndices.length := by
+  have h := (S.ctorWF constructor hconstructor).resultSpine.forallN_sort_length
+  simpa only [VExpr.liftTelN_length] using h
+
+/-- Transport one mutual constructor's checked result spine to the selected
+raw family-index telescope and through arbitrary middle/top binders. -/
+theorem result_transport
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families)
+    (hindices : family.view.indices = constructor.familyIndices)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.SpineWF gen.recUvars
+      (As₂ ++
+        ((VExpr.liftTelN g
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          ((constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length + g + d)
+          (gen.idxTel family) 0)
+        (.sort (gen.validated.resultLevel.inst gen.sourceLevels)))
+      ((constructor.ctor.resultIndicesR source.uvars gen.elimination).map
+        fun e =>
+          (e.liftN g
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length).liftN d)
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+  let ls := gen.sourceLevels
+  have hview := (S.ctorWF constructor hconstructor).resultSpine
+  rw [← hindices] at hview
+  have hctx := (S.ctorWF constructor hconstructor).emittedTel.ctx
+  simp only [NormalizedBlockCtor.emittedBinders,
+    NormalizedBlockCtor.viewBinders, List.reverse_append,
+    List.append_nil] at hctx
+  have hraw := hview.defeqDFC S.ord (hctx.symm S.ord)
+  have hfields := gen.flatCtor_fields_length hconstructor
+  rw [← hfields] at hraw
+  have h1 := hraw.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have h1Checked : env.SpineWF gen.recUvars
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (VExpr.instL ls
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (constructor.ctor.rawFields source.nparams).length
+            family.view.indices 0)
+          (.sort gen.validated.resultLevel)))
+      (constructor.ctor.view.resultIndices.map (VExpr.instL ls))
+      ((VExpr.sort gen.validated.resultLevel).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse] using h1
+  have hfieldsCtx :=
+    (S.generationFields_onTel_rec hconstructor).extendDefEqCtx
+      S.generationParams_ctx_rec
+  have h1Generation := h1Checked.defeqDFC S.ord
+    (hfieldsCtx.symm S.ord)
+  rw [VExpr.instL_forallN, VExpr.liftTelN_instL] at h1Generation
+  rw [← NormalizedCtor.fieldsR_length
+    (source := source) (mode := gen.elimination) constructor.ctor] at h1Generation
+  have hidx := (S.familyIndexTel_defeq_rec hfamily).weakN S.ord
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse)
+      (constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination).reverse)
+  rw [List.length_reverse] at hidx
+  have hlen :
+      (constructor.ctor.view.resultIndices.map (VExpr.instL ls)).length =
+        (VExpr.liftTelN
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination).length
+          (gen.idxTel family) 0).length := by
+    simp only [List.length_map, VExpr.liftTelN_length,
+      BlockGenerationChecked.idxTel]
+    exact (S.viewResultIndices_length hconstructor).trans
+      ((congrArg List.length hindices).symm.trans
+        (gen.shape.2.2.2.2 family hfamily).2.2.2.1.symm)
+  have h1Raw := hidx.spine_sort S.ord h1Generation hlen
+  have W₁ := Ctx.LiftN.consTel (n := mid.length)
+    (constructor.ctor.fieldsR source.uvars source.nparams
+      gen.elimination)
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h2 := h1Raw.weakN S.ord W₁
+  rw [VExpr.liftN_forallN, hg] at h2
+  have h3 := h2.weakN S.ord
+    (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  rw [VExpr.liftN_forallN] at h3
+  rw [VExpr.liftTelN_liftTelN_hi'
+      (constructor.ctor.fieldsR source.uvars source.nparams
+        gen.elimination).length g _ 0 (by omega),
+    VExpr.liftTelN_liftTelN] at h3
+  simpa [ls, NormalizedCtor.resultIndicesR,
+    VExpr.instL, VExpr.liftN, List.map_map,
+    Function.comp_def, List.append_assoc] using h3
+
+/-- The raw mutual constructor applied to its emitted self-spine at source
+universes. -/
+theorem ctorApp_emitted_decl
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    env.HasType source.uvars
+      ((constructor.ctor.rawFields source.nparams).reverse ++
+        gen.block.checked.params.reverse)
+      (VExpr.appN
+        (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+        (VExpr.bvarRevRange
+            (constructor.ctor.rawFields source.nparams).length
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (constructor.ctor.rawFields source.nparams).length))
+      (NormalizedBlockCtor.resultTarget gen constructor) := by
+  let E := NormalizedBlockCtor.emittedBinders gen constructor
+  let V := NormalizedBlockCtor.viewBinders gen constructor
+  have hc : env.HasType source.uvars []
+      (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN
+        (NormalizedBlockCtor.declaredBinders
+          (source := source) constructor)
+        (NormalizedBlockCtor.rawResult
+          (source := source) constructor)) := by
+    rw [NormalizedBlockCtor.declaredBinders,
+      NormalizedBlockCtor.rawResult,
+      ← constructor.ctor.rawType_eq]
+    exact S.ctorConst_decl hconstructor
+  obtain ⟨_, hdecl⟩ :=
+    (S.ctorWF constructor hconstructor).declaredTel.forallN_defeq
+      (by simpa using
+        (S.ctorWF constructor hconstructor).declaredResult)
+  have hview : env.HasType source.uvars []
+      (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN V
+        (NormalizedBlockCtor.resultTarget gen constructor)) := by
+    simpa [V] using hdecl.defeq hc
+  have hresult : env.HasType source.uvars E.reverse
+      (NormalizedBlockCtor.resultTarget gen constructor)
+      (.sort gen.validated.resultLevel) := by
+    simpa [E] using
+      (S.ctorWF constructor hconstructor).emittedResult.hasType.2
+  obtain ⟨_, hemit⟩ :=
+    (S.ctorWF constructor hconstructor).emittedTel.forallN_defeq
+      (by simpa [E, VEnv.HasType] using hresult)
+  have hcE₀ : env.HasType source.uvars []
+      (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN E
+        (NormalizedBlockCtor.resultTarget gen constructor)) := by
+    exact hemit.defeq' (by simpa [V] using hview)
+  have hclosed :
+      (VExpr.forallN E
+        (NormalizedBlockCtor.resultTarget gen constructor)).ClosedN 0 :=
+    (hcE₀.closedN' S.ord.closed trivial).2.2
+  have hcE : env.HasType source.uvars E.reverse
+      (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+      (VExpr.forallN E
+        (NormalizedBlockCtor.resultTarget gen constructor)) :=
+    hcE₀.weak0 S.ord
+  have happ := VEnv.HasType.appN_selfSpine'
+    (As := E)
+    (B := NormalizedBlockCtor.resultTarget gen constructor)
+    (Δ := []) (Γ := []) hclosed (by simpa using hcE)
+  simp only [List.length_nil, VExpr.liftN_zero,
+    List.nil_append, List.append_nil] at happ
+  have hEctx :
+      E.reverse =
+        (constructor.ctor.rawFields source.nparams).reverse ++
+          gen.block.checked.params.reverse := by
+    simp [E, NormalizedBlockCtor.emittedBinders,
+      List.reverse_append]
+  have hElen :
+      E.length =
+        (constructor.ctor.rawFields source.nparams).length +
+          source.nparams := by
+    have hp : gen.block.checked.params.length = source.nparams :=
+      gen.shape.2.1.symm.trans gen.shape.1
+    simp [E, NormalizedBlockCtor.emittedBinders, hp]
+    omega
+  rw [hEctx, hElen,
+    ← VExpr.bvarRevRange_append source.nparams
+      (constructor.ctor.rawFields source.nparams).length] at happ
+  exact happ
+
+/-- The exact emitted mutual-constructor application in recursor universes,
+retargeted to its owner family. -/
+theorem ctorApp_emitted_rec
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    {family : NormalizedFamily}
+    (hname : family.raw.name = constructor.familyName) :
+    env.HasType gen.recUvars
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).reverse ++ gen.paramsTel.reverse)
+      (VExpr.appN
+        (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length source.nparams ++
+          VExpr.bvarRevRange 0
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length source.nparams ++
+          constructor.ctor.resultIndicesR source.uvars gen.elimination)) := by
+  let ls := gen.sourceLevels
+  have h := (S.ctorApp_emitted_decl hconstructor).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hChecked : env.HasType gen.recUvars
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      ((VExpr.appN
+        (.const constructor.ctor.raw.name (VLevel.params source.uvars))
+        (VExpr.bvarRevRange
+            (constructor.ctor.rawFields source.nparams).length
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (constructor.ctor.rawFields source.nparams).length)).instL ls)
+      ((NormalizedBlockCtor.resultTarget gen constructor).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse] using h
+  have hfieldsCtx :=
+    (S.generationFields_onTel_rec hconstructor).extendDefEqCtx
+      S.generationParams_ctx_rec
+  have hGeneration := hChecked.defeqDFC S.ord
+    (hfieldsCtx.symm S.ord)
+  rw [← NormalizedCtor.fieldsR_length
+    (source := source) (mode := gen.elimination) constructor.ctor] at hGeneration
+  simpa [ls, hname, NormalizedCtor.fieldsR,
+    BlockGenerationChecked.paramsTel,
+    NormalizedBlockCtor.resultTarget,
+    NormalizedCtor.resultIndicesR,
+    VExpr.instL_appN, List.map_append,
+    bvarRevRange_instL, List.map_reverse,
+    VExpr.instL, VLevel.params_map_inst_params'] using hGeneration
+
+/-- Transport the emitted mutual-constructor application beneath arbitrary
+middle and top binders. -/
+theorem ctorApp_transport
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    {family : NormalizedFamily}
+    (hname : family.raw.name = constructor.familyName)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.HasType gen.recUvars
+      (As₂ ++
+        ((VExpr.liftTelN g
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse)))
+      (VExpr.appN (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (d + (g +
+              (constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length)) source.nparams ++
+          VExpr.bvarRevRange d
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (d + (g +
+              (constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length)) source.nparams ++
+          (constructor.ctor.resultIndicesR source.uvars gen.elimination).map
+            fun e =>
+              (e.liftN g
+                (constructor.ctor.fieldsR source.uvars source.nparams
+                  gen.elimination).length).liftN d)) := by
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams
+    gen.elimination
+  have W₁ := Ctx.LiftN.consTel (n := mid.length) Bs
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h₁ := (S.ctorApp_emitted_rec hconstructor hname).weakN
+    S.ord W₁
+  rw [hg] at h₁
+  have hmid : env.HasType gen.recUvars
+      ((VExpr.liftTelN g Bs 0).reverse ++
+        (mid ++ gen.paramsTel.reverse))
+      (VExpr.appN (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (g + Bs.length) source.nparams ++
+          VExpr.bvarRevRange 0 Bs.length))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (g + Bs.length) source.nparams ++
+          (constructor.ctor.resultIndicesR source.uvars
+            gen.elimination).map (VExpr.liftN g · Bs.length))) := by
+    simpa [Bs, VExpr.liftN_appN, List.map_append,
+      bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+      VExpr.bvarRevRange_liftN_high Bs.length 0 g Bs.length (by omega),
+      VExpr.liftN] using h₁
+  have htop := hmid.weakN S.ord
+    (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  simpa [Bs, VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+    VExpr.liftN, List.map_map, Function.comp_def,
+    List.append_assoc] using htop
+
+/-- The raw field telescope of a mutual constructor is well formed after
+inserting all block motives. -/
+theorem fields_onTel_minor
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    env.OnTel gen.recUvars
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+      (VExpr.liftTelN gen.familyCount
+        (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination) 0) := by
+  have hd : gen.motiveTypes.reverse.length = gen.familyCount := by
+    simp [gen.motiveTypes_length]
+  have hout := (S.generationFields_onTel_rec hconstructor).weakN S.ord
+    (Ctx.LiftN.zero (n := gen.familyCount)
+      (Γ := gen.paramsTel.reverse) gen.motiveTypes.reverse (h := hd))
+  simpa using hout
+
+/-- Every flattened mutual constructor minor is a type over the global
+motive telescope. -/
+theorem minor_isType
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    env.IsType gen.recUvars
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+      (gen.minorType constructor) := by
+  obtain ⟨family, hfamily, howner, hname, hindices⟩ :=
+    (S.ctorWF constructor hconstructor).owner
+  let d := gen.familyCount
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams
+    gen.elimination
+  let m := Bs.length
+  let rs := constructor.ctor.recArgsR source.uvars gen.elimination
+  let IHs := BlockGenerationChecked.blockIHsFromRecArgs d m rs 0
+  let Fs := VExpr.liftTelN d Bs 0
+  let Γ := IHs.reverse ++
+    (Fs.reverse ++
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+  let q := family.view.ordinal
+  let K := d - 1 - constructor.owner + m + rs.length
+  simp only [BlockGenerationChecked.minorType]
+  refine VEnv.IsType.forallN (by
+    simpa [Bs, d] using S.fields_onTel_minor hconstructor) ?_
+  refine VEnv.IsType.forallN (by
+    simpa [Bs, m, rs, IHs, Fs, d, List.append_assoc] using
+      S.ihs_onTel hconstructor rs (fun r hr => hr) [] 0 rfl) ?_
+  have hrlen : IHs.reverse.length = rs.length := by
+    simp [IHs, BlockGenerationChecked.blockIHsFromRecArgs_length]
+  have hd : gen.motiveTypes.reverse.length = d := by
+    simp [d, gen.motiveTypes_length]
+  have hd' : gen.motiveTypes.length = d := by
+    simpa using hd
+  have hFsLen : Fs.length = m := by
+    simp [Fs, m, VExpr.liftTelN_length]
+  have hq : q < d := by
+    simpa [q, d] using gen.family_ordinal_lt hfamily
+  have hmot : gen.motiveTypes.reverse[d - 1 - q]? =
+      some ((gen.motiveType family).liftN q) := by
+    rw [List.getElem?_reverse (by rw [hd']; omega),
+      show gen.motiveTypes.length - 1 - (d - 1 - q) = q from by
+        rw [hd']
+        omega,
+      gen.motiveTypes_getElem?_ordinal hfamily]
+  have hM0 := getElem?_rstack_mid
+    (IHs.reverse ++ Fs.reverse)
+    gen.motiveTypes.reverse gen.paramsTel.reverse
+    (i := K)
+    (by
+      simp only [List.length_append, List.length_reverse,
+        hrlen, hFsLen]
+      dsimp only [K, q, d]
+      omega)
+    (by
+      simp only [List.length_append, List.length_reverse,
+        hrlen, hFsLen, hd]
+      dsimp only [K, q, d]
+      omega)
+  have hdiff :
+      K - (IHs.reverse ++ Fs.reverse).length = d - 1 - q := by
+    simp only [List.length_append, List.length_reverse,
+      hrlen, hFsLen]
+    dsimp only [K, q, d]
+    omega
+  rw [hdiff, hmot] at hM0
+  have hMget : Γ[K]? =
+      some ((gen.motiveType family).liftN q) := by
+    simpa [Γ, List.append_assoc] using hM0
+  have hMraw := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars)
+    (Lookup.of_getElem? hMget)
+  have hM : env.HasType gen.recUvars Γ (.bvar K)
+      ((gen.motiveType family).liftN (q + K + 1)) := by
+    simpa [VExpr.liftN_liftN, Nat.add_assoc] using hMraw
+  have hSp := S.result_transport hconstructor hfamily hindices
+    gen.motiveTypes.reverse hd IHs.reverse hrlen
+  have hSp' : env.SpineWF gen.recUvars Γ
+      (VExpr.forallN
+        (VExpr.liftTelN (m + d + rs.length)
+          (gen.idxTel family) 0)
+        (.sort (gen.validated.resultLevel.inst gen.sourceLevels)))
+      ((constructor.ctor.resultIndicesR source.uvars
+          gen.elimination).map fun e =>
+        (e.liftN d m).liftN rs.length)
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+    simpa [Γ, Fs, Bs, m, d, List.append_assoc] using hSp
+  have hlen :
+      ((constructor.ctor.resultIndicesR source.uvars
+          gen.elimination).map fun e =>
+        (e.liftN d m).liftN rs.length).length =
+        (gen.idxTel family).length := by
+    simp only [List.length_map, NormalizedCtor.resultIndicesR,
+      BlockGenerationChecked.idxTel]
+    exact (S.viewResultIndices_length hconstructor).trans
+      ((congrArg List.length hindices).symm.trans
+        (gen.shape.2.2.2.2 family hfamily).2.2.2.1.symm)
+  have hctorApp := S.ctorApp_transport hconstructor hname
+    gen.motiveTypes.reverse hd IHs.reverse hrlen
+  have hctorApp' : env.HasType gen.recUvars Γ
+      (VExpr.appN
+        (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (m + d + rs.length) source.nparams ++
+          VExpr.bvarRevRange rs.length m))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (m + d + rs.length) source.nparams ++
+          (constructor.ctor.resultIndicesR source.uvars
+            gen.elimination).map fun e =>
+              (e.liftN d m).liftN rs.length)) := by
+    simpa [Γ, Fs, Bs, m, d, IHs, rs,
+      List.append_assoc, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm] using hctorApp
+  have hshift : q + K + 1 = m + d + rs.length := by
+    dsimp only [q, K, d]
+    omega
+  have hbody := gen.motiveVarApp_hasType family
+    (q := q) (K := K)
+    hM (by simpa [hshift, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm] using hSp') hlen
+      (by simpa [hshift, Nat.add_assoc, Nat.add_comm,
+        Nat.add_left_comm] using hctorApp')
+  exact ⟨gen.motiveLevel, by
+    simpa [Γ, Fs, Bs, m, rs, IHs, d, K, q,
+      BlockGenerationChecked.blockMinorIH,
+      List.append_assoc, Nat.add_assoc, Nat.add_comm,
+      Nat.add_left_comm] using hbody⟩
+
+/-- Any suffix of the globally flattened constructor list generates a
+well-formed minor telescope at its positional depth. -/
+theorem minorTypesAux_onTel :
+    ∀ (constructors : List NormalizedBlockCtor),
+      (∀ constructor ∈ constructors, constructor ∈ gen.flatCtors) →
+      ∀ (Δ : List VExpr) (i : Nat), Δ.length = i →
+        env.OnTel gen.recUvars
+          (Δ ++ (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+          (gen.minorTypesAux constructors i)
+  | [], _, _, _, _ => trivial
+  | constructor :: constructors, hsub, Δ, i, hΔ =>
+    ⟨by
+      rw [← hΔ]
+      exact (S.minor_isType
+        (hsub constructor (.head _))).weakN S.ord (.zero Δ),
+    BlockGenerationEnv.minorTypesAux_onTel constructors
+      (fun constructor hconstructor => hsub constructor (.tail _ hconstructor))
+      (_ :: Δ) (i + 1) (by simp [hΔ])⟩
+
+/-- The complete global constructor-minor telescope is well formed beneath
+all mutual motives. -/
+theorem minorTypes_onTel :
+    env.OnTel gen.recUvars
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+      gen.minorTypes := by
+  simpa [BlockGenerationChecked.minorTypes] using
+    S.minorTypesAux_onTel gen.flatCtors
+      (fun _ h => h) [] 0 rfl
+
+theorem idxTel_onTel {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.OnTel gen.recUvars gen.paramsTel.reverse
+      (gen.idxTel family) := by
+  have h := (S.generationFamily_onTel hfamily).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have h' : env.OnTel gen.recUvars []
+      (gen.paramsTel ++ gen.idxTel family) := by
+    simpa [BlockGenerationChecked.paramsTel,
+      BlockGenerationChecked.idxTel] using h
+  simpa using h'.of_append.2
+
+/-- Transport a selected family applied to its index self-spine beneath
+arbitrary middle and top binders. -/
+theorem familyApp_transport {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.HasType gen.recUvars
+      (As₂ ++
+        ((VExpr.liftTelN g (gen.idxTel family) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse)))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (d + (g + (gen.idxTel family).length)) source.nparams ++
+          VExpr.bvarRevRange d (gen.idxTel family).length))
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+  have W₁ := Ctx.LiftN.consTel (n := mid.length) (gen.idxTel family)
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h₁ := (S.familyApp_hasType hfamily).weakN S.ord W₁
+  rw [hg] at h₁
+  have hmid : env.HasType gen.recUvars
+      ((VExpr.liftTelN g (gen.idxTel family) 0).reverse ++
+        (mid ++ gen.paramsTel.reverse))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (g + (gen.idxTel family).length) source.nparams ++
+          VExpr.bvarRevRange 0 (gen.idxTel family).length))
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+    simpa [VExpr.liftN_appN, List.map_append,
+      bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+      VExpr.bvarRevRange_liftN_high
+        (gen.idxTel family).length 0 g (gen.idxTel family).length
+        (by omega),
+      VExpr.liftN] using h₁
+  have htop := hmid.weakN S.ord
+    (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  simpa [VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+    VExpr.liftN, List.append_assoc] using htop
+
+/-- The generated recursor type for every selected mutual family is well
+formed over the empty context. -/
+theorem recType_isType {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    env.IsType gen.recUvars [] (gen.recType family) := by
+  let d := gen.familyCount
+  let k := gen.minorCount
+  let q := family.view.ordinal
+  let Is := gen.idxTel family
+  let ni := Is.length
+  let LiftedIs := VExpr.liftTelN (d + k) Is 0
+  let A := VExpr.appN (.const family.raw.name gen.sourceLevels)
+    (VExpr.bvarRevRange (ni + d + k) source.nparams ++
+      VExpr.bvarRevRange 0 ni)
+  let Base := gen.minorTypes.reverse ++
+    (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+  let Γ := A :: (LiftedIs.reverse ++ Base)
+  let K := d - 1 - q + k + ni + 1
+  refine VEnv.IsType.forallN S.paramsTel_onTel ?_
+  simp only [List.append_nil]
+  refine VEnv.IsType.forallN S.motiveTypes_onTel ?_
+  refine VEnv.IsType.forallN S.minorTypes_onTel ?_
+  have hdk :
+      (gen.minorTypes.reverse ++ gen.motiveTypes.reverse).length = d + k := by
+    simp only [List.length_append, List.length_reverse,
+      gen.minorTypes_length, gen.motiveTypes_length]
+    dsimp only [d, k]
+    omega
+  have hI : env.OnTel gen.recUvars Base LiftedIs := by
+    have h := (S.idxTel_onTel hfamily).weakN S.ord
+      (Ctx.LiftN.zero (n := d + k)
+        (Γ := gen.paramsTel.reverse)
+        (gen.minorTypes.reverse ++ gen.motiveTypes.reverse)
+        (h := hdk))
+    simpa [Base, LiftedIs, Is, List.append_assoc] using h
+  refine VEnv.IsType.forallN hI ?_
+  have hmaj₀ := S.familyApp_transport hfamily
+    (gen.minorTypes.reverse ++ gen.motiveTypes.reverse)
+    (g := d + k) hdk [] (d := 0) rfl
+  rw [VExpr.bvarRevRange_congr source.nparams
+    (show 0 + (d + k + Is.length) = ni + d + k by
+      dsimp only [ni]
+      omega)] at hmaj₀
+  have hmaj : env.HasType gen.recUvars
+      (LiftedIs.reverse ++ Base) A
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+    simpa [A, Base, LiftedIs, Is, List.append_assoc] using hmaj₀
+  refine VEnv.IsType.forallE ⟨_, hmaj⟩ ?_
+  have hILen : LiftedIs.length = ni := by
+    simp [LiftedIs, ni, VExpr.liftTelN_length]
+  have hq : q < d := by
+    simpa [q, d] using gen.family_ordinal_lt hfamily
+  have hd : gen.motiveTypes.length = d := by
+    simpa [d] using gen.motiveTypes_length
+  have hmot : gen.motiveTypes.reverse[d - 1 - q]? =
+      some ((gen.motiveType family).liftN q) := by
+    rw [List.getElem?_reverse (by rw [hd]; omega),
+      show gen.motiveTypes.length - 1 - (d - 1 - q) = q from by
+        rw [hd]
+        omega,
+      gen.motiveTypes_getElem?_ordinal hfamily]
+  have hM0 := getElem?_rstack_mid
+    ([A] ++ LiftedIs.reverse ++ gen.minorTypes.reverse)
+    gen.motiveTypes.reverse gen.paramsTel.reverse
+    (i := K)
+    (by
+      simp only [List.length_append, List.length_singleton,
+        List.length_reverse, hILen, gen.minorTypes_length]
+      dsimp only [K, q, d, k, ni, Is]
+      omega)
+    (by
+      simp only [List.length_append, List.length_singleton,
+        List.length_reverse, hILen, gen.minorTypes_length]
+      rw [hd]
+      dsimp only [K, q, d, k, ni, Is]
+      omega)
+  have hdiff :
+      K - ([A] ++ LiftedIs.reverse ++ gen.minorTypes.reverse).length =
+        d - 1 - q := by
+    simp only [List.length_append, List.length_singleton,
+      List.length_reverse, hILen, gen.minorTypes_length]
+    dsimp only [K, q, d, k, ni, Is]
+    omega
+  rw [hdiff, hmot] at hM0
+  have hMget : Γ[K]? =
+      some ((gen.motiveType family).liftN q) := by
+    simpa [Γ, Base, List.append_assoc] using hM0
+  have hmlu := Lookup.of_getElem? hMget
+  rw [show ((gen.motiveType family).liftN q).liftN (K + 1) =
+      ((gen.motiveType family).liftN (d + k)).liftN (ni + 1) from by
+        rw [VExpr.liftN_liftN, VExpr.liftN_liftN]
+        congr 1
+        dsimp only [K, q, d, k]
+        omega,
+    gen.motiveType_liftN family] at hmlu
+  have hfun : env.HasType gen.recUvars Γ (.bvar K)
+      ((VExpr.forallN LiftedIs
+        (.forallE
+          (VExpr.appN (.const family.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange (d + k + ni) source.nparams ++
+              VExpr.bvarRevRange 0 ni))
+          (.sort gen.motiveLevel))).liftN
+        (1 + LiftedIs.length)) := by
+    exact .bvar (by
+      simpa [Γ, Base, LiftedIs, Is, ni,
+        VExpr.liftTelN_length, List.append_assoc,
+        Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using hmlu)
+  have hMapp := VEnv.HasType.appN_selfSpine
+    (As := LiftedIs)
+    (Δ := [A])
+    (Γ := Base)
+    (f := .bvar K) hfun
+  have hMapp' : env.HasType gen.recUvars Γ
+      ((VExpr.bvar K).appN (VExpr.bvarRevRange 1 ni))
+      (.forallE (A.liftN 1) (.sort gen.motiveLevel)) := by
+    simpa [Γ, Base, A, LiftedIs, Is, ni, hILen,
+      VExpr.liftN, List.append_assoc,
+      Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using hMapp
+  have h0 : Γ[0]? = some A := rfl
+  have harg := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars)
+    (Lookup.of_getElem? h0)
+  have harg' : env.HasType gen.recUvars Γ (.bvar 0) (A.liftN 1) := by
+    simpa [Γ, List.append_assoc] using harg
+  have happ := VEnv.HasType.app hMapp' harg'
+  exact ⟨gen.motiveLevel, by
+    simpa [BlockGenerationChecked.recType,
+      Γ, Base, A, LiftedIs, Is, ni, d, k, q, K,
+      VExpr.liftTelN_length, VExpr.inst, List.append_assoc,
+      Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using happ⟩
+
+/-- Every family-selected mutual recursor constant is well formed in the
+environment containing the complete raw block. -/
+theorem recursor_wf {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    (gen.recursor family).WF env :=
+  S.recType_isType hfamily
+
+theorem recType_levelWF {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    (gen.recType family).LevelWF gen.recUvars := by
+  obtain ⟨_, h⟩ := S.recType_isType hfamily
+  exact (h.levelWF trivial).1
+
+theorem recType_closedN {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families) :
+    (gen.recType family).ClosedN 0 := by
+  obtain ⟨_, h⟩ := S.recType_isType hfamily
+  exact VExpr.WF.closedN S.ord ⟨_, h⟩ trivial
+
+/-- The selected family recursor constant has its generated mutual recursor
+type in every local context. -/
+theorem recursor_hasType {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families)
+    (hrec : env.constants (.str family.raw.name "rec") =
+      some (gen.recursor family)) {Γ : List VExpr} :
+    env.HasType gen.recUvars Γ
+      (.const (.str family.raw.name "rec") gen.recLevels)
+      (gen.recType family) := by
+  have h := VEnv.HasType.const (Γ := Γ) hrec
+    VLevel.params_wf VLevel.params_length
+  rw [show (gen.recursor family).uvars = gen.recUvars from rfl,
+    show (gen.recursor family).type = gen.recType family from rfl] at h
+  rwa [(S.recType_levelWF hfamily).instL_id] at h
+
+/-- Applying a selected recursor to the shared parameters, motives, and
+flattened minors exposes its index-and-major spine. -/
+theorem recBase_hasType {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families)
+    (hrec : env.constants (.str family.raw.name "rec") =
+      some (gen.recursor family))
+    (Δ : List VExpr) :
+    env.HasType gen.recUvars
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (gen.recBase Δ.length family.view.ordinal)
+      ((VExpr.forallN
+        (VExpr.liftTelN
+          (gen.familyCount + gen.minorCount)
+          (gen.idxTel family) 0)
+        (.forallE
+          (VExpr.appN (.const family.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange
+                ((gen.idxTel family).length +
+                  gen.familyCount + gen.minorCount)
+                source.nparams ++
+              VExpr.bvarRevRange 0 (gen.idxTel family).length))
+          (.app
+            (VExpr.appN
+              (.bvar
+                (gen.familyCount - 1 - family.view.ordinal +
+                  gen.minorCount + (gen.idxTel family).length + 1))
+              (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+            (.bvar 0)))).liftN Δ.length) := by
+  have hf : env.HasType gen.recUvars
+      (Δ ++
+        (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes).reverse ++ [])
+      (.const (.str family.raw.name "rec") gen.recLevels)
+      ((VExpr.forallN
+        (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes)
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (gen.familyCount + gen.minorCount)
+            (gen.idxTel family) 0)
+          (.forallE
+            (VExpr.appN (.const family.raw.name gen.sourceLevels)
+              (VExpr.bvarRevRange
+                  ((gen.idxTel family).length +
+                    gen.familyCount + gen.minorCount)
+                  source.nparams ++
+                VExpr.bvarRevRange 0 (gen.idxTel family).length))
+            (.app
+              (VExpr.appN
+                (.bvar
+                  (gen.familyCount - 1 - family.view.ordinal +
+                    gen.minorCount + (gen.idxTel family).length + 1))
+                (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+              (.bvar 0))))).liftN
+        (Δ.length +
+          (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes).length)) := by
+    rw [show VExpr.forallN
+        (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes)
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (gen.familyCount + gen.minorCount)
+            (gen.idxTel family) 0)
+          (.forallE
+            (VExpr.appN (.const family.raw.name gen.sourceLevels)
+              (VExpr.bvarRevRange
+                  ((gen.idxTel family).length +
+                    gen.familyCount + gen.minorCount)
+                  source.nparams ++
+                VExpr.bvarRevRange 0 (gen.idxTel family).length))
+            (.app
+              (VExpr.appN
+                (.bvar
+                  (gen.familyCount - 1 - family.view.ordinal +
+                    gen.minorCount + (gen.idxTel family).length + 1))
+                (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+              (.bvar 0)))) = gen.recType family from by
+          rw [VExpr.forallN_append, VExpr.forallN_append]
+          rfl,
+      (S.recType_closedN hfamily).liftN_eq (Nat.zero_le _)]
+    exact S.recursor_hasType hfamily hrec
+  have hspine := VEnv.HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars) hf
+  simp only [List.reverse_append, List.append_nil, List.append_assoc, List.length_append,
+    gen.minorTypes_length, gen.motiveTypes_length] at hspine
+  rw [show gen.paramsTel.length = source.nparams from by
+      simpa [BlockGenerationChecked.paramsTel] using
+        S.generationParams_length,
+    VExpr.bvarRevRange_congr' Δ.length
+      (show source.nparams + (gen.familyCount + gen.minorCount) =
+        source.nparams + gen.familyCount + gen.minorCount by omega)] at hspine
+  simpa [BlockGenerationChecked.recBase,
+    gen.familyNameAt_ordinal hfamily,
+    List.append_assoc] using hspine
+
+/-- Applying a selected family recursor to indices and a major premise
+returns the correspondingly selected motive application. -/
+theorem recApp_hasType {family : NormalizedFamily}
+    (hfamily : family ∈ gen.families)
+    (hrec : env.constants (.str family.raw.name "rec") =
+      some (gen.recursor family))
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF gen.recUvars
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (Δ.length + gen.familyCount + gen.minorCount)
+          (gen.idxTel family) 0)
+        (.sort (gen.validated.resultLevel.inst gen.sourceLevels)))
+      idxs (.sort (gen.validated.resultLevel.inst gen.sourceLevels)))
+    (hlen : idxs.length = (gen.idxTel family).length)
+    (ha : env.HasType gen.recUvars
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      a
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            (Δ.length + gen.familyCount + gen.minorCount)
+            source.nparams ++ idxs))) :
+    env.HasType gen.recUvars
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (VExpr.appN (gen.recBase Δ.length family.view.ordinal)
+        (idxs ++ [a]))
+      (VExpr.appN
+        (.bvar
+          (gen.familyCount - 1 - family.view.ordinal +
+            gen.minorCount + Δ.length))
+        (idxs ++ [a])) := by
+  have hq := gen.family_ordinal_lt hfamily
+  have hb := S.recBase_hasType hfamily hrec Δ
+  rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+    liftTelN_congr _ _
+      (show gen.familyCount + gen.minorCount + Δ.length =
+        Δ.length + gen.familyCount + gen.minorCount by omega)] at hb
+  have hcod :
+      (VExpr.forallE
+        (VExpr.appN (.const family.raw.name gen.sourceLevels)
+          (VExpr.bvarRevRange
+              ((gen.idxTel family).length +
+                gen.familyCount + gen.minorCount)
+              source.nparams ++
+            VExpr.bvarRevRange 0 (gen.idxTel family).length))
+        (.app
+          (VExpr.appN
+            (.bvar
+              (gen.familyCount - 1 - family.view.ordinal +
+                gen.minorCount + (gen.idxTel family).length + 1))
+            (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+          (.bvar 0))).liftN Δ.length
+            (0 + (VExpr.liftTelN
+              (gen.familyCount + gen.minorCount)
+              (gen.idxTel family) 0).length) =
+      VExpr.forallE
+        (VExpr.appN (.const family.raw.name gen.sourceLevels)
+          (VExpr.bvarRevRange
+              ((gen.idxTel family).length + Δ.length +
+                gen.familyCount + gen.minorCount)
+              source.nparams ++
+            VExpr.bvarRevRange 0 (gen.idxTel family).length))
+        (.app
+          (VExpr.appN
+            (.bvar
+              (gen.familyCount - 1 - family.view.ordinal +
+                gen.minorCount + (gen.idxTel family).length +
+                Δ.length + 1))
+            (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+          (.bvar 0)) := by
+    rw [VExpr.liftTelN_length, Nat.zero_add]
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN_appN, List.map_append,
+        bvarRevRange_liftN_ge _ _ _ _ (by omega),
+        VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+        VExpr.bvarRevRange_congr source.nparams
+          (show Δ.length +
+              ((gen.idxTel family).length +
+                gen.familyCount + gen.minorCount) =
+            (gen.idxTel family).length + Δ.length +
+              gen.familyCount + gen.minorCount by omega)]
+      rfl
+    · show VExpr.app _ _ = VExpr.app _ _
+      congr 1
+      · rw [VExpr.liftN_appN,
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+        show VExpr.appN
+          (.bvar (liftVar Δ.length
+            (gen.familyCount - 1 - family.view.ordinal +
+              gen.minorCount + (gen.idxTel family).length + 1)
+            ((gen.idxTel family).length + 1))) _ = _
+        rw [liftVar_le (by omega)]
+        congr 1
+        ac_rfl
+  rw [hcod] at hb
+  have hshape := hidx.retarget
+    (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            ((gen.idxTel family).length + Δ.length +
+              gen.familyCount + gen.minorCount)
+            source.nparams ++
+          VExpr.bvarRevRange 0 (gen.idxTel family).length))
+      (.sort gen.motiveLevel))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _
+      (C := .const family.raw.name gen.sourceLevels) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _
+      (by rw [hlen]; omega),
+    show (gen.idxTel family).length + Δ.length +
+        gen.familyCount + gen.minorCount - idxs.length =
+      Δ.length + gen.familyCount + gen.minorCount from by
+        rw [hlen]
+        omega,
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hfull := hshape.snoc ha
+  simp only [VExpr.inst] at hfull
+  change env.SpineWF gen.recUvars _
+    (VExpr.forallN
+      (VExpr.liftTelN
+        (Δ.length + gen.familyCount + gen.minorCount)
+        (gen.idxTel family) 0)
+      (VExpr.forallN
+        [VExpr.appN (.const family.raw.name gen.sourceLevels)
+          (VExpr.bvarRevRange
+              ((gen.idxTel family).length + Δ.length +
+                gen.familyCount + gen.minorCount)
+              source.nparams ++
+            VExpr.bvarRevRange 0 (gen.idxTel family).length)]
+        (.sort gen.motiveLevel)))
+    (idxs ++ [a]) (.sort gen.motiveLevel) at hfull
+  rw [← VExpr.forallN_append] at hfull
+  have hfullLen : (idxs ++ [a]).length =
+      (VExpr.liftTelN
+          (Δ.length + gen.familyCount + gen.minorCount)
+          (gen.idxTel family) 0 ++
+        [VExpr.appN (.const family.raw.name gen.sourceLevels)
+          (VExpr.bvarRevRange
+              ((gen.idxTel family).length + Δ.length +
+                gen.familyCount + gen.minorCount)
+              source.nparams ++
+            VExpr.bvarRevRange 0 (gen.idxTel family).length)]).length := by
+    simp only [List.length_append, List.length_singleton,
+      VExpr.liftTelN_length, hlen]
+  have hactual := hfull.retarget hfullLen
+    (VExpr.app
+      (VExpr.appN
+        (.bvar
+          (gen.familyCount - 1 - family.view.ordinal +
+            gen.minorCount + (gen.idxTel family).length +
+            Δ.length + 1))
+        (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+      (.bvar 0))
+  rw [VExpr.forallN_append] at hactual
+  have happ := hactual.hasType_appN hb
+  rw [show VExpr.app
+      (VExpr.appN
+        (.bvar
+          (gen.familyCount - 1 - family.view.ordinal +
+            gen.minorCount + (gen.idxTel family).length +
+            Δ.length + 1))
+        (VExpr.bvarRevRange 1 (gen.idxTel family).length))
+      (.bvar 0) =
+      VExpr.appN
+        (.bvar
+          (gen.familyCount - 1 - family.view.ordinal +
+            gen.minorCount + (gen.idxTel family).length +
+            Δ.length + 1))
+        (VExpr.bvarRevRange 0 ((gen.idxTel family).length + 1)) from by
+      rw [VExpr.bvarRevRange_congr' 0
+          (show (gen.idxTel family).length + 1 =
+            1 + (gen.idxTel family).length by omega),
+        ← VExpr.bvarRevRange_append (gen.idxTel family).length 1]
+      simpa [VExpr.bvarRevRange, VExpr.appN] using
+        (VExpr.appN_append
+          (.bvar
+            (gen.familyCount - 1 - family.view.ordinal +
+              gen.minorCount + (gen.idxTel family).length +
+              Δ.length + 1))
+          (VExpr.bvarRevRange 1 (gen.idxTel family).length)
+          [VExpr.bvar 0]).symm,
+    VExpr.instRev_appN,
+    VExpr.instRev_bvar_ge _ (by
+      simp only [List.length_append, List.length_singleton]
+      rw [hlen]
+      omega),
+    VExpr.bvarRevRange_congr' 0
+      (show (gen.idxTel family).length + 1 =
+        (idxs ++ [a]).length by simp [hlen]),
+    VExpr.map_instRev_bvarRevRange] at happ
+  rw [show gen.familyCount - 1 - family.view.ordinal +
+      gen.minorCount + (gen.idxTel family).length + Δ.length + 1 -
+        (idxs ++ [a]).length =
+      gen.familyCount - 1 - family.view.ordinal +
+        gen.minorCount + Δ.length from by
+    simp only [List.length_append, List.length_singleton]
+    rw [hlen]
+    omega] at happ
+  simpa [List.length_append, hlen,
+    BlockGenerationChecked.recBase,
+    gen.familyNameAt_ordinal hfamily] using happ
+
+/-- The constructor application appearing in a mutual rule has the selected
+owner-family application as its type. -/
+theorem ctorAppRule_hasType
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    {family : NormalizedFamily} (_hfamily : family ∈ gen.families)
+    (hname : family.raw.name = constructor.familyName) :
+    env.HasType gen.recUvars
+      ((VExpr.liftTelN
+          (gen.familyCount + gen.minorCount)
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            ((constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length +
+              gen.familyCount + gen.minorCount)
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length))
+      (VExpr.appN (.const family.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange
+            ((constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length +
+              gen.familyCount + gen.minorCount)
+            source.nparams ++
+          (constructor.ctor.resultIndicesR source.uvars
+            gen.elimination).map fun e =>
+              e.liftN (gen.familyCount + gen.minorCount)
+                (constructor.ctor.fieldsR source.uvars source.nparams
+                  gen.elimination).length)) := by
+  have h := S.ctorApp_transport hconstructor hname
+    (gen.minorTypes.reverse ++ gen.motiveTypes.reverse)
+    (g := gen.familyCount + gen.minorCount)
+    (by
+      simp only [List.length_append, List.length_reverse,
+        gen.minorTypes_length, gen.motiveTypes_length]
+      omega)
+    [] (d := 0) rfl
+  rw [VExpr.bvarRevRange_congr source.nparams
+    (show
+      0 + (gen.familyCount + gen.minorCount +
+        (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).length) =
+      (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).length +
+        gen.familyCount + gen.minorCount by omega)] at h
+  simpa [List.append_assoc] using h
+
+/-- Parameters, every motive, every flattened minor, and the selected
+constructor fields form the binder telescope of a mutual rule. -/
+theorem ruleBinders_onTel
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors) :
+    env.OnTel gen.recUvars []
+      (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes ++
+        VExpr.liftTelN
+          (gen.familyCount + gen.minorCount)
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0) := by
+  have hF₀ := S.fields_onTel_minor hconstructor
+  have hF := hF₀.weakN S.ord
+    (Ctx.LiftN.zero
+      (Γ := gen.motiveTypes.reverse ++ gen.paramsTel.reverse)
+      gen.minorTypes.reverse)
+  rw [VExpr.liftTelN_liftTelN,
+    liftTelN_congr _ _
+      (show gen.familyCount + gen.minorTypes.reverse.length =
+        gen.familyCount + gen.minorCount by
+          simp only [List.length_reverse, gen.minorTypes_length])] at hF
+  refine OnTel.append
+    (OnTel.append
+      (OnTel.append S.paramsTel_onTel
+        (by simpa only [List.append_nil] using S.motiveTypes_onTel))
+      (by simpa only [List.append_nil, List.reverse_append,
+          List.append_assoc] using S.minorTypes_onTel)) ?_
+  simpa only [List.append_nil, List.append_assoc,
+    List.reverse_append] using hF
+
+/-- The constructor-headed left side of a mutual iota rule has the owner
+motive application as its type. -/
+theorem recRuleApp_hasType
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    (hrecs : ∀ family ∈ gen.families,
+      env.constants (.str family.raw.name "rec") =
+        some (gen.recursor family)) :
+    env.HasType gen.recUvars
+      ((VExpr.liftTelN
+          (gen.familyCount + gen.minorCount)
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (VExpr.appN
+        (gen.recBase
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination).length constructor.owner)
+        (((constructor.ctor.resultIndicesR source.uvars
+              gen.elimination).map fun e =>
+            e.liftN (gen.familyCount + gen.minorCount)
+              (constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length) ++
+          [VExpr.appN
+            (.const constructor.ctor.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange
+                ((constructor.ctor.fieldsR source.uvars source.nparams
+                    gen.elimination).length +
+                  gen.familyCount + gen.minorCount)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (constructor.ctor.fieldsR source.uvars source.nparams
+                  gen.elimination).length)]))
+      (VExpr.appN
+        (.bvar
+          (gen.familyCount - 1 - constructor.owner +
+            gen.minorCount +
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length))
+        (((constructor.ctor.resultIndicesR source.uvars
+              gen.elimination).map fun e =>
+            e.liftN (gen.familyCount + gen.minorCount)
+              (constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length) ++
+          [VExpr.appN
+            (.const constructor.ctor.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange
+                ((constructor.ctor.fieldsR source.uvars source.nparams
+                    gen.elimination).length +
+                  gen.familyCount + gen.minorCount)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (constructor.ctor.fieldsR source.uvars source.nparams
+                  gen.elimination).length)])) := by
+  obtain ⟨family, hfamily, howner, hname, hindices⟩ :=
+    (S.ctorWF constructor hconstructor).owner
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams
+    gen.elimination
+  let common := gen.familyCount + gen.minorCount
+  let mid := gen.minorTypes.reverse ++ gen.motiveTypes.reverse
+  have hmid : mid.length = common := by
+    simp only [mid, common, List.length_append, List.length_reverse,
+      gen.minorTypes_length, gen.motiveTypes_length]
+    omega
+  have hSp₀ := S.result_transport hconstructor hfamily hindices
+    mid hmid [] (d := 0) rfl
+  have hSp : env.SpineWF gen.recUvars
+      ((VExpr.liftTelN common Bs 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN (Bs.length + common)
+          (gen.idxTel family) 0)
+        (.sort (gen.validated.resultLevel.inst gen.sourceLevels)))
+      ((constructor.ctor.resultIndicesR source.uvars gen.elimination).map
+        fun e => e.liftN common Bs.length)
+      (.sort (gen.validated.resultLevel.inst gen.sourceLevels)) := by
+    simpa [Bs, common, mid, List.append_assoc,
+      Nat.add_assoc] using hSp₀
+  have hidxLen :
+      ((constructor.ctor.resultIndicesR source.uvars gen.elimination).map
+        fun e => e.liftN common Bs.length).length =
+      (gen.idxTel family).length := by
+    have hlen := hSp.forallN_sort_length
+    simpa only [VExpr.liftTelN_length] using hlen
+  have ha := S.ctorAppRule_hasType hconstructor hfamily hname
+  have hout := S.recApp_hasType hfamily (hrecs family hfamily)
+    (VExpr.liftTelN common Bs 0).reverse
+    (by simpa [common, List.length_reverse, VExpr.liftTelN_length,
+        Nat.add_assoc] using hSp)
+    hidxLen
+    (by simpa only [Bs, common, List.length_reverse,
+        VExpr.liftTelN_length] using ha)
+  simpa only [Bs, common, howner, List.length_reverse,
+    VExpr.liftTelN_length] using hout
+
+/-- Every recursive field contributes a well-typed rule call to the
+recursor selected by that field's certified target family. -/
+theorem blockRuleCall_hasType
+    {constructor : NormalizedBlockCtor}
+    (hconstructor : constructor ∈ gen.flatCtors)
+    (hrecs : ∀ family ∈ gen.families,
+      env.constants (.str family.raw.name "rec") =
+        some (gen.recursor family))
+    {r : RecArg}
+    (hr : r ∈ constructor.ctor.recArgsR source.uvars gen.elimination) :
+    env.HasType gen.recUvars
+      ((VExpr.liftTelN
+          (gen.familyCount + gen.minorCount)
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (BlockGenerationChecked.blockRuleCall
+        (gen.familyCount + gen.minorCount)
+        (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).length
+        (gen.recBase
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination).length r.targetType) r)
+      (BlockGenerationChecked.blockRuleIH
+        gen.familyCount gen.minorCount
+        (constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination).length r) := by
+  obtain ⟨r₀, hr₀, rfl⟩ := NormalizedCtor.recArgsR_mem hr
+  obtain ⟨family, hfamily, hord, ⟨Bview, hBview, hshape⟩, hsem⟩ :=
+    (S.ctorWF constructor hconstructor).recursive r₀ hr₀
+  let ls := gen.sourceLevels
+  let r := r₀.instL ls
+  let d := gen.familyCount
+  let k := gen.minorCount
+  let common := d+k
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams
+    gen.elimination
+  let m := Bs.length
+  let j := r₀.fieldIndex
+  let Fs := VExpr.liftTelN common Bs 0
+  let As := BlockGenerationChecked.blockRuleBinders common m r
+  let idxs := r.indices.map fun e =>
+    (e.liftN common (r.fieldIndex+r.binders.length)).liftN
+      (m-r.fieldIndex) r.binders.length
+  let Γ := Fs.reverse ++
+    (gen.minorTypes.reverse ++
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+  have hjview : r₀.fieldIndex < constructor.ctor.view.fields.length :=
+    (List.getElem?_eq_some_iff.1 hBview).1
+  have hjm : j < m := by
+    have hfields := gen.flatCtor_fields_length hconstructor
+    simp only [j, m, Bs, NormalizedCtor.fieldsR_length]
+    omega
+  have hjraw : r₀.fieldIndex <
+      (constructor.ctor.rawFields source.nparams).length := by
+    simpa [j, m, Bs, NormalizedCtor.fieldsR_length] using hjm
+  let Braw :=
+    (constructor.ctor.rawFields source.nparams)[r₀.fieldIndex]
+  have hBraw :
+      (constructor.ctor.rawFields source.nparams)[r₀.fieldIndex]? =
+        some Braw :=
+    List.getElem?_eq_getElem hjraw
+  have hcommon :
+      (gen.minorTypes.reverse ++ gen.motiveTypes.reverse).length =
+        common := by
+    simp only [List.length_append, List.length_reverse,
+      gen.minorTypes_length, gen.motiveTypes_length]
+    dsimp only [common, d, k]
+    omega
+  have hFsLen : Fs.length = m := by
+    simp [Fs, m, VExpr.liftTelN_length]
+  have ht := S.recArg_transport hconstructor hfamily hsem hjview
+    (gen.minorTypes.reverse ++ gen.motiveTypes.reverse) hcommon
+    (Fs.drop j).reverse (d := m-j) (by
+      simp only [List.length_reverse, List.length_drop, hFsLen])
+  dsimp only [r, j, RecArg.instL] at ht
+  have hctx :
+      (Fs.drop j).reverse ++
+          ((VExpr.liftTelN common (Bs.take j) 0).reverse ++
+            ((gen.minorTypes.reverse ++ gen.motiveTypes.reverse) ++
+              gen.paramsTel.reverse)) = Γ := by
+    dsimp only [Γ, Fs]
+    rw [← VExpr.liftTelN_take, List.append_assoc,
+      ← List.append_assoc
+        (((VExpr.liftTelN common Bs 0).drop j).reverse),
+      ← List.reverse_append, List.take_append_drop,
+      ← List.append_assoc]
+  have htel : env.OnTel gen.recUvars Γ As := by
+    rw [hctx] at ht
+    simpa [r, As, m, common, j, RecArg.instL,
+      BlockGenerationChecked.blockRuleBinders] using ht.1
+  have hsp : env.SpineWF gen.recUvars
+      (As.reverse ++ Γ)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (m + r.binders.length + common)
+          (gen.idxTel family) 0)
+        (.sort (gen.validated.resultLevel.inst ls)))
+      idxs
+      (.sort (gen.validated.resultLevel.inst ls)) := by
+    rw [hctx] at ht
+    simpa [r, As, idxs, m, common, j, ls,
+      RecArg.instL, BlockGenerationChecked.blockRuleBinders,
+      List.append_assoc,
+      show j + r₀.binders.length + common + (m-j) =
+        m + r₀.binders.length + common by omega] using ht.2
+  have hF : Γ[m-1-j]? =
+      some ((Braw.instL ls).liftN common j) := by
+    dsimp only [Γ, Fs]
+    rw [List.getElem?_append_left
+        (by
+          simp only [List.length_reverse, VExpr.liftTelN_length]
+          omega),
+      List.getElem?_reverse (by rw [hFsLen]; omega),
+      VExpr.liftTelN_length,
+      show m - 1 - (m - 1 - j) = j by omega,
+      VExpr.liftTelN_getElem?,
+      NormalizedCtor.fieldsR_getElem?, hBraw]
+    simp [ls]
+  have hlu := Lookup.of_getElem? hF
+  rw [show m-1-j+1 = m-j by omega] at hlu
+  dsimp only [j, r] at hlu
+  have hf0 := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars) hlu
+  obtain ⟨u, hdom₀⟩ :=
+    S.emittedField_defeq hconstructor hBraw hBview
+  have hdom₁ := hdom₀.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hdomChecked : env.IsDefEq gen.recUvars
+      ((constructor.ctor.fieldsR source.uvars source.nparams
+          gen.elimination |>.take r₀.fieldIndex).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (Braw.instL ls) (Bview.instL ls) ((VExpr.sort u).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse, List.map_take] using hdom₁
+  have hprefix :=
+    S.generationFieldPrefix_ctx_rec hconstructor r₀.fieldIndex
+  have hdomGeneration := hdomChecked.defeqDFC S.ord
+    (hprefix.symm S.ord)
+  have hjlen : (Bs.take r₀.fieldIndex).length =
+      r₀.fieldIndex := by
+    simp only [Bs, NormalizedCtor.fieldsR,
+      List.length_take, List.length_map]
+    omega
+  have Wmid := Ctx.LiftN.consTel (n := common)
+    (Bs.take r₀.fieldIndex)
+    (Ctx.LiftN.zero (n := common) (Γ := gen.paramsTel.reverse)
+      (gen.minorTypes.reverse ++ gen.motiveTypes.reverse)
+      (h := hcommon))
+  rw [hjlen, Nat.add_zero] at Wmid
+  have hdom₂ := hdomGeneration.weakN S.ord Wmid
+  have Wstack := Ctx.LiftN.zero (n := m-j)
+    (Γ := (VExpr.liftTelN common (Bs.take j) 0).reverse ++
+      ((gen.minorTypes.reverse ++ gen.motiveTypes.reverse) ++
+        gen.paramsTel.reverse))
+    (Fs.drop j).reverse
+    (h := by
+      simp only [List.length_reverse, List.length_drop, hFsLen])
+  have hdom₃ := hdom₂.weakN S.ord Wstack
+  rw [hctx] at hdom₃
+  have hfView := hdom₃.defeq hf0
+  have hfield := blockMinor_fieldType_of_eq hshape common m 0
+    (by simpa [j] using hjm) gen.elimination
+  simp only [RecArg.instL] at hfield
+  dsimp only [j] at hfView
+  simp only [Nat.add_zero] at hfield
+  rw [hfield] at hfView
+  have hf := hfView.weakN S.ord
+    (Ctx.LiftN.zero (Γ := Γ) As.reverse)
+  have hmajor := VEnv.HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars)
+    (As := As)
+    (B := VExpr.appN (.const family.raw.name ls)
+      (VExpr.bvarRevRange
+        (m + r.binders.length + common) source.nparams ++ idxs))
+    (Δ := []) (Γ := Γ) (by
+      simpa [As, r, idxs, j, common, ls, RecArg.instL,
+        BlockGenerationChecked.blockRuleBinders,
+        BlockGenerationChecked.blockMinorBinders,
+        List.length_reverse, List.map_map,
+        Function.comp_def] using hf)
+  simp only [List.length_nil, VExpr.liftN_zero,
+    List.nil_append] at hmajor
+  have hAsLen : As.length = r.binders.length := by
+    simp [As, BlockGenerationChecked.blockRuleBinders,
+      VExpr.liftTelN_length]
+  have hmajor' : env.HasType gen.recUvars (As.reverse ++ Γ)
+      ((VExpr.bvar (m-1-r.fieldIndex+As.length)).appN
+        (VExpr.bvarRevRange 0 As.length))
+      (VExpr.appN (.const family.raw.name ls)
+        (VExpr.bvarRevRange
+          (m+r.binders.length+common) source.nparams ++ idxs)) := by
+    simpa [As, common, r, RecArg.instL,
+      BlockGenerationChecked.blockRuleBinders,
+      VExpr.liftN, liftVar_le, Nat.add_comm] using hmajor
+  rw [hAsLen] at hmajor'
+  have hlen : idxs.length = (gen.idxTel family).length := by
+    have hidx := hsem.2.forallN_sort_length
+    simp only [idxs, List.length_map, VExpr.liftTelN_length,
+      BlockGenerationChecked.idxTel] at hidx ⊢
+    simpa [r, RecArg.instL] using hidx.trans
+      (gen.shape.2.2.2.2 family hfamily).2.2.2.1.symm
+  have hcall := S.recApp_hasType hfamily (hrecs family hfamily)
+    (As.reverse ++ Fs.reverse)
+    (by
+      simpa [Γ, List.append_assoc, hAsLen, hFsLen,
+        common, d, k,
+        Nat.add_comm, Nat.add_left_comm,
+        Nat.add_assoc] using hsp)
+    hlen
+    (by
+      simpa [Γ, List.append_assoc, hAsLen, hFsLen,
+        common, d, k,
+        Nat.add_comm, Nat.add_left_comm,
+        Nat.add_assoc] using hmajor')
+  have hbaseLift :
+      (gen.recBase m r.targetType).liftN r.binders.length =
+        gen.recBase (m+r.binders.length) r.targetType := by
+    simp only [BlockGenerationChecked.recBase, VExpr.liftN_appN, VExpr.liftN]
+    rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _)]
+    apply congrArg (VExpr.appN _)
+    apply VExpr.bvarRevRange_congr
+    omega
+  have hlam := HasType.lamN htel (by
+    simpa [Γ, Fs, hAsLen, hFsLen, hbaseLift,
+      List.append_assoc, hord, r, RecArg.instL,
+      common, d, k,
+      Nat.add_comm, Nat.add_left_comm,
+      Nat.add_assoc] using hcall)
+  have hrecPos : r₀.binders.length + m = m + r₀.binders.length := by
+    omega
+  have hfieldPos :
+      r₀.binders.length + (m-1-r₀.fieldIndex) =
+        m-1-r₀.fieldIndex+r₀.binders.length := by
+    omega
+  have hmotivePos :
+      r₀.binders.length +
+          (gen.familyCount - 1 - r₀.targetType + (gen.minorCount+m)) =
+        gen.familyCount - 1 - r₀.targetType + gen.minorCount + m +
+          r₀.binders.length := by
+    ac_rfl
+  rw [hrecPos, hfieldPos, hmotivePos] at hlam
+  change env.HasType gen.recUvars Γ
+    (BlockGenerationChecked.blockRuleCall common m
+      (gen.recBase m r.targetType) r)
+    (VExpr.forallN As
+      (VExpr.appN
+        (.bvar (d - 1 - r.targetType + k + m + r.binders.length))
+        (idxs ++
+          [VExpr.appN
+            (.bvar (m - 1 - r.fieldIndex + r.binders.length))
+            (VExpr.bvarRevRange 0 r.binders.length)])))
+  have hcallEq :
+      BlockGenerationChecked.blockRuleCall common m
+          (gen.recBase m r.targetType) r =
+        VExpr.lamN As
+          (VExpr.appN
+            (gen.recBase (m+r.binders.length) r.targetType)
+            (idxs ++
+              [VExpr.appN
+                (.bvar (m-1-r.fieldIndex+r.binders.length))
+                (VExpr.bvarRevRange 0 r.binders.length)])) := by
+    simp [BlockGenerationChecked.blockRuleCall, As, idxs, hbaseLift]
+  rw [hcallEq]
+  simpa [r, RecArg.instL, List.length_map] using hlam
+
+/-- The selected flattened mutual minor applied to its fields and routed
+recursive calls has the owner's motive as its result. -/
+theorem minorApp_hasType {i : Nat}
+    {constructor : NormalizedBlockCtor}
+    (hci : gen.flatCtors[i]? = some constructor)
+    (hrecs : ∀ family ∈ gen.families,
+      env.constants (.str family.raw.name "rec") =
+        some (gen.recursor family)) :
+    env.HasType gen.recUvars
+      ((VExpr.liftTelN
+          (gen.familyCount + gen.minorCount)
+          (constructor.ctor.fieldsR source.uvars source.nparams
+            gen.elimination) 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.bvar
+          (gen.minorCount - 1 - i +
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length))
+        (VExpr.bvarRevRange 0
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length ++
+          (constructor.ctor.recArgsR source.uvars gen.elimination).map
+            fun r =>
+              BlockGenerationChecked.blockRuleCall
+                (gen.familyCount + gen.minorCount)
+                (constructor.ctor.fieldsR source.uvars source.nparams
+                  gen.elimination).length
+                (gen.recBase
+                  (constructor.ctor.fieldsR source.uvars source.nparams
+                    gen.elimination).length r.targetType) r))
+      (VExpr.appN
+        (.bvar
+          (gen.familyCount - 1 - constructor.owner + gen.minorCount +
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination).length))
+        (((constructor.ctor.resultIndicesR source.uvars
+              gen.elimination).map fun e =>
+            e.liftN (gen.familyCount + gen.minorCount)
+              (constructor.ctor.fieldsR source.uvars source.nparams
+                gen.elimination).length) ++
+          [VExpr.appN
+            (.const constructor.ctor.raw.name gen.sourceLevels)
+            (VExpr.bvarRevRange
+                ((constructor.ctor.fieldsR source.uvars source.nparams
+                    gen.elimination).length + gen.familyCount +
+                  gen.minorCount)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (constructor.ctor.fieldsR source.uvars source.nparams
+                  gen.elimination).length)])) := by
+  obtain ⟨hik, -⟩ := List.getElem?_eq_some_iff.1 hci
+  have hconstructor := List.mem_of_getElem? hci
+  obtain ⟨family, hfamily, howner, -, -⟩ :=
+    (S.ctorWF constructor hconstructor).owner
+  let d := gen.familyCount
+  let k := gen.minorCount
+  let common := d+k
+  let Bs := constructor.ctor.fieldsR source.uvars source.nparams
+    gen.elimination
+  let m := Bs.length
+  let rs := constructor.ctor.recArgsR source.uvars gen.elimination
+  let Fs := VExpr.liftTelN common Bs 0
+  let D := VExpr.appN
+    (.bvar (d - 1 - constructor.owner + m + rs.length))
+    (((constructor.ctor.resultIndicesR source.uvars
+          gen.elimination).map fun e =>
+        (e.liftN d m).liftN rs.length) ++
+      [VExpr.appN
+        (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (rs.length+m+d) source.nparams ++
+          VExpr.bvarRevRange rs.length m)])
+  let Dfin := VExpr.appN
+    (.bvar (d - 1 - constructor.owner + k + m))
+    (((constructor.ctor.resultIndicesR source.uvars
+          gen.elimination).map fun e => e.liftN common m) ++
+      [VExpr.appN
+        (.const constructor.ctor.raw.name gen.sourceLevels)
+        (VExpr.bvarRevRange (m+common) source.nparams ++
+          VExpr.bvarRevRange 0 m)])
+  have hownerLt : constructor.owner < d := by
+    rw [← howner]
+    simpa [d] using gen.family_ordinal_lt hfamily
+  have hrsLt : ∀ r ∈ rs, r.fieldIndex < m := by
+    intro r hr
+    obtain ⟨r₀, hr₀, rfl⟩ :=
+      NormalizedCtor.recArgsR_mem (show
+        r ∈ constructor.ctor.recArgsR source.uvars gen.elimination from
+          by simpa [rs] using hr)
+    obtain ⟨family₀, hfamily₀, htarget,
+        ⟨Bview, hfield, hshape⟩, hsem⟩ :=
+      (S.ctorWF constructor hconstructor).recursive r₀ hr₀
+    have hj := (List.getElem?_eq_some_iff.1 hfield).1
+    simp only [RecArg.instL]
+    dsimp only [m, Bs]
+    rw [NormalizedCtor.fieldsR_length]
+    rw [gen.flatCtor_fields_length hconstructor]
+    exact hj
+  have hik' : i < k := by
+    simpa [k] using hik
+  rw [VExpr.appN_append]
+  have hminorAt :
+      gen.minorTypes[i]? =
+        some ((gen.minorType constructor).liftN i) := by
+    simpa [BlockGenerationChecked.minorTypes, hci] using
+      (gen.minorTypesAux_getElem? gen.flatCtors 0 i)
+  have hlu0 :
+      (Fs.reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveTypes.reverse ++ gen.paramsTel.reverse)))[
+          k - 1 - i + m]? =
+        some ((gen.minorType constructor).liftN i) := by
+    rw [getElem?_rstack_mid _ _ _
+        (by simp [Fs, m, VExpr.liftTelN_length] <;> omega)
+        (by simp [Fs, m, k, gen.minorTypes_length,
+          VExpr.liftTelN_length] <;> omega),
+      show k - 1 - i + m - Fs.reverse.length = k - 1 - i by
+        simp [Fs, m, VExpr.liftTelN_length],
+      List.getElem?_reverse (by
+        rw [gen.minorTypes_length]
+        omega),
+      show gen.minorTypes.length - 1 - (k - 1 - i) = i by
+        rw [gen.minorTypes_length]
+        dsimp only [k]
+        omega,
+      hminorAt]
+  have hlu := Lookup.of_getElem? hlu0
+  rw [VExpr.liftN_liftN,
+    show i + (k - 1 - i + m + 1) = m+k by omega] at hlu
+  have hminorEq :
+      (gen.minorType constructor).liftN (m+k) =
+        (VExpr.forallN Fs
+          ((VExpr.forallN
+            (BlockGenerationChecked.blockIHsFromRecArgs d m rs 0)
+            D).liftN k m)).liftN m := by
+    simp only [BlockGenerationChecked.minorType]
+    conv => lhs; rw [VExpr.liftN_forallN,
+        VExpr.liftTelN_liftTelN,
+        liftTelN_congr _ _
+          (show d + (m+k) = common+m by
+            dsimp only [common]
+            omega),
+        show 0 + (VExpr.liftTelN d Bs 0).length = m by
+          simp [m, VExpr.liftTelN_length]]
+    conv => rhs; rw [VExpr.liftN_forallN,
+        VExpr.liftTelN_liftTelN,
+        show 0 + Fs.length = m by
+          simp [Fs, m, VExpr.liftTelN_length],
+        VExpr.liftN'_liftN_hi,
+        Nat.add_comm k m]
+  have hfields := HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars)
+    (As := Fs)
+    (B := (VExpr.forallN
+      (BlockGenerationChecked.blockIHsFromRecArgs d m rs 0)
+      D).liftN k m)
+    (Δ := [])
+    (Γ := gen.minorTypes.reverse ++
+      (gen.motiveTypes.reverse ++ gen.paramsTel.reverse))
+    (f := .bvar (k-1-i+m))
+    (by
+      have hb := VEnv.HasType.bvar
+        (env := env) (U := gen.recUvars) hlu
+      rw [hminorEq] at hb
+      simpa [Fs, VExpr.liftTelN_length] using hb)
+  simp only [List.length_nil, VExpr.liftN_zero] at hfields
+  rw [BlockGenerationChecked.blockIHs_liftN'
+    d m k rs hrsLt 0 D (cut := m) rfl] at hfields
+  have hD : D.liftN k (m+0+rs.length) =
+      Dfin.liftN rs.length := by
+    dsimp only [D, Dfin]
+    rw [VExpr.liftN_appN, VExpr.liftN_appN,
+      List.map_append, List.map_append,
+      List.map_map, List.map_map]
+    show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+    congr 1
+    · show
+        VExpr.bvar
+            (liftVar k
+              (d - 1 - constructor.owner + m + rs.length)
+              (m+0+rs.length)) =
+          VExpr.bvar
+            (liftVar rs.length
+              (d - 1 - constructor.owner + k + m) 0)
+      rw [liftVar_le (by omega), liftVar_le (Nat.zero_le _)]
+      congr 1
+      omega
+    · congr 1
+      · apply List.map_congr_left
+        intro e _
+        simp only [Function.comp_apply]
+        rw [show m+0+rs.length = m+rs.length by omega,
+          VExpr.liftN_liftN_midN e d k rs.length (Nat.zero_le _)]
+      · congr 1
+        simp only []
+        rw [show m+0+rs.length = m+rs.length by omega,
+          VExpr.liftN_appN, VExpr.liftN_appN,
+          List.map_append, List.map_append,
+          bvarRevRange_liftN_ge _ _ _ _ (by omega),
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+          bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+          bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+          VExpr.bvarRevRange_congr source.nparams
+            (show k + (rs.length+m+d) =
+              rs.length + (m+common) by
+                dsimp only [common]
+                omega),
+          VExpr.bvarRevRange_congr m
+            (show rs.length = rs.length+0 by omega)]
+        rfl
+  rw [hD] at hfields
+  have hres := hasType_appN_blockRuleIHs
+    (env := env) (gen := gen) (d := d) (m := m) (k := k)
+    (rs := rs)
+    (argOf := fun r =>
+      BlockGenerationChecked.blockRuleCall common m
+        (gen.recBase m r.targetType) r)
+    (Dfin := Dfin)
+    (fun r hr => by
+      simpa [d, k, common, m, Bs] using
+        S.blockRuleCall_hasType hconstructor hrecs
+          (show r ∈ constructor.ctor.recArgsR source.uvars
+              gen.elimination by simpa [rs] using hr))
+    hfields
+  simpa [Fs, Bs, m, rs, d, k, common, Dfin,
+    VExpr.liftTelN_length, Nat.add_assoc] using hres
+
+/-- Every flattened mutual iota rule is well formed once all family
+recursors are available. -/
+theorem rule_WF {i : Nat}
+    {constructor : NormalizedBlockCtor}
+    (hci : gen.flatCtors[i]? = some constructor)
+    (hrecs : ∀ family ∈ gen.families,
+      env.constants (.str family.raw.name "rec") =
+        some (gen.recursor family)) :
+    (gen.rule i constructor).WF env := by
+  have hconstructor := List.mem_of_getElem? hci
+  refine ⟨?_, ?_⟩
+  · show env.HasType gen.recUvars []
+      (VExpr.lamN
+        (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes ++
+          VExpr.liftTelN
+            (gen.familyCount + gen.minorCount)
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination) 0)
+        _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN (S.ruleBinders_onTel hconstructor) ?_
+    simp only [List.reverse_append, List.append_nil,
+      List.append_assoc]
+    simpa only [Nat.add_assoc] using
+      S.recRuleApp_hasType hconstructor hrecs
+  · show env.HasType gen.recUvars []
+      (VExpr.lamN
+        (gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes ++
+          VExpr.liftTelN
+            (gen.familyCount + gen.minorCount)
+            (constructor.ctor.fieldsR source.uvars source.nparams
+              gen.elimination) 0)
+        _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN (S.ruleBinders_onTel hconstructor) ?_
+    simp only [List.reverse_append, List.append_nil,
+      List.append_assoc]
+    simpa only [Nat.add_assoc] using
+      S.minorApp_hasType hci hrecs
+
+end BlockGenerationEnv
+
+/-- The public inductive-declaration contract is monotone in its prefix
+environment. This lets replay fixtures prepend independently verified
+declarations without rebuilding the block's Stage-3 derivation. -/
+theorem WF.mono {env env' : VEnv} (henv : env ≤ env')
+    (H : VInductDecl.WF env decl) : VInductDecl.WF env' decl := by
+  refine ⟨H.1, fun ty hty => ?_⟩
+  obtain ⟨htel, hctors⟩ := H.2 ty hty
+  exact ⟨htel.mono henv, fun c hc =>
+    ⟨fieldsWF_mono henv (hctors c hc).1, (hctors c hc).2.mono henv⟩⟩
+
+/-- Extract the carried index-spine typing of the recursive field at
+position `q` from a `fieldsWF` chain. -/
+theorem fieldsWF_spine {U : Nat} {T : Name} {np : Nat} {env : VEnv} {l : VLevel}
+    {Is : List VExpr} : ∀ {Bs : List VExpr} {Γ₀ : List VExpr} {j₀ : Nat},
+    fieldsWF U T np env l Is Γ₀ j₀ Bs →
+    ∀ q B, Bs[q]? = some B → isRecField U T np Is.length (j₀+q) B = true →
+    env.SpineWF U ((Bs.take q).reverse ++ Γ₀)
+      (VExpr.forallN (VExpr.liftTelN (j₀+q) Is 0) (.sort l)) (recFieldIdxs np B) (.sort l)
+  | [], _, _, _, q, B, hB, _ => by simp at hB
+  | B' :: Bs, Γ₀, j₀, ⟨_, hSp, hT⟩, 0, B, hB, hrec => by
+    obtain rfl : B' = B := by simpa using hB
+    simpa using hSp (by simpa using hrec)
+  | B' :: Bs, Γ₀, j₀, ⟨_, _, hT⟩, q+1, B, hB, hrec => by
+    have := fieldsWF_spine hT q B (by simpa using hB)
+      (by rwa [show j₀+1+q = j₀+(q+1) from by omega])
+    rw [show j₀+1+q = j₀+(q+1) from by omega] at this
+    simpa [List.append_assoc] using this
+
+/-- Extract the uniform semantic evidence for any analyzed recursive
+argument. Direct fields are re-expressed as the empty-telescope case; genuine
+recursive Pi fields return the evidence stored by `fieldsWF`. -/
+theorem fieldsWF_recArg {U : Nat} {T : Name} {np : Nat} {env : VEnv} {l : VLevel}
+    {Is : List VExpr} : ∀ {Bs : List VExpr} {Γ₀ : List VExpr} {j₀ : Nat},
+    fieldsWF U T np env l Is Γ₀ j₀ Bs →
+    ∀ q B r, Bs[q]? = some B →
+      recArg? U T np Is.length (j₀+q) B = some r →
+      r.WF U env l Is ((Bs.take q).reverse ++ Γ₀)
+  | [], _, _, _, q, B, r, hB, _ => by simp at hB
+  | B' :: Bs, Γ₀, j₀, ⟨hclass, hSp, htail⟩, 0, B, r, hB, hr => by
+    obtain rfl : B' = B := by simpa using hB
+    simp only [Nat.add_zero] at hr
+    rcases hclass with hdirect | hfun | ⟨hnone, -, -, -⟩
+    · have hcanon := recArg?_of_isRecField hdirect
+      rw [hcanon] at hr
+      obtain rfl := Option.some.inj hr
+      exact ⟨trivial, by simpa [RecArg.WF] using hSp hdirect⟩
+    · obtain ⟨r', hr', -, hwf⟩ := hfun
+      rw [hr'] at hr
+      obtain rfl := Option.some.inj hr
+      simpa using hwf
+    · rw [hnone] at hr
+      contradiction
+  | B' :: Bs, Γ₀, j₀, ⟨_, _, htail⟩, q+1, B, r, hB, hr => by
+    have h := fieldsWF_recArg htail q B r (by simpa using hB)
+      (by rwa [show j₀+1+q = j₀+(q+1) from by omega])
+    simpa [List.append_assoc] using h
+
+namespace GenerationEnv
+
+variable {source : VInductDecl} {gen : GenerationChecked source}
+  {env : VEnv} (S : GenerationEnv gen env)
+include S
+-- `S` is included throughout so every lemma below is reachable as `S.lemma`,
+-- including those whose statement and proof never mention it.
+set_option linter.unusedSectionVars false
+
+/-- Checked field semantics for one paired constructor, re-indexed onto the
+raw block header used by mixed generation. -/
+theorem viewFieldsWF {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    fieldsWF source.uvars gen.block.sourceType.name source.nparams env
+      gen.block.checked.resultLevel gen.block.checked.indices
+      gen.block.checked.params.reverse 0 ctor.view.fields := by
+  obtain ⟨c, hc, hview⟩ := gen.viewCtor_ofDirect hctor
+  have h := (S.checked.2 c hc).1
+  rw [hview]
+  simpa [CheckedCtor.ofDirect, gen.block.uvars_eq,
+    gen.block.nparams_eq, gen.block.sourceType_name_eq] using h
+
+/-- Every retained recursive descriptor comes from re-analysis of the field
+at its recorded position in the checked view. -/
+theorem viewRecArg_data {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r : RecArg}
+    (hr : r ∈ ctor.view.recursive) :
+    ∃ B, ctor.view.fields[r.fieldIndex]? = some B ∧
+      recArg? source.uvars gen.block.sourceType.name source.nparams
+        gen.block.checked.indices.length r.fieldIndex B = some r := by
+  obtain ⟨c, -, hview⟩ := gen.viewCtor_ofDirect hctor
+  rw [hview] at hr ⊢
+  simp only [CheckedCtor.ofDirect] at hr ⊢
+  obtain ⟨B, hB, hrec⟩ := recArgs_getElem r hr
+  exact ⟨B, by simpa using hB, hrec⟩
+
+/-- Retained recursive descriptors have the checked family-index arity. -/
+theorem viewRecArg_indices_length {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r : RecArg}
+    (hr : r ∈ ctor.view.recursive) :
+    r.indices.length = gen.block.checked.indices.length := by
+  obtain ⟨B, hB, hrec⟩ := S.viewRecArg_data hctor hr
+  exact (recArg?_eq hrec).2.2.2.1
+
+/-- Retained recursive descriptors point inside the normalized field list. -/
+theorem viewRecArg_lt {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r : RecArg}
+    (hr : r ∈ ctor.view.recursive) :
+    r.fieldIndex < ctor.view.fields.length := by
+  obtain ⟨c, -, hview⟩ := gen.viewCtor_ofDirect hctor
+  rw [hview] at hr ⊢
+  simp only [CheckedCtor.ofDirect] at hr ⊢
+  simpa using recArgs_lt r hr
+
+/-- The checked-view certificate supplies recursive-argument semantics in
+the exact normalized prefix context. -/
+theorem viewRecArg_WF {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r : RecArg}
+    (hr : r ∈ ctor.view.recursive) :
+    r.WF source.uvars env gen.block.checked.resultLevel
+      gen.block.checked.indices
+      ((ctor.view.fields.take r.fieldIndex).reverse ++
+        gen.block.checked.params.reverse) := by
+  obtain ⟨B, hB, hrec⟩ := S.viewRecArg_data hctor hr
+  have h := fieldsWF_recArg (S.viewFieldsWF hctor)
+    r.fieldIndex B r hB (by simpa using hrec)
+  simpa using h
+
+/-- Definitionally equal raw/view contexts at any constructor-field prefix.
+This is the structural bridge used before instantiation and weakening. -/
+theorem emittedPrefix_ctx {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) (j : Nat) :
+    env.IsDefEqCtx source.uvars []
+      ((ctor.rawFields source.nparams |>.take j).reverse ++
+        gen.block.checked.params.reverse)
+      ((ctor.view.fields.take j).reverse ++
+        gen.block.checked.params.reverse) := by
+  have h := ((S.ctorWF ctor hctor).emittedTel.take
+    (source.nparams + j)).ctx
+  have hviewLen :
+      gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hraw :
+      (gen.block.checked.params ++ ctor.rawFields source.nparams).take
+          (source.nparams + j) =
+        gen.block.checked.params ++
+          (ctor.rawFields source.nparams).take j := by
+    rw [← hviewLen]
+    rw [List.take_append, List.take_of_length_le (by omega)]
+    simp
+  have hview :
+      (gen.block.checked.params ++ ctor.view.fields).take
+          (source.nparams + j) =
+        gen.block.checked.params ++ ctor.view.fields.take j := by
+    rw [← hviewLen]
+    rw [List.take_append, List.take_of_length_le (by omega)]
+    simp
+  simp only [NormalizedCtor.emittedBinders,
+    NormalizedCtor.viewBinders] at h
+  rw [hraw, hview] at h
+  simpa [List.reverse_append] using h
+
+/-- The pointwise raw/view field-domain equality at a paired position, in
+the preceding raw context. -/
+theorem emittedField_defeq {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {j : Nat} {B B' : VExpr}
+    (hB : (ctor.rawFields source.nparams)[j]? = some B)
+    (hB' : ctor.view.fields[j]? = some B') :
+    ∃ u, env.IsDefEq source.uvars
+      ((ctor.rawFields source.nparams |>.take j).reverse ++
+        gen.block.checked.params.reverse)
+      B B' (.sort u) := by
+  have hviewLen :
+      gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hraw :
+      getElem?
+        (gen.block.checked.params ++ ctor.rawFields source.nparams)
+        (source.nparams + j) = some B := by
+    rw [List.getElem?_append_right (by
+      rw [hviewLen]
+      omega), hviewLen]
+    simpa using hB
+  have hview :
+      getElem?
+        (gen.block.checked.params ++ ctor.view.fields)
+        (source.nparams + j) = some B' := by
+    rw [List.getElem?_append_right (by
+      rw [hviewLen]
+      omega), hviewLen]
+    simpa using hB'
+  obtain ⟨u, h⟩ :=
+    (S.ctorWF ctor hctor).emittedTel.getElem? hraw hview
+  have htake :
+      (gen.block.checked.params ++ ctor.rawFields source.nparams).take
+          (source.nparams + j) =
+        gen.block.checked.params ++
+          (ctor.rawFields source.nparams).take j := by
+    rw [← hviewLen]
+    rw [List.take_append, List.take_of_length_le (by omega)]
+    simp
+  simp only [NormalizedCtor.emittedBinders] at h
+  rw [htake, List.reverse_append] at h
+  exact ⟨u, by simpa using h⟩
+
+/-- Recursive-argument semantics transported from the checked view into the
+raw constructor-field prefix that mixed artifacts actually bind. -/
+theorem rawRecArg_WF {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r : RecArg}
+    (hr : r ∈ ctor.view.recursive) :
+    r.WF source.uvars env gen.block.checked.resultLevel
+      gen.block.checked.indices
+      ((ctor.rawFields source.nparams |>.take r.fieldIndex).reverse ++
+        gen.block.checked.params.reverse) := by
+  exact (S.viewRecArg_WF hctor hr).defeqDFC S.ord
+    ((S.emittedPrefix_ctx hctor r.fieldIndex).symm S.ord)
+
+/-- The family telescope contract restricted to the index suffix. -/
+theorem rawIndexTel_defeq :
+    env.TelDefEq source.uvars gen.block.rawParams.reverse
+      gen.block.rawIndices gen.block.checked.indices := by
+  have h := S.familyTel.drop source.nparams
+  have hrawTake :
+      (gen.block.rawParams ++ gen.block.rawIndices).take source.nparams =
+        gen.block.rawParams := by
+    rw [← gen.shape.1, List.take_append, List.take_length]
+    simp
+  have hrawDrop :
+      (gen.block.rawParams ++ gen.block.rawIndices).drop source.nparams =
+        gen.block.rawIndices := by
+    rw [← gen.shape.1, List.drop_append]
+    simp
+  have hviewLen :
+      gen.block.checked.params.length = source.nparams :=
+    gen.shape.2.1.symm.trans gen.shape.1
+  have hviewDrop :
+      (gen.block.checked.params ++ gen.block.checked.indices).drop
+          source.nparams =
+        gen.block.checked.indices := by
+    rw [← hviewLen, List.drop_append]
+    simp
+  rw [hrawTake, hrawDrop, hviewDrop] at h
+  simpa using h
+
+/-- The raw/view index relation transported to the checked parameter base
+used by generated artifacts. -/
+theorem emittedIndexTel_defeq :
+    env.TelDefEq source.uvars gen.block.checked.params.reverse
+      gen.block.rawIndices gen.block.checked.indices :=
+  S.rawIndexTel_defeq.defeqDFC S.ord S.rawParams_ctx
+
+/-- The raw/view index telescope relation transported into recursor
+universes. -/
+theorem rawIndexTel_defeq_rec :
+    env.TelDefEq (gen.recUvars) gen.paramsTel.reverse gen.idxTel
+      (gen.block.checked.indices.map
+        (VExpr.instL (gen.sourceLevels))) := by
+  have hdecl := S.emittedIndexTel_defeq.defeqDFC S.ord
+    (S.generationParams_ctx.symm S.ord)
+  have h := hdecl.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  simpa [GenerationChecked.paramsTel, GenerationChecked.idxTel,
+    List.map_reverse] using h
+
+/-- Transport all retained recursive-argument evidence into a mixed
+minor/rule context. Raw constructor fields and raw family indices are the
+emitted surfaces; recursive classification and index expressions remain the
+checked-view data. -/
+theorem recArg_transport {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r₀ : RecArg}
+    (hr₀ : r₀ ∈ ctor.view.recursive)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    let r := r₀.instL (gen.sourceLevels)
+    let As := VExpr.liftTelN d
+      (VExpr.liftTelN g r.binders r.fieldIndex) 0
+    env.OnTel (gen.recUvars)
+        (As₂ ++ ((VExpr.liftTelN g
+          ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+            r.fieldIndex) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse))) As ∧
+      env.SpineWF (gen.recUvars)
+        (As.reverse ++
+          (As₂ ++ ((VExpr.liftTelN g
+            ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+              r.fieldIndex) 0).reverse ++
+            (mid ++ gen.paramsTel.reverse))))
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (r.fieldIndex + r.binders.length + g + d) gen.idxTel 0)
+          (.sort (gen.block.checked.resultLevel.inst
+            (gen.sourceLevels))))
+        (r.indices.map fun e =>
+          (e.liftN g (r.fieldIndex + r.binders.length)).liftN d
+            r.binders.length)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))) := by
+  dsimp only
+  let ls := gen.sourceLevels
+  have hjlt :
+      r₀.fieldIndex < (ctor.rawFields source.nparams).length := by
+    have hview := S.viewRecArg_lt hctor hr₀
+    have hfields :=
+      (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+    omega
+  have hsem := S.rawRecArg_WF hctor hr₀
+  have htel₁ := hsem.1.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hsp₁ := hsem.2.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have htelChecked : env.OnTel (gen.recUvars)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination |>.take
+        r₀.fieldIndex).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (r₀.binders.map (VExpr.instL ls)) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse, List.map_take] using htel₁
+  have hspChecked : env.SpineWF (gen.recUvars)
+      ((r₀.binders.map (VExpr.instL ls)).reverse ++
+        ((ctor.fieldsR source.uvars source.nparams gen.elimination |>.take
+          r₀.fieldIndex).reverse ++
+          (gen.block.checked.params.map (VExpr.instL ls)).reverse))
+      (VExpr.instL ls
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (r₀.fieldIndex + r₀.binders.length)
+            gen.block.checked.indices 0)
+          (.sort gen.block.checked.resultLevel)))
+      (r₀.indices.map (VExpr.instL ls))
+      (VExpr.instL ls (.sort gen.block.checked.resultLevel)) := by
+    simpa [List.map_append, List.map_reverse,
+      NormalizedCtor.fieldsR, List.map_take] using hsp₁
+  have hprefix := S.generationFieldPrefix_ctx_rec hctor r₀.fieldIndex
+  have htelGeneration := htelChecked.defeqDFC S.ord
+    (hprefix.symm S.ord)
+  have hfull := htelGeneration.extendDefEqCtx hprefix
+  have hspGeneration := hspChecked.defeqDFC S.ord (hfull.symm S.ord)
+  simp only [VExpr.instL_forallN, VExpr.liftTelN_instL] at htelGeneration hspGeneration
+  have hjlen :
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+        r₀.fieldIndex).length = r₀.fieldIndex := by
+    simp only [NormalizedCtor.fieldsR, List.length_take,
+      List.length_map]
+    omega
+  have hidxField := S.rawIndexTel_defeq_rec.weakN S.ord
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+        r₀.fieldIndex).reverse)
+  rw [List.length_reverse, hjlen] at hidxField
+  have hidxPrivate := hidxField.weakN S.ord
+    (Ctx.LiftN.zero
+      (Γ := ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+          r₀.fieldIndex).reverse ++ gen.paramsTel.reverse)
+      (r₀.binders.map (VExpr.instL ls)).reverse)
+  simp only [List.length_reverse, List.length_map] at hidxPrivate
+  rw [VExpr.liftTelN_liftTelN,
+    VExpr.liftTelN_liftTelN] at hidxPrivate
+  have hidxLen :
+      (r₀.indices.map (VExpr.instL ls)).length =
+        (VExpr.liftTelN
+          (r₀.fieldIndex + r₀.binders.length) gen.idxTel 0).length := by
+    simp only [List.length_map, VExpr.liftTelN_length,
+      GenerationChecked.idxTel]
+    exact (S.viewRecArg_indices_length hctor hr₀).trans
+      gen.shape.2.2.1.symm
+  have hspRaw :=
+    hidxPrivate.spine_sort S.ord hspGeneration hidxLen
+  have W₁ := Ctx.LiftN.consTel (n := mid.length)
+    ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+      r₀.fieldIndex)
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [hjlen, Nat.add_zero] at W₁
+  have htel₂ := htelGeneration.weakN S.ord W₁
+  have hsp₂ := hspRaw.weakN S.ord
+    (Ctx.LiftN.consTel
+      (r₀.binders.map (VExpr.instL ls)) W₁)
+  rw [hg] at htel₂ hsp₂
+  have W₂ := Ctx.LiftN.zero
+    (Γ := (VExpr.liftTelN g
+        ((ctor.fieldsR source.uvars source.nparams gen.elimination).take
+          r₀.fieldIndex) 0).reverse ++
+      (mid ++ gen.paramsTel.reverse)) As₂ (h := hd)
+  have htel₃ := htel₂.weakN S.ord W₂
+  have hsp₃ := hsp₂.weakN S.ord
+    (Ctx.LiftN.consTel
+      (VExpr.liftTelN g
+        (r₀.binders.map (VExpr.instL ls)) r₀.fieldIndex) W₂)
+  refine ⟨?_, ?_⟩
+  · simpa [ls, RecArg.instL, List.append_assoc] using htel₃
+  · simp only [List.length_map, VExpr.liftTelN_length,
+      Nat.add_zero] at hsp₃
+    rw [VExpr.liftN_forallN, VExpr.liftN_forallN,
+      VExpr.liftTelN_liftTelN_hi'
+        (r₀.fieldIndex + r₀.binders.length) g _ 0 (by omega),
+      VExpr.liftTelN_liftTelN_mid
+        (r₀.fieldIndex + r₀.binders.length + g) d _ 0
+        r₀.binders.length (Nat.zero_le _) (by omega)] at hsp₃
+    rw [show r₀.binders.length + r₀.fieldIndex =
+      r₀.fieldIndex + r₀.binders.length from Nat.add_comm _ _] at hsp₃
+    simpa [ls, RecArg.instL, VExpr.instL, VExpr.liftN,
+      List.map_map, Function.comp_def, List.append_assoc] using hsp₃
+
+end GenerationEnv
+
+/-- Syntactic lifting law for the mixed motive. -/
+theorem GenerationChecked.motiveType_liftN {source : VInductDecl}
+    (gen : GenerationChecked source) (n : Nat) :
+    gen.motiveType.liftN n =
+      VExpr.forallN (VExpr.liftTelN n gen.idxTel 0)
+        (.forallE
+          (VExpr.appN
+            (.const gen.block.sourceType.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange (n + gen.idxTel.length)
+                source.nparams ++
+              VExpr.bvarRevRange 0 gen.idxTel.length))
+          (.sort gen.motiveLevel)) := by
+  rw [show gen.motiveType =
+      VExpr.forallN gen.idxTel
+        (.forallE
+          (VExpr.appN
+            (.const gen.block.sourceType.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange gen.idxTel.length source.nparams ++
+              VExpr.bvarRevRange 0 gen.idxTel.length))
+          (.sort gen.motiveLevel)) from rfl,
+    VExpr.liftN_forallN]
+  refine congrArg _ ?_
+  show VExpr.forallE _ _ = VExpr.forallE _ _
+  refine congr (congrArg _ ?_) rfl
+  rw [VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+  rfl
+
+/-- Apply a mixed motive variable to a raw-index spine and a typed family
+major. -/
+theorem GenerationChecked.motiveVarApp_hasType {source : VInductDecl}
+    (gen : GenerationChecked source) {env : VEnv} {l : VLevel}
+    {Γ : List VExpr} {K : Nat} {idxs : List VExpr} {a : VExpr}
+    (hM : env.HasType (gen.recUvars) Γ (.bvar K)
+      (gen.motiveType.liftN (K+1)))
+    (hidx : env.SpineWF (gen.recUvars) Γ
+      (VExpr.forallN (VExpr.liftTelN (K+1) gen.idxTel 0)
+        (.sort l))
+      idxs (.sort l))
+    (hlen : idxs.length = gen.idxTel.length)
+    (ha : env.HasType (gen.recUvars) Γ a
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange (K+1) source.nparams ++ idxs))) :
+    env.HasType (gen.recUvars) Γ
+      (VExpr.appN (.bvar K) (idxs ++ [a])) (.sort gen.motiveLevel) := by
+  rw [gen.motiveType_liftN] at hM
+  have hshape := hidx.retarget
+    (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange (K+1 + gen.idxTel.length)
+            source.nparams ++
+          VExpr.bvarRevRange 0 gen.idxTel.length))
+      (.sort gen.motiveLevel))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _
+      (C := .const gen.block.sourceType.name
+        (gen.sourceLevels)) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _ (by rw [hlen]; omega),
+    show K+1+gen.idxTel.length-idxs.length = K+1 from by
+      rw [hlen, Nat.add_sub_cancel],
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hApp := hshape.hasType_appN hM
+  rw [VExpr.appN_append]
+  exact HasType.app hApp (by simpa using ha)
+
+/-- Mixed minor generation preserves constructor-list arity at every suffix
+depth. -/
+theorem GenerationChecked.minorTypesAux_length
+    {source : VInductDecl} (gen : GenerationChecked source) :
+    ∀ (ctors : List NormalizedCtor) (i : Nat),
+      (gen.minorTypesAux ctors i).length = ctors.length
+  | [], _ => rfl
+  | _ :: ctors, i => by
+    simp [GenerationChecked.minorTypesAux,
+      gen.minorTypesAux_length ctors (i+1)]
+
+/-- The complete mixed minor telescope has one entry per paired raw/view
+constructor. -/
+theorem GenerationChecked.minorTypes_length
+    {source : VInductDecl} (gen : GenerationChecked source) :
+    gen.minorTypes.length = gen.block.ctorPairs.length := by
+  simpa [GenerationChecked.minorTypes] using
+    gen.minorTypesAux_length gen.block.ctorPairs 0
+
+/-- Positional lookup through mixed minor generation. -/
+theorem GenerationChecked.minorTypesAux_getElem?
+    {source : VInductDecl} (gen : GenerationChecked source) :
+    ∀ (ctors : List NormalizedCtor) (i q : Nat),
+      (gen.minorTypesAux ctors i)[q]? =
+        ctors[q]?.map fun ctor =>
+          VExpr.liftN (i+q)
+            (GenerationChecked.minorType
+              (source := source) ctor gen.elimination)
+  | [], _, q => by simp [GenerationChecked.minorTypesAux]
+  | _ :: _, _, 0 => by simp [GenerationChecked.minorTypesAux]
+  | _ :: ctors, i, q+1 => by
+    simp only [GenerationChecked.minorTypesAux,
+      List.getElem?_cons_succ]
+    rw [gen.minorTypesAux_getElem? ctors (i+1) q,
+      show i+1+q = i+(q+1) by omega]
+
+namespace GenerationEnv
+
+variable {source : VInductDecl} {gen : GenerationChecked source}
+  {env : VEnv} (S : GenerationEnv gen env)
+include S
+-- `S` is included throughout so every lemma below is reachable as `S.lemma`,
+-- including those whose statement and proof never mention it.
+set_option linter.unusedSectionVars false
+
+/-- One mixed generalized induction-hypothesis entry is a type. The bound
+field keeps its raw domain; `emittedField_defeq` converts it to the retained
+recursive-Pi view only at the semantic application point. -/
+theorem recArgMinor_isType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) {r : RecArg}
+    (hrmem : r ∈ ctor.recArgsR source.uvars gen.elimination)
+    (Δ : List VExpr) (p : Nat) (hΔ : Δ.length = p) :
+    env.IsType (gen.recUvars)
+      (Δ ++
+        (VExpr.liftTelN 1
+          (ctor.fieldsR source.uvars source.nparams gen.elimination) 0).reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse))
+      (r.minorIH
+        (ctor.fieldsR source.uvars source.nparams gen.elimination).length p) := by
+  obtain ⟨r₀, hr₀, rfl⟩ :=
+    NormalizedCtor.recArgsR_mem hrmem
+  obtain ⟨Bview, hBview, hrec⟩ :=
+    S.viewRecArg_data hctor hr₀
+  let ls := gen.sourceLevels
+  let r := r₀.instL ls
+  let Bs := ctor.fieldsR source.uvars source.nparams gen.elimination
+  let m := Bs.length
+  let j := r₀.fieldIndex
+  let Fs := VExpr.liftTelN 1 Bs 0
+  let As := r.minorBinders m p
+  let idxs := r.indices.map fun e =>
+    (e.liftN 1 (r.fieldIndex+r.binders.length)).liftN
+      (m-r.fieldIndex+p) r.binders.length
+  let Γ := Δ ++ Fs.reverse ++
+    (gen.motiveType :: gen.paramsTel.reverse)
+  have hjm : j < m := by
+    have hview := S.viewRecArg_lt hctor hr₀
+    have hfields :=
+      (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+    simp only [j, m, Bs, NormalizedCtor.fieldsR_length]
+    omega
+  have hjraw :
+      r₀.fieldIndex < (ctor.rawFields source.nparams).length := by
+    simpa [j, m, Bs, NormalizedCtor.fieldsR_length] using hjm
+  let Braw := (ctor.rawFields source.nparams)[r₀.fieldIndex]
+  have hBraw :
+      (ctor.rawFields source.nparams)[r₀.fieldIndex]? =
+        some Braw :=
+    List.getElem?_eq_getElem hjraw
+  have hFsLen : Fs.length = m := by
+    simp [Fs, m, VExpr.liftTelN_length]
+  have hstackLen :
+      (Δ ++ (Fs.drop j).reverse).length = m-j+p := by
+    simp only [List.length_append, List.length_reverse,
+      List.length_drop, hFsLen, hΔ]
+    omega
+  have ht := S.recArg_transport hctor hr₀ [gen.motiveType] rfl
+    (Δ ++ (Fs.drop j).reverse) hstackLen
+  simp only [List.length_singleton, RecArg.instL] at ht
+  have hctx :
+      (Δ ++ (Fs.drop j).reverse) ++
+          ((VExpr.liftTelN 1 (Bs.take j) 0).reverse ++
+            ([gen.motiveType] ++ gen.paramsTel.reverse)) = Γ := by
+    dsimp only [Γ, Fs]
+    rw [← VExpr.liftTelN_take, List.append_assoc,
+      ← List.append_assoc
+        ((VExpr.liftTelN 1 Bs 0).drop j).reverse,
+      ← List.reverse_append, List.take_append_drop,
+      List.singleton_append, ← List.append_assoc]
+  dsimp only [j] at ht hctx
+  have htel : env.OnTel (gen.recUvars) Γ As := by
+    rw [hctx] at ht
+    simpa [r, As, m, j, Bs, RecArg.instL,
+      RecArg.minorBinders] using ht.1
+  have hsp : env.SpineWF (gen.recUvars)
+      (As.reverse ++ Γ)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (m+p+r.binders.length+1) gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst ls)))
+      idxs
+      (.sort (gen.block.checked.resultLevel.inst ls)) := by
+    rw [hctx] at ht
+    simpa [r, As, idxs, m, j, Bs, ls, RecArg.instL,
+      RecArg.minorBinders,
+      List.append_assoc,
+      show j + r₀.binders.length + 1 + (m-j+p) =
+        m+p+r₀.binders.length+1 from by omega] using ht.2
+  have hF : Γ[m-1-j+p]? =
+      some ((Braw.instL ls).liftN 1 j) := by
+    dsimp only [Γ, Fs]
+    rw [getElem?_stack_mid Δ
+        (VExpr.liftTelN 1 Bs 0).reverse
+        (gen.motiveType :: gen.paramsTel.reverse)
+        (i := m-1-j+p) (by rw [hΔ]; omega)
+        (by simp only [hΔ, List.length_reverse,
+          VExpr.liftTelN_length]; omega),
+      show m - 1 - j + p - Δ.length = m - 1 - j from by
+        rw [hΔ]
+        omega,
+      List.getElem?_reverse (by rw [hFsLen]; omega),
+      VExpr.liftTelN_length,
+      show m - 1 - (m - 1 - j) = j from by omega,
+      VExpr.liftTelN_getElem?,
+      NormalizedCtor.fieldsR_getElem?, hBraw]
+    simp [ls]
+  have hlu := Lookup.of_getElem? hF
+  rw [show m-1-j+p+1 = m-j+p from by omega] at hlu
+  dsimp only [j, r] at hlu
+  have hf0 := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars) hlu
+  obtain ⟨u, hdom₀⟩ :=
+    S.emittedField_defeq hctor hBraw hBview
+  have hdom₁ := hdom₀.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hdomChecked : env.IsDefEq (gen.recUvars)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination |>.take
+          r₀.fieldIndex).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (Braw.instL ls) (Bview.instL ls) ((VExpr.sort u).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse, List.map_take] using hdom₁
+  have hprefix := S.generationFieldPrefix_ctx_rec hctor r₀.fieldIndex
+  have hdomGeneration := hdomChecked.defeqDFC S.ord
+    (hprefix.symm S.ord)
+  have hjlen : (Bs.take r₀.fieldIndex).length =
+      r₀.fieldIndex := by
+    simp only [Bs, NormalizedCtor.fieldsR,
+      List.length_take, List.length_map]
+    omega
+  have Wmid := Ctx.LiftN.consTel (n := 1)
+    (Bs.take r₀.fieldIndex)
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse)
+      [gen.motiveType])
+  rw [hjlen, Nat.add_zero] at Wmid
+  have hdom₂ := hdomGeneration.weakN S.ord Wmid
+  have Wstack := Ctx.LiftN.zero
+    (Γ := (VExpr.liftTelN 1 (Bs.take j) 0).reverse ++
+      ([gen.motiveType] ++ gen.paramsTel.reverse))
+    (Δ ++ (Fs.drop j).reverse) (h := hstackLen)
+  have hdom₃ := hdom₂.weakN S.ord Wstack
+  rw [hctx] at hdom₃
+  have hfView := hdom₃.defeq hf0
+  have hfield := recArg_minor_fieldType hrec m p
+    (by simpa [j] using hjm) gen.elimination
+  simp only [RecArg.instL] at hfield
+  rw [hfield] at hfView
+  have hf := hfView.weakN S.ord
+    (Ctx.LiftN.zero (Γ := Γ) As.reverse)
+  have hmajor := VEnv.HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars)
+    (As := As)
+    (B := VExpr.appN
+      (.const gen.block.sourceType.name ls)
+      (VExpr.bvarRevRange
+        (m+p+r.binders.length+1) source.nparams ++ idxs))
+    (Δ := []) (Γ := Γ) (by
+      simpa [As, r, idxs, j, ls, RecArg.instL,
+        List.length_reverse, List.map_map,
+        Function.comp_def] using hf)
+  simp only [List.length_nil, VExpr.liftN_zero,
+    List.nil_append] at hmajor
+  have hAsLen : As.length = r.binders.length := by
+    simp [As, RecArg.minorBinders, VExpr.liftTelN_length]
+  change env.HasType (gen.recUvars) (As.reverse ++ Γ)
+    ((VExpr.bvar (m-1-r.fieldIndex+p+As.length)).appN
+      (VExpr.bvarRevRange 0 As.length))
+    (VExpr.appN
+      (.const gen.block.sourceType.name ls)
+      (VExpr.bvarRevRange
+        (m+p+r.binders.length+1) source.nparams ++ idxs)) at hmajor
+  rw [hAsLen] at hmajor
+  have hMget :
+      (As.reverse ++ Γ)[m+p+r.binders.length]? =
+        some gen.motiveType := by
+    have hM0 := getElem?_rstack3 As.reverse
+      (Δ ++ Fs.reverse) gen.motiveType gen.paramsTel.reverse
+      (i := m+p+r.binders.length)
+      (by
+        simp [As, RecArg.minorBinders, r, m, Fs, hΔ,
+          VExpr.liftTelN_length, RecArg.instL]
+        omega)
+    simpa [Γ, List.append_assoc] using hM0
+  have hM := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars)
+    (Lookup.of_getElem? hMget)
+  have hlen : idxs.length = gen.idxTel.length := by
+    simpa [idxs, r, RecArg.instL,
+      GenerationChecked.idxTel] using
+      (S.viewRecArg_indices_length hctor hr₀).trans
+        gen.shape.2.2.1.symm
+  have hbody := gen.motiveVarApp_hasType
+    (l := gen.block.checked.resultLevel.inst ls)
+    hM hsp hlen hmajor
+  refine IsType.forallN htel ⟨gen.motiveLevel, ?_⟩
+  simpa [RecArg.minorIH, r, As, idxs, m, Γ, Fs, Bs,
+    List.append_assoc] using hbody
+
+/-- The complete mixed functional-IH telescope is well formed at any suffix
+and depth. -/
+theorem ihs_onTel {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    ∀ (rsSuf : List RecArg),
+    (∀ r ∈ rsSuf, r ∈ ctor.recArgsR source.uvars gen.elimination) →
+    ∀ (Δ : List VExpr) (p : Nat), Δ.length = p →
+    env.OnTel (gen.recUvars)
+      (Δ ++
+        (VExpr.liftTelN 1
+          (ctor.fieldsR source.uvars source.nparams gen.elimination) 0).reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse))
+      (ihsFromRecArgs
+        (ctor.fieldsR source.uvars source.nparams gen.elimination).length rsSuf p)
+  | [], _, _, _, _ => trivial
+  | r :: rsSuf, hqs, Δ, p, hΔ =>
+    ⟨S.recArgMinor_isType hctor
+        (hqs r (.head _)) Δ p hΔ,
+      GenerationEnv.ihs_onTel hctor rsSuf
+        (fun q hq => hqs q (.tail _ hq))
+        (_ :: Δ) (p+1) (by simp [hΔ])⟩
+
+/-- The retained constructor result has exactly the checked family-index
+arity. -/
+theorem viewResultIndices_length {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    ctor.view.resultIndices.length =
+      gen.block.checked.indices.length := by
+  obtain ⟨c, hc, hview⟩ := gen.viewCtor_ofDirect hctor
+  have hstage :=
+    (gen.block.checked.direct_anatomy.2.2.2.2.2 c hc).2.2
+  have hlen := (stage3Ctor_eq hstage).2.1
+  rw [hview]
+  rw [gen.block.nparams_eq]
+  simpa [CheckedCtor.ofDirect] using hlen
+
+/-- Checked result-index spine semantics for a paired constructor. -/
+theorem viewResultSpine {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.SpineWF source.uvars
+      (ctor.view.fields.reverse ++
+        gen.block.checked.params.reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN ctor.view.fields.length
+          gen.block.checked.indices 0)
+        (.sort gen.block.checked.resultLevel))
+      ctor.view.resultIndices
+      (.sort gen.block.checked.resultLevel) := by
+  obtain ⟨c, hc, hview⟩ := gen.viewCtor_ofDirect hctor
+  have h := (S.checked.2 c hc).2
+  rw [hview]
+  simpa [CheckedCtor.ofDirect, gen.block.uvars_eq,
+    gen.block.nparams_eq] using h
+
+/-- Constructor-result semantics transported to the exact emitted
+checked-parameter/raw-field context and raw family-index telescope. -/
+theorem rawResultSpine {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.SpineWF source.uvars
+      ((ctor.rawFields source.nparams).reverse ++
+        gen.block.checked.params.reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (ctor.rawFields source.nparams).length
+          gen.block.rawIndices 0)
+        (.sort gen.block.checked.resultLevel))
+      ctor.view.resultIndices
+      (.sort gen.block.checked.resultLevel) := by
+  have hctx := (S.ctorWF ctor hctor).emittedTel.ctx
+  simp only [NormalizedCtor.emittedBinders,
+    NormalizedCtor.viewBinders, List.reverse_append,
+    List.append_nil] at hctx
+  have hsp := (S.viewResultSpine hctor).defeqDFC S.ord
+    (hctx.symm S.ord)
+  have hfields :=
+    (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+  rw [← hfields] at hsp
+  have hidx := S.emittedIndexTel_defeq.weakN S.ord
+    (Ctx.LiftN.zero (Γ := gen.block.checked.params.reverse)
+      (ctor.rawFields source.nparams).reverse)
+  rw [List.length_reverse] at hidx
+  have hlen :
+      ctor.view.resultIndices.length =
+        (VExpr.liftTelN
+          (ctor.rawFields source.nparams).length
+          gen.block.rawIndices 0).length := by
+    simp only [VExpr.liftTelN_length]
+    exact (S.viewResultIndices_length hctor).trans
+      gen.shape.2.2.1.symm
+  exact hidx.spine_sort S.ord hsp hlen
+
+/-- Transport the mixed constructor result spine into a minor or rule
+context. -/
+theorem result_transport {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.SpineWF (gen.recUvars)
+      (As₂ ++
+        ((VExpr.liftTelN g
+          (ctor.fieldsR source.uvars source.nparams gen.elimination) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          ((ctor.fieldsR source.uvars source.nparams gen.elimination).length + g + d)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))))
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        (e.liftN g
+          (ctor.fieldsR source.uvars source.nparams gen.elimination).length).liftN d)
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+  let ls := gen.sourceLevels
+  have h1 := (S.rawResultSpine hctor).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have h1Checked : env.SpineWF (gen.recUvars)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (VExpr.instL ls
+        (VExpr.forallN
+          (VExpr.liftTelN (ctor.rawFields source.nparams).length
+            gen.block.rawIndices 0)
+          (.sort gen.block.checked.resultLevel)))
+      (ctor.view.resultIndices.map (VExpr.instL ls))
+      ((VExpr.sort gen.block.checked.resultLevel).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse] using h1
+  have hfieldsCtx := (S.generationFields_onTel_rec hctor).extendDefEqCtx
+    S.generationParams_ctx_rec
+  have h1Generation := h1Checked.defeqDFC S.ord
+    (hfieldsCtx.symm S.ord)
+  rw [VExpr.instL_forallN, VExpr.liftTelN_instL,
+    show
+      (gen.block.rawIndices.map (VExpr.instL ls)) =
+        gen.idxTel by rfl] at h1Generation
+  rw [← NormalizedCtor.fieldsR_length
+    (source := source) (mode := gen.elimination) ctor] at h1Generation
+  have W₁ := Ctx.LiftN.consTel (n := mid.length)
+    (ctor.fieldsR source.uvars source.nparams gen.elimination)
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h2 := h1Generation.weakN S.ord W₁
+  rw [VExpr.liftN_forallN, hg] at h2
+  have h3 := h2.weakN S.ord
+    (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  rw [VExpr.liftN_forallN] at h3
+  rw [VExpr.liftTelN_liftTelN_hi'
+      (ctor.fieldsR source.uvars source.nparams gen.elimination).length
+      g _ 0 (by omega),
+    VExpr.liftTelN_liftTelN] at h3
+  simpa [ls, NormalizedCtor.resultIndicesR,
+    VExpr.instL, VExpr.liftN, List.map_map,
+    Function.comp_def, List.append_assoc] using h3
+
+/-- The exact emitted constructor application transported into recursor
+universes, before inserting the motive or any induction-hypothesis stack. -/
+theorem ctorApp_emitted_rec {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.HasType (gen.recUvars)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination).reverse ++
+        gen.paramsTel.reverse)
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length
+            source.nparams ++
+          ctor.resultIndicesR source.uvars gen.elimination)) := by
+  let ls := gen.sourceLevels
+  have h := (S.ctorApp_emitted_decl hctor).instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have hChecked : env.HasType (gen.recUvars)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      ((VExpr.appN
+        (.const ctor.raw.name (VLevel.params source.uvars))
+        (VExpr.bvarRevRange
+          (ctor.rawFields source.nparams).length source.nparams ++
+          VExpr.bvarRevRange 0
+            (ctor.rawFields source.nparams).length)).instL ls)
+      ((ctor.resultTarget gen.block).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse] using h
+  have hfieldsCtx := (S.generationFields_onTel_rec hctor).extendDefEqCtx
+    S.generationParams_ctx_rec
+  have hGeneration := hChecked.defeqDFC S.ord
+    (hfieldsCtx.symm S.ord)
+  rw [← NormalizedCtor.fieldsR_length
+    (source := source) (mode := gen.elimination) ctor] at hGeneration
+  simpa [ls, NormalizedCtor.fieldsR,
+    GenerationChecked.paramsTel,
+    NormalizedCtor.resultTarget,
+    NormalizedCtor.resultIndicesR,
+    VExpr.instL_appN, List.map_append,
+    bvarRevRange_instL, List.map_reverse,
+    VExpr.instL, VLevel.params_map_inst_params'] using hGeneration
+
+/-- Transport the emitted constructor application under binders inserted
+between parameters and fields, then under an arbitrary top stack. -/
+theorem ctorApp_transport {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.HasType (gen.recUvars)
+      (As₂ ++
+        ((VExpr.liftTelN g
+          (ctor.fieldsR source.uvars source.nparams gen.elimination) 0).reverse ++
+          (mid ++ gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (d + (g +
+              (ctor.fieldsR source.uvars source.nparams gen.elimination).length))
+            source.nparams ++
+          VExpr.bvarRevRange d
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (d + (g +
+              (ctor.fieldsR source.uvars source.nparams gen.elimination).length))
+            source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            (e.liftN g
+              (ctor.fieldsR source.uvars source.nparams gen.elimination).length).liftN d)) := by
+  let Bs := ctor.fieldsR source.uvars source.nparams gen.elimination
+  have W₁ := Ctx.LiftN.consTel (n := mid.length) Bs
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h₁ := (S.ctorApp_emitted_rec hctor).weakN S.ord W₁
+  rw [hg] at h₁
+  have hmid : env.HasType (gen.recUvars)
+      ((VExpr.liftTelN g Bs 0).reverse ++
+        (mid ++ gen.paramsTel.reverse))
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange (g + Bs.length) source.nparams ++
+          VExpr.bvarRevRange 0 Bs.length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange (g + Bs.length) source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map
+            (VExpr.liftN g · Bs.length))) := by
+    simpa [Bs, VExpr.liftN_appN, List.map_append,
+      bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+      VExpr.bvarRevRange_liftN_high
+        Bs.length 0 g Bs.length (by omega),
+      VExpr.liftN] using h₁
+  have htop := hmid.weakN S.ord
+    (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  simpa [Bs, VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+    VExpr.liftN, List.map_map, Function.comp_def,
+    List.append_assoc] using htop
+
+/-- Constructor application in the exact mixed minor-premise context. -/
+theorem ctorAppMinor_hasType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) (Δ : List VExpr) :
+    env.HasType (gen.recUvars)
+      (Δ ++
+        (VExpr.liftTelN 1
+          (ctor.fieldsR source.uvars source.nparams gen.elimination) 0).reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse))
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (Δ.length +
+              (ctor.fieldsR source.uvars source.nparams gen.elimination).length + 1)
+            source.nparams ++
+          VExpr.bvarRevRange Δ.length
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (Δ.length +
+              (ctor.fieldsR source.uvars source.nparams gen.elimination).length + 1)
+            source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            (e.liftN 1
+              (ctor.fieldsR source.uvars source.nparams gen.elimination).length).liftN
+                Δ.length)) := by
+  have h := S.ctorApp_transport hctor [gen.motiveType]
+    (g := 1) rfl Δ (d := Δ.length) rfl
+  rw [VExpr.bvarRevRange_congr source.nparams
+    (show
+      Δ.length +
+          (1 +
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length) =
+        Δ.length +
+          (ctor.fieldsR source.uvars source.nparams gen.elimination).length + 1 by
+      omega)] at h
+  simpa [List.append_assoc] using h
+
+/-- The exact raw field telescope used by a mixed minor is well formed after
+universe instantiation and insertion of the motive. -/
+theorem fields_onTel_minor {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.OnTel (gen.recUvars)
+      (gen.motiveType :: gen.paramsTel.reverse)
+      (VExpr.liftTelN 1
+        (ctor.fieldsR source.uvars source.nparams gen.elimination) 0) := by
+  have hout := (S.generationFields_onTel_rec hctor).weakN S.ord
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse)
+      [gen.motiveType])
+  simpa using hout
+
+/-- Every mixed constructor minor is a type over the checked parameter telescope
+and mixed motive. Raw field syntax is preserved; recursive classifications
+and result indices come from the checked view. -/
+theorem minor_isType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.IsType (gen.recUvars)
+      (gen.motiveType :: gen.paramsTel.reverse)
+      (GenerationChecked.minorType
+        (source := source) ctor gen.elimination) := by
+  let Bs := ctor.fieldsR source.uvars source.nparams gen.elimination
+  let m := Bs.length
+  let rs := ctor.recArgsR source.uvars gen.elimination
+  let IHs := ihsFromRecArgs m rs 0
+  let Fs := VExpr.liftTelN 1 Bs 0
+  let Γ := IHs.reverse ++
+    (Fs.reverse ++
+      (gen.motiveType :: gen.paramsTel.reverse))
+  simp only [GenerationChecked.minorType]
+  refine IsType.forallN (by
+    simpa [Bs] using S.fields_onTel_minor hctor) ?_
+  refine IsType.forallN (by
+    simpa [Bs, m, rs, IHs, Fs, List.append_assoc] using
+      S.ihs_onTel hctor rs (fun r hr => hr) [] 0 rfl) ?_
+  have hrlen : IHs.reverse.length = rs.length := by
+    simp [IHs, ihsFromRecArgs_length]
+  have hMget : Γ[m + rs.length]? =
+      some gen.motiveType := by
+    have h := getElem?_rstack3 IHs.reverse Fs.reverse
+      gen.motiveType gen.paramsTel.reverse
+      (i := m + rs.length)
+      (by
+        simp [IHs, Fs, m, ihsFromRecArgs_length,
+          VExpr.liftTelN_length]
+        omega)
+    simpa [Γ] using h
+  have hM : env.HasType (gen.recUvars) Γ
+      (.bvar (m + rs.length))
+      (gen.motiveType.liftN (m + rs.length + 1)) :=
+    VEnv.HasType.bvar (Lookup.of_getElem? hMget)
+  have hSp := S.result_transport hctor [gen.motiveType]
+    (g := 1) rfl IHs.reverse
+    (d := rs.length) hrlen
+  rw [show m + 1 + rs.length =
+    m + rs.length + 1 by omega] at hSp
+  have hSp' : env.SpineWF (gen.recUvars) Γ
+      (VExpr.forallN
+        (VExpr.liftTelN (m + rs.length + 1)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))))
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        (e.liftN 1 m).liftN rs.length)
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+    simpa [Γ, Fs, Bs, m, List.append_assoc] using hSp
+  have hlen :
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        (e.liftN 1 m).liftN rs.length).length =
+        gen.idxTel.length := by
+    simp only [List.length_map, NormalizedCtor.resultIndicesR,
+      GenerationChecked.idxTel]
+    exact (S.viewResultIndices_length hctor).trans
+      gen.shape.2.2.1.symm
+  have hctorApp := S.ctorAppMinor_hasType hctor IHs.reverse
+  rw [hrlen,
+    VExpr.bvarRevRange_congr source.nparams
+      (show rs.length + m + 1 = m + rs.length + 1 by omega)] at hctorApp
+  have hctorApp' : env.HasType (gen.recUvars) Γ
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (m + rs.length + 1) source.nparams ++
+          VExpr.bvarRevRange rs.length m))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (m + rs.length + 1) source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            (e.liftN 1 m).liftN rs.length)) := by
+    simpa [Γ, Fs, Bs, m, IHs, rs,
+      List.append_assoc] using hctorApp
+  have hbody := gen.motiveVarApp_hasType hM hSp' hlen hctorApp'
+  rw [VExpr.bvarRevRange_congr source.nparams
+    (show m + rs.length + 1 =
+      rs.length + m + 1 by omega)] at hbody
+  exact ⟨gen.motiveLevel, by
+    simpa [Γ, Fs, Bs, m, rs, IHs,
+      List.append_assoc] using hbody⟩
+
+/-- The checked parameter telescope is well formed in recursor universes. -/
+theorem paramsTel_onTel :
+    env.OnTel (gen.recUvars) [] gen.paramsTel := by
+  have h := S.generationFamily_onTel.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have h' : env.OnTel (gen.recUvars) []
+      (gen.paramsTel ++ gen.idxTel) := by
+    simpa [GenerationChecked.paramsTel,
+      GenerationChecked.idxTel] using h
+  exact h'.of_append.1
+
+/-- The raw index telescope is well formed over the checked parameters. -/
+theorem idxTel_onTel :
+    env.OnTel (gen.recUvars)
+      gen.paramsTel.reverse gen.idxTel := by
+  have h := S.generationFamily_onTel.instL
+    (U' := gen.recUvars) gen.sourceLevels_wf
+  have h' : env.OnTel (gen.recUvars) []
+      (gen.paramsTel ++ gen.idxTel) := by
+    simpa [GenerationChecked.paramsTel,
+      GenerationChecked.idxTel] using h
+  simpa using h'.of_append.2
+
+/-- Any suffix of paired constructors generates a well-formed mixed minor
+telescope at its positional depth. -/
+theorem minorTypesAux_onTel :
+    ∀ (ctors : List NormalizedCtor),
+      (∀ ctor ∈ ctors, ctor ∈ gen.block.ctorPairs) →
+      ∀ (Δ : List VExpr) (i : Nat), Δ.length = i →
+        env.OnTel (gen.recUvars)
+          (Δ ++
+            (gen.motiveType :: gen.paramsTel.reverse))
+          (gen.minorTypesAux ctors i)
+  | [], _, _, _, _ => trivial
+  | ctor :: ctors, hsub, Δ, i, hΔ =>
+    ⟨by
+      rw [← hΔ]
+      exact (S.minor_isType
+        (hsub ctor (.head _))).weakN S.ord
+          (.zero Δ),
+    GenerationEnv.minorTypesAux_onTel ctors
+      (fun ctor hctor => hsub ctor (.tail _ hctor))
+      (_ :: Δ) (i+1) (by simp [hΔ])⟩
+
+/-- The complete mixed minor telescope is well formed over parameters and
+motive. -/
+theorem minorTypes_onTel :
+    env.OnTel (gen.recUvars)
+      (gen.motiveType :: gen.paramsTel.reverse)
+      gen.minorTypes := by
+  simpa [GenerationChecked.minorTypes] using
+    S.minorTypesAux_onTel gen.block.ctorPairs
+      (fun _ h => h) [] 0 rfl
+
+/-- Transport the fully applied raw family under binders inserted below its
+indices and then under an arbitrary top stack. -/
+theorem familyApp_transport
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.HasType (gen.recUvars)
+      (As₂ ++
+        ((VExpr.liftTelN g gen.idxTel 0).reverse ++
+          (mid ++ gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (d + (g + gen.idxTel.length))
+            source.nparams ++
+          VExpr.bvarRevRange d gen.idxTel.length))
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+  have W₁ := Ctx.LiftN.consTel (n := mid.length) gen.idxTel
+    (Ctx.LiftN.zero (Γ := gen.paramsTel.reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h₁ := S.familyApp_hasType.weakN S.ord W₁
+  rw [hg] at h₁
+  have hmid : env.HasType (gen.recUvars)
+      ((VExpr.liftTelN g gen.idxTel 0).reverse ++
+        (mid ++ gen.paramsTel.reverse))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (g + gen.idxTel.length) source.nparams ++
+          VExpr.bvarRevRange 0 gen.idxTel.length))
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+    simpa [VExpr.liftN_appN, List.map_append,
+      bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+      VExpr.bvarRevRange_liftN_high
+        gen.idxTel.length 0 g gen.idxTel.length (by omega),
+      VExpr.liftN] using h₁
+  have htop := hmid.weakN S.ord
+    (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  simpa [VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+    VExpr.liftN, List.append_assoc] using htop
+
+/-- The mixed recursor type is well formed. Its telescope retains raw
+parameter and index syntax while its motive and minors use the checked
+recursive classification. -/
+theorem recType_isType :
+    env.IsType (gen.recUvars) [] gen.recType := by
+  refine IsType.forallN S.paramsTel_onTel ?_
+  simp only [List.append_nil]
+  refine IsType.forallE S.motive_isType ?_
+  refine IsType.forallN S.minorTypes_onTel ?_
+  have hI : env.OnTel (gen.recUvars)
+      (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse))
+      (VExpr.liftTelN (gen.block.ctorPairs.length + 1)
+        gen.idxTel 0) := by
+    have h := S.idxTel_onTel.weakN S.ord
+      (Ctx.LiftN.zero
+        (n := gen.block.ctorPairs.length + 1)
+        (Γ := gen.paramsTel.reverse)
+        (gen.minorTypes.reverse ++ [gen.motiveType])
+        (h := by simp [gen.minorTypes_length]))
+    simpa [List.append_assoc] using h
+  refine IsType.forallN hI ?_
+  have hmaj₀ := S.familyApp_transport
+    (gen.minorTypes.reverse ++ [gen.motiveType])
+    (g := gen.block.ctorPairs.length + 1)
+    (by simp [gen.minorTypes_length])
+    [] (d := 0) rfl
+  rw [VExpr.bvarRevRange_congr source.nparams
+    (show
+      0 + ((gen.block.ctorPairs.length + 1) +
+        gen.idxTel.length) =
+      gen.idxTel.length + gen.block.ctorPairs.length + 1 by omega)] at hmaj₀
+  have hmaj : env.HasType (gen.recUvars)
+      ((VExpr.liftTelN (gen.block.ctorPairs.length + 1)
+          gen.idxTel 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (gen.idxTel.length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          VExpr.bvarRevRange 0 gen.idxTel.length))
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+    simpa [List.append_assoc] using hmaj₀
+  refine IsType.forallE ⟨_, hmaj⟩ ?_
+  have hM := getElem?_rstack3
+    [VExpr.appN
+      (.const gen.block.sourceType.name
+        (gen.sourceLevels))
+      (VExpr.bvarRevRange
+          (gen.idxTel.length +
+            gen.block.ctorPairs.length + 1)
+          source.nparams ++
+        VExpr.bvarRevRange 0 gen.idxTel.length)]
+    ((VExpr.liftTelN (gen.block.ctorPairs.length + 1)
+        gen.idxTel 0).reverse ++
+      gen.minorTypes.reverse)
+    gen.motiveType gen.paramsTel.reverse
+    (i := gen.idxTel.length +
+      gen.block.ctorPairs.length + 1)
+    (by
+      simp only [List.length_singleton, List.length_append,
+        List.length_reverse, VExpr.liftTelN_length,
+        gen.minorTypes_length]
+      omega)
+  have hmlu := Lookup.of_getElem? (by
+    simpa only [List.singleton_append,
+      List.append_assoc] using hM)
+  rw [show gen.motiveType.liftN
+        (gen.idxTel.length +
+          gen.block.ctorPairs.length + 1 + 1) =
+      (gen.motiveType.liftN
+        (gen.block.ctorPairs.length + 1)).liftN
+          (gen.idxTel.length + 1) from by
+      rw [VExpr.liftN_liftN]
+      congr 1
+      omega,
+    gen.motiveType_liftN] at hmlu
+  have hfun : env.HasType (gen.recUvars)
+      (VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length) ::
+        ((VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            gen.idxTel 0).reverse ++
+          (gen.minorTypes.reverse ++
+            (gen.motiveType :: gen.paramsTel.reverse))))
+      (.bvar
+        (gen.idxTel.length +
+          gen.block.ctorPairs.length + 1))
+      ((VExpr.forallN
+        (VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.forallE
+          (VExpr.appN
+            (.const gen.block.sourceType.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                (gen.block.ctorPairs.length + 1 +
+                  gen.idxTel.length)
+                source.nparams ++
+              VExpr.bvarRevRange 0 gen.idxTel.length))
+          (.sort gen.motiveLevel))).liftN
+        (1 + (VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          gen.idxTel 0).length)) := by
+    exact .bvar (by
+      simpa [List.append_assoc, VExpr.liftTelN_length,
+        Nat.add_comm] using hmlu)
+  have hMapp := HasType.appN_selfSpine
+    (As := VExpr.liftTelN
+      (gen.block.ctorPairs.length + 1)
+      gen.idxTel 0)
+    (Δ := [VExpr.appN
+      (.const gen.block.sourceType.name
+        (gen.sourceLevels))
+      (VExpr.bvarRevRange
+          (gen.idxTel.length +
+            gen.block.ctorPairs.length + 1)
+          source.nparams ++
+        VExpr.bvarRevRange 0 gen.idxTel.length)])
+    (Γ := gen.minorTypes.reverse ++
+      (gen.motiveType :: gen.paramsTel.reverse))
+    (f := .bvar
+      (gen.idxTel.length +
+        gen.block.ctorPairs.length + 1))
+    hfun
+  have h0 :
+      (VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length) ::
+        ((VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            gen.idxTel 0).reverse ++
+          (gen.minorTypes.reverse ++
+            (gen.motiveType :: gen.paramsTel.reverse))))[0]? =
+        some (VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length)) := rfl
+  have harg := HasType.bvar
+    (env := env) (U := gen.recUvars)
+    (Lookup.of_getElem? h0)
+  have harg' : env.HasType (gen.recUvars)
+      ([VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length)] ++
+        (VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          gen.idxTel 0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (.bvar 0)
+      ((VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (gen.block.ctorPairs.length + 1 +
+              gen.idxTel.length)
+            source.nparams ++
+          VExpr.bvarRevRange 0 gen.idxTel.length)).liftN 1) := by
+    simpa [List.append_assoc, Nat.add_comm,
+      Nat.add_left_comm, Nat.add_assoc] using harg
+  have happ := HasType.app hMapp harg'
+  exact ⟨_, by
+    simpa [GenerationChecked.recType, List.append_assoc,
+      VExpr.liftTelN_length] using happ⟩
+
+/-- The mixed generated recursor constant is well formed. -/
+theorem recursor_wf : gen.recursor.WF env :=
+  S.recType_isType
+
+end GenerationEnv
+
+theorem minorTypes_getElem? {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    ∀ (cs : List VConstVal) (i₀ q : Nat),
+    (minorTypes U T np ty cs i₀)[q]? =
+      cs[q]?.map fun c => VExpr.liftN (i₀+q) (minorType U T np ty c)
+  | [], _, q => by simp [minorTypes]
+  | c :: cs, i₀, 0 => by simp [minorTypes]
+  | c :: cs, i₀, q+1 => by
+    simp only [minorTypes, List.getElem?_cons_succ]
+    rw [minorTypes_getElem? cs (i₀+1) q, show i₀+1+q = i₀+(q+1) from by omega]
+
+theorem minorTypesRec_getElem? {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    ∀ (cs : List VConstVal) (i₀ q : Nat),
+    (minorTypesRec U T np ty cs i₀)[q]? =
+      cs[q]?.map fun c => VExpr.liftN (i₀+q) (minorTypeRec U T np ty c)
+  | [], _, q => by simp [minorTypesRec]
+  | c :: cs, i₀, 0 => by simp [minorTypesRec]
+  | c :: cs, i₀, q+1 => by
+    simp only [minorTypesRec, List.getElem?_cons_succ]
+    rw [minorTypesRec_getElem? cs (i₀+1) q,
+      show i₀+1+q = i₀+(q+1) from by omega]
+
+theorem recApp'_levelWF {U : Nat} {T : Name} {np off : Nat} :
+    (recApp' U T np off).LevelWF (U+1) :=
+  VExpr.LevelWF.appN (f := .const T (VLevel.params' U 1)) VLevel.params'_one_wf
+    (bvarRevRange_levelWF _ _)
+
+theorem idxTel_length {U np : Nat} {ty : VInductiveType} :
+    (idxTel U np ty).length = (ctorFields (VExpr.dropN np ty.type)).length :=
+  List.length_map ..
+
+theorem idxTel_levelWF {U np : Nat} {ty : VInductiveType} :
+    ∀ A ∈ idxTel U np ty, A.LevelWF (U+1) := by
+  intro A hA
+  obtain ⟨A₀, -, rfl⟩ := List.mem_map.1 hA
+  exact VExpr.LevelWF.instL VLevel.params'_one_wf
+
+theorem ctorIdxs_length {U np : Nat} {c : VConstVal} :
+    (ctorIdxs U np c).length =
+      (recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))).length :=
+  List.length_map ..
+
+theorem ctorIdxs_levelWF {U np : Nat} {c : VConstVal} :
+    ∀ e ∈ ctorIdxs U np c, e.LevelWF (U+1) := by
+  intro e he
+  obtain ⟨e₀, -, rfl⟩ := List.mem_map.1 he
+  exact VExpr.LevelWF.instL VLevel.params'_one_wf
+
+theorem recPairsR_lt {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} :
+    ∀ q ∈ recPairsR U T np ni c, q.1 < (ctorFields (VExpr.dropN np c.type)).length := by
+  intro q hq
+  obtain ⟨⟨j, idxs⟩, hmem, rfl⟩ := List.mem_map.1 hq
+  simpa using recPairs_lt _ hmem
+
+theorem recPairsR_idx_levelWF {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} :
+    ∀ q ∈ recPairsR U T np ni c, ∀ e ∈ q.2, e.LevelWF (U+1) := by
+  intro q hq e he
+  obtain ⟨⟨j, idxs⟩, -, rfl⟩ := List.mem_map.1 hq
+  obtain ⟨e₀, -, rfl⟩ := List.mem_map.1 he
+  exact VExpr.LevelWF.instL VLevel.params'_one_wf
+
+/-- Unpack a recursor-universe recursive position: the underlying field and
+its (declaration-universe) index arguments. -/
+theorem recPairsR_mem {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} {q}
+    (hq : q ∈ recPairsR U T np ni c) :
+    ∃ B, (ctorFields (VExpr.dropN np c.type))[q.1]? = some B ∧
+      isRecField U T np ni q.1 B = true ∧
+      q.2 = (recFieldIdxs np B).map (VExpr.instL (VLevel.params' U 1)) := by
+  obtain ⟨⟨j, idxs⟩, hmem, rfl⟩ := List.mem_map.1 hq
+  obtain ⟨B, hB, hrec, hidx⟩ := recPairs_getElem _ hmem
+  exact ⟨B, by simpa using hB, hrec, by
+    simpa using congrArg
+      (List.map (VExpr.instL (ElimMode.large.sourceLevels U))) hidx⟩
+
+/-- Recursor-universe transport preserves each recursive argument's source
+field position. -/
+theorem recArgsR_lt {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} :
+    ∀ r ∈ recArgsR U T np ni c,
+      r.fieldIndex < (ctorFields (VExpr.dropN np c.type)).length := by
+  intro r hr
+  obtain ⟨r₀, hr₀, rfl⟩ := List.mem_map.1 hr
+  simpa [RecArg.instL] using recArgs_lt _ hr₀
+
+/-- Every generated recursive-target index is level-well-formed in the
+recursor universe context. -/
+theorem recArgsR_idx_levelWF {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} :
+    ∀ r ∈ recArgsR U T np ni c, ∀ e ∈ r.indices, e.LevelWF (U+1) := by
+  intro r hr e he
+  obtain ⟨r₀, -, rfl⟩ := List.mem_map.1 hr
+  obtain ⟨e₀, -, rfl⟩ := List.mem_map.1 he
+  exact VExpr.LevelWF.instL VLevel.params'_one_wf
+
+/-- Every generated recursive-Pi domain is level-well-formed after universe
+transport. -/
+theorem recArgsR_binder_levelWF {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} :
+    ∀ r ∈ recArgsR U T np ni c, ∀ A ∈ r.binders, A.LevelWF (U+1) := by
+  intro r hr A hA
+  obtain ⟨r₀, -, rfl⟩ := List.mem_map.1 hr
+  obtain ⟨A₀, -, rfl⟩ := List.mem_map.1 hA
+  exact VExpr.LevelWF.instL VLevel.params'_one_wf
+
+/-- Unpack a recursor-universe recursive descriptor to the source field and
+its declaration-universe analysis result. -/
+theorem recArgsR_mem {U : Nat} {T : Name} {np ni : Nat} {c : VConstVal} {r}
+    (hr : r ∈ recArgsR U T np ni c) :
+    ∃ r₀ B, r = r₀.instL (VLevel.params' U 1) ∧
+      (ctorFields (VExpr.dropN np c.type))[r₀.fieldIndex]? = some B ∧
+      recArg? U T np ni r₀.fieldIndex B = some r₀ := by
+  obtain ⟨r₀, hr₀, rfl⟩ := List.mem_map.1 hr
+  obtain ⟨B, hB, hrec⟩ := recArgs_getElem _ hr₀
+  exact ⟨r₀, B, rfl, by simpa using hB, hrec⟩
+
+theorem motiveType_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    (motiveType U T np ty).LevelWF (U+1) := by
+  refine VExpr.LevelWF.forallN idxTel_levelWF ⟨?_, Nat.succ_pos U⟩
+  refine VExpr.LevelWF.appN (f := .const T (VLevel.params' U 1)) VLevel.params'_one_wf
+    fun e h => ?_
+  rcases List.mem_append.1 h with h | h
+  · exact bvarRevRange_levelWF _ _ _ h
+  · exact bvarRevRange_levelWF _ _ _ h
+
+theorem motiveType_liftN {U : Nat} {T : Name} {np n : Nat} {ty : VInductiveType} :
+    (motiveType U T np ty).liftN n =
+    VExpr.forallN (VExpr.liftTelN n (idxTel U np ty) 0)
+      (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (n + (idxTel U np ty).length) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.sort (.param 0))) := by
+  rw [show motiveType U T np ty = VExpr.forallN (idxTel U np ty)
+      (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (idxTel U np ty).length np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.sort (.param 0))) from rfl,
+    VExpr.liftN_forallN]
+  refine congrArg _ ?_
+  show VExpr.forallE _ _ = VExpr.forallE _ _
+  refine congr (congrArg _ ?_) rfl
+  rw [VExpr.liftN_appN, List.map_append,
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+  rfl
+
+theorem liftTelN_levelWF {Uv n : Nat} : ∀ {tel : List VExpr} {k : Nat},
+    (∀ A ∈ tel, A.LevelWF Uv) → ∀ A ∈ VExpr.liftTelN n tel k, A.LevelWF Uv
+  | [], _, _, _, h => nomatch h
+  | _ :: tel, k, hAs, A', h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · exact (hAs _ (.head _)).liftN
+    · exact liftTelN_levelWF (fun A h => hAs _ (.tail _ h)) A' h
+
+theorem RecArg.minorBinders_levelWF {Uv m p : Nat} {r : RecArg}
+    (hbind : ∀ A ∈ r.binders, A.LevelWF Uv) :
+    ∀ A ∈ r.minorBinders m p, A.LevelWF Uv :=
+  liftTelN_levelWF (liftTelN_levelWF hbind)
+
+theorem RecArg.minorIH_levelWF {Uv m p : Nat} {r : RecArg}
+    (hbind : ∀ A ∈ r.binders, A.LevelWF Uv)
+    (hidx : ∀ e ∈ r.indices, e.LevelWF Uv) :
+    (r.minorIH m p).LevelWF Uv := by
+  simp only [RecArg.minorIH]
+  refine VExpr.LevelWF.forallN (r.minorBinders_levelWF hbind)
+    (VExpr.LevelWF.appN (f := .bvar _) trivial fun e he => ?_)
+  rcases List.mem_append.1 he with he | he
+  · obtain ⟨e₀, he₀, rfl⟩ := List.mem_map.1 he
+    exact ((hidx e₀ he₀).liftN).liftN
+  · rcases List.mem_cons.1 he with rfl | he
+    · exact VExpr.LevelWF.appN (f := .bvar _) trivial (bvarRevRange_levelWF _ _)
+    · cases he
+
+theorem ihsFromRecArgs_levelWF {Uv m : Nat} :
+    ∀ (rs : List RecArg) (p : Nat),
+    (∀ r ∈ rs, ∀ A ∈ r.binders, A.LevelWF Uv) →
+    (∀ r ∈ rs, ∀ e ∈ r.indices, e.LevelWF Uv) →
+    ∀ e ∈ ihsFromRecArgs m rs p, e.LevelWF Uv
+  | [], _, _, _, _, h => nomatch h
+  | r :: rs, p, hbind, hidx, e, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · exact r.minorIH_levelWF
+        (hbind r (.head _)) (hidx r (.head _))
+    · exact ihsFromRecArgs_levelWF rs (p+1)
+        (fun q hq => hbind q (.tail _ hq))
+        (fun q hq => hidx q (.tail _ hq)) e h
+
+theorem minorType_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType}
+    {c : VConstVal} : (minorType U T np ty c).LevelWF (U+1) := by
+  simp only [minorType]
+  refine VExpr.LevelWF.forallN (liftTelN_levelWF fun B hB => ?_)
+    (VExpr.LevelWF.forallN (ihsFrom_levelWF _ _ recPairsR_idx_levelWF) ?_)
+  · obtain ⟨B₀, _, rfl⟩ := List.mem_map.1 hB
+    exact VExpr.LevelWF.instL VLevel.params'_one_wf
+  · refine VExpr.LevelWF.appN (f := .bvar _) trivial fun e h => ?_
+    rcases List.mem_append.1 h with h | h
+    · obtain ⟨e₀, he₀, rfl⟩ := List.mem_map.1 h
+      exact ((ctorIdxs_levelWF _ he₀).liftN).liftN
+    · rcases List.mem_cons.1 h with rfl | h
+      · refine VExpr.LevelWF.appN (f := .const c.name (VLevel.params' U 1))
+          VLevel.params'_one_wf fun e h => ?_
+        rcases List.mem_append.1 h with h | h
+        · exact bvarRevRange_levelWF _ _ _ h
+        · exact bvarRevRange_levelWF _ _ _ h
+      · cases h
+
+theorem minorTypeRec_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType}
+    {c : VConstVal} : (minorTypeRec U T np ty c).LevelWF (U+1) := by
+  simp only [minorTypeRec]
+  refine VExpr.LevelWF.forallN (liftTelN_levelWF fun B hB => ?_)
+    (VExpr.LevelWF.forallN
+      (ihsFromRecArgs_levelWF _ _ recArgsR_binder_levelWF recArgsR_idx_levelWF) ?_)
+  · obtain ⟨B₀, _, rfl⟩ := List.mem_map.1 hB
+    exact VExpr.LevelWF.instL VLevel.params'_one_wf
+  · refine VExpr.LevelWF.appN (f := .bvar _) trivial fun e h => ?_
+    rcases List.mem_append.1 h with h | h
+    · obtain ⟨e₀, he₀, rfl⟩ := List.mem_map.1 h
+      exact ((ctorIdxs_levelWF _ he₀).liftN).liftN
+    · rcases List.mem_cons.1 h with rfl | h
+      · refine VExpr.LevelWF.appN (f := .const c.name (VLevel.params' U 1))
+          VLevel.params'_one_wf fun e h => ?_
+        rcases List.mem_append.1 h with h | h
+        · exact bvarRevRange_levelWF _ _ _ h
+        · exact bvarRevRange_levelWF _ _ _ h
+      · cases h
+
+theorem minorTypes_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    ∀ (cs : List VConstVal) (i : Nat), ∀ e ∈ minorTypes U T np ty cs i, e.LevelWF (U+1)
+  | _ :: cs, i, e, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · exact minorType_levelWF.liftN
+    · exact minorTypes_levelWF cs (i+1) e h
+
+theorem minorTypesRec_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    ∀ (cs : List VConstVal) (i : Nat),
+      ∀ e ∈ minorTypesRec U T np ty cs i, e.LevelWF (U+1)
+  | _ :: cs, i, e, h => by
+    rcases List.mem_cons.1 h with rfl | h
+    · exact minorTypeRec_levelWF.liftN
+    · exact minorTypesRec_levelWF cs (i+1) e h
+
+theorem recType_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    (recType U T np ty).LevelWF (U+1) := by
+  refine VExpr.LevelWF.forallN (fun A hA => ?_)
+    ⟨motiveType_levelWF, VExpr.LevelWF.forallN (minorTypes_levelWF _ _)
+      (VExpr.LevelWF.forallN (liftTelN_levelWF idxTel_levelWF)
+        ⟨?_, ?_, trivial⟩)⟩
+  · obtain ⟨A₀, _, rfl⟩ := List.mem_map.1 hA
+    exact VExpr.LevelWF.instL VLevel.params'_one_wf
+  · refine VExpr.LevelWF.appN (f := .const T (VLevel.params' U 1)) VLevel.params'_one_wf
+      fun e h => ?_
+    rcases List.mem_append.1 h with h | h
+    · exact bvarRevRange_levelWF _ _ _ h
+    · exact bvarRevRange_levelWF _ _ _ h
+  · exact VExpr.LevelWF.appN (f := .bvar _) trivial (bvarRevRange_levelWF _ _)
+
+theorem recTypeRec_levelWF {U : Nat} {T : Name} {np : Nat} {ty : VInductiveType} :
+    (recTypeRec U T np ty).LevelWF (U+1) := by
+  refine VExpr.LevelWF.forallN (fun A hA => ?_)
+    ⟨motiveType_levelWF, VExpr.LevelWF.forallN (minorTypesRec_levelWF _ _)
+      (VExpr.LevelWF.forallN (liftTelN_levelWF idxTel_levelWF)
+        ⟨?_, ?_, trivial⟩)⟩
+  · obtain ⟨A₀, _, rfl⟩ := List.mem_map.1 hA
+    exact VExpr.LevelWF.instL VLevel.params'_one_wf
+  · refine VExpr.LevelWF.appN (f := .const T (VLevel.params' U 1)) VLevel.params'_one_wf
+      fun e h => ?_
+    rcases List.mem_append.1 h with h | h
+    · exact bvarRevRange_levelWF _ _ _ h
+    · exact bvarRevRange_levelWF _ _ _ h
+  · exact VExpr.LevelWF.appN (f := .bvar _) trivial (bvarRevRange_levelWF _ _)
+
+/-- Consume the induction-hypothesis telescope with well-typed values. -/
+theorem hasType_appN_ihs {env : VEnv} {U : Nat} {Γ : List VExpr} {m k : Nat}
+    {argOf : Nat × List VExpr → VExpr} {Dfin : VExpr} :
+    ∀ {rs : List (Nat × List VExpr)} {g : VExpr}, (∀ q ∈ rs, q.1 < m) →
+    (∀ q ∈ rs, env.HasType U Γ (argOf q)
+      (VExpr.appN (.bvar (k + m))
+        ((q.2.map fun e => ((e.liftN 1 q.1).liftN (m-q.1)).liftN k m) ++
+          [.bvar (m-1-q.1)]))) →
+    env.HasType U Γ g (VExpr.forallN (ihsR m k rs 0) (Dfin.liftN rs.length)) →
+    env.HasType U Γ (g.appN (rs.map argOf)) Dfin
+  | [], g, _, _, hg => by simpa [ihsR] using hg
+  | (j, idxs) :: rs, g, hm, hargs, hg => by
+    have happ := VEnv.HasType.app hg (hargs (j, idxs) (.head _))
+    simp only [List.length_cons] at happ
+    rw [show Dfin.liftN (rs.length+1) =
+        (Dfin.liftN rs.length).liftN 1 (0 + rs.length) from by
+        rw [Nat.zero_add, VExpr.liftN'_liftN' (Nat.zero_le _) (by omega)],
+      ihsR_liftN1 m k rs 0 0 (Nat.le_refl _) (fun q hq => hm q (.tail _ hq))
+        (Dfin.liftN rs.length),
+      VExpr.inst_liftN1] at happ
+    exact hasType_appN_ihs (rs := rs) (fun q hq => hm q (.tail _ hq))
+      (fun q hq => hargs q (.tail _ hq)) happ
+
+/-- Consume a normalized functional-IH telescope with one generated recursive
+call per recursive argument. -/
+theorem hasType_appN_ruleIHs {env : VEnv} {U : Nat} {Γ : List VExpr} {m k : Nat}
+    {argOf : RecArg → VExpr} {Dfin : VExpr} :
+    ∀ {rs : List RecArg} {g : VExpr},
+    (∀ r ∈ rs, env.HasType U Γ (argOf r) (r.ruleIH m k)) →
+    env.HasType U Γ g
+      (VExpr.forallN (ruleIHs m k rs 0) (Dfin.liftN rs.length)) →
+    env.HasType U Γ (g.appN (rs.map argOf)) Dfin
+  | [], g, _, hg => by simpa [ruleIHs] using hg
+  | r :: rs, g, hargs, hg => by
+    have happ := VEnv.HasType.app hg (by
+      simpa [ruleIHs] using hargs r (.head _))
+    simp only [List.length_cons] at happ
+    rw [show Dfin.liftN (rs.length+1) =
+        (Dfin.liftN rs.length).liftN 1 (0+rs.length) from by
+          rw [Nat.zero_add, VExpr.liftN'_liftN' (Nat.zero_le _) (by omega)],
+      ruleIHs_liftN1 m k rs 0 0 (Nat.le_refl _) (Dfin.liftN rs.length),
+      VExpr.inst_liftN1] at happ
+    exact hasType_appN_ruleIHs (rs := rs)
+      (fun q hq => hargs q (.tail _ hq)) happ
+
+namespace GenerationEnv
+
+variable {source : VInductDecl} {gen : GenerationChecked source}
+  {env : VEnv} (S : GenerationEnv gen env)
+include S
+-- `S` is included throughout so every lemma below is reachable as `S.lemma`,
+-- including those whose statement and proof never mention it.
+set_option linter.unusedSectionVars false
+
+/-! ## Mixed iota-rule preservation -/
+
+/-- Syntactic universe well-formedness follows from semantic well-formedness
+of the closed mixed recursor type. -/
+theorem recType_levelWF :
+    gen.recType.LevelWF (gen.recUvars) := by
+  obtain ⟨_, h⟩ := S.recType_isType
+  exact (h.levelWF trivial).1
+
+/-- The mixed recursor type is closed. -/
+theorem recType_closedN : gen.recType.ClosedN 0 := by
+  obtain ⟨_, h⟩ := S.recType_isType
+  exact VExpr.WF.closedN S.ord ⟨_, h⟩ trivial
+
+/-- The inserted mixed recursor constant at its identity universe list. -/
+theorem recursor_hasType
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor) {Γ} :
+    env.HasType (gen.recUvars) Γ
+      (.const (.str gen.block.sourceType.name "rec")
+        (gen.recLevels))
+      gen.recType := by
+  have h := HasType.const (Γ := Γ) hrec
+    VLevel.params_wf VLevel.params_length
+  rw [show gen.recursor.uvars =
+      gen.recUvars from rfl,
+    show gen.recursor.type = gen.recType from rfl] at h
+  rwa [S.recType_levelWF.instL_id] at h
+
+/-- Apply the mixed recursor to parameters, motive, and every constructor
+minor. The remaining type binds the indices and major premise. -/
+theorem recBase_hasType
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor)
+    (Δ : List VExpr) :
+    env.HasType (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const (.str gen.block.sourceType.name "rec")
+          (gen.recLevels))
+        (VExpr.bvarRevRange Δ.length
+          (source.nparams +
+            gen.block.ctorPairs.length + 1)))
+      ((VExpr.forallN
+        (VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.forallE
+          (VExpr.appN
+            (.const gen.block.sourceType.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                (gen.idxTel.length +
+                  gen.block.ctorPairs.length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange 0 gen.idxTel.length))
+          (.app
+            (VExpr.appN
+              (.bvar
+                (gen.idxTel.length +
+                  gen.block.ctorPairs.length + 1))
+              (VExpr.bvarRevRange 1 gen.idxTel.length))
+            (.bvar 0)))).liftN Δ.length) := by
+  have hf : env.HasType (gen.recUvars)
+      (Δ ++
+        (gen.paramsTel ++
+          gen.motiveType :: gen.minorTypes).reverse ++ [])
+      (.const (.str gen.block.sourceType.name "rec")
+        (gen.recLevels))
+      ((VExpr.forallN
+        (gen.paramsTel ++
+          gen.motiveType :: gen.minorTypes)
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            gen.idxTel 0)
+          (.forallE
+            (VExpr.appN
+              (.const gen.block.sourceType.name
+                (gen.sourceLevels))
+              (VExpr.bvarRevRange
+                  (gen.idxTel.length +
+                    gen.block.ctorPairs.length + 1)
+                  source.nparams ++
+                VExpr.bvarRevRange 0 gen.idxTel.length))
+            (.app
+              (VExpr.appN
+                (.bvar
+                  (gen.idxTel.length +
+                    gen.block.ctorPairs.length + 1))
+                (VExpr.bvarRevRange 1 gen.idxTel.length))
+              (.bvar 0))))).liftN
+        (Δ.length +
+          (gen.paramsTel ++
+            gen.motiveType :: gen.minorTypes).length)) := by
+    rw [show VExpr.forallN
+        (gen.paramsTel ++
+          gen.motiveType :: gen.minorTypes)
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            gen.idxTel 0)
+          (.forallE
+            (VExpr.appN
+              (.const gen.block.sourceType.name
+                (gen.sourceLevels))
+              (VExpr.bvarRevRange
+                  (gen.idxTel.length +
+                    gen.block.ctorPairs.length + 1)
+                  source.nparams ++
+                VExpr.bvarRevRange 0 gen.idxTel.length))
+            (.app
+              (VExpr.appN
+                (.bvar
+                  (gen.idxTel.length +
+                    gen.block.ctorPairs.length + 1))
+                (VExpr.bvarRevRange 1 gen.idxTel.length))
+              (.bvar 0)))) =
+        gen.recType from by
+          rw [VExpr.forallN_append]
+          rfl,
+      S.recType_closedN.liftN_eq (Nat.zero_le _)]
+    exact S.recursor_hasType hrec
+  have hspine := HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars) hf
+  simp only [List.reverse_append, List.reverse_cons, List.append_nil, List.append_assoc,
+    List.singleton_append, List.length_append, List.length_cons, gen.minorTypes_length] at hspine
+  rw [show gen.paramsTel.length = source.nparams from by
+      simp [GenerationChecked.paramsTel,
+        S.generationParams_length],
+    VExpr.bvarRevRange_congr' Δ.length
+      (show source.nparams +
+          (gen.block.ctorPairs.length + 1) =
+        source.nparams +
+          gen.block.ctorPairs.length + 1 by omega)] at hspine
+  simpa [List.append_assoc] using hspine
+
+/-- Apply the inserted mixed recursor to a typed index spine and major. -/
+theorem recApp_hasType
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor)
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (Δ.length +
+            gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))))
+      idxs
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))))
+    (hlen : idxs.length = gen.idxTel.length)
+    (ha : env.HasType (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      a
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (Δ.length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          idxs))) :
+    env.HasType (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (VExpr.appN
+          (.const (.str gen.block.sourceType.name "rec")
+            (gen.recLevels))
+          (VExpr.bvarRevRange Δ.length
+            (source.nparams +
+              gen.block.ctorPairs.length + 1)))
+        (idxs ++ [a]))
+      (VExpr.appN
+        (.bvar
+          (Δ.length +
+            gen.block.ctorPairs.length))
+        (idxs ++ [a])) := by
+  have hb := S.recBase_hasType hrec Δ
+  rw [VExpr.liftN_forallN,
+    VExpr.liftTelN_liftTelN,
+    liftTelN_congr _ _
+      (show gen.block.ctorPairs.length + 1 +
+          Δ.length =
+        Δ.length + gen.block.ctorPairs.length + 1 by omega)] at hb
+  have hcod :
+      (VExpr.forallE
+        (VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length))
+        (.app
+          (VExpr.appN
+            (.bvar
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1))
+            (VExpr.bvarRevRange 1 gen.idxTel.length))
+          (.bvar 0))).liftN Δ.length
+            (0 + (VExpr.liftTelN
+              (gen.block.ctorPairs.length + 1)
+              gen.idxTel 0).length) =
+      VExpr.forallE
+        (VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length + Δ.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length))
+        (.app
+          (VExpr.appN
+            (.bvar
+              (gen.idxTel.length + Δ.length +
+                gen.block.ctorPairs.length + 1))
+            (VExpr.bvarRevRange 1 gen.idxTel.length))
+          (.bvar 0)) := by
+    rw [VExpr.liftTelN_length, Nat.zero_add]
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN_appN, List.map_append,
+        bvarRevRange_liftN_ge _ _ _ _ (by omega),
+        VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+        VExpr.bvarRevRange_congr source.nparams
+          (show Δ.length +
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1) =
+            gen.idxTel.length + Δ.length +
+              gen.block.ctorPairs.length + 1 by omega)]
+      rfl
+    · show VExpr.app _ _ = VExpr.app _ _
+      congr 1
+      · rw [VExpr.liftN_appN,
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+        show VExpr.appN
+          (.bvar (liftVar Δ.length
+            (gen.idxTel.length +
+              gen.block.ctorPairs.length + 1)
+            (gen.idxTel.length + 1))) _ = _
+        rw [liftVar_le (by omega),
+          show Δ.length +
+              (gen.idxTel.length +
+                gen.block.ctorPairs.length + 1) =
+            gen.idxTel.length + Δ.length +
+              gen.block.ctorPairs.length + 1 by omega]
+  rw [hcod] at hb
+  have hshape := hidx.retarget
+    (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (gen.idxTel.length + Δ.length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          VExpr.bvarRevRange 0 gen.idxTel.length))
+      (.sort gen.motiveLevel))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _
+      (C := .const gen.block.sourceType.name
+        (gen.sourceLevels)) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _
+      (by rw [hlen]; omega),
+    show gen.idxTel.length + Δ.length +
+        gen.block.ctorPairs.length + 1 - idxs.length =
+      Δ.length + gen.block.ctorPairs.length + 1 from by
+        rw [hlen]
+        omega,
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hfull := hshape.snoc ha
+  simp only [VExpr.inst] at hfull
+  change env.SpineWF (gen.recUvars) _
+    (VExpr.forallN
+      (VExpr.liftTelN
+        (Δ.length + gen.block.ctorPairs.length + 1)
+        gen.idxTel 0)
+      (VExpr.forallN
+        [VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length + Δ.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0 gen.idxTel.length)]
+        (.sort gen.motiveLevel)))
+    (idxs ++ [a]) (.sort gen.motiveLevel) at hfull
+  rw [← VExpr.forallN_append] at hfull
+  have hfullLen : (idxs ++ [a]).length =
+      (VExpr.liftTelN
+          (Δ.length +
+            gen.block.ctorPairs.length + 1)
+          gen.idxTel 0 ++
+        [VExpr.appN
+          (.const gen.block.sourceType.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (gen.idxTel.length + Δ.length +
+                gen.block.ctorPairs.length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange 0
+              gen.idxTel.length)]).length := by
+    simp only [List.length_append, List.length_singleton,
+      VExpr.liftTelN_length, hlen]
+  have hactual := hfull.retarget hfullLen
+    (VExpr.app
+      (VExpr.appN
+        (.bvar
+          (gen.idxTel.length + Δ.length +
+            gen.block.ctorPairs.length + 1))
+        (VExpr.bvarRevRange 1 gen.idxTel.length))
+      (.bvar 0))
+  rw [VExpr.forallN_append] at hactual
+  have happ := hactual.hasType_appN hb
+  rw [show VExpr.app
+      (VExpr.appN
+        (.bvar
+          (gen.idxTel.length + Δ.length +
+            gen.block.ctorPairs.length + 1))
+        (VExpr.bvarRevRange 1 gen.idxTel.length))
+      (.bvar 0) =
+      VExpr.appN
+        (.bvar
+          (gen.idxTel.length + Δ.length +
+            gen.block.ctorPairs.length + 1))
+        (VExpr.bvarRevRange 0
+          (gen.idxTel.length + 1)) from by
+      rw [VExpr.bvarRevRange_congr' 0
+          (show gen.idxTel.length + 1 =
+            1 + gen.idxTel.length by omega),
+        ← VExpr.bvarRevRange_append
+          gen.idxTel.length 1]
+      simpa [VExpr.bvarRevRange, VExpr.appN] using
+        (VExpr.appN_append
+          (.bvar
+            (gen.idxTel.length + Δ.length +
+              gen.block.ctorPairs.length + 1))
+          (VExpr.bvarRevRange 1 gen.idxTel.length)
+          [VExpr.bvar 0]).symm,
+    VExpr.instRev_appN,
+    VExpr.instRev_bvar_ge _ (by
+      simp only [List.length_append,
+        List.length_singleton]
+      rw [hlen]
+      omega),
+    VExpr.bvarRevRange_congr' 0
+      (show gen.idxTel.length + 1 =
+        (idxs ++ [a]).length by simp [hlen]),
+    VExpr.map_instRev_bvarRevRange] at happ
+  rw [show gen.idxTel.length + Δ.length +
+      gen.block.ctorPairs.length + 1 -
+        (idxs ++ [a]).length =
+      Δ.length + gen.block.ctorPairs.length from by
+    simp only [List.length_append, List.length_singleton]
+    rw [hlen]
+    omega] at happ
+  simpa [List.length_append, hlen] using happ
+
+/-- The mixed motive variable applied to an index spine and major. -/
+theorem motiveApp_hasType
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (Δ.length +
+            gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))))
+      idxs
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))))
+    (hlen : idxs.length = gen.idxTel.length)
+    (ha : env.HasType (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      a
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            (Δ.length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          idxs))) :
+    env.HasType (gen.recUvars)
+      (Δ ++ (gen.minorTypes.reverse ++
+        (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.bvar
+          (Δ.length +
+            gen.block.ctorPairs.length))
+        (idxs ++ [a]))
+      (.sort gen.motiveLevel) := by
+  have hM := getElem?_rstack3 Δ
+    gen.minorTypes.reverse gen.motiveType
+    gen.paramsTel.reverse
+    (i := Δ.length + gen.block.ctorPairs.length)
+    (by simp only [List.length_reverse,
+      gen.minorTypes_length])
+  exact gen.motiveVarApp_hasType
+    (.bvar (Lookup.of_getElem? hM))
+    hidx hlen ha
+
+/-- The raw constructor-headed major in the complete mixed rule context. -/
+theorem ctorAppRule_hasType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.HasType (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            ((ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            ((ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length)) := by
+  have h := S.ctorApp_transport hctor
+    (gen.minorTypes.reverse ++ [gen.motiveType])
+    (g := gen.block.ctorPairs.length + 1)
+    (by simp [gen.minorTypes_length])
+    [] (d := 0) rfl
+  rw [VExpr.bvarRevRange_congr source.nparams
+    (show
+      0 + (gen.block.ctorPairs.length + 1 +
+        (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length) =
+      (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length +
+        gen.block.ctorPairs.length + 1 by omega)] at h
+  simpa [List.append_assoc] using h
+
+/-- The complete mixed rule binder telescope is well formed. -/
+theorem ruleBinders_onTel {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.OnTel (gen.recUvars) []
+      (gen.paramsTel ++
+        gen.motiveType :: gen.minorTypes ++
+        VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0) := by
+  have hF₀ := S.fields_onTel_minor hctor
+  have hF := hF₀.weakN S.ord
+    (Ctx.LiftN.zero
+      (Γ := gen.motiveType :: gen.paramsTel.reverse)
+      gen.minorTypes.reverse)
+  rw [VExpr.liftTelN_liftTelN,
+    liftTelN_congr _ _
+      (show 1 + gen.minorTypes.reverse.length =
+        gen.block.ctorPairs.length + 1 by
+          simp [gen.minorTypes_length, Nat.add_comm])] at hF
+  refine OnTel.append
+    (OnTel.append S.paramsTel_onTel ⟨?_, ?_⟩) ?_
+  · simpa only [List.append_nil] using S.motive_isType
+  · simpa only [List.append_nil] using S.minorTypes_onTel
+  · simpa only [List.append_nil, List.append_assoc,
+      List.reverse_append, List.reverse_cons,
+      List.singleton_append] using hF
+
+/-- The type recorded on every mixed iota rule is itself a type. -/
+theorem ruleType_isType {i : Nat} {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs) :
+    env.IsType (gen.recUvars) []
+      ((gen.rule i ctor).type) := by
+  show env.IsType (gen.recUvars) []
+    (VExpr.forallN
+      (gen.paramsTel ++
+        gen.motiveType :: gen.minorTypes ++
+        VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0)
+      (VExpr.appN
+        (.bvar
+          (gen.block.ctorPairs.length +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+        (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length) ++
+          [VExpr.appN
+            (.const ctor.raw.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  gen.block.ctorPairs.length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)])))
+  refine IsType.forallN (S.ruleBinders_onTel hctor) ?_
+  simp only [List.reverse_append, List.reverse_cons,
+    List.append_nil, List.append_assoc,
+    List.singleton_append]
+  have hSp₀ := S.result_transport hctor
+    (gen.minorTypes.reverse ++ [gen.motiveType])
+    (g := gen.block.ctorPairs.length + 1)
+    (by simp [gen.minorTypes_length])
+    [] (d := 0) rfl
+  have hSp : env.SpineWF (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          ((ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length +
+            gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))))
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        e.liftN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length)
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+    simpa [List.append_assoc, Nat.add_assoc] using hSp₀
+  have hidxLen :
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        e.liftN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length).length =
+      gen.idxTel.length := by
+    simp only [List.length_map,
+      NormalizedCtor.resultIndicesR,
+      GenerationChecked.idxTel]
+    exact (S.viewResultIndices_length hctor).trans
+      gen.shape.2.2.1.symm
+  have hctorApp := S.ctorAppRule_hasType hctor
+  have hSp' : env.SpineWF (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          ((VExpr.liftTelN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination)
+              0).reverse.length +
+            gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))))
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        e.liftN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length)
+      (.sort (gen.block.checked.resultLevel.inst
+        (gen.sourceLevels))) := by
+    simpa only [List.length_reverse,
+      VExpr.liftTelN_length] using hSp
+  have hctorApp' : env.HasType (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            ((ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            ((VExpr.liftTelN
+                (gen.block.ctorPairs.length + 1)
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination)
+                0).reverse.length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length)) := by
+    simpa only [List.length_reverse,
+      VExpr.liftTelN_length] using hctorApp
+  refine ⟨gen.motiveLevel, ?_⟩
+  have hm := S.motiveApp_hasType
+    (VExpr.liftTelN
+      (gen.block.ctorPairs.length + 1)
+      (ctor.fieldsR source.uvars source.nparams gen.elimination)
+      0).reverse
+    hSp' hidxLen hctorApp'
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show
+      (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length +
+          gen.block.ctorPairs.length =
+        gen.block.ctorPairs.length +
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length by omega,
+    show
+      gen.block.ctorPairs.length +
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length + 1 =
+        (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length +
+          gen.block.ctorPairs.length + 1 by omega] at hm
+  exact hm
+
+/-- A retained recursive descriptor generates a well-typed direct or
+lambda-valued recursive call in the complete mixed rule context. -/
+theorem ruleCall_hasType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs)
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor)
+    {r : RecArg}
+    (hr : r ∈ ctor.recArgsR source.uvars gen.elimination) :
+    env.HasType (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (r.ruleCall
+        (ctor.fieldsR source.uvars source.nparams gen.elimination).length
+        gen.block.ctorPairs.length
+        (VExpr.appN
+          (.const
+            (.str gen.block.sourceType.name "rec")
+            (gen.recLevels))
+          (VExpr.bvarRevRange
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length
+            (source.nparams +
+              gen.block.ctorPairs.length + 1))))
+      (r.ruleIH
+        (ctor.fieldsR source.uvars source.nparams gen.elimination).length
+        gen.block.ctorPairs.length) := by
+  obtain ⟨r₀, hr₀, rfl⟩ :=
+    NormalizedCtor.recArgsR_mem hr
+  obtain ⟨Bview, hBview, hrecArg⟩ :=
+    S.viewRecArg_data hctor hr₀
+  let ls := gen.sourceLevels
+  let r := r₀.instL ls
+  let Bs := ctor.fieldsR source.uvars source.nparams gen.elimination
+  let m := Bs.length
+  let k := gen.block.ctorPairs.length
+  let j := r₀.fieldIndex
+  let Fs := VExpr.liftTelN (k+1) Bs 0
+  let As := r.ruleBinders m k
+  let idxs := r.indices.map fun e =>
+    (e.liftN (k+1)
+      (r.fieldIndex+r.binders.length)).liftN
+        (m-r.fieldIndex) r.binders.length
+  let Γ := Fs.reverse ++
+    (gen.minorTypes.reverse ++
+      (gen.motiveType :: gen.paramsTel.reverse))
+  have hjm : j < m := by
+    have hview := S.viewRecArg_lt hctor hr₀
+    have hfields :=
+      (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+    simp only [j, m, Bs, NormalizedCtor.fieldsR_length]
+    omega
+  have hjraw :
+      r₀.fieldIndex <
+        (ctor.rawFields source.nparams).length := by
+    simpa [j, m, Bs,
+      NormalizedCtor.fieldsR_length] using hjm
+  let Braw :=
+    (ctor.rawFields source.nparams)[r₀.fieldIndex]
+  have hBraw :
+      (ctor.rawFields source.nparams)[r₀.fieldIndex]? =
+        some Braw :=
+    List.getElem?_eq_getElem hjraw
+  have hFsLen : Fs.length = m := by
+    simp [Fs, m, VExpr.liftTelN_length]
+  have ht := S.recArg_transport hctor hr₀
+    (gen.minorTypes.reverse ++ [gen.motiveType])
+    (g := k+1) (by simp [k, gen.minorTypes_length])
+    (Fs.drop j).reverse (d := m-j) (by
+      simp only [List.length_reverse, List.length_drop,
+        hFsLen])
+  dsimp only [r, j, RecArg.instL] at ht
+  have hctx :
+      (Fs.drop j).reverse ++
+          ((VExpr.liftTelN (k+1)
+              (Bs.take j) 0).reverse ++
+            ((gen.minorTypes.reverse ++
+              [gen.motiveType]) ++
+              gen.paramsTel.reverse)) = Γ := by
+    dsimp only [Γ, Fs]
+    rw [← VExpr.liftTelN_take, List.append_assoc,
+      ← List.append_assoc
+        (((VExpr.liftTelN (k+1) Bs 0).drop j).reverse),
+      ← List.reverse_append, List.take_append_drop,
+      List.singleton_append, ← List.append_assoc]
+  have htel : env.OnTel
+      (gen.recUvars) Γ As := by
+    rw [hctx] at ht
+    simpa [r, As, m, k, j, RecArg.instL,
+      RecArg.ruleBinders] using ht.1
+  have hsp : env.SpineWF (gen.recUvars)
+      (As.reverse ++ Γ)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (m+k+r.binders.length+1)
+          gen.idxTel 0)
+        (.sort (gen.block.checked.resultLevel.inst ls)))
+      idxs
+      (.sort (gen.block.checked.resultLevel.inst ls)) := by
+    rw [hctx] at ht
+    simpa [r, As, idxs, m, k, j, ls,
+      RecArg.instL, RecArg.ruleBinders,
+      List.append_assoc,
+      show j + r₀.binders.length + (k+1) + (m-j) =
+        m+k+r₀.binders.length+1 by omega] using ht.2
+  have hF : Γ[m-1-j]? =
+      some ((Braw.instL ls).liftN (k+1) j) := by
+    dsimp only [Γ, Fs]
+    rw [List.getElem?_append_left
+        (by
+          simp only [List.length_reverse,
+            VExpr.liftTelN_length]
+          omega),
+      List.getElem?_reverse (by rw [hFsLen]; omega),
+      VExpr.liftTelN_length,
+      show m - 1 - (m - 1 - j) = j by omega,
+      VExpr.liftTelN_getElem?,
+      NormalizedCtor.fieldsR_getElem?, hBraw]
+    simp [ls]
+  have hlu := Lookup.of_getElem? hF
+  dsimp only [j, r] at hlu
+  rw [show m-1-r₀.fieldIndex+1 =
+      m-r₀.fieldIndex by omega] at hlu
+  have hf0 := VEnv.HasType.bvar
+    (env := env) (U := gen.recUvars) hlu
+  obtain ⟨u, hdom₀⟩ :=
+    S.emittedField_defeq hctor hBraw hBview
+  have hdom₁ := hdom₀.instL
+    (U' := gen.recUvars)
+    gen.sourceLevels_wf
+  have hdomChecked : env.IsDefEq (gen.recUvars)
+      ((ctor.fieldsR source.uvars source.nparams gen.elimination |>.take
+          r₀.fieldIndex).reverse ++
+        (gen.block.checked.params.map (VExpr.instL ls)).reverse)
+      (Braw.instL ls) (Bview.instL ls) ((VExpr.sort u).instL ls) := by
+    simpa [NormalizedCtor.fieldsR, List.map_append,
+      List.map_reverse, List.map_take] using hdom₁
+  have hprefix := S.generationFieldPrefix_ctx_rec hctor r₀.fieldIndex
+  have hdomGeneration := hdomChecked.defeqDFC S.ord
+    (hprefix.symm S.ord)
+  have hjlen :
+      (Bs.take r₀.fieldIndex).length =
+        r₀.fieldIndex := by
+    simp only [Bs, NormalizedCtor.fieldsR,
+      List.length_take, List.length_map]
+    omega
+  have Wmid := Ctx.LiftN.consTel
+    (n := k+1)
+    (Bs.take r₀.fieldIndex)
+    (Ctx.LiftN.zero
+      (n := k+1)
+      (Γ := gen.paramsTel.reverse)
+      (gen.minorTypes.reverse ++
+        [gen.motiveType])
+      (h := by simp [k, gen.minorTypes_length]))
+  rw [hjlen, Nat.add_zero] at Wmid
+  have hdom₂ := hdomGeneration.weakN S.ord Wmid
+  have Wstack := Ctx.LiftN.zero
+    (n := m-j)
+    (Γ := (VExpr.liftTelN (k+1)
+        (Bs.take j) 0).reverse ++
+      ((gen.minorTypes.reverse ++
+        [gen.motiveType]) ++
+        gen.paramsTel.reverse))
+    (Fs.drop j).reverse
+    (h := by
+      simp only [List.length_reverse, List.length_drop,
+        hFsLen])
+  have hdom₃ := hdom₂.weakN S.ord Wstack
+  rw [hctx] at hdom₃
+  have hfView := hdom₃.defeq hf0
+  have hfield := recArg_rule_fieldType
+    hrecArg m k (by simpa [j] using hjm) gen.elimination
+  simp only [RecArg.instL] at hfield
+  dsimp only [j] at hfView
+  simp only [Nat.add_zero] at hfView
+  rw [hfield] at hfView
+  have hf := hfView.weakN S.ord
+    (Ctx.LiftN.zero (Γ := Γ) As.reverse)
+  have hmajor := VEnv.HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars)
+    (As := As)
+    (B := VExpr.appN
+      (.const gen.block.sourceType.name ls)
+      (VExpr.bvarRevRange
+          (m+k+r.binders.length+1)
+          source.nparams ++
+        idxs))
+    (Δ := []) (Γ := Γ) (by
+      simpa [As, r, idxs, j, ls,
+        RecArg.instL, RecArg.ruleBinders,
+        List.length_reverse, List.map_map,
+        Function.comp_def] using hf)
+  simp only [List.length_nil, VExpr.liftN_zero,
+    List.nil_append] at hmajor
+  have hAsLen :
+      As.length = r.binders.length := by
+    simp [As, RecArg.ruleBinders,
+      VExpr.liftTelN_length]
+  change env.HasType (gen.recUvars)
+    (As.reverse ++ Γ)
+    ((VExpr.bvar
+      (m-1-r.fieldIndex+As.length)).appN
+        (VExpr.bvarRevRange 0 As.length))
+    (VExpr.appN
+      (.const gen.block.sourceType.name ls)
+      (VExpr.bvarRevRange
+          (m+k+r.binders.length+1)
+          source.nparams ++
+        idxs)) at hmajor
+  rw [hAsLen] at hmajor
+  have hlen : idxs.length = gen.idxTel.length := by
+    simpa [idxs, r, RecArg.instL,
+      GenerationChecked.idxTel] using
+      (S.viewRecArg_indices_length hctor hr₀).trans
+        gen.shape.2.2.1.symm
+  have hcall := S.recApp_hasType hrec
+    (As.reverse ++ Fs.reverse)
+    (by
+      simpa [Γ, List.append_assoc, hAsLen, hFsLen,
+        Nat.add_comm, Nat.add_left_comm,
+        Nat.add_assoc] using hsp)
+    hlen
+    (by
+      simpa [Γ, List.append_assoc, hAsLen, hFsLen,
+        Nat.add_comm, Nat.add_left_comm,
+        Nat.add_assoc] using hmajor)
+  have hbaseLift :
+      (VExpr.appN
+        (.const
+          (.str gen.block.sourceType.name "rec")
+          (gen.recLevels))
+        (VExpr.bvarRevRange m
+          (source.nparams+(k+1)))).liftN
+          r.binders.length =
+      VExpr.appN
+        (.const
+          (.str gen.block.sourceType.name "rec")
+          (gen.recLevels))
+        (VExpr.bvarRevRange
+          (m+r.binders.length)
+          (source.nparams+(1+k))) := by
+    rw [VExpr.liftN_appN]
+    simp only [VExpr.liftN]
+    rw [bvarRevRange_liftN_ge _ _ _ _
+      (Nat.zero_le _)]
+    rw [show source.nparams+(k+1) =
+      source.nparams+(1+k) by omega]
+    apply congrArg (VExpr.appN _)
+    apply VExpr.bvarRevRange_congr
+    omega
+  have hbaseRange :
+      VExpr.appN
+        ((VExpr.const
+          (.str gen.block.sourceType.name "rec")
+          (gen.recLevels)).app
+            (VExpr.bvar
+              (source.nparams +
+                (k + (m + r.binders.length)))))
+        (VExpr.bvarRevRange
+          (m+r.binders.length)
+          (source.nparams+k)) =
+      VExpr.appN
+        (.const
+          (.str gen.block.sourceType.name "rec")
+          (gen.recLevels))
+        (VExpr.bvarRevRange
+          (m+r.binders.length)
+          (source.nparams+(1+k))) := by
+    rw [show source.nparams + (k + (m + r.binders.length)) =
+        (m+r.binders.length) + (source.nparams+k) by omega,
+      show source.nparams+(1+k) = (source.nparams+k)+1 by omega]
+    rfl
+  have hlam := HasType.lamN htel (by
+    simpa [Γ, Fs, hAsLen, hFsLen,
+      List.append_assoc, VExpr.liftN_appN,
+      bvarRevRange_liftN_ge _ _ _ _
+        (Nat.zero_le _),
+      Nat.add_comm, Nat.add_left_comm,
+      Nat.add_assoc] using hcall)
+  simp only [VExpr.liftTelN_length] at hlam
+  rw [hbaseRange] at hlam
+  simpa only [RecArg.ruleCall, RecArg.ruleIH,
+    r, Bs, ls, As, idxs, m, k, Γ, Fs, hbaseLift,
+    VExpr.liftTelN_length, List.append_assoc,
+    Nat.add_assoc] using hlam
+
+/-- The selected mixed constructor minor applied to all raw fields and to one
+generated direct or functional recursive call for every retained `RecArg`. -/
+theorem minorApp_hasType {i : Nat} {ctor : NormalizedCtor}
+    (hci : gen.block.ctorPairs[i]? = some ctor)
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor) :
+    env.HasType (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.bvar
+          (gen.block.ctorPairs.length - 1 - i +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+        (VExpr.bvarRevRange 0
+            (ctor.fieldsR source.uvars source.nparams gen.elimination).length ++
+          List.map (fun r =>
+              r.ruleCall
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length
+                gen.block.ctorPairs.length
+                (VExpr.appN
+                  (.const
+                    (.str gen.block.sourceType.name "rec")
+                    (gen.recLevels))
+                  (VExpr.bvarRevRange
+                    (ctor.fieldsR
+                      source.uvars source.nparams gen.elimination).length
+                    (source.nparams +
+                      gen.block.ctorPairs.length + 1))))
+            (ctor.recArgsR source.uvars gen.elimination)))
+      (VExpr.appN
+        (.bvar
+          (gen.block.ctorPairs.length +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+        (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length) ++
+          [VExpr.appN
+            (.const ctor.raw.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  gen.block.ctorPairs.length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)])) := by
+  obtain ⟨hik, -⟩ :=
+    List.getElem?_eq_some_iff.1 hci
+  have hctor := List.mem_of_getElem? hci
+  let rs := ctor.recArgsR source.uvars gen.elimination
+  have hrs :
+      rs = ctor.recArgsR source.uvars gen.elimination := rfl
+  have hrsLt : ∀ r ∈ rs,
+      r.fieldIndex <
+        (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length := by
+    intro r hr
+    obtain ⟨r₀, hr₀, rfl⟩ :=
+      NormalizedCtor.recArgsR_mem (hrs ▸ hr)
+    have hview := S.viewRecArg_lt hctor hr₀
+    have hfields :=
+      (gen.shape.2.2.2.2.2 ctor hctor).2.2.2
+    simp only [RecArg.instL,
+      NormalizedCtor.fieldsR_length]
+    omega
+  rw [VExpr.appN_append]
+  have hminorAt :
+      gen.minorTypes[i]? =
+        some
+          (VExpr.liftN i
+            (GenerationChecked.minorType
+              (source := source) ctor gen.elimination)) := by
+    simpa [GenerationChecked.minorTypes, hci] using
+      gen.minorTypesAux_getElem?
+        gen.block.ctorPairs 0 i
+  have hlu0 :
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))[
+          gen.block.ctorPairs.length - 1 - i +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length]? =
+        some
+          (VExpr.liftN i
+            (GenerationChecked.minorType
+              (source := source) ctor gen.elimination)) := by
+    rw [getElem?_rstack_mid _ _ _
+        (by
+          simp only [List.length_reverse,
+            VExpr.liftTelN_length]
+          omega)
+        (by
+          simp only [List.length_reverse,
+            VExpr.liftTelN_length,
+            gen.minorTypes_length]
+          omega),
+      show
+        gen.block.ctorPairs.length - 1 - i +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length -
+            (VExpr.liftTelN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination)
+              0).reverse.length =
+          gen.block.ctorPairs.length - 1 - i by
+        simp only [List.length_reverse,
+          VExpr.liftTelN_length]
+        omega,
+      List.getElem?_reverse
+        (by
+          simp only [gen.minorTypes_length]
+          omega),
+      show
+        gen.minorTypes.length - 1 -
+            (gen.block.ctorPairs.length - 1 - i) =
+          i by
+        simp only [gen.minorTypes_length]
+        omega,
+      hminorAt]
+  have hlu := Lookup.of_getElem? hlu0
+  rw [VExpr.liftN_liftN,
+    show
+      i +
+          (gen.block.ctorPairs.length - 1 - i +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length + 1) =
+        (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length +
+          gen.block.ctorPairs.length by omega] at hlu
+  have hminorEq :
+      (GenerationChecked.minorType
+              (source := source) ctor gen.elimination).liftN
+          ((ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length +
+            gen.block.ctorPairs.length) =
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination)
+            0)
+          ((VExpr.forallN
+            (ihsFromRecArgs
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length
+              rs 0)
+            (VExpr.appN
+              (.bvar
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  rs.length))
+              (((ctor.resultIndicesR source.uvars gen.elimination).map
+                  fun e =>
+                    (e.liftN 1
+                      (ctor.fieldsR
+                        source.uvars source.nparams gen.elimination).length).liftN
+                      rs.length) ++
+                [VExpr.appN
+                  (.const ctor.raw.name
+                    (gen.sourceLevels))
+                  (VExpr.bvarRevRange
+                      (rs.length +
+                        (ctor.fieldsR
+                          source.uvars source.nparams gen.elimination).length +
+                        1)
+                      source.nparams ++
+                    VExpr.bvarRevRange rs.length
+                      (ctor.fieldsR
+                        source.uvars source.nparams gen.elimination).length)]))).liftN
+              gen.block.ctorPairs.length
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length)).liftN
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length := by
+    simp only [GenerationChecked.minorType, rs]
+    conv => lhs; rw [VExpr.liftN_forallN,
+        VExpr.liftTelN_liftTelN,
+        liftTelN_congr _ _
+          (show
+            (1 : Nat) +
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  gen.block.ctorPairs.length) =
+              gen.block.ctorPairs.length + 1 +
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length by
+            omega),
+        show
+          (0 : Nat) +
+              (VExpr.liftTelN 1
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination)
+                0).length =
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length by
+          simp [VExpr.liftTelN_length]]
+    conv => rhs; rw [VExpr.liftN_forallN,
+        VExpr.liftTelN_liftTelN,
+        show
+          (0 : Nat) +
+              (VExpr.liftTelN
+                (gen.block.ctorPairs.length + 1)
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination)
+                0).length =
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length by
+          simp [VExpr.liftTelN_length],
+        VExpr.liftN'_liftN_hi,
+        Nat.add_comm gen.block.ctorPairs.length
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length]
+  have hfields := HasType.appN_selfSpine
+    (env := env) (U := gen.recUvars)
+    (As := VExpr.liftTelN
+      (gen.block.ctorPairs.length + 1)
+      (ctor.fieldsR source.uvars source.nparams gen.elimination)
+      0)
+    (B :=
+      (VExpr.forallN
+        (ihsFromRecArgs
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length
+          rs 0)
+        (VExpr.appN
+          (.bvar
+            ((ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+              rs.length))
+          (((ctor.resultIndicesR source.uvars gen.elimination).map
+              fun e =>
+                (e.liftN 1
+                  (ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length).liftN
+                  rs.length) ++
+            [VExpr.appN
+              (.const ctor.raw.name
+                (gen.sourceLevels))
+              (VExpr.bvarRevRange
+                  (rs.length +
+                    (ctor.fieldsR
+                      source.uvars source.nparams gen.elimination).length +
+                    1)
+                  source.nparams ++
+                VExpr.bvarRevRange rs.length
+                  (ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length)]))).liftN
+        gen.block.ctorPairs.length
+        (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length)
+    (Δ := [])
+    (Γ := gen.minorTypes.reverse ++
+      (gen.motiveType :: gen.paramsTel.reverse))
+    (f := .bvar
+      (gen.block.ctorPairs.length - 1 - i +
+        (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length))
+    (by
+      have hb := VEnv.HasType.bvar
+        (env := env) (U := gen.recUvars) hlu
+      rw [hminorEq] at hb
+      simpa [VExpr.liftTelN_length] using hb)
+  simp only [List.length_nil,
+    VExpr.liftTelN_length,
+    VExpr.liftN_zero] at hfields
+  rw [ihsFromRecArgs_liftN'
+    (ctor.fieldsR source.uvars source.nparams gen.elimination).length
+    gen.block.ctorPairs.length rs hrsLt 0
+    (VExpr.appN
+      (.bvar
+        ((ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length +
+          rs.length))
+      (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+          (e.liftN 1
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length).liftN
+            rs.length) ++
+        [VExpr.appN
+          (.const ctor.raw.name
+            (gen.sourceLevels))
+          (VExpr.bvarRevRange
+              (rs.length +
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length + 1)
+              source.nparams ++
+            VExpr.bvarRevRange rs.length
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length)]))
+    (cut :=
+      (ctor.fieldsR
+        source.uvars source.nparams gen.elimination).length)
+    rfl] at hfields
+  have hD :
+      (VExpr.appN
+        (.bvar
+          ((ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length +
+            rs.length))
+        (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            (e.liftN 1
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length).liftN
+              rs.length) ++
+          [VExpr.appN
+            (.const ctor.raw.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                (rs.length +
+                  (ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange rs.length
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)])).liftN
+        gen.block.ctorPairs.length
+        ((ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length +
+          0 + rs.length) =
+      (VExpr.appN
+        (.bvar
+          (gen.block.ctorPairs.length +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+        (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length) ++
+          [VExpr.appN
+            (.const ctor.raw.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  gen.block.ctorPairs.length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)])).liftN
+        rs.length := by
+    rw [VExpr.liftN_appN, VExpr.liftN_appN,
+      List.map_append, List.map_append,
+      List.map_map, List.map_map]
+    show VExpr.appN _ (_ ++ [_]) =
+      VExpr.appN _ (_ ++ [_])
+    congr 1
+    · show
+        VExpr.bvar
+            (liftVar gen.block.ctorPairs.length
+              ((ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length +
+                rs.length)
+              ((ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length +
+                0 + rs.length)) =
+          VExpr.bvar
+            (liftVar rs.length
+              (gen.block.ctorPairs.length +
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)
+              0)
+      rw [liftVar_le (by omega),
+        liftVar_le (Nat.zero_le _)]
+      congr 1
+      omega
+    · congr 1
+      · apply List.map_congr_left
+        intro e _
+        simp only [Function.comp_apply]
+        rw [show
+            (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+                0 + rs.length =
+              (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length +
+                rs.length by omega,
+          VExpr.liftN_liftN_mid e
+            gen.block.ctorPairs.length rs.length
+            (Nat.zero_le _)]
+      · congr 1
+        simp only []
+        rw [show
+            (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+                0 + rs.length =
+              (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length +
+                rs.length by omega]
+        rw [VExpr.liftN_appN,
+          VExpr.liftN_appN,
+          List.map_append, List.map_append,
+          bvarRevRange_liftN_ge _ _ _ _ (by omega),
+          VExpr.bvarRevRange_liftN_high _ _ _ _
+            (by omega),
+          bvarRevRange_liftN_ge _ _ _ _
+            (Nat.zero_le _),
+          bvarRevRange_liftN_ge _ _ _ _
+            (Nat.zero_le _),
+          VExpr.bvarRevRange_congr source.nparams
+            (show
+              gen.block.ctorPairs.length +
+                  (rs.length +
+                    (ctor.fieldsR
+                      source.uvars source.nparams gen.elimination).length +
+                    1) =
+                rs.length +
+                  ((ctor.fieldsR
+                      source.uvars source.nparams gen.elimination).length +
+                    gen.block.ctorPairs.length + 1) by
+              omega),
+          VExpr.bvarRevRange_congr _
+            (show rs.length = rs.length + 0 by omega)]
+        rfl
+  rw [hD] at hfields
+  have hres := hasType_appN_ruleIHs
+    (env := env) (U := gen.recUvars)
+    (m :=
+      (ctor.fieldsR
+        source.uvars source.nparams gen.elimination).length)
+    (k := gen.block.ctorPairs.length)
+    (rs := rs)
+    (argOf := fun r =>
+      r.ruleCall
+        (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length
+        gen.block.ctorPairs.length
+        (VExpr.appN
+          (.const
+            (.str gen.block.sourceType.name "rec")
+            (gen.recLevels))
+          (VExpr.bvarRevRange
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length
+            (source.nparams +
+              gen.block.ctorPairs.length + 1))))
+    (fun r hr =>
+      S.ruleCall_hasType hctor hrec (hrs ▸ hr))
+    hfields
+  simpa only [hrs] using hres
+
+/-- The constructor-headed left side of a mixed iota rule. -/
+theorem recRuleApp_hasType {ctor : NormalizedCtor}
+    (hctor : ctor ∈ gen.block.ctorPairs)
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor) :
+    env.HasType (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (VExpr.appN
+          (.const
+            (.str gen.block.sourceType.name "rec")
+            (gen.recLevels))
+          (VExpr.bvarRevRange
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length
+            (source.nparams +
+              gen.block.ctorPairs.length + 1)))
+        (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length) ++
+          [VExpr.appN
+            (.const ctor.raw.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  gen.block.ctorPairs.length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)]))
+      (VExpr.appN
+        (.bvar
+          (gen.block.ctorPairs.length +
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+        (((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length) ++
+          [VExpr.appN
+            (.const ctor.raw.name
+              (gen.sourceLevels))
+            (VExpr.bvarRevRange
+                ((ctor.fieldsR
+                    source.uvars source.nparams gen.elimination).length +
+                  gen.block.ctorPairs.length + 1)
+                source.nparams ++
+              VExpr.bvarRevRange 0
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination).length)])) := by
+  have hSp₀ := S.result_transport hctor
+    (gen.minorTypes.reverse ++ [gen.motiveType])
+    (g := gen.block.ctorPairs.length + 1)
+    (by simp [gen.minorTypes_length])
+    [] (d := 0) rfl
+  have hSp : env.SpineWF (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN
+          ((VExpr.liftTelN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination)
+              0).reverse.length +
+            gen.block.ctorPairs.length + 1)
+          gen.idxTel 0)
+        (.sort
+          (gen.block.checked.resultLevel.inst
+            (gen.sourceLevels))))
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        e.liftN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length)
+      (.sort
+        (gen.block.checked.resultLevel.inst
+          (gen.sourceLevels))) := by
+    simpa [List.append_assoc, Nat.add_assoc,
+      List.length_reverse, VExpr.liftTelN_length]
+      using hSp₀
+  have hidxLen :
+      ((ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+        e.liftN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length).length =
+        gen.idxTel.length := by
+    simp only [List.length_map,
+      NormalizedCtor.resultIndicesR,
+      GenerationChecked.idxTel]
+    exact (S.viewResultIndices_length hctor).trans
+      gen.shape.2.2.1.symm
+  have ha₀ := S.ctorAppRule_hasType hctor
+  have ha : env.HasType (gen.recUvars)
+      ((VExpr.liftTelN
+          (gen.block.ctorPairs.length + 1)
+          (ctor.fieldsR source.uvars source.nparams gen.elimination)
+          0).reverse ++
+        (gen.minorTypes.reverse ++
+          (gen.motiveType :: gen.paramsTel.reverse)))
+      (VExpr.appN
+        (.const ctor.raw.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            ((ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          VExpr.bvarRevRange 0
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination).length))
+      (VExpr.appN
+        (.const gen.block.sourceType.name
+          (gen.sourceLevels))
+        (VExpr.bvarRevRange
+            ((VExpr.liftTelN
+                (gen.block.ctorPairs.length + 1)
+                (ctor.fieldsR
+                  source.uvars source.nparams gen.elimination)
+                0).reverse.length +
+              gen.block.ctorPairs.length + 1)
+            source.nparams ++
+          (ctor.resultIndicesR source.uvars gen.elimination).map fun e =>
+            e.liftN
+              (gen.block.ctorPairs.length + 1)
+              (ctor.fieldsR
+                source.uvars source.nparams gen.elimination).length)) := by
+    simpa only [List.length_reverse,
+      VExpr.liftTelN_length] using ha₀
+  have hr := S.recApp_hasType hrec
+    (VExpr.liftTelN
+      (gen.block.ctorPairs.length + 1)
+      (ctor.fieldsR source.uvars source.nparams gen.elimination)
+      0).reverse
+    hSp hidxLen ha
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show
+      (ctor.fieldsR
+          source.uvars source.nparams gen.elimination).length +
+          gen.block.ctorPairs.length =
+        gen.block.ctorPairs.length +
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length by
+      omega,
+    show
+      gen.block.ctorPairs.length +
+          (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length + 1 =
+        (ctor.fieldsR
+            source.uvars source.nparams gen.elimination).length +
+          gen.block.ctorPairs.length + 1 by
+      omega] at hr
+  exact hr
+
+/-- Every per-constructor mixed iota rule is well formed in an environment
+containing the generated recursor constant. -/
+theorem rule_WF {i : Nat} {ctor : NormalizedCtor}
+    (hci : gen.block.ctorPairs[i]? = some ctor)
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor) :
+    (gen.rule i ctor).WF env := by
+  have hctor := List.mem_of_getElem? hci
+  refine ⟨?_, ?_⟩
+  · show env.HasType (gen.recUvars) []
+      (VExpr.lamN
+        (gen.paramsTel ++
+          gen.motiveType :: gen.minorTypes ++
+          VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination)
+            0)
+        _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN
+      (S.ruleBinders_onTel hctor) ?_
+    simp only [List.reverse_append,
+      List.reverse_cons, List.append_nil,
+      List.append_assoc, List.singleton_append]
+    exact S.recRuleApp_hasType hctor hrec
+  · show env.HasType (gen.recUvars) []
+      (VExpr.lamN
+        (gen.paramsTel ++
+          gen.motiveType :: gen.minorTypes ++
+          VExpr.liftTelN
+            (gen.block.ctorPairs.length + 1)
+            (ctor.fieldsR
+              source.uvars source.nparams gen.elimination)
+            0)
+        _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN
+      (S.ruleBinders_onTel hctor) ?_
+    simp only [List.reverse_append,
+      List.reverse_cons, List.append_nil,
+      List.append_assoc, List.singleton_append]
+    exact S.minorApp_hasType hci hrec
+
+end GenerationEnv
+
+theorem ctorFieldsR_length {U np : Nat} {c : VConstVal} :
+    (ctorFieldsR U np c).length = (ctorFields (VExpr.dropN np c.type)).length :=
+  List.length_map ..
+
+theorem ctorFieldsR_getElem? {U np : Nat} {c : VConstVal} {q : Nat} :
+    (ctorFieldsR U np c)[q]? =
+    (ctorFields (VExpr.dropN np c.type))[q]?.map (VExpr.instL (VLevel.params' U 1)) :=
+  List.getElem?_map ..
+
+/-! ## The post-family environment invariant -/
+
+/-- The facts available immediately after inserting a checked family,
+before any constructor has been installed. Constructor types may refer to the
+family, so this is the precise staging invariant needed to validate them. -/
+structure DirectFamilyEnv (env : VEnv) (U : Nat) (T : Name)
+    (np : Nat) (l : VLevel) (ty : VInductiveType) : Prop where
+  ord : env.Ordered
+  hl : l.WF U
+  hsort : VExpr.resultOf (VExpr.dropN np ty.type) = .sort l
+  hlen : (VExpr.telN np ty.type).length = np
+  hT : env.constants T = some ⟨U, ty.type⟩
+  hparams :
+    OnTel env U []
+      (VExpr.telN np ty.type ++
+        ctorFields (VExpr.dropN np ty.type))
+
+section DirectFamily
+
+variable {env : VEnv} {U : Nat} {T : Name} {np : Nat}
+  {l : VLevel} {ty : VInductiveType}
+  (S : DirectFamilyEnv env U T np l ty)
+include S
+
+theorem DirectFamilyEnv.tyType_eq :
+    ty.type =
+      VExpr.forallN (VExpr.telN np ty.type)
+        (VExpr.forallN
+          (ctorFields (VExpr.dropN np ty.type)) (.sort l)) := by
+  conv => lhs
+          rw [← VExpr.forallN_telN_dropN np ty.type,
+            ← forallN_ctorFields_resultOf
+              (VExpr.dropN np ty.type), S.hsort]
+
+theorem DirectFamilyEnv.tyType_isType :
+    env.IsType U [] ty.type := by
+  rw [S.tyType_eq, ← VExpr.forallN_append]
+  exact IsType.forallN S.hparams ⟨_, HasType.sort S.hl⟩
+
+theorem DirectFamilyEnv.tconst_decl {Γ} :
+    env.HasType U Γ (.const T (VLevel.params U)) ty.type :=
+  (HasType.const0 S.hT S.tyType_isType).weak0 S.ord
+
+/-- Applying the newly inserted family to its parameter self-spine exposes
+the index telescope in any constructor-field context. -/
+theorem DirectFamilyEnv.recAppPi_hasType_decl (Δ : List VExpr) :
+    env.HasType U (Δ ++ (VExpr.telN np ty.type).reverse)
+      (recApp U T np Δ.length)
+      ((VExpr.forallN
+        (ctorFields (VExpr.dropN np ty.type)) (.sort l)).liftN
+          Δ.length) := by
+  have hcl : ty.type.ClosedN 0 :=
+    Ordered.closedC (ci := ⟨U, ty.type⟩) S.ord S.hT
+  have hf : env.HasType U
+      (Δ ++ (VExpr.telN np ty.type).reverse ++ [])
+      (.const T (VLevel.params U))
+      ((VExpr.forallN (VExpr.telN np ty.type)
+        (VExpr.forallN
+          (ctorFields (VExpr.dropN np ty.type)) (.sort l))).liftN
+            (Δ.length + (VExpr.telN np ty.type).length)) := by
+    rw [← S.tyType_eq, hcl.liftN_eq (Nat.zero_le _)]
+    exact S.tconst_decl
+  have hout := HasType.appN_selfSpine (env := env) (U := U) hf
+  rw [S.hlen] at hout
+  simpa [recApp, List.append_nil] using hout
+
+/-- Checked constructor fields form a telescope as soon as the family is
+available; no constructor lookup is needed for recursive occurrences. -/
+theorem DirectFamilyEnv.fieldsWF_onTel_decl :
+    ∀ (Bs : List VExpr) (Δd : List VExpr) (j : Nat),
+      Δd.length = j →
+      fieldsWF U T np env l
+        (ctorFields (VExpr.dropN np ty.type))
+        (Δd ++ (VExpr.telN np ty.type).reverse) j Bs →
+      OnTel env U
+        (Δd ++ (VExpr.telN np ty.type).reverse) Bs
+  | [], _, _, _, _ => trivial
+  | B :: Bs, Δd, j, hΔ, ⟨hB, hSp, hrest⟩ => by
+    refine ⟨?_, DirectFamilyEnv.fieldsWF_onTel_decl
+      Bs (B :: Δd) (j+1) (by simp [hΔ]) hrest⟩
+    rcases hB with hrec | hfun | ⟨-, u, h, -⟩
+    · obtain ⟨hBeq, -, -⟩ := isRecField_eq hrec
+      have hTapp := S.recAppPi_hasType_decl Δd
+      rw [hΔ, VExpr.liftN_forallN] at hTapp
+      have hgoal : env.HasType U
+          (Δd ++ (VExpr.telN np ty.type).reverse)
+          B (.sort l) := by
+        rw [hBeq, VExpr.appN_append]
+        exact (hSp hrec).hasType_appN hTapp
+      exact ⟨_, hgoal⟩
+    · obtain ⟨r, hr, -, hrtel, hrsp⟩ := hfun
+      obtain ⟨hrj, -, hBeq, -, -, -⟩ := recArg?_eq hr
+      rw [hBeq]
+      refine IsType.forallN hrtel ⟨l, ?_⟩
+      have hTapp :=
+        S.recAppPi_hasType_decl (r.binders.reverse ++ Δd)
+      rw [VExpr.liftN_forallN] at hTapp
+      have hbase : env.HasType U
+          (r.binders.reverse ++
+            (Δd ++ (VExpr.telN np ty.type).reverse))
+          (recApp U T np (j + r.binders.length))
+          (VExpr.forallN
+            (VExpr.liftTelN (j + r.binders.length)
+              (ctorFields (VExpr.dropN np ty.type)) 0)
+            (.sort l)) := by
+        simpa [List.append_assoc, hΔ, Nat.add_comm] using hTapp
+      rw [hrj] at hrsp
+      simpa [recApp, VExpr.appN_append] using
+        hrsp.hasType_appN hbase
+    · exact ⟨u, h⟩
+
+/-- The analyzed result spine types the exact family application at the end
+of a constructor declaration. -/
+theorem DirectFamilyEnv.ctorResult_hasType_decl
+    {c : VConstVal}
+    (hresult : env.SpineWF U
+      ((ctorFields (VExpr.dropN np c.type)).reverse ++
+        (VExpr.telN np ty.type).reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (ctorFields (VExpr.dropN np c.type)).length
+          (ctorFields (VExpr.dropN np ty.type)) 0)
+        (.sort l))
+      (recFieldIdxs np
+        (VExpr.resultOf (VExpr.dropN np c.type)))
+      (.sort l)) :
+    env.HasType U
+      ((ctorFields (VExpr.dropN np c.type)).reverse ++
+        (VExpr.telN np ty.type).reverse)
+      (VExpr.appN (.const T (VLevel.params U))
+        (VExpr.bvarRevRange
+          (ctorFields (VExpr.dropN np c.type)).length np ++
+          recFieldIdxs np
+            (VExpr.resultOf (VExpr.dropN np c.type))))
+      (.sort l) := by
+  have hTapp := S.recAppPi_hasType_decl
+    ((ctorFields (VExpr.dropN np c.type)).reverse)
+  rw [List.length_reverse, VExpr.liftN_forallN] at hTapp
+  rw [VExpr.appN_append]
+  exact hresult.hasType_appN hTapp
+
+end DirectFamily
+
+/-- A checked family insertion constructs the post-family invariant directly
+from the checker contract. -/
+theorem Checked.WF.toDirectFamilyEnv
+    {source : VInductDecl} {checked : source.Checked}
+    {pre envT : VEnv} (hpre : pre.Ordered)
+    (h : checked.WF pre)
+    (hadd : pre.addConst checked.type.name
+      checked.type.toVConstant = some envT) :
+    DirectFamilyEnv envT source.uvars checked.type.name
+      source.nparams checked.resultLevel checked.type where
+  ord := by
+    have hfamily : checked.type.toVConstant.WF pre := by
+      show pre.IsType checked.type.uvars [] checked.type.type
+      rw [checked.direct_anatomy.1]
+      exact h.family_isType
+    exact .const hpre hfamily hadd
+  hl := checked.direct_anatomy.2.2.1
+  hsort := checked.result_eq
+  hlen := by simpa [checked.params_eq] using
+    checked.direct_anatomy.2.1
+  hT := by
+    have hout := addConst_self hadd
+    change envT.constants checked.type.name =
+      some ⟨checked.type.uvars, checked.type.type⟩ at hout
+    rw [checked.direct_anatomy.1] at hout
+    exact hout
+  hparams := by
+    simpa [checked.params_eq, checked.indices_eq] using
+      h.1.mono (addConst_le hadd)
+
+/-! ## The stage-3 environment invariant -/
+
+/-- Everything the piece-typing lemmas need about an environment that
+already contains the block's type constant and constructors. -/
+structure Stage3Env (env : VEnv) (U : Nat) (T : Name) (np : Nat) (l : VLevel)
+    (ty : VInductiveType) : Prop where
+  ord : env.Ordered
+  hl : l.WF U
+  hsort : VExpr.resultOf (VExpr.dropN np ty.type) = .sort l
+  hlen : (VExpr.telN np ty.type).length = np
+  hT : env.constants T = some ⟨U, ty.type⟩
+  hcs : ∀ c ∈ ty.ctors, env.constants c.name = some ⟨U, c.type⟩
+  htel : ∀ c ∈ ty.ctors, VExpr.telN np c.type = VExpr.telN np ty.type
+  hs3 : ∀ c ∈ ty.ctors, stage3Ctor U T np (ctorFields (VExpr.dropN np ty.type)).length 0
+    (VExpr.dropN np c.type) = true
+  hparams : OnTel env U [] (VExpr.telN np ty.type ++ ctorFields (VExpr.dropN np ty.type))
+  hfields : ∀ c ∈ ty.ctors, fieldsWF U T np env l (ctorFields (VExpr.dropN np ty.type))
+    (VExpr.telN np ty.type).reverse 0 (ctorFields (VExpr.dropN np c.type))
+  hresult : ∀ c ∈ ty.ctors, env.SpineWF U
+    ((ctorFields (VExpr.dropN np c.type)).reverse ++ (VExpr.telN np ty.type).reverse)
+    (VExpr.forallN (VExpr.liftTelN (ctorFields (VExpr.dropN np c.type)).length
+      (ctorFields (VExpr.dropN np ty.type)) 0) (.sort l))
+    (recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))) (.sort l)
+
+variable {env : VEnv} {U : Nat} {T : Name} {np : Nat} {l : VLevel} {ty : VInductiveType}
+  (S : Stage3Env env U T np l ty)
+include S
+-- `S` is included throughout so every lemma below is reachable as `S.lemma`,
+-- including those whose statement and proof never mention it.
+set_option linter.unusedSectionVars false
+
+theorem Stage3Env.mono {env' : VEnv} (henv : env ≤ env') (ord' : env'.Ordered) :
+    Stage3Env env' U T np l ty where
+  ord := ord'
+  hl := S.hl
+  hsort := S.hsort
+  hlen := S.hlen
+  hT := henv.constants S.hT
+  hcs := fun c hc => henv.constants (S.hcs c hc)
+  htel := S.htel
+  hs3 := S.hs3
+  hparams := S.hparams.mono henv
+  hfields := fun c hc => fieldsWF_mono henv (S.hfields c hc)
+  hresult := fun c hc => (S.hresult c hc).mono henv
+
+/-- The block's type split at the parameters and indices. -/
+theorem Stage3Env.tyType_eq : ty.type =
+    VExpr.forallN (VExpr.telN np ty.type)
+      (VExpr.forallN (ctorFields (VExpr.dropN np ty.type)) (.sort l)) := by
+  conv => lhs; rw [← VExpr.forallN_telN_dropN np ty.type,
+    ← forallN_ctorFields_resultOf (VExpr.dropN np ty.type), S.hsort]
+
+/-- The type of the block constant is a type. -/
+theorem Stage3Env.tyType_isType : env.IsType U [] ty.type := by
+  rw [S.tyType_eq, ← VExpr.forallN_append]
+  exact IsType.forallN S.hparams ⟨_, HasType.sort S.hl⟩
+
+/-- The block constant at the declaration universes, in any context. -/
+theorem Stage3Env.tconst_decl {Γ} :
+    env.HasType U Γ (.const T (VLevel.params U)) ty.type :=
+  (HasType.const0 S.hT S.tyType_isType).weak0 S.ord
+
+/-- The type of the block constant, instantiated to the recursor universes. -/
+theorem Stage3Env.tyType_instL :
+    ty.type.instL (VLevel.params' U 1) =
+    VExpr.forallN (paramsTel U np ty)
+      (VExpr.forallN (idxTel U np ty) (.sort (l.inst (VLevel.params' U 1)))) := by
+  conv => lhs; rw [S.tyType_eq]
+  rw [VExpr.instL_forallN, VExpr.instL_forallN]
+  rfl
+
+/-- The block constant at the recursor universes, in any context. -/
+theorem Stage3Env.tconst {Γ} :
+    env.HasType (U+1) Γ (.const T (VLevel.params' U 1)) (ty.type.instL (VLevel.params' U 1)) := by
+  have := (S.tconst_decl (Γ := [])).instL (U' := U+1) VLevel.params'_one_wf
+  rw [show (VExpr.const T (VLevel.params U)).instL (VLevel.params' U 1) =
+    .const T (VLevel.params' U 1) from by
+      simp [VExpr.instL, VLevel.params_map_inst_params']] at this
+  exact this.weak0 S.ord
+
+/-- The parameter spine applied to the block constant, `Δ` binders past
+the parameter telescope (declaration universes): the index pi. -/
+theorem Stage3Env.recAppPi_hasType_decl (Δ : List VExpr) :
+    env.HasType U (Δ ++ (VExpr.telN np ty.type).reverse) (recApp U T np Δ.length)
+      ((VExpr.forallN (ctorFields (VExpr.dropN np ty.type)) (.sort l)).liftN Δ.length) := by
+  have hcl : ty.type.ClosedN 0 := Ordered.closedC (ci := ⟨U, ty.type⟩) S.ord S.hT
+  have hf : env.HasType U (Δ ++ (VExpr.telN np ty.type).reverse ++ [])
+      (.const T (VLevel.params U))
+      ((VExpr.forallN (VExpr.telN np ty.type)
+        (VExpr.forallN (ctorFields (VExpr.dropN np ty.type)) (.sort l))).liftN
+        (Δ.length + (VExpr.telN np ty.type).length)) := by
+    rw [← S.tyType_eq, hcl.liftN_eq (Nat.zero_le _)]
+    exact S.tconst_decl
+  have := HasType.appN_selfSpine (env := env) (U := U) hf
+  rw [S.hlen] at this
+  simpa [recApp, List.append_nil] using this
+
+/-- The parameter spine at the recursor universes: the index pi. -/
+theorem Stage3Env.recAppPi_hasType (Δ : List VExpr) :
+    env.HasType (U+1) (Δ ++ (paramsTel U np ty).reverse) (recApp' U T np Δ.length)
+      ((VExpr.forallN (idxTel U np ty)
+        (.sort (l.inst (VLevel.params' U 1)))).liftN Δ.length) := by
+  have hcl : (ty.type.instL (VLevel.params' U 1)).ClosedN 0 :=
+    (Ordered.closedC (ci := ⟨U, ty.type⟩) S.ord S.hT).instL
+  have hf : env.HasType (U+1) (Δ ++ (paramsTel U np ty).reverse ++ [])
+      (.const T (VLevel.params' U 1))
+      ((VExpr.forallN (paramsTel U np ty)
+        (VExpr.forallN (idxTel U np ty) (.sort (l.inst (VLevel.params' U 1))))).liftN
+        (Δ.length + (paramsTel U np ty).length)) := by
+    rw [← S.tyType_instL, hcl.liftN_eq (Nat.zero_le _)]
+    exact S.tconst
+  have := HasType.appN_selfSpine (env := env) (U := U+1) hf
+  rw [show (paramsTel U np ty).length = np from by
+    simp [paramsTel, List.length_map, S.hlen]] at this
+  simpa [recApp', List.append_nil] using this
+
+/-- The block applied to the full parameter-and-index self-spine is a
+sort, in the context of the indices over the parameters. -/
+theorem Stage3Env.motiveTApp_hasType :
+    env.HasType (U+1) ((idxTel U np ty).reverse ++ (paramsTel U np ty).reverse)
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (idxTel U np ty).length np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (l.inst (VLevel.params' U 1))) := by
+  have hcl : (ty.type.instL (VLevel.params' U 1)).ClosedN 0 :=
+    (Ordered.closedC (ci := ⟨U, ty.type⟩) S.ord S.hT).instL
+  have hf : env.HasType (U+1)
+      ([] ++ (paramsTel U np ty ++ idxTel U np ty).reverse ++ [])
+      (.const T (VLevel.params' U 1))
+      ((VExpr.forallN (paramsTel U np ty ++ idxTel U np ty)
+        (.sort (l.inst (VLevel.params' U 1)))).liftN
+        (List.length ([] : List VExpr) +
+          (paramsTel U np ty ++ idxTel U np ty).length)) := by
+    rw [VExpr.forallN_append, ← S.tyType_instL, hcl.liftN_eq (Nat.zero_le _)]
+    exact S.tconst
+  have h2 := HasType.appN_selfSpine (env := env) (U := U+1) hf
+  rw [show List.length ([] : List VExpr) = 0 from rfl,
+    VExpr.bvarRevRange_congr' 0 (show (paramsTel U np ty ++ idxTel U np ty).length =
+      (idxTel U np ty).length + np from by
+      simp [paramsTel, List.length_map, S.hlen]; omega),
+    ← VExpr.bvarRevRange_append] at h2
+  simpa [List.append_nil, List.reverse_append] using h2
+
+/-- Field telescopes are well-formed in context, at the declaration
+universes: recursive fields by the partial parameter application of the
+block followed by the carried index-spine typing. -/
+theorem Stage3Env.fieldsWF_onTel_decl :
+    ∀ (Bs : List VExpr) (Δd : List VExpr) (j : Nat), Δd.length = j →
+    fieldsWF U T np env l (ctorFields (VExpr.dropN np ty.type))
+      (Δd ++ (VExpr.telN np ty.type).reverse) j Bs →
+    OnTel env U (Δd ++ (VExpr.telN np ty.type).reverse) Bs
+  | [], _, _, _, _ => trivial
+  | B :: Bs, Δd, j, hΔ, ⟨hB, hSp, hT⟩ => by
+    refine ⟨?_, Stage3Env.fieldsWF_onTel_decl Bs (B :: Δd) (j+1) (by simp [hΔ]) hT⟩
+    rcases hB with hrec | hfun | ⟨-, u, h, -⟩
+    · obtain ⟨hBeq, -, -⟩ := isRecField_eq hrec
+      have hTapp := S.recAppPi_hasType_decl Δd
+      rw [hΔ, VExpr.liftN_forallN] at hTapp
+      have hgoal : env.HasType U (Δd ++ (VExpr.telN np ty.type).reverse) B (.sort l) := by
+        rw [hBeq, VExpr.appN_append]
+        exact (hSp hrec).hasType_appN hTapp
+      exact ⟨_, hgoal⟩
+    · obtain ⟨r, hr, -, hrtel, hrsp⟩ := hfun
+      obtain ⟨hrj, -, hBeq, -, -, -⟩ := recArg?_eq hr
+      rw [hBeq]
+      refine IsType.forallN hrtel ⟨l, ?_⟩
+      have hTapp := S.recAppPi_hasType_decl (r.binders.reverse ++ Δd)
+      rw [VExpr.liftN_forallN] at hTapp
+      have hbase : env.HasType U
+          (r.binders.reverse ++ (Δd ++ (VExpr.telN np ty.type).reverse))
+          (recApp U T np (j + r.binders.length))
+          (VExpr.forallN
+            (VExpr.liftTelN (j + r.binders.length)
+              (ctorFields (VExpr.dropN np ty.type)) 0) (.sort l)) := by
+        simpa [List.append_assoc, hΔ, Nat.add_comm] using hTapp
+      rw [hrj] at hrsp
+      simpa [recApp, VExpr.appN_append] using hrsp.hasType_appN hbase
+    · exact ⟨u, h⟩
+
+/-- Field telescopes are well-formed in context, at the recursor
+universes. -/
+theorem Stage3Env.fieldsWF_onTel :
+    ∀ (Bs : List VExpr) (Δd : List VExpr) (j : Nat), Δd.length = j →
+    fieldsWF U T np env l (ctorFields (VExpr.dropN np ty.type))
+      (Δd ++ (VExpr.telN np ty.type).reverse) j Bs →
+    OnTel env (U+1)
+      ((Δd ++ (VExpr.telN np ty.type).reverse).map (VExpr.instL (VLevel.params' U 1)))
+      (Bs.map (VExpr.instL (VLevel.params' U 1)))
+  | Bs, Δd, j, hΔ, hfields => by
+    exact (S.fieldsWF_onTel_decl Bs Δd j hΔ hfields).instL VLevel.params'_one_wf
+
+/-- The constructor's type, split at the parameters. -/
+theorem Stage3Env.ctorType_eq {c : VConstVal} (hc : c ∈ ty.ctors) :
+    c.type = VExpr.forallN (VExpr.telN np ty.type)
+      (VExpr.forallN (ctorFields (VExpr.dropN np c.type))
+        (VExpr.appN (.const T (VLevel.params U))
+          (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+            recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))))) := by
+  conv => lhs; rw [← VExpr.forallN_telN_dropN np c.type, S.htel c hc,
+    (stage3Ctor_eq (S.hs3 c hc)).1]
+
+theorem Stage3Env.ctorType_instL {c : VConstVal} (hc : c ∈ ty.ctors) :
+    c.type.instL (VLevel.params' U 1) =
+    VExpr.forallN (paramsTel U np ty)
+      (VExpr.forallN (ctorFieldsR U np c)
+        (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+            ctorIdxs U np c))) := by
+  conv => lhs; rw [S.ctorType_eq hc, VExpr.instL_forallN, VExpr.instL_forallN,
+    VExpr.instL_appN, List.map_append, bvarRevRange_instL,
+    show (VExpr.const T (VLevel.params U)).instL (VLevel.params' U 1) =
+      .const T (VLevel.params' U 1) from by
+      simp [VExpr.instL, VLevel.params_map_inst_params']]
+  rfl
+
+/-- The constructor's result, typed by the partial parameter application
+and the carried result-spine typing (declaration universes). -/
+theorem Stage3Env.ctorResult_hasType_decl {c : VConstVal} (hc : c ∈ ty.ctors) :
+    env.HasType U
+      ((ctorFields (VExpr.dropN np c.type)).reverse ++ (VExpr.telN np ty.type).reverse)
+      (VExpr.appN (.const T (VLevel.params U))
+        (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+          recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))))
+      (.sort l) := by
+  have hTapp := S.recAppPi_hasType_decl ((ctorFields (VExpr.dropN np c.type)).reverse)
+  rw [List.length_reverse, VExpr.liftN_forallN] at hTapp
+  rw [VExpr.appN_append,
+    VExpr.bvarRevRange_congr np (show 0 + (ctorFields (VExpr.dropN np c.type)).length =
+      (ctorFields (VExpr.dropN np c.type)).length from by omega)]
+  exact (S.hresult c hc).hasType_appN hTapp
+
+/-- A constructor's declared type is well-formed (declaration universes). -/
+theorem Stage3Env.ctorType_isType {c : VConstVal} (hc : c ∈ ty.ctors) :
+    env.IsType U [] c.type := by
+  rw [S.ctorType_eq hc]
+  refine IsType.forallN (S.hparams.of_append.1) ?_
+  simp only [List.append_nil]
+  refine IsType.forallN
+    (S.fieldsWF_onTel_decl _ [] 0 rfl (by simpa using S.hfields c hc)) ?_
+  exact ⟨_, by simpa using S.ctorResult_hasType_decl hc⟩
+
+/-- The constructor constant at the recursor universes, any context. -/
+theorem Stage3Env.cConst {c : VConstVal} (hc : c ∈ ty.ctors) {Γ} :
+    env.HasType (U+1) Γ (.const c.name (VLevel.params' U 1))
+      (c.type.instL (VLevel.params' U 1)) := by
+  have h0 := HasType.const0 (S.hcs c hc) (S.ctorType_isType hc)
+  have := h0.instL (U' := U+1) VLevel.params'_one_wf
+  rw [show (VExpr.const c.name (VLevel.params U)).instL (VLevel.params' U 1) =
+    .const c.name (VLevel.params' U 1) from by
+      simp [VExpr.instL, VLevel.params_map_inst_params']] at this
+  exact this.weak0 S.ord
+
+/-- The index telescope is well-formed over the parameters, at the
+recursor universes. -/
+theorem Stage3Env.idxTel_onTel :
+    OnTel env (U+1) (paramsTel U np ty).reverse (idxTel U np ty) := by
+  have h0 := (S.hparams.of_append.2).instL (U' := U+1) VLevel.params'_one_wf
+  simpa [paramsTel, idxTel, List.map_reverse] using h0
+
+theorem Stage3Env.motive_isType :
+    env.IsType (U+1) (paramsTel U np ty).reverse (motiveType U T np ty) := by
+  refine IsType.forallN S.idxTel_onTel ?_
+  exact ⟨_, HasType.forallE S.motiveTApp_hasType (HasType.sort (Nat.succ_pos U))⟩
+
+/-- Transport a recursive field's index-spine typing into a rule or minor
+context: instantiate the universes, insert `mid` (motive, or motive and
+minors) at the field's depth `j`, and push a `d`-entry stack underneath. -/
+theorem Stage3Env.spine_transport {c : VConstVal} (hc : c ∈ ty.ctors)
+    {j : Nat} {B : VExpr}
+    (hBj : (ctorFields (VExpr.dropN np c.type))[j]? = some B)
+    (hrec : isRecField U T np (ctorFields (VExpr.dropN np ty.type)).length j B = true)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.SpineWF (U+1)
+      (As₂ ++ ((VExpr.liftTelN g ((ctorFieldsR U np c).take j) 0).reverse ++
+        (mid ++ (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN (j + g + d) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      (((recFieldIdxs np B).map (VExpr.instL (VLevel.params' U 1))).map
+        fun e => (e.liftN g j).liftN d)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+  have hjlen : ((ctorFieldsR U np c).take j).length = j := by
+    have h1 := (List.getElem?_eq_some_iff.1 hBj).1
+    simp only [ctorFieldsR, List.length_take, List.length_map]
+    omega
+  -- (1) declaration-universe spine from the fieldsWF chain
+  have h0 := fieldsWF_spine (S.hfields c hc) j B (by simpa using hBj)
+    (by simpa using hrec)
+  rw [Nat.zero_add] at h0
+  -- (2) universe instantiation
+  have h1 := h0.instL (U' := U+1) VLevel.params'_one_wf
+  rw [VExpr.instL_forallN, VExpr.liftTelN_instL,
+    show (((ctorFields (VExpr.dropN np c.type)).take j).reverse ++
+        (VExpr.telN np ty.type).reverse).map (VExpr.instL (VLevel.params' U 1)) =
+      ((ctorFieldsR U np c).take j).reverse ++ (paramsTel U np ty).reverse from by
+      simp [ctorFieldsR, paramsTel, List.map_reverse, List.map_take]] at h1
+  -- (3) insert `mid` at depth `j`
+  have W₁ := Ctx.LiftN.consTel (n := mid.length) ((ctorFieldsR U np c).take j)
+    (Ctx.LiftN.zero (Γ := (paramsTel U np ty).reverse) mid)
+  rw [hjlen, Nat.add_zero] at W₁
+  have h2 := h1.weakN S.ord W₁
+  rw [VExpr.liftN_forallN, hg] at h2
+  -- (4) push the stack underneath
+  have h3 := h2.weakN S.ord (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  rw [VExpr.liftN_forallN] at h3
+  rw [VExpr.liftTelN_liftTelN_hi' j g _ 0 (by omega), VExpr.liftTelN_liftTelN,
+    show (ctorFields (VExpr.dropN np ty.type)).map (VExpr.instL (VLevel.params' U 1)) =
+      idxTel U np ty from rfl] at h3
+  simpa [VExpr.instL, VExpr.liftN, List.map_map, Function.comp_def,
+    List.append_assoc] using h3
+
+/-- Transport all semantic evidence for a recursive argument beneath a Pi
+telescope. This is the functional counterpart of `spine_transport`: it
+transports both the argument telescope and the terminal family-index spine.
+-/
+theorem Stage3Env.recArg_transport {c : VConstVal} (hc : c ∈ ty.ctors)
+    {r₀ : RecArg} {B : VExpr}
+    (hB : (ctorFields (VExpr.dropN np c.type))[r₀.fieldIndex]? = some B)
+    (hr : recArg? U T np (idxTel U np ty).length r₀.fieldIndex B = some r₀)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    let r := r₀.instL (VLevel.params' U 1)
+    let As := VExpr.liftTelN d (VExpr.liftTelN g r.binders r.fieldIndex) 0
+    OnTel env (U+1)
+        (As₂ ++ ((VExpr.liftTelN g
+          ((ctorFieldsR U np c).take r.fieldIndex) 0).reverse ++
+          (mid ++ (paramsTel U np ty).reverse))) As ∧
+      env.SpineWF (U+1)
+        (As.reverse ++
+          (As₂ ++ ((VExpr.liftTelN g
+            ((ctorFieldsR U np c).take r.fieldIndex) 0).reverse ++
+            (mid ++ (paramsTel U np ty).reverse))))
+        (VExpr.forallN
+          (VExpr.liftTelN
+            (r.fieldIndex + r.binders.length + g + d) (idxTel U np ty) 0)
+          (.sort (l.inst (VLevel.params' U 1))))
+        (r.indices.map fun e =>
+          (e.liftN g (r.fieldIndex + r.binders.length)).liftN d r.binders.length)
+        (.sort (l.inst (VLevel.params' U 1))) := by
+  dsimp only
+  have hjlt : r₀.fieldIndex < (ctorFields (VExpr.dropN np c.type)).length :=
+    (List.getElem?_eq_some_iff.1 hB).1
+  have hsem := fieldsWF_recArg (S.hfields c hc) r₀.fieldIndex B r₀ hB (by
+    simpa [idxTel_length] using hr)
+  have htel₁ := hsem.1.instL (U' := U+1) VLevel.params'_one_wf
+  have hsp₁ := hsem.2.instL (U' := U+1) VLevel.params'_one_wf
+  have hctx :
+      (((ctorFields (VExpr.dropN np c.type)).take r₀.fieldIndex).reverse ++
+        (VExpr.telN np ty.type).reverse).map (VExpr.instL (VLevel.params' U 1)) =
+      ((ctorFieldsR U np c).take r₀.fieldIndex).reverse ++
+        (paramsTel U np ty).reverse := by
+    simp [ctorFieldsR, paramsTel, List.map_reverse, List.map_take]
+  rw [hctx] at htel₁
+  rw [List.map_append, List.map_reverse, hctx] at hsp₁
+  simp only [VExpr.instL_forallN, VExpr.liftTelN_instL] at htel₁ hsp₁
+  have hjlen : ((ctorFieldsR U np c).take r₀.fieldIndex).length =
+      r₀.fieldIndex := by
+    simp only [ctorFieldsR, List.length_take, List.length_map]
+    omega
+  have W₁ := Ctx.LiftN.consTel (n := mid.length)
+    ((ctorFieldsR U np c).take r₀.fieldIndex)
+    (Ctx.LiftN.zero (Γ := (paramsTel U np ty).reverse) mid)
+  rw [hjlen, Nat.add_zero] at W₁
+  have htel₂ := htel₁.weakN S.ord W₁
+  have hsp₂ := hsp₁.weakN S.ord
+    (Ctx.LiftN.consTel
+      (r₀.binders.map (VExpr.instL (VLevel.params' U 1))) W₁)
+  rw [hg] at htel₂ hsp₂
+  have W₂ := Ctx.LiftN.zero
+    (Γ := (VExpr.liftTelN g
+        ((ctorFieldsR U np c).take r₀.fieldIndex) 0).reverse ++
+      (mid ++ (paramsTel U np ty).reverse)) As₂ (h := hd)
+  have htel₃ := htel₂.weakN S.ord W₂
+  have hsp₃ := hsp₂.weakN S.ord
+    (Ctx.LiftN.consTel
+      (VExpr.liftTelN g
+        (r₀.binders.map (VExpr.instL (VLevel.params' U 1))) r₀.fieldIndex) W₂)
+  refine ⟨?_, ?_⟩
+  · simpa [RecArg.instL, List.append_assoc] using htel₃
+  · simp only [List.length_map, VExpr.liftTelN_length, Nat.add_zero] at hsp₃
+    rw [VExpr.liftN_forallN, VExpr.liftN_forallN,
+      VExpr.liftTelN_liftTelN_hi' (r₀.fieldIndex + r₀.binders.length) g _ 0
+        (by omega),
+      VExpr.liftTelN_liftTelN_mid
+        (r₀.fieldIndex + r₀.binders.length + g) d _ 0 r₀.binders.length
+        (Nat.zero_le _) (by omega),
+      show (ctorFields (VExpr.dropN np ty.type)).map
+          (VExpr.instL (VLevel.params' U 1)) = idxTel U np ty from rfl] at hsp₃
+    rw [show r₀.binders.length + r₀.fieldIndex =
+      r₀.fieldIndex + r₀.binders.length from Nat.add_comm _ _] at hsp₃
+    simpa [RecArg.instL, VExpr.instL, VExpr.liftN, List.map_map,
+      Function.comp_def, List.append_assoc] using hsp₃
+
+omit S in
+/-- Apply a motive variable to a typed family-index spine and major premise.
+Unlike `Stage3Env.motiveApp_hasType`, this helper is independent of the
+recursor's minor-premise stack, so it also applies under a recursive
+argument's private Pi telescope. -/
+theorem motiveVarApp_hasType {Γ : List VExpr} {K : Nat}
+    {idxs : List VExpr} {a : VExpr}
+    (hM : env.HasType (U+1) Γ (.bvar K)
+      ((motiveType U T np ty).liftN (K+1)))
+    (hidx : env.SpineWF (U+1) Γ
+      (VExpr.forallN (VExpr.liftTelN (K+1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))))
+    (hlen : idxs.length = (idxTel U np ty).length)
+    (ha : env.HasType (U+1) Γ a
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (K+1) np ++ idxs))) :
+    env.HasType (U+1) Γ
+      (VExpr.appN (.bvar K) (idxs ++ [a])) (.sort (.param 0)) := by
+  rw [motiveType_liftN] at hM
+  have hshape := hidx.retarget
+    (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (K+1 + (idxTel U np ty).length) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _ (by rw [hlen]; omega),
+    show K+1+(idxTel U np ty).length-idxs.length = K+1 from by
+      rw [hlen, Nat.add_sub_cancel],
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hApp := hshape.hasType_appN hM
+  rw [VExpr.appN_append]
+  exact HasType.app hApp (by simpa using ha)
+
+/-- One generalized induction-hypothesis entry is a type in the minor
+premise context. Recursive Pi arguments become Pi-valued hypotheses whose
+body applies both the motive and the recursive field to the same private
+self-spine. -/
+theorem Stage3Env.recArgMinor_isType {c : VConstVal} (hc : c ∈ ty.ctors)
+    {r : RecArg}
+    (hrmem : r ∈ recArgsR U T np (idxTel U np ty).length c)
+    (Δ : List VExpr) (p : Nat) (hΔ : Δ.length = p) :
+    env.IsType (U+1)
+      (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (r.minorIH (ctorFieldsR U np c).length p) := by
+  obtain ⟨r₀, B, rfl, hB, hr₀⟩ := recArgsR_mem hrmem
+  let r := r₀.instL (VLevel.params' U 1)
+  let m := (ctorFieldsR U np c).length
+  let j := r₀.fieldIndex
+  let Fs := VExpr.liftTelN 1 (ctorFieldsR U np c) 0
+  let As := r.minorBinders m p
+  let idxs := r.indices.map fun e =>
+    (e.liftN 1 (r.fieldIndex+r.binders.length)).liftN (m-r.fieldIndex+p) r.binders.length
+  let Γ := Δ ++ Fs.reverse ++
+    (motiveType U T np ty :: (paramsTel U np ty).reverse)
+  have hjm : j < m := by
+    simpa [j, m, RecArg.instL, ctorFieldsR_length] using recArgsR_lt _ hrmem
+  have hFsLen : Fs.length = m := by simp [Fs, m, VExpr.liftTelN_length]
+  have hstackLen : (Δ ++ (Fs.drop j).reverse).length = m-j+p := by
+    simp only [List.length_append, List.length_reverse, List.length_drop, hFsLen, hΔ]
+    omega
+  have ht := S.recArg_transport hc hB hr₀ [motiveType U T np ty] rfl
+    (Δ ++ (Fs.drop j).reverse) hstackLen
+  simp only [List.length_singleton, RecArg.instL] at ht
+  have hctx :
+      (Δ ++ (Fs.drop j).reverse) ++
+          ((VExpr.liftTelN 1 ((ctorFieldsR U np c).take j) 0).reverse ++
+            ([motiveType U T np ty] ++ (paramsTel U np ty).reverse)) = Γ := by
+    dsimp only [Γ, Fs]
+    rw [← VExpr.liftTelN_take, List.append_assoc,
+      ← List.append_assoc ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).drop j).reverse,
+      ← List.reverse_append, List.take_append_drop, List.singleton_append,
+      ← List.append_assoc]
+  dsimp only [j] at ht hctx
+  have htel : OnTel env (U+1) Γ As := by
+    rw [hctx] at ht
+    simpa [r, As, m, j, RecArg.instL,
+      RecArg.minorBinders] using ht.1
+  have hsp : env.SpineWF (U+1) (As.reverse ++ Γ)
+      (VExpr.forallN
+        (VExpr.liftTelN (m+p+r.binders.length+1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))) := by
+    rw [hctx] at ht
+    simpa [r, As, idxs, m, j, RecArg.instL,
+      RecArg.minorBinders, List.append_assoc,
+      show j + r₀.binders.length + 1 + (m-j+p) =
+        m+p+r₀.binders.length+1 from by omega] using ht.2
+  have hF : Γ[m-1-j+p]? =
+      some ((B.instL (VLevel.params' U 1)).liftN 1 j) := by
+    dsimp only [Γ, Fs]
+    rw [getElem?_stack_mid Δ
+        (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)
+        (i := m-1-j+p) (by rw [hΔ]; omega)
+        (by simp only [hΔ, List.length_reverse, VExpr.liftTelN_length]; omega),
+      show m - 1 - j + p - Δ.length = m - 1 - j from by rw [hΔ]; omega,
+      List.getElem?_reverse (by rw [hFsLen]; omega),
+      VExpr.liftTelN_length,
+      show m - 1 - (m - 1 - j) = j from by omega,
+      VExpr.liftTelN_getElem?, ctorFieldsR_getElem?, hB]
+    simp
+  have hlu := Lookup.of_getElem? hF
+  rw [show m-1-j+p+1 = m-j+p from by omega] at hlu
+  dsimp only [j, r] at hlu
+  have hfield := recArg_minor_fieldType hr₀ m p (by simpa [j] using hjm)
+  simp only [RecArg.instL, ElimMode.large_sourceLevels] at hfield
+  rw [hfield] at hlu
+  have hf0 := VEnv.HasType.bvar (env := env) (U := U+1) hlu
+  have hf := hf0.weakN S.ord (Ctx.LiftN.zero (Γ := Γ) As.reverse)
+  have hmajor := VEnv.HasType.appN_selfSpine (env := env) (U := U+1)
+    (As := As) (B := VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (m+p+r.binders.length+1) np ++ idxs))
+    (Δ := []) (Γ := Γ) (by
+      simpa [As, r, idxs, j, RecArg.instL, List.length_reverse,
+        List.map_map, Function.comp_def] using hf)
+  simp only [List.length_nil, VExpr.liftN_zero, List.nil_append] at hmajor
+  have hAsLen : As.length = r.binders.length := by
+    simp [As, RecArg.minorBinders, VExpr.liftTelN_length]
+  change env.HasType (U+1) (As.reverse ++ Γ)
+    ((VExpr.bvar (m-1-r.fieldIndex+p+As.length)).appN
+      (VExpr.bvarRevRange 0 As.length))
+    (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (m+p+r.binders.length+1) np ++ idxs)) at hmajor
+  rw [hAsLen] at hmajor
+  have hMget : (As.reverse ++ Γ)[m+p+r.binders.length]? =
+      some (motiveType U T np ty) := by
+    have hM0 := getElem?_rstack3 As.reverse (Δ ++ Fs.reverse)
+      (motiveType U T np ty) (paramsTel U np ty).reverse
+      (i := m+p+r.binders.length)
+      (by simp [As, RecArg.minorBinders, r, m, Fs, hΔ, VExpr.liftTelN_length,
+        RecArg.instL]; omega)
+    simpa [Γ, List.append_assoc] using hM0
+  have hM := VEnv.HasType.bvar (env := env) (U := U+1)
+    (Lookup.of_getElem? hMget)
+  have hlen : idxs.length = (idxTel U np ty).length := by
+    simpa [idxs, r, RecArg.instL] using (recArg?_eq hr₀).2.2.2.1
+  have hbody := motiveVarApp_hasType (env := env) (U := U) (T := T)
+    (np := np) (l := l) (ty := ty) hM hsp hlen hmajor
+  refine IsType.forallN htel ⟨VLevel.param 0, ?_⟩
+  simpa [RecArg.minorIH, r, As, idxs, m, Γ, Fs, List.append_assoc] using hbody
+
+/-- Well-formedness of the generalized induction-hypothesis telescope. Each
+entry is supplied by `recArgMinor_isType`; recursive Pi arguments therefore
+contribute one functional IH, not one IH per private binder. -/
+theorem Stage3Env.ihsRec_onTel {c : VConstVal} (hc : c ∈ ty.ctors) :
+    ∀ (rsSuf : List RecArg),
+    (∀ r ∈ rsSuf, r ∈ recArgsR U T np (idxTel U np ty).length c) →
+    ∀ (Δ : List VExpr) (p : Nat), Δ.length = p →
+    OnTel env (U+1)
+      (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (ihsFromRecArgs (ctorFieldsR U np c).length rsSuf p)
+  | [], _, _, _, _ => trivial
+  | r :: rsSuf, hqs, Δ, p, hΔ =>
+    ⟨S.recArgMinor_isType hc (hqs r (.head _)) Δ p hΔ,
+      Stage3Env.ihsRec_onTel hc rsSuf (fun q hq => hqs q (.tail _ hq))
+        (_ :: Δ) (p+1) (by simp [hΔ])⟩
+
+/-- Transport the constructor result's index-spine typing into a rule or
+minor context, like `spine_transport` but at the bottom of the full field
+telescope. -/
+theorem Stage3Env.result_transport {c : VConstVal} (hc : c ∈ ty.ctors)
+    (mid : List VExpr) {g : Nat} (hg : mid.length = g)
+    (As₂ : List VExpr) {d : Nat} (hd : As₂.length = d) :
+    env.SpineWF (U+1)
+      (As₂ ++ ((VExpr.liftTelN g (ctorFieldsR U np c) 0).reverse ++
+        (mid ++ (paramsTel U np ty).reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN ((ctorFieldsR U np c).length + g + d) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e => (e.liftN g (ctorFieldsR U np c).length).liftN d)
+      (.sort (l.inst (VLevel.params' U 1)))
+    := by
+  have hml : (ctorFieldsR U np c).length =
+      (ctorFields (VExpr.dropN np c.type)).length := ctorFieldsR_length
+  -- (1) the carried result spine, universes instantiated
+  have h1 := (S.hresult c hc).instL (U' := U+1) VLevel.params'_one_wf
+  rw [VExpr.instL_forallN, VExpr.liftTelN_instL,
+    show ((ctorFields (VExpr.dropN np c.type)).reverse ++
+        (VExpr.telN np ty.type).reverse).map (VExpr.instL (VLevel.params' U 1)) =
+      (ctorFieldsR U np c).reverse ++ (paramsTel U np ty).reverse from by
+      simp [ctorFieldsR, paramsTel, List.map_reverse],
+    liftTelN_congr _ _ hml.symm] at h1
+  -- (2) insert `mid` at the bottom of the fields
+  have W₁ := Ctx.LiftN.consTel (n := mid.length) (ctorFieldsR U np c)
+    (Ctx.LiftN.zero (Γ := (paramsTel U np ty).reverse) mid)
+  rw [Nat.add_zero] at W₁
+  have h2 := h1.weakN S.ord W₁
+  rw [VExpr.liftN_forallN, hg] at h2
+  -- (3) push the stack underneath
+  have h3 := h2.weakN S.ord (Ctx.LiftN.zero (Γ := _) As₂ (h := hd))
+  rw [VExpr.liftN_forallN] at h3
+  rw [VExpr.liftTelN_liftTelN_hi' (ctorFieldsR U np c).length g _ 0 (by omega),
+    VExpr.liftTelN_liftTelN,
+    show (ctorFields (VExpr.dropN np ty.type)).map (VExpr.instL (VLevel.params' U 1)) =
+      idxTel U np ty from rfl] at h3
+  simpa [ctorIdxs, VExpr.instL, VExpr.liftN, List.map_map, Function.comp_def,
+    List.append_assoc] using h3
+
+/-- Well-formedness of the induction-hypothesis telescope of a minor
+premise, at any suffix of the recursive positions and any depth. -/
+theorem Stage3Env.ihs_onTel {c : VConstVal} (hc : c ∈ ty.ctors) :
+    ∀ (rsSuf : List (Nat × List VExpr)),
+    (∀ q ∈ rsSuf, q ∈ recPairsR U T np (idxTel U np ty).length c) →
+    ∀ (Δ : List VExpr) (p : Nat), Δ.length = p →
+    OnTel env (U+1)
+      (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (ihsFrom (ctorFieldsR U np c).length rsSuf p)
+  | [], _, _, _, _ => trivial
+  | (j, idxs) :: rsSuf, hqs, Δ, p, hΔ => by
+    have hq := hqs _ (List.Mem.head _)
+    obtain ⟨B, hBj0, hrec0, hidx0⟩ := recPairsR_mem hq
+    have hBj : (ctorFields (VExpr.dropN np c.type))[j]? = some B := hBj0
+    have hrec : isRecField U T np (ctorFields (VExpr.dropN np ty.type)).length j B =
+        true := by
+      have h : isRecField U T np (idxTel U np ty).length j B = true := hrec0
+      rwa [idxTel_length] at h
+    have hidx' : idxs = (recFieldIdxs np B).map (VExpr.instL (VLevel.params' U 1)) := hidx0
+    have hjlt : j < (ctorFields (VExpr.dropN np c.type)).length := by
+      simpa using recPairsR_lt _ hq
+    have hml : (ctorFieldsR U np c).length =
+        (ctorFields (VExpr.dropN np c.type)).length := ctorFieldsR_length
+    have hml2 : (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+        (ctorFieldsR U np c).length := VExpr.liftTelN_length ..
+    have hni : (recFieldIdxs np B).length = (ctorFields (VExpr.dropN np ty.type)).length :=
+      (isRecField_eq hrec).2.1
+    refine ⟨?_, Stage3Env.ihs_onTel hc rsSuf (fun q hq' => hqs q (.tail _ hq'))
+      (_ :: Δ) (p+1) (by simp [hΔ])⟩
+    -- the motive variable
+    have hM := getElem?_stack3 Δ
+      ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse)
+      (paramsTel U np ty).reverse (motiveType U T np ty)
+      (i := (ctorFieldsR U np c).length + p)
+      (by simp only [hΔ, List.length_reverse, VExpr.liftTelN_length]; omega)
+    have hmlu := Lookup.of_getElem? hM
+    rw [motiveType_liftN] at hmlu
+    -- the transported index spine
+    have hSp := S.spine_transport hc hBj hrec [motiveType U T np ty] (g := 1) rfl
+      (Δ ++ ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).drop j).reverse)
+      (d := (ctorFieldsR U np c).length - j + p)
+      (by simp only [List.length_append, List.length_reverse, List.length_drop,
+            hml2, hΔ]
+          omega)
+    rw [show (Δ ++ ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).drop j).reverse) ++
+        ((VExpr.liftTelN 1 ((ctorFieldsR U np c).take j) 0).reverse ++
+          ([motiveType U T np ty] ++ (paramsTel U np ty).reverse)) =
+      Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse) from by
+        rw [← VExpr.liftTelN_take, List.append_assoc,
+          ← List.append_assoc (((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).drop j).reverse),
+          ← List.reverse_append, List.take_append_drop, List.singleton_append,
+          ← List.append_assoc],
+      liftTelN_congr _ _ (show j + 1 + ((ctorFieldsR U np c).length - j + p) =
+        (ctorFieldsR U np c).length + p + 1 from by omega),
+      ← hidx'] at hSp
+    -- retarget onto the motive's pi and compute the instantiation
+    have hlen : (idxs.map fun e => (e.liftN 1 j).liftN
+        ((ctorFieldsR U np c).length - j + p)).length =
+      (VExpr.liftTelN ((ctorFieldsR U np c).length + p + 1) (idxTel U np ty) 0).length := by
+      simp only [List.length_map, VExpr.liftTelN_length, hidx', idxTel_length]
+      exact hni
+    have hRe := hSp.retarget hlen (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((ctorFieldsR U np c).length + p + 1 + (idxTel U np ty).length) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+    rw [show VExpr.instRev (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + p + 1 +
+          (idxTel U np ty).length) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.sort (.param 0)))
+        (idxs.map fun e => (e.liftN 1 j).liftN ((ctorFieldsR U np c).length - j + p)) =
+      .forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + p + 1) np ++
+          idxs.map fun e => (e.liftN 1 j).liftN ((ctorFieldsR U np c).length - j + p)))
+        (.sort (.param 0)) from by
+      rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+        VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+        List.map_append,
+        VExpr.map_instRev_bvarRevRange_ge _ _ _ (by
+          simp only [List.length_map]
+          rw [hidx', List.length_map, hni, ← idxTel_length (U := U) (ty := ty)]
+          omega),
+        show (ctorFieldsR U np c).length + p + 1 + (idxTel U np ty).length -
+            (idxs.map fun e => (e.liftN 1 j).liftN
+              ((ctorFieldsR U np c).length - j + p)).length =
+          (ctorFieldsR U np c).length + p + 1 from by
+          simp only [List.length_map]
+          rw [hidx', List.length_map, hni, ← idxTel_length (U := U) (ty := ty)]
+          omega,
+        VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length =
+          (idxs.map fun e => (e.liftN 1 j).liftN
+            ((ctorFieldsR U np c).length - j + p)).length from by
+          simp only [List.length_map]
+          rw [hidx', List.length_map, hni, ← idxTel_length (U := U) (ty := ty)]),
+        VExpr.map_instRev_bvarRevRange]] at hRe
+    -- the motive applied to the index arguments
+    have hApp := hRe.hasType_appN (f := .bvar ((ctorFieldsR U np c).length + p)) (.bvar hmlu)
+    -- the recursive-field variable
+    have hF := getElem?_stack_mid Δ
+      ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse)
+      (motiveType U T np ty :: (paramsTel U np ty).reverse)
+      (i := (ctorFieldsR U np c).length - 1 - j + p)
+      (by rw [hΔ]; omega)
+      (by simp only [hΔ, List.length_reverse, VExpr.liftTelN_length]; omega)
+    rw [show (ctorFieldsR U np c).length - 1 - j + p - Δ.length =
+        (ctorFieldsR U np c).length - 1 - j from by rw [hΔ]; omega,
+      List.getElem?_reverse (by simp only [VExpr.liftTelN_length]; omega),
+      VExpr.liftTelN_length,
+      show (ctorFieldsR U np c).length - 1 -
+        ((ctorFieldsR U np c).length - 1 - j) = j from by omega,
+      VExpr.liftTelN_getElem?, ctorFieldsR_getElem?, hBj] at hF
+    simp only [Option.map_some] at hF
+    have hflu := Lookup.of_getElem? hF
+    rw [show (((B.instL (VLevel.params' U 1)).liftN 1 (0+j)).liftN
+        ((ctorFieldsR U np c).length - 1 - j + p + 1)) =
+      VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + p + 1) np ++
+          idxs.map fun e => (e.liftN 1 j).liftN
+            ((ctorFieldsR U np c).length - j + p)) from by
+      conv => lhs; rw [(isRecField_eq hrec).1]
+      rw [VExpr.instL_appN, List.map_append, bvarRevRange_instL,
+        show (VExpr.const T (VLevel.params U)).instL (VLevel.params' U 1) =
+          .const T (VLevel.params' U 1) from by
+          simp [VExpr.instL, VLevel.params_map_inst_params'],
+        VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+        bvarRevRange_liftN_ge _ _ _ _ (by omega),
+        bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+        VExpr.bvarRevRange_congr np (show (ctorFieldsR U np c).length - 1 - j + p + 1 +
+          (1 + j) = (ctorFieldsR U np c).length + p + 1 from by omega),
+        ← hidx', List.map_map]
+      refine congrArg (VExpr.appN _) (congrArg (VExpr.bvarRevRange _ np ++ ·) ?_)
+      refine List.map_congr_left fun e _ => ?_
+      show (e.liftN 1 (0+j)).liftN ((ctorFieldsR U np c).length - 1 - j + p + 1) = _
+      rw [show (0+j) = j from Nat.zero_add j,
+        show (ctorFieldsR U np c).length - 1 - j + p + 1 =
+          (ctorFieldsR U np c).length - j + p from by omega]] at hflu
+    have happ2 : env.HasType (U+1)
+        (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse))
+        (VExpr.appN (.bvar ((ctorFieldsR U np c).length + p))
+          ((idxs.map fun e => (e.liftN 1 j).liftN
+            ((ctorFieldsR U np c).length - j + p)) ++
+            [.bvar ((ctorFieldsR U np c).length - 1 - j + p)]))
+        ((VExpr.sort (.param 0)).inst
+          (.bvar ((ctorFieldsR U np c).length - 1 - j + p))) := by
+      rw [VExpr.appN_append]
+      exact HasType.app hApp (.bvar hflu)
+    exact ⟨_, happ2⟩
+theorem Stage3Env.ctorAppMin_hasType {c : VConstVal} (hc : c ∈ ty.ctors)
+    (Δ : List VExpr) :
+    env.HasType (U+1)
+      (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange (Δ.length + (ctorFieldsR U np c).length + 1) np ++
+          VExpr.bvarRevRange Δ.length (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (Δ.length + (ctorFieldsR U np c).length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN Δ.length)) := by
+  have hml : (ctorFieldsR U np c).length =
+      (ctorFields (VExpr.dropN np c.type)).length := ctorFieldsR_length
+  have hml2 : (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+      (ctorFieldsR U np c).length := VExpr.liftTelN_length ..
+  have hcl : (c.type.instL (VLevel.params' U 1)).ClosedN 0 :=
+    (Ordered.closedC (ci := ⟨U, c.type⟩) S.ord (S.hcs c hc)).instL
+  -- step A: consume the parameter telescope
+  have hfA : env.HasType (U+1)
+      ((Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        [motiveType U T np ty]) ++ (paramsTel U np ty).reverse ++ [])
+      (.const c.name (VLevel.params' U 1))
+      ((VExpr.forallN (paramsTel U np ty)
+        (VExpr.forallN (ctorFieldsR U np c)
+          (VExpr.appN (.const T (VLevel.params' U 1))
+            (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+              ctorIdxs U np c)))).liftN
+        ((Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+          [motiveType U T np ty]).length + (paramsTel U np ty).length)) := by
+    rw [← S.ctorType_instL hc, hcl.liftN_eq (Nat.zero_le _)]
+    exact S.cConst hc
+  have hA := HasType.appN_selfSpine (env := env) (U := U+1) hfA
+  -- step B: consume the field telescope
+  rw [VExpr.liftN_forallN] at hA
+  have hBeq : VExpr.forallN
+      (VExpr.liftTelN ((Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+          [motiveType U T np ty]).length) (ctorFieldsR U np c) 0)
+      ((VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+          ctorIdxs U np c)).liftN
+        ((Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+          [motiveType U T np ty]).length) (0 + (ctorFieldsR U np c).length)) =
+      (VExpr.forallN (VExpr.liftTelN 1 (ctorFieldsR U np c) 0)
+        ((VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+            ctorIdxs U np c)).liftN 1 (0 + (ctorFieldsR U np c).length))).liftN
+        (Δ.length + (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length) := by
+    conv => rhs; rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+      show (0:Nat) + (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+        0 + (ctorFieldsR U np c).length from by rw [hml2],
+      VExpr.liftN'_liftN_hi]
+    rw [liftTelN_congr _ _ (show (1:Nat) + (Δ.length +
+        (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length) =
+      (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+        [motiveType U T np ty]).length from by
+      simp only [List.length_append, List.length_reverse, VExpr.liftTelN_length,
+        List.length_singleton]
+      omega),
+      show (1 + (Δ.length + (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length)) =
+        (Δ ++ (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+          [motiveType U T np ty]).length from by
+        simp only [List.length_append, List.length_reverse, VExpr.liftTelN_length,
+          List.length_singleton]
+        omega]
+  rw [hBeq] at hA
+  have hB := HasType.appN_selfSpine (env := env) (U := U+1)
+    (Δ := Δ) (Γ := motiveType U T np ty :: (paramsTel U np ty).reverse)
+    (As := VExpr.liftTelN 1 (ctorFieldsR U np c) 0)
+    (B := (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+        ctorIdxs U np c)).liftN 1 (0 + (ctorFieldsR U np c).length))
+    (by simpa [List.append_assoc, List.append_nil] using hA)
+  rw [show (paramsTel U np ty).length = np from by
+      simp [paramsTel, List.length_map, S.hlen],
+    VExpr.bvarRevRange_congr np (show Δ.length +
+      ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length + 1) =
+      Δ.length + (ctorFieldsR U np c).length + 1 from by omega),
+    VExpr.liftTelN_length] at hB
+  rw [show ((VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+        ctorIdxs U np c)).liftN 1 (0 + (ctorFieldsR U np c).length)).liftN Δ.length =
+    VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (Δ.length + (ctorFieldsR U np c).length + 1) np ++
+        (ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN Δ.length) from by
+    rw [VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+      Nat.zero_add ((ctorFieldsR U np c).length),
+      bvarRevRange_liftN_ge _ _ _ _ (by omega),
+      bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+      VExpr.bvarRevRange_congr np (show Δ.length +
+        (1 + (0 + (ctorFields (VExpr.dropN np c.type)).length)) =
+        Δ.length + (ctorFieldsR U np c).length + 1 from by omega),
+      List.map_map]
+    rfl] at hB
+  rw [show VExpr.appN (.const c.name (VLevel.params' U 1))
+      (VExpr.bvarRevRange (Δ.length + (ctorFieldsR U np c).length + 1) np ++
+        VExpr.bvarRevRange Δ.length (ctorFieldsR U np c).length) =
+    (VExpr.appN (.const c.name (VLevel.params' U 1))
+      (VExpr.bvarRevRange (Δ.length + (ctorFieldsR U np c).length + 1) np)).appN
+      (VExpr.bvarRevRange Δ.length (ctorFieldsR U np c).length) from
+    VExpr.appN_append ..]
+  exact hB
+
+/-- The minor premise for a constructor is a type over
+`params ++ [motive]`. -/
+theorem Stage3Env.minor_isType {c : VConstVal} (hc : c ∈ ty.ctors) :
+    env.IsType (U+1) (motiveType U T np ty :: (paramsTel U np ty).reverse)
+      (minorType U T np ty c) := by
+  simp only [minorType]
+  refine IsType.forallN ?_ ?_
+  · have h0 := S.fieldsWF_onTel _ [] 0 rfl (by simpa using S.hfields c hc)
+    have h1 := h0.weakN S.ord (.zero [motiveType U T np ty])
+    simpa [ctorFieldsR, List.map_reverse, paramsTel] using h1
+  · refine IsType.forallN (S.ihs_onTel hc _ (fun q hq => hq) [] 0 rfl) ?_
+    have hml2 : (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+        (ctorFieldsR U np c).length := VExpr.liftTelN_length ..
+    have hrlen : ((ihsFrom (ctorFieldsR U np c).length
+        (recPairsR U T np (idxTel U np ty).length c) 0).reverse).length =
+        (recPairsR U T np (idxTel U np ty).length c).length := by
+      simp [ihsFrom_length]
+    -- the motive variable
+    have hM := getElem?_rstack3 ((ihsFrom (ctorFieldsR U np c).length
+        (recPairsR U T np (idxTel U np ty).length c) 0).reverse)
+      ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse)
+      (motiveType U T np ty) (paramsTel U np ty).reverse
+      (i := (ctorFieldsR U np c).length +
+        (recPairsR U T np (idxTel U np ty).length c).length)
+      (by simp only [List.length_reverse, ihsFrom_length, VExpr.liftTelN_length]; omega)
+    have hmlu := Lookup.of_getElem? hM
+    rw [motiveType_liftN] at hmlu
+    -- the transported result spine
+    have hSp := S.result_transport hc [motiveType U T np ty] (g := 1) rfl
+      ((ihsFrom (ctorFieldsR U np c).length
+        (recPairsR U T np (idxTel U np ty).length c) 0).reverse)
+      (d := (recPairsR U T np (idxTel U np ty).length c).length) hrlen
+    rw [liftTelN_congr _ _ (show (ctorFieldsR U np c).length + 1 +
+        (recPairsR U T np (idxTel U np ty).length c).length =
+      (ctorFieldsR U np c).length +
+        (recPairsR U T np (idxTel U np ty).length c).length + 1 from by omega)] at hSp
+    have hlen : ((ctorIdxs U np c).map fun e =>
+        (e.liftN 1 (ctorFieldsR U np c).length).liftN
+          (recPairsR U T np (idxTel U np ty).length c).length).length =
+      (VExpr.liftTelN ((ctorFieldsR U np c).length +
+        (recPairsR U T np (idxTel U np ty).length c).length + 1)
+        (idxTel U np ty) 0).length := by
+      simp only [List.length_map, VExpr.liftTelN_length, ctorIdxs_length, idxTel_length]
+      have hc3 := stage3Ctor_eq (S.hs3 c hc)
+      exact hc3.2.1
+    have hRe := hSp.retarget hlen (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+        (recPairsR U T np (idxTel U np ty).length c).length + 1 +
+          (idxTel U np ty).length) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+    rw [show VExpr.instRev (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+          (recPairsR U T np (idxTel U np ty).length c).length + 1 +
+            (idxTel U np ty).length) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.sort (.param 0)))
+        ((ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN
+            (recPairsR U T np (idxTel U np ty).length c).length) =
+      .forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+          (recPairsR U T np (idxTel U np ty).length c).length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN
+              (recPairsR U T np (idxTel U np ty).length c).length))
+        (.sort (.param 0)) from by
+      rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+        VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+        List.map_append,
+        VExpr.map_instRev_bvarRevRange_ge _ _ _ (by
+          rw [hlen, VExpr.liftTelN_length]; omega),
+        show (ctorFieldsR U np c).length +
+            (recPairsR U T np (idxTel U np ty).length c).length + 1 +
+            (idxTel U np ty).length -
+            ((ctorIdxs U np c).map fun e =>
+              (e.liftN 1 (ctorFieldsR U np c).length).liftN
+                (recPairsR U T np (idxTel U np ty).length c).length).length =
+          (ctorFieldsR U np c).length +
+            (recPairsR U T np (idxTel U np ty).length c).length + 1 from by
+          rw [hlen, VExpr.liftTelN_length]
+          omega,
+        VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length =
+          ((ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN
+              (recPairsR U T np (idxTel U np ty).length c).length).length from by
+          rw [hlen, VExpr.liftTelN_length]),
+        VExpr.map_instRev_bvarRevRange]] at hRe
+    -- the motive applied to the result indices
+    have hApp := hRe.hasType_appN (f := .bvar ((ctorFieldsR U np c).length +
+      (recPairsR U T np (idxTel U np ty).length c).length)) (.bvar hmlu)
+    -- the constructor application
+    have hctor := S.ctorAppMin_hasType hc
+      ((ihsFrom (ctorFieldsR U np c).length
+        (recPairsR U T np (idxTel U np ty).length c) 0).reverse)
+    rw [hrlen] at hctor
+    rw [VExpr.bvarRevRange_congr np (show
+        (recPairsR U T np (idxTel U np ty).length c).length +
+          (ctorFieldsR U np c).length + 1 =
+        (ctorFieldsR U np c).length +
+          (recPairsR U T np (idxTel U np ty).length c).length + 1 from by omega)] at hctor
+    have happ2 : env.HasType (U+1)
+        ((ihsFrom (ctorFieldsR U np c).length
+          (recPairsR U T np (idxTel U np ty).length c) 0).reverse ++
+          ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+        (VExpr.appN (.bvar ((ctorFieldsR U np c).length +
+          (recPairsR U T np (idxTel U np ty).length c).length))
+          (((ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN
+              (recPairsR U T np (idxTel U np ty).length c).length) ++
+            [VExpr.appN (.const c.name (VLevel.params' U 1))
+              (VExpr.bvarRevRange ((recPairsR U T np (idxTel U np ty).length c).length +
+                (ctorFieldsR U np c).length + 1) np ++
+                VExpr.bvarRevRange (recPairsR U T np (idxTel U np ty).length c).length
+                  (ctorFieldsR U np c).length)]))
+        ((VExpr.sort (.param 0)).inst
+          (VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((recPairsR U T np (idxTel U np ty).length c).length +
+              (ctorFieldsR U np c).length + 1) np ++
+              VExpr.bvarRevRange (recPairsR U T np (idxTel U np ty).length c).length
+                (ctorFieldsR U np c).length))) := by
+      rw [VExpr.appN_append,
+        VExpr.bvarRevRange_congr np (show
+          (recPairsR U T np (idxTel U np ty).length c).length +
+            (ctorFieldsR U np c).length + 1 =
+          (ctorFieldsR U np c).length +
+            (recPairsR U T np (idxTel U np ty).length c).length + 1 from by omega)]
+      exact HasType.app hApp (by simpa [List.append_assoc] using hctor)
+    exact ⟨_, by simpa [List.append_assoc] using happ2⟩
+
+/-- The generalized minor premise is a type over `params ++ [motive]`.
+This is the preservation theorem used by `minorTypeRec`; it differs from
+`minor_isType` only in the functional-IH telescope supplied for recursive
+Pi arguments. -/
+theorem Stage3Env.minor_isTypeRec {c : VConstVal} (hc : c ∈ ty.ctors) :
+    env.IsType (U+1) (motiveType U T np ty :: (paramsTel U np ty).reverse)
+      (minorTypeRec U T np ty c) := by
+  simp only [minorTypeRec]
+  refine IsType.forallN ?_ ?_
+  · have h0 := S.fieldsWF_onTel _ [] 0 rfl (by simpa using S.hfields c hc)
+    have h1 := h0.weakN S.ord (.zero [motiveType U T np ty])
+    simpa [ctorFieldsR, List.map_reverse, paramsTel] using h1
+  · refine IsType.forallN (S.ihsRec_onTel hc _ (fun q hq => hq) [] 0 rfl) ?_
+    have hml2 : (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+        (ctorFieldsR U np c).length := VExpr.liftTelN_length ..
+    have hrlen : ((ihsFromRecArgs (ctorFieldsR U np c).length
+        (recArgsR U T np (idxTel U np ty).length c) 0).reverse).length =
+        (recArgsR U T np (idxTel U np ty).length c).length := by
+      simp [ihsFromRecArgs_length]
+    -- the motive variable
+    have hM := getElem?_rstack3 ((ihsFromRecArgs (ctorFieldsR U np c).length
+        (recArgsR U T np (idxTel U np ty).length c) 0).reverse)
+      ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse)
+      (motiveType U T np ty) (paramsTel U np ty).reverse
+      (i := (ctorFieldsR U np c).length +
+        (recArgsR U T np (idxTel U np ty).length c).length)
+      (by simp only [List.length_reverse, ihsFromRecArgs_length,
+        VExpr.liftTelN_length]; omega)
+    have hmlu := Lookup.of_getElem? hM
+    rw [motiveType_liftN] at hmlu
+    -- the transported result spine
+    have hSp := S.result_transport hc [motiveType U T np ty] (g := 1) rfl
+      ((ihsFromRecArgs (ctorFieldsR U np c).length
+        (recArgsR U T np (idxTel U np ty).length c) 0).reverse)
+      (d := (recArgsR U T np (idxTel U np ty).length c).length) hrlen
+    rw [liftTelN_congr _ _ (show (ctorFieldsR U np c).length + 1 +
+        (recArgsR U T np (idxTel U np ty).length c).length =
+      (ctorFieldsR U np c).length +
+        (recArgsR U T np (idxTel U np ty).length c).length + 1 from by omega)] at hSp
+    have hlen : ((ctorIdxs U np c).map fun e =>
+        (e.liftN 1 (ctorFieldsR U np c).length).liftN
+          (recArgsR U T np (idxTel U np ty).length c).length).length =
+      (VExpr.liftTelN ((ctorFieldsR U np c).length +
+        (recArgsR U T np (idxTel U np ty).length c).length + 1)
+        (idxTel U np ty) 0).length := by
+      simp only [List.length_map, VExpr.liftTelN_length, ctorIdxs_length, idxTel_length]
+      have hc3 := stage3Ctor_eq (S.hs3 c hc)
+      exact hc3.2.1
+    have hRe := hSp.retarget hlen (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+        (recArgsR U T np (idxTel U np ty).length c).length + 1 +
+          (idxTel U np ty).length) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+    rw [show VExpr.instRev (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+          (recArgsR U T np (idxTel U np ty).length c).length + 1 +
+            (idxTel U np ty).length) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.sort (.param 0)))
+        ((ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN
+            (recArgsR U T np (idxTel U np ty).length c).length) =
+      .forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+          (recArgsR U T np (idxTel U np ty).length c).length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN
+              (recArgsR U T np (idxTel U np ty).length c).length))
+        (.sort (.param 0)) from by
+      rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+        VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+        List.map_append,
+        VExpr.map_instRev_bvarRevRange_ge _ _ _ (by
+          rw [hlen, VExpr.liftTelN_length]; omega),
+        show (ctorFieldsR U np c).length +
+            (recArgsR U T np (idxTel U np ty).length c).length + 1 +
+            (idxTel U np ty).length -
+            ((ctorIdxs U np c).map fun e =>
+              (e.liftN 1 (ctorFieldsR U np c).length).liftN
+                (recArgsR U T np (idxTel U np ty).length c).length).length =
+          (ctorFieldsR U np c).length +
+            (recArgsR U T np (idxTel U np ty).length c).length + 1 from by
+          rw [hlen, VExpr.liftTelN_length]
+          omega,
+        VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length =
+          ((ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN
+              (recArgsR U T np (idxTel U np ty).length c).length).length from by
+          rw [hlen, VExpr.liftTelN_length]),
+        VExpr.map_instRev_bvarRevRange]] at hRe
+    -- the motive applied to the result indices
+    have hApp := hRe.hasType_appN (f := .bvar ((ctorFieldsR U np c).length +
+      (recArgsR U T np (idxTel U np ty).length c).length)) (.bvar hmlu)
+    -- the constructor application
+    have hctor := S.ctorAppMin_hasType hc
+      ((ihsFromRecArgs (ctorFieldsR U np c).length
+        (recArgsR U T np (idxTel U np ty).length c) 0).reverse)
+    rw [hrlen] at hctor
+    rw [VExpr.bvarRevRange_congr np (show
+        (recArgsR U T np (idxTel U np ty).length c).length +
+          (ctorFieldsR U np c).length + 1 =
+        (ctorFieldsR U np c).length +
+          (recArgsR U T np (idxTel U np ty).length c).length + 1 from by omega)] at hctor
+    have happ2 : env.HasType (U+1)
+        ((ihsFromRecArgs (ctorFieldsR U np c).length
+          (recArgsR U T np (idxTel U np ty).length c) 0).reverse ++
+          ((VExpr.liftTelN 1 (ctorFieldsR U np c) 0).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+        (VExpr.appN (.bvar ((ctorFieldsR U np c).length +
+          (recArgsR U T np (idxTel U np ty).length c).length))
+          (((ctorIdxs U np c).map fun e =>
+            (e.liftN 1 (ctorFieldsR U np c).length).liftN
+              (recArgsR U T np (idxTel U np ty).length c).length) ++
+            [VExpr.appN (.const c.name (VLevel.params' U 1))
+              (VExpr.bvarRevRange ((recArgsR U T np (idxTel U np ty).length c).length +
+                (ctorFieldsR U np c).length + 1) np ++
+                VExpr.bvarRevRange (recArgsR U T np (idxTel U np ty).length c).length
+                  (ctorFieldsR U np c).length)]))
+        ((VExpr.sort (.param 0)).inst
+          (VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((recArgsR U T np (idxTel U np ty).length c).length +
+              (ctorFieldsR U np c).length + 1) np ++
+              VExpr.bvarRevRange (recArgsR U T np (idxTel U np ty).length c).length
+                (ctorFieldsR U np c).length))) := by
+      rw [VExpr.appN_append,
+        VExpr.bvarRevRange_congr np (show
+          (recArgsR U T np (idxTel U np ty).length c).length +
+            (ctorFieldsR U np c).length + 1 =
+          (ctorFieldsR U np c).length +
+            (recArgsR U T np (idxTel U np ty).length c).length + 1 from by omega)]
+      exact HasType.app hApp (by simpa [List.append_assoc] using hctor)
+    exact ⟨_, by simpa [List.append_assoc] using happ2⟩
+
+/-- The minor premises, in position, are a telescope over
+`params ++ [motive]`. -/
+theorem Stage3Env.minorTypes_onTel :
+    ∀ (cs' : List VConstVal), (∀ c ∈ cs', c ∈ ty.ctors) →
+    ∀ (Δ : List VExpr) (i : Nat), Δ.length = i →
+    OnTel env (U+1) (Δ ++ (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (minorTypes U T np ty cs' i)
+  | [], _, _, _, _ => trivial
+  | c :: cs', hsub, Δ, i, hΔ =>
+    ⟨by
+      rw [← hΔ]
+      exact (S.minor_isType (hsub c (.head _))).weakN S.ord (.zero Δ),
+    Stage3Env.minorTypes_onTel cs' (fun c h => hsub c (.tail _ h)) (_ :: Δ) (i+1)
+      (by simp [hΔ])⟩
+
+/-- Generalized minor premises, including functional recursive hypotheses,
+form a telescope over `params ++ [motive]`. -/
+theorem Stage3Env.minorTypesRec_onTel :
+    ∀ (cs' : List VConstVal), (∀ c ∈ cs', c ∈ ty.ctors) →
+    ∀ (Δ : List VExpr) (i : Nat), Δ.length = i →
+    OnTel env (U+1) (Δ ++ (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (minorTypesRec U T np ty cs' i)
+  | [], _, _, _, _ => trivial
+  | c :: cs', hsub, Δ, i, hΔ =>
+    ⟨by
+      rw [← hΔ]
+      exact (S.minor_isTypeRec (hsub c (.head _))).weakN S.ord (.zero Δ),
+    Stage3Env.minorTypesRec_onTel cs' (fun c h => hsub c (.tail _ h)) (_ :: Δ) (i+1)
+      (by simp [hΔ])⟩
+
+/-- The generated recursor type is well-formed. -/
+theorem Stage3Env.recType_isType : env.IsType (U+1) [] (recType U T np ty) := by
+  have hP : OnTel env (U+1) [] (paramsTel U np ty) := by
+    have := S.hparams.of_append.1.instL (U' := U+1) VLevel.params'_one_wf
+    simpa [paramsTel] using this
+  refine IsType.forallN hP ?_
+  simp only [List.append_nil]
+  refine IsType.forallE S.motive_isType ?_
+  refine IsType.forallN
+    (by simpa using S.minorTypes_onTel ty.ctors (fun _ h => h) [] 0 rfl) ?_
+  have hI : OnTel env (U+1)
+      ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0) := by
+    have h := S.idxTel_onTel.weakN S.ord
+      (Ctx.LiftN.zero (n := ty.ctors.length + 1)
+        (Γ := (paramsTel U np ty).reverse)
+        ((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+        (h := by simp [minorTypes_length]))
+    simpa [List.append_assoc] using h
+  refine IsType.forallN hI ?_
+  have hmaj : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    have W := Ctx.LiftN.consTel (n := ty.ctors.length + 1) (idxTel U np ty)
+      (Ctx.LiftN.zero (n := ty.ctors.length + 1)
+        (Γ := (paramsTel U np ty).reverse)
+        ((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+        (h := by simp [minorTypes_length]))
+    have h := S.motiveTApp_hasType.weakN S.ord W
+    simp only [Nat.add_zero, VExpr.liftN_appN, VExpr.liftN, List.map_append] at h
+    rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+      VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+      VExpr.bvarRevRange_congr np (show
+        ty.ctors.length + 1 + (idxTel U np ty).length =
+          (idxTel U np ty).length + ty.ctors.length + 1 from by omega)] at h
+    simpa [List.append_assoc] using h
+  refine IsType.forallE ⟨_, hmaj⟩ ?_
+  have hM := getElem?_rstack3
+    [VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length)]
+    ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+      (minorTypes U T np ty ty.ctors).reverse)
+    (motiveType U T np ty) (paramsTel U np ty).reverse
+    (i := (idxTel U np ty).length + ty.ctors.length + 1)
+    (by simp only [List.length_singleton, List.length_append, List.length_reverse,
+      VExpr.liftTelN_length, minorTypes_length]; omega)
+  have hmlu := Lookup.of_getElem? (by
+    simpa only [List.singleton_append, List.append_assoc] using hM)
+  rw [show (motiveType U T np ty).liftN
+        ((idxTel U np ty).length + ty.ctors.length + 1 + 1) =
+      ((motiveType U T np ty).liftN (ty.ctors.length + 1)).liftN
+        ((idxTel U np ty).length + 1) from by
+      rw [VExpr.liftN_liftN]
+      congr 1
+      omega,
+    motiveType_liftN] at hmlu
+  have hfun : env.HasType (U+1)
+      (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length) ::
+        ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+          ((minorTypes U T np ty ty.ctors).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse))))
+      (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+      ((VExpr.forallN
+        (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange (ty.ctors.length + 1 + (idxTel U np ty).length) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length))
+          (.sort (.param 0)))).liftN
+        (1 + (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).length)) := by
+    exact .bvar (by
+      simpa [List.append_assoc, VExpr.liftTelN_length, Nat.add_comm] using hmlu)
+  have hMapp := HasType.appN_selfSpine
+    (As := VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+    (Δ := [VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length)])
+    (Γ := (minorTypes U T np ty ty.ctors).reverse ++
+      (motiveType U T np ty :: (paramsTel U np ty).reverse))
+    (f := .bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+    hfun
+  have h0 :
+      (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length) ::
+        ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+          ((minorTypes U T np ty ty.ctors).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse))))[0]? =
+        some (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)) := rfl
+  have harg := HasType.bvar (env := env) (U := U+1) (Lookup.of_getElem? h0)
+  have harg' : env.HasType (U+1)
+      ([VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)] ++
+        (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (.bvar 0)
+      ((VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (ty.ctors.length + 1 + (idxTel U np ty).length) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length)).liftN
+        [VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)].length) := by
+    simpa [List.append_assoc, Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using harg
+  have happ := HasType.app hMapp harg'
+  exact ⟨_, by
+    simpa [List.append_assoc, VExpr.liftTelN_length] using happ⟩
+
+/-- The generalized recursor type, whose constructor minors include
+functional IHs for recursive Pi arguments, is well-formed. -/
+theorem Stage3Env.recTypeRec_isType : env.IsType (U+1) [] (recTypeRec U T np ty) := by
+  have hP : OnTel env (U+1) [] (paramsTel U np ty) := by
+    have := S.hparams.of_append.1.instL (U' := U+1) VLevel.params'_one_wf
+    simpa [paramsTel] using this
+  refine IsType.forallN hP ?_
+  simp only [List.append_nil]
+  refine IsType.forallE S.motive_isType ?_
+  refine IsType.forallN
+    (by simpa using S.minorTypesRec_onTel ty.ctors (fun _ h => h) [] 0 rfl) ?_
+  have hI : OnTel env (U+1)
+      ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0) := by
+    have h := S.idxTel_onTel.weakN S.ord
+      (Ctx.LiftN.zero (n := ty.ctors.length + 1)
+        (Γ := (paramsTel U np ty).reverse)
+        ((minorTypesRec U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+        (h := by simp [minorTypesRec_length]))
+    simpa [List.append_assoc] using h
+  refine IsType.forallN hI ?_
+  have hmaj : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    have W := Ctx.LiftN.consTel (n := ty.ctors.length + 1) (idxTel U np ty)
+      (Ctx.LiftN.zero (n := ty.ctors.length + 1)
+        (Γ := (paramsTel U np ty).reverse)
+        ((minorTypesRec U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+        (h := by simp [minorTypesRec_length]))
+    have h := S.motiveTApp_hasType.weakN S.ord W
+    simp only [Nat.add_zero, VExpr.liftN_appN, VExpr.liftN, List.map_append] at h
+    rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.le_refl _),
+      VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+      VExpr.bvarRevRange_congr np (show
+        ty.ctors.length + 1 + (idxTel U np ty).length =
+          (idxTel U np ty).length + ty.ctors.length + 1 from by omega)] at h
+    simpa [List.append_assoc] using h
+  refine IsType.forallE ⟨_, hmaj⟩ ?_
+  have hM := getElem?_rstack3
+    [VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length)]
+    ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+      (minorTypesRec U T np ty ty.ctors).reverse)
+    (motiveType U T np ty) (paramsTel U np ty).reverse
+    (i := (idxTel U np ty).length + ty.ctors.length + 1)
+    (by simp only [List.length_singleton, List.length_append, List.length_reverse,
+      VExpr.liftTelN_length, minorTypesRec_length]; omega)
+  have hmlu := Lookup.of_getElem? (by
+    simpa only [List.singleton_append, List.append_assoc] using hM)
+  rw [show (motiveType U T np ty).liftN
+        ((idxTel U np ty).length + ty.ctors.length + 1 + 1) =
+      ((motiveType U T np ty).liftN (ty.ctors.length + 1)).liftN
+        ((idxTel U np ty).length + 1) from by
+      rw [VExpr.liftN_liftN]
+      congr 1
+      omega,
+    motiveType_liftN] at hmlu
+  have hfun : env.HasType (U+1)
+      (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length) ::
+        ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+          ((minorTypesRec U T np ty ty.ctors).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse))))
+      (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+      ((VExpr.forallN
+        (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange (ty.ctors.length + 1 + (idxTel U np ty).length) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length))
+          (.sort (.param 0)))).liftN
+        (1 + (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).length)) := by
+    exact .bvar (by
+      simpa [List.append_assoc, VExpr.liftTelN_length, Nat.add_comm] using hmlu)
+  have hMapp := HasType.appN_selfSpine
+    (As := VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+    (Δ := [VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length)])
+    (Γ := (minorTypesRec U T np ty ty.ctors).reverse ++
+      (motiveType U T np ty :: (paramsTel U np ty).reverse))
+    (f := .bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+    hfun
+  have h0 :
+      (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length) ::
+        ((VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+          ((minorTypesRec U T np ty ty.ctors).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse))))[0]? =
+        some (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)) := rfl
+  have harg := HasType.bvar (env := env) (U := U+1) (Lookup.of_getElem? h0)
+  have harg' : env.HasType (U+1)
+      ([VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)] ++
+        (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (.bvar 0)
+      ((VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (ty.ctors.length + 1 + (idxTel U np ty).length) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length)).liftN
+        [VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)].length) := by
+    simpa [List.append_assoc, Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using harg
+  have happ := HasType.app hMapp harg'
+  exact ⟨_, by
+    simpa [List.append_assoc, VExpr.liftTelN_length] using happ⟩
+
+theorem Stage3Env.recConstRec_wf : (recConstRec U T np ty).WF env :=
+  S.recTypeRec_isType
+
+theorem Stage3Env.recConst_wf : (recConst U T np ty).WF env :=
+  S.recType_isType
+
+/-! ## The iota rules -/
+
+/-- The recursor type is closed, by well-formedness. -/
+theorem Stage3Env.recType_closedN : (recType U T np ty).ClosedN 0 := by
+  obtain ⟨u, h⟩ := S.recType_isType
+  exact VExpr.WF.closedN S.ord ⟨_, h⟩ trivial
+
+theorem Stage3Env.recTypeRec_closedN : (recTypeRec U T np ty).ClosedN 0 := by
+  obtain ⟨u, h⟩ := S.recTypeRec_isType
+  exact VExpr.WF.closedN S.ord ⟨_, h⟩ trivial
+
+/-- The recursor constant at its own (identity) universe list. -/
+theorem Stage3Env.recConst_hasType
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty)) {Γ} :
+    env.HasType (U+1) Γ (.const (.str T "rec") (VLevel.params (U+1)))
+      (recType U T np ty) := by
+  have := HasType.const (Γ := Γ) hrec VLevel.params_wf VLevel.params_length
+  rw [show (recConst U T np ty).uvars = U + 1 from rfl,
+    show (recConst U T np ty).type = recType U T np ty from rfl] at this
+  rwa [recType_levelWF.instL_id] at this
+
+theorem Stage3Env.recConstRec_hasType
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty)) {Γ} :
+    env.HasType (U+1) Γ (.const (.str T "rec") (VLevel.params (U+1)))
+      (recTypeRec U T np ty) := by
+  have := HasType.const (Γ := Γ) hrec VLevel.params_wf VLevel.params_length
+  rw [show (recConstRec U T np ty).uvars = U + 1 from rfl,
+    show (recConstRec U T np ty).type = recTypeRec U T np ty from rfl] at this
+  rwa [recTypeRec_levelWF.instL_id] at this
+
+/-- The recursor applied to its parameter, motive, and minor-premise
+spine.  The remaining type is the (lifted) index telescope followed by
+the major premise. -/
+theorem Stage3Env.recBase_hasType
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty))
+    (Δ : List VExpr) :
+    env.HasType (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+        (VExpr.bvarRevRange Δ.length (np + ty.ctors.length + 1)))
+      ((VExpr.forallN (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length))
+          (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+            (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0)))).liftN Δ.length) := by
+  have hf : env.HasType (U+1)
+      (Δ ++ (paramsTel U np ty ++
+        motiveType U T np ty :: minorTypes U T np ty ty.ctors).reverse ++ [])
+      (.const (.str T "rec") (VLevel.params (U+1)))
+      ((VExpr.forallN (paramsTel U np ty ++
+        motiveType U T np ty :: minorTypes U T np ty ty.ctors)
+        (VExpr.forallN (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+          (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (idxTel U np ty).length))
+            (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+              (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0))))).liftN
+        (Δ.length + (paramsTel U np ty ++
+          motiveType U T np ty :: minorTypes U T np ty ty.ctors).length)) := by
+    rw [show VExpr.forallN (paramsTel U np ty ++
+        motiveType U T np ty :: minorTypes U T np ty ty.ctors)
+        (VExpr.forallN (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+          (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (idxTel U np ty).length))
+            (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+              (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0)))) =
+        recType U T np ty from by rw [VExpr.forallN_append]; rfl,
+      S.recType_closedN.liftN_eq (Nat.zero_le _)]
+    exact S.recConst_hasType hrec
+  have hspine := HasType.appN_selfSpine (env := env) (U := U+1) hf
+  simp only [List.reverse_append, List.reverse_cons, List.append_nil, List.append_assoc,
+    List.singleton_append, List.length_append, List.length_cons, minorTypes_length] at hspine
+  rw [show (paramsTel U np ty).length = np from by
+      simp [paramsTel, List.length_map, S.hlen],
+    VExpr.bvarRevRange_congr' Δ.length (show
+      np + (ty.ctors.length + 1) = np + ty.ctors.length + 1 from by omega)] at hspine
+  simpa [List.append_assoc] using hspine
+
+theorem Stage3Env.recBaseRec_hasType
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty))
+    (Δ : List VExpr) :
+    env.HasType (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+        (VExpr.bvarRevRange Δ.length (np + ty.ctors.length + 1)))
+      ((VExpr.forallN (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length))
+          (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+            (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0)))).liftN Δ.length) := by
+  have hf : env.HasType (U+1)
+      (Δ ++ (paramsTel U np ty ++
+        motiveType U T np ty :: minorTypesRec U T np ty ty.ctors).reverse ++ [])
+      (.const (.str T "rec") (VLevel.params (U+1)))
+      ((VExpr.forallN (paramsTel U np ty ++
+        motiveType U T np ty :: minorTypesRec U T np ty ty.ctors)
+        (VExpr.forallN (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+          (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (idxTel U np ty).length))
+            (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+              (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0))))).liftN
+        (Δ.length + (paramsTel U np ty ++
+          motiveType U T np ty :: minorTypesRec U T np ty ty.ctors).length)) := by
+    rw [show VExpr.forallN (paramsTel U np ty ++
+        motiveType U T np ty :: minorTypesRec U T np ty ty.ctors)
+        (VExpr.forallN (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0)
+          (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (idxTel U np ty).length))
+            (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+              (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0)))) =
+        recTypeRec U T np ty from by rw [VExpr.forallN_append]; rfl,
+      S.recTypeRec_closedN.liftN_eq (Nat.zero_le _)]
+    exact S.recConstRec_hasType hrec
+  have hspine := HasType.appN_selfSpine (env := env) (U := U+1) hf
+  simp only [List.reverse_append, List.reverse_cons, List.append_nil, List.append_assoc,
+    List.singleton_append, List.length_append, List.length_cons, minorTypesRec_length] at hspine
+  rw [show (paramsTel U np ty).length = np from by
+      simp [paramsTel, List.length_map, S.hlen],
+    VExpr.bvarRevRange_congr' Δ.length (show
+      np + (ty.ctors.length + 1) = np + ty.ctors.length + 1 from by omega)] at hspine
+  simpa [List.append_assoc] using hspine
+
+/-- Apply the generated recursor to an index spine and its major premise.
+This is shared by constructor-headed rule left sides and by the recursive
+calls appearing in minor-premise right sides. -/
+theorem Stage3Env.recApp_hasType
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty))
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))))
+    (hlen : idxs.length = (idxTel U np ty).length)
+    (ha : env.HasType (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))) a
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (Δ.length + ty.ctors.length + 1) np ++ idxs))) :
+    env.HasType (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange Δ.length (np + ty.ctors.length + 1)))
+        (idxs ++ [a]))
+      (VExpr.appN (.bvar (Δ.length + ty.ctors.length)) (idxs ++ [a])) := by
+  have hb := S.recBase_hasType hrec Δ
+  rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+    liftTelN_congr _ _ (show ty.ctors.length + 1 + Δ.length =
+      Δ.length + ty.ctors.length + 1 from by omega)] at hb
+  have hcod :
+      (VExpr.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+          (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0))).liftN Δ.length
+          (0 + (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).length) =
+      VExpr.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+            ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.app (VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+            ty.ctors.length + 1))
+          (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0)) := by
+    rw [VExpr.liftTelN_length, Nat.zero_add]
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN_appN, List.map_append,
+        bvarRevRange_liftN_ge _ _ _ _ (by omega),
+        VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+        VExpr.bvarRevRange_congr np (show Δ.length +
+          ((idxTel U np ty).length + ty.ctors.length + 1) =
+          (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 from by omega)]
+      rfl
+    · show VExpr.app _ _ = VExpr.app _ _
+      congr 1
+      · rw [VExpr.liftN_appN,
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+        show VExpr.appN (.bvar (liftVar Δ.length
+          ((idxTel U np ty).length + ty.ctors.length + 1)
+          ((idxTel U np ty).length + 1))) _ = _
+        rw [liftVar_le (by omega), show Δ.length +
+          ((idxTel U np ty).length + ty.ctors.length + 1) =
+          (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 from by omega]
+  rw [hcod] at hb
+  have hshape := hidx.retarget (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+          ty.ctors.length + 1) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _ (by rw [hlen]; omega),
+    show (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 - idxs.length =
+      Δ.length + ty.ctors.length + 1 from by rw [hlen]; omega,
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hfull := hshape.snoc ha
+  simp only [VExpr.inst] at hfull
+  change env.SpineWF (U+1) _
+    (VExpr.forallN
+      (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0)
+      (VExpr.forallN [VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+            ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length)]
+        (.sort (.param 0))))
+    (idxs ++ [a]) (.sort (.param 0)) at hfull
+  rw [← VExpr.forallN_append] at hfull
+  have hfullLen : (idxs ++ [a]).length =
+      (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0 ++
+        [VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+              ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)]).length := by
+    simp only [List.length_append, List.length_singleton, VExpr.liftTelN_length, hlen]
+  have hactual := hfull.retarget hfullLen
+    (VExpr.app
+      (VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+          ty.ctors.length + 1))
+        (VExpr.bvarRevRange 1 (idxTel U np ty).length))
+      (.bvar 0))
+  rw [VExpr.forallN_append] at hactual
+  have happ := hactual.hasType_appN hb
+  rw [show VExpr.app
+      (VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+          ty.ctors.length + 1))
+        (VExpr.bvarRevRange 1 (idxTel U np ty).length))
+      (.bvar 0) =
+      VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+        ty.ctors.length + 1)) (VExpr.bvarRevRange 0 ((idxTel U np ty).length + 1)) from by
+        rw [VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length + 1 =
+          1 + (idxTel U np ty).length from by omega),
+          ← VExpr.bvarRevRange_append (idxTel U np ty).length 1]
+        simpa [VExpr.bvarRevRange, VExpr.appN] using (VExpr.appN_append
+          (.bvar ((idxTel U np ty).length + Δ.length + ty.ctors.length + 1))
+          (VExpr.bvarRevRange 1 (idxTel U np ty).length) [VExpr.bvar 0]).symm,
+    VExpr.instRev_appN,
+    VExpr.instRev_bvar_ge _ (by
+      simp only [List.length_append, List.length_singleton]
+      rw [hlen]
+      omega),
+    VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length + 1 =
+      (idxs ++ [a]).length from by simp [hlen]),
+    VExpr.map_instRev_bvarRevRange] at happ
+  rw [show (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 -
+      (idxs ++ [a]).length = Δ.length + ty.ctors.length from by
+    simp only [List.length_append, List.length_singleton]
+    rw [hlen]
+    omega] at happ
+  simpa [List.length_append, hlen] using happ
+
+theorem Stage3Env.recAppRec_hasType
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty))
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))))
+    (hlen : idxs.length = (idxTel U np ty).length)
+    (ha : env.HasType (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))) a
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (Δ.length + ty.ctors.length + 1) np ++ idxs))) :
+    env.HasType (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange Δ.length (np + ty.ctors.length + 1)))
+        (idxs ++ [a]))
+      (VExpr.appN (.bvar (Δ.length + ty.ctors.length)) (idxs ++ [a])) := by
+  have hb := S.recBaseRec_hasType hrec Δ
+  rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+    liftTelN_congr _ _ (show ty.ctors.length + 1 + Δ.length =
+      Δ.length + ty.ctors.length + 1 from by omega)] at hb
+  have hcod :
+      (VExpr.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.app (VExpr.appN (.bvar ((idxTel U np ty).length + ty.ctors.length + 1))
+          (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0))).liftN Δ.length
+          (0 + (VExpr.liftTelN (ty.ctors.length + 1) (idxTel U np ty) 0).length) =
+      VExpr.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+            ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length))
+        (.app (VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+            ty.ctors.length + 1))
+          (VExpr.bvarRevRange 1 (idxTel U np ty).length)) (.bvar 0)) := by
+    rw [VExpr.liftTelN_length, Nat.zero_add]
+    show VExpr.forallE _ _ = VExpr.forallE _ _
+    congr 1
+    · rw [VExpr.liftN_appN, List.map_append,
+        bvarRevRange_liftN_ge _ _ _ _ (by omega),
+        VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+        VExpr.bvarRevRange_congr np (show Δ.length +
+          ((idxTel U np ty).length + ty.ctors.length + 1) =
+          (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 from by omega)]
+      rfl
+    · show VExpr.app _ _ = VExpr.app _ _
+      congr 1
+      · rw [VExpr.liftN_appN,
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)]
+        show VExpr.appN (.bvar (liftVar Δ.length
+          ((idxTel U np ty).length + ty.ctors.length + 1)
+          ((idxTel U np ty).length + 1))) _ = _
+        rw [liftVar_le (by omega), show Δ.length +
+          ((idxTel U np ty).length + ty.ctors.length + 1) =
+          (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 from by omega]
+  rw [hcod] at hb
+  have hshape := hidx.retarget (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+          ty.ctors.length + 1) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _ (by rw [hlen]; omega),
+    show (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 - idxs.length =
+      Δ.length + ty.ctors.length + 1 from by rw [hlen]; omega,
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hfull := hshape.snoc ha
+  simp only [VExpr.inst] at hfull
+  change env.SpineWF (U+1) _
+    (VExpr.forallN
+      (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0)
+      (VExpr.forallN [VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+            ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (idxTel U np ty).length)]
+        (.sort (.param 0))))
+    (idxs ++ [a]) (.sort (.param 0)) at hfull
+  rw [← VExpr.forallN_append] at hfull
+  have hfullLen : (idxs ++ [a]).length =
+      (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0 ++
+        [VExpr.appN (.const T (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((idxTel U np ty).length + Δ.length +
+              ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (idxTel U np ty).length)]).length := by
+    simp only [List.length_append, List.length_singleton, VExpr.liftTelN_length, hlen]
+  have hactual := hfull.retarget hfullLen
+    (VExpr.app
+      (VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+          ty.ctors.length + 1))
+        (VExpr.bvarRevRange 1 (idxTel U np ty).length))
+      (.bvar 0))
+  rw [VExpr.forallN_append] at hactual
+  have happ := hactual.hasType_appN hb
+  rw [show VExpr.app
+      (VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+          ty.ctors.length + 1))
+        (VExpr.bvarRevRange 1 (idxTel U np ty).length))
+      (.bvar 0) =
+      VExpr.appN (.bvar ((idxTel U np ty).length + Δ.length +
+        ty.ctors.length + 1)) (VExpr.bvarRevRange 0 ((idxTel U np ty).length + 1)) from by
+        rw [VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length + 1 =
+          1 + (idxTel U np ty).length from by omega),
+          ← VExpr.bvarRevRange_append (idxTel U np ty).length 1]
+        simpa [VExpr.bvarRevRange, VExpr.appN] using (VExpr.appN_append
+          (.bvar ((idxTel U np ty).length + Δ.length + ty.ctors.length + 1))
+          (VExpr.bvarRevRange 1 (idxTel U np ty).length) [VExpr.bvar 0]).symm,
+    VExpr.instRev_appN,
+    VExpr.instRev_bvar_ge _ (by
+      simp only [List.length_append, List.length_singleton]
+      rw [hlen]
+      omega),
+    VExpr.bvarRevRange_congr' 0 (show (idxTel U np ty).length + 1 =
+      (idxs ++ [a]).length from by simp [hlen]),
+    VExpr.map_instRev_bvarRevRange] at happ
+  rw [show (idxTel U np ty).length + Δ.length + ty.ctors.length + 1 -
+      (idxs ++ [a]).length = Δ.length + ty.ctors.length from by
+    simp only [List.length_append, List.length_singleton]
+    rw [hlen]
+    omega] at happ
+  simpa [List.length_append, hlen] using happ
+
+/-- The motive variable applied to a well-typed index spine and major
+premise has the recursor's elimination sort. -/
+theorem Stage3Env.motiveApp_hasType
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))))
+    (hlen : idxs.length = (idxTel U np ty).length)
+    (ha : env.HasType (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))) a
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (Δ.length + ty.ctors.length + 1) np ++ idxs))) :
+    env.HasType (U+1)
+      (Δ ++ ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.bvar (Δ.length + ty.ctors.length)) (idxs ++ [a]))
+      (.sort (.param 0)) := by
+  have hM := getElem?_rstack3 Δ (minorTypes U T np ty ty.ctors).reverse
+    (motiveType U T np ty) (paramsTel U np ty).reverse
+    (i := Δ.length + ty.ctors.length)
+    (by simp only [List.length_reverse, minorTypes_length])
+  have hmlu := Lookup.of_getElem? hM
+  rw [motiveType_liftN] at hmlu
+  have hshape := hidx.retarget (by simpa only [VExpr.liftTelN_length] using hlen)
+    (.forallE (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (Δ.length + ty.ctors.length + 1 +
+          (idxTel U np ty).length) np ++
+        VExpr.bvarRevRange 0 (idxTel U np ty).length))
+      (.sort (.param 0)))
+  rw [VExpr.instRev_forallE_sort, VExpr.instRev_appN,
+    VExpr.instRev_closedN _ (C := .const T (VLevel.params' U 1)) trivial,
+    List.map_append,
+    VExpr.map_instRev_bvarRevRange_ge _ _ _ (by rw [hlen]; omega),
+    show Δ.length + ty.ctors.length + 1 + (idxTel U np ty).length - idxs.length =
+      Δ.length + ty.ctors.length + 1 from by rw [hlen]; omega,
+    VExpr.bvarRevRange_congr' 0 hlen.symm,
+    VExpr.map_instRev_bvarRevRange] at hshape
+  rw [hlen] at hshape
+  have hfull := hshape.snoc ha
+  simp only [VExpr.inst] at hfull
+  exact hfull.hasType_appN (.bvar hmlu)
+
+theorem Stage3Env.motiveAppRec_hasType
+    (Δ : List VExpr) {idxs : List VExpr} {a : VExpr}
+    (hidx : env.SpineWF (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN
+        (VExpr.liftTelN (Δ.length + ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))))
+    (hlen : idxs.length = (idxTel U np ty).length)
+    (ha : env.HasType (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))) a
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange (Δ.length + ty.ctors.length + 1) np ++ idxs))) :
+    env.HasType (U+1)
+      (Δ ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.bvar (Δ.length + ty.ctors.length)) (idxs ++ [a]))
+      (.sort (.param 0)) := by
+  have hM := getElem?_rstack3 Δ (minorTypesRec U T np ty ty.ctors).reverse
+    (motiveType U T np ty) (paramsTel U np ty).reverse
+    (i := Δ.length + ty.ctors.length)
+    (by simp only [List.length_reverse, minorTypesRec_length])
+  exact motiveVarApp_hasType (env := env) (U := U) (T := T) (np := np)
+    (l := l) (ty := ty) (.bvar (Lookup.of_getElem? hM)) hidx hlen ha
+
+/-- The constructor-headed major of an iota rule, in the rule's binder
+context (parameter spine past the motive, minors and fields). -/
+theorem Stage3Env.ctorAppRule_hasType {c : VConstVal} (hc : c ∈ ty.ctors) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)) := by
+  have W := Ctx.LiftN.consTel (n := ty.ctors.length)
+    (VExpr.liftTelN 1 (ctorFieldsR U np c) 0)
+    (Ctx.LiftN.zero (n := ty.ctors.length)
+      (Γ := motiveType U T np ty :: (paramsTel U np ty).reverse)
+      (minorTypes U T np ty ty.ctors).reverse
+      (h := by simp [minorTypes_length]))
+  have h := (S.ctorAppMin_hasType hc []).weakN S.ord W
+  have hlen : (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+      (ctorFieldsR U np c).length := VExpr.liftTelN_length ..
+  rw [hlen] at h
+  simp only [List.length_nil, Nat.zero_add, VExpr.liftN_appN, VExpr.liftN, List.map_append,
+    List.map_map] at h
+  rw [VExpr.liftTelN_liftTelN,
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)] at h
+  simp only [Function.comp_def, VExpr.liftN_zero, Nat.add_zero] at h
+  have hmap : (ctorIdxs U np c).map (fun e =>
+      (e.liftN 1 (ctorFieldsR U np c).length).liftN
+        ty.ctors.length (ctorFieldsR U np c).length) =
+      (ctorIdxs U np c).map (fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) := by
+    apply List.map_congr_left
+    intro e _
+    rw [VExpr.liftN'_liftN_hi]
+    congr 1
+    omega
+  rw [hmap] at h
+  simpa [List.append_assoc, Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using h
+
+theorem Stage3Env.ctorAppRuleRec_hasType {c : VConstVal} (hc : c ∈ ty.ctors) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)) := by
+  have W := Ctx.LiftN.consTel (n := ty.ctors.length)
+    (VExpr.liftTelN 1 (ctorFieldsR U np c) 0)
+    (Ctx.LiftN.zero (n := ty.ctors.length)
+      (Γ := motiveType U T np ty :: (paramsTel U np ty).reverse)
+      (minorTypesRec U T np ty ty.ctors).reverse
+      (h := by simp [minorTypesRec_length]))
+  have h := (S.ctorAppMin_hasType hc []).weakN S.ord W
+  have hlen : (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+      (ctorFieldsR U np c).length := VExpr.liftTelN_length ..
+  rw [hlen] at h
+  simp only [List.length_nil, Nat.zero_add, VExpr.liftN_appN, VExpr.liftN, List.map_append,
+    List.map_map] at h
+  rw [VExpr.liftTelN_liftTelN,
+    bvarRevRange_liftN_ge _ _ _ _ (by omega),
+    VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega)] at h
+  simp only [Function.comp_def, VExpr.liftN_zero, Nat.add_zero] at h
+  have hmap : (ctorIdxs U np c).map (fun e =>
+      (e.liftN 1 (ctorFieldsR U np c).length).liftN
+        ty.ctors.length (ctorFieldsR U np c).length) =
+      (ctorIdxs U np c).map (fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) := by
+    apply List.map_congr_left
+    intro e _
+    rw [VExpr.liftN'_liftN_hi]
+    congr 1
+    omega
+  rw [hmap] at h
+  simpa [List.append_assoc, Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using h
+
+theorem Stage3Env.ruleBinders_onTel {c : VConstVal} (hc : c ∈ ty.ctors) :
+    OnTel env (U+1) []
+      (paramsTel U np ty ++ motiveType U T np ty :: minorTypes U T np ty ty.ctors ++
+        VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) := by
+  have hP : OnTel env (U+1) [] (paramsTel U np ty) := by
+    have := S.hparams.of_append.1.instL (U' := U+1) VLevel.params'_one_wf
+    simpa [paramsTel] using this
+  have hF : OnTel env (U+1)
+      ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) := by
+    have h0 := S.fieldsWF_onTel _ [] 0 rfl (by simpa using S.hfields c hc)
+    have h1 := h0.weakN S.ord
+      (.zero ((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty]))
+    rw [liftTelN_congr _ _ (show ((minorTypes U T np ty ty.ctors).reverse ++
+        [motiveType U T np ty]).length = ty.ctors.length + 1 from by
+      simp only [List.length_append, List.length_reverse, minorTypes_length,
+        List.length_singleton])] at h1
+    simpa [ctorFieldsR, List.map_reverse, paramsTel,
+      List.append_assoc] using h1
+  refine OnTel.append (OnTel.append hP ⟨?_, ?_⟩) ?_
+  · simpa only [List.append_nil] using S.motive_isType
+  · have := S.minorTypes_onTel ty.ctors (fun _ h => h) [] 0 rfl
+    simpa only [List.nil_append, List.append_nil] using this
+  · simpa only [List.append_nil, List.append_assoc, List.reverse_append,
+      List.reverse_cons, List.singleton_append] using hF
+
+theorem Stage3Env.ruleBindersRec_onTel {c : VConstVal} (hc : c ∈ ty.ctors) :
+    OnTel env (U+1) []
+      (paramsTel U np ty ++ motiveType U T np ty :: minorTypesRec U T np ty ty.ctors ++
+        VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) := by
+  have hP : OnTel env (U+1) [] (paramsTel U np ty) := by
+    have := S.hparams.of_append.1.instL (U' := U+1) VLevel.params'_one_wf
+    simpa [paramsTel] using this
+  have hF : OnTel env (U+1)
+      ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse))
+      (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) := by
+    have h0 := S.fieldsWF_onTel _ [] 0 rfl (by simpa using S.hfields c hc)
+    have h1 := h0.weakN S.ord
+      (.zero ((minorTypesRec U T np ty ty.ctors).reverse ++ [motiveType U T np ty]))
+    rw [liftTelN_congr _ _ (show ((minorTypesRec U T np ty ty.ctors).reverse ++
+        [motiveType U T np ty]).length = ty.ctors.length + 1 from by
+      simp only [List.length_append, List.length_reverse, minorTypesRec_length,
+        List.length_singleton])] at h1
+    simpa [ctorFieldsR, List.map_reverse, paramsTel,
+      List.append_assoc] using h1
+  refine OnTel.append (OnTel.append hP ⟨?_, ?_⟩) ?_
+  · simpa only [List.append_nil] using S.motive_isType
+  · have := S.minorTypesRec_onTel ty.ctors (fun _ h => h) [] 0 rfl
+    simpa only [List.nil_append, List.append_nil] using this
+  · simpa only [List.append_nil, List.append_assoc, List.reverse_append,
+      List.reverse_cons, List.singleton_append] using hF
+
+theorem Stage3Env.ruleType_isType {i : Nat} {c : VConstVal}
+    (hci : ty.ctors[i]? = some c) :
+    env.IsType (U+1) [] ((rule U T np ty i c).type) := by
+  have hc := List.mem_of_getElem? hci
+  show env.IsType (U+1) [] (VExpr.forallN
+    (paramsTel U np ty ++ motiveType U T np ty :: minorTypes U T np ty ty.ctors ++
+      VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0)
+    (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+      (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+        [VExpr.appN (.const c.name (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])))
+  refine IsType.forallN (S.ruleBinders_onTel hc) ?_
+  simp only [List.reverse_append, List.reverse_cons, List.append_nil, List.append_assoc,
+    List.singleton_append]
+  have hSp0 := S.result_transport hc
+    ((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+    (g := ty.ctors.length + 1) (by simp [minorTypes_length]) [] (d := 0) rfl
+  have hSp : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((ctorFieldsR U np c).length + ty.ctors.length + 1)
+        (idxTel U np ty) 0) (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa [List.append_assoc, Nat.add_assoc] using hSp0
+  have hidxLen : ((ctorIdxs U np c).map fun e =>
+      e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length).length =
+      (idxTel U np ty).length := by
+    simp only [List.length_map, ctorIdxs_length, idxTel_length]
+    exact (stage3Ctor_eq (S.hs3 c hc)).2.1
+  have hctor := S.ctorAppRule_hasType hc
+  have hSp' : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse.length +
+          ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using hSp
+  have hctor' : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange
+          ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse.length +
+            ty.ctors.length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using hctor
+  refine ⟨.param 0, ?_⟩
+  have hm := S.motiveApp_hasType
+    (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse
+    hSp' hidxLen hctor'
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show (ctorFieldsR U np c).length + ty.ctors.length =
+      ty.ctors.length + (ctorFieldsR U np c).length from by omega,
+    show ty.ctors.length + (ctorFieldsR U np c).length + 1 =
+      (ctorFieldsR U np c).length + ty.ctors.length + 1 from by omega] at hm
+  exact hm
+
+theorem Stage3Env.ruleTypeRec_isType {i : Nat} {c : VConstVal}
+    (hci : ty.ctors[i]? = some c) :
+    env.IsType (U+1) [] ((ruleRec U T np ty i c).type) := by
+  have hc := List.mem_of_getElem? hci
+  show env.IsType (U+1) [] (VExpr.forallN
+    (paramsTel U np ty ++ motiveType U T np ty :: minorTypesRec U T np ty ty.ctors ++
+      VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0)
+    (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+      (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+        [VExpr.appN (.const c.name (VLevel.params' U 1))
+          (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+            VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])))
+  refine IsType.forallN (S.ruleBindersRec_onTel hc) ?_
+  simp only [List.reverse_append, List.reverse_cons, List.append_nil, List.append_assoc,
+    List.singleton_append]
+  have hSp0 := S.result_transport hc
+    ((minorTypesRec U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+    (g := ty.ctors.length + 1) (by simp [minorTypesRec_length]) [] (d := 0) rfl
+  have hSp : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((ctorFieldsR U np c).length + ty.ctors.length + 1)
+        (idxTel U np ty) 0) (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa [List.append_assoc, Nat.add_assoc] using hSp0
+  have hidxLen : ((ctorIdxs U np c).map fun e =>
+      e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length).length =
+      (idxTel U np ty).length := by
+    simp only [List.length_map, ctorIdxs_length, idxTel_length]
+    exact (stage3Ctor_eq (S.hs3 c hc)).2.1
+  have hctor := S.ctorAppRuleRec_hasType hc
+  have hSp' : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse.length +
+          ty.ctors.length + 1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using hSp
+  have hctor' : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange
+          ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse.length +
+            ty.ctors.length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using hctor
+  refine ⟨.param 0, ?_⟩
+  have hm := S.motiveAppRec_hasType
+    (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse
+    hSp' hidxLen hctor'
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show (ctorFieldsR U np c).length + ty.ctors.length =
+      ty.ctors.length + (ctorFieldsR U np c).length from by omega,
+    show ty.ctors.length + (ctorFieldsR U np c).length + 1 =
+      (ctorFieldsR U np c).length + ty.ctors.length + 1 from by omega] at hm
+  exact hm
+
+/-- A recursive field gives a well-typed recursive call in the full iota
+rule context, carrying that field's own index arguments. -/
+theorem Stage3Env.recCallRule_hasType {c : VConstVal} (hc : c ∈ ty.ctors)
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty))
+    {q : Nat × List VExpr}
+    (hq : q ∈ recPairsR U T np (idxTel U np ty).length c) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange (ctorFieldsR U np c).length
+            (np + ty.ctors.length + 1)))
+        ((q.2.map fun e =>
+          (e.liftN (ty.ctors.length + 1) q.1).liftN
+            ((ctorFieldsR U np c).length - q.1)) ++
+          [.bvar ((ctorFieldsR U np c).length - 1 - q.1)]))
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        ((q.2.map fun e =>
+          (e.liftN (ty.ctors.length + 1) q.1).liftN
+            ((ctorFieldsR U np c).length - q.1)) ++
+          [.bvar ((ctorFieldsR U np c).length - 1 - q.1)])) := by
+  obtain ⟨B, hBj, hrecB0, hidx⟩ := recPairsR_mem hq
+  have hrecB : isRecField U T np
+      (ctorFields (VExpr.dropN np ty.type)).length q.1 B = true := by
+    rwa [← idxTel_length (U := U) (ty := ty)]
+  have hjm : q.1 < (ctorFieldsR U np c).length := by
+    simpa [ctorFieldsR_length] using recPairsR_lt _ hq
+  have hml2 : (VExpr.liftTelN (ty.ctors.length + 1)
+      (ctorFieldsR U np c) 0).length = (ctorFieldsR U np c).length :=
+    VExpr.liftTelN_length ..
+  have hSp0 := S.spine_transport hc hBj hrecB
+    ((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+    (g := ty.ctors.length + 1) (by simp [minorTypes_length])
+    ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).drop q.1).reverse
+    (d := (ctorFieldsR U np c).length - q.1) (by
+      simp only [List.length_reverse, List.length_drop, hml2])
+  rw [show
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).drop q.1).reverse ++
+          ((VExpr.liftTelN (ty.ctors.length + 1)
+            ((ctorFieldsR U np c).take q.1) 0).reverse ++
+            (((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty]) ++
+              (paramsTel U np ty).reverse)) =
+        (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+          ((minorTypes U T np ty ty.ctors).reverse ++
+            (motiveType U T np ty :: (paramsTel U np ty).reverse)) from by
+      rw [← VExpr.liftTelN_take, List.append_assoc,
+        ← List.append_assoc
+          (((VExpr.liftTelN (ty.ctors.length + 1)
+            (ctorFieldsR U np c) 0).drop q.1).reverse),
+        ← List.reverse_append, List.take_append_drop, List.singleton_append,
+        ← List.append_assoc],
+    liftTelN_congr _ _ (show q.1 + (ty.ctors.length + 1) +
+        ((ctorFieldsR U np c).length - q.1) =
+      (ctorFieldsR U np c).length + ty.ctors.length + 1 from by omega),
+    ← hidx] at hSp0
+  have hni : q.2.length = (idxTel U np ty).length := by
+    rw [hidx, List.length_map, idxTel_length]
+    exact (isRecField_eq hrecB).2.1
+  have hSp : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).reverse.length + ty.ctors.length + 1)
+        (idxTel U np ty) 0) (.sort (l.inst (VLevel.params' U 1))))
+      (q.2.map fun e => (e.liftN (ty.ctors.length + 1) q.1).liftN
+        ((ctorFieldsR U np c).length - q.1))
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using hSp0
+  have hSpLen : (q.2.map fun e =>
+      (e.liftN (ty.ctors.length + 1) q.1).liftN
+        ((ctorFieldsR U np c).length - q.1)).length =
+      (idxTel U np ty).length := by simpa using hni
+  have hF : ((VExpr.liftTelN (ty.ctors.length + 1)
+      (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))[
+      (ctorFieldsR U np c).length - 1 - q.1]? =
+      some ((B.instL (VLevel.params' U 1)).liftN
+        (ty.ctors.length + 1) q.1) := by
+    rw [List.getElem?_append_left
+        (by simp only [List.length_reverse, VExpr.liftTelN_length]; omega),
+      List.getElem?_reverse (by simp only [VExpr.liftTelN_length]; omega),
+      VExpr.liftTelN_length,
+      show (ctorFieldsR U np c).length - 1 -
+        ((ctorFieldsR U np c).length - 1 - q.1) = q.1 from by omega,
+      VExpr.liftTelN_getElem?, ctorFieldsR_getElem?, hBj]
+    simp only [Option.map_some, Nat.zero_add]
+  have hflu := Lookup.of_getElem? hF
+  rw [show (((B.instL (VLevel.params' U 1)).liftN
+      (ty.ctors.length + 1) q.1).liftN
+        ((ctorFieldsR U np c).length - 1 - q.1 + 1)) =
+      VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          q.2.map fun e => (e.liftN (ty.ctors.length + 1) q.1).liftN
+            ((ctorFieldsR U np c).length - q.1)) from by
+    conv => lhs; rw [(isRecField_eq hrecB).1]
+    rw [VExpr.instL_appN, List.map_append, bvarRevRange_instL,
+      show (VExpr.const T (VLevel.params U)).instL (VLevel.params' U 1) =
+        .const T (VLevel.params' U 1) from by
+        simp [VExpr.instL, VLevel.params_map_inst_params'],
+      VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+      bvarRevRange_liftN_ge _ _ _ _ (by omega),
+      bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+      VExpr.bvarRevRange_congr np (show
+        (ctorFieldsR U np c).length - 1 - q.1 + 1 +
+          (ty.ctors.length + 1 + q.1) =
+        (ctorFieldsR U np c).length + ty.ctors.length + 1 from by omega),
+      ← hidx, List.map_map]
+    apply congrArg (VExpr.appN (.const T (VLevel.params' U 1)))
+    apply congrArg (VExpr.bvarRevRange
+      ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++ ·)
+    apply List.map_congr_left
+    intro e _
+    rw [show (ctorFieldsR U np c).length - 1 - q.1 + 1 =
+      (ctorFieldsR U np c).length - q.1 from by omega]
+    simp only [Function.comp_apply]
+    ] at hflu
+  have ha : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (.bvar ((ctorFieldsR U np c).length - 1 - q.1))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange
+          ((VExpr.liftTelN (ty.ctors.length + 1)
+            (ctorFieldsR U np c) 0).reverse.length + ty.ctors.length + 1) np ++
+          q.2.map fun e => (e.liftN (ty.ctors.length + 1) q.1).liftN
+            ((ctorFieldsR U np c).length - q.1))) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using
+      (VEnv.HasType.bvar (env := env) (U := U+1) hflu)
+  have hr := S.recApp_hasType hrec
+    (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse
+    hSp hSpLen ha
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show (ctorFieldsR U np c).length + ty.ctors.length =
+      ty.ctors.length + (ctorFieldsR U np c).length from by omega] at hr
+  exact hr
+
+/-- A generalized recursive argument yields the direct or lambda-valued
+recursive call required by its functional IH in the complete rule context. -/
+theorem Stage3Env.ruleCallRec_hasType {c : VConstVal} (hc : c ∈ ty.ctors)
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty))
+    {r : RecArg} (hr : r ∈ recArgsR U T np (idxTel U np ty).length c) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (r.ruleCall (ctorFieldsR U np c).length ty.ctors.length
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange (ctorFieldsR U np c).length
+            (np + ty.ctors.length + 1))))
+      (r.ruleIH (ctorFieldsR U np c).length ty.ctors.length) := by
+  obtain ⟨r₀, B, rfl, hB, hr₀⟩ := recArgsR_mem hr
+  let r := r₀.instL (VLevel.params' U 1)
+  let m := (ctorFieldsR U np c).length
+  let k := ty.ctors.length
+  let j := r₀.fieldIndex
+  let Fs := VExpr.liftTelN (k+1) (ctorFieldsR U np c) 0
+  let As := r.ruleBinders m k
+  let idxs := r.indices.map fun e =>
+    (e.liftN (k+1) (r.fieldIndex+r.binders.length)).liftN
+      (m-r.fieldIndex) r.binders.length
+  let Γ := Fs.reverse ++ ((minorTypesRec U T np ty ty.ctors).reverse ++
+    (motiveType U T np ty :: (paramsTel U np ty).reverse))
+  have hjm : j < m := by
+    simpa [j, m, RecArg.instL, ctorFieldsR_length] using recArgsR_lt _ hr
+  have hFsLen : Fs.length = m := by
+    simp [Fs, m, VExpr.liftTelN_length]
+  have ht := S.recArg_transport hc hB hr₀
+    ((minorTypesRec U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+    (g := k+1) (by simp [k, minorTypesRec_length])
+    (Fs.drop j).reverse (d := m-j) (by
+      simp only [List.length_reverse, List.length_drop, hFsLen])
+  dsimp only [r, j, RecArg.instL] at ht
+  have hctx :
+      (Fs.drop j).reverse ++
+          ((VExpr.liftTelN (k+1) ((ctorFieldsR U np c).take j) 0).reverse ++
+            (((minorTypesRec U T np ty ty.ctors).reverse ++
+              [motiveType U T np ty]) ++ (paramsTel U np ty).reverse)) = Γ := by
+    dsimp only [Γ, Fs]
+    rw [← VExpr.liftTelN_take, List.append_assoc,
+      ← List.append_assoc
+        (((VExpr.liftTelN (k+1) (ctorFieldsR U np c) 0).drop j).reverse),
+      ← List.reverse_append, List.take_append_drop, List.singleton_append,
+      ← List.append_assoc]
+  have htel : OnTel env (U+1) Γ As := by
+    rw [hctx] at ht
+    simpa [r, As, m, k, j, RecArg.instL, RecArg.ruleBinders] using ht.1
+  have hsp : env.SpineWF (U+1) (As.reverse ++ Γ)
+      (VExpr.forallN
+        (VExpr.liftTelN (m+k+r.binders.length+1) (idxTel U np ty) 0)
+        (.sort (l.inst (VLevel.params' U 1))))
+      idxs (.sort (l.inst (VLevel.params' U 1))) := by
+    rw [hctx] at ht
+    simpa [r, As, idxs, m, k, j, RecArg.instL, RecArg.ruleBinders,
+      List.append_assoc,
+      show j + r₀.binders.length + (k+1) + (m-j) =
+        m+k+r₀.binders.length+1 from by omega] using ht.2
+  have hF : Γ[m-1-j]? =
+      some ((B.instL (VLevel.params' U 1)).liftN (k+1) j) := by
+    dsimp only [Γ, Fs]
+    rw [List.getElem?_append_left
+        (by simp only [List.length_reverse, VExpr.liftTelN_length]; omega),
+      List.getElem?_reverse (by rw [hFsLen]; omega),
+      VExpr.liftTelN_length,
+      show m - 1 - (m - 1 - j) = j from by omega,
+      VExpr.liftTelN_getElem?, ctorFieldsR_getElem?, hB]
+    simp
+  have hlu := Lookup.of_getElem? hF
+  dsimp only [j, r] at hlu
+  rw [show m-1-r₀.fieldIndex+1 = m-r₀.fieldIndex from by omega]
+    at hlu
+  have hfield := recArg_rule_fieldType hr₀ m k (by simpa [j] using hjm)
+  simp only [RecArg.instL, ElimMode.large_sourceLevels] at hfield
+  rw [hfield] at hlu
+  have hf0 := VEnv.HasType.bvar (env := env) (U := U+1) hlu
+  have hf := hf0.weakN S.ord (Ctx.LiftN.zero (Γ := Γ) As.reverse)
+  have hmajor := VEnv.HasType.appN_selfSpine (env := env) (U := U+1)
+    (As := As) (B := VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (m+k+r.binders.length+1) np ++ idxs))
+    (Δ := []) (Γ := Γ) (by
+      simpa [As, r, idxs, j, RecArg.instL, RecArg.ruleBinders,
+        List.length_reverse, List.map_map, Function.comp_def] using hf)
+  simp only [List.length_nil, VExpr.liftN_zero, List.nil_append] at hmajor
+  have hAsLen : As.length = r.binders.length := by
+    simp [As, RecArg.ruleBinders, VExpr.liftTelN_length]
+  change env.HasType (U+1) (As.reverse ++ Γ)
+    ((VExpr.bvar (m-1-r.fieldIndex+As.length)).appN
+      (VExpr.bvarRevRange 0 As.length))
+    (VExpr.appN (.const T (VLevel.params' U 1))
+      (VExpr.bvarRevRange (m+k+r.binders.length+1) np ++ idxs)) at hmajor
+  rw [hAsLen] at hmajor
+  have hlen : idxs.length = (idxTel U np ty).length := by
+    simpa [idxs, r, RecArg.instL] using (recArg?_eq hr₀).2.2.2.1
+  have hcall := S.recAppRec_hasType hrec (As.reverse ++ Fs.reverse)
+    (by simpa [Γ, List.append_assoc, hAsLen, hFsLen, Nat.add_comm,
+      Nat.add_left_comm, Nat.add_assoc] using hsp)
+    hlen
+    (by simpa [Γ, List.append_assoc, hAsLen, hFsLen, Nat.add_comm,
+      Nat.add_left_comm, Nat.add_assoc] using hmajor)
+  have hbaseLift :
+      (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+        (VExpr.bvarRevRange m (np+(k+1)))).liftN r.binders.length =
+      VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+        (VExpr.bvarRevRange (m+r.binders.length) (np+(k+1))) := by
+    rw [VExpr.liftN_appN]
+    simp only [VExpr.liftN]
+    rw [bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _)]
+    apply congrArg (VExpr.appN _)
+    apply VExpr.bvarRevRange_congr
+    omega
+  have hbaseRange :
+      VExpr.appN
+        ((VExpr.const (.str T "rec") (VLevel.params (U+1))).app
+          (VExpr.bvar (np + (k + (m + r.binders.length)))))
+        (VExpr.bvarRevRange (m+r.binders.length) (np+k)) =
+      VExpr.appN
+        (.const (.str T "rec") (VLevel.params (U+1)))
+        (VExpr.bvarRevRange (m+r.binders.length) (np+(k+1))) := by
+    rw [show np + (k + (m + r.binders.length)) =
+        (m+r.binders.length) + (np+k) by omega,
+      show np+(k+1) = (np+k)+1 by omega]
+    rfl
+  have hlam := HasType.lamN htel (by
+    simpa [Γ, Fs, hAsLen, hFsLen, List.append_assoc,
+      VExpr.liftN_appN, bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+      Nat.add_comm, Nat.add_left_comm, Nat.add_assoc] using hcall)
+  rw [hbaseRange] at hlam
+  simpa only [RecArg.ruleCall, RecArg.ruleIH, r, As, idxs, m, k, Γ, Fs,
+    hbaseLift, List.append_assoc, Nat.add_assoc] using hlam
+
+
+/-- The right-hand side of an indexed iota rule: the constructor's minor
+premise applied to its fields and to one indexed recursive call per recursive
+field. -/
+theorem Stage3Env.minorApp_hasType {i : Nat} {c : VConstVal}
+    (hci : ty.ctors[i]? = some c)
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty)) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.bvar (ty.ctors.length - 1 - i + (ctorFieldsR U np c).length))
+        (VExpr.bvarRevRange 0 (ctorFieldsR U np c).length ++
+          List.map (fun q => VExpr.appN
+              (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+                (VExpr.bvarRevRange (ctorFieldsR U np c).length
+                  (np + ty.ctors.length + 1)))
+              ((q.2.map fun e =>
+                (e.liftN (ty.ctors.length + 1) q.1).liftN
+                  ((ctorFieldsR U np c).length - q.1)) ++
+                [.bvar ((ctorFieldsR U np c).length - 1 - q.1)]))
+            (recPairsR U T np (idxTel U np ty).length c)))
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])) := by
+  obtain ⟨hik, -⟩ := List.getElem?_eq_some_iff.1 hci
+  have hc := List.mem_of_getElem? hci
+  let rs := recPairsR U T np (idxTel U np ty).length c
+  have hrs : rs = recPairsR U T np (idxTel U np ty).length c := rfl
+  have hrsLt : ∀ q ∈ rs, q.1 < (ctorFieldsR U np c).length := by
+    intro q hq
+    simpa [hrs, ctorFieldsR_length] using recPairsR_lt _ hq
+  rw [VExpr.appN_append]
+  have hlu0 : ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+      ((minorTypes U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))[
+      ty.ctors.length - 1 - i + (ctorFieldsR U np c).length]? =
+      some (VExpr.liftN i (minorType U T np ty c)) := by
+    rw [getElem?_rstack_mid _ _ _
+        (by simp only [List.length_reverse, VExpr.liftTelN_length]; omega)
+        (by simp only [List.length_reverse, VExpr.liftTelN_length, minorTypes_length]
+            omega),
+      show ty.ctors.length - 1 - i + (ctorFieldsR U np c).length -
+        ((VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).reverse).length =
+        ty.ctors.length - 1 - i from by
+          simp only [List.length_reverse, VExpr.liftTelN_length]
+          omega,
+      List.getElem?_reverse (by simp only [minorTypes_length]; omega),
+      show (minorTypes U T np ty ty.ctors).length - 1 -
+          (ty.ctors.length - 1 - i) = i from by
+        simp only [minorTypes_length]
+        omega,
+      minorTypes_getElem?, hci, Nat.zero_add]
+    rfl
+  have hlu := Lookup.of_getElem? hlu0
+  rw [VExpr.liftN_liftN,
+    show i + (ty.ctors.length - 1 - i + (ctorFieldsR U np c).length + 1) =
+      (ctorFieldsR U np c).length + ty.ctors.length from by omega] at hlu
+  have hminorEq : (minorType U T np ty c).liftN
+      ((ctorFieldsR U np c).length + ty.ctors.length) =
+      (VExpr.forallN
+        (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0)
+        ((VExpr.forallN (ihsFrom (ctorFieldsR U np c).length rs 0)
+          (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+            (((ctorIdxs U np c).map fun e =>
+              (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+              [VExpr.appN (.const c.name (VLevel.params' U 1))
+                (VExpr.bvarRevRange (rs.length +
+                    (ctorFieldsR U np c).length + 1) np ++
+                  VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)]))).liftN
+            ty.ctors.length (ctorFieldsR U np c).length)).liftN
+        (ctorFieldsR U np c).length := by
+    simp only [minorType, rs, ElimMode.large_sourceLevels]
+    conv => lhs; rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+        liftTelN_congr _ _ (show (1:Nat) +
+          ((ctorFieldsR U np c).length + ty.ctors.length) =
+          ty.ctors.length + 1 + (ctorFieldsR U np c).length from by omega),
+        show (0:Nat) + (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+          (ctorFieldsR U np c).length from by simp [VExpr.liftTelN_length]]
+    conv => rhs; rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+        show (0:Nat) + (VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).length = (ctorFieldsR U np c).length from by
+          simp [VExpr.liftTelN_length],
+        VExpr.liftN'_liftN_hi,
+        Nat.add_comm ty.ctors.length (ctorFieldsR U np c).length]
+  have hfields := HasType.appN_selfSpine (env := env) (U := U+1)
+    (As := VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0)
+    (B := (VExpr.forallN (ihsFrom (ctorFieldsR U np c).length rs 0)
+      (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+        (((ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange (rs.length + (ctorFieldsR U np c).length + 1) np ++
+              VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)]))).liftN
+        ty.ctors.length (ctorFieldsR U np c).length)
+    (Δ := [])
+    (Γ := (minorTypes U T np ty ty.ctors).reverse ++
+      (motiveType U T np ty :: (paramsTel U np ty).reverse))
+    (f := .bvar (ty.ctors.length - 1 - i + (ctorFieldsR U np c).length)) (by
+      have hb := VEnv.HasType.bvar (env := env) (U := U+1) hlu
+      rw [hminorEq] at hb
+      simpa [VExpr.liftTelN_length] using hb)
+  simp only [List.length_nil, VExpr.liftTelN_length, VExpr.liftN_zero] at hfields
+  rw [ihsFrom_liftN' (ctorFieldsR U np c).length ty.ctors.length rs
+    hrsLt 0
+    (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+      (((ctorIdxs U np c).map fun e =>
+        (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+        [VExpr.appN (.const c.name (VLevel.params' U 1))
+          (VExpr.bvarRevRange (rs.length + (ctorFieldsR U np c).length + 1) np ++
+            VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)]))
+    (cut := (ctorFieldsR U np c).length) rfl] at hfields
+  have hD :
+      (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+        (((ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange (rs.length + (ctorFieldsR U np c).length + 1) np ++
+              VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)])).liftN
+        ty.ctors.length ((ctorFieldsR U np c).length + 0 + rs.length) =
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])).liftN rs.length := by
+    rw [VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+      List.map_map, List.map_map]
+    show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+    congr 1
+    · show VExpr.bvar (liftVar ty.ctors.length
+          ((ctorFieldsR U np c).length + rs.length)
+          ((ctorFieldsR U np c).length + 0 + rs.length)) =
+        VExpr.bvar (liftVar rs.length
+          (ty.ctors.length + (ctorFieldsR U np c).length) 0)
+      rw [liftVar_le (by omega), liftVar_le (Nat.zero_le _)]
+      congr 1
+      omega
+    · congr 1
+      · apply List.map_congr_left
+        intro e _
+        simp only [Function.comp_apply]
+        rw [show (ctorFieldsR U np c).length + 0 + rs.length =
+          (ctorFieldsR U np c).length + rs.length from by omega,
+          VExpr.liftN_liftN_mid e ty.ctors.length rs.length (Nat.zero_le _)]
+      · congr 1
+        simp only []
+        rw [show (ctorFieldsR U np c).length + 0 + rs.length =
+          (ctorFieldsR U np c).length + rs.length from by omega]
+        rw [VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+          bvarRevRange_liftN_ge _ _ _ _ (by omega),
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+          bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+          bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+          VExpr.bvarRevRange_congr np (show ty.ctors.length +
+            (rs.length + (ctorFieldsR U np c).length + 1) =
+            rs.length + ((ctorFieldsR U np c).length + ty.ctors.length + 1) from by
+              omega),
+          VExpr.bvarRevRange_congr _ (show rs.length = rs.length + 0 from by omega)]
+        rfl
+  rw [hD] at hfields
+  have hres := hasType_appN_ihs (env := env) (U := U+1)
+    (m := (ctorFieldsR U np c).length) (k := ty.ctors.length)
+    (rs := rs)
+    (argOf := fun (j, idxs) =>
+      VExpr.appN
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange (ctorFieldsR U np c).length
+            (np + ty.ctors.length + 1)))
+        ((idxs.map fun e => (e.liftN (ty.ctors.length + 1) j).liftN
+          ((ctorFieldsR U np c).length - j)) ++
+          [.bvar ((ctorFieldsR U np c).length - 1 - j)]))
+    hrsLt (fun q hq => by
+      have hr := S.recCallRule_hasType hc hrec (hrs ▸ hq)
+      have hargs : (q.2.map fun e =>
+          ((e.liftN 1 q.1).liftN ((ctorFieldsR U np c).length - q.1)).liftN
+            ty.ctors.length (ctorFieldsR U np c).length) =
+          q.2.map fun e => (e.liftN (ty.ctors.length + 1) q.1).liftN
+            ((ctorFieldsR U np c).length - q.1) := by
+        apply List.map_congr_left
+        intro e _
+        rw [← VExpr.liftN_liftN_mid e ty.ctors.length
+          ((ctorFieldsR U np c).length - q.1) (Nat.zero_le _),
+          show q.1 + ((ctorFieldsR U np c).length - q.1) =
+            (ctorFieldsR U np c).length from by
+              have := hrsLt q hq
+              omega]
+      rw [hargs]
+      exact hr)
+    hfields
+  simpa only [hrs, List.nil_append] using hres
+
+/-- Generalized iota RHS: apply the selected constructor minor to every field
+and then to the direct or functional recursive call generated for each
+`RecArg`. -/
+theorem Stage3Env.minorAppRec_hasType {i : Nat} {c : VConstVal}
+    (hci : ty.ctors[i]? = some c)
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty)) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.bvar (ty.ctors.length - 1 - i + (ctorFieldsR U np c).length))
+        (VExpr.bvarRevRange 0 (ctorFieldsR U np c).length ++
+          List.map (fun r => r.ruleCall (ctorFieldsR U np c).length ty.ctors.length
+              (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+                (VExpr.bvarRevRange (ctorFieldsR U np c).length
+                  (np + ty.ctors.length + 1))))
+            (recArgsR U T np (idxTel U np ty).length c)))
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])) := by
+  obtain ⟨hik, -⟩ := List.getElem?_eq_some_iff.1 hci
+  have hc := List.mem_of_getElem? hci
+  let rs := recArgsR U T np (idxTel U np ty).length c
+  have hrs : rs = recArgsR U T np (idxTel U np ty).length c := rfl
+  have hrsLt : ∀ r ∈ rs, r.fieldIndex < (ctorFieldsR U np c).length := by
+    intro r hr
+    simpa [hrs, ctorFieldsR_length] using recArgsR_lt _ hr
+  rw [VExpr.appN_append]
+  have hlu0 : ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+      ((minorTypesRec U T np ty ty.ctors).reverse ++
+        (motiveType U T np ty :: (paramsTel U np ty).reverse)))[
+      ty.ctors.length - 1 - i + (ctorFieldsR U np c).length]? =
+      some (VExpr.liftN i (minorTypeRec U T np ty c)) := by
+    rw [getElem?_rstack_mid _ _ _
+        (by simp only [List.length_reverse, VExpr.liftTelN_length]; omega)
+        (by simp only [List.length_reverse, VExpr.liftTelN_length,
+          minorTypesRec_length]; omega),
+      show ty.ctors.length - 1 - i + (ctorFieldsR U np c).length -
+        ((VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).reverse).length =
+        ty.ctors.length - 1 - i from by
+          simp only [List.length_reverse, VExpr.liftTelN_length]
+          omega,
+      List.getElem?_reverse (by simp only [minorTypesRec_length]; omega),
+      show (minorTypesRec U T np ty ty.ctors).length - 1 -
+          (ty.ctors.length - 1 - i) = i from by
+        simp only [minorTypesRec_length]
+        omega,
+      minorTypesRec_getElem?, hci, Nat.zero_add]
+    rfl
+  have hlu := Lookup.of_getElem? hlu0
+  rw [VExpr.liftN_liftN,
+    show i + (ty.ctors.length - 1 - i + (ctorFieldsR U np c).length + 1) =
+      (ctorFieldsR U np c).length + ty.ctors.length from by omega] at hlu
+  have hminorEq : (minorTypeRec U T np ty c).liftN
+      ((ctorFieldsR U np c).length + ty.ctors.length) =
+      (VExpr.forallN
+        (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0)
+        ((VExpr.forallN (ihsFromRecArgs (ctorFieldsR U np c).length rs 0)
+          (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+            (((ctorIdxs U np c).map fun e =>
+              (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+              [VExpr.appN (.const c.name (VLevel.params' U 1))
+                (VExpr.bvarRevRange (rs.length +
+                    (ctorFieldsR U np c).length + 1) np ++
+                  VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)]))).liftN
+            ty.ctors.length (ctorFieldsR U np c).length)).liftN
+        (ctorFieldsR U np c).length := by
+    simp only [minorTypeRec, rs, ElimMode.large_sourceLevels]
+    conv => lhs; rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+        liftTelN_congr _ _ (show (1:Nat) +
+          ((ctorFieldsR U np c).length + ty.ctors.length) =
+          ty.ctors.length + 1 + (ctorFieldsR U np c).length from by omega),
+        show (0:Nat) + (VExpr.liftTelN 1 (ctorFieldsR U np c) 0).length =
+          (ctorFieldsR U np c).length from by simp [VExpr.liftTelN_length]]
+    conv => rhs; rw [VExpr.liftN_forallN, VExpr.liftTelN_liftTelN,
+        show (0:Nat) + (VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).length = (ctorFieldsR U np c).length from by
+          simp [VExpr.liftTelN_length],
+        VExpr.liftN'_liftN_hi,
+        Nat.add_comm ty.ctors.length (ctorFieldsR U np c).length]
+  have hfields := HasType.appN_selfSpine (env := env) (U := U+1)
+    (As := VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0)
+    (B := (VExpr.forallN (ihsFromRecArgs (ctorFieldsR U np c).length rs 0)
+      (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+        (((ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange (rs.length + (ctorFieldsR U np c).length + 1) np ++
+              VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)]))).liftN
+        ty.ctors.length (ctorFieldsR U np c).length)
+    (Δ := [])
+    (Γ := (minorTypesRec U T np ty ty.ctors).reverse ++
+      (motiveType U T np ty :: (paramsTel U np ty).reverse))
+    (f := .bvar (ty.ctors.length - 1 - i + (ctorFieldsR U np c).length)) (by
+      have hb := VEnv.HasType.bvar (env := env) (U := U+1) hlu
+      rw [hminorEq] at hb
+      simpa [VExpr.liftTelN_length] using hb)
+  simp only [List.length_nil, VExpr.liftTelN_length, VExpr.liftN_zero] at hfields
+  rw [ihsFromRecArgs_liftN' (ctorFieldsR U np c).length ty.ctors.length rs
+    hrsLt 0
+    (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+      (((ctorIdxs U np c).map fun e =>
+        (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+        [VExpr.appN (.const c.name (VLevel.params' U 1))
+          (VExpr.bvarRevRange (rs.length + (ctorFieldsR U np c).length + 1) np ++
+            VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)]))
+    (cut := (ctorFieldsR U np c).length) rfl] at hfields
+  have hD :
+      (VExpr.appN (.bvar ((ctorFieldsR U np c).length + rs.length))
+        (((ctorIdxs U np c).map fun e =>
+          (e.liftN 1 (ctorFieldsR U np c).length).liftN rs.length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange (rs.length + (ctorFieldsR U np c).length + 1) np ++
+              VExpr.bvarRevRange rs.length (ctorFieldsR U np c).length)])).liftN
+        ty.ctors.length ((ctorFieldsR U np c).length + 0 + rs.length) =
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])).liftN rs.length := by
+    rw [VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+      List.map_map, List.map_map]
+    show VExpr.appN _ (_ ++ [_]) = VExpr.appN _ (_ ++ [_])
+    congr 1
+    · show VExpr.bvar (liftVar ty.ctors.length
+          ((ctorFieldsR U np c).length + rs.length)
+          ((ctorFieldsR U np c).length + 0 + rs.length)) =
+        VExpr.bvar (liftVar rs.length
+          (ty.ctors.length + (ctorFieldsR U np c).length) 0)
+      rw [liftVar_le (by omega), liftVar_le (Nat.zero_le _)]
+      congr 1
+      omega
+    · congr 1
+      · apply List.map_congr_left
+        intro e _
+        simp only [Function.comp_apply]
+        rw [show (ctorFieldsR U np c).length + 0 + rs.length =
+          (ctorFieldsR U np c).length + rs.length from by omega,
+          VExpr.liftN_liftN_mid e ty.ctors.length rs.length (Nat.zero_le _)]
+      · congr 1
+        simp only []
+        rw [show (ctorFieldsR U np c).length + 0 + rs.length =
+          (ctorFieldsR U np c).length + rs.length from by omega]
+        rw [VExpr.liftN_appN, VExpr.liftN_appN, List.map_append, List.map_append,
+          bvarRevRange_liftN_ge _ _ _ _ (by omega),
+          VExpr.bvarRevRange_liftN_high _ _ _ _ (by omega),
+          bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+          bvarRevRange_liftN_ge _ _ _ _ (Nat.zero_le _),
+          VExpr.bvarRevRange_congr np (show ty.ctors.length +
+            (rs.length + (ctorFieldsR U np c).length + 1) =
+            rs.length + ((ctorFieldsR U np c).length + ty.ctors.length + 1) from by
+              omega),
+          VExpr.bvarRevRange_congr _ (show rs.length = rs.length + 0 from by omega)]
+        rfl
+  rw [hD] at hfields
+  have hres := hasType_appN_ruleIHs (env := env) (U := U+1)
+    (m := (ctorFieldsR U np c).length) (k := ty.ctors.length)
+    (rs := rs)
+    (argOf := fun r => r.ruleCall (ctorFieldsR U np c).length ty.ctors.length
+      (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+        (VExpr.bvarRevRange (ctorFieldsR U np c).length
+          (np + ty.ctors.length + 1))))
+    (fun r hr => S.ruleCallRec_hasType hc hrec (hrs ▸ hr)) hfields
+  simpa only [hrs] using hres
+
+/-- The constructor-headed left side of an indexed iota rule. -/
+theorem Stage3Env.recRuleApp_hasType {c : VConstVal} (hc : c ∈ ty.ctors)
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty)) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange (ctorFieldsR U np c).length
+            (np + ty.ctors.length + 1)))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)]))
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])) := by
+  have hSp0 := S.result_transport hc
+    ((minorTypes U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+    (g := ty.ctors.length + 1) (by simp [minorTypes_length]) [] (d := 0) rfl
+  have hSp : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).reverse.length + ty.ctors.length + 1)
+        (idxTel U np ty) 0) (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa [List.append_assoc, Nat.add_assoc, List.length_reverse,
+      VExpr.liftTelN_length] using hSp0
+  have hidxLen : ((ctorIdxs U np c).map fun e =>
+      e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length).length =
+      (idxTel U np ty).length := by
+    simp only [List.length_map, ctorIdxs_length, idxTel_length]
+    exact (stage3Ctor_eq (S.hs3 c hc)).2.1
+  have ha0 := S.ctorAppRule_hasType hc
+  have ha : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypes U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange
+          ((VExpr.liftTelN (ty.ctors.length + 1)
+            (ctorFieldsR U np c) 0).reverse.length + ty.ctors.length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using ha0
+  have hr := S.recApp_hasType hrec
+    (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse
+    hSp hidxLen ha
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show (ctorFieldsR U np c).length + ty.ctors.length =
+      ty.ctors.length + (ctorFieldsR U np c).length from by omega,
+    show ty.ctors.length + (ctorFieldsR U np c).length + 1 =
+      (ctorFieldsR U np c).length + ty.ctors.length + 1 from by omega] at hr
+  exact hr
+
+/-- The constructor-headed left side of a generalized indexed iota rule. -/
+theorem Stage3Env.recRuleAppRec_hasType {c : VConstVal} (hc : c ∈ ty.ctors)
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty)) :
+    env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN
+        (VExpr.appN (.const (.str T "rec") (VLevel.params (U+1)))
+          (VExpr.bvarRevRange (ctorFieldsR U np c).length
+            (np + ty.ctors.length + 1)))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)]))
+      (VExpr.appN (.bvar (ty.ctors.length + (ctorFieldsR U np c).length))
+        (((ctorIdxs U np c).map fun e =>
+          e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length) ++
+          [VExpr.appN (.const c.name (VLevel.params' U 1))
+            (VExpr.bvarRevRange ((ctorFieldsR U np c).length +
+                ty.ctors.length + 1) np ++
+              VExpr.bvarRevRange 0 (ctorFieldsR U np c).length)])) := by
+  have hSp0 := S.result_transport hc
+    ((minorTypesRec U T np ty ty.ctors).reverse ++ [motiveType U T np ty])
+    (g := ty.ctors.length + 1) (by simp [minorTypesRec_length]) [] (d := 0) rfl
+  have hSp : env.SpineWF (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.forallN (VExpr.liftTelN
+        ((VExpr.liftTelN (ty.ctors.length + 1)
+          (ctorFieldsR U np c) 0).reverse.length + ty.ctors.length + 1)
+        (idxTel U np ty) 0) (.sort (l.inst (VLevel.params' U 1))))
+      ((ctorIdxs U np c).map fun e =>
+        e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)
+      (.sort (l.inst (VLevel.params' U 1))) := by
+    simpa [List.append_assoc, Nat.add_assoc, List.length_reverse,
+      VExpr.liftTelN_length] using hSp0
+  have hidxLen : ((ctorIdxs U np c).map fun e =>
+      e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length).length =
+      (idxTel U np ty).length := by
+    simp only [List.length_map, ctorIdxs_length, idxTel_length]
+    exact (stage3Ctor_eq (S.hs3 c hc)).2.1
+  have ha0 := S.ctorAppRuleRec_hasType hc
+  have ha : env.HasType (U+1)
+      ((VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse ++
+        ((minorTypesRec U T np ty ty.ctors).reverse ++
+          (motiveType U T np ty :: (paramsTel U np ty).reverse)))
+      (VExpr.appN (.const c.name (VLevel.params' U 1))
+        (VExpr.bvarRevRange ((ctorFieldsR U np c).length + ty.ctors.length + 1) np ++
+          VExpr.bvarRevRange 0 (ctorFieldsR U np c).length))
+      (VExpr.appN (.const T (VLevel.params' U 1))
+        (VExpr.bvarRevRange
+          ((VExpr.liftTelN (ty.ctors.length + 1)
+            (ctorFieldsR U np c) 0).reverse.length + ty.ctors.length + 1) np ++
+          (ctorIdxs U np c).map fun e =>
+            e.liftN (ty.ctors.length + 1) (ctorFieldsR U np c).length)) := by
+    simpa only [List.length_reverse, VExpr.liftTelN_length] using ha0
+  have hr := S.recAppRec_hasType hrec
+    (VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0).reverse
+    hSp hidxLen ha
+  rw [List.length_reverse, VExpr.liftTelN_length,
+    show (ctorFieldsR U np c).length + ty.ctors.length =
+      ty.ctors.length + (ctorFieldsR U np c).length from by omega,
+    show ty.ctors.length + (ctorFieldsR U np c).length + 1 =
+      (ctorFieldsR U np c).length + ty.ctors.length + 1 from by omega] at hr
+  exact hr
+
+/-- Well-formedness of the iota rule for the `i`-th constructor. -/
+theorem Stage3Env.rule_WF {i : Nat} {c : VConstVal}
+    (hci : ty.ctors[i]? = some c)
+    (hrec : env.constants (.str T "rec") = some (recConst U T np ty)) :
+    (rule U T np ty i c).WF env := by
+  have hc := List.mem_of_getElem? hci
+  refine ⟨?_, ?_⟩
+  · show env.HasType (U+1) [] (VExpr.lamN
+      (paramsTel U np ty ++ motiveType U T np ty :: minorTypes U T np ty ty.ctors ++
+        VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN (S.ruleBinders_onTel hc) ?_
+    simp only [List.reverse_append, List.reverse_cons, List.append_nil,
+      List.append_assoc, List.singleton_append]
+    exact S.recRuleApp_hasType hc hrec
+  · show env.HasType (U+1) [] (VExpr.lamN
+      (paramsTel U np ty ++ motiveType U T np ty :: minorTypes U T np ty ty.ctors ++
+        VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN (S.ruleBinders_onTel hc) ?_
+    simp only [List.reverse_append, List.reverse_cons, List.append_nil,
+      List.append_assoc, List.singleton_append]
+    exact S.minorApp_hasType hci hrec
+
+/-- Well-formedness of the generalized iota rule for the `i`-th constructor. -/
+theorem Stage3Env.ruleRec_WF {i : Nat} {c : VConstVal}
+    (hci : ty.ctors[i]? = some c)
+    (hrec : env.constants (.str T "rec") = some (recConstRec U T np ty)) :
+    (ruleRec U T np ty i c).WF env := by
+  have hc := List.mem_of_getElem? hci
+  refine ⟨?_, ?_⟩
+  · show env.HasType (U+1) [] (VExpr.lamN
+      (paramsTel U np ty ++ motiveType U T np ty :: minorTypesRec U T np ty ty.ctors ++
+        VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN (S.ruleBindersRec_onTel hc) ?_
+    simp only [List.reverse_append, List.reverse_cons, List.append_nil,
+      List.append_assoc, List.singleton_append]
+    exact S.recRuleAppRec_hasType hc hrec
+  · show env.HasType (U+1) [] (VExpr.lamN
+      (paramsTel U np ty ++ motiveType U T np ty :: minorTypesRec U T np ty ty.ctors ++
+        VExpr.liftTelN (ty.ctors.length + 1) (ctorFieldsR U np c) 0) _)
+      (VExpr.forallN _ _)
+    refine HasType.lamN (S.ruleBindersRec_onTel hc) ?_
+    simp only [List.reverse_append, List.reverse_cons, List.append_nil,
+      List.append_assoc, List.singleton_append]
+    exact S.minorAppRec_hasType hci hrec
+
+/-- `ctorType_eq` from the per-constructor facts directly (for use before
+the constructor is in the environment). -/
+theorem Stage3Env.ctorType_eq' {c : VConstVal}
+    (htelc : VExpr.telN np c.type = VExpr.telN np ty.type)
+    (hs3c : stage3Ctor U T np
+      (ctorFields (VExpr.dropN np ty.type)).length 0 (VExpr.dropN np c.type)) :
+    c.type = VExpr.forallN (VExpr.telN np ty.type)
+      (VExpr.forallN (ctorFields (VExpr.dropN np c.type))
+        (VExpr.appN (.const T (VLevel.params U))
+          (VExpr.bvarRevRange (0 + (ctorFields (VExpr.dropN np c.type)).length) np ++
+            recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))))) := by
+  conv => lhs; rw [← VExpr.forallN_telN_dropN np c.type, htelc,
+    (stage3Ctor_eq hs3c).1]
+
+/-- `ctorType_isType` from the per-constructor facts directly. -/
+theorem Stage3Env.ctorType_isType' {c : VConstVal}
+    (htelc : VExpr.telN np c.type = VExpr.telN np ty.type)
+    (hs3c : stage3Ctor U T np
+      (ctorFields (VExpr.dropN np ty.type)).length 0 (VExpr.dropN np c.type))
+    (hfc : fieldsWF U T np env l (ctorFields (VExpr.dropN np ty.type))
+      (VExpr.telN np ty.type).reverse 0 (ctorFields (VExpr.dropN np c.type)))
+    (hresultc : env.SpineWF U
+      ((ctorFields (VExpr.dropN np c.type)).reverse ++
+        (VExpr.telN np ty.type).reverse)
+      (VExpr.forallN (VExpr.liftTelN
+        (ctorFields (VExpr.dropN np c.type)).length
+        (ctorFields (VExpr.dropN np ty.type)) 0) (.sort l))
+      (recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))) (.sort l)) :
+    env.IsType U [] c.type := by
+  rw [S.ctorType_eq' htelc hs3c]
+  refine IsType.forallN S.hparams.of_append.1 ?_
+  simp only [List.append_nil]
+  refine IsType.forallN
+    (S.fieldsWF_onTel_decl _ [] 0 rfl (by simpa using hfc)) ?_
+  have hTapp := S.recAppPi_hasType_decl
+    ((ctorFields (VExpr.dropN np c.type)).reverse)
+  rw [List.length_reverse, VExpr.liftN_forallN] at hTapp
+  have hres := hresultc.hasType_appN hTapp
+  exact ⟨_, by
+    rw [VExpr.appN_append, Nat.zero_add]
+    exact hres⟩
+
+omit S in
+/-- In the identity path, each paired constructor receives the granular
+raw/view certificate required immediately after the family insertion. -/
+theorem Checked.WF.identityCtorWF
+    {source : VInductDecl} {checked : source.Checked}
+    {pre envT : VEnv} (hpre : pre.Ordered)
+    (h : checked.WF pre)
+    (hadd : pre.addConst checked.type.name
+      checked.type.toVConstant = some envT)
+    {ctor : NormalizedCtor}
+    (hctor : ctor ∈
+      checked.identityGeneration.block.ctorPairs) :
+    ctor.WF checked.identityGeneration.block envT := by
+  obtain ⟨c, hc, rfl⟩ :=
+    checked.identityGeneration_ctor hctor
+  let S := h.toDirectFamilyEnv hpre hadd
+  have hcAn := checked.direct_anatomy.2.2.2.2.2 c hc
+  have hfields : fieldsWF source.uvars checked.type.name
+      source.nparams envT checked.resultLevel
+      (ctorFields (VExpr.dropN source.nparams checked.type.type))
+      (VExpr.telN source.nparams checked.type.type).reverse 0
+      (ctorFields (VExpr.dropN source.nparams c.type)) := by
+    simpa [checked.params_eq, checked.indices_eq] using
+      fieldsWF_mono (addConst_le hadd) (h.2 c hc).1
+  have hfieldTel : OnTel envT source.uvars
+      (VExpr.telN source.nparams checked.type.type).reverse
+      (ctorFields (VExpr.dropN source.nparams c.type)) :=
+    S.fieldsWF_onTel_decl _ [] 0 rfl hfields
+  have hbinders : OnTel envT source.uvars []
+      (VExpr.telN source.nparams checked.type.type ++
+        ctorFields (VExpr.dropN source.nparams c.type)) :=
+    S.hparams.of_append.1.append (by simpa using hfieldTel)
+  have htelRefl := hbinders.telDefEq_refl
+  have hresultSpine : envT.SpineWF source.uvars
+      ((ctorFields
+          (VExpr.dropN source.nparams c.type)).reverse ++
+        (VExpr.telN source.nparams checked.type.type).reverse)
+      (VExpr.forallN
+        (VExpr.liftTelN
+          (ctorFields
+            (VExpr.dropN source.nparams c.type)).length
+          (ctorFields
+            (VExpr.dropN source.nparams checked.type.type)) 0)
+        (.sort checked.resultLevel))
+      (recFieldIdxs source.nparams
+        (VExpr.resultOf
+          (VExpr.dropN source.nparams c.type)))
+      (.sort checked.resultLevel) := by
+    simpa [checked.params_eq, checked.indices_eq] using
+      (h.2 c hc).2.mono (addConst_le hadd)
+  have hresultTyped :=
+    S.ctorResult_hasType_decl hresultSpine
+  have hrawResult :
+      VExpr.resultOf (VExpr.dropN source.nparams c.type) =
+        VExpr.appN
+          (.const checked.type.name
+            (VLevel.params source.uvars))
+          (VExpr.bvarRevRange
+            (ctorFields
+              (VExpr.dropN source.nparams c.type)).length
+            source.nparams ++
+            recFieldIdxs source.nparams
+              (VExpr.resultOf
+                (VExpr.dropN source.nparams c.type))) := by
+    have hout := congrArg VExpr.resultOf
+      (stage3Ctor_eq hcAn.2.2).1
+    rw [VExpr.resultOf_forallN,
+      VExpr.resultOf_appN_const] at hout
+    simpa only [Nat.zero_add] using hout
+  have hresultDF : envT.IsDefEq source.uvars
+      ((ctorFields
+          (VExpr.dropN source.nparams c.type)).reverse ++
+        (VExpr.telN source.nparams checked.type.type).reverse)
+      (VExpr.resultOf (VExpr.dropN source.nparams c.type))
+      (VExpr.appN
+        (.const checked.type.name
+          (VLevel.params source.uvars))
+        (VExpr.bvarRevRange
+          (ctorFields
+            (VExpr.dropN source.nparams c.type)).length
+          source.nparams ++
+          recFieldIdxs source.nparams
+            (VExpr.resultOf
+              (VExpr.dropN source.nparams c.type))))
+      (.sort checked.resultLevel) := by
+    exact Eq.mpr
+      (congrArg
+        (fun e => envT.IsDefEq source.uvars
+          ((ctorFields
+              (VExpr.dropN source.nparams c.type)).reverse ++
+            (VExpr.telN source.nparams
+              checked.type.type).reverse)
+          e
+          (VExpr.appN
+            (.const checked.type.name
+              (VLevel.params source.uvars))
+            (VExpr.bvarRevRange
+              (ctorFields
+                (VExpr.dropN source.nparams c.type)).length
+              source.nparams ++
+              recFieldIdxs source.nparams
+                (VExpr.resultOf
+                  (VExpr.dropN source.nparams c.type))))
+          (.sort checked.resultLevel))
+        hrawResult)
+      hresultTyped
+  constructor
+  · simpa [NormalizedCtor.declaredBinders,
+      NormalizedCtor.rawFields,
+      NormalizedCtor.viewBinders, CheckedCtor.ofDirect,
+      checked.params_eq, hcAn.2.1] using htelRefl
+  · simpa [NormalizedCtor.declaredBinders,
+      NormalizedCtor.rawFields, NormalizedCtor.rawResult,
+      NormalizedCtor.resultTarget, CheckedCtor.ofDirect,
+      checked.params_eq, hcAn.2.1] using hresultDF
+  · simpa [NormalizedCtor.emittedBinders,
+      NormalizedCtor.rawFields,
+      NormalizedCtor.viewBinders, CheckedCtor.ofDirect,
+      Checked.identityGeneration, Checked.identityBlock,
+      NormalizedChecked.rawParams, checked.params_eq] using htelRefl
+  · simpa [NormalizedCtor.emittedBinders,
+      NormalizedCtor.rawFields, NormalizedCtor.rawResult,
+      NormalizedCtor.resultTarget, CheckedCtor.ofDirect,
+      Checked.identityGeneration, Checked.identityBlock,
+      NormalizedChecked.rawParams, checked.params_eq] using hresultDF
+
+omit S in
+/-- Every semantically checked direct declaration admits the identity mixed
+generation certificate. This is the public bridge from the legacy checker
+contract to the normalized transaction. -/
+theorem Checked.WF.identityGeneration
+    {source : VInductDecl} {checked : source.Checked}
+    {env : VEnv} (h : checked.WF env) (henv : env.Ordered) :
+    checked.identityGeneration.WF env := by
+  have hfamily := h.family_isType
+  have hnorm : checked.identityGeneration.block.normalization.WF env := by
+    refine ⟨checked.type, checked.type, checked.types_eq, ?_, ?_, ?_⟩
+    · simpa only [Checked.identityGeneration, Checked.identityBlock,
+        Normalization.identity] using checked.types_eq
+    · obtain ⟨u, hu⟩ := hfamily
+      exact ⟨.sort u, hu⟩
+    · intro envT hadd
+      have hadd' : env.addConst checked.type.name
+          checked.type.toVConstant = some envT := by
+        simpa only [Checked.identityGeneration,
+          Checked.identityBlock] using hadd
+      have hall : ∀ c ∈ checked.type.ctors,
+          envT.IsDefEqU source.uvars [] c.type c.type := by
+        intro c hc
+        have hpair :
+            (⟨c, CheckedCtor.ofDirect source.uvars
+              checked.type.name source.nparams
+              checked.indices.length c⟩ : NormalizedCtor) ∈
+              checked.identityGeneration.block.ctorPairs := by
+          simpa only [Checked.identityGeneration,
+            Checked.identityBlock, NormalizedChecked.ctorPairs,
+            checked.constructors_eq] using
+              (pairNormalizedCtors_map_self_contains hc :
+                (⟨c, CheckedCtor.ofDirect source.uvars
+                  checked.type.name source.nparams
+                  checked.indices.length c⟩ :
+                  NormalizedCtor) ∈
+                    pairNormalizedCtors checked.type.ctors
+                      (checked.type.ctors.map
+                        (CheckedCtor.ofDirect source.uvars
+                          checked.type.name source.nparams
+                          checked.indices.length)))
+        obtain ⟨u, hu⟩ :=
+          (h.identityCtorWF henv hadd' hpair).rawDeclared_isType
+        exact ⟨.sort u, hu⟩
+      have hrel : List.Forall₂
+          (fun c c' => envT.IsDefEqU source.uvars []
+            c.type c'.type)
+          checked.type.ctors checked.type.ctors := by
+        let R : VConstVal → VConstVal → Prop :=
+          fun c c' => envT.IsDefEqU source.uvars []
+            c.type c'.type
+        let rec diagonal :
+            ∀ cs : List VConstVal,
+              (∀ c ∈ cs, R c c) →
+              List.Forall₂ R cs cs
+          | [], _ => .nil
+          | c :: cs, hs =>
+              .cons (hs c (.head _))
+                (diagonal cs fun c hc => hs c (.tail _ hc))
+        exact diagonal checked.type.ctors hall
+      simpa only [Checked.identityGeneration,
+        Checked.identityBlock, Normalization.identity] using hrel
+  refine {
+    blockWF := ⟨hnorm, h⟩
+    familyTel := ?_
+    familyResult := ?_
+    ctors := ?_
+  }
+  · simpa only [Checked.identityGeneration,
+      Checked.identityBlock, NormalizedChecked.rawParams,
+      NormalizedChecked.rawIndices, checked.params_eq,
+      checked.indices_eq] using h.1.telDefEq_refl
+  · simpa only [Checked.identityGeneration,
+      Checked.identityBlock, NormalizedChecked.rawParams,
+      NormalizedChecked.rawIndices, NormalizedChecked.rawResult,
+      checked.params_eq, checked.indices_eq,
+      checked.result_eq] using
+        (VEnv.IsDefEq.sortDF
+          checked.direct_anatomy.2.2.1
+          checked.direct_anatomy.2.2.1 rfl :
+          env.IsDefEq source.uvars
+            (checked.params ++ checked.indices).reverse
+            (.sort checked.resultLevel)
+            (.sort checked.resultLevel)
+            (.sort (.succ checked.resultLevel)))
+  · intro envT hadd ctor hctor
+    have hadd' : env.addConst checked.type.name
+        checked.type.toVConstant = some envT := by
+      simpa only [Checked.identityGeneration,
+        Checked.identityBlock] using hadd
+    exact h.identityCtorWF henv hadd' hctor
+
+end VInductDecl
+
+/-! ## `addInduct_WF` -/
+
+theorem _root_.List.mem_zipIdx_getElem? {α} : ∀ {l : List α} {n : Nat} {a : α} {i : Nat},
+    (a, i) ∈ l.zipIdx n → n ≤ i ∧ l[i - n]? = some a
+  | b :: l, n, a, i, h => by
+    simp only [List.zipIdx] at h
+    rcases List.mem_cons.1 h with h | h
+    · obtain ⟨rfl, rfl⟩ := Prod.mk.injEq .. ▸ h
+      simp
+    · obtain ⟨h1, h2⟩ := List.mem_zipIdx_getElem? h
+      refine ⟨by omega, ?_⟩
+      rw [show i - n = (i - (n+1)) + 1 from by omega]
+      simpa using h2
+
+namespace VInductDecl
+
+theorem rulesFold_WF : ∀ (dfs : List VDefEq) {env₃ : VEnv},
+    env₃.Ordered → (∀ df ∈ dfs, df.WF env₃) →
+    (dfs.foldl VEnv.addDefEq env₃).Ordered
+  | [], _, ord, _ => ord
+  | df :: dfs, env₃, ord, hdfs => by
+    rw [List.foldl_cons]
+    exact rulesFold_WF dfs (.defeq ord (hdfs df (.head _)))
+      (fun df' hdf' => (hdfs df' (.tail _ hdf')).mono VEnv.addDefEq_le)
+
+/-- Every rule emitted from the paired constructor list is well formed in the
+environment containing the mixed recursor. -/
+theorem GenerationEnv.generatedRules_WF
+    {source : VInductDecl}
+    {gen : GenerationChecked source} {env : VEnv}
+    (S : GenerationEnv gen env)
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor) :
+    ∀ df ∈ gen.generatedRules, df.WF env := by
+  intro df hdf
+  change df ∈
+    gen.block.ctorPairs.zipIdx.map
+      (fun (ctor, i) => gen.rule i ctor) at hdf
+  obtain ⟨⟨ctor, i⟩, hmem, rfl⟩ :=
+    List.mem_map.1 hdf
+  obtain ⟨-, hci⟩ :=
+    List.mem_zipIdx_getElem? hmem
+  rw [Nat.sub_zero] at hci
+  exact S.rule_WF hci hrec
+
+/-- Folding all mixed generated rules preserves environment ordering. -/
+theorem GenerationEnv.generatedRulesFold_ordered
+    {source : VInductDecl}
+    {gen : GenerationChecked source} {env : VEnv}
+    (S : GenerationEnv gen env)
+    (hrec : env.constants
+      (.str gen.block.sourceType.name "rec") =
+        some gen.recursor) :
+    (gen.generatedRules.foldl
+      VEnv.addDefEq env).Ordered :=
+  rulesFold_WF gen.generatedRules S.ord
+    (S.generatedRules_WF hrec)
+
+/-- Every rule emitted from the flattened mutual constructor list is well
+formed in an environment containing every generated family recursor. -/
+theorem BlockGenerationEnv.generatedRules_WF
+    {source : VInductDecl}
+    {gen : BlockGenerationChecked source} {env : VEnv}
+    (S : BlockGenerationEnv gen env)
+    (hrecs : ∀ family ∈ gen.families,
+      env.constants (.str family.raw.name "rec") =
+        some (gen.recursor family)) :
+    ∀ df ∈ gen.generatedRules, df.WF env := by
+  intro df hdf
+  change df ∈
+    gen.flatCtors.zipIdx.map
+      (fun (constructor, i) => gen.rule i constructor) at hdf
+  obtain ⟨⟨constructor, i⟩, hmem, rfl⟩ := List.mem_map.1 hdf
+  obtain ⟨-, hci⟩ := List.mem_zipIdx_getElem? hmem
+  rw [Nat.sub_zero] at hci
+  exact S.rule_WF hci hrecs
+
+/-- Folding every generated mutual rule preserves environment ordering. -/
+theorem BlockGenerationEnv.generatedRulesFold_ordered
+    {source : VInductDecl}
+    {gen : BlockGenerationChecked source} {env : VEnv}
+    (S : BlockGenerationEnv gen env)
+    (hrecs : ∀ family ∈ gen.families,
+      env.constants (.str family.raw.name "rec") =
+        some (gen.recursor family)) :
+    (gen.generatedRules.foldl VEnv.addDefEq env).Ordered :=
+  rulesFold_WF gen.generatedRules S.ord
+    (S.generatedRules_WF hrecs)
+
+/-- Folding definitional equations only grows the environment and registers
+every equation in the input list. -/
+theorem rulesFold_spec : ∀ (dfs : List VDefEq) (env : VEnv),
+    env ≤ dfs.foldl VEnv.addDefEq env ∧
+      ∀ df ∈ dfs, (dfs.foldl VEnv.addDefEq env).defeqs df
+  | [], _ => ⟨.rfl, nofun⟩
+  | df :: dfs, env => by
+    rw [List.foldl_cons]
+    obtain ⟨hle, hmem⟩ := rulesFold_spec dfs (env.addDefEq df)
+    refine ⟨VEnv.addDefEq_le.trans hle, fun df' hdf' => ?_⟩
+    rcases List.mem_cons.1 hdf' with rfl | hdf'
+    · exact hle.defeqs VEnv.addDefEq_self
+    · exact hmem df' hdf'
+
+/-- A successful constructor fold grows the environment, registers every
+constructor, and certifies that every constructor name was fresh in the
+fold's input environment. -/
+theorem ctorFold_spec : ∀ (cs : List VConstVal) {env₀ env₁ : VEnv},
+    List.foldlM (fun env (c : VConstVal) => env.addConst c.name c.toVConstant) env₀ cs =
+      some env₁ →
+    env₀ ≤ env₁ ∧
+      (∀ c ∈ cs, env₁.constants c.name = some c.toVConstant) ∧
+      ∀ c ∈ cs, env₀.constants c.name = none
+  | [], _, _, hfold => by
+    cases hfold
+    exact ⟨.rfl, nofun, nofun⟩
+  | c :: cs, env₀, env₁, hfold => by
+    rw [List.foldlM_cons] at hfold
+    obtain ⟨env₀', hadd, hrest⟩ := Option.bind_eq_some_iff.1 hfold
+    obtain ⟨hle, hlook, hfresh⟩ := ctorFold_spec cs hrest
+    have haddLe := VEnv.addConst_le hadd
+    refine ⟨haddLe.trans hle, ?_, ?_⟩
+    · intro c' hc'
+      rcases List.mem_cons.1 hc' with rfl | hc'
+      · exact hle.constants (VEnv.addConst_self hadd)
+      · exact hlook c' hc'
+    · intro c' hc'
+      rcases List.mem_cons.1 hc' with rfl | hc'
+      · exact VEnv.addConst_fresh hadd
+      · exact haddLe.constants_none (hfresh c' hc')
+
+/-- Sequentially inserting constants that are all well formed in the fold's
+initial environment preserves ordering. Monotonicity transports the remaining
+constant certificates after each insertion. -/
+theorem constFold_ordered : ∀ (cs : List VConstVal) {env₀ env₁ : VEnv},
+    env₀.Ordered →
+    (∀ c ∈ cs, c.toVConstant.WF env₀) →
+    List.foldlM
+      (fun env (c : VConstVal) => env.addConst c.name c.toVConstant)
+      env₀ cs = some env₁ →
+    env₁.Ordered
+  | [], _, _, ord, _, hfold => by
+    cases hfold
+    exact ord
+  | c :: cs, env₀, env₁, ord, hwf, hfold => by
+    rw [List.foldlM_cons] at hfold
+    obtain ⟨env₀', hadd, hrest⟩ := Option.bind_eq_some_iff.1 hfold
+    have hle := VEnv.addConst_le hadd
+    have ord' : env₀'.Ordered :=
+      .const ord (hwf c (.head _)) hadd
+    exact constFold_ordered cs ord'
+      (fun c' hc' => (hwf c' (.tail _ hc')).mono hle) hrest
+
+/-- Adding the constructors of a stage-3 block preserves order and records
+their lookups. -/
+theorem ctorFold_WF {U : Nat} {T : Name} {np : Nat} {l : VLevel} {ty : VInductiveType}
+    (hsort : VExpr.resultOf (VExpr.dropN np ty.type) = .sort l)
+    (hlen : (VExpr.telN np ty.type).length = np) (hl : l.WF U) :
+    ∀ (cs' : List VConstVal) {env₀ env₁ : VEnv},
+    env₀.Ordered → env₀.constants T = some ⟨U, ty.type⟩ →
+    VEnv.OnTel env₀ U []
+      (VExpr.telN np ty.type ++ ctorFields (VExpr.dropN np ty.type)) →
+    (∀ c ∈ cs', c.uvars = U ∧ VExpr.telN np c.type = VExpr.telN np ty.type ∧
+      stage3Ctor U T np (ctorFields (VExpr.dropN np ty.type)).length 0
+        (VExpr.dropN np c.type) ∧
+      fieldsWF U T np env₀ l (ctorFields (VExpr.dropN np ty.type))
+        (VExpr.telN np ty.type).reverse 0 (ctorFields (VExpr.dropN np c.type)) ∧
+      env₀.SpineWF U
+        ((ctorFields (VExpr.dropN np c.type)).reverse ++
+          (VExpr.telN np ty.type).reverse)
+        (VExpr.forallN (VExpr.liftTelN
+          (ctorFields (VExpr.dropN np c.type)).length
+          (ctorFields (VExpr.dropN np ty.type)) 0) (.sort l))
+        (recFieldIdxs np (VExpr.resultOf (VExpr.dropN np c.type))) (.sort l)) →
+    List.foldlM (fun env (c : VConstVal) => env.addConst c.name c.toVConstant) env₀ cs' =
+      some env₁ →
+    env₁.Ordered ∧ env₀ ≤ env₁ ∧
+      ∀ c ∈ cs', env₁.constants c.name = some ⟨U, c.type⟩
+  | [], env₀, env₁, ord, _, _, _, hfold => by
+    cases hfold
+    exact ⟨ord, .rfl, nofun⟩
+  | c :: cs', env₀, env₁, ord, hT, hpar, hcs, hfold => by
+    rw [List.foldlM_cons] at hfold
+    obtain ⟨env₀', hadd, hrest⟩ := Option.bind_eq_some_iff.1 hfold
+    obtain ⟨hcU, htelc, hs3c, hfc, hresultc⟩ := hcs c (.head _)
+    have S₀ : Stage3Env env₀ U T np l ⟨⟨⟨ty.uvars, ty.type⟩, ty.name⟩, []⟩ :=
+      ⟨ord, hl, hsort, hlen, hT, nofun, nofun, nofun, hpar, nofun, nofun⟩
+    have hwfc : c.toVConstant.WF env₀ := by
+      show env₀.IsType c.toVConstant.uvars [] c.toVConstant.type
+      rw [show c.toVConstant.uvars = c.uvars from rfl, hcU]
+      exact S₀.ctorType_isType' htelc hs3c hfc hresultc
+    have ord' : env₀'.Ordered := .const ord hwfc hadd
+    have hle' := VEnv.addConst_le hadd
+    obtain ⟨ord₁, hle₁, hlook⟩ := ctorFold_WF hsort hlen hl cs' ord'
+      (hle'.constants hT) (hpar.mono hle')
+      (fun c' hc' => by
+        obtain ⟨h1, h2, h3, h4, h5⟩ := hcs c' (.tail _ hc')
+        exact ⟨h1, h2, h3, fieldsWF_mono hle' h4, h5.mono hle'⟩)
+      hrest
+    refine ⟨ord₁, hle'.trans hle₁, fun c' hc' => ?_⟩
+    rcases List.mem_cons.1 hc' with rfl | hc'
+    · have hself := VEnv.addConst_self hadd
+      rw [show c'.toVConstant = ⟨U, c'.type⟩ from by rw [← hcU]] at hself
+      exact hle₁.constants hself
+    · exact hlook c' hc'
+
+end VInductDecl
+
+namespace VEnv
+open VInductDecl
+
+/-- Recover the exact intermediate environments from a successful normalized
+generation transaction. The data-bearing trace is wrapped in `Nonempty` so
+proof consumers can eliminate it without adding a choice axiom merely to
+recover bookkeeping states. -/
+theorem addInductGeneration_trace {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (hadd : addInductGeneration env gen = some env') :
+    Nonempty (AddInductGenerationTrace env env' gen) := by
+  unfold addInductGeneration at hadd
+  obtain ⟨typeEnv, addType, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  obtain ⟨ctorEnv, addCtors, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  obtain ⟨recEnv, addRec, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  cases hadd
+  exact ⟨⟨typeEnv, ctorEnv, recEnv, addType, addCtors, addRec, rfl⟩⟩
+
+/-- The normalized core is atomic: failure returns no observable intermediate
+environment, while success exposes one complete trace. -/
+theorem addInductGeneration_atomic {source : VInductDecl}
+    (env : VEnv) (gen : source.GenerationChecked) :
+    addInductGeneration env gen = none ∨
+      ∃ env', addInductGeneration env gen = some env' ∧
+        Nonempty (AddInductGenerationTrace env env' gen) := by
+  cases hadd : addInductGeneration env gen with
+  | none => exact .inl rfl
+  | some env' =>
+    exact .inr ⟨env', rfl, addInductGeneration_trace hadd⟩
+
+/-- A successful normalized generation transaction only grows its input
+environment. -/
+theorem AddInductGenerationTrace.le {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen) : env ≤ env' := by
+  have htype := addConst_le H.addType
+  have hctors := (ctorFold_spec gen.block.sourceType.ctors H.addCtors).1
+  have hrec := addConst_le H.addRec
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact htype.trans (hctors.trans (hrec.trans hrules))
+
+/-- The raw family name was fresh before a successful normalized
+transaction. -/
+theorem AddInductGenerationTrace.family_fresh {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen) :
+    env.constants gen.block.sourceType.name = none :=
+  addConst_fresh H.addType
+
+/-- The final environment contains the exact raw family constant. -/
+theorem AddInductGenerationTrace.family_lookup {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen) :
+    env'.constants gen.block.sourceType.name =
+      some gen.block.sourceType.toVConstant := by
+  have hctors := (ctorFold_spec gen.block.sourceType.ctors H.addCtors).1
+  have hrec := addConst_le H.addRec
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact (hctors.trans (hrec.trans hrules)).constants
+    (addConst_self H.addType)
+
+/-- Every raw constructor name was fresh in the transaction's input
+environment. -/
+theorem AddInductGenerationTrace.ctor_fresh {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    {ctor : VConstVal} (hctor : ctor ∈ gen.block.sourceType.ctors) :
+    env.constants ctor.name = none := by
+  have htype := addConst_le H.addType
+  have hfresh :=
+    (ctorFold_spec gen.block.sourceType.ctors H.addCtors).2.2 ctor hctor
+  exact htype.constants_none hfresh
+
+/-- The final environment contains every exact raw constructor constant. -/
+theorem AddInductGenerationTrace.ctor_lookup {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    {ctor : VConstVal} (hctor : ctor ∈ gen.block.sourceType.ctors) :
+    env'.constants ctor.name = some ctor.toVConstant := by
+  have hlookup :=
+    (ctorFold_spec gen.block.sourceType.ctors H.addCtors).2.1 ctor hctor
+  have hrec := addConst_le H.addRec
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact (hrec.trans hrules).constants hlookup
+
+/-- The generated recursor name was fresh before a successful normalized
+transaction. -/
+theorem AddInductGenerationTrace.rec_fresh {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen) :
+    env.constants (.str gen.block.sourceType.name "rec") = none := by
+  have htype := addConst_le H.addType
+  have hctors := (ctorFold_spec gen.block.sourceType.ctors H.addCtors).1
+  exact (htype.trans hctors).constants_none (addConst_fresh H.addRec)
+
+/-- The final environment contains the exact mixed generated recursor. -/
+theorem AddInductGenerationTrace.rec_lookup {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen) :
+    env'.constants (.str gen.block.sourceType.name "rec") =
+      some gen.recursor := by
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact hrules.constants (addConst_self H.addRec)
+
+/-- The final environment registers every mixed generated iota rule. -/
+theorem AddInductGenerationTrace.rule_mem {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    {df : VDefEq} (hdf : df ∈ gen.generatedRules) :
+    env'.defeqs df := by
+  simpa only [H.addRules] using
+    (rulesFold_spec gen.generatedRules H.recEnv).2 df hdf
+
+/-! ### Block-wide transaction facts -/
+
+/-- Recover every phase boundary from a successful block-wide transaction. -/
+theorem addInductBlockGeneration_trace {source : VInductDecl}
+    {gen : source.BlockGenerationChecked}
+    (hadd : addInductBlockGeneration env gen = some env') :
+    Nonempty (AddInductBlockGenerationTrace env env' gen) := by
+  unfold addInductBlockGeneration at hadd
+  obtain ⟨typeEnv, addTypes, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  obtain ⟨ctorEnv, addCtors, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  obtain ⟨recEnv, addRecs, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  cases hadd
+  exact ⟨⟨typeEnv, ctorEnv, recEnv, addTypes, addCtors, addRecs, rfl⟩⟩
+
+/-- The block-wide transaction is atomic at its public `Option` boundary. -/
+theorem addInductBlockGeneration_atomic {source : VInductDecl}
+    (env : VEnv) (gen : source.BlockGenerationChecked) :
+    addInductBlockGeneration env gen = none ∨
+      ∃ env', addInductBlockGeneration env gen = some env' ∧
+        Nonempty (AddInductBlockGenerationTrace env env' gen) := by
+  cases hadd : addInductBlockGeneration env gen with
+  | none => exact .inl rfl
+  | some env' =>
+    exact .inr ⟨env', rfl, addInductBlockGeneration_trace hadd⟩
+
+/-- Every phase of a successful block transaction only grows the Theory
+environment. -/
+theorem AddInductBlockGenerationTrace.le {source : VInductDecl}
+    {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen) : env ≤ env' := by
+  have htypes :=
+    (ctorFold_spec source.blockTypeConstants H.addTypes).1
+  have hctors :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).1
+  have hrecs := (ctorFold_spec gen.recursors H.addRecs).1
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact htypes.trans (hctors.trans (hrecs.trans hrules))
+
+/-- Every source family name was fresh before a successful block
+transaction. -/
+theorem AddInductBlockGenerationTrace.family_fresh
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {type : VInductiveType} (htype : type ∈ source.types) :
+    env.constants type.name = none := by
+  have hmem : type.toVConstVal ∈ source.blockTypeConstants := by
+    exact List.mem_map.2 ⟨type, htype, rfl⟩
+  simpa [VInductDecl.blockTypeConstants] using
+    (ctorFold_spec source.blockTypeConstants H.addTypes).2.2
+      type.toVConstVal hmem
+
+/-- The final environment contains every exact raw family constant. -/
+theorem AddInductBlockGenerationTrace.family_lookup
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {type : VInductiveType} (htype : type ∈ source.types) :
+    env'.constants type.name = some type.toVConstant := by
+  have hmem : type.toVConstVal ∈ source.blockTypeConstants := by
+    exact List.mem_map.2 ⟨type, htype, rfl⟩
+  have hlookup :=
+    (ctorFold_spec source.blockTypeConstants H.addTypes).2.1
+      type.toVConstVal hmem
+  have hctors :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).1
+  have hrecs := (ctorFold_spec gen.recursors H.addRecs).1
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact (hctors.trans (hrecs.trans hrules)).constants hlookup
+
+/-- Every flattened raw constructor name was fresh in the transaction's
+input environment. -/
+theorem AddInductBlockGenerationTrace.ctor_fresh
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ source.blockConstructorConstants) :
+    env.constants constructor.name = none := by
+  have htypes :=
+    (ctorFold_spec source.blockTypeConstants H.addTypes).1
+  have hfresh :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).2.2
+      constructor hconstructor
+  exact htypes.constants_none hfresh
+
+/-- The final environment contains every exact raw constructor constant. -/
+theorem AddInductBlockGenerationTrace.ctor_lookup
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ source.blockConstructorConstants) :
+    env'.constants constructor.name = some constructor.toVConstant := by
+  have hlookup :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).2.1
+      constructor hconstructor
+  have hrecs := (ctorFold_spec gen.recursors H.addRecs).1
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact (hrecs.trans hrules).constants hlookup
+
+/-- Every generated recursor name was fresh before the block transaction. -/
+theorem AddInductBlockGenerationTrace.rec_fresh
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {recursor : VConstVal} (hrecursor : recursor ∈ gen.recursors) :
+    env.constants recursor.name = none := by
+  have htypes :=
+    (ctorFold_spec source.blockTypeConstants H.addTypes).1
+  have hctors :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).1
+  have hfresh :=
+    (ctorFold_spec gen.recursors H.addRecs).2.2 recursor hrecursor
+  exact (htypes.trans hctors).constants_none hfresh
+
+/-- The final environment contains every generated recursor. -/
+theorem AddInductBlockGenerationTrace.rec_lookup
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {recursor : VConstVal} (hrecursor : recursor ∈ gen.recursors) :
+    env'.constants recursor.name = some recursor.toVConstant := by
+  have hlookup :=
+    (ctorFold_spec gen.recursors H.addRecs).2.1 recursor hrecursor
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec gen.generatedRules H.recEnv).1
+  exact hrules.constants hlookup
+
+/-- The final environment registers every block-generated iota rule. -/
+theorem AddInductBlockGenerationTrace.rule_mem
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {df : VDefEq} (hdf : df ∈ gen.generatedRules) :
+    env'.defeqs df := by
+  simpa only [H.addRules] using
+    (rulesFold_spec gen.generatedRules H.recEnv).2 df hdf
+
+/-- Preserve ordering through the all-families phase. -/
+private theorem addInductBlockGeneration_families_ordered
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    {blockEnv : VEnv}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    (henv : env.Ordered) (hgen : gen.WF env blockEnv) :
+    H.typeEnv.Ordered := by
+  apply constFold_ordered source.blockTypeConstants henv ?_ H.addTypes
+  intro type htype
+  simp only [VInductDecl.blockTypeConstants, List.mem_map] at htype
+  obtain ⟨raw, hraw, rfl⟩ := htype
+  have hraw' : raw ∈ gen.families.map (·.raw) := by
+    rw [gen.families_map_raw]
+    exact hraw
+  obtain ⟨family, hfamily, rfl⟩ := List.mem_map.1 hraw'
+  show env.IsType family.raw.uvars [] family.raw.type
+  rw [gen.family_uvars hfamily]
+  exact hgen.rawFamily_isType hfamily
+
+/-- Preserve ordering through the globally flattened constructor phase. -/
+private theorem addInductBlockGeneration_constructors_ordered
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    {blockEnv : VEnv}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    (hgen : gen.WF env blockEnv) (ordT : H.typeEnv.Ordered) :
+    H.ctorEnv.Ordered := by
+  have hstage : env.stageInductiveTypes source.types = some blockEnv :=
+    hgen.blockWF.1.1
+  rw [← blockTypeConstants_foldlM_eq_stageInductiveTypes env source,
+    H.addTypes] at hstage
+  have htypeEnv : H.typeEnv = blockEnv := Option.some.inj hstage
+  subst blockEnv
+  apply constFold_ordered source.blockConstructorConstants ordT ?_ H.addCtors
+  intro ctor hctor
+  have hctor' : ctor ∈ gen.flatCtors.map (·.ctor.raw) := by
+    rw [gen.flatCtors_map_raw]
+    exact hctor
+  obtain ⟨constructor, hconstructor, rfl⟩ := List.mem_map.1 hctor'
+  show H.typeEnv.IsType constructor.ctor.raw.uvars []
+    constructor.ctor.raw.type
+  rw [gen.flatCtor_uvars hconstructor]
+  exact hgen.rawCtor_isType hconstructor
+
+/-- Assemble the mutual generation invariant once every raw family and every
+globally flattened constructor has been inserted. -/
+private theorem addInductBlockGeneration_constructor_generationEnv
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    {blockEnv : VEnv}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    (hgen : gen.WF env blockEnv) (ordC : H.ctorEnv.Ordered) :
+    BlockGenerationEnv gen H.ctorEnv := by
+  obtain ⟨hleET, hfamilyLookup, -⟩ :=
+    ctorFold_spec source.blockTypeConstants H.addTypes
+  obtain ⟨hleTC, hctorLookup, -⟩ :=
+    ctorFold_spec source.blockConstructorConstants H.addCtors
+  have hstage : env.stageInductiveTypes source.types = some blockEnv :=
+    hgen.blockWF.1.1
+  rw [← blockTypeConstants_foldlM_eq_stageInductiveTypes env source,
+    H.addTypes] at hstage
+  have htypeEnv : H.typeEnv = blockEnv := Option.some.inj hstage
+  rw [htypeEnv] at hleET hfamilyLookup hleTC
+  have hfamilies : ∀ family ∈ gen.families,
+      H.ctorEnv.constants family.raw.name =
+        some family.raw.toVConstant := by
+    intro family hfamily
+    apply hleTC.constants
+    apply hfamilyLookup family.raw.toVConstVal
+    simp only [VInductDecl.blockTypeConstants, List.mem_map]
+    refine ⟨family.raw, ?_, rfl⟩
+    rw [← gen.families_map_raw]
+    exact List.mem_map.2 ⟨family, hfamily, rfl⟩
+  have hctors : ∀ constructor ∈ gen.flatCtors,
+      H.ctorEnv.constants constructor.ctor.raw.name =
+        some constructor.ctor.raw.toVConstant := by
+    intro constructor hconstructor
+    apply hctorLookup constructor.ctor.raw
+    rw [← gen.flatCtors_map_raw]
+    exact List.mem_map.2 ⟨constructor, hconstructor, rfl⟩
+  exact hgen.toBlockGenerationEnv (hleET.trans hleTC) hleTC ordC
+    hfamilies hctors
+
+/-- Preserve ordering while inserting the family-indexed recursor list. -/
+private theorem addInductBlockGeneration_recursors_ordered
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    (S : BlockGenerationEnv gen H.ctorEnv) :
+    H.recEnv.Ordered := by
+  apply constFold_ordered gen.recursors S.ord ?_ H.addRecs
+  intro recursor hrecursor
+  simp only [BlockGenerationChecked.recursors, List.mem_map] at hrecursor
+  obtain ⟨family, hfamily, rfl⟩ := hrecursor
+  exact S.recursor_wf hfamily
+
+/-- The recursor fold stores the exact generated recursor selected by every
+family ordinal. -/
+private theorem addInductBlockGeneration_recursor_lookup
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    {family : NormalizedFamily} (hfamily : family ∈ gen.families) :
+    H.recEnv.constants (.str family.raw.name "rec") =
+      some (gen.recursor family) := by
+  let recursor : VConstVal :=
+    ⟨gen.recursor family, .str family.raw.name "rec"⟩
+  have hrecursor : recursor ∈ gen.recursors :=
+    List.mem_map.2 ⟨family, hfamily, rfl⟩
+  simpa [recursor] using
+    (ctorFold_spec gen.recursors H.addRecs).2.1 recursor hrecursor
+
+/-- Preserve ordering through the block-wide generated-rule fold. -/
+private theorem addInductBlockGeneration_rules_ordered
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    (H : AddInductBlockGenerationTrace env env' gen)
+    (S : BlockGenerationEnv gen H.recEnv) : env'.Ordered := by
+  have hout := S.generatedRulesFold_ordered
+    (fun family hfamily =>
+      addInductBlockGeneration_recursor_lookup H hfamily)
+  simpa only [H.addRules] using hout
+
+/-- The block-wide transaction preserves ordering through all families,
+constructors, family-indexed recursors, and flattened iota rules. -/
+theorem addInductBlockGeneration_WF
+    {source : VInductDecl} {gen : source.BlockGenerationChecked}
+    {blockEnv : VEnv}
+    (henv : env.Ordered) (hgen : gen.WF env blockEnv)
+    (hadd : addInductBlockGeneration env gen = some env') :
+    env'.Ordered := by
+  rcases addInductBlockGeneration_trace hadd with ⟨H⟩
+  have ordT : H.typeEnv.Ordered :=
+    addInductBlockGeneration_families_ordered H henv hgen
+  have ordC : H.ctorEnv.Ordered :=
+    addInductBlockGeneration_constructors_ordered H hgen ordT
+  have S : BlockGenerationEnv gen H.ctorEnv :=
+    addInductBlockGeneration_constructor_generationEnv H hgen ordC
+  have ordR : H.recEnv.Ordered :=
+    addInductBlockGeneration_recursors_ordered H S
+  have hleCR := (ctorFold_spec gen.recursors H.addRecs).1
+  have SR : BlockGenerationEnv gen H.recEnv :=
+    S.mono hleCR ordR
+  exact addInductBlockGeneration_rules_ordered H SR
+
+/-- Preserve ordering across the raw family insertion, the first generated
+component of an inductive transaction. -/
+private theorem addInductGeneration_family_ordered {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    (henv : env.Ordered) (hgen : gen.WF env) : H.typeEnv.Ordered := by
+  have hfamilyWF : gen.block.sourceType.toVConstant.WF env := by
+    show env.IsType gen.block.sourceType.uvars []
+      gen.block.sourceType.type
+    rw [gen.block.sourceType_uvars_eq]
+    exact hgen.rawFamily_isType
+  exact .const henv hfamilyWF H.addType
+
+/-- Preserve ordering across the complete raw constructor fold. The proof is
+uniform in the source list, so the empty-constructor case is the ordinary
+zero-step fold rather than a separate preservation path. -/
+private theorem addInductGeneration_constructors_ordered
+    {source : VInductDecl} {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    (hgen : gen.WF env) (ordT : H.typeEnv.Ordered) :
+    H.ctorEnv.Ordered := by
+  have hctorWF :
+      ∀ c ∈ gen.block.sourceType.ctors,
+        c.toVConstant.WF H.typeEnv := by
+    intro c hc
+    have hc' : c ∈ gen.block.ctorPairs.map (·.raw) := by
+      rw [gen.rawCtors_eq]
+      exact hc
+    obtain ⟨ctor, hctor, rfl⟩ := List.mem_map.1 hc'
+    show H.typeEnv.IsType ctor.raw.uvars [] ctor.raw.type
+    rw [gen.ctor_uvars_eq hctor]
+    exact hgen.rawCtor_isType H.addType hctor
+  exact constFold_ordered gen.block.sourceType.ctors ordT hctorWF
+    H.addCtors
+
+/-- Assemble the mixed-generation invariant after the exact family and
+constructor components have been inserted. -/
+private theorem addInductGeneration_constructor_generationEnv
+    {source : VInductDecl} {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    (hgen : gen.WF env) (ordC : H.ctorEnv.Ordered) :
+    GenerationEnv gen H.ctorEnv := by
+  obtain ⟨hleTC, hctorLookup, -⟩ :=
+    ctorFold_spec gen.block.sourceType.ctors H.addCtors
+  have hlePreT := addConst_le H.addType
+  have hlePreC := hlePreT.trans hleTC
+  have hfamily :
+      H.ctorEnv.constants gen.block.sourceType.name =
+        some gen.block.sourceType.toVConstant :=
+    hleTC.constants (addConst_self H.addType)
+  have hctors :
+      ∀ ctor ∈ gen.block.ctorPairs,
+        H.ctorEnv.constants ctor.raw.name =
+          some ctor.raw.toVConstant := by
+    intro ctor hctor
+    apply hctorLookup ctor.raw
+    rw [← gen.rawCtors_eq]
+    exact List.mem_map.2 ⟨ctor, hctor, rfl⟩
+  exact hgen.toGenerationEnv H.addType hlePreC hleTC ordC hfamily
+    hctors
+
+/-- Preserve ordering across the single generated recursor component. -/
+private theorem addInductGeneration_recursor_ordered
+    {source : VInductDecl} {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    (S : GenerationEnv gen H.ctorEnv) : H.recEnv.Ordered :=
+  .const S.ord S.recursor_wf H.addRec
+
+/-- Preserve ordering across the generated rule fold. Empty families supply
+no rules, so this is again the same zero-step component fold used generally. -/
+private theorem addInductGeneration_rules_ordered
+    {source : VInductDecl} {gen : source.GenerationChecked}
+    (H : AddInductGenerationTrace env env' gen)
+    (S : GenerationEnv gen H.recEnv) : env'.Ordered := by
+  have hout :=
+    S.generatedRulesFold_ordered (addConst_self H.addRec)
+  simpa only [H.addRules] using hout
+
+/-- The normalized transaction preserves environment ordering from the
+semantic raw/view generation certificate. Stored constants are checked in
+their exact raw syntax; the mixed recursor and rules are checked only after
+all raw constants are present. -/
+theorem addInductGeneration_WF {source : VInductDecl}
+    {gen : source.GenerationChecked}
+    (henv : env.Ordered) (hgen : gen.WF env)
+    (hadd : addInductGeneration env gen = some env') :
+    env'.Ordered := by
+  rcases addInductGeneration_trace hadd with ⟨H⟩
+  have ordT : H.typeEnv.Ordered :=
+    addInductGeneration_family_ordered H henv hgen
+  have ordC : H.ctorEnv.Ordered :=
+    addInductGeneration_constructors_ordered H hgen ordT
+  have S : GenerationEnv gen H.ctorEnv :=
+    addInductGeneration_constructor_generationEnv H hgen ordC
+  have ordR : H.recEnv.Ordered :=
+    addInductGeneration_recursor_ordered H S
+  have hleCR := addConst_le H.addRec
+  have SR : GenerationEnv gen H.recEnv :=
+    S.mono hleCR ordR
+  exact addInductGeneration_rules_ordered H SR
+
+/-- Recover the ordinary normalized transaction trace from the
+proof-carrying public entry point.  The conclusion contains only Theory data;
+the producer that established the certificate is deliberately absent. -/
+theorem addInductCertified_trace {source : VInductDecl}
+    {certificate : source.GenerationCertificate env}
+    (hadd : addInductCertified env certificate = some env') :
+    Nonempty
+      (AddInductGenerationTrace env env' certificate.generation) := by
+  apply addInductGeneration_trace
+  simpa only [addInductCertified_eq_addInductGeneration] using hadd
+
+/-- The proof-carrying wrapper has the same atomic success/failure behavior as
+the underlying normalized transaction. -/
+theorem addInductCertified_atomic {source : VInductDecl}
+    (env : VEnv) (certificate : source.GenerationCertificate env) :
+    addInductCertified env certificate = none ∨
+      ∃ env', addInductCertified env certificate = some env' ∧
+        Nonempty
+          (AddInductGenerationTrace env env' certificate.generation) := by
+  simpa only [addInductCertified_eq_addInductGeneration] using
+    addInductGeneration_atomic env certificate.generation
+
+/-- Ordering preservation for the public certified transaction.  Its
+semantic premise is carried by the certificate rather than repeated at every
+call site. -/
+theorem addInductCertified_WF {source : VInductDecl}
+    {certificate : source.GenerationCertificate env}
+    (henv : env.Ordered)
+    (hadd : addInductCertified env certificate = some env') :
+    env'.Ordered := by
+  apply addInductGeneration_WF henv certificate.wf
+  simpa only [addInductCertified_eq_addInductGeneration] using hadd
+
+/-- Recover the exact block-wide transaction phases through the public
+proof-carrying entry point. -/
+theorem addInductBlockCertified_trace {source : VInductDecl}
+    {certificate : source.BlockGenerationCertificate env}
+    (hadd : addInductBlockCertified env certificate = some env') :
+    Nonempty
+      (AddInductBlockGenerationTrace env env'
+        certificate.generation) := by
+  apply addInductBlockGeneration_trace
+  simpa only [addInductBlockCertified_eq_addInductBlockGeneration] using hadd
+
+/-- The public block certificate wrapper has the same atomic behavior as its
+underlying block transaction. -/
+theorem addInductBlockCertified_atomic {source : VInductDecl}
+    (env : VEnv) (certificate : source.BlockGenerationCertificate env) :
+    addInductBlockCertified env certificate = none ∨
+      ∃ env', addInductBlockCertified env certificate = some env' ∧
+        Nonempty
+          (AddInductBlockGenerationTrace env env'
+            certificate.generation) := by
+  simpa only [addInductBlockCertified_eq_addInductBlockGeneration] using
+    addInductBlockGeneration_atomic env certificate.generation
+
+/-- Ordering preservation for the public proof-carrying mutual-block
+transaction. -/
+theorem addInductBlockCertified_WF {source : VInductDecl}
+    {certificate : source.BlockGenerationCertificate env}
+    (henv : env.Ordered)
+    (hadd : addInductBlockCertified env certificate = some env') :
+    env'.Ordered := by
+  apply addInductBlockGeneration_WF henv certificate.wf
+  simpa only [addInductBlockCertified_eq_addInductBlockGeneration] using hadd
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockGeneration_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockGeneration_atomic [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductBlockGenerationTrace.le [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductBlockGenerationTrace.family_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductBlockGenerationTrace.ctor_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductBlockGenerationTrace.rec_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductBlockGenerationTrace.rule_mem [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockGeneration_WF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockCertified_eq_addInductBlockGeneration [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockCertified_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockCertified_atomic [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductBlockCertified_WF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductGeneration_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductGeneration_atomic [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductGenerationTrace.le [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductGenerationTrace.family_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductGenerationTrace.ctor_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductGenerationTrace.rec_lookup [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.AddInductGenerationTrace.rule_mem [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductGeneration_WF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductCertified_eq_addInductGeneration [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductCertified_trace [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductCertified_atomic [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInductCertified_WF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInduct_eq_addInductBlockGeneration [propext, Classical.choice, Quot.sound]
+
+/-- Elimination of a successful `addInduct` transaction into its stable
+consumer-facing postcondition. -/
+theorem addInduct_success (hadd : addInduct env decl = some env') :
+    AddInductSuccess env env' decl := by
+  unfold addInduct at hadd
+  obtain ⟨generation, hgeneration, hgen⟩ :=
+    Option.bind_eq_some_iff.1 hadd
+  rcases addInductBlockGeneration_trace hgen with ⟨H⟩
+  refine {
+    generation := ⟨generation, hgeneration⟩
+    accepted := by simp [stage3, hgeneration]
+    le := H.le
+    type_fresh := ?_
+    type_lookup := ?_
+    ctor_fresh := ?_
+    ctor_lookup := ?_
+    rec_fresh := ?_
+    rec_lookup := ?_
+    rule_mem := ?_
+  }
+  · intro ty hty
+    exact H.family_fresh hty
+  · intro ty hty
+    exact H.family_lookup hty
+  · intro ty hty c hc
+    apply H.ctor_fresh
+    simp only [VInductDecl.blockConstructorConstants, List.mem_flatMap]
+    exact ⟨ty, hty, hc⟩
+  · intro ty hty c hc
+    apply H.ctor_lookup
+    simp only [VInductDecl.blockConstructorConstants, List.mem_flatMap]
+    exact ⟨ty, hty, hc⟩
+  · intro generation' hgeneration' recursor hrecursor
+    have heq : generation = generation' :=
+      Option.some.inj (hgeneration.symm.trans hgeneration')
+    exact H.rec_fresh (by simpa [heq] using hrecursor)
+  · intro generation' hgeneration' recursor hrecursor
+    have heq : generation = generation' :=
+      Option.some.inj (hgeneration.symm.trans hgeneration')
+    exact H.rec_lookup (by simpa [heq] using hrecursor)
+  · intro generation' hgeneration' df hdf
+    have heq : generation = generation' :=
+      Option.some.inj (hgeneration.symm.trans hgeneration')
+    exact H.rule_mem (by simpa [heq] using hdf)
+
+/-- Successful inductive addition is monotone. -/
+theorem addInduct_le (hadd : addInduct env decl = some env') : env ≤ env' :=
+  (addInduct_success hadd).le
+
+/-- Successful environment extension exposes the exact block descriptor that
+drove generation, so consumers never need to re-run acceptance analysis. -/
+theorem addInduct_generation (hadd : addInduct env decl = some env') :
+    ∃ generation, decl.identityBlockGeneration? = some generation :=
+  (addInduct_success hadd).generation
+
+theorem addInduct_type_fresh (hadd : addInduct env decl = some env')
+    (hty : ty ∈ decl.types) : env.constants ty.name = none :=
+  (addInduct_success hadd).type_fresh ty hty
+
+theorem addInduct_type_lookup (hadd : addInduct env decl = some env')
+    (hty : ty ∈ decl.types) : env'.constants ty.name = some ty.toVConstant :=
+  (addInduct_success hadd).type_lookup ty hty
+
+theorem addInduct_ctor_fresh (hadd : addInduct env decl = some env')
+    (hty : ty ∈ decl.types) (hc : c ∈ ty.ctors) : env.constants c.name = none :=
+  (addInduct_success hadd).ctor_fresh ty hty c hc
+
+theorem addInduct_ctor_lookup (hadd : addInduct env decl = some env')
+    (hty : ty ∈ decl.types) (hc : c ∈ ty.ctors) :
+    env'.constants c.name = some c.toVConstant :=
+  (addInduct_success hadd).ctor_lookup ty hty c hc
+
+theorem addInduct_rec_fresh (hadd : addInduct env decl = some env')
+    {generation : decl.BlockGenerationChecked}
+    (hgeneration : decl.identityBlockGeneration? = some generation)
+    {recursor : VConstVal} (hrecursor : recursor ∈ generation.recursors) :
+    env.constants recursor.name = none :=
+  (addInduct_success hadd).rec_fresh generation hgeneration recursor hrecursor
+
+theorem addInduct_rec_lookup (hadd : addInduct env decl = some env')
+    {generation : decl.BlockGenerationChecked}
+    (hgeneration : decl.identityBlockGeneration? = some generation)
+    {recursor : VConstVal} (hrecursor : recursor ∈ generation.recursors) :
+    env'.constants recursor.name = some recursor.toVConstant :=
+  (addInduct_success hadd).rec_lookup generation hgeneration recursor hrecursor
+
+theorem addInduct_rule_mem (hadd : addInduct env decl = some env')
+    {generation : decl.BlockGenerationChecked}
+    (hgeneration : decl.identityBlockGeneration? = some generation)
+    (hdf : df ∈ generation.generatedRules) :
+    env'.defeqs df :=
+  (addInduct_success hadd).rule_mem generation hgeneration df hdf
+
+/-- `addInduct` is an all-or-nothing transaction: every evaluation either
+returns no environment or returns an environment satisfying the complete
+success contract. -/
+theorem addInduct_atomic :
+    addInduct env decl = none ∨
+      ∃ env', addInduct env decl = some env' ∧ AddInductSuccess env env' decl := by
+  cases hadd : addInduct env decl with
+  | none => exact .inl rfl
+  | some env' => exact .inr ⟨env', rfl, addInduct_success hadd⟩
+
+/-- The Stage-3 guard is an exact early-rejection condition. -/
+theorem addInduct_eq_none_of_stage3_false (h : decl.stage3 = false) :
+    addInduct env decl = none := by
+  have hgeneration : decl.identityBlockGeneration? = none :=
+    identityBlockGeneration?_eq_none_iff.2 h
+  simp [addInduct, hgeneration]
+
+/-- A pre-existing type name rejects the transaction before any generated
+object is observable. -/
+theorem addInduct_eq_none_of_type_present (hty : ty ∈ decl.types)
+    (hcontains : env.contains ty.name) : addInduct env decl = none := by
+  cases hadd : addInduct env decl with
+  | none => rfl
+  | some env' =>
+    have hfresh := (addInduct_success hadd).type_fresh ty hty
+    obtain ⟨ci, hci⟩ := hcontains
+    rw [hci] at hfresh
+    contradiction
+
+/-- A pre-existing constructor name rejects the complete transaction. The
+proof is stated through the stable success certificate, not the position of
+the constructor in the internal `foldlM`. -/
+theorem addInduct_eq_none_of_ctor_present (hty : ty ∈ decl.types)
+    (hctor : ctor ∈ ty.ctors) (hcontains : env.contains ctor.name) :
+    addInduct env decl = none := by
+  cases hadd : addInduct env decl with
+  | none => rfl
+  | some env' =>
+    have hfresh := (addInduct_success hadd).ctor_fresh ty hty ctor hctor
+    obtain ⟨ci, hci⟩ := hcontains
+    rw [hci] at hfresh
+    contradiction
+
+/-- A pre-existing generated recursor name likewise rejects the complete
+transaction. -/
+theorem addInduct_eq_none_of_rec_present
+    {generation : decl.BlockGenerationChecked}
+    (hgeneration : decl.identityBlockGeneration? = some generation)
+    (hrecursor : recursor ∈ generation.recursors)
+    (hcontains : env.contains recursor.name) : addInduct env decl = none := by
+  cases hadd : addInduct env decl with
+  | none => rfl
+  | some env' =>
+    have success := addInduct_success hadd
+    have hfresh := success.rec_fresh generation hgeneration recursor hrecursor
+    obtain ⟨ci, hci⟩ := hcontains
+    rw [hci] at hfresh
+    contradiction
+
+theorem addInduct_WF {generation : decl.BlockGenerationChecked}
+    {blockEnv : VEnv} (henv : Ordered env)
+    (hgeneration : decl.identityBlockGeneration? = some generation)
+    (hgen : generation.WF env blockEnv)
+    (hadd : addInduct env decl = some env') : Ordered env' := by
+  unfold addInduct at hadd
+  rw [hgeneration] at hadd
+  exact addInductBlockGeneration_WF henv hgen hadd
+
+end VEnv
+
+/- Mixed raw/view generation must stay within Lean's standard logical
+baseline. Guard each proof-critical boundary separately so a dependency change
+identifies the first affected layer. -/
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Checked.WF.identityGeneration [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.minor_isType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.minorTypes_onTel [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.familyApp_transport [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.recType_isType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.recursor_wf [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.ruleCall_hasType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.rule_WF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.generatedRules_WF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationEnv.generatedRulesFold_ordered [propext, Classical.choice, Quot.sound]
+
+/- The generalized recursive-Pi artifact path must remain within the same
+standard logical baseline as the public preservation theorem. These guards
+make every proof-critical boundary independently auditable. -/
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Stage3Env.recTypeRec_isType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Stage3Env.recConstRec_wf [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Stage3Env.ruleCallRec_hasType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Stage3Env.minorAppRec_hasType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Stage3Env.recRuleAppRec_hasType [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.Stage3Env.ruleRec_WF [propext, Classical.choice, Quot.sound]
+
+/- The indexed-inductive preservation proof stays within Lean's standard
+logical axiom baseline. Keep this guard adjacent to the theorem so a new
+dependency fails during ordinary module compilation. -/
+#guard_named_axioms Ix.Theory.Named.VEnv.addInduct_success [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInduct_generation [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInduct_eq_none_of_ctor_present [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInduct_eq_none_of_rec_present [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.addInduct_WF [propext, Classical.choice, Quot.sound]
diff --git a/Ix/Theory/Named/Typing/InductivePattern.lean b/Ix/Theory/Named/Typing/InductivePattern.lean
new file mode 100644
index 000000000..b853952d7
--- /dev/null
+++ b/Ix/Theory/Named/Typing/InductivePattern.lean
@@ -0,0 +1,761 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.InductiveLemmas
+import Ix.Theory.Named.Typing.Pattern
+
+open Ix.Theory (VLevel)
+
+/-! # Generated iota rules as patterns
+
+Every iota rule generated for a certified mutual block
+(`BlockGenerationChecked.rule`) is a closed defeq between lambda telescopes
+whose left body is a `SimplePattern.iota` spine: the owning family's recursor
+applied to the shared parameters, all motives, all minors, and the
+constructor's result indices, with a constructor-headed major premise. This
+module makes that connection exact and proves the generic pattern facts the
+Church–Rosser `Params` interface demands of one certified block:
+
+* `rulePattern` is the `SimplePattern` of one flattened constructor's rule,
+  and `ruleLhsBody_matches` matches the exact generated left body against it
+  at the rule's recursor levels.
+* `IotaPat` is the block's pattern set, associating each rule's pattern with
+  an RHS template (the registered right tower applied to the captured common
+  arguments and fields) and a check list (parameter and result-index
+  agreement between the recursor spine and the major premise).
+* `pat_simple`, `pat_uniq`, `pat_app_l`, `pat_app_l_uniq`, and
+  `pat_app_uniq` are exactly the `Params` obligations, specialized to
+  `IotaPat`; their name-freshness inputs come from the certified block's
+  `blockGeneratedNames` nodup bit, and the major-arity agreement between
+  same-recursor rules comes from the analyzer's terminal `blockTarget?`
+  arity equation.
+
+No open-environment `Params` instance is installed here; the block supplies
+the facts, and soundness (`pat_wf`) plus the block-local environment
+assembler belong to the pattern-soundness milestone. -/
+
+namespace Ix.Theory.Named
+
+open VExpr
+
+namespace VExpr
+
+@[simp] theorem bvarRevRange_length : ∀ (off m : Nat),
+    (bvarRevRange off m).length = m
+  | _, 0 => rfl
+  | off, m+1 => by simp [bvarRevRange, bvarRevRange_length off m]
+
+end VExpr
+
+/-- Extending a `HeadConstN` spine by an application spine. -/
+theorem HeadConstN.appN {c : Name} {ls : List VLevel} :
+    ∀ (as : List VExpr) {n : Nat} {f : VExpr}, HeadConstN c ls n f →
+      HeadConstN c ls (n + as.length) (VExpr.appN f as)
+  | [], _, _, h => h
+  | a :: as, n, f, h => by
+    have := HeadConstN.appN as (h.app (a := a))
+    show HeadConstN c ls (n + (as.length + 1)) (VExpr.appN (f.app a) as)
+    rwa [(by omega : n + (as.length + 1) = n + 1 + as.length)]
+
+namespace VInductDecl
+
+/-! ## Positional facts about the checked pairings -/
+
+theorem pairNormalizedFamilies_getElem? :
+    ∀ (raws : List VInductiveType) (views : List CheckedFamilyData) (t : Nat)
+      {family : NormalizedFamily},
+      (pairNormalizedFamilies raws views)[t]? = some family →
+      raws[t]? = some family.raw ∧ views[t]? = some family.view
+  | raw :: raws, view :: views, 0, family => by
+    intro h
+    cases h
+    exact ⟨rfl, rfl⟩
+  | raw :: raws, view :: views, t+1, family => by
+    intro h
+    simpa using pairNormalizedFamilies_getElem? raws views t
+      (by simpa [pairNormalizedFamilies] using h)
+  | [], _, t, _ => by intro h; simp [pairNormalizedFamilies] at h
+  | _ :: _, [], t, _ => by intro h; simp [pairNormalizedFamilies] at h
+
+theorem pairNormalizedCtors_getElem? :
+    ∀ (raws : List VConstVal) (views : List CheckedCtor) (t : Nat)
+      {ctor : NormalizedCtor},
+      (pairNormalizedCtors raws views)[t]? = some ctor →
+      raws[t]? = some ctor.raw ∧ views[t]? = some ctor.view
+  | raw :: raws, view :: views, 0, ctor => by
+    intro h
+    cases h
+    exact ⟨rfl, rfl⟩
+  | raw :: raws, view :: views, t+1, ctor => by
+    intro h
+    simpa using pairNormalizedCtors_getElem? raws views t
+      (by simpa [pairNormalizedCtors] using h)
+  | [], _, t, _ => by intro h; simp [pairNormalizedCtors] at h
+  | _ :: _, [], t, _ => by intro h; simp [pairNormalizedCtors] at h
+
+/-- The erased family-data spine reads back its exact member facts: ordinal
+consecutiveness, the indexing family, the analyzer equations, and the
+per-family acceptance bit. -/
+theorem CheckedFamilies.data_getElem? {source : VInductDecl} {params : List VExpr} :
+    ∀ {ord : Nat} {types : List VInductiveType}
+      (fs : CheckedFamilies source params ord types) (t : Nat)
+      {fd : CheckedFamilyData},
+      fs.data[t]? = some fd →
+      ∃ type, types[t]? = some type ∧ fd.ordinal = ord + t ∧ fd.value = type ∧
+        fd.indices = ctorFields (VExpr.dropN source.nparams type.type) ∧
+        fd.constructors = type.ctors.map (CheckedCtor.ofBlock source) ∧
+        blockFamilyCore source params (ord + t) type = true
+  | _, _, .nil, t, fd => by intro h; simp [CheckedFamilies.data] at h
+  | ord, _, .cons head tail, 0, fd => by
+    intro h
+    cases h
+    exact ⟨_, rfl, rfl, rfl, head.indices_eq, head.constructors_eq, head.accepted⟩
+  | ord, _, .cons head tail, t+1, fd => by
+    intro h
+    obtain ⟨type, h1, h2, h3, h4, h5, h6⟩ :=
+      CheckedFamilies.data_getElem? tail t (by simpa [CheckedFamilies.data] using h)
+    exact ⟨type, by simpa using h1, by omega, h3, h4, h5,
+      by rw [(by omega : ord + (t + 1) = ord + 1 + t)]; exact h6⟩
+
+/-! ## Arity extraction from the analyzer's terminal target check -/
+
+theorem blockTarget?_loop_length {U np j : Nat} {names : List Name}
+    {head : VExpr} {args : List VExpr} :
+    ∀ (headers : List FamilyHeader) (t : Nat) {target : Nat} {idxs : List VExpr},
+      blockTarget?.loop U np j names head args t headers = some (target, idxs) →
+      t ≤ target ∧ ∃ header, headers[target - t]? = some header ∧
+        args.length = np + header.indices ∧ idxs = args.drop np
+  | [], t, target, idxs => by intro h; simp [blockTarget?.loop] at h
+  | header :: headers, t, target, idxs => by
+    intro h
+    rw [blockTarget?.loop] at h
+    split at h
+    · rename_i hcond
+      cases h
+      simp only [Bool.and_eq_true, beq_iff_eq] at hcond
+      exact ⟨Nat.le_refl _, header, by simp, hcond.1.1.2, rfl⟩
+    · obtain ⟨hle, header', h1, h2, h3⟩ :=
+        blockTarget?_loop_length headers (t+1) h
+      refine ⟨Nat.le_of_succ_le hle, header', ?_, h2, h3⟩
+      rw [(by omega : target - t = (target - (t+1)) + 1)]
+      simpa using h1
+
+/-- A successful mutual target recognition pins the target's index arity to
+its family header. -/
+theorem blockTarget?_length {U np j : Nat} {headers : List FamilyHeader}
+    {names : List Name} {B : VExpr} {target : Nat} {idxs : List VExpr}
+    (h : blockTarget? U np j headers names B = some (target, idxs)) :
+    ∃ header, headers[target]? = some header ∧
+      (VExpr.appArgs B []).length = np + header.indices ∧
+      idxs = (VExpr.appArgs B []).drop np := by
+  rw [blockTarget?] at h
+  obtain ⟨hle, header, h1, h2, h3⟩ := blockTarget?_loop_length headers 0 h
+  exact ⟨header, by simpa using h1, h2, h3⟩
+
+/-- The terminal of an accepted mutual constructor shape is a successful
+`blockTarget?` recognition of the owner family, past all fields. -/
+theorem blockStage3Ctor_result {U np : Nat} {headers : List FamilyHeader}
+    {names : List Name} {owner : Nat} :
+    ∀ (B : VExpr) (j : Nat), blockStage3Ctor U np headers names owner j B = true →
+      ∃ idxs, blockTarget? U np (j + (ctorFields B).length) headers names
+        (VExpr.resultOf B) = some (owner, idxs) := by
+  intro B
+  induction B with
+    (intro j h
+     simp only [blockStage3Ctor] at h
+     try (split at h
+          · rename_i target idxs heq
+            refine ⟨idxs, ?_⟩
+            simp only [ctorFields, List.length_nil, Nat.add_zero, VExpr.resultOf]
+            rwa [(by simpa using h : target = owner)] at heq
+          · cases h))
+  | forallE A rest _ ihR =>
+    rw [Bool.and_eq_true] at h
+    obtain ⟨-, h2⟩ := h
+    obtain ⟨idxs, hidx⟩ := ihR (j+1) h2
+    refine ⟨idxs, ?_⟩
+    simp only [ctorFields, List.length_cons, VExpr.resultOf]
+    rwa [(by omega : j + ((ctorFields rest).length + 1) = j + 1 + (ctorFields rest).length)]
+
+/-! ## Name transport across the normalization boundary -/
+
+theorem sameCtorHeaders_names : ∀ {cs cs' : List VConstVal},
+    sameCtorHeaders cs cs' = true → cs.map (·.name) = cs'.map (·.name)
+  | [], [], _ => rfl
+  | c :: cs, c' :: cs', h => by
+    simp only [sameCtorHeaders, Bool.and_eq_true, beq_iff_eq] at h
+    simp only [List.map_cons, h.1.1, sameCtorHeaders_names h.2]
+  | [], _ :: _, h => by simp [sameCtorHeaders] at h
+  | _ :: _, [], h => by simp [sameCtorHeaders] at h
+
+theorem sameTypeHeaders_names : ∀ {tys tys' : List VInductiveType},
+    sameTypeHeaders tys tys' = true →
+    tys.map (·.name) = tys'.map (·.name) ∧
+      tys.flatMap (fun ty => ty.ctors.map (·.name)) =
+        tys'.flatMap (fun ty => ty.ctors.map (·.name))
+  | [], [], _ => ⟨rfl, rfl⟩
+  | ty :: tys, ty' :: tys', h => by
+    simp only [sameTypeHeaders, Bool.and_eq_true, beq_iff_eq] at h
+    have ih := sameTypeHeaders_names h.2
+    simp only [List.map_cons, List.flatMap_cons, h.1.1.1, ih.1, ih.2,
+      sameCtorHeaders_names h.1.2, and_self]
+  | [], _ :: _, h => by simp [sameTypeHeaders] at h
+  | _ :: _, [], h => by simp [sameTypeHeaders] at h
+
+/-- The reserved generated names are unchanged by normalization: they are
+computed from family and constructor identities only. -/
+theorem blockGeneratedNames_eq_of_sameTypeHeaders
+    {tys tys' : List VInductiveType} (h : sameTypeHeaders tys tys' = true) :
+    blockGeneratedNames tys = blockGeneratedNames tys' := by
+  obtain ⟨h1, h2⟩ := sameTypeHeaders_names h
+  have h3 : tys.map (fun ty => (.str ty.name "rec" : Name)) =
+      tys'.map (fun ty => (.str ty.name "rec" : Name)) := by
+    have := congrArg (List.map (fun n => (.str n "rec" : Name))) h1
+    simpa [List.map_map, Function.comp_def] using this
+  simp only [blockGeneratedNames, h1, h2, h3]
+
+namespace BlockGenerationChecked
+
+variable {source : VInductDecl} (gen : source.BlockGenerationChecked)
+
+/-! ## Inventory facts from the certified block -/
+
+include gen in
+/-- The reserved generated names of the raw source are collision-free: the
+analyzer certifies the view's inventory, and normalization retains every
+identity. -/
+theorem blockGeneratedNames_nodup :
+    (blockGeneratedNames source.types).Nodup := by
+  have hshape := gen.block.normalization.shape_eq
+  simp only [normalizationShape, Bool.and_eq_true, beq_iff_eq] at hshape
+  rw [blockGeneratedNames_eq_of_sameTypeHeaders hshape.2]
+  have h := gen.block.checked.names_nodup
+  rwa [gen.block.checked.names_eq] at h
+
+/-! ## Named components of one generated iota rule -/
+
+/-- Field count of one flattened constructor, as bound by its iota rule. -/
+def ruleFieldCount (constructor : NormalizedBlockCtor) : Nat :=
+  (constructor.ctor.fieldsR source.uvars source.nparams gen.elimination).length
+
+/-- The result-index spine of one iota rule body, in the rule's binder
+context. -/
+def ruleIdx (constructor : NormalizedBlockCtor) : List VExpr :=
+  constructor.ctor.resultIndicesR source.uvars gen.elimination |>.map
+    fun e => e.liftN (gen.familyCount + gen.minorCount)
+      (gen.ruleFieldCount constructor)
+
+/-- The binder telescope shared by both towers of one iota rule. -/
+def ruleBinders (constructor : NormalizedBlockCtor) : List VExpr :=
+  gen.paramsTel ++ gen.motiveTypes ++ gen.minorTypes ++
+    VExpr.liftTelN (gen.familyCount + gen.minorCount)
+      (constructor.ctor.fieldsR source.uvars source.nparams gen.elimination) 0
+
+/-- The constructor-headed major premise of one iota rule body. -/
+def ruleCtorApp (constructor : NormalizedBlockCtor) : VExpr :=
+  VExpr.appN (.const constructor.ctor.raw.name gen.sourceLevels)
+    (VExpr.bvarRevRange
+        (gen.ruleFieldCount constructor + (gen.familyCount + gen.minorCount))
+        source.nparams ++
+      VExpr.bvarRevRange 0 (gen.ruleFieldCount constructor))
+
+/-- The exact left body of one generated iota rule: the owner's recursor
+applied to the common arguments, the constructor's result indices, and the
+constructor-headed major premise. -/
+def ruleLhsBody (constructor : NormalizedBlockCtor) : VExpr :=
+  VExpr.appN (gen.recBase (gen.ruleFieldCount constructor) constructor.owner)
+    (gen.ruleIdx constructor ++ [gen.ruleCtorApp constructor])
+
+/-- The generated rule's left side is exactly the shared binder telescope
+over the `SimplePattern.iota` spine. -/
+theorem rule_lhs (i : Nat) (constructor : NormalizedBlockCtor) :
+    (gen.rule i constructor).lhs =
+      VExpr.lamN (gen.ruleBinders constructor) (gen.ruleLhsBody constructor) := rfl
+
+/-! ## The pattern of one generated iota rule -/
+
+/-- The recursor constant owning one flattened constructor's iota rule. -/
+def ruleRecName (constructor : NormalizedBlockCtor) : Name :=
+  .str (gen.familyNameAt constructor.owner) "rec"
+
+/-- Major-argument arity of one iota rule: shared parameters, all motives,
+all minors, and the constructor's result indices. -/
+def ruleMajorArity (constructor : NormalizedBlockCtor) : Nat :=
+  source.nparams + gen.familyCount + gen.minorCount +
+    (constructor.ctor.resultIndicesR source.uvars gen.elimination).length
+
+/-- Argument arity of one iota rule's constructor-headed major premise. -/
+def ruleArgArity (constructor : NormalizedBlockCtor) : Nat :=
+  source.nparams + gen.ruleFieldCount constructor
+
+/-- The `SimplePattern` of one generated iota rule. -/
+@[reducible] def rulePattern (constructor : NormalizedBlockCtor) : SimplePattern :=
+  .iota (gen.ruleRecName constructor) (gen.ruleMajorArity constructor)
+    constructor.ctor.raw.name (gen.ruleArgArity constructor)
+
+/-- The generated left body is matched by the rule's pattern, at exactly the
+rule's recursor levels. -/
+theorem ruleLhsBody_matches (constructor : NormalizedBlockCtor) :
+    ∃ m2, ((gen.rulePattern constructor).toPattern).Matches
+      (gen.ruleLhsBody constructor) gen.recLevels m2 := by
+  rw [rulePattern, SimplePattern.toPattern_iota]
+  have hleft : HeadConstN (gen.ruleRecName constructor) gen.recLevels
+      (gen.ruleMajorArity constructor)
+      (VExpr.appN (gen.recBase (gen.ruleFieldCount constructor) constructor.owner)
+        (gen.ruleIdx constructor)) := by
+    have h0 : HeadConstN (gen.ruleRecName constructor) gen.recLevels 0
+        (.const (gen.ruleRecName constructor) gen.recLevels) := .const
+    have h1 := (h0.appN (VExpr.bvarRevRange (gen.ruleFieldCount constructor)
+      (source.nparams + gen.familyCount + gen.minorCount)))
+    have h2 := h1.appN (as := gen.ruleIdx constructor)
+    rw [VExpr.bvarRevRange_length] at h2
+    have harity : 0 + (source.nparams + gen.familyCount + gen.minorCount) +
+        (gen.ruleIdx constructor).length = gen.ruleMajorArity constructor := by
+      simp only [ruleIdx, ruleMajorArity, List.length_map]; omega
+    rwa [harity] at h2
+  have hright : HeadConstN constructor.ctor.raw.name gen.sourceLevels
+      (gen.ruleArgArity constructor) (gen.ruleCtorApp constructor) := by
+    have h0 : HeadConstN constructor.ctor.raw.name gen.sourceLevels 0
+        (.const constructor.ctor.raw.name gen.sourceLevels) := .const
+    have h1 := h0.appN (as := VExpr.bvarRevRange
+      (gen.ruleFieldCount constructor + (gen.familyCount + gen.minorCount))
+      source.nparams ++ VExpr.bvarRevRange 0 (gen.ruleFieldCount constructor))
+    rw [List.length_append, VExpr.bvarRevRange_length, VExpr.bvarRevRange_length] at h1
+    have harity : 0 + (source.nparams + gen.ruleFieldCount constructor) =
+        gen.ruleArgArity constructor := by simp only [ruleArgArity]; omega
+    rwa [harity] at h1
+  have hbody : gen.ruleLhsBody constructor =
+      .app (VExpr.appN (gen.recBase (gen.ruleFieldCount constructor) constructor.owner)
+          (gen.ruleIdx constructor))
+        (gen.ruleCtorApp constructor) := by
+    rw [ruleLhsBody, VExpr.appN_append]
+    rfl
+  rw [hbody]
+  exact RecursorIotaPattern.matches_of hleft hright
+
+/-! ## Positional anatomy of the flattened constructors -/
+
+/-- The checked spine assigns family ordinals positionally. -/
+theorem families_getElem?_ordinal {t : Nat} {family : NormalizedFamily}
+    (h : gen.families[t]? = some family) : family.view.ordinal = t := by
+  have h' : (pairNormalizedFamilies source.types
+      gen.block.checked.families.data)[t]? = some family := h
+  obtain ⟨-, hview⟩ := pairNormalizedFamilies_getElem? _ _ t h'
+  obtain ⟨type, -, hord, -, -, -, -⟩ := CheckedFamilies.data_getElem? _ t hview
+  simpa using hord
+
+/-- Position `t` of the paired family list is the `t`-th source family. -/
+theorem families_getElem?_raw {t : Nat} {family : NormalizedFamily}
+    (h : gen.families[t]? = some family) : source.types[t]? = some family.raw :=
+  (pairNormalizedFamilies_getElem? source.types
+    gen.block.checked.families.data t h).1
+
+/-- A family lookup names the owning recursor's family. -/
+theorem familyNameAt_eq {t : Nat} {family : NormalizedFamily}
+    (h : gen.families[t]? = some family) :
+    gen.familyNameAt t = family.raw.name := by
+  simp [familyNameAt, h]
+
+/-- One flattened constructor decomposes into its owner family lookup and
+its position inside that family's pairing. -/
+theorem flatCtors_anatomy {constructor : NormalizedBlockCtor}
+    (hc : constructor ∈ gen.flatCtors) :
+    ∃ t family, gen.families[t]? = some family ∧
+      constructor.owner = t ∧
+      constructor.familyName = family.raw.name ∧
+      constructor.familyIndices = family.view.indices ∧
+      constructor.ctor ∈ family.ctorPairs := by
+  have hc' : constructor ∈ gen.families.flatMap (·.blockCtors) := hc
+  rw [List.mem_flatMap] at hc'
+  obtain ⟨family, hfamily, hmem⟩ := hc'
+  obtain ⟨t, ht⟩ := List.mem_iff_getElem?.1 hfamily
+  simp only [NormalizedFamily.blockCtors, List.mem_map] at hmem
+  obtain ⟨ctor, hctor, rfl⟩ := hmem
+  exact ⟨t, family, ht, gen.families_getElem?_ordinal ht, rfl, rfl, hctor⟩
+
+/-! ## The analyzer's arity equation for pattern majors -/
+
+/-- Every flattened constructor's checked result-index spine has exactly its
+owner family's index arity: the analyzer's terminal `blockTarget?` equation
+transports through the checked spine. -/
+theorem view_resultIndices_length {constructor : NormalizedBlockCtor}
+    (hc : constructor ∈ gen.flatCtors) :
+    constructor.ctor.view.resultIndices.length =
+      constructor.familyIndices.length := by
+  obtain ⟨t, family, ht, -, -, hindices, hmem⟩ := gen.flatCtors_anatomy hc
+  have ht' : (pairNormalizedFamilies source.types
+      gen.block.checked.families.data)[t]? = some family := ht
+  obtain ⟨-, hview⟩ := pairNormalizedFamilies_getElem? _ _ t ht'
+  obtain ⟨vtype, hvty, -, -, hvindices, hvctors, hvcore⟩ :=
+    CheckedFamilies.data_getElem? _ t hview
+  rw [Nat.zero_add] at hvcore
+  obtain ⟨s, hs⟩ := List.mem_iff_getElem?.1 hmem
+  have hs' : (pairNormalizedCtors family.raw.ctors
+      family.view.constructors)[s]? = some constructor.ctor := hs
+  obtain ⟨-, hviewCtor⟩ := pairNormalizedCtors_getElem? _ _ s hs'
+  rw [hvctors, List.getElem?_map] at hviewCtor
+  obtain ⟨c₀, hc₀, hview_eq⟩ : ∃ c₀, vtype.ctors[s]? = some c₀ ∧
+      CheckedCtor.ofBlock _ c₀ = constructor.ctor.view := by
+    cases h0 : vtype.ctors[s]? with
+    | none => rw [h0] at hviewCtor; cases hviewCtor
+    | some c₀ => rw [h0] at hviewCtor; exact ⟨c₀, rfl, by simpa using hviewCtor⟩
+  simp only [blockFamilyCore, Bool.and_eq_true, beq_iff_eq,
+    List.all_eq_true] at hvcore
+  have hstage := (hvcore.2 c₀ (List.mem_of_getElem? hc₀)).2
+  obtain ⟨idxs, htarget⟩ := blockStage3Ctor_result _ 0 hstage
+  obtain ⟨header, hheader, hlen, -⟩ := blockTarget?_length htarget
+  rw [familyHeaders, List.getElem?_map, hvty, Option.map_some] at hheader
+  have hri : constructor.ctor.view.resultIndices =
+      (VExpr.appArgs (VExpr.resultOf (VExpr.dropN
+        gen.block.normalization.view.nparams c₀.type)) []).drop
+        gen.block.normalization.view.nparams := by
+    rw [← hview_eq]; rfl
+  rw [hri, hindices, hvindices, List.length_drop, hlen]
+  cases hheader
+  show gen.block.normalization.view.nparams +
+      (ctorFields (VExpr.dropN gen.block.normalization.view.nparams
+        vtype.type)).length -
+      gen.block.normalization.view.nparams =
+    (ctorFields (VExpr.dropN gen.block.normalization.view.nparams
+      vtype.type)).length
+  omega
+
+/-- Pattern major arity through the owner family's index count. -/
+theorem ruleMajorArity_eq {constructor : NormalizedBlockCtor}
+    (hc : constructor ∈ gen.flatCtors) :
+    gen.ruleMajorArity constructor =
+      source.nparams + gen.familyCount + gen.minorCount +
+        constructor.familyIndices.length := by
+  simp only [ruleMajorArity, NormalizedCtor.resultIndicesR, List.length_map,
+    gen.view_resultIndices_length hc]
+
+/-! ## Name freshness of the generated inventory -/
+
+include gen in
+private theorem nodup_parts :
+    (source.types.map (·.name)).Nodup ∧
+      (source.types.flatMap fun ty => ty.ctors.map (·.name)).Nodup ∧
+      ∀ a ∈ (source.types.flatMap fun ty => ty.ctors.map (·.name)),
+        ∀ b ∈ source.types.map (fun ty => (.str ty.name "rec" : Name)), a ≠ b := by
+  have h := gen.blockGeneratedNames_nodup
+  rw [blockGeneratedNames, List.nodup_append] at h
+  obtain ⟨hAB, -, hdisj⟩ := h
+  rw [List.nodup_append] at hAB
+  exact ⟨hAB.1, hAB.2.1, fun a ha b hb =>
+    hdisj a (List.mem_append.2 (.inr ha)) b hb⟩
+
+/-- Family positions are recoverable from raw family names. -/
+theorem families_name_inj {t t' : Nat} {family family' : NormalizedFamily}
+    (h : gen.families[t]? = some family) (h' : gen.families[t']? = some family')
+    (hname : family.raw.name = family'.raw.name) : t = t' := by
+  have h1 := gen.families_getElem?_raw h
+  have h1' := gen.families_getElem?_raw h'
+  have hm : (source.types.map (·.name))[t]? = some family.raw.name := by
+    rw [List.getElem?_map, h1, Option.map_some]
+  have hm' : (source.types.map (·.name))[t']? = some family.raw.name := by
+    rw [List.getElem?_map, h1', Option.map_some, hname]
+  obtain ⟨hlt, -⟩ := List.getElem?_eq_some_iff.1 hm
+  exact (List.getElem?_inj hlt gen.nodup_parts.1).1 (hm.trans hm'.symm)
+
+/-- Flattened positions are recoverable from raw constructor names. -/
+theorem flatCtors_name_inj {i i' : Nat} {c c' : NormalizedBlockCtor}
+    (h : gen.flatCtors[i]? = some c) (h' : gen.flatCtors[i']? = some c')
+    (hname : c.ctor.raw.name = c'.ctor.raw.name) : i = i' ∧ c = c' := by
+  have hnodup : ((source.blockConstructorConstants).map (·.name)).Nodup := by
+    rw [VInductDecl.blockConstructorConstants, List.map_flatMap]
+    exact gen.nodup_parts.2.1
+  have hm : ((source.blockConstructorConstants).map (·.name))[i]? =
+      some c.ctor.raw.name := by
+    rw [List.getElem?_map, ← gen.flatCtors_map_raw, List.getElem?_map, h]
+    rfl
+  have hm' : ((source.blockConstructorConstants).map (·.name))[i']? =
+      some c.ctor.raw.name := by
+    rw [List.getElem?_map, ← gen.flatCtors_map_raw, List.getElem?_map, h',
+      hname]
+    rfl
+  obtain ⟨hlt, -⟩ := List.getElem?_eq_some_iff.1 hm
+  have hii : i = i' := (List.getElem?_inj hlt hnodup).1 (hm.trans hm'.symm)
+  subst hii
+  exact ⟨rfl, Option.some.inj (h.symm.trans h')⟩
+
+/-- No family's recursor name collides with any flattened constructor's
+name. -/
+theorem recName_ne_ctorName {family : NormalizedFamily}
+    (hfam : family ∈ gen.families) {constructor : NormalizedBlockCtor}
+    (hc : constructor ∈ gen.flatCtors) :
+    (.str family.raw.name "rec" : Name) ≠ constructor.ctor.raw.name := by
+  have hmemC : constructor.ctor.raw.name ∈
+      source.types.flatMap fun ty => ty.ctors.map (·.name) := by
+    have h1 : constructor.ctor.raw ∈ source.blockConstructorConstants := by
+      rw [← gen.flatCtors_map_raw]
+      exact List.mem_map_of_mem hc
+    rw [VInductDecl.blockConstructorConstants, List.mem_flatMap] at h1
+    obtain ⟨ty, hty, hmem⟩ := h1
+    rw [List.mem_flatMap]
+    exact ⟨ty, hty, List.mem_map_of_mem hmem⟩
+  have hmemR : (.str family.raw.name "rec" : Name) ∈
+      source.types.map (fun ty => (.str ty.name "rec" : Name)) := by
+    have h1 : family.raw ∈ source.types := by
+      rw [← gen.families_map_raw]
+      exact List.mem_map_of_mem hfam
+    exact List.mem_map_of_mem h1
+  intro heq
+  exact gen.nodup_parts.2.2 _ hmemC _ hmemR heq.symm
+
+/-- Two flattened constructors with the same owning recursor name share
+their owner and their family's index telescope. -/
+theorem ruleRecName_inj {c c' : NormalizedBlockCtor}
+    (hc : c ∈ gen.flatCtors) (hc' : c' ∈ gen.flatCtors)
+    (h : gen.ruleRecName c = gen.ruleRecName c') :
+    c.owner = c'.owner ∧ c.familyIndices = c'.familyIndices := by
+  obtain ⟨t, family, ht, ho, -, hi, -⟩ := gen.flatCtors_anatomy hc
+  obtain ⟨t', family', ht', ho', -, hi', -⟩ := gen.flatCtors_anatomy hc'
+  rw [ruleRecName, ruleRecName, ho, ho', gen.familyNameAt_eq ht,
+    gen.familyNameAt_eq ht'] at h
+  have hnames : family.raw.name = family'.raw.name := by
+    injection h with h1 h2
+  have ht2 : t = t' := gen.families_name_inj ht ht' hnames
+  subst ht2
+  cases Option.some.inj (ht.symm.trans ht')
+  exact ⟨ho.trans ho'.symm, hi.trans hi'.symm⟩
+
+/-- Rule distinctness: distinct flattened positions carry distinct
+patterns. -/
+theorem rulePattern_inj {i i' : Nat} {c c' : NormalizedBlockCtor}
+    (h : gen.flatCtors[i]? = some c) (h' : gen.flatCtors[i']? = some c')
+    (heq : gen.rulePattern c = gen.rulePattern c') : i = i' ∧ c = c' := by
+  injection heq with h1 h2 h3 h4
+  exact gen.flatCtors_name_inj h h' h3
+
+/-! ## Rule payloads: RHS templates and agreement checks -/
+
+/-- Closedness inputs for one certified block's rule payloads: the towers a
+rule's RHS template and checks embed as fixed template constants. Concrete
+fixtures discharge this bundle by `decide`; the pattern-soundness milestone
+derives it from the staged environment's rule well-formedness. -/
+structure RuleClosure : Prop where
+  rhs_closed : ∀ ⦃i : Nat⦄ ⦃constructor : NormalizedBlockCtor⦄,
+    gen.flatCtors[i]? = some constructor →
+      ((gen.rule i constructor).rhs).ClosedN 0
+  idxTower_closed : ∀ ⦃constructor : NormalizedBlockCtor⦄,
+    constructor ∈ gen.flatCtors → ∀ e ∈ gen.ruleIdx constructor,
+      (VExpr.lamN (gen.ruleBinders constructor) e).ClosedN 0
+
+/-- The template capture list shared by every payload tower: the recursor
+side's parameters, motives, and minors, then the major premise's fields. -/
+def captureArgs (constructor : NormalizedBlockCtor) :
+    List (((gen.rulePattern constructor).toPattern).RHS) :=
+  ((Pattern.varNPaths (.const (gen.ruleRecName constructor))
+      (gen.ruleMajorArity constructor)).take
+    (source.nparams + gen.familyCount + gen.minorCount)).map
+      (fun path => .var (.inl path)) ++
+  ((Pattern.varNPaths (.const constructor.ctor.raw.name)
+      (gen.ruleArgArity constructor)).drop source.nparams).map
+      (fun path => .var (.inr path))
+
+/-- The RHS template of one rule: the registered right tower applied to the
+captured common arguments and fields. -/
+def ruleRHS (hcl : gen.RuleClosure) {i : Nat} {constructor : NormalizedBlockCtor}
+    (h : gen.flatCtors[i]? = some constructor) :
+    ((gen.rulePattern constructor).toPattern).RHS :=
+  Pattern.RHS.appN (.fixed ((gen.rule i constructor).rhs) (hcl.rhs_closed h))
+    (gen.captureArgs constructor)
+
+/-- The check list of one rule: the major premise's parameters must agree
+with the recursor side's parameters, and the recursor side's index arguments
+must agree with the constructor's computed result indices (as fixed index
+towers applied to the captures). -/
+def ruleCheck (hcl : gen.RuleClosure) {constructor : NormalizedBlockCtor}
+    (hc : constructor ∈ gen.flatCtors) :
+    ((gen.rulePattern constructor).toPattern).Check :=
+  let recPaths := Pattern.varNPaths (.const (gen.ruleRecName constructor))
+    (gen.ruleMajorArity constructor)
+  let ctorPaths := Pattern.varNPaths (.const constructor.ctor.raw.name)
+    (gen.ruleArgArity constructor)
+  let common := source.nparams + gen.familyCount + gen.minorCount
+  let idxChecks :=
+    ((gen.ruleIdx constructor).attach.zip (recPaths.drop common)).foldr
+      (fun ep rest =>
+        .defeq (.var (.inl ep.2))
+          (Pattern.RHS.appN
+            (.fixed (VExpr.lamN (gen.ruleBinders constructor) ep.1.1)
+              (hcl.idxTower_closed hc ep.1.1 ep.1.2))
+            (gen.captureArgs constructor)) rest)
+      .true
+  ((ctorPaths.take source.nparams).zip (recPaths.take source.nparams)).foldr
+    (fun pr rest => .defeq (.var (.inr pr.1)) (.var (.inl pr.2)) rest)
+    idxChecks
+
+/-- Position `i` of the certified block's flattened constructor list. -/
+abbrev ruleEntry (i : Nat) (constructor : NormalizedBlockCtor) : Prop :=
+  gen.flatCtors[i]? = some constructor
+
+/-- A decidable sufficient condition for `RuleClosure`, discharging concrete
+fixtures by evaluation. -/
+theorem RuleClosure.of_all
+    (h1 : gen.flatCtors.zipIdx.all (fun ic =>
+      decide (((gen.rule ic.2 ic.1).rhs).ClosedN 0)) = true)
+    (h2 : gen.flatCtors.all (fun c => (gen.ruleIdx c).all fun e =>
+      decide ((VExpr.lamN (gen.ruleBinders c) e).ClosedN 0)) = true) :
+    gen.RuleClosure := by
+  constructor
+  · intro i constructor h
+    have hmem : (constructor, i) ∈ gen.flatCtors.zipIdx := by
+      apply List.mem_of_getElem? (i := i)
+      rw [List.getElem?_zipIdx, h, Option.map_some, Nat.zero_add]
+    exact of_decide_eq_true (List.all_eq_true.1 h1 _ hmem)
+  · intro constructor hc e he
+    exact of_decide_eq_true (List.all_eq_true.1 (List.all_eq_true.1 h2 _ hc) _ he)
+
+/-- The pattern set of one certified block: each flattened constructor's
+rule pattern with its template and checks. -/
+inductive IotaPat (hcl : gen.RuleClosure) :
+    (p : Pattern) → p.RHS × p.Check → Prop where
+  | mk {i : Nat} {constructor : NormalizedBlockCtor}
+      (h : gen.ruleEntry i constructor) :
+      IotaPat hcl ((gen.rulePattern constructor).toPattern)
+        (gen.ruleRHS hcl h, gen.ruleCheck hcl (List.mem_of_getElem? h))
+
+/-! ## The `Params` obligations for one certified block -/
+
+/-- `Params.pat_simple` for the block's pattern set. -/
+theorem IotaPat.pat_simple {hcl : gen.RuleClosure} {p : Pattern}
+    {r : p.RHS × p.Check} (H : gen.IotaPat hcl p r) :
+    ∃ sp : SimplePattern, p = sp.toPattern := by
+  cases H with | mk h => exact ⟨_, rfl⟩
+
+/-- Rule recovery: a pattern in the block's set determines its flattened
+rule position and constructor. -/
+theorem IotaPat.recover {hcl : gen.RuleClosure} {p : Pattern}
+    {r : p.RHS × p.Check} (H : gen.IotaPat hcl p r) :
+    ∃ (i : Nat) (constructor : NormalizedBlockCtor),
+      gen.flatCtors[i]? = some constructor ∧
+      p = (gen.rulePattern constructor).toPattern ∧
+      ∀ (i' : Nat) (constructor' : NormalizedBlockCtor),
+        gen.flatCtors[i']? = some constructor' →
+        (gen.rulePattern constructor').toPattern = p →
+        i' = i ∧ constructor' = constructor := by
+  cases H with | @mk i constructor h =>
+  refine ⟨i, constructor, h, rfl, ?_⟩
+  intro i' constructor' h' heq
+  have := RecursorIotaPattern.inj heq
+  exact gen.flatCtors_name_inj h' h this.2.2.1
+
+/-- `Params.pat_uniq` for the block's pattern set. -/
+theorem IotaPat.pat_uniq {hcl : gen.RuleClosure} {p₁ p₂ p₃ p₄ : Pattern}
+    {r : p₁.RHS × p₁.Check} {r' : p₂.RHS × p₂.Check}
+    (H1 : gen.IotaPat hcl p₁ r) (H2 : gen.IotaPat hcl p₂ r')
+    (H3 : Subpattern p₃ p₁) (H4 : p₂.inter p₃ = some p₄) :
+    p₁ = p₂ ∧ p₂ = p₃ ∧ r ≍ r' := by
+  cases H1 with | @mk i c h =>
+  cases H2 with | @mk i' c' h' =>
+  rcases RecursorIotaPattern.subpattern_inv H3 with rfl | ⟨j, hj, rfl⟩ | ⟨j, hj, rfl⟩
+  · obtain ⟨hR, hM, hC, hN, rfl⟩ := RecursorIotaPattern.inter_some H4
+    obtain ⟨rfl, rfl⟩ := gen.flatCtors_name_inj h' h hC
+    exact ⟨rfl, rfl, HEq.rfl⟩
+  · obtain ⟨hb, hj'⟩ := RecursorIotaPattern.inter_varN_const_some H4
+    obtain ⟨-, hIdx⟩ := gen.ruleRecName_inj (List.mem_of_getElem? h)
+      (List.mem_of_getElem? h') hb
+    have hM : gen.ruleMajorArity c' = gen.ruleMajorArity c := by
+      rw [gen.ruleMajorArity_eq (List.mem_of_getElem? h'),
+        gen.ruleMajorArity_eq (List.mem_of_getElem? h), hIdx]
+    omega
+  · obtain ⟨hb, -⟩ := RecursorIotaPattern.inter_varN_const_some H4
+    obtain ⟨t', family', ht', ho', -, -, -⟩ :=
+      gen.flatCtors_anatomy (List.mem_of_getElem? h')
+    have hrec : gen.ruleRecName c' = (.str family'.raw.name "rec" : Name) := by
+      rw [ruleRecName, ho', gen.familyNameAt_eq ht']
+    refine absurd ?_ (gen.recName_ne_ctorName (List.mem_of_getElem? ht')
+      (List.mem_of_getElem? h))
+    rw [← hrec, hb]
+
+/-- `Params.pat_app_l` for the block's pattern set. -/
+theorem IotaPat.pat_app_l {hcl : gen.RuleClosure} {p : Pattern}
+    {r : p.RHS × p.Check} {p₁ p₂ p₃ p₄ : Pattern}
+    (H : gen.IotaPat hcl p r) (h : Subpattern (.app p₁ p₂) p) :
+    ¬Subpattern (.app p₃ p₄) p₁ := by
+  cases H with | @mk i c hi =>
+  obtain ⟨rfl, -⟩ := RecursorIotaPattern.app_subpattern h
+  intro hsub
+  obtain ⟨j', hj', heq'⟩ := hsub.varN_const_le
+  cases j' <;> exact absurd heq' (by simp [Pattern.varN])
+
+/-- `Params.pat_app_l_uniq` for the block's pattern set. -/
+theorem IotaPat.pat_app_l_uniq {hcl : gen.RuleClosure} {p p' : Pattern}
+    {r : p.RHS × p.Check} {r' : p'.RHS × p'.Check} {p₁ p₂ p₁' p₂' p₃ : Pattern}
+    (H : gen.IotaPat hcl p r) (H' : gen.IotaPat hcl p' r')
+    (h : Subpattern (.app p₁ p₂) p) (h' : Subpattern (.app p₁' p₂') p')
+    (h₃ : Subpattern (.var p₃) p₁) : p₁'.inter p₃ = none := by
+  cases H with | @mk i c hi =>
+  cases H' with | @mk i' c' hi' =>
+  obtain ⟨rfl, -⟩ := RecursorIotaPattern.app_subpattern h
+  obtain ⟨rfl, -⟩ := RecursorIotaPattern.app_subpattern h'
+  obtain ⟨j, hj, heq⟩ := h₃.varN_const_le
+  cases j with
+  | zero => exact absurd heq (by simp [Pattern.varN])
+  | succ j'' =>
+    rw [show Pattern.varN (.const (gen.ruleRecName c)) (j'' + 1) =
+        .var (Pattern.varN (.const (gen.ruleRecName c)) j'') from rfl] at heq
+    injection heq with heq'
+    subst heq'
+    by_cases hname : gen.ruleRecName c' = gen.ruleRecName c
+    · obtain ⟨-, hIdx⟩ := gen.ruleRecName_inj (List.mem_of_getElem? hi')
+        (List.mem_of_getElem? hi) hname
+      have hM : gen.ruleMajorArity c' = gen.ruleMajorArity c := by
+        rw [gen.ruleMajorArity_eq (List.mem_of_getElem? hi'),
+          gen.ruleMajorArity_eq (List.mem_of_getElem? hi), hIdx]
+      rw [hname]
+      exact Pattern.varN_const_inter_of_ne_arity (by omega) _ _
+    · exact Pattern.varN_const_inter_of_ne_name hname _ _
+
+/-- `Params.pat_app_uniq` for the block's pattern set. -/
+theorem IotaPat.pat_app_uniq {hcl : gen.RuleClosure} {p p' : Pattern}
+    {r : p.RHS × p.Check} {r' : p'.RHS × p'.Check}
+    {p₁ p₂ p₁' p₂' p₃ p₃' : Pattern}
+    (H : gen.IotaPat hcl p r) (H' : gen.IotaPat hcl p' r')
+    (h : Subpattern (.app p₁ p₂) p) (h' : Subpattern (.app p₁' p₂') p')
+    (h₃ : Subpattern p₃ p₁) (h₃' : Subpattern p₃' p₂') : p₃.inter p₃' = none := by
+  cases H with | @mk i c hi =>
+  cases H' with | @mk i' c' hi' =>
+  obtain ⟨rfl, -⟩ := RecursorIotaPattern.app_subpattern h
+  obtain ⟨-, rfl⟩ := RecursorIotaPattern.app_subpattern h'
+  obtain ⟨j, hj, rfl⟩ := h₃.varN_const_le
+  obtain ⟨j', hj', rfl⟩ := h₃'.varN_const_le
+  refine Pattern.varN_const_inter_of_ne_name ?_ _ _
+  obtain ⟨t, family, ht, ho, -, -, -⟩ :=
+    gen.flatCtors_anatomy (List.mem_of_getElem? hi)
+  have hrec : gen.ruleRecName c = (.str family.raw.name "rec" : Name) := by
+    rw [ruleRecName, ho, gen.familyNameAt_eq ht]
+  rw [hrec]
+  exact gen.recName_ne_ctorName (List.mem_of_getElem? ht)
+    (List.mem_of_getElem? hi')
+
+/-! ## Axiom closures of the generic pattern facts -/
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.ruleLhsBody_matches [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.view_resultIndices_length [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.rulePattern_inj [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.IotaPat.pat_simple [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.IotaPat.recover [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.IotaPat.pat_uniq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.IotaPat.pat_app_l [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.IotaPat.pat_app_l_uniq [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.IotaPat.pat_app_uniq [propext, Quot.sound]
+
+end BlockGenerationChecked
+
+end VInductDecl
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Typing/InductivePatternWF.lean b/Ix/Theory/Named/Typing/InductivePatternWF.lean
new file mode 100644
index 000000000..d01b7305a
--- /dev/null
+++ b/Ix/Theory/Named/Typing/InductivePatternWF.lean
@@ -0,0 +1,943 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Typing.InductivePattern
+import Ix.Theory.Named.Typing.UniqueTyping
+
+open Ix.Theory (VLevel)
+
+/-! # Pattern soundness for generated iota rules
+
+The typed β-collapse layer for Spec-10B: applying a lambda tower to a
+well-typed argument spine is definitionally equal to the iterated
+instantiation of its body (`IsDefEq.appN_lamN`), applications are
+congruent along spines (`IsDefEq.appN_congr`, `IsDefEq.appN_defEq` over
+`SpineDefEq`), and a matched pattern's captures are exactly the spine
+arguments (`varN_matches_paths`). `pat_wf` then proves that a successful
+match whose checks hold is definitionally equal to its RHS template — by
+applying the registered `addInduct` rule tower to the captured arguments
+and β-collapsing both readings. -/
+
+namespace Ix.Theory.Named
+
+open VExpr
+
+namespace VExpr
+
+/-- Instantiation pushes under a lambda telescope, mirroring
+`instN_forallN`. -/
+theorem instN_lamN (a : VExpr) : ∀ (tel : List VExpr) (X : VExpr) (k : Nat),
+    (lamN tel X).inst a k = lamN (instTelN a tel k) (X.inst a (k + tel.length))
+  | [], _, _ => rfl
+  | A :: tel, X, k => by
+    show VExpr.lam _ _ = VExpr.lam _ _
+    rw [instN_lamN a tel X (k+1),
+      show k+1+tel.length = k+(tel.length+1) from by omega]
+    rfl
+
+/-- Universe instantiation pushes under a lambda telescope. -/
+theorem instL_lamN (ls : List VLevel) : ∀ (As : List VExpr) (e : VExpr),
+    (lamN As e).instL ls = lamN (As.map (instL ls)) (e.instL ls)
+  | [], _ => rfl
+  | A :: As, e => by
+    show VExpr.lam _ _ = VExpr.lam _ _
+    rw [instL_lamN ls As e]
+
+end VExpr
+
+/-- Matching a constant `varN` tower captures exactly the spine arguments:
+the `varNPaths` read back the argument list. -/
+theorem Pattern.varN_matches_paths {c : Name} {m1 : List VLevel} :
+    ∀ (n : Nat) (as : List VExpr) {f : VExpr} {m2},
+      (Pattern.varN (.const c) n).Matches (VExpr.appN f as) m1 m2 →
+      as.length = n →
+      (Pattern.varNPaths (.const c) n).map m2 = as := by
+  intro n
+  induction n with
+  | zero =>
+    intro as f m2 H hlen
+    obtain rfl : as = [] := List.length_eq_zero_iff.1 hlen
+    rfl
+  | succ n ih =>
+    intro as f m2 H hlen
+    have hne : as ≠ [] := by rintro rfl; simp at hlen
+    obtain ⟨as', a, rfl⟩ : ∃ as' a, as = as' ++ [a] :=
+      ⟨as.dropLast, as.getLast hne, (List.dropLast_concat_getLast hne).symm⟩
+    rw [VExpr.appN_append] at H
+    have has : as'.length = n := by simpa using hlen
+    cases H with
+    | var h =>
+      show ((Pattern.varNPaths (.const c) n).map some ++ [none]).map _ =
+        as' ++ [a]
+      rw [List.map_append, List.map_map]
+      exact congrArg (· ++ [a]) (ih as' h has)
+
+/-- Applying an RHS template spine computes to the applied template
+values. -/
+theorem Pattern.RHS.appN_apply {p : Pattern} (m1 : List VLevel)
+    (m2 : p.Path → VExpr) :
+    ∀ (f : p.RHS) (as : List (p.RHS)),
+      (Pattern.RHS.appN f as).apply m1 m2 =
+        VExpr.appN (f.apply m1 m2) (as.map (Pattern.RHS.apply m1 m2))
+  | _, [] => rfl
+  | f, a :: as => by
+    show (Pattern.RHS.appN (.app f a) as).apply m1 m2 = _
+    rw [Pattern.RHS.appN_apply m1 m2 (.app f a) as]
+    rfl
+
+/-- A `HeadConstN` spine names its argument list. -/
+theorem HeadConstN.exists_appN {c : Name} {ls : List VLevel} :
+    ∀ {n : Nat} {e : VExpr}, HeadConstN c ls n e →
+      ∃ as : List VExpr, e = VExpr.appN (.const c ls) as ∧ as.length = n
+  | _, _, .const => ⟨[], rfl, rfl⟩
+  | _, _, .app (a := a) h =>
+    let ⟨as, he, hl⟩ := h.exists_appN
+    ⟨as ++ [a], by rw [VExpr.appN_append, ← he]; rfl, by simp [hl]⟩
+
+namespace VExpr
+
+/-- The value of a bound variable under iterated instantiation: the spine
+argument at its reverse position. -/
+theorem instRev_bvar_lt : ∀ (es : List VExpr) {i : Nat} (h : i < es.length),
+    instRev (.bvar i) es = es[es.length - 1 - i]'(by omega)
+  | e :: es, i, h => by
+    rcases Nat.lt_or_ge i es.length with h' | h'
+    · rw [show instRev (.bvar i) (e :: es) = instRev (.bvar i) es from
+        instRev_bvar_lt_cons es e h', instRev_bvar_lt es h']
+      simp only [show (e :: es).length - 1 - i = (es.length - 1 - i) + 1 from by
+        simp only [List.length_cons]; omega, List.getElem_cons_succ]
+    · obtain rfl : i = es.length := by
+        simp only [List.length_cons] at h; omega
+      show instRev (instVar es.length e es.length) es = _
+      rw [show instVar es.length e es.length = liftN es.length e from by
+        simp [instVar]]
+      rw [instRev_liftN_len]
+      simp only [show (e :: es).length - 1 - es.length = 0 from by
+        simp only [List.length_cons]; omega, List.getElem_cons_zero]
+
+/-- Iterated instantiation of a reverse bound-variable segment reads back
+the corresponding spine segment. -/
+theorem map_instRev_bvarRevRange_seg (es : List VExpr) :
+    ∀ (q off : Nat), off + q ≤ es.length →
+    (bvarRevRange off q).map (instRev · es) =
+      (es.drop (es.length - off - q)).take q := by
+  intro q
+  induction q with
+  | zero => intro off h; simp [VExpr.bvarRevRange]
+  | succ q ih =>
+    intro off h
+    show instRev (.bvar (off + q)) es :: (bvarRevRange off q).map (instRev · es) = _
+    rw [instRev_bvar_lt es (by omega), ih off (by omega)]
+    have hd : es.length - off - (q + 1) < es.length := by omega
+    simp only [show es.length - 1 - (off + q) = es.length - off - (q + 1) from by
+      omega, show es.length - off - q = (es.length - off - (q + 1)) + 1 from by
+      omega]
+    rw [List.drop_eq_getElem_cons hd, List.take_succ_cons]
+
+end VExpr
+
+/-! ## Typed β-collapse of applied telescopes -/
+
+/-- Instantiating below a reversed telescope, mirroring
+`Ctx.LiftN.consTel`. -/
+theorem Ctx.InstN.consTel {Γ₀ : List VExpr} {e₀ A₀ : VExpr} :
+    ∀ (As : List VExpr) {k : Nat} {Γ Γ' : List VExpr},
+      Ctx.InstN Γ₀ e₀ A₀ k Γ Γ' →
+      Ctx.InstN Γ₀ e₀ A₀ (As.length + k) (As.reverse ++ Γ)
+        ((VExpr.instTelN e₀ As k).reverse ++ Γ')
+  | [], k, Γ, Γ', W => by simpa [VExpr.instTelN] using W
+  | A :: As, k, Γ, Γ', W => by
+    have h := Ctx.InstN.consTel As (Ctx.InstN.succ (A := A) W)
+    rw [show As.length + (k+1) = (A :: As).length + k from by simp; omega] at h
+    simpa [VExpr.instTelN, List.append_assoc] using h
+
+/-- Instantiating a telescope's context. -/
+theorem VEnv.OnTel.instN {env : VEnv} (henv : env.Ordered) {U : Nat}
+    {Γ₀ : List VExpr} {e₀ A₀ : VExpr} (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    ∀ {As : List VExpr} {k : Nat} {Γ Γ' : List VExpr},
+      Ctx.InstN Γ₀ e₀ A₀ k Γ Γ' → VEnv.OnTel env U Γ As →
+      VEnv.OnTel env U Γ' (VExpr.instTelN e₀ As k)
+  | [], _, _, _, _, _ => trivial
+  | _ :: _, _, _, _, W, ⟨⟨u, hA⟩, hT⟩ =>
+    ⟨⟨u, hA.instN henv W h₀⟩, VEnv.OnTel.instN henv h₀ W.succ hT⟩
+
+/-- Pointwise defeq of two application spines against a peeled pi type. -/
+inductive VEnv.SpineDefEq (env : VEnv) (U : Nat) (Γ : List VExpr) :
+    VExpr → List VExpr → List VExpr → VExpr → Prop where
+  | nil : VEnv.SpineDefEq env U Γ A [] [] A
+  | cons : env.IsDefEq U Γ a a' A₁ →
+      VEnv.SpineDefEq env U Γ (A₂.inst a) es es' B →
+      VEnv.SpineDefEq env U Γ (.forallE A₁ A₂) (a :: es) (a' :: es') B
+
+/-- Iterated application congruence along a pointwise defeq spine. -/
+theorem VEnv.IsDefEq.appN_defEq {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {es es' : List VExpr} {F B X Y : VExpr},
+      env.IsDefEq U Γ X Y F → VEnv.SpineDefEq env U Γ F es es' B →
+      env.IsDefEq U Γ (VExpr.appN X es) (VExpr.appN Y es') B
+  | [], _, _, _, _, _, h, .nil => h
+  | a :: _, a' :: _, _, _, X, Y, h, .cons ha hrest =>
+    VEnv.IsDefEq.appN_defEq (X := X.app a) (Y := Y.app a') (h.appDF ha) hrest
+
+/-- A well-typed spine is a reflexive defeq spine. -/
+theorem VEnv.SpineWF.toSpineDefEq {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {es : List VExpr} {F B : VExpr}, env.SpineWF U Γ F es B →
+      VEnv.SpineDefEq env U Γ F es es B
+  | [], _, _, .nil => .nil
+  | _ :: _, _, _, .cons ha hrest => .cons ha hrest.toSpineDefEq
+
+/-- Iterated application congruence in the function position. -/
+theorem VEnv.IsDefEq.appN_congr {env : VEnv} {U : Nat} {Γ : List VExpr}
+    {es : List VExpr} {F B X Y : VExpr}
+    (h : env.IsDefEq U Γ X Y F) (hs : env.SpineWF U Γ F es B) :
+    env.IsDefEq U Γ (VExpr.appN X es) (VExpr.appN Y es) B :=
+  h.appN_defEq hs.toSpineDefEq
+
+/-- A registered equation remains available after environment growth.
+
+This is the primitive transport operation for consumer-certified extension
+rules: `VEnv.LE` transports registration, while the core `.extra` constructor
+still requires the exact universe instantiation side conditions. -/
+theorem VEnv.LE.extra {env env' : VEnv} (henv : env ≤ env') {U : Nat}
+    {Γ : List VExpr} {df : VDefEq} {ls : List VLevel}
+    (hreg : env.defeqs df) (hlevels : ∀ l ∈ ls, l.WF U)
+    (hlevelsLength : ls.length = df.uvars) :
+    env'.IsDefEq U Γ (df.lhs.instL ls) (df.rhs.instL ls)
+      (df.type.instL ls) :=
+  .extra (henv.defeqs hreg) hlevels hlevelsLength
+
+/-- Transport a registered equation through environment growth and then
+apply it to a well-typed spine. This is the beta-tower consumer boundary:
+registration supplies only the tower equality; application congruence and
+spine typing remain explicit proof obligations. -/
+theorem VEnv.LE.extra_appN {env env' : VEnv} (henv : env ≤ env') {U : Nat}
+    {Γ : List VExpr} {df : VDefEq} {ls : List VLevel} {args : List VExpr}
+    {B : VExpr} (hreg : env.defeqs df)
+    (hlevels : ∀ l ∈ ls, l.WF U) (hlevelsLength : ls.length = df.uvars)
+    (hspine : env.SpineWF U Γ (df.type.instL ls) args B) :
+    env'.IsDefEq U Γ
+      (VExpr.appN (df.lhs.instL ls) args)
+      (VExpr.appN (df.rhs.instL ls) args) B :=
+  (henv.extra hreg hlevels hlevelsLength).appN_congr (hspine.mono henv)
+
+/-- The symmetric applied transport is derived, not a second trusted
+extension direction. -/
+theorem VEnv.LE.extra_appN_symm {env env' : VEnv} (henv : env ≤ env')
+    {U : Nat} {Γ : List VExpr} {df : VDefEq} {ls : List VLevel}
+    {args : List VExpr} {B : VExpr} (hreg : env.defeqs df)
+    (hlevels : ∀ l ∈ ls, l.WF U) (hlevelsLength : ls.length = df.uvars)
+    (hspine : env.SpineWF U Γ (df.type.instL ls) args B) :
+    env'.IsDefEq U Γ
+      (VExpr.appN (df.rhs.instL ls) args)
+      (VExpr.appN (df.lhs.instL ls) args) B :=
+  (henv.extra_appN hreg hlevels hlevelsLength hspine).symm
+
+/-- Applying a lambda telescope to a full well-typed spine collapses to the
+iterated instantiation of its body. -/
+theorem VEnv.IsDefEq.appN_lamN {env : VEnv} (henv : env.Ordered) {U : Nat} :
+    ∀ {As : List VExpr} {Γ : List VExpr} {body T B : VExpr} {es : List VExpr},
+      VEnv.OnTel env U Γ As →
+      env.HasType U (As.reverse ++ Γ) body T →
+      env.SpineWF U Γ (VExpr.forallN As T) es B →
+      es.length = As.length →
+      env.IsDefEq U Γ (VExpr.appN (VExpr.lamN As body) es)
+        (VExpr.instRev body es) B
+  | [], Γ, body, T, B, es, _, hb, hs, hlen => by
+    obtain rfl : es = [] := List.length_eq_zero_iff.1 hlen
+    obtain rfl : T = B := hs.nil_inv
+    exact hb
+  | A :: As, Γ, body, T, B, e :: es, ⟨⟨u, hA⟩, hT⟩, hb,
+      .cons he hrest, hlen => by
+    have hb' : env.HasType U (As.reverse ++ (A :: Γ)) body T := by
+      simpa [List.append_assoc] using hb
+    have hlam : env.HasType U (A :: Γ) (VExpr.lamN As body)
+        (VExpr.forallN As T) := VEnv.HasType.lamN hT hb'
+    have hbeta := VEnv.IsDefEq.beta hlam he
+    rw [VExpr.instN_lamN, Nat.zero_add] at hbeta
+    have hlen2 : es.length = As.length := by simpa using hlen
+    have hT' : VEnv.OnTel env U Γ (VExpr.instTelN e As 0) :=
+      VEnv.OnTel.instN henv he .zero hT
+    have hb'' : env.HasType U ((VExpr.instTelN e As 0).reverse ++ Γ)
+        (body.inst e As.length) (T.inst e As.length) := by
+      have W := Ctx.InstN.consTel (Γ₀ := Γ) (e₀ := e) (A₀ := A) As .zero
+      have := hb'.instN henv W he
+      simpa using this
+    have hrest' : env.SpineWF U Γ
+        (VExpr.forallN (VExpr.instTelN e As 0) (T.inst e As.length)) es B := by
+      rw [VExpr.instN_forallN] at hrest
+      simpa using hrest
+    have hlen' : es.length = (VExpr.instTelN e As 0).length := by
+      rw [VExpr.instTelN_length]; exact hlen2
+    have IH := VEnv.IsDefEq.appN_lamN henv hT' hb'' hrest' hlen'
+    have hstep := VEnv.IsDefEq.appN_congr hbeta hrest
+    show env.IsDefEq U Γ
+      (VExpr.appN ((VExpr.lam A (VExpr.lamN As body)).app e) es)
+      (VExpr.instRev (body.inst e es.length) es) B
+    rw [hlen2]
+    exact hstep.trans IH
+
+/-- Instantiate a terminal definitional equality through a saturated telescope spine. -/
+theorem VEnv.SpineWF.instRev_defeq
+    {env : VEnv} (henv : env.Ordered) {U : Nat} {Γ : List VExpr} :
+    ∀ {As : List VExpr} {C C' T : VExpr} {es : List VExpr} {B : VExpr},
+      env.SpineWF U Γ (VExpr.forallN As C) es B →
+      es.length = As.length →
+      env.IsDefEq U (As.reverse ++ Γ) C C' T →
+      env.IsDefEq U Γ (VExpr.instRev C es) (VExpr.instRev C' es)
+        (VExpr.instRev T es)
+  | [], C, C', T, [], B, hspine, _, hterminal => by
+      simpa [VExpr.instRev] using hterminal
+  | [], _, _, _, _ :: _, _, _, hlen, _ => by simp at hlen
+  | _ :: _, _, _, _, [], _, _, hlen, _ => by simp at hlen
+  | A :: As, C, C', T, e :: es, B,
+      .cons he hrest, hlen, hterminal => by
+      have hlen' : es.length = As.length := by simpa using hlen
+      have W := Ctx.InstN.consTel (Γ₀ := Γ) (e₀ := e) (A₀ := A) As .zero
+      have hterminal₀ : env.IsDefEq U (As.reverse ++ A :: Γ) C C' T := by
+        simpa [List.reverse_cons, List.append_assoc] using hterminal
+      have hterminal' := hterminal₀.instN henv he W
+      have hrest' : env.SpineWF U Γ
+          (VExpr.forallN (VExpr.instTelN e As 0)
+            (C.inst e As.length)) es B := by
+        rw [VExpr.instN_forallN] at hrest
+        simpa using hrest
+      have hout := VEnv.SpineWF.instRev_defeq henv hrest'
+        (by simpa [VExpr.instTelN_length] using hlen') hterminal'
+      simpa [VExpr.instRev, hlen'] using hout
+
+/-- Iterated inversion of a lambda tower's typing: the telescope is
+well-formed and the body is typed under it. -/
+theorem VEnv.HasType.lamN_wf {env : VEnv} {U : Nat} (henv : env.Ordered) :
+    ∀ {As : List VExpr} {Γ : List VExpr} {body V : VExpr},
+      OnCtx Γ (env.IsType U) →
+      env.HasType U Γ (VExpr.lamN As body) V →
+      VEnv.OnTel env U Γ As ∧
+        ∃ T₀, env.HasType U (As.reverse ++ Γ) body T₀
+  | [], Γ, body, V, _, H => ⟨trivial, V, H⟩
+  | A :: As, Γ, body, V, hΓ, H => by
+    obtain ⟨⟨u, hA⟩, W, hrest⟩ := VEnv.HasType.lam_inv henv hΓ H
+    obtain ⟨hT, T₀, hbody⟩ :=
+      VEnv.HasType.lamN_wf henv (As := As) (Γ := A :: Γ) ⟨hΓ, u, hA⟩ hrest
+    exact ⟨⟨⟨u, hA⟩, hT⟩, T₀, by simpa [List.append_assoc] using hbody⟩
+
+/-- The levels of a `HeadConstN` spine are unique. -/
+theorem HeadConstN.levels_uniq {c : Name} :
+    ∀ {n : Nat} {e : VExpr} {ls ls' : List VLevel},
+      HeadConstN c ls n e → HeadConstN c ls' n e → ls = ls'
+  | _, _, _, _, .const, .const => rfl
+  | _, _, _, _, .app h, .app h' => h.levels_uniq h'
+
+/-- Zip a well-typed spine with pointwise defeqs into a defeq spine.
+Reflexive entries need no defeq evidence. -/
+theorem VEnv.SpineWF.defEq_of_pointwise {env : VEnv} (henv : env.WF)
+    {U : Nat} {Γ : List VExpr} (hΓ : OnCtx Γ (env.IsType U)) :
+    ∀ {es es' : List VExpr} {F B : VExpr},
+      env.SpineWF U Γ F es B →
+      List.Forall₂ (fun a a' => a = a' ∨ env.IsDefEqU U Γ a a') es es' →
+      VEnv.SpineDefEq env U Γ F es es' B
+  | [], [], _, _, .nil, .nil => .nil
+  | _ :: _, _ :: _, _, _, .cons he hrest, .cons hd htl => by
+    refine .cons ?_ (hrest.defEq_of_pointwise henv hΓ htl)
+    rcases hd with rfl | hd
+    · exact he
+    · exact VEnv.IsDefEqU.of_l henv hΓ hd he
+
+/-- Unfold the `OK` predicate through a folded list of defeq checks. -/
+theorem Pattern.Check.OK.of_foldr {p : Pattern} {α : Type _}
+    {df : VExpr → VExpr → Prop} {m1 : List VLevel} {m2 : p.Path → VExpr}
+    (f g : α → p.RHS) :
+    ∀ {xs : List α} {rest : p.Check},
+      ((xs.foldr (fun x acc => Pattern.Check.defeq (f x) (g x) acc)
+        rest).OK df m1 m2) →
+      (∀ x ∈ xs, df ((f x).apply m1 m2) ((g x).apply m1 m2)) ∧
+        rest.OK df m1 m2
+  | [], _, h => ⟨nofun, h⟩
+  | _ :: xs, rest, h => by
+    obtain ⟨h1, h2⟩ := h
+    obtain ⟨h3, h4⟩ := Pattern.Check.OK.of_foldr f g (xs := xs) h2
+    refine ⟨fun x hx => ?_, h4⟩
+    rcases List.mem_cons.1 hx with rfl | hx
+    · exact h1
+    · exact h3 x hx
+
+/-- Build a pointwise relation between two mapped lists from their zip. -/
+private theorem forall₂_zip_map {α β : Type _} (F : α → VExpr) (G : β → VExpr)
+    (R : VExpr → VExpr → Prop) :
+    ∀ (xs : List α) (ys : List β), xs.length = ys.length →
+      (∀ p ∈ xs.zip ys, R (F p.1) (G p.2)) →
+      List.Forall₂ R (xs.map F) (ys.map G)
+  | [], [], _, _ => .nil
+  | x :: xs, y :: ys, hlen, hall =>
+    .cons (hall (x, y) (.head _))
+      (forall₂_zip_map F G R xs ys (by simpa using hlen)
+        fun p hp => hall p (.tail _ hp))
+  | [], _ :: _, hlen, _ => by simp at hlen
+  | _ :: _, [], hlen, _ => by simp at hlen
+
+/-- Universe instantiation fixes a reverse bound-variable range. -/
+theorem VExpr.bvarRevRange_map_instL (ls : List VLevel) :
+    ∀ (off m : Nat),
+      (VExpr.bvarRevRange off m).map (VExpr.instL ls) =
+        VExpr.bvarRevRange off m
+  | _, 0 => rfl
+  | off, m+1 => by
+    simp only [VExpr.bvarRevRange, List.map_cons, VExpr.instL,
+      VExpr.bvarRevRange_map_instL ls off m]
+
+/-- A well-formed telescope extends a well-formed context. -/
+theorem VEnv.OnTel.onCtx {env : VEnv} {U : Nat} :
+    ∀ {As Γ : List VExpr}, OnCtx Γ (env.IsType U) →
+      VEnv.OnTel env U Γ As → OnCtx (As.reverse ++ Γ) (env.IsType U)
+  | [], _, hΓ, _ => hΓ
+  | A :: As, Γ, hΓ, ⟨hA, hT⟩ => by
+    simpa [List.append_assoc] using
+      VEnv.OnTel.onCtx (As := As) (Γ := A :: Γ) ⟨hΓ, hA⟩ hT
+
+/-- Every argument of a well-typed application spine is well-typed. -/
+theorem VEnv.HasType.appN_args_wf {env : VEnv} (henv : env.WF) {U : Nat}
+    {Γ : List VExpr} (hΓ : OnCtx Γ (env.IsType U)) :
+    ∀ (n : Nat) (es : List VExpr), es.length = n → ∀ {f B : VExpr},
+      env.HasType U Γ (VExpr.appN f es) B →
+      ∀ e ∈ es, ∃ T, env.HasType U Γ e T := by
+  intro n
+  induction n with
+  | zero =>
+    intro es hlen f B H e he
+    obtain rfl := List.length_eq_zero_iff.1 hlen
+    cases he
+  | succ n ih =>
+    intro es hlen f B H e he
+    have hne : es ≠ [] := by rintro rfl; simp at hlen
+    obtain ⟨es', a, rfl⟩ : ∃ es' a, es = es' ++ [a] :=
+      ⟨es.dropLast, es.getLast hne, (List.dropLast_concat_getLast hne).symm⟩
+    rw [VExpr.appN_append] at H
+    have H' : env.HasType U Γ ((VExpr.appN f es').app a) B := H
+    obtain ⟨A₁, B₁, hf, ha⟩ := H'.app_inv henv hΓ
+    rcases List.mem_append.1 he with he' | he'
+    · exact ih es' (by simpa using hlen) hf e he'
+    · obtain rfl : e = a := by simpa using he'
+      exact ⟨A₁, ha⟩
+
+/-- Iterated inversion of a pi tower's typing: the telescope is well formed
+and the body is typed under it. -/
+theorem VEnv.HasType.forallN_wf {env : VEnv} {U : Nat} (henv : env.Ordered) :
+    ∀ {As : List VExpr} {Γ : List VExpr} {body V : VExpr},
+      env.HasType U Γ (VExpr.forallN As body) V →
+      VEnv.OnTel env U Γ As ∧ ∃ V', env.HasType U (As.reverse ++ Γ) body V'
+  | [], _, _, V, H => ⟨trivial, V, H⟩
+  | A :: As, Γ, body, V, H => by
+    obtain ⟨⟨u, hA⟩, v, hB⟩ := VEnv.HasType.forallE_inv henv H
+    obtain ⟨hT, V', hbody⟩ := VEnv.HasType.forallN_wf henv (As := As) hB
+    exact ⟨⟨⟨u, hA⟩, hT⟩, V', by simpa [List.append_assoc] using hbody⟩
+
+private theorem forall₂_refl_or {R : VExpr → VExpr → Prop} :
+    ∀ (l : List VExpr), List.Forall₂ (fun a a' => a = a' ∨ R a a') l l
+  | [] => .nil
+  | _ :: l => .cons (Or.inl rfl) (forall₂_refl_or l)
+
+private theorem forall₂_append {R : VExpr → VExpr → Prop} :
+    ∀ {l₁ l₂ l₁' l₂' : List VExpr}, List.Forall₂ R l₁ l₂ →
+      List.Forall₂ R l₁' l₂' → List.Forall₂ R (l₁ ++ l₁') (l₂ ++ l₂')
+  | [], [], _, _, .nil, h => h
+  | _ :: _, _ :: _, _, _, .cons hd htl, h => .cons hd (forall₂_append htl h)
+
+namespace VInductDecl
+
+namespace BlockGenerationChecked
+
+variable {source : VInductDecl} (gen : source.BlockGenerationChecked)
+
+/-! ## Named shapes of one generated rule -/
+
+theorem rule_type (i : Nat) (c : NormalizedBlockCtor) :
+    (gen.rule i c).type =
+      VExpr.forallN (gen.ruleBinders c)
+        (VExpr.appN
+          (.bvar (gen.familyCount - 1 - c.owner + gen.minorCount +
+            gen.ruleFieldCount c))
+          (gen.ruleIdx c ++ [gen.ruleCtorApp c])) := rfl
+
+theorem rule_uvars (i : Nat) (c : NormalizedBlockCtor) :
+    (gen.rule i c).uvars = gen.recUvars := rfl
+
+theorem paramsTel_length : gen.paramsTel.length = source.nparams := by
+  show ((generationParams gen.block.rawParams gen.block.checked.params).map
+    (VExpr.instL gen.sourceLevels)).length = _
+  rw [List.length_map]
+  exact (generationParams_length_of_eq gen.shape.2.1).trans gen.shape.1
+
+theorem ruleBinders_length (c : NormalizedBlockCtor) :
+    (gen.ruleBinders c).length =
+      source.nparams + gen.familyCount + gen.minorCount +
+        gen.ruleFieldCount c := by
+  simp only [ruleBinders, List.length_append, gen.paramsTel_length,
+    motiveTypes, gen.motiveTypesAux_length, minorTypes,
+    gen.minorTypesAux_length, VExpr.liftTelN_length, ruleFieldCount]
+  try omega
+
+/-- The instantiated left body as one flattened application spine. -/
+theorem ruleLhsBody_instL (c : NormalizedBlockCtor) {m1 : List VLevel}
+    (hlen1 : m1.length = gen.recUvars) :
+    (gen.ruleLhsBody c).instL m1 =
+      VExpr.appN (.const (gen.ruleRecName c) m1)
+        (VExpr.bvarRevRange (gen.ruleFieldCount c)
+            (source.nparams + gen.familyCount + gen.minorCount) ++
+          (gen.ruleIdx c).map (VExpr.instL m1) ++
+          [(gen.ruleCtorApp c).instL m1]) := by
+  show (VExpr.appN
+      (VExpr.appN (.const (gen.ruleRecName c) gen.recLevels)
+        (VExpr.bvarRevRange (gen.ruleFieldCount c)
+          (source.nparams + gen.familyCount + gen.minorCount)))
+      (gen.ruleIdx c ++ [gen.ruleCtorApp c])).instL m1 = _
+  rw [← VExpr.appN_append, VExpr.instL_appN]
+  show VExpr.appN (.const (gen.ruleRecName c)
+      (gen.recLevels.map (VLevel.inst m1))) _ = _
+  rw [show gen.recLevels.map (VLevel.inst m1) = m1 from
+    VLevel.inst_map_id hlen1]
+  rw [List.map_append, List.map_append, VExpr.bvarRevRange_map_instL,
+    List.append_assoc]
+  rfl
+
+/-- The instantiated major premise of the rule body. -/
+theorem ruleCtorApp_instL (c : NormalizedBlockCtor) (m1 : List VLevel) :
+    (gen.ruleCtorApp c).instL m1 =
+      VExpr.appN (.const c.ctor.raw.name
+          (gen.sourceLevels.map (VLevel.inst m1)))
+        (VExpr.bvarRevRange
+            (gen.ruleFieldCount c + (gen.familyCount + gen.minorCount))
+            source.nparams ++
+          VExpr.bvarRevRange 0 (gen.ruleFieldCount c)) := by
+  show (VExpr.appN (.const c.ctor.raw.name gen.sourceLevels) _).instL m1 = _
+  rw [VExpr.instL_appN, List.map_append, VExpr.bvarRevRange_map_instL,
+    VExpr.bvarRevRange_map_instL]
+  rfl
+
+/-- The captured template values are exactly the shared prefix of the
+recursor spine and the field suffix of the major premise. -/
+private theorem captureArgs_apply {c : NormalizedBlockCtor} {m1 : List VLevel}
+    {g1 : Pattern.Path
+      (Pattern.varN (.const (gen.ruleRecName c)) (gen.ruleMajorArity c)) → VExpr}
+    {g2 : Pattern.Path
+      (Pattern.varN (.const c.ctor.raw.name) (gen.ruleArgArity c)) → VExpr}
+    {fArgs aArgs : List VExpr}
+    (hg1 : (Pattern.varNPaths (.const (gen.ruleRecName c))
+      (gen.ruleMajorArity c)).map g1 = fArgs)
+    (hg2 : (Pattern.varNPaths (.const c.ctor.raw.name)
+      (gen.ruleArgArity c)).map g2 = aArgs) :
+    (gen.captureArgs c).map
+      (Pattern.RHS.apply (p := (gen.rulePattern c).toPattern) m1
+        (Sum.elim g1 g2)) =
+      fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+        aArgs.drop source.nparams := by
+  rw [captureArgs, List.map_append, List.map_map, List.map_map]
+  show List.map g1 (List.take
+      (source.nparams + gen.familyCount + gen.minorCount)
+      (Pattern.varNPaths (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c))) ++
+    List.map g2 (List.drop source.nparams
+      (Pattern.varNPaths (.const c.ctor.raw.name)
+        (gen.ruleArgArity c))) = _
+  rw [List.map_take, List.map_drop, hg1, hg2]
+
+/-- Pattern soundness for one certified block (`pat_wf`): a successful match
+of a rule's pattern whose checks hold is definitionally equal to the
+instantiated RHS template, derived from the rule defeq registered by
+`addInduct` via typed β-collapse. The redex arrives decomposed into its
+recursor and constructor spines with spine-form typing, and the major
+premise's levels pinned to the rule's source levels; both are exactly what
+a verified reduction site holds. -/
+theorem pat_wf {env : VEnv} (henv : env.WF) {univs : Nat} {Γ : List VExpr}
+    (hΓ : OnCtx Γ (env.IsType univs))
+    (hcl : gen.RuleClosure)
+    {i : Nat} {c : NormalizedBlockCtor} (h : gen.ruleEntry i c)
+    (hreg : env.defeqs (gen.rule i c))
+    (hwf : (gen.rule i c).WF env)
+    {m1 : List VLevel} {m2}
+    (hm1 : ∀ l ∈ m1, l.WF univs) (hlen1 : m1.length = gen.recUvars)
+    {fArgs aArgs : List VExpr}
+    (hMlen : fArgs.length = gen.ruleMajorArity c)
+    (hNlen : aArgs.length = gen.ruleArgArity c)
+    (hm : ((gen.rulePattern c).toPattern).Matches
+      (.app (VExpr.appN (.const (gen.ruleRecName c) m1) fArgs)
+        (VExpr.appN (.const c.ctor.raw.name
+          (gen.sourceLevels.map (VLevel.inst m1))) aArgs)) m1 m2)
+    (hck : (gen.ruleCheck hcl (List.mem_of_getElem? h)).OK
+      (env.IsDefEqU univs Γ) m1 m2)
+    {Frec Ae : VExpr}
+    (hehead : env.HasType univs Γ (.const (gen.ruleRecName c) m1) Frec)
+    (hespine : env.SpineWF univs Γ Frec
+      (fArgs ++ [VExpr.appN (.const c.ctor.raw.name
+        (gen.sourceLevels.map (VLevel.inst m1))) aArgs]) Ae)
+    {Fctor Actor : VExpr}
+    (hctorhead : env.HasType univs Γ
+      (.const c.ctor.raw.name (gen.sourceLevels.map (VLevel.inst m1))) Fctor)
+    (hctorspine : env.SpineWF univs Γ Fctor aArgs Actor)
+    {B : VExpr}
+    (hcaps : env.SpineWF univs Γ ((gen.rule i c).type.instL m1)
+      (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+        aArgs.drop source.nparams) B) :
+    env.IsDefEqU univs Γ
+      (.app (VExpr.appN (.const (gen.ruleRecName c) m1) fArgs)
+        (VExpr.appN (.const c.ctor.raw.name
+          (gen.sourceLevels.map (VLevel.inst m1))) aArgs))
+      ((gen.ruleRHS hcl h).apply m1 m2) := by
+  have henvo := henv.ordered
+  have hc := List.mem_of_getElem? h
+  cases hm with
+  | @app _ _ _ g1 _ _ f2 g2 h1 h2 =>
+  -- canonical captures
+  have hg1 : (Pattern.varNPaths (.const (gen.ruleRecName c))
+      (gen.ruleMajorArity c)).map g1 = fArgs :=
+    Pattern.varN_matches_paths _ fArgs h1 hMlen
+  have hg2 : (Pattern.varNPaths (.const c.ctor.raw.name)
+      (gen.ruleArgArity c)).map g2 = aArgs :=
+    Pattern.varN_matches_paths _ aArgs h2 hNlen
+  have hcapsVals := gen.captureArgs_apply (m1 := m1) hg1 hg2
+  -- length bookkeeping
+  have hcommon_le : source.nparams + gen.familyCount + gen.minorCount ≤
+      gen.ruleMajorArity c := Nat.le_add_right _ _
+  have hnp_le : source.nparams ≤ gen.ruleArgArity c := Nat.le_add_right _ _
+  have htakelen : (fArgs.take (source.nparams + gen.familyCount +
+      gen.minorCount)).length =
+      source.nparams + gen.familyCount + gen.minorCount := by
+    rw [List.length_take, hMlen]; omega
+  have hdroplen : (aArgs.drop source.nparams).length =
+      gen.ruleFieldCount c := by
+    rw [List.length_drop, hNlen]
+    show gen.ruleArgArity c - source.nparams = _
+    simp only [ruleArgArity]; omega
+  have hcapslen : (fArgs.take (source.nparams + gen.familyCount +
+      gen.minorCount) ++ aArgs.drop source.nparams).length =
+      ((gen.ruleBinders c).map (VExpr.instL m1)).length := by
+    rw [List.length_append, htakelen, hdroplen, List.length_map,
+      gen.ruleBinders_length]
+  -- tower shapes
+  have htype' : (gen.rule i c).type.instL m1 =
+      VExpr.forallN ((gen.ruleBinders c).map (VExpr.instL m1))
+        ((VExpr.appN
+          (.bvar (gen.familyCount - 1 - c.owner + gen.minorCount +
+            gen.ruleFieldCount c))
+          (gen.ruleIdx c ++ [gen.ruleCtorApp c])).instL m1) := by
+    rw [gen.rule_type, VExpr.instL_forallN]
+  have hlhs' : (gen.rule i c).lhs.instL m1 =
+      VExpr.lamN ((gen.ruleBinders c).map (VExpr.instL m1))
+        ((gen.ruleLhsBody c).instL m1) := by
+    rw [gen.rule_lhs, VExpr.instL_lamN]
+  -- tower typing at the working context
+  have hlhsT : env.HasType univs Γ
+      (VExpr.lamN ((gen.ruleBinders c).map (VExpr.instL m1))
+        ((gen.ruleLhsBody c).instL m1))
+      ((gen.rule i c).type.instL m1) := by
+    rw [← hlhs']
+    exact (hwf.1.instL hm1).weak0 henvo
+  obtain ⟨hTel, T₀, hbody⟩ := VEnv.HasType.lamN_wf henvo hΓ hlhsT
+  -- β-collapse of the applied left tower
+  have hcapsF : env.SpineWF univs Γ
+      (VExpr.forallN ((gen.ruleBinders c).map (VExpr.instL m1))
+        ((VExpr.appN
+          (.bvar (gen.familyCount - 1 - c.owner + gen.minorCount +
+            gen.ruleFieldCount c))
+          (gen.ruleIdx c ++ [gen.ruleCtorApp c])).instL m1))
+      (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+        aArgs.drop source.nparams) B := htype' ▸ hcaps
+  have hretT0 := (VEnv.SpineWF.retarget hcapsF hcapslen) T₀
+  have hcollapseL := VEnv.IsDefEq.appN_lamN henvo hTel hbody hretT0 hcapslen
+  -- the registered defeq, applied
+  have hex : env.IsDefEq univs Γ ((gen.rule i c).lhs.instL m1)
+      ((gen.rule i c).rhs.instL m1) ((gen.rule i c).type.instL m1) :=
+    .extra hreg hm1 hlen1
+  rw [hlhs'] at hex
+  have happlied := VEnv.IsDefEq.appN_congr hex hcaps
+  -- conclusion-side template computation
+  have hRHS : Pattern.RHS.apply (p := (gen.rulePattern c).toPattern) m1
+      (Sum.elim g1 g2) (gen.ruleRHS hcl h) =
+      VExpr.appN ((gen.rule i c).rhs.instL m1)
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          aArgs.drop source.nparams) := by
+    rw [ruleRHS]
+    simp only [Pattern.RHS.appN_apply, hcapsVals]
+    rfl
+  -- typing of the rule type's index spine
+  obtain ⟨u₀, htypeT⟩ := hlhsT.isType henvo hΓ
+  rw [htype'] at htypeT
+  obtain ⟨-, V', htypeBody⟩ := VEnv.HasType.forallN_wf henvo htypeT
+  have hCtxTel : OnCtx (((gen.ruleBinders c).map (VExpr.instL m1)).reverse ++ Γ)
+      (env.IsType univs) := VEnv.OnTel.onCtx hΓ hTel
+  rw [show ((VExpr.appN
+      (.bvar (gen.familyCount - 1 - c.owner + gen.minorCount +
+        gen.ruleFieldCount c))
+      (gen.ruleIdx c ++ [gen.ruleCtorApp c])).instL m1) =
+    VExpr.appN (.bvar (gen.familyCount - 1 - c.owner + gen.minorCount +
+        gen.ruleFieldCount c))
+      ((gen.ruleIdx c ++ [gen.ruleCtorApp c]).map (VExpr.instL m1)) from by
+      rw [VExpr.instL_appN]; rfl] at htypeBody
+  have hargsWF := VEnv.HasType.appN_args_wf henv hCtxTel _ _ rfl htypeBody
+  -- check extraction
+  unfold ruleCheck at hck
+  obtain ⟨hparams, hidxOK⟩ := Pattern.Check.OK.of_foldr _ _ hck
+  obtain ⟨hidxs, -⟩ := Pattern.Check.OK.of_foldr _ _ hidxOK
+  -- per-index tower collapse and check composition
+  have hidxLink : ∀ x ∈ (gen.ruleIdx c).attach.zip
+      ((Pattern.varNPaths (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c)).drop
+        (source.nparams + gen.familyCount + gen.minorCount)),
+      env.IsDefEqU univs Γ (Sum.elim g1 g2 (Sum.inl x.2))
+        (VExpr.instRev (x.1.1.instL m1)
+          (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+            aArgs.drop source.nparams)) := by
+    intro x hx
+    have hfact := hidxs x hx
+    simp only [Pattern.RHS.appN_apply, hcapsVals] at hfact
+    have htower : Pattern.RHS.apply (p := (gen.rulePattern c).toPattern) m1
+        (Sum.elim g1 g2)
+        (.fixed (VExpr.lamN (gen.ruleBinders c) x.1.1)
+          (hcl.idxTower_closed hc x.1.1 x.1.2)) =
+        VExpr.lamN ((gen.ruleBinders c).map (VExpr.instL m1))
+          (x.1.1.instL m1) := by
+      show (VExpr.lamN (gen.ruleBinders c) x.1.1).instL m1 = _
+      rw [VExpr.instL_lamN]
+    rw [htower] at hfact
+    obtain ⟨Tx, hTx⟩ := hargsWF (x.1.1.instL m1)
+      (by
+        rw [List.map_append]
+        exact List.mem_append.2 (.inl (List.mem_map_of_mem x.1.2)))
+    have hretTx := (VEnv.SpineWF.retarget hcapsF hcapslen) Tx
+    have hcollapseX := VEnv.IsDefEq.appN_lamN henvo hTel hTx hretTx hcapslen
+    exact VEnv.IsDefEqU.trans henv hΓ hfact ⟨_, hcollapseX⟩
+  -- major premise: constructor spine against its rebuilt form
+  have hparamsF₂ : List.Forall₂
+      (fun a a' => a = a' ∨ env.IsDefEqU univs Γ a a')
+      aArgs
+      (fArgs.take source.nparams ++ aArgs.drop source.nparams) := by
+    have hb := forall₂_zip_map (α := Pattern.Path
+        (Pattern.varN (.const c.ctor.raw.name) (gen.ruleArgArity c)))
+      (β := Pattern.Path
+        (Pattern.varN (.const (gen.ruleRecName c)) (gen.ruleMajorArity c)))
+      g2 g1 (fun a a' => a = a' ∨ env.IsDefEqU univs Γ a a')
+      ((Pattern.varNPaths (.const c.ctor.raw.name)
+        (gen.ruleArgArity c)).take source.nparams)
+      ((Pattern.varNPaths (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c)).take source.nparams)
+      (by
+        rw [List.length_take, List.length_take,
+          Pattern.varNPaths_length, Pattern.varNPaths_length]
+        omega)
+      (fun p hp => Or.inr (hparams p hp))
+    rw [List.map_take, List.map_take, hg1, hg2] at hb
+    have hall := forall₂_append hb
+      (forall₂_refl_or (R := env.IsDefEqU univs Γ)
+        (aArgs.drop source.nparams))
+    rwa [List.take_append_drop] at hall
+  have hmajorLink : env.IsDefEqU univs Γ
+      (VExpr.appN (.const c.ctor.raw.name
+        (gen.sourceLevels.map (VLevel.inst m1))) aArgs)
+      (VExpr.appN (.const c.ctor.raw.name
+        (gen.sourceLevels.map (VLevel.inst m1)))
+        (fArgs.take source.nparams ++ aArgs.drop source.nparams)) :=
+    ⟨_, VEnv.IsDefEq.appN_defEq hctorhead
+      (VEnv.SpineWF.defEq_of_pointwise henv hΓ hctorspine hparamsF₂)⟩
+  -- the collapsed left spine, computed
+  have hL : (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+      aArgs.drop source.nparams).length =
+      gen.ruleFieldCount c +
+        (source.nparams + gen.familyCount + gen.minorCount) := by
+    rw [List.length_append, htakelen, hdroplen]; omega
+  have hcapsTake : (fArgs.take (source.nparams + gen.familyCount +
+      gen.minorCount) ++ aArgs.drop source.nparams).take
+      (source.nparams + gen.familyCount + gen.minorCount) =
+      fArgs.take (source.nparams + gen.familyCount + gen.minorCount) := by
+    rw [List.take_append_of_le_length (by omega : _ ≤ (fArgs.take
+      (source.nparams + gen.familyCount + gen.minorCount)).length)]
+    exact List.take_of_length_le (Nat.le_of_eq htakelen)
+  have hcapsTakeNp : (fArgs.take (source.nparams + gen.familyCount +
+      gen.minorCount) ++ aArgs.drop source.nparams).take source.nparams =
+      fArgs.take source.nparams := by
+    rw [List.take_append_of_le_length (by omega : _ ≤ (fArgs.take
+      (source.nparams + gen.familyCount + gen.minorCount)).length)]
+    rw [List.take_take]
+    congr 1
+    omega
+  have hcapsDrop : (fArgs.take (source.nparams + gen.familyCount +
+      gen.minorCount) ++ aArgs.drop source.nparams).drop
+      (source.nparams + gen.familyCount + gen.minorCount) =
+      aArgs.drop source.nparams := by
+    have hdl := List.drop_left (l₁ := fArgs.take (source.nparams + gen.familyCount + gen.minorCount)) (l₂ := aArgs.drop source.nparams)
+    rwa [htakelen] at hdl
+  have hsegNp : (VExpr.bvarRevRange
+      (gen.ruleFieldCount c + (gen.familyCount + gen.minorCount))
+      source.nparams).map (VExpr.instRev ·
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          aArgs.drop source.nparams)) = fArgs.take source.nparams := by
+    rw [VExpr.map_instRev_bvarRevRange_seg _ source.nparams _ (by omega)]
+    rw [show (fArgs.take (source.nparams + gen.familyCount +
+        gen.minorCount) ++ aArgs.drop source.nparams).length -
+        (gen.ruleFieldCount c + (gen.familyCount + gen.minorCount)) -
+        source.nparams = 0 from by omega, List.drop_zero]
+    exact hcapsTakeNp
+  have hsegFld : (VExpr.bvarRevRange 0 (gen.ruleFieldCount c)).map
+      (VExpr.instRev ·
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          aArgs.drop source.nparams)) = aArgs.drop source.nparams := by
+    rw [VExpr.map_instRev_bvarRevRange_seg _ (gen.ruleFieldCount c) 0
+      (by omega)]
+    rw [show (fArgs.take (source.nparams + gen.familyCount +
+        gen.minorCount) ++ aArgs.drop source.nparams).length - 0 -
+        gen.ruleFieldCount c =
+        source.nparams + gen.familyCount + gen.minorCount from by omega]
+    rw [hcapsDrop]
+    exact List.take_of_length_le (Nat.le_of_eq hdroplen)
+  have hsegCommon : (VExpr.bvarRevRange (gen.ruleFieldCount c)
+      (source.nparams + gen.familyCount + gen.minorCount)).map
+      (VExpr.instRev ·
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          aArgs.drop source.nparams)) =
+      fArgs.take (source.nparams + gen.familyCount + gen.minorCount) := by
+    rw [VExpr.map_instRev_bvarRevRange_seg _
+      (source.nparams + gen.familyCount + gen.minorCount)
+      (gen.ruleFieldCount c) (by omega)]
+    rw [show (fArgs.take (source.nparams + gen.familyCount +
+        gen.minorCount) ++ aArgs.drop source.nparams).length -
+        gen.ruleFieldCount c -
+        (source.nparams + gen.familyCount + gen.minorCount) = 0 from by
+        omega, List.drop_zero]
+    exact hcapsTake
+  have hctorImg : VExpr.instRev ((gen.ruleCtorApp c).instL m1)
+      (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+        aArgs.drop source.nparams) =
+      VExpr.appN (.const c.ctor.raw.name
+          (gen.sourceLevels.map (VLevel.inst m1)))
+        (fArgs.take source.nparams ++ aArgs.drop source.nparams) := by
+    rw [gen.ruleCtorApp_instL, VExpr.instRev_appN,
+      VExpr.instRev_closedN (C := .const c.ctor.raw.name
+        (gen.sourceLevels.map (VLevel.inst m1))) _ trivial, List.map_append,
+      hsegNp, hsegFld]
+  have hcollapsedEq : VExpr.instRev ((gen.ruleLhsBody c).instL m1)
+      (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+        aArgs.drop source.nparams) =
+      VExpr.appN (.const (gen.ruleRecName c) m1)
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          ((gen.ruleIdx c).map (fun x => VExpr.instRev (x.instL m1)
+            (fArgs.take (source.nparams + gen.familyCount +
+              gen.minorCount) ++ aArgs.drop source.nparams)) ++
+          [VExpr.appN (.const c.ctor.raw.name
+              (gen.sourceLevels.map (VLevel.inst m1)))
+            (fArgs.take source.nparams ++ aArgs.drop source.nparams)])) := by
+    rw [gen.ruleLhsBody_instL c hlen1, VExpr.instRev_appN,
+      VExpr.instRev_closedN (C := .const (gen.ruleRecName c) m1) _ trivial,
+      List.map_append, List.map_append, hsegCommon, List.map_map]
+    rw [show ((gen.ruleCtorApp c).instL m1 ::
+        ([] : List VExpr)).map (VExpr.instRev ·
+          (fArgs.take (source.nparams + gen.familyCount +
+            gen.minorCount) ++ aArgs.drop source.nparams)) =
+        [VExpr.instRev ((gen.ruleCtorApp c).instL m1)
+          (fArgs.take (source.nparams + gen.familyCount +
+            gen.minorCount) ++ aArgs.drop source.nparams)] from rfl]
+    rw [hctorImg]
+    simp only [Function.comp_def]
+    rw [List.append_assoc]
+  -- pointwise defeq between the redex spine and the collapsed spine
+  have hidxF₂ : List.Forall₂ (fun a a' => a = a' ∨ env.IsDefEqU univs Γ a a')
+      (fArgs.drop (source.nparams + gen.familyCount + gen.minorCount))
+      ((gen.ruleIdx c).map (fun x => VExpr.instRev (x.instL m1)
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          aArgs.drop source.nparams))) := by
+    have hb := forall₂_zip_map
+      (α := {x // x ∈ gen.ruleIdx c})
+      (β := Pattern.Path (Pattern.varN (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c)))
+      (fun s => VExpr.instRev (s.1.instL m1)
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+          aArgs.drop source.nparams))
+      (fun p => Sum.elim g1 g2 (Sum.inl p))
+      (fun t v => v = t ∨ env.IsDefEqU univs Γ v t)
+      (gen.ruleIdx c).attach
+      ((Pattern.varNPaths (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c)).drop
+        (source.nparams + gen.familyCount + gen.minorCount))
+      (by
+        rw [List.length_attach, List.length_drop, Pattern.varNPaths_length]
+        show (gen.ruleIdx c).length = gen.ruleMajorArity c - _
+        simp only [ruleIdx, ruleMajorArity, List.length_map]
+        omega)
+      (fun p hp => Or.inr (hidxLink p hp))
+    have hflip := List.Forall₂.flip hb
+    have hmapG : ((Pattern.varNPaths (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c)).drop
+        (source.nparams + gen.familyCount + gen.minorCount)).map
+        (fun p => Sum.elim g1 g2 (Sum.inl p)) =
+        fArgs.drop (source.nparams + gen.familyCount + gen.minorCount) := by
+      show ((Pattern.varNPaths (.const (gen.ruleRecName c))
+        (gen.ruleMajorArity c)).drop
+        (source.nparams + gen.familyCount + gen.minorCount)).map g1 = _
+      rw [List.map_drop, hg1]
+    have hmapF : ((gen.ruleIdx c).attach).map
+        (fun s => VExpr.instRev (s.1.instL m1)
+          (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+            aArgs.drop source.nparams)) =
+        (gen.ruleIdx c).map (fun x => VExpr.instRev (x.instL m1)
+          (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+            aArgs.drop source.nparams)) := by
+      exact List.attach_map_val
+        (f := fun x : VExpr => VExpr.instRev (x.instL m1)
+          (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+            aArgs.drop source.nparams)) ..
+    rw [hmapG, hmapF] at hflip
+    exact hflip
+  have hbigF₂ : List.Forall₂ (fun a a' => a = a' ∨ env.IsDefEqU univs Γ a a')
+      (fArgs ++ [VExpr.appN (.const c.ctor.raw.name
+        (gen.sourceLevels.map (VLevel.inst m1))) aArgs])
+      (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+        ((gen.ruleIdx c).map (fun x => VExpr.instRev (x.instL m1)
+          (fArgs.take (source.nparams + gen.familyCount + gen.minorCount) ++
+            aArgs.drop source.nparams)) ++
+        [VExpr.appN (.const c.ctor.raw.name
+            (gen.sourceLevels.map (VLevel.inst m1)))
+          (fArgs.take source.nparams ++ aArgs.drop source.nparams)])) := by
+    have hres := forall₂_append
+      (forall₂_refl_or (R := env.IsDefEqU univs Γ)
+        (fArgs.take (source.nparams + gen.familyCount + gen.minorCount)))
+      (forall₂_append hidxF₂ (.cons (Or.inr hmajorLink) .nil))
+    rwa [← List.append_assoc, List.take_append_drop] at hres
+  -- the redex is defeq to the collapsed left spine
+  have hE := VEnv.IsDefEq.appN_defEq hehead
+    (VEnv.SpineWF.defEq_of_pointwise henv hΓ hespine hbigF₂)
+  rw [← hcollapsedEq, VExpr.appN_append] at hE
+  -- assemble
+  rw [hRHS]
+  exact VEnv.IsDefEqU.trans henv hΓ ⟨_, hE⟩
+    (VEnv.IsDefEqU.trans henv hΓ ⟨_, hcollapseL.symm⟩ ⟨_, happlied⟩)
+
+end BlockGenerationChecked
+
+end VInductDecl
+
+end Ix.Theory.Named
+
+/-! ## Axiom closures
+
+The typed β-collapse layer is sorry-free. `pat_wf` composes typed defeqs
+through `IsDefEqU.of_l`/`IsDefEqU.trans` and therefore carries exactly the
+transitional unique-typing closure the Church–Rosser development itself
+carries; it sheds `sorryAx` automatically when the Spec-16/17 inversion
+milestones land, with no restatement. -/
+
+#guard_named_axioms Ix.Theory.Named.VEnv.IsDefEq.appN_lamN [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.IsDefEq.appN_defEq [propext]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.LE.extra [propext]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.LE.extra_appN [propext]
+
+#guard_named_axioms Ix.Theory.Named.VEnv.LE.extra_appN_symm [propext]
+
+#guard_named_axioms Ix.Theory.Named.Pattern.varN_matches_paths [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.BlockGenerationChecked.pat_wf [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Quot.sound]
diff --git a/Ix/Theory/Named/Typing/Injectivity.lean b/Ix/Theory/Named/Typing/Injectivity.lean
new file mode 100644
index 000000000..6a69aad14
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Injectivity.lean
@@ -0,0 +1,43 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.EnvLemmas
+import Ix.Theory.Named.Typing.Strong
+
+/-!
+A bunch of important structural theorems which we can't prove :(
+-/
+
+namespace Ix.Theory.Named
+namespace VEnv
+
+set_option warn.sorry false in
+theorem IsDefEqU.sort_inv (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ (.sort u) (.sort v)) : u ≈ v := sorry
+
+set_option warn.sorry false in
+theorem IsDefEqU.forallE_inv_stratified (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ (.forallE A B) (.forallE A' B'))
+    (h2 : env.HasTypeStratified U Γ (.forallE A B) V true n)
+    (h3 : env.HasTypeStratified U Γ (.forallE A' B') V' true n') :
+    (∃ u, env.IsDefEq U Γ A A' (.sort u) ∧ env.HasTypeStratified U Γ A (.sort u) true n) ∧
+    ∃ u, env.IsDefEq U (A::Γ) B B' (.sort u) ∧
+      env.HasTypeStratified U (A::Γ) B (.sort u) true n ∧
+      env.HasTypeStratified U (A'::Γ) B' (.sort u) true n' := sorry
+
+theorem IsDefEqU.forallE_inv (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ (.forallE A B) (.forallE A' B')) :
+    (∃ u, env.IsDefEq U Γ A A' (.sort u)) ∧ ∃ u, env.IsDefEq U (A::Γ) B B' (.sort u) :=
+  let ⟨_, eq⟩ := h1
+  let ⟨h2, h3⟩ := (eq.strong henv hΓ).hasType'
+  let ⟨_, h2⟩ := h2.stratify
+  let ⟨_, h3⟩ := h3.stratify
+  let ⟨⟨_, a1, _⟩, _, a2, _⟩ := IsDefEqU.forallE_inv_stratified henv hΓ h1 h2 h3
+  ⟨⟨_, a1⟩, _, a2⟩
+
+set_option warn.sorry false in
+theorem IsDefEqU.sort_forallE_inv (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U)) :
+    ¬env.IsDefEqU U Γ (.sort u) (.forallE A B) := sorry
diff --git a/Ix/Theory/Named/Typing/Lemmas.lean b/Ix/Theory/Named/Typing/Lemmas.lean
new file mode 100644
index 000000000..36e44bafb
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Lemmas.lean
@@ -0,0 +1,1115 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Basic
+import Ix.Theory.Named.Std.VariableBang
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+open Ix.Theory.Named VExpr
+
+inductive Ctx.LiftN (n : Nat) : Nat → List VExpr → List VExpr → Prop where
+  | zero (As) (h : As.length = n := by rfl) : Ctx.LiftN n 0 Γ (As ++ Γ)
+  | succ : Ctx.LiftN n k Γ Γ' → Ctx.LiftN n (k+1) (A::Γ) (A.liftN n k :: Γ')
+
+theorem Ctx.LiftN.one : Ctx.LiftN 1 0 Γ (A::Γ) := .zero [_]
+
+theorem Ctx.LiftN.isSuffix (H : Ctx.LiftN n k Γ Γ') :
+    ∃ Γ₀ As Δ Δ',
+      As.length = n ∧ Δ.length = k ∧ Δ'.length = k ∧
+      Γ = Δ ++ Γ₀ ∧ Γ' = Δ' ++ As ++ Γ₀ := by
+  induction H with
+  | @zero Γ As h => exact ⟨Γ, As, [], [], h, rfl, rfl, rfl, rfl⟩
+  | succ _ ih =>
+    obtain ⟨_, _, Δ, Δ', hn, hΔ, hΔ', rfl, rfl⟩ := ih
+    exact ⟨_, _, _ :: Δ, _ :: Δ', hn, by simp [hΔ], by simp [hΔ'], rfl, rfl⟩
+
+theorem Ctx.LiftN.comp (h1 : k1 ≤ k2) (h2 : k2 ≤ n1 + k1) :
+    Ctx.LiftN n1 k1 Γ₀ Γ₁ → Ctx.LiftN n2 k2 Γ₁ Γ₂ → Ctx.LiftN (n1+n2) k1 Γ₀ Γ₂
+  | .zero As h, H2 => by
+    obtain ⟨Γ₀', _, Δ, Δ', hn, hΔ, hΔ', eq, rfl⟩ := H2.isSuffix
+    obtain ⟨As, rfl, rfl⟩ := (List.append_eq_append_of_length_le (by rwa [h, hΔ])).1 eq.symm
+    rw [← List.append_assoc]
+    exact .zero _ (by simp [← h, hΔ, hΔ', hn, Nat.add_left_comm, Nat.add_comm])
+  | .succ H1, .succ H2 =>
+    have h1 := Nat.le_of_succ_le_succ h1
+    have h2 := Nat.le_of_succ_le_succ h2
+    liftN'_liftN' h1 h2 ▸ (H1.comp h1 h2 H2).succ
+
+inductive Ctx.Lift' : Lift → List VExpr → List VExpr → Prop where
+  | refl : Ctx.Lift' .refl Γ Γ
+  | skip : Ctx.Lift' l Γ Γ' → Ctx.Lift' (.skip l) Γ (A :: Γ')
+  | cons : Ctx.Lift' l Γ Γ' → Ctx.Lift' (.cons l) (A::Γ) (A.lift' l :: Γ')
+
+theorem Ctx.liftN_iff_lift' : Ctx.LiftN n k Γ Γ' ↔ Ctx.Lift' (.consN (.skipN .refl n) k) Γ Γ' := by
+  constructor <;> intro h
+  · induction h with
+    | zero As =>
+      subst n
+      induction As with
+      | nil => simp [Lift'.refl]
+      | cons _ _ ih => exact .skip ih
+    | succ _ ih => rw [← lift'_consN_skipN]; exact .cons ih
+  · induction k generalizing Γ Γ' with
+    | zero =>
+      obtain ⟨_, rfl, eq⟩ : ∃ As, Γ' = As ++ Γ ∧ As.length = n := by
+        induction n generalizing Γ' with
+        | zero => cases h; exact ⟨[], rfl, rfl⟩
+        | succ n ih => let .skip h := h; obtain ⟨_, rfl, rfl⟩ := ih h; exact ⟨_::_, rfl, rfl⟩
+      exact .zero _ eq
+    | succ k ih => let .cons h := h; rw [lift'_consN_skipN]; exact .succ (ih h)
+
+theorem Ctx.Lift'.comp (H1 : Ctx.Lift' l₁ Γ₁ Γ₂) (H2 : Ctx.Lift' l₂ Γ₂ Γ₃) :
+    Ctx.Lift' (.comp l₁ l₂) Γ₁ Γ₃ := by
+  induction H2 generalizing l₁ Γ₁ with
+  | refl => exact H1
+  | skip _ ih => exact .skip (ih H1)
+  | cons H2 ih =>
+    cases H1 with
+    | refl => exact .cons H2
+    | skip H1 => exact .skip (ih H1)
+    | cons H1 => rw [← VExpr.lift'_comp]; exact .cons (ih H1)
+
+theorem Ctx.Lift'.of_cons_skip (H : Ctx.Lift' (Lift.consN (.skip l) k) Γ₁ Γ₃) :
+    ∃ Γ₂, Ctx.Lift' (Lift.consN l k) Γ₁ Γ₂ ∧ Ctx.LiftN 1 k Γ₂ Γ₃ := by
+  induction k generalizing Γ₁ Γ₃ with
+  | zero => let .skip H := H; exact ⟨_, H, .one⟩
+  | succ k ih =>
+    let .cons (A := A) H := H
+    let ⟨_, h1, h2⟩ := ih H
+    refine ⟨_, .cons h1, ?_⟩
+    simp only [Ctx.liftN_iff_lift'] at h2 ⊢
+    simpa [← VExpr.lift'_comp, ← Lift.consN_comp] using h2.cons (A := lift' A (.consN l k))
+
+theorem Ctx.Lift'.depth_zero (h : l.depth = 0) : Ctx.Lift' l Γ Γ' → Γ = Γ'
+  | .refl => rfl
+  | .cons (l := l) H => by rw [VExpr.lift'_depth_zero (l := l) h, H.depth_zero (l := l) h]
+
+variable (Γ₀ : List VExpr) (e₀ A₀ : VExpr) in
+inductive Ctx.InstN : Nat → List VExpr → List VExpr → Prop where
+  | zero : Ctx.InstN 0 (A₀ :: Γ₀) Γ₀
+  | succ : Ctx.InstN k Γ Γ' → Ctx.InstN (k+1) (A::Γ) (A.inst e₀ k :: Γ')
+
+theorem Lookup.lt (H : Lookup Γ i A) : i < Γ.length := by
+  induction H with
+  | zero => apply Nat.succ_pos
+  | succ _ ih => apply Nat.succ_lt_succ ih
+
+def Lookup.ofLt (hi : i < Γ.length) : {A // Lookup Γ i A} :=
+  match Γ, i with
+  | _::_, 0 => ⟨_, .zero⟩
+  | _::_, _+1 => let ⟨_, h⟩ := ofLt (Nat.lt_of_succ_lt_succ hi); ⟨_, .succ h⟩
+
+theorem Lookup.uniq (hA : Lookup Γ i A) (hB : Lookup Γ i B) : A = B :=
+  match hA, hB with
+  | .zero, .zero => rfl
+  | .succ hA, .succ hB => Lookup.uniq hA hB ▸ rfl
+
+theorem Lookup.weak' (W : Ctx.Lift' ρ Γ Γ') (H : Lookup Γ i A) :
+    Lookup Γ' (ρ.liftVar i) (A.lift' ρ) := by
+  induction W generalizing i A with
+  | refl => simp; exact H
+  | skip W ih => have' := (ih H).succ; rwa [VExpr.lift_eq_lift', ← VExpr.lift'_comp] at this
+  | cons W ih =>
+    cases H with
+    | zero => refine' cast _ Lookup.zero; congr 1; simp [VExpr.lift_eq_lift', ← VExpr.lift'_comp]
+    | succ H => refine' cast _ (ih H).succ; congr 1; simp [VExpr.lift_eq_lift', ← VExpr.lift'_comp]
+
+theorem Lookup.weakN (W : Ctx.LiftN n k Γ Γ') (H : Lookup Γ i A) :
+    Lookup Γ' (liftVar n i k) (A.liftN n k) := by
+  simp [← Lift.liftVar_consN_skipN, ← VExpr.lift'_consN_skipN]
+  exact H.weak' (Ctx.liftN_iff_lift'.1 W)
+
+theorem Lookup.weakU_inv (W : Ctx.Lift' ρ Γ Γ')
+    (H : Lookup Γ' (ρ.liftVar i) A') : ∃ A, A' = A.lift' ρ ∧ Lookup Γ i A := by
+  induction W generalizing i A' with
+  | refl => simpa using H
+  | @skip ρ W _ _ _ ih =>
+    simp at H; let .succ H := H
+    obtain ⟨_, rfl, h2⟩ := ih H; refine ⟨_, ?_, h2⟩
+    rw [VExpr.lift_eq_lift', ← VExpr.lift'_comp]; rfl
+  | @cons ρ Γ Δ B W ih =>
+    cases i with
+    | zero => cases H; exact ⟨_, by simp [VExpr.lift_eq_lift', ← VExpr.lift'_comp], .zero⟩
+    | succ i =>
+      let .succ (ty := C) H := H
+      obtain ⟨C, rfl, h⟩ := ih H
+      refine ⟨_, ?_, .succ h⟩
+      simp [VExpr.lift_eq_lift', ← VExpr.lift'_comp]
+
+theorem Lookup.weak'_iff (W : Ctx.Lift' ρ Γ Γ') :
+    Lookup Γ' (ρ.liftVar i) (A.lift' ρ) ↔ Lookup Γ i A := by
+  refine ⟨fun H => ?_, fun H => H.weak' W⟩
+  let ⟨_, h1, h2⟩ := H.weakU_inv W
+  exact VExpr.lift'_inj.1 h1 ▸ h2
+
+theorem Lookup.weakN_iff (W : Ctx.LiftN n k Γ Γ') :
+    Lookup Γ' (liftVar n i k) (A.liftN n k) ↔ Lookup Γ i A := by
+  simp [← Lift.liftVar_consN_skipN, ← VExpr.lift'_consN_skipN]
+  exact weak'_iff (Ctx.liftN_iff_lift'.1 W)
+
+theorem Lookup.instL : Lookup Γ i A → Lookup (Γ.map (VExpr.instL ls)) i (A.instL ls)
+  | .zero => instL_liftN ▸ .zero
+  | .succ h => instL_liftN ▸ .succ h.instL
+
+theorem OnCtx.lookup (h : OnCtx Γ P) (hL : Lookup Γ n A)
+    (hP : ∀ {Γ A B}, P Γ A → P (B::Γ) A.lift) : P Γ A :=
+  match hL, h with
+  | .zero, ⟨h1, h2⟩ => hP h2
+  | .succ hL, ⟨h1, h2⟩ => hP (h1.lookup hL hP)
+
+theorem OnCtx.mono (H : ∀ {Γ A}, P Γ A → Q Γ A) : ∀ {Γ}, OnCtx Γ P → OnCtx Γ Q
+  | [], h => h
+  | _::_, ⟨h1, h2⟩ => ⟨mono H h1, H h2⟩
+
+def CtxClosed : List VExpr → Prop := (OnCtx · fun Γ A => A.ClosedN Γ.length)
+
+theorem CtxClosed.lookup (h : CtxClosed Γ) (hL : Lookup Γ n A) : A.ClosedN Γ.length :=
+  match hL, h with
+  | .zero, ⟨h1, h2⟩ => h2.liftN
+  | .succ hL, ⟨h1, h2⟩ => (CtxClosed.lookup h1 hL).liftN
+
+theorem Ctx.LiftN.right (h : CtxClosed Γ) (Γ') : Ctx.LiftN Γ'.length Γ.length Γ (Γ ++ Γ') :=
+  match Γ, h with
+  | [], _ => by simpa using LiftN.zero (Γ := []) Γ'
+  | A :: Γ, ⟨h1, h2⟩ => by
+    simpa [h2.liftN_eq (Nat.le_refl _)] using LiftN.succ (LiftN.right h1 Γ') (A := A)
+
+theorem VStructEta.WF.mono {rule : VStructEta} {env env' : VEnv}
+    (henv : env ≤ env') (self : VStructEta.WF rule env) :
+    VStructEta.WF rule env' where
+  familyType_closed := self.familyType_closed
+  rebuild_hasType hle := self.rebuild_hasType (henv.trans hle)
+
+inductive VObject where
+  | const (n : Name) (ci : VConstant)
+  | defeq (df : VDefEq)
+
+namespace VEnv
+
+theorem addConst_le {env env' : VEnv} (h : env.addConst n ci = some env') : env ≤ env' := by
+  unfold addConst at h; split at h <;> cases h
+  exact ⟨fun _ => by simp; split <;> simp_all, by simp [*], by simp [*]⟩
+
+theorem addConst_self {env env' : VEnv} (h : env.addConst n ci = some env') :
+    env'.constants n = some ci := by
+  unfold addConst at h; split at h <;> cases h; simp
+
+/-- A successful insertion certifies that its name was fresh in the input
+environment. -/
+theorem addConst_fresh {env env' : VEnv} (h : env.addConst n ci = some env') :
+    env.constants n = none := by
+  unfold addConst at h
+  split at h <;> simp_all
+
+/-- Environment inclusion is preserved when the same fresh constant is
+inserted on both sides. This is the commuting square needed to replay a
+declaration after an unrelated prefix environment. -/
+theorem LE.addConst {env₁ env₂ env₁' env₂' : VEnv} (henv : env₁ ≤ env₂)
+    (h₁ : env₁.addConst n ci = some env₁')
+    (h₂ : env₂.addConst n ci = some env₂') : env₁' ≤ env₂' := by
+  unfold VEnv.addConst at h₁ h₂
+  split at h₁ <;> cases h₁
+  split at h₂ <;> cases h₂
+  exact {
+    constants := fun h => by
+      simp at h ⊢
+      split at h <;> split <;> simp_all
+      exact henv.constants h
+    defeqs := henv.defeqs
+    structEtas := henv.structEtas }
+
+/-- Absence of a constant pulls back along environment growth. -/
+theorem LE.constants_none {env env' : VEnv} (henv : env ≤ env')
+    (h : env'.constants n = none) : env.constants n = none := by
+  cases h₀ : env.constants n with
+  | none => rfl
+  | some ci =>
+    have := henv.constants h₀
+    rw [h] at this
+    contradiction
+
+theorem addDefEq_le {env : VEnv} : env ≤ env.addDefEq df := ⟨id, .inr, id⟩
+
+theorem addDefEq_self {env : VEnv} : (env.addDefEq df).defeqs df := .inl rfl
+
+theorem addStructEta_le {env : VEnv} : env ≤ env.addStructEta rule :=
+  ⟨id, id, .inr⟩
+
+theorem addStructEta_self {env : VEnv} :
+    (env.addStructEta rule).structEtas rule := .inl rfl
+
+def HasObjects (env : VEnv) : List VObject → Prop
+  | [] => True
+  | .const n ci :: ls => env.constants n = some ci ∧ env.HasObjects ls
+  | .defeq df :: ls => env.defeqs df ∧ env.HasObjects ls
+
+theorem HasObjects.mono {env env' : VEnv} (henv : env ≤ env') :
+    ∀ {ls}, HasObjects env ls → HasObjects env' ls
+  | [] => id
+  | .const .. :: _ => .imp henv.1 (mono henv)
+  | .defeq .. :: _ => .imp henv.2 (mono henv)
+
+theorem HasObjects.const {env env' : VEnv} (hls : env.HasObjects ls)
+    (h : env.addConst n ci = some env') : env'.HasObjects (.const n ci :: ls) :=
+  ⟨addConst_self h, hls.mono (addConst_le h)⟩
+
+theorem HasObjects.defeq {env : VEnv} (hls : env.HasObjects ls) :
+    (addDefEq env df).HasObjects (.defeq df :: ls) := ⟨addDefEq_self, hls.mono addDefEq_le⟩
+
+theorem HasObjects.bind_const {env env' : VEnv} (hls : env.HasObjects ls)
+    (h : env.addConst n ci >>= f = some env') :
+    ∃ env1, env1.HasObjects (.const n ci :: ls) ∧ f env1 = some env' :=
+  let ⟨env1, h1, henv1⟩ := Option.bind_eq_some_iff.1 h; ⟨env1, hls.const h1, henv1⟩
+
+nonrec theorem HasType.bvar (h : Lookup Γ i A): HasType env U Γ (.bvar i) A := .bvar h
+theorem HasType.sort (h : l.WF U) : HasType env U Γ (.sort l) (.sort (.succ l)) :=
+  .sortDF h h rfl
+theorem HasType.const
+    (h1 : env.constants c = some ci) (h2 : ∀ l ∈ ls, l.WF U) (h3 : ls.length = ci.uvars) :
+    HasType env U Γ (.const c ls) (ci.type.instL ls) :=
+  .constDF h1 h2 h2 h3 (.rfl fun _ _ => rfl)
+theorem HasType.app (h1 : HasType env U Γ f (.forallE A B)) (h2 : HasType env U Γ a A) :
+    HasType env U Γ (.app f a) (B.inst a) := .appDF h1 h2
+theorem HasType.lam (h1 : HasType env U Γ A (.sort u)) (h2 : HasType env U (A::Γ) body B) :
+    HasType env U Γ (.lam A body) (.forallE A B) := .lamDF h1 h2
+theorem HasType.forallE
+    (h1 : HasType env U Γ A (.sort u)) (h2 : HasType env U (A::Γ) body (.sort v)) :
+    HasType env U Γ (.forallE A body) (.sort (.imax u v)) := .forallEDF h1 h2
+theorem IsDefEq.defeq (h1 : IsDefEq env U Γ A B (.sort u))
+    (h2 : HasType env U Γ e A) : HasType env U Γ e B := .defeqDF h1 h2
+theorem IsDefEq.defeq' (h1 : IsDefEq env U Γ A B (.sort u))
+    (h2 : HasType env U Γ e B) : HasType env U Γ e A := .defeq h1.symm h2
+
+theorem IsType.forallE : IsType env U Γ A → IsType env U (A::Γ) body →
+    IsType env U Γ (.forallE A body)
+  | ⟨_, h1⟩, ⟨_, h2⟩ => ⟨_, .forallE h1 h2⟩
+
+theorem IsDefEq.hasType {env : VEnv} (H : env.IsDefEq U Γ e1 e2 A) :
+    env.HasType U Γ e1 A ∧ env.HasType U Γ e2 A := ⟨H.trans H.symm, H.symm.trans H⟩
+
+theorem IsDefEq.toU {env : VEnv} (H : env.IsDefEq U Γ e1 e2 A) : env.IsDefEqU U Γ e1 e2 := ⟨_, H⟩
+
+theorem IsDefEqU.refl {env : VEnv} (h1 : e.WF env U Γ) : env.IsDefEqU U Γ e e := h1
+theorem IsDefEqU.symm {env : VEnv} (h1 : env.IsDefEqU U Γ e₁ e₂) : env.IsDefEqU U Γ e₂ e₁ :=
+  h1.imp fun _ => (·.symm)
+
+inductive Ordered : VEnv → Prop where
+  | empty : Ordered ∅
+  | const :
+    Ordered env → ci.WF env →
+    env.addConst n ci = some env' → Ordered env'
+  | defeq : Ordered env → df.WF env → Ordered (env.addDefEq df)
+  | structEta : Ordered env → rule.WF env → Ordered (env.addStructEta rule)
+
+def OnTypes (env : VEnv) (P : Nat → VExpr → VExpr → Prop) : Prop :=
+  (∀ {n ci}, env.constants n = some ci → ∃ u, P ci.uvars ci.type (.sort u)) ∧
+  (∀ {df}, env.defeqs df → P df.uvars df.lhs df.type ∧ P df.uvars df.rhs df.type)
+
+theorem OnTypes.mono (henv : env' ≤ env) (hP : ∀ {U e A}, P U e A → P' U e A)
+    (H : OnTypes env P) : OnTypes env' P' :=
+  ⟨fun hci => (H.1 (henv.1 hci)).imp fun _ => hP, fun hdf => (H.2 (henv.2 hdf)).imp hP hP⟩
+
+theorem Ordered.induction (motive : VEnv → Nat → VExpr → VExpr → Prop)
+    (mono : ∀ {env env' U e A}, env ≤ env' → motive env U e A → motive env' U e A)
+    (type : ∀ {env U e A},
+      Ordered env → OnTypes env (motive env) → HasType env U [] e A → motive env U e A)
+    (H : Ordered env) : OnTypes env (motive env) := by
+  induction H with
+  | empty => exact ⟨nofun, nofun⟩
+  | const h1 h2 h3 ih =>
+    apply OnTypes.mono .rfl (mono (addConst_le h3))
+    unfold addConst at h3; split at h3 <;> cases h3
+    refine ⟨fun h => ?_, ih.2⟩
+    simp at h; split at h
+    · cases h
+      let ⟨_, ht⟩ := h2
+      exact ⟨_, type h1 ih ht⟩
+    · exact ih.1 h
+  | defeq h1 h2 ih =>
+    apply OnTypes.mono .rfl (mono addDefEq_le)
+    refine ⟨ih.1, fun hdf => ?_⟩
+    simp [addDefEq] at hdf
+    obtain rfl | hdf := hdf
+    · let ⟨hl, hr⟩ := h2
+      exact ⟨type h1 ih hl, type h1 ih hr⟩
+    · exact ih.2 hdf
+  | structEta _ _ ih =>
+    exact OnTypes.mono .rfl (mono addStructEta_le) ih
+
+variable (env : VEnv) (U : Nat) (Γ₀ : List VExpr) in
+inductive IsDefEqCtx : List VExpr → List VExpr → Prop
+  | zero : IsDefEqCtx Γ₀ Γ₀
+  | succ :  IsDefEqCtx Γ₁ Γ₂ → env.IsDefEq U Γ₁ A₁ A₂ (.sort u) → IsDefEqCtx (A₁ :: Γ₁) (A₂ :: Γ₂)
+
+theorem IsDefEqCtx.length_eq : IsDefEqCtx env U Γ₀ Γ₁ Γ₂ → Γ₁.length = Γ₂.length
+  | .zero => rfl
+  | .succ h  _ => congrArg Nat.succ h.length_eq
+
+theorem IsDefEqCtx.isSuffix : IsDefEqCtx env U Γ₀ Γ₁ Γ₂ → Γ₀ <:+ Γ₁ ∧ Γ₀ <:+ Γ₂
+  | .zero => ⟨List.suffix_refl _, List.suffix_refl _⟩
+  | .succ h _ =>
+    let ⟨h1, h2⟩ := h.isSuffix
+    ⟨h1.trans (List.suffix_cons _ _), h2.trans (List.suffix_cons _ _)⟩
+
+variable! (H₀ : OnCtx Γ₀ (IsType env U)) in
+theorem IsDefEqCtx.isType' : IsDefEqCtx env U Γ₀ Γ₁ Γ₂ → OnCtx Γ₁ (env.IsType U)
+  | .zero => H₀
+  | .succ h1 h2 => ⟨h1.isType', _, h2.hasType.1⟩
+
+theorem IsDefEqCtx.isType (H : IsDefEqCtx env U [] Γ₁ Γ₂) : OnCtx Γ₁ (env.IsType U) :=
+  H.isType' (by trivial)
+
+theorem IsDefEqCtx.refl : ∀ {Γ}, OnCtx Γ (env.IsType U) → IsDefEqCtx env U [] Γ Γ
+  | [], _ => .zero
+  | _::_, ⟨h1, _, h2⟩ => .succ (.refl h1) h2
+
+variable! (henv : OnTypes env fun _ e A => e.ClosedN ∧ A.ClosedN) in
+theorem IsDefEq.closedN' (H : env.IsDefEq U Γ e1 e2 A) (hΓ : CtxClosed Γ) :
+    e1.ClosedN Γ.length ∧ e2.ClosedN Γ.length ∧ A.ClosedN Γ.length := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun _ _ _ _ _ => True) with
+  | bvar h => exact ⟨h.lt, h.lt, hΓ.lookup h⟩
+  | constDF h1 =>
+    let ⟨_, h, _⟩ := henv.1 h1
+    exact ⟨trivial, trivial, h.instL.mono (Nat.zero_le _)⟩
+  | sortDF => exact ⟨trivial, trivial, trivial⟩
+  | symm _ ih => let ⟨h1, h2, h3⟩ := ih hΓ; exact ⟨h2, h1, h3⟩
+  | trans _ _ ih1 ih2 => exact ⟨(ih1 hΓ).1, (ih2 hΓ).2.1, (ih1 hΓ).2.2⟩
+  | appDF _ _ ih1 ih2 =>
+    let ⟨hf, hf', _, hB⟩ := ih1 hΓ
+    let ⟨ha, ha', _⟩ := ih2 hΓ
+    exact ⟨⟨hf, ha⟩, ⟨hf', ha'⟩, hB.inst ha⟩
+  | lamDF _ _ ih1 ih2 =>
+    let ⟨hA, hA', _⟩ := ih1 hΓ
+    let ⟨hb, hb', hB⟩ := ih2 ⟨hΓ, hA⟩
+    exact ⟨⟨hA, hb⟩, ⟨hA', hb'⟩, hA, hB⟩
+  | forallEDF _ _ ih1 ih2 =>
+    let ⟨hA, hA', _⟩ := ih1 hΓ
+    let ⟨hb, hb', _⟩ := ih2 ⟨hΓ, hA⟩
+    exact ⟨⟨hA, hb⟩, ⟨hA', hb'⟩, trivial⟩
+  | defeqDF _ _ ih1 ih2 => exact ⟨(ih2 hΓ).1, (ih2 hΓ).2.1, (ih1 hΓ).2.1⟩
+  | beta _ _ ih1 ih2 =>
+    let ⟨he', _, hA⟩ := ih2 hΓ
+    let ⟨he, _, hB⟩ := ih1 ⟨hΓ, hA⟩
+    exact ⟨⟨⟨hA, he⟩, he'⟩, he.inst he', hB.inst he'⟩
+  | eta _ ih =>
+    let ⟨he, _, hA, hB⟩ := ih hΓ
+    exact ⟨⟨hA, he.liftN, Nat.succ_pos _⟩, he, hA, hB⟩
+  | structEta _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    let ⟨hmajor, _, htype⟩ := ihMajor hΓ
+    let ⟨hrebuild, _, _⟩ := ihRebuild hΓ
+    exact ⟨hrebuild, hmajor, htype⟩
+  | proofIrrel _ _ _ _ ih2 ih3 =>
+    let ⟨hh, _, _⟩ := ih2 hΓ
+    let ⟨hh', _, hp⟩ := ih3 hΓ
+    exact ⟨hh, hh', hp⟩
+  | extra h1 _ _ =>
+    let ⟨⟨hl, _⟩, ⟨hr, hA⟩⟩ := henv.2 h1
+    exact ⟨
+      hl.instL.mono (Nat.zero_le _),
+      hr.instL.mono (Nat.zero_le _),
+      hA.instL.mono (Nat.zero_le _)⟩
+  | nil | cons => trivial
+
+theorem Ordered.closed (H : Ordered env) : env.OnTypes fun _ e A => e.ClosedN ∧ A.ClosedN :=
+  H.induction _ (fun _ => id) fun _ ih h => (IsDefEq.closedN' ih h trivial).2
+
+theorem Ordered.closedC (H : Ordered env)
+    (h : env.constants n = some ci) : ci.type.ClosedN :=
+  let ⟨_, h⟩ := H.closed.1 h; h.1
+
+theorem IsDefEq.closedN {env : VEnv} (henv : env.Ordered)
+    (H : env.IsDefEq U Γ e1 e2 A) (hΓ : CtxClosed Γ) : e1.ClosedN Γ.length :=
+  (H.closedN' henv.closed hΓ).1
+
+theorem _root_.Ix.Theory.Named.VExpr.WF.closedN {env : VEnv} (henv : env.Ordered)
+    (H : VExpr.WF env U Γ e) (hΓ : CtxClosed Γ) : e.ClosedN Γ.length :=
+  let ⟨_, h⟩ := H; h.closedN henv hΓ
+
+variable! (henv : Ordered env) in
+theorem IsDefEqCtx.closed (H : CtxClosed Γ₀) :
+    IsDefEqCtx env U Γ₀ Γ₁ Γ₂ → CtxClosed Γ₁ ∧ CtxClosed Γ₂
+  | .zero => ⟨H, H⟩
+  | .succ h1 h2 =>
+    have ⟨c1, c2⟩ := h1.closed H
+    ⟨⟨c1, h2.closedN henv c1⟩, ⟨c2, by simpa [h1.length_eq] using h2.symm.closedN henv c1⟩⟩
+
+variable! {env env' : VEnv} (henv : env ≤ env') in
+theorem IsDefEq.mono (H : env.IsDefEq U Γ e1 e2 A) : env'.IsDefEq U Γ e1 e2 A := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun Γ A es B _ => env'.SpineWF U Γ A es B) with
+  | bvar h => exact .bvar h
+  | constDF h1 h2 h3 h4 h5 => exact .constDF (henv.1 h1) h2 h3 h4 h5
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | symm _ ih => exact .symm ih
+  | trans _ _ ih1 ih2 => exact .trans ih1 ih2
+  | appDF _ _ ih1 ih2 => exact .appDF ih1 ih2
+  | lamDF _ _ ih1 ih2 => exact .lamDF ih1 ih2
+  | forallEDF _ _ ih1 ih2 => exact .forallEDF ih1 ih2
+  | defeqDF _ _ ih1 ih2 => exact .defeqDF ih1 ih2
+  | beta _ _ ih1 ih2 => exact .beta ih1 ih2
+  | eta _ ih => exact .eta ih
+  | structEta hreg hlevels hlevelsLength hparamsLength _ _ _
+      ihSpine ihMajor ihRebuild =>
+    exact .structEta (henv.structEtas hreg) hlevels hlevelsLength
+      hparamsLength ihSpine ihMajor ihRebuild
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel ih1 ih2 ih3
+  | extra h1 h2 h3 => exact .extra (henv.2 h1) h2 h3
+  | nil => exact .nil
+  | cons _ _ ihType ihRest => exact .cons ihType ihRest
+
+theorem HasType.mono {env env' : VEnv} (henv : env ≤ env') :
+    env.HasType U Γ e A → env'.HasType U Γ e A := IsDefEq.mono henv
+
+theorem SpineWF.mono {env env' : VEnv} (henv : env ≤ env') {U : Nat}
+    {Γ : List VExpr} : ∀ {es A B}, env.SpineWF U Γ A es B →
+      env'.SpineWF U Γ A es B
+  | [], _, _, .nil => .nil
+  | _ :: _, _, _, .cons he hrest =>
+    .cons (he.mono henv) (SpineWF.mono henv hrest)
+
+theorem SpineWF.nil_inv {env : VEnv} (h : env.SpineWF U Γ A [] B) : A = B := by
+  cases h
+  rfl
+
+theorem SpineWF.cons_inv {env : VEnv}
+    (h : env.SpineWF U Γ A (e :: es) B) :
+    ∃ A₁ A₂, A = .forallE A₁ A₂ ∧
+      env.HasType U Γ e A₁ ∧ env.SpineWF U Γ (A₂.inst e) es B := by
+  cases h with
+  | cons he hrest => exact ⟨_, _, rfl, he, hrest⟩
+
+theorem IsType.mono {env env' : VEnv} (henv : env ≤ env') : env.IsType U Γ A → env'.IsType U Γ A
+  | ⟨u, h⟩ => ⟨u, h.mono henv⟩
+
+theorem IsDefEqU.mono {env env' : VEnv} (henv : env ≤ env') :
+    env.IsDefEqU U Γ e1 e2 → env'.IsDefEqU U Γ e1 e2
+  | ⟨u, h⟩ => ⟨u, h.mono henv⟩
+
+end VEnv
+
+theorem VExpr.WF.mono {env env' : VEnv} (henv : env ≤ env') {e : VExpr} :
+    e.WF env U Γ → e.WF env' U Γ
+  | ⟨u, h⟩ => ⟨u, h.mono henv⟩
+
+theorem VConstant.WF.mono {env env' : VEnv} (henv : env ≤ env') {ci : VConstant} :
+    ci.WF env → ci.WF env'
+  | ⟨u, h⟩ => ⟨u, h.mono henv⟩
+
+theorem VDefEq.WF.mono {env env' : VEnv} (henv : env ≤ env') {df : VDefEq} : df.WF env → df.WF env'
+  | ⟨h1, h2⟩ => ⟨h1.mono henv, h2.mono henv⟩
+
+namespace VEnv
+
+theorem Ordered.constWF (H : Ordered env) (h : env.constants n = some ci) : ci.WF env := by
+  induction H with
+  | empty => cases h
+  | const _ h2 h3 ih =>
+    refine .mono (addConst_le h3) ?_
+    unfold addConst at h3; split at h3 <;> cases h3
+    simp at h; split at h
+    · cases h; exact h2
+    · exact ih h
+  | defeq _ _ ih => exact .mono addDefEq_le (ih h)
+  | structEta _ _ ih => exact .mono addStructEta_le (ih h)
+
+theorem Ordered.defEqWF (H : Ordered env) (h : env.defeqs df) : df.WF env := by
+  induction H with
+  | empty => cases h
+  | const _ _ h3 ih =>
+    refine .mono (addConst_le h3) (ih ?_)
+    unfold addConst at h3; split at h3 <;> cases h3; exact h
+  | defeq _ _ ih =>
+    refine .mono addDefEq_le ?_
+    obtain rfl | h := h
+    · assumption
+    · exact ih h
+  | structEta _ _ ih => exact .mono addStructEta_le (ih h)
+
+theorem Ordered.structEtaWF (H : Ordered env) (h : env.structEtas rule) :
+    VStructEta.WF rule env := by
+  induction H with
+  | empty => cases h
+  | const _ _ hadd ih =>
+    refine VStructEta.WF.mono (addConst_le hadd) (ih ?_)
+    unfold VEnv.addConst at hadd
+    split at hadd <;> cases hadd
+    exact h
+  | defeq _ _ ih => exact VStructEta.WF.mono addDefEq_le (ih h)
+  | structEta _ hwf ih =>
+    obtain rfl | h := h
+    · exact VStructEta.WF.mono addStructEta_le hwf
+    · exact VStructEta.WF.mono addStructEta_le (ih h)
+
+variable! (henv : Ordered env) in
+theorem CtxWF.closed (h : OnCtx Γ (IsType env U)) : CtxClosed Γ :=
+  match Γ, h with
+  | [], _ => trivial
+  | _::_, ⟨h1, _, h2⟩ => ⟨closed h1, h2.closedN henv (closed h1)⟩
+
+variable {env : VEnv} in
+theorem IsDefEq.levelWF (H : env.IsDefEq U Γ e1 e2 A) (W : OnCtx Γ fun _ A => A.LevelWF U) :
+    e1.LevelWF U ∧ e2.LevelWF U ∧ A.LevelWF U := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun _ _ _ _ _ => True) with
+  | bvar h =>
+    refine ⟨⟨⟩, ⟨⟩, ?_⟩
+    induction h with
+    | zero => exact W.2.liftN
+    | succ _ ih => exact (ih W.1).liftN
+  | symm _ ih => let ⟨he, he', hA⟩ := ih W; exact ⟨he', he, hA⟩
+  | trans _ _ ih1 ih2 => let ⟨he1, _, hA⟩ := ih1 W; let ⟨_, he3, _⟩ := ih2 W; exact ⟨he1, he3, hA⟩
+  | sortDF h1 h2 => exact ⟨h1, h2, h1⟩
+  | constDF _ h2 h3 => exact ⟨h2, h3, .instL h2⟩
+  | appDF _ _ ih1 ih2 =>
+    let ⟨hf, hf', _, hB⟩ := ih1 W; let ⟨ha, ha', _⟩ := ih2 W
+    exact ⟨⟨hf, ha⟩, ⟨hf', ha'⟩, hB.inst ha⟩
+  | lamDF _ _ ih1 ih2 =>
+    let ⟨hA, hA', _⟩ := ih1 W; let ⟨hb, hb', hB⟩ := ih2 ⟨W, hA⟩
+    exact ⟨⟨hA, hb⟩, ⟨hA', hb'⟩, hA, hB⟩
+  | forallEDF _ _ ih1 ih2 =>
+    let ⟨hA, hA', hu⟩ := ih1 W; let ⟨hb, hb', hv⟩ := ih2 ⟨W, hA⟩
+    exact ⟨⟨hA, hb⟩, ⟨hA', hb'⟩, hu, hv⟩
+  | defeqDF _ _ ih1 ih2 => let ⟨_, hB, _⟩ := ih1 W; let ⟨he1, he2, _⟩ := ih2 W; exact ⟨he1, he2, hB⟩
+  | beta _ _ ih1 ih2 =>
+    let ⟨he', _, hA⟩ := ih2 W; let ⟨he, _, hB⟩ := ih1 ⟨W, hA⟩
+    exact ⟨⟨⟨hA, he⟩, he'⟩, he.inst he', hB.inst he'⟩
+  | eta _ ih => let ⟨he, _, hA, hB⟩ := ih W; exact ⟨⟨hA, he.liftN, ⟨⟩⟩, he, hA, hB⟩
+  | structEta _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    let ⟨hmajor, _, htype⟩ := ihMajor W
+    let ⟨hrebuild, _, _⟩ := ihRebuild W
+    exact ⟨hrebuild, hmajor, htype⟩
+  | proofIrrel _ _ _ _ ih2 ih3 =>
+    let ⟨hh, _, hp⟩ := ih2 W; let ⟨hh', _, _⟩ := ih3 W
+    exact ⟨hh, hh', hp⟩
+  | extra _ h2 => exact ⟨.instL h2, .instL h2, .instL h2⟩
+  | nil | cons => trivial
+
+theorem HasType.const0 (H : env.constants c = some ci) (wf : ci.WF env) :
+    HasType env ci.uvars [] (.const c (VLevel.params ci.uvars)) ci.type := by
+  have := const H (ls := VLevel.params ci.uvars) VLevel.params_wf VLevel.params_length (Γ := [])
+  have ⟨_, h⟩ := wf
+  rwa [(IsDefEq.levelWF h trivial).1.instL_id] at this
+
+theorem IsDefEq.extra0 (H : env.defeqs df) (wf : df.WF env) :
+    IsDefEq env df.uvars [] df.lhs df.rhs df.type := by
+  have := extra H (ls := VLevel.params df.uvars) VLevel.params_wf VLevel.params_length (Γ := [])
+  let ⟨_, h2, h3⟩ := IsDefEq.levelWF wf.2 trivial
+  rwa [(IsDefEq.levelWF wf.1 trivial).1.instL_id, h2.instL_id, h3.instL_id] at this
+
+variable! (henv : Ordered env) in
+theorem IsDefEq.weakN (W : Ctx.LiftN n k Γ Γ') (H : env.IsDefEq U Γ e1 e2 A) :
+    env.IsDefEq U Γ' (e1.liftN n k) (e2.liftN n k) (A.liftN n k) := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun Γ A es B _ => ∀ {k Γ'}, Ctx.LiftN n k Γ Γ' →
+        env.SpineWF U Γ' (A.liftN n k)
+          (es.map fun e => e.liftN n k) (B.liftN n k))
+      generalizing k Γ' with
+  | bvar h => refine .bvar (h.weakN W)
+  | symm _ ih => exact .symm (ih W)
+  | trans _ _ ih1 ih2 => exact .trans (ih1 W) (ih2 W)
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 =>
+    rw [(henv.closedC h1).instL.liftN_eq (Nat.zero_le _)]
+    exact .constDF h1 h2 h3 h4 h5
+  | appDF _ _ ih1 ih2 => exact liftN_inst_hi .. ▸ .appDF (ih1 W) (ih2 W)
+  | lamDF _ _ ih1 ih2 => exact .lamDF (ih1 W) (ih2 W.succ)
+  | forallEDF _ _ ih1 ih2 => exact .forallEDF (ih1 W) (ih2 W.succ)
+  | defeqDF _ _ ih1 ih2 => exact .defeqDF (ih1 W) (ih2 W)
+  | beta _ _ ih1 ih2 =>
+    exact VExpr.liftN_inst_hi .. ▸ VExpr.liftN_instN_hi .. ▸ .beta (ih1 W.succ) (ih2 W)
+  | eta _ ih =>
+    have := IsDefEq.eta (ih W)
+    simp [liftN]; rwa [← lift_liftN']
+  | @structEta rule levels _ params _ major hreg hlevels
+      hlevelsLength hparamsLength _ _ _
+      ihSpine ihMajor ihRebuild =>
+    have hparamsSpine := ihSpine W
+    rw [(henv.structEtaWF hreg).familyType_closed.instL.liftN_eq
+      (Nat.zero_le _)] at hparamsSpine
+    have hmajor := ihMajor W
+    rw [VStructEta.structureType_liftN] at hmajor
+    have hrebuild := ihRebuild W
+    rw [VStructEta.rebuild_liftN rule levels params major
+      hparamsLength n k, VStructEta.structureType_liftN] at hrebuild
+    have hout := IsDefEq.structEta hreg hlevels hlevelsLength
+      (by simpa using hparamsLength) hparamsSpine hmajor hrebuild
+    simpa only [VStructEta.rebuild_liftN rule levels params major
+      hparamsLength n k, VStructEta.structureType_liftN] using hout
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel (ih1 W) (ih2 W) (ih3 W)
+  | extra h1 h2 h3 =>
+    have ⟨⟨hA1, _⟩, hA2, hA3⟩ := henv.closed.2 h1
+    rw [
+      hA1.instL.liftN_eq (Nat.zero_le _),
+      hA2.instL.liftN_eq (Nat.zero_le _),
+      hA3.instL.liftN_eq (Nat.zero_le _)]
+    exact .extra h1 h2 h3
+  | nil => exact .nil
+  | cons _ _ ihType ihRest =>
+    exact .cons (ihType (by assumption)) (by
+      simpa only [VExpr.liftN_inst_hi] using ihRest (by assumption))
+
+variable! (henv : Ordered env) in
+theorem HasType.weakN (W : Ctx.LiftN n k Γ Γ') (H : env.HasType U Γ e A) :
+    env.HasType U Γ' (e.liftN n k) (A.liftN n k) := IsDefEq.weakN henv W H
+
+theorem SpineWF.weakN {env : VEnv} (henv : env.Ordered)
+    (W : Ctx.LiftN n k Γ Γ') :
+    ∀ {es A B}, env.SpineWF U Γ A es B →
+      env.SpineWF U Γ' (A.liftN n k)
+        (es.map fun e => e.liftN n k) (B.liftN n k)
+  | [], _, _, .nil => .nil
+  | _ :: _, _, _, .cons he hrest =>
+    .cons (he.weakN henv W) (by
+      simpa only [VExpr.liftN_inst_hi] using SpineWF.weakN henv W hrest)
+
+variable! (henv : Ordered env) in
+theorem IsType.weakN (W : Ctx.LiftN n k Γ Γ') (H : env.IsType U Γ A) :
+    env.IsType U Γ' (A.liftN n k) := let ⟨_, h⟩ := H; ⟨_, h.weakN henv W⟩
+
+variable! (henv : Ordered env) in
+theorem IsDefEq.weak (H : env.IsDefEq U Γ e1 e2 A) :
+    env.IsDefEq U (B::Γ) e1.lift e2.lift A.lift := H.weakN henv .one
+
+variable! (henv : Ordered env) in
+theorem IsDefEqU.weak (H : env.IsDefEqU U Γ e1 e2) :
+    env.IsDefEqU U (B::Γ) e1.lift e2.lift := let ⟨_, H⟩ := H; ⟨_, H.weak henv⟩
+
+variable! (henv : Ordered env) in
+theorem IsDefEqU.weakN (W : Ctx.LiftN n k Γ Γ') (H : env.IsDefEqU U Γ e1 e2) :
+    env.IsDefEqU U Γ' (e1.liftN n k) (e2.liftN n k) := let ⟨_, H⟩ := H; ⟨_, H.weakN henv W⟩
+
+variable! (henv : Ordered env) in
+theorem IsDefEq.weakR (hΓ : CtxClosed Γ) (H : env.IsDefEq U Γ e1 e2 A) (Γ') :
+    env.IsDefEq U (Γ ++ Γ') e1 e2 A := by
+  have ⟨h1, h2, h3⟩ := H.closedN' henv.closed hΓ
+  simpa [h1.liftN_eq, h2.liftN_eq, h3.liftN_eq] using H.weakN henv (.right hΓ Γ')
+
+variable! (henv : Ordered env) in
+theorem IsDefEq.weak0 (H : env.IsDefEq U [] e1 e2 A) : env.IsDefEq U Γ e1 e2 A :=
+  H.weakR henv (Γ := []) ⟨⟩ _
+
+variable! (henv : Ordered env) in
+nonrec theorem HasType.weak0 (H : env.HasType U [] e A) : env.HasType U Γ e A := H.weak0 henv
+
+variable! (henv : Ordered env) in
+theorem IsDefEqU.weak0 (H : env.IsDefEqU U [] e1 e2) : env.IsDefEqU U Γ e1 e2 :=
+  let ⟨_, H⟩ := H; ⟨_, H.weak0 henv⟩
+
+variable! (henv : Ordered env) in
+theorem IsDefEq.weak' (W : Ctx.Lift' l Γ Γ') (H : env.IsDefEq U Γ e1 e2 A) :
+    env.IsDefEq U Γ' (e1.lift' l) (e2.lift' l) (A.lift' l) := by
+  generalize e : l.depth = n
+  induction n generalizing l Γ' with
+  | zero => simpa [lift'_depth_zero e, W.depth_zero e] using H
+  | succ n ih =>
+    obtain ⟨l, k, rfl, rfl⟩ := Lift.depth_succ e
+    have ⟨Γ₁, W1, W2⟩ := W.of_cons_skip
+    rw [Lift.consN_skip_eq, lift'_comp, lift'_comp, lift'_comp, ← Lift.skipN_one,
+      lift'_consN_skipN, lift'_consN_skipN, lift'_consN_skipN]
+    exact (ih W1 Lift.depth_consN).weakN henv W2
+
+variable! (henv : Ordered env) in
+theorem HasType.weak' (W : Ctx.Lift' l Γ Γ') (H : env.HasType U Γ e A) :
+    env.HasType U Γ' (e.lift' l) (A.lift' l) := IsDefEq.weak' henv W H
+
+variable! (henv : Ordered env) in
+theorem IsType.weak' (W : Ctx.Lift' l Γ Γ') (H : env.IsType U Γ A) :
+    env.IsType U Γ' (A.lift' l) := let ⟨_, h⟩ := H; ⟨_, h.weak' henv W⟩
+
+variable! (henv : Ordered env) in
+theorem IsDefEqU.weak' (W : Ctx.Lift' n Γ Γ') (H : env.IsDefEqU U Γ e1 e2) :
+    env.IsDefEqU U Γ' (e1.lift' n) (e2.lift' n) := let ⟨_, H⟩ := H; ⟨_, H.weak' henv W⟩
+
+theorem IsType.lookup (henv : Ordered env) (h : OnCtx Γ (IsType env U)) (hL : Lookup Γ n A) :
+    env.IsType U Γ A := h.lookup hL <| .weakN henv .one
+
+variable! {env : VEnv} {ls : List VLevel} (hls : ∀ l ∈ ls, l.WF U') in
+theorem IsDefEq.instL (H : env.IsDefEq U Γ e1 e2 A) :
+    env.IsDefEq U' (Γ.map (VExpr.instL ls)) (e1.instL ls) (e2.instL ls) (A.instL ls) := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun Γ A es B _ =>
+        env.SpineWF U' (Γ.map (VExpr.instL ls)) (A.instL ls)
+          (es.map (VExpr.instL ls)) (B.instL ls)) with
+  | bvar h => refine .bvar h.instL
+  | symm _ ih => exact .symm ih
+  | trans _ _ ih1 ih2 => exact .trans ih1 ih2
+  | sortDF _ _ h3 =>
+    exact .sortDF (VLevel.WF.inst hls) (VLevel.WF.inst hls) (VLevel.inst_congr_l h3)
+  | @constDF _ _ ls₁ ls₂ _ h1 h2 h3 h4 h5 =>
+    simp [VExpr.instL, VExpr.instL_instL]
+    exact .constDF h1 (by simp [VLevel.WF.inst hls]) (by simp [VLevel.WF.inst hls])
+      (by simp [h4]) (by simpa using h5.imp fun _ _ => VLevel.inst_congr_l)
+  | appDF _ _ ih1 ih2 => exact VExpr.instL_instN ▸ .appDF ih1 ih2
+  | lamDF _ _ ih1 ih2 => exact .lamDF ih1 ih2
+  | forallEDF _ _ ih1 ih2 => exact .forallEDF ih1 ih2
+  | defeqDF _ _ ih1 ih2 => exact .defeqDF ih1 ih2
+  | beta _ _ ih1 ih2 => simpa using .beta ih1 ih2
+  | eta _ ih => simpa [VExpr.instL] using .eta ih
+  | @structEta rule levels _ params _ major hreg hlevels
+      hlevelsLength hparamsLength _ _ _
+      ihSpine ihMajor ihRebuild =>
+    have hlevels' : ∀ level ∈ levels.map (VLevel.inst ls),
+        level.WF U' := by
+      intro level hlevel
+      obtain ⟨source, hsource, heq⟩ := List.mem_map.1 hlevel
+      rw [← heq]
+      exact VLevel.WF.inst hls
+    rw [VStructEta.structureType_instL] at ihMajor
+    rw [VStructEta.rebuild_instL,
+      VStructEta.structureType_instL] at ihRebuild
+    rw [VExpr.instL_instL] at ihSpine
+    have hout := IsDefEq.structEta hreg hlevels'
+      (by simpa using hlevelsLength)
+      (by simpa using hparamsLength) ihSpine ihMajor ihRebuild
+    simpa only [VStructEta.rebuild_instL,
+      VStructEta.structureType_instL] using hout
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel ih1 ih2 ih3
+  | extra h1 h2 h3 =>
+    simp [VExpr.instL_instL]
+    exact .extra h1 (by simp [VLevel.WF.inst hls]) (by simp [h3])
+  | nil => exact .nil
+  | cons _ _ ihType ihRest =>
+    exact .cons ihType (by simpa using ihRest)
+
+theorem HasType.instL {env : VEnv} (hls : ∀ l ∈ ls, l.WF U') (H : env.HasType U Γ e A) :
+    env.HasType U' (Γ.map (VExpr.instL ls)) (e.instL ls) (A.instL ls) := IsDefEq.instL hls H
+
+theorem SpineWF.instL {env : VEnv} (hls : ∀ l ∈ ls, l.WF U') :
+    ∀ {es A B}, env.SpineWF U Γ A es B →
+      env.SpineWF U' (Γ.map (VExpr.instL ls)) (A.instL ls)
+        (es.map (VExpr.instL ls)) (B.instL ls)
+  | [], _, _, .nil => .nil
+  | _ :: _, _, _, .cons he hrest =>
+    .cons (he.instL hls) (by
+      simpa using SpineWF.instL hls hrest)
+
+theorem IsType.instL {env : VEnv} (hls : ∀ l ∈ ls, l.WF U') (H : env.IsType U Γ A) :
+    env.IsType U' (Γ.map (VExpr.instL ls)) (A.instL ls) := let ⟨_, h⟩ := H; ⟨_, h.instL hls⟩
+
+theorem IsDefEqU.instL {env : VEnv} (hls : ∀ l ∈ ls, l.WF U') (H : env.IsDefEqU U Γ e1 e2) :
+    env.IsDefEqU U' (Γ.map (VExpr.instL ls)) (e1.instL ls) (e2.instL ls) :=
+  let ⟨_, h⟩ := H; ⟨_, h.instL hls⟩
+
+theorem _root_.Ix.Theory.Named.OnCtx.instL {env : VEnv} (hls : ∀ l ∈ ls, l.WF U') :
+  ∀ {Γ}, OnCtx Γ (env.IsType U) → OnCtx (Γ.map (VExpr.instL ls)) (env.IsType U')
+  | [], _ => trivial
+  | _::_, ⟨H1, H2⟩ => ⟨H1.instL hls, IsType.instL hls H2⟩
+
+variable! (henv : Ordered env) (h₀ : env.HasType U Γ₀ e₀ A₀) in
+theorem IsDefEq.instN (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ) (H : env.IsDefEq U Γ₁ e1 e2 A) :
+    env.IsDefEq U Γ (e1.inst e₀ k) (e2.inst e₀ k) (A.inst e₀ k) := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun Γ₁ A es B _ => ∀ {Γ k}, Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
+        env.SpineWF U Γ (A.inst e₀ k)
+          (es.map fun e => e.inst e₀ k) (B.inst e₀ k))
+      generalizing Γ k with
+  | @bvar _ i ty h =>
+    dsimp [inst]
+    induction W generalizing i ty with
+    | zero =>
+      cases h with simp [inst_lift]
+      | zero => exact h₀
+      | succ h => exact .bvar h
+    | succ _ ih =>
+      cases h with (simp; rw [Nat.add_comm, ← VExpr.liftN_instN_lo (hj := Nat.zero_le _)])
+      | zero => exact .bvar .zero
+      | succ h => exact (ih h).weak henv
+  | symm _ ih => exact .symm (ih W)
+  | trans _ _ ih1 ih2 => exact .trans (ih1 W) (ih2 W)
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 =>
+    rw [(henv.closedC h1).instL.instN_eq (Nat.zero_le _)]
+    exact .constDF h1 h2 h3 h4 h5
+  | appDF _ _ ih1 ih2 => exact VExpr.inst_inst_hi .. ▸ .appDF (ih1 W) (ih2 W)
+  | lamDF _ _ ih1 ih2 => exact .lamDF (ih1 W) (ih2 W.succ)
+  | forallEDF _ _ ih1 ih2 => exact .forallEDF (ih1 W) (ih2 W.succ)
+  | defeqDF _ _ ih1 ih2 => exact .defeqDF (ih1 W) (ih2 W)
+  | beta _ _ ih1 ih2 =>
+    exact VExpr.inst_inst_hi .. ▸ VExpr.inst_inst_hi .. ▸ .beta (ih1 W.succ) (ih2 W)
+  | eta _ ih =>
+    have := IsDefEq.eta (ih W)
+    rw [lift, VExpr.liftN_instN_lo (hj := Nat.zero_le _), Nat.add_comm] at this
+    simpa [inst]
+  | @structEta rule levels _ params _ major hreg hlevels
+      hlevelsLength hparamsLength _ _ _
+      ihSpine ihMajor ihRebuild =>
+    have hparamsSpine := ihSpine W
+    rw [(henv.structEtaWF hreg).familyType_closed.instL.instN_eq
+      (Nat.zero_le _)] at hparamsSpine
+    have hmajor := ihMajor W
+    rw [VStructEta.structureType_instN] at hmajor
+    have hrebuild := ihRebuild W
+    rw [VStructEta.rebuild_instN rule levels params major e₀
+      hparamsLength k, VStructEta.structureType_instN] at hrebuild
+    have hout := IsDefEq.structEta hreg hlevels hlevelsLength
+      (by simpa using hparamsLength) hparamsSpine hmajor hrebuild
+    simpa only [VStructEta.rebuild_instN rule levels params major e₀
+      hparamsLength k, VStructEta.structureType_instN] using hout
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel (ih1 W) (ih2 W) (ih3 W)
+  | extra h1 h2 h3 =>
+    have ⟨⟨hA1, _⟩, hA2, hA3⟩ := henv.closed.2 h1
+    rw [
+      hA1.instL.instN_eq (Nat.zero_le _),
+      hA2.instL.instN_eq (Nat.zero_le _),
+      hA3.instL.instN_eq (Nat.zero_le _)]
+    exact .extra h1 h2 h3
+  | nil => exact .nil
+  | cons _ _ ihType ihRest =>
+    exact .cons (ihType (by assumption)) (by
+      simpa only [VExpr.inst0_inst_hi] using ihRest (by assumption))
+
+theorem SpineWF.instN {env : VEnv} (henv : env.Ordered)
+    (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    ∀ {es A B}, env.SpineWF U Γ₁ A es B →
+      env.SpineWF U Γ (A.inst e₀ k)
+        (es.map fun e => e.inst e₀ k) (B.inst e₀ k)
+  | [], _, _, .nil => .nil
+  | _ :: _, _, _, .cons he hrest =>
+    .cons (IsDefEq.instN henv h₀ W he) (by
+      simpa only [VExpr.inst0_inst_hi] using
+        SpineWF.instN henv W h₀ hrest)
+
+theorem HasType.instN {env : VEnv} (henv : env.Ordered) (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (H : env.HasType U Γ₁ e A) (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    env.HasType U Γ (e.inst e₀ k) (A.inst e₀ k) := IsDefEq.instN henv h₀ W H
+
+theorem IsType.instN {env : VEnv} (henv : env.Ordered) (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (H : env.IsType U Γ₁ A) (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    env.IsType U Γ (A.inst e₀ k) := let ⟨_, h⟩ := H; ⟨_, h.instN henv W h₀⟩
+
+theorem IsDefEqU.instN {env : VEnv} (henv : env.Ordered) (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (H : env.IsDefEqU U Γ₁ e1 e2) (h₀ : env.HasType U Γ₀ e₀ A₀) :
+    env.IsDefEqU U Γ (e1.inst e₀ k) (e2.inst e₀ k) := let ⟨_, h⟩ := H; ⟨_, h.instN henv h₀ W⟩
+
+theorem _root_.Ix.Theory.Named.Ctx.InstN.wf (henv : Ordered env) (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (h₀ : env.HasType U Γ₀ e₀ A₀) (H : OnCtx Γ₁ (env.IsType U)) :
+    OnCtx Γ₀ (env.IsType U) ∧ OnCtx Γ (env.IsType U) := by
+  induction W with
+  | zero => exact ⟨H.1, H.1⟩
+  | succ W ih => let ⟨h1, h2⟩ := ih H.1; exact ⟨h1, h2, .instN henv W H.2 h₀⟩
+
+theorem IsDefEq.defeqDF_l' (henv : Ordered env) (h1 : env.IsDefEq U Γ A A' (.sort u))
+    (h2 : env.IsDefEq U (Δ++A::Γ) e1 e2 B) : env.IsDefEq U (Δ++A'::Γ) e1 e2 B := by
+  have ⟨_, H1, H2⟩ : ∃ Γ', Ctx.LiftN 1 (Δ.length + 1) (Δ ++ A :: Γ) Γ' ∧
+      Ctx.InstN (A' :: Γ) (VExpr.bvar 0) (liftN 1 A) Δ.length Γ' (Δ ++ A' :: Γ) := by
+    clear h1 h2
+    induction Δ with
+    | nil => exact ⟨_, .succ (.one (A := A')), .zero⟩
+    | cons B Δ ih =>
+      have ⟨Γ', h1, h2⟩ := ih
+      exact ⟨_, .succ h1, by simpa [instN_bvar0] using h2.succ (A := liftN 1 B (Δ.length + 1))⟩
+  simpa [instN_bvar0] using
+    instN henv (h1.weakN henv (.one (A := A')) |>.symm.defeq (.bvar .zero)) H2 (.weakN henv H1 h2)
+
+theorem IsDefEq.defeqDF_l (henv : Ordered env) (h1 : env.IsDefEq U Γ A A' (.sort u))
+    (h2 : env.IsDefEq U (A::Γ) e1 e2 B) : env.IsDefEq U (A'::Γ) e1 e2 B :=
+  .defeqDF_l' (Δ := []) henv h1 h2
+
+theorem HasType.defeq_l (henv : Ordered env) (h1 : env.IsDefEq U Γ A A' (.sort u))
+    (h2 : env.HasType U (A::Γ) e B) : env.HasType U (A'::Γ) e B := h1.defeqDF_l henv h2
+
+theorem IsDefEq.defeqDFC' (henv : Ordered env) (h1 : IsDefEqCtx env U Γ₀ Γ₁ Γ₂)
+    (h2 : env.IsDefEq U (Δ ++ Γ₁) e₁ e₂ A) : env.IsDefEq U (Δ ++ Γ₂) e₁ e₂ A := by
+  induction h1 generalizing e₁ e₂ A Δ with
+  | zero => exact h2
+  | @succ _ _ _ A₂ _ _ AA ih =>
+    simpa using ih (Δ := Δ ++ [A₂]) (by simpa using AA.defeqDF_l' henv h2)
+
+theorem IsDefEq.defeqDFC (henv : Ordered env) (h1 : IsDefEqCtx env U Γ₀ Γ₁ Γ₂)
+    (h2 : env.IsDefEq U Γ₁ e₁ e₂ A) : env.IsDefEq U Γ₂ e₁ e₂ A := .defeqDFC' (Δ := []) henv h1 h2
+
+theorem HasType.defeqDFC (henv : Ordered env) (h1 : IsDefEqCtx env U Γ₀ Γ₁ Γ₂)
+    (h2 : env.HasType U Γ₁ e A) : env.HasType U Γ₂ e A := IsDefEq.defeqDFC henv h1 h2
+
+theorem IsType.defeqDFC (henv : Ordered env) (h1 : IsDefEqCtx env U Γ₀ Γ₁ Γ₂)
+    (h2 : env.IsType U Γ₁ A) : env.IsType U Γ₂ A := h2.imp fun _ => (·.defeqDFC henv h1)
+
+theorem IsDefEqU.defeqDFC (henv : Ordered env) (h1 : IsDefEqCtx env U Γ₀ Γ₁ Γ₂)
+    (h2 : env.IsDefEqU U Γ₁ e₁ e₂) : env.IsDefEqU U Γ₂ e₁ e₂ :=
+  let ⟨_, h2⟩ := h2; ⟨_, h2.defeqDFC henv h1⟩
+
+theorem IsDefEqCtx.symm (henv : Ordered env) :
+    IsDefEqCtx env U Γ₀ Γ₁ Γ₂ → IsDefEqCtx env U Γ₀ Γ₂ Γ₁
+  | .zero => .zero
+  | .succ h1 h2 => .succ (h1.symm henv) (h2.symm.defeqDFC henv h1)
+
+variable! (henv : Ordered env)
+  (envIH : env.OnTypes fun U e _ => ∀ A B, e = A.forallE B →
+    env.IsType U [] A ∧ env.IsType U [A] B) in
+theorem IsDefEq.forallE_inv'
+    (H : env.IsDefEq U Γ e1 e2 V) (eq : e1 = A.forallE B ∨ e2 = A.forallE B) :
+    env.IsType U Γ A ∧ env.IsType U (A::Γ) B := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun _ _ _ _ _ => True)
+      generalizing A B with
+  | symm _ ih => exact ih eq.symm
+  | trans _ _ ih1 ih2
+  | proofIrrel _ _ _ _ ih1 ih2 =>
+    obtain eq | eq := eq
+    · exact ih1 (.inl eq)
+    · exact ih2 (.inr eq)
+  | forallEDF h1 h2 =>
+    obtain ⟨⟨⟩⟩ | ⟨⟨⟩⟩ := eq
+    · exact ⟨⟨_, h1.hasType.1⟩, _, h2.hasType.1⟩
+    · exact ⟨⟨_, h1.hasType.2⟩, _, h2.hasType.2.defeq_l henv h1⟩
+  | defeqDF _ _ _ ih2 => exact ih2 eq
+  | @beta _ _ e _ _ h1 h2 ih1 ih2 =>
+    obtain ⟨⟨⟩⟩ | eq := eq
+    cases e with
+    | bvar i =>
+      cases i with simp [inst] at eq
+      | zero => exact ih2 (.inl eq)
+    | forallE A B =>
+      cases eq
+      let ⟨A1, A2⟩ := ih1 (.inl rfl)
+      exact ⟨A1.instN henv .zero h2, A2.instN henv (.succ .zero) h2⟩
+    | _ => cases eq
+  | eta _ ih =>
+    obtain ⟨⟨⟩⟩ | eq := eq
+    exact ih (.inl eq)
+  | structEta _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    obtain eq | eq := eq
+    · exact ihRebuild (.inl eq)
+    · exact ihMajor (.inl eq)
+  | @extra df ls Γ h1 h2 =>
+    suffices ∀ e, VExpr.instL ls e = VExpr.forallE A B →
+        (∀ A B, e = VExpr.forallE A B → IsType env df.uvars [] A ∧ IsType env df.uvars [A] B) →
+        IsType env U Γ A ∧ IsType env U (A :: Γ) B by
+      have ⟨A1, A2⟩ := envIH.2 h1
+      cases eq <;> exact this _ ‹_› ‹_›
+    intro e eq IH
+    cases e <;> cases eq; rename_i A B
+    let ⟨⟨_, A1⟩, v, A2⟩ := IH _ _ rfl
+    refine ⟨⟨_, (A1.instL h2).weak0 henv⟩, v.inst ls, ?_⟩
+    have := (A2.instL h2).weakN henv (.succ (.zero Γ))
+    have C1 := (A1.instL h2).closedN henv ⟨⟩
+    have C2 := (A2.instL h2).closedN henv ⟨⟨⟩, C1⟩
+    rw [C1.liftN_eq (Nat.zero_le _), C2.liftN_eq (by exact Nat.le_refl _)] at this
+    simpa [liftN]
+  | nil | cons => trivial
+  | _ => nomatch eq
+
+theorem HasType.forallE_inv (henv : Ordered env) (H : env.HasType U Γ (A.forallE B) V) :
+    env.IsType U Γ A ∧ env.IsType U (A::Γ) B := by
+  refine H.forallE_inv' henv ?_ (.inl rfl)
+  exact henv.induction
+    (fun env U e _ => ∀ A B, e = .forallE A B → IsType env U [] A ∧ IsType env U [A] B)
+    (fun le H A B eq => (H A B eq).imp (.mono le) (.mono le))
+    (fun henv IH H A B eq => H.forallE_inv' henv IH (.inl eq))
+
+theorem IsType.forallE_inv (henv : Ordered env) (H : env.IsType U Γ (A.forallE B)) :
+    env.IsType U Γ A ∧ env.IsType U (A::Γ) B := let ⟨_, h⟩ := H; h.forallE_inv henv
+
+variable! (henv : Ordered env) in
+theorem IsDefEq.sort_inv'
+    (H : env.IsDefEq U Γ e1 e2 V) (eq : e1 = .sort u ∨ e2 = .sort u) : u.WF U := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun _ _ _ _ _ => True) with
+  | symm _ ih => exact ih eq.symm
+  | trans _ _ ih1 ih2
+  | proofIrrel _ _ _ _ ih1 ih2 =>
+    obtain eq | eq := eq <;> [exact ih1 (.inl eq); exact ih2 (.inr eq)]
+  | sortDF => obtain ⟨⟨⟩⟩ | ⟨⟨⟩⟩ := eq <;> assumption
+  | defeqDF _ _ _ ih2 => exact ih2 eq
+  | @beta _ _ e _ _ h1 _ ih1 ih2 =>
+    obtain ⟨⟨⟩⟩ | eq := eq
+    cases e with
+    | bvar i =>
+      cases i with simp [inst] at eq
+      | zero => exact ih2 (.inl eq)
+    | _ => cases eq <;> exact ih1 (.inl rfl)
+  | eta _ ih =>
+    obtain ⟨⟨⟩⟩ | eq := eq
+    exact ih (.inl eq)
+  | structEta _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    obtain eq | eq := eq
+    · exact ihRebuild (.inl eq)
+    · exact ihMajor (.inl eq)
+  | @extra df ls _ h1 h2 =>
+    suffices ∀ e, VExpr.instL ls e = .sort u → HasType env df.uvars [] e df.type → u.WF U by
+      have ⟨A1, A2⟩ := henv.defEqWF h1
+      cases eq <;> exact this _ ‹_› ‹_›
+    intro e eq IH
+    cases e <;> cases eq; rename_i u
+    exact VLevel.WF.inst h2
+  | nil | cons => trivial
+  | _ => nomatch eq
+
+theorem IsDefEq.sort_inv_l (henv : Ordered env) (H : env.IsDefEq U Γ (.sort u) e2 V) : u.WF U :=
+  H.sort_inv' henv (.inl rfl)
+
+theorem IsDefEq.sort_inv_r (henv : Ordered env) (H : env.IsDefEq U Γ e2 (.sort u) V) : u.WF U :=
+  H.sort_inv' henv (.inr rfl)
+
+theorem HasType.sort_inv (henv : Ordered env) (H : env.HasType U Γ (.sort u) V) : u.WF U :=
+  H.sort_inv_l henv
+
+theorem IsType.sort_inv (henv : Ordered env) (H : env.IsType U Γ (.sort u)) : u.WF U :=
+  let ⟨_, h⟩ := H; h.sort_inv henv
+
+variable! (henv : Ordered env)
+  (envIH : env.OnTypes fun U e A => env.HasType U [] e A ∧ env.IsType U [] A) in
+theorem IsDefEq.isType' (hΓ : OnCtx Γ (env.IsType U)) (H : env.IsDefEq U Γ e1 e2 A) :
+    env.IsType U Γ A := by
+  induction H using IsDefEq.rec
+      (motive_2 := fun _ _ _ _ _ => True) with
+  | bvar h => exact .lookup henv hΓ h
+  | proofIrrel h1 => exact ⟨_, h1⟩
+  | extra h1 h2 =>
+    have ⟨_, _, _, h⟩ := envIH.2 h1
+    exact ⟨_, (h.instL h2).weak0 henv⟩
+  | sortDF h1 => exact ⟨_, .sort h1⟩
+  | constDF h1 h2 =>
+    let ⟨_, h, _⟩ := envIH.1 h1
+    exact ⟨_, (h.instL h2).weak0 henv⟩
+  | symm _ ih => exact ih hΓ
+  | trans _ _ ih1 => exact ih1 hΓ
+  | appDF _ h2 ih1 => exact ((ih1 hΓ).forallE_inv henv).2.instN henv .zero h2.hasType.1
+  | lamDF h1 _ _ ih2 =>
+    let ⟨_, h⟩ := ih2 ⟨hΓ, _, h1.hasType.1⟩
+    exact ⟨_, .forallE h1.hasType.1 h⟩
+  | forallEDF h1 _ ih1 ih2 =>
+    exact ⟨_, .sort ⟨(ih1 hΓ).sort_inv henv, (ih2 ⟨hΓ, _, h1.hasType.1⟩).sort_inv henv⟩⟩
+  | defeqDF h1 => exact ⟨_, h1.hasType.2⟩
+  | beta _ h2 ih1 ih2 =>
+    have ⟨_, h⟩ := ih2 hΓ
+    exact (ih1 ⟨hΓ, _, h.hasType.2⟩).instN henv .zero h2
+  | eta _ ih => exact ih hΓ
+  | structEta _ _ _ _ _ _ _ _ ihMajor _ => exact ihMajor hΓ
+  | nil | cons => trivial
+
+theorem Ordered.isType (H : Ordered env) :
+    env.OnTypes fun U e A => env.HasType U [] e A ∧ env.IsType U [] A :=
+  H.induction (fun env U e A => env.HasType U [] e A ∧ env.IsType U [] A)
+    (fun h1 h2 => h2.imp (.mono h1) (.mono h1))
+    (fun henv ih h => ⟨h, h.isType' henv ih trivial⟩)
+
+theorem IsDefEq.isType (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U))
+    (H : env.IsDefEq U Γ e1 e2 A) : env.IsType U Γ A := H.isType' henv henv.isType hΓ
+
+theorem IsDefEq.sort_r (henv : Ordered env)
+    (hΓ : OnCtx Γ (env.IsType U)) (H : env.IsDefEq U Γ e1 e2 (.sort u)) : u.WF U :=
+  (H.isType henv hΓ).sort_inv henv
+
+theorem IsDefEq.instDF
+    (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U))
+    (hf : env.IsDefEq U (A::Γ) f f' B) (ha : env.IsDefEq U Γ a a' A) :
+    env.IsDefEq U Γ (f.inst a) (f'.inst a') (B.inst a) :=
+  have ⟨_, hA⟩ := ha.isType henv hΓ
+  have ⟨_, hB⟩ := hf.isType henv (Γ := _::_) ⟨hΓ, _, hA⟩
+  have H2 {f f' B v}
+      (hf : env.IsDefEq U (A::Γ) f f' B)
+      (hi : IsDefEq env U Γ (inst B a) (inst B a') (.sort v)) :
+      env.IsDefEq U Γ (f.inst a) (f'.inst a') (B.inst a) :=
+    (IsDefEq.beta hf.hasType.1 ha.hasType.1).symm.trans <|
+      .trans (.appDF (.lamDF hA hf) ha) <|
+      .defeqDF (.symm hi) (.beta hf.hasType.2 ha.hasType.2)
+  H2 hf <| H2 hB (HasType.sort (hB.sort_r henv (Γ := _::_) ⟨hΓ, _, hA⟩))
diff --git a/Ix/Theory/Named/Typing/Meta.lean b/Ix/Theory/Named/Typing/Meta.lean
new file mode 100644
index 000000000..f17cc9a5a
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Meta.lean
@@ -0,0 +1,54 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Lemmas
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+namespace VEnv
+
+theorem with_addConst {P : Prop} {env env' : VEnv} {cis : List VObject}
+    (henv : Ordered env)
+    (hci : env.HasObjects cis → ci.WF env)
+    (IH : ∀ {env1}, Ordered env1 →
+      env1.HasObjects (.const n ci :: cis) → f env1 = some env' → P)
+    (hcis : env.HasObjects cis)
+    (H : (env.addConst n ci >>= f) = some env') : P := by
+  let ⟨env1, h1, henv1⟩ := Option.bind_eq_some_iff.1 H
+  refine IH (.const henv (hci hcis) h1) (hcis.const h1) henv1
+
+theorem Lookup.zero' (eq : A.lift = ty') :
+    Lookup (A::Γ) 0 ty' := eq ▸ .zero
+theorem Lookup.succ' (h : Lookup Γ n ty) (eq : ty.lift = ty') :
+    Lookup (A::Γ) (n+1) ty' := eq ▸ .succ h
+
+syntax "lookup_tac" : tactic
+macro_rules | `(tactic| lookup_tac) => `(tactic|
+  first
+  | refine Lookup.zero' ?_; exact rfl
+  | refine Lookup.succ' (ty := ?_) ?_ ?_ <;> [skip; lookup_tac; exact rfl]
+)
+
+theorem HasType.app' (h1 : HasType env U Γ f (.forallE A B)) (h2 : HasType env U Γ a A)
+    (eq : B.inst a = B') : HasType env U Γ (.app f a) B' := eq ▸ .appDF h1 h2
+theorem HasType.const'
+  (h1 : constants env c = some ci)
+  (h2 : ∀ (l : VLevel), l ∈ ls → VLevel.WF uvars l)
+  (h3 : List.length ls = ci.uvars)
+  (eq : .instL ls ci.type = ty') :
+  HasType env uvars Γ (.const c ls) ty' := eq ▸ .const h1 h2 h3
+
+syntax "type_tac" : tactic -- TODO: write an actual tactic
+macro_rules | `(tactic| type_tac) => `(tactic|
+  first
+  | refine HasType.forallE (u := ?_) (v := ?_) ?_ ?_ <;> [skip; skip; type_tac; type_tac]
+  | refine HasType.sort ?_; decide
+  | refine HasType.bvar ?_; lookup_tac
+  | refine HasType.app' (A := ?_) (B := ?_) ?_ ?_ ?_ <;> [skip; skip; type_tac; type_tac; exact rfl]
+  | refine HasType.const' (ci := ?_) ?_ ?_ ?_ ?_ <;> [skip; assumption; decide; decide; exact rfl]
+  | refine HasType.lam (u := ?_) ?_ ?_ <;> [skip; type_tac; type_tac]
+)
diff --git a/Ix/Theory/Named/Typing/NestedInductiveLemmas.lean b/Ix/Theory/Named/Typing/NestedInductiveLemmas.lean
new file mode 100644
index 000000000..1a8ad71d8
--- /dev/null
+++ b/Ix/Theory/Named/Typing/NestedInductiveLemmas.lean
@@ -0,0 +1,190 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.NestedInductive
+import Ix.Theory.Named.Typing.InductiveLemmas
+
+/-!
+# Nested transaction facts and preservation (Spec-09C)
+
+The `addInductNested` analog of the block-wide transaction lemma suite:
+exact phase recovery, atomicity, monotonicity, freshness, lookup and rule
+membership through `ctorFold_spec`/`rulesFold_spec`, and `Ordered`
+preservation from the `NestedBlockChecked.WF` package.
+-/
+
+namespace Ix.Theory.Named
+
+open VInductDecl
+
+namespace VEnv
+
+/-- Recover every phase boundary from a successful nested transaction. -/
+theorem addInductNested_trace {source : VInductDecl}
+    {nested : source.NestedBlockChecked}
+    (hadd : addInductNested env nested = some env') :
+    Nonempty (AddInductNestedTrace env env' nested) := by
+  unfold addInductNested at hadd
+  obtain ⟨typeEnv, addTypes, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  obtain ⟨ctorEnv, addCtors, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  obtain ⟨recEnv, addRecs, hadd⟩ := Option.bind_eq_some_iff.1 hadd
+  cases hadd
+  exact ⟨⟨typeEnv, ctorEnv, recEnv, addTypes, addCtors, addRecs, rfl⟩⟩
+
+/-- The nested transaction is atomic at its public `Option` boundary. -/
+theorem addInductNested_atomic {source : VInductDecl}
+    (env : VEnv) (nested : source.NestedBlockChecked) :
+    addInductNested env nested = none ∨
+      ∃ env', addInductNested env nested = some env' ∧
+        Nonempty (AddInductNestedTrace env env' nested) := by
+  cases hadd : addInductNested env nested with
+  | none => exact .inl rfl
+  | some env' => exact .inr ⟨env', rfl, addInductNested_trace hadd⟩
+
+namespace AddInductNestedTrace
+
+variable {source : VInductDecl} {nested : source.NestedBlockChecked}
+
+/-- Every phase of a successful nested transaction only grows the Theory
+environment. -/
+theorem le (H : AddInductNestedTrace env env' nested) : env ≤ env' := by
+  have htypes := (ctorFold_spec source.blockTypeConstants H.addTypes).1
+  have hctors := (ctorFold_spec source.blockConstructorConstants H.addCtors).1
+  have hrecs := (ctorFold_spec nested.recursors H.addRecs).1
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec nested.generatedRules H.recEnv).1
+  exact htypes.trans (hctors.trans (hrecs.trans hrules))
+
+/-- Every source family name was fresh before the transaction. -/
+theorem family_fresh (H : AddInductNestedTrace env env' nested)
+    {type : VInductiveType} (htype : type ∈ source.types) :
+    env.constants type.name = none := by
+  have hmem : type.toVConstVal ∈ source.blockTypeConstants :=
+    List.mem_map.2 ⟨type, htype, rfl⟩
+  simpa [VInductDecl.blockTypeConstants] using
+    (ctorFold_spec source.blockTypeConstants H.addTypes).2.2
+      type.toVConstVal hmem
+
+/-- The final environment stores every exact source family constant. -/
+theorem family_lookup (H : AddInductNestedTrace env env' nested)
+    {type : VInductiveType} (htype : type ∈ source.types) :
+    env'.constants type.name = some type.toVConstant := by
+  have hmem : type.toVConstVal ∈ source.blockTypeConstants :=
+    List.mem_map.2 ⟨type, htype, rfl⟩
+  have hlookup :=
+    (ctorFold_spec source.blockTypeConstants H.addTypes).2.1
+      type.toVConstVal hmem
+  have hctors := (ctorFold_spec source.blockConstructorConstants H.addCtors).1
+  have hrecs := (ctorFold_spec nested.recursors H.addRecs).1
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec nested.generatedRules H.recEnv).1
+  exact (hctors.trans (hrecs.trans hrules)).constants hlookup
+
+/-- Every flattened source constructor name was fresh before the nested
+transaction. -/
+theorem ctor_fresh (H : AddInductNestedTrace env env' nested)
+    {c : VConstVal} (hc : c ∈ source.blockConstructorConstants) :
+    env.constants c.name = none := by
+  have htypes := (ctorFold_spec source.blockTypeConstants H.addTypes).1
+  have hfresh :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).2.2 c hc
+  exact htypes.constants_none hfresh
+
+/-- The final environment stores every exact source constructor
+constant. -/
+theorem ctor_lookup (H : AddInductNestedTrace env env' nested)
+    {type : VInductiveType} (htype : type ∈ source.types)
+    {c : VConstVal} (hc : c ∈ type.ctors) :
+    env'.constants c.name = some c.toVConstant := by
+  have hmem : c ∈ source.blockConstructorConstants :=
+    List.mem_flatMap.2 ⟨type, htype, hc⟩
+  have hlookup :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).2.1 c hmem
+  have hrecs := (ctorFold_spec nested.recursors H.addRecs).1
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec nested.generatedRules H.recEnv).1
+  exact (hrecs.trans hrules).constants hlookup
+
+/-- The final environment stores every restored recursor constant. -/
+theorem rec_lookup (H : AddInductNestedTrace env env' nested)
+    {recursor : VConstVal} (hrec : recursor ∈ nested.recursors) :
+    env'.constants recursor.name = some recursor.toVConstant := by
+  have hlookup := (ctorFold_spec nested.recursors H.addRecs).2.1 recursor hrec
+  have hrules : H.recEnv ≤ env' := by
+    simpa only [H.addRules] using
+      (rulesFold_spec nested.generatedRules H.recEnv).1
+  exact hrules.constants hlookup
+
+/-- Every restored recursor name was fresh before the nested transaction. -/
+theorem rec_fresh (H : AddInductNestedTrace env env' nested)
+    {recursor : VConstVal} (hrec : recursor ∈ nested.recursors) :
+    env.constants recursor.name = none := by
+  have htypes := (ctorFold_spec source.blockTypeConstants H.addTypes).1
+  have hctors :=
+    (ctorFold_spec source.blockConstructorConstants H.addCtors).1
+  have hfresh := (ctorFold_spec nested.recursors H.addRecs).2.2 recursor hrec
+  exact (htypes.trans hctors).constants_none hfresh
+
+/-- The final environment registers every restored rule. -/
+theorem rule_mem (H : AddInductNestedTrace env env' nested)
+    {df : VDefEq} (hdf : df ∈ nested.generatedRules) :
+    env'.defeqs df := by
+  simpa only [H.addRules] using
+    (rulesFold_spec nested.generatedRules H.recEnv).2 df hdf
+
+end AddInductNestedTrace
+
+nonrec theorem addInductNested_le {source : VInductDecl}
+    {nested : source.NestedBlockChecked}
+    (hadd : addInductNested env nested = some env') : env ≤ env' := by
+  obtain ⟨H⟩ := addInductNested_trace hadd
+  exact H.le
+
+end VEnv
+
+/-- A chained constant package folds into `Ordered` preservation. -/
+theorem NestedConstsWF.fold_ordered :
+    ∀ {cs : List VConstVal} {env env' : VEnv},
+      VEnv.Ordered env → NestedConstsWF env cs →
+      cs.foldlM (fun env c => env.addConst c.name c.toVConstant) env =
+        some env' →
+      VEnv.Ordered env'
+  | [], _, _, h, _, hf => by cases hf; exact h
+  | c :: cs, env, env', h, hwf, hf => by
+    rw [List.foldlM_cons] at hf
+    obtain ⟨env₁, hadd, htail⟩ := Option.bind_eq_some_iff.1 hf
+    exact NestedConstsWF.fold_ordered (.const h hwf.1 hadd)
+      (hwf.2 env₁ hadd) htail
+
+/-- A chained rule package folds into `Ordered` preservation. -/
+theorem NestedRulesWF.fold_ordered :
+    ∀ {dfs : List VDefEq} {env : VEnv},
+      VEnv.Ordered env → NestedRulesWF env dfs →
+      VEnv.Ordered (dfs.foldl VEnv.addDefEq env)
+  | [], _, h, _ => h
+  | df :: dfs, env, h, hwf => by
+    rw [List.foldl_cons]
+    exact NestedRulesWF.fold_ordered (.defeq h hwf.1) hwf.2
+
+/-- `Ordered` preservation for the nested transaction. -/
+theorem VEnv.addInductNested_WF {source : VInductDecl}
+    {nested : source.NestedBlockChecked}
+    (ih : VEnv.Ordered env) (h1 : nested.WF env)
+    (h2 : addInductNested env nested = some env') : VEnv.Ordered env' := by
+  unfold addInductNested at h2
+  obtain ⟨typeEnv, addTypes, h2⟩ := Option.bind_eq_some_iff.1 h2
+  obtain ⟨ctorEnv, addCtors, h2⟩ := Option.bind_eq_some_iff.1 h2
+  obtain ⟨recEnv, addRecs, h2⟩ := Option.bind_eq_some_iff.1 h2
+  cases h2
+  have hT := NestedConstsWF.fold_ordered ih h1.types addTypes
+  have hC := NestedConstsWF.fold_ordered hT (h1.ctors addTypes) addCtors
+  have hR := NestedConstsWF.fold_ordered hC (h1.recs addTypes addCtors) addRecs
+  exact NestedRulesWF.fold_ordered hR (h1.rules addTypes addCtors addRecs)
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Typing/Pattern.lean b/Ix/Theory/Named/Typing/Pattern.lean
new file mode 100644
index 000000000..7927638e6
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Pattern.lean
@@ -0,0 +1,466 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.VExpr
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+open VExpr
+
+inductive Pattern where
+  | const (c : Name)
+  | app (f a : Pattern)
+  | var (f : Pattern)
+
+@[reducible] def Pattern.varN (p : Pattern) : Nat → Pattern
+  | 0 => p
+  | n+1 => (p.varN n).var
+
+inductive Subpattern (p : Pattern) : Pattern → Prop where
+  | refl : Subpattern p p
+  | appL : Subpattern p f → Subpattern p (.app f a)
+  | appR : Subpattern p a → Subpattern p (.app f a)
+  | varL : Subpattern p f → Subpattern p (.var f)
+
+theorem Subpattern.varN (h : Subpattern p f) : ∀ {n}, Subpattern p (.varN f n)
+  | 0 => h
+  | _+1 => .varL (.varN h)
+
+theorem Subpattern.trans {p₁ p₂ p₃} (H₁ : Subpattern p₁ p₂) (H₂ : Subpattern p₂ p₃) : Subpattern p₁ p₃ := by
+  induction H₂ with
+  | refl => exact H₁
+  | appL _ ih => exact .appL ih
+  | appR _ ih => exact .appR ih
+  | varL _ ih => exact .varL ih
+
+theorem Subpattern.sizeOf_le {p₁ p₂} (H₁ : Subpattern p₁ p₂) : sizeOf p₁ ≤ sizeOf p₂ := by
+  induction H₁ <;> simp <;> omega
+
+theorem Subpattern.antisymm {p₁ p₂} (H₁ : Subpattern p₁ p₂) (H₂ : Subpattern p₂ p₁) : p₂ = p₁ := by
+  cases id H₂ with
+  | refl => rfl
+  | _ h₂ =>
+    have H₁ := H₁.sizeOf_le
+    have h₂ := h₂.sizeOf_le
+    simp at H₁; omega
+
+inductive Arity (p : Pattern) : Nat → Pattern → Prop where
+  | refl : Arity p 0 p
+  | app : Arity p n f → Arity p (n+1) (.app f a)
+  | var : Arity p n f → Arity p (n+1) (.var f)
+
+theorem Arity.subpattern : Arity p n p' → Subpattern p p'
+  | .refl => .refl
+  | .app h => .appL h.subpattern
+  | .var h => .varL h.subpattern
+
+def Pattern.inter : Pattern → Pattern → Option Pattern
+  | .const c, .const c' => if c = c' then some (.const c) else none
+  | .app f a, .app f' a' => return .app (← f.inter f') (← a.inter a')
+  | .var f, .var f' => return .var (← f.inter f')
+  | .app f a, .var f' => return .app (← f.inter f') a
+  | .var f, .app f' a' => return .app (← f.inter f') a'
+  | _, _ => none
+
+theorem Pattern.inter_self (p : Pattern) : p.inter p = some p := by induction p <;> simp [*, inter]
+
+theorem Pattern.inter_comm (p q : Pattern) : p.inter q = q.inter p := by
+  induction p generalizing q <;> cases q <;> simp [*, eq_comm, inter] <;> split <;> simp [*]
+
+inductive Pattern.LE : Pattern → Pattern → Prop where
+  | refl : LE p p
+  | var : LE f f' → LE (.var f) (.var f')
+  | app : LE f f' → LE a a' → LE (.app f a) (.app f' a')
+  | app_var : LE f f' → LE (.app f a) (.var f')
+
+@[reducible] def Pattern.Path : Pattern → Type
+  | .const _ => Empty
+  | .app f a => f.Path ⊕ a.Path
+  | .var f => Option f.Path
+
+inductive Pattern.Matches : (p : Pattern) → VExpr → List VLevel → (p.Path → VExpr) → Prop
+  | const : Matches (.const c) (.const c ls) ls nofun
+  | var : Matches f f' f1 g1 → Matches (.var f) (.app f' a') f1 (·.elim a' g1)
+  | app : Matches f f' f1 g1 → Matches a a' f2 g2 →
+    Matches (.app f a) (.app f' a') f1 (Sum.elim g1 g2)
+
+theorem Pattern.Matches.uniq {p : Pattern} {e : VExpr} {m1 m2 m1' m2'}
+    (H1 : Pattern.Matches p e m1 m2) (H2 : Pattern.Matches p e m1' m2') : m1 = m1' ∧ m2 = m2' := by
+  induction H1 generalizing m1' with cases H2
+  | const => simp
+  | var _ ih => rename_i h; simp [ih h]
+  | app _ _ ih1 ih2 => rename_i h2 h1; simp [ih1 h1, ih2 h2]
+
+def Pattern.OnArgs (P : VExpr → Prop) : Pattern → Prop
+  | .const .. => True
+  | .var f => f.OnArgs P
+  | .app f a => f.OnArgs P ∧ a.OnArgs P ∧ ∀ e m1 m2, a.Matches e m1 m2 → P e
+
+inductive Pattern.RHS (p : Pattern) where
+  | fixed (c : VExpr) (_ : c.Closed)
+  | app (f a : RHS p)
+  | var (e : p.Path)
+
+inductive Pattern.Check (p : Pattern) where
+  | true
+  | defeq (x y : RHS p) (rest : Check p)
+
+def Pattern.RHS.apply {p : Pattern} (m1 : List VLevel) (m2 : p.Path → VExpr) : p.RHS → VExpr
+  | .fixed c _ => c.instL m1
+  | .var path => m2 path
+  | .app f a => .app (f.apply m1 m2) (a.apply m1 m2)
+
+theorem Pattern.RHS.lift'_apply {p : Pattern} {m1 m2} (r : p.RHS) :
+    (r.apply m1 m2).lift' ρ = (r.apply m1 fun x => (m2 x).lift' ρ) := by
+  induction r <;> simp [*, apply, lift', ← instL_lift']
+  rw [ClosedN.lift'_eq ‹_› (by trivial)]
+
+theorem Pattern.RHS.liftN_apply {p : Pattern} {m1 m2} (r : p.RHS) :
+    (r.apply m1 m2).liftN n k = (r.apply m1 fun x => (m2 x).liftN n k) := by
+  simp [← lift'_consN_skipN, lift'_apply]
+
+theorem Pattern.matches_lift' {p : Pattern} {e : VExpr} {m1 m2'} :
+    p.Matches (e.lift' ρ) m1 m2' ↔
+    ∃ m2, p.Matches e m1 m2 ∧ ∀ x, m2' x = (m2 x).lift' ρ := by
+  constructor
+  · intro h; generalize eq : e.lift' ρ = e' at h
+    induction h generalizing e with
+    | const => cases e <;> cases eq; exact ⟨_, .const, nofun⟩
+    | var _ ih =>
+      cases e <;> cases eq
+      have ⟨_, l1, l2⟩ := ih rfl
+      refine ⟨_, .var l1, ?_⟩
+      rintro (_|_) <;> solve_by_elim
+    | app _ _ ih1 ih2 =>
+      cases e <;> cases eq
+      have ⟨_, l1, l2⟩ := ih1 rfl
+      have ⟨_, r1, r2⟩ := ih2 rfl
+      refine ⟨_, .app l1 r1, ?_⟩
+      rintro (_|_) <;> solve_by_elim
+  · intro ⟨m2, h1, h2⟩
+    induction h1 with
+    | const => exact (show m2' = _ by ext ⟨⟩) ▸ .const
+    | var _ ih =>
+      have := (ih (h2 <| some ·)).var (a' := ?_)
+      rwa [(_ : m2' = _)]; ext (_|_) <;> simp [h2 none]
+    | app _ _ ih1 ih2 =>
+      have := (ih1 (h2 <| .inl ·)).app (ih2 (h2 <| .inr ·))
+      rwa [(_ : m2' = _)]; ext (_|_) <;> rfl
+
+theorem Pattern.matches_liftN {p : Pattern} {e : VExpr} {m1 m2'} :
+    p.Matches (e.liftN n k) m1 m2' ↔ ∃ m2, p.Matches e m1 m2 ∧ ∀ x, m2' x = (m2 x).liftN n k := by
+  simp only [← lift'_consN_skipN]; exact p.matches_lift'
+
+theorem Pattern.RHS.instN_apply {p : Pattern} {m1 m2} (r : p.RHS) :
+    (r.apply m1 m2).inst e₀ k = (r.apply m1 fun x => (m2 x).inst e₀ k) := by
+  induction r <;> simp [*, apply, inst]
+  rw [(ClosedN.instL ‹_›).instN_eq (Nat.zero_le _)]
+
+theorem Pattern.matches_instN {p : Pattern} {e : VExpr} {m1 m2} (H : p.Matches e m1 m2) :
+    p.Matches (e.inst e₀ k) m1 fun x => (m2 x).inst e₀ k := by
+  induction H with
+  | const => erw [show (fun _ : Empty => _) = _ by ext ⟨⟩]; exact .const
+  | var _ ih =>
+    rw [(_ : (fun _ => _) = _)]; exact ih.var
+    ext (_|_) <;> rfl
+  | app _ _ ih1 ih2 =>
+    rw [(_ : (fun _ => _) = _)]; exact ih1.app ih2
+    ext (_|_) <;> rfl
+
+/-- Universe instantiation preserves a successful match.  The universe
+capture is instantiated pointwise and every expression capture is
+instantiated by the same level substitution. -/
+theorem Pattern.Matches.instL {p : Pattern} {e : VExpr} {m1 m2}
+    (H : p.Matches e m1 m2) (ls : List VLevel) :
+    p.Matches (e.instL ls) (m1.map (VLevel.inst ls))
+      fun x => (m2 x).instL ls := by
+  induction H with
+  | const => erw [show (fun _ : Empty => _) = _ by ext ⟨⟩]; exact .const
+  | var _ ih =>
+    rw [(_ : (fun _ => _) = _)]; exact ih.var
+    ext (_|_) <;> rfl
+  | app _ _ ih1 ih2 =>
+    rw [(_ : (fun _ => _) = _)]; exact ih1.app ih2
+    ext (_|_) <;> rfl
+
+theorem Pattern.matches_inter {p q : Pattern} {e : VExpr} :
+    (∃ m1 m2, p.Matches e m1 m2) ∧ (∃ m1 m2, q.Matches e m1 m2) ↔
+    (∃ r m1 m2, p.inter q = some r ∧ r.Matches e m1 m2) := by
+  constructor
+  · rintro ⟨⟨m1, m2, hp⟩, ⟨m3, m4, hq⟩⟩
+    induction hp generalizing q m3 <;> cases hq <;> simp [inter]
+    · case const.const => exact ⟨_, _, .const⟩
+    · case var.var ih _ _ ih' =>
+      have ⟨rf, mf1, mf2, hf1, hf2⟩ := ih _ _ ih'
+      exact ⟨_, ⟨_, hf1, rfl⟩, _, _, .var hf2⟩
+    · case var.app ihf _ _ _ _ _ ha2 ihf' =>
+      have ⟨rf, mf1, mf2, hf1, hf2⟩ := ihf _ _ ihf'
+      exact ⟨_, ⟨_, hf1, rfl⟩, _, _, .app hf2 ha2⟩
+    · case app.var ha2 ihf _ _ _ ihf' =>
+      have ⟨rf, mf1, mf2, hf1, hf2⟩ := ihf _ _ ihf'
+      exact ⟨_, ⟨_, hf1, rfl⟩, _, _, .app hf2 ha2⟩
+    · case app.app ihf iha _ _ _ _ _ iha' ihf' =>
+      have ⟨rf, mf1, mf2, hf1, hf2⟩ := ihf _ _ ihf'
+      have ⟨ra, ma1, ma2, ha1, ha2⟩ := iha _ _ iha'
+      exact ⟨_, ⟨_, hf1, _, ha1, rfl⟩, _, _, .app hf2 ha2⟩
+  · rintro ⟨r, m1, m2, h1, h2⟩
+    induction p generalizing q e r m1 <;> cases q <;> simp [inter] at h1 <;> [
+        obtain ⟨rfl, rfl⟩ := h1; obtain ⟨_, wf, _, wa, rfl⟩ := h1;
+        obtain ⟨_, wf, rfl⟩ := h1; obtain ⟨_, wf, rfl⟩ := h1; obtain ⟨_, wf, rfl⟩ := h1
+      ] <;> cases h2
+    · exact ⟨⟨_, _, .const⟩, ⟨_, _, .const⟩⟩
+    · next ihf iha _ _ _ _ _ _ _ _ _ ha hf =>
+      have ⟨⟨mf1, mf2, hf⟩, ⟨mf1', mf2', hf'⟩⟩ := ihf _ _ _ wf hf
+      have ⟨⟨ma1, ma2, ha⟩, ⟨ma1', ma2', ha'⟩⟩ := iha _ _ _ wa ha
+      exact ⟨⟨_, _, .app hf ha⟩, ⟨_, _, .app hf' ha'⟩⟩
+    · next ihf _ _ _ _ _ _ _ _ ha hf =>
+      have ⟨⟨mf1, mf2, hf⟩, ⟨mf1', mf2', hf'⟩⟩ := ihf _ _ _ wf hf
+      exact ⟨⟨_, _, .app hf ha⟩, ⟨_, _, .var hf'⟩⟩
+    · next ihf _ _ _ _ _ _ _ _ ha' hf =>
+      have ⟨⟨mf1, mf2, hf⟩, ⟨mf1', mf2', hf'⟩⟩ := ihf _ _ _ wf hf
+      exact ⟨⟨_, _, .var hf⟩, ⟨_, _, .app hf' ha'⟩⟩
+    · next ihf _ _ _ _ _ hf =>
+      have ⟨⟨mf1, mf2, hf⟩, ⟨mf1', mf2', hf'⟩⟩ := ihf _ _ _ wf hf
+      exact ⟨⟨_, _, .var hf⟩, ⟨_, _, .var hf'⟩⟩
+
+theorem Pattern.matches_determ
+    (h1 : Matches p e m1 m2) (h2 : Matches p e m1' m2') : m1 = m1' ∧ m2 = m2' := by
+  induction h1 generalizing m1' with
+  | const => let .const := h2; simp
+  | app l1 l2 ih1 ih2 => let .app r1 r2 := h2; simp [ih1 r1, ih2 r2]
+  | var l1 ih1 => let .var r1 := h2; simp [ih1 r1]
+
+def Pattern.Check.OK (defeq : VExpr → VExpr → Prop) {p : Pattern}
+    (m1 : List VLevel) (m2 : p.Path → VExpr) : p.Check → Prop
+  | .true => True
+  | .defeq a b rest => defeq (RHS.apply m1 m2 a) (RHS.apply m1 m2 b) ∧ rest.OK defeq m1 m2
+
+theorem Pattern.Check.OK.map
+    {df df' : VExpr → VExpr → Prop} {p : Pattern} {ck : p.Check} {m1 m2 m1' m2'}
+    (h : ∀ a b : p.RHS,
+      df (a.apply m1 m2) (b.apply m1 m2) → df' (a.apply m1' m2') (b.apply m1' m2'))
+    (H : ck.OK df m1 m2) : ck.OK df' m1' m2' := by
+  induction ck <;> simp [OK, *] at H ⊢; cases H; constructor <;> solve_by_elim
+
+inductive SimplePattern where
+  | iota (recursor : Name) (major : Nat) (constr : Name) (args : Nat)
+  | defn (head : Name)
+
+@[reducible] def SimplePattern.toPattern : SimplePattern → Pattern
+  | .defn c => .const c
+  | .iota r m c n => .app (.varN (.const r) m) (.varN (.const c) n)
+
+/-! ## Shape helpers for generated recursor patterns
+
+`HeadConstN`, `HeadConst`, `of_varN_matches`, `RecursorIotaPattern`, and
+`matches_shape` form the implementation-independent shape layer consumed by
+the generated iota patterns of a certified inductive block
+(`Theory/Typing/InductivePattern.lean`). They characterize matching against
+`Pattern.varN` towers and `SimplePattern.iota` patterns without referring to
+any generator data. -/
+
+/-- `HeadConstN c ls n e`: `e` is the constant `c` at levels `ls` applied to
+exactly `n` arguments. This is the expression shape captured by matching the
+pattern `Pattern.varN (.const c) n`. -/
+inductive HeadConstN (c : Name) (ls : List VLevel) : Nat → VExpr → Prop where
+  | const : HeadConstN c ls 0 (.const c ls)
+  | app : HeadConstN c ls n f → HeadConstN c ls (n+1) (.app f a)
+
+/-- `e` is an application spine headed by the constant `c`. -/
+def HeadConst (c : Name) (e : VExpr) : Prop := ∃ ls n, HeadConstN c ls n e
+
+/-- Matching a `varN` tower of a constant captures exactly a `HeadConstN`
+spine whose head levels are the pattern's level assignment. -/
+theorem Pattern.of_varN_matches {c : Name} :
+    ∀ {n : Nat} {e : VExpr} {m2}, (Pattern.varN (.const c) n).Matches e m1 m2 →
+      HeadConstN c m1 n e := by
+  intro n
+  induction n with
+  | zero => intro e m2 H; cases H; exact .const
+  | succ n ih => intro e m2 H; cases H with | var h => exact .app (ih h)
+
+/-- Every `HeadConstN` spine matches its `varN` tower. -/
+theorem HeadConstN.matches : HeadConstN c ls n e →
+    ∃ m2, (Pattern.varN (.const c) n).Matches e ls m2
+  | .const => ⟨_, .const⟩
+  | .app h => let ⟨_, h'⟩ := h.matches; ⟨_, .var h'⟩
+
+/-- The capture paths of an `n`-ary `varN` tower in argument order (outermost
+application first): matching assigns the `t`-th entry the `t`-th spine
+argument. -/
+def Pattern.varNPaths (p : Pattern) : ∀ n, List (Pattern.Path (p.varN n))
+  | 0 => []
+  | n+1 => (varNPaths p n).map some ++ [none]
+
+@[simp] theorem Pattern.varNPaths_length (p : Pattern) :
+    ∀ n, (varNPaths p n).length = n
+  | 0 => rfl
+  | n+1 => by
+    show ((varNPaths p n).map some ++ [none]).length = n + 1
+    rw [List.length_append, List.length_map, varNPaths_length p n]; rfl
+
+/-- The exact pattern of one generated iota rule: the recursor constant
+applied to `major` arguments (parameters, motives, minors, and the
+constructor's result indices), with a `ctor`-headed major premise carrying
+`args` arguments. Definitionally `(SimplePattern.iota recursor major ctor
+args).toPattern`. -/
+def RecursorIotaPattern (recursor : Name) (major : Nat)
+    (ctor : Name) (args : Nat) : Pattern :=
+  .app (.varN (.const recursor) major) (.varN (.const ctor) args)
+
+theorem SimplePattern.toPattern_iota :
+    (SimplePattern.iota r m c n).toPattern = RecursorIotaPattern r m c n := rfl
+
+/-- Match inversion for an iota pattern: the expression is exactly a
+recursor-headed spine at the pattern's level assignment whose last argument
+is a constructor-headed spine (at unconstrained levels). -/
+theorem RecursorIotaPattern.matches_shape
+    (H : (RecursorIotaPattern r mj c n).Matches e m1 m2) :
+    ∃ f a ls, e = .app f a ∧ HeadConstN r m1 mj f ∧ HeadConstN c ls n a := by
+  cases H with
+  | app h1 h2 =>
+    exact ⟨_, _, _, rfl, Pattern.of_varN_matches h1, Pattern.of_varN_matches h2⟩
+
+/-- Match construction for an iota pattern from the two head spines. -/
+theorem RecursorIotaPattern.matches_of
+    (h1 : HeadConstN r ls mj f) (h2 : HeadConstN c ls' n a) :
+    ∃ m2, (RecursorIotaPattern r mj c n).Matches (.app f a) ls m2 :=
+  let ⟨_, hf⟩ := h1.matches
+  let ⟨_, ha⟩ := h2.matches
+  ⟨_, .app hf ha⟩
+
+/-- Subpatterns of a constant `varN` tower are exactly its shorter towers. -/
+theorem Subpattern.varN_const_le :
+    ∀ {n}, Subpattern p (Pattern.varN (.const c) n) →
+      ∃ j, j ≤ n ∧ p = Pattern.varN (.const c) j := by
+  intro n
+  induction n with
+  | zero => intro H; cases H; exact ⟨0, Nat.le_refl _, rfl⟩
+  | succ n ih =>
+    intro H
+    cases H with
+    | refl => exact ⟨n+1, Nat.le_refl _, rfl⟩
+    | varL h =>
+      let ⟨j, hj, hp⟩ := ih h
+      exact ⟨j, Nat.le_succ_of_le hj, hp⟩
+
+/-- Subpattern classification for an iota pattern: the whole pattern, a
+prefix of the recursor head, or a prefix of the constructor spine. -/
+theorem RecursorIotaPattern.subpattern_inv
+    (H : Subpattern p (RecursorIotaPattern r mj c n)) :
+    p = RecursorIotaPattern r mj c n ∨
+      (∃ j, j ≤ mj ∧ p = .varN (.const r) j) ∨
+      (∃ j, j ≤ n ∧ p = .varN (.const c) j) := by
+  cases H with
+  | refl => exact .inl rfl
+  | appL h => exact .inr (.inl h.varN_const_le)
+  | appR h => exact .inr (.inr h.varN_const_le)
+
+/-- Two constant `varN` towers intersect only when they agree exactly. -/
+theorem Pattern.varN_const_inter_some :
+    ∀ {n n' p}, (Pattern.varN (.const c) n).inter (Pattern.varN (.const c') n') = some p →
+      c = c' ∧ n = n' ∧ p = Pattern.varN (.const c) n := by
+  intro n
+  induction n with
+  | zero =>
+    intro n' p h
+    cases n' with
+    | zero =>
+      simp [Pattern.inter] at h
+      exact ⟨h.1, rfl, h.2.symm⟩
+    | succ n' => simp [Pattern.inter] at h
+  | succ n ih =>
+    intro n' p h
+    cases n' with
+    | zero => simp [Pattern.inter] at h
+    | succ n' =>
+      simp only [Pattern.inter, bind, Option.bind_eq_some_iff, Option.pure_def, Option.some.injEq] at h
+      obtain ⟨q, hq, rfl⟩ := h
+      obtain ⟨rfl, rfl, rfl⟩ := ih hq
+      exact ⟨rfl, rfl, rfl⟩
+
+theorem Pattern.varN_const_inter_of_ne_name (h : c ≠ c') (n n' : Nat) :
+    (Pattern.varN (.const c) n).inter (Pattern.varN (.const c') n') = none := by
+  cases e : (Pattern.varN (.const c) n).inter (Pattern.varN (.const c') n') with
+  | none => rfl
+  | some p => exact absurd (varN_const_inter_some e).1 h
+
+theorem Pattern.varN_const_inter_of_ne_arity (h : n ≠ n') (c c' : Name) :
+    (Pattern.varN (.const c) n).inter (Pattern.varN (.const c') n') = none := by
+  cases e : (Pattern.varN (.const c) n).inter (Pattern.varN (.const c') n') with
+  | none => rfl
+  | some p => exact absurd (varN_const_inter_some e).2.1 h
+
+/-- An application pattern intersects a constant `varN` tower only through a
+positive tower whose inner tower intersects the function part. -/
+theorem Pattern.app_inter_varN_const_some {f a : Pattern}
+    (h : (Pattern.app f a).inter (Pattern.varN (.const c) n) = some p) :
+    ∃ n' q, n = n' + 1 ∧ f.inter (Pattern.varN (.const c) n') = some q ∧
+      p = .app q a := by
+  cases n with
+  | zero => simp [Pattern.inter] at h
+  | succ n' =>
+    simp only [Pattern.inter, bind, Option.bind_eq_some_iff, Option.pure_def, Option.some.injEq] at h
+    obtain ⟨q, hq, rfl⟩ := h
+    exact ⟨n', q, rfl, hq, rfl⟩
+
+/-- Two iota patterns intersect only when they agree exactly. -/
+theorem RecursorIotaPattern.inter_some
+    (h : (RecursorIotaPattern r mj c n).inter (RecursorIotaPattern r' mj' c' n') = some p) :
+    r = r' ∧ mj = mj' ∧ c = c' ∧ n = n' ∧ p = RecursorIotaPattern r mj c n := by
+  simp only [RecursorIotaPattern, Pattern.inter, bind, Option.bind_eq_some_iff,
+    Option.pure_def, Option.some.injEq] at h
+  obtain ⟨q1, h1, q2, h2, rfl⟩ := h
+  obtain ⟨rfl, rfl, rfl⟩ := Pattern.varN_const_inter_some h1
+  obtain ⟨rfl, rfl, rfl⟩ := Pattern.varN_const_inter_some h2
+  exact ⟨rfl, rfl, rfl, rfl, rfl⟩
+
+/-- An iota pattern intersects a constant `varN` tower only at a tower whose
+inner arity is the pattern's major arity with the recursor's name. -/
+theorem RecursorIotaPattern.inter_varN_const_some
+    (h : (RecursorIotaPattern r mj c n).inter (Pattern.varN (.const b) j) = some p) :
+    b = r ∧ j = mj + 1 := by
+  obtain ⟨j', q, rfl, hq, rfl⟩ := Pattern.app_inter_varN_const_some h
+  obtain ⟨rfl, rfl, rfl⟩ := Pattern.varN_const_inter_some hq
+  exact ⟨rfl, rfl⟩
+
+/-- Constant `varN` towers are injective in the head name and the arity. -/
+theorem Pattern.varN_const_inj {c c' : Name} :
+    ∀ {n n' : Nat}, Pattern.varN (.const c) n = Pattern.varN (.const c') n' →
+      c = c' ∧ n = n'
+  | 0, 0, h => by cases h; exact ⟨rfl, rfl⟩
+  | 0, n'+1, h => absurd h (by simp [Pattern.varN])
+  | n+1, 0, h => absurd h (by simp [Pattern.varN])
+  | n+1, n'+1, h => by
+    injection h with h1
+    obtain ⟨rfl, rfl⟩ := Pattern.varN_const_inj h1
+    exact ⟨rfl, rfl⟩
+
+/-- Iota patterns are injective in all four components. -/
+theorem RecursorIotaPattern.inj
+    (h : RecursorIotaPattern r mj c n = RecursorIotaPattern r' mj' c' n') :
+    r = r' ∧ mj = mj' ∧ c = c' ∧ n = n' := by
+  injection h with h1 h2
+  obtain ⟨rfl, rfl⟩ := Pattern.varN_const_inj h1
+  obtain ⟨rfl, rfl⟩ := Pattern.varN_const_inj h2
+  exact ⟨rfl, rfl, rfl, rfl⟩
+
+/-- The only application subpattern of an iota pattern is the pattern
+itself. -/
+theorem RecursorIotaPattern.app_subpattern
+    (H : Subpattern (.app p₁ p₂) (RecursorIotaPattern r mj c n)) :
+    p₁ = .varN (.const r) mj ∧ p₂ = .varN (.const c) n := by
+  rcases RecursorIotaPattern.subpattern_inv H with heq | ⟨j, hj, heq⟩ | ⟨j, hj, heq⟩
+  · injection heq with h1 h2; exact ⟨h1, h2⟩
+  · cases j <;> exact absurd heq (by simp [Pattern.varN])
+  · cases j <;> exact absurd heq (by simp [Pattern.varN])
+
+/-- Apply an RHS template head to a list of template arguments. -/
+def Pattern.RHS.appN {p : Pattern} (f : p.RHS) : List p.RHS → p.RHS
+  | [] => f
+  | a :: as => Pattern.RHS.appN (.app f a) as
diff --git a/Ix/Theory/Named/Typing/QuotLemmas.lean b/Ix/Theory/Named/Typing/QuotLemmas.lean
new file mode 100644
index 000000000..1f69ed1ba
--- /dev/null
+++ b/Ix/Theory/Named/Typing/QuotLemmas.lean
@@ -0,0 +1,39 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Env
+import Ix.Theory.Named.Typing.Meta
+
+namespace Ix.Theory.Named
+namespace VEnv
+
+theorem addQuot_WF (henv : Ordered env) (hq : QuotReady env) :
+    addQuot env = some env' → Ordered env' := by
+  refine with_addConst (cis := [.const _ eqConst]) (hcis := ⟨hq, ⟨⟩⟩) henv
+    (fun _ => ⟨_, by type_tac⟩) fun henv => ?_
+  refine with_addConst henv (fun ⟨quot, _⟩ => ⟨_, by type_tac⟩) fun henv => ?_
+  refine with_addConst henv (fun ⟨_, quot, eq, _⟩ => ⟨_, by type_tac⟩) fun henv => ?_
+  refine with_addConst henv (fun ⟨_, _, quot, _⟩ => ⟨_, by type_tac⟩) fun henv => ?_
+  rintro ⟨_, _, _, _, eq, _⟩ ⟨⟩; exact .defeq henv ⟨by type_tac, by type_tac⟩
+
+section
+variable (henv : addQuot env = some env') include henv
+
+theorem addQuot_objs : env'.HasObjects [.defeq quotDefEq, .const `Quot.ind quotIndConst,
+    .const `Quot.lift quotLiftConst, .const `Quot.mk quotMkConst, .const `Quot quotConst] := by
+  let ⟨env, h, henv⟩ := HasObjects.bind_const (ls := []) trivial henv
+  let ⟨env, h, henv⟩ := HasObjects.bind_const h henv
+  let ⟨env, h, henv⟩ := HasObjects.bind_const h henv
+  obtain ⟨env, h, ⟨⟩⟩ := HasObjects.bind_const h henv
+  exact HasObjects.defeq (df := quotDefEq) h
+
+theorem addQuot_quot : env'.constants ``Quot = quotConst := (addQuot_objs henv).2.2.2.2.1
+theorem addQuot_quotMk : env'.constants ``Quot.mk = quotMkConst := (addQuot_objs henv).2.2.2.1
+theorem addQuot_quotLift : env'.constants ``Quot.lift = quotLiftConst := (addQuot_objs henv).2.2.1
+theorem addQuot_quotInd : env'.constants ``Quot.ind = quotIndConst := (addQuot_objs henv).2.1
+theorem addQuot_defeq : env'.defeqs quotDefEq := (addQuot_objs henv).1
+
+end
diff --git a/Ix/Theory/Named/Typing/Strong.lean b/Ix/Theory/Named/Typing/Strong.lean
new file mode 100644
index 000000000..f79f27dc7
--- /dev/null
+++ b/Ix/Theory/Named/Typing/Strong.lean
@@ -0,0 +1,1031 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Lemmas
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Ix.Theory.Named
+
+namespace VEnv
+
+open VExpr
+
+section
+set_option hygiene false
+variable (env : VEnv) (uvars : Nat)
+
+section
+local notation:65 Γ " ⊢ " e " : " A:30 => IsDefEqStrong Γ e e A
+local notation:65 Γ " ⊢ " e1 " ≡ " e2 " : " A:30 => IsDefEqStrong Γ e1 e2 A
+
+inductive IsDefEqStrong : List VExpr → VExpr → VExpr → VExpr → Prop where
+  | bvar : Lookup Γ i A → u.WF uvars → Γ ⊢ A : .sort u → Γ ⊢ .bvar i : A
+  | symm : Γ ⊢ e ≡ e' : A → Γ ⊢ e' ≡ e : A
+  | trans : Γ ⊢ e₁ ≡ e₂ : A → Γ ⊢ e₂ ≡ e₃ : A → Γ ⊢ e₁ ≡ e₃ : A
+  | sortDF :
+    l.WF uvars → l'.WF uvars → l ≈ l' →
+    Γ ⊢ .sort l ≡ .sort l' : .sort (.succ l)
+  | constDF :
+    env.constants c = some ci →
+    (∀ l ∈ ls, l.WF uvars) →
+    (∀ l ∈ ls', l.WF uvars) →
+    ls.length = ci.uvars →
+    List.Forall₂ (· ≈ ·) ls ls' →
+    u.WF uvars →
+    [] ⊢ ci.type.instL ls ≡ ci.type.instL ls' : .sort u →
+    Γ ⊢ ci.type.instL ls ≡ ci.type.instL ls' : .sort u →
+    Γ ⊢ .const c ls ≡ .const c ls' : ci.type.instL ls
+  | appDF :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A : .sort u →
+    A::Γ ⊢ B : .sort v →
+    Γ ⊢ f ≡ f' : .forallE A B →
+    Γ ⊢ a ≡ a' : A →
+    Γ ⊢ B.inst a ≡ B.inst a' : .sort v →
+    Γ ⊢ .app f a ≡ .app f' a' : B.inst a
+  | lamDF :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A ≡ A' : .sort u →
+    A::Γ ⊢ B : .sort v →
+    A'::Γ ⊢ B : .sort v →
+    A::Γ ⊢ body ≡ body' : B →
+    A'::Γ ⊢ body ≡ body' : B →
+    Γ ⊢ .lam A body ≡ .lam A' body' : .forallE A B
+  | forallEDF :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A ≡ A' : .sort u →
+    A::Γ ⊢ body ≡ body' : .sort v →
+    A'::Γ ⊢ body ≡ body' : .sort v →
+    Γ ⊢ .forallE A body ≡ .forallE A' body' : .sort (.imax u v)
+  | defeqDF :
+    u.WF uvars → Γ ⊢ A ≡ B : .sort u → Γ ⊢ e1 ≡ e2 : A → Γ ⊢ e1 ≡ e2 : B
+  | beta :
+    u.WF uvars → v.WF uvars → Γ ⊢ A : .sort u → A::Γ ⊢ B : .sort v →
+    A::Γ ⊢ e : B → Γ ⊢ e' : A →
+    Γ ⊢ B.inst e' : .sort v →
+    Γ ⊢ e.inst e' : B.inst e' →
+    Γ ⊢ .app (.lam A e) e' ≡ e.inst e' : B.inst e'
+  | eta :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A : .sort u →
+    A::Γ ⊢ B : .sort v →
+    A.lift::A::Γ ⊢ B.liftN 1 1 : .sort v →
+    Γ ⊢ e : .forallE A B →
+    A::Γ ⊢ e.lift : .forallE A.lift (B.liftN 1 1) →
+    A::Γ ⊢ A.lift : .sort u →
+    Γ ⊢ .lam A (.app e.lift (.bvar 0)) ≡ e : .forallE A B
+  | structEta :
+    env.structEtas rule →
+    (∀ level ∈ levels, level.WF uvars) →
+    levels.length = rule.uvars →
+    params.length = rule.nparams →
+    env.SpineWF uvars Γ (rule.familyType.instL levels)
+      params (.sort resultLevel) →
+    u.WF uvars →
+    Γ ⊢ rule.structureType levels params : .sort u →
+    Γ ⊢ major : rule.structureType levels params →
+    Γ ⊢ rule.rebuild levels params major :
+      rule.structureType levels params →
+    Γ ⊢ rule.rebuild levels params major ≡ major :
+      rule.structureType levels params
+  | proofIrrel :
+    Γ ⊢ p : .sort .zero → Γ ⊢ h : p → Γ ⊢ h' : p →
+    Γ ⊢ h ≡ h' : p
+  | extra :
+    env.defeqs df → (∀ l ∈ ls, l.WF uvars) → ls.length = df.uvars →
+    u.WF uvars →
+    [] ⊢ df.type.instL ls : .sort u →
+    [] ⊢ df.lhs.instL ls : df.type.instL ls →
+    [] ⊢ df.rhs.instL ls : df.type.instL ls →
+    Γ ⊢ df.lhs.instL ls : df.type.instL ls →
+    Γ ⊢ df.rhs.instL ls : df.type.instL ls →
+    Γ ⊢ df.lhs.instL ls ≡ df.rhs.instL ls : df.type.instL ls
+
+end
+
+section
+local notation:65 Γ " ⊢ " e " : " A:30 => HasTypeStrong Γ e A true
+local notation:65 Γ " ⊢ " e " :! " A:30 => HasTypeStrong Γ e A false
+local notation:65 Γ " ⊢ " e1 " ≡ " e2 " : " A:30 => IsDefEqStrong env uvars Γ e1 e2 A
+
+/--
+This is functionally a mutual inductive type,
+but using a bool index makes it easier to do induction in lean.
+The defeq rule is separated from the structural rules for easy inversion.
+-/
+inductive HasTypeStrong : List VExpr → VExpr → VExpr → Bool → Prop where
+  | bvar : Lookup Γ i A → u.WF uvars → Γ ⊢ A : .sort u → Γ ⊢ .bvar i :! A
+  | sort' : l.WF uvars → l'.WF uvars → l ≈ l' → Γ ⊢ .sort l :! .sort (.succ l')
+  | const :
+    env.constants c = some ci →
+    (∀ l ∈ ls, l.WF uvars) →
+    ls.length = ci.uvars →
+    u.WF uvars →
+    [] ⊢ ci.type.instL ls : .sort u →
+    Γ ⊢ ci.type.instL ls : .sort u →
+    Γ ⊢ .const c ls :! ci.type.instL ls
+  | app :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A : .sort u →
+    A::Γ ⊢ B : .sort v →
+    Γ ⊢ .forallE A B : .sort (.imax u v) →
+    Γ ⊢ f : .forallE A B →
+    Γ ⊢ a : A →
+    Γ ⊢ B.inst a : .sort v →
+    Γ ⊢ .app f a :! B.inst a
+  | lam :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A : .sort u →
+    A::Γ ⊢ B : .sort v →
+    A::Γ ⊢ body : B →
+    Γ ⊢ .forallE A B : .sort (.imax u v) →
+    Γ ⊢ .lam A body :! .forallE A B
+  | forallE :
+    u.WF uvars → v.WF uvars →
+    Γ ⊢ A : .sort u →
+    A::Γ ⊢ body : .sort v →
+    Γ ⊢ .forallE A body :! .sort (.imax u v)
+  | base : Γ ⊢ e :! A → Γ ⊢ e : A
+  | defeq : u.WF uvars → Γ ⊢ A ≡ B : .sort u →
+    Γ ⊢ A : .sort u → Γ ⊢ B : .sort u → Γ ⊢ e : A → Γ ⊢ e : B
+end
+
+end
+
+theorem IsDefEqStrong.hasType {env : VEnv}
+    (H : env.IsDefEqStrong U Γ e1 e2 A) :
+    env.IsDefEqStrong U Γ e1 e1 A ∧ env.IsDefEqStrong U Γ e2 e2 A :=
+  ⟨H.trans H.symm, H.symm.trans H⟩
+
+variable! (henv : Ordered env) in
+theorem IsDefEqStrong.weakN (W : Ctx.LiftN n k Γ Γ') (H : env.IsDefEqStrong U Γ e1 e2 A) :
+    env.IsDefEqStrong U Γ' (e1.liftN n k) (e2.liftN n k) (A.liftN n k) := by
+  induction H generalizing k Γ' with
+  | bvar h1 h2 _ ih3 => refine .bvar (h1.weakN W) h2 (ih3 W)
+  | symm _ ih => exact .symm (ih W)
+  | trans _ _ ih1 ih2 => exact .trans (ih1 W) (ih2 W)
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 h6 h7 _ _ ih2 =>
+    simp [(henv.closedC h1).instL.liftN_eq (Nat.zero_le _)] at ih2 ⊢
+    exact .constDF h1 h2 h3 h4 h5 h6 h7 (ih2 W)
+  | appDF h1 h2 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    refine liftN_inst_hi .. ▸ .appDF h1 h2 (ih1 W) (ih2 W.succ) (ih3 W) (ih4 W) ?_
+    exact liftN_inst_hi .. ▸ liftN_inst_hi .. ▸ ih5 W
+  | lamDF h1 h2 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact .lamDF h1 h2 (ih1 W) (ih2 W.succ) (ih3 W.succ) (ih4 W.succ) (ih5 W.succ)
+  | forallEDF h1 h2 _ _ _ ih1 ih2 ih3 => exact .forallEDF h1 h2 (ih1 W) (ih2 W.succ) (ih3 W.succ)
+  | defeqDF h1 _ _ ih1 ih2 => exact .defeqDF h1 (ih1 W) (ih2 W)
+  | beta h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    refine liftN_inst_hi .. ▸ liftN_instN_hi .. ▸ .beta h1 h2
+      (ih1 W) (ih2 W.succ) (ih3 W.succ) (ih4 W)
+      (liftN_instN_hi .. ▸ ih5 W :)
+      (liftN_instN_hi .. ▸ liftN_instN_hi .. ▸ ih6 W :)
+  | @eta Γ a u B v e h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    have := IsDefEqStrong.eta h1 h2 (ih1 W) (ih2 W.succ) ?_ (ih4 W) ?_ ?_
+    · simp [liftN]; rwa [← lift_liftN']
+    · specialize ih3 W.succ.succ
+      have := liftN'_comm B n 1 (k+1) 1 (Nat.le_add_left ..)
+      rw [Nat.add_comm 1] at this; rwa [← this, ← lift_liftN'] at ih3
+    · have ih5 : IsDefEqStrong _ _ _ _ _ (liftN n (lift (forallE ..)) _) := ih5 W.succ
+      rwa [← lift_liftN', ← lift_liftN'] at ih5
+    · have ih6 := ih6 W.succ
+      rwa [← lift_liftN'] at ih6
+  | @structEta rule levels _ params _ u major hreg hlevels
+      hlevelsLength hparamsLength hparamsSpine hu _ _ _ ihType ihMajor ihRebuild =>
+    have hparamsSpine' := hparamsSpine.weakN henv W
+    rw [(henv.structEtaWF hreg).familyType_closed.instL.liftN_eq
+      (Nat.zero_le _)] at hparamsSpine'
+    have htype := ihType W
+    rw [VStructEta.structureType_liftN] at htype
+    have hmajor := ihMajor W
+    rw [VStructEta.structureType_liftN] at hmajor
+    have hrebuild := ihRebuild W
+    rw [VStructEta.rebuild_liftN rule levels params major
+      hparamsLength n k, VStructEta.structureType_liftN] at hrebuild
+    have hout := IsDefEqStrong.structEta hreg hlevels hlevelsLength
+      (by simpa using hparamsLength) hparamsSpine' hu htype hmajor hrebuild
+    simpa only [VStructEta.rebuild_liftN rule levels params major
+      hparamsLength n k, VStructEta.structureType_liftN] using hout
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel (ih1 W) (ih2 W) (ih3 W)
+  | extra h1 h2 h3 h4 h5 h6 h7 _ _ _ _ _ ih4 ih5 =>
+    have ⟨⟨hA1, _⟩, hA2, hA3⟩ := henv.closed.2 h1
+    simp [
+      hA1.instL.liftN_eq (Nat.zero_le _),
+      hA2.instL.liftN_eq (Nat.zero_le _),
+      hA3.instL.liftN_eq (Nat.zero_le _)] at ih4 ih5 ⊢
+    exact IsDefEqStrong.extra h1 h2 h3 h4 h5 h6 h7 (ih4 W) (ih5 W)
+
+theorem IsDefEqStrong.defeq (H : IsDefEqStrong env U Γ e1 e2 A) : env.IsDefEq U Γ e1 e2 A := by
+  induction H with
+  | bvar h => exact .bvar h
+  | symm _ ih => exact .symm ih
+  | trans _ _ ih1 ih2 => exact .trans ih1 ih2
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 => exact .constDF h1 h2 h3 h4 h5
+  | appDF _ _ _ _ _ _ _ _ _ ih1 ih2 => exact .appDF ih1 ih2
+  | lamDF _ _ _ _ _ _ _ ih1 _ _ ih2 => exact .lamDF ih1 ih2
+  | forallEDF _ _ _ _ _ ih1 ih2 => exact .forallEDF ih1 ih2
+  | defeqDF _ _ _ ih1 ih2 => exact .defeqDF ih1 ih2
+  | beta _ _ _ _ _ _ _ _ _ _ ih1 ih2 => exact .beta ih1 ih2
+  | eta _ _ _ _ _ _ _ _ _ _ _ ih => exact .eta ih
+  | structEta hreg hlevels hlevelsLength hparamsLength hparamsSpine
+      _ _ _ _ _ ihMajor ihRebuild =>
+    exact .structEta hreg hlevels hlevelsLength hparamsLength
+      hparamsSpine ihMajor ihRebuild
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel ih1 ih2 ih3
+  | extra h1 h2 h3 => exact .extra h1 h2 h3
+
+variable! {env env' : VEnv} (henv : env ≤ env') in
+theorem IsDefEqStrong.mono
+    (H : env.IsDefEqStrong U Γ e1 e2 A) : env'.IsDefEqStrong U Γ e1 e2 A := by
+  induction H with
+  | bvar h1 h2 _ ih => exact .bvar h1 h2 ih
+  | symm _ ih => exact .symm ih
+  | trans _ _ ih1 ih2 => exact .trans ih1 ih2
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 h6 _ _ ih1 ih2 =>
+    exact .constDF (henv.1 h1) h2 h3 h4 h5 h6 ih1 ih2
+  | appDF h1 h2 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 => exact .appDF h1 h2 ih1 ih2 ih3 ih4 ih5
+  | lamDF h1 h2  _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 => exact .lamDF h1 h2 ih1 ih2 ih3 ih4 ih5
+  | forallEDF h1 h2 _ _ _ ih1 ih2 ih3 => exact .forallEDF h1 h2 ih1 ih2 ih3
+  | defeqDF h1 _ _ ih1 ih2 => exact .defeqDF h1 ih1 ih2
+  | beta h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 => exact .beta h1 h2 ih1 ih2 ih3 ih4 ih5 ih6
+  | eta h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 => exact .eta h1 h2 ih1 ih2 ih3 ih4 ih5 ih6
+  | structEta hreg hlevels hlevelsLength hparamsLength hparamsSpine
+      hu _ _ _ ihType ihMajor ihRebuild =>
+    exact .structEta (henv.structEtas hreg) hlevels hlevelsLength
+      hparamsLength (hparamsSpine.mono henv) hu ihType ihMajor ihRebuild
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel ih1 ih2 ih3
+  | extra h1 h2 h3 h4 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact .extra (henv.2 h1) h2 h3 h4 ih1 ih2 ih3 ih4 ih5
+
+variable! (henv : Ordered env) in
+theorem IsDefEqStrong.weak0 (H : env.IsDefEqStrong U [] e1 e2 A) :
+    env.IsDefEqStrong U Γ e1 e2 A := by
+  have ⟨h1, h2, h3⟩ := H.defeq.closedN' henv.closed ⟨⟩
+  simpa [h1.liftN_eq (Nat.zero_le _), h2.liftN_eq (Nat.zero_le _),
+    h3.liftN_eq (Nat.zero_le _)] using H.weakN henv (.zero Γ rfl)
+
+inductive EqUpToLevels (U : Nat) : VExpr → VExpr → Prop
+  | bvar : EqUpToLevels U (.bvar i) (.bvar i)
+  | const : (∀ l ∈ ls, l.WF U) → (∀ l ∈ ls', l.WF U) → List.Forall₂ (· ≈ ·) ls ls' →
+    EqUpToLevels U (.const c ls) (.const c ls')
+  | sort : l.WF U → l'.WF U → l ≈ l' → EqUpToLevels U (.sort l) (.sort l')
+  | app : EqUpToLevels U f f' → EqUpToLevels U a a' → EqUpToLevels U (.app f a) (.app f' a')
+  | lam : EqUpToLevels U A A' → EqUpToLevels U e e' → EqUpToLevels U (.lam A e) (.lam A' e')
+  | forallE : EqUpToLevels U A A' → EqUpToLevels U B B' → EqUpToLevels U (.forallE A B) (.forallE A' B')
+
+variable! {env : VEnv} {ls ls' : List VLevel}
+    (hls : ∀ l ∈ ls, l.WF U) (hls' : ∀ l ∈ ls', l.WF U) (heq : List.Forall₂ (· ≈ ·) ls ls') in
+theorem EqUpToLevels.instL (H : env.IsDefEqStrong U' Γ e1 e2 A) :
+    EqUpToLevels U (e1.instL ls) (e1.instL ls') ∧ EqUpToLevels U (e2.instL ls) (e2.instL ls') := by
+  induction H with
+  | bvar => exact ⟨.bvar, .bvar⟩
+  | symm _ ih => exact ih.symm
+  | trans _ _ ih1 ih2 | proofIrrel _ _  _ _ ih1 ih2
+  | extra _ _ _ _ _ _ _ _ _ _ ih1 ih2 => exact ⟨ih1.1, ih2.2⟩
+  | sortDF h1 h2 h3 =>
+    constructor <;> exact .sort (.inst hls) (.inst hls') (VLevel.inst_congr rfl heq)
+  | constDF h1 h2 h3 h4 h5 =>
+    constructor <;> exact .const
+      (List.forall_mem_map.2 fun _ _ => .inst hls)
+      (List.forall_mem_map.2 fun _ _ => .inst hls')
+      (List.forall₂_map_left_iff.2 <| List.forall₂_map_right_iff.2 <|
+        .rfl fun _ _ => VLevel.inst_congr rfl heq)
+  | appDF _ _ _ _ _ _ _ _ _ ih1 ih2 => exact ⟨.app ih1.1 ih2.1, .app ih1.2 ih2.2⟩
+  | lamDF _ _ _ _ _ _ _ ih1 _ _ ih2 => exact ⟨.lam ih1.1 ih2.1, .lam ih1.2 ih2.2⟩
+  | forallEDF _ _ _ _ _ ih1 ih2 => exact ⟨.forallE ih1.1 ih2.1, .forallE ih1.2 ih2.2⟩
+  | defeqDF _ _ _ _ ih => exact ih
+  | beta _ _ _ _ _ _ _ _ ih1 _ ih3 ih4 _ ih6 => exact ⟨.app (.lam ih1.1 ih3.1) ih4.1, ih6.2⟩
+  | eta _ _ _ _ _ _ _ _ ih1 _ _ ih4 ih5 => exact ⟨.lam ih1.1 (.app ih5.1 .bvar), ih4.1⟩
+  | structEta _ _ _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    exact ⟨ihRebuild.1, ihMajor.2⟩
+
+
+variable! {env : VEnv} (W : OnCtx Γ fun _ A => A.LevelWF U) in
+theorem EqUpToLevels.refl (H : env.IsDefEqStrong U Γ e1 e2 A) :
+    EqUpToLevels U e1 e1 ∧ EqUpToLevels U e2 e2 := by
+  have := IsDefEq.levelWF H.defeq W
+  exact LevelWF.instL_id this.1 ▸ LevelWF.instL_id this.2.1 ▸
+    EqUpToLevels.instL VLevel.params_wf VLevel.params_wf (.rfl fun _ _ => rfl) H
+
+theorem EqUpToLevels.weakN (H : EqUpToLevels U e e') :
+    EqUpToLevels U (e.liftN n k) (e'.liftN n k) := by
+  induction H generalizing k with
+  | bvar => exact .bvar
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | sort h1 h2 h3 => exact .sort h1 h2 h3
+  | app _ _ ih1 ih2 => exact .app ih1 ih2
+  | lam _ _ ih1 ih2 => exact .lam ih1 ih2
+  | forallE _ _ ih1 ih2 => exact .forallE ih1 ih2
+
+variable! (h₀ : EqUpToLevels U e₀ e₀') in
+theorem EqUpToLevels.instN (H : EqUpToLevels U e e') :
+    EqUpToLevels U (e.inst e₀ k) (e'.inst e₀' k) := by
+  induction H generalizing k with
+  | bvar => simp [inst, instVar]; split <;> [exact .bvar; split] <;> [exact h₀.weakN; exact .bvar]
+  | const h1 h2 h3 => exact .const h1 h2 h3
+    | sort h1 h2 h3 => exact .sort h1 h2 h3
+  | app _ _ ih1 ih2 => exact .app ih1 ih2
+  | lam _ _ ih1 ih2 => exact .lam ih1 ih2
+  | forallE _ _ ih1 ih2 => exact .forallE ih1 ih2
+
+def EnvStrong (env : VEnv) (U : Nat) (e A : VExpr) : Prop :=
+  env.IsDefEqStrong U [] e e A ∧
+  (∃ u, env.IsDefEqStrong U [] A A (.sort u)) ∧
+  (∀ U' ls ls', (∀ l ∈ ls, l.WF U') → (∀ l ∈ ls', l.WF U') → List.Forall₂ (· ≈ ·) ls ls' →
+    env.IsDefEqStrong U' [] (e.instL ls) (e.instL ls') (A.instL ls)) ∧
+  ∀ A B, e = A.forallE B →
+    (∃ u, env.IsDefEqStrong U [] A A (.sort u)) ∧
+    (∃ u, env.IsDefEqStrong U [A] B B (.sort u))
+
+variable! {env : VEnv} {ls : List VLevel} (hls : ∀ l ∈ ls, l.WF U') in
+theorem IsDefEqStrong.instL (H : env.IsDefEqStrong U Γ e1 e2 A) :
+    env.IsDefEqStrong U' (Γ.map (VExpr.instL ls)) (e1.instL ls) (e2.instL ls) (A.instL ls) := by
+  induction H with
+  | bvar h _ _ ih =>
+    exact .bvar h.instL (.inst hls) ih
+  | constDF h1 h2 h3 h4 h5 _ _ _ ih1 ih2 =>
+    simp [VExpr.instL, VExpr.instL_instL] at ih1 ih2 ⊢
+    exact .constDF h1
+      (by simp [VLevel.WF.inst hls]) (by simp [VLevel.WF.inst hls]) (by simp [h4])
+      (by simpa using h5.imp fun _ _ => VLevel.inst_congr_l) (.inst hls) ih1 ih2
+  | symm _ ih => exact .symm ih
+  | trans _ _ ih1 ih2 => exact .trans ih1 ih2
+  | sortDF _ _ h3 =>
+    exact .sortDF (VLevel.WF.inst hls) (VLevel.WF.inst hls) (VLevel.inst_congr_l h3)
+  | appDF _ _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact instL_instN ▸ .appDF (.inst hls) (.inst hls)
+      ih1 ih2 ih3 ih4 (instL_instN ▸ instL_instN ▸ ih5)
+  | lamDF _ _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact .lamDF (.inst hls) (.inst hls) ih1 ih2 ih3 ih4 ih5
+  | forallEDF _ _ _ _ _ ih1 ih2 ih3 =>
+    exact .forallEDF (.inst hls) (.inst hls) ih1 ih2 ih3
+  | defeqDF _ _ _ ih1 ih2 =>
+    exact .defeqDF (.inst hls) ih1 ih2
+  | beta _ _ _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    simpa using .beta (.inst hls) (.inst hls) ih1 ih2 ih3 ih4
+      (by simpa [VExpr.instL] using ih5) (by simpa [VExpr.instL] using ih6)
+  | eta _ _ _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    simpa [VExpr.instL] using .eta (.inst hls) (.inst hls) ih1 ih2
+      (by simpa [VExpr.instL] using ih3) ih4
+      (by simpa [VExpr.instL] using ih5) (by simpa [VExpr.instL] using ih6)
+  | @structEta rule levels _ params _ u major hreg hlevels
+      hlevelsLength hparamsLength hparamsSpine _ _ _ _ ihType ihMajor ihRebuild =>
+    have hlevels' : ∀ level ∈ levels.map (VLevel.inst ls),
+        level.WF U' := by
+      intro level hlevel
+      obtain ⟨source, _, heq⟩ := List.mem_map.1 hlevel
+      rw [← heq]
+      exact VLevel.WF.inst hls
+    rw [VStructEta.structureType_instL] at ihType ihMajor
+    rw [VStructEta.rebuild_instL,
+      VStructEta.structureType_instL] at ihRebuild
+    have hparamsSpine' := hparamsSpine.instL hls
+    rw [VExpr.instL_instL] at hparamsSpine'
+    have hout := IsDefEqStrong.structEta hreg hlevels'
+      (by simpa using hlevelsLength) (by simpa using hparamsLength)
+      hparamsSpine' (VLevel.WF.inst hls) ihType ihMajor ihRebuild
+    simpa only [VStructEta.rebuild_instL,
+      VStructEta.structureType_instL] using hout
+  | proofIrrel _ _ _ ih1 ih2 ih3 =>
+    exact .proofIrrel ih1 ih2 ih3
+  | extra h1 h2 h3 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    simp [VExpr.instL, VExpr.instL_instL] at ih1 ih2 ih3 ih4 ih5 ⊢
+    exact .extra h1 (by simp [VLevel.WF.inst hls]) (by simp [h3])
+      (.inst hls) ih1 ih2 ih3 ih4 ih5
+
+def CtxStrong (env : VEnv) (U Γ) :=
+  OnCtx Γ fun Γ A => ∃ u, env.IsDefEqStrong U Γ A A (.sort u)
+
+variable! (henv : Ordered env) in
+nonrec theorem CtxStrong.lookup {Γ} (H : CtxStrong env U Γ) (h : Lookup Γ i A) :
+    ∃ u, env.IsDefEqStrong U Γ A A (.sort u) :=
+  H.lookup h fun ⟨_, h⟩ => ⟨_, h.weakN henv .one⟩
+
+theorem CtxStrong.defeq {Γ} (H : CtxStrong env U Γ) : OnCtx Γ (env.IsType U) :=
+  H.mono fun ⟨_, h⟩ => ⟨_, h.defeq⟩
+
+theorem CtxStrong.levelWF : ∀ {Γ}, CtxStrong env U Γ → OnCtx Γ fun _ A => A.LevelWF U
+  | [], h => h
+  | _::_, ⟨h1, _, h2⟩ => ⟨levelWF h1, (h2.defeq.levelWF (levelWF h1)).1⟩
+
+variable! (henv : Ordered env) (h₀ : env.IsDefEqStrong U Γ₀ e₀ e₀ A₀) (hΓ₀ : CtxStrong env U Γ₀) in
+theorem IsDefEqStrong.instN (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ) (H : env.IsDefEqStrong U Γ₁ e1 e2 A)
+    (hΓ : CtxStrong env U Γ) :
+    env.IsDefEqStrong U Γ (e1.inst e₀ k) (e2.inst e₀ k) (A.inst e₀ k) := by
+  induction H generalizing Γ k with
+  | @bvar _ i ty _ h _ h2 ih =>
+    dsimp [inst]; clear h2 ih
+    induction W generalizing i ty with
+    | zero =>
+      cases h with simp [inst_lift]
+      | zero => exact h₀
+      | succ h =>
+        let ⟨u, hty⟩ := hΓ₀.lookup henv h
+        exact .bvar h (hty.defeq.sort_r henv hΓ₀.defeq) hty
+    | succ _ ih =>
+      cases h with (simp; rw [Nat.add_comm, ← liftN_instN_lo (hj := Nat.zero_le _)])
+      | zero =>
+        let ⟨u, hty⟩ := hΓ.lookup henv .zero
+        exact .bvar .zero (hty.defeq.sort_r henv hΓ.defeq) hty
+      | succ h => exact (ih h hΓ.1).weakN henv .one
+  | symm _ ih => exact .symm (ih W hΓ)
+  | trans _ _ ih1 ih2 => exact .trans (ih1 W hΓ) (ih2 W hΓ)
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 h6 h7 _ _ ih2 =>
+    simp [(henv.closedC h1).instL.instN_eq (Nat.zero_le _)] at ih2 ⊢
+    exact .constDF h1 h2 h3 h4 h5 h6 h7 (ih2 W hΓ)
+  | appDF h1 h2 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact inst0_inst_hi .. ▸ .appDF h1 h2
+      (ih1 W hΓ) (ih2 W.succ ⟨hΓ, _, ih1 W hΓ⟩)
+      (ih3 W hΓ) (ih4 W hΓ) (inst0_inst_hi .. ▸ inst0_inst_hi .. ▸ ih5 W hΓ)
+  | lamDF h1 h2 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact
+      have hΓ' := ⟨hΓ, _, (ih1 W hΓ).hasType.1⟩
+      have hΓ'' := ⟨hΓ, _, (ih1 W hΓ).hasType.2⟩
+      .lamDF h1 h2 (ih1 W hΓ) (ih2 W.succ hΓ') (ih3 W.succ hΓ'') (ih4 W.succ hΓ') (ih5 W.succ hΓ'')
+  | forallEDF h1 h2 _ _ _ ih1 ih2 ih3 =>
+    exact .forallEDF h1 h2 (ih1 W hΓ)
+      (ih2 W.succ ⟨hΓ, _, (ih1 W hΓ).hasType.1⟩) (ih3 W.succ ⟨hΓ, _, (ih1 W hΓ).hasType.2⟩)
+  | defeqDF h1 _ _ ih1 ih2 => exact .defeqDF h1 (ih1 W hΓ) (ih2 W hΓ)
+  | beta h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    rw [inst0_inst_hi, inst0_inst_hi]; exact
+      have hΓ' := ⟨hΓ, _, ih1 W hΓ⟩
+      .beta h1 h2
+        (ih1 W hΓ) (ih2 W.succ hΓ') (ih3 W.succ hΓ') (ih4 W hΓ)
+        (inst0_inst_hi .. ▸ ih5 W hΓ) (inst0_inst_hi .. ▸ inst0_inst_hi .. ▸ ih6 W hΓ)
+  | eta h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    have :=
+      have hΓ' := ⟨hΓ, _, (ih1 W hΓ).hasType.1⟩
+      IsDefEqStrong.eta h1 h2 (ih1 W hΓ) (ih2 W.succ hΓ')
+        (by
+          have := ih3 W.succ.succ ⟨hΓ', _, by
+            rw [← lift_instN_lo]; exact (ih1 W hΓ).hasType.1.weakN henv .one⟩
+          rwa [lift_instN_lo, liftN_instN_lo (hj := Nat.le_add_left ..), Nat.add_comm 1])
+        (ih4 W hΓ)
+        (by
+          have := ih5 W.succ hΓ'
+          simp only [inst, ← lift_instN_lo] at this
+          rwa [liftN_instN_lo (hj := Nat.le_add_left ..), Nat.add_comm 1])
+        (by simpa [inst, ← lift_instN_lo] using ih6 W.succ hΓ')
+    rw [lift, liftN_instN_lo (hj := Nat.zero_le _), Nat.add_comm] at this
+    simpa [inst]
+  | @structEta rule levels _ params _ u major hreg hlevels
+      hlevelsLength hparamsLength hparamsSpine hu _ _ _ ihType ihMajor ihRebuild =>
+    have hparamsSpine' := SpineWF.instN henv W h₀.defeq hparamsSpine
+    rw [(henv.structEtaWF hreg).familyType_closed.instL.instN_eq
+      (Nat.zero_le _)] at hparamsSpine'
+    have htype := ihType W hΓ
+    rw [VStructEta.structureType_instN] at htype
+    have hmajor := ihMajor W hΓ
+    rw [VStructEta.structureType_instN] at hmajor
+    have hrebuild := ihRebuild W hΓ
+    rw [VStructEta.rebuild_instN rule levels params major e₀
+      hparamsLength k, VStructEta.structureType_instN] at hrebuild
+    have hout := IsDefEqStrong.structEta hreg hlevels hlevelsLength
+      (by simpa using hparamsLength) hparamsSpine' hu htype hmajor hrebuild
+    simpa only [VStructEta.rebuild_instN rule levels params major e₀
+      hparamsLength k, VStructEta.structureType_instN] using hout
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel (ih1 W hΓ) (ih2 W hΓ) (ih3 W hΓ)
+  | extra h1 h2 h3 h4 h5 h6 h7 _ _ _ _ _ ih4 ih5 =>
+    have ⟨⟨hA1, _⟩, hA2, hA3⟩ := henv.closed.2 h1
+    simp [
+      hA1.instL.instN_eq (Nat.zero_le _),
+      hA2.instL.instN_eq (Nat.zero_le _),
+      hA3.instL.instN_eq (Nat.zero_le _)] at ih4 ih5 ⊢
+    exact .extra h1 h2 h3 h4 h5 h6 h7 (ih4 W hΓ) (ih5 W hΓ)
+
+theorem IsDefEqStrong.defeqDF_l (henv : Ordered env) (hΓ : CtxStrong env U Γ)
+    (h1 : env.IsDefEqStrong U Γ A A' (.sort u))
+    (h2 : env.IsDefEqStrong U (A::Γ) e1 e2 B) : env.IsDefEqStrong U (A'::Γ) e1 e2 B := by
+  simpa [instN_bvar0] using
+    have hu := h1.defeq.sort_r henv hΓ.defeq
+    have hΓ' := ⟨hΓ, _, h1.hasType.2⟩
+    h1.weakN henv (.one (A := A'))
+      |>.symm.defeqDF hu (.bvar .zero hu (h1.hasType.2.weakN henv .one))
+      |>.instN henv hΓ' .zero (h2.weakN henv (.succ (.one (A := A')))) hΓ'
+
+variable! (henv : Ordered env) (envIH : env.OnTypes (EnvStrong env)) in
+theorem IsDefEqStrong.forallE_inv' (hΓ : CtxStrong env U Γ)
+    (H : env.IsDefEqStrong U Γ e1 e2 V) (eq : e1 = A.forallE B ∨ e2 = A.forallE B) :
+    (∃ u, env.IsDefEqStrong U Γ A A (.sort u)) ∧ ∃ v, env.IsDefEqStrong U (A::Γ) B B (.sort v) := by
+  induction H generalizing A B with
+  | symm _ ih => exact ih hΓ eq.symm
+  | trans _ _ ih1 ih2
+  | proofIrrel _ _ _ _ ih1 ih2 =>
+    obtain eq | eq := eq
+    · exact ih1 hΓ (.inl eq)
+    · exact ih2 hΓ (.inr eq)
+  | forallEDF _ _ h1 h2 =>
+    obtain ⟨⟨⟩⟩ | ⟨⟨⟩⟩ := eq
+    · exact ⟨⟨_, h1.hasType.1⟩, _, h2.hasType.1⟩
+    · exact ⟨⟨_, h1.hasType.2⟩, _, h1.defeqDF_l henv hΓ h2.hasType.2⟩
+  | defeqDF _ _ _ _ ih2 => exact ih2 hΓ eq
+  | @beta _ _ _ _ _ e _ _ _ h1 _ _ h4 _ _ _ _ ih3 ih4 =>
+    obtain ⟨⟨⟩⟩ | eq := eq
+    cases e with
+    | bvar i =>
+      cases i with simp [inst] at eq
+      | zero => exact ih4 hΓ (.inl eq)
+    | forallE A B =>
+      cases eq
+      let ⟨⟨_, A1⟩, _, A2⟩ := ih3 ⟨hΓ, _, h1⟩ (.inl rfl)
+      refine ⟨⟨_, h4.instN henv hΓ .zero A1 hΓ⟩, _, h4.instN henv hΓ (.succ .zero) A2 ?_⟩
+      exact ⟨hΓ, _, h4.instN henv hΓ .zero A1 hΓ⟩
+    | _ => cases eq
+  | eta _ _ _ _ _ _ _ _ _ _ _ ih =>
+    obtain ⟨⟨⟩⟩ | eq := eq
+    exact ih hΓ (.inl eq)
+  | structEta _ _ _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    obtain eq | eq := eq
+    · exact ihRebuild hΓ (.inl eq)
+    · exact ihMajor hΓ (.inl eq)
+  | @extra df ls _ Γ h1 h2 =>
+    suffices ∀ e, VExpr.instL ls e = VExpr.forallE A B →
+        EnvStrong env df.uvars e df.type →
+        (∃ u, IsDefEqStrong env U Γ A A (.sort u)) ∧
+        (∃ u, IsDefEqStrong env U (A :: Γ) B B (.sort u)) by
+      have ⟨A1, A2⟩ := envIH.2 h1
+      cases eq <;> exact this _ ‹_› ‹_›
+    intro e eq IH
+    cases e <;> cases eq; rename_i A B
+    let ⟨⟨_, A1⟩, v, A2⟩ := IH.2.2.2 _ _ rfl
+    refine ⟨⟨_, (A1.instL h2).weak0 henv⟩, v.inst ls, ?_⟩
+    have := (A2.instL h2).weakN henv (.succ (.zero Γ))
+    have C1 := (A1.instL h2).defeq.closedN henv ⟨⟩
+    have C2 := (A2.instL h2).defeq.closedN henv ⟨⟨⟩, C1⟩
+    rw [C1.liftN_eq (Nat.zero_le _), C2.liftN_eq (by exact Nat.le_refl _)] at this
+    simpa [liftN]
+  | _ => nomatch eq
+
+variable! (henv : Ordered env) (envIH : env.OnTypes (EnvStrong env)) in
+theorem IsDefEqStrong.isType' (hΓ : CtxStrong env U Γ) (H : env.IsDefEqStrong U Γ e1 e2 A) :
+    ∃ u, env.IsDefEqStrong U Γ A A (.sort u) := by
+  induction H with
+  | bvar h => exact hΓ.lookup henv h
+  | symm _ ih => exact ih hΓ
+  | trans _ _ ih1 => exact ih1 hΓ
+  | sortDF h1 => exact ⟨_, .sortDF h1 h1 rfl⟩
+  | constDF h1 h2 =>
+    let ⟨_, h⟩ := envIH.1 h1
+    exact ⟨_, (h.1.instL h2).weak0 henv⟩
+  | appDF _ _ _ _ _ h4 _ _ _ ih3 =>
+    let ⟨_, ih3⟩ := ih3 hΓ
+    have ⟨_, _, ih3⟩ := ih3.forallE_inv' henv envIH hΓ (.inl rfl)
+    exact ⟨_, h4.hasType.1.instN henv hΓ .zero ih3 hΓ⟩
+  | lamDF h1 h2 h3 h4 => exact ⟨_, .forallEDF h1 h2 h3.hasType.1 h4 h4⟩
+  | forallEDF h1 h2 => exact ⟨_, .sortDF ⟨h1, h2⟩ ⟨h1, h2⟩ rfl⟩
+  | defeqDF _ h2 => exact ⟨_, h2.hasType.2⟩
+  | beta _ _ _ h4 _ h6 => exact ⟨_, h6.hasType.1.instN henv hΓ .zero h4 hΓ⟩
+  | eta _ _ _ _ _ _ _ _ _ _ _ ih => exact ih hΓ
+  | @structEta _ _ _ _ _ u _ _ _ _ _ _ _ htype _ _ _ _ _ =>
+    exact ⟨u, htype⟩
+  | proofIrrel h1 => exact ⟨_, h1⟩
+  | extra h1 h2 =>
+    have ⟨_, h⟩ := (envIH.2 h1).2.2.1
+    exact ⟨_, (h.instL h2).weak0 henv⟩
+
+theorem IsDefEqStrong.instDF
+    (henv : Ordered env) (hΓ : CtxStrong env U Γ) (hu : u.WF U) (hv : v.WF U)
+    (hA : env.IsDefEqStrong U Γ A A (.sort u))
+    (hB : env.IsDefEqStrong U (A::Γ) B B (.sort v))
+    (hf : env.IsDefEqStrong U (A::Γ) f f' B)
+    (ha : env.IsDefEqStrong U Γ a a' A) :
+    env.IsDefEqStrong U Γ (f.inst a) (f'.inst a') (B.inst a) :=
+  have H2 {f f' B v}
+      (hv : v.WF U)
+      (hB : env.IsDefEqStrong U (A::Γ) B B (.sort v))
+      (hf : env.IsDefEqStrong U (A::Γ) f f' B)
+      (hi : IsDefEqStrong env U Γ (inst B a) (inst B a') (sort v)) :
+      env.IsDefEqStrong U Γ (f.inst a) (f'.inst a') (B.inst a) :=
+    have H1 {a f}
+        (hf : env.IsDefEqStrong U (A::Γ) f f' B)
+        (ha : IsDefEqStrong env U Γ a a A) :
+        env.IsDefEqStrong U Γ (.app (.lam A f) a) (f.inst a) (B.inst a) :=
+      IsDefEqStrong.beta hu hv hA hB hf.hasType.1 ha
+        (ha.hasType.1.instN henv hΓ .zero hB hΓ)
+        (ha.hasType.1.instN henv hΓ .zero hf.hasType.1 hΓ)
+    (H1 hf ha.hasType.1).symm.trans <|
+      .trans (.appDF hu hv hA hB (.lamDF hu hv hA hB hB hf hf) ha hi) <|
+      .defeqDF hv (.symm hi) (H1 hf.hasType.2 ha.hasType.2)
+  H2 hv hB hf <| H2 (v := v.succ) hv (.sortDF hv hv rfl) hB (.sortDF hv hv rfl)
+
+variable! (henv : Ordered env) (envIH : env.OnTypes (EnvStrong env))
+  (W : CtxStrong env U Γ) in
+theorem EqUpToLevels.defeq (H : env.IsDefEqStrong U Γ e1 e2 A)
+    (H1 : EqUpToLevels U e1 e1') (H2 : EqUpToLevels U e2 e2') :
+    env.IsDefEqStrong U Γ e1' e2' A := by
+  induction H generalizing e1' e2' with
+  | bvar h1 h2 h3 => let .bvar := H1; let .bvar := H2; exact .bvar h1 h2 h3
+  | constDF h1 h2 h3 h4 h5 h6 _ _ ih1 ih2 =>
+    let .const a1 a2 a3 := H1
+    let .const b1 b2 b3 := H2
+    let ⟨_, c1⟩ := envIH.1 h1
+    have c2 := a3.flip.trans (T := (· ≈ ·)) (fun _ _ _  => (·.symm.trans)) <|
+      h5.trans (T := (· ≈ ·)) (fun _ _ _ => Eq.trans) b3
+    have := c1.2.2.1 _ _ _ a2 b2 c2
+    exact .defeqDF (.inst a1) (.symm ((c1.2.2.1 _ _ _ a1 a2 a3).weak0 henv)) <|
+      .constDF h1 a2 b2 (a3.length_eq.symm.trans h4) c2 (.inst a2) this (this.weak0 henv)
+  | symm _ ih => exact (ih W H2 H1).symm
+  | trans h1 _ ih1 ih2 =>
+    have H3 := (EqUpToLevels.refl W.levelWF h1).2; exact (ih1 W H1 H3).trans (ih2 W H3 H2)
+  | sortDF h1 h2 h3 =>
+    let .sort a1 a2 a3 := H1
+    let .sort b1 b2 b3 := H2
+    exact .defeqDF (by exact a1)
+      (.symm <| .sortDF (by exact a1) (by exact a2) (VLevel.succ_congr a3))
+      (.sortDF a2 b2 (a3.symm.trans <| h3.trans b3))
+  | appDF h1 h2 h3 h4 h5 h6 _ ih1 ih2 ih3 ih4 ih5 =>
+    let .app a1 a2 := H1
+    let .app b1 b2 := H2
+    have := ih4 W a2 (EqUpToLevels.refl W.levelWF h6).2 |>.trans h6.symm
+    exact .defeqDF h2 (.instDF henv W h1 (by exact h2) h3 (.sortDF h2 h2 rfl) h4 this) <|
+      .appDF h1 h2 h3 h4 (ih3 W a1 b1) (ih4 W a2 b2) <|
+      .instDF henv W h1 (by exact h2) h3 (.sortDF h2 h2 rfl) h4 (ih4 W a2 b2)
+  | lamDF h1 h2 h3 h4 h5 h6 h7 ih1 ih2 ih3 ih4 =>
+    let .lam a1 a2 := H1
+    let .lam b1 b2 := H2
+    have c1 := ih1 W a1 (EqUpToLevels.refl W.levelWF h3).2 |>.trans h3.symm
+    have c2 := ih1 W (EqUpToLevels.refl W.levelWF h3).1 b1
+    have h4' := c1.symm.defeqDF_l henv W h4
+    exact have ih := ih4 ⟨W, _, h3.hasType.1⟩ a2 b2
+      .defeqDF (by exact ⟨h1, h2⟩) (.forallEDF h1 h2 c1 h4' h4) <|
+      .lamDF h1 h2 (ih1 W a1 b1) h4' (.defeqDF_l henv W c2 h4)
+        (.defeqDF_l henv W c1.symm ih) (.defeqDF_l henv W c2 ih)
+  | forallEDF h1 h2 h3 _ _ ih1 ih2 =>
+    let .forallE a1 a2 := H1
+    let .forallE b1 b2 := H2
+    have c1 := ih1 W a1 (EqUpToLevels.refl W.levelWF h3).2 |>.trans h3.symm
+    have c2 := ih1 W (EqUpToLevels.refl W.levelWF h3).1 b1
+    exact .forallEDF h1 h2 (ih1 W a1 b1)
+      (.defeqDF_l henv W c1.symm <| ih2 ⟨W, _, h3.hasType.1⟩ a2 b2)
+      (.defeqDF_l henv W c2 <| ih2 ⟨W, _, h3.hasType.1⟩ a2 b2)
+  | defeqDF h1 h2 _ _ ih => exact .defeqDF h1 h2 (ih W H1 H2)
+  | beta h1 h2 h3 h4 h5 h6 h7 _ ih1 _ ih3 ih4 ih5 ih6 =>
+    let .app a1 a3 := H1; let .lam a1 a2 := a1
+    have c1 := ih1 W a1 (EqUpToLevels.refl W.levelWF h3).2 |>.trans h3.symm
+    have c2 := ih4 W a3 (EqUpToLevels.refl W.levelWF h6).2 |>.trans h6.symm
+    have c3 := ih3 ⟨W, _, h3⟩ a2 a2
+    have hb := (EqUpToLevels.refl (CtxStrong.levelWF (by exact ⟨W, _, h3⟩)) h4).2
+    have c4 := ih5 W (.instN a3 hb) (EqUpToLevels.refl W.levelWF h7).2
+    refine .trans ?_ (ih6 W (.instN a3 a2) H2)
+    refine .defeqDF h2 (.instDF henv W h1 (by exact h2) h3 (.sortDF h2 h2 rfl) h4 c2) ?_
+    exact .beta h1 h2 c1.hasType.1 (.defeqDF_l henv W c1.symm h4)
+      (.defeqDF_l henv W c1.symm c3) (.defeqDF h1 c1.symm c2.hasType.1)
+      c4.hasType.1 (.instN henv c2.hasType.1 W .zero c3 W)
+  | eta h1 h2 h3 h4 h5 h6 h7 h8 ih1 ih2 ih3 ih4 ih5 =>
+    let .lam a1 a3 := H1; let .app a2 a3 := a3; let .bvar := a3
+    have c1 := ih1 W a1 (EqUpToLevels.refl W.levelWF h3).2 |>.trans h3.symm
+    have c2 := have W' := ⟨W, _, h3⟩; ih5 W' a2 (EqUpToLevels.refl W'.levelWF h7).2
+    have c3 := IsDefEqStrong.appDF h1 h2 h8 h5 c2 (.bvar .zero h1 h8)
+    rw [instN_bvar0] at c3; specialize c3 h4
+    refine .trans
+      (.symm <| .lamDF h1 h2 c1.symm h4 (.defeqDF_l henv W c1.symm h4) c3.symm
+        (.defeqDF_l henv W c1.symm c3.symm)) ?_
+    exact .trans (.eta h1 h2 h3 h4 h5 h6 h7 h8) (ih4 W (EqUpToLevels.refl W.levelWF h6).1 H2)
+  | structEta hreg hlevels hlevelsLength hparamsLength hparamsSpine hu htype hmajor
+      hrebuild _ ihMajor ihRebuild =>
+    have hrebuildRefl := (EqUpToLevels.refl W.levelWF hrebuild).2
+    have hmajorRefl := (EqUpToLevels.refl W.levelWF hmajor).1
+    exact (ihRebuild W H1 hrebuildRefl).trans <|
+      (IsDefEqStrong.structEta hreg hlevels hlevelsLength hparamsLength
+        hparamsSpine hu htype hmajor hrebuild).trans
+      (ihMajor W hmajorRefl H2)
+  | proofIrrel h1 _ _ _ ih1 ih2 => exact .proofIrrel h1 (ih1 W H1 H1) (ih2 W H2 H2)
+  | extra h1 h2 h3 h4 h5 h6 h7 h8 h9 _ ih1 ih2 =>
+    have c1 := ih1 trivial H1 (EqUpToLevels.refl (by trivial) h6).2
+    have c2 := ih2 trivial H2 (EqUpToLevels.refl (by trivial) h7).2
+    refine .weak0 henv <| c1.trans <| .trans ?_ c2.symm
+    exact .extra h1 h2 h3 h4 h5 h6 h7 h6 h7
+
+variable! (henv : Ordered env) (envIH : env.OnTypes (EnvStrong env)) in
+theorem IsDefEq.strong' (hΓ : CtxStrong env U Γ)
+    (H : env.IsDefEq U Γ e1 e2 A) : env.IsDefEqStrong U Γ e1 e2 A := by
+  have hctx {Γ} (H : OnCtx Γ fun Γ A => ∃ u, env.IsDefEqStrong U Γ A A (.sort u)) :
+     OnCtx Γ (env.IsType U) := H.mono fun ⟨_, h⟩ => ⟨_, h.defeq⟩
+  induction H using IsDefEq.rec
+      (motive_2 := fun _ _ _ _ _ => True) with
+  | bvar h =>
+    let ⟨u, hA⟩ := hΓ.lookup henv h
+    exact .bvar h (hA.defeq.sort_r henv (hctx hΓ)) hA
+  | symm _ ih => exact (ih hΓ).symm
+  | trans _ _ ih1 ih2 => exact (ih1 hΓ).trans (ih2 hΓ)
+  | sortDF h1 h2 h3 => exact .sortDF h1 h2 h3
+  | @constDF _ _ ls₁ ls₂ _ h1 h2 h3 h4 h5 =>
+    let ⟨u, h6⟩ := envIH.1 h1
+    have := h6.2.2.1 _ _ _ h2 h3 h5
+    exact .constDF h1 h2 h3 h4 h5 (.inst h2) this (this.weak0 henv)
+  | appDF _ _ ih1 ih2 =>
+    let ⟨_, h3⟩ := (ih1 hΓ).isType' henv envIH hΓ
+    let ⟨⟨u, hA⟩, ⟨v, hB⟩⟩ := h3.forallE_inv' henv envIH hΓ (.inl rfl)
+    have hu := hA.defeq.sort_r henv hΓ.defeq
+    have hΓ' : CtxStrong env U (_::_) := ⟨hΓ, _, hA⟩
+    have hv := hB.defeq.sort_r henv hΓ'.defeq
+    exact .appDF hu hv hA hB (ih1 hΓ) (ih2 hΓ) <|
+      .instDF (v := v.succ) henv hΓ hu hv hA (.sortDF hv hv rfl) hB (ih2 hΓ)
+  | lamDF hA _ ih1 ih2 =>
+    have hu := hA.sort_r henv hΓ.defeq
+    have hΓ' : CtxStrong env U (_::_) := ⟨hΓ, _, (ih1 hΓ).hasType.1⟩
+    let ⟨_, hB⟩ := (ih2 hΓ').isType' henv envIH hΓ'
+    exact .lamDF hu (hB.defeq.sort_r henv hΓ'.defeq) (ih1 hΓ)
+      hB ((ih1 hΓ).defeqDF_l henv hΓ hB) (ih2 hΓ') ((ih1 hΓ).defeqDF_l henv hΓ (ih2 hΓ'))
+  | forallEDF hA hb ih1 ih2 =>
+    have hu := hA.sort_r henv hΓ.defeq
+    have hΓ' : CtxStrong env U (_::_) := ⟨hΓ, _, (ih1 hΓ).hasType.1⟩
+    exact .forallEDF hu (hb.sort_r henv hΓ'.defeq)
+      (ih1 hΓ) (ih2 hΓ') ((ih1 hΓ).defeqDF_l henv hΓ (ih2 hΓ'))
+  | defeqDF hAB _ ih1 ih2 =>
+    exact .defeqDF (hAB.sort_r henv hΓ.defeq) (ih1 hΓ) (ih2 hΓ)
+  | beta _ _ ih1 ih2 =>
+    have he' := ih2 hΓ
+    have ⟨_, hA⟩ := he'.isType' henv envIH hΓ
+    have hΓ' : CtxStrong env U (_::_) := ⟨hΓ, _, hA⟩
+    have he := ih1 hΓ'
+    have ⟨_, hB⟩ := he.isType' henv envIH hΓ'
+    exact .beta (hA.defeq.sort_r henv hΓ.defeq) (hB.defeq.sort_r henv hΓ'.defeq)
+      hA hB he he' (he'.instN henv hΓ .zero hB hΓ) (he'.instN henv hΓ .zero he hΓ)
+  | eta _ ih =>
+    have he := ih hΓ
+    let ⟨_, hAB⟩ := he.isType' henv envIH hΓ
+    let ⟨⟨u, hA⟩, ⟨v, hB⟩⟩ := hAB.forallE_inv' henv envIH hΓ (.inl rfl)
+    have hΓ' : CtxStrong env U (_::_) := ⟨hΓ, _, hA⟩
+    exact .eta (hA.defeq.sort_r henv hΓ.defeq) (hB.defeq.sort_r henv hΓ'.defeq)
+      hA hB (hB.weakN henv (.succ .one)) he (he.weakN henv .one) (hA.weakN henv .one)
+  | structEta hreg hlevels hlevelsLength hparamsLength hparamsSpine
+      _ _ _ ihMajor ihRebuild =>
+    have hmajor := ihMajor hΓ
+    have hrebuild := ihRebuild hΓ
+    let ⟨u, htype⟩ := hmajor.isType' henv envIH hΓ
+    exact .structEta hreg hlevels hlevelsLength hparamsLength
+      hparamsSpine (htype.defeq.sort_r henv hΓ.defeq) htype hmajor hrebuild
+  | proofIrrel _ _ _ ih1 ih2 ih3 => exact .proofIrrel (ih1 hΓ) (ih2 hΓ) (ih3 hΓ)
+  | extra h1 h2 h3 =>
+    let ⟨⟨hl, ⟨_, ht⟩, _⟩, hr, _, _⟩ := envIH.2 h1
+    exact .extra h1 h2 h3 (.inst h2) (ht.instL h2)
+      (hl.instL h2) (hr.instL h2) ((hl.instL h2).weak0 henv) ((hr.instL h2).weak0 henv)
+  | nil | cons => trivial
+
+theorem CtxStrong.strong' (henv : Ordered env) (envIH : env.OnTypes (EnvStrong env))
+    (hΓ : OnCtx Γ (env.IsType U)) : CtxStrong env U Γ := by
+  induction Γ with
+  | nil => trivial
+  | cons _ _ ih => let ⟨hΓ, _, hA⟩ := hΓ; exact ⟨ih hΓ, _, hA.strong' henv envIH (ih hΓ)⟩
+
+theorem Ordered.strong (henv : Ordered env) : OnTypes env (EnvStrong env) := by
+  refine henv.induction _ (fun le ⟨h1, ⟨_, h2⟩, h3, h4⟩ => ?_) (fun henv IH H => ?_)
+  · refine ⟨h1.mono le, ⟨_, h2.mono le⟩, ?_, ?_⟩
+    · exact fun _ _ _ h4 h5 h6 => (h3 _ _ _ h4 h5 h6).mono le
+    · exact fun _ _ eq => let ⟨⟨_, h4⟩, ⟨_, h5⟩⟩ := h4 _ _ eq; ⟨⟨_, h4.mono le⟩, ⟨_, h5.mono le⟩⟩
+  · have H' := H.strong' henv IH (Γ := []) ⟨⟩
+    refine ⟨H', H'.isType' henv IH ⟨⟩, fun _ _ _ h1 h2 h3 => ?_, ?_⟩
+    · exact EqUpToLevels.defeq henv IH (by trivial) (.instL h1 H')
+        (EqUpToLevels.refl (by trivial) (.instL h1 H')).1 (EqUpToLevels.instL h1 h2 h3 H').1
+    · exact fun _ _ eq => H'.forallE_inv' henv IH ⟨⟩ (.inl eq)
+
+theorem CtxStrong.strong (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) : CtxStrong env U Γ :=
+  .strong' henv henv.strong hΓ
+
+theorem IsDefEq.strong (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U))
+    (H : env.IsDefEq U Γ e1 e2 A) : env.IsDefEqStrong U Γ e1 e2 A :=
+  H.strong' henv henv.strong (.strong henv hΓ)
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem IsDefEq.eqUpToLevels (H : env.IsDefEq U Γ e1 e2 A)
+    (H1 : EqUpToLevels U e2 e2') : env.IsDefEq U Γ e1 e2' A :=
+  have W := .strong' henv henv.strong hΓ
+  have := H.strong henv hΓ
+  (EqUpToLevels.defeq henv henv.strong W (H.strong henv hΓ)
+    (EqUpToLevels.refl W.levelWF this).1 H1).defeq
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U')) {ls ls' : List VLevel}
+    (hls : ∀ l ∈ ls, l.WF U) (hls' : ∀ l ∈ ls', l.WF U) (heq : List.Forall₂ (· ≈ ·) ls ls') in
+theorem IsDefEq.instL_r (H : env.IsDefEq U' Γ e1 e2 A) :
+    env.IsDefEq U (Γ.map (VExpr.instL ls)) (e1.instL ls) (e2.instL ls') (A.instL ls) :=
+  have := H.strong henv hΓ
+  IsDefEq.eqUpToLevels henv (hΓ.instL hls) (this.instL hls).defeq
+    (EqUpToLevels.instL hls hls' heq this).2
+
+theorem IsDefEqStrong.hasType' {env : VEnv}
+    (H : env.IsDefEqStrong U Γ e1 e2 A) :
+    env.HasTypeStrong U Γ e1 A true ∧ env.HasTypeStrong U Γ e2 A true := by
+  induction H with
+  | bvar h1 h2 _ ih3 => refine and_self_iff.2 <| .base <| .bvar h1 h2 ih3.1
+  | symm _ ih => exact ih.symm
+  | trans _ _ ih1 ih2 | proofIrrel _ _ _ _ ih1 ih2 => exact ⟨ih1.1, ih2.2⟩
+  | sortDF h1 h2 h3 => exact ⟨.base <| .sort' h1 h1 rfl, .base <| .sort' h2 h1 h3.symm⟩
+  | constDF h1 h2 h3 h4 h5 h6 h7 h8 ih1 ih2 =>
+    exact ⟨.base <| .const h1 h2 h4 h6 ih1.1 ih2.1,
+      .defeq h6 h8.symm ih2.2 ih2.1 <| .base <|
+      .const h1 h3 (h5.length_eq.symm.trans h4) h6 ih1.2 ih2.2⟩
+  | appDF h1 h2 h3 h4 h5 h6 h7 ih1 ih2 ih3 ih4 ih5 =>
+    have := HasTypeStrong.base <| .forallE h1 h2 ih1.1 ih2.1
+    exact ⟨.base <| .app h1 h2 ih1.1 ih2.1 this ih3.1 ih4.1 ih5.1,
+      .defeq h2 h7.symm ih5.2 ih5.1 <| .base <| .app h1 h2 ih1.2 ih2.2 this ih3.2 ih4.2 ih5.2⟩
+  | lamDF h1 h2 h3 h4 h5 h6 h7 ih1 ih2 ih3 ih4 ih5 =>
+    refine ⟨.base <| .lam h1 h2 ih1.1 ih2.1 ih4.1 ?a,
+      .defeq (by exact ⟨h1, h2⟩) (.symm <| .forallEDF h1 h2 h3 h4 h5) ?b ?a ?_⟩
+    · exact .base <| .forallE h1 h2 ih1.1 ih2.1
+    · exact .base <| .forallE h1 h2 ih1.2 ih3.1
+    · exact .base <| .lam h1 h2 ih1.2 ih3.1 ih5.2 ?b
+  | forallEDF h1 h2 h3 h4 h5 ih1 ih2 ih3 =>
+    exact ⟨.base <| .forallE h1 h2 ih1.1 ih2.1, .base <| .forallE h1 h2 ih1.2 ih3.2⟩
+  | defeqDF h1 h2 h3 ih1 ih2 =>
+    exact ⟨.defeq h1 h2 ih1.1 ih1.2 ih2.1, .defeq h1 h2 ih1.1 ih1.2 ih2.2⟩
+  | beta h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    have := HasTypeStrong.base <| .forallE h1 h2 ih1.1 ih2.1
+    refine ⟨.base <| .app h1 h2 ih1.1 ih2.1 this ?_ ih4.1 ih5.1, ih6.1⟩
+    refine .base <| .lam h1 h2 ih1.1 ih2.1 ih3.1 ?_
+    exact .base <| .forallE h1 h2 ih1.1 ih2.1
+  | @eta Γ A u B v e h1 h2 _ _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 ih6 =>
+    refine have a1 := .base <| .forallE h1 h2 ih6.1 ih3.1
+      have := ih6.1.app h1 h2 ih3.1 a1 ih5.1 (.base <| .bvar .zero h1 ih6.1); ?_
+    rw [instN_bvar0] at this; specialize this ih2.1
+    refine ⟨.base <| .lam h1 h2 ih1.1 ih2.1 (.base this) ?_, ih4.1⟩
+    exact .base <| .forallE h1 h2 ih1.1 ih2.1
+  | structEta _ _ _ _ _ _ _ _ _ _ ihMajor ihRebuild =>
+    exact ⟨ihRebuild.1, ihMajor.1⟩
+  | extra h1 h2 h3 h4 h5 h6 h7 _ _ _ _ _ ih4 ih5 => exact ⟨ih4.1, ih5.1⟩
+
+theorem HasTypeStrong.refl {env : VEnv}
+    (H : env.HasTypeStrong U Γ e A b) : env.IsDefEqStrong U Γ e e A := by
+  induction H with
+  | bvar h1 h2 _ ih1 => refine .bvar h1 h2 ih1
+  | sort' h1 h2 h3 =>
+    refine .defeqDF ?_ (.sortDF ?_ ?_ (VLevel.succ_congr h3)) (.sortDF h1 h1 rfl) <;> assumption
+  | const h1 h2 h3 h4 h5 h6 ih1 ih2 =>
+    exact .constDF h1 h2 h2 h3 (.rfl fun _ _ => rfl) h4 ih1 ih2
+  | app h1 h2 h3 h4 _ h5 h6 h7 ih1 ih2 _ ih3 ih4 ih5 =>
+    exact .appDF h1 h2 ih1 ih2 ih3 ih4 ih5
+  | lam h1 h2 h3 h4 h5 _ ih1 ih2 ih3 =>
+    exact .lamDF h1 h2 ih1 ih2 ih2 ih3 ih3
+  | forallE h1 h2 h3 h4 ih1 ih2 =>
+    exact .forallEDF h1 h2 ih1 ih2 ih2
+  | base _ ih => exact ih
+  | defeq h1 h2 h3 h4 h5 ih1 ih2 ih3 => exact .defeqDF h1 h2 ih3
+
+theorem HasTypeStrong.hasType {env : VEnv}
+    (H : env.HasTypeStrong U Γ e A b) :  env.HasType U Γ e A := H.refl.defeq.hasType.1
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem HasType.app_inv (H : env.HasType U Γ (.app f a) V) :
+    ∃ A B, env.HasType U Γ f (.forallE A B) ∧ env.HasType U Γ a A := by
+  replace H := (H.strong henv hΓ).hasType'.1
+  generalize eq : true = b, eq' : f.app a = e' at H
+  induction H with cases eq
+  | defeq _ _ _ _ _ _ _ ih => exact ih hΓ rfl eq'
+  | base H =>
+    subst eq'; let .app _ _ _ _ _ h1 h2 _ := H; exact ⟨_, _, h1.hasType, h2.hasType⟩
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem _root_.Ix.Theory.Named.VExpr.WF.app_inv (H : VExpr.WF env U Γ (.app f a)) :
+    ∃ A B, env.HasType U Γ f (.forallE A B) ∧ env.HasType U Γ a A :=
+  let ⟨_, H⟩ := H; HasType.app_inv henv hΓ H
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem HasType.lam_inv (H : env.HasType U Γ (.lam A body) V) :
+    env.IsType U Γ A ∧ body.WF env U (A::Γ) := by
+  replace H := (H.strong henv hΓ).hasType'.1
+  generalize eq : true = b, eq' : A.lam body = e' at H
+  induction H with cases eq
+  | defeq _ _ _ _ _ _ _ ih => exact ih hΓ rfl eq'
+  | base H => subst eq'; let .lam _ _ h1 _ h2 _ := H; exact ⟨⟨_, h1.hasType⟩, _, h2.hasType⟩
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem _root_.Ix.Theory.Named.VExpr.WF.lam_inv (H : VExpr.WF env U Γ (.lam A body)) :
+    env.IsType U Γ A ∧ body.WF env U (A::Γ) :=
+  let ⟨_, H⟩ := H; HasType.lam_inv henv hΓ H
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem HasType.const_inv (H : env.HasType U Γ (.const c ls) V) :
+    ∃ ci, env.constants c = some ci ∧ (∀ l ∈ ls, l.WF U) ∧ ls.length = ci.uvars := by
+  replace H := (H.strong henv hΓ).hasType'.1
+  generalize eq : true = b, eq' : VExpr.const c ls = e' at H
+  induction H with cases eq
+  | defeq _ _ _ _ _ _ _ ih => exact ih hΓ rfl eq'
+  | base H => subst eq'; let .const h1 h2 h3 .. := H; exact ⟨_, h1, h2, h3⟩
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem _root_.Ix.Theory.Named.VExpr.WF.const_inv (H : VExpr.WF env U Γ (.const c ls)) :
+    ∃ ci, env.constants c = some ci ∧ (∀ l ∈ ls, l.WF U) ∧ ls.length = ci.uvars :=
+  let ⟨_, H⟩ := H; HasType.const_inv henv hΓ H
+
+variable! (henv : Ordered env) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem HasType.bvar_inv (H : env.HasType U Γ (.bvar i) V) : ∃ A, Lookup Γ i A := by
+  replace H := (H.strong henv hΓ).hasType'.1
+  generalize eq : true = b, eq' : VExpr.bvar i = e' at H
+  induction H with cases eq
+  | defeq _ _ _ _ _ _ _ ih => exact ih hΓ rfl eq'
+  | base H => subst eq'; let .bvar h1 .. := H; exact ⟨_, h1⟩
+
+set_option hygiene false
+local notation:65 Γ " ⊢ " e " : " A:36 => HasType env U Γ e A
+local notation:65 Γ " ⊢ " e1 " ≡ " e2 " : " A:36 => IsDefEq env U Γ e1 e2 A
+section
+local notation:65 Γ " ⊢ " e " : " A " !! " n:30 => HasTypeStratified Γ e A true n
+local notation:65 Γ " ⊢ " e " :! " A " !! " n:30 => HasTypeStratified Γ e A false n
+
+variable (env : VEnv) (U : Nat) in
+inductive HasTypeStratified : List VExpr → VExpr → VExpr → Bool → Nat → Prop where
+  | bvar : Lookup Γ i A → Γ ⊢ A : .sort u !! n → Γ ⊢ .bvar i :! A !! n+1
+  | sort' : l.WF U → l'.WF U → l ≈ l' → Γ ⊢ .sort l :! .sort (.succ l') !! n
+  | const :
+    env.constants c = some ci →
+    (∀ l ∈ ls, l.WF U) →
+    ls.length = ci.uvars →
+    Γ ⊢ ci.type.instL ls : .sort u !! n →
+    Γ ⊢ .const c ls :! ci.type.instL ls !! n+1
+  | app :
+    u.WF U → v.WF U →
+    Γ ⊢ A : .sort u !! n →
+    A::Γ ⊢ B : .sort v !! n →
+    Γ ⊢ f : .forallE A B !! n →
+    Γ ⊢ a : A !! n →
+    Γ ⊢ B.inst a : .sort v !! n →
+    Γ ⊢ .app f a :! B.inst a !! n+1
+  | lam :
+    Γ ⊢ A : .sort u !! n →
+    A::Γ ⊢ B : .sort v !! n →
+    A::Γ ⊢ body : B !! n →
+    Γ ⊢ .forallE A B : .sort (.imax u v) !! n →
+    Γ ⊢ .lam A body :! .forallE A B !! n+1
+  | forallE :
+    u.WF U → v.WF U →
+    Γ ⊢ A : .sort u !! n →
+    A::Γ ⊢ body : .sort v !! n →
+    Γ ⊢ .forallE A body :! .sort (.imax u v) !! n+1
+  | base : Γ ⊢ e :! A !! n → Γ ⊢ e : A !! n
+  | defeq : u.WF U → Γ ⊢ A ≡ B : .sort u →
+    Γ ⊢ A : .sort u !! n → Γ ⊢ B : .sort u !! n → Γ ⊢ e : A !! n → Γ ⊢ e : B !! n+1
+end
+
+theorem HasTypeStratified.hasType (H : env.HasTypeStratified U Γ e A b n) : Γ ⊢ e : A := by
+  induction H with
+  | bvar h1 h2 ih1 => refine .bvar h1
+  | sort' h1 h2 h3 =>
+    exact IsDefEq.defeq (.sortDF (by exact h1) h2 (VLevel.succ_congr h3)) (.sort h1)
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app _ _ _ _ _ _ _ _ _ ih3 ih4 => exact .app ih3 ih4
+  | lam _ _ _ _ ih1 _ ih3 => exact .lam ih1 ih3
+  | forallE _ _ _ _ ih1 ih2 => exact .forallE ih1 ih2
+  | base _ ih => exact ih
+  | defeq _ h2 _ _ _ _ _ ih3 => exact h2.defeq ih3
+
+theorem HasTypeStratified.mono (le : m ≤ n) (H : HasTypeStratified env U Γ e A b m) :
+    env.HasTypeStratified U Γ e A b n := by
+  induction H generalizing n with try let n+1 := n; replace le := Nat.le_of_succ_le_succ le
+  | bvar h1 h2 ih1 => exact .bvar h1 (ih1 le)
+  | sort' h1 h2 h3 => exact .sort' h1 h2 h3
+  | const h1 h2 h3 _ ih1 => exact .const h1 h2 h3 (ih1 le)
+  | app h1 h2 _ _ _ _ _ ih1 ih2 ih3 ih4 ih5 =>
+    exact .app h1 h2 (ih1 le) (ih2 le) (ih3 le) (ih4 le) (ih5 le)
+  | lam _ _ _ _ ih1 ih2 ih3 ih4 => exact .lam (ih1 le) (ih2 le) (ih3 le) (ih4 le)
+  | forallE h1 h2 _ _ ih1 ih2 => exact .forallE h1 h2 (ih1 le) (ih2 le)
+  | base _ ih => exact .base (ih le)
+  | defeq h1 h2 _ _ _ ih1 ih2 ih3 => exact .defeq h1 h2 (ih1 le) (ih2 le) (ih3 le)
+
+theorem HasTypeStrong.stratify (H : HasTypeStrong env U Γ e A b) :
+    ∃ n, HasTypeStratified env U Γ e A b n := by
+  generalize true = b at H ⊢
+  induction H with
+  | bvar h1 h2 _ ih1 => let ⟨n, ih1⟩ := ih1; exact ⟨_, .bvar h1 ih1⟩
+  | sort' h1 h2 h3 => exact ⟨0, .sort' h1 h2 h3⟩
+  | const h1 h2 h3 _ _ _ _ ih1 => let ⟨_, ih1⟩ := ih1; exact ⟨_, .const h1 h2 h3 ih1⟩
+  | app h1 h2 _ _ _ _ _ _ ih1 ih2 _ ih3 ih4 ih5 =>
+    let ⟨n₁, ih1⟩ := ih1; let ⟨n₂, ih2⟩ := ih2; let ⟨n₃, ih3⟩ := ih3
+    let ⟨n₄, ih4⟩ := ih4; let ⟨n₅, ih5⟩ := ih5
+    refine ⟨max n₁ (max n₂ (max n₃ (max n₄ n₅))) + 1,
+      .app h1 h2 (ih1.mono ?_) (ih2.mono ?_) (ih3.mono ?_) (ih4.mono ?_) (ih5.mono ?_)⟩ <;> omega
+  | lam _ _ _ _ _ _ ih1 ih2 ih3 ih4 =>
+    let ⟨n₁, ih1⟩ := ih1; let ⟨n₂, ih2⟩ := ih2; let ⟨n₃, ih3⟩ := ih3; let ⟨n₄, ih4⟩ := ih4
+    refine ⟨max n₁ (max n₂ (max n₃ n₄)) + 1,
+      .lam (ih1.mono ?_) (ih2.mono ?_) (ih3.mono ?_) (ih4.mono ?_)⟩ <;> omega
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    let ⟨n₁, ih1⟩ := ih1; let ⟨n₂, ih2⟩ := ih2
+    refine ⟨max n₁ n₂ + 1, .forallE h1 h2 (ih1.mono ?_) (ih2.mono ?_)⟩ <;> omega
+  | base _ ih => let ⟨_, ih⟩ := ih; exact ⟨_, .base ih⟩
+  | defeq h1 h2 _ _ _ ih1 ih2 ih3 =>
+    let ⟨n₁, ih1⟩ := ih1; let ⟨n₂, ih2⟩ := ih2; let ⟨n₃, ih3⟩ := ih3
+    refine ⟨max n₁ (max n₂ n₃) + 1,
+      .defeq h1 h2.defeq (ih1.mono ?_) (ih2.mono ?_) (ih3.mono ?_)⟩ <;> omega
+
+theorem HasTypeStratified.to_core (H : HasTypeStratified env U Γ e A true n) :
+    ∃ A', HasTypeStratified env U Γ e A' false n := by
+  generalize hb : true = b at H
+  induction H with cases hb
+  | base h _ => exact ⟨_, h⟩
+  | defeq _ _ _ _ _ _ _ ih3 => obtain ⟨A', hA'⟩ := ih3 rfl; exact ⟨A', hA'.mono (Nat.le_succ _)⟩
+
+theorem HasTypeStratified.isType (H : HasTypeStratified env U Γ e A b n) :
+    ∃ u, HasTypeStratified env U Γ A (.sort u) true (n - 1) := by
+  induction H with
+  | base _ ih => exact ih
+  | bvar _ h | const _ _ _ h | app _ _ _ _ _ _ h | lam _ _ _ h | defeq _ _ _ h => exact ⟨_, h⟩
+  | @sort' _ l _ _ _ h _ => exact ⟨_, .base (.sort' (l := l.succ) (l' := l.succ) h h rfl)⟩
+  | @forallE _ _ u _ _ v h1 h2 =>
+    exact ⟨_, .base (.sort' (l := .imax u v) (l' := .imax u v) ⟨h1, h2⟩ ⟨h1, h2⟩ rfl)⟩
diff --git a/Ix/Theory/Named/Typing/UniqueTyping.lean b/Ix/Theory/Named/Typing/UniqueTyping.lean
new file mode 100644
index 000000000..66579ab3b
--- /dev/null
+++ b/Ix/Theory/Named/Typing/UniqueTyping.lean
@@ -0,0 +1,377 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Injectivity
+import Ix.Theory.Named.Typing.Pattern
+
+open Ix.Theory (VLevel)
+
+/-! # Unique typing and its consequences. -/
+
+namespace Ix.Theory.Named
+namespace VEnv
+
+variable {env : VEnv} {U : Nat}
+local notation:65 Γ " ⊢ " e " : " A:36 => HasType env U Γ e A
+local notation:65 Γ " ⊢ " e1 " ≡ " e2 " : " A:36 => IsDefEq env U Γ e1 e2 A
+
+theorem IsDefEq.uniq (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : Γ ⊢ e₁ ≡ e₂ : A) (h2 : Γ ⊢ e₂ ≡ e₃ : B) : ∃ u, Γ ⊢ A ≡ B : .sort u := by
+  suffices ∀ {e A B b n₁ n₂ n}, n₁ ≤ n → n₂ ≤ n →
+      env.HasTypeStratified U Γ e A b n₁ → env.HasTypeStratified U Γ e B b n₂ →
+      ∃ u, Γ ⊢ A ≡ B : .sort u ∧ ∃ v, u ≈ v ∧
+        env.HasTypeStratified U Γ A (.sort u) true (n-1) ∧
+        env.HasTypeStratified U Γ B (.sort v) true (n-1) from
+    let ⟨n₁, h1⟩ := (h1.strong henv hΓ).hasType'.2.stratify
+    let ⟨n₂, h2⟩ := (h2.strong henv hΓ).hasType'.1.stratify
+    have ⟨_, h, _⟩ := this (Nat.le_max_left ..) (Nat.le_max_right ..) h1 h2
+    ⟨_, h⟩
+  clear h1 h2; intro e A B b n₁ n₂ n le₁ le₂ H1
+  induction n using WellFounded.induction Nat.lt_wfRel.2
+    generalizing n₁ n₂ Γ e A B b with | _ n IH
+  induction H1 generalizing B n₂ n with
+  | bvar a1 a2 =>
+    intro (.bvar b1 b2); cases a1.uniq b1
+    exact ⟨_, b2.hasType, _, rfl, b2.mono (by omega), b2.mono (by omega)⟩
+  | sort' a1 a2 a3 =>
+    intro (.sort' b1 b2 b3)
+    have := VLevel.succ_congr (b3.symm.trans a3)
+    exact ⟨_, .symm <| .sortDF b2 a2 this, _, VLevel.succ_congr this,
+      .base <| .sort' a2 b2 this.symm, .base <| .sort' b2 a2 this⟩
+  | const a1 a2 a3 a4 =>
+    intro (.const b1 b2 b3 b4); cases a1.symm.trans b1
+    replace le₁ := Nat.sub_le_sub_right le₁ 1
+    exact ⟨_, a4.hasType, _, rfl, a4.mono le₁, a4.mono le₁⟩
+  | app _ a2 a3 a4 _ a6 a7 _ _ ih3 =>
+    intro (.app _ _ b3 b4 b5 _ b7)
+    have ⟨_, c1, _, _, c3, c4⟩ := ih3 n IH hΓ (Nat.le_of_succ_le le₁) (Nat.le_of_succ_le le₂) b5
+    have ⟨_, _, d3, d4, d5⟩ := IsDefEqU.forallE_inv_stratified henv hΓ ⟨_, c1⟩ c3 c4
+    let n+1 := n
+    replace le₁ := Nat.le_of_succ_le_succ le₁
+    replace le₂ := Nat.le_of_succ_le_succ le₂
+    have e1 := have ⟨_, h⟩ := a3.hasType.isType henv hΓ; h.sort_inv henv
+    refine have hΓ₁ := ⟨hΓ, _, a3.hasType⟩
+      have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ₁ le₁ (Nat.le_refl _) a4 d4; ?_
+    have e3 := IsDefEqU.sort_inv henv hΓ₁ ⟨_, h⟩
+    have e4 := have ⟨_, h⟩ := d4.hasType.isType henv hΓ₁; h.sort_inv henv
+    refine have hΓ₂ := ⟨hΓ, _, b3.hasType⟩
+      have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ₂ le₂ (Nat.le_refl _) b4 d5; ?_
+    have e5 := IsDefEqU.sort_inv henv hΓ₂ ⟨_, h⟩
+    exact ⟨_, .defeqDF (.sortDF e4 a2 e3.symm) (d3.instN henv a6.hasType .zero), _,
+      e3.trans e5.symm, a7.mono le₁, b7.mono le₂⟩
+  | lam a1 a2 _ a4 _ _ ih3 =>
+    intro (.lam b1 b2 b3 b4)
+    have ⟨_, c1, _, c2, c3, c4⟩ := ih3 n IH ⟨hΓ, _, a1.hasType⟩
+      (Nat.le_of_succ_le le₁) (Nat.le_of_succ_le le₂) b3
+    let n+1 := n
+    replace le₁ := Nat.le_of_succ_le_succ le₁
+    replace le₂ := Nat.le_of_succ_le_succ le₂
+    have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ le₁ le₂ a1 b1
+    have e1 := IsDefEqU.sort_inv henv hΓ ⟨_, h⟩
+    refine have hΓ' := ⟨hΓ, _, a1.hasType⟩
+      have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ' le₁ (Nat.le_refl _) a2 c3; ?_
+    have f1 := h.sort_inv_l henv; have f2 := h.sort_inv_r henv
+    have e2 := IsDefEqU.sort_inv henv hΓ' ⟨_, h⟩
+    have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ' le₂ (Nat.le_refl _) b2 c4
+    have e3 := IsDefEqU.sort_inv henv hΓ' ⟨_, h⟩
+    exact ⟨_, .forallEDF a1.hasType (.defeqDF (.symm <| .sortDF f1 f2 e2) c1),
+      _, VLevel.imax_congr e1 (e2.trans <| c2.trans e3.symm), a4.mono le₁, b4.mono le₂⟩
+  | forallE a1 a2 a3 a4 =>
+    intro (.forallE b1 b2 b3 b4)
+    let n+1 := n
+    replace le₁ := Nat.le_of_succ_le_succ le₁
+    replace le₂ := Nat.le_of_succ_le_succ le₂
+    have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ le₁ le₂ a3 b3
+    have e1 := IsDefEqU.sort_inv henv hΓ ⟨_, h⟩
+    refine have hΓ' := ⟨hΓ, _, a3.hasType⟩
+      have ⟨_, h, _⟩ := IH _ (Nat.lt_succ_self _) hΓ' le₁ le₂ a4 b4; ?_
+    have e2 := IsDefEqU.sort_inv henv hΓ' ⟨_, h⟩
+    have := VLevel.imax_congr e1 e2
+    exact ⟨_, .sortDF ⟨a1, a2⟩ ⟨b1, b2⟩ this, _, rfl,
+      .base <| .sort' ⟨a1, a2⟩ ⟨a1, a2⟩ rfl, .base <| .sort' ⟨b1, b2⟩ ⟨a1, a2⟩ this.symm⟩
+  | @base Γ e A n₁ a1 ih =>
+    intro H2
+    replace ih {n'} le := @ih n' (fun y h1 => IH y (Nat.lt_of_lt_of_le h1 le)) hΓ
+    generalize eq : true = b at H2
+    induction H2 with cases eq
+    | @base _ _  _ n' b1 => exact ih (Nat.le_refl _) le₁ le₂ b1
+    | @defeq Γ B' B u n' _ b1 b2 b3 b4 b5 _ _ ih' =>
+      have ⟨u₁, c1, u₂, c2, c3, c4⟩ := ih' a1 hΓ (Nat.le_of_succ_le le₂) ih rfl
+      let n+1 := n
+      replace le₂ := Nat.le_of_succ_le_succ le₂
+      have ⟨v₁, d1, v₂, _⟩ := IH _ (Nat.lt_succ_self _) hΓ le₂ (Nat.le_refl _) b3 c4
+      have e1 := IsDefEqU.sort_inv henv hΓ ⟨_, d1⟩
+      have e2 := have ⟨_, h⟩ := c3.hasType.isType henv hΓ; h.sort_inv henv
+      have eq : u₁ ≈ u := c2.trans e1.symm
+      exact ⟨_, c1.trans (.defeqDF (.symm <| .sortDF e2 b1 eq) b2), _, eq, c3, b4.mono le₂⟩
+  | @defeq Γ A' A u n' _ a1 a2 a3 a4 a5 ih1 ih2 ih' =>
+    intro H2
+    have ⟨_, c1, u₂, c2, c3, c4⟩ := ih' _ IH hΓ (Nat.le_of_succ_le le₁) le₂ H2
+    let n+1 := n
+    replace le₁ := Nat.le_of_succ_le_succ le₁
+    have ⟨_, d1, _, _⟩ := IH _ (Nat.lt_succ_self _) hΓ le₁ (Nat.le_refl _) a3 c3
+    have e1 := IsDefEqU.sort_inv henv hΓ ⟨_, d1⟩
+    have e2 := have ⟨_, h⟩ := c3.hasType.isType henv hΓ; h.sort_inv henv
+    have eq : u ≈ u₂ := e1.trans c2
+    exact ⟨_, a2.symm.trans (.defeqDF (.symm <| .sortDF a1 e2 e1) c1), _, eq, a4.mono le₁, c4⟩
+
+theorem IsDefEq.uniqU (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEq U Γ e₁ e₂ A) (h2 : env.IsDefEq U Γ e₂ e₃ B) :
+    env.IsDefEqU U Γ A B := let ⟨_, h⟩ := h1.uniq henv hΓ h2; ⟨_, h⟩
+
+theorem isDefEq_iff (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U)) :
+    env.IsDefEq U Γ e₁ e₂ A ↔
+    env.HasType U Γ e₁ A ∧ env.HasType U Γ e₂ A ∧ env.IsDefEqU U Γ e₁ e₂ := by
+  refine ⟨fun h => ⟨h.hasType.1, h.hasType.2, _, h⟩, fun ⟨_, h2, _, h3⟩ => ?_⟩
+  have ⟨_, h⟩ := h3.uniq henv hΓ h2
+  exact h.defeqDF h3
+
+theorem IsDefEq.trans_r (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h₁ : env.IsDefEq U Γ e₁ e₂ A) (h₂ : env.IsDefEq U Γ e₂ e₃ B) :
+    env.IsDefEq U Γ e₁ e₃ B := have ⟨_, h⟩ := h₁.uniq henv hΓ h₂; .trans (.defeqDF h h₁) h₂
+
+theorem IsDefEq.trans_l (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h₁ : env.IsDefEq U Γ e₁ e₂ A) (h₂ : env.IsDefEq U Γ e₂ e₃ B) :
+    env.IsDefEq U Γ e₁ e₃ A := have ⟨_, h⟩ := h₁.uniq henv hΓ h₂; h₁.trans (.defeqDF (.symm h) h₂)
+
+theorem IsDefEq.transU_r (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h₁ : env.IsDefEqU U Γ e₁ e₂) (h₂ : env.IsDefEq U Γ e₂ e₃ A) :
+    env.IsDefEq U Γ e₁ e₃ A := have ⟨_, h₁⟩ := h₁; .trans_r henv hΓ h₁ h₂
+
+theorem IsDefEq.transU_l (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h₁ : env.IsDefEq U Γ e₁ e₂ A) (h₂ : env.IsDefEqU U Γ e₂ e₃) :
+    env.IsDefEq U Γ e₁ e₃ A := have ⟨_, h₂⟩ := h₂; .trans_l henv hΓ h₁ h₂
+
+theorem IsDefEqU.defeqDF (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h₁ : env.IsDefEqU U Γ A B) (h₂ : env.IsDefEq U Γ e₁ e₂ A) :
+    env.IsDefEq U Γ e₁ e₂ B := by
+  have ⟨_, h₁⟩ := h₁
+  have ⟨_, hA⟩ := h₂.isType henv hΓ
+  exact .defeqDF (hA.trans_l henv hΓ h₁) h₂
+
+theorem IsDefEqU.of_l (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ e₁ e₂) (h2 : env.HasType U Γ e₁ A) :
+    env.IsDefEq U Γ e₁ e₂ A := let ⟨_, h⟩ := h1; h2.trans_l henv hΓ h
+
+theorem HasType.defeqU_l (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ e₁ e₂) (h2 : env.HasType U Γ e₁ A) :
+    env.HasType U Γ e₂ A := (h1.of_l henv hΓ h2).hasType.2
+
+theorem IsType.defeqU_l (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ A₁ A₂) (h2 : env.IsType U Γ A₁) :
+    env.IsType U Γ A₂ := h2.imp fun _ h2 => h2.defeqU_l henv hΓ h1
+
+theorem IsDefEqU.of_r (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ e₁ e₂) (h2 : env.HasType U Γ e₂ A) :
+    env.IsDefEq U Γ e₁ e₂ A := (h1.symm.of_l henv hΓ h2).symm
+
+theorem HasType.defeqU_r (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ A₁ A₂) (h2 : env.HasType U Γ e A₁) :
+    env.HasType U Γ e A₂ := h1.defeqDF henv hΓ h2
+
+theorem IsDefEqU.trans (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (h1 : env.IsDefEqU U Γ e₁ e₂) (h2 : env.IsDefEqU U Γ e₂ e₃) :
+    env.IsDefEqU U Γ e₁ e₃ := h1.imp fun _ h1 => let ⟨_, h2⟩ := h2; h1.trans_l henv hΓ h2
+
+set_option warn.sorry false in
+variable! (henv : VEnv.WF env) (hΓ : OnCtx Γ' (env.IsType U)) in
+theorem IsDefEqU.weakN_iff (W : Ctx.LiftN n k Γ Γ') :
+    env.IsDefEqU U Γ' (e1.liftN n k) (e2.liftN n k) ↔ env.IsDefEqU U Γ e1 e2 := by
+  refine ⟨fun h => have := henv; have := hΓ; sorry, fun h => h.weakN henv W⟩
+
+variable! (henv : VEnv.WF env) (hΓ : OnCtx Γ' (env.IsType U)) in
+theorem _root_.Ix.Theory.Named.VExpr.WF.weakN_iff (W : Ctx.LiftN n k Γ Γ') :
+    VExpr.WF env U Γ' (e.liftN n k) ↔ VExpr.WF env U Γ e := IsDefEqU.weakN_iff henv hΓ W
+
+theorem IsDefEq.skips (henv : VEnv.WF env) (hΓ : OnCtx Γ' (env.IsType U))
+    (W : Ctx.LiftN n k Γ Γ')
+    (H : env.IsDefEq U Γ' e₁ e₂ A) (h1 : e₁.Skips n k) (h2 : e₂.Skips n k) :
+    ∃ B, env.IsDefEq U Γ' e₁ e₂ B ∧ B.Skips n k := by
+  obtain ⟨e₁, rfl⟩ := VExpr.skips_iff_exists.1 h1
+  obtain ⟨e₂, rfl⟩ := VExpr.skips_iff_exists.1 h2
+  have ⟨_, H⟩ := (IsDefEqU.weakN_iff henv hΓ W).1 ⟨_, H⟩
+  exact ⟨_, H.weakN henv W, .liftN⟩
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) (hΓ : OnCtx Γ (env.IsType U)) in
+theorem IsDefEq.weakN_iff' (W : Ctx.LiftN n k Γ Γ') :
+    env.IsDefEq U Γ' (e1.liftN n k) (e2.liftN n k) (A.liftN n k) ↔ env.IsDefEq U Γ e1 e2 A := by
+  refine ⟨fun h => ?_, fun h => h.weakN henv W⟩
+  have ⟨_, H⟩ := (IsDefEqU.weakN_iff henv hΓ' W).1 ⟨_, h⟩
+  refine IsDefEqU.defeqDF henv hΓ ?_ H
+  exact (IsDefEqU.weakN_iff henv hΓ' W).1 <| (H.weakN henv W).uniqU henv hΓ' h.symm
+
+variable! (henv : VEnv.WF env) in
+theorem _root_.Ix.Theory.Named.OnCtx.weakN_inv
+    (W : Ctx.LiftN n k Γ Γ') (H : OnCtx Γ' (env.IsType U)) : OnCtx Γ (env.IsType U) := by
+  induction W with
+  | zero As h =>
+    clear h
+    induction As with
+    | nil => exact H
+    | cons A As ih => exact ih H.1
+  | succ W ih =>
+    let ⟨H1, _, H2⟩ := H
+    exact ⟨ih H1, _, (IsDefEq.weakN_iff' henv H1 (ih H1) W).1 H2⟩
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem IsDefEq.weakN_iff (W : Ctx.LiftN n k Γ Γ') :
+    env.IsDefEq U Γ' (e1.liftN n k) (e2.liftN n k) (A.liftN n k) ↔ env.IsDefEq U Γ e1 e2 A :=
+  IsDefEq.weakN_iff' henv hΓ' (hΓ'.weakN_inv henv W) W
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem HasType.weakN_iff (W : Ctx.LiftN n k Γ Γ') :
+    env.HasType U Γ' (e.liftN n k) (A.liftN n k) ↔ env.HasType U Γ e A :=
+  IsDefEq.weakN_iff henv hΓ' W
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem IsType.weakN_iff (W : Ctx.LiftN n k Γ Γ') :
+    env.IsType U Γ' (A.liftN n k) ↔ env.IsType U Γ A :=
+  exists_congr fun _ => HasType.weakN_iff henv hΓ' W (A := .sort _)
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem HasType.skips (W : Ctx.LiftN n k Γ Γ')
+    (h1 : env.HasType U Γ' e A) (h2 : e.Skips n k) : ∃ B, env.HasType U Γ' e B ∧ B.Skips n k :=
+  IsDefEq.skips henv hΓ' W h1 h2 h2
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem IsDefEqU.weak'_iff (W : Ctx.Lift' l Γ Γ') :
+    env.IsDefEqU U Γ' (e1.lift' l) (e2.lift' l) ↔ env.IsDefEqU U Γ e1 e2 := by
+  generalize e : l.depth = n
+  induction n generalizing l Γ' with
+  | zero => simp [VExpr.lift'_depth_zero e, W.depth_zero e]
+  | succ n ih =>
+    obtain ⟨l, k, rfl, rfl⟩ := Lift.depth_succ e
+    have ⟨Γ₁, W1, W2⟩ := W.of_cons_skip
+    rw [Lift.consN_skip_eq, VExpr.lift'_comp, VExpr.lift'_comp,
+      ← Lift.skipN_one, VExpr.lift'_consN_skipN, VExpr.lift'_consN_skipN,
+      weakN_iff henv hΓ' W2, ih (hΓ'.weakN_inv henv W2) W1 Lift.depth_consN]
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem IsDefEq.weak'_iff (W : Ctx.Lift' l Γ Γ') :
+    env.IsDefEq U Γ' (e1.lift' l) (e2.lift' l) (A.lift' l) ↔ env.IsDefEq U Γ e1 e2 A := by
+  generalize e : l.depth = n
+  induction n generalizing l Γ' with
+  | zero => simp [VExpr.lift'_depth_zero e, W.depth_zero e]
+  | succ n ih =>
+    obtain ⟨l, k, rfl, rfl⟩ := Lift.depth_succ e
+    have ⟨Γ₁, W1, W2⟩ := W.of_cons_skip
+    rw [Lift.consN_skip_eq, VExpr.lift'_comp, VExpr.lift'_comp, VExpr.lift'_comp,
+      ← Lift.skipN_one, VExpr.lift'_consN_skipN, VExpr.lift'_consN_skipN, VExpr.lift'_consN_skipN,
+      weakN_iff henv hΓ' W2, ih (hΓ'.weakN_inv henv W2) W1 Lift.depth_consN]
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem HasType.weak'_iff (W : Ctx.Lift' l Γ Γ') :
+    env.HasType U Γ' (e.lift' l) (A.lift' l) ↔ env.HasType U Γ e A :=
+  IsDefEq.weak'_iff henv hΓ' W
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem IsType.weak'_iff (W : Ctx.Lift' l Γ Γ') :
+    env.IsType U Γ' (e.lift' l) ↔ env.IsType U Γ e :=
+  exists_congr fun _ => HasType.weak'_iff henv hΓ' W (A := .sort _)
+
+variable! (henv : VEnv.WF env) (hΓ : OnCtx Γ' (env.IsType U)) in
+theorem _root_.Ix.Theory.Named.VExpr.WF.weak'_iff (W : Ctx.Lift' l Γ Γ') :
+    VExpr.WF env U Γ' (e.lift' l) ↔ VExpr.WF env U Γ e := IsDefEqU.weak'_iff henv hΓ W
+
+/-! ### Application-spine weakening and inversion -/
+
+/-- General context weakening for an application spine. -/
+theorem SpineWF.weak' {env : VEnv} (henv : env.Ordered)
+    {U : Nat} {lift : Lift} {Γ Γ' : List VExpr}
+    (W : Ctx.Lift' lift Γ Γ') :
+    ∀ {es : List VExpr} {A B : VExpr}, env.SpineWF U Γ A es B →
+      env.SpineWF U Γ' (A.lift' lift)
+        (es.map fun e => e.lift' lift) (B.lift' lift) := by
+  intro es
+  induction es with
+  | nil =>
+      intro A B h
+      cases h
+      exact .nil
+  | cons e es ih =>
+      intro A B h
+      obtain ⟨A₁, A₂, rfl, he, hrest⟩ := h.cons_inv
+      refine .cons (he.weak' henv W) ?_
+      have weakened := ih hrest
+      rwa [VExpr.lift'_inst_hi] at weakened
+
+/-- Invert weakening of every component of an application-spine judgment
+when the enlarged context is well formed. -/
+theorem SpineWF.weakN_inv {env : VEnv} {U n k : Nat} {Γ Γ' : List VExpr}
+    (henv : env.WF) (hΓ' : OnCtx Γ' (env.IsType U))
+    (W : Ctx.LiftN n k Γ Γ') :
+    ∀ {es : List VExpr} {A B : VExpr},
+      env.SpineWF U Γ' (A.liftN n k)
+        (es.map fun e => e.liftN n k) (B.liftN n k) →
+      env.SpineWF U Γ A es B := by
+  intro es
+  induction es with
+  | nil =>
+      intro A B h
+      have hab := VExpr.liftN_inj.1 h.nil_inv
+      subst B
+      exact .nil
+  | cons e es ih =>
+      intro A B h
+      obtain ⟨A₁', A₂', sourceEq, he, hrest⟩ := h.cons_inv
+      cases A with
+      | bvar index => cases sourceEq
+      | sort level => cases sourceEq
+      | const name levels => cases sourceEq
+      | app fn argument => cases sourceEq
+      | lam domain body => cases sourceEq
+      | forallE A₁ A₂ =>
+        injection sourceEq with domainEq bodyEq
+        subst A₁'
+        subst A₂'
+        refine .cons ((HasType.weakN_iff henv hΓ' W).1 he) ?_
+        rw [← VExpr.liftN_inst_hi] at hrest
+        exact ih hrest
+
+/-- Invert a general context lift componentwise across an application-spine
+judgment. -/
+theorem SpineWF.weak'_inv {env : VEnv} {U : Nat} {lift : Lift}
+    {Γ Γ' : List VExpr}
+    (henv : env.WF) (hΓ' : OnCtx Γ' (env.IsType U))
+    (W : Ctx.Lift' lift Γ Γ') :
+    ∀ {es : List VExpr} {A B : VExpr},
+      env.SpineWF U Γ' (A.lift' lift)
+        (es.map fun e => e.lift' lift) (B.lift' lift) →
+      env.SpineWF U Γ A es B := by
+  intro es
+  induction es with
+  | nil =>
+      intro A B h
+      have hab := VExpr.lift'_inj.1 h.nil_inv
+      subst B
+      exact .nil
+  | cons e es ih =>
+      intro A B h
+      obtain ⟨A₁', A₂', sourceEq, he, hrest⟩ := h.cons_inv
+      cases A with
+      | bvar index => cases sourceEq
+      | sort level => cases sourceEq
+      | const name levels => cases sourceEq
+      | app fn argument => cases sourceEq
+      | lam domain body => cases sourceEq
+      | forallE A₁ A₂ =>
+        injection sourceEq with domainEq bodyEq
+        subst A₁'
+        subst A₂'
+        refine .cons ((HasType.weak'_iff henv hΓ' W).1 he) ?_
+        rw [← VExpr.lift'_inst_hi] at hrest
+        exact ih hrest
+
+variable! (henv : VEnv.WF env) in
+theorem _root_.Ix.Theory.Named.OnCtx.weak'_inv
+    (W : Ctx.Lift' ρ Γ Γ') (H : OnCtx Γ' (env.IsType U)) : OnCtx Γ (env.IsType U) := by
+  generalize e : ρ.depth = n
+  induction n generalizing ρ Γ' with
+  | zero => simp [W.depth_zero e, H]
+  | succ n ih =>
+    obtain ⟨l, k, rfl, rfl⟩ := Lift.depth_succ e
+    have ⟨Γ₁, W1, W2⟩ := W.of_cons_skip
+    exact ih W1 (.weakN_inv henv W2 H) (by simp)
diff --git a/Ix/Theory/Named/VDecl.lean b/Ix/Theory/Named/VDecl.lean
new file mode 100644
index 000000000..f18cb5ff9
--- /dev/null
+++ b/Ix/Theory/Named/VDecl.lean
@@ -0,0 +1,37 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.VEnv
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+structure VConstVal extends VConstant where
+  name : Name
+
+structure VDefVal extends VConstVal where
+  value : VExpr
+
+def VDefVal.toDefEq (v : VDefVal) : VDefEq :=
+  ⟨v.uvars, .const v.name (VLevel.params v.uvars), v.value, v.type⟩
+
+structure VInductiveType extends VConstVal where
+  ctors : List VConstVal
+
+structure VInductDecl where
+  uvars : Nat
+  nparams : Nat
+  types : List VInductiveType
+
+inductive VDecl where
+  | axiom (_ : VConstVal)
+  | def (_ : VDefVal)
+  | opaque (_ : VDefVal)
+  | example (_ : VDefVal)
+  | quot
+  | induct (_ : VInductDecl)
+  | mutualDef (_ : List VDefVal)
diff --git a/Ix/Theory/Named/VEnv.lean b/Ix/Theory/Named/VEnv.lean
new file mode 100644
index 000000000..2bcff284c
--- /dev/null
+++ b/Ix/Theory/Named/VEnv.lean
@@ -0,0 +1,214 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.VExpr
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+structure VConstant where
+  uvars : Nat
+  type : VExpr
+
+structure VDefEq where
+  uvars : Nat
+  lhs : VExpr
+  rhs : VExpr
+  type : VExpr
+
+/-- Syntax of one registered nonrecursive-structure eta rule.
+
+The projector family is fixed by the checked structure artifact.  Its three
+naturality fields are syntactic equations, not semantic assumptions; they
+are exactly what weakening and substitution need in order to reconstruct the
+same registered eta redex. -/
+structure VStructEta where
+  uvars : Nat
+  nparams : Nat
+  nfields : Nat
+  familyName : Name
+  familyType : VExpr
+  constructorName : Name
+  projectors : List VLevel → List VExpr → List VExpr
+  projectors_length : ∀ levels params,
+    levels.length = uvars → params.length = nparams →
+      (projectors levels params).length = nfields
+  projectors_liftN : ∀ levels params n k,
+    params.length = nparams →
+    (projectors levels params).map (fun projector =>
+      projector.liftN n k) =
+      projectors levels (params.map fun param => param.liftN n k)
+  projectors_instN : ∀ levels params a k,
+    params.length = nparams →
+    (projectors levels params).map (fun projector =>
+      projector.inst a k) =
+      projectors levels (params.map fun param => param.inst a k)
+  projectors_instL : ∀ levels params ls,
+    (projectors levels params).map (fun projector =>
+      projector.instL ls) =
+      projectors (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls))
+
+namespace VStructEta
+
+/-- The instantiated family type governed by a structure-eta descriptor. -/
+def structureType (rule : VStructEta) (levels : List VLevel)
+    (params : List VExpr) : VExpr :=
+  VExpr.appN (.const rule.familyName levels) params
+
+/-- Canonical projected fields of one major premise. -/
+def projectionArgs (rule : VStructEta) (levels : List VLevel)
+    (params : List VExpr) (major : VExpr) : List VExpr :=
+  (rule.projectors levels params).map fun projector => .app projector major
+
+/-- Constructor reconstruction contracted by the primitive eta rule. -/
+def rebuild (rule : VStructEta) (levels : List VLevel)
+    (params : List VExpr) (major : VExpr) : VExpr :=
+  VExpr.appN (.const rule.constructorName levels)
+    (params ++ rule.projectionArgs levels params major)
+
+@[simp] theorem structureType_liftN (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (n k : Nat) :
+    (rule.structureType levels params).liftN n k =
+      rule.structureType levels
+        (params.map fun param => param.liftN n k) := by
+  unfold structureType
+  rw [VExpr.liftN_appN]
+  rfl
+
+@[simp] theorem structureType_instN (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (a : VExpr) (k : Nat) :
+    (rule.structureType levels params).inst a k =
+      rule.structureType levels
+        (params.map fun param => param.inst a k) := by
+  unfold structureType
+  rw [VExpr.instN_appN]
+  rfl
+
+@[simp] theorem structureType_instL (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (ls : List VLevel) :
+    (rule.structureType levels params).instL ls =
+      rule.structureType (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls)) := by
+  unfold structureType
+  rw [VExpr.instL_appN]
+  rfl
+
+@[simp] theorem projectionArgs_length (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major : VExpr)
+    (hlevels : levels.length = rule.uvars)
+    (hparams : params.length = rule.nparams) :
+    (rule.projectionArgs levels params major).length = rule.nfields := by
+  simp [projectionArgs,
+    rule.projectors_length levels params hlevels hparams]
+
+@[simp] theorem projectionArgs_liftN (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major : VExpr)
+    (hparams : params.length = rule.nparams) (n k : Nat) :
+    (rule.projectionArgs levels params major).map
+        (fun arg => arg.liftN n k) =
+      rule.projectionArgs levels
+        (params.map fun param => param.liftN n k) (major.liftN n k) := by
+  simpa [projectionArgs, VExpr.liftN, List.map_map, Function.comp_def] using
+    congrArg (List.map fun projector =>
+      projector.app (major.liftN n k))
+      (rule.projectors_liftN levels params n k hparams)
+
+@[simp] theorem projectionArgs_instN (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major a : VExpr)
+    (hparams : params.length = rule.nparams) (k : Nat) :
+    (rule.projectionArgs levels params major).map
+        (fun arg => arg.inst a k) =
+      rule.projectionArgs levels
+        (params.map fun param => param.inst a k) (major.inst a k) := by
+  simpa [projectionArgs, VExpr.inst, List.map_map, Function.comp_def] using
+    congrArg (List.map fun projector => projector.app (major.inst a k))
+      (rule.projectors_instN levels params a k hparams)
+
+@[simp] theorem projectionArgs_instL (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major : VExpr)
+    (ls : List VLevel) :
+    (rule.projectionArgs levels params major).map
+        (fun arg => arg.instL ls) =
+      rule.projectionArgs (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls)) (major.instL ls) := by
+  simpa [projectionArgs, VExpr.instL, List.map_map, Function.comp_def] using
+    congrArg (List.map fun projector => projector.app (major.instL ls))
+      (rule.projectors_instL levels params ls)
+
+@[simp] theorem rebuild_liftN (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major : VExpr)
+    (hparams : params.length = rule.nparams) (n k : Nat) :
+    (rule.rebuild levels params major).liftN n k =
+      rule.rebuild levels (params.map fun param => param.liftN n k)
+        (major.liftN n k) := by
+  unfold rebuild
+  rw [VExpr.liftN_appN, List.map_append,
+    rule.projectionArgs_liftN levels params major hparams n k]
+  rfl
+
+@[simp] theorem rebuild_instN (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major a : VExpr)
+    (hparams : params.length = rule.nparams) (k : Nat) :
+    (rule.rebuild levels params major).inst a k =
+      rule.rebuild levels (params.map fun param => param.inst a k)
+        (major.inst a k) := by
+  unfold rebuild
+  rw [VExpr.instN_appN, List.map_append,
+    rule.projectionArgs_instN levels params major a hparams k]
+  rfl
+
+@[simp] theorem rebuild_instL (rule : VStructEta)
+    (levels : List VLevel) (params : List VExpr) (major : VExpr)
+    (ls : List VLevel) :
+    (rule.rebuild levels params major).instL ls =
+      rule.rebuild (levels.map (VLevel.inst ls))
+        (params.map (VExpr.instL ls)) (major.instL ls) := by
+  unfold rebuild
+  rw [VExpr.instL_appN, List.map_append,
+    rule.projectionArgs_instL levels params major ls]
+  rfl
+
+end VStructEta
+
+@[ext] structure VEnv where
+  constants : Name → Option VConstant
+  defeqs : VDefEq → Prop
+  structEtas : VStructEta → Prop
+
+def VEnv.empty : VEnv where
+  constants _ := none
+  defeqs _ := False
+  structEtas _ := False
+
+instance : EmptyCollection VEnv := ⟨.empty⟩
+
+def VEnv.contains (env : VEnv) (name : Name) := ∃ ci, env.constants name = some ci
+
+def VEnv.addConst (env : VEnv) (name : Name) (ci : VConstant) : Option VEnv :=
+  match env.constants name with
+  | some _ => none
+  | none => some { env with constants := fun n => if name = n then some ci else env.constants n }
+
+def VEnv.addDefEq (env : VEnv) (df : VDefEq) : VEnv :=
+  { env with defeqs := fun x => x = df ∨ env.defeqs x }
+
+/-- Register one checked structure-eta descriptor. -/
+def VEnv.addStructEta (env : VEnv) (rule : VStructEta) : VEnv :=
+  { env with structEtas := fun x => x = rule ∨ env.structEtas x }
+
+structure VEnv.LE (env1 env2 : VEnv) : Prop where
+  constants : env1.constants n = some a → env2.constants n = some a
+  defeqs : env1.defeqs df → env2.defeqs df
+  structEtas : env1.structEtas rule → env2.structEtas rule
+
+instance : LE VEnv := ⟨VEnv.LE⟩
+
+theorem VEnv.LE.rfl {env : VEnv} : env ≤ env := ⟨id, id, id⟩
+
+theorem VEnv.LE.trans {a b c : VEnv} (h1 : a ≤ b) (h2 : b ≤ c) : a ≤ c :=
+  ⟨h2.1 ∘ h1.1, h2.2 ∘ h1.2, h2.3 ∘ h1.3⟩
diff --git a/Ix/Theory/Named/VExpr.lean b/Ix/Theory/Named/VExpr.lean
new file mode 100644
index 000000000..ad7108342
--- /dev/null
+++ b/Ix/Theory/Named/VExpr.lean
@@ -0,0 +1,831 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean
+import Ix.Theory.Named.VLevel
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Ix.Theory.Named
+
+inductive VExpr where
+  | bvar (deBruijnIndex : Nat)
+  | sort (u : VLevel)
+  | const (declName : Name) (us : List VLevel)
+  | app (fn arg : VExpr)
+  | lam (binderType body : VExpr)
+  | forallE (binderType body : VExpr)
+
+instance : Inhabited VExpr := ⟨.sort .zero⟩
+
+def liftVar (n i : Nat) (k := 0) : Nat := if i < k then i else n + i
+
+theorem liftVar_lt (h : i < k) : liftVar n i k = i := if_pos h
+theorem liftVar_le (h : k ≤ i) : liftVar n i k = n + i := if_neg (Nat.not_lt.2 h)
+
+theorem liftVar_base : liftVar n i = n + i := liftVar_le (Nat.zero_le _)
+@[simp] theorem liftVar_base' : liftVar n i = i + n := Nat.add_comm .. ▸ liftVar_le (Nat.zero_le _)
+
+@[simp] theorem liftVar_zero : liftVar n 0 (k+1) = 0 := by simp [liftVar]
+@[simp] theorem liftVar_succ : liftVar n (i+1) (k+1) = liftVar n i k + 1 := by
+  simp [liftVar, Nat.succ_lt_succ_iff]; split <;> simp [Nat.add_assoc]
+
+theorem liftVar_lt_add (self : i < k) : liftVar n i j < k + n := by
+  simp [liftVar]
+  split <;> rename_i h
+  · exact Nat.lt_of_lt_of_le self (Nat.le_add_right ..)
+  · rw [Nat.add_comm]; exact Nat.add_lt_add_right self _
+
+namespace VExpr
+
+/-- Iterated application, with arguments ordered from left to right. -/
+def appN (f : VExpr) : List VExpr → VExpr
+  | [] => f
+  | a :: as => (f.app a).appN as
+
+variable (n : Nat) in
+def liftN : VExpr → (k :_:= 0) → VExpr
+  | .bvar i, k => .bvar (liftVar n i k)
+  | .sort u, _ => .sort u
+  | .const c us, _ => .const c us
+  | .app fn arg, k => .app (fn.liftN k) (arg.liftN k)
+  | .lam ty body, k => .lam (ty.liftN k) (body.liftN (k+1))
+  | .forallE ty body, k => .forallE (ty.liftN k) (body.liftN (k+1))
+
+abbrev lift := liftN 1
+
+@[simp] theorem liftN_zero (e : VExpr) (k : Nat) : liftN 0 e k = e := by
+  induction e generalizing k <;> simp [liftN, liftVar, *]
+
+theorem liftN'_liftN' {e : VExpr} {n1 n2 k1 k2 : Nat} (h1 : k1 ≤ k2) (h2 : k2 ≤ n1 + k1) :
+    liftN n2 (liftN n1 e k1) k2 = liftN (n1+n2) e k1 := by
+  induction e generalizing k1 k2 with simp [liftN, liftVar, Nat.add_assoc, *]
+  | bvar i =>
+    split <;> rename_i h
+    · rw [if_pos (Nat.lt_of_lt_of_le h h1)]
+    · rw [if_neg (mt (fun h => ?_) h), Nat.add_left_comm]
+      exact (Nat.add_lt_add_iff_left ..).1 (Nat.lt_of_lt_of_le h h2)
+  | lam _ _ _ IH2 | forallE _ _ _ IH2 =>
+    rw [IH2 (Nat.succ_le_succ h1) (Nat.succ_le_succ h2)]
+
+theorem liftN'_liftN_lo (e : VExpr) (n k : Nat) : liftN n (liftN k e) k = liftN (n+k) e := by
+  simpa [Nat.add_comm] using liftN'_liftN' (n1 := k) (n2 := n) (Nat.zero_le _) (Nat.le_refl _)
+
+theorem liftN'_liftN_hi (e : VExpr) (n1 n2 k : Nat) :
+    liftN n2 (liftN n1 e k) k = liftN (n1+n2) e k :=
+  liftN'_liftN' (Nat.le_refl _) (Nat.le_add_left ..)
+
+theorem liftN_liftN (e : VExpr) (n1 n2 : Nat) : liftN n2 (liftN n1 e) = liftN (n1+n2) e := by
+  simpa using liftN'_liftN' (Nat.zero_le _) (Nat.zero_le _)
+
+theorem liftN_succ (e : VExpr) (n : Nat) : liftN (n+1) e = lift (liftN n e) :=
+  (liftN_liftN ..).symm
+
+theorem liftN'_comm (e : VExpr) (n1 n2 k1 k2 : Nat) (h : k2 ≤ k1) :
+    liftN n2 (liftN n1 e k1) k2 = liftN n1 (liftN n2 e k2) (n2+k1) := by
+  induction e generalizing k1 k2 with
+    simp [liftN, liftVar, Nat.add_assoc, Nat.succ_le_succ, *]
+  | bvar i =>
+    split <;> rename_i h'
+    · rw [if_pos (c := _ < n2 + k1)]; split
+      · exact Nat.lt_add_left _ h'
+      · exact Nat.add_lt_add_left h' _
+    · have := mt (Nat.lt_of_lt_of_le · h) h'
+      rw [if_neg (mt (Nat.lt_of_le_of_lt (Nat.le_add_left _ n1)) this),
+        if_neg this, if_neg (mt (Nat.add_lt_add_iff_left ..).1 h'), Nat.add_left_comm]
+
+theorem lift_liftN' (e : VExpr) (k : Nat) : lift (liftN n e k) = liftN n (lift e) (k+1) :=
+  Nat.add_comm .. ▸ liftN'_comm (h := Nat.zero_le _) ..
+
+theorem sizeOf_liftN (e : VExpr) (k : Nat) : sizeOf e ≤ sizeOf (liftN n e k) := by
+  induction e generalizing k with simp [liftN, Nat.add_assoc, Nat.add_le_add_iff_left]
+  | bvar => simp [liftVar]; split <;> simp [Nat.le_add_left]
+  | _ => rename_i ih1 ih2; exact Nat.add_le_add (ih1 _) (ih2 _)
+
+@[simp] theorem liftN_default (n k : Nat) : liftN n default k = default := rfl
+@[simp] theorem lift_default : lift default = default := rfl
+
+def ClosedN : VExpr → (k :_:= 0) → Prop
+  | .bvar i, k => i < k
+  | .sort .., _ | .const .., _ => True
+  | .app fn arg, k => fn.ClosedN k ∧ arg.ClosedN k
+  | .lam ty body, k => ty.ClosedN k ∧ body.ClosedN (k+1)
+  | .forallE ty body, k => ty.ClosedN k ∧ body.ClosedN (k+1)
+
+abbrev Closed := ClosedN
+
+@[simp] theorem ClosedN.default : ClosedN default k := trivial
+
+theorem ClosedN.mono (h : k ≤ k') (self : ClosedN e k) : ClosedN e k' := by
+  induction e generalizing k k' with (simp [ClosedN] at self ⊢; try simp [self, *])
+  | bvar i => exact Nat.lt_of_lt_of_le self h
+  | app _ _ ih1 ih2 => exact ⟨ih1 h self.1, ih2 h self.2⟩
+  | lam _ _ ih1 ih2 | forallE _ _ ih1 ih2 =>
+    exact ⟨ih1 h self.1, ih2 (Nat.succ_le_succ h) self.2⟩
+
+theorem ClosedN.liftN_eq (self : ClosedN e k) (h : k ≤ j) : liftN n e j = e := by
+  induction e generalizing k j with
+    (simp [ClosedN] at self; simp [liftN, *])
+  | bvar i => exact liftVar_lt (Nat.lt_of_lt_of_le self h)
+  | app _ _ ih1 ih2 => exact ⟨ih1 self.1 h, ih2 self.2 h⟩
+  | lam _ _ ih1 ih2 | forallE _ _ ih1 ih2 =>
+    exact ⟨ih1 self.1 h, ih2 self.2 (Nat.succ_le_succ h)⟩
+
+theorem ClosedN.lift_eq (self : ClosedN e) : lift e = e := self.liftN_eq (Nat.zero_le _)
+
+protected theorem ClosedN.liftN (self : ClosedN e k) : ClosedN (e.liftN n j) (k+n) := by
+  induction e generalizing k j with
+    (simp [ClosedN] at self; simp [VExpr.liftN, ClosedN, *])
+  | bvar i => exact liftVar_lt_add self
+  | lam _ _ _ ih2 | forallE _ _ _ ih2 => exact Nat.add_right_comm .. ▸ ih2 self.2
+
+theorem ClosedN.liftN_eq_rev (self : ClosedN (liftN n e j) k) (h : k ≤ j) : liftN n e j = e := by
+  induction e generalizing k j with
+    (simp [liftN, ClosedN] at self; simp [liftN, *])
+  | bvar i =>
+    refine liftVar_lt (Nat.lt_of_lt_of_le ?_ h)
+    unfold liftVar at self; split at self <;>
+      [exact self; exact Nat.lt_of_le_of_lt (Nat.le_add_left ..) self]
+  | app _ _ ih1 ih2 => exact ⟨ih1 self.1 h, ih2 self.2 h⟩
+  | lam _ _ ih1 ih2 | forallE _ _ ih1 ih2 =>
+    exact ⟨ih1 self.1 h, ih2 self.2 (Nat.succ_le_succ h)⟩
+
+variable (ls : List VLevel) in
+def instL : VExpr → VExpr
+  | .bvar i => .bvar i
+  | .sort u => .sort (u.inst ls)
+  | .const c us => .const c (us.map (VLevel.inst ls))
+  | .app fn arg => .app fn.instL arg.instL
+  | .lam ty body => .lam ty.instL body.instL
+  | .forallE ty body => .forallE ty.instL body.instL
+
+theorem ClosedN.instL : ∀ {e}, ClosedN e k → ClosedN (e.instL ls) k
+  | .bvar .., h | .sort .., h | .const .., h => h
+  | .app .., h | .lam .., h | .forallE .., h => ⟨h.1.instL, h.2.instL⟩
+
+theorem ClosedN.instL_rev : ∀ {e}, ClosedN (e.instL ls) k → ClosedN e k
+  | .bvar .., h | .sort .., h | .const .., h => h
+  | .app .., h | .lam .., h | .forallE .., h => ⟨h.1.instL_rev, h.2.instL_rev⟩
+
+@[simp] theorem instL_default : instL ls default = default := rfl
+
+@[simp] theorem instL_liftN : (liftN n e k).instL ls = liftN n (e.instL ls) k := by
+  cases e <;> simp [liftN, instL, instL_liftN]
+
+theorem instL_instL {e : VExpr} : (e.instL ls).instL ls' = e.instL (ls.map (VLevel.inst ls')) := by
+  cases e <;> simp [instL, instL_instL, Function.comp_def, VLevel.inst_inst]
+
+def LevelWF (U : Nat) : VExpr → Prop
+  | .bvar _ => True
+  | .sort l => l.WF U
+  | .const _ ls => ∀ l ∈ ls, l.WF U
+  | .app e1 e2 | .lam e1 e2 | .forallE e1 e2 => e1.LevelWF U ∧ e2.LevelWF U
+
+theorem LevelWF.instL_id {e : VExpr} (h : e.LevelWF U) : e.instL (VLevel.params U) = e := by
+  induction e <;> simp_all [instL, LevelWF, VLevel.inst_id]
+  case const => exact List.map_id''' _ fun _ h1 => VLevel.inst_id (h _ h1)
+
+theorem levelWF_liftN : (liftN n e k).LevelWF U ↔ e.LevelWF U := by
+  induction e generalizing k <;> simp [liftN, LevelWF, *]
+
+theorem LevelWF.instL (h : ∀ l ∈ ls, l.WF U) : (instL ls e).LevelWF U := by
+  induction e <;> simp [VExpr.instL, VLevel.WF.inst h, LevelWF, *]
+
+alias ⟨LevelWF.liftN_rev, LevelWF.liftN⟩ := levelWF_liftN
+
+def instVar (i : Nat) (e : VExpr) (k := 0) : VExpr :=
+  if i < k then .bvar i else if i = k then liftN k e else .bvar (i - 1)
+
+@[simp] theorem instVar_zero : instVar 0 e = e := liftN_zero ..
+@[simp] theorem instVar_upper : instVar (i+1) e = .bvar i := rfl
+@[simp] theorem instVar_lower : instVar 0 e (k+1) = .bvar 0 := by simp [instVar]
+@[simp] theorem instVar_succ : instVar (i+1) e (k+1) = (instVar i e k).lift := by
+  simp [instVar, Nat.succ_lt_succ_iff]; split <;> simp [lift, liftN]
+  split <;> simp [liftN_liftN, liftN]
+  have := Nat.lt_of_le_of_ne (Nat.not_lt.1 ‹_›) (Ne.symm ‹_›)
+  let i+1 := i; rfl
+
+theorem liftN_instVar_lo (n : Nat) (e : VExpr) (j k : Nat) (hj : k ≤ j) :
+    liftN n (instVar i e j) k = instVar (liftVar n i k) e (n+j) := by
+  simp [instVar]; split <;> rename_i h
+  · rw [if_pos]; · rfl
+    simp only [liftVar]; split <;> rename_i hk
+    · exact Nat.lt_add_left _ h
+    · exact Nat.add_lt_add_left h _
+  split <;> rename_i h'
+  · subst i
+    rw [liftN'_liftN' (h1 := Nat.zero_le _) (h2 := hj), liftVar_le hj,
+      if_neg (by simp), if_pos rfl, Nat.add_comm]
+  · rw [Nat.not_lt] at h; rw [liftVar_le (Nat.le_trans hj h)]
+    have hk := Nat.lt_of_le_of_ne h (Ne.symm h')
+    let i+1 := i
+    have := Nat.add_lt_add_left hk n
+    rw [if_neg (Nat.lt_asymm this), if_neg (Nat.ne_of_gt this)]
+    simp only [liftN]
+    rw [liftVar_le (Nat.le_trans hj <| by exact Nat.le_of_lt_succ hk)]; rfl
+
+theorem liftN_instVar_hi (i : Nat) (e2 : VExpr) (n k j : Nat) :
+    liftN n (instVar i e2 j) (k+j) = instVar (liftVar n i (k+j+1)) (liftN n e2 k) j := by
+  simp [instVar]; split <;> rename_i h
+  · have := Nat.lt_add_left k h
+    rw [liftVar_lt <| Nat.lt_succ_of_lt this, if_pos h]
+    simp [liftN, liftVar_lt this]
+  split <;> rename_i h'
+  · subst i
+    have := Nat.le_add_left j k
+    simp [liftVar_lt (by exact Nat.lt_succ_of_le this)]
+    rw [liftN'_comm (h := Nat.zero_le _), Nat.add_comm]
+  · have hk := Nat.lt_of_le_of_ne (Nat.not_lt.1 h) (Ne.symm h')
+    let i+1 := i
+    simp [liftVar, Nat.succ_lt_succ_iff]; split <;> rename_i hi
+    · simp [liftN, liftVar_lt hi]
+    · have := Nat.lt_add_left n hk
+      rw [if_neg (Nat.lt_asymm this), if_neg (Nat.ne_of_gt this)]
+      simp [liftN]; rw [liftVar_le (Nat.not_lt.1 hi)]
+
+@[simp] theorem instL_instVar : (instVar i e k).instL ls = instVar i (e.instL ls) k := by
+  simp [instVar]; split <;> [skip; split] <;> simp [instL, instL_liftN]
+
+def inst : VExpr → VExpr → (k :_:= 0) → VExpr
+  | .bvar i, e, k => instVar i e k
+  | .sort u, _, _ => .sort u
+  | .const c us, _, _ => .const c us
+  | .app fn arg, e, k => .app (fn.inst e k) (arg.inst e k)
+  | .lam ty body, e, k => .lam (ty.inst e k) (body.inst e (k+1))
+  | .forallE ty body, e, k => .forallE (ty.inst e k) (body.inst e (k+1))
+
+theorem instL_appN (ls : List VLevel) (as : List VExpr) (f : VExpr) :
+    (appN f as).instL ls = appN (f.instL ls) (as.map (instL ls)) := by
+  induction as generalizing f with
+  | nil => rfl
+  | cons a as ih => simp [appN, instL, ih]
+
+theorem liftN_appN (n k : Nat) (f : VExpr) : ∀ (as : List VExpr),
+    (f.appN as).liftN n k = appN (f.liftN n k) (as.map (liftN n · k))
+  | [] => rfl
+  | a :: as => by
+    show (VExpr.appN (f.app a) as).liftN n k = _
+    rw [liftN_appN n k (f.app a) as]
+    rfl
+
+theorem instN_appN (a : VExpr) (k : Nat) (f : VExpr) : ∀ (as : List VExpr),
+    (f.appN as).inst a k = appN (f.inst a k) (as.map (·.inst a k))
+  | [] => rfl
+  | e :: as => by
+    show (VExpr.appN (f.app e) as).inst a k = _
+    rw [instN_appN a k (f.app e) as]
+    rfl
+
+@[simp] theorem inst_default : inst default e k = default := rfl
+
+theorem liftN_instN_lo (n : Nat) (e1 e2 : VExpr) (j k : Nat) (hj : k ≤ j) :
+    liftN n (e1.inst e2 j) k = (liftN n e1 k).inst e2 (n+j) := by
+  induction e1 generalizing k j with
+    simp [liftN, inst, instVar, Nat.add_le_add_iff_right, *]
+  | bvar i => apply liftN_instVar_lo (hj := hj)
+  | _ => rfl
+
+theorem liftN_instN_hi (e1 e2 : VExpr) (n k j : Nat) :
+    liftN n (e1.inst e2 j) (k+j) = (liftN n e1 (k+j+1)).inst (liftN n e2 k) j := by
+  induction e1 generalizing j with simp [liftN, inst, instVar, *]
+  | bvar i => apply liftN_instVar_hi
+  | _ => rename_i IH; apply IH
+
+theorem liftN_inst_hi (e1 e2 : VExpr) (n k : Nat) :
+    liftN n (e1.inst e2) k = (liftN n e1 (k+1)).inst (liftN n e2 k) := liftN_instN_hi ..
+
+theorem lift_instN_lo (e1 e2 : VExpr) : lift (e1.inst e2 k) = (lift e1).inst e2 (k + 1) :=
+  Nat.add_comm .. ▸ liftN_instN_lo (hj := Nat.zero_le _) ..
+
+theorem lift_inst_hi (e1 e2 : VExpr) : lift (e1.inst e2) = (liftN 1 e1 1).inst (lift e2) :=
+  liftN_instN_hi ..
+
+theorem inst_liftN (e1 e2 : VExpr) : (liftN 1 e1 k).inst e2 k = e1 := by
+  induction e1 generalizing k with simp [liftN, inst, *]
+  | bvar i =>
+    simp only [liftVar, instVar, Nat.add_comm 1]; split <;> [rfl; rename_i h]
+    rw [if_neg (mt (Nat.lt_of_le_of_lt (Nat.le_succ _)) h),
+      if_neg (mt (by rintro rfl; apply Nat.lt_succ_self) h)]; rfl
+
+theorem inst_liftN' (e1 e2 : VExpr) : (liftN (n+1) e1 k).inst e2 k = liftN n e1 k := by
+  rw [← liftN'_liftN_hi, inst_liftN]
+
+theorem inst_lift (e1 e2 : VExpr) : (lift e1).inst e2 = e1 := inst_liftN ..
+
+protected theorem LevelWF.inst
+    (h1 : e1.LevelWF U) (h2 : e2.LevelWF U) : (inst e1 e2 k).LevelWF U := by
+  induction e1 generalizing k <;> simp_all [inst, instVar, LevelWF]
+  case bvar => split <;> [trivial; split <;> [exact h2.liftN; trivial]]
+
+def unliftN (e : VExpr) (n k : Nat) : VExpr :=
+  match n with
+  | 0 => e
+  | n+1 => unliftN (e.inst default k) n k
+
+@[simp] theorem unliftN_liftN : unliftN (liftN n e k) n k = e := by
+  induction n <;> simp [unliftN, inst_liftN', *]
+
+theorem unliftN_add : unliftN e (n1+n2) k = unliftN (unliftN e n1 k) n2 k := by
+  induction n1 generalizing e <;> simp [unliftN, Nat.succ_add, *]
+
+theorem unliftN_succ' : unliftN e (n+1) k = (unliftN e n k).inst default k := by
+  rw [unliftN_add]; rfl
+
+theorem liftN_unliftN_hi (h : k2 ≤ k1) :
+    liftN n1 (unliftN e n2 k2) k1 = unliftN (liftN n1 e (k1+n2)) n2 k2 := by
+  obtain ⟨k1, rfl⟩ := Nat.le_iff_exists_add'.1 h
+  induction n2 generalizing e with simp [unliftN]
+  | succ n2 ih =>
+    rw [ih, Nat.add_right_comm, liftN_instN_hi e default n1 (k1+n2) k2,
+      Nat.add_right_comm k1]; rfl
+
+def Skips (e : VExpr) (n k : Nat) : Prop := liftN n (unliftN e n k) k = e
+
+protected theorem Skips.liftN : Skips (liftN n e k) n k := by simp [Skips]
+
+theorem skips_iff_exists : Skips e n k ↔ ∃ e', e = liftN n e' k :=
+  ⟨fun h => ⟨_, h.symm⟩, fun ⟨_, h⟩ => h ▸ .liftN⟩
+
+theorem Skips.zero : Skips e 0 k := by simp [Skips, unliftN]
+
+theorem liftN_inj : liftN n e1 k = liftN n e2 k ↔ e1 = e2 :=
+  ⟨fun H => by rw [← unliftN_liftN (e := e1), H, unliftN_liftN], (· ▸ rfl)⟩
+
+theorem liftVar_inj : liftVar n i k = liftVar n i' k ↔ i = i' := by
+  simpa [liftN] using @liftN_inj n (.bvar i) k (.bvar i')
+
+theorem Skips.of_liftN_hi (self : (liftN n1 e k1).Skips n2 k2) (h : n2 + k2 ≤ k1) :
+    e.Skips n2 k2 := by
+  obtain ⟨k1, rfl⟩ := Nat.le_iff_exists_add'.1 h
+  rwa [Skips, Nat.add_comm n2, ← Nat.add_assoc, ← liftN_unliftN_hi (Nat.le_add_left ..),
+    liftN'_comm (h := Nat.le_add_left ..), Nat.add_comm, liftN_inj] at self
+
+theorem skips_add : Skips e (n1+n2) k ↔ ∃ e', Skips e' n1 k ∧ e = liftN n2 e' k := by
+  simp [skips_iff_exists, ← liftN'_liftN_hi]
+  exact ⟨fun ⟨_, h⟩ => ⟨_, ⟨_, rfl⟩, h⟩, fun ⟨_, ⟨_, rfl⟩, h⟩ => ⟨_, h⟩⟩
+
+def Skips' (n : Nat) : VExpr → (k :_:= 0) → Prop
+  | .bvar i, k => i < k + n → i < k
+  | .sort .., _ | .const .., _ => True
+  | .app fn arg, k => fn.Skips' n k ∧ arg.Skips' n k
+  | .lam ty body, k => ty.Skips' n k ∧ body.Skips' n (k+1)
+  | .forallE ty body, k => ty.Skips' n k ∧ body.Skips' n (k+1)
+
+theorem skips_iff : Skips e n k ↔ Skips' n e k := by
+  induction n generalizing e with
+  | zero => simp [Skips, unliftN]; induction e generalizing k <;> simp [Skips', *]
+  | succ n ih =>
+    simp [skips_add, ih]; clear ih
+    induction e generalizing k with
+    | bvar i =>
+      refine ⟨fun ⟨e', h1, h2⟩ => ?_, fun h => ?_⟩
+      · cases e' <;> cases h2; simp [Skips', liftVar]; split
+        · intro; assumption
+        · next h2 =>
+          rw [Nat.add_comm, ← Nat.add_assoc, Nat.succ_lt_succ_iff]
+          exact fun h => h2.elim (h1 h)
+      · simp [Skips'] at h
+        if h' : i < k + n + 1 then
+          exact ⟨.bvar i, fun _ => h h', by simp [liftN, liftVar, h h']⟩
+        else
+          have := Nat.not_lt.1 h'
+          let i+1 := i; rw [Nat.add_lt_add_iff_right] at h'
+          have := mt (Nat.lt_of_lt_of_le · (Nat.le_add_right ..)) h'
+          exact ⟨.bvar i, h'.elim, by simp [liftN, liftVar]; rw [if_neg this, Nat.add_comm]⟩
+    | sort u =>
+      refine ⟨fun ⟨e', h1, h2⟩ => ?_, fun _ => ⟨.sort u, by simp [Skips', liftN]⟩⟩
+      cases e' <;> cases h2; simp [Skips']
+    | const c ls =>
+      refine ⟨fun ⟨e', h1, h2⟩ => ?_, fun _ => ⟨.const c ls, by simp [Skips', liftN]⟩⟩
+      cases e' <;> cases h2; simp [Skips']
+    | app f a fIH aIH =>
+      simp [Skips', ← fIH, ← aIH]; refine ⟨fun ⟨e', h1, h2⟩ => ?_, ?_⟩
+      · cases e' <;> cases h2; exact ⟨⟨_, h1.1, rfl⟩, ⟨_, h1.2, rfl⟩⟩
+      · rintro ⟨⟨e1, h1, rfl⟩, ⟨e2, h2, rfl⟩⟩; exact ⟨.app .., ⟨h1, h2⟩, rfl⟩
+    | forallE f a fIH aIH =>
+      simp [Skips', ← fIH, ← aIH]; refine ⟨fun ⟨e', h1, h2⟩ => ?_, ?_⟩
+      · cases e' <;> cases h2; exact ⟨⟨_, h1.1, rfl⟩, ⟨_, h1.2, rfl⟩⟩
+      · rintro ⟨⟨e1, h1, rfl⟩, ⟨e2, h2, rfl⟩⟩; exact ⟨.forallE .., ⟨h1, h2⟩, rfl⟩
+    | lam f a fIH aIH =>
+      simp [Skips', ← fIH, ← aIH]; refine ⟨fun ⟨e', h1, h2⟩ => ?_, ?_⟩
+      · cases e' <;> cases h2; exact ⟨⟨_, h1.1, rfl⟩, ⟨_, h1.2, rfl⟩⟩
+      · rintro ⟨⟨e1, h1, rfl⟩, ⟨e2, h2, rfl⟩⟩; exact ⟨.lam .., ⟨h1, h2⟩, rfl⟩
+
+theorem of_liftN_eq_liftN (h : liftN n1 e1 (k1+n2+k2) = liftN n2 e2 k2) :
+    ∃ e', e1 = liftN n2 e' k2 ∧ e2 = liftN n1 e' (k1+k2) := by
+  have : (liftN n1 e1 (k1+n2+k2)).Skips n2 k2 := h ▸ .liftN
+  obtain ⟨e', rfl⟩ := skips_iff_exists.1 <|
+    this.of_liftN_hi (Nat.add_assoc .. ▸ Nat.le_add_left ..)
+  refine ⟨e', rfl, ?_⟩
+  rw [← liftN_inj, ← h, liftN'_comm (n1 := n1) (h := Nat.le_add_left ..),
+    Nat.add_left_comm, Nat.add_assoc]
+
+@[simp] theorem instL_instN {e1 e2 : VExpr} :
+    (e1.inst e2 k).instL ls = (e1.instL ls).inst (e2.instL ls) k := by
+  induction e1 generalizing k <;> simp [instL, inst, *]
+
+theorem instL_unliftN : instL ls (unliftN e n k) = unliftN (instL ls e) n k := by
+  induction n generalizing e with simp [unliftN]
+  | succ _ ih => rw [ih, instL_instN]; rfl
+
+theorem Skips.of_instL (self : (instL ls e).Skips n k) : e.Skips n k := by
+  rw [skips_iff] at self ⊢
+  induction e generalizing k <;> simp_all [Skips', instL]
+
+theorem of_liftN_eq_instL (h : liftN n e1 k = instL ls e2) :
+    ∃ e', e1 = instL ls e' ∧ e2 = liftN n e' k := by
+  have : (instL ls e2).Skips n k := h ▸ .liftN
+  obtain ⟨e', rfl⟩ := skips_iff_exists.1 this.of_instL
+  refine ⟨e', ?_, rfl⟩
+  rw [← liftN_inj, h, instL_liftN]
+
+theorem ClosedN.instN_eq (self : ClosedN e1 k) (h : k ≤ j) : e1.inst e2 j = e1 := by
+  conv => lhs; rw [← self.liftN_eq (n := 1) h]
+  rw [inst_liftN]
+
+theorem ClosedN.instN (h1 : ClosedN e (k+j+1)) (h2 : ClosedN e2 k) : ClosedN (e.inst e2 j) (k+j) :=
+  match e, h1 with
+  | .bvar i, h => by
+    simp [inst, instVar]; split <;> rename_i h1
+    · exact Nat.lt_of_lt_of_le h1 (Nat.le_add_left ..)
+    split <;> rename_i h1'
+    · exact h2.liftN
+    · have hk := Nat.lt_of_le_of_ne (Nat.not_lt.1 h1) (Ne.symm h1')
+      let i+1 := i
+      exact Nat.lt_of_succ_lt_succ h
+  | .sort .., h | .const .., h => h
+  | .app .., h => ⟨h.1.instN h2, h.2.instN h2⟩
+  | .lam .., h | .forallE .., h => ⟨h.1.instN h2, h.2.instN (j := j+1) h2⟩
+
+theorem ClosedN.inst (h1 : ClosedN e (k+1)) (h2 : ClosedN e2 k) : ClosedN (e.inst e2) k :=
+  h1.instN (j := 0) h2
+
+theorem inst_instVar_hi (i : Nat) (e2 e3 : VExpr) (k j : Nat) :
+    inst (instVar i e2 k) e3 (j+k) = (instVar i e3 (j+k+1)).inst (e2.inst e3 j) k := by
+  simp [instVar]; split <;> rename_i h
+  · simp [Nat.lt_succ_of_lt, inst, instVar, h, Nat.lt_of_lt_of_le h (Nat.le_add_left k j)]
+  split <;> rename_i h'
+  · subst i
+    simp [Nat.lt_succ_of_le, Nat.le_add_left, inst, instVar]
+    rw [liftN_instN_lo k e2 e3 j _ (Nat.zero_le _), Nat.add_comm]
+  · have hk := Nat.lt_of_le_of_ne (Nat.not_lt.1 h) (Ne.symm h')
+    let i+1 := i
+    simp [inst, instVar]; split <;> rename_i hi
+    · simp [inst, instVar, h, h']
+    split <;> rename_i hi'
+    · subst i
+      suffices liftN (j+k+1) .. = _ by rw [this]; exact (inst_liftN ..).symm
+      exact (liftN'_liftN' (Nat.zero_le _) (Nat.le_add_left k j)).symm
+    · have hk := Nat.lt_of_le_of_ne (Nat.not_lt.1 hi) (Ne.symm hi')
+      let i+1 := i
+      simp [inst, instVar]
+      have := Nat.lt_of_le_of_lt (Nat.le_add_left ..) hk
+      rw [if_neg (Nat.lt_asymm this), if_neg (Nat.ne_of_gt this)]
+
+theorem inst_inst_hi (e1 e2 e3 : VExpr) (k j : Nat) :
+    inst (e1.inst e2 k) e3 (j+k) = (e1.inst e3 (j+k+1)).inst (e2.inst e3 j) k := by
+  induction e1 generalizing k with simp [inst, instVar, *]
+  | bvar i => apply inst_instVar_hi
+  | _ => rename_i IH; apply IH
+
+theorem inst0_inst_hi (e1 e2 e3 : VExpr) (j : Nat) :
+    inst (e1.inst e2) e3 j = (e1.inst e3 (j+1)).inst (e2.inst e3 j) := inst_inst_hi ..
+
+theorem inst_instVar_lo (i : Nat) (e2 e3 : VExpr) (k j : Nat) :
+    inst (instVar i e2 (k+j+1)) e3 j =
+    (instVar i (e3.liftN 1 k) j).inst e2 (k+j) := by
+  simp [instVar]; split <;> rename_i h
+  · split <;> rename_i h1
+    · simp only [inst, instVar, h1, reduceIte]
+      rw [if_pos (Nat.lt_of_lt_of_le h1 (Nat.le_add_left ..))]
+    split <;> rename_i h1'
+    · subst i
+      simp [inst, instVar]; rw [liftN'_comm (h := Nat.zero_le _), Nat.add_comm]
+      exact (inst_liftN ..).symm
+    · have hj := Nat.lt_of_le_of_ne (Nat.not_lt.1 h1) (Ne.symm h1')
+      let i+1 := i
+      simp [inst, instVar, h1, h1', Nat.lt_of_succ_lt_succ h]
+  split <;> rename_i h'
+  · subst i
+    have := Nat.lt_succ_of_le (Nat.le_add_left j k)
+    rw [if_neg (Nat.lt_asymm this), if_neg (Nat.ne_of_gt this)]
+    simp [inst, instVar]
+    suffices liftN (k+j+1) .. = _ by rw [this]; exact inst_liftN ..
+    exact (liftN'_liftN' (Nat.zero_le _) (Nat.le_add_left j k)).symm
+  · have hk := Nat.lt_of_le_of_ne (Nat.not_lt.1 h) (Ne.symm h')
+    let i+1 := i
+    have hk := Nat.lt_of_add_lt_add_right hk
+    simp [inst, instVar]
+    have := Nat.lt_of_le_of_lt (Nat.le_add_left ..) hk
+    rw [if_neg (Nat.lt_asymm this), if_neg (Nat.ne_of_gt this)]
+    have := Nat.lt_succ_of_lt this
+    rw [if_neg (Nat.lt_asymm this), if_neg (Nat.ne_of_gt this)]
+    simp [inst, instVar]
+    rw [if_neg (Nat.lt_asymm hk), if_neg (Nat.ne_of_gt hk)]
+
+theorem inst_inst_lo (e1 e2 e3 : VExpr) (k j : Nat) :
+    inst (e1.inst e2 (k+j+1)) e3 j =
+    (e1.inst (e3.liftN 1 k) j).inst e2 (k+j) := by
+  induction e1 generalizing j with simp [inst, instVar, *]
+  | bvar i => apply inst_instVar_lo
+  | _ => rename_i IH; exact IH (j+1)
+
+theorem instN_bvar0 (e : VExpr) (k : Nat) :
+    inst (e.liftN 1 (k+1)) (.bvar 0) k = e := by
+  induction e generalizing k with simp [liftN, inst, *]
+  | bvar i => induction i generalizing k <;> cases k <;> simp [*, lift, liftN]
+
+end VExpr
+
+inductive Lift : Type where
+  | refl : Lift
+  | skip : Lift → Lift
+  | cons : Lift → Lift
+
+namespace Lift
+
+@[simp] def skipN (l : Lift) : Nat → Lift
+  | 0   => l
+  | n+1 => .skip (skipN l n)
+
+theorem skipN_one : skipN l 1 = .skip l := rfl
+
+theorem skipN_skipN : skipN (skipN l n) k = skipN l (n + k) := by induction k <;> simp [*]
+
+@[simp] def consN (l : Lift) : Nat → Lift
+  | 0  => l
+  | k+1 => .cons (consN l k)
+
+theorem consN_consN : consN (.consN l a) b = .consN l (a + b) := by
+  induction b <;> simp [*]
+
+@[simp] def comp (l₁ l₂ : Lift) : Lift :=
+  match l₂, l₁ with
+  | .refl,    l₁       => l₁
+  | .skip l₂, l₁       => .skip (l₁.comp l₂)
+  | .cons l₂, .refl    => .cons l₂
+  | .cons l₂, .skip l₁ => .skip (l₁.comp l₂)
+  | .cons l₂, .cons l₁ => .cons (l₁.comp l₂)
+
+@[simp] theorem refl_comp : comp refl l = l := by induction l <;> simp [*]
+
+theorem consN_comp : consN (.comp l₁ l₂) n = .comp (.consN l₁ n) (.consN l₂ n) := by
+  induction n <;> simp [*]
+
+@[simp] def dom : Lift → Nat
+  | .refl   => 0
+  | .skip l => l.dom
+  | .cons l => l.dom + 1
+
+@[simp] def size : Lift → Nat
+  | .refl   => 0
+  | .skip l => l.size + 1
+  | .cons l => l.size + 1
+
+@[simp] def depth : Lift → Nat
+  | .refl   => 0
+  | .skip l => l.depth + 1
+  | .cons l => l.depth
+
+theorem dom_add_depth : dom l + depth l = size l := by induction l <;> simp! <;> omega
+
+theorem depth_comp : depth (.comp l₁ l₂) = l₁.depth + l₂.depth :=
+  match l₂, l₁ with
+  | .refl,    _        => rfl
+  | .skip _,  _        => congrArg Nat.succ depth_comp
+  | .cons _,  .refl    => (Nat.zero_add _).symm
+  | .cons _,  .skip _  => (congrArg Nat.succ depth_comp).trans (Nat.succ_add ..).symm
+  | .cons l₂, .cons l₁ => @depth_comp l₁ l₂
+
+@[simp] theorem depth_consN : depth (.consN l n) = l.depth := by induction n <;> simp [*]
+
+@[simp] theorem depth_skipN : depth (.skipN l n) = l.depth + n := by
+  induction n <;> simp [Nat.add_assoc, *]
+
+theorem consN_skip_eq : consN (skip l) k = comp (consN l k) (consN (skip refl) k) := by
+  rw [← consN_comp]; rfl
+
+theorem depth_succ (H : l.depth = n + 1) :
+    ∃ l' k, depth l' = n ∧ l = consN (.skip l') k := by
+  match l with
+  | .skip l => cases H; exact ⟨l, 0, rfl, rfl⟩
+  | .cons l =>
+    obtain ⟨l, k, rfl, ⟨⟩⟩ := depth_succ (l := l) H
+    exact ⟨l, k+1, rfl, rfl⟩
+
+theorem depth_succ' (H : l.depth = n + 1) :
+    ∃ l' k, depth l' = n ∧ l = comp l' (.consN (.skip refl) k) := by
+  let ⟨l', k, h1, h2⟩ := depth_succ H
+  exact ⟨.consN l' k, k, by simp [h1], by rwa [← consN_skip_eq]⟩
+
+theorem comp_skipN : comp l₁ (skipN l₂ k) = skipN (comp l₁ l₂) k := by
+  induction k <;> simp [*]
+
+theorem skipN_comp_consN : comp (skipN l₁ k) (consN l₂ k) = skipN (comp l₁ l₂) k := by
+  induction k <;> simp [*]
+
+@[simp] protected def liftVar : Lift → Nat → Nat
+  | .refl, n => n
+  | .skip l, n => l.liftVar n + 1
+  | .cons _, 0 => 0
+  | .cons l, n+1 => l.liftVar n + 1
+
+theorem liftVar_comp : (comp l₁ l₂).liftVar n = l₂.liftVar (l₁.liftVar n) := by
+  induction l₂ generalizing l₁ n <;> [skip; skip; cases l₁ <;> [skip; skip; cases n]] <;> simp [*]
+
+theorem liftVar_skipN : (skipN l n).liftVar i = l.liftVar i + n := by
+  induction n generalizing i with
+  | zero => rfl
+  | succ _ ih => simp [ih]; rfl
+
+theorem liftVar_consN_skipN : (consN (skipN refl n) k).liftVar i = liftVar n i k := by
+  induction k generalizing i with
+  | zero => simp [liftVar_skipN]
+  | succ k ih =>
+    cases i with simp [liftVar, Nat.succ_lt_succ_iff, ih]
+    | succ i => split <;> rfl
+
+theorem liftVar_depth_zero (H : depth l = 0) : l.liftVar n = n := by
+  induction l generalizing n <;> [skip; skip; cases n] <;> simp_all [depth]
+
+theorem le_liftVar {l : Lift} : n ≤ l.liftVar n := by
+  induction l generalizing n <;> [skip; skip; cases n] <;> simp_all; grind
+
+def inter : Lift → Lift → Lift
+  | refl, l | l, refl => l
+  | skip l₁, skip l₂ | skip l₁, cons l₂ | cons l₁, skip l₂ => skip (l₁.inter l₂)
+  | cons l₁, cons l₂ => cons (l₁.inter l₂)
+
+theorem inter_self : inter l l = l := by induction l <;> simp! [*]
+
+theorem inter_comm : inter l₁ l₂ = inter l₂ l₁ := by
+  induction l₁ generalizing l₂ <;> cases l₂ <;> simp! [*]
+
+theorem inter_assoc : inter (inter l₁ l₂) l₃ = inter l₁ (inter l₂ l₃) := by
+  induction l₁ generalizing l₂ l₃ <;> cases l₂ <;> cases l₃ <;> simp! [*]
+
+@[simp] def diff : Lift → Lift → Lift
+  | refl, _ => refl
+  | l, refl => l
+  | skip l₁, skip l₂ | cons l₁, skip l₂ => diff l₁ l₂
+  | skip l₁, cons l₂ => skip (diff l₁ l₂)
+  | cons l₁, cons l₂ => cons (l₁.diff l₂)
+
+@[simp] theorem diff_refl : diff l refl = l := by cases l <;> simp!
+
+theorem diff_comp : comp (diff l₁ l₂) l₂ = inter l₁ l₂ := by
+  induction l₁ generalizing l₂ <;> cases l₂ <;> simp! [*]
+
+def Fixes : Nat → Lift → Prop
+  | 0,   _       => True
+  | _,   .refl   => True
+  | _+1, .skip _ => False
+  | n+1, .cons l => Fixes n l
+
+theorem Fixes.zero : Fixes 0 ρ := by simp [Fixes]
+
+theorem Fixes.liftVar_eq {ρ : Lift} (H : ρ.Fixes k) (h2 : i < k) : ρ.liftVar i = i := by
+  induction ρ generalizing i k with
+  | refl => rfl
+  | skip => let k+1 := k; cases H
+  | cons ρ ih =>
+    let k+1 := k
+    cases i with
+    | zero => rfl
+    | succ k => exact congrArg Nat.succ <| ih H (Nat.lt_of_succ_lt_succ h2)
+
+end Lift
+
+namespace VExpr
+
+@[simp] def lift' : VExpr → Lift → VExpr
+  | .bvar i, k => .bvar (k.liftVar i)
+  | .sort u, _ => .sort u
+  | .const c us, _ => .const c us
+  | .app fn arg, k => .app (fn.lift' k) (arg.lift' k)
+  | .lam ty body, k => .lam (ty.lift' k) (body.lift' k.cons)
+  | .forallE ty body, k => .forallE (ty.lift' k) (body.lift' k.cons)
+
+theorem lift'_consN_skipN : e.lift' (.consN (.skipN .refl n) k) = liftN n e k := Eq.symm <| by
+  induction e generalizing k <;> simp [liftN, Lift.liftVar_consN_skipN, *]
+
+theorem lift'_comp {e : VExpr} : e.lift' (.comp l₁ l₂) = (e.lift' l₁).lift' l₂ := Eq.symm <| by
+  induction e generalizing l₁ l₂ <;> simp [Lift.liftVar_comp, *]
+
+theorem lift'_depth_zero {e : VExpr} (H : l.depth = 0) : e.lift' l = e := by
+  induction e generalizing l <;> simp_all [Lift.liftVar_depth_zero]
+
+@[simp] theorem lift'_refl {e : VExpr} : e.lift' .refl = e := lift'_depth_zero rfl
+
+theorem lift_eq_lift' {e : VExpr} : e.lift = e.lift' (.skip .refl) := by
+  rw [lift, ← lift'_consN_skipN]; rfl
+
+@[simp] theorem instL_lift' : (lift' e ρ).instL ls = lift' (e.instL ls) ρ := by
+  cases e <;> simp [lift', instL, instL_lift']
+
+theorem ClosedN.lift'_eq (self : ClosedN e k) (h : ρ.Fixes k) : lift' e ρ = e := by
+  induction e generalizing k ρ with (simp [ClosedN] at self; simp [*])
+  | bvar i => exact h.liftVar_eq self
+  | app _ _ ih1 ih2 => exact ⟨ih1 self.1 h, ih2 self.2 h⟩
+  | lam _ _ ih1 ih2 | forallE _ _ ih1 ih2 => exact ⟨ih1 self.1 h, ih2 self.2 h⟩
+
+def Subst := Nat → VExpr
+
+def Subst.Depth (σ : Subst) (n n' : Nat) := ∀ i, σ (i + n') = .bvar (i + n)
+
+def Subst.lift (σ : Subst) : Subst
+  | 0 => .bvar 0
+  | i+1 => (σ i).lift
+
+def Subst.liftN (σ : Subst) : Nat → Subst
+  | 0 => σ
+  | k+1 => (σ.liftN k).lift
+
+def subst : VExpr → Subst → VExpr
+  | .bvar i, σ => σ i
+  | .sort u, _ => .sort u
+  | .const c us, _ => .const c us
+  | .app fn arg, σ => .app (fn.subst σ) (arg.subst σ)
+  | .lam ty body, σ => .lam (ty.subst σ) (body.subst σ.lift)
+  | .forallE ty body, σ => .forallE (ty.subst σ) (body.subst σ.lift)
+
+def Subst.lift_r (σ : Subst) (ρ : Lift) : Subst := fun x => (σ x).lift' ρ
+def Subst.lift_l (ρ : Lift) (σ : Subst) : Subst := fun x => σ (ρ.liftVar x)
+
+theorem Subst.lift_l_lift {σ : Subst} {ρ} : (σ.lift_l ρ).lift = σ.lift.lift_l ρ.cons := by
+  funext i; cases i <;> simp! [lift_l]
+
+theorem Subst.lift_r_lift {σ : Subst} {ρ} : (σ.lift_r ρ).lift = σ.lift.lift_r ρ.cons := by
+  funext i; cases i <;> simp! [lift, lift_r, ← lift'_comp, lift_eq_lift']
+
+theorem subst_lift' {e : VExpr} : (e.lift' ρ).subst σ = subst e (.lift_l ρ σ) := by
+  induction e generalizing ρ σ <;> simp! [*, Subst.lift_l_lift]; rfl
+
+theorem lift'_subst {e : VExpr} : (e.subst σ).lift' ρ = subst e (.lift_r σ ρ) := by
+  induction e generalizing ρ σ <;> simp! [*, Subst.lift_r, Subst.lift_r_lift]
+
+def Subst.id : Subst := .bvar
+def Subst.head (σ : Subst) : VExpr := σ 0
+def Subst.tail (σ : Subst) : Subst := fun n => σ (n+1)
+
+theorem Subst.Depth.id : Subst.id.Depth 0 0 := fun _ => rfl
+
+@[simp] theorem id_lift : Subst.id.lift = Subst.id := by
+  funext i; cases i <;> simp [Subst.id, Subst.lift, liftN]
+
+@[simp] theorem subst_id {e : VExpr} : e.subst .id = e := by
+  induction e <;> simp! [*, id_lift]; rfl
+
+def Subst.cons (σ : Subst) (e : VExpr) : Subst
+  | 0 => e
+  | i+1 => σ i
+
+abbrev Subst.one (e : VExpr) : Subst := .cons .id e
+
+theorem Subst.Depth.one : (Subst.one e).Depth 0 1 := .id
+
+def _root_.Ix.Theory.Named.Lift.inv : Lift → Subst
+  | .refl => .id
+  | .skip ρ => ρ.inv.cons default
+  | .cons ρ => ρ.inv.lift
+
+theorem lift_l_inv {ρ : Lift} : .lift_l ρ ρ.inv = Subst.id := by
+  funext i; simp [Subst.lift_l, Subst.id]
+  induction ρ generalizing i with
+  | refl => rfl
+  | skip ρ ih => simp [Lift.inv, Subst.cons, ih]
+  | cons ρ ih => cases i <;> simp [Lift.inv, Subst.lift, ih, lift_eq_lift']
+
+theorem lift'_inj {e e' : VExpr} {ρ : Lift} : e.lift' ρ = e'.lift' ρ ↔ e = e' :=
+  ⟨(by simpa [subst_lift', lift_l_inv] using congrArg (·.subst ρ.inv) ·), (· ▸ rfl)⟩
+
+theorem instN_eq (e a : VExpr) : e.inst a k = e.subst (.liftN (.one a) k) := by
+  induction e generalizing k with simp_all [inst, subst, Subst.liftN] | bvar i
+  induction k generalizing i <;> cases i <;> simp [Subst.liftN, Subst.lift, Subst.cons, Subst.id, *]
+
+theorem inst_eq (e a : VExpr) : e.inst a = e.subst (.one a) := instN_eq ..
+
+def Subst.trunc (σ : Subst) (n n' : Nat) : Subst :=
+  fun i => if n' ≤ i then .bvar (i - n' + n) else σ i
+
+theorem Subst.lift_r_comm (σ : Subst) (ρ : Lift) (H : Subst.Depth σ 0 n) :
+    σ.lift_r ρ = .lift_l (ρ.consN n) ((σ.lift_r ρ).trunc 0 n) := by
+  funext i; simp [Subst.lift_l, Subst.lift_r, Subst.trunc]
+  have : (ρ.consN n).liftVar i = if n ≤ i then ρ.liftVar (i-n) + n else i := by
+    clear H; induction n generalizing i <;> [skip; cases i] <;> simp! [*]; split <;> rfl
+  rw [this]; split <;> simp
+  have := H (i - n); rw [Nat.sub_add_cancel ‹_›] at this; simp [this]
+
+theorem lift_r_one (e : VExpr) (ρ : Lift) :
+    (Subst.one e).lift_r ρ = .lift_l ρ.cons (Subst.one (e.lift' ρ)) := by
+  refine (Subst.lift_r_comm (Subst.one e) ρ .one).trans ?_; congr 1
+  funext i; simp [Subst.trunc]
+  cases i <;> simp [Subst.one, Subst.cons, Subst.lift_r, Subst.id]
+
+theorem lift'_inst_hi (e1 e2 : VExpr) (ρ : Lift) :
+    lift' (e1.inst e2) ρ = (lift' e1 ρ.cons).inst (lift' e2 ρ) := by
+  simp [subst_lift', lift'_subst, lift_r_one, inst_eq]
diff --git a/Ix/Theory/Named/VLevel.lean b/Ix/Theory/Named/VLevel.lean
new file mode 100644
index 000000000..e2c9b26bf
--- /dev/null
+++ b/Ix/Theory/Named/VLevel.lean
@@ -0,0 +1,99 @@
+/-
+Adapted for Ix: shared universe semantics and additional proof support.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.VLevel
+import Ix.Theory.Named.Std.Basic
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+export Lean (Name)
+end Ix.Theory.Named
+
+namespace Ix.Theory.VLevel
+open Ix.Theory.Named
+
+theorem le_trans {a b c : VLevel} (h1 : a ≤ b) (h2 : b ≤ c) : a ≤ c :=
+  fun _ => Nat.le_trans (h1 _) (h2 _)
+
+theorem zero_le : zero ≤ a := fun _ => Nat.zero_le _
+
+theorem le_succ : a ≤ succ a := fun _ => Nat.le_succ _
+
+theorem succ_le_succ (h : a ≤ b) : succ a ≤ succ b := fun _ => Nat.succ_le_succ (h _)
+
+theorem le_max_left : a ≤ max a b := fun _ => Nat.le_max_left ..
+theorem le_max_right : b ≤ max a b := fun _ => Nat.le_max_right ..
+
+theorem equiv_def' {a b : VLevel} : a ≈ b ↔ a.eval = b.eval := .rfl
+theorem equiv_congr_left {a b c : VLevel} (h : a ≈ b) : a ≈ c ↔ b ≈ c :=
+  iff_of_eq (congrArg (· = _) h)
+
+theorem equiv_congr_right {a b c : VLevel} (h : a ≈ b) : c ≈ a ↔ c ≈ b :=
+  iff_of_eq (congrArg (_ = ·) h)
+
+theorem succ_congr_iff {a b : VLevel} : succ a ≈ succ b ↔ a ≈ b := by
+  simp [equiv_def, eval]
+
+theorem max_congr (h₁ : a₁ ≈ b₁) (h₂ : a₂ ≈ b₂) : max a₁ a₂ ≈ max b₁ b₂ := by
+  simp_all [equiv_def, eval]
+
+theorem max_comm : max a b ≈ max b a := by simp [equiv_def, eval, Nat.max_comm]
+
+theorem LE.max_eq_left (h : b.LE a) : max a b ≈ a := by
+  simp [equiv_def, eval, Nat.max_eq_left (h _)]
+
+theorem LE.max_eq_right (h : a.LE b) : max a b ≈ b := by
+  simp [equiv_def, eval, Nat.max_eq_right (h _)]
+
+theorem max_self : max a a ≈ a := by simp [equiv_def, eval]
+
+theorem zero_imax : imax zero a ≈ a := by
+  simp [equiv_def, eval, natIMax, eq_comm (b := 0)]
+
+theorem imax_zero : imax a zero ≈ zero := by simp [equiv_def, eval, natIMax]
+
+theorem imax_eq_zero : imax a b ≈ zero ↔ b ≈ zero := by
+  simp [equiv_def, eval, natIMax]
+  refine ⟨fun H ls => ?_, fun H ls hn => nomatch hn (H ls)⟩
+  exact Decidable.byContradiction fun h => h (H ls h).2
+
+def IsNeverZero (a : VLevel) : Prop := ∀ ls, a.eval ls ≠ 0
+
+theorem IsNeverZero.imax_eq_max (h : IsNeverZero b) : imax a b ≈ max a b := by
+  simp_all [equiv_def, eval, natIMax, IsNeverZero]
+
+theorem id_WF : ∀ l ∈ (List.range u).map param, l.WF u := by simp [WF]
+
+variable (ls : List Name) in
+def ofLevel : Lean.Level → Option VLevel
+  | .zero => return .zero
+  | .succ l => return .succ (← ofLevel l)
+  | .max l₁ l₂ => return .max (← ofLevel l₁) (← ofLevel l₂)
+  | .imax l₁ l₂ => return .imax (← ofLevel l₁) (← ofLevel l₂)
+  | .param n =>
+    let i := ls.idxOf n
+    if i < ls.length then some (.param i) else none
+  | .mvar _ => none
+
+theorem WF.of_ofLevel (h : ofLevel ls l = some l') : l'.WF ls.length := by
+  induction l generalizing l' with simp [ofLevel, bind] at h
+  | zero => cases h; trivial
+  | succ _ ih => obtain ⟨l', h, ⟨⟩⟩ := h; exact @ih l' h
+  | max _ _ ih1 ih2 | imax _ _ ih1 ih2 => obtain ⟨_, h1, _, h2, ⟨⟩⟩ := h; exact ⟨ih1 h1, ih2 h2⟩
+  | param n => exact h.2 ▸ h.1
+
+theorem WF.of_mapM_ofLevel (h : List.mapM (VLevel.ofLevel Us) us = some us')
+    (a) (hl : a ∈ us') : VLevel.WF Us.length a := by
+  rw [List.mapM_eq_some] at h
+  have ⟨_, _, h⟩ := h.forall_exists_r _ hl; exact .of_ofLevel h
+
+end Ix.Theory.VLevel
+
+/-- The internal universe operation agrees definitionally with Lean's
+natural-number operation used by the reference implementation proofs. -/
+@[simp] theorem Ix.Theory.VLevel.natIMax_eq_core (a b : Nat) :
+    Ix.Theory.VLevel.natIMax a b = Lean.Nat.imax a b := rfl
diff --git a/Ix/Theory/Named/Verify/Axioms.lean b/Ix/Theory/Named/Verify/Axioms.lean
new file mode 100644
index 000000000..7638841fc
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Axioms.lean
@@ -0,0 +1,516 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Batteries.Tactic.OpenPrivate
+import Ix.Theory.Named.Std.Basic
+import Ix.Theory.Named.Std.NodupKeys
+
+namespace Std.TreeMap
+
+variable {α : Type u} {β : Type v} {cmp : α → α → Ordering} {t : TreeMap α β cmp}
+
+/-- https://github.com/leanprover/lean4/issues/12798 -/
+axiom all_eq_all_toList {p : α → β → Bool} :
+    t.all p = t.toList.all fun a => p a.1 a.2
+
+/-- https://github.com/leanprover/lean4/issues/12798 -/
+axiom any_eq_any_toList {p : α → β → Bool} :
+    t.any p = t.toList.any fun a => p a.1 a.2
+
+end Std.TreeMap
+
+open scoped _root_.List
+namespace Lean
+
+noncomputable def PersistentArrayNode.toList' : PersistentArrayNode α → List α :=
+  PersistentArrayNode.rec
+    (motive_1 := fun _ => List α) (motive_2 := fun _ => List α) (motive_3 := fun _ => List α)
+    (node := fun _ => id) (leaf := (·.toList)) (fun _ => id) [] (fun _ _ a b => a ++ b)
+
+namespace PersistentArray
+
+inductive WF : PersistentArray α → Prop where
+  | empty : WF .empty
+  | push : WF arr → WF (arr.push x)
+
+noncomputable def toList' (arr : PersistentArray α) : List α :=
+  arr.root.toList' ++ arr.tail.toList
+
+@[simp] theorem toList'_empty : (.empty : PersistentArray α).toList' = [] := rfl
+
+/-- We cannot prove this because `insertNewLeaf` is partial -/
+@[simp] axiom toList'_push {α} (arr : PersistentArray α) (x : α) :
+    (arr.push x).toList' = arr.toList' ++ [x]
+
+@[simp] theorem size_empty : (.empty : PersistentArray α).size = 0 := rfl
+
+@[simp] theorem size_push {α} (arr : PersistentArray α) (x : α) :
+    (arr.push x).size = arr.size + 1 := by
+  simp [push]; split <;> [rfl; (simp [mkNewTail]; split <;> rfl)]
+
+@[simp] theorem WF.toList'_length (h : WF arr) : arr.toList'.length = arr.size := by
+  induction h <;> simp [*]
+
+end PersistentArray
+
+namespace PersistentHashMap
+
+noncomputable def Node.toList' : Node α β → List (α × β) :=
+  Node.rec
+    (motive_1 := fun _ => List (α × β)) (motive_2 := fun _ => List (α × β))
+    (motive_3 := fun _ => List (α × β)) (motive_4 := fun _ => List (α × β))
+    (entries := fun _ => id) (collision := fun ks xs _ => ks.toList.zip xs.toList)
+    (mk := fun _ => id)
+    (nil := []) (cons := fun _ _ l1 l2 => l1 ++ l2)
+    (entry := fun a b => [(a, b)]) (ref := fun _ => id) (null := [])
+
+noncomputable def toList' [BEq α] [Hashable α] (m : PersistentHashMap α β) :
+    List (α × β) := m.root.toList'
+
+inductive WF [BEq α] [Hashable α] : PersistentHashMap α β → Prop where
+  | empty : WF .empty
+  | insert : WF m → WF (m.insert a b)
+
+/-- We can't prove this because `Lean.PersistentHashMap.insertAux` is opaque -/
+axiom WF.toList'_insert {α β} [BEq α] [Hashable α]
+    [PartialEquivBEq α] [LawfulHashable α]
+    {m : PersistentHashMap α β} (_ : WF m) (a : α) (b : β) :
+    (m.insert a b).toList' ~ (a, b) :: m.toList'.filter (¬a == ·.1)
+
+/-- We can't prove this because `Lean.PersistentHashMap.findAux` is opaque -/
+axiom WF.find?_eq {α β} [BEq α] [Hashable α]
+    [PartialEquivBEq α] [LawfulHashable α]
+    {m : PersistentHashMap α β} (_ : WF m) (a : α) : m.find? a = m.toList'.lookup a
+
+/-- We can't prove this because `Lean.PersistentHashMap.{findAux, containsAux}` are opaque -/
+axiom findAux_isSome {α β} [BEq α] {node : Node α β} (i : USize) (a : α) :
+    containsAux node i a = (findAux node i a).isSome
+
+end PersistentHashMap
+
+namespace Syntax
+
+def structEq' : Syntax → Syntax → Bool
+  | .missing, .missing => true
+  | .node _ k args, .node _ k' args' => k == k' &&
+    (args.size == args'.size &&
+      (args.toList.attach.zip args'.toList.attach).all fun (a, b) =>
+        have := Array.mem_toList_iff.1 a.2; structEq' a b)
+  | .atom _ val, .atom _ val' => val == val'
+  | .ident _ rawVal val preresolved, Syntax.ident _ rawVal' val' preresolved' =>
+    rawVal == rawVal' && val == val' && preresolved == preresolved'
+  | _, _ => false
+termination_by x _ => x
+
+theorem structEq'_node :
+    structEq' (.node _x k args) (.node _y k' args') = (k == k' && args.isEqv args' structEq') := by
+  unfold structEq'; simp; congr 1
+  by_cases h : args.size = args'.size <;> [simp [h]; simp [Array.isEqv, h]]
+  let ⟨args⟩ := args; let ⟨args'⟩ := args'; simp at h ⊢
+  have' : ((args.attach.map (·.1)).zip (args'.attach.map (·.1))).all
+      (fun x => x.1.structEq' x.2) = _ := by
+    simp only [List.zip_map_left, List.zip_map_right]; simp [Function.comp_def]; rfl
+  rw [← this]; simp; clear this
+  induction args generalizing args' <;> cases args' <;> simp at h <;> simp [List.isEqv, *]
+
+/-- This is a `partial` because it is not obviously terminating. The `structEq'_node` theorem
+shows that a definition with the same clauses can be defined manually. -/
+@[simp] axiom structEq_eq : structEq a b = structEq' a b
+end Syntax
+
+namespace Level
+
+/-!
+### A total copy of `Lean.Level.normalize`
+
+`Lean.Level.normalize` and four of its helpers are `partial def`s, so they are opaque and nothing
+can be proved about them. The `Total` namespace below is a clause-by-clause copy of
+[Lean's `Lean/Level.lean`](https://github.com/leanprover/lean4/blob/v4.33.1/src/Lean/Level.lean#L319-L404),
+under the same names, with the termination proofs supplied. That makes `normalize_eq` below a
+purely syntactic trust assumption, checkable by reading the two definitions side by side;
+`Ix.Theory.Named.Tests.LevelStd` also checks it on a finite corpus of levels.
+-/
+namespace Total
+
+/-- The structural size of a level, used as the termination measure for `normalize`. -/
+def size : Level → Nat
+  | .zero | .param _ | .mvar _ => 1
+  | .succ l => size l + 1
+  | .max l₁ l₂ => size l₁ + size l₂ + 1
+  | .imax l₁ l₂ => size l₁ + size l₂ + 2
+
+/-- Secondary termination measure for `normalize`: in the `imax` branch it recurses on
+`mkLevelMax l₁ l₂`, which has the same `size` as `imax l₁ l₂` but a smaller `tag`. -/
+private def tag (l : Level) : Nat :=
+  match l.getLevelOffset with
+  | .imax .. => 1
+  | _ => 0
+
+private theorem tag_le (l : Level) : tag l ≤ 1 := by unfold tag; split <;> omega
+
+theorem one_le_size (l : Level) : 1 ≤ size l := by cases l <;> simp [size]
+
+private theorem getOffsetAux_eq (l : Level) (k) : getOffsetAux l k = getOffsetAux l 0 + k := by
+  induction l generalizing k with
+  | succ l ih => rw [getOffsetAux, ih (k+1), getOffsetAux, ih 1]; omega
+  | _ => simp [getOffsetAux]
+
+theorem size_getLevelOffset (l : Level) :
+    size l.getLevelOffset + l.getOffset = size l := by
+  simp only [getOffset]
+  induction l with | succ l ih => ?_ | _ => rfl
+  show size l.getLevelOffset + getOffsetAux l 1 = size l + 1
+  rw [getOffsetAux_eq l 1]; omega
+
+end Total
+open private accMax mkIMaxAux mkMaxAux skipExplicit isExplicitSubsumedAux
+  isExplicitSubsumed from Lean.Level
+
+def Total.mkMaxAux (lvls : Array Level) (extraK : Nat) (i : Nat)
+    (prev : Level) (prevK : Nat) (result : Level) : Level :=
+  if h : i < lvls.size then
+    let lvl   := lvls[i]
+    let curr  := lvl.getLevelOffset
+    let currK := lvl.getOffset
+    if curr == prev then mkMaxAux lvls extraK (i+1) curr currK result
+    else mkMaxAux lvls extraK (i+1) curr currK (accMax result prev (extraK + prevK))
+  else accMax result prev (extraK + prevK)
+
+/-- Patch for `partial def Lean.Level.mkMaxAux`. -/
+@[simp] axiom mkMaxAux_eq : mkMaxAux = Total.mkMaxAux
+
+def Total.skipExplicit (lvls : Array Level) (i : Nat) : Nat :=
+  if h : i < lvls.size then
+    if lvls[i].getLevelOffset.isZero then skipExplicit lvls (i+1) else i
+  else i
+
+/-- Patch for `partial def Lean.Level.skipExplicit`. -/
+@[simp] axiom skipExplicit_eq : skipExplicit = Total.skipExplicit
+
+def Total.isExplicitSubsumedAux (lvls : Array Level) (maxExplicit : Nat) (i : Nat) : Bool :=
+  if h : i < lvls.size then
+    if lvls[i].getOffset ≥ maxExplicit then true
+    else isExplicitSubsumedAux lvls maxExplicit (i+1)
+  else false
+
+/-- Patch for `partial def Lean.Level.isExplicitSubsumedAux`. -/
+@[simp] axiom isExplicitSubsumedAux_eq : isExplicitSubsumedAux = Total.isExplicitSubsumedAux
+
+mutual
+
+/-- A total copy of `partial def Lean.Level.normalize`. -/
+def Total.normalize (l : Level) : Level :=
+  if isAlreadyNormalizedCheap l then l else
+  let k := l.getOffset
+  match h : l.getLevelOffset with
+  | .max l₁ l₂ =>
+    let lvls  := getMaxArgsAux l₁ false #[]
+    let lvls  := getMaxArgsAux l₂ false lvls
+    let lvls  := lvls.qsort normLt
+    let firstNonExplicit := skipExplicit lvls 0
+    let i := if isExplicitSubsumed lvls firstNonExplicit then firstNonExplicit
+              else firstNonExplicit - 1
+    let lvl₁  := lvls[i]!
+    let prev  := lvl₁.getLevelOffset
+    let prevK := lvl₁.getOffset
+    mkMaxAux lvls k (i+1) prev prevK Level.zero
+  | .imax l₁ l₂ =>
+    if l₂.isNeverZero then addOffset (normalize (mkLevelMax l₁ l₂)) k
+    else addOffset (mkIMaxAux (normalize l₁) (normalize l₂)) k
+  | _ => unreachable!
+termination_by (1, 3 * size l + tag l)
+decreasing_by all_goals
+  refine .right _ ?_
+  have hsz := size_getLevelOffset l
+  rw [h] at hsz
+  simp only [size] at hsz
+  have := one_le_size l₁
+  have := one_le_size l₂
+  have := tag_le l₁
+  have := tag_le l₂
+  first
+  | omega
+  | have ht : tag l = 1 := by simp [tag, h]
+    have e1 : size (mkLevelMax l₁ l₂) = size l₁ + size l₂ + 1 := rfl
+    have e2 : tag (mkLevelMax l₁ l₂) = 0 := rfl
+    omega
+
+def Total.getMaxArgsAux : Level → Bool → Array Level → Array Level
+  | .max l₁ l₂, norm, lvls => getMaxArgsAux l₂ norm (getMaxArgsAux l₁ norm lvls)
+  | l, false, lvls => getMaxArgsAux (normalize l) true lvls
+  | l, true, lvls => lvls.push l
+termination_by l b => (if b then 0 else 1, 3 * size l + tag l + 1)
+decreasing_by
+  any_goals cases norm
+  any_goals first | refine .right _ ?_ | exact .left _ _ (by decide)
+  all_goals first
+  | omega
+  | have e1 : size (Level.max l₁ l₂) = size l₁ + size l₂ + 1 := rfl
+    have e2 : tag (Level.max l₁ l₂) = 0 := rfl
+    have := one_le_size l₁
+    have := one_le_size l₂
+    have := tag_le l₁
+    have := tag_le l₂
+    omega
+
+end
+
+/-- `Lean.Level.normalize` is a `partial def`, so it is opaque;
+`Total.normalize` above is a total copy of it. -/
+axiom normalize_eq : normalize = Total.normalize
+
+def mkData' (h : UInt64) (depth : Nat := 0) (hasMVar hasParam : Bool := false) : Level.Data :=
+  if depth > Nat.pow 2 24 - 1 then panic! "universe level depth is too big"
+  else
+    h.toUInt32.toUInt64 +
+    hasMVar.toUInt64.shiftLeft 32 +
+    hasParam.toUInt64.shiftLeft 33 +
+    depth.toUInt64.shiftLeft 40
+
+/-- This exists only for the bit-twiddling proofs, it shouldn't appear
+in the main results, which use the functions below instead -/
+axiom mkData_eq : @mkData = @mkData'
+
+def hasParam' : Level → Bool
+  | .param .. => true
+  | .zero | .mvar .. => false
+  | .succ l => l.hasParam'
+  | .max l₁ l₂ | .imax l₁ l₂ => l₁.hasParam' || l₂.hasParam'
+
+/-- This was false prior to the fix of lean4#8554; it should now be provable
+using `mkData_eq` and friends, but this has not been done yet -/
+@[simp] axiom hasParam_eq (l : Level) : l.hasParam = l.hasParam'
+
+def hasMVar' : Level → Bool
+  | .mvar .. => true
+  | .zero | .param .. => false
+  | .succ l => l.hasMVar'
+  | .max l₁ l₂ | .imax l₁ l₂ => l₁.hasMVar' || l₂.hasMVar'
+
+/-- This was false prior to the fix of lean4#8554; it should now be provable
+using `mkData_eq` and friends, but this has not been done yet -/
+@[simp] axiom hasMVar_eq (l : Level) : l.hasMVar = l.hasMVar'
+
+/-- This is because the `BEq` instance is implemented in C++ -/
+@[instance] axiom instLawfulBEqLevel : LawfulBEq Level
+
+@[inline] private def mkIMaxCore (u v : Level) (elseK : Unit → Level) : Level :=
+  if v.isNeverZero then mkLevelMax' u v
+  else if v.isZero then v
+  else if u.isZero || u matches .succ .zero then v
+  else if u == v then u
+  else elseK ()
+
+open private mkLevelIMaxCore from Lean.Level in
+/-- Workaround for https://github.com/leanprover/lean4/pull/7631#issuecomment-3289800246 -/
+@[simp] axiom mkLevelIMaxCore_eq (e : Expr) (n : Nat) : mkLevelIMaxCore = mkIMaxCore
+
+end Level
+
+namespace Expr
+
+def mkData'
+    (h : UInt64) (looseBVarRange : Nat := 0) (approxDepth : UInt32 := 0)
+    (hasFVar hasExprMVar hasLevelMVar hasLevelParam : Bool := false)
+    : Expr.Data :=
+  let approxDepth : UInt8 := if approxDepth > 255 then 255 else approxDepth.toUInt8
+  assert! (looseBVarRange ≤ Nat.pow 2 20 - 1)
+  h.toUInt32.toUInt64 +
+  approxDepth.toUInt64.shiftLeft 32 +
+  hasFVar.toUInt64.shiftLeft 40 +
+  hasExprMVar.toUInt64.shiftLeft 41 +
+  hasLevelMVar.toUInt64.shiftLeft 42 +
+  hasLevelParam.toUInt64.shiftLeft 43 +
+  looseBVarRange.toUInt64.shiftLeft 44
+
+/-- This exists only for the bit-twiddling proofs, it shouldn't appear
+in the main results, which use the functions below instead -/
+axiom mkData_eq : @mkData = @mkData'
+
+@[inline] def mkAppData' (fData : Data) (aData : Data) : Data :=
+  let depth          := max fData.approxDepth.toUInt16 aData.approxDepth.toUInt16 + 1
+  let approxDepth    := if depth > 255 then 255 else depth.toUInt8
+  let looseBVarRange := max fData.looseBVarRange aData.looseBVarRange
+  let hash           := mixHash fData aData
+  let fData : UInt64 := fData
+  let aData : UInt64 := aData
+  assert! looseBVarRange ≤ (Nat.pow 2 20 - 1).toUInt32
+  (fData ||| aData) &&& (15 : UInt64) <<< (40 : UInt64) |||
+  hash.toUInt32.toUInt64 |||
+  approxDepth.toUInt64 <<< (32 : UInt64) |||
+  looseBVarRange.toUInt64 <<< (44 : UInt64)
+
+/-- This exists only for the bit-twiddling proofs, it shouldn't appear
+in the main results, which use the functions below instead -/
+axiom mkAppData_eq : @mkAppData = @mkAppData'
+
+def looseBVarRange' : Expr → Nat
+  | .bvar i => i + 1
+  | .const ..
+  | .sort _
+  | .fvar _
+  | .mvar _
+  | .lit _ => 0
+  | .mdata _ e
+  | .proj _ _ e => e.looseBVarRange'
+  | .app e1 e2 => max e1.looseBVarRange' e2.looseBVarRange'
+  | .lam _ e1 e2 _
+  | .forallE _ e1 e2 _ => max e1.looseBVarRange' (e2.looseBVarRange' - 1)
+  | .letE _ e1 e2 e3 _ => max (max e1.looseBVarRange' e2.looseBVarRange') (e3.looseBVarRange' - 1)
+
+/-- This was false prior to the fix of lean4#8554; it should now be provable
+using `mkData_eq` and friends, but this has not been done yet -/
+@[simp] axiom looseBVarRange_eq (e : Expr) : e.looseBVarRange = e.looseBVarRange'
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom replace_eq (e : Expr) (f) : e.replace f = e.replaceNoCache f
+
+def liftLooseBVars' (e : @& Expr) (s d : @& Nat) : Expr :=
+  match e with
+  | .bvar i => .bvar (if i < s then i else i + d)
+  | .mdata m e => .mdata m (liftLooseBVars' e s d)
+  | .proj n i e => .proj n i (liftLooseBVars' e s d)
+  | .app f a => .app (liftLooseBVars' f s d) (liftLooseBVars' a s d)
+  | .lam n t b bi => .lam n (liftLooseBVars' t s d) (liftLooseBVars' b (s+1) d) bi
+  | .forallE n t b bi => .forallE n (liftLooseBVars' t s d) (liftLooseBVars' b (s+1) d) bi
+  | .letE n t v b bi =>
+    .letE n (liftLooseBVars' t s d) (liftLooseBVars' v s d) (liftLooseBVars' b (s+1) d) bi
+  | e@(.const ..)
+  | e@(.sort _)
+  | e@(.fvar _)
+  | e@(.mvar _)
+  | e@(.lit _) => e
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom liftLooseBVars_eq (e : Expr) (s d) : e.liftLooseBVars s d = e.liftLooseBVars' s d
+
+def lowerLooseBVars' (e : @& Expr) (s d : @& Nat) : Expr :=
+  if s < d then e else
+  match e with
+  | .bvar i => .bvar (if i < s then i else i - d)
+  | .mdata m e => .mdata m (lowerLooseBVars' e s d)
+  | .proj n i e => .proj n i (lowerLooseBVars' e s d)
+  | .app f a => .app (lowerLooseBVars' f s d) (lowerLooseBVars' a s d)
+  | .lam n t b bi => .lam n (lowerLooseBVars' t s d) (lowerLooseBVars' b (s+1) d) bi
+  | .forallE n t b bi => .forallE n (lowerLooseBVars' t s d) (lowerLooseBVars' b (s+1) d) bi
+  | .letE n t v b bi =>
+    .letE n (lowerLooseBVars' t s d) (lowerLooseBVars' v s d) (lowerLooseBVars' b (s+1) d) bi
+  | e@(.const ..)
+  | e@(.sort _)
+  | e@(.fvar _)
+  | e@(.mvar _)
+  | e@(.lit _) => e
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom lowerLooseBVars_eq (e : Expr) (s d) : e.lowerLooseBVars s d = e.lowerLooseBVars' s d
+
+def instantiate1' (e : Expr) (subst : Expr) (d := 0) : Expr :=
+  match e with
+  | .bvar i => if i < d then e else if i = d then subst.liftLooseBVars' 0 d else .bvar (i - 1)
+  | .mdata m e => .mdata m (instantiate1' e subst d)
+  | .proj s i e => .proj s i (instantiate1' e subst d)
+  | .app f a => .app (instantiate1' f subst d) (instantiate1' a subst d)
+  | .lam n t b bi => .lam n (instantiate1' t subst d) (instantiate1' b subst (d+1)) bi
+  | .forallE n t b bi => .forallE n (instantiate1' t subst d) (instantiate1' b subst (d+1)) bi
+  | .letE n t v b bi =>
+    .letE n (instantiate1' t subst d) (instantiate1' v subst d) (instantiate1' b subst (d+1)) bi
+  | .const ..
+  | .sort _
+  | .fvar _
+  | .mvar _
+  | .lit _ => e
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom instantiate1_eq (e : Expr) (subst) : e.instantiate1 subst = e.instantiate1' subst
+
+@[simp] def instantiateList : Expr → List Expr → (k :_:= 0) → Expr
+  | e, [], _ => e
+  | e, a :: as, k => instantiateList (instantiate1' e a k) as k
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom instantiate_eq (e : Expr) (subst) :
+    e.instantiate subst = e.instantiateList subst.toList
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom instantiateRev_eq (e : Expr) (subst) :
+    e.instantiateRev subst = e.instantiate subst.reverse
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom instantiateRange_eq (e : Expr) (subst) :
+    e.instantiateRange start stop subst = e.instantiate (subst.extract start stop)
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom instantiateRevRange_eq (e : Expr) (subst) :
+    e.instantiateRevRange start stop subst = e.instantiateRev (subst.extract start stop)
+
+def abstract1 (v : FVarId) : Expr → (k :_:= 0) → Expr
+  | .bvar i, d => .bvar (if i < d then i else i + 1)
+  | e@(.fvar v'), d => if v == v' then .bvar d else e
+  | .mdata m e, d => .mdata m (abstract1 v e d)
+  | .proj s i e, d => .proj s i (abstract1 v e d)
+  | .app f a, d => .app (abstract1 v f d) (abstract1 v a d)
+  | .lam n t b bi, d => .lam n (abstract1 v t d) (abstract1 v b (d+1)) bi
+  | .forallE n t b bi, d => .forallE n (abstract1 v t d) (abstract1 v b (d+1)) bi
+  | .letE n t val b bi, d =>
+    .letE n (abstract1 v t d) (abstract1 v val d) (abstract1 v b (d+1)) bi
+  | e@(.const ..), _
+  | e@(.sort _), _
+  | e@(.mvar _), _
+  | e@(.lit _), _ => e
+
+@[simp] def abstractList : Expr → List FVarId → (k :_:= 0) → Expr
+  | e, [], _ => e
+  | e, a :: as, k => abstractList (abstract1 a e k) as k
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom abstract_eq (e : Expr) (xs : List FVarId) :
+    e.abstract ⟨xs.map .fvar⟩ = e.abstractList xs
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom abstractRange_eq (e : Expr) (n : Nat) (xs : Array Expr) :
+    e.abstractRange n xs = e.abstract (xs.extract 0 n)
+
+def hasLooseBVar' : (e : @& Expr) → (bvarIdx : @& Nat) → Bool
+  | .bvar i, d => i = d
+  | .mdata _ e, d
+  | .proj _ _ e, d => hasLooseBVar' e d
+  | .app f a, d => hasLooseBVar' f d || hasLooseBVar' a d
+  | .lam _ t b _, d
+  | .forallE _ t b _, d => hasLooseBVar' t d || hasLooseBVar' b (d+1)
+  | .letE _ t v b _, d => hasLooseBVar' t d || hasLooseBVar' v d || hasLooseBVar' b (d+1)
+  | .const .., _
+  | .sort _, _
+  | .fvar _, _
+  | .mvar _, _
+  | .lit _, _ => false
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom hasLooseBVar_eq (e : Expr) (n : Nat) : e.hasLooseBVar n = e.hasLooseBVar' n
+
+def eqv' : (e1 e2 : Expr) → (strict : Bool := false) → Bool
+  | .bvar i, .bvar i', _
+  | .lit i, .lit i', _
+  | .mvar i, .mvar i', _
+  | .fvar i, .fvar i', _
+  | .sort i, .sort i', _ => i == i'
+  | .mdata d e, .mdata d' e', st => e.eqv' e' st && d.entries == d'.entries
+  | .proj s i e, .proj s' i' e', st => e.eqv' e' st && s == s' && i == i'
+  | .const n ls, .const n' ls', _ => n == n' && ls == ls'
+  | .app f a, .app f' a', st => f.eqv' f' st && a.eqv' a' st
+  | .lam n t b bi, .lam n' t' b' bi', st
+  | .forallE n t b bi, .forallE n' t' b' bi', st =>
+    t.eqv' t' st && b.eqv' b' st && (!st || (n == n' && bi == bi'))
+  | .letE n t v b nd, .letE n' t' v' b' nd', st =>
+    t.eqv' t' st && v.eqv' v' st && b.eqv' b' st && nd == nd' && (!st || n == n')
+  | _, _, _ => false
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom eqv_eq (e1 e2 : Expr) : e1.eqv e2 = e1.eqv' e2
+
+/-- This could be an `@[implemented_by]` -/
+@[simp] axiom equal_eq (e1 e2 : Expr) : e1.equal e2 = e1.eqv' e2 (strict := true)
+
+end Expr
diff --git a/Ix/Theory/Named/Verify/Environment/Basic.lean b/Ix/Theory/Named/Verify/Environment/Basic.lean
new file mode 100644
index 000000000..3166422c0
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/Basic.lean
@@ -0,0 +1,555 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.LocalContext
+import Ix.Theory.Named.Typing.EnvLemmas
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+theorem ConstantInfo.hasValue_eq (ci : ConstantInfo) : ci.hasValue = ci.value?.isSome := by
+  cases ci <;> rfl
+
+theorem ConstantInfo.value!_eq (ci : ConstantInfo) : ci.value! = ci.value?.get! := by
+  cases ci <;> simp [ConstantInfo.value?, ConstantInfo.value!]
+
+def _root_.Lean.ConstantInfo.safety (ci : ConstantInfo) : DefinitionSafety :=
+  if ci.isUnsafe then .unsafe else if ci.isPartial then .partial else .safe
+
+variable (safety : DefinitionSafety) (env : VEnv) in
+def TrConstant (ci : ConstantInfo) (ci' : VConstant) : Prop :=
+  safety ≤ ci.safety ∧ ci.levelParams.length = ci'.uvars ∧
+  TrExprS env ci.levelParams [] ci.type ci'.type
+
+variable (safety : DefinitionSafety) (env : VEnv) in
+def TrConstVal (ci : ConstantInfo) (ci' : VConstVal) : Prop :=
+  TrConstant safety env ci ci'.toVConstant ∧ ci.name = ci'.name
+
+variable (safety : DefinitionSafety) (env : VEnv) in
+def TrDefVal (ci : ConstantInfo) (ci' : VDefVal) : Prop :=
+  TrConstVal safety env ci ci'.toVConstVal ∧
+  TrExprS env ci.levelParams [] (ci.value! (allowOpaque := true)) ci'.value
+
+/-- The step an abstract environment takes when `ci`, modelled by `ci'`, is added.
+
+At safety levels where the declaration is visible the constant is added; where it is not, the
+environment is unchanged, matching `TrEnv'.ignore`. Stating this rather than just `venv ≤ venv'`
+is what lets a caller see *which* constant a step added. -/
+def VEnv.AddConst (venv : VEnv) (safety : DefinitionSafety) (ci : ConstantInfo)
+    (ci' : VConstant) (venv' : VEnv) : Prop :=
+  if safety ≤ ci.safety then
+    TrConstant safety venv ci ci' ∧ ci'.WF venv ∧ venv.addConst ci.name ci' = some venv'
+  else
+    venv' = venv
+
+theorem VEnv.AddConst.le {venv venv' : VEnv} {ci ci'}
+    (H : VEnv.AddConst venv safety ci ci' venv') : venv ≤ venv' := by
+  unfold VEnv.AddConst at H; split at H
+  · exact addConst_le H.2.2
+  · exact H ▸ VEnv.LE.rfl
+
+/-- As `VEnv.AddConst`, for a definition: the constant is added and then its defining equation,
+matching `TrEnv'.defn`. -/
+def VEnv.AddDef (venv : VEnv) (safety : DefinitionSafety) (ci : ConstantInfo)
+    (ci' : VDefVal) (venv' : VEnv) : Prop :=
+  if safety ≤ ci.safety then
+    ∃ base, TrDefVal safety venv ci ci' ∧ ci'.WF venv ∧
+      venv.addConst ci.name ci'.toVConstant = some base ∧
+      venv' = base.addDefEq ci'.toDefEq
+  else
+    venv' = venv
+
+theorem VEnv.AddDef.le {venv venv' : VEnv} {ci ci'}
+    (H : VEnv.AddDef venv safety ci ci' venv') : venv ≤ venv' := by
+  unfold VEnv.AddDef at H; split at H
+  · obtain ⟨base, _, _, hadd, rfl⟩ := H
+    exact (addConst_le hadd).trans (VEnv.addDefEq_le ..)
+  · exact H ▸ VEnv.LE.rfl
+
+def AddQuot1 (name : Name) (kind : QuotKind) (ci' : VConstant) (P : ConstMap → VEnv → Prop)
+    (m : ConstMap) (env : VEnv) : Prop :=
+  ∃ levelParams type env',
+    let ci := .quotInfo { name, kind, levelParams, type }
+    TrConstant .safe env ci ci' ∧
+    m.find? name = none ∧
+    env.addConst name ci' = some env' ∧
+    P (m.insert name ci) env'
+
+theorem AddQuot1.to_addQuot
+    (H1 : ∀ m env, P m env → f env = some env')
+    (m env) (H : AddQuot1 name kind ci' P m env) :
+    env.addConst name ci' >>= f = some env' := by
+  let ⟨_, _, _, h1, _, h2, h3⟩ := H
+  simpa using ⟨_, h2, H1 _ _ h3⟩
+
+theorem AddQuot1.le
+    (H1 : ∀ m env, P m env → env ≤ env₀)
+    (m env) (H : AddQuot1 name kind ci' P m env) : env ≤ env₀ :=
+  let ⟨_, _, _, _, _, h2, h3⟩ := H
+  .trans (VEnv.addConst_le h2) (H1 _ _ h3)
+
+def AddQuot (m₁ m₂ : ConstMap) (env₁ env₂ : VEnv) : Prop :=
+  AddQuot1 ``Quot .type quotConst (m := m₁) (env := env₁) <|
+  AddQuot1 ``Quot.mk .ctor quotMkConst <|
+  AddQuot1 ``Quot.lift .lift quotLiftConst <|
+  AddQuot1 ``Quot.ind .ind quotIndConst (· = m₂ ∧ ·.addDefEq quotDefEq = env₂)
+
+nonrec theorem AddQuot.to_addQuot (H : AddQuot m₁ m₂ env₁ env₂) : env₁.addQuot = some env₂ :=
+  open AddQuot1 in (to_addQuot <| to_addQuot <| to_addQuot <| to_addQuot (by simp)) _ _ H
+
+nonrec theorem AddQuot.le (H : AddQuot m₁ m₂ env₁ env₂) : env₁ ≤ env₂ :=
+  open AddQuot1 in (le <| le <| le <| le fun _ _ h => h.2 ▸ VEnv.addDefEq_le) _ _ H
+
+/-! ## Inductive-environment alignment -/
+
+/-- The three kinds of constants emitted by an inductive declaration. The
+role is tracked explicitly so an alignment witness cannot stand in a
+definition or axiom where the kernel emits inductive metadata. -/
+inductive InductConstantKind where
+  | induct
+  | ctor
+  | recursor
+
+def InductConstantKind.Matches : InductConstantKind → ConstantInfo → Prop
+  | .induct, .inductInfo _ => True
+  | .ctor, .ctorInfo _ => True
+  | .recursor, .recInfo _ => True
+  | _, _ => False
+
+theorem InductConstantKind.Matches.value?_eq_none
+    {kind : InductConstantKind} {ci : ConstantInfo}
+    (H : InductConstantKind.Matches kind ci) : ci.value? = none := by
+  cases kind <;> cases ci <;> simp_all [InductConstantKind.Matches, ConstantInfo.value?]
+
+/-- One insertion shared by the implementation `ConstMap` and Theory `VEnv`.
+The translated constant is checked in the Theory environment immediately
+before insertion. -/
+structure AddInductConstant (kind : InductConstantKind)
+    (m₁ : ConstMap) (env₁ : VEnv) (ci' : VConstVal)
+    (m₂ : ConstMap) (env₂ : VEnv) where
+  info : ConstantInfo
+  kind_eq : kind.Matches info
+  tr : TrConstVal .safe env₁ info ci'
+  map_fresh : m₁.find? ci'.name = none
+  env_add : env₁.addConst ci'.name ci'.toVConstant = some env₂
+  map_add : m₂ = m₁.insert ci'.name info
+
+/-- List-fold alignment for the constructor constants of a block. -/
+inductive AddInductConstants (kind : InductConstantKind) :
+    ConstMap → VEnv → List VConstVal → ConstMap → VEnv → Type where
+  | nil : AddInductConstants kind m env [] m env
+  | cons :
+    AddInductConstant kind m₁ env₁ ci m₂ env₂ →
+    AddInductConstants kind m₂ env₂ cis m₃ env₃ →
+    AddInductConstants kind m₁ env₁ (ci :: cis) m₃ env₃
+
+/-- A reusable witness for the defeq tail of an environment transaction. -/
+structure AddDefEqs (env₁ : VEnv) (dfs : List VDefEq) (env₂ : VEnv) : Prop where
+  fold_eq : dfs.foldl VEnv.addDefEq env₁ = env₂
+
+/-- The generated recursor represented as a named Theory constant. -/
+def inductRecVal (decl : VInductDecl) (ty : VInductiveType) : VConstVal :=
+  ⟨VInductDecl.recConstRec decl.uvars ty.name decl.nparams ty, .str ty.name "rec"⟩
+
+/-- The exact mixed recursor represented as a named Theory constant. -/
+def inductGenerationRecVal {decl : VInductDecl}
+    (generation : decl.GenerationChecked) : VConstVal :=
+  ⟨generation.recursor, .str generation.block.sourceType.name "rec"⟩
+
+/-- The implementation recursor metadata carries the same K-like reduction
+flag retained by Theory generation. Keeping this separate from `TrConstant`
+prevents a type-correct recursor with the wrong reduction behavior from
+satisfying an inductive alignment trace. -/
+def RecursorKMatches (info : ConstantInfo) (kTarget : Bool) : Prop :=
+  match info with
+  | .recInfo rec => rec.k = kTarget
+  | _ => False
+
+instance (info : ConstantInfo) (kTarget : Bool) :
+    Decidable (RecursorKMatches info kTarget) := by
+  cases info <;> simp [RecursorKMatches] <;> infer_instance
+
+/-- Data-bearing trace of a complete normalized inductive transaction: one
+`inductInfo`, the constructor `ctorInfo`s in declaration order, one `recInfo`,
+and finally the generated Theory iota equations. The retained generation
+certificate owns both the raw declaration inserted into the Theory environment
+and the checked normalization view used to generate the recursor and rules. -/
+structure AddInductTrace (m₁ : ConstMap) (env₁ : VEnv) (decl : VInductDecl)
+    (m₂ : ConstMap) (env₂ : VEnv) where
+  generation : decl.GenerationChecked
+  generation_wf : generation.WF env₁
+  typeMap : ConstMap
+  typeEnv : VEnv
+  ctorMap : ConstMap
+  ctorEnv : VEnv
+  recEnv : VEnv
+  addType : AddInductConstant .induct m₁ env₁
+    generation.block.sourceType.toVConstVal typeMap typeEnv
+  addCtors : AddInductConstants .ctor typeMap typeEnv
+    generation.block.sourceType.ctors ctorMap ctorEnv
+  addRec : AddInductConstant .recursor ctorMap ctorEnv
+    (inductGenerationRecVal generation) m₂ recEnv
+  recK : RecursorKMatches addRec.info generation.kTarget
+  addRules : AddDefEqs recEnv generation.generatedRules env₂
+
+/-- Proposition-valued environment alignment, preserving the public shape of
+the original placeholder while hiding the intermediate transaction states. -/
+def AddInduct (m₁ : ConstMap) (env₁ : VEnv) (decl : VInductDecl)
+    (m₂ : ConstMap) (env₂ : VEnv) : Prop :=
+  Nonempty (AddInductTrace m₁ env₁ decl m₂ env₂)
+
+/-- Every implementation recursor stored by a block replay retains the
+K-like flag computed by the block generator. -/
+def RecursorMapKMatches (m : ConstMap) (recursors : List VConstVal)
+    (kTarget : Bool) : Prop :=
+  ∀ recursor ∈ recursors, ∃ info,
+    m.find? recursor.name = some info ∧ RecursorKMatches info kTarget
+
+/-- Data-bearing alignment trace for a complete mutual inductive block.
+Families, globally flattened constructors, and recursors are each inserted
+as a list phase, followed only after all recursors exist by the flattened
+rule phase. -/
+structure AddInductBlockTrace
+    (m₁ : ConstMap) (env₁ : VEnv) (decl : VInductDecl)
+    (m₂ : ConstMap) (env₂ : VEnv) where
+  generation : decl.BlockGenerationChecked
+  blockEnv : VEnv
+  generation_wf : generation.WF env₁ blockEnv
+  typeMap : ConstMap
+  typeEnv : VEnv
+  ctorMap : ConstMap
+  ctorEnv : VEnv
+  recEnv : VEnv
+  addTypes : AddInductConstants .induct m₁ env₁
+    decl.blockTypeConstants typeMap typeEnv
+  addCtors : AddInductConstants .ctor typeMap typeEnv
+    decl.blockConstructorConstants ctorMap ctorEnv
+  addRecs : AddInductConstants .recursor ctorMap ctorEnv
+    generation.recursors m₂ recEnv
+  recK : RecursorMapKMatches m₂ generation.recursors generation.kTarget
+  addRules : AddDefEqs recEnv generation.generatedRules env₂
+
+/-- Proposition-valued alignment for a complete mutual block. -/
+def AddInductBlock (m₁ : ConstMap) (env₁ : VEnv) (decl : VInductDecl)
+    (m₂ : ConstMap) (env₂ : VEnv) : Prop :=
+  Nonempty (AddInductBlockTrace m₁ env₁ decl m₂ env₂)
+
+/-- Data-bearing alignment trace for a nested inductive declaration: the
+source families and constructors are the stored payload, followed by the
+restored recursors and restored rules.  The implementation map receives
+only restored metadata; no auxiliary constant appears in either the map or
+the Theory environment. -/
+structure AddInductNestedTrace
+    (m₁ : ConstMap) (env₁ : VEnv) (decl : VInductDecl)
+    (m₂ : ConstMap) (env₂ : VEnv) where
+  nested : decl.NestedBlockChecked
+  nested_wf : nested.WF env₁
+  typeMap : ConstMap
+  typeEnv : VEnv
+  ctorMap : ConstMap
+  ctorEnv : VEnv
+  recEnv : VEnv
+  addTypes : AddInductConstants .induct m₁ env₁
+    decl.blockTypeConstants typeMap typeEnv
+  addCtors : AddInductConstants .ctor typeMap typeEnv
+    decl.blockConstructorConstants ctorMap ctorEnv
+  addRecs : AddInductConstants .recursor ctorMap ctorEnv
+    nested.recursors m₂ recEnv
+  recK : RecursorMapKMatches m₂ nested.recursors nested.generation.kTarget
+  addRules : AddDefEqs recEnv nested.generatedRules env₂
+
+/-- Proposition-valued alignment for a nested declaration. -/
+def AddInductNested (m₁ : ConstMap) (env₁ : VEnv) (decl : VInductDecl)
+    (m₂ : ConstMap) (env₂ : VEnv) : Prop :=
+  Nonempty (AddInductNestedTrace m₁ env₁ decl m₂ env₂)
+
+theorem AddInductConstants.to_foldlM :
+    AddInductConstants kind m₁ env₁ cis m₂ env₂ →
+    List.foldlM (fun env (ci : VConstVal) => env.addConst ci.name ci.toVConstant) env₁ cis =
+      some env₂
+  | .nil => rfl
+  | .cons h hrest => by
+    rw [List.foldlM_cons, h.env_add]
+    exact hrest.to_foldlM
+
+theorem AddInductConstant.fresh
+    (H : AddInductConstant kind m₁ env₁ ci m₂ env₂) : env₁.constants ci.name = none :=
+  VEnv.addConst_fresh H.env_add
+
+theorem AddInductConstant.lookup
+    (H : AddInductConstant kind m₁ env₁ ci m₂ env₂) :
+    env₂.constants ci.name = some ci.toVConstant :=
+  VEnv.addConst_self H.env_add
+
+theorem AddInductConstant.le
+    (H : AddInductConstant kind m₁ env₁ ci m₂ env₂) : env₁ ≤ env₂ :=
+  VEnv.addConst_le H.env_add
+
+theorem AddInductConstants.le :
+    AddInductConstants kind m₁ env₁ cis m₂ env₂ → env₁ ≤ env₂
+  | .nil => .rfl
+  | .cons h hrest => h.le.trans hrest.le
+
+theorem AddInductConstants.lookup :
+    (H : AddInductConstants kind m₁ env₁ cis m₂ env₂) →
+      ∀ ci ∈ cis, env₂.constants ci.name = some ci.toVConstant
+  | .nil, _, hmem => nomatch hmem
+  | .cons h hrest, ci, hmem => by
+    rcases List.mem_cons.1 hmem with rfl | hmem
+    · exact hrest.le.constants h.lookup
+    · exact hrest.lookup ci hmem
+
+theorem AddInductConstants.fresh :
+    (H : AddInductConstants kind m₁ env₁ cis m₂ env₂) →
+      ∀ ci ∈ cis, env₁.constants ci.name = none
+  | .nil, _, hmem => nomatch hmem
+  | .cons h hrest, ci, hmem => by
+    rcases List.mem_cons.1 hmem with rfl | hmem
+    · exact h.fresh
+    · exact h.le.constants_none (hrest.fresh ci hmem)
+
+theorem AddDefEqs.to_add (H : AddDefEqs env₁ dfs env₂) :
+    dfs.foldl VEnv.addDefEq env₁ = env₂ := H.fold_eq
+
+theorem AddDefEqs.le (H : AddDefEqs env₁ dfs env₂) : env₁ ≤ env₂ := by
+  rw [← H.fold_eq]
+  exact (VInductDecl.rulesFold_spec dfs env₁).1
+
+theorem AddDefEqs.lookup (H : AddDefEqs env₁ dfs env₂)
+    (hdf : df ∈ dfs) : env₂.defeqs df := by
+  rw [← H.fold_eq]
+  exact (VInductDecl.rulesFold_spec dfs env₁).2 df hdf
+
+theorem AddInductTrace.to_addInductGeneration
+    (H : AddInductTrace m₁ env₁ decl m₂ env₂) :
+    env₁.addInductGeneration H.generation = some env₂ := by
+  have hrec :
+      H.ctorEnv.addConst
+        (.str H.generation.block.sourceType.name "rec")
+        H.generation.recursor = some H.recEnv := by
+    simpa [inductGenerationRecVal] using H.addRec.env_add
+  simp [VEnv.addInductGeneration, H.addType.env_add,
+    H.addCtors.to_foldlM, hrec, H.addRules.to_add]
+
+theorem AddInductBlockTrace.to_addInductBlockGeneration
+    (H : AddInductBlockTrace m₁ env₁ decl m₂ env₂) :
+    env₁.addInductBlockGeneration H.generation = some env₂ := by
+  simp [VEnv.addInductBlockGeneration, H.addTypes.to_foldlM,
+    H.addCtors.to_foldlM, H.addRecs.to_foldlM, H.addRules.to_add]
+
+theorem AddInductNestedTrace.to_addInductNested
+    (H : AddInductNestedTrace m₁ env₁ decl m₂ env₂) :
+    env₁.addInductNested H.nested = some env₂ := by
+  simp [VEnv.addInductNested, H.addTypes.to_foldlM,
+    H.addCtors.to_foldlM, H.addRecs.to_foldlM, H.addRules.to_add]
+
+/-- Recover the exact certified normalized Theory transaction represented by
+an implementation metadata replay. This replaces the old, false-for-aliases
+claim that every replay must pass the identity-only `VEnv.addInduct` wrapper. -/
+nonrec theorem AddInduct.to_addInduct
+    (H : AddInduct m₁ env₁ decl m₂ env₂) :
+    ∃ generation : decl.GenerationChecked,
+      generation.WF env₁ ∧
+        env₁.addInductGeneration generation = some env₂ := by
+  rcases H with ⟨H⟩
+  exact ⟨H.generation, H.generation_wf, H.to_addInductGeneration⟩
+
+nonrec theorem AddInduct.le (H : AddInduct m₁ env₁ decl m₂ env₂) : env₁ ≤ env₂ := by
+  obtain ⟨generation, -, hadd⟩ := H.to_addInduct
+  rcases VEnv.addInductGeneration_trace hadd with ⟨trace⟩
+  exact trace.le
+
+/-- Recover the exact block-wide Theory transaction represented by an
+implementation metadata replay. -/
+theorem AddInductBlock.to_addInductBlock
+    (H : AddInductBlock m₁ env₁ decl m₂ env₂) :
+    ∃ (generation : decl.BlockGenerationChecked) (blockEnv : VEnv),
+      generation.WF env₁ blockEnv ∧
+        env₁.addInductBlockGeneration generation = some env₂ := by
+  rcases H with ⟨H⟩
+  exact ⟨H.generation, H.blockEnv, H.generation_wf,
+    H.to_addInductBlockGeneration⟩
+
+theorem AddInductBlock.le
+    (H : AddInductBlock m₁ env₁ decl m₂ env₂) : env₁ ≤ env₂ := by
+  obtain ⟨generation, -, -, hadd⟩ := H.to_addInductBlock
+  rcases VEnv.addInductBlockGeneration_trace hadd with ⟨trace⟩
+  exact trace.le
+
+/-- Recover the exact nested Theory transaction represented by an
+implementation metadata replay. -/
+theorem AddInductNested.to_addInductNested
+    (H : AddInductNested m₁ env₁ decl m₂ env₂) :
+    ∃ nested : decl.NestedBlockChecked,
+      nested.WF env₁ ∧ env₁.addInductNested nested = some env₂ := by
+  rcases H with ⟨H⟩
+  exact ⟨H.nested, H.nested_wf, H.to_addInductNested⟩
+
+theorem AddInductNested.le
+    (H : AddInductNested m₁ env₁ decl m₂ env₂) : env₁ ≤ env₂ := by
+  obtain ⟨nested, -, hadd⟩ := H.to_addInductNested
+  exact VEnv.addInductNested_le hadd
+
+/- The projection relation is now a concrete Theory proposition, so merely
+mentioning `TrExprS` no longer contaminates these projection-free roots with
+the deferred structural-law sorries. -/
+#guard_named_axioms Ix.Theory.Named.AddInductTrace.to_addInductGeneration [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInduct.to_addInduct [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInduct.le [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductBlockTrace.to_addInductBlockGeneration [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductBlock.to_addInductBlock [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductBlock.le [propext, Classical.choice, Quot.sound]
+
+/-- Insert a whole block of definitions into the constant map. -/
+def insertDefs (C : ConstMap) (cis : List DefinitionVal) : ConstMap :=
+  cis.foldl (fun C ci => C.insert ci.name (.defnInfo ci)) C
+
+variable (safety : DefinitionSafety) (env env' : VEnv) in
+/-- Translation data for a mutual block: the headers are translated against the environment
+before the block is added, the values against the environment that already has every constant
+of the block, mirroring the kernel adding them all as axioms first. -/
+def TrDefBlock (cis : List DefinitionVal) (cis' : List VDefVal) : Prop :=
+  List.Forall₂ (fun ci ci' =>
+    TrConstVal safety env (.defnInfo ci) ci'.toVConstVal ∧
+    TrExprS env' ci.levelParams [] ci.value ci'.value) cis cis'
+
+variable (safety : DefinitionSafety) in
+inductive TrEnv' : ConstMap → Bool → VEnv → Prop where
+  | empty : TrEnv' {} false .empty
+  | ignore :
+    C.find? ci.name = none → ¬safety ≤ ci.safety →
+    TrEnv' C Q env →
+    TrEnv' (C.insert ci.name ci) Q env
+  | axiom :
+    TrConstant safety env (.axiomInfo ci) ci' →
+    C.find? ci.name = none → ci'.WF env →
+    env.addConst ci.name ci' = some env' →
+    TrEnv' C Q env →
+    TrEnv' (C.insert ci.name (.axiomInfo ci)) Q env'
+  | defn {ci' : VDefVal} :
+    TrDefVal safety env (.defnInfo ci) ci' →
+    C.find? ci.name = none → ci'.WF env →
+    env.addConst ci.name ci'.toVConstant = some env' →
+    TrEnv' C Q env →
+    TrEnv' (C.insert ci.name (.defnInfo ci)) Q (env'.addDefEq ci'.toDefEq)
+  /-- A mutual block, and an unsafe definition as the one-element case. -/
+  | mutualDef {cis : List DefinitionVal} {cis' : List VDefVal} :
+    TrDefBlock safety env env' cis cis' →
+    -- the block's names are distinct; `addMutual` checks this, as does lean4#14632
+    (cis.map (·.name)).Nodup →
+    (∀ ci ∈ cis, C.find? ci.name = none) →
+    (∀ ci' ∈ cis', ci'.toVConstant.WF env) →
+    env.addConsts cis' = some env' →
+    (∀ ci' ∈ cis', ci'.WF env') →
+    TrEnv' C Q env →
+    TrEnv' (insertDefs C cis) Q (env'.addDefEqs cis')
+  | thm {ci' : VDefVal} :
+    TrDefVal safety env (.thmInfo ci) ci' →
+    C.find? ci.name = none → ci'.WF env →
+    env.HasType ci'.uvars [] ci'.type (.sort .zero) →
+    env.addConst ci.name ci'.toVConstant = some env' →
+    TrEnv' C Q env →
+    TrEnv' (C.insert ci.name (.thmInfo ci)) Q env'
+  | opaque {ci' : VDefVal} :
+    TrDefVal safety env (.opaqueInfo ci) ci' →
+    C.find? ci.name = none → ci'.WF env →
+    env.addConst ci.name ci'.toVConstant = some env' →
+    TrEnv' C Q env →
+    TrEnv' (C.insert ci.name (.opaqueInfo ci)) Q env'
+  | quot :
+    env.QuotReady →
+    AddQuot C C' env env' →
+    TrEnv' C false env →
+    TrEnv' C' true env'
+  /-- Internal kernel-checking stage for one inductive metadata constant.
+  Lean checks a family and its constructors in environments that exist before
+  the complete block transaction. Keeping this stage explicit lets the
+  verified WHNF/defeq checker run in exactly those environments; final
+  environment replay continues to use the atomic `induct` constructor below.
+  -/
+  | inductStaging {ci' : VConstVal} :
+    AddInductConstant kind C env ci' C' env' →
+    ci'.toVConstant.WF env →
+    TrEnv' C Q env →
+    TrEnv' C' Q env'
+  | induct :
+    AddInduct C env decl C' env' →
+    TrEnv' C Q env →
+    TrEnv' C' Q env'
+  | inductBlock :
+    AddInductBlock C env decl C' env' →
+    TrEnv' C Q env →
+    TrEnv' C' Q env'
+  | inductNested :
+    AddInductNested C env decl C' env' →
+    TrEnv' C Q env →
+    TrEnv' C' Q env'
+  /-- Register a Theory structure-eta descriptor without changing the host
+  constant map.  Host eligibility and exact view alignment are retained by
+  `StructureEtaArtifact`; this history step records only the checked Theory
+  capability and its subject-reduction certificate. -/
+  | structEta :
+    rule.WF env →
+    TrEnv' C Q env →
+    TrEnv' C Q (env.addStructEta rule)
+
+def TrEnv (safety : DefinitionSafety) (env : Environment) (venv : VEnv) : Prop :=
+  TrEnv' safety env.constants env.quotInit venv
+
+theorem TrEnv'.wf (H : TrEnv' safety C Q venv) : venv.WF := by
+  induction H with
+  | empty => exact ⟨_, .empty⟩
+  | ignore _ _ _ ih => exact ih
+  | «axiom» _ _ h1 h2 _ ih =>
+    have ⟨_, H⟩ := ih
+    exact ⟨_, H.decl <| .axiom (ci := ⟨_, _⟩) h1 h2⟩
+  | defn h1 _ h2 h3 _ ih =>
+    have ⟨_, H⟩ := ih
+    have := h1.1.2; dsimp [ConstantInfo.name, ConstantInfo.toConstantVal] at this
+    exact ⟨_, H.decl <| .def h2 (this ▸ h3)⟩
+  | mutualDef _ _ _ h2 h3 h4 _ ih =>
+    have ⟨_, H⟩ := ih
+    exact ⟨_, H.decl <| .mutualDef h2 h3 h4⟩
+  | thm h1 _ h2 h3 h4 _ ih =>
+    have ⟨_, H⟩ := ih
+    have hn := h1.1.2
+    dsimp [ConstantInfo.name, ConstantInfo.toConstantVal] at hn
+    exact ⟨_, (H.decl (.example h2)).decl (.axiom ⟨_, h3⟩ (hn ▸ h4))⟩
+  | «opaque» h1 _ h2 h3 _ ih =>
+    have ⟨_, H⟩ := ih
+    have := h1.1.2; dsimp [ConstantInfo.name, ConstantInfo.toConstantVal] at this
+    exact ⟨_, H.decl <| .opaque h2 (this ▸ h3)⟩
+  | quot h1 h2 _ ih =>
+    have ⟨_, H⟩ := ih
+    exact ⟨_, H.decl <| .quot h1 h2.to_addQuot⟩
+  | inductStaging h1 h2 _ ih =>
+    have ⟨_, H⟩ := ih
+    exact ⟨_, H.decl <| .axiom h2 h1.env_add⟩
+  | induct h1 _ ih =>
+    have ⟨_, H⟩ := ih
+    obtain ⟨generation, hgen, hadd⟩ := h1.to_addInduct
+    exact ⟨_, H.decl <| .induct hgen hadd⟩
+  | inductBlock h1 _ ih =>
+    have ⟨_, H⟩ := ih
+    obtain ⟨generation, blockEnv, hgen, hadd⟩ :=
+      h1.to_addInductBlock
+    exact ⟨_, H.decl <| .inductBlock (blockEnv := blockEnv) hgen hadd⟩
+  | inductNested h1 _ ih =>
+    have ⟨_, H⟩ := ih
+    obtain ⟨nested, hwf, hadd⟩ := h1.to_addInductNested
+    exact ⟨_, H.decl <| .inductNested hwf hadd⟩
+  | structEta hrule _ ih =>
+    have ⟨_, H⟩ := ih
+    exact ⟨_, H.structEta hrule⟩
+
+#guard_named_axioms Ix.Theory.Named.TrEnv'.wf [propext, Classical.choice, Quot.sound]
diff --git a/Ix/Theory/Named/Verify/Environment/ConstructorValidation.lean b/Ix/Theory/Named/Verify/Environment/ConstructorValidation.lean
new file mode 100644
index 000000000..78ff92f85
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/ConstructorValidation.lean
@@ -0,0 +1,9028 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.Normalization
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+namespace AddInductive
+open TypeChecker
+
+/-!
+# Semantic interpretation of constructor validation
+
+This module interprets the operational trace retained by
+`Inductive.ValidationTrace`.  It deliberately sits above both the verified
+checker and candidate normalization: validation supplies the accepted kernel
+path, while normalization supplies the exact analyzer-owned Theory view.
+-/
+
+/-- Structural equality of kernel levels is sound after strict translation. -/
+theorem levelStructEq_ofLevel
+    (equal : levelStructEq lhs rhs = true)
+    (lhs_tr : VLevel.ofLevel Us lhs = some lhs')
+    (rhs_tr : VLevel.ofLevel Us rhs = some rhs') :
+    lhs' = rhs' := by
+  induction lhs generalizing rhs lhs' rhs' with
+  | zero =>
+      cases rhs <;> simp_all [levelStructEq, VLevel.ofLevel]
+  | succ lhs ih =>
+      cases rhs with
+      | succ rhs =>
+          simp only [levelStructEq] at equal
+          simp only [VLevel.ofLevel, Option.bind_eq_bind] at lhs_tr rhs_tr
+          obtain ⟨lhs'', lhs_inner_tr, lhs'_eq⟩ :=
+            Option.bind_eq_some_iff.mp lhs_tr
+          obtain ⟨rhs'', rhs_inner_tr, rhs'_eq⟩ :=
+            Option.bind_eq_some_iff.mp rhs_tr
+          change some lhs''.succ = some lhs' at lhs'_eq
+          change some rhs''.succ = some rhs' at rhs'_eq
+          injection lhs'_eq with lhs'_eq
+          injection rhs'_eq with rhs'_eq
+          subst lhs'
+          subst rhs'
+          rw [ih equal lhs_inner_tr rhs_inner_tr]
+      | zero | max _ _ | imax _ _ | param _ | mvar _ =>
+          simp_all [levelStructEq]
+  | max lhs₁ lhs₂ ih₁ ih₂ =>
+      cases rhs with
+      | max rhs₁ rhs₂ =>
+          simp only [levelStructEq, Bool.and_eq_true] at equal
+          simp only [VLevel.ofLevel, Option.bind_eq_bind] at lhs_tr rhs_tr
+          obtain ⟨lhs₁', lhs₁_tr, lhsTail⟩ :=
+            Option.bind_eq_some_iff.mp lhs_tr
+          obtain ⟨lhs₂', lhs₂_tr, lhs'_eq⟩ :=
+            Option.bind_eq_some_iff.mp lhsTail
+          obtain ⟨rhs₁', rhs₁_tr, rhsTail⟩ :=
+            Option.bind_eq_some_iff.mp rhs_tr
+          obtain ⟨rhs₂', rhs₂_tr, rhs'_eq⟩ :=
+            Option.bind_eq_some_iff.mp rhsTail
+          change some (.max lhs₁' lhs₂') = some lhs' at lhs'_eq
+          change some (.max rhs₁' rhs₂') = some rhs' at rhs'_eq
+          injection lhs'_eq with lhs'_eq
+          injection rhs'_eq with rhs'_eq
+          subst lhs'
+          subst rhs'
+          rw [ih₁ equal.1 lhs₁_tr rhs₁_tr,
+            ih₂ equal.2 lhs₂_tr rhs₂_tr]
+      | zero | succ _ | imax _ _ | param _ | mvar _ =>
+          simp_all [levelStructEq]
+  | imax lhs₁ lhs₂ ih₁ ih₂ =>
+      cases rhs with
+      | imax rhs₁ rhs₂ =>
+          simp only [levelStructEq, Bool.and_eq_true] at equal
+          simp only [VLevel.ofLevel, Option.bind_eq_bind] at lhs_tr rhs_tr
+          obtain ⟨lhs₁', lhs₁_tr, lhsTail⟩ :=
+            Option.bind_eq_some_iff.mp lhs_tr
+          obtain ⟨lhs₂', lhs₂_tr, lhs'_eq⟩ :=
+            Option.bind_eq_some_iff.mp lhsTail
+          obtain ⟨rhs₁', rhs₁_tr, rhsTail⟩ :=
+            Option.bind_eq_some_iff.mp rhs_tr
+          obtain ⟨rhs₂', rhs₂_tr, rhs'_eq⟩ :=
+            Option.bind_eq_some_iff.mp rhsTail
+          change some (.imax lhs₁' lhs₂') = some lhs' at lhs'_eq
+          change some (.imax rhs₁' rhs₂') = some rhs' at rhs'_eq
+          injection lhs'_eq with lhs'_eq
+          injection rhs'_eq with rhs'_eq
+          subst lhs'
+          subst rhs'
+          rw [ih₁ equal.1 lhs₁_tr rhs₁_tr,
+            ih₂ equal.2 lhs₂_tr rhs₂_tr]
+      | zero | succ _ | max _ _ | param _ | mvar _ =>
+          simp_all [levelStructEq]
+  | param lhsName =>
+      cases rhs <;> simp_all [levelStructEq, VLevel.ofLevel]
+  | mvar lhsId =>
+      simp [VLevel.ofLevel] at lhs_tr
+
+/-- The transparent fast path used by constructor validation implies the
+Theory universe inequality required by `fieldsWF`. -/
+theorem levelStructGe_ofLevel
+    (greater : levelStructGe result field = true)
+    (result_tr : VLevel.ofLevel Us result = some result')
+    (field_tr : VLevel.ofLevel Us field = some field') :
+    field' ≤ result' := by
+  induction result generalizing field result' field' with
+  | zero =>
+      cases field with
+      | zero =>
+          change some (.zero : VLevel) = some result' at result_tr
+          change some (.zero : VLevel) = some field' at field_tr
+          injection result_tr with result_tr
+          injection field_tr with field_tr
+          subst result'
+          subst field'
+          exact VLevel.le_refl _
+      | succ _ | max _ _ | imax _ _ | param _ | mvar _ =>
+          simp_all [levelStructGe, levelStructEq]
+  | succ result ih =>
+      cases field with
+      | zero =>
+          change some (.zero : VLevel) = some field' at field_tr
+          injection field_tr with field_tr
+          subst field'
+          exact VLevel.zero_le
+      | succ field =>
+          simp only [levelStructGe] at greater
+          simp only [VLevel.ofLevel, Option.bind_eq_bind] at result_tr field_tr
+          obtain ⟨result'', result_inner_tr, result'_eq⟩ :=
+            Option.bind_eq_some_iff.mp result_tr
+          obtain ⟨field'', field_inner_tr, field'_eq⟩ :=
+            Option.bind_eq_some_iff.mp field_tr
+          change some result''.succ = some result' at result'_eq
+          change some field''.succ = some field' at field'_eq
+          injection result'_eq with result'_eq
+          injection field'_eq with field'_eq
+          subst result'
+          subst field'
+          exact VLevel.succ_le_succ
+            (ih greater result_inner_tr field_inner_tr)
+      | max _ _ | imax _ _ | param _ | mvar _ =>
+          have equal := levelStructEq_ofLevel (Us := Us)
+            (by simpa [levelStructGe] using greater) result_tr field_tr
+          cases equal
+          exact VLevel.le_refl _
+  | max result₁ result₂ ih₁ ih₂ =>
+      cases field with
+      | zero =>
+          change some (.zero : VLevel) = some field' at field_tr
+          injection field_tr with field_tr
+          subst field'
+          exact VLevel.zero_le
+      | succ _ | max _ _ | imax _ _ | param _ | mvar _ =>
+          have equal := levelStructEq_ofLevel (Us := Us)
+            (by simpa [levelStructGe] using greater) result_tr field_tr
+          cases equal
+          exact VLevel.le_refl _
+  | imax result₁ result₂ ih₁ ih₂ =>
+      cases field with
+      | zero =>
+          change some (.zero : VLevel) = some field' at field_tr
+          injection field_tr with field_tr
+          subst field'
+          exact VLevel.zero_le
+      | succ _ | max _ _ | imax _ _ | param _ | mvar _ =>
+          have equal := levelStructEq_ofLevel (Us := Us)
+            (by simpa [levelStructGe] using greater) result_tr field_tr
+          cases equal
+          exact VLevel.le_refl _
+  | param resultName =>
+      cases field with
+      | zero =>
+          change some (.zero : VLevel) = some field' at field_tr
+          injection field_tr with field_tr
+          subst field'
+          exact VLevel.zero_le
+      | succ _ | max _ _ | imax _ _ | param _ | mvar _ =>
+          have equal := levelStructEq_ofLevel (Us := Us)
+            (by simpa [levelStructGe] using greater) result_tr field_tr
+          cases equal
+          exact VLevel.le_refl _
+  | mvar resultId =>
+      simp [VLevel.ofLevel] at result_tr
+
+/-- The impredicative fallback is exact: a kernel level recognized as zero
+translates to Theory's zero level. -/
+theorem ofLevel_eq_zero_of_isZero
+    (zero : level.isZero = true)
+    (level_tr : VLevel.ofLevel Us level = some level') :
+    level' = .zero := by
+  cases level <;> simp_all [Level.isZero, VLevel.ofLevel]
+
+/-- Executable universe comparison supported by the semantic proof.
+
+The structural and impredicative `Prop` branches mirror the ordinary
+validator directly.  A normalized non-`Prop` comparison is admitted only
+when Lean's ordinary `Level.geq` decision and the verified project `geq'`
+decision both succeed.  The former preserves the kernel-facing acceptance
+boundary; the latter supplies the semantic inequality without trusting
+Lean's opaque normalizer. -/
+def constructorUniverseSemanticGe (resultLevel fieldLevel : Level) : Bool :=
+  levelStructGe resultLevel fieldLevel ||
+    (resultLevel.isZero ||
+      (resultLevel.geq fieldLevel && resultLevel.geq' fieldLevel))
+
+/-- Replay just the universe-bearing part of one constructor telescope.
+
+The traversal deliberately follows the validator's parameter substitution,
+ordinary-field local contexts, annotation consumption, and recursion fuel.
+Unlike `checkConstructorType`, its normalized fallback also requires the
+proved project comparison above.  Running this audit in addition to the
+ordinary validator is therefore an executable verified intersection, not a
+replacement validator and not a proof-only semantic premise. -/
+def checkConstructorUniverseSemantics (stats : InductiveStats) (t : Expr) :
+    M Unit := do
+  loop t 0 (← readThe Context).fuel.inductiveFuel
+where
+  loop (t : Expr) (i : Nat) : Nat → M Unit
+    | 0 => throw .deepRecursion
+    | fuel + 1 => do
+      if let .forallE name domain body binderInfo := t then
+        if let some parameter := stats.params[i]? then
+          loop (body.instantiate1 parameter) (i + 1) fuel
+        else
+          let sortResult ← ensureType domain
+          unless constructorUniverseSemanticGe stats.resultLevel
+              sortResult.sortLevel! do
+            throw <| .other
+              "constructor universe lies outside the verified semantic subset"
+          withLocalDecl name binderInfo (consumeTypeAnnotations domain) fun arg =>
+            loop (body.instantiate1 arg) (i + 1) fuel
+
+/-- Source-ordered universe audit for every constructor in one singleton
+family.  Constructor names and types come from the same indexed source list
+as `ConstructorListValidationTrace`; all non-universe validation remains in
+that retained ordinary trace. -/
+def checkConstructorUniverseListSemantics (stats : InductiveStats) :
+    List Constructor → M Unit
+  | [] => pure ()
+  | constructor :: constructors => do
+      checkConstructorUniverseSemantics stats constructor.type
+      checkConstructorUniverseListSemantics stats constructors
+
+/-- The executable semantic decision at the exact universe node retained by
+ordinary constructor validation. -/
+def ConstructorUniverseTrace.semantic
+    (_trace : ConstructorUniverseTrace resultLevel fieldLevel) : Bool :=
+  constructorUniverseSemanticGe resultLevel fieldLevel
+
+/-- Conjunction of the semantic universe decisions in one exact constructor
+telescope. Parameter and terminal nodes contribute no universe obligation. -/
+def ConstructorTypeValidationTrace.universeSemantics
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel) : Bool :=
+  match trace with
+  | .parameter _ _ _ _ _ _ _ _ _ _ _ _ tail =>
+      tail.universeSemantics
+  | .ordinary _ _ _ _ _ _ _ _ _ _ universeTrace _ tail =>
+      universeTrace.semantic && tail.universeSemantics
+  | .terminal _ _ _ _ _ _ => true
+
+/-- Source-ordered conjunction of every constructor telescope's semantic
+universe decisions. -/
+def ConstructorListValidationTrace.universeSemantics
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors) : Bool :=
+  match trace with
+  | .nil _ => true
+  | .cons _ _ _ _ _ _ typeTrace tailTrace =>
+      typeTrace.universeSemantics && tailTrace.universeSemantics
+
+/-- The complete semantic-universe gate attached to one retained ordinary
+constructor-validation run. -/
+def ConstructorValidationRun.universeSemantics
+    (validation : ConstructorValidationRun indType stats isUnsafe context) :
+    Bool :=
+  validation.trace.universeSemantics
+
+/-- Recover the state-bearing verified-checker execution erased by the
+ordinary constructor validator's `ensureType` observation. -/
+theorem ConstructorEnsureTypeStep.innerRun
+    (step : ConstructorEnsureTypeStep) (hvalid : step.Valid) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.ensureType step.source step.context.toTypeChecker
+          ({} : TypeChecker.State) = .ok (step.result, state) := by
+  unfold ConstructorEnsureTypeStep.Valid TypeChecker.M.run at hvalid
+  cases hrun : TypeChecker.ensureType step.source
+      { env := step.context.env
+        lctx := step.context.lctx
+        safety := step.context.safety
+        lparams := step.context.lparams
+        fuel := step.context.fuel }
+      ({} : TypeChecker.State) with
+  | error err =>
+      simp [StateT.run', Functor.map, Except.map, hrun] at hvalid
+  | ok pair =>
+      rcases pair with ⟨result, state⟩
+      have result_eq : result = step.result := by
+        simpa [StateT.run', Functor.map, Except.map, hrun] using hvalid
+      subst result
+      exact ⟨state, by simpa [Context.toTypeChecker] using hrun⟩
+
+/-- Theory interpretation of the exact `ensureType` execution retained for
+an ordinary constructor field. -/
+structure TypeChecker.EnsureTypeRun (env : VEnv) (Us : List Name)
+    (Δ : VLCtx) (source result : Expr) (source' : VExpr) where
+  context : VContext
+  venv_eq : context.venv = env
+  lparams_eq : context.lparams = Us
+  vlctx_eq : context.vlctx = Δ
+  state_wf : VState.WF context {}
+  source_tr : TrExprS env Us Δ source source'
+  resultLevel : Level
+  resultLevel' : VLevel
+  result_eq : result = .sort resultLevel
+  resultLevel_tr : VLevel.ofLevel Us resultLevel = some resultLevel'
+  source_type : env.HasType Us.length Δ.toCtx source' (.sort resultLevel')
+  run_eq : ∃ state : State,
+    ensureType source context.toContext ({} : State) = .ok (result, state)
+
+/-- Attach verified Theory meaning to one retained ordinary-field
+`ensureType` step in its exact post-family context. -/
+theorem TypeChecker.EnsureTypeRun.exists_ofConstructorStep
+    (step : ConstructorEnsureTypeStep) (hvalid : step.Valid)
+    (contextRun : CandidateContextRun step.context)
+    (source' : VExpr)
+    (source_tr : contextRun.context.TrExprS step.source source') :
+    Nonempty (EnsureTypeRun contextRun.context.venv
+      contextRun.context.lparams contextRun.context.vlctx
+      step.source step.result source') := by
+  obtain ⟨state, run⟩ := step.innerRun hvalid
+  rw [← contextRun.context_eq] at run
+  obtain ⟨_, _, _, _, translated, translated_tr, u, u', result_eq,
+      level_tr, source_type⟩ :=
+    (ensureType.WF source_tr) contextRun.state_wf step.result state run
+  have translated_def := translated_tr.uniq contextRun.context.Ewf
+    (.refl contextRun.context.Ewf contextRun.context.Δwf) source_tr
+  have source_type' := source_type.defeqU_l contextRun.context.Ewf
+    contextRun.context.Δwf translated_def
+  exact ⟨{
+    context := contextRun.context
+    venv_eq := rfl
+    lparams_eq := rfl
+    vlctx_eq := rfl
+    state_wf := contextRun.state_wf
+    source_tr := source_tr
+    resultLevel := u
+    resultLevel' := u'
+    result_eq := result_eq
+    resultLevel_tr := level_tr
+    source_type := source_type'
+    run_eq := ⟨state, run⟩ }⟩
+
+/-!
+## Exact post-family view alignment
+
+Constructor validation and constructor-candidate construction deliberately
+allocate their ordinary-field free variables from different reader states.
+The following audit therefore never compares those identifiers.  It follows
+the already-retained validation trace and instantiates the exact candidate
+view with the *validation* parameter/field expression at each position.
+Every comparison consequently happens in the real post-family local context,
+while the candidate itself still owns the view being inspected.
+-/
+
+/-- Number of parameter/ordinary binders consumed by one exact constructor
+validation trace. -/
+def ConstructorTypeValidationTrace.spineLength
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel) : Nat :=
+  match trace with
+  | .parameter _ _ _ _ _ _ _ _ _ _ _ _ tail => tail.spineLength + 1
+  | .ordinary _ _ _ _ _ _ _ _ _ _ _ _ tail => tail.spineLength + 1
+  | .terminal .. => 0
+
+/-- Every local declaration entered by a retained positivity traversal uses
+an identifier absent from the exact incoming local context.  This is an
+executable structural condition, not a semantic premise. -/
+def ConstructorPositivityTrace.freshNames
+    (trace : ConstructorPositivityTrace stats ctor argIdx context source fuel) :
+    Bool :=
+  match trace with
+  | .absent .. => true
+  | .forallE context _ _ _ _ _ _ _ _ _ tail =>
+      (context.lctx.find? context.freshFVarId).isNone && tail.freshNames
+  | .target .. => true
+
+def ConstructorPositivityModeTrace.freshNames
+    (trace : ConstructorPositivityModeTrace stats isUnsafe ctor argIdx
+      context source) : Bool :=
+  match trace with
+  | .skipped .. => true
+  | .safe _ trace => trace.freshNames
+
+/-- One exact full-check observation together with the syntactic premise used
+by the verified checker refinement.  Keeping the premise at the operational
+boundary avoids reconstructing free-variable membership later from binder
+names or from a parallel telescope. -/
+structure ConstructorCheckedExpr (context : Context) (source : Expr) where
+  fvars : source.FVarsIn
+    (fun fv => (context.lctx.find? fv).isSome = true)
+  observation : CandidateCheckTypeObservation context source
+
+/-- Retain an already verified full-check execution together with a structural
+scope proof for its exact source expression. -/
+def ConstructorCheckedExpr.ofRun
+    (fvars : source.FVarsIn
+      (fun fv => (context.lctx.find? fv).isSome = true))
+    (run : CandidateCheckTypeStep.Valid ⟨context, source, inferred⟩) :
+    ConstructorCheckedExpr context source :=
+  ⟨fvars, ⟨inferred, run⟩⟩
+
+private theorem constructorClosed_hasMVar_false
+    {env : Kernel.Environment} {name : Name} {source : Expr}
+    (closed : env.checkNoMVarNoFVar name source = .ok ()) :
+    source.hasMVar = false := by
+  unfold Kernel.Environment.checkNoMVarNoFVar
+    Kernel.Environment.checkNoMVar Kernel.Environment.checkNoFVar at closed
+  cases hmvars : source.hasMVar
+  · rfl
+  · simp [hmvars, Bind.bind, Except.bind] at closed
+
+private theorem constructorClosed_hasFVar_false
+    {env : Kernel.Environment} {name : Name} {source : Expr}
+    (closed : env.checkNoMVarNoFVar name source = .ok ()) :
+    source.hasFVar = false := by
+  have hmvars := constructorClosed_hasMVar_false closed
+  unfold Kernel.Environment.checkNoMVarNoFVar
+    Kernel.Environment.checkNoMVar Kernel.Environment.checkNoFVar at closed
+  cases hfvars : source.hasFVar
+  · rfl
+  · simp [hmvars, hfvars, Bind.bind, Except.bind, Pure.pure,
+      Except.pure] at closed
+
+/-- Constructor metadata accepted by the validator is closed, so its retained
+empty-context full-check observation directly supplies the D2 root scope. -/
+def ConstructorCheckedExpr.ofClosedRoot
+    {context : Context} {name : Name} {source : Expr}
+    (closed : context.env.checkNoMVarNoFVar name source = .ok ())
+    (observation : CandidateCheckTypeObservation
+      context.withEmptyLocalContext source) :
+    ConstructorCheckedExpr context.withEmptyLocalContext source where
+  fvars := fvarsIn_iff.2 ⟨by
+    intro fv present
+    have empty := fvarsList_eq_nil.mpr
+      (constructorClosed_hasFVar_false closed)
+    rw [empty] at present
+    contradiction,
+    fvarsIn_iff_hasMVar.2 (constructorClosed_hasMVar_false closed)⟩
+  observation := observation
+
+/-- Execute a full check only after confirming that every free variable of
+the exact source belongs to the retained implementation context. -/
+def checkConstructorAlignedExpr (context : Context) (source : Expr) :
+    Except Exception (ConstructorCheckedExpr context source) := do
+  if hfvars : source.fvarsList.all
+      (fun fv => (context.lctx.find? fv).isSome) = true then
+    if hmvars : source.hasMVar = false then
+      have fvars : source.FVarsIn
+          (fun fv => (context.lctx.find? fv).isSome = true) :=
+        fvarsIn_iff.2 ⟨by
+          intro fv hfv
+          have h := List.all_eq_true.mp hfvars fv hfv
+          exact h,
+        fvarsIn_iff_hasMVar.2 hmvars⟩
+      let observation ← observeCandidateCheckType context source
+      pure ⟨fvars, observation⟩
+    else
+      throw <| .other "constructor alignment source contains a metavariable"
+  else
+    throw <| .other "constructor alignment source escaped its local context"
+
+/-- Reuse an exact full-check execution to expose the successful result of
+the supplemental scope-aware checker boundary. -/
+theorem checkConstructorAlignedExpr.exists_of_run
+    (hfvars : source.fvarsList.all
+      (fun fv => (context.lctx.find? fv).isSome) = true)
+    (hmvars : source.hasMVar = false)
+    (hrun : CandidateCheckTypeStep.Valid ⟨context, source, inferred⟩) :
+    ∃ checked : ConstructorCheckedExpr context source,
+      checkConstructorAlignedExpr context source = .ok checked := by
+  unfold checkConstructorAlignedExpr
+  rw [dif_pos hfvars, dif_pos hmvars]
+  rw [observeCandidateCheckType_of_run context source inferred hrun]
+  exact ⟨_, rfl⟩
+
+/-- Re-executing the supplemental scope/full-check boundary reproduces any
+retained successful observation.  The only reconstructed fields are proofs,
+so proof irrelevance identifies the executable result with the retained
+value itself. -/
+theorem ConstructorCheckedExpr.check_eq
+    (checked : ConstructorCheckedExpr context source) :
+    checkConstructorAlignedExpr context source = .ok checked := by
+  have hfvars : source.fvarsList.all
+      (fun fv => (context.lctx.find? fv).isSome) = true := by
+    apply List.all_eq_true.mpr
+    intro fv present
+    exact (fvarsIn_iff.mp checked.fvars).1 fv present
+  have hmvars : source.hasMVar = false :=
+    fvarsIn_iff_hasMVar.mp (fvarsIn_iff.mp checked.fvars).2
+  unfold checkConstructorAlignedExpr
+  rw [dif_pos hfvars, dif_pos hmvars]
+  rw [observeCandidateCheckType_of_run context source
+    checked.observation.inferred checked.observation.valid]
+  cases checked
+  rfl
+
+/-- Determinism of the erased implementation run pins a retained full-check
+observation to any independently proved result of that same exact check. -/
+theorem ConstructorCheckedExpr.inferred_eq_of_run
+    (checked : ConstructorCheckedExpr context source)
+    (hrun : CandidateCheckTypeStep.Valid ⟨context, source, inferred⟩) :
+    checked.observation.inferred = inferred := by
+  have retained := checked.observation.valid
+  unfold CandidateCheckTypeStep.Valid at retained hrun
+  rw [hrun] at retained
+  exact (Except.ok.inj retained).symm
+
+/-- Re-executing a retained equality observation returns that same
+observation; its sole field is proof-valued. -/
+theorem CandidateIsDefEqObservation.observe_eq
+    (observation : CandidateIsDefEqObservation context lhs rhs) :
+    observeCandidateIsDefEq context lhs rhs = .ok observation := by
+  rw [observeCandidateIsDefEq_of_run context lhs rhs observation.valid]
+
+/-- The verified implementation equality checker accepts a syntactically
+identical pair without inspecting or extending its success cache. -/
+theorem candidateIsDefEqRefl
+    (context : Context) (source : Expr) :
+    CandidateIsDefEqStep.Valid ⟨context, source, source⟩ := by
+  unfold CandidateIsDefEqStep.Valid TypeChecker.M.run TypeChecker.isDefEq
+    TypeChecker.RecM.run TypeChecker.Inner.isDefEq
+  simp [readThe, MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind,
+    StateT.bind, Except.bind, StateT.pure, Except.pure, Pure.pure,
+    StateT.run', Functor.map, Except.map]
+  rfl
+
+/-- Convert the executable implementation-context scope check to the exact
+Theory free-variable premise used by verified `checkType` refinement. -/
+theorem ConstructorCheckedExpr.fvarsIn
+    (checked : ConstructorCheckedExpr context source)
+    (contextRun : TypeChecker.CandidateContextRun context) :
+    source.FVarsIn (· ∈ contextRun.context.vlctx.fvars) := by
+  apply checked.fvars.mono
+  intro fv present
+  have implementationPresent :
+      ∃ declaration, context.lctx.find? fv = some declaration := by
+    simpa only [Option.isSome_iff_exists] using present
+  have verifiedPresent :
+      ∃ declaration, contextRun.context.lctx.find? fv = some declaration := by
+    simpa only [contextRun.context_lctx] using implementationPresent
+  apply contextRun.context.trlctx.find?_eq_some.mp
+  change ∃ declaration,
+    contextRun.context.mlctx.lctx.find? fv = some declaration
+  rw [contextRun.context.lctx_eq]
+  exact verifiedPresent
+
+/-- Verified meaning of one full check retained by the alignment audit.  Both
+Theory endpoints are selected by the checker refinement; callers cannot
+substitute an unrelated translation for the exact source position. -/
+structure ConstructorCheckedExpr.Run
+    (checked : ConstructorCheckedExpr context source)
+    (contextRun : TypeChecker.CandidateContextRun context) where
+  source' : VExpr
+  inferred' : VExpr
+  check : TypeChecker.CheckTypeRun contextRun.context.venv
+    contextRun.context.lparams contextRun.context.vlctx source
+    checked.observation.inferred source' inferred'
+
+/-- Interpret an aligned full-check observation in its exact verified
+post-family context. -/
+theorem ConstructorCheckedExpr.Run.exists
+    (checked : ConstructorCheckedExpr context source)
+    (contextRun : TypeChecker.CandidateContextRun context) :
+    Nonempty (ConstructorCheckedExpr.Run checked contextRun) := by
+  obtain ⟨source', inferred', ⟨check⟩⟩ :=
+    TypeChecker.CheckTypeRun.exists_ofCandidateStepFVars
+      ⟨context, source, checked.observation.inferred⟩
+      checked.observation.valid contextRun (checked.fvarsIn contextRun)
+  exact ⟨⟨source', inferred', check⟩⟩
+
+/-- A retained full check whose implementation result is syntactically a
+sort supplies the exact Theory `IsType` premise needed to extend the local
+context. -/
+theorem ConstructorCheckedExpr.Run.isType_of_inferredSort
+    (run : ConstructorCheckedExpr.Run checked contextRun)
+    (inferred_eq : checked.observation.inferred = .sort u) :
+    contextRun.context.IsType run.source' := by
+  rcases run with ⟨source', inferred', check⟩
+  have inferred_tr := check.inferred_tr
+  rw [inferred_eq] at inferred_tr
+  cases inferred_tr
+  exact check.isType
+
+/-- Reuse a proved scope boundary with the exact full-check observation owned
+by another retained execution of the same source expression. -/
+def ConstructorCheckedExpr.withObservation
+    (scope : ConstructorCheckedExpr context source)
+    (observation : CandidateCheckTypeObservation context source) :
+    ConstructorCheckedExpr context source :=
+  ⟨scope.fvars, observation⟩
+
+/-- Interpret one retained equality observation at the exact Theory
+translations selected by the two aligned full checks. -/
+def ConstructorCheckedExpr.Run.isDefEq
+    {context : Context} {lhs rhs : Expr}
+    {lhsCheck : ConstructorCheckedExpr context lhs}
+    {rhsCheck : ConstructorCheckedExpr context rhs}
+    {contextRun : TypeChecker.CandidateContextRun context}
+    (lhsRun : ConstructorCheckedExpr.Run lhsCheck contextRun)
+    (rhsRun : ConstructorCheckedExpr.Run rhsCheck contextRun)
+    (observation : CandidateIsDefEqObservation context lhs rhs) :
+    TypeChecker.IsDefEqRun contextRun.context.venv
+      contextRun.context.lparams contextRun.context.vlctx lhs rhs
+      lhsRun.source' rhsRun.source' :=
+  TypeChecker.IsDefEqRun.ofCandidateStep
+    ⟨context, lhs, rhs⟩ observation.valid contextRun.context
+    contextRun.context_eq rfl rfl rfl contextRun.state_wf
+    lhsRun.check.expr_tr rhsRun.check.expr_tr context.fuel.recDepth rfl
+
+/-- A validation-local verified context pinned to the one post-family Theory
+environment and universe-parameter list used by the whole constructor list. -/
+structure ConstructorContextRun (env : VEnv) (Us : List Name)
+    (context : Context) where
+  candidate : TypeChecker.CandidateContextRun context
+  venv_eq : candidate.context.venv = env
+  lparams_eq : candidate.context.lparams = Us
+
+def ConstructorContextRun.withEmptyLocalContext
+    (run : ConstructorContextRun env Us context) :
+    ConstructorContextRun env Us context.withEmptyLocalContext where
+  candidate := run.candidate.withEmptyLocalContext
+  venv_eq := run.venv_eq
+  lparams_eq := run.lparams_eq
+
+/-- Extend the actual post-family verified context by exactly one retained
+validation local declaration. -/
+def ConstructorContextRun.pushLocalDecl
+    (run : ConstructorContextRun env Us context)
+    (name : Name) (binderInfo : BinderInfo) (domain : Expr)
+    (fresh : context.lctx.find? context.freshFVarId = none)
+    (domain' : VExpr)
+    (domain_tr : run.candidate.context.TrExprS domain domain')
+    (domain_type : run.candidate.context.IsType domain') :
+    ConstructorContextRun env Us
+      (context.pushLocalDecl name binderInfo domain) := by
+  let candidate := run.candidate.pushLocalDecl name binderInfo domain fresh
+    domain' domain_tr domain_type
+  refine ⟨candidate, ?_, ?_⟩
+  · calc
+      candidate.context.venv = run.candidate.context.venv := by
+        simp [candidate]
+      _ = env := run.venv_eq
+  · calc
+      candidate.context.lparams = run.candidate.context.lparams := by
+        simp [candidate, AddInductive.Context.pushLocalDecl]
+      _ = Us := run.lparams_eq
+
+/-- Verified interpretation of one exact retained WHNF operation, sharing the
+source translation already selected by its aligned full check. -/
+structure ConstructorWhnfRun
+    {context : Context} {source : Expr}
+    {sourceCheck : ConstructorCheckedExpr context source}
+    (contextRun : TypeChecker.CandidateContextRun context)
+    (sourceRun : ConstructorCheckedExpr.Run sourceCheck contextRun)
+    (result : Expr) where
+  result' : VExpr
+  result_tr : contextRun.context.TrExprS result result'
+  whnf : TypeChecker.WhnfRun contextRun.context.venv
+    contextRun.context.lparams contextRun.context.vlctx source result
+    sourceRun.source' result'
+
+theorem ConstructorWhnfRun.exists
+    {context : Context} {source result : Expr}
+    {sourceCheck : ConstructorCheckedExpr context source}
+    (contextRun : TypeChecker.CandidateContextRun context)
+    (sourceRun : ConstructorCheckedExpr.Run sourceCheck contextRun)
+    (valid : CandidateWhnfStep.Valid ⟨context, source, result⟩)
+    (recursionFuel : Nat)
+    (depth : context.fuel.recDepth = recursionFuel + 1) :
+    Nonempty (ConstructorWhnfRun contextRun sourceRun result) := by
+  obtain ⟨result', result_tr, ⟨whnf⟩⟩ :=
+    TypeChecker.WhnfRun.exists_ofCandidateStep
+      ⟨context, source, result⟩ valid contextRun sourceRun.source'
+      sourceRun.check.expr_tr recursionFuel depth
+  exact ⟨⟨result', result_tr, whnf⟩⟩
+
+/-- Retained operational evidence for the supplemental nested-positivity
+alignment.  The ordinary positivity trace continues to own every WHNF,
+occurrence decision, and accepted recursive target.  This trace adds the full
+checks and annotation equality needed to interpret those exact operations in
+the verified checker. -/
+inductive ConstructorPositivityAlignmentTrace :
+    {stats : InductiveStats} → {ctor : Name} → {argIdx : Nat} →
+    {context : Context} → {source : Expr} → {fuel : Nat} →
+    ConstructorPositivityTrace stats ctor argIdx context source fuel → Type where
+  | absent
+      (sourceCheck : ConstructorCheckedExpr context source) :
+      ConstructorPositivityAlignmentTrace
+        (.absent context source result fuel whnfStep occurs)
+  | forallE
+      (sourceCheck : ConstructorCheckedExpr context source)
+      (domainCheck : ConstructorCheckedExpr context domain)
+      (consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain))
+      (consumedLevel : Level)
+      (consumedInferred : consumedCheck.observation.inferred =
+        .sort consumedLevel)
+      (fresh : context.lctx.find? context.freshFVarId = none)
+      (annotations : CandidateIsDefEqObservation context domain
+        (consumeTypeAnnotations domain))
+      (tailTrace : ConstructorPositivityTrace stats ctor argIdx
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) fuel)
+      (tail : ConstructorPositivityAlignmentTrace tailTrace) :
+      ConstructorPositivityAlignmentTrace
+        (.forallE context source fuel name domain body binderInfo whnfStep occurs
+          domainFree tailTrace)
+  | target
+      (sourceCheck : ConstructorCheckedExpr context source) :
+      ConstructorPositivityAlignmentTrace
+        (.target context source result fuel targetIdx whnfStep occurs terminal
+          valid)
+
+namespace ConstructorPositivityAlignmentTrace
+
+def build :
+    (positivityTrace : ConstructorPositivityTrace stats ctor argIdx context
+      source fuel) →
+      Except Exception (ConstructorPositivityAlignmentTrace positivityTrace)
+  | .absent context source _ fuel whnfStep occurs => do
+      let sourceCheck ← checkConstructorAlignedExpr context source
+      pure <| .absent sourceCheck
+  | .forallE context source fuel _ domain _ _ _ occurs
+      domainFree tailTrace => do
+      let sourceCheck ← checkConstructorAlignedExpr context source
+      let domainCheck ← checkConstructorAlignedExpr context domain
+      let consumedCheck ← checkConstructorAlignedExpr context
+        (consumeTypeAnnotations domain)
+      match consumedInferred : consumedCheck.observation.inferred with
+      | .sort consumedLevel =>
+        if fresh : context.lctx.find? context.freshFVarId = none then
+          let annotations ← observeCandidateIsDefEq context domain
+            (consumeTypeAnnotations domain)
+          let tail ← build tailTrace
+          pure <| .forallE sourceCheck domainCheck consumedCheck consumedLevel
+            consumedInferred fresh annotations tailTrace tail
+        else
+          throw <| .other "positivity traversal reused a local identifier"
+      | _ =>
+        throw <| .other
+          "consumed positivity domain did not check as a type"
+  | .target context source _ fuel _ _ occurs terminal
+      valid => do
+      let sourceCheck ← checkConstructorAlignedExpr context source
+      pure <| .target sourceCheck
+
+/-- Executable erasure of the retained positivity alignment. -/
+def check (positivityTrace : ConstructorPositivityTrace stats ctor argIdx
+    context source fuel) : M Unit := fun _ =>
+  (ConstructorPositivityAlignmentTrace.build positivityTrace).map fun _ => ()
+
+theorem nonempty_of_check
+    {positivityTrace : ConstructorPositivityTrace stats ctor argIdx context
+      source fuel}
+    (success : ConstructorPositivityAlignmentTrace.check positivityTrace
+      context = .ok ()) :
+    Nonempty (ConstructorPositivityAlignmentTrace positivityTrace) := by
+  unfold check at success
+  cases h : ConstructorPositivityAlignmentTrace.build positivityTrace with
+  | error error =>
+      rw [h] at success
+      change Except.error error = Except.ok () at success
+      contradiction
+  | ok alignment => exact ⟨alignment⟩
+
+end ConstructorPositivityAlignmentTrace
+
+inductive ConstructorPositivityModeAlignmentTrace :
+    {stats : InductiveStats} → {isUnsafe : Bool} → {ctor : Name} →
+    {argIdx : Nat} → {context : Context} → {source : Expr} →
+    ConstructorPositivityModeTrace stats isUnsafe ctor argIdx context source →
+      Type where
+  | skipped : ConstructorPositivityModeAlignmentTrace (.skipped unsafeEq)
+  | safe (alignment : ConstructorPositivityAlignmentTrace positivityTrace) :
+      ConstructorPositivityModeAlignmentTrace (.safe unsafeEq positivityTrace)
+
+namespace ConstructorPositivityModeAlignmentTrace
+
+def build :
+    (positivityTrace : ConstructorPositivityModeTrace stats isUnsafe ctor
+      argIdx context source) →
+      Except Exception
+        (ConstructorPositivityModeAlignmentTrace positivityTrace)
+  | .skipped _ => pure <| .skipped
+  | .safe _ positivityTrace => do
+      let alignment ← ConstructorPositivityAlignmentTrace.build
+        positivityTrace
+      pure <| .safe alignment
+
+def check (positivityTrace : ConstructorPositivityModeTrace stats isUnsafe
+    ctor argIdx context source) : M Unit := fun _ =>
+  (ConstructorPositivityModeAlignmentTrace.build positivityTrace).map fun _ => ()
+
+theorem nonempty_of_check
+    {positivityTrace : ConstructorPositivityModeTrace stats isUnsafe ctor
+      argIdx context source}
+    (success : ConstructorPositivityModeAlignmentTrace.check positivityTrace
+      context = .ok ()) :
+    Nonempty (ConstructorPositivityModeAlignmentTrace positivityTrace) := by
+  unfold check at success
+  cases h : ConstructorPositivityModeAlignmentTrace.build positivityTrace with
+  | error error =>
+      rw [h] at success
+      change Except.error error = Except.ok () at success
+      contradiction
+  | ok alignment => exact ⟨alignment⟩
+
+end ConstructorPositivityModeAlignmentTrace
+
+/-- Exact operational alignment between one retained validation telescope and
+the analyzer-owned kernel view.  The recursive indices instantiate the view
+with validation-owned parameters and fields, so no equality between the
+producer's and validator's fresh free-variable identifiers is assumed. -/
+inductive ConstructorViewAlignmentTrace :
+    {stats : InductiveStats} → {isUnsafe : Bool} → {familyIdx : Nat} →
+    {ctor : Name} → {context : Context} → {source : Expr} →
+    {argIdx fuel : Nat} →
+    ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor context
+      source argIdx fuel →
+    (view : Expr) → Type where
+  | parameter
+      (domainCheck : ConstructorCheckedExpr context domain)
+      (viewDomainCheck : ConstructorCheckedExpr context viewDomain)
+      (parameterTypeCheck : ConstructorCheckedExpr context parameterType)
+      (parameterShape : param = .fvar fv)
+      (parameterPresent : (context.lctx.find? fv).isSome = true)
+      (tailTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context (body.instantiate1 param) (argIdx + 1) fuel)
+      (tail : ConstructorViewAlignmentTrace tailTrace
+        (viewBody.instantiate1 param)) :
+      ConstructorViewAlignmentTrace
+        (.parameter context fuel argIdx name domain body binderInfo param
+          parameterType parameterAt parameterTypeRun validationDefEq tailTrace)
+        (.forallE viewName viewDomain viewBody viewBinderInfo)
+  | ordinary
+      (domainCheck : ConstructorCheckedExpr context domain)
+      (viewDomainCheck : ConstructorCheckedExpr context viewDomain)
+      (viewEquality : CandidateIsDefEqObservation context domain viewDomain)
+      (consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain))
+      (positivityTrace : ConstructorPositivityModeTrace stats isUnsafe ctor
+        argIdx context domain)
+      (positivityAlignment :
+        ConstructorPositivityModeAlignmentTrace positivityTrace)
+      (fresh : context.lctx.find? context.freshFVarId = none)
+      (annotations : CandidateIsDefEqObservation context domain
+        (consumeTypeAnnotations domain))
+      (tailTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) fuel)
+      (tail : ConstructorViewAlignmentTrace tailTrace
+        (viewBody.instantiate1 context.freshExpr)) :
+      ConstructorViewAlignmentTrace
+        (.ordinary context fuel argIdx name domain body binderInfo sortResult
+          noParameter ensureTypeStep universeTrace positivityTrace tailTrace)
+        (.forallE viewName viewDomain viewBody viewBinderInfo)
+  | terminal
+      (sourceCheck : ConstructorCheckedExpr context source)
+      (viewCheck : ConstructorCheckedExpr context view)
+      (viewTerminal : view.isForall = false)
+      (viewValid : isValidIndAppIdx stats view familyIdx = true) :
+      ConstructorViewAlignmentTrace
+        (.terminal context source fuel argIdx sourceTerminal sourceValid) view
+
+namespace ConstructorViewAlignmentTrace
+
+/-- Execute the exact component audit and retain every successful checker
+observation.  This is intentionally not a second `checkConstructors` run: the
+raw branch shape, parameter selection, universe decision, positivity target,
+and raw terminal acceptance remain owned by the ordinary validation trace. -/
+def build :
+    (validationTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx
+      ctor context source argIdx fuel) →
+    (view : Expr) →
+      Except Exception (ConstructorViewAlignmentTrace validationTrace view)
+  | .parameter context parameterFuel parameterArgIdx parameterName domain
+      parameterBody parameterBinderInfo param parameterType _
+      _ _ tailTrace,
+      .forallE viewName viewDomain viewBody viewBinderInfo => do
+      let domainCheck ← checkConstructorAlignedExpr context domain
+      let viewDomainCheck ← checkConstructorAlignedExpr context viewDomain
+      let parameterTypeCheck ← checkConstructorAlignedExpr context
+        parameterType
+      match hparam : param with
+      | .fvar fv =>
+        if parameterPresent : (context.lctx.find? fv).isSome = true then
+          let tail ← build tailTrace
+            (viewBody.instantiate1 param)
+          pure <| .parameter domainCheck viewDomainCheck parameterTypeCheck
+            hparam parameterPresent tailTrace tail
+        else
+          throw <| .other
+            "constructor parameter is absent from validation context"
+      | _ =>
+        throw <| .other "constructor parameter is not a local variable"
+  | .parameter .., _ =>
+      throw <| .other "candidate and validation constructor telescopes differ"
+  | .ordinary context ordinaryFuel ordinaryArgIdx name domain body binderInfo
+      _ _ _ _ positivityTrace tailTrace,
+      .forallE viewName viewDomain viewBody viewBinderInfo => do
+      let domainCheck ← checkConstructorAlignedExpr context domain
+      let viewDomainCheck ← checkConstructorAlignedExpr context viewDomain
+      let viewEquality ← observeCandidateIsDefEq context domain viewDomain
+      let consumedCheck ← checkConstructorAlignedExpr context
+        (consumeTypeAnnotations domain)
+      let positivityAlignment ←
+        ConstructorPositivityModeAlignmentTrace.build positivityTrace
+      if fresh : context.lctx.find? context.freshFVarId = none then
+        let annotations ← observeCandidateIsDefEq context domain
+          (consumeTypeAnnotations domain)
+        let tail ← build tailTrace
+          (viewBody.instantiate1 context.freshExpr)
+        pure <| .ordinary domainCheck viewDomainCheck viewEquality consumedCheck
+          positivityTrace positivityAlignment fresh annotations tailTrace tail
+      else
+        throw <| .other "constructor validation reused a local identifier"
+  | .ordinary .., _ =>
+      throw <| .other "candidate and validation constructor telescopes differ"
+  | .terminal context source fuel argIdx sourceTerminal sourceValid, view => do
+      let sourceCheck ← checkConstructorAlignedExpr context source
+      let viewCheck ← checkConstructorAlignedExpr context view
+      if viewTerminal : view.isForall = false then
+        if viewValid : isValidIndAppIdx stats view familyIdx = true then
+          pure <| .terminal sourceCheck viewCheck viewTerminal viewValid
+        else
+          throw <| .other
+            "candidate view changed the terminal family application"
+      else
+        throw <| .other "candidate view has an extra constructor field"
+
+def check (validationTrace : ConstructorTypeValidationTrace stats isUnsafe
+    familyIdx ctor context source argIdx fuel) (view : Expr) : M Unit :=
+  fun _ => (build validationTrace view).map fun _ => ()
+
+theorem nonempty_of_check
+    {validationTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx
+      ctor context source argIdx fuel}
+    (success : check validationTrace view context = .ok ()) :
+    Nonempty (ConstructorViewAlignmentTrace validationTrace view) := by
+  unfold check at success
+  cases h : build validationTrace view with
+  | error error =>
+      rw [h] at success
+      change Except.error error = Except.ok () at success
+      contradiction
+  | ok alignment => exact ⟨alignment⟩
+
+end ConstructorViewAlignmentTrace
+
+/-- Supplemental checker audit for the exact analyzer-owned view of one
+constructor.  It follows the validation telescope and instantiates the view
+with validation-owned locals; successful execution retains no rewritten
+declaration and claims no independent view acceptance. -/
+def ConstructorTypeValidationTrace.checkViewAlignment
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel) (view : Expr) : M Unit :=
+  ConstructorViewAlignmentTrace.check trace view
+
+/-- Source-ordered retained alignment for the complete constructor list.
+The source indices make omission, duplication, and reordering unrepresentable.
+Each node also retains the closed-root scope check needed to interpret the
+validator's original empty-local-context `checkType` observation. -/
+inductive ConstructorCandidateAlignmentTrace
+    (stats : InductiveStats) (isUnsafe : Bool) (familyIdx : Nat)
+    (context : Context) :
+    {seen : NameSet} → {constructors : List Constructor} →
+    (validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors) →
+    AddInductive.CandidateList AddInductive.CandidateConstructor constructors →
+      Type where
+  | nil (seen : NameSet) :
+      ConstructorCandidateAlignmentTrace stats isUnsafe familyIdx context
+        (.nil seen) .nil
+  | cons
+      {seen : NameSet} {head : Constructor} {tail : List Constructor}
+      {fresh : seen.contains head.name = false}
+      {closed : context.env.checkNoMVarNoFVar head.name head.type = .ok ()}
+      {rootCheck : CandidateCheckTypeObservation
+        context.withEmptyLocalContext head.type}
+      {typeTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx
+        head.name context head.type 0 context.fuel.inductiveFuel}
+      {tailTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+        context (seen.insert head.name) tail}
+      {candidate : AddInductive.CandidateConstructor head}
+      {candidates : AddInductive.CandidateList
+        AddInductive.CandidateConstructor tail}
+      (rootScope : ConstructorCheckedExpr context.withEmptyLocalContext
+        head.type)
+      (storedSpine : candidate.type.trace.storedSpine = true)
+      (spineLength : candidate.type.trace.spineLength =
+        typeTrace.spineLength)
+      (candidateDepth : candidate.type.context.fuel.recDepth =
+        context.fuel.recDepth)
+      (headAlignment : ConstructorViewAlignmentTrace typeTrace
+        candidate.type.view)
+      (tailAlignment : ConstructorCandidateAlignmentTrace stats isUnsafe
+        familyIdx context tailTrace candidates) :
+      ConstructorCandidateAlignmentTrace stats isUnsafe familyIdx context
+        (.cons seen head tail fresh closed rootCheck typeTrace tailTrace)
+        (.cons candidate candidates)
+
+namespace ConstructorCandidateAlignmentTrace
+
+/-- Execute the source-ordered constructor alignment and retain all successful
+component checks.  The candidate list's dependent source index selects the
+same constructor at every recursive position as the validation trace. -/
+def build :
+    (validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors) →
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors) →
+      Except Exception
+        (ConstructorCandidateAlignmentTrace stats isUnsafe familyIdx context
+          validationTrace candidates)
+  | .nil seen, .nil => pure <| .nil seen
+  | .cons seen head tail _ _ _ typeTrace tailTrace,
+      .cons candidate candidates => do
+      let rootScope ← checkConstructorAlignedExpr
+        context.withEmptyLocalContext head.type
+      if storedSpine : candidate.type.trace.storedSpine = true then
+        if spineLength : candidate.type.trace.spineLength =
+            typeTrace.spineLength then
+          if candidateDepth : candidate.type.context.fuel.recDepth =
+              context.fuel.recDepth then
+            let headAlignment ← ConstructorViewAlignmentTrace.build typeTrace
+              candidate.type.view
+            let tailAlignment ← build tailTrace candidates
+            pure <| .cons rootScope storedSpine spineLength candidateDepth
+              headAlignment tailAlignment
+          else
+            throw <| .other
+              "candidate and validation checker depths differ"
+        else
+          throw <| .other
+            "candidate and validation constructor lengths differ"
+      else
+        throw <| .other
+          "candidate constructor did not preserve its stored spine"
+
+def check
+    (validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors)
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors) : M Unit :=
+  fun _ => (build validationTrace candidates).map fun _ => ()
+
+theorem nonempty_of_check
+    {validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors}
+    (success : check validationTrace candidates context = .ok ()) :
+    Nonempty (ConstructorCandidateAlignmentTrace stats isUnsafe familyIdx
+      context validationTrace candidates) := by
+  unfold check at success
+  cases h : build validationTrace candidates with
+  | error error =>
+      rw [h] at success
+      change Except.error error = Except.ok () at success
+      contradiction
+  | ok alignment => exact ⟨alignment⟩
+
+/-- A successful alignment audit guarantees the retained builder returns its
+trace, so audit owners can replay `build` instead of choosing from
+`Nonempty`. -/
+theorem build_ok_of_check
+    {validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors}
+    (success : check validationTrace candidates context = .ok ()) :
+    ∃ alignment, build validationTrace candidates = .ok alignment := by
+  unfold check at success
+  cases h : build validationTrace candidates with
+  | error error =>
+      rw [h] at success
+      change Except.error error = Except.ok () at success
+      contradiction
+  | ok alignment => exact ⟨alignment, rfl⟩
+
+end ConstructorCandidateAlignmentTrace
+
+/-- Source-ordered supplemental alignment audit for every exact constructor
+candidate selected by the producer.  The dependent list indices rule out
+truncation, reordering, duplication, or a view from another source position.
+The Boolean gates additionally pin the candidate main-spine length to the
+retained validation telescope. -/
+def ConstructorListValidationTrace.checkCandidateAlignment
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors)
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors) : M Unit :=
+  ConstructorCandidateAlignmentTrace.check trace candidates
+
+/-!
+## Verified interpretation of the aligned validation telescope
+
+The following semantic traces contain only executions refined by the verified
+checker.  Their indices still carry the ordinary validator's branch choices
+and exact candidate view, while `ConstructorContextRun` fixes every recursive
+local context to the actual post-family Theory environment.
+-/
+
+/-- Verified interpretation of every exact WHNF and nested binder visited by
+one retained positivity traversal. -/
+inductive ConstructorPositivitySemanticRun
+    (env : VEnv) (Us : List Name) (whnfFuel : Nat) :
+    {stats : InductiveStats} → {ctor : Name} → {argIdx : Nat} →
+    {context : Context} → {source : Expr} → {fuel : Nat} →
+    (contextRun : ConstructorContextRun env Us context) →
+    ConstructorPositivityTrace stats ctor argIdx context source fuel → Type where
+  | absent
+      {stats : InductiveStats} {ctor : Name} {argIdx : Nat}
+      {context : Context} {source result : Expr} {fuel : Nat}
+      {whnfStep : CandidateWhnfStep.Valid ⟨context, source, result⟩}
+      {occurs : hasIndOcc stats.indConsts result = false}
+      {sourceCheck : ConstructorCheckedExpr context source}
+      {contextRun : ConstructorContextRun env Us context}
+      (depth : context.fuel.recDepth = whnfFuel + 1)
+      (sourceRun : ConstructorCheckedExpr.Run sourceCheck
+        contextRun.candidate)
+      (whnfRun : ConstructorWhnfRun contextRun.candidate sourceRun result) :
+      ConstructorPositivitySemanticRun env Us whnfFuel contextRun
+        (.absent context source result fuel whnfStep occurs)
+  | forallE
+      {stats : InductiveStats} {ctor : Name} {argIdx : Nat}
+      {context : Context} {source : Expr} {fuel : Nat}
+      {name : Name} {domain body : Expr} {binderInfo : BinderInfo}
+      {whnfStep : CandidateWhnfStep.Valid
+        ⟨context, source, .forallE name domain body binderInfo⟩}
+      {occurs : hasIndOcc stats.indConsts
+        (.forallE name domain body binderInfo) = true}
+      {domainFree : hasIndOcc stats.indConsts domain = false}
+      {tailTrace : ConstructorPositivityTrace stats ctor argIdx
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) fuel}
+      {sourceCheck : ConstructorCheckedExpr context source}
+      {domainCheck : ConstructorCheckedExpr context domain}
+      {consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain)}
+      {consumedLevel : Level}
+      {consumedInferred : consumedCheck.observation.inferred =
+        .sort consumedLevel}
+      {fresh : context.lctx.find? context.freshFVarId = none}
+      {contextRun : ConstructorContextRun env Us context}
+      (depth : context.fuel.recDepth = whnfFuel + 1)
+      (sourceRun : ConstructorCheckedExpr.Run sourceCheck
+        contextRun.candidate)
+      (whnfRun : ConstructorWhnfRun contextRun.candidate sourceRun
+        (.forallE name domain body binderInfo))
+      (domainRun : ConstructorCheckedExpr.Run domainCheck
+        contextRun.candidate)
+      (consumedRun : ConstructorCheckedExpr.Run consumedCheck
+        contextRun.candidate)
+      (annotationsRun : TypeChecker.IsDefEqRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain
+        (consumeTypeAnnotations domain) domainRun.source'
+        consumedRun.source')
+      (consumedType : contextRun.candidate.context.IsType
+        consumedRun.source')
+      (tail : ConstructorPositivitySemanticRun env Us whnfFuel
+        (contextRun.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain) fresh consumedRun.source'
+          consumedRun.check.expr_tr consumedType)
+        tailTrace) :
+      ConstructorPositivitySemanticRun env Us whnfFuel contextRun
+        (.forallE context source fuel name domain body binderInfo whnfStep
+          occurs domainFree tailTrace)
+  | target
+      {stats : InductiveStats} {ctor : Name} {argIdx : Nat}
+      {context : Context} {source result : Expr} {fuel targetIdx : Nat}
+      {whnfStep : CandidateWhnfStep.Valid ⟨context, source, result⟩}
+      {occurs : hasIndOcc stats.indConsts result = true}
+      {terminal : result.isForall = false}
+      {valid : isValidIndApp? stats result = some targetIdx}
+      {sourceCheck : ConstructorCheckedExpr context source}
+      {contextRun : ConstructorContextRun env Us context}
+      (depth : context.fuel.recDepth = whnfFuel + 1)
+      (sourceRun : ConstructorCheckedExpr.Run sourceCheck
+        contextRun.candidate)
+      (whnfRun : ConstructorWhnfRun contextRun.candidate sourceRun result) :
+      ConstructorPositivitySemanticRun env Us whnfFuel contextRun
+        (.target context source result fuel targetIdx whnfStep occurs terminal
+          valid)
+
+namespace ConstructorPositivitySemanticRun
+
+theorem nonempty_of_alignment
+    (contextRun : ConstructorContextRun env Us context)
+    (depth : context.fuel.recDepth = whnfFuel + 1)
+    {trace : ConstructorPositivityTrace stats ctor argIdx context source fuel}
+    (alignment : ConstructorPositivityAlignmentTrace trace) :
+    Nonempty (ConstructorPositivitySemanticRun env Us whnfFuel contextRun
+      trace) := by
+  induction trace with
+  | absent context source result fuel whnfStep occurs =>
+      cases alignment with
+      | absent sourceCheck =>
+          obtain ⟨sourceRun⟩ :=
+            ConstructorCheckedExpr.Run.exists sourceCheck contextRun.candidate
+          obtain ⟨whnfRun⟩ := ConstructorWhnfRun.exists
+            contextRun.candidate sourceRun whnfStep whnfFuel depth
+          exact ⟨ConstructorPositivitySemanticRun.absent
+            (stats := stats) (ctor := ctor) (argIdx := argIdx)
+            depth sourceRun whnfRun⟩
+  | forallE context source fuel name domain body binderInfo whnfStep occurs
+      domainFree tailTrace ih =>
+      cases alignment with
+      | forallE sourceCheck domainCheck consumedCheck consumedLevel
+          consumedInferred fresh annotations _ tailAlignment =>
+          obtain ⟨sourceRun⟩ :=
+            ConstructorCheckedExpr.Run.exists sourceCheck contextRun.candidate
+          obtain ⟨whnfRun⟩ := ConstructorWhnfRun.exists
+            contextRun.candidate sourceRun whnfStep whnfFuel depth
+          obtain ⟨domainRun⟩ :=
+            ConstructorCheckedExpr.Run.exists domainCheck contextRun.candidate
+          obtain ⟨consumedRun⟩ :=
+            ConstructorCheckedExpr.Run.exists consumedCheck
+              contextRun.candidate
+          let annotationsRun := domainRun.isDefEq consumedRun annotations
+          have consumedType : contextRun.candidate.context.IsType
+              consumedRun.source' :=
+            consumedRun.isType_of_inferredSort consumedInferred
+          let tailContext := contextRun.pushLocalDecl name binderInfo
+            (consumeTypeAnnotations domain) fresh consumedRun.source'
+            consumedRun.check.expr_tr consumedType
+          have tailDepth :
+              (context.pushLocalDecl name binderInfo
+                (consumeTypeAnnotations domain)).fuel.recDepth =
+                  whnfFuel + 1 := by
+            simpa [AddInductive.Context.pushLocalDecl] using depth
+          obtain ⟨tail⟩ := ih tailContext tailDepth tailAlignment
+          exact ⟨ConstructorPositivitySemanticRun.forallE
+            (stats := stats) (ctor := ctor) (argIdx := argIdx)
+            (consumedLevel := consumedLevel)
+            (consumedInferred := consumedInferred)
+            depth sourceRun whnfRun domainRun consumedRun annotationsRun
+            consumedType tail⟩
+  | target context source result fuel targetIdx whnfStep occurs terminal valid =>
+      cases alignment with
+      | target sourceCheck =>
+          obtain ⟨sourceRun⟩ :=
+            ConstructorCheckedExpr.Run.exists sourceCheck contextRun.candidate
+          obtain ⟨whnfRun⟩ := ConstructorWhnfRun.exists
+            contextRun.candidate sourceRun whnfStep whnfFuel depth
+          exact ⟨ConstructorPositivitySemanticRun.target
+            (stats := stats) (ctor := ctor) (argIdx := argIdx)
+            depth sourceRun whnfRun⟩
+
+end ConstructorPositivitySemanticRun
+
+/-- Verified meaning of the exact safe/unsafe positivity branch retained by
+ordinary constructor validation. -/
+inductive ConstructorPositivityModeSemanticRun
+    (env : VEnv) (Us : List Name) (whnfFuel : Nat) :
+    {stats : InductiveStats} → {isUnsafe : Bool} → {ctor : Name} →
+    {argIdx : Nat} → {context : Context} → {source : Expr} →
+    (contextRun : ConstructorContextRun env Us context) →
+    ConstructorPositivityModeTrace stats isUnsafe ctor argIdx context source →
+      Type where
+  | skipped :
+      {stats : InductiveStats} → {isUnsafe : Bool} → {ctor : Name} →
+      {argIdx : Nat} → {context : Context} → {source : Expr} →
+      {unsafeEq : isUnsafe = true} →
+      {contextRun : ConstructorContextRun env Us context} →
+      ConstructorPositivityModeSemanticRun env Us whnfFuel contextRun
+        (@ConstructorPositivityModeTrace.skipped stats isUnsafe ctor argIdx
+          context source unsafeEq)
+  | safe
+      {stats : InductiveStats} {isUnsafe : Bool} {ctor : Name}
+      {argIdx : Nat} {context : Context} {source : Expr}
+      {unsafeEq : isUnsafe = false}
+      {positivityTrace : ConstructorPositivityTrace stats ctor argIdx context
+        source context.fuel.inductiveFuel}
+      {contextRun : ConstructorContextRun env Us context}
+      (semantic : ConstructorPositivitySemanticRun env Us whnfFuel contextRun
+        positivityTrace) :
+      ConstructorPositivityModeSemanticRun env Us whnfFuel contextRun
+        (@ConstructorPositivityModeTrace.safe stats isUnsafe ctor argIdx
+          context source unsafeEq positivityTrace)
+
+namespace ConstructorPositivityModeSemanticRun
+
+theorem nonempty_of_alignment
+    (contextRun : ConstructorContextRun env Us context)
+    (depth : context.fuel.recDepth = whnfFuel + 1)
+    {trace : ConstructorPositivityModeTrace stats isUnsafe ctor argIdx
+      context source}
+    (alignment : ConstructorPositivityModeAlignmentTrace trace) :
+    Nonempty (ConstructorPositivityModeSemanticRun env Us whnfFuel contextRun
+      trace) := by
+  cases alignment with
+  | @skipped unsafeEq =>
+      exact ⟨ConstructorPositivityModeSemanticRun.skipped
+        (env := env) (Us := Us) (whnfFuel := whnfFuel)
+        (stats := stats) (isUnsafe := isUnsafe) (ctor := ctor)
+        (argIdx := argIdx) (context := context) (source := source)
+        (unsafeEq := unsafeEq) (contextRun := contextRun)⟩
+  | safe positivityAlignment =>
+      obtain ⟨semantic⟩ :=
+        ConstructorPositivitySemanticRun.nonempty_of_alignment contextRun depth
+          positivityAlignment
+      exact ⟨.safe semantic⟩
+
+end ConstructorPositivityModeSemanticRun
+
+/-- Verified, componentwise interpretation of one aligned constructor
+telescope.  The view is followed at validation-owned parameter and field
+locals; no equality between candidate and validator fresh identifiers is
+required or asserted. -/
+inductive ConstructorViewSemanticRun
+    (env : VEnv) (Us : List Name) (whnfFuel : Nat) :
+    {stats : InductiveStats} → {isUnsafe : Bool} → {familyIdx : Nat} →
+    {ctor : Name} → {context : Context} → {source : Expr} →
+    {argIdx fuel : Nat} →
+    (contextRun : ConstructorContextRun env Us context) →
+    ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor context
+      source argIdx fuel →
+    (view : Expr) → Type where
+  | parameter
+      {stats : InductiveStats} {isUnsafe : Bool} {familyIdx : Nat}
+      {ctor : Name} {context : Context} {fuel argIdx : Nat}
+      {name : Name} {domain body : Expr} {binderInfo : BinderInfo}
+      {param parameterType : Expr}
+      {parameterAt : stats.params[argIdx]? = some param}
+      {parameterTypeGet : getType param context = .ok parameterType}
+      {validationDefEq : CandidateIsDefEqStep.Valid
+        ⟨context, domain, parameterType⟩}
+      {tailTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        context (body.instantiate1 param) (argIdx + 1) fuel}
+      {viewName : Name} {viewDomain viewBody : Expr}
+      {viewBinderInfo : BinderInfo}
+      {domainCheck : ConstructorCheckedExpr context domain}
+      {viewDomainCheck : ConstructorCheckedExpr context viewDomain}
+      {parameterTypeCheck : ConstructorCheckedExpr context parameterType}
+      {contextRun : ConstructorContextRun env Us context}
+      (domainRun : ConstructorCheckedExpr.Run domainCheck
+        contextRun.candidate)
+      (viewDomainRun : ConstructorCheckedExpr.Run viewDomainCheck
+        contextRun.candidate)
+      (parameterTypeSemantic : ConstructorCheckedExpr.Run parameterTypeCheck
+        contextRun.candidate)
+      (validationRun : TypeChecker.IsDefEqRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain parameterType
+        domainRun.source' parameterTypeSemantic.source')
+      (tail : ConstructorViewSemanticRun env Us whnfFuel contextRun tailTrace
+        (viewBody.instantiate1 param)) :
+      ConstructorViewSemanticRun env Us whnfFuel contextRun
+        (.parameter context fuel argIdx name domain body binderInfo param
+          parameterType parameterAt parameterTypeGet validationDefEq tailTrace)
+        (.forallE viewName viewDomain viewBody viewBinderInfo)
+  | ordinary
+      {stats : InductiveStats} {isUnsafe : Bool} {familyIdx : Nat}
+      {ctor : Name} {context : Context} {fuel argIdx : Nat}
+      {name : Name} {domain body : Expr} {binderInfo : BinderInfo}
+      {sortResult : Expr} {noParameter : stats.params[argIdx]? = none}
+      {ensureTypeStep : ConstructorEnsureTypeStep.Valid
+        ⟨context, domain, sortResult⟩}
+      {universeTrace : ConstructorUniverseTrace stats.resultLevel
+        sortResult.sortLevel!}
+      {positivityTrace : ConstructorPositivityModeTrace stats isUnsafe ctor
+        argIdx context domain}
+      {tailTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) fuel}
+      {viewName : Name} {viewDomain viewBody : Expr}
+      {viewBinderInfo : BinderInfo}
+      {domainCheck : ConstructorCheckedExpr context domain}
+      {viewDomainCheck : ConstructorCheckedExpr context viewDomain}
+      {viewEquality : CandidateIsDefEqObservation context domain viewDomain}
+      {consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain)}
+      {fresh : context.lctx.find? context.freshFVarId = none}
+      {contextRun : ConstructorContextRun env Us context}
+      (domainRun : ConstructorCheckedExpr.Run domainCheck
+        contextRun.candidate)
+      (viewDomainRun : ConstructorCheckedExpr.Run viewDomainCheck
+        contextRun.candidate)
+      (viewEqualityRun : TypeChecker.IsDefEqRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain viewDomain
+        domainRun.source' viewDomainRun.source')
+      (consumedRun : ConstructorCheckedExpr.Run consumedCheck
+        contextRun.candidate)
+      (ensureTypeRun : TypeChecker.EnsureTypeRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain sortResult
+        domainRun.source')
+      (positivity : ConstructorPositivityModeSemanticRun env Us whnfFuel
+        contextRun positivityTrace)
+      (annotationsRun : TypeChecker.IsDefEqRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain
+        (consumeTypeAnnotations domain) domainRun.source'
+        consumedRun.source')
+      (consumedType : contextRun.candidate.context.IsType
+        consumedRun.source')
+      (tail : ConstructorViewSemanticRun env Us whnfFuel
+        (contextRun.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain) fresh consumedRun.source'
+          consumedRun.check.expr_tr consumedType)
+        tailTrace (viewBody.instantiate1 context.freshExpr)) :
+      ConstructorViewSemanticRun env Us whnfFuel contextRun
+        (.ordinary context fuel argIdx name domain body binderInfo sortResult
+          noParameter ensureTypeStep universeTrace positivityTrace tailTrace)
+        (.forallE viewName viewDomain viewBody viewBinderInfo)
+  | terminal
+      {stats : InductiveStats} {isUnsafe : Bool} {familyIdx : Nat}
+      {ctor : Name} {context : Context} {source view : Expr}
+      {fuel argIdx : Nat} {sourceTerminal : source.isForall = false}
+      {sourceValid : isValidIndAppIdx stats source familyIdx = true}
+      {sourceCheck : ConstructorCheckedExpr context source}
+      {viewCheck : ConstructorCheckedExpr context view}
+      {contextRun : ConstructorContextRun env Us context}
+      (sourceRun : ConstructorCheckedExpr.Run sourceCheck
+        contextRun.candidate)
+      (viewRun : ConstructorCheckedExpr.Run viewCheck contextRun.candidate) :
+      ConstructorViewSemanticRun env Us whnfFuel contextRun
+        (.terminal context source fuel argIdx sourceTerminal sourceValid) view
+
+namespace ConstructorViewSemanticRun
+
+theorem nonempty_of_alignment
+    (contextRun : ConstructorContextRun env Us context)
+    (depth : context.fuel.recDepth = whnfFuel + 1)
+    {validationTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx
+      ctor context source argIdx fuel}
+    {view : Expr}
+    (alignment : ConstructorViewAlignmentTrace validationTrace view) :
+    Nonempty (ConstructorViewSemanticRun env Us whnfFuel contextRun
+      validationTrace view) := by
+  induction validationTrace generalizing view with
+  | parameter context fuel argIdx name domain body binderInfo param
+      parameterType parameterAt parameterTypeGet validationDefEq tailTrace ih =>
+      cases alignment with
+      | parameter domainCheck viewDomainCheck parameterTypeCheck
+          parameterShape parameterPresent _ tailAlignment =>
+          obtain ⟨domainRun⟩ :=
+            ConstructorCheckedExpr.Run.exists domainCheck contextRun.candidate
+          obtain ⟨viewDomainRun⟩ :=
+            ConstructorCheckedExpr.Run.exists viewDomainCheck
+              contextRun.candidate
+          obtain ⟨parameterTypeSemantic⟩ :=
+            ConstructorCheckedExpr.Run.exists parameterTypeCheck
+              contextRun.candidate
+          let validationRun := TypeChecker.IsDefEqRun.ofCandidateStep
+            ⟨context, domain, parameterType⟩ validationDefEq
+            contextRun.candidate.context contextRun.candidate.context_eq
+            rfl rfl rfl contextRun.candidate.state_wf
+            domainRun.check.expr_tr parameterTypeSemantic.check.expr_tr
+            context.fuel.recDepth rfl
+          obtain ⟨tail⟩ := ih contextRun depth tailAlignment
+          exact ⟨ConstructorViewSemanticRun.parameter
+            domainRun viewDomainRun parameterTypeSemantic validationRun tail⟩
+  | ordinary context fuel argIdx name domain body binderInfo sortResult
+      noParameter ensureTypeStep universeTrace positivityTrace tailTrace ih =>
+      cases alignment with
+      | ordinary domainCheck viewDomainCheck viewEquality consumedCheck _
+          positivityAlignment fresh annotations _ tailAlignment =>
+          obtain ⟨domainRun⟩ :=
+            ConstructorCheckedExpr.Run.exists domainCheck contextRun.candidate
+          obtain ⟨viewDomainRun⟩ :=
+            ConstructorCheckedExpr.Run.exists viewDomainCheck
+              contextRun.candidate
+          let viewEqualityRun := domainRun.isDefEq viewDomainRun viewEquality
+          obtain ⟨consumedRun⟩ :=
+            ConstructorCheckedExpr.Run.exists consumedCheck
+              contextRun.candidate
+          obtain ⟨ensureTypeRun⟩ :=
+            TypeChecker.EnsureTypeRun.exists_ofConstructorStep
+              ⟨context, domain, sortResult⟩ ensureTypeStep
+              contextRun.candidate domainRun.source' domainRun.check.expr_tr
+          obtain ⟨positivity⟩ :=
+            ConstructorPositivityModeSemanticRun.nonempty_of_alignment
+              contextRun depth positivityAlignment
+          let annotationsRun := domainRun.isDefEq consumedRun annotations
+          have consumedType : contextRun.candidate.context.IsType
+              consumedRun.source' := by
+            have annotationDef := annotationsRun.isDefEqU.of_l
+              contextRun.candidate.context.Ewf
+              contextRun.candidate.context.Δwf.toCtx
+              ensureTypeRun.source_type
+            exact ⟨ensureTypeRun.resultLevel', annotationDef.hasType.2⟩
+          let tailContext := contextRun.pushLocalDecl name binderInfo
+            (consumeTypeAnnotations domain) fresh consumedRun.source'
+            consumedRun.check.expr_tr consumedType
+          have tailDepth :
+              (context.pushLocalDecl name binderInfo
+                (consumeTypeAnnotations domain)).fuel.recDepth =
+                  whnfFuel + 1 := by
+            simpa [AddInductive.Context.pushLocalDecl] using depth
+          obtain ⟨tail⟩ := ih tailContext tailDepth tailAlignment
+          exact ⟨ConstructorViewSemanticRun.ordinary
+            (viewEquality := viewEquality)
+            domainRun viewDomainRun viewEqualityRun consumedRun ensureTypeRun
+            positivity annotationsRun consumedType tail⟩
+  | terminal context source fuel argIdx sourceTerminal sourceValid =>
+      cases alignment with
+      | terminal sourceCheck viewCheck viewTerminal viewValid =>
+          obtain ⟨sourceRun⟩ :=
+            ConstructorCheckedExpr.Run.exists sourceCheck contextRun.candidate
+          obtain ⟨viewRun⟩ :=
+            ConstructorCheckedExpr.Run.exists viewCheck contextRun.candidate
+          exact ⟨ConstructorViewSemanticRun.terminal
+            (stats := stats) (isUnsafe := isUnsafe)
+            (familyIdx := familyIdx) (ctor := ctor)
+            sourceRun viewRun⟩
+
+end ConstructorViewSemanticRun
+
+/-!
+## Source-ordered post-family constructor semantics
+
+The alignment trace connects the validator's exact source telescope to the
+analyzer-owned candidate view.  The semantic list below interprets that trace
+alongside the already-produced constructor semantic hierarchy.  Its indices
+keep source order, raw constructor order, and the exact candidate view fixed;
+its payload retains both validation-local checks and Theory telescope/result
+evidence selected by the candidate's recursive checker run.
+-/
+
+/-- Complete post-family meaning for every constructor position selected by
+one exact validation/candidate alignment.
+
+`root` interprets the validator-owned root `checkType` observation (the
+supplemental audit contributes only its scope proof). `telescope` interprets
+parameter equality, ordinary-field typing, positivity, and the terminal
+family application while following the exact candidate view at
+validation-owned locals. `spine` exposes the exact Theory view binders and
+terminal result selected by the candidate semantic root. -/
+inductive ConstructorPostFamilySemanticListRun
+    (env : VEnv) (Us : List Name)
+    (stats : InductiveStats) (isUnsafe : Bool) (familyIdx : Nat)
+    (context : Context) (contextRun : ConstructorContextRun env Us context) :
+    {seen : NameSet} → {constructors : List Constructor} →
+    (validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors) →
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors) →
+    {raws : List VConstVal} →
+    ConstructorCandidateAlignmentTrace stats isUnsafe familyIdx context
+      validationTrace candidates →
+    VInductDecl.CandidateConstructorSemanticListRun env Us candidates raws →
+      Type where
+  | nil (seen : NameSet) :
+      ConstructorPostFamilySemanticListRun env Us stats isUnsafe familyIdx
+        context contextRun (.nil seen) .nil (.nil seen) .nil
+  | cons
+      {seen : NameSet} {head : Constructor} {tail : List Constructor}
+      {freshName : seen.contains head.name = false}
+      {closed : context.env.checkNoMVarNoFVar head.name head.type = .ok ()}
+      {rootCheck : CandidateCheckTypeObservation
+        context.withEmptyLocalContext head.type}
+      {typeTrace : ConstructorTypeValidationTrace stats isUnsafe familyIdx
+        head.name context head.type 0 context.fuel.inductiveFuel}
+      {tailTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+        context (seen.insert head.name) tail}
+      {candidate : AddInductive.CandidateConstructor head}
+      {candidates : AddInductive.CandidateList
+        AddInductive.CandidateConstructor tail}
+      {raw : VConstVal} {raws : List VConstVal}
+      {rootScope : ConstructorCheckedExpr context.withEmptyLocalContext
+        head.type}
+      {storedSpine : candidate.type.trace.storedSpine = true}
+      {spineLength : candidate.type.trace.spineLength =
+        typeTrace.spineLength}
+      {candidateDepth : candidate.type.context.fuel.recDepth =
+        context.fuel.recDepth}
+      {headAlignment : ConstructorViewAlignmentTrace typeTrace
+        candidate.type.view}
+      {tailAlignment : ConstructorCandidateAlignmentTrace stats isUnsafe
+        familyIdx context tailTrace candidates}
+      {headSemantic : VInductDecl.CandidateConstructorSemanticRun env Us
+        candidate raw}
+      {tailSemantic : VInductDecl.CandidateConstructorSemanticListRun env Us
+        candidates raws}
+      (root : ConstructorCheckedExpr.Run
+        (rootScope.withObservation rootCheck)
+        contextRun.withEmptyLocalContext.candidate)
+      (telescope : ConstructorViewSemanticRun env Us
+        headSemantic.type.whnfFuel contextRun typeTrace candidate.type.view)
+      (spine : ∃ resultType,
+        TypeChecker.TelResultDefEqEvidence env Us.length []
+          (VExpr.telN candidate.type.trace.spineLength raw.type)
+          (VExpr.telN candidate.type.trace.spineLength
+            headSemantic.type.view)
+          (VExpr.dropN candidate.type.trace.spineLength raw.type)
+          (VExpr.dropN candidate.type.trace.spineLength
+            headSemantic.type.view)
+          resultType)
+      (tailRun : ConstructorPostFamilySemanticListRun env Us stats isUnsafe
+        familyIdx context contextRun tailTrace candidates
+        tailAlignment tailSemantic) :
+      ConstructorPostFamilySemanticListRun env Us stats isUnsafe familyIdx
+        context contextRun
+        (.cons seen head tail freshName closed rootCheck typeTrace tailTrace)
+        (.cons candidate candidates)
+        (.cons rootScope storedSpine spineLength candidateDepth headAlignment
+          tailAlignment)
+        (.cons headSemantic tailSemantic)
+
+namespace ConstructorPostFamilySemanticListRun
+
+/-- Interpret an exact source-ordered alignment together with the exact
+candidate semantic list produced for the same raw constructor positions. -/
+theorem nonempty_of_alignment
+    (contextRun : ConstructorContextRun env Us context)
+    {validationTrace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors}
+    {raws : List VConstVal}
+    (alignment : ConstructorCandidateAlignmentTrace stats isUnsafe familyIdx
+      context validationTrace candidates)
+    (semantics : VInductDecl.CandidateConstructorSemanticListRun env Us
+      candidates raws) :
+    Nonempty (ConstructorPostFamilySemanticListRun env Us stats isUnsafe
+      familyIdx context contextRun validationTrace candidates alignment
+      semantics) := by
+  induction alignment generalizing raws with
+  | nil seen =>
+      cases semantics
+      exact ⟨.nil seen⟩
+  | @cons seen head tail freshName closed rootCheck typeTrace tailTrace
+      candidate candidates rootScope storedSpine spineLength candidateDepth
+      headAlignment tailAlignment ih =>
+      cases semantics with
+      | cons headSemantic tailSemantic =>
+          obtain ⟨root⟩ := ConstructorCheckedExpr.Run.exists
+            (rootScope.withObservation rootCheck)
+            contextRun.withEmptyLocalContext.candidate
+          have depth : context.fuel.recDepth =
+              headSemantic.type.whnfFuel + 1 := by
+            calc
+              context.fuel.recDepth =
+                  candidate.type.context.fuel.recDepth := candidateDepth.symm
+              _ = headSemantic.type.whnfFuel + 1 :=
+                headSemantic.type.whnfDepth
+          obtain ⟨telescope⟩ :=
+            ConstructorViewSemanticRun.nonempty_of_alignment contextRun depth
+              headAlignment
+          have spine := TypeChecker.CandidateExprSpineRun.evidence
+            (headSemantic.type.spine storedSpine)
+          obtain ⟨tailRun⟩ := ih tailSemantic
+          exact ⟨.cons root telescope spine tailRun⟩
+
+end ConstructorPostFamilySemanticListRun
+
+/-- A retained constructor telescope whose strengthened universe decisions are
+all true replays the exact executable universe traversal.  This is the
+converse of `universeSemantics_of_loop`: the trace supplies the same parameter
+choices and `ensureType` results, while the Boolean supplies only the
+additional verified comparison at ordinary fields. -/
+theorem ConstructorTypeValidationTrace.universeLoop_of_semantics
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel)
+    (semantic : trace.universeSemantics = true) :
+    checkConstructorUniverseSemantics.loop stats source argIdx fuel context =
+      .ok () := by
+  induction trace with
+  | parameter context fuel argIdx name domain body binderInfo parameter
+      parameterType parameterAt parameterTypeRun defeq tail ih =>
+      simp only [universeSemantics] at semantic
+      rw [show fuel + 1 = Nat.succ fuel by rfl]
+      rw [checkConstructorUniverseSemantics.loop.eq_2]
+      rw [parameterAt]
+      exact ih semantic
+  | ordinary context fuel argIdx name domain body binderInfo sortResult
+      noParameter ensureType universeTrace positivity tail ih =>
+      simp only [universeSemantics, Bool.and_eq_true] at semantic
+      rw [show fuel + 1 = Nat.succ fuel by rfl]
+      rw [checkConstructorUniverseSemantics.loop.eq_2]
+      rw [noParameter]
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply]
+      rw [ensureType]
+      simp only [Except.bind]
+      have valid : constructorUniverseSemanticGe stats.resultLevel
+          sortResult.sortLevel! = true := by
+        simpa only [ConstructorUniverseTrace.semantic] using semantic.1
+      rw [valid]
+      simp only []
+      exact ih semantic.2
+  | terminal context source fuel argIdx terminal valid =>
+      cases source <;> try rfl
+      case forallE =>
+        change true = false at terminal
+        contradiction
+
+/-- Root form of `universeLoop_of_semantics`, initialized from the same
+context fuel as ordinary constructor validation. -/
+theorem ConstructorTypeValidationTrace.universeRun_of_semantics
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source 0 context.fuel.inductiveFuel)
+    (semantic : trace.universeSemantics = true) :
+    checkConstructorUniverseSemantics stats source context = .ok () := by
+  unfold checkConstructorUniverseSemantics
+  simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure] using trace.universeLoop_of_semantics semantic
+
+/-- A retained source-ordered constructor list whose strengthened universe
+decisions are all true replays the exact executable list audit. -/
+theorem ConstructorListValidationTrace.universeRun_of_semantics
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors)
+    (semantic : trace.universeSemantics = true) :
+    checkConstructorUniverseListSemantics stats constructors context =
+      .ok () := by
+  induction trace with
+  | nil => rfl
+  | cons seen head tail fresh closed rootCheck typeTrace tailTrace ih =>
+      simp only [universeSemantics, Bool.and_eq_true] at semantic
+      simp only [checkConstructorUniverseListSemantics,
+        ReaderT.bind, Bind.bind]
+      rw [typeTrace.universeRun_of_semantics semantic.1]
+      simp only [Except.bind]
+      exact ih semantic.2
+
+/-- Impredicative `Prop` makes every strengthened constructor-universe node
+true, independently of the field level selected by the retained checker run. -/
+theorem ConstructorUniverseTrace.semantic_of_resultLevel_isZero
+    (trace : ConstructorUniverseTrace resultLevel fieldLevel)
+    (zero : resultLevel.isZero = true) : trace.semantic = true := by
+  simp [ConstructorUniverseTrace.semantic, constructorUniverseSemanticGe,
+    zero]
+
+/-- Every universe node in a retained constructor telescope is admitted by
+the strengthened audit when the family result is `Prop`. -/
+theorem ConstructorTypeValidationTrace.universeSemantics_of_resultLevel_isZero
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel)
+    (zero : stats.resultLevel.isZero = true) :
+    trace.universeSemantics = true := by
+  induction trace with
+  | parameter context fuel argIdx name domain body binderInfo parameter
+      parameterType parameterAt parameterTypeRun defeq tail ih =>
+      simpa only [universeSemantics] using ih
+  | ordinary context fuel argIdx name domain body binderInfo sortResult
+      noParameter ensureType universeTrace positivity tail ih =>
+      simp only [universeSemantics, Bool.and_eq_true]
+      exact ⟨universeTrace.semantic_of_resultLevel_isZero zero, ih⟩
+  | terminal => rfl
+
+/-- Source-list form of
+`ConstructorTypeValidationTrace.universeSemantics_of_resultLevel_isZero`. -/
+theorem ConstructorListValidationTrace.universeSemantics_of_resultLevel_isZero
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors)
+    (zero : stats.resultLevel.isZero = true) :
+    trace.universeSemantics = true := by
+  induction trace with
+  | nil => rfl
+  | cons seen head tail fresh closed rootCheck typeTrace tailTrace ih =>
+      simp only [universeSemantics, Bool.and_eq_true]
+      exact ⟨typeTrace.universeSemantics_of_resultLevel_isZero zero, ih⟩
+
+/-- A successful executable universe audit marks every universe node in an
+arbitrary retained constructor telescope.  The proof uses determinism of the
+same `ensureType` execution retained by the ordinary trace; it cannot change a
+field level or skip a source position. -/
+theorem ConstructorTypeValidationTrace.universeSemantics_of_loop
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel)
+    (success : checkConstructorUniverseSemantics.loop stats source argIdx fuel
+      context = .ok ()) :
+    trace.universeSemantics = true := by
+  induction trace with
+  | parameter context fuel argIdx name domain body binderInfo parameter
+      parameterType parameterAt parameterTypeRun defeq tail ih =>
+      simp only [universeSemantics]
+      rw [show fuel + 1 = Nat.succ fuel by rfl] at success
+      rw [checkConstructorUniverseSemantics.loop.eq_2] at success
+      rw [parameterAt] at success
+      exact ih success
+  | ordinary context fuel argIdx name domain body binderInfo sortResult
+      noParameter ensureType universeTrace positivity tail ih =>
+      simp only [universeSemantics, Bool.and_eq_true]
+      rw [show fuel + 1 = Nat.succ fuel by rfl] at success
+      rw [checkConstructorUniverseSemantics.loop.eq_2] at success
+      rw [noParameter] at success
+      simp only [ReaderT.bind, Bind.bind, liftTypeChecker_apply] at success
+      rw [ensureType] at success
+      simp only [Except.bind] at success
+      cases valid : constructorUniverseSemanticGe stats.resultLevel
+          sortResult.sortLevel! with
+      | false =>
+          rw [valid] at success
+          change Except.error _ = Except.ok () at success
+          cases success
+      | true =>
+          rw [valid] at success
+          simp only [] at success
+          exact ⟨valid, ih success⟩
+  | terminal => rfl
+
+/-- Root form of `universeSemantics_of_loop`, with the audit initialized from
+the exact context fuel just like ordinary constructor validation. -/
+theorem ConstructorTypeValidationTrace.universeSemantics_of_run
+    (trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source 0 context.fuel.inductiveFuel)
+    (success : checkConstructorUniverseSemantics stats source context =
+      .ok ()) :
+    trace.universeSemantics = true := by
+  apply trace.universeSemantics_of_loop
+  simpa only [checkConstructorUniverseSemantics, readThe,
+    MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind,
+    ReaderT.pure, Pure.pure, Except.bind, Except.pure] using success
+
+/-- A successful source-list audit marks every retained constructor position;
+the dependent list indices prevent omission, duplication, or reordering. -/
+theorem ConstructorListValidationTrace.universeSemantics_of_run
+    (trace : ConstructorListValidationTrace stats isUnsafe familyIdx
+      context seen constructors)
+    (success : checkConstructorUniverseListSemantics stats constructors
+      context = .ok ()) :
+    trace.universeSemantics = true := by
+  induction trace with
+  | nil => rfl
+  | cons seen head tail fresh closed rootCheck typeTrace tailTrace ih =>
+      simp only [universeSemantics, Bool.and_eq_true]
+      simp only [checkConstructorUniverseListSemantics,
+        ReaderT.bind, Bind.bind] at success
+      cases headRun : checkConstructorUniverseSemantics stats head.type
+          context with
+      | error error =>
+          rw [headRun] at success
+          cases success
+      | ok result =>
+          cases result
+          rw [headRun] at success
+          simp only [Except.bind] at success
+          exact ⟨typeTrace.universeSemantics_of_run headRun, ih success⟩
+
+/-- Ordinary constructor validation paired with the executable semantic
+universe audit over the identical singleton source list. This record narrows
+the accepted package boundary while preserving the ordinary validator result
+and every retained non-universe check unchanged. -/
+structure ConstructorSemanticValidationRun
+    (indType : InductiveType) (stats : InductiveStats)
+    (isUnsafe : Bool) (context : Context) where
+  validation : ConstructorValidationRun indType stats isUnsafe context
+  universeRun : checkConstructorUniverseListSemantics stats indType.ctors
+    context = .ok ()
+
+namespace ConstructorSemanticValidationRun
+
+/-- Forgetting the semantic audit replays the exact ordinary validator, so
+the strengthened run cannot widen kernel acceptance. -/
+theorem run
+    (semantic : ConstructorSemanticValidationRun indType stats isUnsafe
+      context) :
+    checkConstructors #[indType] stats isUnsafe context = .ok () :=
+  semantic.validation.run
+
+/-- Every universe-bearing node of the retained ordinary trace passed the
+executable verified universe gate. -/
+theorem universeSemantics
+    (semantic : ConstructorSemanticValidationRun indType stats isUnsafe
+      context) :
+    semantic.validation.universeSemantics = true :=
+  semantic.validation.trace.universeSemantics_of_run semantic.universeRun
+
+end ConstructorSemanticValidationRun
+
+/-- The semantic universe gate only accepts branches already accepted by the
+ordinary constructor validator.  It therefore narrows package construction
+without widening kernel validation behavior. -/
+theorem ConstructorUniverseTrace.nonempty_of_semanticGe
+    (valid : constructorUniverseSemanticGe resultLevel fieldLevel = true) :
+    Nonempty (ConstructorUniverseTrace resultLevel fieldLevel) := by
+  unfold constructorUniverseSemanticGe at valid
+  simp only [Bool.or_eq_true, Bool.and_eq_true] at valid
+  rcases valid with structural | prop | ⟨core, _verified⟩
+  · exact ⟨.structural structural⟩
+  · cases hstruct : levelStructGe resultLevel fieldLevel with
+    | true => exact ⟨.structural hstruct⟩
+    | false =>
+        exact ⟨.fallback hstruct
+          (by cases resultLevel <;> simp_all [Level.isZero, Level.isAlwaysZero])⟩
+  · cases hstruct : levelStructGe resultLevel fieldLevel with
+    | true => exact ⟨.structural hstruct⟩
+    | false =>
+        exact ⟨.fallback hstruct (by simp [core])⟩
+
+/-- The executable semantic subset implies exactly the disjunct required for
+a non-recursive field in `VInductDecl.fieldsWF`: either the family is Prop or
+the field universe is bounded by the family universe. -/
+theorem constructorUniverseSemanticGe_ofLevel
+    (valid : constructorUniverseSemanticGe resultLevel fieldLevel = true)
+    (result_tr : VLevel.ofLevel Us resultLevel = some result')
+    (field_tr : VLevel.ofLevel Us fieldLevel = some field') :
+    result' = .zero ∨ field' ≤ result' := by
+  unfold constructorUniverseSemanticGe at valid
+  simp only [Bool.or_eq_true, Bool.and_eq_true] at valid
+  rcases valid with structural | prop | ⟨_core, verified⟩
+  · exact .inr (levelStructGe_ofLevel structural result_tr field_tr)
+  · exact .inl (ofLevel_eq_zero_of_isZero prop result_tr)
+  · exact .inr (Level.geq'_wf result_tr field_tr verified)
+
+/-- Agreement between the ordinary and verified normalized comparisons opens
+the semantic fallback without weakening the ordinary acceptance boundary. -/
+theorem constructorUniverseSemanticGe_eq_true_of_geq_agreement
+    (core : resultLevel.geq fieldLevel = true)
+    (verified : resultLevel.geq' fieldLevel = true) :
+    constructorUniverseSemanticGe resultLevel fieldLevel = true := by
+  simp [constructorUniverseSemanticGe, core, verified]
+
+private def constructorUniverseComparisonSamples : List Level :=
+  [.zero,
+   .succ .zero,
+   .succ (.succ .zero),
+   .param `u,
+   .param `v,
+   .succ (.param `u),
+   .max (.param `u) (.param `v),
+   .max (.succ (.param `u)) (.param `v),
+   .imax (.param `u) (.param `v),
+   .imax (.param `u) (.succ (.param `v)),
+   .imax (.max (.param `u) (.param `v)) (.succ .zero),
+   .max (.imax (.param `u) (.param `v)) (.succ (.param `v))]
+
+/- Differential audit for the mvar-free surface accepted by constructors.
+Every pair in this matrix compares Lean v4.31's core decision with the proved
+project decision; the samples exercise zero, successor, maximum, impredicative
+maximum, parameters, and nested combinations. -/
+#guard constructorUniverseComparisonSamples.all fun resultLevel =>
+  constructorUniverseComparisonSamples.all fun fieldLevel =>
+    resultLevel.geq fieldLevel == resultLevel.geq' fieldLevel
+
+/- Regression for the former D1 gap: the structural and `Prop` branches both
+miss a parameter below a `max`, while core/project normalized comparison
+agrees and the verified semantic fallback now accepts it. -/
+private def constructorUniverseNormalizedResult : Level :=
+  .max (.param `u) (.param `v)
+
+#guard !levelStructGe constructorUniverseNormalizedResult (.param `u)
+#guard !constructorUniverseNormalizedResult.isZero
+#guard constructorUniverseNormalizedResult.geq (.param `u)
+#guard constructorUniverseNormalizedResult.geq' (.param `u)
+#guard constructorUniverseSemanticGe constructorUniverseNormalizedResult
+  (.param `u)
+
+/- The universe bridge stays within Lean's standard logical basis.  In
+particular it does not inherit the project's pending sorries, a custom axiom,
+or a semantic premise for Lean's opaque `Level.geq` implementation. -/
+#guard_named_axioms Ix.Theory.Named.AddInductive.levelStructEq_ofLevel [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.levelStructGe_ofLevel [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.constructorUniverseSemanticGe_ofLevel [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Std.TreeMap.all_eq_all_toList]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorUniverseTrace.nonempty_of_semanticGe [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorSemanticValidationRun.universeSemantics [propext, Classical.choice, Quot.sound]
+
+/- The reverse executable bridge and its impredicative-Prop specialization
+have the same standard-only closure as the forward universe interpretation.
+In particular, replaying a retained validator trace does not inherit a
+fixture computation oracle. -/
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorTypeValidationTrace.universeLoop_of_semantics [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorTypeValidationTrace.universeRun_of_semantics [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorListValidationTrace.universeRun_of_semantics [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorUniverseTrace.semantic_of_resultLevel_isZero [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorTypeValidationTrace.universeSemantics_of_resultLevel_isZero [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.ConstructorListValidationTrace.universeSemantics_of_resultLevel_isZero [propext, Classical.choice, Quot.sound]
+
+/-!
+## Executable pre-family safety and replay
+
+The post-family validator introduces a local declaration for every constructor
+field.  A recursive field's local type mentions the family being defined, so
+that declaration cannot be reproduced in the pre-family verifier context.
+For the current singleton subset we omit such locals, advance the validator's
+fresh-name supply, and permit later checks only when their source expressions
+do not mention an omitted identifier.  Independent ordinary fields may still
+follow recursive fields; genuinely dependent uses remain outside this replay.
+
+The traces below are outputs of executable builders.  Their proof fields are
+exact `checkType`, `ensureType`, and `isDefEq` executions; they are operational
+evidence, not caller-supplied Theory judgments.
+-/
+
+/-- Executable fragment on which strict kernel-to-Theory translation has a
+syntactically unique endpoint.  Projections are excluded because the current
+`TrProj` contract determines their result only up to definitional equality;
+projection-bearing inductives remain outside the singleton subset until the
+projection milestones establish an exact structural API. -/
+def theoryTranslationUnique : Expr → Bool
+  | .bvar _
+  | .fvar _
+  | .sort _
+  | .const ..
+  | .mvar ..
+  | .lit _ => true
+  | .app fn argument =>
+      theoryTranslationUnique fn && theoryTranslationUnique argument
+  | .lam _ domain body _
+  | .forallE _ domain body _ =>
+      theoryTranslationUnique domain && theoryTranslationUnique body
+  | .letE _ _ value body _ =>
+      theoryTranslationUnique value && theoryTranslationUnique body
+  | .mdata _ expression => theoryTranslationUnique expression
+  | .proj .. => false
+
+/-- The executable predicate is exactly the structural proposition used by
+strict-translation uniqueness. -/
+theorem theoryTranslationUnique_sound
+    (success : theoryTranslationUnique expression = true) :
+    TrExprS.IsUnique expression := by
+  induction expression <;>
+    simp_all [theoryTranslationUnique, TrExprS.IsUnique]
+
+/-- Abstracting one free variable preserves the projection-free fragment:
+the operation changes only free/bound-variable identities and recursively
+retains every expression constructor. -/
+theorem theoryTranslationUnique_abstract1
+    (expression : Expr) (id : FVarId) (depth : Nat) :
+    theoryTranslationUnique (Expr.abstract1 id expression depth) =
+      theoryTranslationUnique expression := by
+  induction expression generalizing depth <;>
+    simp [Expr.abstract1, theoryTranslationUnique, *]
+  split <;> rfl
+
+/-- Iterated free-variable abstraction likewise preserves the executable
+strict-translation fragment. -/
+theorem theoryTranslationUnique_abstractList
+    (expression : Expr) (ids : List FVarId) (depth : Nat) :
+    theoryTranslationUnique (Expr.abstractList expression ids depth) =
+      theoryTranslationUnique expression := by
+  induction ids generalizing expression with
+  | nil => rfl
+  | cons id ids ih =>
+      simp only [Expr.abstractList, ih,
+        theoryTranslationUnique_abstract1]
+
+/-- Array-form abstraction over an explicit list of free variables preserves
+the projection-free fragment. -/
+theorem theoryTranslationUnique_abstractFVars
+    (expression : Expr) (ids : List FVarId) :
+    theoryTranslationUnique
+        (expression.abstract ⟨ids.map Expr.fvar⟩) =
+      theoryTranslationUnique expression := by
+  rw [Expr.abstract_eq]
+  exact theoryTranslationUnique_abstractList expression ids 0
+
+/-- Every syntax fragment contributing to a recursively reconstructed
+candidate view has a unique strict Theory endpoint.  Checking recursive body
+views as well as their stored abstractions supplies precisely the induction
+hypotheses consumed by `CandidateExprRun.view_tr_strict`. -/
+def CandidateExprTrace.viewTranslationUnique :
+    {context : Context} → {source : Expr} →
+      CandidateExprTrace context source → Bool
+  | _, _, .terminal _ _ _ result _ _ => theoryTranslationUnique result
+  | _, _, .forallE context _ _ _ _ _ _ _ _ _ _ _ domain body =>
+      domain.viewTranslationUnique &&
+        (body.viewTranslationUnique &&
+          theoryTranslationUnique
+            (body.view.abstract #[context.freshExpr]))
+
+/-- The recursive check is extensionally the projection-free check on the
+reconstructed analyzer view. Its explicit body clause supplies the induction
+hypothesis consumed by the strict-view proof. -/
+theorem CandidateExprTrace.viewTranslationUnique_eq
+    (trace : CandidateExprTrace context source) :
+    trace.viewTranslationUnique = theoryTranslationUnique trace.view := by
+  induction trace with
+  | terminal => rfl
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked normalized domainTrace bodyTrace
+      domainIH bodyIH =>
+    simp only [viewTranslationUnique, CandidateExprTrace.view,
+      theoryTranslationUnique, domainIH, bodyIH]
+    rw [show #[context.freshExpr] =
+      ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl,
+      theoryTranslationUnique_abstractFVars]
+    simp
+
+/-- A successful recursive executable check supplies the exact proposition
+required by strict candidate-view translation. -/
+theorem CandidateExprTrace.viewTranslationUnique_sound
+    (trace : CandidateExprTrace context source)
+    (success : trace.viewTranslationUnique = true) :
+    TypeChecker.CandidateExprTraceViewIsUnique trace := by
+  induction trace with
+  | terminal => exact theoryTranslationUnique_sound success
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked normalized domainTrace bodyTrace
+      domainIH bodyIH =>
+    simp only [viewTranslationUnique, Bool.and_eq_true] at success
+    exact ⟨domainIH success.1, bodyIH success.2.1,
+      theoryTranslationUnique_sound success.2.2⟩
+
+/-- Source-ordered strict-view check for an exact dependent constructor
+candidate list. -/
+def CandidateList.viewTranslationUnique :
+    {constructors : List Constructor} →
+      CandidateList CandidateConstructor constructors → Bool
+  | _, .nil => true
+  | _, .cons candidate candidates =>
+      candidate.type.trace.viewTranslationUnique &&
+        candidates.viewTranslationUnique
+
+/-- Proof-level source-ordered counterpart of
+`CandidateList.viewTranslationUnique`. -/
+def CandidateList.ViewTranslationUnique :
+    {constructors : List Constructor} →
+      CandidateList CandidateConstructor constructors → Prop
+  | _, .nil => True
+  | _, .cons candidate candidates =>
+      TypeChecker.CandidateExprTraceViewIsUnique candidate.type.trace ∧
+        candidates.ViewTranslationUnique
+
+theorem CandidateList.viewTranslationUnique_sound
+    (candidates : CandidateList CandidateConstructor constructors)
+    (success : candidates.viewTranslationUnique = true) :
+    candidates.ViewTranslationUnique := by
+  induction candidates with
+  | nil => trivial
+  | cons candidate candidates ih =>
+    simp only [viewTranslationUnique, Bool.and_eq_true] at success
+    exact ⟨candidate.type.trace.viewTranslationUnique_sound success.1,
+      ih success.2⟩
+
+/-- Advance the constructor traversal's fresh-name supply without adding the
+family-dependent local declaration for a recursive outer field. -/
+def Context.advanceFresh (context : Context) : Context :=
+  { context with ngen := context.ngen.next }
+
+/-- Advancing an omitted recursive field changes only the candidate name
+generator.  The verified checker context and its empty-state certificate remain
+the same because `Context.toTypeChecker` deliberately has no name-generator
+field. -/
+def advanceCandidateContextRun
+    (run : TypeChecker.CandidateContextRun context) :
+    TypeChecker.CandidateContextRun context.advanceFresh := by
+  refine ⟨run.context, ?_, run.state_wf, ?_⟩
+  · simpa [Context.advanceFresh, Context.toTypeChecker] using run.context_eq
+  · simpa [Context.advanceFresh, NameGenerator.next] using run.namePrefix_ne
+
+/-- Keep the fixed pre-family Theory environment/universe indices while the
+operational traversal advances past an omitted recursive outer field. -/
+def ConstructorContextRun.advanceFresh
+    (run : ConstructorContextRun env Us context) :
+    ConstructorContextRun env Us context.advanceFresh where
+  candidate := advanceCandidateContextRun run.candidate
+  venv_eq := run.venv_eq
+  lparams_eq := run.lparams_eq
+
+/-- Syntactic independence from the recursive outer-field locals omitted by
+the pre-family replay context. -/
+def constructorIndependentOf (source : Expr) (removed : List FVarId) : Bool :=
+  source.fvarsList.all fun fv => !removed.contains fv
+
+/-- Instantiate the analyzer-owned family view with the exact parameter FVars
+selected by family validation, leaving the index telescope exposed. -/
+def instantiateFamilyParameters : Expr → List Expr → Except Exception Expr
+  | familyType, [] => pure familyType
+  | .forallE _ _ body _, parameter :: parameters =>
+      instantiateFamilyParameters (body.instantiate1 parameter) parameters
+  | _, _ :: _ =>
+      throw <| .other
+        "candidate family view has fewer binders than retained parameters"
+
+/-- Exact successful pre-family `ensureType` observation. -/
+structure ConstructorEnsureTypeObservation
+    (context : Context) (source : Expr) where
+  result : Expr
+  valid : ConstructorEnsureTypeStep.Valid ⟨context, source, result⟩
+
+def observeConstructorEnsureType (context : Context) (source : Expr) :
+    Except Exception (ConstructorEnsureTypeObservation context source) :=
+  match hrun : TypeChecker.M.run context.env context.safety context.lctx
+      context.lparams context.fuel (TypeChecker.ensureType source) with
+  | .error error => .error error
+  | .ok result => .ok ⟨result, hrun⟩
+
+theorem observeConstructorEnsureType_of_run
+    (run : ConstructorEnsureTypeStep.Valid ⟨context, source, result⟩) :
+    observeConstructorEnsureType context source = .ok ⟨result, run⟩ := by
+  change TypeChecker.M.run context.env context.safety context.lctx
+      context.lparams context.fuel (TypeChecker.ensureType source) =
+    .ok result at run
+  unfold observeConstructorEnsureType
+  split
+  · simp_all
+  · rename_i observed hobserved
+    have : observed = result := by simp_all
+    subst observed
+    rfl
+
+theorem ConstructorEnsureTypeObservation.observe_eq
+    (observation : ConstructorEnsureTypeObservation context source) :
+    observeConstructorEnsureType context source = .ok observation := by
+  rw [observeConstructorEnsureType_of_run observation.valid]
+
+/-- One pre-family index argument checked against the corresponding binder of
+the parameter-instantiated family view. -/
+structure ConstructorPreFamilyIndexStep
+    (context : Context) (argument expected : Expr) where
+  argumentCheck : ConstructorCheckedExpr context argument
+  expectedCheck : ConstructorCheckedExpr context expected
+  comparison : CandidateIsDefEqObservation context
+    argumentCheck.observation.inferred expected
+
+/-- Source-ordered executable replay of a constructor result/recursive-target
+index spine against the analyzer-owned family index telescope. -/
+inductive ConstructorPreFamilyIndexSpineTrace :
+    (context : Context) → (expected : Expr) → List Expr → Type where
+  | nil
+      (context : Context) (expected : Expr)
+      (expectedCheck : ConstructorCheckedExpr context expected)
+      (terminal : expected.isForall = false) :
+      ConstructorPreFamilyIndexSpineTrace context expected []
+  | cons
+      (context : Context) (name : Name) (domain body : Expr)
+      (binderInfo : BinderInfo) (argument : Expr) (arguments : List Expr)
+      (expectedCheck : ConstructorCheckedExpr context
+        (.forallE name domain body binderInfo))
+      (step : ConstructorPreFamilyIndexStep context argument domain)
+      (tail : ConstructorPreFamilyIndexSpineTrace context
+        (body.instantiate1 argument) arguments) :
+      ConstructorPreFamilyIndexSpineTrace context
+        (.forallE name domain body binderInfo) (argument :: arguments)
+
+namespace ConstructorPreFamilyIndexSpineTrace
+
+def build : (context : Context) → (expected : Expr) →
+    (arguments : List Expr) →
+    Except Exception
+      (ConstructorPreFamilyIndexSpineTrace context expected arguments)
+  | context, expected, [] =>
+      if terminal : expected.isForall = false then do
+        let expectedCheck ← checkConstructorAlignedExpr context expected
+        pure <| .nil context expected expectedCheck terminal
+      else
+        throw <| .other
+          "constructor target supplies too few family indices"
+  | context, .forallE name domain body binderInfo, argument :: arguments => do
+      let telescopeCheck ← checkConstructorAlignedExpr context
+        (.forallE name domain body binderInfo)
+      let argumentCheck ← checkConstructorAlignedExpr context argument
+      let domainCheck ← checkConstructorAlignedExpr context domain
+      let comparison ← observeCandidateIsDefEq context
+        argumentCheck.observation.inferred domain
+      let tail ← build context (body.instantiate1 argument) arguments
+      pure <| .cons context name domain body binderInfo argument arguments
+        telescopeCheck ⟨argumentCheck, domainCheck, comparison⟩ tail
+  | _, _, _ :: _ =>
+      throw <| .other
+        "constructor target supplies too many family indices"
+
+end ConstructorPreFamilyIndexSpineTrace
+
+theorem ConstructorPreFamilyIndexSpineTrace.build_eq
+    (trace : ConstructorPreFamilyIndexSpineTrace context expected arguments) :
+    ConstructorPreFamilyIndexSpineTrace.build context expected arguments =
+      .ok trace := by
+  induction trace with
+  | nil expected expectedCheck terminal =>
+      simp only [ConstructorPreFamilyIndexSpineTrace.build]
+      rw [dif_pos terminal, expectedCheck.check_eq]
+      rfl
+  | cons name domain body binderInfo argument arguments
+      expectedCheck step tail ih =>
+      simp only [ConstructorPreFamilyIndexSpineTrace.build]
+      rw [expectedCheck.check_eq, step.argumentCheck.check_eq,
+        step.expectedCheck.check_eq]
+      simp only [Bind.bind, Except.bind]
+      rw [step.comparison.observe_eq, ih]
+      rfl
+
+/-- The exact full check retained at the root of an index-spine replay. -/
+def ConstructorPreFamilyIndexSpineTrace.expectedCheck :
+    (trace : ConstructorPreFamilyIndexSpineTrace context expected arguments) →
+      ConstructorCheckedExpr context expected
+  | .nil _ _ expectedCheck _ => expectedCheck
+  | .cons _ _ _ _ _ _ _ expectedCheck _ _ => expectedCheck
+
+/-!
+### Verified pre-family index spines
+
+The operational trace checks the complete expected family-index telescope at
+every recursive position. Its semantic interpretation follows the strict
+translation selected at the root, instantiates the translated Pi body with the
+translated argument, and therefore constructs an actual Theory `SpineWF`
+rather than a pointwise list whose dependencies have been forgotten.
+-/
+
+/-- Verified meaning of one pre-family index-spine replay. `expected'` is a
+strict translation of the exact parameter-instantiated family telescope in the
+current context; `arguments'` and `result'` are forced by the retained checker
+executions and dependent Pi instantiation. -/
+structure ConstructorPreFamilyIndexSpineSemanticRun
+    (env : VEnv) (Us : List Name)
+    (context : Context) (contextRun : ConstructorContextRun env Us context)
+    {expected : Expr} {arguments : List Expr}
+    (trace : ConstructorPreFamilyIndexSpineTrace context expected arguments)
+    (expected' : VExpr) where
+  expectedInferred' : VExpr
+  expectedRun : TypeChecker.CheckTypeRun env Us
+    contextRun.candidate.context.vlctx expected
+    trace.expectedCheck.observation.inferred expected' expectedInferred'
+  arguments' : List VExpr
+  result' : VExpr
+  arguments_tr : List.Forall₂
+    (TrExprS env Us contextRun.candidate.context.vlctx)
+    arguments arguments'
+  spine : env.SpineWF Us.length contextRun.candidate.context.vlctx.toCtx
+    expected' arguments' result'
+
+namespace ConstructorPreFamilyIndexSpineSemanticRun
+
+/-- Interpret a spine at a caller-fixed strict translation of its expected
+telescope. Recursive calls receive the translated Pi body instantiated with
+the exact checker-selected argument translation. -/
+theorem nonempty_at
+    (contextRun : ConstructorContextRun env Us context)
+    (trace : ConstructorPreFamilyIndexSpineTrace context expected arguments)
+    (expected' : VExpr)
+    (expected_tr : TrExprS env Us
+      contextRun.candidate.context.vlctx expected expected') :
+    Nonempty (ConstructorPreFamilyIndexSpineSemanticRun env Us context
+      contextRun trace expected') := by
+  induction trace generalizing expected' with
+  | nil expected expectedCheck terminal =>
+      have expected_tr' : contextRun.candidate.context.TrExprS expected
+          expected' := by
+        simpa only [VContext.TrExprS, contextRun.venv_eq,
+          contextRun.lparams_eq] using expected_tr
+      obtain ⟨expectedInferred', ⟨expectedRun⟩⟩ :=
+        TypeChecker.CheckTypeRun.exists_ofCandidateStep
+          ⟨context, expected, expectedCheck.observation.inferred⟩
+          expectedCheck.observation.valid contextRun.candidate expected'
+          expected_tr'
+      exact ⟨{
+        expectedInferred' := expectedInferred'
+        expectedRun := by
+          simpa only [ConstructorPreFamilyIndexSpineTrace.expectedCheck,
+            contextRun.venv_eq, contextRun.lparams_eq] using expectedRun
+        arguments' := []
+        result' := expected'
+        arguments_tr := .nil
+        spine := .nil }⟩
+  | cons name domain body binderInfo argument arguments telescopeCheck
+      step tail ih =>
+      obtain ⟨domain', body', rfl, domainType, bodyType, domain_tr,
+          body_tr⟩ := TypeChecker.TrExprS.forallE_components expected_tr
+      have telescope_tr' : contextRun.candidate.context.TrExprS
+          (.forallE name domain body binderInfo) (.forallE domain' body') := by
+        simpa only [VContext.TrExprS, contextRun.venv_eq,
+          contextRun.lparams_eq] using expected_tr
+      obtain ⟨expectedInferred', ⟨expectedRun⟩⟩ :=
+        TypeChecker.CheckTypeRun.exists_ofCandidateStep
+          ⟨context, .forallE name domain body binderInfo,
+            telescopeCheck.observation.inferred⟩
+          telescopeCheck.observation.valid contextRun.candidate
+          (.forallE domain' body') telescope_tr'
+      have domain_tr' : contextRun.candidate.context.TrExprS domain domain' := by
+        simpa only [VContext.TrExprS, contextRun.venv_eq,
+          contextRun.lparams_eq] using domain_tr
+      obtain ⟨domainInferred', ⟨domainCheck⟩⟩ :=
+        TypeChecker.CheckTypeRun.exists_ofCandidateStep
+          ⟨context, domain, step.expectedCheck.observation.inferred⟩
+          step.expectedCheck.observation.valid contextRun.candidate domain'
+          domain_tr'
+      let domainRun : ConstructorCheckedExpr.Run step.expectedCheck
+          contextRun.candidate := ⟨domain', domainInferred', domainCheck⟩
+      obtain ⟨argumentRun⟩ := ConstructorCheckedExpr.Run.exists
+        step.argumentCheck contextRun.candidate
+      let comparisonRun := TypeChecker.IsDefEqRun.ofCandidateStep
+        ⟨context, step.argumentCheck.observation.inferred, domain⟩
+        step.comparison.valid contextRun.candidate.context
+        contextRun.candidate.context_eq rfl rfl rfl
+        contextRun.candidate.state_wf argumentRun.check.inferred_tr
+        domainRun.check.expr_tr context.fuel.recDepth rfl
+      have argumentType' : contextRun.candidate.context.HasType
+          argumentRun.source' domain' :=
+        argumentRun.check.hasType.defeqU_r
+          contextRun.candidate.context.Ewf
+          contextRun.candidate.context.Δwf.toCtx comparisonRun.isDefEqU
+      have argumentType : env.HasType Us.length
+          contextRun.candidate.context.vlctx.toCtx argumentRun.source'
+          domain' := by
+        simpa only [VContext.HasType, contextRun.venv_eq,
+          contextRun.lparams_eq] using argumentType'
+      have argument_tr : TrExprS env Us
+          contextRun.candidate.context.vlctx argument argumentRun.source' := by
+        simpa only [contextRun.venv_eq, contextRun.lparams_eq] using
+          argumentRun.check.expr_tr
+      have henv : VEnv.WF env := by
+        simpa only [contextRun.venv_eq] using
+          contextRun.candidate.context.Ewf
+      have instantiatedBody_tr : TrExprS env Us
+          contextRun.candidate.context.vlctx
+          (body.instantiate1 argument) (body'.inst argumentRun.source') := by
+        simpa only [Expr.instantiate1_eq] using
+          body_tr.inst henv.ordered argumentType argument_tr
+      obtain ⟨tailRun⟩ := ih (body'.inst argumentRun.source')
+        instantiatedBody_tr
+      exact ⟨{
+        expectedInferred' := expectedInferred'
+        expectedRun := by
+          simpa only [ConstructorPreFamilyIndexSpineTrace.expectedCheck,
+            contextRun.venv_eq, contextRun.lparams_eq] using expectedRun
+        arguments' := argumentRun.source' :: tailRun.arguments'
+        result' := tailRun.result'
+        arguments_tr := .cons argument_tr tailRun.arguments_tr
+        spine := .cons argumentType tailRun.spine }⟩
+
+/-- Every successful operational spine trace has a verified interpretation;
+the initial strict endpoint is selected by the trace's own root `checkType`. -/
+theorem nonempty
+    (contextRun : ConstructorContextRun env Us context)
+    (trace : ConstructorPreFamilyIndexSpineTrace context expected arguments) :
+    ∃ expected', Nonempty
+      (ConstructorPreFamilyIndexSpineSemanticRun env Us context contextRun
+        trace expected') := by
+  obtain ⟨expectedRun⟩ := ConstructorCheckedExpr.Run.exists
+    trace.expectedCheck contextRun.candidate
+  have expected_tr : TrExprS env Us
+      contextRun.candidate.context.vlctx expected expectedRun.source' := by
+    simpa only [contextRun.venv_eq, contextRun.lparams_eq] using
+      expectedRun.check.expr_tr
+  exact ⟨expectedRun.source', nonempty_at contextRun trace _ expected_tr⟩
+
+/-- Strict family translation fixes the expected endpoint chosen by an exact
+pre-family index replay, even when the replay context contains a later prefix
+of fresh locals. -/
+theorem expected_eq_of_family
+    {env : VEnv} {Us : List Name} {context : Context}
+    {contextRun : ConstructorContextRun env Us context}
+    {expected : Expr} {arguments : List Expr}
+    {trace : ConstructorPreFamilyIndexSpineTrace context expected arguments}
+    {expected' : VExpr}
+    (run : ConstructorPreFamilyIndexSpineSemanticRun env Us context
+      contextRun trace expected')
+    {parameterΔ viewΔ : VLCtx} {expectedBase : VExpr} {n : Nat}
+    (familyTr : TrExprS env Us parameterΔ expected expectedBase)
+    (unique : TrExprS.IsUnique expected)
+    (viewLift : VLCtx.FVLift' parameterΔ viewΔ 0
+      (.skipN .refl n) 0)
+    (viewDefEq : VLCtx.IsDefEq env Us.length
+      contextRun.candidate.context.vlctx viewΔ)
+    (viewUnique : TrExprS.IsUniqueCtx
+      contextRun.candidate.context.vlctx viewΔ) :
+    expected' = expectedBase.liftN n 0 := by
+  have henv : VEnv.Ordered env := by
+    simpa only [contextRun.venv_eq] using
+      contextRun.candidate.context.Ewf.ordered
+  have viewWF : VLCtx.WF env Us.length viewΔ :=
+    (viewDefEq.symm henv).wf
+  have familyAtView : TrExprS env Us viewΔ expected
+      (expectedBase.liftN n 0) := by
+    simpa only [VExpr.lift'_consN_skipN] using
+      familyTr.weakFV' henv viewLift viewWF
+  have retained : TrExprS env Us contextRun.candidate.context.vlctx
+      expected expected' := run.expectedRun.expr_tr
+  exact retained.unique' viewUnique unique familyAtView
+
+/-- Transport the exact pre-family index judgment below an arbitrary later
+prefix. This is the proved context weakening used when D4 places the same
+spine beneath the remaining constructor fields. -/
+theorem spine_weakPrefix
+    {expected : Expr} {arguments : List Expr}
+    {replay : ConstructorPreFamilyIndexSpineTrace context expected arguments}
+    {expected' : VExpr}
+    (run : ConstructorPreFamilyIndexSpineSemanticRun env Us context contextRun
+      replay expected') (Bs : List VExpr) :
+    env.SpineWF Us.length
+      (Bs ++ contextRun.candidate.context.vlctx.toCtx)
+      (expected'.liftN Bs.length 0)
+      (run.arguments'.map fun argument =>
+        argument.liftN Bs.length 0)
+      (run.result'.liftN Bs.length 0) := by
+  have henv : VEnv.WF env := by
+    simpa only [contextRun.venv_eq] using contextRun.candidate.context.Ewf
+  exact run.spine.weakN henv.ordered
+    (Ctx.LiftN.zero (n := Bs.length)
+      (Γ := contextRun.candidate.context.vlctx.toCtx) Bs)
+
+end ConstructorPreFamilyIndexSpineSemanticRun
+
+/-- Pre-family replay of the family-free pieces of one recursive field.  Π
+domains are checked and introduced normally; the terminal family application
+is replaced by an index-spine replay, so the absent family constant is never
+looked up. -/
+inductive ConstructorPreFamilyRecursiveTrace
+    (stats : InductiveStats) (familyIdx : Nat) (familyIndices : Expr) :
+    (context : Context) → (source : Expr) → (fuel : Nat) → Type where
+  | forallE
+      (context : Context) (name : Name) (domain body : Expr)
+      (binderInfo : BinderInfo)
+      (domainCheck : ConstructorCheckedExpr context domain)
+      (ensureType : ConstructorEnsureTypeObservation context domain)
+      (consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain))
+      (annotations : CandidateIsDefEqObservation context domain
+        (consumeTypeAnnotations domain))
+      (fresh : context.lctx.find? context.freshFVarId = none)
+      (tail : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) fuel) :
+      ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices context
+        (.forallE name domain body binderInfo) (fuel + 1)
+  | target
+      (context : Context) (source : Expr)
+      (valid : isValidIndAppIdx stats source familyIdx = true)
+      (spine : ConstructorPreFamilyIndexSpineTrace context familyIndices
+        (source.getAppArgs.toList.drop stats.params.size)) :
+      ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices context
+        source (fuel + 1)
+
+namespace ConstructorPreFamilyRecursiveTrace
+
+def build (stats : InductiveStats) (familyIdx : Nat)
+    (familyIndices : Expr) :
+    (context : Context) → (source : Expr) → (fuel : Nat) →
+    Except Exception
+      (ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+        context source fuel)
+  | _, _, 0 => throw .deepRecursion
+  | context, .forallE name domain body binderInfo, fuel + 1 => do
+      let domainCheck ← checkConstructorAlignedExpr context domain
+      let ensureType ← observeConstructorEnsureType context domain
+      let consumedCheck ← checkConstructorAlignedExpr context
+        (consumeTypeAnnotations domain)
+      let annotations ← observeCandidateIsDefEq context domain
+        (consumeTypeAnnotations domain)
+      if fresh : context.lctx.find? context.freshFVarId = none then
+        let tail ← build stats familyIdx familyIndices
+          (context.pushLocalDecl name binderInfo
+            (consumeTypeAnnotations domain))
+          (body.instantiate1 context.freshExpr) fuel
+        pure <| .forallE context name domain body binderInfo domainCheck
+          ensureType consumedCheck annotations fresh tail
+      else
+        throw <| .other
+          "pre-family recursive replay reused a local identifier"
+  | context, source, _ + 1 => do
+      if valid : isValidIndAppIdx stats source familyIdx = true then
+        let spine ← ConstructorPreFamilyIndexSpineTrace.build context
+          familyIndices
+          (source.getAppArgs.toList.drop stats.params.size)
+        pure <| .target context source valid spine
+      else
+        throw <| .other
+          "pre-family recursive replay reached a non-family target"
+
+end ConstructorPreFamilyRecursiveTrace
+
+theorem ConstructorPreFamilyRecursiveTrace.forallE_build_eq
+    (domainCheck : ConstructorCheckedExpr context domain)
+    (ensureType : ConstructorEnsureTypeObservation context domain)
+    (consumedCheck : ConstructorCheckedExpr context
+      (consumeTypeAnnotations domain))
+    (annotations : CandidateIsDefEqObservation context domain
+      (consumeTypeAnnotations domain))
+    (fresh : context.lctx.find? context.freshFVarId = none)
+    (tail : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      (context.pushLocalDecl name binderInfo
+        (consumeTypeAnnotations domain))
+      (body.instantiate1 context.freshExpr) fuel)
+    (tailRun : ConstructorPreFamilyRecursiveTrace.build stats familyIdx
+      familyIndices
+      (context.pushLocalDecl name binderInfo
+        (consumeTypeAnnotations domain))
+      (body.instantiate1 context.freshExpr) fuel = .ok tail) :
+    ConstructorPreFamilyRecursiveTrace.build stats familyIdx familyIndices
+        context (.forallE name domain body binderInfo) (fuel + 1) =
+      .ok (.forallE context name domain body binderInfo domainCheck ensureType
+        consumedCheck annotations fresh tail) := by
+  simp only [ConstructorPreFamilyRecursiveTrace.build]
+  rw [domainCheck.check_eq, ensureType.observe_eq, consumedCheck.check_eq]
+  simp only [Bind.bind, Except.bind]
+  rw [annotations.observe_eq]
+  simp only []
+  rw [dif_pos fresh, tailRun]
+  rfl
+
+theorem ConstructorPreFamilyRecursiveTrace.target_build_eq
+    (terminal : source.isForall = false)
+    (valid : isValidIndAppIdx stats source familyIdx = true)
+    (spine : ConstructorPreFamilyIndexSpineTrace context familyIndices
+      (source.getAppArgs.toList.drop stats.params.size)) :
+    ConstructorPreFamilyRecursiveTrace.build stats familyIdx familyIndices
+        context source (fuel + 1) =
+      .ok (.target context source valid spine) := by
+  cases source <;> simp only [ConstructorPreFamilyRecursiveTrace.build]
+  case forallE => simp [Expr.isForall] at terminal
+  all_goals
+    rw [dif_pos valid, spine.build_eq]
+    rfl
+
+/-!
+### Verified pre-family recursive fields
+
+Recursive outer-field locals are intentionally absent here. Nested Pi binders
+inside the field are family-free, so they are checked, interpreted, and pushed
+normally. The terminal family application contributes only its already-verified
+index spine.
+-/
+
+/-- Componentwise verified interpretation of a recursive field replay. -/
+inductive ConstructorPreFamilyRecursiveSemanticRun
+    (env : VEnv) (Us : List Name)
+    (stats : InductiveStats) (familyIdx : Nat) (familyIndices : Expr) :
+    {context : Context} → {source : Expr} → {fuel : Nat} →
+    (contextRun : ConstructorContextRun env Us context) →
+    ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices context
+      source fuel → Type where
+  | forallE
+      {context : Context} {name : Name} {domain body : Expr}
+      {binderInfo : BinderInfo} {fuel : Nat}
+      {domainCheck : ConstructorCheckedExpr context domain}
+      {ensureType : ConstructorEnsureTypeObservation context domain}
+      {consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain)}
+      {annotations : CandidateIsDefEqObservation context domain
+        (consumeTypeAnnotations domain)}
+      {fresh : context.lctx.find? context.freshFVarId = none}
+      {tailTrace : ConstructorPreFamilyRecursiveTrace stats familyIdx
+        familyIndices
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) fuel}
+      {contextRun : ConstructorContextRun env Us context}
+      (domainRun : ConstructorCheckedExpr.Run domainCheck
+        contextRun.candidate)
+      (consumedRun : ConstructorCheckedExpr.Run consumedCheck
+        contextRun.candidate)
+      (ensureTypeRun : TypeChecker.EnsureTypeRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain ensureType.result
+        domainRun.source')
+      (annotationsRun : TypeChecker.IsDefEqRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain
+        (consumeTypeAnnotations domain) domainRun.source'
+        consumedRun.source')
+      (consumedType : contextRun.candidate.context.IsType
+        consumedRun.source')
+      (tail : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+        familyIndices
+        (contextRun.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain) fresh consumedRun.source'
+          consumedRun.check.expr_tr consumedType)
+        tailTrace) :
+      ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+        familyIndices contextRun
+        (.forallE context name domain body binderInfo domainCheck ensureType
+          consumedCheck annotations fresh tailTrace)
+  | target
+      {context : Context} {source : Expr} {fuel : Nat}
+      {valid : isValidIndAppIdx stats source familyIdx = true}
+      {spineTrace : ConstructorPreFamilyIndexSpineTrace context familyIndices
+        (source.getAppArgs.toList.drop stats.params.size)}
+      {contextRun : ConstructorContextRun env Us context}
+      (expected' : VExpr)
+      (spine : ConstructorPreFamilyIndexSpineSemanticRun env Us context
+        contextRun spineTrace expected') :
+      ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+        familyIndices contextRun (.target context source valid spineTrace)
+
+namespace ConstructorPreFamilyRecursiveSemanticRun
+
+/-- Interpret every retained nested-binder and terminal-index operation in the
+exact verified pre-family context. -/
+theorem nonempty
+    (contextRun : ConstructorContextRun env Us context)
+    (trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel) :
+    Nonempty (ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) := by
+  induction trace with
+  | forallE context name domain body binderInfo domainCheck ensureType
+      consumedCheck annotations fresh tailTrace ih =>
+      obtain ⟨domainRun⟩ := ConstructorCheckedExpr.Run.exists domainCheck
+        contextRun.candidate
+      obtain ⟨consumedRun⟩ := ConstructorCheckedExpr.Run.exists consumedCheck
+        contextRun.candidate
+      obtain ⟨ensureTypeRun⟩ :=
+        TypeChecker.EnsureTypeRun.exists_ofConstructorStep
+          ⟨context, domain, ensureType.result⟩ ensureType.valid
+          contextRun.candidate domainRun.source' domainRun.check.expr_tr
+      let annotationsRun := domainRun.isDefEq consumedRun annotations
+      have consumedType : contextRun.candidate.context.IsType
+          consumedRun.source' := by
+        have annotationDef := annotationsRun.isDefEqU.of_l
+          contextRun.candidate.context.Ewf
+          contextRun.candidate.context.Δwf.toCtx ensureTypeRun.source_type
+        exact ⟨ensureTypeRun.resultLevel', annotationDef.hasType.2⟩
+      let tailContext := contextRun.pushLocalDecl name binderInfo
+        (consumeTypeAnnotations domain) fresh consumedRun.source'
+        consumedRun.check.expr_tr consumedType
+      obtain ⟨tail⟩ := ih tailContext
+      exact ⟨.forallE domainRun consumedRun ensureTypeRun annotationsRun
+        consumedType tail⟩
+  | @target traceFuel context source valid spineTrace =>
+      obtain ⟨expected', ⟨spine⟩⟩ :=
+        ConstructorPreFamilyIndexSpineSemanticRun.nonempty contextRun spineTrace
+      exact ⟨@ConstructorPreFamilyRecursiveSemanticRun.target
+        env Us stats familyIdx familyIndices traceFuel
+        context source (traceFuel + 1) valid spineTrace contextRun expected' spine⟩
+
+/-- The verified nested Π-binder telescope retained by the recursive field. -/
+def binders
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) : List VExpr :=
+  match run with
+  | .forallE _ consumedRun _ _ _ tail => consumedRun.source' :: tail.binders
+  | .target _ _ => []
+
+/-- Translation selected for the analyzer-owned family-index telescope. -/
+def expected'
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) : VExpr :=
+  match run with
+  | .forallE _ _ _ _ _ tail => tail.expected'
+  | .target expected' _ => expected'
+
+/-- Translated terminal recursive indices, in source order. -/
+def indices'
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) : List VExpr :=
+  match run with
+  | .forallE _ _ _ _ _ tail => tail.indices'
+  | .target _ spine => spine.arguments'
+
+/-- Translated result type of the terminal recursive index application. -/
+def result'
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) : VExpr :=
+  match run with
+  | .forallE _ _ _ _ _ tail => tail.result'
+  | .target _ spine => spine.result'
+
+/-- The retained recursive Π domains form a verified Theory telescope in the
+exact pre-family context. -/
+theorem onTel
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) :
+    env.OnTel Us.length contextRun.candidate.context.vlctx.toCtx run.binders := by
+  induction run with
+  | @forallE context name domain body binderInfo fuel domainCheck ensureType
+      consumedCheck annotations fresh tailTrace branchContextRun domainRun
+      consumedRun ensureTypeRun annotationsRun consumedType tail ih =>
+      constructor
+      · simpa only [VContext.IsType, branchContextRun.venv_eq,
+          branchContextRun.lparams_eq] using consumedType
+      · simpa only [binders, ConstructorContextRun.pushLocalDecl,
+          CandidateContextRun.pushLocalDecl_vlctx, VLCtx.toCtx] using ih
+  | target => trivial
+
+/-- The terminal recursive indices have the expected analyzer-owned family
+index telescope, below all retained nested Π binders. -/
+theorem spine
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) :
+    env.SpineWF Us.length
+      (run.binders.reverse ++ contextRun.candidate.context.vlctx.toCtx)
+      run.expected' run.indices' run.result' := by
+  induction run with
+  | forallE domainRun consumedRun ensureTypeRun annotationsRun consumedType tail ih =>
+      simpa only [binders, expected', indices', result', List.reverse_cons,
+        List.singleton_append, List.append_assoc,
+        ConstructorContextRun.pushLocalDecl,
+        CandidateContextRun.pushLocalDecl_vlctx, VLCtx.toCtx] using ih
+  | target expectedType spine =>
+      simpa only [binders, expected', indices', result', List.reverse_nil,
+        List.nil_append] using spine.spine
+
+/-- Weaken the retained recursive Π telescope over a later prefix of omitted
+outer recursive fields. -/
+theorem onTel_weakPrefix
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) (Bs : List VExpr) :
+    env.OnTel Us.length
+      (Bs ++ contextRun.candidate.context.vlctx.toCtx)
+      (VExpr.liftTelN Bs.length run.binders 0) := by
+  have henv : VEnv.WF env := by
+    simpa only [contextRun.venv_eq] using contextRun.candidate.context.Ewf
+  exact run.onTel.weakN henv.ordered
+    (Ctx.LiftN.zero (n := Bs.length)
+      (Γ := contextRun.candidate.context.vlctx.toCtx) Bs)
+
+/-- Weaken the terminal recursive index judgment below the same omitted outer
+field prefix, preserving the nested Π-binder depths. -/
+theorem spine_weakPrefix
+    {context : Context} {source : Expr} {fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyRecursiveTrace stats familyIdx familyIndices
+      context source fuel}
+    (run : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) (Bs : List VExpr) :
+    env.SpineWF Us.length
+      ((VExpr.liftTelN Bs.length run.binders 0).reverse ++
+        Bs ++ contextRun.candidate.context.vlctx.toCtx)
+      (run.expected'.liftN Bs.length run.binders.length)
+      (run.indices'.map fun index =>
+        index.liftN Bs.length run.binders.length)
+      (run.result'.liftN Bs.length run.binders.length) := by
+  have henv : VEnv.WF env := by
+    simpa only [contextRun.venv_eq] using contextRun.candidate.context.Ewf
+  simpa only [List.append_assoc, Nat.add_zero] using
+    run.spine.weakN henv.ordered
+      (Ctx.LiftN.consTel run.binders
+        (Ctx.LiftN.zero (n := Bs.length)
+          (Γ := contextRun.candidate.context.vlctx.toCtx) Bs))
+
+end ConstructorPreFamilyRecursiveSemanticRun
+
+/-- Exact executable pre-family replay for one analyzer-owned constructor view.
+
+`removed` contains precisely the validation FVars allocated for recursive
+outer fields that were not inserted into the pre-family checker context.
+`recursiveStarted` records whether such a field has been crossed; later
+ordinary fields are admitted exactly when they are independent of `removed`. -/
+inductive ConstructorPreFamilyViewTrace
+    (stats : InductiveStats) (familyIdx : Nat) (familyIndices : Expr) :
+    (context : Context) → (view : Expr) → (argIdx : Nat) →
+      (removed : List FVarId) → (recursiveStarted : Bool) → Type where
+  | parameter
+      (context : Context) (argIdx : Nat) (removed : List FVarId)
+      (recursiveStarted : Bool)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (parameter : Expr)
+      (parameterAt : stats.params[argIdx]? = some parameter)
+      (tail : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        context (body.instantiate1 parameter) (argIdx + 1) removed
+        recursiveStarted) :
+      ConstructorPreFamilyViewTrace stats familyIdx familyIndices context
+        (.forallE name domain body binderInfo) argIdx removed recursiveStarted
+  | ordinary
+      (context : Context) (argIdx : Nat) (removed : List FVarId)
+      (recursiveStarted : Bool)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (noParameter : stats.params[argIdx]? = none)
+      (nonrecursive : hasIndOcc stats.indConsts domain = false)
+      (independent : constructorIndependentOf domain removed = true)
+      (domainCheck : ConstructorCheckedExpr context domain)
+      (ensureType : ConstructorEnsureTypeObservation context domain)
+      (consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain))
+      (annotations : CandidateIsDefEqObservation context domain
+        (consumeTypeAnnotations domain))
+      (fresh : context.lctx.find? context.freshFVarId = none)
+      (tail : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) removed
+        recursiveStarted) :
+      ConstructorPreFamilyViewTrace stats familyIdx familyIndices context
+        (.forallE name domain body binderInfo) argIdx removed recursiveStarted
+  | recursive
+      (context : Context) (argIdx : Nat) (removed : List FVarId)
+      (recursiveStarted : Bool)
+      (name : Name) (domain body : Expr) (binderInfo : BinderInfo)
+      (noParameter : stats.params[argIdx]? = none)
+      (isRecursive : hasIndOcc stats.indConsts domain = true)
+      (independent : constructorIndependentOf domain removed = true)
+      (field : ConstructorPreFamilyRecursiveTrace stats familyIdx
+        familyIndices context domain context.fuel.inductiveFuel)
+      (fresh : context.lctx.find? context.freshFVarId = none)
+      (tail : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        context.advanceFresh (body.instantiate1 context.freshExpr)
+        (argIdx + 1) (context.freshFVarId :: removed) true) :
+      ConstructorPreFamilyViewTrace stats familyIdx familyIndices context
+        (.forallE name domain body binderInfo) argIdx removed recursiveStarted
+  | terminal
+      (context : Context) (source : Expr) (argIdx : Nat)
+      (removed : List FVarId) (recursiveStarted : Bool)
+      (valid : isValidIndAppIdx stats source familyIdx = true)
+      (independent : constructorIndependentOf source removed = true)
+      (spine : ConstructorPreFamilyIndexSpineTrace context familyIndices
+        (source.getAppArgs.toList.drop stats.params.size)) :
+      ConstructorPreFamilyViewTrace stats familyIdx familyIndices context
+        source argIdx removed recursiveStarted
+
+namespace ConstructorPreFamilyViewTrace
+
+def build (stats : InductiveStats) (familyIdx : Nat)
+    (familyIndices : Expr) :
+    (context : Context) → (view : Expr) → (argIdx : Nat) →
+    (removed : List FVarId) → (recursiveStarted : Bool) → (fuel : Nat) →
+    Except Exception
+      (ConstructorPreFamilyViewTrace stats familyIdx familyIndices context view
+        argIdx removed recursiveStarted)
+  | _, _, _, _, _, 0 => throw .deepRecursion
+  | context, .forallE name domain body binderInfo, argIdx, removed,
+      recursiveStarted, fuel + 1 =>
+      match parameterAt : stats.params[argIdx]? with
+      | some param => do
+          let tail ← build stats familyIdx familyIndices context
+            (body.instantiate1 param) (argIdx + 1) removed
+            recursiveStarted fuel
+          pure <| .parameter context argIdx removed recursiveStarted name domain
+            body binderInfo param parameterAt tail
+      | none => do
+          match recursive : hasIndOcc stats.indConsts domain with
+          | false =>
+              if independent : constructorIndependentOf domain removed = true then
+                let domainCheck ← checkConstructorAlignedExpr context domain
+                let ensureType ← observeConstructorEnsureType context domain
+                let consumedCheck ← checkConstructorAlignedExpr context
+                  (consumeTypeAnnotations domain)
+                let annotations ← observeCandidateIsDefEq context domain
+                  (consumeTypeAnnotations domain)
+                if fresh : context.lctx.find? context.freshFVarId = none then
+                  let tail ← build stats familyIdx familyIndices
+                    (context.pushLocalDecl name binderInfo
+                      (consumeTypeAnnotations domain))
+                    (body.instantiate1 context.freshExpr) (argIdx + 1)
+                    removed recursiveStarted fuel
+                  pure <| .ordinary context argIdx removed recursiveStarted
+                    name domain body binderInfo parameterAt recursive independent domainCheck
+                    ensureType consumedCheck annotations fresh tail
+                else
+                  throw <| .other
+                    "pre-family ordinary replay reused a local identifier"
+              else
+                throw <| .other
+                  "constructor depends on an omitted recursive local"
+          | true =>
+              if independent : constructorIndependentOf domain removed = true then
+                let field ← ConstructorPreFamilyRecursiveTrace.build stats
+                  familyIdx familyIndices context domain
+                  context.fuel.inductiveFuel
+                if fresh : context.lctx.find? context.freshFVarId = none then
+                  let tail ← build stats familyIdx familyIndices
+                    context.advanceFresh
+                    (body.instantiate1 context.freshExpr) (argIdx + 1)
+                    (context.freshFVarId :: removed) true fuel
+                  pure <| .recursive context argIdx removed recursiveStarted
+                    name domain body binderInfo parameterAt recursive independent
+                    field fresh tail
+                else
+                  throw <| .other
+                    "pre-family recursive replay reused a local identifier"
+              else
+                throw <| .other
+                  "constructor depends on an omitted recursive local"
+  | context, source, argIdx, removed, recursiveStarted, _ + 1 => do
+      if valid : isValidIndAppIdx stats source familyIdx = true then
+        if independent : constructorIndependentOf source removed = true then
+          let spine ← ConstructorPreFamilyIndexSpineTrace.build context
+            familyIndices
+            (source.getAppArgs.toList.drop stats.params.size)
+          pure <| .terminal context source argIdx removed recursiveStarted valid
+            independent spine
+        else
+          throw <| .other
+            "constructor result depends on an omitted recursive local"
+      else
+        throw <| .other
+          "pre-family replay reached a non-family constructor result"
+
+end ConstructorPreFamilyViewTrace
+
+theorem ConstructorPreFamilyViewTrace.terminal_build_eq
+    (terminal : source.isForall = false)
+    (valid : isValidIndAppIdx stats source familyIdx = true)
+    (independent : constructorIndependentOf source removed = true)
+    (spine : ConstructorPreFamilyIndexSpineTrace context familyIndices
+      (source.getAppArgs.toList.drop stats.params.size)) :
+    ConstructorPreFamilyViewTrace.build stats familyIdx familyIndices
+        context source argIdx removed recursiveStarted (fuel + 1) =
+      .ok (.terminal context source argIdx removed recursiveStarted valid
+        independent spine) := by
+  cases source <;> simp only [ConstructorPreFamilyViewTrace.build]
+  case forallE => simp [Expr.isForall] at terminal
+  all_goals
+    rw [dif_pos valid, dif_pos independent, spine.build_eq]
+    rfl
+
+/-!
+### Verified pre-family constructor views
+
+This interpretation follows the exact executable D3 trace. Ordinary fields
+are checked and pushed in the pre-family context, recursive outer fields are
+omitted while their family-free nested binders and indices are retained, and
+the terminal result contributes its verified index spine.
+-/
+
+/-- Verified meaning of every family-free operation retained by one exact
+pre-family constructor-view replay. -/
+inductive ConstructorPreFamilyViewSemanticRun
+    (env : VEnv) (Us : List Name)
+    (stats : InductiveStats) (familyIdx : Nat) (familyIndices : Expr) :
+    {context : Context} → {view : Expr} → {argIdx : Nat} →
+    {removed : List FVarId} → {recursiveStarted : Bool} →
+    (contextRun : ConstructorContextRun env Us context) →
+    ConstructorPreFamilyViewTrace stats familyIdx familyIndices context view
+      argIdx removed recursiveStarted → Type where
+  | parameter
+      {context : Context} {argIdx : Nat} {removed : List FVarId}
+      {recursiveStarted : Bool}
+      {name : Name} {domain body : Expr} {binderInfo : BinderInfo}
+      {parameter : Expr}
+      {parameterAt : stats.params[argIdx]? = some parameter}
+      {tailTrace : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        context (body.instantiate1 parameter) (argIdx + 1) removed
+        recursiveStarted}
+      {contextRun : ConstructorContextRun env Us context}
+      (tail : ConstructorPreFamilyViewSemanticRun env Us stats familyIdx
+        familyIndices contextRun tailTrace) :
+      ConstructorPreFamilyViewSemanticRun env Us stats familyIdx familyIndices
+        contextRun
+        (.parameter context argIdx removed recursiveStarted name domain body
+          binderInfo parameter parameterAt tailTrace)
+  | ordinary
+      {context : Context} {argIdx : Nat} {removed : List FVarId}
+      {recursiveStarted : Bool}
+      {name : Name} {domain body : Expr} {binderInfo : BinderInfo}
+      {noParameter : stats.params[argIdx]? = none}
+      {nonrecursive : hasIndOcc stats.indConsts domain = false}
+      {independent : constructorIndependentOf domain removed = true}
+      {domainCheck : ConstructorCheckedExpr context domain}
+      {ensureType : ConstructorEnsureTypeObservation context domain}
+      {consumedCheck : ConstructorCheckedExpr context
+        (consumeTypeAnnotations domain)}
+      {annotations : CandidateIsDefEqObservation context domain
+        (consumeTypeAnnotations domain)}
+      {fresh : context.lctx.find? context.freshFVarId = none}
+      {tailTrace : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain))
+        (body.instantiate1 context.freshExpr) (argIdx + 1) removed
+        recursiveStarted}
+      {contextRun : ConstructorContextRun env Us context}
+      (domainRun : ConstructorCheckedExpr.Run domainCheck
+        contextRun.candidate)
+      (consumedRun : ConstructorCheckedExpr.Run consumedCheck
+        contextRun.candidate)
+      (ensureTypeRun : TypeChecker.EnsureTypeRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain ensureType.result
+        domainRun.source')
+      (annotationsRun : TypeChecker.IsDefEqRun
+        contextRun.candidate.context.venv
+        contextRun.candidate.context.lparams
+        contextRun.candidate.context.vlctx domain
+        (consumeTypeAnnotations domain) domainRun.source'
+        consumedRun.source')
+      (consumedType : contextRun.candidate.context.IsType
+        consumedRun.source')
+      (tail : ConstructorPreFamilyViewSemanticRun env Us stats familyIdx
+        familyIndices
+        (contextRun.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations domain) fresh consumedRun.source'
+          consumedRun.check.expr_tr consumedType)
+        tailTrace) :
+      ConstructorPreFamilyViewSemanticRun env Us stats familyIdx familyIndices
+        contextRun
+        (.ordinary context argIdx removed recursiveStarted name domain body
+          binderInfo noParameter nonrecursive independent domainCheck ensureType
+          consumedCheck annotations fresh tailTrace)
+  | recursive
+      {context : Context} {argIdx : Nat} {removed : List FVarId}
+      {recursiveStarted : Bool}
+      {name : Name} {domain body : Expr} {binderInfo : BinderInfo}
+      {noParameter : stats.params[argIdx]? = none}
+      {isRecursive : hasIndOcc stats.indConsts domain = true}
+      {independent : constructorIndependentOf domain removed = true}
+      {fieldTrace : ConstructorPreFamilyRecursiveTrace stats familyIdx
+        familyIndices context domain context.fuel.inductiveFuel}
+      {fresh : context.lctx.find? context.freshFVarId = none}
+      {tailTrace : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        context.advanceFresh (body.instantiate1 context.freshExpr)
+        (argIdx + 1) (context.freshFVarId :: removed) true}
+      {contextRun : ConstructorContextRun env Us context}
+      (field : ConstructorPreFamilyRecursiveSemanticRun env Us stats familyIdx
+        familyIndices contextRun fieldTrace)
+      (tail : ConstructorPreFamilyViewSemanticRun env Us stats familyIdx
+        familyIndices contextRun.advanceFresh tailTrace) :
+      ConstructorPreFamilyViewSemanticRun env Us stats familyIdx familyIndices
+        contextRun
+        (.recursive context argIdx removed recursiveStarted name domain body
+          binderInfo noParameter isRecursive independent fieldTrace fresh
+          tailTrace)
+  | terminal
+      {context : Context} {source : Expr} {argIdx : Nat}
+      {removed : List FVarId} {recursiveStarted : Bool}
+      {valid : isValidIndAppIdx stats source familyIdx = true}
+      {independent : constructorIndependentOf source removed = true}
+      {spineTrace : ConstructorPreFamilyIndexSpineTrace context familyIndices
+        (source.getAppArgs.toList.drop stats.params.size)}
+      {contextRun : ConstructorContextRun env Us context}
+      (expected' : VExpr)
+      (spine : ConstructorPreFamilyIndexSpineSemanticRun env Us context
+        contextRun spineTrace expected') :
+      ConstructorPreFamilyViewSemanticRun env Us stats familyIdx familyIndices
+        contextRun
+        (.terminal context source argIdx removed recursiveStarted valid
+          independent spineTrace)
+
+namespace ConstructorPreFamilyViewSemanticRun
+
+/-- Interpret every exact family-free checker observation in a successful
+constructor-view replay. -/
+theorem nonempty
+    (contextRun : ConstructorContextRun env Us context)
+    (trace : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+      context view argIdx removed recursiveStarted) :
+    Nonempty (ConstructorPreFamilyViewSemanticRun env Us stats familyIdx
+      familyIndices contextRun trace) := by
+  induction trace with
+  | parameter context argIdx removed recursiveStarted name domain body
+      binderInfo parameter parameterAt tailTrace ih =>
+      obtain ⟨tail⟩ := ih contextRun
+      exact ⟨.parameter tail⟩
+  | ordinary context argIdx removed recursiveStarted name domain body
+      binderInfo noParameter nonrecursive independent domainCheck ensureType
+      consumedCheck annotations fresh tailTrace ih =>
+      obtain ⟨domainRun⟩ := ConstructorCheckedExpr.Run.exists domainCheck
+        contextRun.candidate
+      obtain ⟨consumedRun⟩ := ConstructorCheckedExpr.Run.exists consumedCheck
+        contextRun.candidate
+      obtain ⟨ensureTypeRun⟩ :=
+        TypeChecker.EnsureTypeRun.exists_ofConstructorStep
+          ⟨context, domain, ensureType.result⟩ ensureType.valid
+          contextRun.candidate domainRun.source' domainRun.check.expr_tr
+      let annotationsRun := domainRun.isDefEq consumedRun annotations
+      have consumedType : contextRun.candidate.context.IsType
+          consumedRun.source' := by
+        have annotationDef := annotationsRun.isDefEqU.of_l
+          contextRun.candidate.context.Ewf
+          contextRun.candidate.context.Δwf.toCtx ensureTypeRun.source_type
+        exact ⟨ensureTypeRun.resultLevel', annotationDef.hasType.2⟩
+      let tailContext := contextRun.pushLocalDecl name binderInfo
+        (consumeTypeAnnotations domain) fresh consumedRun.source'
+        consumedRun.check.expr_tr consumedType
+      obtain ⟨tail⟩ := ih tailContext
+      exact ⟨.ordinary domainRun consumedRun ensureTypeRun annotationsRun
+        consumedType tail⟩
+  | recursive context argIdx removed recursiveStarted name domain body
+      binderInfo noParameter isRecursive independent fieldTrace fresh
+      tailTrace tailIH =>
+      obtain ⟨field⟩ :=
+        ConstructorPreFamilyRecursiveSemanticRun.nonempty contextRun fieldTrace
+      obtain ⟨tail⟩ := tailIH contextRun.advanceFresh
+      exact ⟨.recursive field tail⟩
+  | terminal context source argIdx removed recursiveStarted valid independent
+      spineTrace =>
+      obtain ⟨expected', ⟨spine⟩⟩ :=
+        ConstructorPreFamilyIndexSpineSemanticRun.nonempty contextRun spineTrace
+      exact ⟨.terminal expected' spine⟩
+
+end ConstructorPreFamilyViewSemanticRun
+
+private theorem drop_eq_cons_of_getElem?_eq_some
+    {values : List α} {index : Nat} {value : α}
+    (atIndex : values[index]? = some value) :
+    values.drop index = value :: values.drop (index + 1) := by
+  induction values generalizing index with
+  | nil => simp at atIndex
+  | cons head tail ih =>
+      cases index with
+      | zero =>
+          simp at atIndex
+          simp [atIndex]
+      | succ index =>
+          simp at atIndex ⊢
+          simpa [Nat.add_assoc, Nat.add_comm 1] using ih atIndex
+
+private theorem eq_length_of_getElem?_eq_none
+    {values : List α} {index : Nat}
+    (atIndex : values[index]? = none)
+    (indexLe : index ≤ values.length) :
+    index = values.length := by
+  induction values generalizing index with
+  | nil => simp_all
+  | cons head tail ih =>
+      cases index with
+      | zero => simp at atIndex
+      | succ index =>
+          simp at atIndex
+          simp only [List.length_cons, Nat.succ_le_succ_iff] at indexLe
+          have indexEq : index = tail.length :=
+            Nat.le_antisymm indexLe atIndex
+          simp [indexEq]
+
+/-- The exact D3 suffix after consuming every validator-owned parameter.
+The context is unchanged because parameter branches instantiate existing
+locals rather than pushing constructor fields. -/
+structure ConstructorPreFamilyParameterSuffix
+    {env : VEnv} {Us : List Name}
+    {stats : InductiveStats} {familyIndices : Expr}
+    {context : Context}
+    {removed : List FVarId} {recursiveStarted : Bool}
+    {contextRun : ConstructorContextRun env Us context}
+    (rest : Expr) where
+  trace : ConstructorPreFamilyViewTrace stats 0 familyIndices
+    context rest stats.params.size removed recursiveStarted
+  semantic : ConstructorPreFamilyViewSemanticRun env Us stats 0
+    familyIndices contextRun trace
+
+namespace ConstructorPreFamilyViewSemanticRun
+
+/-- Strip the exact validator-owned parameter prefix from a verified D3
+view trace.  The successful executable instantiation equation excludes an
+early terminal, while the indexed parameter lookups exclude an early field. -/
+theorem afterParameters
+    {env : VEnv} {Us : List Name}
+    {stats : InductiveStats} {familyIndices : Expr}
+    {familyName : Name} {levels : List Level}
+    {context : Context} {view rest : Expr} {argIdx : Nat}
+    {removed : List FVarId} {recursiveStarted : Bool}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorPreFamilyViewTrace stats 0 familyIndices
+      context view argIdx removed recursiveStarted}
+    (semantic : ConstructorPreFamilyViewSemanticRun env Us stats 0
+      familyIndices contextRun trace)
+    (indConsts : stats.indConsts = #[.const familyName levels])
+    (argIdxLe : argIdx ≤ stats.params.size)
+    (instantiation : instantiateFamilyParameters view
+      (stats.params.toList.drop argIdx) = .ok rest) :
+    Nonempty (ConstructorPreFamilyParameterSuffix
+      (env := env) (Us := Us) (stats := stats)
+      (familyIndices := familyIndices) (context := context)
+      (removed := removed) (recursiveStarted := recursiveStarted)
+      (contextRun := contextRun) rest) := by
+  induction semantic generalizing rest with
+  | @parameter context argIdx removed recursiveStarted name domain body
+      binderInfo parameter parameterAt tailTrace contextRun tail ih =>
+      have atList : stats.params.toList[argIdx]? = some parameter := by
+        simpa only [← Array.getElem?_toList] using parameterAt
+      have dropped := drop_eq_cons_of_getElem?_eq_some atList
+      rw [dropped] at instantiation
+      simp only [instantiateFamilyParameters] at instantiation
+      have argIdxLt : argIdx < stats.params.size := by
+        by_contra notLt
+        have argIdxEq : argIdx = stats.params.size := by omega
+        subst argIdx
+        simp at parameterAt
+      exact ih (by omega) instantiation
+  | @ordinary context argIdx removed recursiveStarted name domain body
+      binderInfo noParameter nonrecursive independent domainCheck ensureType
+      consumedCheck annotations fresh tailTrace contextRun domainRun consumedRun
+      ensureTypeRun annotationsRun consumedType tail =>
+      have noParameterList : stats.params.toList[argIdx]? = none := by
+        simpa only [← Array.getElem?_toList] using noParameter
+      have argIdxEq : argIdx = stats.params.toList.length :=
+        eq_length_of_getElem?_eq_none noParameterList (by simpa using argIdxLe)
+      have sizeEq : stats.params.toList.length = stats.params.size := by simp
+      rw [sizeEq] at argIdxEq
+      subst argIdx
+      have dropEq : stats.params.toList.drop stats.params.size = [] := by
+        simp
+      rw [dropEq] at instantiation
+      have viewEq : (.forallE name domain body binderInfo) = rest :=
+        Except.ok.inj (by
+          change Except.ok (.forallE name domain body binderInfo) =
+            Except.ok rest at instantiation
+          exact instantiation)
+      subst rest
+      let suffixTrace := ConstructorPreFamilyViewTrace.ordinary context
+        stats.params.size removed recursiveStarted name domain body binderInfo
+        noParameter nonrecursive independent domainCheck ensureType consumedCheck
+        annotations fresh tailTrace
+      exact ⟨⟨suffixTrace,
+        ConstructorPreFamilyViewSemanticRun.ordinary domainRun consumedRun
+          ensureTypeRun annotationsRun consumedType tail⟩⟩
+  | @recursive context argIdx removed recursiveStarted name domain body
+      binderInfo noParameter isRecursive independent fieldTrace fresh tailTrace
+      contextRun field tail =>
+      have noParameterList : stats.params.toList[argIdx]? = none := by
+        simpa only [← Array.getElem?_toList] using noParameter
+      have argIdxEq : argIdx = stats.params.toList.length :=
+        eq_length_of_getElem?_eq_none noParameterList (by simpa using argIdxLe)
+      have sizeEq : stats.params.toList.length = stats.params.size := by simp
+      rw [sizeEq] at argIdxEq
+      subst argIdx
+      have dropEq : stats.params.toList.drop stats.params.size = [] := by
+        simp
+      rw [dropEq] at instantiation
+      have viewEq : (.forallE name domain body binderInfo) = rest :=
+        Except.ok.inj (by
+          change Except.ok (.forallE name domain body binderInfo) =
+            Except.ok rest at instantiation
+          exact instantiation)
+      subst rest
+      let suffixTrace := ConstructorPreFamilyViewTrace.recursive context
+        stats.params.size removed recursiveStarted name domain body binderInfo
+        noParameter isRecursive independent fieldTrace fresh tailTrace
+      exact ⟨⟨suffixTrace,
+        ConstructorPreFamilyViewSemanticRun.recursive field tail⟩⟩
+  | @terminal context source argIdx removed recursiveStarted valid independent
+      spineTrace contextRun expected spine =>
+      by_cases argIdxEq : argIdx = stats.params.size
+      · subst argIdx
+        have dropEq : stats.params.toList.drop stats.params.size = [] := by
+          simp
+        rw [dropEq] at instantiation
+        have viewEq : source = rest :=
+          Except.ok.inj (by
+            change Except.ok source = Except.ok rest at instantiation
+            exact instantiation)
+        subst rest
+        let suffixTrace := ConstructorPreFamilyViewTrace.terminal context source
+          stats.params.size removed recursiveStarted valid independent
+          spineTrace
+        exact ⟨⟨suffixTrace,
+          ConstructorPreFamilyViewSemanticRun.terminal expected spine⟩⟩
+      · have argIdxLt : argIdx < stats.params.size := by omega
+        obtain ⟨parameter, parameterAt⟩ :
+            ∃ parameter, stats.params.toList[argIdx]? = some parameter := by
+          have listLt : argIdx < stats.params.toList.length := by
+            simpa using argIdxLt
+          exact ⟨stats.params.toList[argIdx], by
+            simp only [List.getElem?_eq_getElem listLt]⟩
+        have dropped := drop_eq_cons_of_getElem?_eq_some parameterAt
+        rw [dropped] at instantiation
+        cases source <;>
+          simp only [instantiateFamilyParameters] at instantiation
+        case forallE binderName binderType body binderInfo =>
+          unfold isValidIndAppIdx at valid
+          rw [indConsts] at valid
+          simp only [Expr.withApp_eq, Expr.getAppFn] at valid
+          cases headEq :
+              ((.forallE binderName binderType body binderInfo : Expr) ==
+                .const familyName levels) with
+          | false => simp [headEq] at valid
+          | true =>
+              change Expr.eqv
+                (.forallE binderName binderType body binderInfo)
+                (.const familyName levels) = true at headEq
+              rw [Expr.eqv_eq] at headEq
+              simp [Expr.eqv'] at headEq
+        all_goals exact nomatch instantiation
+
+end ConstructorPreFamilyViewSemanticRun
+
+/-- The exact D2 suffix after consuming every validator-owned parameter.
+Both the executable alignment and its verified semantic interpretation are
+retained at the first ordinary field or terminal result. -/
+structure ConstructorViewParameterSuffix
+    {env : VEnv} {Us : List Name} {whnfFuel : Nat}
+    {stats : InductiveStats} {isUnsafe : Bool} {familyIdx : Nat}
+    {ctor : Name} {context : Context}
+    {contextRun : ConstructorContextRun env Us context}
+    (rest : Expr) where
+  source : Expr
+  fuel : Nat
+  trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+    context source stats.params.size fuel
+  alignment : ConstructorViewAlignmentTrace trace rest
+  semantic : ConstructorViewSemanticRun env Us whnfFuel contextRun trace rest
+
+namespace ConstructorViewSemanticRun
+
+/-- Strip the exact parameter prefix shared by D2's validation trace and
+analyzer view alignment. Parameter lookups exclude an early ordinary field;
+the alignment's retained non-Pi fact excludes an early terminal. -/
+theorem afterParameters
+    {env : VEnv} {Us : List Name} {whnfFuel : Nat}
+    {stats : InductiveStats} {isUnsafe : Bool} {familyIdx : Nat}
+    {ctor : Name} {context : Context} {source view rest : Expr}
+    {argIdx fuel : Nat}
+    {contextRun : ConstructorContextRun env Us context}
+    {trace : ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context source argIdx fuel}
+    (alignment : ConstructorViewAlignmentTrace trace view)
+    (semantic : ConstructorViewSemanticRun env Us whnfFuel contextRun trace
+      view)
+    (argIdxLe : argIdx ≤ stats.params.size)
+    (instantiation : instantiateFamilyParameters view
+      (stats.params.toList.drop argIdx) = .ok rest) :
+    ∃ suffix : ConstructorViewParameterSuffix
+      (env := env) (Us := Us) (whnfFuel := whnfFuel)
+      (stats := stats) (isUnsafe := isUnsafe) (familyIdx := familyIdx)
+      (ctor := ctor) (context := context) (contextRun := contextRun) rest,
+      suffix.trace.universeSemantics = trace.universeSemantics := by
+  induction trace generalizing view rest with
+  | parameter context fuel argIdx name domain body binderInfo param
+      parameterType parameterAt parameterTypeRun validationDefEq tailTrace ih =>
+      cases alignment with
+      | parameter domainCheck viewDomainCheck parameterTypeCheck
+          parameterShape parameterPresent _ tailAlignment =>
+        cases semantic with
+        | parameter domainRun viewDomainRun parameterTypeSemantic validationRun
+            tail =>
+          have atList : stats.params.toList[argIdx]? = some param := by
+            simpa only [← Array.getElem?_toList] using parameterAt
+          have dropped := drop_eq_cons_of_getElem?_eq_some atList
+          rw [dropped] at instantiation
+          simp only [instantiateFamilyParameters] at instantiation
+          obtain ⟨suffix, suffixUniverse⟩ := ih tailAlignment tail (by
+            have argIdxLt : argIdx < stats.params.size := by
+              by_contra notLt
+              have argIdxEq : argIdx = stats.params.size := by omega
+              subst argIdx
+              simp at parameterAt
+            omega) instantiation
+          exact ⟨suffix, by
+            simpa only [ConstructorTypeValidationTrace.universeSemantics]
+              using suffixUniverse⟩
+  | ordinary context fuel argIdx name domain body binderInfo sortResult
+      noParameter ensureTypeStep universeTrace positivityTrace tailTrace ih =>
+      cases alignment with
+      | @ordinary _ _ viewDomain _ _ _ _ _ _ _ _ _ _ _ _ _ viewName
+          viewBody viewBinderInfo domainCheck viewDomainCheck viewEquality
+          consumedCheck _ positivityAlignment fresh annotations _
+          tailAlignment =>
+        cases semantic with
+        | ordinary domainRun viewDomainRun viewEqualityRun consumedRun
+            ensureTypeRun positivity annotationsRun consumedType tail =>
+          have noParameterList : stats.params.toList[argIdx]? = none := by
+            simpa only [← Array.getElem?_toList] using noParameter
+          have argIdxEq : argIdx = stats.params.toList.length :=
+            eq_length_of_getElem?_eq_none noParameterList
+              (by simpa using argIdxLe)
+          have sizeEq : stats.params.toList.length = stats.params.size := by
+            simp
+          rw [sizeEq] at argIdxEq
+          subst argIdx
+          have dropEq : stats.params.toList.drop stats.params.size = [] := by
+            simp
+          rw [dropEq] at instantiation
+          injection instantiation with restEq
+          subst rest
+          let suffixTrace := ConstructorTypeValidationTrace.ordinary context
+            fuel stats.params.size name domain body binderInfo sortResult
+            noParameter ensureTypeStep universeTrace positivityTrace tailTrace
+          have suffixAlignment : ConstructorViewAlignmentTrace suffixTrace
+              (.forallE viewName viewDomain viewBody viewBinderInfo) :=
+            ConstructorViewAlignmentTrace.ordinary domainCheck
+              viewDomainCheck viewEquality consumedCheck positivityTrace
+              positivityAlignment fresh annotations tailTrace tailAlignment
+          have suffixSemantic : ConstructorViewSemanticRun env Us whnfFuel
+              contextRun suffixTrace
+                (.forallE viewName viewDomain viewBody viewBinderInfo) :=
+            ConstructorViewSemanticRun.ordinary
+              (viewEquality := viewEquality) domainRun viewDomainRun
+              viewEqualityRun consumedRun ensureTypeRun positivity
+              annotationsRun consumedType tail
+          exact ⟨⟨_, fuel + 1, suffixTrace, suffixAlignment,
+            suffixSemantic⟩, rfl⟩
+  | terminal context source fuel argIdx sourceTerminal sourceValid =>
+      cases alignment with
+      | terminal sourceCheck viewCheck viewTerminal viewValid =>
+        cases semantic with
+        | terminal sourceRun viewRun =>
+          by_cases argIdxEq : argIdx = stats.params.size
+          · subst argIdx
+            have dropEq : stats.params.toList.drop stats.params.size = [] := by
+              simp
+            rw [dropEq] at instantiation
+            have viewEq : view = rest := Except.ok.inj instantiation
+            subst rest
+            let suffixTrace : ConstructorTypeValidationTrace stats isUnsafe
+                familyIdx ctor context source stats.params.size (fuel + 1) :=
+              ConstructorTypeValidationTrace.terminal context source fuel
+                stats.params.size sourceTerminal sourceValid
+            have suffixAlignment : ConstructorViewAlignmentTrace suffixTrace
+                view :=
+              ConstructorViewAlignmentTrace.terminal sourceCheck viewCheck
+                viewTerminal viewValid
+            have suffixSemantic : ConstructorViewSemanticRun env Us whnfFuel
+                contextRun suffixTrace view :=
+              ConstructorViewSemanticRun.terminal (isUnsafe := isUnsafe)
+                (ctor := ctor) sourceRun viewRun
+            exact ⟨⟨source, fuel + 1, suffixTrace, suffixAlignment,
+              suffixSemantic⟩, rfl⟩
+          · have argIdxLt : argIdx < stats.params.size := by omega
+            obtain ⟨parameter, parameterAt⟩ :
+                ∃ parameter, stats.params.toList[argIdx]? = some parameter := by
+              have listLt : argIdx < stats.params.toList.length := by
+                simpa using argIdxLt
+              exact ⟨stats.params.toList[argIdx], by
+                simp only [List.getElem?_eq_getElem listLt]⟩
+            have dropped := drop_eq_cons_of_getElem?_eq_some parameterAt
+            rw [dropped] at instantiation
+            cases view <;>
+              simp_all [instantiateFamilyParameters, Expr.isForall]
+
+end ConstructorViewSemanticRun
+
+private def candidateForallDepth : Expr → Nat
+  | .forallE _ _ body _ => candidateForallDepth body + 1
+  | _ => 0
+
+private theorem candidateForallDepth_le_instantiate1'
+    (expression argument : Expr) (depth : Nat) :
+    candidateForallDepth expression ≤
+      candidateForallDepth (expression.instantiate1' argument depth) := by
+  induction expression generalizing depth <;>
+    simp [candidateForallDepth, Expr.instantiate1', *]
+
+private theorem candidateForallDepth_abstract1
+    (expression : Expr) (id : FVarId) (depth : Nat) :
+    candidateForallDepth (Expr.abstract1 id expression depth) =
+      candidateForallDepth expression := by
+  induction expression generalizing depth <;>
+    simp [candidateForallDepth, Expr.abstract1, *]
+  split <;> rfl
+
+private theorem candidateForallDepth_abstractList
+    (expression : Expr) (ids : List FVarId) (depth : Nat) :
+    candidateForallDepth (Expr.abstractList expression ids depth) =
+      candidateForallDepth expression := by
+  induction ids generalizing expression with
+  | nil => rfl
+  | cons id ids ih =>
+      simp only [Expr.abstractList, ih, candidateForallDepth_abstract1]
+
+private theorem candidateForallDepth_abstract
+    (expression : Expr) (ids : List FVarId) :
+    candidateForallDepth (expression.abstract ⟨ids.map Expr.fvar⟩) =
+      candidateForallDepth expression := by
+  rw [Expr.abstract_eq]
+  exact candidateForallDepth_abstractList expression ids 0
+
+private theorem candidateView_forallDepth
+    (trace : CandidateExprTrace context source) :
+    trace.spineLength ≤ candidateForallDepth trace.view := by
+  induction trace with
+  | terminal => exact Nat.zero_le _
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked normalized domainCandidate
+      bodyCandidate domainIH bodyIH =>
+      simp only [CandidateExprTrace.view, candidateForallDepth,
+        CandidateExprTrace.spineLength]
+      rw [show #[context.freshExpr] =
+        ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl,
+        candidateForallDepth_abstract]
+      omega
+
+private theorem instantiateFamilyParameters_exists_of_forallDepth
+    (length : parameters.length ≤ candidateForallDepth source) :
+    ∃ rest, instantiateFamilyParameters source parameters = .ok rest := by
+  induction parameters generalizing source with
+  | nil => exact ⟨source, rfl⟩
+  | cons parameter parameters ih =>
+      cases source <;> simp [candidateForallDepth] at length
+      case forallE name domain body binderInfo =>
+        have bodyLength : parameters.length ≤ candidateForallDepth
+            (body.instantiate1 parameter) := by
+          rw [Expr.instantiate1_eq]
+          exact Nat.le_trans
+            (by omega : parameters.length ≤ candidateForallDepth body)
+            (candidateForallDepth_le_instantiate1' body parameter 0)
+        obtain ⟨rest, restEq⟩ := ih bodyLength
+        exact ⟨rest, restEq⟩
+
+/-- A reconstructed candidate view can instantiate any parameter list no
+longer than its retained main Pi spine.  This is only a syntactic success
+fact; the exact Theory endpoint is supplied separately by strict translation. -/
+theorem CandidateExprTrace.instantiateViewParameters
+    (trace : CandidateExprTrace context source)
+    (parameters : List Expr)
+    (length : parameters.length ≤ trace.spineLength) :
+    ∃ rest, instantiateFamilyParameters trace.view parameters = .ok rest := by
+  apply instantiateFamilyParameters_exists_of_forallDepth
+  exact Nat.le_trans length (candidateView_forallDepth trace)
+
+namespace ConstructorPreFamilyViewSemanticRun
+
+/-- Weaken an exact ordinary-field type over any later field prefix. -/
+theorem ordinaryType_weakPrefix
+    (contextRun : ConstructorContextRun env Us context)
+    {fieldType : VExpr}
+    (fieldTypeWF : contextRun.candidate.context.IsType fieldType)
+    (Bs : List VExpr) :
+    env.IsType Us.length
+      (Bs ++ contextRun.candidate.context.vlctx.toCtx)
+      (fieldType.liftN Bs.length 0) := by
+  have henv : VEnv.WF env := by
+    simpa only [contextRun.venv_eq] using contextRun.candidate.context.Ewf
+  have fieldTypeWF' : env.IsType Us.length
+      contextRun.candidate.context.vlctx.toCtx fieldType := by
+    simpa only [VContext.IsType, contextRun.venv_eq,
+      contextRun.lparams_eq] using fieldTypeWF
+  exact fieldTypeWF'.weakN henv.ordered
+    (Ctx.LiftN.zero (n := Bs.length)
+      (Γ := contextRun.candidate.context.vlctx.toCtx) Bs)
+
+end ConstructorPreFamilyViewSemanticRun
+
+/-- Source-ordered D3 traces for the exact dependent constructor candidate
+list selected by the producer. -/
+inductive ConstructorPreFamilyListTrace
+    (stats : InductiveStats) (familyIdx : Nat) (familyIndices : Expr)
+    (context : Context) :
+    {constructors : List Constructor} →
+    AddInductive.CandidateList AddInductive.CandidateConstructor constructors →
+      Type where
+  | nil : ConstructorPreFamilyListTrace stats familyIdx familyIndices context
+      .nil
+  | cons
+      (head : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        context candidate.type.view 0 [] false)
+      (tail : ConstructorPreFamilyListTrace stats familyIdx familyIndices
+        context candidates) :
+      ConstructorPreFamilyListTrace stats familyIdx familyIndices context
+        (.cons candidate candidates)
+
+namespace ConstructorPreFamilyListTrace
+
+def build (stats : InductiveStats) (familyIdx : Nat)
+    (familyIndices : Expr) (context : Context) :
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors) →
+    Except Exception
+      (ConstructorPreFamilyListTrace stats familyIdx familyIndices context
+        candidates)
+  | .nil => pure .nil
+  | .cons head tail => do
+      let headTrace ← ConstructorPreFamilyViewTrace.build stats familyIdx
+        familyIndices context head.type.view 0 [] false
+        context.fuel.inductiveFuel
+      let tailTrace ← build stats familyIdx familyIndices context tail
+      pure <| .cons headTrace tailTrace
+
+end ConstructorPreFamilyListTrace
+
+theorem ConstructorPreFamilyListTrace.cons_build_eq
+    (head : ConstructorPreFamilyViewTrace stats familyIdx familyIndices context
+      candidate.type.view 0 [] false)
+    (headRun : ConstructorPreFamilyViewTrace.build stats familyIdx
+      familyIndices context candidate.type.view 0 [] false
+      context.fuel.inductiveFuel = .ok head)
+    (tail : ConstructorPreFamilyListTrace stats familyIdx familyIndices context
+      candidates)
+    (tailRun : ConstructorPreFamilyListTrace.build stats familyIdx
+      familyIndices context candidates = .ok tail) :
+    ConstructorPreFamilyListTrace.build stats familyIdx familyIndices context
+        (.cons candidate candidates) = .ok (.cons head tail) := by
+  simp only [ConstructorPreFamilyListTrace.build]
+  rw [headRun]
+  simp only [Bind.bind, Except.bind]
+  rw [tailRun]
+  rfl
+
+/-- Source-ordered verified pre-family meaning for every analyzer-owned
+constructor candidate selected by the executable D3 gate. -/
+inductive ConstructorPreFamilyListSemanticRun
+    (env : VEnv) (Us : List Name)
+    (stats : InductiveStats) (familyIdx : Nat) (familyIndices : Expr)
+    (context : Context) (contextRun : ConstructorContextRun env Us context) :
+    {constructors : List Constructor} →
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors} →
+    ConstructorPreFamilyListTrace stats familyIdx familyIndices context
+      candidates → Type where
+  | nil : ConstructorPreFamilyListSemanticRun env Us stats familyIdx
+      familyIndices context contextRun (.nil)
+  | cons
+      {candidate : AddInductive.CandidateConstructor constructor}
+      {candidates : AddInductive.CandidateList
+        AddInductive.CandidateConstructor constructors}
+      {headTrace : ConstructorPreFamilyViewTrace stats familyIdx familyIndices
+        context candidate.type.view 0 [] false}
+      {tailTrace : ConstructorPreFamilyListTrace stats familyIdx familyIndices
+        context candidates}
+      (head : ConstructorPreFamilyViewSemanticRun env Us stats familyIdx
+        familyIndices contextRun headTrace)
+      (tail : ConstructorPreFamilyListSemanticRun env Us stats familyIdx
+        familyIndices context contextRun tailTrace) :
+      ConstructorPreFamilyListSemanticRun env Us stats familyIdx
+        familyIndices context contextRun (.cons headTrace tailTrace)
+
+namespace ConstructorPreFamilyListSemanticRun
+
+/-- Interpret every constructor position retained by a successful executable
+D3 list trace in the same verified pre-family context. -/
+theorem nonempty
+    (contextRun : ConstructorContextRun env Us context)
+    (trace : ConstructorPreFamilyListTrace stats familyIdx familyIndices
+      context candidates) :
+    Nonempty (ConstructorPreFamilyListSemanticRun env Us stats familyIdx
+      familyIndices context contextRun trace) := by
+  induction trace with
+  | nil => exact ⟨.nil⟩
+  | cons headTrace tailTrace ih =>
+      obtain ⟨head⟩ := ConstructorPreFamilyViewSemanticRun.nonempty contextRun
+        headTrace
+      obtain ⟨tail⟩ := ih
+      exact ⟨.cons head tail⟩
+
+end ConstructorPreFamilyListSemanticRun
+
+/-- Exact output of the executable D3 gate. -/
+structure ConstructorPreFamilySafetyTrace
+    (stats : InductiveStats) (familyView : Expr)
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors)
+    (context : Context) where
+  translationUnique :
+    (theoryTranslationUnique familyView &&
+      candidates.viewTranslationUnique) = true
+  familyIndices : Expr
+  parameters : instantiateFamilyParameters familyView stats.params.toList =
+    .ok familyIndices
+  constructors : ConstructorPreFamilyListTrace stats 0 familyIndices context
+    candidates
+
+theorem ConstructorPreFamilySafetyTrace.familyTranslationUnique
+    (trace : ConstructorPreFamilySafetyTrace stats familyView candidates
+      context) :
+    TrExprS.IsUnique familyView :=
+  by
+    have unique := trace.translationUnique
+    simp only [Bool.and_eq_true] at unique
+    exact theoryTranslationUnique_sound unique.1
+
+theorem ConstructorPreFamilySafetyTrace.constructorTranslationUnique
+    (trace : ConstructorPreFamilySafetyTrace stats familyView candidates
+      context) :
+    candidates.ViewTranslationUnique :=
+  by
+    have unique := trace.translationUnique
+    simp only [Bool.and_eq_true] at unique
+    exact candidates.viewTranslationUnique_sound unique.2
+
+/-- Build the complete D3 trace or return the first structural/checker
+failure. -/
+def buildConstructorPreFamilySafety
+    (stats : InductiveStats) (familyView : Expr)
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors)
+    (context : Context) :
+    Except Exception
+      (ConstructorPreFamilySafetyTrace stats familyView candidates context) :=
+  match translationUnique :
+      theoryTranslationUnique familyView &&
+        candidates.viewTranslationUnique with
+  | false => throw <| .other
+      "candidate view contains a projection with no exact Theory endpoint"
+  | true =>
+      match parameters :
+          instantiateFamilyParameters familyView stats.params.toList with
+      | .error error => .error error
+      | .ok familyIndices => do
+          let constructors ← ConstructorPreFamilyListTrace.build stats 0
+            familyIndices context candidates
+          pure ⟨translationUnique, familyIndices, parameters, constructors⟩
+
+/-! ### Executable pre-family rejection fixtures -/
+
+private def preFamilyNegativeStats : InductiveStats where
+  levels := []
+  resultLevel := .zero
+  nindices := #[0]
+  indConsts := #[.const `PreFamilyNegative []]
+  params := #[]
+  isNotZero := true
+
+private def preFamilyNegativeContext : Context where
+  env := Kernel.Environment.ofConstants `_preFamilyNegative
+    ({} : ConstMap)
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+/- The traversal begins from the public gate's initial state. Its first
+recursive field is omitted from the pre-family context, while the following
+ordinary field is independent of that local and is therefore admissible. -/
+private def preFamilyOrdinaryAfterRecursiveView : Expr :=
+  .forallE `recursive (.const `PreFamilyNegative [])
+    (.forallE `ordinary (.sort .zero)
+      (.const `PreFamilyNegative []) .default)
+    .default
+
+private def preFamilyOrdinaryAfterRecursiveAccepted : Bool :=
+  match ConstructorPreFamilyViewTrace.build preFamilyNegativeStats 0
+      (.sort (.succ .zero)) preFamilyNegativeContext
+      preFamilyOrdinaryAfterRecursiveView 0 [] false
+      preFamilyNegativeContext.fuel.inductiveFuel with
+  | .ok _ => true
+  | .error _ => false
+
+#guard preFamilyOrdinaryAfterRecursiveAccepted
+
+/- The first recursive local is deliberately omitted. Instantiating the next
+recursive field exposes that FVar in its domain, so the dependency gate must
+reject it before attempting the recursive-field replay. -/
+private def preFamilyRecursiveLocalDependencyView : Expr :=
+  .forallE `recursive (.const `PreFamilyNegative [])
+    (.forallE `dependent
+      (.app (.const `PreFamilyNegative []) (.bvar 0))
+      (.const `PreFamilyNegative []) .default)
+    .default
+
+private def preFamilyRecursiveLocalDependencyRejected : Bool :=
+  match ConstructorPreFamilyViewTrace.build preFamilyNegativeStats 0
+      (.sort (.succ .zero)) preFamilyNegativeContext
+      preFamilyRecursiveLocalDependencyView 0 [] false
+      preFamilyNegativeContext.fuel.inductiveFuel with
+  | .error (.other message) =>
+      message == "constructor depends on an omitted recursive local"
+  | _ => false
+
+#guard preFamilyRecursiveLocalDependencyRejected
+
+/-- One executable D3 gate for the complete singleton constructor list.  It
+both enforces the recursive-suffix/dependency subset and re-runs every
+family-free checker operation in the supplied pre-family context. -/
+def checkConstructorPreFamilySafety
+    (stats : InductiveStats) (familyView : Expr)
+    (candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors) : M Unit := fun context =>
+  if theoryTranslationUnique familyView &&
+      candidates.viewTranslationUnique then do
+    let familyIndices ← instantiateFamilyParameters familyView
+      stats.params.toList
+    let _ ← ConstructorPreFamilyListTrace.build stats 0 familyIndices context
+      candidates
+    pure ()
+  else
+    throw <| .other
+      "candidate view contains a projection with no exact Theory endpoint"
+
+/-- A successful executable D3 gate returns its exact parameter-instantiated
+family telescope and source-ordered replay trace. -/
+theorem ConstructorPreFamilyListTrace.nonempty_of_check
+    (success : checkConstructorPreFamilySafety stats familyView candidates
+      context = .ok ()) :
+    Nonempty (ConstructorPreFamilySafetyTrace stats familyView candidates
+      context) := by
+  unfold checkConstructorPreFamilySafety at success
+  cases translationUnique :
+      theoryTranslationUnique familyView &&
+        candidates.viewTranslationUnique with
+  | false => simp [translationUnique] at success
+  | true =>
+      cases parameters : instantiateFamilyParameters familyView
+          stats.params.toList with
+      | error error =>
+          simp [translationUnique, parameters, Bind.bind, Except.bind] at success
+      | ok familyIndices =>
+          cases constructorsRun : ConstructorPreFamilyListTrace.build stats 0
+              familyIndices context candidates with
+          | error error =>
+              simp [translationUnique, parameters, constructorsRun,
+                Bind.bind, Except.bind] at success
+          | ok constructors =>
+              exact ⟨⟨translationUnique, familyIndices, parameters,
+                constructors⟩⟩
+
+/-- A successful executable D3 gate guarantees the retained builder returns
+its trace, so gate owners can replay `buildConstructorPreFamilySafety`
+instead of choosing from `Nonempty`. -/
+theorem buildConstructorPreFamilySafety_ok_of_check
+    (success : checkConstructorPreFamilySafety stats familyView candidates
+      context = .ok ()) :
+    ∃ trace, buildConstructorPreFamilySafety stats familyView candidates
+      context = .ok trace := by
+  unfold checkConstructorPreFamilySafety at success
+  unfold buildConstructorPreFamilySafety
+  split
+  next translationUnique =>
+    simp [translationUnique] at success
+  next translationUnique =>
+    split
+    next error parameters =>
+      simp [translationUnique, parameters, Bind.bind, Except.bind] at success
+    next familyIndices parameters =>
+      cases hbuild : ConstructorPreFamilyListTrace.build stats 0 familyIndices
+          context candidates with
+      | error error =>
+          simp [translationUnique, parameters, hbuild,
+            Bind.bind, Except.bind] at success
+      | ok constructors =>
+          exact ⟨_, rfl⟩
+
+end AddInductive
+
+namespace TypeChecker
+open AddInductive
+
+private theorem abstract1_instantiate_self
+    (expression : Expr) (id : FVarId) (depth : Nat) :
+    Closed expression depth →
+    (expression.abstract1 id depth).instantiate1' (.fvar id) depth =
+      expression := by
+  induction expression generalizing depth <;>
+    simp_all [Closed, Expr.abstract1, Expr.instantiate1', beq_iff_eq]
+  split <;>
+    simp_all [Expr.instantiate1', Expr.liftLooseBVars']
+
+private theorem abstract_instantiate_self
+    (expression : Expr) (id : FVarId) (closed : Closed expression) :
+    (expression.abstract #[.fvar id]).instantiate1 (.fvar id) =
+      expression := by
+  rw [show #[Expr.fvar id] = ⟨[id].map Expr.fvar⟩ by rfl]
+  simp only [Expr.abstract_eq, Expr.abstractList, Expr.instantiate1_eq]
+  exact abstract1_instantiate_self expression id 0 closed
+
+/-- A source-ordered list of kernel parameter FVars builds an exact verified
+local telescope.  The final context is obtained by pushing each parameter in
+order; dependency metadata is retained but never guessed by consumers. -/
+inductive CandidateParameterContext :
+    VLCtx → List Expr → List VExpr → VLCtx → Prop where
+  | nil : CandidateParameterContext base [] [] base
+  | cons
+      (tail : CandidateParameterContext
+        ((some (fv, deps), .vlam A) :: base) parameters types final) :
+      CandidateParameterContext base (.fvar fv :: parameters)
+        (A :: types) final
+
+/-- A completed analyzer-owned parameter telescope also certifies every
+earlier context in that telescope. -/
+theorem CandidateParameterContext.initialWF
+    (params : CandidateParameterContext base parameters types final)
+    (finalWF : VLCtx.WF env U final) :
+    VLCtx.WF env U base := by
+  induction params with
+  | nil => exact finalWF
+  | cons tail ih => exact (ih finalWF).1
+
+/-- The source parameter list and analyzer telescope carried by an exact
+parameter context have the same number of entries. -/
+theorem CandidateParameterContext.length_eq
+    (params : CandidateParameterContext base parameters types final) :
+    parameters.length = types.length := by
+  induction params with
+  | nil => rfl
+  | cons tail ih => simp only [List.length_cons, ih]
+
+/-- Replay a successful kernel parameter instantiation against the exact
+analyzer-owned Theory parameter telescope.  Each source Pi body is opened by
+the corresponding retained FVar; no whole-Pi injectivity or caller-selected
+endpoint is used. -/
+theorem CandidateParameterContext.instantiateForall
+    (params : CandidateParameterContext base parameters types final)
+    (henv : VEnv.Ordered env)
+    (finalWF : VLCtx.WF env Us.length final)
+    (instantiation : instantiateFamilyParameters source parameters = .ok rest)
+    (tr : TrExprS env Us base source (VExpr.forallN types result)) :
+    TrExprS env Us final rest result := by
+  induction params generalizing source rest with
+  | nil =>
+      have source_eq : source = rest := Except.ok.inj instantiation
+      subst rest
+      simpa only [VExpr.forallN] using tr
+  | @cons fv deps A base parameters types final tail ih =>
+      cases source <;> simp only [instantiateFamilyParameters] at instantiation
+      case forallE name domain body binderInfo =>
+        obtain ⟨domain', body', targetEq, domainType, bodyType, domainTr,
+            bodyTr⟩ := TrExprS.forallE_components tr
+        simp only [VExpr.forallN, VExpr.forallE.injEq] at targetEq
+        obtain ⟨rfl, rfl⟩ := targetEq
+        have nextWF : VLCtx.WF env Us.length
+            ((some (fv, deps), .vlam A) :: base) :=
+          tail.initialWF finalWF
+        exact ih finalWF instantiation (by
+          simpa only [Expr.instantiate1_eq] using
+            bodyTr.inst_fvar henv nextWF)
+      all_goals exact nomatch instantiation
+
+/-- Consume an exact prefix of a strictly translated candidate view and keep
+the terminal candidate context tied to the corresponding view telescope.
+
+The resulting `parameterContext` is the analyzer-owned prefix context.  The
+final `FVLift'` is over precisely the unconsumed suffix, so a strict
+translation in the parameter context can be weakened to the same terminal
+context used by pre-family constructor replay. -/
+theorem CandidateExprRun.parameterViewTerminal
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (contextRun : CandidateContextRun candidateContext)
+    (venv_eq : contextRun.context.venv = env)
+    (lparams_eq : contextRun.context.lparams = Us)
+    (vlctx_eq : contextRun.context.vlctx = Δ)
+    (unique : CandidateExprTraceViewIsUnique trace)
+    (count : Nat) (hcount : count ≤ trace.spineLength)
+    {viewΔ : VLCtx}
+    (viewDefEq : VLCtx.IsDefEq env Us.length Δ viewΔ)
+    (viewContext : TrExprS.IsUniqueCtx Δ viewΔ)
+    (noBV : Δ.NoBV) :
+    ∃ (parameterΔ : VLCtx) (rest : Expr)
+        (terminalRun : CandidateContextRun trace.terminalContext)
+        (viewTerminal : VLCtx),
+      instantiateFamilyParameters trace.view (trace.parameterList count) =
+        .ok rest ∧
+      TrExprS env Us parameterΔ rest (VExpr.dropN count view') ∧
+      parameterΔ.toCtx =
+        (VExpr.telN count view').reverse ++ viewΔ.toCtx ∧
+      CandidateParameterContext viewΔ (trace.parameterList count)
+        (VExpr.telN count view') parameterΔ ∧
+      parameterΔ.fvars.map Expr.fvar =
+        (trace.parameterList count).reverse ++
+          viewΔ.fvars.map Expr.fvar ∧
+      parameterΔ.NoBV ∧
+      VLCtx.WF env Us.length parameterΔ ∧
+      terminalRun.context.venv = env ∧
+      terminalRun.context.lparams = Us ∧
+      VLCtx.IsDefEq env Us.length terminalRun.context.vlctx viewTerminal ∧
+      TrExprS.IsUniqueCtx terminalRun.context.vlctx viewTerminal ∧
+      VLCtx.FVLift' parameterΔ viewTerminal 0
+        (.skipN .refl (trace.spineLength - count)) 0 ∧
+      viewTerminal.toCtx =
+        (VExpr.telN (trace.spineLength - count)
+          (VExpr.dropN count view')).reverse ++ parameterΔ.toCtx := by
+  induction run generalizing count viewΔ with
+  | @terminal Δ context source inferred result source' result' inferred'
+      checked normalized node =>
+    simp only [AddInductive.CandidateExprTrace.spineLength] at hcount
+    have count_eq : count = 0 := Nat.eq_zero_of_le_zero hcount
+    subst count
+    have strict :=
+      CandidateExprRun.view_tr_strict
+        (CandidateExprRun.terminal node) unique
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    obtain ⟨moved, movedTr⟩ := strict.defeqDFC henv viewDefEq
+    have moved_eq : result' = moved :=
+      strict.unique' viewContext unique movedTr
+    subst moved
+    obtain ⟨terminalRun, viewTerminal, terminalVenv, terminalLparams,
+        terminalViewDefEq, terminalViewContext, terminalViewLift,
+        terminalViewEq⟩ :=
+      (CandidateExprRun.terminal node).terminalContextRunView contextRun
+        venv_eq lparams_eq vlctx_eq viewDefEq viewContext
+    exact ⟨viewΔ, result, terminalRun, viewTerminal, rfl, movedTr, rfl, .nil,
+      by simp [AddInductive.CandidateExprTrace.parameterList],
+      by simpa only [VLCtx.NoBV, ← viewDefEq.bvars] using noBV,
+      (viewDefEq.symm henv.ordered).wf,
+      terminalVenv, terminalLparams, terminalViewDefEq, terminalViewContext,
+      by simpa only [Nat.sub_zero] using terminalViewLift,
+      by simpa only [Nat.sub_zero, VExpr.dropN] using terminalViewEq⟩
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    have currentRun := CandidateExprRun.forallE
+      (fresh := fresh) (checked := checked) (normalized := normalized)
+      annotations annotationsEq domainCandidate bodyCandidate node domainRun
+      annotationsRun bodyRun domainType bodyType bodySource bodyContext
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hΔ : VLCtx.WF env Us.length Δ := by
+      simpa only [node.check.venv_eq, node.check.lparams_eq,
+        node.check.vlctx_eq] using node.check.context.Δwf
+    have allUnique := unique
+    rcases unique with ⟨domainUnique, bodyUnique, abstractUnique⟩
+    cases count with
+    | zero =>
+        have strict := currentRun.view_tr_strict allUnique
+        obtain ⟨moved, movedTr⟩ := strict.defeqDFC henv viewDefEq
+        have moved_eq : VExpr.forallE domainView' bodyView' = moved :=
+          strict.unique' viewContext allUnique.view movedTr
+        subst moved
+        obtain ⟨terminalRun, viewTerminal, terminalVenv, terminalLparams,
+            terminalViewDefEq, terminalViewContext, terminalViewLift,
+            terminalViewEq⟩ :=
+          currentRun.terminalContextRunView contextRun venv_eq lparams_eq
+            vlctx_eq viewDefEq viewContext
+        exact ⟨viewΔ, _, terminalRun, viewTerminal, rfl, movedTr, rfl, .nil,
+          by simp [AddInductive.CandidateExprTrace.parameterList],
+          by simpa only [VLCtx.NoBV, ← viewDefEq.bvars] using noBV,
+          (viewDefEq.symm henv.ordered).wf,
+          terminalVenv, terminalLparams, terminalViewDefEq,
+          terminalViewContext,
+          by simpa only [Nat.sub_zero] using terminalViewLift,
+          by simpa only [Nat.sub_zero, VExpr.dropN] using terminalViewEq⟩
+    | succ count =>
+        simp only [AddInductive.CandidateExprTrace.spineLength,
+          Nat.succ_le_succ_iff] at hcount
+        have domainDef : env.IsDefEq Us.length Δ.toCtx
+            domain' domainView' (.sort u) :=
+          domainRun.evidence.isDefEq.toU.of_l henv hΔ.toCtx domainType
+        have annotationDef : env.IsDefEq Us.length Δ.toCtx
+            domain' storedDomain' (.sort u) :=
+          annotationsRun.isDefEqU.of_l henv hΔ.toCtx domainType
+        have storedToView : env.IsDefEq Us.length Δ.toCtx
+            storedDomain' domainView' (.sort u) :=
+          annotationDef.symm.trans domainDef
+        have storedDomain_tr : contextRun.context.TrExprS
+            annotations.consumed storedDomain' := by
+          simpa only [VContext.TrExprS, venv_eq, lparams_eq, vlctx_eq] using
+            annotationsRun.rhs_tr
+        have storedDomain_type : env.IsType Us.length Δ.toCtx storedDomain' :=
+          ⟨u, annotationDef.hasType.2⟩
+        let nextContextRun := contextRun.pushLocalDecl name binderInfo
+          annotations.consumed fresh storedDomain' storedDomain_tr (by
+            change contextRun.context.venv.IsType
+              contextRun.context.lparams.length
+              contextRun.context.vlctx.toCtx storedDomain'
+            rw [venv_eq, lparams_eq, vlctx_eq]
+            exact storedDomain_type)
+        have nextVenv : nextContextRun.context.venv = env := by
+          simp only [nextContextRun, CandidateContextRun.pushLocalDecl_venv,
+            venv_eq]
+        have nextLparams : nextContextRun.context.lparams = Us := by
+          simp only [nextContextRun, CandidateContextRun.pushLocalDecl_lparams,
+            lparams_eq]
+        have nextVlctx : nextContextRun.context.vlctx = bodyΔ := by
+          simp only [nextContextRun, CandidateContextRun.pushLocalDecl_vlctx]
+          rw [vlctx_eq, bodyContext]
+        let viewBodyΔ : VLCtx :=
+          (some (context.freshFVarId, annotations.consumed.fvarsList),
+            .vlam domainView') :: viewΔ
+        have bodyWF := bodyRun.context_wf
+        rw [bodyContext] at bodyWF
+        have bodyViewDefEq : VLCtx.IsDefEq env Us.length bodyΔ viewBodyΔ := by
+          rw [bodyContext]
+          exact .cons viewDefEq bodyWF.2.1 (.vlam storedToView)
+        have bodyViewContext : TrExprS.IsUniqueCtx bodyΔ viewBodyΔ := by
+          rw [bodyContext]
+          exact viewContext.cons .vlam
+        have bodyNoBV : bodyΔ.NoBV := by
+          rw [bodyContext]
+          simpa only [VLCtx.NoBV, VLCtx.bvars] using noBV
+        obtain ⟨parameterΔ, rest, terminalRun, viewTerminal, restEq,
+            restTr, parameterCtx, parameterContext, parameterFVars,
+            parameterNoBV, parameterWF, terminalVenv,
+            terminalLparams, terminalViewDefEq, terminalViewContext,
+            terminalViewLift, terminalViewEq⟩ :=
+          bodyIH nextContextRun nextVenv nextLparams nextVlctx bodyUnique
+            count hcount bodyViewDefEq bodyViewContext bodyNoBV
+        have bodyClosed : Closed bodyCandidate.view := by
+          have closed := (bodyRun.view_tr_strict bodyUnique).closed
+          simpa only [bodyNoBV] using closed
+        refine ⟨parameterΔ, rest, terminalRun, viewTerminal, ?_, ?_, ?_,
+          ?_, ?_, parameterNoBV, parameterWF, terminalVenv, terminalLparams,
+          ?_, ?_, ?_, ?_⟩
+        · simp only [AddInductive.CandidateExprTrace.view,
+            AddInductive.CandidateExprTrace.parameterList,
+            instantiateFamilyParameters]
+          change instantiateFamilyParameters
+            ((bodyCandidate.view.abstract
+              #[.fvar context.freshFVarId]).instantiate1
+                (.fvar context.freshFVarId)) _ = _
+          rw [abstract_instantiate_self _ _ bodyClosed]
+          exact restEq
+        · simpa only [VExpr.dropN] using restTr
+        · simpa only [AddInductive.CandidateExprTrace.spineLength,
+            VExpr.telN, List.reverse_cons, List.singleton_append,
+            List.append_assoc, viewBodyΔ, VLCtx.toCtx] using parameterCtx
+        · simpa only [AddInductive.CandidateExprTrace.parameterList,
+            VExpr.telN, viewBodyΔ, AddInductive.Context.freshExpr] using
+            CandidateParameterContext.cons parameterContext
+        · simpa [AddInductive.CandidateExprTrace.parameterList,
+            List.reverse_cons, List.singleton_append, List.append_assoc,
+            viewBodyΔ, VLCtx.fvars, AddInductive.Context.freshExpr] using
+            parameterFVars
+        · simpa only [AddInductive.CandidateExprTrace.terminalContext] using
+            terminalViewDefEq
+        · simpa only [AddInductive.CandidateExprTrace.terminalContext] using
+            terminalViewContext
+        · simpa only [AddInductive.CandidateExprTrace.spineLength,
+            Nat.succ_sub_succ_eq_sub] using terminalViewLift
+        · simpa only [AddInductive.CandidateExprTrace.spineLength,
+            Nat.succ_sub_succ_eq_sub, VExpr.dropN] using terminalViewEq
+
+end TypeChecker
+
+namespace VInductDecl
+
+/-!
+## Staged ownership
+
+The ordinary outer producer deliberately remains unchanged: its successful
+equation records kernel validation, while this additive wrapper retains the
+verified universe-semantic audit introduced by Spec-01D1 and extended by
+Spec-02C.  The normalized branch intersects the ordinary core decision with
+the proved project comparison, without making bare
+`buildNormalizationCandidate` success carry Theory meaning.
+-/
+
+/-- A staged singleton semantic input together with the exact executable
+constructor-universe audit for the same source list, family-validation stats,
+and post-family checker context.
+
+Keeping the ordinary staged input as data preserves the established candidate
+and semantic hierarchy.  The dependent `universeRun` field prevents an audit
+for another family, constructor ordering, parameter split, or environment from
+being reused here. -/
+structure StagedNormalizationCandidateUniverseInput
+    (familyContext constructorContext : AddInductive.Context)
+    (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  staged : StagedNormalizationCandidateSemanticInput familyContext
+    constructorContext env Us candidate rawDecl
+  universeRun :
+    AddInductive.checkConstructorUniverseListSemantics
+        staged.family.validation.stats source.ctors
+        { candidate.families.singleton.familyType.type.trace.terminalContext with
+          env := constructorContext.env } = .ok ()
+
+/-- Pair the retained ordinary validation trace with its source-indexed
+universe audit.  This is the strengthened D1 validation object; forgetting it
+recovers exactly the pre-existing staged owner. -/
+def StagedNormalizationCandidateUniverseInput.semanticValidation
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidateUniverseInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    AddInductive.ConstructorSemanticValidationRun source
+      input.staged.family.validation.stats false
+      { candidate.families.singleton.familyType.type.trace.terminalContext with
+        env := constructorContext.env } where
+  validation := input.staged.constructorValidation
+  universeRun := input.universeRun
+
+/-- Every universe-bearing node in the staged source-ordered validation trace
+passes the verified semantic universe gate. -/
+theorem StagedNormalizationCandidateUniverseInput.universeSemantics
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidateUniverseInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    input.staged.constructorValidation.universeSemantics = true :=
+  input.semanticValidation.universeSemantics
+
+/-- Preserve the existing automatic semantic-hierarchy construction while
+retaining the strengthened universe gate in its staged owner. -/
+theorem StagedNormalizationCandidateUniverseInput.exists
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidateUniverseInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    Nonempty (ProducedNormalizationCandidateSemanticRun familyContext
+    constructorContext env Us candidate rawDecl) :=
+  input.staged.exists
+
+/-!
+## Post-family constructor ownership
+
+This additive D2 owner keeps D1's universe gate and adds the exact executable
+alignment between the retained validation telescope and every analyzer-owned
+constructor candidate.  It does not replay `checkConstructors` on the view or
+claim any pre-family field judgment.
+-/
+
+/-- The staged semantic/universe owner together with the source-ordered
+post-family constructor alignment audit. -/
+structure StagedNormalizationCandidatePostFamilyInput
+    (familyContext constructorContext : AddInductive.Context)
+    (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  universeInput : StagedNormalizationCandidateUniverseInput familyContext
+    constructorContext env Us candidate rawDecl
+  alignment : AddInductive.ConstructorCandidateAlignmentTrace
+    universeInput.staged.family.validation.stats false 0
+    { candidate.families.singleton.familyType.type.trace.terminalContext with
+      env := constructorContext.env }
+    universeInput.staged.constructorValidation.trace
+    candidate.families.singleton.constructors
+
+/-- Package a successful executable alignment audit into the staged D2 owner.
+The direct `alignment` field also permits proof-oriented clients to assemble
+the same indexed trace from already-retained checker observations.  The
+retained trace is computed by replaying the alignment builder; the audit
+premise only discharges its impossible error branch. -/
+def StagedNormalizationCandidatePostFamilyInput.ofRun
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (universeInput : StagedNormalizationCandidateUniverseInput familyContext
+      constructorContext env Us candidate rawDecl)
+    (alignmentRun :
+      universeInput.staged.constructorValidation.trace.checkCandidateAlignment
+          candidate.families.singleton.constructors
+          { candidate.families.singleton.familyType.type.trace.terminalContext with
+            env := constructorContext.env } = .ok ()) :
+    StagedNormalizationCandidatePostFamilyInput familyContext
+      constructorContext env Us candidate rawDecl where
+  universeInput := universeInput
+  alignment :=
+    match h : AddInductive.ConstructorCandidateAlignmentTrace.build
+        universeInput.staged.constructorValidation.trace
+        candidate.families.singleton.constructors with
+    | .ok alignment => alignment
+    | .error _ =>
+        absurd
+          (AddInductive.ConstructorCandidateAlignmentTrace.build_ok_of_check
+            alignmentRun)
+          (by simp [h])
+
+/-- The exact output of D2: the established produced semantic hierarchy plus
+the actual post-family validation context, retained source/candidate
+alignment, and a positional semantic interpretation of every exact candidate
+view binder and terminal result. -/
+structure ProducedNormalizationCandidatePostFamilySemanticRun
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePostFamilyInput familyContext
+      constructorContext env Us candidate rawDecl) where
+  produced : ProducedNormalizationCandidateSemanticRun familyContext
+    constructorContext env Us candidate rawDecl
+  contextRun : AddInductive.ConstructorContextRun
+    produced.semantic.family.typeEnv Us
+    { candidate.families.singleton.familyType.type.trace.terminalContext with
+      env := constructorContext.env }
+  alignment : AddInductive.ConstructorCandidateAlignmentTrace
+    input.universeInput.staged.family.validation.stats false 0
+    { candidate.families.singleton.familyType.type.trace.terminalContext with
+      env := constructorContext.env }
+    input.universeInput.staged.constructorValidation.trace
+    candidate.families.singleton.constructors
+  constructors : AddInductive.ConstructorPostFamilySemanticListRun
+    produced.semantic.family.typeEnv Us
+    input.universeInput.staged.family.validation.stats false 0
+    { candidate.families.singleton.familyType.type.trace.terminalContext with
+      env := constructorContext.env }
+    contextRun input.universeInput.staged.constructorValidation.trace
+    candidate.families.singleton.constructors alignment
+    produced.semantic.family.constructors
+
+/-- Interpret D2's executable alignment in the exact post-family Theory
+environment obtained by the retained raw-family insertion.  The only
+existential selections are checker-produced Theory translations already
+encapsulated by `Nonempty`; no caller supplies a view. -/
+theorem StagedNormalizationCandidatePostFamilyInput.exists
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePostFamilyInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    Nonempty (ProducedNormalizationCandidatePostFamilySemanticRun input) := by
+  obtain ⟨familySemantic⟩ :=
+    input.universeInput.staged.semanticInput.family.exists
+  let semantic : NormalizationCandidateSemanticRun env Us candidate rawDecl :=
+    { raw := input.universeInput.staged.raw
+      raw_types_eq := input.universeInput.staged.raw_types_eq
+      uvars_eq := input.universeInput.staged.declaration_uvars_eq
+      family := familySemantic }
+  let produced : ProducedNormalizationCandidateSemanticRun familyContext
+      constructorContext env Us candidate rawDecl :=
+    { semantic := semantic
+      familyTypesProduced :=
+        input.universeInput.staged.familyTypesProduced
+      familiesProduced := input.universeInput.staged.familiesProduced }
+  have typeEnv_eq : familySemantic.typeEnv =
+      input.universeInput.staged.family.typeEnv := by
+    exact Option.some.inj <|
+      familySemantic.addType.symm.trans
+        input.universeInput.staged.family.addInduct.env_add
+  obtain ⟨candidateContext, venv_eq, lparams_eq⟩ :=
+    input.universeInput.staged.family.validationContextRun
+      familySemantic.type
+  let contextRun : AddInductive.ConstructorContextRun
+      produced.semantic.family.typeEnv Us
+      { candidate.families.singleton.familyType.type.trace.terminalContext with
+        env := constructorContext.env } :=
+    ⟨candidateContext, venv_eq.trans typeEnv_eq.symm, lparams_eq⟩
+  let alignment := input.alignment
+  obtain ⟨constructors⟩ :=
+    AddInductive.ConstructorPostFamilySemanticListRun.nonempty_of_alignment
+      contextRun alignment produced.semantic.family.constructors
+  exact ⟨⟨produced, contextRun, alignment, constructors⟩⟩
+
+/-!
+## Pre-family constructor ownership
+
+The D3 owner extends the staged D2 package with the output of one executable
+pre-family safety gate. Its semantic result is reconstructed from that exact
+trace in the verified context reached by family normalization before the raw
+family constant is inserted.
+-/
+
+/-- The staged D2 owner together with the exact executable pre-family safety
+trace for the same singleton family view and dependent constructor list. -/
+structure StagedNormalizationCandidatePreFamilyInput
+    (familyContext constructorContext : AddInductive.Context)
+    (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  postFamilyInput : StagedNormalizationCandidatePostFamilyInput familyContext
+    constructorContext env Us candidate rawDecl
+  safety : AddInductive.ConstructorPreFamilySafetyTrace
+    postFamilyInput.universeInput.staged.family.validation.stats
+    candidate.families.singleton.familyType.type.view
+    candidate.families.singleton.constructors
+    candidate.families.singleton.familyType.type.trace.terminalContext
+
+/-- Package a successful executable D3 gate into the staged owner. The gate
+itself, rather than a caller-supplied Theory premise, selects the retained
+parameter-instantiated family telescope and constructor traces.  The trace
+is computed by replaying the safety builder; the gate premise only
+discharges its impossible error branch. -/
+def StagedNormalizationCandidatePreFamilyInput.ofRun
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (postFamilyInput : StagedNormalizationCandidatePostFamilyInput
+      familyContext constructorContext env Us candidate rawDecl)
+    (safetyRun : AddInductive.checkConstructorPreFamilySafety
+        postFamilyInput.universeInput.staged.family.validation.stats
+        candidate.families.singleton.familyType.type.view
+        candidate.families.singleton.constructors
+        candidate.families.singleton.familyType.type.trace.terminalContext =
+      .ok ()) :
+    StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl where
+  postFamilyInput := postFamilyInput
+  safety :=
+    match h : AddInductive.buildConstructorPreFamilySafety
+        postFamilyInput.universeInput.staged.family.validation.stats
+        candidate.families.singleton.familyType.type.view
+        candidate.families.singleton.constructors
+        candidate.families.singleton.familyType.type.trace.terminalContext with
+    | .ok safety => safety
+    | .error _ =>
+        absurd
+          (AddInductive.buildConstructorPreFamilySafety_ok_of_check safetyRun)
+          (by simp [h])
+
+/-- D3's produced meaning: D2's post-family semantics together with the exact
+verified pre-family context and source-ordered family-free replay selected by
+the executable safety trace. -/
+structure ProducedNormalizationCandidatePreFamilySemanticRun
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl) where
+  postFamily : ProducedNormalizationCandidatePostFamilySemanticRun
+    input.postFamilyInput
+  contextRun : AddInductive.ConstructorContextRun env Us
+    candidate.families.singleton.familyType.type.trace.terminalContext
+  constructors : AddInductive.ConstructorPreFamilyListSemanticRun env Us
+    input.postFamilyInput.universeInput.staged.family.validation.stats 0
+    input.safety.familyIndices
+    candidate.families.singleton.familyType.type.trace.terminalContext
+    contextRun input.safety.constructors
+
+/-- Interpret the executable D3 safety trace in the exact verified pre-family
+context recovered from the retained family semantic normalization run. -/
+theorem StagedNormalizationCandidatePreFamilyInput.exists
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    Nonempty (ProducedNormalizationCandidatePreFamilySemanticRun input) := by
+  obtain ⟨postFamily⟩ := input.postFamilyInput.exists
+  have raw_eq : postFamily.produced.semantic.raw =
+      input.postFamilyInput.universeInput.staged.raw := by
+    have singleton_eq :=
+      postFamily.produced.semantic.raw_types_eq.symm.trans
+        input.postFamilyInput.universeInput.staged.raw_types_eq
+    injection singleton_eq
+  have familyType : TypeChecker.CandidateExprSemanticRootRun env Us
+      candidate.families.singleton.familyType.type
+      input.postFamilyInput.universeInput.staged.raw.type := by
+    rw [← raw_eq]
+    exact postFamily.produced.semantic.family.type
+  obtain ⟨candidateContext, venv_eq, lparams_eq⟩ :=
+    input.postFamilyInput.universeInput.staged.family.preValidationContextRun
+      familyType
+  let contextRun : AddInductive.ConstructorContextRun env Us
+      candidate.families.singleton.familyType.type.trace.terminalContext :=
+    ⟨candidateContext, venv_eq, lparams_eq⟩
+  obtain ⟨constructors⟩ :=
+    AddInductive.ConstructorPreFamilyListSemanticRun.nonempty contextRun
+      input.safety.constructors
+  exact ⟨⟨postFamily, contextRun, constructors⟩⟩
+
+/-- Invert a verified iterated Pi type into its exact source-ordered
+telescope and terminal type. -/
+private theorem isType_forallN_inv
+    (henv : VEnv.Ordered env) :
+    ∀ {As : List VExpr} {U : Nat} {Γ : List VExpr} {B : VExpr},
+      env.IsType U Γ (VExpr.forallN As B) →
+        env.OnTel U Γ As ∧
+          env.IsType U (As.reverse ++ Γ) B
+  | [], U, Γ, B, h => by
+      change env.IsType _ _ B at h
+      exact ⟨trivial, h⟩
+  | A :: As, U, Γ, B, h => by
+      obtain ⟨hA, hrest⟩ := h.forallE_inv henv
+      obtain ⟨hAs, hB⟩ := isType_forallN_inv henv hrest
+      exact ⟨⟨hA, hAs⟩, by
+        simpa [List.reverse_cons, List.append_assoc] using hB⟩
+
+/-- The family normalization trace and the analyzer's exact generation
+equation derive the checked parameter/index telescope. No checked- or
+view-well-formedness premise is accepted. -/
+theorem StagedNormalizationCandidatePreFamilyInput.familyOnTel
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate rawDecl)
+    (generation : GenerationChecked rawDecl)
+    (analysis : normalization.root.normalization.generation? =
+      some generation) :
+    env.OnTel rawDecl.uvars []
+      (generation.block.checked.params ++ generation.block.checked.indices) := by
+  obtain ⟨_, recursive⟩ := normalization.family.type.recursive
+  have familyType : env.IsType Us.length [] normalization.family.type.view :=
+    recursive.view_isType_of_terminalSort
+      input.postFamilyInput.universeInput.staged.family.validation.terminal_eq
+  have view_eq : normalization.family.type.view =
+      generation.block.checked.type.type := by
+    exact (congrArg (fun ty : VInductiveType => ty.type)
+      (normalization.root.familyViewType_eq analysis)).symm
+  rw [view_eq, generation.block.checked.type_eq,
+    ← VExpr.forallN_append] at familyType
+  have henv : VEnv.Ordered env := by
+    simpa only [normalization.family.type.venv_eq] using
+      normalization.family.type.contextRun.context.Ewf.ordered
+  have htel := (isType_forallN_inv henv familyType).1
+  simpa only [normalization.uvars_eq] using htel
+
+open AddInductive TypeChecker
+
+private theorem familyTelNForallNLength :
+    ∀ (As : List VExpr) (B : VExpr),
+      VExpr.telN As.length (VExpr.forallN As B) = As
+  | [], _ => rfl
+  | _ :: As, B => by
+      simp only [List.length_cons, VExpr.forallN, VExpr.telN,
+        familyTelNForallNLength As B]
+
+private theorem familyDropNForallNLength :
+    ∀ (As : List VExpr) (B : VExpr),
+      VExpr.dropN As.length (VExpr.forallN As B) = B
+  | [], _ => rfl
+  | _ :: As, B => by
+      simp only [List.length_cons, VExpr.forallN, VExpr.dropN,
+        familyDropNForallNLength As B]
+
+/-- Consume the validator-owned parameter prefix of the retained family
+candidate and identify both resulting contexts with the analyzer telescope.
+
+The executable D3 gate selects the residual kernel family expression.  Strict
+translation uniqueness, the exact generation shape, and dependent analysis
+then identify its Theory endpoint and the terminal local context; neither a
+view nor a view-context premise is supplied by the caller. -/
+theorem StagedNormalizationCandidatePreFamilyInput.familyParameterTerminal
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate rawDecl)
+    (generation : GenerationChecked rawDecl)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    let trace := candidate.families.singleton.familyType.type.trace
+    ∃ (parameterΔ : VLCtx) (rest : Expr)
+        (terminalRun : CandidateContextRun trace.terminalContext)
+        (viewTerminal : VLCtx),
+      instantiateFamilyParameters trace.view
+          (trace.parameterList rawDecl.nparams) = .ok rest ∧
+      TrExprS env Us parameterΔ rest
+        (VExpr.dropN rawDecl.nparams normalization.family.type.view) ∧
+      parameterΔ.toCtx =
+        (VExpr.telN rawDecl.nparams normalization.family.type.view).reverse ∧
+      CandidateParameterContext [] (trace.parameterList rawDecl.nparams)
+        (VExpr.telN rawDecl.nparams normalization.family.type.view)
+        parameterΔ ∧
+      parameterΔ.fvars.map Expr.fvar =
+        (trace.parameterList rawDecl.nparams).reverse ∧
+      parameterΔ.NoBV ∧
+      VLCtx.WF env Us.length parameterΔ ∧
+      terminalRun.context.venv = env ∧
+      terminalRun.context.lparams = Us ∧
+      VLCtx.IsDefEq env Us.length terminalRun.context.vlctx viewTerminal ∧
+      TrExprS.IsUniqueCtx terminalRun.context.vlctx viewTerminal ∧
+      VLCtx.FVLift' parameterΔ viewTerminal 0
+        (.skipN .refl generation.block.checked.indices.length) 0 ∧
+      viewTerminal.toCtx =
+        generation.block.checked.indices.reverse ++ parameterΔ.toCtx := by
+  dsimp only
+  have familyShape := shape
+  simp only [NormalizationCandidateSemanticRun.generationShape,
+    normalizationCandidateGenerationShape, Bool.and_eq_true,
+    beq_iff_eq] at familyShape
+  have spineLength_eq :
+      candidate.families.singleton.familyType.type.trace.spineLength =
+        (generation.block.checked.params ++
+          generation.block.checked.indices).length := by
+    calc
+      _ = (VExpr.telN rawDecl.nparams normalization.raw.type ++
+          ctorFields (VExpr.dropN rawDecl.nparams normalization.raw.type)).length :=
+        familyShape.1.2
+      _ = (generation.block.rawParams ++
+          generation.block.rawIndices).length := by
+        simp only [NormalizedChecked.rawParams, NormalizedChecked.rawIndices,
+          NormalizationCandidateSemanticRun.root,
+          normalization.root.sourceType_eq generation]
+      _ = (generation.block.checked.params ++
+          generation.block.checked.indices).length := by
+        simp only [List.length_append]
+        rw [generation.shape.2.1, generation.shape.2.2.1]
+  have parameterLength : generation.block.checked.params.length =
+      rawDecl.nparams :=
+    generation.block.checked.direct_anatomy.2.1.trans
+      generation.block.nparams_eq.symm
+  have hcount : rawDecl.nparams ≤
+      candidate.families.singleton.familyType.type.trace.spineLength := by
+    rw [spineLength_eq]
+    simpa only [List.length_append, parameterLength] using
+      Nat.le_add_right rawDecl.nparams
+        generation.block.checked.indices.length
+  have unique : CandidateExprTraceViewIsUnique
+      candidate.families.singleton.familyType.type.trace := by
+    apply CandidateExprTrace.viewTranslationUnique_sound
+    rw [CandidateExprTrace.viewTranslationUnique_eq]
+    have uniqueGate := input.safety.translationUnique
+    simp only [Bool.and_eq_true] at uniqueGate
+    exact uniqueGate.1
+  obtain ⟨inferred, recursive⟩ := normalization.family.type.recursive
+  have rootWF : VLCtx.WF env Us.length ([] : VLCtx) := by
+    simpa only [normalization.family.type.venv_eq,
+      normalization.family.type.lparams_eq,
+      normalization.family.type.vlctx_eq] using
+      normalization.family.type.contextRun.context.Δwf
+  have henv : VEnv.Ordered env := by
+    simpa only [normalization.family.type.venv_eq] using
+      normalization.family.type.contextRun.context.Ewf.ordered
+  obtain ⟨parameterΔ, rest, terminalRun, viewTerminal, restEq, restTr,
+      parameterCtx, parameterContext, parameterFVars, parameterNoBV,
+      parameterWF, terminalVenv, terminalLparams,
+      terminalViewDefEq, terminalViewContext, terminalViewLift,
+      terminalViewEq⟩ :=
+    recursive.parameterViewTerminal normalization.family.type.contextRun
+      normalization.family.type.venv_eq normalization.family.type.lparams_eq
+      normalization.family.type.vlctx_eq unique rawDecl.nparams hcount
+      (.refl henv rootWF) .base (by rfl)
+  have remaining_eq :
+      candidate.families.singleton.familyType.type.trace.spineLength -
+          rawDecl.nparams = generation.block.checked.indices.length := by
+    rw [spineLength_eq, List.length_append,
+      parameterLength, Nat.add_sub_cancel_left]
+  have view_eq : normalization.family.type.view =
+      generation.block.checked.type.type :=
+    (congrArg (fun ty : VInductiveType => ty.type)
+      (normalization.root.familyViewType_eq analysis)).symm
+  have viewDrop_eq :
+      VExpr.dropN rawDecl.nparams normalization.family.type.view =
+        VExpr.forallN generation.block.checked.indices
+          (.sort generation.block.checked.resultLevel) := by
+    rw [view_eq, generation.block.checked.type_eq, ← parameterLength]
+    exact familyDropNForallNLength _ _
+  refine ⟨parameterΔ, rest, terminalRun, viewTerminal, restEq, restTr, ?_,
+    parameterContext, ?_, parameterNoBV, parameterWF, terminalVenv,
+    terminalLparams,
+    terminalViewDefEq,
+    terminalViewContext, ?_, ?_⟩
+  · simpa only [VLCtx.toCtx, List.append_nil] using parameterCtx
+  · simpa [VLCtx.fvars] using parameterFVars
+  · simpa only [remaining_eq] using terminalViewLift
+  · rw [remaining_eq, viewDrop_eq,
+      familyTelNForallNLength] at terminalViewEq
+    exact terminalViewEq
+
+/-- The analyzer-owned family prefix and D3's pre-family terminal context,
+with the residual kernel expression fixed to the exact executable safety
+trace and every Theory telescope component fixed to dependent analysis. -/
+theorem StagedNormalizationCandidatePreFamilyInput.familyContext
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate rawDecl)
+    (generation : GenerationChecked rawDecl)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    let trace := candidate.families.singleton.familyType.type.trace
+    ∃ (parameterΔ : VLCtx)
+        (terminalRun : CandidateContextRun trace.terminalContext)
+        (viewTerminal : VLCtx),
+      instantiateFamilyParameters trace.view
+          (trace.parameterList rawDecl.nparams) =
+        .ok input.safety.familyIndices ∧
+      TrExprS env Us parameterΔ input.safety.familyIndices
+        (VExpr.forallN generation.block.checked.indices
+          (.sort generation.block.checked.resultLevel)) ∧
+      parameterΔ.toCtx = generation.block.checked.params.reverse ∧
+      CandidateParameterContext [] (trace.parameterList rawDecl.nparams)
+        generation.block.checked.params parameterΔ ∧
+      parameterΔ.fvars.map Expr.fvar =
+        (trace.parameterList rawDecl.nparams).reverse ∧
+      parameterΔ.NoBV ∧
+      VLCtx.WF env Us.length parameterΔ ∧
+      terminalRun.context.venv = env ∧
+      terminalRun.context.lparams = Us ∧
+      VLCtx.IsDefEq env Us.length terminalRun.context.vlctx viewTerminal ∧
+      TrExprS.IsUniqueCtx terminalRun.context.vlctx viewTerminal ∧
+      VLCtx.FVLift' parameterΔ viewTerminal 0
+        (.skipN .refl generation.block.checked.indices.length) 0 ∧
+      viewTerminal.toCtx =
+        generation.block.checked.indices.reverse ++
+          generation.block.checked.params.reverse := by
+  dsimp only
+  obtain ⟨parameterΔ, rest, terminalRun, viewTerminal, restEq, restTr,
+      parameterCtx, parameterContext, parameterFVars, parameterNoBV,
+      parameterWF, terminalVenv, terminalLparams,
+      terminalViewDefEq, terminalViewContext, terminalViewLift,
+      terminalViewEq⟩ := input.familyParameterTerminal normalization
+    generation analysis shape
+  let validation :=
+    input.postFamilyInput.universeInput.staged.family.validation
+  have statsParams : validation.stats.params.toList =
+      candidate.families.singleton.familyType.type.trace.parameterList
+        rawDecl.nparams := by
+    rw [validation.stats_eq]
+    simp only [CandidateExprTrace.singletonCandidateInductiveStats,
+      validation, input.postFamilyInput.universeInput.staged.validation_nparams_eq]
+  have safetyParameters := input.safety.parameters
+  rw [statsParams] at safetyParameters
+  have rest_eq : rest = input.safety.familyIndices := by
+    exact Except.ok.inj (restEq.symm.trans safetyParameters)
+  subst rest
+  have parameterLength : generation.block.checked.params.length =
+      rawDecl.nparams :=
+    generation.block.checked.direct_anatomy.2.1.trans
+      generation.block.nparams_eq.symm
+  have view_eq : normalization.family.type.view =
+      generation.block.checked.type.type :=
+    (congrArg (fun ty : VInductiveType => ty.type)
+      (normalization.root.familyViewType_eq analysis)).symm
+  have viewDrop_eq :
+      VExpr.dropN rawDecl.nparams normalization.family.type.view =
+        VExpr.forallN generation.block.checked.indices
+          (.sort generation.block.checked.resultLevel) := by
+    rw [view_eq, generation.block.checked.type_eq, ← parameterLength]
+    exact familyDropNForallNLength _ _
+  have parameterTel_eq :
+      VExpr.telN rawDecl.nparams normalization.family.type.view =
+        generation.block.checked.params := by
+    rw [view_eq, generation.block.checked.type_eq, ← parameterLength]
+    exact familyTelNForallNLength _ _
+  refine ⟨parameterΔ, terminalRun, viewTerminal, restEq, ?_, ?_,
+    ?_, parameterFVars, parameterNoBV, parameterWF, terminalVenv,
+    terminalLparams,
+    terminalViewDefEq,
+    terminalViewContext, terminalViewLift, ?_⟩
+  · simpa only [viewDrop_eq] using restTr
+  · simpa only [parameterTel_eq] using parameterCtx
+  · simpa only [parameterTel_eq] using parameterContext
+  · simpa only [parameterCtx, parameterTel_eq] using terminalViewEq
+
+/-- Peeling at most `n` binders cannot expose more than `n` telescope
+entries. -/
+private theorem constructorTelN_length_le (n : Nat) (expression : VExpr) :
+    (VExpr.telN n expression).length ≤ n := by
+  induction n generalizing expression with
+  | zero => simp [VExpr.telN]
+  | succ n ih => cases expression <;> simp [VExpr.telN, ih]
+
+/-- Strip the validator-owned parameter prefix from one analyzer-selected
+constructor and retain the exact D3 suffix together with its strict Theory
+translation.
+
+The source parameter list is fixed by the family validation statistics, the
+Theory parameter telescope is fixed by dependent analysis, and the complete
+constructor endpoint is fixed by the analyzer-owned raw/view pairing.  Thus
+the residual endpoint is precisely the stored view fields followed by the
+analyzed result target; no whole-Pi injectivity or caller-selected view is
+used. -/
+theorem CandidateSemanticNormalizedCtorRun.preFamilySuffix
+    {env typeEnv : VEnv} {Us : List Name}
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {kernelCtor : Constructor}
+    {candidateCtor : AddInductive.CandidateConstructor kernelCtor}
+    {rawCtor : VConstVal}
+    {root : CandidateConstructorSemanticRun typeEnv Us candidateCtor rawCtor}
+    {ctor : NormalizedCtor}
+    {stats : InductiveStats} {familyIndices : Expr}
+    {context : AddInductive.Context}
+    {contextRun : AddInductive.ConstructorContextRun env Us context}
+    {d3Trace : AddInductive.ConstructorPreFamilyViewTrace stats 0
+      familyIndices context candidateCtor.type.view 0 [] false}
+    {parameterΔ : VLCtx} {parameters : List Expr}
+    (genRun : CandidateSemanticNormalizedCtorRun generation.block typeEnv Us
+      root ctor)
+    (addType : env ≤ typeEnv)
+    (parameterContext : CandidateParameterContext [] parameters
+      generation.block.checked.params parameterΔ)
+    (parameterWF : VLCtx.WF env Us.length parameterΔ)
+    (unique : CandidateExprTraceViewIsUnique candidateCtor.type.trace)
+    (d3 : AddInductive.ConstructorPreFamilyViewSemanticRun env Us stats 0
+      familyIndices contextRun d3Trace)
+    (hctor : ctor ∈ generation.block.ctorPairs)
+    (parametersEq : stats.params.toList = parameters)
+    {familyName : Name} {levels : List Level}
+    (indConsts : stats.indConsts = #[.const familyName levels]) :
+    ∃ rest,
+      instantiateFamilyParameters candidateCtor.type.view stats.params.toList =
+          .ok rest ∧
+      Nonempty (AddInductive.ConstructorPreFamilyParameterSuffix
+        (env := env) (Us := Us) (stats := stats)
+        (familyIndices := familyIndices) (context := context)
+        (removed := []) (recursiveStarted := false)
+        (contextRun := contextRun) rest) ∧
+      TrExprS typeEnv Us parameterΔ rest
+        (VExpr.forallN ctor.view.fields
+          (ctor.resultTarget generation.block)) := by
+  have viewTel := genRun.run.viewTel_eq hctor
+  simp only [CandidateConstructorSemanticRun.root,
+    NormalizedCtor.viewBinders] at viewTel
+  have parameterLengthLe : generation.block.checked.params.length ≤
+      candidateCtor.type.trace.spineLength := by
+    apply Nat.le_trans (Nat.le_add_right _ ctor.view.fields.length)
+    rw [← List.length_append, ← viewTel]
+    exact constructorTelN_length_le _ _
+  have sourceParameterLength : stats.params.toList.length ≤
+      candidateCtor.type.trace.spineLength := by
+    rw [parametersEq, parameterContext.length_eq]
+    exact parameterLengthLe
+  obtain ⟨rest, instantiation⟩ :=
+    candidateCtor.type.trace.instantiateViewParameters stats.params.toList
+      sourceParameterLength
+  obtain ⟨inferred, recursive⟩ := root.type.recursive
+  have wholeTr : TrExprS typeEnv Us [] candidateCtor.type.view
+      (VExpr.forallN generation.block.checked.params
+        (VExpr.forallN ctor.view.fields
+          (ctor.resultTarget generation.block))) := by
+    have strict := recursive.view_tr_strict unique
+    have viewTypeEq : root.type.view = ctor.view.value.type := by
+      simpa only [CandidateConstructorSemanticRun.root,
+        CandidateConstructorRun.view] using
+        (congrArg (fun value : VConstVal => value.type) genRun.view_eq).symm
+    rw [viewTypeEq, generation.viewCtorType_eq hctor,
+      NormalizedCtor.viewBinders] at strict
+    simpa only [CandidateExpr.view, VExpr.forallN_append] using strict
+  have parameterWF' : VLCtx.WF typeEnv Us.length parameterΔ :=
+    parameterWF.mono addType
+  have typeEnvOrdered : typeEnv.Ordered := by
+    simpa only [root.type.venv_eq] using
+      root.type.contextRun.context.Ewf.ordered
+  have suffixTr : TrExprS typeEnv Us parameterΔ rest
+      (VExpr.forallN ctor.view.fields
+        (ctor.resultTarget generation.block)) := by
+    apply parameterContext.instantiateForall typeEnvOrdered parameterWF'
+    · simpa only [← parametersEq] using instantiation
+    · exact wholeTr
+  obtain ⟨suffix⟩ :=
+    d3.afterParameters indConsts (by simp) (by
+      simpa only [CandidateExpr.view, List.drop_zero] using instantiation)
+  exact ⟨rest, instantiation, ⟨suffix⟩, suffixTr⟩
+
+end VInductDecl
+
+namespace ConstructorValidation
+open AddInductive TypeChecker VEnv
+
+theorem TrExprS.IsUnique.liftLooseBVars
+    (unique : TrExprS.IsUnique expression) :
+    TrExprS.IsUnique (expression.liftLooseBVars' start amount) := by
+  induction expression generalizing start with
+  | bvar index => trivial
+  | fvar | mvar | sort | const | lit => trivial
+  | app function argument functionIH argumentIH =>
+      exact ⟨functionIH unique.1, argumentIH unique.2⟩
+  | lam name domain body binderInfo domainIH bodyIH
+  | forallE name domain body binderInfo domainIH bodyIH =>
+      exact ⟨domainIH unique.1, bodyIH unique.2⟩
+  | letE name type value body nondep typeIH valueIH bodyIH =>
+      exact ⟨valueIH unique.1, bodyIH unique.2⟩
+  | mdata data expression ih => exact ih unique
+  | proj => cases unique
+
+theorem TrExprS.IsUnique.instantiate1'
+    (expressionUnique : TrExprS.IsUnique expression)
+    (argumentUnique : TrExprS.IsUnique argument) :
+    TrExprS.IsUnique (expression.instantiate1' argument depth) := by
+  induction expression generalizing depth with
+  | bvar index =>
+      simp only [Expr.instantiate1']
+      split
+      · trivial
+      · split
+        · exact liftLooseBVars argumentUnique
+        · trivial
+  | fvar | mvar | sort | const | lit => trivial
+  | app function argument functionIH argumentIH =>
+      exact ⟨functionIH expressionUnique.1,
+        argumentIH expressionUnique.2⟩
+  | lam name domain body binderInfo domainIH bodyIH
+  | forallE name domain body binderInfo domainIH bodyIH =>
+      exact ⟨domainIH expressionUnique.1,
+        bodyIH expressionUnique.2⟩
+  | letE name type value body nondep typeIH valueIH bodyIH =>
+      exact ⟨valueIH expressionUnique.1,
+        bodyIH expressionUnique.2⟩
+  | mdata data expression ih => exact ih expressionUnique
+  | proj => cases expressionUnique
+
+theorem TrExprS.IsUnique.instantiate1
+    (expressionUnique : TrExprS.IsUnique expression)
+    (argumentUnique : TrExprS.IsUnique argument) :
+    TrExprS.IsUnique (expression.instantiate1 argument) := by
+  rw [Expr.instantiate1_eq]
+  exact instantiate1' expressionUnique argumentUnique
+
+theorem FVarsIn.consumeTypeAnnotations
+    (scope : FVarsIn predicate source) :
+    FVarsIn predicate (AddInductive.consumeTypeAnnotations source) := by
+  fun_induction AddInductive.consumeTypeAnnotations source <;>
+    simp_all [FVarsIn]
+
+theorem instantiateFamilyParameters_unique
+    (sourceUnique : TrExprS.IsUnique source)
+    (parametersUnique : ∀ parameter ∈ parameters,
+      TrExprS.IsUnique parameter)
+    (run : AddInductive.instantiateFamilyParameters source parameters =
+      .ok rest) :
+    TrExprS.IsUnique rest := by
+  induction parameters generalizing source with
+  | nil =>
+      have source_eq : source = rest := Except.ok.inj run
+      simpa only [source_eq] using sourceUnique
+  | cons parameter parameters ih =>
+      cases source <;>
+        simp only [AddInductive.instantiateFamilyParameters] at run
+      case forallE name domain body binderInfo =>
+        exact ih (ConstructorValidation.TrExprS.IsUnique.instantiate1 sourceUnique.2
+          (parametersUnique parameter (.head parameters)))
+          (fun candidate member =>
+            parametersUnique candidate (.tail parameter member)) run
+      all_goals exact nomatch run
+
+theorem CandidateParameterContext.parametersUnique
+    (parameters : CandidateParameterContext base sources types final) :
+    ∀ source ∈ sources, TrExprS.IsUnique source := by
+  induction parameters with
+  | nil => simp
+  | cons tail ih =>
+      intro source member
+      simp only [List.mem_cons] at member
+      rcases member with rfl | member
+      · trivial
+      · exact ih source member
+
+/-- The semantic context invariants shared while D3 and D2 consume the
+ordinary prefix of one analyzer-owned constructor view. -/
+structure ConstructorOrdinaryContextState
+    (env typeEnv : VEnv) (Us : List Name)
+    (base actual view postActual : VLCtx) (lift : Lift) where
+  baseWF : VLCtx.WF env Us.length base
+  actualWF : VLCtx.WF env Us.length actual
+  postWF : VLCtx.WF typeEnv Us.length postActual
+  postRelation : VLCtx.IsDefEqFVars typeEnv Us.length actual postActual
+  viewDefEq : VLCtx.IsDefEq env Us.length actual view
+  viewUnique : TrExprS.IsUniqueCtx actual view
+  viewLift : VLCtx.FVLift' base view 0 lift 0
+
+/-- Extend the synchronized ordinary-prefix invariant by the exact analyzer
+field selected by strict translation.  D3 and D2 may retain different
+dependency metadata, but use the same operational fresh identifier. -/
+theorem ConstructorOrdinaryContextState.push
+    {env typeEnv : VEnv} {Us : List Name}
+    {base actual view postActual : VLCtx} {lift : Lift}
+    (state : ConstructorOrdinaryContextState env typeEnv Us
+      base actual view postActual lift)
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {source : Expr} {analyzer actualSource actualConsumed postConsumed : VExpr}
+    {fieldLevel consumedLevel : VLevel} {fv : FVarId}
+    {deps actualDeps postDeps : List FVarId}
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceTr : TrExprS typeEnv Us base source analyzer)
+    (actualTr : TrExprS env Us actual source actualSource)
+    (actualAnnotations : env.IsDefEqU Us.length actual.toCtx
+      actualSource actualConsumed)
+    (actualConsumedType : env.HasType Us.length actual.toCtx actualConsumed
+      (.sort consumedLevel))
+    (analyzerType : env.HasType Us.length base.toCtx analyzer
+      (.sort fieldLevel))
+    (depsSubset : deps ⊆ base.fvars)
+    (actualTailWF : VLCtx.WF env Us.length
+      ((some (fv, actualDeps), .vlam actualConsumed) :: actual))
+    (actualDeps_eq : actualDeps = deps)
+    (postTailWF : VLCtx.WF typeEnv Us.length
+      ((some (fv, postDeps), .vlam postConsumed) :: postActual))
+    (consumedEq : typeEnv.IsDefEq Us.length actual.toCtx
+      actualConsumed postConsumed (.sort consumedLevel)) :
+    ConstructorOrdinaryContextState env typeEnv Us
+      ((some (fv, deps), .vlam analyzer) :: base)
+      ((some (fv, actualDeps), .vlam actualConsumed) :: actual)
+      ((some (fv, deps), .vlam (analyzer.lift' lift)) :: view)
+      ((some (fv, postDeps), .vlam postConsumed) :: postActual)
+      (.consN lift 1) := by
+  subst actualDeps
+  have viewWF : VLCtx.WF env Us.length view :=
+    (state.viewDefEq.symm henv.ordered).wf
+  have analyzerAtView : TrExprS typeEnv Us view source
+      (analyzer.lift' lift) :=
+    sourceTr.weakFV' typeEnvWF.ordered state.viewLift
+      (viewWF.mono addType)
+  have actualSource_eq : actualSource =
+      analyzer.lift' lift :=
+    (actualTr.mono addType).unique' state.viewUnique sourceUnique
+      analyzerAtView
+  have consumedToAnalyzer : env.IsDefEq Us.length actual.toCtx
+      actualConsumed (analyzer.lift' lift)
+      (.sort consumedLevel) := by
+    rw [← actualSource_eq]
+    exact (actualAnnotations.of_r henv state.actualWF.toCtx
+      actualConsumedType).symm
+  have freshBase : fv ∉ base.fvars := by
+    intro present
+    have presentView : fv ∈ view.fvars :=
+      state.viewLift.fvars_sublist.subset present
+    have presentActual : fv ∈ actual.fvars := by
+      simpa only [state.viewDefEq.fvars] using presentView
+    exact (actualTailWF.2.1 fv deps rfl).1 presentActual
+  have baseTailWF : VLCtx.WF env Us.length
+      ((some (fv, deps), .vlam analyzer) :: base) :=
+    ⟨state.baseWF,
+      fun _ _ equality => by
+        cases equality
+        exact ⟨freshBase, depsSubset⟩,
+      ⟨fieldLevel, analyzerType⟩⟩
+  have nextViewDefEq : VLCtx.IsDefEq env Us.length
+      ((some (fv, deps), .vlam actualConsumed) :: actual)
+      ((some (fv, deps), .vlam (analyzer.lift' lift)) :: view) :=
+    .cons state.viewDefEq actualTailWF.2.1 (.vlam consumedToAnalyzer)
+  exact {
+    baseWF := baseTailWF
+    actualWF := actualTailWF
+    postWF := postTailWF
+    postRelation := .cons_fvar state.postRelation (.vlam consumedEq)
+    viewDefEq := nextViewDefEq
+    viewUnique := state.viewUnique.cons .vlam
+    viewLift := state.viewLift.cons_fvar (fv, deps) (.vlam analyzer)
+      depsSubset }
+
+private theorem vexpr_appArgs_acc (expression : VExpr) (suffix : List VExpr) :
+    VExpr.appArgs expression suffix =
+      VExpr.appArgs expression [] ++ suffix := by
+  induction expression generalizing suffix with
+  | app function argument ihFunction ihArgument =>
+      simp only [VExpr.appArgs]
+      rw [ihFunction, ihFunction (suffix := [argument])]
+      simp
+  | bvar | sort | const | lam | forallE => simp [VExpr.appArgs]
+
+private theorem expr_getAppArgsList_acc (expression : Expr)
+    (suffix : List Expr) :
+    expression.getAppArgsList suffix =
+      expression.getAppArgsList [] ++ suffix := by
+  induction expression generalizing suffix with
+  | app function argument ihFunction ihArgument =>
+      simp only [Expr.getAppArgsList]
+      rw [ihFunction, ihFunction (suffix := [argument])]
+      simp
+  | bvar | fvar | mvar | sort | const | lit | mdata | proj | lam | forallE |
+      letE => simp [Expr.getAppArgsList]
+
+theorem TrExprS.IsUnique.getAppArgsList
+    (unique : TrExprS.IsUnique expression) :
+    ∀ argument ∈ expression.getAppArgsList,
+      TrExprS.IsUnique argument := by
+  induction expression with
+  | app function argument functionIH argumentIH =>
+      intro candidate member
+      rw [Expr.getAppArgsList, expr_getAppArgsList_acc] at member
+      simp only [List.mem_append, List.mem_singleton] at member
+      rcases member with member | rfl
+      · exact functionIH unique.1 candidate member
+      · exact unique.2
+  | bvar | fvar | mvar | sort | const | lit | mdata | proj | lam | forallE |
+      letE => simp [Expr.getAppArgsList]
+
+theorem Closed.getAppArgsList
+    (closed : Closed expression depth) :
+    ∀ argument ∈ expression.getAppArgsList,
+      Closed argument depth := by
+  induction expression with
+  | app function argument functionIH argumentIH =>
+      intro candidate member
+      rw [Expr.getAppArgsList, expr_getAppArgsList_acc] at member
+      simp only [List.mem_append, List.mem_singleton] at member
+      rcases member with member | rfl
+      · exact functionIH closed.1 candidate member
+      · exact closed.2
+  | bvar | fvar | mvar | sort | const | lit | mdata | proj | lam | forallE |
+      letE => simp [Expr.getAppArgsList]
+
+private theorem vexpr_appHead_appN (head : VExpr) (arguments : List VExpr) :
+    VExpr.appHead (VExpr.appN head arguments) = VExpr.appHead head := by
+  induction arguments generalizing head with
+  | nil => rfl
+  | cons argument arguments ih =>
+      simp only [VExpr.appN]
+      rw [ih]
+      rfl
+
+private def vexprLiftTel (lift : Lift) : List VExpr → List VExpr
+  | [] => []
+  | domain :: domains =>
+      domain.lift' lift :: vexprLiftTel lift.cons domains
+
+private theorem vexpr_lift'_forallN (lift : Lift) :
+    ∀ (domains : List VExpr) (body : VExpr),
+      (VExpr.forallN domains body).lift' lift =
+        VExpr.forallN (vexprLiftTel lift domains)
+          (body.lift' (lift.consN domains.length))
+  | [], _ => rfl
+  | domain :: domains, body => by
+      simp only [VExpr.forallN, VExpr.lift', vexprLiftTel,
+        List.length_cons]
+      rw [vexpr_lift'_forallN lift.cons domains body]
+      congr 2
+      rw [show domains.length + 1 = 1 + domains.length by omega,
+        ← Lift.consN_consN]
+      rfl
+
+private theorem vexprLiftTel_length (lift : Lift) :
+    ∀ domains : List VExpr,
+      (vexprLiftTel lift domains).length = domains.length
+  | [] => rfl
+  | _ :: domains => by
+      simp only [vexprLiftTel, List.length_cons,
+        vexprLiftTel_length lift.cons domains]
+
+private theorem forall₂_append
+    (left : List.Forall₂ relation leftSources leftTargets)
+    (right : List.Forall₂ relation rightSources rightTargets) :
+    List.Forall₂ relation (leftSources ++ rightSources)
+      (leftTargets ++ rightTargets) := by
+  induction left with
+  | nil => exact right
+  | cons head tail ih => exact .cons head ih
+
+private theorem forall₂_length
+    (run : List.Forall₂ relation sources targets) :
+    sources.length = targets.length := by
+  induction run with
+  | nil => rfl
+  | cons _ _ ih => exact congrArg Nat.succ ih
+
+theorem forall₂_translation_unique
+    (left : List.Forall₂ (TrExprS env Us context) sources leftTargets)
+    (right : List.Forall₂ (TrExprS env Us context) sources rightTargets)
+    (unique : ∀ source ∈ sources, TrExprS.IsUnique source) :
+    leftTargets = rightTargets := by
+  induction left generalizing rightTargets with
+  | nil => cases right; rfl
+  | @cons source leftTarget sources leftTargets leftHead leftTail ih =>
+      cases right with
+      | cons rightHead rightTail =>
+          rw [leftHead.unique (unique source (.head sources)) rightHead,
+            ih rightTail (fun candidate member =>
+              unique candidate (.tail source member))]
+
+theorem forall₂_drop
+    (run : List.Forall₂ relation sources targets) (n : Nat) :
+    List.Forall₂ relation (sources.drop n) (targets.drop n) := by
+  induction n generalizing sources targets with
+  | zero => simpa using run
+  | succ n ih =>
+      cases run with
+      | nil => exact .nil
+      | cons head tail => simpa using ih tail
+
+theorem forall₂_tr_weakFV'
+    {env : VEnv} {Us : List Name} {base full : VLCtx}
+    {lift : Lift} (henv : VEnv.Ordered env)
+    (extension : VLCtx.FVLift' base full 0 lift 0)
+    (fullWF : VLCtx.WF env Us.length full)
+    (run : List.Forall₂ (TrExprS env Us base) sources targets) :
+    List.Forall₂ (TrExprS env Us full) sources
+      (targets.map fun target => target.lift' lift) := by
+  induction run with
+  | nil => exact .nil
+  | cons head tail ih =>
+      exact .cons (by simpa using head.weakFV' henv extension fullWF) ih
+
+theorem forall₂_tr_mono
+    (add : env ≤ env')
+    (run : List.Forall₂ (TrExprS env Us context) sources targets) :
+    List.Forall₂ (TrExprS env' Us context) sources targets := by
+  induction run with
+  | nil => exact .nil
+  | cons head tail ih => exact .cons (head.mono add) ih
+
+theorem isValidIndAppIdx_shape
+    {stats : AddInductive.InductiveStats} {source : Expr}
+    {familyIdx : Nat}
+    (valid : AddInductive.isValidIndAppIdx stats source familyIdx = true) :
+    (source.getAppFn == stats.indConsts[familyIdx]!) = true ∧
+      source.getAppArgs.size =
+        stats.params.size + stats.nindices[familyIdx]! := by
+  unfold AddInductive.isValidIndAppIdx at valid
+  rw [Expr.withApp_eq] at valid
+  simp only [Id.run] at valid
+  split at valid
+  · rename_i shape
+    simpa only [Bool.and_eq_true, beq_iff_eq] using shape
+  · simp_all
+
+theorem isValidIndAppIdx_indexArgs_length
+    {stats : AddInductive.InductiveStats} {source : Expr}
+    {familyIdx : Nat}
+    (valid : AddInductive.isValidIndAppIdx stats source familyIdx = true) :
+    (source.getAppArgs.toList.drop stats.params.size).length =
+      stats.nindices[familyIdx]! := by
+  have shape := isValidIndAppIdx_shape valid
+  rw [List.length_drop, Array.length_toList, shape.2]
+  omega
+
+theorem constructorIndependentOf_fvars
+    {source : Expr} {full base removed : List FVarId}
+    (scope : FVarsIn (· ∈ full) source)
+    (independent : AddInductive.constructorIndependentOf source removed = true)
+    (remaining : ∀ fv, fv ∈ full → fv ∉ removed → fv ∈ base) :
+    FVarsIn (· ∈ base) source := by
+  rw [fvarsIn_iff] at scope ⊢
+  refine ⟨?_, scope.2⟩
+  intro fv member
+  apply remaining fv (scope.1 fv member)
+  unfold AddInductive.constructorIndependentOf at independent
+  simp only [List.all_eq_true] at independent
+  have omitted := independent fv member
+  simpa using omitted
+
+/-- Strict translation preserves a constant-headed application spine and
+translates its arguments position-for-position. -/
+theorem TrExprS.constApp_components
+    {env : VEnv} {Us : List Name} {context : VLCtx}
+    {source : Expr} {target : VExpr} {name : Name} {levels : List Level}
+    (run : TrExprS env Us context source target)
+    (head : source.getAppFn = .const name levels) :
+    ∃ levels',
+      VExpr.appHead target = .const name levels' ∧
+      List.Forall₂ (TrExprS env Us context)
+        source.getAppArgsList (VExpr.appArgs target []) := by
+  induction source generalizing target with
+  | const sourceName sourceLevels =>
+      cases run with
+      | const lookup levelsTr arity =>
+          simp only [Expr.getAppFn] at head
+          obtain ⟨rfl, rfl⟩ := head
+          exact ⟨_, rfl, .nil⟩
+  | app function argument functionIH argumentIH =>
+      cases run with
+      | app =>
+          rename_i function' domain' body' argument' functionType argumentType
+            functionTr argumentTr
+          have functionHead : function.getAppFn = .const name levels := by
+            simpa only [Expr.getAppFn] using head
+          obtain ⟨levels', targetHead, argumentsTr⟩ :=
+            functionIH functionTr functionHead
+          refine ⟨levels', ?_, ?_⟩
+          · simpa only [VExpr.appHead] using targetHead
+          · rw [show VExpr.appArgs (.app function' argument') [] =
+              VExpr.appArgs function' [] ++ [argument'] by
+                rw [VExpr.appArgs, vexpr_appArgs_acc]]
+            simp only [Expr.getAppArgsList] at *
+            rw [expr_getAppArgsList_acc]
+            exact forall₂_append argumentsTr (.cons argumentTr .nil)
+  | bvar => cases run; simp [Expr.getAppFn] at head
+  | fvar => cases run; simp [Expr.getAppFn] at head
+  | mvar => cases run
+  | sort => cases run; simp [Expr.getAppFn] at head
+  | lam => cases run; simp [Expr.getAppFn] at head
+  | forallE => cases run; simp [Expr.getAppFn] at head
+  | letE => cases run; simp [Expr.getAppFn] at head
+  | lit => cases run; simp [Expr.getAppFn] at head
+  | mdata => cases run; simp [Expr.getAppFn] at head
+  | proj => cases run; simp [Expr.getAppFn] at head
+
+/-- Remove one verified free-variable context extension from a list of strict
+translations, retaining the exact lifted endpoints. -/
+theorem TrExprS.forall₂_weakFV_inv
+    {env : VEnv} {Us : List Name} {base full : VLCtx}
+    {sources : List Expr} {targets : List VExpr} {n : Lift}
+    (henv : VEnv.WF env) (fullWF : VLCtx.WF env Us.length full)
+    (extension : VLCtx.FVLift' base full 0 n 0)
+    (runs : List.Forall₂ (TrExprS env Us full) sources targets)
+    (closed : ∀ source ∈ sources, Closed source)
+    (fvars : ∀ source ∈ sources, FVarsIn (· ∈ base.fvars) source)
+    (unique : ∀ source ∈ sources, TrExprS.IsUnique source) :
+    ∃ baseTargets,
+      List.Forall₂ (TrExprS env Us base) sources baseTargets ∧
+      targets = baseTargets.map (fun target => target.lift' (n.consN 0)) := by
+  induction runs with
+  | nil => exact ⟨[], .nil, rfl⟩
+  | @cons source target sources targets headRun tailRuns ih =>
+      have headClosed := closed source (.head sources)
+      have headFVars := fvars source (.head sources)
+      have headUnique := unique source (.head sources)
+      have tailClosed : ∀ expression ∈ sources, Closed expression :=
+        fun expression member => closed expression (.tail source member)
+      have tailFVars : ∀ expression ∈ sources,
+          FVarsIn (· ∈ base.fvars) expression :=
+        fun expression member => fvars expression (.tail source member)
+      have tailUnique : ∀ expression ∈ sources,
+          TrExprS.IsUnique expression :=
+        fun expression member => unique expression (.tail source member)
+      obtain ⟨headBase, headBaseRun⟩ :=
+        headRun.weakFV'_inv henv extension (.refl henv fullWF)
+          headClosed headFVars
+      obtain ⟨tailBase, tailBaseRuns, tailEq⟩ :=
+        ih tailClosed tailFVars tailUnique
+      have headEq : target = headBase.lift' (n.consN 0) :=
+        headRun.unique headUnique
+          (headBaseRun.weakFV' henv.ordered extension fullWF)
+      subst target
+      exact ⟨headBase :: tailBase, .cons headBaseRun tailBaseRuns, by
+        simp only [List.map_cons, tailEq]⟩
+
+/-- Remove a free-variable extension modulo the verified context equality
+used by the retained checker run. -/
+theorem TrExprS.forall₂_weakFV_inv_defeq
+    {env : VEnv} {Us : List Name} {base actual view : VLCtx}
+    {sources : List Expr} {targets : List VExpr} {n : Lift}
+    (henv : VEnv.WF env)
+    (viewDefEq : VLCtx.IsDefEq env Us.length actual view)
+    (viewUnique : TrExprS.IsUniqueCtx actual view)
+    (extension : VLCtx.FVLift' base view 0 n 0)
+    (runs : List.Forall₂ (TrExprS env Us actual) sources targets)
+    (closed : ∀ source ∈ sources, Closed source)
+    (fvars : ∀ source ∈ sources, FVarsIn (· ∈ base.fvars) source)
+    (unique : ∀ source ∈ sources, TrExprS.IsUnique source) :
+    ∃ baseTargets,
+      List.Forall₂ (TrExprS env Us base) sources baseTargets ∧
+      targets = baseTargets.map (fun target => target.lift' (n.consN 0)) := by
+  have viewWF : VLCtx.WF env Us.length view :=
+    (viewDefEq.symm henv.ordered).wf
+  induction runs with
+  | nil => exact ⟨[], .nil, rfl⟩
+  | @cons source target sources targets headRun tailRuns ih =>
+      have headClosed := closed source (.head sources)
+      have headFVars := fvars source (.head sources)
+      have headUnique := unique source (.head sources)
+      have tailClosed : ∀ expression ∈ sources, Closed expression :=
+        fun expression member => closed expression (.tail source member)
+      have tailFVars : ∀ expression ∈ sources,
+          FVarsIn (· ∈ base.fvars) expression :=
+        fun expression member => fvars expression (.tail source member)
+      have tailUnique : ∀ expression ∈ sources,
+          TrExprS.IsUnique expression :=
+        fun expression member => unique expression (.tail source member)
+      obtain ⟨headBase, headBaseRun⟩ :=
+        headRun.weakFV'_inv henv extension viewDefEq
+          headClosed headFVars
+      obtain ⟨tailBase, tailBaseRuns, tailEq⟩ :=
+        ih tailClosed tailFVars tailUnique
+      have headEq : target = headBase.lift' (n.consN 0) :=
+        headRun.unique' viewUnique headUnique
+          (headBaseRun.weakFV' henv.ordered extension viewWF)
+      subst target
+      exact ⟨headBase :: tailBase, .cons headBaseRun tailBaseRuns, by
+        simp only [List.map_cons, tailEq]⟩
+
+theorem ConstructorPreFamilyIndexSpineSemanticRun.expected_eq_of_family_lift
+    {env : VEnv} {Us : List Name} {context : AddInductive.Context}
+    {contextRun : AddInductive.ConstructorContextRun env Us context}
+    {expected : Expr} {arguments : List Expr}
+    {trace : AddInductive.ConstructorPreFamilyIndexSpineTrace context expected
+      arguments}
+    {expected' : VExpr}
+    (run : AddInductive.ConstructorPreFamilyIndexSpineSemanticRun env Us
+      context contextRun trace expected')
+    {base view : VLCtx} {expectedBase : VExpr} {lift : Lift}
+    (familyTr : TrExprS env Us base expected expectedBase)
+    (unique : TrExprS.IsUnique expected)
+    (extension : VLCtx.FVLift' base view 0 lift 0)
+    (viewDefEq : VLCtx.IsDefEq env Us.length
+      contextRun.candidate.context.vlctx view)
+    (viewUnique : TrExprS.IsUniqueCtx
+      contextRun.candidate.context.vlctx view) :
+    expected' = expectedBase.lift' (lift.consN 0) := by
+  have henv : VEnv.Ordered env := by
+    simpa only [contextRun.venv_eq] using
+      contextRun.candidate.context.Ewf.ordered
+  have viewWF : VLCtx.WF env Us.length view :=
+    (viewDefEq.symm henv).wf
+  have familyAtView : TrExprS env Us view expected
+      (expectedBase.lift' (lift.consN 0)) :=
+    familyTr.weakFV' henv extension viewWF
+  have retained : TrExprS env Us contextRun.candidate.context.vlctx
+      expected expected' := run.expectedRun.expr_tr
+  exact retained.unique' viewUnique unique familyAtView
+
+theorem VLCtx.FVLift'.toCtxLiftN
+    {base view : VLCtx} {n : Nat}
+    (extension : VLCtx.FVLift' base view 0 (.skipN .refl n) 0) :
+    Ctx.LiftN n 0 base.toCtx view.toCtx := by
+  exact Ctx.liftN_iff_lift'.2 extension.toCtx
+
+/-- Transport a spine to the canonical view context and then remove the
+free-variable extension from all of its endpoints. -/
+theorem VEnv.SpineWF.fvLift_inv
+    {env : VEnv} {U n : Nat} {base actual view : VLCtx}
+    {arguments : List VExpr} {source target : VExpr}
+    (henv : VEnv.WF env)
+    (viewDefEq : VLCtx.IsDefEq env U actual view)
+    (extension : VLCtx.FVLift' base view 0 (.skipN .refl n) 0)
+    (run : env.SpineWF U actual.toCtx (source.liftN n 0)
+      (arguments.map fun argument => argument.liftN n 0)
+      (target.liftN n 0)) :
+    env.SpineWF U base.toCtx source arguments target := by
+  have viewWF : VLCtx.WF env U view :=
+    (viewDefEq.symm henv.ordered).wf
+  have viewRun : env.SpineWF U view.toCtx (source.liftN n 0)
+      (arguments.map fun argument => argument.liftN n 0)
+      (target.liftN n 0) :=
+    run.defeqDFC henv.ordered viewDefEq.defeqCtx
+  exact VEnv.SpineWF.weakN_inv henv viewWF.toCtx
+    (Ctx.liftN_iff_lift'.2 extension.toCtx) viewRun
+
+theorem VEnv.SpineWF.fvLift'_inv
+    {env : VEnv} {U : Nat} {lift : Lift} {base actual view : VLCtx}
+    {arguments : List VExpr} {source target : VExpr}
+    (henv : VEnv.WF env)
+    (viewDefEq : VLCtx.IsDefEq env U actual view)
+    (extension : VLCtx.FVLift' base view 0 lift 0)
+    (run : env.SpineWF U actual.toCtx (source.lift' (lift.consN 0))
+      (arguments.map fun argument => argument.lift' (lift.consN 0))
+      (target.lift' (lift.consN 0))) :
+    env.SpineWF U base.toCtx source arguments target := by
+  have viewWF : VLCtx.WF env U view :=
+    (viewDefEq.symm henv.ordered).wf
+  have viewRun : env.SpineWF U view.toCtx
+      (source.lift' (lift.consN 0))
+      (arguments.map fun argument => argument.lift' (lift.consN 0))
+      (target.lift' (lift.consN 0)) :=
+    run.defeqDFC henv.ordered viewDefEq.defeqCtx
+  exact VEnv.SpineWF.weak'_inv henv viewWF.toCtx extension.toCtx viewRun
+
+/-- Identify a pre-family index replay with the analyzer family telescope,
+remove the family-index locals, and retarget its terminal to the family sort. -/
+theorem ConstructorPreFamilyIndexSpineSemanticRun.baseSpine
+    {env : VEnv} {Us : List Name} {context : AddInductive.Context}
+    {contextRun : AddInductive.ConstructorContextRun env Us context}
+    {expected : Expr} {arguments : List Expr}
+    {trace : AddInductive.ConstructorPreFamilyIndexSpineTrace context expected
+      arguments}
+    {expected' : VExpr} {base view : VLCtx} {indices : List VExpr}
+    {level : VLevel} {n : Nat}
+    (run : AddInductive.ConstructorPreFamilyIndexSpineSemanticRun env Us
+      context contextRun trace expected')
+    (familyTr : TrExprS env Us base expected
+      (VExpr.forallN indices (.sort level)))
+    (expectedUnique : TrExprS.IsUnique expected)
+    (viewDefEq : VLCtx.IsDefEq env Us.length
+      contextRun.candidate.context.vlctx view)
+    (viewUnique : TrExprS.IsUniqueCtx
+      contextRun.candidate.context.vlctx view)
+    (extension : VLCtx.FVLift' base view 0 (.skipN .refl n) 0)
+    (argumentClosed : ∀ argument ∈ arguments, Closed argument)
+    (argumentFVars : ∀ argument ∈ arguments,
+      FVarsIn (· ∈ base.fvars) argument)
+    (argumentUnique : ∀ argument ∈ arguments,
+      TrExprS.IsUnique argument)
+    (argumentLength : arguments.length = indices.length) :
+    ∃ indices',
+      List.Forall₂ (TrExprS env Us base) arguments indices' ∧
+      env.SpineWF Us.length base.toCtx
+        (VExpr.forallN indices (.sort level)) indices' (.sort level) := by
+  have henv : VEnv.WF env := by
+    simpa only [contextRun.venv_eq] using
+      contextRun.candidate.context.Ewf
+  have expectedEq : expected' =
+      (VExpr.forallN indices (.sort level)).liftN n 0 :=
+    run.expected_eq_of_family familyTr expectedUnique extension viewDefEq
+      viewUnique
+  subst expected'
+  obtain ⟨indices', indicesTr, indicesEq⟩ :=
+    TrExprS.forall₂_weakFV_inv_defeq henv viewDefEq viewUnique
+      extension run.arguments_tr argumentClosed argumentFVars argumentUnique
+  have translatedLength : run.arguments'.length =
+      (VExpr.liftTelN n indices 0).length := by
+    rw [← forall₂_length run.arguments_tr, argumentLength,
+      VExpr.liftTelN_length]
+  have liftedSpine : env.SpineWF Us.length
+      contextRun.candidate.context.vlctx.toCtx
+      ((VExpr.forallN indices (.sort level)).liftN n 0)
+      run.arguments' (.sort level) := by
+    have sourceEq :
+        (VExpr.forallN indices (.sort level)).liftN n 0 =
+          VExpr.forallN (VExpr.liftTelN n indices 0) (.sort level) := by
+      rw [VExpr.liftN_forallN]
+      rfl
+    have spine : env.SpineWF Us.length
+        contextRun.candidate.context.vlctx.toCtx
+        (VExpr.forallN (VExpr.liftTelN n indices 0) (.sort level))
+        run.arguments' run.result' :=
+      sourceEq ▸ run.spine
+    have retargeted := spine.retarget translatedLength (.sort level)
+    have sortClosed : (VExpr.sort level).ClosedN 0 := by trivial
+    have targetEq : (VExpr.sort level).instRev run.arguments' =
+        .sort level := VExpr.instRev_closedN run.arguments' sortClosed
+    rw [targetEq] at retargeted
+    exact Eq.mpr (congrArg (fun source => env.SpineWF Us.length
+      contextRun.candidate.context.vlctx.toCtx source run.arguments'
+        (.sort level)) sourceEq) retargeted
+  simp only [VExpr.lift'_consN_skipN] at indicesEq
+  rw [indicesEq] at liftedSpine
+  exact ⟨indices', indicesTr, by
+    apply VEnv.SpineWF.fvLift_inv henv viewDefEq extension
+    simpa only [VExpr.liftN] using liftedSpine⟩
+
+theorem ConstructorPreFamilyIndexSpineSemanticRun.baseSpine_lift
+    {env : VEnv} {Us : List Name} {context : AddInductive.Context}
+    {contextRun : AddInductive.ConstructorContextRun env Us context}
+    {expected : Expr} {arguments : List Expr}
+    {trace : AddInductive.ConstructorPreFamilyIndexSpineTrace context expected
+      arguments}
+    {expected' : VExpr} {base view : VLCtx} {indices : List VExpr}
+    {level : VLevel} {lift : Lift}
+    (run : AddInductive.ConstructorPreFamilyIndexSpineSemanticRun env Us
+      context contextRun trace expected')
+    (familyTr : TrExprS env Us base expected
+      (VExpr.forallN indices (.sort level)))
+    (expectedUnique : TrExprS.IsUnique expected)
+    (viewDefEq : VLCtx.IsDefEq env Us.length
+      contextRun.candidate.context.vlctx view)
+    (viewUnique : TrExprS.IsUniqueCtx
+      contextRun.candidate.context.vlctx view)
+    (extension : VLCtx.FVLift' base view 0 lift 0)
+    (argumentClosed : ∀ argument ∈ arguments, Closed argument)
+    (argumentFVars : ∀ argument ∈ arguments,
+      FVarsIn (· ∈ base.fvars) argument)
+    (argumentUnique : ∀ argument ∈ arguments,
+      TrExprS.IsUnique argument)
+    (argumentLength : arguments.length = indices.length) :
+    ∃ indices',
+      List.Forall₂ (TrExprS env Us base) arguments indices' ∧
+      env.SpineWF Us.length base.toCtx
+        (VExpr.forallN indices (.sort level)) indices' (.sort level) := by
+  have henv : VEnv.WF env := by
+    simpa only [contextRun.venv_eq] using
+      contextRun.candidate.context.Ewf
+  have expectedEq : expected' =
+      (VExpr.forallN indices (.sort level)).lift' (lift.consN 0) :=
+    expected_eq_of_family_lift run familyTr expectedUnique extension
+      viewDefEq viewUnique
+  subst expected'
+  obtain ⟨indices', indicesTr, indicesEq⟩ :=
+    TrExprS.forall₂_weakFV_inv_defeq henv viewDefEq viewUnique
+      extension run.arguments_tr argumentClosed argumentFVars argumentUnique
+  have translatedLength : run.arguments'.length =
+      (vexprLiftTel (lift.consN 0) indices).length := by
+    rw [← forall₂_length run.arguments_tr, argumentLength,
+      vexprLiftTel_length]
+  have liftedSpine : env.SpineWF Us.length
+      contextRun.candidate.context.vlctx.toCtx
+      ((VExpr.forallN indices (.sort level)).lift' (lift.consN 0))
+      run.arguments' (.sort level) := by
+    have sourceEq :
+        (VExpr.forallN indices (.sort level)).lift' (lift.consN 0) =
+          VExpr.forallN (vexprLiftTel (lift.consN 0) indices)
+            (.sort level) := by
+      rw [vexpr_lift'_forallN]
+      rfl
+    have spine : env.SpineWF Us.length
+        contextRun.candidate.context.vlctx.toCtx
+        (VExpr.forallN (vexprLiftTel (lift.consN 0) indices) (.sort level))
+        run.arguments' run.result' :=
+      sourceEq ▸ run.spine
+    have retargeted := spine.retarget translatedLength (.sort level)
+    have sortClosed : (VExpr.sort level).ClosedN 0 := by trivial
+    have targetEq : (VExpr.sort level).instRev run.arguments' =
+        .sort level := VExpr.instRev_closedN run.arguments' sortClosed
+    rw [targetEq] at retargeted
+    exact Eq.mpr (congrArg (fun source => env.SpineWF Us.length
+      contextRun.candidate.context.vlctx.toCtx source run.arguments'
+        (.sort level)) sourceEq) retargeted
+  rw [indicesEq] at liftedSpine
+  exact ⟨indices', indicesTr, by
+    apply VEnv.SpineWF.fvLift'_inv henv viewDefEq extension
+    simpa only [VExpr.lift'] using liftedSpine⟩
+
+/-- Recover the exact analyzer-selected source type and its checker-selected
+sort after removing a verified free-variable context extension. -/
+theorem ensureTypeRun_baseType
+    {env typeEnv : VEnv} {Us : List Name}
+    {base actual view : VLCtx} {source : Expr}
+    {source' actual' : VExpr} {fieldLevel : VLevel} {n : Lift}
+    (henv : VEnv.WF env) (typeEnvOrdered : VEnv.Ordered typeEnv)
+    (addType : env ≤ typeEnv)
+    (_baseWF : VLCtx.WF env Us.length base)
+    (viewDefEq : VLCtx.IsDefEq env Us.length actual view)
+    (viewUnique : TrExprS.IsUniqueCtx actual view)
+    (viewLift : VLCtx.FVLift' base view 0 n 0)
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ base.fvars) source)
+    (sourceTr : TrExprS typeEnv Us base source source')
+    (actualTr : TrExprS env Us actual source actual')
+    (actualType : env.HasType Us.length actual.toCtx actual' (.sort fieldLevel)) :
+    env.HasType Us.length base.toCtx source' (.sort fieldLevel) := by
+  obtain ⟨base', baseTr⟩ :=
+    actualTr.weakFV'_inv henv viewLift viewDefEq sourceClosed sourceFVars
+  have baseEq : base' = source' :=
+    (baseTr.mono addType).unique sourceUnique sourceTr
+  subst base'
+  have viewWF : VLCtx.WF env Us.length view :=
+    (viewDefEq.symm henv.ordered).wf
+  have sourceAtView := sourceTr
+  have sourceAtView' : TrExprS typeEnv Us view source
+      (source'.lift' (n.consN 0)) :=
+    sourceAtView.weakFV' typeEnvOrdered viewLift (viewWF.mono addType)
+  have actualEq : actual' = source'.lift' (n.consN 0) := by
+    exact (actualTr.mono addType).unique' viewUnique sourceUnique sourceAtView'
+  have sourceTypeAtView : env.HasType Us.length view.toCtx
+      actual' (.sort fieldLevel) :=
+    actualType.defeqDFC henv.ordered viewDefEq.defeqCtx
+  rw [actualEq] at sourceTypeAtView
+  exact (HasType.weak'_iff henv viewWF.toCtx viewLift.toCtx).1 (by
+    simpa using sourceTypeAtView)
+
+theorem ensureTypeRun_baseType_mono
+    {env typeEnv : VEnv} {Us : List Name}
+    {base actual view : VLCtx} {source : Expr}
+    {source' actual' : VExpr} {fieldLevel : VLevel} {n : Lift}
+    (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    (baseWF : VLCtx.WF env Us.length base)
+    (viewDefEq : VLCtx.IsDefEq env Us.length actual view)
+    (viewUnique : TrExprS.IsUniqueCtx actual view)
+    (viewLift : VLCtx.FVLift' base view 0 n 0)
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ base.fvars) source)
+    (sourceTr : TrExprS typeEnv Us base source source')
+    (actualTr : TrExprS env Us actual source actual')
+    (actualType : typeEnv.HasType Us.length actual.toCtx actual'
+      (.sort fieldLevel)) :
+    typeEnv.HasType Us.length base.toCtx source' (.sort fieldLevel) := by
+  exact ensureTypeRun_baseType typeEnvWF
+    typeEnvWF.ordered VEnv.LE.rfl
+    (baseWF.mono addType) (viewDefEq.mono addType) viewUnique viewLift
+    sourceUnique sourceClosed sourceFVars sourceTr (actualTr.mono addType)
+    actualType
+
+/-- Recover a family-free base endpoint when the analyzer translation lives
+under a different prefix than D3's index-extended replay context. -/
+theorem ensureTypeRun_commonType
+    {env typeEnv : VEnv} {Us : List Name}
+    {base full actual view : VLCtx} {source : Expr}
+    {fullTarget actualTarget : VExpr} {fieldLevel : VLevel}
+    {fullLift viewLift : Lift}
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    (baseWF : VLCtx.WF env Us.length base)
+    (fullWF : VLCtx.WF typeEnv Us.length full)
+    (fullExtension : VLCtx.FVLift' base full 0 fullLift 0)
+    (viewDefEq : VLCtx.IsDefEq env Us.length actual view)
+    (viewUnique : TrExprS.IsUniqueCtx actual view)
+    (viewExtension : VLCtx.FVLift' base view 0 viewLift 0)
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ base.fvars) source)
+    (fullTr : TrExprS typeEnv Us full source fullTarget)
+    (actualTr : TrExprS env Us actual source actualTarget)
+    (actualType : env.HasType Us.length actual.toCtx actualTarget
+      (.sort fieldLevel)) :
+    ∃ baseTarget,
+      TrExprS typeEnv Us base source baseTarget ∧
+      fullTarget = baseTarget.lift' fullLift ∧
+      env.HasType Us.length base.toCtx baseTarget (.sort fieldLevel) := by
+  obtain ⟨baseTarget, baseTr⟩ := fullTr.weakFV'_inv typeEnvWF
+    fullExtension (.refl typeEnvWF.ordered fullWF) sourceClosed sourceFVars
+  have fullEq : fullTarget = baseTarget.lift' fullLift :=
+    fullTr.unique sourceUnique
+      (baseTr.weakFV' typeEnvWF.ordered fullExtension fullWF)
+  have baseType := ensureTypeRun_baseType
+    henv typeEnvWF.ordered
+    addType baseWF viewDefEq viewUnique viewExtension sourceUnique
+    sourceClosed sourceFVars baseTr actualTr actualType
+  exact ⟨baseTarget, baseTr, fullEq, baseType⟩
+
+/-- D2 types the exact analyzer-owned field in the synthetic full field
+context and relates it to the declaration actually pushed by validation. -/
+theorem analyzerField_postType
+    {typeEnv : VEnv} {Us : List Name}
+    {full postActual : VLCtx} {source : Expr}
+    {analyzer postRaw postView postConsumed : VExpr}
+    {rawLevel : VLevel}
+    (typeEnvWF : VEnv.WF typeEnv)
+    (fullWF : VLCtx.WF typeEnv Us.length full)
+    (postWF : VLCtx.WF typeEnv Us.length postActual)
+    (relation : VLCtx.IsDefEqFVars typeEnv Us.length full postActual)
+    (analyzerTr : TrExprS typeEnv Us full source analyzer)
+    (postViewTr : TrExprS typeEnv Us postActual source postView)
+    (postRawType : typeEnv.HasType Us.length postActual.toCtx postRaw
+      (.sort rawLevel))
+    (postRawView : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw postView)
+    (postAnnotations : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw postConsumed) :
+    typeEnv.HasType Us.length full.toCtx analyzer (.sort rawLevel) ∧
+      typeEnv.IsDefEq Us.length full.toCtx analyzer postConsumed
+        (.sort rawLevel) := by
+  have postViewType : typeEnv.HasType Us.length postActual.toCtx postView
+      (.sort rawLevel) :=
+    postRawType.defeqU_l typeEnvWF postWF.toCtx postRawView
+  have postViewAtFull : typeEnv.HasType Us.length full.toCtx postView
+      (.sort rawLevel) :=
+    postViewType.defeqDFC typeEnvWF.ordered
+      (relation.defeqCtx.symm typeEnvWF.ordered)
+  have analyzerViewU : typeEnv.IsDefEqU Us.length full.toCtx
+      analyzer postView :=
+    analyzerTr.uniqFVars typeEnvWF relation fullWF postViewTr
+  have analyzerView := analyzerViewU.of_r typeEnvWF fullWF.toCtx
+    postViewAtFull
+  have rawViewAtFull := postRawView.defeqDFC typeEnvWF.ordered
+    (relation.defeqCtx.symm typeEnvWF.ordered)
+  have rawConsumedAtFull := postAnnotations.defeqDFC typeEnvWF.ordered
+    (relation.defeqCtx.symm typeEnvWF.ordered)
+  have rawTypeAtFull := postRawType.defeqDFC typeEnvWF.ordered
+    (relation.defeqCtx.symm typeEnvWF.ordered)
+  have rawConsumed := rawConsumedAtFull.of_l typeEnvWF fullWF.toCtx
+    rawTypeAtFull
+  have analyzerConsumed := analyzerView.trans
+    ((rawViewAtFull.of_l typeEnvWF fullWF.toCtx rawTypeAtFull).symm.trans
+      rawConsumed)
+  exact ⟨analyzerView.hasType.1, analyzerConsumed⟩
+
+structure AnalyzerPostContextState
+    (typeEnv : VEnv) (Us : List Name)
+    (full postActual postView : VLCtx) (viewLift : Lift) where
+  fullWF : VLCtx.WF typeEnv Us.length full
+  postWF : VLCtx.WF typeEnv Us.length postActual
+  viewWF : VLCtx.WF typeEnv Us.length postView
+  viewDefEq : VLCtx.IsDefEqFVars typeEnv Us.length postActual postView
+  viewExtension : VLCtx.FVLift' full postView 0 viewLift 0
+
+def vlctxCons
+    (entry : Option (FVarId × List FVarId) × VLocalDecl)
+    (tail : VLCtx) : VLCtx :=
+  entry :: tail
+
+theorem VLCtx.IsDefEqFVars.fvars
+    (relation : VLCtx.IsDefEqFVars env U left right) :
+    left.fvars = right.fvars := by
+  induction relation with
+  | nil => rfl
+  | cons_bvar relation declaration ih =>
+      change _ = _
+      exact ih
+  | cons_fvar relation declaration ih =>
+      change _ :: _ = _ :: _
+      exact congrArg (fun tail => _ :: tail) ih
+
+theorem VLCtx.IsDefEqFVars.mono
+    (add : env ≤ env') :
+    VLCtx.IsDefEqFVars env U left right →
+      VLCtx.IsDefEqFVars env' U left right := by
+  intro relation
+  induction relation with
+  | nil => exact .nil
+  | cons_bvar relation declaration ih =>
+      exact .cons_bvar ih (declaration.mono add)
+  | cons_fvar relation declaration ih =>
+      exact .cons_fvar ih (declaration.mono add)
+
+theorem VLCtx.IsDefEqFVars.symm
+    (henv : VEnv.Ordered env) :
+    VLCtx.IsDefEqFVars env U left right →
+      VLCtx.IsDefEqFVars env U right left := by
+  intro relation
+  induction relation with
+  | nil => exact .nil
+  | cons_bvar relation declaration ih =>
+      exact .cons_bvar ih
+        (declaration.symm.defeqDFC henv relation.defeqCtx)
+  | cons_fvar relation declaration ih =>
+      exact .cons_fvar ih
+        (declaration.symm.defeqDFC henv relation.defeqCtx)
+
+def FullFreshInvariant (context : AddInductive.Context)
+    (common full : VLCtx) : Prop :=
+  ∀ fv ∈ full.fvars,
+    fv ∈ common.fvars ∨ context.ngen.Reserves fv
+
+theorem FullFreshInvariant.fresh
+    (invariant : FullFreshInvariant context common full)
+    (freshCommon : context.freshFVarId ∉ common.fvars) :
+    context.freshFVarId ∉ full.fvars := by
+  intro present
+  rcases invariant context.freshFVarId present with common | reserved
+  · exact freshCommon common
+  · exact NameGenerator.not_reserves_self reserved
+
+theorem FullFreshInvariant.push
+    (invariant : FullFreshInvariant context common full)
+    {commonDomain fullDomain : VLocalDecl}
+    {commonDeps fullDeps : List FVarId} :
+    FullFreshInvariant
+      (context.pushLocalDecl name binderInfo sourceDomain)
+      (vlctxCons
+        (some (context.freshFVarId, commonDeps), commonDomain) common)
+      (vlctxCons
+        (some (context.freshFVarId, fullDeps), fullDomain) full) := by
+  intro fv present
+  simp only [vlctxCons, VLCtx.fvars_cons_some, List.mem_cons] at present
+  rcases present with rfl | present
+  · exact .inl (by simp [vlctxCons])
+  · rcases invariant fv present with commonMem | reserved
+    · exact .inl (by
+        simp only [vlctxCons, VLCtx.fvars_cons_some, List.mem_cons]
+        exact .inr commonMem)
+    · exact .inr (reserved.mono NameGenerator.LE.next)
+
+theorem FullFreshInvariant.skip
+    (invariant : FullFreshInvariant context common full)
+    {fullDomain : VLocalDecl} {fullDeps : List FVarId} :
+    FullFreshInvariant context.advanceFresh common
+      (vlctxCons
+        (some (context.freshFVarId, fullDeps), fullDomain) full) := by
+  intro fv present
+  simp only [vlctxCons, VLCtx.fvars_cons_some, List.mem_cons] at present
+  rcases present with rfl | present
+  · exact .inr NameGenerator.next_reserves_self
+  · rcases invariant fv present with common | reserved
+    · exact .inl common
+    · exact .inr (reserved.mono NameGenerator.LE.next)
+
+structure D3FullContextState
+    (env typeEnv : VEnv) (Us : List Name)
+    (context : AddInductive.Context)
+    (common full actual view : VLCtx) (fullLift viewLift : Lift) where
+  commonWF : VLCtx.WF env Us.length common
+  commonNoBV : common.NoBV
+  fullWF : VLCtx.WF typeEnv Us.length full
+  fullExtension : VLCtx.FVLift' common full 0 fullLift 0
+  actualWF : VLCtx.WF env Us.length actual
+  viewDefEq : VLCtx.IsDefEq env Us.length actual view
+  viewUnique : TrExprS.IsUniqueCtx actual view
+  viewExtension : VLCtx.FVLift' common view 0 viewLift 0
+  freshInvariant : FullFreshInvariant context common full
+
+/-- Push one family-free D3 binder through both the analyzer's full context
+and D3's index-extended context. -/
+theorem D3FullContextState.push
+    {env typeEnv : VEnv} {Us : List Name}
+    {context : AddInductive.Context}
+    {common full actual view : VLCtx} {fullLift viewLift : Lift}
+    (state : D3FullContextState env typeEnv Us context
+      common full actual view fullLift viewLift)
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {source : Expr}
+    {fullTarget actualSource actualConsumed : VExpr}
+    {fieldLevel consumedLevel : VLevel}
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ common.fvars) source)
+    (fullTr : TrExprS typeEnv Us full source fullTarget)
+    (actualTr : TrExprS env Us actual source actualSource)
+    (actualType : env.HasType Us.length actual.toCtx actualSource
+      (.sort fieldLevel))
+    (actualAnnotations : env.IsDefEqU Us.length actual.toCtx
+      actualSource actualConsumed)
+    (actualConsumedType : env.HasType Us.length actual.toCtx actualConsumed
+      (.sort consumedLevel))
+    (actualTailWF : VLCtx.WF env Us.length
+      (vlctxCons
+        (some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+          .vlam actualConsumed) actual)) :
+    ∃ commonTarget,
+      TrExprS typeEnv Us common source commonTarget ∧
+      fullTarget = commonTarget.lift' fullLift ∧
+      env.HasType Us.length common.toCtx commonTarget (.sort fieldLevel) ∧
+      D3FullContextState env typeEnv Us
+        (context.pushLocalDecl name binderInfo
+          (consumeTypeAnnotations source))
+        (vlctxCons
+          (some (context.freshFVarId,
+            (consumeTypeAnnotations source).fvarsList),
+            .vlam commonTarget) common)
+        (vlctxCons
+          (some (context.freshFVarId,
+            (consumeTypeAnnotations source).fvarsList),
+            .vlam fullTarget) full)
+        (vlctxCons
+          (some (context.freshFVarId,
+            (consumeTypeAnnotations source).fvarsList),
+            .vlam actualConsumed) actual)
+        (vlctxCons
+          (some (context.freshFVarId,
+            (consumeTypeAnnotations source).fvarsList),
+            .vlam (commonTarget.lift' viewLift)) view)
+        (.consN fullLift 1) (.consN viewLift 1) := by
+  obtain ⟨commonTarget, commonTr, fullEq, commonType⟩ :=
+    ensureTypeRun_commonType henv typeEnvWF addType state.commonWF
+      state.fullWF state.fullExtension state.viewDefEq state.viewUnique
+      state.viewExtension sourceUnique sourceClosed sourceFVars fullTr
+      actualTr actualType
+  have viewWF : VLCtx.WF env Us.length view :=
+    (state.viewDefEq.symm henv.ordered).wf
+  have commonAtView : TrExprS typeEnv Us view source
+      (commonTarget.lift' viewLift) :=
+    commonTr.weakFV' typeEnvWF.ordered state.viewExtension
+      (viewWF.mono addType)
+  have actualSource_eq : actualSource = commonTarget.lift' viewLift :=
+    (actualTr.mono addType).unique' state.viewUnique sourceUnique commonAtView
+  have consumedToCommon : env.IsDefEq Us.length actual.toCtx
+      actualConsumed (commonTarget.lift' viewLift)
+      (.sort consumedLevel) := by
+    rw [← actualSource_eq]
+    exact (actualAnnotations.of_r henv state.actualWF.toCtx
+      actualConsumedType).symm
+  have depsSubset : (consumeTypeAnnotations source).fvarsList ⊆
+      common.fvars :=
+    (FVarsIn.consumeTypeAnnotations sourceFVars |> fvarsIn_iff.mp).1
+  have freshCommon : context.freshFVarId ∉ common.fvars := by
+    intro present
+    have presentView := state.viewExtension.fvars_sublist.subset present
+    have presentActual : context.freshFVarId ∈ actual.fvars := by
+      simpa only [state.viewDefEq.fvars] using presentView
+    exact (actualTailWF.2.1 _ _ rfl).1 presentActual
+  have freshFull := state.freshInvariant.fresh freshCommon
+  have commonTailWF : VLCtx.WF env Us.length
+      (vlctxCons
+        (some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+          .vlam commonTarget) common) := by
+    refine ⟨state.commonWF, ?_, ⟨fieldLevel, commonType⟩⟩
+    intro fv deps equality
+    cases equality
+    exact ⟨freshCommon, depsSubset⟩
+  have fullType : typeEnv.HasType Us.length full.toCtx fullTarget
+      (.sort fieldLevel) := by
+    rw [fullEq]
+    exact (commonType.weak' henv.ordered state.fullExtension.toCtx).mono addType
+  have fullTailWF : VLCtx.WF typeEnv Us.length
+      (vlctxCons
+        (some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+          .vlam fullTarget) full) := by
+    refine ⟨state.fullWF, ?_, ⟨fieldLevel, fullType⟩⟩
+    intro fv deps equality
+    cases equality
+    exact ⟨freshFull, fun fv member =>
+      state.fullExtension.fvars_sublist.subset (depsSubset member)⟩
+  have nextViewDefEq : VLCtx.IsDefEq env Us.length
+      (vlctxCons
+        (some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+          .vlam actualConsumed) actual)
+      (vlctxCons
+        (some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+          .vlam (commonTarget.lift' viewLift)) view) := by
+    exact .cons state.viewDefEq actualTailWF.2.1
+      (.vlam consumedToCommon)
+  refine ⟨commonTarget, commonTr, fullEq, commonType, {
+    commonWF := commonTailWF
+    commonNoBV := by
+      simpa only [vlctxCons, VLCtx.NoBV, VLCtx.bvars] using
+        state.commonNoBV
+    fullWF := fullTailWF
+    fullExtension := ?_
+    actualWF := actualTailWF
+    viewDefEq := nextViewDefEq
+    viewUnique := state.viewUnique.cons .vlam
+    viewExtension := state.viewExtension.cons_fvar
+      (context.freshFVarId,
+        (consumeTypeAnnotations source).fvarsList)
+      (.vlam commonTarget) depsSubset
+    freshInvariant := state.freshInvariant.push }⟩
+  simpa only [fullEq, vlctxCons, VLocalDecl.lift',
+    VLocalDecl.depth] using state.fullExtension.cons_fvar
+    (context.freshFVarId,
+      (consumeTypeAnnotations source).fvarsList)
+    (.vlam commonTarget) depsSubset
+
+/-- Skip one family-dependent outer field in D3's family-free replay while
+retaining that exact analyzer field in the full context. -/
+theorem D3FullContextState.skip
+    {env typeEnv : VEnv} {Us : List Name}
+    {context : AddInductive.Context}
+    {common full actual view : VLCtx} {fullLift viewLift : Lift}
+    (state : D3FullContextState env typeEnv Us context
+      common full actual view fullLift viewLift)
+    {source : Expr} {field : VExpr}
+    (nextFullWF : VLCtx.WF typeEnv Us.length
+      ((some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+        .vlam field) :: full)) :
+    D3FullContextState env typeEnv Us context.advanceFresh common
+      ((some (context.freshFVarId,
+          (consumeTypeAnnotations source).fvarsList),
+        .vlam field) :: full)
+      actual view (.skipN fullLift 1) viewLift where
+  commonWF := state.commonWF
+  commonNoBV := state.commonNoBV
+  fullWF := nextFullWF
+  fullExtension := by
+    simpa only [VLocalDecl.depth] using state.fullExtension.skip_fvar
+      (context.freshFVarId,
+        (consumeTypeAnnotations source).fvarsList) (.vlam field)
+  actualWF := state.actualWF
+  viewDefEq := state.viewDefEq
+  viewUnique := state.viewUnique
+  viewExtension := state.viewExtension
+  freshInvariant := state.freshInvariant.skip
+
+/-- Exact analyzer syntax and pre-family semantic evidence for one recursive
+field.  The family telescope is tracked at the analyzer's current full
+context; nested binders lift it in the ordinary de Bruijn way. -/
+def RecursiveFieldRunResult
+    (env : VEnv) (Us : List Name) (full : VLCtx)
+    (familyTarget fieldTarget : VExpr) (level : VLevel)
+    (familyName : Name) (parameterCount : Nat) : Prop :=
+  ∃ binders indices terminal,
+    fieldTarget = VExpr.forallN binders terminal ∧
+    env.OnTel Us.length full.toCtx binders ∧
+    env.SpineWF Us.length
+      (binders.reverse ++ full.toCtx)
+      (familyTarget.liftN binders.length 0) indices (.sort level) ∧
+    (∃ levels, VExpr.appHead terminal = .const familyName levels) ∧
+    (VExpr.appArgs terminal []).drop parameterCount = indices
+
+/-- Synchronize the recursive D3 replay with the analyzer's exact strict
+translation.  D3 supplies all family-free typing and the terminal index
+spine; strict translation uniqueness fixes the analyzer-owned domains and
+terminal arguments componentwise. -/
+theorem recursiveField_exactAnalyzer
+    {env typeEnv : VEnv} {Us : List Name}
+    {stats : AddInductive.InductiveStats} {familyIdx : Nat}
+    {familyIndices : Expr} {context : AddInductive.Context}
+    {contextRun : AddInductive.ConstructorContextRun env Us context}
+    {source : Expr} {fuel : Nat}
+    {trace : AddInductive.ConstructorPreFamilyRecursiveTrace stats familyIdx
+      familyIndices context source fuel}
+    (run : AddInductive.ConstructorPreFamilyRecursiveSemanticRun env Us stats
+      familyIdx familyIndices contextRun trace)
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {common full view : VLCtx} {fullLift viewLift : Lift}
+    (state : D3FullContextState env typeEnv Us context common full
+      contextRun.candidate.context.vlctx view fullLift viewLift)
+    {commonIndices : List VExpr} {familyTarget fieldTarget : VExpr}
+    {level : VLevel} {familyName : Name} {familyLevels : List Level}
+    (familyCommonTr : TrExprS env Us common familyIndices
+      (VExpr.forallN commonIndices (.sort level)))
+    (familyFullTr : TrExprS typeEnv Us full familyIndices familyTarget)
+    (familyUnique : TrExprS.IsUnique familyIndices)
+    (indexLength : commonIndices.length = stats.nindices[familyIdx]!)
+    (familyHead : stats.indConsts[familyIdx]! =
+      .const familyName familyLevels)
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ common.fvars) source)
+    (fullTr : TrExprS typeEnv Us full source fieldTarget) :
+    RecursiveFieldRunResult env Us full familyTarget fieldTarget level
+      familyName stats.params.size := by
+  induction run generalizing common full view fullLift viewLift commonIndices
+      familyTarget fieldTarget with
+  | @target _ context source fuel valid spineTrace branchContextRun expected'
+      spine =>
+      have argumentClosed : ∀ argument ∈
+          source.getAppArgs.toList.drop stats.params.size,
+          Closed argument := by
+        intro argument member
+        apply Closed.getAppArgsList sourceClosed
+        rw [← Expr.getAppArgs_toList]
+        exact List.mem_of_mem_drop member
+      have argumentFVars : ∀ argument ∈
+          source.getAppArgs.toList.drop stats.params.size,
+          FVarsIn (· ∈ common.fvars) argument := by
+        intro argument member
+        apply FVarsIn.getAppArgsList sourceFVars
+        rw [← Expr.getAppArgs_toList]
+        exact List.mem_of_mem_drop member
+      have argumentUnique : ∀ argument ∈
+          source.getAppArgs.toList.drop stats.params.size,
+          TrExprS.IsUnique argument := by
+        intro argument member
+        apply TrExprS.IsUnique.getAppArgsList sourceUnique
+        rw [← Expr.getAppArgs_toList]
+        exact List.mem_of_mem_drop member
+      have argumentLength :
+          (source.getAppArgs.toList.drop stats.params.size).length =
+            commonIndices.length :=
+        (isValidIndAppIdx_indexArgs_length valid).trans
+          indexLength.symm
+      obtain ⟨baseIndices, baseIndicesTr, baseSpine⟩ :=
+        ConstructorPreFamilyIndexSpineSemanticRun.baseSpine_lift spine
+          familyCommonTr familyUnique
+          state.viewDefEq state.viewUnique state.viewExtension
+          argumentClosed argumentFVars argumentUnique argumentLength
+      have commonFamilyAtFull : TrExprS typeEnv Us full familyIndices
+          ((VExpr.forallN commonIndices (.sort level)).lift' fullLift) := by
+        simpa using (familyCommonTr.mono addType).weakFV'
+          typeEnvWF.ordered state.fullExtension state.fullWF
+      have familyEq : familyTarget =
+          (VExpr.forallN commonIndices (.sort level)).lift' fullLift :=
+        familyFullTr.unique familyUnique commonFamilyAtFull
+      have shape := isValidIndAppIdx_shape valid
+      have sourceHead : source.getAppFn =
+          .const familyName familyLevels := by
+        rw [familyHead] at shape
+        change source.getAppFn.eqv (.const familyName familyLevels) = true ∧
+          _ at shape
+        rw [Expr.eqv_eq] at shape
+        generalize headEq : source.getAppFn = head at shape
+        cases head <;> simp_all [Expr.eqv']
+      obtain ⟨targetLevels, targetHead, allArgumentsTr⟩ :=
+        TrExprS.constApp_components fullTr sourceHead
+      have droppedArgumentsTr :=
+        forall₂_drop allArgumentsTr stats.params.size
+      have baseIndicesAtFull : List.Forall₂
+          (TrExprS typeEnv Us full)
+          (source.getAppArgsList.drop stats.params.size)
+          (baseIndices.map fun index => index.lift' fullLift) := by
+        have baseMono := forall₂_tr_mono addType baseIndicesTr
+        have baseWeak := forall₂_tr_weakFV' typeEnvWF.ordered
+          state.fullExtension state.fullWF baseMono
+        simpa only [Expr.getAppArgs_toList] using baseWeak
+      have translatedIndicesEq :
+          (VExpr.appArgs fieldTarget []).drop stats.params.size =
+            baseIndices.map fun index => index.lift' fullLift :=
+        forall₂_translation_unique droppedArgumentsTr
+          baseIndicesAtFull (fun argument member =>
+            TrExprS.IsUnique.getAppArgsList sourceUnique argument
+              (List.mem_of_mem_drop member))
+      have fullSpine : env.SpineWF Us.length full.toCtx
+          ((VExpr.forallN commonIndices (.sort level)).lift' fullLift)
+          (baseIndices.map fun index => index.lift' fullLift)
+          (.sort level) := by
+        simpa using VEnv.SpineWF.weak' henv.ordered
+          state.fullExtension.toCtx baseSpine
+      rw [← familyEq, ← translatedIndicesEq] at fullSpine
+      exact ⟨[], (VExpr.appArgs fieldTarget []).drop stats.params.size,
+        fieldTarget, rfl, trivial, by simpa using fullSpine,
+        ⟨targetLevels, targetHead⟩, rfl⟩
+  | @forallE context name domain body binderInfo fuel domainCheck ensureType
+      consumedCheck annotations fresh tailTrace branchContextRun domainRun
+      consumedRun ensureTypeRun annotationsRun consumedType tail ih =>
+      obtain ⟨fullDomain, fullBody, rfl, fullDomainType, fullBodyType,
+          domainTr, bodyTr⟩ := TrExprS.forallE_components fullTr
+      have actualDomainTr : TrExprS env Us
+          branchContextRun.candidate.context.vlctx domain
+          domainRun.source' := by
+        simpa only [branchContextRun.venv_eq,
+          branchContextRun.lparams_eq] using domainRun.check.expr_tr
+      have actualDomainType : env.HasType Us.length
+          branchContextRun.candidate.context.vlctx.toCtx domainRun.source'
+          (.sort ensureTypeRun.resultLevel') := by
+        simpa only [branchContextRun.venv_eq,
+          branchContextRun.lparams_eq] using ensureTypeRun.source_type
+      have actualAnnotations : env.IsDefEqU Us.length
+          branchContextRun.candidate.context.vlctx.toCtx domainRun.source'
+          consumedRun.source' := by
+        simpa only [branchContextRun.venv_eq,
+          branchContextRun.lparams_eq] using annotationsRun.isDefEqU
+      have consumedTypeCopy := consumedType
+      obtain ⟨consumedLevel, consumedHasType⟩ := consumedType
+      have actualConsumedType : env.HasType Us.length
+          branchContextRun.candidate.context.vlctx.toCtx consumedRun.source'
+          (.sort consumedLevel) := by
+        simpa only [branchContextRun.venv_eq,
+          branchContextRun.lparams_eq] using consumedHasType
+      let nextContextRun := branchContextRun.pushLocalDecl name binderInfo
+        (consumeTypeAnnotations domain) fresh consumedRun.source'
+        consumedRun.check.expr_tr consumedTypeCopy
+      have actualTailWF : VLCtx.WF env Us.length
+          (vlctxCons
+            (some (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList),
+              .vlam consumedRun.source')
+            branchContextRun.candidate.context.vlctx) := by
+        have nextWF := nextContextRun.candidate.context.Δwf
+        rw [nextContextRun.venv_eq, nextContextRun.lparams_eq] at nextWF
+        simpa only [vlctxCons, nextContextRun,
+          AddInductive.ConstructorContextRun.pushLocalDecl,
+          CandidateContextRun.pushLocalDecl_vlctx] using nextWF
+      obtain ⟨commonDomain, commonDomainTr, fullDomainEq,
+          commonDomainType, nextState⟩ :=
+        state.push henv typeEnvWF addType sourceUnique.1 sourceClosed.1
+          sourceFVars.1 domainTr actualDomainTr actualDomainType
+          actualAnnotations actualConsumedType actualTailWF
+      have bodyOpened : TrExprS typeEnv Us
+          (vlctxCons
+            (some (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList),
+              .vlam fullDomain) full)
+          (body.instantiate1 context.freshExpr) fullBody := by
+        simpa only [vlctxCons, AddInductive.Context.freshExpr,
+          Expr.instantiate1_eq] using
+          bodyTr.inst_fvar typeEnvWF.ordered nextState.fullWF
+      have familyCommonNext : TrExprS env Us
+          (vlctxCons
+            (some (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList),
+              .vlam commonDomain) common)
+          familyIndices
+          (VExpr.forallN (VExpr.liftTelN 1 commonIndices 0)
+            (.sort level)) := by
+        have weakened := familyCommonTr.weakFV henv.ordered
+          (VLCtx.FVLift.skip_fvar
+            (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList)
+            (.vlam commonDomain) .refl)
+          nextState.commonWF
+        simpa [vlctxCons, VLocalDecl.depth,
+          VExpr.liftN_forallN, VExpr.liftN] using weakened
+      have familyFullNext : TrExprS typeEnv Us
+          (vlctxCons
+            (some (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList),
+              .vlam fullDomain) full)
+          familyIndices (familyTarget.liftN 1 0) := by
+        have weakened := familyFullTr.weakFV typeEnvWF.ordered
+          (VLCtx.FVLift.skip_fvar
+            (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList)
+            (.vlam fullDomain) .refl)
+          nextState.fullWF
+        simpa [vlctxCons, VLocalDecl.depth] using weakened
+      have nextIndexLength :
+          (VExpr.liftTelN 1 commonIndices 0).length =
+            stats.nindices[familyIdx]! := by
+        simpa only [VExpr.liftTelN_length] using indexLength
+      have tailUnique : TrExprS.IsUnique
+          (body.instantiate1 context.freshExpr) := by
+        apply TrExprS.IsUnique.instantiate1 sourceUnique.2
+        simp only [AddInductive.Context.freshExpr]
+        trivial
+      have nextFullNoBV :
+          (vlctxCons
+            (some (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList),
+              .vlam fullDomain) full).bvars = 0 :=
+        nextState.fullExtension.bvars_eq.trans nextState.commonNoBV
+      have tailClosed : Closed (body.instantiate1 context.freshExpr) := by
+        have closed := bodyOpened.closed
+        rw [nextFullNoBV] at closed
+        exact closed
+      have tailFVars : FVarsIn
+          (· ∈ (vlctxCons
+            (some (context.freshFVarId,
+              (consumeTypeAnnotations domain).fvarsList),
+              .vlam commonDomain) common).fvars)
+          (body.instantiate1 context.freshExpr) := by
+        rw [Expr.instantiate1_eq]
+        apply FVarsIn.instantiate1
+        · exact sourceFVars.2.mono (fun fv member => by
+            simp only [vlctxCons, VLCtx.fvars_cons_some,
+              List.mem_cons]
+            exact .inr member)
+        · simp [AddInductive.Context.freshExpr, vlctxCons, FVarsIn]
+      obtain ⟨tailBinders, indices, terminal, tailTargetEq, tailOnTel,
+          tailSpine, terminalHead, terminalIndices⟩ :=
+        ih nextState familyCommonNext familyFullNext nextIndexLength
+          tailUnique tailClosed tailFVars bodyOpened
+      refine ⟨fullDomain :: tailBinders, indices, terminal, ?_, ?_, ?_,
+        terminalHead, terminalIndices⟩
+      · simp only [VExpr.forallN, VExpr.forallE.injEq, true_and]
+        exact tailTargetEq
+      · exact ⟨by
+          rw [fullDomainEq]
+          exact ⟨ensureTypeRun.resultLevel', by
+            simpa using commonDomainType.weak' henv.ordered
+              state.fullExtension.toCtx⟩,
+          by
+            simpa only [vlctxCons, VLCtx.toCtx] using tailOnTel⟩
+      · simpa only [List.reverse_cons, List.singleton_append,
+          List.append_assoc, vlctxCons, VLCtx.toCtx,
+          List.length_cons, VExpr.liftN_liftN, Nat.add_comm] using tailSpine
+
+private theorem forallN_inj_of_terminal_ne_forall
+    (leftNot : ∀ domain body, leftTerminal ≠ .forallE domain body)
+    (rightNot : ∀ domain body, rightTerminal ≠ .forallE domain body)
+    (equality : VExpr.forallN leftBinders leftTerminal =
+      VExpr.forallN rightBinders rightTerminal) :
+    leftBinders = rightBinders ∧ leftTerminal = rightTerminal := by
+  induction leftBinders generalizing rightBinders with
+  | nil =>
+      cases rightBinders with
+      | nil => exact ⟨rfl, equality⟩
+      | cons domain binders =>
+          exact (leftNot domain (VExpr.forallN binders rightTerminal)
+            equality).elim
+  | cons domain binders ih =>
+      cases rightBinders with
+      | nil =>
+          exact (rightNot domain (VExpr.forallN binders leftTerminal)
+            equality.symm).elim
+      | cons rightDomain rightBinders =>
+          simp only [VExpr.forallN, VExpr.forallE.injEq] at equality
+          obtain ⟨domainEq, tailEq⟩ := equality
+          obtain ⟨bindersEq, terminalEq⟩ :=
+            ih tailEq
+          cases domainEq
+          cases bindersEq
+          exact ⟨rfl, terminalEq⟩
+
+private theorem terminal_ne_forall_of_appHead_const
+    (head : VExpr.appHead terminal = .const familyName levels) :
+    ∀ domain body, terminal ≠ .forallE domain body := by
+  intro domain body equality
+  subst terminal
+  simp only [VExpr.appHead] at head
+  exact VExpr.noConfusion head
+
+private theorem hasConst_of_appHead_const
+    (head : VExpr.appHead terminal = .const familyName levels) :
+    terminal.hasConst familyName = true := by
+  induction terminal with
+  | app function argument functionIH argumentIH =>
+      simp only [VExpr.appHead] at head
+      simp only [VExpr.hasConst, Bool.or_eq_true]
+      exact .inl (functionIH head)
+  | const name levels =>
+      simp only [VExpr.appHead, VExpr.const.injEq] at head
+      exact (beq_iff_eq).2 head.1
+  | bvar | sort | lam | forallE => simp [VExpr.appHead] at head
+
+private theorem forallN_hasConst_of_terminal
+    (terminalHasConst : terminal.hasConst familyName = true) :
+    (VExpr.forallN binders terminal).hasConst familyName = true := by
+  induction binders with
+  | nil => exact terminalHasConst
+  | cons binder binders ih =>
+      simp only [VExpr.forallN, VExpr.hasConst, Bool.or_eq_true]
+      exact .inr ih
+
+theorem recArg?_eq_none_of_hasConst_false
+    (free : field.hasConst familyName = false) :
+    VInductDecl.recArg? U familyName np ni fieldIndex field = none := by
+  cases recursiveEq : VInductDecl.recArg? U familyName np ni fieldIndex field with
+  | none => rfl
+  | some recursive =>
+      have anatomy := VInductDecl.recArg?_eq recursiveEq
+      have terminalHead :
+          VExpr.appHead
+              (VExpr.appN (.const familyName (VLevel.params U))
+                (VExpr.bvarRevRange
+                    (fieldIndex + recursive.binders.length) np ++
+                  recursive.indices)) =
+            .const familyName (VLevel.params U) :=
+        VExpr.appHead_appN _ _
+      have terminalHasConst :=
+        hasConst_of_appHead_const terminalHead
+      have recursiveHasConst :=
+        forallN_hasConst_of_terminal
+          (binders := recursive.binders) terminalHasConst
+      rw [← anatomy.2.2.1, free] at recursiveHasConst
+      contradiction
+
+private theorem drop_bvarRevRange_append
+    (offset count : Nat) (suffix : List VExpr) :
+    (VExpr.bvarRevRange offset count ++ suffix).drop count = suffix := by
+  induction count with
+  | zero => rfl
+  | succ count ih =>
+      simp only [VExpr.bvarRevRange, List.cons_append, List.drop_succ_cons]
+      exact ih
+
+/-- A recursive-field synchronization certificate is exactly the semantic
+payload required by the analyzer's `RecArg` descriptor. -/
+theorem recursiveFieldResult_recArgWF
+    {env : VEnv} {Us : List Name} {full : VLCtx}
+    {familyTarget fieldTarget : VExpr} {level : VLevel}
+    {familyName : Name} {np ni fieldIndex : Nat}
+    {familyIndices : List VExpr}
+    (result : RecursiveFieldRunResult env Us full familyTarget
+      fieldTarget level familyName np)
+    (familyTargetEq : familyTarget =
+      VExpr.forallN (VExpr.liftTelN fieldIndex familyIndices 0)
+        (.sort level))
+    (stage : VInductDecl.stage3Field Us.length familyName np ni fieldIndex
+      fieldTarget = true) :
+    ∃ recursive,
+      VInductDecl.recArg? Us.length familyName np ni fieldIndex fieldTarget =
+        some recursive ∧
+      recursive.WF Us.length env level familyIndices full.toCtx := by
+  obtain ⟨binders, indices, terminal, targetEq, onTel, spine,
+      ⟨terminalLevels, terminalHead⟩, terminalIndices⟩ := result
+  have terminalHasConst : terminal.hasConst familyName = true :=
+    hasConst_of_appHead_const terminalHead
+  have fieldHasConst : fieldTarget.hasConst familyName = true := by
+    rw [targetEq]
+    exact forallN_hasConst_of_terminal terminalHasConst
+  have recursiveSome :
+      (VInductDecl.recArg? Us.length familyName np ni fieldIndex
+        fieldTarget).isSome = true := by
+    simpa only [VInductDecl.stage3Field, fieldHasConst, Bool.not_true,
+      Bool.or_false] using stage
+  cases recursiveEq : VInductDecl.recArg? Us.length familyName np ni
+      fieldIndex fieldTarget with
+  | none => simp [recursiveEq] at recursiveSome
+  | some recursive =>
+      have anatomy := VInductDecl.recArg?_eq recursiveEq
+      let recursiveTerminal := VExpr.appN
+        (.const familyName (VLevel.params Us.length))
+        (VExpr.bvarRevRange (fieldIndex + recursive.binders.length) np ++
+          recursive.indices)
+      have telescopesEq : VExpr.forallN binders terminal =
+          VExpr.forallN recursive.binders recursiveTerminal := by
+        exact targetEq.symm.trans anatomy.2.2.1
+      have recursiveTerminalHead :
+          VExpr.appHead recursiveTerminal =
+            .const familyName (VLevel.params Us.length) := by
+        exact VExpr.appHead_appN _ _
+      obtain ⟨bindersEq, terminalEq⟩ :=
+        forallN_inj_of_terminal_ne_forall
+          (terminal_ne_forall_of_appHead_const terminalHead)
+          (terminal_ne_forall_of_appHead_const recursiveTerminalHead)
+          telescopesEq
+      have indicesEq : indices = recursive.indices := by
+        rw [terminalEq, VExpr.appArgs_appN] at terminalIndices
+        simp only [VExpr.appArgs, List.append_nil] at terminalIndices
+        rw [drop_bvarRevRange_append] at terminalIndices
+        exact terminalIndices.symm
+      refine ⟨recursive, rfl, ?_⟩
+      unfold VInductDecl.RecArg.WF
+      refine ⟨?_, ?_⟩
+      · rw [← bindersEq]
+        exact onTel
+      · rw [anatomy.1, ← bindersEq, ← indicesEq]
+        rw [familyTargetEq, VExpr.liftN_forallN,
+          VExpr.liftTelN_liftTelN] at spine
+        simpa [VExpr.liftN] using spine
+
+theorem AnalyzerPostContextState.push
+    {typeEnv : VEnv} {Us : List Name}
+    {full postActual postViewContext : VLCtx} {viewLift : Lift}
+    (state : AnalyzerPostContextState typeEnv Us full postActual
+      postViewContext viewLift)
+    (typeEnvWF : VEnv.WF typeEnv)
+    {source : Expr} {analyzer postRaw postView postConsumed : VExpr}
+    {rawLevel : VLevel} {fv : FVarId} {postDeps : List FVarId}
+    (_sourceUnique : TrExprS.IsUnique source)
+    (_sourceClosed : Closed source)
+    (analyzerTr : TrExprS typeEnv Us full source analyzer)
+    (postViewTr : TrExprS typeEnv Us postActual source postView)
+    (postRawType : typeEnv.HasType Us.length postActual.toCtx postRaw
+      (.sort rawLevel))
+    (postRawView : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw postView)
+    (postAnnotations : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw postConsumed)
+    (postTailWF : VLCtx.WF typeEnv Us.length
+      ((some (fv, postDeps), .vlam postConsumed) :: postActual)) :
+    let deps := (AddInductive.consumeTypeAnnotations source).fvarsList
+    typeEnv.HasType Us.length full.toCtx analyzer (.sort rawLevel) ∧
+      AnalyzerPostContextState typeEnv Us
+        ((some (fv, deps), .vlam analyzer) :: full)
+        ((some (fv, postDeps), .vlam postConsumed) :: postActual)
+        ((some (fv, deps), .vlam (analyzer.lift' viewLift)) ::
+          postViewContext)
+        (.consN viewLift 1) := by
+  dsimp only
+  have postViewType : typeEnv.HasType Us.length postActual.toCtx postView
+      (.sort rawLevel) :=
+    postRawType.defeqU_l typeEnvWF state.postWF.toCtx postRawView
+  have postViewContextWF : VLCtx.WF typeEnv Us.length postViewContext :=
+    state.viewWF
+  have analyzerAtView : TrExprS typeEnv Us postViewContext source
+      (analyzer.lift' viewLift) :=
+    analyzerTr.weakFV' typeEnvWF.ordered state.viewExtension
+      postViewContextWF
+  have postViewAnalyzer : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postView (analyzer.lift' viewLift) :=
+    postViewTr.uniqFVars typeEnvWF state.viewDefEq state.postWF
+      analyzerAtView
+  have analyzerAtPostType : typeEnv.HasType Us.length postActual.toCtx
+      (analyzer.lift' viewLift) (.sort rawLevel) :=
+    (postViewAnalyzer.of_l typeEnvWF state.postWF.toCtx postViewType).hasType.2
+  have analyzerAtViewType : typeEnv.HasType Us.length postViewContext.toCtx
+      (analyzer.lift' viewLift) (.sort rawLevel) :=
+    analyzerAtPostType.defeqDFC typeEnvWF.ordered
+      state.viewDefEq.defeqCtx
+  have analyzerType : typeEnv.HasType Us.length full.toCtx analyzer
+      (.sort rawLevel) :=
+    (HasType.weak'_iff typeEnvWF postViewContextWF.toCtx
+      state.viewExtension.toCtx).1 (by simpa using analyzerAtViewType)
+  have rawView := postRawView.of_l typeEnvWF state.postWF.toCtx postRawType
+  have rawConsumed :=
+    postAnnotations.of_l typeEnvWF state.postWF.toCtx postRawType
+  have analyzerConsumed : typeEnv.IsDefEq Us.length postActual.toCtx
+      postConsumed (analyzer.lift' viewLift) (.sort rawLevel) :=
+    (rawConsumed.symm.trans rawView).trans
+      (postViewAnalyzer.of_l typeEnvWF state.postWF.toCtx postViewType)
+  have depsSubset : (AddInductive.consumeTypeAnnotations source).fvarsList ⊆
+      full.fvars :=
+    (FVarsIn.consumeTypeAnnotations analyzerTr.fvarsIn
+      |> fvarsIn_iff.mp).1
+  have freshFull : fv ∉ full.fvars := by
+    intro present
+    have presentView := state.viewExtension.fvars_sublist.subset present
+    have presentPost : fv ∈ postActual.fvars := by
+      simpa only [ConstructorValidation.VLCtx.IsDefEqFVars.fvars state.viewDefEq]
+        using presentView
+    exact (postTailWF.2.1 fv postDeps rfl).1 presentPost
+  have freshView : fv ∉ postViewContext.fvars := by
+    intro present
+    have presentPost : fv ∈ postActual.fvars := by
+      simpa only [ConstructorValidation.VLCtx.IsDefEqFVars.fvars state.viewDefEq]
+        using present
+    exact (postTailWF.2.1 fv postDeps rfl).1 presentPost
+  have depsSubsetView :
+      (AddInductive.consumeTypeAnnotations source).fvarsList ⊆
+        postViewContext.fvars := fun _ member =>
+    state.viewExtension.fvars_sublist.subset (depsSubset member)
+  have fullTailWF : VLCtx.WF typeEnv Us.length
+      ((some (fv, (AddInductive.consumeTypeAnnotations source).fvarsList),
+        .vlam analyzer) :: full) :=
+    ⟨state.fullWF,
+      fun _ _ equality => by
+        cases equality
+        exact ⟨freshFull, depsSubset⟩,
+      ⟨rawLevel, analyzerType⟩⟩
+  have viewTailWF : VLCtx.WF typeEnv Us.length
+      ((some (fv, (AddInductive.consumeTypeAnnotations source).fvarsList),
+        .vlam (analyzer.lift' viewLift)) :: postViewContext) :=
+    ⟨state.viewWF,
+      fun _ _ equality => by
+        cases equality
+        exact ⟨freshView, depsSubsetView⟩,
+      ⟨rawLevel, analyzerAtViewType⟩⟩
+  exact ⟨analyzerType, {
+    fullWF := fullTailWF
+    postWF := postTailWF
+    viewWF := viewTailWF
+    viewDefEq := .cons_fvar state.viewDefEq (.vlam analyzerConsumed)
+    viewExtension := state.viewExtension.cons_fvar
+      (fv, (AddInductive.consumeTypeAnnotations source).fvarsList)
+      (.vlam analyzer) depsSubset }⟩
+
+theorem ordinaryField_baseTypes
+    {env typeEnv : VEnv} {Us : List Name}
+    {base actual view postActual : VLCtx} {source : Expr}
+    {source' actual' postRaw' postView' : VExpr}
+    {fieldLevel rawLevel resultLevel : VLevel} {n : Lift}
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    (baseWF : VLCtx.WF env Us.length base)
+    (actualWF : VLCtx.WF env Us.length actual)
+    (postWF : VLCtx.WF typeEnv Us.length postActual)
+    (postRelation : VLCtx.IsDefEqFVars typeEnv Us.length actual postActual)
+    (viewDefEq : VLCtx.IsDefEq env Us.length actual view)
+    (viewUnique : TrExprS.IsUniqueCtx actual view)
+    (viewLift : VLCtx.FVLift' base view 0 n 0)
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ base.fvars) source)
+    (sourceTr : TrExprS typeEnv Us base source source')
+    (actualTr : TrExprS env Us actual source actual')
+    (actualType : env.HasType Us.length actual.toCtx actual'
+      (.sort fieldLevel))
+    (postViewTr : TrExprS typeEnv Us postActual source postView')
+    (postRawType : typeEnv.HasType Us.length postActual.toCtx postRaw'
+      (.sort rawLevel))
+    (postRawView : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw' postView')
+    (rawBound : resultLevel = .zero ∨ rawLevel ≤ resultLevel) :
+    env.HasType Us.length base.toCtx source' (.sort fieldLevel) ∧
+      fieldLevel ≈ rawLevel ∧
+      (resultLevel = .zero ∨ fieldLevel ≤ resultLevel) := by
+  have baseField := ensureTypeRun_baseType henv
+    typeEnvWF.ordered addType baseWF viewDefEq viewUnique viewLift
+    sourceUnique sourceClosed sourceFVars sourceTr actualTr actualType
+  have postViewType : typeEnv.HasType Us.length postActual.toCtx postView'
+      (.sort rawLevel) :=
+    postRawType.defeqU_l typeEnvWF postWF.toCtx postRawView
+  have postViewTypeAtActual : typeEnv.HasType Us.length actual.toCtx
+      postView' (.sort rawLevel) :=
+    postViewType.defeqDFC typeEnvWF.ordered
+      (postRelation.defeqCtx.symm typeEnvWF.ordered)
+  have translatedDefEq : typeEnv.IsDefEqU Us.length actual.toCtx
+      actual' postView' :=
+    (actualTr.mono addType).uniqFVars typeEnvWF postRelation
+      (actualWF.mono addType) postViewTr
+  have actualRawType : typeEnv.HasType Us.length actual.toCtx actual'
+      (.sort rawLevel) :=
+    (translatedDefEq.of_r typeEnvWF (actualWF.mono addType).toCtx
+      postViewTypeAtActual).hasType.1
+  have baseRaw := ensureTypeRun_baseType_mono typeEnvWF addType baseWF
+    viewDefEq viewUnique viewLift sourceUnique sourceClosed sourceFVars
+    sourceTr actualTr actualRawType
+  have levelEq : fieldLevel ≈ rawLevel :=
+    (baseField.mono addType).uniqU typeEnvWF (baseWF.mono addType).toCtx
+      baseRaw |>.sort_inv typeEnvWF (baseWF.mono addType).toCtx
+  refine ⟨baseField, levelEq, ?_⟩
+  rcases rawBound with prop | bound
+  · exact .inl prop
+  · exact .inr (VLevel.le_trans
+      (VLevel.le_antisymm_iff.mp levelEq).1 bound)
+
+theorem ordinaryConsumed_defeq
+    {env typeEnv : VEnv} {Us : List Name}
+    {actual postActual : VLCtx} {source _rawSource _rawConsumed _sourceConsumed : Expr}
+    {actualSource' actualConsumed' postRaw' postView' postConsumed' : VExpr}
+    (typeEnvWF : VEnv.WF typeEnv) (addType : env ≤ typeEnv)
+    (actualWF : VLCtx.WF env Us.length actual)
+    (relation : VLCtx.IsDefEqFVars typeEnv Us.length actual postActual)
+    (actualSourceTr : TrExprS env Us actual source actualSource')
+    (actualAnnotations : env.IsDefEqU Us.length actual.toCtx
+      actualSource' actualConsumed')
+    (actualConsumedType : env.IsType Us.length actual.toCtx actualConsumed')
+    (postViewTr : TrExprS typeEnv Us postActual source postView')
+    (postRawView : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw' postView')
+    (postAnnotations : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw' postConsumed') :
+    ∃ level, typeEnv.IsDefEq Us.length actual.toCtx
+      actualConsumed' postConsumed' (.sort level) := by
+  have actualWF' := actualWF.mono addType
+  have sourceEq : typeEnv.IsDefEqU Us.length actual.toCtx
+      actualSource' postView' :=
+    (actualSourceTr.mono addType).uniqFVars typeEnvWF relation actualWF'
+      postViewTr
+  have postToActual := relation.defeqCtx.symm typeEnvWF.ordered
+  have rawView := postRawView.defeqDFC typeEnvWF.ordered postToActual
+  have rawConsumed := postAnnotations.defeqDFC typeEnvWF.ordered postToActual
+  have consumedEq := (actualAnnotations.mono addType).symm.trans typeEnvWF
+    actualWF'.toCtx (sourceEq.trans typeEnvWF actualWF'.toCtx
+      (rawView.symm.trans typeEnvWF actualWF'.toCtx rawConsumed))
+  obtain ⟨level, consumedType⟩ := actualConsumedType
+  exact ⟨level, consumedEq.of_l typeEnvWF actualWF'.toCtx
+    (consumedType.mono addType)⟩
+
+/-- The terminal kernel sort retained by a candidate recursion translates to
+the exact terminal Theory sort exposed by its analyzer-owned view telescope. -/
+theorem CandidateExprRun.terminalLevel_tr
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {context : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace context source' view' inferred')
+    {resultLevel : Level} {resultLevel' : VLevel} {binders : List VExpr}
+    (terminal : trace.terminalResult = .sort resultLevel)
+    (viewEq : view' = VExpr.forallN binders (.sort resultLevel'))
+    (lengthEq : trace.spineLength = binders.length) :
+    VLevel.ofLevel Us resultLevel = some resultLevel' := by
+  induction run generalizing binders with
+  | terminal node =>
+      simp only [AddInductive.CandidateExprTrace.spineLength] at lengthEq
+      have bindersEq : binders = [] := List.eq_nil_of_length_eq_zero
+        lengthEq.symm
+      subst binders
+      simp only [VExpr.forallN] at viewEq
+      simp only [AddInductive.CandidateExprTrace.terminalResult] at terminal
+      rw [terminal, viewEq] at node
+      cases node.whnf.rhs_tr with
+      | sort levelTr => exact levelTr
+  | @forallE domain candidateContext name binderInfo context source inferred
+      body source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyContext storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate bodyCandidate
+      node domainRun annotationsRun bodyRun domainType bodyType bodySource
+      bodyContextEq domainIH bodyIH =>
+      simp only [AddInductive.CandidateExprTrace.spineLength] at lengthEq
+      cases binders with
+      | nil => simp at lengthEq
+      | cons binder binders =>
+          simp only [VExpr.forallN, VExpr.forallE.injEq] at viewEq
+          obtain ⟨_, bodyViewEq⟩ := viewEq
+          apply bodyIH terminal bodyViewEq
+          simpa only [List.length_cons] using Nat.succ.inj lengthEq
+
+end ConstructorValidation
+
+
+namespace ConstructorValidation
+open AddInductive TypeChecker
+-- `VEnv` here resolves to these two namespaces; `_root_.Ix.Theory.Named.VEnv` is
+-- shadowed by the enclosing namespace, so name both explicitly.
+open _root_.Ix.Theory.Named.ConstructorValidation.VEnv _root_.Ix.Theory.Named.TypeChecker.VEnv
+
+/-- Every full-context free variable not deliberately omitted by D3 is still
+present in the family-free common context. -/
+def FullRemovedInvariant (common full : VLCtx)
+    (removed : List FVarId) : Prop :=
+  ∀ fv, fv ∈ full.fvars → fv ∉ removed → fv ∈ common.fvars
+
+theorem FullRemovedInvariant.push
+    (invariant : FullRemovedInvariant common full removed) :
+    FullRemovedInvariant
+      ((some (fv, commonDeps), commonDomain) :: common)
+      ((some (fv, fullDeps), fullDomain) :: full) removed := by
+  intro candidate present notRemoved
+  simp only [VLCtx.fvars_cons_some, List.mem_cons] at present ⊢
+  rcases present with rfl | present
+  · exact .inl rfl
+  · exact .inr (invariant candidate present notRemoved)
+
+theorem FullRemovedInvariant.skip
+    (invariant : FullRemovedInvariant common full removed)
+    (fresh : fv ∉ full.fvars) :
+    FullRemovedInvariant common
+      ((some (fv, fullDeps), fullDomain) :: full) (fv :: removed) := by
+  intro candidate present notRemoved
+  simp only [VLCtx.fvars_cons_some, List.mem_cons] at present
+  rcases present with rfl | present
+  · exact (notRemoved (by simp)).elim
+  · exact invariant candidate present (fun old => notRemoved (by simp [old]))
+
+theorem Context.freshFVarId_eq_of_ngen_eq
+    {left right : AddInductive.Context}
+    (equal : left.ngen = right.ngen) :
+    left.freshFVarId = right.freshFVarId := by
+  simp only [AddInductive.Context.freshFVarId, equal]
+
+theorem Context.push_advance_ngen_eq
+    {left right : AddInductive.Context}
+    (equal : left.ngen = right.ngen) :
+    (left.pushLocalDecl name binderInfo domain).ngen =
+      right.advanceFresh.ngen := by
+  simp only [AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.advanceFresh, equal]
+
+theorem ordinaryConsumed_defeqAt
+    {env typeEnv : VEnv} {Us : List Name}
+    {actual postActual : VLCtx} {source : Expr}
+    {actualSource' actualConsumed' postRaw' postView' postConsumed' : VExpr}
+    {consumedLevel : VLevel}
+    (typeEnvWF : VEnv.WF typeEnv) (addType : env ≤ typeEnv)
+    (actualWF : VLCtx.WF env Us.length actual)
+    (relation : VLCtx.IsDefEqFVars typeEnv Us.length actual postActual)
+    (actualSourceTr : TrExprS env Us actual source actualSource')
+    (actualAnnotations : env.IsDefEqU Us.length actual.toCtx
+      actualSource' actualConsumed')
+    (actualConsumedType : env.HasType Us.length actual.toCtx actualConsumed'
+      (.sort consumedLevel))
+    (postViewTr : TrExprS typeEnv Us postActual source postView')
+    (postRawView : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw' postView')
+    (postAnnotations : typeEnv.IsDefEqU Us.length postActual.toCtx
+      postRaw' postConsumed') :
+    typeEnv.IsDefEq Us.length actual.toCtx
+      actualConsumed' postConsumed' (.sort consumedLevel) := by
+  have actualWF' := actualWF.mono addType
+  have sourceEq : typeEnv.IsDefEqU Us.length actual.toCtx
+      actualSource' postView' :=
+    (actualSourceTr.mono addType).uniqFVars typeEnvWF relation actualWF'
+      postViewTr
+  have postToActual := relation.defeqCtx.symm typeEnvWF.ordered
+  have rawView := postRawView.defeqDFC typeEnvWF.ordered postToActual
+  have rawConsumed := postAnnotations.defeqDFC typeEnvWF.ordered postToActual
+  have consumedEq := (actualAnnotations.mono addType).symm.trans typeEnvWF
+    actualWF'.toCtx (sourceEq.trans typeEnvWF actualWF'.toCtx
+      (rawView.symm.trans typeEnvWF actualWF'.toCtx rawConsumed))
+  exact consumedEq.of_l typeEnvWF actualWF'.toCtx
+    (actualConsumedType.mono addType)
+
+theorem ConstructorUniverseTrace.bound
+    {stats : AddInductive.InductiveStats}
+    {sortResult : Expr}
+    (trace : AddInductive.ConstructorUniverseTrace stats.resultLevel
+      sortResult.sortLevel!)
+    (valid : trace.semantic = true)
+    (resultLevelTr : VLevel.ofLevel Us stats.resultLevel = some resultLevel)
+    (ensureTypeRun : TypeChecker.EnsureTypeRun typeEnv Us postContext
+      source sortResult source') :
+    resultLevel = .zero ∨ ensureTypeRun.resultLevel' ≤ resultLevel := by
+  apply AddInductive.constructorUniverseSemanticGe_ofLevel valid resultLevelTr
+  have sortLevelEq : sortResult.sortLevel! = ensureTypeRun.resultLevel := by
+    simpa only [Expr.sortLevel!] using
+      congrArg Expr.sortLevel! ensureTypeRun.result_eq
+  rw [sortLevelEq]
+  exact ensureTypeRun.resultLevel_tr
+
+/-- D3's terminal index replay transported to the analyzer's exact full
+context and exact translated result target. -/
+theorem terminal_exactAnalyzer
+    {env typeEnv : VEnv} {Us : List Name}
+    {stats : AddInductive.InductiveStats} {familyIdx : Nat}
+    {familyIndices : Expr} {context : AddInductive.Context}
+    {contextRun : AddInductive.ConstructorContextRun env Us context}
+    {source : Expr}
+    {valid : AddInductive.isValidIndAppIdx stats source familyIdx = true}
+    {spineTrace : AddInductive.ConstructorPreFamilyIndexSpineTrace context
+      familyIndices (source.getAppArgs.toList.drop stats.params.size)}
+    {expected' : VExpr}
+    (spine : AddInductive.ConstructorPreFamilyIndexSpineSemanticRun env Us
+      context contextRun spineTrace expected')
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {common full view : VLCtx} {fullLift viewLift : Lift}
+    (state : D3FullContextState env typeEnv Us context common full
+      contextRun.candidate.context.vlctx view fullLift viewLift)
+    {commonIndices : List VExpr} {familyTarget resultTarget : VExpr}
+    {level : VLevel} {familyName : Name} {familyLevels : List Level}
+    (familyCommonTr : TrExprS env Us common familyIndices
+      (VExpr.forallN commonIndices (.sort level)))
+    (familyFullTr : TrExprS typeEnv Us full familyIndices familyTarget)
+    (familyUnique : TrExprS.IsUnique familyIndices)
+    (indexLength : commonIndices.length = stats.nindices[familyIdx]!)
+    (familyHead : stats.indConsts[familyIdx]! =
+      .const familyName familyLevels)
+    (sourceUnique : TrExprS.IsUnique source)
+    (sourceClosed : Closed source)
+    (sourceFVars : FVarsIn (· ∈ common.fvars) source)
+    (fullTr : TrExprS typeEnv Us full source resultTarget) :
+    env.SpineWF Us.length full.toCtx familyTarget
+      (VInductDecl.recFieldIdxs stats.params.size resultTarget)
+      (.sort level) := by
+  have argumentClosed : ∀ argument ∈
+      source.getAppArgs.toList.drop stats.params.size,
+      Closed argument := by
+    intro argument member
+    apply Closed.getAppArgsList sourceClosed
+    rw [← Expr.getAppArgs_toList]
+    exact List.mem_of_mem_drop member
+  have argumentFVars : ∀ argument ∈
+      source.getAppArgs.toList.drop stats.params.size,
+      FVarsIn (· ∈ common.fvars) argument := by
+    intro argument member
+    apply FVarsIn.getAppArgsList sourceFVars
+    rw [← Expr.getAppArgs_toList]
+    exact List.mem_of_mem_drop member
+  have argumentUnique : ∀ argument ∈
+      source.getAppArgs.toList.drop stats.params.size,
+      TrExprS.IsUnique argument := by
+    intro argument member
+    apply TrExprS.IsUnique.getAppArgsList sourceUnique
+    rw [← Expr.getAppArgs_toList]
+    exact List.mem_of_mem_drop member
+  have argumentLength :
+      (source.getAppArgs.toList.drop stats.params.size).length =
+        commonIndices.length :=
+    (isValidIndAppIdx_indexArgs_length valid).trans indexLength.symm
+  obtain ⟨baseIndices, baseIndicesTr, baseSpine⟩ :=
+    ConstructorPreFamilyIndexSpineSemanticRun.baseSpine_lift
+      spine familyCommonTr familyUnique state.viewDefEq state.viewUnique
+      state.viewExtension argumentClosed argumentFVars argumentUnique
+      argumentLength
+  have commonFamilyAtFull : TrExprS typeEnv Us full familyIndices
+      ((VExpr.forallN commonIndices (.sort level)).lift' fullLift) := by
+    simpa using (familyCommonTr.mono addType).weakFV'
+      typeEnvWF.ordered state.fullExtension state.fullWF
+  have familyEq : familyTarget =
+      (VExpr.forallN commonIndices (.sort level)).lift' fullLift :=
+    familyFullTr.unique familyUnique commonFamilyAtFull
+  have shape := isValidIndAppIdx_shape valid
+  have sourceHead : source.getAppFn = .const familyName familyLevels := by
+    rw [familyHead] at shape
+    change source.getAppFn.eqv (.const familyName familyLevels) = true ∧ _
+      at shape
+    rw [Expr.eqv_eq] at shape
+    generalize headEq : source.getAppFn = head at shape
+    cases head <;> simp_all [Expr.eqv']
+  obtain ⟨targetLevels, targetHead, allArgumentsTr⟩ :=
+    TrExprS.constApp_components fullTr sourceHead
+  have droppedArgumentsTr :=
+    forall₂_drop allArgumentsTr stats.params.size
+  have baseIndicesAtFull : List.Forall₂ (TrExprS typeEnv Us full)
+      (source.getAppArgsList.drop stats.params.size)
+      (baseIndices.map fun index => index.lift' fullLift) := by
+    have baseMono := forall₂_tr_mono addType baseIndicesTr
+    have baseWeak := forall₂_tr_weakFV' typeEnvWF.ordered
+      state.fullExtension state.fullWF baseMono
+    simpa only [Expr.getAppArgs_toList] using baseWeak
+  have translatedIndicesEq :
+      (VExpr.appArgs resultTarget []).drop stats.params.size =
+        baseIndices.map fun index => index.lift' fullLift :=
+    forall₂_translation_unique droppedArgumentsTr baseIndicesAtFull
+      (fun argument member =>
+        TrExprS.IsUnique.getAppArgsList sourceUnique argument
+          (List.mem_of_mem_drop member))
+  have fullSpine : env.SpineWF Us.length full.toCtx
+      ((VExpr.forallN commonIndices (.sort level)).lift' fullLift)
+      (baseIndices.map fun index => index.lift' fullLift) (.sort level) := by
+    simpa using VEnv.SpineWF.weak' henv.ordered
+      state.fullExtension.toCtx baseSpine
+  rw [← familyEq, ← translatedIndicesEq] at fullSpine
+  simpa only [VInductDecl.recFieldIdxs] using fullSpine
+
+def ConstructorFieldsRunResult
+    (env : VEnv) (Us : List Name) (full : VLCtx)
+    (familyTarget : VExpr) (level : VLevel) (familyName : Name)
+    (parameters : Nat) (familyIndices fields : List VExpr)
+    (fieldIndex : Nat) (resultTarget : VExpr) : Prop :=
+  VInductDecl.fieldsWF Us.length familyName parameters env level familyIndices
+      full.toCtx fieldIndex fields ∧
+    env.SpineWF Us.length (fields.reverse ++ full.toCtx)
+      (familyTarget.liftN fields.length 0)
+      (VInductDecl.recFieldIdxs parameters resultTarget) (.sort level)
+
+/-- Synchronize the exact D3 family-free replay with D2's analyzer-owned
+constructor view, deriving every field judgment and the terminal index spine. -/
+theorem constructorFields_exactAnalyzer
+    {env typeEnv : VEnv} {Us : List Name}
+    {stats : AddInductive.InductiveStats} {familyIdx : Nat}
+    {familyIndices : Expr}
+    {d3Context d2Context : AddInductive.Context}
+    {d3ContextRun : AddInductive.ConstructorContextRun env Us d3Context}
+    {d2ContextRun : AddInductive.ConstructorContextRun typeEnv Us d2Context}
+    {view : Expr} {argIdx : Nat} {removed : List FVarId}
+    {recursiveStarted : Bool}
+    {d3Trace : AddInductive.ConstructorPreFamilyViewTrace stats familyIdx
+      familyIndices d3Context view argIdx removed recursiveStarted}
+    (d3 : AddInductive.ConstructorPreFamilyViewSemanticRun env Us stats
+      familyIdx familyIndices d3ContextRun d3Trace)
+    {isUnsafe : Bool} {ctorName : Name} {rawSource : Expr}
+    {d2Fuel whnfFuel : Nat}
+    {d2Trace : AddInductive.ConstructorTypeValidationTrace stats isUnsafe
+      familyIdx ctorName d2Context rawSource argIdx d2Fuel}
+    (d2Alignment : AddInductive.ConstructorViewAlignmentTrace d2Trace view)
+    (d2 : AddInductive.ConstructorViewSemanticRun typeEnv Us whnfFuel
+      d2ContextRun d2Trace view)
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {common full d3ViewContext analyzerViewContext : VLCtx}
+    {fullLift viewLift analyzerViewLift : Lift}
+    (d3State : D3FullContextState env typeEnv Us d3Context common full
+      d3ContextRun.candidate.context.vlctx d3ViewContext fullLift viewLift)
+    (analyzerState : AnalyzerPostContextState typeEnv Us full
+      d2ContextRun.candidate.context.vlctx analyzerViewContext
+      analyzerViewLift)
+    (removedInvariant : FullRemovedInvariant common full removed)
+    (ngenEq : d3Context.ngen = d2Context.ngen)
+    {commonIndices checkedIndices fields : List VExpr}
+    {familyTarget resultTarget : VExpr} {level : VLevel}
+    {familyName : Name} {familyLevels : List Level}
+    (familyCommonTr : TrExprS env Us common familyIndices
+      (VExpr.forallN commonIndices (.sort level)))
+    (familyFullTr : TrExprS typeEnv Us full familyIndices familyTarget)
+    (familyUnique : TrExprS.IsUnique familyIndices)
+    (indexLength : commonIndices.length = stats.nindices[familyIdx]!)
+    (familyHead : stats.indConsts[familyIdx]! =
+      .const familyName familyLevels)
+    (familyTargetEq : familyTarget =
+      VExpr.forallN (VExpr.liftTelN fieldIndex checkedIndices 0)
+        (.sort level))
+    (resultNotForall : ∀ domain body, resultTarget ≠ .forallE domain body)
+    (resultLevelTr : VLevel.ofLevel Us stats.resultLevel = some level)
+    (absent : env.constants familyName = none)
+    (sourceUnique : TrExprS.IsUnique view)
+    (sourceClosed : Closed view)
+    (wholeTr : TrExprS typeEnv Us full view
+      (VExpr.forallN fields resultTarget))
+    (parametersDone : stats.params.size ≤ argIdx)
+    (universeSemantics : d2Trace.universeSemantics = true)
+    (stageFields : ∀ q field, fields[q]? = some field →
+      VInductDecl.stage3Field Us.length familyName stats.params.size
+        checkedIndices.length (fieldIndex + q) field = true) :
+    ConstructorFieldsRunResult env Us full familyTarget level familyName
+      stats.params.size checkedIndices fields fieldIndex resultTarget := by
+  induction d3 generalizing d2Context d2ContextRun rawSource d2Fuel
+      common full d3ViewContext fullLift viewLift commonIndices familyTarget
+      analyzerViewContext analyzerViewLift fields fieldIndex with
+  | @parameter context parameterArgIdx removed recursiveStarted name domain
+      body binderInfo parameter parameterAt tailTrace contextRun tail ih =>
+      have parameterLt : parameterArgIdx < stats.params.size := by
+        exact Array.getElem?_eq_some_iff.mp parameterAt |>.1
+      omega
+  | @ordinary context ordinaryArgIdx removed recursiveStarted name domain body
+      binderInfo noParameter nonrecursive independent domainCheck ensureType
+      consumedCheck annotations fresh tailTrace contextRun domainRun
+      consumedRun ensureTypeRun annotationsRun consumedType tail ih =>
+      cases d2 with
+      | @parameter _ _ _ _ d2Context d2Fuel ordinaryArgIdx name₂
+          rawDomain rawBody
+          binderInfo₂ parameter parameterType parameterAt parameterTypeGet
+          validationDefEq d2TailTrace viewName viewDomain viewBody
+          viewBinderInfo domainCheck₂ viewDomainCheck₂ parameterTypeCheck
+          d2ContextRun domainRun₂ viewDomainRun₂ parameterTypeSemantic
+          validationRun tail₂ =>
+          rw [noParameter] at parameterAt
+          contradiction
+      | @ordinary _ _ _ _ d2Context d2Fuel ordinaryArgIdx name₂
+          rawDomain rawBody
+          binderInfo₂ sortResult noParameter₂ ensureTypeStep universeTrace
+          positivityTrace d2TailTrace viewName viewDomain viewBody
+          viewBinderInfo domainCheck₂ viewDomainCheck₂ viewEquality
+          consumedCheck₂ fresh₂ d2ContextRun domainRun₂ viewDomainRun₂
+          viewEqualityRun₂
+          consumedRun₂ ensureTypeRun₂ positivity₂ annotationsRun₂
+          consumedType₂ tail₂ =>
+          cases d2Alignment with
+          | ordinary _ _ _ _ _ positivityAlignment _ _ _ tailAlignment =>
+              obtain ⟨fieldTarget, bodyTarget, targetEq, fieldType,
+                  bodyType, fieldTr, bodyTr⟩ :=
+                TrExprS.forallE_components wholeTr
+              cases fields with
+              | nil =>
+                  exact (resultNotForall fieldTarget bodyTarget targetEq).elim
+              | cons field fields =>
+                  simp only [VExpr.forallN, VExpr.forallE.injEq] at targetEq
+                  obtain ⟨rfl, rfl⟩ := targetEq
+                  have actualFieldTr : TrExprS env Us
+                      contextRun.candidate.context.vlctx domain
+                      domainRun.source' := by
+                    simpa only [contextRun.venv_eq, contextRun.lparams_eq]
+                      using domainRun.check.expr_tr
+                  have actualFieldType : env.HasType Us.length
+                      contextRun.candidate.context.vlctx.toCtx
+                      domainRun.source' (.sort ensureTypeRun.resultLevel') := by
+                    simpa only [contextRun.venv_eq, contextRun.lparams_eq]
+                      using ensureTypeRun.source_type
+                  have actualAnnotations : env.IsDefEqU Us.length
+                      contextRun.candidate.context.vlctx.toCtx
+                      domainRun.source' consumedRun.source' := by
+                    simpa only [contextRun.venv_eq, contextRun.lparams_eq]
+                      using annotationsRun.isDefEqU
+                  obtain ⟨consumedLevel, actualConsumedType⟩ := consumedType
+                  have actualConsumedType' : env.HasType Us.length
+                      contextRun.candidate.context.vlctx.toCtx
+                      consumedRun.source' (.sort consumedLevel) := by
+                    simpa only [contextRun.venv_eq, contextRun.lparams_eq]
+                      using actualConsumedType
+                  let nextD3ContextRun := contextRun.pushLocalDecl name
+                    binderInfo (consumeTypeAnnotations domain) fresh
+                    consumedRun.source' consumedRun.check.expr_tr
+                    ⟨consumedLevel, actualConsumedType⟩
+                  have actualTailWF : VLCtx.WF env Us.length
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam consumedRun.source') ::
+                        contextRun.candidate.context.vlctx) := by
+                    have nextWF := nextD3ContextRun.candidate.context.Δwf
+                    rw [nextD3ContextRun.venv_eq,
+                      nextD3ContextRun.lparams_eq] at nextWF
+                    exact nextWF
+                  have postViewTr : TrExprS typeEnv Us
+                      d2ContextRun.candidate.context.vlctx domain
+                      viewDomainRun₂.source' := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using
+                      viewDomainRun₂.check.expr_tr
+                  have postRawType : typeEnv.HasType Us.length
+                      d2ContextRun.candidate.context.vlctx.toCtx
+                      domainRun₂.source' (.sort ensureTypeRun₂.resultLevel') := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using ensureTypeRun₂.source_type
+                  have postRawView : typeEnv.IsDefEqU Us.length
+                      d2ContextRun.candidate.context.vlctx.toCtx
+                      domainRun₂.source' viewDomainRun₂.source' := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using
+                      viewEqualityRun₂.isDefEqU
+                  have postAnnotations : typeEnv.IsDefEqU Us.length
+                      d2ContextRun.candidate.context.vlctx.toCtx
+                      domainRun₂.source' consumedRun₂.source' := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using
+                      annotationsRun₂.isDefEqU
+                  let nextD2ContextRun := d2ContextRun.pushLocalDecl name₂
+                    binderInfo₂ (consumeTypeAnnotations rawDomain) fresh₂
+                    consumedRun₂.source' consumedRun₂.check.expr_tr
+                    consumedType₂
+                  have postTailWF : VLCtx.WF typeEnv Us.length
+                      ((some (d2Context.freshFVarId,
+                          (consumeTypeAnnotations rawDomain).fvarsList),
+                        .vlam consumedRun₂.source') ::
+                        d2ContextRun.candidate.context.vlctx) := by
+                    have nextWF := nextD2ContextRun.candidate.context.Δwf
+                    rw [nextD2ContextRun.venv_eq,
+                      nextD2ContextRun.lparams_eq] at nextWF
+                    simpa only [nextD2ContextRun,
+                      AddInductive.ConstructorContextRun.pushLocalDecl,
+                      CandidateContextRun.pushLocalDecl_vlctx] using nextWF
+                  simp only [AddInductive.ConstructorTypeValidationTrace.universeSemantics,
+                    Bool.and_eq_true] at universeSemantics
+                  have sortLevelEq : sortResult.sortLevel! =
+                      ensureTypeRun₂.resultLevel := by
+                    simpa only [Expr.sortLevel!] using
+                      congrArg Expr.sortLevel! ensureTypeRun₂.result_eq
+                  have fieldLevelTr : VLevel.ofLevel Us
+                      sortResult.sortLevel! =
+                        some ensureTypeRun₂.resultLevel' := by
+                    rw [sortLevelEq]
+                    simpa only [d2ContextRun.lparams_eq] using
+                      ensureTypeRun₂.resultLevel_tr
+                  have rawBound :=
+                    AddInductive.constructorUniverseSemanticGe_ofLevel
+                      universeSemantics.1 resultLevelTr fieldLevelTr
+                  have freshEq : context.freshFVarId =
+                      d2Context.freshFVarId :=
+                    Context.freshFVarId_eq_of_ngen_eq ngenEq
+                  have domainFVars : FVarsIn (· ∈ common.fvars) domain :=
+                    constructorIndependentOf_fvars fieldTr.fvarsIn
+                      independent removedInvariant
+                  obtain ⟨commonDomain, commonDomainTr, fieldEq,
+                      commonDomainType, nextD3State⟩ :=
+                    d3State.push (name := name) (binderInfo := binderInfo)
+                      henv typeEnvWF addType sourceUnique.1
+                      sourceClosed.1 domainFVars fieldTr actualFieldTr
+                      actualFieldType actualAnnotations actualConsumedType'
+                      actualTailWF
+                  obtain ⟨postAnalyzerType, nextAnalyzerState⟩ :=
+                    analyzerState.push typeEnvWF sourceUnique.1 sourceClosed.1
+                      fieldTr postViewTr postRawType postRawView
+                      postAnnotations postTailWF
+                  have fieldBaseType : env.HasType Us.length full.toCtx field
+                      (.sort ensureTypeRun.resultLevel') := by
+                    rw [fieldEq]
+                    exact commonDomainType.weak' henv.ordered
+                      d3State.fullExtension.toCtx
+                  have levelEq : ensureTypeRun.resultLevel' ≈
+                      ensureTypeRun₂.resultLevel' :=
+                    (fieldBaseType.mono addType).uniqU typeEnvWF
+                      d3State.fullWF.toCtx postAnalyzerType |>.sort_inv
+                        typeEnvWF d3State.fullWF.toCtx
+                  have fieldBound : level = .zero ∨
+                      ensureTypeRun.resultLevel' ≤ level := by
+                    rcases rawBound with prop | bound
+                    · exact .inl prop
+                    · exact .inr <| VLevel.le_trans
+                        (VLevel.le_antisymm_iff.mp levelEq).1 bound
+                  have commonFree : commonDomain.hasConst familyName = false :=
+                    VEnv.HasType.hasConst_false_of_absent henv.ordered
+                      d3State.commonWF.toCtx absent commonDomainType
+                  have fieldFree : field.hasConst familyName = false := by
+                    rw [fieldEq, VExpr.hasConst_lift']
+                    exact commonFree
+                  have recNone := recArg?_eq_none_of_hasConst_false
+                    (U := Us.length) (np := stats.params.size)
+                    (ni := checkedIndices.length) (fieldIndex := fieldIndex)
+                    fieldFree
+                  have nextD3State' : D3FullContextState env typeEnv Us
+                      (context.pushLocalDecl name binderInfo
+                        (consumeTypeAnnotations domain))
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam commonDomain) :: common)
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      nextD3ContextRun.candidate.context.vlctx
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam (commonDomain.lift' viewLift)) :: d3ViewContext)
+                      (.consN fullLift 1) (.consN viewLift 1) := by
+                    exact nextD3State
+                  have nextAnalyzerState' : AnalyzerPostContextState
+                      typeEnv Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      nextD2ContextRun.candidate.context.vlctx
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam (field.lift' analyzerViewLift)) ::
+                        analyzerViewContext)
+                      (.consN analyzerViewLift 1) := by
+                    rw [freshEq]
+                    simpa only [nextD2ContextRun,
+                      AddInductive.ConstructorContextRun.pushLocalDecl,
+                      CandidateContextRun.pushLocalDecl_vlctx] using
+                      nextAnalyzerState
+                  have familyCommonNext : TrExprS env Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam commonDomain) :: common)
+                      familyIndices
+                      (VExpr.forallN (VExpr.liftTelN 1 commonIndices 0)
+                        (.sort level)) := by
+                    have weakened := familyCommonTr.weakFV henv.ordered
+                      (VLCtx.FVLift.skip_fvar
+                        (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList)
+                        (.vlam commonDomain) .refl)
+                      nextD3State'.commonWF
+                    simpa [VLocalDecl.depth, VExpr.liftN_forallN,
+                      VExpr.liftN] using weakened
+                  have familyFullNext : TrExprS typeEnv Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      familyIndices (familyTarget.liftN 1 0) := by
+                    have weakened := familyFullTr.weakFV typeEnvWF.ordered
+                      (VLCtx.FVLift.skip_fvar
+                        (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList)
+                        (.vlam field) .refl)
+                      nextD3State'.fullWF
+                    simpa [VLocalDecl.depth] using weakened
+                  have bodyOpened : TrExprS typeEnv Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      (body.instantiate1 context.freshExpr)
+                      (VExpr.forallN fields resultTarget) := by
+                    simpa only [AddInductive.Context.freshExpr,
+                      Expr.instantiate1_eq] using
+                      bodyTr.inst_fvar typeEnvWF.ordered nextD3State'.fullWF
+                  have tailUnique : TrExprS.IsUnique
+                      (body.instantiate1 context.freshExpr) := by
+                    apply TrExprS.IsUnique.instantiate1 sourceUnique.2
+                    simp only [AddInductive.Context.freshExpr]
+                    trivial
+                  have nextFullNoBV :
+                      VLCtx.bvars (((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full) : VLCtx) = 0 :=
+                    nextD3State'.fullExtension.bvars_eq.trans
+                      nextD3State'.commonNoBV
+                  have tailClosed : Closed
+                      (body.instantiate1 context.freshExpr) := by
+                    have closed := bodyOpened.closed
+                    rw [nextFullNoBV] at closed
+                    exact closed
+                  have freshExprEq : d2Context.freshExpr =
+                      context.freshExpr := by
+                    simp only [AddInductive.Context.freshExpr, freshEq]
+                  have tailAlignment' : AddInductive.ConstructorViewAlignmentTrace
+                      d2TailTrace (body.instantiate1 context.freshExpr) := by
+                    rw [← freshExprEq]
+                    exact tailAlignment
+                  have tail₂' : AddInductive.ConstructorViewSemanticRun
+                      typeEnv Us whnfFuel nextD2ContextRun d2TailTrace
+                      (body.instantiate1 context.freshExpr) := by
+                    rw [← freshExprEq]
+                    exact tail₂
+                  have nextNgenEq :
+                      (context.pushLocalDecl name binderInfo
+                        (consumeTypeAnnotations domain)).ngen =
+                      (d2Context.pushLocalDecl name₂ binderInfo₂
+                        (consumeTypeAnnotations rawDomain)).ngen := by
+                    simp only [AddInductive.Context.pushLocalDecl, ngenEq]
+                  have nextIndexLength :
+                      (VExpr.liftTelN 1 commonIndices 0).length =
+                        stats.nindices[familyIdx]! := by
+                    simpa only [VExpr.liftTelN_length] using indexLength
+                  have familyTargetNextEq : familyTarget.liftN 1 0 =
+                      VExpr.forallN
+                        (VExpr.liftTelN (fieldIndex + 1) checkedIndices 0)
+                        (.sort level) := by
+                    rw [familyTargetEq, VExpr.liftN_forallN,
+                      VExpr.liftTelN_liftTelN]
+                    simp only [VExpr.liftN]
+                  have stageTail : ∀ q candidate,
+                      fields[q]? = some candidate →
+                      VInductDecl.stage3Field Us.length familyName
+                        stats.params.size checkedIndices.length
+                        (fieldIndex + 1 + q) candidate = true := by
+                    intro q candidate member
+                    have staged := stageFields (q + 1) candidate (by
+                      simpa using member)
+                    simpa only [Nat.add_assoc, Nat.add_comm 1 q] using staged
+                  obtain ⟨tailFields, tailSpine⟩ := ih
+                    (fieldIndex := fieldIndex + 1) tailAlignment' tail₂'
+                    nextD3State' nextAnalyzerState'
+                    (removedInvariant.push) nextNgenEq familyCommonNext
+                    familyFullNext nextIndexLength familyTargetNextEq
+                    tailUnique tailClosed bodyOpened (by omega)
+                    universeSemantics.2 stageTail
+                  unfold ConstructorFieldsRunResult
+                  refine ⟨⟨?_, ?_, ?_⟩, ?_⟩
+                  · exact .inr (.inr ⟨recNone, ensureTypeRun.resultLevel',
+                      fieldBaseType, fieldBound⟩)
+                  · intro recursive
+                    rw [VInductDecl.recArg?_of_isRecField recursive] at recNone
+                    contradiction
+                  · simpa only [VLCtx.toCtx] using tailFields
+                  · simpa only [List.reverse_cons, List.singleton_append,
+                      List.append_assoc, VLCtx.toCtx, List.length_cons,
+                      VExpr.liftN_liftN, Nat.add_comm] using tailSpine
+      | terminal sourceRun₂ viewRun₂ =>
+          cases d2Alignment; simp_all [Expr.isForall]
+  | @recursive context recursiveArgIdx removed recursiveStarted name domain
+      body binderInfo noParameter isRecursive independent fieldTrace fresh
+      tailTrace contextRun recursiveRun tail ih =>
+      cases d2 with
+      | @parameter _ _ _ _ d2Context d2Fuel recursiveArgIdx name₂
+          rawDomain rawBody binderInfo₂ parameter parameterType parameterAt
+          parameterTypeGet validationDefEq d2TailTrace viewName viewDomain
+          viewBody viewBinderInfo domainCheck₂ viewDomainCheck₂
+          parameterTypeCheck d2ContextRun domainRun₂ viewDomainRun₂
+          parameterTypeSemantic validationRun tail₂ =>
+          rw [noParameter] at parameterAt
+          contradiction
+      | @ordinary _ _ _ _ d2Context d2Fuel recursiveArgIdx name₂
+          rawDomain rawBody binderInfo₂ sortResult noParameter₂
+          ensureTypeStep universeTrace positivityTrace d2TailTrace viewName
+          viewDomain viewBody viewBinderInfo domainCheck₂ viewDomainCheck₂
+          viewEquality consumedCheck₂ fresh₂ d2ContextRun domainRun₂
+          viewDomainRun₂ viewEqualityRun₂ consumedRun₂ ensureTypeRun₂
+          positivity₂ annotationsRun₂ consumedType₂ tail₂ =>
+          cases d2Alignment with
+          | ordinary _ _ _ _ _ positivityAlignment _ _ _ tailAlignment =>
+              obtain ⟨fieldTarget, bodyTarget, targetEq, fieldType,
+                  bodyType, fieldTr, bodyTr⟩ :=
+                TrExprS.forallE_components wholeTr
+              cases fields with
+              | nil =>
+                  exact (resultNotForall fieldTarget bodyTarget targetEq).elim
+              | cons field fields =>
+                  simp only [VExpr.forallN, VExpr.forallE.injEq] at targetEq
+                  obtain ⟨rfl, rfl⟩ := targetEq
+                  have postViewTr : TrExprS typeEnv Us
+                      d2ContextRun.candidate.context.vlctx domain
+                      viewDomainRun₂.source' := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using
+                      viewDomainRun₂.check.expr_tr
+                  have postRawType : typeEnv.HasType Us.length
+                      d2ContextRun.candidate.context.vlctx.toCtx
+                      domainRun₂.source' (.sort ensureTypeRun₂.resultLevel') := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using ensureTypeRun₂.source_type
+                  have postRawView : typeEnv.IsDefEqU Us.length
+                      d2ContextRun.candidate.context.vlctx.toCtx
+                      domainRun₂.source' viewDomainRun₂.source' := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using
+                      viewEqualityRun₂.isDefEqU
+                  have postAnnotations : typeEnv.IsDefEqU Us.length
+                      d2ContextRun.candidate.context.vlctx.toCtx
+                      domainRun₂.source' consumedRun₂.source' := by
+                    simpa only [d2ContextRun.venv_eq,
+                      d2ContextRun.lparams_eq] using annotationsRun₂.isDefEqU
+                  let nextD2ContextRun := d2ContextRun.pushLocalDecl name₂
+                    binderInfo₂ (consumeTypeAnnotations rawDomain) fresh₂
+                    consumedRun₂.source' consumedRun₂.check.expr_tr
+                    consumedType₂
+                  have postTailWF : VLCtx.WF typeEnv Us.length
+                      ((some (d2Context.freshFVarId,
+                          (consumeTypeAnnotations rawDomain).fvarsList),
+                        .vlam consumedRun₂.source') ::
+                        d2ContextRun.candidate.context.vlctx) := by
+                    have nextWF := nextD2ContextRun.candidate.context.Δwf
+                    rw [nextD2ContextRun.venv_eq,
+                      nextD2ContextRun.lparams_eq] at nextWF
+                    simpa only [nextD2ContextRun,
+                      AddInductive.ConstructorContextRun.pushLocalDecl,
+                      CandidateContextRun.pushLocalDecl_vlctx] using nextWF
+                  simp only [
+                    AddInductive.ConstructorTypeValidationTrace.universeSemantics,
+                    Bool.and_eq_true] at universeSemantics
+                  have freshEq : context.freshFVarId =
+                      d2Context.freshFVarId :=
+                    Context.freshFVarId_eq_of_ngen_eq ngenEq
+                  obtain ⟨postAnalyzerType, nextAnalyzerState⟩ :=
+                    analyzerState.push typeEnvWF sourceUnique.1 sourceClosed.1
+                      fieldTr postViewTr postRawType postRawView
+                      postAnnotations postTailWF
+                  have nextAnalyzerState' : AnalyzerPostContextState
+                      typeEnv Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      nextD2ContextRun.candidate.context.vlctx
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam (field.lift' analyzerViewLift)) ::
+                        analyzerViewContext)
+                      (.consN analyzerViewLift 1) := by
+                    rw [freshEq]
+                    simpa only [nextD2ContextRun,
+                      AddInductive.ConstructorContextRun.pushLocalDecl,
+                      CandidateContextRun.pushLocalDecl_vlctx] using
+                      nextAnalyzerState
+                  have domainFVars : FVarsIn (· ∈ common.fvars) domain :=
+                    constructorIndependentOf_fvars fieldTr.fvarsIn
+                      independent removedInvariant
+                  have recursiveResult := recursiveField_exactAnalyzer
+                    recursiveRun henv typeEnvWF addType d3State
+                    familyCommonTr familyFullTr familyUnique indexLength
+                    familyHead sourceUnique.1 sourceClosed.1 domainFVars fieldTr
+                  have stageHead : VInductDecl.stage3Field Us.length
+                      familyName stats.params.size checkedIndices.length
+                      fieldIndex field = true := by
+                    simpa using stageFields 0 field (by simp)
+                  obtain ⟨recursive, recursiveEq, recursiveWF⟩ :=
+                    recursiveFieldResult_recArgWF recursiveResult
+                      familyTargetEq stageHead
+                  have nextD3State : D3FullContextState env typeEnv Us
+                      context.advanceFresh common
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      contextRun.advanceFresh.candidate.context.vlctx
+                      d3ViewContext (.skipN fullLift 1) viewLift := by
+                    simpa only [AddInductive.ConstructorContextRun.advanceFresh,
+                      AddInductive.advanceCandidateContextRun] using
+                      d3State.skip (source := domain)
+                        nextAnalyzerState'.fullWF
+                  have familyFullNext : TrExprS typeEnv Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      familyIndices (familyTarget.liftN 1 0) := by
+                    have weakened := familyFullTr.weakFV typeEnvWF.ordered
+                      (VLCtx.FVLift.skip_fvar
+                        (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList)
+                        (.vlam field) .refl)
+                      nextD3State.fullWF
+                    simpa [VLocalDecl.depth] using weakened
+                  have bodyOpened : TrExprS typeEnv Us
+                      ((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full)
+                      (body.instantiate1 context.freshExpr)
+                      (VExpr.forallN fields resultTarget) := by
+                    simpa only [AddInductive.Context.freshExpr,
+                      Expr.instantiate1_eq] using
+                      bodyTr.inst_fvar typeEnvWF.ordered nextD3State.fullWF
+                  have tailUnique : TrExprS.IsUnique
+                      (body.instantiate1 context.freshExpr) := by
+                    apply TrExprS.IsUnique.instantiate1 sourceUnique.2
+                    simp only [AddInductive.Context.freshExpr]
+                    trivial
+                  have nextFullNoBV :
+                      VLCtx.bvars (((some (context.freshFVarId,
+                          (consumeTypeAnnotations domain).fvarsList),
+                        .vlam field) :: full) : VLCtx) = 0 :=
+                    nextD3State.fullExtension.bvars_eq.trans
+                      nextD3State.commonNoBV
+                  have tailClosed : Closed
+                      (body.instantiate1 context.freshExpr) := by
+                    have closed := bodyOpened.closed
+                    rw [nextFullNoBV] at closed
+                    exact closed
+                  have freshExprEq : d2Context.freshExpr =
+                      context.freshExpr := by
+                    simp only [AddInductive.Context.freshExpr, freshEq]
+                  have tailAlignment' : AddInductive.ConstructorViewAlignmentTrace
+                      d2TailTrace (body.instantiate1 context.freshExpr) := by
+                    rw [← freshExprEq]
+                    exact tailAlignment
+                  have tail₂' : AddInductive.ConstructorViewSemanticRun
+                      typeEnv Us whnfFuel nextD2ContextRun d2TailTrace
+                      (body.instantiate1 context.freshExpr) := by
+                    rw [← freshExprEq]
+                    exact tail₂
+                  have nextNgenEq : context.advanceFresh.ngen =
+                      (d2Context.pushLocalDecl name₂ binderInfo₂
+                        (consumeTypeAnnotations rawDomain)).ngen := by
+                    simp only [AddInductive.Context.advanceFresh,
+                      AddInductive.Context.pushLocalDecl, ngenEq]
+                  have freshFull : context.freshFVarId ∉ full.fvars :=
+                    (nextAnalyzerState'.fullWF.2.1 _ _ rfl).1
+                  have familyTargetNextEq : familyTarget.liftN 1 0 =
+                      VExpr.forallN
+                        (VExpr.liftTelN (fieldIndex + 1) checkedIndices 0)
+                        (.sort level) := by
+                    rw [familyTargetEq, VExpr.liftN_forallN,
+                      VExpr.liftTelN_liftTelN]
+                    simp only [VExpr.liftN]
+                  have stageTail : ∀ q candidate,
+                      fields[q]? = some candidate →
+                      VInductDecl.stage3Field Us.length familyName
+                        stats.params.size checkedIndices.length
+                        (fieldIndex + 1 + q) candidate = true := by
+                    intro q candidate member
+                    have staged := stageFields (q + 1) candidate (by
+                      simpa using member)
+                    simpa only [Nat.add_assoc, Nat.add_comm 1 q] using staged
+                  obtain ⟨tailFields, tailSpine⟩ := ih
+                    (fieldIndex := fieldIndex + 1) tailAlignment' tail₂'
+                    nextD3State nextAnalyzerState'
+                    (removedInvariant.skip freshFull) nextNgenEq
+                    familyCommonTr familyFullNext indexLength
+                    familyTargetNextEq tailUnique tailClosed bodyOpened
+                    (by omega) universeSemantics.2 stageTail
+                  have headClassification :
+                      VInductDecl.isRecField Us.length familyName
+                          stats.params.size checkedIndices.length fieldIndex
+                          field = true ∨
+                        (∃ descriptor,
+                          VInductDecl.recArg? Us.length familyName
+                              stats.params.size checkedIndices.length
+                              fieldIndex field = some descriptor ∧
+                            descriptor.binders ≠ [] ∧
+                            descriptor.WF Us.length env level checkedIndices
+                              full.toCtx) ∨
+                        VInductDecl.recArg? Us.length familyName
+                            stats.params.size checkedIndices.length fieldIndex
+                            field = none ∧
+                          ∃ fieldLevel,
+                            env.HasType Us.length full.toCtx field
+                                (.sort fieldLevel) ∧
+                              (level = .zero ∨ fieldLevel ≤ level) := by
+                    by_cases nonempty : recursive.binders ≠ []
+                    · exact .inr (.inl ⟨recursive, recursiveEq, nonempty,
+                        recursiveWF⟩)
+                    · have empty : recursive.binders = [] := by
+                        simpa using nonempty
+                      exact .inl
+                        (VInductDecl.recArg?_nil recursiveEq empty).1
+                  have headDirectSpine :
+                      VInductDecl.isRecField Us.length familyName
+                          stats.params.size checkedIndices.length fieldIndex
+                          field = true →
+                        env.SpineWF Us.length full.toCtx
+                          (VExpr.forallN
+                            (VExpr.liftTelN fieldIndex checkedIndices 0)
+                            (.sort level))
+                          (VInductDecl.recFieldIdxs stats.params.size field)
+                          (.sort level) := by
+                    intro direct
+                    have canonical :=
+                      VInductDecl.recArg?_of_isRecField direct
+                    have descriptorEq : recursive =
+                        { fieldIndex := fieldIndex, binders := [],
+                          targetType := 0,
+                          indices := VInductDecl.recFieldIdxs
+                            stats.params.size field } :=
+                      Option.some.inj (recursiveEq.symm.trans canonical)
+                    rw [descriptorEq] at recursiveWF
+                    simpa [VInductDecl.RecArg.WF] using recursiveWF.2
+                  unfold ConstructorFieldsRunResult
+                  refine ⟨⟨headClassification, headDirectSpine, ?_⟩, ?_⟩
+                  · simpa only [VLCtx.toCtx] using tailFields
+                  · simpa only [List.reverse_cons, List.singleton_append,
+                      List.append_assoc, VLCtx.toCtx, List.length_cons,
+                      VExpr.liftN_liftN, Nat.add_comm] using tailSpine
+      | terminal sourceRun₂ viewRun₂ =>
+          cases d2Alignment; simp_all [Expr.isForall]
+  | @terminal context source terminalArgIdx removed recursiveStarted valid
+      independent spineTrace contextRun expected spine =>
+      have shape := isValidIndAppIdx_shape valid
+      have sourceHead : source.getAppFn = .const familyName familyLevels := by
+        rw [familyHead] at shape
+        change source.getAppFn.eqv (.const familyName familyLevels) = true ∧ _
+          at shape
+        rw [Expr.eqv_eq] at shape
+        generalize headEq : source.getAppFn = head at shape
+        cases head <;> simp_all [Expr.eqv']
+      cases fields with
+      | nil =>
+          unfold ConstructorFieldsRunResult
+          refine ⟨trivial, ?_⟩
+          simpa using terminal_exactAnalyzer
+            (valid := valid) (resultTarget := resultTarget)
+            spine henv typeEnvWF addType d3State
+            familyCommonTr familyFullTr familyUnique indexLength familyHead
+            sourceUnique sourceClosed
+            (constructorIndependentOf_fvars wholeTr.fvarsIn independent
+              removedInvariant)
+            wholeTr
+      | cons field fields =>
+          cases wholeTr
+          all_goals simp_all [Expr.getAppFn]
+
+end ConstructorValidation
+
+namespace VInductDecl
+open AddInductive TypeChecker VEnv
+
+theorem stagedIndexCount_eq
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {kernelSource : InductiveType}
+    {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source)
+    (_analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    (input.postFamilyInput.universeInput.staged.family.validation.stats
+        ).nindices[0]! = generation.block.checked.indices.length := by
+  let validation := input.postFamilyInput.universeInput.staged.family.validation
+  have familyShape := shape
+  simp only [NormalizationCandidateSemanticRun.generationShape,
+    normalizationCandidateGenerationShape, Bool.and_eq_true,
+    beq_iff_eq] at familyShape
+  have spineLengthEq :
+      candidate.families.singleton.familyType.type.trace.spineLength =
+        (generation.block.checked.params ++
+          generation.block.checked.indices).length := by
+    calc
+      _ = (VExpr.telN source.nparams normalization.raw.type ++
+          ctorFields (VExpr.dropN source.nparams normalization.raw.type)).length :=
+        familyShape.1.2
+      _ = (generation.block.rawParams ++
+          generation.block.rawIndices).length := by
+        simp only [NormalizedChecked.rawParams, NormalizedChecked.rawIndices,
+          NormalizationCandidateSemanticRun.root,
+          normalization.root.sourceType_eq generation]
+      _ = (generation.block.checked.params ++
+          generation.block.checked.indices).length := by
+        simp only [List.length_append]
+        rw [generation.shape.2.1, generation.shape.2.2.1]
+  have parameterLength : generation.block.checked.params.length =
+      source.nparams :=
+    generation.block.checked.direct_anatomy.2.1.trans
+      generation.block.nparams_eq.symm
+  change validation.stats.nindices[0]! = _
+  rw [validation.stats_eq]
+  simp only [CandidateExprTrace.singletonCandidateInductiveStats]
+  rw [spineLengthEq, List.length_append, parameterLength,
+    input.postFamilyInput.universeInput.staged.validation_nparams_eq,
+    Nat.add_sub_cancel_left]
+  rfl
+
+theorem stagedResultLevel_tr
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {kernelSource : InductiveType}
+    {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    VLevel.ofLevel Us
+        input.postFamilyInput.universeInput.staged.family.validation.stats.resultLevel =
+      some generation.block.checked.resultLevel := by
+  let validation := input.postFamilyInput.universeInput.staged.family.validation
+  have familyShape := shape
+  simp only [NormalizationCandidateSemanticRun.generationShape,
+    normalizationCandidateGenerationShape, Bool.and_eq_true,
+    beq_iff_eq] at familyShape
+  have spineLengthEq :
+      candidate.families.singleton.familyType.type.trace.spineLength =
+        (generation.block.checked.params ++
+          generation.block.checked.indices).length := by
+    calc
+      _ = (VExpr.telN source.nparams normalization.raw.type ++
+          ctorFields (VExpr.dropN source.nparams normalization.raw.type)).length :=
+        familyShape.1.2
+      _ = (generation.block.rawParams ++
+          generation.block.rawIndices).length := by
+        simp only [NormalizedChecked.rawParams, NormalizedChecked.rawIndices,
+          NormalizationCandidateSemanticRun.root,
+          normalization.root.sourceType_eq generation]
+      _ = (generation.block.checked.params ++
+          generation.block.checked.indices).length := by
+        simp only [List.length_append]
+        rw [generation.shape.2.1, generation.shape.2.2.1]
+  have viewEq : normalization.family.type.view =
+      VExpr.forallN
+        (generation.block.checked.params ++ generation.block.checked.indices)
+        (.sort generation.block.checked.resultLevel) := by
+    have analyzerEq : normalization.family.type.view =
+        generation.block.checked.type.type :=
+      (congrArg (fun ty : VInductiveType => ty.type)
+        (normalization.root.familyViewType_eq analysis)).symm
+    rw [analyzerEq, generation.block.checked.type_eq,
+      VExpr.forallN_append]
+  obtain ⟨_, recursive⟩ := normalization.family.type.recursive
+  have levelTr := ConstructorValidation.CandidateExprRun.terminalLevel_tr recursive
+    validation.terminal_eq viewEq spineLengthEq
+  change VLevel.ofLevel Us validation.stats.resultLevel = _
+  rw [validation.stats_eq]
+  simpa only [CandidateExprTrace.singletonCandidateInductiveStats] using levelTr
+
+end VInductDecl
+
+namespace VInductDecl
+open AddInductive TypeChecker VEnv
+open ConstructorValidation
+
+/-- Derive the checked field and result-spine obligations for one exact
+analyzer-owned constructor position after consuming its parameter prefix. -/
+theorem CandidateSemanticNormalizedCtorRun.checkedConstructorWF
+    {env typeEnv : VEnv} {Us : List Name}
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {kernelCtor : Constructor}
+    {candidateCtor : AddInductive.CandidateConstructor kernelCtor}
+    {rawCtor : VConstVal}
+    {root : CandidateConstructorSemanticRun typeEnv Us candidateCtor rawCtor}
+    {ctor : NormalizedCtor}
+    {stats : InductiveStats} {familyIndices : Expr}
+    {d3Context d2Context : AddInductive.Context}
+    {d3ContextRun : AddInductive.ConstructorContextRun env Us d3Context}
+    {d2ContextRun : AddInductive.ConstructorContextRun typeEnv Us d2Context}
+    {d3Trace : AddInductive.ConstructorPreFamilyViewTrace stats 0
+      familyIndices d3Context candidateCtor.type.view 0 [] false}
+    (d3 : AddInductive.ConstructorPreFamilyViewSemanticRun env Us stats 0
+      familyIndices d3ContextRun d3Trace)
+    {d2Trace : AddInductive.ConstructorTypeValidationTrace stats false 0
+      kernelCtor.name d2Context kernelCtor.type 0 d2Context.fuel.inductiveFuel}
+    (d2Alignment : AddInductive.ConstructorViewAlignmentTrace d2Trace
+      candidateCtor.type.view)
+    (d2 : AddInductive.ConstructorViewSemanticRun typeEnv Us
+      root.type.whnfFuel d2ContextRun d2Trace candidateCtor.type.view)
+    (genRun : CandidateSemanticNormalizedCtorRun generation.block typeEnv Us
+      root ctor)
+    (hctor : ctor ∈ generation.block.ctorPairs)
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {parameterΔ d3ViewContext analyzerViewContext : VLCtx}
+    {viewLift analyzerViewLift : Lift}
+    {parameters : List Expr}
+    (parameterContext : CandidateParameterContext [] parameters
+      generation.block.checked.params parameterΔ)
+    (parameterWF : VLCtx.WF env Us.length parameterΔ)
+    (parameterCtx : parameterΔ.toCtx =
+      generation.block.checked.params.reverse)
+    (d3State : D3FullContextState env typeEnv Us d3Context
+      parameterΔ parameterΔ d3ContextRun.candidate.context.vlctx
+      d3ViewContext .refl viewLift)
+    (analyzerState : AnalyzerPostContextState typeEnv Us parameterΔ
+      d2ContextRun.candidate.context.vlctx analyzerViewContext
+      analyzerViewLift)
+    (ngenEq : d3Context.ngen = d2Context.ngen)
+    (parametersEq : stats.params.toList = parameters)
+    {familyName : Name} {familyLevels : List Level}
+    (indConsts : stats.indConsts = #[.const familyName familyLevels])
+    (familyTr : TrExprS env Us parameterΔ familyIndices
+      (VExpr.forallN generation.block.checked.indices
+        (.sort generation.block.checked.resultLevel)))
+    (familyUnique : TrExprS.IsUnique familyIndices)
+    (indexLength : generation.block.checked.indices.length =
+      stats.nindices[0]!)
+    (resultLevelTr : VLevel.ofLevel Us stats.resultLevel =
+      some generation.block.checked.resultLevel)
+    (absent : env.constants familyName = none)
+    (unique : CandidateExprTraceViewIsUnique candidateCtor.type.trace)
+    (universeSemantics : d2Trace.universeSemantics = true)
+    (stageFields : ∀ q field, ctor.view.fields[q]? = some field →
+      VInductDecl.stage3Field Us.length familyName stats.params.size
+        generation.block.checked.indices.length q field = true) :
+    VInductDecl.fieldsWF Us.length familyName stats.params.size env
+        generation.block.checked.resultLevel
+        generation.block.checked.indices
+        generation.block.checked.params.reverse 0 ctor.view.fields ∧
+      env.SpineWF Us.length
+        (ctor.view.fields.reverse ++
+          generation.block.checked.params.reverse)
+        (VExpr.forallN
+          (VExpr.liftTelN ctor.view.fields.length
+            generation.block.checked.indices 0)
+          (.sort generation.block.checked.resultLevel))
+        (VInductDecl.recFieldIdxs stats.params.size
+          (ctor.resultTarget generation.block))
+        (.sort generation.block.checked.resultLevel) := by
+  obtain ⟨rest, instantiation, ⟨d3Suffix⟩, wholeTr⟩ :=
+    genRun.preFamilySuffix addType parameterContext parameterWF unique d3
+      hctor parametersEq indConsts
+  obtain ⟨d2Suffix, suffixUniverse⟩ :=
+    d2.afterParameters d2Alignment (by omega) instantiation
+  have instantiation' : instantiateFamilyParameters candidateCtor.type.view
+      parameters = .ok rest := by
+    rw [← parametersEq]
+    exact instantiation
+  have sourceUnique : TrExprS.IsUnique rest :=
+    instantiateFamilyParameters_unique unique.view
+      (ConstructorValidation.CandidateParameterContext.parametersUnique
+        parameterContext) instantiation'
+  have sourceClosed : Closed rest := by
+    have closed := wholeTr.closed
+    rw [show parameterΔ.bvars = 0 from by
+      simpa only [VLCtx.NoBV] using d3State.commonNoBV] at closed
+    exact closed
+  have resultNotForall : ∀ domain body,
+      ctor.resultTarget generation.block ≠ .forallE domain body := by
+    intro domain body equality
+    have headEq := congrArg VExpr.appHead equality
+    simp only [NormalizedCtor.resultTarget, VExpr.appHead_appN,
+      VExpr.appHead] at headEq
+    exact VExpr.noConfusion headEq
+  have familyTargetEq :
+      VExpr.forallN generation.block.checked.indices
+          (.sort generation.block.checked.resultLevel) =
+        VExpr.forallN
+          (VExpr.liftTelN 0 generation.block.checked.indices 0)
+          (.sort generation.block.checked.resultLevel) := by
+    have liftTelNZero : ∀ (indices : List VExpr) (cutoff : Nat),
+        VExpr.liftTelN 0 indices cutoff = indices := by
+      intro indices cutoff
+      induction indices generalizing cutoff with
+      | nil => rfl
+      | cons index indices ih =>
+          simp only [VExpr.liftTelN, VExpr.liftN_zero]
+          rw [ih]
+    rw [liftTelNZero]
+  have removedInvariant : FullRemovedInvariant parameterΔ parameterΔ
+      [] := by
+    intro fv member _
+    exact member
+  have familyHead : stats.indConsts[0]! =
+      .const familyName familyLevels := by
+    rw [indConsts]
+    rfl
+  have suffixUniverseSemantics :
+      d2Suffix.trace.universeSemantics = true :=
+    suffixUniverse.trans universeSemantics
+  have result := constructorFields_exactAnalyzer
+    (d3 := d3Suffix.semantic)
+    (d2Alignment := d2Suffix.alignment) (d2 := d2Suffix.semantic)
+    henv typeEnvWF addType d3State analyzerState
+    removedInvariant ngenEq
+    familyTr (familyTr.mono addType) familyUnique indexLength
+    familyHead
+    familyTargetEq resultNotForall resultLevelTr absent sourceUnique
+    sourceClosed wholeTr (by omega) suffixUniverseSemantics (by
+      intro q field atIndex
+      simpa only [Nat.zero_add] using stageFields q field atIndex)
+  unfold ConstructorFieldsRunResult at result
+  simpa only [parameterCtx, VExpr.liftN_forallN, VExpr.liftN,
+    Nat.zero_add] using result
+
+/-- Traverse the exact source-indexed D3, D2, and analyzer lists in lockstep.
+The dependent indices rule out truncation, reordering, or reuse of evidence
+from a different constructor position. -/
+theorem CandidateSemanticNormalizedCtorListRun.checkedConstructorsWF
+    {env typeEnv : VEnv} {Us : List Name}
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {stats : InductiveStats} {familyIndices : Expr}
+    {d3Context d2Context : AddInductive.Context}
+    {d3ContextRun : AddInductive.ConstructorContextRun env Us d3Context}
+    {d2ContextRun : AddInductive.ConstructorContextRun typeEnv Us d2Context}
+    {kernelCtors : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelCtors}
+    {d3Trace : AddInductive.ConstructorPreFamilyListTrace stats 0
+      familyIndices d3Context candidates}
+    (d3 : AddInductive.ConstructorPreFamilyListSemanticRun env Us stats 0
+      familyIndices d3Context d3ContextRun d3Trace)
+    {seen : NameSet}
+    {d2Trace : AddInductive.ConstructorListValidationTrace stats false 0
+      d2Context seen kernelCtors}
+    {alignment : AddInductive.ConstructorCandidateAlignmentTrace stats false 0
+      d2Context d2Trace candidates}
+    {raws : List VConstVal}
+    {roots : CandidateConstructorSemanticListRun typeEnv Us candidates raws}
+    (d2 : AddInductive.ConstructorPostFamilySemanticListRun typeEnv Us stats
+      false 0 d2Context d2ContextRun d2Trace candidates alignment roots)
+    {ctors : List NormalizedCtor}
+    (generationRuns : CandidateSemanticNormalizedCtorListRun generation.block
+      typeEnv Us roots ctors)
+    (membership : ∀ ctor ∈ ctors,
+      ctor ∈ generation.block.ctorPairs)
+    (henv : VEnv.WF env) (typeEnvWF : VEnv.WF typeEnv)
+    (addType : env ≤ typeEnv)
+    {parameterΔ d3ViewContext analyzerViewContext : VLCtx}
+    {viewLift analyzerViewLift : Lift}
+    {parameters : List Expr}
+    (parameterContext : CandidateParameterContext [] parameters
+      generation.block.checked.params parameterΔ)
+    (parameterWF : VLCtx.WF env Us.length parameterΔ)
+    (parameterCtx : parameterΔ.toCtx =
+      generation.block.checked.params.reverse)
+    (d3State : D3FullContextState env typeEnv Us d3Context
+      parameterΔ parameterΔ d3ContextRun.candidate.context.vlctx
+      d3ViewContext .refl viewLift)
+    (analyzerState : AnalyzerPostContextState typeEnv Us parameterΔ
+      d2ContextRun.candidate.context.vlctx analyzerViewContext
+      analyzerViewLift)
+    (ngenEq : d3Context.ngen = d2Context.ngen)
+    (parametersEq : stats.params.toList = parameters)
+    {familyName : Name} {familyLevels : List Level}
+    (indConsts : stats.indConsts = #[.const familyName familyLevels])
+    (familyTr : TrExprS env Us parameterΔ familyIndices
+      (VExpr.forallN generation.block.checked.indices
+        (.sort generation.block.checked.resultLevel)))
+    (familyUnique : TrExprS.IsUnique familyIndices)
+    (indexLength : generation.block.checked.indices.length =
+      stats.nindices[0]!)
+    (resultLevelTr : VLevel.ofLevel Us stats.resultLevel =
+      some generation.block.checked.resultLevel)
+    (absent : env.constants familyName = none)
+    (unique : candidates.ViewTranslationUnique)
+    (universeSemantics : d2Trace.universeSemantics = true)
+    (uvarsEq : source.uvars = Us.length)
+    (familyNameEq : familyName = generation.block.checked.type.name)
+    (paramsSizeEq : stats.params.size = source.nparams) :
+    ∀ ctor ∈ ctors,
+      VInductDecl.fieldsWF Us.length familyName stats.params.size env
+          generation.block.checked.resultLevel
+          generation.block.checked.indices
+          generation.block.checked.params.reverse 0 ctor.view.fields ∧
+        env.SpineWF Us.length
+          (ctor.view.fields.reverse ++
+            generation.block.checked.params.reverse)
+          (VExpr.forallN
+            (VExpr.liftTelN ctor.view.fields.length
+              generation.block.checked.indices 0)
+            (.sort generation.block.checked.resultLevel))
+          (VInductDecl.recFieldIdxs stats.params.size
+            (ctor.resultTarget generation.block))
+          (.sort generation.block.checked.resultLevel) := by
+  induction d3 generalizing seen raws ctors with
+  | nil =>
+      cases d2
+      cases generationRuns
+      intro ctor member
+      simp at member
+  | cons d3Head d3Tail ih =>
+      cases alignment with
+      | cons rootScope storedSpine spineLength candidateDepth headAlignment
+          tailAlignment =>
+        cases d2 with
+        | cons root d2Head spine d2Tail =>
+          cases generationRuns with
+          | cons generationHead generationTail =>
+            simp only [AddInductive.ConstructorListValidationTrace.universeSemantics,
+              Bool.and_eq_true] at universeSemantics
+            intro ctor member
+            simp only [List.mem_cons] at member
+            rcases member with rfl | member
+            · have hctor : ctor ∈ generation.block.ctorPairs :=
+                membership ctor (.head _)
+              obtain ⟨directCtor, directMember, viewEq⟩ :=
+                generation.viewCtor_ofDirect hctor
+              have directStage :=
+                (generation.block.checked.direct_anatomy.2.2.2.2.2
+                  directCtor directMember).2.2
+              rw [← generation.block.uvars_eq,
+                ← generation.block.nparams_eq,
+                uvarsEq, ← familyNameEq, ← paramsSizeEq] at directStage
+              have viewEq' : ctor.view =
+                  CheckedCtor.ofDirect Us.length familyName stats.params.size
+                    generation.block.checked.indices.length directCtor := by
+                simpa only [uvarsEq, paramsSizeEq,
+                  generation.block.sourceType_name_eq, familyNameEq] using viewEq
+              have stageFields : ∀ q field,
+                  ctor.view.fields[q]? = some field →
+                    VInductDecl.stage3Field Us.length familyName
+                      stats.params.size
+                      generation.block.checked.indices.length q field = true := by
+                intro q field atIndex
+                rw [viewEq'] at atIndex
+                simpa only [Nat.zero_add] using
+                  (VInductDecl.stage3Ctor_eq directStage).2.2.2 q field
+                    (by simpa only [CheckedCtor.ofDirect] using atIndex)
+              exact generationHead.checkedConstructorWF d3Head
+                headAlignment d2Head hctor henv typeEnvWF addType
+                parameterContext parameterWF parameterCtx d3State analyzerState
+                ngenEq parametersEq indConsts familyTr
+                familyUnique indexLength resultLevelTr absent unique.1
+                universeSemantics.1 stageFields
+            · exact ih d2Tail generationTail
+                (fun ctor member => membership ctor (.tail _ member)) unique.2
+                universeSemantics.2 ctor member
+
+/-- The retained D1/D2/D3 producer traces derive the exact analyzer-owned
+checked declaration semantics. -/
+theorem StagedNormalizationCandidatePreFamilyInput.checkedWF
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {kernelSource : InductiveType}
+    {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    generation.block.checked.WF env := by
+  let staged := input.postFamilyInput.universeInput.staged
+  let validation := staged.family.validation
+  obtain ⟨parameterΔ, terminalRun, viewTerminal, familyInstantiation,
+      familyTr, parameterCtx, parameterContext, parameterFVars,
+      parameterNoBV, parameterWF, terminalVenv, terminalLparams,
+      terminalViewDefEq, terminalViewUnique, terminalViewLift,
+      terminalViewEq⟩ :=
+    input.familyContext normalization generation analysis shape
+  have henv : VEnv.WF env := by
+    simpa only [normalization.family.type.venv_eq] using
+      normalization.family.type.contextRun.context.Ewf
+  have rawWF : normalization.raw.toVConstant.WF env := by
+    show env.IsType normalization.raw.uvars [] normalization.raw.type
+    simpa only [normalization.family.uvars_eq] using
+      normalization.family.type.source_isType_of_terminalSort
+        validation.terminal_eq
+  have typeEnvWF : VEnv.WF normalization.family.typeEnv := by
+    obtain ⟨declarations, declarationsWF⟩ := henv
+    exact ⟨.axiom normalization.raw.toVConstVal :: declarations,
+      .decl (.axiom rawWF normalization.family.addType) declarationsWF⟩
+  have rawEq : normalization.raw = staged.raw := by
+    have singletonEq : [normalization.raw] = [staged.raw] :=
+      normalization.raw_types_eq.symm.trans staged.raw_types_eq
+    injection singletonEq
+  have typeEnvEq : normalization.family.typeEnv = staged.family.typeEnv := by
+    exact Option.some.inj <| normalization.family.addType.symm.trans (by
+      simpa only [rawEq] using staged.family.addInduct.env_add)
+  obtain ⟨validationRun, validationVenv, validationLparams,
+      validationVlctx⟩ :=
+    staged.family.validationContextRunFromPre terminalRun terminalVenv
+      terminalLparams
+  let d3ContextRun : AddInductive.ConstructorContextRun env Us
+      candidate.families.singleton.familyType.type.trace.terminalContext :=
+    ⟨terminalRun, terminalVenv, terminalLparams⟩
+  let d2ContextRun : AddInductive.ConstructorContextRun
+      normalization.family.typeEnv Us
+      { candidate.families.singleton.familyType.type.trace.terminalContext with
+        env := constructorContext.env } :=
+    ⟨validationRun, validationVenv.trans typeEnvEq.symm,
+      validationLparams⟩
+  obtain ⟨d3Constructors⟩ :=
+    AddInductive.ConstructorPreFamilyListSemanticRun.nonempty d3ContextRun
+      input.safety.constructors
+  obtain ⟨d2Constructors⟩ :=
+    AddInductive.ConstructorPostFamilySemanticListRun.nonempty_of_alignment
+      d2ContextRun input.postFamilyInput.alignment
+      normalization.family.constructors
+  let generationRuns := normalization.constructorGenerationRuns generation
+    analysis shape
+  have terminalWF : VLCtx.WF env Us.length
+      terminalRun.context.vlctx := by
+    simpa only [terminalVenv, terminalLparams] using terminalRun.context.Δwf
+  have validationWF : VLCtx.WF normalization.family.typeEnv Us.length
+      validationRun.context.vlctx := by
+    simpa only [validationVenv, ← typeEnvEq, validationLparams] using
+      validationRun.context.Δwf
+  have viewTerminalWF : VLCtx.WF env Us.length viewTerminal :=
+    (terminalViewDefEq.symm henv.ordered).wf
+  have d3State : D3FullContextState env normalization.family.typeEnv Us
+      candidate.families.singleton.familyType.type.trace.terminalContext
+      parameterΔ parameterΔ terminalRun.context.vlctx viewTerminal .refl
+      (.skipN .refl generation.block.checked.indices.length) := {
+    commonWF := parameterWF
+    commonNoBV := parameterNoBV
+    fullWF := parameterWF.mono
+      (VEnv.addConst_le normalization.family.addType)
+    fullExtension := .refl
+    actualWF := terminalWF
+    viewDefEq := terminalViewDefEq
+    viewUnique := terminalViewUnique
+    viewExtension := terminalViewLift
+    freshInvariant := fun _ present => .inl present }
+  have analyzerState : AnalyzerPostContextState
+      normalization.family.typeEnv Us parameterΔ validationRun.context.vlctx
+      viewTerminal (.skipN .refl
+        generation.block.checked.indices.length) := {
+    fullWF := parameterWF.mono
+      (VEnv.addConst_le normalization.family.addType)
+    postWF := validationWF
+    viewWF := viewTerminalWF.mono
+      (VEnv.addConst_le normalization.family.addType)
+    viewDefEq := by
+      rw [validationVlctx]
+      exact (terminalViewDefEq.mono
+        (VEnv.addConst_le normalization.family.addType)).toFVars
+    viewExtension := terminalViewLift }
+  have parametersEq : validation.stats.params.toList =
+      candidate.families.singleton.familyType.type.trace.parameterList
+        source.nparams := by
+    rw [validation.stats_eq]
+    simp only [CandidateExprTrace.singletonCandidateInductiveStats,
+      validation, staged, staged.validation_nparams_eq]
+  have paramsSizeEq : validation.stats.params.size = source.nparams := by
+    calc
+      validation.stats.params.size =
+          validation.stats.params.toList.length := by simp
+      _ = (candidate.families.singleton.familyType.type.trace.parameterList
+          source.nparams).length := congrArg List.length parametersEq
+      _ = generation.block.checked.params.length :=
+        parameterContext.length_eq
+      _ = source.nparams :=
+        generation.block.checked.direct_anatomy.2.1.trans
+          generation.block.nparams_eq.symm
+  have sourceTypeEq : generation.block.sourceType = normalization.raw := by
+    simpa only [NormalizationCandidateSemanticRun.root] using
+      normalization.root.sourceType_eq generation
+  have familyNameEq : generation.block.sourceType.name =
+      generation.block.checked.type.name :=
+    generation.block.sourceType_name_eq
+  have familyLparams :
+      candidate.families.singleton.familyType.type.context.lparams = Us := by
+    exact normalization.family.type.contextRun.context_lparams.symm.trans
+      normalization.family.type.lparams_eq
+  have indConsts : validation.stats.indConsts =
+      #[.const generation.block.sourceType.name (Us.map .param)] := by
+    rw [validation.stats_eq]
+    simp only [CandidateExprTrace.singletonCandidateInductiveStats,
+      familyLparams]
+    congr 2
+    exact congrArg (fun name => Expr.const name (Us.map .param)) <|
+      staged.family.name_eq.trans (congrArg
+        (fun type : VInductiveType => type.name)
+        (rawEq.symm.trans sourceTypeEq.symm))
+  have familyUnique : TrExprS.IsUnique input.safety.familyIndices :=
+    instantiateFamilyParameters_unique
+      input.safety.familyTranslationUnique
+      (ConstructorValidation.CandidateParameterContext.parametersUnique
+        parameterContext) familyInstantiation
+  have indexLength : generation.block.checked.indices.length =
+      validation.stats.nindices[0]! :=
+    (stagedIndexCount_eq input normalization generation analysis
+      shape).symm
+  have resultLevelTr : VLevel.ofLevel Us validation.stats.resultLevel =
+      some generation.block.checked.resultLevel :=
+    stagedResultLevel_tr input normalization generation analysis shape
+  have absent : env.constants generation.block.sourceType.name = none := by
+    rw [sourceTypeEq]
+    exact VEnv.addConst_fresh normalization.family.addType
+  have pairWF := generationRuns.checkedConstructorsWF
+    d3Constructors d2Constructors (fun _ member => member) henv typeEnvWF
+    (VEnv.addConst_le normalization.family.addType) parameterContext
+    parameterWF parameterCtx d3State analyzerState rfl
+    parametersEq indConsts familyTr familyUnique indexLength resultLevelTr
+    absent input.safety.constructorTranslationUnique
+    input.postFamilyInput.universeInput.universeSemantics
+    normalization.uvars_eq familyNameEq paramsSizeEq
+  refine ⟨by
+    simpa only [generation.block.uvars_eq] using
+      input.familyOnTel normalization generation analysis, ?_⟩
+  intro ctor ctorMember
+  have directMember :
+      CheckedCtor.ofDirect generation.block.normalization.view.uvars
+          generation.block.checked.type.name
+          generation.block.normalization.view.nparams
+          generation.block.checked.indices.length ctor ∈
+        generation.block.checked.constructors := by
+    rw [generation.block.checked.constructors_eq]
+    exact List.mem_map.2 ⟨ctor, ctorMember, rfl⟩
+  rw [← generation.viewCtors_eq] at directMember
+  obtain ⟨pair, pairMember, pairViewEq⟩ := List.mem_map.1 directMember
+  have result := pairWF pair pairMember
+  rw [pairViewEq] at result
+  have viewUvarsEq : generation.block.normalization.view.uvars = Us.length :=
+    generation.block.uvars_eq.symm.trans normalization.uvars_eq
+  have dropBvarRevRange : ∀ (offset count : Nat) (suffix : List VExpr),
+      (VExpr.bvarRevRange offset count ++ suffix).drop count = suffix := by
+    intro offset count suffix
+    induction count with
+    | zero => rfl
+    | succ count ih =>
+        simp only [VExpr.bvarRevRange, List.cons_append,
+          List.drop_succ_cons]
+        exact ih
+  rw [← viewUvarsEq, paramsSizeEq, generation.block.nparams_eq,
+    familyNameEq] at result
+  simpa only [
+    generation.block.nparams_eq, pairViewEq,
+    CheckedCtor.ofDirect, NormalizedCtor.resultTarget,
+    VInductDecl.recFieldIdxs, VExpr.appArgs_appN, VExpr.appArgs,
+    List.append_nil, dropBvarRevRange] using result
+
+/-- Re-index the derived checked semantics onto the exact normalization view
+selected by dependent analysis. -/
+theorem StagedNormalizationCandidatePreFamilyInput.viewDeclWF
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {kernelSource : InductiveType}
+    {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    normalization.root.viewDecl.WF env := by
+  have checkedWF := input.checkedWF normalization generation analysis shape
+  have normalizationEq : generation.block.normalization =
+      normalization.root.normalization :=
+    Normalization.generation?_normalization analysis
+  have viewEq : generation.block.normalization.view =
+      normalization.root.viewDecl := by
+    simpa only [NormalizationCandidateRun.normalization] using
+      congrArg (fun normalized : Normalization source => normalized.view)
+        normalizationEq
+  rw [← viewEq]
+  exact generation.block.checked.to_declWF generation.block.checked_eq
+    checkedWF
+
+/-- Build the semantic generation owner from the retained D1/D2/D3 input,
+exact dependent analysis, and the single executable hierarchy shape check.
+The analyzer-owned checked semantics are derived from those traces rather
+than accepted as a premise. -/
+def GenerationCandidateSemanticRun.ofGenerationShape
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    GenerationCandidateSemanticRun normalization generation := by
+  have familyShape := shape
+  simp only [NormalizationCandidateSemanticRun.generationShape,
+    normalizationCandidateGenerationShape, Bool.and_eq_true,
+    beq_iff_eq] at familyShape
+  have sourceTypeEq : generation.block.sourceType = normalization.raw := by
+    simpa only [NormalizationCandidateSemanticRun.root] using
+      normalization.root.sourceType_eq generation
+  apply GenerationCandidateSemanticShapeRun.run {
+    analysis := analysis
+    checked := input.checkedWF normalization generation analysis shape
+    family := {
+      storedSpine := familyShape.1.1
+      spineLength_eq := by
+        simpa only [NormalizedChecked.rawParams,
+          NormalizedChecked.rawIndices, sourceTypeEq] using familyShape.1.2 }
+    constructors :=
+      CandidateConstructorSemanticGenerationShapeList.ofCheck
+        normalization.family.constructors familyShape.2 }
+
+/-- Construct the produced package at the consolidated generation-shape
+boundary without accepting a checked- or view-WF premise. -/
+def NormalizationCandidateSemanticRun.producedPackageOfGenerationShape
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true)
+    (context : AddInductive.Context)
+    (nparams numNested : Nat) (isUnsafe : Bool)
+    (produced :
+      AddInductive.buildNormalizationCandidate nparams
+          [kernelSource] numNested isUnsafe context = .ok candidate) :
+    ProducedGenerationCandidatePackage env Us :=
+  (GenerationCandidateSemanticRun.ofGenerationShape input normalization
+    generation analysis shape).producedPackage context nparams numNested
+      isUnsafe produced
+
+/-- Interpret one successful shape-producing outer result using the matching
+retained D1/D2/D3 semantic input. -/
+def ProducedGenerationShapeCandidate.producedPackage
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {raw : VInductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    (producedCandidate : ProducedGenerationShapeCandidate source raw
+      kernelSource numNested isUnsafe context)
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us producedCandidate.candidate source)
+    (normalization : NormalizationCandidateSemanticRun env Us
+      producedCandidate.candidate source)
+    (rawEq : raw = normalization.raw)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation) :
+    ProducedGenerationCandidatePackage env Us :=
+  normalization.producedPackageOfGenerationShape input generation analysis
+    (by
+      simpa only [NormalizationCandidateSemanticRun.generationShape,
+        rawEq] using producedCandidate.shape)
+    context source.nparams numNested isUnsafe producedCandidate.produced
+
+/-- Projection-free D3 candidates determine one exact Theory constructor
+view at every source position, independently of the existential checker run
+that selected it. -/
+theorem CandidateConstructorSemanticListRun.roots_views_eq
+    {env : VEnv} {Us : List Name} {constructors : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors}
+    {raws : List VConstVal}
+    (unique : candidates.ViewTranslationUnique)
+    (left right : CandidateConstructorSemanticListRun env Us candidates raws) :
+    left.roots.views = right.roots.views := by
+  induction left with
+  | nil =>
+      cases right
+      rfl
+  | @cons constructor constructors candidate candidates raw raws head tail ih =>
+      cases right with
+      | cons otherHead otherTail =>
+          obtain ⟨_, headRecursive⟩ := head.type.recursive
+          obtain ⟨_, otherHeadRecursive⟩ := otherHead.type.recursive
+          have headViewEq : head.type.view = otherHead.type.view :=
+            TrExprS.unique unique.1.view
+              (headRecursive.view_tr_strict unique.1)
+              (otherHeadRecursive.view_tr_strict unique.1)
+          have tailViewsEq := ih unique.2 otherTail
+          simp only [CandidateConstructorSemanticListRun.roots,
+            CandidateConstructorListRun.views,
+            CandidateConstructorSemanticRun.root,
+            CandidateConstructorRun.view]
+          rw [headViewEq, tailViewsEq]
+
+/-- Transport the positional uniqueness theorem across the uniquely produced
+post-family environment and raw constructor list. -/
+theorem CandidateConstructorSemanticListRun.roots_views_eq_of_eq
+    {leftEnv rightEnv : VEnv} {Us : List Name}
+    {constructors : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor constructors}
+    {leftRaws rightRaws : List VConstVal}
+    (unique : candidates.ViewTranslationUnique)
+    (envEq : leftEnv = rightEnv) (rawsEq : leftRaws = rightRaws)
+    (left : CandidateConstructorSemanticListRun leftEnv Us candidates leftRaws)
+    (right : CandidateConstructorSemanticListRun rightEnv Us candidates
+      rightRaws) :
+    left.roots.views = right.roots.views := by
+  subst rightEnv
+  subst rightRaws
+  exact left.roots_views_eq unique right
+
+private theorem candidateFamilyView_eq_of_components
+    {rawLeft rawRight : VInductiveType}
+    {typeLeft typeRight : VExpr}
+    {ctorsLeft ctorsRight : List VConstVal}
+    (rawEq : rawLeft = rawRight) (typeEq : typeLeft = typeRight)
+    (ctorsEq : ctorsLeft = ctorsRight) :
+    ({ rawLeft with type := typeLeft, ctors := ctorsLeft } :
+        VInductiveType) =
+      { rawRight with type := typeRight, ctors := ctorsRight } := by
+  cases rawEq
+  cases typeEq
+  cases ctorsEq
+  rfl
+
+private theorem Normalization.eq_of_view_eq
+    {source : VInductDecl} {left right : Normalization source}
+    (viewEq : left.view = right.view) : left = right := by
+  cases left with
+  | mk leftView leftShape =>
+      cases right with
+      | mk rightView rightShape =>
+          cases viewEq
+          rfl
+
+/-- The D3 projection-free safety gate makes the complete normalization
+selected by the staged semantic owner syntactically unique.  In particular,
+fixtures may state dependent analysis once for the known normalization and
+transport it to whichever semantic hierarchy `input.exists` selects. -/
+theorem StagedNormalizationCandidatePreFamilyInput.normalization_eq
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate source)
+    (left right : NormalizationCandidateSemanticRun env Us candidate source) :
+    left.root.normalization = right.root.normalization := by
+  have rawEq : left.raw = right.raw := by
+    have singletonEq := left.raw_types_eq.symm.trans right.raw_types_eq
+    injection singletonEq
+  have typeEnvEq : left.family.typeEnv = right.family.typeEnv := by
+    exact Option.some.inj <| left.family.addType.symm.trans <| by
+      simpa only [rawEq] using right.family.addType
+  have familyViewEq : left.family.type.view = right.family.type.view := by
+    obtain ⟨_, leftRecursive⟩ := left.family.type.recursive
+    obtain ⟨_, rightRecursive⟩ := right.family.type.recursive
+    exact TrExprS.unique input.safety.familyTranslationUnique
+      (leftRecursive.view_tr_strict <|
+        AddInductive.CandidateExprTrace.viewTranslationUnique_sound _ <| by
+          rw [AddInductive.CandidateExprTrace.viewTranslationUnique_eq]
+          have gate := input.safety.translationUnique
+          simp only [Bool.and_eq_true] at gate
+          exact gate.1)
+      (rightRecursive.view_tr_strict <|
+        AddInductive.CandidateExprTrace.viewTranslationUnique_sound _ <| by
+          rw [AddInductive.CandidateExprTrace.viewTranslationUnique_eq]
+          have gate := input.safety.translationUnique
+          simp only [Bool.and_eq_true] at gate
+          exact gate.1)
+  have constructorViewsEq : left.family.constructors.roots.views =
+      right.family.constructors.roots.views := by
+    exact left.family.constructors.roots_views_eq_of_eq
+      input.safety.constructorTranslationUnique typeEnvEq
+      (congrArg VInductiveType.ctors rawEq) right.family.constructors
+  have familyEq : left.family.root.view = right.family.root.view := by
+    exact candidateFamilyView_eq_of_components rawEq familyViewEq
+      constructorViewsEq
+  have viewDeclEq : left.root.viewDecl = right.root.viewDecl := by
+    simp only [NormalizationCandidateSemanticRun.root,
+      NormalizationCandidateRun.viewDecl]
+    rw [familyEq]
+  exact Normalization.eq_of_view_eq viewDeclEq
+
+/-- Choice-free constructor-root interpretation: the semantic root's view is
+computed by the deterministic translator under the constructor's strict-view
+uniqueness certificate. -/
+def CandidateConstructorSemanticInput.semanticOfUnique
+    {env : VEnv} {Us : List Name} {source : Constructor}
+    {candidate : AddInductive.CandidateConstructor source} {raw : VConstVal}
+    (input : CandidateConstructorSemanticInput env Us candidate raw)
+    (unique : TypeChecker.CandidateExprTraceViewIsUnique
+      candidate.type.trace) :
+    CandidateConstructorSemanticRun env Us candidate raw where
+  name_eq := input.name_eq
+  uvars_eq := input.uvars_eq
+  type := input.type.semanticOfUnique unique
+
+/-- Choice-free source-ordered interpretation of a complete constructor list
+under its source-ordered strict-view certificate. -/
+def CandidateConstructorSemanticListInput.semanticOfUnique
+    {env : VEnv} {Us : List Name} :
+    {sources : List Constructor} →
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor sources} →
+    {raws : List VConstVal} →
+    CandidateConstructorSemanticListInput env Us candidates raws →
+    candidates.ViewTranslationUnique →
+    CandidateConstructorSemanticListRun env Us candidates raws
+  | _, _, _, .nil, _ => .nil
+  | _, _, _, .cons head tail, unique =>
+    .cons (head.semanticOfUnique unique.1) (tail.semanticOfUnique unique.2)
+
+/-- Choice-free family interpretation: the family type and every
+post-insertion constructor view are computed by the deterministic
+translator. -/
+def CandidateFamilySemanticInput.semanticOfUnique
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.CandidateFamily source} {raw : VInductiveType}
+    (input : CandidateFamilySemanticInput env Us candidate raw)
+    (uniqueType : TypeChecker.CandidateExprTraceViewIsUnique
+      candidate.familyType.type.trace)
+    (uniqueCtors : candidate.constructors.ViewTranslationUnique) :
+    CandidateFamilySemanticRun env Us candidate raw where
+  name_eq := input.name_eq
+  uvars_eq := input.uvars_eq
+  type := input.type.semanticOfUnique uniqueType
+  typeEnv := input.typeEnv
+  addType := input.addType
+  constructors := input.constructors.semanticOfUnique uniqueCtors
+
+/-- Choice-free singleton semantic hierarchy: every normalized Theory view
+in the family and constructor list is computed by the deterministic
+translator, with `Nonempty` interpretation transferred onto the computed
+values. -/
+def NormalizationCandidateSemanticInput.semanticOfUnique
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : NormalizationCandidateSemanticInput env Us candidate rawDecl)
+    (uniqueType : TypeChecker.CandidateExprTraceViewIsUnique
+      candidate.families.singleton.familyType.type.trace)
+    (uniqueCtors :
+      candidate.families.singleton.constructors.ViewTranslationUnique) :
+    NormalizationCandidateSemanticRun env Us candidate rawDecl where
+  raw := input.raw
+  raw_types_eq := input.raw_types_eq
+  uvars_eq := input.uvars_eq
+  family := input.family.semanticOfUnique uniqueType uniqueCtors
+
+/-- The executable D3 gate's uniqueness Bool supplies the family strict-view
+certificate consumed by the choice-free semantic assembly. -/
+theorem StagedNormalizationCandidatePreFamilyInput.familyViewUnique
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    TypeChecker.CandidateExprTraceViewIsUnique
+      candidate.families.singleton.familyType.type.trace := by
+  have h := input.safety.translationUnique
+  simp only [Bool.and_eq_true] at h
+  exact AddInductive.CandidateExprTrace.viewTranslationUnique_sound _
+    ((AddInductive.CandidateExprTrace.viewTranslationUnique_eq _).trans h.1)
+
+/-- The executable D3 gate's uniqueness Bool likewise supplies the
+constructor-list strict-view certificate. -/
+theorem StagedNormalizationCandidatePreFamilyInput.constructorViewsUnique
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    candidate.families.singleton.constructors.ViewTranslationUnique := by
+  have h := input.safety.translationUnique
+  simp only [Bool.and_eq_true] at h
+  exact AddInductive.CandidateList.viewTranslationUnique_sound _ h.2
+
+/-- Exact, source-indexed refinement of the public producer package.
+
+The public `ProducedGenerationCandidatePackage` deliberately erases its
+dependent source, normalization, and generation indices.  Keeping those
+indices in this closure result lets clients choose the `Nonempty` witness and
+still recover a package whose projections reduce to the requested source and
+generation. -/
+structure ExactProducedGenerationCandidatePackage
+    {source : VInductDecl} {raw : VInductiveType}
+    {kernelSource : InductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    (env : VEnv) (Us : List Name)
+    (producedCandidate : ProducedGenerationShapeCandidate source raw
+      kernelSource numNested isUnsafe context)
+    (generation : GenerationChecked source) where
+  normalization : NormalizationCandidateSemanticRun env Us
+    producedCandidate.candidate source
+  raw_eq : raw = normalization.raw
+  semantic : GenerationCandidateSemanticRun normalization generation
+
+/-- Erase only the exact dependent indices retained by the generic closure.
+The ordinary producer equation is copied from the same strengthened producer
+value; it contributes provenance, not semantic authority. -/
+def ExactProducedGenerationCandidatePackage.package
+    {source : VInductDecl} {raw : VInductiveType}
+    {kernelSource : InductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context} {env : VEnv} {Us : List Name}
+    {producedCandidate : ProducedGenerationShapeCandidate source raw
+      kernelSource numNested isUnsafe context}
+    {generation : GenerationChecked source}
+    (exact : ExactProducedGenerationCandidatePackage env Us
+      producedCandidate generation) :
+    ProducedGenerationCandidatePackage env Us :=
+  exact.semantic.producedPackage context source.nparams numNested isUnsafe
+    producedCandidate.produced
+
+/-- Close one strengthened singleton producer choice-free.  The semantic
+hierarchy is computed by the deterministic translator under the executable
+D3 strict-view gate carried by the staged owner, so the retained package is
+data rather than a `Classical.choice` selection from `Nonempty`. -/
+def ProducedGenerationShapeCandidate.exactProducedPackage
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {raw : VInductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    (producedCandidate : ProducedGenerationShapeCandidate source raw
+      kernelSource numNested isUnsafe context)
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us producedCandidate.candidate source)
+    (rawOwnerEq : raw =
+      input.postFamilyInput.universeInput.staged.raw)
+    (generation : GenerationChecked source)
+    (analysis : ∀ normalization : NormalizationCandidateSemanticRun env Us
+        producedCandidate.candidate source,
+      normalization.root.normalization.generation? = some generation) :
+    ExactProducedGenerationCandidatePackage env Us
+      producedCandidate generation :=
+  let normalization :=
+    input.postFamilyInput.universeInput.staged.semanticInput.semanticOfUnique
+      input.familyViewUnique input.constructorViewsUnique
+  { normalization := normalization
+    raw_eq := rawOwnerEq
+    semantic := GenerationCandidateSemanticRun.ofGenerationShape input
+      normalization generation (analysis normalization)
+      (by
+        have hraw : normalization.raw =
+            input.postFamilyInput.universeInput.staged.raw := rfl
+        simpa only [NormalizationCandidateSemanticRun.generationShape,
+          rawOwnerEq, hraw] using producedCandidate.shape) }
+
+/-- Close one strengthened singleton producer from the staged D1--D4 owner
+without choosing a semantic hierarchy at the API boundary, while retaining
+the exact dependent source and generation indices needed by consumers. -/
+theorem ProducedGenerationShapeCandidate.exactProducedPackage_nonempty
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {raw : VInductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    (producedCandidate : ProducedGenerationShapeCandidate source raw
+      kernelSource numNested isUnsafe context)
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us producedCandidate.candidate source)
+    (rawOwnerEq : raw =
+      input.postFamilyInput.universeInput.staged.raw)
+    (generation : GenerationChecked source)
+    (analysis : ∀ normalization : NormalizationCandidateSemanticRun env Us
+        producedCandidate.candidate source,
+      normalization.root.normalization.generation? = some generation) :
+    Nonempty (ExactProducedGenerationCandidatePackage env Us
+      producedCandidate generation) := by
+  obtain ⟨preFamily⟩ := input.exists
+  let normalization := preFamily.postFamily.produced.semantic
+  have semanticRawEq : normalization.raw =
+      input.postFamilyInput.universeInput.staged.raw := by
+    have singletonEq := normalization.raw_types_eq.symm.trans
+      input.postFamilyInput.universeInput.staged.raw_types_eq
+    injection singletonEq
+  have rawEq := rawOwnerEq.trans semanticRawEq.symm
+  let semantic := GenerationCandidateSemanticRun.ofGenerationShape input
+    normalization generation (analysis normalization) (by
+      simpa only [NormalizationCandidateSemanticRun.generationShape,
+        rawEq] using producedCandidate.shape)
+  exact ⟨{ normalization, raw_eq := rawEq, semantic }⟩
+
+/-- Close one strengthened singleton producer from the staged D1--D4 owner
+without choosing a semantic hierarchy at the API boundary.
+
+`analysis` is exact for every checker-selected semantic normalization owned by
+the staged input.  The proof eliminates `input.exists` only into `Nonempty`,
+then applies D4 to that exact selected normalization.  The ordinary producer
+equation and the independent generation-shape gate remain the two fields of
+`producedCandidate`; neither supplies Theory meaning by itself. -/
+theorem ProducedGenerationShapeCandidate.producedPackage_nonempty
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {raw : VInductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    (producedCandidate : ProducedGenerationShapeCandidate source raw
+      kernelSource numNested isUnsafe context)
+    (input : StagedNormalizationCandidatePreFamilyInput familyContext
+      constructorContext env Us producedCandidate.candidate source)
+    (rawOwnerEq : raw =
+      input.postFamilyInput.universeInput.staged.raw)
+    (generation : GenerationChecked source)
+    (analysis : ∀ normalization : NormalizationCandidateSemanticRun env Us
+        producedCandidate.candidate source,
+      normalization.root.normalization.generation? = some generation) :
+    Nonempty (ProducedGenerationCandidatePackage env Us) := by
+  obtain ⟨exact⟩ := producedCandidate.exactProducedPackage_nonempty input
+    rawOwnerEq generation analysis
+  exact ⟨exact.package⟩
+
+end VInductDecl
+
+namespace VInductDecl
+
+/- The D4 closure roots intentionally inherit the exact transitional Verify
+axiom set already present in the staged semantic inputs. -/
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidatePreFamilyInput.checkedWF [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidatePreFamilyInput.viewDeclWF [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateSemanticRun.ofGenerationShape [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateSemanticRun.producedPackageOfGenerationShape [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.ProducedGenerationShapeCandidate.producedPackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.ProducedGenerationShapeCandidate.exactProducedPackage_nonempty [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidatePreFamilyInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidatePostFamilyInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/- The wrapper projections expose their exact existing Verify closure.  The
+new universe bridge itself remains separately guarded above; staging does not
+hide the transitional dependencies already present in the semantic owner. -/
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidateUniverseInput.semanticValidation [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidateUniverseInput.universeSemantics [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidateUniverseInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+end VInductDecl
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Verify/Environment/ConstructorValidityMatrix.lean b/Ix/Theory/Named/Verify/Environment/ConstructorValidityMatrix.lean
new file mode 100644
index 000000000..1692e8052
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/ConstructorValidityMatrix.lean
@@ -0,0 +1,358 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.ConstructorValidityFixtures
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
+
+/-!
+# Spec-05 constructor-validity differential matrix
+
+The positive half quotes real Lean metadata, runs the ordinary normalization
+candidate producer, then runs both strengthened constructor gates at their
+actual pre-family and post-family environments.  The negative half pairs each failed
+source declaration in `Theory.ConstructorValidityFixtures` with hand-built
+metadata at the nearest ordinary-producer phase.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/-! ## Actual positive metadata -/
+
+def constructorValidityMatrixInfo : ConstantInfo :=
+  kernelInductInfo% ConstructorValidityMatrix
+
+def constructorValidityMatrixMkInfo : ConstantInfo :=
+  kernelCtorInfo% ConstructorValidityMatrix.mk
+
+def constructorValidityMatrixRecInfo : ConstantInfo :=
+  kernelRecInfo% ConstructorValidityMatrix.rec
+
+def constructorValidityMatrixKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% ConstructorValidityMatrix.rec 0
+
+def constructorValidityMatrixKernelCtor : Constructor where
+  name := constructorValidityMatrixMkInfo.name
+  type := constructorValidityMatrixMkInfo.type
+
+def constructorValidityMatrixKernelType : InductiveType where
+  name := constructorValidityMatrixInfo.name
+  type := constructorValidityMatrixInfo.type
+  ctors := [constructorValidityMatrixKernelCtor]
+
+def propRecursiveBoundaryInfo : ConstantInfo :=
+  kernelInductInfo% PropRecursiveBoundary
+
+def propRecursiveBoundaryMkInfo : ConstantInfo :=
+  kernelCtorInfo% PropRecursiveBoundary.mk
+
+def propRecursiveBoundaryRecInfo : ConstantInfo :=
+  kernelRecInfo% PropRecursiveBoundary.rec
+
+def propRecursiveBoundaryKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% PropRecursiveBoundary.rec 0
+
+def propRecursiveBoundaryKernelCtor : Constructor where
+  name := propRecursiveBoundaryMkInfo.name
+  type := propRecursiveBoundaryMkInfo.type
+
+def propRecursiveBoundaryKernelType : InductiveType where
+  name := propRecursiveBoundaryInfo.name
+  type := propRecursiveBoundaryInfo.type
+  ctors := [propRecursiveBoundaryKernelCtor]
+
+theorem constructorValidityMatrix_kernel_shape :
+    (match constructorValidityMatrixInfo with
+    | .inductInfo info => (info.numParams, info.numIndices)
+    | _ => (0, 0)) = (2, 0) ∧
+      (match constructorValidityMatrixMkInfo with
+      | .ctorInfo info => info.numFields
+      | _ => 0) = 6 ∧
+      (match constructorValidityMatrixRecInfo with
+      | .recInfo info =>
+        (info.numParams, info.numIndices, info.numMotives,
+          info.numMinors, info.rules.length)
+      | _ => (0, 0, 0, 0, 0)) = (2, 0, 1, 1, 1) := by
+  exact ⟨rfl, rfl, rfl⟩
+
+theorem constructorValidityMatrix_recursive_positions_exact :
+    constructorValidityMatrixChecked.constructors[0].recursive.map
+      (fun position => (position.fieldIndex, position.binders.length)) =
+        [(2, 0), (3, 1)] := rfl
+
+theorem constructorValidityMatrix_kernel_rule_exact :
+    constructorValidityMatrixKernelRuleRhs =
+      constructorValidityMatrixGenerationChecked.generatedRules[0].rhs := rfl
+
+theorem propRecursiveBoundary_kernel_shape :
+    (match propRecursiveBoundaryInfo with
+    | .inductInfo info => (info.numParams, info.numIndices)
+    | _ => (0, 0)) = (1, 1) ∧
+      (match propRecursiveBoundaryMkInfo with
+      | .ctorInfo info => info.numFields
+      | _ => 0) = 2 ∧
+      (match propRecursiveBoundaryRecInfo with
+      | .recInfo info =>
+        (info.numParams, info.numIndices, info.numMotives,
+          info.numMinors, info.rules.length)
+      | _ => (0, 0, 0, 0, 0)) = (1, 1, 1, 1, 1) := by
+  exact ⟨rfl, rfl, rfl⟩
+
+theorem propRecursiveBoundary_recursive_positions_exact :
+    propRecursiveBoundaryChecked.constructors[0].recursive.map
+      (fun position => (position.fieldIndex, position.binders.length)) =
+        [(1, 1)] := rfl
+
+theorem propRecursiveBoundary_kernel_rule_exact :
+    propRecursiveBoundaryKernelRuleRhs =
+      propRecursiveBoundaryGenerationChecked.generatedRules[0].rhs := rfl
+
+/-! ## Positive ordinary and strengthened gates -/
+
+def constructorValidityMatrixContext : AddInductive.Context where
+  env := Kernel.Environment.ofConstants `_constructorValidityMatrix
+    ({} : ConstMap)
+  lparams := [`u]
+  safety := .safe
+  allowPrimitive := false
+
+def propRecursiveBoundaryContext : AddInductive.Context where
+  env := Kernel.Environment.ofConstants `_propRecursiveBoundary
+    ({} : ConstMap)
+  lparams := [`u]
+  safety := .safe
+  allowPrimitive := false
+
+def singletonCandidateExact (nparams : Nat) (source : InductiveType)
+    (context : AddInductive.Context) : Bool :=
+  match AddInductive.buildNormalizationCandidate nparams [source] 0 false
+      context with
+  | .error _ => false
+  | .ok candidate =>
+      candidate.families.singleton.familyType.type.view.equal source.type &&
+        candidate.families.singleton.constructors.toList
+          (fun _ constructor => constructor.type.view) ==
+            source.ctors.map (fun constructor => constructor.type)
+
+def singletonPreFamilyAccepted (nparams : Nat) (source : InductiveType)
+    (context : AddInductive.Context) : Bool :=
+  match AddInductive.buildNormalizationCandidate nparams [source] 0 false
+      context with
+  | .error _ => false
+  | .ok candidate =>
+      match AddInductive.checkInductiveTypes nparams #[source]
+          (fun stats =>
+            AddInductive.checkConstructorPreFamilySafety stats
+              candidate.families.singleton.familyType.type.view
+              candidate.families.singleton.constructors) context with
+      | .ok _ => true
+      | .error _ => false
+
+def singletonUniverseAccepted (nparams : Nat) (source : InductiveType)
+    (context : AddInductive.Context) : Bool :=
+  match AddInductive.checkInductiveTypes nparams #[source]
+      (fun stats => do
+        let familyEnv ← AddInductive.declareInductiveTypes stats nparams
+          #[source] 0 false
+        AddInductive.withEnv familyEnv do
+          AddInductive.checkConstructorUniverseListSemantics stats
+            source.ctors) context with
+  | .ok _ => true
+  | .error _ => false
+
+#guard singletonCandidateExact 2 constructorValidityMatrixKernelType
+  constructorValidityMatrixContext
+
+#guard singletonPreFamilyAccepted 2 constructorValidityMatrixKernelType
+  constructorValidityMatrixContext
+
+#guard singletonUniverseAccepted 2 constructorValidityMatrixKernelType
+  constructorValidityMatrixContext
+
+#guard singletonCandidateExact 1 propRecursiveBoundaryKernelType
+  propRecursiveBoundaryContext
+
+#guard singletonPreFamilyAccepted 1 propRecursiveBoundaryKernelType
+  propRecursiveBoundaryContext
+
+#guard singletonUniverseAccepted 1 propRecursiveBoundaryKernelType
+  propRecursiveBoundaryContext
+
+/-! ## Matching ordinary-producer rejections -/
+
+def spec05TypeBoxName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05TypeBox
+
+def spec05ProofBoxName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05ProofBox
+
+def spec05DepProofBoxName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05DepProofBox
+
+def spec05TypeBoxInfo : ConstantInfo := .axiomInfo {
+  name := spec05TypeBoxName
+  levelParams := []
+  type := .forallE `α (.sort (.succ .zero))
+    (.sort (.succ .zero)) .default
+  isUnsafe := false }
+
+def spec05ProofBoxInfo : ConstantInfo := .axiomInfo {
+  name := spec05ProofBoxName
+  levelParams := []
+  type := .forallE `α (.sort (.succ .zero)) (.sort .zero) .default
+  isUnsafe := false }
+
+def spec05DepProofBoxInfo : ConstantInfo := .axiomInfo {
+  name := spec05DepProofBoxName
+  levelParams := []
+  type := .forallE `α (.sort (.succ .zero))
+    (.forallE `value (.bvar 0) (.sort .zero) .default) .implicit
+  isUnsafe := false }
+
+def spec05NegativeMap : ConstMap :=
+  ((({} : ConstMap).insert spec05TypeBoxName spec05TypeBoxInfo).insert
+    spec05ProofBoxName spec05ProofBoxInfo).insert
+      spec05DepProofBoxName spec05DepProofBoxInfo
+
+def spec05NegativeContext : AddInductive.Context where
+  env := Kernel.Environment.ofConstants `_spec05Negative spec05NegativeMap
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+def spec05UnsafeNegativeContext : AddInductive.Context :=
+  { spec05NegativeContext with safety := .unsafe }
+
+def spec05NegativeType (name ctorName : Name) (ctorType : Expr) :
+    InductiveType where
+  name := name
+  type := .sort (.succ .zero)
+  ctors := [{ name := ctorName, type := ctorType }]
+
+def spec05NestedNegativeName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05NestedNegative
+
+def spec05NestedNegativeMkName : Name :=
+  .str spec05NestedNegativeName "mk"
+
+def spec05NestedNegativeConst : Expr :=
+  .const spec05NestedNegativeName []
+
+def spec05NestedNegativeField : Expr :=
+  .forallE `_
+    (.forallE `_ spec05NestedNegativeConst (.sort .zero) .default)
+    spec05NestedNegativeConst .default
+
+def spec05NestedNegativeType : InductiveType :=
+  spec05NegativeType spec05NestedNegativeName spec05NestedNegativeMkName
+    (.forallE `field spec05NestedNegativeField
+      spec05NestedNegativeConst .default)
+
+def spec05FamilyNonrecursiveName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05FamilyNonrecursive
+
+def spec05FamilyNonrecursiveMkName : Name :=
+  .str spec05FamilyNonrecursiveName "mk"
+
+def spec05FamilyNonrecursiveConst : Expr :=
+  .const spec05FamilyNonrecursiveName []
+
+def spec05FamilyNonrecursiveType : InductiveType :=
+  spec05NegativeType spec05FamilyNonrecursiveName
+    spec05FamilyNonrecursiveMkName
+    (.forallE `field
+      (.app (.const spec05TypeBoxName []) spec05FamilyNonrecursiveConst)
+      spec05FamilyNonrecursiveConst .default)
+
+def spec05FamilyProofName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05FamilyProof
+
+def spec05FamilyProofMkName : Name :=
+  .str spec05FamilyProofName "mk"
+
+def spec05FamilyProofConst : Expr :=
+  .const spec05FamilyProofName []
+
+def spec05FamilyProofType : InductiveType :=
+  spec05NegativeType spec05FamilyProofName spec05FamilyProofMkName
+    (.forallE `proof
+      (.app (.const spec05ProofBoxName []) spec05FamilyProofConst)
+      spec05FamilyProofConst .default)
+
+def spec05RecursiveDependencyName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05RecursiveDependency
+
+def spec05RecursiveDependencyMkName : Name :=
+  .str spec05RecursiveDependencyName "mk"
+
+def spec05RecursiveDependencyConst : Expr :=
+  .const spec05RecursiveDependencyName []
+
+def spec05RecursiveDependencyProof : Expr :=
+  .app (.app (.const spec05DepProofBoxName [])
+    spec05RecursiveDependencyConst) (.bvar 0)
+
+def spec05RecursiveDependencyType : InductiveType :=
+  spec05NegativeType spec05RecursiveDependencyName
+    spec05RecursiveDependencyMkName
+    (.forallE `recursive spec05RecursiveDependencyConst
+      (.forallE `proof spec05RecursiveDependencyProof
+        spec05RecursiveDependencyConst .default) .default)
+
+def spec05UniverseRejectName : Name :=
+  `Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05UniverseReject
+
+def spec05UniverseRejectMkName : Name :=
+  .str spec05UniverseRejectName "mk"
+
+def spec05UniverseRejectConst : Expr :=
+  .const spec05UniverseRejectName []
+
+def spec05UniverseRejectType : InductiveType :=
+  spec05NegativeType spec05UniverseRejectName spec05UniverseRejectMkName
+    (.forallE `α (.sort (.succ .zero)) spec05UniverseRejectConst .default)
+
+def spec05CandidateError (source : InductiveType) : Option String :=
+  match AddInductive.buildNormalizationCandidate 0 [source] 0 false
+      spec05NegativeContext with
+  | .error (.other message) => some message
+  | _ => none
+
+#guard spec05CandidateError spec05NestedNegativeType = some
+  "arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05NestedNegative.mk' has a non positive occurrence of the datatypes being declared"
+
+#guard spec05CandidateError spec05FamilyNonrecursiveType = some
+  "arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05FamilyNonrecursive.mk' has a non valid occurrence of the datatypes being declared"
+
+#guard spec05CandidateError spec05FamilyProofType = some
+  "arg #1 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05FamilyProof.mk' has a non valid occurrence of the datatypes being declared"
+
+#guard spec05CandidateError spec05RecursiveDependencyType = some
+  "arg #2 of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05RecursiveDependency.mk' has a non valid occurrence of the datatypes being declared"
+
+#guard spec05CandidateError spec05UniverseRejectType = some
+  "universe level of type_of(arg #1) of 'Ix.Theory.Named.InductiveFixtures.KernelDifferential.Spec05UniverseReject.mk' is too big for the corresponding inductive datatype"
+
+def spec05RecursiveDependencyPreFamilyError : Option String :=
+  match AddInductive.buildNormalizationCandidate 0
+      [spec05RecursiveDependencyType] 0 true spec05UnsafeNegativeContext with
+  | .error _ => none
+  | .ok candidate =>
+      match AddInductive.checkInductiveTypes 0
+          #[spec05RecursiveDependencyType]
+          (fun stats =>
+            AddInductive.checkConstructorPreFamilySafety stats
+              candidate.families.singleton.familyType.type.view
+              candidate.families.singleton.constructors)
+          spec05UnsafeNegativeContext with
+      | .error (.other message) => some message
+      | _ => none
+
+#guard spec05RecursiveDependencyPreFamilyError =
+  some "constructor depends on an omitted recursive local"
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/Elimination.lean b/Ix/Theory/Named/Verify/Environment/Elimination.lean
new file mode 100644
index 000000000..6ab6559b4
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/Elimination.lean
@@ -0,0 +1,244 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Reference.Inductive.EliminationTrace
+import Ix.Theory.Named.Inductive
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+
+namespace AddInductive
+
+/-- Compatibility name for Theory's presentation of the Boolean returned by
+the ordinary large-eliminator checker. -/
+@[deprecated VInductDecl.ElimMode.ofBool (since := "2026-08-11")]
+abbrev checkerElimMode : Bool → VInductDecl.ElimMode :=
+  VInductDecl.ElimMode.ofBool
+
+/-- Lightweight alignment for an exact `getElimLevel` execution when the
+normalization statistics are already pinned independently. This is useful for
+the never-zero branch, which returns before inspecting any constructor. -/
+structure CheckerElimLevelRun
+    {source : VInductDecl} (generation : VInductDecl.GenerationChecked source)
+    {stats : InductiveStats} {indTypes : Array InductiveType}
+    {context : Context}
+    (execution : ElimLevelExecution stats indTypes context) : Type where
+  sourceUvars_eq : source.uvars = context.lparams.length
+  mode_eq : generation.elimination =
+    VInductDecl.ElimMode.ofBool execution.large.result
+  recUvars_eq : generation.recUvars =
+    (getRecLevelParams execution.level context.lparams).length
+  recLevels_eq :
+    (getRecLevels execution.level stats.levels).mapM
+      (VLevel.ofLevel (getRecLevelParams execution.level context.lparams)) =
+        some generation.recLevels
+
+namespace CheckerElimLevelRun
+
+/-- Decide the complete mode and level-layout alignment from the retained
+ordinary execution. -/
+def build?
+    {source : VInductDecl} (generation : VInductDecl.GenerationChecked source)
+    {stats : InductiveStats} {indTypes : Array InductiveType}
+    {context : Context}
+    (execution : ElimLevelExecution stats indTypes context) :
+    Option (CheckerElimLevelRun generation execution) := do
+  if huvars : source.uvars = context.lparams.length then
+    if hmode : generation.elimination =
+        VInductDecl.ElimMode.ofBool execution.large.result then
+      if hrecUvars : generation.recUvars =
+          (getRecLevelParams execution.level context.lparams).length then
+        if hlevels :
+            (getRecLevels execution.level stats.levels).mapM
+              (VLevel.ofLevel
+                (getRecLevelParams execution.level context.lparams)) =
+              some generation.recLevels then
+          some {
+            sourceUvars_eq := huvars
+            mode_eq := hmode
+            recUvars_eq := hrecUvars
+            recLevels_eq := hlevels }
+        else none
+      else none
+    else none
+  else none
+
+theorem large_result_iff
+    (run : CheckerElimLevelRun generation execution) :
+    execution.large.result = true ↔
+      generation.elimination = VInductDecl.ElimMode.large := by
+  cases hresult : execution.large.result with
+  | false =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.small := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+  | true =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.large := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+
+theorem small_result_iff
+    (run : CheckerElimLevelRun generation execution) :
+    execution.large.result = false ↔
+      generation.elimination = VInductDecl.ElimMode.small := by
+  cases hresult : execution.large.result with
+  | false =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.small := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+  | true =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.large := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+
+end CheckerElimLevelRun
+
+/-- Exact alignment between the ordinary K-target execution and the Boolean
+retained by Theory generation. This flag is certified independently of the
+elimination-mode decision. -/
+structure CheckerKTargetRun
+    {source : VInductDecl} (generation : VInductDecl.GenerationChecked source)
+    {stats : InductiveStats} {indTypes : Array InductiveType}
+    {context : Context}
+    (execution : KTargetExecution stats indTypes context) : Type where
+  result_eq : generation.kTarget = execution.result
+
+namespace CheckerKTargetRun
+
+def build?
+    {source : VInductDecl} (generation : VInductDecl.GenerationChecked source)
+    {stats : InductiveStats} {indTypes : Array InductiveType}
+    {context : Context}
+    (execution : KTargetExecution stats indTypes context) :
+    Option (CheckerKTargetRun generation execution) :=
+  if h : generation.kTarget = execution.result then
+    some ⟨h⟩
+  else
+    none
+
+theorem result_true_iff
+    (run : CheckerKTargetRun generation execution) :
+    execution.result = true ↔ generation.kTarget = true := by
+  rw [run.result_eq]
+
+theorem result_false_iff
+    (run : CheckerKTargetRun generation execution) :
+    execution.result = false ↔ generation.kTarget = false := by
+  rw [run.result_eq]
+
+end CheckerKTargetRun
+
+/-- Executable alignment between an exact ordinary elimination run and the
+mode/K-target/universe layout consumed by one Theory generation artifact.
+
+The operational side owns the real `ensureType` observations, selected fresh
+level name, K-target decision, recursive-call levels, and stored metadata
+parameter order. The equations below are checked data, so a Theory generation
+whose mode, K flag, or numeric universe layout disagrees with that run cannot
+inhabit this record. -/
+structure CheckerEliminationRun
+    {source : VInductDecl} (generation : VInductDecl.GenerationChecked source)
+    {nparams : Nat} {types : List InductiveType}
+    {numNested : Nat} {isUnsafe : Bool} {candidateContext : Context}
+    (execution : NormalizationEliminationExecution nparams types numNested
+      isUnsafe candidateContext) : Type where
+  nparams_eq : nparams = source.nparams
+  sourceUvars_eq : source.uvars =
+    execution.normalization.validationContext.lparams.length
+  mode_eq : generation.elimination =
+    VInductDecl.ElimMode.ofBool execution.elimination.large.result
+  kTarget_eq : generation.kTarget = execution.kTarget.result
+  recUvars_eq : generation.recUvars = execution.recLevelParams.length
+  recLevels_eq : execution.recLevels.mapM
+    (VLevel.ofLevel execution.recLevelParams) = some generation.recLevels
+
+namespace CheckerEliminationRun
+
+/-- Build the alignment by deciding every equality rather than asking a
+fixture or caller to supply a mode or level permutation. -/
+def build?
+    {source : VInductDecl} (generation : VInductDecl.GenerationChecked source)
+    {nparams : Nat} {types : List InductiveType}
+    {numNested : Nat} {isUnsafe : Bool} {candidateContext : Context}
+    (execution : NormalizationEliminationExecution nparams types numNested
+      isUnsafe candidateContext) :
+    Option (CheckerEliminationRun generation execution) := do
+  if hparams : nparams = source.nparams then
+    if huvars : source.uvars =
+        execution.normalization.validationContext.lparams.length then
+      if hmode : generation.elimination =
+          VInductDecl.ElimMode.ofBool execution.elimination.large.result then
+        if hkTarget : generation.kTarget = execution.kTarget.result then
+          if hrecUvars : generation.recUvars =
+              execution.recLevelParams.length then
+            if hlevels : execution.recLevels.mapM
+                (VLevel.ofLevel execution.recLevelParams) =
+                  some generation.recLevels then
+              some {
+                nparams_eq := hparams
+                sourceUvars_eq := huvars
+                mode_eq := hmode
+                kTarget_eq := hkTarget
+                recUvars_eq := hrecUvars
+                recLevels_eq := hlevels }
+            else none
+          else none
+        else none
+      else none
+    else none
+  else none
+
+theorem large_result_iff
+    (run : CheckerEliminationRun generation execution) :
+    execution.elimination.large.result = true ↔
+      generation.elimination = VInductDecl.ElimMode.large := by
+  cases hresult : execution.elimination.large.result with
+  | false =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.small := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+  | true =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.large := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+
+theorem small_result_iff
+    (run : CheckerEliminationRun generation execution) :
+    execution.elimination.large.result = false ↔
+      generation.elimination = VInductDecl.ElimMode.small := by
+  cases hresult : execution.elimination.large.result with
+  | false =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.small := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+  | true =>
+      have hmode : generation.elimination = VInductDecl.ElimMode.large := by
+        simpa [hresult] using run.mode_eq
+      simp [hmode]
+
+theorem kTarget_result_true_iff
+    (run : CheckerEliminationRun generation execution) :
+    execution.kTarget.result = true ↔ generation.kTarget = true := by
+  rw [run.kTarget_eq]
+
+theorem kTarget_result_false_iff
+    (run : CheckerEliminationRun generation execution) :
+    execution.kTarget.result = false ↔ generation.kTarget = false := by
+  rw [run.kTarget_eq]
+
+end CheckerEliminationRun
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CheckerEliminationRun.large_result_iff [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CheckerElimLevelRun.large_result_iff [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.AddInductive.CheckerKTargetRun.result_true_iff [propext, Classical.choice, Quot.sound]
+
+end AddInductive
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesCommon.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesCommon.lean
new file mode 100644
index 000000000..efacf6f1c
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesCommon.lean
@@ -0,0 +1,65 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.Elimination
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+universe u
+
+/-- A source-universe-bearing small eliminator. Or has no source universes,
+so this fixture distinguishes "no fresh level" from "no levels at all". -/
+inductive Spec06SmallSource (α : Sort u) : Prop where
+  | left : Spec06SmallSource α
+  | right : Spec06SmallSource α
+
+def recursorShape06 (info : ConstantInfo) :
+    List Name × Nat × Nat × Nat × Nat × Bool × List (Name × Nat) :=
+  match info with
+  | .recInfo rec =>
+      (rec.levelParams, rec.numParams, rec.numIndices, rec.numMotives,
+        rec.numMinors, rec.k,
+        rec.rules.map fun rule => (rule.ctor, rule.nfields))
+  | _ => ([], 0, 0, 0, 0, false, [])
+
+def spec06KernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_spec06 {}
+
+def spec06Context (lparams : List Name) : AddInductive.Context where
+  env := spec06KernelEnv
+  lparams := lparams
+  safety := .safe
+  allowPrimitive := false
+
+example : AddInductive.getFreshElimParam [] = `u := by native_decide
+example : AddInductive.getFreshElimParam [`u] = `u_1 := by native_decide
+example : AddInductive.getFreshElimParam [`u, `u_1] = `u_2 := by native_decide
+
+/-- Decidable structural equality for the exact kernel level lists retained by
+the fixtures. `Lean.Level` intentionally has no `DecidableEq` instance. -/
+def levelListStructEq06 : List Level → List Level → Bool
+  | [], [] => true
+  | u :: us, v :: vs =>
+      Level.isStructEq u v && levelListStructEq06 us vs
+  | _, _ => false
+
+theorem levelListStructEq06_eq {us vs : List Level}
+    (h : levelListStructEq06 us vs) : us = vs := by
+  induction us generalizing vs with
+  | nil => cases vs <;> simp_all [levelListStructEq06]
+  | cons u us ih =>
+      cases vs with
+      | nil => simp [levelListStructEq06] at h
+      | cons v vs =>
+          simp only [levelListStructEq06, Bool.and_eq_true] at h
+          cases Level.isStructEq_eq h.1
+          cases ih h.2
+          rfl
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesEdges.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesEdges.lean
new file mode 100644
index 000000000..4f9c11fa7
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesEdges.lean
@@ -0,0 +1,249 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesCommon
+
+open Ix.Theory (VLevel)
+
+/-! Exact Spec-06C `Unit`/`PUnit` and `Empty` edge-shape fixtures.
+
+`Unit` is a reducible alias for `PUnit` on this Lean revision. The alias has
+definition metadata but no independent inductive/constructor/recursor records,
+so the real one-constructor transaction is checked under `PUnit`. `Empty`
+supplies the matching zero-constructor transaction. -/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/-- Translate the declaration-first universe order produced by `vconst` to
+the fresh-first order stored by large recursor metadata. -/
+private def permC06C (constant : VConstant) (levels : List VLevel) :
+    VConstant :=
+  ⟨constant.uvars, constant.type.instL levels⟩
+
+/-! ## Unit is exactly the reducible PUnit alias -/
+
+def unitAliasInfo06C : DefinitionVal := kernelDefVal% Unit
+
+/-- Pin every field of the actual `Unit` definition metadata. In particular,
+there is no fabricated alias-level recursor for the edge fixture. -/
+example :
+    (unitAliasInfo06C.name, unitAliasInfo06C.levelParams,
+      unitAliasInfo06C.type, unitAliasInfo06C.value,
+      unitAliasInfo06C.hints, unitAliasInfo06C.safety,
+      unitAliasInfo06C.all) =
+    (``Unit, [], .sort (.succ .zero),
+      .const ``PUnit [.succ .zero], .abbrev, .safe, [``Unit]) := rfl
+
+/-! ## Complete kernel metadata shapes -/
+
+def inductiveShape06C (info : ConstantInfo) :
+    Option (Name × List Name × Nat × Nat × List Name × List Name × Nat ×
+      Bool × Bool × Bool) :=
+  match info with
+  | .inductInfo induct => some
+      (induct.name, induct.levelParams, induct.numParams, induct.numIndices,
+        induct.all, induct.ctors, induct.numNested, induct.isRec,
+        induct.isUnsafe, induct.isReflexive)
+  | _ => none
+
+def constructorShape06C (info : ConstantInfo) :
+    Option (Name × List Name × Name × Nat × Nat × Nat × Bool) :=
+  match info with
+  | .ctorInfo ctor => some
+      (ctor.name, ctor.levelParams, ctor.induct, ctor.cidx, ctor.numParams,
+        ctor.numFields, ctor.isUnsafe)
+  | _ => none
+
+def completeRecursorShape06C (info : ConstantInfo) :
+    Option (Name × List Name × List Name × Nat × Nat × Nat × Nat × Bool ×
+      Bool × List (Name × Nat)) :=
+  match info with
+  | .recInfo rec => some
+      (rec.name, rec.levelParams, rec.all, rec.numParams, rec.numIndices,
+        rec.numMotives, rec.numMinors, rec.k, rec.isUnsafe,
+        rec.rules.map fun rule => (rule.ctor, rule.nfields))
+  | _ => none
+
+/-! ## PUnit: one constructor, one minor, one rule -/
+
+def punitInfo06C : ConstantInfo := kernelInductInfo% PUnit
+def punitCtorInfo06C : ConstantInfo := kernelCtorInfo% PUnit.unit
+def punitRecInfo06C : ConstantInfo := kernelRecInfo% PUnit.rec
+def punitRuleRhs06C : VExpr := kernelRecRuleRhs% PUnit.rec 0
+
+example : inductiveShape06C punitInfo06C = some
+    (``PUnit, [`u], 0, 0, [``PUnit], [``PUnit.unit], 0, false, false,
+      false) := rfl
+example : punitInfo06C.type = .sort (.param `u) := rfl
+example : constructorShape06C punitCtorInfo06C = some
+    (``PUnit.unit, [`u], ``PUnit, 0, 0, 0, false) := rfl
+example : punitCtorInfo06C.type = .const ``PUnit [.param `u] := rfl
+example : completeRecursorShape06C punitRecInfo06C = some
+    (``PUnit.rec, [`u_1, `u], [``PUnit], 0, 0, 1, 1, false, false,
+      [(``PUnit.unit, 0)]) := rfl
+
+example : punitChecked.params = [] := rfl
+example : punitChecked.indices = [] := rfl
+example : punitChecked.constructors.length = 1 := rfl
+example : punitChecked.constructors[0].fields = [] := rfl
+example : punitChecked.constructors[0].recursive = [] := rfl
+example : punitGenerationChecked.block.ctorPairs.length = 1 := rfl
+example : punitGenerationChecked.minorTypes =
+    [.app (.bvar 0) (.const ``PUnit.unit [.param 1])] := rfl
+example : punitGenerationChecked.generatedRules.length = 1 := rfl
+
+/-- The complete generated type agrees with the real recursor, including the
+fresh-first `[u_1, u]` metadata order. -/
+example : punitGenerationChecked.recursor =
+    permC06C (vconst(type_of% @PUnit.rec)) [.param 1, .param 0] := rfl
+
+/-- Removing the three outer binders exposes motive, sole minor, then major.
+The minor has no field or induction-hypothesis binders. -/
+example : VExpr.telN 3 punitGenerationChecked.recType =
+    [punitGenerationChecked.motiveType,
+      .app (.bvar 0) (.const ``PUnit.unit [.param 1]),
+      .const ``PUnit [.param 1]] := rfl
+
+example : punitRuleRhs06C =
+    punitGenerationChecked.generatedRules[0].rhs := rfl
+
+def punitKernelType06C : InductiveType where
+  name := punitInfo06C.name
+  type := punitInfo06C.type
+  ctors := [{ name := punitCtorInfo06C.name, type := punitCtorInfo06C.type }]
+
+def punitEliminationResult06C :=
+  AddInductive.NormalizationEliminationExecution.buildExecution 0
+    [punitKernelType06C] 0 false (spec06Context [`u])
+
+theorem punitEliminationResult06C_isOk :
+    punitEliminationResult06C.isOk = true := by
+  native_decide
+
+def punitProducedExecution06C :
+    { execution // punitEliminationResult06C = .ok execution } :=
+  match h : punitEliminationResult06C with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := punitEliminationResult06C_isOk
+      rw [h] at hOk
+      contradiction
+
+def punitExecution06C := punitProducedExecution06C.val
+
+def punitAlignment06C : AddInductive.CheckerEliminationRun
+    punitGenerationChecked punitExecution06C :=
+  (AddInductive.CheckerEliminationRun.build? punitGenerationChecked
+    punitExecution06C).get (by native_decide)
+
+def punitLargeSingleton06C :=
+  punitExecution06C.elimination.large.singleton.get (by native_decide)
+
+example : punitExecution06C.normalization.stats.params.size = 0 := by
+  native_decide
+example : punitExecution06C.normalization.stats.nindices = #[0] := by
+  native_decide
+example : punitExecution06C.normalization.stats.isNotZero = false := by
+  native_decide
+example : punitExecution06C.elimination.large.result = true := by
+  native_decide
+example : punitLargeSingleton06C.trace.parameterCount = 0 := by
+  native_decide
+example : punitLargeSingleton06C.trace.proofFieldCount = 0 := by
+  native_decide
+example : punitLargeSingleton06C.trace.dataFieldCount = 0 := by
+  native_decide
+example : punitExecution06C.kTarget.result = false := by native_decide
+example : punitExecution06C.kTarget.singleton = none := by native_decide
+example : punitExecution06C.elimination.level = .param `u_1 :=
+  Level.isStructEq_eq (by native_decide)
+example : punitExecution06C.recLevelParams = [`u_1, `u] := by
+  native_decide
+example : punitExecution06C.recLevels = [.param `u_1, .param `u] :=
+  levelListStructEq06_eq (by native_decide)
+example : punitGenerationChecked.elimination = .large :=
+  punitAlignment06C.large_result_iff.mp (by native_decide)
+example : punitGenerationChecked.kTarget = false :=
+  punitAlignment06C.kTarget_result_false_iff.mp (by native_decide)
+
+/-! ## Empty: zero constructors, zero minors, zero rules -/
+
+def emptyInfo06C : ConstantInfo := kernelInductInfo% Empty
+def emptyRecInfo06C : ConstantInfo := kernelRecInfo% Empty.rec
+
+example : inductiveShape06C emptyInfo06C = some
+    (``Empty, [], 0, 0, [``Empty], [], 0, false, false, false) := rfl
+example : emptyInfo06C.type = .sort (.succ .zero) := rfl
+example : completeRecursorShape06C emptyRecInfo06C = some
+    (``Empty.rec, [`u], [``Empty], 0, 0, 1, 0, false, false, []) := rfl
+
+example : emptyChecked.params = [] := rfl
+example : emptyChecked.indices = [] := rfl
+example : emptyChecked.constructors = [] := rfl
+example : emptyGenerationChecked.block.ctorPairs = [] := rfl
+example : emptyGenerationChecked.minorTypes = [] := rfl
+example : emptyGenerationChecked.generatedRules = [] := rfl
+example : emptyGenerationChecked.recursor = vconst(type_of% @Empty.rec) := rfl
+
+/-- Empty elimination has no synthetic constructor minor: motive is followed
+immediately by the major. -/
+example : VExpr.telN 2 emptyGenerationChecked.recType =
+    [emptyGenerationChecked.motiveType, .const ``Empty []] := rfl
+
+def emptyKernelType06C : InductiveType where
+  name := emptyInfo06C.name
+  type := emptyInfo06C.type
+  ctors := []
+
+def emptyEliminationResult06C :=
+  AddInductive.NormalizationEliminationExecution.buildExecution 0
+    [emptyKernelType06C] 0 false (spec06Context [])
+
+theorem emptyEliminationResult06C_isOk :
+    emptyEliminationResult06C.isOk = true := by
+  native_decide
+
+def emptyProducedExecution06C :
+    { execution // emptyEliminationResult06C = .ok execution } :=
+  match h : emptyEliminationResult06C with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := emptyEliminationResult06C_isOk
+      rw [h] at hOk
+      contradiction
+
+def emptyExecution06C := emptyProducedExecution06C.val
+
+def emptyAlignment06C : AddInductive.CheckerEliminationRun
+    emptyGenerationChecked emptyExecution06C :=
+  (AddInductive.CheckerEliminationRun.build? emptyGenerationChecked
+    emptyExecution06C).get (by native_decide)
+
+example : emptyExecution06C.normalization.stats.params.size = 0 := by
+  native_decide
+example : emptyExecution06C.normalization.stats.nindices = #[0] := by
+  native_decide
+example : emptyExecution06C.normalization.stats.isNotZero = true := by
+  native_decide
+example : emptyExecution06C.elimination.large.result = true := by
+  native_decide
+example : emptyExecution06C.elimination.large.singleton = none := by
+  native_decide
+example : emptyExecution06C.kTarget.result = false := by native_decide
+example : emptyExecution06C.kTarget.singleton = none := by native_decide
+example : emptyExecution06C.elimination.level = .param `u :=
+  Level.isStructEq_eq (by native_decide)
+example : emptyExecution06C.recLevelParams = [`u] := by native_decide
+example : emptyExecution06C.recLevels = [.param `u] :=
+  levelListStructEq06_eq (by native_decide)
+example : emptyGenerationChecked.elimination = .large :=
+  emptyAlignment06C.large_result_iff.mp (by native_decide)
+example : emptyGenerationChecked.kTarget = false :=
+  emptyAlignment06C.kTarget_result_false_iff.mp (by native_decide)
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesEq.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesEq.lean
new file mode 100644
index 000000000..11b50dbb2
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesEq.lean
@@ -0,0 +1,65 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesCommon
+
+/-! Exact Spec-06B Eq differential fixture. -/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/-! Eq: indexed singleton large elimination and fresh-first order. -/
+
+def eqKernelType06 : InductiveType where
+  name := eqInfo.name
+  type := eqInfo.type
+  ctors := [{ name := eqReflInfo.name, type := eqReflInfo.type }]
+
+def eqEliminationResult06 :=
+  AddInductive.NormalizationEliminationExecution.buildExecution 2
+    [eqKernelType06] 0 false (spec06Context eqInfo.levelParams)
+
+theorem eqEliminationResult06_isOk : eqEliminationResult06.isOk = true := by
+  native_decide
+
+def eqProducedExecution06 :
+    { execution // eqEliminationResult06 = .ok execution } :=
+  match h : eqEliminationResult06 with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := eqEliminationResult06_isOk
+      rw [h] at hOk
+      contradiction
+
+def eqExecution06 := eqProducedExecution06.val
+
+def eqAlignment06 :
+    AddInductive.CheckerEliminationRun eqGenerationChecked eqExecution06 :=
+  (AddInductive.CheckerEliminationRun.build? eqGenerationChecked eqExecution06).get
+    (by native_decide)
+
+def eqKTargetSingleton06 :=
+  eqExecution06.kTarget.singleton.get (by native_decide)
+
+example : eqExecution06.elimination.large.result = true := by native_decide
+example : eqExecution06.kTarget.result = true := by native_decide
+example : eqKTargetSingleton06.trace.parameterCount = 2 := by native_decide
+example : eqKTargetSingleton06.trace.fieldCount = 0 := by native_decide
+example : eqExecution06.elimination.level = .param `u :=
+  Level.isStructEq_eq (by native_decide)
+example : eqExecution06.recLevelParams = [`u, `u_1] := by native_decide
+example : eqExecution06.recLevels = [.param `u, .param `u_1] :=
+  levelListStructEq06_eq (by native_decide)
+example : recursorShape06 eqRecInfo =
+    ([`u, `u_1], 2, 1, 1, 1, true, [(``Eq.refl, 0)]) := rfl
+example : eqReflKernelRuleRhs = eqChecked.generatedRules[0].rhs := rfl
+example : eqGenerationChecked.elimination = .large :=
+  eqAlignment06.large_result_iff.mp (by native_decide)
+example : eqGenerationChecked.kTarget = true :=
+  eqAlignment06.kTarget_result_true_iff.mp (by native_decide)
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesEqNat.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesEqNat.lean
new file mode 100644
index 000000000..ba3fbfbc4
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesEqNat.lean
@@ -0,0 +1,10 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesEq
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesNat
+
+/-! Umbrella for the exact Spec-06A Eq and Nat differential fixtures. -/
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesNat.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesNat.lean
new file mode 100644
index 000000000..5da576adb
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesNat.lean
@@ -0,0 +1,114 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesCommon
+
+/-! Exact Spec-06B Nat never-zero elimination and non-K fixture. -/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/-! Nat's nonzero result universe takes the immediate large-elimination
+branch. The exact singleton statistics and source levels are pinned directly
+so this replay tests that branch without compiling the unrelated full
+normalization trace a second time. -/
+
+def natKernelType06 : InductiveType where
+  name := natInfo.name
+  type := natInfo.type
+  ctors := [
+    { name := natZeroInfo.name, type := natZeroInfo.type },
+    { name := natSuccInfo.name, type := natSuccInfo.type }]
+
+def natNeverZeroStats06 : AddInductive.InductiveStats :=
+  AddInductive.singletonInductiveStats (spec06Context []) natKernelType06
+    (.succ .zero)
+
+def natElimLevelResult06 :=
+  AddInductive.ElimLevelExecution.buildExecution natNeverZeroStats06
+    #[natKernelType06] (spec06Context [])
+
+theorem natElimLevelResult06_isOk : natElimLevelResult06.isOk = true := by
+  native_decide
+
+def natProducedElimLevel06 :
+    { execution // natElimLevelResult06 = .ok execution } :=
+  match h : natElimLevelResult06 with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := natElimLevelResult06_isOk
+      rw [h] at hOk
+      contradiction
+
+def natElimLevelExecution06 := natProducedElimLevel06.val
+
+def natElimAlignmentResult06 :=
+  AddInductive.CheckerElimLevelRun.build? natGenerationChecked
+    natElimLevelExecution06
+
+theorem natElimAlignmentResult06_isSome :
+    natElimAlignmentResult06.isSome = true := by
+  native_decide
+
+def natElimAlignment06 : AddInductive.CheckerElimLevelRun
+    natGenerationChecked natElimLevelExecution06 :=
+  natElimAlignmentResult06.get natElimAlignmentResult06_isSome
+
+def natKTargetResult06 :=
+  AddInductive.KTargetExecution.buildExecution natNeverZeroStats06
+    #[natKernelType06] (spec06Context [])
+
+theorem natKTargetResult06_isOk : natKTargetResult06.isOk = true := by
+  native_decide
+
+def natProducedKTarget06 :
+    { execution // natKTargetResult06 = .ok execution } :=
+  match h : natKTargetResult06 with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := natKTargetResult06_isOk
+      rw [h] at hOk
+      contradiction
+
+def natKTargetExecution06 := natProducedKTarget06.val
+
+def natKTargetAlignmentResult06 :=
+  AddInductive.CheckerKTargetRun.build? natGenerationChecked
+    natKTargetExecution06
+
+theorem natKTargetAlignmentResult06_isSome :
+    natKTargetAlignmentResult06.isSome = true := by
+  native_decide
+
+def natKTargetAlignment06 : AddInductive.CheckerKTargetRun
+    natGenerationChecked natKTargetExecution06 :=
+  natKTargetAlignmentResult06.get natKTargetAlignmentResult06_isSome
+
+example : natNeverZeroStats06.isNotZero = true := rfl
+example : natNeverZeroStats06.resultLevel = .succ .zero := rfl
+example : natKernelType06.type = .sort (.succ .zero) := rfl
+example : natChecked.resultLevel = .succ .zero := rfl
+example : natElimLevelExecution06.large.result = true := by native_decide
+example : natKTargetExecution06.result = false := by native_decide
+example : natKTargetExecution06.singleton = none := by native_decide
+example : natElimLevelExecution06.level = .param `u :=
+  Level.isStructEq_eq (by native_decide)
+example : AddInductive.getRecLevelParams natElimLevelExecution06.level [] =
+    [`u] := by native_decide
+example : AddInductive.getRecLevels natElimLevelExecution06.level [] =
+    [.param `u] := levelListStructEq06_eq (by native_decide)
+example : recursorShape06 natRecInfo =
+    ([`u], 0, 0, 1, 2, false,
+      [(``Nat.zero, 0), (``Nat.succ, 1)]) := rfl
+example : natZeroKernelRuleRhs = natChecked.generatedRules[0].rhs := rfl
+example : natSuccKernelRuleRhs = natChecked.generatedRules[1].rhs := rfl
+example : natGenerationChecked.elimination = .large :=
+  natElimAlignment06.large_result_iff.mp (by native_decide)
+example : natGenerationChecked.kTarget = false :=
+  natKTargetAlignment06.result_false_iff.mp (by native_decide)
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesOrAnd.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesOrAnd.lean
new file mode 100644
index 000000000..3688cf991
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesOrAnd.lean
@@ -0,0 +1,137 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesCommon
+
+/-! Exact Spec-06B Or/And differential fixtures. -/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/-! ## Or: Prop-only elimination -/
+
+def orInfo06 : ConstantInfo := kernelInductInfo% Or
+def orInlInfo06 : ConstantInfo := kernelCtorInfo% Or.inl
+def orInrInfo06 : ConstantInfo := kernelCtorInfo% Or.inr
+def orRecInfo06 : ConstantInfo := kernelRecInfo% Or.rec
+def orInlKernelRuleRhs06 : VExpr := kernelRecRuleRhs% Or.rec 0
+def orInrKernelRuleRhs06 : VExpr := kernelRecRuleRhs% Or.rec 1
+
+def orKernelType06 : InductiveType where
+  name := orInfo06.name
+  type := orInfo06.type
+  ctors := [
+    { name := orInlInfo06.name, type := orInlInfo06.type },
+    { name := orInrInfo06.name, type := orInrInfo06.type }]
+
+def orEliminationResult06 :=
+  AddInductive.NormalizationEliminationExecution.buildExecution 2
+    [orKernelType06] 0 false (spec06Context orInfo06.levelParams)
+
+theorem orEliminationResult06_isOk : orEliminationResult06.isOk = true := by
+  native_decide
+
+def orProducedExecution06 :
+    { execution // orEliminationResult06 = .ok execution } :=
+  match h : orEliminationResult06 with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := orEliminationResult06_isOk
+      rw [h] at hOk
+      contradiction
+
+def orExecution06 := orProducedExecution06.val
+
+def orGeneration06 : VInductDecl.GenerationChecked orDecl :=
+  (VInductDecl.identityGeneration? orDecl).get (by decide)
+
+def orAlignment06 :
+    AddInductive.CheckerEliminationRun orGeneration06 orExecution06 :=
+  (AddInductive.CheckerEliminationRun.build? orGeneration06 orExecution06).get
+    (by native_decide)
+
+example : orExecution06.elimination.large.result = false := by native_decide
+example : orExecution06.kTarget.result = false := by native_decide
+example : orExecution06.kTarget.singleton = none := by native_decide
+example : orExecution06.elimination.level = .zero :=
+  Level.isStructEq_eq (by native_decide)
+example : orExecution06.recLevelParams = [] := by native_decide
+example : orExecution06.recLevels = [] := by native_decide
+example : recursorShape06 orRecInfo06 =
+    ([], 2, 0, 1, 2, false, [(``Or.inl, 1), (``Or.inr, 1)]) := rfl
+example : orInlKernelRuleRhs06 = orChecked.generatedRules[0].rhs := rfl
+example : orInrKernelRuleRhs06 = orChecked.generatedRules[1].rhs := rfl
+example : orGeneration06.elimination = .small :=
+  orAlignment06.small_result_iff.mp (by native_decide)
+example : orGeneration06.kTarget = false :=
+  orAlignment06.kTarget_result_false_iff.mp (by native_decide)
+
+/-! ## And: singleton proof fields permit large elimination -/
+
+def andInfo06 : ConstantInfo := kernelInductInfo% And
+def andIntroInfo06 : ConstantInfo := kernelCtorInfo% And.intro
+def andRecInfo06 : ConstantInfo := kernelRecInfo% And.rec
+def andKernelRuleRhs06 : VExpr := kernelRecRuleRhs% And.rec 0
+
+def andKernelType06 : InductiveType where
+  name := andInfo06.name
+  type := andInfo06.type
+  ctors := [{ name := andIntroInfo06.name, type := andIntroInfo06.type }]
+
+def andEliminationResult06 :=
+  AddInductive.NormalizationEliminationExecution.buildExecution 2
+    [andKernelType06] 0 false (spec06Context andInfo06.levelParams)
+
+theorem andEliminationResult06_isOk : andEliminationResult06.isOk = true := by
+  native_decide
+
+def andProducedExecution06 :
+    { execution // andEliminationResult06 = .ok execution } :=
+  match h : andEliminationResult06 with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := andEliminationResult06_isOk
+      rw [h] at hOk
+      contradiction
+
+def andExecution06 := andProducedExecution06.val
+
+def andGeneration06 : VInductDecl.GenerationChecked andDecl :=
+  (VInductDecl.identityGeneration? andDecl).get (by decide)
+
+def andAlignment06 :
+    AddInductive.CheckerEliminationRun andGeneration06 andExecution06 :=
+  (AddInductive.CheckerEliminationRun.build? andGeneration06 andExecution06).get
+    (by native_decide)
+
+def andSingletonExecution06 :=
+  andExecution06.elimination.large.singleton.get (by native_decide)
+
+def andKTargetSingleton06 :=
+  andExecution06.kTarget.singleton.get (by native_decide)
+
+example : andExecution06.elimination.large.result = true := by native_decide
+example : andExecution06.kTarget.result = false := by native_decide
+example : andKTargetSingleton06.trace.parameterCount = 2 := by native_decide
+example : andKTargetSingleton06.trace.fieldCount = 1 := by native_decide
+example : andExecution06.elimination.level = .param `u :=
+  Level.isStructEq_eq (by native_decide)
+example : andExecution06.recLevelParams = [`u] := by native_decide
+example : andExecution06.recLevels = [.param `u] :=
+  levelListStructEq06_eq (by native_decide)
+example : recursorShape06 andRecInfo06 =
+    ([`u], 2, 0, 1, 1, false, [(``And.intro, 2)]) := rfl
+example : andSingletonExecution06.trace.parameterCount = 2 := by native_decide
+example : andSingletonExecution06.trace.proofFieldCount = 2 := by native_decide
+example : andSingletonExecution06.trace.dataFieldCount = 0 := by native_decide
+example : andKernelRuleRhs06 = andChecked.generatedRules[0].rhs := rfl
+example : andGeneration06.elimination = .large :=
+  andAlignment06.large_result_iff.mp (by native_decide)
+example : andGeneration06.kTarget = false :=
+  andAlignment06.kTarget_result_false_iff.mp (by native_decide)
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/EliminationFixturesSmall.lean b/Ix/Theory/Named/Verify/Environment/EliminationFixturesSmall.lean
new file mode 100644
index 000000000..309021ddf
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/EliminationFixturesSmall.lean
@@ -0,0 +1,100 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesCommon
+
+/-! Exact Spec-06B source-universe small-elimination differential fixture. -/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+def smallSourceInfo06 : ConstantInfo := kernelInductInfo% Spec06SmallSource
+def smallSourceLeftInfo06 : ConstantInfo :=
+  kernelCtorInfo% Spec06SmallSource.left
+def smallSourceRightInfo06 : ConstantInfo :=
+  kernelCtorInfo% Spec06SmallSource.right
+def smallSourceRecInfo06 : ConstantInfo :=
+  kernelRecInfo% Spec06SmallSource.rec
+def smallSourceLeftRuleRhs06 : VExpr :=
+  kernelRecRuleRhs% Spec06SmallSource.rec 0
+def smallSourceRightRuleRhs06 : VExpr :=
+  kernelRecRuleRhs% Spec06SmallSource.rec 1
+
+def smallSourceType06 : VInductiveType where
+  name := ``Spec06SmallSource
+  uvars := 1
+  type := vconst(type_of% @Spec06SmallSource).type
+  ctors := [
+    ⟨vconst(type_of% @Spec06SmallSource.left), ``Spec06SmallSource.left⟩,
+    ⟨vconst(type_of% @Spec06SmallSource.right), ``Spec06SmallSource.right⟩]
+
+def smallSourceDecl06 : VInductDecl := ⟨1, 1, [smallSourceType06]⟩
+
+def smallSourceChecked06 : smallSourceDecl06.Checked :=
+  smallSourceDecl06.checked?.get (by decide)
+
+def smallSourceGeneration06 :
+    VInductDecl.GenerationChecked smallSourceDecl06 :=
+  (VInductDecl.identityGeneration? smallSourceDecl06).get (by decide)
+
+def smallSourceKernelType06 : InductiveType where
+  name := smallSourceInfo06.name
+  type := smallSourceInfo06.type
+  ctors := [
+    { name := smallSourceLeftInfo06.name, type := smallSourceLeftInfo06.type },
+    { name := smallSourceRightInfo06.name, type := smallSourceRightInfo06.type }]
+
+def smallSourceEliminationResult06 :=
+  AddInductive.NormalizationEliminationExecution.buildExecution 1
+    [smallSourceKernelType06] 0 false
+      (spec06Context smallSourceInfo06.levelParams)
+
+theorem smallSourceEliminationResult06_isOk :
+    smallSourceEliminationResult06.isOk = true := by
+  native_decide
+
+def smallSourceProducedExecution06 :
+    { execution // smallSourceEliminationResult06 = .ok execution } :=
+  match h : smallSourceEliminationResult06 with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := smallSourceEliminationResult06_isOk
+      rw [h] at hOk
+      contradiction
+
+def smallSourceExecution06 := smallSourceProducedExecution06.val
+
+def smallSourceAlignment06 : AddInductive.CheckerEliminationRun
+    smallSourceGeneration06 smallSourceExecution06 :=
+  (AddInductive.CheckerEliminationRun.build? smallSourceGeneration06
+    smallSourceExecution06).get (by native_decide)
+
+example : smallSourceInfo06.levelParams = [`u] := rfl
+example : smallSourceExecution06.elimination.large.result = false := by
+  native_decide
+example : smallSourceExecution06.kTarget.result = false := by native_decide
+example : smallSourceExecution06.kTarget.singleton = none := by native_decide
+example : smallSourceExecution06.elimination.level = .zero :=
+  Level.isStructEq_eq (by native_decide)
+example : smallSourceExecution06.recLevelParams = [`u] := by native_decide
+example : smallSourceExecution06.recLevels = [.param `u] :=
+  levelListStructEq06_eq (by native_decide)
+example : recursorShape06 smallSourceRecInfo06 =
+    ([`u], 1, 0, 1, 2, false,
+      [(``Spec06SmallSource.left, 0), (``Spec06SmallSource.right, 0)]) := rfl
+example : smallSourceChecked06.elimination = .small :=
+  smallSourceAlignment06.small_result_iff.mp (by native_decide)
+example : smallSourceGeneration06.kTarget = false :=
+  smallSourceAlignment06.kTarget_result_false_iff.mp (by native_decide)
+example : smallSourceGeneration06.recursor =
+    vconst(type_of% @Spec06SmallSource.rec) := rfl
+example : smallSourceLeftRuleRhs06 =
+    smallSourceGeneration06.generatedRules[0].rhs := rfl
+example : smallSourceRightRuleRhs06 =
+    smallSourceGeneration06.generatedRules[1].rhs := rfl
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/IndexedVecCandidate.lean b/Ix/Theory/Named/Verify/Environment/IndexedVecCandidate.lean
new file mode 100644
index 000000000..8d305f876
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/IndexedVecCandidate.lean
@@ -0,0 +1,1686 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta
+open Ix.Theory.Named.InductiveFixtures
+
+def indexedVecKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_indexedVecCandidate natMap
+
+def indexedVecFamilyCandidateContext :
+    Ix.Theory.Named.AddInductive.Context where
+  env := indexedVecKernelEnv
+  lparams := indexedVecInfo.levelParams
+  safety := .safe
+  allowPrimitive := false
+
+private theorem indexedVecKernel_lookup_nat :
+    indexedVecKernelEnv.find? ``Nat = some natInfo := by
+  change natMap.find?' ``Nat = some natInfo
+  rw [natMap_wf.find?'_eq_find?, nat_type_map_lookup]
+
+private theorem indexedVecKernel_lookup_zero :
+    indexedVecKernelEnv.find? ``Nat.zero = some natZeroInfo := by
+  change natMap.find?' ``Nat.zero = some natZeroInfo
+  rw [natMap_wf.find?'_eq_find?, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert]
+  rfl
+
+private theorem indexedVecKernel_lookup_succ :
+    indexedVecKernelEnv.find? ``Nat.succ = some natSuccInfo := by
+  change natMap.find?' ``Nat.succ = some natSuccInfo
+  rw [natMap_wf.find?'_eq_find?, nat_succ_map_lookup]
+
+@[simp] private theorem indexedVecKernel_get_nat :
+    indexedVecKernelEnv.get ``Nat = .ok natInfo := by
+  simp only [Kernel.Environment.get, indexedVecKernel_lookup_nat,
+    Pure.pure, Except.pure]
+
+@[simp] private theorem indexedVecKernel_get_zero :
+    indexedVecKernelEnv.get ``Nat.zero = .ok natZeroInfo := by
+  simp only [Kernel.Environment.get, indexedVecKernel_lookup_zero,
+    Pure.pure, Except.pure]
+
+@[simp] private theorem indexedVecKernel_get_succ :
+    indexedVecKernelEnv.get ``Nat.succ = .ok natSuccInfo := by
+  simp only [Kernel.Environment.get, indexedVecKernel_lookup_succ,
+    Pure.pure, Except.pure]
+
+private def indexedVecParamName : Name :=
+  indexedVecInfo.type.bindingName!
+
+private def indexedVecIndexName : Name :=
+  indexedVecInfo.type.bindingBody!.bindingName!
+
+private def indexedVecParamCandidateContext :
+    Ix.Theory.Named.AddInductive.Context :=
+  indexedVecFamilyCandidateContext.pushLocalDecl
+    indexedVecParamName .default (.sort (.succ (.param `u)))
+
+private def indexedVecIndexCandidateContext :
+    Ix.Theory.Named.AddInductive.Context :=
+  indexedVecParamCandidateContext.pushLocalDecl
+    indexedVecIndexName .default (.const ``Nat [])
+
+private def indexedVecInnerKernel : Expr :=
+  .forallE indexedVecIndexName (.const ``Nat [])
+    (.sort (.succ (.param `u))) .default
+
+private def indexedVecTerminalKernel : Expr :=
+  .sort (.succ (.param `u))
+
+@[simp] private theorem indexedVecInnerKernel_instantiate1 (arg : Expr) :
+    indexedVecInnerKernel.instantiate1 arg = indexedVecInnerKernel := by
+  simp [indexedVecInnerKernel, Expr.instantiate1_eq, Expr.instantiate1']
+
+@[simp] private theorem indexedVecTerminalKernel_instantiate1 (arg : Expr) :
+    indexedVecTerminalKernel.instantiate1 arg =
+      indexedVecTerminalKernel := by
+  simp [indexedVecTerminalKernel, Expr.instantiate1_eq,
+    Expr.instantiate1']
+
+@[simp] private theorem indexedVecInfo_levelParams :
+    indexedVecInfo.levelParams = [`u] := rfl
+
+/-- Reflexive binder-domain equality is an exact successful ordinary-checker
+run in any candidate context with positive recursive fuel. -/
+theorem candidateIsDefEqSelfValid
+    (context : Ix.Theory.Named.AddInductive.Context) (e : Expr)
+    (fuel : Nat) (hfuel : context.fuel.recDepth = fuel + 1) :
+    Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.Valid ⟨context, e, e⟩ := by
+  unfold Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.Valid
+  unfold Ix.Theory.Named.TypeChecker.M.run Ix.Theory.Named.TypeChecker.isDefEq
+    Ix.Theory.Named.TypeChecker.RecM.run
+  simp [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, StateT.bind, Except.bind, Bind.bind,
+    StateT.pure, Except.pure, Pure.pure,
+    StateT.run', Functor.map, Except.map]
+  rw [hfuel]
+  change Except.map (fun x : Bool × Ix.Theory.Named.TypeChecker.State => x.1)
+      (Ix.Theory.Named.TypeChecker.Inner.isDefEq e e
+        (Ix.Theory.Named.TypeChecker.Methods.withFuel (fuel + 1))
+        context.toTypeChecker ({} : Ix.Theory.Named.TypeChecker.State)) = .ok true
+  unfold Ix.Theory.Named.TypeChecker.Inner.isDefEq
+  rw [if_pos (Expr.eqv_refl e)]
+  rfl
+
+def indexedVecTypeCheckerContext
+    (lctx : LocalContext) : Ix.Theory.Named.TypeChecker.Context where
+  env := indexedVecKernelEnv
+  lctx := lctx
+  lparams := [`u]
+
+@[simp] private theorem indexedVecFamily_checkLevel :
+    Ix.Theory.Named.TypeChecker.Inner.checkLevel
+      indexedVecFamilyCandidateContext.toTypeChecker
+        (.succ (.param `u)) = .ok () := by
+  simp [Ix.Theory.Named.TypeChecker.Inner.checkLevel,
+    indexedVecFamilyCandidateContext, indexedVecInfo,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker,
+    Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq, Level.hasParam']
+  rfl
+
+@[simp] private theorem indexedVec_checkLevel
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.checkLevel
+      (indexedVecTypeCheckerContext lctx)
+      (.succ (.param `u)) = .ok () := by
+  simp [Ix.Theory.Named.TypeChecker.Inner.checkLevel,
+    indexedVecTypeCheckerContext,
+    Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq, Level.hasParam']
+  rfl
+
+@[simp] private theorem indexedVecRecMGet (methods context state) :
+    (get : Ix.Theory.Named.TypeChecker.RecM Ix.Theory.Named.TypeChecker.State)
+        methods context state = .ok (state, state) := rfl
+
+@[simp] private theorem indexedVecRecMReadContext
+    (methods context state) :
+    (readThe Ix.Theory.Named.TypeChecker.Context :
+        Ix.Theory.Named.TypeChecker.RecM Ix.Theory.Named.TypeChecker.Context)
+      methods context state = .ok (context, state) := rfl
+
+@[simp] private theorem indexedVecRecMModify
+    (f : Ix.Theory.Named.TypeChecker.State → Ix.Theory.Named.TypeChecker.State)
+    (methods context state) :
+    (modify f : Ix.Theory.Named.TypeChecker.RecM PUnit)
+      methods context state = .ok (.unit, f state) := rfl
+
+@[simp] private theorem indexedVecRecMPure
+    {α} (a : α) (methods context state) :
+    (pure a : Ix.Theory.Named.TypeChecker.RecM α)
+      methods context state = .ok (a, state) := rfl
+
+@[simp] private theorem indexedVecRecMBind
+    {α β} (x : Ix.Theory.Named.TypeChecker.RecM α)
+    (f : α → Ix.Theory.Named.TypeChecker.RecM β)
+    (methods context state) :
+    (x >>= f) methods context state =
+      match x methods context state with
+      | .error e => .error e
+      | .ok (a, state') => f a methods context state' := by
+  simp [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  cases h : x methods context state with
+  | error => rfl
+  | ok value => cases value; rfl
+
+@[simp] private theorem indexedVecRecMLiftExceptOk
+    {α} (a : α) (methods context state) :
+    (liftM (.ok a : Except Kernel.Exception α) :
+      Ix.Theory.Named.TypeChecker.RecM α) methods context state =
+        .ok (a, state) := rfl
+
+@[simp] private theorem indexedVecGetNGen
+    (context : Ix.Theory.Named.TypeChecker.Context)
+    (state : Ix.Theory.Named.TypeChecker.State) :
+    (getNGen : Ix.Theory.Named.TypeChecker.M NameGenerator) context state =
+      .ok (state.ngen, state) := rfl
+
+@[simp] private theorem indexedVecSetNGen
+    (ngen : NameGenerator) (context : Ix.Theory.Named.TypeChecker.Context)
+    (state : Ix.Theory.Named.TypeChecker.State) :
+    (setNGen ngen : Ix.Theory.Named.TypeChecker.M PUnit) context state =
+      .ok (.unit, { state with ngen }) := rfl
+
+@[simp] private theorem indexedVecMPure
+    {α} (a : α) (context : Ix.Theory.Named.TypeChecker.Context)
+    (state : Ix.Theory.Named.TypeChecker.State) :
+    (pure a : Ix.Theory.Named.TypeChecker.M α) context state =
+      .ok (a, state) := rfl
+
+@[simp] private theorem indexedVecRecMWithReader
+    {α} (f : LocalContext → LocalContext)
+    (x : Ix.Theory.Named.TypeChecker.RecM α)
+    (methods : Ix.Theory.Named.TypeChecker.Methods)
+    (context : Ix.Theory.Named.TypeChecker.Context)
+    (state : Ix.Theory.Named.TypeChecker.State) :
+    (MonadWithReaderOf.withReader (m := Ix.Theory.Named.TypeChecker.RecM) f x)
+      methods context state =
+        x methods { context with lctx := f context.lctx } state := rfl
+
+private theorem indexedVecWithLocalDecl
+    {α} (name : Name) (bi : BinderInfo) (ty : Expr)
+    (k : Expr → Ix.Theory.Named.TypeChecker.RecM α)
+    (methods : Ix.Theory.Named.TypeChecker.Methods)
+    (context : Ix.Theory.Named.TypeChecker.Context)
+    (state : Ix.Theory.Named.TypeChecker.State) :
+    (withLocalDecl (m := Ix.Theory.Named.TypeChecker.RecM) name bi ty k)
+      methods context state =
+        k (.fvar ⟨state.ngen.curr⟩) methods
+          { context with lctx :=
+              (context.lctx.mkLocalDecl ⟨state.ngen.curr⟩ name ty bi) }
+          { state with ngen := state.ngen.next } := rfl
+
+@[simp] private theorem indexedVecEnsureSort
+    (u : Level) (source : Expr)
+    (methods : Ix.Theory.Named.TypeChecker.Methods)
+    (context : Ix.Theory.Named.TypeChecker.Context)
+    (state : Ix.Theory.Named.TypeChecker.State) :
+    Ix.Theory.Named.TypeChecker.Inner.ensureSortCore (.sort u) source
+      methods context state = .ok (.sort u, state) := by
+  rfl
+
+private theorem indexedVecInferTypeFuel
+    (n e inferOnly context state) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType e inferOnly
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel (n + 1)) context state =
+        Ix.Theory.Named.TypeChecker.Inner.inferType' e inferOnly
+          (Ix.Theory.Named.TypeChecker.Methods.withFuel n) context state := rfl
+
+@[simp] private theorem indexedVecInferTypeSortCore
+    (n : Nat) (lctx : LocalContext)
+    (state : Ix.Theory.Named.TypeChecker.State)
+    (hcache : state.inferTypeC[(.sort (.succ (.param `u)) : Expr)]? = none) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel n)
+      (indexedVecTypeCheckerContext lctx)
+      state =
+        .ok (.sort (.succ (.succ (.param `u))),
+          { state with inferTypeC :=
+              (state.inferTypeC.insert (.sort (.succ (.param `u)))
+                (.sort (.succ (.succ (.param `u))))) }) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+@[simp] private theorem indexedVecInferTypeSortCachedCore
+    (n : Nat) (lctx : LocalContext)
+    (state : Ix.Theory.Named.TypeChecker.State)
+    (hcache : state.inferTypeC[(.sort (.succ (.param `u)) : Expr)]? =
+      some (.sort (.succ (.succ (.param `u))))) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel n)
+      (indexedVecTypeCheckerContext lctx)
+      state = .ok (.sort (.succ (.succ (.param `u))), state) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache]
+
+@[simp] private theorem indexedVecInferConstantNat
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferConstant
+      (indexedVecTypeCheckerContext lctx) ``Nat [] false =
+        .ok (.sort (.succ .zero)) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferConstant
+  simp [indexedVecTypeCheckerContext, indexedVecKernel_get_nat,
+    natInfo, ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Level.substParams', Bind.bind, Except.bind,
+    Pure.pure, Except.pure]
+
+@[simp] theorem indexedVecPreFamilyInferConstantZero
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferConstant
+      (indexedVecTypeCheckerContext lctx) ``Nat.zero [] false =
+        .ok (.const ``Nat []) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferConstant
+  simp [indexedVecTypeCheckerContext, indexedVecKernel_get_zero,
+    natZeroInfo, ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] theorem indexedVecPreFamilyInferConstantSucc
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferConstant
+      (indexedVecTypeCheckerContext lctx) ``Nat.succ [] false =
+        .ok (.forallE `n (.const ``Nat []) (.const ``Nat []) .default) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferConstant
+  simp [indexedVecTypeCheckerContext, indexedVecKernel_get_succ,
+    natSuccInfo, ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] private theorem indexedVecInferTypeNatCore
+    (n : Nat) (lctx : LocalContext)
+    (state : Ix.Theory.Named.TypeChecker.State)
+    (hcache : state.inferTypeC[(.const ``Nat [] : Expr)]? = none) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel n)
+      (indexedVecTypeCheckerContext lctx)
+      state =
+        .ok (.sort (.succ .zero),
+          { state with inferTypeC :=
+              (state.inferTypeC.insert (.const ``Nat [])
+                (.sort (.succ .zero))) }) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    indexedVecInferConstantNat,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem indexedVecPreFamilyInferTypeFVarCore
+    (n : Nat) (lctx : LocalContext)
+    (state : Ix.Theory.Named.TypeChecker.State) (id : FVarId) (type : Expr)
+    (hcache : state.inferTypeC[(.fvar id : Expr)]? = none)
+    (hfind : lctx.find? id =
+      some (.cdecl index id name type bi kind)) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.fvar id) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel n)
+      (indexedVecTypeCheckerContext lctx) state =
+        .ok (type, { state with inferTypeC :=
+          state.inferTypeC.insert (.fvar id) type }) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    Ix.Theory.Named.TypeChecker.Inner.inferFVar,
+    indexedVecTypeCheckerContext, hfind, LocalDecl.type,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem indexedVecPreFamilyInferTypeZeroCore
+    (n : Nat) (lctx : LocalContext)
+    (state : Ix.Theory.Named.TypeChecker.State)
+    (hcache : state.inferTypeC[(.const ``Nat.zero [] : Expr)]? = none) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat.zero []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel n)
+      (indexedVecTypeCheckerContext lctx) state =
+        .ok (.const ``Nat [], { state with inferTypeC :=
+          (state.inferTypeC.insert (.const ``Nat.zero [])
+            (.const ``Nat [])) }) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    indexedVecPreFamilyInferConstantZero,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem indexedVecPreFamilyInferTypeSuccCore
+    (n : Nat) (lctx : LocalContext)
+    (state : Ix.Theory.Named.TypeChecker.State)
+    (hcache : state.inferTypeC[(.const ``Nat.succ [] : Expr)]? = none) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat.succ []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel n)
+      (indexedVecTypeCheckerContext lctx) state =
+        .ok (.forallE `n (.const ``Nat []) (.const ``Nat []) .default,
+          { state with inferTypeC := (state.inferTypeC.insert
+            (.const ``Nat.succ [])
+            (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)) }) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    indexedVecPreFamilyInferConstantSucc,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private def indexedVecRootSortState : Ix.Theory.Named.TypeChecker.State :=
+  { ({} : Ix.Theory.Named.TypeChecker.State) with inferTypeC :=
+      (({} : Ix.Theory.Named.TypeChecker.State).inferTypeC.insert
+        (.sort (.succ (.param `u)))
+        (.sort (.succ (.succ (.param `u))))) }
+
+@[simp] private theorem indexedVecRootSortCore :
+    Ix.Theory.Named.TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      indexedVecFamilyCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort (.succ (.succ (.param `u))),
+          indexedVecRootSortState) := by
+  simpa [indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker,
+    indexedVecInfo, ConstantInfo.levelParams,
+    ConstantInfo.toConstantVal, indexedVecTypeCheckerContext,
+    indexedVecRootSortState] using
+      (indexedVecInferTypeSortCore 9998 ({} : LocalContext)
+        ({} : Ix.Theory.Named.TypeChecker.State) Std.HashMap.getElem?_empty)
+
+private def indexedVecParamLctx : LocalContext :=
+  ({} : LocalContext).mkLocalDecl
+    ⟨indexedVecRootSortState.ngen.curr⟩ indexedVecParamName
+    (.sort (.succ (.param `u))) .default
+
+private def indexedVecAfterParamState : Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecRootSortState with
+    ngen := indexedVecRootSortState.ngen.next }
+
+private def indexedVecNatState : Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecAfterParamState with
+    inferTypeC := indexedVecAfterParamState.inferTypeC.insert
+      (.const ``Nat []) (.sort (.succ .zero)) }
+
+private def indexedVecIndexLctx : LocalContext :=
+  indexedVecParamLctx.mkLocalDecl
+    ⟨indexedVecNatState.ngen.curr⟩ indexedVecIndexName
+    (.const ``Nat []) .default
+
+private def indexedVecAfterIndexState : Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecNatState with ngen := indexedVecNatState.ngen.next }
+
+private theorem indexedVecOuterWithLocalDecl
+    {α} (k : Expr → Ix.Theory.Named.TypeChecker.RecM α)
+    (methods : Ix.Theory.Named.TypeChecker.Methods) :
+    (withLocalDecl (m := Ix.Theory.Named.TypeChecker.RecM)
+      indexedVecParamName .default (.sort (.succ (.param `u))) k)
+        methods indexedVecFamilyCandidateContext.toTypeChecker
+          indexedVecRootSortState =
+      k (.fvar ⟨indexedVecRootSortState.ngen.curr⟩) methods
+        { indexedVecFamilyCandidateContext.toTypeChecker with
+          lctx := indexedVecParamLctx }
+        indexedVecAfterParamState := by
+  simpa [indexedVecParamLctx, indexedVecAfterParamState,
+    indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker] using
+    (indexedVecWithLocalDecl indexedVecParamName .default
+      (.sort (.succ (.param `u))) k methods
+      indexedVecFamilyCandidateContext.toTypeChecker indexedVecRootSortState)
+
+private theorem indexedVecInnerWithLocalDecl
+    {α} (k : Expr → Ix.Theory.Named.TypeChecker.RecM α)
+    (methods : Ix.Theory.Named.TypeChecker.Methods) :
+    (withLocalDecl (m := Ix.Theory.Named.TypeChecker.RecM)
+      indexedVecIndexName .default (.const ``Nat []) k)
+        methods
+          { indexedVecFamilyCandidateContext.toTypeChecker with
+            lctx := indexedVecParamLctx }
+          indexedVecNatState =
+      k (.fvar ⟨indexedVecNatState.ngen.curr⟩) methods
+        { indexedVecFamilyCandidateContext.toTypeChecker with
+          lctx := indexedVecIndexLctx }
+        indexedVecAfterIndexState := by
+  simpa [indexedVecIndexLctx, indexedVecAfterIndexState] using
+    (indexedVecWithLocalDecl indexedVecIndexName .default
+      (.const ``Nat []) k methods
+      { indexedVecFamilyCandidateContext.toTypeChecker with
+        lctx := indexedVecParamLctx }
+      indexedVecNatState)
+
+@[simp] private theorem indexedVecNat_beq_sort :
+    ((.const ``Nat [] : Expr) == .sort (.succ (.param `u))) = false := by
+  change Expr.eqv (.const ``Nat []) (.sort (.succ (.param `u))) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] private theorem indexedVecAfterIndexState_sort_cache :
+    indexedVecAfterIndexState.inferTypeC[
+      (.sort (.succ (.param `u)) : Expr)]? =
+        some (.sort (.succ (.succ (.param `u)))) := by
+  change
+    (((({} : Ix.Theory.Named.InferCache).insert
+      (.sort (.succ (.param `u)))
+      (.sort (.succ (.succ (.param `u))))).insert
+      (.const ``Nat []) (.sort (.succ .zero)))[
+        (.sort (.succ (.param `u)) : Expr)]?) = _
+  rw [Std.HashMap.getElem?_insert, indexedVecNat_beq_sort]
+  exact Std.HashMap.getElem?_insert_self
+
+@[simp] private theorem indexedVecParamNatCore :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      { indexedVecFamilyCandidateContext.toTypeChecker with
+        lctx := indexedVecParamLctx }
+      indexedVecAfterParamState =
+        .ok (.sort (.succ .zero), indexedVecNatState) := by
+  simpa [indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker,
+    indexedVecInfo, ConstantInfo.levelParams,
+    ConstantInfo.toConstantVal, indexedVecTypeCheckerContext,
+    indexedVecAfterParamState, indexedVecRootSortState,
+    indexedVecNatState] using
+      (indexedVecInferTypeNatCore 9998 indexedVecParamLctx
+        indexedVecAfterParamState (by
+          simp [indexedVecAfterParamState, indexedVecRootSortState]))
+
+@[simp] private theorem indexedVecTerminalSortCore :
+    Ix.Theory.Named.TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      { indexedVecFamilyCandidateContext.toTypeChecker with
+        lctx := indexedVecIndexLctx }
+      indexedVecAfterIndexState =
+        .ok (.sort (.succ (.succ (.param `u))),
+          indexedVecAfterIndexState) := by
+  simpa [indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker,
+    indexedVecInfo, ConstantInfo.levelParams,
+    ConstantInfo.toConstantVal, indexedVecTypeCheckerContext,
+    indexedVecAfterIndexState, indexedVecNatState,
+    indexedVecAfterParamState, indexedVecRootSortState] using
+      (indexedVecInferTypeSortCachedCore 9998 indexedVecIndexLctx
+        indexedVecAfterIndexState indexedVecAfterIndexState_sort_cache)
+
+private def indexedVecFamilyInferredLevel : Level :=
+  mkLevelIMax' (.succ (.succ (.param `u)))
+    (mkLevelIMax' (.succ .zero) (.succ (.succ (.param `u))))
+
+private theorem indexedVecFamilyInferForall :
+    Ix.Theory.Named.TypeChecker.Inner.inferForall
+      (.forallE indexedVecParamName (.sort (.succ (.param `u)))
+        (.forallE indexedVecIndexName (.const ``Nat [])
+          (.sort (.succ (.param `u))) .default) .default)
+      false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      indexedVecFamilyCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort indexedVecFamilyInferredLevel,
+          indexedVecAfterIndexState) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferForall
+  simp only [Ix.Theory.Named.TypeChecker.Inner.inferForall.loop]
+  rw [show
+    (.sort (.succ (.param `u)) : Expr).instantiateRev #[] =
+      .sort (.succ (.param `u)) by
+        simp [Expr.instantiateRev_eq, Expr.instantiate_eq]]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecRootSortCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp only
+  rw [indexedVecOuterWithLocalDecl]
+  rw [show
+    (.const ``Nat [] : Expr).instantiateRev
+        (#[] |>.push (.fvar ⟨indexedVecRootSortState.ngen.curr⟩)) =
+      .const ``Nat [] by
+        simp [Expr.instantiateRev_eq, Expr.instantiate_eq,
+          Expr.instantiate1']]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecParamNatCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp only
+  rw [indexedVecInnerWithLocalDecl]
+  rw [show
+    (.sort (.succ (.param `u)) : Expr).instantiateRev
+        ((#[] |>.push
+          (.fvar ⟨indexedVecRootSortState.ngen.curr⟩)).push
+          (.fvar ⟨indexedVecNatState.ngen.curr⟩)) =
+      .sort (.succ (.param `u)) by
+        simp [Expr.instantiateRev_eq, Expr.instantiate_eq,
+          Expr.instantiate1']]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecTerminalSortCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp [indexedVecFamilyInferredLevel, Expr.sortLevel!,
+    Pure.pure, ReaderT.pure,
+    StateT.pure, Except.pure]
+
+private def indexedVecFamilyCheckedState : Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecAfterIndexState with
+    inferTypeC := indexedVecAfterIndexState.inferTypeC.insert
+      (.forallE indexedVecParamName (.sort (.succ (.param `u)))
+        (.forallE indexedVecIndexName (.const ``Nat [])
+          (.sort (.succ (.param `u))) .default) .default)
+      (.sort indexedVecFamilyInferredLevel) }
+
+private theorem indexedVecFamilyCheckTypeInner :
+    Ix.Theory.Named.TypeChecker.Inner.inferType indexedVecInfo.type false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      indexedVecFamilyCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort indexedVecFamilyInferredLevel,
+          indexedVecFamilyCheckedState) := by
+  change Ix.Theory.Named.TypeChecker.Inner.inferType'
+    (.forallE indexedVecParamName (.sort (.succ (.param `u)))
+      (.forallE indexedVecIndexName (.const ``Nat [])
+        (.sort (.succ (.param `u))) .default) .default)
+    false (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+    indexedVecFamilyCandidateContext.toTypeChecker
+    ({} : Ix.Theory.Named.TypeChecker.State) = _
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    indexedVecFamilyInferForall, indexedVecFamilyCheckedState,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem indexedVecFamily_whnfM :
+    Ix.Theory.Named.TypeChecker.M.run
+      indexedVecFamilyCandidateContext.env
+      indexedVecFamilyCandidateContext.safety
+      indexedVecFamilyCandidateContext.lctx
+      indexedVecFamilyCandidateContext.lparams
+      indexedVecFamilyCandidateContext.fuel
+      (Ix.Theory.Named.TypeChecker.whnf indexedVecInfo.type) =
+        .ok indexedVecInfo.type := by
+  rfl
+
+private theorem indexedVecSort_checkTypeM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.checkType (.sort (.succ (.param `u)))) =
+        .ok (.sort (.succ (.succ (.param `u)))) := by
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.inferType
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  rw [indexedVecInferTypeFuel 9999]
+  rw [indexedVecInferTypeSortCore 9999 lctx
+    ({} : Ix.Theory.Named.TypeChecker.State) Std.HashMap.getElem?_empty]
+  rfl
+
+private theorem indexedVecSort_whnfM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.whnf (.sort (.succ (.param `u)))) =
+        .ok (.sort (.succ (.param `u))) := by
+  rfl
+
+private theorem indexedVecNat_checkTypeM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.checkType (.const ``Nat [])) =
+        .ok (.sort (.succ .zero)) := by
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.inferType (.const ``Nat []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  rw [indexedVecInferTypeFuel 9999]
+  rw [indexedVecInferTypeNatCore 9999 lctx
+    ({} : Ix.Theory.Named.TypeChecker.State) Std.HashMap.getElem?_empty]
+  rfl
+
+private theorem indexedVecUnfoldNat (lctx methods state) :
+    Ix.Theory.Named.TypeChecker.Inner.unfoldDefinition (.const ``Nat [])
+      methods (indexedVecTypeCheckerContext lctx) state =
+        .ok (none, state) := by
+  change Ix.Theory.Named.TypeChecker.Inner.unfoldDefinitionCore
+    (.const ``Nat []) methods (indexedVecTypeCheckerContext lctx) state = _
+  simp [Ix.Theory.Named.TypeChecker.Inner.unfoldDefinitionCore,
+    Ix.Theory.Named.TypeChecker.Inner.isDelta, Expr.getAppFn,
+    indexedVecTypeCheckerContext, indexedVecKernel_lookup_nat,
+    natInfo, ConstantInfo.deltaValue?,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem indexedVecWhnfLoopNat (lctx methods state n) :
+    Ix.Theory.Named.TypeChecker.Inner.whnf'.loop (.const ``Nat []) (n + 1)
+      methods (indexedVecTypeCheckerContext lctx) state =
+        .ok (.const ``Nat [], state) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.whnf'.loop
+  simp [indexedVecUnfoldNat]
+
+private theorem indexedVecNat_whnfM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.whnf (.const ``Nat [])) =
+        .ok (.const ``Nat []) := by
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.whnf' (.const ``Nat [])
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  unfold Ix.Theory.Named.TypeChecker.Inner.whnf'
+  simp
+  rw [show
+    (if (indexedVecTypeCheckerContext lctx).eagerReduce then
+      (indexedVecTypeCheckerContext lctx).fuel.whnfEager
+    else (indexedVecTypeCheckerContext lctx).fuel.whnf) = 100000 by rfl]
+  rw [show 100000 = 99999 + 1 by rfl]
+  rw [indexedVecWhnfLoopNat]
+  simp [Functor.map, StateT.map, Except.map]
+
+private def indexedVecInnerInferredLevel : Level :=
+  mkLevelIMax' (.succ .zero) (.succ (.succ (.param `u)))
+
+private def indexedVecInnerNatState : Ix.Theory.Named.TypeChecker.State :=
+  { ({} : Ix.Theory.Named.TypeChecker.State) with
+    inferTypeC := ({} : Ix.Theory.Named.TypeChecker.State).inferTypeC.insert
+      (.const ``Nat []) (.sort (.succ .zero)) }
+
+private def indexedVecInnerCheckerLctx : LocalContext :=
+  indexedVecParamCandidateContext.lctx.mkLocalDecl
+    ⟨indexedVecInnerNatState.ngen.curr⟩ indexedVecIndexName
+    (.const ``Nat []) .default
+
+private def indexedVecInnerAfterIndexState :
+    Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecInnerNatState with
+    ngen := indexedVecInnerNatState.ngen.next }
+
+private def indexedVecInnerSortState : Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecInnerAfterIndexState with
+    inferTypeC := indexedVecInnerAfterIndexState.inferTypeC.insert
+      (.sort (.succ (.param `u)))
+      (.sort (.succ (.succ (.param `u)))) }
+
+private def indexedVecInnerCheckedState : Ix.Theory.Named.TypeChecker.State :=
+  { indexedVecInnerSortState with
+    inferTypeC := indexedVecInnerSortState.inferTypeC.insert
+      indexedVecInnerKernel (.sort indexedVecInnerInferredLevel) }
+
+@[simp] private theorem indexedVecInnerNatCore :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      indexedVecParamCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort (.succ .zero), indexedVecInnerNatState) := by
+  simpa [indexedVecParamCandidateContext,
+    indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker,
+    indexedVecInfo, ConstantInfo.levelParams,
+    ConstantInfo.toConstantVal, indexedVecTypeCheckerContext,
+    indexedVecInnerNatState] using
+      (indexedVecInferTypeNatCore 9998
+        indexedVecParamCandidateContext.lctx
+        ({} : Ix.Theory.Named.TypeChecker.State) Std.HashMap.getElem?_empty)
+
+private theorem indexedVecInnerCheckerWithLocalDecl
+    {α} (k : Expr → Ix.Theory.Named.TypeChecker.RecM α)
+    (methods : Ix.Theory.Named.TypeChecker.Methods) :
+    (withLocalDecl (m := Ix.Theory.Named.TypeChecker.RecM)
+      indexedVecIndexName .default (.const ``Nat []) k)
+        methods indexedVecParamCandidateContext.toTypeChecker
+          indexedVecInnerNatState =
+      k (.fvar ⟨indexedVecInnerNatState.ngen.curr⟩) methods
+        { indexedVecParamCandidateContext.toTypeChecker with
+          lctx := indexedVecInnerCheckerLctx }
+        indexedVecInnerAfterIndexState := by
+  simpa [indexedVecInnerCheckerLctx,
+    indexedVecInnerAfterIndexState,
+    indexedVecParamCandidateContext,
+    indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker] using
+      (indexedVecWithLocalDecl indexedVecIndexName .default
+        (.const ``Nat []) k methods
+        indexedVecParamCandidateContext.toTypeChecker
+        indexedVecInnerNatState)
+
+@[simp] private theorem indexedVecInnerTerminalSortCore :
+    Ix.Theory.Named.TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      { indexedVecParamCandidateContext.toTypeChecker with
+        lctx := indexedVecInnerCheckerLctx }
+      indexedVecInnerAfterIndexState =
+        .ok (.sort (.succ (.succ (.param `u))),
+          indexedVecInnerSortState) := by
+  simpa [indexedVecParamCandidateContext,
+    indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+    Ix.Theory.Named.AddInductive.Context.toTypeChecker,
+    indexedVecInfo, ConstantInfo.levelParams,
+    ConstantInfo.toConstantVal, indexedVecTypeCheckerContext,
+    indexedVecInnerAfterIndexState, indexedVecInnerNatState,
+    indexedVecInnerSortState] using
+      (indexedVecInferTypeSortCore 9998 indexedVecInnerCheckerLctx
+        indexedVecInnerAfterIndexState (by
+          simp [indexedVecInnerAfterIndexState,
+            indexedVecInnerNatState]))
+
+private theorem indexedVecInnerInferForall :
+    Ix.Theory.Named.TypeChecker.Inner.inferForall indexedVecInnerKernel false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      indexedVecParamCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort indexedVecInnerInferredLevel,
+          indexedVecInnerSortState) := by
+  unfold indexedVecInnerKernel
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferForall
+  simp only [Ix.Theory.Named.TypeChecker.Inner.inferForall.loop]
+  rw [show (.const ``Nat [] : Expr).instantiateRev #[] =
+    .const ``Nat [] by
+      simp [Expr.instantiateRev_eq, Expr.instantiate_eq]]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecInnerNatCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp only
+  rw [indexedVecInnerCheckerWithLocalDecl]
+  rw [show
+    (.sort (.succ (.param `u)) : Expr).instantiateRev
+      (#[] |>.push (.fvar ⟨indexedVecInnerNatState.ngen.curr⟩)) =
+        .sort (.succ (.param `u)) by
+      simp [Expr.instantiateRev_eq, Expr.instantiate_eq,
+        Expr.instantiate1']]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecInnerTerminalSortCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp [indexedVecInnerInferredLevel, Expr.sortLevel!,
+    Pure.pure, ReaderT.pure, StateT.pure, Except.pure]
+
+private theorem indexedVecInner_checkTypeM :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe
+      indexedVecParamCandidateContext.lctx [`u] ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.checkType indexedVecInnerKernel) =
+        .ok (.sort indexedVecInnerInferredLevel) := by
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.inferType indexedVecInnerKernel false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      indexedVecParamCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.inferType' indexedVecInnerKernel false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      indexedVecParamCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [indexedVecInnerKernel, Expr.hasLooseBVars,
+    Expr.looseBVarRange',
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show
+    Ix.Theory.Named.TypeChecker.Inner.inferForall
+      (.forallE indexedVecIndexName (.const ``Nat [])
+        (.sort (.succ (.param `u))) .default)
+      false (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      indexedVecParamCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort indexedVecInnerInferredLevel,
+          indexedVecInnerSortState) by
+      simpa [indexedVecInnerKernel] using indexedVecInnerInferForall]
+  rfl
+
+/-! The constructor pre-family replay runs after family analysis has added its
+parameter and index locals, but before `IndexedVec` itself is present in the
+kernel environment.  The following executions expose the family-free pieces
+of the family candidate proof for an arbitrary local context. -/
+
+def indexedVecPreFamilyIndexTelescope : Expr :=
+  .forallE indexedVecIndexName (.const ``Nat [])
+    (.sort (.succ (.param `u))) .default
+
+theorem indexedVecPreFamilyIndexTelescope_eq :
+    indexedVecPreFamilyIndexTelescope = indexedVecInfo.type.bindingBody! := by
+  rfl
+
+theorem indexedVecPreFamilySortCheckTypeM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.checkType
+        (.sort (.succ (.param `u)))) =
+      .ok (.sort (.succ (.succ (.param `u)))) :=
+  indexedVecSort_checkTypeM lctx
+
+theorem indexedVecPreFamilyNatCheckTypeM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.checkType (.const ``Nat [])) =
+      .ok (.sort (.succ .zero)) :=
+  indexedVecNat_checkTypeM lctx
+
+@[simp] private theorem indexedVecInferConstantNatOnly
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferConstant
+      (indexedVecTypeCheckerContext lctx) ``Nat [] true =
+        .ok (.sort (.succ .zero)) := by
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferConstant
+  simp [indexedVecTypeCheckerContext, indexedVecKernel_get_nat, natInfo, ConstantInfo.levelParams,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams, Expr.instantiateLevelParams_eq,
+    Expr.instantiateLevelParamsCore', Level.substParams', Bind.bind, Except.bind, Pure.pure,
+    Except.pure]
+
+private def indexedVecPreFamilyNatInferOnlyState :
+    Ix.Theory.Named.TypeChecker.State :=
+  { ({} : Ix.Theory.Named.TypeChecker.State) with
+    inferTypeI := ({} : Ix.Theory.Named.TypeChecker.State).inferTypeI.insert
+      (.const ``Nat []) (.sort (.succ .zero)) }
+
+private theorem indexedVecPreFamilyNatInferOnly
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType (.const ``Nat []) true
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort (.succ .zero),
+          indexedVecPreFamilyNatInferOnlyState) := by
+  change Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat []) true
+    (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+    (indexedVecTypeCheckerContext lctx)
+    ({} : Ix.Theory.Named.TypeChecker.State) = _
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [indexedVecPreFamilyNatInferOnlyState,
+    Expr.hasLooseBVars, Expr.looseBVarRange',
+    indexedVecInferConstantNatOnly, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+theorem indexedVecPreFamilyNatEnsureTypeM (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.ensureType (.const ``Nat [])) =
+        .ok (.sort (.succ .zero)) := by
+  unfold Ix.Theory.Named.TypeChecker.ensureType Ix.Theory.Named.TypeChecker.inferType
+    Ix.Theory.Named.TypeChecker.ensureSort Ix.Theory.Named.TypeChecker.RecM.run
+    Ix.Theory.Named.TypeChecker.M.run
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    Pure.pure, StateT.pure, Except.pure, StateT.run',
+    Functor.map, Except.map]
+  rw [show Ix.Theory.Named.TypeChecker.Inner.inferType (.const ``Nat []) true
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      { env := indexedVecKernelEnv
+        lctx := lctx
+        safety := .safe
+        lparams := [`u]
+        fuel := ({} : FuelConfig) }
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort (.succ .zero),
+          indexedVecPreFamilyNatInferOnlyState) by
+    simpa [indexedVecTypeCheckerContext] using
+      indexedVecPreFamilyNatInferOnly lctx]
+  rfl
+
+private def indexedVecPreFamilyIndexCheckerLctx
+    (lctx : LocalContext) : LocalContext :=
+  lctx.mkLocalDecl ⟨indexedVecInnerNatState.ngen.curr⟩
+    indexedVecIndexName (.const ``Nat []) .default
+
+private theorem indexedVecPreFamilyIndexNatCore (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort (.succ .zero), indexedVecInnerNatState) := by
+  simp [indexedVecInnerNatState]
+
+private theorem indexedVecPreFamilyIndexWithLocalDecl
+    (lctx : LocalContext)
+    {α} (k : Expr → Ix.Theory.Named.TypeChecker.RecM α)
+    (methods : Ix.Theory.Named.TypeChecker.Methods) :
+    (withLocalDecl (m := Ix.Theory.Named.TypeChecker.RecM)
+      indexedVecIndexName .default (.const ``Nat []) k)
+        methods (indexedVecTypeCheckerContext lctx)
+          indexedVecInnerNatState =
+      k (.fvar ⟨indexedVecInnerNatState.ngen.curr⟩) methods
+        { indexedVecTypeCheckerContext lctx with
+          lctx := indexedVecPreFamilyIndexCheckerLctx lctx }
+        indexedVecInnerAfterIndexState := by
+  simpa [indexedVecPreFamilyIndexCheckerLctx,
+    indexedVecInnerAfterIndexState, indexedVecTypeCheckerContext] using
+    (indexedVecWithLocalDecl indexedVecIndexName .default
+      (.const ``Nat []) k methods (indexedVecTypeCheckerContext lctx)
+      indexedVecInnerNatState)
+
+private theorem indexedVecPreFamilyIndexSortCore (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9998)
+      { indexedVecTypeCheckerContext lctx with
+        lctx := indexedVecPreFamilyIndexCheckerLctx lctx }
+      indexedVecInnerAfterIndexState =
+        .ok (.sort (.succ (.succ (.param `u))),
+          indexedVecInnerSortState) := by
+  simpa [indexedVecPreFamilyIndexCheckerLctx,
+    indexedVecInnerAfterIndexState, indexedVecInnerNatState,
+    indexedVecInnerSortState, indexedVecTypeCheckerContext] using
+    (indexedVecInferTypeSortCore 9998
+      (indexedVecPreFamilyIndexCheckerLctx lctx)
+      indexedVecInnerAfterIndexState (by
+        simp [indexedVecInnerAfterIndexState,
+          indexedVecInnerNatState]))
+
+private theorem indexedVecPreFamilyIndexInferForall
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.Inner.inferForall
+      indexedVecPreFamilyIndexTelescope false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort indexedVecInnerInferredLevel,
+          indexedVecInnerSortState) := by
+  unfold indexedVecPreFamilyIndexTelescope
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferForall
+  simp only [Ix.Theory.Named.TypeChecker.Inner.inferForall.loop]
+  rw [show (.const ``Nat [] : Expr).instantiateRev #[] =
+    .const ``Nat [] by
+      simp [Expr.instantiateRev_eq, Expr.instantiate_eq]]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecPreFamilyIndexNatCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp only
+  rw [indexedVecPreFamilyIndexWithLocalDecl]
+  rw [show
+    (.sort (.succ (.param `u)) : Expr).instantiateRev
+      (#[] |>.push (.fvar ⟨indexedVecInnerNatState.ngen.curr⟩)) =
+        .sort (.succ (.param `u)) by
+      simp [Expr.instantiateRev_eq, Expr.instantiate_eq,
+        Expr.instantiate1']]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [indexedVecInferTypeFuel 9998]
+  rw [indexedVecPreFamilyIndexSortCore]
+  simp only
+  rw [indexedVecEnsureSort]
+  simp [indexedVecInnerInferredLevel, Expr.sortLevel!,
+    Pure.pure, ReaderT.pure, StateT.pure, Except.pure]
+
+theorem indexedVecPreFamilyIndexTelescopeCheckTypeM
+    (lctx : LocalContext) :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.checkType
+        indexedVecPreFamilyIndexTelescope) =
+      .ok (.sort indexedVecInnerInferredLevel) := by
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.inferType'
+      indexedVecPreFamilyIndexTelescope false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  unfold Ix.Theory.Named.TypeChecker.Inner.inferType'
+  simp [indexedVecPreFamilyIndexTelescope, Expr.hasLooseBVars,
+    Expr.looseBVarRange', Bind.bind, ReaderT.bind, StateT.bind,
+    Except.bind]
+  rw [show
+    Ix.Theory.Named.TypeChecker.Inner.inferForall
+      (.forallE indexedVecIndexName (.const ``Nat [])
+        (.sort (.succ (.param `u))) .default)
+      false (Ix.Theory.Named.TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : Ix.Theory.Named.TypeChecker.State) =
+        .ok (.sort indexedVecInnerInferredLevel,
+          indexedVecInnerSortState) by
+      simpa [indexedVecPreFamilyIndexTelescope] using
+        indexedVecPreFamilyIndexInferForall lctx]
+  rfl
+
+private theorem indexedVecInner_whnfM :
+    Ix.Theory.Named.TypeChecker.M.run indexedVecKernelEnv .safe
+      indexedVecParamCandidateContext.lctx [`u] ({} : FuelConfig)
+      (Ix.Theory.Named.TypeChecker.whnf indexedVecInnerKernel) =
+        .ok indexedVecInnerKernel := by
+  rfl
+
+private theorem indexedVecFamilyCandidateFresh :
+    indexedVecFamilyCandidateContext.lctx.find?
+      indexedVecFamilyCandidateContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := indexedVecFamilyCandidateContext.freshFVarId)
+    LocalContext.WF.nil
+  change
+    ({ fvarIdToDecl := PersistentHashMap.empty,
+       decls := PersistentArray.empty,
+       auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+      indexedVecFamilyCandidateContext.freshFVarId = none
+  rw [h]
+  simp [LocalContext.toList]
+
+private theorem indexedVecParamCandidateFresh :
+    indexedVecParamCandidateContext.lctx.find?
+      indexedVecParamCandidateContext.freshFVarId = none := by
+  have hroot := indexedVecFamilyCandidateFresh
+  have hwf : indexedVecParamCandidateContext.lctx.WF := by
+    change (({} : LocalContext).mkLocalDecl
+      indexedVecFamilyCandidateContext.freshFVarId
+      indexedVecParamName (.sort (.succ (.param `u))) .default).WF
+    exact LocalContext.WF.mkLocalDecl LocalContext.WF.nil (by
+      simpa [indexedVecFamilyCandidateContext] using hroot)
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := indexedVecParamCandidateContext.freshFVarId) hwf
+  rw [h]
+  simp only [indexedVecParamCandidateContext,
+    indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+    Ix.Theory.Named.AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  intro heq
+  injection heq with hname
+  injection hname with hidx
+  omega
+
+private theorem indexedVecFamily_checkTypeM :
+    Ix.Theory.Named.TypeChecker.M.run
+      indexedVecFamilyCandidateContext.env
+      indexedVecFamilyCandidateContext.safety
+      indexedVecFamilyCandidateContext.lctx
+      indexedVecFamilyCandidateContext.lparams
+      indexedVecFamilyCandidateContext.fuel
+      (Ix.Theory.Named.TypeChecker.checkType indexedVecInfo.type) =
+        .ok (.sort indexedVecFamilyInferredLevel) := by
+  change Except.map
+    (fun x : Expr × Ix.Theory.Named.TypeChecker.State => x.1)
+    (Ix.Theory.Named.TypeChecker.Inner.inferType indexedVecInfo.type false
+      (Ix.Theory.Named.TypeChecker.Methods.withFuel 10000)
+      indexedVecFamilyCandidateContext.toTypeChecker
+      ({} : Ix.Theory.Named.TypeChecker.State)) = _
+  rw [indexedVecFamilyCheckTypeInner]
+  rfl
+
+private def indexedVecParamAnnotations :
+    Ix.Theory.Named.AddInductive.CandidateTypeAnnotations
+      indexedVecTerminalKernel where
+  consumed := indexedVecTerminalKernel
+  trace := .identity _
+
+private def indexedVecIndexAnnotations :
+    Ix.Theory.Named.AddInductive.CandidateTypeAnnotations (.const ``Nat []) where
+  consumed := .const ``Nat []
+  trace := .identity _
+
+private theorem indexedVecParamAnnotationTrace_build :
+    Ix.Theory.Named.AddInductive.CandidateTypeAnnotationTrace.build
+      indexedVecTerminalKernel =
+        ⟨indexedVecTerminalKernel, .identity _⟩ := by
+  simp [Ix.Theory.Named.AddInductive.CandidateTypeAnnotationTrace.build,
+    indexedVecTerminalKernel]
+
+private theorem indexedVecIndexAnnotationTrace_build :
+    Ix.Theory.Named.AddInductive.CandidateTypeAnnotationTrace.build
+      (.const ``Nat []) = ⟨.const ``Nat [], .identity _⟩ := by
+  simp [Ix.Theory.Named.AddInductive.CandidateTypeAnnotationTrace.build]
+
+private theorem indexedVecParamAnnotations_build :
+    Ix.Theory.Named.AddInductive.buildCandidateTypeAnnotations
+      indexedVecTerminalKernel = .ok indexedVecParamAnnotations := by
+  unfold Ix.Theory.Named.AddInductive.buildCandidateTypeAnnotations
+  rw [indexedVecParamAnnotationTrace_build]
+  rfl
+
+private theorem indexedVecIndexAnnotations_build :
+    Ix.Theory.Named.AddInductive.buildCandidateTypeAnnotations
+      (.const ``Nat []) = .ok indexedVecIndexAnnotations := by
+  unfold Ix.Theory.Named.AddInductive.buildCandidateTypeAnnotations
+  rw [indexedVecIndexAnnotationTrace_build]
+  rfl
+
+private theorem indexedVecParamAnnotations_match :
+    indexedVecParamAnnotations.Matches :=
+  Ix.Theory.Named.AddInductive.CandidateTypeAnnotations.matches_of_build
+    indexedVecParamAnnotations indexedVecParamAnnotations_build
+
+private theorem indexedVecIndexAnnotations_match :
+    indexedVecIndexAnnotations.Matches :=
+  Ix.Theory.Named.AddInductive.CandidateTypeAnnotations.matches_of_build
+    indexedVecIndexAnnotations indexedVecIndexAnnotations_build
+
+private theorem indexedVecParamAnnotationsEq :
+    Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.Valid
+      ⟨indexedVecFamilyCandidateContext, indexedVecTerminalKernel,
+        indexedVecParamAnnotations.consumed⟩ := by
+  simpa [indexedVecParamAnnotations] using
+    (candidateIsDefEqSelfValid indexedVecFamilyCandidateContext
+      indexedVecTerminalKernel 9999 rfl)
+
+private theorem indexedVecIndexAnnotationsEq :
+    Ix.Theory.Named.AddInductive.CandidateIsDefEqStep.Valid
+      ⟨indexedVecParamCandidateContext, (.const ``Nat []),
+        indexedVecIndexAnnotations.consumed⟩ := by
+  simpa [indexedVecIndexAnnotations] using
+    (candidateIsDefEqSelfValid indexedVecParamCandidateContext
+      (.const ``Nat []) 9999 rfl)
+
+private def indexedVecParamDomainCandidateTrace :
+    Ix.Theory.Named.AddInductive.CandidateExprTrace
+      indexedVecFamilyCandidateContext indexedVecTerminalKernel :=
+  .terminal indexedVecFamilyCandidateContext indexedVecTerminalKernel
+    (.sort (.succ (.succ (.param `u)))) indexedVecTerminalKernel
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateCheckTypeStep.Valid,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        indexedVecTerminalKernel] using
+          indexedVecSort_checkTypeM
+            indexedVecFamilyCandidateContext.lctx)
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        indexedVecTerminalKernel] using
+          indexedVecSort_whnfM indexedVecFamilyCandidateContext.lctx)
+
+private def indexedVecIndexDomainCandidateTrace :
+    Ix.Theory.Named.AddInductive.CandidateExprTrace
+      indexedVecParamCandidateContext (.const ``Nat []) :=
+  .terminal indexedVecParamCandidateContext (.const ``Nat [])
+    (.sort (.succ .zero)) (.const ``Nat [])
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateCheckTypeStep.Valid,
+        indexedVecParamCandidateContext,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        Ix.Theory.Named.AddInductive.Context.pushLocalDecl] using
+          indexedVecNat_checkTypeM indexedVecParamCandidateContext.lctx)
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid,
+        indexedVecParamCandidateContext,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        Ix.Theory.Named.AddInductive.Context.pushLocalDecl] using
+          indexedVecNat_whnfM indexedVecParamCandidateContext.lctx)
+
+private def indexedVecTerminalCandidateTrace :
+    Ix.Theory.Named.AddInductive.CandidateExprTrace
+      indexedVecIndexCandidateContext
+      (indexedVecTerminalKernel.instantiate1
+        indexedVecParamCandidateContext.freshExpr) :=
+  .terminal indexedVecIndexCandidateContext
+    (indexedVecTerminalKernel.instantiate1
+      indexedVecParamCandidateContext.freshExpr)
+    (.sort (.succ (.succ (.param `u)))) indexedVecTerminalKernel
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateCheckTypeStep.Valid,
+        indexedVecIndexCandidateContext,
+        indexedVecParamCandidateContext,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+        indexedVecTerminalKernel] using
+          indexedVecSort_checkTypeM indexedVecIndexCandidateContext.lctx)
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid,
+        indexedVecIndexCandidateContext,
+        indexedVecParamCandidateContext,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+        indexedVecTerminalKernel] using
+          indexedVecSort_whnfM indexedVecIndexCandidateContext.lctx)
+
+private def indexedVecInnerCandidateTrace :
+    Ix.Theory.Named.AddInductive.CandidateExprTrace
+      indexedVecParamCandidateContext
+      (indexedVecInnerKernel.instantiate1
+        indexedVecFamilyCandidateContext.freshExpr) :=
+  .forallE indexedVecParamCandidateContext
+    (indexedVecInnerKernel.instantiate1
+      indexedVecFamilyCandidateContext.freshExpr)
+    (.sort indexedVecInnerInferredLevel)
+    indexedVecIndexName (.const ``Nat []) indexedVecTerminalKernel
+    .default indexedVecParamCandidateFresh indexedVecIndexAnnotations
+    indexedVecIndexAnnotationsEq
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateCheckTypeStep.Valid,
+        indexedVecParamCandidateContext,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+        indexedVecInnerKernel, indexedVecTerminalKernel,
+        Expr.instantiate1'] using
+          indexedVecInner_checkTypeM)
+    (by
+      simpa [Ix.Theory.Named.AddInductive.CandidateWhnfStep.Valid,
+        indexedVecParamCandidateContext,
+        indexedVecFamilyCandidateContext, indexedVecInfo,
+        ConstantInfo.levelParams, ConstantInfo.toConstantVal,
+        Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+        indexedVecInnerKernel, indexedVecTerminalKernel,
+        Expr.instantiate1'] using
+          indexedVecInner_whnfM)
+    indexedVecIndexDomainCandidateTrace indexedVecTerminalCandidateTrace
+
+private def indexedVecFamilyCandidateTrace :
+    Ix.Theory.Named.AddInductive.CandidateExprTrace
+      indexedVecFamilyCandidateContext indexedVecInfo.type :=
+  .forallE indexedVecFamilyCandidateContext indexedVecInfo.type
+    (.sort indexedVecFamilyInferredLevel)
+    indexedVecParamName indexedVecTerminalKernel indexedVecInnerKernel
+    .default indexedVecFamilyCandidateFresh indexedVecParamAnnotations
+    indexedVecParamAnnotationsEq
+    indexedVecFamily_checkTypeM
+    (by
+      change Ix.Theory.Named.TypeChecker.M.run
+        indexedVecFamilyCandidateContext.env
+        indexedVecFamilyCandidateContext.safety
+        indexedVecFamilyCandidateContext.lctx
+        indexedVecFamilyCandidateContext.lparams
+        indexedVecFamilyCandidateContext.fuel
+        (Ix.Theory.Named.TypeChecker.whnf indexedVecInfo.type) =
+          .ok indexedVecInfo.type
+      exact indexedVecFamily_whnfM)
+    indexedVecParamDomainCandidateTrace indexedVecInnerCandidateTrace
+
+def indexedVecFamilyCandidate :
+    Ix.Theory.Named.AddInductive.CandidateExpr indexedVecInfo.type :=
+  ⟨indexedVecFamilyCandidateContext, indexedVecFamilyCandidateTrace⟩
+
+theorem indexedVecFamilyCandidate_view_eq :
+    indexedVecFamilyCandidate.view = indexedVecInfo.type := by
+  have habstract (context : Ix.Theory.Named.AddInductive.Context) (e : Expr) :
+      e.abstract #[context.freshExpr] =
+        Expr.abstract1 context.freshFVarId e := by
+    rw [show #[context.freshExpr] =
+      ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl]
+    simp only [Expr.abstract_eq, Expr.abstractList]
+  simp only [indexedVecFamilyCandidate,
+    Ix.Theory.Named.AddInductive.CandidateExpr.view,
+    indexedVecFamilyCandidateTrace,
+    indexedVecInnerCandidateTrace, indexedVecParamDomainCandidateTrace,
+    indexedVecIndexDomainCandidateTrace, indexedVecTerminalCandidateTrace,
+    Ix.Theory.Named.AddInductive.CandidateExprTrace.view]
+  rw [habstract, habstract]
+  simp [Expr.abstract1, indexedVecTerminalKernel,
+    indexedVecFamilyCandidateContext,
+    Ix.Theory.Named.AddInductive.Context.pushLocalDecl,
+    Ix.Theory.Named.AddInductive.Context.freshFVarId,
+    NameGenerator.next, NameGenerator.curr,
+    indexedVecInfo, ConstantInfo.type, ConstantInfo.toConstantVal]
+  constructor <;> rfl
+
+/-- Every retained family-type candidate node preserves its kernel source.
+This is the structural premise used by the semantic spine interpreter; it is
+stronger than the root `view` equality because it covers both Pi domains and
+the instantiated body under their exact candidate contexts. -/
+theorem indexedVecFamilyCandidate_identity :
+    Ix.Theory.Named.TypeChecker.CandidateExprIdentity
+      indexedVecFamilyCandidate.trace := by
+  change Ix.Theory.Named.TypeChecker.CandidateExprIdentity
+    indexedVecFamilyCandidateTrace
+  unfold indexedVecFamilyCandidateTrace
+  refine .forallE (name := indexedVecParamName) (binderInfo := .default)
+    (body := indexedVecInnerKernel)
+    (annotations := indexedVecParamAnnotations)
+    indexedVecParamDomainCandidateTrace indexedVecInnerCandidateTrace
+    ?_ rfl (.terminal rfl) ?_
+  · rfl
+  · unfold indexedVecInnerCandidateTrace
+    refine .forallE (name := indexedVecIndexName) (binderInfo := .default)
+      (body := indexedVecTerminalKernel)
+      (annotations := indexedVecIndexAnnotations)
+      indexedVecIndexDomainCandidateTrace indexedVecTerminalCandidateTrace
+      ?_ rfl (.terminal rfl) ?_
+    · simpa only [Expr.instantiate1_eq, indexedVecInnerKernel,
+        indexedVecTerminalKernel] using
+        indexedVecInnerKernel_instantiate1
+          indexedVecFamilyCandidateContext.freshExpr
+    · exact .terminal (by
+        simpa only [Expr.instantiate1_eq] using
+          (indexedVecTerminalKernel_instantiate1
+            indexedVecParamCandidateContext.freshExpr).symm)
+
+private theorem indexedVecParamDomainCandidateTrace_loop (fuel : Nat) :
+    Ix.Theory.Named.AddInductive.buildCandidateExpr.loop
+      indexedVecFamilyCandidateContext indexedVecTerminalKernel
+      (fuel + 1) = .ok indexedVecParamDomainCandidateTrace := by
+  simpa only [indexedVecParamDomainCandidateTrace] using
+    Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      indexedVecFamilyCandidateContext indexedVecTerminalKernel
+      (.sort (.succ (.succ (.param `u)))) indexedVecTerminalKernel fuel
+      indexedVecParamDomainCandidateTrace.rootCheck.valid
+      indexedVecParamDomainCandidateTrace.rootWhnf_valid rfl
+
+private theorem indexedVecIndexDomainCandidateTrace_loop (fuel : Nat) :
+    Ix.Theory.Named.AddInductive.buildCandidateExpr.loop
+      indexedVecParamCandidateContext (.const ``Nat []) (fuel + 1) =
+        .ok indexedVecIndexDomainCandidateTrace := by
+  simpa only [indexedVecIndexDomainCandidateTrace] using
+    Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      indexedVecParamCandidateContext (.const ``Nat [])
+      (.sort (.succ .zero)) (.const ``Nat []) fuel
+      indexedVecIndexDomainCandidateTrace.rootCheck.valid
+      indexedVecIndexDomainCandidateTrace.rootWhnf_valid rfl
+
+private theorem indexedVecTerminalCandidateTrace_loop (fuel : Nat) :
+    Ix.Theory.Named.AddInductive.buildCandidateExpr.loop
+      indexedVecIndexCandidateContext
+      (indexedVecTerminalKernel.instantiate1
+        indexedVecParamCandidateContext.freshExpr)
+      (fuel + 1) = .ok indexedVecTerminalCandidateTrace := by
+  simpa only [indexedVecTerminalCandidateTrace] using
+    Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      indexedVecIndexCandidateContext
+      (indexedVecTerminalKernel.instantiate1
+        indexedVecParamCandidateContext.freshExpr)
+      (.sort (.succ (.succ (.param `u)))) indexedVecTerminalKernel fuel
+      indexedVecTerminalCandidateTrace.rootCheck.valid
+      indexedVecTerminalCandidateTrace.rootWhnf_valid rfl
+
+private theorem indexedVecInnerCandidateTrace_loop :
+    Ix.Theory.Named.AddInductive.buildCandidateExpr.loop
+      indexedVecParamCandidateContext
+      (indexedVecInnerKernel.instantiate1
+        indexedVecFamilyCandidateContext.freshExpr) 999 =
+        .ok indexedVecInnerCandidateTrace := by
+  rw [show 999 = 998 + 1 by rfl]
+  simpa only [indexedVecInnerCandidateTrace,
+    indexedVecIndexCandidateContext] using
+    (Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := indexedVecParamCandidateContext)
+      (e := indexedVecInnerKernel.instantiate1
+        indexedVecFamilyCandidateContext.freshExpr)
+      (inferred := .sort indexedVecInnerInferredLevel)
+      (fuel := 998) (name := indexedVecIndexName)
+      (domain := .const ``Nat []) (body := indexedVecTerminalKernel)
+      (binderInfo := .default) (hfresh := indexedVecParamCandidateFresh)
+      (annotations := indexedVecIndexAnnotations)
+      (hannotations := indexedVecIndexAnnotations_build)
+      (hannotationsEq := indexedVecIndexAnnotationsEq)
+      (hcheck := indexedVecInnerCandidateTrace.rootCheck.valid)
+      (hrun := indexedVecInnerCandidateTrace.rootWhnf_valid)
+      (domainCandidate := indexedVecIndexDomainCandidateTrace)
+      (bodyCandidate := indexedVecTerminalCandidateTrace)
+      (hdomain := by
+        simpa using indexedVecIndexDomainCandidateTrace_loop 997)
+      (hbody := by
+        simpa [indexedVecIndexCandidateContext,
+          indexedVecIndexAnnotations] using
+          indexedVecTerminalCandidateTrace_loop 997))
+
+private theorem indexedVecFamilyCandidateTrace_loop :
+    Ix.Theory.Named.AddInductive.buildCandidateExpr.loop
+      indexedVecFamilyCandidateContext indexedVecInfo.type
+      indexedVecFamilyCandidateContext.fuel.inductiveFuel =
+        .ok indexedVecFamilyCandidateTrace := by
+  change Ix.Theory.Named.AddInductive.buildCandidateExpr.loop
+    indexedVecFamilyCandidateContext indexedVecInfo.type (999 + 1) = _
+  simpa only [indexedVecFamilyCandidateTrace,
+    indexedVecParamCandidateContext] using
+    (Ix.Theory.Named.AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := indexedVecFamilyCandidateContext)
+      (e := indexedVecInfo.type)
+      (inferred := .sort indexedVecFamilyInferredLevel)
+      (fuel := 999) (name := indexedVecParamName)
+      (domain := indexedVecTerminalKernel) (body := indexedVecInnerKernel)
+      (binderInfo := .default) (hfresh := indexedVecFamilyCandidateFresh)
+      (annotations := indexedVecParamAnnotations)
+      (hannotations := indexedVecParamAnnotations_build)
+      (hannotationsEq := indexedVecParamAnnotationsEq)
+      (hcheck := indexedVecFamilyCandidateTrace.rootCheck.valid)
+      (hrun := indexedVecFamilyCandidateTrace.rootWhnf_valid)
+      (domainCandidate := indexedVecParamDomainCandidateTrace)
+      (bodyCandidate := indexedVecInnerCandidateTrace)
+      (hdomain := by
+        simpa using indexedVecParamDomainCandidateTrace_loop 998)
+      (hbody := by
+        simpa [indexedVecParamCandidateContext,
+          indexedVecParamAnnotations, indexedVecTerminalKernel] using
+          indexedVecInnerCandidateTrace_loop))
+
+/-- The executable candidate traversal preserves the real IndexedVec family
+telescope and classifies its first binder as a parameter and its second as an
+index in the subsequent family-validation pass. -/
+theorem indexedVecFamily_candidateTrace :
+    Ix.Theory.Named.AddInductive.buildCandidateExpr indexedVecInfo.type
+      indexedVecFamilyCandidateContext = .ok indexedVecFamilyCandidate := by
+  unfold Ix.Theory.Named.AddInductive.buildCandidateExpr
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  rw [indexedVecFamilyCandidateTrace_loop]
+  rfl
+
+/-- The executable IndexedVec family candidate retains its parameter and
+index binders in order. -/
+theorem indexedVecFamilyCandidate_spineLength :
+    indexedVecFamilyCandidate.trace.spineLength = 2 := by
+  rfl
+
+theorem indexedVecFamilyCandidate_validationAnnotations :
+    indexedVecFamilyCandidate.trace.validationAnnotations := by
+  exact ⟨indexedVecParamAnnotations_match,
+    indexedVecIndexAnnotations_match, trivial⟩
+
+theorem indexedVecFamilyCandidate_terminalResult :
+    indexedVecFamilyCandidate.trace.terminalResult =
+      .sort (.succ (.param `u)) := by
+  rfl
+
+def indexedVecKernelNil : Constructor where
+  name := indexedVecNilInfo.name
+  type := indexedVecNilInfo.type
+
+def indexedVecKernelCons : Constructor where
+  name := indexedVecConsInfo.name
+  type := indexedVecConsInfo.type
+
+def indexedVecKernelType : InductiveType where
+  name := indexedVecInfo.name
+  type := indexedVecInfo.type
+  ctors := [indexedVecKernelNil, indexedVecKernelCons]
+
+def indexedVecCandidateInductiveStats :
+    Ix.Theory.Named.AddInductive.InductiveStats :=
+  indexedVecFamilyCandidate.trace.singletonCandidateInductiveStats
+    indexedVecKernelType 1 (.succ (.param `u))
+
+private theorem indexedVecFamily_data_hasExprMVar_false :
+    indexedVecInfo.type.data.hasExprMVar = false := by
+  change indexedVecInfo.type.hasExprMVar = false
+  rw [Expr.hasExprMVar_eq]
+  rfl
+
+private theorem indexedVecFamily_data_hasLevelMVar_false :
+    indexedVecInfo.type.data.hasLevelMVar = false := by
+  change indexedVecInfo.type.hasLevelMVar = false
+  rw [Expr.hasLevelMVar_eq]
+  simp [indexedVecInfo, ConstantInfo.type, ConstantInfo.toConstantVal,
+    Expr.hasLevelMVar', Level.hasMVar_eq, Level.hasMVar']
+
+private theorem indexedVecFamily_data_hasFVar_false :
+    indexedVecInfo.type.data.hasFVar = false := by
+  change indexedVecInfo.type.hasFVar = false
+  rw [Expr.hasFVar_eq]
+  rfl
+
+private theorem indexedVecFamily_hasMVar_false :
+    indexedVecInfo.type.hasMVar = false := by
+  change (indexedVecInfo.type.data.hasExprMVar ||
+    indexedVecInfo.type.data.hasLevelMVar) = false
+  rw [indexedVecFamily_data_hasExprMVar_false,
+    indexedVecFamily_data_hasLevelMVar_false]
+  rfl
+
+private theorem indexedVecFamily_hasFVar_false :
+    indexedVecInfo.type.hasFVar = false := by
+  exact indexedVecFamily_data_hasFVar_false
+
+private theorem indexedVecFamily_closed :
+    indexedVecFamilyCandidateContext.env.checkNoMVarNoFVar
+      indexedVecKernelType.name indexedVecKernelType.type = .ok () := by
+  unfold Kernel.Environment.checkNoMVarNoFVar
+    Kernel.Environment.checkNoMVar Kernel.Environment.checkNoFVar
+  rw [show indexedVecKernelType.type.hasMVar = false by
+    simpa [indexedVecKernelType] using indexedVecFamily_hasMVar_false]
+  rw [show indexedVecKernelType.type.hasFVar = false by
+    simpa [indexedVecKernelType] using indexedVecFamily_hasFVar_false]
+  rfl
+
+private theorem indexedVecTerminal_ensureSortM :
+    Ix.Theory.Named.TypeChecker.M.run
+      indexedVecFamilyCandidate.trace.terminalContext.env
+      indexedVecFamilyCandidate.trace.terminalContext.safety
+      indexedVecFamilyCandidate.trace.terminalContext.lctx
+      indexedVecFamilyCandidate.trace.terminalContext.lparams
+      indexedVecFamilyCandidate.trace.terminalContext.fuel
+      (Ix.Theory.Named.TypeChecker.ensureSort
+        (.sort (.succ (.param `u)))) =
+      .ok (.sort (.succ (.param `u))) := by
+  rfl
+
+/-- The real IndexedVec family telescope drives the complete singleton
+family-validation pass with one parameter and one index. -/
+theorem indexedVec_checkInductiveTypes
+    (k : Ix.Theory.Named.AddInductive.InductiveStats →
+      Ix.Theory.Named.AddInductive.M α) :
+    Ix.Theory.Named.AddInductive.checkInductiveTypes 1
+        #[indexedVecKernelType] k indexedVecFamilyCandidateContext =
+      k indexedVecCandidateInductiveStats
+        indexedVecFamilyCandidate.trace.terminalContext := by
+  change Ix.Theory.Named.AddInductive.checkInductiveTypes 1
+      #[indexedVecKernelType] k indexedVecFamilyCandidate.context =
+    k indexedVecCandidateInductiveStats
+      indexedVecFamilyCandidate.trace.terminalContext
+  exact
+    Ix.Theory.Named.AddInductive.CandidateExprTrace.checkInductiveTypes_singleton_of_candidate
+      (indType := indexedVecKernelType)
+      (candidate := indexedVecFamilyCandidate.trace)
+      (nparams := 1) (resultLevel := .succ (.param `u)) (k := k)
+      indexedVecFamily_closed (by decide) (by decide)
+      ⟨indexedVecParamAnnotations_match,
+        indexedVecIndexAnnotations_match, trivial⟩
+      rfl indexedVecTerminal_ensureSortM
+
+theorem indexedVecCandidateInductiveStats_nindices :
+    indexedVecCandidateInductiveStats.nindices = #[1] := by
+  rfl
+
+theorem indexedVecCandidateInductiveStats_params :
+    indexedVecCandidateInductiveStats.params =
+    #[indexedVecFamilyCandidateContext.freshExpr] := by
+  rfl
+
+theorem indexedVecCandidateInductiveStats_resultLevel :
+    indexedVecCandidateInductiveStats.resultLevel =
+    .succ (.param `u) := by
+  rfl
+
+theorem indexedVecCandidateInductiveStats_indConsts :
+    indexedVecCandidateInductiveStats.indConsts =
+    #[.const ``IndexedVec [.param `u]] := by
+  rfl
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.candidateIsDefEqSelfValid [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Syntax.structEq_eq]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecFamily_candidateTrace [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVec_checkInductiveTypes [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecCandidateInductiveStats_nindices [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecCandidateInductiveStats_params [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/IndexedVecConsReplay.lean b/Ix/Theory/Named/Verify/Environment/IndexedVecConsReplay.lean
new file mode 100644
index 000000000..15ccbc80b
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/IndexedVecConsReplay.lean
@@ -0,0 +1,2863 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.IndexedVecConstructors
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta
+open Ix.Theory.Named.InductiveFixtures
+
+namespace IndexedVecConsReplay
+
+
+
+
+
+
+def replayInsert (state : TypeChecker.State) (e type : Expr) :
+    TypeChecker.State :=
+  { state with inferTypeC := state.inferTypeC.insert e type }
+
+open private mkLevelIMaxCore mkLevelMaxCore from Lean.Level in
+@[simp] theorem replayMkLevelIMaxSuccParamSelf :
+    mkLevelIMax' (.succ (.param `u)) (.succ (.param `u)) =
+      .succ (.param `u) := by
+  simp [mkLevelIMax', mkLevelIMaxCore, mkLevelMax', mkLevelMaxCore]
+
+def replayFirstApp (alpha : Expr) : Expr :=
+  .app (.const ``IndexedVec [.param `u]) alpha
+
+@[simp] theorem replayAppBeqFVar (fn arg : Expr) (id : FVarId) :
+    ((.app fn arg : Expr) == .fvar id) = false := by
+  change Expr.eqv (.app fn arg) (.fvar id) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem replayFVarBeqApp (id : FVarId) (fn arg : Expr) :
+    ((.fvar id : Expr) == .app fn arg) = false := by
+  change Expr.eqv (.fvar id) (.app fn arg) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem replayConstBeqApp
+    (name : Name) (levels : List Level) (fn arg : Expr) :
+    ((.const name levels : Expr) == .app fn arg) = false := by
+  change Expr.eqv (.const name levels) (.app fn arg) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem replayAppBeqConst
+    (fn arg : Expr) (name : Name) (levels : List Level) :
+    ((.app fn arg : Expr) == .const name levels) = false := by
+  change Expr.eqv (.app fn arg) (.const name levels) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem replayIndexedVecConstBeqSucc :
+    ((.const ``IndexedVec [.param `u] : Expr) ==
+      .const ``Nat.succ []) = false := by
+  change Expr.eqv (.const ``IndexedVec [.param `u])
+    (.const ``Nat.succ []) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv']
+
+@[simp] theorem replayAlphaBeqN :
+    ((consAlphaExpr : Expr) == consNExpr) = false := by
+  change Expr.eqv consAlphaExpr consNExpr = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', consAlphaExpr, consNExpr, consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl, AddInductive.Context.freshExpr,
+    AddInductive.Context.freshFVarId, NameGenerator.next, NameGenerator.curr]
+
+@[simp] theorem replayAlphaIdBeqNId :
+    ((.fvar consAlphaId : Expr) == .fvar consNId) = false := by
+  simpa using replayAlphaBeqN
+
+theorem replayInferFirstAppFVarCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (id : FVarId)
+    (hfamily : state.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none)
+    (halpha : (replayInsert state
+      (.const ``IndexedVec [.param `u]) indexedVecInfo.type).inferTypeC[
+        (.fvar id : Expr)]? = none)
+    (happ : state.inferTypeC[replayFirstApp (.fvar id)]? = none)
+    (hfind : lctx.find? id = some (.cdecl index id name
+      (.sort (.succ (.param `u))) bi kind)) :
+    TypeChecker.Inner.inferType' (replayFirstApp (.fvar id)) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (vecFamilyTail,
+          replayInsert
+            (replayInsert
+              (replayInsert state
+                (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+              (.fvar id) (.sort (.succ (.param `u))))
+            (replayFirstApp (.fvar id)) vecFamilyTail) := by
+  have hfamilyRun := inferTypeFamilyCore fuel lctx state hfamily
+  have halphaRun := inferTypeFVarCore fuel lctx
+    (replayInsert state (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+    id (.sort (.succ (.param `u))) halpha hfind
+  have happRun := inferAppCoreOf fuel (tcContext lctx)
+    state
+    (replayInsert state (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+    (replayInsert
+      (replayInsert state (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+      (.fvar id) (.sort (.succ (.param `u))))
+    (.const ``IndexedVec [.param `u]) (.fvar id)
+    (.sort (.succ (.param `u))) vecFamilyTail `α .default
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    happ
+    (by simpa [replayInsert, indexedVecInfoTypeShape] using hfamilyRun)
+    (by simpa [replayInsert] using halphaRun)
+    (by rfl)
+  simpa [replayInsert, replayFirstApp, vecFamilyTail,
+    Expr.instantiate1'] using happRun
+
+def replaySuccApp (n : Expr) : Expr :=
+  .app (.const ``Nat.succ []) n
+
+@[simp] theorem replayFirstAppBeqSuccApp (alpha n : Expr) :
+    (replayFirstApp alpha == replaySuccApp n) = false := by
+  change Expr.eqv (replayFirstApp alpha) (replaySuccApp n) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', replayFirstApp, replaySuccApp]
+
+@[simp] theorem replayFirstAppBeqSuccLiteral (alpha n : Expr) :
+    (replayFirstApp alpha == .app (.const ``Nat.succ []) n) = false := by
+  simpa [replaySuccApp] using replayFirstAppBeqSuccApp alpha n
+
+theorem replayInferSuccFVarCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (id : FVarId)
+    (hsucc : state.inferTypeC[(.const ``Nat.succ [] : Expr)]? = none)
+    (hn : (replayInsert state (.const ``Nat.succ [])
+      (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)).inferTypeC[
+        (.fvar id : Expr)]? = none)
+    (happ : state.inferTypeC[replaySuccApp (.fvar id)]? = none)
+    (hfind : lctx.find? id = some (.cdecl index id name
+      (.const ``Nat []) bi kind)) :
+    TypeChecker.Inner.inferType' (replaySuccApp (.fvar id)) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.const ``Nat [],
+          replayInsert
+            (replayInsert
+              (replayInsert state (.const ``Nat.succ [])
+                (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+              (.fvar id) (.const ``Nat []))
+            (replaySuccApp (.fvar id)) (.const ``Nat [])) := by
+  have hsuccRun := inferTypeSuccCore fuel lctx state hsucc
+  have hnRun := inferTypeFVarCore fuel lctx
+    (replayInsert state (.const ``Nat.succ [])
+      (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+    id (.const ``Nat []) hn hfind
+  have happRun := inferAppCoreOf fuel (tcContext lctx)
+    state
+    (replayInsert state (.const ``Nat.succ [])
+      (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+    (replayInsert
+      (replayInsert state (.const ``Nat.succ [])
+        (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+      (.fvar id) (.const ``Nat []))
+    (.const ``Nat.succ []) (.fvar id) (.const ``Nat [])
+    (.const ``Nat []) `n .default
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    happ
+    (by simpa [replayInsert] using hsuccRun)
+    (by simpa [replayInsert] using hnRun)
+    (by rfl)
+  simpa [replayInsert, replaySuccApp, Expr.instantiate1_eq,
+    Expr.instantiate1'] using happRun
+
+theorem replayInferIndexedVecAppCore
+    (fuel : Nat) (lctx : LocalContext)
+    (state stateFn stateArg : TypeChecker.State)
+    (alpha indexExpr : Expr)
+    (hclosed : (ctorIndexedVecApp alpha indexExpr).hasLooseBVars = false)
+    (hcache : state.inferTypeC[ctorIndexedVecApp alpha indexExpr]? = none)
+    (hfn : TypeChecker.Inner.inferType' (replayFirstApp alpha) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (vecFamilyTail, stateFn))
+    (harg : TypeChecker.Inner.inferType' indexExpr false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) stateFn =
+        .ok (.const ``Nat [], stateArg))
+    (heager : indexExpr.isAppOfArity ``eagerReduce 2 = false) :
+    TypeChecker.Inner.inferType' (ctorIndexedVecApp alpha indexExpr) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.sort (.succ (.param `u)),
+          replayInsert stateArg (ctorIndexedVecApp alpha indexExpr)
+            (.sort (.succ (.param `u)))) := by
+  have h := inferAppCoreOf fuel (tcContext lctx) state stateFn stateArg
+    (replayFirstApp alpha) indexExpr (.const ``Nat [])
+    (.sort (.succ (.param `u))) vecIndexName .default
+    hclosed hcache
+    (by simpa [replayFirstApp, vecFamilyTail] using hfn) harg heager
+  simpa [replayInsert, ctorIndexedVecApp, replayFirstApp,
+    vecFamilyTail, Expr.instantiate1_eq, Expr.instantiate1'] using h
+
+theorem replayInferTypeCachedCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (e type : Expr)
+    (hclosed : e.hasLooseBVars = false)
+    (hcache : state.inferTypeC[e]? = some type) :
+    TypeChecker.Inner.inferType' e false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (type, state) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [hclosed, hcache]
+
+theorem replayInferFirstAppAlphaCachedCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (alphaId : FVarId)
+    (halpha : state.inferTypeC[(.fvar alphaId : Expr)]? =
+      some (.sort (.succ (.param `u))))
+    (hfamily : state.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none)
+    (happ : state.inferTypeC[replayFirstApp (.fvar alphaId)]? = none) :
+    TypeChecker.Inner.inferType' (replayFirstApp (.fvar alphaId)) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (vecFamilyTail,
+          replayInsert
+            (replayInsert state
+              (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+            (replayFirstApp (.fvar alphaId)) vecFamilyTail) := by
+  let familyState := replayInsert state
+    (.const ``IndexedVec [.param `u]) indexedVecInfo.type
+  have hfamilyRun := inferTypeFamilyCore fuel lctx state hfamily
+  have halphaCache : familyState.inferTypeC[(.fvar alphaId : Expr)]? =
+      some (.sort (.succ (.param `u))) := by
+    simp only [familyState, replayInsert, Std.HashMap.getElem?_insert]
+    rw [constBeqFVar]
+    exact halpha
+  have halphaRun := replayInferTypeCachedCore fuel lctx familyState
+    (.fvar alphaId) (.sort (.succ (.param `u)))
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange']) halphaCache
+  have hrun := inferAppCoreOf fuel (tcContext lctx)
+    state familyState familyState
+    (.const ``IndexedVec [.param `u]) (.fvar alphaId)
+    (.sort (.succ (.param `u))) vecFamilyTail `α .default
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    happ
+    (by simpa [familyState, replayInsert, indexedVecInfoTypeShape] using
+      hfamilyRun)
+    halphaRun (by rfl)
+  simpa [familyState, replayInsert, replayFirstApp, vecFamilyTail,
+    Expr.instantiate1'] using hrun
+
+theorem replayInferTailDomainAlphaCachedCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (alphaId nId : FVarId)
+    (halpha : state.inferTypeC[(.fvar alphaId : Expr)]? =
+      some (.sort (.succ (.param `u))))
+    (hfamily : state.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none)
+    (hfirstApp : state.inferTypeC[
+      replayFirstApp (.fvar alphaId)]? = none)
+    (hn : (replayInsert
+      (replayInsert state (.const ``IndexedVec [.param `u])
+        indexedVecInfo.type)
+      (replayFirstApp (.fvar alphaId)) vecFamilyTail).inferTypeC[
+        (.fvar nId : Expr)]? = none)
+    (htail : state.inferTypeC[
+      ctorIndexedVecApp (.fvar alphaId) (.fvar nId)]? = none)
+    (hfind : lctx.find? nId = some (.cdecl index nId name
+      (.const ``Nat []) bi kind)) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar alphaId) (.fvar nId)) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.sort (.succ (.param `u)),
+          replayInsert
+            (replayInsert
+              (replayInsert
+                (replayInsert state (.const ``IndexedVec [.param `u])
+                  indexedVecInfo.type)
+                (replayFirstApp (.fvar alphaId)) vecFamilyTail)
+              (.fvar nId) (.const ``Nat []))
+            (ctorIndexedVecApp (.fvar alphaId) (.fvar nId))
+            (.sort (.succ (.param `u)))) := by
+  let firstState := replayInsert
+    (replayInsert state (.const ``IndexedVec [.param `u])
+      indexedVecInfo.type)
+    (replayFirstApp (.fvar alphaId)) vecFamilyTail
+  let nState := replayInsert firstState (.fvar nId) (.const ``Nat [])
+  have hfirstRun := replayInferFirstAppAlphaCachedCore fuel lctx state
+    alphaId halpha hfamily hfirstApp
+  have hnRun := inferTypeFVarCore fuel lctx firstState nId
+    (.const ``Nat []) hn hfind
+  have hrun := replayInferIndexedVecAppCore fuel lctx state firstState nState
+    (.fvar alphaId) (.fvar nId)
+    (by simp [ctorIndexedVecApp, Expr.hasLooseBVars,
+      Expr.looseBVarRange'])
+    htail
+    (by simpa [firstState] using hfirstRun)
+    (by simpa [firstState, nState, replayInsert] using hnRun)
+    (by rfl)
+  simpa [firstState, nState, replayInsert] using hrun
+
+theorem replayInferSuccFVarCachedCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (id : FVarId)
+    (hsucc : state.inferTypeC[(.const ``Nat.succ [] : Expr)]? = none)
+    (hn : state.inferTypeC[(.fvar id : Expr)]? = some (.const ``Nat []))
+    (happ : state.inferTypeC[replaySuccApp (.fvar id)]? = none) :
+    TypeChecker.Inner.inferType' (replaySuccApp (.fvar id)) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.const ``Nat [],
+          replayInsert
+            (replayInsert state (.const ``Nat.succ [])
+              (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+            (replaySuccApp (.fvar id)) (.const ``Nat [])) := by
+  let succState := replayInsert state (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+  have hsuccRun := inferTypeSuccCore fuel lctx state hsucc
+  have hnCache : succState.inferTypeC[(.fvar id : Expr)]? =
+      some (.const ``Nat []) := by
+    simp only [succState, replayInsert, Std.HashMap.getElem?_insert]
+    rw [constBeqFVar]
+    exact hn
+  have hnRun := replayInferTypeCachedCore fuel lctx succState
+    (.fvar id) (.const ``Nat [])
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange']) hnCache
+  have happRun := inferAppCoreOf fuel (tcContext lctx)
+    state succState succState
+    (.const ``Nat.succ []) (.fvar id) (.const ``Nat [])
+    (.const ``Nat []) `n .default
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    happ
+    (by simpa [succState, replayInsert] using hsuccRun)
+    hnRun (by rfl)
+  simpa [succState, replayInsert, replaySuccApp,
+    Expr.instantiate1_eq, Expr.instantiate1'] using happRun
+
+theorem replayInferIndexedVecSuccFromCacheCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (alphaId nId : FVarId)
+    (hfirst : state.inferTypeC[replayFirstApp (.fvar alphaId)]? =
+      some vecFamilyTail)
+    (hsucc : state.inferTypeC[(.const ``Nat.succ [] : Expr)]? = none)
+    (hn : state.inferTypeC[(.fvar nId : Expr)]? = some (.const ``Nat []))
+    (hsuccApp : state.inferTypeC[replaySuccApp (.fvar nId)]? = none)
+    (hresult : state.inferTypeC[
+      ctorIndexedVecApp (.fvar alphaId) (replaySuccApp (.fvar nId))]? = none) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar alphaId) (replaySuccApp (.fvar nId))) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.sort (.succ (.param `u)),
+          replayInsert
+            (replayInsert
+              (replayInsert state (.const ``Nat.succ [])
+                (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+              (replaySuccApp (.fvar nId)) (.const ``Nat []))
+            (ctorIndexedVecApp (.fvar alphaId)
+              (replaySuccApp (.fvar nId)))
+            (.sort (.succ (.param `u)))) := by
+  let succState := replayInsert state (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+  let succAppState := replayInsert succState
+    (replaySuccApp (.fvar nId)) (.const ``Nat [])
+  have hfirstRun := replayInferTypeCachedCore fuel lctx state
+    (replayFirstApp (.fvar alphaId)) vecFamilyTail
+    (by simp [replayFirstApp, Expr.hasLooseBVars,
+      Expr.looseBVarRange']) hfirst
+  have hsuccRun := replayInferSuccFVarCachedCore fuel lctx state nId
+    hsucc hn hsuccApp
+  have h := replayInferIndexedVecAppCore fuel lctx state state succAppState
+    (.fvar alphaId) (replaySuccApp (.fvar nId))
+    (by simp [ctorIndexedVecApp, replaySuccApp,
+      Expr.hasLooseBVars, Expr.looseBVarRange'])
+    hresult hfirstRun
+    (by simpa [succState, succAppState] using hsuccRun)
+    (by rfl)
+  simpa [succState, succAppState, replayInsert] using h
+
+def consHeadFirstAppState : TypeChecker.State :=
+  replayInsert
+    (replayInsert
+      (replayInsert ({} : TypeChecker.State)
+        (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+      consAlphaExpr (.sort (.succ (.param `u))))
+    (replayFirstApp consAlphaExpr) vecFamilyTail
+
+def consHeadNState : TypeChecker.State :=
+  replayInsert consHeadFirstAppState consNExpr (.const ``Nat [])
+
+def consTailDomainFinalState : TypeChecker.State :=
+  replayInsert consHeadNState consTailDomain
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsHeadFirstApp (fuel : Nat) :
+    TypeChecker.Inner.inferType' (replayFirstApp consAlphaExpr) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State) =
+        .ok (vecFamilyTail, consHeadFirstAppState) := by
+  simpa [consHeadFirstAppState, consAlphaExprShape] using
+    (replayInferFirstAppFVarCore fuel consHeadContext.lctx
+      ({} : TypeChecker.State) consAlphaId
+      (by simp)
+      (by simp [replayInsert])
+      (by simp [replayFirstApp])
+      consAlphaFindInHead)
+
+theorem replayInferConsHeadN (fuel : Nat) :
+    TypeChecker.Inner.inferType' consNExpr false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consHeadContext.lctx) consHeadFirstAppState =
+        .ok (.const ``Nat [], consHeadNState) := by
+  simpa [consHeadNState, consNExprShape, replayInsert] using
+    (inferTypeFVarCore fuel consHeadContext.lctx
+      consHeadFirstAppState consNId (.const ``Nat [])
+      (index := 1) (name := consNName) (bi := .implicit)
+      (kind := .default)
+      (by simp [consHeadFirstAppState, replayInsert, replayFirstApp])
+      consNFindInHead)
+
+theorem replayInferConsTailDomainCore (fuel : Nat) :
+    TypeChecker.Inner.inferType' consTailDomain false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)), consTailDomainFinalState) := by
+  simpa [consTailDomainFinalState, consTailDomain,
+    ctorIndexedVecApp, replayFirstApp] using
+    (replayInferIndexedVecAppCore fuel consHeadContext.lctx
+      ({} : TypeChecker.State) consHeadFirstAppState consHeadNState
+      consAlphaExpr consNExpr
+      (by simp [ctorIndexedVecApp, consAlphaExprShape,
+        consNExprShape, Expr.hasLooseBVars, Expr.looseBVarRange'])
+      (by simp [ctorIndexedVecApp, consAlphaExprShape, consNExprShape])
+      (replayInferConsHeadFirstApp fuel) (replayInferConsHeadN fuel) (by rfl))
+
+theorem replayInferConsTailDomain :
+    TypeChecker.Inner.inferType consTailDomain false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)), consTailDomainFinalState) := by
+  change TypeChecker.Inner.inferType' consTailDomain false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State) = _
+  exact replayInferConsTailDomainCore 9999
+
+theorem replayConsTailDomainCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe consHeadContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType consTailDomain) =
+        .ok (.sort (.succ (.param `u))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType consTailDomain false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State)) = _
+  rw [replayInferConsTailDomain]
+  rfl
+
+def consTailFirstAppState : TypeChecker.State :=
+  replayInsert
+    (replayInsert
+      (replayInsert ({} : TypeChecker.State)
+        (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+      consAlphaExpr (.sort (.succ (.param `u))))
+    (replayFirstApp consAlphaExpr) vecFamilyTail
+
+def consTailSuccState : TypeChecker.State :=
+  replayInsert
+    (replayInsert
+      (replayInsert consTailFirstAppState (.const ``Nat.succ [])
+        (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+      consNExpr (.const ``Nat []))
+    (replaySuccApp consNExpr) (.const ``Nat [])
+
+def consTerminalFinalState : TypeChecker.State :=
+  replayInsert consTailSuccState consTerminal
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsTailFirstApp :
+    TypeChecker.Inner.inferType' (replayFirstApp consAlphaExpr) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consTailContext.lctx) ({} : TypeChecker.State) =
+        .ok (vecFamilyTail, consTailFirstAppState) := by
+  simpa [consTailFirstAppState, consAlphaExprShape] using
+    (replayInferFirstAppFVarCore 9999 consTailContext.lctx
+      ({} : TypeChecker.State) consAlphaId
+      (by simp)
+      (by simp [replayInsert])
+      (by simp [replayFirstApp])
+      consAlphaFindInTail)
+
+theorem replayInferConsTailSucc :
+    TypeChecker.Inner.inferType' (replaySuccApp consNExpr) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consTailContext.lctx) consTailFirstAppState =
+        .ok (.const ``Nat [], consTailSuccState) := by
+  simpa [consTailSuccState, consNExprShape] using
+    (replayInferSuccFVarCore 9999 consTailContext.lctx
+      consTailFirstAppState consNId
+      (by simp [consTailFirstAppState, replayInsert, replayFirstApp])
+      (by simp [consTailFirstAppState, replayInsert,
+        replayFirstApp])
+      (by simp [consTailFirstAppState, replayInsert, replaySuccApp])
+      consNFindInTail)
+
+theorem replayInferConsTerminal :
+    TypeChecker.Inner.inferType consTerminal false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consTailContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)), consTerminalFinalState) := by
+  change TypeChecker.Inner.inferType' consTerminal false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consTailContext.lctx) ({} : TypeChecker.State) = _
+  simpa [consTerminalFinalState, consTerminal,
+    ctorIndexedVecApp, replayFirstApp, replaySuccApp] using
+    (replayInferIndexedVecAppCore 9999 consTailContext.lctx
+      ({} : TypeChecker.State) consTailFirstAppState consTailSuccState
+      consAlphaExpr (replaySuccApp consNExpr)
+      (by simp [ctorIndexedVecApp, replaySuccApp,
+        Expr.hasLooseBVars, Expr.looseBVarRange'])
+      (by simp [ctorIndexedVecApp, replaySuccApp])
+      replayInferConsTailFirstApp replayInferConsTailSucc
+      (by rfl))
+
+theorem replayConsTerminalCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe consTailContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType consTerminal) =
+        .ok (.sort (.succ (.param `u))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType consTerminal false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consTailContext.lctx) ({} : TypeChecker.State)) = _
+  rw [replayInferConsTerminal]
+  rfl
+
+theorem replayConsTailDomainWhnfM :
+    TypeChecker.M.run ctorEnv .safe consHeadContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.whnf consTailDomain) =
+        .ok consTailDomain := by
+  simpa [consTailDomain, ctorIndexedVecApp] using
+    (ctorIndexedVecWhnfM consHeadContext.lctx consAlphaExpr consNExpr)
+
+theorem replayConsTerminalWhnfM :
+    TypeChecker.M.run ctorEnv .safe consTailContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.whnf consTerminal) =
+        .ok consTerminal := by
+  simpa [consTerminal, ctorIndexedVecApp, replaySuccApp] using
+    (ctorIndexedVecWhnfM consTailContext.lctx consAlphaExpr
+      (replaySuccApp consNExpr))
+
+theorem replayConsRootWhnfM :
+    TypeChecker.M.run ctorEnv .safe {} [`u] ({} : FuelConfig)
+    (TypeChecker.whnf indexedVecConsInfo.type) =
+      .ok indexedVecConsInfo.type := by rfl
+
+theorem replayConsAfterAlphaWhnfM :
+    TypeChecker.M.run ctorEnv .safe consAlphaContext.lctx [`u]
+    ({} : FuelConfig) (TypeChecker.whnf consAfterAlpha) =
+      .ok consAfterAlpha := by rfl
+
+theorem replayConsAfterNWhnfM :
+    TypeChecker.M.run ctorEnv .safe consNContext.lctx [`u]
+    ({} : FuelConfig) (TypeChecker.whnf consAfterN) =
+      .ok consAfterN := by rfl
+
+theorem replayConsAfterHeadWhnfM :
+    TypeChecker.M.run ctorEnv .safe consHeadContext.lctx [`u]
+    ({} : FuelConfig) (TypeChecker.whnf consAfterHead) =
+      .ok consAfterHead := by rfl
+
+def consAfterHeadCheckTailId : FVarId :=
+  ⟨consTailDomainFinalState.ngen.curr⟩
+
+def consAfterHeadCheckLctx : LocalContext :=
+  consHeadContext.lctx.mkLocalDecl consAfterHeadCheckTailId
+    consTailName consTailDomain .default
+
+def consAfterHeadCheckState : TypeChecker.State :=
+  { consTailDomainFinalState with
+    ngen := consTailDomainFinalState.ngen.next }
+
+@[simp] theorem replayTailDomainBeqFirstApp :
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId) ==
+      replayFirstApp (.fvar consAlphaId)) = false := by
+  change Expr.eqv
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId))
+    (replayFirstApp (.fvar consAlphaId)) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replayFirstApp]
+
+@[simp] theorem replayTailDomainBeqSuccApp :
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId) ==
+      replaySuccApp (.fvar consNId)) = false := by
+  change Expr.eqv
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId))
+    (replaySuccApp (.fvar consNId)) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replaySuccApp]
+
+@[simp] theorem replayTailDomainBeqTerminal :
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId) ==
+      ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consNId))) = false := by
+  change Expr.eqv
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId))
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (replaySuccApp (.fvar consNId))) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replaySuccApp]
+
+@[simp] theorem replayFirstAppBeqTerminal :
+    (replayFirstApp (.fvar consAlphaId) ==
+      ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consNId))) = false := by
+  change Expr.eqv (replayFirstApp (.fvar consAlphaId))
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (replaySuccApp (.fvar consNId))) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+@[simp] theorem replayTailDomainLiteralBeqFirstApp :
+    (((.const ``IndexedVec [.param `u] : Expr).app (.fvar consAlphaId)).app
+        (.fvar consNId) ==
+      (.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)) = false := by
+  simpa [ctorIndexedVecApp, replayFirstApp] using
+    replayTailDomainBeqFirstApp
+
+@[simp] theorem replayTailDomainLiteralBeqSuccApp :
+    (((.const ``IndexedVec [.param `u] : Expr).app (.fvar consAlphaId)).app
+        (.fvar consNId) ==
+      (.const ``Nat.succ [] : Expr).app (.fvar consNId)) = false := by
+  simpa [ctorIndexedVecApp, replaySuccApp] using
+    replayTailDomainBeqSuccApp
+
+@[simp] theorem replayFirstAppLiteralBeqSuccApp :
+    ((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId) ==
+      (.const ``Nat.succ [] : Expr).app (.fvar consNId)) = false := by
+  simpa only [replayFirstApp, replaySuccApp] using
+    (replayFirstAppBeqSuccApp (.fvar consAlphaId) (.fvar consNId))
+
+@[simp] theorem replayTailDomainLiteralBeqTerminal :
+    (((.const ``IndexedVec [.param `u] : Expr).app (.fvar consAlphaId)).app
+        (.fvar consNId) ==
+      ((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app
+        ((.const ``Nat.succ [] : Expr).app (.fvar consNId))) = false := by
+  simpa [ctorIndexedVecApp, replaySuccApp] using
+    replayTailDomainBeqTerminal
+
+@[simp] theorem replayFirstAppLiteralBeqTerminal :
+    ((.const ``IndexedVec [.param `u] : Expr).app (.fvar consAlphaId) ==
+      ((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app
+        ((.const ``Nat.succ [] : Expr).app (.fvar consNId))) = false := by
+  simpa [ctorIndexedVecApp, replayFirstApp, replaySuccApp] using
+    replayFirstAppBeqTerminal
+
+theorem consAfterHeadCheckFirstCache :
+    consAfterHeadCheckState.inferTypeC[
+      replayFirstApp (.fvar consAlphaId)]? = some vecFamilyTail := by
+  change consTailDomainFinalState.inferTypeC[
+    replayFirstApp (.fvar consAlphaId)]? = some vecFamilyTail
+  unfold consTailDomainFinalState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (consTailDomain == replayFirstApp (.fvar consAlphaId)) =
+      false by
+    simpa only [consTailDomain, ctorIndexedVecApp,
+      consAlphaExprShape, consNExprShape] using
+      replayTailDomainBeqFirstApp]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consHeadNState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (consNExpr == replayFirstApp (.fvar consAlphaId)) = false by
+    simp [consNExprShape, replayFirstApp]]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consHeadFirstAppState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (replayFirstApp consAlphaExpr ==
+      replayFirstApp (.fvar consAlphaId)) = true by simp]
+  rfl
+
+theorem consAfterHeadCheckNCache :
+    consAfterHeadCheckState.inferTypeC[(.fvar consNId : Expr)]? =
+      some (.const ``Nat []) := by
+  change consTailDomainFinalState.inferTypeC[(.fvar consNId : Expr)]? =
+    some (.const ``Nat [])
+  unfold consTailDomainFinalState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (consTailDomain == (.fvar consNId : Expr)) = false by
+    simpa only [consTailDomain, consAlphaExprShape, consNExprShape] using
+      (replayAppBeqFVar
+        ((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)) (.fvar consNId) consNId)]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consHeadNState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (consNExpr == (.fvar consNId : Expr)) = true by simp]
+  rfl
+
+theorem consAfterHeadCheckSuccMiss :
+    consAfterHeadCheckState.inferTypeC[(.const ``Nat.succ [] : Expr)]? =
+      none := by
+  simp [consAfterHeadCheckState, consTailDomainFinalState, consHeadNState, consHeadFirstAppState,
+    replayInsert, consTailDomain, replayFirstApp]
+
+theorem consAfterHeadCheckSuccAppMiss :
+    consAfterHeadCheckState.inferTypeC[
+      replaySuccApp (.fvar consNId)]? = none := by
+  simp [consAfterHeadCheckState, consTailDomainFinalState, consHeadNState, consHeadFirstAppState,
+    replayInsert, consTailDomain, replayFirstApp, replaySuccApp]
+
+theorem consAfterHeadCheckTerminalMiss :
+    consAfterHeadCheckState.inferTypeC[
+      ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consNId))]? = none := by
+  simp [consAfterHeadCheckState, consTailDomainFinalState, consHeadNState, consHeadFirstAppState,
+    replayInsert, consTailDomain, ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+def consAfterHeadCheckSuccState : TypeChecker.State :=
+  replayInsert consAfterHeadCheckState (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+
+def consAfterHeadCheckSuccAppState : TypeChecker.State :=
+  replayInsert consAfterHeadCheckSuccState
+    (replaySuccApp (.fvar consNId)) (.const ``Nat [])
+
+def consAfterHeadCheckTerminalState : TypeChecker.State :=
+  replayInsert consAfterHeadCheckSuccAppState
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (replaySuccApp (.fvar consNId)))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterHeadTerminal :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consNId))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterHeadCheckLctx) consAfterHeadCheckState =
+        .ok (.sort (.succ (.param `u)),
+          consAfterHeadCheckTerminalState) := by
+  simpa [consAfterHeadCheckSuccState,
+    consAfterHeadCheckSuccAppState,
+    consAfterHeadCheckTerminalState] using
+    (replayInferIndexedVecSuccFromCacheCore 9998 consAfterHeadCheckLctx
+      consAfterHeadCheckState consAlphaId consNId
+      consAfterHeadCheckFirstCache consAfterHeadCheckSuccMiss
+      consAfterHeadCheckNCache consAfterHeadCheckSuccAppMiss
+      consAfterHeadCheckTerminalMiss)
+
+theorem replayConsAfterHeadCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe consHeadContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType consAfterHead) =
+        .ok (.sort (.succ (.param `u))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType consAfterHead false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State)) = _
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' consAfterHead false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State)) = _
+  unfold consAfterHead consTailDomain TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', TypeChecker.Inner.inferForall,
+    TypeChecker.Inner.inferForall.loop, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show TypeChecker.Inner.inferType'
+      (.app
+        (.app (.const ``IndexedVec [.param `u]) (.fvar consAlphaId))
+        (.fvar consNId)) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consHeadContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)), consTailDomainFinalState) by
+    simpa [consTailDomain, ctorIndexedVecApp] using
+      replayInferConsTailDomainCore 9998]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp [Expr.instantiate1']
+  have hterminal :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)).app
+          ((.const ``Nat.succ [] : Expr).app (.fvar consNId))) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consAfterHeadCheckLctx) consAfterHeadCheckState =
+          .ok (.sort (.succ (.param `u)),
+            consAfterHeadCheckTerminalState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app
+        ((.const ``Nat.succ [] : Expr).app (.fvar consNId))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterHeadCheckLctx) consAfterHeadCheckState = _
+    simpa [ctorIndexedVecApp, replaySuccApp] using
+      replayInferConsAfterHeadTerminal
+  simp only [consAfterHeadCheckLctx, consAfterHeadCheckTailId,
+    consAfterHeadCheckState, consTailDomain, consAlphaExprShape,
+    consNExprShape, tcContext] at hterminal
+  simp only [tcContext]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hterminal]
+  simp only [ensureSortExact]
+  simp [Expr.sortLevel!, Pure.pure, ReaderT.pure,
+    StateT.pure, Except.pure]
+  rfl
+
+/-! The two-binder suffix beginning at the `head` field. -/
+
+def consAfterNHeadDomainState : TypeChecker.State :=
+  replayInsert ({} : TypeChecker.State) consAlphaExpr
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterNHeadDomain (fuel : Nat) :
+    TypeChecker.Inner.inferType' consAlphaExpr false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consNContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)),
+          consAfterNHeadDomainState) := by
+  simpa [consAfterNHeadDomainState, replayInsert,
+    consAlphaExprShape] using
+    (inferTypeFVarCore fuel consNContext.lctx ({} : TypeChecker.State)
+      consAlphaId (.sort (.succ (.param `u)))
+      (index := 0) (name := consAlphaName) (bi := .implicit)
+      (kind := .default) (by simp) consAlphaFindInN)
+
+def consAfterNCheckHeadId : FVarId :=
+  ⟨consAfterNHeadDomainState.ngen.curr⟩
+
+def consAfterNCheckLctx : LocalContext :=
+  consNContext.lctx.mkLocalDecl consAfterNCheckHeadId
+    consHeadName consAlphaExpr .default
+
+def consAfterNCheckState : TypeChecker.State :=
+  { consAfterNHeadDomainState with
+    ngen := consAfterNHeadDomainState.ngen.next }
+
+theorem consAfterNCheckHeadFresh :
+    consNContext.lctx.find? consAfterNCheckHeadId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consAfterNCheckHeadId) consNContextWF
+  rw [h]
+  simp [consAfterNCheckHeadId, consAfterNHeadDomainState, replayInsert, consNContext,
+    consAlphaContext, consRootContext, ctorContext, consAlphaId, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl, LocalContext.toList,
+    LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+  intro x hx
+  change some x ∈
+    (PersistentArray.empty : PersistentArray (Option LocalDecl)).toList' at hx
+  rw [PersistentArray.toList'_empty] at hx
+  simp at hx
+
+theorem consAfterNCheckLctxWF : consAfterNCheckLctx.WF := by
+  simpa [consAfterNCheckLctx] using
+    (LocalContext.WF.mkLocalDecl consNContextWF consAfterNCheckHeadFresh)
+
+theorem consAfterNCheckNFind :
+    consAfterNCheckLctx.find? consNId =
+      some (.cdecl 1 consNId consNName (.const ``Nat [])
+        .implicit .default) := by
+  rw [consAfterNCheckLctxWF.find?_eq_find?_toList]
+  simp [consAfterNCheckLctx, consAfterNCheckHeadId, consAfterNHeadDomainState, replayInsert,
+    consNContext, consAlphaContext, consRootContext, ctorContext, consAlphaId, consNId,
+    AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl,
+    LocalContext.toList, LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+
+theorem consAfterNCheckAlphaCache :
+    consAfterNCheckState.inferTypeC[(.fvar consAlphaId : Expr)]? =
+      some (.sort (.succ (.param `u))) := by
+  change consAfterNHeadDomainState.inferTypeC[
+    (.fvar consAlphaId : Expr)]? = some (.sort (.succ (.param `u)))
+  unfold consAfterNHeadDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (consAlphaExpr == (.fvar consAlphaId : Expr)) = true by simp]
+  rfl
+
+theorem consAfterNCheckFamilyMiss :
+    consAfterNCheckState.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none := by
+  simp [consAfterNCheckState, consAfterNHeadDomainState, replayInsert]
+
+theorem consAfterNCheckFirstAppMiss :
+    consAfterNCheckState.inferTypeC[
+      replayFirstApp (.fvar consAlphaId)]? = none := by
+  simp [consAfterNCheckState, consAfterNHeadDomainState,
+    replayInsert, replayFirstApp]
+
+def consAfterNCheckFirstAppState : TypeChecker.State :=
+  replayInsert
+    (replayInsert consAfterNCheckState
+      (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+    (replayFirstApp (.fvar consAlphaId)) vecFamilyTail
+
+theorem consAfterNCheckNMiss :
+    consAfterNCheckFirstAppState.inferTypeC[(.fvar consNId : Expr)]? =
+      none := by
+  simp [consAfterNCheckFirstAppState, consAfterNCheckState,
+    consAfterNHeadDomainState, replayInsert, replayFirstApp]
+
+theorem consAfterNCheckTailMiss :
+    consAfterNCheckState.inferTypeC[
+      ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId)]? = none := by
+  simp [consAfterNCheckState, consAfterNHeadDomainState,
+    replayInsert, ctorIndexedVecApp]
+
+def consAfterNCheckNState : TypeChecker.State :=
+  replayInsert consAfterNCheckFirstAppState
+    (.fvar consNId) (.const ``Nat [])
+
+def consAfterNCheckTailDomainState : TypeChecker.State :=
+  replayInsert consAfterNCheckNState
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterNTailDomain (fuel : Nat) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId)) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consAfterNCheckLctx) consAfterNCheckState =
+        .ok (.sort (.succ (.param `u)),
+          consAfterNCheckTailDomainState) := by
+  simpa [consAfterNCheckFirstAppState, consAfterNCheckNState,
+    consAfterNCheckTailDomainState] using
+    (replayInferTailDomainAlphaCachedCore fuel consAfterNCheckLctx
+      consAfterNCheckState consAlphaId consNId
+      consAfterNCheckAlphaCache consAfterNCheckFamilyMiss
+      consAfterNCheckFirstAppMiss consAfterNCheckNMiss
+      consAfterNCheckTailMiss consAfterNCheckNFind)
+
+def consAfterNCheckTailId : FVarId :=
+  ⟨consAfterNCheckTailDomainState.ngen.curr⟩
+
+def consAfterNCheckTailLctx : LocalContext :=
+  consAfterNCheckLctx.mkLocalDecl consAfterNCheckTailId
+    consTailName
+    (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId)) .default
+
+def consAfterNCheckTailState : TypeChecker.State :=
+  { consAfterNCheckTailDomainState with
+    ngen := consAfterNCheckTailDomainState.ngen.next }
+
+theorem consAfterNCheckTailFirstCache :
+    consAfterNCheckTailState.inferTypeC[
+      replayFirstApp (.fvar consAlphaId)]? = some vecFamilyTail := by
+  change consAfterNCheckTailDomainState.inferTypeC[
+    replayFirstApp (.fvar consAlphaId)]? = some vecFamilyTail
+  unfold consAfterNCheckTailDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [replayTailDomainBeqFirstApp]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consAfterNCheckNState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show ((.fvar consNId : Expr) ==
+      replayFirstApp (.fvar consAlphaId)) = false by
+    simpa only [replayFirstApp] using
+      (replayFVarBeqApp consNId
+        (.const ``IndexedVec [.param `u]) (.fvar consAlphaId))]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consAfterNCheckFirstAppState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consAfterNCheckTailNCache :
+    consAfterNCheckTailState.inferTypeC[(.fvar consNId : Expr)]? =
+      some (.const ``Nat []) := by
+  change consAfterNCheckTailDomainState.inferTypeC[
+    (.fvar consNId : Expr)]? = some (.const ``Nat [])
+  unfold consAfterNCheckTailDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (ctorIndexedVecApp (.fvar consAlphaId) (.fvar consNId) ==
+      (.fvar consNId : Expr)) = false by
+    simpa only [ctorIndexedVecApp] using
+      (replayAppBeqFVar
+        ((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)) (.fvar consNId) consNId)]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consAfterNCheckNState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consAfterNCheckTailSuccMiss :
+    consAfterNCheckTailState.inferTypeC[
+      (.const ``Nat.succ [] : Expr)]? = none := by
+  simp [consAfterNCheckTailState, consAfterNCheckTailDomainState, consAfterNCheckNState,
+    consAfterNCheckFirstAppState, consAfterNCheckState, consAfterNHeadDomainState, replayInsert,
+    ctorIndexedVecApp, replayFirstApp]
+
+theorem consAfterNCheckTailSuccAppMiss :
+    consAfterNCheckTailState.inferTypeC[
+      replaySuccApp (.fvar consNId)]? = none := by
+  simp [consAfterNCheckTailState, consAfterNCheckTailDomainState, consAfterNCheckNState,
+    consAfterNCheckFirstAppState, consAfterNCheckState, consAfterNHeadDomainState, replayInsert,
+    ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+theorem consAfterNCheckTailTerminalMiss :
+    consAfterNCheckTailState.inferTypeC[
+      ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consNId))]? = none := by
+  simp [consAfterNCheckTailState, consAfterNCheckTailDomainState, consAfterNCheckNState,
+    consAfterNCheckFirstAppState, consAfterNCheckState, consAfterNHeadDomainState, replayInsert,
+    ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+def consAfterNCheckSuccState : TypeChecker.State :=
+  replayInsert consAfterNCheckTailState (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+
+def consAfterNCheckSuccAppState : TypeChecker.State :=
+  replayInsert consAfterNCheckSuccState
+    (replaySuccApp (.fvar consNId)) (.const ``Nat [])
+
+def consAfterNCheckTerminalState : TypeChecker.State :=
+  replayInsert consAfterNCheckSuccAppState
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (replaySuccApp (.fvar consNId)))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterNTerminal (fuel : Nat) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consNId))) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consAfterNCheckTailLctx) consAfterNCheckTailState =
+        .ok (.sort (.succ (.param `u)),
+          consAfterNCheckTerminalState) := by
+  simpa [consAfterNCheckSuccState, consAfterNCheckSuccAppState,
+    consAfterNCheckTerminalState] using
+    (replayInferIndexedVecSuccFromCacheCore fuel
+      consAfterNCheckTailLctx consAfterNCheckTailState
+      consAlphaId consNId consAfterNCheckTailFirstCache
+      consAfterNCheckTailSuccMiss consAfterNCheckTailNCache
+      consAfterNCheckTailSuccAppMiss consAfterNCheckTailTerminalMiss)
+
+theorem replayConsAfterNCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe consNContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType consAfterN) =
+        .ok (.sort (.succ (.param `u))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType consAfterN false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consNContext.lctx) ({} : TypeChecker.State)) = _
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' consAfterN false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consNContext.lctx) ({} : TypeChecker.State)) = _
+  unfold consAfterN TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show TypeChecker.Inner.inferType'
+      (.fvar consAlphaId) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consNContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)),
+          consAfterNHeadDomainState) by
+    simpa [consAlphaExprShape] using
+      replayInferConsAfterNHeadDomain 9998]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp [Expr.instantiate1']
+  have htail :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)).app (.fvar consNId)) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consAfterNCheckLctx) consAfterNCheckState =
+          .ok (.sort (.succ (.param `u)),
+            consAfterNCheckTailDomainState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app (.fvar consNId)) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterNCheckLctx) consAfterNCheckState = _
+    simpa [ctorIndexedVecApp] using
+      replayInferConsAfterNTailDomain 9998
+  simp only [consAfterNCheckLctx, consAfterNCheckHeadId,
+    consAfterNCheckState, consAlphaExprShape, tcContext] at htail
+  simp only [tcContext]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [htail]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp only []
+  have hterminal :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)).app
+          ((.const ``Nat.succ [] : Expr).app (.fvar consNId))) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consAfterNCheckTailLctx) consAfterNCheckTailState =
+          .ok (.sort (.succ (.param `u)),
+            consAfterNCheckTerminalState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app
+        ((.const ``Nat.succ [] : Expr).app (.fvar consNId))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterNCheckTailLctx) consAfterNCheckTailState = _
+    simpa [ctorIndexedVecApp, replaySuccApp] using
+      replayInferConsAfterNTerminal 9998
+  simp only [consAfterNCheckTailLctx, consAfterNCheckTailId,
+    consAfterNCheckTailState, consAfterNCheckLctx,
+    consAfterNCheckHeadId, consAlphaExprShape,
+    ctorIndexedVecApp, tcContext] at hterminal
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hterminal]
+  simp only [ensureSortExact]
+  simp [Expr.sortLevel!, Pure.pure, ReaderT.pure,
+    StateT.pure, Except.pure]
+  rfl
+
+/-! The three-binder suffix beginning at the `n` index. -/
+
+open private mkLevelIMaxCore mkLevelMaxCore from Lean.Level in
+@[simp] theorem replayMkLevelIMaxSuccZeroSuccParam :
+    mkLevelIMax' (.succ .zero) (.succ (.param `u)) =
+      .succ (.param `u) := by
+  simp [mkLevelIMax', mkLevelIMaxCore, mkLevelMax', mkLevelMaxCore, Level.isNeverZero, Level.isZero,
+    Level.isExplicit, Level.hasMVar', Level.hasParam', Level.getOffset, Level.getOffsetAux]
+
+def consAfterAlphaNatState : TypeChecker.State :=
+  replayInsert ({} : TypeChecker.State) (.const ``Nat [])
+    (.sort (.succ .zero))
+
+theorem replayInferConsAfterAlphaNat (fuel : Nat) :
+    TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consAlphaContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero), consAfterAlphaNatState) := by
+  simpa [consAfterAlphaNatState, replayInsert] using
+    (inferTypeNatCore fuel consAlphaContext.lctx
+      ({} : TypeChecker.State) (by simp))
+
+def consAfterAlphaCheckNId : FVarId :=
+  ⟨consAfterAlphaNatState.ngen.curr⟩
+
+def consAfterAlphaCheckNLctx : LocalContext :=
+  consAlphaContext.lctx.mkLocalDecl consAfterAlphaCheckNId
+    consNName (.const ``Nat []) .implicit
+
+def consAfterAlphaCheckNState : TypeChecker.State :=
+  { consAfterAlphaNatState with
+    ngen := consAfterAlphaNatState.ngen.next }
+
+theorem consAfterAlphaCheckNFresh :
+    consAlphaContext.lctx.find? consAfterAlphaCheckNId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consAfterAlphaCheckNId) consAlphaContextWF
+  rw [h]
+  simp [consAfterAlphaCheckNId, consAfterAlphaNatState, replayInsert, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl, LocalContext.toList,
+    LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+  intro x hx
+  change some x ∈
+    (PersistentArray.empty : PersistentArray (Option LocalDecl)).toList' at hx
+  rw [PersistentArray.toList'_empty] at hx
+  simp at hx
+
+theorem consAfterAlphaCheckNLctxWF : consAfterAlphaCheckNLctx.WF := by
+  simpa [consAfterAlphaCheckNLctx] using
+    (LocalContext.WF.mkLocalDecl consAlphaContextWF
+      consAfterAlphaCheckNFresh)
+
+theorem consAfterAlphaCheckAlphaFind :
+    consAfterAlphaCheckNLctx.find? consAlphaId =
+      some (.cdecl 0 consAlphaId consAlphaName
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  rw [consAfterAlphaCheckNLctxWF.find?_eq_find?_toList]
+  simp [consAfterAlphaCheckNLctx, consAfterAlphaCheckNId, consAfterAlphaNatState, replayInsert,
+    consAlphaContext, consRootContext, ctorContext, consAlphaId, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl, LocalContext.toList,
+    LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+
+theorem consAfterAlphaCheckAlphaMiss :
+    consAfterAlphaCheckNState.inferTypeC[
+      (.fvar consAlphaId : Expr)]? = none := by
+  simp [consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert]
+
+def consAfterAlphaHeadDomainState : TypeChecker.State :=
+  replayInsert consAfterAlphaCheckNState (.fvar consAlphaId)
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterAlphaHeadDomain (fuel : Nat) :
+    TypeChecker.Inner.inferType' (.fvar consAlphaId) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consAfterAlphaCheckNLctx) consAfterAlphaCheckNState =
+        .ok (.sort (.succ (.param `u)),
+          consAfterAlphaHeadDomainState) := by
+  simpa [consAfterAlphaHeadDomainState, replayInsert] using
+    (inferTypeFVarCore fuel consAfterAlphaCheckNLctx
+      consAfterAlphaCheckNState consAlphaId
+      (.sort (.succ (.param `u)))
+      consAfterAlphaCheckAlphaMiss consAfterAlphaCheckAlphaFind)
+
+def consAfterAlphaCheckHeadId : FVarId :=
+  ⟨consAfterAlphaHeadDomainState.ngen.curr⟩
+
+def consAfterAlphaCheckHeadLctx : LocalContext :=
+  consAfterAlphaCheckNLctx.mkLocalDecl consAfterAlphaCheckHeadId
+    consHeadName (.fvar consAlphaId) .default
+
+def consAfterAlphaCheckHeadState : TypeChecker.State :=
+  { consAfterAlphaHeadDomainState with
+    ngen := consAfterAlphaHeadDomainState.ngen.next }
+
+theorem consAfterAlphaCheckHeadFresh :
+    consAfterAlphaCheckNLctx.find? consAfterAlphaCheckHeadId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consAfterAlphaCheckHeadId) consAfterAlphaCheckNLctxWF
+  rw [h]
+  simp [consAfterAlphaCheckHeadId, consAfterAlphaHeadDomainState, consAfterAlphaCheckNState,
+    consAfterAlphaCheckNId, consAfterAlphaNatState, replayInsert, consAfterAlphaCheckNLctx,
+    consAlphaContext, consRootContext, ctorContext, consAlphaId, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl, LocalContext.toList,
+    LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+  intro x hx
+  change some x ∈
+    (PersistentArray.empty : PersistentArray (Option LocalDecl)).toList' at hx
+  rw [PersistentArray.toList'_empty] at hx
+  simp at hx
+
+theorem consAfterAlphaCheckHeadLctxWF :
+    consAfterAlphaCheckHeadLctx.WF := by
+  simpa [consAfterAlphaCheckHeadLctx] using
+    (LocalContext.WF.mkLocalDecl consAfterAlphaCheckNLctxWF
+      consAfterAlphaCheckHeadFresh)
+
+theorem consAfterAlphaCheckNFind :
+    consAfterAlphaCheckHeadLctx.find? consAfterAlphaCheckNId =
+      some (.cdecl 1 consAfterAlphaCheckNId consNName
+        (.const ``Nat []) .implicit .default) := by
+  rw [consAfterAlphaCheckHeadLctxWF.find?_eq_find?_toList]
+  simp [consAfterAlphaCheckHeadLctx, consAfterAlphaCheckHeadId, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaCheckNLctx, consAfterAlphaCheckNId,
+    consAfterAlphaNatState, replayInsert, consAlphaContext, consRootContext, ctorContext,
+    consAlphaId, AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId,
+    LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId, NameGenerator.next,
+    NameGenerator.curr]
+
+theorem consAfterAlphaCheckAlphaCache :
+    consAfterAlphaCheckHeadState.inferTypeC[
+      (.fvar consAlphaId : Expr)]? =
+        some (.sort (.succ (.param `u))) := by
+  change consAfterAlphaHeadDomainState.inferTypeC[
+    (.fvar consAlphaId : Expr)]? =
+      some (.sort (.succ (.param `u)))
+  unfold consAfterAlphaHeadDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+@[simp] theorem replayNatConstBeqIndexedVec :
+    ((.const ``Nat [] : Expr) ==
+      .const ``IndexedVec [.param `u]) = false := by
+  change Expr.eqv (.const ``Nat [])
+    (.const ``IndexedVec [.param `u]) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem replayAlphaIdBeqAfterAlphaNId :
+    ((.fvar consAlphaId : Expr) ==
+      .fvar consAfterAlphaCheckNId) = false := by
+  change Expr.eqv (.fvar consAlphaId)
+    (.fvar consAfterAlphaCheckNId) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', consAlphaId, consAfterAlphaCheckNId, consAfterAlphaNatState, replayInsert,
+    consRootContext, ctorContext, AddInductive.Context.freshFVarId, NameGenerator.curr]
+
+theorem consAfterAlphaCheckFamilyMiss :
+    consAfterAlphaCheckHeadState.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none := by
+  simp [consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState, replayInsert]
+
+theorem consAfterAlphaCheckFirstAppMiss :
+    consAfterAlphaCheckHeadState.inferTypeC[
+      replayFirstApp (.fvar consAlphaId)]? = none := by
+  simp [consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert, replayFirstApp]
+
+def consAfterAlphaCheckFirstAppState : TypeChecker.State :=
+  replayInsert
+    (replayInsert consAfterAlphaCheckHeadState
+      (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+    (replayFirstApp (.fvar consAlphaId)) vecFamilyTail
+
+theorem consAfterAlphaCheckNMiss :
+    consAfterAlphaCheckFirstAppState.inferTypeC[
+      (.fvar consAfterAlphaCheckNId : Expr)]? = none := by
+  simp [consAfterAlphaCheckFirstAppState,
+    consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert, replayFirstApp]
+
+theorem consAfterAlphaCheckTailMiss :
+    consAfterAlphaCheckHeadState.inferTypeC[
+      ctorIndexedVecApp (.fvar consAlphaId)
+        (.fvar consAfterAlphaCheckNId)]? = none := by
+  simp [consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert, ctorIndexedVecApp]
+
+def consAfterAlphaCheckNInferState : TypeChecker.State :=
+  replayInsert consAfterAlphaCheckFirstAppState
+    (.fvar consAfterAlphaCheckNId) (.const ``Nat [])
+
+def consAfterAlphaCheckTailDomainState : TypeChecker.State :=
+  replayInsert consAfterAlphaCheckNInferState
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (.fvar consAfterAlphaCheckNId))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterAlphaTailDomain (fuel : Nat) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consAlphaId)
+        (.fvar consAfterAlphaCheckNId)) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consAfterAlphaCheckHeadLctx)
+      consAfterAlphaCheckHeadState =
+        .ok (.sort (.succ (.param `u)),
+          consAfterAlphaCheckTailDomainState) := by
+  simpa [consAfterAlphaCheckFirstAppState,
+    consAfterAlphaCheckNInferState,
+    consAfterAlphaCheckTailDomainState] using
+    (replayInferTailDomainAlphaCachedCore fuel
+      consAfterAlphaCheckHeadLctx consAfterAlphaCheckHeadState
+      consAlphaId consAfterAlphaCheckNId
+      consAfterAlphaCheckAlphaCache consAfterAlphaCheckFamilyMiss
+      consAfterAlphaCheckFirstAppMiss consAfterAlphaCheckNMiss
+      consAfterAlphaCheckTailMiss consAfterAlphaCheckNFind)
+
+def consAfterAlphaCheckTailId : FVarId :=
+  ⟨consAfterAlphaCheckTailDomainState.ngen.curr⟩
+
+def consAfterAlphaCheckTailLctx : LocalContext :=
+  consAfterAlphaCheckHeadLctx.mkLocalDecl consAfterAlphaCheckTailId
+    consTailName
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (.fvar consAfterAlphaCheckNId)) .default
+
+def consAfterAlphaCheckTailState : TypeChecker.State :=
+  { consAfterAlphaCheckTailDomainState with
+    ngen := consAfterAlphaCheckTailDomainState.ngen.next }
+
+@[simp] theorem replayAfterAlphaNIdBeqAlphaId :
+    ((.fvar consAfterAlphaCheckNId : Expr) ==
+      .fvar consAlphaId) = false := by
+  change Expr.eqv (.fvar consAfterAlphaCheckNId)
+    (.fvar consAlphaId) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', consAlphaId, consAfterAlphaCheckNId, consAfterAlphaNatState, replayInsert,
+    consRootContext, ctorContext, AddInductive.Context.freshFVarId, NameGenerator.curr]
+
+@[simp] theorem replayNatConstBeqSucc :
+    ((.const ``Nat [] : Expr) == .const ``Nat.succ []) = false := by
+  change Expr.eqv (.const ``Nat []) (.const ``Nat.succ []) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem replayIndexedVecAppBeqFirstApp
+    (alpha index : Expr) :
+    (ctorIndexedVecApp alpha index == replayFirstApp alpha) = false := by
+  change Expr.eqv (ctorIndexedVecApp alpha index)
+    (replayFirstApp alpha) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replayFirstApp]
+
+@[simp] theorem replayIndexedVecAppBeqSuccApp
+    (alpha n : Expr) :
+    (ctorIndexedVecApp alpha n == replaySuccApp n) = false := by
+  change Expr.eqv (ctorIndexedVecApp alpha n)
+    (replaySuccApp n) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replaySuccApp]
+
+@[simp] theorem replayIndexedVecAppBeqIndexedVecSucc
+    (alpha : Expr) (id : FVarId) :
+    (ctorIndexedVecApp alpha (.fvar id) ==
+      ctorIndexedVecApp alpha (replaySuccApp (.fvar id))) = false := by
+  change Expr.eqv (ctorIndexedVecApp alpha (.fvar id))
+    (ctorIndexedVecApp alpha (replaySuccApp (.fvar id))) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replaySuccApp]
+
+@[simp] theorem replayFirstAppBeqIndexedVecSucc
+    (alpha n : Expr) :
+    (replayFirstApp alpha ==
+      ctorIndexedVecApp alpha (replaySuccApp n)) = false := by
+  change Expr.eqv (replayFirstApp alpha)
+    (ctorIndexedVecApp alpha (replaySuccApp n)) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+@[simp] theorem replayIndexedVecLiteralBeqSuccApp
+    (alpha n : Expr) :
+    (((.const ``IndexedVec [.param `u] : Expr).app alpha).app n ==
+      (.const ``Nat.succ [] : Expr).app n) = false := by
+  simpa [ctorIndexedVecApp, replaySuccApp] using
+    replayIndexedVecAppBeqSuccApp alpha n
+
+@[simp] theorem replayFirstAppLiteralGenericBeqSuccApp
+    (alpha n : Expr) :
+    ((.const ``IndexedVec [.param `u] : Expr).app alpha ==
+      (.const ``Nat.succ [] : Expr).app n) = false := by
+  simpa [replayFirstApp, replaySuccApp] using
+    replayFirstAppBeqSuccApp alpha n
+
+@[simp] theorem replayIndexedVecLiteralFVarBeqTerminal
+    (alpha : Expr) (id : FVarId) :
+    (((.const ``IndexedVec [.param `u] : Expr).app alpha).app
+        (.fvar id) ==
+      ((.const ``IndexedVec [.param `u] : Expr).app alpha).app
+        ((.const ``Nat.succ [] : Expr).app (.fvar id))) = false := by
+  simpa [ctorIndexedVecApp, replaySuccApp] using
+    replayIndexedVecAppBeqIndexedVecSucc alpha id
+
+@[simp] theorem replayFirstAppLiteralGenericBeqTerminal
+    (alpha : Expr) (id : FVarId) :
+    ((.const ``IndexedVec [.param `u] : Expr).app alpha ==
+      ((.const ``IndexedVec [.param `u] : Expr).app alpha).app
+        ((.const ``Nat.succ [] : Expr).app (.fvar id))) = false := by
+  simpa [ctorIndexedVecApp, replayFirstApp, replaySuccApp] using
+    replayFirstAppBeqIndexedVecSucc alpha (.fvar id)
+
+theorem consAfterAlphaCheckTailFirstCache :
+    consAfterAlphaCheckTailState.inferTypeC[
+      replayFirstApp (.fvar consAlphaId)]? = some vecFamilyTail := by
+  change consAfterAlphaCheckTailDomainState.inferTypeC[
+    replayFirstApp (.fvar consAlphaId)]? = some vecFamilyTail
+  unfold consAfterAlphaCheckTailDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [replayIndexedVecAppBeqFirstApp]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consAfterAlphaCheckNInferState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show ((.fvar consAfterAlphaCheckNId : Expr) ==
+      replayFirstApp (.fvar consAlphaId)) = false by
+    exact replayFVarBeqApp consAfterAlphaCheckNId
+      (.const ``IndexedVec [.param `u]) (.fvar consAlphaId)]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consAfterAlphaCheckFirstAppState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consAfterAlphaCheckTailNCache :
+    consAfterAlphaCheckTailState.inferTypeC[
+      (.fvar consAfterAlphaCheckNId : Expr)]? =
+        some (.const ``Nat []) := by
+  change consAfterAlphaCheckTailDomainState.inferTypeC[
+    (.fvar consAfterAlphaCheckNId : Expr)]? =
+      some (.const ``Nat [])
+  unfold consAfterAlphaCheckTailDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (ctorIndexedVecApp (.fvar consAlphaId)
+      (.fvar consAfterAlphaCheckNId) ==
+      (.fvar consAfterAlphaCheckNId : Expr)) = false by
+    exact replayAppBeqFVar
+      ((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId))
+      (.fvar consAfterAlphaCheckNId) consAfterAlphaCheckNId]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consAfterAlphaCheckNInferState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consAfterAlphaCheckTailSuccMiss :
+    consAfterAlphaCheckTailState.inferTypeC[
+      (.const ``Nat.succ [] : Expr)]? = none := by
+  simp [consAfterAlphaCheckTailState,
+    consAfterAlphaCheckTailDomainState,
+    consAfterAlphaCheckNInferState,
+    consAfterAlphaCheckFirstAppState,
+    consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert, ctorIndexedVecApp, replayFirstApp]
+
+theorem consAfterAlphaCheckTailSuccAppMiss :
+    consAfterAlphaCheckTailState.inferTypeC[
+      replaySuccApp (.fvar consAfterAlphaCheckNId)]? = none := by
+  simp [consAfterAlphaCheckTailState,
+    consAfterAlphaCheckTailDomainState,
+    consAfterAlphaCheckNInferState,
+    consAfterAlphaCheckFirstAppState,
+    consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert, ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+theorem consAfterAlphaCheckTailTerminalMiss :
+    consAfterAlphaCheckTailState.inferTypeC[
+      ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consAfterAlphaCheckNId))]? = none := by
+  simp [consAfterAlphaCheckTailState,
+    consAfterAlphaCheckTailDomainState,
+    consAfterAlphaCheckNInferState,
+    consAfterAlphaCheckFirstAppState,
+    consAfterAlphaCheckHeadState, consAfterAlphaHeadDomainState,
+    consAfterAlphaCheckNState, consAfterAlphaNatState,
+    replayInsert, ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+def consAfterAlphaCheckSuccState : TypeChecker.State :=
+  replayInsert consAfterAlphaCheckTailState (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+
+def consAfterAlphaCheckSuccAppState : TypeChecker.State :=
+  replayInsert consAfterAlphaCheckSuccState
+    (replaySuccApp (.fvar consAfterAlphaCheckNId)) (.const ``Nat [])
+
+def consAfterAlphaCheckTerminalState : TypeChecker.State :=
+  replayInsert consAfterAlphaCheckSuccAppState
+    (ctorIndexedVecApp (.fvar consAlphaId)
+      (replaySuccApp (.fvar consAfterAlphaCheckNId)))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsAfterAlphaTerminal (fuel : Nat) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consAlphaId)
+        (replaySuccApp (.fvar consAfterAlphaCheckNId))) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consAfterAlphaCheckTailLctx)
+      consAfterAlphaCheckTailState =
+        .ok (.sort (.succ (.param `u)),
+          consAfterAlphaCheckTerminalState) := by
+  simpa [consAfterAlphaCheckSuccState,
+    consAfterAlphaCheckSuccAppState,
+    consAfterAlphaCheckTerminalState] using
+    (replayInferIndexedVecSuccFromCacheCore fuel
+      consAfterAlphaCheckTailLctx consAfterAlphaCheckTailState
+      consAlphaId consAfterAlphaCheckNId
+      consAfterAlphaCheckTailFirstCache
+      consAfterAlphaCheckTailSuccMiss
+      consAfterAlphaCheckTailNCache
+      consAfterAlphaCheckTailSuccAppMiss
+      consAfterAlphaCheckTailTerminalMiss)
+
+theorem replayConsAfterAlphaCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe consAlphaContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType consAfterAlpha) =
+        .ok (.sort (.succ (.param `u))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType consAfterAlpha false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consAlphaContext.lctx) ({} : TypeChecker.State)) = _
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' consAfterAlpha false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consAlphaContext.lctx) ({} : TypeChecker.State)) = _
+  unfold consAfterAlpha TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show TypeChecker.Inner.inferType'
+      (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAlphaContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero), consAfterAlphaNatState) by
+    exact replayInferConsAfterAlphaNat 9998]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp only [Expr.instantiate1']
+  have hhead :
+      TypeChecker.Inner.inferType (.fvar consAlphaId) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consAfterAlphaCheckNLctx)
+        consAfterAlphaCheckNState =
+          .ok (.sort (.succ (.param `u)),
+            consAfterAlphaHeadDomainState) := by
+    change TypeChecker.Inner.inferType' (.fvar consAlphaId) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterAlphaCheckNLctx)
+      consAfterAlphaCheckNState = _
+    exact replayInferConsAfterAlphaHeadDomain 9998
+  simp only [consAfterAlphaCheckNLctx, consAfterAlphaCheckNId,
+    consAfterAlphaCheckNState, tcContext] at hhead
+  simp only [tcContext]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hhead]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp [Expr.instantiate1']
+  have htail :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)).app
+          (.fvar consAfterAlphaCheckNId)) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consAfterAlphaCheckHeadLctx)
+        consAfterAlphaCheckHeadState =
+          .ok (.sort (.succ (.param `u)),
+            consAfterAlphaCheckTailDomainState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app
+        (.fvar consAfterAlphaCheckNId)) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterAlphaCheckHeadLctx)
+      consAfterAlphaCheckHeadState = _
+    simpa [ctorIndexedVecApp] using
+      replayInferConsAfterAlphaTailDomain 9998
+  simp only [consAfterAlphaCheckHeadLctx,
+    consAfterAlphaCheckHeadId, consAfterAlphaCheckHeadState,
+    consAfterAlphaCheckNLctx, consAfterAlphaCheckNId,
+    tcContext] at htail
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [htail]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp
+  have hterminal :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consAlphaId)).app
+          ((.const ``Nat.succ [] : Expr).app
+            (.fvar consAfterAlphaCheckNId))) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consAfterAlphaCheckTailLctx)
+        consAfterAlphaCheckTailState =
+          .ok (.sort (.succ (.param `u)),
+            consAfterAlphaCheckTerminalState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consAlphaId)).app
+        ((.const ``Nat.succ [] : Expr).app
+          (.fvar consAfterAlphaCheckNId))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consAfterAlphaCheckTailLctx)
+      consAfterAlphaCheckTailState = _
+    simpa [ctorIndexedVecApp, replaySuccApp] using
+      replayInferConsAfterAlphaTerminal 9998
+  simp only [consAfterAlphaCheckTailLctx,
+    consAfterAlphaCheckTailId, consAfterAlphaCheckTailState,
+    consAfterAlphaCheckHeadLctx, consAfterAlphaCheckHeadId,
+    consAfterAlphaCheckNLctx, consAfterAlphaCheckNId,
+    ctorIndexedVecApp, tcContext] at hterminal
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hterminal]
+  simp only [ensureSortExact]
+  simp [Expr.sortLevel!, Pure.pure, ReaderT.pure,
+    StateT.pure, Except.pure]
+  rfl
+
+/-! The complete four-binder constructor type. -/
+
+def consRootCheckAlphaId : FVarId :=
+  ⟨nilRootSortState.ngen.curr⟩
+
+def consRootCheckAlphaLctx : LocalContext :=
+  consRootContext.lctx.mkLocalDecl consRootCheckAlphaId
+    consAlphaName (.sort (.succ (.param `u))) .implicit
+
+def consRootCheckAlphaState : TypeChecker.State :=
+  { nilRootSortState with ngen := nilRootSortState.ngen.next }
+
+theorem replayInferConsRootSort :
+    TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consRootContext.lctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.succ (.param `u))),
+          nilRootSortState) := by
+  simpa [consRootContext, ctorContext] using nilRootSortCore
+
+theorem consRootCheckAlphaFresh :
+    consRootContext.lctx.find? consRootCheckAlphaId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consRootCheckAlphaId) LocalContext.WF.nil
+  change
+    ({ fvarIdToDecl := PersistentHashMap.empty,
+       decls := PersistentArray.empty,
+       auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+      consRootCheckAlphaId = none
+  rw [h]
+  simp [LocalContext.toList]
+
+theorem consRootCheckAlphaLctxWF : consRootCheckAlphaLctx.WF := by
+  change (({} : LocalContext).mkLocalDecl consRootCheckAlphaId
+    consAlphaName (.sort (.succ (.param `u))) .implicit).WF
+  exact LocalContext.WF.mkLocalDecl LocalContext.WF.nil (by
+    have h := LocalContext.WF.find?_eq_find?_toList
+      (fv := consRootCheckAlphaId) LocalContext.WF.nil
+    change
+      ({ fvarIdToDecl := PersistentHashMap.empty,
+         decls := PersistentArray.empty,
+         auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+        consRootCheckAlphaId = none
+    rw [h]
+    simp [LocalContext.toList])
+
+theorem consRootCheckAlphaFind :
+    consRootCheckAlphaLctx.find? consRootCheckAlphaId =
+      some (.cdecl 0 consRootCheckAlphaId consAlphaName
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  rw [consRootCheckAlphaLctxWF.find?_eq_find?_toList]
+  simp [consRootCheckAlphaLctx, consRootCheckAlphaId, consRootContext, ctorContext,
+    nilRootSortState, LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId,
+    NameGenerator.curr]
+
+theorem consRootCheckNatMiss :
+    consRootCheckAlphaState.inferTypeC[
+      (.const ``Nat [] : Expr)]? = none := by
+  simp [consRootCheckAlphaState, nilRootSortState]
+
+def consRootCheckNatState : TypeChecker.State :=
+  replayInsert consRootCheckAlphaState (.const ``Nat [])
+    (.sort (.succ .zero))
+
+theorem replayInferConsRootNat (fuel : Nat) :
+    TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consRootCheckAlphaLctx) consRootCheckAlphaState =
+        .ok (.sort (.succ .zero), consRootCheckNatState) := by
+  simpa [consRootCheckNatState, replayInsert] using
+    (inferTypeNatCore fuel consRootCheckAlphaLctx
+      consRootCheckAlphaState consRootCheckNatMiss)
+
+def consRootCheckNId : FVarId :=
+  ⟨consRootCheckNatState.ngen.curr⟩
+
+def consRootCheckNLctx : LocalContext :=
+  consRootCheckAlphaLctx.mkLocalDecl consRootCheckNId
+    consNName (.const ``Nat []) .implicit
+
+def consRootCheckNState : TypeChecker.State :=
+  { consRootCheckNatState with ngen := consRootCheckNatState.ngen.next }
+
+theorem consRootCheckNFresh :
+    consRootCheckAlphaLctx.find? consRootCheckNId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consRootCheckNId) consRootCheckAlphaLctxWF
+  rw [h]
+  simp [consRootCheckNId, consRootCheckNatState, consRootCheckAlphaState, consRootCheckAlphaLctx,
+    consRootCheckAlphaId, nilRootSortState, replayInsert, consRootContext, ctorContext,
+    LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId, NameGenerator.next,
+    NameGenerator.curr]
+  intro x hx
+  change some x ∈
+    (PersistentArray.empty : PersistentArray (Option LocalDecl)).toList' at hx
+  rw [PersistentArray.toList'_empty] at hx
+  simp at hx
+
+theorem consRootCheckNLctxWF : consRootCheckNLctx.WF := by
+  simpa [consRootCheckNLctx] using
+    (LocalContext.WF.mkLocalDecl consRootCheckAlphaLctxWF
+      consRootCheckNFresh)
+
+theorem consRootCheckAlphaFindInN :
+    consRootCheckNLctx.find? consRootCheckAlphaId =
+      some (.cdecl 0 consRootCheckAlphaId consAlphaName
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  rw [consRootCheckNLctxWF.find?_eq_find?_toList]
+  simp [consRootCheckNLctx, consRootCheckNId, consRootCheckNatState, consRootCheckAlphaState,
+    consRootCheckAlphaLctx, consRootCheckAlphaId, nilRootSortState, replayInsert, consRootContext,
+    ctorContext, LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId,
+    NameGenerator.next, NameGenerator.curr]
+
+theorem consRootCheckAlphaMiss :
+    consRootCheckNState.inferTypeC[
+      (.fvar consRootCheckAlphaId : Expr)]? = none := by
+  simp [consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState, replayInsert]
+
+def consRootCheckHeadDomainState : TypeChecker.State :=
+  replayInsert consRootCheckNState (.fvar consRootCheckAlphaId)
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsRootHeadDomain (fuel : Nat) :
+    TypeChecker.Inner.inferType' (.fvar consRootCheckAlphaId) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consRootCheckNLctx) consRootCheckNState =
+        .ok (.sort (.succ (.param `u)),
+          consRootCheckHeadDomainState) := by
+  simpa [consRootCheckHeadDomainState, replayInsert] using
+    (inferTypeFVarCore fuel consRootCheckNLctx consRootCheckNState
+      consRootCheckAlphaId (.sort (.succ (.param `u)))
+      consRootCheckAlphaMiss consRootCheckAlphaFindInN)
+
+def consRootCheckHeadId : FVarId :=
+  ⟨consRootCheckHeadDomainState.ngen.curr⟩
+
+def consRootCheckHeadLctx : LocalContext :=
+  consRootCheckNLctx.mkLocalDecl consRootCheckHeadId
+    consHeadName (.fvar consRootCheckAlphaId) .default
+
+def consRootCheckHeadState : TypeChecker.State :=
+  { consRootCheckHeadDomainState with
+    ngen := consRootCheckHeadDomainState.ngen.next }
+
+theorem consRootCheckHeadFresh :
+    consRootCheckNLctx.find? consRootCheckHeadId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consRootCheckHeadId) consRootCheckNLctxWF
+  rw [h]
+  simp [consRootCheckHeadId, consRootCheckHeadDomainState, consRootCheckNState, consRootCheckNId,
+    consRootCheckNatState, consRootCheckAlphaState, consRootCheckAlphaLctx, consRootCheckAlphaId,
+    nilRootSortState, replayInsert, consRootCheckNLctx, consRootContext, ctorContext,
+    LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId, NameGenerator.next,
+    NameGenerator.curr]
+  intro x hx
+  change some x ∈
+    (PersistentArray.empty : PersistentArray (Option LocalDecl)).toList' at hx
+  rw [PersistentArray.toList'_empty] at hx
+  simp at hx
+
+theorem consRootCheckHeadLctxWF : consRootCheckHeadLctx.WF := by
+  simpa [consRootCheckHeadLctx] using
+    (LocalContext.WF.mkLocalDecl consRootCheckNLctxWF
+      consRootCheckHeadFresh)
+
+theorem consRootCheckNFind :
+    consRootCheckHeadLctx.find? consRootCheckNId =
+      some (.cdecl 1 consRootCheckNId consNName
+        (.const ``Nat []) .implicit .default) := by
+  rw [consRootCheckHeadLctxWF.find?_eq_find?_toList]
+  simp [consRootCheckHeadLctx, consRootCheckHeadId, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNLctx, consRootCheckNId, consRootCheckNatState,
+    consRootCheckAlphaState, consRootCheckAlphaLctx, consRootCheckAlphaId, nilRootSortState,
+    replayInsert, consRootContext, ctorContext, LocalContext.mkLocalDecl, LocalContext.toList,
+    LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+
+@[simp] theorem replayConsRootAlphaIdBeqNId :
+    ((.fvar consRootCheckAlphaId : Expr) ==
+      .fvar consRootCheckNId) = false := by
+  change Expr.eqv (.fvar consRootCheckAlphaId)
+    (.fvar consRootCheckNId) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', consRootCheckAlphaId, consRootCheckNId,
+    consRootCheckNatState, consRootCheckAlphaState,
+    nilRootSortState, replayInsert,
+    NameGenerator.next, NameGenerator.curr]
+
+@[simp] theorem replayConsRootNIdBeqAlphaId :
+    ((.fvar consRootCheckNId : Expr) ==
+      .fvar consRootCheckAlphaId) = false := by
+  change Expr.eqv (.fvar consRootCheckNId)
+    (.fvar consRootCheckAlphaId) = false
+  rw [Expr.eqv_eq]
+  simp [Expr.eqv', consRootCheckAlphaId, consRootCheckNId,
+    consRootCheckNatState, consRootCheckAlphaState,
+    nilRootSortState, replayInsert,
+    NameGenerator.next, NameGenerator.curr]
+
+theorem consRootCheckAlphaCache :
+    consRootCheckHeadState.inferTypeC[
+      (.fvar consRootCheckAlphaId : Expr)]? =
+        some (.sort (.succ (.param `u))) := by
+  change consRootCheckHeadDomainState.inferTypeC[
+    (.fvar consRootCheckAlphaId : Expr)]? =
+      some (.sort (.succ (.param `u)))
+  unfold consRootCheckHeadDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consRootCheckFamilyMiss :
+    consRootCheckHeadState.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none := by
+  simp [consRootCheckHeadState, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState, replayInsert]
+
+theorem consRootCheckFirstAppMiss :
+    consRootCheckHeadState.inferTypeC[
+      replayFirstApp (.fvar consRootCheckAlphaId)]? = none := by
+  simp [consRootCheckHeadState, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState,
+    replayInsert, replayFirstApp]
+
+def consRootCheckFirstAppState : TypeChecker.State :=
+  replayInsert
+    (replayInsert consRootCheckHeadState
+      (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+    (replayFirstApp (.fvar consRootCheckAlphaId)) vecFamilyTail
+
+theorem consRootCheckNMiss :
+    consRootCheckFirstAppState.inferTypeC[
+      (.fvar consRootCheckNId : Expr)]? = none := by
+  simp [consRootCheckFirstAppState, consRootCheckHeadState,
+    consRootCheckHeadDomainState, consRootCheckNState,
+    consRootCheckNatState, consRootCheckAlphaState,
+    nilRootSortState, replayInsert, replayFirstApp]
+
+theorem consRootCheckTailMiss :
+    consRootCheckHeadState.inferTypeC[
+      ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+        (.fvar consRootCheckNId)]? = none := by
+  simp [consRootCheckHeadState, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState,
+    replayInsert, ctorIndexedVecApp]
+
+def consRootCheckNInferState : TypeChecker.State :=
+  replayInsert consRootCheckFirstAppState
+    (.fvar consRootCheckNId) (.const ``Nat [])
+
+def consRootCheckTailDomainState : TypeChecker.State :=
+  replayInsert consRootCheckNInferState
+    (ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+      (.fvar consRootCheckNId))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsRootTailDomain (fuel : Nat) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+        (.fvar consRootCheckNId)) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consRootCheckHeadLctx) consRootCheckHeadState =
+        .ok (.sort (.succ (.param `u)),
+          consRootCheckTailDomainState) := by
+  simpa [consRootCheckFirstAppState, consRootCheckNInferState,
+    consRootCheckTailDomainState] using
+    (replayInferTailDomainAlphaCachedCore fuel
+      consRootCheckHeadLctx consRootCheckHeadState
+      consRootCheckAlphaId consRootCheckNId
+      consRootCheckAlphaCache consRootCheckFamilyMiss
+      consRootCheckFirstAppMiss consRootCheckNMiss
+      consRootCheckTailMiss consRootCheckNFind)
+
+def consRootCheckTailId : FVarId :=
+  ⟨consRootCheckTailDomainState.ngen.curr⟩
+
+def consRootCheckTailLctx : LocalContext :=
+  consRootCheckHeadLctx.mkLocalDecl consRootCheckTailId
+    consTailName
+    (ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+      (.fvar consRootCheckNId)) .default
+
+def consRootCheckTailState : TypeChecker.State :=
+  { consRootCheckTailDomainState with
+    ngen := consRootCheckTailDomainState.ngen.next }
+
+theorem consRootCheckTailFirstCache :
+    consRootCheckTailState.inferTypeC[
+      replayFirstApp (.fvar consRootCheckAlphaId)]? =
+        some vecFamilyTail := by
+  change consRootCheckTailDomainState.inferTypeC[
+    replayFirstApp (.fvar consRootCheckAlphaId)]? = some vecFamilyTail
+  unfold consRootCheckTailDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [replayIndexedVecAppBeqFirstApp]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consRootCheckNInferState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show ((.fvar consRootCheckNId : Expr) ==
+      replayFirstApp (.fvar consRootCheckAlphaId)) = false by
+    exact replayFVarBeqApp consRootCheckNId
+      (.const ``IndexedVec [.param `u])
+      (.fvar consRootCheckAlphaId)]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consRootCheckFirstAppState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consRootCheckTailNCache :
+    consRootCheckTailState.inferTypeC[
+      (.fvar consRootCheckNId : Expr)]? = some (.const ``Nat []) := by
+  change consRootCheckTailDomainState.inferTypeC[
+    (.fvar consRootCheckNId : Expr)]? = some (.const ``Nat [])
+  unfold consRootCheckTailDomainState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [show (ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+      (.fvar consRootCheckNId) ==
+      (.fvar consRootCheckNId : Expr)) = false by
+    exact replayAppBeqFVar
+      ((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consRootCheckAlphaId))
+      (.fvar consRootCheckNId) consRootCheckNId]
+  simp only [Bool.false_eq_true, if_false]
+  unfold consRootCheckNInferState replayInsert
+  rw [Std.HashMap.getElem?_insert]
+  rw [beq_self_eq_true]
+  rfl
+
+theorem consRootCheckTailSuccMiss :
+    consRootCheckTailState.inferTypeC[
+      (.const ``Nat.succ [] : Expr)]? = none := by
+  simp [consRootCheckTailState, consRootCheckTailDomainState,
+    consRootCheckNInferState, consRootCheckFirstAppState,
+    consRootCheckHeadState, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState,
+    replayInsert, ctorIndexedVecApp, replayFirstApp]
+
+theorem consRootCheckTailSuccAppMiss :
+    consRootCheckTailState.inferTypeC[
+      replaySuccApp (.fvar consRootCheckNId)]? = none := by
+  simp [consRootCheckTailState, consRootCheckTailDomainState,
+    consRootCheckNInferState, consRootCheckFirstAppState,
+    consRootCheckHeadState, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState,
+    replayInsert, ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+theorem consRootCheckTailTerminalMiss :
+    consRootCheckTailState.inferTypeC[
+      ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+        (replaySuccApp (.fvar consRootCheckNId))]? = none := by
+  simp [consRootCheckTailState, consRootCheckTailDomainState,
+    consRootCheckNInferState, consRootCheckFirstAppState,
+    consRootCheckHeadState, consRootCheckHeadDomainState,
+    consRootCheckNState, consRootCheckNatState,
+    consRootCheckAlphaState, nilRootSortState,
+    replayInsert, ctorIndexedVecApp, replayFirstApp, replaySuccApp]
+
+def consRootCheckSuccState : TypeChecker.State :=
+  replayInsert consRootCheckTailState (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+
+def consRootCheckSuccAppState : TypeChecker.State :=
+  replayInsert consRootCheckSuccState
+    (replaySuccApp (.fvar consRootCheckNId)) (.const ``Nat [])
+
+def consRootCheckTerminalState : TypeChecker.State :=
+  replayInsert consRootCheckSuccAppState
+    (ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+      (replaySuccApp (.fvar consRootCheckNId)))
+    (.sort (.succ (.param `u)))
+
+theorem replayInferConsRootTerminal (fuel : Nat) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar consRootCheckAlphaId)
+        (replaySuccApp (.fvar consRootCheckNId))) false
+      (TypeChecker.Methods.withFuel fuel)
+      (tcContext consRootCheckTailLctx) consRootCheckTailState =
+        .ok (.sort (.succ (.param `u)),
+          consRootCheckTerminalState) := by
+  simpa [consRootCheckSuccState, consRootCheckSuccAppState,
+    consRootCheckTerminalState] using
+    (replayInferIndexedVecSuccFromCacheCore fuel
+      consRootCheckTailLctx consRootCheckTailState
+      consRootCheckAlphaId consRootCheckNId
+      consRootCheckTailFirstCache consRootCheckTailSuccMiss
+      consRootCheckTailNCache consRootCheckTailSuccAppMiss
+      consRootCheckTailTerminalMiss)
+
+open private mkLevelIMaxCore mkLevelMaxCore from Lean.Level in
+@[simp] theorem replayMkLevelIMaxSuccSuccParamSuccParam :
+    mkLevelIMax' (.succ (.succ (.param `u)))
+      (.succ (.param `u)) = .succ (.succ (.param `u)) := by
+  simp [mkLevelIMax', mkLevelIMaxCore, mkLevelMax', mkLevelMaxCore,
+    Level.isNeverZero, Level.isZero, Level.isExplicit,
+    Level.hasMVar', Level.hasParam', Level.getOffset,
+    Level.getOffsetAux, Level.getLevelOffset]
+
+theorem replayConsRootCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe consRootContext.lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType indexedVecConsInfo.type) =
+        .ok (.sort (.succ (.succ (.param `u)))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType indexedVecConsInfo.type false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext consRootContext.lctx) ({} : TypeChecker.State)) = _
+  rw [consInfoTypeShape]
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' consCtorTypeRaw false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext consRootContext.lctx) ({} : TypeChecker.State)) = _
+  unfold consCtorTypeRaw consNTypeRaw consHeadTypeRaw
+    consTailTypeRaw consTerminalRaw TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [replayInferConsRootSort]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp [Expr.instantiate1']
+  have hnat :
+      TypeChecker.Inner.inferType (.const ``Nat []) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consRootCheckAlphaLctx) consRootCheckAlphaState =
+          .ok (.sort (.succ .zero), consRootCheckNatState) := by
+    change TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consRootCheckAlphaLctx) consRootCheckAlphaState = _
+    exact replayInferConsRootNat 9998
+  simp only [consRootCheckAlphaLctx, consRootCheckAlphaId,
+    consRootCheckAlphaState, tcContext] at hnat
+  simp only [tcContext]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hnat]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp [Expr.instantiate1']
+  have hhead :
+      TypeChecker.Inner.inferType (.fvar consRootCheckAlphaId) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consRootCheckNLctx) consRootCheckNState =
+          .ok (.sort (.succ (.param `u)),
+            consRootCheckHeadDomainState) := by
+    change TypeChecker.Inner.inferType'
+      (.fvar consRootCheckAlphaId) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consRootCheckNLctx) consRootCheckNState = _
+    exact replayInferConsRootHeadDomain 9998
+  simp only [consRootCheckNLctx, consRootCheckNId,
+    consRootCheckNState, consRootCheckAlphaLctx,
+    consRootCheckAlphaId, tcContext] at hhead
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hhead]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp
+  have htail :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consRootCheckAlphaId)).app
+          (.fvar consRootCheckNId)) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consRootCheckHeadLctx) consRootCheckHeadState =
+          .ok (.sort (.succ (.param `u)),
+            consRootCheckTailDomainState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consRootCheckAlphaId)).app
+        (.fvar consRootCheckNId)) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consRootCheckHeadLctx) consRootCheckHeadState = _
+    simpa [ctorIndexedVecApp] using
+      replayInferConsRootTailDomain 9998
+  simp only [consRootCheckHeadLctx, consRootCheckHeadId,
+    consRootCheckHeadState, consRootCheckNLctx, consRootCheckNId,
+    consRootCheckAlphaLctx, consRootCheckAlphaId,
+    tcContext] at htail
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [htail]
+  simp only [ensureSortExact]
+  rw [withLocalDeclEq]
+  simp
+  have hterminal :
+      TypeChecker.Inner.inferType
+        (((.const ``IndexedVec [.param `u] : Expr).app
+          (.fvar consRootCheckAlphaId)).app
+          ((.const ``Nat.succ [] : Expr).app
+            (.fvar consRootCheckNId))) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext consRootCheckTailLctx) consRootCheckTailState =
+          .ok (.sort (.succ (.param `u)),
+            consRootCheckTerminalState) := by
+    change TypeChecker.Inner.inferType'
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar consRootCheckAlphaId)).app
+        ((.const ``Nat.succ [] : Expr).app
+          (.fvar consRootCheckNId))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext consRootCheckTailLctx) consRootCheckTailState = _
+    simpa [ctorIndexedVecApp, replaySuccApp] using
+      replayInferConsRootTerminal 9998
+  simp only [consRootCheckTailLctx, consRootCheckTailId,
+    consRootCheckTailState, consRootCheckHeadLctx,
+    consRootCheckHeadId, consRootCheckNLctx, consRootCheckNId,
+    consRootCheckAlphaLctx, consRootCheckAlphaId,
+    ctorIndexedVecApp, tcContext] at hterminal
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hterminal]
+  simp only [ensureSortExact]
+  simp [Expr.sortLevel!, Pure.pure, ReaderT.pure,
+    StateT.pure, Except.pure]
+  rfl
+
+/-! ## Source-indexed candidate trace -/
+
+def consAlphaAnnotations :
+    AddInductive.CandidateTypeAnnotations
+      (.sort (.succ (.param `u))) where
+  consumed := .sort (.succ (.param `u))
+  trace := .identity _
+
+def consNatAnnotations :
+    AddInductive.CandidateTypeAnnotations (.const ``Nat []) where
+  consumed := .const ``Nat []
+  trace := .identity _
+
+def consHeadAnnotations :
+    AddInductive.CandidateTypeAnnotations consAlphaExpr where
+  consumed := consAlphaExpr
+  trace := .identity _
+
+def consTailAnnotations :
+    AddInductive.CandidateTypeAnnotations consTailDomain where
+  consumed := consTailDomain
+  trace := .identity _
+
+theorem consAlphaAnnotationTraceBuild :
+    AddInductive.CandidateTypeAnnotationTrace.build
+      (.sort (.succ (.param `u))) =
+        ⟨.sort (.succ (.param `u)), .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build]
+
+theorem consNatAnnotationTraceBuild :
+    AddInductive.CandidateTypeAnnotationTrace.build (.const ``Nat []) =
+      ⟨.const ``Nat [], .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build]
+
+theorem consHeadAnnotationTraceBuild :
+    AddInductive.CandidateTypeAnnotationTrace.build consAlphaExpr =
+      ⟨consAlphaExpr, .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build,
+    consAlphaExprShape]
+
+theorem consTailAnnotationTraceBuild :
+    AddInductive.CandidateTypeAnnotationTrace.build consTailDomain =
+      ⟨consTailDomain, .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build, consTailDomain]
+
+theorem consAlphaAnnotationsBuild :
+    AddInductive.buildCandidateTypeAnnotations
+      (.sort (.succ (.param `u))) = .ok consAlphaAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [consAlphaAnnotationTraceBuild]
+  rfl
+
+theorem consNatAnnotationsBuild :
+    AddInductive.buildCandidateTypeAnnotations (.const ``Nat []) =
+      .ok consNatAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [consNatAnnotationTraceBuild]
+  rfl
+
+theorem consHeadAnnotationsBuild :
+    AddInductive.buildCandidateTypeAnnotations consAlphaExpr =
+      .ok consHeadAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [consHeadAnnotationTraceBuild]
+  rfl
+
+theorem consTailAnnotationsBuild :
+    AddInductive.buildCandidateTypeAnnotations consTailDomain =
+      .ok consTailAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [consTailAnnotationTraceBuild]
+  rfl
+
+theorem consAlphaAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨consRootContext, (.sort (.succ (.param `u))),
+        consAlphaAnnotations.consumed⟩ := by
+  simpa [consAlphaAnnotations] using
+    (candidateIsDefEqSelfValid consRootContext
+      (.sort (.succ (.param `u))) 9999 rfl)
+
+theorem consNatAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨consAlphaContext, (.const ``Nat []),
+        consNatAnnotations.consumed⟩ := by
+  simpa [consNatAnnotations] using
+    (candidateIsDefEqSelfValid consAlphaContext
+      (.const ``Nat []) 9999 rfl)
+
+theorem consHeadAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨consNContext, consAlphaExpr,
+        consHeadAnnotations.consumed⟩ := by
+  simpa [consHeadAnnotations] using
+    (candidateIsDefEqSelfValid consNContext consAlphaExpr 9999 rfl)
+
+theorem consTailAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨consHeadContext, consTailDomain,
+        consTailAnnotations.consumed⟩ := by
+  simpa [consTailAnnotations] using
+    (candidateIsDefEqSelfValid consHeadContext consTailDomain 9999 rfl)
+
+theorem consRootCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consRootContext, indexedVecConsInfo.type,
+        .sort (.succ (.succ (.param `u)))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consRootContext, ctorContext] using
+    replayConsRootCheckTypeM
+
+theorem consRootWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consRootContext, indexedVecConsInfo.type,
+        indexedVecConsInfo.type⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consRootContext, ctorContext] using replayConsRootWhnfM
+
+theorem consAfterAlphaCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consAlphaContext, consAfterAlpha,
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl] using
+    replayConsAfterAlphaCheckTypeM
+
+theorem consAfterAlphaWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consAlphaContext, consAfterAlpha, consAfterAlpha⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl] using
+    replayConsAfterAlphaWhnfM
+
+theorem consAfterNCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consNContext, consAfterN, .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consNContext, consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl] using
+    replayConsAfterNCheckTypeM
+
+theorem consAfterNWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consNContext, consAfterN, consAfterN⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consNContext, consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl] using
+    replayConsAfterNWhnfM
+
+theorem consAfterHeadCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consHeadContext, consAfterHead,
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    replayConsAfterHeadCheckTypeM
+
+theorem consAfterHeadWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consHeadContext, consAfterHead, consAfterHead⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    replayConsAfterHeadWhnfM
+
+theorem consTerminalCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consTailContext, consTerminal,
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consTailContext, consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    replayConsTerminalCheckTypeM
+
+theorem consTerminalWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consTailContext, consTerminal, consTerminal⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consTailContext, consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    replayConsTerminalWhnfM
+
+theorem consAlphaDomainCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consRootContext, (.sort (.succ (.param `u))),
+        .sort (.succ (.succ (.param `u)))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consRootContext, nilCandidateContext, ctorContext] using
+    nilDomainCheckValid
+
+theorem consAlphaDomainWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consRootContext, (.sort (.succ (.param `u))),
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consRootContext, nilCandidateContext, ctorContext] using
+    nilDomainWhnfValid
+
+theorem consNatDomainCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consAlphaContext, (.const ``Nat []),
+        .sort (.succ .zero)⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl] using
+    ctorNatCheckTypeM consAlphaContext.lctx
+
+theorem consNatDomainWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consAlphaContext, (.const ``Nat []), (.const ``Nat [])⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl] using
+    ctorNatWhnfM consAlphaContext.lctx
+
+theorem consHeadDomainCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consNContext, consAlphaExpr,
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consAlphaExprShape, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    (ctorFVarCheckTypeM consNContext.lctx consAlphaId
+      (.sort (.succ (.param `u))) consAlphaFindInN)
+
+theorem consHeadDomainWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consNContext, consAlphaExpr, consAlphaExpr⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consAlphaExprShape, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    (ctorFVarWhnfM consNContext.lctx consAlphaId consAlphaFindInN)
+
+theorem consTailDomainCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨consHeadContext, consTailDomain,
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    replayConsTailDomainCheckTypeM
+
+theorem consTailDomainWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨consHeadContext, consTailDomain, consTailDomain⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl] using
+    replayConsTailDomainWhnfM
+
+def consAlphaDomainCandidateTrace :
+    AddInductive.CandidateExprTrace consRootContext
+      (.sort (.succ (.param `u))) :=
+  .terminal consRootContext (.sort (.succ (.param `u)))
+    (.sort (.succ (.succ (.param `u))))
+    (.sort (.succ (.param `u)))
+    consAlphaDomainCheckValid consAlphaDomainWhnfValid
+
+def consNatDomainCandidateTrace :
+    AddInductive.CandidateExprTrace consAlphaContext
+      (.const ``Nat []) :=
+  .terminal consAlphaContext (.const ``Nat [])
+    (.sort (.succ .zero)) (.const ``Nat [])
+    consNatDomainCheckValid consNatDomainWhnfValid
+
+def consHeadDomainCandidateTrace :
+    AddInductive.CandidateExprTrace consNContext consAlphaExpr :=
+  .terminal consNContext consAlphaExpr
+    (.sort (.succ (.param `u))) consAlphaExpr
+    consHeadDomainCheckValid consHeadDomainWhnfValid
+
+def consTailDomainCandidateTrace :
+    AddInductive.CandidateExprTrace consHeadContext consTailDomain :=
+  .terminal consHeadContext consTailDomain
+    (.sort (.succ (.param `u))) consTailDomain
+    consTailDomainCheckValid consTailDomainWhnfValid
+
+def consTerminalCandidateTrace :
+    AddInductive.CandidateExprTrace consTailContext
+      (consAfterHead.bindingBody!.instantiate1
+        consHeadContext.freshExpr) :=
+  .terminal consTailContext
+    (consAfterHead.bindingBody!.instantiate1 consHeadContext.freshExpr)
+    (.sort (.succ (.param `u))) consTerminal
+    (by simpa only [consTerminalShape] using consTerminalCheckValid)
+    (by simpa only [consTerminalShape] using consTerminalWhnfValid)
+
+def consAfterHeadCandidateTrace :
+    AddInductive.CandidateExprTrace consHeadContext
+      (consAfterN.bindingBody!.instantiate1 consNContext.freshExpr) :=
+  .forallE consHeadContext
+    (consAfterN.bindingBody!.instantiate1 consNContext.freshExpr)
+    (.sort (.succ (.param `u))) consTailName consTailDomain
+    consAfterHead.bindingBody! .default consHeadContextFresh
+    consTailAnnotations consTailAnnotationsEq
+    (by simpa only [consAfterHeadShape] using consAfterHeadCheckValid)
+    (by
+      simpa [consAfterN, consAfterHead, consTailDomain,
+        consAlphaExpr, consNExpr, consRootContext, consAlphaContext,
+        consNContext, ctorContext, AddInductive.Context.pushLocalDecl,
+        AddInductive.Context.freshExpr, Expr.bindingBody!,
+        Expr.instantiate1_eq, Expr.instantiate1',
+        Expr.liftLooseBVars_zero] using
+        consAfterHeadWhnfValid)
+    consTailDomainCandidateTrace consTerminalCandidateTrace
+
+def consAfterNCandidateTrace :
+    AddInductive.CandidateExprTrace consNContext
+      (consAfterAlpha.bindingBody!.instantiate1
+        consAlphaContext.freshExpr) :=
+  .forallE consNContext
+    (consAfterAlpha.bindingBody!.instantiate1
+      consAlphaContext.freshExpr)
+    (.sort (.succ (.param `u))) consHeadName consAlphaExpr
+    consAfterN.bindingBody! .default consNContextFresh
+    consHeadAnnotations consHeadAnnotationsEq
+    (by simpa only [consAfterNShape] using consAfterNCheckValid)
+    (by
+      simpa [consAfterAlpha, consAfterN, consAlphaExpr, consNExpr,
+        consRootContext, consAlphaContext, ctorContext,
+        AddInductive.Context.pushLocalDecl,
+        AddInductive.Context.freshExpr, Expr.bindingBody!,
+        Expr.instantiate1_eq, Expr.instantiate1',
+        Expr.liftLooseBVars_zero] using
+        consAfterNWhnfValid)
+    consHeadDomainCandidateTrace consAfterHeadCandidateTrace
+
+def consAfterAlphaCandidateTrace :
+    AddInductive.CandidateExprTrace consAlphaContext
+      (consNTypeRaw.instantiate1 consRootContext.freshExpr) :=
+  .forallE consAlphaContext
+    (consNTypeRaw.instantiate1 consRootContext.freshExpr)
+    (.sort (.succ (.param `u))) consNName (.const ``Nat [])
+    consAfterAlpha.bindingBody! .implicit consAlphaContextFresh
+    consNatAnnotations consNatAnnotationsEq
+    (by simpa only [consAfterAlphaShape] using consAfterAlphaCheckValid)
+    (by
+      simpa [consNTypeRaw, consHeadTypeRaw, consTailTypeRaw,
+        consTerminalRaw, consAfterAlpha, consAlphaExpr,
+        consRootContext, ctorContext, AddInductive.Context.freshExpr,
+        Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1',
+        Expr.liftLooseBVars_zero] using
+        consAfterAlphaWhnfValid)
+    consNatDomainCandidateTrace consAfterNCandidateTrace
+
+def consCandidateTrace :
+    AddInductive.CandidateExprTrace consRootContext
+      indexedVecConsInfo.type :=
+  .forallE consRootContext indexedVecConsInfo.type
+    (.sort (.succ (.succ (.param `u)))) consAlphaName
+    (.sort (.succ (.param `u))) consNTypeRaw .implicit consRootFresh
+    consAlphaAnnotations consAlphaAnnotationsEq consRootCheckValid
+    (by
+      simpa [consInfoTypeShape, consCtorTypeRaw] using consRootWhnfValid)
+    consAlphaDomainCandidateTrace consAfterAlphaCandidateTrace
+
+def consCandidate : AddInductive.CandidateExpr indexedVecConsInfo.type :=
+  ⟨consRootContext, consCandidateTrace⟩
+
+theorem consCandidate_view_eq :
+    consCandidate.view = indexedVecConsInfo.type := by
+  have habstract (context : AddInductive.Context) (e : Expr) :
+      e.abstract #[context.freshExpr] =
+        Expr.abstract1 context.freshFVarId e := by
+    rw [show #[context.freshExpr] =
+      ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl]
+    simp only [Expr.abstract_eq, Expr.abstractList]
+  simp only [consCandidate, AddInductive.CandidateExpr.view,
+    consCandidateTrace, consAlphaDomainCandidateTrace,
+    consNatDomainCandidateTrace, consHeadDomainCandidateTrace,
+    consTailDomainCandidateTrace, consTerminalCandidateTrace,
+    consAfterHeadCandidateTrace, consAfterNCandidateTrace,
+    consAfterAlphaCandidateTrace, AddInductive.CandidateExprTrace.view]
+  rw [habstract, habstract, habstract, habstract]
+  rw [consInfoTypeShape]
+  simp [consCtorTypeRaw, consNTypeRaw, consHeadTypeRaw,
+    consTailTypeRaw, consTerminalRaw, consTerminal, consTailDomain,
+    consAlphaExpr, consNExpr,
+    consRootContext, consAlphaContext, ctorContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshExpr,
+    AddInductive.Context.freshFVarId,
+    Expr.abstract1, NameGenerator.next, NameGenerator.curr]
+
+/-- The retained `cons` candidate preserves all four Pi nodes, their domains,
+and the terminal recursive result under the exact instantiated contexts. -/
+theorem consCandidate_identity :
+    TypeChecker.CandidateExprIdentity consCandidate.trace := by
+  change TypeChecker.CandidateExprIdentity consCandidateTrace
+  unfold consCandidateTrace
+  refine .forallE (name := consAlphaName) (binderInfo := .implicit)
+    (body := consNTypeRaw) (annotations := consAlphaAnnotations)
+    consAlphaDomainCandidateTrace consAfterAlphaCandidateTrace
+    (by simpa [consCtorTypeRaw] using consInfoTypeShape)
+    rfl (.terminal rfl) ?_
+  · unfold consAfterAlphaCandidateTrace
+    refine .forallE (name := consNName) (binderInfo := .implicit)
+      (body := consAfterAlpha.bindingBody!)
+      (annotations := consNatAnnotations)
+      consNatDomainCandidateTrace consAfterNCandidateTrace
+      (by rw [consAfterAlphaShape]; rfl) rfl (.terminal rfl) ?_
+    · unfold consAfterNCandidateTrace
+      refine .forallE (name := consHeadName) (binderInfo := .default)
+        (body := consAfterN.bindingBody!)
+        (annotations := consHeadAnnotations)
+        consHeadDomainCandidateTrace consAfterHeadCandidateTrace
+        (by rw [consAfterNShape]; rfl) rfl (.terminal rfl) ?_
+      · unfold consAfterHeadCandidateTrace
+        refine .forallE (name := consTailName) (binderInfo := .default)
+          (body := consAfterHead.bindingBody!)
+          (annotations := consTailAnnotations)
+          consTailDomainCandidateTrace consTerminalCandidateTrace
+          (by rw [consAfterHeadShape]; rfl) rfl (.terminal rfl) ?_
+        · unfold consTerminalCandidateTrace
+          exact .terminal (by
+            simpa only [Expr.instantiate1_eq] using consTerminalShape.symm)
+
+theorem consAlphaDomainCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop consRootContext
+      (.sort (.succ (.param `u))) (fuel + 1) =
+        .ok consAlphaDomainCandidateTrace := by
+  simpa only [consAlphaDomainCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      consRootContext (.sort (.succ (.param `u)))
+      (.sort (.succ (.succ (.param `u))))
+      (.sort (.succ (.param `u))) fuel
+      consAlphaDomainCheckValid consAlphaDomainWhnfValid rfl
+
+theorem consNatDomainCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop consAlphaContext
+      (.const ``Nat []) (fuel + 1) =
+        .ok consNatDomainCandidateTrace := by
+  simpa only [consNatDomainCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      consAlphaContext (.const ``Nat []) (.sort (.succ .zero))
+      (.const ``Nat []) fuel consNatDomainCheckValid
+      consNatDomainWhnfValid rfl
+
+theorem consHeadDomainCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop consNContext consAlphaExpr
+      (fuel + 1) = .ok consHeadDomainCandidateTrace := by
+  simpa only [consHeadDomainCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      consNContext consAlphaExpr (.sort (.succ (.param `u)))
+      consAlphaExpr fuel consHeadDomainCheckValid
+      consHeadDomainWhnfValid (by rw [consAlphaExprShape]; rfl)
+
+theorem consTailDomainCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop consHeadContext consTailDomain
+      (fuel + 1) = .ok consTailDomainCandidateTrace := by
+  simpa only [consTailDomainCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      consHeadContext consTailDomain (.sort (.succ (.param `u)))
+      consTailDomain fuel consTailDomainCheckValid
+      consTailDomainWhnfValid (by rfl)
+
+theorem consTerminalCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop consTailContext
+      (consAfterHead.bindingBody!.instantiate1
+        consHeadContext.freshExpr) (fuel + 1) =
+        .ok consTerminalCandidateTrace := by
+  simpa only [consTerminalCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      consTailContext
+      (consAfterHead.bindingBody!.instantiate1 consHeadContext.freshExpr)
+      (.sort (.succ (.param `u))) consTerminal fuel
+      (by simpa only [consTerminalShape] using consTerminalCheckValid)
+      (by simpa only [consTerminalShape] using consTerminalWhnfValid)
+      (by rfl)
+
+theorem consAfterHeadCandidateTraceLoop :
+    AddInductive.buildCandidateExpr.loop consHeadContext
+      (consAfterN.bindingBody!.instantiate1 consNContext.freshExpr) 997 =
+        .ok consAfterHeadCandidateTrace := by
+  rw [show 997 = 996 + 1 by rfl]
+  simpa only [consAfterHeadCandidateTrace, consTailContext,
+    consTailAnnotations] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := consHeadContext)
+      (e := consAfterN.bindingBody!.instantiate1 consNContext.freshExpr)
+      (inferred := .sort (.succ (.param `u))) (fuel := 996)
+      (name := consTailName) (domain := consTailDomain)
+      (body := consAfterHead.bindingBody!) (binderInfo := .default)
+      (hfresh := consHeadContextFresh)
+      (annotations := consTailAnnotations)
+      (hannotations := consTailAnnotationsBuild)
+      (hannotationsEq := consTailAnnotationsEq)
+      (hcheck := by
+        simpa only [consAfterHeadShape] using consAfterHeadCheckValid)
+      (hrun := by
+        simpa [consAfterN, consAfterHead, consTailDomain,
+          consAlphaExpr, consNExpr, consRootContext, consAlphaContext,
+          consNContext, ctorContext, AddInductive.Context.pushLocalDecl,
+          AddInductive.Context.freshExpr, Expr.bindingBody!,
+          Expr.instantiate1_eq, Expr.instantiate1',
+          Expr.liftLooseBVars_zero] using
+          consAfterHeadWhnfValid)
+      (domainCandidate := consTailDomainCandidateTrace)
+      (bodyCandidate := consTerminalCandidateTrace)
+      (hdomain := by
+        simpa using consTailDomainCandidateTraceLoop 995)
+      (hbody := by
+        simpa [consTailContext, consTailAnnotations] using
+          consTerminalCandidateTraceLoop 995))
+
+theorem consAfterNCandidateTraceLoop :
+    AddInductive.buildCandidateExpr.loop consNContext
+      (consAfterAlpha.bindingBody!.instantiate1
+        consAlphaContext.freshExpr) 998 =
+        .ok consAfterNCandidateTrace := by
+  rw [show 998 = 997 + 1 by rfl]
+  simpa only [consAfterNCandidateTrace, consHeadContext,
+    consHeadAnnotations] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := consNContext)
+      (e := consAfterAlpha.bindingBody!.instantiate1
+        consAlphaContext.freshExpr)
+      (inferred := .sort (.succ (.param `u))) (fuel := 997)
+      (name := consHeadName) (domain := consAlphaExpr)
+      (body := consAfterN.bindingBody!) (binderInfo := .default)
+      (hfresh := consNContextFresh)
+      (annotations := consHeadAnnotations)
+      (hannotations := consHeadAnnotationsBuild)
+      (hannotationsEq := consHeadAnnotationsEq)
+      (hcheck := by
+        simpa only [consAfterNShape] using consAfterNCheckValid)
+      (hrun := by
+        simpa [consAfterAlpha, consAfterN, consAlphaExpr, consNExpr,
+          consRootContext, consAlphaContext, ctorContext,
+          AddInductive.Context.pushLocalDecl,
+          AddInductive.Context.freshExpr, Expr.bindingBody!,
+          Expr.instantiate1_eq, Expr.instantiate1',
+          Expr.liftLooseBVars_zero] using
+          consAfterNWhnfValid)
+      (domainCandidate := consHeadDomainCandidateTrace)
+      (bodyCandidate := consAfterHeadCandidateTrace)
+      (hdomain := by
+        simpa using consHeadDomainCandidateTraceLoop 996)
+      (hbody := by
+        simpa [consHeadContext, consHeadAnnotations] using
+          consAfterHeadCandidateTraceLoop))
+
+theorem consAfterAlphaCandidateTraceLoop :
+    AddInductive.buildCandidateExpr.loop consAlphaContext
+      (consNTypeRaw.instantiate1 consRootContext.freshExpr) 999 =
+        .ok consAfterAlphaCandidateTrace := by
+  rw [show 999 = 998 + 1 by rfl]
+  simpa only [consAfterAlphaCandidateTrace, consNContext,
+    consNatAnnotations] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := consAlphaContext)
+      (e := consNTypeRaw.instantiate1 consRootContext.freshExpr)
+      (inferred := .sort (.succ (.param `u))) (fuel := 998)
+      (name := consNName) (domain := .const ``Nat [])
+      (body := consAfterAlpha.bindingBody!) (binderInfo := .implicit)
+      (hfresh := consAlphaContextFresh)
+      (annotations := consNatAnnotations)
+      (hannotations := consNatAnnotationsBuild)
+      (hannotationsEq := consNatAnnotationsEq)
+      (hcheck := by
+        simpa only [consAfterAlphaShape] using consAfterAlphaCheckValid)
+      (hrun := by
+        simpa [consNTypeRaw, consHeadTypeRaw, consTailTypeRaw,
+          consTerminalRaw, consAfterAlpha, consAlphaExpr,
+          consRootContext, ctorContext, AddInductive.Context.freshExpr,
+          Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1',
+          Expr.liftLooseBVars_zero] using
+          consAfterAlphaWhnfValid)
+      (domainCandidate := consNatDomainCandidateTrace)
+      (bodyCandidate := consAfterNCandidateTrace)
+      (hdomain := by
+        simpa using consNatDomainCandidateTraceLoop 997)
+      (hbody := by
+        simpa [consNContext, consNatAnnotations] using
+          consAfterNCandidateTraceLoop))
+
+theorem consCandidateTraceLoop :
+    AddInductive.buildCandidateExpr.loop consRootContext
+      indexedVecConsInfo.type consRootContext.fuel.inductiveFuel =
+        .ok consCandidateTrace := by
+  change AddInductive.buildCandidateExpr.loop consRootContext
+    indexedVecConsInfo.type (999 + 1) = _
+  simpa only [consCandidateTrace, consAlphaContext,
+    consAlphaAnnotations] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := consRootContext) (e := indexedVecConsInfo.type)
+      (inferred := .sort (.succ (.succ (.param `u)))) (fuel := 999)
+      (name := consAlphaName)
+      (domain := .sort (.succ (.param `u)))
+      (body := consNTypeRaw) (binderInfo := .implicit)
+      (hfresh := consRootFresh)
+      (annotations := consAlphaAnnotations)
+      (hannotations := consAlphaAnnotationsBuild)
+      (hannotationsEq := consAlphaAnnotationsEq)
+      (hcheck := consRootCheckValid)
+      (hrun := by
+        simpa [consInfoTypeShape, consCtorTypeRaw] using consRootWhnfValid)
+      (domainCandidate := consAlphaDomainCandidateTrace)
+      (bodyCandidate := consAfterAlphaCandidateTrace)
+      (hdomain := by
+        simpa using consAlphaDomainCandidateTraceLoop 998)
+      (hbody := by
+        simpa [consAlphaContext, consAlphaAnnotations] using
+          consAfterAlphaCandidateTraceLoop))
+
+theorem consCandidateProduced :
+    AddInductive.buildCandidateExpr indexedVecConsInfo.type
+      consRootContext = .ok consCandidate := by
+  unfold AddInductive.buildCandidateExpr
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  rw [consCandidateTraceLoop]
+  rfl
+
+def indexedVecNilConstructorCandidate :
+    AddInductive.CandidateConstructor indexedVecKernelNil where
+  type := nilCandidate
+
+def indexedVecConsConstructorCandidate :
+    AddInductive.CandidateConstructor indexedVecKernelCons where
+  type := consCandidate
+
+def indexedVecFamilyListCandidate :
+    AddInductive.CandidateFamily indexedVecKernelType where
+  familyType := ⟨indexedVecFamilyCandidate⟩
+  constructors :=
+    .cons indexedVecNilConstructorCandidate
+      (.cons indexedVecConsConstructorCandidate .nil)
+
+def indexedVecNormalizationCandidate :
+    AddInductive.NormalizationCandidate [indexedVecKernelType] where
+  families := .cons indexedVecFamilyListCandidate .nil
+
+/-- Source-indexed evidence for the complete `IndexedVec` family-type list. -/
+theorem indexedVecFamilyTypeListProduced :
+    AddInductive.CandidateFamilyTypeListProduced
+      indexedVecFamilyCandidateContext
+      (.cons indexedVecFamilyListCandidate.familyType .nil) := by
+  exact .cons (by
+    unfold AddInductive.normalizeCandidateFamilyType
+    simp only [ReaderT.bind, Bind.bind]
+    simp only [indexedVecKernelType]
+    rw [indexedVecFamily_candidateTrace]
+    rfl) .nil
+
+theorem indexedVecFamilyTypeListCandidateProduced :
+    (withReader (fun c : AddInductive.Context => { c with lctx := {} })
+        (AddInductive.normalizeCandidateFamilyTypeList
+          [indexedVecKernelType])) indexedVecFamilyCandidateContext =
+      .ok (.cons indexedVecFamilyListCandidate.familyType .nil) := by
+  change AddInductive.normalizeCandidateFamilyTypeList
+    [indexedVecKernelType] indexedVecFamilyCandidateContext = _
+  exact indexedVecFamilyTypeListProduced.normalize
+
+/-- The two constructor positions are assembled in source order.  The
+dependent list indices rule out truncating, swapping, or reusing either
+constructor proof. -/
+theorem indexedVecConstructorListProduced :
+    AddInductive.CandidateConstructorListProduced ctorContext
+      indexedVecFamilyListCandidate.constructors := by
+  have hnil : AddInductive.buildCandidateExpr indexedVecNilInfo.type
+      ctorContext = .ok nilCandidate := by
+    simpa [nilCandidateContext] using nilCandidateProduced
+  have hcons : AddInductive.buildCandidateExpr indexedVecConsInfo.type
+      ctorContext = .ok consCandidate := by
+    simpa [consRootContext] using consCandidateProduced
+  exact .cons (by
+    unfold AddInductive.normalizeCandidateConstructor
+    simp only [ReaderT.bind, Bind.bind]
+    simp only [indexedVecKernelNil]
+    rw [hnil]
+    rfl) (.cons (by
+      unfold AddInductive.normalizeCandidateConstructor
+      simp only [ReaderT.bind, Bind.bind]
+      simp only [indexedVecKernelCons]
+      rw [hcons]
+      rfl) .nil)
+
+theorem indexedVecConstructorListCandidateProduced :
+    AddInductive.normalizeCandidateConstructorList
+        indexedVecKernelType.ctors ctorContext =
+      .ok indexedVecFamilyListCandidate.constructors := by
+  exact indexedVecConstructorListProduced.normalize
+
+/-- Source-indexed evidence for complete family assembly after constructor
+normalization. -/
+theorem indexedVecFamilyListProduced :
+    AddInductive.CandidateFamilyListProduced ctorContext
+      (.cons indexedVecFamilyListCandidate.familyType .nil)
+      indexedVecNormalizationCandidate.families := by
+  exact .cons indexedVecConstructorListProduced .nil
+
+theorem indexedVecFamilyListCandidateProduced :
+    AddInductive.normalizeCandidateFamilyList
+        (.cons indexedVecFamilyListCandidate.familyType .nil)
+        ctorContext =
+      .ok indexedVecNormalizationCandidate.families := by
+  exact indexedVecFamilyListProduced.normalize
+
+end IndexedVecConsReplay
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/IndexedVecConstructors.lean b/Ix/Theory/Named/Verify/Environment/IndexedVecConstructors.lean
new file mode 100644
index 000000000..2af5cf296
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/IndexedVecConstructors.lean
@@ -0,0 +1,1803 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.IndexedVecCandidate
+
+/-!
+# IndexedVec constructor normalization candidates
+
+Exact ordinary-checker and candidate-producer traces for the real `nil` and
+`cons` constructor metadata, staged in the post-family kernel environment.
+This module extends the family-validation seam proved in
+`IndexedVecCandidate` toward the complete normalization candidate used by the
+certified inductive-generation path.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta
+open Ix.Theory.Named.InductiveFixtures
+
+def ctorEnv : Kernel.Environment :=
+  -- `declareInductiveTypes` preserves the input environment header while
+  -- inserting the raw family constant.  Use that exact staged header so this
+  -- environment is not merely lookup-equivalent to the producer result.
+  Kernel.Environment.ofConstants `_indexedVecCandidate indexedVecTypeMap
+
+def ctorContext : AddInductive.Context where
+  env := ctorEnv
+  lparams := [`u]
+  safety := .safe
+  allowPrimitive := false
+
+theorem type_lookup_family :
+    ctorEnv.find? ``IndexedVec = some indexedVecInfo := by
+  change indexedVecTypeMap.find?' ``IndexedVec = some indexedVecInfo
+  rw [indexedVecTypeMap_wf.find?'_eq_find?, indexedVecTypeMap,
+    natMap_wf.find?_insert]
+  rfl
+
+theorem type_lookup_nat : ctorEnv.find? ``Nat = some natInfo := by
+  change indexedVecTypeMap.find?' ``Nat = some natInfo
+  rw [indexedVecTypeMap_wf.find?'_eq_find?, indexedVecTypeMap,
+    natMap_wf.find?_insert, nat_type_map_lookup]
+  simp +decide
+
+theorem nat_zero_map_lookup :
+    natMap.find? ``Nat.zero = some natZeroInfo := by
+  rw [natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert]
+  rfl
+
+theorem type_lookup_zero :
+    ctorEnv.find? ``Nat.zero = some natZeroInfo := by
+  change indexedVecTypeMap.find?' ``Nat.zero = some natZeroInfo
+  rw [indexedVecTypeMap_wf.find?'_eq_find?, indexedVecTypeMap,
+    natMap_wf.find?_insert, nat_zero_map_lookup]
+  simp +decide
+
+theorem type_lookup_succ :
+    ctorEnv.find? ``Nat.succ = some natSuccInfo := by
+  change indexedVecTypeMap.find?' ``Nat.succ = some natSuccInfo
+  rw [indexedVecTypeMap_wf.find?'_eq_find?, indexedVecTypeMap,
+    natMap_wf.find?_insert, nat_succ_map_lookup]
+  simp +decide
+
+@[simp] theorem type_get_family :
+    ctorEnv.get ``IndexedVec = .ok indexedVecInfo := by
+  unfold Kernel.Environment.get
+  rw [type_lookup_family]
+  rfl
+
+@[simp] theorem type_get_nat : ctorEnv.get ``Nat = .ok natInfo := by
+  unfold Kernel.Environment.get
+  rw [type_lookup_nat]
+  rfl
+
+@[simp] theorem type_get_zero :
+    ctorEnv.get ``Nat.zero = .ok natZeroInfo := by
+  unfold Kernel.Environment.get
+  rw [type_lookup_zero]
+  rfl
+
+@[simp] theorem type_get_succ :
+    ctorEnv.get ``Nat.succ = .ok natSuccInfo := by
+  unfold Kernel.Environment.get
+  rw [type_lookup_succ]
+  rfl
+
+def tcContext (lctx : LocalContext := {}) : TypeChecker.Context where
+  env := ctorEnv
+  lctx := lctx
+  lparams := [`u]
+
+@[simp] theorem checkLevelSuccParam (lctx) :
+    TypeChecker.Inner.checkLevel (tcContext lctx)
+      (.succ (.param `u)) = .ok () := by
+  simp [TypeChecker.Inner.checkLevel, tcContext,
+    Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq, Level.hasParam']
+  rfl
+
+@[simp] theorem checkLevelParam (lctx) :
+    TypeChecker.Inner.checkLevel (tcContext lctx) (.param `u) =
+      .ok () := by
+  simp [TypeChecker.Inner.checkLevel, tcContext,
+    Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq, Level.hasParam']
+  rfl
+
+@[simp] theorem indexedVecInfoLevelParams :
+    indexedVecInfo.levelParams = [`u] := rfl
+
+@[simp] theorem indexedVecInfoIsUnsafe :
+    indexedVecInfo.isUnsafe = false := rfl
+
+@[simp] theorem indexedVecInfoInstantiate :
+    indexedVecInfo.instantiateTypeLevelParams [.param `u] =
+      indexedVecInfo.type := by
+  rw [ConstantInfo.instantiateTypeLevelParams,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq]
+  simp [indexedVecInfo, ConstantInfo.type, ConstantInfo.toConstantVal,
+    Expr.instantiateLevelParamsCore', Level.substParams']
+
+@[simp] theorem inferConstantFamily (lctx) :
+    TypeChecker.Inner.inferConstant (tcContext lctx) ``IndexedVec
+      [.param `u] false = .ok indexedVecInfo.type := by
+  unfold TypeChecker.Inner.inferConstant
+  simp only [tcContext]
+  rw [type_get_family]
+  simp only [Bind.bind, Except.bind]
+  rw [show indexedVecInfo.levelParams.length = 1 by rfl]
+  simp
+  rw [show TypeChecker.Inner.checkLevel
+      ({ env := ctorEnv, lctx := lctx, lparams := [`u] } :
+        TypeChecker.Context) (.param `u) = .ok () by
+    simpa [tcContext] using checkLevelParam lctx]
+  simp [indexedVecInfo, Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] theorem inferConstantNat (lctx) :
+    TypeChecker.Inner.inferConstant (tcContext lctx) ``Nat [] false =
+      .ok (.sort (.succ .zero)) := by
+  unfold TypeChecker.Inner.inferConstant
+  simp [tcContext, natInfo,
+    ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Level.substParams',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] theorem inferConstantZero (lctx) :
+    TypeChecker.Inner.inferConstant (tcContext lctx) ``Nat.zero [] false =
+      .ok (.const ``Nat []) := by
+  unfold TypeChecker.Inner.inferConstant
+  simp [tcContext, natZeroInfo,
+    ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] theorem inferConstantSucc (lctx) :
+    TypeChecker.Inner.inferConstant (tcContext lctx) ``Nat.succ [] false =
+      .ok (.forallE `n (.const ``Nat []) (.const ``Nat []) .default) := by
+  unfold TypeChecker.Inner.inferConstant
+  simp [tcContext, natSuccInfo,
+    ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams, ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+theorem selfDefEq (e : Expr) fuel context state :
+    TypeChecker.Inner.isDefEq e e (TypeChecker.Methods.withFuel fuel)
+      context state = .ok (true, state) := by
+  unfold TypeChecker.Inner.isDefEq
+  rw [if_pos (Expr.eqv_refl _)]
+  rfl
+
+@[simp] theorem constBeqFVar (name : Name) (levels : List Level)
+    (id : FVarId) :
+    ((.const name levels : Expr) == .fvar id) = false := by
+  change Expr.eqv (.const name levels) (.fvar id) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem sortBeqFVar (level : Level) (id : FVarId) :
+    ((.sort level : Expr) == .fvar id) = false := by
+  change Expr.eqv (.sort level) (.fvar id) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem fvarBeqConst (id : FVarId) (name : Name)
+    (levels : List Level) :
+    ((.fvar id : Expr) == .const name levels) = false := by
+  change Expr.eqv (.fvar id) (.const name levels) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem sortBeqApp (level : Level) (fn arg : Expr) :
+    ((.sort level : Expr) == .app fn arg) = false := by
+  change Expr.eqv (.sort level) (.app fn arg) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] theorem indexedVecConstBeqZero :
+    ((.const ``IndexedVec [.param `u] : Expr) ==
+      .const ``Nat.zero []) = false := by
+  change Expr.eqv (.const ``IndexedVec [.param `u])
+    (.const ``Nat.zero []) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+theorem withLocalDeclEq
+    {α} (name : Name) (bi : BinderInfo) (ty : Expr)
+    (k : Expr → TypeChecker.RecM α)
+    (methods : TypeChecker.Methods)
+    (context : TypeChecker.Context)
+    (state : TypeChecker.State) :
+    (withLocalDecl (m := TypeChecker.RecM) name bi ty k)
+      methods context state =
+        k (.fvar ⟨state.ngen.curr⟩) methods
+          { context with lctx :=
+              context.lctx.mkLocalDecl ⟨state.ngen.curr⟩ name ty bi }
+          { state with ngen := state.ngen.next } := rfl
+
+def nilRootSortState : TypeChecker.State :=
+  { ({} : TypeChecker.State) with
+    inferTypeC := ({} : TypeChecker.State).inferTypeC.insert
+      (.sort (.succ (.param `u)))
+      (.sort (.succ (.succ (.param `u)))) }
+
+def nilAlphaId : FVarId :=
+  ⟨nilRootSortState.ngen.curr⟩
+
+def nilAlphaLctx : LocalContext :=
+  ({} : LocalContext).mkLocalDecl nilAlphaId `α
+    (.sort (.succ (.param `u))) .implicit
+
+def nilBodyInitialState : TypeChecker.State :=
+  { nilRootSortState with ngen := nilRootSortState.ngen.next }
+
+theorem nilAlphaFind :
+    nilAlphaLctx.find? nilAlphaId =
+      some (.cdecl 0 nilAlphaId `α
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  have hfresh : ({} : LocalContext).find? nilAlphaId = none := by
+    have h := LocalContext.WF.find?_eq_find?_toList
+      (fv := nilAlphaId) LocalContext.WF.nil
+    change
+      ({ fvarIdToDecl := PersistentHashMap.empty,
+         decls := PersistentArray.empty,
+         auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+        nilAlphaId = none
+    rw [h]
+    simp [LocalContext.toList]
+  have hwf : nilAlphaLctx.WF := by
+    change (({} : LocalContext).mkLocalDecl nilAlphaId `α
+      (.sort (.succ (.param `u))) .implicit).WF
+    exact LocalContext.WF.mkLocalDecl LocalContext.WF.nil hfresh
+  rw [hwf.find?_eq_find?_toList]
+  simp only [nilAlphaLctx]
+  rw [LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  rw [show ({} : LocalContext).decls.size = 0 by rfl]
+  change
+    (if nilAlphaId == nilAlphaId then
+      some (LocalDecl.cdecl 0 nilAlphaId `α
+        (.sort (.succ (.param `u))) .implicit .default)
+    else none) = _
+  rw [beq_self_eq_true]
+  rfl
+
+example :
+    TypeChecker.Inner.inferFVar (tcContext nilAlphaLctx) nilAlphaId =
+      .ok (.sort (.succ (.param `u))) := by
+  unfold TypeChecker.Inner.inferFVar
+  simp [tcContext, nilAlphaFind, LocalDecl.type,
+    Pure.pure, Except.pure]
+
+theorem inferTypeFamilyCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache : state.inferTypeC[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none) :
+    TypeChecker.Inner.inferType'
+      (.const ``IndexedVec [.param `u]) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (indexedVecInfo.type,
+          { state with inferTypeC :=
+              (state.inferTypeC.insert
+                (.const ``IndexedVec [.param `u]) indexedVecInfo.type) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    inferConstantFamily, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+theorem inferTypeFVarCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (id : FVarId) (type : Expr)
+    (hcache : state.inferTypeC[(.fvar id : Expr)]? = none)
+    (hfind : lctx.find? id = some (.cdecl index id name type bi kind)) :
+    TypeChecker.Inner.inferType' (.fvar id) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (type, { state with inferTypeC :=
+          (state.inferTypeC.insert (.fvar id) type) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    TypeChecker.Inner.inferFVar, tcContext, hfind,
+    LocalDecl.type, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem inferTypeZeroCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache : state.inferTypeC[(.const ``Nat.zero [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType' (.const ``Nat.zero []) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.const ``Nat [], { state with inferTypeC :=
+          (state.inferTypeC.insert (.const ``Nat.zero []) (.const ``Nat [])) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    inferConstantZero, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+theorem inferTypeNatCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache : state.inferTypeC[(.const ``Nat [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.sort (.succ .zero), { state with inferTypeC :=
+          (state.inferTypeC.insert (.const ``Nat [])
+            (.sort (.succ .zero))) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    inferConstantNat, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+theorem inferTypeSuccCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache : state.inferTypeC[(.const ``Nat.succ [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType' (.const ``Nat.succ []) false
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.forallE `n (.const ``Nat []) (.const ``Nat []) .default,
+          { state with inferTypeC :=
+            (state.inferTypeC.insert (.const ``Nat.succ [])
+              (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    inferConstantSucc, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+@[simp] theorem ensureForallExact
+    (name : Name) (domain body : Expr) (bi : BinderInfo)
+    (source : Expr) (fuel : Nat) (context : TypeChecker.Context)
+    (state : TypeChecker.State) :
+    TypeChecker.Inner.ensureForallCore (.forallE name domain body bi)
+      source (TypeChecker.Methods.withFuel fuel) context state =
+        .ok (.forallE name domain body bi, state) := by
+  rfl
+
+theorem inferAppCoreOf
+    (fuel : Nat) (context : TypeChecker.Context)
+    (state stateFn stateArg : TypeChecker.State)
+    (fn arg domain body : Expr) (name : Name) (bi : BinderInfo)
+    (hclosed : (.app fn arg : Expr).hasLooseBVars = false)
+    (hcache : state.inferTypeC[(.app fn arg : Expr)]? = none)
+    (hfn : TypeChecker.Inner.inferType' fn false
+      (TypeChecker.Methods.withFuel fuel) context state =
+        .ok (.forallE name domain body bi, stateFn))
+    (harg : TypeChecker.Inner.inferType' arg false
+      (TypeChecker.Methods.withFuel fuel) context stateFn =
+        .ok (domain, stateArg))
+    (heager : arg.isAppOfArity ``eagerReduce 2 = false) :
+    TypeChecker.Inner.inferType' (.app fn arg) false
+      (TypeChecker.Methods.withFuel fuel) context state =
+        .ok (body.instantiate1 arg,
+          { stateArg with inferTypeC :=
+              (stateArg.inferTypeC.insert
+                (.app fn arg) (body.instantiate1 arg)) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [hclosed, hcache, hfn, harg, heager, selfDefEq, Expr.instantiate1_eq, Bind.bind,
+    ReaderT.bind, StateT.bind, Except.bind]
+
+theorem inferTypeForallCore
+    (fuel : Nat) (context : TypeChecker.Context)
+    (state finalState : TypeChecker.State)
+    (name : Name) (domain body result : Expr) (bi : BinderInfo)
+    (hclosed : (.forallE name domain body bi : Expr).hasLooseBVars = false)
+    (hcache : state.inferTypeC[(.forallE name domain body bi : Expr)]? = none)
+    (hforall : TypeChecker.Inner.inferForall
+      (.forallE name domain body bi) false
+      (TypeChecker.Methods.withFuel fuel) context state =
+        .ok (result, finalState)) :
+    TypeChecker.Inner.inferType'
+      (.forallE name domain body bi) false
+      (TypeChecker.Methods.withFuel fuel) context state =
+        .ok (result, { finalState with inferTypeC :=
+          (finalState.inferTypeC.insert
+            (.forallE name domain body bi) result) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [hclosed, hcache, hforall, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+def nilBodyExpr : Expr :=
+  .app (.app (.const ``IndexedVec [.param `u]) (.fvar nilAlphaId))
+    (.const ``Nat.zero [])
+
+def vecIndexName : Name :=
+  indexedVecInfo.type.bindingBody!.bindingName!
+
+def vecFamilyTail : Expr :=
+  .forallE vecIndexName (.const ``Nat [])
+    (.sort (.succ (.param `u))) .default
+
+theorem indexedVecInfoTypeShape :
+    indexedVecInfo.type =
+      .forallE `α (.sort (.succ (.param `u))) vecFamilyTail .default := by
+  rfl
+
+@[simp] theorem vecFamilyTailInstantiate (arg : Expr) :
+    vecFamilyTail.instantiate1 arg = vecFamilyTail := by
+  simp [vecFamilyTail, Expr.instantiate1_eq, Expr.instantiate1']
+
+def nilFamilyState : TypeChecker.State :=
+  { nilBodyInitialState with inferTypeC :=
+      (nilBodyInitialState.inferTypeC.insert
+        (.const ``IndexedVec [.param `u]) indexedVecInfo.type) }
+
+def nilAlphaState : TypeChecker.State :=
+  { nilFamilyState with inferTypeC :=
+      (nilFamilyState.inferTypeC.insert (.fvar nilAlphaId)
+        (.sort (.succ (.param `u)))) }
+
+def nilFirstApp : Expr :=
+  .app (.const ``IndexedVec [.param `u]) (.fvar nilAlphaId)
+
+def nilFirstAppState : TypeChecker.State :=
+  { nilAlphaState with inferTypeC :=
+      (nilAlphaState.inferTypeC.insert nilFirstApp vecFamilyTail) }
+
+def nilZeroState : TypeChecker.State :=
+  { nilFirstAppState with inferTypeC :=
+      (nilFirstAppState.inferTypeC.insert (.const ``Nat.zero [])
+        (.const ``Nat [])) }
+
+theorem inferNilFamily :
+    TypeChecker.Inner.inferType'
+      (.const ``IndexedVec [.param `u]) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext nilAlphaLctx) nilBodyInitialState =
+        .ok (indexedVecInfo.type, nilFamilyState) := by
+  simpa [nilFamilyState] using
+    (inferTypeFamilyCore 9998 nilAlphaLctx nilBodyInitialState (by
+      simp [nilBodyInitialState, nilRootSortState]))
+
+theorem inferNilAlpha :
+    TypeChecker.Inner.inferType' (.fvar nilAlphaId) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext nilAlphaLctx) nilFamilyState =
+        .ok (.sort (.succ (.param `u)), nilAlphaState) := by
+  simpa [nilAlphaState] using
+    (inferTypeFVarCore 9998 nilAlphaLctx nilFamilyState nilAlphaId
+      (.sort (.succ (.param `u))) (index := 0) (name := `α)
+      (bi := .implicit) (kind := .default) (by
+        simp [nilFamilyState, nilBodyInitialState, nilRootSortState]) nilAlphaFind)
+
+theorem inferNilFirstApp :
+    TypeChecker.Inner.inferType' nilFirstApp false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext nilAlphaLctx) nilBodyInitialState =
+        .ok (vecFamilyTail, nilFirstAppState) := by
+  have h := inferAppCoreOf 9998 (tcContext nilAlphaLctx)
+    nilBodyInitialState nilFamilyState nilAlphaState
+    (.const ``IndexedVec [.param `u]) (.fvar nilAlphaId)
+    (.sort (.succ (.param `u))) vecFamilyTail `α .default
+    (by
+      simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    (by
+      simp [nilBodyInitialState, nilRootSortState])
+    (by simpa [indexedVecInfoTypeShape] using inferNilFamily)
+    inferNilAlpha (by rfl)
+  simpa [nilFirstApp, nilFirstAppState, vecFamilyTail,
+    Expr.instantiate1'] using h
+
+theorem inferNilZero :
+    TypeChecker.Inner.inferType' (.const ``Nat.zero []) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext nilAlphaLctx) nilFirstAppState =
+        .ok (.const ``Nat [], nilZeroState) := by
+  simpa [nilZeroState] using
+    (inferTypeZeroCore 9998 nilAlphaLctx nilFirstAppState (by
+      simp [nilFirstAppState, nilAlphaState, nilFamilyState, nilBodyInitialState, nilRootSortState,
+        nilFirstApp]))
+
+theorem inferNilBodyExists : ∃ finalState,
+    TypeChecker.Inner.inferType nilBodyExpr false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilAlphaLctx) nilBodyInitialState =
+        .ok (.sort (.succ (.param `u)), finalState) := by
+  refine ⟨{ nilZeroState with inferTypeC :=
+    (nilZeroState.inferTypeC.insert nilBodyExpr
+      (.sort (.succ (.param `u)))) }, ?_⟩
+  change TypeChecker.Inner.inferType' nilBodyExpr false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext nilAlphaLctx) nilBodyInitialState = _
+  have h := inferAppCoreOf 9998 (tcContext nilAlphaLctx)
+    nilBodyInitialState nilFirstAppState nilZeroState
+    nilFirstApp (.const ``Nat.zero []) (.const ``Nat [])
+    (.sort (.succ (.param `u))) vecIndexName .default
+    (by simp [nilFirstApp, Expr.hasLooseBVars, Expr.looseBVarRange'])
+    (by simp [nilBodyInitialState, nilRootSortState])
+    (by simpa [vecFamilyTail] using inferNilFirstApp)
+    inferNilZero (by rfl)
+  simpa [nilBodyExpr, nilFirstApp,
+    Expr.instantiate1_eq, Expr.instantiate1'] using h
+
+theorem nilOuterWithLocalDecl
+    {α} (k : Expr → TypeChecker.RecM α)
+    (methods : TypeChecker.Methods) :
+    (withLocalDecl (m := TypeChecker.RecM) `α .implicit
+      (.sort (.succ (.param `u))) k)
+        methods (tcContext ({} : LocalContext)) nilRootSortState =
+      k (.fvar nilAlphaId) methods (tcContext nilAlphaLctx)
+        nilBodyInitialState := by
+  simpa [nilAlphaId, nilAlphaLctx, nilBodyInitialState, tcContext] using
+    (withLocalDeclEq `α .implicit (.sort (.succ (.param `u))) k methods
+      (tcContext ({} : LocalContext)) nilRootSortState)
+
+@[simp] theorem ensureSortExact
+    (level : Level) (source : Expr) (fuel : Nat)
+    (context : TypeChecker.Context) (state : TypeChecker.State) :
+    TypeChecker.Inner.ensureSortCore (.sort level) source
+      (TypeChecker.Methods.withFuel fuel) context state =
+        .ok (.sort level, state) := by
+  rfl
+
+theorem nilRootSortCore :
+    TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (TypeChecker.Methods.withFuel 9998)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.succ (.param `u))), nilRootSortState) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    nilRootSortState, checkLevelSuccParam,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+def nilCtorBodyRaw : Expr :=
+  .app (.app (.const ``IndexedVec [.param `u]) (.bvar 0))
+    (.const ``Nat.zero [])
+
+def nilCtorTypeRaw : Expr :=
+  .forallE `α (.sort (.succ (.param `u))) nilCtorBodyRaw .implicit
+
+def nilCtorInferredLevel : Level :=
+  mkLevelIMax' (.succ (.succ (.param `u))) (.succ (.param `u))
+
+theorem nilInfoTypeShape : indexedVecNilInfo.type = nilCtorTypeRaw := by
+  rfl
+
+theorem nilRootInferForallExists : ∃ finalState,
+    TypeChecker.Inner.inferForall nilCtorTypeRaw false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State) =
+        .ok (.sort nilCtorInferredLevel, finalState) := by
+  obtain ⟨finalState, hbody⟩ := inferNilBodyExists
+  refine ⟨finalState, ?_⟩
+  unfold TypeChecker.Inner.inferForall
+  simp only [TypeChecker.Inner.inferForall.loop, nilCtorTypeRaw]
+  rw [show
+    (.sort (.succ (.param `u)) : Expr).instantiateRev #[] =
+      .sort (.succ (.param `u)) by
+        simp [Expr.instantiateRev_eq, Expr.instantiate_eq]]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show TypeChecker.Inner.inferType
+      (.sort (.succ (.param `u))) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State) =
+        TypeChecker.Inner.inferType'
+          (.sort (.succ (.param `u))) false
+          (TypeChecker.Methods.withFuel 9998)
+          (tcContext ({} : LocalContext)) ({} : TypeChecker.State) by rfl]
+  rw [nilRootSortCore]
+  simp only
+  rw [ensureSortExact]
+  simp only
+  rw [nilOuterWithLocalDecl]
+  simp only [TypeChecker.Inner.inferForall.loop, nilCtorBodyRaw]
+  rw [show
+      (((.const ``IndexedVec [.param `u] : Expr).app (.bvar 0)).app
+        (.const ``Nat.zero [])).instantiateRev
+      (#[] |>.push (.fvar nilAlphaId)) = nilBodyExpr by
+    simp [nilBodyExpr, nilAlphaId, Expr.instantiateRev_eq, Expr.instantiate_eq, Expr.instantiate1',
+      Expr.liftLooseBVars_zero]]
+  simp only [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hbody]
+  simp only
+  rw [ensureSortExact]
+  simp [nilCtorInferredLevel, Expr.sortLevel!, Pure.pure, ReaderT.pure,
+    StateT.pure, Except.pure]
+
+theorem inferNilRootExists : ∃ finalState,
+    TypeChecker.Inner.inferType indexedVecNilInfo.type false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State) =
+        .ok (.sort nilCtorInferredLevel, finalState) := by
+  obtain ⟨state, hforall⟩ := nilRootInferForallExists
+  refine ⟨{ state with inferTypeC :=
+    (state.inferTypeC.insert indexedVecNilInfo.type
+      (.sort nilCtorInferredLevel)) }, ?_⟩
+  change TypeChecker.Inner.inferType' indexedVecNilInfo.type false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State) = _
+  rw [nilInfoTypeShape]
+  exact inferTypeForallCore 9999 (tcContext ({} : LocalContext))
+    ({} : TypeChecker.State) state `α
+    (.sort (.succ (.param `u))) nilCtorBodyRaw
+    (.sort nilCtorInferredLevel) .implicit
+    (by simp [nilCtorBodyRaw, Expr.hasLooseBVars,
+      Expr.looseBVarRange'])
+    (by simp) hforall
+
+theorem nilRootCheckTypeM :
+    TypeChecker.M.run ctorEnv .safe {} [`u] {}
+      (TypeChecker.checkType indexedVecNilInfo.type) =
+      .ok (.sort nilCtorInferredLevel) := by
+  obtain ⟨finalState, hroot⟩ := inferNilRootExists
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType indexedVecNilInfo.type false
+        (TypeChecker.Methods.withFuel 10000)
+        (tcContext {}) ({} : TypeChecker.State)) = _
+  rw [hroot]
+  rfl
+
+def nilCandidateContext : AddInductive.Context := ctorContext
+
+def nilCandidateBodyContext : AddInductive.Context :=
+  nilCandidateContext.pushLocalDecl `α .implicit
+    (.sort (.succ (.param `u)))
+
+def nilCandidateBody : Expr :=
+  nilCtorBodyRaw.instantiate1 nilCandidateContext.freshExpr
+
+theorem nilStandaloneSortCore :
+    TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.succ (.param `u))), nilRootSortState) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    nilRootSortState, checkLevelSuccParam,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem nilRootWhnfM :
+    TypeChecker.M.run nilCandidateContext.env nilCandidateContext.safety
+      nilCandidateContext.lctx nilCandidateContext.lparams
+      nilCandidateContext.fuel
+      (TypeChecker.whnf indexedVecNilInfo.type) =
+        .ok indexedVecNilInfo.type := by
+  rfl
+
+theorem nilDomainCheckTypeM :
+    TypeChecker.M.run nilCandidateContext.env nilCandidateContext.safety
+      nilCandidateContext.lctx nilCandidateContext.lparams
+      nilCandidateContext.fuel
+      (TypeChecker.checkType (.sort (.succ (.param `u)))) =
+        .ok (.sort (.succ (.succ (.param `u)))) := by
+  obtain ⟨finalState, hroot⟩ :=
+    show ∃ finalState,
+      TypeChecker.Inner.inferType (.sort (.succ (.param `u))) false
+        (TypeChecker.Methods.withFuel 10000)
+        (tcContext ({} : LocalContext)) ({} : TypeChecker.State) =
+          .ok (.sort (.succ (.succ (.param `u))), finalState) by
+      refine ⟨nilRootSortState, ?_⟩
+      change TypeChecker.Inner.inferType'
+        (.sort (.succ (.param `u))) false
+        (TypeChecker.Methods.withFuel 9999)
+        (tcContext ({} : LocalContext)) ({} : TypeChecker.State) = _
+      exact nilStandaloneSortCore
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType (.sort (.succ (.param `u))) false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext ({} : LocalContext)) ({} : TypeChecker.State)) = _
+  rw [hroot]
+  rfl
+
+theorem nilDomainWhnfM :
+    TypeChecker.M.run nilCandidateContext.env nilCandidateContext.safety
+      nilCandidateContext.lctx nilCandidateContext.lparams
+      nilCandidateContext.fuel
+      (TypeChecker.whnf (.sort (.succ (.param `u)))) =
+        .ok (.sort (.succ (.param `u))) := by
+  rfl
+
+def nilCandidateAlphaId : FVarId :=
+  nilCandidateContext.freshFVarId
+
+def nilCandidateAlphaLctx : LocalContext :=
+  ({} : LocalContext).mkLocalDecl nilCandidateAlphaId `α
+    (.sort (.succ (.param `u))) .implicit
+
+theorem nilCandidateFresh :
+    ({} : LocalContext).find? nilCandidateAlphaId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := nilCandidateAlphaId) LocalContext.WF.nil
+  change
+    ({ fvarIdToDecl := PersistentHashMap.empty,
+       decls := PersistentArray.empty,
+       auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+      nilCandidateAlphaId = none
+  rw [h]
+  simp [LocalContext.toList]
+
+theorem nilCandidateAlphaFind :
+    nilCandidateAlphaLctx.find? nilCandidateAlphaId =
+      some (.cdecl 0 nilCandidateAlphaId `α
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  have hwf : nilCandidateAlphaLctx.WF := by
+    change (({} : LocalContext).mkLocalDecl nilCandidateAlphaId `α
+      (.sort (.succ (.param `u))) .implicit).WF
+    exact LocalContext.WF.mkLocalDecl LocalContext.WF.nil
+      nilCandidateFresh
+  rw [hwf.find?_eq_find?_toList]
+  simp only [nilCandidateAlphaLctx]
+  rw [LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  rw [show ({} : LocalContext).decls.size = 0 by rfl]
+  change
+    (if nilCandidateAlphaId == nilCandidateAlphaId then
+      some (LocalDecl.cdecl 0 nilCandidateAlphaId `α
+        (.sort (.succ (.param `u))) .implicit .default)
+    else none) = _
+  rw [beq_self_eq_true]
+  rfl
+
+def nilCandidateFirstApp : Expr :=
+  .app (.const ``IndexedVec [.param `u]) (.fvar nilCandidateAlphaId)
+
+def nilCandidateBodyExpr : Expr :=
+  .app nilCandidateFirstApp (.const ``Nat.zero [])
+
+theorem nilCandidateBodyShape :
+    nilCandidateBody = nilCandidateBodyExpr := by
+  simp [nilCandidateBody, nilCtorBodyRaw, nilCandidateBodyExpr,
+    nilCandidateFirstApp, nilCandidateAlphaId,
+    AddInductive.Context.freshExpr,
+    Expr.instantiate1_eq, Expr.instantiate1']
+
+def nilCandidateFamilyState : TypeChecker.State :=
+  { ({} : TypeChecker.State) with inferTypeC :=
+      (({} : TypeChecker.State).inferTypeC.insert
+        (.const ``IndexedVec [.param `u]) indexedVecInfo.type) }
+
+def nilCandidateAlphaState : TypeChecker.State :=
+  { nilCandidateFamilyState with inferTypeC :=
+      (nilCandidateFamilyState.inferTypeC.insert
+        (.fvar nilCandidateAlphaId) (.sort (.succ (.param `u)))) }
+
+def nilCandidateFirstAppState : TypeChecker.State :=
+  { nilCandidateAlphaState with inferTypeC :=
+      (nilCandidateAlphaState.inferTypeC.insert
+        nilCandidateFirstApp vecFamilyTail) }
+
+def nilCandidateZeroState : TypeChecker.State :=
+  { nilCandidateFirstAppState with inferTypeC :=
+      (nilCandidateFirstAppState.inferTypeC.insert
+        (.const ``Nat.zero []) (.const ``Nat [])) }
+
+theorem inferNilCandidateFamily :
+    TypeChecker.Inner.inferType'
+      (.const ``IndexedVec [.param `u]) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) =
+        .ok (indexedVecInfo.type, nilCandidateFamilyState) := by
+  simpa [nilCandidateFamilyState] using
+    (inferTypeFamilyCore 9999 nilCandidateAlphaLctx
+      ({} : TypeChecker.State) (by simp))
+
+theorem inferNilCandidateAlpha :
+    TypeChecker.Inner.inferType' (.fvar nilCandidateAlphaId) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) nilCandidateFamilyState =
+        .ok (.sort (.succ (.param `u)), nilCandidateAlphaState) := by
+  simpa [nilCandidateAlphaState] using
+    (inferTypeFVarCore 9999 nilCandidateAlphaLctx
+      nilCandidateFamilyState nilCandidateAlphaId
+      (.sort (.succ (.param `u)))
+      (by simp [nilCandidateFamilyState]) nilCandidateAlphaFind)
+
+theorem inferNilCandidateFirstApp :
+    TypeChecker.Inner.inferType' nilCandidateFirstApp false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) =
+        .ok (vecFamilyTail, nilCandidateFirstAppState) := by
+  have h := inferAppCoreOf 9999 (tcContext nilCandidateAlphaLctx)
+    ({} : TypeChecker.State) nilCandidateFamilyState
+    nilCandidateAlphaState (.const ``IndexedVec [.param `u])
+    (.fvar nilCandidateAlphaId) (.sort (.succ (.param `u)))
+    vecFamilyTail `α .default
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    (by simp) inferNilCandidateFamily
+    (by simpa [indexedVecInfoTypeShape] using inferNilCandidateAlpha)
+    (by rfl)
+  simpa [nilCandidateFirstApp, nilCandidateFirstAppState,
+    indexedVecInfoTypeShape, vecFamilyTail,
+    Expr.instantiate1'] using h
+
+theorem inferNilCandidateZero :
+    TypeChecker.Inner.inferType' (.const ``Nat.zero []) false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) nilCandidateFirstAppState =
+        .ok (.const ``Nat [], nilCandidateZeroState) := by
+  simpa [nilCandidateZeroState] using
+    (inferTypeZeroCore 9999 nilCandidateAlphaLctx
+      nilCandidateFirstAppState (by
+        simp [nilCandidateFirstAppState, nilCandidateAlphaState, nilCandidateFamilyState,
+          nilCandidateFirstApp]))
+
+theorem inferNilCandidateBodyExists : ∃ finalState,
+    TypeChecker.Inner.inferType nilCandidateBody false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)), finalState) := by
+  refine ⟨{ nilCandidateZeroState with inferTypeC :=
+    (nilCandidateZeroState.inferTypeC.insert nilCandidateBodyExpr
+      (.sort (.succ (.param `u)))) }, ?_⟩
+  change TypeChecker.Inner.inferType' nilCandidateBody false
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) = _
+  rw [nilCandidateBodyShape]
+  have h := inferAppCoreOf 9999 (tcContext nilCandidateAlphaLctx)
+    ({} : TypeChecker.State) nilCandidateFirstAppState
+    nilCandidateZeroState nilCandidateFirstApp (.const ``Nat.zero [])
+    (.const ``Nat []) (.sort (.succ (.param `u))) vecIndexName .default
+    (by simp [nilCandidateFirstApp, Expr.hasLooseBVars, Expr.looseBVarRange'])
+    (by simp) inferNilCandidateFirstApp
+    inferNilCandidateZero (by rfl)
+  simpa [nilCandidateBodyExpr, nilCandidateFirstApp,
+    Expr.instantiate1_eq, Expr.instantiate1'] using h
+
+theorem nilCandidateBodyCheckTypeM :
+    TypeChecker.M.run nilCandidateBodyContext.env
+      nilCandidateBodyContext.safety nilCandidateBodyContext.lctx
+      nilCandidateBodyContext.lparams nilCandidateBodyContext.fuel
+      (TypeChecker.checkType nilCandidateBody) =
+        .ok (.sort (.succ (.param `u))) := by
+  obtain ⟨finalState, hbody⟩ := inferNilCandidateBodyExists
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType nilCandidateBody false
+      (TypeChecker.Methods.withFuel 10000)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State)) = _
+  rw [hbody]
+  rfl
+
+theorem nilCandidateBodyGetAppFn :
+    nilCandidateBody.getAppFn =
+      .const ``IndexedVec [.param `u] := by
+  rw [nilCandidateBodyShape]
+  rfl
+
+theorem nilRecMBind
+    {α β} (x : TypeChecker.RecM α)
+    (f : α → TypeChecker.RecM β) (methods context state) :
+    (x >>= f) methods context state =
+      match x methods context state with
+      | .error e => .error e
+      | .ok (a, state') => f a methods context state' := by
+  simp [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  cases h : x methods context state with
+  | error => rfl
+  | ok value => cases value; rfl
+
+@[simp] theorem nilRecMGetEnv (methods context state) :
+    (liftM TypeChecker.getEnv :
+      TypeChecker.RecM Kernel.Environment) methods context state =
+        .ok (context.env, state) := rfl
+
+@[simp] theorem nilRecMGet (methods context state) :
+    (get : TypeChecker.RecM TypeChecker.State)
+      methods context state = .ok (state, state) := rfl
+
+@[simp] theorem nilRecMPure
+    {α} (a : α) (methods context state) :
+    (pure a : TypeChecker.RecM α) methods context state =
+      .ok (a, state) := rfl
+
+theorem nilCandidateInductiveReduceRec
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    inductiveReduceRec ctorEnv nilCandidateBody
+        (fun e => TypeChecker.Inner.whnf e)
+        (fun e => TypeChecker.Inner.inferType e)
+        TypeChecker.Inner.isDefEq
+        TypeChecker.Inner.isNeverProp
+        methods (tcContext nilCandidateAlphaLctx) state =
+      .ok (none, state) := by
+  unfold inductiveReduceRec
+  rw [nilCandidateBodyGetAppFn]
+  simp only
+  rw [type_lookup_family]
+  rfl
+
+theorem nilCandidateReduceRecursor
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.reduceRecursor nilCandidateBody
+      methods (tcContext nilCandidateAlphaLctx) state =
+        .ok (none, state) := by
+  unfold TypeChecker.Inner.reduceRecursor
+  have hquot : ctorEnv.quotInit = false := by rfl
+  simp only [nilRecMBind, nilRecMGetEnv]
+  rw [show (tcContext nilCandidateAlphaLctx).env = ctorEnv by rfl]
+  rw [hquot]
+  simp only [Bool.false_eq_true, if_false, nilRecMBind]
+  rw [nilCandidateInductiveReduceRec methods state]
+  rfl
+
+@[simp] theorem nilCandidateWhnfCoreFamily (n state) :
+    TypeChecker.Inner.whnfCore
+      (.const ``IndexedVec [.param `u]) false
+      (TypeChecker.Methods.withFuel (n + 1))
+      (tcContext nilCandidateAlphaLctx) state =
+        .ok (.const ``IndexedVec [.param `u], state) := by
+  rfl
+
+theorem nilCandidateWhnfCoreInitial (n : Nat) :
+    TypeChecker.Inner.whnfCore' nilCandidateBody false
+      (TypeChecker.Methods.withFuel (n + 1))
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) =
+        .ok (nilCandidateBody, ({} : TypeChecker.State)) := by
+  rw [nilCandidateBodyShape]
+  change TypeChecker.Inner.whnfCore'
+    (.app (.app (.const ``IndexedVec [.param `u])
+      (.fvar nilCandidateAlphaId)) (.const ``Nat.zero []))
+    false (TypeChecker.Methods.withFuel (n + 1))
+    (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) = _
+  unfold TypeChecker.Inner.whnfCore'
+  simp only [nilRecMBind, nilRecMGet, Std.HashMap.getElem?_empty]
+  rw [Expr.withRevApp_eq]
+  simp only [nilRecMBind]
+  rw [show
+    (Expr.app
+      (Expr.app (Expr.const ``IndexedVec [.param `u])
+        (Expr.fvar nilCandidateAlphaId))
+      (Expr.const ``Nat.zero [])).getAppFn =
+        (Expr.const ``IndexedVec [.param `u]) by rfl]
+  rw [nilCandidateWhnfCoreFamily n ({} : TypeChecker.State)]
+  simp [nilCandidateBodyExpr, nilCandidateFirstApp, Expr.structuralEq, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rw [show
+    .app (.app (.const ``IndexedVec [.param `u])
+      (.fvar nilCandidateAlphaId)) (.const ``Nat.zero []) =
+        nilCandidateBody by
+    symm; exact nilCandidateBodyShape]
+  rw [nilCandidateReduceRecursor]
+  rfl
+
+@[simp] theorem nilCandidateReduceNative
+    (env : Kernel.Environment) (methods : TypeChecker.Methods)
+    (state : TypeChecker.State) :
+    (liftM (TypeChecker.Inner.reduceNative env nilCandidateBody) :
+      TypeChecker.RecM (Option Expr))
+        methods (tcContext nilCandidateAlphaLctx) state =
+      .ok (none, state) := by
+  rw [nilCandidateBodyShape]
+  simp [TypeChecker.Inner.reduceNative, nilCandidateBodyExpr,
+    nilCandidateFirstApp, Expr.structuralEq]
+
+@[simp] theorem nilCandidateReduceNat
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.reduceNat nilCandidateBody
+        methods (tcContext nilCandidateAlphaLctx) state =
+      .ok (none, state) := by
+  rw [nilCandidateBodyShape]
+  simp [TypeChecker.Inner.reduceNat, nilCandidateBodyExpr, nilCandidateFirstApp,
+    Expr.getAppNumArgs_eq, Expr.getAppArgsRevList]
+
+theorem nilCandidateIsDeltaFamily :
+    TypeChecker.Inner.isDelta ctorEnv
+      (.const ``IndexedVec [.param `u]) = none := by
+  unfold TypeChecker.Inner.isDelta
+  rw [show
+    (Expr.const ``IndexedVec [.param `u]).getAppFn =
+      Expr.const ``IndexedVec [.param `u] by rfl]
+  simp only
+  rw [type_lookup_family]
+  simp [indexedVecInfo, ConstantInfo.deltaValue?]
+
+theorem nilCandidateUnfoldFamily
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.unfoldDefinitionCore
+      (.const ``IndexedVec [.param `u])
+      methods (tcContext nilCandidateAlphaLctx) state =
+        .ok (none, state) := by
+  unfold TypeChecker.Inner.unfoldDefinitionCore
+  simp only [nilRecMBind, nilRecMGetEnv]
+  rw [show (tcContext nilCandidateAlphaLctx).env = ctorEnv by rfl]
+  rw [nilCandidateIsDeltaFamily]
+  rfl
+
+theorem nilCandidateUnfoldBody
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.unfoldDefinition nilCandidateBody
+      methods (tcContext nilCandidateAlphaLctx) state =
+        .ok (none, state) := by
+  unfold TypeChecker.Inner.unfoldDefinition
+  rw [show nilCandidateBody.isApp = true by
+    rw [nilCandidateBodyShape]
+    rfl]
+  simp only [if_true]
+  rw [nilCandidateBodyGetAppFn]
+  simp only [nilRecMBind]
+  rw [nilCandidateUnfoldFamily]
+  rfl
+
+theorem nilCandidateWhnfLoop :
+    TypeChecker.Inner.whnf'.loop nilCandidateBody 100000
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) =
+        .ok (nilCandidateBody, ({} : TypeChecker.State)) := by
+  rw [show 100000 = 99999 + 1 by rfl]
+  unfold TypeChecker.Inner.whnf'.loop
+  rw [show 9999 = 9998 + 1 by rfl]
+  simp only [nilRecMBind, nilRecMGetEnv]
+  rw [nilCandidateWhnfCoreInitial 9998]
+  simp only []
+  rw [nilCandidateReduceNative]
+  simp only [nilRecMBind]
+  rw [nilCandidateReduceNat]
+  simp only [nilRecMBind]
+  rw [nilCandidateUnfoldBody]
+  rfl
+
+theorem nilCandidateBodyWhnfM :
+    TypeChecker.M.run nilCandidateBodyContext.env
+      nilCandidateBodyContext.safety nilCandidateBodyContext.lctx
+      nilCandidateBodyContext.lparams nilCandidateBodyContext.fuel
+      (TypeChecker.whnf nilCandidateBody) = .ok nilCandidateBody := by
+  rw [nilCandidateBodyShape]
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.whnf'
+      (.app (.app (.const ``IndexedVec [.param `u])
+        (.fvar nilCandidateAlphaId)) (.const ``Nat.zero []))
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State)) =
+        .ok (.app (.app (.const ``IndexedVec [.param `u])
+          (.fvar nilCandidateAlphaId)) (.const ``Nat.zero []))
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show
+    (if (tcContext nilCandidateAlphaLctx).eagerReduce then
+      (tcContext nilCandidateAlphaLctx).fuel.whnfEager
+    else (tcContext nilCandidateAlphaLctx).fuel.whnf) = 100000 by rfl]
+  rw [show
+    TypeChecker.Inner.whnf'.loop
+      (.app (.app (.const ``IndexedVec [.param `u])
+        (.fvar nilCandidateAlphaId)) (.const ``Nat.zero [])) 100000
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext nilCandidateAlphaLctx) ({} : TypeChecker.State) =
+        .ok (.app (.app (.const ``IndexedVec [.param `u])
+          (.fvar nilCandidateAlphaId)) (.const ``Nat.zero []),
+          ({} : TypeChecker.State)) by
+    simpa [nilCandidateBodyShape, nilCandidateBodyExpr,
+      nilCandidateFirstApp] using nilCandidateWhnfLoop]
+  simp [Functor.map, StateT.map, Except.map]
+
+def nilDomainAnnotations :
+    AddInductive.CandidateTypeAnnotations
+      (.sort (.succ (.param `u))) where
+  consumed := .sort (.succ (.param `u))
+  trace := .identity _
+
+theorem nilDomainAnnotationTraceBuild :
+    AddInductive.CandidateTypeAnnotationTrace.build
+      (.sort (.succ (.param `u))) =
+        ⟨.sort (.succ (.param `u)), .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build]
+
+theorem nilDomainAnnotationsBuild :
+    AddInductive.buildCandidateTypeAnnotations
+      (.sort (.succ (.param `u))) = .ok nilDomainAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [nilDomainAnnotationTraceBuild]
+  rfl
+
+theorem nilDomainAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨nilCandidateContext, (.sort (.succ (.param `u))),
+        nilDomainAnnotations.consumed⟩ := by
+  simpa [nilDomainAnnotations] using
+    (candidateIsDefEqSelfValid nilCandidateContext
+      (.sort (.succ (.param `u))) 9999 rfl)
+
+theorem nilCandidateContextFresh :
+    nilCandidateContext.lctx.find?
+      nilCandidateContext.freshFVarId = none := by
+  change ({} : LocalContext).find? nilCandidateAlphaId = none
+  exact nilCandidateFresh
+
+theorem nilRootCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨nilCandidateContext, indexedVecNilInfo.type,
+        .sort nilCtorInferredLevel⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid,
+    nilCandidateContext, ctorContext] using nilRootCheckTypeM
+
+theorem nilRootWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨nilCandidateContext, indexedVecNilInfo.type,
+        indexedVecNilInfo.type⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid,
+    nilCandidateContext, ctorContext] using nilRootWhnfM
+
+theorem nilDomainCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨nilCandidateContext, (.sort (.succ (.param `u))),
+        .sort (.succ (.succ (.param `u)))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid] using
+    nilDomainCheckTypeM
+
+theorem nilDomainWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨nilCandidateContext, (.sort (.succ (.param `u))),
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid] using nilDomainWhnfM
+
+theorem nilBodyCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨nilCandidateBodyContext, nilCandidateBody,
+        .sort (.succ (.param `u))⟩ := by
+  simpa [AddInductive.CandidateCheckTypeStep.Valid] using
+    nilCandidateBodyCheckTypeM
+
+theorem nilBodyWhnfValid :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨nilCandidateBodyContext, nilCandidateBody,
+        nilCandidateBody⟩ := by
+  simpa [AddInductive.CandidateWhnfStep.Valid] using
+    nilCandidateBodyWhnfM
+
+def nilDomainCandidateTrace :
+    AddInductive.CandidateExprTrace nilCandidateContext
+      (.sort (.succ (.param `u))) :=
+  .terminal nilCandidateContext (.sort (.succ (.param `u)))
+    (.sort (.succ (.succ (.param `u))))
+    (.sort (.succ (.param `u)))
+    nilDomainCheckValid nilDomainWhnfValid
+
+def nilBodyCandidateTrace :
+    AddInductive.CandidateExprTrace nilCandidateBodyContext
+      (nilCtorBodyRaw.instantiate1 nilCandidateContext.freshExpr) :=
+  .terminal nilCandidateBodyContext
+    (nilCtorBodyRaw.instantiate1 nilCandidateContext.freshExpr)
+    (.sort (.succ (.param `u))) nilCandidateBody
+    (by simpa [nilCandidateBody] using nilBodyCheckValid)
+    (by simpa [nilCandidateBody] using nilBodyWhnfValid)
+
+def nilCandidateTrace :
+    AddInductive.CandidateExprTrace nilCandidateContext
+      indexedVecNilInfo.type :=
+  .forallE nilCandidateContext indexedVecNilInfo.type
+    (.sort nilCtorInferredLevel) `α
+    (.sort (.succ (.param `u))) nilCtorBodyRaw .implicit
+    nilCandidateContextFresh nilDomainAnnotations
+    nilDomainAnnotationsEq nilRootCheckValid
+    (by simpa [nilInfoTypeShape, nilCtorTypeRaw] using nilRootWhnfValid)
+    nilDomainCandidateTrace nilBodyCandidateTrace
+
+def nilCandidate : AddInductive.CandidateExpr indexedVecNilInfo.type :=
+  ⟨nilCandidateContext, nilCandidateTrace⟩
+
+theorem nilCandidate_view_eq :
+    nilCandidate.view = indexedVecNilInfo.type := by
+  have habstract (context : AddInductive.Context) (e : Expr) :
+      e.abstract #[context.freshExpr] =
+        Expr.abstract1 context.freshFVarId e := by
+    rw [show #[context.freshExpr] =
+      ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl]
+    simp only [Expr.abstract_eq, Expr.abstractList]
+  simp only [nilCandidate, AddInductive.CandidateExpr.view,
+    nilCandidateTrace, nilDomainCandidateTrace, nilBodyCandidateTrace,
+    AddInductive.CandidateExprTrace.view]
+  rw [habstract]
+  rw [nilInfoTypeShape]
+  simp [nilCandidateBody, nilCtorTypeRaw, nilCtorBodyRaw,
+    Expr.instantiate1_eq, Expr.instantiate1', Expr.abstract1,
+    nilCandidateContext, ctorContext,
+    AddInductive.Context.freshExpr,
+    AddInductive.Context.freshFVarId,
+    NameGenerator.curr]
+
+/-- The retained `nil` candidate is identity-normalizing at its root, domain,
+and instantiated result. -/
+theorem nilCandidate_identity :
+    TypeChecker.CandidateExprIdentity nilCandidate.trace := by
+  change TypeChecker.CandidateExprIdentity nilCandidateTrace
+  unfold nilCandidateTrace
+  refine .forallE (name := `α) (binderInfo := .implicit)
+    (body := nilCtorBodyRaw) (annotations := nilDomainAnnotations)
+    nilDomainCandidateTrace nilBodyCandidateTrace
+    (by simpa [nilCtorTypeRaw] using nilInfoTypeShape)
+    rfl (.terminal rfl) (.terminal (by rfl))
+
+theorem nilDomainCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop nilCandidateContext
+      (.sort (.succ (.param `u))) (fuel + 1) =
+        .ok nilDomainCandidateTrace := by
+  simpa only [nilDomainCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      nilCandidateContext (.sort (.succ (.param `u)))
+      (.sort (.succ (.succ (.param `u))))
+      (.sort (.succ (.param `u))) fuel
+      nilDomainCheckValid nilDomainWhnfValid rfl
+
+theorem nilBodyCandidateTraceLoop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop nilCandidateBodyContext
+      (nilCtorBodyRaw.instantiate1 nilCandidateContext.freshExpr)
+      (fuel + 1) = .ok nilBodyCandidateTrace := by
+  simpa only [nilBodyCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      nilCandidateBodyContext
+      (nilCtorBodyRaw.instantiate1 nilCandidateContext.freshExpr)
+      (.sort (.succ (.param `u))) nilCandidateBody fuel
+      (by simpa [nilCandidateBody] using nilBodyCheckValid)
+      (by simpa [nilCandidateBody] using nilBodyWhnfValid)
+      (by rw [nilCandidateBodyShape]; rfl)
+
+theorem nilCandidateTraceLoop :
+    AddInductive.buildCandidateExpr.loop nilCandidateContext
+      indexedVecNilInfo.type nilCandidateContext.fuel.inductiveFuel =
+        .ok nilCandidateTrace := by
+  change AddInductive.buildCandidateExpr.loop nilCandidateContext
+    indexedVecNilInfo.type (999 + 1) = _
+  simpa only [nilCandidateTrace, nilCandidateBodyContext] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := nilCandidateContext)
+      (e := indexedVecNilInfo.type)
+      (inferred := .sort nilCtorInferredLevel)
+      (fuel := 999) (name := `α)
+      (domain := .sort (.succ (.param `u)))
+      (body := nilCtorBodyRaw) (binderInfo := .implicit)
+      (hfresh := nilCandidateContextFresh)
+      (annotations := nilDomainAnnotations)
+      (hannotations := nilDomainAnnotationsBuild)
+      (hannotationsEq := nilDomainAnnotationsEq)
+      (hcheck := nilRootCheckValid)
+      (hrun := by
+        simpa [nilInfoTypeShape, nilCtorTypeRaw] using nilRootWhnfValid)
+      (domainCandidate := nilDomainCandidateTrace)
+      (bodyCandidate := nilBodyCandidateTrace)
+      (hdomain := by
+        simpa using nilDomainCandidateTraceLoop 998)
+      (hbody := by
+        simpa [nilCandidateBodyContext, nilDomainAnnotations] using
+          nilBodyCandidateTraceLoop 998))
+
+theorem nilCandidateProduced :
+    AddInductive.buildCandidateExpr indexedVecNilInfo.type
+      nilCandidateContext = .ok nilCandidate := by
+  unfold AddInductive.buildCandidateExpr
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  rw [nilCandidateTraceLoop]
+  rfl
+
+/-! ## `IndexedVec.cons` source and candidate contexts -/
+
+def consAlphaName : Name :=
+  indexedVecConsInfo.type.bindingName!
+
+def consNName : Name :=
+  indexedVecConsInfo.type.bindingBody!.bindingName!
+
+def consHeadName : Name :=
+  indexedVecConsInfo.type.bindingBody!.bindingBody!.bindingName!
+
+def consTailName : Name :=
+  indexedVecConsInfo.type.bindingBody!.bindingBody!.bindingBody!.bindingName!
+
+def consTerminalRaw : Expr :=
+  .app (.app (.const ``IndexedVec [.param `u]) (.bvar 3))
+    (.app (.const ``Nat.succ []) (.bvar 2))
+
+def consTailTypeRaw : Expr :=
+  .forallE consTailName
+    (.app (.app (.const ``IndexedVec [.param `u]) (.bvar 2)) (.bvar 1))
+    consTerminalRaw .default
+
+def consHeadTypeRaw : Expr :=
+  .forallE consHeadName (.bvar 1) consTailTypeRaw .default
+
+def consNTypeRaw : Expr :=
+  .forallE consNName (.const ``Nat []) consHeadTypeRaw .implicit
+
+def consCtorTypeRaw : Expr :=
+  .forallE consAlphaName (.sort (.succ (.param `u)))
+    consNTypeRaw .implicit
+
+theorem consInfoTypeShape :
+    indexedVecConsInfo.type = consCtorTypeRaw := by
+  rfl
+
+def consRootContext : AddInductive.Context := ctorContext
+
+def consAlphaId : FVarId := consRootContext.freshFVarId
+
+def consAlphaExpr : Expr := consRootContext.freshExpr
+
+def consAlphaContext : AddInductive.Context :=
+  consRootContext.pushLocalDecl consAlphaName .implicit
+    (.sort (.succ (.param `u)))
+
+def consNId : FVarId := consAlphaContext.freshFVarId
+
+def consNExpr : Expr := consAlphaContext.freshExpr
+
+def consNContext : AddInductive.Context :=
+  consAlphaContext.pushLocalDecl consNName .implicit (.const ``Nat [])
+
+def consHeadId : FVarId := consNContext.freshFVarId
+
+def consHeadExpr : Expr := consNContext.freshExpr
+
+def consAfterAlpha : Expr :=
+  .forallE consNName (.const ``Nat [])
+    (.forallE consHeadName consAlphaExpr
+      (.forallE consTailName
+        (.app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr)
+          (.bvar 1))
+        (.app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr)
+          (.app (.const ``Nat.succ []) (.bvar 2)))
+        .default)
+      .default)
+    .implicit
+
+def consAfterN : Expr :=
+  .forallE consHeadName consAlphaExpr
+    (.forallE consTailName
+      (.app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr)
+        consNExpr)
+      (.app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr)
+        (.app (.const ``Nat.succ []) consNExpr))
+      .default)
+    .default
+
+def consHeadContext : AddInductive.Context :=
+  consNContext.pushLocalDecl consHeadName .default consAlphaExpr
+
+def consTailId : FVarId := consHeadContext.freshFVarId
+
+def consTailExpr : Expr := consHeadContext.freshExpr
+
+def consTailDomain : Expr :=
+  .app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr) consNExpr
+
+def consAfterHead : Expr :=
+  .forallE consTailName consTailDomain
+    (.app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr)
+      (.app (.const ``Nat.succ []) consNExpr))
+    .default
+
+def consTailContext : AddInductive.Context :=
+  consHeadContext.pushLocalDecl consTailName .default consTailDomain
+
+def consTerminal : Expr :=
+  .app (.app (.const ``IndexedVec [.param `u]) consAlphaExpr)
+    (.app (.const ``Nat.succ []) consNExpr)
+
+@[simp] theorem consLiftLooseBVarsFVar
+    (id : FVarId) (s d : Nat) :
+    (Expr.fvar id).liftLooseBVars' s d = .fvar id := by
+  rfl
+
+@[simp] theorem consInstantiateFVar
+    (id : FVarId) (a : Expr) (k : Nat) :
+    (Expr.fvar id).instantiate1' a k = .fvar id := by
+  rfl
+
+theorem consAfterAlphaShape :
+    consNTypeRaw.instantiate1 consRootContext.freshExpr =
+      consAfterAlpha := by
+  simp [consNTypeRaw, consHeadTypeRaw, consTailTypeRaw, consTerminalRaw, consAfterAlpha,
+    consAlphaExpr, consRootContext, ctorContext, AddInductive.Context.freshExpr,
+    Expr.instantiate1_eq, Expr.instantiate1']
+
+theorem consAfterNShape :
+    consAfterAlpha.bindingBody!.instantiate1
+      consAlphaContext.freshExpr = consAfterN := by
+  simp [consAfterAlpha, consAfterN, consAlphaExpr, consNExpr, consRootContext, consAlphaContext,
+    ctorContext, AddInductive.Context.pushLocalDecl, AddInductive.Context.freshExpr,
+    Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1']
+
+theorem consAfterHeadShape :
+    consAfterN.bindingBody!.instantiate1
+      consNContext.freshExpr = consAfterHead := by
+  simp [consAfterN, consAfterHead, consTailDomain, consAlphaExpr, consNExpr, consRootContext,
+    consAlphaContext, consNContext, ctorContext, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshExpr, Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1']
+
+theorem consTerminalShape :
+    consAfterHead.bindingBody!.instantiate1
+      consHeadContext.freshExpr = consTerminal := by
+  simp [consAfterHead, consTerminal, consAlphaExpr, consNExpr, consRootContext, consAlphaContext,
+    consNContext, consHeadContext, ctorContext, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshExpr, Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1']
+
+@[simp] theorem consAlphaExprShape :
+    consAlphaExpr = .fvar consAlphaId := by
+  rfl
+
+@[simp] theorem consNExprShape :
+    consNExpr = .fvar consNId := by
+  rfl
+
+@[simp] theorem consHeadExprShape :
+    consHeadExpr = .fvar consHeadId := by
+  rfl
+
+@[simp] theorem consTailExprShape :
+    consTailExpr = .fvar consTailId := by
+  rfl
+
+theorem consRootFresh :
+    consRootContext.lctx.find? consRootContext.freshFVarId = none := by
+  simpa [consRootContext, nilCandidateContext] using nilCandidateContextFresh
+
+theorem consAlphaContextWF : consAlphaContext.lctx.WF := by
+  change (({} : LocalContext).mkLocalDecl
+    consRootContext.freshFVarId consAlphaName
+    (.sort (.succ (.param `u))) .implicit).WF
+  exact LocalContext.WF.mkLocalDecl LocalContext.WF.nil (by
+    have h := LocalContext.WF.find?_eq_find?_toList
+      (fv := consRootContext.freshFVarId) LocalContext.WF.nil
+    change
+      ({ fvarIdToDecl := PersistentHashMap.empty,
+         decls := PersistentArray.empty,
+         auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+        consRootContext.freshFVarId = none
+    rw [h]
+    simp [LocalContext.toList])
+
+theorem consAlphaContextFresh :
+    consAlphaContext.lctx.find? consAlphaContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consAlphaContext.freshFVarId) consAlphaContextWF
+  rw [h]
+  simp only [consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  intro heq
+  injection heq with hname
+  injection hname with hidx
+  omega
+
+theorem consNContextWF : consNContext.lctx.WF := by
+  simpa [consNContext, AddInductive.Context.pushLocalDecl] using
+    (LocalContext.WF.mkLocalDecl consAlphaContextWF consAlphaContextFresh)
+
+theorem consNContextFresh :
+    consNContext.lctx.find? consNContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consNContext.freshFVarId) consNContextWF
+  rw [h]
+  simp only [consNContext, consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList, LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  constructor <;> intro heq
+  · injection heq with hname
+    injection hname with hidx
+    omega
+  · injection heq with hname
+    injection hname with hidx
+    omega
+
+theorem consHeadContextWF : consHeadContext.lctx.WF := by
+  simpa [consHeadContext, AddInductive.Context.pushLocalDecl] using
+    (LocalContext.WF.mkLocalDecl consNContextWF consNContextFresh)
+
+theorem consHeadContextFresh :
+    consHeadContext.lctx.find? consHeadContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := consHeadContext.freshFVarId) consHeadContextWF
+  rw [h]
+  simp only [consHeadContext, consNContext, consAlphaContext,
+    consRootContext, ctorContext, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList, LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  constructor
+  · intro heq
+    injection heq with hname
+    injection hname with hidx
+    omega
+  · constructor <;> intro heq
+    · injection heq with hname
+      injection hname with hidx
+      omega
+    · injection heq with hname
+      injection hname with hidx
+      omega
+
+theorem consTailContextWF : consTailContext.lctx.WF := by
+  simpa [consTailContext, AddInductive.Context.pushLocalDecl] using
+    (LocalContext.WF.mkLocalDecl consHeadContextWF consHeadContextFresh)
+
+theorem consAlphaFindInHead :
+    consHeadContext.lctx.find? consAlphaId =
+      some (.cdecl 0 consAlphaId consAlphaName
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  rw [consHeadContextWF.find?_eq_find?_toList]
+  simp [consHeadContext, consNContext, consAlphaContext, consRootContext, ctorContext, consAlphaId,
+    AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl,
+    LocalContext.toList, LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+
+theorem consAlphaFindInN :
+    consNContext.lctx.find? consAlphaId =
+      some (.cdecl 0 consAlphaId consAlphaName
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  rw [consNContextWF.find?_eq_find?_toList]
+  simp [consNContext, consAlphaContext, consRootContext, ctorContext, consAlphaId,
+    AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl,
+    LocalContext.toList, LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+
+theorem consNFindInHead :
+    consHeadContext.lctx.find? consNId =
+      some (.cdecl 1 consNId consNName (.const ``Nat [])
+        .implicit .default) := by
+  rw [consHeadContextWF.find?_eq_find?_toList]
+  simp [consHeadContext, consNContext, consAlphaContext, consRootContext, ctorContext, consAlphaId,
+    consNId, AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId,
+    LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId, NameGenerator.next,
+    NameGenerator.curr]
+
+theorem consAlphaFindInTail :
+    consTailContext.lctx.find? consAlphaId =
+      some (.cdecl 0 consAlphaId consAlphaName
+        (.sort (.succ (.param `u))) .implicit .default) := by
+  rw [consTailContextWF.find?_eq_find?_toList]
+  simp [consTailContext, consHeadContext, consNContext, consAlphaContext, consRootContext,
+    ctorContext, consAlphaId, AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId,
+    LocalContext.mkLocalDecl, LocalContext.toList, LocalDecl.fvarId, NameGenerator.next,
+    NameGenerator.curr]
+
+theorem consNFindInTail :
+    consTailContext.lctx.find? consNId =
+      some (.cdecl 1 consNId consNName (.const ``Nat [])
+        .implicit .default) := by
+  rw [consTailContextWF.find?_eq_find?_toList]
+  simp [consTailContext, consHeadContext, consNContext, consAlphaContext, consRootContext,
+    ctorContext, consAlphaId, consNId, AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId, LocalContext.mkLocalDecl, LocalContext.toList,
+    LocalDecl.fvarId, NameGenerator.next, NameGenerator.curr]
+
+/-! ## Reusable post-family atom observations -/
+
+theorem ctorNatCheckTypeM (lctx : LocalContext) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.checkType (.const ``Nat [])) =
+        .ok (.sort (.succ .zero)) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel 10000) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' (.const ``Nat []) false
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [inferTypeNatCore 9999 lctx ({} : TypeChecker.State)
+    (by simp)]
+  rfl
+
+theorem ctorUnfoldNat (lctx methods state) :
+    TypeChecker.Inner.unfoldDefinition (.const ``Nat [])
+      methods (tcContext lctx) state = .ok (none, state) := by
+  change TypeChecker.Inner.unfoldDefinitionCore (.const ``Nat [])
+    methods (tcContext lctx) state = _
+  simp [TypeChecker.Inner.unfoldDefinitionCore,
+    TypeChecker.Inner.isDelta, Expr.getAppFn, tcContext,
+    type_lookup_nat, natInfo, ConstantInfo.deltaValue?,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem ctorWhnfLoopNat (lctx methods state n) :
+    TypeChecker.Inner.whnf'.loop (.const ``Nat []) (n + 1)
+      methods (tcContext lctx) state =
+        .ok (.const ``Nat [], state) := by
+  unfold TypeChecker.Inner.whnf'.loop
+  simp [ctorUnfoldNat]
+
+theorem ctorNatWhnfM (lctx : LocalContext) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.whnf (.const ``Nat [])) =
+        .ok (.const ``Nat []) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.whnf' (.const ``Nat [])
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show
+    (if (tcContext lctx).eagerReduce then
+      (tcContext lctx).fuel.whnfEager
+    else (tcContext lctx).fuel.whnf) = 100000 by rfl]
+  rw [show 100000 = 99999 + 1 by rfl]
+  rw [ctorWhnfLoopNat]
+  simp [Functor.map, StateT.map, Except.map]
+
+theorem ctorFVarCheckTypeM
+    (lctx : LocalContext) (id : FVarId) (type : Expr)
+    (hfind : lctx.find? id = some (.cdecl index id name type bi kind)) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.checkType (.fvar id)) = .ok type := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType (.fvar id) false
+      (TypeChecker.Methods.withFuel 10000) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' (.fvar id) false
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [inferTypeFVarCore 9999 lctx ({} : TypeChecker.State)
+    id type (by simp) hfind]
+  rfl
+
+theorem ctorFVarWhnfM
+    (lctx : LocalContext) (id : FVarId)
+    (hfind : lctx.find? id = some (.cdecl index id name type bi kind)) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.whnf (.fvar id)) = .ok (.fvar id) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.whnf' (.fvar id)
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  unfold TypeChecker.Inner.whnf'
+  simp only [nilRecMBind]
+  rw [show (getLCtx : TypeChecker.RecM LocalContext)
+    (TypeChecker.Methods.withFuel 9999)
+    (tcContext lctx) ({} : TypeChecker.State) =
+      .ok (lctx, ({} : TypeChecker.State)) by rfl]
+  simp [TypeChecker.Inner.isLetFVar, hfind]
+  rfl
+
+/-! A uniform WHNF observation for opaque applications of the inserted
+`IndexedVec` family. -/
+
+def ctorIndexedVecApp (alpha index : Expr) : Expr :=
+  .app (.app (.const ``IndexedVec [.param `u]) alpha) index
+
+@[simp] theorem ctorIndexedVecAppGetAppFn (alpha index : Expr) :
+    (ctorIndexedVecApp alpha index).getAppFn =
+      .const ``IndexedVec [.param `u] := by
+  rfl
+
+theorem ctorIndexedVecInductiveReduceRec
+    {m : Type → Type} [Monad m]
+    (alpha index : Expr) (whnf inferType : Expr → m Expr)
+    (isDefEq : Expr → Expr → m Bool) (isNeverProp : Expr → m Bool) :
+    inductiveReduceRec ctorEnv (ctorIndexedVecApp alpha index)
+      whnf inferType isDefEq isNeverProp = pure none := by
+  unfold inductiveReduceRec
+  rw [ctorIndexedVecAppGetAppFn]
+  simp only
+  rw [type_lookup_family]
+  rfl
+
+theorem ctorIndexedVecReduceRecursor
+    (lctx : LocalContext) (alpha index : Expr)
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.reduceRecursor (ctorIndexedVecApp alpha index)
+      methods (tcContext lctx) state =
+        .ok (none, state) := by
+  unfold TypeChecker.Inner.reduceRecursor
+  have hquot : ctorEnv.quotInit = false := by rfl
+  simp only [nilRecMBind, nilRecMGetEnv]
+  rw [show (tcContext lctx).env = ctorEnv by rfl]
+  rw [hquot]
+  simp only [Bool.false_eq_true, if_false, nilRecMBind]
+  rw [ctorIndexedVecInductiveReduceRec]
+  rfl
+
+@[simp] theorem ctorIndexedVecWhnfCoreFamily
+    (lctx : LocalContext) (n : Nat) (state : TypeChecker.State) :
+    TypeChecker.Inner.whnfCore
+      (.const ``IndexedVec [.param `u]) false
+      (TypeChecker.Methods.withFuel (n + 1)) (tcContext lctx) state =
+        .ok (.const ``IndexedVec [.param `u], state) := by
+  rfl
+
+theorem ctorIndexedVecWhnfCoreInitial
+    (lctx : LocalContext) (alpha index : Expr) (n : Nat) :
+    TypeChecker.Inner.whnfCore' (ctorIndexedVecApp alpha index)
+      false (TypeChecker.Methods.withFuel (n + 1))
+      (tcContext lctx) ({} : TypeChecker.State) =
+        .ok (ctorIndexedVecApp alpha index, ({} : TypeChecker.State)) := by
+  unfold ctorIndexedVecApp TypeChecker.Inner.whnfCore'
+  simp only [nilRecMBind, nilRecMGet, Std.HashMap.getElem?_empty]
+  rw [Expr.withRevApp_eq]
+  simp only [nilRecMBind]
+  rw [show
+    (Expr.app (Expr.app (Expr.const ``IndexedVec [.param `u]) alpha)
+      index).getAppFn = Expr.const ``IndexedVec [.param `u] by rfl]
+  rw [ctorIndexedVecWhnfCoreFamily lctx n ({} : TypeChecker.State)]
+  simp [Expr.structuralEq, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show
+    Expr.app (Expr.app (Expr.const ``IndexedVec [.param `u]) alpha)
+      index = ctorIndexedVecApp alpha index by rfl]
+  rw [ctorIndexedVecReduceRecursor]
+  rfl
+
+@[simp] theorem ctorIndexedVecReduceNative
+    (lctx : LocalContext) (env : Kernel.Environment)
+    (alpha index : Expr) (methods : TypeChecker.Methods)
+    (state : TypeChecker.State) :
+    (liftM (TypeChecker.Inner.reduceNative env
+      (ctorIndexedVecApp alpha index)) :
+        TypeChecker.RecM (Option Expr))
+      methods (tcContext lctx) state = .ok (none, state) := by
+  cases index <;>
+    simp [ctorIndexedVecApp, TypeChecker.Inner.reduceNative, Expr.structuralEq]
+
+@[simp] theorem ctorIndexedVecReduceNat
+    (lctx : LocalContext) (alpha index : Expr)
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.reduceNat (ctorIndexedVecApp alpha index)
+      methods (tcContext lctx) state = .ok (none, state) := by
+  simp [ctorIndexedVecApp, TypeChecker.Inner.reduceNat, Expr.getAppNumArgs_eq,
+    Expr.getAppArgsRevList]
+
+theorem ctorIndexedVecUnfoldFamily
+    (lctx : LocalContext) (methods : TypeChecker.Methods)
+    (state : TypeChecker.State) :
+    TypeChecker.Inner.unfoldDefinitionCore
+      (.const ``IndexedVec [.param `u]) methods (tcContext lctx) state =
+        .ok (none, state) := by
+  unfold TypeChecker.Inner.unfoldDefinitionCore
+  simp only [nilRecMBind, nilRecMGetEnv]
+  rw [show (tcContext lctx).env = ctorEnv by rfl]
+  rw [nilCandidateIsDeltaFamily]
+  rfl
+
+theorem ctorIndexedVecUnfold
+    (lctx : LocalContext) (alpha index : Expr)
+    (methods : TypeChecker.Methods) (state : TypeChecker.State) :
+    TypeChecker.Inner.unfoldDefinition (ctorIndexedVecApp alpha index)
+      methods (tcContext lctx) state = .ok (none, state) := by
+  unfold TypeChecker.Inner.unfoldDefinition
+  rw [show (ctorIndexedVecApp alpha index).isApp = true by rfl]
+  simp only [if_true]
+  rw [ctorIndexedVecAppGetAppFn]
+  simp only [nilRecMBind]
+  rw [ctorIndexedVecUnfoldFamily]
+  rfl
+
+theorem ctorIndexedVecWhnfLoop
+    (lctx : LocalContext) (alpha index : Expr) :
+    TypeChecker.Inner.whnf'.loop (ctorIndexedVecApp alpha index) 100000
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State) =
+        .ok (ctorIndexedVecApp alpha index, ({} : TypeChecker.State)) := by
+  rw [show 100000 = 99999 + 1 by rfl]
+  unfold TypeChecker.Inner.whnf'.loop
+  rw [show 9999 = 9998 + 1 by rfl]
+  simp only [nilRecMBind, nilRecMGetEnv]
+  rw [ctorIndexedVecWhnfCoreInitial lctx alpha index 9998]
+  simp only []
+  rw [ctorIndexedVecReduceNative]
+  simp only [nilRecMBind]
+  rw [ctorIndexedVecReduceNat]
+  simp only [nilRecMBind]
+  rw [ctorIndexedVecUnfold]
+  rfl
+
+theorem ctorIndexedVecWhnfM
+    (lctx : LocalContext) (alpha index : Expr) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.whnf (ctorIndexedVecApp alpha index)) =
+        .ok (ctorIndexedVecApp alpha index) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.whnf' (ctorIndexedVecApp alpha index)
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  unfold ctorIndexedVecApp
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show
+    (if (tcContext lctx).eagerReduce then
+      (tcContext lctx).fuel.whnfEager
+    else (tcContext lctx).fuel.whnf) = 100000 by rfl]
+  have hloop := ctorIndexedVecWhnfLoop lctx alpha index
+  simp only [ctorIndexedVecApp] at hloop
+  rw [hloop]
+  simp [Functor.map, StateT.map, Except.map]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/IndexedVecOuterReplay.lean b/Ix/Theory/Named/Verify/Environment/IndexedVecOuterReplay.lean
new file mode 100644
index 000000000..6ccc4cd64
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/IndexedVecOuterReplay.lean
@@ -0,0 +1,1757 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.IndexedVecConsReplay
+import Ix.Theory.Named.Verify.Name
+
+/-!
+# IndexedVec outer normalization-candidate replay
+
+Exact post-family declaration and constructor-validation executions for the
+real one-parameter, one-index `IndexedVec` metadata. The final theorem closes
+the complete `buildNormalizationCandidate` call and retains the ordered
+`nil`/`cons` candidate package produced in the staged kernel environments.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta
+open Ix.Theory.Named.InductiveFixtures
+open IndexedVecConsReplay
+
+def indexedVecCtorValidationContext : AddInductive.Context :=
+  { indexedVecFamilyCandidate.trace.terminalContext with env := ctorEnv }
+
+def indexedVecValidationAlpha : Expr :=
+  indexedVecFamilyCandidateContext.freshExpr
+
+def indexedVecValidationAlphaId : FVarId :=
+  indexedVecFamilyCandidateContext.freshFVarId
+
+def indexedVecValidationIndexId : FVarId :=
+  ⟨indexedVecFamilyCandidateContext.ngen.next.curr⟩
+
+theorem validationTerminalEnv :
+    indexedVecFamilyCandidate.trace.terminalContext.env =
+      indexedVecKernelEnv := by
+  rfl
+
+theorem validationTerminalLparams :
+    indexedVecFamilyCandidate.trace.terminalContext.lparams = [`u] := by
+  rfl
+
+theorem validationTerminalAllowPrimitive :
+    indexedVecFamilyCandidate.trace.terminalContext.allowPrimitive = false := by
+  rfl
+
+theorem validationFamilyEnvNotContains :
+    indexedVecKernelEnv.contains ``IndexedVec = false := by
+  unfold Kernel.Environment.contains
+  change natMap.contains ``IndexedVec = false
+  rw [SMap.find?_isSome, indexedVecType_fresh]
+  rfl
+
+theorem validationFamilyEnvCheckName :
+    indexedVecKernelEnv.checkName ``IndexedVec false = .ok () := by
+  simp [Kernel.Environment.checkName, validationFamilyEnvNotContains, Kernel.Environment.primitives,
+    NameSet.ofList, NameSet.contains, Pure.pure, Except.pure]
+
+theorem indexedVecDeclareRoot :
+    AddInductive.declareInductiveTypes indexedVecCandidateInductiveStats 1
+        #[indexedVecKernelType] 0 false
+        indexedVecFamilyCandidateContext =
+      .ok ctorEnv := by
+  simp [AddInductive.declareInductiveTypes,
+    indexedVecCandidateInductiveStats_nindices,
+    indexedVecCandidateInductiveStats_indConsts,
+    indexedVecKernelType, indexedVecKernelNil, indexedVecKernelCons,
+    indexedVecInfo, indexedVecNilInfo, indexedVecConsInfo,
+    ConstantInfo.name, ConstantInfo.type, ConstantInfo.toConstantVal,
+    ctorEnv, indexedVecKernelEnv, indexedVecFamilyCandidateContext,
+    indexedVecTypeMap,
+    AddInductive.isRec, AddInductive.isRec.loop,
+    AddInductive.isReflexive, AddInductive.isReflexive.loop,
+    AddInductive.hasIndOcc, Expr.constName!,
+    Bind.bind, Pure.pure, Except.bind, Except.pure]
+  have hcheck :
+      (Kernel.Environment.ofConstants `_indexedVecCandidate natMap).checkName
+          ``IndexedVec false = .ok () := by
+    simpa [indexedVecKernelEnv] using validationFamilyEnvCheckName
+  rw [hcheck]
+  rfl
+
+theorem indexedVecDeclareFromTerminal :
+    AddInductive.declareInductiveTypes indexedVecCandidateInductiveStats 1
+        #[indexedVecKernelType] 0 false
+        indexedVecFamilyCandidate.trace.terminalContext =
+      .ok ctorEnv := by
+  calc
+    _ = AddInductive.declareInductiveTypes
+        indexedVecCandidateInductiveStats 1 #[indexedVecKernelType]
+        0 false indexedVecFamilyCandidateContext :=
+      AddInductive.declareInductiveTypes_context_eq _ _ _ _ _ _ _
+        validationTerminalEnv validationTerminalLparams
+        validationTerminalAllowPrimitive
+    _ = .ok ctorEnv := indexedVecDeclareRoot
+
+example : indexedVecCtorValidationContext.env = ctorEnv := by rfl
+example : indexedVecCtorValidationContext.lparams = [`u] := by rfl
+example : indexedVecCtorValidationContext.safety = .safe := by rfl
+example : indexedVecCtorValidationContext.allowPrimitive = false := by rfl
+example : indexedVecCtorValidationContext.fuel = ({} : FuelConfig) := by rfl
+example : indexedVecCtorValidationContext.ngen =
+    ({ namePrefix := `_ind_fresh } : NameGenerator).next.next := by rfl
+
+def indexedVecValidationParamName : Name :=
+  indexedVecInfo.type.bindingName!
+
+def indexedVecValidationIndexName : Name :=
+  indexedVecInfo.type.bindingBody!.bindingName!
+
+def indexedVecValidationParamContext : AddInductive.Context :=
+  indexedVecFamilyCandidateContext.pushLocalDecl
+    indexedVecValidationParamName .default
+      (.sort (.succ (.param `u)))
+
+def indexedVecValidationFamilyContext : AddInductive.Context :=
+  indexedVecValidationParamContext.pushLocalDecl
+    indexedVecValidationIndexName .default (.const ``Nat [])
+
+theorem indexedVecValidationTerminalContextShape :
+    indexedVecFamilyCandidate.trace.terminalContext =
+      indexedVecValidationFamilyContext := by
+  rfl
+
+theorem indexedVecCtorValidationContextShape :
+    indexedVecCtorValidationContext =
+      { indexedVecValidationFamilyContext with env := ctorEnv } := by
+  rfl
+
+theorem indexedVecValidationParamContextWF :
+    indexedVecValidationParamContext.lctx.WF := by
+  have hfresh : indexedVecFamilyCandidateContext.lctx.find?
+      indexedVecFamilyCandidateContext.freshFVarId = none := by
+    have h := LocalContext.WF.find?_eq_find?_toList
+      (fv := indexedVecFamilyCandidateContext.freshFVarId)
+      LocalContext.WF.nil
+    change
+      ({ fvarIdToDecl := PersistentHashMap.empty,
+         decls := PersistentArray.empty,
+         auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+        indexedVecFamilyCandidateContext.freshFVarId = none
+    rw [h]
+    simp [LocalContext.toList]
+  change (({} : LocalContext).mkLocalDecl
+    indexedVecFamilyCandidateContext.freshFVarId
+    indexedVecValidationParamName
+    (.sort (.succ (.param `u))) .default).WF
+  exact LocalContext.WF.mkLocalDecl LocalContext.WF.nil hfresh
+
+theorem indexedVecValidationFamilyContextFresh :
+    indexedVecValidationParamContext.lctx.find?
+      indexedVecValidationParamContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := indexedVecValidationParamContext.freshFVarId)
+    indexedVecValidationParamContextWF
+  rw [h]
+  simp only [indexedVecValidationParamContext,
+    indexedVecFamilyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  intro heq
+  injection heq with hname
+  injection hname with hidx
+  omega
+
+theorem indexedVecValidationFamilyContextWF :
+    indexedVecValidationFamilyContext.lctx.WF := by
+  simpa [indexedVecValidationFamilyContext,
+    AddInductive.Context.pushLocalDecl] using
+      (LocalContext.WF.mkLocalDecl indexedVecValidationParamContextWF
+        indexedVecValidationFamilyContextFresh)
+
+theorem indexedVecValidationAlphaFind :
+    indexedVecCtorValidationContext.lctx.find?
+        indexedVecValidationAlphaId =
+      some (.cdecl 0 indexedVecValidationAlphaId
+        indexedVecValidationParamName
+        (.sort (.succ (.param `u))) .default .default) := by
+  change indexedVecValidationFamilyContext.lctx.find?
+      indexedVecValidationAlphaId = _
+  rw [indexedVecValidationFamilyContextWF.find?_eq_find?_toList]
+  simp [indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext,
+    indexedVecValidationAlphaId,
+    indexedVecFamilyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId,
+    LocalContext.mkLocalDecl,
+    LocalContext.toList, LocalDecl.fvarId,
+    NameGenerator.next, NameGenerator.curr]
+
+@[simp] theorem indexedVecValidationAlphaShape : indexedVecValidationAlpha =
+    .fvar indexedVecValidationAlphaId := by rfl
+
+theorem localContextFindNew
+    (lctx : LocalContext) (id : FVarId) (name : Name)
+    (type : Expr) (bi : BinderInfo) (kind : LocalDeclKind)
+    (hwf : lctx.WF) (hfresh : lctx.find? id = none) :
+    (lctx.mkLocalDecl id name type bi kind).find? id =
+      some (.cdecl lctx.decls.size id name type bi kind) := by
+  have hwf' := LocalContext.WF.mkLocalDecl
+    (name := name) (ty := type) (bi := bi) (kind := kind) hwf hfresh
+  rw [hwf'.find?_eq_find?_toList]
+  rw [LocalContext.mkLocalDecl_toList]
+  simp [LocalDecl.fvarId]
+
+theorem localContextFindOld
+    (lctx : LocalContext) (oldId newId : FVarId)
+    (newName : Name) (newType : Expr) (newBi : BinderInfo)
+    (newKind : LocalDeclKind) (oldDecl : LocalDecl)
+    (hwf : lctx.WF) (hfresh : lctx.find? newId = none)
+    (hne : oldId ≠ newId) (hold : lctx.find? oldId = some oldDecl) :
+    (lctx.mkLocalDecl newId newName newType newBi newKind).find? oldId =
+      some oldDecl := by
+  have hwf' := LocalContext.WF.mkLocalDecl
+    (name := newName) (ty := newType) (bi := newBi)
+    (kind := newKind) hwf hfresh
+  rw [hwf'.find?_eq_find?_toList]
+  rw [LocalContext.mkLocalDecl_toList]
+  simp only [List.find?_cons, LocalDecl.fvarId]
+  rw [show (oldId == newId) = false by
+    exact beq_eq_false_iff_ne.mpr hne]
+  rw [hwf.find?_eq_find?_toList] at hold
+  simpa only [LocalDecl.fvarId] using hold
+
+def validationFirstAppState (alphaId : FVarId) : TypeChecker.State :=
+  replayInsert
+    (replayInsert
+      (replayInsert ({} : TypeChecker.State)
+        (.const ``IndexedVec [.param `u]) indexedVecInfo.type)
+      (.fvar alphaId) (.sort (.succ (.param `u))))
+    (replayFirstApp (.fvar alphaId)) vecFamilyTail
+
+def validationIndexState (alphaId nId : FVarId) : TypeChecker.State :=
+  replayInsert (validationFirstAppState alphaId)
+    (.fvar nId) (.const ``Nat [])
+
+def validationIndexedVecState
+    (alphaId nId : FVarId) : TypeChecker.State :=
+  replayInsert (validationIndexState alphaId nId)
+    (ctorIndexedVecApp (.fvar alphaId) (.fvar nId))
+    (.sort (.succ (.param `u)))
+
+theorem ctorIndexedVecFVarCheckTypeM
+    (lctx : LocalContext) (alphaId nId : FVarId)
+    (hne : alphaId ≠ nId)
+    (halpha : lctx.find? alphaId = some (.cdecl alphaIndex alphaId
+      alphaName (.sort (.succ (.param `u))) alphaBi alphaKind))
+    (hn : lctx.find? nId = some (.cdecl nIndex nId nName
+      (.const ``Nat []) nBi nKind)) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.checkType
+        (ctorIndexedVecApp (.fvar alphaId) (.fvar nId))) =
+      .ok (.sort (.succ (.param `u))) := by
+  have hfirst :
+      TypeChecker.Inner.inferType'
+        (replayFirstApp (.fvar alphaId)) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        ({} : TypeChecker.State) =
+      .ok (vecFamilyTail, validationFirstAppState alphaId) := by
+    simpa [validationFirstAppState] using
+      (replayInferFirstAppFVarCore 9999 lctx
+        ({} : TypeChecker.State) alphaId
+        (by simp)
+        (by simp [replayInsert])
+        (by simp [replayFirstApp])
+        halpha)
+  have hnmiss :
+      (validationFirstAppState alphaId).inferTypeC[
+        (.fvar nId : Expr)]? = none := by
+    have halphaN :
+        ((.fvar alphaId : Expr) == .fvar nId) = false := by
+      change Expr.eqv (.fvar alphaId) (.fvar nId) = false
+      rw [Expr.eqv_eq]
+      simp [Expr.eqv', hne]
+    simp [validationFirstAppState, replayInsert, replayFirstApp,
+      halphaN]
+  have hnrun :
+      TypeChecker.Inner.inferType' (.fvar nId) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        (validationFirstAppState alphaId) =
+      .ok (.const ``Nat [], validationIndexState alphaId nId) := by
+    simpa [validationIndexState, replayInsert] using
+      (inferTypeFVarCore 9999 lctx
+        (validationFirstAppState alphaId) nId (.const ``Nat [])
+        hnmiss hn)
+  have htail :
+      (({} : TypeChecker.State).inferTypeC[
+        ctorIndexedVecApp (.fvar alphaId) (.fvar nId)]?) = none := by
+    simp
+  have hrun :
+      TypeChecker.Inner.inferType'
+        (ctorIndexedVecApp (.fvar alphaId) (.fvar nId)) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.param `u)),
+        validationIndexedVecState alphaId nId) := by
+    simpa [validationIndexedVecState] using
+      (replayInferIndexedVecAppCore 9999 lctx
+        ({} : TypeChecker.State) (validationFirstAppState alphaId)
+        (validationIndexState alphaId nId)
+        (.fvar alphaId) (.fvar nId)
+        (by simp [ctorIndexedVecApp, Expr.hasLooseBVars,
+          Expr.looseBVarRange'])
+        htail hfirst hnrun (by rfl))
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar alphaId) (.fvar nId)) false
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [hrun]
+  rfl
+
+def indexedVecValidationNilResult : Expr :=
+  ctorIndexedVecApp indexedVecValidationAlpha (.const ``Nat.zero [])
+
+def indexedVecValidationConsAfterParam : Expr :=
+  consNTypeRaw.instantiate1 indexedVecValidationAlpha
+
+def indexedVecValidationNId : FVarId :=
+  indexedVecCtorValidationContext.freshFVarId
+
+def indexedVecValidationNExpr : Expr :=
+  indexedVecCtorValidationContext.freshExpr
+
+@[simp] theorem indexedVecValidationNExprShape :
+    indexedVecValidationNExpr = .fvar indexedVecValidationNId := by
+  rfl
+
+def indexedVecValidationNContext : AddInductive.Context :=
+  indexedVecCtorValidationContext.pushLocalDecl
+    consNName .implicit (.const ``Nat [])
+
+def indexedVecValidationConsAfterN : Expr :=
+  .forallE consHeadName indexedVecValidationAlpha
+    (.forallE consTailName
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        (replaySuccApp indexedVecValidationNExpr))
+      .default)
+    .default
+
+def indexedVecValidationHeadId : FVarId :=
+  indexedVecValidationNContext.freshFVarId
+
+def indexedVecValidationHeadExpr : Expr :=
+  indexedVecValidationNContext.freshExpr
+
+@[simp] theorem indexedVecValidationHeadExprShape :
+    indexedVecValidationHeadExpr =
+      .fvar indexedVecValidationHeadId := by
+  rfl
+
+def indexedVecValidationHeadContext : AddInductive.Context :=
+  indexedVecValidationNContext.pushLocalDecl
+    consHeadName .default indexedVecValidationAlpha
+
+def indexedVecValidationConsAfterHead : Expr :=
+  .forallE consTailName
+    (ctorIndexedVecApp indexedVecValidationAlpha
+      indexedVecValidationNExpr)
+    (ctorIndexedVecApp indexedVecValidationAlpha
+      (replaySuccApp indexedVecValidationNExpr))
+    .default
+
+def indexedVecValidationTailId : FVarId :=
+  indexedVecValidationHeadContext.freshFVarId
+
+def indexedVecValidationTailContext : AddInductive.Context :=
+  indexedVecValidationHeadContext.pushLocalDecl consTailName .default
+    (ctorIndexedVecApp indexedVecValidationAlpha
+      indexedVecValidationNExpr)
+
+def indexedVecValidationConsResult : Expr :=
+  ctorIndexedVecApp indexedVecValidationAlpha
+    (replaySuccApp indexedVecValidationNExpr)
+
+theorem indexedVecValidationNilResultShape :
+    indexedVecNilInfo.type.bindingBody!.instantiate1
+        indexedVecValidationAlpha =
+      indexedVecValidationNilResult := by
+  simp [indexedVecNilInfo, ConstantInfo.type,
+    ConstantInfo.toConstantVal, indexedVecValidationNilResult,
+    ctorIndexedVecApp, indexedVecValidationAlpha,
+    indexedVecFamilyCandidateContext,
+    Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1',
+    Expr.liftLooseBVars_zero]
+
+theorem indexedVecValidationConsAfterParamShape :
+    indexedVecConsInfo.type.bindingBody!.instantiate1
+        indexedVecValidationAlpha =
+      indexedVecValidationConsAfterParam := by
+  rw [consInfoTypeShape]
+  rfl
+
+theorem indexedVecValidationConsAfterParamExplicitShape :
+    indexedVecValidationConsAfterParam =
+      .forallE consNName (.const ``Nat [])
+        (.forallE consHeadName indexedVecValidationAlpha
+          (.forallE consTailName
+            (ctorIndexedVecApp indexedVecValidationAlpha (.bvar 1))
+            (ctorIndexedVecApp indexedVecValidationAlpha
+              (replaySuccApp (.bvar 2)))
+            .default)
+          .default)
+        .implicit := by
+  simp [indexedVecValidationConsAfterParam, consNTypeRaw,
+    consHeadTypeRaw, consTailTypeRaw, consTerminalRaw,
+    ctorIndexedVecApp, replaySuccApp,
+    Expr.instantiate1_eq, Expr.instantiate1']
+
+theorem indexedVecValidationConsAfterNShape :
+    indexedVecValidationConsAfterParam.bindingBody!.instantiate1
+        indexedVecValidationNExpr =
+      indexedVecValidationConsAfterN := by
+  simp [indexedVecValidationConsAfterParam, consNTypeRaw,
+    consHeadTypeRaw, consTailTypeRaw, consTerminalRaw,
+    indexedVecValidationConsAfterN,
+    indexedVecValidationNExpr,
+    indexedVecValidationAlpha,
+    indexedVecCtorValidationContext,
+    indexedVecValidationTerminalContextShape,
+    indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext,
+    indexedVecFamilyCandidateContext,
+    ctorIndexedVecApp, replaySuccApp,
+    AddInductive.Context.freshExpr,
+    AddInductive.Context.freshFVarId,
+    Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1',
+    NameGenerator.curr]
+
+theorem indexedVecValidationConsAfterHeadShape :
+    indexedVecValidationConsAfterN.bindingBody!.instantiate1
+        indexedVecValidationHeadExpr =
+      indexedVecValidationConsAfterHead := by
+  simp [indexedVecValidationConsAfterN,
+    indexedVecValidationConsAfterHead,
+    ctorIndexedVecApp, replaySuccApp,
+    Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1']
+
+theorem indexedVecValidationConsResultShape :
+    indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+        indexedVecValidationHeadContext.freshExpr =
+      indexedVecValidationConsResult := by
+  simp [indexedVecValidationConsAfterHead,
+    indexedVecValidationConsResult,
+    ctorIndexedVecApp, replaySuccApp,
+    Expr.bindingBody!, Expr.instantiate1_eq, Expr.instantiate1']
+
+theorem indexedVecCtorValidationContextWF :
+    indexedVecCtorValidationContext.lctx.WF := by
+  simpa [indexedVecCtorValidationContextShape] using
+    indexedVecValidationFamilyContextWF
+
+theorem indexedVecCtorValidationContextLctxSize :
+    indexedVecCtorValidationContext.lctx.decls.size = 2 := by
+  change indexedVecFamilyCandidate.trace.terminalContext.lctx.decls.size = 2
+  rw [indexedVecValidationTerminalContextShape]
+  simp [indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext,
+    indexedVecFamilyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    LocalContext.mkLocalDecl]
+
+theorem indexedVecCtorValidationContextFresh :
+    indexedVecCtorValidationContext.lctx.find?
+      indexedVecCtorValidationContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := indexedVecCtorValidationContext.freshFVarId)
+    indexedVecCtorValidationContextWF
+  rw [h]
+  simp only [indexedVecCtorValidationContext,
+    indexedVecValidationTerminalContextShape,
+    indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext,
+    indexedVecFamilyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  constructor <;> intro heq
+  · injection heq with hname
+    injection hname with hidx
+    omega
+  · injection heq with hname
+    injection hname with hidx
+    omega
+
+theorem indexedVecValidationNContextWF :
+    indexedVecValidationNContext.lctx.WF := by
+  simpa [indexedVecValidationNContext,
+    AddInductive.Context.pushLocalDecl] using
+      (LocalContext.WF.mkLocalDecl indexedVecCtorValidationContextWF
+        indexedVecCtorValidationContextFresh)
+
+theorem indexedVecValidationNContextFresh :
+    indexedVecValidationNContext.lctx.find?
+      indexedVecValidationNContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := indexedVecValidationNContext.freshFVarId)
+    indexedVecValidationNContextWF
+  rw [h]
+  simp only [indexedVecValidationNContext,
+    indexedVecCtorValidationContext,
+    indexedVecValidationTerminalContextShape,
+    indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext,
+    indexedVecFamilyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp [NameGenerator.next, NameGenerator.curr]
+  constructor
+  · intro heq
+    injection heq with hname
+    injection hname with hidx
+    omega
+  · constructor <;> intro heq
+    · injection heq with hname
+      injection hname with hidx
+      omega
+    · injection heq with hname
+      injection hname with hidx
+      omega
+
+theorem indexedVecValidationHeadContextWF :
+    indexedVecValidationHeadContext.lctx.WF := by
+  simpa [indexedVecValidationHeadContext,
+    AddInductive.Context.pushLocalDecl] using
+      (LocalContext.WF.mkLocalDecl indexedVecValidationNContextWF
+        indexedVecValidationNContextFresh)
+
+theorem indexedVecValidationAlphaNeN :
+    indexedVecValidationAlphaId ≠ indexedVecValidationNId := by
+  change indexedVecValidationAlphaId ≠
+    indexedVecCtorValidationContext.freshFVarId
+  intro heq
+  have hfresh := indexedVecCtorValidationContextFresh
+  rw [← heq] at hfresh
+  rw [indexedVecValidationAlphaFind] at hfresh
+  contradiction
+
+theorem indexedVecValidationNNeHead :
+    indexedVecValidationNId ≠ indexedVecValidationHeadId := by
+  change indexedVecValidationNId ≠
+    indexedVecValidationNContext.freshFVarId
+  intro heq
+  have hfresh := indexedVecValidationNContextFresh
+  rw [← heq] at hfresh
+  have hnew := localContextFindNew
+    indexedVecCtorValidationContext.lctx indexedVecValidationNId
+    consNName (.const ``Nat []) .implicit .default
+    indexedVecCtorValidationContextWF
+    indexedVecCtorValidationContextFresh
+  have hfind : indexedVecValidationNContext.lctx.find?
+      indexedVecValidationNId = some (.cdecl 2
+        indexedVecValidationNId consNName (.const ``Nat [])
+        .implicit .default) := by
+    rw [indexedVecCtorValidationContextLctxSize] at hnew
+    simpa [indexedVecValidationNContext,
+      indexedVecValidationNId,
+      AddInductive.Context.pushLocalDecl] using hnew
+  rw [hfind] at hfresh
+  contradiction
+
+theorem indexedVecValidationAlphaFindInN :
+    indexedVecValidationNContext.lctx.find?
+        indexedVecValidationAlphaId =
+      some (.cdecl 0 indexedVecValidationAlphaId
+        indexedVecValidationParamName
+        (.sort (.succ (.param `u))) .default .default) := by
+  have h := localContextFindOld
+    (lctx := indexedVecCtorValidationContext.lctx)
+    (oldId := indexedVecValidationAlphaId)
+    (newId := indexedVecValidationNId)
+    (newName := consNName) (newType := .const ``Nat [])
+    (newBi := .implicit) (newKind := .default)
+    (oldDecl := .cdecl 0 indexedVecValidationAlphaId
+      indexedVecValidationParamName (.sort (.succ (.param `u)))
+      .default .default)
+    indexedVecCtorValidationContextWF
+    indexedVecCtorValidationContextFresh
+    indexedVecValidationAlphaNeN indexedVecValidationAlphaFind
+  simpa [indexedVecValidationNContext,
+    indexedVecValidationNId,
+    AddInductive.Context.pushLocalDecl] using h
+
+theorem indexedVecValidationNFindInHead :
+    indexedVecValidationHeadContext.lctx.find?
+        indexedVecValidationNId =
+      some (.cdecl 2 indexedVecValidationNId consNName
+        (.const ``Nat []) .implicit .default) := by
+  have hnew := localContextFindNew
+    indexedVecCtorValidationContext.lctx indexedVecValidationNId
+    consNName (.const ``Nat []) .implicit .default
+    indexedVecCtorValidationContextWF
+    indexedVecCtorValidationContextFresh
+  have hold : indexedVecValidationNContext.lctx.find?
+      indexedVecValidationNId =
+      some (.cdecl 2 indexedVecValidationNId consNName
+        (.const ``Nat []) .implicit .default) := by
+    rw [indexedVecCtorValidationContextLctxSize] at hnew
+    simpa [indexedVecValidationNContext,
+      indexedVecValidationNId,
+      AddInductive.Context.pushLocalDecl] using hnew
+  have h := localContextFindOld
+    (lctx := indexedVecValidationNContext.lctx)
+    (oldId := indexedVecValidationNId)
+    (newId := indexedVecValidationHeadId)
+    (newName := consHeadName)
+    (newType := indexedVecValidationAlpha)
+    (newBi := .default) (newKind := .default)
+    (oldDecl := .cdecl 2 indexedVecValidationNId consNName
+      (.const ``Nat []) .implicit .default)
+    indexedVecValidationNContextWF indexedVecValidationNContextFresh
+    indexedVecValidationNNeHead hold
+  simpa [indexedVecValidationHeadContext,
+    indexedVecValidationHeadId,
+    AddInductive.Context.pushLocalDecl] using h
+
+theorem indexedVecValidationAlphaFindInHead :
+    indexedVecValidationHeadContext.lctx.find?
+        indexedVecValidationAlphaId =
+      some (.cdecl 0 indexedVecValidationAlphaId
+        indexedVecValidationParamName
+        (.sort (.succ (.param `u))) .default .default) := by
+  have hne : indexedVecValidationAlphaId ≠
+      indexedVecValidationHeadId := by
+    change indexedVecValidationAlphaId ≠
+      indexedVecValidationNContext.freshFVarId
+    intro heq
+    have hfresh := indexedVecValidationNContextFresh
+    rw [← heq] at hfresh
+    rw [indexedVecValidationAlphaFindInN] at hfresh
+    contradiction
+  have h := localContextFindOld
+    (lctx := indexedVecValidationNContext.lctx)
+    (oldId := indexedVecValidationAlphaId)
+    (newId := indexedVecValidationHeadId)
+    (newName := consHeadName)
+    (newType := indexedVecValidationAlpha)
+    (newBi := .default) (newKind := .default)
+    (oldDecl := .cdecl 0 indexedVecValidationAlphaId
+      indexedVecValidationParamName (.sort (.succ (.param `u)))
+      .default .default)
+    indexedVecValidationNContextWF indexedVecValidationNContextFresh
+    hne indexedVecValidationAlphaFindInN
+  simpa [indexedVecValidationHeadContext,
+    indexedVecValidationHeadId,
+    AddInductive.Context.pushLocalDecl] using h
+
+theorem indexedVecValidationGetTypeAlpha :
+    AddInductive.getType indexedVecValidationAlpha
+        indexedVecCtorValidationContext =
+      .ok (.sort (.succ (.param `u))) := by
+  unfold AddInductive.getType
+  simp only [getLCtx,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  change Except.ok ((indexedVecCtorValidationContext.lctx.get!
+    indexedVecValidationAlpha.fvarId!).type) = _
+  rw [show indexedVecValidationAlpha.fvarId! =
+      indexedVecValidationAlphaId by
+    rw [indexedVecValidationAlphaShape]
+    rfl]
+  simp [LocalContext.get!, indexedVecValidationAlphaFind,
+    LocalDecl.type]
+
+theorem indexedVecValidationParamIsDefEq :
+    TypeChecker.M.run indexedVecCtorValidationContext.env
+        indexedVecCtorValidationContext.safety
+        indexedVecCtorValidationContext.lctx
+        indexedVecCtorValidationContext.lparams
+        indexedVecCtorValidationContext.fuel
+        (TypeChecker.isDefEq (.sort (.succ (.param `u)))
+          (.sort (.succ (.param `u)))) = .ok true := by
+  exact candidateIsDefEqSelfValid indexedVecCtorValidationContext
+    (.sort (.succ (.param `u))) 9999 rfl
+
+theorem indexedVecNilNoMVarNoFVar :
+    ctorEnv.checkNoMVarNoFVar indexedVecKernelNil.name
+        indexedVecKernelNil.type = .ok () := by
+  have hexpr : indexedVecKernelNil.type.data.hasExprMVar = false := by
+    change indexedVecNilInfo.type.hasExprMVar = false
+    rw [Expr.hasExprMVar_eq]
+    rfl
+  have hlevel : indexedVecKernelNil.type.data.hasLevelMVar = false := by
+    change indexedVecNilInfo.type.hasLevelMVar = false
+    rw [Expr.hasLevelMVar_eq]
+    simp [indexedVecNilInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal, Expr.hasLevelMVar',
+      Level.hasMVar_eq, Level.hasMVar']
+  have hfvar : indexedVecKernelNil.type.data.hasFVar = false := by
+    change indexedVecNilInfo.type.hasFVar = false
+    rw [Expr.hasFVar_eq]
+    rfl
+  unfold Kernel.Environment.checkNoMVarNoFVar
+    Kernel.Environment.checkNoMVar Kernel.Environment.checkNoFVar
+  rw [show indexedVecKernelNil.type.hasMVar = false by
+    change (indexedVecKernelNil.type.data.hasExprMVar ||
+      indexedVecKernelNil.type.data.hasLevelMVar) = false
+    rw [hexpr, hlevel]
+    rfl]
+  rw [show indexedVecKernelNil.type.hasFVar = false by
+    exact hfvar]
+  rfl
+
+theorem indexedVecConsNoMVarNoFVar :
+    ctorEnv.checkNoMVarNoFVar indexedVecKernelCons.name
+        indexedVecKernelCons.type = .ok () := by
+  have hexpr : indexedVecKernelCons.type.data.hasExprMVar = false := by
+    change indexedVecConsInfo.type.hasExprMVar = false
+    rw [Expr.hasExprMVar_eq]
+    rfl
+  have hlevel : indexedVecKernelCons.type.data.hasLevelMVar = false := by
+    change indexedVecConsInfo.type.hasLevelMVar = false
+    rw [Expr.hasLevelMVar_eq]
+    simp [indexedVecConsInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal, Expr.hasLevelMVar',
+      Level.hasMVar_eq, Level.hasMVar']
+  have hfvar : indexedVecKernelCons.type.data.hasFVar = false := by
+    change indexedVecConsInfo.type.hasFVar = false
+    rw [Expr.hasFVar_eq]
+    rfl
+  unfold Kernel.Environment.checkNoMVarNoFVar
+    Kernel.Environment.checkNoMVar Kernel.Environment.checkNoFVar
+  rw [show indexedVecKernelCons.type.hasMVar = false by
+    change (indexedVecKernelCons.type.data.hasExprMVar ||
+      indexedVecKernelCons.type.data.hasLevelMVar) = false
+    rw [hexpr, hlevel]
+    rfl]
+  rw [show indexedVecKernelCons.type.hasFVar = false by
+    exact hfvar]
+  rfl
+
+theorem indexedVecValidationNilRootCheckTypeM :
+    TypeChecker.M.run indexedVecCtorValidationContext.env
+        indexedVecCtorValidationContext.safety {}
+        indexedVecCtorValidationContext.lparams
+        indexedVecCtorValidationContext.fuel
+        (TypeChecker.checkType indexedVecKernelNil.type) =
+      .ok (.sort nilCtorInferredLevel) := by
+  change TypeChecker.M.run ctorEnv .safe {} [`u] ({} : FuelConfig)
+    (TypeChecker.checkType indexedVecKernelNil.type) =
+      .ok (.sort nilCtorInferredLevel)
+  simpa [indexedVecKernelNil] using nilRootCheckTypeM
+
+theorem indexedVecValidationConsRootCheckTypeM :
+    TypeChecker.M.run indexedVecCtorValidationContext.env
+        indexedVecCtorValidationContext.safety {}
+        indexedVecCtorValidationContext.lparams
+        indexedVecCtorValidationContext.fuel
+        (TypeChecker.checkType indexedVecKernelCons.type) =
+      .ok (.sort (.succ (.succ (.param `u)))) := by
+  change TypeChecker.M.run ctorEnv .safe {} [`u] ({} : FuelConfig)
+    (TypeChecker.checkType indexedVecKernelCons.type) =
+      .ok (.sort (.succ (.succ (.param `u))))
+  simpa [indexedVecKernelCons, consRootContext, ctorContext] using
+    replayConsRootCheckTypeM
+
+def validationInferOnlyInsert
+    (state : TypeChecker.State) (e type : Expr) : TypeChecker.State :=
+  { state with inferTypeI := state.inferTypeI.insert e type }
+
+@[simp] theorem inferConstantFamilyOnly (lctx : LocalContext) :
+    TypeChecker.Inner.inferConstant (tcContext lctx) ``IndexedVec
+      [.param `u] true = .ok indexedVecInfo.type := by
+  unfold TypeChecker.Inner.inferConstant
+  simp only [tcContext]
+  rw [type_get_family]
+  simp [indexedVecInfo,
+    ConstantInfo.levelParams, ConstantInfo.type,
+    ConstantInfo.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq,
+    Expr.instantiateLevelParamsCore', Level.substParams',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] theorem inferConstantNatOnly (lctx : LocalContext) :
+    TypeChecker.Inner.inferConstant (tcContext lctx) ``Nat [] true =
+      .ok (.sort (.succ .zero)) := by
+  unfold TypeChecker.Inner.inferConstant
+  simp [tcContext, natInfo,
+    ConstantInfo.levelParams, ConstantInfo.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq,
+    Expr.instantiateLevelParamsCore', Level.substParams',
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+theorem inferTypeNatOnlyCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache : state.inferTypeI[(.const ``Nat [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType' (.const ``Nat []) true
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (.sort (.succ .zero),
+          validationInferOnlyInsert state (.const ``Nat [])
+            (.sort (.succ .zero))) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    validationInferOnlyInsert, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+theorem inferTypeFamilyOnlyCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache : state.inferTypeI[
+      (.const ``IndexedVec [.param `u] : Expr)]? = none) :
+    TypeChecker.Inner.inferType'
+      (.const ``IndexedVec [.param `u]) true
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (indexedVecInfo.type,
+          validationInferOnlyInsert state
+            (.const ``IndexedVec [.param `u]) indexedVecInfo.type) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    validationInferOnlyInsert, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+theorem inferTypeFVarOnlyCore
+    (fuel : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (id : FVarId) (type : Expr)
+    (hcache : state.inferTypeI[(.fvar id : Expr)]? = none)
+    (hfind : lctx.find? id = some (.cdecl index id name type bi kind)) :
+    TypeChecker.Inner.inferType' (.fvar id) true
+      (TypeChecker.Methods.withFuel fuel) (tcContext lctx) state =
+        .ok (type, validationInferOnlyInsert state (.fvar id) type) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    TypeChecker.Inner.inferFVar, tcContext, hfind, LocalDecl.type,
+    validationInferOnlyInsert, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+def validationFamilyOnlyState : TypeChecker.State :=
+  validationInferOnlyInsert ({} : TypeChecker.State)
+    (.const ``IndexedVec [.param `u]) indexedVecInfo.type
+
+def validationIndexedVecOnlyState
+    (alpha index : Expr) : TypeChecker.State :=
+  validationInferOnlyInsert validationFamilyOnlyState
+    (ctorIndexedVecApp alpha index) (.sort (.succ (.param `u)))
+
+@[simp] theorem ctorIndexedVecAppGetAppArgs (alpha index : Expr) :
+    (ctorIndexedVecApp alpha index).getAppArgs = #[alpha, index] := by
+  rfl
+
+@[simp] theorem ctorIndexedVecAppGetAppNumArgs (alpha index : Expr) :
+    (ctorIndexedVecApp alpha index).getAppNumArgs = 2 := by
+  rfl
+
+theorem inferTypeIndexedVecOnlyCore
+    (fuel : Nat) (lctx : LocalContext) (alpha index : Expr)
+    (hclosed : (ctorIndexedVecApp alpha index).hasLooseBVars = false) :
+    TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp alpha index) true
+      (TypeChecker.Methods.withFuel (fuel + 1)) (tcContext lctx)
+      ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)),
+          validationIndexedVecOnlyState alpha index) := by
+  unfold ctorIndexedVecApp at hclosed ⊢
+  have hfn :
+      (((.const ``IndexedVec [.param `u] : Expr).app alpha).app index).getAppFn =
+        .const ``IndexedVec [.param `u] := by
+    rfl
+  have hargs :
+      (((.const ``IndexedVec [.param `u] : Expr).app alpha).app index).getAppArgs =
+        #[alpha, index] := by
+    rfl
+  unfold TypeChecker.Inner.inferType'
+  rw [hclosed]
+  simp [TypeChecker.Inner.inferApp,
+    TypeChecker.Inner.inferApp.loop,
+    hfn, hargs, ctorIndexedVecApp,
+    validationFamilyOnlyState, validationIndexedVecOnlyState,
+    validationInferOnlyInsert,
+    inferTypeFamilyOnlyCore,
+    indexedVecInfoTypeShape, vecFamilyTail,
+    Expr.instantiate1',
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+theorem ensureTypeMOfInferOnly
+    (context : AddInductive.Context) (e : Expr) (level : Level)
+    (finalState : TypeChecker.State)
+    (hrun : TypeChecker.Inner.inferType e true
+      (TypeChecker.Methods.withFuel context.fuel.recDepth)
+      context.toTypeChecker ({} : TypeChecker.State) =
+        .ok (.sort level, finalState)) :
+    TypeChecker.M.run context.env context.safety context.lctx
+        context.lparams context.fuel (TypeChecker.ensureType e) =
+      .ok (.sort level) := by
+  unfold TypeChecker.ensureType TypeChecker.inferType
+    TypeChecker.ensureSort TypeChecker.RecM.run TypeChecker.M.run
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    Pure.pure, StateT.pure, Except.pure, StateT.run',
+    Functor.map, Except.map]
+  rw [show TypeChecker.Inner.inferType e true
+      (TypeChecker.Methods.withFuel context.fuel.recDepth)
+      { env := context.env, lctx := context.lctx,
+        safety := context.safety, lparams := context.lparams,
+        fuel := context.fuel } ({} : TypeChecker.State) =
+        .ok (.sort level, finalState) by
+    simpa [AddInductive.Context.toTypeChecker] using hrun]
+  rfl
+
+def validationNatOnlyState : TypeChecker.State :=
+  validationInferOnlyInsert ({} : TypeChecker.State)
+    (.const ``Nat []) (.sort (.succ .zero))
+
+theorem indexedVecValidationNatInferOnly :
+    TypeChecker.Inner.inferType (.const ``Nat []) true
+      (TypeChecker.Methods.withFuel
+        indexedVecCtorValidationContext.fuel.recDepth)
+      indexedVecCtorValidationContext.toTypeChecker
+      ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero), validationNatOnlyState) := by
+  change TypeChecker.Inner.inferType' (.const ``Nat []) true
+    (TypeChecker.Methods.withFuel 9999)
+    (tcContext indexedVecCtorValidationContext.lctx)
+    ({} : TypeChecker.State) = _
+  simpa [validationNatOnlyState] using
+    (inferTypeNatOnlyCore 9999 indexedVecCtorValidationContext.lctx
+      ({} : TypeChecker.State) (by simp))
+
+theorem indexedVecValidationNatEnsureTypeM :
+    TypeChecker.M.run indexedVecCtorValidationContext.env
+        indexedVecCtorValidationContext.safety
+        indexedVecCtorValidationContext.lctx
+        indexedVecCtorValidationContext.lparams
+        indexedVecCtorValidationContext.fuel
+        (TypeChecker.ensureType (.const ``Nat [])) =
+      .ok (.sort (.succ .zero)) := by
+  exact ensureTypeMOfInferOnly indexedVecCtorValidationContext
+    (.const ``Nat []) (.succ .zero) validationNatOnlyState
+    indexedVecValidationNatInferOnly
+
+def validationAlphaOnlyState : TypeChecker.State :=
+  validationInferOnlyInsert ({} : TypeChecker.State)
+    indexedVecValidationAlpha (.sort (.succ (.param `u)))
+
+theorem indexedVecValidationAlphaInferOnly :
+    TypeChecker.Inner.inferType indexedVecValidationAlpha true
+      (TypeChecker.Methods.withFuel
+        indexedVecValidationNContext.fuel.recDepth)
+      indexedVecValidationNContext.toTypeChecker
+      ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)), validationAlphaOnlyState) := by
+  rw [indexedVecValidationAlphaShape]
+  change TypeChecker.Inner.inferType'
+      (.fvar indexedVecValidationAlphaId) true
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext indexedVecValidationNContext.lctx)
+      ({} : TypeChecker.State) = _
+  simpa [validationAlphaOnlyState,
+    indexedVecValidationAlphaShape] using
+    (inferTypeFVarOnlyCore 9999 indexedVecValidationNContext.lctx
+      ({} : TypeChecker.State) indexedVecValidationAlphaId
+      (.sort (.succ (.param `u))) (by simp)
+      indexedVecValidationAlphaFindInN)
+
+theorem indexedVecValidationAlphaEnsureTypeM :
+    TypeChecker.M.run indexedVecValidationNContext.env
+        indexedVecValidationNContext.safety
+        indexedVecValidationNContext.lctx
+        indexedVecValidationNContext.lparams
+        indexedVecValidationNContext.fuel
+        (TypeChecker.ensureType indexedVecValidationAlpha) =
+      .ok (.sort (.succ (.param `u))) := by
+  exact ensureTypeMOfInferOnly indexedVecValidationNContext
+    indexedVecValidationAlpha (.succ (.param `u))
+    validationAlphaOnlyState indexedVecValidationAlphaInferOnly
+
+theorem indexedVecValidationTailInferOnly :
+    TypeChecker.Inner.inferType
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) true
+      (TypeChecker.Methods.withFuel
+        indexedVecValidationHeadContext.fuel.recDepth)
+      indexedVecValidationHeadContext.toTypeChecker
+      ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.param `u)),
+          validationIndexedVecOnlyState indexedVecValidationAlpha
+            indexedVecValidationNExpr) := by
+  change TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) true
+      (TypeChecker.Methods.withFuel 9999)
+      (tcContext indexedVecValidationHeadContext.lctx)
+      ({} : TypeChecker.State) = _
+  exact inferTypeIndexedVecOnlyCore 9998
+    indexedVecValidationHeadContext.lctx
+    indexedVecValidationAlpha indexedVecValidationNExpr
+    (by simp [ctorIndexedVecApp, Expr.hasLooseBVars,
+      Expr.looseBVarRange'])
+
+theorem indexedVecValidationTailEnsureTypeM :
+    TypeChecker.M.run indexedVecValidationHeadContext.env
+        indexedVecValidationHeadContext.safety
+        indexedVecValidationHeadContext.lctx
+        indexedVecValidationHeadContext.lparams
+        indexedVecValidationHeadContext.fuel
+        (TypeChecker.ensureType
+          (ctorIndexedVecApp indexedVecValidationAlpha
+            indexedVecValidationNExpr)) =
+      .ok (.sort (.succ (.param `u))) := by
+  exact ensureTypeMOfInferOnly indexedVecValidationHeadContext
+    (ctorIndexedVecApp indexedVecValidationAlpha
+      indexedVecValidationNExpr) (.succ (.param `u))
+    (validationIndexedVecOnlyState indexedVecValidationAlpha
+      indexedVecValidationNExpr)
+    indexedVecValidationTailInferOnly
+
+theorem indexedVecValidationStatsParams :
+    indexedVecCandidateInductiveStats.params =
+      #[indexedVecValidationAlpha] := by
+  simpa [indexedVecValidationAlpha] using
+    indexedVecCandidateInductiveStats_params
+
+@[simp] theorem validationExprBneSelf (e : Expr) :
+    (e != e) = false := by
+  change (!Expr.eqv e e) = false
+  rw [show Expr.eqv e e = true by exact Expr.eqv_refl e]
+  rfl
+
+theorem indexedVecValidationAppIsValidIdx (index : Expr)
+    (hindex : AddInductive.hasIndOcc
+      indexedVecCandidateInductiveStats.indConsts index = false) :
+    AddInductive.isValidIndAppIdx indexedVecCandidateInductiveStats
+      (ctorIndexedVecApp indexedVecValidationAlpha index) 0 = true := by
+  have hparam :
+      (indexedVecValidationAlpha != indexedVecValidationAlpha) = false := by
+    change (!Expr.eqv indexedVecValidationAlpha
+      indexedVecValidationAlpha) = false
+    rw [show Expr.eqv indexedVecValidationAlpha
+      indexedVecValidationAlpha = true by
+      exact Expr.eqv_refl indexedVecValidationAlpha]
+    rfl
+  have hindex' : AddInductive.hasIndOcc
+      #[.const ``IndexedVec [.param `u]] index = false := by
+    simpa [indexedVecCandidateInductiveStats_indConsts] using hindex
+  simp +decide [AddInductive.isValidIndAppIdx,
+    indexedVecCandidateInductiveStats_nindices,
+    indexedVecValidationStatsParams,
+    indexedVecCandidateInductiveStats_indConsts,
+    ctorIndexedVecAppGetAppFn, ctorIndexedVecAppGetAppArgs,
+    hindex']
+
+theorem indexedVecValidationAppIsValid (index : Expr)
+    (hindex : AddInductive.hasIndOcc
+      indexedVecCandidateInductiveStats.indConsts index = false) :
+    AddInductive.isValidIndApp? indexedVecCandidateInductiveStats
+      (ctorIndexedVecApp indexedVecValidationAlpha index) = some 0 := by
+  exact AddInductive.isValidIndApp?_singleton_zero
+    indexedVecCandidateInductiveStats
+    (ctorIndexedVecApp indexedVecValidationAlpha index)
+    (by simp [indexedVecCandidateInductiveStats_indConsts])
+    (indexedVecValidationAppIsValidIdx index hindex)
+
+theorem indexedVecValidationZeroHasNoIndOcc :
+    AddInductive.hasIndOcc indexedVecCandidateInductiveStats.indConsts
+      (.const ``Nat.zero []) = false := by
+  simp [AddInductive.hasIndOcc,
+    indexedVecCandidateInductiveStats_indConsts, Expr.constName!]
+
+theorem indexedVecValidationNHasNoIndOcc :
+    AddInductive.hasIndOcc indexedVecCandidateInductiveStats.indConsts
+      indexedVecValidationNExpr = false := by
+  simp [AddInductive.hasIndOcc,
+    indexedVecCandidateInductiveStats_indConsts,
+    indexedVecValidationNExprShape]
+
+theorem indexedVecValidationSuccNHasNoIndOcc :
+    AddInductive.hasIndOcc indexedVecCandidateInductiveStats.indConsts
+      (replaySuccApp indexedVecValidationNExpr) = false := by
+  simp [AddInductive.hasIndOcc,
+    indexedVecCandidateInductiveStats_indConsts,
+    replaySuccApp, Expr.constName!]
+
+theorem indexedVecValidationNilResultIsValid :
+    AddInductive.isValidIndAppIdx indexedVecCandidateInductiveStats
+      indexedVecValidationNilResult 0 = true := by
+  exact indexedVecValidationAppIsValidIdx (.const ``Nat.zero [])
+    indexedVecValidationZeroHasNoIndOcc
+
+theorem indexedVecValidationConsResultIsValid :
+    AddInductive.isValidIndAppIdx indexedVecCandidateInductiveStats
+      indexedVecValidationConsResult 0 = true := by
+  exact indexedVecValidationAppIsValidIdx
+    (replaySuccApp indexedVecValidationNExpr)
+    indexedVecValidationSuccNHasNoIndOcc
+
+theorem indexedVecValidationNatHasNoIndOcc :
+    AddInductive.hasIndOcc indexedVecCandidateInductiveStats.indConsts
+      (.const ``Nat []) = false := by
+  simp [AddInductive.hasIndOcc,
+    indexedVecCandidateInductiveStats_indConsts, Expr.constName!]
+
+theorem indexedVecValidationAlphaHasNoIndOcc :
+    AddInductive.hasIndOcc indexedVecCandidateInductiveStats.indConsts
+      indexedVecValidationAlpha = false := by
+  simp [AddInductive.hasIndOcc,
+    indexedVecCandidateInductiveStats_indConsts,
+    indexedVecValidationAlphaShape]
+
+theorem indexedVecValidationTailHasIndOcc :
+    AddInductive.hasIndOcc indexedVecCandidateInductiveStats.indConsts
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) = true := by
+  simp [AddInductive.hasIndOcc,
+    indexedVecCandidateInductiveStats_indConsts,
+    ctorIndexedVecApp, Expr.constName!]
+
+theorem indexedVecValidationNatPositivity :
+    AddInductive.checkPositivity indexedVecCandidateInductiveStats
+      (.const ``Nat []) indexedVecKernelCons.name 1
+      indexedVecCtorValidationContext = .ok () := by
+  unfold AddInductive.checkPositivity
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show indexedVecCtorValidationContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkPositivity.loop
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [show TypeChecker.M.run indexedVecCtorValidationContext.env
+      indexedVecCtorValidationContext.safety
+      indexedVecCtorValidationContext.lctx
+      indexedVecCtorValidationContext.lparams
+      indexedVecCtorValidationContext.fuel
+      (TypeChecker.whnf (.const ``Nat [])) =
+        .ok (.const ``Nat []) by
+    change TypeChecker.M.run ctorEnv .safe
+      indexedVecCtorValidationContext.lctx [`u] ({} : FuelConfig)
+      (TypeChecker.whnf (.const ``Nat [])) = .ok (.const ``Nat [])
+    exact ctorNatWhnfM indexedVecCtorValidationContext.lctx]
+  simp only [Except.bind]
+  rw [indexedVecValidationNatHasNoIndOcc]
+  simp only [Bool.not_false, if_true,
+    ReaderT.pure, Pure.pure, Except.pure]
+
+theorem indexedVecValidationAlphaPositivity :
+    AddInductive.checkPositivity indexedVecCandidateInductiveStats
+      indexedVecValidationAlpha indexedVecKernelCons.name 2
+      indexedVecValidationNContext = .ok () := by
+  unfold AddInductive.checkPositivity
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show indexedVecValidationNContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkPositivity.loop
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [show TypeChecker.M.run indexedVecValidationNContext.env
+      indexedVecValidationNContext.safety
+      indexedVecValidationNContext.lctx
+      indexedVecValidationNContext.lparams
+      indexedVecValidationNContext.fuel
+      (TypeChecker.whnf indexedVecValidationAlpha) =
+        .ok indexedVecValidationAlpha by
+    rw [indexedVecValidationAlphaShape]
+    change TypeChecker.M.run ctorEnv .safe
+      indexedVecValidationNContext.lctx [`u] ({} : FuelConfig)
+      (TypeChecker.whnf (.fvar indexedVecValidationAlphaId)) =
+        .ok (.fvar indexedVecValidationAlphaId)
+    exact ctorFVarWhnfM indexedVecValidationNContext.lctx
+      indexedVecValidationAlphaId indexedVecValidationAlphaFindInN]
+  simp only [Except.bind]
+  rw [indexedVecValidationAlphaHasNoIndOcc]
+  simp only [Bool.not_false, if_true,
+    ReaderT.pure, Pure.pure, Except.pure]
+
+theorem indexedVecValidationTailPositivity :
+    AddInductive.checkPositivity indexedVecCandidateInductiveStats
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)
+      indexedVecKernelCons.name 3 indexedVecValidationHeadContext =
+      .ok () := by
+  unfold AddInductive.checkPositivity
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show indexedVecValidationHeadContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkPositivity.loop
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [show TypeChecker.M.run indexedVecValidationHeadContext.env
+      indexedVecValidationHeadContext.safety
+      indexedVecValidationHeadContext.lctx
+      indexedVecValidationHeadContext.lparams
+      indexedVecValidationHeadContext.fuel
+      (TypeChecker.whnf
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr)) =
+        .ok (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr) by
+    change TypeChecker.M.run ctorEnv .safe
+      indexedVecValidationHeadContext.lctx [`u] ({} : FuelConfig)
+      (TypeChecker.whnf
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr)) =
+        .ok (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr)
+    exact ctorIndexedVecWhnfM indexedVecValidationHeadContext.lctx
+      indexedVecValidationAlpha indexedVecValidationNExpr]
+  simp only [Except.bind]
+  rw [indexedVecValidationTailHasIndOcc]
+  simp only [Bool.not_true, Bool.false_eq_true, if_false, Pure.pure]
+  rw [indexedVecValidationAppIsValid indexedVecValidationNExpr
+    indexedVecValidationNHasNoIndOcc]
+  rfl
+
+theorem indexedVecValidationNilLoopTerminal :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelNil.name indexedVecValidationNilResult 1 999
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show 999 = 998 + 1 by rfl]
+  have hvalid : AddInductive.isValidIndAppIdx
+      indexedVecCandidateInductiveStats
+      ((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar indexedVecValidationAlphaId) |>.app
+          (.const ``Nat.zero [])) 0 =
+      true := by
+    simpa [indexedVecValidationNilResult, ctorIndexedVecApp,
+      indexedVecValidationAlphaShape] using
+      indexedVecValidationNilResultIsValid
+  unfold indexedVecValidationNilResult ctorIndexedVecApp
+  unfold AddInductive.checkConstructorType.loop
+  simp [hvalid,
+    ReaderT.pure, Pure.pure, Except.pure]
+
+theorem indexedVecValidationNilLoop :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelNil.name indexedVecKernelNil.type 0
+      indexedVecCtorValidationContext.fuel.inductiveFuel
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show indexedVecCtorValidationContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkConstructorType.loop
+  simp only [indexedVecKernelNil, indexedVecNilInfo,
+    ConstantInfo.name, ConstantInfo.type, ConstantInfo.toConstantVal]
+  rw [show indexedVecCandidateInductiveStats.params[0]? =
+      some indexedVecValidationAlpha by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [indexedVecValidationGetTypeAlpha]
+  simp only [Except.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationParamIsDefEq]
+  simp only [if_true]
+  simpa [indexedVecValidationNilResult, ctorIndexedVecApp,
+    indexedVecKernelNil, indexedVecNilInfo, ConstantInfo.name,
+    ConstantInfo.toConstantVal,
+    Expr.instantiate1_eq, Expr.instantiate1',
+    Expr.liftLooseBVars_zero] using indexedVecValidationNilLoopTerminal
+
+@[simp] theorem indexedVecValidationConsumeNat :
+    AddInductive.consumeTypeAnnotations (.const ``Nat []) =
+      .const ``Nat [] := by
+  simp [AddInductive.consumeTypeAnnotations]
+
+@[simp] theorem indexedVecValidationConsumeAlpha :
+    AddInductive.consumeTypeAnnotations indexedVecValidationAlpha =
+      indexedVecValidationAlpha := by
+  rw [indexedVecValidationAlphaShape]
+  simp [AddInductive.consumeTypeAnnotations]
+
+@[simp] theorem indexedVecValidationConsumeTail :
+    AddInductive.consumeTypeAnnotations
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) =
+      ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr := by
+  simp [ctorIndexedVecApp, AddInductive.consumeTypeAnnotations]
+
+theorem indexedVecValidationConsLoopTerminal :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelCons.name indexedVecValidationConsResult 4 996
+      indexedVecValidationTailContext = .ok () := by
+  rw [show 996 = 995 + 1 by rfl]
+  have hvalid : AddInductive.isValidIndAppIdx
+      indexedVecCandidateInductiveStats
+      (((.const ``IndexedVec [.param `u] : Expr).app
+        (.fvar indexedVecValidationAlphaId)).app
+          ((.const ``Nat.succ [] : Expr).app
+            (.fvar indexedVecValidationNId))) 0 = true := by
+    simpa [indexedVecValidationConsResult, ctorIndexedVecApp,
+      replaySuccApp, indexedVecValidationAlphaShape,
+      indexedVecValidationNExprShape] using
+        indexedVecValidationConsResultIsValid
+  unfold indexedVecValidationConsResult ctorIndexedVecApp replaySuccApp
+  unfold AddInductive.checkConstructorType.loop
+  simp [hvalid, ReaderT.pure, Pure.pure, Except.pure]
+
+theorem indexedVecValidationConsLoopTail :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelCons.name indexedVecValidationConsAfterHead 3 997
+      indexedVecValidationHeadContext = .ok () := by
+  rw [show 997 = 996 + 1 by rfl]
+  unfold indexedVecValidationConsAfterHead
+  unfold AddInductive.checkConstructorType.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[3]? = none by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationTailEnsureTypeM]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.levelStructGe
+      indexedVecCandidateInductiveStats.resultLevel
+      (Expr.sort (.succ (.param `u))).sortLevel! = true from by
+    simp [Expr.sortLevel!, indexedVecCandidateInductiveStats_resultLevel,
+      AddInductive.levelStructGe, AddInductive.levelStructEq])]
+  simp only [↓reduceIte, Bool.not_false, ReaderT.bind, Bind.bind, Except.bind]
+  rw [indexedVecValidationTailPositivity]
+  rw [AddInductive.withLocalDecl_apply]
+  rw [indexedVecValidationConsumeTail]
+  rw [show (ctorIndexedVecApp indexedVecValidationAlpha
+      (replaySuccApp indexedVecValidationNExpr)).instantiate1
+        indexedVecValidationHeadContext.freshExpr =
+      indexedVecValidationConsResult by
+    simp [indexedVecValidationConsResult, ctorIndexedVecApp,
+      replaySuccApp, Expr.instantiate1_eq, Expr.instantiate1']]
+  simpa [indexedVecValidationTailContext,
+    AddInductive.Context.pushLocalDecl,
+    ReaderT.pure, Pure.pure, Except.pure] using
+      indexedVecValidationConsLoopTerminal
+
+theorem indexedVecValidationConsLoopHead :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelCons.name indexedVecValidationConsAfterN 2 998
+      indexedVecValidationNContext = .ok () := by
+  rw [show 998 = 997 + 1 by rfl]
+  unfold indexedVecValidationConsAfterN
+  unfold AddInductive.checkConstructorType.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[2]? = none by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationAlphaEnsureTypeM]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.levelStructGe
+      indexedVecCandidateInductiveStats.resultLevel
+      (Expr.sort (.succ (.param `u))).sortLevel! = true from by
+    simp [Expr.sortLevel!, indexedVecCandidateInductiveStats_resultLevel,
+      AddInductive.levelStructGe, AddInductive.levelStructEq])]
+  simp only [↓reduceIte, Bool.not_false, ReaderT.bind, Bind.bind, Except.bind]
+  rw [indexedVecValidationAlphaPositivity]
+  rw [AddInductive.withLocalDecl_apply]
+  rw [indexedVecValidationConsumeAlpha]
+  rw [show
+      ((.forallE consTailName
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr)
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          (replaySuccApp indexedVecValidationNExpr))
+        .default : Expr).instantiate1
+          indexedVecValidationNContext.freshExpr) =
+        indexedVecValidationConsAfterHead by
+    simp [indexedVecValidationConsAfterHead,
+      ctorIndexedVecApp, replaySuccApp,
+      Expr.instantiate1_eq, Expr.instantiate1']]
+  simpa [indexedVecValidationHeadContext,
+    AddInductive.Context.pushLocalDecl,
+    ReaderT.pure, Pure.pure, Except.pure] using
+      indexedVecValidationConsLoopTail
+
+theorem indexedVecValidationConsLoopN :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelCons.name indexedVecValidationConsAfterParam 1 999
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show 999 = 998 + 1 by rfl]
+  rw [indexedVecValidationConsAfterParamExplicitShape]
+  unfold AddInductive.checkConstructorType.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[1]? = none by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationNatEnsureTypeM]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.levelStructGe
+      indexedVecCandidateInductiveStats.resultLevel
+      (Expr.sort (.succ .zero)).sortLevel! = true from by
+    simp [Expr.sortLevel!, indexedVecCandidateInductiveStats_resultLevel,
+      AddInductive.levelStructGe])]
+  simp only [↓reduceIte, Bool.not_false, ReaderT.bind, Bind.bind, Except.bind]
+  rw [indexedVecValidationNatPositivity]
+  rw [AddInductive.withLocalDecl_apply]
+  rw [indexedVecValidationConsumeNat]
+  rw [show
+      ((.forallE consHeadName indexedVecValidationAlpha
+        (.forallE consTailName
+          (ctorIndexedVecApp indexedVecValidationAlpha (.bvar 1))
+          (ctorIndexedVecApp indexedVecValidationAlpha
+            (replaySuccApp (.bvar 2)))
+          .default)
+        .default : Expr).instantiate1
+          indexedVecCtorValidationContext.freshExpr) =
+        indexedVecValidationConsAfterN by
+    simp [indexedVecValidationConsAfterN,
+      ctorIndexedVecApp, replaySuccApp,
+      indexedVecValidationNExpr,
+      AddInductive.Context.freshExpr,
+      Expr.instantiate1_eq, Expr.instantiate1']]
+  simpa [indexedVecValidationNContext,
+    AddInductive.Context.pushLocalDecl,
+    ReaderT.pure, Pure.pure, Except.pure] using
+      indexedVecValidationConsLoopHead
+
+theorem indexedVecValidationConsLoop :
+    AddInductive.checkConstructorType.loop
+      indexedVecCandidateInductiveStats false 0
+      indexedVecKernelCons.name indexedVecKernelCons.type 0
+      indexedVecCtorValidationContext.fuel.inductiveFuel
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show indexedVecCtorValidationContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  rw [show indexedVecKernelCons.type = consCtorTypeRaw by
+    simpa [indexedVecKernelCons] using consInfoTypeShape]
+  unfold consCtorTypeRaw
+  unfold AddInductive.checkConstructorType.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[0]? =
+      some indexedVecValidationAlpha by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [indexedVecValidationGetTypeAlpha]
+  simp only [Except.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationParamIsDefEq]
+  simp only [if_true]
+  simpa [indexedVecValidationConsAfterParam] using
+    indexedVecValidationConsLoopN
+
+theorem indexedVecValidationNilUniverseLoopTerminal :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecValidationNilResult 1 999
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show 999 = 998 + 1 by rfl]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  rfl
+
+theorem indexedVecValidationNilUniverseLoop :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecKernelNil.type 0
+      indexedVecCtorValidationContext.fuel.inductiveFuel
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show indexedVecCtorValidationContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  simp only [indexedVecKernelNil, indexedVecNilInfo,
+    ConstantInfo.type, ConstantInfo.toConstantVal]
+  rw [show indexedVecCandidateInductiveStats.params[0]? =
+      some indexedVecValidationAlpha by
+    simp [indexedVecValidationStatsParams]]
+  simpa [indexedVecValidationNilResult, ctorIndexedVecApp,
+    indexedVecKernelNil, indexedVecNilInfo, ConstantInfo.toConstantVal,
+    Expr.instantiate1_eq, Expr.instantiate1',
+    Expr.liftLooseBVars_zero] using
+      indexedVecValidationNilUniverseLoopTerminal
+
+theorem indexedVecValidationConsUniverseLoopTerminal :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecValidationConsResult 4 996
+      indexedVecValidationTailContext = .ok () := by
+  rw [show 996 = 995 + 1 by rfl]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  rfl
+
+theorem indexedVecValidationConsUniverseLoopTail :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecValidationConsAfterHead 3 997
+      indexedVecValidationHeadContext = .ok () := by
+  rw [show 997 = 996 + 1 by rfl]
+  unfold indexedVecValidationConsAfterHead
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[3]? = none by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind, AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationTailEnsureTypeM]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.constructorUniverseSemanticGe
+      indexedVecCandidateInductiveStats.resultLevel
+      (Expr.sort (.succ (.param `u))).sortLevel! = true from by
+    simp [Expr.sortLevel!, AddInductive.constructorUniverseSemanticGe,
+      indexedVecCandidateInductiveStats_resultLevel,
+      AddInductive.levelStructGe, AddInductive.levelStructEq])]
+  rw [AddInductive.withLocalDecl_apply]
+  simpa [indexedVecValidationTailContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.consumeTypeAnnotations,
+    indexedVecValidationConsResult, ctorIndexedVecApp,
+    replaySuccApp, Expr.instantiate1_eq, Expr.instantiate1'] using
+      indexedVecValidationConsUniverseLoopTerminal
+
+theorem indexedVecValidationConsUniverseLoopHead :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecValidationConsAfterN 2 998
+      indexedVecValidationNContext = .ok () := by
+  rw [show 998 = 997 + 1 by rfl]
+  unfold indexedVecValidationConsAfterN
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[2]? = none by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind, AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationAlphaEnsureTypeM]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.constructorUniverseSemanticGe
+      indexedVecCandidateInductiveStats.resultLevel
+      (Expr.sort (.succ (.param `u))).sortLevel! = true from by
+    simp [Expr.sortLevel!, AddInductive.constructorUniverseSemanticGe,
+      indexedVecCandidateInductiveStats_resultLevel,
+      AddInductive.levelStructGe, AddInductive.levelStructEq])]
+  rw [AddInductive.withLocalDecl_apply]
+  simpa [indexedVecValidationHeadContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.consumeTypeAnnotations,
+    indexedVecValidationConsAfterHead,
+    ctorIndexedVecApp, replaySuccApp,
+    Expr.instantiate1_eq, Expr.instantiate1'] using
+      indexedVecValidationConsUniverseLoopTail
+
+theorem indexedVecValidationConsUniverseLoopN :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecValidationConsAfterParam 1 999
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show 999 = 998 + 1 by rfl]
+  rw [indexedVecValidationConsAfterParamExplicitShape]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[1]? = none by
+    simp [indexedVecValidationStatsParams]]
+  simp only [ReaderT.bind, Bind.bind, AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationNatEnsureTypeM]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.constructorUniverseSemanticGe
+      indexedVecCandidateInductiveStats.resultLevel
+      (Expr.sort (.succ .zero)).sortLevel! = true from by
+    simp [Expr.sortLevel!, AddInductive.constructorUniverseSemanticGe,
+      indexedVecCandidateInductiveStats_resultLevel,
+      AddInductive.levelStructGe])]
+  rw [AddInductive.withLocalDecl_apply]
+  simpa [indexedVecValidationNContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.consumeTypeAnnotations,
+    indexedVecValidationConsAfterN,
+    ctorIndexedVecApp, replaySuccApp,
+    indexedVecValidationNExpr,
+    AddInductive.Context.freshExpr,
+    Expr.instantiate1_eq, Expr.instantiate1'] using
+      indexedVecValidationConsUniverseLoopHead
+
+theorem indexedVecValidationConsUniverseLoop :
+    AddInductive.checkConstructorUniverseSemantics.loop
+      indexedVecCandidateInductiveStats indexedVecKernelCons.type 0
+      indexedVecCtorValidationContext.fuel.inductiveFuel
+      indexedVecCtorValidationContext = .ok () := by
+  rw [show indexedVecCtorValidationContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  rw [show indexedVecKernelCons.type = consCtorTypeRaw by
+    simpa [indexedVecKernelCons] using consInfoTypeShape]
+  unfold consCtorTypeRaw
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  simp only
+  rw [show indexedVecCandidateInductiveStats.params[0]? =
+      some indexedVecValidationAlpha by
+    simp [indexedVecValidationStatsParams]]
+  simpa [indexedVecValidationConsAfterParam] using
+    indexedVecValidationConsUniverseLoopN
+
+theorem indexedVecValidationNilUniverseRun :
+    AddInductive.checkConstructorUniverseSemantics
+      indexedVecCandidateInductiveStats indexedVecKernelNil.type
+      indexedVecCtorValidationContext = .ok () := by
+  unfold AddInductive.checkConstructorUniverseSemantics
+  simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure] using indexedVecValidationNilUniverseLoop
+
+theorem indexedVecValidationConsUniverseRun :
+    AddInductive.checkConstructorUniverseSemantics
+      indexedVecCandidateInductiveStats indexedVecKernelCons.type
+      indexedVecCtorValidationContext = .ok () := by
+  unfold AddInductive.checkConstructorUniverseSemantics
+  simpa only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure] using indexedVecValidationConsUniverseLoop
+
+/-- Both source-ordered `IndexedVec` constructors pass the executable verified
+universe gate. -/
+theorem indexedVecValidationCheckConstructorUniverseSemantics :
+    AddInductive.checkConstructorUniverseListSemantics
+      indexedVecCandidateInductiveStats indexedVecKernelType.ctors
+      indexedVecCtorValidationContext = .ok () := by
+  unfold AddInductive.checkConstructorUniverseListSemantics
+  simp only [indexedVecKernelType, ReaderT.bind, Bind.bind]
+  rw [indexedVecValidationNilUniverseRun]
+  simp only [Except.bind]
+  unfold AddInductive.checkConstructorUniverseListSemantics
+  simp only [ReaderT.bind, Bind.bind]
+  rw [indexedVecValidationConsUniverseRun]
+  rfl
+
+theorem indexedVecValidationGetEnvM :
+    TypeChecker.M.run indexedVecCtorValidationContext.env
+        indexedVecCtorValidationContext.safety
+        indexedVecCtorValidationContext.lctx
+        indexedVecCtorValidationContext.lparams
+        indexedVecCtorValidationContext.fuel TypeChecker.getEnv =
+      .ok ctorEnv := by
+  rfl
+
+theorem indexedVecValidationEmptyDoesNotContainNil :
+    (∅ : NameSet).contains indexedVecKernelNil.name = false := by
+  simp +decide
+
+theorem indexedVecValidationNilSetDoesNotContainCons :
+    ((∅ : NameSet).insert indexedVecKernelNil.name).contains
+      indexedVecKernelCons.name = false := by
+  simp only [indexedVecKernelNil, indexedVecKernelCons,
+    indexedVecNilInfo, indexedVecConsInfo,
+    ConstantInfo.name, ConstantInfo.toConstantVal,
+    NameSet.contains, NameSet.insert]
+  rw [Std.TreeSet.contains_insert (t := (∅ : NameSet))]
+  simp +decide
+
+set_option linter.unusedSimpArgs false in
+theorem indexedVecValidationCheckConstructors :
+    AddInductive.checkConstructors #[indexedVecKernelType]
+      indexedVecCandidateInductiveStats false
+      indexedVecCtorValidationContext = .ok () := by
+  unfold AddInductive.checkConstructors
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationGetEnvM]
+  simp only [Except.bind]
+  unfold AddInductive.checkConstructorsLoop AddInductive.checkConstructorFold
+  simp only [indexedVecKernelType, List.toList_toArray,
+    ReaderT.bind, Bind.bind, Except.bind]
+  rw [indexedVecValidationEmptyDoesNotContainNil]
+  simp only [Bool.false_eq_true, if_false,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  rw [indexedVecNilNoMVarNoFVar]
+  simp only [ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure, AddInductive.liftExcept_apply]
+  rw [AddInductive.withEmptyLocalContext_apply]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationNilRootCheckTypeM]
+  unfold AddInductive.checkConstructorType
+  simp only [Except.bind, readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure, Except.pure]
+  rw [indexedVecValidationNilLoop]
+  unfold AddInductive.checkConstructorFold
+  simp only [Except.bind, ReaderT.pure, Pure.pure, Except.pure]
+  rw [indexedVecValidationNilSetDoesNotContainCons]
+  simp only [Bool.false_eq_true, if_false,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  rw [indexedVecConsNoMVarNoFVar]
+  simp only [ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure, AddInductive.liftExcept_apply]
+  rw [AddInductive.withEmptyLocalContext_apply]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [indexedVecValidationConsRootCheckTypeM]
+  unfold AddInductive.checkConstructorType
+  simp only [Except.bind, readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure, Except.pure]
+  rw [indexedVecValidationConsLoop]
+  unfold AddInductive.checkConstructorFold
+  rfl
+
+/-- The complete one-parameter, one-index IndexedVec request produces the
+exact ordered family/nil/cons normalization candidate. -/
+theorem indexedVecNormalizationCandidateProduced :
+    AddInductive.buildNormalizationCandidate 1
+        [indexedVecKernelType] 0 false
+        indexedVecFamilyCandidateContext =
+      .ok indexedVecNormalizationCandidate := by
+  unfold AddInductive.buildNormalizationCandidate
+  rw [indexedVec_checkInductiveTypes]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [show
+    (withReader (fun _ : AddInductive.Context =>
+        { indexedVecFamilyCandidateContext with lctx := {} })
+      (AddInductive.normalizeCandidateFamilyTypeList
+        [indexedVecKernelType])) indexedVecFamilyCandidate.trace.terminalContext =
+      .ok (.cons indexedVecFamilyListCandidate.familyType .nil) by
+    simpa using indexedVecFamilyTypeListCandidateProduced]
+  simp only [Except.bind]
+  rw [indexedVecDeclareFromTerminal]
+  unfold AddInductive.withEnv
+  change (ReaderT.bind
+      (AddInductive.checkConstructors #[indexedVecKernelType]
+        indexedVecCandidateInductiveStats false)
+      (fun _ => ReaderT.bind
+        (fun _ : AddInductive.Context =>
+          AddInductive.normalizeCandidateFamilyList
+            (.cons indexedVecFamilyListCandidate.familyType .nil)
+            ctorContext)
+        (fun families => pure
+          (⟨families⟩ : AddInductive.NormalizationCandidate
+            [indexedVecKernelType]))))
+      indexedVecCtorValidationContext = _
+  simp only [ReaderT.bind, Bind.bind]
+  rw [indexedVecValidationCheckConstructors]
+  simp only [Except.bind]
+  rw [indexedVecFamilyListCandidateProduced]
+  rfl
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecNormalizationCandidateProduced [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/IndexedVecSemanticReplay.lean b/Ix/Theory/Named/Verify/Environment/IndexedVecSemanticReplay.lean
new file mode 100644
index 000000000..1a12306a7
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/IndexedVecSemanticReplay.lean
@@ -0,0 +1,3540 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.IndexedVecOuterReplay
+
+/-!
+# Complete semantic replay of the IndexedVec normalization candidate
+
+This module connects the exact executable family/`nil`/`cons` candidate
+produced by `buildNormalizationCandidate` to its Theory generation
+certificate and the E1 kernel-environment replay. Every retained candidate
+node is interpreted in its exact pre-family or post-family verifier context;
+the final transaction therefore consumes the certificate projected from the
+same producer-selected package rather than an independently supplied
+well-formedness proof.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta
+open Ix.Theory.Named.InductiveFixtures
+open IndexedVecConsReplay
+
+theorem indexedVecSemanticNatHasPrimitives : VEnv.HasPrimitives natFinalEnv := by
+  have absent (n : Name) (hlookup : natFinalEnv.constants n = none) :
+      ¬ natFinalEnv.contains n := by
+    rintro ⟨ci, hci⟩
+    rw [hlookup] at hci
+    contradiction
+  refine {
+    bool := fun h => (absent ``Bool rfl h).elim
+    boolFalse := fun h => by
+      change none = some _ at h
+      contradiction
+    boolTrue := fun h => by
+      change none = some _ at h
+      contradiction
+    nat := fun _ => ⟨⟨_, rfl⟩, ⟨_, rfl⟩⟩
+    natZero := fun h => by
+      change some natType.ctors[0].toVConstant = some _ at h
+      exact (Option.some.inj h).symm
+    natSucc := fun h => by
+      change some natType.ctors[1].toVConstant = some _ at h
+      exact (Option.some.inj h).symm
+    natAdd := fun h => (absent ``Nat.add rfl h).elim
+    natSub := fun h => (absent ``Nat.sub rfl h).elim
+    natMul := fun h => (absent ``Nat.mul rfl h).elim
+    natPow := fun h => (absent ``Nat.pow rfl h).elim
+    natGcd := fun h => (absent ``Nat.gcd rfl h).elim
+    natMod := fun h => (absent ``Nat.mod rfl h).elim
+    natDiv := fun h => (absent ``Nat.div rfl h).elim
+    natBEq := fun h => (absent ``Nat.beq rfl h).elim
+    natBLE := fun h => (absent ``Nat.ble rfl h).elim
+    natLAnd := fun h => (absent ``Nat.land rfl h).elim
+    natLOr := fun h => (absent ``Nat.lor rfl h).elim
+    natXor := fun h => (absent ``Nat.xor rfl h).elim
+    natShiftLeft := fun h => (absent ``Nat.shiftLeft rfl h).elim
+    natShiftRight := fun h => (absent ``Nat.shiftRight rfl h).elim
+    charOfNat := fun h => by
+      change none = some _ at h
+      contradiction
+    stringOfList := fun h => by
+      change none = some _ at h
+      contradiction }
+
+theorem indexedVecSemanticNatSafePrimitives :
+    indexedVecKernelEnv.find? n = some ci →
+      Kernel.Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [] := by
+  intro hfind hprim
+  change natMap.find?' n = some ci at hfind
+  rw [natMap_wf.find?'_eq_find?, natMap,
+    natCtorMap_wf.find?_insert] at hfind
+  split at hfind
+  · rename_i heq
+    simp at heq
+    subst n
+    simp at hfind
+    subst ci
+    simp [Kernel.Environment.primitives, NameSet.ofList] at hprim
+    simp +decide [NameSet.contains] at hprim
+  · rw [natCtorMap, natZeroMap_wf.find?_insert] at hfind
+    split at hfind
+    · rename_i heq
+      simp at heq
+      subst n
+      simp at hfind
+      subst ci
+      exact ⟨rfl, rfl⟩
+    · rw [natZeroMap, natTypeMap_wf.find?_insert] at hfind
+      split at hfind
+      · rename_i heq
+        simp at heq
+        subst n
+        simp at hfind
+        subst ci
+        exact ⟨rfl, rfl⟩
+      · rw [natTypeMap,
+          SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+          at hfind
+        split at hfind
+        · rename_i heq
+          simp at heq
+          subst n
+          simp at hfind
+          subst ci
+          exact ⟨rfl, rfl⟩
+        · simp [SMap.find?] at hfind
+
+theorem indexedVecKernelEnv_noProjectionReady (name : Name) :
+    indexedVecKernelEnv.isProjectionReadyStructure name = false := by
+  simp only [indexedVecKernelEnv,
+    Kernel.Environment.isProjectionReadyStructure,
+    Kernel.Environment.ofConstants]
+  simp only [natMap_wf.find?'_eq_find?]
+  simp only [natMap, natCtorMap_wf.find?_insert]
+  simp only [natCtorMap, natZeroMap_wf.find?_insert]
+  simp only [natZeroMap, natTypeMap_wf.find?_insert]
+  simp only [natTypeMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  by_cases hRec : ``Nat.rec = name
+  · subst name
+    simp [natRecInfo]
+  · by_cases hSucc : ``Nat.succ = name
+    · subst name
+      simp [hRec, natSuccInfo]
+    · by_cases hZero : ``Nat.zero = name
+      · subst name
+        simp [hRec, hSucc, natZeroInfo]
+      · by_cases hNat : ``Nat = name
+        · subst name
+          simp [hRec, hSucc, hZero, natInfo]
+        · simp [hRec, hSucc, hZero, hNat, SMap.find?]
+
+theorem indexedVecKernelEnv_noStructureEta (name : Name) :
+    indexedVecKernelEnv.isNonRecStructure name = false := by
+  simp only [indexedVecKernelEnv, Kernel.Environment.isNonRecStructure,
+    Kernel.Environment.ofConstants, Kernel.Environment.find?]
+  simp only [natMap_wf.find?'_eq_find?]
+  simp only [natMap, natCtorMap_wf.find?_insert]
+  simp only [natCtorMap, natZeroMap_wf.find?_insert]
+  simp only [natZeroMap, natTypeMap_wf.find?_insert]
+  simp only [natTypeMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  by_cases hRec : ``Nat.rec = name
+  · subst name
+    simp [natRecInfo]
+  · by_cases hSucc : ``Nat.succ = name
+    · subst name
+      simp [hRec, natSuccInfo]
+    · by_cases hZero : ``Nat.zero = name
+      · subst name
+        simp [hRec, hSucc, natZeroInfo]
+      · by_cases hNat : ``Nat = name
+        · subst name
+          simp [hRec, hSucc, hZero, natInfo]
+        · simp [hRec, hSucc, hZero, hNat, SMap.find?]
+
+theorem indexedVecTypeEnv_noProjectionReady (name : Name) :
+    ctorContext.env.isProjectionReadyStructure name = false := by
+  simp only [ctorContext, ctorEnv,
+    Kernel.Environment.isProjectionReadyStructure,
+    Kernel.Environment.ofConstants]
+  simp only [indexedVecTypeMap_wf.find?'_eq_find?]
+  simp only [indexedVecTypeMap, natMap_wf.find?_insert]
+  simp only [natMap, natCtorMap_wf.find?_insert]
+  simp only [natCtorMap, natZeroMap_wf.find?_insert]
+  simp only [natZeroMap, natTypeMap_wf.find?_insert]
+  simp only [natTypeMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  by_cases hVec : ``IndexedVec = name
+  · subst name
+    simp [indexedVecInfo]
+  · by_cases hRec : ``Nat.rec = name
+    · subst name
+      simp [hVec, natRecInfo]
+    · by_cases hSucc : ``Nat.succ = name
+      · subst name
+        simp [hVec, hRec, natSuccInfo]
+      · by_cases hZero : ``Nat.zero = name
+        · subst name
+          simp [hVec, hRec, hSucc, natZeroInfo]
+        · by_cases hNat : ``Nat = name
+          · subst name
+            simp [hVec, hRec, hSucc, hZero, natInfo]
+          · simp [hVec, hRec, hSucc, hZero, hNat, SMap.find?]
+
+theorem indexedVecTypeEnv_noStructureEta (name : Name) :
+    ctorContext.env.isNonRecStructure name = false := by
+  simp only [ctorContext, ctorEnv, Kernel.Environment.isNonRecStructure,
+    Kernel.Environment.ofConstants, Kernel.Environment.find?]
+  simp only [indexedVecTypeMap_wf.find?'_eq_find?]
+  simp only [indexedVecTypeMap, natMap_wf.find?_insert]
+  simp only [natMap, natCtorMap_wf.find?_insert]
+  simp only [natCtorMap, natZeroMap_wf.find?_insert]
+  simp only [natZeroMap, natTypeMap_wf.find?_insert]
+  simp only [natTypeMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  by_cases hVec : ``IndexedVec = name
+  · subst name
+    simp [indexedVecInfo]
+  · by_cases hRec : ``Nat.rec = name
+    · subst name
+      simp [hVec, natRecInfo]
+    · by_cases hSucc : ``Nat.succ = name
+      · subst name
+        simp [hVec, hRec, natSuccInfo]
+      · by_cases hZero : ``Nat.zero = name
+        · subst name
+          simp [hVec, hRec, hSucc, natZeroInfo]
+        · by_cases hNat : ``Nat = name
+          · subst name
+            simp [hVec, hRec, hSucc, hZero, natInfo]
+          · simp [hVec, hRec, hSucc, hZero, hNat, SMap.find?]
+
+private theorem addConst_constants {env env' : VEnv} {name : Name}
+    {ci : VConstant} (hadd : env.addConst name ci = some env') (query : Name) :
+    env'.constants query =
+      if name = query then some ci else env.constants query := by
+  unfold VEnv.addConst at hadd
+  split at hadd <;> cases hadd
+  rfl
+
+private theorem structureView_nparams_eq_zero_of_nat
+    {env : VEnv} {view : VStructureView} (hview : view.WF env)
+    (hname : ``Nat = view.name)
+    (hNat : env.constants ``Nat = some natType.toVConstant) :
+    view.nparams = 0 := by
+  have hfamily := hview.family
+  rw [← hname, hNat] at hfamily
+  have hsourceType : view.generation.block.sourceType.type = natType.type :=
+    congrArg VConstant.type (Option.some.inj hfamily).symm
+  have hshape := view.generation.shape_eq
+  simp only [VInductDecl.NormalizedChecked.generationShape, Bool.and_eq_true,
+    beq_iff_eq] at hshape
+  have hrawParamsLength := hshape.1.1.1.1.1
+  have hNatType : natType.type = .sort (.succ .zero) := rfl
+  rw [VInductDecl.NormalizedChecked.rawParams, hsourceType,
+    hNatType] at hrawParamsLength
+  cases hnp : view.source.nparams with
+  | zero => simpa using hnp
+  | succ _ =>
+    rw [hnp] at hrawParamsLength
+    simp [VExpr.telN] at hrawParamsLength
+
+private theorem natFinalEnv_structureView_nparams_eq_zero
+    {view : VStructureView} (hview : view.WF natFinalEnv) :
+    view.nparams = 0 := by
+  have hrec := hview.recursor
+  change natRecEnv.constants view.recursorName =
+    some view.generation.recursor at hrec
+  rw [addConst_constants
+      (show natCtorEnv.addConst ``Nat.rec
+        (VInductDecl.recConst 0 ``Nat 0 natType) = some natRecEnv from rfl),
+    addConst_constants
+      (show natZeroEnv.addConst natType.ctors[1].name
+        natType.ctors[1].toVConstant = some natCtorEnv from rfl),
+    addConst_constants
+      (show natTypeEnv.addConst natType.ctors[0].name
+        natType.ctors[0].toVConstant = some natZeroEnv from rfl),
+    addConst_constants
+      (show VEnv.empty.addConst natType.name natType.toVConstant =
+        some natTypeEnv from rfl)] at hrec
+  have hNatName : natType.name = ``Nat := rfl
+  have hZeroName : natType.ctors[0].name = ``Nat.zero := rfl
+  have hSuccName : natType.ctors[1].name = ``Nat.succ := rfl
+  rw [hNatName, hZeroName, hSuccName] at hrec
+  simp [VEnv.empty, VStructureView.recursorName] at hrec
+  exact structureView_nparams_eq_zero_of_nat hview hrec.1
+    nat_type_env_lookup
+
+private theorem indexedVecTypeEnv_structureView_nparams_eq_zero
+    {view : VStructureView} (hview : view.WF indexedVecTypeEnv) :
+    view.nparams = 0 := by
+  have hrec := hview.recursor
+  rw [addConst_constants
+      (show natFinalEnv.addConst indexedVecType.name
+        indexedVecType.toVConstant = some indexedVecTypeEnv from rfl)] at hrec
+  change (if indexedVecType.name = view.recursorName then
+      some indexedVecType.toVConstant else
+      natRecEnv.constants view.recursorName) =
+    some view.generation.recursor at hrec
+  rw [addConst_constants
+      (show natCtorEnv.addConst ``Nat.rec
+        (VInductDecl.recConst 0 ``Nat 0 natType) = some natRecEnv from rfl),
+    addConst_constants
+      (show natZeroEnv.addConst natType.ctors[1].name
+        natType.ctors[1].toVConstant = some natCtorEnv from rfl),
+    addConst_constants
+      (show natTypeEnv.addConst natType.ctors[0].name
+        natType.ctors[0].toVConstant = some natZeroEnv from rfl),
+    addConst_constants
+      (show VEnv.empty.addConst natType.name natType.toVConstant =
+        some natTypeEnv from rfl)] at hrec
+  have hVecName : indexedVecType.name = ``IndexedVec := rfl
+  have hNatName : natType.name = ``Nat := rfl
+  have hZeroName : natType.ctors[0].name = ``Nat.zero := rfl
+  have hSuccName : natType.ctors[1].name = ``Nat.succ := rfl
+  rw [hVecName, hNatName, hZeroName, hSuccName] at hrec
+  simp [VEnv.empty, VStructureView.recursorName] at hrec
+  exact structureView_nparams_eq_zero_of_nat hview hrec.1 rfl
+
+private theorem natMap_constructor_numParams
+    {view : VStructureView} {info : ConstructorVal}
+    (hzero : view.nparams = 0)
+    (hfind : natMap.find? view.constructorName = some (.ctorInfo info)) :
+    info.numParams = view.nparams := by
+  rw [natMap, natCtorMap_wf.find?_insert] at hfind
+  split at hfind
+  · cases hfind
+  · rw [natCtorMap, natZeroMap_wf.find?_insert] at hfind
+    split at hfind
+    · simp [natSuccInfo] at hfind
+      cases hfind
+      exact hzero.symm
+    · rw [natZeroMap, natTypeMap_wf.find?_insert] at hfind
+      split at hfind
+      · simp [natZeroInfo] at hfind
+        cases hfind
+        exact hzero.symm
+      · rw [natTypeMap,
+          SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+          at hfind
+        split at hfind
+        · cases hfind
+        · simp [SMap.find?] at hfind
+
+def indexedVecSemanticNatVEnvs : VEnvs where
+  venv _ := natFinalEnv
+
+theorem indexedVecSemanticNatVEnvsWF : indexedVecSemanticNatVEnvs.WF indexedVecKernelEnv where
+  tr := by
+    intro safety
+    change TrEnv' _ natMap false natFinalEnv
+    exact nat_trEnv'
+  hasPrimitives := indexedVecSemanticNatHasPrimitives
+  safePrimitives := indexedVecSemanticNatSafePrimitives
+  mono := fun _ => .rfl
+  projectionReady := {
+    infer := by
+      intro name _info _hfind hready
+      rw [indexedVecKernelEnv_noProjectionReady] at hready
+      contradiction
+    constructorNumParams := by
+      intro view info hview hfind
+      change natMap.find?' view.constructorName =
+        some (.ctorInfo info) at hfind
+      rw [natMap_wf.find?'_eq_find?] at hfind
+      exact natMap_constructor_numParams
+        (natFinalEnv_structureView_nparams_eq_zero hview) hfind }
+  structureEtaReady := StructureEtaReady.of_no_nonRecStructure
+    indexedVecKernelEnv_noStructureEta
+
+def indexedVecSemanticAddType :
+    AddInductConstant .induct natMap natFinalEnv
+      indexedVecType.toVConstVal indexedVecTypeMap indexedVecTypeEnv where
+  info := indexedVecInfo
+  kind_eq := by simp [indexedVecInfo, InductConstantKind.Matches]
+  tr := indexedVecInfo_tr
+  map_fresh := by simpa [indexedVecType] using indexedVecType_fresh
+  env_add := rfl
+  map_add := rfl
+
+theorem indexedVecSemanticFamilyPrefixNe :
+    indexedVecFamilyCandidateContext.ngen.namePrefix ≠
+      (({} : TypeChecker.VState).ngen).namePrefix := by
+  decide
+
+def indexedVecSemanticFamilyContextRun :
+    TypeChecker.CandidateContextRun indexedVecFamilyCandidateContext :=
+  TypeChecker.CandidateContextRun.root indexedVecSemanticNatVEnvsWF rfl
+    indexedVecSemanticFamilyPrefixNe
+
+theorem indexedVecSemanticFamilySourceTr :
+    TrExprS natFinalEnv [`u] [] indexedVecInfo.type indexedVecType.type :=
+  indexedVecInfo_tr.1.2.2
+
+def indexedVecPreFamilyStage :
+    TypeChecker.CandidateSemanticStage indexedVecFamilyCandidateContext
+      natFinalEnv [`u] where
+  contextRun := indexedVecSemanticFamilyContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+
+def indexedVecFamilyValidationRun :
+    AddInductive.CandidateExprTrace.FamilyValidationRun
+      indexedVecKernelType indexedVecFamilyCandidate.trace where
+  nparams := 1
+  resultLevel := .succ (.param `u)
+  stats := indexedVecCandidateInductiveStats
+  stats_eq := rfl
+  terminal_eq := indexedVecFamilyCandidate_terminalResult
+  run := indexedVec_checkInductiveTypes
+
+def indexedVecFamilyStage :
+    VInductDecl.CandidateFamilyStagedInput
+      indexedVecFamilyCandidateContext ctorContext natFinalEnv [`u]
+      indexedVecFamilyListCandidate.familyType indexedVecType
+      indexedVecPreFamilyStage where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := {
+    context_eq := rfl
+    source_tr := indexedVecSemanticFamilySourceTr
+    whnfFuel := 9999
+    whnfDepth := rfl }
+  validation := indexedVecFamilyValidationRun
+  typeEnv := indexedVecTypeEnv
+  addInduct := indexedVecSemanticAddType
+  projectionReady := {
+    infer := by
+      intro name _info _hfind hready
+      rw [indexedVecTypeEnv_noProjectionReady] at hready
+      contradiction
+    constructorNumParams := by
+      intro view info hview hfind
+      change indexedVecTypeMap.find?' view.constructorName =
+        some (.ctorInfo info) at hfind
+      rw [indexedVecTypeMap_wf.find?'_eq_find?, indexedVecTypeMap,
+        natMap_wf.find?_insert] at hfind
+      split at hfind
+      · cases hfind
+      · exact natMap_constructor_numParams
+          (indexedVecTypeEnv_structureView_nparams_eq_zero hview) hfind }
+  structureEtaReady := StructureEtaReady.of_no_nonRecStructure
+    indexedVecTypeEnv_noStructureEta
+  family_lctx_eq := rfl
+  constructorContext_eq := rfl
+  quotInit_eq := rfl
+  name_not_reflected := by decide
+  name_not_primitive := by
+    simp [indexedVecType, Kernel.Environment.primitives,
+      NameSet.ofList]
+    simp +decide [NameSet.contains]
+
+def indexedVecSemanticCtorContextRun :
+    TypeChecker.CandidateContextRun ctorContext :=
+  indexedVecFamilyStage.postContextRun
+
+theorem indexedVecSemanticNilSourceTr :
+    TrExprS indexedVecTypeEnv [`u] [] indexedVecNilInfo.type
+      indexedVecType.ctors[0].type :=
+  indexedVecNilInfo_tr.1.2.2
+
+theorem indexedVecSemanticConsIsType :
+    indexedVecTypeEnv.IsType 1 [] indexedVecType.ctors[1].type := by
+  have hwf :=
+    (indexedVecChecked.wf_of_decl indexedVecDecl_wf).identityGeneration
+      nat_env_wf.ordered
+  have hctor := hwf.rawCtor_isType (envT := indexedVecTypeEnv) rfl
+    (ctor := indexedVecChecked.identityGeneration.block.ctorPairs[1])
+    (by simp)
+  simpa only [
+    show indexedVecDecl.uvars = 1 by rfl,
+    show indexedVecChecked.identityGeneration.block.ctorPairs[1].raw.type =
+      indexedVecType.ctors[1].type by rfl] using hctor
+
+theorem indexedVecSemanticConsSourceTr :
+    TrExprS indexedVecTypeEnv [`u] [] indexedVecConsInfo.type
+      indexedVecType.ctors[1].type := by
+  have hshape : TrTypeExpr indexedVecTypeEnv [`u] []
+      indexedVecConsInfo.type indexedVecType.ctors[1].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := indexedVecSemanticConsIsType
+  exact hshape.to_trExprS indexedVecTypeEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+def indexedVecStagedUniverseInput :
+    VInductDecl.StagedNormalizationCandidateUniverseInput
+      indexedVecFamilyCandidateContext ctorContext natFinalEnv [`u]
+      indexedVecNormalizationCandidate indexedVecDecl where
+  staged := {
+    raw := indexedVecType
+    raw_types_eq := rfl
+    declaration_uvars_eq := rfl
+    preFamily := indexedVecPreFamilyStage
+    family := indexedVecFamilyStage
+    validation_nparams_eq := rfl
+    constructorValidation :=
+      AddInductive.ConstructorValidationRun.of_run
+        indexedVecValidationCheckConstructors
+    constructors := .cons {
+      name_eq := rfl
+      uvars_eq := rfl
+      type := {
+        context_eq := rfl
+        source_tr := indexedVecSemanticNilSourceTr
+        whnfFuel := 9999
+        whnfDepth := rfl } } (.cons {
+      name_eq := rfl
+      uvars_eq := rfl
+      type := {
+        context_eq := rfl
+        source_tr := indexedVecSemanticConsSourceTr
+        whnfFuel := 9999
+        whnfDepth := rfl } } .nil)
+    familyTypesProduced := indexedVecFamilyTypeListProduced
+    familiesProduced := indexedVecFamilyListProduced }
+  universeRun := indexedVecValidationCheckConstructorUniverseSemantics
+
+/-- Generic automatic assembly joins the arbitrary-length operational list
+witnesses to the complete retained semantic hierarchy for the two-constructor
+fixture.  No expected normalized view is an input to this theorem. -/
+theorem indexedVecProducedSemanticHierarchy_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidateSemanticRun
+      indexedVecFamilyCandidateContext ctorContext natFinalEnv [`u]
+      indexedVecNormalizationCandidate indexedVecDecl) :=
+  indexedVecStagedUniverseInput.exists
+
+/-- The automatically assembled hierarchy retains both constructor headers in
+the producer's `nil`/`cons` source order.  This inspects the semantic result,
+not the separately constructed concrete replay below. -/
+theorem indexedVecProducedSemanticHierarchy_constructorHeaders :
+    ∃ run : VInductDecl.ProducedNormalizationCandidateSemanticRun
+        indexedVecFamilyCandidateContext ctorContext natFinalEnv [`u]
+        indexedVecNormalizationCandidate indexedVecDecl,
+      VInductDecl.sameCtorHeaders indexedVecType.ctors
+        run.semantic.family.root.constructors.views = true := by
+  obtain ⟨run⟩ := indexedVecProducedSemanticHierarchy_exists
+  have hraw : run.semantic.raw = indexedVecType := by
+    have htypes : [indexedVecType] = [run.semantic.raw] := by
+      simpa [indexedVecDecl] using run.semantic.raw_types_eq
+    injection htypes with h
+    exact h.symm
+  exact ⟨run, by
+    simpa only [hraw] using
+      run.semantic.family.root.constructors.sameHeaders⟩
+
+/-! ## Post-family constructor alignment -/
+
+private theorem indexedVecValidationSortCheckTypeM (lctx : LocalContext) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.checkType (.sort (.succ (.param `u)))) =
+        .ok (.sort (.succ (.succ (.param `u)))) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType'
+      (.sort (.succ (.param `u))) false
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    checkLevelSuccParam, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rfl
+
+private def indexedVecValidationZeroState (alphaId : FVarId) :
+    TypeChecker.State :=
+  replayInsert (validationFirstAppState alphaId)
+    (.const ``Nat.zero []) (.const ``Nat [])
+
+private def indexedVecValidationZeroFinalState (alphaId : FVarId) :
+    TypeChecker.State :=
+  replayInsert (indexedVecValidationZeroState alphaId)
+    (ctorIndexedVecApp (.fvar alphaId) (.const ``Nat.zero []))
+    (.sort (.succ (.param `u)))
+
+private theorem indexedVecValidationZeroCheckTypeM
+    (lctx : LocalContext) (alphaId : FVarId)
+    (halpha : lctx.find? alphaId = some (.cdecl alphaIndex alphaId
+      alphaName (.sort (.succ (.param `u))) alphaBi alphaKind)) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.checkType
+        (ctorIndexedVecApp (.fvar alphaId) (.const ``Nat.zero []))) =
+      .ok (.sort (.succ (.param `u))) := by
+  have hfirst :
+      TypeChecker.Inner.inferType' (replayFirstApp (.fvar alphaId)) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        ({} : TypeChecker.State) =
+      .ok (vecFamilyTail, validationFirstAppState alphaId) := by
+    simpa [validationFirstAppState] using
+      (replayInferFirstAppFVarCore 9999 lctx
+        ({} : TypeChecker.State) alphaId
+        (by simp)
+        (by simp [replayInsert])
+        (by simp [replayFirstApp]) halpha)
+  have hzero :
+      TypeChecker.Inner.inferType' (.const ``Nat.zero []) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        (validationFirstAppState alphaId) =
+      .ok (.const ``Nat [], indexedVecValidationZeroState alphaId) := by
+    simpa [indexedVecValidationZeroState, replayInsert] using
+      (inferTypeZeroCore 9999 lctx (validationFirstAppState alphaId)
+        (by simp [validationFirstAppState, replayInsert,
+          replayFirstApp]))
+  have hresult :
+      TypeChecker.Inner.inferType'
+        (ctorIndexedVecApp (.fvar alphaId) (.const ``Nat.zero [])) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.param `u)),
+        indexedVecValidationZeroFinalState alphaId) := by
+    simpa [indexedVecValidationZeroFinalState] using
+      (replayInferIndexedVecAppCore 9999 lctx
+        ({} : TypeChecker.State) (validationFirstAppState alphaId)
+        (indexedVecValidationZeroState alphaId) (.fvar alphaId)
+        (.const ``Nat.zero [])
+        (by simp [ctorIndexedVecApp, Expr.hasLooseBVars,
+          Expr.looseBVarRange'])
+        (by simp [ctorIndexedVecApp])
+        hfirst hzero (by rfl))
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar alphaId) (.const ``Nat.zero [])) false
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [hresult]
+  rfl
+
+private def indexedVecValidationSuccState
+    (alphaId nId : FVarId) : TypeChecker.State :=
+  replayInsert
+    (replayInsert
+      (replayInsert (validationFirstAppState alphaId)
+        (.const ``Nat.succ [])
+        (.forallE `n (.const ``Nat []) (.const ``Nat []) .default))
+      (.fvar nId) (.const ``Nat []))
+    (replaySuccApp (.fvar nId)) (.const ``Nat [])
+
+private def indexedVecValidationSuccFinalState
+    (alphaId nId : FVarId) : TypeChecker.State :=
+  replayInsert (indexedVecValidationSuccState alphaId nId)
+    (ctorIndexedVecApp (.fvar alphaId) (replaySuccApp (.fvar nId)))
+    (.sort (.succ (.param `u)))
+
+private theorem indexedVecValidationSuccCheckTypeM
+    (lctx : LocalContext) (alphaId nId : FVarId)
+    (hne : alphaId ≠ nId)
+    (halpha : lctx.find? alphaId = some (.cdecl alphaIndex alphaId
+      alphaName (.sort (.succ (.param `u))) alphaBi alphaKind))
+    (hn : lctx.find? nId = some (.cdecl nIndex nId nName
+      (.const ``Nat []) nBi nKind)) :
+    TypeChecker.M.run ctorEnv .safe lctx [`u] ({} : FuelConfig)
+      (TypeChecker.checkType
+        (ctorIndexedVecApp (.fvar alphaId)
+          (replaySuccApp (.fvar nId)))) =
+      .ok (.sort (.succ (.param `u))) := by
+  have hfirst :
+      TypeChecker.Inner.inferType' (replayFirstApp (.fvar alphaId)) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        ({} : TypeChecker.State) =
+      .ok (vecFamilyTail, validationFirstAppState alphaId) := by
+    simpa [validationFirstAppState] using
+      (replayInferFirstAppFVarCore 9999 lctx
+        ({} : TypeChecker.State) alphaId
+        (by simp)
+        (by simp [replayInsert])
+        (by simp [replayFirstApp]) halpha)
+  have hsucc :
+      TypeChecker.Inner.inferType' (replaySuccApp (.fvar nId)) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        (validationFirstAppState alphaId) =
+      .ok (.const ``Nat [], indexedVecValidationSuccState alphaId nId) := by
+    simpa [indexedVecValidationSuccState] using
+      (replayInferSuccFVarCore 9999 lctx
+        (validationFirstAppState alphaId) nId
+        (by simp [validationFirstAppState, replayInsert,
+          replayFirstApp])
+        (by
+          simp only [validationFirstAppState, replayInsert,
+            Std.HashMap.getElem?_insert]
+          rw [constBeqFVar]
+          rw [show (replayFirstApp (.fvar alphaId) ==
+              (.fvar nId : Expr)) = false by
+            simp [replayFirstApp]]
+          rw [show ((.fvar alphaId : Expr) == .fvar nId) = false by
+            change Expr.eqv (.fvar alphaId) (.fvar nId) = false
+            rw [Expr.eqv_eq]
+            simp [Expr.eqv', hne]]
+          rw [constBeqFVar]
+          simp)
+        (by simp [validationFirstAppState, replayInsert,
+          replaySuccApp])
+        hn)
+  have hresult :
+      TypeChecker.Inner.inferType'
+        (ctorIndexedVecApp (.fvar alphaId)
+          (replaySuccApp (.fvar nId))) false
+        (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+        ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.param `u)),
+        indexedVecValidationSuccFinalState alphaId nId) := by
+    simpa [indexedVecValidationSuccFinalState] using
+      (replayInferIndexedVecAppCore 9999 lctx
+        ({} : TypeChecker.State) (validationFirstAppState alphaId)
+        (indexedVecValidationSuccState alphaId nId) (.fvar alphaId)
+        (replaySuccApp (.fvar nId))
+        (by simp [ctorIndexedVecApp, replaySuccApp,
+          Expr.hasLooseBVars, Expr.looseBVarRange'])
+        (by simp [ctorIndexedVecApp, replaySuccApp])
+        hfirst hsucc (by rfl))
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType'
+      (ctorIndexedVecApp (.fvar alphaId)
+        (replaySuccApp (.fvar nId))) false
+      (TypeChecker.Methods.withFuel 9999) (tcContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [hresult]
+  rfl
+
+private theorem indexedVecValidationHeadContextFresh :
+    indexedVecValidationHeadContext.lctx.find?
+      indexedVecValidationHeadContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := indexedVecValidationHeadContext.freshFVarId)
+    indexedVecValidationHeadContextWF
+  rw [h]
+  simp only [indexedVecValidationHeadContext,
+    indexedVecValidationNContext, indexedVecCtorValidationContext,
+    indexedVecValidationTerminalContextShape,
+    indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext,
+    indexedVecFamilyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId]
+  rw [LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList,
+    LocalContext.mkLocalDecl_toList]
+  rw [show ({} : LocalContext).toList = [] by rfl]
+  simp +decide
+
+private theorem indexedVecValidationAlphaFindInTail :
+    indexedVecValidationTailContext.lctx.find?
+        indexedVecValidationAlphaId =
+      some (.cdecl 0 indexedVecValidationAlphaId
+        indexedVecValidationParamName
+        (.sort (.succ (.param `u))) .default .default) := by
+  have hfresh := indexedVecValidationHeadContextFresh
+  have hne : indexedVecValidationAlphaId ≠
+      indexedVecValidationTailId := by
+    change indexedVecValidationAlphaId ≠
+      indexedVecValidationHeadContext.freshFVarId
+    intro heq
+    rw [← heq] at hfresh
+    rw [indexedVecValidationAlphaFindInHead] at hfresh
+    contradiction
+  have h := localContextFindOld
+    (lctx := indexedVecValidationHeadContext.lctx)
+    (oldId := indexedVecValidationAlphaId)
+    (newId := indexedVecValidationTailId)
+    (newName := consTailName)
+    (newType := ctorIndexedVecApp indexedVecValidationAlpha
+      indexedVecValidationNExpr)
+    (newBi := .default) (newKind := .default)
+    (oldDecl := .cdecl 0 indexedVecValidationAlphaId
+      indexedVecValidationParamName (.sort (.succ (.param `u)))
+      .default .default)
+    indexedVecValidationHeadContextWF
+    hfresh hne
+    indexedVecValidationAlphaFindInHead
+  simpa [indexedVecValidationTailContext,
+    indexedVecValidationTailId,
+    AddInductive.Context.pushLocalDecl] using h
+
+private theorem indexedVecValidationNFindInTail :
+    indexedVecValidationTailContext.lctx.find?
+        indexedVecValidationNId =
+      some (.cdecl 2 indexedVecValidationNId consNName
+        (.const ``Nat []) .implicit .default) := by
+  have hfresh := indexedVecValidationHeadContextFresh
+  have hne : indexedVecValidationNId ≠
+      indexedVecValidationTailId := by
+    change indexedVecValidationNId ≠
+      indexedVecValidationHeadContext.freshFVarId
+    intro heq
+    rw [← heq] at hfresh
+    rw [indexedVecValidationNFindInHead] at hfresh
+    contradiction
+  have h := localContextFindOld
+    (lctx := indexedVecValidationHeadContext.lctx)
+    (oldId := indexedVecValidationNId)
+    (newId := indexedVecValidationTailId)
+    (newName := consTailName)
+    (newType := ctorIndexedVecApp indexedVecValidationAlpha
+      indexedVecValidationNExpr)
+    (newBi := .default) (newKind := .default)
+    (oldDecl := .cdecl 2 indexedVecValidationNId consNName
+      (.const ``Nat []) .implicit .default)
+    indexedVecValidationHeadContextWF
+    hfresh hne
+    indexedVecValidationNFindInHead
+  simpa [indexedVecValidationTailContext,
+    indexedVecValidationTailId,
+    AddInductive.Context.pushLocalDecl] using h
+
+private theorem indexedVecValidationSortCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨indexedVecCtorValidationContext,
+        .sort (.succ (.param `u)),
+        .sort (.succ (.succ (.param `u)))⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecCtorValidationContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.checkType (.sort (.succ (.param `u)))) = _
+  exact indexedVecValidationSortCheckTypeM
+    indexedVecCtorValidationContext.lctx
+
+private theorem indexedVecValidationNatCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨indexedVecCtorValidationContext, .const ``Nat [],
+        .sort (.succ .zero)⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecCtorValidationContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.checkType (.const ``Nat [])) = _
+  exact ctorNatCheckTypeM indexedVecCtorValidationContext.lctx
+
+private theorem indexedVecValidationAlphaCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨indexedVecValidationNContext, indexedVecValidationAlpha,
+        .sort (.succ (.param `u))⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecValidationNContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.checkType (.fvar indexedVecValidationAlphaId)) = _
+  exact ctorFVarCheckTypeM indexedVecValidationNContext.lctx
+    indexedVecValidationAlphaId (.sort (.succ (.param `u)))
+    indexedVecValidationAlphaFindInN
+
+private theorem indexedVecValidationTailCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨indexedVecValidationHeadContext,
+        ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr,
+        .sort (.succ (.param `u))⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecValidationHeadContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.checkType
+      (ctorIndexedVecApp (.fvar indexedVecValidationAlphaId)
+        (.fvar indexedVecValidationNId))) = _
+  exact ctorIndexedVecFVarCheckTypeM
+    indexedVecValidationHeadContext.lctx
+    indexedVecValidationAlphaId indexedVecValidationNId
+    indexedVecValidationAlphaNeN indexedVecValidationAlphaFindInHead
+    indexedVecValidationNFindInHead
+
+private theorem indexedVecValidationNilResultCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨indexedVecCtorValidationContext, indexedVecValidationNilResult,
+        .sort (.succ (.param `u))⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecCtorValidationContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.checkType
+      (ctorIndexedVecApp (.fvar indexedVecValidationAlphaId)
+        (.const ``Nat.zero []))) = _
+  exact indexedVecValidationZeroCheckTypeM
+    indexedVecCtorValidationContext.lctx indexedVecValidationAlphaId
+    indexedVecValidationAlphaFind
+
+private theorem indexedVecValidationConsResultCheckValid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨indexedVecValidationTailContext, indexedVecValidationConsResult,
+        .sort (.succ (.param `u))⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecValidationTailContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.checkType
+      (ctorIndexedVecApp (.fvar indexedVecValidationAlphaId)
+        (replaySuccApp (.fvar indexedVecValidationNId)))) = _
+  exact indexedVecValidationSuccCheckTypeM
+    indexedVecValidationTailContext.lctx
+    indexedVecValidationAlphaId indexedVecValidationNId
+    indexedVecValidationAlphaNeN
+    indexedVecValidationAlphaFindInTail
+    indexedVecValidationNFindInTail
+
+private def indexedVecCheckedOfValid
+    (context : AddInductive.Context) (source inferred : Expr)
+    (fvars : source.FVarsIn
+      (fun fv => (context.lctx.find? fv).isSome = true))
+    (valid : AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, source, inferred⟩) :
+    AddInductive.ConstructorCheckedExpr context source :=
+  .ofRun fvars valid
+
+private def indexedVecValidationSortChecked :
+    AddInductive.ConstructorCheckedExpr indexedVecCtorValidationContext
+      (.sort (.succ (.param `u))) :=
+  indexedVecCheckedOfValid _ _ _ (by
+    simp [FVarsIn, Level.hasMVar'])
+    indexedVecValidationSortCheckValid
+
+private def indexedVecValidationNatChecked :
+    AddInductive.ConstructorCheckedExpr indexedVecCtorValidationContext
+      (.const ``Nat []) :=
+  indexedVecCheckedOfValid _ _ _ (by simp [FVarsIn])
+    indexedVecValidationNatCheckValid
+
+private def indexedVecValidationAlphaChecked :
+    AddInductive.ConstructorCheckedExpr indexedVecValidationNContext
+      indexedVecValidationAlpha :=
+  indexedVecCheckedOfValid _ _ _ (by
+    change (indexedVecValidationNContext.lctx.find?
+      indexedVecValidationAlphaId).isSome = true
+    rw [indexedVecValidationAlphaFindInN]
+    rfl)
+    indexedVecValidationAlphaCheckValid
+
+private def indexedVecValidationTailChecked :
+    AddInductive.ConstructorCheckedExpr indexedVecValidationHeadContext
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) :=
+  indexedVecCheckedOfValid _ _ _ (by
+    simp [ctorIndexedVecApp, indexedVecValidationAlpha,
+      indexedVecValidationNExpr, AddInductive.Context.freshExpr,
+      FVarsIn, Level.hasMVar']
+    constructor
+    · change (indexedVecValidationHeadContext.lctx.find?
+        indexedVecValidationAlphaId).isSome = true
+      rw [indexedVecValidationAlphaFindInHead]
+      rfl
+    · change (indexedVecValidationHeadContext.lctx.find?
+        indexedVecValidationNId).isSome = true
+      rw [indexedVecValidationNFindInHead]
+      rfl)
+    indexedVecValidationTailCheckValid
+
+private def indexedVecValidationNilResultChecked :
+    AddInductive.ConstructorCheckedExpr indexedVecCtorValidationContext
+      indexedVecValidationNilResult :=
+  indexedVecCheckedOfValid _ _ _ (by
+    simp [indexedVecValidationNilResult, ctorIndexedVecApp,
+      indexedVecValidationAlpha,
+      AddInductive.Context.freshExpr, FVarsIn, Level.hasMVar']
+    change (indexedVecCtorValidationContext.lctx.find?
+      indexedVecValidationAlphaId).isSome = true
+    rw [indexedVecValidationAlphaFind]
+    rfl)
+    indexedVecValidationNilResultCheckValid
+
+private def indexedVecValidationConsResultChecked :
+    AddInductive.ConstructorCheckedExpr indexedVecValidationTailContext
+      indexedVecValidationConsResult :=
+  indexedVecCheckedOfValid _ _ _ (by
+    simp [indexedVecValidationConsResult, ctorIndexedVecApp,
+      replaySuccApp, indexedVecValidationAlpha,
+      indexedVecValidationNExpr, AddInductive.Context.freshExpr,
+      FVarsIn, Level.hasMVar']
+    constructor
+    · change (indexedVecValidationTailContext.lctx.find?
+        indexedVecValidationAlphaId).isSome = true
+      rw [indexedVecValidationAlphaFindInTail]
+      rfl
+    · change (indexedVecValidationTailContext.lctx.find?
+        indexedVecValidationNId).isSome = true
+      rw [indexedVecValidationNFindInTail]
+      rfl)
+    indexedVecValidationConsResultCheckValid
+
+private theorem indexedVecStagedStats_eq :
+    indexedVecStagedUniverseInput.staged.family.validation.stats =
+      indexedVecCandidateInductiveStats := rfl
+
+private theorem indexedVecValidationPostContext_eq :
+    { indexedVecNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+      env := ctorContext.env } = indexedVecCtorValidationContext := rfl
+
+private def indexedVecTransportValidationTrace
+    {context context' : AddInductive.Context}
+    (context_eq : context = context')
+    {source source' : Expr} (source_eq : source = source')
+    (trace : AddInductive.ConstructorTypeValidationTrace stats isUnsafe
+      familyIdx ctor context source argIdx fuel) :
+    AddInductive.ConstructorTypeValidationTrace stats isUnsafe familyIdx ctor
+      context' source' argIdx fuel := by
+  subst context'
+  subst source'
+  exact trace
+
+private def indexedVecTransportViewAlignment
+    {context context' : AddInductive.Context}
+    (context_eq : context = context')
+    {source source' view view' : Expr}
+    (source_eq : source = source') (view_eq : view = view')
+    (trace : AddInductive.ConstructorTypeValidationTrace stats isUnsafe
+      familyIdx ctor context source argIdx fuel)
+    (alignment : AddInductive.ConstructorViewAlignmentTrace
+      (indexedVecTransportValidationTrace context_eq source_eq trace)
+      view') :
+    AddInductive.ConstructorViewAlignmentTrace trace view := by
+  subst context'
+  subst source'
+  subst view'
+  exact alignment
+
+@[simp] private theorem indexedVecTransportValidationTrace_spineLength
+    {context context' : AddInductive.Context}
+    (context_eq : context = context')
+    {source source' : Expr} (source_eq : source = source')
+    (trace : AddInductive.ConstructorTypeValidationTrace stats isUnsafe
+      familyIdx ctor context source argIdx fuel) :
+    (indexedVecTransportValidationTrace context_eq source_eq trace).spineLength =
+      trace.spineLength := by
+  subst context'
+  subst source'
+  rfl
+
+private theorem indexedVecValidationNatWhnfSelf :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨indexedVecCtorValidationContext, .const ``Nat [],
+        .const ``Nat []⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecCtorValidationContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.whnf (.const ``Nat [])) = .ok (.const ``Nat [])
+  exact ctorNatWhnfM indexedVecCtorValidationContext.lctx
+
+private theorem indexedVecValidationAlphaWhnfSelf :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨indexedVecValidationNContext, indexedVecValidationAlpha,
+        indexedVecValidationAlpha⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecValidationNContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.whnf (.fvar indexedVecValidationAlphaId)) =
+      .ok (.fvar indexedVecValidationAlphaId)
+  exact ctorFVarWhnfM indexedVecValidationNContext.lctx
+    indexedVecValidationAlphaId indexedVecValidationAlphaFindInN
+
+private theorem indexedVecValidationTailWhnfSelf :
+    AddInductive.CandidateWhnfStep.Valid
+      ⟨indexedVecValidationHeadContext,
+        ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr,
+        ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr⟩ := by
+  change TypeChecker.M.run ctorEnv .safe
+    indexedVecValidationHeadContext.lctx [`u] ({} : FuelConfig)
+    (TypeChecker.whnf
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)) =
+      .ok (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)
+  exact ctorIndexedVecWhnfM indexedVecValidationHeadContext.lctx
+    indexedVecValidationAlpha indexedVecValidationNExpr
+
+private theorem indexedVecCandidateWhnfResult_eq
+    (self : AddInductive.CandidateWhnfStep.Valid
+      ⟨context, source, source⟩)
+    (other : AddInductive.CandidateWhnfStep.Valid
+      ⟨context, source, result⟩) :
+    result = source := by
+  unfold AddInductive.CandidateWhnfStep.Valid at self other
+  rw [self] at other
+  exact (Except.ok.inj other).symm
+
+private def indexedVecValidationNatPositivityAlignment
+    (trace : AddInductive.ConstructorPositivityModeTrace
+      indexedVecStagedUniverseInput.staged.family.validation.stats false
+      indexedVecKernelCons.name 1 indexedVecCtorValidationContext
+      (.const ``Nat [])) :
+    AddInductive.ConstructorPositivityModeAlignmentTrace trace := by
+  cases trace with
+  | skipped unsafeEq => contradiction
+  | safe unsafeEq positivityTrace =>
+      apply AddInductive.ConstructorPositivityModeAlignmentTrace.safe
+      cases positivityTrace with
+      | absent context source result fuel whnf occurs =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationNatWhnfSelf whnf
+          subst result
+          exact .absent indexedVecValidationNatChecked
+      | forallE context source fuel name domain body binderInfo whnf occurs
+          domainFree tail =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationNatWhnfSelf whnf
+          have impossible := congrArg Expr.isForall result_eq
+          simp [Expr.isForall] at impossible
+      | target context source result fuel targetIdx whnf occurs terminal valid =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationNatWhnfSelf whnf
+          subst result
+          rw [indexedVecStagedStats_eq,
+            indexedVecValidationNatHasNoIndOcc] at occurs
+          contradiction
+
+private def indexedVecValidationAlphaPositivityAlignment
+    (trace : AddInductive.ConstructorPositivityModeTrace
+      indexedVecStagedUniverseInput.staged.family.validation.stats false
+      indexedVecKernelCons.name 2 indexedVecValidationNContext
+      indexedVecValidationAlpha) :
+    AddInductive.ConstructorPositivityModeAlignmentTrace trace := by
+  cases trace with
+  | skipped unsafeEq => contradiction
+  | safe unsafeEq positivityTrace =>
+      apply AddInductive.ConstructorPositivityModeAlignmentTrace.safe
+      cases positivityTrace with
+      | absent context source result fuel whnf occurs =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationAlphaWhnfSelf whnf
+          subst result
+          exact .absent indexedVecValidationAlphaChecked
+      | forallE context source fuel name domain body binderInfo whnf occurs
+          domainFree tail =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationAlphaWhnfSelf whnf
+          have impossible := congrArg Expr.isForall result_eq
+          simp [indexedVecValidationAlphaShape, Expr.isForall] at impossible
+      | target context source result fuel targetIdx whnf occurs terminal valid =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationAlphaWhnfSelf whnf
+          subst result
+          rw [indexedVecStagedStats_eq] at occurs
+          change AddInductive.hasIndOcc
+            indexedVecCandidateInductiveStats.indConsts
+              indexedVecValidationAlpha = true at occurs
+          rw [indexedVecValidationAlphaHasNoIndOcc] at occurs
+          contradiction
+
+private def indexedVecValidationTailPositivityAlignment
+    (trace : AddInductive.ConstructorPositivityModeTrace
+      indexedVecStagedUniverseInput.staged.family.validation.stats false
+      indexedVecKernelCons.name 3 indexedVecValidationHeadContext
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)) :
+    AddInductive.ConstructorPositivityModeAlignmentTrace trace := by
+  cases trace with
+  | skipped unsafeEq => contradiction
+  | safe unsafeEq positivityTrace =>
+      apply AddInductive.ConstructorPositivityModeAlignmentTrace.safe
+      cases positivityTrace with
+      | absent context source result fuel whnf occurs =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationTailWhnfSelf whnf
+          subst result
+          rw [indexedVecStagedStats_eq] at occurs
+          change AddInductive.hasIndOcc
+            indexedVecCandidateInductiveStats.indConsts
+              (ctorIndexedVecApp indexedVecValidationAlpha
+                indexedVecValidationNExpr) = false at occurs
+          rw [indexedVecValidationTailHasIndOcc] at occurs
+          contradiction
+      | forallE context source fuel name domain body binderInfo whnf occurs
+          domainFree tail =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationTailWhnfSelf whnf
+          have impossible := congrArg Expr.isForall result_eq
+          simp [ctorIndexedVecApp, Expr.isForall] at impossible
+      | target context source result fuel targetIdx whnf occurs terminal valid =>
+          have result_eq := indexedVecCandidateWhnfResult_eq
+            indexedVecValidationTailWhnfSelf whnf
+          subst result
+          exact .target indexedVecValidationTailChecked
+
+private def indexedVecValidationNatAnnotations :
+    AddInductive.CandidateIsDefEqObservation
+      indexedVecCtorValidationContext (.const ``Nat [])
+        (.const ``Nat []) :=
+  ⟨AddInductive.candidateIsDefEqRefl indexedVecCtorValidationContext
+    (.const ``Nat [])⟩
+
+private def indexedVecValidationAlphaAnnotations :
+    AddInductive.CandidateIsDefEqObservation
+      indexedVecValidationNContext indexedVecValidationAlpha
+        indexedVecValidationAlpha :=
+  ⟨AddInductive.candidateIsDefEqRefl indexedVecValidationNContext
+    indexedVecValidationAlpha⟩
+
+private def indexedVecValidationTailAnnotations :
+    AddInductive.CandidateIsDefEqObservation
+      indexedVecValidationHeadContext
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr)
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr) :=
+  ⟨AddInductive.candidateIsDefEqRefl indexedVecValidationHeadContext
+    (ctorIndexedVecApp indexedVecValidationAlpha
+      indexedVecValidationNExpr)⟩
+
+/-- The validator and analyzer intentionally allocate the retained `n` field
+under different fresh-FVar histories.  D2 alignment must therefore be
+positional rather than identifier-based. -/
+theorem indexedVecValidationCandidateFieldFVars_ne :
+    indexedVecValidationNId ≠ consNId := by
+  simp [indexedVecValidationNId, indexedVecCtorValidationContext,
+    indexedVecValidationTerminalContextShape,
+    indexedVecValidationFamilyContext,
+    indexedVecValidationParamContext, indexedVecFamilyCandidateContext,
+    consNId, consAlphaContext, consRootContext, ctorContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId,
+    NameGenerator.next, NameGenerator.curr]
+
+/-- Exact D2 owner for `IndexedVec`.  Its validator telescope is transported
+only across proved context/source equalities, while every candidate view is
+instantiated with the validator-owned locals at the same de Bruijn position. -/
+def indexedVecStagedPostFamilyInput :
+    VInductDecl.StagedNormalizationCandidatePostFamilyInput
+      indexedVecFamilyCandidateContext ctorContext natFinalEnv [`u]
+      indexedVecNormalizationCandidate indexedVecDecl where
+  universeInput := indexedVecStagedUniverseInput
+  alignment := by
+    change AddInductive.ConstructorCandidateAlignmentTrace
+      indexedVecStagedUniverseInput.staged.family.validation.stats false 0
+      indexedVecCtorValidationContext
+      indexedVecStagedUniverseInput.staged.constructorValidation.trace
+      (.cons indexedVecNilConstructorCandidate
+        (.cons indexedVecConsConstructorCandidate .nil))
+    generalize htrace :
+      indexedVecStagedUniverseInput.staged.constructorValidation.trace = trace
+    cases trace with
+    | cons seen head constructors fresh closed rootCheck typeTrace tailTrace =>
+        clear htrace
+        cases hnilRoot : typeTrace with
+        | parameter context fuel argIdx name domain body binderInfo param
+            parameterType parameterAt parameterTypeRun parameterDefEq
+            nilTypeTail =>
+            rw [indexedVecStagedStats_eq,
+              indexedVecValidationStatsParams] at parameterAt
+            simp at parameterAt
+            subst param
+            change AddInductive.getType indexedVecValidationAlpha
+              indexedVecCtorValidationContext = .ok parameterType at parameterTypeRun
+            rw [indexedVecValidationGetTypeAlpha] at parameterTypeRun
+            injection parameterTypeRun with parameterType_eq
+            subst parameterType
+            let nilNormalized := indexedVecTransportValidationTrace
+              indexedVecValidationPostContext_eq
+              indexedVecValidationNilResultShape nilTypeTail
+            let nilNormalizedTrace := nilNormalized
+            have nilSpine : nilTypeTail.spineLength =
+                nilNormalizedTrace.spineLength := by
+              exact (indexedVecTransportValidationTrace_spineLength
+                indexedVecValidationPostContext_eq
+                indexedVecValidationNilResultShape nilTypeTail).symm
+            cases hnilNormalized : nilNormalizedTrace with
+            | terminal context source fuel argIdx nilTerminal nilValid =>
+                simp [hnilNormalized,
+                  AddInductive.ConstructorTypeValidationTrace.spineLength] at nilSpine
+                have nilNormalizedAlignment :
+                    AddInductive.ConstructorViewAlignmentTrace
+                      nilNormalizedTrace indexedVecValidationNilResult := by
+                  rw [hnilNormalized]
+                  exact .terminal indexedVecValidationNilResultChecked
+                    indexedVecValidationNilResultChecked nilTerminal nilValid
+                have nilTailAlignment := indexedVecTransportViewAlignment
+                  indexedVecValidationPostContext_eq
+                  indexedVecValidationNilResultShape
+                  indexedVecValidationNilResultShape nilTypeTail
+                  nilNormalizedAlignment
+                have nilHeadAlignment :
+                    AddInductive.ConstructorViewAlignmentTrace
+                      (.parameter
+                        { indexedVecNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                          env := ctorContext.env }
+                        999 0 `α (.sort (.succ (.param `u)))
+                        nilCtorBodyRaw .implicit indexedVecValidationAlpha
+                        (.sort (.succ (.param `u))) parameterAt
+                        parameterTypeRun parameterDefEq nilTypeTail)
+                      indexedVecNilConstructorCandidate.type.view := by
+                  change AddInductive.ConstructorViewAlignmentTrace
+                    _ nilCandidate.view
+                  rw [nilCandidate_view_eq]
+                  exact .parameter indexedVecValidationSortChecked
+                    indexedVecValidationSortChecked
+                    indexedVecValidationSortChecked rfl
+                    (by simp [indexedVecValidationAlphaFind])
+                    nilTypeTail nilTailAlignment
+                cases tailTrace with
+                | cons seen head constructors consFresh consClosed
+                    consRootCheck consTypeTrace finalTrace =>
+                    cases hconsRoot : consTypeTrace with
+                    | parameter context fuel argIdx name domain body binderInfo
+                        param parameterType parameterAt parameterTypeRun
+                        parameterDefEq consAfterParamTrace =>
+                        rw [indexedVecStagedStats_eq,
+                          indexedVecValidationStatsParams] at parameterAt
+                        simp at parameterAt
+                        subst param
+                        change AddInductive.getType indexedVecValidationAlpha
+                          indexedVecCtorValidationContext = .ok parameterType at parameterTypeRun
+                        rw [indexedVecValidationGetTypeAlpha] at parameterTypeRun
+                        injection parameterTypeRun with parameterType_eq
+                        subst parameterType
+                        let buildConsHeadAlignment
+                            (tailAlignment :
+                              AddInductive.ConstructorViewAlignmentTrace
+                                consAfterParamTrace
+                                (consNTypeRaw.instantiate1
+                                  indexedVecValidationAlpha)) :
+                            AddInductive.ConstructorViewAlignmentTrace
+                              (.parameter
+                                { indexedVecNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                                  env := ctorContext.env }
+                                999 0 consAlphaName
+                                (.sort (.succ (.param `u))) consNTypeRaw
+                                .implicit indexedVecValidationAlpha
+                                (.sort (.succ (.param `u))) parameterAt
+                                parameterTypeRun parameterDefEq
+                                consAfterParamTrace)
+                              indexedVecConsConstructorCandidate.type.view := by
+                          change AddInductive.ConstructorViewAlignmentTrace
+                            _ consCandidate.view
+                          rw [consCandidate_view_eq]
+                          exact .parameter indexedVecValidationSortChecked
+                            indexedVecValidationSortChecked
+                            indexedVecValidationSortChecked rfl
+                            (by simp [indexedVecValidationAlphaFind])
+                            consAfterParamTrace tailAlignment
+                        have consAfterParamSource_eq :
+                            indexedVecConsInfo.type.bindingBody!.instantiate1
+                                indexedVecValidationAlpha =
+                              indexedVecValidationConsAfterParam :=
+                          indexedVecValidationConsAfterParamShape
+                        have consAfterParamExplicit_eq :
+                            indexedVecConsInfo.type.bindingBody!.instantiate1
+                                indexedVecValidationAlpha =
+                              .forallE consNName (.const ``Nat [])
+                                (.forallE consHeadName
+                                  indexedVecValidationAlpha
+                                  (.forallE consTailName
+                                    (ctorIndexedVecApp
+                                      indexedVecValidationAlpha (.bvar 1))
+                                    (ctorIndexedVecApp
+                                      indexedVecValidationAlpha
+                                      (replaySuccApp (.bvar 2))) .default)
+                                  .default)
+                                .implicit :=
+                          consAfterParamSource_eq.trans
+                            indexedVecValidationConsAfterParamExplicitShape
+                        let consAfterParamNormalized :=
+                          indexedVecTransportValidationTrace
+                            indexedVecValidationPostContext_eq
+                            consAfterParamExplicit_eq consAfterParamTrace
+                        let consAfterParamNormalizedTrace :=
+                          consAfterParamNormalized
+                        have consAfterParamSpine :
+                            consAfterParamTrace.spineLength =
+                              consAfterParamNormalizedTrace.spineLength := by
+                          exact (indexedVecTransportValidationTrace_spineLength
+                            indexedVecValidationPostContext_eq
+                            consAfterParamExplicit_eq
+                            consAfterParamTrace).symm
+                        cases hconsAfterParamNormalized :
+                            consAfterParamNormalizedTrace with
+                        | parameter context fuel argIdx name domain body
+                            binderInfo param parameterType parameterAt
+                            parameterTypeRun parameterDefEq tail =>
+                            rw [indexedVecStagedStats_eq,
+                              indexedVecValidationStatsParams] at parameterAt
+                            simp at parameterAt
+                        | ordinary context fuel argIdx name domain body
+                            binderInfo sortResult noParameter ensureType
+                            universeTrace natPositivity consAfterNTrace =>
+                            simp [hconsAfterParamNormalized,
+                              AddInductive.ConstructorTypeValidationTrace.spineLength]
+                              at consAfterParamSpine
+                            have natPositivityAlignment :=
+                              indexedVecValidationNatPositivityAlignment
+                                natPositivity
+                            have afterParamBody_eq :
+                                indexedVecValidationConsAfterParam.bindingBody! =
+                                  .forallE consHeadName
+                                    indexedVecValidationAlpha
+                                    (.forallE consTailName
+                                      (ctorIndexedVecApp
+                                        indexedVecValidationAlpha (.bvar 1))
+                                      (ctorIndexedVecApp
+                                        indexedVecValidationAlpha
+                                        (replaySuccApp (.bvar 2))) .default)
+                                    .default := by
+                              exact congrArg Expr.bindingBody!
+                                indexedVecValidationConsAfterParamExplicitShape
+                            have afterNSource_eq :
+                                ((Expr.forallE consHeadName
+                                    indexedVecValidationAlpha
+                                    (Expr.forallE consTailName
+                                      (ctorIndexedVecApp
+                                        indexedVecValidationAlpha (.bvar 1))
+                                      (ctorIndexedVecApp
+                                        indexedVecValidationAlpha
+                                        (replaySuccApp (.bvar 2))) .default)
+                                    .default).instantiate1
+                                  indexedVecCtorValidationContext.freshExpr) =
+                                    indexedVecValidationConsAfterN := by
+                              change
+                                ((Expr.forallE consHeadName
+                                    indexedVecValidationAlpha
+                                    (Expr.forallE consTailName
+                                      (ctorIndexedVecApp
+                                        indexedVecValidationAlpha (.bvar 1))
+                                      (ctorIndexedVecApp
+                                        indexedVecValidationAlpha
+                                        (replaySuccApp (.bvar 2))) .default)
+                                    .default).instantiate1
+                                  indexedVecValidationNExpr) =
+                                    indexedVecValidationConsAfterN
+                              rw [← afterParamBody_eq]
+                              exact indexedVecValidationConsAfterNShape
+                            have nContext_eq :
+                                indexedVecCtorValidationContext.pushLocalDecl
+                                    consNName .implicit
+                                      (AddInductive.consumeTypeAnnotations
+                                        (.const ``Nat [])) =
+                                  indexedVecValidationNContext := by
+                              simp [indexedVecValidationNContext]
+                            let consAfterNNormalized :=
+                              indexedVecTransportValidationTrace nContext_eq
+                                afterNSource_eq consAfterNTrace
+                            let consAfterNNormalizedTrace := consAfterNNormalized
+                            have consAfterNSpine :
+                                consAfterNTrace.spineLength =
+                                  consAfterNNormalizedTrace.spineLength := by
+                              exact
+                                (indexedVecTransportValidationTrace_spineLength
+                                  nContext_eq afterNSource_eq
+                                  consAfterNTrace).symm
+                            cases hconsAfterNNormalized :
+                                consAfterNNormalizedTrace with
+                            | parameter context fuel argIdx name domain body
+                                binderInfo param parameterType parameterAt
+                                parameterTypeRun parameterDefEq tail =>
+                                rw [indexedVecStagedStats_eq,
+                                  indexedVecValidationStatsParams] at parameterAt
+                                simp at parameterAt
+                            | ordinary context fuel argIdx name domain body
+                                binderInfo sortResult noParameter ensureType
+                                universeTrace alphaPositivity
+                                consAfterHeadTrace =>
+                                simp [hconsAfterNNormalized,
+                                  AddInductive.ConstructorTypeValidationTrace.spineLength]
+                                  at consAfterNSpine
+                                have alphaPositivityAlignment :=
+                                  indexedVecValidationAlphaPositivityAlignment
+                                    alphaPositivity
+                                have headContext_eq :
+                                    indexedVecValidationNContext.pushLocalDecl
+                                        consHeadName .default
+                                          (AddInductive.consumeTypeAnnotations
+                                            indexedVecValidationAlpha) =
+                                      indexedVecValidationHeadContext := by
+                                  rw [indexedVecValidationConsumeAlpha]
+                                  rfl
+                                let consAfterHeadNormalized :=
+                                  indexedVecTransportValidationTrace
+                                    headContext_eq
+                                    indexedVecValidationConsAfterHeadShape
+                                    consAfterHeadTrace
+                                let consAfterHeadNormalizedTrace :=
+                                  consAfterHeadNormalized
+                                have consAfterHeadSpine :
+                                    consAfterHeadTrace.spineLength =
+                                      consAfterHeadNormalizedTrace.spineLength := by
+                                  exact
+                                    (indexedVecTransportValidationTrace_spineLength
+                                      headContext_eq
+                                      indexedVecValidationConsAfterHeadShape
+                                      consAfterHeadTrace).symm
+                                cases hconsAfterHeadNormalized :
+                                    consAfterHeadNormalizedTrace with
+                                | parameter context fuel argIdx name domain body
+                                    binderInfo param parameterType parameterAt
+                                    parameterTypeRun parameterDefEq tail =>
+                                    rw [indexedVecStagedStats_eq,
+                                      indexedVecValidationStatsParams] at parameterAt
+                                    simp at parameterAt
+                                | ordinary context fuel argIdx name domain body
+                                    binderInfo sortResult noParameter ensureType
+                                    universeTrace tailPositivity
+                                    consResultTrace =>
+                                    simp [hconsAfterHeadNormalized,
+                                      AddInductive.ConstructorTypeValidationTrace.spineLength]
+                                      at consAfterHeadSpine
+                                    have tailPositivityAlignment :=
+                                      indexedVecValidationTailPositivityAlignment
+                                        tailPositivity
+                                    have tailContext_eq :
+                                        indexedVecValidationHeadContext.pushLocalDecl
+                                            consTailName .default
+                                              (AddInductive.consumeTypeAnnotations
+                                                (ctorIndexedVecApp
+                                                  indexedVecValidationAlpha
+                                                  indexedVecValidationNExpr)) =
+                                          indexedVecValidationTailContext := by
+                                      rw [indexedVecValidationConsumeTail]
+                                      rfl
+                                    let consResultNormalized :=
+                                      indexedVecTransportValidationTrace
+                                        tailContext_eq
+                                        indexedVecValidationConsResultShape
+                                        consResultTrace
+                                    let consResultNormalizedTrace :=
+                                      consResultNormalized
+                                    have consResultSpine :
+                                        consResultTrace.spineLength =
+                                          consResultNormalizedTrace.spineLength := by
+                                      exact
+                                        (indexedVecTransportValidationTrace_spineLength
+                                          tailContext_eq
+                                          indexedVecValidationConsResultShape
+                                          consResultTrace).symm
+                                    cases hconsResultNormalized :
+                                        consResultNormalizedTrace with
+                                    | terminal context source fuel argIdx
+                                        resultTerminal resultValid =>
+                                        simp [hconsResultNormalized,
+                                          AddInductive.ConstructorTypeValidationTrace.spineLength]
+                                          at consResultSpine
+                                        have consResultNormalizedAlignment :
+                                            AddInductive.ConstructorViewAlignmentTrace
+                                              consResultNormalizedTrace
+                                              indexedVecValidationConsResult := by
+                                          rw [hconsResultNormalized]
+                                          exact .terminal
+                                            indexedVecValidationConsResultChecked
+                                            indexedVecValidationConsResultChecked
+                                            resultTerminal resultValid
+                                        have consResultAlignment :=
+                                          indexedVecTransportViewAlignment
+                                            tailContext_eq
+                                            indexedVecValidationConsResultShape
+                                            indexedVecValidationConsResultShape
+                                            consResultTrace
+                                            consResultNormalizedAlignment
+                                        have consAfterHeadNormalizedAlignment :
+                                            AddInductive.ConstructorViewAlignmentTrace
+                                              consAfterHeadNormalizedTrace
+                                              indexedVecValidationConsAfterHead := by
+                                          rw [hconsAfterHeadNormalized]
+                                          exact .ordinary
+                                            indexedVecValidationTailChecked
+                                            indexedVecValidationTailChecked
+                                            (by simpa only
+                                              [indexedVecValidationConsumeTail]
+                                              using
+                                                indexedVecValidationTailAnnotations)
+                                            (by simpa only
+                                              [indexedVecValidationConsumeTail]
+                                              using indexedVecValidationTailChecked)
+                                            tailPositivity
+                                            tailPositivityAlignment
+                                            indexedVecValidationHeadContextFresh
+                                            (by simpa only
+                                              [indexedVecValidationConsumeTail]
+                                              using
+                                                indexedVecValidationTailAnnotations)
+                                            consResultTrace consResultAlignment
+                                        have consAfterHeadAlignment :=
+                                          indexedVecTransportViewAlignment
+                                            headContext_eq
+                                            indexedVecValidationConsAfterHeadShape
+                                            indexedVecValidationConsAfterHeadShape
+                                            consAfterHeadTrace
+                                            consAfterHeadNormalizedAlignment
+                                        have consAfterNNormalizedAlignment :
+                                            AddInductive.ConstructorViewAlignmentTrace
+                                              consAfterNNormalizedTrace
+                                              indexedVecValidationConsAfterN := by
+                                          rw [hconsAfterNNormalized]
+                                          exact .ordinary
+                                            indexedVecValidationAlphaChecked
+                                            indexedVecValidationAlphaChecked
+                                            (by simpa only
+                                              [indexedVecValidationConsumeAlpha]
+                                              using
+                                                indexedVecValidationAlphaAnnotations)
+                                            (by simpa only
+                                              [indexedVecValidationConsumeAlpha]
+                                              using indexedVecValidationAlphaChecked)
+                                            alphaPositivity
+                                            alphaPositivityAlignment
+                                            indexedVecValidationNContextFresh
+                                            (by simpa only
+                                              [indexedVecValidationConsumeAlpha]
+                                              using
+                                                indexedVecValidationAlphaAnnotations)
+                                            consAfterHeadTrace
+                                            consAfterHeadAlignment
+                                        have consAfterNAlignment :=
+                                          indexedVecTransportViewAlignment
+                                            nContext_eq afterNSource_eq
+                                            afterNSource_eq consAfterNTrace
+                                            consAfterNNormalizedAlignment
+                                        have consAfterParamNormalizedAlignment :
+                                            AddInductive.ConstructorViewAlignmentTrace
+                                              consAfterParamNormalizedTrace
+                                              (.forallE consNName
+                                                (.const ``Nat [])
+                                                (.forallE consHeadName
+                                                  indexedVecValidationAlpha
+                                                  (.forallE consTailName
+                                                    (ctorIndexedVecApp
+                                                      indexedVecValidationAlpha
+                                                      (.bvar 1))
+                                                    (ctorIndexedVecApp
+                                                      indexedVecValidationAlpha
+                                                      (replaySuccApp (.bvar 2)))
+                                                    .default)
+                                                  .default)
+                                                .implicit) := by
+                                          rw [hconsAfterParamNormalized]
+                                          exact .ordinary
+                                            indexedVecValidationNatChecked
+                                            indexedVecValidationNatChecked
+                                            (by simpa only
+                                              [indexedVecValidationConsumeNat]
+                                              using
+                                                indexedVecValidationNatAnnotations)
+                                            (by simpa only
+                                              [indexedVecValidationConsumeNat]
+                                              using indexedVecValidationNatChecked)
+                                            natPositivity natPositivityAlignment
+                                            indexedVecCtorValidationContextFresh
+                                            (by simpa only
+                                              [indexedVecValidationConsumeNat]
+                                              using
+                                                indexedVecValidationNatAnnotations)
+                                            consAfterNTrace consAfterNAlignment
+                                        have consAfterParamAlignment :=
+                                          indexedVecTransportViewAlignment
+                                            indexedVecValidationPostContext_eq
+                                            consAfterParamExplicit_eq
+                                            consAfterParamExplicit_eq
+                                            consAfterParamTrace
+                                            consAfterParamNormalizedAlignment
+                                        have consHeadAlignment :=
+                                          buildConsHeadAlignment
+                                            consAfterParamAlignment
+                                        change
+                                          AddInductive.CandidateCheckTypeObservation
+                                            indexedVecCtorValidationContext.withEmptyLocalContext
+                                            indexedVecKernelNil.type at rootCheck
+                                        change
+                                          AddInductive.CandidateCheckTypeObservation
+                                            indexedVecCtorValidationContext.withEmptyLocalContext
+                                            indexedVecKernelCons.type at consRootCheck
+                                        let nilRootScope :
+                                            AddInductive.ConstructorCheckedExpr
+                                              indexedVecCtorValidationContext.withEmptyLocalContext
+                                              indexedVecKernelNil.type :=
+                                          AddInductive.ConstructorCheckedExpr.ofClosedRoot
+                                            closed rootCheck
+                                        let consRootScope :
+                                            AddInductive.ConstructorCheckedExpr
+                                              indexedVecCtorValidationContext.withEmptyLocalContext
+                                              indexedVecKernelCons.type :=
+                                          AddInductive.ConstructorCheckedExpr.ofClosedRoot
+                                            consClosed consRootCheck
+                                        cases finalTrace with
+                                        | nil finalSeen =>
+                                            exact
+                                              AddInductive.ConstructorCandidateAlignmentTrace.cons
+                                                nilRootScope
+                                                (by
+                                                  change nilCandidate.trace.storedSpine = true
+                                                  exact nilCandidate_identity.storedSpine)
+                                                (by
+                                                  change 1 =
+                                                    nilTypeTail.spineLength + 1
+                                                  omega)
+                                                (by rfl) nilHeadAlignment <|
+                                              AddInductive.ConstructorCandidateAlignmentTrace.cons
+                                                consRootScope
+                                                (by
+                                                  change consCandidate.trace.storedSpine = true
+                                                  exact consCandidate_identity.storedSpine)
+                                                (by
+                                                  change 4 =
+                                                    consAfterParamTrace.spineLength + 1
+                                                  omega)
+                                                (by rfl) consHeadAlignment <|
+                                              AddInductive.ConstructorCandidateAlignmentTrace.nil
+                                                ((∅ : NameSet).insert
+                                                  indexedVecKernelNil.name |>.insert
+                                                    indexedVecKernelCons.name)
+                                | terminal context source fuel argIdx terminal
+                                    valid =>
+                                    simp [indexedVecValidationConsAfterHead,
+                                      Expr.isForall] at terminal
+                            | terminal context source fuel argIdx terminal valid =>
+                                simp [indexedVecValidationConsAfterN,
+                                  Expr.isForall] at terminal
+                        | terminal context source fuel argIdx terminal valid =>
+                            simp [Expr.isForall] at terminal
+                    | ordinary context fuel argIdx name domain body binderInfo
+                        sortResult noParameter ensureType universeTrace positivity
+                        tail =>
+                        rw [indexedVecStagedStats_eq,
+                          indexedVecValidationStatsParams] at noParameter
+                        simp at noParameter
+                    | terminal context source fuel argIdx terminal valid =>
+                        have consType_eq : indexedVecKernelCons.type =
+                            consCtorTypeRaw := by
+                          simpa [indexedVecKernelCons] using consInfoTypeShape
+                        rw [consType_eq] at terminal
+                        simp [consCtorTypeRaw, Expr.isForall] at terminal
+        | ordinary context fuel argIdx name domain body binderInfo sortResult
+            noParameter ensureType universeTrace positivity nilTypeTail =>
+            rw [indexedVecStagedStats_eq,
+              indexedVecValidationStatsParams] at noParameter
+            simp at noParameter
+        | terminal context source fuel argIdx terminal valid =>
+            simp [indexedVecKernelNil, indexedVecNilInfo,
+              ConstantInfo.type, ConstantInfo.toConstantVal,
+              Expr.isForall] at terminal
+
+/-- The retained `nil`/`cons` validator telescopes, exact analyzer views, field
+checks, positivity target, and terminal family applications all admit the D2
+post-family Theory interpretation despite their distinct fresh identifiers. -/
+theorem indexedVecProducedPostFamilySemantic_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidatePostFamilySemanticRun
+      indexedVecStagedPostFamilyInput) :=
+  indexedVecStagedPostFamilyInput.exists
+
+/-! ## Pre-family constructor safety
+
+The D3 replay uses the terminal family-analysis context, whose environment is
+still exactly `natMap`.  Ordinary constructor fields extend that context;
+recursive fields advance only the fresh-name generator so their locals cannot
+be used by later fields or the result. -/
+
+private def indexedVecPreFamilyContext : AddInductive.Context :=
+  indexedVecFamilyCandidate.trace.terminalContext
+
+private def indexedVecPreFamilyNContext : AddInductive.Context :=
+  indexedVecPreFamilyContext.pushLocalDecl
+    consNName .implicit (.const ``Nat [])
+
+private def indexedVecPreFamilyHeadContext : AddInductive.Context :=
+  indexedVecPreFamilyNContext.pushLocalDecl
+    consHeadName .default indexedVecValidationAlpha
+
+private def indexedVecPreFamilyResultContext : AddInductive.Context :=
+  indexedVecPreFamilyHeadContext.advanceFresh
+
+private theorem indexedVecPreFamilyContext_eq :
+    indexedVecPreFamilyContext = indexedVecValidationFamilyContext := rfl
+
+private theorem indexedVecPreFamilyNContext_eq :
+    indexedVecPreFamilyNContext =
+      { indexedVecValidationNContext with env := indexedVecKernelEnv } := rfl
+
+private theorem indexedVecPreFamilyHeadContext_eq :
+    indexedVecPreFamilyHeadContext =
+      { indexedVecValidationHeadContext with env := indexedVecKernelEnv } := rfl
+
+private theorem indexedVecPreFamilySortCheckValid
+    (context : AddInductive.Context)
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, .sort (.succ (.param `u)),
+        .sort (.succ (.succ (.param `u)))⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilySortCheckTypeM context.lctx
+
+private theorem indexedVecPreFamilyNatCheckValid
+    (context : AddInductive.Context)
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, .const ``Nat [], .sort (.succ .zero)⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilyNatCheckTypeM context.lctx
+
+private theorem indexedVecPreFamilyNatEnsureValid
+    (context : AddInductive.Context)
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.ConstructorEnsureTypeStep.Valid
+      ⟨context, .const ``Nat [], .sort (.succ .zero)⟩ := by
+  unfold AddInductive.ConstructorEnsureTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilyNatEnsureTypeM context.lctx
+
+private theorem indexedVecPreFamilyTelescopeCheckValid
+    (context : AddInductive.Context)
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, indexedVecPreFamilyIndexTelescope,
+        .sort (mkLevelIMax' (.succ .zero)
+          (.succ (.succ (.param `u))))⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilyIndexTelescopeCheckTypeM context.lctx
+
+private theorem indexedVecPreFamilyFVarCheckTypeM
+    (lctx : LocalContext) (id : FVarId) (type : Expr)
+    (find : lctx.find? id =
+      some (.cdecl index id name type bi kind)) :
+    TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType (.fvar id)) =
+        .ok type := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' (.fvar id) false
+      (TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [indexedVecPreFamilyInferTypeFVarCore 9999 lctx
+    ({} : TypeChecker.State) id type Std.HashMap.getElem?_empty find]
+  rfl
+
+private def indexedVecPreFamilyFVarInferOnlyState
+    (id : FVarId) (type : Expr) : TypeChecker.State :=
+  { ({} : TypeChecker.State) with
+    inferTypeI := ({} : TypeChecker.State).inferTypeI.insert
+      (.fvar id) type }
+
+private theorem indexedVecPreFamilyFVarInferOnly
+    (lctx : LocalContext) (id : FVarId) (type : Expr)
+    (find : lctx.find? id =
+      some (.cdecl index id name type bi kind)) :
+    TypeChecker.Inner.inferType (.fvar id) true
+      (TypeChecker.Methods.withFuel 10000)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : TypeChecker.State) =
+        .ok (type, indexedVecPreFamilyFVarInferOnlyState id type) := by
+  change TypeChecker.Inner.inferType' (.fvar id) true
+    (TypeChecker.Methods.withFuel 9999)
+    (indexedVecTypeCheckerContext lctx)
+    ({} : TypeChecker.State) = _
+  unfold TypeChecker.Inner.inferType'
+  simp [indexedVecPreFamilyFVarInferOnlyState,
+    Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferFVar, indexedVecTypeCheckerContext,
+    find, LocalDecl.type, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+private theorem indexedVecPreFamilyFVarEnsureTypeM
+    (lctx : LocalContext) (id : FVarId) (level : Level)
+    (find : lctx.find? id =
+      some (.cdecl index id name (.sort level) bi kind)) :
+    TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig) (TypeChecker.ensureType (.fvar id)) =
+        .ok (.sort level) := by
+  unfold TypeChecker.ensureType TypeChecker.inferType
+    TypeChecker.ensureSort TypeChecker.RecM.run TypeChecker.M.run
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    Pure.pure, StateT.pure, Except.pure, StateT.run',
+    Functor.map, Except.map]
+  rw [show TypeChecker.Inner.inferType (.fvar id) true
+      (TypeChecker.Methods.withFuel 10000)
+      { env := indexedVecKernelEnv, lctx := lctx, safety := .safe,
+        lparams := [`u], fuel := ({} : FuelConfig) }
+      ({} : TypeChecker.State) =
+        .ok (.sort level,
+          indexedVecPreFamilyFVarInferOnlyState id (.sort level)) by
+    simpa [indexedVecTypeCheckerContext] using
+      indexedVecPreFamilyFVarInferOnly lctx id (.sort level) find]
+  rfl
+
+private theorem indexedVecPreFamilyZeroCheckTypeM
+    (lctx : LocalContext) :
+    TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig) (TypeChecker.checkType (.const ``Nat.zero [])) =
+        .ok (.const ``Nat []) := by
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' (.const ``Nat.zero []) false
+      (TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [indexedVecPreFamilyInferTypeZeroCore 9999 lctx
+    ({} : TypeChecker.State) Std.HashMap.getElem?_empty]
+  rfl
+
+private theorem indexedVecPreFamilySuccFVarCheckTypeM
+    (lctx : LocalContext) (id : FVarId)
+    (find : lctx.find? id =
+      some (.cdecl index id name (.const ``Nat []) bi kind)) :
+    TypeChecker.M.run indexedVecKernelEnv .safe lctx [`u]
+      ({} : FuelConfig)
+      (TypeChecker.checkType (replaySuccApp (.fvar id))) =
+        .ok (.const ``Nat []) := by
+  let succState := replayInsert ({} : TypeChecker.State)
+    (.const ``Nat.succ [])
+    (.forallE `n (.const ``Nat []) (.const ``Nat []) .default)
+  let argumentState := replayInsert succState (.fvar id) (.const ``Nat [])
+  have succRun : TypeChecker.Inner.inferType' (.const ``Nat.succ []) false
+      (TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx) ({} : TypeChecker.State) =
+      .ok (.forallE `n (.const ``Nat []) (.const ``Nat []) .default,
+        succState) := by
+    simpa [succState, replayInsert] using
+      (indexedVecPreFamilyInferTypeSuccCore 9999 lctx
+        ({} : TypeChecker.State) Std.HashMap.getElem?_empty)
+  have argumentRun : TypeChecker.Inner.inferType' (.fvar id) false
+      (TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx) succState =
+      .ok (.const ``Nat [], argumentState) := by
+    apply indexedVecPreFamilyInferTypeFVarCore
+    · simp [succState, replayInsert]
+    · exact find
+  have appRun := inferAppCoreOf 9999
+    (indexedVecTypeCheckerContext lctx)
+    ({} : TypeChecker.State) succState argumentState
+    (.const ``Nat.succ []) (.fvar id) (.const ``Nat [])
+    (.const ``Nat []) `n .default
+    (by simp [Expr.hasLooseBVars, Expr.looseBVarRange'])
+    (by simp) succRun argumentRun (by rfl)
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+    (TypeChecker.Inner.inferType' (replaySuccApp (.fvar id)) false
+      (TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : TypeChecker.State)) = _
+  rw [show TypeChecker.Inner.inferType'
+      (replaySuccApp (.fvar id)) false
+      (TypeChecker.Methods.withFuel 9999)
+      (indexedVecTypeCheckerContext lctx)
+      ({} : TypeChecker.State) =
+        .ok (.const ``Nat [],
+          { argumentState with inferTypeC :=
+            (argumentState.inferTypeC.insert
+              (replaySuccApp (.fvar id)) (.const ``Nat [])) }) by
+    simpa [replaySuccApp, Expr.instantiate1_eq,
+      Expr.instantiate1'] using appRun]
+  rfl
+
+private theorem indexedVecPreFamilyFVarCheckValid
+    (context : AddInductive.Context) (id : FVarId) (type : Expr)
+    (find : context.lctx.find? id =
+      some (.cdecl index id name type bi kind))
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, .fvar id, type⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilyFVarCheckTypeM context.lctx id type find
+
+private theorem indexedVecPreFamilyFVarEnsureValid
+    (context : AddInductive.Context) (id : FVarId) (level : Level)
+    (find : context.lctx.find? id =
+      some (.cdecl index id name (.sort level) bi kind))
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.ConstructorEnsureTypeStep.Valid
+      ⟨context, .fvar id, .sort level⟩ := by
+  unfold AddInductive.ConstructorEnsureTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilyFVarEnsureTypeM context.lctx id level find
+
+private theorem indexedVecPreFamilyZeroCheckValid
+    (context : AddInductive.Context)
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, .const ``Nat.zero [], .const ``Nat []⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilyZeroCheckTypeM context.lctx
+
+private theorem indexedVecPreFamilySuccCheckValid
+    (context : AddInductive.Context) (id : FVarId)
+    (find : context.lctx.find? id =
+      some (.cdecl index id name (.const ``Nat []) bi kind))
+    (contextEnv : context.env = indexedVecKernelEnv)
+    (contextSafety : context.safety = .safe)
+    (contextLparams : context.lparams = [`u])
+    (contextFuel : context.fuel = ({} : FuelConfig)) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, replaySuccApp (.fvar id), .const ``Nat []⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  rw [contextEnv, contextSafety, contextLparams, contextFuel]
+  exact indexedVecPreFamilySuccFVarCheckTypeM context.lctx id find
+
+private theorem indexedVecNormalizationFamilyView_eq :
+    indexedVecNormalizationCandidate.families.singleton.familyType.type.view =
+      indexedVecInfo.type := by
+  change indexedVecFamilyCandidate.view = indexedVecInfo.type
+  exact indexedVecFamilyCandidate_view_eq
+
+private theorem indexedVecNormalizationConstructors_eq :
+    indexedVecNormalizationCandidate.families.singleton.constructors =
+      .cons indexedVecNilConstructorCandidate
+        (.cons indexedVecConsConstructorCandidate .nil) := rfl
+
+private theorem indexedVecNormalizationPreFamilyContext_eq :
+    indexedVecNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext =
+      indexedVecPreFamilyContext := rfl
+
+private theorem indexedVecPreFamilySafetyRun :
+    AddInductive.checkConstructorPreFamilySafety
+        indexedVecStagedUniverseInput.staged.family.validation.stats
+        indexedVecNormalizationCandidate.families.singleton.familyType.type.view
+        indexedVecNormalizationCandidate.families.singleton.constructors
+        indexedVecNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext =
+      .ok () := by
+  rw [indexedVecStagedStats_eq]
+  rw [indexedVecNormalizationFamilyView_eq,
+    indexedVecNormalizationConstructors_eq,
+    indexedVecNormalizationPreFamilyContext_eq]
+  change AddInductive.checkConstructorPreFamilySafety
+    indexedVecCandidateInductiveStats indexedVecInfo.type
+    (.cons indexedVecNilConstructorCandidate
+      (.cons indexedVecConsConstructorCandidate .nil))
+    indexedVecPreFamilyContext = .ok ()
+  have alphaFind : indexedVecPreFamilyContext.lctx.find?
+      indexedVecValidationAlphaId =
+        some (.cdecl 0 indexedVecValidationAlphaId
+          indexedVecValidationParamName
+          (.sort (.succ (.param `u))) .default .default) := by
+    change indexedVecCtorValidationContext.lctx.find?
+      indexedVecValidationAlphaId = _
+    exact indexedVecValidationAlphaFind
+  have alphaFindN : indexedVecPreFamilyNContext.lctx.find?
+      indexedVecValidationAlphaId =
+        some (.cdecl 0 indexedVecValidationAlphaId
+          indexedVecValidationParamName
+          (.sort (.succ (.param `u))) .default .default) := by
+    change indexedVecValidationNContext.lctx.find?
+      indexedVecValidationAlphaId = _
+    exact indexedVecValidationAlphaFindInN
+  have alphaFindHead : indexedVecPreFamilyHeadContext.lctx.find?
+      indexedVecValidationAlphaId =
+        some (.cdecl 0 indexedVecValidationAlphaId
+          indexedVecValidationParamName
+          (.sort (.succ (.param `u))) .default .default) := by
+    change indexedVecValidationHeadContext.lctx.find?
+      indexedVecValidationAlphaId = _
+    exact indexedVecValidationAlphaFindInHead
+  have nFindHead : indexedVecPreFamilyHeadContext.lctx.find?
+      indexedVecValidationNId =
+        some (.cdecl 2 indexedVecValidationNId consNName
+          (.const ``Nat []) .implicit .default) := by
+    change indexedVecValidationHeadContext.lctx.find?
+      indexedVecValidationNId = _
+    exact indexedVecValidationNFindInHead
+  have nFindResult : indexedVecPreFamilyResultContext.lctx.find?
+      indexedVecValidationNId =
+        some (.cdecl 2 indexedVecValidationNId consNName
+          (.const ``Nat []) .implicit .default) := by
+    simpa [indexedVecPreFamilyResultContext,
+      AddInductive.Context.advanceFresh] using nFindHead
+  have baseFresh : indexedVecPreFamilyContext.lctx.find?
+      indexedVecPreFamilyContext.freshFVarId = none := by
+    change indexedVecCtorValidationContext.lctx.find?
+      indexedVecCtorValidationContext.freshFVarId = none
+    exact indexedVecCtorValidationContextFresh
+  have nFresh : indexedVecPreFamilyNContext.lctx.find?
+      indexedVecPreFamilyNContext.freshFVarId = none := by
+    change indexedVecValidationNContext.lctx.find?
+      indexedVecValidationNContext.freshFVarId = none
+    exact indexedVecValidationNContextFresh
+  have headFresh : indexedVecPreFamilyHeadContext.lctx.find?
+      indexedVecPreFamilyHeadContext.freshFVarId = none := by
+    change indexedVecValidationHeadContext.lctx.find?
+      indexedVecValidationHeadContext.freshFVarId = none
+    exact indexedVecValidationHeadContextFresh
+  let baseTelescope : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyContext indexedVecPreFamilyIndexTelescope :=
+    .ofRun (by
+      simp [indexedVecPreFamilyIndexTelescope, FVarsIn,
+        Level.hasMVar'])
+      (indexedVecPreFamilyTelescopeCheckValid
+        indexedVecPreFamilyContext rfl rfl rfl rfl)
+  let headTelescope : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyHeadContext indexedVecPreFamilyIndexTelescope :=
+    .ofRun (by
+      simp [indexedVecPreFamilyIndexTelescope, FVarsIn,
+        Level.hasMVar'])
+      (indexedVecPreFamilyTelescopeCheckValid
+        indexedVecPreFamilyHeadContext rfl rfl rfl rfl)
+  let resultTelescope : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyResultContext indexedVecPreFamilyIndexTelescope :=
+    .ofRun (by
+      simp [indexedVecPreFamilyIndexTelescope, FVarsIn,
+        Level.hasMVar'])
+      (indexedVecPreFamilyTelescopeCheckValid
+        indexedVecPreFamilyResultContext rfl rfl rfl rfl)
+  let baseSort : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyContext (.sort (.succ (.param `u))) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (indexedVecPreFamilySortCheckValid
+        indexedVecPreFamilyContext rfl rfl rfl rfl)
+  let headSort : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyHeadContext (.sort (.succ (.param `u))) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (indexedVecPreFamilySortCheckValid
+        indexedVecPreFamilyHeadContext rfl rfl rfl rfl)
+  let resultSort : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyResultContext (.sort (.succ (.param `u))) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (indexedVecPreFamilySortCheckValid
+        indexedVecPreFamilyResultContext rfl rfl rfl rfl)
+  let baseNat : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyContext (.const ``Nat []) :=
+    .ofRun (by simp [FVarsIn])
+      (indexedVecPreFamilyNatCheckValid
+        indexedVecPreFamilyContext rfl rfl rfl rfl)
+  let headNat : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyHeadContext (.const ``Nat []) :=
+    .ofRun (by simp [FVarsIn])
+      (indexedVecPreFamilyNatCheckValid
+        indexedVecPreFamilyHeadContext rfl rfl rfl rfl)
+  let resultNat : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyResultContext (.const ``Nat []) :=
+    .ofRun (by simp [FVarsIn])
+      (indexedVecPreFamilyNatCheckValid
+        indexedVecPreFamilyResultContext rfl rfl rfl rfl)
+  let zeroChecked : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyContext (.const ``Nat.zero []) :=
+    .ofRun (by simp [FVarsIn])
+      (indexedVecPreFamilyZeroCheckValid
+        indexedVecPreFamilyContext rfl rfl rfl rfl)
+  let nChecked : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyHeadContext indexedVecValidationNExpr := by
+    rw [indexedVecValidationNExprShape]
+    exact .ofRun (by
+      change (indexedVecPreFamilyHeadContext.lctx.find?
+        indexedVecValidationNId).isSome = true
+      rw [nFindHead]
+      rfl) (indexedVecPreFamilyFVarCheckValid
+        indexedVecPreFamilyHeadContext indexedVecValidationNId
+        (.const ``Nat []) nFindHead rfl rfl rfl rfl)
+  let succChecked : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyResultContext
+        (replaySuccApp indexedVecValidationNExpr) := by
+    rw [indexedVecValidationNExprShape]
+    exact .ofRun (by
+      simp [replaySuccApp, FVarsIn]
+      change (indexedVecPreFamilyResultContext.lctx.find?
+        indexedVecValidationNId).isSome = true
+      rw [nFindResult]
+      rfl) (indexedVecPreFamilySuccCheckValid
+        indexedVecPreFamilyResultContext indexedVecValidationNId
+        nFindResult rfl rfl rfl rfl)
+  let zeroComparison : AddInductive.CandidateIsDefEqObservation
+      indexedVecPreFamilyContext (.const ``Nat []) (.const ``Nat []) :=
+    ⟨candidateIsDefEqSelfValid indexedVecPreFamilyContext
+      (.const ``Nat []) 9999 rfl⟩
+  let nComparison : AddInductive.CandidateIsDefEqObservation
+      indexedVecPreFamilyHeadContext (.const ``Nat []) (.const ``Nat []) :=
+    ⟨candidateIsDefEqSelfValid indexedVecPreFamilyHeadContext
+      (.const ``Nat []) 9999 rfl⟩
+  let succComparison : AddInductive.CandidateIsDefEqObservation
+      indexedVecPreFamilyResultContext (.const ``Nat []) (.const ``Nat []) :=
+    ⟨candidateIsDefEqSelfValid indexedVecPreFamilyResultContext
+      (.const ``Nat []) 9999 rfl⟩
+  let nilSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      indexedVecPreFamilyContext indexedVecPreFamilyIndexTelescope
+        [.const ``Nat.zero []] := by
+    unfold indexedVecPreFamilyIndexTelescope
+    exact .cons indexedVecPreFamilyContext
+      indexedVecInfo.type.bindingBody!.bindingName!
+      (.const ``Nat []) (.sort (.succ (.param `u))) .default
+      (.const ``Nat.zero []) [] baseTelescope
+      ⟨zeroChecked, baseNat, zeroComparison⟩
+      (by
+        simpa [Expr.instantiate1_eq, Expr.instantiate1'] using
+          (AddInductive.ConstructorPreFamilyIndexSpineTrace.nil
+            indexedVecPreFamilyContext
+            (.sort (.succ (.param `u))) baseSort rfl))
+  let recursiveSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      indexedVecPreFamilyHeadContext indexedVecPreFamilyIndexTelescope
+        [indexedVecValidationNExpr] := by
+    unfold indexedVecPreFamilyIndexTelescope
+    exact .cons indexedVecPreFamilyHeadContext
+      indexedVecInfo.type.bindingBody!.bindingName!
+      (.const ``Nat []) (.sort (.succ (.param `u))) .default
+      indexedVecValidationNExpr [] headTelescope
+      ⟨nChecked, headNat, nComparison⟩
+      (by
+        simpa [Expr.instantiate1_eq, Expr.instantiate1'] using
+          (AddInductive.ConstructorPreFamilyIndexSpineTrace.nil
+            indexedVecPreFamilyHeadContext
+            (.sort (.succ (.param `u))) headSort rfl))
+  let resultSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      indexedVecPreFamilyResultContext indexedVecPreFamilyIndexTelescope
+        [replaySuccApp indexedVecValidationNExpr] := by
+    unfold indexedVecPreFamilyIndexTelescope
+    exact .cons indexedVecPreFamilyResultContext
+      indexedVecInfo.type.bindingBody!.bindingName!
+      (.const ``Nat []) (.sort (.succ (.param `u))) .default
+      (replaySuccApp indexedVecValidationNExpr) [] resultTelescope
+      ⟨succChecked, resultNat, succComparison⟩
+      (by
+        simpa [Expr.instantiate1_eq, Expr.instantiate1'] using
+          (AddInductive.ConstructorPreFamilyIndexSpineTrace.nil
+            indexedVecPreFamilyResultContext
+            (.sort (.succ (.param `u))) resultSort rfl))
+  have nilArgs : indexedVecValidationNilResult.getAppArgs.toList.drop
+      indexedVecCandidateInductiveStats.params.size =
+        [.const ``Nat.zero []] := by
+    simp [indexedVecValidationNilResult,
+      indexedVecValidationStatsParams, ctorIndexedVecAppGetAppArgs]
+  obtain ⟨nilTargetSpine, nilTargetSpineRun⟩ :
+      ∃ nilTargetSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+          indexedVecPreFamilyContext indexedVecPreFamilyIndexTelescope
+          (indexedVecValidationNilResult.getAppArgs.toList.drop
+            indexedVecCandidateInductiveStats.params.size),
+        AddInductive.ConstructorPreFamilyIndexSpineTrace.build
+            indexedVecPreFamilyContext indexedVecPreFamilyIndexTelescope
+            (indexedVecValidationNilResult.getAppArgs.toList.drop
+              indexedVecCandidateInductiveStats.params.size) =
+          .ok nilTargetSpine := by
+    rw [nilArgs]
+    exact ⟨nilSpine, nilSpine.build_eq⟩
+  have nilIndependent : AddInductive.constructorIndependentOf
+      indexedVecValidationNilResult [] = true := by
+    simp [AddInductive.constructorIndependentOf]
+  let nilTerminalTrace : AddInductive.ConstructorPreFamilyViewTrace
+      indexedVecCandidateInductiveStats 0
+      indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+      indexedVecValidationNilResult 1 [] false :=
+    .terminal indexedVecPreFamilyContext indexedVecValidationNilResult
+      1 [] false indexedVecValidationNilResultIsValid nilIndependent
+      nilTargetSpine
+  have nilTerminalRun :
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecValidationNilResult 1 [] false 999 =
+        .ok nilTerminalTrace := by
+    exact AddInductive.ConstructorPreFamilyViewTrace.terminal_build_eq
+      (fuel := 998) rfl indexedVecValidationNilResultIsValid nilIndependent
+      nilTargetSpine
+  obtain ⟨nilTailTrace, nilTailRun⟩ :
+      ∃ nilTailTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          (nilCtorBodyRaw.instantiate1 indexedVecValidationAlpha)
+          1 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            (nilCtorBodyRaw.instantiate1 indexedVecValidationAlpha)
+            1 [] false 999 =
+          .ok nilTailTrace := by
+    rw [show nilCtorBodyRaw.instantiate1 indexedVecValidationAlpha =
+        indexedVecValidationNilResult by
+      simpa [nilInfoTypeShape, nilCtorTypeRaw] using
+        indexedVecValidationNilResultShape]
+    exact ⟨nilTerminalTrace, nilTerminalRun⟩
+  have parameterAtZero : indexedVecCandidateInductiveStats.params[0]? =
+      some indexedVecValidationAlpha := by
+    rw [indexedVecValidationStatsParams]
+    rfl
+  obtain ⟨nilRawViewTrace, nilRawViewRun⟩ :
+      ∃ nilRawViewTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          nilCtorTypeRaw 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            nilCtorTypeRaw 0 [] false 1000 = .ok nilRawViewTrace := by
+    simp only [nilCtorTypeRaw,
+      AddInductive.ConstructorPreFamilyViewTrace.build]
+    split
+    · rename_i parameter parameterAt
+      rw [parameterAtZero] at parameterAt
+      cases parameterAt
+      rw [nilTailRun]
+      exact ⟨_, rfl⟩
+    · rename_i noParameter
+      rw [parameterAtZero] at noParameter
+      contradiction
+  obtain ⟨nilViewTrace, nilViewRun⟩ :
+      ∃ nilViewTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecNilInfo.type 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            indexedVecNilInfo.type 0 [] false 1000 =
+          .ok nilViewTrace := by
+    rw [nilInfoTypeShape]
+    exact ⟨nilRawViewTrace, nilRawViewRun⟩
+  obtain ⟨nilHeadTrace, nilHeadRun⟩ :
+      ∃ nilHeadTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecNilConstructorCandidate.type.view 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            indexedVecNilConstructorCandidate.type.view 0 [] false 1000 =
+          .ok nilHeadTrace := by
+    change ∃ nilHeadTrace : AddInductive.ConstructorPreFamilyViewTrace
+        indexedVecCandidateInductiveStats 0
+        indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+        nilCandidate.view 0 [] false,
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          nilCandidate.view 0 [] false 1000 = .ok nilHeadTrace
+    rw [nilCandidate_view_eq]
+    exact ⟨nilViewTrace, nilViewRun⟩
+  let baseNatEnsure : AddInductive.ConstructorEnsureTypeObservation
+      indexedVecPreFamilyContext (.const ``Nat []) :=
+    ⟨.sort (.succ .zero), indexedVecPreFamilyNatEnsureValid
+      indexedVecPreFamilyContext rfl rfl rfl rfl⟩
+  let baseNatConsumed : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyContext
+      (AddInductive.consumeTypeAnnotations (.const ``Nat [])) := by
+    rw [indexedVecValidationConsumeNat]
+    exact baseNat
+  let baseNatAnnotations : AddInductive.CandidateIsDefEqObservation
+      indexedVecPreFamilyContext (.const ``Nat [])
+      (AddInductive.consumeTypeAnnotations (.const ``Nat [])) := by
+    rw [indexedVecValidationConsumeNat]
+    exact ⟨candidateIsDefEqSelfValid indexedVecPreFamilyContext
+      (.const ``Nat []) 9999 rfl⟩
+  let alphaChecked : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyNContext indexedVecValidationAlpha := by
+    rw [indexedVecValidationAlphaShape]
+    exact .ofRun (by
+      change (indexedVecPreFamilyNContext.lctx.find?
+        indexedVecValidationAlphaId).isSome = true
+      rw [alphaFindN]
+      rfl) (indexedVecPreFamilyFVarCheckValid
+        indexedVecPreFamilyNContext indexedVecValidationAlphaId
+        (.sort (.succ (.param `u))) alphaFindN rfl rfl rfl rfl)
+  let alphaEnsure : AddInductive.ConstructorEnsureTypeObservation
+      indexedVecPreFamilyNContext indexedVecValidationAlpha := by
+    rw [indexedVecValidationAlphaShape]
+    exact ⟨.sort (.succ (.param `u)),
+      indexedVecPreFamilyFVarEnsureValid indexedVecPreFamilyNContext
+        indexedVecValidationAlphaId (.succ (.param `u)) alphaFindN
+        rfl rfl rfl rfl⟩
+  let alphaConsumed : AddInductive.ConstructorCheckedExpr
+      indexedVecPreFamilyNContext
+      (AddInductive.consumeTypeAnnotations indexedVecValidationAlpha) := by
+    rw [indexedVecValidationConsumeAlpha]
+    exact alphaChecked
+  let alphaAnnotations : AddInductive.CandidateIsDefEqObservation
+      indexedVecPreFamilyNContext indexedVecValidationAlpha
+      (AddInductive.consumeTypeAnnotations indexedVecValidationAlpha) := by
+    rw [indexedVecValidationConsumeAlpha]
+    exact ⟨candidateIsDefEqSelfValid indexedVecPreFamilyNContext
+      indexedVecValidationAlpha 9999 rfl⟩
+  have alphaNeRemoved : indexedVecValidationAlphaId ≠
+      indexedVecPreFamilyHeadContext.freshFVarId := by
+    intro equality
+    have fresh := headFresh
+    rw [← equality, alphaFindHead] at fresh
+    contradiction
+  have nNeRemoved : indexedVecValidationNId ≠
+      indexedVecPreFamilyHeadContext.freshFVarId := by
+    intro equality
+    have fresh := headFresh
+    rw [← equality, nFindHead] at fresh
+    contradiction
+  have recursiveArgs :
+      (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr).getAppArgs.toList.drop
+        indexedVecCandidateInductiveStats.params.size =
+      [indexedVecValidationNExpr] := by
+    simp [indexedVecValidationStatsParams, ctorIndexedVecAppGetAppArgs]
+  obtain ⟨recursiveTargetSpine, recursiveTargetSpineRun⟩ :
+      ∃ recursiveTargetSpine :
+          AddInductive.ConstructorPreFamilyIndexSpineTrace
+            indexedVecPreFamilyHeadContext
+            indexedVecPreFamilyIndexTelescope
+            ((ctorIndexedVecApp indexedVecValidationAlpha
+                indexedVecValidationNExpr).getAppArgs.toList.drop
+              indexedVecCandidateInductiveStats.params.size),
+        AddInductive.ConstructorPreFamilyIndexSpineTrace.build
+            indexedVecPreFamilyHeadContext
+            indexedVecPreFamilyIndexTelescope
+            ((ctorIndexedVecApp indexedVecValidationAlpha
+                indexedVecValidationNExpr).getAppArgs.toList.drop
+              indexedVecCandidateInductiveStats.params.size) =
+          .ok recursiveTargetSpine := by
+    rw [recursiveArgs]
+    exact ⟨recursiveSpine, recursiveSpine.build_eq⟩
+  have recursiveTargetValid : AddInductive.isValidIndAppIdx
+      indexedVecCandidateInductiveStats
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) 0 = true :=
+    indexedVecValidationAppIsValidIdx indexedVecValidationNExpr
+      indexedVecValidationNHasNoIndOcc
+  let recursiveFieldTrace : AddInductive.ConstructorPreFamilyRecursiveTrace
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyHeadContext
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)
+      indexedVecPreFamilyHeadContext.fuel.inductiveFuel :=
+    .target indexedVecPreFamilyHeadContext
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)
+      recursiveTargetValid recursiveTargetSpine
+  have recursiveFieldRun : AddInductive.ConstructorPreFamilyRecursiveTrace.build
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyHeadContext
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr)
+      indexedVecPreFamilyHeadContext.fuel.inductiveFuel =
+        .ok recursiveFieldTrace := by
+    exact AddInductive.ConstructorPreFamilyRecursiveTrace.target_build_eq
+      (fuel := 999) rfl recursiveTargetValid recursiveTargetSpine
+  have recursiveIndependent : AddInductive.constructorIndependentOf
+      (ctorIndexedVecApp indexedVecValidationAlpha
+        indexedVecValidationNExpr) [] = true := by
+    simp [AddInductive.constructorIndependentOf]
+  have resultArgs : indexedVecValidationConsResult.getAppArgs.toList.drop
+      indexedVecCandidateInductiveStats.params.size =
+        [replaySuccApp indexedVecValidationNExpr] := by
+    simp [indexedVecValidationConsResult,
+      indexedVecValidationStatsParams, ctorIndexedVecAppGetAppArgs]
+  obtain ⟨resultTargetSpine, resultTargetSpineRun⟩ :
+      ∃ resultTargetSpine :
+          AddInductive.ConstructorPreFamilyIndexSpineTrace
+            indexedVecPreFamilyResultContext
+            indexedVecPreFamilyIndexTelescope
+            (indexedVecValidationConsResult.getAppArgs.toList.drop
+              indexedVecCandidateInductiveStats.params.size),
+        AddInductive.ConstructorPreFamilyIndexSpineTrace.build
+            indexedVecPreFamilyResultContext
+            indexedVecPreFamilyIndexTelescope
+            (indexedVecValidationConsResult.getAppArgs.toList.drop
+              indexedVecCandidateInductiveStats.params.size) =
+          .ok resultTargetSpine := by
+    rw [resultArgs]
+    exact ⟨resultSpine, resultSpine.build_eq⟩
+  have resultIndependent : AddInductive.constructorIndependentOf
+      indexedVecValidationConsResult
+      [indexedVecPreFamilyHeadContext.freshFVarId] = true := by
+    simp [AddInductive.constructorIndependentOf,
+      indexedVecValidationConsResult, ctorIndexedVecApp, replaySuccApp,
+      Expr.fvarsList,
+      indexedVecValidationAlphaShape, indexedVecValidationNExprShape,
+      alphaNeRemoved, nNeRemoved]
+  let resultTerminalTrace : AddInductive.ConstructorPreFamilyViewTrace
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyResultContext indexedVecValidationConsResult 4
+      [indexedVecPreFamilyHeadContext.freshFVarId] true :=
+    .terminal indexedVecPreFamilyResultContext
+      indexedVecValidationConsResult 4
+      [indexedVecPreFamilyHeadContext.freshFVarId] true
+      indexedVecValidationConsResultIsValid resultIndependent
+      resultTargetSpine
+  have resultTerminalRun : AddInductive.ConstructorPreFamilyViewTrace.build
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyResultContext indexedVecValidationConsResult 4
+      [indexedVecPreFamilyHeadContext.freshFVarId] true 996 =
+        .ok resultTerminalTrace := by
+    exact AddInductive.ConstructorPreFamilyViewTrace.terminal_build_eq
+      (fuel := 995) rfl indexedVecValidationConsResultIsValid
+      resultIndependent resultTargetSpine
+  obtain ⟨consResultTailTrace, consResultTailRun⟩ :
+      ∃ consResultTailTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope
+          indexedVecPreFamilyHeadContext.advanceFresh
+          (indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+            indexedVecPreFamilyHeadContext.freshExpr)
+          4 [indexedVecPreFamilyHeadContext.freshFVarId] true,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope
+            indexedVecPreFamilyHeadContext.advanceFresh
+            (indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+              indexedVecPreFamilyHeadContext.freshExpr)
+            4 [indexedVecPreFamilyHeadContext.freshFVarId] true 996 =
+          .ok consResultTailTrace := by
+    rw [show indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+        indexedVecPreFamilyHeadContext.freshExpr =
+          indexedVecValidationConsResult by
+      change indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+        indexedVecValidationHeadContext.freshExpr = _
+      exact indexedVecValidationConsResultShape]
+    exact ⟨resultTerminalTrace, resultTerminalRun⟩
+  obtain ⟨explicitResultTailTrace, explicitResultTailRun⟩ :
+      ∃ explicitResultTailTrace :
+          AddInductive.ConstructorPreFamilyViewTrace
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope
+            indexedVecPreFamilyHeadContext.advanceFresh
+            ((ctorIndexedVecApp indexedVecValidationAlpha
+              (replaySuccApp indexedVecValidationNExpr)).instantiate1
+                indexedVecPreFamilyHeadContext.freshExpr)
+            4 [indexedVecPreFamilyHeadContext.freshFVarId] true,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope
+            indexedVecPreFamilyHeadContext.advanceFresh
+            ((ctorIndexedVecApp indexedVecValidationAlpha
+              (replaySuccApp indexedVecValidationNExpr)).instantiate1
+                indexedVecPreFamilyHeadContext.freshExpr)
+            4 [indexedVecPreFamilyHeadContext.freshFVarId] true 996 =
+          .ok explicitResultTailTrace := by
+    change ∃ explicitResultTailTrace :
+        AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope
+          indexedVecPreFamilyHeadContext.advanceFresh
+          (indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+            indexedVecPreFamilyHeadContext.freshExpr)
+          4 [indexedVecPreFamilyHeadContext.freshFVarId] true,
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope
+          indexedVecPreFamilyHeadContext.advanceFresh
+          (indexedVecValidationConsAfterHead.bindingBody!.instantiate1
+            indexedVecPreFamilyHeadContext.freshExpr)
+          4 [indexedVecPreFamilyHeadContext.freshFVarId] true 996 =
+        .ok explicitResultTailTrace
+    exact ⟨consResultTailTrace, consResultTailRun⟩
+  have noParameterThree : indexedVecCandidateInductiveStats.params[3]? =
+      none := by
+    rw [indexedVecValidationStatsParams]
+    rfl
+  obtain ⟨consAfterHeadTrace, consAfterHeadRun⟩ :
+      ∃ consAfterHeadTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyHeadContext
+          indexedVecValidationConsAfterHead 3 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyHeadContext
+            indexedVecValidationConsAfterHead 3 [] false 997 =
+          .ok consAfterHeadTrace := by
+    simp only [indexedVecValidationConsAfterHead,
+      AddInductive.ConstructorPreFamilyViewTrace.build]
+    split
+    · rename_i parameter parameterAt
+      rw [noParameterThree] at parameterAt
+      contradiction
+    · split
+      · rename_i nonrecursive
+        rw [indexedVecValidationTailHasIndOcc] at nonrecursive
+        contradiction
+      · rw [dif_pos recursiveIndependent, recursiveFieldRun]
+        simp only [Bind.bind, Except.bind]
+        rw [dif_pos headFresh]
+        rw [explicitResultTailRun]
+        exact ⟨_, rfl⟩
+  obtain ⟨consHeadTailTrace, consHeadTailRun⟩ :
+      ∃ consHeadTailTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyHeadContext
+          (indexedVecValidationConsAfterN.bindingBody!.instantiate1
+            indexedVecPreFamilyNContext.freshExpr)
+          3 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyHeadContext
+            (indexedVecValidationConsAfterN.bindingBody!.instantiate1
+              indexedVecPreFamilyNContext.freshExpr)
+            3 [] false 997 = .ok consHeadTailTrace := by
+    rw [show indexedVecValidationConsAfterN.bindingBody!.instantiate1
+        indexedVecPreFamilyNContext.freshExpr =
+          indexedVecValidationConsAfterHead by
+      change indexedVecValidationConsAfterN.bindingBody!.instantiate1
+        indexedVecValidationNContext.freshExpr = _
+      exact indexedVecValidationConsAfterHeadShape]
+    exact ⟨consAfterHeadTrace, consAfterHeadRun⟩
+  obtain ⟨explicitHeadTailTrace, explicitHeadTailRun⟩ :
+      ∃ explicitHeadTailTrace :
+          AddInductive.ConstructorPreFamilyViewTrace
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope
+            (indexedVecPreFamilyNContext.pushLocalDecl consHeadName .default
+              (AddInductive.consumeTypeAnnotations
+                indexedVecValidationAlpha))
+            ((Expr.forallE consTailName
+              (ctorIndexedVecApp indexedVecValidationAlpha
+                indexedVecValidationNExpr)
+              (ctorIndexedVecApp indexedVecValidationAlpha
+                (replaySuccApp indexedVecValidationNExpr))
+              .default).instantiate1 indexedVecPreFamilyNContext.freshExpr)
+            3 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope
+            (indexedVecPreFamilyNContext.pushLocalDecl consHeadName .default
+              (AddInductive.consumeTypeAnnotations
+                indexedVecValidationAlpha))
+            ((Expr.forallE consTailName
+              (ctorIndexedVecApp indexedVecValidationAlpha
+                indexedVecValidationNExpr)
+              (ctorIndexedVecApp indexedVecValidationAlpha
+                (replaySuccApp indexedVecValidationNExpr))
+              .default).instantiate1 indexedVecPreFamilyNContext.freshExpr)
+            3 [] false 997 = .ok explicitHeadTailTrace := by
+    rw [indexedVecValidationConsumeAlpha]
+    rw [show Expr.forallE consTailName
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          indexedVecValidationNExpr)
+        (ctorIndexedVecApp indexedVecValidationAlpha
+          (replaySuccApp indexedVecValidationNExpr)) .default =
+          indexedVecValidationConsAfterN.bindingBody! by rfl]
+    exact ⟨consHeadTailTrace, consHeadTailRun⟩
+  have noParameterTwo : indexedVecCandidateInductiveStats.params[2]? =
+      none := by
+    rw [indexedVecValidationStatsParams]
+    rfl
+  obtain ⟨consAfterNTrace, consAfterNRun⟩ :
+      ∃ consAfterNTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyNContext
+          indexedVecValidationConsAfterN 2 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyNContext
+            indexedVecValidationConsAfterN 2 [] false 998 =
+          .ok consAfterNTrace := by
+    simp only [indexedVecValidationConsAfterN,
+      AddInductive.ConstructorPreFamilyViewTrace.build]
+    split
+    · rename_i parameter parameterAt
+      rw [noParameterTwo] at parameterAt
+      contradiction
+    · split
+      · rw [alphaChecked.check_eq, alphaEnsure.observe_eq,
+          alphaConsumed.check_eq]
+        rw [dif_pos (by
+          simp [AddInductive.constructorIndependentOf])]
+        simp only [Bind.bind, Except.bind]
+        rw [alphaAnnotations.observe_eq]
+        simp only []
+        rw [dif_pos nFresh]
+        rw [explicitHeadTailRun]
+        exact ⟨_, rfl⟩
+      · rename_i recursive
+        rw [indexedVecValidationAlphaHasNoIndOcc] at recursive
+        contradiction
+  obtain ⟨consNTailTrace, consNTailRun⟩ :
+      ∃ consNTailTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyNContext
+          (indexedVecValidationConsAfterParam.bindingBody!.instantiate1
+            indexedVecPreFamilyContext.freshExpr)
+          2 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyNContext
+            (indexedVecValidationConsAfterParam.bindingBody!.instantiate1
+              indexedVecPreFamilyContext.freshExpr)
+            2 [] false 998 = .ok consNTailTrace := by
+    rw [show indexedVecValidationConsAfterParam.bindingBody!.instantiate1
+        indexedVecPreFamilyContext.freshExpr =
+          indexedVecValidationConsAfterN by
+      change indexedVecValidationConsAfterParam.bindingBody!.instantiate1
+        indexedVecValidationNExpr = _
+      exact indexedVecValidationConsAfterNShape]
+    exact ⟨consAfterNTrace, consAfterNRun⟩
+  obtain ⟨explicitNTailTrace, explicitNTailRun⟩ :
+      ∃ explicitNTailTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope
+          (indexedVecPreFamilyContext.pushLocalDecl consNName .implicit
+            (AddInductive.consumeTypeAnnotations (.const ``Nat [])))
+          ((Expr.forallE consHeadName indexedVecValidationAlpha
+            (Expr.forallE consTailName
+              (ctorIndexedVecApp indexedVecValidationAlpha (.bvar 1))
+              (ctorIndexedVecApp indexedVecValidationAlpha
+                (replaySuccApp (.bvar 2))) .default)
+            .default).instantiate1 indexedVecPreFamilyContext.freshExpr)
+          2 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope
+            (indexedVecPreFamilyContext.pushLocalDecl consNName .implicit
+              (AddInductive.consumeTypeAnnotations (.const ``Nat [])))
+            ((Expr.forallE consHeadName indexedVecValidationAlpha
+              (Expr.forallE consTailName
+                (ctorIndexedVecApp indexedVecValidationAlpha (.bvar 1))
+                (ctorIndexedVecApp indexedVecValidationAlpha
+                  (replaySuccApp (.bvar 2))) .default)
+              .default).instantiate1 indexedVecPreFamilyContext.freshExpr)
+            2 [] false 998 = .ok explicitNTailTrace := by
+    rw [indexedVecValidationConsumeNat]
+    rw [show Expr.forallE consHeadName indexedVecValidationAlpha
+        (Expr.forallE consTailName
+          (ctorIndexedVecApp indexedVecValidationAlpha (.bvar 1))
+          (ctorIndexedVecApp indexedVecValidationAlpha
+            (replaySuccApp (.bvar 2))) .default) .default =
+          indexedVecValidationConsAfterParam.bindingBody! by
+      rw [indexedVecValidationConsAfterParamExplicitShape]
+      rfl]
+    exact ⟨consNTailTrace, consNTailRun⟩
+  have noParameterOne : indexedVecCandidateInductiveStats.params[1]? =
+      none := by
+    rw [indexedVecValidationStatsParams]
+    rfl
+  obtain ⟨consAfterParamTrace, consAfterParamRun⟩ :
+      ∃ consAfterParamTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecValidationConsAfterParam 1 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            indexedVecValidationConsAfterParam 1 [] false 999 =
+          .ok consAfterParamTrace := by
+    rw [indexedVecValidationConsAfterParamExplicitShape]
+    simp only [AddInductive.ConstructorPreFamilyViewTrace.build]
+    split
+    · rename_i parameter parameterAt
+      rw [noParameterOne] at parameterAt
+      contradiction
+    · split
+      · rw [baseNat.check_eq, baseNatEnsure.observe_eq,
+          baseNatConsumed.check_eq]
+        rw [dif_pos (by
+          simp [AddInductive.constructorIndependentOf])]
+        simp only [Bind.bind, Except.bind]
+        rw [baseNatAnnotations.observe_eq]
+        simp only []
+        rw [dif_pos baseFresh]
+        rw [explicitNTailRun]
+        exact ⟨_, rfl⟩
+      · rename_i recursive
+        rw [indexedVecValidationNatHasNoIndOcc] at recursive
+        contradiction
+  obtain ⟨consParameterTailTrace, consParameterTailRun⟩ :
+      ∃ consParameterTailTrace :
+          AddInductive.ConstructorPreFamilyViewTrace
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            (consNTypeRaw.instantiate1 indexedVecValidationAlpha)
+            1 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            (consNTypeRaw.instantiate1 indexedVecValidationAlpha)
+            1 [] false 999 = .ok consParameterTailTrace := by
+    change ∃ consParameterTailTrace :
+        AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecValidationConsAfterParam 1 [] false,
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecValidationConsAfterParam 1 [] false 999 =
+        .ok consParameterTailTrace
+    exact ⟨consAfterParamTrace, consAfterParamRun⟩
+  obtain ⟨consRawViewTrace, consRawViewRun⟩ :
+      ∃ consRawViewTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          consCtorTypeRaw 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            consCtorTypeRaw 0 [] false 1000 = .ok consRawViewTrace := by
+    simp only [consCtorTypeRaw,
+      AddInductive.ConstructorPreFamilyViewTrace.build]
+    split
+    · rename_i parameter parameterAt
+      rw [parameterAtZero] at parameterAt
+      cases parameterAt
+      rw [consParameterTailRun]
+      exact ⟨_, rfl⟩
+    · rename_i noParameter
+      rw [parameterAtZero] at noParameter
+      contradiction
+  obtain ⟨consViewTrace, consViewRun⟩ :
+      ∃ consViewTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecConsInfo.type 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            indexedVecConsInfo.type 0 [] false 1000 = .ok consViewTrace := by
+    rw [consInfoTypeShape]
+    exact ⟨consRawViewTrace, consRawViewRun⟩
+  obtain ⟨consHeadTrace, consHeadRun⟩ :
+      ∃ consHeadTrace : AddInductive.ConstructorPreFamilyViewTrace
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          indexedVecConsConstructorCandidate.type.view 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            indexedVecCandidateInductiveStats 0
+            indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+            indexedVecConsConstructorCandidate.type.view 0 [] false 1000 =
+          .ok consHeadTrace := by
+    change ∃ consHeadTrace : AddInductive.ConstructorPreFamilyViewTrace
+        indexedVecCandidateInductiveStats 0
+        indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+        consCandidate.view 0 [] false,
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          consCandidate.view 0 [] false 1000 = .ok consHeadTrace
+    rw [consCandidate_view_eq]
+    exact ⟨consViewTrace, consViewRun⟩
+  let consListTrace : AddInductive.ConstructorPreFamilyListTrace
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyContext
+      (.cons indexedVecConsConstructorCandidate .nil) :=
+    .cons consHeadTrace .nil
+  have consListRun : AddInductive.ConstructorPreFamilyListTrace.build
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyContext
+      (.cons indexedVecConsConstructorCandidate .nil) =
+        .ok consListTrace := by
+    exact AddInductive.ConstructorPreFamilyListTrace.cons_build_eq
+      consHeadTrace consHeadRun .nil rfl
+  let constructorListTrace : AddInductive.ConstructorPreFamilyListTrace
+      indexedVecCandidateInductiveStats 0 indexedVecPreFamilyIndexTelescope
+      indexedVecPreFamilyContext
+      (.cons indexedVecNilConstructorCandidate
+        (.cons indexedVecConsConstructorCandidate .nil)) :=
+    .cons nilHeadTrace consListTrace
+  have constructorListRun :
+      AddInductive.ConstructorPreFamilyListTrace.build
+          indexedVecCandidateInductiveStats 0
+          indexedVecPreFamilyIndexTelescope indexedVecPreFamilyContext
+          (.cons indexedVecNilConstructorCandidate
+            (.cons indexedVecConsConstructorCandidate .nil)) =
+        .ok constructorListTrace := by
+    exact AddInductive.ConstructorPreFamilyListTrace.cons_build_eq
+      nilHeadTrace nilHeadRun consListTrace consListRun
+  have parametersRun : AddInductive.instantiateFamilyParameters
+      indexedVecInfo.type indexedVecCandidateInductiveStats.params.toList =
+        .ok indexedVecPreFamilyIndexTelescope := by
+    rw [indexedVecPreFamilyIndexTelescope_eq]
+    rw [indexedVecValidationStatsParams]
+    rw [indexedVecInfoTypeShape]
+    simp [AddInductive.instantiateFamilyParameters, vecFamilyTail, vecIndexName,
+      Expr.instantiate1_eq, Expr.instantiate1', Pure.pure, Except.pure]
+  unfold AddInductive.checkConstructorPreFamilySafety
+  have translationUnique :
+      (AddInductive.theoryTranslationUnique indexedVecInfo.type &&
+        (AddInductive.CandidateList.cons indexedVecNilConstructorCandidate
+          (AddInductive.CandidateList.cons indexedVecConsConstructorCandidate
+            (AddInductive.CandidateList.nil : AddInductive.CandidateList
+              AddInductive.CandidateConstructor []))).viewTranslationUnique) =
+        true := by
+    change (AddInductive.theoryTranslationUnique indexedVecInfo.type &&
+      (nilCandidateTrace.viewTranslationUnique &&
+        (consCandidateTrace.viewTranslationUnique && true))) = true
+    rw [nilCandidateTrace.viewTranslationUnique_eq,
+      consCandidateTrace.viewTranslationUnique_eq]
+    change (AddInductive.theoryTranslationUnique indexedVecInfo.type &&
+      (AddInductive.theoryTranslationUnique nilCandidate.view &&
+        (AddInductive.theoryTranslationUnique consCandidate.view && true))) =
+          true
+    rw [nilCandidate_view_eq, consCandidate_view_eq,
+      indexedVecInfoTypeShape, nilInfoTypeShape, consInfoTypeShape]
+    simp [AddInductive.theoryTranslationUnique, vecFamilyTail,
+      nilCtorTypeRaw, nilCtorBodyRaw, consCtorTypeRaw, consNTypeRaw,
+      consHeadTypeRaw, consTailTypeRaw, consTerminalRaw]
+  rw [if_pos translationUnique]
+  rw [parametersRun]
+  simp only [Bind.bind, Except.bind]
+  rw [constructorListRun]
+  rfl
+
+private def indexedVecStagedPreFamilyInput :
+    VInductDecl.StagedNormalizationCandidatePreFamilyInput
+      indexedVecFamilyCandidateContext ctorContext natFinalEnv [`u]
+      indexedVecNormalizationCandidate indexedVecDecl :=
+  VInductDecl.StagedNormalizationCandidatePreFamilyInput.ofRun
+    indexedVecStagedPostFamilyInput indexedVecPreFamilySafetyRun
+
+/-- IndexedVec's ordinary fields are retained, its recursive tail is omitted,
+and both constructor-result index spines admit the exact pre-family semantic
+replay. -/
+theorem indexedVecProducedPreFamilySemantic_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidatePreFamilySemanticRun
+      indexedVecStagedPreFamilyInput) :=
+  indexedVecStagedPreFamilyInput.exists
+
+private def indexedVecReorderedViewType : VInductiveType :=
+  { indexedVecType with
+    ctors := [indexedVecType.ctors[1], indexedVecType.ctors[0]] }
+
+private def indexedVecReorderedViewDecl : VInductDecl :=
+  { indexedVecDecl with types := [indexedVecReorderedViewType] }
+
+/-- Swapping the two otherwise unchanged constructor payloads fails the
+computational normalization-shape gate before semantic or generation evidence
+can be attached. -/
+theorem indexedVecReorderedView_rejected :
+    VInductDecl.normalization? indexedVecDecl
+      indexedVecReorderedViewDecl = none := rfl
+
+theorem indexedVecSemanticFamilyViewTr :
+    TrExpr natFinalEnv [`u] [] indexedVecFamilyCandidate.view
+      indexedVecType.type := by
+  rw [indexedVecFamilyCandidate_view_eq]
+  obtain ⟨u, htype⟩ := indexedVecType_wf
+  exact ⟨_, indexedVecSemanticFamilySourceTr, ⟨_, htype⟩⟩
+
+theorem indexedVecSemanticNilViewTr :
+    TrExpr indexedVecTypeEnv [`u] [] nilCandidate.view
+      indexedVecType.ctors[0].type := by
+  rw [nilCandidate_view_eq]
+  obtain ⟨u, htype⟩ := indexedVecNil_wf
+  exact ⟨_, indexedVecSemanticNilSourceTr, ⟨_, htype⟩⟩
+
+theorem indexedVecSemanticConsViewTr :
+    TrExpr indexedVecTypeEnv [`u] [] consCandidate.view
+      indexedVecType.ctors[1].type := by
+  rw [consCandidate_view_eq]
+  obtain ⟨u, htype⟩ := indexedVecSemanticConsIsType
+  exact ⟨_, indexedVecSemanticConsSourceTr, ⟨_, htype⟩⟩
+
+def indexedVecSemanticFamilyRootRun :
+    TypeChecker.CandidateExprRootRun natFinalEnv [`u]
+      indexedVecFamilyCandidate indexedVecType.type indexedVecType.type where
+  contextRun := indexedVecSemanticFamilyContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := indexedVecSemanticFamilySourceTr
+  view_tr := indexedVecSemanticFamilyViewTr
+  whnfFuel := 9999
+  whnfDepth := rfl
+
+def indexedVecSemanticNilRootRun :
+    TypeChecker.CandidateExprRootRun indexedVecTypeEnv [`u]
+      nilCandidate indexedVecType.ctors[0].type
+      indexedVecType.ctors[0].type where
+  contextRun := by
+    simpa [nilCandidate, nilCandidateContext] using indexedVecSemanticCtorContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := indexedVecSemanticNilSourceTr
+  view_tr := indexedVecSemanticNilViewTr
+  whnfFuel := 9999
+  whnfDepth := rfl
+
+def indexedVecSemanticConsRootRun :
+    TypeChecker.CandidateExprRootRun indexedVecTypeEnv [`u]
+      consCandidate indexedVecType.ctors[1].type
+      indexedVecType.ctors[1].type where
+  contextRun := by
+    simpa [consCandidate, consRootContext] using indexedVecSemanticCtorContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := indexedVecSemanticConsSourceTr
+  view_tr := indexedVecSemanticConsViewTr
+  whnfFuel := 9999
+  whnfDepth := rfl
+
+def indexedVecSemanticFamilySemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun natFinalEnv [`u]
+      indexedVecFamilyCandidate indexedVecType.type :=
+  indexedVecSemanticFamilyRootRun.semanticOfIdentity
+    indexedVecFamilyCandidate_identity
+
+def indexedVecSemanticNilSemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun indexedVecTypeEnv [`u]
+      nilCandidate indexedVecType.ctors[0].type :=
+  indexedVecSemanticNilRootRun.semanticOfIdentity nilCandidate_identity
+
+def indexedVecSemanticConsSemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun indexedVecTypeEnv [`u]
+      consCandidate indexedVecType.ctors[1].type :=
+  indexedVecSemanticConsRootRun.semanticOfIdentity consCandidate_identity
+
+def indexedVecSemanticNilConstructorSemanticRun :
+    VInductDecl.CandidateConstructorSemanticRun indexedVecTypeEnv [`u]
+      indexedVecNilConstructorCandidate indexedVecType.ctors[0] where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := indexedVecSemanticNilSemanticRootRun
+
+def indexedVecSemanticConsConstructorSemanticRun :
+    VInductDecl.CandidateConstructorSemanticRun indexedVecTypeEnv [`u]
+      indexedVecConsConstructorCandidate indexedVecType.ctors[1] where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := indexedVecSemanticConsSemanticRootRun
+
+def indexedVecSemanticNilConstructorRun :
+    VInductDecl.CandidateConstructorRun indexedVecTypeEnv [`u]
+      indexedVecNilConstructorCandidate indexedVecType.ctors[0] :=
+  indexedVecSemanticNilConstructorSemanticRun.root
+
+def indexedVecSemanticConsConstructorRun :
+    VInductDecl.CandidateConstructorRun indexedVecTypeEnv [`u]
+      indexedVecConsConstructorCandidate indexedVecType.ctors[1] :=
+  indexedVecSemanticConsConstructorSemanticRun.root
+
+def indexedVecSemanticConstructorSemanticListRun :
+    VInductDecl.CandidateConstructorSemanticListRun indexedVecTypeEnv [`u]
+      indexedVecFamilyListCandidate.constructors indexedVecType.ctors := by
+  exact .cons indexedVecSemanticNilConstructorSemanticRun
+    (.cons indexedVecSemanticConsConstructorSemanticRun .nil)
+
+def indexedVecSemanticConstructorListRun :
+    VInductDecl.CandidateConstructorListRun indexedVecTypeEnv [`u]
+      indexedVecFamilyListCandidate.constructors indexedVecType.ctors :=
+  indexedVecSemanticConstructorSemanticListRun.roots
+
+def indexedVecSemanticFamilySemanticRun :
+    VInductDecl.CandidateFamilySemanticRun natFinalEnv [`u]
+      indexedVecFamilyListCandidate indexedVecType where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := indexedVecSemanticFamilySemanticRootRun
+  typeEnv := indexedVecTypeEnv
+  addType := rfl
+  constructors := indexedVecSemanticConstructorSemanticListRun
+
+def indexedVecSemanticFamilyRun :
+    VInductDecl.CandidateFamilyRun natFinalEnv [`u]
+      indexedVecFamilyListCandidate indexedVecType :=
+  indexedVecSemanticFamilySemanticRun.root
+
+def indexedVecSemanticNormalizationCandidateRun :
+    VInductDecl.NormalizationCandidateRun natFinalEnv [`u]
+      indexedVecNormalizationCandidate indexedVecDecl where
+  raw := indexedVecType
+  raw_types_eq := rfl
+  uvars_eq := rfl
+  family := indexedVecSemanticFamilyRun
+
+/-- Reconstructing every family and constructor payload leaves the identity
+IndexedVec declaration unchanged. -/
+theorem indexedVecSemantic_viewDecl_eq :
+    indexedVecSemanticNormalizationCandidateRun.viewDecl =
+      indexedVecDecl := rfl
+
+/-- The candidate-derived normalization is exactly the analyzer's canonical
+identity normalization, not merely propositionally interchangeable with it. -/
+theorem indexedVecSemantic_normalization_eq :
+    indexedVecSemanticNormalizationCandidateRun.normalization =
+      indexedVecChecked.identityGeneration.block.normalization := rfl
+
+theorem indexedVecSemanticFamilySpineRun :
+    TypeChecker.CandidateExprSpineRun natFinalEnv [`u]
+      indexedVecFamilyCandidate indexedVecType.type
+      indexedVecType.type :=
+  indexedVecSemanticFamilySemanticRootRun.spine
+    indexedVecFamilyCandidate_identity.storedSpine
+
+theorem indexedVecSemanticNilSpineRun :
+    TypeChecker.CandidateExprSpineRun indexedVecTypeEnv [`u]
+      nilCandidate indexedVecType.ctors[0].type
+      indexedVecType.ctors[0].type :=
+  indexedVecSemanticNilSemanticRootRun.spine
+    nilCandidate_identity.storedSpine
+
+theorem indexedVecSemanticConsSpineRun :
+    TypeChecker.CandidateExprSpineRun indexedVecTypeEnv [`u]
+      consCandidate indexedVecType.ctors[1].type
+      indexedVecType.ctors[1].type :=
+  indexedVecSemanticConsSemanticRootRun.spine
+    consCandidate_identity.storedSpine
+
+theorem indexedVecSemanticCandidate_generationShape :
+    VInductDecl.normalizationCandidateGenerationShape indexedVecDecl
+      indexedVecType indexedVecNormalizationCandidate = true := by
+  change ((indexedVecFamilyCandidate.trace.storedSpine && true) &&
+    ((nilCandidate.trace.storedSpine && true) &&
+      ((consCandidate.trace.storedSpine && true) && true))) = true
+  rw [indexedVecFamilyCandidate_identity.storedSpine,
+    nilCandidate_identity.storedSpine,
+    consCandidate_identity.storedSpine]
+  rfl
+
+/-- The consolidated constructor gate rejects truncation in either direction
+before dependent semantic generation is assembled. -/
+theorem indexedVecSemanticCandidate_missingRawShape_rejected :
+    VInductDecl.candidateConstructorSemanticGenerationShape indexedVecDecl
+      (.cons indexedVecNilConstructorCandidate .nil) [] = false :=
+  rfl
+
+theorem indexedVecSemanticCandidate_extraRawShape_rejected :
+    VInductDecl.candidateConstructorSemanticGenerationShape indexedVecDecl
+      .nil [indexedVecType.ctors[0]] = false :=
+  rfl
+
+def indexedVecSemanticProducedGenerationShapeCandidate :
+    VInductDecl.ProducedGenerationShapeCandidate indexedVecDecl indexedVecType
+      indexedVecKernelType 0 false indexedVecFamilyCandidateContext where
+  candidate := indexedVecNormalizationCandidate
+  produced := indexedVecNormalizationCandidateProduced
+  shape := indexedVecSemanticCandidate_generationShape
+
+/-- The strengthened outer gate retains the complete parameter/index and
+ordered `nil`/`cons` generation layout in the same produced result. -/
+theorem indexedVecSemanticGenerationShapeCandidate_produced :
+    VInductDecl.produceGenerationShapeCandidate indexedVecDecl indexedVecType
+      indexedVecKernelType 0 false indexedVecFamilyCandidateContext =
+        .ok indexedVecSemanticProducedGenerationShapeCandidate := by
+  have produced :
+      AddInductive.buildNormalizationCandidate indexedVecDecl.nparams
+          [indexedVecKernelType] 0 false indexedVecFamilyCandidateContext =
+        .ok indexedVecNormalizationCandidate :=
+    indexedVecNormalizationCandidateProduced
+  simpa only [indexedVecSemanticProducedGenerationShapeCandidate] using
+    VInductDecl.produceGenerationShapeCandidate_eq_ok
+      (source := indexedVecDecl) (raw := indexedVecType)
+      produced indexedVecSemanticCandidate_generationShape
+
+private theorem indexedVecSemanticCandidate_analysis
+    (normalization : VInductDecl.NormalizationCandidateSemanticRun
+      natFinalEnv [`u] indexedVecNormalizationCandidate indexedVecDecl) :
+    normalization.root.normalization.generation? =
+      some indexedVecChecked.identityGeneration := by
+  let reference : VInductDecl.NormalizationCandidateSemanticRun natFinalEnv
+      [`u] indexedVecNormalizationCandidate indexedVecDecl := {
+    raw := indexedVecType
+    raw_types_eq := rfl
+    uvars_eq := rfl
+    family := indexedVecSemanticFamilySemanticRun }
+  rw [indexedVecStagedPreFamilyInput.normalization_eq normalization reference]
+  rfl
+
+/-- The parameter/index and two-constructor fixture closes through the same
+generic staged-owner theorem without supplying its semantic hierarchy. -/
+theorem indexedVecSemanticExactProducedGenerationCandidatePackage_exists :
+    Nonempty (VInductDecl.ExactProducedGenerationCandidatePackage
+      natFinalEnv [`u] indexedVecSemanticProducedGenerationShapeCandidate
+      indexedVecChecked.identityGeneration) :=
+  indexedVecSemanticProducedGenerationShapeCandidate
+    |>.exactProducedPackage_nonempty indexedVecStagedPreFamilyInput rfl
+      indexedVecChecked.identityGeneration indexedVecSemanticCandidate_analysis
+
+private def
+    indexedVecSemanticExactProducedGenerationCandidatePackage :
+    VInductDecl.ExactProducedGenerationCandidatePackage natFinalEnv [`u]
+      indexedVecSemanticProducedGenerationShapeCandidate
+      indexedVecChecked.identityGeneration :=
+  indexedVecSemanticProducedGenerationShapeCandidate.exactProducedPackage
+    indexedVecStagedPreFamilyInput rfl indexedVecChecked.identityGeneration
+    indexedVecSemanticCandidate_analysis
+
+def indexedVecSemanticGenerationCandidateSemanticRun :
+  VInductDecl.GenerationCandidateSemanticRun
+      indexedVecSemanticExactProducedGenerationCandidatePackage.normalization
+      indexedVecChecked.identityGeneration :=
+  indexedVecSemanticExactProducedGenerationCandidatePackage.semantic
+
+def indexedVecSemanticGenerationCandidateRun :
+    VInductDecl.GenerationCandidateRun
+      indexedVecSemanticExactProducedGenerationCandidatePackage.normalization.root
+      indexedVecChecked.identityGeneration :=
+  indexedVecSemanticGenerationCandidateSemanticRun.run
+
+def indexedVecSemanticGenerationCandidatePackage :
+    VInductDecl.GenerationCandidatePackage natFinalEnv [`u] :=
+  indexedVecSemanticGenerationCandidateSemanticRun.package
+
+def indexedVecSemanticProducedGenerationCandidatePackage :
+    VInductDecl.ProducedGenerationCandidatePackage natFinalEnv [`u] :=
+  indexedVecSemanticExactProducedGenerationCandidatePackage.package
+
+def indexedVecSemanticGenerationCertificate :
+    indexedVecDecl.GenerationCertificate natFinalEnv where
+  generation := indexedVecChecked.identityGeneration
+  wf :=
+    indexedVecSemanticExactProducedGenerationCandidatePackage.semantic.run.wf
+
+theorem indexedVecSemantic_addInductCertified :
+    natFinalEnv.addInductCertified indexedVecSemanticGenerationCertificate =
+      some indexedVecFinalEnv := by
+  rfl
+
+theorem indexedVecSemanticCertified_trace :
+    Nonempty (VEnv.AddInductGenerationTrace natFinalEnv
+      indexedVecFinalEnv indexedVecChecked.identityGeneration) :=
+  VEnv.addInductCertified_trace indexedVecSemantic_addInductCertified
+
+theorem indexedVecSemanticCertified_ordered :
+    indexedVecFinalEnv.Ordered :=
+  VEnv.addInductCertified_WF nat_env_wf.ordered
+    indexedVecSemantic_addInductCertified
+
+def indexedVecSemanticAddInductTraceChecked :
+    AddInductTrace natMap natFinalEnv indexedVecDecl indexedVecMap
+      indexedVecFinalEnv := by
+  refine indexedVecSemanticProducedGenerationCandidatePackage.package.addInductTrace
+    indexedVecTypeMap indexedVecTypeEnv indexedVecCtorMap
+    indexedVecCtorEnv indexedVecRecEnv ?_ ?_ ?_ ?_ ⟨rfl⟩
+  · exact {
+      info := indexedVecInfo
+      kind_eq := by simp [indexedVecInfo, InductConstantKind.Matches]
+      tr := indexedVecInfo_tr
+      map_fresh := by
+        rw [show
+          indexedVecSemanticProducedGenerationCandidatePackage.package.generation.block.sourceType.name =
+            ``IndexedVec by rfl]
+        exact indexedVecType_fresh
+      env_add := rfl
+      map_add := rfl }
+  · refine .cons (m₂ := indexedVecNilMap)
+      (env₂ := indexedVecNilEnv) ?_ ?_
+    · exact {
+        info := indexedVecNilInfo
+        kind_eq := by simp [indexedVecNilInfo, InductConstantKind.Matches]
+        tr := indexedVecNilInfo_tr
+        map_fresh := by simpa [indexedVecType] using indexedVecNil_fresh
+        env_add := rfl
+        map_add := rfl }
+    · refine .cons ?_ .nil
+      exact {
+        info := indexedVecConsInfo
+        kind_eq := by simp [indexedVecConsInfo, InductConstantKind.Matches]
+        tr := indexedVecConsInfo_tr
+        map_fresh := by simpa [indexedVecType] using indexedVecCons_fresh
+        env_add := rfl
+        map_add := rfl }
+  · exact {
+      info := indexedVecRecInfo
+      kind_eq := by simp [indexedVecRecInfo, InductConstantKind.Matches]
+      tr := indexedVecRecInfo_tr
+      map_fresh := by
+        rw [show
+          (inductGenerationRecVal
+            indexedVecSemanticProducedGenerationCandidatePackage.package.generation).name =
+              ``IndexedVec.rec by rfl]
+        exact indexedVecRec_fresh
+      env_add := rfl
+      map_add := rfl }
+  · decide
+
+theorem indexedVecSemantic_addInduct_checked :
+    AddInduct natMap natFinalEnv indexedVecDecl indexedVecMap
+      indexedVecFinalEnv :=
+  ⟨indexedVecSemanticAddInductTraceChecked⟩
+
+theorem indexedVecSemantic_trEnv'_checked :
+    TrEnv' .safe indexedVecMap false indexedVecFinalEnv :=
+  .induct indexedVecSemantic_addInduct_checked nat_trEnv'
+
+theorem indexedVecSemantic_env_wf_checked : indexedVecFinalEnv.WF :=
+  indexedVecSemantic_trEnv'_checked.wf
+
+theorem indexedVecSemantic_aligned_checked :
+    Aligned .safe indexedVecMap indexedVecFinalEnv :=
+  indexedVecSemantic_trEnv'_checked.aligned
+
+/-
+The semantic assembly, executable producer, and final E1 replay intentionally
+inherit the existing transitional verifier closure. These guards make
+additions to that closure visible at the public roots of this module.
+-/
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecProducedSemanticHierarchy_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecProducedPostFamilySemantic_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecProducedPreFamilySemantic_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecProducedSemanticHierarchy_constructorHeaders [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecReorderedView_rejected [propext]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemanticCandidate_missingRawShape_rejected [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemanticCandidate_extraRawShape_rejected [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemanticGenerationShapeCandidate_produced [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemanticExactProducedGenerationCandidatePackage_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemanticGenerationCandidateSemanticRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemanticProducedGenerationCandidatePackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVecSemantic_trEnv'_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/InductiveFixtures.lean b/Ix/Theory/Named/Verify/Environment/InductiveFixtures.lean
new file mode 100644
index 000000000..0d9cb3079
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/InductiveFixtures.lean
@@ -0,0 +1,12189 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.Lemmas
+import Ix.Theory.Named.Verify.Environment.ConstructorValidation
+import Ix.Theory.Named.Reference.Inductive.Add
+import Ix.Theory.Named.Meta
+import Ix.Theory.Named.InductiveFixtures
+import Ix.Theory.Named.Typing.Meta
+
+open Ix.Theory (VLevel)
+
+/-! End-to-end replay fixtures for inductive environment alignment.
+
+The Theory fixtures compare generated recursors and iota rules with Lean's
+kernel declarations. This module closes the next bridge: it quotes the actual
+`ConstantInfo` metadata, translates each metadata type in the precise
+intermediate Theory environment, constructs `AddInduct`, and drives the live
+`TrEnv'.induct` case. -/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/- These instances are used only by the elaborators below to quote the kernel
+metadata returned by `getConstInfo`. -/
+deriving instance ToExpr for ConstantVal
+deriving instance ToExpr for InductiveVal
+deriving instance ToExpr for ConstructorVal
+deriving instance ToExpr for RecursorRule
+deriving instance ToExpr for RecursorVal
+deriving instance ToExpr for ReducibilityHints
+deriving instance ToExpr for DefinitionSafety
+deriving instance ToExpr for DefinitionVal
+
+syntax "kernelInductInfo%" ident : term
+syntax "kernelCtorInfo%" ident : term
+syntax "kernelRecInfo%" ident : term
+syntax "kernelRecRuleRhs%" ident num : term
+syntax "kernelDefVal%" ident : term
+
+elab_rules : term
+  | `(kernelInductInfo% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let .inductInfo info ← getConstInfo name
+      | throwError "expected inductive metadata for {name}"
+    return mkApp (mkConst ``ConstantInfo.inductInfo) (toExpr info)
+  | `(kernelCtorInfo% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let .ctorInfo info ← getConstInfo name
+      | throwError "expected constructor metadata for {name}"
+    return mkApp (mkConst ``ConstantInfo.ctorInfo) (toExpr info)
+  | `(kernelRecInfo% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let .recInfo info ← getConstInfo name
+      | throwError "expected recursor metadata for {name}"
+    return mkApp (mkConst ``ConstantInfo.recInfo) (toExpr info)
+  | `(kernelDefVal% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let .defnInfo info ← getConstInfo name
+      | throwError "expected definition metadata for {name}"
+    return toExpr info
+
+/-- Quote one kernel recursor-rule RHS using the rule's own universe-parameter
+order. This lets replay fixtures compare implementation metadata with the
+Theory equation generator by reduction, including lambdas under recursive Pi
+arguments. -/
+elab_rules : term
+  | `(kernelRecRuleRhs% $n:ident $i:num) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let .recInfo info ← getConstInfo name
+      | throwError "expected recursor metadata for {name}"
+    let some rule := info.rules[i.getNat]?
+      | throwError "missing recursor rule {i.getNat} for {name}"
+    let rhs ← Ix.Theory.Named.Meta.expandExpr rule.rhs
+    let rhs ← Ix.Theory.Named.Meta.ofExpr info.levelParams {} rhs
+    return toExpr rhs
+
+/- Construct the representation-only half of a metadata-type translation.
+The `to_trExprS` theorem supplies every typing premise from the declaration's
+actual Theory `WF` evidence. -/
+syntax "tr_type_expr_tac" : tactic
+macro_rules
+  | `(tactic| tr_type_expr_tac) => `(tactic|
+    first
+    | apply TrTypeExpr.bvar; rfl
+    | apply TrTypeExpr.sort; rfl
+    | apply TrTypeExpr.const <;>
+        (first | assumption | rfl | (dsimp; simp [VLevel.params']))
+    | apply TrTypeExpr.app <;> tr_type_expr_tac
+    | apply TrTypeExpr.mdata; tr_type_expr_tac
+    | apply TrTypeExpr.forallE <;> tr_type_expr_tac)
+
+local instance : Inhabited VEnv := ⟨.empty⟩
+
+/-! ## Nat -/
+
+/-- Kernel metadata, captured at elaboration rather than reconstructed by the
+fixture. A change in Lean's emitted record is therefore a compile failure. -/
+def natInfo : ConstantInfo := kernelInductInfo% Nat
+def natZeroInfo : ConstantInfo := kernelCtorInfo% Nat.zero
+def natSuccInfo : ConstantInfo := kernelCtorInfo% Nat.succ
+def natRecInfo : ConstantInfo := kernelRecInfo% Nat.rec
+def natZeroKernelRuleRhs : VExpr := kernelRecRuleRhs% Nat.rec 0
+def natSuccKernelRuleRhs : VExpr := kernelRecRuleRhs% Nat.rec 1
+
+example : natInfo.name = ``Nat := rfl
+example : natZeroInfo.name = ``Nat.zero := rfl
+example : natSuccInfo.name = ``Nat.succ := rfl
+example : natRecInfo.name = ``Nat.rec := rfl
+example : natZeroKernelRuleRhs =
+    natChecked.identityGeneration.generatedRules[0].rhs := rfl
+example : natSuccKernelRuleRhs =
+    natChecked.identityGeneration.generatedRules[1].rhs := rfl
+
+def natTypeEnv := (VEnv.empty.addConst natType.name natType.toVConstant).get!
+def natZeroEnv :=
+  (natTypeEnv.addConst natType.ctors[0].name natType.ctors[0].toVConstant).get!
+def natCtorEnv :=
+  (natZeroEnv.addConst natType.ctors[1].name natType.ctors[1].toVConstant).get!
+def natRecEnv :=
+  (natCtorEnv.addConst ``Nat.rec (VInductDecl.recConst 0 ``Nat 0 natType)).get!
+
+theorem natTypeEnv_ordered : natTypeEnv.Ordered := by
+  refine .const .empty ?_ rfl
+  exact ⟨.succ (.succ .zero), VEnv.HasType.sort (by decide)⟩
+
+theorem natZeroEnv_ordered : natZeroEnv.Ordered := by
+  refine .const (n := natType.ctors[0].name) (ci := natType.ctors[0].toVConstant)
+    natTypeEnv_ordered ?_ rfl
+  have hNat : natTypeEnv.constants ``Nat = some natType.toVConstant := rfl
+  exact ⟨.succ .zero, by type_tac⟩
+
+theorem natSucc_wf : natType.ctors[1].toVConstant.WF natZeroEnv := by
+  have hNat : natZeroEnv.constants ``Nat = some natType.toVConstant := rfl
+  refine ⟨.imax (.succ .zero) (.succ .zero), ?_⟩
+  refine VEnv.HasType.forallE (u := .succ .zero) (v := .succ .zero) ?_ ?_
+  · type_tac
+  · type_tac
+
+theorem natCtorEnv_ordered : natCtorEnv.Ordered := by
+  exact .const (n := natType.ctors[1].name) (ci := natType.ctors[1].toVConstant)
+    natZeroEnv_ordered natSucc_wf rfl
+
+/-- `Nat` satisfies the public Stage-3 declaration contract without a fixture
+assumption. -/
+theorem natDecl_wf : natDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = natType := List.mem_singleton.1 (by simpa [natDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change True
+    trivial
+  intro c hc
+  rcases List.mem_cons.1 hc with rfl | hc
+  · constructor
+    · change True
+      trivial
+    · exact .nil
+  · have hc' := List.mem_singleton.1 hc
+    subst c
+    constructor
+    · refine ⟨.inl rfl, ?_, trivial⟩
+      intro
+      exact .nil
+    · exact .nil
+
+/-- The exact intermediate invariant used to type the generated recursor. -/
+theorem natStage3 :
+    VInductDecl.Stage3Env natCtorEnv 0 ``Nat 0 (.succ .zero) natType := by
+  refine {
+    ord := natCtorEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := ?_
+    htel := ?_
+    hs3 := ?_
+    hparams := ?_
+    hfields := ?_
+    hresult := ?_ }
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · rfl
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · rfl
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · rfl
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+  · change True
+    trivial
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · change True
+      trivial
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      refine ⟨.inl rfl, ?_, trivial⟩
+      intro
+      exact .nil
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · exact .nil
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      exact .nil
+
+theorem natInfo_tr :
+    TrConstVal .safe VEnv.empty natInfo natType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  exact .sort rfl
+
+theorem natZeroInfo_tr :
+    TrConstVal .safe natTypeEnv natZeroInfo natType.ctors[0] := by
+  have hNat : natTypeEnv.constants ``Nat = some natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr natTypeEnv natZeroInfo.levelParams []
+      natZeroInfo.type natType.ctors[0].type := by tr_type_expr_tac
+  exact hshape.to_trExprS natTypeEnv_ordered trivial
+    ⟨.sort (.succ .zero), by type_tac⟩
+
+theorem natSuccInfo_tr :
+    TrConstVal .safe natZeroEnv natSuccInfo natType.ctors[1] := by
+  have hNat : natZeroEnv.constants ``Nat = some natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr natZeroEnv natSuccInfo.levelParams []
+      natSuccInfo.type natType.ctors[1].type := by
+    exact .forallE (.const hNat rfl rfl) (.const hNat rfl rfl)
+  exact hshape.to_trExprS natZeroEnv_ordered trivial
+    ⟨.sort (.imax (.succ .zero) (.succ .zero)), by
+      refine VEnv.HasType.forallE (u := .succ .zero) (v := .succ .zero) ?_ ?_
+      · type_tac
+      · type_tac⟩
+
+theorem natRecInfo_tr :
+    TrConstVal .safe natCtorEnv natRecInfo (inductRecVal natDecl natType) := by
+  have hNat : natCtorEnv.constants ``Nat = some natType.toVConstant := rfl
+  have hZero :
+      natCtorEnv.constants ``Nat.zero = some natType.ctors[0].toVConstant := rfl
+  have hSucc :
+      natCtorEnv.constants ``Nat.succ = some natType.ctors[1].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr natCtorEnv natRecInfo.levelParams [] natRecInfo.type
+      (inductRecVal natDecl natType).type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := natStage3.recConst_wf
+  exact hshape.to_trExprS natCtorEnv_ordered trivial ⟨.sort u, hrec⟩
+
+def natTypeMap : ConstMap := ({} : ConstMap).insert ``Nat natInfo
+def natZeroMap : ConstMap := natTypeMap.insert ``Nat.zero natZeroInfo
+def natCtorMap : ConstMap := natZeroMap.insert ``Nat.succ natSuccInfo
+def natMap : ConstMap := natCtorMap.insert ``Nat.rec natRecInfo
+def natFinalEnv : VEnv :=
+  (VInductDecl.rules 0 ``Nat 0 natType).foldl VEnv.addDefEq natRecEnv
+
+theorem natType_fresh : ({} : ConstMap).find? ``Nat = none := by
+  simp [SMap.find?]
+
+theorem natTypeMap_wf : natTypeMap.WF :=
+  SMap.WF.empty.insert _ _ natType_fresh
+
+theorem natZero_fresh : natTypeMap.find? ``Nat.zero = none := by
+  rw [natTypeMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem natZeroMap_wf : natZeroMap.WF :=
+  natTypeMap_wf.insert _ _ natZero_fresh
+
+theorem natSucc_fresh : natZeroMap.find? ``Nat.succ = none := by
+  rw [natZeroMap, natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem natCtorMap_wf : natCtorMap.WF :=
+  natZeroMap_wf.insert _ _ natSucc_fresh
+
+theorem natRec_fresh : natCtorMap.find? ``Nat.rec = none := by
+  rw [natCtorMap, natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+/-- A concrete `AddInduct` witness whose implementation side consists of the
+actual kernel metadata above and whose Theory side is the Stage-3 Nat
+transaction. -/
+theorem nat_addInduct :
+    AddInduct ({} : ConstMap) VEnv.empty natDecl natMap natFinalEnv := by
+  refine ⟨{
+    generation := natChecked.identityGeneration
+    generation_wf :=
+      (natChecked.wf_of_decl natDecl_wf).identityGeneration .empty
+    typeMap := natTypeMap
+    typeEnv := natTypeEnv
+    ctorMap := natCtorMap
+    ctorEnv := natCtorEnv
+    recEnv := natRecEnv
+    addType := {
+      info := natInfo
+      kind_eq := by simp [natInfo, InductConstantKind.Matches]
+      tr := natInfo_tr
+      map_fresh := by
+        change ({} : ConstMap).find? ``Nat = none
+        exact natType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := natRecInfo
+      kind_eq := by simp [natRecInfo, InductConstantKind.Matches]
+      tr := natRecInfo_tr
+      map_fresh := by
+        change natCtorMap.find? ``Nat.rec = none
+        exact natRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := natZeroInfo
+      kind_eq := by simp [natZeroInfo, InductConstantKind.Matches]
+      tr := natZeroInfo_tr
+      map_fresh := by simpa [natType] using natZero_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := natSuccInfo
+      kind_eq := by simp [natSuccInfo, InductConstantKind.Matches]
+      tr := natSuccInfo_tr
+      map_fresh := by
+        change natZeroMap.find? ``Nat.succ = none
+        exact natSucc_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+
+/-- The formerly impossible `TrEnv'.induct` branch, instantiated with a real
+Lean declaration transaction. -/
+theorem nat_trEnv' {safety : DefinitionSafety} :
+    TrEnv' safety natMap false natFinalEnv :=
+  .induct nat_addInduct .empty
+
+theorem nat_final_matches_addInduct :
+    VEnv.empty.addInduct natDecl = some natFinalEnv :=
+  rfl
+
+/-- Theory-only ordering evidence for the Nat dependency environment. This
+keeps later inductive preservation proofs entirely within the Theory layer. -/
+theorem natFinalEnv_ordered : natFinalEnv.Ordered :=
+  VEnv.addInductGeneration_WF .empty
+    ((natChecked.wf_of_decl natDecl_wf).identityGeneration .empty) rfl
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.natFinalEnv_ordered [propext, Classical.choice, Quot.sound]
+
+theorem nat_env_wf : natFinalEnv.WF := (nat_trEnv' (safety := .safe)).wf
+
+theorem nat_aligned : Aligned .safe natMap natFinalEnv := (nat_trEnv' (safety := .safe)).aligned
+
+theorem nat_type_map_lookup : natMap.find? ``Nat = some natInfo := by
+  rw [natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap, natTypeMap_wf.find?_insert,
+    natTypeMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+theorem nat_type_env_lookup :
+    natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+
+theorem nat_type_lookup_unique :
+    natInfo.name = ``Nat ∧
+      TrConstant .safe natFinalEnv natInfo natType.toVConstant :=
+  nat_aligned.find?_uniq nat_type_map_lookup nat_type_env_lookup
+
+theorem nat_succ_map_lookup : natMap.find? ``Nat.succ = some natSuccInfo := by
+  rw [natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert]
+  rfl
+
+theorem nat_succ_env_lookup : natFinalEnv.constants ``Nat.succ =
+    some natType.ctors[1].toVConstant := rfl
+
+theorem nat_succ_lookup_unique :
+    natSuccInfo.name = ``Nat.succ ∧
+      TrConstant .safe natFinalEnv natSuccInfo
+        natType.ctors[1].toVConstant :=
+  nat_aligned.find?_uniq nat_succ_map_lookup nat_succ_env_lookup
+
+theorem nat_rec_map_lookup : natMap.find? ``Nat.rec = some natRecInfo := by
+  rw [natMap, natCtorMap_wf.find?_insert]
+  rfl
+
+theorem nat_rec_env_lookup : natFinalEnv.constants ``Nat.rec =
+    some (VInductDecl.recConst 0 ``Nat 0 natType) := rfl
+
+/-- Lookup uniqueness is tested at the generated recursor, after all iota
+rules have been installed. -/
+theorem nat_rec_lookup_unique :
+    natRecInfo.name = ``Nat.rec ∧
+      TrConstant .safe natFinalEnv natRecInfo
+        (VInductDecl.recConst 0 ``Nat 0 natType) :=
+  nat_aligned.find?_uniq nat_rec_map_lookup nat_rec_env_lookup
+
+/- This closure is now free of `sorryAx`; the persistent-map contracts come
+from proving concrete `SMap` freshness. The fixture introduces no new axiom. -/
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.nat_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/-! ## A value-bearing prefix followed by Nat -/
+
+/-- A dependency-free definition used to ensure value translation survives a
+later inductive metadata transaction. -/
+def ReplaySeed : Type 1 := Type
+
+def seedKernelDef : DefinitionVal := kernelDefVal% ReplaySeed
+def seedInfo : ConstantInfo := .defnInfo seedKernelDef
+
+def seedVal : VDefVal where
+  name := ``ReplaySeed
+  uvars := 0
+  type := .sort (.succ (.succ .zero))
+  value := .sort (.succ .zero)
+
+theorem seedInfo_tr : TrDefVal .safe VEnv.empty seedInfo seedVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · exact .sort rfl
+  · exact .sort rfl
+
+theorem seedVal_wf : seedVal.WF VEnv.empty :=
+  VEnv.HasType.sort (by decide)
+
+def seedConstEnv := (VEnv.empty.addConst seedVal.name seedVal.toVConstant).get!
+def seedEnv := seedConstEnv.addDefEq seedVal.toDefEq
+def seedMap : ConstMap := ({} : ConstMap).insert seedVal.name seedInfo
+
+theorem seed_fresh : ({} : ConstMap).find? seedVal.name = none := by
+  simp [seedVal, SMap.find?]
+
+theorem seed_trEnv' : TrEnv' .safe seedMap false seedEnv :=
+  .defn (ci := seedKernelDef) (ci' := seedVal) seedInfo_tr seed_fresh
+    seedVal_wf rfl .empty
+
+theorem seed_map_lookup : seedMap.find? ``ReplaySeed = some seedInfo := by
+  rw [seedMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+theorem seed_le : VEnv.empty ≤ seedEnv :=
+  (VEnv.addConst_le (show VEnv.empty.addConst seedVal.name seedVal.toVConstant =
+    some seedConstEnv from rfl)).trans VEnv.addDefEq_le
+
+theorem seedEnv_ordered : seedEnv.Ordered := seed_trEnv'.wf.ordered
+
+def seedNatTypeEnv := (seedEnv.addConst natType.name natType.toVConstant).get!
+def seedNatZeroEnv :=
+  (seedNatTypeEnv.addConst natType.ctors[0].name natType.ctors[0].toVConstant).get!
+def seedNatCtorEnv :=
+  (seedNatZeroEnv.addConst natType.ctors[1].name natType.ctors[1].toVConstant).get!
+def seedNatRecEnv :=
+  (seedNatCtorEnv.addConst ``Nat.rec (VInductDecl.recConst 0 ``Nat 0 natType)).get!
+
+theorem natTypeEnv_le_seedNatTypeEnv : natTypeEnv ≤ seedNatTypeEnv :=
+  VEnv.LE.addConst (n := natType.name) (ci := natType.toVConstant) seed_le rfl rfl
+
+theorem natZeroEnv_le_seedNatZeroEnv : natZeroEnv ≤ seedNatZeroEnv :=
+  VEnv.LE.addConst (n := natType.ctors[0].name)
+    (ci := natType.ctors[0].toVConstant) natTypeEnv_le_seedNatTypeEnv rfl rfl
+
+theorem natCtorEnv_le_seedNatCtorEnv : natCtorEnv ≤ seedNatCtorEnv :=
+  VEnv.LE.addConst (n := natType.ctors[1].name)
+    (ci := natType.ctors[1].toVConstant) natZeroEnv_le_seedNatZeroEnv rfl rfl
+
+theorem seedNatTypeEnv_ordered : seedNatTypeEnv.Ordered := by
+  refine .const (n := natType.name) (ci := natType.toVConstant)
+    seedEnv_ordered ?_ rfl
+  exact ⟨.succ (.succ .zero), VEnv.HasType.sort (by decide)⟩
+
+theorem seedNatZeroEnv_ordered : seedNatZeroEnv.Ordered := by
+  refine .const (n := natType.ctors[0].name) (ci := natType.ctors[0].toVConstant)
+    seedNatTypeEnv_ordered ?_ rfl
+  have hNat : seedNatTypeEnv.constants ``Nat = some natType.toVConstant := rfl
+  exact ⟨.succ .zero, by type_tac⟩
+
+theorem seedNatSucc_wf : natType.ctors[1].toVConstant.WF seedNatZeroEnv := by
+  have hNat : seedNatZeroEnv.constants ``Nat = some natType.toVConstant := rfl
+  refine ⟨.imax (.succ .zero) (.succ .zero), ?_⟩
+  refine VEnv.HasType.forallE (u := .succ .zero) (v := .succ .zero) ?_ ?_
+  · type_tac
+  · type_tac
+
+theorem seedNatCtorEnv_ordered : seedNatCtorEnv.Ordered :=
+  .const (n := natType.ctors[1].name) (ci := natType.ctors[1].toVConstant)
+    seedNatZeroEnv_ordered seedNatSucc_wf rfl
+
+theorem seedNatInfo_tr :
+    TrConstVal .safe seedEnv natInfo natType.toVConstVal :=
+  natInfo_tr.mono seed_le
+
+theorem seedNatZeroInfo_tr :
+    TrConstVal .safe seedNatTypeEnv natZeroInfo natType.ctors[0] :=
+  natZeroInfo_tr.mono natTypeEnv_le_seedNatTypeEnv
+
+theorem seedNatSuccInfo_tr :
+    TrConstVal .safe seedNatZeroEnv natSuccInfo natType.ctors[1] :=
+  natSuccInfo_tr.mono natZeroEnv_le_seedNatZeroEnv
+
+theorem seedNatRecInfo_tr :
+    TrConstVal .safe seedNatCtorEnv natRecInfo (inductRecVal natDecl natType) :=
+  natRecInfo_tr.mono natCtorEnv_le_seedNatCtorEnv
+
+def seedNatTypeMap : ConstMap := seedMap.insert ``Nat natInfo
+def seedNatZeroMap : ConstMap := seedNatTypeMap.insert ``Nat.zero natZeroInfo
+def seedNatCtorMap : ConstMap := seedNatZeroMap.insert ``Nat.succ natSuccInfo
+def seedNatMap : ConstMap := seedNatCtorMap.insert ``Nat.rec natRecInfo
+def seedNatFinalEnv : VEnv :=
+  (VInductDecl.rules 0 ``Nat 0 natType).foldl VEnv.addDefEq seedNatRecEnv
+
+theorem seedMap_wf : seedMap.WF := seed_trEnv'.map_wf
+
+theorem seedNatType_fresh : seedMap.find? ``Nat = none := by
+  rw [seedMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [seedVal, SMap.find?]
+
+theorem seedNatTypeMap_wf : seedNatTypeMap.WF :=
+  seedMap_wf.insert _ _ seedNatType_fresh
+
+theorem seedNatZero_fresh : seedNatTypeMap.find? ``Nat.zero = none := by
+  rw [seedNatTypeMap, seedMap_wf.find?_insert, seedMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [seedVal, SMap.find?]
+
+theorem seedNatZeroMap_wf : seedNatZeroMap.WF :=
+  seedNatTypeMap_wf.insert _ _ seedNatZero_fresh
+
+theorem seedNatSucc_fresh : seedNatZeroMap.find? ``Nat.succ = none := by
+  rw [seedNatZeroMap, seedNatTypeMap_wf.find?_insert, seedNatTypeMap,
+    seedMap_wf.find?_insert, seedMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [seedVal, SMap.find?]
+
+theorem seedNatCtorMap_wf : seedNatCtorMap.WF :=
+  seedNatZeroMap_wf.insert _ _ seedNatSucc_fresh
+
+theorem seedNatRec_fresh : seedNatCtorMap.find? ``Nat.rec = none := by
+  rw [seedNatCtorMap, seedNatZeroMap_wf.find?_insert, seedNatZeroMap,
+    seedNatTypeMap_wf.find?_insert, seedNatTypeMap, seedMap_wf.find?_insert,
+    seedMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [seedVal, SMap.find?]
+
+theorem seedNat_addInduct :
+    AddInduct seedMap seedEnv natDecl seedNatMap seedNatFinalEnv := by
+  refine ⟨{
+    generation := natChecked.identityGeneration
+    generation_wf :=
+      (natChecked.wf_of_decl (natDecl_wf.mono seed_le)).identityGeneration
+        seedEnv_ordered
+    typeMap := seedNatTypeMap
+    typeEnv := seedNatTypeEnv
+    ctorMap := seedNatCtorMap
+    ctorEnv := seedNatCtorEnv
+    recEnv := seedNatRecEnv
+    addType := {
+      info := natInfo
+      kind_eq := by simp [natInfo, InductConstantKind.Matches]
+      tr := seedNatInfo_tr
+      map_fresh := by
+        change seedMap.find? ``Nat = none
+        exact seedNatType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := natRecInfo
+      kind_eq := by simp [natRecInfo, InductConstantKind.Matches]
+      tr := seedNatRecInfo_tr
+      map_fresh := by
+        change seedNatCtorMap.find? ``Nat.rec = none
+        exact seedNatRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := natZeroInfo
+      kind_eq := by simp [natZeroInfo, InductConstantKind.Matches]
+      tr := seedNatZeroInfo_tr
+      map_fresh := by simpa [natType] using seedNatZero_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := natSuccInfo
+      kind_eq := by simp [natSuccInfo, InductConstantKind.Matches]
+      tr := seedNatSuccInfo_tr
+      map_fresh := by
+        change seedNatZeroMap.find? ``Nat.succ = none
+        exact seedNatSucc_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+
+theorem seedNat_trEnv' : TrEnv' .safe seedNatMap false seedNatFinalEnv :=
+  .induct seedNat_addInduct seed_trEnv'
+
+theorem seedNat_seed_lookup : seedNatMap.find? ``ReplaySeed = some seedInfo := by
+  rw [seedNatMap, seedNatCtorMap_wf.find?_insert, seedNatCtorMap,
+    seedNatZeroMap_wf.find?_insert, seedNatZeroMap,
+    seedNatTypeMap_wf.find?_insert, seedNatTypeMap, seedMap_wf.find?_insert]
+  simpa [seedVal] using seed_map_lookup
+
+/-- A concrete regression for the formerly impossible `TrEnv'.of_value`
+inductive branch: the value was inserted before Nat, so this theorem must pull
+its lookup back through every Nat metadata insertion. -/
+theorem seed_after_nat_of_value :
+    TrExpr seedNatFinalEnv seedInfo.levelParams [] seedKernelDef.value
+      (.const seedInfo.name (VLevel.params seedInfo.levelParams.length)) :=
+  seedNat_trEnv'.of_value (name := ``ReplaySeed) (ci := seedInfo)
+    (v := seedKernelDef.value) seedNat_seed_lookup (by decide) rfl
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.seed_after_nat_of_value [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/-! ## Eq -/
+
+/- `Eq` exercises parameters, a genuine index, Prop-valued elimination, and
+the kernel/generated recursor universe permutation. -/
+def eqInfo : ConstantInfo := kernelInductInfo% Eq
+def eqReflInfo : ConstantInfo := kernelCtorInfo% Eq.refl
+def eqRecInfo : ConstantInfo := kernelRecInfo% Eq.rec
+def eqReflKernelRuleRhs : VExpr := kernelRecRuleRhs% Eq.rec 0
+
+example : eqReflKernelRuleRhs =
+    eqChecked.identityGeneration.generatedRules[0].rhs := rfl
+
+def eqTypeEnv := (VEnv.empty.addConst eqType.name eqType.toVConstant).get!
+def eqCtorEnv :=
+  (eqTypeEnv.addConst eqType.ctors[0].name eqType.ctors[0].toVConstant).get!
+def eqRecEnv :=
+  (eqCtorEnv.addConst ``Eq.rec (VInductDecl.recConst 1 ``Eq 2 eqType)).get!
+
+theorem eqType_wf : eqType.toVConstant.WF VEnv.empty := by
+  refine ⟨.imax (.succ (.param 0))
+    (.imax (.param 0) (.imax (.param 0) (.succ .zero))), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.param 0))
+    (v := .imax (.param 0) (.imax (.param 0) (.succ .zero))) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · refine VEnv.HasType.forallE
+      (u := .param 0) (v := .imax (.param 0) (.succ .zero)) ?_ ?_
+    · type_tac
+    · refine VEnv.HasType.forallE
+        (u := .param 0) (v := .succ .zero) ?_ ?_
+      · type_tac
+      · exact VEnv.HasType.sort (by decide)
+
+theorem eqTypeEnv_ordered : eqTypeEnv.Ordered :=
+  .const .empty eqType_wf rfl
+
+theorem eqDecl_wf : eqDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = eqType := List.mem_singleton.1 (by simpa [eqDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change VEnv.empty.OnTel 1 []
+      [.sort (.param 0), .bvar 0, .bvar 1]
+    exact ⟨⟨.succ (.param 0), VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨.param 0, by type_tac⟩, ⟨⟨.param 0, by type_tac⟩, trivial⟩⟩⟩
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    constructor
+    · change True
+      trivial
+    · exact .cons (by type_tac) .nil
+
+theorem eqRefl_wf : eqType.ctors[0].toVConstant.WF eqTypeEnv := by
+  have hblock := eqDecl_wf.2 eqType (by simp [eqDecl])
+  have hctor := hblock.2 eqType.ctors[0] (by simp)
+  have hle : VEnv.empty ≤ eqTypeEnv := VEnv.addConst_le rfl
+  have S0 : VInductDecl.Stage3Env eqTypeEnv 1 ``Eq 2 .zero
+      { eqType with ctors := [] } := {
+    ord := eqTypeEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := by simp
+    htel := by simp
+    hs3 := by simp
+    hparams := hblock.1.mono hle
+    hfields := by simp
+    hresult := by simp }
+  exact S0.ctorType_isType' rfl rfl
+    (VInductDecl.fieldsWF_mono hle hctor.1) (hctor.2.mono hle)
+
+theorem eqCtorEnv_ordered : eqCtorEnv.Ordered :=
+  .const (n := eqType.ctors[0].name) (ci := eqType.ctors[0].toVConstant)
+    eqTypeEnv_ordered eqRefl_wf rfl
+
+theorem eqStage3 :
+    VInductDecl.Stage3Env eqCtorEnv 1 ``Eq 2 .zero eqType := by
+  have hblock := eqDecl_wf.2 eqType (by simp [eqDecl])
+  have hctor := hblock.2 eqType.ctors[0] (by simp)
+  have h0 : VEnv.empty ≤ eqTypeEnv :=
+    VEnv.addConst_le (show VEnv.empty.addConst eqType.name eqType.toVConstant =
+      some eqTypeEnv from rfl)
+  have h1 : eqTypeEnv ≤ eqCtorEnv :=
+    VEnv.addConst_le (show eqTypeEnv.addConst eqType.ctors[0].name
+      eqType.ctors[0].toVConstant = some eqCtorEnv from rfl)
+  have hle : VEnv.empty ≤ eqCtorEnv := h0.trans h1
+  refine {
+    ord := eqCtorEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+    htel := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+    hs3 := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+    hparams := hblock.1.mono hle
+    hfields := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      exact VInductDecl.fieldsWF_mono hle hctor.1
+    hresult := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      exact hctor.2.mono hle }
+
+theorem eqInfo_tr :
+    TrConstVal .safe VEnv.empty eqInfo eqType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr VEnv.empty eqInfo.levelParams [] eqInfo.type
+      eqType.type := by tr_type_expr_tac
+  obtain ⟨u, htype⟩ := eqType_wf
+  exact hshape.to_trExprS .empty trivial ⟨.sort u, htype⟩
+
+theorem eqReflInfo_tr :
+    TrConstVal .safe eqTypeEnv eqReflInfo eqType.ctors[0] := by
+  have hEq : eqTypeEnv.constants ``Eq = some eqType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr eqTypeEnv eqReflInfo.levelParams [] eqReflInfo.type
+      eqType.ctors[0].type := by tr_type_expr_tac
+  obtain ⟨u, htype⟩ := eqRefl_wf
+  exact hshape.to_trExprS eqTypeEnv_ordered trivial ⟨.sort u, htype⟩
+
+theorem eqRecInfo_tr :
+    TrConstVal .safe eqCtorEnv eqRecInfo (inductRecVal eqDecl eqType) := by
+  have hEq : eqCtorEnv.constants ``Eq = some eqType.toVConstant := rfl
+  have hRefl : eqCtorEnv.constants ``Eq.refl =
+      some eqType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr eqCtorEnv eqRecInfo.levelParams [] eqRecInfo.type
+      (inductRecVal eqDecl eqType).type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := eqStage3.recConst_wf
+  exact hshape.to_trExprS eqCtorEnv_ordered trivial ⟨.sort u, hrec⟩
+
+def eqTypeMap : ConstMap := ({} : ConstMap).insert ``Eq eqInfo
+def eqCtorMap : ConstMap := eqTypeMap.insert ``Eq.refl eqReflInfo
+def eqMap : ConstMap := eqCtorMap.insert ``Eq.rec eqRecInfo
+def eqFinalEnv : VEnv :=
+  (VInductDecl.rules 1 ``Eq 2 eqType).foldl VEnv.addDefEq eqRecEnv
+
+theorem eqType_fresh : ({} : ConstMap).find? ``Eq = none := by
+  simp [SMap.find?]
+
+theorem eqTypeMap_wf : eqTypeMap.WF :=
+  SMap.WF.empty.insert _ _ eqType_fresh
+
+theorem eqRefl_fresh : eqTypeMap.find? ``Eq.refl = none := by
+  rw [eqTypeMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem eqCtorMap_wf : eqCtorMap.WF :=
+  eqTypeMap_wf.insert _ _ eqRefl_fresh
+
+theorem eqRec_fresh : eqCtorMap.find? ``Eq.rec = none := by
+  rw [eqCtorMap, eqTypeMap_wf.find?_insert, eqTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem eq_addInduct :
+    AddInduct ({} : ConstMap) VEnv.empty eqDecl eqMap eqFinalEnv := by
+  refine ⟨{
+    generation := eqChecked.identityGeneration
+    generation_wf :=
+      (eqChecked.wf_of_decl eqDecl_wf).identityGeneration .empty
+    typeMap := eqTypeMap
+    typeEnv := eqTypeEnv
+    ctorMap := eqCtorMap
+    ctorEnv := eqCtorEnv
+    recEnv := eqRecEnv
+    addType := {
+      info := eqInfo
+      kind_eq := by simp [eqInfo, InductConstantKind.Matches]
+      tr := eqInfo_tr
+      map_fresh := by
+        change ({} : ConstMap).find? ``Eq = none
+        exact eqType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := eqRecInfo
+      kind_eq := by simp [eqRecInfo, InductConstantKind.Matches]
+      tr := eqRecInfo_tr
+      map_fresh := by
+        change eqCtorMap.find? ``Eq.rec = none
+        exact eqRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := eqReflInfo
+    kind_eq := by simp [eqReflInfo, InductConstantKind.Matches]
+    tr := eqReflInfo_tr
+    map_fresh := by simpa [eqType] using eqRefl_fresh
+    env_add := rfl
+    map_add := rfl } .nil
+
+/-- Replay actual kernel `Eq` metadata through the formerly empty inductive
+environment branch. -/
+theorem eq_trEnv' : TrEnv' .safe eqMap false eqFinalEnv :=
+  .induct eq_addInduct .empty
+
+theorem eq_final_matches_addInduct :
+    VEnv.empty.addInduct eqDecl = some eqFinalEnv :=
+  rfl
+
+theorem eq_env_wf : eqFinalEnv.WF := eq_trEnv'.wf
+
+theorem eq_aligned : Aligned .safe eqMap eqFinalEnv := eq_trEnv'.aligned
+
+theorem eq_type_map_lookup : eqMap.find? ``Eq = some eqInfo := by
+  rw [eqMap, eqCtorMap_wf.find?_insert, eqCtorMap,
+    eqTypeMap_wf.find?_insert, eqTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+theorem eq_type_env_lookup :
+    eqFinalEnv.constants ``Eq = some eqType.toVConstant := rfl
+
+theorem eq_type_lookup_unique :
+    eqInfo.name = ``Eq ∧
+      TrConstant .safe eqFinalEnv eqInfo eqType.toVConstant :=
+  eq_aligned.find?_uniq eq_type_map_lookup eq_type_env_lookup
+
+theorem eq_refl_map_lookup : eqMap.find? ``Eq.refl = some eqReflInfo := by
+  rw [eqMap, eqCtorMap_wf.find?_insert, eqCtorMap,
+    eqTypeMap_wf.find?_insert]
+  rfl
+
+theorem eq_refl_env_lookup : eqFinalEnv.constants ``Eq.refl =
+    some eqType.ctors[0].toVConstant := rfl
+
+theorem eq_refl_lookup_unique :
+    eqReflInfo.name = ``Eq.refl ∧
+      TrConstant .safe eqFinalEnv eqReflInfo
+        eqType.ctors[0].toVConstant :=
+  eq_aligned.find?_uniq eq_refl_map_lookup eq_refl_env_lookup
+
+theorem eq_rec_map_lookup : eqMap.find? ``Eq.rec = some eqRecInfo := by
+  rw [eqMap, eqCtorMap_wf.find?_insert]
+  rfl
+
+theorem eq_rec_env_lookup : eqFinalEnv.constants ``Eq.rec =
+    some (VInductDecl.recConst 1 ``Eq 2 eqType) := rfl
+
+theorem eq_rec_lookup_unique :
+    eqRecInfo.name = ``Eq.rec ∧
+      TrConstant .safe eqFinalEnv eqRecInfo
+        (VInductDecl.recConst 1 ``Eq 2 eqType) :=
+  eq_aligned.find?_uniq eq_rec_map_lookup eq_rec_env_lookup
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.eq_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/-! ## IndexedVec over the replayed Nat prefix -/
+
+/- The fixture spells its changing index as `Nat.succ n` (and its base as
+`Nat.zero`) so its kernel metadata has exactly the semantically relevant Nat
+dependency prefix, rather than the unrelated `OfNat`/`HAdd` instance
+implementation generated by notation. The declaration and every metadata
+record below are still quoted from and checked against the real kernel
+objects. -/
+def indexedVecInfo : ConstantInfo := kernelInductInfo% IndexedVec
+def indexedVecNilInfo : ConstantInfo := kernelCtorInfo% IndexedVec.nil
+def indexedVecConsInfo : ConstantInfo := kernelCtorInfo% IndexedVec.cons
+def indexedVecRecInfo : ConstantInfo := kernelRecInfo% IndexedVec.rec
+def indexedVecNilKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% IndexedVec.rec 0
+def indexedVecConsKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% IndexedVec.rec 1
+
+example : indexedVecNilKernelRuleRhs =
+    indexedVecChecked.identityGeneration.generatedRules[0].rhs := rfl
+example : indexedVecConsKernelRuleRhs =
+    indexedVecChecked.identityGeneration.generatedRules[1].rhs := rfl
+
+def indexedVecTypeEnv :=
+  (natFinalEnv.addConst indexedVecType.name indexedVecType.toVConstant).get!
+def indexedVecNilEnv :=
+  (indexedVecTypeEnv.addConst indexedVecType.ctors[0].name
+    indexedVecType.ctors[0].toVConstant).get!
+def indexedVecCtorEnv :=
+  (indexedVecNilEnv.addConst indexedVecType.ctors[1].name
+    indexedVecType.ctors[1].toVConstant).get!
+def indexedVecRecEnv :=
+  (indexedVecCtorEnv.addConst ``IndexedVec.rec
+    (VInductDecl.recConst 1 ``IndexedVec 1 indexedVecType)).get!
+theorem indexedVecType_wf : indexedVecType.toVConstant.WF natFinalEnv := by
+  have hNat : natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+  refine ⟨.imax (.succ (.succ (.param 0)))
+    (.imax (.succ .zero) (.succ (.succ (.param 0)))), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.succ (.param 0)))
+    (v := .imax (.succ .zero) (.succ (.succ (.param 0)))) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · refine VEnv.HasType.forallE
+      (u := .succ .zero) (v := .succ (.succ (.param 0))) ?_ ?_
+    · type_tac
+    · exact VEnv.HasType.sort (by decide)
+
+theorem indexedVecDecl_wf : indexedVecDecl.WF natFinalEnv := by
+  refine ⟨rfl, ?_⟩
+  intro ty hty
+  have hty' : ty = indexedVecType :=
+    List.mem_singleton.1 (by simpa [indexedVecDecl] using hty)
+  subst ty
+  refine ⟨?_, ?_⟩
+  · change natFinalEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .const ``Nat []]
+    have hNat : natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+    exact ⟨⟨.succ (.succ (.param 0)), VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨.succ .zero, by type_tac⟩, trivial⟩⟩
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · constructor
+      · change True
+        trivial
+      · change natFinalEnv.SpineWF 1
+          [.sort (.succ (.param 0))]
+          (.forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+          [.const ``Nat.zero []] (.sort (.succ (.param 0)))
+        have hNat : natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+        have hZero : natFinalEnv.constants ``Nat.zero =
+            some natType.ctors[0].toVConstant := rfl
+        exact .cons (by type_tac) .nil
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      constructor
+      · change VInductDecl.fieldsWF 1 ``IndexedVec 1 natFinalEnv
+          (VLevel.succ (VLevel.param 0)) [VExpr.const ``Nat []]
+          [VExpr.sort (VLevel.succ (VLevel.param 0))] 0
+          [VExpr.const ``Nat [], VExpr.bvar 1,
+            VExpr.app (VExpr.app (VExpr.const ``IndexedVec [VLevel.param 0])
+              (VExpr.bvar 2)) (VExpr.bvar 1)]
+        have hNat : natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+        constructor
+        · exact .inr (.inr ⟨rfl, .succ .zero, (by type_tac),
+            .inr (VLevel.succ_le_succ VLevel.zero_le)⟩)
+        constructor
+        · intro h
+          contradiction
+        constructor
+        · exact .inr (.inr ⟨rfl, .succ (.param 0), (by type_tac),
+            .inr (VLevel.le_refl _)⟩)
+        constructor
+        · intro h
+          contradiction
+        constructor
+        · exact .inl rfl
+        constructor
+        · intro _
+          exact .cons (by type_tac) .nil
+        · trivial
+      · change natFinalEnv.SpineWF 1
+          [VExpr.app (VExpr.app (VExpr.const ``IndexedVec [VLevel.param 0])
+              (VExpr.bvar 2)) (VExpr.bvar 1),
+            VExpr.bvar 1, VExpr.const ``Nat [],
+            VExpr.sort (VLevel.succ (VLevel.param 0))]
+          (VExpr.forallE (VExpr.const ``Nat [])
+            (VExpr.sort (VLevel.succ (VLevel.param 0))))
+          [VExpr.app (VExpr.const ``Nat.succ []) (VExpr.bvar 2)]
+          (VExpr.sort (VLevel.succ (VLevel.param 0)))
+        have hNat : natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+        have hSucc : natFinalEnv.constants ``Nat.succ =
+            some natType.ctors[1].toVConstant := rfl
+        exact .cons (by type_tac) .nil
+
+theorem natFinalEnv_le_indexedVecTypeEnv : natFinalEnv ≤ indexedVecTypeEnv :=
+  VEnv.addConst_le (show natFinalEnv.addConst indexedVecType.name
+    indexedVecType.toVConstant = some indexedVecTypeEnv from rfl)
+
+theorem indexedVecTypeEnv_le_indexedVecNilEnv :
+    indexedVecTypeEnv ≤ indexedVecNilEnv :=
+  VEnv.addConst_le (show indexedVecTypeEnv.addConst
+    indexedVecType.ctors[0].name indexedVecType.ctors[0].toVConstant =
+      some indexedVecNilEnv from rfl)
+
+theorem indexedVecNilEnv_le_indexedVecCtorEnv :
+    indexedVecNilEnv ≤ indexedVecCtorEnv :=
+  VEnv.addConst_le (show indexedVecNilEnv.addConst
+    indexedVecType.ctors[1].name indexedVecType.ctors[1].toVConstant =
+      some indexedVecCtorEnv from rfl)
+
+theorem indexedVecTypeEnv_ordered : indexedVecTypeEnv.Ordered :=
+  .const (n := indexedVecType.name) (ci := indexedVecType.toVConstant)
+    nat_env_wf.ordered indexedVecType_wf rfl
+
+theorem indexedVecNil_wf :
+    indexedVecType.ctors[0].toVConstant.WF indexedVecTypeEnv := by
+  have hblock := indexedVecDecl_wf.2 indexedVecType
+    (by simp [indexedVecDecl])
+  have hctor := hblock.2 indexedVecType.ctors[0] (by simp)
+  have hle : natFinalEnv ≤ indexedVecTypeEnv :=
+    natFinalEnv_le_indexedVecTypeEnv
+  have S0 : VInductDecl.Stage3Env indexedVecTypeEnv 1 ``IndexedVec 1
+      (.succ (.param 0)) { indexedVecType with ctors := [] } := {
+    ord := indexedVecTypeEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := by simp
+    htel := by simp
+    hs3 := by simp
+    hparams := hblock.1.mono hle
+    hfields := by simp
+    hresult := by simp }
+  exact S0.ctorType_isType' rfl rfl
+    (VInductDecl.fieldsWF_mono hle hctor.1) (hctor.2.mono hle)
+
+theorem indexedVecNilEnv_ordered : indexedVecNilEnv.Ordered :=
+  .const (n := indexedVecType.ctors[0].name)
+    (ci := indexedVecType.ctors[0].toVConstant)
+    indexedVecTypeEnv_ordered indexedVecNil_wf rfl
+
+theorem indexedVecCons_wf :
+    indexedVecType.ctors[1].toVConstant.WF indexedVecNilEnv := by
+  have hblock := indexedVecDecl_wf.2 indexedVecType
+    (by simp [indexedVecDecl])
+  have hnil := hblock.2 indexedVecType.ctors[0] (by simp)
+  have hcons := hblock.2 indexedVecType.ctors[1] (by simp)
+  have h0 : natFinalEnv ≤ indexedVecTypeEnv :=
+    natFinalEnv_le_indexedVecTypeEnv
+  have h1 : indexedVecTypeEnv ≤ indexedVecNilEnv :=
+    indexedVecTypeEnv_le_indexedVecNilEnv
+  have hle : natFinalEnv ≤ indexedVecNilEnv := h0.trans h1
+  have S1 : VInductDecl.Stage3Env indexedVecNilEnv 1 ``IndexedVec 1
+      (.succ (.param 0))
+      { indexedVecType with ctors := [indexedVecType.ctors[0]] } := {
+    ord := indexedVecNilEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+    htel := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+    hs3 := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+    hparams := hblock.1.mono hle
+    hfields := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      exact VInductDecl.fieldsWF_mono hle hnil.1
+    hresult := by
+      intro c hc
+      have hc' := List.mem_singleton.1 hc
+      subst c
+      exact hnil.2.mono hle }
+  exact S1.ctorType_isType' rfl rfl
+    (VInductDecl.fieldsWF_mono hle hcons.1) (hcons.2.mono hle)
+
+theorem indexedVecCtorEnv_ordered : indexedVecCtorEnv.Ordered :=
+  .const (n := indexedVecType.ctors[1].name)
+    (ci := indexedVecType.ctors[1].toVConstant)
+    indexedVecNilEnv_ordered indexedVecCons_wf rfl
+
+theorem indexedVecStage3 :
+    VInductDecl.Stage3Env indexedVecCtorEnv 1 ``IndexedVec 1
+      (.succ (.param 0)) indexedVecType := by
+  have hblock := indexedVecDecl_wf.2 indexedVecType
+    (by simp [indexedVecDecl])
+  have h0 : natFinalEnv ≤ indexedVecTypeEnv :=
+    natFinalEnv_le_indexedVecTypeEnv
+  have h1 : indexedVecTypeEnv ≤ indexedVecNilEnv :=
+    indexedVecTypeEnv_le_indexedVecNilEnv
+  have h2 : indexedVecNilEnv ≤ indexedVecCtorEnv :=
+    indexedVecNilEnv_le_indexedVecCtorEnv
+  have hle : natFinalEnv ≤ indexedVecCtorEnv := (h0.trans h1).trans h2
+  refine {
+    ord := indexedVecCtorEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := ?_
+    htel := ?_
+    hs3 := ?_
+    hparams := hblock.1.mono hle
+    hfields := ?_
+    hresult := ?_ }
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · rfl
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · rfl
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+  · intro c hc
+    rcases List.mem_cons.1 hc with rfl | hc
+    · rfl
+    · have hc' := List.mem_singleton.1 hc
+      subst c
+      rfl
+  · intro c hc
+    exact VInductDecl.fieldsWF_mono hle (hblock.2 c hc).1
+  · intro c hc
+    exact (hblock.2 c hc).2.mono hle
+
+theorem indexedVecInfo_tr :
+    TrConstVal .safe natFinalEnv indexedVecInfo indexedVecType.toVConstVal := by
+  have hNat : natFinalEnv.constants ``Nat = some natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr natFinalEnv indexedVecInfo.levelParams []
+      indexedVecInfo.type indexedVecType.type := by tr_type_expr_tac
+  obtain ⟨u, htype⟩ := indexedVecType_wf
+  exact hshape.to_trExprS nat_env_wf.ordered trivial ⟨.sort u, htype⟩
+
+theorem indexedVecNilInfo_tr :
+    TrConstVal .safe indexedVecTypeEnv indexedVecNilInfo
+      indexedVecType.ctors[0] := by
+  have hNat : indexedVecTypeEnv.constants ``Nat = some natType.toVConstant := rfl
+  have hZero : indexedVecTypeEnv.constants ``Nat.zero =
+      some natType.ctors[0].toVConstant := rfl
+  have hVec : indexedVecTypeEnv.constants ``IndexedVec =
+      some indexedVecType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedVecTypeEnv indexedVecNilInfo.levelParams []
+      indexedVecNilInfo.type indexedVecType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := indexedVecNil_wf
+  exact hshape.to_trExprS indexedVecTypeEnv_ordered trivial ⟨.sort u, htype⟩
+
+theorem indexedVecConsInfo_tr :
+    TrConstVal .safe indexedVecNilEnv indexedVecConsInfo
+      indexedVecType.ctors[1] := by
+  have hNat : indexedVecNilEnv.constants ``Nat = some natType.toVConstant := rfl
+  have hSucc : indexedVecNilEnv.constants ``Nat.succ =
+      some natType.ctors[1].toVConstant := rfl
+  have hVec : indexedVecNilEnv.constants ``IndexedVec =
+      some indexedVecType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedVecNilEnv indexedVecConsInfo.levelParams []
+      indexedVecConsInfo.type indexedVecType.ctors[1].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := indexedVecCons_wf
+  exact hshape.to_trExprS indexedVecNilEnv_ordered trivial ⟨.sort u, htype⟩
+
+theorem indexedVecRecInfo_tr :
+    TrConstVal .safe indexedVecCtorEnv indexedVecRecInfo
+      (inductRecVal indexedVecDecl indexedVecType) := by
+  have hNat : indexedVecCtorEnv.constants ``Nat = some natType.toVConstant := rfl
+  have hZero : indexedVecCtorEnv.constants ``Nat.zero =
+      some natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedVecCtorEnv.constants ``Nat.succ =
+      some natType.ctors[1].toVConstant := rfl
+  have hVec : indexedVecCtorEnv.constants ``IndexedVec =
+      some indexedVecType.toVConstant := rfl
+  have hNil : indexedVecCtorEnv.constants ``IndexedVec.nil =
+      some indexedVecType.ctors[0].toVConstant := rfl
+  have hCons : indexedVecCtorEnv.constants ``IndexedVec.cons =
+      some indexedVecType.ctors[1].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedVecCtorEnv indexedVecRecInfo.levelParams []
+      indexedVecRecInfo.type
+      (inductRecVal indexedVecDecl indexedVecType).type := by
+    tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := indexedVecStage3.recConst_wf
+  exact hshape.to_trExprS indexedVecCtorEnv_ordered trivial ⟨.sort u, hrec⟩
+
+def indexedVecTypeMap : ConstMap := natMap.insert ``IndexedVec indexedVecInfo
+def indexedVecNilMap : ConstMap :=
+  indexedVecTypeMap.insert ``IndexedVec.nil indexedVecNilInfo
+def indexedVecCtorMap : ConstMap :=
+  indexedVecNilMap.insert ``IndexedVec.cons indexedVecConsInfo
+def indexedVecMap : ConstMap :=
+  indexedVecCtorMap.insert ``IndexedVec.rec indexedVecRecInfo
+def indexedVecFinalEnv : VEnv :=
+  (VInductDecl.rules 1 ``IndexedVec 1 indexedVecType).foldl
+    VEnv.addDefEq indexedVecRecEnv
+
+theorem natMap_wf : natMap.WF := (nat_trEnv' (safety := .safe)).map_wf
+
+theorem indexedVecType_fresh : natMap.find? ``IndexedVec = none := by
+  rw [natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedVecTypeMap_wf : indexedVecTypeMap.WF :=
+  natMap_wf.insert _ _ indexedVecType_fresh
+
+theorem indexedVecNil_fresh :
+    indexedVecTypeMap.find? ``IndexedVec.nil = none := by
+  rw [indexedVecTypeMap, natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedVecNilMap_wf : indexedVecNilMap.WF :=
+  indexedVecTypeMap_wf.insert _ _ indexedVecNil_fresh
+
+theorem indexedVecCons_fresh :
+    indexedVecNilMap.find? ``IndexedVec.cons = none := by
+  rw [indexedVecNilMap, indexedVecTypeMap_wf.find?_insert,
+    indexedVecTypeMap, natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedVecCtorMap_wf : indexedVecCtorMap.WF :=
+  indexedVecNilMap_wf.insert _ _ indexedVecCons_fresh
+
+theorem indexedVecRec_fresh :
+    indexedVecCtorMap.find? ``IndexedVec.rec = none := by
+  rw [indexedVecCtorMap, indexedVecNilMap_wf.find?_insert,
+    indexedVecNilMap, indexedVecTypeMap_wf.find?_insert,
+    indexedVecTypeMap, natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedVec_addInduct :
+    AddInduct natMap natFinalEnv indexedVecDecl indexedVecMap
+      indexedVecFinalEnv := by
+  refine ⟨{
+    generation := indexedVecChecked.identityGeneration
+    generation_wf :=
+      (indexedVecChecked.wf_of_decl indexedVecDecl_wf).identityGeneration
+        nat_env_wf.ordered
+    typeMap := indexedVecTypeMap
+    typeEnv := indexedVecTypeEnv
+    ctorMap := indexedVecCtorMap
+    ctorEnv := indexedVecCtorEnv
+    recEnv := indexedVecRecEnv
+    addType := {
+      info := indexedVecInfo
+      kind_eq := by simp [indexedVecInfo, InductConstantKind.Matches]
+      tr := indexedVecInfo_tr
+      map_fresh := by
+        change natMap.find? ``IndexedVec = none
+        exact indexedVecType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := indexedVecRecInfo
+      kind_eq := by simp [indexedVecRecInfo, InductConstantKind.Matches]
+      tr := indexedVecRecInfo_tr
+      map_fresh := by
+        change indexedVecCtorMap.find? ``IndexedVec.rec = none
+        exact indexedVecRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := indexedVecNilInfo
+      kind_eq := by simp [indexedVecNilInfo, InductConstantKind.Matches]
+      tr := indexedVecNilInfo_tr
+      map_fresh := by simpa [indexedVecType] using indexedVecNil_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := indexedVecConsInfo
+      kind_eq := by simp [indexedVecConsInfo, InductConstantKind.Matches]
+      tr := indexedVecConsInfo_tr
+      map_fresh := by
+        change indexedVecNilMap.find? ``IndexedVec.cons = none
+        exact indexedVecCons_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+
+theorem indexedVec_trEnv' :
+    TrEnv' .safe indexedVecMap false indexedVecFinalEnv :=
+  .induct indexedVec_addInduct nat_trEnv'
+
+theorem indexedVec_final_matches_addInduct :
+    natFinalEnv.addInduct indexedVecDecl = some indexedVecFinalEnv :=
+  rfl
+
+theorem indexedVec_env_wf : indexedVecFinalEnv.WF := indexedVec_trEnv'.wf
+
+theorem indexedVec_aligned :
+    Aligned .safe indexedVecMap indexedVecFinalEnv :=
+  indexedVec_trEnv'.aligned
+
+theorem indexedVec_type_map_lookup :
+    indexedVecMap.find? ``IndexedVec = some indexedVecInfo := by
+  rw [indexedVecMap, indexedVecCtorMap_wf.find?_insert, indexedVecCtorMap,
+    indexedVecNilMap_wf.find?_insert, indexedVecNilMap,
+    indexedVecTypeMap_wf.find?_insert, indexedVecTypeMap,
+    natMap_wf.find?_insert]
+  rfl
+
+theorem indexedVec_type_env_lookup :
+    indexedVecFinalEnv.constants ``IndexedVec =
+      some indexedVecType.toVConstant := rfl
+
+theorem indexedVec_type_lookup_unique :
+    indexedVecInfo.name = ``IndexedVec ∧
+      TrConstant .safe indexedVecFinalEnv indexedVecInfo
+        indexedVecType.toVConstant :=
+  indexedVec_aligned.find?_uniq indexedVec_type_map_lookup
+    indexedVec_type_env_lookup
+
+theorem indexedVec_cons_map_lookup :
+    indexedVecMap.find? ``IndexedVec.cons = some indexedVecConsInfo := by
+  rw [indexedVecMap, indexedVecCtorMap_wf.find?_insert, indexedVecCtorMap,
+    indexedVecNilMap_wf.find?_insert]
+  rfl
+
+theorem indexedVec_cons_env_lookup :
+    indexedVecFinalEnv.constants ``IndexedVec.cons =
+      some indexedVecType.ctors[1].toVConstant := rfl
+
+theorem indexedVec_cons_lookup_unique :
+    indexedVecConsInfo.name = ``IndexedVec.cons ∧
+      TrConstant .safe indexedVecFinalEnv indexedVecConsInfo
+        indexedVecType.ctors[1].toVConstant :=
+  indexedVec_aligned.find?_uniq indexedVec_cons_map_lookup
+    indexedVec_cons_env_lookup
+
+theorem indexedVec_rec_map_lookup :
+    indexedVecMap.find? ``IndexedVec.rec = some indexedVecRecInfo := by
+  rw [indexedVecMap, indexedVecCtorMap_wf.find?_insert]
+  rfl
+
+theorem indexedVec_rec_env_lookup :
+    indexedVecFinalEnv.constants ``IndexedVec.rec =
+      some (VInductDecl.recConst 1 ``IndexedVec 1 indexedVecType) := rfl
+
+theorem indexedVec_rec_lookup_unique :
+    indexedVecRecInfo.name = ``IndexedVec.rec ∧
+      TrConstant .safe indexedVecFinalEnv indexedVecRecInfo
+        (VInductDecl.recConst 1 ``IndexedVec 1 indexedVecType) :=
+  indexedVec_aligned.find?_uniq indexedVec_rec_map_lookup
+    indexedVec_rec_env_lookup
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.indexedVec_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/-! ## Acc: recursive Pi metadata -/
+
+/- `Acc` is the first replay whose recursive constructor argument is a
+function. In addition to translating the three kernel constants, this fixture
+quotes the actual `RecursorRule.rhs` and compares it definitionally with the
+public generalized Theory rule. -/
+def accInfo : ConstantInfo := kernelInductInfo% Acc
+def accIntroInfo : ConstantInfo := kernelCtorInfo% Acc.intro
+def accRecInfo : ConstantInfo := kernelRecInfo% Acc.rec
+def accKernelRuleRhs : VExpr := kernelRecRuleRhs% Acc.rec 0
+
+example : (match accIntroInfo with
+    | .ctorInfo ci => ci.numParams
+    | _ => 0) = 2 := rfl
+example : (match accIntroInfo with
+    | .ctorInfo ci => ci.numFields
+    | _ => 0) = 2 := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.numParams
+    | _ => 0) = 2 := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.numIndices
+    | _ => 0) = 1 := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.numMotives
+    | _ => 0) = 1 := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.numMinors
+    | _ => 0) = 1 := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.rules.length
+    | _ => 0) = 1 := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.rules[0]?.map (·.ctor) |>.getD .anonymous
+    | _ => .anonymous) = ``Acc.intro := rfl
+example : (match accRecInfo with
+    | .recInfo ci => ci.rules[0]?.map (·.nfields) |>.getD 0
+    | _ => 0) = 2 := rfl
+
+/-- The actual kernel rule has the same lambda-wrapped functional recursive
+call as the public Theory generator, in the kernel recursor's universe order. -/
+example : accKernelRuleRhs =
+    (VInductDecl.ruleRec 1 ``Acc 2 accType 0 accType.ctors[0]).rhs := rfl
+example : accKernelRuleRhs =
+    accChecked.identityGeneration.generatedRules[0].rhs := rfl
+
+def accTypeEnv := (VEnv.empty.addConst accType.name accType.toVConstant).get!
+def accCtorEnv :=
+  (accTypeEnv.addConst accType.ctors[0].name accType.ctors[0].toVConstant).get!
+def accRecEnv :=
+  (accCtorEnv.addConst ``Acc.rec
+    (VInductDecl.recConstRec 1 ``Acc 2 accType)).get!
+
+theorem accType_wf : accType.toVConstant.WF VEnv.empty := by
+  have htel := (accDecl_wf.2 accType (by simp [accDecl])).1
+  change VEnv.empty.IsType 1 [] accType.type
+  rw [show accType.type = VExpr.forallN
+    [.sort (.param 0),
+      .forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)),
+      .bvar 1] (.sort .zero) from rfl]
+  exact VEnv.IsType.forallN htel ⟨.succ .zero, VEnv.HasType.sort (by decide)⟩
+
+theorem accTypeEnv_ordered : accTypeEnv.Ordered :=
+  .const .empty accType_wf rfl
+
+theorem accIntro_wf : accType.ctors[0].toVConstant.WF accTypeEnv := by
+  have hblock := accDecl_wf.2 accType (by simp [accDecl])
+  have hctor := hblock.2 accType.ctors[0] (by simp)
+  have hle : VEnv.empty ≤ accTypeEnv := VEnv.addConst_le rfl
+  have S0 : VInductDecl.Stage3Env accTypeEnv 1 ``Acc 2 .zero
+      { accType with ctors := [] } := {
+    ord := accTypeEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := by simp
+    htel := by simp
+    hs3 := by simp
+    hparams := hblock.1.mono hle
+    hfields := by simp
+    hresult := by simp }
+  exact S0.ctorType_isType' rfl rfl
+    (VInductDecl.fieldsWF_mono hle hctor.1) (hctor.2.mono hle)
+
+theorem accCtorEnv_ordered : accCtorEnv.Ordered :=
+  .const (n := accType.ctors[0].name) (ci := accType.ctors[0].toVConstant)
+    accTypeEnv_ordered accIntro_wf rfl
+
+theorem accStage3 :
+    VInductDecl.Stage3Env accCtorEnv 1 ``Acc 2 .zero accType := by
+  have hblock := accDecl_wf.2 accType (by simp [accDecl])
+  have hctor := hblock.2 accType.ctors[0] (by simp)
+  have h0 : VEnv.empty ≤ accTypeEnv := VEnv.addConst_le rfl
+  have h1 : accTypeEnv ≤ accCtorEnv :=
+    VEnv.addConst_le (show accTypeEnv.addConst accType.ctors[0].name
+      accType.ctors[0].toVConstant = some accCtorEnv from rfl)
+  have hle : VEnv.empty ≤ accCtorEnv := h0.trans h1
+  refine {
+    ord := accCtorEnv_ordered
+    hl := by decide
+    hsort := rfl
+    hlen := rfl
+    hT := rfl
+    hcs := ?_
+    htel := ?_
+    hs3 := ?_
+    hparams := hblock.1.mono hle
+    hfields := ?_
+    hresult := ?_ }
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    rfl
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    rfl
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    rfl
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    exact VInductDecl.fieldsWF_mono hle hctor.1
+  · intro c hc
+    have hc' := List.mem_singleton.1 hc
+    subst c
+    exact hctor.2.mono hle
+
+theorem accInfo_tr :
+    TrConstVal .safe VEnv.empty accInfo accType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr VEnv.empty accInfo.levelParams [] accInfo.type
+      accType.type := by tr_type_expr_tac
+  obtain ⟨u, htype⟩ := accType_wf
+  exact hshape.to_trExprS .empty trivial ⟨.sort u, htype⟩
+
+theorem accIntroInfo_tr :
+    TrConstVal .safe accTypeEnv accIntroInfo accType.ctors[0] := by
+  have hAcc : accTypeEnv.constants ``Acc = some accType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr accTypeEnv accIntroInfo.levelParams []
+      accIntroInfo.type accType.ctors[0].type := by tr_type_expr_tac
+  obtain ⟨u, htype⟩ := accIntro_wf
+  exact hshape.to_trExprS accTypeEnv_ordered trivial ⟨.sort u, htype⟩
+
+theorem accRecInfo_tr :
+    TrConstVal .safe accCtorEnv accRecInfo (inductRecVal accDecl accType) := by
+  have hAcc : accCtorEnv.constants ``Acc = some accType.toVConstant := rfl
+  have hIntro : accCtorEnv.constants ``Acc.intro =
+      some accType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr accCtorEnv accRecInfo.levelParams []
+      accRecInfo.type (inductRecVal accDecl accType).type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := accStage3.recConstRec_wf
+  exact hshape.to_trExprS accCtorEnv_ordered trivial ⟨.sort u, hrec⟩
+
+def accTypeMap : ConstMap := ({} : ConstMap).insert ``Acc accInfo
+def accCtorMap : ConstMap := accTypeMap.insert ``Acc.intro accIntroInfo
+def accMap : ConstMap := accCtorMap.insert ``Acc.rec accRecInfo
+def accFinalEnv : VEnv :=
+  (VInductDecl.rulesRec 1 ``Acc 2 accType).foldl VEnv.addDefEq accRecEnv
+
+theorem accType_fresh : ({} : ConstMap).find? ``Acc = none := by
+  simp [SMap.find?]
+
+theorem accTypeMap_wf : accTypeMap.WF :=
+  SMap.WF.empty.insert _ _ accType_fresh
+
+theorem accIntro_fresh : accTypeMap.find? ``Acc.intro = none := by
+  rw [accTypeMap, SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem accCtorMap_wf : accCtorMap.WF :=
+  accTypeMap_wf.insert _ _ accIntro_fresh
+
+theorem accRec_fresh : accCtorMap.find? ``Acc.rec = none := by
+  rw [accCtorMap, accTypeMap_wf.find?_insert, accTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem acc_addInduct :
+    AddInduct ({} : ConstMap) VEnv.empty accDecl accMap accFinalEnv := by
+  refine ⟨{
+    generation := accChecked.identityGeneration
+    generation_wf :=
+      (accChecked.wf_of_decl accDecl_wf).identityGeneration .empty
+    typeMap := accTypeMap
+    typeEnv := accTypeEnv
+    ctorMap := accCtorMap
+    ctorEnv := accCtorEnv
+    recEnv := accRecEnv
+    addType := {
+      info := accInfo
+      kind_eq := by simp [accInfo, InductConstantKind.Matches]
+      tr := accInfo_tr
+      map_fresh := by
+        change ({} : ConstMap).find? ``Acc = none
+        exact accType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := accRecInfo
+      kind_eq := by simp [accRecInfo, InductConstantKind.Matches]
+      tr := accRecInfo_tr
+      map_fresh := by
+        change accCtorMap.find? ``Acc.rec = none
+        exact accRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := accIntroInfo
+    kind_eq := by simp [accIntroInfo, InductConstantKind.Matches]
+    tr := accIntroInfo_tr
+    map_fresh := by simpa [accType] using accIntro_fresh
+    env_add := rfl
+    map_add := rfl } .nil
+
+/-- Replay the actual kernel `Acc` metadata through the live inductive
+environment branch. -/
+theorem acc_trEnv' : TrEnv' .safe accMap false accFinalEnv :=
+  .induct acc_addInduct .empty
+
+theorem acc_final_matches_addInduct :
+    VEnv.empty.addInduct accDecl = some accFinalEnv :=
+  rfl
+
+theorem acc_env_wf : accFinalEnv.WF := acc_trEnv'.wf
+
+theorem acc_aligned : Aligned .safe accMap accFinalEnv := acc_trEnv'.aligned
+
+theorem acc_type_map_lookup : accMap.find? ``Acc = some accInfo := by
+  rw [accMap, accCtorMap_wf.find?_insert, accCtorMap,
+    accTypeMap_wf.find?_insert, accTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+theorem acc_type_env_lookup :
+    accFinalEnv.constants ``Acc = some accType.toVConstant := rfl
+
+theorem acc_type_lookup_unique :
+    accInfo.name = ``Acc ∧
+      TrConstant .safe accFinalEnv accInfo accType.toVConstant :=
+  acc_aligned.find?_uniq acc_type_map_lookup acc_type_env_lookup
+
+theorem acc_intro_map_lookup :
+    accMap.find? ``Acc.intro = some accIntroInfo := by
+  rw [accMap, accCtorMap_wf.find?_insert, accCtorMap,
+    accTypeMap_wf.find?_insert]
+  rfl
+
+theorem acc_intro_env_lookup :
+    accFinalEnv.constants ``Acc.intro =
+      some accType.ctors[0].toVConstant := rfl
+
+theorem acc_intro_lookup_unique :
+    accIntroInfo.name = ``Acc.intro ∧
+      TrConstant .safe accFinalEnv accIntroInfo
+        accType.ctors[0].toVConstant :=
+  acc_aligned.find?_uniq acc_intro_map_lookup acc_intro_env_lookup
+
+theorem acc_rec_map_lookup : accMap.find? ``Acc.rec = some accRecInfo := by
+  rw [accMap, accCtorMap_wf.find?_insert]
+  rfl
+
+theorem acc_rec_env_lookup :
+    accFinalEnv.constants ``Acc.rec =
+      some (VInductDecl.recConstRec 1 ``Acc 2 accType) := rfl
+
+theorem acc_rec_lookup_unique :
+    accRecInfo.name = ``Acc.rec ∧
+      TrConstant .safe accFinalEnv accRecInfo
+        (VInductDecl.recConstRec 1 ``Acc 2 accType) :=
+  acc_aligned.find?_uniq acc_rec_map_lookup acc_rec_env_lookup
+
+/- This has the same `sorryAx`-free closure as the direct replay roots; the
+persistent-map contracts enter through concrete `SMap` freshness proofs. -/
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.acc_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/-! ## AliasFormer: non-identity family-result normalization -/
+
+/-- The actual reducible alias declaration that precedes `AliasFormer` in the
+kernel environment. -/
+def typeFamilyAliasKernelDef : DefinitionVal :=
+  kernelDefVal% TypeFamilyAlias
+
+def typeFamilyAliasInfo : ConstantInfo :=
+  .defnInfo typeFamilyAliasKernelDef
+
+def typeFamilyAliasVal : VDefVal where
+  name := ``TypeFamilyAlias
+  uvars := (vconst(type_of% @TypeFamilyAlias) : VConstant).uvars
+  type := (vconst(type_of% @TypeFamilyAlias) : VConstant).type
+  value := typeFamilyAliasDefEq.rhs
+
+theorem typeFamilyAliasInfo_tr :
+    TrDefVal .safe VEnv.empty typeFamilyAliasInfo typeFamilyAliasVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · exact .sort rfl
+  · exact .sort rfl
+
+theorem typeFamilyAliasVal_wf :
+    typeFamilyAliasVal.WF VEnv.empty :=
+  VEnv.HasType.sort (by decide)
+
+def typeFamilyAliasMap : ConstMap :=
+  ({} : ConstMap).insert ``TypeFamilyAlias typeFamilyAliasInfo
+
+theorem typeFamilyAliasMap_fresh :
+    ({} : ConstMap).find? ``TypeFamilyAlias = none := by
+  simp [SMap.find?]
+
+/-- Replay the actual alias definition, including its Theory delta rule. -/
+theorem typeFamilyAlias_trEnv' {safety : DefinitionSafety} :
+    TrEnv' safety typeFamilyAliasMap false typeFamilyAliasEnv :=
+  .defn (ci := typeFamilyAliasKernelDef) (ci' := typeFamilyAliasVal)
+    (typeFamilyAliasInfo_tr.sf_mono DefinitionSafety.le_safe)
+    typeFamilyAliasMap_fresh
+    typeFamilyAliasVal_wf rfl .empty
+
+def aliasFormerInfo : ConstantInfo := kernelInductInfo% AliasFormer
+def aliasFormerMkInfo : ConstantInfo := kernelCtorInfo% AliasFormer.mk
+def aliasFormerRecInfo : ConstantInfo := kernelRecInfo% AliasFormer.rec
+def aliasFormerKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% AliasFormer.rec 0
+
+example : aliasFormerRawDecl.checked? = none := rfl
+example : aliasFormerGenerationChecked.block.sourceType =
+    aliasFormerRawType := rfl
+example : aliasFormerGenerationChecked.block.checked.type =
+    aliasFormerViewType := rfl
+example : aliasFormerKernelRuleRhs =
+    aliasFormerGenerationChecked.generatedRules[0].rhs := rfl
+
+def aliasFormerTypeEnv :=
+  (typeFamilyAliasEnv.addConst aliasFormerRawType.name
+    aliasFormerRawType.toVConstant).get!
+
+def aliasFormerCtorEnv :=
+  (aliasFormerTypeEnv.addConst aliasFormerRawType.ctors[0].name
+    aliasFormerRawType.ctors[0].toVConstant).get!
+
+def aliasFormerRecEnv :=
+  (aliasFormerCtorEnv.addConst ``AliasFormer.rec
+    aliasFormerGenerationChecked.recursor).get!
+
+theorem aliasFormerTypeEnv_ordered : aliasFormerTypeEnv.Ordered := by
+  refine .const (n := aliasFormerRawType.name)
+    (ci := aliasFormerRawType.toVConstant)
+    typeFamilyAliasEnv_ordered ?_ rfl
+  show typeFamilyAliasEnv.IsType
+    aliasFormerGenerationChecked.block.sourceType.uvars []
+    aliasFormerGenerationChecked.block.sourceType.type
+  rw [aliasFormerGenerationChecked.block.sourceType_uvars_eq]
+  exact aliasFormerGenerationChecked_wf.rawFamily_isType
+
+theorem aliasFormerRawCtor_wf :
+    aliasFormerRawType.ctors[0].toVConstant.WF aliasFormerTypeEnv := by
+  have hctor :
+      (⟨aliasFormerRawType.ctors[0],
+        aliasFormerViewChecked.constructors[0]⟩ :
+          VInductDecl.NormalizedCtor) ∈
+        aliasFormerGenerationChecked.block.ctorPairs := by
+    exact .head _
+  show aliasFormerTypeEnv.IsType
+    aliasFormerRawType.ctors[0].uvars []
+    aliasFormerRawType.ctors[0].type
+  rw [aliasFormerGenerationChecked.ctor_uvars_eq hctor]
+  exact aliasFormerGenerationChecked_wf.rawCtor_isType rfl hctor
+
+theorem aliasFormerCtorEnv_ordered : aliasFormerCtorEnv.Ordered :=
+  .const (n := aliasFormerRawType.ctors[0].name)
+    (ci := aliasFormerRawType.ctors[0].toVConstant)
+    aliasFormerTypeEnv_ordered aliasFormerRawCtor_wf rfl
+
+theorem aliasFormerGenerationEnv :
+    VInductDecl.GenerationEnv aliasFormerGenerationChecked
+      aliasFormerCtorEnv := by
+  apply aliasFormerGenerationChecked_wf.toGenerationEnv
+    (envT := aliasFormerTypeEnv)
+  · rfl
+  · exact (VEnv.addConst_le (show
+      typeFamilyAliasEnv.addConst aliasFormerRawType.name
+        aliasFormerRawType.toVConstant = some aliasFormerTypeEnv from rfl)).trans
+      (VEnv.addConst_le (show
+        aliasFormerTypeEnv.addConst aliasFormerRawType.ctors[0].name
+          aliasFormerRawType.ctors[0].toVConstant =
+            some aliasFormerCtorEnv from rfl))
+  · exact VEnv.addConst_le (show
+      aliasFormerTypeEnv.addConst aliasFormerRawType.ctors[0].name
+        aliasFormerRawType.ctors[0].toVConstant =
+          some aliasFormerCtorEnv from rfl)
+  · exact aliasFormerCtorEnv_ordered
+  · rfl
+  · intro ctor hctor
+    change ctor ∈
+      [⟨aliasFormerRawType.ctors[0],
+        aliasFormerViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    rfl
+
+theorem aliasFormerInfo_tr :
+    TrConstVal .safe typeFamilyAliasEnv aliasFormerInfo
+      aliasFormerRawType.toVConstVal := by
+  have hAlias : typeFamilyAliasEnv.constants ``TypeFamilyAlias =
+      some (vconst(type_of% @TypeFamilyAlias)) := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr typeFamilyAliasEnv
+      aliasFormerInfo.levelParams [] aliasFormerInfo.type
+      aliasFormerRawType.type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ :=
+    aliasFormerGenerationChecked_wf.rawFamily_isType
+  exact hshape.to_trExprS typeFamilyAliasEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+theorem aliasFormerMkInfo_tr :
+    TrConstVal .safe aliasFormerTypeEnv aliasFormerMkInfo
+      aliasFormerRawType.ctors[0] := by
+  have hFamily : aliasFormerTypeEnv.constants ``AliasFormer =
+      some aliasFormerRawType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr aliasFormerTypeEnv
+      aliasFormerMkInfo.levelParams [] aliasFormerMkInfo.type
+      aliasFormerRawType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := aliasFormerRawCtor_wf
+  exact hshape.to_trExprS aliasFormerTypeEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+theorem aliasFormerRecInfo_tr :
+    TrConstVal .safe aliasFormerCtorEnv aliasFormerRecInfo
+      (inductGenerationRecVal aliasFormerGenerationChecked) := by
+  have hFamily : aliasFormerCtorEnv.constants ``AliasFormer =
+      some aliasFormerRawType.toVConstant := rfl
+  have hMk : aliasFormerCtorEnv.constants ``AliasFormer.mk =
+      some aliasFormerRawType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr aliasFormerCtorEnv
+      aliasFormerRecInfo.levelParams [] aliasFormerRecInfo.type
+      (inductGenerationRecVal aliasFormerGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := aliasFormerGenerationEnv.recursor_wf
+  exact hshape.to_trExprS aliasFormerCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+def aliasFormerTypeMap : ConstMap :=
+  typeFamilyAliasMap.insert ``AliasFormer aliasFormerInfo
+
+def aliasFormerCtorMap : ConstMap :=
+  aliasFormerTypeMap.insert ``AliasFormer.mk aliasFormerMkInfo
+
+def aliasFormerMap : ConstMap :=
+  aliasFormerCtorMap.insert ``AliasFormer.rec aliasFormerRecInfo
+
+theorem typeFamilyAliasMap_wf : typeFamilyAliasMap.WF :=
+  (typeFamilyAlias_trEnv' (safety := .safe)).map_wf
+
+theorem aliasFormerType_fresh :
+    typeFamilyAliasMap.find? ``AliasFormer = none := by
+  rw [typeFamilyAliasMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem aliasFormerTypeMap_wf : aliasFormerTypeMap.WF :=
+  typeFamilyAliasMap_wf.insert _ _ aliasFormerType_fresh
+
+theorem aliasFormerMk_fresh :
+    aliasFormerTypeMap.find? ``AliasFormer.mk = none := by
+  rw [aliasFormerTypeMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem aliasFormerCtorMap_wf : aliasFormerCtorMap.WF :=
+  aliasFormerTypeMap_wf.insert _ _ aliasFormerMk_fresh
+
+theorem aliasFormerRec_fresh :
+    aliasFormerCtorMap.find? ``AliasFormer.rec = none := by
+  rw [aliasFormerCtorMap, aliasFormerTypeMap_wf.find?_insert,
+    aliasFormerTypeMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private def aliasFormerAddInductTraceWith
+    (generation_wf :
+      aliasFormerGenerationChecked.WF typeFamilyAliasEnv) :
+    AddInductTrace typeFamilyAliasMap typeFamilyAliasEnv
+      aliasFormerRawDecl aliasFormerMap aliasFormerFinalEnv := by
+  refine {
+    generation := aliasFormerGenerationChecked
+    generation_wf := generation_wf
+    typeMap := aliasFormerTypeMap
+    typeEnv := aliasFormerTypeEnv
+    ctorMap := aliasFormerCtorMap
+    ctorEnv := aliasFormerCtorEnv
+    recEnv := aliasFormerRecEnv
+    addType := {
+      info := aliasFormerInfo
+      kind_eq := by simp [aliasFormerInfo, InductConstantKind.Matches]
+      tr := aliasFormerInfo_tr
+      map_fresh := by
+        change typeFamilyAliasMap.find? ``AliasFormer = none
+        exact aliasFormerType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := aliasFormerRecInfo
+      kind_eq := by simp [aliasFormerRecInfo, InductConstantKind.Matches]
+      tr := aliasFormerRecInfo_tr
+      map_fresh := by
+        change aliasFormerCtorMap.find? ``AliasFormer.rec = none
+        exact aliasFormerRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }
+  exact .cons {
+    info := aliasFormerMkInfo
+    kind_eq := by simp [aliasFormerMkInfo, InductConstantKind.Matches]
+    tr := aliasFormerMkInfo_tr
+    map_fresh := by
+      simpa [aliasFormerRawType] using aliasFormerMk_fresh
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem aliasFormer_addInduct :
+    AddInduct typeFamilyAliasMap typeFamilyAliasEnv
+      aliasFormerRawDecl aliasFormerMap aliasFormerFinalEnv :=
+  ⟨aliasFormerAddInductTraceWith aliasFormerGenerationChecked_wf⟩
+
+theorem aliasFormer_trEnv' :
+    TrEnv' .safe aliasFormerMap false aliasFormerFinalEnv :=
+  .induct aliasFormer_addInduct typeFamilyAlias_trEnv'
+
+theorem aliasFormer_final_matches_generation :
+    typeFamilyAliasEnv.addInductGeneration
+      aliasFormerGenerationChecked = some aliasFormerFinalEnv :=
+  aliasFormer_addInductGeneration
+
+theorem aliasFormer_env_wf : aliasFormerFinalEnv.WF :=
+  aliasFormer_trEnv'.wf
+
+theorem aliasFormer_aligned :
+    Aligned .safe aliasFormerMap aliasFormerFinalEnv :=
+  aliasFormer_trEnv'.aligned
+
+theorem aliasFormer_type_map_lookup :
+    aliasFormerMap.find? ``AliasFormer = some aliasFormerInfo := by
+  rw [aliasFormerMap, aliasFormerCtorMap_wf.find?_insert,
+    aliasFormerCtorMap, aliasFormerTypeMap_wf.find?_insert,
+    aliasFormerTypeMap, typeFamilyAliasMap_wf.find?_insert]
+  rfl
+
+theorem aliasFormer_type_lookup_unique :
+    aliasFormerInfo.name = ``AliasFormer ∧
+      TrConstant .safe aliasFormerFinalEnv aliasFormerInfo
+        aliasFormerRawType.toVConstant :=
+  aliasFormer_aligned.find?_uniq aliasFormer_type_map_lookup
+    aliasFormerFinalEnv_family_lookup
+
+theorem aliasFormer_mk_map_lookup :
+    aliasFormerMap.find? ``AliasFormer.mk = some aliasFormerMkInfo := by
+  rw [aliasFormerMap, aliasFormerCtorMap_wf.find?_insert,
+    aliasFormerCtorMap, aliasFormerTypeMap_wf.find?_insert]
+  rfl
+
+theorem aliasFormer_mk_lookup_unique :
+    aliasFormerMkInfo.name = ``AliasFormer.mk ∧
+      TrConstant .safe aliasFormerFinalEnv aliasFormerMkInfo
+        aliasFormerRawType.ctors[0].toVConstant :=
+  aliasFormer_aligned.find?_uniq aliasFormer_mk_map_lookup
+    (aliasFormerFinalEnv_ctor_lookup _ (.head _))
+
+theorem aliasFormer_rec_map_lookup :
+    aliasFormerMap.find? ``AliasFormer.rec = some aliasFormerRecInfo := by
+  rw [aliasFormerMap, aliasFormerCtorMap_wf.find?_insert]
+  rfl
+
+theorem aliasFormer_rec_lookup_unique :
+    aliasFormerRecInfo.name = ``AliasFormer.rec ∧
+      TrConstant .safe aliasFormerFinalEnv aliasFormerRecInfo
+        aliasFormerGenerationChecked.recursor :=
+  aliasFormer_aligned.find?_uniq aliasFormer_rec_map_lookup
+    aliasFormerFinalEnv_rec_lookup
+
+/-! ## AliasRec: non-identity recursive-field normalization -/
+
+def recAliasKernelDef : DefinitionVal := kernelDefVal% RecAlias
+
+def recAliasInfo : ConstantInfo := .defnInfo recAliasKernelDef
+
+def recAliasVal : VDefVal where
+  name := ``RecAlias
+  uvars := (vconst(type_of% @RecAlias) : VConstant).uvars
+  type := (vconst(type_of% @RecAlias) : VConstant).type
+  value := recAliasDefEq.rhs
+
+theorem recAliasInfo_tr :
+    TrDefVal .safe VEnv.empty recAliasInfo recAliasVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · have hshape : TrTypeExpr VEnv.empty recAliasInfo.levelParams []
+        recAliasInfo.type recAliasVal.type := by
+      tr_type_expr_tac
+    obtain ⟨u, htype⟩ := recAliasConstant_wf
+    exact hshape.to_trExprS .empty trivial ⟨.sort u, htype⟩
+  · refine .lam ?_ (.sort rfl) (.bvar rfl)
+    exact ⟨_, VEnv.HasType.sort (by decide)⟩
+
+theorem recAliasVal_wf : recAliasVal.WF VEnv.empty := by
+  exact VEnv.HasType.lam
+    (VEnv.HasType.sort (by decide))
+    (VEnv.HasType.bvar .zero)
+
+def recAliasMap : ConstMap :=
+  ({} : ConstMap).insert ``RecAlias recAliasInfo
+
+theorem recAliasMap_fresh :
+    ({} : ConstMap).find? ``RecAlias = none := by
+  simp [SMap.find?]
+
+theorem recAlias_trEnv' {safety : DefinitionSafety} :
+    TrEnv' safety recAliasMap false recAliasEnv :=
+  .defn (ci := recAliasKernelDef) (ci' := recAliasVal)
+    (recAliasInfo_tr.sf_mono DefinitionSafety.le_safe)
+    recAliasMap_fresh recAliasVal_wf rfl .empty
+
+def aliasRecInfo : ConstantInfo := kernelInductInfo% AliasRec
+def aliasRecMkInfo : ConstantInfo := kernelCtorInfo% AliasRec.mk
+def aliasRecRecInfo : ConstantInfo := kernelRecInfo% AliasRec.rec
+def aliasRecKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% AliasRec.rec 0
+
+example : aliasRecRawDecl.checked? = none := rfl
+example : aliasRecGenerationChecked.block.sourceType = aliasRecRawType := rfl
+example : aliasRecGenerationChecked.block.checked.type = aliasRecViewType := rfl
+example : aliasRecGenerationChecked.block.ctorPairs[0].rawFields 0 =
+    [aliasRecRawField] := rfl
+example : (VInductDecl.ctorFields
+    aliasRecGenerationChecked.minorTypes[0])[0]? =
+      some aliasRecRawField := rfl
+example : aliasRecKernelRuleRhs =
+    aliasRecGenerationChecked.generatedRules[0].rhs := rfl
+
+def aliasRecTypeEnv :=
+  (recAliasEnv.addConst aliasRecRawType.name
+    aliasRecRawType.toVConstant).get!
+
+def aliasRecCtorEnv :=
+  (aliasRecTypeEnv.addConst aliasRecRawType.ctors[0].name
+    aliasRecRawType.ctors[0].toVConstant).get!
+
+def aliasRecRecEnv :=
+  (aliasRecCtorEnv.addConst ``AliasRec.rec
+    aliasRecGenerationChecked.recursor).get!
+
+theorem aliasRecTypeEnv_ordered : aliasRecTypeEnv.Ordered := by
+  refine .const (n := aliasRecRawType.name)
+    (ci := aliasRecRawType.toVConstant)
+    recAliasEnv_ordered ?_ rfl
+  show recAliasEnv.IsType
+    aliasRecGenerationChecked.block.sourceType.uvars []
+    aliasRecGenerationChecked.block.sourceType.type
+  rw [aliasRecGenerationChecked.block.sourceType_uvars_eq]
+  exact aliasRecGenerationChecked_wf.rawFamily_isType
+
+theorem aliasRecRawCtor_wf :
+    aliasRecRawType.ctors[0].toVConstant.WF aliasRecTypeEnv := by
+  have hctor :
+      (⟨aliasRecRawType.ctors[0],
+        aliasRecViewChecked.constructors[0]⟩ :
+          VInductDecl.NormalizedCtor) ∈
+        aliasRecGenerationChecked.block.ctorPairs := by
+    exact .head _
+  show aliasRecTypeEnv.IsType aliasRecRawType.ctors[0].uvars []
+    aliasRecRawType.ctors[0].type
+  rw [aliasRecGenerationChecked.ctor_uvars_eq hctor]
+  exact aliasRecGenerationChecked_wf.rawCtor_isType rfl hctor
+
+theorem aliasRecCtorEnv_ordered : aliasRecCtorEnv.Ordered :=
+  .const (n := aliasRecRawType.ctors[0].name)
+    (ci := aliasRecRawType.ctors[0].toVConstant)
+    aliasRecTypeEnv_ordered aliasRecRawCtor_wf rfl
+
+theorem aliasRecGenerationEnv :
+    VInductDecl.GenerationEnv aliasRecGenerationChecked aliasRecCtorEnv := by
+  apply aliasRecGenerationChecked_wf.toGenerationEnv
+    (envT := aliasRecTypeEnv)
+  · rfl
+  · exact (VEnv.addConst_le (show
+      recAliasEnv.addConst aliasRecRawType.name
+        aliasRecRawType.toVConstant = some aliasRecTypeEnv from rfl)).trans
+      (VEnv.addConst_le (show
+        aliasRecTypeEnv.addConst aliasRecRawType.ctors[0].name
+          aliasRecRawType.ctors[0].toVConstant =
+            some aliasRecCtorEnv from rfl))
+  · exact VEnv.addConst_le (show
+      aliasRecTypeEnv.addConst aliasRecRawType.ctors[0].name
+        aliasRecRawType.ctors[0].toVConstant =
+          some aliasRecCtorEnv from rfl)
+  · exact aliasRecCtorEnv_ordered
+  · rfl
+  · intro ctor hctor
+    change ctor ∈
+      [⟨aliasRecRawType.ctors[0],
+        aliasRecViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    rfl
+
+theorem aliasRecInfo_tr :
+    TrConstVal .safe recAliasEnv aliasRecInfo
+      aliasRecRawType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr recAliasEnv aliasRecInfo.levelParams []
+      aliasRecInfo.type aliasRecRawType.type := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS recAliasEnv_ordered trivial
+    ⟨.sort (.succ (.succ .zero)), VEnv.HasType.sort (by decide)⟩
+
+theorem aliasRecMkInfo_tr :
+    TrConstVal .safe aliasRecTypeEnv aliasRecMkInfo
+      aliasRecRawType.ctors[0] := by
+  have hAlias : aliasRecTypeEnv.constants ``RecAlias =
+      some (vconst(type_of% @RecAlias)) := rfl
+  have hFamily : aliasRecTypeEnv.constants ``AliasRec =
+      some aliasRecRawType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr aliasRecTypeEnv
+      aliasRecMkInfo.levelParams [] aliasRecMkInfo.type
+      aliasRecRawType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := aliasRecRawCtor_wf
+  exact hshape.to_trExprS aliasRecTypeEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+theorem aliasRecRecInfo_tr :
+    TrConstVal .safe aliasRecCtorEnv aliasRecRecInfo
+      (inductGenerationRecVal aliasRecGenerationChecked) := by
+  have hAlias : aliasRecCtorEnv.constants ``RecAlias =
+      some (vconst(type_of% @RecAlias)) := rfl
+  have hFamily : aliasRecCtorEnv.constants ``AliasRec =
+      some aliasRecRawType.toVConstant := rfl
+  have hMk : aliasRecCtorEnv.constants ``AliasRec.mk =
+      some aliasRecRawType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr aliasRecCtorEnv
+      aliasRecRecInfo.levelParams [] aliasRecRecInfo.type
+      (inductGenerationRecVal aliasRecGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := aliasRecGenerationEnv.recursor_wf
+  exact hshape.to_trExprS aliasRecCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+def aliasRecTypeMap : ConstMap :=
+  recAliasMap.insert ``AliasRec aliasRecInfo
+
+def aliasRecCtorMap : ConstMap :=
+  aliasRecTypeMap.insert ``AliasRec.mk aliasRecMkInfo
+
+def aliasRecMap : ConstMap :=
+  aliasRecCtorMap.insert ``AliasRec.rec aliasRecRecInfo
+
+theorem recAliasMap_wf : recAliasMap.WF := (recAlias_trEnv' (safety := .safe)).map_wf
+
+theorem aliasRecType_fresh :
+    recAliasMap.find? ``AliasRec = none := by
+  rw [recAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem aliasRecTypeMap_wf : aliasRecTypeMap.WF :=
+  recAliasMap_wf.insert _ _ aliasRecType_fresh
+
+theorem aliasRecMk_fresh :
+    aliasRecTypeMap.find? ``AliasRec.mk = none := by
+  rw [aliasRecTypeMap, recAliasMap_wf.find?_insert, recAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem aliasRecCtorMap_wf : aliasRecCtorMap.WF :=
+  aliasRecTypeMap_wf.insert _ _ aliasRecMk_fresh
+
+theorem aliasRecRec_fresh :
+    aliasRecCtorMap.find? ``AliasRec.rec = none := by
+  rw [aliasRecCtorMap, aliasRecTypeMap_wf.find?_insert,
+    aliasRecTypeMap, recAliasMap_wf.find?_insert, recAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private def aliasRecAddInductTraceWith
+    (generation_wf : aliasRecGenerationChecked.WF recAliasEnv) :
+    AddInductTrace recAliasMap recAliasEnv aliasRecRawDecl
+      aliasRecMap aliasRecFinalEnv := by
+  refine {
+    generation := aliasRecGenerationChecked
+    generation_wf := generation_wf
+    typeMap := aliasRecTypeMap
+    typeEnv := aliasRecTypeEnv
+    ctorMap := aliasRecCtorMap
+    ctorEnv := aliasRecCtorEnv
+    recEnv := aliasRecRecEnv
+    addType := {
+      info := aliasRecInfo
+      kind_eq := by simp [aliasRecInfo, InductConstantKind.Matches]
+      tr := aliasRecInfo_tr
+      map_fresh := by
+        change recAliasMap.find? ``AliasRec = none
+        exact aliasRecType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := aliasRecRecInfo
+      kind_eq := by simp [aliasRecRecInfo, InductConstantKind.Matches]
+      tr := aliasRecRecInfo_tr
+      map_fresh := by
+        change aliasRecCtorMap.find? ``AliasRec.rec = none
+        exact aliasRecRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }
+  exact .cons {
+    info := aliasRecMkInfo
+    kind_eq := by simp [aliasRecMkInfo, InductConstantKind.Matches]
+    tr := aliasRecMkInfo_tr
+    map_fresh := by simpa [aliasRecRawType] using aliasRecMk_fresh
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem aliasRec_addInduct :
+    AddInduct recAliasMap recAliasEnv aliasRecRawDecl
+      aliasRecMap aliasRecFinalEnv :=
+  ⟨aliasRecAddInductTraceWith aliasRecGenerationChecked_wf⟩
+
+theorem aliasRec_trEnv' :
+    TrEnv' .safe aliasRecMap false aliasRecFinalEnv :=
+  .induct aliasRec_addInduct recAlias_trEnv'
+
+theorem aliasRec_final_matches_generation :
+    recAliasEnv.addInductGeneration aliasRecGenerationChecked =
+      some aliasRecFinalEnv :=
+  aliasRec_addInductGeneration
+
+theorem aliasRec_env_wf : aliasRecFinalEnv.WF :=
+  aliasRec_trEnv'.wf
+
+theorem aliasRec_aligned :
+    Aligned .safe aliasRecMap aliasRecFinalEnv :=
+  aliasRec_trEnv'.aligned
+
+theorem aliasRec_type_map_lookup :
+    aliasRecMap.find? ``AliasRec = some aliasRecInfo := by
+  rw [aliasRecMap, aliasRecCtorMap_wf.find?_insert,
+    aliasRecCtorMap, aliasRecTypeMap_wf.find?_insert,
+    aliasRecTypeMap, recAliasMap_wf.find?_insert]
+  rfl
+
+theorem aliasRec_type_lookup_unique :
+    aliasRecInfo.name = ``AliasRec ∧
+      TrConstant .safe aliasRecFinalEnv aliasRecInfo
+        aliasRecRawType.toVConstant :=
+  aliasRec_aligned.find?_uniq aliasRec_type_map_lookup
+    aliasRecFinalEnv_family_lookup
+
+theorem aliasRec_mk_map_lookup :
+    aliasRecMap.find? ``AliasRec.mk = some aliasRecMkInfo := by
+  rw [aliasRecMap, aliasRecCtorMap_wf.find?_insert,
+    aliasRecCtorMap, aliasRecTypeMap_wf.find?_insert]
+  rfl
+
+theorem aliasRec_mk_lookup_unique :
+    aliasRecMkInfo.name = ``AliasRec.mk ∧
+      TrConstant .safe aliasRecFinalEnv aliasRecMkInfo
+        aliasRecRawType.ctors[0].toVConstant :=
+  aliasRec_aligned.find?_uniq aliasRec_mk_map_lookup
+    (aliasRecFinalEnv_ctor_lookup _ (.head _))
+
+theorem aliasRec_rec_map_lookup :
+    aliasRecMap.find? ``AliasRec.rec = some aliasRecRecInfo := by
+  rw [aliasRecMap, aliasRecCtorMap_wf.find?_insert]
+  rfl
+
+theorem aliasRec_rec_lookup_unique :
+    aliasRecRecInfo.name = ``AliasRec.rec ∧
+      TrConstant .safe aliasRecFinalEnv aliasRecRecInfo
+        aliasRecGenerationChecked.recursor :=
+  aliasRec_aligned.find?_uniq aliasRec_rec_map_lookup
+    aliasRecFinalEnv_rec_lookup
+
+/-! ## Binder annotation candidate fixtures -/
+
+/- These four definitions are quoted from the running kernel rather than
+reconstructed. The resulting minimal environment is sufficient for the
+ordinary checker to delta-reduce every annotation gadget while leaving the
+shared `Nat` endpoint opaque. -/
+private def annotationOutParamInfo : ConstantInfo :=
+  .defnInfo (kernelDefVal% outParam)
+
+private def annotationSemiOutParamInfo : ConstantInfo :=
+  .defnInfo (kernelDefVal% semiOutParam)
+
+private def annotationOptParamInfo : ConstantInfo :=
+  .defnInfo (kernelDefVal% optParam)
+
+private def annotationAutoParamInfo : ConstantInfo :=
+  .defnInfo (kernelDefVal% autoParam)
+
+private def annotationKernelMap : ConstMap :=
+  ((({} : ConstMap).insert ``outParam annotationOutParamInfo).insert
+    ``semiOutParam annotationSemiOutParamInfo).insert
+      ``optParam annotationOptParamInfo |>.insert
+        ``autoParam annotationAutoParamInfo
+
+private def annotationKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_annotationCandidate annotationKernelMap
+
+private def annotationCandidateContext : AddInductive.Context where
+  env := annotationKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+private def annotationNatExpr : Expr := .const ``Nat []
+
+private def outParamDomain : Expr :=
+  .app (.const ``outParam [.succ .zero]) annotationNatExpr
+
+private def semiOutParamDomain : Expr :=
+  .app (.const ``semiOutParam [.succ .zero]) annotationNatExpr
+
+private def optParamDomain : Expr :=
+  .app (.app (.const ``optParam [.succ .zero]) annotationNatExpr)
+    (.lit (.natVal 0))
+
+private def autoParamDomain : Expr :=
+  .app (.app (.const ``autoParam [.succ .zero]) annotationNatExpr)
+    (.const ``Lean.Syntax.missing [])
+
+/- Each constructor is inhabited at its precise source and consumed indices;
+the guards below additionally ensure the executable structural mirror chooses
+that constructor. -/
+private def outParamTrace :
+    AddInductive.CandidateTypeAnnotationTrace
+      outParamDomain annotationNatExpr :=
+  .outParam [.succ .zero] annotationNatExpr (.identity _)
+
+private def semiOutParamTrace :
+    AddInductive.CandidateTypeAnnotationTrace
+      semiOutParamDomain annotationNatExpr :=
+  .semiOutParam [.succ .zero] annotationNatExpr (.identity _)
+
+private def optParamTrace :
+    AddInductive.CandidateTypeAnnotationTrace
+      optParamDomain annotationNatExpr :=
+  .optParam [.succ .zero] annotationNatExpr
+    (.lit (.natVal 0)) (.identity _)
+
+private def autoParamTrace :
+    AddInductive.CandidateTypeAnnotationTrace
+      autoParamDomain annotationNatExpr :=
+  .autoParam [.succ .zero] annotationNatExpr
+    (.const ``Lean.Syntax.missing []) (.identity _)
+
+private def annotationTraceTag :
+    AddInductive.CandidateTypeAnnotationTrace source consumed → Nat
+  | .identity _ => 0
+  | .outParam .. => 1
+  | .semiOutParam .. => 2
+  | .optParam .. => 3
+  | .autoParam .. => 4
+
+#guard let ⟨consumed, trace⟩ :=
+    AddInductive.CandidateTypeAnnotationTrace.build outParamDomain
+  consumed.equal annotationNatExpr && annotationTraceTag trace == 1
+
+#guard let ⟨consumed, trace⟩ :=
+    AddInductive.CandidateTypeAnnotationTrace.build semiOutParamDomain
+  consumed.equal annotationNatExpr && annotationTraceTag trace == 2
+
+#guard let ⟨consumed, trace⟩ :=
+    AddInductive.CandidateTypeAnnotationTrace.build optParamDomain
+  consumed.equal annotationNatExpr && annotationTraceTag trace == 3
+
+#guard let ⟨consumed, trace⟩ :=
+    AddInductive.CandidateTypeAnnotationTrace.build autoParamDomain
+  consumed.equal annotationNatExpr && annotationTraceTag trace == 4
+
+private def annotationCandidateAccepted (domain expected : Expr) : Bool :=
+  match AddInductive.buildCandidateTypeAnnotations domain with
+  | .error _ => false
+  | .ok annotations =>
+    annotations.consumed.equal expected &&
+      match AddInductive.observeCandidateIsDefEq annotationCandidateContext
+          domain annotations.consumed with
+      | .ok _ => true
+      | .error _ => false
+
+/- These guards cover the complete binder-annotation seam used by the
+candidate producer: the transparent structural implementation remains
+differentially equal to Lean's opaque helper, followed by an exact successful
+ordinary-checker equality observation. -/
+#guard AddInductive.candidateTypeAnnotationsAgree outParamDomain
+#guard AddInductive.candidateTypeAnnotationsAgree semiOutParamDomain
+#guard AddInductive.candidateTypeAnnotationsAgree optParamDomain
+#guard AddInductive.candidateTypeAnnotationsAgree autoParamDomain
+#guard annotationCandidateAccepted outParamDomain annotationNatExpr
+#guard annotationCandidateAccepted semiOutParamDomain annotationNatExpr
+#guard annotationCandidateAccepted optParamDomain annotationNatExpr
+#guard annotationCandidateAccepted autoParamDomain annotationNatExpr
+
+private def annotationIsDefEq (lhs rhs : Expr) :=
+  TypeChecker.M.run annotationCandidateContext.env
+    annotationCandidateContext.safety annotationCandidateContext.lctx
+    annotationCandidateContext.lparams annotationCandidateContext.fuel
+    (TypeChecker.isDefEq lhs rhs)
+
+/- A genuinely unequal domain is observed as `.ok false`, not a checker
+failure, and the candidate boundary rejects it with the dedicated error. -/
+#guard match annotationIsDefEq (.sort .zero) (.sort (.succ .zero)) with
+  | .ok false => true
+  | _ => false
+
+#guard match AddInductive.observeCandidateIsDefEq annotationCandidateContext
+    (.sort .zero) (.sort (.succ .zero)) with
+  | .error (.other message) =>
+    message == "normalization candidate changed a binder domain"
+  | _ => false
+
+/-! ## Annotated recursive-Pi candidate -/
+
+/-- Exact kernel definition and Theory value used to interpret `outParam`
+inside a complete recursive constructor candidate. -/
+private def outParamKernelDef : DefinitionVal :=
+  kernelDefVal% outParam
+
+private def outParamVal : VDefVal where
+  name := ``outParam
+  uvars := (vconst(type_of% @outParam) : VConstant).uvars
+  type := (vconst(type_of% @outParam) : VConstant).type
+  value := outParamDefEq.rhs
+
+private theorem outParamInfo_tr :
+    TrDefVal .safe VEnv.empty annotationOutParamInfo outParamVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · exact .forallE
+      ⟨_, VEnv.HasType.sort (by decide)⟩
+      ⟨_, VEnv.HasType.sort (by decide)⟩
+      (.sort rfl) (.sort rfl)
+  · exact .lam
+      ⟨_, VEnv.HasType.sort (by decide)⟩
+      (.sort rfl) (.bvar rfl)
+
+private theorem outParamVal_wf : outParamVal.WF VEnv.empty := by
+  exact VEnv.HasType.lam
+    (VEnv.HasType.sort (by decide))
+    (VEnv.HasType.bvar .zero)
+
+private def outParamMap : ConstMap :=
+  ({} : ConstMap).insert ``outParam annotationOutParamInfo
+
+private theorem outParamMap_fresh :
+    ({} : ConstMap).find? ``outParam = none := by
+  simp [SMap.find?]
+
+private theorem outParam_trEnv' {safety : DefinitionSafety} :
+    TrEnv' safety outParamMap false outParamEnv :=
+  .defn (ci := outParamKernelDef) (ci' := outParamVal)
+    (outParamInfo_tr.sf_mono DefinitionSafety.le_safe)
+    outParamMap_fresh outParamVal_wf rfl .empty
+
+private theorem outParamMap_wf : outParamMap.WF :=
+  (outParam_trEnv' (safety := .safe)).map_wf
+
+/-- Public map-well-formedness boundary for replay artifacts whose concrete
+dependency map is intentionally kept private to this fixture module. -/
+theorem annotatedReplayInputMap_wf : outParamMap.WF :=
+  outParamMap_wf
+
+private def outParamKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_annotatedPiCandidate outParamMap
+
+private theorem outParam_trEnv :
+    TrEnv .safe outParamKernelEnv outParamEnv := by
+  simpa [TrEnv, outParamKernelEnv, Kernel.Environment.ofConstants] using
+    outParam_trEnv'
+
+private theorem outParam_hasPrimitives :
+    VEnv.HasPrimitives outParamEnv := by
+  apply VEnv.HasPrimitives.of_avoids
+  intro n hn
+  simp only [VEnv.reflectedPrimitiveNames, List.mem_cons,
+    List.not_mem_nil, or_false] at hn
+  rcases hn with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl |
+      rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl |
+      rfl | rfl | rfl | rfl <;>
+    rfl
+
+private theorem outParam_safePrimitives :
+    outParamKernelEnv.find? n = some ci →
+      Kernel.Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [] := by
+  intro hfind hprim
+  change outParamMap.find?' n = some ci at hfind
+  rw [outParamMap_wf.find?'_eq_find?, outParamMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty] at hfind
+  simp [SMap.find?] at hfind
+  obtain ⟨rfl, rfl⟩ := hfind
+  simp [Kernel.Environment.primitives, NameSet.ofList] at hprim
+  simp +decide [NameSet.contains] at hprim
+
+private def outParamVEnvs : VEnvs where
+  venv _ := outParamEnv
+
+private theorem outParamVEnvs_wf : outParamVEnvs.WF outParamKernelEnv where
+  tr := by
+    intro safety
+    exact outParam_trEnv'
+  hasPrimitives := outParam_hasPrimitives
+  safePrimitives := outParam_safePrimitives
+  mono := fun _ => .rfl
+  projectionReady := ProjectionReady.of_no_ctorInfo <| by
+    intro name _info h
+    change outParamMap.find?' name = some (.ctorInfo _info) at h
+    rw [outParamMap_wf.find?'_eq_find?] at h
+    simp only [outParamMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    simp [SMap.find?, annotationOutParamInfo] at h
+  structureEtaReady := StructureEtaReady.of_no_ctorInfo <| by
+    intro name _info h
+    change outParamMap.find?' name = some (.ctorInfo _info) at h
+    rw [outParamMap_wf.find?'_eq_find?] at h
+    simp only [outParamMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    simp [SMap.find?, annotationOutParamInfo] at h
+
+/-! ## Definitionally equal constructor parameters -/
+
+def annotatedParamInfo : ConstantInfo := kernelInductInfo% AnnotatedParam
+def annotatedParamMkInfo : ConstantInfo := kernelCtorInfo% AnnotatedParam.mk
+def annotatedParamRecInfo : ConstantInfo := kernelRecInfo% AnnotatedParam.rec
+def annotatedParamKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% AnnotatedParam.rec 0
+
+example : annotatedParamKernelRuleRhs =
+    annotatedParamGenerationChecked.generatedRules[0].rhs := rfl
+
+private def annotatedParamKernelCtor : Constructor where
+  name := annotatedParamMkInfo.name
+  type := annotatedParamMkInfo.type
+
+private def annotatedParamKernelType : InductiveType where
+  name := annotatedParamInfo.name
+  type := annotatedParamInfo.type
+  ctors := [annotatedParamKernelCtor]
+
+private def annotatedParamCandidateContext : AddInductive.Context where
+  env := outParamKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+private def annotatedParamExpectedFamilyView : Expr :=
+  .forallE `alpha (.sort (.succ .zero))
+    (.sort (.succ .zero)) .default
+
+private def annotatedParamExpectedCtorView : Expr :=
+  .forallE `alpha (.sort (.succ .zero))
+    (.app (.const ``AnnotatedParam []) (.bvar 0)) .implicit
+
+/- The successful whole metadata pass reaches `checkConstructors`, compares
+the stored `outParam Type` constructor prefix with the checked `Type` family
+local by ordinary definitional equality, and retains the checked surface in
+both candidate views. -/
+#guard match AddInductive.buildNormalizationCandidate 1
+    [annotatedParamKernelType] 0 false annotatedParamCandidateContext with
+  | .ok candidate =>
+    candidate.families.singleton.familyType.type.view.equal
+        annotatedParamExpectedFamilyView &&
+      match candidate.families.singleton.constructors with
+      | .cons constructor .nil =>
+        constructor.type.view.equal annotatedParamExpectedCtorView
+  | .error _ => false
+
+/- Keep the constructor type closed and independently well typed while making
+its declared parameter domain genuinely different. The fixed result avoids a
+premature application-type failure, so rejection is specifically the same
+constructor-parameter check exercised by the positive. -/
+private def annotatedParamNonDefEqCtor : Constructor where
+  name := annotatedParamMkInfo.name
+  type := .forallE `alpha (.sort .zero)
+    (.app (.const ``AnnotatedParam []) (.sort .zero)) .implicit
+
+private def annotatedParamNonDefEqType : InductiveType :=
+  { annotatedParamKernelType with ctors := [annotatedParamNonDefEqCtor] }
+
+#guard match AddInductive.buildNormalizationCandidate 1
+    [annotatedParamNonDefEqType] 0 false annotatedParamCandidateContext with
+  | .error (.other message) =>
+    message ==
+      "arg #1 of 'Ix.Theory.Named.InductiveFixtures.AnnotatedParam.mk' does not match inductive datatype parameters"
+  | _ => false
+
+private theorem annotatedParamRawType_wf :
+    annotatedParamRawType.toVConstant.WF outParamEnv := by
+  refine ⟨.imax (.succ (.succ .zero)) (.succ (.succ .zero)), ?_⟩
+  change outParamEnv.HasType 0 []
+    (.forallE
+      (.app (.const ``outParam [.succ (.succ .zero)])
+        (.sort (.succ .zero)))
+      (.sort (.succ .zero)))
+    (.sort (.imax (.succ (.succ .zero)) (.succ (.succ .zero))))
+  apply VEnv.HasType.forallE
+  · apply VEnv.HasType.app
+      (A := .sort (.succ (.succ .zero)))
+      (B := .sort (.succ (.succ .zero)))
+    · simpa [VExpr.instL, VLevel.inst] using VEnv.HasType.const
+        (env := outParamEnv) (U := 0) (c := ``outParam)
+        (ci := vconst(type_of% @outParam))
+        (ls := [.succ (.succ .zero)]) rfl
+        (by simp; decide) rfl
+    · exact VEnv.HasType.sort (by decide)
+  · exact VEnv.HasType.sort (by decide)
+
+private theorem annotatedParamInfo_tr :
+    TrConstVal .safe outParamEnv annotatedParamInfo
+      annotatedParamRawType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr outParamEnv annotatedParamInfo.levelParams []
+      annotatedParamInfo.type annotatedParamRawType.type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := annotatedParamRawType_wf
+  exact hshape.to_trExprS outParamEnv_ordered trivial ⟨.sort u, htype⟩
+
+private def annotatedParamTypeEnv : VEnv :=
+  (outParamEnv.addConst annotatedParamRawType.name
+    annotatedParamRawType.toVConstant).get!
+
+private def annotatedParamTypeMap : ConstMap :=
+  outParamMap.insert ``AnnotatedParam annotatedParamInfo
+
+private theorem annotatedParamType_fresh :
+    outParamMap.find? ``AnnotatedParam = none := by
+  rw [outParamMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private theorem annotatedParamTypeMap_wf : annotatedParamTypeMap.WF :=
+  outParamMap_wf.insert _ _ annotatedParamType_fresh
+
+private def annotatedParamAddType :
+    AddInductConstant .induct outParamMap outParamEnv
+      annotatedParamRawType.toVConstVal annotatedParamTypeMap
+      annotatedParamTypeEnv where
+  info := annotatedParamInfo
+  kind_eq := by simp [annotatedParamInfo, InductConstantKind.Matches]
+  tr := annotatedParamInfo_tr
+  map_fresh := by simpa [annotatedParamRawType] using
+    annotatedParamType_fresh
+  env_add := rfl
+  map_add := rfl
+
+private def annotatedParamTypeKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_annotatedParamCandidate
+    annotatedParamTypeMap
+
+private theorem annotatedParamTypeEnv_ordered :
+    annotatedParamTypeEnv.Ordered :=
+  .const (n := annotatedParamRawType.name)
+    (ci := annotatedParamRawType.toVConstant)
+    outParamEnv_ordered annotatedParamRawType_wf rfl
+
+private def annotatedParamCtorCandidateContext : AddInductive.Context where
+  env := annotatedParamTypeKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+private theorem annotatedParamType_lookup_outParam :
+    annotatedParamTypeKernelEnv.find? ``outParam =
+      some annotationOutParamInfo := by
+  change annotatedParamTypeMap.find?' ``outParam =
+    some annotationOutParamInfo
+  rw [annotatedParamTypeMap_wf.find?'_eq_find?, annotatedParamTypeMap,
+    outParamMap_wf.find?_insert]
+  rw [outParamMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+private theorem annotatedParamType_lookup_family :
+    annotatedParamTypeKernelEnv.find? ``AnnotatedParam =
+      some annotatedParamInfo := by
+  change annotatedParamTypeMap.find?' ``AnnotatedParam =
+    some annotatedParamInfo
+  rw [annotatedParamTypeMap_wf.find?'_eq_find?, annotatedParamTypeMap,
+    outParamMap_wf.find?_insert]
+  rfl
+
+@[simp] private theorem annotatedParamType_get_outParam :
+    annotatedParamTypeKernelEnv.get ``outParam =
+      .ok annotationOutParamInfo := by
+  unfold Kernel.Environment.get
+  rw [annotatedParamType_lookup_outParam]
+  rfl
+
+@[simp] private theorem annotatedParamType_get_family :
+    annotatedParamTypeKernelEnv.get ``AnnotatedParam =
+      .ok annotatedParamInfo := by
+  unfold Kernel.Environment.get
+  rw [annotatedParamType_lookup_family]
+  rfl
+
+def annotatedPiInfo : ConstantInfo := kernelInductInfo% AnnotatedPi
+def annotatedPiMkInfo : ConstantInfo := kernelCtorInfo% AnnotatedPi.mk
+def annotatedPiRecInfo : ConstantInfo := kernelRecInfo% AnnotatedPi.rec
+def annotatedPiKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% AnnotatedPi.rec 0
+
+example : annotatedPiKernelRuleRhs =
+    annotatedPiGenerationChecked.generatedRules[0].rhs := rfl
+
+private def annotatedPiKernelCtor : Constructor where
+  name := annotatedPiMkInfo.name
+  type := annotatedPiMkInfo.type
+
+private def annotatedPiKernelType : InductiveType where
+  name := annotatedPiInfo.name
+  type := annotatedPiInfo.type
+  ctors := [annotatedPiKernelCtor]
+
+/- The whole-candidate negative keeps the actual AnnotatedPi family and
+constructor metadata, but gives the annotation symbol its correct type as an
+opaque constant. Ordinary metadata typing can therefore reach the recursive
+constructor candidate, while `outParam Prop` is no longer definitionally equal
+to the syntactically consumed `Prop`. -/
+private def annotatedPiOpaqueOutParamInfo : ConstantInfo :=
+  .axiomInfo {
+    name := ``outParam
+    levelParams := outParamKernelDef.levelParams
+    type := outParamKernelDef.type
+    isUnsafe := false }
+
+private def annotatedPiOpaqueOutParamMap : ConstMap :=
+  ({} : ConstMap).insert ``outParam annotatedPiOpaqueOutParamInfo
+
+private def annotatedPiOpaqueOutParamEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_annotatedPiOpaqueAnnotation
+    annotatedPiOpaqueOutParamMap
+
+private def annotatedPiOpaqueOutParamContext : AddInductive.Context where
+  env := annotatedPiOpaqueOutParamEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+/- This is a complete family/constructor candidate rejection, not the earlier
+leaf-level `isDefEq` test. The dedicated message proves failure occurs at the
+raw-to-consumed binder equality boundary before any semantic package or
+transaction can be assembled. -/
+#guard match AddInductive.buildNormalizationCandidate 0
+    [annotatedPiKernelType] 0 false annotatedPiOpaqueOutParamContext with
+  | .error (.other message) =>
+    message == "normalization candidate changed a binder domain"
+  | _ => false
+
+private theorem annotatedPiRawType_wf :
+    annotatedPiRawType.toVConstant.WF outParamEnv := by
+  exact ⟨_, VEnv.HasType.sort (by decide)⟩
+
+private theorem annotatedPiInfo_tr :
+    TrConstVal .safe outParamEnv annotatedPiInfo
+      annotatedPiRawType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr outParamEnv annotatedPiInfo.levelParams []
+      annotatedPiInfo.type annotatedPiRawType.type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := annotatedPiRawType_wf
+  exact hshape.to_trExprS outParamEnv_ordered trivial ⟨.sort u, htype⟩
+
+private def annotatedPiTypeEnv : VEnv :=
+  (outParamEnv.addConst annotatedPiRawType.name
+    annotatedPiRawType.toVConstant).get!
+
+private def annotatedPiTypeMap : ConstMap :=
+  outParamMap.insert ``AnnotatedPi annotatedPiInfo
+
+private theorem annotatedPiType_fresh :
+    outParamMap.find? ``AnnotatedPi = none := by
+  rw [outParamMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private theorem annotatedPiTypeMap_wf : annotatedPiTypeMap.WF :=
+  outParamMap_wf.insert _ _ annotatedPiType_fresh
+
+private def annotatedPiAddType :
+    AddInductConstant .induct outParamMap outParamEnv
+      annotatedPiRawType.toVConstVal annotatedPiTypeMap
+      annotatedPiTypeEnv where
+  info := annotatedPiInfo
+  kind_eq := by simp [annotatedPiInfo, InductConstantKind.Matches]
+  tr := annotatedPiInfo_tr
+  map_fresh := by simpa [annotatedPiRawType] using annotatedPiType_fresh
+  env_add := rfl
+  map_add := rfl
+
+private def annotatedPiTypeKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_annotatedPiCandidate annotatedPiTypeMap
+
+private theorem annotatedPiTypeEnv_ordered : annotatedPiTypeEnv.Ordered :=
+  .const (n := annotatedPiRawType.name)
+    (ci := annotatedPiRawType.toVConstant)
+    outParamEnv_ordered annotatedPiRawType_wf rfl
+
+private def annotatedPiFamilyCandidateContext : AddInductive.Context where
+  env := outParamKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+private def annotatedPiCtorCandidateContext : AddInductive.Context where
+  env := annotatedPiTypeKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+
+private theorem annotatedPiType_lookup_outParam :
+    annotatedPiTypeKernelEnv.find? ``outParam =
+      some annotationOutParamInfo := by
+  change annotatedPiTypeMap.find?' ``outParam =
+    some annotationOutParamInfo
+  rw [annotatedPiTypeMap_wf.find?'_eq_find?, annotatedPiTypeMap,
+    outParamMap_wf.find?_insert]
+  rw [outParamMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+private theorem annotatedPiType_lookup_family :
+    annotatedPiTypeKernelEnv.find? ``AnnotatedPi =
+      some annotatedPiInfo := by
+  change annotatedPiTypeMap.find?' ``AnnotatedPi = some annotatedPiInfo
+  rw [annotatedPiTypeMap_wf.find?'_eq_find?, annotatedPiTypeMap,
+    outParamMap_wf.find?_insert]
+  rfl
+
+@[simp] private theorem annotatedPiType_get_outParam :
+    annotatedPiTypeKernelEnv.get ``outParam =
+      .ok annotationOutParamInfo := by
+  unfold Kernel.Environment.get
+  rw [annotatedPiType_lookup_outParam]
+  rfl
+
+@[simp] private theorem annotatedPiType_get_family :
+    annotatedPiTypeKernelEnv.get ``AnnotatedPi =
+      .ok annotatedPiInfo := by
+  unfold Kernel.Environment.get
+  rw [annotatedPiType_lookup_family]
+  rfl
+
+@[simp] private theorem annotatedPi_checkLevelZero
+    (context : TypeChecker.Context) :
+    TypeChecker.Inner.checkLevel context .zero = .ok () := by
+  simp [TypeChecker.Inner.checkLevel, Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq, Level.hasParam']
+  rfl
+
+@[simp] private theorem annotatedPi_checkLevelSuccZero
+    (context : TypeChecker.Context) :
+    TypeChecker.Inner.checkLevel context (.succ .zero) = .ok () := by
+  simp [TypeChecker.Inner.checkLevel, Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq, Level.hasParam']
+  rfl
+
+open private mkLevelIMaxCore mkLevelMaxCore from Lean.Level in
+@[simp] private theorem annotatedPi_mkLevelIMaxSuccZero :
+    mkLevelIMax' (.succ .zero) (.succ .zero) = .succ .zero := by
+  simp [mkLevelIMax', mkLevelIMaxCore, mkLevelMax', mkLevelMaxCore]
+
+private theorem annotatedPiExceptPure
+    {α} (a : α) :
+    (pure a : Except Kernel.Exception α) = .ok a := rfl
+
+@[simp] private theorem annotatedPiInferConstantOutParam
+    (lctx : LocalContext) :
+    TypeChecker.Inner.inferConstant
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        ``outParam [.succ .zero] false =
+      .ok (.forallE `α (.sort (.succ .zero))
+        (.sort (.succ .zero)) .default) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [show annotatedPiTypeKernelEnv.get ``outParam =
+    .ok annotationOutParamInfo by exact annotatedPiType_get_outParam]
+  simp [annotationOutParamInfo, Bind.bind, Except.bind,
+    annotatedPiExceptPure,
+    ConstantInfo.levelParams, ConstantInfo.isUnsafe,
+    ConstantInfo.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Level.substParams']
+
+@[simp] private theorem annotatedPiInferConstantFamily
+    (lctx : LocalContext) :
+    TypeChecker.Inner.inferConstant
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        ``AnnotatedPi [] false =
+      .ok (.sort (.succ .zero)) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [show annotatedPiTypeKernelEnv.get ``AnnotatedPi =
+    .ok annotatedPiInfo by exact annotatedPiType_get_family]
+  rfl
+
+@[simp] private theorem annotatedPiInferConstantOutParamCandidate :
+    TypeChecker.Inner.inferConstant
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ``outParam [.succ .zero] false =
+      .ok (.forallE `α (.sort (.succ .zero))
+        (.sort (.succ .zero)) .default) := by
+  simp [annotatedPiCtorCandidateContext, AddInductive.Context.toTypeChecker]
+
+@[simp] private theorem annotatedPiEnsureForall
+    (name dom body bi source methods context state) :
+    TypeChecker.Inner.ensureForallCore (.forallE name dom body bi) source
+        methods context state =
+      .ok (.forallE name dom body bi, state) := by
+  unfold TypeChecker.Inner.ensureForallCore
+  rfl
+
+@[simp] private theorem annotatedPiEnsureSort
+    (u source methods context state) :
+    TypeChecker.Inner.ensureSortCore (.sort u) source methods context state =
+      .ok (.sort u, state) := by
+  unfold TypeChecker.Inner.ensureSortCore
+  rfl
+
+@[simp] private theorem annotatedPiForall_bindingDomain
+    (name dom body bi) :
+    (Expr.forallE name dom body bi).bindingDomain! = dom := rfl
+
+@[simp] private theorem annotatedPiForall_bindingBody
+    (name dom body bi) :
+    (Expr.forallE name dom body bi).bindingBody! = body := rfl
+
+@[simp] private theorem annotatedPiSort_instantiate1'
+    (u arg) :
+    (Expr.sort u).instantiate1' arg = .sort u := rfl
+
+@[simp] private theorem annotatedPiConst_beq_sort
+    (name levels u) :
+    ((.const name levels : Expr) == .sort u) = false := by
+  change Expr.eqv (.const name levels) (.sort u) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] private theorem annotatedPiSort_beq_const
+    (u name levels) :
+    ((.sort u : Expr) == .const name levels) = false := by
+  change Expr.eqv (.sort u) (.const name levels) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] private theorem annotatedPiApp_beq_const
+    (fn arg name levels) :
+    ((.app fn arg : Expr) == .const name levels) = false := by
+  change Expr.eqv (.app fn arg) (.const name levels) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] private theorem annotatedPiForall_beq_const
+    (binderName dom body bi name levels) :
+    ((.forallE binderName dom body bi : Expr) == .const name levels) =
+      false := by
+  change Expr.eqv (.forallE binderName dom body bi)
+    (.const name levels) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] private theorem annotatedPiOutParam_beq_family :
+    ((.const ``outParam [.succ .zero] : Expr) ==
+      .const ``AnnotatedPi []) = false := by
+  change Expr.eqv (.const ``outParam [.succ .zero])
+    (.const ``AnnotatedPi []) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+@[simp] private theorem annotatedPiFamilyCacheAfterForall
+    (cache : InferCache) (name : Name) (dom body result : Expr)
+    (bi : BinderInfo) :
+    (((cache.insert (.const ``AnnotatedPi []) (.sort (.succ .zero))).insert
+        (.forallE name dom body bi) result)[
+        (.const ``AnnotatedPi [] : Expr)]?) =
+      some (.sort (.succ .zero)) := by
+  rw [Std.HashMap.getElem?_insert,
+    annotatedPiForall_beq_const]
+  exact Std.HashMap.getElem?_insert_self
+
+private def annotatedPiOutParamFnType : Expr :=
+  .forallE `α (.sort (.succ .zero))
+    (.sort (.succ .zero)) .default
+
+@[simp] private theorem annotatedPiOutParamFnType_bindingDomain :
+    annotatedPiOutParamFnType.bindingDomain! =
+      .sort (.succ .zero) := rfl
+
+@[simp] private theorem annotatedPiOutParamFnType_instantiatedBody :
+    annotatedPiOutParamFnType.bindingBody!.instantiate1 (.sort .zero) =
+      .sort (.succ .zero) := by
+  simp [annotatedPiOutParamFnType, Expr.bindingBody!,
+    Expr.instantiate1_eq, Expr.instantiate1']
+
+@[simp] private theorem annotatedPiSort_notEagerReduce :
+    (Expr.sort .zero).isAppOfArity ``eagerReduce 2 = false := rfl
+
+private def annotatedPiOutParamFnState : TypeChecker.State :=
+  { ({} : TypeChecker.State) with
+    inferTypeC := ({} : TypeChecker.State).inferTypeC.insert
+      (.const ``outParam [.succ .zero]) annotatedPiOutParamFnType }
+
+private def annotatedPiOutParamArgState : TypeChecker.State :=
+  { annotatedPiOutParamFnState with
+    inferTypeC := annotatedPiOutParamFnState.inferTypeC.insert
+      (.sort .zero) (.sort (.succ .zero)) }
+
+private def annotatedPiWithSuccessCache
+    (state : TypeChecker.State) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.State :=
+  { state with success := m }
+
+private theorem annotatedPiIsDefEqSort
+    (fuel : Nat)
+    (context : TypeChecker.Context)
+    (initial : TypeChecker.State) :
+    TypeChecker.Inner.isDefEq
+        (.sort (.succ .zero)) (.sort (.succ .zero))
+        (TypeChecker.Methods.withFuel fuel) context initial =
+      .ok (true, initial) := by
+  unfold TypeChecker.Inner.isDefEq
+  rw [if_pos (Expr.eqv_refl _)]
+  rfl
+
+private def annotatedPiCtorExpectedView : Expr :=
+  match annotatedPiMkInfo.type with
+  | .forallE outerName (.forallE innerName _ innerBody innerInfo)
+      outerBody outerInfo =>
+    .forallE outerName
+      (.forallE innerName (.sort .zero) innerBody innerInfo)
+      outerBody outerInfo
+  | source => source
+
+private def annotatedPiOuterName : Name :=
+  .mkNum
+    (.mkStr
+      (.mkStr (.mkStr (.mkStr .anonymous "a") "_@") "_internal")
+      "_hyg")
+    0
+
+@[simp] private theorem annotatedPiFamilyType_noLooseBVars :
+    annotatedPiInfo.type.hasLooseBVars = false := by
+  rw [show annotatedPiInfo.type = .sort (.succ .zero) by rfl]
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange']
+
+@[simp] private theorem emptyCheckTypeCache_annotatedPiFamily :
+    (({} : TypeChecker.State).inferTypeC)[annotatedPiInfo.type]? = none := by
+  exact Std.HashMap.getElem?_empty
+
+@[simp] private theorem annotatedPiFamily_checkLevel :
+    TypeChecker.Inner.checkLevel
+      annotatedPiFamilyCandidateContext.toTypeChecker (.succ .zero) =
+      .ok () := by
+  simp [TypeChecker.Inner.checkLevel, Level.getUndefParam, Level.forEach, Level.hasParam_eq,
+    Level.hasParam']
+  rfl
+
+@[simp] private theorem annotatedPiRecMGet (methods context state) :
+    (get : TypeChecker.RecM TypeChecker.State) methods context state =
+      .ok (state, state) := rfl
+
+@[simp] private theorem annotatedPiRecMReadContext
+    (methods context state) :
+    (readThe TypeChecker.Context : TypeChecker.RecM TypeChecker.Context)
+        methods context state =
+      .ok (context, state) := rfl
+
+@[simp] private theorem annotatedPiRecMModify
+    (f : TypeChecker.State → TypeChecker.State)
+    (methods context state) :
+    (modify f : TypeChecker.RecM PUnit) methods context state =
+      .ok (.unit, f state) := rfl
+
+@[simp] private theorem annotatedPiRecMPure
+    {α} (a : α) (methods context state) :
+    (pure a : TypeChecker.RecM α) methods context state =
+      .ok (a, state) := rfl
+
+@[simp] private theorem annotatedPiRecMBind
+    {α β} (x : TypeChecker.RecM α)
+    (f : α → TypeChecker.RecM β) (methods context state) :
+    (x >>= f) methods context state =
+      match x methods context state with
+      | .error e => .error e
+      | .ok (a, state') => f a methods context state' := by
+  simp [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  cases h : x methods context state with
+  | error => rfl
+  | ok value => cases value; rfl
+
+@[simp] private theorem annotatedPiRecMLiftExceptOk
+    {α} (a : α) (methods context state) :
+    (liftM (.ok a : Except Kernel.Exception α) :
+        TypeChecker.RecM α) methods context state =
+      .ok (a, state) := rfl
+
+@[simp] private theorem annotatedPiGetNGen
+    (context : TypeChecker.Context) (state : TypeChecker.State) :
+    (getNGen : TypeChecker.M NameGenerator) context state =
+      .ok (state.ngen, state) := rfl
+
+@[simp] private theorem annotatedPiSetNGen
+    (ngen : NameGenerator) (context : TypeChecker.Context)
+    (state : TypeChecker.State) :
+    (setNGen ngen : TypeChecker.M PUnit) context state =
+      .ok (.unit, { state with ngen }) := rfl
+
+@[simp] private theorem annotatedPiMPure
+    {α} (a : α) (context : TypeChecker.Context)
+    (state : TypeChecker.State) :
+    (pure a : TypeChecker.M α) context state =
+      .ok (a, state) := rfl
+
+@[simp] private theorem annotatedPiRecMWithReader
+    {α} (f : LocalContext → LocalContext)
+    (x : TypeChecker.RecM α) (methods : TypeChecker.Methods)
+    (context : TypeChecker.Context) (state : TypeChecker.State) :
+    (MonadWithReaderOf.withReader (m := TypeChecker.RecM) f x)
+        methods context state =
+      x methods { context with lctx := f context.lctx } state := rfl
+
+private theorem annotatedPiWithLocalDecl
+    {α} (name : Name) (bi : BinderInfo) (ty : Expr)
+    (k : Expr → TypeChecker.RecM α)
+    (methods : TypeChecker.Methods) (context : TypeChecker.Context)
+    (state : TypeChecker.State) :
+    (withLocalDecl (m := TypeChecker.RecM) name bi ty k)
+        methods context state =
+      k (.fvar ⟨state.ngen.curr⟩) methods
+        { context with
+          lctx := context.lctx.mkLocalDecl
+            ⟨state.ngen.curr⟩ name ty bi }
+        { state with ngen := state.ngen.next } := rfl
+
+@[simp] private theorem annotatedPiInferTypeFuel
+    (n e inferOnly context state) :
+    TypeChecker.Inner.inferType e inferOnly
+        (TypeChecker.Methods.withFuel (n + 1)) context state =
+      TypeChecker.Inner.inferType' e inferOnly
+        (TypeChecker.Methods.withFuel n) context state := rfl
+
+@[simp] private theorem annotatedPiInferTypeFamilyCore
+    (n : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache :
+      state.inferTypeC[(.const ``AnnotatedPi [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType' (.const ``AnnotatedPi []) false
+        (TypeChecker.Methods.withFuel n)
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        state =
+      .ok (.sort (.succ .zero),
+        { state with
+          inferTypeC := state.inferTypeC.insert
+            (.const ``AnnotatedPi []) (.sort (.succ .zero)) }) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+@[simp] private theorem annotatedPiInferTypeFamily
+    (n : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache :
+      state.inferTypeC[(.const ``AnnotatedPi [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType (.const ``AnnotatedPi []) false
+        (TypeChecker.Methods.withFuel (n + 1))
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        state =
+      .ok (.sort (.succ .zero),
+        { state with
+          inferTypeC := state.inferTypeC.insert
+            (.const ``AnnotatedPi []) (.sort (.succ .zero)) }) :=
+  annotatedPiInferTypeFamilyCore n lctx state hcache
+
+@[simp] private theorem annotatedPiInferTypeFamilyCached
+    (n : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache :
+      state.inferTypeC[(.const ``AnnotatedPi [] : Expr)]? =
+        some (.sort (.succ .zero))) :
+    TypeChecker.Inner.inferType' (.const ``AnnotatedPi []) false
+        (TypeChecker.Methods.withFuel n)
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        state =
+      .ok (.sort (.succ .zero), state) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+@[simp] private theorem annotatedPiInferTypeFamilyAfterForall
+    (n : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (name : Name) (dom body result : Expr) (bi : BinderInfo) :
+    let state' : TypeChecker.State :=
+      { state with
+        inferTypeC :=
+          (state.inferTypeC.insert
+            (.const ``AnnotatedPi []) (.sort (.succ .zero))).insert
+            (.forallE name dom body bi) result }
+    TypeChecker.Inner.inferType' (.const ``AnnotatedPi []) false
+        (TypeChecker.Methods.withFuel n)
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        state' =
+      .ok (.sort (.succ .zero), state') := by
+  dsimp only
+  apply annotatedPiInferTypeFamilyCached
+  exact annotatedPiFamilyCacheAfterForall
+    state.inferTypeC name dom body result bi
+
+private def annotatedPiFamilyCheckTypeState : TypeChecker.State :=
+  { ({} : TypeChecker.State) with
+    inferTypeC := ({} : TypeChecker.State).inferTypeC.insert
+      (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) }
+
+private theorem annotatedPiFamily_checkTypeInner :
+    TypeChecker.Inner.inferType annotatedPiInfo.type false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiFamilyCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.succ .zero)),
+        annotatedPiFamilyCheckTypeState) := by
+  change
+    TypeChecker.Inner.inferType' (.sort (.succ .zero)) false
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiFamilyCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.succ .zero)),
+        annotatedPiFamilyCheckTypeState)
+  unfold TypeChecker.Inner.inferType'
+  simp [annotatedPiFamilyCheckTypeState, Expr.hasLooseBVars, Expr.looseBVarRange', Bind.bind,
+    ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem annotatedPiFamily_checkTypeM :
+    TypeChecker.M.run annotatedPiFamilyCandidateContext.env
+      annotatedPiFamilyCandidateContext.safety
+      annotatedPiFamilyCandidateContext.lctx
+      annotatedPiFamilyCandidateContext.lparams
+      annotatedPiFamilyCandidateContext.fuel
+      (TypeChecker.checkType annotatedPiInfo.type) =
+        .ok (.sort (.succ (.succ .zero))) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiInfo.type false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiFamilyCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ (.succ .zero)))
+  rw [annotatedPiFamily_checkTypeInner]
+  rfl
+
+private theorem annotatedPiFamily_whnfM :
+    TypeChecker.M.run annotatedPiFamilyCandidateContext.env
+      annotatedPiFamilyCandidateContext.safety
+      annotatedPiFamilyCandidateContext.lctx
+      annotatedPiFamilyCandidateContext.lparams
+      annotatedPiFamilyCandidateContext.fuel
+      (TypeChecker.whnf annotatedPiInfo.type) =
+        .ok annotatedPiInfo.type := by rfl
+
+private theorem annotatedPiCtor_checkTypeM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.checkType annotatedPiMkInfo.type) =
+        .ok (.sort (.succ .zero)) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiMkInfo.type false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  rw [show annotatedPiMkInfo.type =
+    .forallE annotatedPiOuterName
+      (.forallE `p
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        (.const ``AnnotatedPi []) .default)
+      (.const ``AnnotatedPi []) .default by rfl]
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType'
+        (.forallE annotatedPiOuterName
+          (.forallE `p
+            (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+            (.const ``AnnotatedPi []) .default)
+          (.const ``AnnotatedPi []) .default)
+        false (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', TypeChecker.Inner.inferType',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rw [annotatedPiIsDefEqSort 9997]
+  simp [Expr.instantiate1', annotatedPiWithLocalDecl, annotatedPiCtorCandidateContext,
+    AddInductive.Context.toTypeChecker, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [annotatedPiInferTypeFamilyCached (hcache := by
+    apply annotatedPiFamilyCacheAfterForall)]
+  simp [Expr.sortLevel!, annotatedPi_mkLevelIMaxSuccZero]
+  rfl
+
+private theorem annotatedPiCtor_whnfM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.whnf annotatedPiMkInfo.type) =
+        .ok annotatedPiMkInfo.type := by rfl
+
+/-! ## Checker-produced alias normalization certificates -/
+
+/-- Minimal kernel environment used to replay family-result WHNF without
+bringing unrelated constants or primitives into the certificate. -/
+private def aliasFormerNormalizationKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_aliasFormerNormalization
+    typeFamilyAliasMap
+
+private theorem aliasFormerNormalization_trEnv :
+    TrEnv .safe aliasFormerNormalizationKernelEnv typeFamilyAliasEnv := by
+  simpa [TrEnv, aliasFormerNormalizationKernelEnv,
+    Kernel.Environment.ofConstants] using
+    typeFamilyAlias_trEnv'
+
+private theorem aliasFormerNormalization_hasPrimitives :
+    VEnv.HasPrimitives typeFamilyAliasEnv := by
+  apply VEnv.HasPrimitives.of_avoids
+  intro n hn
+  simp only [VEnv.reflectedPrimitiveNames, List.mem_cons,
+    List.not_mem_nil, or_false] at hn
+  rcases hn with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl |
+      rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl |
+      rfl | rfl | rfl | rfl <;>
+    rfl
+
+private theorem aliasFormerNormalization_safePrimitives :
+    aliasFormerNormalizationKernelEnv.find? n = some ci →
+      Kernel.Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [] := by
+  intro hfind hprim
+  change typeFamilyAliasMap.find?' n = some ci at hfind
+  rw [typeFamilyAliasMap_wf.find?'_eq_find?,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty] at hfind
+  simp [SMap.find?] at hfind
+  obtain ⟨rfl, rfl⟩ := hfind
+  simp [Kernel.Environment.primitives, NameSet.ofList] at hprim
+  simp +decide [NameSet.contains] at hprim
+
+private def aliasFormerNormalizationVEnvs : VEnvs where
+  venv _ := typeFamilyAliasEnv
+
+private theorem aliasFormerNormalizationVEnvs_wf :
+    aliasFormerNormalizationVEnvs.WF
+      aliasFormerNormalizationKernelEnv where
+  tr := by
+    intro safety
+    change TrEnv' _ typeFamilyAliasMap false typeFamilyAliasEnv
+    exact typeFamilyAlias_trEnv'
+  hasPrimitives := aliasFormerNormalization_hasPrimitives
+  safePrimitives := aliasFormerNormalization_safePrimitives
+  mono := fun _ => .rfl
+  projectionReady := ProjectionReady.of_no_ctorInfo <| by
+    intro name _info h
+    change typeFamilyAliasMap.find?' name = some (.ctorInfo _info) at h
+    rw [typeFamilyAliasMap_wf.find?'_eq_find?] at h
+    simp only [typeFamilyAliasMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    simp [SMap.find?, typeFamilyAliasInfo] at h
+  structureEtaReady := StructureEtaReady.of_no_ctorInfo <| by
+    intro name _info h
+    change typeFamilyAliasMap.find?' name = some (.ctorInfo _info) at h
+    rw [typeFamilyAliasMap_wf.find?'_eq_find?] at h
+    simp only [typeFamilyAliasMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    simp [SMap.find?, typeFamilyAliasInfo] at h
+
+private def aliasFormerNormalizationContext : TypeChecker.VContext :=
+  TypeChecker.VContext.mk' aliasFormerNormalizationVEnvs_wf
+    (fuel := { whnf := 2 })
+
+private def aliasFormerNormalizationRawContext : TypeChecker.Context where
+  env := aliasFormerNormalizationKernelEnv
+  fuel := { whnf := 2 }
+
+private def aliasFormerCheckTypeState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    inferTypeC := state.inferTypeC.insert
+      (.const ``TypeFamilyAlias [])
+      (.sort (.succ (.succ .zero))) }
+
+/-- Insert the raw AliasFormer family before checking its constructor type. -/
+private def aliasFormerCtorNormalizationAddType :
+    AddInductConstant .induct typeFamilyAliasMap typeFamilyAliasEnv
+      aliasFormerRawType.toVConstVal aliasFormerTypeMap
+      aliasFormerTypeEnv where
+  info := aliasFormerInfo
+  kind_eq := by simp [aliasFormerInfo, InductConstantKind.Matches]
+  tr := aliasFormerInfo_tr
+  map_fresh := by simpa [aliasFormerRawType] using aliasFormerType_fresh
+  env_add := rfl
+  map_add := rfl
+
+private def aliasFormerCtorNormalizationKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_aliasFormerNormalization
+    aliasFormerTypeMap
+
+private def aliasFormerCtorNormalizationRawContext : TypeChecker.Context where
+  env := aliasFormerCtorNormalizationKernelEnv
+  fuel := { whnf := 2 }
+
+private def aliasFormerCtorCheckTypeState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    inferTypeC := state.inferTypeC.insert
+      (.const ``AliasFormer [])
+      (.const ``TypeFamilyAlias []) }
+
+/-- Insert only the raw `AliasRec` family into the replay environment. This is
+the exact staging at which constructor domains are normalized. -/
+private def aliasRecNormalizationAddType :
+    AddInductConstant .induct recAliasMap recAliasEnv
+      aliasRecRawType.toVConstVal aliasRecTypeMap aliasRecTypeEnv where
+  info := aliasRecInfo
+  kind_eq := by simp [aliasRecInfo, InductConstantKind.Matches]
+  tr := aliasRecInfo_tr
+  map_fresh := by simpa [aliasRecRawType] using aliasRecType_fresh
+  env_add := rfl
+  map_add := rfl
+
+private theorem aliasRecNormalization_trEnv' {safety : DefinitionSafety} :
+    TrEnv' safety aliasRecTypeMap false aliasRecTypeEnv :=
+  .inductStaging aliasRecNormalizationAddType
+    ⟨.succ (.succ .zero), VEnv.HasType.sort (by decide)⟩
+    recAlias_trEnv'
+
+private def aliasRecNormalizationKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_aliasRecNormalization aliasRecTypeMap
+
+private theorem aliasRecNormalization_trEnv :
+    TrEnv .safe aliasRecNormalizationKernelEnv aliasRecTypeEnv := by
+  simpa [TrEnv, aliasRecNormalizationKernelEnv,
+    Kernel.Environment.ofConstants] using
+    aliasRecNormalization_trEnv'
+
+private theorem aliasRecNormalization_hasPrimitives :
+    VEnv.HasPrimitives aliasRecTypeEnv := by
+  apply VEnv.HasPrimitives.of_avoids
+  intro n hn
+  simp only [VEnv.reflectedPrimitiveNames, List.mem_cons,
+    List.not_mem_nil, or_false] at hn
+  rcases hn with rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl |
+      rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl | rfl |
+      rfl | rfl | rfl | rfl <;>
+    rfl
+
+private theorem aliasRecNormalization_safePrimitives :
+    aliasRecNormalizationKernelEnv.find? n = some ci →
+      Kernel.Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [] := by
+  intro hfind hprim
+  change aliasRecTypeMap.find?' n = some ci at hfind
+  rw [aliasRecTypeMap_wf.find?'_eq_find?,
+    aliasRecTypeMap, recAliasMap_wf.find?_insert] at hfind
+  split at hfind
+  · rename_i heq
+    simp at heq
+    subst n
+    simp [Kernel.Environment.primitives, NameSet.ofList] at hprim
+    simp +decide [NameSet.contains] at hprim
+  · rw [recAliasMap,
+      SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty] at hfind
+    simp [SMap.find?] at hfind
+    obtain ⟨rfl, rfl⟩ := hfind
+    simp [Kernel.Environment.primitives, NameSet.ofList] at hprim
+    simp +decide [NameSet.contains] at hprim
+
+private def aliasRecNormalizationVEnvs : VEnvs where
+  venv _ := aliasRecTypeEnv
+
+private theorem aliasRecNormalizationVEnvs_wf :
+    aliasRecNormalizationVEnvs.WF aliasRecNormalizationKernelEnv where
+  tr := by
+    intro safety
+    change TrEnv' _ aliasRecTypeMap false aliasRecTypeEnv
+    exact aliasRecNormalization_trEnv'
+  hasPrimitives := aliasRecNormalization_hasPrimitives
+  safePrimitives := aliasRecNormalization_safePrimitives
+  mono := fun _ => .rfl
+  projectionReady := ProjectionReady.of_no_ctorInfo <| by
+    intro name _info h
+    change aliasRecTypeMap.find?' name = some (.ctorInfo _info) at h
+    rw [aliasRecTypeMap_wf.find?'_eq_find?] at h
+    simp only [aliasRecTypeMap, recAliasMap_wf.find?_insert] at h
+    simp only [recAliasMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    by_cases hAliasRec : ``AliasRec = name <;>
+      by_cases hRecAlias : ``RecAlias = name <;>
+      simp +decide [hAliasRec, hRecAlias, SMap.find?, aliasRecInfo,
+        recAliasInfo] at h
+  structureEtaReady := StructureEtaReady.of_no_ctorInfo <| by
+    intro name _info h
+    change aliasRecTypeMap.find?' name = some (.ctorInfo _info) at h
+    rw [aliasRecTypeMap_wf.find?'_eq_find?] at h
+    simp only [aliasRecTypeMap, recAliasMap_wf.find?_insert] at h
+    simp only [recAliasMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    by_cases hAliasRec : ``AliasRec = name <;>
+      by_cases hRecAlias : ``RecAlias = name <;>
+      simp +decide [hAliasRec, hRecAlias, SMap.find?, aliasRecInfo,
+        recAliasInfo] at h
+
+private def aliasRecNormalizationContext : TypeChecker.VContext :=
+  TypeChecker.VContext.mk' aliasRecNormalizationVEnvs_wf
+    (fuel := { whnf := 2 })
+
+private def aliasRecNormalizationRawContext : TypeChecker.Context where
+  env := aliasRecNormalizationKernelEnv
+  fuel := { whnf := 2 }
+
+private def aliasFormerCandidateContext : AddInductive.Context where
+  env := aliasFormerNormalizationKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+  fuel := { whnf := 2 }
+
+private def aliasFormerCtorCandidateContext : AddInductive.Context where
+  env := aliasFormerCtorNormalizationKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+  fuel := { whnf := 2 }
+
+/-- Exact kernel request indexed by the singleton normalization candidate. -/
+private def aliasFormerKernelCtor : Constructor where
+  name := aliasFormerMkInfo.name
+  type := aliasFormerMkInfo.type
+
+private def aliasFormerKernelType : InductiveType where
+  name := aliasFormerInfo.name
+  type := aliasFormerInfo.type
+  ctors := [aliasFormerKernelCtor]
+
+private theorem aliasFormerNormalization_lookup :
+    aliasFormerNormalizationKernelEnv.find? ``TypeFamilyAlias =
+      some typeFamilyAliasInfo := by
+  change typeFamilyAliasMap.find?' ``TypeFamilyAlias =
+    some typeFamilyAliasInfo
+  rw [typeFamilyAliasMap_wf.find?'_eq_find?, typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+private theorem aliasFormerCtorNormalization_lookup :
+    aliasFormerCtorNormalizationKernelEnv.find? ``AliasFormer =
+      some aliasFormerInfo := by
+  change aliasFormerTypeMap.find?' ``AliasFormer = some aliasFormerInfo
+  rw [aliasFormerTypeMap_wf.find?'_eq_find?, aliasFormerTypeMap,
+    typeFamilyAliasMap_wf.find?_insert]
+  rfl
+
+private theorem aliasRecNormalization_lookup :
+    aliasRecNormalizationKernelEnv.find? ``RecAlias =
+      some recAliasInfo := by
+  change aliasRecTypeMap.find?' ``RecAlias = some recAliasInfo
+  rw [aliasRecTypeMap_wf.find?'_eq_find?, aliasRecTypeMap,
+    recAliasMap_wf.find?_insert, recAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  rfl
+
+private theorem aliasRecNormalization_family_lookup :
+    aliasRecNormalizationKernelEnv.find? ``AliasRec =
+      some aliasRecInfo := by
+  change aliasRecTypeMap.find?' ``AliasRec = some aliasRecInfo
+  rw [aliasRecTypeMap_wf.find?'_eq_find?, aliasRecTypeMap,
+    recAliasMap_wf.find?_insert]
+  rfl
+
+private def recAliasWhnfKernelExpr : Expr :=
+  recAliasInfo.instantiateValueLevelParams! [.succ .zero]
+
+private def aliasRecFieldKernelExpr : Expr :=
+  aliasRecMkInfo.type.bindingDomain!
+
+private theorem aliasRecFieldKernelExpr_eq :
+    aliasRecFieldKernelExpr =
+      .app (.const ``RecAlias [.succ .zero])
+        (.const ``AliasRec []) := rfl
+
+private theorem recAliasWhnfKernelExpr_eq :
+    recAliasWhnfKernelExpr =
+      .lam `α (.sort (.succ .zero)) (.bvar 0) .default := by
+  simp [recAliasWhnfKernelExpr, recAliasInfo,
+    recAliasKernelDef, ConstantInfo.instantiateValueLevelParams!,
+    ConstantInfo.levelParams, ConstantInfo.value!,
+    ConstantInfo.toConstantVal,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Level.substParams']
+
+private def recAliasUnfoldState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    unfold := state.unfold.insert
+      (.const ``RecAlias [.succ .zero])
+      recAliasWhnfKernelExpr }
+
+/- The following small operational equations expose only the transformer
+plumbing needed to kernel-reduce the two concrete WHNF traces. -/
+
+@[simp] private theorem normalizationRecMGet (methods context state) :
+    (get : TypeChecker.RecM TypeChecker.State) methods context state =
+      .ok (state, state) := rfl
+
+@[simp] private theorem normalizationRecMReadContext
+    (methods context state) :
+    (readThe TypeChecker.Context : TypeChecker.RecM TypeChecker.Context)
+        methods context state =
+      .ok (context, state) := rfl
+
+@[simp] private theorem normalizationRecMModify
+    (f : TypeChecker.State → TypeChecker.State)
+    (methods context state) :
+    (modify f : TypeChecker.RecM PUnit) methods context state =
+      .ok (.unit, f state) := rfl
+
+@[simp] private theorem normalizationRecMPure
+    {α} (a : α) (methods context state) :
+    (pure a : TypeChecker.RecM α) methods context state =
+      .ok (a, state) := rfl
+
+@[simp] private theorem normalizationRecMBind
+    {α β} (x : TypeChecker.RecM α)
+    (f : α → TypeChecker.RecM β) (methods context state) :
+    (x >>= f) methods context state =
+      match x methods context state with
+      | .error e => .error e
+      | .ok (a, state') => f a methods context state' := by
+  simp [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  cases h : x methods context state with
+  | error => rfl
+  | ok value => cases value; rfl
+
+@[simp] private theorem normalizationRecMGetEnv
+    (methods context state) :
+    (liftM TypeChecker.getEnv :
+        TypeChecker.RecM Kernel.Environment) methods context state =
+      .ok (context.env, state) := rfl
+
+@[simp] private theorem normalizationRecMLiftExceptOk
+    {α} (a : α) (methods context state) :
+    (liftM (.ok a : Except Kernel.Exception α) :
+        TypeChecker.RecM α) methods context state =
+      .ok (a, state) := rfl
+
+private theorem normalizationExceptPure
+    {α} (a : α) :
+    (pure a : Except Kernel.Exception α) = .ok a := rfl
+
+@[simp] private theorem typeFamilyAlias_noLooseBVars :
+    (Expr.const ``TypeFamilyAlias []).hasLooseBVars = false := by
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange']
+
+@[simp] private theorem aliasFormer_noLooseBVars :
+    (Expr.const ``AliasFormer []).hasLooseBVars = false := by
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange']
+
+@[simp] private theorem recAlias_noLooseBVars :
+    (Expr.const ``RecAlias [.succ .zero]).hasLooseBVars = false := by
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange']
+
+@[simp] private theorem aliasRec_noLooseBVars :
+    (Expr.const ``AliasRec []).hasLooseBVars = false := by
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange']
+
+@[simp] private theorem aliasRecField_noLooseBVars :
+    (Expr.app
+      (.const ``RecAlias [.succ .zero])
+      (.const ``AliasRec [])).hasLooseBVars = false := by
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange']
+
+@[simp] private theorem emptyCheckTypeCache_typeFamilyAlias :
+    (({} : TypeChecker.State).inferTypeC)[
+      Expr.const ``TypeFamilyAlias []]? = none := by
+  exact Std.HashMap.getElem?_empty
+
+@[simp] private theorem emptyCheckTypeCache_aliasFormer :
+    (({} : TypeChecker.State).inferTypeC)[
+      Expr.const ``AliasFormer []]? = none := by
+  exact Std.HashMap.getElem?_empty
+
+@[simp] private theorem emptyCheckTypeCache_recAlias :
+    (({} : TypeChecker.State).inferTypeC)[
+      Expr.const ``RecAlias [.succ .zero]]? = none := by
+  exact Std.HashMap.getElem?_empty
+
+@[simp] private theorem emptyCheckTypeCache_aliasRecField :
+    (({} : TypeChecker.State).inferTypeC)[
+      Expr.app
+        (.const ``RecAlias [.succ .zero])
+        (.const ``AliasRec [])]? = none := by
+  exact Std.HashMap.getElem?_empty
+
+@[simp] private theorem aliasFormerNormalization_get :
+    aliasFormerNormalizationRawContext.env.get ``TypeFamilyAlias =
+      .ok typeFamilyAliasInfo := by
+  unfold Kernel.Environment.get
+  change
+    (match aliasFormerNormalizationKernelEnv.find? ``TypeFamilyAlias with
+    | some ci => pure ci
+    | none => throw <| Kernel.Exception.unknownConstant
+        aliasFormerNormalizationKernelEnv ``TypeFamilyAlias) =
+      Except.ok typeFamilyAliasInfo
+  rw [aliasFormerNormalization_lookup]
+  rfl
+
+@[simp] private theorem inferConstantTypeFamilyAlias :
+    TypeChecker.Inner.inferConstant aliasFormerNormalizationRawContext
+        ``TypeFamilyAlias [] false =
+      .ok (.sort (.succ (.succ .zero))) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [aliasFormerNormalization_get]
+  rfl
+
+@[simp] private theorem aliasFormerCtorNormalization_get :
+    aliasFormerCtorNormalizationRawContext.env.get ``AliasFormer =
+      .ok aliasFormerInfo := by
+  unfold Kernel.Environment.get
+  change
+    (match aliasFormerCtorNormalizationKernelEnv.find? ``AliasFormer with
+    | some ci => pure ci
+    | none => throw <| Kernel.Exception.unknownConstant
+        aliasFormerCtorNormalizationKernelEnv ``AliasFormer) =
+      Except.ok aliasFormerInfo
+  rw [aliasFormerCtorNormalization_lookup]
+  rfl
+
+@[simp] private theorem inferConstantAliasFormer :
+    TypeChecker.Inner.inferConstant aliasFormerCtorNormalizationRawContext
+        ``AliasFormer [] false =
+      .ok (.const ``TypeFamilyAlias []) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [aliasFormerCtorNormalization_get]
+  rfl
+
+private theorem checkTypeTypeFamilyAlias :
+    TypeChecker.Inner.inferType (.const ``TypeFamilyAlias []) false
+        (TypeChecker.Methods.withFuel 9999)
+        aliasFormerNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.succ .zero)),
+        aliasFormerCheckTypeState {}) := by
+  change TypeChecker.Inner.inferType'
+      (.const ``TypeFamilyAlias []) false
+      (TypeChecker.Methods.withFuel 9998)
+      aliasFormerNormalizationRawContext ({} : TypeChecker.State) =
+    .ok (.sort (.succ (.succ .zero)),
+      aliasFormerCheckTypeState {})
+  unfold TypeChecker.Inner.inferType'
+  simp [aliasFormerCheckTypeState,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem checkTypeTypeFamilyAliasCandidate :
+    TypeChecker.Inner.inferType (.const ``TypeFamilyAlias []) false
+        (TypeChecker.Methods.withFuel 10000)
+        aliasFormerNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (.sort (.succ (.succ .zero)),
+        aliasFormerCheckTypeState {}) := by
+  change TypeChecker.Inner.inferType'
+      (.const ``TypeFamilyAlias []) false
+      (TypeChecker.Methods.withFuel 9999)
+      aliasFormerNormalizationRawContext ({} : TypeChecker.State) =
+    .ok (.sort (.succ (.succ .zero)),
+      aliasFormerCheckTypeState {})
+  unfold TypeChecker.Inner.inferType'
+  simp [aliasFormerCheckTypeState,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem checkTypeAliasFormer :
+    TypeChecker.Inner.inferType (.const ``AliasFormer []) false
+        (TypeChecker.Methods.withFuel 9999)
+        aliasFormerCtorNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (.const ``TypeFamilyAlias [],
+        aliasFormerCtorCheckTypeState {}) := by
+  change TypeChecker.Inner.inferType'
+      (.const ``AliasFormer []) false
+      (TypeChecker.Methods.withFuel 9998)
+      aliasFormerCtorNormalizationRawContext ({} : TypeChecker.State) =
+    .ok (.const ``TypeFamilyAlias [],
+      aliasFormerCtorCheckTypeState {})
+  unfold TypeChecker.Inner.inferType'
+  simp [aliasFormerCtorCheckTypeState,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem checkTypeAliasFormerCandidate :
+    TypeChecker.Inner.inferType (.const ``AliasFormer []) false
+        (TypeChecker.Methods.withFuel 10000)
+        aliasFormerCtorNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (.const ``TypeFamilyAlias [],
+        aliasFormerCtorCheckTypeState {}) := by
+  change TypeChecker.Inner.inferType'
+      (.const ``AliasFormer []) false
+      (TypeChecker.Methods.withFuel 9999)
+      aliasFormerCtorNormalizationRawContext ({} : TypeChecker.State) =
+    .ok (.const ``TypeFamilyAlias [],
+      aliasFormerCtorCheckTypeState {})
+  unfold TypeChecker.Inner.inferType'
+  simp [aliasFormerCtorCheckTypeState,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+@[simp] private theorem aliasRecNormalization_getRecAlias :
+    aliasRecNormalizationRawContext.env.get ``RecAlias =
+      .ok recAliasInfo := by
+  unfold Kernel.Environment.get
+  change
+    (match aliasRecNormalizationKernelEnv.find? ``RecAlias with
+    | some ci => pure ci
+    | none => throw <| Kernel.Exception.unknownConstant
+        aliasRecNormalizationKernelEnv ``RecAlias) =
+      Except.ok recAliasInfo
+  rw [aliasRecNormalization_lookup]
+  rfl
+
+@[simp] private theorem aliasRecNormalization_getFamily :
+    aliasRecNormalizationRawContext.env.get ``AliasRec =
+      .ok aliasRecInfo := by
+  unfold Kernel.Environment.get
+  change
+    (match aliasRecNormalizationKernelEnv.find? ``AliasRec with
+    | some ci => pure ci
+    | none => throw <| Kernel.Exception.unknownConstant
+        aliasRecNormalizationKernelEnv ``AliasRec) =
+      Except.ok aliasRecInfo
+  rw [aliasRecNormalization_family_lookup]
+  rfl
+
+@[simp] private theorem aliasRecNormalization_checkLevelSuccZero :
+    TypeChecker.Inner.checkLevel aliasRecNormalizationRawContext
+      (.succ .zero) = .ok () := by
+  simp [TypeChecker.Inner.checkLevel, Level.getUndefParam, Level.forEach,
+    Level.hasParam_eq,
+    Level.hasParam', normalizationExceptPure]
+
+@[simp] private theorem recAliasInfo_isUnsafe :
+    recAliasInfo.isUnsafe = false := rfl
+
+@[simp] private theorem aliasRecNormalization_safety :
+    aliasRecNormalizationRawContext.safety = .safe := rfl
+
+@[simp] private theorem recAliasInfo_instantiateType :
+    recAliasInfo.instantiateTypeLevelParams [.succ .zero] =
+      .forallE `α (.sort (.succ .zero))
+        (.sort (.succ .zero)) .default := by
+  simp [recAliasInfo, recAliasKernelDef,
+    ConstantInfo.instantiateTypeLevelParams,
+    ConstantVal.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Level.substParams']
+
+@[simp] private theorem inferConstantRecAlias :
+    TypeChecker.Inner.inferConstant aliasRecNormalizationRawContext
+        ``RecAlias [.succ .zero] false =
+      .ok (.forallE `α (.sort (.succ .zero))
+        (.sort (.succ .zero)) .default) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [aliasRecNormalization_getRecAlias]
+  simp [recAliasInfo, recAliasKernelDef, Bind.bind, Except.bind, normalizationExceptPure,
+    ConstantInfo.levelParams, ConstantInfo.isUnsafe, ConstantInfo.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal, ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore', Level.substParams']
+
+@[simp] private theorem inferConstantAliasRec :
+    TypeChecker.Inner.inferConstant aliasRecNormalizationRawContext
+        ``AliasRec [] false =
+      .ok (.sort (.succ .zero)) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [aliasRecNormalization_getFamily]
+  rfl
+
+@[simp] private theorem normalizationWhnfCoreConst
+    (methods context state n ls) :
+    (TypeChecker.Inner.whnfCore' (.const n ls)
+        (cheapProj := false))
+        methods context state =
+      .ok (.const n ls, state) := rfl
+
+@[simp] private theorem normalizationWhnfCoreSort
+    (methods context state u) :
+    (TypeChecker.Inner.whnfCore' (.sort u)
+        (cheapProj := false))
+        methods context state =
+      .ok (.sort u, state) := rfl
+
+@[simp] private theorem normalizationWhnfCoreLam
+    (methods context state name ty body bi) :
+    (TypeChecker.Inner.whnfCore' (.lam name ty body bi)
+        (cheapProj := false))
+        methods context state =
+      .ok (.lam name ty body bi, state) := rfl
+
+@[simp] private theorem normalizationReduceNativeConst
+    (env methods context state n ls) :
+    (liftM (TypeChecker.Inner.reduceNative env (.const n ls)) :
+        TypeChecker.RecM (Option Expr)) methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationReduceNativeSort
+    (env methods context state u) :
+    (liftM (TypeChecker.Inner.reduceNative env (.sort u)) :
+        TypeChecker.RecM (Option Expr)) methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationReduceNativeLam
+    (env methods context state name ty body bi) :
+    (liftM (TypeChecker.Inner.reduceNative env (.lam name ty body bi)) :
+        TypeChecker.RecM (Option Expr)) methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationReduceNatConst
+    (methods context state n ls) :
+    TypeChecker.Inner.reduceNat (.const n ls) methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationReduceNatSort
+    (methods context state u) :
+    TypeChecker.Inner.reduceNat (.sort u) methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationReduceNatLam
+    (methods context state name ty body bi) :
+    TypeChecker.Inner.reduceNat (.lam name ty body bi)
+        methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationUnfoldSort
+    (methods context state u) :
+    TypeChecker.Inner.unfoldDefinition (.sort u) methods context state =
+      .ok (none, state) := rfl
+
+@[simp] private theorem normalizationUnfoldLam
+    (methods context state name ty body bi) :
+    TypeChecker.Inner.unfoldDefinition (.lam name ty body bi)
+        methods context state =
+      .ok (none, state) := rfl
+
+private theorem unfoldTypeFamilyAlias (methods state) :
+    TypeChecker.Inner.unfoldDefinition (.const ``TypeFamilyAlias [])
+        methods aliasFormerNormalizationRawContext state =
+      .ok (some (.sort (.succ .zero)), state) := by
+  change
+    TypeChecker.Inner.unfoldDefinitionCore (.const ``TypeFamilyAlias [])
+        methods aliasFormerNormalizationRawContext state =
+      .ok (some (.sort (.succ .zero)), state)
+  simp [TypeChecker.Inner.unfoldDefinitionCore, TypeChecker.Inner.isDelta, Expr.getAppFn,
+    aliasFormerNormalizationRawContext, aliasFormerNormalization_lookup, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind, typeFamilyAliasInfo, typeFamilyAliasKernelDef,
+    ConstantInfo.deltaValue?, TypeChecker.Inner.instantiateDeltaValue, ConstantInfo.numLevelParams,
+    ConstantInfo.levelParams, ConstantInfo.toConstantVal, Expr.instantiateLevelParams]
+
+private theorem unfoldAliasFormer (methods state) :
+    TypeChecker.Inner.unfoldDefinition (.const ``AliasFormer [])
+        methods aliasFormerCtorNormalizationRawContext state =
+      .ok (none, state) := by
+  change
+    TypeChecker.Inner.unfoldDefinitionCore (.const ``AliasFormer [])
+        methods aliasFormerCtorNormalizationRawContext state =
+      .ok (none, state)
+  simp [TypeChecker.Inner.unfoldDefinitionCore, TypeChecker.Inner.isDelta,
+    Expr.getAppFn, aliasFormerCtorNormalizationRawContext,
+    aliasFormerCtorNormalization_lookup, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind, aliasFormerInfo,
+    ConstantInfo.deltaValue?]
+
+private theorem unfoldRecAliasInitial (methods) :
+    TypeChecker.Inner.unfoldDefinition
+        (.const ``RecAlias [.succ .zero])
+        methods aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (some recAliasWhnfKernelExpr, recAliasUnfoldState {}) := by
+  change
+    TypeChecker.Inner.unfoldDefinitionCore
+        (.const ``RecAlias [.succ .zero])
+        methods aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (some recAliasWhnfKernelExpr, recAliasUnfoldState {})
+  simp [TypeChecker.Inner.unfoldDefinitionCore, TypeChecker.Inner.isDelta,
+    Expr.getAppFn, aliasRecNormalizationRawContext,
+    aliasRecNormalization_lookup, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind, recAliasInfo, recAliasKernelDef,
+    ConstantInfo.deltaValue?, TypeChecker.Inner.instantiateDeltaValue,
+    ConstantInfo.numLevelParams,
+    ConstantInfo.instantiateValueLevelParams!, ConstantInfo.levelParams,
+    ConstantInfo.value!, ConstantInfo.toConstantVal,
+    Expr.instantiateLevelParams, recAliasWhnfKernelExpr,
+    recAliasUnfoldState]
+
+private theorem unfoldRecAliasCoreInitial (methods) :
+    TypeChecker.Inner.unfoldDefinitionCore
+        (.const ``RecAlias [.succ .zero])
+        methods aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (some recAliasWhnfKernelExpr, recAliasUnfoldState {}) := by
+  change
+    TypeChecker.Inner.unfoldDefinition
+        (.const ``RecAlias [.succ .zero])
+        methods aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (some recAliasWhnfKernelExpr, recAliasUnfoldState {})
+  exact unfoldRecAliasInitial methods
+
+private theorem unfoldAliasRecFieldInitial (methods) :
+    TypeChecker.Inner.unfoldDefinition aliasRecFieldKernelExpr
+        methods aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (some (.app recAliasWhnfKernelExpr
+        (.const ``AliasRec [])), recAliasUnfoldState {}) := by
+  rw [aliasRecFieldKernelExpr_eq]
+  unfold TypeChecker.Inner.unfoldDefinition
+  rw [if_pos (show (Expr.app (.const ``RecAlias [.succ .zero])
+    (.const ``AliasRec [])).isApp = true from rfl)]
+  rw [show
+    (Expr.app (.const ``RecAlias [.succ .zero])
+      (.const ``AliasRec [])).getAppFn =
+        .const ``RecAlias [.succ .zero] by rfl]
+  simp only [normalizationRecMBind]
+  rw [unfoldRecAliasCoreInitial]
+  rw [show
+    (Expr.app (.const ``RecAlias [.succ .zero])
+      (.const ``AliasRec [])).getAppRevArgs =
+        #[.const ``AliasRec []] by rfl]
+  simp only [normalizationRecMPure]
+  rw [Expr.mkAppRevRange_eq
+    (l₁ := []) (l₂ := [.const ``AliasRec []]) (l₃ := [])
+    (by simp) (by rfl) (by rfl)]
+  rfl
+
+private theorem whnfLoopTypeFamilyAlias (methods state) :
+    TypeChecker.Inner.whnf'.loop (.const ``TypeFamilyAlias []) 2
+        methods aliasFormerNormalizationRawContext state =
+      .ok (.sort (.succ .zero), state) := by
+  unfold TypeChecker.Inner.whnf'.loop
+  simp [unfoldTypeFamilyAlias]
+  unfold TypeChecker.Inner.whnf'.loop
+  simp
+
+private theorem whnfLoopAliasFormer (methods state) :
+    TypeChecker.Inner.whnf'.loop (.const ``AliasFormer []) 2
+        methods aliasFormerCtorNormalizationRawContext state =
+      .ok (.const ``AliasFormer [], state) := by
+  unfold TypeChecker.Inner.whnf'.loop
+  simp [unfoldAliasFormer]
+
+private theorem whnfLoopRecAlias (methods) :
+    TypeChecker.Inner.whnf'.loop
+        (.const ``RecAlias [.succ .zero]) 2
+        methods aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (recAliasWhnfKernelExpr, recAliasUnfoldState {}) := by
+  unfold TypeChecker.Inner.whnf'.loop
+  simp [unfoldRecAliasInitial]
+  unfold TypeChecker.Inner.whnf'.loop
+  rw [recAliasWhnfKernelExpr_eq]
+  simp
+
+/-- The actual verified WHNF computation for the raw AliasFormer family
+result. -/
+theorem aliasFormerFamily_whnf :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.whnf' (.const ``TypeFamilyAlias [])
+          (TypeChecker.Methods.withFuel 9999)
+          aliasFormerNormalizationRawContext ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero), state) := by
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show (if aliasFormerNormalizationRawContext.eagerReduce then
+      aliasFormerNormalizationRawContext.fuel.whnfEager
+    else aliasFormerNormalizationRawContext.fuel.whnf) = 2 by rfl]
+  rw [whnfLoopTypeFamilyAlias]
+  simp [Functor.map, StateT.map, Except.map]
+
+/-- Constructor normalization is staged after inserting the raw family. The
+family constant is opaque, so this exact checker run retains the constructor
+type unchanged. -/
+theorem aliasFormerCtor_whnf :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.whnf' (.const ``AliasFormer [])
+          (TypeChecker.Methods.withFuel 9999)
+          aliasFormerCtorNormalizationRawContext
+          ({} : TypeChecker.State) =
+        .ok (.const ``AliasFormer [], state) := by
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show (if aliasFormerCtorNormalizationRawContext.eagerReduce then
+      aliasFormerCtorNormalizationRawContext.fuel.whnfEager
+    else aliasFormerCtorNormalizationRawContext.fuel.whnf) = 2 by rfl]
+  rw [whnfLoopAliasFormer]
+  simp [Functor.map, StateT.map, Except.map]
+
+/-- The full non-inference-only checker run for the raw AliasFormer family
+type. The returned sort is recorded together with the checker's cache update,
+rather than supplied as an external Theory premise. -/
+theorem aliasFormerFamily_checkType :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.inferType aliasFormerInfo.type false
+          (TypeChecker.Methods.withFuel 9999)
+          aliasFormerNormalizationContext.toContext
+          ({} : TypeChecker.State) =
+        .ok (.sort (.succ (.succ .zero)), state) := by
+  exact ⟨aliasFormerCheckTypeState {}, by
+    simpa [aliasFormerInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal,
+      aliasFormerNormalizationContext,
+      TypeChecker.VContext.mk', TypeChecker.VContext.mk1,
+      TypeChecker.MLCtx.lctx,
+      aliasFormerNormalizationRawContext] using
+      checkTypeTypeFamilyAlias⟩
+
+/-- The exact full checker run for the actual AliasFormer constructor type,
+staged after insertion of the raw family. The checker returns the retained
+family-type alias rather than silently normalizing it. -/
+theorem aliasFormerCtor_checkType :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.inferType aliasFormerMkInfo.type false
+          (TypeChecker.Methods.withFuel 9999)
+          aliasFormerCtorCandidateContext.toTypeChecker
+          ({} : TypeChecker.State) =
+        .ok (.const ``TypeFamilyAlias [], state) := by
+  exact ⟨aliasFormerCtorCheckTypeState {}, by
+    simpa [aliasFormerMkInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal,
+      aliasFormerCtorCandidateContext,
+      AddInductive.Context.toTypeChecker,
+      aliasFormerCtorNormalizationRawContext] using
+      checkTypeAliasFormer⟩
+
+/-- The actual verified WHNF computation for the reducible `RecAlias`
+head at the universe used by `AliasRec.mk`. -/
+theorem recAlias_whnf :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.whnf'
+          (.const ``RecAlias [.succ .zero])
+          (TypeChecker.Methods.withFuel 9999)
+          aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+        .ok (recAliasWhnfKernelExpr, state) := by
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show (if aliasRecNormalizationRawContext.eagerReduce then
+      aliasRecNormalizationRawContext.fuel.whnfEager
+    else aliasRecNormalizationRawContext.fuel.whnf) = 2 by rfl]
+  rw [whnfLoopRecAlias]
+  simp [Functor.map, StateT.map, Except.map]
+
+private theorem aliasFormerFamily_whnfM :
+    TypeChecker.M.run aliasFormerNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.whnf aliasFormerInfo.type) =
+      .ok (.sort (.succ .zero)) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.whnf'
+        (.const ``TypeFamilyAlias [])
+        (TypeChecker.Methods.withFuel 9999)
+        aliasFormerNormalizationRawContext ({} : TypeChecker.State)) =
+        Except.ok (.sort (.succ .zero))
+  obtain ⟨state, hrun⟩ := aliasFormerFamily_whnf
+  rw [hrun]
+  rfl
+
+private theorem aliasFormerFamily_checkTypeM :
+    TypeChecker.M.run aliasFormerNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.checkType aliasFormerInfo.type) =
+      .ok (.sort (.succ (.succ .zero))) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType aliasFormerInfo.type false
+        (TypeChecker.Methods.withFuel 10000)
+        aliasFormerNormalizationRawContext ({} : TypeChecker.State)) =
+      Except.ok (.sort (.succ (.succ .zero)))
+  rw [show aliasFormerInfo.type =
+    .const ``TypeFamilyAlias [] by rfl]
+  rw [checkTypeTypeFamilyAliasCandidate]
+  rfl
+
+private theorem aliasFormerCtor_checkTypeM :
+    TypeChecker.M.run aliasFormerCtorNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.checkType aliasFormerMkInfo.type) =
+      .ok (.const ``TypeFamilyAlias []) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType aliasFormerMkInfo.type false
+        (TypeChecker.Methods.withFuel 10000)
+        aliasFormerCtorNormalizationRawContext ({} : TypeChecker.State)) =
+      Except.ok (.const ``TypeFamilyAlias [])
+  rw [show aliasFormerMkInfo.type =
+    .const ``AliasFormer [] by rfl]
+  rw [checkTypeAliasFormerCandidate]
+  rfl
+
+private theorem aliasFormerCtor_whnfM :
+    TypeChecker.M.run aliasFormerCtorNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.whnf aliasFormerMkInfo.type) =
+      .ok (.const ``AliasFormer []) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.whnf'
+        (.const ``AliasFormer [])
+        (TypeChecker.Methods.withFuel 9999)
+        aliasFormerCtorNormalizationRawContext ({} : TypeChecker.State)) =
+      Except.ok (.const ``AliasFormer [])
+  obtain ⟨state, hrun⟩ := aliasFormerCtor_whnf
+  rw [hrun]
+  rfl
+
+private def annotatedPiRawDomainKernel : Expr :=
+  .app (.const ``outParam [.succ .zero]) (.sort .zero)
+
+private def annotatedPiInnerKernel : Expr :=
+  .forallE `p annotatedPiRawDomainKernel
+    (.const ``AnnotatedPi []) .default
+
+@[simp] private theorem annotatedPiRawDomain_getAppFn :
+    annotatedPiRawDomainKernel.getAppFn =
+      .const ``outParam [.succ .zero] := rfl
+
+@[simp] private theorem annotatedPiRawDomain_getAppRevArgs :
+    annotatedPiRawDomainKernel.getAppRevArgs = #[.sort .zero] := rfl
+
+private def annotatedPiOutParamWhnfKernelExpr : Expr :=
+  annotationOutParamInfo.instantiateValueLevelParams! [.succ .zero]
+
+private theorem annotatedPiOutParamWhnfKernelExpr_eq :
+    annotatedPiOutParamWhnfKernelExpr =
+      .lam `α (.sort (.succ .zero)) (.bvar 0) .default := by
+  simp [annotatedPiOutParamWhnfKernelExpr, annotationOutParamInfo,
+    ConstantInfo.instantiateValueLevelParams!, ConstantInfo.levelParams, ConstantInfo.value!,
+    ConstantInfo.toConstantVal, Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore',
+    Level.substParams']
+
+private def annotatedPiOutParamUnfoldState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    unfold := state.unfold.insert
+      (.const ``outParam [.succ .zero])
+      annotatedPiOutParamWhnfKernelExpr }
+
+private def annotatedPiDomainBetaKernel : Expr :=
+  .app annotatedPiOutParamWhnfKernelExpr (.sort .zero)
+
+private def annotatedPiDomainBetaState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    whnfCoreCache := state.whnfCoreCache.insert
+      annotatedPiDomainBetaKernel (.sort .zero) }
+
+@[simp] private theorem annotatedPiType_quotInit :
+    annotatedPiTypeKernelEnv.quotInit = false := rfl
+
+private theorem annotatedPiInductiveReduceRecDomain
+    {m : Type → Type} [Monad m]
+    (whnf inferType : Expr → m Expr)
+    (isDefEq : Expr → Expr → m Bool) (isNeverProp : Expr → m Bool) :
+    inductiveReduceRec annotatedPiTypeKernelEnv annotatedPiRawDomainKernel
+        whnf inferType isDefEq isNeverProp =
+      pure none := by
+  unfold inductiveReduceRec
+  rw [show annotatedPiRawDomainKernel.getAppFn =
+    .const ``outParam [.succ .zero] by rfl]
+  simp only
+  rw [annotatedPiType_lookup_outParam]
+  rfl
+
+private theorem annotatedPiReduceRecursorDomain
+    (methods state) :
+    TypeChecker.Inner.reduceRecursor annotatedPiRawDomainKernel
+        methods annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (none, state) := by
+  unfold TypeChecker.Inner.reduceRecursor
+  simp only [normalizationRecMBind, normalizationRecMGetEnv]
+  rw [if_neg (show
+    ¬(annotatedPiCtorCandidateContext.toTypeChecker.env.quotInit = true) by
+      simp [annotatedPiCtorCandidateContext,
+        AddInductive.Context.toTypeChecker, annotatedPiType_quotInit])]
+  simp only [annotatedPiCtorCandidateContext,
+    AddInductive.Context.toTypeChecker]
+  rw [annotatedPiInductiveReduceRecDomain]
+  rfl
+
+@[simp] private theorem annotatedPiWhnfCoreOutParamConst (n state) :
+    TypeChecker.Inner.whnfCore
+        (.const ``outParam [.succ .zero]) false
+        (TypeChecker.Methods.withFuel (n + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.const ``outParam [.succ .zero], state) := by
+  rfl
+
+private theorem annotatedPiWhnfCoreDomainInitial (n) :
+    TypeChecker.Inner.whnfCore' annotatedPiRawDomainKernel
+        (cheapProj := false)
+        (TypeChecker.Methods.withFuel (n + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (annotatedPiRawDomainKernel, ({} : TypeChecker.State)) := by
+  change
+    TypeChecker.Inner.whnfCore'
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        (cheapProj := false)
+        (TypeChecker.Methods.withFuel (n + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (.app (.const ``outParam [.succ .zero]) (.sort .zero),
+        ({} : TypeChecker.State))
+  unfold TypeChecker.Inner.whnfCore'
+  simp only [normalizationRecMBind, normalizationRecMGet, Std.HashMap.getElem?_empty]
+  rw [Expr.withRevApp_eq]
+  simp only [normalizationRecMBind]
+  rw [show
+    (Expr.app (.const ``outParam [.succ .zero])
+      (.sort .zero)).getAppFn =
+        .const ``outParam [.succ .zero] by rfl]
+  rw [annotatedPiWhnfCoreOutParamConst n ({} : TypeChecker.State)]
+  simp [Expr.structuralEq, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show
+    .app (.const ``outParam [.succ .zero]) (.sort .zero) =
+      annotatedPiRawDomainKernel by rfl]
+  rw [annotatedPiReduceRecursorDomain]
+  rfl
+
+private theorem annotatedPiUnfoldOutParamCoreInitial (methods) :
+    TypeChecker.Inner.unfoldDefinitionCore
+        (.const ``outParam [.succ .zero])
+        methods annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (some annotatedPiOutParamWhnfKernelExpr,
+        annotatedPiOutParamUnfoldState {}) := by
+  simp [TypeChecker.Inner.unfoldDefinitionCore, TypeChecker.Inner.isDelta, Expr.getAppFn,
+    annotatedPiCtorCandidateContext, AddInductive.Context.toTypeChecker,
+    annotatedPiType_lookup_outParam, Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    annotationOutParamInfo, ConstantInfo.deltaValue?, TypeChecker.Inner.instantiateDeltaValue,
+    ConstantInfo.numLevelParams, ConstantInfo.instantiateValueLevelParams!,
+    ConstantInfo.levelParams, ConstantInfo.value!, ConstantInfo.toConstantVal,
+    Expr.instantiateLevelParams, annotatedPiOutParamWhnfKernelExpr, annotatedPiOutParamUnfoldState]
+
+private theorem annotatedPiUnfoldDomainInitial (methods) :
+    TypeChecker.Inner.unfoldDefinition annotatedPiRawDomainKernel
+        methods annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (some annotatedPiDomainBetaKernel,
+        annotatedPiOutParamUnfoldState {}) := by
+  change
+    TypeChecker.Inner.unfoldDefinition
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        methods annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (some annotatedPiDomainBetaKernel,
+        annotatedPiOutParamUnfoldState {})
+  unfold TypeChecker.Inner.unfoldDefinition
+  rw [if_pos (show (Expr.app (.const ``outParam [.succ .zero])
+    (.sort .zero)).isApp = true from rfl)]
+  rw [show
+    (Expr.app (.const ``outParam [.succ .zero])
+      (.sort .zero)).getAppFn =
+        .const ``outParam [.succ .zero] by rfl]
+  simp only [normalizationRecMBind]
+  rw [annotatedPiUnfoldOutParamCoreInitial]
+  rw [show
+    (Expr.app (.const ``outParam [.succ .zero])
+      (.sort .zero)).getAppRevArgs = #[.sort .zero] by rfl]
+  simp only [normalizationRecMPure]
+  rw [Expr.mkAppRevRange_eq
+    (l₁ := []) (l₂ := [.sort .zero]) (l₃ := [])
+    (by simp) (by rfl) (by rfl)]
+  rfl
+
+@[simp] private theorem annotatedPiWhnfCoreOutParamIdentity (n state) :
+    TypeChecker.Inner.whnfCore
+        (.lam `α (.sort (.succ .zero)) (.bvar 0) .default)
+        false (TypeChecker.Methods.withFuel (n + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.lam `α (.sort (.succ .zero)) (.bvar 0) .default,
+        state) := by
+  rfl
+
+@[simp] private theorem annotatedPiWhnfCoreDomainSort (n state) :
+    TypeChecker.Inner.whnfCore (.sort .zero) false
+        (TypeChecker.Methods.withFuel (n + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.sort .zero, state) := by
+  rfl
+
+@[simp] private theorem annotatedPiSort_mkAppRevRangeZero :
+    (Expr.sort .zero).mkAppRevRange 0 0 #[.sort .zero] =
+      .sort .zero := by
+  rw [Expr.mkAppRevRange_eq
+    (l₁ := []) (l₂ := []) (l₃ := [.sort .zero])
+    (by simp) (by rfl) (by rfl)]
+  rfl
+
+private theorem annotatedPiWhnfCoreDomainBeta (n) :
+    TypeChecker.Inner.whnfCore' annotatedPiDomainBetaKernel
+        (cheapProj := false)
+        (TypeChecker.Methods.withFuel (n + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiOutParamUnfoldState {}) =
+      .ok (.sort .zero,
+        annotatedPiDomainBetaState
+          (annotatedPiOutParamUnfoldState {})) := by
+  rw [annotatedPiDomainBetaKernel,
+    annotatedPiOutParamWhnfKernelExpr_eq]
+  unfold TypeChecker.Inner.whnfCore'
+  simp only [normalizationRecMBind, normalizationRecMGet, annotatedPiOutParamUnfoldState,
+    Std.HashMap.getElem?_empty]
+  rw [Expr.withRevApp_eq]
+  simp only [normalizationRecMBind]
+  rw [show
+    (Expr.app
+      (.lam `α (.sort (.succ .zero)) (.bvar 0) .default)
+      (.sort .zero)).getAppFn =
+        .lam `α (.sort (.succ .zero)) (.bvar 0) .default by rfl]
+  rw [annotatedPiWhnfCoreOutParamIdentity]
+  rw [show
+    (Expr.app
+      (.lam `α (.sort (.succ .zero)) (.bvar 0) .default)
+      (.sort .zero)).getAppRevArgs = #[.sort .zero] by rfl]
+  simp [TypeChecker.Inner.whnfCore'.loop, TypeChecker.Inner.whnfCore'.loop.cont,
+    TypeChecker.Inner.whnfCore'.save, annotatedPiDomainBetaKernel,
+    annotatedPiOutParamWhnfKernelExpr_eq, annotatedPiDomainBetaState, Expr.instantiate1', Bind.bind,
+    ReaderT.bind, StateT.bind, Except.bind]
+
+@[simp] private theorem annotatedPiReduceNativeDomain
+    (env methods state) :
+    (liftM (TypeChecker.Inner.reduceNative env annotatedPiRawDomainKernel) :
+        TypeChecker.RecM (Option Expr))
+        methods annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (none, state) := by
+  rfl
+
+@[simp] private theorem annotatedPiReduceNatDomain (methods state) :
+    TypeChecker.Inner.reduceNat annotatedPiRawDomainKernel
+        methods annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (none, state) := by
+  change
+    TypeChecker.Inner.reduceNat
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        methods annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (none, state)
+  simp [TypeChecker.Inner.reduceNat, Expr.getAppNumArgs_eq,
+    Expr.getAppArgsRevList, Expr.appFn!, Expr.structuralEq]
+
+private theorem annotatedPiWhnfLoopDomain :
+    TypeChecker.Inner.whnf'.loop annotatedPiRawDomainKernel 100000
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (.sort .zero,
+        annotatedPiDomainBetaState
+          (annotatedPiOutParamUnfoldState {})) := by
+  rw [show 100000 = 99999 + 1 by rfl]
+  unfold TypeChecker.Inner.whnf'.loop
+  rw [show 9999 = 9998 + 1 by rfl]
+  simp only [normalizationRecMBind, normalizationRecMGetEnv]
+  rw [annotatedPiWhnfCoreDomainInitial]
+  simp only []
+  rw [annotatedPiReduceNativeDomain]
+  simp only [normalizationRecMBind]
+  rw [annotatedPiReduceNatDomain]
+  simp only [normalizationRecMBind]
+  rw [annotatedPiUnfoldDomainInitial]
+  simp only []
+  unfold TypeChecker.Inner.whnf'.loop
+  simp only [normalizationRecMBind, normalizationRecMGetEnv]
+  rw [annotatedPiWhnfCoreDomainBeta]
+  simp only []
+  rw [normalizationReduceNativeSort]
+  simp only [normalizationRecMBind]
+  rw [normalizationReduceNatSort]
+  simp only [normalizationRecMBind]
+  rw [normalizationUnfoldSort]
+  rfl
+
+private theorem annotatedPiWhnfLoopDomainConcrete :
+    TypeChecker.Inner.whnf'.loop
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero)) 100000
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (.sort .zero,
+        annotatedPiDomainBetaState
+          (annotatedPiOutParamUnfoldState {})) := by
+  exact annotatedPiWhnfLoopDomain
+
+private theorem annotatedPiDomain_checkTypeM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.checkType annotatedPiRawDomainKernel) =
+        .ok (.sort (.succ .zero)) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiRawDomainKernel false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' annotatedPiRawDomainKernel false
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  unfold annotatedPiRawDomainKernel TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', TypeChecker.Inner.inferType', Bind.bind,
+    ReaderT.bind, StateT.bind, Except.bind]
+  rw [annotatedPiIsDefEqSort 9999]
+  simp [Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rfl
+
+private theorem annotatedPiDomain_whnfM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.whnf annotatedPiRawDomainKernel) =
+        .ok (.sort .zero) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.whnf' annotatedPiRawDomainKernel
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort .zero)
+  rw [show annotatedPiRawDomainKernel =
+    .app (.const ``outParam [.succ .zero]) (.sort .zero) by rfl]
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show
+    (if annotatedPiCtorCandidateContext.toTypeChecker.eagerReduce then
+      annotatedPiCtorCandidateContext.toTypeChecker.fuel.whnfEager
+    else annotatedPiCtorCandidateContext.toTypeChecker.fuel.whnf) =
+        100000 by rfl]
+  rw [annotatedPiWhnfLoopDomainConcrete]
+  simp [Functor.map, StateT.map, Except.map]
+
+@[simp] private theorem annotatedPiApp_beq_sort
+    (fn arg : Expr) (u : Level) :
+    ((.app fn arg : Expr) == .sort u) = false := by
+  change Expr.eqv (.app fn arg) (.sort u) = false
+  rw [Expr.eqv_eq]
+  rfl
+
+/-- `quickIsDefEq` only reads the success cache, so whichever answer the cache gives, the state
+comes back unchanged and the result is `.true` or `.undef` -- never `.false`, since an application
+and a sort are not settled structurally. -/
+private theorem annotatedPiQuickIsDefEqDomainInitial
+    (methods : TypeChecker.Methods)
+    (context : TypeChecker.Context) (initial : Std.HashSet (Expr × Expr)) :
+    ∃ (r : LBool) (m : Std.HashSet (Expr × Expr)),
+      TypeChecker.Inner.quickIsDefEq
+          annotatedPiRawDomainKernel (.sort .zero)
+          methods context ({ success := initial } : TypeChecker.State) =
+        .ok (r, ({ success := m } : TypeChecker.State)) ∧
+      (r = .true ∨ r = .undef) := by
+  have hb : (annotatedPiRawDomainKernel == Expr.sort .zero) = false :=
+    annotatedPiApp_beq_sort ..
+  by_cases h : TypeChecker.Inner.succeededBefore initial
+      annotatedPiRawDomainKernel (.sort .zero) = true
+  · refine ⟨.true, initial, ?_, Or.inl rfl⟩
+    simp [TypeChecker.Inner.quickIsDefEq, hb, h, Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+      pure, ReaderT.pure, StateT.pure, Except.pure]
+  · simp only [Bool.not_eq_true] at h
+    refine ⟨.undef, initial, ?_, Or.inr rfl⟩
+    simp [TypeChecker.Inner.quickIsDefEq, hb, h, Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+      pure]
+    rfl
+
+@[simp] private theorem annotatedPiWhnfCoreOutParamConstCheap
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.whnfCore
+        (.const ``outParam [.succ .zero]) true
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.const ``outParam [.succ .zero],
+        ({ success := m } : TypeChecker.State)) := by
+  rfl
+
+private theorem annotatedPiWhnfCoreDomainCheap
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.whnfCore annotatedPiRawDomainKernel true
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (annotatedPiRawDomainKernel,
+        ({ success := m } : TypeChecker.State)) := by
+  change
+    TypeChecker.Inner.whnfCore'
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        true (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.app (.const ``outParam [.succ .zero]) (.sort .zero),
+        ({ success := m } : TypeChecker.State))
+  unfold TypeChecker.Inner.whnfCore'
+  simp only [normalizationRecMBind, normalizationRecMGet, Std.HashMap.getElem?_empty]
+  rw [Expr.withRevApp_eq]
+  simp only [normalizationRecMBind]
+  rw [show
+    (Expr.app (.const ``outParam [.succ .zero])
+      (.sort .zero)).getAppFn =
+        .const ``outParam [.succ .zero] by rfl]
+  rw [annotatedPiWhnfCoreOutParamConstCheap fuel]
+  simp [Expr.structuralEq, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [show
+    .app (.const ``outParam [.succ .zero]) (.sort .zero) =
+      annotatedPiRawDomainKernel by rfl]
+  rw [annotatedPiReduceRecursorDomain]
+  rfl
+
+@[simp] private theorem annotatedPiInferConstantOutParamCandidateOnly :
+    TypeChecker.Inner.inferConstant
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ``outParam [.succ .zero] true =
+      .ok annotatedPiOutParamFnType := by
+  unfold TypeChecker.Inner.inferConstant
+  simp only [annotatedPiCtorCandidateContext,
+    AddInductive.Context.toTypeChecker]
+  rw [show annotatedPiTypeKernelEnv.get ``outParam =
+    .ok annotationOutParamInfo by exact annotatedPiType_get_outParam]
+  simp [annotationOutParamInfo, annotatedPiOutParamFnType, Bind.bind, Except.bind,
+    annotatedPiExceptPure, ConstantInfo.levelParams, ConstantInfo.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal, ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq, Expr.instantiateLevelParamsCore', Level.substParams']
+
+private def annotatedPiOutParamInferOnlyState
+    (m : Std.HashSet (Expr × Expr)) : TypeChecker.State :=
+  { inferTypeI := ({} : InferCache).insert
+      (.const ``outParam [.succ .zero]) annotatedPiOutParamFnType,
+    success := m }
+
+private theorem annotatedPiInferTypeOutParamOnly
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.inferType
+        (.const ``outParam [.succ .zero]) true
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (annotatedPiOutParamFnType,
+        annotatedPiOutParamInferOnlyState m) := by
+  change
+    TypeChecker.Inner.inferType'
+        (.const ``outParam [.succ .zero]) true
+        (TypeChecker.Methods.withFuel (fuel + 1))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (annotatedPiOutParamFnType,
+        annotatedPiOutParamInferOnlyState m)
+  unfold TypeChecker.Inner.inferType'
+  simp [annotatedPiOutParamInferOnlyState,
+    Expr.hasLooseBVars, Expr.looseBVarRange',
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem annotatedPiInferAppDomainOnly
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.inferApp annotatedPiRawDomainKernel
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.sort (.succ .zero),
+        annotatedPiOutParamInferOnlyState m) := by
+  unfold TypeChecker.Inner.inferApp
+  rw [Expr.withApp_eq]
+  rw [annotatedPiRawDomain_getAppFn]
+  rw [show annotatedPiRawDomainKernel.getAppArgs =
+    #[.sort .zero] by rfl]
+  simp only [normalizationRecMBind]
+  rw [annotatedPiInferTypeOutParamOnly fuel]
+  simp [TypeChecker.Inner.inferApp.loop, annotatedPiOutParamFnType]
+
+private def annotatedPiDomainInferOnlyState
+    (m : Std.HashSet (Expr × Expr)) : TypeChecker.State :=
+  { inferTypeI :=
+      (({} : InferCache).insert
+        (.const ``outParam [.succ .zero]) annotatedPiOutParamFnType).insert
+        annotatedPiRawDomainKernel (.sort (.succ .zero)),
+    success := m }
+
+private theorem annotatedPiInferTypeDomainOnlyAny
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.inferType annotatedPiRawDomainKernel true
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.sort (.succ .zero), annotatedPiDomainInferOnlyState m) := by
+  change
+    TypeChecker.Inner.inferType' annotatedPiRawDomainKernel true
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.sort (.succ .zero), annotatedPiDomainInferOnlyState m)
+  rw [show annotatedPiRawDomainKernel =
+    .app (.const ``outParam [.succ .zero]) (.sort .zero) by rfl]
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    annotatedPiDomainInferOnlyState, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rw [show
+    .app (.const ``outParam [.succ .zero]) (.sort .zero) =
+      annotatedPiRawDomainKernel by rfl]
+  rw [annotatedPiInferAppDomainOnly fuel]
+  simp [annotatedPiOutParamInferOnlyState]
+
+private theorem annotatedPiInferTypeDomainOnly998
+    (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.inferType'
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero)) true
+        (TypeChecker.Methods.withFuel 9998)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.sort (.succ .zero), annotatedPiDomainInferOnlyState m) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    annotatedPiDomainInferOnlyState, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rw [show
+    .app (.const ``outParam [.succ .zero]) (.sort .zero) =
+      annotatedPiRawDomainKernel by rfl]
+  rw [show TypeChecker.Inner.inferApp annotatedPiRawDomainKernel
+      (TypeChecker.Methods.withFuel 9998)
+      annotatedPiCtorCandidateContext.toTypeChecker
+      ({ success := m } : TypeChecker.State) =
+    .ok (.sort (.succ .zero), annotatedPiOutParamInferOnlyState m) by
+      simpa only [Nat.reduceAdd] using
+        annotatedPiInferAppDomainOnly 9996 m]
+  simp [annotatedPiOutParamInferOnlyState]
+
+private def annotatedPiSortOneInferOnlyState
+    (m : Std.HashSet (Expr × Expr)) : TypeChecker.State :=
+  { annotatedPiDomainInferOnlyState m with
+    inferTypeI := (annotatedPiDomainInferOnlyState m).inferTypeI.insert
+      (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) }
+
+@[simp] private theorem annotatedPiDomainInferOnlyState_sortOneMiss
+    (m : Std.HashSet (Expr × Expr)) :
+    (annotatedPiDomainInferOnlyState m).inferTypeI[
+        (.sort (.succ .zero) : Expr)]? = none := by
+  simp [annotatedPiDomainInferOnlyState, annotatedPiRawDomainKernel, annotatedPiOutParamFnType]
+
+private theorem annotatedPiInferTypeSortOneOnly
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.inferType (.sort (.succ .zero)) true
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiDomainInferOnlyState m) =
+      .ok (.sort (.succ (.succ .zero)),
+        annotatedPiSortOneInferOnlyState m) := by
+  change
+    TypeChecker.Inner.inferType' (.sort (.succ .zero)) true
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiDomainInferOnlyState m) =
+      .ok (.sort (.succ (.succ .zero)),
+        annotatedPiSortOneInferOnlyState m)
+  unfold TypeChecker.Inner.inferType'
+  simp [annotatedPiDomainInferOnlyState_sortOneMiss,
+    annotatedPiSortOneInferOnlyState, Expr.hasLooseBVars,
+    Expr.looseBVarRange', Bind.bind, ReaderT.bind, StateT.bind,
+    Except.bind]
+
+@[simp] private theorem annotatedPiWhnfSortTwo
+    (fuel : Nat) (state : TypeChecker.State) :
+    TypeChecker.Inner.whnf (.sort (.succ (.succ .zero)))
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.sort (.succ (.succ .zero)), state) := by
+  rfl
+
+private theorem annotatedPiIsPropSortOneFalse
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.isProp (.sort (.succ .zero))
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiDomainInferOnlyState m) =
+      .ok (false, annotatedPiSortOneInferOnlyState m) := by
+  unfold TypeChecker.Inner.isProp TypeChecker.Inner.getSortLevel
+  simp only [normalizationRecMBind]
+  rw [annotatedPiInferTypeSortOneOnly fuel]
+  rfl
+
+private theorem annotatedPiIsDefEqProofIrrelDomain
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.isDefEqProofIrrel
+        annotatedPiRawDomainKernel (.sort .zero)
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({ success := m } : TypeChecker.State) =
+      .ok (.undef, annotatedPiSortOneInferOnlyState m) := by
+  unfold TypeChecker.Inner.isDefEqProofIrrel
+  simp only [normalizationRecMBind]
+  rw [annotatedPiInferTypeDomainOnlyAny fuel]
+  simp only []
+  rw [annotatedPiIsPropSortOneFalse fuel]
+  rfl
+
+private theorem annotatedPiUnfoldOutParamCoreOfMiss
+    (methods : TypeChecker.Methods) (state : TypeChecker.State)
+    (hcache : state.unfold[
+      (.const ``outParam [.succ .zero] : Expr)]? = none) :
+    TypeChecker.Inner.unfoldDefinitionCore
+        (.const ``outParam [.succ .zero]) methods
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (some annotatedPiOutParamWhnfKernelExpr,
+        annotatedPiOutParamUnfoldState state) := by
+  simp [TypeChecker.Inner.unfoldDefinitionCore,
+    TypeChecker.Inner.isDelta, Expr.getAppFn,
+    annotatedPiCtorCandidateContext,
+    AddInductive.Context.toTypeChecker, annotatedPiType_lookup_outParam,
+    hcache, Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    annotationOutParamInfo, ConstantInfo.deltaValue?,
+    TypeChecker.Inner.instantiateDeltaValue,
+    ConstantInfo.numLevelParams,
+    ConstantInfo.instantiateValueLevelParams!, ConstantInfo.levelParams,
+    ConstantInfo.value!, ConstantInfo.toConstantVal,
+    Expr.instantiateLevelParams, annotatedPiOutParamWhnfKernelExpr,
+    annotatedPiOutParamUnfoldState]
+
+private theorem annotatedPiUnfoldDomainOfMiss
+    (methods : TypeChecker.Methods) (state : TypeChecker.State)
+    (hcache : state.unfold[
+      (.const ``outParam [.succ .zero] : Expr)]? = none) :
+    TypeChecker.Inner.unfoldDefinition annotatedPiRawDomainKernel
+        methods annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (some annotatedPiDomainBetaKernel,
+        annotatedPiOutParamUnfoldState state) := by
+  change
+    TypeChecker.Inner.unfoldDefinition
+        (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+        methods annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (some annotatedPiDomainBetaKernel,
+        annotatedPiOutParamUnfoldState state)
+  unfold TypeChecker.Inner.unfoldDefinition
+  rw [if_pos (show (Expr.app (.const ``outParam [.succ .zero])
+    (.sort .zero)).isApp = true from rfl)]
+  rw [show
+    (Expr.app (.const ``outParam [.succ .zero])
+      (.sort .zero)).getAppFn =
+        .const ``outParam [.succ .zero] by rfl]
+  simp only [normalizationRecMBind]
+  rw [annotatedPiUnfoldOutParamCoreOfMiss methods state hcache]
+  rw [show
+    (Expr.app (.const ``outParam [.succ .zero])
+      (.sort .zero)).getAppRevArgs = #[.sort .zero] by rfl]
+  simp only [normalizationRecMPure]
+  rw [Expr.mkAppRevRange_eq
+    (l₁ := []) (l₂ := [.sort .zero]) (l₃ := [])
+    (by simp) (by rfl) (by rfl)]
+  rfl
+
+@[simp] private theorem annotatedPiWhnfCoreIdentityCheap
+    (fuel : Nat) (state) :
+    TypeChecker.Inner.whnfCore
+        (.lam `α (.sort (.succ .zero)) (.bvar 0) .default)
+        true (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.lam `α (.sort (.succ .zero)) (.bvar 0) .default,
+        state) := by
+  rfl
+
+@[simp] private theorem annotatedPiWhnfCoreSortZeroCheap
+    (fuel : Nat) (state) :
+    TypeChecker.Inner.whnfCore (.sort .zero) true
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.sort .zero, state) := by
+  rfl
+
+private theorem annotatedPiWhnfCoreDomainBetaCheap
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.whnfCore annotatedPiDomainBetaKernel true
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiOutParamUnfoldState
+          (annotatedPiSortOneInferOnlyState m)) =
+      .ok (.sort .zero,
+        annotatedPiOutParamUnfoldState
+          (annotatedPiSortOneInferOnlyState m)) := by
+  change
+    TypeChecker.Inner.whnfCore' annotatedPiDomainBetaKernel true
+        (TypeChecker.Methods.withFuel (fuel + 2))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiOutParamUnfoldState
+          (annotatedPiSortOneInferOnlyState m)) =
+      .ok (.sort .zero,
+        annotatedPiOutParamUnfoldState
+          (annotatedPiSortOneInferOnlyState m))
+  rw [annotatedPiDomainBetaKernel,
+    annotatedPiOutParamWhnfKernelExpr_eq]
+  unfold TypeChecker.Inner.whnfCore'
+  simp only [normalizationRecMBind, normalizationRecMGet, annotatedPiOutParamUnfoldState,
+    annotatedPiSortOneInferOnlyState, annotatedPiDomainInferOnlyState, Std.HashMap.getElem?_empty]
+  rw [Expr.withRevApp_eq]
+  simp only [normalizationRecMBind]
+  rw [show
+    (Expr.app
+      (.lam `α (.sort (.succ .zero)) (.bvar 0) .default)
+      (.sort .zero)).getAppFn =
+        .lam `α (.sort (.succ .zero)) (.bvar 0) .default by rfl]
+  rw [annotatedPiWhnfCoreIdentityCheap fuel]
+  rw [show
+    (Expr.app
+      (.lam `α (.sort (.succ .zero)) (.bvar 0) .default)
+      (.sort .zero)).getAppRevArgs = #[.sort .zero] by rfl]
+  simp [TypeChecker.Inner.whnfCore'.loop, TypeChecker.Inner.whnfCore'.loop.cont,
+    TypeChecker.Inner.whnfCore'.save, annotatedPiOutParamWhnfKernelExpr_eq, Expr.instantiate1',
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem annotatedPiQuickIsDefEqSortZeroAny
+    (methods : TypeChecker.Methods)
+    (context : TypeChecker.Context)
+    (initial : TypeChecker.State) :
+    ∃ m : Std.HashSet (Expr × Expr),
+      TypeChecker.Inner.quickIsDefEq (.sort .zero) (.sort .zero)
+          methods context initial =
+        .ok (.true, annotatedPiWithSuccessCache initial m) := by
+  -- The two sides are syntactically equal, so the structural check settles it without the cache.
+  refine ⟨initial.success, ?_⟩
+  simp [TypeChecker.Inner.quickIsDefEq, annotatedPiWithSuccessCache, pure, ReaderT.pure,
+    StateT.pure, Except.pure, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem annotatedPiIsDeltaDomain :
+    TypeChecker.Inner.isDelta annotatedPiTypeKernelEnv
+        annotatedPiRawDomainKernel =
+      some annotationOutParamInfo := by
+  unfold TypeChecker.Inner.isDelta
+  rw [annotatedPiRawDomain_getAppFn]
+  simp only
+  rw [annotatedPiType_lookup_outParam]
+  simp [annotationOutParamInfo, ConstantInfo.deltaValue?,
+    ConstantInfo.numLevelParams, ConstantInfo.levelParams,
+    ConstantInfo.toConstantVal]
+
+@[simp] private theorem annotatedPiIsDeltaSortZero :
+    TypeChecker.Inner.isDelta annotatedPiTypeKernelEnv (.sort .zero) =
+      none := by
+  rfl
+
+@[simp] private theorem annotatedPiTryUnfoldProjAppSortZero
+    (methods state) :
+    TypeChecker.Inner.tryUnfoldProjApp (.sort .zero) methods
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (none, state) := by
+  rfl
+
+private theorem annotatedPiDeltaDomain
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    (TypeChecker.Inner.unfoldDefinition annotatedPiRawDomainKernel >>=
+      fun e => TypeChecker.Inner.whnfCore e.get! true)
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiSortOneInferOnlyState m) =
+      .ok (.sort .zero,
+        annotatedPiOutParamUnfoldState
+          (annotatedPiSortOneInferOnlyState m)) := by
+  simp only [normalizationRecMBind]
+  rw [annotatedPiUnfoldDomainOfMiss
+    (TypeChecker.Methods.withFuel (fuel + 3))
+    (annotatedPiSortOneInferOnlyState m) (by
+      simp [annotatedPiSortOneInferOnlyState,
+        annotatedPiDomainInferOnlyState])]
+  simp only
+  rw [show (some annotatedPiDomainBetaKernel).get! =
+    annotatedPiDomainBetaKernel by rfl]
+  rw [annotatedPiWhnfCoreDomainBetaCheap fuel]
+
+private theorem annotatedPiLazyDeltaStepDomain
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    ∃ m' : Std.HashSet (Expr × Expr),
+      TypeChecker.Inner.lazyDeltaReductionStep
+          annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 3))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          (annotatedPiSortOneInferOnlyState m) =
+        .ok (.bool true,
+          annotatedPiWithSuccessCache
+            (annotatedPiOutParamUnfoldState
+              (annotatedPiSortOneInferOnlyState m)) m') := by
+  obtain ⟨m', hquick⟩ := annotatedPiQuickIsDefEqSortZeroAny
+    (TypeChecker.Methods.withFuel (fuel + 3))
+    annotatedPiCtorCandidateContext.toTypeChecker
+    (annotatedPiOutParamUnfoldState
+      (annotatedPiSortOneInferOnlyState m))
+  refine ⟨m', ?_⟩
+  unfold TypeChecker.Inner.lazyDeltaReductionStep
+  rw [normalizationRecMBind]
+  rw [normalizationRecMGetEnv]
+  simp only
+  rw [show annotatedPiCtorCandidateContext.toTypeChecker.env =
+    annotatedPiTypeKernelEnv by rfl]
+  rw [annotatedPiIsDeltaDomain, annotatedPiIsDeltaSortZero]
+  simp only
+  rw [normalizationRecMBind]
+  rw [annotatedPiTryUnfoldProjAppSortZero]
+  simp only
+  rw [normalizationRecMBind]
+  rw [annotatedPiDeltaDomain fuel]
+  simp only
+  rw [normalizationRecMBind]
+  rw [hquick]
+  rfl
+
+@[simp] private theorem annotatedPiIsDefEqOffsetDomain
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    TypeChecker.Inner.isDefEqOffset
+        annotatedPiRawDomainKernel (.sort .zero)
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiSortOneInferOnlyState m) =
+      .ok (.undef, annotatedPiSortOneInferOnlyState m) := by
+  have hzero :
+      (annotatedPiRawDomainKernel == Expr.natZero) = false := by
+    rw [show annotatedPiRawDomainKernel =
+      .app (.const ``outParam [.succ .zero]) (.sort .zero) by rfl]
+    exact annotatedPiApp_beq_const _ _ _ _
+  unfold TypeChecker.Inner.isDefEqOffset
+  simp [TypeChecker.Inner.isNatZero, TypeChecker.Inner.isNatSuccOf?, annotatedPiRawDomainKernel,
+    Expr.natZero]
+
+private theorem annotatedPiLazyDeltaLoopDomain
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    ∃ m' : Std.HashSet (Expr × Expr),
+      TypeChecker.Inner.lazyDeltaReduction.loop
+          annotatedPiRawDomainKernel (.sort .zero) 1000
+          (TypeChecker.Methods.withFuel (fuel + 3))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          (annotatedPiSortOneInferOnlyState m) =
+        .ok (.bool true,
+          annotatedPiWithSuccessCache
+            (annotatedPiOutParamUnfoldState
+              (annotatedPiSortOneInferOnlyState m)) m') := by
+  obtain ⟨m', hstep⟩ := annotatedPiLazyDeltaStepDomain fuel m
+  refine ⟨m', ?_⟩
+  rw [show 1000 = 999 + 1 by rfl]
+  unfold TypeChecker.Inner.lazyDeltaReduction.loop
+  rw [normalizationRecMBind]
+  rw [annotatedPiIsDefEqOffsetDomain fuel]
+  simp only
+  rw [show (LBool.undef != LBool.undef) = false by rfl]
+  simp only [Bool.false_eq_true, if_false]
+  rw [normalizationRecMBind]
+  rw [normalizationRecMReadContext]
+  simp only
+  rw [show
+    (!annotatedPiRawDomainKernel.hasFVar &&
+        !(.sort .zero : Expr).hasFVar ||
+      annotatedPiCtorCandidateContext.toTypeChecker.eagerReduce) = true
+    by
+      simp [Expr.hasFVar_eq, Expr.hasFVar',
+        annotatedPiRawDomainKernel]]
+  simp only [if_true]
+  rw [normalizationRecMBind]
+  rw [annotatedPiReduceNatDomain]
+  simp only
+  rw [normalizationRecMBind]
+  rw [normalizationReduceNatSort]
+  simp only
+  rw [normalizationRecMBind]
+  rw [normalizationRecMGetEnv]
+  simp only
+  rw [normalizationRecMBind]
+  rw [annotatedPiReduceNativeDomain]
+  simp only
+  rw [normalizationRecMBind]
+  rw [normalizationReduceNativeSort]
+  simp only
+  rw [normalizationRecMBind]
+  rw [hstep]
+  rfl
+
+private theorem annotatedPiLazyDeltaDomain
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    ∃ m' : Std.HashSet (Expr × Expr),
+      TypeChecker.Inner.lazyDeltaReduction
+          annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 3))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          (annotatedPiSortOneInferOnlyState m) =
+        .ok (.bool true,
+          annotatedPiWithSuccessCache
+            (annotatedPiOutParamUnfoldState
+              (annotatedPiSortOneInferOnlyState m)) m') := by
+  obtain ⟨m', hloop⟩ := annotatedPiLazyDeltaLoopDomain fuel m
+  refine ⟨m', ?_⟩
+  unfold TypeChecker.Inner.lazyDeltaReduction
+  rw [normalizationRecMBind]
+  rw [normalizationRecMReadContext]
+  simp only
+  change
+    TypeChecker.Inner.lazyDeltaReduction.loop
+        annotatedPiRawDomainKernel (.sort .zero) 1000
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker
+        (annotatedPiSortOneInferOnlyState m) = _
+  exact hloop
+
+private theorem annotatedPiQuickIsDefEqDomainAny
+    (fuel : Nat) (m : Std.HashSet (Expr × Expr)) :
+    ∃ (r : LBool) (m' : Std.HashSet (Expr × Expr)),
+      TypeChecker.Inner.quickIsDefEq
+          annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 3))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := m } : TypeChecker.State) =
+        .ok (r, ({ success := m' } : TypeChecker.State)) ∧
+      (r = .true ∨ r = .undef) :=
+  annotatedPiQuickIsDefEqDomainInitial _ _ m
+
+@[simp] private theorem annotatedPiWhnfCoreSortCheap
+    (fuel : Nat) (state : TypeChecker.State) :
+    TypeChecker.Inner.whnfCore (.sort .zero) true
+        (TypeChecker.Methods.withFuel (fuel + 3))
+        annotatedPiCtorCandidateContext.toTypeChecker state =
+      .ok (.sort .zero, state) := by
+  rfl
+
+private theorem annotatedPiIsDefEqCoreDomain
+    (fuel : Nat) (initial : Std.HashSet (Expr × Expr) := {}) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEqCore'
+          annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 3))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (true, state) := by
+  obtain ⟨r, m, hquick, hr⟩ := annotatedPiQuickIsDefEqDomainInitial
+    (TypeChecker.Methods.withFuel (fuel + 3))
+    annotatedPiCtorCandidateContext.toTypeChecker initial
+  unfold TypeChecker.Inner.isDefEqCore'
+  rw [normalizationRecMBind]
+  rw [hquick]
+  rcases hr with htrue | hundef
+  · subst r
+    simp only
+    rw [show (LBool.true != LBool.undef) = true by rfl]
+    simp only [if_true]
+    exact ⟨({ success := m } : TypeChecker.State), rfl⟩
+  · subst r
+    simp only
+    rw [show (LBool.undef != LBool.undef) = false by rfl]
+    simp only [Bool.false_eq_true, if_false]
+    rw [normalizationRecMBind]
+    rw [normalizationRecMReadContext]
+    simp only
+    rw [show ((.sort .zero : Expr).isConstOf ``true) = false by rfl]
+    simp only [Bool.and_false, Bool.false_eq_true, if_false]
+    rw [normalizationRecMBind]
+    rw [annotatedPiWhnfCoreDomainCheap fuel]
+    simp only
+    rw [normalizationRecMBind]
+    rw [annotatedPiWhnfCoreSortCheap fuel]
+    simp only
+    cases hptr :
+        (!(ptrEqExpr annotatedPiRawDomainKernel annotatedPiRawDomainKernel &&
+          ptrEqExpr (.sort .zero) (.sort .zero)))
+    · simp only [Bool.false_eq_true, if_false]
+      rw [normalizationRecMBind]
+      rw [annotatedPiIsDefEqProofIrrelDomain fuel]
+      simp only
+      rw [show (LBool.undef != LBool.undef) = false by rfl]
+      simp only [Bool.false_eq_true, if_false]
+      rw [normalizationRecMBind]
+      obtain ⟨m'', hlazy⟩ := annotatedPiLazyDeltaDomain fuel m
+      rw [hlazy]
+      refine ⟨annotatedPiWithSuccessCache
+        (annotatedPiOutParamUnfoldState
+          (annotatedPiSortOneInferOnlyState m)) m'', ?_⟩
+      rfl
+    · simp only [if_true]
+      obtain ⟨r, m', hquick', hr⟩ :=
+        annotatedPiQuickIsDefEqDomainAny fuel m
+      rw [normalizationRecMBind]
+      rw [hquick']
+      simp only
+      rcases hr with htrue | hundef
+      · subst r
+        rw [show (LBool.true != LBool.undef) = true by rfl]
+        simp only [if_true]
+        refine ⟨({ success := m' } : TypeChecker.State), ?_⟩
+        rfl
+      · subst r
+        rw [show (LBool.undef != LBool.undef) = false by rfl]
+        simp only [Bool.false_eq_true, if_false]
+        rw [normalizationRecMBind]
+        rw [annotatedPiIsDefEqProofIrrelDomain fuel]
+        simp only
+        rw [show (LBool.undef != LBool.undef) = false by rfl]
+        simp only [Bool.false_eq_true, if_false]
+        rw [normalizationRecMBind]
+        obtain ⟨m'', hlazy⟩ := annotatedPiLazyDeltaDomain fuel m'
+        rw [hlazy]
+        refine ⟨annotatedPiWithSuccessCache
+          (annotatedPiOutParamUnfoldState
+            (annotatedPiSortOneInferOnlyState m')) m'', ?_⟩
+        rfl
+
+private theorem annotatedPiDomain_isDefEqInner
+    (fuel : Nat) (initial : Std.HashSet (Expr × Expr) := {}) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEq annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 4))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (true, state) := by
+  obtain ⟨state, hcore⟩ := annotatedPiIsDefEqCoreDomain fuel initial
+  have hcore' :
+      TypeChecker.Inner.isDefEqCore
+          annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 4))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (true, state) := by
+    change
+      TypeChecker.Inner.isDefEqCore'
+          annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel (fuel + 3))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (true, state)
+    exact hcore
+  unfold TypeChecker.Inner.isDefEq
+  rw [show
+    (annotatedPiRawDomainKernel == (.sort .zero : Expr)) = false by
+      exact annotatedPiApp_beq_sort _ _ _]
+  simp only [Bool.false_eq_true, if_false, normalizationRecMBind]
+  rw [hcore']
+  exact ⟨_, rfl⟩
+
+private theorem annotatedPiDomain_isDefEqM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.isDefEq annotatedPiRawDomainKernel (.sort .zero)) =
+        .ok true := by
+  obtain ⟨state, hrun⟩ := annotatedPiDomain_isDefEqInner 9996
+  change
+    Except.map (fun x : Bool × TypeChecker.State => x.1)
+      (TypeChecker.Inner.isDefEq
+        annotatedPiRawDomainKernel (.sort .zero)
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok true
+  rw [show TypeChecker.Inner.isDefEq
+      annotatedPiRawDomainKernel (.sort .zero)
+      (TypeChecker.Methods.withFuel 10000)
+      annotatedPiCtorCandidateContext.toTypeChecker
+      ({} : TypeChecker.State) = .ok (true, state) by
+    simpa only [Nat.reduceAdd] using hrun]
+  rfl
+
+private theorem annotatedPiInner_checkTypeM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.checkType annotatedPiInnerKernel) =
+        .ok (.sort (.succ .zero)) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiInnerKernel false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' annotatedPiInnerKernel false
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  unfold annotatedPiInnerKernel TypeChecker.Inner.inferType'
+  simp [annotatedPiRawDomainKernel, Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferType', TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [annotatedPiIsDefEqSort 9998]
+  simp [Expr.instantiate1', annotatedPiWithLocalDecl, annotatedPiCtorCandidateContext,
+    AddInductive.Context.toTypeChecker, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  simp [Expr.sortLevel!, annotatedPi_mkLevelIMaxSuccZero]
+  rfl
+
+private theorem annotatedPiInner_whnfM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.whnf annotatedPiInnerKernel) =
+        .ok annotatedPiInnerKernel := by
+  rfl
+
+private theorem annotatedPiInner_isDefEqM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.isDefEq annotatedPiInnerKernel
+        annotatedPiInnerKernel) = .ok true := by
+  change
+    Except.map (fun x : Bool × TypeChecker.State => x.1)
+      (TypeChecker.Inner.isDefEq annotatedPiInnerKernel
+        annotatedPiInnerKernel (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) = .ok true
+  unfold TypeChecker.Inner.isDefEq
+  rw [if_pos (Expr.eqv_refl _)]
+  rfl
+
+private theorem annotatedPiConst_checkTypeM (lctx : LocalContext) :
+    TypeChecker.M.run annotatedPiTypeKernelEnv .safe lctx []
+      ({} : FuelConfig)
+      (TypeChecker.checkType (.const ``AnnotatedPi [])) =
+        .ok (.sort (.succ .zero)) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType (.const ``AnnotatedPi []) false
+        (TypeChecker.Methods.withFuel 10000)
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  rw [annotatedPiInferTypeFamily 9999 lctx
+    ({} : TypeChecker.State) Std.HashMap.getElem?_empty]
+  rfl
+
+private def annotatedPiNormalizationRawContext
+    (lctx : LocalContext) : TypeChecker.Context :=
+  { env := annotatedPiTypeKernelEnv, lctx := lctx }
+
+private theorem unfoldAnnotatedPi (lctx methods state) :
+    TypeChecker.Inner.unfoldDefinition (.const ``AnnotatedPi [])
+        methods (annotatedPiNormalizationRawContext lctx) state =
+      .ok (none, state) := by
+  change
+    TypeChecker.Inner.unfoldDefinitionCore (.const ``AnnotatedPi [])
+        methods (annotatedPiNormalizationRawContext lctx) state =
+      .ok (none, state)
+  simp [TypeChecker.Inner.unfoldDefinitionCore, TypeChecker.Inner.isDelta,
+    Expr.getAppFn, annotatedPiNormalizationRawContext,
+    annotatedPiType_lookup_family, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind, annotatedPiInfo, ConstantInfo.deltaValue?]
+
+private theorem whnfLoopAnnotatedPi (lctx methods state n) :
+    TypeChecker.Inner.whnf'.loop (.const ``AnnotatedPi []) (n + 1)
+        methods (annotatedPiNormalizationRawContext lctx) state =
+      .ok (.const ``AnnotatedPi [], state) := by
+  unfold TypeChecker.Inner.whnf'.loop
+  simp [unfoldAnnotatedPi]
+
+private theorem annotatedPiConst_whnfM (lctx : LocalContext) :
+    TypeChecker.M.run annotatedPiTypeKernelEnv .safe lctx []
+      ({} : FuelConfig)
+      (TypeChecker.whnf (.const ``AnnotatedPi [])) =
+        .ok (.const ``AnnotatedPi []) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.whnf' (.const ``AnnotatedPi [])
+        (TypeChecker.Methods.withFuel 9999)
+        (annotatedPiNormalizationRawContext lctx)
+        ({} : TypeChecker.State)) =
+      .ok (.const ``AnnotatedPi [])
+  unfold TypeChecker.Inner.whnf'
+  simp
+  rw [show
+    (if (annotatedPiNormalizationRawContext lctx).eagerReduce then
+      (annotatedPiNormalizationRawContext lctx).fuel.whnfEager
+    else (annotatedPiNormalizationRawContext lctx).fuel.whnf) =
+        100000 by rfl]
+  rw [show 100000 = 99999 + 1 by rfl]
+  rw [whnfLoopAnnotatedPi]
+  simp [Functor.map, StateT.map, Except.map]
+
+private def annotatedPiFamilyCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := annotatedPiFamilyCandidateContext
+  source := annotatedPiInfo.type
+  result := annotatedPiInfo.type
+
+private theorem annotatedPiFamilyCandidateStep_valid :
+    annotatedPiFamilyCandidateStep.Valid := by
+  exact annotatedPiFamily_whnfM
+
+private def annotatedPiFamilyCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := annotatedPiFamilyCandidateContext
+  source := annotatedPiInfo.type
+  inferred := .sort (.succ (.succ .zero))
+
+private theorem annotatedPiFamilyCheckTypeStep_valid :
+    annotatedPiFamilyCheckTypeStep.Valid := by
+  exact annotatedPiFamily_checkTypeM
+
+private def annotatedPiCtorCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := annotatedPiCtorCandidateContext
+  source := annotatedPiMkInfo.type
+  result := annotatedPiMkInfo.type
+
+private theorem annotatedPiCtorCandidateStep_valid :
+    annotatedPiCtorCandidateStep.Valid := by
+  exact annotatedPiCtor_whnfM
+
+private def annotatedPiCtorCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := annotatedPiCtorCandidateContext
+  source := annotatedPiMkInfo.type
+  inferred := .sort (.succ .zero)
+
+private theorem annotatedPiCtorCheckTypeStep_valid :
+    annotatedPiCtorCheckTypeStep.Valid := by
+  exact annotatedPiCtor_checkTypeM
+
+private def annotatedPiInnerCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := annotatedPiCtorCandidateContext
+  source := annotatedPiInnerKernel
+  result := annotatedPiInnerKernel
+
+private theorem annotatedPiInnerCandidateStep_valid :
+    annotatedPiInnerCandidateStep.Valid := by
+  exact annotatedPiInner_whnfM
+
+private def annotatedPiInnerCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := annotatedPiCtorCandidateContext
+  source := annotatedPiInnerKernel
+  inferred := .sort (.succ .zero)
+
+private theorem annotatedPiInnerCheckTypeStep_valid :
+    annotatedPiInnerCheckTypeStep.Valid := by
+  exact annotatedPiInner_checkTypeM
+
+private def annotatedPiDomainCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := annotatedPiCtorCandidateContext
+  source := annotatedPiRawDomainKernel
+  result := .sort .zero
+
+private theorem annotatedPiDomainCandidateStep_valid :
+    annotatedPiDomainCandidateStep.Valid := by
+  exact annotatedPiDomain_whnfM
+
+private def annotatedPiDomainCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := annotatedPiCtorCandidateContext
+  source := annotatedPiRawDomainKernel
+  inferred := .sort (.succ .zero)
+
+private theorem annotatedPiDomainCheckTypeStep_valid :
+    annotatedPiDomainCheckTypeStep.Valid := by
+  exact annotatedPiDomain_checkTypeM
+
+private def annotatedPiDomainAnnotations :
+    AddInductive.CandidateTypeAnnotations
+      annotatedPiRawDomainKernel where
+  consumed := .sort .zero
+  trace := .outParam [.succ .zero] (.sort .zero) (.identity _)
+
+private theorem annotatedPiDomainAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨annotatedPiCtorCandidateContext,
+        annotatedPiRawDomainKernel,
+        annotatedPiDomainAnnotations.consumed⟩ := by
+  exact annotatedPiDomain_isDefEqM
+
+private def annotatedPiInnerAnnotations :
+    AddInductive.CandidateTypeAnnotations annotatedPiInnerKernel where
+  consumed := annotatedPiInnerKernel
+  trace := .identity _
+
+private theorem annotatedPiInnerAnnotationsEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨annotatedPiCtorCandidateContext, annotatedPiInnerKernel,
+        annotatedPiInnerAnnotations.consumed⟩ := by
+  exact annotatedPiInner_isDefEqM
+
+private def annotatedPiInnerBodyCandidateContext :
+    AddInductive.Context :=
+  annotatedPiCtorCandidateContext.pushLocalDecl
+    `p .default annotatedPiDomainAnnotations.consumed
+
+private def annotatedPiOuterBodyCandidateContext :
+    AddInductive.Context :=
+  annotatedPiCtorCandidateContext.pushLocalDecl
+    annotatedPiOuterName .default annotatedPiInnerAnnotations.consumed
+
+@[simp] private theorem addInductiveWithReader_apply
+    {alpha : Type} (f : AddInductive.Context → AddInductive.Context)
+    (x : AddInductive.M alpha) (context : AddInductive.Context) :
+    (withReader f x) context = x (f context) := rfl
+
+@[simp] private theorem addInductiveWithLocalReader_apply
+    {alpha : Type} (f : LocalContext → LocalContext)
+    (x : AddInductive.M alpha) (context : AddInductive.Context) :
+    (MonadWithReaderOf.withReader (m := AddInductive.M) f x) context =
+      x { context with lctx := f context.lctx } := rfl
+
+private theorem annotatedPiCtorCandidateFresh :
+    annotatedPiCtorCandidateContext.lctx.find?
+        annotatedPiCtorCandidateContext.freshFVarId = none := by
+  have h := LocalContext.WF.find?_eq_find?_toList
+    (fv := annotatedPiCtorCandidateContext.freshFVarId)
+    LocalContext.WF.nil
+  change
+    ({ fvarIdToDecl := PersistentHashMap.empty,
+       decls := PersistentArray.empty,
+       auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+      annotatedPiCtorCandidateContext.freshFVarId = none
+  rw [h]
+  simp [LocalContext.toList]
+
+@[simp] private theorem annotatedPiConst_instantiate1 (arg : Expr) :
+    (Expr.const ``AnnotatedPi []).instantiate1 arg =
+      .const ``AnnotatedPi [] := by
+  simp [Expr.instantiate1_eq, Expr.instantiate1']
+
+@[simp] private theorem annotatedPiConst_instantiate1' (arg : Expr) :
+    (Expr.const ``AnnotatedPi []).instantiate1' arg =
+      .const ``AnnotatedPi [] := by
+  rfl
+
+private def annotatedPiInnerBodyCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := annotatedPiInnerBodyCandidateContext
+  source := .const ``AnnotatedPi []
+  result := .const ``AnnotatedPi []
+
+private theorem annotatedPiInnerBodyCandidateStep_valid :
+    annotatedPiInnerBodyCandidateStep.Valid := by
+  exact annotatedPiConst_whnfM _
+
+private def annotatedPiInnerBodyCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := annotatedPiInnerBodyCandidateContext
+  source := .const ``AnnotatedPi []
+  inferred := .sort (.succ .zero)
+
+private theorem annotatedPiInnerBodyCheckTypeStep_valid :
+    annotatedPiInnerBodyCheckTypeStep.Valid := by
+  exact annotatedPiConst_checkTypeM _
+
+private def annotatedPiOuterBodyCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := annotatedPiOuterBodyCandidateContext
+  source := .const ``AnnotatedPi []
+  result := .const ``AnnotatedPi []
+
+private theorem annotatedPiOuterBodyCandidateStep_valid :
+    annotatedPiOuterBodyCandidateStep.Valid := by
+  exact annotatedPiConst_whnfM _
+
+private def annotatedPiOuterBodyCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := annotatedPiOuterBodyCandidateContext
+  source := .const ``AnnotatedPi []
+  inferred := .sort (.succ .zero)
+
+private theorem annotatedPiOuterBodyCheckTypeStep_valid :
+    annotatedPiOuterBodyCheckTypeStep.Valid := by
+  exact annotatedPiConst_checkTypeM _
+
+private def annotatedPiDomainCandidateTrace :
+    AddInductive.CandidateExprTrace annotatedPiCtorCandidateContext
+      annotatedPiRawDomainKernel :=
+  .terminal annotatedPiCtorCandidateContext
+    annotatedPiRawDomainKernel (.sort (.succ .zero)) (.sort .zero)
+    annotatedPiDomainCheckTypeStep_valid
+    annotatedPiDomainCandidateStep_valid
+
+private def annotatedPiInnerBodyCandidateTrace :
+    AddInductive.CandidateExprTrace annotatedPiInnerBodyCandidateContext
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr) :=
+  .terminal annotatedPiInnerBodyCandidateContext
+    ((Expr.const ``AnnotatedPi []).instantiate1
+      annotatedPiCtorCandidateContext.freshExpr)
+    (.sort (.succ .zero))
+    (.const ``AnnotatedPi [])
+    (by simpa only [annotatedPiInnerBodyCheckTypeStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiInnerBodyCheckTypeStep_valid)
+    (by simpa only [annotatedPiInnerBodyCandidateStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiInnerBodyCandidateStep_valid)
+
+private def annotatedPiOuterBodyCandidateTrace :
+    AddInductive.CandidateExprTrace annotatedPiOuterBodyCandidateContext
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr) :=
+  .terminal annotatedPiOuterBodyCandidateContext
+    ((Expr.const ``AnnotatedPi []).instantiate1
+      annotatedPiCtorCandidateContext.freshExpr)
+    (.sort (.succ .zero))
+    (.const ``AnnotatedPi [])
+    (by simpa only [annotatedPiOuterBodyCheckTypeStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiOuterBodyCheckTypeStep_valid)
+    (by simpa only [annotatedPiOuterBodyCandidateStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiOuterBodyCandidateStep_valid)
+
+private def annotatedPiInnerCandidateTrace :
+    AddInductive.CandidateExprTrace annotatedPiCtorCandidateContext
+      annotatedPiInnerKernel :=
+  .forallE annotatedPiCtorCandidateContext annotatedPiInnerKernel
+    (.sort (.succ .zero)) `p annotatedPiRawDomainKernel
+    (.const ``AnnotatedPi []) .default annotatedPiCtorCandidateFresh
+    annotatedPiDomainAnnotations annotatedPiDomainAnnotationsEq
+    annotatedPiInnerCheckTypeStep_valid
+    annotatedPiInnerCandidateStep_valid
+    annotatedPiDomainCandidateTrace annotatedPiInnerBodyCandidateTrace
+
+private def annotatedPiCtorCandidateTrace :
+    AddInductive.CandidateExprTrace annotatedPiCtorCandidateContext
+      annotatedPiMkInfo.type :=
+  .forallE annotatedPiCtorCandidateContext annotatedPiMkInfo.type
+    (.sort (.succ .zero)) annotatedPiOuterName annotatedPiInnerKernel
+    (.const ``AnnotatedPi []) .default annotatedPiCtorCandidateFresh
+    annotatedPiInnerAnnotations annotatedPiInnerAnnotationsEq
+    annotatedPiCtorCheckTypeStep_valid annotatedPiCtorCandidateStep_valid
+    annotatedPiInnerCandidateTrace annotatedPiOuterBodyCandidateTrace
+
+private def annotatedPiFamilyCandidate :
+    AddInductive.CandidateExpr annotatedPiInfo.type :=
+  ⟨annotatedPiFamilyCandidateContext,
+    .terminal annotatedPiFamilyCandidateContext annotatedPiInfo.type
+      (.sort (.succ (.succ .zero))) annotatedPiInfo.type
+      annotatedPiFamilyCheckTypeStep_valid
+      annotatedPiFamilyCandidateStep_valid⟩
+
+private def annotatedPiCtorCandidate :
+    AddInductive.CandidateExpr annotatedPiMkInfo.type :=
+  ⟨annotatedPiCtorCandidateContext, annotatedPiCtorCandidateTrace⟩
+
+private def annotatedPiConstructorCandidate :
+    AddInductive.CandidateConstructor annotatedPiKernelCtor :=
+  ⟨annotatedPiCtorCandidate⟩
+
+private def annotatedPiFamilyListCandidate :
+    AddInductive.CandidateFamily annotatedPiKernelType where
+  familyType := ⟨annotatedPiFamilyCandidate⟩
+  constructors := .cons annotatedPiConstructorCandidate .nil
+
+private def annotatedPiNormalizationCandidate :
+    AddInductive.NormalizationCandidate [annotatedPiKernelType] where
+  families := .cons annotatedPiFamilyListCandidate .nil
+
+private def annotatedPiInductiveStats : AddInductive.InductiveStats where
+  levels := []
+  resultLevel := .succ .zero
+  nindices := #[0]
+  indConsts := #[.const ``AnnotatedPi []]
+  params := #[]
+  isNotZero := true
+
+private theorem annotatedPiSortOne_data_hasExprMVar_false :
+    (Expr.sort (.succ .zero)).data.hasExprMVar = false := by
+  change (Expr.sort (.succ .zero)).hasExprMVar = false
+  rw [Expr.hasExprMVar_eq]
+  rfl
+
+private theorem annotatedPiSortOne_data_hasLevelMVar_false :
+    (Expr.sort (.succ .zero)).data.hasLevelMVar = false := by
+  change (Expr.sort (.succ .zero)).hasLevelMVar = false
+  rw [Expr.hasLevelMVar_eq]
+  simp [Expr.hasLevelMVar', Level.hasMVar_eq, Level.hasMVar']
+
+private theorem annotatedPiSortOne_data_hasFVar_false :
+    (Expr.sort (.succ .zero)).data.hasFVar = false := by
+  change (Expr.sort (.succ .zero)).hasFVar = false
+  rw [Expr.hasFVar_eq]
+  rfl
+
+private theorem annotatedPi_checkInductiveTypes
+    (k : AddInductive.InductiveStats → AddInductive.M α) :
+    AddInductive.checkInductiveTypes 0 #[annotatedPiKernelType] k
+        annotatedPiFamilyCandidateContext =
+      k annotatedPiInductiveStats annotatedPiFamilyCandidateContext := by
+  apply AddInductive.checkInductiveTypes_singleton_zero_of_whnf_sort
+  · decide
+  · simp [Kernel.Environment.checkNoMVarNoFVar,
+      Kernel.Environment.checkNoMVar, Kernel.Environment.checkNoFVar,
+      annotatedPiKernelType, annotatedPiInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal, Expr.hasMVar, Expr.hasFVar,
+      annotatedPiSortOne_data_hasExprMVar_false,
+      annotatedPiSortOne_data_hasLevelMVar_false,
+      annotatedPiSortOne_data_hasFVar_false,
+      Bind.bind, Except.bind, Pure.pure, Except.pure]
+  · simpa [annotatedPiFamilyCandidateContext,
+      annotatedPiKernelType] using annotatedPiFamily_checkTypeM
+  · simpa [annotatedPiFamilyCandidateContext,
+      annotatedPiKernelType, annotatedPiInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal] using annotatedPiFamily_whnfM
+  · rfl
+
+private theorem annotatedPiFamilyEnv_not_contains :
+    outParamKernelEnv.contains ``AnnotatedPi = false := by
+  unfold Kernel.Environment.contains
+  change outParamMap.contains ``AnnotatedPi = false
+  rw [SMap.find?_isSome, annotatedPiType_fresh]
+  rfl
+
+private theorem annotatedPiFamilyEnv_checkName :
+    outParamKernelEnv.checkName ``AnnotatedPi false = .ok () := by
+  simp [Kernel.Environment.checkName, annotatedPiFamilyEnv_not_contains,
+    Kernel.Environment.primitives, NameSet.ofList, NameSet.contains, Pure.pure, Except.pure]
+
+private theorem annotatedPiInner_hasIndOcc :
+    AddInductive.hasIndOcc #[.const ``AnnotatedPi []]
+      annotatedPiInnerKernel = true := by
+  simp [AddInductive.hasIndOcc, annotatedPiInnerKernel,
+    annotatedPiRawDomainKernel, Expr.constName!]
+
+private theorem annotatedPi_declareInductiveTypes :
+    AddInductive.declareInductiveTypes annotatedPiInductiveStats 0
+        #[annotatedPiKernelType] 0 false annotatedPiFamilyCandidateContext =
+      .ok annotatedPiTypeKernelEnv := by
+  simp [AddInductive.declareInductiveTypes, annotatedPiInductiveStats,
+    annotatedPiKernelType, annotatedPiKernelCtor,
+    annotatedPiInfo, annotatedPiMkInfo, ConstantInfo.name,
+    ConstantInfo.type, ConstantInfo.toConstantVal,
+    annotatedPiFamilyCandidateContext, annotatedPiTypeKernelEnv,
+    outParamKernelEnv, annotatedPiTypeMap,
+    AddInductive.isRec, AddInductive.isRec.loop,
+    AddInductive.isReflexive, AddInductive.isReflexive.loop,
+    AddInductive.hasIndOcc, Expr.constName!,
+    Bind.bind, Pure.pure, Except.bind, Except.pure]
+  rw [show (Kernel.Environment.ofConstants `_annotatedPiCandidate
+      outParamMap).checkName ``AnnotatedPi = .ok () by
+    simpa [outParamKernelEnv] using annotatedPiFamilyEnv_checkName]
+  rfl
+
+private theorem annotatedPiCtor_data_hasExprMVar_false :
+    annotatedPiMkInfo.type.data.hasExprMVar = false := by
+  change annotatedPiMkInfo.type.hasExprMVar = false
+  rw [Expr.hasExprMVar_eq]
+  rfl
+
+private theorem annotatedPiCtor_data_hasLevelMVar_false :
+    annotatedPiMkInfo.type.data.hasLevelMVar = false := by
+  change annotatedPiMkInfo.type.hasLevelMVar = false
+  rw [Expr.hasLevelMVar_eq]
+  simp [annotatedPiMkInfo, ConstantInfo.type,
+    ConstantInfo.toConstantVal, Expr.hasLevelMVar',
+    Level.hasMVar_eq, Level.hasMVar']
+
+private theorem annotatedPiCtor_data_hasFVar_false :
+    annotatedPiMkInfo.type.data.hasFVar = false := by
+  change annotatedPiMkInfo.type.hasFVar = false
+  rw [Expr.hasFVar_eq]
+  rfl
+
+private theorem annotatedPiCtor_noMVarNoFVar :
+    annotatedPiTypeKernelEnv.checkNoMVarNoFVar
+        annotatedPiMkInfo.name annotatedPiMkInfo.type = .ok () := by
+  simp [Kernel.Environment.checkNoMVarNoFVar,
+    Kernel.Environment.checkNoMVar, Kernel.Environment.checkNoFVar,
+    Expr.hasMVar, Expr.hasFVar,
+    annotatedPiCtor_data_hasExprMVar_false,
+    annotatedPiCtor_data_hasLevelMVar_false,
+    annotatedPiCtor_data_hasFVar_false,
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+@[simp] private theorem annotatedPiInferConstantFamilyOnly
+    (lctx : LocalContext) :
+    TypeChecker.Inner.inferConstant
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        ``AnnotatedPi [] true =
+      .ok (.sort (.succ .zero)) := by
+  unfold TypeChecker.Inner.inferConstant
+  rw [show annotatedPiTypeKernelEnv.get ``AnnotatedPi =
+    .ok annotatedPiInfo by exact annotatedPiType_get_family]
+  simp [annotatedPiInfo, Bind.bind, Except.bind,
+    annotatedPiExceptPure, ConstantInfo.levelParams,
+    ConstantInfo.instantiateTypeLevelParams,
+    ConstantInfo.toConstantVal,
+    ConstantVal.instantiateTypeLevelParams,
+    Expr.instantiateLevelParams_eq,
+    Expr.instantiateLevelParamsCore_id]
+
+private theorem annotatedPiInferTypeFamilyOnly
+    (n : Nat) (lctx : LocalContext) (state : TypeChecker.State)
+    (hcache :
+      state.inferTypeI[(.const ``AnnotatedPi [] : Expr)]? = none) :
+    TypeChecker.Inner.inferType (.const ``AnnotatedPi []) true
+        (TypeChecker.Methods.withFuel (n + 1))
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        state =
+      .ok (.sort (.succ .zero),
+        { state with
+          inferTypeI := state.inferTypeI.insert
+            (.const ``AnnotatedPi []) (.sort (.succ .zero)) }) := by
+  change
+    TypeChecker.Inner.inferType' (.const ``AnnotatedPi []) true
+        (TypeChecker.Methods.withFuel n)
+        ({ env := annotatedPiTypeKernelEnv, lctx := lctx } :
+          TypeChecker.Context)
+        state = _
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', hcache,
+    annotatedPiInferConstantFamilyOnly,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private def annotatedPiInnerInferOnlyLCtx : LocalContext :=
+  ({} : LocalContext).mkLocalDecl
+    ⟨({} : TypeChecker.State).ngen.curr⟩ `p
+    annotatedPiRawDomainKernel .default
+
+private def annotatedPiInnerInferOnlyState : TypeChecker.State :=
+  { annotatedPiDomainInferOnlyState {} with
+    ngen := ({} : TypeChecker.State).ngen.next }
+
+private def annotatedPiFamilyInferOnlyState : TypeChecker.State :=
+  { annotatedPiInnerInferOnlyState with
+    inferTypeI := annotatedPiInnerInferOnlyState.inferTypeI.insert
+      (.const ``AnnotatedPi []) (.sort (.succ .zero)) }
+
+@[simp] private theorem annotatedPiInnerInferOnlyState_family_miss :
+    annotatedPiInnerInferOnlyState.inferTypeI[
+        (.const ``AnnotatedPi [] : Expr)]? = none := by
+  simp [annotatedPiInnerInferOnlyState,
+    annotatedPiDomainInferOnlyState, annotatedPiRawDomainKernel,
+    annotatedPiOutParamFnType]
+
+@[simp] private theorem annotatedPiInferTypeFamilyAfterDomainOnly :
+    TypeChecker.Inner.inferType' (.const ``AnnotatedPi []) true
+        (TypeChecker.Methods.withFuel 9998)
+        ({ env := annotatedPiTypeKernelEnv, lctx :=
+          annotatedPiInnerInferOnlyLCtx } :
+          TypeChecker.Context)
+        annotatedPiInnerInferOnlyState =
+      .ok (.sort (.succ .zero), annotatedPiFamilyInferOnlyState) := by
+  change
+    TypeChecker.Inner.inferType (.const ``AnnotatedPi []) true
+        (TypeChecker.Methods.withFuel 9999)
+        ({ env := annotatedPiTypeKernelEnv, lctx :=
+          annotatedPiInnerInferOnlyLCtx } :
+          TypeChecker.Context)
+        annotatedPiInnerInferOnlyState = _
+  simpa [annotatedPiFamilyInferOnlyState] using
+    annotatedPiInferTypeFamilyOnly 9998 annotatedPiInnerInferOnlyLCtx
+      annotatedPiInnerInferOnlyState
+      annotatedPiInnerInferOnlyState_family_miss
+
+private theorem annotatedPiInferTypeFamilyAfterDomainOnly_exact :
+    TypeChecker.Inner.inferType (.const ``AnnotatedPi []) true
+        (TypeChecker.Methods.withFuel 9999)
+        { annotatedPiCtorCandidateContext.toTypeChecker with
+          lctx := annotatedPiCtorCandidateContext.toTypeChecker.lctx.mkLocalDecl
+            ⟨(annotatedPiDomainInferOnlyState {}).ngen.curr⟩ `p
+            annotatedPiRawDomainKernel .default }
+        { annotatedPiDomainInferOnlyState {} with
+          ngen := (annotatedPiDomainInferOnlyState {}).ngen.next } =
+      .ok (.sort (.succ .zero), annotatedPiFamilyInferOnlyState) := by
+  simpa [annotatedPiInnerInferOnlyLCtx,
+    annotatedPiInnerInferOnlyState, annotatedPiCtorCandidateContext,
+    annotatedPiDomainInferOnlyState,
+    AddInductive.Context.toTypeChecker] using
+      annotatedPiInferTypeFamilyAfterDomainOnly
+
+private theorem annotatedPiInferTypeFamilyAfterDomainOnly_literal :
+    TypeChecker.Inner.inferType (.const ``AnnotatedPi []) true
+        (TypeChecker.Methods.withFuel 9999)
+        { env := annotatedPiCtorCandidateContext.toTypeChecker.env
+          lctx := annotatedPiCtorCandidateContext.toTypeChecker.lctx.mkLocalDecl
+            { name := (annotatedPiDomainInferOnlyState {}).ngen.curr } `p
+            (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+            .default
+          safety := annotatedPiCtorCandidateContext.toTypeChecker.safety
+          eagerReduce :=
+            annotatedPiCtorCandidateContext.toTypeChecker.eagerReduce
+          lparams := annotatedPiCtorCandidateContext.toTypeChecker.lparams
+          fuel := annotatedPiCtorCandidateContext.toTypeChecker.fuel }
+        { ngen := (annotatedPiDomainInferOnlyState {}).ngen.next
+          inferTypeI := (annotatedPiDomainInferOnlyState {}).inferTypeI
+          inferTypeC := (annotatedPiDomainInferOnlyState {}).inferTypeC
+          whnfCoreCache :=
+            (annotatedPiDomainInferOnlyState {}).whnfCoreCache
+          whnfCache := (annotatedPiDomainInferOnlyState {}).whnfCache
+          success := (annotatedPiDomainInferOnlyState {}).success
+          failure := (annotatedPiDomainInferOnlyState {}).failure
+          unfold := (annotatedPiDomainInferOnlyState {}).unfold } =
+      .ok (.sort (.succ .zero), annotatedPiFamilyInferOnlyState) := by
+  simpa [annotatedPiRawDomainKernel] using
+    annotatedPiInferTypeFamilyAfterDomainOnly_exact
+
+private def annotatedPiInnerInferOnlyFinalState : TypeChecker.State :=
+  { annotatedPiFamilyInferOnlyState with
+    inferTypeI := annotatedPiFamilyInferOnlyState.inferTypeI.insert
+      annotatedPiInnerKernel (.sort (.succ .zero)) }
+
+set_option maxRecDepth 10000 in
+private theorem annotatedPiInner_inferTypeInner :
+    TypeChecker.Inner.inferType annotatedPiInnerKernel true
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) =
+      .ok (.sort (.succ .zero),
+        annotatedPiInnerInferOnlyFinalState) := by
+  change
+    TypeChecker.Inner.inferType' annotatedPiInnerKernel true
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State) = _
+  unfold annotatedPiInnerKernel TypeChecker.Inner.inferType'
+  simp [annotatedPiRawDomainKernel,
+    Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [annotatedPiInferTypeDomainOnly998]
+  simp only [TypeChecker.Inner.ensureSortCore, Expr.isSort, ↓reduceIte, annotatedPiWithLocalDecl,
+    annotatedPiRecMPure, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [annotatedPiInferTypeFamilyAfterDomainOnly_literal]
+  simp [Expr.sortLevel!, annotatedPiInnerInferOnlyFinalState,
+    annotatedPiInnerKernel, annotatedPiRawDomainKernel]
+
+private theorem annotatedPiInner_inferTypeM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.inferType annotatedPiInnerKernel) =
+        .ok (.sort (.succ .zero)) := by
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiInnerKernel true
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  rw [annotatedPiInner_inferTypeInner]
+  rfl
+
+private theorem annotatedPiInner_ensureTypeM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.ensureType annotatedPiInnerKernel) =
+        .ok (.sort (.succ .zero)) := by
+  unfold TypeChecker.ensureType TypeChecker.inferType
+    TypeChecker.ensureSort TypeChecker.RecM.run TypeChecker.M.run
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    Pure.pure, StateT.pure, Except.pure, StateT.run',
+    Functor.map, Except.map]
+  rw [show TypeChecker.Inner.inferType annotatedPiInnerKernel true
+      (TypeChecker.Methods.withFuel
+        annotatedPiCtorCandidateContext.fuel.recDepth)
+      { env := annotatedPiCtorCandidateContext.env
+        lctx := annotatedPiCtorCandidateContext.lctx
+        safety := annotatedPiCtorCandidateContext.safety
+        lparams := annotatedPiCtorCandidateContext.lparams
+        fuel := annotatedPiCtorCandidateContext.fuel }
+      ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero),
+          annotatedPiInnerInferOnlyFinalState) by
+    simpa [annotatedPiCtorCandidateContext,
+      AddInductive.Context.toTypeChecker] using
+        annotatedPiInner_inferTypeInner]
+  rfl
+
+private theorem annotatedPiCtor_getEnvM :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+        annotatedPiCtorCandidateContext.safety
+        annotatedPiCtorCandidateContext.lctx
+        annotatedPiCtorCandidateContext.lparams
+        annotatedPiCtorCandidateContext.fuel TypeChecker.getEnv =
+      .ok annotatedPiTypeKernelEnv := by
+  rfl
+
+private theorem annotatedPiRawDomain_hasIndOcc_false :
+    AddInductive.hasIndOcc annotatedPiInductiveStats.indConsts
+        annotatedPiRawDomainKernel = false := by
+  simp [AddInductive.hasIndOcc, annotatedPiInductiveStats,
+    annotatedPiRawDomainKernel, Expr.constName!]
+
+private theorem annotatedPiConst_isValidIndAppIdx :
+    AddInductive.isValidIndAppIdx annotatedPiInductiveStats
+        (.const ``AnnotatedPi []) 0 = true := by
+  simp +decide [AddInductive.isValidIndAppIdx,
+    annotatedPiInductiveStats, Expr.getAppFn, Expr.getAppArgs,
+    Expr.getAppNumArgs]
+
+private theorem annotatedPiInner_stats_hasIndOcc :
+    AddInductive.hasIndOcc annotatedPiInductiveStats.indConsts
+        annotatedPiInnerKernel = true := by
+  simpa [annotatedPiInductiveStats] using annotatedPiInner_hasIndOcc
+
+private theorem annotatedPiConst_hasIndOcc :
+    AddInductive.hasIndOcc annotatedPiInductiveStats.indConsts
+        (.const ``AnnotatedPi []) = true := by
+  simp [AddInductive.hasIndOcc, annotatedPiInductiveStats,
+    Expr.constName!]
+
+private theorem annotatedPiConst_isValidIndApp :
+    AddInductive.isValidIndApp? annotatedPiInductiveStats
+        (.const ``AnnotatedPi []) = some 0 := by
+  exact AddInductive.isValidIndApp?_singleton_zero
+    annotatedPiInductiveStats (.const ``AnnotatedPi []) rfl
+      annotatedPiConst_isValidIndAppIdx
+
+private theorem annotatedPi_checkPositivity_terminal :
+    AddInductive.checkPositivity.loop annotatedPiInductiveStats
+        annotatedPiMkInfo.name 0 (.const ``AnnotatedPi []) 999
+        annotatedPiInnerBodyCandidateContext = .ok () := by
+  rw [show 999 = 998 + 1 by rfl]
+  unfold AddInductive.checkPositivity.loop
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [show TypeChecker.M.run
+      annotatedPiInnerBodyCandidateContext.env
+      annotatedPiInnerBodyCandidateContext.safety
+      annotatedPiInnerBodyCandidateContext.lctx
+      annotatedPiInnerBodyCandidateContext.lparams
+      annotatedPiInnerBodyCandidateContext.fuel
+      (TypeChecker.whnf (.const ``AnnotatedPi [])) =
+        .ok (.const ``AnnotatedPi []) by
+    exact annotatedPiConst_whnfM _]
+  simp [annotatedPiConst_hasIndOcc, annotatedPiConst_isValidIndApp, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+
+private theorem annotatedPi_checkPositivity :
+    AddInductive.checkPositivity annotatedPiInductiveStats
+        annotatedPiInnerKernel annotatedPiMkInfo.name 0
+        annotatedPiCtorCandidateContext = .ok () := by
+  unfold AddInductive.checkPositivity
+  simp only [readThe, MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show annotatedPiCtorCandidateContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkPositivity.loop
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [annotatedPiInner_whnfM]
+  simp only [Except.bind]
+  rw [show AddInductive.hasIndOcc annotatedPiInductiveStats.indConsts
+      annotatedPiInnerKernel = true by
+    exact annotatedPiInner_stats_hasIndOcc]
+  simp only [Bool.not_true, Bool.false_eq_true, if_false, Pure.pure]
+  unfold annotatedPiInnerKernel
+  simp only
+  rw [show AddInductive.hasIndOcc annotatedPiInductiveStats.indConsts
+      annotatedPiRawDomainKernel = false by
+    exact annotatedPiRawDomain_hasIndOcc_false]
+  simp only [Bool.false_eq_true, if_false]
+  simpa [withLocalDecl, annotatedPiInnerBodyCandidateContext,
+    withFreshId, MonadLocalNameGenerator.withFreshId,
+    MonadWithReader.withReader, withTheReader,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshExpr, AddInductive.Context.freshFVarId,
+    AddInductive.consumeTypeAnnotations, annotatedPiDomainAnnotations,
+    annotatedPiRawDomainKernel, annotatedPiCtorCandidateContext] using
+      annotatedPi_checkPositivity_terminal
+
+private theorem annotatedPiInner_ensureTypeM_expanded :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+        annotatedPiCtorCandidateContext.safety
+        annotatedPiCtorCandidateContext.lctx
+        annotatedPiCtorCandidateContext.lparams
+        annotatedPiCtorCandidateContext.fuel
+        (TypeChecker.ensureType
+          (.forallE `p
+            (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+            (.const ``AnnotatedPi []) .default)) =
+      .ok (.sort (.succ .zero)) := by
+  simpa [annotatedPiInnerKernel, annotatedPiRawDomainKernel] using
+    annotatedPiInner_ensureTypeM
+
+private theorem annotatedPi_checkPositivity_expanded :
+    AddInductive.checkPositivity annotatedPiInductiveStats
+        (.forallE `p
+          (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+          (.const ``AnnotatedPi []) .default)
+        ``AnnotatedPi.mk 0 annotatedPiCtorCandidateContext = .ok () := by
+  simpa [annotatedPiMkInfo, ConstantInfo.name,
+    ConstantInfo.toConstantVal, annotatedPiInnerKernel,
+    annotatedPiRawDomainKernel] using annotatedPi_checkPositivity
+
+private theorem annotatedPi_checkConstructors_terminal :
+    AddInductive.checkConstructorType.loop annotatedPiInductiveStats false 0
+        ``AnnotatedPi.mk (.const ``AnnotatedPi []) 1 999
+        annotatedPiOuterBodyCandidateContext = .ok () := by
+  rw [show 999 = 998 + 1 by rfl]
+  unfold AddInductive.checkConstructorType.loop
+  simp [annotatedPiConst_isValidIndAppIdx,
+    ReaderT.pure, Pure.pure, Except.pure]
+
+private theorem annotatedPi_checkConstructors_terminal_expanded :
+    AddInductive.checkConstructorType.loop annotatedPiInductiveStats false 0
+        ``AnnotatedPi.mk (.const ``AnnotatedPi []) 1 999
+        ({ env := annotatedPiTypeKernelEnv
+           lctx := ({} : LocalContext).mkLocalDecl
+             ⟨({ namePrefix := `_ind_fresh } : NameGenerator).curr⟩
+             (.mkNum
+               (.mkStr
+                 (.mkStr (.mkStr (.mkStr .anonymous "a") "_@")
+                   "_internal") "_hyg") 0)
+             (.forallE `p
+               (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+               (.const ``AnnotatedPi []) .default)
+             .default
+           lparams := []
+           ngen := ({ namePrefix := `_ind_fresh } : NameGenerator).next
+           safety := .safe
+           allowPrimitive := false } : AddInductive.Context) = .ok () := by
+  simpa [annotatedPiOuterBodyCandidateContext,
+    AddInductive.Context.pushLocalDecl,
+    AddInductive.Context.freshFVarId,
+    annotatedPiInnerAnnotations, annotatedPiOuterName,
+    annotatedPiInnerKernel, annotatedPiRawDomainKernel,
+    annotatedPiCtorCandidateContext] using
+      annotatedPi_checkConstructors_terminal
+
+private theorem annotatedPiCtor_noMVarNoFVar_literal :
+    annotatedPiTypeKernelEnv.checkNoMVarNoFVar
+        ``AnnotatedPi.mk
+        (.forallE annotatedPiOuterName annotatedPiInnerKernel
+          (.const ``AnnotatedPi []) .default) = .ok () := by
+  simpa [annotatedPiMkInfo, ConstantInfo.name, ConstantInfo.type,
+    ConstantInfo.toConstantVal, annotatedPiInnerKernel,
+    annotatedPiRawDomainKernel, annotatedPiOuterName] using
+      annotatedPiCtor_noMVarNoFVar
+
+private theorem annotatedPiCtor_noMVarNoFVar_projected :
+    annotatedPiTypeKernelEnv.checkNoMVarNoFVar
+        annotatedPiMkInfo.toConstantVal.name annotatedPiMkInfo.type =
+      .ok () := by
+  simpa [ConstantInfo.name] using annotatedPiCtor_noMVarNoFVar
+
+private theorem annotatedPiCtor_checkTypeM_literal :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+        annotatedPiCtorCandidateContext.safety
+        annotatedPiCtorCandidateContext.lctx
+        annotatedPiCtorCandidateContext.lparams
+        annotatedPiCtorCandidateContext.fuel
+        (TypeChecker.checkType
+          (.forallE annotatedPiOuterName annotatedPiInnerKernel
+            (.const ``AnnotatedPi []) .default)) =
+      .ok (.sort (.succ .zero)) := by
+  simpa [annotatedPiMkInfo, ConstantInfo.type,
+    ConstantInfo.toConstantVal, annotatedPiInnerKernel,
+    annotatedPiRawDomainKernel, annotatedPiOuterName] using
+      annotatedPiCtor_checkTypeM
+
+private theorem annotatedPiCtor_noMVarNoFVar_expanded :
+    annotatedPiTypeKernelEnv.checkNoMVarNoFVar ``AnnotatedPi.mk
+        (.forallE
+          (.mkNum
+            (.mkStr
+              (.mkStr (.mkStr (.mkStr .anonymous "a") "_@")
+                "_internal") "_hyg") 0)
+          (.forallE `p
+            (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+            (.const ``AnnotatedPi []) .default)
+          (.const ``AnnotatedPi []) .default) = .ok () := by
+  simpa [annotatedPiMkInfo, ConstantInfo.name, ConstantInfo.type,
+    ConstantInfo.toConstantVal, annotatedPiOuterName,
+    annotatedPiInnerKernel, annotatedPiRawDomainKernel] using
+      annotatedPiCtor_noMVarNoFVar
+
+private theorem annotatedPiCtor_checkTypeM_expanded :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+        annotatedPiCtorCandidateContext.safety
+        annotatedPiCtorCandidateContext.lctx
+        annotatedPiCtorCandidateContext.lparams
+        annotatedPiCtorCandidateContext.fuel
+        (TypeChecker.checkType
+          (.forallE
+            (.mkNum
+              (.mkStr
+                (.mkStr (.mkStr (.mkStr .anonymous "a") "_@")
+                  "_internal") "_hyg") 0)
+            (.forallE `p
+              (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+              (.const ``AnnotatedPi []) .default)
+            (.const ``AnnotatedPi []) .default)) =
+      .ok (.sort (.succ .zero)) := by
+  simpa [annotatedPiMkInfo, ConstantInfo.type,
+    ConstantInfo.toConstantVal, annotatedPiOuterName,
+    annotatedPiInnerKernel, annotatedPiRawDomainKernel] using
+      annotatedPiCtor_checkTypeM
+
+private theorem annotatedPiCtor_checkTypeM_empty :
+    TypeChecker.M.run annotatedPiCtorCandidateContext.env
+        annotatedPiCtorCandidateContext.safety {}
+        annotatedPiCtorCandidateContext.lparams
+        annotatedPiCtorCandidateContext.fuel
+        (TypeChecker.checkType
+          (.forallE
+            (.mkNum
+              (.mkStr
+                (.mkStr (.mkStr (.mkStr .anonymous "a") "_@")
+                  "_internal") "_hyg") 0)
+            (.forallE `p
+              (.app (.const ``outParam [.succ .zero]) (.sort .zero))
+              (.const ``AnnotatedPi []) .default)
+            (.const ``AnnotatedPi []) .default)) =
+      .ok (.sort (.succ .zero)) := by
+  simpa [annotatedPiCtorCandidateContext] using
+    annotatedPiCtor_checkTypeM_expanded
+
+private theorem annotatedPi_checkConstructors :
+    AddInductive.checkConstructors #[annotatedPiKernelType]
+        annotatedPiInductiveStats false
+        annotatedPiCtorCandidateContext = .ok () := by
+  unfold AddInductive.checkConstructors
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [annotatedPiCtor_getEnvM]
+  simp only [Except.bind]
+  unfold AddInductive.checkConstructorsLoop AddInductive.checkConstructorFold
+  simp +decide [annotatedPiKernelType, annotatedPiKernelCtor, annotatedPiMkInfo, ConstantInfo.name,
+    ConstantInfo.type, ConstantInfo.toConstantVal]
+  rw [annotatedPiCtor_noMVarNoFVar_expanded]
+  simp only [ReaderT.bind, Bind.bind, Except.bind]
+  rw [AddInductive.withEmptyLocalContext_apply]
+  rw [AddInductive.liftTypeChecker_apply]
+  simp only
+  rw [annotatedPiCtor_checkTypeM_empty]
+  simp only []
+  unfold AddInductive.checkConstructorType
+  simp +decide [readThe, MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show annotatedPiCtorCandidateContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkConstructorType.loop
+  simp only
+  rw [show annotatedPiInductiveStats.params[0]? = none by rfl]
+  simp only
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [annotatedPiInner_ensureTypeM_expanded]
+  simp only [Except.bind]
+  rw [if_pos (show AddInductive.levelStructGe
+      annotatedPiInductiveStats.resultLevel
+      (Expr.sort (.succ .zero)).sortLevel! = true from rfl)]
+  simp only [Bool.not_false, ↓reduceIte, ReaderT.bind, Bind.bind, Except.bind]
+  rw [annotatedPi_checkPositivity_expanded]
+  simp only []
+  simp only [AddInductive.withLocalDecl_apply, annotatedPiConst_instantiate1,
+    AddInductive.Context.pushLocalDecl, AddInductive.Context.freshFVarId,
+    AddInductive.consumeTypeAnnotations, annotatedPiCtorCandidateContext]
+  rw [annotatedPi_checkConstructors_terminal_expanded]
+  unfold AddInductive.checkConstructorsLoop AddInductive.checkConstructorFold
+  simp [ReaderT.pure, Pure.pure, Except.pure]
+
+private theorem annotatedPi_checkConstructorUniverseSemantics :
+    AddInductive.checkConstructorUniverseListSemantics
+        annotatedPiInductiveStats annotatedPiKernelType.ctors
+        annotatedPiCtorCandidateContext = .ok () := by
+  unfold AddInductive.checkConstructorUniverseListSemantics
+  simp only [annotatedPiKernelType, annotatedPiKernelCtor,
+    annotatedPiMkInfo, ConstantInfo.type, ConstantInfo.toConstantVal,
+    ReaderT.bind, Bind.bind]
+  unfold AddInductive.checkConstructorUniverseSemantics
+  simp only [readThe, MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show annotatedPiCtorCandidateContext.fuel.inductiveFuel =
+      999 + 1 by rfl]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  simp only
+  rw [show annotatedPiInductiveStats.params[0]? = none by rfl]
+  simp only [ReaderT.bind, Bind.bind, AddInductive.liftTypeChecker_apply]
+  rw [annotatedPiInner_ensureTypeM_expanded]
+  simp only [Except.bind]
+  simp [Expr.sortLevel!, AddInductive.constructorUniverseSemanticGe]
+  simp only [AddInductive.consumeTypeAnnotations, annotatedPiCtorCandidateContext]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  rfl
+
+private theorem annotatedPiSortAnnotationTrace_build :
+    AddInductive.CandidateTypeAnnotationTrace.build (.sort .zero) =
+      ⟨.sort .zero, .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build]
+
+private theorem annotatedPiDomainAnnotationTrace_build :
+    AddInductive.CandidateTypeAnnotationTrace.build
+        annotatedPiRawDomainKernel =
+      ⟨.sort .zero,
+        .outParam [.succ .zero] (.sort .zero) (.identity _)⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build,
+    annotatedPiRawDomainKernel, annotatedPiSortAnnotationTrace_build]
+  rw [annotatedPiSortAnnotationTrace_build]
+
+private theorem annotatedPiInnerAnnotationTrace_build :
+    AddInductive.CandidateTypeAnnotationTrace.build
+        annotatedPiInnerKernel =
+      ⟨annotatedPiInnerKernel, .identity _⟩ := by
+  simp [AddInductive.CandidateTypeAnnotationTrace.build,
+    annotatedPiInnerKernel]
+
+private theorem annotatedPiDomainAnnotations_produced :
+    AddInductive.buildCandidateTypeAnnotations
+        annotatedPiRawDomainKernel =
+      .ok annotatedPiDomainAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [annotatedPiDomainAnnotationTrace_build]
+  rfl
+
+private theorem annotatedPiInnerAnnotations_produced :
+    AddInductive.buildCandidateTypeAnnotations annotatedPiInnerKernel =
+      .ok annotatedPiInnerAnnotations := by
+  unfold AddInductive.buildCandidateTypeAnnotations
+  rw [annotatedPiInnerAnnotationTrace_build]
+  rfl
+
+private theorem annotatedPiDomainCandidateTrace_loop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop
+        annotatedPiCtorCandidateContext annotatedPiRawDomainKernel
+        (fuel + 1) =
+      .ok annotatedPiDomainCandidateTrace := by
+  simpa only [annotatedPiDomainCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      annotatedPiCtorCandidateContext annotatedPiRawDomainKernel
+      (.sort (.succ .zero)) (.sort .zero) fuel
+      annotatedPiDomainCheckTypeStep_valid
+      annotatedPiDomainCandidateStep_valid rfl
+
+private theorem annotatedPiInnerBodyCandidateTrace_loop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop
+        annotatedPiInnerBodyCandidateContext
+        ((Expr.const ``AnnotatedPi []).instantiate1
+          annotatedPiCtorCandidateContext.freshExpr)
+        (fuel + 1) =
+      .ok annotatedPiInnerBodyCandidateTrace := by
+  simpa only [annotatedPiInnerBodyCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      annotatedPiInnerBodyCandidateContext
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr)
+      (.sort (.succ .zero)) (.const ``AnnotatedPi []) fuel
+      (by simpa only [annotatedPiInnerBodyCheckTypeStep,
+          annotatedPiConst_instantiate1] using
+        annotatedPiInnerBodyCheckTypeStep_valid)
+      (by simpa only [annotatedPiInnerBodyCandidateStep,
+          annotatedPiConst_instantiate1] using
+        annotatedPiInnerBodyCandidateStep_valid) rfl
+
+private theorem annotatedPiOuterBodyCandidateTrace_loop (fuel : Nat) :
+    AddInductive.buildCandidateExpr.loop
+        annotatedPiOuterBodyCandidateContext
+        ((Expr.const ``AnnotatedPi []).instantiate1
+          annotatedPiCtorCandidateContext.freshExpr)
+        (fuel + 1) =
+      .ok annotatedPiOuterBodyCandidateTrace := by
+  simpa only [annotatedPiOuterBodyCandidateTrace] using
+    AddInductive.buildCandidateExpr_loop_of_whnf_nonForall
+      annotatedPiOuterBodyCandidateContext
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr)
+      (.sort (.succ .zero)) (.const ``AnnotatedPi []) fuel
+      (by simpa only [annotatedPiOuterBodyCheckTypeStep,
+          annotatedPiConst_instantiate1] using
+        annotatedPiOuterBodyCheckTypeStep_valid)
+      (by simpa only [annotatedPiOuterBodyCandidateStep,
+          annotatedPiConst_instantiate1] using
+        annotatedPiOuterBodyCandidateStep_valid) rfl
+
+private theorem annotatedPiInnerCandidateTrace_loop :
+    AddInductive.buildCandidateExpr.loop
+        annotatedPiCtorCandidateContext annotatedPiInnerKernel 999 =
+      .ok annotatedPiInnerCandidateTrace := by
+  rw [show 999 = 998 + 1 by rfl]
+  simpa only [annotatedPiInnerCandidateTrace,
+    annotatedPiInnerBodyCandidateContext] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := annotatedPiCtorCandidateContext)
+      (e := annotatedPiInnerKernel)
+      (inferred := .sort (.succ .zero))
+      (fuel := 998)
+      (name := `p)
+      (domain := annotatedPiRawDomainKernel)
+      (body := .const ``AnnotatedPi [])
+      (binderInfo := .default)
+      (hfresh := annotatedPiCtorCandidateFresh)
+      (annotations := annotatedPiDomainAnnotations)
+      (hannotations := annotatedPiDomainAnnotations_produced)
+      (hannotationsEq := annotatedPiDomainAnnotationsEq)
+      (hcheck := annotatedPiInnerCheckTypeStep_valid)
+      (hrun := annotatedPiInnerCandidateStep_valid)
+      (domainCandidate := annotatedPiDomainCandidateTrace)
+      (bodyCandidate := annotatedPiInnerBodyCandidateTrace)
+      (hdomain := by
+        simpa using annotatedPiDomainCandidateTrace_loop 997)
+      (hbody := by
+        simpa [annotatedPiInnerBodyCandidateContext] using
+          annotatedPiInnerBodyCandidateTrace_loop 997))
+
+private theorem annotatedPiCtorCandidateTrace_loop :
+    AddInductive.buildCandidateExpr.loop
+        annotatedPiCtorCandidateContext annotatedPiMkInfo.type
+        annotatedPiCtorCandidateContext.fuel.inductiveFuel =
+      .ok annotatedPiCtorCandidateTrace := by
+  change AddInductive.buildCandidateExpr.loop
+      annotatedPiCtorCandidateContext annotatedPiMkInfo.type
+      (999 + 1) = _
+  simpa only [annotatedPiCtorCandidateTrace,
+    annotatedPiOuterBodyCandidateContext] using
+    (AddInductive.buildCandidateExpr_loop_of_whnf_forall
+      (context := annotatedPiCtorCandidateContext)
+      (e := annotatedPiMkInfo.type)
+      (inferred := .sort (.succ .zero))
+      (fuel := 999)
+      (name := annotatedPiOuterName)
+      (domain := annotatedPiInnerKernel)
+      (body := .const ``AnnotatedPi [])
+      (binderInfo := .default)
+      (hfresh := annotatedPiCtorCandidateFresh)
+      (annotations := annotatedPiInnerAnnotations)
+      (hannotations := annotatedPiInnerAnnotations_produced)
+      (hannotationsEq := annotatedPiInnerAnnotationsEq)
+      (hcheck := annotatedPiCtorCheckTypeStep_valid)
+      (hrun := annotatedPiCtorCandidateStep_valid)
+      (domainCandidate := annotatedPiInnerCandidateTrace)
+      (bodyCandidate := annotatedPiOuterBodyCandidateTrace)
+      (hdomain := annotatedPiInnerCandidateTrace_loop)
+      (hbody := by
+        simpa [annotatedPiOuterBodyCandidateContext] using
+          annotatedPiOuterBodyCandidateTrace_loop 998))
+
+/-- The executable candidate traversal returns the exact nested-forall
+AnnotatedPi constructor trace, including both annotation boundaries and the
+two recursively extended body contexts. -/
+theorem annotatedPiCtor_candidateTrace :
+    AddInductive.buildCandidateExpr annotatedPiMkInfo.type
+        annotatedPiCtorCandidateContext =
+      .ok annotatedPiCtorCandidate := by
+  unfold AddInductive.buildCandidateExpr
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    ReaderT.bind, Bind.bind, ReaderT.pure, Pure.pure,
+    Except.bind, Except.pure]
+  rw [annotatedPiCtorCandidateTrace_loop]
+  rfl
+
+/-- The family position is the exact terminal candidate returned in the
+pre-family environment. -/
+theorem annotatedPiFamily_candidateTrace :
+    AddInductive.buildCandidateExpr annotatedPiInfo.type
+        annotatedPiFamilyCandidateContext =
+      .ok annotatedPiFamilyCandidate := by
+  apply AddInductive.buildCandidateExpr_of_whnf_nonForall
+  · decide
+  · rfl
+
+private theorem annotatedPiFamilyTypeListProduced :
+    AddInductive.CandidateFamilyTypeListProduced
+      annotatedPiFamilyCandidateContext
+      (.cons annotatedPiFamilyListCandidate.familyType .nil) := by
+  exact .cons (by
+    unfold AddInductive.normalizeCandidateFamilyType
+    simp only [ReaderT.bind, Bind.bind]
+    simp only [annotatedPiKernelType]
+    rw [annotatedPiFamily_candidateTrace]
+    rfl) .nil
+
+private theorem annotatedPiFamilyTypeList_candidateTrace :
+    AddInductive.normalizeCandidateFamilyTypeList
+        [annotatedPiKernelType] annotatedPiFamilyCandidateContext =
+      .ok (.cons annotatedPiFamilyListCandidate.familyType .nil) := by
+  exact annotatedPiFamilyTypeListProduced.normalize
+
+private theorem annotatedPiConstructorListProduced :
+    AddInductive.CandidateConstructorListProduced
+      annotatedPiCtorCandidateContext
+      annotatedPiFamilyListCandidate.constructors := by
+  exact .cons (by
+    unfold AddInductive.normalizeCandidateConstructor
+    simp only [ReaderT.bind, Bind.bind]
+    simp only [annotatedPiKernelCtor]
+    rw [annotatedPiCtor_candidateTrace]
+    rfl) .nil
+
+private theorem annotatedPiConstructorList_candidateTrace :
+    AddInductive.normalizeCandidateConstructorList
+        annotatedPiKernelType.ctors annotatedPiCtorCandidateContext =
+      .ok annotatedPiFamilyListCandidate.constructors := by
+  exact annotatedPiConstructorListProduced.normalize
+
+private theorem annotatedPiFamilyListProduced :
+    AddInductive.CandidateFamilyListProduced
+      annotatedPiCtorCandidateContext
+      (.cons annotatedPiFamilyListCandidate.familyType .nil)
+      annotatedPiNormalizationCandidate.families := by
+  exact .cons annotatedPiConstructorListProduced .nil
+
+private theorem annotatedPiFamilyList_candidateTrace :
+    AddInductive.normalizeCandidateFamilyList
+        (.cons annotatedPiFamilyListCandidate.familyType .nil)
+        annotatedPiCtorCandidateContext =
+      .ok annotatedPiNormalizationCandidate.families := by
+  exact annotatedPiFamilyListProduced.normalize
+
+/-- The complete positive AnnotatedPi metadata request selects the exact
+nested-forall normalization candidate in the real pre-family and post-family
+checker environments. -/
+theorem annotatedPiNormalizationCandidate_produced :
+    AddInductive.buildNormalizationCandidate 0
+        [annotatedPiKernelType] 0 false
+        annotatedPiFamilyCandidateContext =
+      .ok annotatedPiNormalizationCandidate := by
+  unfold AddInductive.buildNormalizationCandidate
+  rw [annotatedPi_checkInductiveTypes]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [show
+    (withReader (fun _ : AddInductive.Context =>
+        { annotatedPiFamilyCandidateContext with lctx := {} })
+      (AddInductive.normalizeCandidateFamilyTypeList
+        [annotatedPiKernelType])) annotatedPiFamilyCandidateContext =
+      .ok (.cons annotatedPiFamilyListCandidate.familyType .nil) by
+    change AddInductive.normalizeCandidateFamilyTypeList
+      [annotatedPiKernelType]
+      { annotatedPiFamilyCandidateContext with lctx := {} } = _
+    rw [show { annotatedPiFamilyCandidateContext with lctx := {} } =
+      annotatedPiFamilyCandidateContext by rfl]
+    exact annotatedPiFamilyTypeList_candidateTrace]
+  simp only [Except.bind]
+  rw [annotatedPi_declareInductiveTypes]
+  unfold AddInductive.withEnv
+  change (ReaderT.bind
+      (AddInductive.checkConstructors #[annotatedPiKernelType]
+        annotatedPiInductiveStats false)
+      (fun _ => ReaderT.bind
+        (AddInductive.normalizeCandidateFamilyList
+          (.cons annotatedPiFamilyListCandidate.familyType .nil))
+        (fun families => pure
+          (⟨families⟩ : AddInductive.NormalizationCandidate
+            [annotatedPiKernelType]))))
+      ({ annotatedPiFamilyCandidateContext with
+        env := annotatedPiTypeKernelEnv } :
+          AddInductive.Context) = _
+  rw [show ({ annotatedPiFamilyCandidateContext with
+      env := annotatedPiTypeKernelEnv } : AddInductive.Context) =
+        annotatedPiCtorCandidateContext by rfl]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [annotatedPi_checkConstructors]
+  simp only [Except.bind]
+  rw [annotatedPiFamilyList_candidateTrace]
+  rfl
+
+private def aliasFormerFamilyCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := aliasFormerCandidateContext
+  source := aliasFormerInfo.type
+  result := .sort (.succ .zero)
+
+private theorem aliasFormerFamilyCandidateStep_valid :
+    aliasFormerFamilyCandidateStep.Valid := by
+  change
+    TypeChecker.M.run aliasFormerNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.whnf aliasFormerInfo.type) =
+      .ok (.sort (.succ .zero))
+  exact aliasFormerFamily_whnfM
+
+private def aliasFormerFamilyCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := aliasFormerCandidateContext
+  source := aliasFormerInfo.type
+  inferred := .sort (.succ (.succ .zero))
+
+private theorem aliasFormerFamilyCheckTypeStep_valid :
+    aliasFormerFamilyCheckTypeStep.Valid := by
+  change
+    TypeChecker.M.run aliasFormerNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.checkType aliasFormerInfo.type) =
+      .ok (.sort (.succ (.succ .zero)))
+  exact aliasFormerFamily_checkTypeM
+
+private def aliasFormerCtorCheckTypeStep :
+    AddInductive.CandidateCheckTypeStep where
+  context := aliasFormerCtorCandidateContext
+  source := aliasFormerMkInfo.type
+  inferred := .const ``TypeFamilyAlias []
+
+private theorem aliasFormerCtorCheckTypeStep_valid :
+    aliasFormerCtorCheckTypeStep.Valid := by
+  change
+    TypeChecker.M.run aliasFormerCtorNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.checkType aliasFormerMkInfo.type) =
+      .ok (.const ``TypeFamilyAlias [])
+  exact aliasFormerCtor_checkTypeM
+
+private def aliasFormerCtorCandidateStep :
+    AddInductive.CandidateWhnfStep where
+  context := aliasFormerCtorCandidateContext
+  source := aliasFormerMkInfo.type
+  result := .const ``AliasFormer []
+
+private theorem aliasFormerCtorCandidateStep_valid :
+    aliasFormerCtorCandidateStep.Valid := by
+  change
+    TypeChecker.M.run aliasFormerCtorNormalizationKernelEnv .safe {} []
+        { whnf := 2 } (TypeChecker.whnf aliasFormerMkInfo.type) =
+      .ok (.const ``AliasFormer [])
+  exact aliasFormerCtor_whnfM
+
+private def aliasFormerFamilyCandidate :
+    AddInductive.CandidateExpr aliasFormerInfo.type :=
+  ⟨aliasFormerCandidateContext,
+    .terminal aliasFormerCandidateContext aliasFormerInfo.type
+      (.sort (.succ (.succ .zero))) (.sort (.succ .zero))
+      aliasFormerFamilyCheckTypeStep_valid
+      aliasFormerFamilyCandidateStep_valid⟩
+
+private def aliasFormerCtorCandidate :
+    AddInductive.CandidateExpr aliasFormerMkInfo.type :=
+  ⟨aliasFormerCtorCandidateContext,
+    .terminal aliasFormerCtorCandidateContext aliasFormerMkInfo.type
+      (.const ``TypeFamilyAlias []) (.const ``AliasFormer [])
+      aliasFormerCtorCheckTypeStep_valid
+      aliasFormerCtorCandidateStep_valid⟩
+
+private def aliasFormerConstructorCandidate :
+    AddInductive.CandidateConstructor aliasFormerKernelCtor :=
+  ⟨aliasFormerCtorCandidate⟩
+
+private def aliasFormerFamilyListCandidate :
+    AddInductive.CandidateFamily aliasFormerKernelType where
+  familyType := ⟨aliasFormerFamilyCandidate⟩
+  constructors := .cons aliasFormerConstructorCandidate .nil
+
+/-- Exact singleton family/constructor candidate list used to exercise the
+generic positional Theory boundary. -/
+private def aliasFormerNormalizationCandidate :
+    AddInductive.NormalizationCandidate [aliasFormerKernelType] where
+  families := .cons aliasFormerFamilyListCandidate .nil
+
+private def aliasFormerInductiveStats : AddInductive.InductiveStats where
+  levels := []
+  resultLevel := .succ .zero
+  nindices := #[0]
+  indConsts := #[.const ``AliasFormer []]
+  params := #[]
+  isNotZero := true
+
+private theorem constNil_data_hasExprMVar_false (n : Name) :
+    (Expr.const n []).data.hasExprMVar = false := by
+  change (Expr.const n []).hasExprMVar = false
+  rw [Expr.hasExprMVar_eq]
+  rfl
+
+private theorem constNil_data_hasLevelMVar_false (n : Name) :
+    (Expr.const n []).data.hasLevelMVar = false := by
+  change (Expr.const n []).hasLevelMVar = false
+  rw [Expr.hasLevelMVar_eq]
+  rfl
+
+private theorem constNil_data_hasFVar_false (n : Name) :
+    (Expr.const n []).data.hasFVar = false := by
+  change (Expr.const n []).hasFVar = false
+  rw [Expr.hasFVar_eq]
+  rfl
+
+private theorem aliasFormer_checkInductiveTypes
+    (k : AddInductive.InductiveStats → AddInductive.M α) :
+    AddInductive.checkInductiveTypes 0 #[aliasFormerKernelType] k
+        aliasFormerCandidateContext =
+      k aliasFormerInductiveStats aliasFormerCandidateContext := by
+  apply AddInductive.checkInductiveTypes_singleton_zero_of_whnf_sort
+  · decide
+  · simp [Kernel.Environment.checkNoMVarNoFVar,
+      Kernel.Environment.checkNoMVar, Kernel.Environment.checkNoFVar,
+      aliasFormerKernelType, aliasFormerInfo, ConstantInfo.type,
+      ConstantInfo.toConstantVal, Expr.hasMVar, Expr.hasFVar,
+      constNil_data_hasExprMVar_false,
+      constNil_data_hasLevelMVar_false, constNil_data_hasFVar_false,
+      Bind.bind, Except.bind,
+      Pure.pure, Except.pure]
+  · simpa [aliasFormerCandidateContext, aliasFormerKernelType] using
+      aliasFormerFamily_checkTypeM
+  · simpa [aliasFormerCandidateContext, aliasFormerKernelType] using
+      aliasFormerFamily_whnfM
+  · rfl
+
+private theorem aliasFormerNormalization_not_contains :
+    aliasFormerNormalizationKernelEnv.contains ``AliasFormer = false := by
+  unfold Kernel.Environment.contains
+  change typeFamilyAliasMap.contains ``AliasFormer = false
+  rw [SMap.find?_isSome, aliasFormerType_fresh]
+  rfl
+
+private theorem aliasFormerNormalization_checkName :
+    aliasFormerNormalizationKernelEnv.checkName ``AliasFormer false =
+      .ok () := by
+  simp [Kernel.Environment.checkName, aliasFormerNormalization_not_contains,
+    Kernel.Environment.primitives, NameSet.ofList, NameSet.contains, Pure.pure, Except.pure]
+
+private theorem aliasFormer_declareInductiveTypes :
+    AddInductive.declareInductiveTypes aliasFormerInductiveStats 0
+        #[aliasFormerKernelType] 0 false aliasFormerCandidateContext =
+      .ok aliasFormerCtorNormalizationKernelEnv := by
+  simp [AddInductive.declareInductiveTypes, aliasFormerInductiveStats,
+    aliasFormerKernelType, aliasFormerKernelCtor,
+    aliasFormerInfo, aliasFormerMkInfo, ConstantInfo.name,
+    ConstantInfo.type, ConstantInfo.toConstantVal,
+    aliasFormerCandidateContext, aliasFormerCtorNormalizationKernelEnv,
+    aliasFormerNormalizationKernelEnv, aliasFormerTypeMap,
+    AddInductive.isRec,
+    AddInductive.isRec.loop, AddInductive.isReflexive,
+    AddInductive.isReflexive.loop,
+    Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show (Kernel.Environment.ofConstants `_aliasFormerNormalization
+      typeFamilyAliasMap).checkName ``AliasFormer = .ok () by
+    simpa [aliasFormerNormalizationKernelEnv] using
+      aliasFormerNormalization_checkName]
+  rfl
+
+private theorem aliasFormerCtor_getEnvM :
+    TypeChecker.M.run aliasFormerCtorCandidateContext.env
+        aliasFormerCtorCandidateContext.safety
+        aliasFormerCtorCandidateContext.lctx
+        aliasFormerCtorCandidateContext.lparams
+        aliasFormerCtorCandidateContext.fuel TypeChecker.getEnv =
+      .ok aliasFormerCtorNormalizationKernelEnv := by
+  rfl
+
+private theorem aliasFormerCtor_isValidIndAppIdx :
+    AddInductive.isValidIndAppIdx aliasFormerInductiveStats
+      (.const ``AliasFormer []) 0 = true := by
+  simp +decide [AddInductive.isValidIndAppIdx,
+    aliasFormerInductiveStats,
+    Expr.getAppFn, Expr.getAppArgs, Expr.getAppNumArgs]
+
+private theorem aliasFormerCtor_noMVarNoFVar :
+    aliasFormerCtorNormalizationKernelEnv.checkNoMVarNoFVar
+        ``AliasFormer.mk (.const ``AliasFormer []) = .ok () := by
+  simp [Kernel.Environment.checkNoMVarNoFVar,
+    Kernel.Environment.checkNoMVar, Kernel.Environment.checkNoFVar,
+    Expr.hasMVar, Expr.hasFVar,
+    constNil_data_hasExprMVar_false,
+    constNil_data_hasLevelMVar_false, constNil_data_hasFVar_false,
+    Bind.bind, Except.bind, Pure.pure, Except.pure]
+
+private theorem aliasFormerCtor_checkTypeM_const :
+    TypeChecker.M.run aliasFormerCtorCandidateContext.env
+        aliasFormerCtorCandidateContext.safety
+        aliasFormerCtorCandidateContext.lctx
+        aliasFormerCtorCandidateContext.lparams
+        aliasFormerCtorCandidateContext.fuel
+        (TypeChecker.checkType (.const ``AliasFormer [])) =
+      .ok (.const ``TypeFamilyAlias []) := by
+  simpa [aliasFormerMkInfo, ConstantInfo.type,
+    ConstantInfo.toConstantVal, aliasFormerCtorCandidateContext] using
+      aliasFormerCtor_checkTypeM
+
+private theorem aliasFormerCtor_checkTypeM_empty :
+    TypeChecker.M.run aliasFormerCtorCandidateContext.env
+        aliasFormerCtorCandidateContext.safety {}
+        aliasFormerCtorCandidateContext.lparams
+        aliasFormerCtorCandidateContext.fuel
+        (TypeChecker.checkType (.const ``AliasFormer [])) =
+      .ok (.const ``TypeFamilyAlias []) := by
+  simpa [aliasFormerCtorCandidateContext] using
+    aliasFormerCtor_checkTypeM_const
+
+private theorem aliasFormerCtor_checkTypeM_of_empty
+    (lctx : LocalContext) (hlctx : lctx = {}) :
+    TypeChecker.M.run aliasFormerCtorCandidateContext.env
+        aliasFormerCtorCandidateContext.safety lctx
+        aliasFormerCtorCandidateContext.lparams
+        aliasFormerCtorCandidateContext.fuel
+        (TypeChecker.checkType (.const ``AliasFormer [])) =
+      .ok (.const ``TypeFamilyAlias []) := by
+  subst lctx
+  exact aliasFormerCtor_checkTypeM_empty
+
+private theorem aliasFormer_checkConstructors :
+    AddInductive.checkConstructors #[aliasFormerKernelType]
+        aliasFormerInductiveStats false aliasFormerCtorCandidateContext =
+      .ok () := by
+  unfold AddInductive.checkConstructors
+  simp only [ReaderT.bind, Bind.bind]
+  rw [AddInductive.liftTypeChecker_apply]
+  rw [aliasFormerCtor_getEnvM]
+  simp only [Except.bind]
+  unfold AddInductive.checkConstructorsLoop AddInductive.checkConstructorFold
+  simp +decide [aliasFormerKernelType, aliasFormerKernelCtor, aliasFormerMkInfo, ConstantInfo.name]
+  simp +decide [ConstantInfo.type, ConstantInfo.toConstantVal, AddInductive.liftTypeChecker_apply,
+    aliasFormerCtor_noMVarNoFVar, ReaderT.bind, Bind.bind, Except.bind]
+  rw [aliasFormerCtor_checkTypeM_of_empty
+    ({ decls :=
+      { root := PersistentArrayNode.node #[], tail := #[] } } :
+        LocalContext) rfl]
+  simp only []
+  unfold AddInductive.checkConstructorType
+  simp only [readThe, MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show aliasFormerCtorCandidateContext.fuel.inductiveFuel = 999 + 1 by
+    rfl]
+  unfold AddInductive.checkConstructorType.loop
+  simp [aliasFormerCtor_isValidIndAppIdx, ReaderT.pure, Pure.pure,
+    Except.pure, AddInductive.checkConstructorFold,
+    AddInductive.checkConstructorsLoop]
+
+private theorem aliasFormer_checkConstructorUniverseSemantics :
+    AddInductive.checkConstructorUniverseListSemantics
+        aliasFormerInductiveStats aliasFormerKernelType.ctors
+        aliasFormerCtorCandidateContext = .ok () := by
+  unfold AddInductive.checkConstructorUniverseListSemantics
+  simp only [aliasFormerKernelType, aliasFormerKernelCtor,
+    aliasFormerMkInfo, ConstantInfo.type, ConstantInfo.toConstantVal,
+    ReaderT.bind, Bind.bind]
+  unfold AddInductive.checkConstructorUniverseSemantics
+  simp only [readThe, MonadReaderOf.read, ReaderT.read, ReaderT.bind, Bind.bind, Pure.pure,
+    Except.bind, Except.pure]
+  rw [show aliasFormerCtorCandidateContext.fuel.inductiveFuel = 999 + 1 by
+    rfl]
+  unfold AddInductive.checkConstructorUniverseSemantics.loop
+  rfl
+
+/-- The generic candidate traversal retains the exact context, input, and
+result of the actual AliasFormer family WHNF observation. -/
+theorem aliasFormerFamily_candidateTrace :
+    AddInductive.buildCandidateExpr aliasFormerInfo.type
+        aliasFormerCandidateContext =
+      .ok aliasFormerFamilyCandidate := by
+  apply AddInductive.buildCandidateExpr_of_whnf_nonForall
+  · decide
+  · rfl
+
+private theorem aliasFormerFamilyTypeListProduced :
+    AddInductive.CandidateFamilyTypeListProduced aliasFormerCandidateContext
+      (.cons aliasFormerFamilyListCandidate.familyType .nil) := by
+  exact .cons (by
+    unfold AddInductive.normalizeCandidateFamilyType
+    simp only [ReaderT.bind, Bind.bind]
+    simp only [aliasFormerKernelType]
+    rw [aliasFormerFamily_candidateTrace]
+    rfl) .nil
+
+private theorem aliasFormerFamilyTypeList_candidateTrace :
+    AddInductive.normalizeCandidateFamilyTypeList
+        [aliasFormerKernelType] aliasFormerCandidateContext =
+      .ok (.cons aliasFormerFamilyListCandidate.familyType .nil) := by
+  exact aliasFormerFamilyTypeListProduced.normalize
+
+/-- The post-family constructor position is produced by the same executable
+candidate traversal and retains its exact opaque result. -/
+theorem aliasFormerCtor_candidateTrace :
+    AddInductive.buildCandidateExpr aliasFormerMkInfo.type
+        aliasFormerCtorCandidateContext =
+      .ok aliasFormerCtorCandidate := by
+  apply AddInductive.buildCandidateExpr_of_whnf_nonForall
+  · decide
+  · rfl
+
+private theorem aliasFormerConstructorListProduced :
+    AddInductive.CandidateConstructorListProduced
+      aliasFormerCtorCandidateContext
+      aliasFormerFamilyListCandidate.constructors := by
+  exact .cons (by
+    unfold AddInductive.normalizeCandidateConstructor
+    simp only [ReaderT.bind, Bind.bind]
+    simp only [aliasFormerKernelCtor]
+    rw [aliasFormerCtor_candidateTrace]
+    rfl) .nil
+
+private theorem aliasFormerConstructorList_candidateTrace :
+    AddInductive.normalizeCandidateConstructorList
+        aliasFormerKernelType.ctors aliasFormerCtorCandidateContext =
+      .ok aliasFormerFamilyListCandidate.constructors := by
+  exact aliasFormerConstructorListProduced.normalize
+
+private theorem aliasFormerFamilyListProduced :
+    AddInductive.CandidateFamilyListProduced aliasFormerCtorCandidateContext
+      (.cons aliasFormerFamilyListCandidate.familyType .nil)
+      aliasFormerNormalizationCandidate.families := by
+  exact .cons aliasFormerConstructorListProduced .nil
+
+private theorem aliasFormerFamilyList_candidateTrace :
+    AddInductive.normalizeCandidateFamilyList
+        (.cons aliasFormerFamilyListCandidate.familyType .nil)
+        aliasFormerCtorCandidateContext =
+      .ok aliasFormerNormalizationCandidate.families := by
+  exact aliasFormerFamilyListProduced.normalize
+
+theorem aliasFormerNormalizationCandidate_produced :
+    AddInductive.buildNormalizationCandidate 0
+        [aliasFormerKernelType] 0 false aliasFormerCandidateContext =
+      .ok aliasFormerNormalizationCandidate := by
+  unfold AddInductive.buildNormalizationCandidate
+  rw [aliasFormer_checkInductiveTypes]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [show
+    (withReader (fun _ : AddInductive.Context =>
+        { aliasFormerCandidateContext with lctx := {} })
+      (AddInductive.normalizeCandidateFamilyTypeList
+        [aliasFormerKernelType])) aliasFormerCandidateContext =
+      .ok (.cons aliasFormerFamilyListCandidate.familyType .nil) by
+    change AddInductive.normalizeCandidateFamilyTypeList
+      [aliasFormerKernelType]
+      { aliasFormerCandidateContext with lctx := {} } = _
+    rw [show { aliasFormerCandidateContext with lctx := {} } =
+      aliasFormerCandidateContext by rfl]
+    exact aliasFormerFamilyTypeList_candidateTrace]
+  simp only [Except.bind]
+  rw [aliasFormer_declareInductiveTypes]
+  unfold AddInductive.withEnv
+  change (ReaderT.bind
+      (AddInductive.checkConstructors #[aliasFormerKernelType]
+        aliasFormerInductiveStats false)
+      (fun _ => ReaderT.bind
+        (AddInductive.normalizeCandidateFamilyList
+          (.cons aliasFormerFamilyListCandidate.familyType .nil))
+        (fun families => pure
+          (⟨families⟩ : AddInductive.NormalizationCandidate
+            [aliasFormerKernelType]))))
+      ({ aliasFormerCandidateContext with
+        env := aliasFormerCtorNormalizationKernelEnv } :
+          AddInductive.Context) = _
+  rw [show ({ aliasFormerCandidateContext with
+      env := aliasFormerCtorNormalizationKernelEnv } :
+        AddInductive.Context) = aliasFormerCtorCandidateContext by rfl]
+  simp only [ReaderT.bind, Bind.bind]
+  rw [aliasFormer_checkConstructors]
+  simp only [Except.bind]
+  rw [aliasFormerFamilyList_candidateTrace]
+  rfl
+
+/-- Erasing the retained trace produces the expected AliasFormer analysis
+view at the same checker boundary. -/
+theorem aliasFormerFamily_candidate :
+    AddInductive.normalizeCandidateExpr aliasFormerInfo.type
+        aliasFormerCandidateContext =
+      .ok (.sort (.succ .zero)) := by
+  apply AddInductive.normalizeCandidateExpr_of_whnf_nonForall
+  · decide
+  · simpa [aliasFormerCandidateContext] using
+      aliasFormerFamily_checkTypeM
+  · simpa [aliasFormerCandidateContext] using
+      aliasFormerFamily_whnfM
+  · rfl
+
+private def aliasRecFieldFnType : Expr :=
+  .forallE `α (.sort (.succ .zero))
+    (.sort (.succ .zero)) .default
+
+@[simp] private theorem aliasRecFieldFnType_isForall :
+    aliasRecFieldFnType.isForall = true := rfl
+
+@[simp] private theorem aliasRecFieldFnType_bindingDomain :
+    aliasRecFieldFnType.bindingDomain! =
+      .sort (.succ .zero) := rfl
+
+@[simp] private theorem aliasRecFieldFnType_instantiatedBody :
+    aliasRecFieldFnType.bindingBody!.instantiate1
+        (.const ``AliasRec []) =
+      .sort (.succ .zero) := by
+  simp [aliasRecFieldFnType, Expr.bindingBody!,
+    Expr.instantiate1_eq,
+    Expr.instantiate1']
+
+@[simp] private theorem aliasRecFamily_notEagerReduce :
+    (Expr.const ``AliasRec []).isAppOfArity ``eagerReduce 2 =
+      false := rfl
+
+private def aliasRecFieldFnState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    inferTypeC := state.inferTypeC.insert
+      (.const ``RecAlias [.succ .zero]) aliasRecFieldFnType }
+
+private def aliasRecFieldArgState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    inferTypeC := state.inferTypeC.insert
+      (.const ``AliasRec []) (.sort (.succ .zero)) }
+
+private def aliasRecFieldResultState (state : TypeChecker.State) :
+    TypeChecker.State :=
+  { state with
+    inferTypeC := state.inferTypeC.insert
+      aliasRecFieldKernelExpr (.sort (.succ .zero)) }
+
+@[simp] private theorem aliasRecFieldFnCache_miss :
+    (({} : Ix.Theory.Named.InferCache).insert
+      (Expr.const ``RecAlias [.succ .zero]) aliasRecFieldFnType)[
+        Expr.const ``AliasRec []]? = none := by
+  rw [Std.HashMap.getElem?_insert]
+  have h :
+      (Expr.const ``RecAlias [.succ .zero] ==
+        Expr.const ``AliasRec []) = false := by
+    change Expr.eqv
+      (Expr.const ``RecAlias [.succ .zero])
+      (Expr.const ``AliasRec []) = false
+    rw [Expr.eqv_eq]
+    rfl
+  rw [h]
+  exact Std.HashMap.getElem?_empty
+
+@[simp] private theorem aliasRecFieldFnState_cache_miss :
+    (aliasRecFieldFnState {}).inferTypeC[
+      Expr.const ``AliasRec []]? = none := by
+  change
+    (({} : Ix.Theory.Named.InferCache).insert
+      (Expr.const ``RecAlias [.succ .zero]) aliasRecFieldFnType)[
+        Expr.const ``AliasRec []]? = none
+  exact aliasRecFieldFnCache_miss
+
+private theorem isDefEqSort
+    (context : TypeChecker.Context)
+    (initial : TypeChecker.State) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEq
+          (.sort (.succ .zero)) (.sort (.succ .zero))
+          (TypeChecker.Methods.withFuel 9998) context initial =
+        .ok (true, state) := by
+  refine ⟨initial, ?_⟩
+  unfold TypeChecker.Inner.isDefEq
+  rw [if_pos (Expr.eqv_refl _)]
+  rfl
+
+private theorem inferTypeRecAliasInitial :
+    TypeChecker.Inner.inferType'
+        (.const ``RecAlias [.succ .zero]) false
+        (TypeChecker.Methods.withFuel 9998)
+        aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (aliasRecFieldFnType, aliasRecFieldFnState {}) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [aliasRecFieldFnType, aliasRecFieldFnState,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem inferTypeAliasRecAfterRecAlias :
+    TypeChecker.Inner.inferType'
+        (.const ``AliasRec []) false
+        (TypeChecker.Methods.withFuel 9998)
+        aliasRecNormalizationRawContext (aliasRecFieldFnState {}) =
+      .ok (.sort (.succ .zero),
+        aliasRecFieldArgState (aliasRecFieldFnState {})) := by
+  unfold TypeChecker.Inner.inferType'
+  simp [aliasRecFieldArgState, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+
+/-- The exact full checker run for the raw `RecAlias AliasRec` constructor
+field in the post-family environment. -/
+theorem aliasRecField_checkType :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.inferType aliasRecFieldKernelExpr false
+          (TypeChecker.Methods.withFuel 9999)
+          aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero), state) := by
+  change ∃ state : TypeChecker.State,
+    TypeChecker.Inner.inferType' aliasRecFieldKernelExpr false
+        (TypeChecker.Methods.withFuel 9998)
+        aliasRecNormalizationRawContext ({} : TypeChecker.State) =
+      .ok (.sort (.succ .zero), state)
+  rw [aliasRecFieldKernelExpr_eq]
+  unfold TypeChecker.Inner.inferType'
+  simp only [aliasRecField_noLooseBVars, Bool.false_eq_true, if_false, cond, normalizationRecMGet,
+    Std.HashMap.getElem?_empty, normalizationRecMBind]
+  rw [inferTypeRecAliasInitial]
+  simp only
+    [TypeChecker.Inner.ensureForallCore,
+      aliasRecFieldFnType_isForall, ↓reduceIte, normalizationRecMPure]
+  rw [inferTypeAliasRecAfterRecAlias]
+  obtain ⟨eqState, heq⟩ :=
+    isDefEqSort aliasRecNormalizationRawContext
+      (aliasRecFieldArgState (aliasRecFieldFnState {}))
+  dsimp only
+  rw [if_neg (show ¬((Expr.const ``AliasRec []).isAppOfArity
+      `eagerReduce 2 = true) from by
+    simp [aliasRecFamily_notEagerReduce])]
+  simp only [aliasRecFieldFnType_bindingDomain,
+    normalizationRecMBind]
+  rw [heq]
+  rw [aliasRecFieldFnType_instantiatedBody]
+  refine ⟨aliasRecFieldResultState eqState, ?_⟩
+  simp [aliasRecFieldResultState, aliasRecFieldKernelExpr_eq,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+
+/-- The paired full-check/WHNF interpretation of the retained AliasFormer
+family node.  Both semantic runs are obtained from the candidate's exact
+observations in one verified context. -/
+private def aliasFormerFamilyCandidateNodeRun :
+    TypeChecker.CandidateNodeRun typeFamilyAliasEnv [] []
+      aliasFormerCandidateContext aliasFormerInfo.type
+      (.sort (.succ (.succ .zero))) (.sort (.succ .zero))
+      aliasFormerRawType.type aliasFormerViewType.type
+      (.sort (.succ (.succ .zero))) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    aliasFormerCandidateContext aliasFormerInfo.type
+    (.sort (.succ (.succ .zero))) (.sort (.succ .zero))
+    aliasFormerFamilyCheckTypeStep_valid
+    aliasFormerFamilyCandidateStep_valid
+    aliasFormerNormalizationContext (by rfl)
+    rfl rfl rfl TypeChecker.VState.WF.empty
+    (.const rfl rfl rfl) (.sort rfl)
+    (by
+      have hs : TrExprS typeFamilyAliasEnv [] []
+          (.sort (.succ .zero)) (.sort (.succ .zero)) := .sort rfl
+      exact hs)
+    10000 9999 (by rfl) (by rfl)
+
+/-- Verified family-result normalization leaf for AliasFormer. -/
+def aliasFormerFamilyWhnfRun :
+    TypeChecker.WhnfRun typeFamilyAliasEnv [] []
+      aliasFormerInfo.type (.sort (.succ .zero))
+      aliasFormerRawType.type aliasFormerViewType.type :=
+  aliasFormerFamilyCandidateNodeRun.whnf
+
+/-- Verified full-check certificate for the raw AliasFormer family type. -/
+def aliasFormerFamilyCheckTypeRun :
+    TypeChecker.CheckTypeRun typeFamilyAliasEnv [] []
+      aliasFormerInfo.type (.sort (.succ (.succ .zero)))
+      aliasFormerRawType.type (.sort (.succ (.succ .zero))) :=
+  aliasFormerFamilyCandidateNodeRun.check
+
+/-- Recursive semantic interpretation of the exact source-indexed candidate
+trace.  This terminal fixture is the base case used by the generic Pi
+interpreter for larger metadata. -/
+private theorem aliasFormerFamilyCandidateRun :
+    TypeChecker.CandidateExprRun typeFamilyAliasEnv []
+      aliasFormerFamilyCandidate.trace []
+      aliasFormerRawType.type aliasFormerViewType.type
+      (.sort (.succ (.succ .zero))) :=
+  .terminal aliasFormerFamilyCandidateNodeRun
+
+private theorem aliasFormerCandidatePrefix_ne :
+    aliasFormerCandidateContext.ngen.namePrefix ≠
+      (({} : TypeChecker.VState).ngen).namePrefix := by
+  decide
+
+/-- The generic root constructor aligns the actual candidate context with the
+verified AliasFormer environment and supplies the empty-state certificate. -/
+private def aliasFormerCandidateContextRun :
+    TypeChecker.CandidateContextRun aliasFormerCandidateContext :=
+  TypeChecker.CandidateContextRun.root aliasFormerNormalizationVEnvs_wf
+    rfl aliasFormerCandidatePrefix_ne
+
+/-- The retained AliasFormer full check now selects its own Theory source and
+output translations; no expression translation is supplied by the fixture. -/
+theorem aliasFormerFamily_candidateRun_exists :
+    ∃ source' view' inferred',
+      aliasFormerCandidateContextRun.context.TrExprS
+        aliasFormerInfo.type source' ∧
+      Nonempty (TypeChecker.CandidateExprRun
+        aliasFormerCandidateContextRun.context.venv
+        aliasFormerCandidateContextRun.context.lparams
+        aliasFormerFamilyCandidate.trace
+        aliasFormerCandidateContextRun.context.vlctx
+        source' view' inferred') := by
+  apply TypeChecker.CandidateExprRun.exists_ofCandidateFVars
+    aliasFormerFamilyCandidate.trace aliasFormerCandidateContextRun
+      (whnfFuel := 9999)
+  · change ∀ u ∈ ([] : List Level), u.hasMVar' = false
+    simp
+  · rfl
+
+/-- The generic interpreter retains the strict translation of the raw
+candidate endpoint. -/
+theorem aliasFormerFamily_candidateSource_tr :
+    TrExprS typeFamilyAliasEnv [] [] aliasFormerInfo.type
+      aliasFormerRawType.type :=
+  aliasFormerFamilyCandidateRun.source_tr
+
+/-- The reconstructed candidate endpoint is also tied back to the concrete
+kernel WHNF result, closing the source/view translation pair. -/
+theorem aliasFormerFamily_candidateView_tr :
+    TrExpr typeFamilyAliasEnv [] [] (.sort (.succ .zero))
+      aliasFormerViewType.type := by
+  simpa [aliasFormerFamilyCandidate,
+    AddInductive.CandidateExprTrace.view] using
+    aliasFormerFamilyCandidateRun.view_tr
+
+private def aliasFormerPreFamilyStage :
+    TypeChecker.CandidateSemanticStage aliasFormerCandidateContext
+      typeFamilyAliasEnv [] where
+  contextRun := aliasFormerCandidateContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+
+private def aliasFormerFamilyValidationRun :
+    AddInductive.CandidateExprTrace.FamilyValidationRun
+      aliasFormerKernelType aliasFormerFamilyCandidate.trace where
+  nparams := 0
+  resultLevel := .succ .zero
+  stats := aliasFormerInductiveStats
+  stats_eq := rfl
+  terminal_eq := rfl
+  run := aliasFormer_checkInductiveTypes
+
+private def aliasFormerFamilyStage :
+    VInductDecl.CandidateFamilyStagedInput aliasFormerCandidateContext
+      aliasFormerCtorCandidateContext typeFamilyAliasEnv []
+      aliasFormerFamilyListCandidate.familyType aliasFormerRawType
+      aliasFormerPreFamilyStage where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := {
+    context_eq := rfl
+    source_tr := aliasFormerFamily_candidateSource_tr
+    whnfFuel := 9999
+    whnfDepth := rfl }
+  validation := aliasFormerFamilyValidationRun
+  typeEnv := aliasFormerTypeEnv
+  addInduct := aliasFormerCtorNormalizationAddType
+  projectionReady := ProjectionReady.of_no_ctorInfo <| by
+    intro name _info h
+    change aliasFormerTypeMap.find?' name = some (.ctorInfo _info) at h
+    rw [aliasFormerTypeMap_wf.find?'_eq_find?] at h
+    simp only [aliasFormerTypeMap, typeFamilyAliasMap_wf.find?_insert] at h
+    simp only [typeFamilyAliasMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    by_cases hAliasFormer : ``AliasFormer = name
+    · subst name
+      simp [aliasFormerInfo] at h
+    · by_cases hTypeFamilyAlias : ``TypeFamilyAlias = name
+      · subst name
+        simp [hAliasFormer, typeFamilyAliasInfo] at h
+      · simp [hAliasFormer, hTypeFamilyAlias, SMap.find?] at h
+  structureEtaReady := StructureEtaReady.of_no_ctorInfo <| by
+    intro name _info h
+    change aliasFormerTypeMap.find?' name = some (.ctorInfo _info) at h
+    rw [aliasFormerTypeMap_wf.find?'_eq_find?] at h
+    simp only [aliasFormerTypeMap, typeFamilyAliasMap_wf.find?_insert] at h
+    simp only [typeFamilyAliasMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    by_cases hAliasFormer : ``AliasFormer = name
+    · subst name
+      simp [aliasFormerInfo] at h
+    · by_cases hTypeFamilyAlias : ``TypeFamilyAlias = name
+      · subst name
+        simp [hAliasFormer, typeFamilyAliasInfo] at h
+      · simp [hAliasFormer, hTypeFamilyAlias, SMap.find?] at h
+  family_lctx_eq := rfl
+  constructorContext_eq := rfl
+  quotInit_eq := rfl
+  name_not_reflected := by decide
+  name_not_primitive := by
+    simp [aliasFormerRawType, Kernel.Environment.primitives,
+      NameSet.ofList]
+    simp +decide [NameSet.contains]
+
+private def aliasFormerCtorCandidateContextRun :
+    TypeChecker.CandidateContextRun aliasFormerCtorCandidateContext :=
+  aliasFormerFamilyStage.postContextRun
+
+/-- Family endpoint certificate used by the singleton list assembler. -/
+private def aliasFormerFamilySemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun typeFamilyAliasEnv []
+      aliasFormerFamilyCandidate aliasFormerRawType.type
+    where
+  contextRun := aliasFormerCandidateContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := aliasFormerFamily_candidateSource_tr
+  whnfFuel := 9999
+  whnfDepth := rfl
+  view := aliasFormerViewType.type
+  recursive := ⟨.sort (.succ (.succ .zero)),
+    aliasFormerFamilyCandidateRun⟩
+
+private def aliasFormerFamilyRootRun :
+    TypeChecker.CandidateExprRootRun typeFamilyAliasEnv []
+      aliasFormerFamilyCandidate aliasFormerRawType.type
+      aliasFormerViewType.type :=
+  aliasFormerFamilySemanticRootRun.root
+
+/-- Verified full-check certificate for the actual AliasFormer constructor
+type in the post-family environment. -/
+def aliasFormerCtorCheckTypeRun :
+    TypeChecker.CheckTypeRun aliasFormerTypeEnv [] []
+      aliasFormerMkInfo.type (.const ``TypeFamilyAlias [])
+      aliasFormerRawType.ctors[0].type
+      (.const ``TypeFamilyAlias []) := by
+  exact TypeChecker.CheckTypeRun.ofCandidateStep
+    aliasFormerCtorCheckTypeStep aliasFormerCtorCheckTypeStep_valid
+    aliasFormerCtorCandidateContextRun.context
+    aliasFormerCtorCandidateContextRun.context_eq
+    rfl rfl rfl aliasFormerCtorCandidateContextRun.state_wf
+    (.const rfl rfl rfl) (.const rfl rfl rfl)
+    10000 (by rfl)
+
+/-- Paired full-check/WHNF interpretation of the retained constructor leaf.
+This is the post-family terminal used by the generic constructor-spine
+assembler. -/
+private def aliasFormerCtorCandidateNodeRun :
+    TypeChecker.CandidateNodeRun aliasFormerTypeEnv [] []
+      aliasFormerCtorCandidateContext aliasFormerMkInfo.type
+      (.const ``TypeFamilyAlias []) (.const ``AliasFormer [])
+      aliasFormerRawType.ctors[0].type
+      aliasFormerRawType.ctors[0].type
+      (.const ``TypeFamilyAlias []) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    aliasFormerCtorCandidateContext aliasFormerMkInfo.type
+    (.const ``TypeFamilyAlias []) (.const ``AliasFormer [])
+    aliasFormerCtorCheckTypeStep_valid
+    aliasFormerCtorCandidateStep_valid
+    aliasFormerCtorCandidateContextRun.context
+    aliasFormerCtorCandidateContextRun.context_eq
+    rfl rfl rfl aliasFormerCtorCandidateContextRun.state_wf
+    aliasFormerCtorCheckTypeRun.expr_tr (.const rfl rfl rfl)
+    aliasFormerCtorCheckTypeRun.expr_tr
+    10000 9999 (by rfl) (by rfl)
+
+private theorem aliasFormerCtorCandidateRun :
+    TypeChecker.CandidateExprRun aliasFormerTypeEnv []
+      aliasFormerCtorCandidate.trace []
+      aliasFormerRawType.ctors[0].type
+      aliasFormerRawType.ctors[0].type
+      (.const ``TypeFamilyAlias []) :=
+  .terminal aliasFormerCtorCandidateNodeRun
+
+/-- Constructor endpoint certificate in the exact post-family context. -/
+private def aliasFormerCtorSemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun aliasFormerTypeEnv []
+      aliasFormerCtorCandidate aliasFormerRawType.ctors[0].type
+    where
+  contextRun := aliasFormerCtorCandidateContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := aliasFormerCtorCheckTypeRun.expr_tr
+  whnfFuel := 9999
+  whnfDepth := rfl
+  view := aliasFormerRawType.ctors[0].type
+  recursive := ⟨.const ``TypeFamilyAlias [], aliasFormerCtorCandidateRun⟩
+
+private def aliasFormerCtorRootRun :
+    TypeChecker.CandidateExprRootRun aliasFormerTypeEnv []
+      aliasFormerCtorCandidate aliasFormerRawType.ctors[0].type
+      aliasFormerRawType.ctors[0].type :=
+  aliasFormerCtorSemanticRootRun.root
+
+/-- The actual AliasFormer constructor type is typed by the verified full
+checker in the post-family environment. -/
+theorem aliasFormerCtor_hasType_checked :
+    aliasFormerTypeEnv.HasType 0 []
+      aliasFormerRawType.ctors[0].type
+      (.const ``TypeFamilyAlias []) :=
+  aliasFormerCtorCheckTypeRun.hasType
+
+/-- The raw AliasFormer family is a Theory type because the verified checker
+actually accepted it and inferred a sort. -/
+theorem aliasFormerFamily_isType_checked :
+    typeFamilyAliasEnv.IsType 0 [] aliasFormerRawType.type :=
+  aliasFormerFamilyCheckTypeRun.isType
+
+private theorem aliasFormerFamilySpineRun :
+    TypeChecker.CandidateExprSpineRun typeFamilyAliasEnv []
+      aliasFormerFamilyCandidate aliasFormerRawType.type
+      aliasFormerViewType.type :=
+  aliasFormerFamilySemanticRootRun.spine rfl
+
+private theorem aliasFormerCtorSpineRun :
+    TypeChecker.CandidateExprSpineRun aliasFormerTypeEnv []
+      aliasFormerCtorCandidate aliasFormerRawType.ctors[0].type
+      aliasFormerRawType.ctors[0].type :=
+  aliasFormerCtorSemanticRootRun.spine rfl
+
+/-- Verified delta-normalization leaf for `RecAlias.{1}`. -/
+def recAliasWhnfRun :
+    TypeChecker.WhnfRun aliasRecTypeEnv [] []
+      (.const ``RecAlias [.succ .zero])
+      recAliasWhnfKernelExpr
+      (.const ``RecAlias [.succ .zero])
+      (.lam (.sort (.succ .zero)) (.bvar 0)) where
+  context := aliasRecNormalizationContext
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  state_wf := TypeChecker.VState.WF.empty
+  lhs_tr := .const rfl rfl rfl
+  rhs_tr := by
+    have hs : TrExprS aliasRecTypeEnv [] []
+        recAliasWhnfKernelExpr
+        (.lam (.sort (.succ .zero)) (.bvar 0)) := by
+      rw [recAliasWhnfKernelExpr_eq]
+      exact .lam
+        ⟨_, VEnv.HasType.sort (by decide)⟩
+        (.sort rfl) (.bvar rfl)
+    exact hs
+  recursionFuel := 9999
+  run_eq := by
+    simpa [aliasRecNormalizationContext, TypeChecker.VContext.mk',
+      TypeChecker.VContext.mk1, TypeChecker.MLCtx.lctx,
+      aliasRecNormalizationRawContext] using
+      recAlias_whnf
+
+private theorem recAliasConst_hasType :
+    aliasRecTypeEnv.HasType 0 []
+      (.const ``RecAlias [.succ .zero])
+      (.forallE (.sort (.succ .zero)) (.sort (.succ .zero))) := by
+  have hAlias : aliasRecTypeEnv.constants ``RecAlias =
+      some (vconst(type_of% @RecAlias)) := rfl
+  type_tac
+
+private theorem aliasRecConst_hasType :
+    aliasRecTypeEnv.HasType 0 []
+      (.const ``AliasRec []) (.sort (.succ .zero)) := by
+  exact .constDF
+    (VEnv.addConst_self (show
+      recAliasEnv.addConst aliasRecRawType.name
+      aliasRecRawType.toVConstant = some aliasRecTypeEnv from rfl))
+    (fun _ h => nomatch h) (fun _ h => nomatch h) rfl .nil
+
+/-- Verified full-check certificate for the actual raw recursive field in the
+exact environment produced by inserting `AliasRec`. -/
+def aliasRecFieldCheckTypeRun :
+    TypeChecker.CheckTypeRun aliasRecTypeEnv [] []
+      aliasRecFieldKernelExpr (.sort (.succ .zero))
+      aliasRecRawField (.sort (.succ .zero)) where
+  context := aliasRecNormalizationContext
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  state_wf := TypeChecker.VState.WF.empty
+  expr_tr := .app recAliasConst_hasType aliasRecConst_hasType
+    (.const rfl rfl rfl) (.const rfl rfl rfl)
+  inferred_tr := .sort rfl
+  recursionFuel := 9999
+  run_eq := by
+    simpa [aliasRecNormalizationContext, TypeChecker.VContext.mk',
+      TypeChecker.VContext.mk1, TypeChecker.MLCtx.lctx,
+      aliasRecNormalizationRawContext] using
+      aliasRecField_checkType
+
+/-- The raw recursive field is typed by an exact full checker execution in
+the post-family environment. -/
+theorem aliasRecField_hasType_checked :
+    aliasRecTypeEnv.HasType 0 []
+      aliasRecRawField (.sort (.succ .zero)) :=
+  aliasRecFieldCheckTypeRun.hasType
+
+private theorem aliasRecFieldEvidenceBase :
+    TypeChecker.DefEqEvidence aliasRecTypeEnv 0 []
+      aliasRecRawField (.const ``AliasRec []) (.sort (.succ .zero)) := by
+  exact .trans
+    (.app
+      (.whnf recAliasWhnfRun recAliasConst_hasType)
+      (.refl aliasRecConst_hasType))
+    (.beta (VEnv.HasType.bvar .zero) aliasRecConst_hasType)
+
+private theorem aliasRecFieldEvidence :
+    TypeChecker.DefEqEvidence aliasRecTypeEnv 0 []
+      aliasRecRawField (.const ``AliasRec []) (.sort (.succ .zero)) :=
+  .trans (.refl aliasRecField_hasType_checked)
+    aliasRecFieldEvidenceBase
+
+private theorem aliasRecCtorEvidence :
+    ∃ A, TypeChecker.DefEqEvidence aliasRecTypeEnv 0 []
+      aliasRecRawType.ctors[0].type aliasRecViewCtor.type A := by
+  exact ⟨.sort (.imax (.succ .zero) (.succ .zero)),
+    .forallE aliasRecFieldEvidence
+      (.refl (aliasRecResult_hasType rfl))⟩
+
+private def aliasFormerCandidateConstructorSemanticRun :
+    VInductDecl.CandidateConstructorSemanticRun aliasFormerTypeEnv []
+      aliasFormerConstructorCandidate aliasFormerRawType.ctors[0] where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := aliasFormerCtorSemanticRootRun
+
+private def aliasFormerCandidateConstructorRun :
+    VInductDecl.CandidateConstructorRun aliasFormerTypeEnv []
+      aliasFormerConstructorCandidate aliasFormerRawType.ctors[0] :=
+  aliasFormerCandidateConstructorSemanticRun.root
+
+private def aliasFormerCandidateConstructorSemanticListRun :
+    VInductDecl.CandidateConstructorSemanticListRun aliasFormerTypeEnv []
+      aliasFormerFamilyListCandidate.constructors
+      aliasFormerRawType.ctors := by
+  exact .cons aliasFormerCandidateConstructorSemanticRun .nil
+
+private def aliasFormerCandidateConstructorListRun :
+    VInductDecl.CandidateConstructorListRun aliasFormerTypeEnv []
+      aliasFormerFamilyListCandidate.constructors
+      aliasFormerRawType.ctors :=
+  aliasFormerCandidateConstructorSemanticListRun.roots
+
+private def aliasFormerCandidateFamilySemanticRun :
+    VInductDecl.CandidateFamilySemanticRun typeFamilyAliasEnv []
+      aliasFormerFamilyListCandidate aliasFormerRawType where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := aliasFormerFamilySemanticRootRun
+  typeEnv := aliasFormerTypeEnv
+  addType := rfl
+  constructors := aliasFormerCandidateConstructorSemanticListRun
+
+private def aliasFormerCandidateFamilyRun :
+    VInductDecl.CandidateFamilyRun typeFamilyAliasEnv []
+      aliasFormerFamilyListCandidate aliasFormerRawType :=
+  aliasFormerCandidateFamilySemanticRun.root
+
+private def aliasFormerStagedUniverseInput :
+    VInductDecl.StagedNormalizationCandidateUniverseInput
+      aliasFormerCandidateContext aliasFormerCtorCandidateContext
+      typeFamilyAliasEnv [] aliasFormerNormalizationCandidate
+      aliasFormerRawDecl where
+  staged := {
+    raw := aliasFormerRawType
+    raw_types_eq := rfl
+    declaration_uvars_eq := rfl
+    preFamily := aliasFormerPreFamilyStage
+    family := aliasFormerFamilyStage
+    validation_nparams_eq := rfl
+    constructorValidation :=
+      AddInductive.ConstructorValidationRun.of_run aliasFormer_checkConstructors
+    constructors := .cons {
+      name_eq := rfl
+      uvars_eq := rfl
+      type := {
+        context_eq := rfl
+        source_tr := aliasFormerCtorCheckTypeRun.expr_tr
+        whnfFuel := 9999
+        whnfDepth := rfl } } .nil
+    familyTypesProduced := aliasFormerFamilyTypeListProduced
+    familiesProduced := aliasFormerFamilyListProduced }
+  universeRun := aliasFormer_checkConstructorUniverseSemantics
+
+private theorem aliasFormerConstructorValidationContext_eq :
+    { aliasFormerNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+      env := aliasFormerCtorCandidateContext.env } =
+      aliasFormerCtorCandidateContext := rfl
+
+private theorem aliasFormerCtorCandidateContext_empty :
+    aliasFormerCtorCandidateContext.withEmptyLocalContext =
+      aliasFormerCtorCandidateContext := rfl
+
+set_option warn.sorry false in
+theorem aliasFormerAlignmentRun :
+    aliasFormerStagedUniverseInput.staged.constructorValidation.trace.checkCandidateAlignment
+      aliasFormerNormalizationCandidate.families.singleton.constructors
+      { aliasFormerNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+        env := aliasFormerCtorCandidateContext.env } = .ok () := by
+  -- Tier V (Spec-19B, v4.33 reconciliation repair debt): the premerge proof
+  -- stepped `ConstructorCandidateAlignmentTrace.build` with `rw [build.eq_def]`,
+  -- which the v4.33 elaborator no longer matches (and eq_def-in-simp loops).
+  -- The statement is an exact closed checker run and remains true; the
+  -- stepping proof needs a rework against the new equation-lemma shapes.
+  sorry
+
+private def aliasFormerStagedPostFamilyInput :
+    VInductDecl.StagedNormalizationCandidatePostFamilyInput
+      aliasFormerCandidateContext aliasFormerCtorCandidateContext
+      typeFamilyAliasEnv [] aliasFormerNormalizationCandidate
+      aliasFormerRawDecl :=
+  VInductDecl.StagedNormalizationCandidatePostFamilyInput.ofRun
+    aliasFormerStagedUniverseInput aliasFormerAlignmentRun
+
+private theorem aliasFormerPreFamilySafetyRun :
+    AddInductive.checkConstructorPreFamilySafety
+        aliasFormerStagedUniverseInput.staged.family.validation.stats
+        aliasFormerNormalizationCandidate.families.singleton.familyType.type.view
+        aliasFormerNormalizationCandidate.families.singleton.constructors
+        aliasFormerNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext =
+      .ok () := by
+  change AddInductive.checkConstructorPreFamilySafety
+    aliasFormerInductiveStats (.sort (.succ .zero))
+    (.cons aliasFormerConstructorCandidate .nil)
+    aliasFormerCandidateContext = .ok ()
+  let sortStep : AddInductive.CandidateCheckTypeStep :=
+    ⟨aliasFormerCandidateContext, .sort (.succ .zero),
+      .sort (.succ (.succ .zero))⟩
+  have sortRun : sortStep.Valid := by
+    change Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' (.sort (.succ .zero)) false
+        (TypeChecker.Methods.withFuel 9999)
+        aliasFormerCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) = _
+    unfold TypeChecker.Inner.inferType'
+    simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+      annotatedPi_checkLevelSuccZero, Bind.bind, ReaderT.bind,
+      StateT.bind, Except.bind]
+    rfl
+  have sortHasMVar : (Expr.sort (.succ .zero)).hasMVar = false := by
+    simp [Expr.hasMVar, annotatedPiSortOne_data_hasExprMVar_false,
+      annotatedPiSortOne_data_hasLevelMVar_false]
+  obtain ⟨sortChecked, sortCheckedRun⟩ :=
+    AddInductive.checkConstructorAlignedExpr.exists_of_run
+      (context := aliasFormerCandidateContext)
+      (source := .sort (.succ .zero))
+      (inferred := .sort (.succ (.succ .zero))) rfl sortHasMVar sortRun
+  have aliasArgs :
+      (Expr.const ``AliasFormer []).getAppArgs.toList.drop 0 = [] := by
+    rfl
+  have paramsSize : aliasFormerInductiveStats.params.size = 0 := rfl
+  have targetArgs :
+      (Expr.const ``AliasFormer []).getAppArgs.toList.drop
+        aliasFormerInductiveStats.params.size = [] := by
+    rw [paramsSize]
+    exact aliasArgs
+  have inductiveFuel :
+      aliasFormerCandidateContext.fuel.inductiveFuel = 1000 := rfl
+  unfold AddInductive.checkConstructorPreFamilySafety
+  have parametersRun :
+      AddInductive.instantiateFamilyParameters (.sort (.succ .zero))
+      aliasFormerInductiveStats.params.toList = .ok (.sort (.succ .zero)) := by
+    rfl
+  have sortTerminal : (Expr.sort (.succ .zero)).isForall = false := rfl
+  let spineTrace : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      aliasFormerCandidateContext (.sort (.succ .zero)) [] :=
+    .nil aliasFormerCandidateContext (.sort (.succ .zero)) sortChecked
+      sortTerminal
+  have spineRun :
+      AddInductive.ConstructorPreFamilyIndexSpineTrace.build
+          aliasFormerCandidateContext (.sort (.succ .zero)) [] =
+        .ok spineTrace := by
+    unfold AddInductive.ConstructorPreFamilyIndexSpineTrace.build
+    rw [dif_pos sortTerminal, sortCheckedRun]
+    rfl
+  obtain ⟨targetSpineTrace, targetSpineRun⟩ :
+      ∃ targetSpineTrace : AddInductive.ConstructorPreFamilyIndexSpineTrace
+          aliasFormerCandidateContext (.sort (.succ .zero))
+          ((Expr.const ``AliasFormer []).getAppArgs.toList.drop
+            aliasFormerInductiveStats.params.size),
+        AddInductive.ConstructorPreFamilyIndexSpineTrace.build
+            aliasFormerCandidateContext (.sort (.succ .zero))
+          ((Expr.const ``AliasFormer []).getAppArgs.toList.drop
+              aliasFormerInductiveStats.params.size) =
+          .ok targetSpineTrace := by
+    rw [targetArgs]
+    exact ⟨spineTrace, spineRun⟩
+  have valid : AddInductive.isValidIndAppIdx aliasFormerInductiveStats
+      (.const ``AliasFormer []) 0 = true :=
+    aliasFormerCtor_isValidIndAppIdx
+  have independent : AddInductive.constructorIndependentOf
+      (.const ``AliasFormer []) [] = true := by
+    rfl
+  obtain ⟨viewTrace, viewRun⟩ : ∃ viewTrace,
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          aliasFormerInductiveStats 0 (.sort (.succ .zero))
+          aliasFormerCandidateContext (.const ``AliasFormer []) 0 [] false
+          aliasFormerCandidateContext.fuel.inductiveFuel = .ok viewTrace := by
+    rw [inductiveFuel]
+    rw [show 1000 = 999 + 1 by rfl]
+    simp only [AddInductive.ConstructorPreFamilyViewTrace.build]
+    rw [dif_pos valid, dif_pos independent]
+    rw [targetSpineRun]
+    exact ⟨_, rfl⟩
+  obtain ⟨listTrace, listRun⟩ : ∃ listTrace,
+      AddInductive.ConstructorPreFamilyListTrace.build
+          aliasFormerInductiveStats 0 (.sort (.succ .zero))
+          aliasFormerCandidateContext
+          (.cons aliasFormerConstructorCandidate .nil) = .ok listTrace := by
+    refine ⟨.cons viewTrace .nil, ?_⟩
+    simp [AddInductive.ConstructorPreFamilyListTrace.build,
+      aliasFormerConstructorCandidate, aliasFormerCtorCandidate,
+      AddInductive.CandidateExpr.view, AddInductive.CandidateExprTrace.view,
+      viewRun, Bind.bind, Except.bind, Except.pure, Pure.pure]
+  have translationUnique :
+      (AddInductive.theoryTranslationUnique (.sort (.succ .zero)) &&
+        (AddInductive.CandidateList.cons aliasFormerConstructorCandidate
+          (AddInductive.CandidateList.nil : AddInductive.CandidateList
+            AddInductive.CandidateConstructor [])).viewTranslationUnique) =
+        true := by
+    rfl
+  rw [if_pos translationUnique]
+  simp [parametersRun, listRun, Bind.bind, Except.bind,
+    Except.pure, Pure.pure]
+
+private def aliasFormerStagedPreFamilyInput :
+    VInductDecl.StagedNormalizationCandidatePreFamilyInput
+      aliasFormerCandidateContext aliasFormerCtorCandidateContext
+      typeFamilyAliasEnv [] aliasFormerNormalizationCandidate
+      aliasFormerRawDecl :=
+  VInductDecl.StagedNormalizationCandidatePreFamilyInput.ofRun
+    aliasFormerStagedPostFamilyInput aliasFormerPreFamilySafetyRun
+
+/-- The exact family/constructor producer traversals and verified translations
+automatically determine a complete retained AliasFormer hierarchy. -/
+theorem aliasFormerProducedSemanticHierarchy_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidateSemanticRun
+      aliasFormerCandidateContext aliasFormerCtorCandidateContext
+      typeFamilyAliasEnv [] aliasFormerNormalizationCandidate
+      aliasFormerRawDecl) :=
+  aliasFormerStagedUniverseInput.exists
+
+/-- The retained validator telescope and independently produced candidate
+telescope align positionally and admit the complete post-family semantic
+interpretation for `AliasFormer`. -/
+theorem aliasFormerProducedPostFamilySemantic_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidatePostFamilySemanticRun
+      aliasFormerStagedPostFamilyInput) :=
+  aliasFormerStagedPostFamilyInput.exists
+
+/-- AliasFormer's analyzer-owned constructor candidate passes the executable
+pre-family suffix/dependency gate and admits the exact family-free replay. -/
+theorem aliasFormerProducedPreFamilySemantic_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidatePreFamilySemanticRun
+      aliasFormerStagedPreFamilyInput) :=
+  aliasFormerStagedPreFamilyInput.exists
+
+def aliasFormerNormalizationCandidateRun :
+    VInductDecl.NormalizationCandidateRun typeFamilyAliasEnv []
+      aliasFormerNormalizationCandidate aliasFormerRawDecl where
+  raw := aliasFormerRawType
+  raw_types_eq := rfl
+  uvars_eq := rfl
+  family := aliasFormerCandidateFamilyRun
+
+example : aliasFormerNormalizationCandidateRun.viewDecl =
+    aliasFormerViewDecl := rfl
+
+example : aliasFormerNormalizationCandidateRun.normalization.accepted =
+    true := rfl
+
+theorem aliasFormerCandidateNormalization_eq :
+    aliasFormerNormalizationCandidateRun.normalization =
+      aliasFormerNormalization := rfl
+
+private def aliasFormerTruncatedViewType : VInductiveType :=
+  { aliasFormerViewType with ctors := [] }
+
+private def aliasFormerTruncatedViewDecl : VInductDecl :=
+  { aliasFormerViewDecl with types := [aliasFormerTruncatedViewType] }
+
+/-- A shorter view cannot cross even the computational normalization-shape
+gate, so it cannot reach dependent analysis or transaction construction. -/
+theorem aliasFormerTruncatedView_rejected :
+    VInductDecl.normalization? aliasFormerRawDecl
+      aliasFormerTruncatedViewDecl = none := rfl
+
+/-- Complete checker-produced semantic normalization certificate for
+AliasFormer. -/
+def aliasFormerNormalizationRun :
+    VInductDecl.NormalizationRun aliasFormerNormalization
+      typeFamilyAliasEnv := by
+  simpa only [aliasFormerCandidateNormalization_eq] using
+    aliasFormerNormalizationCandidateRun.normalizationRun
+
+theorem aliasFormerNormalization_wf_checked :
+    aliasFormerNormalization.WF typeFamilyAliasEnv :=
+  aliasFormerNormalizationRun.wf
+
+/-- Complete checker-produced semantic normalization certificate for
+AliasRec. The field comparison is assembled from verified WHNF, application,
+beta, and outer-forall congruence. -/
+def aliasRecNormalizationRun :
+    VInductDecl.NormalizationRun aliasRecNormalization recAliasEnv := by
+  refine {
+    raw := aliasRecRawType
+    view := aliasRecViewType
+    source_types_eq := rfl
+    view_types_eq := rfl
+    family := ?_
+    typeEnv := aliasRecTypeEnv
+    addType := rfl
+    constructors := ?_ }
+  · exact ⟨.sort (.succ (.succ .zero)),
+      .refl (VEnv.HasType.sort (by decide))⟩
+  · exact .cons aliasRecCtorEvidence .nil
+
+theorem aliasRecNormalization_wf_checked :
+    aliasRecNormalization.WF recAliasEnv :=
+  aliasRecNormalizationRun.wf
+
+/-- The paired AliasFormer block with its normalization component supplied by
+the checked WHNF path. The view's structural semantics remain the ordinary
+Theory `Checked.WF` proof. -/
+theorem aliasFormerBlock_wf_checked :
+    aliasFormerBlock.WF typeFamilyAliasEnv := by
+  refine ⟨aliasFormerNormalization_wf_checked, ?_⟩
+  change aliasFormerViewChecked.WF typeFamilyAliasEnv
+  exact aliasFormerViewChecked.wf_of_decl aliasFormerViewDecl_wf
+
+private theorem aliasFormerFamily_defeq_checked :
+    typeFamilyAliasEnv.IsDefEq 0 []
+      (.const ``TypeFamilyAlias []) (.sort (.succ .zero))
+      (.sort (.succ (.succ .zero))) :=
+  aliasFormerFamilyWhnfRun.isDefEq
+    aliasFormerFamilyCheckTypeRun.hasType
+
+/-- Combining the constructor's exact full-check result with the verified
+family-alias WHNF fixes its Theory sort. -/
+theorem aliasFormerCtor_hasSort_checked :
+    aliasFormerTypeEnv.HasType 0 []
+      aliasFormerRawType.ctors[0].type (.sort (.succ .zero)) := by
+  have halias :=
+    aliasFormerFamily_defeq_checked.mono (VEnv.addConst_le (show
+      typeFamilyAliasEnv.addConst aliasFormerRawType.name
+        aliasFormerRawType.toVConstant = some aliasFormerTypeEnv from rfl))
+  exact halias.defeq aliasFormerCtor_hasType_checked
+
+theorem aliasFormerCtor_isType_checked :
+    aliasFormerTypeEnv.IsType 0 []
+      aliasFormerRawType.ctors[0].type :=
+  ⟨.succ .zero, aliasFormerCtor_hasSort_checked⟩
+
+private theorem aliasFormerCandidate_generationShape :
+    VInductDecl.normalizationCandidateGenerationShape aliasFormerRawDecl
+      aliasFormerRawType aliasFormerNormalizationCandidate = true :=
+  rfl
+
+private def aliasFormerProducedGenerationShapeCandidate :
+    VInductDecl.ProducedGenerationShapeCandidate aliasFormerRawDecl
+      aliasFormerRawType aliasFormerKernelType 0 false
+      aliasFormerCandidateContext where
+  candidate := aliasFormerNormalizationCandidate
+  produced := aliasFormerNormalizationCandidate_produced
+  shape := aliasFormerCandidate_generationShape
+
+/-- The strengthened outer gate returns the exact AliasFormer candidate with
+its complete executable generation layout attached. -/
+theorem aliasFormerGenerationShapeCandidate_produced :
+    VInductDecl.produceGenerationShapeCandidate aliasFormerRawDecl
+      aliasFormerRawType aliasFormerKernelType 0 false
+      aliasFormerCandidateContext =
+        .ok aliasFormerProducedGenerationShapeCandidate := by
+  have produced :
+      AddInductive.buildNormalizationCandidate aliasFormerRawDecl.nparams
+          [aliasFormerKernelType] 0 false aliasFormerCandidateContext =
+        .ok aliasFormerNormalizationCandidate :=
+    aliasFormerNormalizationCandidate_produced
+  simpa only [aliasFormerProducedGenerationShapeCandidate] using
+    VInductDecl.produceGenerationShapeCandidate_eq_ok
+      (source := aliasFormerRawDecl) (raw := aliasFormerRawType)
+      produced aliasFormerCandidate_generationShape
+
+private theorem aliasFormerCandidate_analysis
+    (normalization : VInductDecl.NormalizationCandidateSemanticRun
+      typeFamilyAliasEnv [] aliasFormerNormalizationCandidate
+      aliasFormerRawDecl) :
+    normalization.root.normalization.generation? =
+      some aliasFormerGenerationChecked := by
+  let reference : VInductDecl.NormalizationCandidateSemanticRun
+      typeFamilyAliasEnv [] aliasFormerNormalizationCandidate
+      aliasFormerRawDecl := {
+    raw := aliasFormerRawType
+    raw_types_eq := rfl
+    uvars_eq := rfl
+    family := aliasFormerCandidateFamilySemanticRun }
+  rw [aliasFormerStagedPreFamilyInput.normalization_eq normalization reference]
+  rfl
+
+/-- The staged owner, exact dependent analysis, and strengthened producer
+close AliasFormer without exposing a caller-selected semantic hierarchy. -/
+theorem aliasFormerExactProducedGenerationCandidatePackage_exists :
+    Nonempty (VInductDecl.ExactProducedGenerationCandidatePackage
+      typeFamilyAliasEnv [] aliasFormerProducedGenerationShapeCandidate
+      aliasFormerGenerationChecked) :=
+  aliasFormerProducedGenerationShapeCandidate.exactProducedPackage_nonempty
+    aliasFormerStagedPreFamilyInput rfl aliasFormerGenerationChecked
+    aliasFormerCandidate_analysis
+
+private def
+    aliasFormerExactProducedGenerationCandidatePackage :
+    VInductDecl.ExactProducedGenerationCandidatePackage typeFamilyAliasEnv []
+      aliasFormerProducedGenerationShapeCandidate aliasFormerGenerationChecked :=
+  aliasFormerProducedGenerationShapeCandidate.exactProducedPackage
+    aliasFormerStagedPreFamilyInput rfl aliasFormerGenerationChecked
+    aliasFormerCandidate_analysis
+
+/-- Complete source-indexed candidate certificate for the non-identity
+AliasFormer generation transaction. -/
+def aliasFormerGenerationCandidateSemanticRun :
+  VInductDecl.GenerationCandidateSemanticRun
+      aliasFormerExactProducedGenerationCandidatePackage.normalization
+      aliasFormerGenerationChecked :=
+  aliasFormerExactProducedGenerationCandidatePackage.semantic
+
+def aliasFormerGenerationCandidateRun :
+    VInductDecl.GenerationCandidateRun
+      aliasFormerExactProducedGenerationCandidatePackage.normalization.root
+      aliasFormerGenerationChecked :=
+  aliasFormerGenerationCandidateSemanticRun.run
+
+/-- The generic dependent package retains the exact AliasFormer kernel
+source, candidate trace, reconstructed normalization, successful dependent
+analysis, and semantic generation run in one value. -/
+def aliasFormerGenerationCandidatePackage :
+    VInductDecl.GenerationCandidatePackage typeFamilyAliasEnv [] :=
+  aliasFormerGenerationCandidateSemanticRun.package
+
+/-- The complete AliasFormer semantic package is selected by the exact
+successful whole-call metadata producer, including its pre-family and
+post-family checker environments. -/
+def aliasFormerProducedGenerationCandidatePackage :
+    VInductDecl.ProducedGenerationCandidatePackage typeFamilyAliasEnv [] :=
+  aliasFormerExactProducedGenerationCandidatePackage.package
+
+/-- Theory-only erasure of the AliasFormer producer package. This is the
+consumer-facing value accepted by the public non-identity transaction. -/
+def aliasFormerGenerationCertificate :
+    aliasFormerRawDecl.GenerationCertificate typeFamilyAliasEnv where
+  generation := aliasFormerGenerationChecked
+  wf := aliasFormerExactProducedGenerationCandidatePackage.semantic.run.wf
+
+/-- The public proof-carrying path exposes AliasFormer's candidate-derived
+non-identity generation without exposing its checker package. -/
+theorem aliasFormer_addInductCertified_checked :
+    typeFamilyAliasEnv.addInductCertified
+        aliasFormerGenerationCertificate =
+      some aliasFormerFinalEnv :=
+  aliasFormer_addInductGeneration
+
+theorem aliasFormerCertified_trace :
+    Nonempty (VEnv.AddInductGenerationTrace typeFamilyAliasEnv
+      aliasFormerFinalEnv aliasFormerGenerationChecked) :=
+  VEnv.addInductCertified_trace aliasFormer_addInductCertified_checked
+
+theorem aliasFormerCertified_ordered : aliasFormerFinalEnv.Ordered :=
+  VEnv.addInductCertified_WF typeFamilyAliasEnv_ordered
+    aliasFormer_addInductCertified_checked
+
+/-- Complete checker-side AliasFormer generation run, now derived by the
+generic family/constructor spine assembler from the executable singleton
+candidate rather than assembled field-by-field by the fixture. -/
+def aliasFormerGenerationRun :
+    VInductDecl.GenerationRun aliasFormerGenerationChecked
+      typeFamilyAliasEnv :=
+  aliasFormerProducedGenerationCandidatePackage.package.run.generationRun
+
+/-- Generation-ready AliasFormer certificate whose raw/view family equality
+comes from the verified checker execution rather than the fixture's explicit
+delta rule. -/
+theorem aliasFormerGenerationChecked_wf_checked :
+    aliasFormerGenerationChecked.WF typeFamilyAliasEnv :=
+  aliasFormerGenerationCertificate.wf
+
+/-- The paired AliasRec block with its field normalization supplied by the
+checked WHNF/application/beta certificate. -/
+theorem aliasRecBlock_wf_checked :
+    aliasRecBlock.WF recAliasEnv := by
+  refine ⟨aliasRecNormalization_wf_checked, ?_⟩
+  change aliasRecViewChecked.WF recAliasEnv
+  exact aliasRecViewChecked.wf_of_decl aliasRecViewDecl_wf
+
+/-- Complete checker-side AliasRec generation run. Its constructor telescope
+retains the checked compositional alias equality as pointwise evidence. -/
+def aliasRecGenerationRun :
+    VInductDecl.GenerationRun aliasRecGenerationChecked recAliasEnv := by
+  refine {
+    normalization := aliasRecNormalizationRun
+    checked := aliasRecViewChecked.wf_of_decl aliasRecViewDecl_wf
+    familyTel := .nil
+    familyResult := .refl (VEnv.HasType.sort (by decide))
+    typeEnv := aliasRecTypeEnv
+    addType := rfl
+    constructors := ?_ }
+  intro ctor hctor
+  change ctor ∈
+    [⟨aliasRecRawType.ctors[0],
+      aliasRecViewChecked.constructors[0]⟩] at hctor
+  obtain rfl := List.mem_singleton.1 hctor
+  have hresult := aliasRecResult_hasType rfl
+  exact {
+    declaredTel := .cons aliasRecFieldEvidence .nil
+    declaredResult := .refl hresult
+    emittedTel := .cons aliasRecFieldEvidence .nil
+    emittedResult := .refl hresult }
+
+/-- Generation-ready AliasRec certificate whose raw field typing comes from
+the exact post-family full-check run and whose normalization equality composes
+the verified WHNF, application, and beta steps. -/
+theorem aliasRecGenerationChecked_wf_checked :
+    aliasRecGenerationChecked.WF recAliasEnv :=
+  aliasRecGenerationRun.wf
+
+/-! ## Annotated recursive-Pi candidate interpretation -/
+
+private def annotatedPiRawDomain : VExpr :=
+  .app (.const ``outParam [.succ .zero]) (.sort .zero)
+
+private def annotatedPiRawInner : VExpr :=
+  .forallE annotatedPiRawDomain (.const ``AnnotatedPi [])
+
+private def annotatedPiViewInner : VExpr :=
+  .forallE (.sort .zero) (.const ``AnnotatedPi [])
+
+private theorem annotatedPiFamilyConst_hasType (Γ : List VExpr) :
+    annotatedPiTypeEnv.HasType 0 Γ
+      (.const ``AnnotatedPi []) (.sort (.succ .zero)) := by
+  have hfamily : annotatedPiTypeEnv.constants ``AnnotatedPi =
+      some annotatedPiRawType.toVConstant := rfl
+  type_tac
+
+private theorem annotatedPiRawDomain_hasType (Γ : List VExpr) :
+    annotatedPiTypeEnv.HasType 0 Γ annotatedPiRawDomain
+      (.sort (.succ .zero)) := by
+  have hout : annotatedPiTypeEnv.constants ``outParam =
+      some (vconst(type_of% @outParam)) := rfl
+  type_tac
+
+private theorem annotatedPiForall_hasType
+    {Γ : List VExpr} {domain body : VExpr}
+    (domainType : annotatedPiTypeEnv.HasType 0 Γ domain
+      (.sort (.succ .zero)))
+    (bodyType : annotatedPiTypeEnv.HasType 0 (domain :: Γ) body
+      (.sort (.succ .zero))) :
+    annotatedPiTypeEnv.HasType 0 Γ (.forallE domain body)
+      (.sort (.succ .zero)) :=
+  .defeqDF
+    (.sortDF (by decide) (by decide) VLevel.imax_self)
+    (VEnv.HasType.forallE domainType bodyType)
+
+private theorem annotatedPiRawInner_hasType (Γ : List VExpr) :
+    annotatedPiTypeEnv.HasType 0 Γ annotatedPiRawInner
+      (.sort (.succ .zero)) := by
+  simpa [annotatedPiRawInner] using annotatedPiForall_hasType
+    (annotatedPiRawDomain_hasType Γ)
+    (annotatedPiFamilyConst_hasType (annotatedPiRawDomain :: Γ))
+
+private theorem annotatedPiViewInner_hasType (Γ : List VExpr) :
+    annotatedPiTypeEnv.HasType 0 Γ annotatedPiViewInner
+      (.sort (.succ .zero)) := by
+  simpa [annotatedPiViewInner] using annotatedPiForall_hasType
+    (VEnv.HasType.sort (by decide))
+    (annotatedPiFamilyConst_hasType ((.sort .zero) :: Γ))
+
+private theorem annotatedPiRawCtor_hasType :
+    annotatedPiTypeEnv.HasType 0 []
+      annotatedPiRawType.ctors[0].type (.sort (.succ .zero)) := by
+  rw [show annotatedPiRawType.ctors[0].type =
+    .forallE annotatedPiRawInner (.const ``AnnotatedPi []) by rfl]
+  simpa using annotatedPiForall_hasType
+    (annotatedPiRawInner_hasType [])
+    (annotatedPiFamilyConst_hasType [annotatedPiRawInner])
+
+private theorem annotatedPiViewCtor_hasType :
+    annotatedPiTypeEnv.HasType 0 []
+      annotatedPiViewCtor.type (.sort (.succ .zero)) := by
+  simpa [annotatedPiViewCtor, annotatedPiViewInner] using
+    annotatedPiForall_hasType (annotatedPiViewInner_hasType [])
+      (annotatedPiFamilyConst_hasType [annotatedPiViewInner])
+
+private theorem annotatedPiCtorSource_tr :
+    TrExprS annotatedPiTypeEnv [] [] annotatedPiMkInfo.type
+      annotatedPiRawType.ctors[0].type := by
+  have hshape : TrTypeExpr annotatedPiTypeEnv [] []
+      annotatedPiMkInfo.type annotatedPiRawType.ctors[0].type := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS annotatedPiTypeEnv_ordered trivial
+    ⟨_, annotatedPiRawCtor_hasType⟩
+
+private theorem annotatedPiInnerSource_tr :
+    TrExprS annotatedPiTypeEnv [] [] annotatedPiInnerKernel
+      annotatedPiRawInner := by
+  have hshape : TrTypeExpr annotatedPiTypeEnv [] []
+      annotatedPiInnerKernel annotatedPiRawInner := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS annotatedPiTypeEnv_ordered trivial
+    ⟨_, annotatedPiRawInner_hasType []⟩
+
+private theorem annotatedPiDomainSource_tr :
+    TrExprS annotatedPiTypeEnv [] [] annotatedPiRawDomainKernel
+      annotatedPiRawDomain := by
+  have hshape : TrTypeExpr annotatedPiTypeEnv [] []
+      annotatedPiRawDomainKernel annotatedPiRawDomain := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS annotatedPiTypeEnv_ordered trivial
+    ⟨_, annotatedPiRawDomain_hasType []⟩
+
+private theorem annotatedPiConstSource_tr (Δ : VLCtx) :
+    TrExprS annotatedPiTypeEnv [] Δ (Expr.const ``AnnotatedPi [])
+      (VExpr.const ``AnnotatedPi []) :=
+  .const rfl rfl rfl
+
+private theorem annotatedPiInstConstSource_tr (Δ : VLCtx) :
+    TrExprS annotatedPiTypeEnv [] Δ
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr)
+      (VExpr.const ``AnnotatedPi []) := by
+  simpa using annotatedPiConstSource_tr Δ
+
+private theorem annotatedPiFamilyCandidatePrefix_ne :
+    annotatedPiFamilyCandidateContext.ngen.namePrefix ≠
+      (({} : TypeChecker.VState).ngen).namePrefix := by
+  decide
+
+private def annotatedPiFamilyCandidateContextRun :
+    TypeChecker.CandidateContextRun annotatedPiFamilyCandidateContext :=
+  TypeChecker.CandidateContextRun.root outParamVEnvs_wf rfl
+    annotatedPiFamilyCandidatePrefix_ne
+
+private theorem annotatedPiFamilySource_tr :
+    TrExprS outParamEnv [] [] annotatedPiInfo.type
+      annotatedPiRawType.type :=
+  annotatedPiInfo_tr.1.2.2
+
+private def annotatedPiPreFamilyStage :
+    TypeChecker.CandidateSemanticStage annotatedPiFamilyCandidateContext
+      outParamEnv [] where
+  contextRun := annotatedPiFamilyCandidateContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+
+private def annotatedPiFamilyValidationRun :
+    AddInductive.CandidateExprTrace.FamilyValidationRun
+      annotatedPiKernelType annotatedPiFamilyCandidate.trace where
+  nparams := 0
+  resultLevel := .succ .zero
+  stats := annotatedPiInductiveStats
+  stats_eq := rfl
+  terminal_eq := rfl
+  run := annotatedPi_checkInductiveTypes
+
+private def annotatedPiFamilyStage :
+    VInductDecl.CandidateFamilyStagedInput
+      annotatedPiFamilyCandidateContext annotatedPiCtorCandidateContext
+      outParamEnv [] annotatedPiFamilyListCandidate.familyType
+      annotatedPiRawType annotatedPiPreFamilyStage where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := {
+    context_eq := rfl
+    source_tr := annotatedPiFamilySource_tr
+    whnfFuel := 9999
+    whnfDepth := rfl }
+  validation := annotatedPiFamilyValidationRun
+  typeEnv := annotatedPiTypeEnv
+  addInduct := annotatedPiAddType
+  projectionReady := ProjectionReady.of_no_ctorInfo <| by
+    intro name _info h
+    change annotatedPiTypeMap.find?' name = some (.ctorInfo _info) at h
+    rw [annotatedPiTypeMap_wf.find?'_eq_find?] at h
+    simp only [annotatedPiTypeMap, outParamMap_wf.find?_insert] at h
+    simp only [outParamMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    by_cases hAnnotatedPi : ``AnnotatedPi = name <;>
+      by_cases hOutParam : ``outParam = name <;>
+      simp +decide [hAnnotatedPi, hOutParam, SMap.find?, annotatedPiInfo,
+        annotationOutParamInfo] at h
+  structureEtaReady := StructureEtaReady.of_no_ctorInfo <| by
+    intro name _info h
+    change annotatedPiTypeMap.find?' name = some (.ctorInfo _info) at h
+    rw [annotatedPiTypeMap_wf.find?'_eq_find?] at h
+    simp only [annotatedPiTypeMap, outParamMap_wf.find?_insert] at h
+    simp only [outParamMap, SMap.WF.find?_insert
+      (s := ({} : ConstMap)) SMap.WF.empty] at h
+    by_cases hAnnotatedPi : ``AnnotatedPi = name <;>
+      by_cases hOutParam : ``outParam = name <;>
+      simp +decide [hAnnotatedPi, hOutParam, SMap.find?, annotatedPiInfo,
+        annotationOutParamInfo] at h
+  family_lctx_eq := rfl
+  constructorContext_eq := rfl
+  quotInit_eq := rfl
+  name_not_reflected := by decide
+  name_not_primitive := by
+    simp [annotatedPiRawType, Kernel.Environment.primitives,
+      NameSet.ofList]
+    simp +decide [NameSet.contains]
+
+private def annotatedPiCtorCandidateContextRun :
+    TypeChecker.CandidateContextRun annotatedPiCtorCandidateContext :=
+  annotatedPiFamilyStage.postContextRun
+
+private def annotatedPiInnerBodyCandidateContextRun :
+    TypeChecker.CandidateContextRun
+      annotatedPiInnerBodyCandidateContext := by
+  simpa [annotatedPiInnerBodyCandidateContext,
+    annotatedPiDomainAnnotations] using
+    annotatedPiCtorCandidateContextRun.pushLocalDecl `p .default
+      (.sort .zero) annotatedPiCtorCandidateFresh (.sort .zero)
+      (TrExprS.sort rfl)
+      ⟨.succ .zero, VEnv.HasType.sort (by decide)⟩
+
+private def annotatedPiOuterBodyCandidateContextRun :
+    TypeChecker.CandidateContextRun
+      annotatedPiOuterBodyCandidateContext := by
+  have domain_tr :
+      annotatedPiCtorCandidateContextRun.context.TrExprS
+        annotatedPiInnerKernel annotatedPiRawInner := by
+    change
+      (annotatedPiFamilyStage.postFamily.contextRun.context.TrExprS
+        annotatedPiInnerKernel annotatedPiRawInner)
+    change TrExprS
+      annotatedPiFamilyStage.postFamily.contextRun.context.venv
+      annotatedPiFamilyStage.postFamily.contextRun.context.lparams
+      annotatedPiFamilyStage.postFamily.contextRun.context.vlctx
+      annotatedPiInnerKernel annotatedPiRawInner
+    rw [annotatedPiFamilyStage.postFamily.venv_eq,
+      annotatedPiFamilyStage.postFamily.lparams_eq,
+      annotatedPiFamilyStage.postFamily.vlctx_eq]
+    change TrExprS annotatedPiTypeEnv [] []
+      annotatedPiInnerKernel annotatedPiRawInner
+    exact annotatedPiInnerSource_tr
+  simpa [annotatedPiOuterBodyCandidateContext,
+    annotatedPiInnerAnnotations] using
+    annotatedPiCtorCandidateContextRun.pushLocalDecl
+      annotatedPiOuterName .default annotatedPiInnerKernel
+      annotatedPiCtorCandidateFresh annotatedPiRawInner domain_tr
+      ⟨.succ .zero, annotatedPiRawInner_hasType []⟩
+
+private theorem annotatedPiInnerBodyCandidateContextRun_vlctx :
+    annotatedPiInnerBodyCandidateContextRun.context.vlctx =
+      [(some (annotatedPiCtorCandidateContext.freshFVarId,
+          annotatedPiDomainAnnotations.consumed.fvarsList),
+        .vlam (.sort .zero))] := by
+  rfl
+
+private theorem annotatedPiOuterBodyCandidateContextRun_vlctx :
+    annotatedPiOuterBodyCandidateContextRun.context.vlctx =
+      [(some (annotatedPiCtorCandidateContext.freshFVarId,
+          annotatedPiInnerAnnotations.consumed.fvarsList),
+        .vlam annotatedPiRawInner)] := by
+  rfl
+
+private def annotatedPiFamilyCandidateNodeRun :
+    TypeChecker.CandidateNodeRun outParamEnv [] []
+      annotatedPiFamilyCandidateContext annotatedPiInfo.type
+      (.sort (.succ (.succ .zero))) annotatedPiInfo.type
+      annotatedPiRawType.type annotatedPiRawType.type
+      (.sort (.succ (.succ .zero))) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    annotatedPiFamilyCandidateContext annotatedPiInfo.type
+    (.sort (.succ (.succ .zero))) annotatedPiInfo.type
+    annotatedPiFamilyCheckTypeStep_valid
+    annotatedPiFamilyCandidateStep_valid
+    annotatedPiFamilyCandidateContextRun.context
+    annotatedPiFamilyCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiFamilyCandidateContextRun.state_wf
+    (.sort rfl) (.sort rfl)
+    (TrExprS.sort rfl)
+    10000 9999 rfl rfl
+
+private theorem annotatedPiFamilyCandidateRun :
+    TypeChecker.CandidateExprRun outParamEnv []
+      annotatedPiFamilyCandidate.trace []
+      annotatedPiRawType.type annotatedPiRawType.type
+      (.sort (.succ (.succ .zero))) :=
+  .terminal annotatedPiFamilyCandidateNodeRun
+
+private def annotatedPiFamilySemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun outParamEnv []
+      annotatedPiFamilyCandidate annotatedPiRawType.type
+    where
+  contextRun := annotatedPiFamilyCandidateContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := annotatedPiFamilyCandidateRun.source_tr
+  whnfFuel := 9999
+  whnfDepth := rfl
+  view := annotatedPiRawType.type
+  recursive := ⟨.sort (.succ (.succ .zero)),
+    annotatedPiFamilyCandidateRun⟩
+
+private def annotatedPiFamilyRootRun :
+    TypeChecker.CandidateExprRootRun outParamEnv []
+      annotatedPiFamilyCandidate annotatedPiRawType.type
+      annotatedPiRawType.type :=
+  annotatedPiFamilySemanticRootRun.root
+
+private theorem annotatedPiFamilySpineRun :
+    TypeChecker.CandidateExprSpineRun outParamEnv []
+      annotatedPiFamilyCandidate annotatedPiRawType.type
+      annotatedPiRawType.type :=
+  annotatedPiFamilySemanticRootRun.spine rfl
+
+private def annotatedPiCtorCandidateNodeRun :
+    TypeChecker.CandidateNodeRun annotatedPiTypeEnv [] []
+      annotatedPiCtorCandidateContext annotatedPiMkInfo.type
+      (.sort (.succ .zero)) annotatedPiMkInfo.type
+      annotatedPiRawType.ctors[0].type
+      annotatedPiRawType.ctors[0].type
+      (.sort (.succ .zero)) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    annotatedPiCtorCandidateContext annotatedPiMkInfo.type
+    (.sort (.succ .zero)) annotatedPiMkInfo.type
+    annotatedPiCtorCheckTypeStep_valid annotatedPiCtorCandidateStep_valid
+    annotatedPiCtorCandidateContextRun.context
+    annotatedPiCtorCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiCtorCandidateContextRun.state_wf
+    annotatedPiCtorSource_tr (.sort rfl)
+    annotatedPiCtorSource_tr
+    10000 9999 rfl rfl
+
+private def annotatedPiInnerCandidateNodeRun :
+    TypeChecker.CandidateNodeRun annotatedPiTypeEnv [] []
+      annotatedPiCtorCandidateContext annotatedPiInnerKernel
+      (.sort (.succ .zero)) annotatedPiInnerKernel
+      annotatedPiRawInner annotatedPiRawInner
+      (.sort (.succ .zero)) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    annotatedPiCtorCandidateContext annotatedPiInnerKernel
+    (.sort (.succ .zero)) annotatedPiInnerKernel
+    annotatedPiInnerCheckTypeStep_valid annotatedPiInnerCandidateStep_valid
+    annotatedPiCtorCandidateContextRun.context
+    annotatedPiCtorCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiCtorCandidateContextRun.state_wf
+    annotatedPiInnerSource_tr (.sort rfl)
+    annotatedPiInnerSource_tr
+    10000 9999 rfl rfl
+
+private def annotatedPiDomainCandidateNodeRun :
+    TypeChecker.CandidateNodeRun annotatedPiTypeEnv [] []
+      annotatedPiCtorCandidateContext annotatedPiRawDomainKernel
+      (.sort (.succ .zero)) (.sort .zero)
+      annotatedPiRawDomain (.sort .zero)
+      (.sort (.succ .zero)) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    annotatedPiCtorCandidateContext annotatedPiRawDomainKernel
+    (.sort (.succ .zero)) (.sort .zero)
+    annotatedPiDomainCheckTypeStep_valid annotatedPiDomainCandidateStep_valid
+    annotatedPiCtorCandidateContextRun.context
+    annotatedPiCtorCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiCtorCandidateContextRun.state_wf
+    annotatedPiDomainSource_tr (.sort rfl)
+    (TrExprS.sort rfl)
+    10000 9999 rfl rfl
+
+private def annotatedPiInnerBodyCandidateNodeRun :
+    TypeChecker.CandidateNodeRun annotatedPiTypeEnv []
+      annotatedPiInnerBodyCandidateContextRun.context.vlctx
+      annotatedPiInnerBodyCandidateContext
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr)
+      (.sort (.succ .zero)) (.const ``AnnotatedPi [])
+      (.const ``AnnotatedPi []) (.const ``AnnotatedPi [])
+      (.sort (.succ .zero)) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    annotatedPiInnerBodyCandidateContext
+    ((Expr.const ``AnnotatedPi []).instantiate1
+      annotatedPiCtorCandidateContext.freshExpr)
+    (.sort (.succ .zero)) (.const ``AnnotatedPi [])
+    (by simpa only [annotatedPiInnerBodyCheckTypeStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiInnerBodyCheckTypeStep_valid)
+    (by simpa only [annotatedPiInnerBodyCandidateStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiInnerBodyCandidateStep_valid)
+    annotatedPiInnerBodyCandidateContextRun.context
+    annotatedPiInnerBodyCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiInnerBodyCandidateContextRun.state_wf
+    (annotatedPiInstConstSource_tr
+      annotatedPiInnerBodyCandidateContextRun.context.vlctx)
+    (.sort rfl)
+    (annotatedPiConstSource_tr
+      annotatedPiInnerBodyCandidateContextRun.context.vlctx)
+    10000 9999 rfl rfl
+
+private def annotatedPiOuterBodyCandidateNodeRun :
+    TypeChecker.CandidateNodeRun annotatedPiTypeEnv []
+      annotatedPiOuterBodyCandidateContextRun.context.vlctx
+      annotatedPiOuterBodyCandidateContext
+      ((Expr.const ``AnnotatedPi []).instantiate1
+        annotatedPiCtorCandidateContext.freshExpr)
+      (.sort (.succ .zero)) (.const ``AnnotatedPi [])
+      (.const ``AnnotatedPi []) (.const ``AnnotatedPi [])
+      (.sort (.succ .zero)) := by
+  exact TypeChecker.CandidateNodeRun.ofCandidate
+    annotatedPiOuterBodyCandidateContext
+    ((Expr.const ``AnnotatedPi []).instantiate1
+      annotatedPiCtorCandidateContext.freshExpr)
+    (.sort (.succ .zero)) (.const ``AnnotatedPi [])
+    (by simpa only [annotatedPiOuterBodyCheckTypeStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiOuterBodyCheckTypeStep_valid)
+    (by simpa only [annotatedPiOuterBodyCandidateStep,
+        annotatedPiConst_instantiate1] using
+      annotatedPiOuterBodyCandidateStep_valid)
+    annotatedPiOuterBodyCandidateContextRun.context
+    annotatedPiOuterBodyCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiOuterBodyCandidateContextRun.state_wf
+    (annotatedPiInstConstSource_tr
+      annotatedPiOuterBodyCandidateContextRun.context.vlctx)
+    (.sort rfl)
+    (annotatedPiConstSource_tr
+      annotatedPiOuterBodyCandidateContextRun.context.vlctx)
+    10000 9999 rfl rfl
+
+private def annotatedPiDomainAnnotationsRun :
+    TypeChecker.IsDefEqRun annotatedPiTypeEnv [] []
+      annotatedPiRawDomainKernel annotatedPiDomainAnnotations.consumed
+      annotatedPiRawDomain (.sort .zero) := by
+  exact TypeChecker.IsDefEqRun.ofCandidateStep
+    ⟨annotatedPiCtorCandidateContext, annotatedPiRawDomainKernel,
+      annotatedPiDomainAnnotations.consumed⟩
+    annotatedPiDomainAnnotationsEq
+    annotatedPiCtorCandidateContextRun.context
+    annotatedPiCtorCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiCtorCandidateContextRun.state_wf
+    annotatedPiDomainSource_tr (.sort rfl) 10000 rfl
+
+private def annotatedPiInnerAnnotationsRun :
+    TypeChecker.IsDefEqRun annotatedPiTypeEnv [] []
+      annotatedPiInnerKernel annotatedPiInnerAnnotations.consumed
+      annotatedPiRawInner annotatedPiRawInner := by
+  exact TypeChecker.IsDefEqRun.ofCandidateStep
+    ⟨annotatedPiCtorCandidateContext, annotatedPiInnerKernel,
+      annotatedPiInnerAnnotations.consumed⟩
+    annotatedPiInnerAnnotationsEq
+    annotatedPiCtorCandidateContextRun.context
+    annotatedPiCtorCandidateContextRun.context_eq
+    rfl rfl rfl annotatedPiCtorCandidateContextRun.state_wf
+    annotatedPiInnerSource_tr annotatedPiInnerSource_tr 10000 rfl
+
+private theorem annotatedPiDomainCandidateRun :
+    TypeChecker.CandidateExprRun annotatedPiTypeEnv []
+      annotatedPiDomainCandidateTrace [] annotatedPiRawDomain
+      (.sort .zero) (.sort (.succ .zero)) :=
+  .terminal annotatedPiDomainCandidateNodeRun
+
+private theorem annotatedPiInnerBodyCandidateRun :
+    TypeChecker.CandidateExprRun annotatedPiTypeEnv []
+      annotatedPiInnerBodyCandidateTrace
+      [(some (annotatedPiCtorCandidateContext.freshFVarId,
+          annotatedPiDomainAnnotations.consumed.fvarsList),
+        .vlam (.sort .zero))]
+      (.const ``AnnotatedPi []) (.const ``AnnotatedPi [])
+      (.sort (.succ .zero)) := by
+  simpa only [annotatedPiInnerBodyCandidateTrace,
+    annotatedPiInnerBodyCandidateContextRun_vlctx] using
+    (TypeChecker.CandidateExprRun.terminal
+      annotatedPiInnerBodyCandidateNodeRun)
+
+private theorem annotatedPiOuterBodyCandidateRun :
+    TypeChecker.CandidateExprRun annotatedPiTypeEnv []
+      annotatedPiOuterBodyCandidateTrace
+      [(some (annotatedPiCtorCandidateContext.freshFVarId,
+          annotatedPiInnerAnnotations.consumed.fvarsList),
+        .vlam annotatedPiRawInner)]
+      (.const ``AnnotatedPi []) (.const ``AnnotatedPi [])
+      (.sort (.succ .zero)) := by
+  simpa only [annotatedPiOuterBodyCandidateTrace,
+    annotatedPiOuterBodyCandidateContextRun_vlctx] using
+    (TypeChecker.CandidateExprRun.terminal
+      annotatedPiOuterBodyCandidateNodeRun)
+
+private theorem annotatedPiInnerCandidateRun :
+    TypeChecker.CandidateExprRun annotatedPiTypeEnv []
+      annotatedPiInnerCandidateTrace [] annotatedPiRawInner
+      annotatedPiViewInner (.sort (.succ .zero)) := by
+  exact .forallE annotatedPiDomainAnnotations
+    annotatedPiDomainAnnotationsEq annotatedPiDomainCandidateTrace
+    annotatedPiInnerBodyCandidateTrace
+    annotatedPiInnerCandidateNodeRun annotatedPiDomainCandidateRun
+    annotatedPiDomainAnnotationsRun annotatedPiInnerBodyCandidateRun
+    (annotatedPiRawDomain_hasType [])
+    (annotatedPiFamilyConst_hasType [annotatedPiRawDomain])
+    (annotatedPiFamilyConst_hasType [annotatedPiRawDomain]) rfl
+
+private theorem annotatedPiCtorCandidateRun :
+    TypeChecker.CandidateExprRun annotatedPiTypeEnv []
+      annotatedPiCtorCandidate.trace []
+      annotatedPiRawType.ctors[0].type annotatedPiViewCtor.type
+      (.sort (.succ .zero)) := by
+  exact .forallE annotatedPiInnerAnnotations
+    annotatedPiInnerAnnotationsEq annotatedPiInnerCandidateTrace
+    annotatedPiOuterBodyCandidateTrace
+    annotatedPiCtorCandidateNodeRun annotatedPiInnerCandidateRun
+    annotatedPiInnerAnnotationsRun annotatedPiOuterBodyCandidateRun
+    (annotatedPiRawInner_hasType [])
+    (annotatedPiFamilyConst_hasType [annotatedPiRawInner])
+    (annotatedPiFamilyConst_hasType [annotatedPiRawInner]) rfl
+
+private def annotatedPiCtorSemanticRootRun :
+    TypeChecker.CandidateExprSemanticRootRun annotatedPiTypeEnv []
+      annotatedPiCtorCandidate annotatedPiRawType.ctors[0].type
+    where
+  contextRun := annotatedPiCtorCandidateContextRun
+  venv_eq := rfl
+  lparams_eq := rfl
+  vlctx_eq := rfl
+  source_tr := annotatedPiCtorCandidateRun.source_tr
+  whnfFuel := 9999
+  whnfDepth := rfl
+  view := annotatedPiViewCtor.type
+  recursive := ⟨.sort (.succ .zero), annotatedPiCtorCandidateRun⟩
+
+private def annotatedPiCtorRootRun :
+    TypeChecker.CandidateExprRootRun annotatedPiTypeEnv []
+      annotatedPiCtorCandidate annotatedPiRawType.ctors[0].type
+      annotatedPiViewCtor.type :=
+  annotatedPiCtorSemanticRootRun.root
+
+private theorem annotatedPiCtorCandidate_storedSpine :
+    annotatedPiCtorCandidate.trace.storedSpine = true := by
+  have hsource : annotatedPiMkInfo.type =
+      .forallE annotatedPiOuterName annotatedPiInnerKernel
+        (.const ``AnnotatedPi []) .default := rfl
+  simp only [annotatedPiCtorCandidate, annotatedPiCtorCandidateTrace,
+    AddInductive.CandidateExprTrace.storedSpine, hsource,
+    Expr.structuralEq_refl, Bool.true_and]
+  rfl
+
+private theorem annotatedPiCtorSpineRun :
+    TypeChecker.CandidateExprSpineRun annotatedPiTypeEnv []
+      annotatedPiCtorCandidate annotatedPiRawType.ctors[0].type
+      annotatedPiViewCtor.type :=
+  annotatedPiCtorSemanticRootRun.spine
+    annotatedPiCtorCandidate_storedSpine
+
+private def annotatedPiCandidateConstructorSemanticRun :
+    VInductDecl.CandidateConstructorSemanticRun annotatedPiTypeEnv []
+      annotatedPiConstructorCandidate annotatedPiRawType.ctors[0] where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := annotatedPiCtorSemanticRootRun
+
+private def annotatedPiCandidateConstructorRun :
+    VInductDecl.CandidateConstructorRun annotatedPiTypeEnv []
+      annotatedPiConstructorCandidate annotatedPiRawType.ctors[0] :=
+  annotatedPiCandidateConstructorSemanticRun.root
+
+private def annotatedPiCandidateConstructorSemanticListRun :
+    VInductDecl.CandidateConstructorSemanticListRun annotatedPiTypeEnv []
+      annotatedPiFamilyListCandidate.constructors
+      annotatedPiRawType.ctors := by
+  exact .cons annotatedPiCandidateConstructorSemanticRun .nil
+
+private def annotatedPiCandidateConstructorListRun :
+    VInductDecl.CandidateConstructorListRun annotatedPiTypeEnv []
+      annotatedPiFamilyListCandidate.constructors
+      annotatedPiRawType.ctors :=
+  annotatedPiCandidateConstructorSemanticListRun.roots
+
+private def annotatedPiCandidateFamilySemanticRun :
+    VInductDecl.CandidateFamilySemanticRun outParamEnv []
+      annotatedPiFamilyListCandidate annotatedPiRawType where
+  name_eq := rfl
+  uvars_eq := rfl
+  type := annotatedPiFamilySemanticRootRun
+  typeEnv := annotatedPiTypeEnv
+  addType := rfl
+  constructors := annotatedPiCandidateConstructorSemanticListRun
+
+private def annotatedPiCandidateFamilyRun :
+    VInductDecl.CandidateFamilyRun outParamEnv []
+      annotatedPiFamilyListCandidate annotatedPiRawType :=
+  annotatedPiCandidateFamilySemanticRun.root
+
+private def annotatedPiStagedUniverseInput :
+    VInductDecl.StagedNormalizationCandidateUniverseInput
+      annotatedPiFamilyCandidateContext annotatedPiCtorCandidateContext
+      outParamEnv [] annotatedPiNormalizationCandidate
+      annotatedPiRawDecl where
+  staged := {
+    raw := annotatedPiRawType
+    raw_types_eq := rfl
+    declaration_uvars_eq := rfl
+    preFamily := annotatedPiPreFamilyStage
+    family := annotatedPiFamilyStage
+    validation_nparams_eq := rfl
+    constructorValidation :=
+      AddInductive.ConstructorValidationRun.of_run annotatedPi_checkConstructors
+    constructors := .cons {
+      name_eq := rfl
+      uvars_eq := rfl
+      type := {
+        context_eq := rfl
+        source_tr := annotatedPiCtorCandidateRun.source_tr
+        whnfFuel := 9999
+        whnfDepth := rfl } } .nil
+    familyTypesProduced := annotatedPiFamilyTypeListProduced
+    familiesProduced := annotatedPiFamilyListProduced }
+  universeRun := annotatedPi_checkConstructorUniverseSemantics
+
+private def annotatedPiConstructorValidationContext : AddInductive.Context :=
+  { env := annotatedPiCtorCandidateContext.env
+    lctx := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.lctx
+    lparams := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.lparams
+    ngen := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.ngen
+    safety := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.safety
+    allowPrimitive := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.allowPrimitive
+    fuel := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.fuel }
+
+private theorem annotatedPiConstructorValidationContext_eq :
+    { annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+      env := annotatedPiCtorCandidateContext.env } =
+      annotatedPiCtorCandidateContext := rfl
+
+private theorem annotatedPiConstructorValidationContext_def_eq :
+    annotatedPiConstructorValidationContext =
+      annotatedPiCtorCandidateContext := rfl
+
+private theorem annotatedPiConstructorValidationContextLiteral_eq :
+    ({ env := annotatedPiCtorCandidateContext.env
+       lctx := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.lctx
+       lparams := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.lparams
+       ngen := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.ngen
+       safety := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.safety
+       allowPrimitive := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.allowPrimitive
+       fuel := annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.fuel } :
+      AddInductive.Context) = annotatedPiCtorCandidateContext := rfl
+
+private theorem annotatedPiStagedStats_eq :
+    annotatedPiStagedUniverseInput.staged.family.validation.stats =
+      annotatedPiInductiveStats := rfl
+
+private theorem annotatedPiStagedParams_zero :
+    annotatedPiStagedUniverseInput.staged.family.validation.stats.params[0]? =
+      none := by
+  rw [annotatedPiStagedStats_eq]
+  rfl
+
+private theorem annotatedPiKernelCtor_isForall :
+    annotatedPiKernelCtor.type.isForall = true := rfl
+
+private theorem annotatedPiKernelType_ctors_eq :
+    annotatedPiKernelType.ctors = [annotatedPiKernelCtor] := rfl
+
+private theorem annotatedPiKernelCtor_type_eq :
+    annotatedPiKernelCtor.type =
+      .forallE annotatedPiOuterName annotatedPiInnerKernel
+        (.const ``AnnotatedPi []) .default := rfl
+
+private theorem annotatedPiConstructorValidationFuel_eq :
+    annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext.fuel.inductiveFuel =
+      1000 := rfl
+
+private theorem annotatedPiCtorCandidateContext_empty :
+    annotatedPiCtorCandidateContext.withEmptyLocalContext =
+      annotatedPiCtorCandidateContext := rfl
+
+private def annotatedPiViewInnerKernel : Expr :=
+  .forallE `p (.sort .zero) (.const ``AnnotatedPi []) .default
+
+private def annotatedPiViewCtorKernel : Expr :=
+  .forallE annotatedPiOuterName annotatedPiViewInnerKernel
+    (.const ``AnnotatedPi []) .default
+
+private def annotatedPiAlignedViewInnerKernel : Expr :=
+  .forallE `p (.sort .zero)
+    ((Expr.const ``AnnotatedPi []).abstract
+      #[annotatedPiCtorCandidateContext.freshExpr]) .default
+
+private def annotatedPiAlignedViewCtorKernel : Expr :=
+  .forallE annotatedPiOuterName annotatedPiAlignedViewInnerKernel
+    ((Expr.const ``AnnotatedPi []).abstract
+      #[annotatedPiCtorCandidateContext.freshExpr]) .default
+
+@[simp] private theorem annotatedPiConst_abstract_singleton
+    (context : AddInductive.Context) :
+    (Expr.const ``AnnotatedPi []).abstract #[context.freshExpr] =
+      .const ``AnnotatedPi [] := by
+  rw [show #[context.freshExpr] =
+    ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl]
+  simp only [Expr.abstract_eq, Expr.abstractList, Expr.abstract1]
+
+private theorem annotatedPiAlignedViewInnerKernel_eq :
+    annotatedPiAlignedViewInnerKernel = annotatedPiViewInnerKernel := by
+  simp [annotatedPiAlignedViewInnerKernel, annotatedPiViewInnerKernel]
+
+private theorem annotatedPiAlignedViewCtorKernel_eq :
+    annotatedPiAlignedViewCtorKernel = annotatedPiViewCtorKernel := by
+  simp [annotatedPiAlignedViewCtorKernel, annotatedPiViewCtorKernel,
+    annotatedPiAlignedViewInnerKernel, annotatedPiViewInnerKernel]
+
+set_option maxRecDepth 10000 in
+private theorem annotatedPiDomain_isDefEqInner9999
+    (initial : Std.HashSet (Expr × Expr)) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEq annotatedPiRawDomainKernel (.sort .zero)
+          (TypeChecker.Methods.withFuel 9999)
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (true, state) := by
+  simpa only [Nat.reduceAdd] using
+    annotatedPiDomain_isDefEqInner 9995 initial
+
+private theorem annotatedPiInnerView_isDefEqForall
+    (initial : Std.HashSet (Expr × Expr)) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEqForall
+          annotatedPiInnerKernel annotatedPiViewInnerKernel #[]
+          (TypeChecker.Methods.withFuel 9999)
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (true, state) := by
+  obtain ⟨state, domainRun⟩ :=
+    annotatedPiDomain_isDefEqInner9999 initial
+  have domainRun' : TypeChecker.Inner.isDefEq
+      (annotatedPiRawDomainKernel.instantiateRev #[])
+      ((.sort .zero : Expr).instantiateRev #[])
+      (TypeChecker.Methods.withFuel 9999)
+      annotatedPiCtorCandidateContext.toTypeChecker
+      ({ success := initial } : TypeChecker.State) =
+        .ok (true, state) := by
+    simpa [Expr.instantiateRev] using domainRun
+  refine ⟨state, ?_⟩
+  unfold annotatedPiInnerKernel annotatedPiViewInnerKernel
+    TypeChecker.Inner.isDefEqForall
+  rw [show
+    (annotatedPiRawDomainKernel == (.sort .zero : Expr)) = false by
+      exact annotatedPiApp_beq_sort _ _ _]
+  simp only [Bool.false_eq_true, if_false, pure_bind,
+    normalizationRecMBind]
+  rw [domainRun']
+  simp [TypeChecker.Inner.isDefEqForall, TypeChecker.Inner.isDefEq, Expr.hasLooseBVars,
+    Expr.looseBVarRange']
+
+private theorem annotatedPiInnerView_quickIsDefEq
+    (initial : Std.HashSet (Expr × Expr)) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.quickIsDefEq
+          annotatedPiInnerKernel annotatedPiViewInnerKernel
+          (TypeChecker.Methods.withFuel 9999)
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({ success := initial } : TypeChecker.State) =
+        .ok (.true, state) := by
+  by_cases hc : (annotatedPiInnerKernel == annotatedPiViewInnerKernel ||
+      TypeChecker.Inner.succeededBefore initial
+        annotatedPiInnerKernel annotatedPiViewInnerKernel) = true
+  -- Settled structurally or by the cache: the state comes back untouched.
+  · refine ⟨({ success := initial } : TypeChecker.State), ?_⟩
+    unfold TypeChecker.Inner.quickIsDefEq
+    simp [hc, pure, ReaderT.pure, StateT.pure, Except.pure,
+      Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  -- Otherwise both sides are for-alls and the match hands off to `isDefEqForall`.
+  · simp only [Bool.not_eq_true] at hc
+    obtain ⟨state, forallRun⟩ := annotatedPiInnerView_isDefEqForall initial
+    refine ⟨state, ?_⟩
+    unfold annotatedPiInnerKernel annotatedPiViewInnerKernel at hc forallRun ⊢
+    unfold TypeChecker.Inner.quickIsDefEq
+    simp [hc, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+    unfold toLBoolM
+    rw [normalizationRecMBind, forallRun]
+    rfl
+
+private theorem annotatedPiInnerView_isDefEqInner :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.isDefEq
+          annotatedPiInnerKernel annotatedPiViewInnerKernel
+          (TypeChecker.Methods.withFuel 10000)
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({} : TypeChecker.State) =
+        .ok (true, state) := by
+  obtain ⟨quickState, quickRun⟩ :=
+    annotatedPiInnerView_quickIsDefEq {}
+  have coreRun : TypeChecker.Inner.isDefEqCore
+      annotatedPiInnerKernel annotatedPiViewInnerKernel
+      (TypeChecker.Methods.withFuel 10000)
+      annotatedPiCtorCandidateContext.toTypeChecker
+      ({} : TypeChecker.State) = .ok (true, quickState) := by
+    change TypeChecker.Inner.isDefEqCore'
+      annotatedPiInnerKernel annotatedPiViewInnerKernel
+      (TypeChecker.Methods.withFuel 9999)
+      annotatedPiCtorCandidateContext.toTypeChecker
+      ({} : TypeChecker.State) = .ok (true, quickState)
+    unfold TypeChecker.Inner.isDefEqCore'
+    rw [normalizationRecMBind, quickRun]
+    rfl
+  unfold TypeChecker.Inner.isDefEq
+  rw [show
+    (annotatedPiInnerKernel == annotatedPiViewInnerKernel) = false by
+      change Expr.eqv
+        (.forallE `p annotatedPiRawDomainKernel
+          (.const ``AnnotatedPi []) .default)
+        (.forallE `p (.sort .zero)
+          (.const ``AnnotatedPi []) .default) = false
+      rw [Expr.eqv_eq]
+      rfl]
+  simp only [Bool.false_eq_true, if_false, normalizationRecMBind]
+  rw [coreRun]
+  exact ⟨_, rfl⟩
+
+private theorem annotatedPiInnerView_isDefEq :
+    AddInductive.CandidateIsDefEqStep.Valid
+      ⟨annotatedPiConstructorValidationContext,
+        annotatedPiInnerKernel, annotatedPiAlignedViewInnerKernel⟩ := by
+  unfold AddInductive.CandidateIsDefEqStep.Valid
+  rw [annotatedPiConstructorValidationContext_def_eq,
+    annotatedPiAlignedViewInnerKernel_eq]
+  obtain ⟨state, run⟩ := annotatedPiInnerView_isDefEqInner
+  change Except.map (fun x : Bool × TypeChecker.State => x.1)
+      (TypeChecker.Inner.isDefEq annotatedPiInnerKernel
+        annotatedPiViewInnerKernel
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) = .ok true
+  rw [run]
+  rfl
+
+private theorem annotatedPiValidationAlignedCheck_exists
+    {source candidateSource : Expr}
+    (source_eq : source = candidateSource)
+    {checked : AddInductive.ConstructorCheckedExpr
+      annotatedPiCtorCandidateContext candidateSource}
+    (run : AddInductive.checkConstructorAlignedExpr
+      annotatedPiCtorCandidateContext candidateSource = .ok checked) :
+    ∃ aligned : AddInductive.ConstructorCheckedExpr
+        annotatedPiConstructorValidationContext source,
+      AddInductive.checkConstructorAlignedExpr
+        annotatedPiConstructorValidationContext source = .ok aligned := by
+  subst candidateSource
+  rw [annotatedPiConstructorValidationContext_def_eq]
+  exact ⟨checked, run⟩
+
+private def annotatedPiAlignChecked
+    {context candidateContext : AddInductive.Context}
+    {source candidateSource : Expr}
+    (context_eq : context = candidateContext)
+    (source_eq : source = candidateSource)
+    (checked : AddInductive.ConstructorCheckedExpr
+      candidateContext candidateSource) :
+    AddInductive.ConstructorCheckedExpr context source := by
+  subst candidateContext
+  subst candidateSource
+  exact checked
+
+private def annotatedPiAlignIsDefEq
+    {context candidateContext : AddInductive.Context}
+    {lhs rhs candidateLhs candidateRhs : Expr}
+    (context_eq : context = candidateContext)
+    (lhs_eq : lhs = candidateLhs)
+    (rhs_eq : rhs = candidateRhs)
+    (observation : AddInductive.CandidateIsDefEqObservation
+      candidateContext candidateLhs candidateRhs) :
+    AddInductive.CandidateIsDefEqObservation context lhs rhs := by
+  subst candidateContext
+  subst candidateLhs
+  subst candidateRhs
+  exact observation
+
+private theorem annotatedPiViewInnerCheckTypeStep_valid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨annotatedPiCtorCandidateContext, annotatedPiViewInnerKernel,
+        .sort (.succ .zero)⟩ := by
+  change TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.checkType annotatedPiViewInnerKernel) =
+        .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiViewInnerKernel false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' annotatedPiViewInnerKernel false
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  unfold annotatedPiViewInnerKernel TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange', TypeChecker.Inner.inferType',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop, Expr.instantiate1',
+    annotatedPiWithLocalDecl, annotatedPiCtorCandidateContext, AddInductive.Context.toTypeChecker,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  simp [Expr.sortLevel!, annotatedPi_mkLevelIMaxSuccZero]
+  rfl
+
+private def annotatedPiViewInnerFinalState : TypeChecker.State :=
+  { ({} : TypeChecker.State) with
+    ngen := ({} : TypeChecker.State).ngen.next
+    inferTypeC :=
+      ((({} : TypeChecker.State).inferTypeC.insert
+          (.sort .zero) (.sort (.succ .zero))).insert
+          (.const ``AnnotatedPi []) (.sort (.succ .zero))).insert
+          annotatedPiViewInnerKernel (.sort (.succ .zero)) }
+
+private theorem annotatedPiViewInnerInferType_exists (n : Nat) :
+    ∃ state : TypeChecker.State,
+      TypeChecker.Inner.inferType' annotatedPiViewInnerKernel false
+          (TypeChecker.Methods.withFuel (n + 1))
+          annotatedPiCtorCandidateContext.toTypeChecker
+          ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero), state) ∧
+      state.inferTypeC[(.const ``AnnotatedPi [] : Expr)]? =
+        some (.sort (.succ .zero)) := by
+  refine ⟨annotatedPiViewInnerFinalState, ?_, ?_⟩
+  · unfold annotatedPiViewInnerKernel TypeChecker.Inner.inferType'
+    simp [Expr.hasLooseBVars, Expr.looseBVarRange', TypeChecker.Inner.inferType',
+      TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop, Expr.instantiate1',
+      annotatedPiWithLocalDecl, annotatedPiCtorCandidateContext, AddInductive.Context.toTypeChecker,
+      Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+    simp [Expr.sortLevel!, annotatedPi_mkLevelIMaxSuccZero]
+    rfl
+  · simpa [annotatedPiViewInnerFinalState,
+      annotatedPiViewInnerKernel] using
+      annotatedPiFamilyCacheAfterForall
+        (({} : TypeChecker.State).inferTypeC.insert
+          (.sort .zero) (.sort (.succ .zero)))
+        `p (.sort .zero) (.const ``AnnotatedPi [])
+        (.sort (.succ .zero)) .default
+
+private theorem annotatedPiViewCtorCheckTypeStep_valid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨annotatedPiCtorCandidateContext, annotatedPiViewCtorKernel,
+        .sort (.succ .zero)⟩ := by
+  change TypeChecker.M.run annotatedPiCtorCandidateContext.env
+      annotatedPiCtorCandidateContext.safety
+      annotatedPiCtorCandidateContext.lctx
+      annotatedPiCtorCandidateContext.lparams
+      annotatedPiCtorCandidateContext.fuel
+      (TypeChecker.checkType annotatedPiViewCtorKernel) =
+        .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType annotatedPiViewCtorKernel false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' annotatedPiViewCtorKernel false
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  obtain ⟨innerState, hinner, hinnerCache⟩ :=
+    annotatedPiViewInnerInferType_exists 9997
+  change TypeChecker.Inner.inferType' annotatedPiViewInnerKernel false
+      (TypeChecker.Methods.withFuel 9998)
+      annotatedPiCtorCandidateContext.toTypeChecker
+      ({} : TypeChecker.State) =
+    .ok (.sort (.succ .zero), innerState) at hinner
+  unfold annotatedPiViewInnerKernel at hinner
+  let outerState : TypeChecker.State :=
+    { innerState with ngen := innerState.ngen.next }
+  have houterCache :
+      outerState.inferTypeC[(.const ``AnnotatedPi [] : Expr)]? =
+        some (.sort (.succ .zero)) := by
+    exact hinnerCache
+  have hfamily :
+      TypeChecker.Inner.inferType' (.const ``AnnotatedPi []) false
+          (TypeChecker.Methods.withFuel 9998)
+          ({ env := annotatedPiCtorCandidateContext.toTypeChecker.env
+             lctx := annotatedPiCtorCandidateContext.toTypeChecker.lctx.mkLocalDecl
+               ⟨innerState.ngen.curr⟩ annotatedPiOuterName
+               annotatedPiViewInnerKernel .default
+             safety := annotatedPiCtorCandidateContext.toTypeChecker.safety
+             eagerReduce := annotatedPiCtorCandidateContext.toTypeChecker.eagerReduce
+             lparams := annotatedPiCtorCandidateContext.toTypeChecker.lparams
+             fuel := annotatedPiCtorCandidateContext.toTypeChecker.fuel } :
+            TypeChecker.Context)
+          outerState =
+        .ok (.sort (.succ .zero), outerState) := by
+    simpa [annotatedPiCtorCandidateContext,
+      AddInductive.Context.toTypeChecker] using
+      annotatedPiInferTypeFamilyCached 9998
+        (annotatedPiCtorCandidateContext.toTypeChecker.lctx.mkLocalDecl
+          ⟨innerState.ngen.curr⟩ annotatedPiOuterName
+          annotatedPiViewInnerKernel .default)
+        outerState houterCache
+  unfold annotatedPiViewInnerKernel at hfamily
+  unfold annotatedPiViewCtorKernel TypeChecker.Inner.inferType'
+  simp [annotatedPiViewInnerKernel, Expr.hasLooseBVars, Expr.looseBVarRange',
+    TypeChecker.Inner.inferForall, TypeChecker.Inner.inferForall.loop, Expr.instantiate1',
+    annotatedPiWithLocalDecl, Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rw [hinner]
+  simp only [TypeChecker.Inner.ensureSortCore, Expr.isSort, ↓reduceIte, Bind.bind, ReaderT.pure,
+    StateT.pure, Except.pure, Pure.pure]
+  rw [hfamily]
+  simp [Expr.sortLevel!, annotatedPi_mkLevelIMaxSuccZero, ReaderT.pure, StateT.pure, Except.pure,
+    Pure.pure]
+  rfl
+
+private theorem annotatedPiSortZeroCheckTypeStep_valid :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨annotatedPiCtorCandidateContext, .sort .zero,
+        .sort (.succ .zero)⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType (.sort .zero) false
+        (TypeChecker.Methods.withFuel 10000)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  change
+    Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' (.sort .zero) false
+        (TypeChecker.Methods.withFuel 9999)
+        annotatedPiCtorCandidateContext.toTypeChecker
+        ({} : TypeChecker.State)) =
+      .ok (.sort (.succ .zero))
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    annotatedPiCtorCandidateContext,
+    AddInductive.Context.toTypeChecker,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind]
+  rfl
+
+private theorem annotatedPiConsumeRawDomain :
+    AddInductive.consumeTypeAnnotations annotatedPiRawDomainKernel =
+      .sort .zero := by
+  simp [AddInductive.consumeTypeAnnotations, annotatedPiRawDomainKernel]
+
+private theorem annotatedPiConsumeInner :
+    AddInductive.consumeTypeAnnotations annotatedPiInnerKernel =
+      annotatedPiInnerKernel := by
+  simp [AddInductive.consumeTypeAnnotations, annotatedPiInnerKernel]
+
+private theorem annotatedPiValidationInnerBodyContext_eq :
+    annotatedPiConstructorValidationContext.pushLocalDecl
+      `p .default
+        (AddInductive.consumeTypeAnnotations annotatedPiRawDomainKernel) =
+      annotatedPiInnerBodyCandidateContext := by
+  rw [annotatedPiConstructorValidationContext_def_eq,
+    annotatedPiConsumeRawDomain]
+  rfl
+
+private theorem annotatedPiValidationOuterBodyContext_eq :
+    annotatedPiConstructorValidationContext.pushLocalDecl
+      annotatedPiOuterName .default
+        (AddInductive.consumeTypeAnnotations annotatedPiInnerKernel) =
+      annotatedPiOuterBodyCandidateContext := by
+  rw [annotatedPiConstructorValidationContext_def_eq,
+    annotatedPiConsumeInner]
+  rfl
+
+private theorem annotatedPiValidationInnerBody_whnf_eq
+    {result : Expr}
+    (run : AddInductive.CandidateWhnfStep.Valid
+      ⟨({ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+          env := annotatedPiCtorCandidateContext.env }).pushLocalDecl
+          `p .default (AddInductive.consumeTypeAnnotations
+            annotatedPiRawDomainKernel),
+        .const ``AnnotatedPi [], result⟩) :
+    result = .const ``AnnotatedPi [] := by
+  rw [annotatedPiConstructorValidationContext_eq,
+    annotatedPiConsumeRawDomain] at run
+  change TypeChecker.M.run annotatedPiInnerBodyCandidateContext.env
+    annotatedPiInnerBodyCandidateContext.safety
+    annotatedPiInnerBodyCandidateContext.lctx
+    annotatedPiInnerBodyCandidateContext.lparams
+    annotatedPiInnerBodyCandidateContext.fuel
+    (TypeChecker.whnf (.const ``AnnotatedPi [])) = .ok result at run
+  have known := annotatedPiInnerBodyCandidateStep_valid
+  change TypeChecker.M.run annotatedPiInnerBodyCandidateContext.env
+    annotatedPiInnerBodyCandidateContext.safety
+    annotatedPiInnerBodyCandidateContext.lctx
+    annotatedPiInnerBodyCandidateContext.lparams
+    annotatedPiInnerBodyCandidateContext.fuel
+    (TypeChecker.whnf (.const ``AnnotatedPi [])) =
+      .ok (.const ``AnnotatedPi []) at known
+  rw [known] at run
+  exact (Except.ok.inj run).symm
+
+private theorem constructorTypeValidationTrace_spineLength_zero
+    {stats : AddInductive.InductiveStats} {isUnsafe : Bool}
+    {familyIdx : Nat} {ctor : Name} {context : AddInductive.Context}
+    {source : Expr} {argIdx fuel : Nat}
+    (trace : AddInductive.ConstructorTypeValidationTrace stats isUnsafe
+      familyIdx ctor context source argIdx fuel)
+    (terminal : source.isForall = false) :
+    trace.spineLength = 0 := by
+  cases trace <;>
+    simp_all [AddInductive.ConstructorTypeValidationTrace.spineLength,
+      Expr.isForall]
+
+private theorem constructorTypeValidationTrace_eq_terminal
+    {stats : AddInductive.InductiveStats} {isUnsafe : Bool}
+    {familyIdx : Nat} {ctor : Name} {context : AddInductive.Context}
+    {source : Expr} {argIdx fuel : Nat}
+    (trace : AddInductive.ConstructorTypeValidationTrace stats isUnsafe
+      familyIdx ctor context source argIdx (fuel + 1))
+    (terminal : source.isForall = false)
+    (valid : AddInductive.isValidIndAppIdx stats source familyIdx = true) :
+    trace = .terminal context source fuel argIdx terminal valid := by
+  cases trace with
+  | parameter context fuel argIdx name domain body binderInfo param
+      parameterType parameterAt parameterTypeRun defeq tail =>
+      have impossible :
+          (Expr.forallE name domain body binderInfo).isForall = true := rfl
+      rw [impossible] at terminal
+      contradiction
+  | ordinary context fuel argIdx name domain body binderInfo sortResult
+      noParameter ensureType universeTrace positivity tail =>
+      have impossible :
+          (Expr.forallE name domain body binderInfo).isForall = true := rfl
+      rw [impossible] at terminal
+      contradiction
+  | terminal => rfl
+
+set_option maxHeartbeats 10000000 in
+private def annotatedPiStagedPostFamilyInput :
+    VInductDecl.StagedNormalizationCandidatePostFamilyInput
+      annotatedPiFamilyCandidateContext annotatedPiCtorCandidateContext
+      outParamEnv [] annotatedPiNormalizationCandidate
+      annotatedPiRawDecl where
+  universeInput := annotatedPiStagedUniverseInput
+  alignment := by
+    change AddInductive.ConstructorCandidateAlignmentTrace
+      annotatedPiStagedUniverseInput.staged.family.validation.stats false 0
+      annotatedPiConstructorValidationContext
+      annotatedPiStagedUniverseInput.staged.constructorValidation.trace
+      (.cons annotatedPiConstructorCandidate .nil)
+    generalize htrace :
+      annotatedPiStagedUniverseInput.staged.constructorValidation.trace = trace
+    cases trace with
+    | cons seen head constructors constructorFresh constructorClosed
+        constructorRootCheck typeTrace listTailTrace =>
+        cases typeTrace with
+        | parameter context fuel argIdx name domain body binderInfo param
+            parameterType parameterAt parameterTypeRun defeq tail =>
+            rw [annotatedPiStagedParams_zero] at parameterAt
+            contradiction
+        | terminal context source fuel argIdx terminal valid =>
+            rw [annotatedPiKernelCtor_isForall] at terminal
+            contradiction
+        | ordinary context fuel argIdx name domain body binderInfo sortResult
+            noParameter ensureType universeTrace positivity tail =>
+            cases listTailTrace
+            cases positivity with
+            | skipped isUnsafe_eq => contradiction
+            | safe isUnsafe_eq positivityTrace =>
+                cases positivityTrace with
+                | absent context source result fuel whnf occurs =>
+                    change AddInductive.CandidateWhnfStep.Valid
+                      ⟨{ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                          env := annotatedPiCtorCandidateContext.env },
+                        annotatedPiInnerKernel, result⟩ at whnf
+                    rw [annotatedPiConstructorValidationContext_eq] at whnf
+                    change TypeChecker.M.run annotatedPiCtorCandidateContext.env
+                      annotatedPiCtorCandidateContext.safety
+                      annotatedPiCtorCandidateContext.lctx
+                      annotatedPiCtorCandidateContext.lparams
+                      annotatedPiCtorCandidateContext.fuel
+                      (TypeChecker.whnf annotatedPiInnerKernel) =
+                        .ok result at whnf
+                    rw [annotatedPiInner_whnfM] at whnf
+                    cases whnf
+                    rw [annotatedPiStagedStats_eq,
+                      annotatedPiInner_stats_hasIndOcc] at occurs
+                    contradiction
+                | target context source result fuel targetIdx whnf occurs
+                    terminal valid =>
+                    change AddInductive.CandidateWhnfStep.Valid
+                      ⟨{ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                          env := annotatedPiCtorCandidateContext.env },
+                        annotatedPiInnerKernel, result⟩ at whnf
+                    rw [annotatedPiConstructorValidationContext_eq] at whnf
+                    change TypeChecker.M.run annotatedPiCtorCandidateContext.env
+                      annotatedPiCtorCandidateContext.safety
+                      annotatedPiCtorCandidateContext.lctx
+                      annotatedPiCtorCandidateContext.lparams
+                      annotatedPiCtorCandidateContext.fuel
+                      (TypeChecker.whnf annotatedPiInnerKernel) =
+                        .ok result at whnf
+                    rw [annotatedPiInner_whnfM] at whnf
+                    cases whnf
+                    simp [annotatedPiInnerKernel, Expr.isForall] at terminal
+                | forallE positivityContext positivitySource positivityFuel
+                    positivityName positivityDomain positivityBody
+                    positivityBinderInfo positivityWhnf positivityOccurs
+                    positivityDomainFree positivityTail =>
+                    change AddInductive.CandidateWhnfStep.Valid
+                      ⟨{ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                          env := annotatedPiCtorCandidateContext.env },
+                        annotatedPiInnerKernel,
+                        .forallE positivityName positivityDomain positivityBody
+                          positivityBinderInfo⟩ at positivityWhnf
+                    rw [annotatedPiConstructorValidationContext_eq] at positivityWhnf
+                    change TypeChecker.M.run annotatedPiCtorCandidateContext.env
+                      annotatedPiCtorCandidateContext.safety
+                      annotatedPiCtorCandidateContext.lctx
+                      annotatedPiCtorCandidateContext.lparams
+                      annotatedPiCtorCandidateContext.fuel
+                      (TypeChecker.whnf annotatedPiInnerKernel) =
+                        .ok (.forallE positivityName positivityDomain
+                          positivityBody positivityBinderInfo) at positivityWhnf
+                    rw [annotatedPiInner_whnfM] at positivityWhnf
+                    cases positivityWhnf
+                    have hTailSpine : tail.spineLength = 0 :=
+                      constructorTypeValidationTrace_spineLength_zero tail (by
+                        simp only [annotatedPiConst_instantiate1,
+                          Expr.isForall])
+                    cases positivityTail with
+                    | absent context source result fuel whnf occurs =>
+                        have whnf' : AddInductive.CandidateWhnfStep.Valid
+                            ⟨({ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                                env := annotatedPiCtorCandidateContext.env }).pushLocalDecl
+                                `p .default (AddInductive.consumeTypeAnnotations
+                                  annotatedPiRawDomainKernel),
+                              .const ``AnnotatedPi [], result⟩ := by
+                          simpa only [annotatedPiConst_instantiate1] using whnf
+                        have hresult :=
+                          annotatedPiValidationInnerBody_whnf_eq whnf'
+                        subst result
+                        rw [annotatedPiStagedStats_eq,
+                          annotatedPiConst_hasIndOcc] at occurs
+                        contradiction
+                    | forallE context source fuel name domain body binderInfo
+                        whnf occurs domainFree positivityTail =>
+                        have whnf' : AddInductive.CandidateWhnfStep.Valid
+                            ⟨({ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                                env := annotatedPiCtorCandidateContext.env }).pushLocalDecl
+                                `p .default (AddInductive.consumeTypeAnnotations
+                                  annotatedPiRawDomainKernel),
+                              .const ``AnnotatedPi [],
+                              .forallE name domain body binderInfo⟩ := by
+                          simpa only [annotatedPiConst_instantiate1] using whnf
+                        have hresult :=
+                          annotatedPiValidationInnerBody_whnf_eq whnf'
+                        contradiction
+                    | target targetContext targetSource targetResult targetFuel
+                        targetIdx targetWhnf targetOccurs targetTerminal
+                        targetValid =>
+                        have targetWhnfNormalized :
+                            AddInductive.CandidateWhnfStep.Valid
+                              ⟨({ annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext with
+                                  env := annotatedPiCtorCandidateContext.env }).pushLocalDecl
+                                  `p .default (AddInductive.consumeTypeAnnotations
+                                    annotatedPiRawDomainKernel),
+                                .const ``AnnotatedPi [], targetResult⟩ := by
+                          simpa only [annotatedPiConst_instantiate1] using
+                            targetWhnf
+                        have hresult :=
+                          annotatedPiValidationInnerBody_whnf_eq
+                            targetWhnfNormalized
+                        subst targetResult
+                        simp only [annotatedPiConst_instantiate1] at tail ⊢
+                        cases tail
+                        change AddInductive.CandidateCheckTypeObservation
+                          annotatedPiConstructorValidationContext.withEmptyLocalContext
+                          annotatedPiKernelCtor.type at constructorRootCheck
+                        let rootChecked :=
+                          AddInductive.ConstructorCheckedExpr.ofClosedRoot
+                            constructorClosed constructorRootCheck
+                        let innerChecked : AddInductive.ConstructorCheckedExpr
+                            annotatedPiCtorCandidateContext
+                            annotatedPiInnerKernel :=
+                          .ofRun (by
+                            simp [annotatedPiInnerKernel,
+                              annotatedPiRawDomainKernel, FVarsIn,
+                              Level.hasMVar'])
+                            annotatedPiInnerCheckTypeStep_valid
+                        let viewInnerChecked : AddInductive.ConstructorCheckedExpr
+                            annotatedPiCtorCandidateContext
+                            annotatedPiViewInnerKernel :=
+                          .ofRun (by
+                            simp [annotatedPiViewInnerKernel, FVarsIn,
+                              Level.hasMVar'])
+                            annotatedPiViewInnerCheckTypeStep_valid
+                        let domainChecked : AddInductive.ConstructorCheckedExpr
+                            annotatedPiCtorCandidateContext
+                            annotatedPiRawDomainKernel :=
+                          .ofRun (by
+                            simp [annotatedPiRawDomainKernel, FVarsIn,
+                              Level.hasMVar'])
+                            annotatedPiDomainCheckTypeStep_valid
+                        let sortChecked : AddInductive.ConstructorCheckedExpr
+                            annotatedPiCtorCandidateContext (.sort .zero) :=
+                          .ofRun (by simp [FVarsIn, Level.hasMVar'])
+                            annotatedPiSortZeroCheckTypeStep_valid
+                        let innerBodyChecked :
+                            AddInductive.ConstructorCheckedExpr
+                              annotatedPiInnerBodyCandidateContext
+                              (.const ``AnnotatedPi []) :=
+                          .ofRun (by simp [FVarsIn])
+                            annotatedPiInnerBodyCheckTypeStep_valid
+                        let outerBodyChecked :
+                            AddInductive.ConstructorCheckedExpr
+                              annotatedPiOuterBodyCandidateContext
+                              (.const ``AnnotatedPi []) :=
+                          .ofRun (by simp [FVarsIn])
+                            annotatedPiOuterBodyCheckTypeStep_valid
+                        let innerChecked' := annotatedPiAlignChecked
+                          annotatedPiConstructorValidationContext_def_eq rfl
+                          innerChecked
+                        let viewInnerChecked' := annotatedPiAlignChecked
+                          annotatedPiConstructorValidationContext_def_eq
+                          annotatedPiAlignedViewInnerKernel_eq viewInnerChecked
+                        let consumedInnerChecked := annotatedPiAlignChecked
+                          annotatedPiConstructorValidationContext_def_eq
+                          annotatedPiConsumeInner innerChecked
+                        let domainChecked' := annotatedPiAlignChecked
+                          annotatedPiConstructorValidationContext_def_eq rfl
+                          domainChecked
+                        let sortChecked' := annotatedPiAlignChecked
+                          annotatedPiConstructorValidationContext_def_eq
+                          annotatedPiConsumeRawDomain sortChecked
+                        let innerBodyChecked' := annotatedPiAlignChecked
+                          annotatedPiValidationInnerBodyContext_eq rfl
+                          innerBodyChecked
+                        let innerBodyPositivityChecked :=
+                          annotatedPiAlignChecked
+                            annotatedPiValidationInnerBodyContext_eq
+                            (annotatedPiConst_instantiate1
+                              annotatedPiConstructorValidationContext.freshExpr)
+                            innerBodyChecked
+                        let outerBodyChecked' := annotatedPiAlignChecked
+                          annotatedPiValidationOuterBodyContext_eq rfl
+                          outerBodyChecked
+                        let outerBodySourceChecked := annotatedPiAlignChecked
+                          annotatedPiValidationOuterBodyContext_eq
+                          (annotatedPiConst_instantiate1
+                            annotatedPiConstructorValidationContext.freshExpr)
+                          outerBodyChecked
+                        have outerTailView_eq :
+                            ((Expr.const ``AnnotatedPi []).abstract
+                                #[annotatedPiCtorCandidateContext.freshExpr]
+                              |>.instantiate1
+                                annotatedPiConstructorValidationContext.freshExpr) =
+                              .const ``AnnotatedPi [] := by
+                          simp [annotatedPiConst_abstract_singleton]
+                        let outerBodyViewChecked := annotatedPiAlignChecked
+                          annotatedPiValidationOuterBodyContext_eq
+                          outerTailView_eq outerBodyChecked
+                        let innerAnnotations :
+                            AddInductive.CandidateIsDefEqObservation
+                              annotatedPiCtorCandidateContext
+                              annotatedPiInnerKernel annotatedPiInnerKernel :=
+                          ⟨AddInductive.candidateIsDefEqRefl
+                            annotatedPiCtorCandidateContext
+                            annotatedPiInnerKernel⟩
+                        let innerAnnotations' := annotatedPiAlignIsDefEq
+                          annotatedPiConstructorValidationContext_def_eq rfl
+                          annotatedPiConsumeInner innerAnnotations
+                        let domainAnnotations :
+                            AddInductive.CandidateIsDefEqObservation
+                              annotatedPiCtorCandidateContext
+                              annotatedPiRawDomainKernel (.sort .zero) :=
+                          ⟨annotatedPiDomainAnnotationsEq⟩
+                        let domainAnnotations' := annotatedPiAlignIsDefEq
+                          annotatedPiConstructorValidationContext_def_eq rfl
+                          annotatedPiConsumeRawDomain domainAnnotations
+                        have sortCheckedInferred :
+                            sortChecked'.observation.inferred =
+                              .sort (.succ .zero) := by
+                          apply sortChecked'.inferred_eq_of_run
+                          rw [annotatedPiConstructorValidationContext_def_eq,
+                            annotatedPiConsumeRawDomain]
+                          exact annotatedPiSortZeroCheckTypeStep_valid
+                        have rootStoredSpine :
+                            annotatedPiConstructorCandidate.type.trace.storedSpine =
+                              true := by
+                          change annotatedPiCtorCandidate.trace.storedSpine = true
+                          exact annotatedPiCtorCandidate_storedSpine
+                        have rootDepth :
+                            annotatedPiConstructorCandidate.type.context.fuel.recDepth =
+                              annotatedPiConstructorValidationContext.fuel.recDepth := by
+                          rfl
+                        let constructorTailTrace :=
+                          AddInductive.ConstructorTypeValidationTrace.terminal
+                            (stats := annotatedPiStagedUniverseInput.staged.family.validation.stats)
+                            (isUnsafe := false) (familyIdx := 0)
+                            (ctor := annotatedPiKernelCtor.name)
+                            (annotatedPiConstructorValidationContext.pushLocalDecl
+                              annotatedPiOuterName .default
+                                (AddInductive.consumeTypeAnnotations
+                                  annotatedPiInnerKernel))
+                            ((Expr.const ``AnnotatedPi []).instantiate1
+                              annotatedPiConstructorValidationContext.freshExpr)
+                            998 1
+                            (by
+                              simp only [annotatedPiConst_instantiate1,
+                                Expr.isForall])
+                            (by
+                              simp only [annotatedPiConst_instantiate1]
+                              assumption)
+                        have tail_eq : tail = constructorTailTrace := by
+                          unfold constructorTailTrace
+                          apply constructorTypeValidationTrace_eq_terminal
+                        let positivityTargetTrace :=
+                          AddInductive.ConstructorPositivityTrace.target
+                            (stats := annotatedPiStagedUniverseInput.staged.family.validation.stats)
+                            (ctor := annotatedPiKernelCtor.name)
+                            (argIdx := 0)
+                            (annotatedPiConstructorValidationContext.pushLocalDecl
+                              `p .default
+                                (AddInductive.consumeTypeAnnotations
+                                  annotatedPiRawDomainKernel))
+                            ((Expr.const ``AnnotatedPi []).instantiate1
+                              annotatedPiConstructorValidationContext.freshExpr)
+                            (.const ``AnnotatedPi []) 998 targetIdx
+                            targetWhnf targetOccurs targetTerminal targetValid
+                        let nestedPositivityTrace :=
+                          AddInductive.ConstructorPositivityTrace.forallE
+                            (stats := annotatedPiStagedUniverseInput.staged.family.validation.stats)
+                            (ctor := annotatedPiKernelCtor.name)
+                            (argIdx := 0)
+                            annotatedPiConstructorValidationContext
+                            annotatedPiInnerKernel 999 `p
+                            annotatedPiRawDomainKernel
+                            (.const ``AnnotatedPi []) .default positivityWhnf
+                            positivityOccurs positivityDomainFree
+                            positivityTargetTrace
+                        let positivityModeTrace :=
+                          AddInductive.ConstructorPositivityModeTrace.safe
+                            isUnsafe_eq nestedPositivityTrace
+                        let headValidationTrace :=
+                          AddInductive.ConstructorTypeValidationTrace.ordinary
+                            annotatedPiConstructorValidationContext 999 0
+                            annotatedPiOuterName annotatedPiInnerKernel
+                            (.const ``AnnotatedPi []) .default sortResult
+                            noParameter ensureType universeTrace
+                            positivityModeTrace constructorTailTrace
+                        have rootSpineLength' :
+                            annotatedPiConstructorCandidate.type.trace.spineLength =
+                              headValidationTrace.spineLength := by
+                          rfl
+                        have positivityTargetAlignment :
+                            AddInductive.ConstructorPositivityAlignmentTrace
+                              positivityTargetTrace :=
+                          .target innerBodyPositivityChecked
+                        have positivityAlignment :
+                            AddInductive.ConstructorPositivityModeAlignmentTrace
+                              positivityModeTrace :=
+                          .safe <| .forallE innerChecked' domainChecked'
+                            sortChecked' (.succ .zero)
+                            sortCheckedInferred (by
+                              rw [annotatedPiConstructorValidationContext_def_eq]
+                              exact annotatedPiCtorCandidateFresh)
+                            domainAnnotations' positivityTargetTrace
+                            positivityTargetAlignment
+                        have outerTailAlignment :
+                            AddInductive.ConstructorViewAlignmentTrace
+                              constructorTailTrace
+                              ((Expr.const ``AnnotatedPi []).abstract
+                                  #[annotatedPiCtorCandidateContext.freshExpr]
+                                |>.instantiate1
+                                  annotatedPiConstructorValidationContext.freshExpr) := by
+                          simp only [annotatedPiConst_abstract_singleton,
+                            annotatedPiConst_instantiate1]
+                          exact .terminal outerBodySourceChecked
+                            outerBodyChecked'
+                            (by simp [Expr.isForall]) (by assumption)
+                        have headAlignment :
+                            AddInductive.ConstructorViewAlignmentTrace
+                              headValidationTrace
+                              annotatedPiConstructorCandidate.type.view := by
+                          change AddInductive.ConstructorViewAlignmentTrace
+                            headValidationTrace
+                            annotatedPiAlignedViewCtorKernel
+                          exact AddInductive.ConstructorViewAlignmentTrace.ordinary
+                              innerChecked' viewInnerChecked'
+                              ⟨annotatedPiInnerView_isDefEq⟩
+                              consumedInnerChecked
+                              positivityModeTrace
+                              positivityAlignment (by
+                                rw [annotatedPiConstructorValidationContext_def_eq]
+                                exact annotatedPiCtorCandidateFresh)
+                              innerAnnotations' constructorTailTrace
+                              outerTailAlignment
+                        rw [tail_eq]
+                        exact
+                          AddInductive.ConstructorCandidateAlignmentTrace.cons
+                            (seen := ∅) (fresh := constructorFresh)
+                            (closed := constructorClosed)
+                            (rootCheck := constructorRootCheck)
+                            (typeTrace := headValidationTrace)
+                            (tailTrace :=
+                              AddInductive.ConstructorListValidationTrace.nil
+                                ((∅ : NameSet).insert
+                                  annotatedPiKernelCtor.name))
+                            (candidate := annotatedPiConstructorCandidate)
+                            (candidates := AddInductive.CandidateList.nil)
+                            rootChecked rootStoredSpine rootSpineLength'
+                            rootDepth headAlignment
+                            (AddInductive.ConstructorCandidateAlignmentTrace.nil
+                              (stats := annotatedPiStagedUniverseInput.staged.family.validation.stats)
+                              (isUnsafe := false) (familyIdx := 0)
+                              (context := annotatedPiConstructorValidationContext)
+                              ((∅ : NameSet).insert
+                                annotatedPiKernelCtor.name))
+
+private theorem annotatedPiPreFamilySortZeroCheckTypeStep_valid
+    (context : AddInductive.Context)
+    (depth : context.fuel.recDepth = 10000) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, .sort .zero, .sort (.succ .zero)⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType (.sort .zero) false
+        (TypeChecker.Methods.withFuel context.fuel.recDepth)
+        context.toTypeChecker ({} : TypeChecker.State)) = _
+  rw [depth]
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' (.sort .zero) false
+        (TypeChecker.Methods.withFuel 9999)
+        context.toTypeChecker ({} : TypeChecker.State)) = _
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    annotatedPi_checkLevelZero, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rfl
+
+private theorem annotatedPiPreFamilySortOneCheckTypeStep_valid
+    (context : AddInductive.Context)
+    (depth : context.fuel.recDepth = 10000) :
+    AddInductive.CandidateCheckTypeStep.Valid
+      ⟨context, .sort (.succ .zero),
+        .sort (.succ (.succ .zero))⟩ := by
+  unfold AddInductive.CandidateCheckTypeStep.Valid
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType (.sort (.succ .zero)) false
+        (TypeChecker.Methods.withFuel context.fuel.recDepth)
+        context.toTypeChecker ({} : TypeChecker.State)) = _
+  rw [depth]
+  change Except.map (fun x : Expr × TypeChecker.State => x.1)
+      (TypeChecker.Inner.inferType' (.sort (.succ .zero)) false
+        (TypeChecker.Methods.withFuel 9999)
+        context.toTypeChecker ({} : TypeChecker.State)) = _
+  unfold TypeChecker.Inner.inferType'
+  simp [Expr.hasLooseBVars, Expr.looseBVarRange',
+    annotatedPi_checkLevelSuccZero, Bind.bind, ReaderT.bind,
+    StateT.bind, Except.bind]
+  rfl
+
+private def annotatedPiPreFamilySortZeroInferState : TypeChecker.State :=
+  { ({} : TypeChecker.State) with
+    inferTypeI := ({} : TypeChecker.State).inferTypeI.insert
+      (.sort .zero) (.sort (.succ .zero)) }
+
+private theorem annotatedPiPreFamilySortZeroInferTypeInner
+    (context : AddInductive.Context)
+    (depth : context.fuel.recDepth = 10000) :
+    TypeChecker.Inner.inferType (.sort .zero) true
+        (TypeChecker.Methods.withFuel context.fuel.recDepth)
+        context.toTypeChecker ({} : TypeChecker.State) =
+      .ok (.sort (.succ .zero),
+        annotatedPiPreFamilySortZeroInferState) := by
+  rw [depth]
+  change TypeChecker.Inner.inferType' (.sort .zero) true
+      (TypeChecker.Methods.withFuel 9999) context.toTypeChecker
+      ({} : TypeChecker.State) = _
+  unfold TypeChecker.Inner.inferType'
+  simp [annotatedPiPreFamilySortZeroInferState,
+    Expr.hasLooseBVars, Expr.looseBVarRange', Bind.bind,
+    ReaderT.bind, StateT.bind, Except.bind]
+
+private theorem annotatedPiPreFamilySortZeroEnsureTypeStep_valid
+    (context : AddInductive.Context)
+    (depth : context.fuel.recDepth = 10000) :
+    AddInductive.ConstructorEnsureTypeStep.Valid
+      ⟨context, .sort .zero, .sort (.succ .zero)⟩ := by
+  unfold AddInductive.ConstructorEnsureTypeStep.Valid
+    TypeChecker.ensureType TypeChecker.inferType TypeChecker.ensureSort
+    TypeChecker.RecM.run TypeChecker.M.run
+  simp only [readThe, MonadReaderOf.read, ReaderT.read,
+    Bind.bind, ReaderT.bind, StateT.bind, Except.bind,
+    Pure.pure, StateT.pure, Except.pure, StateT.run',
+    Functor.map, Except.map]
+  rw [show TypeChecker.Inner.inferType (.sort .zero) true
+      (TypeChecker.Methods.withFuel context.fuel.recDepth)
+      { env := context.env
+        lctx := context.lctx
+        safety := context.safety
+        lparams := context.lparams
+        fuel := context.fuel }
+      ({} : TypeChecker.State) =
+        .ok (.sort (.succ .zero),
+          annotatedPiPreFamilySortZeroInferState) by
+    simpa [AddInductive.Context.toTypeChecker] using
+      annotatedPiPreFamilySortZeroInferTypeInner context depth]
+  rfl
+
+private theorem annotatedPiPreFamilySafetyRun :
+    AddInductive.checkConstructorPreFamilySafety
+        annotatedPiStagedUniverseInput.staged.family.validation.stats
+        annotatedPiNormalizationCandidate.families.singleton.familyType.type.view
+        annotatedPiNormalizationCandidate.families.singleton.constructors
+        annotatedPiNormalizationCandidate.families.singleton.familyType.type.trace.terminalContext =
+      .ok () := by
+  change AddInductive.checkConstructorPreFamilySafety
+    annotatedPiInductiveStats (.sort (.succ .zero))
+    (.cons annotatedPiConstructorCandidate .nil)
+    annotatedPiFamilyCandidateContext = .ok ()
+  have consumeSortZero : AddInductive.consumeTypeAnnotations
+      (.sort .zero) = .sort .zero := by
+    simp [AddInductive.consumeTypeAnnotations]
+  let nestedContext := annotatedPiFamilyCandidateContext.pushLocalDecl
+    `p .default (AddInductive.consumeTypeAnnotations (.sort .zero))
+  let resultContext := annotatedPiFamilyCandidateContext.advanceFresh
+  let rootSortZero : AddInductive.ConstructorCheckedExpr
+      annotatedPiFamilyCandidateContext (.sort .zero) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (annotatedPiPreFamilySortZeroCheckTypeStep_valid
+        annotatedPiFamilyCandidateContext rfl)
+  let rootSortOne : AddInductive.ConstructorCheckedExpr
+      annotatedPiFamilyCandidateContext (.sort (.succ .zero)) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (annotatedPiPreFamilySortOneCheckTypeStep_valid
+        annotatedPiFamilyCandidateContext rfl)
+  let nestedSortOne : AddInductive.ConstructorCheckedExpr
+      nestedContext (.sort (.succ .zero)) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (annotatedPiPreFamilySortOneCheckTypeStep_valid nestedContext rfl)
+  let resultSortOne : AddInductive.ConstructorCheckedExpr
+      resultContext (.sort (.succ .zero)) :=
+    .ofRun (by simp [FVarsIn, Level.hasMVar'])
+      (annotatedPiPreFamilySortOneCheckTypeStep_valid resultContext rfl)
+  let rootEnsure : AddInductive.ConstructorEnsureTypeObservation
+      annotatedPiFamilyCandidateContext (.sort .zero) :=
+    ⟨.sort (.succ .zero),
+      annotatedPiPreFamilySortZeroEnsureTypeStep_valid
+        annotatedPiFamilyCandidateContext rfl⟩
+  let consumedSortZero : AddInductive.ConstructorCheckedExpr
+      annotatedPiFamilyCandidateContext
+        (AddInductive.consumeTypeAnnotations (.sort .zero)) := by
+    rw [consumeSortZero]
+    exact rootSortZero
+  let annotations : AddInductive.CandidateIsDefEqObservation
+      annotatedPiFamilyCandidateContext (.sort .zero)
+        (AddInductive.consumeTypeAnnotations (.sort .zero)) :=
+    ⟨by
+      rw [consumeSortZero]
+      exact AddInductive.candidateIsDefEqRefl
+        annotatedPiFamilyCandidateContext (.sort .zero)⟩
+  have rootFresh : annotatedPiFamilyCandidateContext.lctx.find?
+      annotatedPiFamilyCandidateContext.freshFVarId = none := by
+    have h := LocalContext.WF.find?_eq_find?_toList
+      (fv := annotatedPiFamilyCandidateContext.freshFVarId)
+      LocalContext.WF.nil
+    change
+      ({ fvarIdToDecl := PersistentHashMap.empty
+         decls := PersistentArray.empty
+         auxDeclToFullName := Std.TreeMap.empty } : LocalContext).find?
+        annotatedPiFamilyCandidateContext.freshFVarId = none
+    rw [h]
+    simp [LocalContext.toList]
+  let rootSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      annotatedPiFamilyCandidateContext (.sort (.succ .zero)) [] :=
+    .nil annotatedPiFamilyCandidateContext (.sort (.succ .zero))
+      rootSortOne rfl
+  let nestedSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      nestedContext (.sort (.succ .zero)) [] :=
+    .nil nestedContext (.sort (.succ .zero)) nestedSortOne rfl
+  let resultSpine : AddInductive.ConstructorPreFamilyIndexSpineTrace
+      resultContext (.sort (.succ .zero)) [] :=
+    .nil resultContext (.sort (.succ .zero)) resultSortOne rfl
+  have valid : AddInductive.isValidIndAppIdx annotatedPiInductiveStats
+      (.const ``AnnotatedPi []) 0 = true :=
+    annotatedPiConst_isValidIndAppIdx
+  have targetArgs :
+      (Expr.const ``AnnotatedPi []).getAppArgs.toList.drop
+        annotatedPiInductiveStats.params.size = [] := by
+    rfl
+  obtain ⟨nestedTargetSpine, nestedTargetSpineRun⟩ :
+      ∃ nestedTargetSpine :
+          AddInductive.ConstructorPreFamilyIndexSpineTrace nestedContext
+            (.sort (.succ .zero))
+            ((Expr.const ``AnnotatedPi []).getAppArgs.toList.drop
+              annotatedPiInductiveStats.params.size),
+        AddInductive.ConstructorPreFamilyIndexSpineTrace.build nestedContext
+            (.sort (.succ .zero))
+            ((Expr.const ``AnnotatedPi []).getAppArgs.toList.drop
+              annotatedPiInductiveStats.params.size) =
+          .ok nestedTargetSpine := by
+    rw [targetArgs]
+    exact ⟨nestedSpine, nestedSpine.build_eq⟩
+  let targetTrace : AddInductive.ConstructorPreFamilyRecursiveTrace
+      annotatedPiInductiveStats 0 (.sort (.succ .zero)) nestedContext
+        (.const ``AnnotatedPi []) 999 :=
+    .target nestedContext (.const ``AnnotatedPi []) valid nestedTargetSpine
+  have targetRun :
+      AddInductive.ConstructorPreFamilyRecursiveTrace.build
+          annotatedPiInductiveStats 0 (.sort (.succ .zero)) nestedContext
+          (.const ``AnnotatedPi []) 999 = .ok targetTrace := by
+    simp only [AddInductive.ConstructorPreFamilyRecursiveTrace.build]
+    rw [dif_pos valid, nestedTargetSpineRun]
+    rfl
+  obtain ⟨recursiveTailTrace, recursiveTailRun⟩ :
+      ∃ recursiveTailTrace :
+          AddInductive.ConstructorPreFamilyRecursiveTrace
+            annotatedPiInductiveStats 0 (.sort (.succ .zero)) nestedContext
+            ((Expr.const ``AnnotatedPi []).instantiate1
+              annotatedPiFamilyCandidateContext.freshExpr) 999,
+        AddInductive.ConstructorPreFamilyRecursiveTrace.build
+            annotatedPiInductiveStats 0 (.sort (.succ .zero)) nestedContext
+            ((Expr.const ``AnnotatedPi []).instantiate1
+              annotatedPiFamilyCandidateContext.freshExpr) 999 =
+          .ok recursiveTailTrace := by
+    rw [annotatedPiConst_instantiate1]
+    exact ⟨targetTrace, targetRun⟩
+  let recursiveTrace : AddInductive.ConstructorPreFamilyRecursiveTrace
+      annotatedPiInductiveStats 0 (.sort (.succ .zero))
+        annotatedPiFamilyCandidateContext annotatedPiViewInnerKernel
+        annotatedPiFamilyCandidateContext.fuel.inductiveFuel :=
+    .forallE annotatedPiFamilyCandidateContext `p (.sort .zero)
+      (.const ``AnnotatedPi []) .default rootSortZero rootEnsure
+      consumedSortZero annotations rootFresh (by
+        simpa only [nestedContext] using recursiveTailTrace)
+  have recursiveRun :
+      AddInductive.ConstructorPreFamilyRecursiveTrace.build
+          annotatedPiInductiveStats 0 (.sort (.succ .zero))
+          annotatedPiFamilyCandidateContext annotatedPiViewInnerKernel
+          annotatedPiFamilyCandidateContext.fuel.inductiveFuel =
+        .ok recursiveTrace := by
+    change AddInductive.ConstructorPreFamilyRecursiveTrace.build
+        annotatedPiInductiveStats 0 (.sort (.succ .zero))
+        annotatedPiFamilyCandidateContext annotatedPiViewInnerKernel 1000 =
+      .ok recursiveTrace
+    simp only [annotatedPiViewInnerKernel,
+      AddInductive.ConstructorPreFamilyRecursiveTrace.build]
+    rw [rootSortZero.check_eq, rootEnsure.observe_eq,
+      consumedSortZero.check_eq]
+    simp only [Bind.bind, Except.bind]
+    rw [annotations.observe_eq]
+    simp only []
+    rw [dif_pos rootFresh]
+    rw [recursiveTailRun]
+    rfl
+  have resultIndependent : AddInductive.constructorIndependentOf
+      (.const ``AnnotatedPi [])
+      [annotatedPiFamilyCandidateContext.freshFVarId] = true := by
+    rfl
+  obtain ⟨resultTargetSpine, resultTargetSpineRun⟩ :
+      ∃ resultTargetSpine :
+          AddInductive.ConstructorPreFamilyIndexSpineTrace resultContext
+            (.sort (.succ .zero))
+            ((Expr.const ``AnnotatedPi []).getAppArgs.toList.drop
+              annotatedPiInductiveStats.params.size),
+        AddInductive.ConstructorPreFamilyIndexSpineTrace.build resultContext
+            (.sort (.succ .zero))
+            ((Expr.const ``AnnotatedPi []).getAppArgs.toList.drop
+              annotatedPiInductiveStats.params.size) =
+          .ok resultTargetSpine := by
+    rw [targetArgs]
+    exact ⟨resultSpine, resultSpine.build_eq⟩
+  let terminalTrace : AddInductive.ConstructorPreFamilyViewTrace
+      annotatedPiInductiveStats 0 (.sort (.succ .zero)) resultContext
+        (.const ``AnnotatedPi []) 1
+        [annotatedPiFamilyCandidateContext.freshFVarId] true :=
+    .terminal resultContext (.const ``AnnotatedPi []) 1
+      [annotatedPiFamilyCandidateContext.freshFVarId] true valid
+      resultIndependent resultTargetSpine
+  have terminalRun :
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          annotatedPiInductiveStats 0 (.sort (.succ .zero)) resultContext
+          (.const ``AnnotatedPi []) 1
+          [annotatedPiFamilyCandidateContext.freshFVarId] true 999 =
+        .ok terminalTrace := by
+    simp only [AddInductive.ConstructorPreFamilyViewTrace.build]
+    rw [dif_pos valid, dif_pos resultIndependent, resultTargetSpineRun]
+    rfl
+  obtain ⟨viewTailTrace, viewTailRun⟩ :
+      ∃ viewTailTrace : AddInductive.ConstructorPreFamilyViewTrace
+          annotatedPiInductiveStats 0 (.sort (.succ .zero)) resultContext
+          ((Expr.const ``AnnotatedPi []).instantiate1
+            annotatedPiFamilyCandidateContext.freshExpr)
+          1 [annotatedPiFamilyCandidateContext.freshFVarId] true,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            annotatedPiInductiveStats 0 (.sort (.succ .zero)) resultContext
+            ((Expr.const ``AnnotatedPi []).instantiate1
+              annotatedPiFamilyCandidateContext.freshExpr)
+            1 [annotatedPiFamilyCandidateContext.freshFVarId] true 999 =
+          .ok viewTailTrace := by
+    rw [annotatedPiConst_instantiate1]
+    exact ⟨terminalTrace, terminalRun⟩
+  have noParameter : annotatedPiInductiveStats.params[0]? = none := rfl
+  have recursive : AddInductive.hasIndOcc annotatedPiInductiveStats.indConsts
+      annotatedPiViewInnerKernel = true := by
+    simp [AddInductive.hasIndOcc, annotatedPiInductiveStats,
+      annotatedPiViewInnerKernel, Expr.constName!]
+  have fieldIndependent : AddInductive.constructorIndependentOf
+      annotatedPiViewInnerKernel [] = true := by
+    simp [AddInductive.constructorIndependentOf,
+      annotatedPiViewInnerKernel]
+  let viewTrace : AddInductive.ConstructorPreFamilyViewTrace
+      annotatedPiInductiveStats 0 (.sort (.succ .zero))
+        annotatedPiFamilyCandidateContext annotatedPiViewCtorKernel 0 [] false :=
+    .recursive annotatedPiFamilyCandidateContext 0 [] false
+      annotatedPiOuterName annotatedPiViewInnerKernel
+      (.const ``AnnotatedPi []) .default noParameter recursive
+      fieldIndependent recursiveTrace rootFresh (by
+        simpa only [resultContext] using viewTailTrace)
+  have viewRun :
+      AddInductive.ConstructorPreFamilyViewTrace.build
+          annotatedPiInductiveStats 0 (.sort (.succ .zero))
+          annotatedPiFamilyCandidateContext annotatedPiViewCtorKernel 0 []
+          false 1000 = .ok viewTrace := by
+    simp only [annotatedPiViewCtorKernel,
+      AddInductive.ConstructorPreFamilyViewTrace.build]
+    split
+    · rename_i parameter parameterAt
+      rw [noParameter] at parameterAt
+      contradiction
+    · split
+      · rename_i nonrecursive
+        rw [recursive] at nonrecursive
+        contradiction
+      · rw [dif_pos fieldIndependent]
+        rw [recursiveRun]
+        simp only [Bind.bind, Except.bind]
+        rw [dif_pos rootFresh]
+        rw [viewTailRun]
+        rfl
+  have candidateViewEq : annotatedPiConstructorCandidate.type.view =
+      annotatedPiViewCtorKernel := by
+    change annotatedPiCtorCandidate.trace.view = annotatedPiViewCtorKernel
+    change annotatedPiAlignedViewCtorKernel = annotatedPiViewCtorKernel
+    exact annotatedPiAlignedViewCtorKernel_eq
+  obtain ⟨headTrace, headRun⟩ :
+      ∃ headTrace : AddInductive.ConstructorPreFamilyViewTrace
+          annotatedPiInductiveStats 0 (.sort (.succ .zero))
+          annotatedPiFamilyCandidateContext
+          annotatedPiConstructorCandidate.type.view 0 [] false,
+        AddInductive.ConstructorPreFamilyViewTrace.build
+            annotatedPiInductiveStats 0 (.sort (.succ .zero))
+            annotatedPiFamilyCandidateContext
+            annotatedPiConstructorCandidate.type.view 0 [] false 1000 =
+          .ok headTrace := by
+    rw [candidateViewEq]
+    exact ⟨viewTrace, viewRun⟩
+  let listTrace : AddInductive.ConstructorPreFamilyListTrace
+      annotatedPiInductiveStats 0 (.sort (.succ .zero))
+        annotatedPiFamilyCandidateContext
+        (.cons annotatedPiConstructorCandidate .nil) :=
+    .cons headTrace .nil
+  have listRun :
+      AddInductive.ConstructorPreFamilyListTrace.build
+          annotatedPiInductiveStats 0 (.sort (.succ .zero))
+          annotatedPiFamilyCandidateContext
+          (.cons annotatedPiConstructorCandidate .nil) = .ok listTrace := by
+    simp only [AddInductive.ConstructorPreFamilyListTrace.build]
+    rw [show annotatedPiFamilyCandidateContext.fuel.inductiveFuel = 1000 by
+      rfl, headRun]
+    rfl
+  have parametersRun : AddInductive.instantiateFamilyParameters
+      (.sort (.succ .zero)) annotatedPiInductiveStats.params.toList =
+        .ok (.sort (.succ .zero)) := by
+    rfl
+  unfold AddInductive.checkConstructorPreFamilySafety
+  have translationUnique :
+      (AddInductive.theoryTranslationUnique (.sort (.succ .zero)) &&
+        (AddInductive.CandidateList.cons annotatedPiConstructorCandidate
+          (AddInductive.CandidateList.nil : AddInductive.CandidateList
+            AddInductive.CandidateConstructor [])).viewTranslationUnique) =
+        true := by
+    simp [AddInductive.theoryTranslationUnique,
+      AddInductive.CandidateList.viewTranslationUnique,
+      AddInductive.CandidateExprTrace.viewTranslationUnique,
+      AddInductive.CandidateExprTrace.view,
+      annotatedPiConstructorCandidate, annotatedPiCtorCandidate,
+      annotatedPiCtorCandidateTrace, annotatedPiInnerCandidateTrace,
+      annotatedPiDomainCandidateTrace, annotatedPiInnerBodyCandidateTrace,
+      annotatedPiOuterBodyCandidateTrace,
+      annotatedPiConst_abstract_singleton]
+  rw [if_pos translationUnique]
+  rw [parametersRun]
+  simp only [Bind.bind, Except.bind]
+  rw [listRun]
+  rfl
+
+private def annotatedPiStagedPreFamilyInput :
+    VInductDecl.StagedNormalizationCandidatePreFamilyInput
+      annotatedPiFamilyCandidateContext annotatedPiCtorCandidateContext
+      outParamEnv [] annotatedPiNormalizationCandidate annotatedPiRawDecl :=
+  VInductDecl.StagedNormalizationCandidatePreFamilyInput.ofRun
+    annotatedPiStagedPostFamilyInput annotatedPiPreFamilySafetyRun
+
+/-- AnnotatedPi's retained validator telescope and candidate telescope admit
+the complete post-family semantic interpretation, including the nested
+annotation-bearing recursive field. -/
+theorem annotatedPiProducedPostFamilySemantic_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidatePostFamilySemanticRun
+      annotatedPiStagedPostFamilyInput) :=
+  annotatedPiStagedPostFamilyInput.exists
+
+/-- AnnotatedPi's recursive outer field is omitted from the pre-family local
+context while its nested Pi binder and both family-index spines receive the
+exact verified family-free interpretation. -/
+theorem annotatedPiProducedPreFamilySemantic_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidatePreFamilySemanticRun
+      annotatedPiStagedPreFamilyInput) :=
+  annotatedPiStagedPreFamilyInput.exists
+
+/-- The exact family/constructor producer traversals and verified translations
+automatically determine the complete retained AnnotatedPi hierarchy, including
+its nested annotation-consuming constructor trace. -/
+theorem annotatedPiProducedSemanticHierarchy_exists :
+    Nonempty (VInductDecl.ProducedNormalizationCandidateSemanticRun
+      annotatedPiFamilyCandidateContext annotatedPiCtorCandidateContext
+      outParamEnv [] annotatedPiNormalizationCandidate
+      annotatedPiRawDecl) :=
+  annotatedPiStagedUniverseInput.exists
+
+def annotatedPiNormalizationCandidateRun :
+    VInductDecl.NormalizationCandidateRun outParamEnv []
+      annotatedPiNormalizationCandidate annotatedPiRawDecl where
+  raw := annotatedPiRawType
+  raw_types_eq := rfl
+  uvars_eq := rfl
+  family := annotatedPiCandidateFamilyRun
+
+example : annotatedPiNormalizationCandidateRun.viewDecl =
+    annotatedPiViewDecl := rfl
+
+theorem annotatedPiCandidateNormalization_eq :
+    annotatedPiNormalizationCandidateRun.normalization =
+      annotatedPiNormalization := rfl
+
+def annotatedPiNormalizationRun :
+    VInductDecl.NormalizationRun annotatedPiNormalization outParamEnv := by
+  simpa only [annotatedPiCandidateNormalization_eq] using
+    annotatedPiNormalizationCandidateRun.normalizationRun
+
+theorem annotatedPiNormalization_wf_checked :
+    annotatedPiNormalization.WF outParamEnv :=
+  annotatedPiNormalizationRun.wf
+
+theorem annotatedPiBlock_wf_checked :
+    annotatedPiBlock.WF outParamEnv := by
+  refine ⟨annotatedPiNormalization_wf_checked, ?_⟩
+  exact annotatedPiViewChecked_wf
+
+private theorem annotatedPiCandidate_generationShape :
+    VInductDecl.normalizationCandidateGenerationShape annotatedPiRawDecl
+      annotatedPiRawType annotatedPiNormalizationCandidate = true := by
+  change ((true && true) &&
+    (annotatedPiCtorCandidate.trace.storedSpine && true && true)) = true
+  rw [annotatedPiCtorCandidate_storedSpine]
+  rfl
+
+private def annotatedPiProducedGenerationShapeCandidate :
+    VInductDecl.ProducedGenerationShapeCandidate annotatedPiRawDecl
+      annotatedPiRawType annotatedPiKernelType 0 false
+      annotatedPiFamilyCandidateContext where
+  candidate := annotatedPiNormalizationCandidate
+  produced := annotatedPiNormalizationCandidate_produced
+  shape := annotatedPiCandidate_generationShape
+
+/-- The strengthened outer gate retains AnnotatedPi's nested annotation-
+normalizing candidate only after its complete raw generation spine passes. -/
+theorem annotatedPiGenerationShapeCandidate_produced :
+    VInductDecl.produceGenerationShapeCandidate annotatedPiRawDecl
+      annotatedPiRawType annotatedPiKernelType 0 false
+      annotatedPiFamilyCandidateContext =
+        .ok annotatedPiProducedGenerationShapeCandidate := by
+  have produced :
+      AddInductive.buildNormalizationCandidate annotatedPiRawDecl.nparams
+          [annotatedPiKernelType] 0 false annotatedPiFamilyCandidateContext =
+        .ok annotatedPiNormalizationCandidate :=
+    annotatedPiNormalizationCandidate_produced
+  simpa only [annotatedPiProducedGenerationShapeCandidate] using
+    VInductDecl.produceGenerationShapeCandidate_eq_ok
+      (source := annotatedPiRawDecl) (raw := annotatedPiRawType)
+      produced annotatedPiCandidate_generationShape
+
+private theorem annotatedPiCandidate_analysis
+    (normalization : VInductDecl.NormalizationCandidateSemanticRun
+      outParamEnv [] annotatedPiNormalizationCandidate
+      annotatedPiRawDecl) :
+    normalization.root.normalization.generation? =
+      some annotatedPiGenerationChecked := by
+  let reference : VInductDecl.NormalizationCandidateSemanticRun outParamEnv []
+      annotatedPiNormalizationCandidate annotatedPiRawDecl := {
+    raw := annotatedPiRawType
+    raw_types_eq := rfl
+    uvars_eq := rfl
+    family := annotatedPiCandidateFamilySemanticRun }
+  rw [annotatedPiStagedPreFamilyInput.normalization_eq normalization reference]
+  rfl
+
+/-- AnnotatedPi's nested annotation-normalizing candidate closes through the
+same generic staged-owner boundary as the ordinary singleton fixture. -/
+theorem annotatedPiExactProducedGenerationCandidatePackage_exists :
+    Nonempty (VInductDecl.ExactProducedGenerationCandidatePackage
+      outParamEnv [] annotatedPiProducedGenerationShapeCandidate
+      annotatedPiGenerationChecked) :=
+  annotatedPiProducedGenerationShapeCandidate.exactProducedPackage_nonempty
+    annotatedPiStagedPreFamilyInput rfl annotatedPiGenerationChecked
+    annotatedPiCandidate_analysis
+
+private def
+    annotatedPiExactProducedGenerationCandidatePackage :
+    VInductDecl.ExactProducedGenerationCandidatePackage outParamEnv []
+      annotatedPiProducedGenerationShapeCandidate annotatedPiGenerationChecked :=
+  annotatedPiProducedGenerationShapeCandidate.exactProducedPackage
+    annotatedPiStagedPreFamilyInput rfl annotatedPiGenerationChecked
+    annotatedPiCandidate_analysis
+
+/-- Complete source-indexed checker certificate for annotated recursive-Π
+generation. This is the first live generation run whose main constructor
+spine contains an annotation-normalized recursive function domain. -/
+def annotatedPiGenerationCandidateSemanticRun :
+  VInductDecl.GenerationCandidateSemanticRun
+      annotatedPiExactProducedGenerationCandidatePackage.normalization
+      annotatedPiGenerationChecked :=
+  annotatedPiExactProducedGenerationCandidatePackage.semantic
+
+def annotatedPiGenerationCandidateRun :
+    VInductDecl.GenerationCandidateRun
+      annotatedPiExactProducedGenerationCandidatePackage.normalization.root
+      annotatedPiGenerationChecked :=
+  annotatedPiGenerationCandidateSemanticRun.run
+
+/-- Complete dependent producer package for the annotation-bearing recursive
+Π candidate. -/
+def annotatedPiGenerationCandidatePackage :
+    VInductDecl.GenerationCandidatePackage outParamEnv [] :=
+  annotatedPiGenerationCandidateSemanticRun.package
+
+/-- The complete AnnotatedPi semantic package is selected by the exact
+successful whole-call metadata producer, including its nested annotation-
+consuming traversal in the post-family environment. -/
+def annotatedPiProducedGenerationCandidatePackage :
+    VInductDecl.ProducedGenerationCandidatePackage outParamEnv [] :=
+  annotatedPiExactProducedGenerationCandidatePackage.package
+
+/-- Theory-only erasure consumed by the public certified transaction. -/
+def annotatedPiGenerationCertificate :
+    annotatedPiRawDecl.GenerationCertificate outParamEnv where
+  generation := annotatedPiGenerationChecked
+  wf := annotatedPiExactProducedGenerationCandidatePackage.semantic.run.wf
+
+def annotatedPiGenerationRun :
+    VInductDecl.GenerationRun annotatedPiGenerationChecked outParamEnv :=
+  annotatedPiProducedGenerationCandidatePackage.package.run.generationRun
+
+theorem annotatedPiGenerationChecked_wf_checked :
+    annotatedPiGenerationChecked.WF outParamEnv :=
+  annotatedPiGenerationCertificate.wf
+
+def annotatedPiCtorEnv : VEnv :=
+  (annotatedPiTypeEnv.addConst annotatedPiRawType.ctors[0].name
+    annotatedPiRawType.ctors[0].toVConstant).get!
+
+def annotatedPiRecEnv : VEnv :=
+  (annotatedPiCtorEnv.addConst ``AnnotatedPi.rec
+    annotatedPiGenerationChecked.recursor).get!
+
+def annotatedPiFinalEnv : VEnv :=
+  (outParamEnv.addInductGeneration
+    annotatedPiGenerationChecked).get (by decide)
+
+theorem annotatedPi_addInductGeneration :
+    outParamEnv.addInductGeneration annotatedPiGenerationChecked =
+      some annotatedPiFinalEnv := rfl
+
+/-- The public proof-carrying path accepts the non-identity AnnotatedPi view
+while computing exactly the established mixed Theory transaction. -/
+theorem annotatedPi_addInductCertified :
+    outParamEnv.addInductCertified annotatedPiGenerationCertificate =
+      some annotatedPiFinalEnv :=
+  annotatedPi_addInductGeneration
+
+theorem annotatedPiCertified_ordered : annotatedPiFinalEnv.Ordered :=
+  VEnv.addInductCertified_WF outParamEnv_ordered
+    annotatedPi_addInductCertified
+
+private theorem annotatedPiRawCtor_wf :
+    annotatedPiRawType.ctors[0].toVConstant.WF
+      annotatedPiTypeEnv :=
+  ⟨.succ .zero, annotatedPiRawCtor_hasType⟩
+
+private theorem annotatedPiCtorEnv_ordered :
+    annotatedPiCtorEnv.Ordered :=
+  .const (n := annotatedPiRawType.ctors[0].name)
+    (ci := annotatedPiRawType.ctors[0].toVConstant)
+    annotatedPiTypeEnv_ordered annotatedPiRawCtor_wf rfl
+
+private theorem annotatedPiGenerationEnv :
+    VInductDecl.GenerationEnv annotatedPiGenerationChecked
+      annotatedPiCtorEnv := by
+  apply annotatedPiGenerationChecked_wf_checked.toGenerationEnv
+    (envT := annotatedPiTypeEnv)
+  · rfl
+  · exact (VEnv.addConst_le (show
+      outParamEnv.addConst annotatedPiRawType.name
+        annotatedPiRawType.toVConstant = some annotatedPiTypeEnv from rfl)).trans
+      (VEnv.addConst_le (show
+        annotatedPiTypeEnv.addConst annotatedPiRawType.ctors[0].name
+          annotatedPiRawType.ctors[0].toVConstant =
+            some annotatedPiCtorEnv from rfl))
+  · exact VEnv.addConst_le (show
+      annotatedPiTypeEnv.addConst annotatedPiRawType.ctors[0].name
+        annotatedPiRawType.ctors[0].toVConstant =
+          some annotatedPiCtorEnv from rfl)
+  · exact annotatedPiCtorEnv_ordered
+  · rfl
+  · intro ctor hctor
+    change ctor ∈
+      [⟨annotatedPiRawType.ctors[0],
+        annotatedPiViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    rfl
+
+private theorem annotatedPiMkInfo_tr :
+    TrConstVal .safe annotatedPiTypeEnv annotatedPiMkInfo
+      annotatedPiRawType.ctors[0] := by
+  exact ⟨⟨by decide, rfl, annotatedPiCtorSource_tr⟩, rfl⟩
+
+private theorem annotatedPiRecInfo_tr :
+    TrConstVal .safe annotatedPiCtorEnv annotatedPiRecInfo
+      (inductGenerationRecVal annotatedPiGenerationChecked) := by
+  have hfamily : annotatedPiCtorEnv.constants ``AnnotatedPi =
+      some annotatedPiRawType.toVConstant := rfl
+  have hmk : annotatedPiCtorEnv.constants ``AnnotatedPi.mk =
+      some annotatedPiRawType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr annotatedPiCtorEnv
+      annotatedPiRecInfo.levelParams [] annotatedPiRecInfo.type
+      (inductGenerationRecVal annotatedPiGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := annotatedPiGenerationEnv.recursor_wf
+  exact hshape.to_trExprS annotatedPiCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+private def annotatedPiCtorMap : ConstMap :=
+  annotatedPiTypeMap.insert ``AnnotatedPi.mk annotatedPiMkInfo
+
+private def annotatedPiMap : ConstMap :=
+  annotatedPiCtorMap.insert ``AnnotatedPi.rec annotatedPiRecInfo
+
+private theorem annotatedPiMk_fresh :
+    annotatedPiTypeMap.find? ``AnnotatedPi.mk = none := by
+  rw [annotatedPiTypeMap, outParamMap_wf.find?_insert,
+    outParamMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private theorem annotatedPiCtorMap_wf : annotatedPiCtorMap.WF :=
+  annotatedPiTypeMap_wf.insert _ _ annotatedPiMk_fresh
+
+private theorem annotatedPiRec_fresh :
+    annotatedPiCtorMap.find? ``AnnotatedPi.rec = none := by
+  rw [annotatedPiCtorMap, annotatedPiTypeMap_wf.find?_insert,
+    annotatedPiTypeMap, outParamMap_wf.find?_insert, outParamMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+/-- Complete kernel-metadata replay transaction for `AnnotatedPi`, driven by
+the checker-produced non-identity normalization certificate. -/
+def annotatedPiAddInductTraceChecked :
+    AddInductTrace outParamMap outParamEnv annotatedPiRawDecl
+      annotatedPiMap annotatedPiFinalEnv := by
+  refine annotatedPiProducedGenerationCandidatePackage.package.addInductTrace
+    annotatedPiTypeMap annotatedPiTypeEnv annotatedPiCtorMap
+    annotatedPiCtorEnv annotatedPiRecEnv annotatedPiAddType ?_ ?_ ?_ ⟨rfl⟩
+  · exact .cons {
+      info := annotatedPiMkInfo
+      kind_eq := by simp [annotatedPiMkInfo, InductConstantKind.Matches]
+      tr := annotatedPiMkInfo_tr
+      map_fresh := by
+        simpa [annotatedPiRawType] using annotatedPiMk_fresh
+      env_add := rfl
+      map_add := rfl } .nil
+  · exact {
+      info := annotatedPiRecInfo
+      kind_eq := by simp [annotatedPiRecInfo, InductConstantKind.Matches]
+      tr := annotatedPiRecInfo_tr
+      map_fresh := by
+        rw [show
+          (inductGenerationRecVal
+            annotatedPiProducedGenerationCandidatePackage.package.generation).name =
+              ``AnnotatedPi.rec by rfl]
+        exact annotatedPiRec_fresh
+      env_add := rfl
+      map_add := rfl }
+  · decide
+
+theorem annotatedPi_addInduct_checked :
+    AddInduct outParamMap outParamEnv annotatedPiRawDecl
+      annotatedPiMap annotatedPiFinalEnv :=
+  ⟨annotatedPiAddInductTraceChecked⟩
+
+theorem annotatedPi_trEnv'_checked :
+    TrEnv' .safe annotatedPiMap false annotatedPiFinalEnv :=
+  .induct annotatedPi_addInduct_checked outParam_trEnv'
+
+theorem annotatedPi_env_wf_checked : annotatedPiFinalEnv.WF :=
+  annotatedPi_trEnv'_checked.wf
+
+theorem annotatedPi_aligned_checked :
+    Aligned .safe annotatedPiMap annotatedPiFinalEnv :=
+  annotatedPi_trEnv'_checked.aligned
+
+theorem annotatedPiFinalEnv_trace :
+    Nonempty (VEnv.AddInductGenerationTrace outParamEnv
+      annotatedPiFinalEnv annotatedPiGenerationChecked) :=
+  VEnv.addInductGeneration_trace annotatedPi_addInductGeneration
+
+/-- The public certified wrapper exposes the same trace. This deliberately
+stays separate from the minimal Theory-only iota root below: the concrete
+certificate remembers its Verify provenance, while the transaction equality
+itself admits the smaller Theory proof. -/
+theorem annotatedPiCertified_trace :
+    Nonempty (VEnv.AddInductGenerationTrace outParamEnv
+      annotatedPiFinalEnv annotatedPiGenerationChecked) :=
+  VEnv.addInductCertified_trace annotatedPi_addInductCertified
+
+theorem annotatedPiFinalEnv_family_lookup :
+    annotatedPiFinalEnv.constants ``AnnotatedPi =
+      some annotatedPiRawType.toVConstant := by
+  rcases annotatedPiFinalEnv_trace with ⟨trace⟩
+  exact trace.family_lookup
+
+theorem annotatedPiFinalEnv_ctor_lookup :
+    annotatedPiFinalEnv.constants ``AnnotatedPi.mk =
+      some annotatedPiRawType.ctors[0].toVConstant := by
+  rcases annotatedPiFinalEnv_trace with ⟨trace⟩
+  exact trace.ctor_lookup (.head _)
+
+theorem annotatedPiFinalEnv_rec_lookup :
+    annotatedPiFinalEnv.constants ``AnnotatedPi.rec =
+      some annotatedPiGenerationChecked.recursor := by
+  rcases annotatedPiFinalEnv_trace with ⟨trace⟩
+  exact trace.rec_lookup
+
+theorem annotatedPiFinalEnv_rule_mem :
+    ∀ df ∈ annotatedPiGenerationChecked.generatedRules,
+      annotatedPiFinalEnv.defeqs df := by
+  intro df hdf
+  rcases annotatedPiFinalEnv_trace with ⟨trace⟩
+  exact trace.rule_mem hdf
+
+theorem annotatedPiFinalEnv_iota_mem :
+    annotatedPiFinalEnv.defeqs
+      annotatedPiGenerationChecked.generatedRules[0] := by
+  apply annotatedPiFinalEnv_rule_mem
+  exact .head _
+
+theorem annotatedPi_iota_rhs_matches_kernel :
+    annotatedPiKernelRuleRhs =
+      annotatedPiGenerationChecked.generatedRules[0].rhs := rfl
+
+theorem annotatedPi_type_map_lookup :
+    annotatedPiMap.find? ``AnnotatedPi = some annotatedPiInfo := by
+  rw [annotatedPiMap, annotatedPiCtorMap_wf.find?_insert,
+    annotatedPiCtorMap, annotatedPiTypeMap_wf.find?_insert]
+  simp +decide
+  rw [annotatedPiTypeMap, outParamMap_wf.find?_insert]
+  simp +decide
+
+theorem annotatedPi_mk_map_lookup :
+    annotatedPiMap.find? ``AnnotatedPi.mk = some annotatedPiMkInfo := by
+  rw [annotatedPiMap, annotatedPiCtorMap_wf.find?_insert,
+    annotatedPiCtorMap, annotatedPiTypeMap_wf.find?_insert]
+  rfl
+
+theorem annotatedPi_rec_map_lookup :
+    annotatedPiMap.find? ``AnnotatedPi.rec = some annotatedPiRecInfo := by
+  rw [annotatedPiMap, annotatedPiCtorMap_wf.find?_insert]
+  rfl
+
+theorem annotatedPi_type_lookup_unique :
+    annotatedPiInfo.name = ``AnnotatedPi ∧
+      TrConstant .safe annotatedPiFinalEnv annotatedPiInfo
+        annotatedPiRawType.toVConstant :=
+  annotatedPi_aligned_checked.find?_uniq annotatedPi_type_map_lookup
+    annotatedPiFinalEnv_family_lookup
+
+theorem annotatedPi_mk_lookup_unique :
+    annotatedPiMkInfo.name = ``AnnotatedPi.mk ∧
+      TrConstant .safe annotatedPiFinalEnv annotatedPiMkInfo
+        annotatedPiRawType.ctors[0].toVConstant :=
+  annotatedPi_aligned_checked.find?_uniq annotatedPi_mk_map_lookup
+    annotatedPiFinalEnv_ctor_lookup
+
+theorem annotatedPi_rec_lookup_unique :
+    annotatedPiRecInfo.name = ``AnnotatedPi.rec ∧
+      TrConstant .safe annotatedPiFinalEnv annotatedPiRecInfo
+        annotatedPiGenerationChecked.recursor :=
+  annotatedPi_aligned_checked.find?_uniq annotatedPi_rec_map_lookup
+    annotatedPiFinalEnv_rec_lookup
+
+/-! ## Definitionally equal parameter transaction replay -/
+
+/-- Consumer-facing certificate for the exact mixed generation value whose
+stored parameter is `outParam Type` and whose emitted recursor parameter is
+the definitionally equal checked `Type`. -/
+def annotatedParamGenerationCertificate :
+    annotatedParamRawDecl.GenerationCertificate outParamEnv where
+  generation := annotatedParamGenerationChecked
+  wf := annotatedParamGenerationChecked_wf
+
+def annotatedParamCtorEnv : VEnv :=
+  (annotatedParamTypeEnv.addConst annotatedParamRawType.ctors[0].name
+    annotatedParamRawType.ctors[0].toVConstant).get!
+
+def annotatedParamRecEnv : VEnv :=
+  (annotatedParamCtorEnv.addConst ``AnnotatedParam.rec
+    annotatedParamGenerationChecked.recursor).get!
+
+def annotatedParamFinalEnv : VEnv :=
+  (outParamEnv.addInductGeneration
+    annotatedParamGenerationChecked).get (by decide)
+
+theorem annotatedParam_addInductGeneration :
+    outParamEnv.addInductGeneration annotatedParamGenerationChecked =
+      some annotatedParamFinalEnv := rfl
+
+/-- The public proof-carrying transaction accepts the raw/checked parameter
+normalization and computes the same environment as the underlying generation
+transaction. -/
+theorem annotatedParam_addInductCertified :
+    outParamEnv.addInductCertified annotatedParamGenerationCertificate =
+      some annotatedParamFinalEnv :=
+  annotatedParam_addInductGeneration
+
+theorem annotatedParamCertified_ordered :
+    annotatedParamFinalEnv.Ordered :=
+  VEnv.addInductCertified_WF outParamEnv_ordered
+    annotatedParam_addInductCertified
+
+private theorem annotatedParamRawCtor_wf :
+    annotatedParamRawType.ctors[0].toVConstant.WF
+      annotatedParamTypeEnv := by
+  change annotatedParamTypeEnv.IsType 0 []
+    annotatedParamRawType.ctors[0].type
+  let ctor : VInductDecl.NormalizedCtor :=
+    ⟨annotatedParamRawType.ctors[0],
+      annotatedParamViewChecked.constructors[0]⟩
+  have hctor : ctor ∈
+      annotatedParamGenerationChecked.block.ctorPairs := by
+    change ctor ∈ [⟨annotatedParamRawType.ctors[0],
+      annotatedParamViewChecked.constructors[0]⟩]
+    exact .head _
+  simpa [ctor, annotatedParamRawDecl] using
+    annotatedParamGenerationChecked_wf.rawCtor_isType
+      (envT := annotatedParamTypeEnv) rfl hctor
+
+private theorem annotatedParamCtorEnv_ordered :
+    annotatedParamCtorEnv.Ordered :=
+  .const (n := annotatedParamRawType.ctors[0].name)
+    (ci := annotatedParamRawType.ctors[0].toVConstant)
+    annotatedParamTypeEnv_ordered annotatedParamRawCtor_wf rfl
+
+private theorem annotatedParamGenerationEnv :
+    VInductDecl.GenerationEnv annotatedParamGenerationChecked
+      annotatedParamCtorEnv := by
+  apply annotatedParamGenerationChecked_wf.toGenerationEnv
+    (envT := annotatedParamTypeEnv)
+  · rfl
+  · exact (VEnv.addConst_le (show
+      outParamEnv.addConst annotatedParamRawType.name
+        annotatedParamRawType.toVConstant =
+          some annotatedParamTypeEnv from rfl)).trans
+      (VEnv.addConst_le (show
+        annotatedParamTypeEnv.addConst
+          annotatedParamRawType.ctors[0].name
+          annotatedParamRawType.ctors[0].toVConstant =
+            some annotatedParamCtorEnv from rfl))
+  · exact VEnv.addConst_le (show
+      annotatedParamTypeEnv.addConst
+        annotatedParamRawType.ctors[0].name
+        annotatedParamRawType.ctors[0].toVConstant =
+          some annotatedParamCtorEnv from rfl)
+  · exact annotatedParamCtorEnv_ordered
+  · rfl
+  · intro ctor hctor
+    change ctor ∈ [⟨annotatedParamRawType.ctors[0],
+      annotatedParamViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    rfl
+
+private theorem annotatedParamMkInfo_tr :
+    TrConstVal .safe annotatedParamTypeEnv annotatedParamMkInfo
+      annotatedParamRawType.ctors[0] := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr annotatedParamTypeEnv
+      annotatedParamMkInfo.levelParams [] annotatedParamMkInfo.type
+      annotatedParamRawType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := annotatedParamRawCtor_wf
+  exact hshape.to_trExprS annotatedParamTypeEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+private theorem annotatedParamRecInfo_tr :
+    TrConstVal .safe annotatedParamCtorEnv annotatedParamRecInfo
+      (inductGenerationRecVal annotatedParamGenerationChecked) := by
+  have hfamily : annotatedParamCtorEnv.constants ``AnnotatedParam =
+      some annotatedParamRawType.toVConstant := rfl
+  have hmk : annotatedParamCtorEnv.constants ``AnnotatedParam.mk =
+      some annotatedParamRawType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr annotatedParamCtorEnv
+      annotatedParamRecInfo.levelParams [] annotatedParamRecInfo.type
+      (inductGenerationRecVal annotatedParamGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := annotatedParamGenerationEnv.recursor_wf
+  exact hshape.to_trExprS annotatedParamCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+private def annotatedParamCtorMap : ConstMap :=
+  annotatedParamTypeMap.insert ``AnnotatedParam.mk annotatedParamMkInfo
+
+private def annotatedParamMap : ConstMap :=
+  annotatedParamCtorMap.insert ``AnnotatedParam.rec annotatedParamRecInfo
+
+private theorem annotatedParamMk_fresh :
+    annotatedParamTypeMap.find? ``AnnotatedParam.mk = none := by
+  rw [annotatedParamTypeMap, outParamMap_wf.find?_insert,
+    outParamMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private theorem annotatedParamCtorMap_wf : annotatedParamCtorMap.WF :=
+  annotatedParamTypeMap_wf.insert _ _ annotatedParamMk_fresh
+
+private theorem annotatedParamRec_fresh :
+    annotatedParamCtorMap.find? ``AnnotatedParam.rec = none := by
+  rw [annotatedParamCtorMap, annotatedParamTypeMap_wf.find?_insert,
+    annotatedParamTypeMap, outParamMap_wf.find?_insert, outParamMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+/-- Real `ConstantInfo` replay for the definitionally equal parameter case.
+The generation certificate and the emitted recursor/rule payload are the same
+values checked against kernel metadata above. -/
+def annotatedParamAddInductTraceChecked :
+    AddInductTrace outParamMap outParamEnv annotatedParamRawDecl
+      annotatedParamMap annotatedParamFinalEnv := by
+  refine {
+    generation := annotatedParamGenerationChecked
+    generation_wf := annotatedParamGenerationChecked_wf
+    typeMap := annotatedParamTypeMap
+    typeEnv := annotatedParamTypeEnv
+    ctorMap := annotatedParamCtorMap
+    ctorEnv := annotatedParamCtorEnv
+    recEnv := annotatedParamRecEnv
+    addType := annotatedParamAddType
+    addCtors := ?_
+    addRec := {
+      info := annotatedParamRecInfo
+      kind_eq := by
+        simp [annotatedParamRecInfo, InductConstantKind.Matches]
+      tr := annotatedParamRecInfo_tr
+      map_fresh := by
+        rw [show
+          (inductGenerationRecVal annotatedParamGenerationChecked).name =
+            ``AnnotatedParam.rec by rfl]
+        exact annotatedParamRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }
+  exact .cons {
+    info := annotatedParamMkInfo
+    kind_eq := by
+      simp [annotatedParamMkInfo, InductConstantKind.Matches]
+    tr := annotatedParamMkInfo_tr
+    map_fresh := by
+      simpa [annotatedParamRawType] using annotatedParamMk_fresh
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem annotatedParam_addInduct_checked :
+    AddInduct outParamMap outParamEnv annotatedParamRawDecl
+      annotatedParamMap annotatedParamFinalEnv :=
+  ⟨annotatedParamAddInductTraceChecked⟩
+
+theorem annotatedParam_trEnv'_checked :
+    TrEnv' .safe annotatedParamMap false annotatedParamFinalEnv :=
+  .induct annotatedParam_addInduct_checked outParam_trEnv'
+
+theorem annotatedParam_env_wf_checked : annotatedParamFinalEnv.WF :=
+  annotatedParam_trEnv'_checked.wf
+
+theorem annotatedParam_aligned_checked :
+    Aligned .safe annotatedParamMap annotatedParamFinalEnv :=
+  annotatedParam_trEnv'_checked.aligned
+
+theorem annotatedParamCertified_trace :
+    Nonempty (VEnv.AddInductGenerationTrace outParamEnv
+      annotatedParamFinalEnv annotatedParamGenerationChecked) :=
+  VEnv.addInductCertified_trace annotatedParam_addInductCertified
+
+theorem annotatedParamFinalEnv_family_lookup :
+    annotatedParamFinalEnv.constants ``AnnotatedParam =
+      some annotatedParamRawType.toVConstant := by
+  rcases annotatedParamCertified_trace with ⟨trace⟩
+  exact trace.family_lookup
+
+theorem annotatedParamFinalEnv_ctor_lookup :
+    annotatedParamFinalEnv.constants ``AnnotatedParam.mk =
+      some annotatedParamRawType.ctors[0].toVConstant := by
+  rcases annotatedParamCertified_trace with ⟨trace⟩
+  exact trace.ctor_lookup (.head _)
+
+theorem annotatedParamFinalEnv_rec_lookup :
+    annotatedParamFinalEnv.constants ``AnnotatedParam.rec =
+      some annotatedParamGenerationChecked.recursor := by
+  rcases annotatedParamCertified_trace with ⟨trace⟩
+  exact trace.rec_lookup
+
+theorem annotatedParamFinalEnv_iota_mem :
+    annotatedParamFinalEnv.defeqs
+      annotatedParamGenerationChecked.generatedRules[0] := by
+  rcases annotatedParamCertified_trace with ⟨trace⟩
+  exact trace.rule_mem (.head _)
+
+theorem annotatedParam_iota_rhs_matches_kernel :
+    annotatedParamKernelRuleRhs =
+      annotatedParamGenerationChecked.generatedRules[0].rhs := rfl
+
+theorem annotatedParam_type_map_lookup :
+    annotatedParamMap.find? ``AnnotatedParam =
+      some annotatedParamInfo := by
+  rw [annotatedParamMap, annotatedParamCtorMap_wf.find?_insert,
+    annotatedParamCtorMap, annotatedParamTypeMap_wf.find?_insert,
+    annotatedParamTypeMap, outParamMap_wf.find?_insert]
+  simp +decide
+
+theorem annotatedParam_mk_map_lookup :
+    annotatedParamMap.find? ``AnnotatedParam.mk =
+      some annotatedParamMkInfo := by
+  rw [annotatedParamMap, annotatedParamCtorMap_wf.find?_insert,
+    annotatedParamCtorMap, annotatedParamTypeMap_wf.find?_insert]
+  rfl
+
+theorem annotatedParam_rec_map_lookup :
+    annotatedParamMap.find? ``AnnotatedParam.rec =
+      some annotatedParamRecInfo := by
+  rw [annotatedParamMap, annotatedParamCtorMap_wf.find?_insert]
+  rfl
+
+theorem annotatedParam_type_lookup_unique :
+    annotatedParamInfo.name = ``AnnotatedParam ∧
+      TrConstant .safe annotatedParamFinalEnv annotatedParamInfo
+        annotatedParamRawType.toVConstant :=
+  annotatedParam_aligned_checked.find?_uniq annotatedParam_type_map_lookup
+    annotatedParamFinalEnv_family_lookup
+
+theorem annotatedParam_mk_lookup_unique :
+    annotatedParamMkInfo.name = ``AnnotatedParam.mk ∧
+      TrConstant .safe annotatedParamFinalEnv annotatedParamMkInfo
+        annotatedParamRawType.ctors[0].toVConstant :=
+  annotatedParam_aligned_checked.find?_uniq annotatedParam_mk_map_lookup
+    annotatedParamFinalEnv_ctor_lookup
+
+theorem annotatedParam_rec_lookup_unique :
+    annotatedParamRecInfo.name = ``AnnotatedParam.rec ∧
+      TrConstant .safe annotatedParamFinalEnv annotatedParamRecInfo
+        annotatedParamGenerationChecked.recursor :=
+  annotatedParam_aligned_checked.find?_uniq annotatedParam_rec_map_lookup
+    annotatedParamFinalEnv_rec_lookup
+
+/-- The complete AliasFormer metadata trace with the generation-WF field
+supplied by the checker-produced certificate. All computational metadata
+witnesses are shared with the existing replay. -/
+def aliasFormerAddInductTraceChecked :
+    AddInductTrace typeFamilyAliasMap typeFamilyAliasEnv
+      aliasFormerRawDecl aliasFormerMap aliasFormerFinalEnv :=
+  let replay :=
+    aliasFormerAddInductTraceWith aliasFormerGenerationCertificate.wf
+  aliasFormerProducedGenerationCandidatePackage.package.addInductTrace
+    replay.typeMap replay.typeEnv replay.ctorMap replay.ctorEnv replay.recEnv
+    replay.addType replay.addCtors replay.addRec replay.recK replay.addRules
+
+theorem aliasFormer_addInduct_checked :
+    AddInduct typeFamilyAliasMap typeFamilyAliasEnv
+      aliasFormerRawDecl aliasFormerMap aliasFormerFinalEnv :=
+  ⟨aliasFormerAddInductTraceChecked⟩
+
+theorem aliasFormer_trEnv'_checked :
+    TrEnv' .safe aliasFormerMap false aliasFormerFinalEnv :=
+  .induct aliasFormer_addInduct_checked typeFamilyAlias_trEnv'
+
+theorem aliasFormer_env_wf_checked : aliasFormerFinalEnv.WF :=
+  aliasFormer_trEnv'_checked.wf
+
+theorem aliasFormer_aligned_checked :
+    Aligned .safe aliasFormerMap aliasFormerFinalEnv :=
+  aliasFormer_trEnv'_checked.aligned
+
+/-- The complete AliasRec metadata trace with the generation-WF field supplied
+by the checker-produced normalization certificate. -/
+def aliasRecAddInductTraceChecked :
+    AddInductTrace recAliasMap recAliasEnv aliasRecRawDecl
+      aliasRecMap aliasRecFinalEnv :=
+  aliasRecAddInductTraceWith aliasRecGenerationChecked_wf_checked
+
+theorem aliasRec_addInduct_checked :
+    AddInduct recAliasMap recAliasEnv aliasRecRawDecl
+      aliasRecMap aliasRecFinalEnv :=
+  ⟨aliasRecAddInductTraceChecked⟩
+
+theorem aliasRec_trEnv'_checked :
+    TrEnv' .safe aliasRecMap false aliasRecFinalEnv :=
+  .induct aliasRec_addInduct_checked recAlias_trEnv'
+
+theorem aliasRec_env_wf_checked : aliasRecFinalEnv.WF :=
+  aliasRec_trEnv'_checked.wf
+
+theorem aliasRec_aligned_checked :
+    Aligned .safe aliasRecMap aliasRecFinalEnv :=
+  aliasRec_trEnv'_checked.aligned
+
+/- The operational traces do not reach the pointer-equality contracts. Their
+semantic endpoints intentionally inherit Verify's existing checker-refinement
+and reflection contracts, including pointer equality. No new axiom or
+native-evaluation principle is used. -/
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_candidateTrace [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerCtor_candidateTrace [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_candidate [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_candidateRun_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_candidateSource_tr [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_candidateView_tr [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerNormalizationCandidateRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerCandidateNormalization_eq [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerTruncatedView_rejected [propext]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRecField_checkType [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRecField_hasType_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_whnf [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerCtor_whnf [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.recAlias_whnf [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_checkType [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerCtor_checkType [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerFamily_isType_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerCtor_isType_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerNormalization_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRecNormalization_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerBlock_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerProducedSemanticHierarchy_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerProducedPostFamilySemantic_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerProducedPreFamilySemantic_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerGenerationCandidateSemanticRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerGenerationCandidateRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerGenerationCandidatePackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerNormalizationCandidate_produced [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerGenerationShapeCandidate_produced [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerExactProducedGenerationCandidatePackage_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerProducedGenerationCandidatePackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormer_addInductCertified_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerGenerationChecked_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRecBlock_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRecGenerationChecked_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormerAddInductTraceChecked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormer_trEnv'_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRecAddInductTraceChecked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRec_trEnv'_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+/- Both alias replays have the same `sorryAx`-free Verify closure as the
+identity fixtures. The three persistent-map contracts enter through concrete
+`ConstMap` freshness proofs. -/
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormer_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormer_env_wf [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasFormer_aligned [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRec_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRec_env_wf [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.aliasRec_aligned [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiProducedSemanticHierarchy_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiProducedPostFamilySemantic_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiProducedPreFamilySemantic_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiNormalizationCandidateRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiGenerationCandidateSemanticRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiGenerationCandidateRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiGenerationCandidatePackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiCtor_candidateTrace [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiFamily_candidateTrace [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Syntax.structEq_eq]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiNormalizationCandidate_produced [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiGenerationShapeCandidate_produced [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiExactProducedGenerationCandidatePackage_exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiProducedGenerationCandidatePackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPi_addInductCertified [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiGenerationChecked_wf_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiAddInductTraceChecked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPi_trEnv'_checked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedPiFinalEnv_iota_mem [propext, Quot.sound]
+
+/-! The parameter-parity fixture deliberately keeps its operational checker
+outcome guard separate from the Theory certificate. These pins make the exact
+trust split visible: the semantic transaction stays Theory-small, while real
+`ConstantInfo` replay inherits only the already classified Verify frontier. -/
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedParam_addInductCertified [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedParamAddInductTraceChecked [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedParam_trEnv'_checked [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.annotatedParamFinalEnv_iota_mem [propext, Quot.sound]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/Lemmas.lean b/Ix/Theory/Named/Verify/Environment/Lemmas.lean
new file mode 100644
index 000000000..d82bd8ecb
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/Lemmas.lean
@@ -0,0 +1,664 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Std.SMap
+import Ix.Theory.Named.Reference.Declaration
+import Ix.Theory.Named.Verify.Environment.Basic
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+theorem TrConstant.sf_mono (hsf : safety ≤ safety')
+    (H : TrConstant safety' env ci ci') : TrConstant safety env ci ci' :=
+  ⟨safety.le_trans hsf H.1, H.2⟩
+
+theorem TrConstVal.sf_mono (hsf : safety ≤ safety')
+    (H : TrConstVal safety' env ci ci') : TrConstVal safety env ci ci' :=
+  ⟨H.1.sf_mono hsf, H.2⟩
+
+theorem TrDefVal.sf_mono (hsf : safety ≤ safety')
+    (H : TrDefVal safety' env ci ci') : TrDefVal safety env ci ci' :=
+  ⟨H.1.sf_mono hsf, H.2⟩
+
+/- The former blanket `TrEnv'.sf_mono` was deleted at the v4.33
+reconciliation: upstream's new `TrEnv'.ignore` constructor makes lowering the
+safety mode of an arbitrary translation unsound (a declaration skipped at a
+strict mode must be translated, not skipped, at a laxer one). Fixture
+environments that need every safety mode now state their `TrEnv'` derivations
+parametrically in `safety` instead. -/
+
+theorem TrConstant.mono {env env' : VEnv} (henv : env ≤ env')
+    (H : TrConstant safety env ci ci') : TrConstant safety env' ci ci' :=
+  ⟨H.1, H.2.1, H.2.2.mono henv⟩
+
+theorem TrConstVal.mono {env env' : VEnv} (henv : env ≤ env')
+    (H : TrConstVal safety env ci ci') : TrConstVal safety env' ci ci' :=
+  ⟨H.1.mono henv, H.2⟩
+
+theorem TrDefVal.mono {env env' : VEnv} (henv : env ≤ env')
+    (H : TrDefVal safety env ci ci') : TrDefVal safety env' ci ci' :=
+  ⟨H.1.mono henv, H.2.mono henv⟩
+
+variable (safety : DefinitionSafety) in
+inductive Aligned : ConstMap → VEnv → Prop where
+  | empty : Aligned {} .empty
+  | ignoreConst : Aligned C venv → C.find? n = none → ¬safety ≤ ci.safety →
+    ci.name = n → Aligned (C.insert n ci) venv
+  | const : Aligned C venv → C.find? n = none → TrConstant safety venv ci ci' →
+    venv.addConst n ci' = some venv' → ci.name = n → Aligned (C.insert n ci) venv'
+  | defeq : Aligned C venv → Aligned C (venv.addDefEq df)
+  | structEta : Aligned C venv → Aligned C (venv.addStructEta rule)
+
+theorem Aligned.map_wf (H : Aligned safety C venv) : C.WF := by
+  induction H with
+  | empty => exact .empty
+  | ignoreConst _ h1 _ _ ih
+  | const _ h1 _ _ _ ih => exact ih.insert _ _ h1
+  | defeq _ ih => exact ih
+  | structEta _ ih => exact ih
+
+theorem Aligned.find?_iff (H : Aligned safety C venv) :
+    (∃ ci, C.find? name = some ci ∧ safety ≤ ci.safety) ↔ ∃ ci, venv.constants name = some ci := by
+  induction H with
+  | empty => simp [SMap.find?, VEnv.empty]
+  | ignoreConst H _ h2 _ ih =>
+    simp [H.map_wf.find?_insert]; split <;> [skip; assumption]
+    rename_i eq1 eq2; subst eq2; simp [← ih, *]
+  | const H h1 h2 eq _ ih =>
+    simp [H.map_wf.find?_insert]
+    simp [VEnv.addConst] at eq; split at eq <;> cases eq
+    split <;> simp_all; exact h2.1
+  | defeq _ ih => exact ih
+  | structEta _ ih => exact ih
+
+theorem Aligned.addQuot1 {Q : Prop}
+    (H1 : ∀ c env, Aligned safety c env → P c env → Q)
+    (C env) (wf : Aligned safety C env) (H2 : AddQuot1 n k ci P C env) : Q := by
+  let ⟨_, _, _, h1, h2, h3, h4⟩ := H2
+  exact H1 _ _ (wf.const h2 (h1.sf_mono DefinitionSafety.le_safe) h3 rfl) h4
+
+nonrec theorem Aligned.addQuot (H : AddQuot C₁ C₂ venv₁ venv₂)
+    (wf : Aligned safety C₁ venv₁) : Aligned safety C₂ venv₂ := by
+  dsimp [AddQuot] at H
+  refine (addQuot1 <| addQuot1 <| addQuot1 <| addQuot1 ?_) _ _ wf H
+  rintro _ _ h ⟨rfl, rfl⟩; exact h.defeq
+
+theorem AddInductConstant.map_wf
+    (H : AddInductConstant kind C₁ env₁ ci C₂ env₂) (wf : C₁.WF) : C₂.WF := by
+  rw [H.map_add]
+  exact wf.insert _ _ H.map_fresh
+
+/-- The implementation metadata inserted by one inductive-constant step is
+still available at that step's output boundary. -/
+theorem AddInductConstant.map_lookup
+    (H : AddInductConstant kind C₁ env₁ ci C₂ env₂)
+    (wf : C₁.WF) : C₂.find? ci.name = some H.info := by
+  simp [H.map_add, wf.find?_insert]
+
+/-- An inductive-metadata insertion preserves every lookup already present in
+the input map.  Freshness rules out the only key at which `insert` could
+replace that entry. -/
+theorem AddInductConstant.preserve_map_lookup
+    (H : AddInductConstant kind C₁ env₁ ci' C₂ env₂)
+    (wf : C₁.WF) {name : Name} {info : ConstantInfo}
+    (hlookup : C₁.find? name = some info) :
+    C₂.find? name = some info := by
+  rw [H.map_add, wf.find?_insert]
+  split
+  · rename_i heq
+    have hname : ci'.name = name := by simpa using heq
+    subst name
+    have hfresh := H.map_fresh
+    rw [hlookup] at hfresh
+    contradiction
+  · exact hlookup
+
+theorem InductConstantKind.Matches.deltaValue?_eq_none
+    {kind : InductConstantKind} {ci : ConstantInfo}
+    (H : InductConstantKind.Matches kind ci) : ci.deltaValue? = none := by
+  cases kind <;> cases ci <;>
+    simp_all [InductConstantKind.Matches, ConstantInfo.deltaValue?]
+
+/-- An inductive metadata insertion cannot introduce a declaration body.
+Consequently, any value-bearing entry in the result map was already present
+in the input map. -/
+theorem AddInductConstant.old_of_value
+    (H : AddInductConstant kind C₁ env₁ ci' C₂ env₂) (wf : C₁.WF)
+    (hout : C₂.find? name = some ci) (hv : ci.deltaValue? = some v) :
+    C₁.find? name = some ci := by
+  rw [H.map_add, wf.find?_insert] at hout
+  split at hout
+  · cases hout
+    have hnone := InductConstantKind.Matches.deltaValue?_eq_none H.kind_eq
+    simp_all
+  · exact hout
+
+theorem AddInductConstants.map_wf :
+    AddInductConstants kind C₁ env₁ cis C₂ env₂ → C₁.WF → C₂.WF
+  | .nil, wf => wf
+  | .cons h hrest, wf => hrest.map_wf (h.map_wf wf)
+
+/-- A whole insertion fold preserves every lookup from its input map. -/
+theorem AddInductConstants.preserve_map_lookup
+    (H : AddInductConstants kind C₁ env₁ cis C₂ env₂)
+    (wf : C₁.WF) {name : Name} {info : ConstantInfo}
+    (hlookup : C₁.find? name = some info) :
+    C₂.find? name = some info := by
+  induction H with
+  | nil => exact hlookup
+  | cons h hrest ih =>
+    exact ih (h.map_wf wf) (h.preserve_map_lookup wf hlookup)
+
+/-- Final-map evidence for any member of an inductive metadata fold.  The
+result retains the exact implementation object, its role tag, and its
+translation against the final Theory environment. -/
+theorem AddInductConstants.translated_lookup
+    (H : AddInductConstants kind C₁ env₁ cis C₂ env₂)
+    (wf : C₁.WF) {ci : VConstVal} (hmem : ci ∈ cis) : ∃ info,
+      C₂.find? ci.name = some info ∧
+      kind.Matches info ∧ TrConstVal .safe env₂ info ci := by
+  induction H with
+  | nil => contradiction
+  | cons h hrest ih =>
+    rcases List.mem_cons.1 hmem with rfl | hmem
+    · refine ⟨h.info, ?_, h.kind_eq, ?_⟩
+      exact hrest.preserve_map_lookup (h.map_wf wf) (h.map_lookup wf)
+      exact h.tr.mono (h.le.trans hrest.le)
+    · exact ih (h.map_wf wf) hmem
+
+theorem AddInductConstants.old_of_value :
+    (H : AddInductConstants kind C₁ env₁ cis C₂ env₂) → C₁.WF →
+    C₂.find? name = some ci → ci.deltaValue? = some v → C₁.find? name = some ci
+  | .nil, _, hout, _ => hout
+  | .cons h hrest, wf, hout, hv =>
+    h.old_of_value wf (hrest.old_of_value (h.map_wf wf) hout hv) hv
+
+/-! ## Final translated metadata inventories -/
+
+/-- Final-map and final-environment evidence for the family emitted by a
+singleton inductive replay. -/
+theorem AddInductTrace.type_translated_lookup
+    (H : AddInductTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF) :
+    ∃ info,
+      C₂.find? H.generation.block.sourceType.name = some info ∧
+      InductConstantKind.induct.Matches info ∧
+      TrConstVal .safe env₂ info H.generation.block.sourceType.toVConstVal := by
+  refine ⟨H.addType.info, ?_, H.addType.kind_eq, ?_⟩
+  · exact H.addRec.preserve_map_lookup
+      (H.addCtors.map_wf (H.addType.map_wf wf))
+      (H.addCtors.preserve_map_lookup (H.addType.map_wf wf)
+        (H.addType.map_lookup wf))
+  · exact H.addType.tr.mono
+      (H.addType.le.trans <| H.addCtors.le.trans <|
+        H.addRec.le.trans H.addRules.le)
+
+/-- Final-map and final-environment evidence for every constructor emitted by
+a singleton inductive replay. -/
+theorem AddInductTrace.constructor_translated_lookup
+    (H : AddInductTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ H.generation.block.sourceType.ctors) :
+    ∃ info,
+      C₂.find? constructor.name = some info ∧
+      InductConstantKind.ctor.Matches info ∧
+      TrConstVal .safe env₂ info constructor := by
+  obtain ⟨info, hlookup, hkind, htr⟩ :=
+    H.addCtors.translated_lookup (H.addType.map_wf wf) hconstructor
+  exact ⟨info,
+    H.addRec.preserve_map_lookup (H.addCtors.map_wf (H.addType.map_wf wf)) hlookup,
+    hkind, htr.mono (H.addRec.le.trans H.addRules.le)⟩
+
+/-- Final-map and final-environment evidence for the recursor emitted by a
+singleton inductive replay. -/
+theorem AddInductTrace.recursor_translated_lookup
+    (H : AddInductTrace C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) : ∃ info,
+      C₂.find? (inductGenerationRecVal H.generation).name = some info ∧
+      InductConstantKind.recursor.Matches info ∧
+      TrConstVal .safe env₂ info (inductGenerationRecVal H.generation) := by
+  exact ⟨H.addRec.info, H.addRec.map_lookup
+      (H.addCtors.map_wf (H.addType.map_wf wf)), H.addRec.kind_eq,
+    H.addRec.tr.mono (H.addRec.le.trans H.addRules.le)⟩
+
+/-- Final translated lookup for every source family in a mutual block. -/
+theorem AddInductBlockTrace.family_translated_lookup
+    (H : AddInductBlockTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {family : VInductiveType} (hfamily : family ∈ decl.types) : ∃ info,
+      C₂.find? family.name = some info ∧
+      InductConstantKind.induct.Matches info ∧
+      TrConstVal .safe env₂ info family.toVConstVal := by
+  have hmember : family.toVConstVal ∈ decl.blockTypeConstants :=
+    List.mem_map.2 ⟨family, hfamily, rfl⟩
+  obtain ⟨info, hlookup, hkind, htr⟩ :=
+    H.addTypes.translated_lookup wf hmember
+  exact ⟨info,
+    H.addRecs.preserve_map_lookup
+      (H.addCtors.map_wf (H.addTypes.map_wf wf))
+      (H.addCtors.preserve_map_lookup (H.addTypes.map_wf wf) hlookup),
+    hkind, htr.mono (H.addCtors.le.trans <| H.addRecs.le.trans H.addRules.le)⟩
+
+/-- Final translated lookup for every flattened constructor in a mutual
+block. -/
+theorem AddInductBlockTrace.constructor_translated_lookup
+    (H : AddInductBlockTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ decl.blockConstructorConstants) : ∃ info,
+      C₂.find? constructor.name = some info ∧
+      InductConstantKind.ctor.Matches info ∧
+      TrConstVal .safe env₂ info constructor := by
+  obtain ⟨info, hlookup, hkind, htr⟩ :=
+    H.addCtors.translated_lookup (H.addTypes.map_wf wf) hconstructor
+  exact ⟨info,
+    H.addRecs.preserve_map_lookup
+      (H.addCtors.map_wf (H.addTypes.map_wf wf)) hlookup,
+    hkind, htr.mono (H.addRecs.le.trans H.addRules.le)⟩
+
+/-- Final translated lookup for every generated recursor in a mutual block. -/
+theorem AddInductBlockTrace.recursor_translated_lookup
+    (H : AddInductBlockTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {recursor : VConstVal} (hrecursor : recursor ∈ H.generation.recursors) :
+    ∃ info,
+      C₂.find? recursor.name = some info ∧
+      InductConstantKind.recursor.Matches info ∧
+      TrConstVal .safe env₂ info recursor := by
+  obtain ⟨info, hlookup, hkind, htr⟩ := H.addRecs.translated_lookup
+    (H.addCtors.map_wf (H.addTypes.map_wf wf)) hrecursor
+  exact ⟨info, hlookup, hkind, htr.mono H.addRules.le⟩
+
+/-- Final translated lookup for every source family in a nested replay. -/
+theorem AddInductNestedTrace.family_translated_lookup
+    (H : AddInductNestedTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {family : VInductiveType} (hfamily : family ∈ decl.types) : ∃ info,
+      C₂.find? family.name = some info ∧
+      InductConstantKind.induct.Matches info ∧
+      TrConstVal .safe env₂ info family.toVConstVal := by
+  have hmember : family.toVConstVal ∈ decl.blockTypeConstants :=
+    List.mem_map.2 ⟨family, hfamily, rfl⟩
+  obtain ⟨info, hlookup, hkind, htr⟩ :=
+    H.addTypes.translated_lookup wf hmember
+  exact ⟨info,
+    H.addRecs.preserve_map_lookup
+      (H.addCtors.map_wf (H.addTypes.map_wf wf))
+      (H.addCtors.preserve_map_lookup (H.addTypes.map_wf wf) hlookup),
+    hkind, htr.mono (H.addCtors.le.trans <| H.addRecs.le.trans H.addRules.le)⟩
+
+/-- Final translated lookup for every source constructor in a nested replay. -/
+theorem AddInductNestedTrace.constructor_translated_lookup
+    (H : AddInductNestedTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {constructor : VConstVal}
+    (hconstructor : constructor ∈ decl.blockConstructorConstants) : ∃ info,
+      C₂.find? constructor.name = some info ∧
+      InductConstantKind.ctor.Matches info ∧
+      TrConstVal .safe env₂ info constructor := by
+  obtain ⟨info, hlookup, hkind, htr⟩ :=
+    H.addCtors.translated_lookup (H.addTypes.map_wf wf) hconstructor
+  exact ⟨info,
+    H.addRecs.preserve_map_lookup
+      (H.addCtors.map_wf (H.addTypes.map_wf wf)) hlookup,
+    hkind, htr.mono (H.addRecs.le.trans H.addRules.le)⟩
+
+/-- Final translated lookup for every restored recursor in a nested replay. -/
+theorem AddInductNestedTrace.recursor_translated_lookup
+    (H : AddInductNestedTrace C₁ env₁ decl C₂ env₂) (wf : C₁.WF)
+    {recursor : VConstVal} (hrecursor : recursor ∈ H.nested.recursors) : ∃ info,
+      C₂.find? recursor.name = some info ∧
+      InductConstantKind.recursor.Matches info ∧
+      TrConstVal .safe env₂ info recursor := by
+  obtain ⟨info, hlookup, hkind, htr⟩ := H.addRecs.translated_lookup
+    (H.addCtors.map_wf (H.addTypes.map_wf wf)) hrecursor
+  exact ⟨info, hlookup, hkind, htr.mono H.addRules.le⟩
+
+theorem AddInduct.map_wf (H : AddInduct C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) : C₂.WF := by
+  rcases H with ⟨H⟩
+  exact H.addRec.map_wf <| H.addCtors.map_wf <| H.addType.map_wf wf
+
+theorem AddInduct.old_of_value (H : AddInduct C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) (hout : C₂.find? name = some ci) (hv : ci.deltaValue? = some v) :
+    C₁.find? name = some ci := by
+  rcases H with ⟨H⟩
+  have wfType := H.addType.map_wf wf
+  have wfCtors := H.addCtors.map_wf wfType
+  exact H.addType.old_of_value wf
+    (H.addCtors.old_of_value wfType (H.addRec.old_of_value wfCtors hout hv) hv) hv
+
+theorem AddInductBlock.map_wf
+    (H : AddInductBlock C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) : C₂.WF := by
+  rcases H with ⟨H⟩
+  exact H.addRecs.map_wf <| H.addCtors.map_wf <|
+    H.addTypes.map_wf wf
+
+theorem AddInductBlock.old_of_value
+    (H : AddInductBlock C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) (hout : C₂.find? name = some ci)
+    (hv : ci.deltaValue? = some v) : C₁.find? name = some ci := by
+  rcases H with ⟨H⟩
+  have wfTypes := H.addTypes.map_wf wf
+  have wfCtors := H.addCtors.map_wf wfTypes
+  exact H.addTypes.old_of_value wf
+    (H.addCtors.old_of_value wfTypes
+      (H.addRecs.old_of_value wfCtors hout hv) hv) hv
+
+theorem AddInductNested.map_wf
+    (H : AddInductNested C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) : C₂.WF := by
+  rcases H with ⟨H⟩
+  exact H.addRecs.map_wf <| H.addCtors.map_wf <|
+    H.addTypes.map_wf wf
+
+theorem AddInductNested.old_of_value
+    (H : AddInductNested C₁ env₁ decl C₂ env₂)
+    (wf : C₁.WF) (hout : C₂.find? name = some ci)
+    (hv : ci.deltaValue? = some v) : C₁.find? name = some ci := by
+  rcases H with ⟨H⟩
+  have wfTypes := H.addTypes.map_wf wf
+  have wfCtors := H.addCtors.map_wf wfTypes
+  exact H.addTypes.old_of_value wf
+    (H.addCtors.old_of_value wfTypes
+      (H.addRecs.old_of_value wfCtors hout hv) hv) hv
+
+theorem Aligned.addInductConstant
+    (wf : Aligned safety C₁ env₁)
+    (H : AddInductConstant kind C₁ env₁ ci C₂ env₂) : Aligned safety C₂ env₂ := by
+  rw [H.map_add]
+  exact wf.const H.map_fresh (H.tr.1.sf_mono DefinitionSafety.le_safe)
+    H.env_add H.tr.2
+
+theorem Aligned.addInductConstants :
+    AddInductConstants kind C₁ env₁ cis C₂ env₂ →
+      Aligned safety C₁ env₁ → Aligned safety C₂ env₂
+  | .nil, wf => wf
+  | .cons h hrest, wf =>
+    Aligned.addInductConstants hrest (wf.addInductConstant h)
+
+theorem Aligned.addDefEqFold : ∀ (dfs : List VDefEq),
+    Aligned safety C env → Aligned safety C (dfs.foldl VEnv.addDefEq env)
+  | [], wf => wf
+  | _ :: dfs, wf => addDefEqFold dfs wf.defeq
+
+theorem Aligned.addInduct (H : AddInduct C₁ env₁ decl C₂ env₂)
+    (wf : Aligned safety C₁ env₁) : Aligned safety C₂ env₂ := by
+  rcases H with ⟨H⟩
+  rw [← H.addRules.to_add]
+  have wfType := wf.addInductConstant H.addType
+  have wfCtors := wfType.addInductConstants H.addCtors
+  have wfRec := wfCtors.addInductConstant H.addRec
+  exact wfRec.addDefEqFold _
+
+theorem Aligned.addInductBlock
+    (H : AddInductBlock C₁ env₁ decl C₂ env₂)
+    (wf : Aligned safety C₁ env₁) : Aligned safety C₂ env₂ := by
+  rcases H with ⟨H⟩
+  rw [← H.addRules.to_add]
+  have wfTypes := wf.addInductConstants H.addTypes
+  have wfCtors := wfTypes.addInductConstants H.addCtors
+  have wfRecs := wfCtors.addInductConstants H.addRecs
+  exact wfRecs.addDefEqFold _
+
+theorem Aligned.addInductNested
+    (H : AddInductNested C₁ env₁ decl C₂ env₂)
+    (wf : Aligned safety C₁ env₁) : Aligned safety C₂ env₂ := by
+  rcases H with ⟨H⟩
+  rw [← H.addRules.to_add]
+  have wfTypes := wf.addInductConstants H.addTypes
+  have wfCtors := wfTypes.addInductConstants H.addCtors
+  have wfRecs := wfCtors.addInductConstants H.addRecs
+  exact wfRecs.addDefEqFold _
+
+#guard_named_axioms Ix.Theory.Named.Aligned.addInduct [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.Aligned.addInductBlock [propext, Classical.choice, Quot.sound]
+
+theorem Aligned.addDefEqs {C : ConstMap} : ∀ {cis' : List VDefVal} {venv},
+    Aligned safety C venv → Aligned safety C (venv.addDefEqs cis')
+  | [], _, H => H
+  | ci :: cis, venv, H => by
+    show Aligned safety C (VEnv.addDefEqs (venv.addDefEq ci.toDefEq) cis)
+    exact Aligned.addDefEqs H.defeq
+
+theorem Aligned.insertDefs : ∀ {cis : List DefinitionVal} {cis' : List VDefVal} {C venv venv'},
+    Aligned safety C venv → (cis.map (·.name)).Nodup →
+    (∀ ci ∈ cis, C.find? ci.name = none) →
+    List.Forall₂ (fun ci ci' => TrConstVal safety venv (.defnInfo ci) ci'.toVConstVal) cis cis' →
+    venv.addConsts cis' = some venv' → Aligned safety (insertDefs C cis) venv'
+  | [], _, _, _, _, H, _, _, hblk, e => by
+    cases hblk; simp [VEnv.addConsts] at e; cases e; exact H
+  | ci :: cis, _, C, venv, _, H, hnd, hfr, hblk, e => by
+    cases hblk with | @cons _ ci' _ _ htr hblk => ?_
+    simp [VEnv.addConsts, Option.bind_eq_some_iff] at e
+    obtain ⟨venv₁, h1, h2⟩ := e
+    have hname := htr.2
+    simp only [ConstantInfo.name, ConstantInfo.toConstantVal] at hname
+    simp only [List.map_cons, List.nodup_cons, List.mem_map] at hnd
+    have h1' : venv.addConst ci.name ci'.toVConstant = some venv₁ := by rw [hname]; exact h1
+    show Aligned safety
+      (_root_.Ix.Theory.Named.insertDefs (SMap.insert C ci.name (.defnInfo ci)) cis) _
+    refine Aligned.insertDefs (H.const (hfr _ (.head _)) htr.1 h1' rfl) hnd.2
+      (fun c hc => ?_) (Ix.Theory.Named.List.Forall₂.imp
+        (fun _ _ h => h.mono (VEnv.addConst_le h1')) hblk) h2
+    rw [H.map_wf.find?_insert]
+    have : ¬ (ci.name == c.name) = true := by
+      simp only [beq_iff_eq]; intro h
+      exact hnd.1 ⟨c, hc, h.symm⟩
+    simp [this]
+    exact hfr c (.tail _ hc)
+
+theorem TrEnv'.aligned (H : TrEnv' safety C Q venv) : Aligned safety C venv := by
+  induction H with
+  | empty => exact .empty
+  | ignore h1 h2 _ ih => exact ih.ignoreConst h1 h2 rfl
+  | «axiom» h1 h2 _ h _ ih => exact ih.const h2 h1 h rfl
+  | thm h1 h2 _ _ h _ ih => exact ih.const h2 h1.1.1 h rfl
+  | «opaque» h1 h2 _ h _ ih => exact ih.const h2 h1.1.1 h rfl
+  | defn h1 h2 _ h _ ih => exact (ih.const h2 h1.1.1 h rfl).defeq
+  | mutualDef hblk hnd hfr _ hadd _ _ ih =>
+    exact Aligned.addDefEqs <| ih.insertDefs hnd hfr
+      (Ix.Theory.Named.List.Forall₂.imp (fun _ _ h => h.1) hblk) hadd
+  | quot _ h _ ih => exact ih.addQuot h
+  | inductStaging h _ _ ih => exact ih.addInductConstant h
+  | induct h _ ih => exact ih.addInduct h
+  | inductBlock h _ ih => exact ih.addInductBlock h
+  | inductNested h _ ih => exact ih.addInductNested h
+  | structEta _ _ ih => exact ih.structEta
+
+/- Since the v4.33 reconciliation the `mutualDef` arm routes through
+`insertDefs`, whose `SMap` reasoning uses the classified persistent-map
+container contracts; the closure is pinned so any further growth is
+reviewed. -/
+#guard_named_axioms Ix.Theory.Named.TrEnv'.aligned [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+theorem TrEnv'.map_wf (H : TrEnv' safety C Q venv) : C.WF := H.aligned.map_wf
+
+theorem Aligned.find? (H : Aligned safety C venv)
+    (h : C.find? name = some ci) (hs : safety ≤ ci.safety) :
+    ∃ ci', venv.constants name = some ci' ∧ TrConstant safety venv ci ci' := by
+  have mono {env₁ env₂} (H : env₁.LE env₂) :
+      (∃ ci', env₁.constants name = some ci' ∧ TrConstant safety env₁ ci ci') →
+      (∃ ci', env₂.constants name = some ci' ∧ TrConstant safety env₂ ci ci')
+    | ⟨_, h1, h2⟩ => ⟨_, H.constants h1, h2.mono H⟩
+  induction H with
+  | empty => simp [SMap.find?] at h
+  | ignoreConst h1 _ _ _ ih =>
+    rw [h1.map_wf.find?_insert] at h; split at h
+    · cases h; contradiction
+    · exact ih h
+  | const h1 _ h2 h3 _ ih =>
+    have := VEnv.addConst_le h3
+    rw [h1.map_wf.find?_insert] at h; split at h
+    · rename_i h'; cases h; simp at h'; subst h'
+      simp [VEnv.addConst] at h3; split at h3 <;> cases h3
+      simp; rename_i h'; refine h2.mono this
+    · let ⟨_, h1, h2⟩ := ih h; exact ⟨_, this.constants h1, h2.mono this⟩
+  | defeq h1 ih => let ⟨_, h1, h2⟩ := ih h; exact ⟨_, h1, h2.mono VEnv.addDefEq_le⟩
+  | structEta h1 ih =>
+    let ⟨_, h1, h2⟩ := ih h
+    exact ⟨_, h1, h2.mono VEnv.addStructEta_le⟩
+
+theorem Aligned.find?_uniq (H : Aligned safety C venv)
+    (h : C.find? name = some ci) (hs : venv.constants name = some ci') :
+    ci.name = name ∧ TrConstant safety venv ci ci' := by
+  induction H with
+  | empty => simp [SMap.find?] at h
+  | ignoreConst H h2 h3 _ ih =>
+    simp [H.map_wf.find?_insert] at h; split at h
+    · rename_i n ci _ h'; subst n h'
+      simpa [h2, hs] using H.find?_iff (name := ci.name)
+    · exact ih h hs
+  | const h1 h5 h2 h3 h4 ih =>
+    have := VEnv.addConst_le h3
+    simp [VEnv.addConst] at h3; split at h3 <;> cases h3
+    simp [h1.map_wf.find?_insert] at h hs; revert h hs; split
+    · rintro ⟨⟩ ⟨⟩; rename_i n _ _ _; subst n; exact ⟨h4, h2.mono this⟩
+    · intro hs h; let ⟨h1, h2⟩ := ih h hs; exact ⟨h1, h2.mono this⟩
+  | defeq h1 ih => let ⟨h1, h2⟩ := ih h hs; exact ⟨h1, h2.mono VEnv.addDefEq_le⟩
+  | structEta h1 ih =>
+    let ⟨h1, h2⟩ := ih h hs
+    exact ⟨h1, h2.mono VEnv.addStructEta_le⟩
+
+theorem TrEnv.find?_iff (H : TrEnv safety env venv) :
+    (∃ ci, env.find? name = some ci ∧ safety ≤ ci.safety) ↔ ∃ ci, venv.constants name = some ci := by
+  conv => enter [1,1,_,1,1]; apply H.map_wf.find?'_eq_find?
+  exact H.aligned.find?_iff
+
+-- theorem TrEnv.contains_iff (H : TrEnv safety env venv) :
+--     env.contains name ↔ ∃ oci, venv.constants name = some oci := by
+--   simp [← H.find?_iff, Kernel.Environment.find?, H.map_wf.find?'_eq_find?,
+--     ← Option.isSome_iff_exists, ← SMap.find?_isSome, Kernel.Environment.contains]
+
+theorem TrEnv.find? (H : TrEnv safety env venv)
+    (h : env.find? name = some ci) (hs : safety ≤ ci.safety) :
+    ∃ ci', venv.constants name = some ci' ∧ TrConstant safety venv ci ci' :=
+  H.aligned.find? (H.map_wf.find?'_eq_find? _ ▸ h) hs
+
+theorem TrEnv.find?_uniq (H : TrEnv safety env venv)
+    (h : env.find? name = some ci) (hs : venv.constants name = some ci') :
+    ci.name = name ∧ TrConstant safety venv ci ci' :=
+  H.aligned.find?_uniq (H.map_wf.find?'_eq_find? _ ▸ h) hs
+
+theorem VEnv.addDefEqs_le : ∀ {cis' : List VDefVal} {venv : VEnv}, venv ≤ venv.addDefEqs cis'
+  | [], _ => .rfl
+  | ci :: cis, venv => by
+    show venv ≤ VEnv.addDefEqs (venv.addDefEq ci.toDefEq) cis
+    exact VEnv.addDefEq_le.trans VEnv.addDefEqs_le
+
+theorem VEnv.addDefEqs_self : ∀ {cis' : List VDefVal} {venv : VEnv} {ci'}, ci' ∈ cis' →
+    (venv.addDefEqs cis').defeqs ci'.toDefEq
+  | ci :: cis, venv, _, hc => by
+    show (VEnv.addDefEqs (venv.addDefEq ci.toDefEq) cis).defeqs _
+    cases hc with
+    | head => exact VEnv.addDefEqs_le.defeqs VEnv.addDefEq_self
+    | tail _ hc => exact VEnv.addDefEqs_self hc
+
+theorem insertDefs_find? : ∀ {cis : List DefinitionVal} {C : ConstMap} {name ci}, C.WF →
+    (∀ d ∈ cis, C.find? d.name = none) → (cis.map (·.name)).Nodup →
+    (insertDefs C cis).find? name = some ci →
+    C.find? name = some ci ∨ ∃ d ∈ cis, d.name = name ∧ ConstantInfo.defnInfo d = ci
+  | [], _, _, _, _, _, _, h => .inl h
+  | d :: ds, C, name, ci, hC, hfr, hnd, h => by
+    simp only [List.map_cons, List.nodup_cons, List.mem_map] at hnd
+    have hfr' : ∀ e ∈ ds, (SMap.insert C d.name (.defnInfo d)).find? e.name = none := by
+      intro e he
+      rw [hC.find?_insert]
+      have : ¬ (d.name == e.name) = true := by
+        simp only [beq_iff_eq]; intro hh; exact hnd.1 ⟨e, he, hh.symm⟩
+      simp [this]; exact hfr e (.tail _ he)
+    have h : (insertDefs (SMap.insert C d.name (.defnInfo d)) ds).find? name = some ci := h
+    rcases insertDefs_find? (hC.insert _ _ (hfr _ (.head _))) hfr' hnd.2 h with h | ⟨e, he, h1, h2⟩
+    · rw [hC.find?_insert] at h; split at h
+      · rename_i hb; cases h
+        exact .inr ⟨d, .head _, by simpa using hb, rfl⟩
+      · exact .inl h
+    · exact .inr ⟨e, .tail _ he, h1, h2⟩
+
+theorem TrEnv'.of_value (H : TrEnv' safety C Q venv) (h : C.find? name = some ci)
+    (hs : safety ≤ ci.safety) (hv : ci.deltaValue? = some v) :
+    TrExpr venv ci.levelParams [] v (.const ci.name (VLevel.params ci.levelParams.length)) := by
+  have {C n ci'} (hC : C.WF) :
+      (SMap.insert C n ci').find? name = some ci →
+      C.find? name = some ci ∨ n = name ∧ ci' = ci := by
+    rw [hC.find?_insert]; simp; split <;> simp +contextual [*]
+  induction H with
+  | empty => simp [SMap.find?] at h
+  | ignore h1 h2 H ih =>
+    obtain h | ⟨rfl, rfl⟩ := this H.map_wf h
+    · exact ih h
+    · exact (h2 hs).elim
+  | «axiom» _ _ _ h1 H ih =>
+    obtain h | ⟨rfl, rfl⟩ := this H.map_wf h
+    · exact (ih h).mono (VEnv.addConst_le h1)
+    · contradiction
+  | defn h2 h3 h4 h1 H ih =>
+    have' le := (VEnv.addConst_le h1).trans VEnv.addDefEq_le
+    obtain h | ⟨rfl, rfl⟩ := this H.map_wf h
+    · exact (ih h).mono le
+    · cases hv
+      have := VEnv.IsDefEq.extra0 VEnv.addDefEq_self <|
+        (H.defn h2 h3 h4 h1).wf.ordered.defEqWF VEnv.addDefEq_self
+      let ⟨⟨⟨b1, b2, b3⟩, b4⟩, b5⟩ := h2
+      refine ⟨_, b5.mono le, b2.symm ▸ b4.symm ▸ ⟨_, this.symm⟩⟩
+  | mutualDef hblk hnd hfr _ hadd _ H ih =>
+    have' le := (VEnv.addConsts_le hadd).trans VEnv.addDefEqs_le
+    rcases insertDefs_find? H.map_wf hfr hnd h with h | ⟨d, hd, rfl, rfl⟩
+    · exact (ih h).mono le
+    · obtain ⟨d', hd', htr, hval⟩ := Ix.Theory.Named.List.Forall₂.forall_exists_l hblk _ hd
+      cases hv
+      have hdefeq := VEnv.IsDefEq.extra0 (VEnv.addDefEqs_self hd')
+        ((H.mutualDef hblk hnd hfr ‹_› hadd ‹_›).wf.ordered.defEqWF (VEnv.addDefEqs_self hd'))
+      let ⟨⟨b1, b2, b3⟩, b4⟩ := htr
+      exact ⟨_, hval.mono VEnv.addDefEqs_le, b2.symm ▸ b4.symm ▸ ⟨_, hdefeq.symm⟩⟩
+  | thm h2 h3 h4 h5 h1 H ih =>
+    have' le := VEnv.addConst_le h1
+    obtain h | ⟨rfl, rfl⟩ := this H.map_wf h
+    · exact (ih h).mono le
+    · cases hv
+      let ⟨⟨⟨b1, b2, b3⟩, b4⟩, b5⟩ := h2
+      dsimp only [ConstantInfo.name, ConstantInfo.levelParams, ConstantInfo.toConstantVal] at b2 b4 ⊢
+      have hp := h5.mono le
+      have hb := h4.mono le
+      have hc := VEnv.HasType.const0 (VEnv.addConst_self h1) ⟨_, hp⟩
+      rw [b4] at hc
+      refine ⟨_, b5.mono le, b2.symm ▸ b4.symm ▸ ?_⟩
+      exact ⟨_, .proofIrrel hp hb hc⟩
+  | «opaque» _ _ _ h1 H ih =>
+    obtain h | ⟨rfl, rfl⟩ := this H.map_wf h
+    · exact (ih h).mono (VEnv.addConst_le h1)
+    · contradiction
+  | quot _ h1 H ih =>
+    suffices ∀ {n k ci' P}, (∀ C env, Aligned safety C env → P C env → C.find? name = some ci) →
+        ∀ C env, Aligned safety C env → AddQuot1 n k ci' P C env → C.find? name = some ci by
+      refine (ih <| this (this <| this <| this ?_) _ _ H.aligned h1).mono h1.le
+      rintro _ _ _ ⟨rfl, rfl⟩; exact h
+    rintro n k ci' P ih C env wf ⟨_, h1, _, h2, h3, h4, h5⟩
+    have wf' := wf.const h3 ⟨by cases safety <;> rfl, h2.2⟩ h4 rfl
+    obtain h | ⟨rfl, rfl⟩ := this wf.map_wf (ih _ _ wf' h5)
+    · exact h
+    · contradiction
+  | inductStaging h1 _ H ih =>
+    exact (ih (h1.old_of_value H.map_wf h hv)).mono h1.le
+  | induct h1 H ih =>
+    exact (ih (h1.old_of_value H.map_wf h hv)).mono h1.le
+  | inductBlock h1 H ih =>
+    exact (ih (h1.old_of_value H.map_wf h hv)).mono h1.le
+  | inductNested h1 H ih =>
+    exact (ih (h1.old_of_value H.map_wf h hv)).mono h1.le
+  | structEta _ H ih =>
+    exact (ih h).mono VEnv.addStructEta_le
+
+nonrec theorem TrEnv.of_value (H : TrEnv safety env venv) (h : env.find? name = some ci)
+    (hs : safety ≤ ci.safety) (hv : ci.deltaValue? = some v) :
+    TrExpr venv ci.levelParams [] v (.const ci.name (VLevel.params ci.levelParams.length)) :=
+  H.of_value (by rwa [← H.map_wf.find?'_eq_find?]) hs hv
diff --git a/Ix/Theory/Named/Verify/Environment/MutualInductiveFixtures.lean b/Ix/Theory/Named/Verify/Environment/MutualInductiveFixtures.lean
new file mode 100644
index 000000000..4fa9ec2de
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/MutualInductiveFixtures.lean
@@ -0,0 +1,3150 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
+import Ix.Theory.Named.MutualInductiveFixtures
+
+open Ix.Theory (VLevel)
+
+/-!
+# Mutual generation, preservation, and environment replay
+
+The real `Tree`/`TreeList` and indexed mutual fixtures instantiate the
+arbitrary-block validator traces, generate one recursor per family with one
+globally flattened minor/rule inventory, and compare every kernel metadata
+record.  Their Theory transactions stage all families before constructors,
+all constructors before recursors, and all recursors before rules, then replay
+the same phases through `TrEnv'.inductBlock` into aligned Verify environments.
+-/
+
+namespace Ix.Theory.Named.MutualInductiveReplayFixtures
+
+open Lean Meta Elab Term
+open Kernel
+open AddInductive
+open VInductDecl
+open Ix.Theory.Named.MutualInductiveFixtures
+open Ix.Theory.Named.InductiveReplayFixtures
+
+local instance : Inhabited VEnv := ⟨.empty⟩
+
+/-- Quote a kernel recursor type using the recursor metadata's own universe
+parameter order. -/
+syntax "kernelRecConstant08C%" ident : term
+syntax "kernelConstVType08C%" ident : term
+
+elab_rules : term
+  | `(kernelRecConstant08C% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let .recInfo info ← getConstInfo name
+      | throwError "expected recursor metadata for {name}"
+    let type ← Ix.Theory.Named.Meta.expandExpr info.type
+    let type ← Ix.Theory.Named.Meta.ofExpr info.levelParams {} type
+    return toExpr ({ uvars := info.levelParams.length, type } : VConstant)
+
+/-- Quote a stored kernel metadata type in that record's own universe order.
+Together with the explicit record-field checks below, this observes universe
+permutations as well as the translated type expression. -/
+elab_rules : term
+  | `(kernelConstVType08C% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let info ← getConstInfo name
+    let type ← Ix.Theory.Named.Meta.expandExpr info.type
+    let type ← Ix.Theory.Named.Meta.ofExpr info.levelParams {} type
+    return toExpr type
+
+/-! ## Complete block metadata parity -/
+
+/-- One block-wide comparison between the retained Theory generation and all
+kernel inductive metadata.  The nested lists preserve family/constructor
+ownership and split each recursor's local rules out of the globally flattened
+Theory rule list. -/
+structure MutualKernelBlockRow where
+  source : VInductDecl
+  generation : BlockGenerationChecked source
+  inductInfos : List ConstantInfo
+  ctorInfos : List (List ConstantInfo)
+  recInfos : List ConstantInfo
+  familyTypes : List VExpr
+  ctorTypes : List (List VExpr)
+  recTypes : List VExpr
+  ruleRhs : List (List VExpr)
+
+namespace MutualKernelBlockRow
+
+def ctorMatches (row : MutualKernelBlockRow)
+    (family : NormalizedFamily) (cidx : Nat) (info : ConstantInfo)
+    (constructor : NormalizedCtor) (storedType : VExpr) : Bool :=
+  match info with
+  | .ctorInfo ctor =>
+      ctor.name == constructor.raw.name &&
+        ctor.levelParams.length == row.source.uvars &&
+        ctor.induct == family.raw.name &&
+        ctor.cidx == cidx &&
+        ctor.numParams == row.source.nparams &&
+        ctor.numFields == constructor.view.fields.length &&
+        !ctor.isUnsafe && storedType == constructor.raw.type
+  | _ => false
+
+def ctorsMatch (row : MutualKernelBlockRow)
+    (family : NormalizedFamily) :
+    List ConstantInfo → List NormalizedCtor → List VExpr → Nat → Bool
+  | [], [], [], _ => true
+  | info :: infos, constructor :: constructors, storedType :: storedTypes,
+      cidx =>
+      row.ctorMatches family cidx info constructor storedType &&
+        row.ctorsMatch family infos constructors storedTypes (cidx + 1)
+  | _, _, _, _ => false
+
+def recursorMatches (row : MutualKernelBlockRow)
+    (family : NormalizedFamily) (offset : Nat)
+    (info : ConstantInfo) (storedType : VExpr)
+    (rhs : List VExpr) : Bool :=
+  match info with
+  | .recInfo rec =>
+      rec.name == .str family.raw.name "rec" &&
+        rec.levelParams.length == row.generation.recUvars &&
+        rec.all == row.source.types.map (·.name) &&
+        rec.numParams == row.source.nparams &&
+        rec.numIndices == family.view.indices.length &&
+        rec.numMotives == row.generation.familyCount &&
+        rec.numMinors == row.generation.minorCount &&
+        rec.k == row.generation.kTarget &&
+        !rec.isUnsafe &&
+        rec.rules.map (fun rule => (rule.ctor, rule.nfields)) ==
+          family.ctorPairs.map (fun constructor =>
+            (constructor.raw.name, constructor.view.fields.length)) &&
+        storedType == (row.generation.recursor family).type &&
+        rhs == ((row.generation.generatedRules.drop offset).take
+          family.ctorPairs.length |>.map (·.rhs))
+  | _ => false
+
+def familiesMatch (row : MutualKernelBlockRow) :
+    List NormalizedFamily → List ConstantInfo → List (List ConstantInfo) →
+      List ConstantInfo → List VExpr → List (List VExpr) → List VExpr →
+      List (List VExpr) → Nat → Bool
+  | [], [], [], [], [], [], [], [], _ => true
+  | family :: families, inductInfo :: inductInfos,
+      ctorInfos :: ctorInfosTail, recInfo :: recInfos,
+      familyType :: familyTypes, ctorTypes :: ctorTypesTail,
+      recType :: recTypes, ruleRhs :: ruleRhsTail, offset =>
+      (match inductInfo with
+        | .inductInfo induct =>
+            induct.name == family.raw.name &&
+              induct.levelParams.length == row.source.uvars &&
+              induct.numParams == row.source.nparams &&
+              induct.numIndices == family.view.indices.length &&
+              induct.all == row.source.types.map (·.name) &&
+              induct.ctors == family.raw.ctors.map (·.name) &&
+              induct.numNested == 0 &&
+              induct.isRec == row.generation.isRec &&
+              induct.isReflexive == row.generation.isReflexive &&
+              !induct.isUnsafe &&
+              familyType == family.raw.type
+        | _ => false) &&
+      row.ctorsMatch family ctorInfos family.ctorPairs ctorTypes 0 &&
+      row.recursorMatches family offset recInfo recType ruleRhs &&
+      row.familiesMatch families inductInfos ctorInfosTail recInfos
+        familyTypes ctorTypesTail recTypes ruleRhsTail
+        (offset + family.ctorPairs.length)
+  | _, _, _, _, _, _, _, _, _ => false
+
+/-- Every list must agree position-for-position; no truncated family,
+constructor, recursor, or rule inventory can satisfy the comparison. -/
+def agrees (row : MutualKernelBlockRow) : Bool :=
+  row.familiesMatch row.generation.families row.inductInfos row.ctorInfos
+    row.recInfos row.familyTypes row.ctorTypes row.recTypes row.ruleRhs 0
+
+end MutualKernelBlockRow
+
+/-! ## Executable kernel validation -/
+
+def treeKernelInfo : ConstantInfo := kernelInductInfo% Tree
+def treeListKernelInfo : ConstantInfo := kernelInductInfo% TreeList
+def treeLeafKernelInfo : ConstantInfo := kernelCtorInfo% Tree.leaf
+def treeNodeKernelInfo : ConstantInfo := kernelCtorInfo% Tree.node
+def treeBranchKernelInfo : ConstantInfo := kernelCtorInfo% Tree.branch
+def treeListNilKernelInfo : ConstantInfo := kernelCtorInfo% TreeList.nil
+def treeListConsKernelInfo : ConstantInfo := kernelCtorInfo% TreeList.cons
+def treeRecKernelInfo : ConstantInfo := kernelRecInfo% Tree.rec
+def treeListRecKernelInfo : ConstantInfo := kernelRecInfo% TreeList.rec
+def treeRecKernelConstant : VConstant := kernelRecConstant08C% Tree.rec
+def treeListRecKernelConstant : VConstant :=
+  kernelRecConstant08C% TreeList.rec
+def treeLeafKernelRuleRhs : VExpr := kernelRecRuleRhs% Tree.rec 0
+def treeNodeKernelRuleRhs : VExpr := kernelRecRuleRhs% Tree.rec 1
+def treeBranchKernelRuleRhs : VExpr := kernelRecRuleRhs% Tree.rec 2
+def treeListNilKernelRuleRhs : VExpr := kernelRecRuleRhs% TreeList.rec 0
+def treeListConsKernelRuleRhs : VExpr := kernelRecRuleRhs% TreeList.rec 1
+
+example : treeRecKernelConstant =
+    treeGeneration.recursors[0].toVConstant := rfl
+example : treeListRecKernelConstant =
+    treeGeneration.recursors[1].toVConstant := rfl
+example : treeLeafKernelRuleRhs = treeGeneration.generatedRules[0].rhs := rfl
+example : treeNodeKernelRuleRhs = treeGeneration.generatedRules[1].rhs := rfl
+example : treeBranchKernelRuleRhs = treeGeneration.generatedRules[2].rhs := rfl
+example : treeListNilKernelRuleRhs = treeGeneration.generatedRules[3].rhs := rfl
+example : treeListConsKernelRuleRhs = treeGeneration.generatedRules[4].rhs := rfl
+
+def treeKernelType : InductiveType where
+  name := treeKernelInfo.name
+  type := treeKernelInfo.type
+  ctors := [
+    ⟨treeLeafKernelInfo.name, treeLeafKernelInfo.type⟩,
+    ⟨treeNodeKernelInfo.name, treeNodeKernelInfo.type⟩,
+    ⟨treeBranchKernelInfo.name, treeBranchKernelInfo.type⟩]
+
+def treeListKernelType : InductiveType where
+  name := treeListKernelInfo.name
+  type := treeListKernelInfo.type
+  ctors := [
+    ⟨treeListNilKernelInfo.name, treeListNilKernelInfo.type⟩,
+    ⟨treeListConsKernelInfo.name, treeListConsKernelInfo.type⟩]
+
+def treeKernelTypes : List InductiveType :=
+  [treeKernelType, treeListKernelType]
+
+def treeKernelContext : AddInductive.Context where
+  env := Kernel.Environment.ofConstants `_mutualTree ({} : ConstMap)
+  lparams := [`u]
+  safety := .safe
+  allowPrimitive := false
+
+def treeExecutionResult :=
+  AddInductive.buildNormalizationCandidateExecution 1 treeKernelTypes 0 false
+    treeKernelContext
+
+theorem treeExecutionResult_isOk : treeExecutionResult.isOk = true := by
+  native_decide
+
+def treeProducedExecution :
+    { execution // treeExecutionResult = .ok execution } :=
+  match h : treeExecutionResult with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := treeExecutionResult_isOk
+      rw [h] at hOk
+      contradiction
+
+def treeExecution := treeProducedExecution.val
+
+def treeFamilyValidationResult :=
+  FamilyValidationBlockRun.buildExecution 1 treeKernelTypes treeKernelContext
+
+theorem treeFamilyValidationResult_isOk :
+    treeFamilyValidationResult.isOk = true := by
+  native_decide
+
+def treeProducedFamilyValidation :
+    { run // treeFamilyValidationResult = .ok run } :=
+  match h : treeFamilyValidationResult with
+  | .ok run => ⟨run, rfl⟩
+  | .error _ => by
+      have hOk := treeFamilyValidationResult_isOk
+      rw [h] at hOk
+      contradiction
+
+def treeFamilyValidation := treeProducedFamilyValidation.val
+
+def treeConstructorContext : AddInductive.Context :=
+  { treeExecution.validationContext with env := treeExecution.familyEnv }
+
+def treeConstructorValidationResult :=
+  ConstructorBlockValidationRun.buildExecution treeKernelTypes
+    treeExecution.stats false treeConstructorContext
+
+theorem treeConstructorValidationResult_isOk :
+    treeConstructorValidationResult.isOk = true := by
+  native_decide
+
+def treeProducedConstructorValidation :
+    { run // treeConstructorValidationResult = .ok run } :=
+  match h : treeConstructorValidationResult with
+  | .ok run => ⟨run, rfl⟩
+  | .error _ => by
+      have hOk := treeConstructorValidationResult_isOk
+      rw [h] at hOk
+      contradiction
+
+def treeConstructorValidation := treeProducedConstructorValidation.val
+
+/-- The real positivity traversal selects both sibling targets and records the
+one Pi binder above `Tree.branch`'s recursive occurrence. -/
+theorem treeConstructorTargets_exact :
+    treeConstructorValidation.traces.targets =
+      [
+        [[none],
+          [some { familyIdx := 1, binderDepth := 0 }],
+          [some { familyIdx := 1, binderDepth := 1 }]],
+        [[],
+          [some { familyIdx := 0, binderDepth := 0 },
+            some { familyIdx := 1, binderDepth := 0 }]]
+      ] := by
+  native_decide
+
+example : treeFamilyValidation.parameters.size = 1 :=
+  treeFamilyValidation.params_size
+
+example : treeFamilyValidation.result.stats.nindices = #[0, 0] := by
+  native_decide
+
+#guard AddInductive.levelStructEq treeFamilyValidation.resultLevel
+  (.succ (.param `u))
+
+#guard AddInductive.levelStructEq treeExecution.stats.resultLevel
+  (.succ (.param `u))
+
+def indexedTreeKernelInfo : ConstantInfo := kernelInductInfo% IndexedTree
+def indexedTreeListKernelInfo : ConstantInfo :=
+  kernelInductInfo% IndexedTreeList
+def indexedTreeLeafKernelInfo : ConstantInfo :=
+  kernelCtorInfo% IndexedTree.leaf
+def indexedTreeNodeKernelInfo : ConstantInfo :=
+  kernelCtorInfo% IndexedTree.node
+def indexedTreeListNilKernelInfo : ConstantInfo :=
+  kernelCtorInfo% IndexedTreeList.nil
+def indexedTreeListConsKernelInfo : ConstantInfo :=
+  kernelCtorInfo% IndexedTreeList.cons
+def indexedTreeRecKernelInfo : ConstantInfo :=
+  kernelRecInfo% IndexedTree.rec
+def indexedTreeListRecKernelInfo : ConstantInfo :=
+  kernelRecInfo% IndexedTreeList.rec
+def indexedTreeRecKernelConstant : VConstant :=
+  kernelRecConstant08C% IndexedTree.rec
+def indexedTreeListRecKernelConstant : VConstant :=
+  kernelRecConstant08C% IndexedTreeList.rec
+def indexedTreeLeafKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% IndexedTree.rec 0
+def indexedTreeNodeKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% IndexedTree.rec 1
+def indexedTreeListNilKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% IndexedTreeList.rec 0
+def indexedTreeListConsKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% IndexedTreeList.rec 1
+
+example : indexedTreeRecKernelConstant =
+    indexedTreeGeneration.recursors[0].toVConstant := rfl
+example : indexedTreeListRecKernelConstant =
+    indexedTreeGeneration.recursors[1].toVConstant := rfl
+example : indexedTreeLeafKernelRuleRhs =
+    indexedTreeGeneration.generatedRules[0].rhs := rfl
+example : indexedTreeNodeKernelRuleRhs =
+    indexedTreeGeneration.generatedRules[1].rhs := rfl
+example : indexedTreeListNilKernelRuleRhs =
+    indexedTreeGeneration.generatedRules[2].rhs := rfl
+example : indexedTreeListConsKernelRuleRhs =
+    indexedTreeGeneration.generatedRules[3].rhs := rfl
+
+/-- Complete kernel/Theory metadata row for the unindexed mutual block. -/
+def treeKernelBlockRow : MutualKernelBlockRow where
+  source := treeDecl
+  generation := treeGeneration
+  inductInfos := [treeKernelInfo, treeListKernelInfo]
+  ctorInfos := [
+    [treeLeafKernelInfo, treeNodeKernelInfo, treeBranchKernelInfo],
+    [treeListNilKernelInfo, treeListConsKernelInfo]]
+  recInfos := [treeRecKernelInfo, treeListRecKernelInfo]
+  familyTypes := [kernelConstVType08C% Tree,
+    kernelConstVType08C% TreeList]
+  ctorTypes := [
+    [kernelConstVType08C% Tree.leaf, kernelConstVType08C% Tree.node,
+      kernelConstVType08C% Tree.branch],
+    [kernelConstVType08C% TreeList.nil,
+      kernelConstVType08C% TreeList.cons]]
+  recTypes := [kernelConstVType08C% Tree.rec,
+    kernelConstVType08C% TreeList.rec]
+  ruleRhs := [
+    [treeLeafKernelRuleRhs, treeNodeKernelRuleRhs,
+      treeBranchKernelRuleRhs],
+    [treeListNilKernelRuleRhs, treeListConsKernelRuleRhs]]
+
+#guard treeKernelBlockRow.agrees
+
+/-- Complete kernel/Theory metadata row for the indexed mutual block. -/
+def indexedTreeKernelBlockRow : MutualKernelBlockRow where
+  source := indexedTreeDecl
+  generation := indexedTreeGeneration
+  inductInfos := [indexedTreeKernelInfo, indexedTreeListKernelInfo]
+  ctorInfos := [
+    [indexedTreeLeafKernelInfo, indexedTreeNodeKernelInfo],
+    [indexedTreeListNilKernelInfo, indexedTreeListConsKernelInfo]]
+  recInfos := [indexedTreeRecKernelInfo, indexedTreeListRecKernelInfo]
+  familyTypes := [kernelConstVType08C% IndexedTree,
+    kernelConstVType08C% IndexedTreeList]
+  ctorTypes := [
+    [kernelConstVType08C% IndexedTree.leaf,
+      kernelConstVType08C% IndexedTree.node],
+    [kernelConstVType08C% IndexedTreeList.nil,
+      kernelConstVType08C% IndexedTreeList.cons]]
+  recTypes := [kernelConstVType08C% IndexedTree.rec,
+    kernelConstVType08C% IndexedTreeList.rec]
+  ruleRhs := [
+    [indexedTreeLeafKernelRuleRhs, indexedTreeNodeKernelRuleRhs],
+    [indexedTreeListNilKernelRuleRhs, indexedTreeListConsKernelRuleRhs]]
+
+#guard indexedTreeKernelBlockRow.agrees
+
+def indexedTreeKernelType : InductiveType where
+  name := indexedTreeKernelInfo.name
+  type := indexedTreeKernelInfo.type
+  ctors := [
+    ⟨indexedTreeLeafKernelInfo.name, indexedTreeLeafKernelInfo.type⟩,
+    ⟨indexedTreeNodeKernelInfo.name, indexedTreeNodeKernelInfo.type⟩]
+
+def indexedTreeListKernelType : InductiveType where
+  name := indexedTreeListKernelInfo.name
+  type := indexedTreeListKernelInfo.type
+  ctors := [
+    ⟨indexedTreeListNilKernelInfo.name, indexedTreeListNilKernelInfo.type⟩,
+    ⟨indexedTreeListConsKernelInfo.name, indexedTreeListConsKernelInfo.type⟩]
+
+def indexedTreeKernelTypes : List InductiveType :=
+  [indexedTreeKernelType, indexedTreeListKernelType]
+
+def indexedTreeKernelContext : AddInductive.Context where
+  env := Kernel.Environment.ofConstants `_mutualIndexedTree natMap
+  lparams := [`u]
+  safety := .safe
+  allowPrimitive := false
+
+def indexedTreeExecutionResult :=
+  AddInductive.buildNormalizationCandidateExecution 1 indexedTreeKernelTypes
+    0 false indexedTreeKernelContext
+
+theorem indexedTreeExecutionResult_isOk :
+    indexedTreeExecutionResult.isOk = true := by
+  native_decide
+
+def indexedTreeProducedExecution :
+    { execution // indexedTreeExecutionResult = .ok execution } :=
+  match h : indexedTreeExecutionResult with
+  | .ok execution => ⟨execution, rfl⟩
+  | .error _ => by
+      have hOk := indexedTreeExecutionResult_isOk
+      rw [h] at hOk
+      contradiction
+
+def indexedTreeExecution := indexedTreeProducedExecution.val
+
+def indexedTreeFamilyValidationResult :=
+  FamilyValidationBlockRun.buildExecution 1 indexedTreeKernelTypes
+    indexedTreeKernelContext
+
+theorem indexedTreeFamilyValidationResult_isOk :
+    indexedTreeFamilyValidationResult.isOk = true := by
+  native_decide
+
+def indexedTreeProducedFamilyValidation :
+    { run // indexedTreeFamilyValidationResult = .ok run } :=
+  match h : indexedTreeFamilyValidationResult with
+  | .ok run => ⟨run, rfl⟩
+  | .error _ => by
+      have hOk := indexedTreeFamilyValidationResult_isOk
+      rw [h] at hOk
+      contradiction
+
+def indexedTreeFamilyValidation := indexedTreeProducedFamilyValidation.val
+
+def indexedTreeConstructorContext : AddInductive.Context :=
+  { indexedTreeExecution.validationContext with
+    env := indexedTreeExecution.familyEnv }
+
+def indexedTreeConstructorValidationResult :=
+  ConstructorBlockValidationRun.buildExecution indexedTreeKernelTypes
+    indexedTreeExecution.stats false indexedTreeConstructorContext
+
+theorem indexedTreeConstructorValidationResult_isOk :
+    indexedTreeConstructorValidationResult.isOk = true := by
+  native_decide
+
+def indexedTreeProducedConstructorValidation :
+    { run // indexedTreeConstructorValidationResult = .ok run } :=
+  match h : indexedTreeConstructorValidationResult with
+  | .ok run => ⟨run, rfl⟩
+  | .error _ => by
+      have hOk := indexedTreeConstructorValidationResult_isOk
+      rw [h] at hOk
+      contradiction
+
+def indexedTreeConstructorValidation :=
+  indexedTreeProducedConstructorValidation.val
+
+/-- Indexed recursive fields retain sibling ordinals after the ordinary Nat
+binder, while nonrecursive fields occupy explicit `none` slots. -/
+theorem indexedTreeConstructorTargets_exact :
+    indexedTreeConstructorValidation.traces.targets =
+      [
+        [[none],
+          [none, some { familyIdx := 1, binderDepth := 0 }]],
+        [[],
+          [none,
+            some { familyIdx := 0, binderDepth := 0 },
+            some { familyIdx := 1, binderDepth := 0 }]]
+      ] := by
+  native_decide
+
+example : indexedTreeFamilyValidation.parameters.size = 1 :=
+  indexedTreeFamilyValidation.params_size
+
+example : indexedTreeFamilyValidation.result.stats.nindices = #[1, 1] := by
+  native_decide
+
+#guard AddInductive.levelStructEq indexedTreeFamilyValidation.resultLevel
+  (.succ (.param `u))
+
+/-! ## Phase-specific failures -/
+
+def treeParameterMismatchType : InductiveType :=
+  { treeListKernelType with
+    type := .forallE `α (.sort .zero) (.sort (.succ (.param `u))) .default }
+
+#guard match observeFamilyValidationBlock 1
+    [treeKernelType, treeParameterMismatchType] treeKernelContext with
+  | .error (.other message) =>
+      message == "parameters of all inductive datatypes must match"
+  | _ => false
+
+def treeResultUniverseMismatchType : InductiveType :=
+  { treeListKernelType with
+    type := .forallE `α (.sort (.succ (.param `u))) (.sort .zero) .default }
+
+#guard match observeFamilyValidationBlock 1
+    [treeKernelType, treeResultUniverseMismatchType] treeKernelContext with
+  | .error (.other message) =>
+      message == "mutually inductive types must live in the same universe"
+  | _ => false
+
+/-- Reusing the original family statistics after swapping source owners
+reaches constructor validation and fails at the first now-misowned return. -/
+def treeReorderedConstructorResult :=
+  checkConstructors #[treeListKernelType, treeKernelType]
+    treeExecution.stats false treeConstructorContext
+
+#guard match treeReorderedConstructorResult with
+  | .error (.other message) =>
+      message ==
+        "invalid return type for 'Ix.Theory.Named.MutualInductiveFixtures.TreeList.nil'"
+  | _ => false
+
+def treeReorderedView : VInductDecl :=
+  { treeDecl with types := [treeListType, treeType] }
+
+/- Raw/view normalization rejects family reordering before semantic evidence
+can be attached to the dependent candidate list. -/
+#guard (normalization? treeDecl treeReorderedView).isNone
+
+/-! The host elaborator diagnostics independently pin the corresponding
+family-validation phases in Lean itself. -/
+
+namespace KernelPhases
+
+universe v
+
+/--
+error: Invalid mutually inductive types: Parameter `α` has type
+  Prop
+of sort `Type` but is expected to have type
+  Type v
+of sort `Type (v + 1)`
+-/
+#guard_msgs (whitespace := lax) in
+mutual
+inductive ParamA (α : Type v) : Type v
+inductive ParamB (α : Prop) : Type v
+end
+
+/--
+error: Invalid mutually inductive types: The resulting type of this declaration
+  Prop
+differs from a preceding one
+  Type v
+
+Note: All inductive types declared in the same `mutual` block must belong to the same type universe
+-/
+#guard_msgs (whitespace := lax) in
+mutual
+inductive UniverseA (α : Type v) : Type v
+inductive UniverseB (α : Type v) : Prop
+end
+
+end KernelPhases
+
+/-! ## Tree/TreeList Theory semantics -/
+
+def treeBlockEnv : VEnv :=
+  (VEnv.empty.stageInductiveTypes treeDecl.types).get!
+
+theorem treeStage :
+    VEnv.empty.stageInductiveTypes treeDecl.types = some treeBlockEnv := by
+  rfl
+
+theorem empty_le_treeBlockEnv : VEnv.empty ≤ treeBlockEnv where
+  constants h := by simp [VEnv.empty] at h
+  defeqs h := h.elim
+  structEtas h := h.elim
+
+theorem treeFamilyTypeWF (type : VInductiveType)
+    (h : type = treeType ∨ type = treeListType) :
+    type.type.WF VEnv.empty type.uvars [] := by
+  rcases h with rfl | rfl <;>
+    refine ⟨.sort (.imax (.succ (.succ (.param 0)))
+      (.succ (.succ (.param 0)))), VEnv.HasType.forallE ?_ ?_⟩ <;>
+    exact VEnv.HasType.sort (by decide)
+
+theorem treeCtorWF (ctor : VConstVal)
+    (h : ctor ∈ treeType.ctors ∨ ctor ∈ treeListType.ctors) :
+    ctor.type.WF treeBlockEnv 1 [] := by
+  have hTree : treeBlockEnv.constants ``Tree =
+      some treeType.toVConstant := by rfl
+  have hTreeList : treeBlockEnv.constants ``TreeList =
+      some treeListType.toVConstant := by rfl
+  rcases h with h | h
+  · simp [treeType] at h
+    rcases h with (rfl | rfl | rfl)
+    · exact ⟨_, by type_tac⟩
+    · exact ⟨_, by type_tac⟩
+    · exact ⟨_, by type_tac⟩
+  · simp [treeListType] at h
+    rcases h with (rfl | rfl)
+    · exact ⟨_, by type_tac⟩
+    · exact ⟨_, by type_tac⟩
+
+theorem treeNormalizationBlockWF :
+    (Normalization.identity treeDecl).BlockWF VEnv.empty treeBlockEnv := by
+  refine ⟨treeStage, ?_⟩
+  change List.Forall₂ _ [treeType, treeListType] [treeType, treeListType]
+  apply List.Forall₂.cons
+  · refine ⟨?_, ?_⟩
+    · exact VEnv.IsDefEqU.refl (treeFamilyTypeWF treeType (.inl rfl))
+    · apply List.Forall₂.rfl
+      intro ctor h
+      exact VEnv.IsDefEqU.refl (treeCtorWF ctor (.inl h))
+  · apply List.Forall₂.cons
+    · refine ⟨?_, ?_⟩
+      · exact VEnv.IsDefEqU.refl (treeFamilyTypeWF treeListType (.inr rfl))
+      · apply List.Forall₂.rfl
+        intro ctor h
+        exact VEnv.IsDefEqU.refl (treeCtorWF ctor (.inr h))
+    · exact .nil
+
+theorem treeLeafSemantic :
+    let constructor := CheckedCtor.ofBlock treeDecl treeType.ctors[0]
+    checkedBlockFieldsWF VEnv.empty 1 (.succ (.param 0)) [[], []]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      VEnv.empty.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN (VExpr.liftTelN constructor.fields.length [] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[0]).fields =
+      [.bvar 0] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[0]).recursiveAt =
+      [none] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[0]).resultIndices =
+      [] by rfl]
+  exact ⟨⟨⟨.succ (.param 0), .bvar .zero,
+    .inr (VLevel.le_refl _)⟩, trivial⟩, .nil⟩
+
+theorem treeNodeSemantic :
+    let constructor := CheckedCtor.ofBlock treeDecl treeType.ctors[1]
+    checkedBlockFieldsWF VEnv.empty 1 (.succ (.param 0)) [[], []]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      VEnv.empty.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN (VExpr.liftTelN constructor.fields.length [] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[1]).fields =
+      [.app (.const ``TreeList [.param 0]) (.bvar 0)] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[1]).recursiveAt =
+      [some ({
+        fieldIndex := 0
+        binders := []
+        targetType := 1
+        indices := [] } : RecArg)] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[1]).resultIndices =
+      [] by rfl]
+  exact ⟨⟨⟨rfl, trivial, .nil⟩, trivial⟩, .nil⟩
+
+theorem treeBranchSemantic :
+    let constructor := CheckedCtor.ofBlock treeDecl treeType.ctors[2]
+    checkedBlockFieldsWF VEnv.empty 1 (.succ (.param 0)) [[], []]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      VEnv.empty.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN (VExpr.liftTelN constructor.fields.length [] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[2]).fields =
+      [.forallE (.bvar 0)
+        (.app (.const ``TreeList [.param 0]) (.bvar 1))] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[2]).recursiveAt =
+      [some ({
+        fieldIndex := 0
+        binders := [.bvar 0]
+        targetType := 1
+        indices := [] } : RecArg)] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeType.ctors[2]).resultIndices =
+      [] by rfl]
+  exact ⟨
+    ⟨⟨rfl, ⟨⟨⟨.succ (.param 0), .bvar .zero⟩, trivial⟩, .nil⟩⟩,
+      trivial⟩,
+    .nil⟩
+
+theorem treeListNilSemantic :
+    let constructor := CheckedCtor.ofBlock treeDecl treeListType.ctors[0]
+    checkedBlockFieldsWF VEnv.empty 1 (.succ (.param 0)) [[], []]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      VEnv.empty.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN (VExpr.liftTelN constructor.fields.length [] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock treeDecl treeListType.ctors[0]).fields =
+      [] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeListType.ctors[0]).recursiveAt =
+      [] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeListType.ctors[0]).resultIndices =
+      [] by rfl]
+  exact ⟨trivial, .nil⟩
+
+theorem treeListConsSemantic :
+    let constructor := CheckedCtor.ofBlock treeDecl treeListType.ctors[1]
+    checkedBlockFieldsWF VEnv.empty 1 (.succ (.param 0)) [[], []]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      VEnv.empty.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN (VExpr.liftTelN constructor.fields.length [] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock treeDecl treeListType.ctors[1]).fields =
+      [.app (.const ``Tree [.param 0]) (.bvar 0),
+        .app (.const ``TreeList [.param 0]) (.bvar 1)] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeListType.ctors[1]).recursiveAt =
+      [some ({
+          fieldIndex := 0
+          binders := []
+          targetType := 0
+          indices := [] } : RecArg),
+        some ({
+          fieldIndex := 1
+          binders := []
+          targetType := 1
+          indices := [] } : RecArg)] by rfl]
+  rw [show (CheckedCtor.ofBlock treeDecl treeListType.ctors[1]).resultIndices =
+      [] by rfl]
+  exact ⟨
+    ⟨⟨rfl, trivial, .nil⟩,
+      ⟨⟨rfl, trivial, .nil⟩, trivial⟩⟩,
+    .nil⟩
+
+theorem treeCheckedBlockWF :
+    treeChecked.WF VEnv.empty (.succ (.param 0)) := by
+  have hparams : treeChecked.params =
+      [.sort (.succ (.param 0))] := rfl
+  have hindices : treeChecked.families.indices = [[], []] := rfl
+  have hlevels : treeChecked.families.resultLevels =
+      [.succ (.param 0), .succ (.param 0)] := rfl
+  have hconstructors : treeChecked.families.constructors =
+      [treeType.ctors.map (CheckedCtor.ofBlock treeDecl),
+        treeListType.ctors.map (CheckedCtor.ofBlock treeDecl)] := rfl
+  rw [CheckedBlock.WF, hindices, hlevels, hconstructors]
+  rw [hparams]
+  simp only [checkedFamilyListsWF]
+  refine ⟨rfl, ?_, ?_, rfl, ?_, ?_⟩
+  · exact ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+  · intro ctor h
+    simp [treeType] at h
+    rcases h with rfl | rfl | rfl
+    · exact treeLeafSemantic
+    · exact treeNodeSemantic
+    · exact treeBranchSemantic
+  · exact ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+  · refine ⟨?_, trivial⟩
+    intro ctor h
+    simp [treeListType] at h
+    rcases h with rfl | rfl
+    · exact treeListNilSemantic
+    · exact treeListConsSemantic
+
+def treeNormalizedBlock : NormalizedCheckedBlock treeDecl where
+  normalization := Normalization.identity treeDecl
+  checked := treeChecked
+  checked_eq := (Option.some_get (x := treeDecl.checkedBlock?)
+    (by decide)).symm
+
+def treeValidatedBlock : ValidatedBlock treeDecl where
+  block := treeNormalizedBlock
+  resultLevel := .succ (.param 0)
+
+/-- Exact validation-only semantic package for the unindexed mutual block. -/
+def treeValidationCertificate : ValidationCertificate treeDecl VEnv.empty where
+  validated := treeValidatedBlock
+  blockEnv := treeBlockEnv
+  wf := ⟨treeNormalizationBlockWF, treeCheckedBlockWF⟩
+
+/-! ## IndexedTree/IndexedTreeList Theory semantics -/
+
+def indexedTreeBlockEnv : VEnv :=
+  (natFinalEnv.stageInductiveTypes indexedTreeDecl.types).get!
+
+theorem indexedTreeStage :
+    natFinalEnv.stageInductiveTypes indexedTreeDecl.types =
+      some indexedTreeBlockEnv := by
+  rfl
+
+theorem indexedTreeFamilyTypeWF (type : VInductiveType)
+    (h : type = indexedTreeType ∨ type = indexedTreeListType) :
+    type.type.WF natFinalEnv type.uvars [] := by
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  rcases h with rfl | rfl <;>
+    exact ⟨_, by type_tac⟩
+
+theorem indexedTreeCtorWF (ctor : VConstVal)
+    (h : ctor ∈ indexedTreeType.ctors ∨
+      ctor ∈ indexedTreeListType.ctors) :
+    ctor.type.WF indexedTreeBlockEnv 1 [] := by
+  have hNat : indexedTreeBlockEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := by rfl
+  have hZero : indexedTreeBlockEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := by rfl
+  have hSucc : indexedTreeBlockEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := by rfl
+  have hTree : indexedTreeBlockEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := by rfl
+  have hTreeList : indexedTreeBlockEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := by rfl
+  rcases h with h | h
+  · simp [indexedTreeType] at h
+    rcases h with (rfl | rfl)
+    · exact ⟨_, by type_tac⟩
+    · exact ⟨_, by type_tac⟩
+  · simp [indexedTreeListType] at h
+    rcases h with (rfl | rfl)
+    · exact ⟨_, by type_tac⟩
+    · exact ⟨_, by type_tac⟩
+
+theorem indexedTreeNormalizationBlockWF :
+    (Normalization.identity indexedTreeDecl).BlockWF
+      natFinalEnv indexedTreeBlockEnv := by
+  refine ⟨indexedTreeStage, ?_⟩
+  change List.Forall₂ _ [indexedTreeType, indexedTreeListType]
+    [indexedTreeType, indexedTreeListType]
+  apply List.Forall₂.cons
+  · refine ⟨?_, ?_⟩
+    · exact VEnv.IsDefEqU.refl
+        (indexedTreeFamilyTypeWF indexedTreeType (.inl rfl))
+    · apply List.Forall₂.rfl
+      intro ctor h
+      exact VEnv.IsDefEqU.refl (indexedTreeCtorWF ctor (.inl h))
+  · apply List.Forall₂.cons
+    · refine ⟨?_, ?_⟩
+      · exact VEnv.IsDefEqU.refl
+          (indexedTreeFamilyTypeWF indexedTreeListType (.inr rfl))
+      · apply List.Forall₂.rfl
+        intro ctor h
+        exact VEnv.IsDefEqU.refl (indexedTreeCtorWF ctor (.inr h))
+    · exact .nil
+
+theorem indexedTreeLeafSemantic :
+    let constructor := CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[0]
+    checkedBlockFieldsWF natFinalEnv 1 (.succ (.param 0))
+        [[.const ``Nat []], [.const ``Nat []]]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      natFinalEnv.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN
+          (VExpr.liftTelN constructor.fields.length [.const ``Nat []] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[0]).fields = [.bvar 0] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[0]).recursiveAt = [none] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[0]).resultIndices = [.const ``Nat.zero []] by rfl]
+  constructor
+  · exact ⟨⟨.succ (.param 0), .bvar .zero,
+      .inr (VLevel.le_refl _)⟩, trivial⟩
+  · have hNat : natFinalEnv.constants ``Nat =
+        some InductiveFixtures.natType.toVConstant := rfl
+    have hZero : natFinalEnv.constants ``Nat.zero =
+        some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+    exact .cons (by type_tac) .nil
+
+theorem indexedTreeNodeSemantic :
+    let constructor := CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[1]
+    checkedBlockFieldsWF natFinalEnv 1 (.succ (.param 0))
+        [[.const ``Nat []], [.const ``Nat []]]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      natFinalEnv.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN
+          (VExpr.liftTelN constructor.fields.length [.const ``Nat []] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[1]).fields =
+        [.const ``Nat [],
+          (VExpr.const ``IndexedTreeList [.param 0]).app (.bvar 1)
+            |>.app (.bvar 0)] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[1]).recursiveAt =
+        [none, some ({
+          fieldIndex := 1
+          binders := []
+          targetType := 1
+          indices := [.bvar 0] } : RecArg)] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeType.ctors[1]).resultIndices =
+        [(VExpr.const ``Nat.succ []).app (.bvar 1)] by rfl]
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hSucc : natFinalEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  refine ⟨?_, ?_⟩
+  · refine ⟨⟨.succ .zero, (by type_tac),
+        .inr (VLevel.succ_le_succ VLevel.zero_le)⟩, ?_⟩
+    exact ⟨⟨rfl, trivial, .cons (by type_tac) .nil⟩, trivial⟩
+  · exact .cons (by type_tac) .nil
+
+theorem indexedTreeListNilSemantic :
+    let constructor := CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[0]
+    checkedBlockFieldsWF natFinalEnv 1 (.succ (.param 0))
+        [[.const ``Nat []], [.const ``Nat []]]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      natFinalEnv.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN
+          (VExpr.liftTelN constructor.fields.length [.const ``Nat []] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[0]).fields = [] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[0]).recursiveAt = [] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[0]).resultIndices =
+        [.const ``Nat.zero []] by rfl]
+  refine ⟨trivial, ?_⟩
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : natFinalEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  exact .cons (by type_tac) .nil
+
+theorem indexedTreeListConsSemantic :
+    let constructor := CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[1]
+    checkedBlockFieldsWF natFinalEnv 1 (.succ (.param 0))
+        [[.const ``Nat []], [.const ``Nat []]]
+        constructor.fields constructor.recursiveAt
+        [.sort (.succ (.param 0))] 0 ∧
+      natFinalEnv.SpineWF 1
+        (constructor.fields.reverse ++ [.sort (.succ (.param 0))])
+        (VExpr.forallN
+          (VExpr.liftTelN constructor.fields.length [.const ``Nat []] 0)
+          (.sort (.succ (.param 0))))
+        constructor.resultIndices (.sort (.succ (.param 0))) := by
+  dsimp only
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[1]).fields =
+        [.const ``Nat [],
+          (VExpr.const ``IndexedTree [.param 0]).app (.bvar 1)
+            |>.app (.bvar 0),
+          (VExpr.const ``IndexedTreeList [.param 0]).app (.bvar 2)
+            |>.app (.bvar 1)] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[1]).recursiveAt =
+        [none,
+          some ({
+            fieldIndex := 1
+            binders := []
+            targetType := 0
+            indices := [.bvar 0] } : RecArg),
+          some ({
+            fieldIndex := 2
+            binders := []
+            targetType := 1
+            indices := [.bvar 1] } : RecArg)] by rfl]
+  rw [show (CheckedCtor.ofBlock indexedTreeDecl
+      indexedTreeListType.ctors[1]).resultIndices =
+        [(VExpr.const ``Nat.succ []).app (.bvar 2)] by rfl]
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hSucc : natFinalEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  refine ⟨?_, ?_⟩
+  · refine ⟨⟨.succ .zero, (by type_tac),
+        .inr (VLevel.succ_le_succ VLevel.zero_le)⟩, ?_⟩
+    refine ⟨⟨rfl, trivial, .cons (by type_tac) .nil⟩, ?_⟩
+    exact ⟨⟨rfl, trivial, .cons (by type_tac) .nil⟩, trivial⟩
+  · exact .cons (by type_tac) .nil
+
+theorem indexedTreeCheckedBlockWF :
+    indexedTreeChecked.WF natFinalEnv (.succ (.param 0)) := by
+  have hparams : indexedTreeChecked.params =
+      [.sort (.succ (.param 0))] := rfl
+  have hindices : indexedTreeChecked.families.indices =
+      [[.const ``Nat []], [.const ``Nat []]] := rfl
+  have hlevels : indexedTreeChecked.families.resultLevels =
+      [.succ (.param 0), .succ (.param 0)] := rfl
+  have hconstructors : indexedTreeChecked.families.constructors =
+      [indexedTreeType.ctors.map (CheckedCtor.ofBlock indexedTreeDecl),
+        indexedTreeListType.ctors.map
+          (CheckedCtor.ofBlock indexedTreeDecl)] := rfl
+  rw [CheckedBlock.WF, hindices, hlevels, hconstructors]
+  rw [hparams]
+  simp only [checkedFamilyListsWF]
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  refine ⟨rfl, ?_, ?_, rfl, ?_, ?_⟩
+  · exact ⟨⟨_, VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨_, (by type_tac)⟩, trivial⟩⟩
+  · intro ctor h
+    simp [indexedTreeType] at h
+    rcases h with rfl | rfl
+    · exact indexedTreeLeafSemantic
+    · exact indexedTreeNodeSemantic
+  · exact ⟨⟨_, VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨_, (by type_tac)⟩, trivial⟩⟩
+  · refine ⟨?_, trivial⟩
+    intro ctor h
+    simp [indexedTreeListType] at h
+    rcases h with rfl | rfl
+    · exact indexedTreeListNilSemantic
+    · exact indexedTreeListConsSemantic
+
+def indexedTreeNormalizedBlock : NormalizedCheckedBlock indexedTreeDecl where
+  normalization := Normalization.identity indexedTreeDecl
+  checked := indexedTreeChecked
+  checked_eq := (Option.some_get (x := indexedTreeDecl.checkedBlock?)
+    (by decide)).symm
+
+def indexedTreeValidatedBlock : ValidatedBlock indexedTreeDecl where
+  block := indexedTreeNormalizedBlock
+  resultLevel := .succ (.param 0)
+
+/-- Exact validation-only semantic package for the indexed mutual block. -/
+def indexedTreeValidationCertificate :
+    ValidationCertificate indexedTreeDecl natFinalEnv where
+  validated := indexedTreeValidatedBlock
+  blockEnv := indexedTreeBlockEnv
+  wf := ⟨indexedTreeNormalizationBlockWF, indexedTreeCheckedBlockWF⟩
+
+/-! ## Certified block-generation semantics -/
+
+theorem treeLeafGenerationWF :
+    NormalizedBlockCtor.WF treeGeneration treeGeneration.flatCtors[0]
+      treeBlockEnv := by
+  refine {
+    declaredTel := ?_
+    declaredResult := ?_
+    emittedTel := ?_
+    emittedResult := ?_
+    owner := ?_
+    recursive := ?_
+    resultSpine := ?_ }
+  · change treeBlockEnv.TelDefEq 1 []
+      [.sort (.succ (.param 0)), .bvar 0]
+      [.sort (.succ (.param 0)), .bvar 0]
+    exact (show treeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .bvar 0] from by
+        refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+        exact ⟨⟨_, by type_tac⟩, trivial⟩).telDefEq_refl
+  · change treeBlockEnv.IsDefEq 1
+      [.bvar 0, .sort (.succ (.param 0))]
+      (.app (.const ``Tree [.param 0]) (.bvar 1))
+      (.app (.const ``Tree [.param 0]) (.bvar 1))
+      (.sort (.succ (.param 0)))
+    have hTree : treeBlockEnv.constants ``Tree =
+        some treeType.toVConstant := rfl
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar (.succ .zero)
+  · change treeBlockEnv.TelDefEq 1 []
+      [.sort (.succ (.param 0)), .bvar 0]
+      [.sort (.succ (.param 0)), .bvar 0]
+    exact (show treeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .bvar 0] from by
+        refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+        exact ⟨⟨_, by type_tac⟩, trivial⟩).telDefEq_refl
+  · change treeBlockEnv.IsDefEq 1
+      [.bvar 0, .sort (.succ (.param 0))]
+      (.app (.const ``Tree [.param 0]) (.bvar 1))
+      (.app (.const ``Tree [.param 0]) (.bvar 1))
+      (.sort (.succ (.param 0)))
+    have hTree : treeBlockEnv.constants ``Tree =
+        some treeType.toVConstant := rfl
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar (.succ .zero)
+  · refine ⟨treeGeneration.families[0], ?_, rfl, rfl, rfl⟩
+    exact .head _
+  · intro recursive hrecursive
+    change recursive ∈ [] at hrecursive
+    nomatch hrecursive
+  · exact treeLeafSemantic.2.mono empty_le_treeBlockEnv
+
+theorem treeNodeGenerationWF :
+    NormalizedBlockCtor.WF treeGeneration treeGeneration.flatCtors[1]
+      treeBlockEnv := by
+  have hTree : treeBlockEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeBlockEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  have hbinders : treeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)),
+        .app (.const ``TreeList [.param 0]) (.bvar 0)] := by
+    refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+    refine ⟨⟨.succ (.param 0), ?_⟩, trivial⟩
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar .zero
+  have hresult : treeBlockEnv.HasType 1
+      [.app (.const ``TreeList [.param 0]) (.bvar 0),
+        .sort (.succ (.param 0))]
+      (.app (.const ``Tree [.param 0]) (.bvar 1))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar (.succ .zero)
+  refine {
+    declaredTel := ?_
+    declaredResult := ?_
+    emittedTel := ?_
+    emittedResult := ?_
+    owner := ?_
+    recursive := ?_
+    resultSpine := ?_ }
+  · exact hbinders.telDefEq_refl
+  · exact hresult
+  · exact hbinders.telDefEq_refl
+  · exact hresult
+  · refine ⟨treeGeneration.families[0], ?_, rfl, rfl, rfl⟩
+    exact .head _
+  · intro recursive hrecursive
+    change recursive ∈ [{
+      fieldIndex := 0
+      binders := []
+      targetType := 1
+      indices := [] }] at hrecursive
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursive
+    subst recursive
+    refine ⟨treeGeneration.families[1], ?_, rfl, ?_, ?_⟩
+    · exact .tail _ (.head _)
+    · exact ⟨.app (.const ``TreeList [.param 0]) (.bvar 0), rfl, rfl⟩
+    · exact ⟨trivial, .nil⟩
+  · exact treeNodeSemantic.2.mono empty_le_treeBlockEnv
+
+theorem treeBranchGenerationWF :
+    NormalizedBlockCtor.WF treeGeneration treeGeneration.flatCtors[2]
+      treeBlockEnv := by
+  have hTree : treeBlockEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeBlockEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  have hbinders : treeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)),
+        .forallE (.bvar 0)
+          (.app (.const ``TreeList [.param 0]) (.bvar 1))] := by
+    refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+    refine ⟨⟨.imax (.succ (.param 0)) (.succ (.param 0)), ?_⟩,
+      trivial⟩
+    apply VEnv.HasType.forallE
+    · exact VEnv.HasType.bvar .zero
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .sort (.succ (.param 0)))
+      · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar (.succ .zero)
+  have hresult : treeBlockEnv.HasType 1
+      [.forallE (.bvar 0)
+          (.app (.const ``TreeList [.param 0]) (.bvar 1)),
+        .sort (.succ (.param 0))]
+      (.app (.const ``Tree [.param 0]) (.bvar 1))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar (.succ .zero)
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := treeBranchSemantic.2.mono empty_le_treeBlockEnv }
+  · refine ⟨treeGeneration.families[0], ?_, rfl, rfl, rfl⟩
+    exact .head _
+  · intro recursive hrecursive
+    change recursive ∈ [{
+      fieldIndex := 0
+      binders := [.bvar 0]
+      targetType := 1
+      indices := [] }] at hrecursive
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursive
+    subst recursive
+    refine ⟨treeGeneration.families[1], ?_, rfl, ?_, ?_⟩
+    · exact .tail _ (.head _)
+    · exact ⟨.forallE (.bvar 0)
+        (.app (.const ``TreeList [.param 0]) (.bvar 1)), rfl, rfl⟩
+    · exact ⟨⟨⟨_, VEnv.HasType.bvar .zero⟩, trivial⟩, .nil⟩
+
+theorem treeListNilGenerationWF :
+    NormalizedBlockCtor.WF treeGeneration treeGeneration.flatCtors[3]
+      treeBlockEnv := by
+  have hTreeList : treeBlockEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  have hbinders : treeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0))] :=
+    ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+  have hresult : treeBlockEnv.HasType 1
+      [.sort (.succ (.param 0))]
+      (.app (.const ``TreeList [.param 0]) (.bvar 0))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar .zero
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := treeListNilSemantic.2.mono empty_le_treeBlockEnv }
+  · refine ⟨treeGeneration.families[1], ?_, rfl, rfl, rfl⟩
+    exact .tail _ (.head _)
+  · intro recursive hrecursive
+    change recursive ∈ [] at hrecursive
+    nomatch hrecursive
+
+theorem treeListConsGenerationWF :
+    NormalizedBlockCtor.WF treeGeneration treeGeneration.flatCtors[4]
+      treeBlockEnv := by
+  have hTree : treeBlockEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeBlockEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  have hbinders : treeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)),
+        .app (.const ``Tree [.param 0]) (.bvar 0),
+        .app (.const ``TreeList [.param 0]) (.bvar 1)] := by
+    refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+    refine ⟨⟨.succ (.param 0), ?_⟩, ?_⟩
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .sort (.succ (.param 0)))
+      · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar .zero
+    · refine ⟨⟨.succ (.param 0), ?_⟩, trivial⟩
+      apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .sort (.succ (.param 0)))
+      · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar (.succ .zero)
+  have hresult : treeBlockEnv.HasType 1
+      [.app (.const ``TreeList [.param 0]) (.bvar 1),
+        .app (.const ``Tree [.param 0]) (.bvar 0),
+        .sort (.succ (.param 0))]
+      (.app (.const ``TreeList [.param 0]) (.bvar 2))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .sort (.succ (.param 0)))
+      (B := .sort (.succ (.param 0)))
+    · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+    · exact VEnv.HasType.bvar (.succ (.succ .zero))
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := treeListConsSemantic.2.mono empty_le_treeBlockEnv }
+  · refine ⟨treeGeneration.families[1], ?_, rfl, rfl, rfl⟩
+    exact .tail _ (.head _)
+  · intro recursive hrecursive
+    change recursive ∈ [{
+      fieldIndex := 0
+      binders := []
+      targetType := 0
+      indices := [] }, {
+      fieldIndex := 1
+      binders := []
+      targetType := 1
+      indices := [] }] at hrecursive
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursive
+    rcases hrecursive with rfl | rfl
+    · refine ⟨treeGeneration.families[0], ?_, rfl, ?_, ?_⟩
+      · exact .head _
+      · exact ⟨.app (.const ``Tree [.param 0]) (.bvar 0), rfl, rfl⟩
+      · exact ⟨trivial, .nil⟩
+    · refine ⟨treeGeneration.families[1], ?_, rfl, ?_, ?_⟩
+      · exact .tail _ (.head _)
+      · exact ⟨.app (.const ``TreeList [.param 0]) (.bvar 1), rfl, rfl⟩
+      · exact ⟨trivial, .nil⟩
+
+theorem treeBlockGenerationWF :
+    treeGeneration.WF VEnv.empty treeBlockEnv := by
+  refine {
+    blockWF := treeValidationCertificate.wf
+    resultLevelWF := by decide
+    paramsTel := ?_
+    families := ?_
+    constructors := ?_ }
+  · change VEnv.empty.TelDefEq 1 []
+      [.sort (.succ (.param 0))] [.sort (.succ (.param 0))]
+    exact (show VEnv.empty.OnTel 1 []
+      [.sort (.succ (.param 0))] from
+        ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩).telDefEq_refl
+  · intro family hfamily
+    have hfamilies : treeGeneration.families =
+        [treeGeneration.families[0], treeGeneration.families[1]] := rfl
+    rw [hfamilies] at hfamily
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hfamily
+    rcases hfamily with rfl | rfl
+    · constructor
+      · change VEnv.empty.TelDefEq 1 []
+          [.sort (.succ (.param 0))] [.sort (.succ (.param 0))]
+        exact (show VEnv.empty.OnTel 1 []
+          [.sort (.succ (.param 0))] from
+            ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩).telDefEq_refl
+      · change VEnv.empty.IsDefEq 1 [.sort (.succ (.param 0))]
+          (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+          (.sort (.succ (.succ (.param 0))))
+        exact .sortDF (by decide) (by decide) rfl
+    · constructor
+      · change VEnv.empty.TelDefEq 1 []
+          [.sort (.succ (.param 0))] [.sort (.succ (.param 0))]
+        exact (show VEnv.empty.OnTel 1 []
+          [.sort (.succ (.param 0))] from
+            ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩).telDefEq_refl
+      · change VEnv.empty.IsDefEq 1 [.sort (.succ (.param 0))]
+          (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+          (.sort (.succ (.succ (.param 0))))
+        exact .sortDF (by decide) (by decide) rfl
+  · intro constructor hconstructor
+    have hconstructors : treeGeneration.flatCtors =
+        [treeGeneration.flatCtors[0], treeGeneration.flatCtors[1],
+          treeGeneration.flatCtors[2], treeGeneration.flatCtors[3],
+          treeGeneration.flatCtors[4]] := rfl
+    rw [hconstructors] at hconstructor
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hconstructor
+    rcases hconstructor with rfl | rfl | rfl | rfl | rfl
+    · exact treeLeafGenerationWF
+    · exact treeNodeGenerationWF
+    · exact treeBranchGenerationWF
+    · exact treeListNilGenerationWF
+    · exact treeListConsGenerationWF
+
+theorem indexedTreeBlock_le : natFinalEnv ≤ indexedTreeBlockEnv := by
+  have hfold : indexedTreeDecl.blockTypeConstants.foldlM
+      (fun env type => env.addConst type.name type.toVConstant) natFinalEnv =
+        some indexedTreeBlockEnv := by
+    rw [blockTypeConstants_foldlM_eq_stageInductiveTypes]
+    exact indexedTreeStage
+  exact (VInductDecl.ctorFold_spec indexedTreeDecl.blockTypeConstants hfold).1
+
+theorem indexedTreeLeafGenerationWF :
+    NormalizedBlockCtor.WF indexedTreeGeneration
+      indexedTreeGeneration.flatCtors[0] indexedTreeBlockEnv := by
+  have hTree : indexedTreeBlockEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hZero : indexedTreeBlockEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hbinders : indexedTreeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .bvar 0] := by
+    refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+    exact ⟨⟨_, VEnv.HasType.bvar .zero⟩, trivial⟩
+  have hresult : indexedTreeBlockEnv.HasType 1
+      [.bvar 0, .sort (.succ (.param 0))]
+      (.app
+        (.app (.const ``IndexedTree [.param 0]) (.bvar 1))
+        (.const ``Nat.zero []))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .const ``Nat [])
+      (B := .sort (.succ (.param 0)))
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+      · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar (.succ .zero)
+    · exact VEnv.HasType.const hZero (by simp) rfl
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := indexedTreeLeafSemantic.2.mono indexedTreeBlock_le }
+  · refine ⟨indexedTreeGeneration.families[0], ?_, rfl, rfl, rfl⟩
+    exact .head _
+  · intro recursive hrecursive
+    change recursive ∈ [] at hrecursive
+    nomatch hrecursive
+
+theorem indexedTreeListNilGenerationWF :
+    NormalizedBlockCtor.WF indexedTreeGeneration
+      indexedTreeGeneration.flatCtors[2] indexedTreeBlockEnv := by
+  have hTreeList : indexedTreeBlockEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  have hZero : indexedTreeBlockEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hbinders : indexedTreeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0))] :=
+    ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+  have hresult : indexedTreeBlockEnv.HasType 1
+      [.sort (.succ (.param 0))]
+      (.app
+        (.app (.const ``IndexedTreeList [.param 0]) (.bvar 0))
+        (.const ``Nat.zero []))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .const ``Nat [])
+      (B := .sort (.succ (.param 0)))
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+      · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar .zero
+    · exact VEnv.HasType.const hZero (by simp) rfl
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := indexedTreeListNilSemantic.2.mono
+      indexedTreeBlock_le }
+  · refine ⟨indexedTreeGeneration.families[1], ?_, rfl, rfl, rfl⟩
+    exact .tail _ (.head _)
+  · intro recursive hrecursive
+    change recursive ∈ [] at hrecursive
+    nomatch hrecursive
+
+theorem indexedTreeNodeGenerationWF :
+    NormalizedBlockCtor.WF indexedTreeGeneration
+      indexedTreeGeneration.flatCtors[1] indexedTreeBlockEnv := by
+  have hNat : indexedTreeBlockEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hSucc : indexedTreeBlockEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedTreeBlockEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedTreeBlockEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  have hbinders : indexedTreeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .const ``Nat [],
+        .app
+          (.app (.const ``IndexedTreeList [.param 0]) (.bvar 1))
+          (.bvar 0)] := by
+    refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+    refine ⟨⟨.succ .zero, VEnv.HasType.const hNat (by simp) rfl⟩, ?_⟩
+    refine ⟨⟨.succ (.param 0), ?_⟩, trivial⟩
+    apply VEnv.HasType.app
+      (A := .const ``Nat [])
+      (B := .sort (.succ (.param 0)))
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+      · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar (.succ .zero)
+    · exact VEnv.HasType.bvar .zero
+  have hresult : indexedTreeBlockEnv.HasType 1
+      [.app
+          (.app (.const ``IndexedTreeList [.param 0]) (.bvar 1))
+          (.bvar 0),
+        .const ``Nat [], .sort (.succ (.param 0))]
+      (.app
+        (.app (.const ``IndexedTree [.param 0]) (.bvar 2))
+        (.app (.const ``Nat.succ []) (.bvar 1)))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .const ``Nat [])
+      (B := .sort (.succ (.param 0)))
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+      · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar (.succ (.succ .zero))
+    · apply VEnv.HasType.app
+        (A := .const ``Nat []) (B := .const ``Nat [])
+      · exact VEnv.HasType.const hSucc (by simp) rfl
+      · exact VEnv.HasType.bvar (.succ .zero)
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := indexedTreeNodeSemantic.2.mono
+      indexedTreeBlock_le }
+  · refine ⟨indexedTreeGeneration.families[0], ?_, rfl, rfl, rfl⟩
+    exact .head _
+  · intro recursive hrecursive
+    change recursive ∈ [{
+      fieldIndex := 1
+      binders := []
+      targetType := 1
+      indices := [.bvar 0] }] at hrecursive
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursive
+    subst recursive
+    refine ⟨indexedTreeGeneration.families[1], ?_, rfl, ?_, ?_⟩
+    · exact .tail _ (.head _)
+    · exact ⟨.app
+        (.app (.const ``IndexedTreeList [.param 0]) (.bvar 1))
+        (.bvar 0), rfl, rfl⟩
+    · refine ⟨trivial, ?_⟩
+      exact .cons (VEnv.HasType.bvar .zero) .nil
+
+theorem indexedTreeListConsGenerationWF :
+    NormalizedBlockCtor.WF indexedTreeGeneration
+      indexedTreeGeneration.flatCtors[3] indexedTreeBlockEnv := by
+  have hNat : indexedTreeBlockEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hSucc : indexedTreeBlockEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedTreeBlockEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedTreeBlockEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  have hbinders : indexedTreeBlockEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .const ``Nat [],
+        .app
+          (.app (.const ``IndexedTree [.param 0]) (.bvar 1))
+          (.bvar 0),
+        .app
+          (.app (.const ``IndexedTreeList [.param 0]) (.bvar 2))
+          (.bvar 1)] := by
+    refine ⟨⟨_, VEnv.HasType.sort (by decide)⟩, ?_⟩
+    refine ⟨⟨.succ .zero, VEnv.HasType.const hNat (by simp) rfl⟩, ?_⟩
+    refine ⟨⟨.succ (.param 0), ?_⟩, ?_⟩
+    · apply VEnv.HasType.app
+        (A := .const ``Nat [])
+        (B := .sort (.succ (.param 0)))
+      · apply VEnv.HasType.app
+          (A := .sort (.succ (.param 0)))
+          (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+        · exact VEnv.HasType.const hTree (by simp [VLevel.WF]) rfl
+        · exact VEnv.HasType.bvar (.succ .zero)
+      · exact VEnv.HasType.bvar .zero
+    · refine ⟨⟨.succ (.param 0), ?_⟩, trivial⟩
+      apply VEnv.HasType.app
+        (A := .const ``Nat [])
+        (B := .sort (.succ (.param 0)))
+      · apply VEnv.HasType.app
+          (A := .sort (.succ (.param 0)))
+          (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+        · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+        · exact VEnv.HasType.bvar (.succ (.succ .zero))
+      · exact VEnv.HasType.bvar (.succ .zero)
+  have hresult : indexedTreeBlockEnv.HasType 1
+      [.app
+          (.app (.const ``IndexedTreeList [.param 0]) (.bvar 2))
+          (.bvar 1),
+        .app
+          (.app (.const ``IndexedTree [.param 0]) (.bvar 1))
+          (.bvar 0),
+        .const ``Nat [], .sort (.succ (.param 0))]
+      (.app
+        (.app (.const ``IndexedTreeList [.param 0]) (.bvar 3))
+        (.app (.const ``Nat.succ []) (.bvar 2)))
+      (.sort (.succ (.param 0))) := by
+    apply VEnv.HasType.app
+      (A := .const ``Nat [])
+      (B := .sort (.succ (.param 0)))
+    · apply VEnv.HasType.app
+        (A := .sort (.succ (.param 0)))
+        (B := .forallE (.const ``Nat []) (.sort (.succ (.param 0))))
+      · exact VEnv.HasType.const hTreeList (by simp [VLevel.WF]) rfl
+      · exact VEnv.HasType.bvar (.succ (.succ (.succ .zero)))
+    · apply VEnv.HasType.app
+        (A := .const ``Nat []) (B := .const ``Nat [])
+      · exact VEnv.HasType.const hSucc (by simp) rfl
+      · exact VEnv.HasType.bvar (.succ (.succ .zero))
+  refine {
+    declaredTel := hbinders.telDefEq_refl
+    declaredResult := hresult
+    emittedTel := hbinders.telDefEq_refl
+    emittedResult := hresult
+    owner := ?_
+    recursive := ?_
+    resultSpine := indexedTreeListConsSemantic.2.mono
+      indexedTreeBlock_le }
+  · refine ⟨indexedTreeGeneration.families[1], ?_, rfl, rfl, rfl⟩
+    exact .tail _ (.head _)
+  · intro recursive hrecursive
+    change recursive ∈ [{
+      fieldIndex := 1
+      binders := []
+      targetType := 0
+      indices := [.bvar 0] }, {
+      fieldIndex := 2
+      binders := []
+      targetType := 1
+      indices := [.bvar 1] }] at hrecursive
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursive
+    rcases hrecursive with rfl | rfl
+    · refine ⟨indexedTreeGeneration.families[0], ?_, rfl, ?_, ?_⟩
+      · exact .head _
+      · exact ⟨.app
+          (.app (.const ``IndexedTree [.param 0]) (.bvar 1))
+          (.bvar 0), rfl, rfl⟩
+      · refine ⟨trivial, ?_⟩
+        exact .cons (VEnv.HasType.bvar .zero) .nil
+    · refine ⟨indexedTreeGeneration.families[1], ?_, rfl, ?_, ?_⟩
+      · exact .tail _ (.head _)
+      · exact ⟨.app
+          (.app (.const ``IndexedTreeList [.param 0]) (.bvar 2))
+          (.bvar 1), rfl, rfl⟩
+      · refine ⟨trivial, ?_⟩
+        exact .cons (VEnv.HasType.bvar (.succ .zero)) .nil
+
+theorem indexedTreeBlockGenerationWF :
+    indexedTreeGeneration.WF natFinalEnv indexedTreeBlockEnv := by
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hparams : natFinalEnv.OnTel 1 []
+      [.sort (.succ (.param 0))] :=
+    ⟨⟨_, VEnv.HasType.sort (by decide)⟩, trivial⟩
+  have hfamilyTel : natFinalEnv.OnTel 1 []
+      [.sort (.succ (.param 0)), .const ``Nat []] :=
+    ⟨⟨_, VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨.succ .zero, VEnv.HasType.const hNat (by simp) rfl⟩, trivial⟩⟩
+  refine {
+    blockWF := indexedTreeValidationCertificate.wf
+    resultLevelWF := by decide
+    paramsTel := hparams.telDefEq_refl
+    families := ?_
+    constructors := ?_ }
+  · intro family hfamily
+    have hfamilies : indexedTreeGeneration.families =
+        [indexedTreeGeneration.families[0],
+          indexedTreeGeneration.families[1]] := rfl
+    rw [hfamilies] at hfamily
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hfamily
+    rcases hfamily with rfl | rfl
+    · constructor
+      · exact hfamilyTel.telDefEq_refl
+      · change natFinalEnv.IsDefEq 1
+          [.const ``Nat [], .sort (.succ (.param 0))]
+          (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+          (.sort (.succ (.succ (.param 0))))
+        exact .sortDF (by decide) (by decide) rfl
+    · constructor
+      · exact hfamilyTel.telDefEq_refl
+      · change natFinalEnv.IsDefEq 1
+          [.const ``Nat [], .sort (.succ (.param 0))]
+          (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+          (.sort (.succ (.succ (.param 0))))
+        exact .sortDF (by decide) (by decide) rfl
+  · intro constructor hconstructor
+    have hconstructors : indexedTreeGeneration.flatCtors =
+        [indexedTreeGeneration.flatCtors[0],
+          indexedTreeGeneration.flatCtors[1],
+          indexedTreeGeneration.flatCtors[2],
+          indexedTreeGeneration.flatCtors[3]] := rfl
+    rw [hconstructors] at hconstructor
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hconstructor
+    rcases hconstructor with rfl | rfl | rfl | rfl
+    · exact indexedTreeLeafGenerationWF
+    · exact indexedTreeNodeGenerationWF
+    · exact indexedTreeListNilGenerationWF
+    · exact indexedTreeListConsGenerationWF
+
+/-- Proof-carrying block generation for `Tree`/`TreeList`. -/
+def treeGenerationCertificate :
+    treeDecl.BlockGenerationCertificate VEnv.empty where
+  generation := treeGeneration
+  blockEnv := treeBlockEnv
+  wf := treeBlockGenerationWF
+
+/-- Proof-carrying block generation for the indexed mutual fixture. -/
+def indexedTreeGenerationCertificate :
+    indexedTreeDecl.BlockGenerationCertificate natFinalEnv where
+  generation := indexedTreeGeneration
+  blockEnv := indexedTreeBlockEnv
+  wf := indexedTreeBlockGenerationWF
+
+/-- Final Theory environment produced by the certified unindexed block
+transaction. -/
+def treeFinalEnv : VEnv :=
+  (VEnv.empty.addInductBlockCertified treeGenerationCertificate).get
+    (by decide)
+
+theorem tree_addInductBlockCertified :
+    VEnv.empty.addInductBlockCertified treeGenerationCertificate =
+      some treeFinalEnv := by
+  rfl
+
+/-- The raw public transaction selects the same retained block descriptor and
+produces the same final Theory environment. -/
+theorem tree_addInduct :
+    VEnv.empty.addInduct treeDecl = some treeFinalEnv := by
+  rfl
+
+theorem tree_addInduct_success :
+    VEnv.AddInductSuccess VEnv.empty treeFinalEnv treeDecl :=
+  VEnv.addInduct_success tree_addInduct
+
+/-- Exact four-phase trace for the certified unindexed block transaction. -/
+theorem treeCertifiedTrace :
+    Nonempty (VEnv.AddInductBlockGenerationTrace
+      VEnv.empty treeFinalEnv treeGeneration) :=
+  VEnv.addInductBlockCertified_trace tree_addInductBlockCertified
+
+theorem treeFinalEnv_ordered : treeFinalEnv.Ordered :=
+  VEnv.addInduct_WF .empty rfl treeBlockGenerationWF tree_addInduct
+
+theorem treeFinalEnv_family_lookup {type : VInductiveType}
+    (htype : type ∈ treeDecl.types) :
+    treeFinalEnv.constants type.name = some type.toVConstant := by
+  obtain ⟨trace⟩ := treeCertifiedTrace
+  exact trace.family_lookup htype
+
+theorem treeFinalEnv_ctor_lookup {constructor : VConstVal}
+    (hconstructor : constructor ∈ treeDecl.blockConstructorConstants) :
+    treeFinalEnv.constants constructor.name =
+      some constructor.toVConstant := by
+  obtain ⟨trace⟩ := treeCertifiedTrace
+  exact trace.ctor_lookup hconstructor
+
+theorem treeFinalEnv_rec_lookup {recursor : VConstVal}
+    (hrecursor : recursor ∈ treeGeneration.recursors) :
+    treeFinalEnv.constants recursor.name =
+      some recursor.toVConstant := by
+  obtain ⟨trace⟩ := treeCertifiedTrace
+  exact trace.rec_lookup hrecursor
+
+theorem treeFinalEnv_rule_mem {rule : VDefEq}
+    (hrule : rule ∈ treeGeneration.generatedRules) :
+    treeFinalEnv.defeqs rule := by
+  obtain ⟨trace⟩ := treeCertifiedTrace
+  exact trace.rule_mem hrule
+
+/-- Final Theory environment produced by the certified indexed block
+transaction. -/
+def indexedTreeFinalEnv : VEnv :=
+  (natFinalEnv.addInductBlockCertified indexedTreeGenerationCertificate).get
+    (by decide)
+
+theorem indexedTree_addInductBlockCertified :
+    natFinalEnv.addInductBlockCertified indexedTreeGenerationCertificate =
+      some indexedTreeFinalEnv := by
+  rfl
+
+/-- The indexed mutual block also runs through the same raw public entry
+point once its ordinary `Nat` dependency is present. -/
+theorem indexedTree_addInduct :
+    natFinalEnv.addInduct indexedTreeDecl = some indexedTreeFinalEnv := by
+  rfl
+
+theorem indexedTree_addInduct_success :
+    VEnv.AddInductSuccess natFinalEnv indexedTreeFinalEnv indexedTreeDecl :=
+  VEnv.addInduct_success indexedTree_addInduct
+
+/-- Exact four-phase trace for the certified indexed block transaction. -/
+theorem indexedTreeCertifiedTrace :
+    Nonempty (VEnv.AddInductBlockGenerationTrace
+      natFinalEnv indexedTreeFinalEnv indexedTreeGeneration) :=
+  VEnv.addInductBlockCertified_trace indexedTree_addInductBlockCertified
+
+theorem indexedTreeFinalEnv_ordered : indexedTreeFinalEnv.Ordered :=
+  VEnv.addInduct_WF natFinalEnv_ordered rfl indexedTreeBlockGenerationWF
+    indexedTree_addInduct
+
+theorem indexedTreeFinalEnv_family_lookup {type : VInductiveType}
+    (htype : type ∈ indexedTreeDecl.types) :
+    indexedTreeFinalEnv.constants type.name = some type.toVConstant := by
+  obtain ⟨trace⟩ := indexedTreeCertifiedTrace
+  exact trace.family_lookup htype
+
+theorem indexedTreeFinalEnv_ctor_lookup {constructor : VConstVal}
+    (hconstructor :
+      constructor ∈ indexedTreeDecl.blockConstructorConstants) :
+    indexedTreeFinalEnv.constants constructor.name =
+      some constructor.toVConstant := by
+  obtain ⟨trace⟩ := indexedTreeCertifiedTrace
+  exact trace.ctor_lookup hconstructor
+
+theorem indexedTreeFinalEnv_rec_lookup {recursor : VConstVal}
+    (hrecursor : recursor ∈ indexedTreeGeneration.recursors) :
+    indexedTreeFinalEnv.constants recursor.name =
+      some recursor.toVConstant := by
+  obtain ⟨trace⟩ := indexedTreeCertifiedTrace
+  exact trace.rec_lookup hrecursor
+
+theorem indexedTreeFinalEnv_rule_mem {rule : VDefEq}
+    (hrule : rule ∈ indexedTreeGeneration.generatedRules) :
+    indexedTreeFinalEnv.defeqs rule := by
+  obtain ⟨trace⟩ := indexedTreeCertifiedTrace
+  exact trace.rule_mem hrule
+
+/-! ## Verification-environment block replay -/
+
+/-! ## Unindexed Verify block replay -/
+
+def treeReplayFirstTypeEnv : VEnv :=
+  (VEnv.empty.addConst treeType.name treeType.toVConstant).get!
+
+def treeReplayTypeEnv : VEnv :=
+  (treeReplayFirstTypeEnv.addConst treeListType.name
+    treeListType.toVConstant).get!
+
+def treeReplayLeafEnv : VEnv :=
+  (treeReplayTypeEnv.addConst treeType.ctors[0].name
+    treeType.ctors[0].toVConstant).get!
+
+def treeReplayNodeEnv : VEnv :=
+  (treeReplayLeafEnv.addConst treeType.ctors[1].name
+    treeType.ctors[1].toVConstant).get!
+
+def treeReplayBranchEnv : VEnv :=
+  (treeReplayNodeEnv.addConst treeType.ctors[2].name
+    treeType.ctors[2].toVConstant).get!
+
+def treeReplayNilEnv : VEnv :=
+  (treeReplayBranchEnv.addConst treeListType.ctors[0].name
+    treeListType.ctors[0].toVConstant).get!
+
+def treeReplayCtorEnv : VEnv :=
+  (treeReplayNilEnv.addConst treeListType.ctors[1].name
+    treeListType.ctors[1].toVConstant).get!
+
+def treeReplayFirstRecEnv : VEnv :=
+  (treeReplayCtorEnv.addConst treeGeneration.recursors[0].name
+    treeGeneration.recursors[0].toVConstant).get!
+
+def treeReplayRecEnv : VEnv :=
+  (treeReplayFirstRecEnv.addConst treeGeneration.recursors[1].name
+    treeGeneration.recursors[1].toVConstant).get!
+
+example : treeReplayTypeEnv = treeBlockEnv := rfl
+
+theorem treeReplay_addFirstType :
+    VEnv.empty.addConst treeType.name treeType.toVConstant =
+      some treeReplayFirstTypeEnv := rfl
+
+theorem treeReplay_addSecondType :
+    treeReplayFirstTypeEnv.addConst treeListType.name
+      treeListType.toVConstant = some treeReplayTypeEnv := rfl
+
+theorem treeReplay_addLeaf :
+    treeReplayTypeEnv.addConst treeType.ctors[0].name
+      treeType.ctors[0].toVConstant = some treeReplayLeafEnv := rfl
+
+theorem treeReplay_addNode :
+    treeReplayLeafEnv.addConst treeType.ctors[1].name
+      treeType.ctors[1].toVConstant = some treeReplayNodeEnv := rfl
+
+theorem treeReplay_addBranch :
+    treeReplayNodeEnv.addConst treeType.ctors[2].name
+      treeType.ctors[2].toVConstant = some treeReplayBranchEnv := rfl
+
+theorem treeReplay_addNil :
+    treeReplayBranchEnv.addConst treeListType.ctors[0].name
+      treeListType.ctors[0].toVConstant = some treeReplayNilEnv := rfl
+
+theorem treeReplay_addCons :
+    treeReplayNilEnv.addConst treeListType.ctors[1].name
+      treeListType.ctors[1].toVConstant = some treeReplayCtorEnv := rfl
+
+theorem treeReplay_addFirstRec :
+    treeReplayCtorEnv.addConst treeGeneration.recursors[0].name
+      treeGeneration.recursors[0].toVConstant =
+        some treeReplayFirstRecEnv := rfl
+
+theorem treeReplay_addSecondRec :
+    treeReplayFirstRecEnv.addConst treeGeneration.recursors[1].name
+      treeGeneration.recursors[1].toVConstant =
+        some treeReplayRecEnv := rfl
+
+theorem treeTypeConstantWF : treeType.toVConstant.WF VEnv.empty := by
+  exact treeBlockGenerationWF.rawFamily_isType (.head _)
+
+theorem treeListTypeConstantWF :
+    treeListType.toVConstant.WF VEnv.empty := by
+  exact treeBlockGenerationWF.rawFamily_isType (.tail _ (.head _))
+
+theorem treeLeafConstantWF :
+    treeType.ctors[0].toVConstant.WF treeReplayTypeEnv := by
+  exact treeBlockGenerationWF.rawCtor_isType (.head _)
+
+theorem treeNodeConstantWF :
+    treeType.ctors[1].toVConstant.WF treeReplayTypeEnv := by
+  exact treeBlockGenerationWF.rawCtor_isType (.tail _ (.head _))
+
+theorem treeBranchConstantWF :
+    treeType.ctors[2].toVConstant.WF treeReplayTypeEnv := by
+  exact treeBlockGenerationWF.rawCtor_isType
+    (.tail _ (.tail _ (.head _)))
+
+theorem treeNilConstantWF :
+    treeListType.ctors[0].toVConstant.WF treeReplayTypeEnv := by
+  exact treeBlockGenerationWF.rawCtor_isType
+    (.tail _ (.tail _ (.tail _ (.head _))))
+
+theorem treeConsConstantWF :
+    treeListType.ctors[1].toVConstant.WF treeReplayTypeEnv := by
+  exact treeBlockGenerationWF.rawCtor_isType
+    (.tail _ (.tail _ (.tail _ (.tail _ (.head _)))))
+
+theorem treeReplayFirstTypeEnv_ordered :
+    treeReplayFirstTypeEnv.Ordered := by
+  exact .const .empty treeTypeConstantWF treeReplay_addFirstType
+
+theorem treeReplayTypeEnv_ordered : treeReplayTypeEnv.Ordered := by
+  refine .const treeReplayFirstTypeEnv_ordered ?_
+    treeReplay_addSecondType
+  exact treeListTypeConstantWF.mono
+    (VEnv.addConst_le treeReplay_addFirstType)
+
+theorem treeReplayTypeEnv_le_leafEnv :
+    treeReplayTypeEnv ≤ treeReplayLeafEnv :=
+  VEnv.addConst_le treeReplay_addLeaf
+
+theorem treeReplayLeafEnv_ordered : treeReplayLeafEnv.Ordered := by
+  exact .const treeReplayTypeEnv_ordered treeLeafConstantWF
+    treeReplay_addLeaf
+
+theorem treeReplayLeafEnv_le_nodeEnv :
+    treeReplayLeafEnv ≤ treeReplayNodeEnv :=
+  VEnv.addConst_le treeReplay_addNode
+
+theorem treeReplayNodeEnv_ordered : treeReplayNodeEnv.Ordered := by
+  refine .const treeReplayLeafEnv_ordered ?_ treeReplay_addNode
+  exact treeNodeConstantWF.mono
+    treeReplayTypeEnv_le_leafEnv
+
+theorem treeReplayNodeEnv_le_branchEnv :
+    treeReplayNodeEnv ≤ treeReplayBranchEnv :=
+  VEnv.addConst_le treeReplay_addBranch
+
+theorem treeReplayBranchEnv_ordered : treeReplayBranchEnv.Ordered := by
+  refine .const treeReplayNodeEnv_ordered ?_ treeReplay_addBranch
+  exact treeBranchConstantWF.mono
+    (treeReplayTypeEnv_le_leafEnv.trans treeReplayLeafEnv_le_nodeEnv)
+
+theorem treeReplayBranchEnv_le_nilEnv :
+    treeReplayBranchEnv ≤ treeReplayNilEnv :=
+  VEnv.addConst_le treeReplay_addNil
+
+theorem treeReplayNilEnv_ordered : treeReplayNilEnv.Ordered := by
+  refine .const treeReplayBranchEnv_ordered ?_ treeReplay_addNil
+  exact treeNilConstantWF.mono
+      (treeReplayTypeEnv_le_leafEnv.trans
+        (treeReplayLeafEnv_le_nodeEnv.trans
+          treeReplayNodeEnv_le_branchEnv))
+
+theorem treeReplayNilEnv_le_ctorEnv :
+    treeReplayNilEnv ≤ treeReplayCtorEnv :=
+  VEnv.addConst_le treeReplay_addCons
+
+theorem treeReplayCtorEnv_ordered : treeReplayCtorEnv.Ordered := by
+  refine .const treeReplayNilEnv_ordered ?_ treeReplay_addCons
+  exact treeConsConstantWF.mono
+      (treeReplayTypeEnv_le_leafEnv.trans
+        (treeReplayLeafEnv_le_nodeEnv.trans
+          (treeReplayNodeEnv_le_branchEnv.trans
+            treeReplayBranchEnv_le_nilEnv)))
+
+theorem treeReplayInput_le_ctorEnv : VEnv.empty ≤ treeReplayCtorEnv := by
+  exact (VEnv.addConst_le treeReplay_addFirstType).trans
+    ((VEnv.addConst_le treeReplay_addSecondType).trans
+      (treeReplayTypeEnv_le_leafEnv.trans
+        (treeReplayLeafEnv_le_nodeEnv.trans
+          (treeReplayNodeEnv_le_branchEnv.trans
+            (treeReplayBranchEnv_le_nilEnv.trans
+              treeReplayNilEnv_le_ctorEnv)))))
+
+theorem treeReplayBlock_le_ctorEnv : treeBlockEnv ≤ treeReplayCtorEnv := by
+  exact treeReplayTypeEnv_le_leafEnv.trans
+    (treeReplayLeafEnv_le_nodeEnv.trans
+      (treeReplayNodeEnv_le_branchEnv.trans
+        (treeReplayBranchEnv_le_nilEnv.trans
+          treeReplayNilEnv_le_ctorEnv)))
+
+theorem treeReplayGenerationEnv :
+    BlockGenerationEnv treeGeneration treeReplayCtorEnv := by
+  apply treeBlockGenerationWF.toBlockGenerationEnv
+    treeReplayInput_le_ctorEnv treeReplayBlock_le_ctorEnv
+    treeReplayCtorEnv_ordered
+  · intro family hfamily
+    have hfamilies : treeGeneration.families =
+        [treeGeneration.families[0], treeGeneration.families[1]] := rfl
+    rw [hfamilies] at hfamily
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hfamily
+    rcases hfamily with rfl | rfl <;> rfl
+  · intro constructor hconstructor
+    have hconstructors : treeGeneration.flatCtors =
+        [treeGeneration.flatCtors[0], treeGeneration.flatCtors[1],
+          treeGeneration.flatCtors[2], treeGeneration.flatCtors[3],
+          treeGeneration.flatCtors[4]] := rfl
+    rw [hconstructors] at hconstructor
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hconstructor
+    rcases hconstructor with rfl | rfl | rfl | rfl | rfl <;> rfl
+
+theorem treeReplayFirstRecEnv_ordered :
+    treeReplayFirstRecEnv.Ordered := by
+  refine .const treeReplayCtorEnv_ordered ?_ treeReplay_addFirstRec
+  exact treeReplayGenerationEnv.recursor_wf (.head _)
+
+theorem treeReplayCtorEnv_le_firstRecEnv :
+    treeReplayCtorEnv ≤ treeReplayFirstRecEnv :=
+  VEnv.addConst_le treeReplay_addFirstRec
+
+theorem treeReplayRecEnv_ordered : treeReplayRecEnv.Ordered := by
+  refine .const treeReplayFirstRecEnv_ordered ?_ treeReplay_addSecondRec
+  exact (treeReplayGenerationEnv.recursor_wf
+    (.tail _ (.head _))).mono treeReplayCtorEnv_le_firstRecEnv
+
+theorem treeKernelInfo_tr :
+    TrConstVal .safe VEnv.empty treeKernelInfo treeType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr VEnv.empty treeKernelInfo.levelParams []
+      treeKernelInfo.type treeType.type := by tr_type_expr_tac
+  exact hshape.to_trExprS .empty trivial
+    (treeFamilyTypeWF treeType (.inl rfl))
+
+theorem treeListKernelInfo_tr :
+    TrConstVal .safe treeReplayFirstTypeEnv treeListKernelInfo
+      treeListType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayFirstTypeEnv
+      treeListKernelInfo.levelParams [] treeListKernelInfo.type
+      treeListType.type := by tr_type_expr_tac
+  exact hshape.to_trExprS treeReplayFirstTypeEnv_ordered trivial
+    ((treeFamilyTypeWF treeListType (.inr rfl)).mono
+      (VEnv.addConst_le (by rfl)))
+
+theorem treeLeafKernelInfo_tr :
+    TrConstVal .safe treeReplayTypeEnv treeLeafKernelInfo
+      treeType.ctors[0] := by
+  have hTree : treeReplayTypeEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayTypeEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayTypeEnv
+      treeLeafKernelInfo.levelParams [] treeLeafKernelInfo.type
+      treeType.ctors[0].type := by tr_type_expr_tac
+  exact hshape.to_trExprS treeReplayTypeEnv_ordered trivial
+    (treeCtorWF treeType.ctors[0] (.inl (by simp [treeType])))
+
+theorem treeNodeKernelInfo_tr :
+    TrConstVal .safe treeReplayLeafEnv treeNodeKernelInfo
+      treeType.ctors[1] := by
+  have hTree : treeReplayLeafEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayLeafEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayLeafEnv
+      treeNodeKernelInfo.levelParams [] treeNodeKernelInfo.type
+      treeType.ctors[1].type := by tr_type_expr_tac
+  exact hshape.to_trExprS treeReplayLeafEnv_ordered trivial
+    ((treeCtorWF treeType.ctors[1] (.inl (by simp [treeType]))).mono
+      treeReplayTypeEnv_le_leafEnv)
+
+theorem treeBranchKernelInfo_tr :
+    TrConstVal .safe treeReplayNodeEnv treeBranchKernelInfo
+      treeType.ctors[2] := by
+  have hTree : treeReplayNodeEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayNodeEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayNodeEnv
+      treeBranchKernelInfo.levelParams [] treeBranchKernelInfo.type
+      treeType.ctors[2].type := by tr_type_expr_tac
+  exact hshape.to_trExprS treeReplayNodeEnv_ordered trivial
+    ((treeCtorWF treeType.ctors[2] (.inl (by simp [treeType]))).mono
+      (treeReplayTypeEnv_le_leafEnv.trans treeReplayLeafEnv_le_nodeEnv))
+
+theorem treeListNilKernelInfo_tr :
+    TrConstVal .safe treeReplayBranchEnv treeListNilKernelInfo
+      treeListType.ctors[0] := by
+  have hTree : treeReplayBranchEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayBranchEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayBranchEnv
+      treeListNilKernelInfo.levelParams [] treeListNilKernelInfo.type
+      treeListType.ctors[0].type := by tr_type_expr_tac
+  exact hshape.to_trExprS treeReplayBranchEnv_ordered trivial
+    ((treeCtorWF treeListType.ctors[0]
+      (.inr (by simp [treeListType]))).mono
+        (treeReplayTypeEnv_le_leafEnv.trans
+          (treeReplayLeafEnv_le_nodeEnv.trans
+            treeReplayNodeEnv_le_branchEnv)))
+
+theorem treeListConsKernelInfo_tr :
+    TrConstVal .safe treeReplayNilEnv treeListConsKernelInfo
+      treeListType.ctors[1] := by
+  have hTree : treeReplayNilEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayNilEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayNilEnv
+      treeListConsKernelInfo.levelParams [] treeListConsKernelInfo.type
+      treeListType.ctors[1].type := by tr_type_expr_tac
+  exact hshape.to_trExprS treeReplayNilEnv_ordered trivial
+    ((treeCtorWF treeListType.ctors[1]
+      (.inr (by simp [treeListType]))).mono
+        (treeReplayTypeEnv_le_leafEnv.trans
+          (treeReplayLeafEnv_le_nodeEnv.trans
+            (treeReplayNodeEnv_le_branchEnv.trans
+              treeReplayBranchEnv_le_nilEnv))))
+
+theorem treeRecKernelInfo_tr :
+    TrConstVal .safe treeReplayCtorEnv treeRecKernelInfo
+      treeGeneration.recursors[0] := by
+  have hTree : treeReplayCtorEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayCtorEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  have hLeaf : treeReplayCtorEnv.constants ``Tree.leaf =
+      some treeType.ctors[0].toVConstant := rfl
+  have hNode : treeReplayCtorEnv.constants ``Tree.node =
+      some treeType.ctors[1].toVConstant := rfl
+  have hBranch : treeReplayCtorEnv.constants ``Tree.branch =
+      some treeType.ctors[2].toVConstant := rfl
+  have hNil : treeReplayCtorEnv.constants ``TreeList.nil =
+      some treeListType.ctors[0].toVConstant := rfl
+  have hCons : treeReplayCtorEnv.constants ``TreeList.cons =
+      some treeListType.ctors[1].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayCtorEnv
+      treeRecKernelInfo.levelParams [] treeRecKernelInfo.type
+      treeGeneration.recursors[0].type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ :=
+    treeReplayGenerationEnv.recursor_wf (.head _)
+  exact hshape.to_trExprS treeReplayCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+theorem treeListRecKernelInfo_tr :
+    TrConstVal .safe treeReplayFirstRecEnv treeListRecKernelInfo
+      treeGeneration.recursors[1] := by
+  have hTree : treeReplayFirstRecEnv.constants ``Tree =
+      some treeType.toVConstant := rfl
+  have hTreeList : treeReplayFirstRecEnv.constants ``TreeList =
+      some treeListType.toVConstant := rfl
+  have hLeaf : treeReplayFirstRecEnv.constants ``Tree.leaf =
+      some treeType.ctors[0].toVConstant := rfl
+  have hNode : treeReplayFirstRecEnv.constants ``Tree.node =
+      some treeType.ctors[1].toVConstant := rfl
+  have hBranch : treeReplayFirstRecEnv.constants ``Tree.branch =
+      some treeType.ctors[2].toVConstant := rfl
+  have hNil : treeReplayFirstRecEnv.constants ``TreeList.nil =
+      some treeListType.ctors[0].toVConstant := rfl
+  have hCons : treeReplayFirstRecEnv.constants ``TreeList.cons =
+      some treeListType.ctors[1].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr treeReplayFirstRecEnv
+      treeListRecKernelInfo.levelParams [] treeListRecKernelInfo.type
+      treeGeneration.recursors[1].type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ :=
+    treeReplayGenerationEnv.recursor_wf (.tail _ (.head _))
+  exact hshape.to_trExprS treeReplayFirstRecEnv_ordered trivial
+    ⟨.sort u, hrec.mono treeReplayCtorEnv_le_firstRecEnv⟩
+
+def treeReplayFirstTypeMap : ConstMap :=
+  ({} : ConstMap).insert ``Tree treeKernelInfo
+
+def treeReplayTypeMap : ConstMap :=
+  treeReplayFirstTypeMap.insert ``TreeList treeListKernelInfo
+
+def treeReplayLeafMap : ConstMap :=
+  treeReplayTypeMap.insert ``Tree.leaf treeLeafKernelInfo
+
+def treeReplayNodeMap : ConstMap :=
+  treeReplayLeafMap.insert ``Tree.node treeNodeKernelInfo
+
+def treeReplayBranchMap : ConstMap :=
+  treeReplayNodeMap.insert ``Tree.branch treeBranchKernelInfo
+
+def treeReplayNilMap : ConstMap :=
+  treeReplayBranchMap.insert ``TreeList.nil treeListNilKernelInfo
+
+def treeReplayCtorMap : ConstMap :=
+  treeReplayNilMap.insert ``TreeList.cons treeListConsKernelInfo
+
+def treeReplayFirstRecMap : ConstMap :=
+  treeReplayCtorMap.insert ``Tree.rec treeRecKernelInfo
+
+def treeReplayMap : ConstMap :=
+  treeReplayFirstRecMap.insert ``TreeList.rec treeListRecKernelInfo
+
+theorem treeReplayFirstType_fresh :
+    ({} : ConstMap).find? ``Tree = none := by
+  simp [SMap.find?]
+
+theorem treeReplayFirstTypeMap_wf : treeReplayFirstTypeMap.WF :=
+  SMap.WF.empty.insert _ _ treeReplayFirstType_fresh
+
+theorem treeReplaySecondType_fresh :
+    treeReplayFirstTypeMap.find? ``TreeList = none := by
+  rw [treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayTypeMap_wf : treeReplayTypeMap.WF :=
+  treeReplayFirstTypeMap_wf.insert _ _ treeReplaySecondType_fresh
+
+theorem treeReplayLeaf_fresh :
+    treeReplayTypeMap.find? ``Tree.leaf = none := by
+  rw [treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayLeafMap_wf : treeReplayLeafMap.WF :=
+  treeReplayTypeMap_wf.insert _ _ treeReplayLeaf_fresh
+
+theorem treeReplayNode_fresh :
+    treeReplayLeafMap.find? ``Tree.node = none := by
+  rw [treeReplayLeafMap, treeReplayTypeMap_wf.find?_insert,
+    treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayNodeMap_wf : treeReplayNodeMap.WF :=
+  treeReplayLeafMap_wf.insert _ _ treeReplayNode_fresh
+
+theorem treeReplayBranch_fresh :
+    treeReplayNodeMap.find? ``Tree.branch = none := by
+  rw [treeReplayNodeMap, treeReplayLeafMap_wf.find?_insert,
+    treeReplayLeafMap, treeReplayTypeMap_wf.find?_insert,
+    treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayBranchMap_wf : treeReplayBranchMap.WF :=
+  treeReplayNodeMap_wf.insert _ _ treeReplayBranch_fresh
+
+theorem treeReplayNil_fresh :
+    treeReplayBranchMap.find? ``TreeList.nil = none := by
+  rw [treeReplayBranchMap, treeReplayNodeMap_wf.find?_insert,
+    treeReplayNodeMap, treeReplayLeafMap_wf.find?_insert,
+    treeReplayLeafMap, treeReplayTypeMap_wf.find?_insert,
+    treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayNilMap_wf : treeReplayNilMap.WF :=
+  treeReplayBranchMap_wf.insert _ _ treeReplayNil_fresh
+
+theorem treeReplayCons_fresh :
+    treeReplayNilMap.find? ``TreeList.cons = none := by
+  rw [treeReplayNilMap, treeReplayBranchMap_wf.find?_insert,
+    treeReplayBranchMap, treeReplayNodeMap_wf.find?_insert,
+    treeReplayNodeMap, treeReplayLeafMap_wf.find?_insert,
+    treeReplayLeafMap, treeReplayTypeMap_wf.find?_insert,
+    treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayCtorMap_wf : treeReplayCtorMap.WF :=
+  treeReplayNilMap_wf.insert _ _ treeReplayCons_fresh
+
+theorem treeReplayFirstRec_fresh :
+    treeReplayCtorMap.find? ``Tree.rec = none := by
+  rw [treeReplayCtorMap, treeReplayNilMap_wf.find?_insert,
+    treeReplayNilMap, treeReplayBranchMap_wf.find?_insert,
+    treeReplayBranchMap, treeReplayNodeMap_wf.find?_insert,
+    treeReplayNodeMap, treeReplayLeafMap_wf.find?_insert,
+    treeReplayLeafMap, treeReplayTypeMap_wf.find?_insert,
+    treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayFirstRecMap_wf : treeReplayFirstRecMap.WF :=
+  treeReplayCtorMap_wf.insert _ _ treeReplayFirstRec_fresh
+
+theorem treeReplaySecondRec_fresh :
+    treeReplayFirstRecMap.find? ``TreeList.rec = none := by
+  rw [treeReplayFirstRecMap, treeReplayCtorMap_wf.find?_insert,
+    treeReplayCtorMap, treeReplayNilMap_wf.find?_insert,
+    treeReplayNilMap, treeReplayBranchMap_wf.find?_insert,
+    treeReplayBranchMap, treeReplayNodeMap_wf.find?_insert,
+    treeReplayNodeMap, treeReplayLeafMap_wf.find?_insert,
+    treeReplayLeafMap, treeReplayTypeMap_wf.find?_insert,
+    treeReplayTypeMap, treeReplayFirstTypeMap_wf.find?_insert,
+    treeReplayFirstTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem treeReplayMap_wf : treeReplayMap.WF :=
+  treeReplayFirstRecMap_wf.insert _ _ treeReplaySecondRec_fresh
+
+theorem treeReplay_treeRec_lookup :
+    treeReplayMap.find? ``Tree.rec = some treeRecKernelInfo := by
+  rw [treeReplayMap, treeReplayFirstRecMap_wf.find?_insert,
+    treeReplayFirstRecMap, treeReplayCtorMap_wf.find?_insert]
+  rfl
+
+theorem treeReplay_treeListRec_lookup :
+    treeReplayMap.find? ``TreeList.rec = some treeListRecKernelInfo := by
+  rw [treeReplayMap, treeReplayFirstRecMap_wf.find?_insert]
+  rfl
+
+def treeAddInductBlockTrace :
+    AddInductBlockTrace ({} : ConstMap) VEnv.empty treeDecl
+      treeReplayMap treeFinalEnv where
+  generation := treeGeneration
+  blockEnv := treeBlockEnv
+  generation_wf := treeBlockGenerationWF
+  typeMap := treeReplayTypeMap
+  typeEnv := treeReplayTypeEnv
+  ctorMap := treeReplayCtorMap
+  ctorEnv := treeReplayCtorEnv
+  recEnv := treeReplayRecEnv
+  addTypes := .cons {
+      info := treeKernelInfo
+      kind_eq := by simp [treeKernelInfo, InductConstantKind.Matches]
+      tr := treeKernelInfo_tr
+      map_fresh := treeReplayFirstType_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := treeListKernelInfo
+      kind_eq := by simp [treeListKernelInfo, InductConstantKind.Matches]
+      tr := treeListKernelInfo_tr
+      map_fresh := treeReplaySecondType_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+  addCtors := .cons {
+      info := treeLeafKernelInfo
+      kind_eq := by simp [treeLeafKernelInfo, InductConstantKind.Matches]
+      tr := treeLeafKernelInfo_tr
+      map_fresh := treeReplayLeaf_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := treeNodeKernelInfo
+      kind_eq := by simp [treeNodeKernelInfo, InductConstantKind.Matches]
+      tr := treeNodeKernelInfo_tr
+      map_fresh := treeReplayNode_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := treeBranchKernelInfo
+      kind_eq := by simp [treeBranchKernelInfo, InductConstantKind.Matches]
+      tr := treeBranchKernelInfo_tr
+      map_fresh := treeReplayBranch_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := treeListNilKernelInfo
+      kind_eq := by simp [treeListNilKernelInfo, InductConstantKind.Matches]
+      tr := treeListNilKernelInfo_tr
+      map_fresh := treeReplayNil_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := treeListConsKernelInfo
+      kind_eq := by simp [treeListConsKernelInfo, InductConstantKind.Matches]
+      tr := treeListConsKernelInfo_tr
+      map_fresh := treeReplayCons_fresh
+      env_add := rfl
+      map_add := rfl } .nil))))
+  addRecs := .cons {
+      info := treeRecKernelInfo
+      kind_eq := by simp [treeRecKernelInfo, InductConstantKind.Matches]
+      tr := treeRecKernelInfo_tr
+      map_fresh := treeReplayFirstRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := treeListRecKernelInfo
+      kind_eq := by simp [treeListRecKernelInfo, InductConstantKind.Matches]
+      tr := treeListRecKernelInfo_tr
+      map_fresh := treeReplaySecondRec_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+  recK := by
+    intro recursor hrecursor
+    have hrecs : treeGeneration.recursors =
+        [treeGeneration.recursors[0], treeGeneration.recursors[1]] := rfl
+    rw [hrecs] at hrecursor
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursor
+    rcases hrecursor with rfl | rfl
+    · exact ⟨treeRecKernelInfo, treeReplay_treeRec_lookup, by decide⟩
+    · exact ⟨treeListRecKernelInfo, treeReplay_treeListRec_lookup,
+        by decide⟩
+  addRules := ⟨rfl⟩
+
+theorem treeAddInductBlock :
+    AddInductBlock ({} : ConstMap) VEnv.empty treeDecl
+      treeReplayMap treeFinalEnv :=
+  ⟨treeAddInductBlockTrace⟩
+
+theorem tree_trEnv' : TrEnv' .safe treeReplayMap false treeFinalEnv :=
+  .inductBlock treeAddInductBlock .empty
+
+theorem tree_verify_env_wf : treeFinalEnv.WF := tree_trEnv'.wf
+
+theorem tree_verify_aligned :
+    Aligned .safe treeReplayMap treeFinalEnv := tree_trEnv'.aligned
+
+/-! ## Indexed Verify block replay -/
+
+def indexedReplayFirstTypeEnv : VEnv :=
+  (natFinalEnv.addConst indexedTreeType.name
+    indexedTreeType.toVConstant).get!
+
+def indexedReplayTypeEnv : VEnv :=
+  (indexedReplayFirstTypeEnv.addConst indexedTreeListType.name
+    indexedTreeListType.toVConstant).get!
+
+def indexedReplayLeafEnv : VEnv :=
+  (indexedReplayTypeEnv.addConst indexedTreeType.ctors[0].name
+    indexedTreeType.ctors[0].toVConstant).get!
+
+def indexedReplayNodeEnv : VEnv :=
+  (indexedReplayLeafEnv.addConst indexedTreeType.ctors[1].name
+    indexedTreeType.ctors[1].toVConstant).get!
+
+def indexedReplayNilEnv : VEnv :=
+  (indexedReplayNodeEnv.addConst indexedTreeListType.ctors[0].name
+    indexedTreeListType.ctors[0].toVConstant).get!
+
+def indexedReplayCtorEnv : VEnv :=
+  (indexedReplayNilEnv.addConst indexedTreeListType.ctors[1].name
+    indexedTreeListType.ctors[1].toVConstant).get!
+
+def indexedReplayFirstRecEnv : VEnv :=
+  (indexedReplayCtorEnv.addConst
+    indexedTreeGeneration.recursors[0].name
+    indexedTreeGeneration.recursors[0].toVConstant).get!
+
+def indexedReplayRecEnv : VEnv :=
+  (indexedReplayFirstRecEnv.addConst
+    indexedTreeGeneration.recursors[1].name
+    indexedTreeGeneration.recursors[1].toVConstant).get!
+
+example : indexedReplayTypeEnv = indexedTreeBlockEnv := rfl
+
+theorem indexedReplay_addFirstType :
+    natFinalEnv.addConst indexedTreeType.name
+      indexedTreeType.toVConstant = some indexedReplayFirstTypeEnv := rfl
+
+theorem indexedReplay_addSecondType :
+    indexedReplayFirstTypeEnv.addConst indexedTreeListType.name
+      indexedTreeListType.toVConstant = some indexedReplayTypeEnv := rfl
+
+theorem indexedReplay_addLeaf :
+    indexedReplayTypeEnv.addConst indexedTreeType.ctors[0].name
+      indexedTreeType.ctors[0].toVConstant =
+        some indexedReplayLeafEnv := rfl
+
+theorem indexedReplay_addNode :
+    indexedReplayLeafEnv.addConst indexedTreeType.ctors[1].name
+      indexedTreeType.ctors[1].toVConstant =
+        some indexedReplayNodeEnv := rfl
+
+theorem indexedReplay_addNil :
+    indexedReplayNodeEnv.addConst indexedTreeListType.ctors[0].name
+      indexedTreeListType.ctors[0].toVConstant =
+        some indexedReplayNilEnv := rfl
+
+theorem indexedReplay_addCons :
+    indexedReplayNilEnv.addConst indexedTreeListType.ctors[1].name
+      indexedTreeListType.ctors[1].toVConstant =
+        some indexedReplayCtorEnv := rfl
+
+theorem indexedReplay_addFirstRec :
+    indexedReplayCtorEnv.addConst
+      indexedTreeGeneration.recursors[0].name
+      indexedTreeGeneration.recursors[0].toVConstant =
+        some indexedReplayFirstRecEnv := rfl
+
+theorem indexedReplay_addSecondRec :
+    indexedReplayFirstRecEnv.addConst
+      indexedTreeGeneration.recursors[1].name
+      indexedTreeGeneration.recursors[1].toVConstant =
+        some indexedReplayRecEnv := rfl
+
+theorem indexedTreeTypeConstantWF :
+    indexedTreeType.toVConstant.WF natFinalEnv := by
+  exact indexedTreeBlockGenerationWF.rawFamily_isType (.head _)
+
+theorem indexedTreeListTypeConstantWF :
+    indexedTreeListType.toVConstant.WF natFinalEnv := by
+  exact indexedTreeBlockGenerationWF.rawFamily_isType
+    (.tail _ (.head _))
+
+theorem indexedTreeLeafConstantWF :
+    indexedTreeType.ctors[0].toVConstant.WF indexedReplayTypeEnv := by
+  exact indexedTreeBlockGenerationWF.rawCtor_isType (.head _)
+
+theorem indexedTreeNodeConstantWF :
+    indexedTreeType.ctors[1].toVConstant.WF indexedReplayTypeEnv := by
+  exact indexedTreeBlockGenerationWF.rawCtor_isType
+    (.tail _ (.head _))
+
+theorem indexedTreeNilConstantWF :
+    indexedTreeListType.ctors[0].toVConstant.WF
+      indexedReplayTypeEnv := by
+  exact indexedTreeBlockGenerationWF.rawCtor_isType
+    (.tail _ (.tail _ (.head _)))
+
+theorem indexedTreeConsConstantWF :
+    indexedTreeListType.ctors[1].toVConstant.WF
+      indexedReplayTypeEnv := by
+  exact indexedTreeBlockGenerationWF.rawCtor_isType
+    (.tail _ (.tail _ (.tail _ (.head _))))
+
+theorem indexedReplayFirstTypeEnv_ordered :
+    indexedReplayFirstTypeEnv.Ordered := by
+  exact .const natFinalEnv_ordered indexedTreeTypeConstantWF
+    indexedReplay_addFirstType
+
+theorem indexedReplayTypeEnv_ordered : indexedReplayTypeEnv.Ordered := by
+  refine .const indexedReplayFirstTypeEnv_ordered ?_
+    indexedReplay_addSecondType
+  exact indexedTreeListTypeConstantWF.mono
+    (VEnv.addConst_le indexedReplay_addFirstType)
+
+theorem indexedReplayTypeEnv_le_leafEnv :
+    indexedReplayTypeEnv ≤ indexedReplayLeafEnv :=
+  VEnv.addConst_le indexedReplay_addLeaf
+
+theorem indexedReplayLeafEnv_ordered : indexedReplayLeafEnv.Ordered := by
+  exact .const indexedReplayTypeEnv_ordered indexedTreeLeafConstantWF
+    indexedReplay_addLeaf
+
+theorem indexedReplayLeafEnv_le_nodeEnv :
+    indexedReplayLeafEnv ≤ indexedReplayNodeEnv :=
+  VEnv.addConst_le indexedReplay_addNode
+
+theorem indexedReplayNodeEnv_ordered : indexedReplayNodeEnv.Ordered := by
+  refine .const indexedReplayLeafEnv_ordered ?_ indexedReplay_addNode
+  exact indexedTreeNodeConstantWF.mono indexedReplayTypeEnv_le_leafEnv
+
+theorem indexedReplayNodeEnv_le_nilEnv :
+    indexedReplayNodeEnv ≤ indexedReplayNilEnv :=
+  VEnv.addConst_le indexedReplay_addNil
+
+theorem indexedReplayNilEnv_ordered : indexedReplayNilEnv.Ordered := by
+  refine .const indexedReplayNodeEnv_ordered ?_ indexedReplay_addNil
+  exact indexedTreeNilConstantWF.mono
+    (indexedReplayTypeEnv_le_leafEnv.trans
+      indexedReplayLeafEnv_le_nodeEnv)
+
+theorem indexedReplayNilEnv_le_ctorEnv :
+    indexedReplayNilEnv ≤ indexedReplayCtorEnv :=
+  VEnv.addConst_le indexedReplay_addCons
+
+theorem indexedReplayCtorEnv_ordered : indexedReplayCtorEnv.Ordered := by
+  refine .const indexedReplayNilEnv_ordered ?_ indexedReplay_addCons
+  exact indexedTreeConsConstantWF.mono
+    (indexedReplayTypeEnv_le_leafEnv.trans
+      (indexedReplayLeafEnv_le_nodeEnv.trans
+        indexedReplayNodeEnv_le_nilEnv))
+
+theorem indexedReplayInput_le_ctorEnv :
+    natFinalEnv ≤ indexedReplayCtorEnv := by
+  exact (VEnv.addConst_le indexedReplay_addFirstType).trans
+    ((VEnv.addConst_le indexedReplay_addSecondType).trans
+      (indexedReplayTypeEnv_le_leafEnv.trans
+        (indexedReplayLeafEnv_le_nodeEnv.trans
+          (indexedReplayNodeEnv_le_nilEnv.trans
+            indexedReplayNilEnv_le_ctorEnv))))
+
+theorem indexedReplayBlock_le_ctorEnv :
+    indexedTreeBlockEnv ≤ indexedReplayCtorEnv := by
+  exact indexedReplayTypeEnv_le_leafEnv.trans
+    (indexedReplayLeafEnv_le_nodeEnv.trans
+      (indexedReplayNodeEnv_le_nilEnv.trans
+        indexedReplayNilEnv_le_ctorEnv))
+
+theorem indexedReplayGenerationEnv :
+    BlockGenerationEnv indexedTreeGeneration indexedReplayCtorEnv := by
+  apply indexedTreeBlockGenerationWF.toBlockGenerationEnv
+    indexedReplayInput_le_ctorEnv indexedReplayBlock_le_ctorEnv
+    indexedReplayCtorEnv_ordered
+  · intro family hfamily
+    have hfamilies : indexedTreeGeneration.families =
+        [indexedTreeGeneration.families[0],
+          indexedTreeGeneration.families[1]] := rfl
+    rw [hfamilies] at hfamily
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hfamily
+    rcases hfamily with rfl | rfl <;> rfl
+  · intro constructor hconstructor
+    have hconstructors : indexedTreeGeneration.flatCtors =
+        [indexedTreeGeneration.flatCtors[0],
+          indexedTreeGeneration.flatCtors[1],
+          indexedTreeGeneration.flatCtors[2],
+          indexedTreeGeneration.flatCtors[3]] := rfl
+    rw [hconstructors] at hconstructor
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hconstructor
+    rcases hconstructor with rfl | rfl | rfl | rfl <;> rfl
+
+theorem indexedReplayFirstRecEnv_ordered :
+    indexedReplayFirstRecEnv.Ordered := by
+  refine .const indexedReplayCtorEnv_ordered ?_
+    indexedReplay_addFirstRec
+  exact indexedReplayGenerationEnv.recursor_wf (.head _)
+
+theorem indexedReplayCtorEnv_le_firstRecEnv :
+    indexedReplayCtorEnv ≤ indexedReplayFirstRecEnv :=
+  VEnv.addConst_le indexedReplay_addFirstRec
+
+theorem indexedReplayRecEnv_ordered : indexedReplayRecEnv.Ordered := by
+  refine .const indexedReplayFirstRecEnv_ordered ?_
+    indexedReplay_addSecondRec
+  exact (indexedReplayGenerationEnv.recursor_wf
+    (.tail _ (.head _))).mono indexedReplayCtorEnv_le_firstRecEnv
+
+theorem indexedTreeKernelInfo_tr :
+    TrConstVal .safe natFinalEnv indexedTreeKernelInfo
+      indexedTreeType.toVConstVal := by
+  have hNat : natFinalEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr natFinalEnv indexedTreeKernelInfo.levelParams []
+      indexedTreeKernelInfo.type indexedTreeType.type := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS natFinalEnv_ordered trivial
+    (indexedTreeFamilyTypeWF indexedTreeType (.inl rfl))
+
+theorem indexedTreeListKernelInfo_tr :
+    TrConstVal .safe indexedReplayFirstTypeEnv indexedTreeListKernelInfo
+      indexedTreeListType.toVConstVal := by
+  have hNat : indexedReplayFirstTypeEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayFirstTypeEnv
+      indexedTreeListKernelInfo.levelParams [] indexedTreeListKernelInfo.type
+      indexedTreeListType.type := by tr_type_expr_tac
+  exact hshape.to_trExprS indexedReplayFirstTypeEnv_ordered trivial
+    ((indexedTreeFamilyTypeWF indexedTreeListType (.inr rfl)).mono
+      (VEnv.addConst_le indexedReplay_addFirstType))
+
+theorem indexedTreeLeafKernelInfo_tr :
+    TrConstVal .safe indexedReplayTypeEnv indexedTreeLeafKernelInfo
+      indexedTreeType.ctors[0] := by
+  have hNat : indexedReplayTypeEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : indexedReplayTypeEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedReplayTypeEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedReplayTypeEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedReplayTypeEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayTypeEnv
+      indexedTreeLeafKernelInfo.levelParams [] indexedTreeLeafKernelInfo.type
+      indexedTreeType.ctors[0].type := by tr_type_expr_tac
+  exact hshape.to_trExprS indexedReplayTypeEnv_ordered trivial
+    (indexedTreeCtorWF indexedTreeType.ctors[0]
+      (.inl (by simp [indexedTreeType])))
+
+theorem indexedTreeNodeKernelInfo_tr :
+    TrConstVal .safe indexedReplayLeafEnv indexedTreeNodeKernelInfo
+      indexedTreeType.ctors[1] := by
+  have hNat : indexedReplayLeafEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : indexedReplayLeafEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedReplayLeafEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedReplayLeafEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedReplayLeafEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayLeafEnv
+      indexedTreeNodeKernelInfo.levelParams [] indexedTreeNodeKernelInfo.type
+      indexedTreeType.ctors[1].type := by tr_type_expr_tac
+  exact hshape.to_trExprS indexedReplayLeafEnv_ordered trivial
+    ((indexedTreeCtorWF indexedTreeType.ctors[1]
+      (.inl (by simp [indexedTreeType]))).mono
+        indexedReplayTypeEnv_le_leafEnv)
+
+theorem indexedTreeListNilKernelInfo_tr :
+    TrConstVal .safe indexedReplayNodeEnv indexedTreeListNilKernelInfo
+      indexedTreeListType.ctors[0] := by
+  have hNat : indexedReplayNodeEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : indexedReplayNodeEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedReplayNodeEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedReplayNodeEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedReplayNodeEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayNodeEnv
+      indexedTreeListNilKernelInfo.levelParams []
+      indexedTreeListNilKernelInfo.type indexedTreeListType.ctors[0].type := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS indexedReplayNodeEnv_ordered trivial
+    ((indexedTreeCtorWF indexedTreeListType.ctors[0]
+      (.inr (by simp [indexedTreeListType]))).mono
+        (indexedReplayTypeEnv_le_leafEnv.trans
+          indexedReplayLeafEnv_le_nodeEnv))
+
+theorem indexedTreeListConsKernelInfo_tr :
+    TrConstVal .safe indexedReplayNilEnv indexedTreeListConsKernelInfo
+      indexedTreeListType.ctors[1] := by
+  have hNat : indexedReplayNilEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : indexedReplayNilEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedReplayNilEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedReplayNilEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedReplayNilEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayNilEnv
+      indexedTreeListConsKernelInfo.levelParams []
+      indexedTreeListConsKernelInfo.type indexedTreeListType.ctors[1].type := by
+    tr_type_expr_tac
+  exact hshape.to_trExprS indexedReplayNilEnv_ordered trivial
+    ((indexedTreeCtorWF indexedTreeListType.ctors[1]
+      (.inr (by simp [indexedTreeListType]))).mono
+        (indexedReplayTypeEnv_le_leafEnv.trans
+          (indexedReplayLeafEnv_le_nodeEnv.trans
+            indexedReplayNodeEnv_le_nilEnv)))
+
+theorem indexedTreeRecKernelInfo_tr :
+    TrConstVal .safe indexedReplayCtorEnv indexedTreeRecKernelInfo
+      indexedTreeGeneration.recursors[0] := by
+  have hNat : indexedReplayCtorEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : indexedReplayCtorEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedReplayCtorEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedReplayCtorEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedReplayCtorEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  have hLeaf : indexedReplayCtorEnv.constants ``IndexedTree.leaf =
+      some indexedTreeType.ctors[0].toVConstant := rfl
+  have hNode : indexedReplayCtorEnv.constants ``IndexedTree.node =
+      some indexedTreeType.ctors[1].toVConstant := rfl
+  have hNil : indexedReplayCtorEnv.constants ``IndexedTreeList.nil =
+      some indexedTreeListType.ctors[0].toVConstant := rfl
+  have hCons : indexedReplayCtorEnv.constants ``IndexedTreeList.cons =
+      some indexedTreeListType.ctors[1].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayCtorEnv
+      indexedTreeRecKernelInfo.levelParams [] indexedTreeRecKernelInfo.type
+      indexedTreeGeneration.recursors[0].type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := indexedReplayGenerationEnv.recursor_wf (.head _)
+  exact hshape.to_trExprS indexedReplayCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+theorem indexedTreeListRecKernelInfo_tr :
+    TrConstVal .safe indexedReplayFirstRecEnv indexedTreeListRecKernelInfo
+      indexedTreeGeneration.recursors[1] := by
+  have hNat : indexedReplayFirstRecEnv.constants ``Nat =
+      some InductiveFixtures.natType.toVConstant := rfl
+  have hZero : indexedReplayFirstRecEnv.constants ``Nat.zero =
+      some InductiveFixtures.natType.ctors[0].toVConstant := rfl
+  have hSucc : indexedReplayFirstRecEnv.constants ``Nat.succ =
+      some InductiveFixtures.natType.ctors[1].toVConstant := rfl
+  have hTree : indexedReplayFirstRecEnv.constants ``IndexedTree =
+      some indexedTreeType.toVConstant := rfl
+  have hTreeList : indexedReplayFirstRecEnv.constants ``IndexedTreeList =
+      some indexedTreeListType.toVConstant := rfl
+  have hLeaf : indexedReplayFirstRecEnv.constants ``IndexedTree.leaf =
+      some indexedTreeType.ctors[0].toVConstant := rfl
+  have hNode : indexedReplayFirstRecEnv.constants ``IndexedTree.node =
+      some indexedTreeType.ctors[1].toVConstant := rfl
+  have hNil : indexedReplayFirstRecEnv.constants ``IndexedTreeList.nil =
+      some indexedTreeListType.ctors[0].toVConstant := rfl
+  have hCons : indexedReplayFirstRecEnv.constants ``IndexedTreeList.cons =
+      some indexedTreeListType.ctors[1].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr indexedReplayFirstRecEnv
+      indexedTreeListRecKernelInfo.levelParams []
+      indexedTreeListRecKernelInfo.type
+      indexedTreeGeneration.recursors[1].type := by tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := indexedReplayGenerationEnv.recursor_wf
+    (.tail _ (.head _))
+  exact hshape.to_trExprS indexedReplayFirstRecEnv_ordered trivial
+    ⟨.sort u, hrec.mono indexedReplayCtorEnv_le_firstRecEnv⟩
+
+def indexedReplayFirstTypeMap : ConstMap :=
+  natMap.insert ``IndexedTree indexedTreeKernelInfo
+
+def indexedReplayTypeMap : ConstMap :=
+  indexedReplayFirstTypeMap.insert ``IndexedTreeList
+    indexedTreeListKernelInfo
+
+def indexedReplayLeafMap : ConstMap :=
+  indexedReplayTypeMap.insert ``IndexedTree.leaf indexedTreeLeafKernelInfo
+
+def indexedReplayNodeMap : ConstMap :=
+  indexedReplayLeafMap.insert ``IndexedTree.node indexedTreeNodeKernelInfo
+
+def indexedReplayNilMap : ConstMap :=
+  indexedReplayNodeMap.insert ``IndexedTreeList.nil
+    indexedTreeListNilKernelInfo
+
+def indexedReplayCtorMap : ConstMap :=
+  indexedReplayNilMap.insert ``IndexedTreeList.cons
+    indexedTreeListConsKernelInfo
+
+def indexedReplayFirstRecMap : ConstMap :=
+  indexedReplayCtorMap.insert ``IndexedTree.rec indexedTreeRecKernelInfo
+
+def indexedReplayMap : ConstMap :=
+  indexedReplayFirstRecMap.insert ``IndexedTreeList.rec
+    indexedTreeListRecKernelInfo
+
+theorem indexedReplayFirstType_fresh :
+    natMap.find? ``IndexedTree = none := by
+  rw [natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayFirstTypeMap_wf : indexedReplayFirstTypeMap.WF :=
+  nat_aligned.map_wf.insert _ _ indexedReplayFirstType_fresh
+
+theorem indexedReplaySecondType_fresh :
+    indexedReplayFirstTypeMap.find? ``IndexedTreeList = none := by
+  rw [indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayTypeMap_wf : indexedReplayTypeMap.WF :=
+  indexedReplayFirstTypeMap_wf.insert _ _ indexedReplaySecondType_fresh
+
+theorem indexedReplayLeaf_fresh :
+    indexedReplayTypeMap.find? ``IndexedTree.leaf = none := by
+  rw [indexedReplayTypeMap, indexedReplayFirstTypeMap_wf.find?_insert,
+    indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayLeafMap_wf : indexedReplayLeafMap.WF :=
+  indexedReplayTypeMap_wf.insert _ _ indexedReplayLeaf_fresh
+
+theorem indexedReplayNode_fresh :
+    indexedReplayLeafMap.find? ``IndexedTree.node = none := by
+  rw [indexedReplayLeafMap, indexedReplayTypeMap_wf.find?_insert,
+    indexedReplayTypeMap, indexedReplayFirstTypeMap_wf.find?_insert,
+    indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayNodeMap_wf : indexedReplayNodeMap.WF :=
+  indexedReplayLeafMap_wf.insert _ _ indexedReplayNode_fresh
+
+theorem indexedReplayNil_fresh :
+    indexedReplayNodeMap.find? ``IndexedTreeList.nil = none := by
+  rw [indexedReplayNodeMap, indexedReplayLeafMap_wf.find?_insert,
+    indexedReplayLeafMap, indexedReplayTypeMap_wf.find?_insert,
+    indexedReplayTypeMap, indexedReplayFirstTypeMap_wf.find?_insert,
+    indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayNilMap_wf : indexedReplayNilMap.WF :=
+  indexedReplayNodeMap_wf.insert _ _ indexedReplayNil_fresh
+
+theorem indexedReplayCons_fresh :
+    indexedReplayNilMap.find? ``IndexedTreeList.cons = none := by
+  rw [indexedReplayNilMap, indexedReplayNodeMap_wf.find?_insert,
+    indexedReplayNodeMap, indexedReplayLeafMap_wf.find?_insert,
+    indexedReplayLeafMap, indexedReplayTypeMap_wf.find?_insert,
+    indexedReplayTypeMap, indexedReplayFirstTypeMap_wf.find?_insert,
+    indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayCtorMap_wf : indexedReplayCtorMap.WF :=
+  indexedReplayNilMap_wf.insert _ _ indexedReplayCons_fresh
+
+theorem indexedReplayFirstRec_fresh :
+    indexedReplayCtorMap.find? ``IndexedTree.rec = none := by
+  rw [indexedReplayCtorMap, indexedReplayNilMap_wf.find?_insert,
+    indexedReplayNilMap, indexedReplayNodeMap_wf.find?_insert,
+    indexedReplayNodeMap, indexedReplayLeafMap_wf.find?_insert,
+    indexedReplayLeafMap, indexedReplayTypeMap_wf.find?_insert,
+    indexedReplayTypeMap, indexedReplayFirstTypeMap_wf.find?_insert,
+    indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayFirstRecMap_wf : indexedReplayFirstRecMap.WF :=
+  indexedReplayCtorMap_wf.insert _ _ indexedReplayFirstRec_fresh
+
+theorem indexedReplaySecondRec_fresh :
+    indexedReplayFirstRecMap.find? ``IndexedTreeList.rec = none := by
+  rw [indexedReplayFirstRecMap, indexedReplayCtorMap_wf.find?_insert,
+    indexedReplayCtorMap, indexedReplayNilMap_wf.find?_insert,
+    indexedReplayNilMap, indexedReplayNodeMap_wf.find?_insert,
+    indexedReplayNodeMap, indexedReplayLeafMap_wf.find?_insert,
+    indexedReplayLeafMap, indexedReplayTypeMap_wf.find?_insert,
+    indexedReplayTypeMap, indexedReplayFirstTypeMap_wf.find?_insert,
+    indexedReplayFirstTypeMap, nat_aligned.map_wf.find?_insert,
+    natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem indexedReplayMap_wf : indexedReplayMap.WF :=
+  indexedReplayFirstRecMap_wf.insert _ _ indexedReplaySecondRec_fresh
+
+theorem indexedReplay_treeRec_lookup :
+    indexedReplayMap.find? ``IndexedTree.rec =
+      some indexedTreeRecKernelInfo := by
+  rw [indexedReplayMap, indexedReplayFirstRecMap_wf.find?_insert,
+    indexedReplayFirstRecMap, indexedReplayCtorMap_wf.find?_insert]
+  rfl
+
+theorem indexedReplay_treeListRec_lookup :
+    indexedReplayMap.find? ``IndexedTreeList.rec =
+      some indexedTreeListRecKernelInfo := by
+  rw [indexedReplayMap, indexedReplayFirstRecMap_wf.find?_insert]
+  rfl
+
+def indexedTreeAddInductBlockTrace :
+    AddInductBlockTrace natMap natFinalEnv indexedTreeDecl
+      indexedReplayMap indexedTreeFinalEnv where
+  generation := indexedTreeGeneration
+  blockEnv := indexedTreeBlockEnv
+  generation_wf := indexedTreeBlockGenerationWF
+  typeMap := indexedReplayTypeMap
+  typeEnv := indexedReplayTypeEnv
+  ctorMap := indexedReplayCtorMap
+  ctorEnv := indexedReplayCtorEnv
+  recEnv := indexedReplayRecEnv
+  addTypes := .cons {
+      info := indexedTreeKernelInfo
+      kind_eq := by simp [indexedTreeKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeKernelInfo_tr
+      map_fresh := indexedReplayFirstType_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := indexedTreeListKernelInfo
+      kind_eq := by simp [indexedTreeListKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeListKernelInfo_tr
+      map_fresh := indexedReplaySecondType_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+  addCtors := .cons {
+      info := indexedTreeLeafKernelInfo
+      kind_eq := by simp [indexedTreeLeafKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeLeafKernelInfo_tr
+      map_fresh := indexedReplayLeaf_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := indexedTreeNodeKernelInfo
+      kind_eq := by simp [indexedTreeNodeKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeNodeKernelInfo_tr
+      map_fresh := indexedReplayNode_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := indexedTreeListNilKernelInfo
+      kind_eq := by simp [indexedTreeListNilKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeListNilKernelInfo_tr
+      map_fresh := indexedReplayNil_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := indexedTreeListConsKernelInfo
+      kind_eq := by simp [indexedTreeListConsKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeListConsKernelInfo_tr
+      map_fresh := indexedReplayCons_fresh
+      env_add := rfl
+      map_add := rfl } .nil)))
+  addRecs := .cons {
+      info := indexedTreeRecKernelInfo
+      kind_eq := by simp [indexedTreeRecKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeRecKernelInfo_tr
+      map_fresh := indexedReplayFirstRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := indexedTreeListRecKernelInfo
+      kind_eq := by simp [indexedTreeListRecKernelInfo,
+        InductConstantKind.Matches]
+      tr := indexedTreeListRecKernelInfo_tr
+      map_fresh := indexedReplaySecondRec_fresh
+      env_add := rfl
+      map_add := rfl } .nil)
+  recK := by
+    intro recursor hrecursor
+    have hrecs : indexedTreeGeneration.recursors =
+        [indexedTreeGeneration.recursors[0],
+          indexedTreeGeneration.recursors[1]] := rfl
+    rw [hrecs] at hrecursor
+    simp only [List.mem_cons, List.not_mem_nil, or_false] at hrecursor
+    rcases hrecursor with rfl | rfl
+    · exact ⟨indexedTreeRecKernelInfo,
+        indexedReplay_treeRec_lookup, by decide⟩
+    · exact ⟨indexedTreeListRecKernelInfo,
+        indexedReplay_treeListRec_lookup, by decide⟩
+  addRules := ⟨rfl⟩
+
+theorem indexedTreeAddInductBlock :
+    AddInductBlock natMap natFinalEnv indexedTreeDecl
+      indexedReplayMap indexedTreeFinalEnv :=
+  ⟨indexedTreeAddInductBlockTrace⟩
+
+theorem indexedTree_trEnv' :
+    TrEnv' .safe indexedReplayMap false indexedTreeFinalEnv :=
+  .inductBlock indexedTreeAddInductBlock nat_trEnv'
+
+theorem indexedTree_verify_env_wf : indexedTreeFinalEnv.WF :=
+  indexedTree_trEnv'.wf
+
+theorem indexedTree_verify_aligned :
+    Aligned .safe indexedReplayMap indexedTreeFinalEnv :=
+  indexedTree_trEnv'.aligned
+
+
+
+/-! ## Trust-boundary manifests -/
+
+/- The semantic generation and raw public transaction remain inside the
+accepted Theory trust baseline. -/
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.treeBlockGenerationWF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTreeBlockGenerationWF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.treeFinalEnv_ordered [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTreeFinalEnv_ordered [propext, Classical.choice, Quot.sound]
+
+/- The implementation metadata replay is now `sorryAx`-free and inherits only
+the already classified persistent-map contracts; fixture-local native-decision
+axioms are deliberately absent. -/
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.treeAddInductBlock [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTreeAddInductBlock [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.tree_verify_aligned [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTree_verify_aligned [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.treeCheckedBlockWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTreeCheckedBlockWF [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.treeNormalizationBlockWF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTreeNormalizationBlockWF [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.treeValidationCertificate [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.MutualInductiveReplayFixtures.indexedTreeValidationCertificate [propext, Classical.choice, Quot.sound]
+
+end Ix.Theory.Named.MutualInductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/NestedReplay.lean b/Ix/Theory/Named/Verify/Environment/NestedReplay.lean
new file mode 100644
index 000000000..e06fb7d68
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/NestedReplay.lean
@@ -0,0 +1,3402 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.SingletonParityReplay
+import Ix.Theory.Named.Verify.Environment.NestedTransformation
+
+/-!
+# Nested environment replay (Spec-09C)
+
+Both ladder fixtures replayed from real stored metadata: the rose tree
+over the completed `List` environment and the nested-indexed family over
+a staged `PVec` boundary.  Each inserts its stored constants through
+`AddInductNestedTrace`, proves the `NestedBlockChecked.WF` package by
+direct concrete typing derivations over the exact phase environments,
+and drives the final map and environment through `TrEnv'.inductNested`,
+with `Ordered` derived and the transitional closures guarded.
+-/
+
+namespace Ix.Theory.Named.NestedReplayFixtures
+
+open Lean
+open Ix.Theory.Named.InductiveReplayFixtures
+open Ix.Theory.Named.NestedRepresentation
+open Ix.Theory.Named.NestedInductiveFixtures
+open VInductDecl
+
+local instance : Inhabited VEnv := ⟨.empty⟩
+local instance : Inhabited VConstVal := ⟨⟨⟨0, .sort .zero⟩, .anonymous⟩⟩
+
+/-! ## The completed List replay as the input boundary -/
+
+theorem listTrEnv07 : TrEnv' .safe listMap07 false listFinalEnv07 :=
+  .induct listAddInduct07 .empty
+
+theorem listFinalOrdered07 : listFinalEnv07.Ordered :=
+  listTrEnv07.wf.ordered
+
+/-! ## The translated rose source and its nested artifact -/
+
+def roseSourceV : VInductDecl where
+  uvars := 1
+  nparams := 1
+  types :=
+    [{ name := ``RoseTree
+       uvars := 1
+       type := nestedConstVType09A% RoseTree
+       ctors :=
+         [⟨⟨1, nestedConstVType09A% RoseTree.node⟩, ``RoseTree.node⟩] }]
+
+def roseNestedC? : Option (NestedBlockChecked roseSourceV) :=
+  nestedBlockChecked? [listTarget] roseSourceV
+
+#guard roseNestedC?.isSome
+
+def roseNestedC : NestedBlockChecked roseSourceV :=
+  roseNestedC?.get (by native_decide)
+
+/-! ## Stored metadata and phase maps/environments -/
+
+def roseInfo09 : ConstantInfo := kernelInductInfo% RoseTree
+def roseNodeInfo09 : ConstantInfo := kernelCtorInfo% RoseTree.node
+def roseRecInfo09 : ConstantInfo := kernelRecInfo% RoseTree.rec
+def roseRec1Info09 : ConstantInfo := kernelRecInfo% RoseTree.rec_1
+
+def roseFamilyV : VConstVal := roseSourceV.types[0].toVConstVal
+def roseNodeV : VConstVal := roseSourceV.types[0].ctors[0]
+def roseRecV : VConstVal := roseNestedC.recursors[0]!
+def roseRec1V : VConstVal := roseNestedC.recursors[1]!
+
+#guard roseRecV.name == ``RoseTree.rec
+#guard roseRec1V.name == `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1
+
+def roseTypeMap09 : ConstMap := listMap07.insert ``RoseTree roseInfo09
+def roseCtorMap09 : ConstMap := roseTypeMap09.insert ``RoseTree.node roseNodeInfo09
+def roseRecMap09 : ConstMap := roseCtorMap09.insert ``RoseTree.rec roseRecInfo09
+def roseMap09 : ConstMap :=
+  roseRecMap09.insert `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1 roseRec1Info09
+
+def roseTypeEnv09 : VEnv :=
+  (listFinalEnv07.addConst roseFamilyV.name roseFamilyV.toVConstant).get!
+def roseCtorEnv09 : VEnv :=
+  (roseTypeEnv09.addConst roseNodeV.name roseNodeV.toVConstant).get!
+-- the recursor and rule phase environments are defined below, over the
+-- printed literal inventories
+
+
+/-! ## Printed artifact literals
+
+The restored recursor types and rule components, printed from the
+computed artifact and tied back to it below; the concrete typing
+derivations are stated over these literals. -/
+
+/-- Printed image of `roseNestedC.recursors[0]!.type`. -/
+def roseRecTypeL : VExpr :=
+  .forallE
+    (.sort (.succ (.param 1)))
+    (.forallE
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.forallE
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.forallE
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.forallE
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.forallE
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 5))
+                (.app (.bvar 5) (.bvar 0))))))))
+
+def roseRec1TypeL : VExpr :=
+  .forallE
+    (.sort (.succ (.param 1)))
+    (.forallE
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.forallE
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.forallE
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.forallE
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.forallE
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.forallE
+                (.app
+                  (.const `List [.param 1])
+                  (.app
+                    (.const
+                      `Ix.Theory.Named.NestedRepresentation.RoseTree
+                      [.param 1])
+                    (.bvar 5)))
+                (.app (.bvar 4) (.bvar 0))))))))
+
+def roseRule0LhsL : VExpr :=
+  .lam
+    (.sort (.succ (.param 1)))
+    (.lam
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.lam
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.lam
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.lam
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.lam
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.lam
+                (.bvar 5)
+                (.lam
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 6)))
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree.rec
+                                  [.param 0, .param 1])
+                                (.bvar 7))
+                              (.bvar 6))
+                            (.bvar 5))
+                          (.bvar 4))
+                        (.bvar 3))
+                      (.bvar 2))
+                    (.app
+                      (.app
+                        (.app
+                          (.const
+                            `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                            [.param 1])
+                          (.bvar 7))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+def roseRule0RhsL : VExpr :=
+  .lam
+    (.sort (.succ (.param 1)))
+    (.lam
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.lam
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.lam
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.lam
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.lam
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.lam
+                (.bvar 5)
+                (.lam
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 6)))
+                  (.app
+                    (.app
+                      (.app (.bvar 4) (.bvar 1))
+                      (.bvar 0))
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.app
+                                  (.const
+                                    `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1
+                                    [.param 0, .param 1])
+                                  (.bvar 7))
+                                (.bvar 6))
+                              (.bvar 5))
+                            (.bvar 4))
+                          (.bvar 3))
+                        (.bvar 2))
+                      (.bvar 0))))))))))
+
+def roseRule0TypeL : VExpr :=
+  .forallE
+    (.sort (.succ (.param 1)))
+    (.forallE
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.forallE
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.forallE
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.forallE
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.forallE
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.forallE
+                (.bvar 5)
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 6)))
+                  (.app
+                    (.bvar 6)
+                    (.app
+                      (.app
+                        (.app
+                          (.const
+                            `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                            [.param 1])
+                          (.bvar 7))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+def roseRule1LhsL : VExpr :=
+  .lam
+    (.sort (.succ (.param 1)))
+    (.lam
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.lam
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.lam
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.lam
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.lam
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.app
+                (.app
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.const
+                              `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1
+                              [.param 0, .param 1])
+                            (.bvar 5))
+                          (.bvar 4))
+                        (.bvar 3))
+                      (.bvar 2))
+                    (.bvar 1))
+                  (.bvar 0))
+                (.app
+                  (.const `List.nil [.param 1])
+                  (.app
+                    (.const
+                      `Ix.Theory.Named.NestedRepresentation.RoseTree
+                      [.param 1])
+                    (.bvar 5)))))))))
+
+def roseRule1RhsL : VExpr :=
+  .lam
+    (.sort (.succ (.param 1)))
+    (.lam
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.lam
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.lam
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.lam
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.lam
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.bvar 1))))))
+
+def roseRule1TypeL : VExpr :=
+  .forallE
+    (.sort (.succ (.param 1)))
+    (.forallE
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.forallE
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.forallE
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.forallE
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.forallE
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.app
+                (.bvar 3)
+                (.app
+                  (.const `List.nil [.param 1])
+                  (.app
+                    (.const
+                      `Ix.Theory.Named.NestedRepresentation.RoseTree
+                      [.param 1])
+                    (.bvar 5)))))))))
+
+def roseRule2LhsL : VExpr :=
+  .lam
+    (.sort (.succ (.param 1)))
+    (.lam
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.lam
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.lam
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.lam
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.lam
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.lam
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 5))
+                (.lam
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 6)))
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1
+                                  [.param 0, .param 1])
+                                (.bvar 7))
+                              (.bvar 6))
+                            (.bvar 5))
+                          (.bvar 4))
+                        (.bvar 3))
+                      (.bvar 2))
+                    (.app
+                      (.app
+                        (.app
+                          (.const `List.cons [.param 1])
+                          (.app
+                            (.const
+                              `Ix.Theory.Named.NestedRepresentation.RoseTree
+                              [.param 1])
+                            (.bvar 7)))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+def roseRule2RhsL : VExpr :=
+  .lam
+    (.sort (.succ (.param 1)))
+    (.lam
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.lam
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.lam
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.lam
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.lam
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.lam
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 5))
+                (.lam
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 6)))
+                  (.app
+                    (.app
+                      (.app
+                        (.app (.bvar 2) (.bvar 1))
+                        (.bvar 0))
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.app
+                                  (.app
+                                    (.const
+                                      `Ix.Theory.Named.NestedRepresentation.RoseTree.rec
+                                      [.param 0, .param 1])
+                                    (.bvar 7))
+                                  (.bvar 6))
+                                (.bvar 5))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))
+                        (.bvar 1)))
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.app
+                                  (.const
+                                    `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1
+                                    [.param 0, .param 1])
+                                  (.bvar 7))
+                                (.bvar 6))
+                              (.bvar 5))
+                            (.bvar 4))
+                          (.bvar 3))
+                        (.bvar 2))
+                      (.bvar 0))))))))))
+
+def roseRule2TypeL : VExpr :=
+  .forallE
+    (.sort (.succ (.param 1)))
+    (.forallE
+      (.forallE
+        (.app
+          (.const
+            `Ix.Theory.Named.NestedRepresentation.RoseTree
+            [.param 1])
+          (.bvar 0))
+        (.sort (.param 0)))
+      (.forallE
+        (.forallE
+          (.app
+            (.const `List [.param 1])
+            (.app
+              (.const
+                `Ix.Theory.Named.NestedRepresentation.RoseTree
+                [.param 1])
+              (.bvar 1)))
+          (.sort (.param 0)))
+        (.forallE
+          (.forallE
+            (.bvar 2)
+            (.forallE
+              (.app
+                (.const `List [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3)))
+              (.forallE
+                (.app (.bvar 2) (.bvar 0))
+                (.app
+                  (.bvar 4)
+                  (.app
+                    (.app
+                      (.app
+                        (.const
+                          `Ix.Theory.Named.NestedRepresentation.RoseTree.node
+                          [.param 1])
+                        (.bvar 5))
+                      (.bvar 2))
+                    (.bvar 1))))))
+          (.forallE
+            (.app
+              (.bvar 1)
+              (.app
+                (.const `List.nil [.param 1])
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 3))))
+            (.forallE
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 4))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 5)))
+                  (.forallE
+                    (.app (.bvar 5) (.bvar 1))
+                    (.forallE
+                      (.app (.bvar 5) (.bvar 1))
+                      (.app
+                        (.bvar 6)
+                        (.app
+                          (.app
+                            (.app
+                              (.const `List.cons [.param 1])
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.RoseTree
+                                  [.param 1])
+                                (.bvar 8)))
+                            (.bvar 3))
+                          (.bvar 2)))))))
+              (.forallE
+                (.app
+                  (.const
+                    `Ix.Theory.Named.NestedRepresentation.RoseTree
+                    [.param 1])
+                  (.bvar 5))
+                (.forallE
+                  (.app
+                    (.const `List [.param 1])
+                    (.app
+                      (.const
+                        `Ix.Theory.Named.NestedRepresentation.RoseTree
+                        [.param 1])
+                      (.bvar 6)))
+                  (.app
+                    (.bvar 5)
+                    (.app
+                      (.app
+                        (.app
+                          (.const `List.cons [.param 1])
+                          (.app
+                            (.const
+                              `Ix.Theory.Named.NestedRepresentation.RoseTree
+                              [.param 1])
+                            (.bvar 7)))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+#guard roseRecV.type == roseRecTypeL
+#guard roseRec1V.type == roseRec1TypeL
+#guard roseNestedC.generatedRules.map (fun df => (df.uvars, df.lhs, df.rhs, df.type)) ==
+  [(2, roseRule0LhsL, roseRule0RhsL, roseRule0TypeL),
+   (2, roseRule1LhsL, roseRule1RhsL, roseRule1TypeL),
+   (2, roseRule2LhsL, roseRule2RhsL, roseRule2TypeL)]
+#guard roseRecV.uvars == 2 && roseRec1V.uvars == 2
+
+
+/-! ## Literal inventories -/
+
+def roseRecVL : VConstVal := ⟨⟨2, roseRecTypeL⟩, ``RoseTree.rec⟩
+def roseRec1VL : VConstVal :=
+  ⟨⟨2, roseRec1TypeL⟩, `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1⟩
+
+def roseRulesL : List VDefEq :=
+  [⟨2, roseRule0LhsL, roseRule0RhsL, roseRule0TypeL⟩,
+   ⟨2, roseRule1LhsL, roseRule1RhsL, roseRule1TypeL⟩,
+   ⟨2, roseRule2LhsL, roseRule2RhsL, roseRule2TypeL⟩]
+
+theorem roseRecursors_eq : roseNestedC.recursors = [roseRecVL, roseRec1VL] := by
+  native_decide
+
+theorem roseRules_eq : roseNestedC.generatedRules = roseRulesL := by
+  native_decide
+
+def roseRecEnv09 : VEnv :=
+  (roseCtorEnv09.addConst roseRecVL.name roseRecVL.toVConstant).get!
+def roseRec1Env09 : VEnv :=
+  (roseRecEnv09.addConst roseRec1VL.name roseRec1VL.toVConstant).get!
+def roseFinalEnv09 : VEnv :=
+  roseRulesL.foldl VEnv.addDefEq roseRec1Env09
+
+/-! ## Concrete constant well-formedness -/
+
+theorem roseFamilyWF09 : roseFamilyV.toVConstant.WF listFinalEnv07 :=
+  ⟨_, by type_tac⟩
+
+theorem roseTypeEnv09_eq :
+    listFinalEnv07.addConst roseFamilyV.name roseFamilyV.toVConstant =
+      some roseTypeEnv09 := rfl
+
+theorem roseTypeOrdered09 : roseTypeEnv09.Ordered :=
+  .const listFinalOrdered07 roseFamilyWF09 roseTypeEnv09_eq
+
+theorem roseNodeWF09 : roseNodeV.toVConstant.WF roseTypeEnv09 := by
+  have hList : roseTypeEnv09.constants ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : roseTypeEnv09.constants ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  exact ⟨_, by type_tac⟩
+
+
+theorem roseCtorEnv09_eq :
+    roseTypeEnv09.addConst roseNodeV.name roseNodeV.toVConstant =
+      some roseCtorEnv09 := rfl
+
+theorem roseCtorOrdered09 : roseCtorEnv09.Ordered :=
+  .const roseTypeOrdered09 roseNodeWF09 roseCtorEnv09_eq
+
+set_option maxRecDepth 4000 in
+theorem roseRecWF09 : (⟨2, roseRecTypeL⟩ : VConstant).WF roseCtorEnv09 := by
+  have hList : roseCtorEnv09.constants ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : roseCtorEnv09.constants ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hNode : roseCtorEnv09.constants ``RoseTree.node =
+      some roseNodeV.toVConstant := rfl
+  have hNil : roseCtorEnv09.constants ``List.nil =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.app (.const `List [.param 0]) (.bvar 0))⟩ := rfl
+  have hCons : roseCtorEnv09.constants ``List.cons =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.forallE (.bvar 0)
+          (.forallE (.app (.const `List [.param 0]) (.bvar 1))
+            (.app (.const `List [.param 0]) (.bvar 2))))⟩ := rfl
+  exact ⟨_, by type_tac⟩
+
+
+theorem roseRecEnv09_eq :
+    roseCtorEnv09.addConst roseRecVL.name roseRecVL.toVConstant =
+      some roseRecEnv09 := rfl
+
+theorem roseRecOrdered09 : roseRecEnv09.Ordered :=
+  .const roseCtorOrdered09 roseRecWF09 roseRecEnv09_eq
+
+set_option maxRecDepth 4000 in
+theorem roseRec1WF09 : (⟨2, roseRec1TypeL⟩ : VConstant).WF roseRecEnv09 := by
+  have hList : roseRecEnv09.constants ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : roseRecEnv09.constants ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hNode : roseRecEnv09.constants ``RoseTree.node =
+      some roseNodeV.toVConstant := rfl
+  have hNil : roseRecEnv09.constants ``List.nil =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.app (.const `List [.param 0]) (.bvar 0))⟩ := rfl
+  have hCons : roseRecEnv09.constants ``List.cons =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.forallE (.bvar 0)
+          (.forallE (.app (.const `List [.param 0]) (.bvar 1))
+            (.app (.const `List [.param 0]) (.bvar 2))))⟩ := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem roseRec1Env09_eq :
+    roseRecEnv09.addConst roseRec1VL.name roseRec1VL.toVConstant =
+      some roseRec1Env09 := rfl
+
+theorem roseRec1Ordered09 : roseRec1Env09.Ordered :=
+  .const roseRecOrdered09 roseRec1WF09 roseRec1Env09_eq
+
+
+/-! ## Rule well-formedness at the rule-phase environment -/
+
+section RuleWF
+
+set_option maxRecDepth 8000
+
+/-- The lookup hypotheses shared by every rule component derivation; the
+environment argument is any `addDefEq` extension of `roseRec1Env09`, whose
+constants agree definitionally. -/
+macro "rose_rule_hyps" e:term : tactic => `(tactic| (
+  have hList : VEnv.constants $e ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : VEnv.constants $e ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hNode : VEnv.constants $e ``RoseTree.node =
+      some roseNodeV.toVConstant := rfl
+  have hNil : VEnv.constants $e ``List.nil =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.app (.const `List [.param 0]) (.bvar 0))⟩ := rfl
+  have hCons : VEnv.constants $e ``List.cons =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.forallE (.bvar 0)
+          (.forallE (.app (.const `List [.param 0]) (.bvar 1))
+            (.app (.const `List [.param 0]) (.bvar 2))))⟩ := rfl
+  have hRec : VEnv.constants $e ``RoseTree.rec =
+      some ⟨2, roseRecTypeL⟩ := rfl
+  have hRec1 : VEnv.constants $e
+      `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1 =
+      some ⟨2, roseRec1TypeL⟩ := rfl))
+
+def roseRuleEnv1 : VEnv := roseRec1Env09.addDefEq roseRulesL[0]
+def roseRuleEnv2 : VEnv := roseRuleEnv1.addDefEq roseRulesL[1]
+
+theorem roseRule0WF09 : roseRulesL[0].WF roseRec1Env09 := by
+  constructor
+  · rose_rule_hyps roseRec1Env09; type_tac
+  · rose_rule_hyps roseRec1Env09; type_tac
+
+theorem roseRule1WF09 : roseRulesL[1].WF roseRuleEnv1 := by
+  constructor
+  · rose_rule_hyps roseRuleEnv1; type_tac
+  · rose_rule_hyps roseRuleEnv1; type_tac
+
+theorem roseRule2WF09 : roseRulesL[2].WF roseRuleEnv2 := by
+  constructor
+  · rose_rule_hyps roseRuleEnv2; type_tac
+  · rose_rule_hyps roseRuleEnv2; type_tac
+
+end RuleWF
+
+
+/-! ## The semantic package -/
+
+theorem roseTypesFold_eq :
+    roseSourceV.blockTypeConstants.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) listFinalEnv07 =
+      some roseTypeEnv09 := rfl
+
+theorem roseCtorsFold_eq :
+    roseSourceV.blockConstructorConstants.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) roseTypeEnv09 =
+      some roseCtorEnv09 := rfl
+
+theorem roseRecsFold_eq :
+    roseNestedC.recursors.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) roseCtorEnv09 =
+      some roseRec1Env09 := by
+  rw [roseRecursors_eq]; rfl
+
+theorem roseNestedWF09 : roseNestedC.WF listFinalEnv07 := by
+  refine ⟨⟨roseFamilyWF09, fun env' h => ?_⟩, fun {typeEnv} h => ?_,
+    fun {typeEnv ctorEnv} hT hC => ?_, fun {typeEnv ctorEnv recEnv} hT hC hR => ?_⟩
+  · cases Option.some.inj (roseTypeEnv09_eq.symm.trans h)
+    exact trivial
+  · cases Option.some.inj (roseTypesFold_eq.symm.trans h)
+    exact ⟨roseNodeWF09, fun env' h' => by
+      cases Option.some.inj (roseCtorEnv09_eq.symm.trans h')
+      exact trivial⟩
+  · cases Option.some.inj (roseTypesFold_eq.symm.trans hT)
+    cases Option.some.inj (roseCtorsFold_eq.symm.trans hC)
+    rw [roseRecursors_eq]
+    exact ⟨roseRecWF09, fun env' h' => by
+      cases Option.some.inj (roseRecEnv09_eq.symm.trans h')
+      exact ⟨roseRec1WF09, fun env'' h'' => by
+        cases Option.some.inj (roseRec1Env09_eq.symm.trans h'')
+        exact trivial⟩⟩
+  · cases Option.some.inj (roseTypesFold_eq.symm.trans hT)
+    cases Option.some.inj (roseCtorsFold_eq.symm.trans hC)
+    cases Option.some.inj (roseRecsFold_eq.symm.trans hR)
+    rw [roseRules_eq]
+    exact ⟨roseRule0WF09, roseRule1WF09, roseRule2WF09, trivial⟩
+
+
+/-! ## Freshness of the stored insertions -/
+
+theorem listMapWF07 : listMap07.WF :=
+  listCtorMapWF07.insert _ _ listRecFresh07
+
+theorem roseTypeFresh09 : listMap07.find? ``RoseTree = none := by
+  rw [listMap07, listCtorMapWF07.find?_insert, listCtorMap07,
+    listNilMapWF07.find?_insert, listNilMap07,
+    listTypeMapWF07.find?_insert, listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem roseTypeMapWF09 : roseTypeMap09.WF :=
+  listMapWF07.insert _ _ roseTypeFresh09
+
+theorem roseNodeFresh09 : roseTypeMap09.find? ``RoseTree.node = none := by
+  rw [roseTypeMap09, listMapWF07.find?_insert, listMap07,
+    listCtorMapWF07.find?_insert, listCtorMap07,
+    listNilMapWF07.find?_insert, listNilMap07,
+    listTypeMapWF07.find?_insert, listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem roseCtorMapWF09 : roseCtorMap09.WF :=
+  roseTypeMapWF09.insert _ _ roseNodeFresh09
+
+theorem roseRecFresh09 : roseCtorMap09.find? ``RoseTree.rec = none := by
+  rw [roseCtorMap09, roseTypeMapWF09.find?_insert, roseTypeMap09,
+    listMapWF07.find?_insert, listMap07,
+    listCtorMapWF07.find?_insert, listCtorMap07,
+    listNilMapWF07.find?_insert, listNilMap07,
+    listTypeMapWF07.find?_insert, listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem roseRecMapWF09 : roseRecMap09.WF :=
+  roseCtorMapWF09.insert _ _ roseRecFresh09
+
+theorem roseRec1Fresh09 :
+    roseRecMap09.find? `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1 = none := by
+  rw [roseRecMap09, roseCtorMapWF09.find?_insert, roseCtorMap09,
+    roseTypeMapWF09.find?_insert, roseTypeMap09,
+    listMapWF07.find?_insert, listMap07,
+    listCtorMapWF07.find?_insert, listCtorMap07,
+    listNilMapWF07.find?_insert, listNilMap07,
+    listTypeMapWF07.find?_insert, listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+/-! ## Stored-metadata translations -/
+
+theorem roseInfoTr09 :
+    TrConstVal .safe listFinalEnv07 roseInfo09 roseFamilyV := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr listFinalEnv07 roseInfo09.levelParams []
+      roseInfo09.type roseFamilyV.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS listFinalOrdered07 trivial ⟨_, by type_tac⟩
+
+theorem roseNodeTr09 :
+    TrConstVal .safe roseTypeEnv09 roseNodeInfo09 roseNodeV := by
+  have hList : roseTypeEnv09.constants ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : roseTypeEnv09.constants ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr roseTypeEnv09 roseNodeInfo09.levelParams []
+      roseNodeInfo09.type roseNodeV.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS roseTypeOrdered09 trivial ⟨_, by type_tac⟩
+
+theorem roseRecTr09 :
+    TrConstVal .safe roseCtorEnv09 roseRecInfo09 roseRecVL := by
+  have hList : roseCtorEnv09.constants ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : roseCtorEnv09.constants ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hNode : roseCtorEnv09.constants ``RoseTree.node =
+      some roseNodeV.toVConstant := rfl
+  have hNil : roseCtorEnv09.constants ``List.nil =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.app (.const `List [.param 0]) (.bvar 0))⟩ := rfl
+  have hCons : roseCtorEnv09.constants ``List.cons =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.forallE (.bvar 0)
+          (.forallE (.app (.const `List [.param 0]) (.bvar 1))
+            (.app (.const `List [.param 0]) (.bvar 2))))⟩ := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr roseCtorEnv09 roseRecInfo09.levelParams []
+      roseRecInfo09.type roseRecVL.toVConstant.type := by
+    tr_type_expr_tac
+  obtain ⟨u, hty⟩ := roseRecWF09
+  exact shape.to_trExprS roseCtorOrdered09 trivial ⟨_, hty⟩
+
+theorem roseRec1Tr09 :
+    TrConstVal .safe roseRecEnv09 roseRec1Info09 roseRec1VL := by
+  have hList : roseRecEnv09.constants ``List =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hRose : roseRecEnv09.constants ``RoseTree =
+      some ⟨1, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))⟩ := rfl
+  have hNode : roseRecEnv09.constants ``RoseTree.node =
+      some roseNodeV.toVConstant := rfl
+  have hNil : roseRecEnv09.constants ``List.nil =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.app (.const `List [.param 0]) (.bvar 0))⟩ := rfl
+  have hCons : roseRecEnv09.constants ``List.cons =
+      some ⟨1, .forallE (.sort (.succ (.param 0)))
+        (.forallE (.bvar 0)
+          (.forallE (.app (.const `List [.param 0]) (.bvar 1))
+            (.app (.const `List [.param 0]) (.bvar 2))))⟩ := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr roseRecEnv09 roseRec1Info09.levelParams []
+      roseRec1Info09.type roseRec1VL.toVConstant.type := by
+    tr_type_expr_tac
+  obtain ⟨u, hty⟩ := roseRec1WF09
+  exact shape.to_trExprS roseRecOrdered09 trivial ⟨_, hty⟩
+
+
+/-! ## Recursor K metadata and stored lookups -/
+
+theorem roseKTarget09 : roseNestedC.generation.kTarget = false := by
+  native_decide
+
+theorem roseRecLookup09 :
+    roseMap09.find? ``RoseTree.rec = some roseRecInfo09 := by
+  rw [roseMap09, roseRecMapWF09.find?_insert]
+  simp [roseRecMap09, roseCtorMapWF09.find?_insert]
+
+theorem roseRec1Lookup09 :
+    roseMap09.find? `Ix.Theory.Named.NestedRepresentation.RoseTree.rec_1 =
+      some roseRec1Info09 := by
+  rw [roseMap09, roseRecMapWF09.find?_insert]
+  simp
+
+theorem roseRecK09 :
+    RecursorMapKMatches roseMap09 roseNestedC.recursors
+      roseNestedC.generation.kTarget := by
+  rw [roseRecursors_eq, roseKTarget09]
+  intro recursor hmem
+  rcases List.mem_cons.1 hmem with rfl | hmem
+  · exact ⟨roseRecInfo09, roseRecLookup09, by decide⟩
+  rcases List.mem_cons.1 hmem with rfl | hmem
+  · exact ⟨roseRec1Info09, roseRec1Lookup09, by decide⟩
+  · cases hmem
+
+/-! ## The nested alignment trace and its `TrEnv'` drive -/
+
+def roseTrace09 :
+    AddInductNestedTrace listMap07 listFinalEnv07 roseSourceV
+      roseMap09 roseFinalEnv09 where
+  nested := roseNestedC
+  nested_wf := roseNestedWF09
+  typeMap := roseTypeMap09
+  typeEnv := roseTypeEnv09
+  ctorMap := roseCtorMap09
+  ctorEnv := roseCtorEnv09
+  recEnv := roseRec1Env09
+  addTypes := .cons
+    { info := roseInfo09
+      kind_eq := trivial
+      tr := roseInfoTr09
+      map_fresh := roseTypeFresh09
+      env_add := roseTypeEnv09_eq
+      map_add := rfl } .nil
+  addCtors := .cons
+    { info := roseNodeInfo09
+      kind_eq := trivial
+      tr := roseNodeTr09
+      map_fresh := roseNodeFresh09
+      env_add := roseCtorEnv09_eq
+      map_add := rfl } .nil
+  addRecs := roseRecursors_eq ▸ .cons
+    { info := roseRecInfo09
+      kind_eq := trivial
+      tr := roseRecTr09
+      map_fresh := roseRecFresh09
+      env_add := roseRecEnv09_eq
+      map_add := rfl } (.cons
+    { info := roseRec1Info09
+      kind_eq := trivial
+      tr := roseRec1Tr09
+      map_fresh := roseRec1Fresh09
+      env_add := roseRec1Env09_eq
+      map_add := rfl } .nil)
+  recK := roseRecK09
+  addRules := ⟨by rw [roseRules_eq]; rfl⟩
+
+theorem roseAddInductNested09 :
+    AddInductNested listMap07 listFinalEnv07 roseSourceV
+      roseMap09 roseFinalEnv09 :=
+  ⟨roseTrace09⟩
+
+/-- The rose-tree nested declaration, replayed from real stored metadata
+over the completed `List` environment through the nested alignment
+constructor. -/
+theorem roseTrEnv09 : TrEnv' .safe roseMap09 false roseFinalEnv09 :=
+  .inductNested roseAddInductNested09 listTrEnv07
+
+theorem roseFinalOrdered09 : roseFinalEnv09.Ordered :=
+  roseTrEnv09.wf.ordered
+
+
+/-! ## Round-trip guards
+
+The stored-metadata surface inserted by the trace is tied to the Theory
+artifact inventory, and the final map/environment pair carries the
+documented closure (persistent-map contracts plus the compiler-trust axioms
+introduced by the `native_decide` observations). -/
+
+#guard roseNestedC.elim.numNested == 1
+#guard roseRecV == roseRecVL && roseRec1V == roseRec1VL
+
+#guard_named_axioms Ix.Theory.Named.NestedReplayFixtures.roseTrEnv09 [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert,
+  Ix.Theory.Named.NestedReplayFixtures.roseKTarget09._native.native_decide.ax_1_1,
+  Ix.Theory.Named.NestedReplayFixtures.roseNestedC._native.native_decide.ax_1,
+  Ix.Theory.Named.NestedReplayFixtures.roseRecursors_eq._native.native_decide.ax_1_1,
+  Ix.Theory.Named.NestedReplayFixtures.roseRules_eq._native.native_decide.ax_1_1]
+
+#guard_named_axioms Ix.Theory.Named.NestedReplayFixtures.roseNestedWF09 [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Ix.Theory.Named.NestedReplayFixtures.roseNestedC._native.native_decide.ax_1,
+  Ix.Theory.Named.NestedReplayFixtures.roseRecursors_eq._native.native_decide.ax_1_1,
+  Ix.Theory.Named.NestedReplayFixtures.roseRules_eq._native.native_decide.ax_1_1]
+
+
+/-! # The nested-indexed fixture
+
+`NVTree` nests through the locally declared indexed `PVec`.  The base
+environment stages the `PVec` family and constructors over the completed
+`Nat` replay through `TrEnv'.inductStaging`; the nested trace then inserts
+the stored `NVTree` metadata and drives `TrEnv'.inductNested`. -/
+
+/-! ## Staged `PVec` base -/
+
+def pvecInfo09 : ConstantInfo := kernelInductInfo% PVec
+def pvecNilInfo09 : ConstantInfo := kernelCtorInfo% PVec.nil
+def pvecConsInfo09 : ConstantInfo := kernelCtorInfo% PVec.cons
+
+def pvecFamilyVL : VConstVal :=
+  ⟨⟨0, .forallE (.sort (.succ .zero))
+    (.forallE (.const `Nat []) (.sort (.succ .zero)))⟩, ``PVec⟩
+def pvecNilVL : VConstVal := ⟨⟨0, nestedConstVType09A% PVec.nil⟩, ``PVec.nil⟩
+def pvecConsVL : VConstVal := ⟨⟨0, nestedConstVType09A% PVec.cons⟩, ``PVec.cons⟩
+
+def pvecTypeMap09 : ConstMap := natMap.insert ``PVec pvecInfo09
+def pvecNilMap09 : ConstMap := pvecTypeMap09.insert ``PVec.nil pvecNilInfo09
+def pvecCtorMap09 : ConstMap := pvecNilMap09.insert ``PVec.cons pvecConsInfo09
+
+def pvecTypeEnv09 : VEnv :=
+  (natFinalEnv.addConst pvecFamilyVL.name pvecFamilyVL.toVConstant).get!
+def pvecNilEnv09 : VEnv :=
+  (pvecTypeEnv09.addConst pvecNilVL.name pvecNilVL.toVConstant).get!
+def pvecCtorEnv09 : VEnv :=
+  (pvecNilEnv09.addConst pvecConsVL.name pvecConsVL.toVConstant).get!
+
+theorem pvecTypeFresh09 : natMap.find? ``PVec = none := by
+  rw [natMap, natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem pvecTypeMapWF09 : pvecTypeMap09.WF :=
+  natMap_wf.insert _ _ pvecTypeFresh09
+
+theorem pvecNilFresh09 : pvecTypeMap09.find? ``PVec.nil = none := by
+  rw [pvecTypeMap09, natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem pvecNilMapWF09 : pvecNilMap09.WF :=
+  pvecTypeMapWF09.insert _ _ pvecNilFresh09
+
+theorem pvecConsFresh09 : pvecNilMap09.find? ``PVec.cons = none := by
+  rw [pvecNilMap09, pvecTypeMapWF09.find?_insert, pvecTypeMap09,
+    natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem pvecCtorMapWF09 : pvecCtorMap09.WF :=
+  pvecNilMapWF09.insert _ _ pvecConsFresh09
+
+theorem natFinalOrdered09 : natFinalEnv.Ordered :=
+  (nat_trEnv' (safety := .safe)).wf.ordered
+
+theorem pvecFamilyWF09 : pvecFamilyVL.toVConstant.WF natFinalEnv := by
+  have hNat : natFinalEnv.constants ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem pvecTypeEnv09_eq :
+    natFinalEnv.addConst pvecFamilyVL.name pvecFamilyVL.toVConstant =
+      some pvecTypeEnv09 := rfl
+
+theorem pvecTypeOrdered09 : pvecTypeEnv09.Ordered :=
+  .const natFinalOrdered09 pvecFamilyWF09 pvecTypeEnv09_eq
+
+theorem pvecNilWF09 : pvecNilVL.toVConstant.WF pvecTypeEnv09 := by
+  have hNat : pvecTypeEnv09.constants ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hZero : pvecTypeEnv09.constants ``Nat.zero = some ⟨0, .const `Nat []⟩ := rfl
+  have hPVec : pvecTypeEnv09.constants ``PVec = some pvecFamilyVL.toVConstant := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem pvecNilEnv09_eq :
+    pvecTypeEnv09.addConst pvecNilVL.name pvecNilVL.toVConstant =
+      some pvecNilEnv09 := rfl
+
+theorem pvecNilOrdered09 : pvecNilEnv09.Ordered :=
+  .const pvecTypeOrdered09 pvecNilWF09 pvecNilEnv09_eq
+
+theorem pvecConsWF09 : pvecConsVL.toVConstant.WF pvecNilEnv09 := by
+  have hNat : pvecNilEnv09.constants ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hSucc : pvecNilEnv09.constants ``Nat.succ =
+      some ⟨0, .forallE (.const `Nat []) (.const `Nat [])⟩ := rfl
+  have hPVec : pvecNilEnv09.constants ``PVec = some pvecFamilyVL.toVConstant := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem pvecConsEnv09_eq :
+    pvecNilEnv09.addConst pvecConsVL.name pvecConsVL.toVConstant =
+      some pvecCtorEnv09 := rfl
+
+theorem pvecCtorOrdered09 : pvecCtorEnv09.Ordered :=
+  .const pvecNilOrdered09 pvecConsWF09 pvecConsEnv09_eq
+
+theorem pvecInfoTr09 : TrConstVal .safe natFinalEnv pvecInfo09 pvecFamilyVL := by
+  have hNat : natFinalEnv.constants ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr natFinalEnv pvecInfo09.levelParams []
+      pvecInfo09.type pvecFamilyVL.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS natFinalOrdered09 trivial ⟨_, by type_tac⟩
+
+theorem pvecNilTr09 : TrConstVal .safe pvecTypeEnv09 pvecNilInfo09 pvecNilVL := by
+  have hNat : pvecTypeEnv09.constants ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hZero : pvecTypeEnv09.constants ``Nat.zero = some ⟨0, .const `Nat []⟩ := rfl
+  have hPVec : pvecTypeEnv09.constants ``PVec = some pvecFamilyVL.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr pvecTypeEnv09 pvecNilInfo09.levelParams []
+      pvecNilInfo09.type pvecNilVL.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS pvecTypeOrdered09 trivial ⟨_, by type_tac⟩
+
+theorem pvecConsTr09 : TrConstVal .safe pvecNilEnv09 pvecConsInfo09 pvecConsVL := by
+  have hNat : pvecNilEnv09.constants ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hSucc : pvecNilEnv09.constants ``Nat.succ =
+      some ⟨0, .forallE (.const `Nat []) (.const `Nat [])⟩ := rfl
+  have hPVec : pvecNilEnv09.constants ``PVec = some pvecFamilyVL.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr pvecNilEnv09 pvecConsInfo09.levelParams []
+      pvecConsInfo09.type pvecConsVL.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS pvecNilOrdered09 trivial ⟨_, by type_tac⟩
+
+/-- The staged `PVec` boundary: family and constructors present, no
+recursor or rules — exactly the constants the nested `NVTree` artifacts
+reference. -/
+theorem pvecTrEnv09 : TrEnv' .safe pvecCtorMap09 false pvecCtorEnv09 :=
+  .inductStaging (kind := .ctor)
+    { info := pvecConsInfo09
+      kind_eq := trivial
+      tr := pvecConsTr09
+      map_fresh := pvecConsFresh09
+      env_add := pvecConsEnv09_eq
+      map_add := rfl } pvecConsWF09 <|
+  .inductStaging (kind := .ctor)
+    { info := pvecNilInfo09
+      kind_eq := trivial
+      tr := pvecNilTr09
+      map_fresh := pvecNilFresh09
+      env_add := pvecNilEnv09_eq
+      map_add := rfl } pvecNilWF09 <|
+  .inductStaging (kind := .induct)
+    { info := pvecInfo09
+      kind_eq := trivial
+      tr := pvecInfoTr09
+      map_fresh := pvecTypeFresh09
+      env_add := pvecTypeEnv09_eq
+      map_add := rfl } pvecFamilyWF09 nat_trEnv'
+
+
+/-! ## The translated NV source and its nested artifact -/
+
+def nvSourceV : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := ``NVTree
+       uvars := 0
+       type := nestedConstVType09A% NVTree
+       ctors := [⟨⟨0, nestedConstVType09A% NVTree.node⟩, ``NVTree.node⟩] }]
+
+def nvNestedC? : Option (NestedBlockChecked nvSourceV) :=
+  nestedBlockChecked? [NestedTransformation.pvecStoredTarget] nvSourceV
+
+#guard nvNestedC?.isSome
+
+def nvNestedC : NestedBlockChecked nvSourceV :=
+  nvNestedC?.get (by native_decide)
+
+def nvInfo09 : ConstantInfo := kernelInductInfo% NVTree
+def nvNodeInfo09 : ConstantInfo := kernelCtorInfo% NVTree.node
+def nvRecInfo09 : ConstantInfo := kernelRecInfo% NVTree.rec
+def nvRec1Info09 : ConstantInfo := kernelRecInfo% NVTree.rec_1
+
+def nvFamilyV : VConstVal := nvSourceV.types[0].toVConstVal
+def nvNodeV : VConstVal := nvSourceV.types[0].ctors[0]
+
+def nvTypeMap09 : ConstMap := pvecCtorMap09.insert ``NVTree nvInfo09
+def nvCtorMap09 : ConstMap := nvTypeMap09.insert ``NVTree.node nvNodeInfo09
+def nvRecMap09 : ConstMap := nvCtorMap09.insert ``NVTree.rec nvRecInfo09
+def nvMap09 : ConstMap :=
+  nvRecMap09.insert `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1 nvRec1Info09
+
+def nvTypeEnv09 : VEnv :=
+  (pvecCtorEnv09.addConst nvFamilyV.name nvFamilyV.toVConstant).get!
+def nvCtorEnv09 : VEnv :=
+  (nvTypeEnv09.addConst nvNodeV.name nvNodeV.toVConstant).get!
+
+def nvFamilyTypeL : VExpr :=
+  .sort (.succ (.zero))
+
+def nvNodeTypeL : VExpr :=
+  .forallE
+    (.const `Nat [])
+    (.forallE
+      (.app
+        (.app
+          (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+          (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+        (.bvar 0))
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+
+def nvRecTypeL : VExpr :=
+  .forallE
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.forallE
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.forallE
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.forallE
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.forallE
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.app (.bvar 5) (.bvar 0)))))))
+
+def nvRec1TypeL : VExpr :=
+  .forallE
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.forallE
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.forallE
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.forallE
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.forallE
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.forallE
+              (.const `Nat [])
+              (.forallE
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                  (.bvar 0))
+                (.app
+                  (.app (.bvar 5) (.bvar 1))
+                  (.bvar 0))))))))
+
+def nvRule0LhsL : VExpr :=
+  .lam
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.lam
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.lam
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.lam
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.lam
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.lam
+              (.const `Nat [])
+              (.lam
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                  (.bvar 0))
+                (.app
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.const
+                              `Ix.Theory.Named.NestedRepresentation.NVTree.rec
+                              [.param 0])
+                            (.bvar 6))
+                          (.bvar 5))
+                        (.bvar 4))
+                      (.bvar 3))
+                    (.bvar 2))
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                      (.bvar 1))
+                    (.bvar 0)))))))))
+
+def nvRule0RhsL : VExpr :=
+  .lam
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.lam
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.lam
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.lam
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.lam
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.lam
+              (.const `Nat [])
+              (.lam
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                  (.bvar 0))
+                (.app
+                  (.app
+                    (.app (.bvar 4) (.bvar 1))
+                    (.bvar 0))
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1
+                                  [.param 0])
+                                (.bvar 6))
+                              (.bvar 5))
+                            (.bvar 4))
+                          (.bvar 3))
+                        (.bvar 2))
+                      (.bvar 1))
+                    (.bvar 0)))))))))
+
+def nvRule0TypeL : VExpr :=
+  .forallE
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.forallE
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.forallE
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.forallE
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.forallE
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.forallE
+              (.const `Nat [])
+              (.forallE
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                  (.bvar 0))
+                (.app
+                  (.bvar 6)
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                      (.bvar 1))
+                    (.bvar 0)))))))))
+
+def nvRule1LhsL : VExpr :=
+  .lam
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.lam
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.lam
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.lam
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.lam
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.app
+              (.app
+                (.app
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.const
+                            `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1
+                            [.param 0])
+                          (.bvar 4))
+                        (.bvar 3))
+                      (.bvar 2))
+                    (.bvar 1))
+                  (.bvar 0))
+                (.const `Nat.zero []))
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))))))
+
+def nvRule1RhsL : VExpr :=
+  .lam
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.lam
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.lam
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.lam
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.lam
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.bvar 1)))))
+
+def nvRule1TypeL : VExpr :=
+  .forallE
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.forallE
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.forallE
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.forallE
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.forallE
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.app
+              (.app (.bvar 3) (.const `Nat.zero []))
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))))))
+
+def nvRule2LhsL : VExpr :=
+  .lam
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.lam
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.lam
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.lam
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.lam
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.lam
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.lam
+                (.const `Nat [])
+                (.lam
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1
+                                  [.param 0])
+                                (.bvar 7))
+                              (.bvar 6))
+                            (.bvar 5))
+                          (.bvar 4))
+                        (.bvar 3))
+                      (.app
+                        (.const `Nat.succ [])
+                        (.bvar 1)))
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.const `Ix.Theory.Named.NestedRepresentation.PVec.cons [])
+                            (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                          (.bvar 2))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+def nvRule2RhsL : VExpr :=
+  .lam
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.lam
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.lam
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.lam
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.lam
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.lam
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.lam
+                (.const `Nat [])
+                (.lam
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.app
+                    (.app
+                      (.app
+                        (.app
+                          (.app (.bvar 3) (.bvar 2))
+                          (.bvar 1))
+                        (.bvar 0))
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.app
+                                  (.const
+                                    `Ix.Theory.Named.NestedRepresentation.NVTree.rec
+                                    [.param 0])
+                                  (.bvar 7))
+                                (.bvar 6))
+                              (.bvar 5))
+                            (.bvar 4))
+                          (.bvar 3))
+                        (.bvar 2)))
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.app
+                                  (.const
+                                    `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1
+                                    [.param 0])
+                                  (.bvar 7))
+                                (.bvar 6))
+                              (.bvar 5))
+                            (.bvar 4))
+                          (.bvar 3))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+def nvRule2TypeL : VExpr :=
+  .forallE
+    (.forallE
+      (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+      (.sort (.param 0)))
+    (.forallE
+      (.forallE
+        (.const `Nat [])
+        (.forallE
+          (.app
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+            (.bvar 0))
+          (.sort (.param 0))))
+      (.forallE
+        (.forallE
+          (.const `Nat [])
+          (.forallE
+            (.app
+              (.app
+                (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+              (.bvar 0))
+            (.forallE
+              (.app
+                (.app (.bvar 2) (.bvar 1))
+                (.bvar 0))
+              (.app
+                (.bvar 4)
+                (.app
+                  (.app
+                    (.const `Ix.Theory.Named.NestedRepresentation.NVTree.node [])
+                    (.bvar 2))
+                  (.bvar 1))))))
+        (.forallE
+          (.app
+            (.app (.bvar 1) (.const `Nat.zero []))
+            (.app
+              (.const `Ix.Theory.Named.NestedRepresentation.PVec.nil [])
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])))
+          (.forallE
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.forallE
+                    (.app (.bvar 6) (.bvar 2))
+                    (.forallE
+                      (.app
+                        (.app (.bvar 6) (.bvar 2))
+                        (.bvar 1))
+                      (.app
+                        (.app
+                          (.bvar 7)
+                          (.app
+                            (.const `Nat.succ [])
+                            (.bvar 3)))
+                        (.app
+                          (.app
+                            (.app
+                              (.app
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.PVec.cons
+                                  [])
+                                (.const
+                                  `Ix.Theory.Named.NestedRepresentation.NVTree
+                                  []))
+                              (.bvar 4))
+                            (.bvar 3))
+                          (.bvar 2))))))))
+            (.forallE
+              (.const `Ix.Theory.Named.NestedRepresentation.NVTree [])
+              (.forallE
+                (.const `Nat [])
+                (.forallE
+                  (.app
+                    (.app
+                      (.const `Ix.Theory.Named.NestedRepresentation.PVec [])
+                      (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                    (.bvar 0))
+                  (.app
+                    (.app
+                      (.bvar 6)
+                      (.app
+                        (.const `Nat.succ [])
+                        (.bvar 1)))
+                    (.app
+                      (.app
+                        (.app
+                          (.app
+                            (.const `Ix.Theory.Named.NestedRepresentation.PVec.cons [])
+                            (.const `Ix.Theory.Named.NestedRepresentation.NVTree []))
+                          (.bvar 2))
+                        (.bvar 1))
+                      (.bvar 0))))))))))
+
+def nvRecVL : VConstVal := ⟨⟨1, nvRecTypeL⟩, ``NVTree.rec⟩
+def nvRec1VL : VConstVal :=
+  ⟨⟨1, nvRec1TypeL⟩, `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1⟩
+
+def nvRulesL : List VDefEq :=
+  [⟨1, nvRule0LhsL, nvRule0RhsL, nvRule0TypeL⟩,
+   ⟨1, nvRule1LhsL, nvRule1RhsL, nvRule1TypeL⟩,
+   ⟨1, nvRule2LhsL, nvRule2RhsL, nvRule2TypeL⟩]
+
+theorem nvRecursors_eq : nvNestedC.recursors = [nvRecVL, nvRec1VL] := by
+  native_decide
+
+theorem nvRules_eq : nvNestedC.generatedRules = nvRulesL := by
+  native_decide
+
+def nvRecEnv09 : VEnv :=
+  (nvCtorEnv09.addConst nvRecVL.name nvRecVL.toVConstant).get!
+def nvRec1Env09 : VEnv :=
+  (nvRecEnv09.addConst nvRec1VL.name nvRec1VL.toVConstant).get!
+def nvFinalEnv09 : VEnv :=
+  nvRulesL.foldl VEnv.addDefEq nvRec1Env09
+
+
+/-! ## NV constant well-formedness and phase chains -/
+
+macro "nv_hyps" e:term : tactic => `(tactic| (
+  have hNat : VEnv.constants $e ``Nat = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hZero : VEnv.constants $e ``Nat.zero = some ⟨0, .const `Nat []⟩ := rfl
+  have hSucc : VEnv.constants $e ``Nat.succ =
+      some ⟨0, .forallE (.const `Nat []) (.const `Nat [])⟩ := rfl
+  have hPVec : VEnv.constants $e ``PVec = some pvecFamilyVL.toVConstant := rfl
+  have hPNil : VEnv.constants $e ``PVec.nil = some pvecNilVL.toVConstant := rfl
+  have hPCons : VEnv.constants $e ``PVec.cons = some pvecConsVL.toVConstant := rfl))
+
+theorem nvFamilyWF09 : nvFamilyV.toVConstant.WF pvecCtorEnv09 :=
+  ⟨_, by type_tac⟩
+
+theorem nvTypeEnv09_eq :
+    pvecCtorEnv09.addConst nvFamilyV.name nvFamilyV.toVConstant =
+      some nvTypeEnv09 := rfl
+
+theorem nvTypeOrdered09 : nvTypeEnv09.Ordered :=
+  .const pvecCtorOrdered09 nvFamilyWF09 nvTypeEnv09_eq
+
+theorem nvNodeWF09 : nvNodeV.toVConstant.WF nvTypeEnv09 := by
+  nv_hyps nvTypeEnv09
+  have hNV : nvTypeEnv09.constants ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem nvCtorEnv09_eq :
+    nvTypeEnv09.addConst nvNodeV.name nvNodeV.toVConstant =
+      some nvCtorEnv09 := rfl
+
+theorem nvCtorOrdered09 : nvCtorEnv09.Ordered :=
+  .const nvTypeOrdered09 nvNodeWF09 nvCtorEnv09_eq
+
+set_option maxRecDepth 4000 in
+theorem nvRecWF09 : (⟨1, nvRecTypeL⟩ : VConstant).WF nvCtorEnv09 := by
+  nv_hyps nvCtorEnv09
+  have hNV : nvCtorEnv09.constants ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hNode : nvCtorEnv09.constants ``NVTree.node =
+      some nvNodeV.toVConstant := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem nvRecEnv09_eq :
+    nvCtorEnv09.addConst nvRecVL.name nvRecVL.toVConstant =
+      some nvRecEnv09 := rfl
+
+theorem nvRecOrdered09 : nvRecEnv09.Ordered :=
+  .const nvCtorOrdered09 nvRecWF09 nvRecEnv09_eq
+
+set_option maxRecDepth 4000 in
+theorem nvRec1WF09 : (⟨1, nvRec1TypeL⟩ : VConstant).WF nvRecEnv09 := by
+  nv_hyps nvRecEnv09
+  have hNV : nvRecEnv09.constants ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hNode : nvRecEnv09.constants ``NVTree.node =
+      some nvNodeV.toVConstant := rfl
+  exact ⟨_, by type_tac⟩
+
+theorem nvRec1Env09_eq :
+    nvRecEnv09.addConst nvRec1VL.name nvRec1VL.toVConstant =
+      some nvRec1Env09 := rfl
+
+theorem nvRec1Ordered09 : nvRec1Env09.Ordered :=
+  .const nvRecOrdered09 nvRec1WF09 nvRec1Env09_eq
+
+section NVRuleWF
+
+set_option maxRecDepth 8000
+
+macro "nv_rule_hyps" e:term : tactic => `(tactic| (
+  nv_hyps $e
+  have hNV : VEnv.constants $e ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hNode : VEnv.constants $e ``NVTree.node = some nvNodeV.toVConstant := rfl
+  have hRec : VEnv.constants $e ``NVTree.rec = some ⟨1, nvRecTypeL⟩ := rfl
+  have hRec1 : VEnv.constants $e
+      `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1 = some ⟨1, nvRec1TypeL⟩ := rfl))
+
+def nvRuleEnv1 : VEnv := nvRec1Env09.addDefEq nvRulesL[0]
+def nvRuleEnv2 : VEnv := nvRuleEnv1.addDefEq nvRulesL[1]
+
+theorem nvRule0WF09 : nvRulesL[0].WF nvRec1Env09 := by
+  constructor
+  · nv_rule_hyps nvRec1Env09; type_tac
+  · nv_rule_hyps nvRec1Env09; type_tac
+
+theorem nvRule1WF09 : nvRulesL[1].WF nvRuleEnv1 := by
+  constructor
+  · nv_rule_hyps nvRuleEnv1; type_tac
+  · nv_rule_hyps nvRuleEnv1; type_tac
+
+theorem nvRule2WF09 : nvRulesL[2].WF nvRuleEnv2 := by
+  constructor
+  · nv_rule_hyps nvRuleEnv2; type_tac
+  · nv_rule_hyps nvRuleEnv2; type_tac
+
+end NVRuleWF
+
+
+/-! ## NV semantic package -/
+
+theorem nvTypesFold_eq :
+    nvSourceV.blockTypeConstants.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) pvecCtorEnv09 =
+      some nvTypeEnv09 := rfl
+
+theorem nvCtorsFold_eq :
+    nvSourceV.blockConstructorConstants.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) nvTypeEnv09 =
+      some nvCtorEnv09 := rfl
+
+theorem nvRecsFold_eq :
+    nvNestedC.recursors.foldlM
+      (fun env c => env.addConst c.name c.toVConstant) nvCtorEnv09 =
+      some nvRec1Env09 := by
+  rw [nvRecursors_eq]; rfl
+
+theorem nvNestedWF09 : nvNestedC.WF pvecCtorEnv09 := by
+  refine ⟨⟨nvFamilyWF09, fun env' h => ?_⟩, fun {typeEnv} h => ?_,
+    fun {typeEnv ctorEnv} hT hC => ?_, fun {typeEnv ctorEnv recEnv} hT hC hR => ?_⟩
+  · cases Option.some.inj (nvTypeEnv09_eq.symm.trans h)
+    exact trivial
+  · cases Option.some.inj (nvTypesFold_eq.symm.trans h)
+    exact ⟨nvNodeWF09, fun env' h' => by
+      cases Option.some.inj (nvCtorEnv09_eq.symm.trans h')
+      exact trivial⟩
+  · cases Option.some.inj (nvTypesFold_eq.symm.trans hT)
+    cases Option.some.inj (nvCtorsFold_eq.symm.trans hC)
+    rw [nvRecursors_eq]
+    exact ⟨nvRecWF09, fun env' h' => by
+      cases Option.some.inj (nvRecEnv09_eq.symm.trans h')
+      exact ⟨nvRec1WF09, fun env'' h'' => by
+        cases Option.some.inj (nvRec1Env09_eq.symm.trans h'')
+        exact trivial⟩⟩
+  · cases Option.some.inj (nvTypesFold_eq.symm.trans hT)
+    cases Option.some.inj (nvCtorsFold_eq.symm.trans hC)
+    cases Option.some.inj (nvRecsFold_eq.symm.trans hR)
+    rw [nvRules_eq]
+    exact ⟨nvRule0WF09, nvRule1WF09, nvRule2WF09, trivial⟩
+
+/-! ## NV freshness and stored-metadata translations -/
+
+theorem nvTypeFresh09 : pvecCtorMap09.find? ``NVTree = none := by
+  rw [pvecCtorMap09, pvecNilMapWF09.find?_insert, pvecNilMap09,
+    pvecTypeMapWF09.find?_insert, pvecTypeMap09,
+    natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem nvTypeMapWF09 : nvTypeMap09.WF :=
+  pvecCtorMapWF09.insert _ _ nvTypeFresh09
+
+theorem nvNodeFresh09 : nvTypeMap09.find? ``NVTree.node = none := by
+  rw [nvTypeMap09, pvecCtorMapWF09.find?_insert, pvecCtorMap09,
+    pvecNilMapWF09.find?_insert, pvecNilMap09,
+    pvecTypeMapWF09.find?_insert, pvecTypeMap09,
+    natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem nvCtorMapWF09 : nvCtorMap09.WF :=
+  nvTypeMapWF09.insert _ _ nvNodeFresh09
+
+theorem nvRecFresh09 : nvCtorMap09.find? ``NVTree.rec = none := by
+  rw [nvCtorMap09, nvTypeMapWF09.find?_insert, nvTypeMap09,
+    pvecCtorMapWF09.find?_insert, pvecCtorMap09,
+    pvecNilMapWF09.find?_insert, pvecNilMap09,
+    pvecTypeMapWF09.find?_insert, pvecTypeMap09,
+    natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem nvRecMapWF09 : nvRecMap09.WF :=
+  nvCtorMapWF09.insert _ _ nvRecFresh09
+
+theorem nvRec1Fresh09 :
+    nvRecMap09.find? `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1 = none := by
+  rw [nvRecMap09, nvCtorMapWF09.find?_insert, nvCtorMap09,
+    nvTypeMapWF09.find?_insert, nvTypeMap09,
+    pvecCtorMapWF09.find?_insert, pvecCtorMap09,
+    pvecNilMapWF09.find?_insert, pvecNilMap09,
+    pvecTypeMapWF09.find?_insert, pvecTypeMap09,
+    natMap_wf.find?_insert, natMap,
+    natCtorMap_wf.find?_insert, natCtorMap,
+    natZeroMap_wf.find?_insert, natZeroMap,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem nvInfoTr09 : TrConstVal .safe pvecCtorEnv09 nvInfo09 nvFamilyV := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr pvecCtorEnv09 nvInfo09.levelParams []
+      nvInfo09.type nvFamilyV.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS pvecCtorOrdered09 trivial ⟨_, by type_tac⟩
+
+theorem nvNodeTr09 : TrConstVal .safe nvTypeEnv09 nvNodeInfo09 nvNodeV := by
+  nv_hyps nvTypeEnv09
+  have hNV : nvTypeEnv09.constants ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr nvTypeEnv09 nvNodeInfo09.levelParams []
+      nvNodeInfo09.type nvNodeV.toVConstant.type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS nvTypeOrdered09 trivial ⟨_, by type_tac⟩
+
+theorem nvRecTr09 : TrConstVal .safe nvCtorEnv09 nvRecInfo09 nvRecVL := by
+  nv_hyps nvCtorEnv09
+  have hNV : nvCtorEnv09.constants ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hNode : nvCtorEnv09.constants ``NVTree.node = some nvNodeV.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr nvCtorEnv09 nvRecInfo09.levelParams []
+      nvRecInfo09.type nvRecVL.toVConstant.type := by
+    tr_type_expr_tac
+  obtain ⟨u, hty⟩ := nvRecWF09
+  exact shape.to_trExprS nvCtorOrdered09 trivial ⟨_, hty⟩
+
+theorem nvRec1Tr09 : TrConstVal .safe nvRecEnv09 nvRec1Info09 nvRec1VL := by
+  nv_hyps nvRecEnv09
+  have hNV : nvRecEnv09.constants ``NVTree = some ⟨0, .sort (.succ .zero)⟩ := rfl
+  have hNode : nvRecEnv09.constants ``NVTree.node = some nvNodeV.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr nvRecEnv09 nvRec1Info09.levelParams []
+      nvRec1Info09.type nvRec1VL.toVConstant.type := by
+    tr_type_expr_tac
+  obtain ⟨u, hty⟩ := nvRec1WF09
+  exact shape.to_trExprS nvRecOrdered09 trivial ⟨_, hty⟩
+
+/-! ## NV recursor K metadata, trace, and `TrEnv'` drive -/
+
+theorem nvKTarget09 : nvNestedC.generation.kTarget = false := by
+  native_decide
+
+theorem nvRecLookup09 : nvMap09.find? ``NVTree.rec = some nvRecInfo09 := by
+  rw [nvMap09, nvRecMapWF09.find?_insert]
+  simp [nvRecMap09, nvCtorMapWF09.find?_insert]
+
+theorem nvRec1Lookup09 :
+    nvMap09.find? `Ix.Theory.Named.NestedRepresentation.NVTree.rec_1 =
+      some nvRec1Info09 := by
+  rw [nvMap09, nvRecMapWF09.find?_insert]
+  simp
+
+theorem nvRecK09 :
+    RecursorMapKMatches nvMap09 nvNestedC.recursors
+      nvNestedC.generation.kTarget := by
+  rw [nvRecursors_eq, nvKTarget09]
+  intro recursor hmem
+  rcases List.mem_cons.1 hmem with rfl | hmem
+  · exact ⟨nvRecInfo09, nvRecLookup09, by decide⟩
+  rcases List.mem_cons.1 hmem with rfl | hmem
+  · exact ⟨nvRec1Info09, nvRec1Lookup09, by decide⟩
+  · cases hmem
+
+def nvTrace09 :
+    AddInductNestedTrace pvecCtorMap09 pvecCtorEnv09 nvSourceV
+      nvMap09 nvFinalEnv09 where
+  nested := nvNestedC
+  nested_wf := nvNestedWF09
+  typeMap := nvTypeMap09
+  typeEnv := nvTypeEnv09
+  ctorMap := nvCtorMap09
+  ctorEnv := nvCtorEnv09
+  recEnv := nvRec1Env09
+  addTypes := .cons
+    { info := nvInfo09
+      kind_eq := trivial
+      tr := nvInfoTr09
+      map_fresh := nvTypeFresh09
+      env_add := nvTypeEnv09_eq
+      map_add := rfl } .nil
+  addCtors := .cons
+    { info := nvNodeInfo09
+      kind_eq := trivial
+      tr := nvNodeTr09
+      map_fresh := nvNodeFresh09
+      env_add := nvCtorEnv09_eq
+      map_add := rfl } .nil
+  addRecs := nvRecursors_eq ▸ .cons
+    { info := nvRecInfo09
+      kind_eq := trivial
+      tr := nvRecTr09
+      map_fresh := nvRecFresh09
+      env_add := nvRecEnv09_eq
+      map_add := rfl } (.cons
+    { info := nvRec1Info09
+      kind_eq := trivial
+      tr := nvRec1Tr09
+      map_fresh := nvRec1Fresh09
+      env_add := nvRec1Env09_eq
+      map_add := rfl } .nil)
+  recK := nvRecK09
+  addRules := ⟨by rw [nvRules_eq]; rfl⟩
+
+theorem nvAddInductNested09 :
+    AddInductNested pvecCtorMap09 pvecCtorEnv09 nvSourceV
+      nvMap09 nvFinalEnv09 :=
+  ⟨nvTrace09⟩
+
+/-- The nested-indexed declaration, replayed from real stored metadata over
+the staged `PVec` boundary through the nested alignment constructor. -/
+theorem nvTrEnv09 : TrEnv' .safe nvMap09 false nvFinalEnv09 :=
+  .inductNested nvAddInductNested09 pvecTrEnv09
+
+theorem nvFinalOrdered09 : nvFinalEnv09.Ordered :=
+  nvTrEnv09.wf.ordered
+
+#guard nvNestedC.elim.numNested == 1
+
+
+#guard_named_axioms Ix.Theory.Named.NestedReplayFixtures.nvTrEnv09 [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert,
+  Ix.Theory.Named.NestedReplayFixtures.nvKTarget09._native.native_decide.ax_1_1,
+  Ix.Theory.Named.NestedReplayFixtures.nvNestedC._native.native_decide.ax_1,
+  Ix.Theory.Named.NestedReplayFixtures.nvRecursors_eq._native.native_decide.ax_1_1,
+  Ix.Theory.Named.NestedReplayFixtures.nvRules_eq._native.native_decide.ax_1_1]
+
+end Ix.Theory.Named.NestedReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/NestedRepresentation.lean b/Ix/Theory/Named/Verify/Environment/NestedRepresentation.lean
new file mode 100644
index 000000000..765a88594
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/NestedRepresentation.lean
@@ -0,0 +1,718 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Reference.Environment
+import Ix.Theory.Named.Inductive
+import Ix.Theory.Named.Meta
+
+open Ix.Theory (VLevel)
+
+/-!
+# Spec-09A: nested-inductive representation audit and decision
+
+This file is the committed design note and the executable metadata probes
+for the nested-inductive representation decision.  Every claim below is
+pinned by a build-failing probe in this file unless it is explicitly marked
+as a forward-looking obligation.  This checkpoint changes no acceptance
+behavior: the probes only observe the implementation and the existing
+Theory analyzers.
+
+## Audit: how the implementation represents nested inductives
+
+`Environment.addInductive` (Inductive/Add.lean) runs three phases:
+
+1. `ElimNestedInductive.run` rewrites the source declaration into a
+   flattened mutual block: every nested occurrence `I Ds is` whose
+   parametric arguments `Ds` mention a block family is replaced by
+   `auxI As is`, where `auxI` is a fresh auxiliary family abstracted over
+   the block parameters `As`, and one auxiliary family is created for each
+   family of `I`'s mutual block, with constructor types instantiated at
+   `Ds` (recursively rewritten).  `aux2nested` records `auxI ↦ I Ds`, open
+   over the block parameters.  Auxiliary names are uniquified against the
+   ambient environment (`mkUniqueName`).
+2. `AddInductive.run` checks and generates the flattened block as an
+   ordinary mutual block, receiving `numNested` (the number of auxiliary
+   families) as opaque metadata.
+3. When `numNested ≠ 0`, a restoration pass rebuilds the final environment
+   from the *pre-block* environment: source families and constructors are
+   re-added with every auxiliary constant replaced by its nested
+   restoration (`Result.restoreNested`), each auxiliary family's recursor
+   is re-added under the name `(mkRecName mainName).appendIndexAfter i`
+   with restored type and rules, and finally every `aux2nested` value
+   `I Ds` is type-checked (the lean4#14577 escape-hatch check, regression
+   tested in `Tests/NestedInductive.lean`).  The auxiliary families,
+   constructors, and recursor names never enter the final environment.
+
+The stored metadata therefore has this shape (probes P1, P2):
+
+- The source `inductInfo` keeps `all` = the source family names only and
+  carries `numNested` = the number of auxiliary families; stored
+  constructor types are in restored form (they mention `I Ds`, e.g.
+  `List (RoseTree α)`).
+- The recursor inventory is one recursor per source family plus one per
+  auxiliary family, all with `all` = source names, and with
+  `numMotives`/`numMinors` counting the *flattened* block's families and
+  minors.  Auxiliary recursors have rules keyed by constructors of the
+  previously declared nested inductive (`List.nil`, `List.cons`, ...) with
+  `nfields` counting the instantiated auxiliary constructor's fields, and
+  every rule RHS references the restored recursor constants mutually.
+- No `_nested.*` constant, and no auxiliary recursor under its original
+  name, survives into the final environment.
+
+## Decision: additive artifact type; `VInductDecl` unchanged
+
+The stored Theory payload for a nested declaration must be the *source*
+`VInductDecl` (restored form), because that is what the implementation
+stores and what Verify alignment must replay.  Storing the flattened block
+is unrepresentable: the final `ConstMap` contains neither the auxiliary
+families nor their constructors (probe P2), and the stored constructor
+types differ from the flattened ones (probe P1).  `VInductDecl` needs no
+new field: `numNested` is implementation metadata recoverable as the
+number of auxiliary specifications, and parity fixtures pin it per row
+exactly as they already pin `numNested == 0` for non-nested rows.
+
+Nested support is an additive checked-block artifact (built in Spec-09B/C),
+coupling:
+
+1. the flattened block as an ordinary `VInductDecl` — probe P4 shows both
+   target fixtures' flattened blocks are already accepted by the existing
+   `identityBlockGeneration?` machinery, so flattening reuses the complete
+   Spec-08 block analyzer and generator unchanged;
+2. one auxiliary specification per auxiliary family, in flattened family
+   order: the auxiliary name, the nested value `I Ds` open over the block
+   parameters (the Theory analog of `aux2nested`), and the restored
+   recursor name — plus executable coherence checks tying the flattened
+   block to the source declaration and to the environment's metadata for
+   `I` at `Ds`;
+3. the restoration substitution σ, a structural constant substitution on
+   `VExpr` (probe P5, `restoreV09A`): on an application spine headed by an
+   auxiliary constant, the first `nparams` spine arguments are consumed
+   and replaced by the instantiated value `I Ds`; auxiliary constructor
+   constants are renamed by prefix into `I`'s constructors, applied to the
+   instantiated value's own arguments; auxiliary recursor constants are
+   renamed (checked *before* the constructor-prefix case, exactly like
+   `restoreNested`'s `auxRec` map); levels come from the recorded value,
+   not the auxiliary constant.
+
+σ has one level-world subtlety (probe P5): specification values live in
+declaration level-world, while recursor types and rules live in recursor
+level-world, so σ over generation artifacts splices
+`value.instL (VLevel.params' uvars elimOffset)`.  Constructor types are
+restored with the unshifted value.  With that splice, σ over the flattened
+block's existing `BlockGenerationChecked` artifacts reproduces the stored
+kernel metadata *exactly* — every recursor type and every rule RHS of all
+three probe fixtures — and no auxiliary constant survives the image.
+Probe P2 additionally shows the port's full nested path reproduces Lean's
+stored metadata field-for-field, and that the final metadata is
+independent of auxiliary-name collisions (the uniquified names are erased
+by σ), so Theory may choose canonical auxiliary names as artifact data.
+
+Rejected alternatives:
+
+- *Flattened block as stored payload*: contradicts the stored metadata
+  (P1/P2); Verify alignment would have to invent constants the
+  implementation never stores.
+- *Changing `VInductDecl` fields*: unnecessary — the probes demonstrate
+  the additive artifact expresses real rose-tree, nested-indexed, and
+  constant-universe metadata; a payload change would ripple through every
+  exported Theory API without demonstrated need.
+- *A Prop-only pre-flattening relation without an artifact*: the
+  specifications and σ are data consumed by generation and replay; a
+  relation alone would force Verify to re-synthesize them.  The artifact's
+  executable coherence checks subsume the relation.
+
+## Obligations recorded for Spec-09B/09C (not claimed here)
+
+- 09B: Theory-side flattening and auxiliary-specification validation —
+  positivity through the existing block analyzer on the flattened block;
+  executable instantiation checks of auxiliary family/constructor types
+  against `I`'s metadata at `Ds`; nearest rejection differentials
+  (ill-typed `Ds` — the lean4#14577 class — wrong specification order,
+  non-matching instantiation).
+- 09C: σ as a total Theory function.  The spine rule needs a simultaneous
+  `instantiateRev`-style multi-substitution for `nparams > 1`: iterating
+  single `VExpr.inst` is wrong once parameter arguments mention bvars.
+  Generation, preservation (typing transport along σ: auxiliary constants
+  behave as definitions `auxI := λ As, I Ds`, so staged flattened-block WF
+  transports to restored WF given environment lookup facts for `I`'s
+  families and constructors), insertion order, and replay of real
+  `Inductive.Add.run` output.
+- The kernel's trailing `checkType (I Ds)` becomes a WF premise of the
+  auxiliary specification, never a trusted escape hatch.
+-/
+
+namespace Ix.Theory.Named.NestedRepresentation
+
+open Lean
+
+/-! ## Probe fixtures
+
+`RoseTree` is the universe-polymorphic rose tree through `List`; `NVTree`
+nests through the locally declared indexed family `PVec` (indices spelled
+with `Nat.zero`/`Nat.succ` to keep the probe dependency maps free of
+notation instances); `CURose` nests `List` at a constant universe, so its
+auxiliary constant carries no block level while the restored `List`
+carries level `1` — the level-instantiation case σ must represent. -/
+
+inductive RoseTree (α : Type u) : Type u where
+  | node : α → List (RoseTree α) → RoseTree α
+
+inductive PVec (α : Type) : Nat → Type where
+  | nil : PVec α Nat.zero
+  | cons : α → {n : Nat} → PVec α n → PVec α (Nat.succ n)
+
+inductive NVTree : Type where
+  | node : (n : Nat) → PVec NVTree n → NVTree
+
+inductive CURose : Type 1 where
+  | node : List CURose → CURose
+
+/-! ## Quoted stored metadata
+
+Local pin records keep this file independent of the replay fixture
+inventory; a change in Lean's emitted metadata is a compile failure. -/
+
+structure InductPins where
+  name : Name
+  lparams : List Name
+  numParams : Nat
+  numIndices : Nat
+  all : List Name
+  ctors : List Name
+  numNested : Nat
+  isRec : Bool
+  isReflexive : Bool
+  isUnsafe : Bool
+  deriving ToExpr, BEq
+
+structure CtorPins where
+  name : Name
+  lparams : List Name
+  induct : Name
+  cidx : Nat
+  numParams : Nat
+  numFields : Nat
+  deriving ToExpr, BEq
+
+structure RecPins where
+  name : Name
+  lparams : List Name
+  all : List Name
+  numParams : Nat
+  numIndices : Nat
+  numMotives : Nat
+  numMinors : Nat
+  k : Bool
+  rules : List (Name × Nat)
+  deriving ToExpr, BEq
+
+open Elab Term in
+elab "nestedInductPins09A%" n:ident : term => do
+  let name ← realizeGlobalConstNoOverloadWithInfo n
+  let .inductInfo i ← getConstInfo name | throwError "expected inductive {name}"
+  return toExpr (InductPins.mk i.name i.levelParams i.numParams i.numIndices
+    i.all i.ctors i.numNested i.isRec i.isReflexive i.isUnsafe)
+
+open Elab Term in
+elab "nestedCtorPins09A%" n:ident : term => do
+  let name ← realizeGlobalConstNoOverloadWithInfo n
+  let .ctorInfo i ← getConstInfo name | throwError "expected constructor {name}"
+  return toExpr (CtorPins.mk i.name i.levelParams i.induct i.cidx
+    i.numParams i.numFields)
+
+open Elab Term in
+elab "nestedRecPins09A%" n:ident : term => do
+  let name ← realizeGlobalConstNoOverloadWithInfo n
+  let .recInfo i ← getConstInfo name | throwError "expected recursor {name}"
+  return toExpr (RecPins.mk i.name i.levelParams i.all i.numParams i.numIndices
+    i.numMotives i.numMinors i.k (i.rules.map fun r => (r.ctor, r.nfields)))
+
+-- Quote a stored `ConstantInfo.type` in that record's own universe order.
+open Elab Term in
+elab "nestedConstVType09A%" n:ident : term => do
+  let name ← realizeGlobalConstNoOverloadWithInfo n
+  let info ← getConstInfo name
+  let type ← Ix.Theory.Named.Meta.expandExpr info.type
+  return toExpr (← Ix.Theory.Named.Meta.ofExpr info.levelParams {} type)
+
+/-! ## P1: stored-metadata pins
+
+The source family keeps `all` = source names and counts its auxiliary
+families in `numNested`; constructor types are restored; the recursor
+inventory reveals the flattened block through `numMotives`/`numMinors` and
+through auxiliary recursors whose rules are keyed by the constructors of a
+previously declared inductive. -/
+
+def roseAux : Name := (`_nested ++ ``List).appendIndexAfter 1
+def nvAux : Name := (`_nested ++ ``PVec).appendIndexAfter 1
+
+def roseInductPins : InductPins := nestedInductPins09A% RoseTree
+def roseNodePins : CtorPins := nestedCtorPins09A% RoseTree.node
+def roseRecPins : RecPins := nestedRecPins09A% RoseTree.rec
+def roseRec1Pins : RecPins := nestedRecPins09A% RoseTree.rec_1
+
+#guard roseInductPins.numNested == 1
+#guard roseInductPins.all == [``RoseTree]
+#guard roseInductPins.ctors == [``RoseTree.node]
+#guard roseInductPins.lparams == [`u] && roseInductPins.numParams == 1
+#guard roseInductPins.isRec && !roseInductPins.isReflexive && !roseInductPins.isUnsafe
+#guard roseNodePins ==
+  { name := ``RoseTree.node, lparams := [`u], induct := ``RoseTree, cidx := 0,
+    numParams := 1, numFields := 2 }
+#guard roseRecPins ==
+  { name := ``RoseTree.rec, lparams := [`u_1, `u], all := [``RoseTree], numParams := 1,
+    numIndices := 0, numMotives := 2, numMinors := 3, k := false,
+    rules := [(``RoseTree.node, 2)] }
+#guard roseRec1Pins ==
+  { name := (mkRecName ``RoseTree).appendIndexAfter 1, lparams := [`u_1, `u],
+    all := [``RoseTree], numParams := 1, numIndices := 0, numMotives := 2, numMinors := 3,
+    k := false, rules := [(``List.nil, 0), (``List.cons, 2)] }
+
+/-- The stored constructor type is the restored form: it mentions
+`List (RoseTree α)`, not an auxiliary constant. -/
+def roseNodeStoredType : VExpr := nestedConstVType09A% RoseTree.node
+
+#guard roseNodeStoredType ==
+  .forallE (.sort (.succ (.param 0)))
+    (.forallE (.bvar 0)
+      (.forallE (.app (.const ``List [.param 0]) (.app (.const ``RoseTree [.param 0]) (.bvar 1)))
+        (.app (.const ``RoseTree [.param 0]) (.bvar 2))))
+
+def nvInductPins : InductPins := nestedInductPins09A% NVTree
+def nvNodePins : CtorPins := nestedCtorPins09A% NVTree.node
+def nvRecPins : RecPins := nestedRecPins09A% NVTree.rec
+def nvRec1Pins : RecPins := nestedRecPins09A% NVTree.rec_1
+
+#guard nvInductPins.numNested == 1
+#guard nvInductPins.all == [``NVTree] && nvInductPins.ctors == [``NVTree.node]
+#guard nvNodePins ==
+  { name := ``NVTree.node, lparams := [], induct := ``NVTree, cidx := 0,
+    numParams := 0, numFields := 2 }
+#guard nvRecPins ==
+  { name := ``NVTree.rec, lparams := [`u], all := [``NVTree], numParams := 0,
+    numIndices := 0, numMotives := 2, numMinors := 3, k := false,
+    rules := [(``NVTree.node, 2)] }
+-- The auxiliary recursor keeps the auxiliary family's index and its rules
+-- count the instantiated constructor's fields (`PVec.cons` retains its
+-- implicit index field: 3 fields, not 2).
+#guard nvRec1Pins ==
+  { name := (mkRecName ``NVTree).appendIndexAfter 1, lparams := [`u], all := [``NVTree],
+    numParams := 0, numIndices := 1, numMotives := 2, numMinors := 3, k := false,
+    rules := [(``PVec.nil, 0), (``PVec.cons, 3)] }
+
+def nvNodeStoredType : VExpr := nestedConstVType09A% NVTree.node
+
+#guard nvNodeStoredType ==
+  .forallE (.const ``Nat [])
+    (.forallE (.app (.app (.const ``PVec []) (.const ``NVTree [])) (.bvar 0))
+      (.const ``NVTree []))
+
+def cuInductPins : InductPins := nestedInductPins09A% CURose
+def cuRecPins : RecPins := nestedRecPins09A% CURose.rec
+def cuRec1Pins : RecPins := nestedRecPins09A% CURose.rec_1
+
+#guard cuInductPins.numNested == 1 && cuInductPins.all == [``CURose]
+#guard cuRecPins.rules == [(``CURose.node, 1)] && cuRecPins.numMotives == 2
+#guard cuRec1Pins.rules == [(``List.nil, 0), (``List.cons, 2)]
+
+/-- The restored constructor type instantiates `List` at the constant level
+`1` even though the declaration has no level parameters. -/
+def cuNodeStoredType : VExpr := nestedConstVType09A% CURose.node
+
+#guard cuNodeStoredType ==
+  .forallE (.app (.const ``List [.succ .zero]) (.const ``CURose []))
+    (.const ``CURose [])
+
+/-! ## Shared probe plumbing -/
+
+def sourceType09A (env : Environment) (n : Name) : InductiveType := Id.run do
+  let some (.inductInfo info) := env.find? n | panic! "expected inductive"
+  let ctors := info.ctors.map fun c => Id.run do
+    let some (.ctorInfo ci) := env.find? c | panic! "expected constructor"
+    return { name := c, type := ci.type : Constructor }
+  return { name := n, type := info.type, ctors }
+
+def depMap09A (env : Environment) (ns : List Name) : ConstMap :=
+  ns.foldl (fun m n => m.insert n (env.find? n).get!) {}
+
+open ElimNestedInductive in
+/-- Run the port's flattening phase, returning the flattened block and the
+`aux2nested` values abstracted over the block parameters. -/
+def runElim09A (env : Kernel.Environment) (lparams : List Name) (nparams : Nat)
+    (types : List InductiveType) :
+    Except Kernel.Exception (List InductiveType × List (Name × Expr)) := do
+  let res : ElimNestedInductive.Result ← ElimNestedInductive.run 1000 nparams types env
+    |>.run' { lvls := lparams.map .param, newTypes := types.toArray }
+  return (res.types, res.aux2nested.toList.map fun (n, e) => (n, e.abstract res.params))
+
+/-- Field-for-field stored/ported agreement for the constant kinds a nested
+declaration emits. -/
+def sameConst09A (a b : ConstantInfo) : Bool :=
+  a.name == b.name && a.levelParams == b.levelParams && a.type == b.type &&
+    match a, b with
+    | .recInfo ra, .recInfo rb =>
+        ra.all == rb.all && ra.numParams == rb.numParams &&
+          ra.numIndices == rb.numIndices && ra.numMotives == rb.numMotives &&
+          ra.numMinors == rb.numMinors && ra.k == rb.k &&
+          ra.isUnsafe == rb.isUnsafe &&
+          ra.rules.map (fun r => (r.ctor, r.nfields, r.rhs)) ==
+            rb.rules.map (fun r => (r.ctor, r.nfields, r.rhs))
+    | .inductInfo ia, .inductInfo ib =>
+        ia.all == ib.all && ia.numParams == ib.numParams &&
+          ia.numIndices == ib.numIndices && ia.ctors == ib.ctors &&
+          ia.numNested == ib.numNested && ia.isRec == ib.isRec &&
+          ia.isReflexive == ib.isReflexive && ia.isUnsafe == ib.isUnsafe
+    | .ctorInfo ca, .ctorInfo cb =>
+        ca.induct == cb.induct && ca.cidx == cb.cidx &&
+          ca.numParams == cb.numParams && ca.numFields == cb.numFields &&
+          ca.isUnsafe == cb.isUnsafe
+    | _, _ => false
+
+def roseDeps : List Name := [``List, ``List.nil, ``List.cons]
+def nvDeps : List Name :=
+  [``Nat, ``Nat.zero, ``Nat.succ, ``PVec, ``PVec.nil, ``PVec.cons]
+
+def roseRestored : List Name :=
+  [``RoseTree, ``RoseTree.node, mkRecName ``RoseTree,
+    (mkRecName ``RoseTree).appendIndexAfter 1]
+def nvRestored : List Name :=
+  [``NVTree, ``NVTree.node, mkRecName ``NVTree,
+    (mkRecName ``NVTree).appendIndexAfter 1]
+def cuRestored : List Name :=
+  [``CURose, ``CURose.node, mkRecName ``CURose,
+    (mkRecName ``CURose).appendIndexAfter 1]
+
+/-! ## P2: the port's nested path reproduces the stored metadata
+
+`Environment.addInductive`, run on a dependency-only kernel environment,
+re-creates exactly the constants Lean stores — including every restored
+type and rule RHS — and no auxiliary constant.  The final output is
+independent of auxiliary-name collisions: pre-seeding `_nested.List_1`
+only shifts the uniquified internal names, which restoration erases. -/
+
+open Elab in
+run_meta do
+  let env ← getEnv
+  let checkPort (label : String) (main : Name) (lparams : List Name) (nparams : Nat)
+      (deps auxNames restored : List Name) (extra : ConstMap → ConstMap) :
+      MetaM Unit := do
+    let src := sourceType09A env main
+    let kenv := Kernel.Environment.ofConstants (`_spec09A ++ main) (extra (depMap09A env deps))
+    match Ix.Theory.Named.Environment.addInductive kenv lparams nparams [src] false false with
+    | .error _ => throwError "{label}: port addInductive failed"
+    | .ok env' =>
+      for n in restored do
+        let some stored := env.find? n | throwError "{label}: {n} not stored"
+        let some ported := env'.find? n | throwError "{label}: {n} missing from port output"
+        unless sameConst09A stored ported do
+          throwError "{label}: stored/ported metadata differ at {n}"
+      for n in auxNames do
+        unless (env'.find? n).isNone do
+          throwError "{label}: auxiliary constant {n} leaked into the final environment"
+        unless (env.find? n).isNone do
+          throwError "{label}: auxiliary constant {n} present in the ambient environment"
+  checkPort "rose" ``RoseTree [`u] 1 roseDeps
+    [roseAux, roseAux ++ `nil, roseAux ++ `cons, mkRecName roseAux,
+      (mkRecName ``RoseTree).appendIndexAfter 2] roseRestored id
+  checkPort "nv" ``NVTree [] 0 nvDeps
+    [nvAux, nvAux ++ `nil, nvAux ++ `cons, mkRecName nvAux,
+      (mkRecName ``NVTree).appendIndexAfter 2] nvRestored id
+  checkPort "cu" ``CURose [] 0 roseDeps
+    [roseAux, mkRecName roseAux] cuRestored id
+  -- auxiliary-name-collision independence
+  checkPort "rose-collision" ``RoseTree [`u] 1 roseDeps
+    [(`_nested ++ ``List).appendIndexAfter 2] roseRestored
+    (fun m => m.insert roseAux (env.find? ``Nat).get!)
+
+/-! ## P3: exact flattening pins
+
+The flattened blocks, translated to binder-erased `VExpr` form.  These are
+the descriptors the Spec-09B transformation must produce. -/
+
+def roseFlatFamilies : List (Name × VExpr) :=
+  [(``RoseTree, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))),
+    (roseAux, .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0))))]
+
+def roseFlatCtors : List (Name × VExpr) :=
+  [(``RoseTree.node,
+    .forallE (.sort (.succ (.param 0)))
+      (.forallE (.bvar 0)
+        (.forallE (.app (.const roseAux [.param 0]) (.bvar 1))
+          (.app (.const ``RoseTree [.param 0]) (.bvar 2))))),
+   (roseAux ++ `nil,
+    .forallE (.sort (.succ (.param 0))) (.app (.const roseAux [.param 0]) (.bvar 0))),
+   (roseAux ++ `cons,
+    .forallE (.sort (.succ (.param 0)))
+      (.forallE (.app (.const ``RoseTree [.param 0]) (.bvar 0))
+        (.forallE (.app (.const roseAux [.param 0]) (.bvar 1))
+          (.app (.const roseAux [.param 0]) (.bvar 2)))))]
+
+/-- `aux2nested` for the rose tree: `List (RoseTree α)`, open over `α`. -/
+def roseAuxValue : VExpr :=
+  .app (.const ``List [.param 0]) (.app (.const ``RoseTree [.param 0]) (.bvar 0))
+
+def nvFlatFamilies : List (Name × VExpr) :=
+  [(``NVTree, .sort (.succ .zero)),
+    (nvAux, .forallE (.const ``Nat []) (.sort (.succ .zero)))]
+
+def nvFlatCtors : List (Name × VExpr) :=
+  [(``NVTree.node,
+    .forallE (.const ``Nat [])
+      (.forallE (.app (.const nvAux []) (.bvar 0)) (.const ``NVTree []))),
+   (nvAux ++ `nil, .app (.const nvAux []) (.const ``Nat.zero [])),
+   (nvAux ++ `cons,
+    .forallE (.const ``NVTree [])
+      (.forallE (.const ``Nat [])
+        (.forallE (.app (.const nvAux []) (.bvar 0))
+          (.app (.const nvAux []) (.app (.const ``Nat.succ []) (.bvar 1))))))]
+
+/-- `aux2nested` for `NVTree`: the closed partial application `PVec NVTree`
+(the index argument stays behind on each occurrence). -/
+def nvAuxValue : VExpr := .app (.const ``PVec []) (.const ``NVTree [])
+
+def cuFlatFamilies : List (Name × VExpr) :=
+  [(``CURose, .sort (.succ (.succ .zero))),
+    (roseAux, .sort (.succ (.succ .zero)))]
+
+def cuFlatCtors : List (Name × VExpr) :=
+  [(``CURose.node, .forallE (.const roseAux []) (.const ``CURose [])),
+   (roseAux ++ `nil, .const roseAux []),
+   (roseAux ++ `cons,
+    .forallE (.const ``CURose []) (.forallE (.const roseAux []) (.const roseAux [])))]
+
+/-- `aux2nested` for `CURose`: the block-level-free auxiliary constant
+restores to `List` at the constant level `1`. -/
+def cuAuxValue : VExpr := .app (.const ``List [.succ .zero]) (.const ``CURose [])
+
+open Elab in
+/-- Translate one flattened block and compare it with its pinned shape. -/
+def checkFlat09A (label : String) (main : Name) (lparams : List Name) (nparams : Nat)
+    (deps : List Name) (families ctors : List (Name × VExpr))
+    (auxValues : List (Name × VExpr)) : MetaM (List VInductiveType) := do
+  let env ← getEnv
+  let src := sourceType09A env main
+  let kenv := Kernel.Environment.ofConstants (`_spec09AFlat ++ main) (depMap09A env deps)
+  let .ok (flatTypes, aux) := runElim09A kenv lparams nparams [src]
+    | throwError "{label}: flattening failed"
+  let uvars := lparams.length
+  let mut vtypes : List VInductiveType := []
+  let mut actualFamilies : List (Name × VExpr) := []
+  let mut actualCtors : List (Name × VExpr) := []
+  for t in flatTypes do
+    let vty ← Ix.Theory.Named.Meta.ofExpr lparams {} t.type
+    actualFamilies := actualFamilies ++ [(t.name, vty)]
+    let mut vctors : List VConstVal := []
+    for c in t.ctors do
+      let vc ← Ix.Theory.Named.Meta.ofExpr lparams {} c.type
+      actualCtors := actualCtors ++ [(c.name, vc)]
+      vctors := vctors ++ [{ name := c.name, uvars, type := vc }]
+    vtypes := vtypes ++ [{ name := t.name, uvars, type := vty, ctors := vctors }]
+  unless actualFamilies == families do
+    throwError "{label}: flattened families differ from the pinned shape"
+  unless actualCtors == ctors do
+    throwError "{label}: flattened constructors differ from the pinned shape"
+  let mut actualValues : List (Name × VExpr) := []
+  for (n, e) in aux do
+    actualValues := actualValues ++ [(n, ← Ix.Theory.Named.Meta.ofExpr lparams {} e)]
+  unless actualValues == auxValues do
+    throwError "{label}: aux2nested values differ from the pinned shape"
+  return vtypes
+
+/-! ## P4: Theory viability, with acceptance behavior unchanged
+
+The flattened blocks are already inside the supported arbitrary-block
+class, while the source declarations remain rejected by every current
+analyzer and by the public transaction. -/
+
+open Elab in
+run_meta do
+  let checkViability (label : String) (main : Name) (lparams : List Name)
+      (nparams : Nat) (deps : List Name) (families ctors : List (Name × VExpr))
+      (auxValues : List (Name × VExpr)) : MetaM Unit := do
+    let vtypes ← checkFlat09A label main lparams nparams deps families ctors auxValues
+    let uvars := lparams.length
+    let flatDecl : VInductDecl := { uvars, nparams, types := vtypes }
+    unless flatDecl.stage3 do
+      throwError "{label}: flattened block rejected by the block analyzer"
+    unless flatDecl.identityBlockGeneration?.isSome do
+      throwError "{label}: flattened block is not generation-ready"
+    let env ← getEnv
+    let src := sourceType09A env main
+    let vsrcTy ← Ix.Theory.Named.Meta.ofExpr lparams {} src.type
+    let mut vctors : List VConstVal := []
+    for c in src.ctors do
+      vctors := vctors ++ [{ name := c.name, uvars, type := ← Ix.Theory.Named.Meta.ofExpr lparams {} c.type }]
+    let srcTy : VInductiveType := { name := main, uvars, type := vsrcTy, ctors := vctors }
+    let srcDecl : VInductDecl := { uvars, nparams, types := [srcTy] }
+    if srcDecl.stage3 then
+      throwError "{label}: source declaration unexpectedly accepted by stage3"
+    if srcDecl.checked?.isSome then
+      throwError "{label}: source declaration unexpectedly accepted by checked?"
+    if (VEnv.empty.addInduct srcDecl).isSome then
+      throwError "{label}: source declaration unexpectedly accepted by addInduct"
+  checkViability "rose" ``RoseTree [`u] 1 roseDeps
+    roseFlatFamilies roseFlatCtors [(roseAux, roseAuxValue)]
+  checkViability "nv" ``NVTree [] 0 nvDeps
+    nvFlatFamilies nvFlatCtors [(nvAux, nvAuxValue)]
+  checkViability "cu" ``CURose [] 0 roseDeps
+    cuFlatFamilies cuFlatCtors [(roseAux, cuAuxValue)]
+
+/-! ## P5: the restoration substitution σ
+
+`restoreV09A` mirrors `ElimNestedInductive.Result.restoreNested` on
+`VExpr`.  It is probe-local: the Spec-09C artifact path must define the
+total Theory version (with a simultaneous parameter substitution once
+`nparams > 1` is in scope; the probe fixtures have `nparams ≤ 1`, where
+iterated `VExpr.inst` coincides with it). -/
+
+structure AuxSpec09A where
+  aux : Name
+  np : Nat
+  value : VExpr
+  recName : Name
+
+def instParams09A (value : VExpr) : List VExpr → VExpr
+  | [] => value
+  | [a] => value.inst a
+  | _ => panic! "the probe fixtures have nparams ≤ 1"
+
+def findCtorSpec09A (specs : List AuxSpec09A) (c : Name) : Option (AuxSpec09A × Name) :=
+  specs.findSome? fun spec =>
+    if spec.aux.isPrefixOf c && c != spec.aux then
+      some (spec, c.replacePrefix spec.aux .anonymous)
+    else none
+
+/-- σ.  The recursor-rename case is checked before the constructor-prefix
+case, exactly like `restoreNested`'s `auxRec` map: an auxiliary recursor
+name is prefixed by its auxiliary family name and would otherwise be
+mangled by the constructor branch. -/
+partial def restoreV09A (specs : List AuxSpec09A) (recMap : List (Name × Name)) :
+    VExpr → VExpr
+  | .bvar i => .bvar i
+  | .sort l => .sort l
+  | .lam ty body => .lam (restoreV09A specs recMap ty) (restoreV09A specs recMap body)
+  | .forallE ty body =>
+      .forallE (restoreV09A specs recMap ty) (restoreV09A specs recMap body)
+  | e@(.app ..) => restoreSpine (VExpr.appHead e) (e.appArgs [])
+  | e@(.const ..) => restoreSpine e []
+  where
+  restoreSpine (head : VExpr) (args : List VExpr) : VExpr :=
+    let args' := args.map (restoreV09A specs recMap)
+    match head with
+    | .const c ls =>
+      match recMap.find? (·.1 == c) with
+      | some (_, newName) => (VExpr.const newName ls).appN args'
+      | none =>
+      match specs.find? (·.aux == c) with
+      | some spec =>
+          (instParams09A spec.value (args'.take spec.np)).appN (args'.drop spec.np)
+      | none =>
+      match findCtorSpec09A specs c with
+      | some (spec, suffix) =>
+          let value := instParams09A spec.value (args'.take spec.np)
+          match VExpr.appHead value with
+          | .const iname ils =>
+              (VExpr.const (iname ++ suffix) ils).appN
+                (value.appArgs [] ++ args'.drop spec.np)
+          | _ => panic! "auxiliary value head is not a constant"
+      | none => (VExpr.const c ls).appN args'
+    | h => (restoreV09A specs recMap h).appN args'
+
+open Elab in
+/-- σ over the flattened block's existing generation artifacts reproduces
+the stored kernel metadata exactly: recursor names and types, and every
+rule RHS in the globally flattened order, with no auxiliary constant in
+the image.  Constructor types are restored with the declaration-world
+value; recursor artifacts use the value spliced by the elimination
+offset. -/
+def checkRestore09A (label : String) (main : Name) (lparams : List Name)
+    (nparams : Nat) (deps : List Name) : MetaM Unit := do
+  let env ← getEnv
+  let src := sourceType09A env main
+  let kenv := Kernel.Environment.ofConstants (`_spec09ARestore ++ main) (depMap09A env deps)
+  let .ok (flatTypes, aux) := runElim09A kenv lparams nparams [src]
+    | throwError "{label}: flattening failed"
+  let uvars := lparams.length
+  let mut vtypes : List VInductiveType := []
+  for t in flatTypes do
+    let vty ← Ix.Theory.Named.Meta.ofExpr lparams {} t.type
+    let mut vctors : List VConstVal := []
+    for c in t.ctors do
+      vctors := vctors ++ [{ name := c.name, uvars, type := ← Ix.Theory.Named.Meta.ofExpr lparams {} c.type }]
+    vtypes := vtypes ++ [{ name := t.name, uvars, type := vty, ctors := vctors }]
+  let flatDecl : VInductDecl := { uvars, nparams, types := vtypes }
+  let some gen := flatDecl.identityBlockGeneration?
+    | throwError "{label}: flattened block is not generation-ready"
+  let elimOffset := gen.recUvars - uvars
+  let mut declSpecs : List AuxSpec09A := []
+  let mut recSpecs : List AuxSpec09A := []
+  let mut recMap : List (Name × Name) := []
+  let mut i := 1
+  for t in flatTypes.drop 1 do
+    let some (_, value) := aux.find? (·.1 == t.name)
+      | throwError "{label}: no aux2nested value for {t.name}"
+    let v ← Ix.Theory.Named.Meta.ofExpr lparams {} value
+    let recName := (mkRecName main).appendIndexAfter i
+    let recValue := v.instL (VLevel.params' uvars elimOffset)
+    declSpecs := declSpecs ++ [{ aux := t.name, np := nparams, value := v, recName }]
+    recSpecs := recSpecs ++ [{ aux := t.name, np := nparams, value := recValue, recName }]
+    recMap := recMap ++ [(mkRecName t.name, recName)]
+    i := i + 1
+  let auxConsts := declSpecs.map (·.aux) ++ recMap.map (·.1) ++
+    (flatTypes.drop 1).flatMap (fun t => t.ctors.map (·.name))
+  -- declaration-world σ: restored source constructors
+  for (t, vt) in flatTypes.zip vtypes do
+    if t.name == main then
+      for c in vt.ctors do
+        let some stored := env.find? c.name | throwError "{label}: {c.name} not stored"
+        let storedType ← Ix.Theory.Named.Meta.ofExpr stored.levelParams {}
+          (← Ix.Theory.Named.Meta.expandExpr stored.type)
+        unless restoreV09A declSpecs recMap c.type == storedType do
+          throwError "{label}: σ(flattened {c.name}) differs from the stored type"
+  -- recursor-world σ: recursor types, names, and every rule RHS
+  let expectedNames := [mkRecName main] ++ recSpecs.map (·.recName)
+  for (r, expected) in gen.recursors.zip expectedNames do
+    let restoredName := match recMap.find? (·.1 == r.name) with
+      | some (_, n) => n
+      | none => r.name
+    unless restoredName == expected do
+      throwError "{label}: restored recursor name {restoredName}, expected {expected}"
+    let some (.recInfo stored) := env.find? expected
+      | throwError "{label}: stored recursor {expected} missing"
+    let storedType ← Ix.Theory.Named.Meta.ofExpr stored.levelParams {}
+      (← Ix.Theory.Named.Meta.expandExpr stored.type)
+    let restored := restoreV09A recSpecs recMap r.type
+    unless restored == storedType do
+      throwError "{label}: σ(recursor type) differs from stored for {expected}"
+    unless !VExpr.hasAnyConst auxConsts restored do
+      throwError "{label}: auxiliary constant survives σ in the type of {expected}"
+  let mut storedRules : List (Name × Expr) := []
+  for n in expectedNames do
+    let some (.recInfo stored) := env.find? n
+      | throwError "{label}: stored recursor {n} missing"
+    for rule in stored.rules do
+      storedRules := storedRules ++ [(rule.ctor, rule.rhs)]
+  let genRules := gen.generatedRules
+  unless storedRules.length == genRules.length do
+    throwError "{label}: {genRules.length} generated rules, {storedRules.length} stored"
+  let some (.recInfo mainRec) := env.find? (mkRecName main)
+    | throwError "{label}: stored main recursor missing"
+  for (df, (ctor, storedRhs)) in genRules.zip storedRules do
+    let storedRhs ← Ix.Theory.Named.Meta.ofExpr mainRec.levelParams {}
+      (← Ix.Theory.Named.Meta.expandExpr storedRhs)
+    let restoredRhs := restoreV09A recSpecs recMap df.rhs
+    unless restoredRhs == storedRhs do
+      throwError "{label}: σ(rule rhs) differs from stored for {ctor}"
+    unless !VExpr.hasAnyConst auxConsts restoredRhs &&
+        !VExpr.hasAnyConst auxConsts (restoreV09A recSpecs recMap df.lhs) do
+      throwError "{label}: auxiliary constant survives σ in the rule for {ctor}"
+
+run_meta do
+  checkRestore09A "rose" ``RoseTree [`u] 1 roseDeps
+  checkRestore09A "nv" ``NVTree [] 0 nvDeps
+  checkRestore09A "cu" ``CURose [] 0 roseDeps
+
+end Ix.Theory.Named.NestedRepresentation
diff --git a/Ix/Theory/Named/Verify/Environment/NestedTransformation.lean b/Ix/Theory/Named/Verify/Environment/NestedTransformation.lean
new file mode 100644
index 000000000..d32c26af8
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/NestedTransformation.lean
@@ -0,0 +1,389 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.NestedRepresentation
+import Ix.Theory.Named.NestedInductiveFixtures
+
+/-!
+# Nested flattening differential (Spec-09B)
+
+Ties the Theory transformation `nestedElimination?` to the implementation:
+
+- the hand-written `List` target block in the Theory fixtures is exactly
+  Lean's stored metadata;
+- on the real rose-tree, nested-indexed, and constant-universe fixtures,
+  the Theory flattening reproduces the port's `ElimNestedInductive` output
+  family for family, constructor for constructor, and specification for
+  `aux2nested` binding — including the canonical auxiliary names — and its
+  auxiliary count equals the stored `numNested`;
+- Theory acceptance (`nestedStage3`) agrees with kernel acceptance on the
+  positives and on the nearest rejections: a parametric argument touching
+  a constructor-local binder (rejected by flattening itself, with the
+  kernel's exact error), an off-spine parametric application (rejected by
+  the unchanged block analyzer where the kernel fails constructor
+  checking), an in-block collision with the canonical auxiliary name
+  (rejected by `blockNamesOK` where the kernel's `checkName` rejects the
+  duplicate insertion), and a missing target declaration.
+-/
+
+namespace Ix.Theory.Named.NestedTransformation
+
+open Lean
+open Ix.Theory.Named.NestedRepresentation
+open Ix.Theory.Named.NestedInductiveFixtures
+open VInductDecl
+
+/-! ## The hand-written `List` target is the stored metadata -/
+
+def listNilStoredType : VExpr := nestedConstVType09A% List.nil
+def listConsStoredType : VExpr := nestedConstVType09A% List.cons
+def listStoredType : VExpr := nestedConstVType09A% List
+
+#guard listTarget.families.map (·.name) == [``List]
+#guard listTarget.nparams == 1
+#guard listTarget.families.map (·.type) == [listStoredType]
+#guard listTarget.families.map (·.ctors.map fun c => (c.name, c.uvars, c.type)) ==
+  [[(``List.nil, 1, listNilStoredType), (``List.cons, 1, listConsStoredType)]]
+
+/-! ## Real-metadata target blocks -/
+
+def pvecStoredTarget : NestedTargetBlock where
+  nparams := 1
+  families :=
+    [{ name := ``PVec
+       uvars := 0
+       type := nestedConstVType09A% PVec
+       ctors :=
+         [⟨⟨0, nestedConstVType09A% PVec.nil⟩, ``PVec.nil⟩,
+          ⟨⟨0, nestedConstVType09A% PVec.cons⟩, ``PVec.cons⟩] }]
+
+/-! ## Shared translation plumbing -/
+
+open Elab in
+/-- Translate a list of kernel `InductiveType`s into a `VInductDecl`. -/
+def toVInductDecl09B (lparams : List Name) (nparams : Nat)
+    (types : List InductiveType) : MetaM VInductDecl := do
+  let uvars := lparams.length
+  let mut vtypes : List VInductiveType := []
+  for t in types do
+    let vty ← Ix.Theory.Named.Meta.ofExpr lparams {} t.type
+    let mut vctors : List VConstVal := []
+    for c in t.ctors do
+      vctors := vctors ++ [⟨⟨uvars, ← Ix.Theory.Named.Meta.ofExpr lparams {} c.type⟩, c.name⟩]
+    vtypes := vtypes ++ [{ name := t.name, uvars, type := vty, ctors := vctors }]
+  return { uvars, nparams, types := vtypes }
+
+open Elab in
+/-- Check that the Theory flattening of one real source declaration equals
+the port's flattening, that its specifications are the translated
+`aux2nested` bindings, and that its auxiliary count is the stored
+`numNested`. -/
+def checkFlattenParity (label : String) (main : Name) (lparams : List Name)
+    (nparams : Nat) (deps : List Name) (targets : List NestedTargetBlock) :
+    MetaM Unit := do
+  let env ← getEnv
+  let src := sourceType09A env main
+  let kenv := Kernel.Environment.ofConstants (`_spec09B ++ main) (depMap09A env deps)
+  let .ok (flatTypes, aux) := runElim09A kenv lparams nparams [src]
+    | throwError "{label}: port flattening failed"
+  let sourceV ← toVInductDecl09B lparams nparams [src]
+  let portFlatV ← toVInductDecl09B lparams nparams flatTypes
+  let some elim := nestedElimination? targets sourceV
+    | throwError "{label}: Theory flattening failed"
+  unless elim.flat == portFlatV do
+    throwError "{label}: Theory flattened block differs from the port's"
+  unless elim.specs.length == aux.length do
+    throwError "{label}: {elim.specs.length} specs vs {aux.length} aux2nested bindings"
+  for spec in elim.specs do
+    let some (_, value) := aux.find? (·.1 == spec.aux)
+      | throwError "{label}: no aux2nested binding for {spec.aux}"
+    let valueV ← Ix.Theory.Named.Meta.ofExpr lparams {} value
+    unless spec.value == valueV do
+      throwError "{label}: spec value for {spec.aux} differs from aux2nested"
+    let .const target ls := VExpr.appHead valueV
+      | throwError "{label}: aux2nested head is not a constant"
+    unless spec.target == target && spec.levels == ls &&
+        spec.values == valueV.appArgs [] do
+      throwError "{label}: spec decomposition differs for {spec.aux}"
+  let some (.inductInfo stored) := env.find? main
+    | throwError "{label}: stored inductive missing"
+  unless elim.numNested == stored.numNested do
+    throwError "{label}: numNested {elim.numNested} vs stored {stored.numNested}"
+  unless nestedStage3 targets sourceV do
+    throwError "{label}: Theory acceptance rejected an accepted declaration"
+
+run_meta do
+  checkFlattenParity "rose" ``RoseTree [`u] 1 roseDeps [listTarget]
+  checkFlattenParity "nv" ``NVTree [] 0 nvDeps [pvecStoredTarget]
+  checkFlattenParity "cu" ``CURose [] 0 roseDeps [listTarget]
+
+/-! ## Rejection differentials
+
+Each negative is written once at the kernel `Expr` level and once as a
+`VInductDecl`; the kernel run and the Theory gate must both reject. -/
+
+def natDeps09B (env : Environment) : ConstMap :=
+  depMap09A env [``Nat, ``Nat.zero, ``Nat.succ, ``List, ``List.nil, ``List.cons]
+
+/-- `inductive Loose0 | node : (n : Nat) → List (Loose0 n) → Loose0` — the
+parametric argument mentions the constructor-local `n`. -/
+def looseDecl : Declaration :=
+  .inductDecl [] 0
+    [{ name := `Loose0
+       type := .sort 1
+       ctors := [{
+         name := `Loose0.node
+         type := .forallE `n (.const ``Nat [])
+           (.forallE `t
+             (mkApp (mkConst ``List [.zero]) (.app (.const `Loose0 []) (.bvar 0)))
+             (.const `Loose0 []) .default) .default }] }]
+    false
+
+def looseSourceV : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := `Loose0
+       uvars := 0
+       type := .sort (.succ .zero)
+       ctors :=
+         [⟨⟨0, .forallE (.const ``Nat [])
+             (.forallE (.app (.const ``List [.zero])
+                 (.app (.const `Loose0 []) (.bvar 0)))
+               (.const `Loose0 []))⟩, `Loose0.node⟩] }]
+
+/-- `inductive Bad0N | node : Bad0N → List (Bad0N Nat.zero) → Bad0N` — the
+parametric argument applies a block family off the parameter spine. -/
+def badAppDecl : Declaration :=
+  .inductDecl [] 0
+    [{ name := `Bad0N
+       type := .sort 1
+       ctors := [{
+         name := `Bad0N.node
+         type := .forallE `x (.const `Bad0N [])
+           (.forallE `t
+             (mkApp (mkConst ``List [.zero])
+               (.app (.const `Bad0N []) (.const ``Nat.zero [])))
+             (.const `Bad0N []) .default) .default }] }]
+    false
+
+def badAppSourceV : VInductDecl where
+  uvars := 0
+  nparams := 0
+  types :=
+    [{ name := `Bad0N
+       uvars := 0
+       type := .sort (.succ .zero)
+       ctors :=
+         [⟨⟨0, .forallE (.const `Bad0N [])
+             (.forallE (.app (.const ``List [.zero])
+                 (.app (.const `Bad0N []) (.const ``Nat.zero [])))
+               (.const `Bad0N []))⟩, `Bad0N.node⟩] }]
+
+/-- A two-family source whose second family occupies the canonical first
+auxiliary name `_nested.List_1`. -/
+def collisionDecl : Declaration :=
+  let rose := fun a => mkApp (mkConst `Rose0 [.param `u]) a
+  .inductDecl [`u] 1
+    [{ name := `Rose0
+       type := .forallE `α (.sort (.succ (.param `u))) (.sort (.succ (.param `u))) .default
+       ctors := [{
+         name := `Rose0.node
+         type := .forallE `α (.sort (.succ (.param `u)))
+           (.forallE `t (mkApp (mkConst ``List [.param `u]) (rose (.bvar 0)))
+             (rose (.bvar 1)) .default) .default }] },
+     { name := (`_nested ++ ``List).appendIndexAfter 1
+       type := .forallE `α (.sort (.succ (.param `u))) (.sort (.succ (.param `u))) .default
+       ctors := [] }]
+    false
+
+def collisionSourceV : VInductDecl where
+  uvars := 1
+  nparams := 1
+  types :=
+    [{ name := `Rose0
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors :=
+         [⟨⟨1, .forallE (.sort (.succ (.param 0)))
+             (.forallE (.bvar 0)
+               (.forallE (.app (.const ``List [.param 0])
+                   (.app (.const `Rose0 [.param 0]) (.bvar 1)))
+                 (.app (.const `Rose0 [.param 0]) (.bvar 2))))⟩, `Rose0.node⟩] },
+     { name := (`_nested ++ ``List).appendIndexAfter 1
+       uvars := 1
+       type := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+       ctors := [] }]
+
+open Elab in
+run_meta do
+  let env ← getEnv
+  let deps := natDeps09B env
+  let kenv := Kernel.Environment.ofConstants `_spec09BNeg deps
+  -- the loose parametric argument rejects in flattening, with the kernel's
+  -- exact diagnostic
+  match Ix.Theory.Named.addDecl kenv looseDecl with
+  | .ok _ => throwError "loose: kernel accepted a local-variable parametric argument"
+  | .error (.other msg) =>
+      unless msg == "invalid nested inductive datatype 'List', \
+          nested inductive datatypes parameters cannot contain local variables." do
+        throwError "loose: unexpected kernel diagnostic {msg}"
+  | .error _ => throwError "loose: unexpected kernel error shape"
+  unless (nestedElimination? [listTarget] looseSourceV).isNone do
+    throwError "loose: Theory flattening accepted"
+  unless !nestedStage3 [listTarget] looseSourceV do
+    throwError "loose: Theory gate accepted"
+  -- the off-spine parametric application flattens but fails checking
+  match Ix.Theory.Named.addDecl kenv badAppDecl with
+  | .ok _ => throwError "badApp: kernel accepted an off-spine parametric application"
+  | .error _ => pure ()
+  unless (nestedElimination? [listTarget] badAppSourceV).isSome do
+    throwError "badApp: Theory flattening should succeed"
+  unless !nestedStage3 [listTarget] badAppSourceV do
+    throwError "badApp: Theory gate accepted"
+  -- the canonical-name collision rejects at insertion (kernel) and at
+  -- `blockNamesOK` (Theory)
+  match Ix.Theory.Named.addDecl kenv collisionDecl with
+  | .ok _ => throwError "collision: kernel accepted a duplicate auxiliary name"
+  | .error _ => pure ()
+  unless (nestedElimination? [listTarget] collisionSourceV).isSome do
+    throwError "collision: Theory flattening should succeed"
+  unless !nestedStage3 [listTarget] collisionSourceV do
+    throwError "collision: Theory gate accepted"
+  -- a missing target declaration rejects on both sides
+  let kenvNoList := Kernel.Environment.ofConstants `_spec09BNoList
+    (depMap09A env [``Nat, ``Nat.zero, ``Nat.succ])
+  let roseSrc := sourceType09A env ``RoseTree
+  match Ix.Theory.Named.Environment.addInductive kenvNoList [`u] 1 [roseSrc] false false with
+  | .ok _ => throwError "noTarget: kernel accepted without the List declaration"
+  | .error _ => pure ()
+  let roseV ← toVInductDecl09B [`u] 1 [roseSrc]
+  unless !nestedStage3 [] roseV do
+    throwError "noTarget: Theory gate accepted without target metadata"
+
+/-! ## Restoration parity (Spec-09C)
+
+The Theory restoration over the flattened block's generation artifacts
+reproduces Lean's stored metadata exactly: every restored recursor name,
+universe count, and type, and every rule RHS in the globally flattened
+order, on all three real fixtures.  This runs the product σ
+(`NestedBlockChecked.recursors`/`generatedRules`), not the Spec-09A design
+probe. -/
+
+open Elab in
+def checkRestoreParity (label : String) (main : Name) (lparams : List Name)
+    (nparams : Nat) (targets : List NestedTargetBlock) : MetaM Unit := do
+  let env ← getEnv
+  let src := sourceType09A env main
+  let sourceV ← toVInductDecl09B lparams nparams [src]
+  let some nested := nestedBlockChecked? targets sourceV
+    | throwError "{label}: nested acceptance failed"
+  let expectedNames := [mkRecName main] ++
+    nested.elim.specs.mapIdx fun i _ => (mkRecName main).appendIndexAfter (i + 1)
+  unless nested.recursors.length == expectedNames.length do
+    throwError "{label}: {nested.recursors.length} restored recursors, \
+      expected {expectedNames.length}"
+  for (r, expected) in nested.recursors.zip expectedNames do
+    unless r.name == expected do
+      throwError "{label}: restored recursor name {r.name}, expected {expected}"
+    let some (.recInfo stored) := env.find? expected
+      | throwError "{label}: stored recursor {expected} missing"
+    unless r.uvars == stored.levelParams.length do
+      throwError "{label}: recursor universe count differs for {expected}"
+    let storedType ← Ix.Theory.Named.Meta.ofExpr stored.levelParams {}
+      (← Ix.Theory.Named.Meta.expandExpr stored.type)
+    unless r.type == storedType do
+      throwError "{label}: restored recursor type differs from stored for {expected}"
+  let mut storedRules : List (Name × Expr) := []
+  for n in expectedNames do
+    let some (.recInfo stored) := env.find? n
+      | throwError "{label}: stored recursor {n} missing"
+    for rule in stored.rules do
+      storedRules := storedRules ++ [(rule.ctor, rule.rhs)]
+  let rules := nested.generatedRules
+  unless rules.length == storedRules.length do
+    throwError "{label}: {rules.length} restored rules, stored {storedRules.length}"
+  let some (.recInfo mainRec) := env.find? (mkRecName main)
+    | throwError "{label}: stored main recursor missing"
+  for (df, (ctor, storedRhs)) in rules.zip storedRules do
+    let storedRhsV ← Ix.Theory.Named.Meta.ofExpr mainRec.levelParams {}
+      (← Ix.Theory.Named.Meta.expandExpr storedRhs)
+    unless df.rhs == storedRhsV do
+      throwError "{label}: restored rule RHS differs from stored for {ctor}"
+
+run_meta do
+  checkRestoreParity "rose" ``RoseTree [`u] 1 [listTarget]
+  checkRestoreParity "nv" ``NVTree [] 0 [pvecStoredTarget]
+  checkRestoreParity "cu" ``CURose [] 0 [listTarget]
+
+/-! ## Real-output round-trip (Spec-09C)
+
+Run the port's complete `Environment.addInductive` on a dependency-only
+kernel environment and compare its entire output — not the ambient
+elaborator metadata — against the Theory nested artifacts: the stored
+payload against the source constants, and every emitted recursor's name,
+universe count, type, rule constructors, rule field counts, and rule RHSs
+against the restored inventory.  Nothing in this comparison is
+hand-authored: the left side is real `Inductive.Add.run`-derived output
+and the right side is computed by `nestedBlockChecked?`. -/
+
+open Elab in
+def checkOutputRoundTrip (label : String) (main : Name) (lparams : List Name)
+    (nparams : Nat) (deps : List Name) (targets : List NestedTargetBlock) :
+    MetaM Unit := do
+  let env ← getEnv
+  let src := sourceType09A env main
+  let kenv := Kernel.Environment.ofConstants (`_spec09C ++ main) (depMap09A env deps)
+  let .ok kout := Ix.Theory.Named.Environment.addInductive kenv lparams nparams [src] false false
+    | throwError "{label}: port addInductive failed"
+  let sourceV ← toVInductDecl09B lparams nparams [src]
+  let some nested := nestedBlockChecked? targets sourceV
+    | throwError "{label}: nested acceptance failed"
+  -- the stored payload: families and constructors
+  for tyV in sourceV.types do
+    let some (.inductInfo out) := kout.find? tyV.name
+      | throwError "{label}: output family {tyV.name} missing"
+    let outType ← Ix.Theory.Named.Meta.ofExpr out.levelParams {} (← Ix.Theory.Named.Meta.expandExpr out.type)
+    unless out.levelParams.length == tyV.uvars && outType == tyV.type do
+      throwError "{label}: output family metadata differs for {tyV.name}"
+    unless out.numNested == nested.elim.numNested do
+      throwError "{label}: output numNested {out.numNested} vs \
+        artifact {nested.elim.numNested}"
+    for cV in tyV.ctors do
+      let some (.ctorInfo outC) := kout.find? cV.name
+        | throwError "{label}: output constructor {cV.name} missing"
+      let outCType ← Ix.Theory.Named.Meta.ofExpr outC.levelParams {}
+        (← Ix.Theory.Named.Meta.expandExpr outC.type)
+      unless outC.levelParams.length == cV.uvars && outCType == cV.type do
+        throwError "{label}: output constructor metadata differs for {cV.name}"
+  -- the restored recursors and their rules, in inventory order
+  let mut ruleIdx := 0
+  let rules := nested.generatedRules
+  for r in nested.recursors do
+    let some (.recInfo out) := kout.find? r.name
+      | throwError "{label}: output recursor {r.name} missing"
+    let outType ← Ix.Theory.Named.Meta.ofExpr out.levelParams {} (← Ix.Theory.Named.Meta.expandExpr out.type)
+    unless out.levelParams.length == r.uvars && outType == r.type do
+      throwError "{label}: output recursor metadata differs for {r.name}"
+    unless out.k == nested.generation.kTarget do
+      throwError "{label}: output recursor K flag differs for {r.name}"
+    for rule in out.rules do
+      let some df := rules[ruleIdx]?
+        | throwError "{label}: more output rules than restored rules"
+      let outRhs ← Ix.Theory.Named.Meta.ofExpr out.levelParams {}
+        (← Ix.Theory.Named.Meta.expandExpr rule.rhs)
+      unless outRhs == df.rhs do
+        throwError "{label}: output rule RHS differs for {rule.ctor}"
+      ruleIdx := ruleIdx + 1
+  unless ruleIdx == rules.length do
+    throwError "{label}: {rules.length} restored rules, output consumed {ruleIdx}"
+
+run_meta do
+  checkOutputRoundTrip "rose" ``RoseTree [`u] 1 roseDeps [listTarget]
+  checkOutputRoundTrip "nv" ``NVTree [] 0 nvDeps [pvecStoredTarget]
+  checkOutputRoundTrip "cu" ``CURose [] 0 roseDeps [listTarget]
+
+end Ix.Theory.Named.NestedTransformation
diff --git a/Ix/Theory/Named/Verify/Environment/Normalization.lean b/Ix/Theory/Named/Verify/Environment/Normalization.lean
new file mode 100644
index 000000000..68a92acb1
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/Normalization.lean
@@ -0,0 +1,6953 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.TypeChecker
+import Ix.Theory.Named.Reference.Inductive.ValidationTrace
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+
+namespace TypeChecker
+
+/-- Compatibility name for the consumer-neutral reflected-primitive list. -/
+@[deprecated Ix.Theory.Named.VEnv.reflectedPrimitiveNames (since := "2026-08-11")]
+abbrev reflectedPrimitiveNames : List Name :=
+  Ix.Theory.Named.VEnv.reflectedPrimitiveNames
+
+/-- Compatibility shim for the consumer-neutral Theory theorem. -/
+@[deprecated Ix.Theory.Named.VEnv.HasPrimitives.of_avoids (since := "2026-08-11")]
+theorem VEnv.HasPrimitives.of_avoids
+    {env : VEnv}
+    (h : ∀ n ∈ reflectedPrimitiveNames, env.constants n = none) :
+    env.HasPrimitives :=
+  Ix.Theory.Named.VEnv.HasPrimitives.of_avoids h
+
+/-- Compatibility shim for the consumer-neutral Theory theorem. -/
+@[deprecated Ix.Theory.Named.VEnv.addConst_other (since := "2026-08-11")]
+theorem VEnv.addConst_other
+    {env env' : VEnv} {name other : Name} {ci : VConstant}
+    (hadd : env.addConst name ci = some env')
+    (hne : name ≠ other) :
+    env'.constants other = env.constants other :=
+  Ix.Theory.Named.VEnv.addConst_other hadd hne
+
+/-- Compatibility shim for the consumer-neutral Theory theorem. -/
+@[deprecated Ix.Theory.Named.VEnv.HasPrimitives.addConst (since := "2026-08-11")]
+theorem VEnv.HasPrimitives.addConst
+    {env env' : VEnv} {name : Name} {ci : VConstant}
+    (H : env.HasPrimitives)
+    (hname : name ∉ reflectedPrimitiveNames)
+    (hadd : env.addConst name ci = some env') :
+    env'.HasPrimitives :=
+  Ix.Theory.Named.VEnv.HasPrimitives.addConst H hname hadd
+
+/-- A verified implementation local context remains verified when the Theory
+environment grows.  Kernel local declarations and their free-variable names
+are unchanged; only their translations and typing derivations are transported
+monotonically. -/
+theorem MLCtx.WF.mono
+    {env env' : VEnv} (henv : env ≤ env') :
+    ∀ {context : MLCtx} {Us : List Name},
+      context.WF env Us → context.WF env' Us
+  | .nil, _, _ => trivial
+  | .vlam _ _ _ _ _ _, _,
+      ⟨tailWF, fresh, type_tr, typeWF⟩ =>
+    ⟨tailWF.mono henv, fresh, type_tr.mono henv, typeWF.mono henv⟩
+  | .vlet _ _ _ _ _ _ _, _,
+      ⟨tailWF, fresh, type_tr, value_tr, valueWF⟩ =>
+    ⟨tailWF.mono henv, fresh, type_tr.mono henv,
+      value_tr.mono henv, valueWF.mono henv⟩
+
+/-- Kernel-side counterpart of `VEnv.HasPrimitives.of_avoids`: if an isolated
+constant map contains no hard-coded primitive name, the safety premise needed
+by `VContext` is vacuous. -/
+theorem safePrimitives_of_avoids
+    {env : Environment} {n : Name} {ci : ConstantInfo}
+    (h : ∀ n, Environment.primitives.contains n → env.find? n = none) :
+    env.find? n = some ci →
+      Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [] := by
+  intro hfind hprim
+  rw [h n hprim] at hfind
+  contradiction
+
+/-- Staging one fresh non-primitive inductive family preserves the kernel-side
+primitive safety contract. All old lookups are inherited from the input map;
+the only new lookup cannot be primitive by hypothesis. -/
+theorem AddInductConstant.safePrimitives
+    {pre post : Environment} {env typeEnv : VEnv} {raw : VConstVal}
+    (stage : AddInductConstant .induct pre.constants env raw
+      post.constants typeEnv)
+    (preMapWF : pre.constants.WF)
+    (H : pre.find? n = some ci →
+      Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [])
+    (hname : Environment.primitives.contains raw.name = false) :
+    post.find? n = some ci →
+      Environment.primitives.contains n →
+      ci.safety = .safe ∧ ci.levelParams = [] := by
+  intro hfind hprim
+  have postMapWF := stage.map_wf preMapWF
+  change post.constants.find?' n = some ci at hfind
+  rw [postMapWF.find?'_eq_find?, stage.map_add,
+    preMapWF.find?_insert] at hfind
+  split at hfind
+  · rename_i heq
+    have : raw.name = n := by simpa using heq
+    subst n
+    rw [hname] at hprim
+    contradiction
+  · apply H
+    change pre.constants.find?' n = some ci
+    rw [preMapWF.find?'_eq_find?]
+    exact hfind
+    exact hprim
+
+/-- Evidence that Verify's recursive WHNF procedure returned an exact kernel
+expression, together with strict translations of the input and output into one
+Theory context.
+
+The result is not trusted merely because it is supplied by a caller:
+`run_eq` records the concrete checker execution, while `rhs_tr` identifies its
+Theory meaning. -/
+structure WhnfRun (env : VEnv) (Us : List Name) (Δ : VLCtx)
+    (lhs rhs : Expr) (lhs' rhs' : VExpr) where
+  context : VContext
+  venv_eq : context.venv = env
+  lparams_eq : context.lparams = Us
+  vlctx_eq : context.vlctx = Δ
+  state_wf : VState.WF context {}
+  lhs_tr : TrExprS env Us Δ lhs lhs'
+  rhs_tr : TrExprS env Us Δ rhs rhs'
+  recursionFuel : Nat
+  run_eq : ∃ state : State,
+    Inner.whnf' lhs (Methods.withFuel recursionFuel)
+      context.toContext ({} : State) = .ok (rhs, state)
+
+/-- Turn one operationally certified candidate step into the existing
+state-bearing Verify certificate once the caller supplies the strict
+kernel/Theory translations and the corresponding verified context.
+
+The adapter recovers the final checker state from the stored `M.run` equality;
+it does not rerun normalization, choose a result, or assert a semantic
+equality. -/
+def WhnfRun.ofCandidateStep
+    (step : AddInductive.CandidateWhnfStep)
+    (hvalid : step.Valid)
+    (context : VContext)
+    (context_eq :
+      context.toContext = step.context.toTypeChecker)
+    (venv_eq : context.venv = env)
+    (lparams_eq : context.lparams = Us)
+    (vlctx_eq : context.vlctx = Δ)
+    (state_wf : VState.WF context {})
+    (lhs_tr : TrExprS env Us Δ step.source lhs')
+    (rhs_tr : TrExprS env Us Δ step.result rhs')
+    (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel + 1) :
+    WhnfRun env Us Δ step.source step.result lhs' rhs' where
+  context := context
+  venv_eq := venv_eq
+  lparams_eq := lparams_eq
+  vlctx_eq := vlctx_eq
+  state_wf := state_wf
+  lhs_tr := lhs_tr
+  rhs_tr := rhs_tr
+  recursionFuel := recursionFuel
+  run_eq := by
+    rw [context_eq]
+    exact step.innerRun recursionFuel hdepth hvalid
+
+/-- The strict input translation already supplies the Theory well-formedness
+needed to type an exact WHNF equality. In particular, a certificate producer
+does not need to borrow a typing fact from the normalized declaration it is
+trying to construct. -/
+theorem WhnfRun.lhs_wf
+    (run : WhnfRun env Us Δ lhs rhs lhs' rhs') :
+    lhs'.WF env Us.length Δ.toCtx := by
+  have hlhs : run.context.TrExprS lhs lhs' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.lhs_tr
+  have hwf := hlhs.wf run.context.Ewf.ordered run.context.Δwf
+  simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using hwf
+
+/-- An exact successful verified WHNF execution is an ordinary Theory
+definitional equality. The proof consumes the existing checker-refinement
+contract and uses representation uniqueness to identify the translated
+result. -/
+theorem WhnfRun.isDefEqU
+    (run : WhnfRun env Us Δ lhs rhs lhs' rhs') :
+    env.IsDefEqU Us.length Δ.toCtx lhs' rhs' := by
+  have hlhs : run.context.TrExprS lhs lhs' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.lhs_tr
+  have hrhs : run.context.TrExpr rhs rhs' := by
+    have strict : run.context.TrExprS rhs rhs' := by
+      simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+        run.vlctx_eq] using run.rhs_tr
+    exact strict.trExpr run.context.Ewf run.context.Δwf
+  obtain ⟨state, hrun⟩ := run.run_eq
+  obtain ⟨_, _, _, _, _, htr⟩ :=
+    (TypeChecker.Inner.whnf'.WF hlhs
+      (Methods.withFuel run.recursionFuel) Methods.withFuel.WF)
+      run.state_wf rhs state hrun
+  have hdefeq :=
+    htr.uniq run.context.Ewf
+      (.refl run.context.Ewf run.context.Δwf) hrhs
+  simpa only [VContext.IsDefEqU, run.venv_eq, run.lparams_eq,
+    run.vlctx_eq] using hdefeq
+
+/-- Typed form of `WhnfRun.isDefEqU`. A known type for the input fixes the
+otherwise existential type in the WHNF refinement result. -/
+theorem WhnfRun.isDefEq
+    (run : WhnfRun env Us Δ lhs rhs lhs' rhs')
+    (hlhs : env.HasType Us.length Δ.toCtx lhs' A) :
+    env.IsDefEq Us.length Δ.toCtx lhs' rhs' A := by
+  have henv : VEnv.WF env := by
+    simpa only [run.venv_eq] using run.context.Ewf
+  have hΔ : OnCtx Δ.toCtx (env.IsType Us.length) := by
+    simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using
+      run.context.Δwf.toCtx
+  exact run.isDefEqU.of_l henv hΔ hlhs
+
+/-- Evidence that Verify's full type-checking path inferred an exact kernel
+type, with strict Theory translations of both the checked expression and the
+returned type.
+
+`inferOnly := false` is important here: the recorded run checks the expression
+rather than trusting a caller-provided `TrExprS` derivation as an inference
+cache hit. -/
+structure CheckTypeRun (env : VEnv) (Us : List Name) (Δ : VLCtx)
+    (expr inferred : Expr) (expr' inferred' : VExpr) where
+  context : VContext
+  venv_eq : context.venv = env
+  lparams_eq : context.lparams = Us
+  vlctx_eq : context.vlctx = Δ
+  state_wf : VState.WF context {}
+  expr_tr : TrExprS env Us Δ expr expr'
+  inferred_tr : TrExprS env Us Δ inferred inferred'
+  recursionFuel : Nat
+  run_eq : ∃ state : State,
+    Inner.inferType expr false (Methods.withFuel recursionFuel)
+      context.toContext ({} : State) = .ok (inferred, state)
+
+/-- Candidate-step adapter for full checking. As with
+`WhnfRun.ofCandidateStep`, the operational result and final state come from
+the producer; this boundary only attaches an already verified context and
+strict translations. -/
+def CheckTypeRun.ofCandidateStep
+    (step : AddInductive.CandidateCheckTypeStep)
+    (hvalid : step.Valid)
+    (context : VContext)
+    (context_eq :
+      context.toContext = step.context.toTypeChecker)
+    (venv_eq : context.venv = env)
+    (lparams_eq : context.lparams = Us)
+    (vlctx_eq : context.vlctx = Δ)
+    (state_wf : VState.WF context {})
+    (expr_tr : TrExprS env Us Δ step.source expr')
+    (inferred_tr : TrExprS env Us Δ step.inferred inferred')
+    (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel) :
+    CheckTypeRun env Us Δ step.source step.inferred expr' inferred' where
+  context := context
+  venv_eq := venv_eq
+  lparams_eq := lparams_eq
+  vlctx_eq := vlctx_eq
+  state_wf := state_wf
+  expr_tr := expr_tr
+  inferred_tr := inferred_tr
+  recursionFuel := recursionFuel
+  run_eq := by
+    rw [context_eq]
+    exact step.innerRun recursionFuel hdepth hvalid
+
+/-- Recover the strict Theory translations and typing judgment supplied by an
+exact retained full-check observation.
+
+This is the proof-producing counterpart of `CheckTypeRun.ofCandidateStep` for
+callers that do not yet have named translations.  The only source-side premise
+is the free-variable condition required by the verified checker refinement. -/
+theorem candidateCheckTypeStep_exists_translation
+    (step : AddInductive.CandidateCheckTypeStep)
+    (hvalid : step.Valid)
+    (context : VContext)
+    (context_eq : context.toContext = step.context.toTypeChecker)
+    (state_wf : VState.WF context {})
+    (source_fvars :
+      step.source.FVarsIn (· ∈ context.vlctx.fvars))
+    (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel) :
+    ∃ source' inferred',
+      context.TrExprS step.source source' ∧
+      context.TrExprS step.inferred inferred' ∧
+      context.HasType source' inferred' := by
+  obtain ⟨state, run⟩ :=
+    step.innerRun recursionFuel hdepth hvalid
+  rw [← context_eq] at run
+  obtain ⟨_, _, _, _, source', inferred', typing⟩ :=
+    (Inner.checkType.WF source_fvars
+      (Methods.withFuel recursionFuel) Methods.withFuel.WF)
+      state_wf step.inferred state run
+  exact ⟨source', inferred', typing.2.1, typing.2.2.1,
+    typing.2.2.2⟩
+
+/-- An exact successful `checkType` execution supplies the corresponding
+Theory typing judgment. Translation uniqueness transports the verifier's
+existential result to the precise translations named by the certificate. -/
+theorem CheckTypeRun.hasType
+    (run : CheckTypeRun env Us Δ expr inferred expr' inferred') :
+    env.HasType Us.length Δ.toCtx expr' inferred' := by
+  have hexpr : run.context.TrExprS expr expr' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.expr_tr
+  have hinferred : run.context.TrExprS inferred inferred' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.inferred_tr
+  obtain ⟨state, hrun⟩ := run.run_eq
+  obtain ⟨_, _, _, _, e, ty, htyping⟩ :=
+    (TypeChecker.Inner.checkType.WF hexpr.fvarsIn
+      (Methods.withFuel run.recursionFuel) Methods.withFuel.WF)
+      run.state_wf inferred state hrun
+  rcases htyping with ⟨_, he, hty, hhasType⟩
+  have heq :=
+    he.uniq run.context.Ewf
+      (.refl run.context.Ewf run.context.Δwf) hexpr
+  have htyeq :=
+    hty.uniq run.context.Ewf
+      (.refl run.context.Ewf run.context.Δwf) hinferred
+  have hout :=
+    (hhasType.defeqU_l run.context.Ewf run.context.Δwf heq).defeqU_r
+      run.context.Ewf run.context.Δwf htyeq
+  simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using hout
+
+/-- A checked expression whose inferred type translates to a sort is a Theory
+type. This is the insertion premise needed for raw family and constructor
+constants. -/
+theorem CheckTypeRun.isType
+    (run : CheckTypeRun env Us Δ expr inferred expr' (.sort u)) :
+    env.IsType Us.length Δ.toCtx expr' :=
+  ⟨u, run.hasType⟩
+
+/-- If `checkType` returns a type expression whose own verified WHNF is a
+sort, the checked expression is a Theory type. This is the common alias case:
+the checker may infer a reducible type constant before `ensureSort` exposes its
+sort WHNF. -/
+theorem CheckTypeRun.isType_of_whnf
+    (run : CheckTypeRun env Us Δ expr inferred expr' inferred')
+    (typeRun : WhnfRun env Us Δ inferred reduced inferred' (.sort u)) :
+    env.IsType Us.length Δ.toCtx expr' := by
+  have henv : VEnv.WF env := by
+    simpa only [run.venv_eq] using run.context.Ewf
+  have hΔ : OnCtx Δ.toCtx (env.IsType Us.length) := by
+    simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using
+      run.context.Δwf.toCtx
+  exact ⟨u, run.hasType.defeqU_r henv hΔ typeRun.isDefEqU⟩
+
+/-- Evidence for one exact successful checker definitional-equality run, with
+strict translations of both kernel endpoints in the same Theory context. -/
+structure IsDefEqRun (env : VEnv) (Us : List Name) (Δ : VLCtx)
+    (lhs rhs : Expr) (lhs' rhs' : VExpr) where
+  context : VContext
+  venv_eq : context.venv = env
+  lparams_eq : context.lparams = Us
+  vlctx_eq : context.vlctx = Δ
+  state_wf : VState.WF context {}
+  lhs_tr : TrExprS env Us Δ lhs lhs'
+  rhs_tr : TrExprS env Us Δ rhs rhs'
+  recursionFuel : Nat
+  run_eq : ∃ state : State,
+    Inner.isDefEq lhs rhs (Methods.withFuel recursionFuel)
+      context.toContext ({} : State) = .ok (true, state)
+
+/-- Convert the retained candidate equality observation to a state-bearing
+Verify certificate. -/
+def IsDefEqRun.ofCandidateStep
+    (step : AddInductive.CandidateIsDefEqStep)
+    (hvalid : step.Valid)
+    (context : VContext)
+    (context_eq : context.toContext = step.context.toTypeChecker)
+    (venv_eq : context.venv = env)
+    (lparams_eq : context.lparams = Us)
+    (vlctx_eq : context.vlctx = Δ)
+    (state_wf : VState.WF context {})
+    (lhs_tr : TrExprS env Us Δ step.lhs lhs')
+    (rhs_tr : TrExprS env Us Δ step.rhs rhs')
+    (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel) :
+    IsDefEqRun env Us Δ step.lhs step.rhs lhs' rhs' where
+  context := context
+  venv_eq := venv_eq
+  lparams_eq := lparams_eq
+  vlctx_eq := vlctx_eq
+  state_wf := state_wf
+  lhs_tr := lhs_tr
+  rhs_tr := rhs_tr
+  recursionFuel := recursionFuel
+  run_eq := by
+    rw [context_eq]
+    exact step.innerRun recursionFuel hdepth hvalid
+
+/-- A successful verified equality run supplies ordinary Theory
+definitional equality. -/
+theorem IsDefEqRun.isDefEqU
+    (run : IsDefEqRun env Us Δ lhs rhs lhs' rhs') :
+    env.IsDefEqU Us.length Δ.toCtx lhs' rhs' := by
+  have hlhs : run.context.TrExprS lhs lhs' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.lhs_tr
+  have hrhs : run.context.TrExprS rhs rhs' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.rhs_tr
+  obtain ⟨state, hrun⟩ := run.run_eq
+  obtain ⟨_, _, _, _, hdefeq⟩ :=
+    (TypeChecker.Inner.isDefEq.WF hlhs hrhs
+      (Methods.withFuel run.recursionFuel) Methods.withFuel.WF)
+      run.state_wf true state hrun
+  simpa only [VContext.IsDefEqU, run.venv_eq, run.lparams_eq,
+    run.vlctx_eq] using hdefeq (by simp)
+
+/-- Consuming a certified annotation path cannot introduce a free variable or
+level metavariable. -/
+theorem candidateTypeAnnotation_fvarsIn
+    (trace : AddInductive.CandidateTypeAnnotationTrace source consumed)
+    (h : source.FVarsIn fvars) : consumed.FVarsIn fvars := by
+  induction trace with
+  | identity => exact h
+  | outParam _ _ _ ih => exact ih h.2
+  | semiOutParam _ _ _ ih => exact ih h.2
+  | optParam _ _ _ _ ih => exact ih h.1.2
+  | autoParam _ _ _ _ ih => exact ih h.1.2
+
+/-- Extract a strict translation of the consumed annotation argument from the
+strict translation of the raw wrapper application. -/
+theorem candidateTypeAnnotation_exists_translation
+    (trace : AddInductive.CandidateTypeAnnotationTrace source consumed)
+    (source_tr : TrExprS env Us Δ source source') :
+    ∃ consumed', TrExprS env Us Δ consumed consumed' := by
+  induction trace generalizing source' with
+  | identity => exact ⟨source', source_tr⟩
+  | outParam _ _ _ ih =>
+    let .app _ _ _ type_tr := source_tr
+    exact ih type_tr
+  | semiOutParam _ _ _ ih =>
+    let .app _ _ _ type_tr := source_tr
+    exact ih type_tr
+  | optParam _ _ _ _ ih =>
+    let .app _ _ fn_tr _ := source_tr
+    let .app _ _ _ type_tr := fn_tr
+    exact ih type_tr
+  | autoParam _ _ _ _ ih =>
+    let .app _ _ fn_tr _ := source_tr
+    let .app _ _ _ type_tr := fn_tr
+    exact ih type_tr
+
+/-- The empty executable checker state is well formed for any verified
+context whose free-variable names are already reserved by the kernel name
+generator.  `VState.WF.empty` is the empty-local-context specialization;
+candidate normalization needs this slightly more general form after entering
+raw Pi binders. -/
+theorem VState.WF.empty_of_reserves
+    (context : VContext)
+    (reserved : ∀ fv ∈ context.vlctx.fvars,
+      (({} : VState).ngen).Reserves fv) :
+    VState.WF context {} where
+  trctx := context.trlctx
+  ngen_wf := reserved
+  ectx := ⟨context.vlctx, .refl, context.Δwf, .refl, .empty, reserved⟩
+  inferTypeI_wf := .empty
+  inferTypeC_wf := .empty
+  whnfCore_wf := .empty
+  whnf_wf := .empty
+  unfold_wf _ := by simp
+
+/-- Positional verified context for an executable normalization candidate.
+
+The equality pins every checker-visible field (environment, local context,
+safety, level parameters, and fuel) to the `AddInductive.Context` retained by
+the candidate trace.  The state certificate is kept with it because every
+retained full-check and WHNF observation starts from the empty checker state. -/
+structure CandidateContextRun
+    (candidateContext : AddInductive.Context) where
+  context : VContext
+  context_eq : context.toContext = candidateContext.toTypeChecker
+  state_wf : VState.WF context {}
+  namePrefix_ne : candidateContext.ngen.namePrefix ≠
+    (({} : VState).ngen).namePrefix
+
+/-- Candidate binders and the kernel checker's own temporary names use
+different prefixes, so every candidate binder is reserved by a freshly
+initialized kernel checker state. -/
+theorem candidateFreshFVarId_reserved
+    (candidateContext : AddInductive.Context)
+    (namePrefix_ne : candidateContext.ngen.namePrefix ≠
+      (({} : VState).ngen).namePrefix) :
+    (({} : VState).ngen).Reserves candidateContext.freshFVarId := by
+  simp [NameGenerator.Reserves, AddInductive.Context.freshFVarId]
+  intro i h
+  apply namePrefix_ne
+  simpa only [NameGenerator.curr, Name.getPrefix] using
+    congrArg Name.getPrefix h
+
+/-- Package an already verified checker context at a candidate position. -/
+def CandidateContextRun.ofVContext
+    (candidateContext : AddInductive.Context)
+    (context : VContext)
+    (context_eq : context.toContext = candidateContext.toTypeChecker)
+    (state_wf : VState.WF context {})
+    (namePrefix_ne : candidateContext.ngen.namePrefix ≠
+      (({} : VState).ngen).namePrefix) :
+    CandidateContextRun candidateContext :=
+  ⟨context, context_eq, state_wf, namePrefix_ne⟩
+
+/-- Construct the root certificate used by family and constructor candidates.
+Their candidate traversal deliberately resets the local context to empty. -/
+def CandidateContextRun.root
+    {ves : VEnvs} (wf : ves.WF candidateContext.env)
+    (lctx_eq : candidateContext.lctx = {})
+    (namePrefix_ne : candidateContext.ngen.namePrefix ≠
+      (({} : VState).ngen).namePrefix) :
+    CandidateContextRun candidateContext := by
+  let context := VContext.mk' wf candidateContext.safety
+    candidateContext.lparams candidateContext.fuel
+  refine ⟨context, ?_, ?_, namePrefix_ne⟩
+  · simp [context, VContext.mk', VContext.mk1, MLCtx.lctx,
+      AddInductive.Context.toTypeChecker, lctx_eq]
+  · exact VState.WF.empty
+
+@[simp] theorem CandidateContextRun.context_env
+    (run : CandidateContextRun candidateContext) :
+    run.context.env = candidateContext.env := by
+  have h := congrArg (fun c : TypeChecker.Context => c.env) run.context_eq
+  simpa only [AddInductive.Context.toTypeChecker] using h
+
+@[simp] theorem CandidateContextRun.context_lctx
+    (run : CandidateContextRun candidateContext) :
+    run.context.lctx = candidateContext.lctx := by
+  have h := congrArg (fun c : TypeChecker.Context => c.lctx) run.context_eq
+  simpa only [AddInductive.Context.toTypeChecker] using h
+
+@[simp] theorem CandidateContextRun.context_safety
+    (run : CandidateContextRun candidateContext) :
+    run.context.safety = candidateContext.safety := by
+  have h := congrArg (fun c : TypeChecker.Context => c.safety) run.context_eq
+  simpa only [AddInductive.Context.toTypeChecker] using h
+
+@[simp] theorem CandidateContextRun.context_lparams
+    (run : CandidateContextRun candidateContext) :
+    run.context.lparams = candidateContext.lparams := by
+  have h := congrArg (fun c : TypeChecker.Context => c.lparams) run.context_eq
+  simpa only [AddInductive.Context.toTypeChecker] using h
+
+@[simp] theorem CandidateContextRun.context_fuel
+    (run : CandidateContextRun candidateContext) :
+    run.context.fuel = candidateContext.fuel := by
+  have h := congrArg (fun c : TypeChecker.Context => c.fuel) run.context_eq
+  simpa only [AddInductive.Context.toTypeChecker] using h
+
+/-- Reset only the implementation and Theory local contexts while retaining
+the exact environment, safety mode, level parameters, fuel, and name
+generator owned by a candidate context.  Constructor root `checkType` uses
+precisely this context before the validation telescope re-enters the retained
+family locals. -/
+def CandidateContextRun.withEmptyLocalContext
+    (run : CandidateContextRun candidateContext) :
+    CandidateContextRun candidateContext.withEmptyLocalContext := by
+  let context : VContext :=
+    { run.context with
+      lctx := {}
+      mlctx := .nil
+      mlctx_wf := trivial
+      lctx_eq := rfl }
+  have context_eq : context.toContext =
+      candidateContext.withEmptyLocalContext.toTypeChecker := by
+    change { run.context.toContext with lctx := {} } =
+      candidateContext.withEmptyLocalContext.toTypeChecker
+    rw [run.context_eq]
+    rfl
+  refine ⟨context, context_eq, ?_, run.namePrefix_ne⟩
+  exact VState.WF.empty_of_reserves context (by
+    intro fv hfv
+    change fv ∈ VLCtx.fvars ([] : VLCtx) at hfv
+    simp at hfv)
+
+/-- Package a retained full-check observation at an already named strict
+Theory source.  The verified execution still chooses the inferred Theory
+type; the duplicate source translation returned by refinement is discarded,
+not identified by syntactic equality. -/
+theorem CheckTypeRun.exists_ofCandidateStep
+    (step : AddInductive.CandidateCheckTypeStep)
+    (hvalid : step.Valid)
+    (contextRun : CandidateContextRun step.context)
+    (source' : VExpr)
+    (source_tr : contextRun.context.TrExprS step.source source') :
+    ∃ inferred', Nonempty
+      (CheckTypeRun contextRun.context.venv contextRun.context.lparams
+        contextRun.context.vlctx step.source step.inferred source' inferred') := by
+  obtain ⟨_, inferred', _, inferred_tr, _⟩ :=
+    candidateCheckTypeStep_exists_translation step hvalid
+      contextRun.context contextRun.context_eq contextRun.state_wf
+      source_tr.fvarsIn step.context.fuel.recDepth rfl
+  exact ⟨inferred', ⟨CheckTypeRun.ofCandidateStep step hvalid
+    contextRun.context contextRun.context_eq rfl rfl rfl
+    contextRun.state_wf source_tr inferred_tr
+    step.context.fuel.recDepth rfl⟩⟩
+
+/-- Full-check packaging when only the checker's syntactic free-variable
+premise is known.  Both strict Theory endpoints are then selected by the
+verified refinement of the retained execution. -/
+theorem CheckTypeRun.exists_ofCandidateStepFVars
+    (step : AddInductive.CandidateCheckTypeStep)
+    (hvalid : step.Valid)
+    (contextRun : CandidateContextRun step.context)
+    (source_fvars :
+      step.source.FVarsIn (· ∈ contextRun.context.vlctx.fvars)) :
+    ∃ source' inferred', Nonempty
+      (CheckTypeRun contextRun.context.venv contextRun.context.lparams
+        contextRun.context.vlctx step.source step.inferred source' inferred') := by
+  obtain ⟨source', inferred', source_tr, inferred_tr, _⟩ :=
+    candidateCheckTypeStep_exists_translation step hvalid
+      contextRun.context contextRun.context_eq contextRun.state_wf
+      source_fvars step.context.fuel.recDepth rfl
+  exact ⟨source', inferred', ⟨CheckTypeRun.ofCandidateStep step hvalid
+    contextRun.context contextRun.context_eq rfl rfl rfl
+    contextRun.state_wf source_tr inferred_tr
+    step.context.fuel.recDepth rfl⟩⟩
+
+/-- Package one retained WHNF observation and keep the strict Theory
+translation selected for its exact kernel result. -/
+theorem WhnfRun.exists_ofCandidateStep
+    (step : AddInductive.CandidateWhnfStep)
+    (hvalid : step.Valid)
+    (contextRun : CandidateContextRun step.context)
+    (source' : VExpr)
+    (source_tr : contextRun.context.TrExprS step.source source')
+    (recursionFuel : Nat)
+    (hdepth : step.context.fuel.recDepth = recursionFuel + 1) :
+    ∃ result', contextRun.context.TrExprS step.result result' ∧
+      Nonempty (WhnfRun contextRun.context.venv
+        contextRun.context.lparams contextRun.context.vlctx
+        step.source step.result source' result') := by
+  obtain ⟨state, run⟩ := step.innerRun recursionFuel hdepth hvalid
+  rw [← contextRun.context_eq] at run
+  obtain ⟨_, _, _, _, _, resultTranslation⟩ :=
+    (Inner.whnf'.WF source_tr
+      (Methods.withFuel recursionFuel) Methods.withFuel.WF)
+      contextRun.state_wf step.result state run
+  obtain ⟨result', result_tr, _⟩ := resultTranslation
+  exact ⟨result', result_tr, ⟨WhnfRun.ofCandidateStep step hvalid
+    contextRun.context contextRun.context_eq rfl rfl rfl
+    contextRun.state_wf source_tr result_tr
+    recursionFuel hdepth⟩⟩
+
+/-- Extend a verified candidate context by precisely the raw local declaration
+used by `AddInductive.Context.pushLocalDecl`.
+
+The caller supplies the strict Theory translation and typing of the *stored*
+local-domain expression.  Freshness comes from the trace index; reservation is
+the independent fact needed to restart each retained checker observation from
+the empty kernel checker state. -/
+def CandidateContextRun.pushLocalDecl
+    (run : CandidateContextRun candidateContext)
+    (name : Name) (binderInfo : BinderInfo) (domain : Expr)
+    (fresh : candidateContext.lctx.find?
+      candidateContext.freshFVarId = none)
+    (domain' : VExpr)
+    (domain_tr : run.context.TrExprS domain domain')
+    (domain_type : run.context.IsType domain') :
+    CandidateContextRun
+      (candidateContext.pushLocalDecl name binderInfo domain) := by
+  let mlctx := run.context.mlctx.vlam candidateContext.freshFVarId
+    name domain domain' binderInfo
+  have lctx_eq : run.context.mlctx.lctx = candidateContext.lctx := by
+    calc
+      run.context.mlctx.lctx = run.context.lctx := run.context.lctx_eq
+      _ = candidateContext.lctx := by
+        simp
+  have fresh' : run.context.mlctx.lctx.find?
+      candidateContext.freshFVarId = none := by
+    rw [lctx_eq]
+    exact fresh
+  have mlctx_wf : mlctx.WF run.context.venv run.context.lparams :=
+    ⟨run.context.mlctx_wf, fresh', domain_tr, domain_type⟩
+  let context := run.context.withMLC mlctx (wf := ⟨mlctx_wf⟩)
+  have context_eq : context.toContext =
+      (candidateContext.pushLocalDecl name binderInfo domain).toTypeChecker := by
+    change { run.context.toContext with
+        lctx := run.context.mlctx.lctx.mkLocalDecl
+          candidateContext.freshFVarId name domain binderInfo } = _
+    rw [run.context_eq, lctx_eq]
+    rfl
+  refine ⟨context, context_eq, VState.WF.empty_of_reserves context ?_, ?_⟩
+  intro fv hfv
+  change fv ∈ candidateContext.freshFVarId ::
+    run.context.vlctx.fvars at hfv
+  simp only [List.mem_cons] at hfv
+  rcases hfv with rfl | hfv
+  · exact candidateFreshFVarId_reserved candidateContext run.namePrefix_ne
+  · exact run.state_wf.ngen_wf fv hfv
+  simpa [AddInductive.Context.pushLocalDecl, NameGenerator.next] using
+    run.namePrefix_ne
+
+@[simp] theorem CandidateContextRun.pushLocalDecl_venv
+    (run : CandidateContextRun candidateContext)
+    (domain_tr : run.context.TrExprS domain domain')
+    (domain_type : run.context.IsType domain') :
+    (run.pushLocalDecl name binderInfo domain fresh domain' domain_tr
+      domain_type).context.venv = run.context.venv := by
+  simp [CandidateContextRun.pushLocalDecl, VContext.withMLC]
+
+@[simp] theorem CandidateContextRun.pushLocalDecl_lparams
+    (run : CandidateContextRun candidateContext)
+    (domain_tr : run.context.TrExprS domain domain')
+    (domain_type : run.context.IsType domain') :
+    (run.pushLocalDecl name binderInfo domain fresh domain' domain_tr
+      domain_type).context.lparams = run.context.lparams := by
+  simp [CandidateContextRun.pushLocalDecl, VContext.withMLC]
+
+@[simp] theorem CandidateContextRun.pushLocalDecl_vlctx
+    (run : CandidateContextRun candidateContext)
+    (domain_tr : run.context.TrExprS domain domain')
+    (domain_type : run.context.IsType domain') :
+    (run.pushLocalDecl name binderInfo domain fresh domain' domain_tr
+      domain_type).context.vlctx =
+      (some (candidateContext.freshFVarId, domain.fvarsList),
+        .vlam domain') :: run.context.vlctx := by
+  simp [CandidateContextRun.pushLocalDecl, VContext.withMLC]
+
+/-- The two exact verifier runs attached to one retained candidate node.
+
+The indices force both runs to use the node's kernel source and observed
+results and to agree on its Theory source.  This is the atomic input to the
+recursive candidate interpreter below: a successful full check supplies the
+type at which the successful WHNF execution is interpreted. -/
+structure CandidateNodeRun (env : VEnv) (Us : List Name) (Δ : VLCtx)
+    (context : AddInductive.Context)
+    (source inferred result : Expr)
+    (source' result' inferred' : VExpr) where
+  check : CheckTypeRun env Us Δ source inferred source' inferred'
+  whnf : WhnfRun env Us Δ source result source' result'
+
+/-- Construct an atomic semantic node directly from the two proof-carrying
+observations retained by `CandidateExprTrace`.  The caller supplies only the
+verified context and translations; the operational equalities and erased
+checker states come from the candidate observations themselves. -/
+def CandidateNodeRun.ofCandidate
+    (candidateContext : AddInductive.Context)
+    (source inferred result : Expr)
+    (checked : AddInductive.CandidateCheckTypeStep.Valid
+      ⟨candidateContext, source, inferred⟩)
+    (normalized : AddInductive.CandidateWhnfStep.Valid
+      ⟨candidateContext, source, result⟩)
+    (context : VContext)
+    (context_eq : context.toContext = candidateContext.toTypeChecker)
+    (venv_eq : context.venv = env)
+    (lparams_eq : context.lparams = Us)
+    (vlctx_eq : context.vlctx = Δ)
+    (state_wf : VState.WF context {})
+    (source_tr : TrExprS env Us Δ source source')
+    (inferred_tr : TrExprS env Us Δ inferred inferred')
+    (result_tr : TrExprS env Us Δ result result')
+    (checkFuel whnfFuel : Nat)
+    (checkDepth : candidateContext.fuel.recDepth = checkFuel)
+    (whnfDepth : candidateContext.fuel.recDepth = whnfFuel + 1) :
+    CandidateNodeRun env Us Δ candidateContext source inferred result
+      source' result' inferred' where
+  check := CheckTypeRun.ofCandidateStep
+    ⟨candidateContext, source, inferred⟩ checked context context_eq
+    venv_eq lparams_eq vlctx_eq state_wf source_tr inferred_tr
+    checkFuel checkDepth
+  whnf := WhnfRun.ofCandidateStep
+    ⟨candidateContext, source, result⟩ normalized context context_eq
+    venv_eq lparams_eq vlctx_eq state_wf source_tr result_tr
+    whnfFuel whnfDepth
+
+/-- Recover all output translations for one retained candidate node from the
+verified checker refinements themselves.
+
+Unlike `ofCandidate`, this theorem does not ask the caller to identify the
+kernel expressions returned by `checkType` and `whnf` with preselected Theory
+terms.  It extracts strict translations of both results from the two exact
+executions, then packages those witnesses in the ordinary paired-node API.
+Only the root source translation and matching verified context remain input. -/
+theorem CandidateNodeRun.exists_ofCandidate
+    (candidateContext : AddInductive.Context)
+    (source inferred result : Expr)
+    (checked : AddInductive.CandidateCheckTypeStep.Valid
+      ⟨candidateContext, source, inferred⟩)
+    (normalized : AddInductive.CandidateWhnfStep.Valid
+      ⟨candidateContext, source, result⟩)
+    (context : VContext)
+    (context_eq : context.toContext = candidateContext.toTypeChecker)
+    (state_wf : VState.WF context {})
+    (source' : VExpr) (source_tr : context.TrExprS source source')
+    (checkFuel whnfFuel : Nat)
+    (checkDepth : candidateContext.fuel.recDepth = checkFuel)
+    (whnfDepth : candidateContext.fuel.recDepth = whnfFuel + 1) :
+    ∃ inferred' result',
+      context.TrExprS inferred inferred' ∧
+      context.TrExprS result result' ∧
+      Nonempty (CandidateNodeRun context.venv context.lparams context.vlctx
+        candidateContext source inferred result source' result' inferred') := by
+  obtain ⟨checkState, checkRun⟩ :=
+    AddInductive.CandidateCheckTypeStep.innerRun
+      ⟨candidateContext, source, inferred⟩ checkFuel checkDepth checked
+  rw [← context_eq] at checkRun
+  obtain ⟨_, _, _, _, checkedSource', inferred', checkedTyping⟩ :=
+    (Inner.checkType.WF source_tr.fvarsIn
+      (Methods.withFuel checkFuel) Methods.withFuel.WF)
+      state_wf inferred checkState checkRun
+  obtain ⟨whnfState, whnfRun⟩ :=
+    AddInductive.CandidateWhnfStep.innerRun
+      ⟨candidateContext, source, result⟩ whnfFuel whnfDepth normalized
+  rw [← context_eq] at whnfRun
+  obtain ⟨_, _, _, _, _, resultTranslation⟩ :=
+    (Inner.whnf'.WF source_tr
+      (Methods.withFuel whnfFuel) Methods.withFuel.WF)
+      state_wf result whnfState whnfRun
+  obtain ⟨result', result_tr, _⟩ := resultTranslation
+  refine ⟨inferred', result', checkedTyping.2.2.1, result_tr, ⟨?_⟩⟩
+  exact CandidateNodeRun.ofCandidate
+    candidateContext source inferred result checked normalized
+    context context_eq rfl rfl rfl state_wf source_tr
+    checkedTyping.2.2.1
+    result_tr
+    checkFuel whnfFuel checkDepth whnfDepth
+
+/-- Construct a paired candidate node with a caller-selected Theory endpoint
+for the retained WHNF result. The exact full-check execution still selects
+and strictly translates its inferred type; only the already translated WHNF
+endpoint is fixed by the caller. -/
+theorem CandidateNodeRun.exists_ofCandidateAtResult
+    (candidateContext : AddInductive.Context)
+    (source inferred result : Expr)
+    (checked : AddInductive.CandidateCheckTypeStep.Valid
+      ⟨candidateContext, source, inferred⟩)
+    (normalized : AddInductive.CandidateWhnfStep.Valid
+      ⟨candidateContext, source, result⟩)
+    (context : VContext)
+    (context_eq : context.toContext = candidateContext.toTypeChecker)
+    (state_wf : VState.WF context {})
+    (source' result' : VExpr)
+    (source_tr : context.TrExprS source source')
+    (result_tr : context.TrExprS result result')
+    (checkFuel whnfFuel : Nat)
+    (checkDepth : candidateContext.fuel.recDepth = checkFuel)
+    (whnfDepth : candidateContext.fuel.recDepth = whnfFuel + 1) :
+    ∃ inferred', Nonempty
+      (CandidateNodeRun context.venv context.lparams context.vlctx
+        candidateContext source inferred result source' result' inferred') := by
+  obtain ⟨_, inferred', _, inferred_tr, _⟩ :=
+    candidateCheckTypeStep_exists_translation
+      ⟨candidateContext, source, inferred⟩ checked
+      context context_eq state_wf source_tr.fvarsIn checkFuel checkDepth
+  exact ⟨inferred', ⟨CandidateNodeRun.ofCandidate
+    candidateContext source inferred result checked normalized
+    context context_eq rfl rfl rfl state_wf source_tr inferred_tr
+    result_tr checkFuel whnfFuel checkDepth whnfDepth⟩⟩
+
+/-- Compositional evidence for a normalization comparison.
+
+Leaves are either reflexive, already typed syntax or exact verified WHNF
+executions. `forallE` lifts such evidence through the raw binder context,
+which is the constructor-type case needed by the first non-identity replay. -/
+inductive DefEqEvidence (env : VEnv) :
+    Nat → List VExpr → VExpr → VExpr → VExpr → Prop where
+  | refl (h : env.HasType U Γ e A) :
+      DefEqEvidence env U Γ e e A
+  | whnf (run : WhnfRun env Us Δ lhs rhs lhs' rhs')
+      (h : env.HasType Us.length Δ.toCtx lhs' A) :
+      DefEqEvidence env Us.length Δ.toCtx lhs' rhs' A
+  | app
+      (fn : DefEqEvidence env U Γ f f' (.forallE A B))
+      (arg : DefEqEvidence env U Γ a a' A) :
+      DefEqEvidence env U Γ (.app f a) (.app f' a') (B.inst a)
+  | beta
+      (body : env.HasType U (A :: Γ) e B)
+      (arg : env.HasType U Γ e' A) :
+      DefEqEvidence env U Γ
+        (.app (.lam A e) e') (e.inst e') (B.inst e')
+  | trans
+      (left : DefEqEvidence env U Γ lhs mid A)
+      (right : DefEqEvidence env U Γ mid rhs A) :
+      DefEqEvidence env U Γ lhs rhs A
+  | change
+      (type : env.IsDefEq U Γ A B (.sort u))
+      (term : DefEqEvidence env U Γ lhs rhs A) :
+      DefEqEvidence env U Γ lhs rhs B
+  | ofDefEq (proof : env.IsDefEq U Γ lhs rhs A) :
+      DefEqEvidence env U Γ lhs rhs A
+  | forallE
+      (domain : DefEqEvidence env U Γ A A' (.sort u))
+      (body : DefEqEvidence env U (A :: Γ) B B' (.sort v)) :
+      DefEqEvidence env U Γ
+        (.forallE A B) (.forallE A' B') (.sort (.imax u v))
+
+/-- Interpret compositional normalization evidence as Theory definitional
+equality at its recorded type. -/
+theorem DefEqEvidence.isDefEq :
+    DefEqEvidence env U Γ lhs rhs A →
+      env.IsDefEq U Γ lhs rhs A
+  | .refl h => h
+  | .whnf run h => run.isDefEq h
+  | .app fn arg => .appDF fn.isDefEq arg.isDefEq
+  | .beta body arg => .beta body arg
+  | .trans left right => .trans left.isDefEq right.isDefEq
+  | .change type term => .defeqDF type term.isDefEq
+  | .ofDefEq proof => proof
+  | .forallE domain body =>
+      .forallEDF domain.isDefEq body.isDefEq
+
+/-- Interpret one paired candidate node as typed definitional equality. -/
+theorem CandidateNodeRun.evidence
+    (run : CandidateNodeRun env Us Δ context source inferred result
+      source' result' inferred') :
+    DefEqEvidence env Us.length Δ.toCtx source' result' inferred' :=
+  .whnf run.whnf run.check.hasType
+
+/-- Recursive semantic interpretation of a source-indexed candidate trace.
+
+At a Pi node the raw domain and the annotation-consumed local domain may have
+different strict Theory translations. The retained equality run relates them;
+the body is checked in the consumed-domain context and transported back to the
+raw Pi context only when forming congruence evidence. -/
+inductive CandidateExprRun (env : VEnv) (Us : List Name) :
+    {candidateContext : AddInductive.Context} → {source : Expr} →
+      AddInductive.CandidateExprTrace candidateContext source →
+      (Δ : VLCtx) → VExpr → VExpr → VExpr → Prop where
+  | terminal
+      (node : CandidateNodeRun env Us Δ context source inferred result
+        source' result' inferred') :
+      CandidateExprRun env Us
+        (.terminal context source inferred result checked normalized)
+        Δ source' result' inferred'
+  | forallE
+      (annotations : AddInductive.CandidateTypeAnnotations domain)
+      (annotationsEq : AddInductive.CandidateIsDefEqStep.Valid
+        ⟨context, domain, annotations.consumed⟩)
+      (domainCandidate : AddInductive.CandidateExprTrace context domain)
+      (bodyCandidate : AddInductive.CandidateExprTrace
+        (context.pushLocalDecl name binderInfo annotations.consumed)
+        (body.instantiate1 context.freshExpr))
+      (node : CandidateNodeRun env Us Δ context source inferred
+        (.forallE name domain body binderInfo)
+        source' (.forallE domain' body') inferred')
+      (domainRun : CandidateExprRun env Us domainCandidate Δ
+        domain' domainView' domainInferred')
+      (annotationsRun : IsDefEqRun env Us Δ
+        domain annotations.consumed domain' storedDomain')
+      (bodyRun : CandidateExprRun env Us bodyCandidate bodyΔ
+        storedBody' bodyView' bodyInferred')
+      (domainType : env.HasType Us.length Δ.toCtx domain' (.sort u))
+      (bodyType : env.HasType Us.length
+        (domain' :: Δ.toCtx) body' (.sort v))
+      (bodySource : env.IsDefEq Us.length (domain' :: Δ.toCtx)
+        body' storedBody' (.sort v))
+      (bodyContext :
+        bodyΔ =
+          (some (context.freshFVarId, annotations.consumed.fvarsList),
+            .vlam storedDomain') :: Δ) :
+      CandidateExprRun env Us
+        (.forallE context source inferred name domain body binderInfo fresh
+          annotations annotationsEq checked normalized
+          domainCandidate bodyCandidate)
+        Δ source' (.forallE domainView' bodyView') inferred'
+
+/-- Structural witness that a retained candidate trace is syntactically
+identity-normalizing at every inspected node.
+
+The witness is deliberately recursive rather than a single root equality:
+generation consumes the exposed Pi spine positionally. At Pi nodes it also
+records that annotation processing kept the binder domain unchanged. -/
+inductive CandidateExprIdentity :
+    {candidateContext : AddInductive.Context} → {source : Expr} →
+      AddInductive.CandidateExprTrace candidateContext source → Prop where
+  | terminal
+      (result_eq : result = source) :
+      CandidateExprIdentity
+        (.terminal context source inferred result checked normalized)
+  | forallE
+      (domainCandidate : AddInductive.CandidateExprTrace context domain)
+      (bodyCandidate : AddInductive.CandidateExprTrace
+        (context.pushLocalDecl name binderInfo annotations.consumed)
+        (body.instantiate1 context.freshExpr))
+      (source_eq : source = .forallE name domain body binderInfo)
+      (consumed_eq : annotations.consumed = domain)
+      (domainIdentity : CandidateExprIdentity domainCandidate)
+      (bodyIdentity : CandidateExprIdentity bodyCandidate) :
+      CandidateExprIdentity
+        (.forallE context source inferred name domain body binderInfo fresh
+          annotations annotationsEq checked normalized
+          domainCandidate bodyCandidate)
+
+private def candidateExprIdentityBinderInfoEq :
+    Lean.BinderInfo → Lean.BinderInfo → Bool
+  | .default, .default
+  | .implicit, .implicit
+  | .strictImplicit, .strictImplicit
+  | .instImplicit, .instImplicit => true
+  | _, _ => false
+
+private theorem candidateExprIdentityBinderInfoEq_sound
+    (left right : Lean.BinderInfo)
+    (h : candidateExprIdentityBinderInfoEq left right = true) :
+    left = right := by
+  cases left <;> cases right <;>
+    simp_all [candidateExprIdentityBinderInfoEq]
+
+/-- Transparent structural equality sufficient for identity-normalizing
+candidate traces.  Metadata nodes are conservatively rejected: the retained
+generation spine never needs an opaque metadata equality to justify source
+identity. -/
+private def candidateExprIdentityExprEq : Lean.Expr → Lean.Expr → Bool
+  | .bvar i, .bvar j => i == j
+  | .fvar i, .fvar j => i == j
+  | .mvar i, .mvar j => i == j
+  | .sort u, .sort v => u == v
+  | .const n us, .const n' us' => n == n' && us == us'
+  | .app f a, .app f' a' =>
+      candidateExprIdentityExprEq f f' &&
+        candidateExprIdentityExprEq a a'
+  | .lam n t b bi, .lam n' t' b' bi' =>
+      n == n' && candidateExprIdentityExprEq t t' &&
+        candidateExprIdentityExprEq b b' &&
+          candidateExprIdentityBinderInfoEq bi bi'
+  | .forallE n t b bi, .forallE n' t' b' bi' =>
+      n == n' && candidateExprIdentityExprEq t t' &&
+        candidateExprIdentityExprEq b b' &&
+          candidateExprIdentityBinderInfoEq bi bi'
+  | .letE n t v b nd, .letE n' t' v' b' nd' =>
+      n == n' && candidateExprIdentityExprEq t t' &&
+        candidateExprIdentityExprEq v v' &&
+          candidateExprIdentityExprEq b b' && nd == nd'
+  | .lit a, .lit b => a == b
+  | .proj n i s, .proj n' i' s' =>
+      n == n' && i == i' && candidateExprIdentityExprEq s s'
+  | _, _ => false
+
+private theorem candidateExprIdentityExprEq_sound :
+    ∀ (left right : Lean.Expr),
+      candidateExprIdentityExprEq left right = true → left = right := by
+  intro left right h
+  induction left generalizing right with
+  | bvar i =>
+      cases right <;>
+        simp_all [candidateExprIdentityExprEq, beq_iff_eq]
+  | fvar i =>
+      cases right <;>
+        simp_all [candidateExprIdentityExprEq, beq_iff_eq]
+  | mvar i =>
+      cases right <;>
+        simp_all [candidateExprIdentityExprEq, beq_iff_eq]
+  | sort u =>
+      cases right <;>
+        simp_all [candidateExprIdentityExprEq, beq_iff_eq]
+  | const n us =>
+      cases right <;>
+        simp_all [candidateExprIdentityExprEq, beq_iff_eq]
+  | app fn arg fnIH argIH =>
+      cases right with
+      | app fn' arg' =>
+          simp only [candidateExprIdentityExprEq,
+            Bool.and_eq_true] at h
+          rw [fnIH fn' h.1, argIH arg' h.2]
+      | _ => simp_all [candidateExprIdentityExprEq]
+  | lam name type body binderInfo typeIH bodyIH =>
+      cases right with
+      | lam name' type' body' binderInfo' =>
+          simp only [candidateExprIdentityExprEq, Bool.and_eq_true,
+            beq_iff_eq] at h
+          rw [h.1.1.1, typeIH type' h.1.1.2,
+            bodyIH body' h.1.2,
+            candidateExprIdentityBinderInfoEq_sound _ _ h.2]
+      | _ => simp_all [candidateExprIdentityExprEq]
+  | forallE name type body binderInfo typeIH bodyIH =>
+      cases right with
+      | forallE name' type' body' binderInfo' =>
+          simp only [candidateExprIdentityExprEq, Bool.and_eq_true,
+            beq_iff_eq] at h
+          rw [h.1.1.1, typeIH type' h.1.1.2,
+            bodyIH body' h.1.2,
+            candidateExprIdentityBinderInfoEq_sound _ _ h.2]
+      | _ => simp_all [candidateExprIdentityExprEq]
+  | letE name type value body nondep typeIH valueIH bodyIH =>
+      cases right with
+      | letE name' type' value' body' nondep' =>
+          simp only [candidateExprIdentityExprEq, Bool.and_eq_true,
+            beq_iff_eq] at h
+          rw [h.1.1.1.1, typeIH type' h.1.1.1.2,
+            valueIH value' h.1.1.2, bodyIH body' h.1.2, h.2]
+      | _ => simp_all [candidateExprIdentityExprEq]
+  | lit literal =>
+      cases right <;>
+        simp_all [candidateExprIdentityExprEq, beq_iff_eq]
+  | mdata data expr exprIH =>
+      cases right <;> simp_all [candidateExprIdentityExprEq]
+  | proj typeName idx struct structIH =>
+      cases right with
+      | proj typeName' idx' struct' =>
+          simp only [candidateExprIdentityExprEq, Bool.and_eq_true,
+            beq_iff_eq] at h
+          rw [h.1.1, h.1.2, structIH struct' h.2]
+      | _ => simp_all [candidateExprIdentityExprEq]
+
+/-- Executable sufficient check for the recursive identity witness consumed
+by generation.  Unlike a root-only equality, it checks every retained domain,
+body, annotation result, and terminal node. -/
+def CandidateExprIdentity.check :
+    {candidateContext : AddInductive.Context} → {source : Lean.Expr} →
+      AddInductive.CandidateExprTrace candidateContext source → Bool
+  | _, _, .terminal _ source _ result _ _ =>
+      candidateExprIdentityExprEq result source
+  | _, _, .forallE _ source _ name domain body binderInfo _ annotations _ _ _
+      domainCandidate bodyCandidate =>
+    candidateExprIdentityExprEq source
+        (.forallE name domain body binderInfo) &&
+      candidateExprIdentityExprEq annotations.consumed domain &&
+        CandidateExprIdentity.check domainCandidate &&
+          CandidateExprIdentity.check bodyCandidate
+
+/-- Executable sufficient equality check for the terminal expression selected
+by a candidate trace.  This is useful when the family validator must name its
+result universe without unfolding the proof-carrying trace. -/
+def CandidateExprIdentity.terminalCheck
+    (trace : AddInductive.CandidateExprTrace candidateContext source)
+    (expected : Lean.Expr) : Bool :=
+  candidateExprIdentityExprEq trace.terminalResult expected
+
+theorem CandidateExprIdentity.terminalResult_eq_of_check
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {expected : Lean.Expr}
+    (h : CandidateExprIdentity.terminalCheck trace expected = true) :
+    trace.terminalResult = expected :=
+  candidateExprIdentityExprEq_sound _ _ h
+
+/-- A successful structural check yields the full recursive identity witness;
+the Boolean contributes no semantic authority beyond these proved equalities. -/
+theorem CandidateExprIdentity.of_check
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    (h : CandidateExprIdentity.check trace = true) :
+    CandidateExprIdentity trace := by
+  induction trace with
+  | terminal context source inferred result checked normalized =>
+      simp only [CandidateExprIdentity.check] at h
+      exact .terminal (candidateExprIdentityExprEq_sound result source h)
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked normalized domainCandidate
+      bodyCandidate domainIH bodyIH =>
+      simp only [CandidateExprIdentity.check, Bool.and_eq_true] at h
+      exact .forallE domainCandidate bodyCandidate
+        (candidateExprIdentityExprEq_sound _ _ h.1.1.1)
+        (candidateExprIdentityExprEq_sound _ _ h.1.1.2)
+        (domainIH h.1.2) (bodyIH h.2)
+
+/-- An identity-normalizing trace necessarily preserves the stored main Pi
+spine. This turns the recursive identity witness into the Boolean gate used
+by the generation assembler. -/
+theorem CandidateExprIdentity.storedSpine
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    (identity : CandidateExprIdentity trace) :
+    trace.storedSpine = true := by
+  induction identity with
+  | terminal => rfl
+  | forallE _ _ source_eq _ _ _ _ bodyIH =>
+    simp [AddInductive.CandidateExprTrace.storedSpine,
+      source_eq, Expr.structuralEq_refl, bodyIH]
+
+/-- Exact component inversion for a strict translation of a kernel Pi. -/
+theorem TrExprS.forallE_components
+    (run : TrExprS env Us Δ (.forallE name domain body binderInfo) source') :
+    ∃ domain' body',
+      source' = .forallE domain' body' ∧
+      env.IsType Us.length Δ.toCtx domain' ∧
+      env.IsType Us.length (domain' :: Δ.toCtx) body' ∧
+      TrExprS env Us Δ domain domain' ∧
+      TrExprS env Us ((none, .vlam domain') :: Δ) body body' := by
+  cases run with
+  | forallE domainType bodyType domain_tr body_tr =>
+    exact ⟨_, _, rfl, domainType, bodyType, domain_tr, body_tr⟩
+
+/-- Recursively turn every retained candidate observation into verified
+normalization evidence, constructing and transporting the exact verified
+binder context at each Pi node. -/
+theorem CandidateExprRun.exists_ofCandidate
+    (trace : AddInductive.CandidateExprTrace candidateContext source)
+    (candidateRun : CandidateContextRun candidateContext)
+    (source' : VExpr)
+    (source_tr : candidateRun.context.TrExprS source source')
+    (whnfFuel : Nat)
+    (whnfDepth : candidateContext.fuel.recDepth = whnfFuel + 1) :
+    ∃ view' inferred',
+      Nonempty (CandidateExprRun candidateRun.context.venv
+        candidateRun.context.lparams trace candidateRun.context.vlctx
+        source' view' inferred') := by
+  induction trace generalizing source' with
+  | terminal context source inferred result checked normalized =>
+    obtain ⟨inferred', result', _, _, ⟨node⟩⟩ :=
+      CandidateNodeRun.exists_ofCandidate context source inferred result
+        checked normalized candidateRun.context candidateRun.context_eq
+        candidateRun.state_wf source' source_tr
+        context.fuel.recDepth whnfFuel rfl whnfDepth
+    exact ⟨result', inferred', ⟨.terminal node⟩⟩
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked normalized
+      domainCandidate bodyCandidate domainIH bodyIH =>
+    obtain ⟨inferred', result', _, result_tr, ⟨node⟩⟩ :=
+      CandidateNodeRun.exists_ofCandidate context source inferred
+        (.forallE name domain body binderInfo) checked normalized
+        candidateRun.context candidateRun.context_eq candidateRun.state_wf
+        source' source_tr context.fuel.recDepth whnfFuel rfl whnfDepth
+    let .forallE domainType bodyType domain_tr body_tr := result_tr
+    obtain ⟨u, domainTypeHasType⟩ := domainType
+    obtain ⟨v, bodyTypeHasType⟩ := bodyType
+    obtain ⟨domainView', domainInferred', ⟨domainRun⟩⟩ :=
+      domainIH candidateRun _ domain_tr whnfDepth
+    obtain ⟨storedDomain', storedDomain_tr⟩ :=
+      candidateTypeAnnotation_exists_translation annotations.trace domain_tr
+    let annotationsRun := IsDefEqRun.ofCandidateStep
+      ⟨context, domain, annotations.consumed⟩ annotationsEq
+      candidateRun.context candidateRun.context_eq rfl rfl rfl
+      candidateRun.state_wf domain_tr storedDomain_tr
+      context.fuel.recDepth rfl
+    have henv : VEnv.WF candidateRun.context.venv :=
+      candidateRun.context.Ewf
+    have hΔ : OnCtx candidateRun.context.vlctx.toCtx
+        (candidateRun.context.venv.IsType
+          candidateRun.context.lparams.length) :=
+      candidateRun.context.Δwf.toCtx
+    have annotationDef :=
+      annotationsRun.isDefEqU.of_l henv hΔ domainTypeHasType
+    let bodyCandidateRun := candidateRun.pushLocalDecl name binderInfo
+      annotations.consumed fresh storedDomain' storedDomain_tr
+        ⟨u, annotationDef.hasType.2⟩
+    have bodyVenv : bodyCandidateRun.context.venv =
+        candidateRun.context.venv := rfl
+    have bodyLparams : bodyCandidateRun.context.lparams =
+        candidateRun.context.lparams := rfl
+    have bodyVlctx : bodyCandidateRun.context.vlctx =
+        (some (context.freshFVarId, annotations.consumed.fvarsList),
+          .vlam storedDomain') :: candidateRun.context.vlctx := rfl
+    have bodyDepth :
+        (context.pushLocalDecl name binderInfo
+          annotations.consumed).fuel.recDepth = whnfFuel + 1 := by
+      simpa [AddInductive.Context.pushLocalDecl] using whnfDepth
+    have domainContext : VLCtx.IsDefEq
+        candidateRun.context.venv candidateRun.context.lparams.length
+        ((none, .vlam _) :: candidateRun.context.vlctx)
+        ((none, .vlam storedDomain') :: candidateRun.context.vlctx) :=
+      .cons (.refl henv candidateRun.context.Δwf) (by nofun)
+        (.vlam annotationDef)
+    obtain ⟨storedBody', storedBody_tr⟩ :=
+      body_tr.defeqDFC henv domainContext
+    have hRawBody : OnCtx
+        (_ :: candidateRun.context.vlctx.toCtx)
+        (candidateRun.context.venv.IsType
+          candidateRun.context.lparams.length) :=
+      ⟨hΔ, ⟨u, domainTypeHasType⟩⟩
+    have bodySource :=
+      (body_tr.uniq henv domainContext storedBody_tr).of_l
+        henv hRawBody bodyTypeHasType
+    have bodyΔwf := bodyCandidateRun.context.Δwf
+    rw [bodyVenv, bodyLparams, bodyVlctx] at bodyΔwf
+    have instantiatedBody_tr :=
+      storedBody_tr.inst_fvar henv.ordered bodyΔwf
+    obtain ⟨bodyView', bodyInferred', ⟨bodyRun⟩⟩ :=
+      bodyIH bodyCandidateRun _ (by
+        change TrExprS bodyCandidateRun.context.venv
+          bodyCandidateRun.context.lparams bodyCandidateRun.context.vlctx
+          (body.instantiate1 context.freshExpr) _
+        rw [bodyVenv, bodyLparams, bodyVlctx]
+        simpa only [AddInductive.Context.freshExpr,
+          Expr.instantiate1_eq] using instantiatedBody_tr)
+        bodyDepth
+    refine ⟨.forallE domainView' bodyView', inferred', ⟨?_⟩⟩
+    exact .forallE annotations annotationsEq domainCandidate bodyCandidate node
+      domainRun annotationsRun bodyRun domainTypeHasType bodyTypeHasType
+      bodySource bodyVlctx
+
+/-- Interpret a recursively identity-normalizing candidate at the exact
+strict Theory translation of its source.
+
+Unlike `exists_ofCandidate`, whose verified executions select an existential
+Theory endpoint, this theorem retains `source'` as the endpoint at every
+recursive position. That stronger conclusion is what the generation spine
+assembler needs for declarations whose executable normalization is
+syntactically the identity. -/
+theorem CandidateExprRun.exists_ofIdentity
+    (trace : AddInductive.CandidateExprTrace candidateContext source)
+    (identity : CandidateExprIdentity trace)
+    (candidateRun : CandidateContextRun candidateContext)
+    (source' : VExpr)
+    (source_tr : candidateRun.context.TrExprS source source')
+    (whnfFuel : Nat)
+    (whnfDepth : candidateContext.fuel.recDepth = whnfFuel + 1) :
+    ∃ inferred', Nonempty
+      (CandidateExprRun candidateRun.context.venv
+        candidateRun.context.lparams trace candidateRun.context.vlctx
+        source' source' inferred') := by
+  induction identity generalizing source' with
+  | @terminal result source context inferred checked normalized result_eq =>
+    subst result
+    obtain ⟨inferred', ⟨node⟩⟩ :=
+      CandidateNodeRun.exists_ofCandidateAtResult
+        context source inferred source checked normalized
+        candidateRun.context candidateRun.context_eq candidateRun.state_wf
+        source' source' source_tr source_tr
+        context.fuel.recDepth whnfFuel rfl whnfDepth
+    exact ⟨inferred', ⟨.terminal node⟩⟩
+  | @forallE context domain name binderInfo source inferred body fresh
+      annotations annotationsEq checked normalized domainCandidate
+      bodyCandidate source_eq consumed_eq domainIdentity bodyIdentity
+      domainIH bodyIH =>
+    subst source
+    obtain ⟨domain', body', rfl, domainWF, bodyWF, domain_tr, body_tr⟩ :=
+      TypeChecker.TrExprS.forallE_components source_tr
+    obtain ⟨u, domainType⟩ := domainWF
+    obtain ⟨v, bodyType⟩ := bodyWF
+    obtain ⟨inferred', ⟨node⟩⟩ :=
+      CandidateNodeRun.exists_ofCandidateAtResult
+        context (.forallE name domain body binderInfo) inferred
+        (.forallE name domain body binderInfo) checked normalized
+        candidateRun.context candidateRun.context_eq candidateRun.state_wf
+        (.forallE domain' body') (.forallE domain' body')
+        source_tr source_tr
+        context.fuel.recDepth whnfFuel rfl whnfDepth
+    obtain ⟨domainInferred', ⟨domainRun⟩⟩ :=
+      domainIH candidateRun domain' domain_tr whnfDepth
+    have consumed_tr : candidateRun.context.TrExprS
+        annotations.consumed domain' := by
+      rw [consumed_eq]
+      exact domain_tr
+    let annotationsRun := IsDefEqRun.ofCandidateStep
+      ⟨context, domain, annotations.consumed⟩ annotationsEq
+      candidateRun.context candidateRun.context_eq rfl rfl rfl
+      candidateRun.state_wf domain_tr consumed_tr
+      context.fuel.recDepth rfl
+    let bodyCandidateRun := candidateRun.pushLocalDecl name binderInfo
+      annotations.consumed fresh domain' consumed_tr ⟨u, domainType⟩
+    have bodyVenv : bodyCandidateRun.context.venv =
+        candidateRun.context.venv := rfl
+    have bodyLparams : bodyCandidateRun.context.lparams =
+        candidateRun.context.lparams := rfl
+    have bodyVlctx : bodyCandidateRun.context.vlctx =
+        (some (context.freshFVarId, annotations.consumed.fvarsList),
+          .vlam domain') :: candidateRun.context.vlctx := rfl
+    have bodyDepth :
+        (context.pushLocalDecl name binderInfo
+          annotations.consumed).fuel.recDepth =
+          whnfFuel + 1 := by
+      simpa [AddInductive.Context.pushLocalDecl] using whnfDepth
+    have bodyDeltaWF := bodyCandidateRun.context.Δwf
+    rw [bodyVenv, bodyLparams, bodyVlctx] at bodyDeltaWF
+    have instantiatedBody_tr :=
+      body_tr.inst_fvar candidateRun.context.Ewf.ordered
+        bodyDeltaWF
+    obtain ⟨bodyInferred', ⟨bodyRun⟩⟩ :=
+      bodyIH bodyCandidateRun body' (by
+        change TrExprS bodyCandidateRun.context.venv
+          bodyCandidateRun.context.lparams bodyCandidateRun.context.vlctx
+          (body.instantiate1 context.freshExpr) body'
+        rw [bodyVenv, bodyLparams, bodyVlctx]
+        simpa only [AddInductive.Context.freshExpr,
+          Expr.instantiate1_eq] using instantiatedBody_tr)
+        bodyDepth
+    refine ⟨inferred', ⟨?_⟩⟩
+    exact .forallE annotations annotationsEq domainCandidate bodyCandidate
+      node domainRun annotationsRun bodyRun domainType bodyType bodyType rfl
+
+/-- Recover a trace root's strict source translation from its retained full
+check.  Unlike recursive child nodes, whose source translations are obtained
+from the parent Pi translation, a root needs only the checker's syntactic
+free-variable premise. -/
+theorem candidateExprTrace_exists_source_translation
+    (trace : AddInductive.CandidateExprTrace candidateContext source)
+    (candidateRun : CandidateContextRun candidateContext)
+    (source_fvars :
+      source.FVarsIn (· ∈ candidateRun.context.vlctx.fvars)) :
+    ∃ source', candidateRun.context.TrExprS source source' := by
+  let checked := trace.rootCheck
+  obtain ⟨source', _, source_tr, _, _⟩ :=
+    candidateCheckTypeStep_exists_translation
+      ⟨candidateContext, source, checked.inferred⟩ checked.valid
+      candidateRun.context candidateRun.context_eq candidateRun.state_wf
+      source_fvars candidateContext.fuel.recDepth rfl
+  exact ⟨source', source_tr⟩
+
+/-- Recursively certify an annotation-complete candidate trace without asking
+the caller for any Theory expression. The retained root full check chooses the
+source translation; all output and child translations then come from verified
+checker executions, structural annotation traces, and Pi decomposition. -/
+theorem CandidateExprRun.exists_ofCandidateFVars
+    (trace : AddInductive.CandidateExprTrace candidateContext source)
+    (candidateRun : CandidateContextRun candidateContext)
+    (source_fvars :
+      source.FVarsIn (· ∈ candidateRun.context.vlctx.fvars))
+    (whnfFuel : Nat)
+    (whnfDepth : candidateContext.fuel.recDepth = whnfFuel + 1) :
+    ∃ source' view' inferred',
+      candidateRun.context.TrExprS source source' ∧
+      Nonempty (CandidateExprRun candidateRun.context.venv
+        candidateRun.context.lparams trace candidateRun.context.vlctx
+        source' view' inferred') := by
+  obtain ⟨source', source_tr⟩ :=
+    candidateExprTrace_exists_source_translation trace candidateRun
+      source_fvars
+  obtain ⟨view', inferred', run⟩ :=
+    CandidateExprRun.exists_ofCandidate trace candidateRun source'
+      source_tr whnfFuel whnfDepth
+  exact ⟨source', view', inferred', source_tr, run⟩
+
+/-- Fold a complete candidate trace into the compositional equality language
+consumed by `NormalizationRun` and `GenerationRun`. -/
+theorem CandidateExprRun.evidence
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr} :
+    CandidateExprRun env Us trace Δ source' view' inferred' →
+      DefEqEvidence env Us.length Δ.toCtx source' view' inferred'
+  | .terminal node => node.evidence
+  | .forallE _ _ _ _ node domainRun annotationsRun bodyRun domainType
+      bodyType bodySource bodyContext => by
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hΔ : VLCtx.WF env Us.length Δ := by
+      simpa only [node.check.venv_eq, node.check.lparams_eq,
+        node.check.vlctx_eq] using node.check.context.Δwf
+    have hΓ : OnCtx Δ.toCtx (env.IsType Us.length) := hΔ.toCtx
+    have domainEvidence := domainRun.evidence
+    obtain ⟨_, domainTypeEq⟩ :=
+      domainType.uniq henv hΓ domainEvidence.isDefEq
+    have domainAtSort : DefEqEvidence env Us.length Δ.toCtx
+        _ _ (.sort _) :=
+      .change domainTypeEq.symm domainEvidence
+    have annotationDef :=
+      annotationsRun.isDefEqU.of_l henv hΓ domainType
+    have domainContext : VLCtx.IsDefEq env Us.length
+        ((none, .vlam _) :: Δ) ((none, .vlam _) :: Δ) :=
+      .cons (.refl henv hΔ) (by nofun) (.vlam annotationDef)
+    have bodyEvidence := bodyRun.evidence
+    rw [bodyContext] at bodyEvidence
+    simp only [VLCtx.toCtx] at bodyEvidence
+    have bodyStoredType :=
+      bodySource.hasType.2.defeqDFC henv domainContext.defeqCtx
+    have hBodyΓ : OnCtx (_ :: Δ.toCtx) (env.IsType Us.length) :=
+      ⟨hΓ, ⟨_, annotationDef.hasType.2⟩⟩
+    obtain ⟨_, bodyTypeEq⟩ :=
+      bodyStoredType.uniq henv hBodyΓ bodyEvidence.isDefEq
+    have bodyAtSortStored : DefEqEvidence env Us.length
+        (_ :: Δ.toCtx) _ _ (.sort _) :=
+      .change bodyTypeEq.symm bodyEvidence
+    have bodyAtSortRaw :=
+      bodyAtSortStored.isDefEq.defeqDFC henv
+        (domainContext.symm henv).defeqCtx
+    have bodyFinal := bodySource.trans bodyAtSortRaw
+    have piEvidence := DefEqEvidence.forallE domainAtSort
+      (DefEqEvidence.ofDefEq bodyFinal)
+    obtain ⟨_, nodeTypeEq⟩ :=
+      node.evidence.isDefEq.uniq henv hΓ (domainType.forallE bodyType)
+    exact .trans node.evidence (.change nodeTypeEq.symm piEvidence)
+
+/-- The raw root of a recursively interpreted trace has the strict Theory
+translation retained by its paired full-check run. -/
+theorem CandidateExprRun.source_tr
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred') :
+    TrExprS env Us Δ source source' := by
+  cases run with
+  | terminal node => exact node.check.expr_tr
+  | forallE _ _ _ _ node => exact node.check.expr_tr
+
+/-- Move a weak expression translation between definitionally equal verified
+local contexts while retaining its named Theory meaning. -/
+private theorem candidateTrExpr_moveCtx
+    (henv : VEnv.WF env)
+    (hctx : VLCtx.IsDefEq env Us.length Δ₁ Δ₂)
+    (H : TrExpr env Us Δ₁ e e') :
+    TrExpr env Us Δ₂ e e' := by
+  obtain ⟨e₂, he₂, hdef⟩ := H
+  have moved : TrExpr env Us Δ₂ e e₂ :=
+    he₂.defeqDFC' henv hctx
+  exact moved.defeq henv (hctx.symm henv).wf.toCtx
+    (hdef.defeqDFC henv hctx.defeqCtx)
+
+/-- The recursively reconstructed kernel candidate view translates to the
+Theory view named by `CandidateExprRun`.
+
+At Pi nodes the instantiated child body is first abstracted from its exact
+free-variable context and then transported from the raw-domain context to the
+definitionally equal normalized-domain context.  This closes the provenance
+loop: the emitted Theory equality is not only between two well-typed terms;
+both endpoints are translations of the source-indexed candidate syntax. -/
+theorem CandidateExprRun.view_tr
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred') :
+    TrExpr env Us Δ trace.view view' := by
+  induction run with
+  | @terminal Δ context source inferred result source' result' inferred'
+      checked normalized node =>
+      have henv : VEnv.WF env := by
+        simpa only [node.whnf.venv_eq] using node.whnf.context.Ewf
+      have hΔ : VLCtx.WF env Us.length Δ := by
+        simpa only [node.whnf.venv_eq, node.whnf.lparams_eq,
+          node.whnf.vlctx_eq] using node.whnf.context.Δwf
+      simpa only [AddInductive.CandidateExprTrace.view] using
+        node.whnf.rhs_tr.trExpr henv hΔ
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hΔ : VLCtx.WF env Us.length Δ := by
+      simpa only [node.check.venv_eq, node.check.lparams_eq,
+        node.check.vlctx_eq] using node.check.context.Δwf
+    obtain ⟨_, domainTypeEq⟩ :=
+      domainType.uniq henv hΔ.toCtx domainRun.evidence.isDefEq
+    have domainDef : env.IsDefEq Us.length Δ.toCtx
+        domain' domainView' (.sort u) :=
+      (DefEqEvidence.change domainTypeEq.symm domainRun.evidence).isDefEq
+    have annotationDef :=
+      annotationsRun.isDefEqU.of_l henv hΔ.toCtx domainType
+    have storedToView : env.IsDefEq Us.length Δ.toCtx
+        storedDomain' domainView' (.sort u) :=
+      annotationDef.symm.trans domainDef
+    have bodyIH' : TrExpr env Us
+        ((some (context.freshFVarId,
+          annotations.consumed.fvarsList), .vlam storedDomain') :: Δ)
+        bodyCandidate.view bodyView' := by
+      simpa only [bodyContext] using bodyIH
+    have bodyAbstract := bodyIH'.abstract VLCtx.Abstract.zero
+    have hctx : VLCtx.IsDefEq env Us.length
+        ((none, .vlam storedDomain') :: Δ)
+        ((none, .vlam domainView') :: Δ) :=
+      .cons (.refl henv hΔ) (by nofun)
+        (.vlam storedToView)
+    have bodyMoved := candidateTrExpr_moveCtx henv hctx bodyAbstract
+    have bodyEvidence := bodyRun.evidence
+    rw [bodyContext] at bodyEvidence
+    simp only [VLCtx.toCtx] at bodyEvidence
+    have annotationContext : VLCtx.IsDefEq env Us.length
+        ((none, .vlam domain') :: Δ)
+        ((none, .vlam storedDomain') :: Δ) :=
+      .cons (.refl henv hΔ) (by nofun) (.vlam annotationDef)
+    have bodyStoredType :=
+      bodySource.hasType.2.defeqDFC henv annotationContext.defeqCtx
+    have hBodyΓ : OnCtx (storedDomain' :: Δ.toCtx)
+        (env.IsType Us.length) :=
+      ⟨hΔ.toCtx, ⟨_, annotationDef.hasType.2⟩⟩
+    obtain ⟨_, bodyTypeEq⟩ :=
+      bodyStoredType.uniq henv hBodyΓ bodyEvidence.isDefEq
+    have bodyDefStored : env.IsDefEq Us.length
+        (storedDomain' :: Δ.toCtx) storedBody' bodyView' (.sort v) :=
+      (DefEqEvidence.change bodyTypeEq.symm bodyEvidence).isDefEq
+    have bodyDefMoved :=
+      bodyDefStored.defeqDFC henv hctx.defeqCtx
+    have habstract :
+        bodyCandidate.view.abstract #[context.freshExpr] =
+          Expr.abstract1 context.freshFVarId bodyCandidate.view := by
+      rw [show #[context.freshExpr] =
+        ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl]
+      simp only [Expr.abstract_eq, Expr.abstractList]
+    apply TrExpr.forallE henv hΔ
+    · exact ⟨_, domainDef.hasType.2⟩
+    · exact ⟨_, bodyDefMoved.hasType.2⟩
+    · exact domainIH
+    · simpa only [AddInductive.CandidateExprTrace.view,
+        habstract] using bodyMoved
+
+/-- Exact-translation uniqueness for every expression that contributes to a
+candidate view.  The abstracted-body clause names the syntax stored by
+`CandidateExprTrace.view`, while the recursive body clause supports the next
+candidate node.  Projections are intentionally excluded: their verified
+Theory relation is only unique up to definitional equality. -/
+def CandidateExprTraceViewIsUnique :
+    {context : AddInductive.Context} → {source : Expr} →
+      AddInductive.CandidateExprTrace context source → Prop
+  | _, _, .terminal _ _ _ result _ _ => TrExprS.IsUnique result
+  | _, _, .forallE context _ _ _ _ _ _ _ _ _ _ _ domain body =>
+      CandidateExprTraceViewIsUnique domain ∧
+        CandidateExprTraceViewIsUnique body ∧
+        TrExprS.IsUnique (body.view.abstract #[context.freshExpr])
+
+/-- The recursive uniqueness certificate in particular covers the complete
+view reconstructed at this candidate node. -/
+theorem CandidateExprTraceViewIsUnique.view
+    {context : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace context source}
+    (unique : CandidateExprTraceViewIsUnique trace) :
+    TrExprS.IsUnique trace.view := by
+  induction trace with
+  | terminal => exact unique
+  | forallE context source inferred name domain body binderInfo fresh
+      annotations annotationsEq checked normalized domainCandidate bodyCandidate
+      domainIH bodyIH =>
+    exact ⟨domainIH unique.1, unique.2.2⟩
+
+/-- A projection-free candidate view retains the strict Theory translation
+selected componentwise by its recursive semantic run.
+
+The ordinary `view_tr` theorem must use weak translation because a projection
+endpoint is only definitionally determined.  Under the explicit uniqueness
+condition, recursive abstraction and context transport select the exact
+analyzer-owned expression instead. -/
+theorem CandidateExprRun.view_tr_strict
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (unique : CandidateExprTraceViewIsUnique trace) :
+    TrExprS env Us Δ trace.view view' := by
+  induction run with
+  | terminal node =>
+      simpa only [AddInductive.CandidateExprTrace.view] using
+        node.whnf.rhs_tr
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    rcases unique with ⟨domainUnique, bodyUnique, abstractUnique⟩
+    have domainStrict := domainIH domainUnique
+    have bodyStrict : TrExprS env Us
+        ((some (context.freshFVarId,
+          annotations.consumed.fvarsList), .vlam storedDomain') :: Δ)
+        bodyCandidate.view bodyView' := by
+      simpa only [bodyContext] using bodyIH bodyUnique
+    have bodyAbstract := bodyStrict.abstract VLCtx.Abstract.zero
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hΔ : VLCtx.WF env Us.length Δ := by
+      simpa only [node.check.venv_eq, node.check.lparams_eq,
+        node.check.vlctx_eq] using node.check.context.Δwf
+    obtain ⟨_, domainTypeEq⟩ :=
+      domainType.uniq henv hΔ.toCtx domainRun.evidence.isDefEq
+    have domainDef : env.IsDefEq Us.length Δ.toCtx
+        domain' domainView' (.sort u) :=
+      (DefEqEvidence.change domainTypeEq.symm domainRun.evidence).isDefEq
+    have annotationDef :=
+      annotationsRun.isDefEqU.of_l henv hΔ.toCtx domainType
+    have storedToView : env.IsDefEq Us.length Δ.toCtx
+        storedDomain' domainView' (.sort u) :=
+      annotationDef.symm.trans domainDef
+    have hctx : VLCtx.IsDefEq env Us.length
+        ((none, .vlam storedDomain') :: Δ)
+        ((none, .vlam domainView') :: Δ) :=
+      .cons (.refl henv hΔ) (by nofun) (.vlam storedToView)
+    obtain ⟨bodyMoved', bodyMoved⟩ :=
+      bodyAbstract.defeqDFC henv hctx
+    have habstract :
+        bodyCandidate.view.abstract #[context.freshExpr] =
+          Expr.abstract1 context.freshFVarId bodyCandidate.view := by
+      rw [show #[context.freshExpr] =
+        ⟨[context.freshFVarId].map Expr.fvar⟩ by rfl]
+      simp only [Expr.abstract_eq, Expr.abstractList]
+    have bodyAbstractArray : TrExprS env Us
+        ((none, .vlam storedDomain') :: Δ)
+        (bodyCandidate.view.abstract #[context.freshExpr]) bodyView' := by
+      simpa only [habstract] using bodyAbstract
+    have bodyMovedArray : TrExprS env Us
+        ((none, .vlam domainView') :: Δ)
+        (bodyCandidate.view.abstract #[context.freshExpr]) bodyMoved' := by
+      simpa only [habstract] using bodyMoved
+    have bodyMoved_eq : bodyMoved' = bodyView' := by
+      exact (bodyAbstractArray.unique'
+        (.cons .base .vlam) abstractUnique bodyMovedArray).symm
+    subst bodyMoved'
+    have bodyEvidence := bodyRun.evidence
+    rw [bodyContext] at bodyEvidence
+    simp only [VLCtx.toCtx] at bodyEvidence
+    have annotationContext : VLCtx.IsDefEq env Us.length
+        ((none, .vlam domain') :: Δ)
+        ((none, .vlam storedDomain') :: Δ) :=
+      .cons (.refl henv hΔ) (by nofun) (.vlam annotationDef)
+    have bodyStoredType :=
+      bodySource.hasType.2.defeqDFC henv annotationContext.defeqCtx
+    have hBodyΓ : OnCtx (storedDomain' :: Δ.toCtx)
+        (env.IsType Us.length) :=
+      ⟨hΔ.toCtx, ⟨_, annotationDef.hasType.2⟩⟩
+    obtain ⟨_, bodyTypeEq⟩ :=
+      bodyStoredType.uniq henv hBodyΓ bodyEvidence.isDefEq
+    have bodyDefStored : env.IsDefEq Us.length
+        (storedDomain' :: Δ.toCtx) storedBody' bodyView' (.sort v) :=
+      (DefEqEvidence.change bodyTypeEq.symm bodyEvidence).isDefEq
+    have bodyDefMoved :=
+      bodyDefStored.defeqDFC henv hctx.defeqCtx
+    simpa only [AddInductive.CandidateExprTrace.view, habstract] using
+      TrExprS.forallE
+        (⟨u, domainDef.hasType.2⟩ :
+          env.IsType Us.length Δ.toCtx domainView')
+        (⟨v, bodyDefMoved.hasType.2⟩ :
+          env.IsType Us.length (domainView' :: Δ.toCtx) bodyView')
+        domainStrict bodyMoved
+
+/-- Root-level verified context and translations for an exact executable
+candidate expression and an explicitly named Theory view.
+
+The raw endpoint is a strict translation of the stored kernel source. The
+view endpoint translates the exact reconstructed candidate syntax; allowing
+the ordinary `TrExpr` relation here accounts for the definitional transport
+performed while recursively rebuilding Pi bodies. -/
+structure CandidateExprRootRun (env : VEnv) (Us : List Name)
+    {source : Expr} (candidate : AddInductive.CandidateExpr source)
+    (source' view' : VExpr) where
+  contextRun : CandidateContextRun candidate.context
+  venv_eq : contextRun.context.venv = env
+  lparams_eq : contextRun.context.lparams = Us
+  vlctx_eq : contextRun.context.vlctx = []
+  source_tr : TrExprS env Us [] source source'
+  view_tr : TrExpr env Us [] candidate.view view'
+  whnfFuel : Nat
+  whnfDepth : candidate.context.fuel.recDepth = whnfFuel + 1
+
+/-- Interpret a root candidate against its explicitly translated endpoints.
+The candidate view is not selected from a proof-only existential: the caller
+names it and proves that it translates the exact executable view, while the
+verified recursive run supplies the equality to the strict raw endpoint. -/
+theorem CandidateExprRootRun.evidence
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source}
+    {source' view' : VExpr}
+    (run : CandidateExprRootRun env Us candidate source' view') :
+    ∃ A, DefEqEvidence env Us.length [] source' view' A := by
+  have source_tr : run.contextRun.context.TrExprS source source' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.source_tr
+  obtain ⟨candidateView', inferred', ⟨candidateRun⟩⟩ :=
+    CandidateExprRun.exists_ofCandidate candidate.trace run.contextRun
+      source' source_tr run.whnfFuel run.whnfDepth
+  have henv : VEnv.WF env := by
+    simpa only [run.venv_eq] using run.contextRun.context.Ewf
+  have hΔ : VLCtx.WF env Us.length [] := by
+    simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using
+      run.contextRun.context.Δwf
+  have candidateView_tr :
+      TrExpr env Us [] candidate.view candidateView' := by
+    simpa only [AddInductive.CandidateExpr.view, run.venv_eq,
+      run.lparams_eq, run.vlctx_eq] using
+      candidateRun.view_tr
+  have viewDef : env.IsDefEqU Us.length [] candidateView' view' :=
+    candidateView_tr.uniq henv (.refl henv hΔ) run.view_tr
+  have sourceDef : env.IsDefEqU Us.length [] source' candidateView' := by
+    simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq,
+      VLCtx.toCtx] using
+      candidateRun.evidence.isDefEq.toU
+  obtain ⟨A, hfinal⟩ := sourceDef.trans henv hΔ.toCtx viewDef
+  exact ⟨A, .ofDefEq hfinal⟩
+
+/-- A root candidate together with the exact recursively interpreted semantic
+run selected by its retained checker executions.
+
+Unlike `CandidateExprRootRun`, this bundle does not stop at whole-expression
+equality: it retains the exact inferred type and reconstructed Theory view at
+every recursive candidate position. Consequently the same value can supply
+both normalization evidence and, when the executable trace preserves its main
+Pi spine, the positional telescope/result evidence required by generation.
+The view is selected by the verified run rather than supplied independently by
+a caller. -/
+structure CandidateExprSemanticRootRun (env : VEnv) (Us : List Name)
+    {source : Expr} (candidate : AddInductive.CandidateExpr source)
+    (source' : VExpr) where
+  contextRun : CandidateContextRun candidate.context
+  venv_eq : contextRun.context.venv = env
+  lparams_eq : contextRun.context.lparams = Us
+  vlctx_eq : contextRun.context.vlctx = []
+  source_tr : TrExprS env Us [] source source'
+  whnfFuel : Nat
+  whnfDepth : candidate.context.fuel.recDepth = whnfFuel + 1
+  view : VExpr
+  recursive : ∃ inferred, CandidateExprRun env Us candidate.trace []
+    source' view inferred
+
+/-- Forget the retained recursive run and expose the existing root semantic
+interface. The reconstructed view translation is derived from that same run,
+so it cannot name an unrelated endpoint. -/
+def CandidateExprSemanticRootRun.root
+    (run : CandidateExprSemanticRootRun env Us candidate source') :
+    CandidateExprRootRun env Us candidate source' run.view where
+  contextRun := run.contextRun
+  venv_eq := run.venv_eq
+  lparams_eq := run.lparams_eq
+  vlctx_eq := run.vlctx_eq
+  source_tr := run.source_tr
+  view_tr := by
+    obtain ⟨_, recursive⟩ := run.recursive
+    simpa only [AddInductive.CandidateExpr.view] using
+      recursive.view_tr
+  whnfFuel := run.whnfFuel
+  whnfDepth := run.whnfDepth
+
+/-- Automatically construct the retained root semantics from an exact
+verified candidate context and strict translation of the stored kernel
+source.
+
+The checker run selects the Theory view and inferred type existentially; the
+result records those exact selections. No caller-selected normalization view,
+erasure equality, or whole-Pi injectivity principle is used. -/
+theorem CandidateExprSemanticRootRun.exists_ofCandidate
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source} {source' : VExpr}
+    (contextRun : CandidateContextRun candidate.context)
+    (venv_eq : contextRun.context.venv = env)
+    (lparams_eq : contextRun.context.lparams = Us)
+    (vlctx_eq : contextRun.context.vlctx = [])
+    (source_tr : TrExprS env Us [] source source')
+    (whnfFuel : Nat)
+    (whnfDepth : candidate.context.fuel.recDepth = whnfFuel + 1) :
+    Nonempty (CandidateExprSemanticRootRun env Us candidate source') := by
+  have contextualSource :
+      contextRun.context.TrExprS source source' := by
+    simpa only [VContext.TrExprS, venv_eq, lparams_eq, vlctx_eq] using
+      source_tr
+  obtain ⟨view, inferred, ⟨recursive⟩⟩ :=
+    CandidateExprRun.exists_ofCandidate candidate.trace contextRun source'
+      contextualSource whnfFuel whnfDepth
+  refine ⟨{
+    contextRun := contextRun
+    venv_eq := venv_eq
+    lparams_eq := lparams_eq
+    vlctx_eq := vlctx_eq
+    source_tr := source_tr
+    whnfFuel := whnfFuel
+    whnfDepth := whnfDepth
+    view := view
+    recursive := ⟨inferred, ?_⟩ }⟩
+  simpa only [venv_eq, lparams_eq, vlctx_eq] using recursive
+
+/-- The exact pre-run evidence needed to interpret one candidate root without
+asking a caller to choose its normalized Theory view.
+
+This bundle deliberately stops before the recursive semantic run.  It contains
+only the verified implementation context, its alignment with the requested
+Theory environment, the strict translation of the stored source, and the fuel
+relation consumed by `CandidateExprRun.exists_ofCandidate`. -/
+structure CandidateExprSemanticRootInput (env : VEnv) (Us : List Name)
+    {source : Expr} (candidate : AddInductive.CandidateExpr source)
+    (source' : VExpr) where
+  contextRun : CandidateContextRun candidate.context
+  venv_eq : contextRun.context.venv = env
+  lparams_eq : contextRun.context.lparams = Us
+  vlctx_eq : contextRun.context.vlctx = []
+  source_tr : TrExprS env Us [] source source'
+  whnfFuel : Nat
+  whnfDepth : candidate.context.fuel.recDepth = whnfFuel + 1
+
+/-- Run the retained checker interpreter on an exact root input.  The result is
+`Nonempty` because the checker-selected Theory view is semantic evidence rather
+than executable metadata; no choice operator or caller-supplied endpoint is
+introduced by this boundary. -/
+theorem CandidateExprSemanticRootInput.exists
+    (input : CandidateExprSemanticRootInput env Us candidate source') :
+    Nonempty (CandidateExprSemanticRootRun env Us candidate source') :=
+  CandidateExprSemanticRootRun.exists_ofCandidate input.contextRun
+    input.venv_eq input.lparams_eq input.vlctx_eq input.source_tr
+    input.whnfFuel input.whnfDepth
+
+/-- Interpret an identity-normalizing staged root at the strict Theory
+translation already owned by its source input.  This keeps the endpoint
+definitionally fixed without caller-supplied WHNF data or a
+`Classical.choice` over the general semantic interpreter. -/
+def CandidateExprSemanticRootInput.semanticOfIdentity
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source} {source' : VExpr}
+    (input : CandidateExprSemanticRootInput env Us candidate source')
+    (identity : CandidateExprIdentity candidate.trace) :
+    CandidateExprSemanticRootRun env Us candidate source' where
+  contextRun := input.contextRun
+  venv_eq := input.venv_eq
+  lparams_eq := input.lparams_eq
+  vlctx_eq := input.vlctx_eq
+  source_tr := input.source_tr
+  whnfFuel := input.whnfFuel
+  whnfDepth := input.whnfDepth
+  view := source'
+  recursive := by
+    have source_tr : input.contextRun.context.TrExprS source source' := by
+      simpa only [VContext.TrExprS, input.venv_eq, input.lparams_eq,
+        input.vlctx_eq] using input.source_tr
+    obtain ⟨inferred, ⟨recursive⟩⟩ :=
+      CandidateExprRun.exists_ofIdentity candidate.trace identity
+        input.contextRun source' source_tr input.whnfFuel input.whnfDepth
+    refine ⟨inferred, ?_⟩
+    simpa only [input.venv_eq, input.lparams_eq, input.vlctx_eq] using
+      recursive
+
+/-- Interpret a staged root at the deterministic translation of its
+checker-selected view.  For a projection-free view the recursive semantic
+run's endpoint is pinned by strict-translation agreement
+(`CandidateExprRun.view_tr_strict` plus `TrExprS.trExprS?_eq`), so the
+retained `view` field is computed by `trExprS?` and the `Nonempty`
+interpretation is transferred onto it; no choice operator selects data.
+Unlike `semanticOfIdentity` this covers non-identity normalizations, at the
+cost of the executable view-uniqueness certificate. -/
+def CandidateExprSemanticRootInput.semanticOfUnique
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source} {source' : VExpr}
+    (input : CandidateExprSemanticRootInput env Us candidate source')
+    (unique : CandidateExprTraceViewIsUnique candidate.trace) :
+    CandidateExprSemanticRootRun env Us candidate source' :=
+  match hview : trExprS? Us [] candidate.trace.view with
+  | some view =>
+    { contextRun := input.contextRun
+      venv_eq := input.venv_eq
+      lparams_eq := input.lparams_eq
+      vlctx_eq := input.vlctx_eq
+      source_tr := input.source_tr
+      whnfFuel := input.whnfFuel
+      whnfDepth := input.whnfDepth
+      view := view
+      recursive := by
+        obtain ⟨w⟩ := input.exists
+        obtain ⟨inferred, run⟩ := w.recursive
+        cases Option.some.inj
+          (((run.view_tr_strict unique).trExprS?_eq unique.view).symm.trans
+            hview)
+        exact ⟨inferred, run⟩ }
+  | none =>
+      absurd
+        (show (trExprS? Us [] candidate.trace.view).isSome by
+          obtain ⟨w⟩ := input.exists
+          obtain ⟨inferred, run⟩ := w.recursive
+          exact TrExprS.trExprS?_isSome
+            ⟨w.view, run.view_tr_strict unique⟩ unique.view)
+        (by simp [hview])
+
+/-- One explicitly verified root stage shared by every candidate expression
+interpreted before or after family insertion.
+
+The stage owns the implementation/Theory context alignment once. Individual
+source positions retain only their strict translation, fuel relation, and the
+equality identifying the candidate's stored context with this stage. This is
+the reusable boundary between staged environment validation and the retained
+recursive candidate interpreter. -/
+structure CandidateSemanticStage
+    (candidateContext : AddInductive.Context) (env : VEnv) (Us : List Name)
+    where
+  contextRun : CandidateContextRun candidateContext
+  venv_eq : contextRun.context.venv = env
+  lparams_eq : contextRun.context.lparams = Us
+  vlctx_eq : contextRun.context.vlctx = []
+
+/-- Source-position evidence interpreted in one shared candidate stage.
+
+`context_eq` prevents a verified stage for another producer position from
+being reused. The normalized Theory endpoint is deliberately absent: it is
+selected only by `CandidateExprSemanticRootInput.exists`. -/
+structure CandidateExprStagedInput
+    {candidateContext : AddInductive.Context} {env : VEnv} {Us : List Name}
+    (stage : CandidateSemanticStage candidateContext env Us)
+    {source : Expr} (candidate : AddInductive.CandidateExpr source)
+    (source' : VExpr) where
+  context_eq : candidateContext = candidate.context
+  source_tr : TrExprS env Us [] source source'
+  whnfFuel : Nat
+  whnfDepth : candidate.context.fuel.recDepth = whnfFuel + 1
+
+/-- Specialize a shared verified stage to one exact source-indexed candidate
+root. This is a pure dependent transport; it neither runs the checker nor
+chooses the semantic view. -/
+def CandidateExprStagedInput.rootInput
+    {candidateContext : AddInductive.Context} {env : VEnv} {Us : List Name}
+    {source : Expr} {candidate : AddInductive.CandidateExpr source}
+    {source' : VExpr}
+    {stage : CandidateSemanticStage candidateContext env Us}
+    (input : CandidateExprStagedInput stage candidate source') :
+    CandidateExprSemanticRootInput env Us candidate source' := by
+  cases input.context_eq
+  exact {
+    contextRun := stage.contextRun
+    venv_eq := stage.venv_eq
+    lparams_eq := stage.lparams_eq
+    vlctx_eq := stage.vlctx_eq
+    source_tr := input.source_tr
+    whnfFuel := input.whnfFuel
+    whnfDepth := input.whnfDepth }
+
+/-- Pointwise checker-produced equality for a pair of binder telescopes. The
+tail is checked in the context extended by the raw binder, exactly matching
+`VEnv.TelDefEq` and the mixed generator's raw-binder discipline. -/
+inductive TelDefEqEvidence (env : VEnv) (U : Nat) :
+    List VExpr → List VExpr → List VExpr → Prop where
+  | nil : TelDefEqEvidence env U Γ [] []
+  | cons
+      (head : DefEqEvidence env U Γ A A' (.sort u))
+      (tail : TelDefEqEvidence env U (A :: Γ) As As') :
+      TelDefEqEvidence env U Γ (A :: As) (A' :: As')
+
+/-- Interpret pointwise checker evidence as the Theory telescope equality
+consumed by `GenerationChecked.WF`. -/
+theorem TelDefEqEvidence.telDefEq :
+    TelDefEqEvidence env U Γ As As' →
+      env.TelDefEq U Γ As As'
+  | .nil => trivial
+  | .cons head tail => ⟨⟨_, head.isDefEq⟩, tail.telDefEq⟩
+
+/-- Pointwise telescope equality followed by equality of the terminal result.
+
+Keeping these witnesses in one inductive preserves the raw-binder context at
+every recursive step.  In particular, the result is checked in
+`rawBinders.reverse ++ Γ`, exactly the context used by mixed generation. -/
+inductive TelResultDefEqEvidence (env : VEnv) (U : Nat) :
+    (Γ : List VExpr) → (rawBinders viewBinders : List VExpr) →
+      (rawResult viewResult resultType : VExpr) → Prop where
+  | terminal
+      (result : DefEqEvidence env U Γ rawResult viewResult resultType) :
+      TelResultDefEqEvidence env U Γ [] [] rawResult viewResult resultType
+  | forallE
+      (domain : DefEqEvidence env U Γ rawDomain viewDomain (.sort u))
+      (tail : TelResultDefEqEvidence env U (rawDomain :: Γ)
+        rawBinders viewBinders rawResult viewResult resultType) :
+      TelResultDefEqEvidence env U Γ
+        (rawDomain :: rawBinders) (viewDomain :: viewBinders)
+        rawResult viewResult resultType
+
+/-- Telescope component of a combined spine/result certificate. -/
+theorem TelResultDefEqEvidence.telescope :
+    TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType →
+      TelDefEqEvidence env U Γ rawBinders viewBinders
+  | .terminal _ => .nil
+  | .forallE domain tail => .cons domain tail.telescope
+
+/-- Terminal component, in the context generated by all raw binders. -/
+theorem TelResultDefEqEvidence.result :
+    TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType →
+      DefEqEvidence env U (rawBinders.reverse ++ Γ)
+        rawResult viewResult resultType
+  | .terminal result => by simpa using result
+  | .forallE _ tail => by
+      simpa [List.reverse_cons, List.append_assoc] using tail.result
+
+theorem TelResultDefEqEvidence.length_eq :
+    TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType →
+      rawBinders.length = viewBinders.length
+  | .terminal _ => rfl
+  | .forallE _ tail => congrArg Nat.succ tail.length_eq
+
+/-- Reify a Theory telescope equality as explicit checker-produced evidence.
+This direction is useful after telescope operations such as `take`, `drop`,
+and context transport have rearranged a candidate certificate. -/
+theorem TelDefEqEvidence.ofTelDefEq :
+    ∀ {Γ As As'}, env.TelDefEq U Γ As As' →
+      TelDefEqEvidence env U Γ As As'
+  | _, [], [], _ => .nil
+  | _, _ :: _, _ :: _, ⟨⟨_, head⟩, tail⟩ =>
+    .cons (.ofDefEq head) (TelDefEqEvidence.ofTelDefEq tail)
+
+/-- Retain an exact prefix of a checker-produced telescope certificate. -/
+theorem TelDefEqEvidence.take
+    (run : TelDefEqEvidence env U Γ As As') (n : Nat) :
+    TelDefEqEvidence env U Γ (As.take n) (As'.take n) :=
+  .ofTelDefEq (run.telDefEq.take n)
+
+/-- Transport a checker-produced telescope certificate through environment
+growth. -/
+theorem TelDefEqEvidence.mono
+    (run : TelDefEqEvidence env U Γ As As') (henv : env ≤ env') :
+    TelDefEqEvidence env' U Γ As As' :=
+  .ofTelDefEq (run.telDefEq.mono henv)
+
+/-- Combine an independently transformed telescope certificate with its
+terminal result certificate. -/
+theorem TelResultDefEqEvidence.ofTelescopeResult
+    (tel : TelDefEqEvidence env U Γ rawBinders viewBinders)
+    (result : DefEqEvidence env U (rawBinders.reverse ++ Γ)
+      rawResult viewResult resultType) :
+    TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType := by
+  induction tel with
+  | nil => exact .terminal (by simpa using result)
+  | cons head tail ih =>
+    exact .forallE head (ih (by
+      simpa [List.reverse_cons, List.append_assoc] using result))
+
+private theorem candidateDefEqCtx_trans (henv : VEnv.WF env) :
+    ∀ {Γ₁ Γ₂ Γ₃},
+      env.IsDefEqCtx U [] Γ₁ Γ₂ →
+      env.IsDefEqCtx U [] Γ₂ Γ₃ →
+      env.IsDefEqCtx U [] Γ₁ Γ₃
+  | _, _, _, .zero, h₂₃ => h₂₃
+  | _, _, _, .succ h₁₂ head₁₂, .succ h₂₃ head₂₃ => by
+    have tail := candidateDefEqCtx_trans henv h₁₂ h₂₃
+    have head₂₃' := head₂₃.defeqDFC henv (h₁₂.symm henv)
+    exact .succ tail (VEnv.IsDefEq.trans_l henv h₁₂.isType
+      head₁₂ head₂₃')
+
+private theorem candidateTelDefEq_defeqDFC (henv : VEnv.WF env)
+    (hctx : env.IsDefEqCtx U [] Γ₁ Γ₂) :
+    ∀ {As As'}, env.TelDefEq U Γ₁ As As' →
+      env.TelDefEq U Γ₂ As As'
+  | [], [], _ => trivial
+  | _ :: _, _ :: _, ⟨⟨u, head⟩, tail⟩ =>
+    ⟨⟨u, head.defeqDFC henv hctx⟩,
+      candidateTelDefEq_defeqDFC henv
+        (.succ hctx head.hasType.1) tail⟩
+
+private theorem candidateTelDefEq_append
+    {env : VEnv} {U : Nat} {Γ : List VExpr} :
+    ∀ {As As' Bs Bs'}, env.TelDefEq U Γ As As' →
+      env.TelDefEq U (As.reverse ++ Γ) Bs Bs' →
+      env.TelDefEq U Γ (As ++ Bs) (As' ++ Bs')
+  | [], [], _, _, _, suffix => by simpa using suffix
+  | _ :: As, _ :: As', Bs, Bs', ⟨head, tail⟩, suffix => by
+    exact ⟨head, candidateTelDefEq_append tail (by
+      simpa [List.reverse_cons, List.append_assoc] using suffix)⟩
+
+/-- Replace a constructor candidate's stored parameter prefix by the family's
+raw parameter prefix.
+
+The two raw prefixes need not be syntactically equal: both are related to the
+same checked view prefix. The field telescope and terminal result are then
+transported through the induced context equality, yielding exactly the mixed
+raw/view context emitted by generation. -/
+theorem TelResultDefEqEvidence.replacePrefix
+    (henv : VEnv.WF env)
+    (newPrefix : TelDefEqEvidence env U [] newRawPrefix viewPrefix)
+    (run : TelResultDefEqEvidence env U []
+      (oldRawPrefix ++ rawSuffix) (viewPrefix ++ viewSuffix)
+      rawResult viewResult resultType)
+    (prefixLength : oldRawPrefix.length = viewPrefix.length) :
+    TelResultDefEqEvidence env U []
+      (newRawPrefix ++ rawSuffix) (viewPrefix ++ viewSuffix)
+      rawResult viewResult resultType := by
+  have declaredTel := run.telescope.telDefEq
+  have oldPrefix : env.TelDefEq U [] oldRawPrefix viewPrefix := by
+    have hprefix := declaredTel.take oldRawPrefix.length
+    simpa [prefixLength] using hprefix
+  have oldSuffix : env.TelDefEq U oldRawPrefix.reverse
+      rawSuffix viewSuffix := by
+    have suffix := declaredTel.drop oldRawPrefix.length
+    simpa [prefixLength] using suffix
+  have newPrefixTheory := newPrefix.telDefEq
+  have newPrefixContext : env.IsDefEqCtx U []
+      newRawPrefix.reverse viewPrefix.reverse := by
+    simpa using newPrefixTheory.ctx
+  have oldPrefixContext : env.IsDefEqCtx U []
+      oldRawPrefix.reverse viewPrefix.reverse := by
+    simpa using oldPrefix.ctx
+  have prefixContext : env.IsDefEqCtx U []
+      newRawPrefix.reverse oldRawPrefix.reverse :=
+    candidateDefEqCtx_trans henv newPrefixContext
+      (oldPrefixContext.symm henv)
+  have newSuffix : env.TelDefEq U newRawPrefix.reverse
+      rawSuffix viewSuffix :=
+    candidateTelDefEq_defeqDFC henv (prefixContext.symm henv) oldSuffix
+  have emittedTel : env.TelDefEq U []
+      (newRawPrefix ++ rawSuffix) (viewPrefix ++ viewSuffix) :=
+    candidateTelDefEq_append newPrefixTheory (by simpa using newSuffix)
+  have fullContext : env.IsDefEqCtx U []
+      ((newRawPrefix ++ rawSuffix).reverse)
+      ((oldRawPrefix ++ rawSuffix).reverse) := by
+    have extended := newSuffix.raw_onTel.extendDefEqCtx prefixContext
+    simpa [List.reverse_append] using extended
+  have oldResult : DefEqEvidence env U
+      (oldRawPrefix ++ rawSuffix).reverse
+      rawResult viewResult resultType := by
+    simpa using run.result
+  have emittedResult : DefEqEvidence env U
+      (newRawPrefix ++ rawSuffix).reverse
+      rawResult viewResult resultType :=
+    .ofDefEq (oldResult.isDefEq.defeqDFC henv
+      (fullContext.symm henv))
+  exact TelResultDefEqEvidence.ofTelescopeResult
+    (.ofTelDefEq emittedTel) (by simpa using emittedResult)
+
+/-- Every recursive candidate run carries the well-formed local context used
+by its root checker observation. -/
+theorem CandidateExprRun.context_wf
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred') :
+    VLCtx.WF env Us.length Δ := by
+  cases run with
+  | @terminal Δ context source inferred result source' result' inferred'
+      checked normalized node =>
+    simpa only [node.check.venv_eq, node.check.lparams_eq,
+      node.check.vlctx_eq] using node.check.context.Δwf
+  | forallE _ _ _ _ node =>
+    simpa only [node.check.venv_eq, node.check.lparams_eq,
+      node.check.vlctx_eq] using node.check.context.Δwf
+
+private theorem candidateTelN_forallN_length :
+    ∀ (As : List VExpr) (B : VExpr),
+      VExpr.telN As.length (VExpr.forallN As B) = As
+  | [], _ => rfl
+  | _ :: As, B => by
+    simp only [List.length_cons, VExpr.forallN, VExpr.telN,
+      candidateTelN_forallN_length As B]
+
+private theorem candidateDropN_forallN_length :
+    ∀ (As : List VExpr) (B : VExpr),
+      VExpr.dropN As.length (VExpr.forallN As B) = B
+  | [], _ => rfl
+  | _ :: As, B => by
+    simp only [List.length_cons, VExpr.forallN, VExpr.dropN,
+      candidateDropN_forallN_length As B]
+
+/-- Syntactic terminal marker used only to recover a telescope from a known
+`dropN` endpoint. -/
+private def CandidateTerminal : VExpr → Prop
+  | .forallE _ _ => False
+  | _ => True
+
+/-- If dropping `n` binders from a telescope reaches its non-forall terminal,
+then taking `n` binders recovers the entire telescope. -/
+private theorem candidateTelN_of_dropN_terminal
+    {B : VExpr} (hB : CandidateTerminal B) :
+    ∀ (As : List VExpr) (n : Nat),
+      VExpr.dropN n (VExpr.forallN As B) = B →
+      VExpr.telN n (VExpr.forallN As B) = As
+  | [], n, _ => by
+    cases B <;> cases n <;> simp_all [CandidateTerminal,
+      VExpr.forallN, VExpr.dropN, VExpr.telN]
+  | A :: As, 0, h => by
+    cases B <;> simp_all [CandidateTerminal,
+      VExpr.forallN, VExpr.dropN]
+  | A :: As, n + 1, h => by
+    simp only [VExpr.forallN, VExpr.telN,
+      List.cons.injEq, true_and]
+    exact candidateTelN_of_dropN_terminal hB As n (by
+      simpa only [VExpr.forallN, VExpr.dropN] using h)
+
+private theorem candidateTerminal_appN_app (f a : VExpr) :
+    ∀ args, CandidateTerminal (VExpr.appN (.app f a) args)
+  | [] => trivial
+  | b :: args => candidateTerminal_appN_app (.app f a) b args
+
+private theorem candidateTerminal_appN_const
+    (name : Name) (levels : List VLevel) :
+    ∀ args, CandidateTerminal (VExpr.appN (.const name levels) args)
+  | [] => trivial
+  | a :: args => candidateTerminal_appN_app (.const name levels) a args
+
+/-- Recursive worker for candidate spine extraction.
+
+`rawΔ` follows the contexts generated by the stored raw binders, while `Δ`
+is the annotation-consumed context in which the candidate body was checked.
+The explicit context equality transports each retained checker judgment back
+to the raw side before it is added to the telescope certificate. -/
+private theorem CandidateExprRun.spineEvidenceAux
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (aligned : trace.storedSpine = true)
+    {rawΔ : VLCtx} {rawSource' : VExpr}
+    (contextEq : VLCtx.IsDefEq env Us.length rawΔ Δ)
+    (rawSource_tr : TrExprS env Us rawΔ source rawSource') :
+    ∃ rawBinders viewBinders rawResult viewResult resultType,
+      rawSource' = VExpr.forallN rawBinders rawResult ∧
+      view' = VExpr.forallN viewBinders viewResult ∧
+      TelResultDefEqEvidence env Us.length rawΔ.toCtx
+        rawBinders viewBinders rawResult viewResult resultType ∧
+      rawBinders.length = trace.spineLength := by
+  induction run generalizing rawΔ rawSource' with
+  | terminal node =>
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hRawΔ := contextEq.wf
+    have rawToSource : env.IsDefEqU Us.length rawΔ.toCtx
+        rawSource' _ :=
+      rawSource_tr.uniq henv contextEq node.check.expr_tr
+    have sourceToView :=
+      node.evidence.isDefEq.defeqDFC henv
+        (contextEq.symm henv).defeqCtx
+    have final := VEnv.IsDefEq.transU_r henv hRawΔ.toCtx
+      rawToSource sourceToView
+    exact ⟨[], [], rawSource', _, _, rfl, rfl,
+      .terminal (.ofDefEq final), rfl⟩
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    simp only [AddInductive.CandidateExprTrace.storedSpine,
+      Bool.and_eq_true] at aligned
+    obtain ⟨sourceEq, bodyAligned⟩ := aligned
+    have alignedSource_tr : TrExprS env Us rawΔ
+        (.forallE name domain body binderInfo) rawSource' :=
+      rawSource_tr.eqv (Expr.structuralEq_eqv sourceEq)
+    let @TrExprS.forallE _ _ rawDomain rawBody _ _ _ _ _
+        rawDomainType rawBodyType rawDomain_tr rawBody_tr := alignedSource_tr
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hΔ : VLCtx.WF env Us.length Δ := by
+      simpa only [node.check.venv_eq, node.check.lparams_eq,
+        node.check.vlctx_eq] using node.check.context.Δwf
+    have hRawΔ := contextEq.wf
+    have rawToDomainU :=
+      rawDomain_tr.uniq henv contextEq domainRun.source_tr
+    have domainTypeRaw :=
+      domainType.defeqDFC henv (contextEq.symm henv).defeqCtx
+    have rawToDomain :=
+      rawToDomainU.of_r henv hRawΔ.toCtx domainTypeRaw
+    have domainToView :=
+      domainRun.evidence.isDefEq.toU.of_l henv hΔ.toCtx domainType
+    have domainToViewRaw :=
+      domainToView.defeqDFC henv (contextEq.symm henv).defeqCtx
+    have head : DefEqEvidence env Us.length rawΔ.toCtx
+        _ domainView' (.sort u) :=
+      .ofDefEq (rawToDomain.trans domainToViewRaw)
+    have annotationDef :=
+      annotationsRun.isDefEqU.of_l henv hΔ.toCtx domainType
+    have annotationDefRaw :=
+      annotationDef.defeqDFC henv (contextEq.symm henv).defeqCtx
+    have rawToStored := rawToDomain.trans annotationDefRaw
+    have bodyWF := bodyRun.context_wf
+    rw [bodyContext] at bodyWF
+    have rawFresh :
+        ∀ fv deps,
+          some (context.freshFVarId, annotations.consumed.fvarsList) =
+              some (fv, deps) →
+            fv ∉ rawΔ.fvars ∧ deps ⊆ rawΔ.fvars := by
+      intro fv deps heq
+      cases heq
+      have hfresh := bodyWF.2.1 _ _ rfl
+      simpa only [contextEq.fvars] using hfresh
+    let rawBodyΔ : VLCtx :=
+      (some (context.freshFVarId, annotations.consumed.fvarsList),
+        .vlam rawDomain) :: rawΔ
+    have bodyContextEqConcrete : VLCtx.IsDefEq env Us.length rawBodyΔ
+        ((some (context.freshFVarId, annotations.consumed.fvarsList),
+          .vlam storedDomain') :: Δ) :=
+      .cons contextEq rawFresh (.vlam rawToStored)
+    have bodyContextEq : VLCtx.IsDefEq env Us.length rawBodyΔ bodyΔ := by
+      simpa only [bodyContext] using bodyContextEqConcrete
+    have rawBodyΔwf := bodyContextEq.wf
+    have rawBodyInst_tr : TrExprS env Us rawBodyΔ
+        (body.instantiate1 context.freshExpr) rawBody := by
+      simpa only [AddInductive.Context.freshExpr,
+        Expr.instantiate1_eq] using
+        rawBody_tr.inst_fvar henv.ordered rawBodyΔwf
+    obtain ⟨rawBinders, viewBinders, rawResult, viewResult,
+        resultType, rawBodyEq, viewBodyEq, tail, tailLength⟩ :=
+      bodyIH bodyAligned bodyContextEq rawBodyInst_tr
+    refine ⟨rawDomain :: rawBinders,
+      domainView' :: viewBinders, rawResult, viewResult, resultType,
+      ?_, ?_, ?_, ?_⟩
+    · simp only [VExpr.forallN, rawBodyEq]
+    · simp only [VExpr.forallN, viewBodyEq]
+    · exact .forallE head (by
+        simpa only [rawBodyΔ, VLCtx.toCtx] using tail)
+    · simpa only [List.length_cons,
+        AddInductive.CandidateExprTrace.spineLength] using
+        congrArg Nat.succ tailLength
+
+/-- Extract exact raw/view telescopes and terminal results from a recursive
+candidate run whose WHNF traversal preserved the stored Pi spine.
+
+The binder count is computed from the source-indexed trace, and `telN`/
+`dropN` name the exact stored raw and reconstructed-view components.  This
+avoids recovering binder equality from whole-Pi definitional equality and so
+does not use the unfinished forall-injectivity theorem. -/
+theorem CandidateExprRun.spineEvidence
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (aligned : trace.storedSpine = true) :
+    ∃ resultType,
+      TelResultDefEqEvidence env Us.length Δ.toCtx
+        (VExpr.telN trace.spineLength source')
+        (VExpr.telN trace.spineLength view')
+        (VExpr.dropN trace.spineLength source')
+        (VExpr.dropN trace.spineLength view') resultType := by
+  have henv : VEnv.WF env := by
+    cases run with
+    | terminal node =>
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    | forallE _ _ _ _ node =>
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+  obtain ⟨rawBinders, viewBinders, rawResult, viewResult,
+      resultType, rawEq, viewEq, evidence, rawLength⟩ :=
+    run.spineEvidenceAux aligned
+      (.refl henv run.context_wf) run.source_tr
+  have viewLength : viewBinders.length = trace.spineLength :=
+    evidence.length_eq ▸ rawLength
+  have rawTel : VExpr.telN trace.spineLength source' = rawBinders := by
+    rw [rawEq, ← rawLength]
+    exact candidateTelN_forallN_length rawBinders rawResult
+  have viewTel : VExpr.telN trace.spineLength view' = viewBinders := by
+    rw [viewEq, ← viewLength]
+    exact candidateTelN_forallN_length viewBinders viewResult
+  have rawResultEq :
+      VExpr.dropN trace.spineLength source' = rawResult := by
+    rw [rawEq, ← rawLength]
+    exact candidateDropN_forallN_length rawBinders rawResult
+  have viewResultEq :
+      VExpr.dropN trace.spineLength view' = viewResult := by
+    rw [viewEq, ← viewLength]
+    exact candidateDropN_forallN_length viewBinders viewResult
+  simpa only [rawTel, viewTel, rawResultEq, viewResultEq] using
+    ⟨resultType, evidence⟩
+
+/-- Replace only the terminal typing index of a combined certificate. The
+telescope and both result endpoints remain definitionally unchanged. -/
+theorem TelResultDefEqEvidence.withResult
+    (run : TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType)
+    (result : DefEqEvidence env U (rawBinders.reverse ++ Γ)
+      rawResult viewResult resultType') :
+    TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType' := by
+  induction run with
+  | terminal _ => exact .terminal (by simpa using result)
+  | forallE domain tail ih =>
+    exact .forallE domain (ih (by
+      simpa [List.reverse_cons, List.append_assoc] using result))
+
+/-- Fix a candidate terminal equality at a known type of its right endpoint.
+This is the bridge from the candidate's checker-inferred type to the precise
+sort required by dependent inductive analysis. -/
+theorem TelResultDefEqEvidence.ofRightType
+    (henv : VEnv.WF env) (hΓ : OnCtx Γ (env.IsType U))
+    (run : TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult resultType)
+    (rightType : env.HasType U (rawBinders.reverse ++ Γ)
+      viewResult expectedType) :
+    TelResultDefEqEvidence env U Γ rawBinders viewBinders
+      rawResult viewResult expectedType := by
+  have hctx : OnCtx (rawBinders.reverse ++ Γ) (env.IsType U) :=
+    (run.telescope.telDefEq.extendCtx (.refl hΓ)).isType
+  exact run.withResult (.ofDefEq
+    (run.result.isDefEq.toU.of_r henv hctx rightType))
+
+theorem CandidateExprRun.env_wf
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred') :
+    VEnv.WF env := by
+  cases run with
+  | terminal node =>
+    simpa only [node.check.venv_eq] using node.check.context.Ewf
+  | forallE _ _ _ _ node =>
+    simpa only [node.check.venv_eq] using node.check.context.Ewf
+
+/-- Recover the exact verified candidate context reached at the end of the
+main Pi spine.
+
+`CandidateExprRun` retains the semantic context at every recursive node, but
+its public indices deliberately mention only the translated local context.
+Constructor validation, on the other hand, resumes in the implementation
+`Context` returned by the family traversal.  This projection reconnects the
+two without reconstructing a local context from names: starting from the
+root `CandidateContextRun`, each Pi case repeats the already-certified
+annotation equality and the exact `pushLocalDecl` used by the candidate. -/
+theorem CandidateExprRun.terminalContextRun
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (contextRun : CandidateContextRun candidateContext)
+    (venv_eq : contextRun.context.venv = env)
+    (lparams_eq : contextRun.context.lparams = Us)
+    (vlctx_eq : contextRun.context.vlctx = Δ) :
+    ∃ terminalRun : CandidateContextRun trace.terminalContext,
+      terminalRun.context.venv = env ∧
+      terminalRun.context.lparams = Us := by
+  induction run with
+  | terminal node =>
+      exact ⟨by
+          simpa only [AddInductive.CandidateExprTrace.terminalContext] using
+            contextRun,
+        venv_eq, lparams_eq⟩
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    have storedDomain_tr : contextRun.context.TrExprS
+        annotations.consumed storedDomain' := by
+      simpa only [VContext.TrExprS, venv_eq, lparams_eq, vlctx_eq] using
+        annotationsRun.rhs_tr
+    have henv : VEnv.WF env := by
+      simpa only [venv_eq] using contextRun.context.Ewf
+    have hΔ : OnCtx Δ.toCtx (env.IsType Us.length) := by
+      simpa only [venv_eq, lparams_eq, vlctx_eq] using
+        contextRun.context.Δwf.toCtx
+    have storedDomain_type : env.IsType Us.length Δ.toCtx storedDomain' := by
+      have annotationDef := annotationsRun.isDefEqU.of_l henv hΔ domainType
+      exact ⟨u, annotationDef.hasType.2⟩
+    let nextContextRun := contextRun.pushLocalDecl name binderInfo
+      annotations.consumed fresh storedDomain' storedDomain_tr (by
+        change contextRun.context.venv.IsType
+          contextRun.context.lparams.length
+          contextRun.context.vlctx.toCtx storedDomain'
+        rw [venv_eq, lparams_eq, vlctx_eq]
+        exact storedDomain_type)
+    have nextVenv : nextContextRun.context.venv = env := by
+      simp only [nextContextRun, CandidateContextRun.pushLocalDecl_venv,
+        venv_eq]
+    have nextLparams : nextContextRun.context.lparams = Us := by
+      simp only [nextContextRun, CandidateContextRun.pushLocalDecl_lparams,
+        lparams_eq]
+    have nextVlctx : nextContextRun.context.vlctx = bodyΔ := by
+      simp only [nextContextRun, CandidateContextRun.pushLocalDecl_vlctx]
+      rw [vlctx_eq, bodyContext]
+    obtain ⟨terminalRun, terminalVenv, terminalLparams⟩ :=
+      bodyIH nextContextRun nextVenv nextLparams nextVlctx
+    exact ⟨by
+        simpa only [AddInductive.CandidateExprTrace.terminalContext] using
+          terminalRun,
+      terminalVenv, terminalLparams⟩
+
+private theorem candidateFVLift'_comp
+    (left : VLCtx.FVLift' Δ₁ Δ₂ 0 (.skipN .refl n₁) 0)
+    (right : VLCtx.FVLift' Δ₂ Δ₃ 0 (.skipN .refl n₂) 0) :
+    VLCtx.FVLift' Δ₁ Δ₃ 0 (.skipN .refl (n₁ + n₂)) 0 := by
+  simpa only [Lift.comp_skipN, Lift.comp, Lift.skipN_skipN] using
+    left.comp right
+
+/-- Recover the terminal implementation context together with the exact
+candidate-view telescope occupying the same local positions.
+
+The two `VLCtx`s keep the identical free-variable metadata and declaration
+kinds.  Their declaration types may differ, but strict translation uniqueness
+only needs this positional relation.  The view-side `toCtx` is definitionally
+the reversed telescope selected by the recursive semantic run, followed by
+the caller's view-side base context. -/
+theorem CandidateExprRun.terminalContextRunView
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (contextRun : CandidateContextRun candidateContext)
+    (venv_eq : contextRun.context.venv = env)
+    (lparams_eq : contextRun.context.lparams = Us)
+    (vlctx_eq : contextRun.context.vlctx = Δ)
+    {viewΔ : VLCtx}
+    (viewDefEq : VLCtx.IsDefEq env Us.length Δ viewΔ)
+    (viewContext : TrExprS.IsUniqueCtx Δ viewΔ) :
+    ∃ (terminalRun : CandidateContextRun trace.terminalContext)
+        (viewTerminal : VLCtx),
+      terminalRun.context.venv = env ∧
+      terminalRun.context.lparams = Us ∧
+      VLCtx.IsDefEq env Us.length terminalRun.context.vlctx viewTerminal ∧
+      TrExprS.IsUniqueCtx terminalRun.context.vlctx viewTerminal ∧
+      VLCtx.FVLift' viewΔ viewTerminal 0
+        (.skipN .refl trace.spineLength) 0 ∧
+      viewTerminal.toCtx =
+        (VExpr.telN trace.spineLength view').reverse ++ viewΔ.toCtx := by
+  induction run generalizing viewΔ with
+  | @terminal Δ context source inferred result source' result' inferred'
+      checked normalized node =>
+      let terminalRun : CandidateContextRun
+          (AddInductive.CandidateExprTrace.terminal
+            context source inferred result checked normalized).terminalContext := by
+        simpa only [AddInductive.CandidateExprTrace.terminalContext] using
+          contextRun
+      refine ⟨terminalRun, viewΔ, venv_eq, lparams_eq, ?_, ?_, .refl, ?_⟩
+      · change VLCtx.IsDefEq env Us.length contextRun.context.vlctx viewΔ
+        rw [vlctx_eq]
+        exact viewDefEq
+      · change TrExprS.IsUniqueCtx contextRun.context.vlctx viewΔ
+        rw [vlctx_eq]
+        exact viewContext
+      · simp only [AddInductive.CandidateExprTrace.spineLength,
+          VExpr.telN, List.reverse_nil, List.nil_append]
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    have storedDomain_tr : contextRun.context.TrExprS
+        annotations.consumed storedDomain' := by
+      simpa only [VContext.TrExprS, venv_eq, lparams_eq, vlctx_eq] using
+        annotationsRun.rhs_tr
+    have henv : VEnv.WF env := by
+      simpa only [venv_eq] using contextRun.context.Ewf
+    have hΔ : OnCtx Δ.toCtx (env.IsType Us.length) := by
+      simpa only [venv_eq, lparams_eq, vlctx_eq] using
+        contextRun.context.Δwf.toCtx
+    have storedDomain_type : env.IsType Us.length Δ.toCtx storedDomain' := by
+      have annotationDef := annotationsRun.isDefEqU.of_l henv hΔ domainType
+      exact ⟨u, annotationDef.hasType.2⟩
+    have domainDef : env.IsDefEq Us.length Δ.toCtx
+        domain' domainView' (.sort u) :=
+      domainRun.evidence.isDefEq.toU.of_l henv hΔ domainType
+    have annotationDef : env.IsDefEq Us.length Δ.toCtx
+        domain' storedDomain' (.sort u) :=
+      annotationsRun.isDefEqU.of_l henv hΔ domainType
+    have storedToView : env.IsDefEq Us.length Δ.toCtx
+        storedDomain' domainView' (.sort u) :=
+      annotationDef.symm.trans domainDef
+    let nextContextRun := contextRun.pushLocalDecl name binderInfo
+      annotations.consumed fresh storedDomain' storedDomain_tr (by
+        change contextRun.context.venv.IsType
+          contextRun.context.lparams.length
+          contextRun.context.vlctx.toCtx storedDomain'
+        rw [venv_eq, lparams_eq, vlctx_eq]
+        exact storedDomain_type)
+    have nextVenv : nextContextRun.context.venv = env := by
+      simp only [nextContextRun, CandidateContextRun.pushLocalDecl_venv,
+        venv_eq]
+    have nextLparams : nextContextRun.context.lparams = Us := by
+      simp only [nextContextRun, CandidateContextRun.pushLocalDecl_lparams,
+        lparams_eq]
+    have nextVlctx : nextContextRun.context.vlctx = bodyΔ := by
+      simp only [nextContextRun, CandidateContextRun.pushLocalDecl_vlctx]
+      rw [vlctx_eq, bodyContext]
+    let viewBodyΔ : VLCtx :=
+      (some (context.freshFVarId, annotations.consumed.fvarsList),
+        .vlam domainView') :: viewΔ
+    have bodyWF := bodyRun.context_wf
+    rw [bodyContext] at bodyWF
+    have bodyViewDefEq : VLCtx.IsDefEq env Us.length bodyΔ viewBodyΔ := by
+      rw [bodyContext]
+      exact .cons viewDefEq bodyWF.2.1 (.vlam storedToView)
+    have bodyViewContext : TrExprS.IsUniqueCtx bodyΔ viewBodyΔ := by
+      rw [bodyContext]
+      exact viewContext.cons .vlam
+    obtain ⟨terminalRun, viewTerminal, terminalVenv, terminalLparams,
+        terminalViewDefEq, terminalViewContext, terminalViewLift,
+        terminalViewEq⟩ :=
+      bodyIH nextContextRun nextVenv nextLparams nextVlctx bodyViewDefEq
+        bodyViewContext
+    refine ⟨by
+        simpa only [AddInductive.CandidateExprTrace.terminalContext] using
+          terminalRun,
+      viewTerminal, terminalVenv, terminalLparams, terminalViewDefEq,
+      terminalViewContext, ?_, ?_⟩
+    · have headLift : VLCtx.FVLift' viewΔ viewBodyΔ 0
+          (.skipN .refl 1) 0 := by
+        exact VLCtx.FVLift'.skip_fvar
+          (context.freshFVarId, annotations.consumed.fvarsList)
+          (.vlam domainView') (.refl :
+            VLCtx.FVLift' viewΔ viewΔ 0 .refl 0)
+      simpa only [AddInductive.CandidateExprTrace.spineLength,
+        Nat.add_comm 1] using
+        candidateFVLift'_comp headLift terminalViewLift
+    simpa only [AddInductive.CandidateExprTrace.spineLength,
+      VExpr.telN, List.reverse_cons, List.singleton_append,
+      List.append_assoc, viewBodyΔ, VLCtx.toCtx] using terminalViewEq
+
+/-- Interpret the terminal-sort fact retained by family validation.
+
+At a terminal node the verified WHNF result translates the exact kernel sort.
+At a Pi node the recursively interpreted body is transported from the
+annotation-consumed binder context to the candidate-view binder context. Thus
+the complete checker-selected candidate view is a Theory type without using a
+checked inductive declaration or a caller-supplied view-WF proof. -/
+theorem CandidateExprRun.view_isType_of_terminalSort
+    {env : VEnv} {Us : List Name}
+    {candidateContext : AddInductive.Context} {source : Expr}
+    {trace : AddInductive.CandidateExprTrace candidateContext source}
+    {Δ : VLCtx} {source' view' inferred' : VExpr}
+    (run : CandidateExprRun env Us trace Δ source' view' inferred')
+    (terminal : trace.terminalResult = .sort resultLevel) :
+    env.IsType Us.length Δ.toCtx view' := by
+  induction run with
+  | terminal node =>
+    simp only [AddInductive.CandidateExprTrace.terminalResult] at terminal
+    rw [terminal] at node
+    cases node.whnf.rhs_tr with
+    | sort level_tr =>
+      exact ⟨_, .sort (VLevel.WF.of_ofLevel level_tr)⟩
+  | @forallE domain context name binderInfo Δ source inferred body
+      source' domain' body' inferred' domainView' domainInferred'
+      storedDomain' bodyΔ storedBody' bodyView' bodyInferred' u v fresh
+      checked normalized annotations annotationsEq domainCandidate
+      bodyCandidate node domainRun annotationsRun bodyRun domainType bodyType
+      bodySource bodyContext domainIH bodyIH =>
+    simp only [AddInductive.CandidateExprTrace.terminalResult] at terminal
+    have henv : VEnv.WF env := by
+      simpa only [node.check.venv_eq] using node.check.context.Ewf
+    have hΔ : VLCtx.WF env Us.length Δ := by
+      simpa only [node.check.venv_eq, node.check.lparams_eq,
+        node.check.vlctx_eq] using node.check.context.Δwf
+    have domainDef : env.IsDefEq Us.length Δ.toCtx
+        domain' domainView' (.sort u) :=
+      domainRun.evidence.isDefEq.toU.of_l henv hΔ.toCtx domainType
+    have domainViewType : env.IsType Us.length Δ.toCtx domainView' :=
+      ⟨u, domainDef.hasType.2⟩
+    have annotationDef : env.IsDefEq Us.length Δ.toCtx
+        domain' storedDomain' (.sort u) :=
+      annotationsRun.isDefEqU.of_l henv hΔ.toCtx domainType
+    have storedToView : env.IsDefEq Us.length Δ.toCtx
+        storedDomain' domainView' (.sort u) :=
+      annotationDef.symm.trans domainDef
+    have bodyContextEq : env.IsDefEqCtx Us.length []
+        (storedDomain' :: Δ.toCtx) (domainView' :: Δ.toCtx) :=
+      (VLCtx.IsDefEq.cons (.refl henv hΔ) (ofv := none)
+        (by nofun) (.vlam storedToView)).defeqCtx
+    have bodyViewTypeStored : env.IsType Us.length
+        (storedDomain' :: Δ.toCtx) bodyView' := by
+      simpa only [bodyContext, VLCtx.toCtx] using bodyIH terminal
+    have bodyViewType : env.IsType Us.length
+        (domainView' :: Δ.toCtx) bodyView' := by
+      exact bodyViewTypeStored.defeqDFC henv.ordered bodyContextEq
+    exact domainViewType.forallE bodyViewType
+
+/-- Family validation types the checker-selected view first; the retained
+candidate equality then transports that fact back to the exact raw Theory
+source. This is the declaration-WF fact needed before raw-family insertion. -/
+theorem CandidateExprSemanticRootRun.source_isType_of_terminalSort
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source} {source' : VExpr}
+    (run : CandidateExprSemanticRootRun env Us candidate source')
+    (terminal : candidate.trace.terminalResult = .sort resultLevel) :
+    env.IsType Us.length [] source' := by
+  obtain ⟨_, recursive⟩ := run.recursive
+  have hview := recursive.view_isType_of_terminalSort terminal
+  have henv : VEnv.WF env := by
+    simpa only [run.venv_eq] using run.contextRun.context.Ewf
+  exact hview.defeqU_l henv trivial recursive.evidence.isDefEq.toU.symm
+
+/-- Candidate-view parameter binders selected by an exact singleton family
+validation run. The split is computed from the retained candidate spine. -/
+def CandidateExprSemanticRootRun.viewParameters
+    {indType : InductiveType}
+    {candidate : AddInductive.CandidateExpr indType.type}
+    (run : CandidateExprSemanticRootRun env Us candidate source')
+    (validation : AddInductive.CandidateExprTrace.FamilyValidationRun
+      indType candidate.trace) : List VExpr :=
+  (VExpr.telN candidate.trace.spineLength run.view).take
+    validation.nparams
+
+/-- Candidate-view index binders following the validator-selected parameter
+prefix. -/
+def CandidateExprSemanticRootRun.viewIndices
+    {indType : InductiveType}
+    {candidate : AddInductive.CandidateExpr indType.type}
+    (run : CandidateExprSemanticRootRun env Us candidate source')
+    (validation : AddInductive.CandidateExprTrace.FamilyValidationRun
+      indType candidate.trace) : List VExpr :=
+  (VExpr.telN candidate.trace.spineLength run.view).drop
+    validation.nparams
+
+/-- An exact recursive run whose executable main spine preserves the stored
+binders. Unlike a whole-expression root equality, this package is strong
+enough to expose generation's pointwise binder and terminal-result evidence. -/
+def CandidateExprSpineRun (env : VEnv) (Us : List Name)
+    {source : Expr} (candidate : AddInductive.CandidateExpr source)
+    (raw view : VExpr) : Prop :=
+  candidate.trace.storedSpine = true ∧
+    ∃ inferred, CandidateExprRun env Us candidate.trace [] raw view inferred
+
+/-- Retaining the recursive semantic root makes the generation spine a direct
+projection once the executable structural gate has succeeded. -/
+theorem CandidateExprSemanticRootRun.spine
+    (run : CandidateExprSemanticRootRun env Us candidate source')
+    (storedSpine : candidate.trace.storedSpine = true) :
+    CandidateExprSpineRun env Us candidate source' run.view :=
+  ⟨storedSpine, run.recursive⟩
+
+/-- Turn an exact root translation and a recursive identity witness into the
+generation-ready spine package. The root equalities transport the recursive
+run out of the verifier's reconstructed context without choosing a different
+semantic endpoint. -/
+theorem CandidateExprRootRun.spineOfIdentity
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source} {source' : VExpr}
+    (run : CandidateExprRootRun env Us candidate source' source')
+    (identity : CandidateExprIdentity candidate.trace) :
+    CandidateExprSpineRun env Us candidate source' source' := by
+  refine ⟨identity.storedSpine, ?_⟩
+  have source_tr : run.contextRun.context.TrExprS source source' := by
+    simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+      run.vlctx_eq] using run.source_tr
+  obtain ⟨inferred', ⟨recursive⟩⟩ :=
+    CandidateExprRun.exists_ofIdentity candidate.trace identity
+      run.contextRun source' source_tr run.whnfFuel run.whnfDepth
+  refine ⟨inferred', ?_⟩
+  simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using recursive
+
+/-- Retain the exact recursive run selected by an identity-normalizing root.
+
+All data fields are inherited from the named root and its fixed Theory
+endpoint. The existential inferred type remains proof-only, so this constructor
+does not use classical choice and does not turn identity into an executable or
+semantic oracle. -/
+def CandidateExprRootRun.semanticOfIdentity
+    {env : VEnv} {Us : List Name} {source : Expr}
+    {candidate : AddInductive.CandidateExpr source} {source' : VExpr}
+    (run : CandidateExprRootRun env Us candidate source' source')
+    (identity : CandidateExprIdentity candidate.trace) :
+    CandidateExprSemanticRootRun env Us candidate source' where
+  contextRun := run.contextRun
+  venv_eq := run.venv_eq
+  lparams_eq := run.lparams_eq
+  vlctx_eq := run.vlctx_eq
+  source_tr := run.source_tr
+  whnfFuel := run.whnfFuel
+  whnfDepth := run.whnfDepth
+  view := source'
+  recursive := by
+    have source_tr : run.contextRun.context.TrExprS source source' := by
+      simpa only [VContext.TrExprS, run.venv_eq, run.lparams_eq,
+        run.vlctx_eq] using run.source_tr
+    obtain ⟨inferred, ⟨recursive⟩⟩ :=
+      CandidateExprRun.exists_ofIdentity candidate.trace identity
+        run.contextRun source' source_tr run.whnfFuel run.whnfDepth
+    refine ⟨inferred, ?_⟩
+    simpa only [run.venv_eq, run.lparams_eq, run.vlctx_eq] using recursive
+
+theorem CandidateExprSpineRun.evidence
+    (run : CandidateExprSpineRun env Us candidate raw view) :
+    ∃ resultType,
+      TelResultDefEqEvidence env Us.length []
+        (VExpr.telN candidate.trace.spineLength raw)
+        (VExpr.telN candidate.trace.spineLength view)
+        (VExpr.dropN candidate.trace.spineLength raw)
+        (VExpr.dropN candidate.trace.spineLength view) resultType := by
+  obtain ⟨aligned, _, recursive⟩ := run
+  exact recursive.spineEvidence aligned
+
+/-- Align extracted candidate components with named raw/view telescope and
+result data, then fix the terminal type from a checked right-endpoint typing
+judgment. All four alignment premises are syntactic equations. -/
+theorem CandidateExprSpineRun.evidenceAt
+    (run : CandidateExprSpineRun env Us candidate raw view)
+    (rawTel : VExpr.telN candidate.trace.spineLength raw = rawBinders)
+    (viewTel : VExpr.telN candidate.trace.spineLength view = viewBinders)
+    (rawResult_eq :
+      VExpr.dropN candidate.trace.spineLength raw = rawResult)
+    (viewResult_eq :
+      VExpr.dropN candidate.trace.spineLength view = viewResult)
+    (rightType : env.HasType Us.length rawBinders.reverse
+      viewResult expectedType) :
+    TelResultDefEqEvidence env Us.length [] rawBinders viewBinders
+      rawResult viewResult expectedType := by
+  obtain ⟨aligned, _, recursive⟩ := run
+  obtain ⟨resultType, evidence⟩ := recursive.spineEvidence aligned
+  have exactEvidence : TelResultDefEqEvidence env Us.length []
+      rawBinders viewBinders rawResult viewResult resultType := by
+    simpa only [rawTel, viewTel, rawResult_eq, viewResult_eq,
+      VLCtx.toCtx] using evidence
+  exact exactEvidence.ofRightType recursive.env_wf trivial (by
+    simpa using rightType)
+
+end TypeChecker
+
+namespace VInductDecl
+
+/-- A one-family normalization candidate validated by compositional verified
+normalization evidence at the kernel's two declaration stages.
+
+The family comparison runs in `env`. Constructor comparisons run in the exact
+`typeEnv` obtained by inserting the raw family constant. The positional
+`Forall₂` prevents a shorter checker-result list from certifying a declaration.
+-/
+structure NormalizationRun {source : VInductDecl}
+    (norm : Normalization source) (env : VEnv) where
+  raw : VInductiveType
+  view : VInductiveType
+  source_types_eq : source.types = [raw]
+  view_types_eq : norm.view.types = [view]
+  family : ∃ A,
+    TypeChecker.DefEqEvidence env source.uvars []
+      raw.type view.type A
+  typeEnv : VEnv
+  addType :
+    env.addConst raw.name raw.toVConstant = some typeEnv
+  constructors : List.Forall₂
+    (fun rawCtor viewCtor =>
+      ∃ A, TypeChecker.DefEqEvidence typeEnv source.uvars []
+        rawCtor.type viewCtor.type A)
+    raw.ctors view.ctors
+
+/-- Checker-validated family and constructor comparisons establish the
+semantic part of the raw/view normalization boundary. -/
+theorem NormalizationRun.wf
+    (run : NormalizationRun norm env) : norm.WF env := by
+  refine ⟨run.raw, run.view, run.source_types_eq, run.view_types_eq, ?_, ?_⟩
+  · obtain ⟨_, hfamily⟩ := run.family
+    exact hfamily.isDefEq.toU
+  · intro envT hadd
+    have henv : envT = run.typeEnv := by
+      have : some envT = some run.typeEnv := hadd.symm.trans run.addType
+      exact Option.some.inj this
+    subst envT
+    exact Ix.Theory.Named.List.Forall₂.imp (h := run.constructors) fun _ _ h => by
+      obtain ⟨_, hctor⟩ := h
+      exact hctor.isDefEq.toU
+
+/-- Checker-validated normalization for an arbitrary mutual block.
+
+Family equalities are interpreted in the common pre-family environment.  The
+raw family constants are then staged as one exact source-ordered fold, and
+all constructor equalities are interpreted in the resulting shared block
+environment. -/
+structure NormalizationBlockRun {source : VInductDecl}
+    (norm : Normalization source) (env blockEnv : VEnv) where
+  stage : env.stageInductiveTypes source.types = some blockEnv
+  families : List.Forall₂
+    (fun raw view =>
+      (∃ A, TypeChecker.DefEqEvidence env source.uvars []
+        raw.type view.type A) ∧
+      List.Forall₂
+        (fun rawCtor viewCtor =>
+          ∃ A, TypeChecker.DefEqEvidence blockEnv source.uvars []
+            rawCtor.type viewCtor.type A)
+        raw.ctors view.ctors)
+    source.types norm.view.types
+
+/-- The verified checker interpretation discharges the complete Theory
+mutual-normalization contract without a singleton projection. -/
+theorem NormalizationBlockRun.wf
+    (run : NormalizationBlockRun norm env blockEnv) :
+    norm.BlockWF env blockEnv := by
+  refine ⟨run.stage, ?_⟩
+  exact Ix.Theory.Named.List.Forall₂.imp (h := run.families) fun _ _ h => by
+    refine ⟨h.1.choose_spec.isDefEq.toU, ?_⟩
+    exact Ix.Theory.Named.List.Forall₂.imp (h := h.2) fun _ _ hctor =>
+      hctor.choose_spec.isDefEq.toU
+
+/-- One constructor candidate tied to the corresponding raw Theory constant.
+Its expression payload may normalize, but its name, universe arity, and exact
+source position remain fixed. -/
+structure CandidateConstructorRun (env : VEnv) (Us : List Name)
+    {source : Constructor}
+    (candidate : AddInductive.CandidateConstructor source)
+    (raw : VConstVal) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  viewType : VExpr
+  typeRun : TypeChecker.CandidateExprRootRun env Us candidate.type
+    raw.type viewType
+
+/-- Replace only the expression payload certified by the constructor run. -/
+def CandidateConstructorRun.view
+    (run : CandidateConstructorRun env Us candidate raw) : VConstVal :=
+  { raw with type := run.viewType }
+
+/-- Exact positional certification for a source-indexed constructor list and
+the raw Theory constructor list. Unlike `zip`, this type cannot truncate a
+longer side or reuse evidence at a different source position. -/
+inductive CandidateConstructorListRun (env : VEnv) (Us : List Name) :
+    {sources : List Constructor} →
+      AddInductive.CandidateList AddInductive.CandidateConstructor sources →
+      List VConstVal → Type where
+  | nil : CandidateConstructorListRun env Us .nil []
+  | cons
+      (head : CandidateConstructorRun env Us candidate raw)
+      (tail : CandidateConstructorListRun env Us candidates raws) :
+      CandidateConstructorListRun env Us
+        (.cons candidate candidates) (raw :: raws)
+
+/-- The exact normalized constructor list retained by a positional run. -/
+def CandidateConstructorListRun.views :
+    CandidateConstructorListRun env Us candidates raws → List VConstVal
+  | .nil => []
+  | .cons head tail => head.view :: tail.views
+
+/-- Positional certification preserves every constructor header. -/
+theorem CandidateConstructorListRun.sameHeaders
+    (run : CandidateConstructorListRun env Us candidates raws) :
+    sameCtorHeaders raws run.views = true := by
+  induction run with
+  | nil => rfl
+  | cons head tail ih =>
+    simp [CandidateConstructorListRun.views,
+      CandidateConstructorRun.view, sameCtorHeaders, ih]
+
+/-- Collect the exact checker-produced equality for every positional raw/view
+constructor pair. -/
+theorem CandidateConstructorListRun.evidence
+    (run : CandidateConstructorListRun env Us candidates raws) :
+    List.Forall₂
+      (fun raw view => ∃ A,
+        TypeChecker.DefEqEvidence env Us.length []
+          raw.type view.type A)
+      raws run.views := by
+  induction run with
+  | nil => exact .nil
+  | cons head tail ih =>
+    exact .cons head.typeRun.evidence ih
+
+/-- One family candidate certified in the input environment, together with
+all of its constructors certified in the exact environment obtained by
+inserting the raw family constant. -/
+structure CandidateFamilyRun (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.CandidateFamily source)
+    (raw : VInductiveType) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  viewType : VExpr
+  typeRun : TypeChecker.CandidateExprRootRun env Us
+    candidate.familyType.type raw.type viewType
+  typeEnv : VEnv
+  addType : env.addConst raw.name raw.toVConstant = some typeEnv
+  constructors : CandidateConstructorListRun typeEnv Us
+    candidate.constructors raw.ctors
+
+/-- Replace only the family and constructor expression payloads named by the
+certified candidate runs. -/
+def CandidateFamilyRun.view
+    (run : CandidateFamilyRun env Us candidate raw) : VInductiveType :=
+  { raw with
+    type := run.viewType
+    ctors := run.constructors.views }
+
+/-- Exact singleton candidate-list certification against one raw Theory
+declaration. The singleton kernel-source index rules out partial selection of
+a family candidate, and `raw_types_eq` rules out partial selection of a Theory
+family. Mutual blocks remain an explicit later generalization. -/
+structure NormalizationCandidateRun (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  raw : VInductiveType
+  raw_types_eq : rawDecl.types = [raw]
+  uvars_eq : rawDecl.uvars = Us.length
+  family : CandidateFamilyRun env Us candidate.families.singleton raw
+
+/-- The Theory declaration obtained from the exact singleton candidate. -/
+def NormalizationCandidateRun.viewDecl
+    (run : NormalizationCandidateRun env Us candidate rawDecl) :
+    VInductDecl :=
+  { rawDecl with types := [run.family.view] }
+
+/-- Candidate-list shape evidence is sufficient to construct the Theory
+normalization boundary without `head!`, unchecked `zip`, or an arbitrary view
+declaration supplied separately from the candidate. -/
+def NormalizationCandidateRun.normalization
+    (run : NormalizationCandidateRun env Us candidate rawDecl) :
+    Normalization rawDecl where
+  view := run.viewDecl
+  shape_eq := by
+    simp only [normalizationShape, NormalizationCandidateRun.viewDecl,
+      run.raw_types_eq, beq_self_eq_true, Bool.true_and, sameTypeHeaders,
+      CandidateFamilyRun.view]
+    simp [run.family.constructors.sameHeaders]
+
+/-- Assemble the existing semantic normalization certificate from the exact
+family and constructor candidate runs. -/
+def NormalizationCandidateRun.normalizationRun
+    (run : NormalizationCandidateRun env Us candidate rawDecl) :
+    NormalizationRun run.normalization env where
+  raw := run.raw
+  view := run.family.view
+  source_types_eq := run.raw_types_eq
+  view_types_eq := rfl
+  family := by
+    simpa only [run.uvars_eq, CandidateFamilyRun.view] using
+      run.family.typeRun.evidence
+  typeEnv := run.family.typeEnv
+  addType := run.family.addType
+  constructors := by
+    simpa only [run.uvars_eq, CandidateFamilyRun.view] using
+      run.family.constructors.evidence
+
+/-- One constructor whose exact recursive candidate semantics are retained,
+rather than reconstructed separately for normalization and generation.
+
+The header remains indexed by the kernel source and raw Theory constant. The
+semantic root owns the checker-selected view, its inferred type, and the
+recursive run used by both downstream phases. -/
+structure CandidateConstructorSemanticRun (env : VEnv) (Us : List Name)
+    {source : Constructor}
+    (candidate : AddInductive.CandidateConstructor source)
+    (raw : VConstVal) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprSemanticRootRun env Us candidate.type
+    raw.type
+
+/-- Project the normalization-facing constructor root without losing its
+source or position indices. -/
+def CandidateConstructorSemanticRun.root
+    (run : CandidateConstructorSemanticRun env Us candidate raw) :
+    CandidateConstructorRun env Us candidate raw where
+  name_eq := run.name_eq
+  uvars_eq := run.uvars_eq
+  viewType := run.type.view
+  typeRun := run.type.root
+
+/-- Exact positional semantic ownership for an arbitrary constructor list.
+Every element retains the recursive run selected at that source position; the
+list cannot truncate, reorder, or reuse a run for another constructor. -/
+inductive CandidateConstructorSemanticListRun
+    (env : VEnv) (Us : List Name) :
+    {sources : List Constructor} →
+      AddInductive.CandidateList AddInductive.CandidateConstructor sources →
+      List VConstVal → Type where
+  | nil : CandidateConstructorSemanticListRun env Us .nil []
+  | cons
+      (head : CandidateConstructorSemanticRun env Us candidate raw)
+      (tail : CandidateConstructorSemanticListRun env Us candidates raws) :
+      CandidateConstructorSemanticListRun env Us
+        (.cons candidate candidates) (raw :: raws)
+
+/-- Forget only the retained recursive-run payload and recover the existing
+normalization-facing positional list. -/
+def CandidateConstructorSemanticListRun.roots :
+    CandidateConstructorSemanticListRun env Us candidates raws →
+      CandidateConstructorListRun env Us candidates raws
+  | .nil => .nil
+  | .cons head tail => .cons head.root tail.roots
+
+/-- One family in a mutual normalization candidate.  Its type is interpreted
+in the common pre-family environment, while every constructor is interpreted
+in the single environment obtained after staging the complete raw family
+block. -/
+structure CandidateBlockFamilySemanticRun
+    (env blockEnv : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.CandidateFamily source)
+    (raw : VInductiveType) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprSemanticRootRun env Us
+    candidate.familyType.type raw.type
+  constructors : CandidateConstructorSemanticListRun blockEnv Us
+    candidate.constructors raw.ctors
+
+/-- Replace only the expression payloads selected by the retained checker
+runs; all family and constructor headers remain raw and source-indexed. -/
+def CandidateBlockFamilySemanticRun.view
+    (run : CandidateBlockFamilySemanticRun env blockEnv Us candidate raw) :
+    VInductiveType :=
+  { raw with
+    type := run.type.view
+    ctors := run.constructors.roots.views }
+
+/-- Exact source-order semantic ownership for every family in an arbitrary
+block.  Both the kernel candidate list and raw Theory list are indices, so
+family reordering and truncation are unrepresentable. -/
+inductive CandidateBlockFamilySemanticListRun
+    (env blockEnv : VEnv) (Us : List Name) :
+    {sources : List InductiveType} →
+      AddInductive.CandidateList AddInductive.CandidateFamily sources →
+      List VInductiveType → Type where
+  | nil : CandidateBlockFamilySemanticListRun env blockEnv Us .nil []
+  | cons
+      (head : CandidateBlockFamilySemanticRun env blockEnv Us candidate raw)
+      (tail : CandidateBlockFamilySemanticListRun env blockEnv Us
+        candidates raws) :
+      CandidateBlockFamilySemanticListRun env blockEnv Us
+        (.cons candidate candidates) (raw :: raws)
+
+/-- Exact normalized family views in source order. -/
+def CandidateBlockFamilySemanticListRun.views :
+    CandidateBlockFamilySemanticListRun env blockEnv Us candidates raws →
+      List VInductiveType
+  | .nil => []
+  | .cons head tail => head.view :: tail.views
+
+/-- Block semantic runs preserve every family and constructor header. -/
+theorem CandidateBlockFamilySemanticListRun.sameHeaders
+    (run : CandidateBlockFamilySemanticListRun env blockEnv Us
+      candidates raws) :
+    sameTypeHeaders raws run.views = true := by
+  induction run with
+  | nil => rfl
+  | cons head tail ih =>
+    simp [CandidateBlockFamilySemanticListRun.views,
+      CandidateBlockFamilySemanticRun.view, sameTypeHeaders,
+      head.constructors.roots.sameHeaders, ih]
+
+/-- Collect the exact family/constructor definitional equalities selected by
+the retained semantic checker hierarchy. -/
+theorem CandidateBlockFamilySemanticListRun.evidence
+    (run : CandidateBlockFamilySemanticListRun env blockEnv Us
+      candidates raws) :
+    List.Forall₂
+      (fun raw view =>
+        (∃ A, TypeChecker.DefEqEvidence env Us.length []
+          raw.type view.type A) ∧
+        List.Forall₂
+          (fun rawCtor viewCtor =>
+            ∃ A, TypeChecker.DefEqEvidence blockEnv Us.length []
+              rawCtor.type viewCtor.type A)
+          raw.ctors view.ctors)
+      raws run.views := by
+  induction run with
+  | nil => exact .nil
+  | cons head tail ih =>
+    exact .cons
+      ⟨head.type.root.evidence, head.constructors.roots.evidence⟩ ih
+
+/-- Complete semantic ownership for an arbitrary normalization candidate.
+The raw staging equation and dependent family list share the same exact raw
+declaration; no independently supplied normalized declaration is accepted. -/
+structure NormalizationCandidateBlockSemanticRun
+    (env blockEnv : VEnv) (Us : List Name)
+    {sources : List InductiveType}
+    (candidate : AddInductive.NormalizationCandidate sources)
+    (rawDecl : VInductDecl) where
+  uvars_eq : rawDecl.uvars = Us.length
+  stage : env.stageInductiveTypes rawDecl.types = some blockEnv
+  families : CandidateBlockFamilySemanticListRun env blockEnv Us
+    candidate.families rawDecl.types
+
+/-- Theory declaration selected by the exact block semantic hierarchy. -/
+def NormalizationCandidateBlockSemanticRun.viewDecl
+    (run : NormalizationCandidateBlockSemanticRun env blockEnv Us
+      candidate rawDecl) : VInductDecl :=
+  { rawDecl with types := run.families.views }
+
+/-- Construct the header-preserving Theory normalization boundary selected by
+the candidate semantic hierarchy. -/
+def NormalizationCandidateBlockSemanticRun.normalization
+    (run : NormalizationCandidateBlockSemanticRun env blockEnv Us
+      candidate rawDecl) : Normalization rawDecl where
+  view := run.viewDecl
+  shape_eq := by
+    simp only [normalizationShape,
+      NormalizationCandidateBlockSemanticRun.viewDecl,
+      beq_self_eq_true, Bool.true_and]
+    exact run.families.sameHeaders
+
+/-- Project the generic verified normalization run for the same raw block and
+shared staged environment. -/
+theorem NormalizationCandidateBlockSemanticRun.normalizationRun
+    (run : NormalizationCandidateBlockSemanticRun env blockEnv Us
+      candidate rawDecl) :
+    NormalizationBlockRun run.normalization env blockEnv where
+  stage := run.stage
+  families := by
+    simpa only [run.uvars_eq,
+      NormalizationCandidateBlockSemanticRun.normalization,
+      NormalizationCandidateBlockSemanticRun.viewDecl] using
+      run.families.evidence
+
+/-- A singleton-family semantic hierarchy spanning the pre-family candidate,
+the exact raw-family insertion, and every post-family constructor candidate.
+The normalized expression payloads are selected by retained recursive checker
+runs, not by a parallel caller-supplied declaration. -/
+structure CandidateFamilySemanticRun (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.CandidateFamily source)
+    (raw : VInductiveType) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprSemanticRootRun env Us
+    candidate.familyType.type raw.type
+  typeEnv : VEnv
+  addType : env.addConst raw.name raw.toVConstant = some typeEnv
+  constructors : CandidateConstructorSemanticListRun typeEnv Us
+    candidate.constructors raw.ctors
+
+/-- Project the existing normalization-facing family run from the retained
+semantic hierarchy. -/
+def CandidateFamilySemanticRun.root
+    (run : CandidateFamilySemanticRun env Us candidate raw) :
+    CandidateFamilyRun env Us candidate raw where
+  name_eq := run.name_eq
+  uvars_eq := run.uvars_eq
+  viewType := run.type.view
+  typeRun := run.type.root
+  typeEnv := run.typeEnv
+  addType := run.addType
+  constructors := run.constructors.roots
+
+/-- Complete retained semantic ownership for one source-indexed singleton
+normalization candidate. This is the generic bridge from translated family and
+constructor candidates to `NormalizationCandidateRun`; mutual blocks remain a
+later indexed generalization. -/
+structure NormalizationCandidateSemanticRun (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  raw : VInductiveType
+  raw_types_eq : rawDecl.types = [raw]
+  uvars_eq : rawDecl.uvars = Us.length
+  family : CandidateFamilySemanticRun env Us candidate.families.singleton raw
+
+/-- Recover the existing normalization candidate from the retained semantic
+hierarchy. -/
+def NormalizationCandidateSemanticRun.root
+    (run : NormalizationCandidateSemanticRun env Us candidate rawDecl) :
+    NormalizationCandidateRun env Us candidate rawDecl where
+  raw := run.raw
+  raw_types_eq := run.raw_types_eq
+  uvars_eq := run.uvars_eq
+  family := run.family.root
+
+/-- Pre-run semantic evidence for one source-indexed constructor.  Its header
+is aligned with the raw Theory constant, while the expression input contains
+only the verified context and strict source translation needed to let the
+retained checker choose the view. -/
+structure CandidateConstructorSemanticInput (env : VEnv) (Us : List Name)
+    {source : Constructor}
+    (candidate : AddInductive.CandidateConstructor source)
+    (raw : VConstVal) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprSemanticRootInput env Us candidate.type
+    raw.type
+
+/-- Interpret one constructor input without selecting its view at the call
+site. -/
+theorem CandidateConstructorSemanticInput.exists
+    (input : CandidateConstructorSemanticInput env Us candidate raw) :
+    Nonempty (CandidateConstructorSemanticRun env Us candidate raw) := by
+  obtain ⟨type⟩ := input.type.exists
+  exact ⟨{
+    name_eq := input.name_eq
+    uvars_eq := input.uvars_eq
+    type := type }⟩
+
+/-- Exact source-order semantic inputs for an arbitrary constructor list.
+Unlike a pointwise predicate over erased lists, these indices prevent an input
+from being reused at another constructor or from silently truncating either
+side. -/
+inductive CandidateConstructorSemanticListInput
+    (env : VEnv) (Us : List Name) :
+    {sources : List Constructor} →
+      AddInductive.CandidateList AddInductive.CandidateConstructor sources →
+      List VConstVal → Type where
+  | nil : CandidateConstructorSemanticListInput env Us .nil []
+  | cons
+      (head : CandidateConstructorSemanticInput env Us candidate raw)
+      (tail : CandidateConstructorSemanticListInput env Us candidates raws) :
+      CandidateConstructorSemanticListInput env Us
+        (.cons candidate candidates) (raw :: raws)
+
+/-- Recursively interpret every source-indexed constructor input. -/
+theorem CandidateConstructorSemanticListInput.exists
+    (input : CandidateConstructorSemanticListInput env Us candidates raws) :
+    Nonempty (CandidateConstructorSemanticListRun env Us candidates raws) := by
+  induction input with
+  | nil => exact ⟨.nil⟩
+  | cons head tail ih =>
+    obtain ⟨headRun⟩ := head.exists
+    obtain ⟨tailRun⟩ := ih
+    exact ⟨.cons headRun tailRun⟩
+
+/-- Pre-run semantic evidence for one family in a shared mutual stage.
+Family types use `env`; all constructor types use the same `blockEnv` after
+every raw family has been staged. -/
+structure CandidateBlockFamilySemanticInput
+    (env blockEnv : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.CandidateFamily source)
+    (raw : VInductiveType) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprSemanticRootInput env Us
+    candidate.familyType.type raw.type
+  constructors : CandidateConstructorSemanticListInput blockEnv Us
+    candidate.constructors raw.ctors
+
+/-- Interpret one family and its complete constructor list without selecting
+a normalized expression at the call site. -/
+theorem CandidateBlockFamilySemanticInput.exists
+    (input : CandidateBlockFamilySemanticInput env blockEnv Us
+      candidate raw) :
+    Nonempty (CandidateBlockFamilySemanticRun env blockEnv Us
+      candidate raw) := by
+  obtain ⟨type⟩ := input.type.exists
+  obtain ⟨constructors⟩ := input.constructors.exists
+  exact ⟨{
+    name_eq := input.name_eq
+    uvars_eq := input.uvars_eq
+    type
+    constructors }⟩
+
+/-- Exact source-order semantic inputs for every family in a mutual block. -/
+inductive CandidateBlockFamilySemanticListInput
+    (env blockEnv : VEnv) (Us : List Name) :
+    {sources : List InductiveType} →
+      AddInductive.CandidateList AddInductive.CandidateFamily sources →
+      List VInductiveType → Type where
+  | nil : CandidateBlockFamilySemanticListInput env blockEnv Us .nil []
+  | cons
+      (head : CandidateBlockFamilySemanticInput env blockEnv Us candidate raw)
+      (tail : CandidateBlockFamilySemanticListInput env blockEnv Us
+        candidates raws) :
+      CandidateBlockFamilySemanticListInput env blockEnv Us
+        (.cons candidate candidates) (raw :: raws)
+
+/-- Interpret every family and constructor input in lockstep. -/
+theorem CandidateBlockFamilySemanticListInput.exists
+    (input : CandidateBlockFamilySemanticListInput env blockEnv Us
+      candidates raws) :
+    Nonempty (CandidateBlockFamilySemanticListRun env blockEnv Us
+      candidates raws) := by
+  induction input with
+  | nil => exact ⟨.nil⟩
+  | cons head tail ih =>
+    obtain ⟨headRun⟩ := head.exists
+    obtain ⟨tailRun⟩ := ih
+    exact ⟨.cons headRun tailRun⟩
+
+/-- Complete verified semantic input for an arbitrary normalization
+candidate.  The exact raw family list owns both the all-family staging fold and
+the dependent family interpretation, ruling out a reordered staging witness. -/
+structure NormalizationCandidateBlockSemanticInput
+    (env blockEnv : VEnv) (Us : List Name)
+    {sources : List InductiveType}
+    (candidate : AddInductive.NormalizationCandidate sources)
+    (rawDecl : VInductDecl) where
+  uvars_eq : rawDecl.uvars = Us.length
+  stage : env.stageInductiveTypes rawDecl.types = some blockEnv
+  families : CandidateBlockFamilySemanticListInput env blockEnv Us
+    candidate.families rawDecl.types
+
+/-- Automatically interpret the complete mutual semantic hierarchy. -/
+theorem NormalizationCandidateBlockSemanticInput.exists
+    (input : NormalizationCandidateBlockSemanticInput env blockEnv Us
+      candidate rawDecl) :
+    Nonempty (NormalizationCandidateBlockSemanticRun env blockEnv Us
+      candidate rawDecl) := by
+  obtain ⟨families⟩ := input.families.exists
+  exact ⟨{
+    uvars_eq := input.uvars_eq
+    stage := input.stage
+    families }⟩
+
+/-- A mutual semantic hierarchy paired with the exact arbitrary-length
+producer traversals that selected the same dependent candidate. -/
+structure ProducedNormalizationCandidateBlockSemanticRun
+    (familyContext constructorContext : AddInductive.Context)
+    (env blockEnv : VEnv) (Us : List Name)
+    {sources : List InductiveType}
+    (candidate : AddInductive.NormalizationCandidate sources)
+    (rawDecl : VInductDecl) where
+  semantic : NormalizationCandidateBlockSemanticRun env blockEnv Us
+    candidate rawDecl
+  familyTypesProduced : AddInductive.CandidateFamilyTypeListProduced
+    familyContext candidate.families.familyTypes
+  familiesProduced : AddInductive.CandidateFamilyListProduced
+    constructorContext candidate.families.familyTypes candidate.families
+
+/-- Combine verified semantic inputs with exact producer provenance for the
+same source-indexed mutual candidate. -/
+theorem NormalizationCandidateBlockSemanticInput.exists_ofProduced
+    (input : NormalizationCandidateBlockSemanticInput env blockEnv Us
+      candidate rawDecl)
+    (familyTypesProduced : AddInductive.CandidateFamilyTypeListProduced
+      familyContext candidate.families.familyTypes)
+    (familiesProduced : AddInductive.CandidateFamilyListProduced
+      constructorContext candidate.families.familyTypes candidate.families) :
+    Nonempty (ProducedNormalizationCandidateBlockSemanticRun
+      familyContext constructorContext env blockEnv Us candidate rawDecl) := by
+  obtain ⟨semantic⟩ := input.exists
+  exact ⟨{
+    semantic
+    familyTypesProduced
+    familiesProduced }⟩
+
+/-- One validated singleton family stage derived from a verified entry
+candidate context and the exact kernel/Theory family insertion.
+
+The family validator selects the parameter/index split and terminal sort. The
+retained candidate semantics then prove the raw family constant well formed;
+that proof extends the entry `TrEnv` and constructs the post-family verifier
+context. No independently verified post-family `VEnvs` is an input. -/
+structure CandidateFamilyStagedInput
+    (familyContext constructorContext : AddInductive.Context)
+    (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.CandidateFamilyType source)
+    (raw : VInductiveType)
+    (preFamily : TypeChecker.CandidateSemanticStage familyContext env Us)
+    where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprStagedInput preFamily
+    candidate.type raw.type
+  validation : AddInductive.CandidateExprTrace.FamilyValidationRun
+    source candidate.type.trace
+  typeEnv : VEnv
+  addInduct : AddInductConstant .induct familyContext.env.constants env
+    raw.toVConstVal constructorContext.env.constants typeEnv
+  /-- The staged family environment has not yet completed a new projection
+  artifact; any already-complete host structure remains backed by a registered
+  Theory view. -/
+  projectionReady : ProjectionReady constructorContext.env typeEnv
+  structureEtaReady : StructureEtaReady constructorContext.env typeEnv
+  family_lctx_eq : familyContext.lctx = {}
+  constructorContext_eq : constructorContext =
+    { familyContext with env := constructorContext.env }
+  quotInit_eq : constructorContext.env.quotInit =
+    familyContext.env.quotInit
+  name_not_reflected : raw.name ∉ VEnv.reflectedPrimitiveNames
+  name_not_primitive :
+    Environment.primitives.contains raw.name = false
+
+/-- Family validation plus retained candidate semantics prove the exact raw
+Theory constant suitable for insertion. The semantic view remains hidden
+under `Nonempty`; elimination is only into this proposition. -/
+theorem CandidateFamilyStagedInput.rawWF
+    (input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily) :
+    raw.toVConstant.WF env := by
+  obtain ⟨semantic⟩ := input.type.rootInput.exists
+  show env.IsType raw.uvars [] raw.type
+  simpa only [input.uvars_eq] using
+    semantic.source_isType_of_terminalSort input.validation.terminal_eq
+
+/-- The verifier context after inserting the validated raw family constant.
+Primitive reflection and safety are preserved because the new family name is
+not a kernel or reflected primitive. -/
+def CandidateFamilyStagedInput.postContext
+    (input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily) : TypeChecker.VContext where
+  env := constructorContext.env
+  lctx := constructorContext.lctx
+  lparams := constructorContext.lparams
+  safety := constructorContext.safety
+  fuel := constructorContext.fuel
+  venv := input.typeEnv
+  hasPrimitives := by
+    have H : env.HasPrimitives := by
+      simpa only [preFamily.venv_eq] using
+        preFamily.contextRun.context.hasPrimitives
+    exact VEnv.HasPrimitives.addConst H
+      input.name_not_reflected input.addInduct.env_add
+  safePrimitives := by
+    intro n ci
+    have preMapWF : familyContext.env.constants.WF := by
+      simpa only [preFamily.contextRun.context_env] using
+        preFamily.contextRun.context.trenv.map_wf
+    exact TypeChecker.AddInductConstant.safePrimitives input.addInduct
+      (n := n) (ci := ci) preMapWF (fun hfind hprim => by
+        apply preFamily.contextRun.context.safePrimitives
+        · simpa only [preFamily.contextRun.context_env] using hfind
+        · exact hprim)
+      input.name_not_primitive
+  trenv := by
+    have preTr : TrEnv' familyContext.safety familyContext.env.constants
+        familyContext.env.quotInit env := by
+      simpa only [TrEnv, preFamily.contextRun.context_safety,
+        preFamily.contextRun.context_env, preFamily.venv_eq] using
+        preFamily.contextRun.context.trenv
+    have postTr := TrEnv'.inductStaging input.addInduct input.rawWF preTr
+    change TrEnv' constructorContext.safety constructorContext.env.constants
+      constructorContext.env.quotInit input.typeEnv
+    rw [show constructorContext.safety = familyContext.safety by
+      rw [input.constructorContext_eq]]
+    rw [input.quotInit_eq]
+    exact postTr
+  projectionReady := input.projectionReady
+  structureEtaReady := input.structureEtaReady
+  mlctx := .nil
+  mlctx_wf := trivial
+  lctx_eq := by
+    change ({} : LocalContext) = constructorContext.lctx
+    rw [input.constructorContext_eq, input.family_lctx_eq]
+
+/-- The exact post-family candidate context constructed from family
+validation, rather than supplied by a second verifier setup. -/
+def CandidateFamilyStagedInput.postContextRun
+    (input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily) :
+    TypeChecker.CandidateContextRun constructorContext :=
+  TypeChecker.CandidateContextRun.ofVContext constructorContext
+    input.postContext (by rfl)
+    (TypeChecker.VState.WF.empty_of_reserves input.postContext (by
+      intro fv hfv
+      change fv ∈ VLCtx.fvars ([] : VLCtx) at hfv
+      simp at hfv))
+    (by
+      rw [input.constructorContext_eq]
+      exact preFamily.contextRun.namePrefix_ne)
+
+/-- Shared post-family semantic stage consumed by every constructor position.
+Its implementation and Theory environments are fixed by the exact family
+insertion above. -/
+def CandidateFamilyStagedInput.postFamily
+    (input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily) :
+    TypeChecker.CandidateSemanticStage constructorContext input.typeEnv Us where
+  contextRun := input.postContextRun
+  venv_eq := rfl
+  lparams_eq := by
+    rw [TypeChecker.CandidateContextRun.context_lparams]
+    calc
+      constructorContext.lparams = familyContext.lparams := by
+        rw [input.constructorContext_eq]
+      _ = preFamily.contextRun.context.lparams :=
+        preFamily.contextRun.context_lparams.symm
+      _ = Us := preFamily.lparams_eq
+  vlctx_eq := rfl
+
+/-- Recover the exact verified pre-family context at the end of the family
+telescope.
+
+Constructor validation starts from this local telescope after changing only
+the kernel/Theory environment to the staged post-family pair.  D3 reuses the
+pre-change context to replay family-free constructor checks; no local
+declaration or fresh identifier is reconstructed. -/
+theorem CandidateFamilyStagedInput.preValidationContextRun
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.CandidateFamilyType source}
+    {raw : VInductiveType}
+    {preFamily : TypeChecker.CandidateSemanticStage familyContext env Us}
+    (_input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily)
+    (semantic : TypeChecker.CandidateExprSemanticRootRun env Us
+      candidate.type raw.type) :
+    ∃ preRun : TypeChecker.CandidateContextRun
+        candidate.type.trace.terminalContext,
+      preRun.context.venv = env ∧
+      preRun.context.lparams = Us := by
+  obtain ⟨inferred, recursive⟩ := semantic.recursive
+  exact recursive.terminalContextRun semantic.contextRun semantic.venv_eq
+    semantic.lparams_eq semantic.vlctx_eq
+
+/-- Rebuild the verified constructor-validation context from the exact
+pre-family terminal context run.
+
+The returned run preserves the implementation local context definitionally;
+only the kernel/Theory environment and the primitive evidence are changed to
+the staged post-family pair. -/
+theorem CandidateFamilyStagedInput.validationContextRunFromPre
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.CandidateFamilyType source}
+    {raw : VInductiveType}
+    {preFamily : TypeChecker.CandidateSemanticStage familyContext env Us}
+    (input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily)
+    (terminalRun : TypeChecker.CandidateContextRun
+      candidate.type.trace.terminalContext)
+    (terminalVenv : terminalRun.context.venv = env)
+    (terminalLparams : terminalRun.context.lparams = Us) :
+    ∃ validationRun : TypeChecker.CandidateContextRun
+        { candidate.type.trace.terminalContext with
+          env := constructorContext.env },
+      validationRun.context.venv = input.typeEnv ∧
+      validationRun.context.lparams = Us ∧
+      validationRun.context.vlctx = terminalRun.context.vlctx := by
+  have terminalMLWF : terminalRun.context.mlctx.WF env Us := by
+    simpa only [terminalVenv, terminalLparams] using
+      terminalRun.context.mlctx_wf
+  have postMLWF : terminalRun.context.mlctx.WF input.typeEnv Us :=
+    terminalMLWF.mono (VEnv.addConst_le input.addInduct.env_add)
+  have validationSafety : terminalRun.context.safety =
+      input.postContext.safety := by
+    calc
+      terminalRun.context.safety =
+          candidate.type.trace.terminalContext.safety :=
+        terminalRun.context_safety
+      _ = candidate.type.context.safety :=
+        candidate.type.trace.terminalContext_safety
+      _ = familyContext.safety := by rw [input.type.context_eq]
+      _ = constructorContext.safety := by rw [input.constructorContext_eq]
+      _ = input.postContext.safety := rfl
+  let validationContext : TypeChecker.VContext :=
+    { terminalRun.context with
+      env := constructorContext.env
+      venv := input.typeEnv
+      hasPrimitives := input.postContext.hasPrimitives
+      safePrimitives := input.postContext.safePrimitives
+      trenv := by
+        have postEnv : input.postContext.env = constructorContext.env := rfl
+        have postVenv : input.postContext.venv = input.typeEnv := rfl
+        simpa only [validationSafety, postEnv, postVenv] using
+          input.postContext.trenv
+      projectionReady := input.postContext.projectionReady
+      structureEtaReady := input.postContext.structureEtaReady
+      mlctx_wf := by
+        simpa only [terminalLparams] using postMLWF }
+  have validationContextEq : validationContext.toContext =
+      ({ candidate.type.trace.terminalContext with
+        env := constructorContext.env } : AddInductive.Context).toTypeChecker := by
+    calc
+      validationContext.toContext =
+          { terminalRun.context.toContext with
+            env := constructorContext.env } := rfl
+      _ = { candidate.type.trace.terminalContext.toTypeChecker with
+            env := constructorContext.env } :=
+        congrArg (fun c : TypeChecker.Context =>
+          { c with env := constructorContext.env }) terminalRun.context_eq
+      _ = ({ candidate.type.trace.terminalContext with
+          env := constructorContext.env } : AddInductive.Context).toTypeChecker :=
+        rfl
+  let validationRun : TypeChecker.CandidateContextRun
+      { candidate.type.trace.terminalContext with
+        env := constructorContext.env } :=
+    TypeChecker.CandidateContextRun.ofVContext _ validationContext
+      validationContextEq
+      (TypeChecker.VState.WF.empty_of_reserves validationContext (by
+        intro fv hfv
+        exact terminalRun.state_wf.ngen_wf fv (by
+          simpa only [validationContext] using hfv)))
+      terminalRun.namePrefix_ne
+  exact ⟨validationRun, rfl, terminalLparams, rfl⟩
+
+/-- Rebuild the verified context in which constructor validation actually
+runs.
+
+Family candidates are interpreted before the raw family is inserted, so the
+recursive run reaches the correct local telescope in the pre-family Theory
+environment.  Constructor validation keeps that exact implementation local
+context while replacing only the kernel/Theory environment with the staged
+post-family pair.  Monotonicity of local-context verification justifies that
+replacement; no local declaration, free-variable identifier, or binder order
+is regenerated. -/
+theorem CandidateFamilyStagedInput.validationContextRun
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.CandidateFamilyType source}
+    {raw : VInductiveType}
+    {preFamily : TypeChecker.CandidateSemanticStage familyContext env Us}
+    (input : CandidateFamilyStagedInput familyContext constructorContext
+      env Us candidate raw preFamily)
+    (semantic : TypeChecker.CandidateExprSemanticRootRun env Us
+      candidate.type raw.type) :
+    ∃ validationRun : TypeChecker.CandidateContextRun
+        { candidate.type.trace.terminalContext with
+          env := constructorContext.env },
+      validationRun.context.venv = input.typeEnv ∧
+      validationRun.context.lparams = Us := by
+  obtain ⟨terminalRun, terminalVenv, terminalLparams⟩ :=
+    input.preValidationContextRun semantic
+  obtain ⟨validationRun, validationVenv, validationLparams, _⟩ :=
+    input.validationContextRunFromPre terminalRun terminalVenv terminalLparams
+  exact ⟨validationRun, validationVenv, validationLparams⟩
+
+/-- One source-indexed constructor interpreted in the shared post-family
+stage. Header equality and universe alignment stay attached to the exact raw
+constructor position; the expression payload contains no independently
+verified context and no caller-selected semantic view. -/
+structure CandidateConstructorStagedInput
+    {candidateContext : AddInductive.Context} {env : VEnv} {Us : List Name}
+    (stage : TypeChecker.CandidateSemanticStage candidateContext env Us)
+    {source : Constructor}
+    (candidate : AddInductive.CandidateConstructor source)
+    (raw : VConstVal) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprStagedInput stage candidate.type raw.type
+
+/-- Forget only the shared-stage presentation and recover the established
+constructor semantic input. -/
+def CandidateConstructorStagedInput.semanticInput
+    {candidateContext : AddInductive.Context} {env : VEnv} {Us : List Name}
+    {source : Constructor}
+    {candidate : AddInductive.CandidateConstructor source}
+    {raw : VConstVal}
+    {stage : TypeChecker.CandidateSemanticStage candidateContext env Us}
+    (input : CandidateConstructorStagedInput stage candidate raw) :
+    CandidateConstructorSemanticInput env Us candidate raw where
+  name_eq := input.name_eq
+  uvars_eq := input.uvars_eq
+  type := input.type.rootInput
+
+/-- Exact source-order translations for every constructor in one shared
+post-family stage. The dependent indices enforce length, order, source, raw
+header, and candidate alignment without `zip` or list lookup. -/
+inductive CandidateConstructorStagedListInput
+    {candidateContext : AddInductive.Context} {env : VEnv} {Us : List Name}
+    (stage : TypeChecker.CandidateSemanticStage candidateContext env Us) :
+    {sources : List Constructor} →
+      AddInductive.CandidateList AddInductive.CandidateConstructor sources →
+      List VConstVal → Type where
+  | nil : CandidateConstructorStagedListInput stage .nil []
+  | cons
+      (head : CandidateConstructorStagedInput stage candidate raw)
+      (tail : CandidateConstructorStagedListInput stage candidates raws) :
+      CandidateConstructorStagedListInput stage
+        (.cons candidate candidates) (raw :: raws)
+
+/-- Convert the staged, source-indexed constructor translations to the
+existing recursive semantic-input representation. -/
+def CandidateConstructorStagedListInput.semanticInput
+    {candidateContext : AddInductive.Context} {env : VEnv} {Us : List Name}
+    {stage : TypeChecker.CandidateSemanticStage candidateContext env Us}
+    {sources : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor sources}
+    {raws : List VConstVal}
+    (input : CandidateConstructorStagedListInput stage candidates raws) :
+    CandidateConstructorSemanticListInput env Us candidates raws :=
+  match input with
+  | .nil => CandidateConstructorSemanticListInput.nil
+  | .cons head tail =>
+    CandidateConstructorSemanticListInput.cons
+      head.semanticInput tail.semanticInput
+
+/-- Pre-run semantic evidence for a complete singleton family position.  The
+family type is interpreted in the input environment and its constructor list
+in the exact environment obtained by inserting the raw family constant. -/
+structure CandidateFamilySemanticInput (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.CandidateFamily source)
+    (raw : VInductiveType) where
+  name_eq : source.name = raw.name
+  uvars_eq : raw.uvars = Us.length
+  type : TypeChecker.CandidateExprSemanticRootInput env Us
+    candidate.familyType.type raw.type
+  typeEnv : VEnv
+  addType : env.addConst raw.name raw.toVConstant = some typeEnv
+  constructors : CandidateConstructorSemanticListInput typeEnv Us
+    candidate.constructors raw.ctors
+
+/-- Interpret the family root and all post-insertion constructor roots from
+their exact pre-run inputs. -/
+theorem CandidateFamilySemanticInput.exists
+    (input : CandidateFamilySemanticInput env Us candidate raw) :
+    Nonempty (CandidateFamilySemanticRun env Us candidate raw) := by
+  obtain ⟨type⟩ := input.type.exists
+  obtain ⟨constructors⟩ := input.constructors.exists
+  exact ⟨{
+    name_eq := input.name_eq
+    uvars_eq := input.uvars_eq
+    type := type
+    typeEnv := input.typeEnv
+    addType := input.addType
+    constructors := constructors }⟩
+
+/-- Pre-run semantic evidence for one source-indexed singleton normalization
+candidate.  The source declaration and candidate list indices rule out an
+unrelated raw family or a partial constructor list. -/
+structure NormalizationCandidateSemanticInput (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  raw : VInductiveType
+  raw_types_eq : rawDecl.types = [raw]
+  uvars_eq : rawDecl.uvars = Us.length
+  family : CandidateFamilySemanticInput env Us
+    candidate.families.singleton raw
+
+/-- Automatically interpret the complete singleton semantic hierarchy from
+its verified, source-indexed inputs. -/
+theorem NormalizationCandidateSemanticInput.exists
+    (input : NormalizationCandidateSemanticInput env Us candidate rawDecl) :
+    Nonempty (NormalizationCandidateSemanticRun env Us candidate rawDecl) := by
+  obtain ⟨family⟩ := input.family.exists
+  exact ⟨{
+    raw := input.raw
+    raw_types_eq := input.raw_types_eq
+    uvars_eq := input.uvars_eq
+    family := family }⟩
+
+/-- The automatic semantic hierarchy paired with the exact executable
+family-type and constructor-list traversals that selected the same dependent
+candidate.  The two producer contexts are explicit because family types are
+checked before raw-family insertion and constructors after it. -/
+structure ProducedNormalizationCandidateSemanticRun
+    (familyContext constructorContext : AddInductive.Context)
+    (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  semantic : NormalizationCandidateSemanticRun env Us candidate rawDecl
+  familyTypesProduced : AddInductive.CandidateFamilyTypeListProduced
+    familyContext
+    (.cons candidate.families.singleton.familyType .nil)
+  familiesProduced : AddInductive.CandidateFamilyListProduced
+    constructorContext
+    (.cons candidate.families.singleton.familyType .nil)
+    candidate.families
+
+/-- Combine exact arbitrary-length producer witnesses with verified semantic
+inputs for the same source-indexed singleton candidate.  Operational evidence
+selects the candidate; only the retained checker interpreter supplies Theory
+meaning. -/
+theorem NormalizationCandidateSemanticInput.exists_ofProduced
+    (input : NormalizationCandidateSemanticInput env Us candidate rawDecl)
+    (familyTypesProduced : AddInductive.CandidateFamilyTypeListProduced
+      familyContext
+      (.cons candidate.families.singleton.familyType .nil))
+    (familiesProduced : AddInductive.CandidateFamilyListProduced
+      constructorContext
+      (.cons candidate.families.singleton.familyType .nil)
+      candidate.families) :
+    Nonempty (ProducedNormalizationCandidateSemanticRun
+      familyContext constructorContext env Us candidate rawDecl) := by
+  obtain ⟨semantic⟩ := input.exists
+  exact ⟨{
+    semantic := semantic
+    familyTypesProduced := familyTypesProduced
+    familiesProduced := familiesProduced }⟩
+
+/-- The complete family-validated semantic input for a produced singleton
+candidate.
+
+Only the entry verifier alignment is supplied. The exact singleton family
+validation and raw-family insertion derive the post-family verified stage;
+constructor positions then supply strict translations and fuel equalities in
+that derived stage. No normalized view, post-family `VEnvs.WF`, semantic run,
+declaration-WF proof, or generation package is an input. -/
+structure StagedNormalizationCandidateSemanticInput
+    (familyContext constructorContext : AddInductive.Context)
+    (env : VEnv) (Us : List Name)
+    {source : InductiveType}
+    (candidate : AddInductive.NormalizationCandidate [source])
+    (rawDecl : VInductDecl) where
+  raw : VInductiveType
+  raw_types_eq : rawDecl.types = [raw]
+  declaration_uvars_eq : rawDecl.uvars = Us.length
+  preFamily : TypeChecker.CandidateSemanticStage familyContext env Us
+  family : CandidateFamilyStagedInput familyContext constructorContext env Us
+    candidate.families.singleton.familyType raw preFamily
+  validation_nparams_eq : family.validation.nparams = rawDecl.nparams
+  constructorValidation : AddInductive.ConstructorValidationRun
+    source family.validation.stats false
+      { candidate.families.singleton.familyType.type.trace.terminalContext with
+        env := constructorContext.env }
+  constructors : CandidateConstructorStagedListInput family.postFamily
+    candidate.families.singleton.constructors raw.ctors
+  familyTypesProduced : AddInductive.CandidateFamilyTypeListProduced
+    familyContext
+    (.cons candidate.families.singleton.familyType .nil)
+  familiesProduced : AddInductive.CandidateFamilyListProduced
+    constructorContext
+    (.cons candidate.families.singleton.familyType .nil)
+    candidate.families
+
+/-- The staged owner retains exactly the successful executable constructor
+validation that selected its source-indexed constructor list. -/
+theorem StagedNormalizationCandidateSemanticInput.constructorValidation_run
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidateSemanticInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    AddInductive.checkConstructors #[source] input.family.validation.stats
+        false
+        { candidate.families.singleton.familyType.type.trace.terminalContext with
+          env := constructorContext.env } = .ok () :=
+  input.constructorValidation.run
+
+/-- Project the established semantic-input hierarchy from the consolidated
+two-stage owner. This projection remains data-free with respect to checker
+semantics: it only rearranges verified stage and translation evidence. -/
+def StagedNormalizationCandidateSemanticInput.semanticInput
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidateSemanticInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    NormalizationCandidateSemanticInput env Us candidate rawDecl where
+  raw := input.raw
+  raw_types_eq := input.raw_types_eq
+  uvars_eq := input.declaration_uvars_eq
+  family := {
+    name_eq := input.family.name_eq
+    uvars_eq := input.family.uvars_eq
+    type := input.family.type.rootInput
+    typeEnv := input.family.typeEnv
+    addType := input.family.addInduct.env_add
+    constructors := input.constructors.semanticInput }
+
+/-- Interpret a complete produced singleton candidate from its entry stage and
+derived family-validation stage. The result stays in `Nonempty`; in particular, this theorem
+does not use choice to expose a semantic run as executable data. -/
+theorem StagedNormalizationCandidateSemanticInput.exists
+    {familyContext constructorContext : AddInductive.Context}
+    {env : VEnv} {Us : List Name} {source : InductiveType}
+    {candidate : AddInductive.NormalizationCandidate [source]}
+    {rawDecl : VInductDecl}
+    (input : StagedNormalizationCandidateSemanticInput familyContext
+      constructorContext env Us candidate rawDecl) :
+    Nonempty (ProducedNormalizationCandidateSemanticRun
+      familyContext constructorContext env Us candidate rawDecl) :=
+  input.semanticInput.exists_ofProduced input.familyTypesProduced
+    input.familiesProduced
+
+/-- Forget executable list provenance and expose the existing normalization
+root selected by the automatic semantic hierarchy. -/
+def ProducedNormalizationCandidateSemanticRun.root
+    (run : ProducedNormalizationCandidateSemanticRun
+      familyContext constructorContext env Us candidate rawDecl) :
+    NormalizationCandidateRun env Us candidate rawDecl :=
+  run.semantic.root
+
+/-- Checker-produced semantic evidence for one positional raw/view
+constructor pair. This has the same four-way declared/emitted split as
+`NormalizedCtor.WF`, but keeps every equality in compositional evidence form
+until the final Theory boundary. -/
+structure NormalizedCtorRun {source : VInductDecl}
+    (block : NormalizedChecked source) (ctor : NormalizedCtor)
+    (env : VEnv) where
+  declaredTel : TypeChecker.TelDefEqEvidence env source.uvars []
+    (ctor.declaredBinders source.nparams) (ctor.viewBinders block)
+  declaredResult : TypeChecker.DefEqEvidence env source.uvars
+    (ctor.declaredBinders source.nparams).reverse
+    (ctor.rawResult source.nparams) (ctor.resultTarget block)
+    (.sort block.checked.resultLevel)
+  emittedTel : TypeChecker.TelDefEqEvidence env source.uvars []
+    (ctor.emittedBinders block) (ctor.viewBinders block)
+  emittedResult : TypeChecker.DefEqEvidence env source.uvars
+    (ctor.emittedBinders block).reverse
+    (ctor.rawResult source.nparams) (ctor.resultTarget block)
+    (.sort block.checked.resultLevel)
+
+theorem NormalizedCtorRun.wf
+    (run : NormalizedCtorRun block ctor env) :
+    ctor.WF block env where
+  declaredTel := run.declaredTel.telDefEq
+  declaredResult := run.declaredResult.isDefEq
+  emittedTel := run.emittedTel.telDefEq
+  emittedResult := run.emittedResult.isDefEq
+
+/-- Complete checker-side assembler for a generation-ready candidate.
+
+The exact family insertion state is named once. This lets a producer check
+constructor evidence in that state and lets `.wf` discharge the universally
+quantified post-family environment in `GenerationChecked.WF` by equality,
+without an oracle or an assumed transaction. -/
+structure GenerationRun {source : VInductDecl}
+    (generation : GenerationChecked source) (env : VEnv) where
+  normalization : NormalizationRun generation.block.normalization env
+  checked : generation.block.checked.WF env
+  familyTel : TypeChecker.TelDefEqEvidence env source.uvars []
+    (generation.block.rawParams ++ generation.block.rawIndices)
+    (generation.block.checked.params ++ generation.block.checked.indices)
+  familyResult : TypeChecker.DefEqEvidence env source.uvars
+    (generation.block.rawParams ++ generation.block.rawIndices).reverse
+    generation.block.rawResult (.sort generation.block.checked.resultLevel)
+    (.sort (.succ generation.block.checked.resultLevel))
+  typeEnv : VEnv
+  addType : env.addConst generation.block.sourceType.name
+    generation.block.sourceType.toVConstant = some typeEnv
+  constructors :
+    ∀ ctor ∈ generation.block.ctorPairs,
+      NormalizedCtorRun generation.block ctor typeEnv
+
+/-- Assemble the complete Theory generation certificate from exact
+checker-produced normalization, telescope, result, and constructor evidence. -/
+theorem GenerationRun.wf
+    (run : GenerationRun generation env) :
+    generation.WF env := by
+  refine {
+    blockWF := ⟨run.normalization.wf, run.checked⟩
+    familyTel := run.familyTel.telDefEq
+    familyResult := run.familyResult.isDefEq
+    ctors := ?_ }
+  intro envT hadd ctor hctor
+  have henv : envT = run.typeEnv := by
+    have : some envT = some run.typeEnv := hadd.symm.trans run.addType
+    exact Option.some.inj this
+  subst envT
+  exact (run.constructors ctor hctor).wf
+
+/-- Exact family-spine evidence extracted from the source-indexed singleton
+normalization candidate and aligned with the components retained by dependent
+inductive analysis. -/
+structure CandidateFamilyGenerationRun
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateRun env Us candidate source)
+    (generation : GenerationChecked source) where
+  spine : TypeChecker.CandidateExprSpineRun env Us
+    candidate.families.singleton.familyType.type
+    normalization.raw.type normalization.family.viewType
+  rawTel : VExpr.telN
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.raw.type =
+    generation.block.rawParams ++ generation.block.rawIndices
+  rawResult : VExpr.dropN
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.raw.type = generation.block.rawResult
+  viewResult : VExpr.dropN
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.family.viewType =
+    .sort generation.block.checked.resultLevel
+
+/-- Extract the complete family telescope/result certificate at the exact
+components consumed by `GenerationRun`. -/
+theorem CandidateFamilyGenerationRun.evidence
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : CandidateFamilyGenerationRun normalization generation)
+    (viewType_eq : normalization.family.viewType =
+      generation.block.checked.type.type) :
+    TypeChecker.TelResultDefEqEvidence env Us.length []
+      (generation.block.rawParams ++ generation.block.rawIndices)
+      (generation.block.checked.params ++ generation.block.checked.indices)
+      generation.block.rawResult
+      (.sort generation.block.checked.resultLevel)
+      (.sort (.succ generation.block.checked.resultLevel)) :=
+  run.spine.evidenceAt run.rawTel (by
+    rw [viewType_eq, generation.block.checked.type_eq,
+      ← VExpr.forallN_append]
+    apply TypeChecker.candidateTelN_of_dropN_terminal (B :=
+      .sort generation.block.checked.resultLevel) trivial
+    simpa only [viewType_eq, generation.block.checked.type_eq,
+      ← VExpr.forallN_append] using run.viewResult)
+    run.rawResult run.viewResult (by
+      apply VEnv.HasType.sort
+      simpa only [← generation.block.uvars_eq,
+        normalization.uvars_eq] using
+        generation.block.checked.direct_anatomy.2.2.1)
+
+/-- Family generation alignment whose spine is projected directly from the
+retained semantic hierarchy.  Callers provide only the executable structural
+gate and the component equations required by `GenerationChecked`; they cannot
+substitute a second recursive run or a different normalized view. -/
+structure CandidateFamilySemanticGenerationRun
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source) where
+  storedSpine :
+    candidate.families.singleton.familyType.type.trace.storedSpine = true
+  rawTel : VExpr.telN
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.raw.type =
+    generation.block.rawParams ++ generation.block.rawIndices
+  rawResult : VExpr.dropN
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.raw.type = generation.block.rawResult
+  viewResult : VExpr.dropN
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.family.type.view =
+    .sort generation.block.checked.resultLevel
+
+/-- Minimal structural input for family generation.  The retained semantic
+root already owns the recursive checker run, while dependent analysis fixes
+the raw and checked components.  A caller therefore supplies only the
+executable stored-spine gate and the total number of binders traversed by that
+spine; all telescope and terminal equations are derived below. -/
+structure CandidateFamilySemanticGenerationShape
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source) where
+  storedSpine :
+    candidate.families.singleton.familyType.type.trace.storedSpine = true
+  spineLength_eq :
+    candidate.families.singleton.familyType.type.trace.spineLength =
+      (generation.block.rawParams ++ generation.block.rawIndices).length
+
+/-- Recover the existing family-generation run from the single retained
+semantic owner. -/
+theorem CandidateFamilySemanticGenerationRun.run
+    (run : CandidateFamilySemanticGenerationRun normalization generation) :
+    CandidateFamilyGenerationRun normalization.root generation where
+  spine := normalization.family.type.spine run.storedSpine
+  rawTel := run.rawTel
+  rawResult := run.rawResult
+  viewResult := run.viewResult
+
+/-- One positional constructor candidate aligned with the raw/view
+constructor pair retained by dependent analysis.
+
+The spine certificate covers the exact stored constructor type. Its declared
+telescope will later be transformed into the mixed emitted telescope by
+replacing only the constructor's parameter prefix. -/
+structure CandidateNormalizedCtorRun {source : VInductDecl}
+    (block : NormalizedChecked source) (env : VEnv) (Us : List Name)
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    (root : CandidateConstructorRun env Us candidate raw)
+    (ctor : NormalizedCtor) where
+  raw_eq : ctor.raw = raw
+  view_eq : ctor.view.value = root.view
+  spine : TypeChecker.CandidateExprSpineRun env Us candidate.type
+    raw.type root.viewType
+  rawTel : VExpr.telN candidate.type.trace.spineLength raw.type =
+    ctor.declaredBinders source.nparams
+  rawResult : VExpr.dropN candidate.type.trace.spineLength raw.type =
+    ctor.rawResult source.nparams
+  viewResult : VExpr.dropN candidate.type.trace.spineLength root.viewType =
+    ctor.resultTarget block
+
+/-- Constructor generation alignment owned by the same retained semantic root
+used for normalization.  The only spine premise is the Boolean structural gate
+computed by the candidate trace; the recursive semantic run and view are
+projected from `root`. -/
+structure CandidateSemanticNormalizedCtorRun {source : VInductDecl}
+    (block : NormalizedChecked source) (env : VEnv) (Us : List Name)
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    (root : CandidateConstructorSemanticRun env Us candidate raw)
+    (ctor : NormalizedCtor) where
+  raw_eq : ctor.raw = raw
+  view_eq : ctor.view.value = root.root.view
+  storedSpine : candidate.type.trace.storedSpine = true
+  rawTel : VExpr.telN candidate.type.trace.spineLength raw.type =
+    ctor.declaredBinders source.nparams
+  rawResult : VExpr.dropN candidate.type.trace.spineLength raw.type =
+    ctor.rawResult source.nparams
+  viewResult : VExpr.dropN candidate.type.trace.spineLength root.type.view =
+    ctor.resultTarget block
+
+/-- Minimal structural input for one retained constructor root.  It is
+independent of a caller-selected normalized pair: positional raw/view pairing
+is recovered from the successful dependent analysis, and the full component
+equations follow from this total stored-binder count. -/
+structure CandidateConstructorSemanticGenerationShape
+    {source : VInductDecl} (env : VEnv) (Us : List Name)
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    (root : CandidateConstructorSemanticRun env Us candidate raw) where
+  storedSpine : candidate.type.trace.storedSpine = true
+  spineLength_eq : candidate.type.trace.spineLength =
+    (VExpr.telN source.nparams raw.type ++
+      ctorFields (VExpr.dropN source.nparams raw.type)).length
+
+/-- Project the compatibility constructor run without rebuilding or choosing
+semantic evidence. -/
+theorem CandidateSemanticNormalizedCtorRun.run
+    (run : CandidateSemanticNormalizedCtorRun block env Us root ctor) :
+    CandidateNormalizedCtorRun block env Us root.root ctor where
+  raw_eq := run.raw_eq
+  view_eq := run.view_eq
+  spine := root.type.spine run.storedSpine
+  rawTel := run.rawTel
+  rawResult := run.rawResult
+  viewResult := run.viewResult
+
+/-- The terminal alignment and the analyzer's exact constructor shape force
+the candidate trace to expose the entire checked binder telescope. -/
+theorem CandidateNormalizedCtorRun.viewTel_eq
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    {root : CandidateConstructorRun env Us candidate raw}
+    {ctor : NormalizedCtor}
+    (run : CandidateNormalizedCtorRun generation.block env Us root ctor)
+    (hctor : ctor ∈ generation.block.ctorPairs) :
+    VExpr.telN candidate.type.trace.spineLength root.viewType =
+      ctor.viewBinders generation.block := by
+  have viewType_eq : root.viewType = ctor.view.value.type := by
+    simpa only [CandidateConstructorRun.view] using
+      (congrArg (fun value : VConstVal => value.type) run.view_eq).symm
+  have hterminal :
+      TypeChecker.CandidateTerminal (ctor.resultTarget generation.block) := by
+    exact TypeChecker.candidateTerminal_appN_const _ _ _
+  rw [viewType_eq, generation.viewCtorType_eq hctor]
+  apply TypeChecker.candidateTelN_of_dropN_terminal hterminal
+  simpa only [viewType_eq, generation.viewCtorType_eq hctor] using
+    run.viewResult
+
+/-- Extract the stored constructor's declared telescope/result evidence. -/
+theorem CandidateNormalizedCtorRun.declaredEvidence
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    {root : CandidateConstructorRun env Us candidate raw}
+    {ctor : NormalizedCtor}
+    (run : CandidateNormalizedCtorRun generation.block env Us root ctor)
+    (hctor : ctor ∈ generation.block.ctorPairs)
+    (rightType : env.HasType Us.length
+      (ctor.declaredBinders source.nparams).reverse
+      (ctor.resultTarget generation.block)
+      (.sort generation.block.checked.resultLevel)) :
+    TypeChecker.TelResultDefEqEvidence env Us.length []
+      (ctor.declaredBinders source.nparams)
+      (ctor.viewBinders generation.block)
+      (ctor.rawResult source.nparams) (ctor.resultTarget generation.block)
+      (.sort generation.block.checked.resultLevel) := by
+  apply run.spine.evidenceAt run.rawTel (run.viewTel_eq hctor)
+    run.rawResult run.viewResult rightType
+
+/-- The checked result spine and the candidate-certified binder telescope
+determine a constructor's terminal typing judgment.  The family constant is
+typed once for the whole block; individual constructor fixtures supply no
+additional semantic result oracle. -/
+theorem CandidateNormalizedCtorRun.rightType_ofChecked
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    {root : CandidateConstructorRun env Us candidate raw}
+    {ctor : NormalizedCtor}
+    (run : CandidateNormalizedCtorRun generation.block env Us root ctor)
+    (henv : VEnv.WF env) (uvars_eq : source.uvars = Us.length)
+    (checked : generation.block.checked.WF env)
+    (familyConst : env.HasType source.uvars []
+      (.const generation.block.sourceType.name
+        (VLevel.params source.uvars))
+      generation.block.checked.type.type)
+    (hctor : ctor ∈ generation.block.ctorPairs) :
+    env.HasType Us.length
+      (ctor.declaredBinders source.nparams).reverse
+      (ctor.resultTarget generation.block)
+      (.sort generation.block.checked.resultLevel) := by
+  obtain ⟨_, evidence⟩ := run.spine.evidence
+  have telescope : TypeChecker.TelDefEqEvidence env Us.length []
+      (ctor.declaredBinders source.nparams)
+      (ctor.viewBinders generation.block) := by
+    simpa only [run.rawTel, run.viewTel_eq hctor] using evidence.telescope
+  have hview := generation.checkedResultTarget_hasType
+    henv.ordered checked familyConst hctor
+  have hview' : env.HasType Us.length
+      (ctor.viewBinders generation.block).reverse
+      (ctor.resultTarget generation.block)
+      (.sort generation.block.checked.resultLevel) := by
+    simpa only [uvars_eq] using hview
+  have hctx : env.IsDefEqCtx Us.length []
+      (ctor.declaredBinders source.nparams).reverse
+      (ctor.viewBinders generation.block).reverse := by
+    simpa using telescope.telDefEq.ctx
+  exact hview'.defeqDFC henv.ordered (hctx.symm henv.ordered)
+
+/-- Produce both constructor paths required by `NormalizedCtorRun`.
+
+The declared path comes directly from the constructor candidate. The emitted
+path replaces the stored constructor parameter prefix by the checked family
+parameter prefix used by Lean's recursor generator, transporting fields and
+result through the induced definitionally equal context. -/
+theorem CandidateNormalizedCtorRun.normalizedCtorRun
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    {root : CandidateConstructorRun env Us candidate raw}
+    {ctor : NormalizedCtor}
+    (run : CandidateNormalizedCtorRun generation.block env Us root ctor)
+    (henv : VEnv.WF env) (uvars_eq : source.uvars = Us.length)
+    (familyParams : TypeChecker.TelDefEqEvidence env Us.length []
+      generation.block.rawParams generation.block.checked.params)
+    (prefixLength :
+      (VExpr.telN source.nparams ctor.raw.type).length =
+        generation.block.checked.params.length)
+    (hctor : ctor ∈ generation.block.ctorPairs)
+    (rightType : env.HasType Us.length
+      (ctor.declaredBinders source.nparams).reverse
+      (ctor.resultTarget generation.block)
+      (.sort generation.block.checked.resultLevel)) :
+    NormalizedCtorRun generation.block ctor env := by
+  have declared := run.declaredEvidence hctor rightType
+  have declaredSplit : TypeChecker.TelResultDefEqEvidence env Us.length []
+      (VExpr.telN source.nparams ctor.raw.type ++
+        ctor.rawFields source.nparams)
+      (generation.block.checked.params ++ ctor.view.fields)
+      (ctor.rawResult source.nparams) (ctor.resultTarget generation.block)
+      (.sort generation.block.checked.resultLevel) := by
+    simpa only [NormalizedCtor.declaredBinders,
+      NormalizedCtor.viewBinders] using declared
+  have checkedParams : TypeChecker.TelDefEqEvidence env Us.length []
+      generation.block.checked.params generation.block.checked.params :=
+    .ofTelDefEq <| (familyParams.telDefEq.view_onTel henv.ordered).telDefEq_refl
+  have emitted := declaredSplit.replacePrefix henv checkedParams prefixLength
+  exact {
+    declaredTel := by
+      simpa only [uvars_eq] using declared.telescope
+    declaredResult := by
+      simpa only [uvars_eq, List.append_nil] using declared.result
+    emittedTel := by
+      simpa only [uvars_eq, NormalizedCtor.emittedBinders,
+        NormalizedCtor.viewBinders] using emitted.telescope
+    emittedResult := by
+      simpa only [uvars_eq, NormalizedCtor.emittedBinders,
+        List.append_nil] using emitted.result }
+
+/-- Dependent positional alignment between every constructor candidate run
+and every normalized constructor pair. The indices make unequal lengths,
+reordering, and evidence reuse at a different source position impossible. -/
+inductive CandidateNormalizedCtorListRun {source : VInductDecl}
+    (block : NormalizedChecked source) (env : VEnv) (Us : List Name) :
+    {kernelSources : List Constructor} →
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelSources} →
+    {raws : List VConstVal} →
+    (roots : CandidateConstructorListRun env Us candidates raws) →
+    List NormalizedCtor → Type where
+  | nil : CandidateNormalizedCtorListRun block env Us .nil []
+  | cons
+      (head : CandidateNormalizedCtorRun block env Us root ctor)
+      (tail : CandidateNormalizedCtorListRun block env Us roots ctors) :
+      CandidateNormalizedCtorListRun block env Us
+        (.cons root roots) (ctor :: ctors)
+
+/-- Dependent positional generation alignment over the retained constructor
+semantic list.  Its projection below is definitionally tied to
+`roots.roots`, so source order and the exact normalization views cannot drift
+between phases. -/
+inductive CandidateSemanticNormalizedCtorListRun {source : VInductDecl}
+    (block : NormalizedChecked source) (env : VEnv) (Us : List Name) :
+    {kernelSources : List Constructor} →
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelSources} →
+    {raws : List VConstVal} →
+    (roots : CandidateConstructorSemanticListRun env Us candidates raws) →
+    List NormalizedCtor → Type where
+  | nil : CandidateSemanticNormalizedCtorListRun block env Us .nil []
+  | cons
+      (head : CandidateSemanticNormalizedCtorRun block env Us root ctor)
+      (tail : CandidateSemanticNormalizedCtorListRun block env Us roots ctors) :
+      CandidateSemanticNormalizedCtorListRun block env Us
+        (.cons root roots) (ctor :: ctors)
+
+/-- Source-indexed structural generation inputs for every retained semantic
+constructor root.  No normalized constructor list occurs in this type, so a
+caller cannot choose, reorder, truncate, or duplicate the analyzer's pairs. -/
+inductive CandidateConstructorSemanticGenerationShapeList
+    (source : VInductDecl) (env : VEnv) (Us : List Name) :
+    {kernelSources : List Constructor} →
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelSources} →
+    {raws : List VConstVal} →
+    (roots : CandidateConstructorSemanticListRun env Us candidates raws) →
+    Type where
+  | nil : CandidateConstructorSemanticGenerationShapeList source env Us .nil
+  | cons
+      (head : CandidateConstructorSemanticGenerationShape
+        (source := source) env Us root)
+      (tail : CandidateConstructorSemanticGenerationShapeList
+        source env Us roots) :
+      CandidateConstructorSemanticGenerationShapeList source env Us
+        (.cons root roots)
+
+/-- Executable generation-layout check for a complete source-indexed
+constructor candidate list.
+
+The check is intentionally stated against the raw Theory constants retained
+by the semantic hierarchy.  It accepts exactly when every candidate WHNF trace
+preserves the stored main Pi spine and traverses the complete raw constructor
+telescope.  List-length mismatches are rejected explicitly; no `zip` or
+positional lookup can silently truncate either side. -/
+def candidateConstructorSemanticGenerationShape
+    (source : VInductDecl) :
+    {kernelSources : List Constructor} →
+    AddInductive.CandidateList AddInductive.CandidateConstructor
+      kernelSources →
+    List VConstVal → Bool
+  | _, .nil, [] => true
+  | _, .nil, _ :: _ => false
+  | _, .cons _ _, [] => false
+  | _, .cons candidate candidates, raw :: raws =>
+    candidate.type.trace.storedSpine &&
+      candidate.type.trace.spineLength ==
+        (VExpr.telN source.nparams raw.type ++
+          ctorFields (VExpr.dropN source.nparams raw.type)).length &&
+      candidateConstructorSemanticGenerationShape source candidates raws
+
+/-- Executable generation-layout check for a complete singleton
+normalization candidate and its raw Theory family.
+
+This definition is independent of semantic proofs.  It checks only the
+source-indexed candidate traces against the raw family/constructor telescope
+layout that generation would emit.  Verify's retained semantic hierarchy
+later reindexes the same Boolean onto its exact raw family. -/
+def normalizationCandidateGenerationShape
+    {kernelSource : InductiveType}
+    (source : VInductDecl) (raw : VInductiveType)
+    (candidate : AddInductive.NormalizationCandidate [kernelSource]) : Bool :=
+  let familyTrace :=
+    candidate.families.singleton.familyType.type.trace
+  (familyTrace.storedSpine &&
+      familyTrace.spineLength ==
+        (VExpr.telN source.nparams raw.type ++
+          ctorFields (VExpr.dropN source.nparams raw.type)).length) &&
+    candidateConstructorSemanticGenerationShape source
+      candidate.families.singleton.constructors raw.ctors
+
+/-- One executable constructor-list shape check determines every dependent
+per-position shape record required by semantic generation. -/
+def CandidateConstructorSemanticGenerationShapeList.ofCheck
+    {source : VInductDecl} {env : VEnv} {Us : List Name}
+    {kernelSources : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelSources}
+    {raws : List VConstVal}
+    (roots : CandidateConstructorSemanticListRun env Us candidates raws)
+    (shape : candidateConstructorSemanticGenerationShape
+      source candidates raws = true) :
+    CandidateConstructorSemanticGenerationShapeList source env Us roots :=
+  match roots with
+  | .nil => .nil
+  | .cons head tail => by
+      simp only [candidateConstructorSemanticGenerationShape,
+        Bool.and_eq_true, beq_iff_eq] at shape
+      exact .cons {
+        storedSpine := shape.1.1
+        spineLength_eq := shape.1.2 }
+        (CandidateConstructorSemanticGenerationShapeList.ofCheck
+          tail shape.2)
+termination_by sizeOf roots
+
+/-- Forget only retained semantic ownership and recover the existing
+generation-facing positional list. -/
+def CandidateSemanticNormalizedCtorListRun.run :
+    (semantic : CandidateSemanticNormalizedCtorListRun
+      block env Us roots ctors) →
+      CandidateNormalizedCtorListRun block env Us roots.roots ctors
+  | .nil => .nil
+  | .cons head tail => .cons head.run tail.run
+
+/-- Assemble a `NormalizedCtorRun` for every constructor in an exact
+dependent positional list. -/
+theorem CandidateNormalizedCtorListRun.normalizedCtorRuns
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSources : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelSources}
+    {raws : List VConstVal}
+    {roots : CandidateConstructorListRun env Us candidates raws}
+    {ctors : List NormalizedCtor}
+    (run : CandidateNormalizedCtorListRun generation.block env Us roots ctors)
+    (henv : VEnv.WF env) (uvars_eq : source.uvars = Us.length)
+    (familyParams : TypeChecker.TelDefEqEvidence env Us.length []
+      generation.block.rawParams generation.block.checked.params)
+    (checked : generation.block.checked.WF env)
+    (familyConst : env.HasType source.uvars []
+      (.const generation.block.sourceType.name
+        (VLevel.params source.uvars))
+      generation.block.checked.type.type)
+    (pairMembership : ∀ ctor ∈ ctors,
+      ctor ∈ generation.block.ctorPairs)
+    (prefixLengths : ∀ ctor ∈ ctors,
+      (VExpr.telN source.nparams ctor.raw.type).length =
+        generation.block.checked.params.length) :
+    ∀ ctor ∈ ctors, NormalizedCtorRun generation.block ctor env := by
+  induction run with
+  | nil => intro ctor hctor; simp at hctor
+  | cons head tail ih =>
+    intro ctor hctor
+    simp only [List.mem_cons] at hctor
+    rcases hctor with rfl | hctor
+    · exact head.normalizedCtorRun henv uvars_eq familyParams
+        (prefixLengths _ (.head _))
+        (pairMembership _ (.head _))
+        (head.rightType_ofChecked henv uvars_eq checked familyConst
+          (pairMembership _ (.head _)))
+    · exact ih
+        (fun ctor hctor => pairMembership ctor (.tail _ hctor))
+        (fun ctor hctor => prefixLengths ctor (.tail _ hctor))
+        ctor hctor
+
+/-- Complete source-indexed candidate certificate for one generation-ready
+singleton inductive declaration.
+
+`analysis` records that the candidate-derived normalization produced this exact
+dependent generation result. `constructors` then aligns every post-family
+candidate run with the corresponding dependent analyzer pair. -/
+structure GenerationCandidateRun
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateRun env Us candidate source)
+    (generation : GenerationChecked source) where
+  analysis : normalization.normalization.generation? = some generation
+  checked : generation.block.checked.WF env
+  family : CandidateFamilyGenerationRun normalization generation
+  constructors : CandidateNormalizedCtorListRun generation.block
+    normalization.family.typeEnv Us normalization.family.constructors
+    generation.block.ctorPairs
+
+/-- Complete generation assembly owned by one retained semantic hierarchy.
+
+This is the no-parallel-run form of `GenerationCandidateRun`: family and
+constructor spines are projections of `normalization`, while `analysis` retains
+the exact dependent analyzer result consumed by Theory generation. -/
+structure GenerationCandidateSemanticRun
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source) where
+  analysis : normalization.root.normalization.generation? = some generation
+  checked : generation.block.checked.WF env
+  family : CandidateFamilySemanticGenerationRun normalization generation
+  constructors : CandidateSemanticNormalizedCtorListRun generation.block
+    normalization.family.typeEnv Us normalization.family.constructors
+    generation.block.ctorPairs
+
+/-- Complete semantic-generation input with all analyzer-determined component
+equations erased.  Compared with `GenerationCandidateSemanticRun`, this form
+retains only checked semantics plus the executable stored-spine/length shape
+for each source-indexed root.  Its projection below reconstructs the exact
+family and dependent constructor alignment from `analysis`. -/
+structure GenerationCandidateSemanticShapeRun
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source) where
+  analysis : normalization.root.normalization.generation? = some generation
+  checked : generation.block.checked.WF env
+  family : CandidateFamilySemanticGenerationShape normalization generation
+  constructors : CandidateConstructorSemanticGenerationShapeList source
+    normalization.family.typeEnv Us normalization.family.constructors
+
+/-- One executable structural gate for the complete retained singleton
+candidate hierarchy.
+
+The family check uses the complete raw parameter/index telescope.  The
+constructor check traverses the source-indexed candidate and raw lists
+dependently.  This consolidates the former per-fixture family and constructor
+proof records into one computation while remaining separate from semantic
+authority and dependent analysis. -/
+def NormalizationCandidateSemanticRun.generationShape
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source) :
+    Bool :=
+  normalizationCandidateGenerationShape source normalization.raw candidate
+
+/-- One successful outer candidate together with the executable structural
+gate required before mixed raw/view generation.
+
+The record carries the exact ordinary producer equation, so the shape check
+cannot be reused for a different candidate.  It remains operational evidence:
+semantic authority is supplied only after Verify interprets the retained
+checker executions. -/
+structure ProducedGenerationShapeCandidate
+    (source : VInductDecl) (raw : VInductiveType)
+    (kernelSource : InductiveType) (numNested : Nat) (isUnsafe : Bool)
+    (context : AddInductive.Context) where
+  candidate : AddInductive.NormalizationCandidate [kernelSource]
+  produced :
+    AddInductive.buildNormalizationCandidate source.nparams
+        [kernelSource] numNested isUnsafe context = .ok candidate
+  shape : normalizationCandidateGenerationShape source raw candidate = true
+
+/-- Run the ordinary outer producer and immediately reject candidates whose
+retained traces cannot support mixed generation of the supplied raw Theory
+family.  The successful result retains both exact producer provenance and the
+single complete shape proof. -/
+def produceGenerationShapeCandidate
+    (source : VInductDecl) (raw : VInductiveType)
+    (kernelSource : InductiveType) (numNested : Nat) (isUnsafe : Bool)
+    (context : AddInductive.Context) :
+    Except Exception (ProducedGenerationShapeCandidate source raw kernelSource
+      numNested isUnsafe context) :=
+  match produced : AddInductive.buildNormalizationCandidate source.nparams
+      [kernelSource] numNested isUnsafe context with
+  | .error error => .error error
+  | .ok candidate =>
+    if shape : normalizationCandidateGenerationShape source raw candidate then
+      .ok { candidate, produced, shape }
+    else
+      .error (.other
+        "normalization candidate does not preserve the generation spine")
+
+private theorem produceGenerationShapeCandidate_match_ok
+    {source : VInductDecl} {raw : VInductiveType}
+    {kernelSource : InductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    (result : Except Exception
+      (AddInductive.NormalizationCandidate [kernelSource]))
+    (toProduced : ∀ actual, result = .ok actual →
+      AddInductive.buildNormalizationCandidate source.nparams
+          [kernelSource] numNested isUnsafe context = .ok actual)
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (result_ok : result = .ok candidate)
+    (shape : normalizationCandidateGenerationShape source raw candidate = true) :
+    (match result_eq : result with
+    | .error error => Except.error error
+    | .ok actual =>
+      if actualShape : normalizationCandidateGenerationShape source raw actual then
+        Except.ok (show ProducedGenerationShapeCandidate source raw kernelSource
+            numNested isUnsafe context from {
+          candidate := actual
+          produced := toProduced actual result_eq
+          shape := actualShape })
+      else
+        Except.error (.other
+          "normalization candidate does not preserve the generation spine")) =
+      Except.ok (show ProducedGenerationShapeCandidate source raw kernelSource
+          numNested isUnsafe context from {
+        candidate
+        produced := toProduced candidate result_ok
+        shape }) := by
+  subst result
+  simp [shape]
+
+/-- A successful ordinary producer equation and successful hierarchy-shape
+check determine the exact successful result of the strengthened producer.
+
+Keeping this dependent-match elimination here avoids repeating proof-carrying
+`Except` reasoning in clients. -/
+theorem produceGenerationShapeCandidate_eq_ok
+    {source : VInductDecl} {raw : VInductiveType}
+    {kernelSource : InductiveType} {numNested : Nat} {isUnsafe : Bool}
+    {context : AddInductive.Context}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (produced :
+      AddInductive.buildNormalizationCandidate source.nparams
+          [kernelSource] numNested isUnsafe context = .ok candidate)
+    (shape : normalizationCandidateGenerationShape source raw candidate = true) :
+    produceGenerationShapeCandidate source raw kernelSource numNested isUnsafe
+        context =
+      .ok { candidate, produced, shape } := by
+  unfold produceGenerationShapeCandidate
+  exact produceGenerationShapeCandidate_match_ok
+    (result := AddInductive.buildNormalizationCandidate source.nparams
+      [kernelSource] numNested isUnsafe context)
+    (toProduced := fun _ result_eq => result_eq) produced shape
+
+/-- Project the established generation assembler.  Every normalization root,
+view, and recursive spine remains definitionally tied to the semantic owner. -/
+def GenerationCandidateSemanticRun.run
+    (run : GenerationCandidateSemanticRun normalization generation) :
+    GenerationCandidateRun normalization.root generation where
+  analysis := run.analysis
+  checked := run.checked
+  family := run.family.run
+  constructors := run.constructors.run
+
+/-- A retained analyzer result necessarily contains the normalization that was
+analyzed.  This is derived from `analysis`, rather than supplied by fixtures. -/
+theorem GenerationCandidateRun.normalization_eq
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    generation.block.normalization = normalization.normalization :=
+  Normalization.generation?_normalization run.analysis
+
+/-- The source-indexed singleton declarations force the analyzer's raw family
+to be the exact family retained by a normalization candidate. -/
+theorem NormalizationCandidateRun.sourceType_eq
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateRun env Us candidate source)
+    (generation : GenerationChecked source) :
+    generation.block.sourceType = normalization.raw := by
+  have h : [generation.block.sourceType] = [normalization.raw] :=
+    generation.block.source_types_eq.symm.trans normalization.raw_types_eq
+  injection h
+
+/-- Exact dependent analysis selects the reconstructed family view, including
+its constructor list, not merely an expression payload with the same type. -/
+theorem NormalizationCandidateRun.familyViewType_eq
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (analysis : normalization.normalization.generation? = some generation) :
+    generation.block.checked.type = normalization.family.view := by
+  have normalization_eq : generation.block.normalization =
+      normalization.normalization :=
+    Normalization.generation?_normalization analysis
+  have hviews := congrArg (fun norm : Normalization source => norm.view.types)
+    normalization_eq
+  have htypes : [generation.block.checked.type] =
+      [normalization.family.view] := by
+    calc
+      [generation.block.checked.type] =
+          generation.block.normalization.view.types :=
+        generation.block.checked.types_eq.symm
+      _ = normalization.normalization.view.types := hviews
+      _ = [normalization.family.view] := rfl
+  injection htypes
+
+/-- The retained dependent analysis necessarily checks the exact family view
+selected by the normalization candidate.  This equation is a consequence of
+the two singleton declaration indices and `normalization_eq`, not a separate
+fixture alignment premise. -/
+theorem GenerationCandidateRun.familyView_eq
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    normalization.family.viewType = generation.block.checked.type.type := by
+  exact (congrArg (fun ty : VInductiveType => ty.type)
+    (normalization.familyViewType_eq run.analysis)).symm
+
+/-- Taking the exact length of the complete stored telescope recovers both
+its binder list and its non-forall result.  This is the structural bridge from
+one numeric trace invariant to generation's named raw components. -/
+private theorem generationTelNForallNLength :
+    ∀ (As : List VExpr) (B : VExpr),
+      VExpr.telN As.length (VExpr.forallN As B) = As
+  | [], _ => rfl
+  | _ :: As, B => by
+    simp only [List.length_cons, VExpr.forallN, VExpr.telN,
+      generationTelNForallNLength As B]
+
+private theorem generationDropNForallNLength :
+    ∀ (As : List VExpr) (B : VExpr),
+      VExpr.dropN As.length (VExpr.forallN As B) = B
+  | [], _ => rfl
+  | _ :: As, B => by
+    simp only [List.length_cons, VExpr.forallN, VExpr.dropN,
+      generationDropNForallNLength As B]
+
+private theorem candidateFullTelComponents (np n : Nat) (e : VExpr)
+    (h : n =
+      (VExpr.telN np e ++ ctorFields (VExpr.dropN np e)).length) :
+    VExpr.telN n e =
+        VExpr.telN np e ++ ctorFields (VExpr.dropN np e) ∧
+      VExpr.dropN n e = VExpr.resultOf (VExpr.dropN np e) := by
+  let As := VExpr.telN np e ++ ctorFields (VExpr.dropN np e)
+  have he :
+      VExpr.forallN As (VExpr.resultOf (VExpr.dropN np e)) = e := by
+    simp only [As, VExpr.forallN_append,
+      forallN_ctorFields_resultOf, VExpr.forallN_telN_dropN]
+  let B := VExpr.resultOf (VExpr.dropN np e)
+  have hAs : n = As.length := h
+  change VExpr.telN n e = As ∧ VExpr.dropN n e = B
+  rw [hAs, ← he]
+  exact ⟨generationTelNForallNLength _ _,
+    generationDropNForallNLength _ _⟩
+
+/-- Derive every family component equation from the minimal structural shape
+and the exact dependent analyzer result. -/
+private theorem CandidateFamilySemanticGenerationShape.generationRun
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateSemanticRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (input : CandidateFamilySemanticGenerationShape
+      normalization generation)
+    (analysis : normalization.root.normalization.generation? =
+      some generation) :
+    CandidateFamilySemanticGenerationRun normalization generation where
+  storedSpine := input.storedSpine
+  rawTel := by
+    have components := candidateFullTelComponents source.nparams
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.raw.type (by
+        simpa only [NormalizedChecked.rawParams,
+          NormalizedChecked.rawIndices,
+          NormalizationCandidateSemanticRun.root,
+          normalization.root.sourceType_eq generation] using
+          input.spineLength_eq)
+    simpa only [NormalizedChecked.rawParams,
+      NormalizedChecked.rawIndices,
+      NormalizationCandidateSemanticRun.root,
+      normalization.root.sourceType_eq generation] using components.1
+  rawResult := by
+    have components := candidateFullTelComponents source.nparams
+      candidate.families.singleton.familyType.type.trace.spineLength
+      normalization.raw.type (by
+        simpa only [NormalizedChecked.rawParams,
+          NormalizedChecked.rawIndices,
+          NormalizationCandidateSemanticRun.root,
+          normalization.root.sourceType_eq generation] using
+          input.spineLength_eq)
+    simpa only [NormalizedChecked.rawResult,
+      NormalizationCandidateSemanticRun.root,
+      normalization.root.sourceType_eq generation] using components.2
+  viewResult := by
+    let As := generation.block.checked.params ++
+      generation.block.checked.indices
+    have hlength :
+        candidate.families.singleton.familyType.type.trace.spineLength =
+          As.length := by
+      rw [input.spineLength_eq]
+      simp only [As, List.length_append]
+      rw [generation.shape.2.1, generation.shape.2.2.1]
+    have hview : normalization.family.type.view =
+        generation.block.checked.type.type := by
+      simpa only [NormalizationCandidateSemanticRun.root,
+        CandidateFamilySemanticRun.root, CandidateFamilyRun.view] using
+        (congrArg (fun ty : VInductiveType => ty.type)
+          (normalization.root.familyViewType_eq analysis)).symm
+    rw [hview, generation.block.checked.type_eq, hlength]
+    simpa only [As, VExpr.forallN_append] using
+      generationDropNForallNLength As
+        (.sort generation.block.checked.resultLevel)
+
+/-- Derive one normalized constructor alignment after its positional raw/view
+equalities have been recovered from the analyzer-owned pair list. -/
+private theorem CandidateConstructorSemanticGenerationShape.generationRun
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSource : Constructor}
+    {candidate : AddInductive.CandidateConstructor kernelSource}
+    {raw : VConstVal}
+    {root : CandidateConstructorSemanticRun env Us candidate raw}
+    {ctor : NormalizedCtor}
+    (input : CandidateConstructorSemanticGenerationShape
+      (source := source) env Us root)
+    (raw_eq : ctor.raw = raw)
+    (view_eq : ctor.view.value = root.root.view)
+    (hctor : ctor ∈ generation.block.ctorPairs) :
+    CandidateSemanticNormalizedCtorRun generation.block env Us root ctor where
+  raw_eq := raw_eq
+  view_eq := view_eq
+  storedSpine := input.storedSpine
+  rawTel := by
+    have components := candidateFullTelComponents source.nparams
+      candidate.type.trace.spineLength raw.type input.spineLength_eq
+    simpa only [NormalizedCtor.declaredBinders,
+      NormalizedCtor.rawFields, raw_eq] using components.1
+  rawResult := by
+    have components := candidateFullTelComponents source.nparams
+      candidate.type.trace.spineLength raw.type input.spineLength_eq
+    simpa only [NormalizedCtor.rawResult, raw_eq] using components.2
+  viewResult := by
+    let As := generation.block.checked.params ++ ctor.view.fields
+    have hlength : candidate.type.trace.spineLength = As.length := by
+      rw [input.spineLength_eq]
+      simp only [As, List.length_append]
+      rw [← raw_eq]
+      have hshape := generation.shape.2.2.2.2.2 ctor hctor
+      simp only [NormalizedCtor.rawFields] at hshape
+      rw [hshape.2.2.1, hshape.2.2.2,
+        generation.shape.1.symm.trans generation.shape.2.1]
+    have viewType_eq : root.type.view = ctor.view.value.type := by
+      exact (congrArg (fun value : VConstVal => value.type) view_eq).symm
+    rw [viewType_eq, generation.viewCtorType_eq hctor, hlength]
+    exact generationDropNForallNLength As _
+
+/-- Recursively align structural constructor inputs with a pair list whose raw
+and checked-value projections are already fixed. -/
+private def
+    CandidateConstructorSemanticGenerationShapeList.generationRuns
+    {source : VInductDecl} {generation : GenerationChecked source}
+    {env : VEnv} {Us : List Name}
+    {kernelSources : List Constructor}
+    {candidates : AddInductive.CandidateList
+      AddInductive.CandidateConstructor kernelSources}
+    {raws : List VConstVal}
+    {roots : CandidateConstructorSemanticListRun env Us candidates raws} :
+    (input : CandidateConstructorSemanticGenerationShapeList
+      source env Us roots) →
+    (ctors : List NormalizedCtor) →
+    (raws_eq : ctors.map (·.raw) = raws) →
+    (views_eq : ctors.map (fun ctor => ctor.view.value) =
+      roots.roots.views) →
+    (membership : ∀ ctor ∈ ctors,
+      ctor ∈ generation.block.ctorPairs) →
+    CandidateSemanticNormalizedCtorListRun generation.block env Us roots ctors
+  | .nil, [], _, _, _ => .nil
+  | .nil, _ :: _, raws_eq, _, _ => by simp at raws_eq
+  | .cons _ _, [], raws_eq, _, _ => by simp at raws_eq
+  | .cons head tail, ctor :: ctors, raws_eq, views_eq, membership => by
+      simp only [List.map_cons, List.cons.injEq] at raws_eq
+      simp only [List.map_cons,
+        CandidateConstructorSemanticListRun.roots,
+        CandidateConstructorListRun.views, List.cons.injEq] at views_eq
+      exact .cons
+        (head.generationRun raws_eq.1 views_eq.1
+          (membership ctor (.head _)))
+        (tail.generationRuns ctors raws_eq.2 views_eq.2
+          (fun ctor hctor => membership ctor (.tail _ hctor)))
+
+/-- Exact analysis determines the complete dependent normalized-constructor
+list from source-indexed semantic roots and their minimal structural shapes. -/
+private def
+    CandidateConstructorSemanticGenerationShapeList.ofAnalysis
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateSemanticRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (input : CandidateConstructorSemanticGenerationShapeList source
+      normalization.family.typeEnv Us normalization.family.constructors)
+    (analysis : normalization.root.normalization.generation? =
+      some generation) :
+    CandidateSemanticNormalizedCtorListRun generation.block
+      normalization.family.typeEnv Us normalization.family.constructors
+      generation.block.ctorPairs := by
+  apply input.generationRuns
+  · simpa only [NormalizationCandidateSemanticRun.root,
+      normalization.root.sourceType_eq generation] using
+      generation.rawCtors_eq
+  · have viewType_eq := normalization.root.familyViewType_eq analysis
+    calc
+      generation.block.ctorPairs.map (fun ctor => ctor.view.value) =
+          generation.block.checked.constructors.map (·.value) := by
+        simpa only [List.map_map, Function.comp_def] using
+          congrArg (List.map (·.value)) generation.viewCtors_eq
+      _ = generation.block.checked.type.ctors := by
+        rw [generation.block.checked.constructors_eq, List.map_map]
+        change generation.block.checked.type.ctors.map (fun c => c) = _
+        exact List.map_id' generation.block.checked.type.ctors
+      _ = normalization.family.root.view.ctors := by
+        simpa only [NormalizationCandidateSemanticRun.root] using
+          congrArg (fun ty : VInductiveType => ty.ctors) viewType_eq
+      _ = normalization.family.constructors.roots.views := rfl
+  · exact fun _ hctor => hctor
+
+/-- Recover every analyzer-owned constructor pairing from the retained
+semantic hierarchy, dependent analysis, and executable structural gate.
+
+This projection deliberately does not require `Checked.WF`: it exposes only
+the exact source/candidate/raw/view alignment needed to derive that semantic
+fact in the constructor-validation layer. -/
+def NormalizationCandidateSemanticRun.constructorGenerationRuns
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    (normalization : NormalizationCandidateSemanticRun env Us candidate source)
+    (generation : GenerationChecked source)
+    (analysis : normalization.root.normalization.generation? =
+      some generation)
+    (shape : normalization.generationShape = true) :
+    CandidateSemanticNormalizedCtorListRun generation.block
+      normalization.family.typeEnv Us normalization.family.constructors
+      generation.block.ctorPairs := by
+  simp only [NormalizationCandidateSemanticRun.generationShape,
+    normalizationCandidateGenerationShape, Bool.and_eq_true,
+    beq_iff_eq] at shape
+  exact (CandidateConstructorSemanticGenerationShapeList.ofCheck
+    normalization.family.constructors shape.2).ofAnalysis analysis
+
+/-- Reconstruct the established semantic-generation run from the reduced
+shape boundary.  No raw/view pair or component equation is supplied here. -/
+def GenerationCandidateSemanticShapeRun.run
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateSemanticRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (input : GenerationCandidateSemanticShapeRun normalization generation) :
+    GenerationCandidateSemanticRun normalization generation where
+  analysis := input.analysis
+  checked := input.checked
+  family := input.family.generationRun input.analysis
+  constructors := input.constructors.ofAnalysis input.analysis
+
+/-- Reconstruct well-formedness of the post-family environment from the
+retained pre-family context, candidate raw/view equality, checked family view,
+and exact raw-family insertion.  Fixtures therefore do not supply this semantic
+consequence independently. -/
+theorem GenerationCandidateRun.typeEnv_wf
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    VEnv.WF normalization.family.typeEnv := by
+  have henv : VEnv.WF env := by
+    simpa only [normalization.family.typeRun.venv_eq] using
+      normalization.family.typeRun.contextRun.context.Ewf
+  obtain ⟨_, hfamily⟩ := normalization.family.typeRun.evidence
+  have hview : env.IsType Us.length [] normalization.family.viewType := by
+    simpa only [← generation.block.uvars_eq, normalization.uvars_eq,
+      run.familyView_eq] using run.checked.family_isType
+  have hraw : env.IsType Us.length [] normalization.raw.type :=
+    VEnv.IsType.defeqU_l henv trivial hfamily.isDefEq.toU.symm hview
+  have hrawWF : normalization.raw.toVConstant.WF env := by
+    show env.IsType normalization.raw.uvars [] normalization.raw.type
+    simpa only [normalization.family.uvars_eq] using hraw
+  obtain ⟨ds, hds⟩ := henv
+  exact ⟨.axiom normalization.raw.toVConstVal :: ds,
+    .decl (.axiom hrawWF normalization.family.addType) hds⟩
+
+/-- Type the raw family constant at the analyzer-selected family view in the
+post-family environment.  The proof combines the exact raw insertion, the
+candidate's whole-family equality, and checked family well-formedness once;
+constructors can then share this result. -/
+theorem GenerationCandidateRun.familyConst_hasType
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    normalization.family.typeEnv.HasType source.uvars []
+      (.const generation.block.sourceType.name
+        (VLevel.params source.uvars))
+      generation.block.checked.type.type := by
+  have sourceType_eq : generation.block.sourceType = normalization.raw := by
+    have h : [generation.block.sourceType] = [normalization.raw] :=
+      generation.block.source_types_eq.symm.trans normalization.raw_types_eq
+    injection h
+  have hlookup : normalization.family.typeEnv.constants
+      normalization.raw.name = some normalization.raw.toVConstant :=
+    VEnv.addConst_self normalization.family.addType
+  have hconstRaw := VEnv.HasType.const0 hlookup
+    (run.typeEnv_wf.ordered.constWF hlookup)
+  have hconstRaw' : normalization.family.typeEnv.HasType Us.length []
+      (.const normalization.raw.name (VLevel.params Us.length))
+      normalization.raw.type := by
+    simpa only [normalization.family.uvars_eq] using hconstRaw
+  obtain ⟨_, hfamily⟩ := normalization.family.typeRun.evidence
+  have hchecked := run.checked.mono
+    (VEnv.addConst_le normalization.family.addType)
+  have hviewType : normalization.family.typeEnv.IsType Us.length []
+      normalization.family.viewType := by
+    simpa only [← generation.block.uvars_eq, normalization.uvars_eq,
+      run.familyView_eq] using hchecked.family_isType
+  obtain ⟨_, hviewType⟩ := hviewType
+  have hfamilyExact :=
+    (hfamily.isDefEq.toU.mono
+      (VEnv.addConst_le normalization.family.addType)).of_r
+        run.typeEnv_wf trivial hviewType
+  have hconstView : normalization.family.typeEnv.HasType Us.length []
+      (.const normalization.raw.name (VLevel.params Us.length))
+      normalization.family.viewType :=
+    hfamilyExact.defeq hconstRaw'
+  simpa only [normalization.uvars_eq, sourceType_eq,
+    run.familyView_eq] using hconstView
+
+/-- Assemble the existing checker-side `GenerationRun` entirely from the
+source-indexed normalization candidate and its exact spine certificates. -/
+def GenerationCandidateRun.generationRun
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    GenerationRun generation env := by
+  have familyEvidence := run.family.evidence run.familyView_eq
+  have familyParams : TypeChecker.TelDefEqEvidence env Us.length []
+      generation.block.rawParams generation.block.checked.params := by
+    apply TypeChecker.TelDefEqEvidence.ofTelDefEq
+    simpa [generation.shape.2.1] using
+      familyEvidence.telescope.telDefEq.take
+        generation.block.rawParams.length
+  have familyParamsTypeEnv := familyParams.mono
+    (VEnv.addConst_le normalization.family.addType)
+  have sourceType_eq : generation.block.sourceType = normalization.raw := by
+    have h : [generation.block.sourceType] = [normalization.raw] :=
+      generation.block.source_types_eq.symm.trans normalization.raw_types_eq
+    injection h
+  refine {
+    normalization := by
+      simpa only [run.normalization_eq] using
+        normalization.normalizationRun
+    checked := run.checked
+    familyTel := by
+      simpa only [normalization.uvars_eq] using familyEvidence.telescope
+    familyResult := by
+      simpa only [normalization.uvars_eq, List.append_nil] using
+        familyEvidence.result
+    typeEnv := normalization.family.typeEnv
+    addType := by
+      simpa only [sourceType_eq] using normalization.family.addType
+    constructors := ?_ }
+  apply run.constructors.normalizedCtorRuns run.typeEnv_wf
+    normalization.uvars_eq familyParamsTypeEnv
+    (run.checked.mono (VEnv.addConst_le normalization.family.addType))
+    run.familyConst_hasType (fun _ hctor => hctor)
+  intro ctor hctor
+  exact (generation.shape.2.2.2.2.2 ctor hctor).2.2.1.trans
+    (generation.shape.1.symm.trans generation.shape.2.1)
+
+/-- Public Theory boundary for a complete source-indexed generation
+candidate. -/
+theorem GenerationCandidateRun.wf
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    generation.WF env :=
+  run.generationRun.wf
+
+/-- Complete dependent semantic package for one Verify-side singleton
+candidate.
+
+`kernelSource` and `candidate` retain the exact implementation metadata and
+source-indexed operational trace. `normalization` ties that trace to the raw
+Theory declaration and its reconstructed view. `generation` is the successful
+dependent analysis, and `run` proves that this exact candidate supplies every
+semantic obligation consumed by mixed artifact generation. No independently
+chosen view can be inserted into this package. -/
+structure GenerationCandidatePackage (env : VEnv) (Us : List Name) where
+  kernelSource : InductiveType
+  source : VInductDecl
+  candidate : AddInductive.NormalizationCandidate [kernelSource]
+  normalization : NormalizationCandidateRun env Us candidate source
+  generation : GenerationChecked source
+  run : GenerationCandidateRun normalization generation
+
+/-- Package an already assembled source-indexed candidate run without
+repeating any of its dependent indices at a call site. -/
+def GenerationCandidateRun.package
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation) :
+    GenerationCandidatePackage env Us where
+  kernelSource := kernelSource
+  source := source
+  candidate := candidate
+  normalization := normalization
+  generation := generation
+  run := run
+
+/-- Erase checker and candidate provenance at the consumer boundary. The
+result contains only the Theory generation value and its ordinary semantic
+certificate, which is the complete input of `VEnv.addInductCertified`. -/
+def GenerationCandidatePackage.certificate
+    (package : GenerationCandidatePackage env Us) :
+    package.source.GenerationCertificate env where
+  generation := package.generation
+  wf := package.run.wf
+
+/-- Build the general Verify metadata replay from a candidate package and the
+ordinary implementation-to-Theory insertion witnesses.
+
+The generation value and its semantic proof are not independent inputs: both
+are projected from `package`. The remaining arguments concern only constant
+map alignment and the exact successful transaction states, so a caller cannot
+pair metadata replay with an unrelated normalized view. -/
+def GenerationCandidatePackage.addInductTrace
+    (package : GenerationCandidatePackage env Us)
+    {m₁ m₂ : ConstMap} {env₂ : VEnv}
+    (typeMap : ConstMap) (typeEnv : VEnv)
+    (ctorMap : ConstMap) (ctorEnv recEnv : VEnv)
+    (addType : AddInductConstant .induct m₁ env
+      package.generation.block.sourceType.toVConstVal typeMap typeEnv)
+    (addCtors : AddInductConstants .ctor typeMap typeEnv
+      package.generation.block.sourceType.ctors ctorMap ctorEnv)
+    (addRec : AddInductConstant .recursor ctorMap ctorEnv
+      (inductGenerationRecVal package.generation) m₂ recEnv)
+    (recK : RecursorKMatches addRec.info package.generation.kTarget)
+    (addRules : AddDefEqs recEnv
+      package.generation.generatedRules env₂) :
+    AddInductTrace m₁ env package.source m₂ env₂ where
+  generation := package.generation
+  generation_wf := package.certificate.wf
+  typeMap := typeMap
+  typeEnv := typeEnv
+  ctorMap := ctorMap
+  ctorEnv := ctorEnv
+  recEnv := recEnv
+  addType := addType
+  addCtors := addCtors
+  addRec := addRec
+  recK := recK
+  addRules := addRules
+
+/-- Optional outer provenance for packages obtained by the executable
+metadata pass itself. Keeping the exact producer equation separate from the
+semantic package makes the trust boundary explicit: computation selects the
+candidate, while `GenerationCandidateRun` alone grants it Theory meaning. -/
+structure ProducedGenerationCandidatePackage
+    (env : VEnv) (Us : List Name) where
+  package : GenerationCandidatePackage env Us
+  context : AddInductive.Context
+  nparams : Nat
+  numNested : Nat
+  isUnsafe : Bool
+  produced :
+    AddInductive.buildNormalizationCandidate nparams
+        [package.kernelSource] numNested isUnsafe context =
+      .ok package.candidate
+
+/-- Attach exact executable provenance to an already verified singleton
+generation run.
+
+Both premises are indexed by the same kernel source and dependent candidate:
+the executable equation therefore cannot be reused for a different semantic
+run, reordered constructor list, or caller-selected view.  Conversely, the
+equation supplies no semantic authority by itself; all Theory meaning remains
+in `run`. -/
+def GenerationCandidateRun.producedPackage
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateRun normalization generation)
+    (context : AddInductive.Context)
+    (nparams numNested : Nat) (isUnsafe : Bool)
+    (produced :
+      AddInductive.buildNormalizationCandidate nparams
+          [kernelSource] numNested isUnsafe context = .ok candidate) :
+    ProducedGenerationCandidatePackage env Us where
+  package := run.package
+  context := context
+  nparams := nparams
+  numNested := numNested
+  isUnsafe := isUnsafe
+  produced := produced
+
+/-- Package the no-parallel-run semantic assembler at the existing public
+boundary. -/
+def GenerationCandidateSemanticRun.package
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateSemanticRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateSemanticRun normalization generation) :
+    GenerationCandidatePackage env Us :=
+  run.run.package
+
+/-- Attach the exact successful outer metadata call directly to a retained
+semantic-generation owner. -/
+def GenerationCandidateSemanticRun.producedPackage
+    {env : VEnv} {Us : List Name}
+    {kernelSource : InductiveType} {source : VInductDecl}
+    {candidate : AddInductive.NormalizationCandidate [kernelSource]}
+    {normalization : NormalizationCandidateSemanticRun env Us candidate source}
+    {generation : GenerationChecked source}
+    (run : GenerationCandidateSemanticRun normalization generation)
+    (context : AddInductive.Context)
+    (nparams numNested : Nat) (isUnsafe : Bool)
+    (produced :
+      AddInductive.buildNormalizationCandidate nparams
+          [kernelSource] numNested isUnsafe context = .ok candidate) :
+    ProducedGenerationCandidatePackage env Us :=
+  run.run.producedPackage context nparams numNested isUnsafe produced
+
+/-
+The evidence types mention exact verifier executions, so the semantic
+interpretation roots below intentionally inherit the same transitional Verify
+closure as `WhnfRun.isDefEq`. Exact guards ensure that the generic assembler
+does not silently widen it. Theory-only helper closures are guarded by
+`Tests.TheoryConsumerSurface` without importing Verify.
+-/
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.AddInductConstant.safePrimitives [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.context_env [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.context_lctx [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.context_safety [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.context_lparams [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.context_fuel [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.view_isType_of_terminalSort [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprSemanticRootRun.source_isType_of_terminalSort [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprSemanticRootRun.viewParameters [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprSemanticRootRun.viewIndices [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateFamilyStagedInput [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateFamilyStagedInput.rawWF [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateFamilyStagedInput.postContext [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateFamilyStagedInput.postContextRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateFamilyStagedInput.postFamily [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprSemanticRootInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateConstructorSemanticListInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateSemanticInput.exists_ofProduced [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidateSemanticInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateFamilySemanticGenerationRun.run [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateSemanticNormalizedCtorListRun.run [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateSemanticRun.run [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateSemanticShapeRun.run [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.candidateConstructorSemanticGenerationShape [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.normalizationCandidateGenerationShape [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateConstructorSemanticGenerationShapeList.ofCheck [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateSemanticRun.generationShape [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.produceGenerationShapeCandidate [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.produceGenerationShapeCandidate_eq_ok [propext, Classical.choice, Quot.sound]
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateSemanticRun.package [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateSemanticRun.producedPackage [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.VState.WF.empty_of_reserves [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.candidateFreshFVarId_reserved [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.root [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Syntax.structEq_eq]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateContextRun.pushLocalDecl [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.eqv_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.Syntax.structEq_eq,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.candidateCheckTypeStep_exists_translation [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.IsDefEqRun.ofCandidateStep [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.IsDefEqRun.isDefEqU [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.candidateTypeAnnotation_fvarsIn []
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.candidateTypeAnnotation_exists_translation [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.exists_ofCandidate [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.exists_ofCandidateFVars [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.WhnfRun.ofCandidateStep [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CheckTypeRun.ofCandidateStep [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateNodeRun.ofCandidate [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateNodeRun.exists_ofCandidate [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateNodeRun.evidence [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.evidence [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.source_tr [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.view_tr [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRootRun.evidence [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.TelDefEqEvidence.telDefEq [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.TelDefEqEvidence.ofTelDefEq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.TelResultDefEqEvidence.replacePrefix [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprRun.spineEvidence [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.CandidateExprSpineRun.evidenceAt [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.normalization_eq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateRun.sourceType_eq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateRun.familyViewType_eq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.familyView_eq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.typeEnv_wf [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.familyConst_hasType [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateNormalizedCtorRun.rightType_ofChecked [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateNormalizedCtorRun.viewTel_eq [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateNormalizedCtorRun.normalizedCtorRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.wf [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateConstructorListRun.sameHeaders [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateConstructorListRun.evidence [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateRun.normalization [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateRun.normalizationRun [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizedCtorRun.wf [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationRun.wf [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.package [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidateRun.producedPackage [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidatePackage.certificate [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.GenerationCandidatePackage.addInductTrace [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.StagedNormalizationCandidateSemanticInput.constructorValidation_run [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationBlockRun.wf [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateBlockFamilySemanticListRun.sameHeaders [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateBlockFamilySemanticListRun.evidence [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateBlockFamilySemanticInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.CandidateBlockFamilySemanticListInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateBlockSemanticInput.exists [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.VInductDecl.NormalizationCandidateBlockSemanticInput.exists_ofProduced [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+
+end VInductDecl
+
+end Ix.Theory.Named
diff --git a/Ix/Theory/Named/Verify/Environment/NormalizationMatrix.lean b/Ix/Theory/Named/Verify/Environment/NormalizationMatrix.lean
new file mode 100644
index 000000000..4c68f01b9
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/NormalizationMatrix.lean
@@ -0,0 +1,749 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.InductiveFixtures
+
+open Ix.Theory (VLevel)
+
+/-!
+# Normalization differential matrix
+
+Executable and semantic replay for the Spec-04 matrix.  The fixture deliberately
+places reducible aliases at every inductive-analysis boundary, including a
+Pi-producing alias around a recursive target.  This file observes the actual
+kernel declarations, pins the exact analyzer output and its fuel boundary, and
+then translates the same declarations into the Theory environment.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+
+open Lean Meta
+open Ix.Theory.Named.InductiveFixtures
+
+/-! ## Actual kernel metadata and executable analysis -/
+
+def matrixBetaKernelDef : DefinitionVal := kernelDefVal% MatrixBetaAlias
+def matrixLetKernelDef : DefinitionVal := kernelDefVal% MatrixLetAlias
+def matrixPiKernelDef : DefinitionVal := kernelDefVal% MatrixPiAlias
+def matrixIndexKernelDef : DefinitionVal := kernelDefVal% MatrixIndexAlias
+
+def matrixBetaInfo : ConstantInfo := .defnInfo matrixBetaKernelDef
+def matrixLetInfo : ConstantInfo := .defnInfo matrixLetKernelDef
+def matrixPiInfo : ConstantInfo := .defnInfo matrixPiKernelDef
+def matrixIndexInfo : ConstantInfo := .defnInfo matrixIndexKernelDef
+
+def matrixRecMap : ConstMap :=
+  typeFamilyAliasMap.insert ``RecAlias recAliasInfo
+
+def matrixBetaMap : ConstMap :=
+  matrixRecMap.insert ``MatrixBetaAlias matrixBetaInfo
+
+def matrixLetMap : ConstMap :=
+  matrixBetaMap.insert ``MatrixLetAlias matrixLetInfo
+
+def matrixPiMap : ConstMap :=
+  matrixLetMap.insert ``MatrixPiAlias matrixPiInfo
+
+def matrixAliasMap : ConstMap :=
+  matrixPiMap.insert ``MatrixIndexAlias matrixIndexInfo
+
+theorem matrixRec_fresh :
+    typeFamilyAliasMap.find? ``RecAlias = none := by
+  rw [typeFamilyAliasMap, SMap.WF.find?_insert
+    (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem matrixRecMap_wf : matrixRecMap.WF :=
+  typeFamilyAliasMap_wf.insert _ _ matrixRec_fresh
+
+theorem matrixBeta_fresh :
+    matrixRecMap.find? ``MatrixBetaAlias = none := by
+  rw [matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem matrixBetaMap_wf : matrixBetaMap.WF :=
+  matrixRecMap_wf.insert _ _ matrixBeta_fresh
+
+theorem matrixLet_fresh :
+    matrixBetaMap.find? ``MatrixLetAlias = none := by
+  rw [matrixBetaMap, matrixRecMap_wf.find?_insert,
+    matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem matrixLetMap_wf : matrixLetMap.WF :=
+  matrixBetaMap_wf.insert _ _ matrixLet_fresh
+
+theorem matrixPi_fresh : matrixLetMap.find? ``MatrixPiAlias = none := by
+  rw [matrixLetMap, matrixBetaMap_wf.find?_insert,
+    matrixBetaMap, matrixRecMap_wf.find?_insert,
+    matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem matrixPiMap_wf : matrixPiMap.WF :=
+  matrixLetMap_wf.insert _ _ matrixPi_fresh
+
+theorem matrixIndex_fresh :
+    matrixPiMap.find? ``MatrixIndexAlias = none := by
+  rw [matrixPiMap, matrixLetMap_wf.find?_insert,
+    matrixLetMap, matrixBetaMap_wf.find?_insert,
+    matrixBetaMap, matrixRecMap_wf.find?_insert,
+    matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem matrixAliasMap_wf : matrixAliasMap.WF :=
+  matrixPiMap_wf.insert _ _ matrixIndex_fresh
+
+def matrixKernelEnv : Kernel.Environment :=
+  Kernel.Environment.ofConstants `_normalizationMatrix matrixAliasMap
+
+def normalizationMatrixInfo : ConstantInfo :=
+  kernelInductInfo% NormalizationMatrix
+
+def normalizationMatrixMkInfo : ConstantInfo :=
+  kernelCtorInfo% NormalizationMatrix.mk
+
+def normalizationMatrixRecInfo : ConstantInfo :=
+  kernelRecInfo% NormalizationMatrix.rec
+
+def normalizationMatrixKernelRuleRhs : VExpr :=
+  kernelRecRuleRhs% NormalizationMatrix.rec 0
+
+def normalizationMatrixKernelCtor : Constructor where
+  name := normalizationMatrixMkInfo.name
+  type := normalizationMatrixMkInfo.type
+
+def normalizationMatrixKernelType : InductiveType where
+  name := normalizationMatrixInfo.name
+  type := normalizationMatrixInfo.type
+  ctors := [normalizationMatrixKernelCtor]
+
+theorem normalizationMatrix_kernel_family_name :
+    normalizationMatrixInfo.name = ``NormalizationMatrix := rfl
+
+theorem normalizationMatrix_kernel_ctor_name :
+    normalizationMatrixMkInfo.name = ``NormalizationMatrix.mk := rfl
+
+theorem normalizationMatrix_kernel_recursor_name :
+    normalizationMatrixRecInfo.name = ``NormalizationMatrix.rec := rfl
+
+theorem normalizationMatrix_kernel_constructor_shape :
+    (match normalizationMatrixMkInfo with
+    | .ctorInfo info => (info.numParams, info.numFields)
+    | _ => (0, 0)) = (1, 8) := rfl
+
+theorem normalizationMatrix_kernel_recursor_shape :
+    (match normalizationMatrixRecInfo with
+    | .recInfo info =>
+      (info.numParams, info.numIndices, info.numMotives,
+        info.numMinors, info.rules.length)
+    | _ => (0, 0, 0, 0, 0)) = (1, 1, 1, 1, 1) := rfl
+
+theorem normalizationMatrix_kernel_rule_exact :
+    normalizationMatrixKernelRuleRhs =
+    normalizationMatrixGenerationChecked.generatedRules[0].rhs := rfl
+
+theorem normalizationMatrix_recursive_positions_exact :
+    normalizationMatrixViewChecked.constructors[0].recursive.map
+      (fun position => (position.fieldIndex, position.binders.length)) =
+        [(4, 0), (5, 1), (6, 0), (7, 0)] := rfl
+
+def matrixCandidateContext (fuel : Nat) : AddInductive.Context where
+  env := matrixKernelEnv
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+  fuel := { inductiveFuel := fuel }
+
+def matrixCandidateAccepted (fuel : Nat) : Bool :=
+  match AddInductive.buildNormalizationCandidate 1
+      [normalizationMatrixKernelType] 0 false (matrixCandidateContext fuel) with
+  | .ok _ => true
+  | .error _ => false
+
+def matrixTargetExpr (alpha index : Expr) : Expr :=
+  .app (.app (.const ``NormalizationMatrix []) alpha)
+    (.app (.const ``MatrixIndexAlias []) index)
+
+def matrixExpectedFamilyView : Expr :=
+  .forallE `alpha (.sort (.succ .zero))
+    (.forallE `index (.sort (.succ .zero))
+      (.sort (.succ (.succ .zero))) .default) .default
+
+def matrixExpectedCtorView : Expr :=
+  .forallE `alpha (.sort (.succ .zero))
+    (.forallE `index (.sort (.succ .zero))
+      (.forallE `ordinary (.sort .zero)
+        (.forallE `beta (.sort .zero)
+          (.forallE `letBound (.sort .zero)
+            (.forallE `direct (matrixTargetExpr (.bvar 4) (.bvar 3))
+              (.forallE `piHidden
+                (.forallE `proof (.sort .zero)
+                  (matrixTargetExpr (.bvar 6) (.bvar 5)) .default)
+                (.forallE `betaRecursive
+                  (matrixTargetExpr (.bvar 6) (.bvar 5))
+                  (.forallE `letRecursive
+                    (matrixTargetExpr (.bvar 7) (.bvar 6))
+                    (matrixTargetExpr (.bvar 8) (.bvar 7)) .default)
+                  .default)
+                .default)
+              .default)
+            .default)
+          .default)
+        .default)
+      .default)
+    .implicit
+
+/-- Binder names are not semantic metadata, so exact executable comparisons
+canonicalize only those names and preserve every other expression node. -/
+def matrixCanonicalExpr : Expr → Expr
+  | .app fn arg => .app (matrixCanonicalExpr fn) (matrixCanonicalExpr arg)
+  | .forallE _ domain body bi =>
+    .forallE `_ (matrixCanonicalExpr domain) (matrixCanonicalExpr body) bi
+  | expr => expr
+
+def matrixCandidateExact (context : AddInductive.Context) : Bool :=
+  match AddInductive.buildNormalizationCandidate 1
+      [normalizationMatrixKernelType] 0 false context with
+  | .ok candidate =>
+      (matrixCanonicalExpr candidate.families.singleton.familyType.type.view).equal
+          (matrixCanonicalExpr matrixExpectedFamilyView) &&
+        match candidate.families.singleton.constructors with
+        | .cons constructor .nil =>
+          (matrixCanonicalExpr constructor.type.view).equal
+            (matrixCanonicalExpr matrixExpectedCtorView)
+  | .error _ => false
+
+#guard matrixCandidateExact (matrixCandidateContext 10)
+#guard matrixCandidateAccepted 10
+#guard !(matrixCandidateAccepted 9)
+
+def matrixOpaquePiAliasInfo : ConstantInfo :=
+  .axiomInfo {
+    name := ``MatrixPiAlias
+    levelParams := matrixPiKernelDef.levelParams
+    type := matrixPiKernelDef.type
+    isUnsafe := false }
+
+def matrixOpaquePiAliasMap : ConstMap :=
+  matrixAliasMap.insert ``MatrixPiAlias matrixOpaquePiAliasInfo
+
+def matrixOpaquePiAliasContext : AddInductive.Context where
+  env := Kernel.Environment.ofConstants `_normalizationMatrixOpaquePi
+    matrixOpaquePiAliasMap
+  lparams := []
+  safety := .safe
+  allowPrimitive := false
+  fuel := { inductiveFuel := 10 }
+
+#guard !(matrixCandidateExact matrixOpaquePiAliasContext)
+
+def matrixNonDefEqCtor : Constructor where
+  name := normalizationMatrixMkInfo.name
+  type := .forallE `alpha (.sort .zero)
+    (matrixTargetExpr (.sort .zero) (.sort .zero)) .implicit
+
+def matrixNonDefEqType : InductiveType :=
+  { normalizationMatrixKernelType with ctors := [matrixNonDefEqCtor] }
+
+#guard match AddInductive.buildNormalizationCandidate 1
+    [matrixNonDefEqType] 0 false (matrixCandidateContext 10) with
+  | .error (.other message) =>
+    message ==
+      "arg #1 of 'Ix.Theory.Named.InductiveFixtures.NormalizationMatrix.mk' does not match inductive datatype parameters"
+  | _ => false
+
+/-! ## Translation of every retained alias -/
+
+def matrixBetaVal : VDefVal where
+  name := ``MatrixBetaAlias
+  uvars := (vconst(type_of% @MatrixBetaAlias) : VConstant).uvars
+  type := (vconst(type_of% @MatrixBetaAlias) : VConstant).type
+  value := matrixBetaAliasDefEq.rhs
+
+def matrixLetVal : VDefVal where
+  name := ``MatrixLetAlias
+  uvars := (vconst(type_of% @MatrixLetAlias) : VConstant).uvars
+  type := (vconst(type_of% @MatrixLetAlias) : VConstant).type
+  value := matrixLetAliasDefEq.rhs
+
+def matrixPiVal : VDefVal where
+  name := ``MatrixPiAlias
+  uvars := (vconst(type_of% @MatrixPiAlias) : VConstant).uvars
+  type := (vconst(type_of% @MatrixPiAlias) : VConstant).type
+  value := matrixPiAliasDefEq.rhs
+
+def matrixIndexVal : VDefVal where
+  name := ``MatrixIndexAlias
+  uvars := (vconst(type_of% @MatrixIndexAlias) : VConstant).uvars
+  type := (vconst(type_of% @MatrixIndexAlias) : VConstant).type
+  value := matrixIndexAliasDefEq.rhs
+
+theorem matrixRecInfo_tr :
+    TrDefVal .safe typeFamilyAliasEnv recAliasInfo recAliasVal :=
+  recAliasInfo_tr.mono
+    ((VEnv.addConst_le (by rfl :
+      VEnv.empty.addConst ``TypeFamilyAlias
+        (vconst(type_of% @TypeFamilyAlias)) =
+          some typeFamilyAliasConstEnv)).trans VEnv.addDefEq_le)
+
+theorem matrixBetaInfo_tr :
+    TrDefVal .safe normalizationMatrixRecAliasEnv
+      matrixBetaInfo matrixBetaVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · have hshape : TrTypeExpr normalizationMatrixRecAliasEnv
+        matrixBetaInfo.levelParams [] matrixBetaInfo.type matrixBetaVal.type := by
+      tr_type_expr_tac
+    exact hshape.to_trExprS normalizationMatrixRecAliasEnv_ordered trivial
+      ⟨_, by type_tac⟩
+  · refine .lam ⟨_, VEnv.HasType.sort (by decide)⟩ (.sort rfl) ?_
+    refine .app
+      (VEnv.HasType.lam
+        (VEnv.HasType.sort (by decide))
+        (VEnv.HasType.bvar .zero))
+      (VEnv.HasType.bvar .zero) ?_ (.bvar rfl)
+    exact .lam ⟨_, VEnv.HasType.sort (by decide)⟩ (.sort rfl) (.bvar rfl)
+
+theorem matrixLetInfo_tr :
+    TrDefVal .safe normalizationMatrixBetaAliasEnv
+      matrixLetInfo matrixLetVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · have hshape : TrTypeExpr normalizationMatrixBetaAliasEnv
+        matrixLetInfo.levelParams [] matrixLetInfo.type matrixLetVal.type := by
+      tr_type_expr_tac
+    exact hshape.to_trExprS normalizationMatrixBetaAliasEnv_ordered trivial
+      ⟨_, by type_tac⟩
+  · refine .lam ⟨_, VEnv.HasType.sort (by decide)⟩ (.sort rfl) ?_
+    exact .letE (by type_tac) (.sort rfl) (.bvar rfl) (.bvar rfl)
+
+theorem matrixPiInfo_tr :
+    TrDefVal .safe normalizationMatrixLetAliasEnv matrixPiInfo matrixPiVal := by
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · have hshape : TrTypeExpr normalizationMatrixLetAliasEnv
+        matrixPiInfo.levelParams [] matrixPiInfo.type matrixPiVal.type := by
+      tr_type_expr_tac
+    exact hshape.to_trExprS normalizationMatrixLetAliasEnv_ordered trivial
+      ⟨_, by type_tac⟩
+  · refine .lam ⟨_, VEnv.HasType.sort (by decide)⟩ (.sort rfl) ?_
+    apply TrExprS.forallE
+    · exact ⟨_, VEnv.HasType.sort (by decide)⟩
+    · exact ⟨.param 0, VEnv.HasType.bvar (.succ .zero)⟩
+    · exact .sort rfl
+    · exact .bvar rfl
+
+theorem matrixIndexInfo_tr :
+    TrDefVal .safe normalizationMatrixPiAliasEnv
+      matrixIndexInfo matrixIndexVal := by
+  have hfamily : normalizationMatrixPiAliasEnv.constants
+      ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+  refine ⟨⟨⟨by decide, rfl, ?_⟩, rfl⟩, ?_⟩
+  · have hshape : TrTypeExpr normalizationMatrixPiAliasEnv
+        matrixIndexInfo.levelParams [] matrixIndexInfo.type matrixIndexVal.type := by
+      tr_type_expr_tac
+    exact hshape.to_trExprS normalizationMatrixPiAliasEnv_ordered trivial
+      ⟨_, by type_tac⟩
+  · refine .lam ⟨_, by type_tac⟩ ?_ (.bvar rfl)
+    exact .const rfl rfl rfl
+
+theorem matrixBetaVal_wf : matrixBetaVal.WF
+    normalizationMatrixRecAliasEnv := by
+  type_tac
+
+theorem matrixLetVal_wf : matrixLetVal.WF
+    normalizationMatrixBetaAliasEnv := by
+  type_tac
+
+theorem matrixPiVal_wf : matrixPiVal.WF
+    normalizationMatrixLetAliasEnv := by
+  apply VEnv.HasType.lam
+  · exact VEnv.HasType.sort (by decide)
+  · apply VEnv.IsDefEq.defeq
+      (VEnv.IsDefEq.sortDF
+        (l := .imax (.succ .zero) (.param 0)) (l' := .param 0)
+        (by decide) (by decide) (by
+          rw [VLevel.equiv_def]
+          intro ls
+          simp only [VLevel.eval, Nat.zero_add]
+          let n := ls.getD 0 0
+          change Nat.imax 1 n = n
+          by_cases h : n = 0
+          · simp [Nat.imax, h]
+          · have hn : 1 ≤ n := Nat.one_le_iff_ne_zero.mpr h
+            simp [Nat.imax, h, Nat.max_eq_right hn]))
+    exact VEnv.HasType.forallE (VEnv.HasType.sort (by decide))
+      (VEnv.HasType.bvar (.succ .zero))
+
+theorem matrixIndexVal_wf : matrixIndexVal.WF
+    normalizationMatrixPiAliasEnv := by
+  have hfamily : normalizationMatrixPiAliasEnv.constants
+      ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+  type_tac
+
+theorem matrixRec_trEnv' :
+    TrEnv' .safe matrixRecMap false normalizationMatrixRecAliasEnv :=
+  .defn (ci := recAliasKernelDef) (ci' := recAliasVal)
+    matrixRecInfo_tr matrixRec_fresh
+    (recAliasVal_wf.mono
+      ((VEnv.addConst_le (by rfl :
+        VEnv.empty.addConst ``TypeFamilyAlias
+          (vconst(type_of% @TypeFamilyAlias)) =
+            some typeFamilyAliasConstEnv)).trans VEnv.addDefEq_le))
+    rfl typeFamilyAlias_trEnv'
+
+theorem matrixBeta_trEnv' :
+    TrEnv' .safe matrixBetaMap false normalizationMatrixBetaAliasEnv :=
+  .defn (ci := matrixBetaKernelDef) (ci' := matrixBetaVal)
+    matrixBetaInfo_tr matrixBeta_fresh matrixBetaVal_wf rfl matrixRec_trEnv'
+
+theorem matrixLet_trEnv' :
+    TrEnv' .safe matrixLetMap false normalizationMatrixLetAliasEnv :=
+  .defn (ci := matrixLetKernelDef) (ci' := matrixLetVal)
+    matrixLetInfo_tr matrixLet_fresh matrixLetVal_wf rfl matrixBeta_trEnv'
+
+theorem matrixPi_trEnv' :
+    TrEnv' .safe matrixPiMap false normalizationMatrixPiAliasEnv :=
+  .defn (ci := matrixPiKernelDef) (ci' := matrixPiVal)
+    matrixPiInfo_tr matrixPi_fresh matrixPiVal_wf rfl matrixLet_trEnv'
+
+theorem matrixAlias_trEnv' :
+    TrEnv' .safe matrixAliasMap false normalizationMatrixAliasEnv :=
+  .defn (ci := matrixIndexKernelDef) (ci' := matrixIndexVal)
+    matrixIndexInfo_tr matrixIndex_fresh matrixIndexVal_wf rfl matrixPi_trEnv'
+
+/-! ## Replay of the actual inductive transaction -/
+
+def normalizationMatrixTypeEnv : VEnv :=
+  (normalizationMatrixAliasEnv.addConst normalizationMatrixRawType.name
+    normalizationMatrixRawType.toVConstant).get (by decide)
+
+def normalizationMatrixCtorEnv : VEnv :=
+  (normalizationMatrixTypeEnv.addConst
+    normalizationMatrixRawType.ctors[0].name
+    normalizationMatrixRawType.ctors[0].toVConstant).get (by decide)
+
+def normalizationMatrixRecEnv : VEnv :=
+  (normalizationMatrixCtorEnv.addConst ``NormalizationMatrix.rec
+    normalizationMatrixGenerationChecked.recursor).get (by decide)
+
+theorem normalizationMatrixTypeEnv_ordered :
+    normalizationMatrixTypeEnv.Ordered := by
+  refine .const (n := normalizationMatrixRawType.name)
+    (ci := normalizationMatrixRawType.toVConstant)
+    normalizationMatrixAliasEnv_ordered ?_ rfl
+  show normalizationMatrixAliasEnv.IsType
+    normalizationMatrixGenerationChecked.block.sourceType.uvars []
+    normalizationMatrixGenerationChecked.block.sourceType.type
+  rw [normalizationMatrixGenerationChecked.block.sourceType_uvars_eq]
+  exact normalizationMatrixGenerationChecked_wf.rawFamily_isType
+
+theorem normalizationMatrixRawCtor_wf :
+    normalizationMatrixRawType.ctors[0].toVConstant.WF
+      normalizationMatrixTypeEnv := by
+  have hctor :
+      (⟨normalizationMatrixRawType.ctors[0],
+        normalizationMatrixViewChecked.constructors[0]⟩ :
+          VInductDecl.NormalizedCtor) ∈
+        normalizationMatrixGenerationChecked.block.ctorPairs := by
+    exact .head _
+  show normalizationMatrixTypeEnv.IsType
+    normalizationMatrixRawType.ctors[0].uvars []
+    normalizationMatrixRawType.ctors[0].type
+  rw [normalizationMatrixGenerationChecked.ctor_uvars_eq hctor]
+  exact normalizationMatrixGenerationChecked_wf.rawCtor_isType rfl hctor
+
+theorem normalizationMatrixCtorEnv_ordered :
+    normalizationMatrixCtorEnv.Ordered :=
+  .const (n := normalizationMatrixRawType.ctors[0].name)
+    (ci := normalizationMatrixRawType.ctors[0].toVConstant)
+    normalizationMatrixTypeEnv_ordered normalizationMatrixRawCtor_wf rfl
+
+theorem normalizationMatrixGenerationEnv :
+    VInductDecl.GenerationEnv normalizationMatrixGenerationChecked
+      normalizationMatrixCtorEnv := by
+  apply normalizationMatrixGenerationChecked_wf.toGenerationEnv
+    (envT := normalizationMatrixTypeEnv)
+  · rfl
+  · exact (VEnv.addConst_le (show
+      normalizationMatrixAliasEnv.addConst normalizationMatrixRawType.name
+        normalizationMatrixRawType.toVConstant =
+          some normalizationMatrixTypeEnv from rfl)).trans
+      (VEnv.addConst_le (show
+        normalizationMatrixTypeEnv.addConst
+          normalizationMatrixRawType.ctors[0].name
+          normalizationMatrixRawType.ctors[0].toVConstant =
+            some normalizationMatrixCtorEnv from rfl))
+  · exact VEnv.addConst_le (show
+      normalizationMatrixTypeEnv.addConst
+        normalizationMatrixRawType.ctors[0].name
+        normalizationMatrixRawType.ctors[0].toVConstant =
+          some normalizationMatrixCtorEnv from rfl)
+  · exact normalizationMatrixCtorEnv_ordered
+  · rfl
+  · intro ctor hctor
+    change ctor ∈
+      [⟨normalizationMatrixRawType.ctors[0],
+        normalizationMatrixViewChecked.constructors[0]⟩] at hctor
+    obtain rfl := List.mem_singleton.1 hctor
+    rfl
+
+theorem normalizationMatrixInfo_tr :
+    TrConstVal .safe normalizationMatrixAliasEnv normalizationMatrixInfo
+      normalizationMatrixRawType.toVConstVal := by
+  have hTypeFamily : normalizationMatrixAliasEnv.constants
+      ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr normalizationMatrixAliasEnv
+      normalizationMatrixInfo.levelParams [] normalizationMatrixInfo.type
+      normalizationMatrixRawType.type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ :=
+    normalizationMatrixGenerationChecked_wf.rawFamily_isType
+  exact hshape.to_trExprS normalizationMatrixAliasEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+theorem normalizationMatrixMkInfo_tr :
+    TrConstVal .safe normalizationMatrixTypeEnv normalizationMatrixMkInfo
+      normalizationMatrixRawType.ctors[0] := by
+  have hTypeFamily : normalizationMatrixTypeEnv.constants
+      ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+  have hRecAlias : normalizationMatrixTypeEnv.constants
+      ``RecAlias = some (vconst(type_of% @RecAlias)) := rfl
+  have hBetaAlias : normalizationMatrixTypeEnv.constants
+      ``MatrixBetaAlias = some (vconst(type_of% @MatrixBetaAlias)) := rfl
+  have hLetAlias : normalizationMatrixTypeEnv.constants
+      ``MatrixLetAlias = some (vconst(type_of% @MatrixLetAlias)) := rfl
+  have hPiAlias : normalizationMatrixTypeEnv.constants
+      ``MatrixPiAlias = some (vconst(type_of% @MatrixPiAlias)) := rfl
+  have hIndexAlias : normalizationMatrixTypeEnv.constants
+      ``MatrixIndexAlias = some (vconst(type_of% @MatrixIndexAlias)) := rfl
+  have hFamily : normalizationMatrixTypeEnv.constants
+      ``NormalizationMatrix = some normalizationMatrixRawType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr normalizationMatrixTypeEnv
+      normalizationMatrixMkInfo.levelParams [] normalizationMatrixMkInfo.type
+      normalizationMatrixRawType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨u, htype⟩ := normalizationMatrixRawCtor_wf
+  exact hshape.to_trExprS normalizationMatrixTypeEnv_ordered trivial
+    ⟨.sort u, htype⟩
+
+theorem normalizationMatrixRecInfo_tr :
+    TrConstVal .safe normalizationMatrixCtorEnv normalizationMatrixRecInfo
+      (inductGenerationRecVal normalizationMatrixGenerationChecked) := by
+  have hTypeFamily : normalizationMatrixCtorEnv.constants
+      ``TypeFamilyAlias = some (vconst(type_of% @TypeFamilyAlias)) := rfl
+  have hIndexAlias : normalizationMatrixCtorEnv.constants
+      ``MatrixIndexAlias = some (vconst(type_of% @MatrixIndexAlias)) := rfl
+  have hFamily : normalizationMatrixCtorEnv.constants
+      ``NormalizationMatrix = some normalizationMatrixRawType.toVConstant := rfl
+  have hMk : normalizationMatrixCtorEnv.constants
+      ``NormalizationMatrix.mk =
+        some normalizationMatrixRawType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have hshape : TrTypeExpr normalizationMatrixCtorEnv
+      normalizationMatrixRecInfo.levelParams [] normalizationMatrixRecInfo.type
+      (inductGenerationRecVal normalizationMatrixGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨u, hrec⟩ := normalizationMatrixGenerationEnv.recursor_wf
+  exact hshape.to_trExprS normalizationMatrixCtorEnv_ordered trivial
+    ⟨.sort u, hrec⟩
+
+def normalizationMatrixTypeMap : ConstMap :=
+  matrixAliasMap.insert ``NormalizationMatrix normalizationMatrixInfo
+
+def normalizationMatrixCtorMap : ConstMap :=
+  normalizationMatrixTypeMap.insert ``NormalizationMatrix.mk
+    normalizationMatrixMkInfo
+
+def normalizationMatrixMap : ConstMap :=
+  normalizationMatrixCtorMap.insert ``NormalizationMatrix.rec
+    normalizationMatrixRecInfo
+
+theorem normalizationMatrixType_fresh :
+    matrixAliasMap.find? ``NormalizationMatrix = none := by
+  rw [matrixAliasMap, matrixPiMap_wf.find?_insert,
+    matrixPiMap, matrixLetMap_wf.find?_insert,
+    matrixLetMap, matrixBetaMap_wf.find?_insert,
+    matrixBetaMap, matrixRecMap_wf.find?_insert,
+    matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem normalizationMatrixTypeMap_wf : normalizationMatrixTypeMap.WF :=
+  matrixAliasMap_wf.insert _ _ normalizationMatrixType_fresh
+
+theorem normalizationMatrixMk_fresh :
+    normalizationMatrixTypeMap.find? ``NormalizationMatrix.mk = none := by
+  rw [normalizationMatrixTypeMap, matrixAliasMap_wf.find?_insert,
+    matrixAliasMap, matrixPiMap_wf.find?_insert,
+    matrixPiMap, matrixLetMap_wf.find?_insert,
+    matrixLetMap, matrixBetaMap_wf.find?_insert,
+    matrixBetaMap, matrixRecMap_wf.find?_insert,
+    matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem normalizationMatrixCtorMap_wf : normalizationMatrixCtorMap.WF :=
+  normalizationMatrixTypeMap_wf.insert _ _ normalizationMatrixMk_fresh
+
+theorem normalizationMatrixRec_fresh :
+    normalizationMatrixCtorMap.find? ``NormalizationMatrix.rec = none := by
+  rw [normalizationMatrixCtorMap,
+    normalizationMatrixTypeMap_wf.find?_insert,
+    normalizationMatrixTypeMap, matrixAliasMap_wf.find?_insert,
+    matrixAliasMap, matrixPiMap_wf.find?_insert,
+    matrixPiMap, matrixLetMap_wf.find?_insert,
+    matrixLetMap, matrixBetaMap_wf.find?_insert,
+    matrixBetaMap, matrixRecMap_wf.find?_insert,
+    matrixRecMap, typeFamilyAliasMap_wf.find?_insert,
+    typeFamilyAliasMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+private def normalizationMatrixAddInductTraceWith
+    (generation_wf :
+      normalizationMatrixGenerationChecked.WF normalizationMatrixAliasEnv) :
+    AddInductTrace matrixAliasMap normalizationMatrixAliasEnv
+      normalizationMatrixRawDecl normalizationMatrixMap
+      normalizationMatrixFinalEnv := by
+  refine {
+    generation := normalizationMatrixGenerationChecked
+    generation_wf := generation_wf
+    typeMap := normalizationMatrixTypeMap
+    typeEnv := normalizationMatrixTypeEnv
+    ctorMap := normalizationMatrixCtorMap
+    ctorEnv := normalizationMatrixCtorEnv
+    recEnv := normalizationMatrixRecEnv
+    addType := {
+      info := normalizationMatrixInfo
+      kind_eq := by simp [normalizationMatrixInfo, InductConstantKind.Matches]
+      tr := normalizationMatrixInfo_tr
+      map_fresh := by
+        change matrixAliasMap.find? ``NormalizationMatrix = none
+        exact normalizationMatrixType_fresh
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := normalizationMatrixRecInfo
+      kind_eq := by
+        simp [normalizationMatrixRecInfo, InductConstantKind.Matches]
+      tr := normalizationMatrixRecInfo_tr
+      map_fresh := by
+        change normalizationMatrixCtorMap.find?
+          ``NormalizationMatrix.rec = none
+        exact normalizationMatrixRec_fresh
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }
+  exact .cons {
+    info := normalizationMatrixMkInfo
+    kind_eq := by
+      simp [normalizationMatrixMkInfo, InductConstantKind.Matches]
+    tr := normalizationMatrixMkInfo_tr
+    map_fresh := by
+      simpa [normalizationMatrixRawType] using normalizationMatrixMk_fresh
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem normalizationMatrix_addInduct :
+    AddInduct matrixAliasMap normalizationMatrixAliasEnv
+      normalizationMatrixRawDecl normalizationMatrixMap
+      normalizationMatrixFinalEnv :=
+  ⟨normalizationMatrixAddInductTraceWith
+    normalizationMatrixGenerationChecked_wf⟩
+
+/-- Actual kernel metadata for the complete matrix is aligned with the Theory
+environment obtained from the semantically checked normalization transaction. -/
+theorem normalizationMatrix_trEnv' :
+    TrEnv' .safe normalizationMatrixMap false normalizationMatrixFinalEnv :=
+  .induct normalizationMatrix_addInduct matrixAlias_trEnv'
+
+theorem normalizationMatrix_final_matches_generation :
+    normalizationMatrixAliasEnv.addInductGeneration
+      normalizationMatrixGenerationChecked =
+        some normalizationMatrixFinalEnv :=
+  normalizationMatrix_addInductGeneration
+
+theorem normalizationMatrix_env_wf : normalizationMatrixFinalEnv.WF :=
+  normalizationMatrix_trEnv'.wf
+
+theorem normalizationMatrix_aligned :
+    Aligned .safe normalizationMatrixMap normalizationMatrixFinalEnv :=
+  normalizationMatrix_trEnv'.aligned
+
+theorem normalizationMatrix_type_map_lookup :
+    normalizationMatrixMap.find? ``NormalizationMatrix =
+      some normalizationMatrixInfo := by
+  rw [normalizationMatrixMap, normalizationMatrixCtorMap_wf.find?_insert,
+    normalizationMatrixCtorMap, normalizationMatrixTypeMap_wf.find?_insert,
+    normalizationMatrixTypeMap, matrixAliasMap_wf.find?_insert]
+  rfl
+
+theorem normalizationMatrix_type_lookup_unique :
+    normalizationMatrixInfo.name = ``NormalizationMatrix ∧
+      TrConstant .safe normalizationMatrixFinalEnv normalizationMatrixInfo
+        normalizationMatrixRawType.toVConstant :=
+  normalizationMatrix_aligned.find?_uniq
+    normalizationMatrix_type_map_lookup
+    normalizationMatrixFinalEnv_family_lookup
+
+theorem normalizationMatrix_mk_map_lookup :
+    normalizationMatrixMap.find? ``NormalizationMatrix.mk =
+      some normalizationMatrixMkInfo := by
+  rw [normalizationMatrixMap, normalizationMatrixCtorMap_wf.find?_insert,
+    normalizationMatrixCtorMap, normalizationMatrixTypeMap_wf.find?_insert]
+  rfl
+
+theorem normalizationMatrix_mk_lookup_unique :
+    normalizationMatrixMkInfo.name = ``NormalizationMatrix.mk ∧
+      TrConstant .safe normalizationMatrixFinalEnv normalizationMatrixMkInfo
+        normalizationMatrixRawType.ctors[0].toVConstant :=
+  normalizationMatrix_aligned.find?_uniq
+    normalizationMatrix_mk_map_lookup
+    normalizationMatrixFinalEnv_ctor_lookup
+
+theorem normalizationMatrix_rec_map_lookup :
+    normalizationMatrixMap.find? ``NormalizationMatrix.rec =
+      some normalizationMatrixRecInfo := by
+  rw [normalizationMatrixMap, normalizationMatrixCtorMap_wf.find?_insert]
+  rfl
+
+theorem normalizationMatrix_rec_lookup_unique :
+    normalizationMatrixRecInfo.name = ``NormalizationMatrix.rec ∧
+      TrConstant .safe normalizationMatrixFinalEnv normalizationMatrixRecInfo
+        normalizationMatrixGenerationChecked.recursor :=
+  normalizationMatrix_aligned.find?_uniq
+    normalizationMatrix_rec_map_lookup
+    normalizationMatrixFinalEnv_rec_lookup
+
+/-! The semantic generation helpers used above are guarded in
+`Theory.Typing.InductiveLemmas`; these two guards pin the separate, now
+`sorryAx`-free Verify closure of metadata translation and final environment
+replay. -/
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.normalizationMatrixInfo_tr [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.normalizationMatrix_trEnv' [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/SingletonParityMatrix.lean b/Ix/Theory/Named/Verify/Environment/SingletonParityMatrix.lean
new file mode 100644
index 000000000..f60012ae8
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/SingletonParityMatrix.lean
@@ -0,0 +1,471 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.SingletonParity
+import Ix.Theory.Named.Verify.Environment.ConstructorValidityMatrix
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesEqNat
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesOrAnd
+import Ix.Theory.Named.Verify.Environment.EliminationFixturesEdges
+import Ix.Theory.Named.Verify.Environment.NormalizationMatrix
+
+/-!
+# Spec-07 complete singleton kernel matrix
+
+The rows below join the single Theory artifact inventory to Lean's actual
+`inductInfo`/`ctorInfo`/`recInfo` records.  The executable predicate compares
+the retained raw types, names, parameter/index and field counts, universe
+order, elimination/K metadata, recursor type, rule count, and every iota RHS.
+It also reruns the ordinary normalization producer on the exact kernel source.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+
+open Lean Meta Elab Term
+open Ix.Theory.Named.InductiveFixtures
+
+/-! ## Exact conversion of stored kernel types -/
+
+syntax "kernelConstVType%" ident : term
+
+/-- Quote the stored `ConstantInfo.type` using that record's own universe
+parameter order.  Unlike `vconst(type_of% ...)`, this observes the raw kernel
+record directly. -/
+elab_rules : term
+  | `(kernelConstVType% $n:ident) => do
+    let name ← realizeGlobalConstNoOverloadWithInfo n
+    let info ← getConstInfo name
+    let type ← Ix.Theory.Named.Meta.expandExpr info.type
+    let type ← Ix.Theory.Named.Meta.ofExpr info.levelParams {} type
+    return toExpr type
+
+/-! ## Missing standard-library metadata rows -/
+
+def boolInfo07 : ConstantInfo := kernelInductInfo% Bool
+def boolFalseInfo07 : ConstantInfo := kernelCtorInfo% Bool.false
+def boolTrueInfo07 : ConstantInfo := kernelCtorInfo% Bool.true
+def boolRecInfo07 : ConstantInfo := kernelRecInfo% Bool.rec
+def boolFalseRuleRhs07 : VExpr := kernelRecRuleRhs% Bool.rec 0
+def boolTrueRuleRhs07 : VExpr := kernelRecRuleRhs% Bool.rec 1
+
+def listInfo07 : ConstantInfo := kernelInductInfo% List
+def listNilInfo07 : ConstantInfo := kernelCtorInfo% List.nil
+def listConsInfo07 : ConstantInfo := kernelCtorInfo% List.cons
+def listRecInfo07 : ConstantInfo := kernelRecInfo% List.rec
+def listNilRuleRhs07 : VExpr := kernelRecRuleRhs% List.rec 0
+def listConsRuleRhs07 : VExpr := kernelRecRuleRhs% List.rec 1
+
+def optionInfo07 : ConstantInfo := kernelInductInfo% Option
+def optionNoneInfo07 : ConstantInfo := kernelCtorInfo% Option.none
+def optionSomeInfo07 : ConstantInfo := kernelCtorInfo% Option.some
+def optionRecInfo07 : ConstantInfo := kernelRecInfo% Option.rec
+def optionNoneRuleRhs07 : VExpr := kernelRecRuleRhs% Option.rec 0
+def optionSomeRuleRhs07 : VExpr := kernelRecRuleRhs% Option.rec 1
+
+def prodInfo07 : ConstantInfo := kernelInductInfo% Prod
+def prodMkInfo07 : ConstantInfo := kernelCtorInfo% Prod.mk
+def prodRecInfo07 : ConstantInfo := kernelRecInfo% Prod.rec
+def prodRuleRhs07 : VExpr := kernelRecRuleRhs% Prod.rec 0
+
+def heqInfo07 : ConstantInfo := kernelInductInfo% HEq
+def heqReflInfo07 : ConstantInfo := kernelCtorInfo% HEq.refl
+def heqRecInfo07 : ConstantInfo := kernelRecInfo% HEq.rec
+def heqRuleRhs07 : VExpr := kernelRecRuleRhs% HEq.rec 0
+
+def finInfo07 : ConstantInfo := kernelInductInfo% Fin
+def finMkInfo07 : ConstantInfo := kernelCtorInfo% Fin.mk
+def finRecInfo07 : ConstantInfo := kernelRecInfo% Fin.rec
+def finRuleRhs07 : VExpr := kernelRecRuleRhs% Fin.rec 0
+
+def vectorInfo07 : ConstantInfo := kernelInductInfo% Vector
+def vectorMkInfo07 : ConstantInfo := kernelCtorInfo% Vector.mk
+def vectorRecInfo07 : ConstantInfo := kernelRecInfo% Vector.rec
+def vectorRuleRhs07 : VExpr := kernelRecRuleRhs% Vector.rec 0
+
+/-! ## Producer dependency contexts -/
+
+def finDependencyMap07 : ConstMap :=
+  ((((({} : ConstMap).insert ``Nat natInfo).insert ``LT
+    (kernelInductInfo% LT)).insert ``LT.mk
+      (kernelCtorInfo% LT.mk)).insert ``LT.lt
+        (.defnInfo (kernelDefVal% LT.lt))).insert ``instLTNat
+          (.defnInfo (kernelDefVal% instLTNat))
+
+def vectorDependencyMap07 : ConstMap :=
+  (((({} : ConstMap).insert ``Nat natInfo).insert ``Eq eqInfo).insert ``Array
+    (kernelInductInfo% Array)).insert ``Array.size
+      (.defnInfo (kernelDefVal% Array.size))
+
+/-! ## Integrated row type -/
+
+structure SingletonKernelRow where
+  artifact : SingletonParityArtifact
+  inductInfo : ConstantInfo
+  ctorInfos : List ConstantInfo
+  recInfo : ConstantInfo
+  familyType : VExpr
+  ctorTypes : List VExpr
+  recType : VExpr
+  ruleRhs : List VExpr
+  dependencies : ConstMap := {}
+
+namespace SingletonKernelRow
+
+def constructor? : ConstantInfo → Option Constructor
+  | .ctorInfo ctor => some { name := ctor.name, type := ctor.type }
+  | _ => none
+
+def kernelType? (row : SingletonKernelRow) : Option InductiveType := do
+  let .inductInfo induct := row.inductInfo | none
+  let ctors ← row.ctorInfos.mapM constructor?
+  some { name := induct.name, type := induct.type, ctors := ctors }
+
+def context (row : SingletonKernelRow) : AddInductive.Context where
+  env := Kernel.Environment.ofConstants
+    (.str `_singletonParity row.artifact.label.toString) row.dependencies
+  lparams := row.inductInfo.levelParams
+  safety := .safe
+  allowPrimitive := row.artifact.typeName == ``Nat ||
+    row.artifact.typeName == ``Bool
+
+def producerAccepted (row : SingletonKernelRow) : Bool :=
+  match row.kernelType? with
+  | none => false
+  | some kernelType =>
+      match AddInductive.buildNormalizationCandidate
+          row.artifact.source.nparams [kernelType] 0 false row.context with
+      | .ok _ => true
+      | .error _ => false
+
+def ctorMatches (row : SingletonKernelRow) (info : ConstantInfo)
+    (raw : VConstVal) (rawType : VExpr) : Bool :=
+  match info with
+  | .ctorInfo ctor =>
+      ctor.name == raw.name &&
+        ctor.levelParams.length == row.artifact.source.uvars &&
+        ctor.induct == row.artifact.typeName &&
+        ctor.numParams == row.artifact.source.nparams &&
+        ctor.numFields == (VInductDecl.ctorFields
+          (VExpr.dropN row.artifact.source.nparams raw.type)).length &&
+        !ctor.isUnsafe && rawType == raw.type
+  | _ => false
+
+def constructorsMatch (row : SingletonKernelRow) :
+    List ConstantInfo → List VConstVal → List VExpr → Bool
+  | [], [], [] => true
+  | info :: infos, raw :: raws, rawType :: rawTypes =>
+      row.ctorMatches info raw rawType &&
+        row.constructorsMatch infos raws rawTypes
+  | _, _, _ => false
+
+def recursorMatches (row : SingletonKernelRow) : Bool :=
+  match row.recInfo with
+  | .recInfo rec =>
+      rec.name == .str row.artifact.typeName "rec" &&
+        rec.levelParams.length == row.artifact.generation.recUvars &&
+        rec.all == [row.artifact.typeName] &&
+        rec.numParams == row.artifact.source.nparams &&
+        rec.numIndices ==
+          row.artifact.generation.block.checked.indices.length &&
+        rec.numMotives == 1 &&
+        rec.numMinors ==
+          row.artifact.generation.block.sourceType.ctors.length &&
+        rec.k == row.artifact.generation.kTarget &&
+        !rec.isUnsafe &&
+        rec.rules.map (fun rule => (rule.ctor, rule.nfields)) ==
+          row.artifact.generation.block.sourceType.ctors.map (fun ctor =>
+            (ctor.name, (VInductDecl.ctorFields
+              (VExpr.dropN row.artifact.source.nparams ctor.type)).length)) &&
+        row.recType == row.artifact.generation.recursor.type &&
+        row.ruleRhs ==
+          row.artifact.generation.generatedRules.map (·.rhs)
+  | _ => false
+
+/-- Exact fixed-row agreement after binder-name erasure.  Universe order is
+still observed: `familyType`/`ctorTypes`/`recType` were converted with the
+stored metadata parameter lists, not with elaborator-inferred ordering. -/
+def agrees (row : SingletonKernelRow) : Bool :=
+  match row.inductInfo with
+  | .inductInfo induct =>
+      induct.name == row.artifact.typeName &&
+        induct.levelParams.length == row.artifact.source.uvars &&
+        induct.numParams == row.artifact.source.nparams &&
+        induct.numIndices ==
+          row.artifact.generation.block.checked.indices.length &&
+        induct.all == [row.artifact.typeName] &&
+        induct.ctors == row.artifact.constructorNames &&
+        induct.numNested == 0 && !induct.isUnsafe &&
+        row.familyType == row.artifact.generation.block.sourceType.type &&
+        row.constructorsMatch row.ctorInfos
+          row.artifact.generation.block.sourceType.ctors row.ctorTypes &&
+        row.recursorMatches
+  | _ => false
+
+end SingletonKernelRow
+
+/-! ## The fixed rows -/
+
+def singletonKernelRows : List SingletonKernelRow :=
+  [ { artifact := singletonPositiveArtifacts[0]
+      inductInfo := natInfo
+      ctorInfos := [natZeroInfo, natSuccInfo]
+      recInfo := natRecInfo
+      familyType := kernelConstVType% Nat
+      ctorTypes := [kernelConstVType% Nat.zero, kernelConstVType% Nat.succ]
+      recType := kernelConstVType% Nat.rec
+      ruleRhs := [natZeroKernelRuleRhs, natSuccKernelRuleRhs] },
+    { artifact := singletonPositiveArtifacts[1]
+      inductInfo := boolInfo07
+      ctorInfos := [boolFalseInfo07, boolTrueInfo07]
+      recInfo := boolRecInfo07
+      familyType := kernelConstVType% Bool
+      ctorTypes := [kernelConstVType% Bool.false, kernelConstVType% Bool.true]
+      recType := kernelConstVType% Bool.rec
+      ruleRhs := [boolFalseRuleRhs07, boolTrueRuleRhs07] },
+    { artifact := singletonPositiveArtifacts[2]
+      inductInfo := listInfo07
+      ctorInfos := [listNilInfo07, listConsInfo07]
+      recInfo := listRecInfo07
+      familyType := kernelConstVType% List
+      ctorTypes := [kernelConstVType% List.nil, kernelConstVType% List.cons]
+      recType := kernelConstVType% List.rec
+      ruleRhs := [listNilRuleRhs07, listConsRuleRhs07] },
+    { artifact := singletonPositiveArtifacts[3]
+      inductInfo := optionInfo07
+      ctorInfos := [optionNoneInfo07, optionSomeInfo07]
+      recInfo := optionRecInfo07
+      familyType := kernelConstVType% Option
+      ctorTypes := [kernelConstVType% Option.none,
+        kernelConstVType% Option.some]
+      recType := kernelConstVType% Option.rec
+      ruleRhs := [optionNoneRuleRhs07, optionSomeRuleRhs07] },
+    { artifact := singletonPositiveArtifacts[4]
+      inductInfo := prodInfo07
+      ctorInfos := [prodMkInfo07]
+      recInfo := prodRecInfo07
+      familyType := kernelConstVType% Prod
+      ctorTypes := [kernelConstVType% Prod.mk]
+      recType := kernelConstVType% Prod.rec
+      ruleRhs := [prodRuleRhs07] },
+    { artifact := singletonPositiveArtifacts[5]
+      inductInfo := punitInfo06C
+      ctorInfos := [punitCtorInfo06C]
+      recInfo := punitRecInfo06C
+      familyType := kernelConstVType% PUnit
+      ctorTypes := [kernelConstVType% PUnit.unit]
+      recType := kernelConstVType% PUnit.rec
+      ruleRhs := [punitRuleRhs06C] },
+    { artifact := singletonPositiveArtifacts[6]
+      inductInfo := emptyInfo06C
+      ctorInfos := []
+      recInfo := emptyRecInfo06C
+      familyType := kernelConstVType% Empty
+      ctorTypes := []
+      recType := kernelConstVType% Empty.rec
+      ruleRhs := [] },
+    { artifact := singletonPositiveArtifacts[7]
+      inductInfo := orInfo06
+      ctorInfos := [orInlInfo06, orInrInfo06]
+      recInfo := orRecInfo06
+      familyType := kernelConstVType% Or
+      ctorTypes := [kernelConstVType% Or.inl, kernelConstVType% Or.inr]
+      recType := kernelConstVType% Or.rec
+      ruleRhs := [orInlKernelRuleRhs06, orInrKernelRuleRhs06] },
+    { artifact := singletonPositiveArtifacts[8]
+      inductInfo := andInfo06
+      ctorInfos := [andIntroInfo06]
+      recInfo := andRecInfo06
+      familyType := kernelConstVType% And
+      ctorTypes := [kernelConstVType% And.intro]
+      recType := kernelConstVType% And.rec
+      ruleRhs := [andKernelRuleRhs06] },
+    { artifact := singletonPositiveArtifacts[9]
+      inductInfo := eqInfo
+      ctorInfos := [eqReflInfo]
+      recInfo := eqRecInfo
+      familyType := kernelConstVType% Eq
+      ctorTypes := [kernelConstVType% Eq.refl]
+      recType := kernelConstVType% Eq.rec
+      ruleRhs := [eqReflKernelRuleRhs] },
+    { artifact := singletonPositiveArtifacts[10]
+      inductInfo := heqInfo07
+      ctorInfos := [heqReflInfo07]
+      recInfo := heqRecInfo07
+      familyType := kernelConstVType% HEq
+      ctorTypes := [kernelConstVType% HEq.refl]
+      recType := kernelConstVType% HEq.rec
+      ruleRhs := [heqRuleRhs07] },
+    { artifact := singletonPositiveArtifacts[11]
+      inductInfo := finInfo07
+      ctorInfos := [finMkInfo07]
+      recInfo := finRecInfo07
+      familyType := kernelConstVType% Fin
+      ctorTypes := [kernelConstVType% Fin.mk]
+      recType := kernelConstVType% Fin.rec
+      ruleRhs := [finRuleRhs07]
+      dependencies := finDependencyMap07 },
+    { artifact := singletonPositiveArtifacts[12]
+      inductInfo := vectorInfo07
+      ctorInfos := [vectorMkInfo07]
+      recInfo := vectorRecInfo07
+      familyType := kernelConstVType% Vector
+      ctorTypes := [kernelConstVType% Vector.mk]
+      recType := kernelConstVType% Vector.rec
+      ruleRhs := [vectorRuleRhs07]
+      dependencies := vectorDependencyMap07 },
+    { artifact := singletonPositiveArtifacts[13]
+      inductInfo := accInfo
+      ctorInfos := [accIntroInfo]
+      recInfo := accRecInfo
+      familyType := kernelConstVType% Acc
+      ctorTypes := [kernelConstVType% Acc.intro]
+      recType := kernelConstVType% Acc.rec
+      ruleRhs := [accKernelRuleRhs] } ]
+
+example : singletonKernelRows.map (·.artifact.label) =
+    singletonPositiveArtifacts.map (·.label) := rfl
+
+#guard singletonKernelRows.all (·.agrees)
+#guard singletonKernelRows.all (·.producerAccepted)
+
+/-! ## Consolidated rejection matrix -/
+
+/-- One named rejection whose Boolean is computed by the public Theory
+analyzer, the ordinary metadata producer, or the environment transaction it
+is intended to guard. -/
+structure SingletonNegativeRow where
+  label : Name
+  rejected : Bool
+
+def theoryDeclarationRejected07 (decl : VInductDecl) : Bool :=
+  decl.checked?.isNone && (VEnv.empty.addInduct decl).isNone
+
+def producerRejected07 (nparams : Nat) (source : InductiveType)
+    (context : AddInductive.Context) : Bool :=
+  match AddInductive.buildNormalizationCandidate nparams [source] 0 false
+      context with
+  | .error _ => true
+  | .ok _ => false
+
+def aliasFormerTruncatedViewType07 : VInductiveType :=
+  { aliasFormerViewType with ctors := [] }
+
+def aliasFormerTruncatedViewDecl07 : VInductDecl :=
+  { aliasFormerViewDecl with types := [aliasFormerTruncatedViewType07] }
+
+def listReorderedViewType07 : VInductiveType :=
+  { listType with ctors := listType.ctors.reverse }
+
+def listReorderedViewDecl07 : VInductDecl :=
+  { listDecl with types := [listReorderedViewType07] }
+
+def recursorKRejected07 (info : ConstantInfo) (expected : Bool) : Bool :=
+  match info with
+  | .recInfo rec => rec.k != expected
+  | _ => false
+
+/-- A large recursor has one fresh universe parameter and a small recursor
+has none.  Supplying the wrong mode must therefore disagree with the actual
+metadata even when the source-universe list itself is otherwise unchanged. -/
+def recursorEliminationRejected07 (info : ConstantInfo) (sourceUvars : Nat) :
+    VInductDecl.ElimMode → Bool
+  | VInductDecl.ElimMode.large =>
+      info.levelParams.length != sourceUvars + 1
+  | VInductDecl.ElimMode.small =>
+      info.levelParams.length != sourceUvars
+
+def typeCollisionEnv07 : VEnv :=
+  (VEnv.empty.addConst ``Nat ⟨0, .sort .zero⟩).get (by decide)
+
+/-- The complete Spec-07 negative matrix.  Earlier phase-specific fixtures
+retain their exact kernel error messages; this table makes their coverage and
+combined acceptance result executable from one public artifact path. -/
+def singletonNegativeRows : List SingletonNegativeRow :=
+  [ ⟨.mkSimple "loose-variables",
+      theoryDeclarationRejected07 looseIndexDecl⟩,
+    ⟨.mkSimple "duplicate-constructor-name",
+      theoryDeclarationRejected07 duplicateCtorDecl⟩,
+    ⟨.mkSimple "type-constructor-name-alias",
+      theoryDeclarationRejected07 typeCtorAliasDecl⟩,
+    ⟨.mkSimple "constructor-recursor-name-alias",
+      theoryDeclarationRejected07 ctorRecAliasDecl⟩,
+    ⟨.mkSimple "self-reference-before-family-staging",
+      theoryDeclarationRejected07 selfParamDecl⟩,
+    ⟨.mkSimple "bad-parameter-universe",
+      theoryDeclarationRejected07 badParamLevelDecl⟩,
+    ⟨.mkSimple "bad-constructor-universe",
+      theoryDeclarationRejected07 badCtorLevelDecl⟩,
+    ⟨.mkSimple "non-sort-family-result",
+      theoryDeclarationRejected07 nonSortResultDecl⟩,
+    ⟨.mkSimple "wrong-constructor-result-head",
+      theoryDeclarationRejected07 wrongCtorHeadDecl⟩,
+    ⟨.mkSimple "wrong-parameter-spine",
+      theoryDeclarationRejected07 wrongParamSpineDecl⟩,
+    ⟨.mkSimple "parameter-count-mismatch",
+      theoryDeclarationRejected07 shortParamDecl⟩,
+    ⟨.mkSimple "family-universe-count-mismatch",
+      theoryDeclarationRejected07 badTypeUvarsDecl⟩,
+    ⟨.mkSimple "constructor-universe-count-mismatch",
+      theoryDeclarationRejected07 badCtorUvarsDecl⟩,
+    ⟨.mkSimple "negative-recursive-pi-domain",
+      theoryDeclarationRejected07 recDomainDecl⟩,
+    ⟨.mkSimple "changed-recursive-target-parameter",
+      theoryDeclarationRejected07 recTargetDecl⟩,
+    ⟨.mkSimple "recursive-index-family-occurrence",
+      theoryDeclarationRejected07 recIndexDecl⟩,
+    ⟨.mkSimple "truncated-normalization-view",
+      (VInductDecl.normalizedGeneration? aliasFormerRawDecl
+        aliasFormerTruncatedViewDecl07).isNone⟩,
+    ⟨.mkSimple "reordered-normalization-view",
+      (VInductDecl.normalizedGeneration? listDecl
+        listReorderedViewDecl07).isNone⟩,
+    ⟨.mkSimple "opaque-normalization-view",
+      !matrixCandidateExact matrixOpaquePiAliasContext⟩,
+    ⟨.mkSimple "non-defeq-normalization-view",
+      producerRejected07 1 matrixNonDefEqType (matrixCandidateContext 10)⟩,
+    ⟨.mkSimple "nested-negativity",
+      (spec05CandidateError spec05NestedNegativeType).isSome⟩,
+    ⟨.mkSimple "family-in-nonrecursive-field",
+      (spec05CandidateError spec05FamilyNonrecursiveType).isSome⟩,
+    ⟨.mkSimple "family-in-proof-field",
+      (spec05CandidateError spec05FamilyProofType).isSome⟩,
+    ⟨.mkSimple "recursive-local-dependency",
+      (spec05CandidateError spec05RecursiveDependencyType).isSome &&
+        spec05RecursiveDependencyPreFamilyError.isSome⟩,
+    ⟨.mkSimple "constructor-field-universe-boundary",
+      (spec05CandidateError spec05UniverseRejectType).isSome⟩,
+    ⟨.mkSimple "preexisting-type-name",
+      (typeCollisionEnv07.addInduct natDecl).isNone⟩,
+    ⟨.mkSimple "preexisting-constructor-name",
+      (ctorCollisionEnv.addInduct natDecl).isNone⟩,
+    ⟨.mkSimple "preexisting-recursor-name",
+      (recCollisionEnv.addInduct natDecl).isNone⟩,
+    ⟨.mkSimple "eq-wrong-k-target", recursorKRejected07 eqRecInfo false⟩,
+    ⟨.mkSimple "and-wrong-k-target", recursorKRejected07 andRecInfo06 true⟩,
+    ⟨.mkSimple "eq-wrong-small-elimination",
+      recursorEliminationRejected07 eqRecInfo eqDecl.uvars
+        VInductDecl.ElimMode.small⟩,
+    ⟨.mkSimple "or-wrong-large-elimination",
+      recursorEliminationRejected07 orRecInfo06 orDecl.uvars
+        VInductDecl.ElimMode.large⟩ ]
+
+example : singletonNegativeRows.length = 32 := rfl
+
+#guard singletonNegativeRows.all (·.rejected)
+
+/-! ## Exact trust manifests for the public matrix roots -/
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.singletonKernelRows [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.singletonNegativeRows [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Level.hasMVar_eq]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Environment/SingletonParityReplay.lean b/Ix/Theory/Named/Verify/Environment/SingletonParityReplay.lean
new file mode 100644
index 000000000..944cc6aab
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Environment/SingletonParityReplay.lean
@@ -0,0 +1,2820 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.Environment.SingletonParityMatrix
+
+open Ix.Theory (VLevel)
+
+/-!
+# Spec-07 environment replay inventory
+
+This module is the sole public environment-facing inventory for singleton
+parity.  A row packages the actual implementation map, the Theory input and
+output environments, input alignment/order, and the proof-carrying inductive
+transaction.  Consequently every row exposes final alignment and orderedness;
+mere Theory generation is not enough to inhabit this structure.
+-/
+
+namespace Ix.Theory.Named.InductiveReplayFixtures
+
+open Lean
+open Ix.Theory.Named.InductiveFixtures
+
+local instance instInhabitedVEnvParityReplay : Inhabited VEnv := ⟨.empty⟩
+
+structure SingletonReplayArtifact where
+  label : Name
+  source : VInductDecl
+  inputMap : ConstMap
+  inputEnv : VEnv
+  inputMapWF : inputMap.WF
+  outputMap : ConstMap
+  outputEnv : VEnv
+  inputOrdered : inputEnv.Ordered
+  transaction : AddInduct inputMap inputEnv source outputMap outputEnv
+  aligned : Aligned .safe outputMap outputEnv
+
+namespace SingletonReplayArtifact
+
+theorem outputAligned (artifact : SingletonReplayArtifact) :
+    Aligned .safe artifact.outputMap artifact.outputEnv := artifact.aligned
+
+theorem outputOrdered (artifact : SingletonReplayArtifact) :
+    artifact.outputEnv.Ordered := by
+  obtain ⟨generation, generation_wf, transaction⟩ :=
+    artifact.transaction.to_addInduct
+  exact VEnv.addInductGeneration_WF artifact.inputOrdered generation_wf
+    transaction
+
+end SingletonReplayArtifact
+
+/-! ## Reusable staging facts for fixed-family replays -/
+
+/-- The raw family constant retained by a generation certificate is a type in
+the replay input environment. -/
+theorem replayRawFamilyWF07
+    {source : VInductDecl} {generation : source.GenerationChecked}
+    {inputEnv : VEnv} (generationWF : generation.WF inputEnv) :
+    generation.block.sourceType.toVConstant.WF inputEnv := by
+  show inputEnv.IsType generation.block.sourceType.uvars []
+    generation.block.sourceType.type
+  rw [generation.block.sourceType_uvars_eq]
+  exact generationWF.rawFamily_isType
+
+/-- The raw family insertion preserves ordering whenever the retained
+generation certificate is well formed in the replay input environment. -/
+theorem replayTypeEnv_ordered07
+    {source : VInductDecl} {generation : source.GenerationChecked}
+    {inputEnv typeEnv : VEnv}
+    (inputOrdered : inputEnv.Ordered)
+    (generationWF : generation.WF inputEnv)
+    (addType : inputEnv.addConst generation.block.sourceType.name
+      generation.block.sourceType.toVConstant = some typeEnv) :
+    typeEnv.Ordered := by
+  refine .const inputOrdered ?_ addType
+  show inputEnv.IsType generation.block.sourceType.uvars []
+    generation.block.sourceType.type
+  rw [generation.block.sourceType_uvars_eq]
+  exact generationWF.rawFamily_isType
+
+/-- Each stored raw constructor is well formed immediately after the raw
+family insertion.  Later constructor stages use monotonicity to transport
+this certificate across earlier constructor insertions. -/
+theorem replayRawCtorWF07
+    {source : VInductDecl} {generation : source.GenerationChecked}
+    {inputEnv typeEnv : VEnv}
+    (generationWF : generation.WF inputEnv)
+    (addType : inputEnv.addConst generation.block.sourceType.name
+      generation.block.sourceType.toVConstant = some typeEnv)
+    (raw : VConstVal) (hraw : raw ∈ generation.block.sourceType.ctors) :
+    raw.toVConstant.WF typeEnv := by
+  have hraw' : raw ∈ generation.block.ctorPairs.map (·.raw) := by
+    rw [generation.rawCtors_eq]
+    exact hraw
+  obtain ⟨ctor, hctor, rfl⟩ := List.mem_map.1 hraw'
+  show typeEnv.IsType ctor.raw.uvars [] ctor.raw.type
+  rw [generation.ctor_uvars_eq hctor]
+  exact generationWF.rawCtor_isType addType hctor
+
+/-- The complete raw-constructor fold preserves ordering.  This includes the
+zero-constructor case, where the fold is the identity. -/
+theorem replayCtorEnv_ordered07
+    {source : VInductDecl} {generation : source.GenerationChecked}
+    {inputEnv typeEnv ctorEnv : VEnv}
+    (generationWF : generation.WF inputEnv)
+    (addType : inputEnv.addConst generation.block.sourceType.name
+      generation.block.sourceType.toVConstant = some typeEnv)
+    (typeOrdered : typeEnv.Ordered)
+    (addCtors : List.foldlM
+      (fun env (ctor : VConstVal) =>
+        env.addConst ctor.name ctor.toVConstant)
+      typeEnv generation.block.sourceType.ctors = some ctorEnv) :
+    ctorEnv.Ordered := by
+  have ctorWF : ∀ ctor ∈ generation.block.sourceType.ctors,
+      ctor.toVConstant.WF typeEnv := by
+    intro raw hraw
+    exact replayRawCtorWF07 generationWF addType raw hraw
+  exact VInductDecl.constFold_ordered
+    generation.block.sourceType.ctors typeOrdered ctorWF addCtors
+
+/-- Reconstruct the precise mixed-generation environment after the family and
+constructor constants have been inserted.  Its recursor certificate is what
+turns exact kernel recursor metadata into a `TrConstVal`. -/
+theorem replayGenerationEnv07
+    {source : VInductDecl} {generation : source.GenerationChecked}
+    {inputEnv typeEnv ctorEnv : VEnv}
+    (generationWF : generation.WF inputEnv)
+    (addType : inputEnv.addConst generation.block.sourceType.name
+      generation.block.sourceType.toVConstant = some typeEnv)
+    (addCtors : List.foldlM
+      (fun env (ctor : VConstVal) =>
+        env.addConst ctor.name ctor.toVConstant)
+      typeEnv generation.block.sourceType.ctors = some ctorEnv)
+    (ctorOrdered : ctorEnv.Ordered) :
+    VInductDecl.GenerationEnv generation ctorEnv := by
+  obtain ⟨typeToCtor, ctorLookup, -⟩ :=
+    VInductDecl.ctorFold_spec generation.block.sourceType.ctors addCtors
+  have inputToType := VEnv.addConst_le addType
+  have inputToCtor := inputToType.trans typeToCtor
+  have familyLookup : ctorEnv.constants
+      generation.block.sourceType.name =
+      some generation.block.sourceType.toVConstant :=
+    typeToCtor.constants (VEnv.addConst_self addType)
+  have constructorsLookup : ∀ ctor ∈ generation.block.ctorPairs,
+      ctorEnv.constants ctor.raw.name = some ctor.raw.toVConstant := by
+    intro ctor hctor
+    apply ctorLookup ctor.raw
+    rw [← generation.rawCtors_eq]
+    exact List.mem_map.2 ⟨ctor, hctor, rfl⟩
+  exact generationWF.toGenerationEnv addType inputToCtor typeToCtor
+    ctorOrdered familyLookup constructorsLookup
+
+/-! ## Replays already established by the completed singleton pipeline -/
+
+def natReplay07 : SingletonReplayArtifact where
+  label := ``Nat
+  source := natDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := natMap
+  outputEnv := natFinalEnv
+  inputOrdered := .empty
+  transaction := nat_addInduct
+  aligned := nat_aligned
+
+def eqReplay07 : SingletonReplayArtifact where
+  label := ``Eq
+  source := eqDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := eqMap
+  outputEnv := eqFinalEnv
+  inputOrdered := .empty
+  transaction := eq_addInduct
+  aligned := eq_aligned
+
+def accReplay07 : SingletonReplayArtifact where
+  label := ``Acc
+  source := accDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := accMap
+  outputEnv := accFinalEnv
+  inputOrdered := .empty
+  transaction := acc_addInduct
+  aligned := acc_aligned
+
+def aliasFormerReplay07 : SingletonReplayArtifact where
+  label := ``AliasFormer
+  source := aliasFormerRawDecl
+  inputMap := typeFamilyAliasMap
+  inputEnv := typeFamilyAliasEnv
+  inputMapWF := typeFamilyAliasMap_wf
+  outputMap := aliasFormerMap
+  outputEnv := aliasFormerFinalEnv
+  inputOrdered := typeFamilyAliasEnv_ordered
+  transaction := aliasFormer_addInduct_checked
+  aligned := aliasFormer_aligned_checked
+
+def aliasRecReplay07 : SingletonReplayArtifact where
+  label := ``AliasRec
+  source := aliasRecRawDecl
+  inputMap := recAliasMap
+  inputEnv := recAliasEnv
+  inputMapWF := recAliasMap_wf
+  outputMap := aliasRecMap
+  outputEnv := aliasRecFinalEnv
+  inputOrdered := recAliasEnv_ordered
+  transaction := aliasRec_addInduct_checked
+  aligned := aliasRec_aligned_checked
+
+def normalizationMatrixReplay07 : SingletonReplayArtifact where
+  label := ``NormalizationMatrix
+  source := normalizationMatrixRawDecl
+  inputMap := matrixAliasMap
+  inputEnv := normalizationMatrixAliasEnv
+  inputMapWF := matrixAliasMap_wf
+  outputMap := normalizationMatrixMap
+  outputEnv := normalizationMatrixFinalEnv
+  inputOrdered := normalizationMatrixAliasEnv_ordered
+  transaction := normalizationMatrix_addInduct
+  aligned := normalizationMatrix_aligned
+
+def annotatedPiReplay07 : SingletonReplayArtifact where
+  label := ``AnnotatedPi
+  source := annotatedPiRawDecl
+  inputMap := _
+  inputEnv := outParamEnv
+  inputMapWF := annotatedReplayInputMap_wf
+  outputMap := _
+  outputEnv := annotatedPiFinalEnv
+  inputOrdered := outParamEnv_ordered
+  transaction := annotatedPi_addInduct_checked
+  aligned := annotatedPi_aligned_checked
+
+def annotatedParamReplay07 : SingletonReplayArtifact where
+  label := ``AnnotatedParam
+  source := annotatedParamRawDecl
+  inputMap := _
+  inputEnv := outParamEnv
+  inputMapWF := annotatedReplayInputMap_wf
+  outputMap := _
+  outputEnv := annotatedParamFinalEnv
+  inputOrdered := outParamEnv_ordered
+  transaction := annotatedParam_addInduct_checked
+  aligned := annotatedParam_aligned_checked
+
+/-! ## Fixed-family replays -/
+
+/-! ### Bool -/
+
+theorem boolDeclWF07 : boolDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro type htype
+  have htype' : type = boolType :=
+    List.mem_singleton.1 (by simpa [boolDecl] using htype)
+  subst type
+  refine ⟨?_, ?_⟩
+  · change True
+    trivial
+  · intro ctor hctor
+    rcases List.mem_cons.1 hctor with rfl | hctor
+    · constructor
+      · change True
+        trivial
+      · exact .nil
+    · have hctor' := List.mem_singleton.1 hctor
+      subst ctor
+      constructor
+      · change True
+        trivial
+      · exact .nil
+
+theorem boolGenerationWF07 : boolGenerationChecked.WF VEnv.empty := by
+  exact (boolChecked.wf_of_decl boolDeclWF07).identityGeneration .empty
+
+def boolTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst boolType.name boolType.toVConstant).get!
+
+def boolFalseEnv07 : VEnv :=
+  (boolTypeEnv07.addConst boolType.ctors[0].name
+    boolType.ctors[0].toVConstant).get!
+
+def boolCtorEnv07 : VEnv :=
+  (boolFalseEnv07.addConst boolType.ctors[1].name
+    boolType.ctors[1].toVConstant).get!
+
+def boolRecEnv07 : VEnv :=
+  (boolCtorEnv07.addConst ``Bool.rec
+    (inductGenerationRecVal boolGenerationChecked).toVConstant).get!
+
+def boolFinalEnv07 : VEnv :=
+  boolGenerationChecked.generatedRules.foldl VEnv.addDefEq boolRecEnv07
+
+def boolTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``Bool boolInfo07
+
+def boolFalseMap07 : ConstMap :=
+  boolTypeMap07.insert ``Bool.false boolFalseInfo07
+
+def boolCtorMap07 : ConstMap :=
+  boolFalseMap07.insert ``Bool.true boolTrueInfo07
+
+def boolMap07 : ConstMap :=
+  boolCtorMap07.insert ``Bool.rec boolRecInfo07
+
+theorem boolTypeEnv_ordered07 : boolTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty boolGenerationWF07 rfl
+
+theorem boolCtorEnv_ordered07 : boolCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 boolGenerationWF07 rfl
+    boolTypeEnv_ordered07 rfl
+
+theorem boolGenerationEnv07 :
+    VInductDecl.GenerationEnv boolGenerationChecked boolCtorEnv07 :=
+  replayGenerationEnv07 boolGenerationWF07 rfl rfl
+    boolCtorEnv_ordered07
+
+theorem boolInfoTr07 :
+    TrConstVal .safe VEnv.empty boolInfo07 boolType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  exact .sort rfl
+
+theorem boolFalseInfoTr07 :
+    TrConstVal .safe boolTypeEnv07 boolFalseInfo07 boolType.ctors[0] := by
+  have hBool : boolTypeEnv07.constants ``Bool =
+      some boolType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr boolTypeEnv07 boolFalseInfo07.levelParams []
+      boolFalseInfo07.type boolType.ctors[0].type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS boolTypeEnv_ordered07 trivial
+    ⟨.sort (.succ .zero), by type_tac⟩
+
+theorem boolTrueInfoTr07 :
+    TrConstVal .safe boolFalseEnv07 boolTrueInfo07 boolType.ctors[1] := by
+  have hBool : boolFalseEnv07.constants ``Bool =
+      some boolType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr boolFalseEnv07 boolTrueInfo07.levelParams []
+      boolTrueInfo07.type boolType.ctors[1].type := by
+    tr_type_expr_tac
+  have falseOrdered : boolFalseEnv07.Ordered := by
+    refine .const (n := boolType.ctors[0].name)
+      (ci := boolType.ctors[0].toVConstant) boolTypeEnv_ordered07 ?_ rfl
+    exact ⟨.succ .zero, by type_tac⟩
+  exact shape.to_trExprS falseOrdered trivial
+    ⟨.sort (.succ .zero), by type_tac⟩
+
+theorem boolRecInfoTr07 :
+    TrConstVal .safe boolCtorEnv07 boolRecInfo07
+      (inductGenerationRecVal boolGenerationChecked) := by
+  have hBool : boolCtorEnv07.constants ``Bool =
+      some boolType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr boolCtorEnv07 boolRecInfo07.levelParams []
+      boolRecInfo07.type
+      (inductGenerationRecVal boolGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := boolGenerationEnv07.recursor_wf
+  exact shape.to_trExprS boolCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem boolTypeFresh07 : ({} : ConstMap).find? ``Bool = none := by
+  simp [SMap.find?]
+
+theorem boolTypeMapWF07 : boolTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ boolTypeFresh07
+
+theorem boolFalseFresh07 : boolTypeMap07.find? ``Bool.false = none := by
+  rw [boolTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem boolFalseMapWF07 : boolFalseMap07.WF :=
+  boolTypeMapWF07.insert _ _ boolFalseFresh07
+
+theorem boolTrueFresh07 : boolFalseMap07.find? ``Bool.true = none := by
+  rw [boolFalseMap07, boolTypeMapWF07.find?_insert, boolTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem boolCtorMapWF07 : boolCtorMap07.WF :=
+  boolFalseMapWF07.insert _ _ boolTrueFresh07
+
+theorem boolRecFresh07 : boolCtorMap07.find? ``Bool.rec = none := by
+  rw [boolCtorMap07, boolFalseMapWF07.find?_insert, boolFalseMap07,
+    boolTypeMapWF07.find?_insert, boolTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem boolAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty boolDecl
+    boolMap07 boolFinalEnv07 := by
+  refine ⟨{
+    generation := boolGenerationChecked
+    generation_wf := boolGenerationWF07
+    typeMap := boolTypeMap07
+    typeEnv := boolTypeEnv07
+    ctorMap := boolCtorMap07
+    ctorEnv := boolCtorEnv07
+    recEnv := boolRecEnv07
+    addType := {
+      info := boolInfo07
+      kind_eq := by simp [boolInfo07, InductConstantKind.Matches]
+      tr := boolInfoTr07
+      map_fresh := boolTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := boolRecInfo07
+      kind_eq := by simp [boolRecInfo07, InductConstantKind.Matches]
+      tr := boolRecInfoTr07
+      map_fresh := boolRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := boolFalseInfo07
+      kind_eq := by simp [boolFalseInfo07, InductConstantKind.Matches]
+      tr := boolFalseInfoTr07
+      map_fresh := by simpa [boolType] using boolFalseFresh07
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := boolTrueInfo07
+      kind_eq := by simp [boolTrueInfo07, InductConstantKind.Matches]
+      tr := boolTrueInfoTr07
+      map_fresh := by
+        change boolFalseMap07.find? ``Bool.true = none
+        exact boolTrueFresh07
+      env_add := rfl
+      map_add := rfl } .nil)
+
+theorem boolAligned07 : Aligned .safe boolMap07 boolFinalEnv07 :=
+  Aligned.addInduct boolAddInduct07 .empty
+
+def boolReplay07 : SingletonReplayArtifact where
+  label := ``Bool
+  source := boolDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := boolMap07
+  outputEnv := boolFinalEnv07
+  inputOrdered := .empty
+  transaction := boolAddInduct07
+  aligned := boolAligned07
+
+/-! ### List -/
+
+theorem listCheckedWF07 : listChecked.WF VEnv.empty := by
+  constructor
+  · change VEnv.empty.OnTel 1 [] [.sort (.succ (.param 0))]
+    exact ⟨⟨.succ (.succ (.param 0)), VEnv.HasType.sort (by decide)⟩,
+      trivial⟩
+  · intro ctor hctor
+    rcases List.mem_cons.1 hctor with rfl | hctor
+    · constructor
+      · change True
+        trivial
+      · exact .nil
+    · have hctor' := List.mem_singleton.1 hctor
+      subst ctor
+      constructor
+      · change VInductDecl.fieldsWF 1 ``List 1 VEnv.empty
+          (.succ (.param 0)) [] [.sort (.succ (.param 0))] 0
+          [.bvar 0,
+            .app (.const ``List [.param 0]) (.bvar 1)]
+        constructor
+        · exact .inr (.inr ⟨rfl, .succ (.param 0), by type_tac,
+            .inr (VLevel.le_refl _)⟩)
+        constructor
+        · intro recursive
+          contradiction
+        constructor
+        · exact .inl rfl
+        constructor
+        · intro _
+          exact .nil
+        · trivial
+      · exact .nil
+
+theorem listGenerationWF07 : listGenerationChecked.WF VEnv.empty := by
+  exact listCheckedWF07.identityGeneration .empty
+
+def listTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst listType.name listType.toVConstant).get!
+
+def listNilEnv07 : VEnv :=
+  (listTypeEnv07.addConst listType.ctors[0].name
+    listType.ctors[0].toVConstant).get!
+
+def listCtorEnv07 : VEnv :=
+  (listNilEnv07.addConst listType.ctors[1].name
+    listType.ctors[1].toVConstant).get!
+
+def listRecEnv07 : VEnv :=
+  (listCtorEnv07.addConst ``List.rec
+    (inductGenerationRecVal listGenerationChecked).toVConstant).get!
+
+def listFinalEnv07 : VEnv :=
+  listGenerationChecked.generatedRules.foldl VEnv.addDefEq listRecEnv07
+
+def listTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``List listInfo07
+
+def listNilMap07 : ConstMap :=
+  listTypeMap07.insert ``List.nil listNilInfo07
+
+def listCtorMap07 : ConstMap :=
+  listNilMap07.insert ``List.cons listConsInfo07
+
+def listMap07 : ConstMap :=
+  listCtorMap07.insert ``List.rec listRecInfo07
+
+theorem listTypeEnv_ordered07 : listTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty listGenerationWF07 rfl
+
+theorem listNilEnv_ordered07 : listNilEnv07.Ordered := by
+  refine .const (n := listType.ctors[0].name)
+    (ci := listType.ctors[0].toVConstant) listTypeEnv_ordered07 ?_ rfl
+  exact replayRawCtorWF07 listGenerationWF07 rfl listType.ctors[0]
+    (.head _)
+
+theorem listCtorEnv_ordered07 : listCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 listGenerationWF07 rfl
+    listTypeEnv_ordered07 rfl
+
+theorem listGenerationEnv07 :
+    VInductDecl.GenerationEnv listGenerationChecked listCtorEnv07 :=
+  replayGenerationEnv07 listGenerationWF07 rfl rfl
+    listCtorEnv_ordered07
+
+theorem listInfoTr07 :
+    TrConstVal .safe VEnv.empty listInfo07 listType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr VEnv.empty listInfo07.levelParams []
+      listInfo07.type listType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 listGenerationWF07
+  exact shape.to_trExprS .empty trivial ⟨.sort sort, familyType⟩
+
+theorem listNilInfoTr07 :
+    TrConstVal .safe listTypeEnv07 listNilInfo07 listType.ctors[0] := by
+  have hList : listTypeEnv07.constants ``List =
+      some listType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr listTypeEnv07 listNilInfo07.levelParams []
+      listNilInfo07.type listType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 listGenerationWF07 rfl
+    listType.ctors[0] (.head _)
+  exact shape.to_trExprS listTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem listConsInfoTr07 :
+    TrConstVal .safe listNilEnv07 listConsInfo07 listType.ctors[1] := by
+  have hList : listNilEnv07.constants ``List =
+      some listType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr listNilEnv07 listConsInfo07.levelParams []
+      listConsInfo07.type listType.ctors[1].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 listGenerationWF07 rfl
+    listType.ctors[1] (.tail _ (.head _))
+  have typeToNil : listTypeEnv07 ≤ listNilEnv07 :=
+    VEnv.addConst_le (show listTypeEnv07.addConst
+      listType.ctors[0].name listType.ctors[0].toVConstant =
+        some listNilEnv07 from rfl)
+  exact shape.to_trExprS listNilEnv_ordered07 trivial
+    ⟨.sort sort, ctorType.mono typeToNil⟩
+
+theorem listRecInfoTr07 :
+    TrConstVal .safe listCtorEnv07 listRecInfo07
+      (inductGenerationRecVal listGenerationChecked) := by
+  have hList : listCtorEnv07.constants ``List =
+      some listType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr listCtorEnv07 listRecInfo07.levelParams []
+      listRecInfo07.type
+      (inductGenerationRecVal listGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := listGenerationEnv07.recursor_wf
+  exact shape.to_trExprS listCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem listTypeFresh07 : ({} : ConstMap).find? ``List = none := by
+  simp [SMap.find?]
+
+theorem listTypeMapWF07 : listTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ listTypeFresh07
+
+theorem listNilFresh07 : listTypeMap07.find? ``List.nil = none := by
+  rw [listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem listNilMapWF07 : listNilMap07.WF :=
+  listTypeMapWF07.insert _ _ listNilFresh07
+
+theorem listConsFresh07 : listNilMap07.find? ``List.cons = none := by
+  rw [listNilMap07, listTypeMapWF07.find?_insert, listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem listCtorMapWF07 : listCtorMap07.WF :=
+  listNilMapWF07.insert _ _ listConsFresh07
+
+theorem listRecFresh07 : listCtorMap07.find? ``List.rec = none := by
+  rw [listCtorMap07, listNilMapWF07.find?_insert, listNilMap07,
+    listTypeMapWF07.find?_insert, listTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem listAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty listDecl
+    listMap07 listFinalEnv07 := by
+  refine ⟨{
+    generation := listGenerationChecked
+    generation_wf := listGenerationWF07
+    typeMap := listTypeMap07
+    typeEnv := listTypeEnv07
+    ctorMap := listCtorMap07
+    ctorEnv := listCtorEnv07
+    recEnv := listRecEnv07
+    addType := {
+      info := listInfo07
+      kind_eq := by simp [listInfo07, InductConstantKind.Matches]
+      tr := listInfoTr07
+      map_fresh := listTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := listRecInfo07
+      kind_eq := by simp [listRecInfo07, InductConstantKind.Matches]
+      tr := listRecInfoTr07
+      map_fresh := listRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := listNilInfo07
+      kind_eq := by simp [listNilInfo07, InductConstantKind.Matches]
+      tr := listNilInfoTr07
+      map_fresh := by simpa [listType] using listNilFresh07
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := listConsInfo07
+      kind_eq := by simp [listConsInfo07, InductConstantKind.Matches]
+      tr := listConsInfoTr07
+      map_fresh := by
+        change listNilMap07.find? ``List.cons = none
+        exact listConsFresh07
+      env_add := rfl
+      map_add := rfl } .nil)
+
+theorem listAligned07 : Aligned .safe listMap07 listFinalEnv07 :=
+  Aligned.addInduct listAddInduct07 .empty
+
+def listReplay07 : SingletonReplayArtifact where
+  label := ``List
+  source := listDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := listMap07
+  outputEnv := listFinalEnv07
+  inputOrdered := .empty
+  transaction := listAddInduct07
+  aligned := listAligned07
+
+/-! ### Option -/
+
+theorem optionDeclWF07 : optionDecl.WF VEnv.empty := by
+  refine ⟨rfl, ?_⟩
+  intro type htype
+  have htype' : type = optionType :=
+    List.mem_singleton.1 (by simpa [optionDecl] using htype)
+  subst type
+  refine ⟨?_, ?_⟩
+  · change VEnv.empty.OnTel 1 [] [.sort (.succ (.param 0))]
+    exact ⟨⟨.succ (.succ (.param 0)), VEnv.HasType.sort (by decide)⟩,
+      trivial⟩
+  · intro ctor hctor
+    rcases List.mem_cons.1 hctor with rfl | hctor
+    · constructor
+      · change True
+        trivial
+      · exact .nil
+    · have hctor' := List.mem_singleton.1 hctor
+      subst ctor
+      constructor
+      · change VInductDecl.fieldsWF 1 ``Option 1 VEnv.empty
+          (.succ (.param 0)) [] [.sort (.succ (.param 0))] 0 [.bvar 0]
+        constructor
+        · exact .inr (.inr ⟨rfl, .succ (.param 0), by type_tac,
+            .inr (VLevel.le_refl _)⟩)
+        constructor
+        · intro recursive
+          contradiction
+        · trivial
+      · exact .nil
+
+theorem optionGenerationWF07 : optionGenerationChecked.WF VEnv.empty := by
+  exact (optionChecked.wf_of_decl optionDeclWF07).identityGeneration .empty
+
+def optionTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst optionType.name optionType.toVConstant).get!
+
+def optionNoneEnv07 : VEnv :=
+  (optionTypeEnv07.addConst optionType.ctors[0].name
+    optionType.ctors[0].toVConstant).get!
+
+def optionCtorEnv07 : VEnv :=
+  (optionNoneEnv07.addConst optionType.ctors[1].name
+    optionType.ctors[1].toVConstant).get!
+
+def optionRecEnv07 : VEnv :=
+  (optionCtorEnv07.addConst ``Option.rec
+    (inductGenerationRecVal optionGenerationChecked).toVConstant).get!
+
+def optionFinalEnv07 : VEnv :=
+  optionGenerationChecked.generatedRules.foldl VEnv.addDefEq optionRecEnv07
+
+def optionTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``Option optionInfo07
+
+def optionNoneMap07 : ConstMap :=
+  optionTypeMap07.insert ``Option.none optionNoneInfo07
+
+def optionCtorMap07 : ConstMap :=
+  optionNoneMap07.insert ``Option.some optionSomeInfo07
+
+def optionMap07 : ConstMap :=
+  optionCtorMap07.insert ``Option.rec optionRecInfo07
+
+theorem optionTypeEnv_ordered07 : optionTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty optionGenerationWF07 rfl
+
+theorem optionNoneEnv_ordered07 : optionNoneEnv07.Ordered := by
+  refine .const (n := optionType.ctors[0].name)
+    (ci := optionType.ctors[0].toVConstant) optionTypeEnv_ordered07 ?_ rfl
+  exact replayRawCtorWF07 optionGenerationWF07 rfl optionType.ctors[0]
+    (.head _)
+
+theorem optionCtorEnv_ordered07 : optionCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 optionGenerationWF07 rfl
+    optionTypeEnv_ordered07 rfl
+
+theorem optionGenerationEnv07 :
+    VInductDecl.GenerationEnv optionGenerationChecked optionCtorEnv07 :=
+  replayGenerationEnv07 optionGenerationWF07 rfl rfl
+    optionCtorEnv_ordered07
+
+theorem optionInfoTr07 :
+    TrConstVal .safe VEnv.empty optionInfo07 optionType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr VEnv.empty optionInfo07.levelParams []
+      optionInfo07.type optionType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 optionGenerationWF07
+  exact shape.to_trExprS .empty trivial ⟨.sort sort, familyType⟩
+
+theorem optionNoneInfoTr07 :
+    TrConstVal .safe optionTypeEnv07 optionNoneInfo07 optionType.ctors[0] := by
+  have hOption : optionTypeEnv07.constants ``Option =
+      some optionType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr optionTypeEnv07 optionNoneInfo07.levelParams []
+      optionNoneInfo07.type optionType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 optionGenerationWF07 rfl
+    optionType.ctors[0] (.head _)
+  exact shape.to_trExprS optionTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem optionSomeInfoTr07 :
+    TrConstVal .safe optionNoneEnv07 optionSomeInfo07 optionType.ctors[1] := by
+  have hOption : optionNoneEnv07.constants ``Option =
+      some optionType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr optionNoneEnv07 optionSomeInfo07.levelParams []
+      optionSomeInfo07.type optionType.ctors[1].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 optionGenerationWF07 rfl
+    optionType.ctors[1] (.tail _ (.head _))
+  have typeToNone : optionTypeEnv07 ≤ optionNoneEnv07 :=
+    VEnv.addConst_le (show optionTypeEnv07.addConst
+      optionType.ctors[0].name optionType.ctors[0].toVConstant =
+        some optionNoneEnv07 from rfl)
+  exact shape.to_trExprS optionNoneEnv_ordered07 trivial
+    ⟨.sort sort, ctorType.mono typeToNone⟩
+
+theorem optionRecInfoTr07 :
+    TrConstVal .safe optionCtorEnv07 optionRecInfo07
+      (inductGenerationRecVal optionGenerationChecked) := by
+  have hOption : optionCtorEnv07.constants ``Option =
+      some optionType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr optionCtorEnv07 optionRecInfo07.levelParams []
+      optionRecInfo07.type
+      (inductGenerationRecVal optionGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := optionGenerationEnv07.recursor_wf
+  exact shape.to_trExprS optionCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem optionTypeFresh07 : ({} : ConstMap).find? ``Option = none := by
+  simp [SMap.find?]
+
+theorem optionTypeMapWF07 : optionTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ optionTypeFresh07
+
+theorem optionNoneFresh07 : optionTypeMap07.find? ``Option.none = none := by
+  rw [optionTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem optionNoneMapWF07 : optionNoneMap07.WF :=
+  optionTypeMapWF07.insert _ _ optionNoneFresh07
+
+theorem optionSomeFresh07 : optionNoneMap07.find? ``Option.some = none := by
+  rw [optionNoneMap07, optionTypeMapWF07.find?_insert, optionTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem optionCtorMapWF07 : optionCtorMap07.WF :=
+  optionNoneMapWF07.insert _ _ optionSomeFresh07
+
+theorem optionRecFresh07 : optionCtorMap07.find? ``Option.rec = none := by
+  rw [optionCtorMap07, optionNoneMapWF07.find?_insert, optionNoneMap07,
+    optionTypeMapWF07.find?_insert, optionTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem optionAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty optionDecl
+    optionMap07 optionFinalEnv07 := by
+  refine ⟨{
+    generation := optionGenerationChecked
+    generation_wf := optionGenerationWF07
+    typeMap := optionTypeMap07
+    typeEnv := optionTypeEnv07
+    ctorMap := optionCtorMap07
+    ctorEnv := optionCtorEnv07
+    recEnv := optionRecEnv07
+    addType := {
+      info := optionInfo07
+      kind_eq := by simp [optionInfo07, InductConstantKind.Matches]
+      tr := optionInfoTr07
+      map_fresh := optionTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := optionRecInfo07
+      kind_eq := by simp [optionRecInfo07, InductConstantKind.Matches]
+      tr := optionRecInfoTr07
+      map_fresh := optionRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := optionNoneInfo07
+      kind_eq := by simp [optionNoneInfo07, InductConstantKind.Matches]
+      tr := optionNoneInfoTr07
+      map_fresh := by simpa [optionType] using optionNoneFresh07
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := optionSomeInfo07
+      kind_eq := by simp [optionSomeInfo07, InductConstantKind.Matches]
+      tr := optionSomeInfoTr07
+      map_fresh := by
+        change optionNoneMap07.find? ``Option.some = none
+        exact optionSomeFresh07
+      env_add := rfl
+      map_add := rfl } .nil)
+
+theorem optionAligned07 : Aligned .safe optionMap07 optionFinalEnv07 :=
+  Aligned.addInduct optionAddInduct07 .empty
+
+def optionReplay07 : SingletonReplayArtifact where
+  label := ``Option
+  source := optionDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := optionMap07
+  outputEnv := optionFinalEnv07
+  inputOrdered := .empty
+  transaction := optionAddInduct07
+  aligned := optionAligned07
+
+/-! ### Prod -/
+
+theorem prodCheckedWF07 : prodChecked.WF VEnv.empty := by
+  constructor
+  · change VEnv.empty.OnTel 2 []
+      [.sort (.succ (.param 0)), .sort (.succ (.param 1))]
+    exact ⟨⟨.succ (.succ (.param 0)), VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨.succ (.succ (.param 1)), VEnv.HasType.sort (by decide)⟩,
+        trivial⟩⟩
+  · intro ctor hctor
+    have hctor' := List.mem_singleton.1 hctor
+    subst ctor
+    constructor
+    · change VInductDecl.fieldsWF 2 ``Prod 2 VEnv.empty
+        (.max (.succ (.param 0)) (.succ (.param 1))) []
+        [.sort (.succ (.param 1)), .sort (.succ (.param 0))] 0
+        [.bvar 1, .bvar 1]
+      constructor
+      · exact .inr (.inr ⟨rfl, .succ (.param 0), by type_tac,
+          .inr VLevel.le_max_left⟩)
+      constructor
+      · intro recursive
+        contradiction
+      constructor
+      · exact .inr (.inr ⟨rfl, .succ (.param 1), by type_tac,
+          .inr VLevel.le_max_right⟩)
+      constructor
+      · intro recursive
+        contradiction
+      · trivial
+    · exact .nil
+
+theorem prodGenerationWF07 : prodGenerationChecked.WF VEnv.empty := by
+  exact prodCheckedWF07.identityGeneration .empty
+
+def prodTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst prodType.name prodType.toVConstant).get!
+
+def prodCtorEnv07 : VEnv :=
+  (prodTypeEnv07.addConst prodType.ctors[0].name
+    prodType.ctors[0].toVConstant).get!
+
+def prodRecEnv07 : VEnv :=
+  (prodCtorEnv07.addConst ``Prod.rec
+    (inductGenerationRecVal prodGenerationChecked).toVConstant).get!
+
+def prodFinalEnv07 : VEnv :=
+  prodGenerationChecked.generatedRules.foldl VEnv.addDefEq prodRecEnv07
+
+def prodTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``Prod prodInfo07
+
+def prodCtorMap07 : ConstMap :=
+  prodTypeMap07.insert ``Prod.mk prodMkInfo07
+
+def prodMap07 : ConstMap :=
+  prodCtorMap07.insert ``Prod.rec prodRecInfo07
+
+theorem prodTypeEnv_ordered07 : prodTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty prodGenerationWF07 rfl
+
+theorem prodCtorEnv_ordered07 : prodCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 prodGenerationWF07 rfl
+    prodTypeEnv_ordered07 rfl
+
+theorem prodGenerationEnv07 :
+    VInductDecl.GenerationEnv prodGenerationChecked prodCtorEnv07 :=
+  replayGenerationEnv07 prodGenerationWF07 rfl rfl
+    prodCtorEnv_ordered07
+
+theorem prodInfoTr07 :
+    TrConstVal .safe VEnv.empty prodInfo07 prodType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr VEnv.empty prodInfo07.levelParams []
+      prodInfo07.type prodType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 prodGenerationWF07
+  exact shape.to_trExprS .empty trivial ⟨.sort sort, familyType⟩
+
+theorem prodCtorInfoTr07 :
+    TrConstVal .safe prodTypeEnv07 prodMkInfo07 prodType.ctors[0] := by
+  have hProd : prodTypeEnv07.constants ``Prod =
+      some prodType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr prodTypeEnv07 prodMkInfo07.levelParams []
+      prodMkInfo07.type prodType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 prodGenerationWF07 rfl
+    prodType.ctors[0] (.head _)
+  exact shape.to_trExprS prodTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem prodRecInfoTr07 :
+    TrConstVal .safe prodCtorEnv07 prodRecInfo07
+      (inductGenerationRecVal prodGenerationChecked) := by
+  have hProd : prodCtorEnv07.constants ``Prod =
+      some prodType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr prodCtorEnv07 prodRecInfo07.levelParams []
+      prodRecInfo07.type
+      (inductGenerationRecVal prodGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := prodGenerationEnv07.recursor_wf
+  exact shape.to_trExprS prodCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem prodTypeFresh07 : ({} : ConstMap).find? ``Prod = none := by
+  simp [SMap.find?]
+
+theorem prodTypeMapWF07 : prodTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ prodTypeFresh07
+
+theorem prodCtorFresh07 : prodTypeMap07.find? ``Prod.mk = none := by
+  rw [prodTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem prodCtorMapWF07 : prodCtorMap07.WF :=
+  prodTypeMapWF07.insert _ _ prodCtorFresh07
+
+theorem prodRecFresh07 : prodCtorMap07.find? ``Prod.rec = none := by
+  rw [prodCtorMap07, prodTypeMapWF07.find?_insert, prodTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem prodAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty prodDecl
+    prodMap07 prodFinalEnv07 := by
+  refine ⟨{
+    generation := prodGenerationChecked
+    generation_wf := prodGenerationWF07
+    typeMap := prodTypeMap07
+    typeEnv := prodTypeEnv07
+    ctorMap := prodCtorMap07
+    ctorEnv := prodCtorEnv07
+    recEnv := prodRecEnv07
+    addType := {
+      info := prodInfo07
+      kind_eq := by simp [prodInfo07, InductConstantKind.Matches]
+      tr := prodInfoTr07
+      map_fresh := prodTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := prodRecInfo07
+      kind_eq := by simp [prodRecInfo07, InductConstantKind.Matches]
+      tr := prodRecInfoTr07
+      map_fresh := prodRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := prodMkInfo07
+    kind_eq := by simp [prodMkInfo07, InductConstantKind.Matches]
+    tr := prodCtorInfoTr07
+    map_fresh := by simpa [prodType] using prodCtorFresh07
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem prodAligned07 : Aligned .safe prodMap07 prodFinalEnv07 :=
+  Aligned.addInduct prodAddInduct07 .empty
+
+def prodReplay07 : SingletonReplayArtifact where
+  label := ``Prod
+  source := prodDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := prodMap07
+  outputEnv := prodFinalEnv07
+  inputOrdered := .empty
+  transaction := prodAddInduct07
+  aligned := prodAligned07
+
+/-! ### And -/
+
+theorem andCheckedWF07 : andChecked.WF VEnv.empty := by
+  constructor
+  · change VEnv.empty.OnTel 0 [] [.sort .zero, .sort .zero]
+    exact ⟨⟨.succ .zero, VEnv.HasType.sort trivial⟩,
+      ⟨⟨.succ .zero, VEnv.HasType.sort trivial⟩, trivial⟩⟩
+  · intro ctor hctor
+    have hctor' := List.mem_singleton.1 hctor
+    subst ctor
+    constructor
+    · change VInductDecl.fieldsWF 0 ``And 2 VEnv.empty .zero []
+        [.sort .zero, .sort .zero] 0 [.bvar 1, .bvar 1]
+      constructor
+      · exact .inr (.inr ⟨rfl, .zero, by type_tac, .inl rfl⟩)
+      constructor
+      · intro recursive
+        contradiction
+      constructor
+      · exact .inr (.inr ⟨rfl, .zero, by type_tac, .inl rfl⟩)
+      constructor
+      · intro recursive
+        contradiction
+      · trivial
+    · exact .nil
+
+theorem andGenerationWF07 : andGenerationChecked.WF VEnv.empty := by
+  exact andCheckedWF07.identityGeneration .empty
+
+def andTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst andType.name andType.toVConstant).get!
+
+def andCtorEnv07 : VEnv :=
+  (andTypeEnv07.addConst andType.ctors[0].name
+    andType.ctors[0].toVConstant).get!
+
+def andRecEnv07 : VEnv :=
+  (andCtorEnv07.addConst ``And.rec
+    (inductGenerationRecVal andGenerationChecked).toVConstant).get!
+
+def andFinalEnv07 : VEnv :=
+  andGenerationChecked.generatedRules.foldl VEnv.addDefEq andRecEnv07
+
+def andTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``And andInfo06
+
+def andCtorMap07 : ConstMap :=
+  andTypeMap07.insert ``And.intro andIntroInfo06
+
+def andMap07 : ConstMap :=
+  andCtorMap07.insert ``And.rec andRecInfo06
+
+theorem andTypeEnv_ordered07 : andTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty andGenerationWF07 rfl
+
+theorem andCtorEnv_ordered07 : andCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 andGenerationWF07 rfl
+    andTypeEnv_ordered07 rfl
+
+theorem andGenerationEnv07 :
+    VInductDecl.GenerationEnv andGenerationChecked andCtorEnv07 :=
+  replayGenerationEnv07 andGenerationWF07 rfl rfl
+    andCtorEnv_ordered07
+
+theorem andInfoTr07 :
+    TrConstVal .safe VEnv.empty andInfo06 andType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr VEnv.empty andInfo06.levelParams []
+      andInfo06.type andType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 andGenerationWF07
+  exact shape.to_trExprS .empty trivial ⟨.sort sort, familyType⟩
+
+theorem andCtorInfoTr07 :
+    TrConstVal .safe andTypeEnv07 andIntroInfo06 andType.ctors[0] := by
+  have hAnd : andTypeEnv07.constants ``And =
+      some andType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr andTypeEnv07 andIntroInfo06.levelParams []
+      andIntroInfo06.type andType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 andGenerationWF07 rfl
+    andType.ctors[0] (.head _)
+  exact shape.to_trExprS andTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem andRecInfoTr07 :
+    TrConstVal .safe andCtorEnv07 andRecInfo06
+      (inductGenerationRecVal andGenerationChecked) := by
+  have hAnd : andCtorEnv07.constants ``And =
+      some andType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr andCtorEnv07 andRecInfo06.levelParams []
+      andRecInfo06.type
+      (inductGenerationRecVal andGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := andGenerationEnv07.recursor_wf
+  exact shape.to_trExprS andCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem andTypeFresh07 : ({} : ConstMap).find? ``And = none := by
+  simp [SMap.find?]
+
+theorem andTypeMapWF07 : andTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ andTypeFresh07
+
+theorem andCtorFresh07 : andTypeMap07.find? ``And.intro = none := by
+  rw [andTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem andCtorMapWF07 : andCtorMap07.WF :=
+  andTypeMapWF07.insert _ _ andCtorFresh07
+
+theorem andRecFresh07 : andCtorMap07.find? ``And.rec = none := by
+  rw [andCtorMap07, andTypeMapWF07.find?_insert, andTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem andAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty andDecl
+    andMap07 andFinalEnv07 := by
+  refine ⟨{
+    generation := andGenerationChecked
+    generation_wf := andGenerationWF07
+    typeMap := andTypeMap07
+    typeEnv := andTypeEnv07
+    ctorMap := andCtorMap07
+    ctorEnv := andCtorEnv07
+    recEnv := andRecEnv07
+    addType := {
+      info := andInfo06
+      kind_eq := by simp [andInfo06, InductConstantKind.Matches]
+      tr := andInfoTr07
+      map_fresh := andTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := andRecInfo06
+      kind_eq := by simp [andRecInfo06, InductConstantKind.Matches]
+      tr := andRecInfoTr07
+      map_fresh := andRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := andIntroInfo06
+    kind_eq := by simp [andIntroInfo06, InductConstantKind.Matches]
+    tr := andCtorInfoTr07
+    map_fresh := by simpa [andType] using andCtorFresh07
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem andAligned07 : Aligned .safe andMap07 andFinalEnv07 :=
+  Aligned.addInduct andAddInduct07 .empty
+
+def andReplay07 : SingletonReplayArtifact where
+  label := ``And
+  source := andDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := andMap07
+  outputEnv := andFinalEnv07
+  inputOrdered := .empty
+  transaction := andAddInduct07
+  aligned := andAligned07
+
+/-! ### Or -/
+
+theorem orCheckedWF07 : orChecked.WF VEnv.empty := by
+  constructor
+  · change VEnv.empty.OnTel 0 [] [.sort .zero, .sort .zero]
+    exact ⟨⟨.succ .zero, VEnv.HasType.sort trivial⟩,
+      ⟨⟨.succ .zero, VEnv.HasType.sort trivial⟩, trivial⟩⟩
+  · intro ctor hctor
+    rcases List.mem_cons.1 hctor with rfl | hctor
+    · constructor
+      · change VInductDecl.fieldsWF 0 ``Or 2 VEnv.empty .zero []
+          [.sort .zero, .sort .zero] 0 [.bvar 1]
+        constructor
+        · exact .inr (.inr ⟨rfl, .zero, by type_tac, .inl rfl⟩)
+        constructor
+        · intro recursive
+          contradiction
+        · trivial
+      · exact .nil
+    · have hctor' := List.mem_singleton.1 hctor
+      subst ctor
+      constructor
+      · change VInductDecl.fieldsWF 0 ``Or 2 VEnv.empty .zero []
+          [.sort .zero, .sort .zero] 0 [.bvar 0]
+        constructor
+        · exact .inr (.inr ⟨rfl, .zero, by type_tac, .inl rfl⟩)
+        constructor
+        · intro recursive
+          contradiction
+        · trivial
+      · exact .nil
+
+theorem orGenerationWF07 : orGenerationChecked.WF VEnv.empty := by
+  exact orCheckedWF07.identityGeneration .empty
+
+def orTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst orType.name orType.toVConstant).get!
+
+def orInlEnv07 : VEnv :=
+  (orTypeEnv07.addConst orType.ctors[0].name
+    orType.ctors[0].toVConstant).get!
+
+def orCtorEnv07 : VEnv :=
+  (orInlEnv07.addConst orType.ctors[1].name
+    orType.ctors[1].toVConstant).get!
+
+def orRecEnv07 : VEnv :=
+  (orCtorEnv07.addConst ``Or.rec
+    (inductGenerationRecVal orGenerationChecked).toVConstant).get!
+
+def orFinalEnv07 : VEnv :=
+  orGenerationChecked.generatedRules.foldl VEnv.addDefEq orRecEnv07
+
+def orTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``Or orInfo06
+
+def orInlMap07 : ConstMap :=
+  orTypeMap07.insert ``Or.inl orInlInfo06
+
+def orCtorMap07 : ConstMap :=
+  orInlMap07.insert ``Or.inr orInrInfo06
+
+def orMap07 : ConstMap :=
+  orCtorMap07.insert ``Or.rec orRecInfo06
+
+theorem orTypeEnv_ordered07 : orTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty orGenerationWF07 rfl
+
+theorem orInlEnv_ordered07 : orInlEnv07.Ordered := by
+  refine .const (n := orType.ctors[0].name)
+    (ci := orType.ctors[0].toVConstant) orTypeEnv_ordered07 ?_ rfl
+  exact replayRawCtorWF07 orGenerationWF07 rfl orType.ctors[0]
+    (.head _)
+
+theorem orCtorEnv_ordered07 : orCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 orGenerationWF07 rfl
+    orTypeEnv_ordered07 rfl
+
+theorem orGenerationEnv07 :
+    VInductDecl.GenerationEnv orGenerationChecked orCtorEnv07 :=
+  replayGenerationEnv07 orGenerationWF07 rfl rfl
+    orCtorEnv_ordered07
+
+theorem orInfoTr07 :
+    TrConstVal .safe VEnv.empty orInfo06 orType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr VEnv.empty orInfo06.levelParams []
+      orInfo06.type orType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 orGenerationWF07
+  exact shape.to_trExprS .empty trivial ⟨.sort sort, familyType⟩
+
+theorem orInlInfoTr07 :
+    TrConstVal .safe orTypeEnv07 orInlInfo06 orType.ctors[0] := by
+  have hOr : orTypeEnv07.constants ``Or = some orType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr orTypeEnv07 orInlInfo06.levelParams []
+      orInlInfo06.type orType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 orGenerationWF07 rfl
+    orType.ctors[0] (.head _)
+  exact shape.to_trExprS orTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem orInrInfoTr07 :
+    TrConstVal .safe orInlEnv07 orInrInfo06 orType.ctors[1] := by
+  have hOr : orInlEnv07.constants ``Or = some orType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr orInlEnv07 orInrInfo06.levelParams []
+      orInrInfo06.type orType.ctors[1].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 orGenerationWF07 rfl
+    orType.ctors[1] (.tail _ (.head _))
+  have typeToInl : orTypeEnv07 ≤ orInlEnv07 :=
+    VEnv.addConst_le (show orTypeEnv07.addConst orType.ctors[0].name
+      orType.ctors[0].toVConstant = some orInlEnv07 from rfl)
+  exact shape.to_trExprS orInlEnv_ordered07 trivial
+    ⟨.sort sort, ctorType.mono typeToInl⟩
+
+theorem orRecInfoTr07 :
+    TrConstVal .safe orCtorEnv07 orRecInfo06
+      (inductGenerationRecVal orGenerationChecked) := by
+  have hOr : orCtorEnv07.constants ``Or = some orType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr orCtorEnv07 orRecInfo06.levelParams []
+      orRecInfo06.type
+      (inductGenerationRecVal orGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := orGenerationEnv07.recursor_wf
+  exact shape.to_trExprS orCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem orTypeFresh07 : ({} : ConstMap).find? ``Or = none := by
+  simp [SMap.find?]
+
+theorem orTypeMapWF07 : orTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ orTypeFresh07
+
+theorem orInlFresh07 : orTypeMap07.find? ``Or.inl = none := by
+  rw [orTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem orInlMapWF07 : orInlMap07.WF :=
+  orTypeMapWF07.insert _ _ orInlFresh07
+
+theorem orInrFresh07 : orInlMap07.find? ``Or.inr = none := by
+  rw [orInlMap07, orTypeMapWF07.find?_insert, orTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem orCtorMapWF07 : orCtorMap07.WF :=
+  orInlMapWF07.insert _ _ orInrFresh07
+
+theorem orRecFresh07 : orCtorMap07.find? ``Or.rec = none := by
+  rw [orCtorMap07, orInlMapWF07.find?_insert, orInlMap07,
+    orTypeMapWF07.find?_insert, orTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem orAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty orDecl
+    orMap07 orFinalEnv07 := by
+  refine ⟨{
+    generation := orGenerationChecked
+    generation_wf := orGenerationWF07
+    typeMap := orTypeMap07
+    typeEnv := orTypeEnv07
+    ctorMap := orCtorMap07
+    ctorEnv := orCtorEnv07
+    recEnv := orRecEnv07
+    addType := {
+      info := orInfo06
+      kind_eq := by simp [orInfo06, InductConstantKind.Matches]
+      tr := orInfoTr07
+      map_fresh := orTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := orRecInfo06
+      kind_eq := by simp [orRecInfo06, InductConstantKind.Matches]
+      tr := orRecInfoTr07
+      map_fresh := orRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := orInlInfo06
+      kind_eq := by simp [orInlInfo06, InductConstantKind.Matches]
+      tr := orInlInfoTr07
+      map_fresh := by simpa [orType] using orInlFresh07
+      env_add := rfl
+      map_add := rfl }
+    (.cons {
+      info := orInrInfo06
+      kind_eq := by simp [orInrInfo06, InductConstantKind.Matches]
+      tr := orInrInfoTr07
+      map_fresh := by
+        change orInlMap07.find? ``Or.inr = none
+        exact orInrFresh07
+      env_add := rfl
+      map_add := rfl } .nil)
+
+theorem orAligned07 : Aligned .safe orMap07 orFinalEnv07 :=
+  Aligned.addInduct orAddInduct07 .empty
+
+def orReplay07 : SingletonReplayArtifact where
+  label := ``Or
+  source := orDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := orMap07
+  outputEnv := orFinalEnv07
+  inputOrdered := .empty
+  transaction := orAddInduct07
+  aligned := orAligned07
+
+/-! ### HEq -/
+
+theorem heqCheckedWF07 : heqChecked.WF VEnv.empty := by
+  constructor
+  · change VEnv.empty.OnTel 1 []
+      [.sort (.param 0), .bvar 0, .sort (.param 0), .bvar 0]
+    exact ⟨⟨.succ (.param 0), VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨.param 0, by type_tac⟩,
+        ⟨⟨.succ (.param 0), VEnv.HasType.sort (by decide)⟩,
+          ⟨⟨.param 0, by type_tac⟩, trivial⟩⟩⟩⟩
+  · intro ctor hctor
+    have hctor' := List.mem_singleton.1 hctor
+    subst ctor
+    constructor
+    · change True
+      trivial
+    · change VEnv.empty.SpineWF 1 [.bvar 0, .sort (.param 0)]
+        (.forallE (.sort (.param 0))
+          (.forallE (.bvar 0) (.sort .zero)))
+        [.bvar 1, .bvar 0] (.sort .zero)
+      exact .cons (by type_tac) <| .cons (by type_tac) .nil
+
+theorem heqGenerationWF07 : heqGenerationChecked.WF VEnv.empty := by
+  exact heqCheckedWF07.identityGeneration .empty
+
+def heqTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst heqType.name heqType.toVConstant).get!
+
+def heqCtorEnv07 : VEnv :=
+  (heqTypeEnv07.addConst heqType.ctors[0].name
+    heqType.ctors[0].toVConstant).get!
+
+def heqRecEnv07 : VEnv :=
+  (heqCtorEnv07.addConst ``HEq.rec
+    (inductGenerationRecVal heqGenerationChecked).toVConstant).get!
+
+def heqFinalEnv07 : VEnv :=
+  heqGenerationChecked.generatedRules.foldl VEnv.addDefEq heqRecEnv07
+
+def heqTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``HEq heqInfo07
+
+def heqCtorMap07 : ConstMap :=
+  heqTypeMap07.insert ``HEq.refl heqReflInfo07
+
+def heqMap07 : ConstMap :=
+  heqCtorMap07.insert ``HEq.rec heqRecInfo07
+
+theorem heqTypeEnv_ordered07 : heqTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty heqGenerationWF07 rfl
+
+theorem heqCtorEnv_ordered07 : heqCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 heqGenerationWF07 rfl
+    heqTypeEnv_ordered07 rfl
+
+theorem heqGenerationEnv07 :
+    VInductDecl.GenerationEnv heqGenerationChecked heqCtorEnv07 :=
+  replayGenerationEnv07 heqGenerationWF07 rfl rfl
+    heqCtorEnv_ordered07
+
+theorem heqInfoTr07 :
+    TrConstVal .safe VEnv.empty heqInfo07 heqType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr VEnv.empty heqInfo07.levelParams []
+      heqInfo07.type heqType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 heqGenerationWF07
+  exact shape.to_trExprS .empty trivial ⟨.sort sort, familyType⟩
+
+theorem heqCtorInfoTr07 :
+    TrConstVal .safe heqTypeEnv07 heqReflInfo07 heqType.ctors[0] := by
+  have hHEq : heqTypeEnv07.constants ``HEq =
+      some heqType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr heqTypeEnv07 heqReflInfo07.levelParams []
+      heqReflInfo07.type heqType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 heqGenerationWF07 rfl
+    heqType.ctors[0] (.head _)
+  exact shape.to_trExprS heqTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem heqRecInfoTr07 :
+    TrConstVal .safe heqCtorEnv07 heqRecInfo07
+      (inductGenerationRecVal heqGenerationChecked) := by
+  have hHEq : heqCtorEnv07.constants ``HEq =
+      some heqType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr heqCtorEnv07 heqRecInfo07.levelParams []
+      heqRecInfo07.type
+      (inductGenerationRecVal heqGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := heqGenerationEnv07.recursor_wf
+  exact shape.to_trExprS heqCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem heqTypeFresh07 : ({} : ConstMap).find? ``HEq = none := by
+  simp [SMap.find?]
+
+theorem heqTypeMapWF07 : heqTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ heqTypeFresh07
+
+theorem heqCtorFresh07 : heqTypeMap07.find? ``HEq.refl = none := by
+  rw [heqTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem heqCtorMapWF07 : heqCtorMap07.WF :=
+  heqTypeMapWF07.insert _ _ heqCtorFresh07
+
+theorem heqRecFresh07 : heqCtorMap07.find? ``HEq.rec = none := by
+  rw [heqCtorMap07, heqTypeMapWF07.find?_insert, heqTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem heqAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty heqDecl
+    heqMap07 heqFinalEnv07 := by
+  refine ⟨{
+    generation := heqGenerationChecked
+    generation_wf := heqGenerationWF07
+    typeMap := heqTypeMap07
+    typeEnv := heqTypeEnv07
+    ctorMap := heqCtorMap07
+    ctorEnv := heqCtorEnv07
+    recEnv := heqRecEnv07
+    addType := {
+      info := heqInfo07
+      kind_eq := by simp [heqInfo07, InductConstantKind.Matches]
+      tr := heqInfoTr07
+      map_fresh := heqTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := heqRecInfo07
+      kind_eq := by simp [heqRecInfo07, InductConstantKind.Matches]
+      tr := heqRecInfoTr07
+      map_fresh := heqRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := heqReflInfo07
+    kind_eq := by simp [heqReflInfo07, InductConstantKind.Matches]
+    tr := heqCtorInfoTr07
+    map_fresh := by simpa [heqType] using heqCtorFresh07
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem heqAligned07 : Aligned .safe heqMap07 heqFinalEnv07 :=
+  Aligned.addInduct heqAddInduct07 .empty
+
+def heqReplay07 : SingletonReplayArtifact where
+  label := ``HEq
+  source := heqDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := heqMap07
+  outputEnv := heqFinalEnv07
+  inputOrdered := .empty
+  transaction := heqAddInduct07
+  aligned := heqAligned07
+
+/-! ### Fin dependency environment -/
+
+def finLTInfo07 : ConstantInfo := kernelInductInfo% LT
+def finLTMkInfo07 : ConstantInfo := kernelCtorInfo% LT.mk
+def finLTLtInfo07 : ConstantInfo := .defnInfo (kernelDefVal% LT.lt)
+def finInstLTNatInfo07 : ConstantInfo :=
+  .defnInfo (kernelDefVal% instLTNat)
+
+def finLTConst07 : VConstVal := ⟨vconst(type_of% @LT), ``LT⟩
+def finLTMkConst07 : VConstVal := ⟨vconst(type_of% @LT.mk), ``LT.mk⟩
+def finLTLtConst07 : VConstVal := ⟨vconst(type_of% @LT.lt), ``LT.lt⟩
+def finInstLTNatConst07 : VConstVal :=
+  ⟨vconst(type_of% @instLTNat), ``instLTNat⟩
+
+def finLTMap07 : ConstMap := natTypeMap.insert ``LT finLTInfo07
+def finLTMkMap07 : ConstMap := finLTMap07.insert ``LT.mk finLTMkInfo07
+def finLTLtMap07 : ConstMap := finLTMkMap07.insert ``LT.lt finLTLtInfo07
+def finInputMap07 : ConstMap :=
+  finLTLtMap07.insert ``instLTNat finInstLTNatInfo07
+
+def finLTEnv07 : VEnv :=
+  (natTypeEnv.addConst ``LT finLTConst07.toVConstant).get!
+
+def finLTMkEnv07 : VEnv :=
+  (finLTEnv07.addConst ``LT.mk finLTMkConst07.toVConstant).get!
+
+def finLTLtEnv07 : VEnv :=
+  (finLTMkEnv07.addConst ``LT.lt finLTLtConst07.toVConstant).get!
+
+def finInputEnv07 : VEnv :=
+  (finLTLtEnv07.addConst ``instLTNat
+    finInstLTNatConst07.toVConstant).get!
+
+theorem natTypeAligned07 : Aligned .safe natTypeMap natTypeEnv := by
+  exact Aligned.const .empty natType_fresh natInfo_tr.1 rfl natInfo_tr.2
+
+theorem finLTConstWF07 : finLTConst07.toVConstant.WF natTypeEnv := by
+  change natTypeEnv.IsType finLTConst07.uvars [] finLTConst07.type
+  dsimp [finLTConst07]
+  refine ⟨.imax (.succ (.succ (.param 0)))
+    (.succ (.succ (.param 0))), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.succ (.param 0)))
+    (v := .succ (.succ (.param 0))) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · exact VEnv.HasType.sort (by decide)
+
+theorem finLTInfoTr07 :
+    TrConstVal .safe natTypeEnv finLTInfo07 finLTConst07 := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr natTypeEnv finLTInfo07.levelParams []
+      finLTInfo07.type finLTConst07.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := finLTConstWF07
+  exact shape.to_trExprS natTypeEnv_ordered trivial
+    ⟨.sort sort, familyType⟩
+
+theorem finLTFresh07 : natTypeMap.find? ``LT = none := by
+  rw [natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finLTMapWF07 : finLTMap07.WF :=
+  natTypeMap_wf.insert _ _ finLTFresh07
+
+theorem finLTEnv_ordered07 : finLTEnv07.Ordered :=
+  .const (n := ``LT) (ci := finLTConst07.toVConstant)
+    natTypeEnv_ordered finLTConstWF07 rfl
+
+theorem finLTAligned07 : Aligned .safe finLTMap07 finLTEnv07 :=
+  Aligned.const natTypeAligned07 finLTFresh07 finLTInfoTr07.1 rfl
+    finLTInfoTr07.2
+
+theorem finLTMkConstWF07 : finLTMkConst07.toVConstant.WF finLTEnv07 := by
+  have hLT : finLTEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  change finLTEnv07.IsType finLTMkConst07.uvars [] finLTMkConst07.type
+  dsimp [finLTMkConst07]
+  refine ⟨.imax (.succ (.succ (.param 0)))
+    (.imax
+      (.imax (.succ (.param 0))
+        (.imax (.succ (.param 0)) (.succ .zero)))
+      (.succ (.param 0))), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.succ (.param 0)))
+    (v := .imax
+      (.imax (.succ (.param 0))
+        (.imax (.succ (.param 0)) (.succ .zero)))
+      (.succ (.param 0))) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · refine VEnv.HasType.forallE
+      (u := .imax (.succ (.param 0))
+        (.imax (.succ (.param 0)) (.succ .zero)))
+      (v := .succ (.param 0)) ?_ ?_
+    · refine VEnv.HasType.forallE
+        (u := .succ (.param 0))
+        (v := .imax (.succ (.param 0)) (.succ .zero)) ?_ ?_
+      · type_tac
+      · refine VEnv.HasType.forallE
+          (u := .succ (.param 0)) (v := .succ .zero) ?_ ?_
+        · type_tac
+        · exact VEnv.HasType.sort (by decide)
+    · type_tac
+
+theorem finLTMkInfoTr07 :
+    TrConstVal .safe finLTEnv07 finLTMkInfo07 finLTMkConst07 := by
+  have hLT : finLTEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr finLTEnv07 finLTMkInfo07.levelParams []
+      finLTMkInfo07.type finLTMkConst07.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := finLTMkConstWF07
+  exact shape.to_trExprS finLTEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem finLTMkFresh07 : finLTMap07.find? ``LT.mk = none := by
+  rw [finLTMap07, natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finLTMkMapWF07 : finLTMkMap07.WF :=
+  finLTMapWF07.insert _ _ finLTMkFresh07
+
+theorem finLTMkEnv_ordered07 : finLTMkEnv07.Ordered :=
+  .const (n := ``LT.mk) (ci := finLTMkConst07.toVConstant)
+    finLTEnv_ordered07 finLTMkConstWF07 rfl
+
+theorem finLTMkAligned07 : Aligned .safe finLTMkMap07 finLTMkEnv07 :=
+  Aligned.const finLTAligned07 finLTMkFresh07 finLTMkInfoTr07.1 rfl
+    finLTMkInfoTr07.2
+
+theorem finLTLtConstWF07 : finLTLtConst07.toVConstant.WF finLTMkEnv07 := by
+  have hLT : finLTMkEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  change finLTMkEnv07.IsType finLTLtConst07.uvars [] finLTLtConst07.type
+  dsimp [finLTLtConst07]
+  refine ⟨.imax (.succ (.succ (.param 0)))
+    (.imax (.succ (.param 0))
+      (.imax (.succ (.param 0))
+        (.imax (.succ (.param 0)) (.succ .zero)))), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.succ (.param 0)))
+    (v := .imax (.succ (.param 0))
+      (.imax (.succ (.param 0))
+        (.imax (.succ (.param 0)) (.succ .zero)))) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · refine VEnv.HasType.forallE
+      (u := .succ (.param 0))
+      (v := .imax (.succ (.param 0))
+        (.imax (.succ (.param 0)) (.succ .zero))) ?_ ?_
+    · type_tac
+    · refine VEnv.HasType.forallE
+        (u := .succ (.param 0))
+        (v := .imax (.succ (.param 0)) (.succ .zero)) ?_ ?_
+      · type_tac
+      · refine VEnv.HasType.forallE
+          (u := .succ (.param 0)) (v := .succ .zero) ?_ ?_
+        · type_tac
+        · exact VEnv.HasType.sort (by decide)
+
+theorem finLTLtInfoTr07 :
+    TrConstVal .safe finLTMkEnv07 finLTLtInfo07 finLTLtConst07 := by
+  have hLT : finLTMkEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr finLTMkEnv07 finLTLtInfo07.levelParams []
+      finLTLtInfo07.type finLTLtConst07.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, projectionType⟩ := finLTLtConstWF07
+  exact shape.to_trExprS finLTMkEnv_ordered07 trivial
+    ⟨.sort sort, projectionType⟩
+
+theorem finLTLtFresh07 : finLTMkMap07.find? ``LT.lt = none := by
+  rw [finLTMkMap07, finLTMapWF07.find?_insert, finLTMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finLTLtMapWF07 : finLTLtMap07.WF :=
+  finLTMkMapWF07.insert _ _ finLTLtFresh07
+
+theorem finLTLtEnv_ordered07 : finLTLtEnv07.Ordered :=
+  .const (n := ``LT.lt) (ci := finLTLtConst07.toVConstant)
+    finLTMkEnv_ordered07 finLTLtConstWF07 rfl
+
+theorem finLTLtAligned07 : Aligned .safe finLTLtMap07 finLTLtEnv07 :=
+  Aligned.const finLTMkAligned07 finLTLtFresh07 finLTLtInfoTr07.1 rfl
+    finLTLtInfoTr07.2
+
+theorem finInstLTNatConstWF07 :
+    finInstLTNatConst07.toVConstant.WF finLTLtEnv07 := by
+  have hNat : finLTLtEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hLT : finLTLtEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  change finLTLtEnv07.IsType finInstLTNatConst07.uvars []
+    finInstLTNatConst07.type
+  dsimp [finInstLTNatConst07]
+  refine ⟨.succ .zero, ?_⟩
+  type_tac
+
+theorem finInstLTNatInfoTr07 :
+    TrConstVal .safe finLTLtEnv07 finInstLTNatInfo07
+      finInstLTNatConst07 := by
+  have hNat : finLTLtEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hLT : finLTLtEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr finLTLtEnv07 finInstLTNatInfo07.levelParams []
+      finInstLTNatInfo07.type finInstLTNatConst07.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, instanceType⟩ := finInstLTNatConstWF07
+  exact shape.to_trExprS finLTLtEnv_ordered07 trivial
+    ⟨.sort sort, instanceType⟩
+
+theorem finInstLTNatFresh07 :
+    finLTLtMap07.find? ``instLTNat = none := by
+  rw [finLTLtMap07, finLTMkMapWF07.find?_insert, finLTMkMap07,
+    finLTMapWF07.find?_insert, finLTMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finInputMapWF07 : finInputMap07.WF :=
+  finLTLtMapWF07.insert _ _ finInstLTNatFresh07
+
+theorem finInputEnv_ordered07 : finInputEnv07.Ordered :=
+  .const (n := ``instLTNat) (ci := finInstLTNatConst07.toVConstant)
+    finLTLtEnv_ordered07 finInstLTNatConstWF07 rfl
+
+theorem finInputAligned07 : Aligned .safe finInputMap07 finInputEnv07 :=
+  Aligned.const finLTLtAligned07 finInstLTNatFresh07
+    finInstLTNatInfoTr07.1 rfl finInstLTNatInfoTr07.2
+
+example : finInputMap07 = finDependencyMap07 := rfl
+
+/-! ### Fin -/
+
+theorem finCheckedWF07 : finChecked.WF finInputEnv07 := by
+  constructor
+  · change finInputEnv07.OnTel 0 [] [.const ``Nat []]
+    have hNat : finInputEnv07.constants ``Nat =
+        some natType.toVConstant := rfl
+    exact ⟨⟨.succ .zero, by type_tac⟩, trivial⟩
+  · intro ctor hctor
+    have hctor' := List.mem_singleton.1 hctor
+    subst ctor
+    constructor
+    · change VInductDecl.fieldsWF 0 ``Fin 1 finInputEnv07
+        (.succ .zero) [] [.const ``Nat []] 0
+        [.const ``Nat [],
+          .app
+            (.app
+              (.app
+                (.app (.const ``LT.lt [.zero]) (.const ``Nat []))
+                  (.const ``instLTNat []))
+                (.bvar 0))
+              (.bvar 1)]
+      have hNat : finInputEnv07.constants ``Nat =
+          some natType.toVConstant := rfl
+      have hLT : finInputEnv07.constants ``LT =
+          some finLTConst07.toVConstant := rfl
+      have hLTLt : finInputEnv07.constants ``LT.lt =
+          some finLTLtConst07.toVConstant := rfl
+      have hInst : finInputEnv07.constants ``instLTNat =
+          some finInstLTNatConst07.toVConstant := rfl
+      constructor
+      · exact .inr (.inr ⟨rfl, .succ .zero, by type_tac,
+          .inr (VLevel.le_refl _)⟩)
+      constructor
+      · intro recursive
+        contradiction
+      constructor
+      · exact .inr (.inr ⟨rfl, .zero, by type_tac,
+          .inr VLevel.zero_le⟩)
+      constructor
+      · intro recursive
+        contradiction
+      · trivial
+    · exact .nil
+
+theorem finGenerationWF07 : finGenerationChecked.WF finInputEnv07 := by
+  exact finCheckedWF07.identityGeneration finInputEnv_ordered07
+
+def finTypeEnv07 : VEnv :=
+  (finInputEnv07.addConst finType.name finType.toVConstant).get!
+
+def finCtorEnv07 : VEnv :=
+  (finTypeEnv07.addConst finType.ctors[0].name
+    finType.ctors[0].toVConstant).get!
+
+def finRecEnv07 : VEnv :=
+  (finCtorEnv07.addConst ``Fin.rec
+    (inductGenerationRecVal finGenerationChecked).toVConstant).get!
+
+def finFinalEnv07 : VEnv :=
+  finGenerationChecked.generatedRules.foldl VEnv.addDefEq finRecEnv07
+
+def finTypeMap07 : ConstMap := finInputMap07.insert ``Fin finInfo07
+def finCtorMap07 : ConstMap := finTypeMap07.insert ``Fin.mk finMkInfo07
+def finMap07 : ConstMap := finCtorMap07.insert ``Fin.rec finRecInfo07
+
+theorem finTypeEnv_ordered07 : finTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 finInputEnv_ordered07 finGenerationWF07 rfl
+
+theorem finCtorEnv_ordered07 : finCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 finGenerationWF07 rfl finTypeEnv_ordered07 rfl
+
+theorem finGenerationEnv07 :
+    VInductDecl.GenerationEnv finGenerationChecked finCtorEnv07 :=
+  replayGenerationEnv07 finGenerationWF07 rfl rfl finCtorEnv_ordered07
+
+theorem finInfoTr07 :
+    TrConstVal .safe finInputEnv07 finInfo07 finType.toVConstVal := by
+  have hNat : finInputEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr finInputEnv07 finInfo07.levelParams []
+      finInfo07.type finType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 finGenerationWF07
+  exact shape.to_trExprS finInputEnv_ordered07 trivial
+    ⟨.sort sort, familyType⟩
+
+theorem finCtorInfoTr07 :
+    TrConstVal .safe finTypeEnv07 finMkInfo07 finType.ctors[0] := by
+  have hNat : finTypeEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hLT : finTypeEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  have hLTLt : finTypeEnv07.constants ``LT.lt =
+      some finLTLtConst07.toVConstant := rfl
+  have hInst : finTypeEnv07.constants ``instLTNat =
+      some finInstLTNatConst07.toVConstant := rfl
+  have hFin : finTypeEnv07.constants ``Fin =
+      some finType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr finTypeEnv07 finMkInfo07.levelParams []
+      finMkInfo07.type finType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 finGenerationWF07 rfl
+    finType.ctors[0] (.head _)
+  exact shape.to_trExprS finTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem finRecInfoTr07 :
+    TrConstVal .safe finCtorEnv07 finRecInfo07
+      (inductGenerationRecVal finGenerationChecked) := by
+  have hNat : finCtorEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hLT : finCtorEnv07.constants ``LT =
+      some finLTConst07.toVConstant := rfl
+  have hLTLt : finCtorEnv07.constants ``LT.lt =
+      some finLTLtConst07.toVConstant := rfl
+  have hInst : finCtorEnv07.constants ``instLTNat =
+      some finInstLTNatConst07.toVConstant := rfl
+  have hFin : finCtorEnv07.constants ``Fin =
+      some finType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr finCtorEnv07 finRecInfo07.levelParams []
+      finRecInfo07.type
+      (inductGenerationRecVal finGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := finGenerationEnv07.recursor_wf
+  exact shape.to_trExprS finCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem finTypeFresh07 : finInputMap07.find? ``Fin = none := by
+  rw [finInputMap07, finLTLtMapWF07.find?_insert, finLTLtMap07,
+    finLTMkMapWF07.find?_insert, finLTMkMap07,
+    finLTMapWF07.find?_insert, finLTMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finTypeMapWF07 : finTypeMap07.WF :=
+  finInputMapWF07.insert _ _ finTypeFresh07
+
+theorem finCtorFresh07 : finTypeMap07.find? ``Fin.mk = none := by
+  rw [finTypeMap07, finInputMapWF07.find?_insert, finInputMap07,
+    finLTLtMapWF07.find?_insert, finLTLtMap07,
+    finLTMkMapWF07.find?_insert, finLTMkMap07,
+    finLTMapWF07.find?_insert, finLTMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finCtorMapWF07 : finCtorMap07.WF :=
+  finTypeMapWF07.insert _ _ finCtorFresh07
+
+theorem finRecFresh07 : finCtorMap07.find? ``Fin.rec = none := by
+  rw [finCtorMap07, finTypeMapWF07.find?_insert, finTypeMap07,
+    finInputMapWF07.find?_insert, finInputMap07,
+    finLTLtMapWF07.find?_insert, finLTLtMap07,
+    finLTMkMapWF07.find?_insert, finLTMkMap07,
+    finLTMapWF07.find?_insert, finLTMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem finAddInduct07 : AddInduct finInputMap07 finInputEnv07 finDecl
+    finMap07 finFinalEnv07 := by
+  refine ⟨{
+    generation := finGenerationChecked
+    generation_wf := finGenerationWF07
+    typeMap := finTypeMap07
+    typeEnv := finTypeEnv07
+    ctorMap := finCtorMap07
+    ctorEnv := finCtorEnv07
+    recEnv := finRecEnv07
+    addType := {
+      info := finInfo07
+      kind_eq := by simp [finInfo07, InductConstantKind.Matches]
+      tr := finInfoTr07
+      map_fresh := finTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := finRecInfo07
+      kind_eq := by simp [finRecInfo07, InductConstantKind.Matches]
+      tr := finRecInfoTr07
+      map_fresh := finRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := finMkInfo07
+    kind_eq := by simp [finMkInfo07, InductConstantKind.Matches]
+    tr := finCtorInfoTr07
+    map_fresh := by simpa [finType] using finCtorFresh07
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem finAligned07 : Aligned .safe finMap07 finFinalEnv07 :=
+  Aligned.addInduct finAddInduct07 finInputAligned07
+
+def finReplay07 : SingletonReplayArtifact where
+  label := ``Fin
+  source := finDecl
+  inputMap := finInputMap07
+  inputEnv := finInputEnv07
+  inputMapWF := finInputMapWF07
+  outputMap := finMap07
+  outputEnv := finFinalEnv07
+  inputOrdered := finInputEnv_ordered07
+  transaction := finAddInduct07
+  aligned := finAligned07
+
+/-! ### Vector dependency environment -/
+
+def vectorArrayInfo07 : ConstantInfo := kernelInductInfo% Array
+def vectorArraySizeInfo07 : ConstantInfo :=
+  .defnInfo (kernelDefVal% Array.size)
+
+def vectorArrayConst07 : VConstVal :=
+  ⟨vconst(type_of% @Array), ``Array⟩
+
+def vectorArraySizeConst07 : VConstVal :=
+  ⟨vconst(type_of% @Array.size), ``Array.size⟩
+
+def vectorEqMap07 : ConstMap := natTypeMap.insert ``Eq eqInfo
+def vectorArrayMap07 : ConstMap :=
+  vectorEqMap07.insert ``Array vectorArrayInfo07
+def vectorInputMap07 : ConstMap :=
+  vectorArrayMap07.insert ``Array.size vectorArraySizeInfo07
+
+def vectorEqEnv07 : VEnv :=
+  (natTypeEnv.addConst ``Eq eqType.toVConstant).get!
+
+def vectorArrayEnv07 : VEnv :=
+  (vectorEqEnv07.addConst ``Array vectorArrayConst07.toVConstant).get!
+
+def vectorInputEnv07 : VEnv :=
+  (vectorArrayEnv07.addConst ``Array.size
+    vectorArraySizeConst07.toVConstant).get!
+
+theorem empty_le_natTypeEnv07 : VEnv.empty ≤ natTypeEnv :=
+  VEnv.addConst_le (show VEnv.empty.addConst natType.name
+    natType.toVConstant = some natTypeEnv from rfl)
+
+theorem vectorEqTypeWF07 : eqType.toVConstant.WF natTypeEnv :=
+  eqType_wf.mono empty_le_natTypeEnv07
+
+theorem vectorEqInfoTr07 :
+    TrConstVal .safe natTypeEnv eqInfo eqType.toVConstVal :=
+  eqInfo_tr.mono empty_le_natTypeEnv07
+
+theorem vectorEqFresh07 : natTypeMap.find? ``Eq = none := by
+  rw [natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem vectorEqMapWF07 : vectorEqMap07.WF :=
+  natTypeMap_wf.insert _ _ vectorEqFresh07
+
+theorem vectorEqEnv_ordered07 : vectorEqEnv07.Ordered :=
+  .const (n := ``Eq) (ci := eqType.toVConstant)
+    natTypeEnv_ordered vectorEqTypeWF07 rfl
+
+theorem vectorEqAligned07 : Aligned .safe vectorEqMap07 vectorEqEnv07 :=
+  Aligned.const natTypeAligned07 vectorEqFresh07 vectorEqInfoTr07.1 rfl
+    vectorEqInfoTr07.2
+
+theorem vectorArrayConstWF07 :
+    vectorArrayConst07.toVConstant.WF vectorEqEnv07 := by
+  change vectorEqEnv07.IsType vectorArrayConst07.uvars []
+    vectorArrayConst07.type
+  dsimp [vectorArrayConst07]
+  refine ⟨.imax (.succ (.succ (.param 0)))
+    (.succ (.succ (.param 0))), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.succ (.param 0)))
+    (v := .succ (.succ (.param 0))) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · exact VEnv.HasType.sort (by decide)
+
+theorem vectorArrayInfoTr07 :
+    TrConstVal .safe vectorEqEnv07 vectorArrayInfo07
+      vectorArrayConst07 := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr vectorEqEnv07 vectorArrayInfo07.levelParams []
+      vectorArrayInfo07.type vectorArrayConst07.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, arrayType⟩ := vectorArrayConstWF07
+  exact shape.to_trExprS vectorEqEnv_ordered07 trivial
+    ⟨.sort sort, arrayType⟩
+
+theorem vectorArrayFresh07 : vectorEqMap07.find? ``Array = none := by
+  rw [vectorEqMap07, natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem vectorArrayMapWF07 : vectorArrayMap07.WF :=
+  vectorEqMapWF07.insert _ _ vectorArrayFresh07
+
+theorem vectorArrayEnv_ordered07 : vectorArrayEnv07.Ordered :=
+  .const (n := ``Array) (ci := vectorArrayConst07.toVConstant)
+    vectorEqEnv_ordered07 vectorArrayConstWF07 rfl
+
+theorem vectorArrayAligned07 :
+    Aligned .safe vectorArrayMap07 vectorArrayEnv07 :=
+  Aligned.const vectorEqAligned07 vectorArrayFresh07
+    vectorArrayInfoTr07.1 rfl vectorArrayInfoTr07.2
+
+theorem vectorArraySizeConstWF07 :
+    vectorArraySizeConst07.toVConstant.WF vectorArrayEnv07 := by
+  have hNat : vectorArrayEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hArray : vectorArrayEnv07.constants ``Array =
+      some vectorArrayConst07.toVConstant := rfl
+  change vectorArrayEnv07.IsType vectorArraySizeConst07.uvars []
+    vectorArraySizeConst07.type
+  dsimp [vectorArraySizeConst07]
+  refine ⟨.imax (.succ (.succ (.param 0)))
+    (.imax (.succ (.param 0)) (.succ .zero)), ?_⟩
+  refine VEnv.HasType.forallE
+    (u := .succ (.succ (.param 0)))
+    (v := .imax (.succ (.param 0)) (.succ .zero)) ?_ ?_
+  · exact VEnv.HasType.sort (by decide)
+  · refine VEnv.HasType.forallE
+      (u := .succ (.param 0)) (v := .succ .zero) ?_ ?_
+    · type_tac
+    · type_tac
+
+theorem vectorArraySizeInfoTr07 :
+    TrConstVal .safe vectorArrayEnv07 vectorArraySizeInfo07
+      vectorArraySizeConst07 := by
+  have hNat : vectorArrayEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hArray : vectorArrayEnv07.constants ``Array =
+      some vectorArrayConst07.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr vectorArrayEnv07
+      vectorArraySizeInfo07.levelParams [] vectorArraySizeInfo07.type
+      vectorArraySizeConst07.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, sizeType⟩ := vectorArraySizeConstWF07
+  exact shape.to_trExprS vectorArrayEnv_ordered07 trivial
+    ⟨.sort sort, sizeType⟩
+
+theorem vectorArraySizeFresh07 :
+    vectorArrayMap07.find? ``Array.size = none := by
+  rw [vectorArrayMap07, vectorEqMapWF07.find?_insert, vectorEqMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem vectorInputMapWF07 : vectorInputMap07.WF :=
+  vectorArrayMapWF07.insert _ _ vectorArraySizeFresh07
+
+theorem vectorInputEnv_ordered07 : vectorInputEnv07.Ordered :=
+  .const (n := ``Array.size) (ci := vectorArraySizeConst07.toVConstant)
+    vectorArrayEnv_ordered07 vectorArraySizeConstWF07 rfl
+
+theorem vectorInputAligned07 :
+    Aligned .safe vectorInputMap07 vectorInputEnv07 :=
+  Aligned.const vectorArrayAligned07 vectorArraySizeFresh07
+    vectorArraySizeInfoTr07.1 rfl vectorArraySizeInfoTr07.2
+
+example : vectorInputMap07 = vectorDependencyMap07 := rfl
+
+/-! ### Vector -/
+
+theorem vectorCheckedWF07 : vectorChecked.WF vectorInputEnv07 := by
+  constructor
+  · change vectorInputEnv07.OnTel 1 []
+      [.sort (.succ (.param 0)), .const ``Nat []]
+    have hNat : vectorInputEnv07.constants ``Nat =
+        some natType.toVConstant := rfl
+    exact ⟨⟨.succ (.succ (.param 0)), VEnv.HasType.sort (by decide)⟩,
+      ⟨⟨.succ .zero, by type_tac⟩, trivial⟩⟩
+  · intro ctor hctor
+    have hctor' := List.mem_singleton.1 hctor
+    subst ctor
+    constructor
+    · change VInductDecl.fieldsWF 1 ``Vector 2 vectorInputEnv07
+        (.succ (.param 0)) []
+        [.const ``Nat [], .sort (.succ (.param 0))] 0
+        [.app (.const ``Array [.param 0]) (.bvar 1),
+          .app
+            (.app
+              (.app (.const ``Eq [.succ .zero]) (.const ``Nat []))
+                (.app
+                  (.app (.const ``Array.size [.param 0]) (.bvar 2))
+                  (.bvar 0)))
+            (.bvar 1)]
+      have hNat : vectorInputEnv07.constants ``Nat =
+          some natType.toVConstant := rfl
+      have hEq : vectorInputEnv07.constants ``Eq =
+          some eqType.toVConstant := rfl
+      have hArray : vectorInputEnv07.constants ``Array =
+          some vectorArrayConst07.toVConstant := rfl
+      have hSize : vectorInputEnv07.constants ``Array.size =
+          some vectorArraySizeConst07.toVConstant := rfl
+      constructor
+      · exact .inr (.inr ⟨rfl, .succ (.param 0), by type_tac,
+          .inr (VLevel.le_refl _)⟩)
+      constructor
+      · intro recursive
+        contradiction
+      constructor
+      · exact .inr (.inr ⟨rfl, .zero, by type_tac,
+          .inr VLevel.zero_le⟩)
+      constructor
+      · intro recursive
+        contradiction
+      · trivial
+    · exact .nil
+
+theorem vectorGenerationWF07 :
+    vectorGenerationChecked.WF vectorInputEnv07 := by
+  exact vectorCheckedWF07.identityGeneration vectorInputEnv_ordered07
+
+def vectorTypeEnv07 : VEnv :=
+  (vectorInputEnv07.addConst vectorType.name vectorType.toVConstant).get!
+
+def vectorCtorEnv07 : VEnv :=
+  (vectorTypeEnv07.addConst vectorType.ctors[0].name
+    vectorType.ctors[0].toVConstant).get!
+
+def vectorRecEnv07 : VEnv :=
+  (vectorCtorEnv07.addConst ``Vector.rec
+    (inductGenerationRecVal vectorGenerationChecked).toVConstant).get!
+
+def vectorFinalEnv07 : VEnv :=
+  vectorGenerationChecked.generatedRules.foldl VEnv.addDefEq vectorRecEnv07
+
+def vectorTypeMap07 : ConstMap :=
+  vectorInputMap07.insert ``Vector vectorInfo07
+def vectorCtorMap07 : ConstMap :=
+  vectorTypeMap07.insert ``Vector.mk vectorMkInfo07
+def vectorMap07 : ConstMap :=
+  vectorCtorMap07.insert ``Vector.rec vectorRecInfo07
+
+theorem vectorTypeEnv_ordered07 : vectorTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 vectorInputEnv_ordered07 vectorGenerationWF07 rfl
+
+theorem vectorCtorEnv_ordered07 : vectorCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 vectorGenerationWF07 rfl
+    vectorTypeEnv_ordered07 rfl
+
+theorem vectorGenerationEnv07 :
+    VInductDecl.GenerationEnv vectorGenerationChecked vectorCtorEnv07 :=
+  replayGenerationEnv07 vectorGenerationWF07 rfl rfl
+    vectorCtorEnv_ordered07
+
+theorem vectorInfoTr07 :
+    TrConstVal .safe vectorInputEnv07 vectorInfo07
+      vectorType.toVConstVal := by
+  have hNat : vectorInputEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr vectorInputEnv07 vectorInfo07.levelParams []
+      vectorInfo07.type vectorType.type := by
+    tr_type_expr_tac
+  obtain ⟨sort, familyType⟩ := replayRawFamilyWF07 vectorGenerationWF07
+  exact shape.to_trExprS vectorInputEnv_ordered07 trivial
+    ⟨.sort sort, familyType⟩
+
+theorem vectorCtorInfoTr07 :
+    TrConstVal .safe vectorTypeEnv07 vectorMkInfo07 vectorType.ctors[0] := by
+  have hNat : vectorTypeEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hEq : vectorTypeEnv07.constants ``Eq =
+      some eqType.toVConstant := rfl
+  have hArray : vectorTypeEnv07.constants ``Array =
+      some vectorArrayConst07.toVConstant := rfl
+  have hSize : vectorTypeEnv07.constants ``Array.size =
+      some vectorArraySizeConst07.toVConstant := rfl
+  have hVector : vectorTypeEnv07.constants ``Vector =
+      some vectorType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr vectorTypeEnv07 vectorMkInfo07.levelParams []
+      vectorMkInfo07.type vectorType.ctors[0].type := by
+    tr_type_expr_tac
+  obtain ⟨sort, ctorType⟩ := replayRawCtorWF07 vectorGenerationWF07 rfl
+    vectorType.ctors[0] (.head _)
+  exact shape.to_trExprS vectorTypeEnv_ordered07 trivial
+    ⟨.sort sort, ctorType⟩
+
+theorem vectorRecInfoTr07 :
+    TrConstVal .safe vectorCtorEnv07 vectorRecInfo07
+      (inductGenerationRecVal vectorGenerationChecked) := by
+  have hNat : vectorCtorEnv07.constants ``Nat =
+      some natType.toVConstant := rfl
+  have hEq : vectorCtorEnv07.constants ``Eq =
+      some eqType.toVConstant := rfl
+  have hArray : vectorCtorEnv07.constants ``Array =
+      some vectorArrayConst07.toVConstant := rfl
+  have hSize : vectorCtorEnv07.constants ``Array.size =
+      some vectorArraySizeConst07.toVConstant := rfl
+  have hVector : vectorCtorEnv07.constants ``Vector =
+      some vectorType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr vectorCtorEnv07 vectorRecInfo07.levelParams []
+      vectorRecInfo07.type
+      (inductGenerationRecVal vectorGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := vectorGenerationEnv07.recursor_wf
+  exact shape.to_trExprS vectorCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem vectorTypeFresh07 :
+    vectorInputMap07.find? ``Vector = none := by
+  rw [vectorInputMap07, vectorArrayMapWF07.find?_insert,
+    vectorArrayMap07, vectorEqMapWF07.find?_insert, vectorEqMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem vectorTypeMapWF07 : vectorTypeMap07.WF :=
+  vectorInputMapWF07.insert _ _ vectorTypeFresh07
+
+theorem vectorCtorFresh07 :
+    vectorTypeMap07.find? ``Vector.mk = none := by
+  rw [vectorTypeMap07, vectorInputMapWF07.find?_insert,
+    vectorInputMap07, vectorArrayMapWF07.find?_insert,
+    vectorArrayMap07, vectorEqMapWF07.find?_insert, vectorEqMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem vectorCtorMapWF07 : vectorCtorMap07.WF :=
+  vectorTypeMapWF07.insert _ _ vectorCtorFresh07
+
+theorem vectorRecFresh07 :
+    vectorCtorMap07.find? ``Vector.rec = none := by
+  rw [vectorCtorMap07, vectorTypeMapWF07.find?_insert,
+    vectorTypeMap07, vectorInputMapWF07.find?_insert,
+    vectorInputMap07, vectorArrayMapWF07.find?_insert,
+    vectorArrayMap07, vectorEqMapWF07.find?_insert, vectorEqMap07,
+    natTypeMap_wf.find?_insert, natTypeMap,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem vectorAddInduct07 :
+    AddInduct vectorInputMap07 vectorInputEnv07 vectorDecl
+      vectorMap07 vectorFinalEnv07 := by
+  refine ⟨{
+    generation := vectorGenerationChecked
+    generation_wf := vectorGenerationWF07
+    typeMap := vectorTypeMap07
+    typeEnv := vectorTypeEnv07
+    ctorMap := vectorCtorMap07
+    ctorEnv := vectorCtorEnv07
+    recEnv := vectorRecEnv07
+    addType := {
+      info := vectorInfo07
+      kind_eq := by simp [vectorInfo07, InductConstantKind.Matches]
+      tr := vectorInfoTr07
+      map_fresh := vectorTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := vectorRecInfo07
+      kind_eq := by simp [vectorRecInfo07, InductConstantKind.Matches]
+      tr := vectorRecInfoTr07
+      map_fresh := vectorRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+    info := vectorMkInfo07
+    kind_eq := by simp [vectorMkInfo07, InductConstantKind.Matches]
+    tr := vectorCtorInfoTr07
+    map_fresh := by simpa [vectorType] using vectorCtorFresh07
+    env_add := rfl
+    map_add := rfl } .nil
+
+theorem vectorAligned07 : Aligned .safe vectorMap07 vectorFinalEnv07 :=
+  Aligned.addInduct vectorAddInduct07 vectorInputAligned07
+
+def vectorReplay07 : SingletonReplayArtifact where
+  label := ``Vector
+  source := vectorDecl
+  inputMap := vectorInputMap07
+  inputEnv := vectorInputEnv07
+  inputMapWF := vectorInputMapWF07
+  outputMap := vectorMap07
+  outputEnv := vectorFinalEnv07
+  inputOrdered := vectorInputEnv_ordered07
+  transaction := vectorAddInduct07
+  aligned := vectorAligned07
+
+/-! ### Unit/Empty edge cases -/
+
+theorem punitGenerationWF07 : punitGenerationChecked.WF VEnv.empty := by
+  exact (punitChecked.wf_of_decl punitDecl_wf).identityGeneration .empty
+
+def punitTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst punitType.name punitType.toVConstant).get!
+
+def punitCtorEnv07 : VEnv :=
+  (punitTypeEnv07.addConst punitType.ctors[0].name
+    punitType.ctors[0].toVConstant).get!
+
+def punitRecEnv07 : VEnv :=
+  (punitCtorEnv07.addConst ``PUnit.rec
+    (inductGenerationRecVal punitGenerationChecked).toVConstant).get!
+
+def punitFinalEnv07 : VEnv :=
+  punitGenerationChecked.generatedRules.foldl VEnv.addDefEq punitRecEnv07
+
+def punitTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``PUnit punitInfo06C
+
+def punitCtorMap07 : ConstMap :=
+  punitTypeMap07.insert ``PUnit.unit punitCtorInfo06C
+
+def punitMap07 : ConstMap :=
+  punitCtorMap07.insert ``PUnit.rec punitRecInfo06C
+
+theorem punitTypeEnv_ordered07 : punitTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty punitGenerationWF07 rfl
+
+theorem punitCtorEnv_ordered07 : punitCtorEnv07.Ordered :=
+  replayCtorEnv_ordered07 punitGenerationWF07 rfl
+    punitTypeEnv_ordered07 rfl
+
+theorem punitGenerationEnv07 :
+    VInductDecl.GenerationEnv punitGenerationChecked punitCtorEnv07 :=
+  replayGenerationEnv07 punitGenerationWF07 rfl rfl
+    punitCtorEnv_ordered07
+
+theorem punitInfoTr07 :
+    TrConstVal .safe VEnv.empty punitInfo06C punitType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  exact .sort rfl
+
+theorem punitCtorInfoTr07 :
+    TrConstVal .safe punitTypeEnv07 punitCtorInfo06C punitType.ctors[0] := by
+  have hPUnit : punitTypeEnv07.constants ``PUnit =
+      some punitType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr punitTypeEnv07 punitCtorInfo06C.levelParams []
+      punitCtorInfo06C.type punitType.ctors[0].type := by
+    tr_type_expr_tac
+  exact shape.to_trExprS punitTypeEnv_ordered07 trivial
+    ⟨.sort (.param 0), by type_tac⟩
+
+theorem punitRecInfoTr07 :
+    TrConstVal .safe punitCtorEnv07 punitRecInfo06C
+      (inductGenerationRecVal punitGenerationChecked) := by
+  have hPUnit : punitCtorEnv07.constants ``PUnit =
+      some punitType.toVConstant := rfl
+  have hUnit : punitCtorEnv07.constants ``PUnit.unit =
+      some punitType.ctors[0].toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr punitCtorEnv07 punitRecInfo06C.levelParams []
+      punitRecInfo06C.type
+      (inductGenerationRecVal punitGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := punitGenerationEnv07.recursor_wf
+  exact shape.to_trExprS punitCtorEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem punitTypeFresh07 : ({} : ConstMap).find? ``PUnit = none := by
+  simp [SMap.find?]
+
+theorem punitTypeMapWF07 : punitTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ punitTypeFresh07
+
+theorem punitCtorFresh07 : punitTypeMap07.find? ``PUnit.unit = none := by
+  rw [punitTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem punitCtorMapWF07 : punitCtorMap07.WF :=
+  punitTypeMapWF07.insert _ _ punitCtorFresh07
+
+theorem punitRecFresh07 : punitCtorMap07.find? ``PUnit.rec = none := by
+  rw [punitCtorMap07, punitTypeMapWF07.find?_insert, punitTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem punitAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty punitDecl
+    punitMap07 punitFinalEnv07 := by
+  refine ⟨{
+    generation := punitGenerationChecked
+    generation_wf := punitGenerationWF07
+    typeMap := punitTypeMap07
+    typeEnv := punitTypeEnv07
+    ctorMap := punitCtorMap07
+    ctorEnv := punitCtorEnv07
+    recEnv := punitRecEnv07
+    addType := {
+      info := punitInfo06C
+      kind_eq := by simp [punitInfo06C, InductConstantKind.Matches]
+      tr := punitInfoTr07
+      map_fresh := punitTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := ?_
+    addRec := {
+      info := punitRecInfo06C
+      kind_eq := by simp [punitRecInfo06C, InductConstantKind.Matches]
+      tr := punitRecInfoTr07
+      map_fresh := punitRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+  exact .cons {
+      info := punitCtorInfo06C
+      kind_eq := by simp [punitCtorInfo06C, InductConstantKind.Matches]
+      tr := punitCtorInfoTr07
+      map_fresh := by simpa [punitType] using punitCtorFresh07
+      env_add := rfl
+      map_add := rfl } .nil
+
+theorem punitAligned07 : Aligned .safe punitMap07 punitFinalEnv07 :=
+  Aligned.addInduct punitAddInduct07 .empty
+
+def punitReplay07 : SingletonReplayArtifact where
+  label := ``Unit
+  source := punitDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := punitMap07
+  outputEnv := punitFinalEnv07
+  inputOrdered := .empty
+  transaction := punitAddInduct07
+  aligned := punitAligned07
+
+theorem emptyGenerationWF07 : emptyGenerationChecked.WF VEnv.empty := by
+  exact (emptyChecked.wf_of_decl emptyDecl_wf).identityGeneration .empty
+
+def emptyTypeEnv07 : VEnv :=
+  (VEnv.empty.addConst emptyType.name emptyType.toVConstant).get!
+
+def emptyRecEnv07 : VEnv :=
+  (emptyTypeEnv07.addConst ``Empty.rec
+    (inductGenerationRecVal emptyGenerationChecked).toVConstant).get!
+
+def emptyFinalEnv07 : VEnv :=
+  emptyGenerationChecked.generatedRules.foldl VEnv.addDefEq emptyRecEnv07
+
+def emptyTypeMap07 : ConstMap :=
+  ({} : ConstMap).insert ``Empty emptyInfo06C
+
+def emptyMap07 : ConstMap :=
+  emptyTypeMap07.insert ``Empty.rec emptyRecInfo06C
+
+theorem emptyTypeEnv_ordered07 : emptyTypeEnv07.Ordered :=
+  replayTypeEnv_ordered07 .empty emptyGenerationWF07 rfl
+
+theorem emptyGenerationEnv07 :
+    VInductDecl.GenerationEnv emptyGenerationChecked emptyTypeEnv07 :=
+  replayGenerationEnv07 emptyGenerationWF07 rfl rfl
+    emptyTypeEnv_ordered07
+
+theorem emptyInfoTr07 :
+    TrConstVal .safe VEnv.empty emptyInfo06C emptyType.toVConstVal := by
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  exact .sort rfl
+
+theorem emptyRecInfoTr07 :
+    TrConstVal .safe emptyTypeEnv07 emptyRecInfo06C
+      (inductGenerationRecVal emptyGenerationChecked) := by
+  have hEmpty : emptyTypeEnv07.constants ``Empty =
+      some emptyType.toVConstant := rfl
+  refine ⟨⟨by decide, rfl, ?_⟩, rfl⟩
+  have shape : TrTypeExpr emptyTypeEnv07 emptyRecInfo06C.levelParams []
+      emptyRecInfo06C.type
+      (inductGenerationRecVal emptyGenerationChecked).type := by
+    tr_type_expr_tac
+  obtain ⟨sort, recursorType⟩ := emptyGenerationEnv07.recursor_wf
+  exact shape.to_trExprS emptyTypeEnv_ordered07 trivial
+    ⟨.sort sort, recursorType⟩
+
+theorem emptyTypeFresh07 : ({} : ConstMap).find? ``Empty = none := by
+  simp [SMap.find?]
+
+theorem emptyTypeMapWF07 : emptyTypeMap07.WF :=
+  SMap.WF.empty.insert _ _ emptyTypeFresh07
+
+theorem emptyRecFresh07 : emptyTypeMap07.find? ``Empty.rec = none := by
+  rw [emptyTypeMap07,
+    SMap.WF.find?_insert (s := ({} : ConstMap)) SMap.WF.empty]
+  simp [SMap.find?]
+
+theorem emptyAddInduct07 : AddInduct ({} : ConstMap) VEnv.empty emptyDecl
+    emptyMap07 emptyFinalEnv07 := by
+  refine ⟨{
+    generation := emptyGenerationChecked
+    generation_wf := emptyGenerationWF07
+    typeMap := emptyTypeMap07
+    typeEnv := emptyTypeEnv07
+    ctorMap := emptyTypeMap07
+    ctorEnv := emptyTypeEnv07
+    recEnv := emptyRecEnv07
+    addType := {
+      info := emptyInfo06C
+      kind_eq := by simp [emptyInfo06C, InductConstantKind.Matches]
+      tr := emptyInfoTr07
+      map_fresh := emptyTypeFresh07
+      env_add := rfl
+      map_add := rfl }
+    addCtors := .nil
+    addRec := {
+      info := emptyRecInfo06C
+      kind_eq := by simp [emptyRecInfo06C, InductConstantKind.Matches]
+      tr := emptyRecInfoTr07
+      map_fresh := emptyRecFresh07
+      env_add := rfl
+      map_add := rfl }
+    recK := by decide
+    addRules := ⟨rfl⟩ }⟩
+
+theorem emptyAligned07 : Aligned .safe emptyMap07 emptyFinalEnv07 :=
+  Aligned.addInduct emptyAddInduct07 .empty
+
+def emptyReplay07 : SingletonReplayArtifact where
+  label := ``Empty
+  source := emptyDecl
+  inputMap := {}
+  inputEnv := .empty
+  inputMapWF := SMap.WF.empty
+  outputMap := emptyMap07
+  outputEnv := emptyFinalEnv07
+  inputOrdered := .empty
+  transaction := emptyAddInduct07
+  aligned := emptyAligned07
+
+/-- Every fixed Spec-07 positive row, in exactly the same order as the
+Theory/kernel parity matrix.  Each entry carries an actual `ConstantInfo`
+transaction and final environment alignment, including the real dependency
+environments required by `Fin` and `Vector`. -/
+def singletonFixedReplays : List SingletonReplayArtifact :=
+  [natReplay07, boolReplay07, listReplay07, optionReplay07, prodReplay07,
+    punitReplay07, emptyReplay07, orReplay07, andReplay07, eqReplay07,
+    heqReplay07, finReplay07, vectorReplay07, accReplay07]
+
+/-- The focused non-identity normalization rows use the same public replay
+artifact as the standard-library matrix. -/
+def singletonNormalizationReplays :
+    List SingletonReplayArtifact :=
+  [aliasFormerReplay07, aliasRecReplay07, normalizationMatrixReplay07,
+    annotatedPiReplay07, annotatedParamReplay07]
+
+/-- The sole public Spec-07 environment replay inventory. -/
+def singletonReplayMatrix : List SingletonReplayArtifact :=
+  singletonFixedReplays ++ singletonNormalizationReplays
+
+example : singletonFixedReplays.map (·.label) =
+    singletonPositiveArtifacts.map (·.label) := rfl
+
+example : singletonFixedReplays.map (·.source) =
+    singletonPositiveArtifacts.map (·.source) := rfl
+
+example : singletonNormalizationReplays.map (·.label) =
+    singletonNormalizationArtifacts.map (·.label) := rfl
+
+example : singletonNormalizationReplays.map (·.source) =
+    singletonNormalizationArtifacts.map (·.source) := rfl
+
+example : singletonReplayMatrix.map (·.source) =
+    (singletonPositiveArtifacts ++ singletonNormalizationArtifacts).map
+      (·.source) := rfl
+
+example : singletonFixedReplays.length = 14 := rfl
+example : singletonNormalizationReplays.length = 5 := rfl
+example : singletonReplayMatrix.length = 19 := rfl
+
+/-! ## Exact trust manifests for the public replay seam -/
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.SingletonReplayArtifact.outputOrdered [propext, Classical.choice, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.singletonFixedReplays [
+  propext,
+  Classical.choice,
+  Quot.sound,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.singletonNormalizationReplays [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+#guard_named_axioms Ix.Theory.Named.InductiveReplayFixtures.singletonReplayMatrix [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Ix.Theory.Named.ptrEqConstantInfo_eq,
+  Quot.sound,
+  Lean.Expr.abstractRange_eq,
+  Lean.Expr.abstract_eq,
+  Lean.Expr.eqv_eq,
+  Lean.Expr.hasLooseBVar_eq,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.instantiateRange_eq,
+  Lean.Expr.instantiateRevRange_eq,
+  Lean.Expr.instantiateRev_eq,
+  Lean.Expr.instantiate_eq,
+  Lean.Expr.looseBVarRange_eq,
+  Lean.Expr.lowerLooseBVars_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.Level.isExplicitSubsumedAux_eq,
+  Lean.Level.normalize_eq,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.Syntax.structEq_eq,
+  Std.TreeMap.all_eq_all_toList,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
+
+end Ix.Theory.Named.InductiveReplayFixtures
diff --git a/Ix/Theory/Named/Verify/Expr.lean b/Ix/Theory/Named/Verify/Expr.lean
new file mode 100644
index 000000000..fba52e69d
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Expr.lean
@@ -0,0 +1,1303 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.Basic
+import Ix.Theory.Named.Verify.Axioms
+import Ix.Theory.Named.Verify.Level
+import Ix.Theory.Named.Reference.Expr
+import Ix.Theory.Named.Reference.Instantiate
+import Batteries.Data.String.Lemmas
+import Std.Tactic.BVDecide
+
+open Ix.Theory.Named
+
+namespace Lean
+
+instance : LawfulBEq FVarId where
+  eq_of_beq := @fun ⟨a⟩ ⟨b⟩ h => by cases LawfulBEq.eq_of_beq (α := Name) h; rfl
+  rfl := BEq.rfl (α := Name)
+
+instance : LawfulBEq MVarId where
+  eq_of_beq := @fun ⟨a⟩ ⟨b⟩ h => by cases LawfulBEq.eq_of_beq (α := Name) h; rfl
+  rfl := BEq.rfl (α := Name)
+
+instance : LawfulBEq LBool where
+  rfl {a} := by cases a <;> rfl
+  eq_of_beq {a b} := by cases a <;> cases b <;> simp +decide
+
+instance : LawfulBEq DefinitionSafety where
+  rfl {a} := by cases a <;> rfl
+  eq_of_beq {a b} := by cases a <;> cases b <;> simp +decide
+
+-- we have to define this manually instead of `deriving instance Ord`
+-- because the variants are written in the wrong order in core
+protected def DefinitionSafety.compare : DefinitionSafety → DefinitionSafety → Ordering
+  | .unsafe, .unsafe => .eq
+  | .unsafe, _ => .lt
+  | _, .unsafe => .gt
+  | .partial, .partial => .eq
+  | .partial, _ => .lt
+  | _, .partial => .gt
+  | .safe, .safe => .eq
+
+instance : Ord DefinitionSafety := ⟨DefinitionSafety.compare⟩
+
+instance : Std.TransOrd DefinitionSafety where
+  eq_swap {a b} := by cases a <;> cases b <;> rfl
+  isLE_trans {a b c} := by cases a <;> cases b <;> simp! [compare] <;> cases c <;> decide
+
+instance : Std.LawfulBEqOrd DefinitionSafety where
+  compare_eq_iff_beq {a b} := by cases a <;> cases b <;> decide
+instance : Std.LawfulEqOrd DefinitionSafety := Std.LawfulBEqOrd.lawfulEqOrd
+
+instance : LE DefinitionSafety := leOfOrd
+instance : DecidableEq DefinitionSafety := instDecidableEqOfLawfulBEq
+
+theorem DefinitionSafety.le_trans {a b c : DefinitionSafety} : a ≤ b → b ≤ c → a ≤ c :=
+  Std.TransOrd.isLE_trans
+
+theorem DefinitionSafety.le_rfl {a : DefinitionSafety} : a ≤ a := Std.ReflCmp.isLE_rfl
+
+theorem DefinitionSafety.unsafe_le : «unsafe» ≤ a := by cases a <;> rfl
+theorem DefinitionSafety.le_safe : a ≤ safe := by cases a <;> rfl
+theorem DefinitionSafety.le_antisymm {a b : DefinitionSafety} : a ≤ b → b ≤ a → a = b := by
+  cases a <;> cases b <;> decide
+
+namespace Substring
+
+open private substrEq.loop from Init.Data.String.Basic in
+theorem beq_refl (s : Substring.Raw) : s == s := by
+  simp [(· == ·), Substring.Raw.beq, Substring.Raw.bsize, String.Pos.Raw.substrEq]
+  let rec loop {s i n} : substrEq.loop s s i i n := by
+    unfold substrEq.loop; simp [Decidable.or_iff_not_imp_left]
+    intro h1
+    have := Char.utf8Size_pos (String.Pos.Raw.get s i)
+    exact loop
+  termination_by n.byteIdx - i.byteIdx
+  refine ⟨?_, loop⟩
+  obtain h | h := Nat.le_or_le s.repair.startPos.byteIdx s.repair.stopPos.byteIdx
+  · simp only [Nat.add_sub_cancel' h, decide_eq_true_eq]
+    apply String.Pos.Raw.IsValid.le_rawEndPos
+    simp [Substring.Raw.repair]; split <;> simp [*]
+  · simp [Nat.sub_eq_zero_of_le h]
+    apply String.Pos.Raw.IsValid.le_rawEndPos
+    simp [Substring.Raw.repair]; split <;> simp [*]
+
+open private substrEq.loop from Init.Data.String.Basic in
+theorem beq_symm {s t : Substring.Raw} : s == t → t == s := by
+  simp +contextual [(· == ·), Substring.Raw.beq, String.Pos.Raw.substrEq]
+  simp [Substring.Raw.bsize]
+  let rec loop {s s' b b' i n} :
+      substrEq.loop s s' ⟨b + i⟩ ⟨b' + i⟩ ⟨b + n⟩ ↔
+      substrEq.loop s' s ⟨b' + i⟩ ⟨b + i⟩ ⟨b' + n⟩ := by
+    unfold substrEq.loop; simp [beq_comm, Decidable.or_iff_not_imp_left]
+    refine imp_congr_right fun h1 => and_congr_right fun h2 => ?_
+    simp +instances [h2, String.instHAddRawChar, Nat.add_assoc]
+    have := Char.utf8Size_pos (String.Pos.Raw.get s' ⟨b'+i⟩)
+    exact Bool.eq_iff_iff.2 loop
+  termination_by b + n - (b + i)
+  intro h1 h2 h3
+  have loop := @loop (i := 0); simp at loop
+  simp [loop]
+
+open private substrEq.loop from Init.Data.String.Basic in
+theorem beq_trans {s t : Substring.Raw} : s == t → t == u → s == u := by
+  simp +contextual [(· == ·), Substring.Raw.beq, String.Pos.Raw.substrEq]
+  simp [Substring.Raw.bsize]
+  let ⟨s, ⟨b⟩, e⟩ := s.repair
+  let ⟨s2, ⟨b2⟩, e2⟩ := t.repair
+  let ⟨s3, ⟨b3⟩, e3⟩ := u.repair
+  intro h1 h2 h3 h4 h5 h6 h7 h8
+  constructor; · omega
+  simp [h5] at h4
+  let rec loop {s₁ s₂ s₃ b₁ b₂ b₃ i n} :
+      (h : substrEq.loop s₁ s₂ ⟨b₁ + i⟩ ⟨b₂ + i⟩ ⟨b₁ + n⟩) →
+      (substrEq.loop s₁ s₃ ⟨b₁ + i⟩ ⟨b₃ + i⟩ ⟨b₁ + n⟩ ↔
+       substrEq.loop s₂ s₃ ⟨b₂ + i⟩ ⟨b₃ + i⟩ ⟨b₂ + n⟩) := by
+    unfold substrEq.loop; simp [Decidable.or_iff_not_imp_left]
+    refine fun h1 => imp_congr_right fun h => ?_; let ⟨h1, h2⟩ := h1 h
+    simp [h1]; intro h3; simp +instances [h1, h3, String.instHAddRawChar, Nat.add_assoc] at h2 ⊢
+    have := Char.utf8Size_pos (String.Pos.Raw.get s₃ ⟨b₃+i⟩)
+    refine Bool.eq_iff_iff.2 (loop h2)
+  termination_by n - i
+  have loop := @loop (i := 0) (h := h4); simp at loop
+  simpa [loop] using h8
+
+instance : EquivBEq Substring.Raw where
+  symm := beq_symm
+  trans := beq_trans
+  rfl := beq_refl _
+
+end Substring
+
+namespace Syntax
+
+namespace Preresolved
+
+protected theorem beq_iff_eq {m n : Preresolved} : m == n ↔ m = n := by
+  simp only [(· == ·)]; cases m <;> cases n <;> simp! <;> grind only [cases Or]
+
+instance : LawfulBEq Preresolved where
+  eq_of_beq := Preresolved.beq_iff_eq.1
+  rfl := Preresolved.beq_iff_eq.2 rfl
+
+end Preresolved
+
+theorem structEq_refl (s : Syntax) : s.structEq' s := by
+  unfold structEq'
+  cases s with
+  | node i k args =>
+    let ⟨args⟩ := args; simp; intro x _ _ _
+    have IH := structEq_refl x
+    induction args.attach <;> simp
+    rintro (⟨rfl, ⟨⟩⟩ | h) <;> [skip; solve_by_elim]
+    simpa using IH
+  | _ => simp
+
+attribute [-simp] List.all_eq_true in
+theorem structEq_euc {s : Syntax} (H : s.structEq' t) : s.structEq' u = t.structEq' u := by
+  unfold structEq' at H; split at H
+  case h_1 => simp
+  case h_5 => cases H
+  all_goals
+    revert H; simp; intros; subst_vars
+    unfold structEq'; cases u <;> simp <;> rw [Bool.eq_iff_iff] <;> simp [*]
+  -- all_goals intros; subst_vars
+  case ident => intros; apply BEq.congr_left ‹_›
+  case node args₁ _ _ args₂ eq H _ _ args₃ =>
+    rintro rfl eq'; revert H
+    have IH {a} (h : a ∈ args₁) := @structEq_euc (s := a)
+    let ⟨args₁⟩ := args₁; let ⟨args₂⟩ := args₂; let ⟨args₃⟩ := args₃
+    revert eq eq'; simp at IH ⊢
+    simp only [← args₁.length_attach, ← args₂.length_attach, ← args₃.length_attach]
+    generalize args₁.attach = l₁, args₂.attach = l₂, args₃.attach = l₃
+    induction l₁ generalizing l₂ l₃ with cases l₂ <;> simp <;> cases l₃ <;> simp | cons a l₁ ih
+    intros _ _ H; rw [IH a.2 _ _ H, Bool.eq_iff_iff]; simp [*]; grind
+termination_by s
+
+theorem structEq_symm {s : Syntax} (H : s.structEq' t) : t.structEq' s :=
+  structEq_euc H ▸ structEq_refl _
+
+theorem structEq_trans {s : Syntax} (H : s.structEq' t) (H2 : t.structEq' u) : s.structEq' u :=
+  structEq_euc H ▸ H2
+
+theorem beq_def : (a == b) = structEq' a b := structEq_eq
+
+instance : EquivBEq Syntax where
+  symm := by simp [beq_def]; exact structEq_symm
+  trans := by simp [beq_def]; exact structEq_trans
+  rfl := by simp [beq_def]; exact structEq_refl _
+
+end Syntax
+
+namespace DataValue
+
+instance : EquivBEq DataValue where
+  symm {a b} := by simp [(· == ·)]; cases a <;> cases b <;> simp! [beq_comm]
+  trans {a b c} := by
+    simp [(· == ·)]; cases a <;> cases b <;> simp! [beq_comm] <;> try rintro rfl; simp
+    cases c <;> simp!; exact BEq.trans
+  rfl {a} := by simp [(· == ·)]; cases a <;> simp!
+
+end DataValue
+
+namespace Expr
+
+theorem Data.looseBVarRange_le :
+    (Data.looseBVarRange d).toNat ≤ 2 ^ 20 - 1 := by
+  rw [Data.looseBVarRange]
+  suffices (UInt64.shiftRight d 44).toNat ≤ 2 ^ 20 - 1 by simp; omega
+  show d.toBitVec >>> 44#64 ≤ 0xfffff#64
+  rw [BitVec.le_def, BitVec.ushiftRight_ofNat_eq]
+  simp
+  have h := BitVec.toNat_ushiftRight_lt d.toBitVec 44 (by omega)
+  simp at h ⊢
+  omega
+
+private theorem Data.flag_eq_getLsbD (d : Data) (n : UInt64) (hn : n < 64) :
+    ((d.shiftRight n).land 1 == 1) = d.toBitVec.getLsbD n.toNat := by
+  apply Bool.eq_iff_iff.2
+  simp only [beq_iff_eq]
+  have hmod : UInt64.mod n 64 = n := UInt64.mod_eq_of_lt hn
+  constructor
+  · intro h
+    have hb := congrArg UInt64.toBitVec h
+    simp [UInt64.shiftRight, UInt64.land, hmod] at hb
+    have := congrArg (fun x : BitVec 64 => x.getLsbD 0) hb
+    simpa using this
+  · intro h
+    apply UInt64.toBitVec_inj.mp
+    simp [UInt64.shiftRight, UInt64.land, hmod]
+    ext i
+    by_cases hi : i = 0
+    · subst i
+      simpa using h
+    · simp [hi]
+
+private theorem Data.hasFVar_eq_getLsbD (d : Data) :
+    d.hasFVar = d.toBitVec.getLsbD 40 := by
+  simpa [Data.hasFVar] using Data.flag_eq_getLsbD d 40 (by decide)
+
+private theorem Data.hasExprMVar_eq_getLsbD (d : Data) :
+    d.hasExprMVar = d.toBitVec.getLsbD 41 := by
+  simpa [Data.hasExprMVar] using Data.flag_eq_getLsbD d 41 (by decide)
+
+private theorem Data.hasLevelMVar_eq_getLsbD (d : Data) :
+    d.hasLevelMVar = d.toBitVec.getLsbD 42 := by
+  simpa [Data.hasLevelMVar] using Data.flag_eq_getLsbD d 42 (by decide)
+
+private theorem Data.hasLevelParam_eq_getLsbD (d : Data) :
+    d.hasLevelParam = d.toBitVec.getLsbD 43 := by
+  simpa [Data.hasLevelParam] using Data.flag_eq_getLsbD d 43 (by decide)
+
+private def flagAt (fv ev lv lp : Bool) : Nat → Bool
+  | 0 => fv
+  | 1 => ev
+  | 2 => lv
+  | 3 => lp
+  | _ => false
+
+private theorem BitVec.getLsbD_eq_false_of_toNat_lt_two_pow
+    {x : BitVec w} (h : x.toNat < 2 ^ n) (hn : n ≤ i) :
+    x.getLsbD i = false := by
+  rw [BitVec.getLsbD, Nat.testBit_lt_two_pow]
+  exact Nat.lt_of_lt_of_le h (Nat.pow_le_pow_right (by decide) hn)
+
+private theorem BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    {x y : BitVec w} (h : x.toNat < 2 ^ n) :
+    x + (y <<< n) = x ||| (y <<< n) := by
+  rw [BitVec.add_eq_or_of_and_eq_zero]
+  ext i hi
+  simp only [BitVec.getElem_and, BitVec.getElem_zero]
+  by_cases hin : i < n
+  · simp [BitVec.getElem_shiftLeft, hin]
+  · have hx : x[i] = false := by
+      rw [← BitVec.getLsbD_eq_getElem]
+      exact BitVec.getLsbD_eq_false_of_toNat_lt_two_pow h (Nat.le_of_not_gt hin)
+    simp [hx]
+
+set_option allowUnsafeReducibility true
+attribute [local reducible] Data
+
+private theorem mkData_flags (H : br ≤ 2 ^ 20 - 1) :
+    (mkData h br d fv ev lv lp).hasFVar = fv ∧
+    (mkData h br d fv ev lv lp).hasExprMVar = ev ∧
+    (mkData h br d fv ev lv lp).hasLevelMVar = lv ∧
+    (mkData h br d fv ev lv lp).hasLevelParam = lp := by
+  rw [mkData_eq, mkData', if_pos H]
+  rw [Data.hasFVar_eq_getLsbD, Data.hasExprMVar_eq_getLsbD,
+    Data.hasLevelMVar_eq_getLsbD, Data.hasLevelParam_eq_getLsbD]
+  have hh : h.toUInt32.toUInt64.toBitVec ≤ 0xffffffff#64 :=
+    Nat.le_of_lt_succ h.toUInt32.1.1.2
+  have hb : ∀ (b : Bool), b.toUInt64.toBitVec ≤ 1#64 := by decide
+  have hfv := hb fv
+  have hev := hb ev
+  have hlv := hb lv
+  have hlp := hb lp
+  have hnat : br.toUInt64.toNat = br := by simp; omega
+  have hbr : br.toUInt64.toBitVec ≤ 0xfffff#64 := (hnat ▸ H :)
+  let depth : UInt8 := if d > 255 then 255 else d.toUInt8
+  have hd : depth.toUInt64.toBitVec ≤ 0xff#64 := Nat.le_of_lt_succ depth.1.1.2
+  let data :=
+    h.toUInt32.toUInt64.toBitVec +
+    depth.toUInt64.toBitVec <<< 32#64 +
+    fv.toUInt64.toBitVec <<< 40#64 +
+    ev.toUInt64.toBitVec <<< 41#64 +
+    lv.toUInt64.toBitVec <<< 42#64 +
+    lp.toUInt64.toBitVec <<< 43#64 +
+    br.toUInt64.toBitVec <<< 44#64
+  change data.getLsbD 40 = fv ∧ data.getLsbD 41 = ev ∧
+    data.getLsbD 42 = lv ∧ data.getLsbD 43 = lp
+  have hh' : h.toUInt32.toUInt64.toBitVec.toNat < 2 ^ 32 := by
+    simpa using h.toUInt32.1.1.2
+  have hd' : depth.toUInt64.toBitVec.toNat < 2 ^ 8 := by
+    simpa using depth.1.1.2
+  have hb' : ∀ (b : Bool), b.toUInt64.toBitVec.toNat < 2 := by
+    intro b
+    cases b <;> decide
+  have h0 := BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    (x := h.toUInt32.toUInt64.toBitVec) (y := depth.toUInt64.toBitVec) hh'
+  have hs0 : (depth.toUInt64.toBitVec <<< 32).toNat < 2 ^ 40 := by
+    rw [BitVec.toNat_shiftLeft, Nat.shiftLeft_eq, Nat.mod_eq_of_lt]
+    · omega
+    · omega
+  have hp0 :
+      (h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32).toNat <
+        2 ^ 40 := by
+    rw [BitVec.toNat_or]
+    exact Nat.or_lt_two_pow (by omega) hs0
+  have h1 := BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    (x := h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32)
+    (y := fv.toUInt64.toBitVec) hp0
+  have hs1 : (fv.toUInt64.toBitVec <<< 40).toNat < 2 ^ 41 := by
+    rw [BitVec.toNat_shiftLeft, Nat.shiftLeft_eq, Nat.mod_eq_of_lt]
+    · have := hb' fv; omega
+    · have := hb' fv; omega
+  have hp1 :
+      (h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+        fv.toUInt64.toBitVec <<< 40).toNat < 2 ^ 41 := by
+    rw [BitVec.toNat_or]
+    exact Nat.or_lt_two_pow (by omega) hs1
+  have h2 := BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    (x := h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+      fv.toUInt64.toBitVec <<< 40)
+    (y := ev.toUInt64.toBitVec) hp1
+  have hs2 : (ev.toUInt64.toBitVec <<< 41).toNat < 2 ^ 42 := by
+    rw [BitVec.toNat_shiftLeft, Nat.shiftLeft_eq, Nat.mod_eq_of_lt]
+    · have := hb' ev; omega
+    · have := hb' ev; omega
+  have hp2 :
+      (h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+        fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41).toNat <
+        2 ^ 42 := by
+    rw [BitVec.toNat_or]
+    exact Nat.or_lt_two_pow (by omega) hs2
+  have h3 := BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    (x := h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+      fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41)
+    (y := lv.toUInt64.toBitVec) hp2
+  have hs3 : (lv.toUInt64.toBitVec <<< 42).toNat < 2 ^ 43 := by
+    rw [BitVec.toNat_shiftLeft, Nat.shiftLeft_eq, Nat.mod_eq_of_lt]
+    · have := hb' lv; omega
+    · have := hb' lv; omega
+  have hp3 :
+      (h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+        fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41 |||
+        lv.toUInt64.toBitVec <<< 42).toNat < 2 ^ 43 := by
+    rw [BitVec.toNat_or]
+    exact Nat.or_lt_two_pow (by omega) hs3
+  have h4 := BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    (x := h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+      fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41 |||
+      lv.toUInt64.toBitVec <<< 42)
+    (y := lp.toUInt64.toBitVec) hp3
+  have hs4 : (lp.toUInt64.toBitVec <<< 43).toNat < 2 ^ 44 := by
+    rw [BitVec.toNat_shiftLeft, Nat.shiftLeft_eq, Nat.mod_eq_of_lt]
+    · have := hb' lp; omega
+    · have := hb' lp; omega
+  have hp4 :
+      (h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+        fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41 |||
+        lv.toUInt64.toBitVec <<< 42 ||| lp.toUInt64.toBitVec <<< 43).toNat <
+        2 ^ 44 := by
+    rw [BitVec.toNat_or]
+    exact Nat.or_lt_two_pow (by omega) hs4
+  have h5 := BitVec.add_shiftLeft_eq_or_of_toNat_lt_two_pow
+    (x := h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+      fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41 |||
+      lv.toUInt64.toBitVec <<< 42 ||| lp.toUInt64.toBitVec <<< 43)
+    (y := br.toUInt64.toBitVec) hp4
+  have hdata : data =
+      h.toUInt32.toUInt64.toBitVec ||| depth.toUInt64.toBitVec <<< 32 |||
+      fv.toUInt64.toBitVec <<< 40 ||| ev.toUInt64.toBitVec <<< 41 |||
+      lv.toUInt64.toBitVec <<< 42 ||| lp.toUInt64.toBitVec <<< 43 |||
+      br.toUInt64.toBitVec <<< 44 := by
+    dsimp [data]
+    rw [h0, h1, h2, h3, h4, h5]
+  have hhbit : ∀ i, 32 ≤ i → h.toUInt32.toUInt64.toBitVec.getLsbD i = false :=
+    fun _ hi => BitVec.getLsbD_eq_false_of_toNat_lt_two_pow hh' hi
+  have hdbit : ∀ i, 8 ≤ i → depth.toUInt64.toBitVec.getLsbD i = false :=
+    fun _ hi => BitVec.getLsbD_eq_false_of_toNat_lt_two_pow hd' hi
+  have hbbit : ∀ (b : Bool) i, 1 ≤ i → b.toUInt64.toBitVec.getLsbD i = false :=
+    fun b _ hi => BitVec.getLsbD_eq_false_of_toNat_lt_two_pow (hb' b) hi
+  rw [hdata]
+  simp only [BitVec.getLsbD_or, BitVec.getLsbD_shiftLeft]
+  simp only [Nat.reduceLT, decide_true, decide_false, Bool.not_true, Bool.not_false,
+    Bool.true_and, Bool.false_and, Bool.or_false, Nat.reduceSub]
+  rw [hhbit 40 (by omega), hhbit 41 (by omega), hhbit 42 (by omega),
+    hhbit 43 (by omega), hdbit 8 (by omega), hdbit 9 (by omega),
+    hdbit 10 (by omega), hdbit 11 (by omega), hbbit fv 1 (by omega),
+    hbbit fv 2 (by omega), hbbit fv 3 (by omega), hbbit ev 1 (by omega),
+    hbbit ev 2 (by omega), hbbit lv 1 (by omega)]
+  simp only [Bool.false_or]
+  cases fv <;> cases ev <;> cases lv <;> cases lp <;> decide
+
+private theorem mkData_hasFVar (H : br ≤ 2 ^ 20 - 1) :
+    (mkData h br d fv ev lv lp).hasFVar = fv := by
+  exact (mkData_flags H).1
+
+private theorem mkData_hasExprMVar (H : br ≤ 2 ^ 20 - 1) :
+    (mkData h br d fv ev lv lp).hasExprMVar = ev := by
+  exact (mkData_flags H).2.1
+
+private theorem mkData_hasLevelMVar (H : br ≤ 2 ^ 20 - 1) :
+    (mkData h br d fv ev lv lp).hasLevelMVar = lv := by
+  exact (mkData_flags H).2.2.1
+
+private theorem mkData_hasLevelParam (H : br ≤ 2 ^ 20 - 1) :
+    (mkData h br d fv ev lv lp).hasLevelParam = lp := by
+  exact (mkData_flags H).2.2.2
+
+private theorem mkData_flags_of_false (br d h) :
+    (mkData h br d false false false false).hasFVar = false ∧
+    (mkData h br d false false false false).hasExprMVar = false ∧
+    (mkData h br d false false false false).hasLevelMVar = false ∧
+    (mkData h br d false false false false).hasLevelParam = false := by
+  by_cases H : br ≤ 2 ^ 20 - 1
+  · exact mkData_flags H
+  · rw [mkData_eq, mkData', if_neg H]
+    exact ⟨rfl, rfl, rfl, rfl⟩
+
+private theorem mkData_hasFVar_of_false (br d h) :
+    (mkData h br d false false false false).hasFVar = false :=
+  (mkData_flags_of_false br d h).1
+
+private theorem mkData_hasExprMVar_of_false (br d h) :
+    (mkData h br d false false false false).hasExprMVar = false :=
+  (mkData_flags_of_false br d h).2.1
+
+private theorem mkData_hasLevelMVar_of_false (br d h) :
+    (mkData h br d false false false false).hasLevelMVar = false :=
+  (mkData_flags_of_false br d h).2.2.1
+
+private theorem mkData_hasLevelParam_of_false (br d h) :
+    (mkData h br d false false false false).hasLevelParam = false :=
+  (mkData_flags_of_false br d h).2.2.2
+
+private theorem mkAppData_flag (i : Nat) (hi : i < 4) :
+    (mkAppData fData aData).toBitVec.getLsbD (40 + i) = flagAt
+      (fData.hasFVar || aData.hasFVar)
+      (fData.hasExprMVar || aData.hasExprMVar)
+      (fData.hasLevelMVar || aData.hasLevelMVar)
+      (fData.hasLevelParam || aData.hasLevelParam) i := by
+  have hm : max fData.looseBVarRange aData.looseBVarRange ≤
+      (Nat.pow 2 20 - 1).toUInt32 := by
+    dsimp +instances [instMaxUInt32, maxOfLe]
+    split <;> exact Data.looseBVarRange_le
+  rw [mkAppData_eq, mkAppData', if_pos hm]
+  generalize (mixHash fData aData).toUInt32 = hash
+  have : i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 := by omega
+  rcases this with rfl | rfl | rfl | rfl
+  · simp [flagAt, Data.hasFVar_eq_getLsbD]
+  · simp [flagAt, Data.hasExprMVar_eq_getLsbD]
+  · simp [flagAt, Data.hasLevelMVar_eq_getLsbD]
+  · simp [flagAt, Data.hasLevelParam_eq_getLsbD]
+
+private theorem mkAppData_hasFVar :
+    (mkAppData fData aData).hasFVar = (fData.hasFVar || aData.hasFVar) := by
+  rw [Data.hasFVar_eq_getLsbD]
+  exact mkAppData_flag 0 (by decide)
+
+private theorem mkAppData_hasExprMVar :
+    (mkAppData fData aData).hasExprMVar = (fData.hasExprMVar || aData.hasExprMVar) := by
+  rw [Data.hasExprMVar_eq_getLsbD]
+  exact mkAppData_flag 1 (by decide)
+
+private theorem mkAppData_hasLevelMVar :
+    (mkAppData fData aData).hasLevelMVar = (fData.hasLevelMVar || aData.hasLevelMVar) := by
+  rw [Data.hasLevelMVar_eq_getLsbD]
+  exact mkAppData_flag 2 (by decide)
+
+private theorem mkAppData_hasLevelParam :
+    (mkAppData fData aData).hasLevelParam = (fData.hasLevelParam || aData.hasLevelParam) := by
+  rw [Data.hasLevelParam_eq_getLsbD]
+  exact mkAppData_flag 3 (by decide)
+
+private theorem binder_looseBVarRange_le (ty body : Expr) :
+    max ty.data.looseBVarRange.toNat (body.data.looseBVarRange.toNat - 1) ≤ 2 ^ 20 - 1 := by
+  have hty := Data.looseBVarRange_le (d := ty.data)
+  have hbody := Data.looseBVarRange_le (d := body.data)
+  omega
+
+private theorem let_looseBVarRange_le (ty val body : Expr) :
+    max (max ty.data.looseBVarRange.toNat val.data.looseBVarRange.toNat)
+      (body.data.looseBVarRange.toNat - 1) ≤ 2 ^ 20 - 1 := by
+  have hty := Data.looseBVarRange_le (d := ty.data)
+  have hval := Data.looseBVarRange_le (d := val.data)
+  have hbody := Data.looseBVarRange_le (d := body.data)
+  omega
+
+def hasFVar' : Expr → Bool
+  | .fvar _ => true
+  | .const ..
+  | .bvar _
+  | .sort _
+  | .mvar _
+  | .lit _ => false
+  | .mdata _ e => e.hasFVar'
+  | .proj _ _ e => e.hasFVar'
+  | .app e1 e2
+  | .lam _ e1 e2 _
+  | .forallE _ e1 e2 _ => e1.hasFVar' || e2.hasFVar'
+  | .letE _ t v b _ => t.hasFVar' || v.hasFVar' || b.hasFVar'
+
+/-- The cached `hasFVar` bit agrees with structural traversal. -/
+theorem hasFVar_eq (e : Expr) : e.hasFVar = e.hasFVar' := by
+  change e.data.hasFVar = e.hasFVar'
+  induction e with
+  | bvar => simp [Expr.data, hasFVar', mkData_hasFVar_of_false]
+  | fvar | mvar | sort | const | lit =>
+    simp only [Expr.data, hasFVar']
+    apply mkData_hasFVar
+    omega
+  | app _ _ ih1 ih2 =>
+    simp only [Expr.data, hasFVar']
+    rw [mkAppData_hasFVar, ih1, ih2]
+  | lam _ ty body _ ihty ihbody | forallE _ ty body _ ihty ihbody =>
+    simp only [Expr.data, mkDataForBinder, hasFVar']
+    rw [mkData_hasFVar (binder_looseBVarRange_le ty body), ihty, ihbody]
+  | letE _ ty val body _ ihty ihval ihbody =>
+    simp only [Expr.data, mkDataForLet, hasFVar']
+    rw [mkData_hasFVar (let_looseBVarRange_le ty val body), ihty, ihval, ihbody]
+  | mdata _ e ih | proj _ _ e ih =>
+    simp only [Expr.data, hasFVar']
+    rw [mkData_hasFVar (Data.looseBVarRange_le (d := e.data)), ih]
+
+def hasExprMVar' : Expr → Bool
+  | .mvar _ => true
+  | .const ..
+  | .bvar _
+  | .sort _
+  | .fvar _
+  | .lit _ => false
+  | .mdata _ e => e.hasExprMVar'
+  | .proj _ _ e => e.hasExprMVar'
+  | .app e1 e2
+  | .lam _ e1 e2 _
+  | .forallE _ e1 e2 _ => e1.hasExprMVar' || e2.hasExprMVar'
+  | .letE _ t v b _ => t.hasExprMVar' || v.hasExprMVar' || b.hasExprMVar'
+
+/-- The cached `hasExprMVar` bit agrees with structural traversal. -/
+@[simp] theorem hasExprMVar_eq (e : Expr) : e.hasExprMVar = e.hasExprMVar' := by
+  change e.data.hasExprMVar = e.hasExprMVar'
+  induction e with
+  | bvar => simp [Expr.data, hasExprMVar', mkData_hasExprMVar_of_false]
+  | fvar | mvar | sort | const | lit =>
+    simp only [Expr.data, hasExprMVar']
+    apply mkData_hasExprMVar
+    omega
+  | app _ _ ih1 ih2 =>
+    simp only [Expr.data, hasExprMVar']
+    rw [mkAppData_hasExprMVar, ih1, ih2]
+  | lam _ ty body _ ihty ihbody | forallE _ ty body _ ihty ihbody =>
+    simp only [Expr.data, mkDataForBinder, hasExprMVar']
+    rw [mkData_hasExprMVar (binder_looseBVarRange_le ty body), ihty, ihbody]
+  | letE _ ty val body _ ihty ihval ihbody =>
+    simp only [Expr.data, mkDataForLet, hasExprMVar']
+    rw [mkData_hasExprMVar (let_looseBVarRange_le ty val body), ihty, ihval, ihbody]
+  | mdata _ e ih | proj _ _ e ih =>
+    simp only [Expr.data, hasExprMVar']
+    rw [mkData_hasExprMVar (Data.looseBVarRange_le (d := e.data)), ih]
+
+def hasLevelMVar' : Expr → Bool
+  | .const _ ls => ls.any (·.hasMVar)
+  | .sort u => u.hasMVar
+  | .bvar _
+  | .fvar _
+  | .mvar _
+  | .lit _ => false
+  | .mdata _ e => e.hasLevelMVar'
+  | .proj _ _ e => e.hasLevelMVar'
+  | .app e1 e2
+  | .lam _ e1 e2 _
+  | .forallE _ e1 e2 _ => e1.hasLevelMVar' || e2.hasLevelMVar'
+  | .letE _ t v b _ => t.hasLevelMVar' || v.hasLevelMVar' || b.hasLevelMVar'
+
+/-- The cached `hasLevelMVar` bit agrees with structural traversal. -/
+@[simp] theorem hasLevelMVar_eq (e : Expr) : e.hasLevelMVar = e.hasLevelMVar' := by
+  change e.data.hasLevelMVar = e.hasLevelMVar'
+  induction e with
+  | bvar => simp [Expr.data, hasLevelMVar', mkData_hasLevelMVar_of_false]
+  | fvar | mvar | sort | const | lit =>
+    simp only [Expr.data, hasLevelMVar']
+    apply mkData_hasLevelMVar
+    omega
+  | app _ _ ih1 ih2 =>
+    simp only [Expr.data, hasLevelMVar']
+    rw [mkAppData_hasLevelMVar, ih1, ih2]
+  | lam _ ty body _ ihty ihbody | forallE _ ty body _ ihty ihbody =>
+    simp only [Expr.data, mkDataForBinder, hasLevelMVar']
+    rw [mkData_hasLevelMVar (binder_looseBVarRange_le ty body), ihty, ihbody]
+  | letE _ ty val body _ ihty ihval ihbody =>
+    simp only [Expr.data, mkDataForLet, hasLevelMVar']
+    rw [mkData_hasLevelMVar (let_looseBVarRange_le ty val body), ihty, ihval, ihbody]
+  | mdata _ e ih | proj _ _ e ih =>
+    simp only [Expr.data, hasLevelMVar']
+    rw [mkData_hasLevelMVar (Data.looseBVarRange_le (d := e.data)), ih]
+
+def hasLevelParam' : Expr → Bool
+  | .const _ ls => ls.any (·.hasParam)
+  | .sort u => u.hasParam
+  | .bvar _
+  | .fvar _
+  | .mvar _
+  | .lit _ => false
+  | .mdata _ e => e.hasLevelParam'
+  | .proj _ _ e => e.hasLevelParam'
+  | .app e1 e2
+  | .lam _ e1 e2 _
+  | .forallE _ e1 e2 _ => e1.hasLevelParam' || e2.hasLevelParam'
+  | .letE _ t v b _ => t.hasLevelParam' || v.hasLevelParam' || b.hasLevelParam'
+
+/-- The cached `hasLevelParam` bit agrees with structural traversal. -/
+@[simp] theorem hasLevelParam_eq (e : Expr) : e.hasLevelParam = e.hasLevelParam' := by
+  change e.data.hasLevelParam = e.hasLevelParam'
+  induction e with
+  | bvar => simp [Expr.data, hasLevelParam', mkData_hasLevelParam_of_false]
+  | fvar | mvar | sort | const | lit =>
+    simp only [Expr.data, hasLevelParam']
+    apply mkData_hasLevelParam
+    omega
+  | app _ _ ih1 ih2 =>
+    simp only [Expr.data, hasLevelParam']
+    rw [mkAppData_hasLevelParam, ih1, ih2]
+  | lam _ ty body _ ihty ihbody | forallE _ ty body _ ihty ihbody =>
+    simp only [Expr.data, mkDataForBinder, hasLevelParam']
+    rw [mkData_hasLevelParam (binder_looseBVarRange_le ty body), ihty, ihbody]
+  | letE _ ty val body _ ihty ihval ihbody =>
+    simp only [Expr.data, mkDataForLet, hasLevelParam']
+    rw [mkData_hasLevelParam (let_looseBVarRange_le ty val body), ihty, ihval, ihbody]
+  | mdata _ e ih | proj _ _ e ih =>
+    simp only [Expr.data, hasLevelParam']
+    rw [mkData_hasLevelParam (Data.looseBVarRange_le (d := e.data)), ih]
+
+end Expr
+
+namespace Literal
+open Expr in
+theorem toConstructor_hasLevelParam :
+    (Literal.toConstructor l).hasLevelParam' = false := by
+  cases l with simp [Literal.toConstructor]
+  | natVal n => cases n <;> simp [natLitToConstructor, hasLevelParam', natZero, natSucc]
+  | strVal s =>
+    simp [strLitToConstructor, hasLevelParam']
+    induction s.toList <;> simp_all [hasLevelParam', Level.hasParam']
+
+protected theorem beq_iff_eq {m n : Literal} : m == n ↔ m = n := by
+  cases m <;> cases n <;> simp! [(· == ·)]
+
+instance : LawfulBEq Literal where
+  eq_of_beq := Literal.beq_iff_eq.1
+  rfl := Literal.beq_iff_eq.2 rfl
+
+instance : DecidableEq Literal :=
+  fun a b => if h : a == b then .isTrue (by simp_all) else .isFalse (by simp_all)
+
+@[simp] theorem mkConst_typeName {l : Literal} : .const l.typeName [] = l.type := by
+  cases l <;> simp [typeName, type, mkConst]
+
+end Literal
+
+namespace Expr
+
+attribute [simp] mkConst mkBVar mkSort mkFVar mkMVar mkMData mkProj mkApp mkLambda mkForall mkLet
+  updateApp! updateFVar! updateConst! updateSort! updateMData! updateProj!
+  updateForall! updateForallE! updateLambda! updateLambdaE! updateLetE! updateLet!
+
+set_option allowUnsafeReducibility true
+attribute [local reducible] Data
+
+theorem mkData_looseBVarRange (H : br ≤ 2^20 - 1) :
+    (mkData h br d fv ev lv lp).looseBVarRange.toNat = br := by
+  rw [mkData_eq, mkData', if_pos H]; dsimp only [Data.looseBVarRange, -Nat.reducePow]
+  have : br.toUInt64.toUInt32.toNat = br := by simp; omega
+  refine .trans ?_ this; congr 2
+  refine UInt64.eq_of_toBitVec_eq ?_
+  have : br.toUInt64.toNat = br := by simp; omega
+  have : br.toUInt64.toBitVec ≤ 0xfffff#64 := (this ▸ H :)
+  have : h.toUInt32.toUInt64.toBitVec ≤ 0xffffffff#64 :=
+    show h.toUInt32.toNat ≤ 2^32-1 by simp; omega
+  have : (if d > 255 then 255 else d.toUInt8).toUInt64.toBitVec ≤ 0xff#64 :=
+    Nat.le_of_lt_succ (if d > 255 then 255 else d.toUInt8).1.1.2
+  have hb : ∀ (b : Bool), b.toUInt64.toBitVec ≤ 1#64 := by decide
+  have := hb fv; have := hb ev; have := hb lv; have := hb lp
+  change
+    (h.toUInt32.toUInt64.toBitVec +
+      (if d > 255 then 255 else d.toUInt8).toUInt64.toBitVec <<< 32#64 +
+      fv.toUInt64.toBitVec <<< 40#64 +
+      ev.toUInt64.toBitVec <<< 41#64 +
+      lv.toUInt64.toBitVec <<< 42#64 +
+      lp.toUInt64.toBitVec <<< 43#64 +
+      br.toUInt64.toBitVec <<< 44#64) >>> 44#64 =
+    br.toUInt64.toBitVec
+  bv_decide
+
+theorem looseBVarRange_le : looseBVarRange e ≤ 2^20 - 1 := Data.looseBVarRange_le
+
+theorem _root_.UInt32.max_toNat (a b : UInt32) : (max a b).toNat = max a.toNat b.toNat := by
+  simp +instances only [instMaxUInt32, maxOfLe, UInt32.le_iff_toNat_le, Nat.instMax]; split <;> rfl
+
+theorem mkAppData_looseBVarRange :
+    (mkAppData fData aData).looseBVarRange = max fData.looseBVarRange aData.looseBVarRange := by
+  have hm : max fData.looseBVarRange aData.looseBVarRange ≤ (Nat.pow 2 20 - 1).toUInt32 := by
+    dsimp +instances [instMaxUInt32, maxOfLe]; split <;> exact Data.looseBVarRange_le
+  rw [mkAppData_eq, mkAppData', if_pos hm]
+  simp [Data.looseBVarRange] at hm
+  dsimp only [Data.looseBVarRange, -Nat.reducePow]
+  generalize (max .. : UInt32) = m at *
+  have : m.toUInt64.toUInt32 = m := by simp [UInt64.toUInt32]
+  refine .trans ?_ this; congr 2
+  generalize (ite (_ > (255 : UInt16)) _ _ : UInt8) = a
+  generalize HOr.hOr (α := UInt64) fData _ = b
+  generalize UInt64.toUInt32 _ = c
+  apply UInt64.eq_of_toBitVec_eq
+  change m.toUInt64.toBitVec ≤ 0xfffff#64 at hm
+  have : c.toUInt64.toBitVec ≤ 0xffffffff#64 := Nat.le_of_lt_succ c.1.1.2
+  have : a.toUInt64.toBitVec ≤ 0xff#64 := Nat.le_of_lt_succ a.1.1.2
+  change
+    (b.toBitVec &&& 15#64 <<< 40#64 |||
+      c.toUInt64.toBitVec |||
+      a.toUInt64.toBitVec <<< 32#64 |||
+      m.toUInt64.toBitVec <<< 44#64) >>> 44#64 =
+    m.toUInt64.toBitVec
+  bv_decide
+
+def getAppArgsList : Expr → (r : List Expr := []) → List Expr
+  | .app f a, r => f.getAppArgsList (a :: r)
+  | _, r => r
+
+def getAppArgsRevList : Expr → List Expr
+  | .app f a => a :: f.getAppArgsRevList
+  | _ => []
+
+theorem getAppArgsRevList_reverse : (getAppArgsRevList e).reverse = getAppArgsList e := by
+  let rec loop {e r} : getAppArgsList e r = (getAppArgsRevList e).reverse ++ r := by
+    unfold getAppArgsList getAppArgsRevList; split <;> simp; exact loop
+  simp [loop]
+
+theorem getAppArgsList_reverse : (getAppArgsList e).reverse = getAppArgsRevList e := by
+  rw [← getAppArgsRevList_reverse]; simp
+
+open private getAppNumArgsAux getAppArgsAux mkAppRangeAux from Lean.Expr
+
+theorem getAppNumArgs_eq : getAppNumArgs e = (getAppArgsRevList e).length := by
+  let rec loop e n : getAppNumArgsAux e n = (getAppArgsRevList e).length + n := by
+    unfold getAppNumArgsAux getAppArgsRevList; split <;> simp
+    rw [loop]; omega
+  rw [getAppNumArgs, loop]; rfl
+
+theorem getAppArgs_toList_rev : (getAppArgs e).toList = (getAppArgsRevList e).reverse := by
+  let rec loop {e l₁ l₂ args} (h1 : args.toList = l₁ ++ l₂) :
+      l₁.length = (getAppArgsRevList e).length →
+      (getAppArgsAux e args ((getAppArgsRevList e).length - 1)).toList =
+      (getAppArgsRevList e).reverse ++ l₂ := by
+    unfold getAppArgsAux getAppArgsRevList; split
+    · rename_i f a; intro h2
+      obtain rfl | ⟨l₁, u, rfl⟩ := List.eq_nil_or_concat l₁; · cases h2
+      simp at h2 ⊢; refine loop ?_ h2
+      simp [← h2, h1]
+    · simp; rintro ⟨⟩; simpa using h1
+  simp [getAppArgs, getAppNumArgs_eq]
+  exact (loop (List.append_nil _).symm (by simp)).trans (by simp)
+
+theorem getAppArgs_toList : (getAppArgs e).toList = getAppArgsList e := by
+  rw [getAppArgs_toList_rev, getAppArgsRevList_reverse]
+
+theorem getAppArgs_eq_rev : getAppArgs e = (getAppArgsRevList e).reverse.toArray := by
+  simp [← getAppArgs_toList_rev]
+
+theorem getAppArgs_eq : getAppArgs e = (getAppArgsList e).toArray := by
+  simp [← getAppArgs_toList]
+
+open private getAppRevArgsAux from Lean.Expr in
+theorem getAppRevArgs_toList : (getAppRevArgs e).toList = getAppArgsRevList e := by
+  simp [getAppRevArgs, loop]
+where
+  loop {e args} : (getAppRevArgsAux e args).toList = args.toList ++ getAppArgsRevList e := by
+    unfold getAppRevArgsAux getAppArgsRevList; split <;> [(rw [loop]; simp); simp]
+
+theorem getAppRevArgs_eq : getAppRevArgs e = (getAppArgsRevList e).toArray := by
+  simp [← getAppRevArgs_toList]
+
+@[simp] theorem withApp_eq {e : Expr} : e.withApp f = f e.getAppFn e.getAppArgs := loop where
+  loop {e arr n} : withAppAux f e arr n = f e.getAppFn (getAppArgsAux e arr n) := by
+    unfold withAppAux getAppArgsAux; split <;> [exact loop; simp [getAppFn]]
+
+open private withAppRevAux getAppRevArgsAux from Lean.Expr in
+@[simp] theorem withRevApp_eq {e : Expr} :
+    e.withAppRev f = f e.getAppFn e.getAppRevArgs := loop where
+  loop {e arr} : withAppRevAux f e arr = f e.getAppFn (getAppRevArgsAux e arr) := by
+    unfold withAppRevAux getAppRevArgsAux; split <;> [exact loop; simp [getAppFn]]
+
+@[simp] def mkAppList : Expr → List Expr → Expr
+  | e, [] => e
+  | e, a :: as => mkAppList (.app e a) as
+
+theorem mkAppList_eq_foldl : mkAppList e es = es.foldl .app e := by
+  induction es generalizing e <;> simp [mkAppList, *]
+
+@[simp] theorem mkAppList_append :
+    mkAppList e (es₁ ++ es₂) = mkAppList (mkAppList e es₁) es₂ := by
+  simp [mkAppList_eq_foldl]
+
+@[simp] def mkAppRevList : Expr → List Expr → Expr
+  | e, [] => e
+  | e, a :: as => .app (mkAppRevList e as) a
+
+theorem mkAppRevList_eq_foldr : mkAppRevList e es = es.foldr (fun a e => .app e a) e := by
+  induction es <;> simp [mkAppRevList, *]
+
+@[simp] theorem mkAppRevList_append :
+    mkAppRevList e (es₁ ++ es₂) = mkAppRevList (mkAppRevList e es₂) es₁ := by
+  simp [mkAppRevList_eq_foldr]
+
+theorem mkAppList_reverse : mkAppList e es.reverse = mkAppRevList e es := by
+  simp [mkAppList_eq_foldl, mkAppRevList_eq_foldr]
+
+theorem mkAppRevList_reverse : mkAppRevList e es.reverse = mkAppList e es := by
+  simp [mkAppList_eq_foldl, mkAppRevList_eq_foldr]
+
+theorem mkAppRevList_getAppArgsRevList (e) :
+    mkAppRevList e.getAppFn (getAppArgsRevList e) = e := by
+  unfold getAppFn getAppArgsRevList; split <;> simp
+  congr 1; exact mkAppRevList_getAppArgsRevList _
+
+theorem mkAppList_getAppArgsList (e) :
+    mkAppList e.getAppFn (getAppArgsList e) = e := by
+  rw [← mkAppRevList_reverse, getAppArgsList_reverse, mkAppRevList_getAppArgsRevList]
+
+theorem mkAppRange_eq (h1 : args.toList = l₁ ++ l₂ ++ l₃)
+    (h2 : l₁.length = i) (h3 : (l₁ ++ l₂).length = j) :
+    mkAppRange e i j args = mkAppList e l₂ := loop h1 h2 h3 where
+  loop {n i e l₁ l₂} (h1 : args.toList = l₁ ++ l₂ ++ l₃)
+      (h2 : l₁.length = i) (h3 : (l₁ ++ l₂).length = n) :
+      mkAppRangeAux n args i e = mkAppList e l₂ := by
+    rw [mkAppRangeAux.eq_def]; split
+    · simp [Array.getElem!_eq_getD, ← Array.getElem?_toList, h1]
+      obtain _ | ⟨a, l₂⟩ := l₂; · simp_all
+      rw [List.getElem?_append_right (by simp [h2])]
+      simp [h2]
+      rw [loop (l₁ := l₁ ++ [a]) (l₂ := l₂)] <;> simp [h1, h2, h3]
+    · simp at h3
+      have : l₂.length = 0 := by omega
+      simp_all
+
+theorem mkAppRange_eq_rev (h1 : args.toList = l₁ ++ l₂ ++ l₃)
+    (h2 : l₁.length = i) (h3 : (l₁ ++ l₂).length = j) :
+    mkAppRange e i j args = mkAppRevList e l₂.reverse := by
+  rw [mkAppRange_eq h1 h2 h3, mkAppRevList_reverse]
+
+open private mkAppRevRangeAux from Lean.Expr in
+theorem mkAppRevRange_eq(h1 : args.toList = l₁ ++ l₂ ++ l₃)
+      (h2 : l₁.length = i) (h3 : (l₁ ++ l₂).length = j) :
+    mkAppRevRange e i j args = mkAppList e l₂.reverse := by
+  unfold mkAppRevRange
+  simpa using loop l₁ l₂.reverse l₃ [] (by simpa using h1) h2 (by simpa using h3)
+where
+  loop {start i} (l₁ l₂ l₃ l₄) (h1 : args.toList = l₁ ++ l₂.reverse ++ l₃)
+      (h2 : l₁.length = start) (h3 : l₁.length + List.length l₂ = i) :
+      mkAppRevRangeAux args start (mkAppRevList e l₄) i = mkAppList (mkAppRevList e l₄) l₂ := by
+    rw [mkAppRevRangeAux.eq_def]; split
+    · have : l₂.length = 0 := by omega
+      simp_all
+    · have : 0 < l₂.length := by omega
+      let a::l₂ := l₂; simp [← Nat.add_assoc] at h3
+      let i+1 := i; simp at h3
+      simp [Array.getElem!_eq_getD, ← Array.getElem?_toList, h1]
+      rw [List.getElem?_append_right (by omega)]
+      simp at h1; simp [← List.append_assoc] at h1
+      simp [← h3]; rw [h3]
+      simpa using loop l₁ l₂ (a :: l₃) (a :: l₄) (by simp [h1]) h2 h3
+
+theorem mkAppRevRange_eq_rev (h1 : args.toList = l₁ ++ l₂ ++ l₃)
+    (h2 : l₁.length = i) (h3 : (l₁ ++ l₂).length = j) :
+    mkAppRevRange e i j args = mkAppRevList e l₂ := by
+  rw [mkAppRevRange_eq h1 h2 h3, mkAppList_reverse]
+
+theorem liftLooseBVars_eq_self : e.looseBVarRange' ≤ s → liftLooseBVars' e s d = e := by
+  induction e generalizing s <;>
+    simp +contextual [*, looseBVarRange', liftLooseBVars', Nat.max_le]
+  omega
+
+@[simp] theorem liftLooseBVars_zero : liftLooseBVars' e s 0 = e := by
+  induction e generalizing s <;> simp [*, liftLooseBVars']
+
+theorem liftLooseBVars_liftLooseBVars {e : Expr} {n1 n2 k1 k2 : Nat}
+    (h1 : k1 ≤ k2) (h2 : k2 ≤ n1 + k1) :
+    liftLooseBVars' (liftLooseBVars' e k1 n1) k2 n2 = liftLooseBVars' e k1 (n1+n2) := by
+  induction e generalizing k1 k2 with simp [liftLooseBVars', ← Nat.add_assoc, *]
+  | bvar i =>
+    split <;> rename_i h
+    · rw [if_pos (Nat.lt_of_lt_of_le h h1)]
+    · rw [if_neg (by omega), Nat.add_assoc]
+
+theorem liftLooseBVars_add {e : Expr} {n1 n2 k : Nat} :
+    liftLooseBVars' (liftLooseBVars' e k n1) k n2 = liftLooseBVars' e k (n1+n2) := by
+  induction e generalizing k with simp [liftLooseBVars', *]
+  | bvar i =>
+    split; · rfl
+    rw [if_neg (by omega), Nat.add_assoc]
+
+theorem liftLooseBVars_comm (e : Expr) (n1 n2 k1 k2 : Nat) (h : k2 ≤ k1) :
+    liftLooseBVars' (liftLooseBVars' e k1 n1) k2 n2 =
+    liftLooseBVars' (liftLooseBVars' e k2 n2) (n2+k1) n1 := by
+  induction e generalizing k1 k2 with
+    simp [liftLooseBVars', Nat.add_assoc, Nat.succ_le_succ, *]
+  | bvar i =>
+    split <;> rename_i h'
+    · rw [if_pos (c := _ < n2 + k1)]; split
+      · exact Nat.lt_add_left _ h'
+      · omega
+    · have := mt (Nat.lt_of_lt_of_le · h) h'
+      rw [if_neg (by omega), if_neg this, if_neg (by omega), Nat.add_right_comm]
+
+theorem liftLooseBVars_looseBVarRange :
+    (liftLooseBVars' e k n).looseBVarRange' ≤ e.looseBVarRange' + n := by
+  induction e generalizing k <;> simp [*, looseBVarRange', liftLooseBVars'] <;> grind
+
+theorem instantiate1'_looseBVarRange
+    (he : e.looseBVarRange' ≤ n + k + 1) (ha : a.looseBVarRange' ≤ n) :
+    (instantiate1' e a k).looseBVarRange' ≤ n + k := by
+  induction e generalizing k with
+    simp_all [looseBVarRange', instantiate1', Nat.max_le]
+  | bvar =>
+    split <;> [skip; split] <;> try simp [looseBVarRange'] at he ⊢; omega
+    have := @liftLooseBVars_looseBVarRange a 0 k; omega
+  | _ => grind
+
+theorem instantiateList_looseBVarRange
+    (he : e.looseBVarRange' ≤ n + k + as.length) (ha : ∀ a ∈ as, a.looseBVarRange' ≤ n) :
+    (instantiateList e as k).looseBVarRange' ≤ n + k := by
+  induction as generalizing e with simp_all | cons _ _ ih
+  apply ih; rw [Nat.add_right_comm]; apply instantiate1'_looseBVarRange <;> omega
+
+theorem instantiate1'_eq_self : e.looseBVarRange' ≤ k → instantiate1' e a k = e := by
+  induction e generalizing k <;>
+    simp +contextual [*, looseBVarRange', instantiate1', Nat.max_le]
+  omega
+
+theorem instantiate1_eq_self (H : e.looseBVarRange' = 0) : instantiate1' e a = e := by
+  simpa using instantiate1'_eq_self (e := e) (Nat.le_zero.2 H)
+
+theorem instantiateList'_eq_self (h : e.looseBVarRange' ≤ k) : instantiateList e as k = e := by
+  induction as <;> simp [instantiateList, instantiate1'_eq_self, *]
+
+theorem instantiateList_eq_self (h : e.looseBVarRange' = 0) : instantiateList e as = e := by
+  induction as <;> simp [instantiateList, instantiate1_eq_self, *]
+
+theorem instantiate1'_liftLooseBVars :
+    instantiate1' (liftLooseBVars' e s (d + 1)) a (s + d) = e.liftLooseBVars' s d := by
+  induction e generalizing s <;>
+    simp [*, instantiate1', liftLooseBVars', Nat.add_right_comm _ _ 1]
+  rename_i i; split; · simp; omega
+  · rw [if_neg (by omega), if_neg (by omega)]; rfl
+
+theorem instantiate1'_liftLooseBVars_0 (e1 e2 : Expr) :
+    instantiate1' (liftLooseBVars' e1 k 1) e2 k = e1 := by
+  simpa using (instantiate1'_liftLooseBVars (d := 0)).trans liftLooseBVars_zero
+
+theorem instantiate1'_instantiate1' (e1 e2 e3 j) :
+    instantiate1' (instantiate1' e1 e2 (j+1)) e3 j =
+    instantiate1' (instantiate1' e1 (e3.liftLooseBVars' 0 1) j) e2 j := by
+  induction e1 generalizing j with simp [instantiate1', *] | bvar i
+  split <;> rename_i h
+  · split <;> rename_i h1
+    · simp [instantiate1', h1]
+    split <;> rename_i h1'
+    · subst i
+      simp [instantiate1']; rw [liftLooseBVars_comm (h := Nat.zero_le _)]
+      exact (instantiate1'_liftLooseBVars_0 ..).symm
+    · have hj := Nat.lt_of_le_of_ne (Nat.not_lt.1 h1) (Ne.symm h1')
+      let i+1 := i
+      simp [instantiate1', h1, h1', Nat.lt_of_succ_lt_succ h]
+  split <;> rename_i h'
+  · subst i
+    rw [if_neg (by omega), if_neg (by omega)]
+    simp [instantiate1']
+    suffices liftLooseBVars' _ _ (j+1) = _ by
+      rw [this]; exact instantiate1'_liftLooseBVars_0 ..
+    exact (liftLooseBVars_liftLooseBVars (Nat.zero_le _) (Nat.le_refl _)).symm
+  · have hk := Nat.lt_of_le_of_ne (Nat.not_lt.1 h) (Ne.symm h')
+    let i+1 := i
+    have hk := Nat.lt_of_add_lt_add_right hk
+    simp [instantiate1']
+    rw [if_neg (by omega), if_neg (by omega), if_neg (by omega), if_neg (by omega)]
+    simp [instantiate1']
+    rw [if_neg (Nat.lt_asymm hk), if_neg (Nat.ne_of_gt hk)]
+
+@[simp] def instantiateRevList (e : Expr) : List Expr → (k :_:= 0) → Expr
+  | [], _ => e
+  | a :: as, k => instantiate1' (instantiateRevList e as k) a k
+
+theorem instantiateList_eq_foldl :
+    instantiateList e as k = as.foldl (instantiate1' · · k) e := by
+  induction as generalizing e <;> simp [*]
+
+theorem instantiateRevList_eq_foldr :
+    instantiateRevList e as k = as.foldr (fun a e => instantiate1' e a k) e := by
+  induction as <;> simp [*]
+
+theorem instantiateList_append :
+    instantiateList e (es₁ ++ es₂) k = instantiateList (instantiateList e es₁ k) es₂ k := by
+  simp [instantiateList_eq_foldl]
+
+theorem instantiateRevList_append :
+    instantiateRevList e (es₁ ++ es₂) k =
+    instantiateRevList (instantiateRevList e es₂ k) es₁ k := by
+  simp [instantiateRevList_eq_foldr]
+
+theorem instantiateList_reverse :
+    instantiateList e as.reverse k = instantiateRevList e as k := by
+  simp [instantiateList_eq_foldl, instantiateRevList_eq_foldr]
+
+theorem instantiateRevList_reverse :
+    instantiateRevList e as.reverse k = instantiateList e as k := by
+  simp [instantiateList_eq_foldl, instantiateRevList_eq_foldr]
+
+@[simp]
+theorem instantiateRevList_lam : instantiateRevList (.lam n ty body bi) as k =
+    .lam n (instantiateRevList ty as k) (instantiateRevList body as (k + 1)) bi := by
+  induction as <;> simp [instantiate1', *]
+
+@[simp]
+theorem instantiateList_lam : instantiateList (.lam n ty body bi) as k =
+    .lam n (instantiateList ty as k) (instantiateList body as (k + 1)) bi := by
+  simp [← instantiateRevList_reverse, instantiateRevList_lam]
+
+@[simp]
+theorem instantiateRevList_app : instantiateRevList (.app f a) as k =
+    .app (instantiateRevList f as k) (instantiateRevList a as k) := by
+  induction as <;> simp [instantiate1', *]
+
+@[simp]
+theorem instantiateList_app : instantiateList (.app f a) as k =
+    .app (instantiateList f as k) (instantiateList a as k) := by
+  simp [← instantiateRevList_reverse, instantiateRevList_app]
+
+@[simp]
+theorem instantiateList_forallE : instantiateList (.forallE n ty body bi) as k =
+    .forallE n (instantiateList ty as k) (instantiateList body as (k + 1)) bi := by
+  induction as generalizing ty body <;> simp [instantiate1', *]
+
+@[simp]
+theorem instantiateList_letE : instantiateList (.letE n ty val body nd) as k =
+    .letE n (instantiateList ty as k) (instantiateList val as k)
+      (instantiateList body as (k + 1)) nd := by
+  induction as generalizing ty val body <;> simp [instantiate1', *]
+
+theorem instantiateList_instantiate1_comm (h : a.looseBVarRange' = 0) :
+    (instantiateList e as 1).instantiate1' a =
+    instantiateList (e.instantiate1' a) as := by
+  induction as generalizing e <;> simp [*]
+  congr 1; refine (instantiate1'_instantiate1' (j := 0) ..).trans ?_
+  rw [liftLooseBVars_eq_self (by simp [h])]
+
+theorem instantiateRev_push {e : Expr} {subst a} :
+    instantiateRev e (subst.push a) = instantiateRev (e.instantiate1' a) subst := by
+  let ⟨subst⟩ := subst; simp [instantiateList]
+
+theorem abstractList_eq_foldl {e : Expr} {as k} :
+    abstractList e as k = List.foldl (fun e a => abstract1 a e k) e as := by
+  induction as generalizing e <;> simp_all
+
+@[simp] def abstractRevList : Expr → List FVarId → (k :_:= 0) → Expr
+  | e, [], _ => e
+  | e, a :: as, k => abstract1 a (abstractRevList e as k) k
+
+theorem abstractRevList_eq_foldr {e : Expr} {as k} :
+    abstractRevList e as k = List.foldr (abstract1 · · k) e as := by
+  induction as <;> simp_all
+
+theorem abstractList_reverse {e : Expr} {as k} :
+    abstractList e as.reverse k = abstractRevList e as k := by
+  simp [abstractList_eq_foldl, abstractRevList_eq_foldr]
+
+theorem abstractRevList_reverse {e : Expr} {as k} :
+    abstractRevList e as.reverse k = abstractList e as k := by
+  simp [abstractList_eq_foldl, abstractRevList_eq_foldr]
+
+theorem abstractList_append {e : Expr} {as k} :
+    abstractList e (as ++ as') k = abstractList (abstractList e as k) as' k := by
+  simp [abstractList_eq_foldl]
+
+theorem abstract1_comm {e : Expr} {k} (h : a ≠ b) :
+    abstract1 a (abstract1 b e k) k =
+    abstract1 b (abstract1 a e k) (k+1) := by
+  induction e generalizing k with simp_all [abstract1]
+  | bvar => split <;> [rw [if_pos]; simp [*]] <;> omega
+  | fvar => split <;> split <;> simp_all [abstract1]
+
+theorem abstract1_abstractList {e : Expr} {as : List FVarId} {k} (H : a ∉ as) :
+    abstract1 a (abstractList e as k) k =
+    abstractList (abstract1 a e k) as (k+1) := by
+  induction as generalizing e <;> simp_all [abstract1_comm]
+
+theorem abstract1_abstractList' {e : Expr} {as : List FVarId} {k} (H : (a :: as).Nodup) :
+    abstract1 a (abstractList e as k) (k + as.length) =
+    abstractList (abstract1 a e k) as k := by
+  induction as generalizing e a with
+  | nil => simp
+  | cons b as ih =>
+    simp at *; simp [H] at ih
+    rw [← ih H.2.1, ← Nat.add_assoc, ← abstract1_comm (.symm H.1.1), ih H.1.2, ih H.2.1]
+
+theorem abstract1_hasLooseBVar (a e k i) :
+    (abstract1 a e k).hasLooseBVar' (if i < k then i else i+1) = e.hasLooseBVar' i := by
+  have (i) k : (if i < k then i else i + 1) + 1 = if i + 1 < k + 1 then i + 1 else i + 1 + 1 := by
+    simp; split <;> rfl
+  induction e generalizing i k with simp only [hasLooseBVar', abstract1, *]
+  | bvar j =>
+    by_cases h : j = i <;> simp [h]
+    split <;> split <;> omega
+  | fvar b =>
+    split <;> simp [hasLooseBVar']
+    split <;> omega
+
+theorem abstract1_eq_liftLooseBVars (h : (abstract1 a e k).hasLooseBVar' k = false) :
+    abstract1 a e k = liftLooseBVars' e k 1 := by
+  induction e generalizing k <;> grind [abstract1, hasLooseBVar', liftLooseBVars']
+
+-- theorem abstract1_looseBVarRange_le :
+--     (abstract1 a e k).looseBVarRange' ≤ max k e.looseBVarRange' + 1 := by
+--   have H {k a b c d} (h1 : a ≤ max k c + 1) (h2 : b ≤ max k d + 1) :
+--       max a b ≤ max k (max c d) + 1 := by
+--     rw [Nat.max_le]; simp [Nat.max_def]; split <;> split <;> omega
+--   have {k a b c d} (h1 : a ≤ max k c + 1) (h2 : b ≤ max (k+1) d + 1) :
+--       max a (b - 1) ≤ max k (max c (d - 1)) + 1 := by apply H <;> omega
+--   induction e generalizing k with simp [abstract1, looseBVarRange', *] <;> try solve_by_elim
+--   | bvar => split <;> omega
+--   | fvar => split <;> simp [looseBVarRange']
+
+theorem lowerLooseBVars_eq_instantiate (h : e.hasLooseBVar' k = false) :
+    e.lowerLooseBVars' (k + 1) 1 = instantiate1' e v k := by
+  induction e generalizing k with simp_all [hasLooseBVar', lowerLooseBVars', instantiate1']
+  | bvar j => split <;> [rw [if_pos (by omega)]; rw [if_neg (by omega)]]
+
+theorem hasLooseBVar_of_ge_looseBVarRange {e : Expr} (h : e.looseBVarRange' ≤ k) :
+    e.hasLooseBVar' k = false := by
+  induction e generalizing k with simp_all [hasLooseBVar', looseBVarRange', Nat.max_le]
+  | bvar j => omega
+
+theorem abstract1_lower {e : Expr} (h : e.hasLooseBVar' k₁ = false) (hk : k₁ ≤ k₂) :
+    Expr.abstract1 a (e.lowerLooseBVars' (k₁ + 1) 1) k₂ =
+    (Expr.abstract1 a e (k₂ + 1)).lowerLooseBVars' (k₁ + 1) 1 := by
+  induction e generalizing k₁ k₂ with simp_all [abstract1, lowerLooseBVars', hasLooseBVar']
+  | bvar i =>
+    split <;> [skip; split]
+    · rw [if_pos (c := i < k₂ + 1) (by omega), if_pos (by omega)]; simp [*]
+    · rw [if_pos (c := i < _) (by omega)]; simp [*]
+    · rw [if_neg (c := i < _) (by omega), if_neg (by omega)]; omega
+  | fvar b =>
+    split <;> simp [lowerLooseBVars', -right_eq_ite_iff]
+    rw [if_neg (by omega)]
+
+variable (red : Bool) (s : Name → Level) in
+def instantiateLevelParamsCore' : Expr → Expr
+  | .const c ls => .const c (ls.map (·.substParams' s red))
+  | .sort u => .sort (u.substParams' s red)
+  | .mdata m e => .mdata m (instantiateLevelParamsCore' e)
+  | .proj n i e => .proj n i (instantiateLevelParamsCore' e)
+  | .app f a => .app (instantiateLevelParamsCore' f) (instantiateLevelParamsCore' a)
+  | .lam n t b bi => .lam n (instantiateLevelParamsCore' t) (instantiateLevelParamsCore' b) bi
+  | .forallE n t b bi =>
+    .forallE n (instantiateLevelParamsCore' t) (instantiateLevelParamsCore' b) bi
+  | .letE n t v b bi => .letE n (instantiateLevelParamsCore' t)
+      (instantiateLevelParamsCore' v) (instantiateLevelParamsCore' b) bi
+  | e@(.bvar _)
+  | e@(.fvar _)
+  | e@(.mvar _)
+  | e@(.lit _) => e
+
+theorem instantiateLevelParamsCore_eq_self (h : e.hasLevelParam' = false) :
+    instantiateLevelParamsCore' red s e = e := by
+  induction e <;> simp_all [instantiateLevelParamsCore', hasLevelParam', Level.substParams_eq_self]
+  exact List.map_id''' _ fun _ h' => Level.substParams_eq_self (h _ h')
+
+theorem instantiateLevelParamsCore_id {e : Expr} :
+    instantiateLevelParamsCore' false .param e = e := by
+  induction e <;> simp_all [instantiateLevelParamsCore', Level.substParams_id]
+
+open private instantiateLevelParamsCore.replaceFn from Lean.Util.InstantiateLevelParams in
+theorem instantiateLevelParamsCore_eq :
+    instantiateLevelParamsCore s e =
+    instantiateLevelParamsCore' true (fun x => (s x).getD (.param x)) e := by
+  simp [instantiateLevelParamsCore]
+  have (e) (H : e.hasLevelParam' = true →
+        replaceNoCache (instantiateLevelParamsCore.replaceFn s) e =
+        instantiateLevelParamsCore' true (fun x => (s x).getD (Level.param x)) e) :
+      replaceNoCache (instantiateLevelParamsCore.replaceFn s) e =
+      instantiateLevelParamsCore' true (fun x => (s x).getD (Level.param x)) e := by
+    cases eq : e.hasLevelParam' <;> [skip; exact H eq]
+    rw [instantiateLevelParamsCore_eq_self eq]
+    suffices ∀ f, f e = some e → replaceNoCache f e = e by
+      apply this; simp [instantiateLevelParamsCore.replaceFn, eq]
+    intro f eq; cases e <;> simp only [replaceNoCache, eq]
+  induction e <;> (
+    refine this _ fun h => ?_
+    simp only [replaceNoCache, instantiateLevelParamsCore.replaceFn]
+    simp [h]; clear this h
+    simp_all [instantiateLevelParamsCore'])
+
+open private getParamSubst from Lean.Util.InstantiateLevelParams in
+theorem instantiateLevelParams_eq {e ps ls} :
+    instantiateLevelParams e ps ls =
+    instantiateLevelParamsCore' (!ps.isEmpty && !ls.isEmpty)
+      (fun x => ((ps.idxOf? x).bind (ls[·]?)).getD (.param x)) e := by
+  simp only [instantiateLevelParams]; rw [← Bool.not_or];
+  cases eq : ps.isEmpty || ls.isEmpty <;> simp
+  · clear eq
+    simp [instantiateLevelParamsCore_eq, List.idxOf?]; congr; ext n; congr
+    induction ps generalizing ls <;> cases ls <;> simp [getParamSubst]
+    split <;> simp [*, List.findIdx?_cons]; cases List.findIdx? .. <;> simp
+  · refine instantiateLevelParamsCore_id.symm.trans ?_; congr; ext n
+    cases ps <;> simp_all
+
+theorem eqv_sort {e : Expr} : e == .sort u ↔ e = .sort u := by
+  conv => lhs; simp [(· == ·)]
+  cases e <;> simp [eqv']
+
+theorem eqv_const {e : Expr} : e == .const c ls ↔ e = .const c ls := by
+  conv => lhs; simp [(· == ·)]
+  cases e <;> simp [eqv']
+
+theorem structuralEq_const {e : Expr} :
+    structuralEq e (.const c ls) = true ↔ e = .const c ls := by
+  cases e <;> simp [structuralEq]
+
+theorem structuralEq_refl (e : Expr) : structuralEq e e = true := by
+  induction e <;> simp [structuralEq, *]
+
+/-- Transparent structural equality implies Lean's non-strict expression
+equivalence.  This direction deliberately does not identify binder names or
+binder information, which `Expr.eqv` also ignores. -/
+theorem structuralEq_eqv {a b : Expr} :
+    structuralEq a b = true → a == b := by
+  simp only [(· == ·)]
+  induction a generalizing b <;> cases b <;>
+    simp_all [structuralEq, eqv']
+
+theorem eqv_refl (e : Expr) : e == e := by
+  simp [(· == ·)]; induction e <;> simp [eqv', *]
+
+theorem eqv_euc {e₁ e₂ e₃ : Expr} : e₁ == e₂ → e₁ == e₃ → e₂ == e₃ := by
+  simp [(· == ·)]
+  induction e₁ generalizing e₂ e₃
+  all_goals
+    cases e₂ <;> try change false = _ → _; rintro ⟨⟩
+    simp [eqv']; intros; subst_vars; try simp [*]
+  all_goals
+    revert ‹Expr.eqv' .. = _›
+    cases e₃ <;> try change false = _ → _; rintro ⟨⟩
+    simp +contextual [eqv', *]
+  simp [BEq.congr_left ‹_›]
+
+instance : EquivBEq Expr where
+  symm h := eqv_euc h (eqv_refl _)
+  trans h1 h2 := eqv_euc (eqv_euc h1 (eqv_refl _)) h2
+  rfl := eqv_refl _
+
+theorem data_eq {e₁ e₂ : Expr} : e₁ == e₂ → e₁.data = e₂.data := by
+  simp [(· == ·)]; induction e₁ generalizing e₂
+  all_goals
+    cases e₂ <;> try change false = _ → _; rintro ⟨⟩
+    simp [eqv']; intros; subst_vars; try simp [*]
+  all_goals simp [Expr.data]; grind
+
+instance : LawfulHashable Expr where
+  hash_eq e₁ e₂ h := by simp [hash, Expr.hash, data_eq h]
+
+theorem instantiate1_eqv {e₁ e₂ : Expr} :
+    e₁ == e₂ → e₁.instantiate1' a k == e₂.instantiate1' a k := by
+  simp [(· == ·)]; induction e₁ generalizing e₂ k
+  all_goals
+    cases e₂ <;> try change false = _ → _; rintro ⟨⟩
+    simp [instantiate1', eqv']
+  all_goals intros; subst_vars; try simp [*]
+  split <;> [skip; split] <;> simpa [(· == ·)] using eqv_refl _
+
+theorem instantiateList_eqv {e₁ e₂ : Expr} (h : e₁ == e₂) :
+    e₁.instantiateList as k == e₂.instantiateList as k := by
+  induction as generalizing e₁ e₂ <;> simp [instantiate1_eqv, *]
diff --git a/Ix/Theory/Named/Verify/Level.lean b/Ix/Theory/Named/Verify/Level.lean
new file mode 100644
index 000000000..8373b4f29
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Level.lean
@@ -0,0 +1,3916 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.VLevel
+import Ix.Theory.Named.Reference.Level
+import Ix.Theory.Named.Verify.Name
+import Ix.Theory.Named.Verify.LevelStd
+import Ix.Theory.Named.Verify.Axioms
+import Std.Tactic.BVDecide
+import Std.Data.TreeMap.Lemmas
+
+open Ix.Theory (VLevel)
+
+namespace Lean
+
+namespace Level
+open Ix.Theory.Named
+
+attribute [simp] mkLevelSucc mkLevelMax mkLevelIMax updateSucc! updateMax! updateIMax!
+
+-- variable (ls : List Name) in
+-- def _root_.Ix.Theory.VLevel.toLevel : VLevel → Level
+--   | .zero => .zero
+--   | .succ l => .succ l.toLevel
+--   | .max l₁ l₂ => .max l₁.toLevel l₂.toLevel
+--   | .imax l₁ l₂ => .imax l₁.toLevel l₂.toLevel
+--   | .param n => match ls.get? n with
+--     | some l => .param l
+--     | none => .zero
+
+-- theorem toLevel_inj {ls : List Name} (d : ls.Nodup)
+--     {l₁ l₂ : VLevel} (eq : l₁.toLevel ls = l₂.toLevel ls) : l₁ = l₂ := sorry
+
+@[simp] def getOffset' : Level → Nat
+  | succ u => getOffset' u + 1
+  | _      => 0
+
+@[simp] theorem getOffset_eq (u : Level) : u.getOffset = u.getOffset' := go _ 0 where
+  go (u : Level) (i) : u.getOffsetAux i = u.getOffset' + i := by
+    unfold getOffsetAux getOffset'; split <;> simp
+    rw [go]; simp [Nat.add_right_comm, Nat.add_assoc]
+
+set_option allowUnsafeReducibility true
+attribute [local reducible] Data
+
+theorem mkData_depth (H : d < 2 ^ 24) : (mkData h d hmv hp).depth.toNat = d := by
+  rw [mkData_eq, mkData', if_neg (Nat.not_lt.2 (Nat.le_sub_one_of_lt H)), Data.depth]
+  have : d.toUInt64.toUInt32.toNat = d := by simp; omega
+  refine .trans ?_ this; congr 2
+  rw [← UInt64.toBitVec_inj]
+  have : d.toUInt64.toNat = d := by simp; omega
+  have : d.toUInt64.toBitVec ≤ 0xffffff#64 := (this ▸ Nat.le_sub_one_of_lt H :)
+  have : h.toUInt32.toUInt64.toBitVec ≤ 0xffffffff#64 := Nat.le_of_lt_succ h.toUInt32.1.1.2
+  have hb : ∀ (b : Bool), b.toUInt64.toBitVec ≤ 1#64 := by decide
+  have := hb hmv; have := hb hp
+  change (
+    h.toUInt32.toUInt64.toBitVec +
+    hmv.toUInt64.toBitVec <<< 32#64 +
+    hp.toUInt64.toBitVec <<< 33#64 +
+    d.toUInt64.toBitVec <<< 40#64) >>> 40#64 = d.toUInt64.toBitVec
+  bv_decide
+
+theorem mkData_hasParam (H : d < 2 ^ 24) : (mkData h d hmv hp).hasParam = hp := by
+  rw [mkData_eq, mkData', if_neg (Nat.not_lt.2 (Nat.le_sub_one_of_lt H))]
+  simp [Data.hasParam, (· == ·), ← UInt64.toBitVec_inj]
+  have : h.toUInt32.toUInt64.toBitVec ≤ 0xffffffff#64 := Nat.le_of_lt_succ h.toUInt32.1.1.2
+  have hb : ∀ (b : Bool), b.toUInt64.toBitVec ≤ 1#64 := by decide
+  have := hb hmv; have := hb hp
+  let L := ((
+    h.toUInt32.toUInt64.toBitVec +
+    hmv.toUInt64.toBitVec <<< 32#64 +
+    hp.toUInt64.toBitVec <<< 33#64 +
+    d.toUInt64.toBitVec <<< 40#64) >>> 33#64) &&& 1#64
+  change decide (L = 1#64) = hp
+  rw [show L = hp.toUInt64.toBitVec by bv_decide]
+  cases hp <;> decide
+
+theorem mkData_hasMVar (H : d < 2 ^ 24) : (mkData h d hmv hp).hasMVar = hmv := by
+  rw [mkData_eq, mkData', if_neg (Nat.not_lt.2 (Nat.le_sub_one_of_lt H))]
+  simp [Data.hasMVar, (· == ·), ← UInt64.toBitVec_inj]
+  have : h.toUInt32.toUInt64.toBitVec ≤ 0xffffffff#64 := Nat.le_of_lt_succ h.toUInt32.1.1.2
+  have hb : ∀ (b : Bool), b.toUInt64.toBitVec ≤ 1#64 := by decide
+  have := hb hmv; have := hb hp
+  let L := ((
+    h.toUInt32.toUInt64.toBitVec +
+    hmv.toUInt64.toBitVec <<< 32#64 +
+    hp.toUInt64.toBitVec <<< 33#64 +
+    d.toUInt64.toBitVec <<< 40#64) >>> 32#64) &&& 1#64
+  change decide (L = 1#64) = hmv
+  rw [show L = hmv.toUInt64.toBitVec by bv_decide]
+  cases hmv <;> decide
+
+theorem ofLevel_of_not_hasParam (Us) {l : Level}
+    (hl : l.hasParam' = false) (hmv : l.hasMVar' = false) :
+    ∃ u', VLevel.ofLevel Us l = some u' := by
+  induction l <;> simp_all [hasParam', hasMVar', VLevel.ofLevel, exists_comm]
+
+def getUndefParam.F (ps : List Name) (l : Level) : StateT (Option Name) Id Bool := do
+  if !l.hasParam || (← get).isSome then
+    return false
+  if let .param n := l then
+    if n ∉ ps then
+      set (some n)
+  return true
+
+theorem getUndefParam_none {l : Level} (hmv : l.hasMVar' = false) :
+    l.getUndefParam Us = none → ∃ u', VLevel.ofLevel Us l = some u' := by
+  suffices ∀ s, ((l.forEach (getUndefParam.F Us)).run s).run.snd = none → s = none ∧ _ from
+    (this _ · |>.2)
+  have {l} (hmv : l.hasMVar' = false) {g}
+      (H : ∀ {s'}, (g.run s').run.snd = none → s' = none ∧
+        (((getUndefParam.F Us l).run none).run = (true, none) →
+          ∃ u', VLevel.ofLevel Us l = some u')) (s) :
+      ((do if !(← getUndefParam.F Us l) then pure () else g) |>.run s).run.snd = none →
+      s = none ∧ ∃ u', VLevel.ofLevel Us l = some u' := by
+    simp; split <;> rename_i h
+    · simp; revert h
+      simp [getUndefParam.F]; split <;> [simp; split <;> [split <;> simp; simp]]
+      rintro rfl; simp at *
+      exact ofLevel_of_not_hasParam Us ‹_› hmv
+    · refine fun h' => let ⟨h1, h2⟩ := H h'; have := ?_; ⟨this, h2 ?_⟩
+      · revert h h1
+        simp [getUndefParam.F]; split <;> [simp; split <;> [split <;> simp; simp]]
+      · revert h h1; subst s
+        cases (getUndefParam.F Us l).run none; simp; rintro rfl rfl; rfl
+  have lt {n a} : n + 1 < a → n < a := by omega
+  induction l with (
+    refine this hmv fun h => ?_; clear this
+    simp [hasMVar', VLevel.ofLevel, *] at *)
+  | succ _ ih =>
+    have ⟨h, _, h1⟩ := ih hmv _ h
+    exact ⟨h, fun _ => ⟨_, _, h1, rfl⟩⟩
+  | max _ _ ih1 ih2 | imax _ _ ih1 ih2 =>
+    have ⟨h, _, h2⟩ := ih2 hmv.2 _ h
+    have ⟨h, _, h1⟩ := ih1 hmv.1 _ h
+    exact ⟨h, fun _ => ⟨_, _, h1, _, h2, rfl⟩⟩
+  | param =>
+    simp [getUndefParam.F, hasParam', List.idxOf_lt_length_iff, *]
+    split <;> simp [*]
+  | _ => simp [*]
+
+variable (s : Name → Level) in
+def substParams' (red : Bool) : Level → Level
+  | .zero       => .zero
+  | .succ v     => .succ (substParams' (v.hasParam ∧ red) v)
+  | .max v₁ v₂  =>
+    let red := (v₁.hasParam ∨ v₂.hasParam) ∧ red
+    (if red then mkLevelMax' else .max) (substParams' red v₁) (substParams' red v₂)
+  | .imax v₁ v₂ =>
+    let red := (v₁.hasParam ∨ v₂.hasParam) ∧ red
+    (if red then mkLevelIMax' else .imax) (substParams' red v₁) (substParams' red v₂)
+  | .param n => s n
+  | u => u
+
+theorem substParams_eq_self {u : Level} (h : u.hasParam' = false) :
+    substParams' s red u = u := by
+  induction u generalizing red <;> simp_all [substParams', hasParam']
+
+open private substParams.go from Lean.Level in
+@[simp] theorem substParams_eq (u : Level) (s : Name → Option Level) :
+    substParams u s = substParams' (fun x => (s x).getD (.param x)) true u := by
+  unfold substParams
+  induction u <;> simp [substParams.go, substParams', hasParam', ← Bool.or_eq_true] <;>
+    split <;> simp [*, substParams_eq_self] <;> simp_all [substParams_eq_self]
+
+theorem substParams_id {u : Level} :
+    substParams' .param false u = u := by induction u <;> simp_all [substParams']
+
+local notation "max'" => Max.max
+
+namespace Normalize
+
+attribute [local instance] Lean.Level.Normalize.namedOrdName
+
+local instance : Std.TransCmp (α := Name) compare := inferInstanceAs (Std.TransCmp Name.cmp)
+local instance : Std.LawfulBEqCmp (α := Name) compare :=
+  inferInstanceAs (Std.LawfulBEqCmp Name.cmp)
+local instance : Std.LawfulBEqCmp (α := List Name) compare :=
+  inferInstanceAs (Std.LawfulBEqCmp (List.compareLex Name.cmp))
+
+instance : LawfulBEq VarNode where
+  rfl {a} := by cases a <;> simp! +instances [instBEqVarNode]
+  eq_of_beq {a b} := by cases a <;> cases b <;> simp! +instances [instBEqVarNode]
+
+@[reducible] local instance : Membership (List Name) NormLevel :=
+  inferInstanceAs (Membership _ (Std.TreeMap _ _ compare))
+
+@[reducible] local instance : GetElem? NormLevel (List Name) Node (fun m a => a ∈ m) :=
+  inferInstanceAs (GetElem? (Std.TreeMap _ _ compare) ..)
+
+inductive Extend1 : List α → α → List α → Prop
+  | mk : Extend1 (l₁ ++ l₂) v (l₁ ++ v :: l₂)
+
+theorem Extend1.base : Extend1 l v (v::l) := .mk (l₁ := [])
+theorem Extend1.cons (H : Extend1 l v l') : Extend1 (a::l) v (a::l') :=
+  let .mk := H; .mk (l₁ := _::_)
+
+theorem Extend1.mem (H : Extend1 p a p') : b ∈ p' ↔ b = a ∨ b ∈ p := by cases H; simp [or_left_comm]
+
+theorem Extend1.length (H : Extend1 p a p') : p'.length = p.length + 1 := by
+  cases H; simp [Nat.add_assoc]
+
+theorem Extend1.of_mem (h : a ∈ p') : ∃ p, Extend1 p a p' := by
+  obtain ⟨_, _, rfl, _⟩ := List.eq_append_cons_of_mem h; exact ⟨_, .mk⟩
+
+theorem Extend1.orderedInsert (H : orderedInsert cmp v p = some p') : Extend1 p v p' := by
+  induction p generalizing p' with simp [Normalize.orderedInsert] at H
+  | nil => exact H ▸ .base
+  | cons _ _ ih =>
+    split at H <;> [(cases H; exact .base); cases H; skip]
+    simp at H; obtain ⟨_, H, rfl⟩ := H; exact (ih H).cons
+
+inductive Extend? : List α → α → List α → Prop
+  | mk1 : Extend1 l v l' → Extend? l v l'
+  | mk0 : v ∈ l → Extend? l v l
+
+theorem Extend?.cons (H : Extend? l v l') : Extend? (a::l) v (a::l') := by
+  cases H with
+  | mk1 H => exact .mk1 H.cons
+  | mk0 H => exact .mk0 (.tail _ H)
+
+theorem Extend?.mem (H : Extend? p a p') : b ∈ p' ↔ b = a ∨ b ∈ p := by
+  cases H with
+  | mk1 H => exact H.mem
+  | mk0 H => simp; rintro rfl; exact H
+
+theorem Extend?.orderedInsert [BEq α] [LawfulBEq α] [Std.LawfulBEqCmp (α := α) cmp] :
+    Extend? p v ((orderedInsert cmp v p).getD p) := by
+  induction p with simp [Normalize.orderedInsert]
+  | nil => exact .mk1 .base
+  | cons _ _ ih =>
+    split
+    · exact .mk1 .base
+    · simp_all; exact .mk0 (.head _)
+    · revert ih; cases Normalize.orderedInsert .. <;> exact .cons
+
+section
+variable (ls : List Name) (ρ : List Nat) in
+def evalParam (x : Name) : Nat :=
+  let i := ls.idxOf x; if i < ls.length then ρ[i]?.getD 0 else 0
+
+theorem evalParam_eq (hv : ls.idxOf x < ls.length) :
+    evalParam ls ρ x = ρ[List.idxOf x ls]?.getD 0 := if_pos hv
+
+variable (ls : List Name) (ρ : List Nat) in
+def VarNode.eval (l : VarNode) : Nat := evalParam ls ρ l.var + l.offset
+
+variable (ls : List Name) (ρ : List Nat) in
+def Node.eval (l : Node) : Nat :=
+  l.var.foldl (init := l.const) fun n v => max' n (v.eval ls ρ)
+
+theorem Node.eval_le : eval ls ρ l ≤ n ↔
+    l.const ≤ n ∧ ∀ v ∈ l.var, v.eval ls ρ ≤ n := by
+  simp [eval, ← List.foldr_reverse]; simp only [← l.var.mem_reverse]
+  induction l.var.reverse with simp | cons a l
+  simp [Nat.max_le, and_comm, and_left_comm, *]
+
+variable (ls : List Name) (ρ : List Nat) in
+def allNZ (path : List Name) : Bool := path.all (0 < evalParam ls ρ ·)
+
+theorem allNZ_cons : allNZ ls ρ (a :: path) ↔
+    0 < evalParam ls ρ a ∧ allNZ ls ρ path := by simp [allNZ]
+
+theorem allNZ_mono (H : ∀ x ∈ path, x ∈ path') : allNZ ls ρ path' → allNZ ls ρ path := by
+  simp [allNZ]; grind
+
+variable (ls : List Name) (ρ : List Nat) in
+def evalPath (path : List Name) (n : Nat) : Nat :=
+  if allNZ ls ρ path then n else 0
+
+theorem evalPath_cons : evalPath ls ρ (a :: path) n =
+    evalPath ls ρ path (if 0 < evalParam ls ρ a then n else 0) := by
+  by_cases h : 0 < evalParam ls ρ a <;> simp [evalPath, allNZ_cons, h]
+
+theorem evalPath_max :
+    evalPath ls ρ path (max' m n) = max' (evalPath ls ρ path m) (evalPath ls ρ path n) := by
+  simp [evalPath]; split <;> simp
+
+theorem evalPath_mono (h : n ≤ m) :
+    evalPath ls ρ path n ≤ evalPath ls ρ path m := by
+  simp [evalPath]; split <;> simp [*]
+
+theorem evalPath_le : evalPath ls ρ path n ≤ m ↔ (allNZ ls ρ path → n ≤ m) := by
+  simp [evalPath]; split <;> simp [*]
+
+variable (ls : List Name) (ρ : List Nat) in
+def NormLevel.eval (l : NormLevel) : Nat :=
+  l.foldl (init := 0) fun n a b => max' n (evalPath ls ρ a (b.eval ls ρ))
+
+theorem NormLevel.eval_le : eval ls ρ l ≤ n ↔
+    ∀ a b, l.get? a = some b → evalPath ls ρ a (b.eval ls ρ) ≤ n := by
+  simp [eval, Std.TreeMap.foldl_eq_foldl_toList, ← List.foldr_reverse]
+  simp only [← Std.TreeMap.mem_toList_iff_getElem?_eq_some, ← l.toList.mem_reverse]
+  induction l.toList.reverse with simp | cons a l; let (a, b) := a
+  simp [or_imp, forall_and, Nat.max_le, and_comm, *]
+
+end
+
+theorem NormLevel.addVar_contains (H : acc.contains x) : (addVar v k path acc).contains x := by
+  simp_all [addVar, Std.TreeMap.mem_modify]
+
+theorem NormLevel.addNode_contains (H : acc.contains x) : (addNode v k path acc).contains x := by
+  simp [addNode, Std.TreeMap.mem_alter] at *; split <;> simp [*]
+
+theorem NormLevel.addNode_contains_self : (addNode v k path acc).contains path := by
+  simp [addNode]; split <;> simp
+
+theorem NormLevel.addConst_contains (H : acc.contains x) : (addConst k path acc).contains x := by
+  simp [addConst] at *; split <;> simp [H, Std.TreeMap.mem_alter]; split <;> simp
+
+theorem NormLevel.addConst_contains_self (h : k ≠ 0) (h2 : ¬(k = 1 ∧ path ≠ [])) :
+    (addConst k path acc).contains path := by
+  simp [addConst, h, h2]; split <;> simp
+
+theorem normalizeAux_contains (H : acc.contains x) : (normalizeAux u path k acc).contains x := by
+  unfold normalizeAux; split
+  · exact NormLevel.addConst_contains H
+  · exact NormLevel.addConst_contains H
+  · exact normalizeAux_contains H
+  · exact normalizeAux_contains (normalizeAux_contains H)
+  · exact normalizeAux_contains (normalizeAux_contains H)
+  · exact normalizeAux_contains (normalizeAux_contains H)
+  · exact normalizeAux_contains (normalizeAux_contains H)
+  · split <;> [skip; (dsimp; split)]
+    · exact normalizeAux_contains (NormLevel.addNode_contains (NormLevel.addConst_contains H))
+    · exact normalizeAux_contains H
+    · exact normalizeAux_contains (NormLevel.addVar_contains H)
+  · exact H
+  · exact H
+  · split <;> [skip; split]
+    · exact NormLevel.addNode_contains (NormLevel.addConst_contains H)
+    · exact H
+    · exact NormLevel.addVar_contains H
+
+theorem imax_max : Lean.Nat.imax a (max' b c) = max' (Lean.Nat.imax a b) (Lean.Nat.imax a c) := by
+  simp [Lean.Nat.imax]; symm; split <;> simp [*]; split <;> simp [*, Nat.max_eq_max]
+  rw [Nat.max_left_comm b, ← Nat.max_assoc, Nat.max_self]
+
+theorem imax_imax : Lean.Nat.imax a (Lean.Nat.imax b c) =
+    max' (Lean.Nat.imax a c) (Lean.Nat.imax b c) := by
+  simp [Lean.Nat.imax]; by_cases h : c = 0 <;> simp [*, Nat.max_eq_max]
+  rw [Nat.max_left_comm c, Nat.max_self]
+
+protected theorem Extend?.allNZ (H : Extend? p a p') : allNZ ls ρ p' = allNZ ls ρ (a :: p) := by
+  rw [Bool.eq_iff_iff]; simp [allNZ, H.mem]
+
+protected theorem Extend?.evalPath (H : Extend? p a p') :
+    evalPath ls ρ p' = evalPath ls ρ (a :: p) := by ext n; simp [evalPath, H.allNZ]
+
+theorem ext_le {n m : Nat} (H : ∀ x, n ≤ x ↔ m ≤ x) : n = m :=
+  Nat.le_antisymm ((H _).2 (Nat.le_refl _)) ((H _).1 (Nat.le_refl _))
+
+theorem le_ext_le {n m : Nat} (H : ∀ x, n ≤ x → m ≤ x) : m ≤ n := H _ (Nat.le_refl _)
+
+/-- Condition sets are strictly sorted, which is what makes `subset` a decision procedure
+for inclusion: it is built up by `orderedInsert` from the empty set. -/
+def Sorted (l : List Name) : Prop := l.Pairwise (compare · · = .lt)
+
+nonrec theorem Sorted.nil : Sorted [] := .nil
+
+theorem Sorted.of_cons (h : Sorted (a :: l)) : Sorted l := (List.pairwise_cons.1 h).2
+
+theorem Sorted.head (h : Sorted (a :: l)) : ∀ b ∈ l, compare a b = .lt :=
+  (List.pairwise_cons.1 h).1
+
+theorem Sorted.erase (h : Sorted l) : Sorted (l.erase a) := h.sublist (List.erase_sublist ..)
+
+theorem Sorted.nodup (h : Sorted l) : l.Nodup :=
+  h.imp <| by rintro _ _ hab rfl; rw [Std.ReflOrd.compare_self] at hab; cases hab
+
+theorem Sorted.orderedInsert (h : Sorted l) (he : orderedInsert Name.cmp a l = some l') :
+    Sorted l' := by
+  induction l generalizing l' with | nil => cases he; exact .cons (by simp) .nil | cons b l ih
+  simp only [Normalize.orderedInsert] at he
+  split at he <;> rename_i hab
+  · cases he
+    refine .cons (fun c hc => ?_) h
+    obtain rfl | hc := List.mem_cons.1 hc
+    · exact hab
+    · exact Std.TransCmp.lt_trans hab (h.head _ hc)
+  · cases he
+  · simp only [Option.map_eq_some_iff] at he
+    obtain ⟨l'', he, rfl⟩ := he
+    refine .cons (fun c hc => ?_) (ih h.of_cons he)
+    -- `c` is either `a`, which is above `b`, or an element of `l`
+    obtain rfl | hc := (Extend1.orderedInsert he).mem.1 hc
+    · exact Std.OrientedCmp.lt_of_gt hab
+    · exact h.head _ hc
+
+/-- The well-formedness invariant of the `NormLevel` maps produced by `normalizeAux`:
+every variable recorded at a key is an element of that key, and every nonempty key `p`
+extends another key of the map by a single variable that is recorded at `p`.
+The latter is what makes the sublevels expressible by `imax` chains (see the reconstruction
+comment in `Ix.Theory.Named.Level`), and it lets `addConst` drop `C(p, 1)` for `p ≠ []`. -/
+def NormLevel.WF (s : NormLevel) : Prop :=
+  ∀ p n, s.get? p = some n →
+    (p ≠ [] → ∃ v p', Extend1 p' v p ∧ (p' = [] ∨ s.contains p') ∧ ∃ x ∈ n.var, x.var = v) ∧
+    (∀ v ∈ n.var, v.var ∈ p) ∧ Sorted p
+
+theorem NormLevel.WF.of_mem (hm : v ∈ path) (H : WF s) (hp : s.contains path) :
+    ∃ path₁ path₂ n, (∀ x ∈ path₁, x ∈ path) ∧
+      Extend1 path₁ v path₂ ∧ (path₁ = [] ∨ s.contains path₁) ∧ s.get? path₂ = some n ∧
+      ∃ x ∈ n.var, x.var = v := by
+  generalize eq : path.length = n
+  induction n generalizing path with | zero => simp at eq; subst path; cases hm | succ n ih
+  have ⟨_, hp'⟩ := Option.isSome_iff_exists.1 (Std.TreeMap.isSome_getElem?_eq_contains.trans hp)
+  have ⟨_, _, a1, a2, a3⟩ := (H _ _ hp').1 (by rintro rfl; cases hm)
+  obtain rfl | hm := a1.mem.1 hm
+  · exact ⟨_, _, _, fun _ h => a1.mem.2 (.inr h), a1, a2, hp', a3⟩
+  · -- the parent is in the map, since `v` occurs in it and so it is not the root
+    have ⟨_, _, _, b1, b2⟩ := ih hm (a2.resolve_left (by rintro rfl; cases hm))
+      (by cases a1; simp at eq ⊢; exact Nat.succ_inj.1 eq)
+    exact ⟨_, _, _, fun _ h => a1.mem.2 (.inr (b1 _ h)), b2⟩
+
+theorem NormLevel.WF.sortedOf {s : NormLevel} (wf : s.WF) (H : path = [] ∨ s.contains path) :
+    Sorted path := by
+  obtain rfl | h := H
+  · exact Sorted.nil
+  · obtain ⟨n, hn⟩ := Option.isSome_iff_exists.1 (Std.TreeMap.isSome_getElem?_eq_contains.trans h)
+    exact (wf _ _ hn).2.2
+
+theorem VarNode.mem_addVar :
+    (∃ x ∈ VarNode.addVar v k l, x.var = u) ↔ v = u ∨ (∃ x ∈ l, x.var = u) := by
+  induction l with simp [addVar] | cons x l ih; split <;> simp_all [or_left_comm]
+
+theorem NormLevel.addVar_wf (hv : v ∈ path) (wf : acc.WF) :
+    (addVar v k path acc).WF := by
+  simp [addVar, WF, Std.TreeMap.getElem?_modify, Std.TreeMap.mem_modify] at wf ⊢
+  intro p n; split <;> [simp; apply wf]
+  subst p; rintro _ h rfl; have ⟨a1, a2, a3⟩ := wf _ _ h
+  refine ⟨fun h => ?_, fun _ h => ?_, a3⟩
+  · have ⟨_, _, b1, b2, b3⟩ := a1 h; exact ⟨_, _, b1, b2, VarNode.mem_addVar.2 (.inr b3)⟩
+  · obtain eq | ⟨_, h, eq⟩ := VarNode.mem_addVar.1 ⟨_, h, rfl⟩
+    · exact eq ▸ hv
+    · exact eq ▸ a2 _ h
+
+theorem NormLevel.addNode_wf (H : Extend1 path v path') (hs : Sorted path')
+    (hacc : path = [] ∨ acc.contains path) (wf : acc.WF) : (addNode v k path' acc).WF := by
+  simp [addNode, WF, Std.TreeMap.getElem?_alter, Std.TreeMap.mem_alter] at *
+  intro p n; split
+  · subst p; split <;> rintro ⟨⟩ <;> simp
+    · exact ⟨fun _ => ⟨_, _, H, hacc.imp id fun h _ => h, rfl⟩, H.mem.2 (.inl rfl), hs⟩
+    · obtain ⟨a1, a2, a3⟩ := wf _ _ ‹_›; refine ⟨fun h => ?_, fun _ h => ?_, a3⟩
+      · have ⟨_, _, b1, b2, b3⟩ := a1 h
+        exact ⟨_, _, b1, b2.imp id fun h _ => h, VarNode.mem_addVar.2 (.inr b3)⟩
+      · obtain eq | ⟨_, h, eq⟩ := VarNode.mem_addVar.1 ⟨_, h, rfl⟩
+        · exact H.mem.2 (.inl eq.symm)
+        · exact eq ▸ a2 _ h
+  · intro h; have ⟨a1, a2, a3⟩ := wf _ _ h; refine ⟨fun h => ?_, a2, a3⟩
+    have ⟨_, _, b1, b2, b3⟩ := a1 h; refine ⟨_, _, b1, ?_, b3⟩
+    split <;> [split <;> simp; exact b2]
+
+/-- `WF` survives an update that only adds keys and preserves each node's variables, provided
+any key it adds is the root, where the parent condition is vacuous. -/
+theorem NormLevel.WF.update {s s' : NormLevel} (wf : s.WF)
+    (hk : ∀ q, s.contains q → s'.contains q)
+    (hv : ∀ p n, s'.get? p = some n →
+      (∃ n₀, s.get? p = some n₀ ∧ n.var = n₀.var) ∨ (p = [] ∧ n.var = [])) : s'.WF := by
+  intro p n hn
+  rcases hv p n hn with ⟨n₀, h₀, hvar⟩ | ⟨rfl, hvar⟩
+  · obtain ⟨a1, a2, a3⟩ := wf _ _ h₀
+    refine ⟨fun h => ?_, fun v hv => a2 v (hvar ▸ hv), a3⟩
+    obtain ⟨v, p', b1, b2, b3⟩ := a1 h
+    exact ⟨v, p', b1, b2.imp id (hk _), hvar ▸ b3⟩
+  · exact ⟨absurd rfl, by simp [hvar], Sorted.nil⟩
+
+theorem NormLevel.addConst_wf (hp : path = [] ∨ acc.contains path) (H : acc.WF) :
+    (addConst k path acc).WF := by
+  simp only [addConst]; split <;> [exact H; skip]
+  refine H.update (fun q hq => ?_) fun p n hn => ?_
+  · rw [Std.TreeMap.contains_alter]; split <;> [split <;> simp; simp [hq]]
+  · rw [Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_alter] at hn
+    split at hn <;> [rename_i hpe; exact .inl ⟨n, hn, rfl⟩]
+    cases eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 hpe)
+    -- `alter` creates a node only at the root, since otherwise `path` is already a key
+    match hpath : acc[path]?, hp with
+    | some n', _ => rw [hpath] at hn; cases hn; exact .inl ⟨n', hpath, rfl⟩
+    | none, .inl hr => rw [hpath] at hn; cases hn; exact .inr ⟨hr, rfl⟩
+    | none, .inr h => simp [Std.TreeMap.mem_iff_isSome_getElem?, hpath] at h
+
+theorem normalizeAux_wf (H : path = [] ∨ acc.contains path) (wf : acc.WF) :
+    (normalizeAux u path k acc).WF := by
+  unfold normalizeAux; split
+  · exact NormLevel.addConst_wf H wf
+  · exact NormLevel.addConst_wf H wf
+  · exact normalizeAux_wf H wf
+  · exact normalizeAux_wf (H.imp id normalizeAux_contains) (normalizeAux_wf H wf)
+  · exact normalizeAux_wf (H.imp id normalizeAux_contains) (normalizeAux_wf H wf)
+  · exact normalizeAux_wf (H.imp id normalizeAux_contains) (normalizeAux_wf H wf)
+  · exact normalizeAux_wf (H.imp id normalizeAux_contains) (normalizeAux_wf H wf)
+  · split <;> rename_i eq <;> [skip; (dsimp; split)]
+    · exact normalizeAux_wf (.inr NormLevel.addNode_contains_self)
+        (NormLevel.addNode_wf (.orderedInsert eq) ((wf.sortedOf H).orderedInsert eq)
+        (H.imp id NormLevel.addConst_contains) (NormLevel.addConst_wf H wf))
+    · exact normalizeAux_wf H wf
+    · refine normalizeAux_wf (H.imp id NormLevel.addVar_contains) (NormLevel.addVar_wf ?_ wf)
+      exact (eq ▸ Extend?.orderedInsert).mem.2 (.inl rfl)
+  · exact wf
+  · exact wf
+  · split <;> rename_i eq <;> [skip; split]
+    · exact NormLevel.addNode_wf (.orderedInsert eq) ((wf.sortedOf H).orderedInsert eq)
+        (H.imp id NormLevel.addConst_contains) (NormLevel.addConst_wf H wf)
+    · exact wf
+    · exact NormLevel.addVar_wf ((eq ▸ Extend?.orderedInsert).mem.2 (.inl rfl)) wf
+
+theorem NormLevel.addConst_eval (H : path = [] ∨ acc.contains path) (wf : acc.WF) :
+    (addConst k path acc).eval ls ρ = max' (acc.eval ls ρ) (evalPath ls ρ path k) := by
+  simp [addConst]; split <;> rename_i h
+  · obtain rfl | ⟨rfl, hne⟩ := h
+    · simp [evalPath]
+    · -- `C(p, 1)` for `p ≠ []` is already dominated: `WF` puts a variable of `p` at `p`,
+      -- and along a nonzero path that variable is at least 1
+      rw [Nat.max_eq_left]; refine evalPath_le.2 fun nz => le_ext_le fun n le => ?_
+      have H := H.resolve_left hne
+      rw [← Std.TreeMap.isSome_getElem?_eq_contains, Option.isSome_iff_exists] at H
+      let ⟨v, H⟩ := H; have ⟨_, _, a1, a2, _, a3, rfl⟩ := (wf _ _ H).1 ‹_›
+      have := (Node.eval_le.1 (evalPath_le.1 (eval_le.1 le _ _ H) nz)).2 _ a3
+      simp [allNZ] at nz
+      exact Nat.le_trans (nz _ (a1.mem.2 (.inl rfl))) (Nat.le_of_add_right_le this)
+  · refine ext_le fun x => ?_
+    simp [eval_le, Nat.max_le, Std.TreeMap.getElem?_alter, evalPath_le, Node.eval_le]
+    refine ⟨fun H => ⟨fun a b h nz => ?_, fun nz => ?_⟩, fun ⟨H1, H2⟩ a b h nz => ?_⟩
+    · have := H a; split at this
+      · subst a; rw [h] at this
+        obtain ⟨hc, hv⟩ := this _ rfl nz
+        exact ⟨Nat.le_trans (Nat.le_max_right ..) hc, hv⟩
+      · exact this _ h nz
+    · have := H path; rw [if_pos rfl] at this; split at this <;>
+        refine Nat.le_trans ?_ ((this _ rfl nz).1)
+      · exact Nat.le_refl _
+      · exact Nat.le_max_left ..
+    · split at h
+      · subst a; split at h <;> cases h <;> [exact ⟨H2 nz, by simp⟩; rename_i n hn]
+        obtain ⟨hc, hv⟩ := H1 _ _ hn nz
+        exact ⟨Nat.max_le.2 ⟨H2 nz, hc⟩, hv⟩
+      · exact H1 _ _ h nz
+
+theorem VarNode.addVar_le : (∀ vn ∈ VarNode.addVar v k l, vn.eval ls ρ ≤ x) ↔
+    evalParam ls ρ v + k ≤ x ∧ (∀ vn ∈ l, vn.eval ls ρ ≤ x) := by
+  simp [eval]; induction l with simp [VarNode.addVar] | cons vn l ih; split <;> simp [*]
+  · simp at *; subst v
+    rw [← and_assoc, ← Nat.max_le, Nat.add_max_add_left, Nat.max_comm, Nat.max_eq_max]
+  · rw [and_left_comm]
+
+theorem NormLevel.addNode_eval : (addNode v k path acc).eval ls ρ =
+    max' (acc.eval ls ρ) (evalPath ls ρ path (evalParam ls ρ v + k)) := by
+  refine ext_le fun x => ?_
+  simp [addNode, eval_le, Std.TreeMap.getElem?_alter, evalPath_le, Node.eval_le, Nat.max_le]
+  refine ⟨fun H => ⟨fun a b h nz => ?_, fun nz => ?_⟩, fun ⟨H1, H2⟩ a b h nz => ?_⟩
+  · have := H a; split at this
+    · subst a; simp_all [VarNode.addVar_le]
+    · exact this _ h nz
+  · have := H path; simp at this; split at this <;> specialize this _ rfl nz
+    · simp_all [VarNode.eval]
+    · simp_all [VarNode.addVar_le]
+  · split at h
+    · subst a; split at h <;> cases h
+      · simp_all [VarNode.eval]
+      · simp_all [VarNode.addVar_le]; grind
+    · grind
+
+theorem NormLevel.addVar_eval (H : acc.contains path) : (addVar v k path acc).eval ls ρ =
+    max' (acc.eval ls ρ) (evalPath ls ρ path (evalParam ls ρ v + k)) := by
+  refine ext_le fun x => ?_
+  rw [← Std.TreeMap.isSome_getElem?_eq_contains, Option.isSome_iff_exists] at H; let ⟨v, H⟩ := H
+  simp [addVar, eval_le, Nat.max_le, Std.TreeMap.getElem?_modify, evalPath_le, Node.eval_le, H]
+  refine ⟨fun H => ⟨fun a b h nz => ?_, fun nz => ?_⟩, fun ⟨H1, H2⟩ a b h nz => ?_⟩
+  · have := H a; split at this
+    · subst a; simp_all [VarNode.addVar_le]
+    · exact this _ h nz
+  · have := H path; simp at this; specialize this nz; simp_all [VarNode.addVar_le]
+  · split at h
+    · subst a; cases h; simp_all [VarNode.addVar_le]; grind
+    · grind
+
+/-- The invariant threaded through `normalizeAux`: the current path is either the root, which
+`addConst` creates on demand, or already a key of the map, created by an earlier `addNode`.
+`addVar` is only reached in the second case, since it runs only when `path` already contains
+the variable being added. -/
+theorem normalizeAux_eval (hu : VLevel.ofLevel ls u = some u')
+    (H : path = [] ∨ acc.contains path) (wf : acc.WF) :
+    (normalizeAux u path k acc).eval ls ρ =
+    max' (acc.eval ls ρ) (evalPath ls ρ path (u'.eval ρ + k)) := by
+  unfold normalizeAux; split
+  · cases hu; simp [NormLevel.addConst_eval H wf, VLevel.eval]
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, rfl⟩ := hu
+    simp [VLevel.eval, Lean.Nat.imax, NormLevel.addConst_eval H wf]
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, rfl⟩ := hu
+    rw [normalizeAux_eval hu H wf, Nat.add_succ, ← Nat.succ_add]; rfl
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, hv, rfl⟩ := hu
+    rw [normalizeAux_eval hv (H.imp id normalizeAux_contains) (normalizeAux_wf H wf),
+      normalizeAux_eval hu H wf, Nat.max_assoc, ← evalPath_max, Nat.add_max_add_right]; rfl
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨_, hv, rfl⟩, rfl⟩ := hu
+    rw [normalizeAux_eval hv (H.imp id normalizeAux_contains) (normalizeAux_wf H wf),
+      normalizeAux_eval hu H wf, Nat.max_assoc, Nat.add_succ, ← Nat.succ_add,
+      ← evalPath_max, Nat.add_max_add_right]; rfl
+  · rename_i u v w
+    simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨_, hv, _, hw, rfl⟩, rfl⟩ := hu
+    rw [normalizeAux_eval (by simpa [VLevel.ofLevel] using ⟨_, hu, _, hw, rfl⟩)
+        (H.imp id normalizeAux_contains) (normalizeAux_wf H wf),
+      normalizeAux_eval (by simpa [VLevel.ofLevel] using ⟨_, hu, _, hv, rfl⟩) H wf,
+      Nat.max_assoc, ← evalPath_max, Nat.add_max_add_right]; simp [VLevel.eval, imax_max]
+  · rename_i u v w
+    simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨_, hv, _, hw, rfl⟩, rfl⟩ := hu
+    rw [normalizeAux_eval (by simpa [VLevel.ofLevel] using ⟨_, hv, _, hw, rfl⟩)
+        (H.imp id normalizeAux_contains) (normalizeAux_wf H wf),
+      normalizeAux_eval (by simpa [VLevel.ofLevel] using ⟨_, hu, _, hw, rfl⟩) H wf,
+      Nat.max_assoc, ← evalPath_max, Nat.add_max_add_right]; simp [VLevel.eval, imax_imax]
+  · rename_i u v
+    simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨hv, rfl⟩, rfl⟩ := hu
+    have := Extend?.orderedInsert (cmp := Name.cmp) (p := path) (v := v)
+    split <;> rename_i h <;> simp [h] at this
+    · rw [normalizeAux_eval hu (.inr NormLevel.addNode_contains_self)
+        (NormLevel.addNode_wf (.orderedInsert h) ((wf.sortedOf H).orderedInsert h)
+          (H.imp id NormLevel.addConst_contains) (NormLevel.addConst_wf H wf)),
+        NormLevel.addNode_eval, NormLevel.addConst_eval H wf, Nat.max_assoc,
+        Nat.max_assoc, ← evalPath_max, this.evalPath, evalPath_cons, ← evalPath_max,
+          Nat.add_max_add_right]; congr 2
+      simp [VLevel.eval, ← evalParam_eq hv, Lean.Nat.imax]
+      cases evalParam .. <;> simp [Nat.max_eq_max, Nat.max_comm]
+    · have hne : path ≠ [] := by rintro rfl; simp [orderedInsert] at h
+      dsimp; split
+      · rw [normalizeAux_eval hu H wf]
+        simp [evalPath]; split <;> [rename_i nz; simp]
+        have hm := this.mem.2 (.inl rfl)
+        obtain ⟨p1, p2, w1, a1, a2, a3, a4, z, a5, rfl⟩ := wf.of_mem hm (H.resolve_left hne)
+        refine ext_le fun n => ?_; simp [Nat.max_le, NormLevel.eval_le]; intro he
+        have := Node.eval_le.1 (evalPath_le.1 (he _ _ a4)
+          (allNZ_mono (fun _ h => (a2.mem.1 h).elim (· ▸ hm) (a1 _)) nz)) |>.2 _ a5
+        simp [allNZ] at nz; specialize nz _ hm
+        simp [VLevel.eval, Lean.Nat.imax]; simp [← evalParam_eq hv, VarNode.eval] at this ⊢
+        revert this nz; cases evalParam .. <;> simp [Nat.max_eq_max]; omega
+      · rw [normalizeAux_eval hu (H.imp id NormLevel.addVar_contains)
+            (NormLevel.addVar_wf (this.mem.2 (.inl rfl)) wf),
+          NormLevel.addVar_eval (H.resolve_left hne), Nat.max_assoc, ← evalPath_max, Nat.add_max_add_right,
+          this.evalPath, evalPath_cons, evalPath_cons]; congr 2
+        split <;> simp [VLevel.eval, Lean.Nat.imax]
+        rename_i h; revert h; simp [← evalParam_eq hv]
+        cases evalParam .. <;> simp [Nat.max_eq_max, Nat.max_comm]
+  · cases hu
+  · simp [VLevel.ofLevel] at hu
+  · rename_i v; simp [VLevel.ofLevel] at hu; obtain ⟨hv, rfl⟩ := hu
+    have := Extend?.orderedInsert (cmp := Name.cmp) (p := path) (v := v)
+    split <;> rename_i h <;> simp [h] at this
+    · rw [NormLevel.addNode_eval, NormLevel.addConst_eval H wf, Nat.max_assoc,
+        this.evalPath, evalPath_cons, ← evalPath_max]
+      simp [VLevel.eval, ← evalParam_eq hv]; congr 2; split <;> simp; omega
+    have hne : path ≠ [] := by rintro rfl; simp [orderedInsert] at h
+    split
+    · simp [evalPath]; split <;> [rename_i nz; simp]
+      have hm := this.mem.2 (.inl rfl)
+      obtain ⟨p1, p2, w1, a1, a2, a3, a4, z, a5, rfl⟩ := wf.of_mem hm (H.resolve_left hne)
+      refine ext_le fun n => ?_; simp [Nat.max_le, NormLevel.eval_le]; intro he
+      have := Node.eval_le.1 (evalPath_le.1 (he _ _ a4)
+        (allNZ_mono (fun _ h => (a2.mem.1 h).elim (· ▸ hm) (a1 _)) nz)) |>.2 _ a5
+      simp [allNZ] at nz; specialize nz _ hm
+      simp [VLevel.eval]; simp [← evalParam_eq hv, VarNode.eval] at this ⊢
+      revert this nz; cases evalParam .. <;> simp; omega
+    · rw [NormLevel.addVar_eval (H.resolve_left hne), this.evalPath, evalPath_cons,
+        evalPath_cons]
+      congr 2; split <;> simp [VLevel.eval, ← evalParam_eq hv]
+
+theorem subset_length (H : subset cmp l₁ l₂) : l₁.length ≤ l₂.length := by
+  induction l₂ generalizing l₁ with | nil => cases l₁ <;> simp_all [subset] | cons y l₂ ih
+  cases l₁ with | nil => simp | cons x l₁
+  simp only [subset] at H; split at H
+  · cases H
+  · have := ih H; simp only [List.length_cons]; omega
+  · have := ih H; simp only [List.length_cons] at this ⊢; omega
+
+theorem subset_mem [BEq α] [LawfulBEq α] [Std.LawfulBEqCmp (α := α) cmp]
+    (H : subset cmp l₁ l₂) (h : a ∈ l₁) : a ∈ l₂ := by
+  induction l₂ generalizing l₁ with | nil => cases l₁ <;> simp_all [subset] | cons y l₂ ih
+  cases l₁ with| nil => cases h | cons x l₁
+  simp only [subset] at H; split at H
+  · cases H
+  · rename_i h'; rw [Std.LawfulBEqCmp.compare_eq_iff_beq] at h'
+    cases eq_of_beq h'
+    rcases List.mem_cons.1 h with rfl | h
+    · exact .head _
+    · exact .tail _ (ih H h)
+  · exact .tail _ (ih H h)
+
+theorem subset_eq [BEq α] [LawfulBEq α] [Std.LawfulBEqCmp (α := α) cmp]
+    (H : subset cmp l₁ l₂) (hl : l₁.length = l₂.length) : l₁ = l₂ := by
+  induction l₂ generalizing l₁ with | nil => cases l₁ <;> simp_all [subset] | cons y l₂ ih
+  cases l₁ with | nil => cases hl | cons x l₁
+  simp only [subset] at H; simp only [List.length_cons] at hl
+  split at H
+  · cases H
+  · rename_i h'; rw [Std.LawfulBEqCmp.compare_eq_iff_beq] at h'
+    cases eq_of_beq h'; rw [ih H (by omega)]
+  · exact absurd (subset_length H) (by simp only [List.length_cons]; omega)
+
+/-- On sorted lists, `subset` decides inclusion. -/
+theorem subset_of_sorted (h₁ : Sorted l₁) (h₂ : Sorted l₂) (h : ∀ x ∈ l₁, x ∈ l₂) :
+    subset compare l₁ l₂ := by
+  induction l₂ generalizing l₁ with
+  | nil => cases l₁ with | nil => rfl | cons x l₁ => cases h x (.head _)
+  | cons y l₂ ih
+  cases l₁ with | nil => rfl | cons x l₁
+  simp only [subset]
+  have hxy := h x (.head _)
+  split <;> rename_i hc
+  · -- `x < y` is impossible: `x` is in `y :: l₂`, whose elements are all `≥ y`
+    obtain rfl | hx := List.mem_cons.1 hxy
+    · rw [Std.ReflOrd.compare_self] at hc; cases hc
+    · exact absurd (h₂.head _ hx) (by rw [Std.OrientedCmp.gt_of_lt hc]; simp)
+  · rw [Std.LawfulBEqCmp.compare_eq_iff_beq] at hc
+    cases eq_of_beq hc
+    refine ih h₁.of_cons h₂.of_cons fun z hz => ?_
+    obtain rfl | hz' := List.mem_cons.1 (h z (.tail _ hz))
+    · exact absurd (h₁.head _ hz) (by rw [Std.ReflOrd.compare_self]; simp)
+    · exact hz'
+  · refine ih h₁ h₂.of_cons fun z hz => ?_
+    obtain rfl | hz' := List.mem_cons.1 (h z hz)
+    · obtain rfl | hz := List.mem_cons.1 hz
+      · exact absurd hc (by rw [Std.ReflOrd.compare_self]; simp)
+      · exact absurd (h₁.head _ hz) (by
+          rw [Std.OrientedCmp.gt_of_lt (Std.OrientedCmp.lt_of_gt hc)]; simp)
+    · exact hz'
+
+theorem subsumeVars_subset (h : x ∈ subsumeVars vs₁ vs₂) : x ∈ vs₁ := by
+  induction vs₁ generalizing vs₂ with | nil => simp_all [subsumeVars] | cons a vs₁ ih
+  induction vs₂ with | nil => simp_all [subsumeVars] | cons b vs₂ ih₂
+  simp only [subsumeVars] at h; split at h
+  · obtain rfl | h := List.mem_cons.1 h
+    · exact .head _
+    · exact .tail _ (ih h)
+  · split at h <;> [exact .tail _ (ih h); skip]
+    obtain rfl | h := List.mem_cons.1 h
+    · exact .head _
+    · exact .tail _ (ih h)
+  · exact ih₂ h
+
+theorem subsumeVars_dominated (h₁ : x ∈ vs₁) (h₂ : x ∉ subsumeVars vs₁ vs₂) :
+    ∃ y ∈ vs₂, y.var = x.var ∧ x.offset ≤ y.offset := by
+  induction vs₁ generalizing vs₂ with | nil => cases h₁ | cons a vs₁ ih
+  induction vs₂ with | nil => exact absurd h₁ (by simpa [subsumeVars] using h₂) | cons b vs₂ ih₂
+  simp only [subsumeVars] at h₂; split at h₂
+  · obtain rfl | h₁ := List.mem_cons.1 h₁
+    · cases h₂ (.head _)
+    · have ⟨y, hy, e, le⟩ := ih h₁ fun h => h₂ (.tail _ h)
+      exact ⟨y, hy, e, le⟩
+  · rename_i heq; split at h₂
+    · obtain rfl | h₁ :=  List.mem_cons.1 h₁
+      · rw [Std.LawfulBEqCmp.compare_eq_iff_beq] at heq
+        exact ⟨b, .head _, (eq_of_beq heq).symm, ‹_›⟩
+      · have ⟨y, hy, e, le⟩ := ih h₁ h₂
+        exact ⟨y, .tail _ hy, e, le⟩
+    · obtain rfl | h₁ :=  List.mem_cons.1 h₁
+      · cases h₂ (.head _)
+      · have ⟨y, hy, e, le⟩ := ih h₁ fun h => h₂ (.tail _ h)
+        exact ⟨y, .tail _ hy, e, le⟩
+  · have ⟨y, hy, e, le⟩ := ih₂ h₂
+    exact ⟨y, .tail _ hy, e, le⟩
+
+theorem le_foldl_max {vs : List VarNode}
+    (h : c ≤ vs.foldl (·.max ·.offset) n + 1) : c ≤ n + 1 ∨ ∃ y ∈ vs, c ≤ y.offset + 1 := by
+  induction vs generalizing n with | nil => exact .inl h | cons x vs ih
+  obtain h | ⟨y, hy, h⟩ := ih h
+  · refine (Nat.le_total x.offset n).imp (fun h' => ?_) (fun h' => ⟨x, .head _, ?_⟩)
+    · simp [Nat.max_eq_left h'] at h; omega
+    · simp [Nat.max_eq_right h'] at h; omega
+  · exact .inr ⟨y, .tail _ hy, h⟩
+
+theorem Node.const_le_eval {l : Node} : l.const ≤ Node.eval ls ρ l :=
+  (Node.eval_le.1 (Nat.le_refl _)).1
+
+theorem Node.var_le_eval {l : Node} (h : x ∈ l.var) :
+    VarNode.eval ls ρ x ≤ Node.eval ls ρ l :=
+  (Node.eval_le.1 (Nat.le_refl _)).2 _ h
+
+theorem Node.eval_empty {l : Node} (H : l.isEmpty) : Node.eval ls ρ l = 0 := by
+  simp [Node.isEmpty] at H; simp [eval, H.1, H.2]
+
+theorem NormLevel.eval_filter {m : NormLevel} :
+    NormLevel.eval ls ρ (m.filter fun _ n => !n.isEmpty) = m.eval ls ρ := by
+  refine ext_le fun x => ?_
+  simp only [eval_le, Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_filter]
+  refine ⟨fun H a b h => ?_, fun H a b h => ?_⟩
+  · by_cases he : b.isEmpty
+    · simp [evalPath_le, Node.eval_empty he]
+    · exact H a b (by simp [h, he])
+  · exact H _ _ (Option.eq_some_of_pfilter_eq_some h)
+
+theorem subsumeVars_eval (H : ∀ v ∈ vs₂, VarNode.eval ls ρ v ≤ n) :
+    (∀ v ∈ subsumeVars vs₁ vs₂, VarNode.eval ls ρ v ≤ n) ↔
+    ∀ v ∈ vs₁, VarNode.eval ls ρ v ≤ n := by
+  refine ⟨fun h v hv => ?_, fun h v hv => h _ (subsumeVars_subset hv)⟩
+  by_cases hs : v ∈ subsumeVars vs₁ vs₂ <;> [exact h _ hs; skip]
+  have ⟨y, hy, e, le⟩ := subsumeVars_dominated hv hs
+  exact Nat.le_trans (by simp [VarNode.eval, e]; omega) (H _ hy)
+
+theorem Node.subsumeBy_const_eq {same : Bool} {n₁ n₂ : Node} :
+    (n₁.subsumeBy same n₂).const =
+    if n₁.const = 0 ||
+      (same || n₁.const > n₂.const) &&
+      (n₂.var.isEmpty || n₁.const > n₂.var.foldl (·.max ·.offset) 0 + 1)
+    then n₁.const else 0 := by
+  simp only [Node.subsumeBy]; split <;> split <;> rfl
+
+theorem Node.subsumeBy_var_eq {same : Bool} {n₁ n₂ : Node} :
+    (n₁.subsumeBy same n₂).var =
+    if same || n₂.var.isEmpty then n₁.var else subsumeVars n₁.var n₂.var := by
+  simp only [Node.subsumeBy]; split <;> split <;> simp
+
+theorem Node.subsumeBy_var_subset {same : Bool}
+    (h : x ∈ (Node.subsumeBy same n₁ n₂).var) : x ∈ n₁.var := by
+  rw [Node.subsumeBy_var_eq] at h; split at h <;> [exact h; exact subsumeVars_subset h]
+
+theorem Node.subsumeBy_const_cases {same : Bool} (n₁ n₂ : Node) :
+    (n₁.subsumeBy same n₂).const = n₁.const ∨ (n₁.subsumeBy same n₂).const = 0 := by
+  rw [Node.subsumeBy_const_eq]; split <;> [exact .inl rfl; exact .inr rfl]
+
+theorem Node.subsumeBy_eval_le {same : Bool} :
+    Node.eval ls ρ (n₁.subsumeBy same n₂) ≤ Node.eval ls ρ n₁ := by
+  refine Node.eval_le.2 ⟨?_, fun v h => Node.var_le_eval (Node.subsumeBy_var_subset h)⟩
+  obtain h | h := Node.subsumeBy_const_cases (same := same) n₁ n₂
+  · exact h ▸ Node.const_le_eval
+  · simp [h]
+
+/-- If `subsumeBy` dropped the constant, the drop was justified: the constant is dominated
+by the constant of `n₂` (only possible when the two keys differ), or by a variable of `n₂`. -/
+theorem Node.subsumeBy_const_drop {same : Bool}
+    (h : (Node.subsumeBy same n₁ n₂).const ≠ n₁.const) :
+    same = false ∧ n₁.const ≤ n₂.const ∨ ∃ y ∈ n₂.var, n₁.const ≤ y.offset + 1 := by
+  rw [Node.subsumeBy_const_eq] at h
+  split at h <;> [cases h rfl; rename_i hc]
+  rw [Bool.or_eq_true, not_or] at hc
+  obtain ⟨-, hc⟩ := hc
+  rw [Bool.and_eq_true, Decidable.not_and_iff_not_or_not] at hc
+  obtain hc | hc := hc <;> rw [Bool.or_eq_true, not_or] at hc <;> obtain ⟨h1, h2⟩ := hc
+  · exact .inl ⟨by simpa using h1, by simpa [Nat.not_lt] using h2⟩
+  · have hne : n₂.var ≠ [] := fun e => h1 (by simp [e])
+    have h2 : n₁.const ≤ n₂.var.foldl (·.max ·.offset) 0 + 1 := by
+      simpa [Nat.not_lt] using h2
+    obtain h | h := le_foldl_max (c := n₁.const) (n := 0) h2
+    · obtain ⟨y, hy⟩ := List.exists_mem_of_ne_nil _ hne
+      exact .inr ⟨y, hy, by omega⟩
+    · exact .inr h
+
+/-- The domination step is exact against a node bounded by `m`: everything `subsumeBy`
+drops from `n₁` is dominated by a sublevel of `n₂`, and `n₂` evaluates to at most `m`.
+Domination of the constant by a variable needs that variable to evaluate to at least its
+offset plus one, which is why the condition set must be all-nonzero (`hnz`). -/
+theorem Node.subsumeBy_eval_iff {same : Bool} {n₁ n₂ : Node} {m : Nat}
+    (hnz : ∀ v ∈ n₂.var, 0 < evalParam ls ρ v.var) (h₂ : Node.eval ls ρ n₂ ≤ m) :
+    Node.eval ls ρ (n₁.subsumeBy same n₂) ≤ m ↔ Node.eval ls ρ n₁ ≤ m := by
+  have hvar₂ v (hv : v ∈ n₂.var) : VarNode.eval ls ρ v ≤ m :=
+    Nat.le_trans (Node.var_le_eval hv) h₂
+  refine ⟨fun h => ?_, fun h => Nat.le_trans Node.subsumeBy_eval_le h⟩
+  rw [Node.eval_le] at h ⊢
+  refine ⟨?_, fun x hx => ?_⟩
+  · by_cases hc : (n₁.subsumeBy same n₂).const = n₁.const
+    · exact hc ▸ h.1
+    obtain ⟨-, hle⟩ | ⟨y, hy, hle⟩ := Node.subsumeBy_const_drop hc
+    · exact Nat.le_trans hle (Nat.le_trans Node.const_le_eval h₂)
+    · refine Nat.le_trans ?_ (hvar₂ _ hy)
+      have := hnz _ hy; simp only [VarNode.eval]; omega
+  · rw [Node.subsumeBy_var_eq] at h
+    split at h
+    · exact h.2 _ hx
+    · exact (subsumeVars_eval hvar₂).1 h.2 _ hx
+
+theorem Node.subsume_const_eq : (Node.subsume p₁ n₁ p₂ n₂).const =
+    if !subset compare p₂ p₁ ||
+      (n₁.const = 0 ||
+      (p₁.length == p₂.length || n₁.const > n₂.const) &&
+      (n₂.var.isEmpty || n₁.const > n₂.var.foldl (·.max ·.offset) 0 + 1))
+    then n₁.const else 0 := by
+  simp only [Node.subsume]
+  cases hs : subset compare p₂ p₁ <;>
+    simp only [reduceIte, Bool.not_true, Bool.not_false, Bool.false_or, Bool.true_or]
+  · rfl
+  · exact subsumeBy_const_eq
+
+theorem Node.subsume_var_eq : (Node.subsume p₁ n₁ p₂ n₂).var =
+    if !subset compare p₂ p₁ || (p₁.length == p₂.length || n₂.var.isEmpty)
+    then n₁.var else subsumeVars n₁.var n₂.var := by
+  simp only [Node.subsume]
+  cases hs : subset compare p₂ p₁ <;>
+    simp only [reduceIte, Bool.not_true, Bool.not_false, Bool.false_or, Bool.true_or]
+  · rfl
+  · exact subsumeBy_var_eq
+
+theorem Node.subsume_var_subset (h : x ∈ (Node.subsume p₁ n₁ p₂ n₂).var) : x ∈ n₁.var := by
+  rw [Node.subsume] at h; split at h <;> [exact subsumeBy_var_subset h; exact h]
+
+theorem Node.subsume_const_cases (p₁ n₁ p₂ n₂) :
+    (Node.subsume p₁ n₁ p₂ n₂).const = n₁.const ∨ (Node.subsume p₁ n₁ p₂ n₂).const = 0 := by
+  rw [Node.subsume]; split <;> [exact subsumeBy_const_cases ..; exact .inl rfl]
+
+theorem Node.subsume_eval_le :
+    Node.eval ls ρ (Node.subsume p₁ n₁ p₂ n₂) ≤ Node.eval ls ρ n₁ := by
+  rw [Node.subsume]; split <;> [exact subsumeBy_eval_le; exact Nat.le_refl _]
+
+/-- If `subsume` dropped the constant, the drop was justified: the constant is dominated
+by the constant of `n₂` at a strictly smaller key, or by a variable of `n₂`. -/
+theorem Node.subsume_const_drop (h : (Node.subsume p₁ n₁ p₂ n₂).const ≠ n₁.const) :
+    subset compare p₂ p₁ ∧
+    (p₁.length ≠ p₂.length ∧ n₁.const ≤ n₂.const ∨ ∃ y ∈ n₂.var, n₁.const ≤ y.offset + 1) := by
+  rw [Node.subsume] at h
+  split at h <;> [skip; cases h rfl]
+  refine ⟨‹_›, (subsumeBy_const_drop h).imp_left fun ⟨he, hc⟩ => ⟨fun e => ?_, hc⟩⟩
+  simp [e] at he
+
+/-- If `subsume` changed the variable list, the change was `subsumeVars` against the
+variables of `n₂` at a strictly smaller key. -/
+theorem Node.subsume_var_cases (p₁ n₁ p₂ n₂) :
+    (Node.subsume p₁ n₁ p₂ n₂).var = n₁.var ∨
+    (subset compare p₂ p₁ ∧ p₁.length ≠ p₂.length ∧
+     (Node.subsume p₁ n₁ p₂ n₂).var = subsumeVars n₁.var n₂.var) := by
+  rw [Node.subsume_var_eq]; split
+  · exact .inl rfl
+  · rename_i hc
+    rw [Bool.or_eq_true, Bool.or_eq_true, not_or, not_or] at hc
+    obtain ⟨hs, hlen, -⟩ := hc
+    have hsub : subset compare p₂ p₁ := by revert hs; cases subset compare p₂ p₁ <;> simp
+    exact .inr ⟨hsub, fun e => hlen (by simp [e]), rfl⟩
+
+theorem NormLevel.minimize_var_subset {acc : NormLevel}
+    (h : x ∈ (acc.minimize p₁ n₁).var) : x ∈ n₁.var := by
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList] at h
+  generalize acc.toList = l at h
+  induction l generalizing n₁ with | nil => exact h | cons a l ih
+  exact Node.subsume_var_subset (ih h)
+
+theorem NormLevel.minimize_eval_le {acc : NormLevel} :
+    Node.eval ls ρ (acc.minimize p₁ n₁) ≤ n₁.eval ls ρ := by
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList]
+  generalize acc.toList = l
+  induction l generalizing n₁ with | nil => exact Nat.le_refl _ | cons a l ih
+  exact Nat.le_trans (ih (n₁ := Node.subsume p₁ n₁ a.1 a.2)) Node.subsume_eval_le
+
+/-- Minimizing a node against the rest of the map preserves its contribution to the total,
+assuming every other entry's contribution is already bounded by `m`. -/
+theorem NormLevel.minimize_eval_iff {acc : NormLevel} {p₁ : List Name} {n₁ : Node} {m : Nat}
+    (wfa : ∀ p n, acc.get? p = some n → ∀ v ∈ n.var, v.var ∈ p)
+    (h₁ : acc.get? p₁ = some n₁)
+    (hacc : ∀ p n, p ≠ p₁ → acc.get? p = some n → evalPath ls ρ p (Node.eval ls ρ n) ≤ m)
+    (nz : allNZ ls ρ p₁) :
+    Node.eval ls ρ (acc.minimize p₁ n₁) ≤ m ↔ Node.eval ls ρ n₁ ≤ m := by
+  have wf₁ := wfa _ _ h₁
+  have evalq p₂ n₂ (hne : p₂ ≠ p₁) (h₂ : acc.get? p₂ = some n₂) (hsub : subset compare p₂ p₁) :
+      Node.eval ls ρ n₂ ≤ m := by
+    have := hacc _ _ hne h₂
+    rw [evalPath_le] at this
+    exact this (allNZ_mono (fun _ h => subset_mem hsub h) nz)
+  -- a variable dominated at a different key of the map is bounded by `m`
+  have domle (x : VarNode) : (∃ p₂ n₂ y, p₂ ≠ p₁ ∧ acc.get? p₂ = some n₂ ∧
+      subset compare p₂ p₁ ∧ y ∈ n₂.var ∧ y.var = x.var ∧ x.offset ≤ y.offset) →
+      VarNode.eval ls ρ x ≤ m := fun ⟨p₂, n₂, y, hne, h₂, hsub, hy, e, le⟩ => by
+    refine Nat.le_trans ?_ (Nat.le_trans (Node.var_le_eval hy) (evalq _ _ hne h₂ hsub))
+    simp only [VarNode.eval, ← e]; omega
+  refine ⟨fun hf => ?_, fun h => Nat.le_trans minimize_eval_le h⟩
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList] at hf
+  have hmem pn (h : pn ∈ acc.toList) : acc.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  generalize acc.toList = l at hf hmem
+  -- fold invariant: vars of the current node come from `n₁`; the constant is intact or
+  -- justifiably dropped; every original variable is dominated by a current one or elsewhere
+  suffices ∀ n1, (∀ x ∈ n1.var, x ∈ n₁.var) →
+      (n1.const = n₁.const ∨ (n1.const = 0 ∧
+        ((∃ y ∈ n₁.var, n₁.const ≤ y.offset + 1) ∨
+         ∃ p₂ n₂, p₂ ≠ p₁ ∧ acc.get? p₂ = some n₂ ∧ subset compare p₂ p₁ ∧
+           n₁.const ≤ Node.eval ls ρ n₂))) →
+      (∀ x ∈ n₁.var, (∃ y ∈ n1.var, y.var = x.var ∧ x.offset ≤ y.offset) ∨
+        ∃ p₂ n₂ y, p₂ ≠ p₁ ∧ acc.get? p₂ = some n₂ ∧ subset compare p₂ p₁ ∧
+          y ∈ n₂.var ∧ y.var = x.var ∧ x.offset ≤ y.offset) →
+      Node.eval ls ρ (List.foldl (fun n1 pn => Node.subsume p₁ n1 pn.1 pn.2) n1 l) ≤ m →
+      Node.eval ls ρ n₁ ≤ m from
+    this n₁ (fun _ => id) (.inl rfl) (fun x h => .inl ⟨x, h, rfl, Nat.le_refl _⟩) hf
+  clear hf
+  induction l with intro n1 hL hK hJ hf
+  | nil =>
+    refine Node.eval_le.2 ⟨?_, fun x hx => ?_⟩
+    · obtain hK | ⟨-, hK | ⟨p₂, n₂, hne, h₂, hsub, hc⟩⟩ := hK
+      · exact Nat.le_trans (hK ▸ Node.const_le_eval) hf
+      · obtain ⟨y, hy, hc⟩ := hK
+        obtain ⟨y', hy', e, le⟩ | hd := hJ _ hy
+        · refine Nat.le_trans ?_ (Nat.le_trans (Node.var_le_eval hy') hf)
+          have : 0 < evalParam ls ρ y'.var := by
+            simp [allNZ] at nz; exact nz _ (wf₁ _ (hL _ hy'))
+          simp only [VarNode.eval]; omega
+        · refine Nat.le_trans ?_ (domle _ hd)
+          obtain ⟨p₂, n₂, y', hne, h₂, hsub, hy', e, le⟩ := hd
+          have : 0 < evalParam ls ρ y'.var := by
+            simp [allNZ] at nz; exact nz _ (subset_mem hsub (wfa _ _ h₂ _ hy'))
+          simp only [VarNode.eval, ← e]; omega
+      · exact Nat.le_trans hc (evalq _ _ hne h₂ hsub)
+    · obtain ⟨y, hy, e, le⟩ | hd := hJ _ hx
+      · refine Nat.le_trans ?_ (Nat.le_trans (Node.var_le_eval hy) hf)
+        simp only [VarNode.eval, ← e]; omega
+      · exact domle _ hd
+  | cons pn l ih =>
+    simp only [List.mem_cons, forall_eq_or_imp] at hmem
+    obtain ⟨h₂, hmem'⟩ := hmem
+    refine ih hmem' _ (fun x h => hL _ (Node.subsume_var_subset h)) ?_ (fun x hx => ?_) hf
+    · by_cases hc : (Node.subsume p₁ n1 pn.1 pn.2).const = n1.const
+      · rw [hc]; exact hK
+      obtain ⟨hsub, hd⟩ := Node.subsume_const_drop hc
+      obtain heq | hzero := Node.subsume_const_cases p₁ n1 pn.1 pn.2
+      · cases hc heq
+      have hc1 : n1.const = n₁.const := by
+        rcases hK with h | ⟨h, -⟩
+        · exact h
+        · cases hc (hzero.trans h.symm)
+      refine .inr ⟨hzero, ?_⟩
+      by_cases hpe : pn.1 = p₁
+      · subst hpe
+        have : pn.2 = n₁ := by cases h₁.symm.trans h₂; rfl
+        subst this
+        obtain ⟨hne', -⟩ | ⟨y, hy, hle⟩ := hd
+        · exact absurd rfl hne'
+        · exact .inl ⟨y, hy, hc1 ▸ hle⟩
+      · refine .inr ⟨pn.1, pn.2, hpe, h₂, hsub, ?_⟩
+        obtain ⟨-, hle⟩ | ⟨y, hy, hle⟩ := hd
+        · exact hc1 ▸ Nat.le_trans hle Node.const_le_eval
+        · refine hc1 ▸ Nat.le_trans hle ?_
+          have : 0 < evalParam ls ρ y.var := by
+            simp [allNZ] at nz
+            exact nz _ (subset_mem hsub (wfa _ _ h₂ _ hy))
+          refine Nat.le_trans ?_ (Node.var_le_eval hy)
+          simp only [VarNode.eval]; omega
+    · obtain ⟨y, hy, e, le⟩ | hd := hJ _ hx <;> [skip; exact .inr hd]
+      obtain hv | ⟨hsub, hlen, hv⟩ := Node.subsume_var_cases p₁ n1 pn.1 pn.2
+      · exact .inl ⟨y, hv ▸ hy, e, le⟩
+      by_cases hy' : y ∈ (Node.subsume p₁ n1 pn.1 pn.2).var
+      · exact .inl ⟨y, hy', e, le⟩
+      obtain ⟨z, hz, ez, lez⟩ := subsumeVars_dominated hy (hv ▸ hy')
+      have hpe : pn.1 ≠ p₁ := fun h => hlen (h ▸ rfl)
+      exact .inr ⟨pn.1, pn.2, z, hpe, h₂, hsub, hz, ez.trans e, Nat.le_trans le lez⟩
+
+/-- One step of `subsumption`: the key being minimized is updated, or erased if it drained,
+and no other key changes. -/
+theorem NormLevel.subsumption_step_get? (acc : NormLevel) (n₁ : Node) (p₁ p : List Name) :
+    (if (acc.minimize p₁ n₁).isEmpty then acc.erase p₁
+     else acc.insert p₁ (acc.minimize p₁ n₁)).get? p =
+    if p₁ = p then (if (acc.minimize p₁ n₁).isEmpty then none else some (acc.minimize p₁ n₁))
+    else acc.get? p := by
+  split <;>
+    simp only [Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_erase,
+      Std.TreeMap.getElem?_insert] <;>
+    split <;> split <;> simp_all
+
+/-- `subsumption` only shrinks the variable lists, at unchanged keys, so it preserves the
+half of `WF` saying that every variable recorded at a key is an element of it. -/
+theorem NormLevel.subsumption_vars {s : NormLevel} (wf : s.WF) :
+    ∀ p n, s.subsumption.get? p = some n → (∀ v ∈ n.var, v.var ∈ p) ∧ Sorted p := by
+  rw [subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  have hmem pn (h : pn ∈ s.toList) : s.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  generalize s.toList = l at hmem
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (∀ pn ∈ l, s.get? pn.1 = some pn.2) →
+      (∀ p n, acc.get? p = some n → (∀ v ∈ n.var, v.var ∈ p) ∧ Sorted p) →
+      ∀ p n, (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).get? p = some n →
+        (∀ v ∈ n.var, v.var ∈ p) ∧ Sorted p from this _ _ hmem fun p n h => (wf p n h).2
+  clear hmem; intro l
+  induction l with | nil => exact fun _ _ => id | cons pn l ih
+  intro acc hl hacc
+  refine ih _ (fun _ h => hl _ (.tail _ h)) fun p n h => ?_
+  rw [subsumption_step_get?] at h
+  split at h
+  · split at h <;> [cases h; skip]
+    cases h; rename_i hp _; subst hp
+    have := (wf _ _ (hl _ (.head _))).2
+    exact ⟨fun v hv => this.1 _ (minimize_var_subset hv), this.2⟩
+  · exact hacc _ _ h
+
+/-- A variable that minimization drops is dropped in favour of one with the same name at a
+strictly smaller key. -/
+theorem NormLevel.minimize_var_dominated {acc : NormLevel} {p₁ n₁ x}
+    (hx : x ∈ n₁.var) (h : x ∉ (acc.minimize p₁ n₁).var) :
+    ∃ p₂ n₂ y, acc.get? p₂ = some n₂ ∧ y ∈ n₂.var ∧ y.var = x.var ∧
+      p₂ ≠ p₁ ∧ ∀ z ∈ p₂, z ∈ p₁ := by
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList] at h
+  have hmem pn (h : pn ∈ acc.toList) : acc.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  generalize acc.toList = l at h hmem
+  suffices ∀ (l : List (List Name × Node)) (n : Node),
+      (∀ pn ∈ l, acc.get? pn.1 = some pn.2) → x ∈ n.var →
+      x ∉ (List.foldl (fun n pn => Node.subsume p₁ n pn.1 pn.2) n l).var →
+      ∃ p₂ n₂ y, acc.get? p₂ = some n₂ ∧ y ∈ n₂.var ∧ y.var = x.var ∧
+        p₂ ≠ p₁ ∧ ∀ z ∈ p₂, z ∈ p₁ from this _ _ hmem hx h
+  clear hx h hmem; intro l
+  induction l with
+  | nil => exact fun n _ hx h => absurd hx h
+  | cons pn l ih =>
+    intro n hl hx h
+    by_cases hx' : x ∈ (Node.subsume p₁ n pn.1 pn.2).var
+    · exact ih _ (fun _ h => hl _ (.tail _ h)) hx' h
+    · obtain heq | ⟨hsub, hlen, heq⟩ := Node.subsume_var_cases p₁ n pn.1 pn.2
+      · rw [heq] at hx'; exact absurd hx hx'
+      · rw [heq] at hx'
+        obtain ⟨y, hy, e, -⟩ := subsumeVars_dominated hx hx'
+        exact ⟨pn.1, pn.2, y, hl _ (.head _), hy, e,
+          fun he => hlen (by rw [he]), fun _ hz => subset_mem hsub hz⟩
+
+/-- `s'` covers `s`: every variable recorded in `s` is still recorded in `s'`, at a subset of
+its key. This is all of a map that `Dom`, hence `Feas`, looks at. -/
+def NormLevel.Covers (s' s : NormLevel) : Prop :=
+  ∀ p n x, s.get? p = some n → x ∈ n.var →
+    ∃ q m y, s'.get? q = some m ∧ y ∈ m.var ∧ y.var = x.var ∧ ∀ z ∈ q, z ∈ p
+
+/-- `subsumption` only removes variables from a node, and never the last witness for a name:
+a removed one is still recorded at a strictly smaller key, possibly after further removals
+there. So the subsumed map covers the original, and its entries are entries of it. -/
+theorem NormLevel.subsumption_covers {s : NormLevel} :
+    (∀ p n, s.subsumption.get? p = some n →
+      ∃ n₀, s.get? p = some n₀ ∧ ∀ x ∈ n.var, x ∈ n₀.var) ∧ s.subsumption.Covers s := by
+  rw [subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  have hmem pn (h : pn ∈ s.toList) : s.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  generalize s.toList = l at hmem
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (∀ pn ∈ l, s.get? pn.1 = some pn.2) →
+      (∀ p n, acc.get? p = some n → ∃ n₀, s.get? p = some n₀ ∧ ∀ x ∈ n.var, x ∈ n₀.var) →
+      acc.Covers s →
+      (∀ p n, (List.foldl (fun acc pn =>
+          let n := acc.minimize pn.1 pn.2
+          if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).get? p = some n →
+        ∃ n₀, s.get? p = some n₀ ∧ ∀ x ∈ n.var, x ∈ n₀.var) ∧
+      (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).Covers s from
+    this _ _ hmem (fun p n h => ⟨n, h, fun _ => id⟩)
+      (fun p n x h hx => ⟨p, n, x, h, hx, rfl, fun _ => id⟩)
+  clear hmem; intro l
+  induction l with | nil => exact fun _ _ h1 h2 => ⟨h1, h2⟩ | cons pn l ih
+  obtain ⟨p₁, n₁⟩ := pn
+  intro acc hl hsub hcov
+  have h₁ : s.get? p₁ = some n₁ := hl _ (.head _)
+  refine ih _ (fun _ h => hl _ (.tail _ h)) (fun p n h => ?_) (fun p n x hp hx => ?_)
+  · rw [subsumption_step_get?] at h
+    split at h
+    · split at h <;> [cases h; skip]
+      cases h; rename_i hp _; subst hp
+      exact ⟨n₁, h₁, fun x hx => minimize_var_subset hx⟩
+    · exact hsub _ _ h
+  · obtain ⟨q, m, y, hq, hy, e, hqp⟩ := hcov _ _ _ hp hx
+    by_cases hqp₁ : q = p₁
+    · subst hqp₁
+      -- the write lands on the key covering `x`: either the variable survives it, or it is
+      -- dominated at a smaller key, which this step leaves alone
+      obtain ⟨n₀, h₀, hy₀⟩ := hsub _ _ hq
+      cases h₀.symm.trans h₁
+      by_cases hmin : y ∈ (acc.minimize q n₁).var
+      · refine ⟨q, _, y, ?_, hmin, e, hqp⟩
+        rw [subsumption_step_get?, if_pos rfl, if_neg]
+        simp only [Node.isEmpty, Bool.and_eq_true, List.isEmpty_iff, not_and]
+        rintro - he; simp [he] at hmin
+      · obtain ⟨p₂, n₂, z, h₂, hz, e₂, hne, hp₂⟩ := minimize_var_dominated (hy₀ _ hy) hmin
+        exact ⟨p₂, n₂, z, by rw [subsumption_step_get?, if_neg (Ne.symm hne)]; exact h₂,
+          hz, e₂.trans e, fun w hw => hqp _ (hp₂ _ hw)⟩
+    · exact ⟨q, m, y, by rw [subsumption_step_get?, if_neg (Ne.symm hqp₁)]; exact hq,
+        hy, e, hqp⟩
+
+theorem NormLevel.subsumption_eval {s : NormLevel} (wf : s.WF) :
+    s.subsumption.eval ls ρ = s.eval ls ρ := by
+  rw [subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  have hmem pn (h : pn ∈ s.toList) : s.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  have nd : (s.toList.map Prod.fst).Nodup := by simpa using Std.TreeMap.nodup_keys (t := s)
+  generalize s.toList = l at hmem nd
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (l.map Prod.fst).Nodup →
+      (∀ p n, (p, n) ∈ l → acc.get? p = some n) →
+      (∀ p n, acc.get? p = some n → ∀ v ∈ n.var, v.var ∈ p) →
+      eval ls ρ acc = eval ls ρ s →
+      eval ls ρ (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l) = eval ls ρ s from
+    this _ _ nd (fun _ _ => hmem _) (fun _ _ h => (wf _ _ h).2.1) rfl
+  clear hmem nd; intro l
+  induction l with | nil => exact fun acc _ _ _ eq => eq | cons pn l ih
+  have ⟨p₁, n₁⟩ := pn; intro acc nd hl wfa eq
+  simp only [List.map_cons, List.nodup_cons] at nd
+  have h₁ := hl _ _ (.head _)
+  -- a drained key is erased rather than kept, which is the same for `eval`
+  have hins := subsumption_step_get? acc n₁ p₁
+  have hmin_le m
+      (H : ∀ a b, (if (acc.minimize p₁ n₁).isEmpty then acc.erase p₁
+        else acc.insert p₁ (acc.minimize p₁ n₁)).get? a = some b →
+        evalPath ls ρ a (Node.eval ls ρ b) ≤ m)
+      (nz : allNZ ls ρ p₁) : Node.eval ls ρ (acc.minimize p₁ n₁) ≤ m := by
+    by_cases he : (acc.minimize p₁ n₁).isEmpty
+    · simp [Node.isEmpty, List.isEmpty_iff] at he; simp [Node.eval, he.1, he.2]
+    · have hget : (if (acc.minimize p₁ n₁).isEmpty then acc.erase p₁
+          else acc.insert p₁ (acc.minimize p₁ n₁)).get? p₁ = some (acc.minimize p₁ n₁) := by
+        rw [hins p₁, if_pos rfl, if_neg he]
+      have := H _ _ hget
+      rw [evalPath_le] at this; exact this nz
+  refine ih _ nd.2 (fun p n h => ?_) (fun p n h v hv => ?_) ((ext_le fun m => ?_).trans eq)
+  · have hne : p₁ ≠ p := fun e => nd.1 (by rw [e]; exact List.mem_map_of_mem h)
+    exact (hins p).trans (if_neg hne) ▸ hl _ _ (.tail _ h)
+  · rw [hins p] at h; split at h
+    · split at h <;> [cases h; skip]
+      cases h; rename_i hp _; subst hp
+      exact wfa _ _ h₁ _ (minimize_var_subset hv)
+    · exact wfa _ _ h _ hv
+  · simp only [eval_le]; constructor <;> intro H p n h
+    · by_cases hp : p = p₁
+      · subst hp; cases h₁.symm.trans h
+        refine evalPath_le.2 fun nz => ?_
+        refine (minimize_eval_iff wfa h₁ (fun q nq hne hq => ?_) nz).1 (hmin_le _ H nz)
+        exact H _ _ ((hins q).trans (if_neg hne.symm) ▸ hq)
+      · exact H p n ((hins p).trans (if_neg (Ne.symm hp)) ▸ h)
+    · rw [hins p] at h; split at h <;> [skip; exact H _ _ h]
+      split at h <;> [cases h; skip]
+      cases h; rename_i hp _; subst hp
+      refine evalPath_le.2 fun nz => ?_
+      have := H _ _ h₁; rw [evalPath_le] at this
+      exact Nat.le_trans minimize_eval_le (this nz)
+
+theorem normalize_eval (hu : VLevel.ofLevel ls u = some u') :
+    (normalize u).eval ls ρ = u'.eval ρ := by
+  simp [normalize]
+  refine have h1 := ?_; by
+    rw [NormLevel.subsumption_eval (normalizeAux_wf (by simp) h1)]
+    exact normalizeAux_eval hu (by simp) h1
+  simp [NormLevel.WF]
+
+theorem normalize_vars_sorted : ∀ p n, (normalize u).get? p = some n →
+    (∀ v ∈ n.var, v.var ∈ p) ∧ Sorted p :=
+  NormLevel.subsumption_vars (normalizeAux_wf (by simp) (by simp [NormLevel.WF]))
+
+theorem normalize_vars : ∀ p n, (normalize u).get? p = some n → ∀ v ∈ n.var, v.var ∈ p :=
+  fun _ _ h => (normalize_vars_sorted _ _ h).1
+
+theorem normalize_sorted : ∀ p n, (normalize u).get? p = some n → Sorted p :=
+  fun _ _ h => (normalize_vars_sorted _ _ h).2
+
+/-- Soundness of `NormLevel.le`, Theorem 39 of the paper: it reports `true` only when every
+sublevel of `l₁` is dominated. Each entry of `l₁` is compared against a fold over `l₂`,
+where every entry discharges from the node what it can, and the fold stops (returning
+`none`) once nothing is left to discharge; so the fold ends in `none` only if the node is
+bounded by the total of `l₂`. -/
+theorem NormLevel.le_eval {l₁ l₂ : NormLevel}
+    (wf₂ : ∀ p n, l₂.get? p = some n → ∀ v ∈ n.var, v.var ∈ p)
+    (h : l₁.le l₂) : l₁.eval ls ρ ≤ l₂.eval ls ρ := by
+  refine NormLevel.eval_le.2 fun p₁ n₁ h₁ => evalPath_le.2 fun nz => ?_
+  -- an entry of `l₂` at a key below `p₁` is bounded by the total, on a live condition set
+  have hbd p₂ n₂ (h₂ : l₂.get? p₂ = some n₂) (hsub : subset compare p₂ p₁) :
+      (∀ v ∈ n₂.var, 0 < evalParam ls ρ v.var) ∧ Node.eval ls ρ n₂ ≤ l₂.eval ls ρ := by
+    have hnz : allNZ ls ρ p₂ := allNZ_mono (fun _ h => subset_mem hsub h) nz
+    refine ⟨fun v hv => ?_, ?_⟩
+    · simp only [allNZ, List.all_eq_true, decide_eq_true_eq] at hnz
+      exact hnz _ (wf₂ _ _ h₂ _ hv)
+    · have := evalPath_le.1 (NormLevel.eval_le.1 (Nat.le_refl (l₂.eval ls ρ)) _ _ h₂)
+      exact this hnz
+  rw [NormLevel.le, Std.TreeMap.all_eq_all_toList, List.all_eq_true] at h
+  have hf := h (p₁, n₁) (Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 (by simpa using h₁))
+  simp only [Std.TreeMap.foldlM_eq_foldlM_toList, Option.isNone_iff_eq_none] at hf
+  have hmem pn (h : pn ∈ l₂.toList) : l₂.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  clear h₁ h
+  generalize l₂.toList = l at hf hmem
+  induction l generalizing n₁ with
+  | nil => simp at hf
+  | cons pn l ih =>
+    simp only [List.foldlM_cons] at hf
+    simp only [List.mem_cons, forall_eq_or_imp] at hmem
+    by_cases hs : subset compare pn.1 p₁
+    · refine (Node.subsumeBy_eval_iff (same := false) (n₂ := pn.2)
+        (hbd _ _ hmem.1 hs).1 (hbd _ _ hmem.1 hs).2).1 ?_
+      by_cases he : (n₁.subsumeBy false pn.2).isEmpty
+      · simp [Node.eval_empty he]
+      · exact ih _ (by simpa [hs, he] using hf) hmem.2
+    · exact ih _ (by simpa [hs] using hf) hmem.2
+
+theorem Node.eval_congr {a b : Node} (H : a == b) : a.eval ls ρ = b.eval ls ρ := by
+  simp +instances [instBEqNode] at H; simp [H, eval]
+
+theorem NormLevel.eval_congr {a b : NormLevel} (H : a == b) : a.eval ls ρ = b.eval ls ρ := by
+  simp +instances only [instBEqNormLevel, Std.TreeMap.all_eq_all_toList,
+    Bool.and_eq_true, List.all_eq_true] at H
+  suffices ∀ {a b : NormLevel}, (∀ x ∈ a.toList, b.get? x.1 == some x.2) →
+      a.eval ls ρ ≤ b.eval ls ρ from Nat.le_antisymm (this H.1) (this H.2)
+  clear a b H; intro a b H
+  simp only [eval, Std.TreeMap.foldl_eq_foldl_toList]
+  rw [← a.toList.reverse_reverse] at H ⊢; generalize a.toList.reverse = a at H ⊢
+  simp only [List.mem_reverse, Std.TreeMap.get?_eq_getElem?, List.foldl_reverse] at H ⊢
+  induction a with | nil => exact Nat.zero_le _ | cons p l ih; let (x, y) := p
+  simp only [List.mem_cons, or_imp, forall_and, forall_eq, List.foldr_cons] at H ⊢
+  refine Nat.max_le.2 ⟨ih H.2, ?_⟩
+  let ⟨y', h1, h2⟩ := Option.beq_some_iff.1 H.1
+  have H := Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 h1
+  rw [← b.toList.reverse_reverse] at H ⊢; generalize b.toList.reverse = b at H ⊢
+  simp only [List.mem_reverse, List.foldl_reverse] at H ⊢
+  induction b with | nil => cases H | cons p l ih; let (x, y) := p
+  simp; obtain ⟨⟩ | ⟨_, (H : _ ∈ l)⟩ := H
+  · exact Node.eval_congr h2 ▸ Nat.le_max_right ..
+  · exact Nat.le_trans (ih H) (Nat.le_max_left ..)
+
+/-!
+### Reconstruction
+
+The value of a `Tree` is the value of the level it reifies to: a tree node contributes its
+own sublevels, and every child contributes under the `imax` guard of the variable labelling
+the edge into it. That edge guard is what makes the tree shape meaningful — a node at path
+`[a₁, …, aₙ]` (innermost first) is guarded by all of `a₁, …, aₙ` — and it is also what makes
+the tree carry sublevels of its own, since `imax x a` is at least `a` when `a ≠ 0`.
+-/
+
+mutual
+
+def Tree.eval (ls : List Name) (ρ : List Nat) : Tree → Nat
+  | ⟨const, var, child⟩ => max' (Node.eval ls ρ ⟨const, var⟩) (Tree.evalChild ls ρ child)
+
+def Tree.evalChild (ls : List Name) (ρ : List Nat) : List (Name × Tree) → Nat
+  | [] => 0
+  | (a, t) :: l =>
+    max' (Lean.Nat.imax (Tree.eval ls ρ t) (evalParam ls ρ a)) (Tree.evalChild ls ρ l)
+
+end
+
+/-- The value of the optional level accumulated by `reify`. -/
+def evalOpt (ρ : Name → Nat) (μ : LMVarId → Nat) : Option Level → Nat
+  | none => 0
+  | some l => Level.eval ρ μ l
+
+@[simp] theorem evalOpt_none : evalOpt ρ μ none = 0 := rfl
+@[simp] theorem evalOpt_some : evalOpt ρ μ (some l) = Level.eval ρ μ l := rfl
+
+theorem imax_eq_ite : Lean.Nat.imax a b = if b = 0 then 0 else max' a b := rfl
+
+theorem imax_zero_left : Lean.Nat.imax 0 a = a := by rw [imax_eq_ite]; split <;> omega
+
+theorem Node.eval_const {var : List VarNode} :
+    Node.eval ls ρ ⟨c, var⟩ = max' c (Node.eval ls ρ ⟨0, var⟩) :=
+  ext_le fun x => by simp [Node.eval_le, Nat.max_le]
+
+theorem Node.eval_cons {var : List VarNode} :
+    Node.eval ls ρ ⟨c, a :: var⟩ = max' (VarNode.eval ls ρ a) (Node.eval ls ρ ⟨c, var⟩) :=
+  ext_le fun x => by simp [Node.eval_le, Nat.max_le, and_left_comm]
+
+theorem eval_mkMax :
+    Level.eval ρ μ (Tree.reify.mkMax l o) = max' (Level.eval ρ μ l) (evalOpt ρ μ o) := by
+  cases o <;> simp [Tree.reify.mkMax, evalOpt, Level.eval]
+
+theorem eval_addOffset : Level.eval ρ μ (l.addOffset k) = Level.eval ρ μ l + k := by
+  simp only [Level.addOffset]
+  induction k generalizing l with
+  | zero => rfl
+  | succ k ih => rw [Level.addOffsetAux, ih]; simp [Level.eval]; omega
+
+theorem eval_ofNat : Level.eval ρ μ (Level.ofNat k) = k := by
+  induction k with
+  | zero => rfl
+  | succ k ih => simp [Level.ofNat, Level.eval, ih]
+
+theorem eval_varFold (var : List VarNode) (o : Option Level) :
+    evalOpt (evalParam ls ρ) μ (var.foldr (init := o) fun n r =>
+      some (Tree.reify.mkMax (Level.addOffset (.param n.var) n.offset) r)) =
+    max' (Node.eval ls ρ ⟨0, var⟩) (evalOpt (evalParam ls ρ) μ o) := by
+  induction var with | nil => simp [Node.eval] | cons a var ih
+  simp only [List.foldr_cons, evalOpt_some, eval_mkMax, eval_addOffset, Level.eval, ih,
+    Node.eval_cons, VarNode.eval]; omega
+
+/-- The two shapes `plainOffset?` accepts. -/
+theorem Tree.plainOffset?_eq {a : Name} {t : Tree} {k : Nat} (h : plainOffset? a t = some k) :
+    t = ⟨0, [], []⟩ ∧ k = 0 ∨ t = ⟨0, [⟨a, k⟩], []⟩ := by
+  unfold plainOffset? at h
+  split at h
+  · exact .inl ⟨rfl, by simpa using h.symm⟩
+  · rename_i v _
+    split at h <;> [skip; cases h]
+    cases h; rename_i hv
+    exact .inr (by rw [← eq_of_beq hv])
+  · cases h
+
+/-- Dropping the `imax` guard of a plain child is exact modulo the node's constant: the two
+differ only when the edge variable is zero, where the plain form contributes `k ≤ const`. -/
+theorem Tree.plainOffset?_eval {a : Name} {t : Tree} {k const : Nat}
+    (h : plainOffset? a t = some k) (hk : k ≤ const) :
+    max' const (Lean.Nat.imax (eval ls ρ t) (evalParam ls ρ a)) =
+    max' const (evalParam ls ρ a + k) := by
+  obtain ⟨rfl, rfl⟩ | rfl := plainOffset?_eq h
+  · rw [show eval ls ρ ⟨0, [], []⟩ = 0 from by simp [eval, evalChild, Node.eval],
+      imax_zero_left]
+    omega
+  · rw [show eval ls ρ ⟨0, [⟨a, k⟩], []⟩ = evalParam ls ρ a + k from by
+      simp [eval, evalChild, Node.eval, VarNode.eval], imax_eq_ite]
+    split <;> omega
+
+/-- A child emitted plainly at exactly the node's constant makes that constant redundant. -/
+theorem Tree.reifyChild_ge {const : Nat} : ∀ child : List (Name × Tree),
+    (child.any fun c => plainOffset? c.1 c.2 == some const) →
+    const ≤ evalOpt (evalParam ls ρ) μ (child.foldr (reify.mkChild const) none)
+  | (n, t) :: child, h => by
+    rw [List.foldr_cons, reify.mkChild]
+    simp only [List.any_cons, Bool.or_eq_true, beq_iff_eq] at h
+    -- either this child is the witness, in which case it is emitted as `n + const`, or the
+    -- witness is further down and the fold maxes its value in
+    obtain h | h := h
+    · rw [h]; dsimp only; rw [if_pos (Nat.le_refl const)]
+      simp only [evalOpt_some, eval_mkMax, eval_addOffset, Level.eval]
+      omega
+    · have ih := reifyChild_ge (ls := ls) (ρ := ρ) (μ := μ) child h
+      split <;> [split; skip] <;>
+        simp only [evalOpt_some, eval_mkMax] <;> omega
+
+mutual
+
+theorem Tree.reify_eval (t : Tree) : t.reify.eval (evalParam ls ρ) μ = t.eval ls ρ := by
+  obtain ⟨const, var, child⟩ := t
+  rw [eval]
+  simp only [reify]
+  have h1 := eval_varFold (ls := ls) (ρ := ρ) (μ := μ) var
+    (child.foldr (reify.mkChild const) none)
+  have hc := reifyChild_eval (ls := ls) (ρ := ρ) (μ := μ) const child
+  rw [Node.eval_const (c := const)]
+  split <;> [rename_i heq; rename_i l heq]
+  · rw [heq, evalOpt_none] at h1
+    rw [eval_ofNat]; omega
+  · rw [heq, evalOpt_some] at h1
+    split <;> rename_i hd
+    · -- the constant is dropped: either it is zero, or some child already covers it
+      simp only [Bool.or_eq_true, beq_iff_eq] at hd
+      rw [h1]
+      obtain rfl | hd := hd
+      · omega
+      · have := Tree.reifyChild_ge (ls := ls) (ρ := ρ) (μ := μ) (const := const) child hd
+        omega
+    · simp only [Level.eval, eval_ofNat, h1, Nat.max_eq_max]; omega
+
+theorem Tree.reifyChild_eval (const : Nat) (child : List (Name × Tree)) :
+    max' const (evalOpt (evalParam ls ρ) μ (child.foldr (reify.mkChild const) none)) =
+    max' const (evalChild ls ρ child) := by
+  match child with
+  | [] => rfl
+  | (n, t) :: child =>
+    rw [List.foldr_cons, evalChild, reify.mkChild]
+    have ht := reify_eval (ls := ls) (ρ := ρ) (μ := μ) t
+    have ih := reifyChild_eval (ls := ls) (ρ := ρ) (μ := μ) const child
+    split <;> rename_i k h
+    · split <;> rename_i hk
+      · have hp := Tree.plainOffset?_eval (ls := ls) (ρ := ρ) h hk
+        simp only [evalOpt_some, eval_mkMax, eval_addOffset, Level.eval] at *
+        omega
+      · simp only [evalOpt_some, eval_mkMax, Level.eval, ht] at *
+        omega
+    · simp only [evalOpt_some, eval_mkMax, Level.eval, ht] at *
+      omega
+
+end
+
+/-- `Tree.At t p t'` says `t'` is the subtree of `t` at path `p`, listed innermost first,
+the way `Tree.modify` takes it. -/
+inductive Tree.At : Tree → List Name → Tree → Prop
+  | nil : At t [] t
+  | cons (h : At t p t') (hm : (a, t'') ∈ t'.child) : At t (a :: p) t''
+
+theorem Tree.eval_eq (t : Tree) :
+    eval ls ρ t = max' (Node.eval ls ρ ⟨t.const, t.var⟩) (evalChild ls ρ t.child) := by
+  cases t; rw [eval]
+
+theorem Tree.At.append (h : At t' q t'') (hm : (a, t') ∈ t.child) :
+    At t (q ++ [a]) t'' := by
+  induction h with
+  | nil => exact .cons .nil hm
+  | cons _ hm' ih => exact .cons ih hm'
+
+/-- A path passes through all of its tails. -/
+theorem Tree.At.suffix {t : Tree} : ∀ {path t' q}, At t path t' → q <:+ path → ∃ t'', At t q t'' := by
+  intro path
+  induction path with
+  | nil => intro t' q _ hq; cases List.suffix_nil.1 hq; exact ⟨t, .nil⟩
+  | cons a p ih =>
+    intro t' q h hq
+    obtain rfl | hq := List.suffix_cons_iff.1 hq
+    · exact ⟨t', h⟩
+    · cases h; rename_i t₁ h _; exact ih h hq
+
+theorem Tree.At.nil_inv (h : At t [] t') : t' = t := by cases h; rfl
+
+/-- Inverting `At.append`: a nonempty path is a child of the root followed by the rest. -/
+theorem Tree.At.append_inv : ∀ {q t t''}, At t (q ++ [a]) t'' →
+    ∃ t₁, (a, t₁) ∈ t.child ∧ At t₁ q t'' := by
+  intro q
+  induction q with
+  | nil =>
+    intro t t'' h
+    cases h; rename_i t₁ h hm
+    cases h.nil_inv
+    exact ⟨t'', hm, .nil⟩
+  | cons b q ih =>
+    intro t t'' h
+    simp only [List.cons_append] at h
+    cases h; rename_i t₁ h hm
+    obtain ⟨t₂, hm₂, h₂⟩ := ih h
+    exact ⟨t₂, hm₂, .cons h₂ hm⟩
+
+/-- Paths only look at the children, so replacing the root's own data leaves them all in
+place; only the empty path sees the difference. -/
+theorem Tree.At.of_child_eq {t u : Tree} (hc : u.child = t.child) :
+    ∀ {p t'}, At t p t' → At u p t' ∨ (p = [] ∧ t' = t) := by
+  intro p
+  induction p with
+  | nil => intro t' h; exact .inr ⟨rfl, h.nil_inv⟩
+  | cons a q ih =>
+    intro t'' h
+    cases h; rename_i t₁ h hm
+    obtain h' | ⟨rfl, rfl⟩ := ih h
+    · exact .inl (.cons h' hm)
+    · exact .inl (.cons .nil (by rw [hc]; exact hm))
+
+theorem Tree.mem_le {l : List (Name × Tree)} (hm : (a, t) ∈ l) :
+    Lean.Nat.imax (eval ls ρ t) (evalParam ls ρ a) ≤ evalChild ls ρ l := by
+  induction l with
+  | nil => cases hm
+  | cons b l ih =>
+    obtain ⟨b, t'⟩ := b
+    rw [evalChild]
+    obtain h | hm := List.mem_cons.1 hm
+    · cases h; exact Nat.le_max_left ..
+    · exact Nat.le_trans (ih hm) (Nat.le_max_right ..)
+
+theorem evalPath_cons_imax :
+    evalPath ls ρ (a :: p) c ≤ evalPath ls ρ p (Lean.Nat.imax c (evalParam ls ρ a)) := by
+  rw [evalPath_cons]
+  exact evalPath_mono <| by
+    by_cases h : evalParam ls ρ a = 0 <;>
+      simp [imax_eq_ite, h, Nat.pos_of_ne_zero, Nat.le_max_left]
+
+theorem evalPath_cons_edge :
+    evalPath ls ρ (a :: p) (evalParam ls ρ a) ≤
+      evalPath ls ρ p (Lean.Nat.imax c (evalParam ls ρ a)) := by
+  rw [evalPath_cons]
+  exact evalPath_mono <| by
+    by_cases h : evalParam ls ρ a = 0 <;>
+      simp [imax_eq_ite, h, Nat.pos_of_ne_zero, Nat.le_max_right]
+
+theorem evalPath_append_single (ha : evalParam ls ρ a ≠ 0) :
+    evalPath ls ρ (p ++ [a]) c = evalPath ls ρ p c := by
+  simp [evalPath, allNZ, List.all_append, Nat.pos_of_ne_zero ha]
+
+theorem Tree.At.le (h : At t p t') :
+    evalPath ls ρ p (eval ls ρ t') ≤ eval ls ρ t := by
+  induction h with
+  | nil => simp [evalPath, allNZ]
+  | cons _ hm ih =>
+    refine Nat.le_trans evalPath_cons_imax (Nat.le_trans (evalPath_mono ?_) ih)
+    exact Nat.le_trans (mem_le hm) (eval_eq _ ▸ Nat.le_max_right ..)
+
+theorem Tree.At.edge_le (h : At t (a :: p) t') :
+    evalPath ls ρ (a :: p) (evalParam ls ρ a) ≤ eval ls ρ t := by
+  cases h with | @cons _ t'' _ _ h' hm => ?_
+  refine Nat.le_trans (evalPath_cons_edge (c := eval ls ρ t'))
+    (Nat.le_trans (evalPath_mono ?_) h'.le)
+  exact Nat.le_trans (mem_le hm) (eval_eq t'' ▸ Nat.le_max_right ..)
+
+mutual
+
+/-- A tree is bounded by `m` as soon as all the sublevels it reifies to are: the ones
+recorded at its nodes, and the `V(p, a, 0)` contributed by the edge into each node. -/
+theorem Tree.eval_le_of (t : Tree)
+    (h1 : ∀ p t', At t p t' → evalPath ls ρ p (Node.eval ls ρ ⟨t'.const, t'.var⟩) ≤ m)
+    (h2 : ∀ a p t', At t (a :: p) t' → evalPath ls ρ (a :: p) (evalParam ls ρ a) ≤ m) :
+    eval ls ρ t ≤ m := by
+  obtain ⟨const, var, child⟩ := t
+  rw [eval]
+  refine Nat.max_le.2 ⟨h1 [] _ .nil, evalChild_le_of child ?_ ?_ ?_⟩
+  · exact fun a t' hm p t'' hat => h1 _ _ (hat.append hm)
+  · exact fun a t' hm b p t'' hat => h2 _ _ _ (hat.append hm)
+  · exact fun a t' hm => h2 a [] t' (.cons .nil hm)
+
+theorem Tree.evalChild_le_of : ∀ (l : List (Name × Tree)),
+    (∀ a t', (a, t') ∈ l → ∀ p t'', At t' p t'' →
+      evalPath ls ρ (p ++ [a]) (Node.eval ls ρ ⟨t''.const, t''.var⟩) ≤ m) →
+    (∀ a t', (a, t') ∈ l → ∀ b p t'', At t' (b :: p) t'' →
+      evalPath ls ρ ((b :: p) ++ [a]) (evalParam ls ρ b) ≤ m) →
+    (∀ a t', (a, t') ∈ l → evalPath ls ρ [a] (evalParam ls ρ a) ≤ m) →
+    evalChild ls ρ l ≤ m
+  | [], _, _, _ => by rw [evalChild]; exact Nat.zero_le _
+  | (a, t) :: l, h1, h2, h3 => by
+    rw [evalChild]
+    refine Nat.max_le.2 ⟨?_, evalChild_le_of l
+      (fun a t' hm => h1 a t' (.tail _ hm)) (fun a t' hm => h2 a t' (.tail _ hm))
+      (fun a t' hm => h3 a t' (.tail _ hm))⟩
+    by_cases ha : evalParam ls ρ a = 0
+    · simp [imax_eq_ite, ha]
+    · have hle : evalParam ls ρ a ≤ m := by
+        have := h3 a t (.head _)
+        simpa [evalPath, allNZ, Nat.pos_of_ne_zero ha] using this
+      have ht : eval ls ρ t ≤ m :=
+        eval_le_of t
+          (fun p t'' hat => evalPath_append_single ha ▸ h1 a t (.head _) p t'' hat)
+          (fun b p t'' hat => evalPath_append_single ha ▸ h2 a t (.head _) b p t'' hat)
+      rw [imax_eq_ite]; split <;> omega
+
+end
+
+/-- A tree is bounded by `m` exactly when all the sublevels it reifies to are: the ones
+recorded at its nodes, and the one each edge contributes. -/
+theorem Tree.eval_le_iff {t : Tree} {m : Nat} :
+    eval ls ρ t ≤ m ↔
+    (∀ p t', At t p t' → evalPath ls ρ p (Node.eval ls ρ ⟨t'.const, t'.var⟩) ≤ m) ∧
+    (∀ a p t', At t (a :: p) t' → evalPath ls ρ (a :: p) (evalParam ls ρ a) ≤ m) := by
+  refine ⟨fun h => ?_, fun ⟨h1, h2⟩ => eval_le_of t h1 h2⟩
+  refine ⟨fun _ t' hp => ?_, fun _ _ _ hp => Nat.le_trans hp.edge_le h⟩
+  exact Nat.le_trans (Nat.le_trans (evalPath_mono (eval_eq t' ▸ Nat.le_max_left ..)) hp.le) h
+
+/-!
+### Admissible chains
+
+Reifying the sublevels at a key `p` means nesting them under an `imax` chain whose variables
+are the elements of `p`; the chain contributes the sublevel `V(q, a, 0)` for every one of its
+edges, where `q` is the set of conditions from the outside up to and including that edge. The
+level is therefore equivalent to the normal form only if every such edge is *dominated*
+(`Dom`), and a key is expressible only if its elements can be ordered so that all of them are
+(`Feas`). `lexChain` searches for such an order greedily; `feasible` is its lookahead.
+-/
+
+/-- The edge adding `a` to the conditions `acc` contributes `V(acc ∪ {a}, a, 0)`, which the
+normal form dominates when it has some `V(T, a+k)` with `T ⊆ acc ∪ {a}`. -/
+def NormLevel.Dom (s : NormLevel) (a : Name) (acc : List Name) : Prop :=
+  ∃ p n, s.get? p = some n ∧ (∃ x ∈ n.var, x.var = a) ∧ ∀ y ∈ p, y = a ∨ y ∈ acc
+
+theorem NormLevel.Dom.mono {s : NormLevel}
+    (h : s.Dom a acc) (hs : ∀ x ∈ acc, x ∈ acc') : s.Dom a acc' :=
+  let ⟨p, n, h1, h2, h3⟩ := h
+  ⟨p, n, h1, h2, fun y hy => (h3 y hy).imp id (hs _)⟩
+
+/-- A dominated edge contributes nothing beyond the normal form. -/
+theorem NormLevel.Dom.le {s : NormLevel} (h : s.Dom a acc) :
+    evalPath ls ρ (a :: acc) (evalParam ls ρ a) ≤ s.eval ls ρ := by
+  refine evalPath_le.2 fun nz => ?_
+  rw [allNZ_cons] at nz
+  obtain ⟨p, n, h1, ⟨x, hx, hxa⟩, h3⟩ := h
+  have hnz : allNZ ls ρ p := by
+    simp only [allNZ, List.all_eq_true, decide_eq_true_eq]
+    refine fun y hy => (h3 y hy).elim (fun e => e ▸ nz.1) fun hy => ?_
+    simp only [allNZ, List.all_eq_true, decide_eq_true_eq] at nz
+    exact nz.2 _ hy
+  refine Nat.le_trans ?_ (Nat.le_trans (Node.var_le_eval hx)
+    (evalPath_le.1 (NormLevel.eval_le.1 (Nat.le_refl _) _ _ h1) hnz))
+  simp only [VarNode.eval, ← hxa]; omega
+
+theorem NormLevel.addable_sound {s : NormLevel} (h : s.addable a acc) : s.Dom a acc := by
+  simp only [addable, Std.TreeMap.any_eq_any_toList, List.any_eq_true, Bool.and_eq_true,
+    beq_iff_eq] at h
+  obtain ⟨⟨p, n⟩, hm, ⟨x, hx, hxa⟩, hsub⟩ := h
+  refine ⟨p, n, Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 hm,
+    ⟨x, hx, hxa⟩, fun y hy => ?_⟩
+  by_cases hya : y = a
+  · exact .inl hya
+  · exact .inr (subset_mem hsub ((List.mem_erase_of_ne hya).2 hy))
+
+theorem NormLevel.addable_complete {s : NormLevel} (hs : ∀ p n, s.get? p = some n → Sorted p)
+    (hacc : Sorted acc) (h : s.Dom a acc) : s.addable a acc := by
+  obtain ⟨p, n, h1, ⟨x, hx, hxa⟩, h3⟩ := h
+  simp only [addable, Std.TreeMap.any_eq_any_toList, List.any_eq_true, Bool.and_eq_true,
+    beq_iff_eq]
+  refine ⟨(p, n), Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 (by simpa using h1),
+    ⟨x, hx, hxa⟩, subset_of_sorted (hs _ _ h1).erase hacc fun y hy => ?_⟩
+  refine (h3 y (List.mem_of_mem_erase hy)).resolve_left fun e => ?_
+  exact absurd (e ▸ hy) ((hs _ _ h1).nodup.not_mem_erase)
+
+/-- The conditions `rem` can be added to `acc` one at a time, each addition dominated. -/
+inductive NormLevel.Feas (s : NormLevel) : List Name → List Name → Prop
+  | nil {acc} : Feas s acc []
+  | cons {acc a rem} : a ∈ rem → s.Dom a acc → Feas s (a :: acc) (rem.erase a) → Feas s acc rem
+
+theorem NormLevel.Feas.mono {s : NormLevel} (hs : ∀ x ∈ acc, x ∈ acc')
+    (h : Feas s acc rem) : Feas s acc' rem := by
+  induction h generalizing acc' with | nil => exact .nil | cons hm hd _ ih
+  refine .cons hm (hd.mono hs) <| ih fun x hx => ?_
+  obtain rfl | hx := List.mem_cons.1 hx
+  · exact .head _
+  · exact .tail _ (hs _ hx)
+
+/-- Greedy exchange: a dominated element can always be taken first. -/
+theorem NormLevel.Feas.exchange {s : NormLevel} (h : Feas s acc rem) :
+    ∀ {a}, a ∈ rem → s.Dom a acc → Feas s (a :: acc) (rem.erase a) := by
+  induction h with | nil => nofun | @cons acc b rem hmb hdb H ih
+  intro a hm hd
+  by_cases hab : a = b <;> [(subst hab; exact H); skip]
+  refine .cons ((List.mem_erase_of_ne (Ne.symm hab)).2 hmb) (hdb.mono fun x hx => .tail _ hx) ?_
+  rw [List.erase_comm]
+  refine ih ((List.mem_erase_of_ne hab).2 hm) (hd.mono fun x hx => .tail _ hx)
+    |>.mono fun x hx => ?_
+  obtain rfl | hx := List.mem_cons.1 hx
+  · exact .tail _ (.head _)
+  · obtain rfl | hx := List.mem_cons.1 hx
+    · exact .head _
+    · exact .tail _ (.tail _ hx)
+
+/-- Peel off the element added last: it is dominated by all the others. -/
+theorem NormLevel.Feas.peel {s : NormLevel} (h : Feas s acc rem) (nd : rem.Nodup) (hne : rem ≠ []) :
+    ∃ a ∈ rem, s.Dom a (acc ++ rem.erase a) ∧ Feas s acc (rem.erase a) := by
+  induction h with
+  | nil => exact absurd rfl hne
+  | @cons acc b rem hmb hdb H ih =>
+    by_cases he : rem.erase b = []
+    · exact ⟨b, hmb, hdb.mono fun x hx => List.mem_append_left _ hx, he ▸ .nil⟩
+    obtain ⟨a, hma, hda, hfa⟩ := ih (nd.erase _) he
+    have hab : a ≠ b := by rintro rfl; exact absurd hma nd.not_mem_erase
+    have hmb' : b ∈ rem.erase a := (List.mem_erase_of_ne (Ne.symm hab)).2 hmb
+    refine ⟨a, List.mem_of_mem_erase hma, hda.mono fun x hx => ?_, ?_⟩
+    · simp only [List.cons_append, List.mem_cons, List.mem_append] at hx ⊢
+      obtain rfl | hx | hx := hx
+      · exact .inr hmb'
+      · exact .inl hx
+      · rw [List.erase_comm] at hx; exact .inr (List.mem_of_mem_erase hx)
+    · exact .cons hmb' hdb <| by rw [List.erase_comm]; exact hfa
+
+theorem NormLevel.feasible_go_sound {s : NormLevel} :
+    ∀ {fuel acc rem}, NormLevel.feasible.go s fuel acc rem → s.Feas acc rem
+  | 0, _, rem, h => by simp [feasible.go, List.isEmpty_iff] at h; exact h ▸ .nil
+  | fuel+1, acc, rem, h => by
+    rw [feasible.go] at h
+    split at h <;> [(let [] := rem; exact .nil); rename_i a ha]
+    have hm := List.mem_of_find?_eq_some ha
+    have hd := addable_sound (List.find?_eq_some_iff_getElem.1 ha).1
+    refine .cons hm hd ((feasible_go_sound h).mono fun x hx => ?_)
+    exact List.mem_cons.2 ((Extend?.orderedInsert (cmp := Name.cmp) (v := a) (p := acc)).mem.1 hx)
+
+theorem NormLevel.feasible_sound {s : NormLevel} (h : s.feasible acc rem) : s.Feas acc rem :=
+  feasible_go_sound h
+
+theorem NormLevel.feasible_go_complete {s : NormLevel} (hs : ∀ p n, s.get? p = some n → Sorted p) :
+    ∀ {fuel acc rem}, rem.length ≤ fuel → Sorted acc → s.Feas acc rem → feasible.go s fuel acc rem
+  | 0, _, rem, hf, _, _ => by
+    rw [feasible.go]; cases rem with | nil => rfl | cons => cases hf
+  | fuel+1, acc, rem, hf, hacc, h => by
+    rw [feasible.go]
+    split <;> [rename_i ha; rename_i a ha]
+    · -- the first element of the chain is addable, so `find?` cannot fail
+      cases h with | nil => rfl | @cons b _ _ hm hd
+      exact absurd (addable_complete hs hacc hd) (by simpa using List.find?_eq_none.1 ha _ hm)
+    · have hm := List.mem_of_find?_eq_some ha
+      have hd := addable_sound (List.find?_eq_some_iff_getElem.1 ha).1
+      have hext := Extend?.orderedInsert (cmp := Name.cmp) (v := a) (p := acc)
+      refine feasible_go_complete hs ?_ ?_ ((h.exchange hm hd).mono fun x hx => hext.mem.2 ?_)
+      · rw [List.length_erase_of_mem hm]; omega
+      · match he : Normalize.orderedInsert Name.cmp a acc with
+        | none => exact hacc
+        | some acc' => exact hacc.orderedInsert he
+      · exact List.mem_cons.1 hx
+
+theorem NormLevel.feasible_complete {s : NormLevel} (hs : ∀ p n, s.get? p = some n → Sorted p)
+    (hacc : Sorted acc) (h : s.Feas acc rem) : s.feasible acc rem :=
+  feasible_go_complete hs (Nat.le_refl _) hacc h
+
+theorem NormLevel.Feas.perm {s : NormLevel} (h : Feas s acc rem) (hp : rem.Perm rem') :
+    Feas s acc rem' := by
+  induction h generalizing rem' with
+  | nil => cases hp.nil_eq; exact .nil
+  | cons hm hd _ ih => exact .cons (hp.mem_iff.1 hm) hd (ih (hp.erase _))
+
+/-- Extend a chain on the inside: the new element's conditions are all the others. -/
+theorem NormLevel.Feas.cons_last {s : NormLevel} (h : Feas s acc rem) (hnm : a ∉ rem)
+    (hd : s.Dom a (acc ++ rem)) : Feas s acc (a :: rem) := by
+  induction h with
+  | nil => exact .cons (.head _) (by simpa using hd) (by simpa using Feas.nil)
+  | @cons acc b rem hmb hdb _ ih =>
+    have hab : b ≠ a := fun e => hnm (e ▸ hmb)
+    refine .cons (.tail _ hmb) hdb ?_
+    rw [List.erase_cons_tail (by simpa using Ne.symm hab)]
+    refine ih (fun h => hnm (List.mem_of_mem_erase h)) (hd.mono fun x hx => ?_)
+    -- everything outside `a` is still there: `b` moved into the accumulator
+    simp only [List.cons_append, List.mem_cons, List.mem_append] at hx ⊢
+    obtain hx | hx := hx
+    · exact .inr (.inl hx)
+    · by_cases hxb : x = b
+      · exact .inl hxb
+      · exact .inr (.inr ((List.mem_erase_of_ne hxb).2 hx))
+
+/-- Every key of a well-formed normal form admits a chain: its `WF` parent is a key with one
+condition fewer, and the variable relating them dominates the edge between them. -/
+theorem NormLevel.WF.feas {s : NormLevel} (wf : s.WF) : ∀ {p}, s.contains p → s.Feas [] p := by
+  intro p
+  generalize eq : p.length = len
+  induction len generalizing p with
+  | zero => cases List.eq_nil_of_length_eq_zero eq; exact fun _ => .nil
+  | succ len ih =>
+    intro hp
+    have hne : p ≠ [] := by rintro rfl; cases eq
+    obtain ⟨n, hn⟩ := Option.isSome_iff_exists.1 (Std.TreeMap.isSome_getElem?_eq_contains.trans hp)
+    obtain ⟨v, p', h1, h2, x, hx, hxv⟩ := (wf _ _ hn).1 hne
+    have hperm : p.Perm (v :: p') := by cases h1; exact List.perm_middle
+    have hnm : v ∉ p' := by
+      have := (wf.sortedOf (.inr hp)).nodup
+      rw [hperm.nodup_iff] at this
+      exact (List.nodup_cons.1 this).1
+    refine Feas.perm ?_ hperm.symm
+    refine Feas.cons_last (h2.elim (fun e => by subst e; exact .nil) (fun h => ih (by
+      have := h1.length; omega) h)) hnm ⟨p, n, hn, ⟨x, hx, hxv⟩, fun y hy => ?_⟩
+    simpa using (h1.mem.1 hy).imp id id
+
+/-- Domination only reads off variable names and their keys, so a map that covers another
+dominates whatever it does. -/
+theorem NormLevel.Dom.mono_map {s s' : NormLevel} (h : s'.Covers s) (hd : s.Dom a acc) :
+    s'.Dom a acc := by
+  obtain ⟨p, n, hp, ⟨x, hx, hxa⟩, hcond⟩ := hd
+  obtain ⟨q, m, y, hq, hy, e, hsub⟩ := h _ _ _ hp hx
+  exact ⟨q, m, hq, ⟨y, hy, e.trans hxa⟩, fun z hz => hcond _ (hsub _ hz)⟩
+
+theorem NormLevel.Feas.mono_map {s s' : NormLevel} (h : s'.Covers s) :
+    ∀ {acc rem}, s.Feas acc rem → s'.Feas acc rem
+  | _, _, .nil => .nil
+  | _, _, .cons hm hd H => .cons hm (hd.mono_map h) (Feas.mono_map h H)
+
+/-- Every key of the normal form admits a chain. `WF.feas` gives this for the map `normalizeAux`
+builds; subsumption keeps it because it covers that map, dropping a variable only in favour of
+one with the same name at a smaller key. -/
+theorem normalize_feas : ∀ p, (normalize u).contains p → (normalize u).Feas [] p := by
+  intro p hp
+  have wf : (normalizeAux u [] 0 {}).WF := normalizeAux_wf (by simp) (by simp [NormLevel.WF])
+  refine NormLevel.Feas.mono_map NormLevel.subsumption_covers.2 (wf.feas ?_)
+  obtain ⟨n, hn⟩ := Option.isSome_iff_exists.1 (Std.TreeMap.isSome_getElem?_eq_contains.trans hp)
+  obtain ⟨n₀, h₀, -⟩ := NormLevel.subsumption_covers.1 p n
+    (by rw [Std.TreeMap.get?_eq_getElem?]; exact hn)
+  exact Std.TreeMap.isSome_getElem?_eq_contains.symm.trans
+    (by simp [Std.TreeMap.get?_eq_getElem?] at h₀; simp [h₀])
+
+/-- An admissible chain, innermost first: each element is dominated relative to the
+conditions outside it. -/
+def NormLevel.Adm (s : NormLevel) : List Name → Prop
+  | [] => True
+  | a :: l => s.Dom a l ∧ s.Adm l
+
+/-- `lexChain` always reorders its input, even in the fallback branch. -/
+theorem NormLevel.lexChain_perm {s : NormLevel} : ∀ {fuel p}, (s.lexChain fuel p).Perm p
+  | 0, p => by rw [lexChain]
+  | fuel+1, p => by
+    rw [lexChain]
+    split
+    · rename_i a ha
+      exact .trans (.cons _ lexChain_perm)
+        (List.perm_cons_erase (List.mem_of_find?_eq_some ha)).symm
+    · exact .refl _
+
+/-- Whenever a key admits some chain, `lexChain` returns one: it reorders the key, and
+every edge of the resulting `imax` chain is dominated. -/
+theorem NormLevel.lexChain_spec {s : NormLevel} (hs : ∀ p n, s.get? p = some n → Sorted p) :
+    ∀ {fuel p}, p.length ≤ fuel → Sorted p → s.Feas [] p →
+      (s.lexChain fuel p).Perm p ∧ s.Adm (s.lexChain fuel p)
+  | 0, p, hf, _, _ => by
+    rw [lexChain]; cases p with | nil => exact ⟨.refl _, trivial⟩ | cons => cases hf
+  | fuel+1, p, hf, hp, h => by
+    rw [lexChain]
+    split
+    · rename_i a ha
+      have hm := List.mem_of_find?_eq_some ha
+      have hpred := List.find?_eq_some_iff_getElem.1 ha |>.1
+      simp only [Bool.and_eq_true] at hpred
+      have hlen : (p.erase a).length ≤ fuel := by
+        rw [List.length_erase_of_mem hm]; omega
+      obtain ⟨hperm, hadm⟩ :=
+        lexChain_spec hs hlen hp.erase (feasible_sound hpred.2)
+      refine ⟨.trans (.cons _ hperm) (List.perm_cons_erase hm).symm, ?_, hadm⟩
+      exact (addable_sound hpred.1).mono fun x hx => hperm.mem_iff.2 hx
+    · rename_i hnone
+      -- the chain that exists ends somewhere, and `find?` would have found that element
+      refine ⟨.refl _, ?_⟩
+      match p, h with
+      | [], _ => exact trivial
+      | b :: p, h =>
+        obtain ⟨a, hm, hd, hfa⟩ := h.peel hp.nodup (by simp)
+        have h1 : s.addable a ((b :: p).erase a) :=
+          addable_complete hs hp.erase (by simpa using hd)
+        have h2 : s.feasible [] ((b :: p).erase a) := feasible_complete hs Sorted.nil hfa
+        have hnot := List.find?_eq_none.1 hnone _ hm
+        simp [h1, h2] at hnot
+
+theorem NormLevel.Adm.suffix {s : NormLevel} : ∀ {l}, s.Adm l → a :: q <:+ l → s.Dom a q
+  | [], _, h => by simp at h
+  | b :: l, ⟨h1, h2⟩, h => by
+    obtain ⟨l', he⟩ := h
+    match l' with
+    | [] => cases he; exact h1
+    | c :: l' => exact Adm.suffix h2 ⟨l', by cases he; rfl⟩
+
+/-! ### Building the tree -/
+
+theorem evalPath_le_self : evalPath ls ρ path c ≤ c := by rw [evalPath]; split <;> simp
+
+theorem evalPath_perm (h : p.Perm p') : evalPath ls ρ p c = evalPath ls ρ p' c := by
+  simp only [evalPath, show allNZ ls ρ p = allNZ ls ρ p' from Bool.eq_iff_iff.2
+    ⟨allNZ_mono fun _ hx => h.symm.mem_iff.1 hx, allNZ_mono fun _ hx => h.mem_iff.1 hx⟩]
+
+theorem evalPath_singleton :
+    evalPath ls ρ [a] c = if 0 < evalParam ls ρ a then c else 0 := by simp [evalPath, allNZ]
+
+theorem evalPath_single : evalPath ls ρ p (evalPath ls ρ [a] c) = evalPath ls ρ (a :: p) c := by
+  rw [evalPath_singleton, ← evalPath_cons]
+
+theorem imax_eq_evalPath : Lean.Nat.imax c (evalParam ls ρ a) =
+    max' (evalPath ls ρ [a] c) (evalPath ls ρ [a] (evalParam ls ρ a)) := by
+  by_cases h : evalParam ls ρ a = 0 <;>
+    simp [imax_eq_ite, evalPath_singleton, h, Nat.pos_of_ne_zero]
+
+/-- `modify` read from the outside in, matching the way `Tree.At` extends a path: the
+shallowest element of the path selects a child, and the rest is modified inside it. -/
+theorem Tree.modify_append (path : List Name) (g : Tree → Tree) (b : Name) (t : Tree) :
+    Tree.modify (path ++ [b]) g t =
+    { t with child := modifyAt (Tree.modify path g) b t.child } := by
+  induction path generalizing t g with
+  | nil => rfl
+  | cons a p ih => rw [List.cons_append, Tree.modify, ih]; rfl
+
+/-- All that matters about `modifyAt`: it replaces one entry with key `a` by `f` of it, or
+inserts `(a, f default)` somewhere if there is none, and leaves the rest of the list alone. -/
+theorem modifyAt_eq (f : Tree → Tree) (a : Name) (l : List (Name × Tree)) :
+    ∃ l₁ l₂ y, modifyAt f a l = l₁ ++ (a, f y) :: l₂ ∧
+      (l = l₁ ++ l₂ ∧ y = default ∨ l = l₁ ++ (a, y) :: l₂) := by
+  induction l with
+  | nil => exact ⟨[], [], default, rfl, .inl ⟨rfl, rfl⟩⟩
+  | cons b l ih =>
+    obtain ⟨b, t⟩ := b
+    match he : Name.cmp a b with
+    | .lt => exact ⟨[], (b, t) :: l, default, by simp [modifyAt, he], .inl ⟨rfl, rfl⟩⟩
+    | .eq =>
+      rw [Std.LawfulBEqCmp.compare_eq_iff_beq (cmp := Name.cmp)] at he
+      cases eq_of_beq he
+      exact ⟨[], l, t, by
+        simp [modifyAt, Std.ReflCmp.compare_self (cmp := Name.cmp)], .inr rfl⟩
+    | .gt =>
+      obtain ⟨l₁, l₂, y, h1, h2⟩ := ih
+      exact ⟨(b, t) :: l₁, l₂, y, by simp [modifyAt, he, h1],
+        h2.imp (fun ⟨h, hy⟩ => ⟨by simp [h], hy⟩) fun h => by simp [h]⟩
+
+theorem mem_modifyAt_self (f : Tree → Tree) (a : Name) (l : List (Name × Tree)) :
+    ∃ y, (a, f y) ∈ modifyAt f a l := by
+  obtain ⟨l₁, l₂, y, h, -⟩ := modifyAt_eq f a l
+  exact ⟨y, by rw [h]; simp⟩
+
+/-- The node `modify` writes is there to be found, and its data does not depend on what was
+at the path before: the payload of a key is what sits at the end of its chain. -/
+theorem Tree.At_modify_self (path : List Name) (g : Tree → Tree) (t : Tree) :
+    ∃ t₀, Tree.At (t.modify path g) path (g t₀) := by
+  suffices ∀ (r : List Name) (g : Tree → Tree) (t : Tree),
+      ∃ t₀, Tree.At (Tree.modify r.reverse g t) r.reverse (g t₀) by
+    simpa using this path.reverse g t
+  clear path g t; intro r
+  induction r with
+  | nil => exact fun g t => ⟨t, .nil⟩
+  | cons b r ih =>
+    intro g t
+    rw [List.reverse_cons, Tree.modify_append]
+    obtain ⟨x, hx⟩ := mem_modifyAt_self (f := Tree.modify r.reverse g) b t.child
+    obtain ⟨t₀, ht₀⟩ := ih g x
+    exact ⟨t₀, ht₀.append hx⟩
+
+/-- Nothing is lost: an entry either survives `modifyAt` untouched, or is the one it modifies.
+(The second case does not need the entry to be the *first* one with its key, so no
+duplicate-freedom assumption is needed here or below.) -/
+theorem mem_modifyAt {f : Tree → Tree} {l : List (Name × Tree)} (hm : (c, x) ∈ l) :
+    (c, x) ∈ modifyAt f a l ∨ (c = a ∧ (c, f x) ∈ modifyAt f a l) := by
+  obtain ⟨l₁, l₂, y, h, h'⟩ := modifyAt_eq f a l
+  rw [h]
+  obtain ⟨rfl, -⟩ | rfl := h'
+  · obtain hm | hm := List.mem_append.1 hm
+    · exact .inl (List.mem_append.2 (.inl hm))
+    · exact .inl (List.mem_append.2 (.inr (.tail _ hm)))
+  · obtain hm | hm := List.mem_append.1 hm
+    · exact .inl (List.mem_append.2 (.inl hm))
+    obtain heq | hm := List.mem_cons.1 hm
+    · simp only [Prod.mk.injEq] at heq; obtain ⟨rfl, rfl⟩ := heq
+      exact .inr ⟨rfl, List.mem_append.2 (.inr (.head _))⟩
+    · exact .inl (List.mem_append.2 (.inr (.tail _ hm)))
+
+/-- A node written at one path survives a later write at a different path: the write only
+replaces the data of the node it lands on, and every other node keeps its own. -/
+theorem Tree.At_modify_of_ne_aux {g : Tree → Tree} (hg : ∀ t, (g t).child = t.child) :
+    ∀ (r : List Name) {path t t'}, path ≠ r.reverse → At t path t' →
+      ∃ t'', At (Tree.modify r.reverse g t) path t'' ∧
+        t''.const = t'.const ∧ t''.var = t'.var := by
+  intro r
+  induction r with
+  | nil =>
+    intro path t t' hne h
+    rw [List.reverse_nil, Tree.modify]
+    obtain h' | ⟨rfl, rfl⟩ := h.of_child_eq (hg t)
+    · exact ⟨t', h', rfl, rfl⟩
+    · exact absurd rfl hne
+  | cons b r ih =>
+    intro path t t' hne h
+    rw [List.reverse_cons, Tree.modify_append]
+    obtain rfl | ⟨q, a, rfl⟩ := List.eq_nil_or_concat path
+    · cases h.nil_inv; exact ⟨_, .nil, rfl, rfl⟩
+    simp only [List.concat_eq_append, List.reverse_cons] at h hne ⊢
+    obtain ⟨t₁, hm, h₁⟩ := h.append_inv
+    obtain hm' | ⟨rfl, hm'⟩ := mem_modifyAt (f := Tree.modify r.reverse g) (a := b) hm
+    · exact ⟨t', h₁.append hm', rfl, rfl⟩
+    · have : q ≠ r.reverse := by rintro rfl; exact hne rfl
+      obtain ⟨t'', h'', hc, hv⟩ := ih this h₁
+      exact ⟨t'', h''.append hm', hc, hv⟩
+
+theorem Tree.At_modify_of_ne {g : Tree → Tree} (hg : ∀ t, (g t).child = t.child)
+    (hne : path ≠ path') (h : At t path t') :
+    ∃ t'', At (Tree.modify path' g t) path t'' ∧ t''.const = t'.const ∧ t''.var = t'.var := by
+  have := At_modify_of_ne_aux hg path'.reverse (path := path) (by rwa [List.reverse_reverse]) h
+  rwa [List.reverse_reverse] at this
+
+/-- Conversely, nothing appears from nowhere: an entry of `modifyAt` is an entry of the list,
+or the modified one, which was an entry or is fresh. -/
+theorem mem_modifyAt_inv {f : Tree → Tree} {l : List (Name × Tree)}
+    (h : (c, x) ∈ modifyAt f a l) :
+    (c, x) ∈ l ∨ (c = a ∧ ∃ y, x = f y ∧ (y = default ∨ (a, y) ∈ l)) := by
+  induction l with
+  | nil =>
+    simp only [modifyAt, List.mem_singleton, Prod.mk.injEq] at h
+    obtain ⟨rfl, rfl⟩ := h
+    exact .inr ⟨rfl, default, rfl, .inl rfl⟩
+  | cons b l ih =>
+    obtain ⟨b, t⟩ := b
+    match he : Name.cmp a b with
+    | .lt =>
+      simp only [modifyAt, he] at h
+      obtain h | h := List.mem_cons.1 h
+      · cases h; exact .inr ⟨rfl, default, rfl, .inl rfl⟩
+      · exact .inl h
+    | .eq =>
+      rw [Std.LawfulBEqCmp.compare_eq_iff_beq (cmp := Name.cmp)] at he
+      cases eq_of_beq he
+      simp only [modifyAt, Std.ReflCmp.compare_self (cmp := Name.cmp)] at h
+      obtain h | h := List.mem_cons.1 h
+      · cases h; exact .inr ⟨rfl, t, rfl, .inr (.head _)⟩
+      · exact .inl (.tail _ h)
+    | .gt =>
+      simp only [modifyAt, he] at h
+      obtain h | h := List.mem_cons.1 h
+      · cases h; exact .inl (.head _)
+      · exact (ih h).imp (.tail _) fun ⟨rfl, y, hy, h⟩ => ⟨rfl, y, hy, h.imp id (.tail _)⟩
+
+theorem Tree.At.of_child_nil (hc : t.child = []) (h : At t p t') : p = [] ∧ t' = t := by
+  obtain rfl | ⟨q, a, rfl⟩ := List.eq_nil_or_concat p
+  · exact ⟨rfl, h.nil_inv⟩
+  · rw [List.concat_eq_append] at h
+    obtain ⟨t₁, hm, -⟩ := h.append_inv
+    rw [hc] at hm; cases hm
+
+theorem suffix_concat {α} {l₁ l₂ : List α} (h : l₁ <:+ l₂) (a : α) :
+    l₁ ++ [a] <:+ l₂ ++ [a] := by
+  obtain ⟨u, rfl⟩ := h; exact ⟨u, by rw [List.append_assoc]⟩
+
+/-- Inverting a write: a path of the modified tree either ends at the node just written, or
+is a tail of the written path whose node was created empty on the way, or was already there
+carrying the same data. -/
+theorem Tree.At_modify_inv_aux {g : Tree → Tree} (hg : ∀ t, (g t).child = t.child) :
+    ∀ (r : List Name) {path t t'}, At (Tree.modify r.reverse g t) path t' →
+      (path = r.reverse ∧ ∃ t₀, t' = g t₀) ∨
+      (path <:+ r.reverse ∧ t'.const = 0 ∧ t'.var = []) ∨
+      (∃ t'', At t path t'' ∧ t'.const = t''.const ∧ t'.var = t''.var) := by
+  intro r
+  induction r with
+  | nil =>
+    intro path t t' h
+    rw [List.reverse_nil, Tree.modify] at h
+    obtain h' | ⟨rfl, rfl⟩ := h.of_child_eq (hg t).symm
+    · exact .inr (.inr ⟨t', h', rfl, rfl⟩)
+    · exact .inl ⟨rfl, t, rfl⟩
+  | cons b r ih =>
+    intro path t t' h
+    rw [List.reverse_cons, Tree.modify_append] at h
+    obtain rfl | ⟨q, a, rfl⟩ := List.eq_nil_or_concat path
+    · cases h.nil_inv; exact .inr (.inr ⟨t, .nil, rfl, rfl⟩)
+    rw [List.concat_eq_append] at h ⊢
+    obtain ⟨t₁, hm, h₁⟩ := h.append_inv
+    obtain hm | ⟨rfl, y, rfl, hy⟩ := mem_modifyAt_inv hm
+    · exact .inr (.inr ⟨t', h₁.append hm, rfl, rfl⟩)
+    · obtain ⟨rfl, t₀, rfl⟩ | ⟨hs, hc, hv⟩ | ⟨t'', h'', hc, hv⟩ := ih h₁
+      · exact .inl ⟨by rw [List.reverse_cons], t₀, rfl⟩
+      · exact .inr (.inl ⟨by rw [List.reverse_cons]; exact suffix_concat hs _, hc, hv⟩)
+      · obtain rfl | hy := hy
+        · obtain ⟨rfl, rfl⟩ := h''.of_child_nil rfl
+          exact .inr (.inl ⟨by rw [List.reverse_cons]; exact ⟨r.reverse, by simp⟩, hc, hv⟩)
+        · exact .inr (.inr ⟨t'', h''.append hy, hc, hv⟩)
+
+theorem Tree.At_modify_inv {g : Tree → Tree} (hg : ∀ t, (g t).child = t.child)
+    (h : At (Tree.modify path' g t) path t') :
+    (path = path' ∧ ∃ t₀, t' = g t₀) ∨
+    (path <:+ path' ∧ t'.const = 0 ∧ t'.var = []) ∨
+    (∃ t'', At t path t'' ∧ t'.const = t''.const ∧ t'.var = t''.var) := by
+  have := At_modify_inv_aux hg path'.reverse (path := path)
+    (by rwa [List.reverse_reverse]) (t' := t')
+  rwa [List.reverse_reverse] at this
+
+/-- Sorted lists with the same elements are equal, so distinct keys reify to distinct paths:
+`lexChain` only permutes a key. -/
+theorem Sorted.perm_eq (h₁ : Sorted l₁) (h₂ : Sorted l₂) (h : l₁.Perm l₂) : l₁ = l₂ := by
+  induction l₁ generalizing l₂ with
+  | nil => exact h.nil_eq
+  | cons a l₁ ih =>
+    match l₂, h₂, h with
+    | [], _, h => simp at h
+    | b :: l₂, h₂, h =>
+      have hab : a = b := by
+        -- each head is at most every element of the other list
+        obtain rfl | ha := List.mem_cons.1 (h.mem_iff.1 (.head _))
+        · rfl
+        obtain rfl | hb := List.mem_cons.1 (h.symm.mem_iff.1 (.head _))
+        · rfl
+        exact absurd (h₂.head _ ha) (by
+          rw [Std.OrientedCmp.gt_of_lt (h₁.head _ hb)]; simp)
+      subst hab
+      rw [ih h₁.of_cons h₂.of_cons ((List.perm_cons _).1 h)]
+
+/-- The variables the reconstruction records for the entry `(p, n)`: those of `n`, except the
+one the edge into the node already contributes. -/
+def NormLevel.treeVar (s : NormLevel) (p : List Name) (n : Node) : List VarNode :=
+  if let v :: _ := s.lexChain p.length p then subsumeVars n.var [⟨v, 0⟩] else n.var
+
+/-- The entry `(p, n)` is recorded in `t`: at the end of `p`'s chain sits a node carrying
+`n`'s constant and `treeVar p n`. -/
+def NormLevel.WrittenAt (s : NormLevel) (t : Tree) (p : List Name) (n : Node) : Prop :=
+  ∃ t', Tree.At t (s.lexChain p.length p) t' ∧ t'.const = n.const ∧ t'.var = s.treeVar p n
+
+theorem NormLevel.WrittenAt.write {s : NormLevel} (t : Tree) (p : List Name) (n : Node) :
+    s.WrittenAt (t.modify (s.lexChain p.length p)
+      fun t => { t with const := n.const, var := s.treeVar p n }) p n :=
+  let ⟨_, h⟩ := Tree.At_modify_self _ _ t
+  ⟨_, h, rfl, rfl⟩
+
+/-- Distinct keys get distinct chains, since `lexChain` only permutes a sorted key. -/
+theorem NormLevel.lexChain_inj {s : NormLevel} (h₁ : Sorted p) (h₂ : Sorted p')
+    (h : s.lexChain p.length p = s.lexChain p'.length p') : p = p' := by
+  refine Sorted.perm_eq h₁ h₂ ((lexChain_perm (s := s) (fuel := p.length) (p := p)).symm.trans ?_)
+  rw [h]; exact lexChain_perm
+
+/-- Conversely, everything the tree contains comes from an entry: every nonempty path is a
+tail of some key's chain, and the node at the end of a path is either empty scaffolding or
+the entry whose chain leads there. -/
+def NormLevel.Accounted (s : NormLevel) (t : Tree) : Prop :=
+  ∀ path t', Tree.At t path t' →
+    (path ≠ [] → ∃ p n, s.get? p = some n ∧ path <:+ s.lexChain p.length p) ∧
+    (t'.const = 0 ∧ t'.var = [] ∨ ∃ p n, s.get? p = some n ∧
+      path = s.lexChain p.length p ∧ t'.const = n.const ∧ t'.var = s.treeVar p n)
+
+/-- The single pass over the map that both directions of soundness read off: after the fold
+every entry is recorded at the end of its chain, and everything in the tree is accounted for
+by an entry. A write puts its own entry there (`At_modify_self`) and leaves the others alone,
+either because it lands on a different path — distinct keys have distinct chains — or because
+it lands on the same key, and then writes the same data. -/
+theorem NormLevel.toTree_spec {s : NormLevel} (hsort : ∀ p n, s.get? p = some n → Sorted p) :
+    s.Accounted (toTree s) ∧ ∀ p n, s.get? p = some n → s.WrittenAt (toTree s) p n := by
+  rw [toTree, Std.TreeMap.foldl_eq_foldl_toList]
+  have hmem : ∀ pn : List Name × Node, pn ∈ s.toList ↔ s.get? pn.1 = some pn.2 := fun _ =>
+    Std.TreeMap.mem_toList_iff_getElem?_eq_some.trans (by rw [Std.TreeMap.get?_eq_getElem?])
+  have hinit : s.Accounted ⟨0, [], []⟩ := fun path t' h => by
+    obtain ⟨rfl, rfl⟩ := h.of_child_nil rfl
+    exact ⟨fun h => absurd rfl h, .inl ⟨rfl, rfl⟩⟩
+  suffices ∀ (l : List (List Name × Node)) (t : Tree),
+      (∀ pn ∈ l, s.get? pn.1 = some pn.2) → s.Accounted t →
+      s.Accounted (List.foldl (fun t pn =>
+        let path := s.lexChain pn.1.length pn.1
+        let var := if let v :: _ := path then subsumeVars pn.2.var [⟨v, 0⟩] else pn.2.var
+        t.modify path fun t => { t with const := pn.2.const, var }) t l) ∧
+      ∀ p n, s.get? p = some n → (s.WrittenAt t p n ∨ (p, n) ∈ l) →
+      s.WrittenAt (List.foldl (fun t pn =>
+        let path := s.lexChain pn.1.length pn.1
+        let var := if let v :: _ := path then subsumeVars pn.2.var [⟨v, 0⟩] else pn.2.var
+        t.modify path fun t => { t with const := pn.2.const, var }) t l) p n by
+    have := this _ _ (fun pn h => (hmem pn).1 h) hinit
+    exact ⟨this.1, fun p n hp => this.2 p n hp (.inr ((hmem (p, n)).2 hp))⟩
+  clear hmem hinit; intro l
+  induction l with
+  | nil => exact fun _ _ h => ⟨h, fun _ _ _ h => h.resolve_right (by simp)⟩
+  | cons pn l ih =>
+    obtain ⟨p', n'⟩ := pn
+    intro t hl hacc
+    have hp' : s.get? p' = some n' := hl _ (.head _)
+    refine (ih _ (fun _ h => hl _ (.tail _ h)) ?_).imp id fun H p n hp h => H p n hp ?_
+    · -- nothing unaccounted for appears: the write adds its own node and empty scaffolding
+      intro path t' h
+      obtain ⟨rfl, t₀, rfl⟩ | ⟨hs, hc, hv⟩ | ⟨t'', h'', hc, hv⟩ :=
+        Tree.At_modify_inv (g := fun t =>
+          { t with const := n'.const, var := s.treeVar p' n' }) (fun _ => rfl) h
+      · exact ⟨fun _ => ⟨p', n', hp', List.suffix_refl _⟩, .inr ⟨p', n', hp', rfl, rfl, rfl⟩⟩
+      · exact ⟨fun _ => ⟨p', n', hp', hs⟩, .inl ⟨hc, hv⟩⟩
+      · exact ⟨(hacc _ _ h'').1, by rw [hc, hv]; exact (hacc _ _ h'').2⟩
+    · -- and nothing already written is lost
+      obtain ⟨t', hat, hc, hv⟩ | h := h
+      · refine .inl ?_
+        by_cases hpp : p = p'
+        · subst hpp; cases hp.symm.trans hp'; exact .write ..
+        · obtain ⟨t'', hat', hc', hv'⟩ := Tree.At_modify_of_ne (g := fun t =>
+            { t with const := n'.const, var := s.treeVar p' n' }) (fun _ => rfl)
+            (fun he => hpp (lexChain_inj (hsort _ _ hp) (hsort _ _ hp') he)) hat
+          exact ⟨t'', hat', hc' ▸ hc, hv' ▸ hv⟩
+      · obtain h | h := List.mem_cons.1 h
+        · simp only [Prod.mk.injEq] at h
+          obtain ⟨rfl, rfl⟩ := h
+          exact .inl (.write ..)
+        · exact .inr h
+
+/-- What the reconstruction contributes, as a biconditional: the tree is bounded by `m`
+exactly when for every entry the node the tree records for it is, and so is every edge of its
+chain. Nothing here is about domination, so no hypothesis on the chains is needed. -/
+theorem NormLevel.toTree_le_iff {s : NormLevel} (hsort : ∀ p n, s.get? p = some n → Sorted p)
+    {m : Nat} : Tree.eval ls ρ (toTree s) ≤ m ↔
+      ∀ p n, s.get? p = some n →
+        evalPath ls ρ (s.lexChain p.length p) (Node.eval ls ρ ⟨n.const, s.treeVar p n⟩) ≤ m ∧
+        ∀ a q, a :: q <:+ s.lexChain p.length p →
+          evalPath ls ρ (a :: q) (evalParam ls ρ a) ≤ m := by
+  obtain ⟨hacc, hwr⟩ := toTree_spec hsort
+  rw [Tree.eval_le_iff]
+  refine ⟨fun ⟨h1, h2⟩ p n hp => ?_, fun H => ⟨fun path t' hat => ?_, fun a q t' hat => ?_⟩⟩
+  · obtain ⟨t', hat, hc, hv⟩ := hwr p n hp
+    refine ⟨by rw [← hc, ← hv]; exact h1 _ _ hat, fun a q hq => ?_⟩
+    obtain ⟨t'', hat''⟩ := hat.suffix hq
+    exact h2 _ _ _ hat''
+  · obtain ⟨-, ⟨hc, hv⟩ | ⟨p, n, hp, rfl, hc, hv⟩⟩ := hacc _ _ hat
+    · rw [show Node.eval ls ρ ⟨t'.const, t'.var⟩ = 0 from by simp [Node.eval, hc, hv]]
+      simp [evalPath]
+    · rw [hc, hv]; exact (H p n hp).1
+  · obtain ⟨p, n, hp, hsuf⟩ := (hacc _ _ hat).1 (by simp)
+    exact (H p n hp).2 _ _ hsuf
+
+/-- Soundness of the reconstruction: the tree built from a normal form, hence the level it
+reifies to, evaluates like the normal form. Below, because the node recorded for an entry
+carries a subset of its sublevels and every edge is dominated, `lexChain` emitting only
+admissible chains; above, because the one sublevel the node omits, `V(p, v, 0)` for the
+innermost element of the chain, is what the edge into it contributes. -/
+theorem NormLevel.toTree_eval {s : NormLevel} (hsort : ∀ p n, s.get? p = some n → Sorted p)
+    (hfeas : ∀ p, s.contains p → s.Feas [] p) :
+    Tree.eval ls ρ (toTree s) = s.eval ls ρ := by
+  refine ext_le fun m => (toTree_le_iff hsort).trans (Iff.trans ?_ NormLevel.eval_le.symm)
+  refine ⟨fun H p n hp => ?_, fun H p n hp => ⟨?_, fun a q hq => ?_⟩⟩
+  · -- the entry is the node the tree records for it, plus the edge into that node
+    rw [← evalPath_perm (lexChain_perm (s := s) (fuel := p.length) (p := p))]
+    refine evalPath_le.2 fun nz => ?_
+    have h1 := evalPath_le.1 (H p n hp).1 nz
+    rw [Node.eval_le] at h1 ⊢
+    refine ⟨h1.1, ?_⟩
+    rw [NormLevel.treeVar] at h1
+    split at h1
+    · rename_i v q hch
+      refine (subsumeVars_eval ?_).1 h1.2
+      simp only [List.mem_singleton, VarNode.eval]
+      rintro _ rfl
+      exact evalPath_le.1 ((H p n hp).2 v q (by rw [hch]; exact List.suffix_refl _)) (hch ▸ nz)
+    · exact h1.2
+  · -- the recorded node is part of the entry
+    rw [evalPath_perm (lexChain_perm (s := s) (fuel := p.length) (p := p))]
+    refine Nat.le_trans (evalPath_mono ?_) (H p n hp)
+    refine Node.eval_le.2 ⟨Node.const_le_eval (l := n), fun v hv => Node.var_le_eval ?_⟩
+    revert hv; rw [NormLevel.treeVar]; split
+    · exact subsumeVars_subset
+    · exact id
+  · -- and every edge of the chain is dominated by an entry
+    have hcon : s.contains p := Std.TreeMap.isSome_getElem?_eq_contains.symm.trans
+      (by simp [Std.TreeMap.get?_eq_getElem?] at hp; simp [hp])
+    obtain ⟨-, hadm⟩ := lexChain_spec hsort (Nat.le_refl _) (hsort _ _ hp) (hfeas _ hcon)
+    exact Nat.le_trans (hadm.suffix hq).le (NormLevel.eval_le.2 H)
+
+/-!
+### Completeness
+
+`geq'` and `isEquiv'` are not only sound but complete: `NormLevel.le` detects every semantic
+inequality between normal forms, and semantically equal levels have equal normal forms. The
+key is a converse to Theorem 39 (`NormLevel.le_eval`): evaluating at a valuation tailored to
+a single sublevel shows that a semantic bound forces a syntactic dominator among the
+sublevels of the bounding form (`separation`). Completeness of `le` then follows because the
+`subsumeBy` fold removes exactly the dominated sublevels, and canonicity because
+`subsumption` leaves no sublevel dominated by another slot (`Reduced`), so mutual domination
+forces the two maps to be equal.
+-/
+
+/-- The variable lists of nodes are strictly sorted by variable name. -/
+def VarsSorted (l : List VarNode) : Prop := l.Pairwise (compare ·.var ·.var = .lt)
+
+theorem VarsSorted.of_cons (h : VarsSorted (v :: l)) : VarsSorted l := (List.pairwise_cons.1 h).2
+
+theorem VarsSorted.head (h : VarsSorted (v :: l)) : ∀ x ∈ l, compare v.var x.var = .lt :=
+  (List.pairwise_cons.1 h).1
+
+/-- In a sorted variable list, the name determines the entry. -/
+theorem VarsSorted.eq_of_var_eq (h : VarsSorted l) (h₁ : x ∈ l) (h₂ : y ∈ l)
+    (e : x.var = y.var) : x = y := by
+  induction l with | nil => cases h₁ | cons v l ih
+  obtain rfl | h₁' := List.mem_cons.1 h₁
+  · obtain rfl | h₂' := List.mem_cons.1 h₂
+    · rfl
+    · have := h.head _ h₂'; rw [e, Std.ReflOrd.compare_self] at this; cases this
+  · obtain rfl | h₂' := List.mem_cons.1 h₂
+    · have := h.head _ h₁'; rw [← e, Std.ReflOrd.compare_self] at this; cases this
+    · exact ih h.of_cons h₁' h₂'
+
+theorem VarNode.mem_addVar' (h : x ∈ VarNode.addVar v k l) : x.var = v ∨ x ∈ l := by
+  induction l with
+  | nil => simp [addVar] at h; simp [h]
+  | cons y l ih =>
+    simp only [addVar] at h
+    split at h
+    · rcases List.mem_cons.1 h with rfl | h <;> simp [h]
+    · rcases List.mem_cons.1 h with rfl | h <;> simp [h]
+    · rcases List.mem_cons.1 h with rfl | h
+      · simp
+      · exact (ih h).imp_right (.tail _)
+
+theorem VarNode.addVar_sorted (h : VarsSorted l) : VarsSorted (VarNode.addVar v k l) := by
+  induction l with | nil => exact .cons (by simp) .nil | cons x l ih
+  simp only [addVar]
+  split <;> rename_i hc
+  · refine .cons (fun y hy => ?_) h
+    obtain rfl | hy := List.mem_cons.1 hy
+    · exact hc
+    · exact Std.TransCmp.lt_trans hc (h.head _ hy)
+  · rw [Std.LawfulBEqCmp.compare_eq_iff_beq] at hc
+    have e := eq_of_beq hc
+    exact .cons (fun y hy => by rw [e]; exact h.head _ hy) h.of_cons
+  · refine .cons (fun y hy => ?_) (ih h.of_cons)
+    obtain e | hy := VarNode.mem_addVar' hy
+    · rw [e]; exact Std.OrientedCmp.lt_of_gt hc
+    · exact h.head _ hy
+
+/-- Every node of the map has its variable list sorted by name. -/
+def NormLevel.SortedVars (s : NormLevel) : Prop :=
+  ∀ p n, s.get? p = some n → VarsSorted n.var
+
+theorem NormLevel.addVar_sortedVars (h : acc.SortedVars) :
+    (addVar v k path acc).SortedVars := by
+  intro p n hn
+  simp only [addVar, Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_modify] at hn
+  split at hn
+  · obtain ⟨n', hn', rfl⟩ := Option.map_eq_some_iff.1 hn
+    exact VarNode.addVar_sorted (h path n' (Std.TreeMap.get?_eq_getElem? .. ▸ hn'))
+  · exact h _ _ (Std.TreeMap.get?_eq_getElem? .. ▸ hn)
+
+theorem NormLevel.addNode_sortedVars (h : acc.SortedVars) :
+    (addNode v k path acc).SortedVars := by
+  intro p n hn
+  simp only [addNode, Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_alter] at hn
+  split at hn
+  · match e : acc[path]?, hn with
+    | some n', hn =>
+      cases hn; exact VarNode.addVar_sorted (h path n' (Std.TreeMap.get?_eq_getElem? .. ▸ e))
+    | none, hn => cases hn; exact .cons (by simp) .nil
+  · exact h _ _ (Std.TreeMap.get?_eq_getElem? .. ▸ hn)
+
+theorem NormLevel.addConst_sortedVars (h : acc.SortedVars) :
+    (addConst k path acc).SortedVars := by
+  intro p n hn
+  simp only [addConst] at hn; split at hn <;> [exact h _ _ hn; skip]
+  simp only [Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_alter] at hn
+  split at hn
+  · match e : acc[path]?, hn with
+    | some n', hn => cases hn; exact h path n' (Std.TreeMap.get?_eq_getElem? .. ▸ e)
+    | none, hn => cases hn; exact .nil
+  · exact h _ _ (Std.TreeMap.get?_eq_getElem? .. ▸ hn)
+
+theorem normalizeAux_sortedVars (h : acc.SortedVars) :
+    (normalizeAux u path k acc).SortedVars := by
+  unfold normalizeAux; split
+  · exact NormLevel.addConst_sortedVars h
+  · exact NormLevel.addConst_sortedVars h
+  · exact normalizeAux_sortedVars h
+  · exact normalizeAux_sortedVars (normalizeAux_sortedVars h)
+  · exact normalizeAux_sortedVars (normalizeAux_sortedVars h)
+  · exact normalizeAux_sortedVars (normalizeAux_sortedVars h)
+  · exact normalizeAux_sortedVars (normalizeAux_sortedVars h)
+  · split <;> [skip; (dsimp; split)]
+    · exact normalizeAux_sortedVars
+        (NormLevel.addNode_sortedVars (NormLevel.addConst_sortedVars h))
+    · exact normalizeAux_sortedVars h
+    · exact normalizeAux_sortedVars (NormLevel.addVar_sortedVars h)
+  · exact h
+  · exact h
+  · split <;> [skip; split]
+    · exact NormLevel.addNode_sortedVars (NormLevel.addConst_sortedVars h)
+    · exact h
+    · exact NormLevel.addVar_sortedVars h
+
+theorem subsumeVars_sublist : ∀ vs₁ vs₂ : List VarNode, List.Sublist (subsumeVars vs₁ vs₂) vs₁
+  | [], _ => by simp [subsumeVars]
+  | _ :: _, [] => by simp [subsumeVars]
+  | x :: xs, y :: ys => by
+    simp only [subsumeVars]; split
+    · exact (subsumeVars_sublist xs (y :: ys)).cons_cons x
+    · split
+      · exact (subsumeVars_sublist xs ys).cons x
+      · exact (subsumeVars_sublist xs ys).cons_cons x
+    · exact subsumeVars_sublist (x :: xs) ys
+
+theorem Node.subsume_var_sublist : List.Sublist (Node.subsume p₁ n₁ p₂ n₂).var n₁.var := by
+  obtain h | ⟨-, -, h⟩ := Node.subsume_var_cases p₁ n₁ p₂ n₂ <;> rw [h]
+  · exact List.Sublist.refl _
+  · exact subsumeVars_sublist ..
+
+theorem NormLevel.minimize_var_sublist {acc : NormLevel} :
+    List.Sublist (acc.minimize p₁ n₁).var n₁.var := by
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList]
+  generalize acc.toList = l
+  induction l generalizing n₁ with | nil => exact List.Sublist.refl _ | cons a l ih
+  exact (ih (n₁ := Node.subsume p₁ n₁ a.1 a.2)).trans Node.subsume_var_sublist
+
+theorem NormLevel.subsumption_sortedVars {s : NormLevel} (hs : s.SortedVars) :
+    s.subsumption.SortedVars := by
+  rw [subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  have hmem pn (h : pn ∈ s.toList) : s.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  generalize s.toList = l at hmem
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (∀ pn ∈ l, s.get? pn.1 = some pn.2) → acc.SortedVars →
+      ∀ p n, (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).get? p = some n →
+        VarsSorted n.var from this _ _ hmem hs
+  clear hmem; intro l
+  induction l with | nil => exact fun _ _ => id | cons pn l ih
+  intro acc hl hacc
+  refine ih _ (fun _ h => hl _ (.tail _ h)) fun p n h => ?_
+  rw [subsumption_step_get?] at h
+  split at h
+  · split at h <;> [cases h; skip]
+    cases h; rename_i hp _; subst hp
+    exact (hs _ _ (hl _ (.head _))).sublist minimize_var_sublist
+  · exact hacc _ _ h
+
+theorem normalize_sortedVars : (normalize u).SortedVars :=
+  NormLevel.subsumption_sortedVars (normalizeAux_sortedVars fun p n h => by simp at h)
+
+/-- `subsumption` erases a key rather than leaving an empty node behind. -/
+theorem NormLevel.subsumption_nonempty {s : NormLevel} :
+    ∀ p n, s.subsumption.get? p = some n → n.isEmpty = false := by
+  rw [subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (∀ p n, acc.get? p = some n → n.isEmpty = false ∨ (p, n) ∈ l) →
+      ∀ p n, (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).get? p = some n →
+        n.isEmpty = false from
+    this _ _ fun p n h => .inr (Std.TreeMap.mem_toList_iff_getElem?_eq_some.2
+      (Std.TreeMap.get?_eq_getElem? .. ▸ h))
+  intro l
+  induction l with
+  | nil => exact fun acc h p n hn => (h p n hn).resolve_right (by simp)
+  | cons pn l ih =>
+    intro acc hacc
+    refine ih _ fun p n h => ?_
+    rw [subsumption_step_get?] at h
+    split at h <;> rename_i hp
+    · split at h <;> [cases h; skip]
+      cases h; rename_i he; exact .inl (by simpa using he)
+    · refine (hacc _ _ h).imp_right fun hm => ?_
+      obtain h' | h' := List.mem_cons.1 hm
+      · exact absurd (congrArg Prod.fst h'.symm) hp
+      · exact h'
+
+theorem normalize_nonempty : ∀ p n, (normalize u).get? p = some n → n.isEmpty = false :=
+  NormLevel.subsumption_nonempty
+
+theorem NormLevel.addVar_keys (h : (addVar v k path acc).contains p) : acc.contains p := by
+  simpa [addVar, Std.TreeMap.mem_modify] using h
+
+theorem NormLevel.addNode_keys (h : (addNode v k path acc).contains p) :
+    p = path ∨ acc.contains p := by
+  rw [addNode, Std.TreeMap.contains_alter] at h
+  split at h
+  · rename_i hc
+    exact .inl (eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 hc)).symm
+  · exact .inr h
+
+theorem NormLevel.addConst_keys (h : (addConst k path acc).contains p) :
+    p = path ∨ acc.contains p := by
+  rw [addConst] at h; split at h <;> [exact .inr h; skip]
+  rw [Std.TreeMap.contains_alter] at h
+  split at h
+  · rename_i hc
+    exact .inl (eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 hc)).symm
+  · exact .inr h
+
+/-- All keys of the map built by `normalizeAux` consist of level parameters, which are
+in `ls` whenever `ofLevel` succeeds. -/
+theorem normalizeAux_keys (hu : VLevel.ofLevel ls u = some u')
+    (hpath : ∀ x ∈ path, x ∈ ls) (hacc : ∀ p, acc.contains p → ∀ x ∈ p, x ∈ ls) :
+    ∀ p, (normalizeAux u path k acc).contains p → ∀ x ∈ p, x ∈ ls := by
+  unfold normalizeAux; split
+  · exact fun p h => (NormLevel.addConst_keys h).elim
+      (fun e x hx => hpath x (e ▸ hx)) (hacc p)
+  · exact fun p h => (NormLevel.addConst_keys h).elim
+      (fun e x hx => hpath x (e ▸ hx)) (hacc p)
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, rfl⟩ := hu
+    exact normalizeAux_keys hu hpath hacc
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, hv, rfl⟩ := hu
+    exact normalizeAux_keys hv hpath (normalizeAux_keys hu hpath hacc)
+  · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨_, hv, rfl⟩, rfl⟩ := hu
+    exact normalizeAux_keys hv hpath (normalizeAux_keys hu hpath hacc)
+  · rename_i u v w
+    simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨_, hv, _, hw, rfl⟩, rfl⟩ := hu
+    exact normalizeAux_keys (by simpa [VLevel.ofLevel] using ⟨_, hu, _, hw, rfl⟩) hpath
+      (normalizeAux_keys (by simpa [VLevel.ofLevel] using ⟨_, hu, _, hv, rfl⟩) hpath hacc)
+  · rename_i u v w
+    simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨_, hv, _, hw, rfl⟩, rfl⟩ := hu
+    exact normalizeAux_keys (by simpa [VLevel.ofLevel] using ⟨_, hv, _, hw, rfl⟩) hpath
+      (normalizeAux_keys (by simpa [VLevel.ofLevel] using ⟨_, hu, _, hw, rfl⟩) hpath hacc)
+  · rename_i u v
+    simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, _, ⟨hv, rfl⟩, rfl⟩ := hu
+    have hvls : v ∈ ls := List.idxOf_lt_length_iff.1 hv
+    split <;> rename_i h
+    · refine normalizeAux_keys hu (fun x hx => ?_) fun q hq => ?_
+      · exact ((Extend1.orderedInsert h).mem.1 hx).elim (fun e => e.symm ▸ hvls) (hpath x)
+      · obtain e | hq' := NormLevel.addNode_keys hq
+        · exact fun x hx => by
+            rcases (Extend1.orderedInsert h).mem.1 (e ▸ hx) with rfl | hx'
+            · exact hvls
+            · exact hpath x hx'
+        · exact (NormLevel.addConst_keys hq').elim
+            (fun e x hx => hpath x (e ▸ hx)) (hacc q)
+    · dsimp; split
+      · exact normalizeAux_keys hu hpath hacc
+      · exact normalizeAux_keys hu hpath fun q hq => hacc q (NormLevel.addVar_keys hq)
+  · exact hacc
+  · exact hacc
+  · rename_i v
+    simp [VLevel.ofLevel] at hu; obtain ⟨hv, rfl⟩ := hu
+    have hvls : v ∈ ls := List.idxOf_lt_length_iff.1 hv
+    split <;> rename_i h
+    · intro q hq
+      obtain e | hq' := NormLevel.addNode_keys hq
+      · exact fun x hx => by
+          rcases (Extend1.orderedInsert h).mem.1 (e ▸ hx) with rfl | hx'
+          · exact hvls
+          · exact hpath x hx'
+      · exact (NormLevel.addConst_keys hq').elim
+          (fun e x hx => hpath x (e ▸ hx)) (hacc q)
+    · split
+      · exact hacc
+      · exact fun q hq => hacc q (NormLevel.addVar_keys hq)
+
+theorem normalize_keys (hu : VLevel.ofLevel ls u = some u') :
+    ∀ p n, (normalize u).get? p = some n → ∀ x ∈ p, x ∈ ls := by
+  intro p n h
+  obtain ⟨n₀, h₀, -⟩ := NormLevel.subsumption_covers.1 p n h
+  have hc : (normalizeAux u [] 0 {}).contains p :=
+    Std.TreeMap.isSome_getElem?_eq_contains.symm.trans
+      (by simp [Std.TreeMap.get?_eq_getElem?] at h₀; simp [h₀])
+  exact normalizeAux_keys hu (by simp) (fun q hq => by simp at hq) p hc
+
+/-- A single sublevel of the canonical form: `Sub.const p k` is `C(p, k)` and
+`Sub.var p x k` is `V(p, x, k)`. -/
+inductive Sub where
+  | const (p : List Name) (k : Nat)
+  | var (p : List Name) (x : Name) (k : Nat)
+
+def Sub.path : Sub → List Name
+  | .const p _ => p
+  | .var p _ _ => p
+
+/-- Domination of sublevels, following Theorem 39: `s.le t` when `t`'s value bounds `s`'s
+value under every valuation. The dominator's condition set is a *subset*, so that it fires
+whenever the dominated sublevel does; a constant is dominated by `V(F, x, K)` up to `K + 1`
+since that sublevel is at least `K + 1` whenever its conditions hold; and a variable
+sublevel is only dominated by the same variable at a larger offset. -/
+protected def Sub.le : Sub → Sub → Prop
+  | .const p k, .const q l => (∀ z ∈ q, z ∈ p) ∧ k ≤ l
+  | .const p k, .var q _ l => (∀ z ∈ q, z ∈ p) ∧ k ≤ l + 1
+  | .var _ _ _, .const _ _ => False
+  | .var p x k, .var q y l => (∀ z ∈ q, z ∈ p) ∧ x = y ∧ k ≤ l
+
+protected theorem Sub.le.trans : ∀ {a b c : Sub}, a.le b → b.le c → a.le c
+  | .const _ _, .const _ _, .const _ _, ⟨s₁, h₁⟩, ⟨s₂, h₂⟩ =>
+    ⟨fun z hz => s₁ _ (s₂ _ hz), Nat.le_trans h₁ h₂⟩
+  | .const _ _, .const _ _, .var _ _ _, ⟨s₁, h₁⟩, ⟨s₂, h₂⟩ =>
+    ⟨fun z hz => s₁ _ (s₂ _ hz), by omega⟩
+  | .const _ _, .var _ _ _, .const _ _, _, h₂ => h₂.elim
+  | .const _ _, .var _ _ _, .var _ _ _, ⟨s₁, h₁⟩, ⟨s₂, _, h₂⟩ =>
+    ⟨fun z hz => s₁ _ (s₂ _ hz), by omega⟩
+  | .var _ _ _, .const _ _, _, h₁, _ => h₁.elim
+  | .var _ _ _, .var _ _ _, .const _ _, _, h₂ => h₂.elim
+  | .var _ _ _, .var _ _ _, .var _ _ _, ⟨s₁, e₁, h₁⟩, ⟨s₂, e₂, h₂⟩ =>
+    ⟨fun z hz => s₁ _ (s₂ _ hz), e₁.trans e₂, Nat.le_trans h₁ h₂⟩
+
+theorem subset_antisymm (h₁ : Sorted l₁) (h₂ : Sorted l₂)
+    (h : ∀ z ∈ l₁, z ∈ l₂) (h' : ∀ z ∈ l₂, z ∈ l₁) : l₁ = l₂ :=
+  subset_eq (subset_of_sorted h₁ h₂ h) <|
+    Nat.le_antisymm (subset_length (subset_of_sorted h₁ h₂ h))
+      (subset_length (subset_of_sorted h₂ h₁ h'))
+
+protected theorem Sub.le.antisymm : ∀ {a b : Sub}, Sorted a.path → Sorted b.path →
+    a.le b → b.le a → a = b
+  | .const p _, .const q _, ha, hb, ⟨s₁, h₁⟩, ⟨s₂, h₂⟩ => by
+    rw [subset_antisymm (l₁ := p) (l₂ := q) ha hb s₂ s₁, Nat.le_antisymm h₁ h₂]
+  | .const _ _, .var _ _ _, _, _, _, h₂ => h₂.elim
+  | .var _ _ _, .const _ _, _, _, h₁, _ => h₁.elim
+  | .var p _ _, .var q _ _, ha, hb, ⟨s₁, e₁, h₁⟩, ⟨s₂, e₂, h₂⟩ => by
+    rw [subset_antisymm (l₁ := p) (l₂ := q) ha hb s₂ s₁, e₁, Nat.le_antisymm h₁ h₂]
+
+/-- The sublevels recorded in a `NormLevel`: `C(p, n.const)` for nonzero constants and
+`V(p, x, k)` for each recorded variable. -/
+def NormLevel.HasSub (s : NormLevel) : Sub → Prop
+  | .const p k => ∃ n, s.get? p = some n ∧ n.const = k ∧ k ≠ 0
+  | .var p x k => ∃ n, s.get? p = some n ∧ ⟨x, k⟩ ∈ n.var
+
+variable (ls : List Name) (ρ : List Nat) in
+def Sub.eval : Sub → Nat
+  | .const p k => evalPath ls ρ p k
+  | .var p x k => evalPath ls ρ p (evalParam ls ρ x + k)
+
+theorem NormLevel.HasSub.le_eval {s : NormLevel} : ∀ {t}, s.HasSub t →
+    t.eval ls ρ ≤ s.eval ls ρ
+  | .const _ _, ⟨_, hn, hk, _⟩ =>
+    Nat.le_trans (evalPath_mono (hk ▸ Node.const_le_eval))
+      (NormLevel.eval_le.1 (Nat.le_refl _) _ _ hn)
+  | .var _ _ _, ⟨_, hn, hx⟩ =>
+    Nat.le_trans (evalPath_mono (Node.var_le_eval hx))
+      (NormLevel.eval_le.1 (Nat.le_refl _) _ _ hn)
+
+theorem NormLevel.lt_eval {s : NormLevel} :
+    m < eval ls ρ s ↔ ∃ p n, s.get? p = some n ∧ m < evalPath ls ρ p (Node.eval ls ρ n) := by
+  refine ⟨fun h => ?_, fun ⟨p, n, hn, hlt⟩ =>
+    Nat.lt_of_lt_of_le hlt (NormLevel.eval_le.1 (Nat.le_refl _) _ _ hn)⟩
+  refine Classical.byContradiction fun hc => ?_
+  exact absurd (eval_le.2 fun p n hn => Nat.not_lt.1 fun hlt => hc ⟨p, n, hn, hlt⟩)
+    (Nat.not_le.2 h)
+
+theorem Node.lt_eval {n : Node} :
+    m < Node.eval ls ρ n ↔ m < n.const ∨ ∃ v ∈ n.var, m < VarNode.eval ls ρ v := by
+  refine ⟨fun h => ?_, fun h => ?_⟩
+  · refine Classical.byContradiction fun hc => ?_
+    rw [not_or] at hc; obtain ⟨h₁, h₂⟩ := hc
+    refine absurd (Node.eval_le.2 ⟨Nat.not_lt.1 h₁, fun v hv => Nat.not_lt.1 fun hlt => ?_⟩)
+      (Nat.not_le.2 h)
+    exact h₂ ⟨v, hv, hlt⟩
+  · obtain h | ⟨v, hv, h⟩ := h
+    · exact Nat.lt_of_lt_of_le h Node.const_le_eval
+    · exact Nat.lt_of_lt_of_le h (Node.var_le_eval hv)
+
+theorem lt_evalPath (h : m < evalPath ls ρ p n) : allNZ ls ρ p ∧ m < n := by
+  rw [evalPath] at h; split at h
+  · exact ⟨‹_›, h⟩
+  · exact absurd h (Nat.not_lt_zero m)
+
+theorem evalParam_map {f : Name → Nat} (hx : x ∈ ls) : evalParam ls (ls.map f) x = f x := by
+  have hv : ls.idxOf x < ls.length := List.idxOf_lt_length_iff.2 hx
+  rw [evalParam_eq hv, List.getElem?_map, List.getElem?_eq_getElem hv]
+  simp [List.getElem_idxOf]
+
+theorem evalParam_not_mem (hx : x ∉ ls) : evalParam ls ρ x = 0 := by
+  simp only [evalParam]
+  rw [if_neg fun h => hx (List.idxOf_lt_length_iff.1 h)]
+
+theorem evalParam_map_pos {f : Name → Nat} (h : 0 < evalParam ls (ls.map f) z) :
+    z ∈ ls ∧ 0 < f z := by
+  by_cases hz : z ∈ ls
+  · refine ⟨hz, ?_⟩; rwa [evalParam_map hz] at h
+  · rw [evalParam_not_mem hz] at h; exact absurd h (Nat.lt_irrefl 0)
+
+theorem evalParam_map_le {f : Name → Nat} (hb : f z ≤ c) :
+    evalParam ls (ls.map f) z ≤ c := by
+  by_cases hz : z ∈ ls
+  · rw [evalParam_map hz]; exact hb
+  · rw [evalParam_not_mem hz]; exact Nat.zero_le _
+
+theorem foldl_max_le {f : α → Nat} {m : Nat} : ∀ {l : List α} {i : Nat},
+    l.foldl (fun r a => max' r (f a)) i ≤ m ↔ i ≤ m ∧ ∀ a ∈ l, f a ≤ m
+  | [], _ => by simp
+  | a :: l, i => by simp [foldl_max_le (l := l), Nat.max_le, and_assoc]
+
+/-- A bound on all the constants and offsets appearing in the map. -/
+def Node.bound (n : Node) : Nat := n.var.foldl (fun r v => max' r v.offset) n.const
+
+def NormLevel.bound (s : NormLevel) : Nat := s.foldl (fun r _ n => max' r n.bound) 0
+
+theorem NormLevel.bound_spec {s : NormLevel} (h : s.get? p = some n) :
+    n.const ≤ s.bound ∧ ∀ v ∈ n.var, v.offset ≤ s.bound := by
+  have hmem := Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 (Std.TreeMap.get?_eq_getElem? .. ▸ h)
+  have hb : n.bound ≤ s.bound := by
+    rw [bound, Std.TreeMap.foldl_eq_foldl_toList]
+    exact ((foldl_max_le (f := fun pn : List Name × Node => pn.2.bound)).1
+      (Nat.le_refl _)).2 _ hmem
+  exact (foldl_max_le (f := fun v : VarNode => v.offset)).1 hb
+
+/-- The separation theorem, a converse to Theorem 39: if the value of `l₁` is bounded by the
+value of `l₂` under every valuation, then every sublevel of `l₁` has a syntactic dominator
+among the sublevels of `l₂`. The valuation exhibiting the dominator sets every variable of
+the sublevel's condition set to `1`, the sublevel's own variable (if any) to a value `N`
+larger than every constant and offset of `l₂`, and everything else to `0`: only entries of
+`l₂` at condition sets below the sublevel's can contribute, and only a sublevel with the
+same variable can reach `N`. -/
+theorem NormLevel.separation {l₁ l₂ : NormLevel}
+    (hls : ∀ p n, l₁.get? p = some n → ∀ x ∈ p, x ∈ ls)
+    (wf₁ : ∀ p n, l₁.get? p = some n → ∀ v ∈ n.var, v.var ∈ p)
+    (h : ∀ ρ, l₁.eval ls ρ ≤ l₂.eval ls ρ) :
+    ∀ t, l₁.HasSub t → ∃ t', l₂.HasSub t' ∧ t.le t' := by
+  intro t ht
+  match t, ht with
+  | .const p k, ⟨n, hn, hk, hk0⟩ =>
+    have hnz : allNZ ls (ls.map fun z => if z ∈ p then 1 else 0) p := by
+      simp only [allNZ, List.all_eq_true, decide_eq_true_eq]
+      intro z hz
+      rw [evalParam_map (hls _ _ hn _ hz)]; simp [hz]
+    have h₁ : k ≤ l₁.eval ls (ls.map fun z => if z ∈ p then 1 else 0) :=
+      Nat.le_trans (by simp [Sub.eval, evalPath, hnz])
+        (HasSub.le_eval (t := .const p k) ⟨n, hn, hk, hk0⟩)
+    have h₂ := NormLevel.lt_eval.1 (Nat.lt_of_lt_of_le (by omega : k - 1 < k)
+      (Nat.le_trans h₁ (h _)))
+    obtain ⟨q, m, hq, hlt⟩ := h₂
+    obtain ⟨hnzq, hlt⟩ := lt_evalPath hlt
+    have hsub : ∀ z ∈ q, z ∈ p := by
+      intro z hz
+      simp only [allNZ, List.all_eq_true, decide_eq_true_eq] at hnzq
+      have := (evalParam_map_pos (hnzq z hz)).2
+      split at this
+      · assumption
+      · exact absurd this (Nat.lt_irrefl 0)
+    obtain hc | ⟨v, hv, hvlt⟩ := Node.lt_eval.1 hlt
+    · exact ⟨.const q m.const, ⟨m, hq, rfl, by omega⟩, hsub, by omega⟩
+    · refine ⟨.var q v.var v.offset, ⟨m, hq, hv⟩, hsub, ?_⟩
+      have hev : evalParam ls (ls.map fun z => if z ∈ p then 1 else 0) v.var ≤ 1 :=
+        evalParam_map_le (by split <;> omega)
+      simp only [VarNode.eval] at hvlt
+      omega
+  | .var p x k, ⟨n, hn, hx⟩ =>
+    have hxp : x ∈ p := wf₁ _ _ hn _ hx
+    have hxls : x ∈ ls := hls _ _ hn _ hxp
+    have hnz : allNZ ls (ls.map fun z =>
+        if z = x then l₂.bound + k + 2 else if z ∈ p then 1 else 0) p := by
+      simp only [allNZ, List.all_eq_true, decide_eq_true_eq]
+      intro z hz
+      simp only [evalParam_map (hls _ _ hn _ hz)]
+      split
+      · omega
+      · omega
+    have h₁ : l₂.bound + k + 2 + k ≤ l₁.eval ls (ls.map fun z =>
+        if z = x then l₂.bound + k + 2 else if z ∈ p then 1 else 0) := by
+      refine Nat.le_trans ?_ (HasSub.le_eval (t := .var p x k) ⟨n, hn, hx⟩)
+      simp [Sub.eval, evalPath, hnz, evalParam_map hxls]
+    obtain ⟨q, m, hq, hlt⟩ := NormLevel.lt_eval.1
+      (Nat.lt_of_lt_of_le (by omega : l₂.bound + k + 2 + k - 1 < l₂.bound + k + 2 + k)
+        (Nat.le_trans h₁ (h _)))
+    obtain ⟨hnzq, hlt⟩ := lt_evalPath hlt
+    have hsub : ∀ z ∈ q, z ∈ p := by
+      intro z hz
+      simp only [allNZ, List.all_eq_true, decide_eq_true_eq] at hnzq
+      have := (evalParam_map_pos (hnzq z hz)).2
+      split at this
+      · rename_i hz'; subst hz'; exact hxp
+      · split at this
+        · assumption
+        · exact absurd this (Nat.lt_irrefl 0)
+    obtain hc | ⟨v, hv, hvlt⟩ := Node.lt_eval.1 hlt
+    · exact absurd hc (by have := (bound_spec hq).1; omega)
+    · by_cases hvx : v.var = x
+      · refine ⟨.var q x v.offset, ⟨m, hq, by rw [← hvx]; exact hv⟩, hsub, rfl, ?_⟩
+        simp [VarNode.eval, hvx, evalParam_map hxls] at hvlt
+        omega
+      · have hoff := (bound_spec hq).2 _ hv
+        have hev : evalParam ls (ls.map fun z =>
+            if z = x then l₂.bound + k + 2 else if z ∈ p then 1 else 0) v.var ≤ 1 :=
+          evalParam_map_le (by rw [if_neg hvx]; split <;> omega)
+        simp only [VarNode.eval] at hvlt
+        exact absurd hvlt (by omega)
+
+private theorem name_lt_ne {a b : Name} (h : compare a b = .lt) : a ≠ b := by
+  rintro rfl; rw [Std.ReflOrd.compare_self] at h; cases h
+
+/-- Exactness of `subsumeVars` on sorted lists: a surviving variable has no dominator
+in the subtracted list. -/
+theorem subsumeVars_complete {x y : VarNode} : ∀ {vs₁ vs₂ : List VarNode},
+    VarsSorted vs₁ → VarsSorted vs₂ → x ∈ subsumeVars vs₁ vs₂ → y ∈ vs₂ →
+    y.var = x.var → x.offset ≤ y.offset → False
+  | [], _, _, _, hx, _ => by simp [subsumeVars] at hx
+  | _ :: _, [], _, _, _, hy => nomatch hy
+  | a :: vs₁, b :: vs₂, h₁, h₂, hx, hy => by
+    intro e hle
+    simp only [subsumeVars] at hx
+    split at hx <;> rename_i hab
+    · rcases List.mem_cons.1 hx with rfl | hx'
+      · rcases List.mem_cons.1 hy with rfl | hy'
+        · exact name_lt_ne hab e.symm
+        · exact name_lt_ne (Std.TransCmp.lt_trans hab (h₂.head _ hy')) e.symm
+      · exact subsumeVars_complete h₁.of_cons h₂ hx' hy e hle
+    · have eab : a.var = b.var := eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 hab)
+      split at hx <;> rename_i hoff
+      · rcases List.mem_cons.1 hy with rfl | hy'
+        · exact name_lt_ne (h₁.head _ (subsumeVars_subset hx)) (eab.trans e)
+        · exact subsumeVars_complete h₁.of_cons h₂.of_cons hx hy' e hle
+      · rcases List.mem_cons.1 hx with rfl | hx'
+        · rcases List.mem_cons.1 hy with rfl | hy'
+          · exact hoff hle
+          · exact name_lt_ne (h₂.head _ hy') (e.trans eab).symm
+        · rcases List.mem_cons.1 hy with rfl | hy'
+          · exact name_lt_ne (h₁.head _ (subsumeVars_subset hx')) (eab.trans e)
+          · exact subsumeVars_complete h₁.of_cons h₂.of_cons hx' hy' e hle
+    · rcases List.mem_cons.1 hy with rfl | hy'
+      · have hbx : compare y.var x.var = .lt := by
+          have hba := Std.OrientedCmp.lt_of_gt hab
+          rcases List.mem_cons.1 (subsumeVars_subset hx) with rfl | hxv
+          · exact hba
+          · exact Std.TransCmp.lt_trans hba (h₁.head _ hxv)
+        exact name_lt_ne hbx e
+      · exact subsumeVars_complete h₁ h₂.of_cons hx hy' e hle
+
+theorem le_foldl_max_self {vs : List VarNode} : ∀ {n : Nat}, n ≤ vs.foldl (·.max ·.offset) n := by
+  induction vs with | nil => exact Nat.le_refl _ | cons a vs ih
+  exact fun {n} => Nat.le_trans (Nat.le_max_left _ _) ih
+
+theorem foldl_max_ge {vs : List VarNode} (hy : y ∈ vs) :
+    ∀ {n : Nat}, y.offset ≤ vs.foldl (·.max ·.offset) n := by
+  induction vs with | nil => cases hy | cons a vs ih
+  rcases List.mem_cons.1 hy with rfl | hy'
+  · exact fun {n} => Nat.le_trans (Nat.le_max_right _ _) le_foldl_max_self
+  · exact fun {n} => ih hy'
+
+/-- Exactness of the constant part of `subsumeBy`: a dominated constant is dropped. -/
+theorem Node.subsumeBy_const_complete {same : Bool} {n₁ n₂ : Node}
+    (h : (same = false ∧ n₁.const ≤ n₂.const) ∨ ∃ y ∈ n₂.var, n₁.const ≤ y.offset + 1) :
+    (n₁.subsumeBy same n₂).const = 0 := by
+  rw [Node.subsumeBy_const_eq]
+  split <;> [rename_i hc; rfl]
+  simp only [Bool.or_eq_true, Bool.and_eq_true, decide_eq_true_eq, List.isEmpty_iff] at hc
+  obtain hc | ⟨hc1, hc2⟩ := hc
+  · exact hc
+  obtain ⟨rfl, hle⟩ | ⟨y, hy, hle⟩ := h
+  · rcases hc1 with hc1 | hc1
+    · cases hc1
+    · omega
+  · rcases hc2 with hc2 | hc2
+    · rw [hc2] at hy; cases hy
+    · have := foldl_max_ge hy (n := 0); omega
+
+theorem Node.subsumeBy_var_sublist {same : Bool} {n₁ n₂ : Node} :
+    List.Sublist (n₁.subsumeBy same n₂).var n₁.var := by
+  rw [Node.subsumeBy_var_eq]; split
+  · exact List.Sublist.refl _
+  · exact subsumeVars_sublist ..
+
+/-- Exactness of the variable part of `subsumeBy` at a different key: a dominated variable
+is dropped. -/
+theorem Node.subsumeBy_var_complete {n₁ n₂ : Node} (h₁ : VarsSorted n₁.var)
+    (h₂ : VarsSorted n₂.var) (hx : x ∈ (n₁.subsumeBy false n₂).var) (hy : y ∈ n₂.var)
+    (e : y.var = x.var) (hle : x.offset ≤ y.offset) : False := by
+  rw [Node.subsumeBy_var_eq] at hx
+  split at hx <;> rename_i hc
+  · simp only [Bool.false_or, List.isEmpty_iff] at hc
+    rw [hc] at hy; cases hy
+  · exact subsumeVars_complete h₁ h₂ hx hy e hle
+
+/-- Completeness of the discharging fold in `NormLevel.le`: if every sublevel of `n₁` has a
+dominator among the entries of `l` at a subkey of `p₁`, the fold discharges everything and
+returns `none`. -/
+theorem NormLevel.le_fold_complete {p₁ : List Name} :
+    ∀ (l : List (List Name × Node)) (n₁ : Node), VarsSorted n₁.var →
+    (∀ pn ∈ l, VarsSorted pn.2.var) → n₁.isEmpty = false →
+    (n₁.const ≠ 0 → ∃ pn ∈ l, subset compare pn.1 p₁ ∧
+      (n₁.const ≤ pn.2.const ∨ ∃ y ∈ pn.2.var, n₁.const ≤ y.offset + 1)) →
+    (∀ x ∈ n₁.var, ∃ pn ∈ l, subset compare pn.1 p₁ ∧
+      ∃ y ∈ pn.2.var, y.var = x.var ∧ x.offset ≤ y.offset) →
+    List.foldlM (m := Option) (fun n pn =>
+      if subset compare pn.1 p₁ then
+        if (n.subsumeBy false pn.2).isEmpty then none else some (n.subsumeBy false pn.2)
+      else some n) n₁ l = none
+  | [], n₁, _, _, hne, hconst, hvar => by
+    rw [Node.isEmpty, Bool.and_eq_false_iff] at hne
+    obtain h0 | hv := hne
+    · obtain ⟨_, h, -⟩ := hconst (by simpa using h0)
+      cases h
+    · obtain ⟨x, hx⟩ := List.exists_mem_of_ne_nil _ (by simpa using hv)
+      obtain ⟨_, h, -⟩ := hvar x hx
+      cases h
+  | pn :: l, n₁, hvs₁, hvsl, hne, hconst, hvar => by
+    simp only [List.foldlM_cons]
+    split <;> rename_i hs
+    · by_cases he : (n₁.subsumeBy false pn.2).isEmpty <;> simp [he]
+      refine le_fold_complete l _ (hvs₁.sublist Node.subsumeBy_var_sublist)
+        (fun pn h => hvsl _ (.tail _ h)) (by simpa using he) ?_ ?_
+      · intro h0
+        have hc : (n₁.subsumeBy false pn.2).const = n₁.const :=
+          (Node.subsumeBy_const_cases ..).resolve_right h0
+        obtain ⟨pn', hpn', hsub', hdom'⟩ := hconst (hc ▸ h0)
+        rcases List.mem_cons.1 hpn' with rfl | hpn'
+        · exact absurd (Node.subsumeBy_const_complete
+            (hdom'.imp (fun h => ⟨rfl, h⟩) id)) h0
+        · exact ⟨pn', hpn', hsub', hc ▸ hdom'⟩
+      · intro x hx
+        obtain ⟨pn', hpn', hsub', y, hy, e, hle⟩ := hvar x (Node.subsumeBy_var_subset hx)
+        rcases List.mem_cons.1 hpn' with rfl | hpn'
+        · exact (Node.subsumeBy_var_complete hvs₁ (hvsl _ (.head _)) hx hy e hle).elim
+        · exact ⟨pn', hpn', hsub', y, hy, e, hle⟩
+    · refine le_fold_complete l n₁ hvs₁ (fun pn h => hvsl _ (.tail _ h)) hne
+        (fun h0 => ?_) (fun x hx => ?_)
+      · obtain ⟨pn', hpn', hsub', hdom'⟩ := hconst h0
+        rcases List.mem_cons.1 hpn' with rfl | hpn'
+        · exact absurd hsub' hs
+        · exact ⟨pn', hpn', hsub', hdom'⟩
+      · obtain ⟨pn', hpn', hsub', hy⟩ := hvar x hx
+        rcases List.mem_cons.1 hpn' with rfl | hpn'
+        · exact absurd hsub' hs
+        · exact ⟨pn', hpn', hsub', hy⟩
+
+/-- Completeness of `NormLevel.le`: per-sublevel domination implies acceptance. -/
+theorem NormLevel.le_complete {l₁ l₂ : NormLevel}
+    (hvs₁ : l₁.SortedVars) (hvs₂ : l₂.SortedVars)
+    (hne : ∀ p n, l₁.get? p = some n → n.isEmpty = false)
+    (hsort₁ : ∀ p n, l₁.get? p = some n → Sorted p)
+    (hsort₂ : ∀ p n, l₂.get? p = some n → Sorted p)
+    (hdom : ∀ t, l₁.HasSub t → ∃ t', l₂.HasSub t' ∧ t.le t') :
+    l₁.le l₂ := by
+  rw [NormLevel.le, Std.TreeMap.all_eq_all_toList, List.all_eq_true]
+  rintro ⟨p₁, n₁⟩ hmem
+  have h₁ := Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 hmem
+  simp only [Std.TreeMap.foldlM_eq_foldlM_toList, Option.isNone_iff_eq_none]
+  have hmem₂ : ∀ q m, l₂.get? q = some m → (q, m) ∈ l₂.toList := fun q m h =>
+    Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 (Std.TreeMap.get?_eq_getElem? .. ▸ h)
+  refine le_fold_complete l₂.toList n₁ (hvs₁ _ _ h₁)
+    (fun pn h => hvs₂ _ _ <| Std.TreeMap.get?_eq_getElem? .. ▸
+      Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h) (hne _ _ h₁) (fun h0 => ?_) (fun x hx => ?_)
+  · obtain ⟨t', ht', hle⟩ := hdom (.const p₁ n₁.const) ⟨n₁, h₁, rfl, h0⟩
+    match t', ht', hle with
+    | .const q _, ⟨m, hq, hc, _⟩, ⟨hsub, hle⟩ =>
+      exact ⟨(q, m), hmem₂ _ _ hq,
+        subset_of_sorted (hsort₂ _ _ hq) (hsort₁ _ _ h₁) hsub, .inl (hc ▸ hle)⟩
+    | .var q yv yk, ⟨m, hq, hyk⟩, ⟨hsub, hle⟩ =>
+      exact ⟨(q, m), hmem₂ _ _ hq,
+        subset_of_sorted (hsort₂ _ _ hq) (hsort₁ _ _ h₁) hsub, .inr ⟨⟨yv, yk⟩, hyk, hle⟩⟩
+  · obtain ⟨t', ht', hle⟩ := hdom (.var p₁ x.var x.offset) ⟨n₁, h₁, hx⟩
+    match t', ht', hle with
+    | .const _ _, _, hle => exact hle.elim
+    | .var q yv yk, ⟨m, hq, hyk⟩, ⟨hsub, hev, hle⟩ =>
+      exact ⟨(q, m), hmem₂ _ _ hq,
+        subset_of_sorted (hsort₂ _ _ hq) (hsort₁ _ _ h₁) hsub, ⟨yv, yk⟩, hyk, hev.symm, hle⟩
+
+/-- Two key-sorted entry lists with the same entries are equal. -/
+theorem sorted_pairs_eq : ∀ {l₁ l₂ : List (List Name × Node)},
+    l₁.Pairwise (compare ·.1 ·.1 = .lt) → l₂.Pairwise (compare ·.1 ·.1 = .lt) →
+    (∀ x, x ∈ l₁ ↔ x ∈ l₂) → l₁ = l₂
+  | [], [], _, _, _ => rfl
+  | [], _ :: _, _, _, h => nomatch (h _).2 (.head _)
+  | _ :: _, [], _, _, h => nomatch (h _).1 (.head _)
+  | a :: l₁, b :: l₂, h₁, h₂, h => by
+    have head₁ := (List.pairwise_cons.1 h₁).1
+    have head₂ := (List.pairwise_cons.1 h₂).1
+    cases show a = b by
+      rcases List.mem_cons.1 ((h a).1 (.head _)) with rfl | ha <;> [rfl; skip]
+      rcases List.mem_cons.1 ((h b).2 (.head _)) with rfl | hb <;> [rfl; skip]
+      cases Std.OrientedCmp.not_lt_of_lt (head₁ _ hb) (head₂ _ ha)
+    refine congrArg (a :: ·) (sorted_pairs_eq (List.pairwise_cons.1 h₁).2
+      (List.pairwise_cons.1 h₂).2 fun x => ⟨fun hx => ?_, fun hx => ?_⟩)
+    · rcases List.mem_cons.1 ((h x).1 (.tail _ hx)) with rfl | hx'
+      · have := head₁ _ hx; rw [Std.ReflOrd.compare_self] at this; cases this
+      · exact hx'
+    · rcases List.mem_cons.1 ((h x).2 (.tail _ hx)) with rfl | hx'
+      · have := head₂ _ hx; rw [Std.ReflOrd.compare_self] at this; cases this
+      · exact hx'
+
+/-! ### The flat fast path
+
+For a level with no essential `imax`, `normalize` produces a map with the constant at the
+root and one single-variable node per parameter (`NormLevel.Flat`), and `toTree` reads that
+off directly, so building the `NormLevel` can be skipped entirely. -/
+
+/-- The map `normalize` produces for a flat level, pointwise: `C(∅, c)` at the root, and
+`V({x}, x, k)` at each singleton key whose parameter is recorded in `vs`. -/
+def flatGet (c : Nat) (vs : List VarNode) : List Name → Option Node
+  | [] => if c = 0 then none else some ⟨c, []⟩
+  | [x] => (vs.find? (·.var == x)).map fun v => ⟨0, [v]⟩
+  | _ => none
+
+def NormLevel.Flat (s : NormLevel) (c : Nat) (vs : List VarNode) : Prop :=
+  ∀ p, s.get? p = flatGet c vs p
+
+theorem find?_var_eq_some {vs : List VarNode} {x : Name} {v : VarNode} (hvs : VarsSorted vs) :
+    vs.find? (·.var == x) = some v ↔ v ∈ vs ∧ v.var = x := by
+  refine ⟨fun h => ⟨List.mem_of_find?_eq_some h, by simpa using List.find?_some h⟩, ?_⟩
+  rintro ⟨hv, rfl⟩
+  match h : vs.find? (·.var == v.var) with
+  | none => simp [List.find?_eq_none] at h; exact absurd rfl (h _ hv)
+  | some w =>
+    have hw := List.mem_of_find?_eq_some h
+    have hwe : w.var = v.var := by simpa using List.find?_some h
+    rw [h, hvs.eq_of_var_eq hw hv hwe]
+
+theorem find?_var_eq_none {vs : List VarNode} {x : Name} :
+    vs.find? (·.var == x) = none ↔ ∀ v ∈ vs, v.var ≠ x := by
+  simp [List.find?_eq_none]
+
+/-- `addVar` raises the offset of the entry for `x`, leaving the rest alone. -/
+theorem VarNode.find?_addVar {vs : List VarNode} {x y : Name} {k : Nat} (hvs : VarsSorted vs) :
+    (VarNode.addVar x k vs).find? (·.var == y) =
+      if x = y then some ⟨x, ((vs.find? (·.var == x)).map (·.offset.max k)).getD k⟩
+      else vs.find? (·.var == y) := by
+  induction vs with | nil => split <;> simp [VarNode.addVar, *] | cons w l ih
+  simp only [VarNode.addVar]
+  split <;> rename_i hc
+  · have hnone : (w :: l).find? (·.var == x) = none := by
+      refine find?_var_eq_none.2 fun v hv => ?_
+      obtain rfl | hv := List.mem_cons.1 hv
+      · exact fun e => name_lt_ne hc e.symm
+      · exact fun e => name_lt_ne (Std.TransCmp.lt_trans hc (hvs.head _ hv)) e.symm
+    split <;> rename_i h
+    · subst h; rw [List.find?_cons_of_pos (by simp), hnone]; rfl
+    · rw [List.find?_cons_of_neg (by simp [h])]
+  · have e := eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 hc)
+    split <;> rename_i h
+    · subst h; rw [List.find?_cons_of_pos (by simp), List.find?_cons_of_pos (by simp [← e])]; rfl
+    · rw [List.find?_cons_of_neg (by simp [h]), List.find?_cons_of_neg (by simp [← e, h])]
+  · have hne := name_lt_ne (Std.OrientedCmp.lt_of_gt hc)
+    by_cases hy : w.var = y
+    · rw [if_neg (hy ▸ hne.symm), List.find?_cons_of_pos (by simp [hy]),
+        List.find?_cons_of_pos (by simp [hy])]
+    · rw [List.find?_cons_of_neg (by simp [hy]), ih hvs.of_cons,
+        List.find?_cons_of_neg (by simp [hne]), List.find?_cons_of_neg (by simp [hy])]
+
+theorem NormLevel.addConst_flat {s : NormLevel} {c k : Nat} {vs : List VarNode}
+    (h : s.Flat c vs) : (addConst k [] s).Flat (Nat.max c k) vs := by
+  by_cases hk : k = 0
+  · subst hk
+    rw [show Nat.max c 0 = c from Nat.max_zero c, NormLevel.addConst, if_pos (by simp)]
+    exact h
+  · rw [NormLevel.addConst, if_neg (by simp [hk])]
+    intro p
+    rw [Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_alter]
+    have hmax : ¬Nat.max c k = 0 := by simp only [Nat.max_eq_zero_iff]; simp [hk]
+    split <;> rename_i he
+    · cases eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 he)
+      rw [← Std.TreeMap.get?_eq_getElem?, h []]
+      simp only [flatGet]
+      by_cases hc0 : c = 0
+      · subst hc0
+        rw [if_pos rfl, if_neg hmax, show Nat.max 0 k = k from Nat.zero_max k]
+      · rw [if_neg hc0, if_neg hmax, show Nat.max c k = Nat.max k c from Nat.max_comm c k]
+    · rw [← Std.TreeMap.get?_eq_getElem?, h p]
+      match p with
+      | [] => cases he Std.ReflOrd.compare_self
+      | [_] | _ :: _ :: _ => rfl
+
+theorem NormLevel.addNode_flat {s : NormLevel} {c k : Nat} {vs : List VarNode} {x : Name}
+    (hvs : VarsSorted vs) (h : s.Flat c vs) :
+    (addNode x k [x] s).Flat c (VarNode.addVar x k vs) := by
+  intro p
+  rw [NormLevel.addNode, Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_alter]
+  split <;> rename_i he
+  · have hp : [x] = p := eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 he)
+    subst hp
+    rw [← Std.TreeMap.get?_eq_getElem?, h [x]]
+    simp only [flatGet]
+    rw [VarNode.find?_addVar hvs, if_pos rfl]
+    match hfd : vs.find? (·.var == x) with
+    | none => rw [hfd]; rfl
+    | some v =>
+      have hv : v.var = x := by simpa using List.find?_some hfd
+      rw [hfd]
+      show some ({ const := 0, var := VarNode.addVar x k [v] } : Node) = _
+      rw [show VarNode.addVar x k [v] = [⟨x, v.offset.max k⟩] from by
+        simp only [VarNode.addVar, hv, Std.ReflCmp.compare_self]]; rfl
+  · rw [← Std.TreeMap.get?_eq_getElem?, h p]
+    match p with
+    | [] => rfl
+    | [y] =>
+      have hxy : x ≠ y := by rintro rfl; exact he Std.ReflOrd.compare_self
+      simp only [flatGet]
+      rw [VarNode.find?_addVar hvs, if_neg hxy]
+    | _ :: _ :: _ => rfl
+
+/-- The entries of a flat map: the root carries the constant (and is absent when it is zero),
+and every other key is a singleton carrying one variable of `vs`. -/
+private theorem flatGet_eq_some {c : Nat} {vs : List VarNode} {p : List Name} {n : Node}
+    (h : flatGet c vs p = some n) :
+    (p = [] ∧ n = ⟨c, []⟩ ∧ c ≠ 0) ∨ ∃ v ∈ vs, p = [v.var] ∧ n = ⟨0, [v]⟩ := by
+  match p with
+  | [] =>
+    simp only [flatGet] at h
+    split at h
+    · cases h
+    · exact .inl ⟨rfl, by cases h; rfl, by assumption⟩
+  | [x] =>
+    simp only [flatGet, Option.map_eq_some_iff] at h
+    obtain ⟨v, hv, rfl⟩ := h
+    have hvx : v.var = x := by simpa using List.find?_some hv
+    exact .inr ⟨v, List.mem_of_find?_eq_some hv, by rw [hvx], rfl⟩
+  | _ :: _ :: _ => simp [flatGet] at h
+
+/-- `subsumeBy` is the identity when the constant has nothing to lose (it is zero, or the two
+sit at the same condition set and the dominator has no variables) and the variables have
+nothing to lose (same condition set, or no variables to be dominated by). -/
+private theorem Node.subsumeBy_id {same : Bool} {n₁ n₂ : Node}
+    (h₁ : n₁.const = 0 ∨ (same ∧ n₂.var = []))
+    (h₂ : same ∨ n₂.var = []) : n₁.subsumeBy same n₂ = n₁ := by
+  simp only [Node.subsumeBy]
+  rcases h₁ with hz | ⟨hs, hv⟩
+  · rcases h₂ with h2 | h2 <;> simp [hz, h2]
+  · simp [hs, hv]
+
+private theorem subsume_flat_id {c : Nat} {vs : List VarNode} {p₁ p₂ : List Name} {n₁ n₂ : Node}
+    (h₁ : flatGet c vs p₁ = some n₁) (h₂ : flatGet c vs p₂ = some n₂) :
+    Node.subsume p₁ n₁ p₂ n₂ = n₁ := by
+  rw [Node.subsume]
+  split <;> [rename_i hsub; rfl]
+  obtain ⟨rfl, rfl, -⟩ | ⟨v, -, rfl, rfl⟩ := flatGet_eq_some h₂
+  · obtain ⟨rfl, rfl, -⟩ | ⟨w, -, rfl, rfl⟩ := flatGet_eq_some h₁
+    · exact Node.subsumeBy_id (.inr ⟨rfl, rfl⟩) (.inl rfl)
+    · exact Node.subsumeBy_id (.inl rfl) (.inr rfl)
+  · obtain ⟨rfl, rfl, -⟩ | ⟨w, -, rfl, rfl⟩ := flatGet_eq_some h₁
+    · exact absurd hsub (by simp [subset])
+    · exact Node.subsumeBy_id (.inl rfl) (.inl rfl)
+
+/-- Nothing in a flat map subsumes anything: a condition set is empty or a singleton, and the
+node carrying the constant has no variables. -/
+theorem NormLevel.subsumption_flat {s : NormLevel} {c : Nat} {vs : List VarNode}
+    (h : s.Flat c vs) : s.subsumption.Flat c vs := by
+  have hmin : ∀ (acc : NormLevel), acc.Flat c vs → ∀ p₁ n₁, flatGet c vs p₁ = some n₁ →
+      acc.minimize p₁ n₁ = n₁ := by
+    intro acc hacc p₁ n₁ h₁
+    rw [NormLevel.minimize, Std.TreeMap.foldl_eq_foldl_toList]
+    have hmem : ∀ pn ∈ acc.toList, flatGet c vs pn.1 = some pn.2 := fun pn hp =>
+      (hacc pn.1).symm.trans (Std.TreeMap.get?_eq_getElem? .. ▸
+        Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 hp)
+    suffices ∀ (l : List (List Name × Node)), (∀ pn ∈ l, flatGet c vs pn.1 = some pn.2) →
+        List.foldl (fun n pn => Node.subsume p₁ n pn.1 pn.2) n₁ l = n₁ from this _ hmem
+    intro l; induction l with | nil => intro; rfl | cons pn l ih
+    intro hl
+    rw [List.foldl_cons, subsume_flat_id h₁ (hl pn (.head _))]
+    exact ih fun q hq => hl q (.tail _ hq)
+  rw [NormLevel.subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  have hmem : ∀ pn ∈ s.toList, flatGet c vs pn.1 = some pn.2 := fun pn hp =>
+    (h pn.1).symm.trans (Std.TreeMap.get?_eq_getElem? .. ▸
+      Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 hp)
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (∀ pn ∈ l, flatGet c vs pn.1 = some pn.2) → acc.Flat c vs →
+      (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).Flat c vs from
+    this _ _ hmem h
+  intro l; induction l with | nil => exact fun _ _ hacc => hacc | cons pn l ih
+  obtain ⟨p₁, n₁⟩ := pn
+  refine fun acc hl hacc => ih _ (fun q hq => hl q (.tail _ hq)) fun p => ?_
+  have h₁ : flatGet c vs p₁ = some n₁ := hl _ (.head _)
+  have hne : n₁.isEmpty = false := by
+    obtain ⟨-, rfl, hc0⟩ | ⟨v, -, -, rfl⟩ := flatGet_eq_some h₁
+    · simp [Node.isEmpty, hc0]
+    · simp [Node.isEmpty]
+  rw [NormLevel.subsumption_step_get?, hmin acc hacc p₁ n₁ h₁, hne]
+  simp only [Bool.false_eq_true, if_false]
+  split <;> rename_i hp
+  · subst hp; exact h₁.symm
+  · exact hacc p
+
+/-- The inserts of `toNormLevel` fill in the singleton keys one at a time: once the starting
+map is right at every key not yet due to be written, the fold is right everywhere. -/
+private theorem toNormLevel_fold {c : Nat} {vs : List VarNode} (hvs : VarsSorted vs) :
+    ∀ (l : List VarNode) (s : NormLevel), (∀ w ∈ l, w ∈ vs) →
+      (∀ p, (∀ w ∈ l, p ≠ [w.var]) → s.get? p = flatGet c vs p) →
+      ∀ p, (l.foldl (fun s v => s.insert [v.var] ⟨0, [v]⟩) s).get? p = flatGet c vs p := by
+  intro l; induction l with | nil => intro s _ hs p; exact hs p (by simp) | cons w l ih
+  refine fun s hmem hs => ih _ (fun x hx => hmem x (.tail _ hx)) fun p hp => ?_
+  rw [Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_insert]
+  split <;> rename_i he
+  · have hpe : [w.var] = p := eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 he)
+    subst hpe
+    simp only [flatGet]
+    rw [(find?_var_eq_some hvs).2 ⟨hmem w (.head _), rfl⟩]; rfl
+  · rw [← Std.TreeMap.get?_eq_getElem?]
+    refine hs p fun x hx => ?_
+    obtain rfl | hx := List.mem_cons.1 hx
+    · rintro rfl; exact he Std.ReflOrd.compare_self
+    · exact hp x hx
+
+/-- `toNormLevel` really does build a flat map. -/
+theorem toNormLevel_flat {c : Nat} {vs : List VarNode} (hvs : VarsSorted vs) :
+    (toNormLevel c vs).Flat c vs := by
+  refine toNormLevel_fold hvs vs _ (fun w hw => hw) fun p hp => ?_
+  have hnone : ∀ x, p = [x] → flatGet c vs [x] = none := by
+    rintro x rfl; simp only [flatGet]
+    rw [find?_var_eq_none.2 fun v hv he => hp v hv (by rw [he])]; rfl
+  split <;> rename_i hc
+  · subst hc
+    match p with
+    | [] => rfl
+    | [x] => rw [hnone x rfl]; rfl
+    | _ :: _ :: _ => rfl
+  · rw [Std.TreeMap.get?_eq_getElem?, Std.TreeMap.getElem?_insert]
+    split <;> rename_i he
+    · cases eq_of_beq (Std.LawfulBEqCmp.compare_eq_iff_beq.1 he); simp [flatGet, hc]
+    · match p with
+      | [] => cases he Std.ReflOrd.compare_self
+      | [x] => rw [hnone x rfl]; rfl
+      | _ :: _ :: _ => rfl
+
+/-! Two maps with the same entries need not be the same tree, so the fallback -- which seeds
+`normalizeAux` with `toNormLevel` rather than with the map the general path would have built
+-- needs `normalizeAux` and `subsumption` to respect pointwise equality. -/
+
+theorem toList_eq_of_get?_eq {A B : NormLevel} (h : ∀ p, A.get? p = B.get? p) :
+    A.toList = B.toList := by
+  refine sorted_pairs_eq Std.TreeMap.ordered_keys_toList Std.TreeMap.ordered_keys_toList ?_
+  rintro ⟨p, n⟩
+  rw [Std.TreeMap.mem_toList_iff_getElem?_eq_some, Std.TreeMap.mem_toList_iff_getElem?_eq_some,
+    ← Std.TreeMap.get?_eq_getElem?, ← Std.TreeMap.get?_eq_getElem?, h]
+
+theorem NormLevel.addConst_congr {A B : NormLevel} (h : ∀ p, A.get? p = B.get? p) (k path p) :
+    (addConst k path A).get? p = (addConst k path B).get? p := by
+  simp only [Std.TreeMap.get?_eq_getElem?] at h ⊢
+  rw [NormLevel.addConst, NormLevel.addConst]
+  split <;> [exact h p; skip]
+  rw [Std.TreeMap.getElem?_alter, Std.TreeMap.getElem?_alter]
+  split <;> rw [h]
+
+theorem NormLevel.addNode_congr {A B : NormLevel} (h : ∀ p, A.get? p = B.get? p) (x k path p) :
+    (addNode x k path A).get? p = (addNode x k path B).get? p := by
+  simp only [Std.TreeMap.get?_eq_getElem?] at h ⊢
+  rw [NormLevel.addNode, NormLevel.addNode, Std.TreeMap.getElem?_alter, Std.TreeMap.getElem?_alter]
+  split <;> rw [h]
+
+theorem NormLevel.addVar_congr {A B : NormLevel} (h : ∀ p, A.get? p = B.get? p) (x k path p) :
+    (addVar x k path A).get? p = (addVar x k path B).get? p := by
+  simp only [Std.TreeMap.get?_eq_getElem?] at h ⊢
+  rw [NormLevel.addVar, NormLevel.addVar, Std.TreeMap.getElem?_modify, Std.TreeMap.getElem?_modify]
+  split <;> rw [h]
+
+theorem normalizeAux_congr {A B : NormLevel} (h : ∀ p, A.get? p = B.get? p) (u path k) :
+    ∀ p, (normalizeAux u path k A).get? p = (normalizeAux u path k B).get? p := by
+  induction u, path, k, A using normalizeAux.induct generalizing B with
+  | case1 path k acc => simp only [normalizeAux]; exact NormLevel.addConst_congr h k path
+  | case2 path k acc a => simp only [normalizeAux]; exact NormLevel.addConst_congr h k path
+  | case3 path k acc u ih => simp only [normalizeAux]; exact ih h
+  | case4 path k acc u v ih₁ ih₂ => simp only [normalizeAux]; exact ih₂ (ih₁ h)
+  | case5 path k acc u v ih₁ ih₂ => simp only [normalizeAux]; exact ih₂ (ih₁ h)
+  | case6 path k acc u v w ih₁ ih₂ => simp only [normalizeAux]; exact ih₂ (ih₁ h)
+  | case7 path k acc u v w ih₁ ih₂ => simp only [normalizeAux]; exact ih₂ (ih₁ h)
+  | case8 path k acc u v path' he ih =>
+    simp only [normalizeAux, he]
+    exact ih (NormLevel.addNode_congr (NormLevel.addConst_congr h k path) v k path')
+  | case9 path k acc u v he acc1 =>
+    rename_i ih
+    simp only [normalizeAux, he]
+    refine ih (B := if k = 0 then B else NormLevel.addVar v k path B) fun p => ?_
+    show (if k = 0 then acc else NormLevel.addVar v k path acc).get? p =
+      (if k = 0 then B else NormLevel.addVar v k path B).get? p
+    by_cases hk : k = 0
+    · simp only [if_pos hk]; exact h p
+    · simp only [if_neg hk]; exact NormLevel.addVar_congr h v k path p
+  | case10 path k acc a => simp only [normalizeAux]; exact h
+  | case11 path k acc a b => simp only [normalizeAux]; exact h
+  | case12 path k acc v path' he =>
+    simp only [normalizeAux, he]
+    exact NormLevel.addNode_congr (NormLevel.addConst_congr h k path) v k path'
+  | case13 path acc v he => simp only [normalizeAux, he, if_pos]; exact h
+  | case14 path k acc v he hk =>
+    simp only [normalizeAux, he, if_neg hk]
+    exact NormLevel.addVar_congr h v k path
+
+theorem NormLevel.subsumption_congr {A B : NormLevel} (h : ∀ p, A.get? p = B.get? p) :
+    ∀ p, A.subsumption.get? p = B.subsumption.get? p := by
+  rw [NormLevel.subsumption, NormLevel.subsumption, Std.TreeMap.foldl_eq_foldl_toList,
+    Std.TreeMap.foldl_eq_foldl_toList, toList_eq_of_get?_eq h]
+  let +generalize F acc pn := _
+  suffices ∀ (l : List (List Name × Node)) (acc₁ acc₂ : NormLevel),
+      (∀ p, acc₁.get? p = acc₂.get? p) → ∀ p,
+      (List.foldl F acc₁ l).get? p = (List.foldl F acc₂ l).get? p from
+    this _ _ _ h
+  intro l; induction l with | nil => exact fun _ _ h => h | cons pn l ih
+  refine fun acc₁ acc₂ hacc => ih _ _ fun p => ?_
+  have hmin : acc₁.minimize pn.1 pn.2 = acc₂.minimize pn.1 pn.2 := by
+    rw [NormLevel.minimize, NormLevel.minimize, Std.TreeMap.foldl_eq_foldl_toList,
+      Std.TreeMap.foldl_eq_foldl_toList, toList_eq_of_get?_eq hacc]
+  rw [NormLevel.subsumption_step_get?, NormLevel.subsumption_step_get?, hmin]
+  split <;> [rfl; exact hacc p]
+
+/-- What a traversal result stands for: collected data still describing the map, or a thrown
+map agreeing with it entry for entry (only entry for entry, since the thrown one was rebuilt
+from sorted data rather than in traversal order). -/
+def RepAcc : Except NormLevel (Nat × List VarNode) → NormLevel → Prop
+  | .ok (c, vs), s => VarsSorted vs ∧ s.Flat c vs
+  | .error s', s => ∀ p, s'.get? p = s.get? p
+
+/-- The traversal tracks `normalizeAux` step for step. -/
+theorem flatAux_rep (hvs : VarsSorted vs) (h : s.Flat c vs) :
+    RepAcc (flatAux l k (c, vs)) (normalizeAux l [] k s) := by
+  induction l generalizing k c vs s with simp only [flatAux, normalizeAux]
+  | zero => exact ⟨hvs, NormLevel.addConst_flat h⟩
+  | succ l ih => exact ih hvs h
+  | max a b iha ihb =>
+    have ha := iha (k := k) hvs h
+    cases hfa : flatAux a k (c, vs) with
+    | ok acc => obtain ⟨c₁, vs₁⟩ := acc; rw [hfa] at ha; exact ihb ha.1 ha.2
+    | error s₁ => rw [hfa] at ha; exact normalizeAux_congr ha b [] k
+  | param =>
+    exact ⟨VarNode.addVar_sorted hvs, NormLevel.addNode_flat hvs (NormLevel.addConst_flat h)⟩
+  | imax => exact normalizeAux_congr (fun p => (toNormLevel_flat hvs p).trans (h p).symm) _ [] k
+  | mvar => exact ⟨hvs, h⟩
+
+private theorem compare_nil_cons {x : Name} {l : List Name} :
+    compare ([] : List Name) (x :: l) = .lt := by
+  simp [compare, List.compareLex]
+
+private theorem compare_singleton {x y : Name} : compare [x] [y] = compare x y := by
+  simp only [compare, List.compareLex]
+  cases Name.cmp x y <;> rfl
+
+/-- Adding a name that sorts after everything already there appends at the end. -/
+private theorem modifyAt_append_of_lt (f : Tree → Tree) (a : Name) : ∀ (l : List (Name × Tree)),
+    (∀ q ∈ l, compare q.1 a = .lt) → modifyAt f a l = l ++ [(a, f default)]
+  | [], _ => rfl
+  | (x, t) :: l, hl => by
+    simp only [modifyAt, Std.OrientedCmp.gt_of_lt (cmp := Name.cmp) (hl (x, t) (.head _))]
+    rw [modifyAt_append_of_lt f a l fun q hq => hl q (.tail _ hq)]; rfl
+
+/-- The edge into a singleton key's node already provides `V({x}, x, 0)`. -/
+private theorem subsumeVars_singleton_self (v : VarNode) :
+    subsumeVars [v] [⟨v.var, 0⟩] = if v.offset == 0 then [] else [v] := by
+  simp only [subsumeVars, Std.ReflCmp.compare_self]
+  by_cases h : v.offset = 0 <;> simp [h] <;> omega
+
+/-- Folding the singleton keys of a flat map appends one child per parameter, in name order. -/
+private theorem flat_toTree_fold (s : NormLevel) (a : Nat) (b : List VarNode) :
+    ∀ (vs : List VarNode) (ch : List (Name × Tree)),
+    VarsSorted vs →
+    (∀ v ∈ vs, s.lexChain 1 [v.var] = [v.var]) →
+    (∀ v ∈ vs, ∀ q ∈ ch, compare q.1 v.var = .lt) →
+    List.foldl (fun t pn =>
+        let path := s.lexChain (List.length pn.1) pn.1
+        let var := if let v :: _ := path then subsumeVars pn.2.var [⟨v, 0⟩] else pn.2.var
+        Tree.modify path (fun t => { t with const := pn.2.const, var }) t)
+      ⟨a, b, ch⟩ (vs.map fun v => ([v.var], (⟨0, [v]⟩ : Node)))
+      = ⟨a, b, ch ++ vs.map fun v => (v.var, (⟨0, if v.offset == 0 then [] else [v], []⟩ : Tree))⟩
+  | [], ch, _, _, _ => by simp
+  | v :: vs, ch, hvs, hlex, hch => by
+    have hch' : ∀ w ∈ vs, ∀ q ∈ ch ++ [(v.var,
+        (⟨0, if v.offset == 0 then [] else [v], []⟩ : Tree))], compare q.1 w.var = .lt := by
+      intro w hw q hq
+      rcases List.mem_append.1 hq with hq | hq
+      · exact hch w (.tail _ hw) q hq
+      · rw [List.mem_singleton] at hq; subst hq; exact hvs.head _ hw
+    have ih := flat_toTree_fold s a b vs _ hvs.of_cons (fun w hw => hlex w (.tail _ hw)) hch'
+    simp only [List.map_cons, List.foldl_cons, List.length_cons, List.length_nil,
+      hlex v (.head _), Tree.modify, subsumeVars_singleton_self]
+    rw [modifyAt_append_of_lt _ _ ch (fun q hq => hch v (.head _) q hq)]
+    exact ih.trans (by simp)
+
+/-- The entry list of a flat map, in key order. -/
+private theorem NormLevel.Flat.toList {s : NormLevel} {c : Nat} {vs : List VarNode}
+    (hvs : VarsSorted vs) (h : s.Flat c vs) :
+    s.toList = (if c = 0 then [] else [([], (⟨c, []⟩ : Node))]) ++
+      vs.map fun v => ([v.var], (⟨0, [v]⟩ : Node)) := by
+  refine sorted_pairs_eq Std.TreeMap.ordered_keys_toList ?_ fun ⟨p, n⟩ => ?_
+  · refine List.pairwise_append.2 ⟨?_, ?_, ?_⟩
+    · by_cases hc0 : c = 0 <;> simp [hc0]
+    · rw [List.pairwise_map]
+      exact hvs.imp fun {u w} huw => by rw [compare_singleton]; exact huw
+    · intro x hx y hy
+      by_cases hc0 : c = 0
+      · simp [hc0] at hx
+      · rw [if_neg hc0, List.mem_singleton] at hx
+        subst hx
+        obtain ⟨w, -, rfl⟩ := List.mem_map.1 hy
+        exact compare_nil_cons
+  · rw [Std.TreeMap.mem_toList_iff_getElem?_eq_some, ← Std.TreeMap.get?_eq_getElem?, h p]
+    constructor <;> intro hp
+    · obtain ⟨rfl, rfl, hc0⟩ | ⟨v, hv, rfl, rfl⟩ := flatGet_eq_some hp
+      · exact List.mem_append_left _ (by rw [if_neg hc0]; exact List.mem_singleton.2 rfl)
+      · exact List.mem_append_right _ (List.mem_map.2 ⟨v, hv, rfl⟩)
+    · obtain hp | hp := List.mem_append.1 hp
+      · split at hp <;> [cases hp; rename_i hc]
+        rw [List.mem_singleton] at hp; cases hp; simp [flatGet, hc]
+      · obtain ⟨v, hv, he⟩ := List.mem_map.1 hp
+        cases he; simp only [flatGet]
+        rw [(find?_var_eq_some hvs).2 ⟨hv, rfl⟩]; rfl
+
+/-- A singleton key's chain is forced: its one element is `addable` on the empty set, thanks
+to the entry itself, and nothing remains to be completed. -/
+private theorem NormLevel.Flat.lexChain_singleton {s : NormLevel} {c : Nat} {vs : List VarNode}
+    (hvs : VarsSorted vs) (h : s.Flat c vs) {v : VarNode} (hv : v ∈ vs) :
+    s.lexChain 1 [v.var] = [v.var] := by
+  have haddable : s.addable v.var [] := by
+    rw [NormLevel.addable, Std.TreeMap.any_eq_any_toList, List.any_eq_true]
+    refine ⟨([v.var], ⟨0, [v]⟩), Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 ?_, ?_⟩
+    · rw [← Std.TreeMap.get?_eq_getElem?, h [v.var]]
+      simp only [flatGet]
+      rw [(find?_var_eq_some hvs).2 ⟨hv, rfl⟩]; rfl
+    · simp [subset]
+  rw [NormLevel.lexChain, List.find?_cons_of_pos]
+  · simp [NormLevel.lexChain]
+  · simp only [List.erase_cons_head, haddable, Bool.true_and]; rfl
+
+/-- Reading the tree off a flat map: every key is a singleton, so its `lexChain` is forced,
+and the fold just adds one child per parameter in name order. -/
+theorem NormLevel.Flat.toTree {s : NormLevel} {c : Nat} {vs : List VarNode}
+    (hvs : VarsSorted vs) (h : s.Flat c vs) : s.toTree = flatTree c vs := by
+  rw [NormLevel.toTree, Std.TreeMap.foldl_eq_foldl_toList, NormLevel.Flat.toList hvs h]
+  have key := flat_toTree_fold s c [] vs [] hvs
+    (fun v => NormLevel.Flat.lexChain_singleton hvs h) (by simp)
+  by_cases hc0 : c = 0
+  · subst hc0; rw [if_pos rfl]; exact key
+  · rw [if_neg hc0]; exact key
+
+/-- The sublevels of a single node keyed at `p`. -/
+def Node.HasSub (p : List Name) (n : Node) : Sub → Prop
+  | .const q k => p = q ∧ n.const = k ∧ k ≠ 0
+  | .var q x k => p = q ∧ ⟨x, k⟩ ∈ n.var
+
+theorem NormLevel.hasSub_iff {s : NormLevel} {t} :
+    s.HasSub t ↔ ∃ p n, s.get? p = some n ∧ Node.HasSub p n t := by
+  match t with
+  | .const p k =>
+    constructor
+    · rintro ⟨n, hn, hk, hk0⟩; exact ⟨p, n, hn, rfl, hk, hk0⟩
+    · rintro ⟨q, n, hn, rfl, hk, hk0⟩; exact ⟨n, hn, hk, hk0⟩
+  | .var p x k =>
+    constructor
+    · rintro ⟨n, hn, hx⟩; exact ⟨p, n, hn, rfl, hx⟩
+    · rintro ⟨q, n, hn, rfl, hx⟩; exact ⟨n, hn, hx⟩
+
+theorem Node.subsume_hasSub : ∀ {t}, Node.HasSub p₁ (Node.subsume p₁ n p₂ n₂) t →
+    Node.HasSub p₁ n t
+  | .const _ k, ⟨rfl, hck, hk0⟩ => by
+    refine ⟨rfl, ?_, hk0⟩
+    obtain h | h := Node.subsume_const_cases p₁ n p₂ n₂
+    · rw [← h]; exact hck
+    · rw [h] at hck; exact absurd hck.symm hk0
+  | .var _ _ _, ⟨rfl, hxk⟩ => ⟨rfl, Node.subsume_var_subset hxk⟩
+
+theorem NormLevel.minimize_hasSub {acc : NormLevel} {t}
+    (h : Node.HasSub p₁ (acc.minimize p₁ n₁) t) : Node.HasSub p₁ n₁ t := by
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList] at h
+  generalize acc.toList = l at h
+  induction l generalizing n₁ with
+  | nil => exact h
+  | cons a l ih => exact Node.subsume_hasSub (ih h)
+
+/-- A `subsumption` step only removes sublevels. -/
+theorem NormLevel.subsumption_step_hasSub {acc : NormLevel} {p₁ : List Name} {n₁ : Node}
+    (h₁ : acc.get? p₁ = some n₁) {t}
+    (h : NormLevel.HasSub (if (acc.minimize p₁ n₁).isEmpty then acc.erase p₁
+      else acc.insert p₁ (acc.minimize p₁ n₁)) t) : acc.HasSub t := by
+  rw [hasSub_iff] at h ⊢
+  obtain ⟨p, n, hp, hn⟩ := h
+  rw [subsumption_step_get?] at hp
+  split at hp <;> rename_i hpe
+  · split at hp <;> [cases hp; skip]
+    cases hp; subst hpe
+    exact ⟨p₁, n₁, h₁, minimize_hasSub hn⟩
+  · exact ⟨p, n, hp, hn⟩
+
+/-- Exactness of minimization, fold form: a sublevel surviving the subtraction of every entry
+in `l` is not (strictly) dominated by any of their sublevels — domination forces equality. -/
+theorem NormLevel.minimize_exact_aux {acc : NormLevel} {p₁ : List Name} {n₁ : Node}
+    (hsort : ∀ p n, acc.get? p = some n → Sorted p) (hvsa : acc.SortedVars)
+    (h₁ : acc.get? p₁ = some n₁) (hs₁ : Sorted p₁) (hvs₁ : VarsSorted n₁.var) :
+    ∀ (l : List (List Name × Node)) (n : Node),
+      (∀ pn ∈ l, acc.get? pn.1 = some pn.2) →
+      (∀ x ∈ n.var, x ∈ n₁.var) → (n.const ≠ 0 → n.const = n₁.const) → VarsSorted n.var →
+      ∀ t, Node.HasSub p₁ (l.foldl (fun n pn => Node.subsume p₁ n pn.1 pn.2) n) t →
+      Node.HasSub p₁ n t ∧
+        ∀ pn ∈ l, ∀ t', Node.HasSub pn.1 pn.2 t' → t.le t' → t = t'
+  | [], _, _, _, _, _, _, ht => ⟨ht, fun _ h => nomatch h⟩
+  | (p₂, n₂) :: l, n, hl, hnvar, hnconst, hvs, t, ht => by
+    simp only [List.foldl_cons] at ht
+    have h₂ : acc.get? p₂ = some n₂ := hl _ (.head _)
+    have hvs₂ : VarsSorted n₂.var := hvsa _ _ h₂
+    have hs₂ : Sorted p₂ := hsort _ _ h₂
+    obtain ⟨ht', hrest⟩ := minimize_exact_aux hsort hvsa h₁ hs₁ hvs₁ l
+      (Node.subsume p₁ n p₂ n₂) (fun pn h => hl _ (.tail _ h))
+      (fun x hx => hnvar _ (Node.subsume_var_subset hx))
+      (fun h0 => by
+        obtain hc | hc := Node.subsume_const_cases p₁ n p₂ n₂
+        · rw [hc]; exact hnconst (hc ▸ h0)
+        · exact absurd hc h0)
+      (hvs.sublist Node.subsume_var_sublist) t ht
+    refine ⟨Node.subsume_hasSub ht', ?_⟩
+    rintro pn hpn t' ht'' hle
+    rcases List.mem_cons.1 hpn with rfl | hpn
+    · obtain ⟨q, k⟩ | ⟨q, x, k⟩ := t <;> obtain ⟨q', k'⟩ | ⟨q', y, k'⟩ := t'
+      · -- const dominated by const
+        obtain ⟨rfl, hck, hk0⟩ := ht'
+        obtain ⟨rfl, hck', hk0'⟩ := ht''
+        obtain ⟨hsub, hlek⟩ := hle
+        have hgate : subset compare p₂ p₁ := subset_of_sorted hs₂ hs₁ hsub
+        have hsu : Node.subsume p₁ n p₂ n₂ = n.subsumeBy (p₁.length == p₂.length) n₂ := by
+          rw [Node.subsume, if_pos hgate]
+        by_cases hlen : p₁.length = p₂.length
+        · have hqq : p₂ = p₁ := subset_eq hgate hlen.symm
+          have hn₂ : n₂ = n₁ := by
+            rw [hqq] at h₂; cases h₂.symm.trans h₁; rfl
+          have hkc : n.const = k := by
+            obtain hc | hc := Node.subsume_const_cases p₁ n p₂ n₂
+            · rw [← hc]; exact hck
+            · rw [hc] at hck; exact absurd hck.symm hk0
+          have hne0 : n.const ≠ 0 := fun h0 => hk0 (hkc.symm.trans h0)
+          rw [hqq, show k = k' from by rw [← hck', hn₂, ← hnconst hne0, hkc]]
+        · have hbeq : (p₁.length == p₂.length) = false := by simpa using hlen
+          rw [hsu, hbeq] at hck
+          have hkc : n.const = k := by
+            obtain hc | hc := Node.subsumeBy_const_cases (same := false) n n₂
+            · rw [← hc]; exact hck
+            · rw [hc] at hck; exact absurd hck.symm hk0
+          refine absurd hck ?_
+          rw [Node.subsumeBy_const_complete (n₁ := n) (n₂ := n₂)
+            (.inl ⟨rfl, by rw [hkc, hck']; exact hlek⟩)]
+          exact fun h => hk0 h.symm
+      · -- const dominated by a variable
+        obtain ⟨rfl, hck, hk0⟩ := ht'
+        obtain ⟨rfl, hyk⟩ := ht''
+        obtain ⟨hsub, hlek⟩ := hle
+        have hgate : subset compare p₂ p₁ := subset_of_sorted hs₂ hs₁ hsub
+        have hsu : Node.subsume p₁ n p₂ n₂ = n.subsumeBy (p₁.length == p₂.length) n₂ := by
+          rw [Node.subsume, if_pos hgate]
+        rw [hsu] at hck
+        have hkc : n.const = k := by
+          obtain hc | hc := Node.subsumeBy_const_cases (same := p₁.length == p₂.length) n n₂
+          · rw [← hc]; exact hck
+          · rw [hc] at hck; exact absurd hck.symm hk0
+        refine absurd hck ?_
+        rw [Node.subsumeBy_const_complete (n₁ := n) (n₂ := n₂)
+          (.inr ⟨⟨y, k'⟩, hyk, by rw [hkc]; exact hlek⟩)]
+        exact fun h => hk0 h.symm
+      · exact hle.elim
+      · -- variable dominated by a variable
+        obtain ⟨rfl, hxk⟩ := ht'
+        obtain ⟨rfl, hyk⟩ := ht''
+        obtain ⟨hsub, rfl, hlek⟩ := hle
+        have hgate : subset compare p₂ p₁ := subset_of_sorted hs₂ hs₁ hsub
+        have hsu : Node.subsume p₁ n p₂ n₂ = n.subsumeBy (p₁.length == p₂.length) n₂ := by
+          rw [Node.subsume, if_pos hgate]
+        by_cases hlen : p₁.length = p₂.length
+        · have hqq : p₂ = p₁ := subset_eq hgate hlen.symm
+          have hn₂ : n₂ = n₁ := by
+            rw [hqq] at h₂; cases h₂.symm.trans h₁; rfl
+          have hk : (⟨x, k⟩ : VarNode) = ⟨x, k'⟩ :=
+            hvs₁.eq_of_var_eq (hnvar _ (Node.subsume_var_subset hxk)) (hn₂ ▸ hyk) rfl
+          rw [hqq, show k = k' from congrArg VarNode.offset hk]
+        · have hbeq : (p₁.length == p₂.length) = false := by simpa using hlen
+          rw [hsu, hbeq] at hxk
+          exact (Node.subsumeBy_var_complete hvs hvs₂ hxk hyk rfl hlek).elim
+    · exact hrest _ hpn _ ht'' hle
+
+theorem NormLevel.minimize_exact {acc : NormLevel} {p₁ : List Name} {n₁ : Node}
+    (hsort : ∀ p n, acc.get? p = some n → Sorted p) (hvsa : acc.SortedVars)
+    (h₁ : acc.get? p₁ = some n₁) :
+    ∀ t t', Node.HasSub p₁ (acc.minimize p₁ n₁) t → acc.HasSub t' → t.le t' → t = t' := by
+  intro t t' ht ht' hle
+  rw [minimize, Std.TreeMap.foldl_eq_foldl_toList] at ht
+  have hmem pn (h : pn ∈ acc.toList) : acc.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  obtain ⟨-, hexact⟩ := minimize_exact_aux hsort hvsa h₁ (hsort _ _ h₁) (hvsa _ _ h₁)
+    acc.toList n₁ hmem (fun _ => id) (fun _ => rfl) (hvsa _ _ h₁) t ht
+  obtain ⟨p₂, n₂, hp₂, hn₂⟩ := hasSub_iff.1 ht'
+  exact hexact (p₂, n₂) (Std.TreeMap.mem_toList_iff_getElem?_eq_some.2
+    (Std.TreeMap.get?_eq_getElem? .. ▸ hp₂)) _ hn₂ hle
+
+/-- A normal form is reduced when no sublevel is dominated by another: domination between
+recorded sublevels forces them to be the same sublevel. -/
+def NormLevel.Reduced (s : NormLevel) : Prop :=
+  ∀ t t', s.HasSub t → s.HasSub t' → t.le t' → t = t'
+
+/-- `subsumption` produces a reduced map: every entry is minimized against the (current)
+whole map, minimization removes exactly the dominated sublevels, and later steps only
+shrink the map, which cannot introduce new domination. -/
+theorem NormLevel.subsumption_reduced {s : NormLevel}
+    (hsort : ∀ p n, s.get? p = some n → Sorted p) (hvsa : s.SortedVars) :
+    s.subsumption.Reduced := by
+  have hmem pn (h : pn ∈ s.toList) : s.get? pn.1 = some pn.2 :=
+    Std.TreeMap.get?_eq_getElem? .. ▸ Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 h
+  have nd : (s.toList.map Prod.fst).Nodup := by simpa using Std.TreeMap.nodup_keys (t := s)
+  rw [Reduced, subsumption, Std.TreeMap.foldl_eq_foldl_toList]
+  suffices ∀ (l : List (List Name × Node)) (acc : NormLevel),
+      (l.map Prod.fst).Nodup →
+      (∀ pn ∈ l, acc.get? pn.1 = some pn.2) →
+      (∀ p n, acc.get? p = some n → Sorted p) → acc.SortedVars →
+      (∀ p n, acc.get? p = some n → p ∉ l.map Prod.fst →
+        ∀ t t', Node.HasSub p n t → acc.HasSub t' → t.le t' → t = t') →
+      ∀ t t', (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).HasSub t →
+      (List.foldl (fun acc pn =>
+        let n := acc.minimize pn.1 pn.2
+        if n.isEmpty then acc.erase pn.1 else acc.insert pn.1 n) acc l).HasSub t' →
+      t.le t' → t = t' from
+    this _ _ nd hmem hsort hvsa fun p n hp hnp => absurd
+      (List.mem_map_of_mem (f := Prod.fst) (Std.TreeMap.mem_toList_iff_getElem?_eq_some.2
+        (Std.TreeMap.get?_eq_getElem? .. ▸ hp))) hnp
+  clear hmem nd hsort hvsa; intro l
+  induction l with
+  | nil =>
+    intro acc _ _ _ _ hred t t' ht ht' hle
+    obtain ⟨p, n, hp, hnt⟩ := hasSub_iff.1 ht
+    exact hred p n hp (by simp) t t' hnt ht' hle
+  | cons pn l ih =>
+    obtain ⟨p₂, n₂⟩ := pn
+    intro acc nd hl hsorta hvsacc hred
+    simp only [List.map_cons, List.nodup_cons] at nd
+    have h₂ : acc.get? p₂ = some n₂ := hl _ (.head _)
+    simp only [List.foldl_cons]
+    have hstep := subsumption_step_get? acc n₂ p₂
+    refine ih _ nd.2 (fun pn' h => ?_) (fun p n h => ?_) (fun p n h => ?_)
+      (fun p n hp hnp t t' hnt ht' hle => ?_)
+    · have hne : p₂ ≠ pn'.1 := fun e => nd.1 (e ▸ List.mem_map_of_mem (f := Prod.fst) h)
+      rw [hstep, if_neg hne]
+      exact hl _ (.tail _ h)
+    · rw [hstep] at h; split at h <;> rename_i hpe
+      · split at h <;> [cases h; skip]
+        cases h; exact hpe ▸ hsorta _ _ h₂
+      · exact hsorta _ _ h
+    · rw [hstep] at h; split at h <;> rename_i hpe
+      · split at h <;> [cases h; skip]
+        cases h
+        exact (hvsacc _ _ h₂).sublist minimize_var_sublist
+      · exact hvsacc _ _ h
+    · rw [hstep] at hp; split at hp <;> rename_i hpe
+      · split at hp <;> [cases hp; skip]
+        cases hp; subst hpe
+        exact minimize_exact hsorta hvsacc h₂ t t' hnt (subsumption_step_hasSub h₂ ht') hle
+      · refine hred p n hp ?_ t t' hnt (subsumption_step_hasSub h₂ ht') hle
+        simp only [List.map_cons, List.mem_cons, not_or]
+        exact ⟨fun e => hpe e.symm, hnp⟩
+
+theorem normalize_reduced : (normalize u).Reduced := by
+  refine NormLevel.subsumption_reduced ?_ (normalizeAux_sortedVars fun _ _ => by simp)
+  exact fun p n h => (normalizeAux_wf (by simp) (by simp [NormLevel.WF]) p n h).2.2
+
+/-! Canonicity: two reduced normal forms with the same semantics have the same sublevels,
+and hence are equal maps. -/
+
+instance : LawfulBEq Node where
+  rfl {a} := by cases a <;> simp! +instances [instBEqNode]
+  eq_of_beq {a b} h := by
+    cases a; cases b
+    simp! +instances [instBEqNode] at h
+    simp [h.1, h.2]
+
+theorem VarsSorted.eq_of_mem_iff : ∀ {l₁ l₂ : List VarNode}, VarsSorted l₁ → VarsSorted l₂ →
+    (∀ x, x ∈ l₁ ↔ x ∈ l₂) → l₁ = l₂
+  | [], [], _, _, _ => rfl
+  | [], _ :: _, _, _, h => nomatch (h _).2 (.head _)
+  | _ :: _, [], _, _, h => nomatch (h _).1 (.head _)
+  | a :: l₁, b :: l₂, h₁, h₂, h => by
+    cases show a = b by
+      rcases List.mem_cons.1 ((h a).1 (.head _)) with rfl | ha <;> [rfl; skip]
+      rcases List.mem_cons.1 ((h b).2 (.head _)) with rfl | hb <;> [rfl; skip]
+      exact absurd (h₂.head _ ha) (by rw [Std.OrientedCmp.gt_of_lt (h₁.head _ hb)]; simp)
+    refine congrArg (a :: ·) (VarsSorted.eq_of_mem_iff h₁.of_cons h₂.of_cons
+      fun x => ⟨fun hx => ?_, fun hx => ?_⟩)
+    · rcases List.mem_cons.1 ((h x).1 (.tail _ hx)) with rfl | hx'
+      · exact absurd (h₁.head _ hx) (by rw [Std.ReflOrd.compare_self]; simp)
+      · exact hx'
+    · rcases List.mem_cons.1 ((h x).2 (.tail _ hx)) with rfl | hx'
+      · exact absurd (h₂.head _ hx) (by rw [Std.ReflOrd.compare_self]; simp)
+      · exact hx'
+
+theorem NormLevel.HasSub.path_sorted {s : NormLevel}
+    (hsort : ∀ p n, s.get? p = some n → Sorted p) : ∀ {t}, s.HasSub t → Sorted t.path
+  | .const _ _, ⟨_, hn, _⟩ => hsort _ _ hn
+  | .var _ _ _, ⟨_, hn, _⟩ => hsort _ _ hn
+
+/-- In reduced maps, mutual per-sublevel domination pins the sublevels to be equal: the
+dominator of a sublevel is itself dominated by a sublevel of the first map, which by
+reducedness is the sublevel we started from, and antisymmetry finishes. -/
+theorem NormLevel.Reduced.hasSub_iff_hasSub {A B : NormLevel}
+    (rA : A.Reduced) (rB : B.Reduced)
+    (sortA : ∀ p n, A.get? p = some n → Sorted p)
+    (sortB : ∀ p n, B.get? p = some n → Sorted p)
+    (hAB : ∀ t, A.HasSub t → ∃ t', B.HasSub t' ∧ t.le t')
+    (hBA : ∀ t, B.HasSub t → ∃ t', A.HasSub t' ∧ t.le t') :
+    ∀ t, A.HasSub t ↔ B.HasSub t := by
+  suffices ∀ {A B : NormLevel}, A.Reduced →
+      (∀ p n, A.get? p = some n → Sorted p) → (∀ p n, B.get? p = some n → Sorted p) →
+      (∀ t, A.HasSub t → ∃ t', B.HasSub t' ∧ t.le t') →
+      (∀ t, B.HasSub t → ∃ t', A.HasSub t' ∧ t.le t') →
+      ∀ t, A.HasSub t → B.HasSub t from
+    fun t => ⟨this rA sortA sortB hAB hBA t, this rB sortB sortA hBA hAB t⟩
+  clear rA rB sortA sortB hAB hBA
+  intro A B rA sortA sortB hAB hBA t ht
+  obtain ⟨t', ht', hle⟩ := hAB t ht
+  obtain ⟨t'', ht'', hle'⟩ := hBA t' ht'
+  cases rA t t'' ht ht'' (hle.trans hle')
+  exact (hle.antisymm (HasSub.path_sorted sortA ht) (HasSub.path_sorted sortB ht') hle').symm ▸ ht'
+
+/-- Two reduced normal forms with the same sublevels are equal as `NormLevel`s. -/
+theorem NormLevel.eq_of_hasSub_iff {A B : NormLevel}
+    (hvsA : A.SortedVars) (hvsB : B.SortedVars)
+    (hneA : ∀ p n, A.get? p = some n → n.isEmpty = false)
+    (hneB : ∀ p n, B.get? p = some n → n.isEmpty = false)
+    (h : ∀ t, A.HasSub t ↔ B.HasSub t) : A == B := by
+  suffices ∀ {A B : NormLevel}, A.SortedVars → B.SortedVars →
+      (∀ p n, A.get? p = some n → n.isEmpty = false) →
+      (∀ t, A.HasSub t ↔ B.HasSub t) →
+      ∀ p n, A.get? p = some n → B.get? p = some n by
+    have h1 := @this A B hvsA hvsB hneA h
+    have h2 := @this B A hvsB hvsA hneB fun t => (h t).symm
+    simp +instances only [instBEqNormLevel, Std.TreeMap.all_eq_all_toList,
+      Bool.and_eq_true, List.all_eq_true]
+    constructor <;> rintro ⟨p, n⟩ hpn
+    · have := h1 p n (Std.TreeMap.get?_eq_getElem? .. ▸
+        Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 hpn)
+      rw [Std.TreeMap.get?_eq_getElem?] at this
+      simp [this]
+    · have := h2 p n (Std.TreeMap.get?_eq_getElem? .. ▸
+        Std.TreeMap.mem_toList_iff_getElem?_eq_some.1 hpn)
+      rw [Std.TreeMap.get?_eq_getElem?] at this
+      simp [this]
+  clear hvsA hvsB hneA hneB h
+  intro A B hvsA hvsB hneA h p n hp
+  have hne := hneA _ _ hp
+  rw [Node.isEmpty, Bool.and_eq_false_iff] at hne
+  have hBp : ∃ m, B.get? p = some m := by
+    obtain h0 | hv := hne
+    · obtain ⟨m, hm, -⟩ := (h (.const p n.const)).1 ⟨n, hp, rfl, by simpa using h0⟩
+      exact ⟨m, hm⟩
+    · obtain ⟨x, hx⟩ := List.exists_mem_of_ne_nil _ (by simpa using hv)
+      obtain ⟨m, hm, -⟩ := (h (.var p x.var x.offset)).1 ⟨n, hp, hx⟩
+      exact ⟨m, hm⟩
+  obtain ⟨m, hm⟩ := hBp
+  have hconst : n.const = m.const := by
+    by_cases h0 : n.const = 0
+    · by_cases h0' : m.const = 0
+      · rw [h0, h0']
+      · obtain ⟨n', hn', hc, -⟩ := (h (.const p m.const)).2 ⟨m, hm, rfl, h0'⟩
+        cases hn'.symm.trans hp
+        exact absurd (h0 ▸ hc).symm h0'
+    · obtain ⟨m', hm', hc, -⟩ := (h (.const p n.const)).1 ⟨n, hp, rfl, h0⟩
+      cases hm'.symm.trans hm
+      exact hc.symm
+  have hvar : n.var = m.var := by
+    refine VarsSorted.eq_of_mem_iff (hvsA _ _ hp) (hvsB _ _ hm)
+      fun x => ⟨fun hx => ?_, fun hx => ?_⟩
+    · obtain ⟨m', hm', hx'⟩ := (h (.var p x.var x.offset)).1 ⟨n, hp, hx⟩
+      cases hm'.symm.trans hm
+      exact hx'
+    · obtain ⟨n', hn', hx'⟩ := (h (.var p x.var x.offset)).2 ⟨m, hm, hx⟩
+      cases hn'.symm.trans hp
+      exact hx'
+  obtain ⟨nc, nv⟩ := n
+  obtain ⟨mc, mv⟩ := m
+  cases hconst; cases hvar
+  exact hm
+
+/-- Semantically equal levels have `BEq`-equal normal forms. -/
+theorem normalize_complete (hu : VLevel.ofLevel ls u = some u')
+    (hv : VLevel.ofLevel ls v = some v') : normalize u == normalize v ↔ u' ≈ v' := by
+  refine .trans ⟨fun h ls => ?_, fun h => ?_⟩ VLevel.equiv_def.symm
+  · rw [← normalize_eval hu, NormLevel.eval_congr h, normalize_eval hv]
+  have h₁ : ∀ ρ, (normalize u).eval ls ρ ≤ (normalize v).eval ls ρ := fun ρ => by
+    rw [normalize_eval hu, normalize_eval hv, h ρ]; exact Nat.le_refl _
+  have h₂ : ∀ ρ, (normalize v).eval ls ρ ≤ (normalize u).eval ls ρ := fun ρ => by
+    rw [normalize_eval hu, normalize_eval hv, h ρ]; exact Nat.le_refl _
+  exact NormLevel.eq_of_hasSub_iff normalize_sortedVars normalize_sortedVars
+    normalize_nonempty normalize_nonempty
+    (NormLevel.Reduced.hasSub_iff_hasSub normalize_reduced normalize_reduced
+      normalize_sorted normalize_sorted
+      (NormLevel.separation (normalize_keys hu) normalize_vars h₁)
+      (NormLevel.separation (normalize_keys hv) normalize_vars h₂))
+
+/-! `BEq`-equal maps have equal `toList`s, and the reconstruction depends on the map only
+through `toList`, so equal normal forms reify to syntactically equal levels. (`TreeMap`
+equality itself does not follow from `==`: the internal tree shape depends on insertion
+order.) -/
+
+theorem NormLevel.toList_eq {A B : NormLevel} (h : A == B) : A.toList = B.toList := by
+  simp +instances only [instBEqNormLevel, Std.TreeMap.all_eq_all_toList,
+    Bool.and_eq_true, List.all_eq_true] at h
+  refine sorted_pairs_eq Std.TreeMap.ordered_keys_toList Std.TreeMap.ordered_keys_toList
+    fun x => ⟨fun hx => ?_, fun hx => ?_⟩
+  · have := h.1 x hx
+    rw [beq_iff_eq, Std.TreeMap.get?_eq_getElem?] at this
+    exact Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 this
+  · have := h.2 x hx
+    rw [beq_iff_eq, Std.TreeMap.get?_eq_getElem?] at this
+    exact Std.TreeMap.mem_toList_iff_getElem?_eq_some.2 this
+
+theorem NormLevel.addable_congr {A B : NormLevel} (h : A.toList = B.toList) :
+    A.addable a acc = B.addable a acc := by
+  rw [addable, addable, Std.TreeMap.any_eq_any_toList, Std.TreeMap.any_eq_any_toList, h]
+
+theorem NormLevel.feasible_go_congr {A B : NormLevel} (h : A.toList = B.toList) :
+    ∀ fuel acc rem, NormLevel.feasible.go A fuel acc rem = NormLevel.feasible.go B fuel acc rem
+  | 0, _, _ => rfl
+  | fuel+1, acc, rem => by
+    simp only [feasible.go]
+    rw [show (fun a => A.addable a acc) = fun a => B.addable a acc from
+      funext fun a => addable_congr h]
+    cases rem.find? fun a => B.addable a acc with
+    | none => rfl
+    | some a => exact feasible_go_congr h fuel _ _
+
+theorem NormLevel.feasible_congr {A B : NormLevel} (h : A.toList = B.toList) :
+    A.feasible acc rem = B.feasible acc rem := by
+  simp only [feasible]; exact feasible_go_congr h ..
+
+theorem NormLevel.lexChain_congr {A B : NormLevel} (h : A.toList = B.toList) :
+    ∀ fuel p, A.lexChain fuel p = B.lexChain fuel p
+  | 0, _ => rfl
+  | fuel+1, p => by
+    simp only [lexChain]
+    rw [show (fun a => A.addable a (p.erase a) && A.feasible [] (p.erase a))
+        = fun a => B.addable a (p.erase a) && B.feasible [] (p.erase a) from
+      funext fun a => by rw [addable_congr h, feasible_congr h]]
+    cases p.find? fun a => B.addable a (p.erase a) && B.feasible [] (p.erase a) with
+    | none => rfl
+    | some a => exact congrArg (a :: ·) (lexChain_congr h fuel _)
+
+/-- The reconstruction depends only on the entry list of the map. -/
+theorem NormLevel.toTree_congr {A B : NormLevel} (h : A.toList = B.toList) :
+    A.toTree = B.toTree := by
+  rw [toTree, toTree, Std.TreeMap.foldl_eq_foldl_toList, Std.TreeMap.foldl_eq_foldl_toList, h]
+  congr 1
+  funext t pn
+  rw [lexChain_congr h]
+
+/-- The fast path is transparent: it computes the same tree the general path does. -/
+theorem normalize'_eq (l : Level) : normalize' l = (normalize l).toTree.reify := by
+  rw [normalize']
+  have hrep := flatAux_rep (l := l) (k := 0) (c := 0) (vs := []) (s := {}) .nil
+    (fun p => by match p with | [] | [_] | _::_::_ => simp [flatGet])
+  match hf : flatAux l 0 (0, []) with
+  | .ok (c, vs) =>
+    rw [hf] at hrep
+    obtain ⟨hvs, hflat⟩ := hrep
+    rw [normalize, (NormLevel.subsumption_flat hflat).toTree hvs]
+  | .error s =>
+    rw [hf] at hrep; dsimp only
+    rw [normalize, NormLevel.toTree_congr (toList_eq_of_get?_eq (NormLevel.subsumption_congr hrep))]
+
+end Normalize
+
+theorem isStructEq_eq {u v : Level} (h : isStructEq u v) : u = v := by
+  induction u generalizing v with
+  | zero => cases v <;> simp_all [isStructEq]
+  | succ u ih =>
+    cases v <;> simp [isStructEq] at h
+    exact congrArg Level.succ (ih h)
+  | max u₁ u₂ ih₁ ih₂ =>
+    cases v <;> simp [isStructEq] at h
+    cases ih₁ h.1
+    cases ih₂ h.2
+    rfl
+  | imax u₁ u₂ ih₁ ih₂ =>
+    cases v <;> simp [isStructEq] at h
+    cases ih₁ h.1
+    cases ih₂ h.2
+    rfl
+  | param u =>
+    cases v <;> simp_all [isStructEq]
+  | mvar u =>
+    rcases u with ⟨u⟩
+    cases v <;> simp_all [isStructEq]
+
+theorem isStructEq_iff_eq {u v : Level} : isStructEq u v ↔ u = v := by
+  constructor
+  · exact isStructEq_eq
+  · rintro rfl
+    induction u <;> simp_all [isStructEq]
+
+theorem isEquiv'_wf (h : isEquiv' u v)
+    (hu : VLevel.ofLevel ls u = some u') (hv : VLevel.ofLevel ls v = some v') : u' ≈ v' := by
+  simp only [isEquiv', Bool.or_eq_true] at h
+  obtain h | h := h
+  · exact isEquiv_wf h hu hv
+  · refine VLevel.equiv_def.2 fun ρ => ?_
+    rw [← Normalize.normalize_eval (ρ := ρ) hu, ← Normalize.normalize_eval (ρ := ρ) hv]
+    exact Normalize.NormLevel.eval_congr h
+
+/-- Soundness of reification: the level `normalize'` reconstructs evaluates like the input
+everywhere. Reification is `toTree` followed by `reify`, and both preserve the value: the
+tree's `imax` chains contribute nothing the normal form does not already have, since every
+key admits a chain (`normalize_feas`) and `lexChain` then picks an admissible one, and
+nothing is lost, since every entry is recorded at the end of its chain. -/
+theorem normalize'_eval (hu : VLevel.ofLevel ls u = some u') :
+    Level.eval (Normalize.evalParam ls ρ) μ (normalize' u) = u'.eval ρ := by
+  open Normalize in
+  rw [normalize'_eq, Tree.reify_eval, NormLevel.toTree_eval normalize_sorted normalize_feas]
+  exact normalize_eval hu
+
+theorem geq'_wf (hu : VLevel.ofLevel ls u = some u') (hv : VLevel.ofLevel ls v = some v')
+    (h : geq' u v) : v' ≤ u' := by
+  simp only [geq', Bool.or_eq_true] at h
+  obtain h | h := h
+  · exact geq_wf h hu hv
+  · intro ρ
+    rw [← Normalize.normalize_eval (ρ := ρ) hv, ← Normalize.normalize_eval (ρ := ρ) hu]
+    exact Normalize.NormLevel.le_eval Normalize.normalize_vars h
+
+theorem isEquivList_wf (H : Level.isEquivList us vs) :
+    List.mapM (VLevel.ofLevel Us) us = some us' →
+    List.mapM (VLevel.ofLevel Us) vs = some vs' → us'.Forall₂ (· ≈ ·) vs' := by
+  simp [Level.isEquivList] at H; revert us' vs'
+  induction us generalizing vs with cases vs <;> simp [List.all2] at H <;> simp | cons u us ih
+  rename_i v vs; rintro _ _ u' hu us' hus rfl v' hv vs' hvs rfl
+  exact .cons (isEquiv'_wf H.1 hu hv) (ih H.2 hus hvs)
+
+/-- Canonicity of `normalize'`: semantically equal levels reconstruct to syntactically equal
+levels. The normal forms are `BEq`-equal, hence have the same entry list, and the
+reconstruction (`lexChain` and the tree fold) depends on the map only through its entry
+list. -/
+theorem normalize'_complete (hu : VLevel.ofLevel ls u = some u')
+    (hv : VLevel.ofLevel ls v = some v') : normalize' u = normalize' v ↔ u' ≈ v' := by
+  refine ⟨fun h => ?_, fun h => ?_⟩
+  · refine VLevel.equiv_def.2 fun ρ => ?_
+    rw [← normalize'_eval (μ := fun _ => 0) hu, ← normalize'_eval hv, h]
+  · rw [Normalize.normalize'_eq, Normalize.normalize'_eq]
+    rw [← Normalize.normalize_complete hu hv] at h
+    rw [Normalize.NormLevel.toTree_congr (Normalize.NormLevel.toList_eq h)]
+
+/-- Completeness of `isEquiv'`: semantically equal levels have equal normal forms. Both
+normal forms are reduced (`subsumption_reduced`), mutually dominate each other's sublevels
+(`separation`), and reduced forms with the same sublevels are the same map. -/
+theorem isEquiv'_complete (hu : VLevel.ofLevel ls u = some u')
+    (hv : VLevel.ofLevel ls v = some v') : isEquiv' u v ↔ u' ≈ v' := by
+  simp only [isEquiv', Bool.or_eq_true, Normalize.normalize_complete hu hv]
+  exact ⟨fun h => h.elim (fun h => isEquiv_wf h hu hv) id, .inr⟩
+
+/-- Completeness of `geq'`: every valid semantic inequality is accepted. Every sublevel of
+`normalize v` is semantically bounded by `normalize u`, hence syntactically dominated by one
+of its sublevels (`separation`), which is exactly what the discharging fold in
+`NormLevel.le` checks for. -/
+theorem geq'_complete (hu : VLevel.ofLevel ls u = some u')
+    (hv : VLevel.ofLevel ls v = some v') : geq' u v ↔ v' ≤ u' := by
+  open Normalize in
+  refine ⟨geq'_wf hu hv, fun h => ?_⟩
+  simp only [geq', Bool.or_eq_true]
+  refine .inr ?_
+  refine NormLevel.le_complete normalize_sortedVars normalize_sortedVars normalize_nonempty
+    normalize_sorted normalize_sorted ?_
+  refine NormLevel.separation (normalize_keys hv) normalize_vars fun ρ => ?_
+  rw [normalize_eval hv, normalize_eval hu]
+  exact h ρ
diff --git a/Ix/Theory/Named/Verify/LevelStd.lean b/Ix/Theory/Named/Verify/LevelStd.lean
new file mode 100644
index 000000000..e05736b3c
--- /dev/null
+++ b/Ix/Theory/Named/Verify/LevelStd.lean
@@ -0,0 +1,549 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Batteries.Tactic.OpenPrivate
+import Ix.Theory.Named.VLevel
+import Ix.Theory.Named.Verify.QSort
+import Ix.Theory.Named.Verify.NormLt
+
+open Ix.Theory (VLevel)
+
+open private go in Lean.Level.geq
+open private accMax mkIMaxAux isExplicitSubsumed from Lean.Level
+
+namespace Lean.Level
+
+open Ix.Theory.Named
+
+/-!
+Semantic soundness of the universe-level operations in Lean's standard library.
+`normalize` is an opaque `partial def`, so `Ix.Theory.Named.Verify.Axioms` assumes it
+equals the total copy `Lean.Level.Total.normalize` defined there; the semantic
+behavior of that copy is `eval_normalize` below, which is still open. The exact
+correspondence between `geqCore` below and the private recursion used by
+`Lean.Level.geq` is proved.
+-/
+
+variable (ρ : Name → Nat) (μ : LMVarId → Nat) in
+def eval : Level → Nat
+  | .zero => 0
+  | .param n => ρ n
+  | .mvar n => μ n
+  | .succ l => eval l + 1
+  | .max l₁ l₂ => Nat.max (eval l₁) (eval l₂)
+  | .imax l₁ l₂ => Nat.imax (eval l₁) (eval l₂)
+
+private def offset : Level → Nat
+  | .succ l => offset l + 1
+  | _ => 0
+
+private theorem getOffsetAux_eq_offset :
+    l.getOffsetAux k = offset l + k := by
+  induction l generalizing k with
+  | succ l ih => simp only [Level.getOffsetAux, offset, ih]; omega
+  | _ => simp [Level.getOffsetAux, offset]
+
+private theorem getOffset_eq_offset : l.getOffset = offset l := by
+  simp [Level.getOffset, getOffsetAux_eq_offset]
+
+theorem eval_getLevelOffset :
+    eval ρ μ l = eval ρ μ l.getLevelOffset + l.getOffset := by
+  induction l with | succ l ih => ?_ | _ => rfl
+  simp only [eval, Level.getLevelOffset, getOffset_eq_offset, offset, ih]
+  omega
+
+theorem fallback_sound
+    (h : (u.getLevelOffset = v.getLevelOffset ∨ v.getLevelOffset.isZero = true) ∧
+      v.getOffset ≤ u.getOffset) :
+    eval ρ μ v ≤ eval ρ μ u := by
+  rw [eval_getLevelOffset, eval_getLevelOffset (l := u)]
+  rcases h with ⟨hv | hv, hk⟩
+  · rw [← hv]; omega
+  · have hv : v.getLevelOffset = .zero := by
+      generalize hbase : v.getLevelOffset = base at hv
+      cases base <;> simp_all [Level.isZero]
+    simp [hv, eval]
+    omega
+
+def geqCore : Level → Level → Bool
+  -- Keep this in the same source-shaped form as `go`'s `u == v || ...` prefix.
+  -- The apparently redundant `|| true` is therefore deliberate.
+  | u, .zero => u == .zero || true
+  | u, .max v₁ v₂ => u == .max v₁ v₂ || (geqCore u v₁ && geqCore u v₂)
+  | .max u₁ u₂, .imax v₁ v₂ =>
+    (.max u₁ u₂ : Level) == .imax v₁ v₂ ||
+      (geqCore u₁ (.imax v₁ v₂) || geqCore u₂ (.imax v₁ v₂) ||
+        (geqCore (.max u₁ u₂) v₁ && geqCore (.max u₁ u₂) v₂))
+  | .max u₁ u₂, v =>
+    let u := .max u₁ u₂
+    u == v || (geqCore u₁ v || geqCore u₂ v ||
+      ((u.getLevelOffset == v.getLevelOffset || v.getLevelOffset.isZero) &&
+        u.getOffset ≥ v.getOffset))
+  | .imax u₁ u₂, v => (.imax u₁ u₂ : Level) == v || geqCore u₂ v
+  | .succ u, .succ v => (.succ u : Level) == .succ v || geqCore u v
+  | u, .imax v₁ v₂ => u == .imax v₁ v₂ || (geqCore u v₁ && geqCore u v₂)
+  | u, v => u == v ||
+    ((u.getLevelOffset == v.getLevelOffset || v.getLevelOffset.isZero) &&
+      u.getOffset ≥ v.getOffset)
+  termination_by u v => (u, v)
+
+private theorem geqCore_eq_go : geqCore u v = go u v := by
+  fun_induction go with | _ u v
+  cases u <;> cases v <;> simp_all [geqCore, go]
+
+theorem geqCore_sound (h : geqCore u v) : eval ρ μ v ≤ eval ρ μ u := by
+  induction u, v using geqCore.induct with
+    simp only [geqCore, Bool.or_eq_true, Bool.and_eq_true, beq_iff_eq,
+      decide_eq_true_eq] at h
+  | case1 => simp [eval]
+  | case2 _ _ _ ih₂ ih₁ =>
+    rcases h with rfl | ⟨h₁, h₂⟩
+    · exact Nat.le_refl _
+    · exact (Nat.max_le).2 ⟨ih₂ h₁, ih₁ h₂⟩
+  | case3 u₁ u₂ v₁ v₂ ih₄ ih₃ ih₂ ih₁ =>
+    rcases h with heq | (h | h) | ⟨h₁, h₂⟩
+    · exact Nat.le_of_eq (congrArg (eval ρ μ) heq).symm
+    · exact Nat.le_trans (ih₄ h) (Nat.le_max_left ..)
+    · exact Nat.le_trans (ih₃ h) (Nat.le_max_right ..)
+    · simp only [eval, Nat.imax]
+      split
+      · exact Nat.zero_le _
+      · exact (Nat.max_le).2 ⟨ih₂ h₁, ih₁ h₂⟩
+  | case4 u₁ u₂ v _ _ _ ih₂ ih₁ =>
+    rcases h with rfl | h
+    · exact Nat.le_refl _
+    · rcases h with (h | h) | h
+      · exact Nat.le_trans (ih₂ h) (Nat.le_max_left ..)
+      · exact Nat.le_trans (ih₁ h) (Nat.le_max_right ..)
+      · exact fallback_sound h
+  | case5 u₁ u₂ v _ _ ih =>
+    rcases h with rfl | h
+    · exact Nat.le_refl _
+    · simp only [eval, Nat.imax]
+      have hv := ih h
+      split <;> rename_i hz
+      · simpa [hz] using hv
+      · exact Nat.le_trans hv (Nat.le_max_right ..)
+  | case6 u v ih =>
+    rcases h with heq | h
+    · exact Nat.le_of_eq (congrArg (eval ρ μ) heq).symm
+    · simpa [eval] using Nat.add_le_add_right (ih h) 1
+  | case7 u v₁ v₂ _ _ ih₂ ih₁ =>
+    rcases h with rfl | ⟨h₁, h₂⟩
+    · exact Nat.le_refl _
+    · simp only [eval, Nat.imax]
+      split
+      · exact Nat.zero_le _
+      · exact (Nat.max_le).2 ⟨ih₂ h₁, ih₁ h₂⟩
+  | case8 =>
+    rcases h with heq | h
+    · exact Nat.le_of_eq (congrArg (eval ρ μ) heq).symm
+    · exact fallback_sound h
+
+/-!
+### Soundness of `normalize`
+
+The proof is by strong induction on `Total.size`. The mutual recursion with
+`getMaxArgsAux` is untangled by observing that `getMaxArgsAux l true` recurses only
+structurally, and `getMaxArgsAux l false` calls `normalize` only on levels of size at
+most `size l`, so both can be handled by standalone lemmas parameterized by the
+induction hypothesis for `normalize`.
+
+The `max` branch sorts the collected arguments with `qsort normLt` and then drops
+dominated entries: `mkMaxAux` drops an entry when the next one has the same level base
+(relying on offsets being sorted within a base class), and the explicit (constant)
+entries in the sorted prefix are dropped when subsumed by the largest explicit or by
+some offset to its right. All of this is justified by a single consequence of
+sortedness: entries with equal `getLevelOffset` occur in order of `getOffset`
+(`explicit` entries all have base `zero`, so this also orders the explicit prefix).
+That fact, together with the fact that `qsort` permutes the array, are the only
+properties of sorting used; they are `qsort_perm_toList` and `pairwise_qsort_normLt`
+below, currently unproved because `Array.qsort` has no specification in the standard
+library.
+-/
+
+theorem le_ext_le {n m : Nat} (H : ∀ x, n ≤ x → m ≤ x) : m ≤ n := H _ (Nat.le_refl _)
+
+theorem nat_ext_le {n m : Nat} (H : ∀ x, n ≤ x ↔ m ≤ x) : n = m :=
+  Nat.le_antisymm ((H _).2 (Nat.le_refl _)) ((H _).1 (Nat.le_refl _))
+
+theorem eval_addOffset : eval ρ μ (addOffset l k) = eval ρ μ l + k := by
+  suffices ∀ k l, eval ρ μ (addOffsetAux k l) = eval ρ μ l + k from this ..
+  intro k; induction k with intro l
+  | zero => rfl
+  | succ k ih => rw [addOffsetAux, ih]; simp [eval, mkLevelSucc]; omega
+
+theorem isZero_iff : isZero l ↔ l = .zero := by cases l <;> simp [Level.isZero]
+
+theorem isNeverZero_sound (h : l.isNeverZero = true) : 0 < eval ρ μ l := by
+  induction l with
+  | zero | param | mvar => simp [isNeverZero] at h
+  | succ l => simp [eval]
+  | max l₁ l₂ ih₁ ih₂ =>
+    simp only [isNeverZero, Bool.or_eq_true] at h
+    simp only [eval, Nat.max_eq_max]
+    obtain h | h := h
+    · have := ih₁ h; omega
+    · have := ih₂ h; omega
+  | imax l₁ l₂ _ ih₂ =>
+    simp only [isNeverZero] at h
+    have := ih₂ h
+    simp only [eval, Nat.imax, Nat.max_eq_max]; split <;> omega
+
+theorem eval_accMax : eval ρ μ (accMax r p k) = Nat.max (eval ρ μ r) (eval ρ μ p + k) := by
+  rw [accMax]; split <;> rename_i h
+  · rw [isZero_iff.1 h, eval_addOffset]; simp [eval]
+  · simp [mkLevelMax, eval, eval_addOffset]
+
+theorem eval_mkIMaxAux :
+    eval ρ μ (mkIMaxAux a b) = Nat.imax (eval ρ μ a) (eval ρ μ b) := by
+  unfold mkIMaxAux; split
+  · simp [eval, Nat.imax]
+  · simp only [eval, Nat.imax]; split <;> [omega; simp]
+  · simp only [eval, Nat.imax, Nat.max_eq_max]; split <;> [omega; rw [Nat.max_eq_right (by omega)]]
+  · split <;> rename_i h
+    · cases eq_of_beq h; simp only [Nat.imax, Nat.max_eq_max]
+      split <;> [omega; rw [Nat.max_self]]
+    · simp [mkLevelIMax, eval]
+
+/-- The maximum of the evaluations of a list of levels. -/
+def evalList (ρ : Name → Nat) (μ : LMVarId → Nat) (ls : List Level) : Nat :=
+  ls.foldr (fun l n => Nat.max (eval ρ μ l) n) 0
+
+theorem evalList_le_iff : evalList ρ μ ls ≤ n ↔ ∀ l ∈ ls, eval ρ μ l ≤ n := by
+  induction ls with
+  | nil => simp [evalList, Nat.zero_le]
+  | cons l ls ih =>
+    show Nat.max (eval ρ μ l) (evalList ρ μ ls) ≤ n ↔ _
+    rw [Nat.max_eq_max, Nat.max_le, ih]; simp
+
+theorem le_evalList (h : l ∈ ls) : eval ρ μ l ≤ evalList ρ μ ls :=
+  evalList_le_iff.1 (Nat.le_refl _) _ h
+
+theorem evalList_perm (h : ls₁.Perm ls₂) : evalList ρ μ ls₁ = evalList ρ μ ls₂ := by
+  refine nat_ext_le fun _ => ?_; simp only [evalList_le_iff, h.mem_iff]
+
+theorem evalList_append : evalList ρ μ (ls₁ ++ ls₂) =
+    Nat.max (evalList ρ μ ls₁) (evalList ρ μ ls₂) := by
+  induction ls₁ with | nil => simp [evalList] | cons l ls ih
+  show Nat.max _ (evalList ρ μ (ls ++ ls₂)) = Nat.max (Nat.max _ (evalList ρ μ ls)) _
+  rw [ih]; simp only [Nat.max_eq_max]; rw [Nat.max_assoc]
+
+/-- `Array.qsort` returns a permutation of its input (`Array.qsort_perm`). -/
+theorem qsort_perm (as : Array Level) : (as.qsort normLt).toList.Perm as.toList :=
+  Array.perm_iff_toList_perm.1 (Array.qsort_perm normLt 0 (as.size - 1) as)
+
+/-- Entries with equal level base come out of `qsort normLt` ordered by offset: a
+consequence of sortedness (`Array.qsort_sorted`), since `normLt` compares levels with
+equal bases by offset. -/
+theorem pairwise_qsort (as : Array Level) :
+    (as.qsort normLt).toList.Pairwise fun a b =>
+      a.getLevelOffset = b.getLevelOffset → a.getOffset ≤ b.getOffset := by
+  rw [List.pairwise_iff_getElem]
+  intro i j hi hj hij hb
+  simp only [Array.getElem_toList] at hb
+  simpa [normLt_same_base hb.symm] using
+    Array.qsort_sorted normLt normLt_asymm normLt_le_trans as i j hij hj
+
+theorem offset_le_eval : l.getOffset ≤ eval ρ μ l := by
+  rw [eval_getLevelOffset]; omega
+
+theorem eval_of_isZero (h : l.getLevelOffset.isZero) : eval ρ μ l = l.getOffset := by
+  rw [eval_getLevelOffset, isZero_iff.1 h]; simp [eval]
+
+theorem skipExplicit_spec {lvls : Array Level} : i ≤ lvls.size →
+    i ≤ Total.skipExplicit lvls i ∧ Total.skipExplicit lvls i ≤ lvls.size ∧
+    ∀ j (_ : j < lvls.size), i ≤ j → j < Total.skipExplicit lvls i →
+      lvls[j].getLevelOffset.isZero := by
+  fun_induction Total.skipExplicit lvls i with
+  | case1 i hi hz ih =>
+    intro h
+    obtain ⟨ih1, ih2, ih3⟩ := ih (by omega)
+    refine ⟨by omega, ih2, fun j hj hij hlt => ?_⟩
+    rcases Nat.eq_or_lt_of_le hij with rfl | hij'
+    · exact hz
+    · exact ih3 j hj (by omega) hlt
+  | case2 i hi hz => exact fun h => ⟨Nat.le_refl _, by omega, fun j hj hij hlt => by omega⟩
+  | case3 i hi => exact fun h => ⟨Nat.le_refl _, by omega, fun j hj hij hlt => by omega⟩
+
+theorem isExplicitSubsumedAux_spec {lvls : Array Level} :
+    Total.isExplicitSubsumedAux lvls mx i = true ↔
+      ∃ j, i ≤ j ∧ ∃ (_ : j < lvls.size), mx ≤ lvls[j].getOffset := by
+  fun_induction Total.isExplicitSubsumedAux lvls mx i with
+  | case1 i hi hge => simpa using ⟨i, Nat.le_refl _, hi, by omega⟩
+  | case2 i hi hlt ih =>
+    rw [ih]
+    constructor <;> rintro ⟨j, hij, hj, hle⟩ <;> refine ⟨j, ?_, hj, hle⟩
+    · omega
+    · obtain rfl | h := Nat.eq_or_lt_of_le hij <;> omega
+  | case3 i hi => simp; rintro j hij hj; omega
+
+theorem eval_mkMaxAux {lvls : Array Level}
+    (hs : ∀ (i j : Nat) (hi : i < lvls.size) (hj : j < lvls.size), i < j →
+      lvls[i].getLevelOffset = lvls[j].getLevelOffset → lvls[i].getOffset ≤ lvls[j].getOffset)
+    (hfuel : lvls.size ≤ i + fuel)
+    (hi0 : 0 < i) (hile : i ≤ lvls.size)
+    (hp : ∀ h : i - 1 < lvls.size, prev = lvls[i-1].getLevelOffset ∧ prevK = lvls[i-1].getOffset) :
+    eval ρ μ (Total.mkMaxAux lvls extraK i prev prevK result) =
+      Nat.max (eval ρ μ result) (evalList ρ μ (lvls.toList.drop (i-1)) + extraK) := by
+  induction fuel generalizing i result prev prevK with
+  | zero =>
+    have hie : i = lvls.size := by omega
+    obtain ⟨hp, hpk⟩ := hp (by omega)
+    rw [Total.mkMaxAux.eq_def, dif_neg (by omega), eval_accMax]
+    have hlast : i - 1 < lvls.size := by omega
+    have hdrop : lvls.toList.drop (i-1) = [lvls[i-1]] := by
+      rw [List.drop_eq_getElem_cons (by simp only [Array.length_toList]; omega)]
+      simp [hie]; omega
+    have : eval ρ μ lvls[i-1] = eval ρ μ prev + prevK := by
+      rw [eval_getLevelOffset (l := lvls[i-1]), hp, hpk]
+    rw [hdrop]
+    simp only [evalList, List.foldr_cons, List.foldr_nil, this, Nat.max_eq_max]
+    omega
+  | succ fuel ih =>
+    rw [Total.mkMaxAux.eq_def]
+    split <;> rename_i hlt
+    · obtain ⟨hp, hpk⟩ := hp (by omega)
+      have hlast : i - 1 < lvls.size := by omega
+      have hdrop : lvls.toList.drop (i-1) = lvls[i-1] :: lvls.toList.drop i := by
+        rw [List.drop_eq_getElem_cons (by simp only [Array.length_toList]; omega)]
+        simp; congr 1; omega
+      have heval : eval ρ μ lvls[i-1] = eval ρ μ prev + prevK := by
+        rw [eval_getLevelOffset (l := lvls[i-1]), hp, hpk]
+      have hmem : eval ρ μ lvls[i] ≤ evalList ρ μ (lvls.toList.drop i) :=
+        le_evalList (by rw [List.drop_eq_getElem_cons (by simp only [Array.length_toList]; omega)]; exact .head _)
+      dsimp only
+      split <;> rename_i hbeq
+      · -- equal bases: drop the previous entry
+        rw [ih (i := i+1) (by omega) (by omega) (by omega) (fun h => by simp)]
+        have hb : lvls[i].getLevelOffset = prev := eq_of_beq hbeq
+        have hk : prevK ≤ lvls[i].getOffset := by
+          rw [hpk]; exact hs (i-1) i hlast hlt (by omega) (by rw [hb, hp])
+        have hle : eval ρ μ lvls[i-1] ≤ evalList ρ μ (lvls.toList.drop i) := by
+          refine Nat.le_trans ?_ hmem
+          rw [heval, eval_getLevelOffset (l := lvls[i]), hb, hp]
+          omega
+        rw [Nat.add_sub_cancel, hdrop]
+        have : evalList ρ μ (lvls[i-1] :: lvls.toList.drop i) =
+            evalList ρ μ (lvls.toList.drop i) := by
+          exact Nat.max_eq_right hle
+        rw [this]
+      · -- new base: accumulate the previous entry
+        rw [ih (i := i+1) (by omega) (by omega) (by omega) (fun h => by simp)]
+        rw [Nat.add_sub_cancel, eval_accMax, hdrop]
+        simp only [evalList, List.foldr_cons, Nat.max_eq_max, heval]
+        omega
+    · have hie : i = lvls.size := by omega
+      obtain ⟨hp, hpk⟩ := hp (by omega)
+      rw [eval_accMax]
+      have hlast : i - 1 < lvls.size := by omega
+      have hdrop : lvls.toList.drop (i-1) = [lvls[i-1]] := by
+        rw [List.drop_eq_getElem_cons (by simp only [Array.length_toList]; omega)]
+        simp [hie]; omega
+      have : eval ρ μ lvls[i-1] = eval ρ μ prev + prevK := by
+        rw [eval_getLevelOffset (l := lvls[i-1]), hp, hpk]
+      rw [hdrop]
+      simp only [evalList, List.foldr_cons, List.foldr_nil, this, Nat.max_eq_max]
+      omega
+
+theorem size_lt_getMaxArgsAux_true :
+    lvls.size < (Total.getMaxArgsAux l true lvls).size := by
+  induction l generalizing lvls with
+  | max _ _ ih₁ ih₂ => exact Total.getMaxArgsAux.eq_def .. ▸ Nat.lt_trans ih₁ ih₂
+  | _ => rw [Total.getMaxArgsAux.eq_def]; simp
+
+theorem size_lt_getMaxArgsAux_false :
+    lvls.size < (Total.getMaxArgsAux l false lvls).size := by
+  induction l generalizing lvls with
+  | max _ _ ih₁ ih₂ => exact Total.getMaxArgsAux.eq_def .. ▸ Nat.lt_trans ih₁ ih₂
+  | _ => exact Total.getMaxArgsAux.eq_def .. ▸ size_lt_getMaxArgsAux_true ..
+
+theorem evalList_getMaxArgsAux_true :
+    evalList ρ μ (Total.getMaxArgsAux l true lvls).toList =
+      Nat.max (evalList ρ μ lvls.toList) (eval ρ μ l) := by
+  induction l generalizing lvls with
+  | max l₁ l₂ ih₁ ih₂ =>
+    rw [Total.getMaxArgsAux, ih₂, ih₁]
+    simp only [eval, Nat.max_eq_max]; omega
+  | _ =>
+    rw [Total.getMaxArgsAux.eq_def, Array.toList_push, evalList_append]
+    simp only [evalList, List.foldr_cons, List.foldr_nil, Nat.max_eq_max]; omega
+
+theorem evalList_getMaxArgsAux_false {l : Level}
+    (IH : ∀ u, Total.size u ≤ Total.size l → eval ρ μ (Total.normalize u) = eval ρ μ u) :
+    evalList ρ μ (Total.getMaxArgsAux l false lvls).toList =
+      Nat.max (evalList ρ μ lvls.toList) (eval ρ μ l) := by
+  induction l generalizing lvls with
+  | max l₁ l₂ ih₁ ih₂ =>
+    rw [Total.getMaxArgsAux.eq_def]
+    show evalList ρ μ (Total.getMaxArgsAux l₂ false (Total.getMaxArgsAux l₁ false lvls)).toList = _
+    rw [ih₂ (fun u hu => IH u (by simp only [Total.size] at *; omega)),
+      ih₁ (fun u hu => IH u (by simp only [Total.size] at *; omega))]
+    simp only [eval, Nat.max_eq_max]; omega
+  | _ => rw [Total.getMaxArgsAux.eq_def, evalList_getMaxArgsAux_true, IH _ (Nat.le_refl _)]
+
+/-- Dropping a dominated prefix does not change the maximum. -/
+theorem evalList_drop_eq {ls : List Level} (hstart : start ≤ ls.length)
+    (hdom : ∀ j (hj : j < ls.length), j < start →
+      eval ρ μ ls[j] ≤ evalList ρ μ (ls.drop start)) :
+    evalList ρ μ (ls.drop start) = evalList ρ μ ls := by
+  refine nat_ext_le fun n => ?_
+  simp only [evalList_le_iff]
+  constructor <;> intro H l hl
+  · obtain ⟨j, hj, rfl⟩ := List.mem_iff_getElem.1 hl
+    by_cases hjs : j < start
+    · exact Nat.le_trans (hdom j hj hjs) (evalList_le_iff.2 H)
+    · refine H _ (List.mem_iff_getElem.2 ⟨j - start, by simp; omega, ?_⟩)
+      rw [List.getElem_drop]; congr 1; omega
+  · exact H l (List.drop_subset _ _ hl)
+
+/-- The level base of a level that is not already normalized is a `max` or an `imax`. -/
+theorem base_of_not_cheap {l : Level} (h : ¬l.isAlreadyNormalizedCheap = true) :
+    (∃ a b, l.getLevelOffset = .max a b) ∨ (∃ a b, l.getLevelOffset = .imax a b) := by
+  induction l with
+  | succ l ih => apply ih; simpa [isAlreadyNormalizedCheap] using h
+  | max l₁ l₂ => exact .inl ⟨_, _, rfl⟩
+  | imax l₁ l₂ => exact .inr ⟨_, _, rfl⟩
+  | _ => simp [isAlreadyNormalizedCheap] at h
+
+theorem eval_normalize_total {l : Level} : eval ρ μ (Total.normalize l) = eval ρ μ l := by
+  generalize hn : Total.size l = n
+  induction n using Nat.strongRecOn generalizing l with | _ n IH
+  subst hn
+  rw [Total.normalize.eq_def]
+  split <;> [rfl; rename_i hcheap]
+  have hsz := Total.size_getLevelOffset l
+  split <;> [rename_i l₁ l₂ hbase; rename_i l₁ l₂ hbase; skip]
+  · -- max
+    rw [eval_getLevelOffset (l := l), hbase]
+    rw [hbase] at hsz; simp only [Total.size] at hsz
+    have hs₁ := Total.one_le_size l₁
+    have hs₂ := Total.one_le_size l₂
+    have IH₁ u (hu : Total.size u ≤ Total.size l₁) : eval ρ μ (Total.normalize u) = eval ρ μ u :=
+      IH _ (by omega) rfl
+    have IH₂ u (hu : Total.size u ≤ Total.size l₂) : eval ρ μ (Total.normalize u) = eval ρ μ u :=
+      IH _ (by omega) rfl
+    extract_lets k lvls₁ L1 L i₀ i lvl₁ prev prevK
+    have hevalL1 : evalList ρ μ L1.toList = Nat.max (eval ρ μ l₁) (eval ρ μ l₂) := by
+      rw [evalList_getMaxArgsAux_false IH₂, evalList_getMaxArgsAux_false IH₁]
+      simp [evalList, Nat.max_eq_max]
+    have hL1pos : 0 < L1.size :=
+      Nat.lt_trans (size_lt_getMaxArgsAux_false (lvls := #[])) size_lt_getMaxArgsAux_false
+    have hperm : L.toList.Perm L1.toList := qsort_perm L1
+    have hpair : List.Pairwise _ L.toList := pairwise_qsort L1
+    have hLsize : L.size = L1.size := by
+      simpa [Array.length_toList] using hperm.length_eq
+    have hLpos : 0 < L.size := hLsize ▸ hL1pos
+    have hevalL : evalList ρ μ L.toList = Nat.max (eval ρ μ l₁) (eval ρ μ l₂) := by
+      rw [evalList_perm hperm, hevalL1]
+    have hs : ∀ (i j : Nat) (hi : i < L.size) (hj : j < L.size), i < j →
+        L[i].getLevelOffset = L[j].getLevelOffset → L[i].getOffset ≤ L[j].getOffset := by
+      intro i j hi hj hij hb
+      have := (List.pairwise_iff_getElem.1 hpair) i j (by simpa using hi) (by simpa using hj) hij
+      simpa using this (by simpa using hb)
+    obtain ⟨-, hskle, hskz⟩ := skipExplicit_spec (lvls := L) (i := 0) (Nat.zero_le _)
+    -- the start index and its bound
+    have main i (hi : i < L.size)
+        (hdom : ∀ j (hj : j < L.size), j < i → eval ρ μ L[j] ≤ evalList ρ μ (L.toList.drop i)) :
+        eval ρ μ (Total.mkMaxAux L (l.getOffset) (i+1) L[i]!.getLevelOffset L[i]!.getOffset
+          Level.zero) = Nat.max (eval ρ μ l₁) (eval ρ μ l₂) + l.getOffset := by
+      rw [getElem!_pos L i hi,
+        eval_mkMaxAux hs (fuel := L.size) (by omega) (by omega) (by omega) (fun _ => by simp),
+        Nat.add_sub_cancel, evalList_drop_eq (by rw [Array.length_toList]; omega) hdom, hevalL]
+      simp [eval, Nat.max_eq_max]
+    subst i lvl₁ prevK prev; split <;> rename_i hsub
+    · -- explicits subsumed: start at the first non-explicit
+      rw [isExplicitSubsumed] at hsub
+      split at hsub <;> [cases hsub; let (eq := eq) i'+1 := i₀]; subst i₀
+      simp only [isExplicitSubsumedAux_eq, isExplicitSubsumedAux_spec] at hsub
+      obtain ⟨j, hij, hjs, hmax⟩ := hsub; dsimp at hmax
+      refine main (i'+1) (by omega) fun m hm hmi => ?_
+      -- every dropped explicit is at most the witness entry
+      have hzm : L[m].getLevelOffset.isZero := hskz m hm (Nat.zero_le _) (eq ▸ hmi)
+      have hz₁ := hskz i' (by omega) (Nat.zero_le _) (by omega)
+      have h2 : L[m].getOffset ≤ L[i'].getOffset := by
+        rcases Nat.eq_or_lt_of_le (Nat.le_pred_of_lt hmi) with h | h
+        · subst h; exact Nat.le_refl _
+        · exact hs m i' hm (by omega) h (by rw [isZero_iff.1 hzm, isZero_iff.1 hz₁])
+      have h3 : L[i'].getOffset ≤ eval ρ μ L[j] :=
+        Nat.le_trans (getElem!_pos L i' (by omega) ▸ hmax) offset_le_eval
+      refine eval_of_isZero hzm ▸ Nat.le_trans (Nat.le_trans h2 h3) (le_evalList ?_)
+      refine List.mem_iff_getElem.2 ⟨j - (i' + 1), ?_, ?_⟩
+      · simp only [List.length_drop, Array.length_toList]; omega
+      · rw [List.getElem_drop]; simp only [Array.getElem_toList]; congr 1; omega
+    · -- keep the largest explicit
+      cases eq : i₀ with | zero => exact main 0 (by omega) (fun m hm hmi => by omega) | succ i'
+      have hstart : i' < L.size := by omega
+      refine main i' hstart fun m hm hmi => ?_
+      have hzm : L[m].getLevelOffset.isZero := hskz m hm (Nat.zero_le _) (by omega)
+      have hz₁ : L[i'].getLevelOffset.isZero :=
+        hskz i' hstart (Nat.zero_le _) (by omega)
+      refine eval_of_isZero hzm ▸ Nat.le_trans (hs m i' hm hstart (by omega) ?_) ?_
+      · rw [isZero_iff.1 hzm, isZero_iff.1 hz₁]
+      refine eval_of_isZero hz₁ ▸ le_evalList ?_
+      rw [List.drop_eq_getElem_cons (by omega)]; exact .head _
+  · -- imax
+    rw [eval_getLevelOffset (l := l), hbase]
+    rw [hbase] at hsz; simp only [Total.size] at hsz
+    have hs₁ := Total.one_le_size l₁
+    have hs₂ := Total.one_le_size l₂
+    split <;> rename_i hnz
+    · rw [eval_addOffset, IH (Total.size (mkLevelMax l₁ l₂))
+        (by simp only [mkLevelMax, Total.size]; omega) rfl]
+      have := isNeverZero_sound (ρ := ρ) (μ := μ) hnz
+      simp only [mkLevelMax, eval, Nat.imax]
+      rw [if_neg (by omega)]
+    · rw [eval_addOffset, eval_mkIMaxAux, IH _ (by omega) rfl, IH _ (by omega) rfl]; rfl
+  · grind [base_of_not_cheap]
+
+theorem eval_normalize {ρ μ l} : eval ρ μ l.normalize = eval ρ μ l := by
+  rw [normalize_eq]; exact eval_normalize_total
+
+theorem geq_eq_core : geq u v = geqCore (normalize u) (normalize v) := by
+  simp [geq, geqCore_eq_go]
+
+theorem isEquiv_sound (h : isEquiv u v) : eval ρ μ u = eval ρ μ v := by
+  simp only [Level.isEquiv, Bool.or_eq_true, beq_iff_eq] at h
+  rcases h with rfl | h <;> [rfl; skip]
+  rw [← eval_normalize (l := u), ← eval_normalize (l := v), h]
+
+theorem geq_sound (h : geq u v) : eval ρ μ v ≤ eval ρ μ u := by
+  rw [geq_eq_core] at h
+  rw [← eval_normalize (l := u), ← eval_normalize (l := v)]
+  exact geqCore_sound h
+
+theorem eval_ofLevel (h : VLevel.ofLevel Us l = some l') :
+    l'.eval ns = eval (fun n => ns.getD (Us.idxOf n) 0) μ l := by
+  induction l generalizing l' with
+  | zero => simp [VLevel.ofLevel] at h; cases h; rfl
+  | succ l ih =>
+    simp [VLevel.ofLevel, bind] at h
+    obtain ⟨l', hl, rfl⟩ := h
+    simp [VLevel.eval, eval, ih hl]
+  | max l₁ l₂ ih₁ ih₂ | imax l₁ l₂ ih₁ ih₂ =>
+    simp [VLevel.ofLevel, bind] at h
+    obtain ⟨l₁', hl₁, l₂', hl₂, rfl⟩ := h
+    simp only [VLevel.eval, eval, ih₁ hl₁, ih₂ hl₂]
+    all_goals rfl
+  | param n =>
+    simp [VLevel.ofLevel] at h
+    obtain ⟨hidx, rfl⟩ := h
+    simp [VLevel.eval, eval]
+  | mvar n => simp [VLevel.ofLevel] at h
+
+theorem isEquiv_wf (h : isEquiv u v)
+    (hu : VLevel.ofLevel Us u = some u') (hv : VLevel.ofLevel Us v = some v') : u' ≈ v' := by
+  refine VLevel.equiv_def.2 fun ns => ?_
+  rw [eval_ofLevel (μ := fun _ => 0) hu, eval_ofLevel (μ := fun _ => 0) hv]
+  exact isEquiv_sound h
+
+theorem geq_wf (h : geq u v)
+    (hu : VLevel.ofLevel Us u = some u') (hv : VLevel.ofLevel Us v = some v') : v' ≤ u' := by
+  intro ns
+  rw [eval_ofLevel (μ := fun _ => 0) hv, eval_ofLevel (μ := fun _ => 0) hu]
+  exact geq_sound h
+
+end Lean.Level
diff --git a/Ix/Theory/Named/Verify/LocalContext.lean b/Ix/Theory/Named/Verify/LocalContext.lean
new file mode 100644
index 000000000..3abc5fa70
--- /dev/null
+++ b/Ix/Theory/Named/Verify/LocalContext.lean
@@ -0,0 +1,337 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.PersistentHashMap
+import Ix.Theory.Named.Verify.Expr
+import Ix.Theory.Named.Verify.Typing.Expr
+import Ix.Theory.Named.Verify.Typing.Lemmas
+
+open Ix.Theory.Named
+
+namespace Lean.LocalContext
+
+noncomputable def toList (lctx : LocalContext) : List LocalDecl :=
+  lctx.decls.toList'.reverse.filterMap id
+
+noncomputable def fvars (lctx : LocalContext) : List FVarId :=
+  lctx.toList.map (·.fvarId)
+
+def mkBindingList1 (isLambda : Bool) (lctx : LocalContext)
+    (xs : List FVarId) (x : FVarId) (b : Expr) : Expr :=
+  match lctx.find? x with
+  | some (.cdecl _ _ n ty bi _) =>
+    let ty := ty.abstractList xs
+    if isLambda then
+      .lam n ty b bi
+    else
+      .forallE n ty b bi
+  | some (.ldecl _ _ n ty val nonDep _) =>
+    if b.hasLooseBVar' 0 then
+      let ty  := ty.abstractList xs
+      let val := val.abstractList xs
+      .letE n ty val b nonDep
+    else
+      b.lowerLooseBVars' 1 1
+  | none => panic! "unknown free variable"
+
+def mkBindingList (isLambda : Bool) (lctx : LocalContext) (xs : List FVarId) (b : Expr) : Expr :=
+  core (b.abstractList xs)
+where
+  core := go xs.reverse
+  go : List FVarId → Expr → Expr
+  | [], b => b
+  | x :: xs, b => go xs (mkBindingList1 isLambda lctx xs.reverse x b)
+
+theorem mkBinding_eq :
+    mkBinding isLambda lctx ⟨xs.map .fvar⟩ b = mkBindingList isLambda lctx xs b := by
+  simp only [mkBinding, List.getElem_toArray, Expr.abstractRange_eq, Expr.hasLooseBVar_eq,
+    Expr.abstract_eq, ← Array.take_eq_extract, List.take_toArray, Bool.and_false,
+    ← List.map_take, List.getElem_map, Expr.lowerLooseBVars_eq]
+  dsimp only [Array.size]
+  simp only [List.getElem_eq_getElem?_get, Option.get_eq_getD (fallback := default)]
+  change Nat.foldRev _ (fun i x =>
+    mkBindingList1 isLambda lctx (xs.take i) (xs[i]?.getD default)) .. = mkBindingList.go ..
+  rw [List.length_map]; generalize eq : xs.length = n
+  generalize b.abstractList xs = b
+  induction n generalizing xs b with
+  | zero => let [] := xs; simp [mkBindingList.go]
+  | succ n ih =>
+    obtain rfl | ⟨xs, a, rfl⟩ := List.eq_nil_or_concat xs; · cases eq
+    simp at eq ⊢; subst eq
+    simp +contextual only [Nat.le_of_lt, List.take_append_of_le_length,
+      List.getElem?_append_left, mkBindingList.go, ih]; simp
+
+theorem mkBindingList1_abstract {xs : List FVarId}
+    (hx : lctx.find? x = some decl) (nd : (a :: xs).Nodup) :
+    (mkBindingList1 isLambda lctx xs x b).abstract1 a xs.length =
+    mkBindingList1 isLambda lctx (a :: xs) x (b.abstract1 a (xs.length + 1)) := by
+  have (e:_) := Nat.zero_add _ ▸ Expr.abstract1_abstractList' (k := 0) (e := e) nd
+  simp [mkBindingList1, hx]; cases decl with simp
+  | cdecl _ _ _ ty => split <;> simp [Expr.abstract1, Expr.abstract1, this]
+  | ldecl =>
+    have := Expr.abstract1_hasLooseBVar a b (xs.length + 1) 0
+    simp at this; simp [this]; clear this
+    split
+    · simp [Expr.abstract1, Expr.abstract1, this]
+    · rename_i h; simp at h
+      rw [Expr.abstract1_lower h (Nat.zero_le _)]
+
+theorem mkBindingList_core_cons {xs : List FVarId} {b : Expr}
+    (hx : ∀ x ∈ xs, ∃ decl, lctx.find? x = some decl) (nd : (a :: xs).Nodup) :
+    mkBindingList.core isLambda lctx (a :: xs) (b.abstract1 a xs.length) =
+    mkBindingList1 isLambda lctx [] a
+      ((mkBindingList.core isLambda lctx xs b).abstract1 a) := by
+  obtain ⟨xs, rfl⟩ : ∃ xs', List.reverse xs' = xs := ⟨_, List.reverse_reverse _⟩
+  simp [mkBindingList.core] at *
+  induction xs generalizing b with
+  | nil => simp [mkBindingList.go]
+  | cons c xs ih =>
+    simp at hx nd ih
+    let ⟨decl, eq⟩ := hx.1
+    simp [mkBindingList.go]
+    rw [← xs.length_reverse, ← mkBindingList1_abstract eq (by simp [*])]
+    simp [ih hx.2 nd.1.2 nd.2.2]
+
+@[simp] theorem mkBindingList_nil : mkBindingList isLambda lctx [] b = b := rfl
+
+theorem mkBindingList_cons
+    (hx : ∀ x ∈ xs, ∃ decl, lctx.find? x = some decl) (nd : (a :: xs).Nodup) :
+    mkBindingList isLambda lctx (a :: xs) b =
+    mkBindingList1 isLambda lctx [] a ((mkBindingList isLambda lctx xs b).abstract1 a) := by
+  simp [mkBindingList]
+  rw [← Expr.abstract1_abstractList' nd]
+  rw [Nat.zero_add, mkBindingList_core_cons hx nd]
+
+theorem mkBindingList_eq_fold
+    (hx : ∀ x ∈ xs, ∃ decl, lctx.find? x = some decl) (nd : xs.Nodup) :
+    mkBindingList isLambda lctx xs b =
+    xs.foldr (fun a e => mkBindingList1 isLambda lctx [] a (e.abstract1 a)) b := by
+  induction xs <;> simp_all [mkBindingList_cons]
+
+theorem mkBindingList1_congr (H : lctx₁.find? x = lctx₂.find? x) :
+    mkBindingList1 isLambda lctx₁ xs x b = mkBindingList1 isLambda lctx₂ xs x b := by
+  simp [mkBindingList1, H]
+
+theorem mkBindingList_congr
+    (H : ∀ x ∈ xs, lctx₁.find? x = lctx₂.find? x) :
+    mkBindingList isLambda lctx₁ xs b = mkBindingList isLambda lctx₂ xs b := by
+  obtain ⟨xs, rfl⟩ : ∃ xs', List.reverse xs' = xs := ⟨_, List.reverse_reverse _⟩
+  simp [mkBindingList, mkBindingList.core] at *
+  generalize b.abstractList _ = b
+  induction xs generalizing b <;> simp_all [mkBindingList.go]
+  simp [mkBindingList1_congr H.1]
+
+inductive WF : LocalContext → Prop
+  | nil : WF ⟨.empty, .empty, .empty⟩
+  | cons :
+    d.fvarId = fv → map.find? fv = none → d.index = arr.size →
+    WF ⟨map, arr, fvmap⟩ →
+    WF ⟨map.insert fv d, arr.push d, fvmap⟩
+
+theorem WF.map_wf {lctx : LocalContext} : lctx.WF → lctx.fvarIdToDecl.WF
+  | .nil => .empty
+  | .cons _ _ _ h2 => .insert h2.map_wf
+
+theorem WF.decls_wf {lctx : LocalContext} : lctx.WF → lctx.decls.WF
+  | .nil => .empty
+  | .cons _ _ _ h2 => .push h2.decls_wf
+
+attribute [-simp] List.filterMap_reverse in
+open scoped _root_.List in
+theorem WF.map_toList : WF lctx →
+    lctx.fvarIdToDecl.toList' ~ lctx.toList.map fun d => (d.fvarId, d)
+  | .nil => by simp [LocalContext.toList]
+  | .cons h1 h2 _ h4 => by
+    subst h1; simp [LocalContext.toList]
+    refine h4.map_wf.toList'_insert _ _ |>.trans (.cons _ ?_)
+    rw [List.filter_eq_self.2]; · exact h4.map_toList
+    simp; rintro _ b h rfl
+    have := (h4.map_wf.find?_eq _).symm.trans h2
+    simp [List.lookup_eq_none_iff] at this
+    exact this _ _ h rfl
+
+theorem WF.find?_eq_find?_toList (H : WF lctx) :
+    lctx.find? fv = lctx.toList.find? (fv == ·.fvarId) := by
+  rw [LocalContext.find?, H.map_wf.find?_eq,
+    H.map_toList.lookup_eq H.map_wf.nodupKeys, List.map_fst_lookup]
+
+theorem WF.nodup : WF lctx → (lctx.toList.map (·.fvarId)).Nodup
+  | .nil => .nil
+  | .cons h1 h2 h3 h4 => by
+    have := h4.nodup
+    have := h4.find?_eq_find?_toList.symm.trans h2
+    simp_all [toList]
+    simpa [eq_comm] using this
+
+protected theorem WF.mkLocalDecl
+    (h1 : WF lctx) (h2 : lctx.find? fv = none) : WF (lctx.mkLocalDecl fv name ty bi kind) :=
+  .cons rfl h2 rfl h1
+
+protected theorem WF.mkLetDecl
+    (h1 : WF lctx) (h2 : lctx.find? fv = none) : WF (lctx.mkLetDecl fv name ty val bi kind) :=
+  .cons rfl h2 rfl h1
+
+@[simp] theorem mkLocalDecl_toList {lctx : LocalContext} :
+    (lctx.mkLocalDecl fv name ty bi kind).toList =
+    .cdecl lctx.decls.size fv name ty bi kind :: lctx.toList := by
+  simp [mkLocalDecl, toList]
+
+@[simp] theorem mkLetDecl_toList {lctx : LocalContext} :
+    (lctx.mkLetDecl fv name ty val bi kind).toList =
+    .ldecl lctx.decls.size fv name ty val bi kind :: lctx.toList := by
+  simp [mkLetDecl, toList]
+
+end Lean.LocalContext
+
+namespace Ix.Theory.Named
+
+open Lean
+open scoped _root_.List
+
+attribute [-simp] List.filterMap_reverse
+
+variable (env : VEnv) (Us : List Name) (Δ : VLCtx) in
+inductive TrLocalDecl : LocalDecl → VLocalDecl → Prop
+  | vlam : TrExprS env Us Δ ty ty' → env.IsType Us.length Δ.toCtx ty' →
+    TrLocalDecl (.cdecl n fv name ty bi kind) (.vlam ty')
+  | vlet :
+    TrExprS env Us Δ ty ty' → TrExprS env Us Δ val val' →
+    env.HasType Us.length Δ.toCtx val' ty' →
+    TrLocalDecl (.ldecl n fv name ty val bi kind) (.vlet ty' val')
+
+theorem TrLocalDecl.wf : TrLocalDecl env Us Δ d d' → d'.WF env Us.length Δ.toCtx
+  | .vlam _ h | .vlet _ _ h => h
+
+def _root_.Lean.LocalDecl.deps : LocalDecl → List FVarId
+  | .cdecl (type := t) .. => t.fvarsList
+  | .ldecl (type := t) (value := v) .. => t.fvarsList ++ v.fvarsList
+
+theorem TrLocalDecl.deps_wf : TrLocalDecl env Us Δ d d' → d.deps ⊆ Δ.fvars
+  | .vlam h _ => h.fvarsList
+  | .vlet h1 h2 _ => by simp [LocalDecl.deps, h1.fvarsList, h2.fvarsList]
+
+variable (env : VEnv) (Us : List Name) in
+inductive TrLCtx' : List LocalDecl → VLCtx → Prop
+  | nil : TrLCtx' [] []
+  | cons :
+    TrLCtx' ds Δ → TrLocalDecl env Us Δ d d' →
+    TrLCtx' (d :: ds) ((some (d.fvarId, d.deps), d') :: Δ)
+
+def TrLCtx (env : VEnv) (Us : List Name) (lctx : LocalContext) (Δ : VLCtx) : Prop :=
+  lctx.WF ∧ TrLCtx' env Us lctx.toList Δ
+
+theorem TrLCtx.nil {env : VEnv} {Us : List Name} : TrLCtx env Us {} [] := ⟨.nil, .nil⟩
+
+theorem TrLCtx'.noBV : TrLCtx' env Us ds Δ → Δ.NoBV
+  | .nil => rfl
+  | .cons h _ => h.noBV
+
+theorem TrLCtx'.forall₂ :
+    TrLCtx' env Us ds Δ → ds.Forall₂ Δ (R := fun d d' => d'.1 = some (d.fvarId, d.deps))
+  | .nil => by simp
+  | .cons h _ => by simp; exact h.forall₂
+
+theorem TrLCtx'.fvars_eq (H : TrLCtx' env Us ds Δ) : ds.map (·.fvarId) = Δ.fvars := by
+  simp [VLCtx.fvars]
+  induction H with
+  | nil => rfl
+  | cons h1 _ ih => simp [← ih]
+
+theorem TrLCtx.fvars_eq (H : TrLCtx env Us lctx Δ) : lctx.fvars = Δ.fvars :=
+  H.2.fvars_eq
+
+theorem TrLCtx'.find?_eq_some (H : TrLCtx' env Us ds Δ) :
+    (∃ d, ds.find? (fv == ·.fvarId) = some d) ↔ fv ∈ Δ.fvars := by
+  rw [← Option.isSome_iff_exists, List.find?_isSome]
+  induction H with simp
+  | @cons _ _ d d' _ _ ih => simp [← ih]
+
+theorem TrLCtx'.find?_isSome (H : TrLCtx' env Us ds Δ) :
+    (ds.find? (fv == ·.fvarId)).isSome = (Δ.find? (.inr fv)).isSome := by
+  rw [Bool.eq_iff_iff, Option.isSome_iff_exists, Option.isSome_iff_exists,
+    H.find?_eq_some, VLCtx.find?_eq_some]
+
+theorem TrLCtx.find?_isSome (H : TrLCtx env Us lctx Δ) :
+    (lctx.find? fv).isSome = (Δ.find? (.inr fv)).isSome := by
+  rw [H.1.find?_eq_find?_toList, H.2.find?_isSome]
+
+theorem TrLCtx.find?_eq_some (H : TrLCtx env Us lctx Δ) :
+    (∃ d, lctx.find? fv = some d) ↔ fv ∈ Δ.fvars := by
+  rw [H.1.find?_eq_find?_toList, H.2.find?_eq_some]
+
+theorem TrLCtx.find?_eq_none (H : TrLCtx env Us lctx Δ) :
+    lctx.find? fv = none ↔ ¬fv ∈ Δ.fvars := by simp [← H.find?_eq_some]
+
+theorem TrLCtx.contains (H : TrLCtx env Us lctx Δ) : lctx.contains fv ↔ fv ∈ Δ.fvars := by
+  rw [LocalContext.contains, PersistentHashMap.find?_isSome, Option.isSome_iff_exists]
+  exact H.find?_eq_some
+
+theorem TrLCtx'.wf : TrLCtx' env Us ds Δ → (ds.map (·.fvarId)).Nodup → Δ.WF env Us.length
+  | .nil, _ => ⟨⟩
+  | .cons h1 h2, .cons H1 H2 => by
+    refine ⟨h1.wf H2, fun _ _ => ?_, h2.wf⟩
+    rintro ⟨⟩; exact ⟨by simpa [← h1.find?_eq_some] using H1, h2.deps_wf⟩
+
+theorem TrLCtx.wf (H : TrLCtx env Us lctx Δ) : Δ.WF env Us.length := H.2.wf H.1.nodup
+
+def _root_.Lean.LocalDecl.value' : LocalDecl → Expr
+  | .ldecl (value := v) .. => v
+  | .cdecl (fvarId := fv) .. => .fvar fv
+
+theorem TrLCtx'.find?_of_mem (henv : env.WF) (H : TrLCtx' env Us ds Δ)
+    (nd : (ds.map (·.fvarId)).Nodup) (hm : decl ∈ ds) :
+    ∃ e A, Δ.find? (.inr decl.fvarId) = some (e, A) ∧
+      FVarsBelow Δ (.fvar decl.fvarId) decl.value' ∧ FVarsBelow Δ (.fvar decl.fvarId) decl.type ∧
+      TrExprS env Us Δ decl.value' e ∧ TrExprS env Us Δ decl.type A := by
+  have := H.wf nd
+  match H with
+  | .nil => cases hm
+  | .cons (ds := ds) h1 h2 =>
+    simp [VLCtx.find?, VLCtx.next]
+    obtain _ | ⟨_, hm : decl ∈ ds⟩ := hm
+    · simp [and_assoc]
+      cases h2 with
+      | vlam h2 h3 =>
+        refine ⟨.rfl, ?_, .fvar <| by simp [VLCtx.find?, VLCtx.next, LocalDecl.fvarId]; rfl, ?_⟩
+        · intro P hP he; exact fvarsIn_iff.2 ⟨hP.2 he, h2.fvarsIn.mono fun _ _ => ⟨⟩⟩
+        · exact h2.weakFV henv (.skip_fvar _ _ .refl) this
+      | vlet h2 h3 =>
+        refine ⟨?_, ?_, ?_, ?_⟩
+        · intro P hP he; have := hP.2 he; simp [LocalDecl.deps, or_imp, forall_and] at this
+          exact fvarsIn_iff.2 ⟨this.2, h3.fvarsIn.mono fun _ _ => ⟨⟩⟩
+        · intro P hP he; have := hP.2 he; simp [LocalDecl.deps, or_imp, forall_and] at this
+          exact fvarsIn_iff.2 ⟨this.1, h2.fvarsIn.mono fun _ _ => ⟨⟩⟩
+        · simpa [LocalDecl.value', VLocalDecl.value, VLocalDecl.depth] using
+            h3.weakFV henv (.skip_fvar _ _ .refl) this
+        · simpa [LocalDecl.type, VLocalDecl.type, VLocalDecl.depth] using
+            h2.weakFV henv (.skip_fvar _ _ .refl) this
+    · simp at nd; rw [if_neg (by simpa using Ne.symm (nd.1 _ hm))]; simp
+      have ⟨_, _, h1, h2, h3, h4, h5⟩ := h1.find?_of_mem henv nd.2 hm
+      refine ⟨_, _, ⟨_, _, h1, rfl, rfl⟩, fun _ h => h2 _ h.1, fun _ h => h3 _ h.1, ?_, ?_⟩
+      · simpa using h4.weakFV henv (.skip_fvar _ _ .refl) this
+      · simpa using h5.weakFV henv (.skip_fvar _ _ .refl) this
+
+theorem TrLCtx.find?_of_mem (henv : env.WF) (H : TrLCtx env Us lctx Δ)
+    (hm : decl ∈ lctx.toList) :
+    ∃ e A, Δ.find? (.inr decl.fvarId) = some (e, A) ∧
+      FVarsBelow Δ (.fvar decl.fvarId) decl.value' ∧ FVarsBelow Δ (.fvar decl.fvarId) decl.type ∧
+      TrExprS env Us Δ decl.value' e ∧ TrExprS env Us Δ decl.type A :=
+  H.2.find?_of_mem henv H.1.nodup hm
+
+theorem TrLCtx.mkLocalDecl
+    (h1 : TrLCtx env Us lctx Δ) (h2 : lctx.find? fv = none) (h3 : TrExprS env Us Δ ty ty')
+    (h4 : env.IsType Us.length Δ.toCtx ty') :
+    TrLCtx env Us (lctx.mkLocalDecl fv name ty bi kind)
+      ((some (fv, ty.fvarsList), .vlam ty') :: Δ) :=
+  ⟨h1.1.mkLocalDecl h2, by simpa using .cons h1.2 (.vlam h3 h4)⟩
+
+theorem TrLCtx.mkLetDecl
+    (h1 : TrLCtx env Us lctx Δ) (h2 : lctx.find? fv = none)
+    (h3 : TrExprS env Us Δ ty ty') (h4 : TrExprS env Us Δ val val')
+    (h5 : env.HasType Us.length Δ.toCtx val' ty') :
+    TrLCtx env Us (lctx.mkLetDecl fv name ty val bi kind)
+      ((some (fv, ty.fvarsList ++ val.fvarsList), .vlet ty' val') :: Δ) :=
+  ⟨h1.1.mkLetDecl h2, by simpa using .cons h1.2 (.vlet h3 h4 h5)⟩
diff --git a/Ix/Theory/Named/Verify/Name.lean b/Ix/Theory/Named/Verify/Name.lean
new file mode 100644
index 000000000..650926aa9
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Name.lean
@@ -0,0 +1,96 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Data.NameMap.Basic
+import Ix.Theory.Named.Std.Ord
+import Std.Data.TreeSet.Lemmas
+
+/-!
+Order properties of `Lean.Name.cmp` and `Lean.Name.quickCmp`.
+-/
+
+namespace Lean
+
+namespace Name
+open _root_.Std Ix.Theory.Named
+
+theorem cmp_eq_swap {a b : Name} : a.cmp b = (b.cmp a).swap := by
+  induction a generalizing b with obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> simp [cmp]
+  | str a₁ a₂ ih | num a₁ a₂ ih =>
+    rw [ih]; cases b₁.cmp a₁ <;> simp [← OrientedOrd.eq_swap]
+
+instance : TransCmp cmp := by
+  refine TransCmp.of_rot (fun _ _ => cmp_eq_swap) fun a b c => ?_
+  induction a generalizing b c with
+  | anonymous =>
+    obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> obtain _|⟨c₁,c₂⟩|⟨c₁,c₂⟩ := c <;> simp [cmp, Rot]
+  | str a₁ a₂ ih | num a₁ a₂ ih =>
+    obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> obtain _|⟨c₁,c₂⟩|⟨c₁,c₂⟩ := c <;>
+      first
+      | exact (ih ..).then (Rot.of_transCmp ..)
+      | simp [cmp, Rot]
+
+instance : LawfulBEqCmp cmp where
+  compare_eq_iff_beq {a b} := by
+    simp; refine ⟨?_, fun h => h ▸ ReflCmp.compare_self⟩
+    induction a generalizing b with obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> simp [cmp]
+    | str a₁ a₂ ih | num a₁ a₂ ih =>
+      refine ?_ ∘ Ordering.then_eq_eq.1
+      simp +contextual; exact fun h _ => ih h
+
+instance : TransCmp quickCmp where
+  eq_swap {a b} := by
+    simp [quickCmp]
+    rw [OrientedOrd.eq_swap]
+    cases compare b.hash a.hash <;> simp
+    induction a generalizing b with obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> simp [quickCmpAux]
+    | str a₁ a₂ ih | num a₁ a₂ ih =>
+      rw [OrientedOrd.eq_swap]
+      cases compare b₂ a₂ <;> simp [ih]
+  isLE_trans {a b c} := by
+    have {α} [Ord α] [TransOrd α] {a₁ b₁ c₁ : α} {a₂ b₂ c₂}
+        (H : (quickCmpAux a₂ b₂).isLE → (quickCmpAux b₂ c₂).isLE → (quickCmpAux a₂ c₂).isLE) :
+        ((compare a₁ b₁).then (quickCmpAux a₂ b₂)).isLE →
+        ((compare b₁ c₁).then (quickCmpAux b₂ c₂)).isLE →
+        ((compare a₁ c₁).then (quickCmpAux a₂ c₂)).isLE := by
+      simp [Ordering.isLE_then_iff_and]
+      intro h1 h2 h3 h4
+      refine ⟨TransCmp.isLE_trans h1 h3, ?_⟩
+      refine h2.elim (fun h2 => .inl <| TransCmp.lt_of_lt_of_isLE h2 h3) fun h2 => ?_
+      refine h4.elim (fun h4 => .inl <| TransCmp.lt_of_isLE_of_lt h1 h4) fun h4 => .inr (H h2 h4)
+    apply this
+    induction a generalizing b c with
+      obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> simp [quickCmpAux] at * <;>
+      obtain _|⟨c₁,c₂⟩|⟨c₁,c₂⟩ := c <;> simp [quickCmpAux] at *
+    | str a₁ a₂ ih | num a₁ a₂ ih => apply this ih
+
+instance : LawfulBEqCmp quickCmp where
+  compare_eq_iff_beq {a b} := by
+    simp; refine ⟨fun h => ?_, fun h => h ▸ ReflCmp.compare_self⟩
+    replace h := (Ordering.then_eq_eq.1 h).2; revert h
+    induction a generalizing b with obtain _|⟨b₁,b₂⟩|⟨b₁,b₂⟩ := b <;> simp [quickCmpAux]
+    | str a₁ a₂ ih | num a₁ a₂ ih =>
+      refine ?_ ∘ Ordering.then_eq_eq.1
+      simp +contextual; exact fun _ => ih
+
+end Name
+
+namespace NameSet
+open _root_.Std
+
+theorem contains_insert {s : NameSet} {a b : Name} :
+    (s.insert a).contains b = (a == b || s.contains b) := by
+  have key : (Name.quickCmp a b == Ordering.eq) = (a == b) := by
+    have := @LawfulBEqCmp.compare_eq_iff_beq _ _ Name.quickCmp _ a b
+    cases h : Name.quickCmp a b <;> simp_all
+  have h : (s.insert a).contains b
+      = (Name.quickCmp a b == Ordering.eq || s.contains b) :=
+    Std.TreeSet.contains_insert (t := s) (k := a) (a := b)
+  rw [h, key]
+
+@[simp] theorem contains_empty {a : Name} : (∅ : NameSet).contains a = false := rfl
+
+end NameSet
diff --git a/Ix/Theory/Named/Verify/NameGenerator.lean b/Ix/Theory/Named/Verify/NameGenerator.lean
new file mode 100644
index 000000000..5e96e8e48
--- /dev/null
+++ b/Ix/Theory/Named/Verify/NameGenerator.lean
@@ -0,0 +1,34 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Reference.Expr
+import Ix.Theory.Named.VExpr
+
+namespace Lean.NameGenerator
+
+def Reserves (ngen : NameGenerator) (fv : FVarId) : Prop :=
+  ∀ i, fv = ⟨.num ngen.namePrefix i⟩ → i < ngen.idx
+
+theorem next_reserves_self {ngen : NameGenerator} :
+    ngen.next.Reserves ⟨ngen.curr⟩ := by rintro _ ⟨⟩; exact Nat.lt_succ_self _
+
+theorem not_reserves_self {ngen : NameGenerator} :
+    ¬ngen.Reserves ⟨ngen.curr⟩ := fun h => Nat.lt_irrefl _ (h _ rfl)
+
+protected inductive LE : NameGenerator → NameGenerator → Prop where
+  | le : i ≤ j → NameGenerator.LE ⟨pfx, i⟩ ⟨pfx, j⟩
+
+instance : LE NameGenerator := ⟨NameGenerator.LE⟩
+
+theorem LE.rfl {ngen : NameGenerator} : ngen ≤ ngen := ⟨Nat.le_refl _⟩
+
+theorem LE.trans {ngen₁ ngen₂ ngen₃ : NameGenerator} : ngen₁ ≤ ngen₂ → ngen₂ ≤ ngen₃ → ngen₁ ≤ ngen₃
+  | ⟨h₁⟩, ⟨h₂⟩ => ⟨Nat.le_trans h₁ h₂⟩
+
+theorem Reserves.mono : ngen ≤ ngen' → Reserves ngen fv → Reserves ngen' fv
+  | ⟨h₁⟩ => fun H _ hi => Nat.lt_of_lt_of_le (H _ hi) h₁
+
+theorem LE.next {ngen : NameGenerator} : ngen ≤ ngen.next := ⟨Nat.le_succ _⟩
diff --git a/Ix/Theory/Named/Verify/NormLt.lean b/Ix/Theory/Named/Verify/NormLt.lean
new file mode 100644
index 000000000..dd097405a
--- /dev/null
+++ b/Ix/Theory/Named/Verify/NormLt.lean
@@ -0,0 +1,370 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Lean.Level
+import Ix.Theory.Named.Verify.Name
+import Ix.Theory.Named.Std.Ord
+import Ix.Theory.Named.Verify.Axioms
+
+/-!
+`Lean.Level.normLt` is the order used to sort the arguments of a `max` in
+`Lean.Level.normalize`. This file shows it is a strict weak order, which is what the
+`Array.qsort` specification requires.
+
+The proof identifies `normLt` with an `Ordering`-valued comparison `normCmp`, which compares
+levels by (base, offset) lexicographically, bases being compared structurally. `normCmp` is
+then given the `Std` order instances (`ReflCmp`, `TransCmp`, `LawfulEqCmp`), from which the
+strict weak order properties `normLt` needs follow. Transitivity uses `Ix.Theory.Named.Rot`, the
+lexicographic-product device shared with `Name.cmp` in `Ix.Theory.Named.Verify.Name`.
+-/
+
+open Std Ix.Theory.Named
+
+namespace Lean.Level
+
+instance : LawfulBEq LMVarId where
+  eq_of_beq := @fun ⟨a⟩ ⟨b⟩ h => by cases LawfulBEq.eq_of_beq (α := Name) h; rfl
+  rfl := BEq.rfl (α := Name)
+
+/-- The structural size of a level. -/
+private def size : Level → Nat
+  | .zero | .param _ | .mvar _ => 1
+  | .succ l => size l + 1
+  | .max a b | .imax a b => size a + size b + 1
+
+private theorem size_max {a b : Level} : size (.max a b) = size a + size b + 1 := rfl
+private theorem size_imax {a b : Level} : size (.imax a b) = size a + size b + 1 := rfl
+
+private theorem one_le_size : ∀ l : Level, 1 ≤ size l
+  | .zero | .param _ | .mvar _ => Nat.le_refl _
+  | .succ l => Nat.le_succ_of_le (one_le_size l)
+  | .max a b | .imax a b => by have := one_le_size a; simp only [size]; omega
+
+private theorem size_getLevelOffset_le : ∀ l : Level, size l.getLevelOffset ≤ size l
+  | .succ l => Nat.le_trans (size_getLevelOffset_le l) (Nat.le_succ _)
+  | .zero | .param _ | .mvar _ | .max .. | .imax .. => Nat.le_refl _
+
+/-- Structural comparison of level *bases* (levels that are not `succ`s).
+Sub-levels are compared by `normCmp`, i.e. base first, then offset. -/
+def baseCmp : Level → Level → Ordering
+  | .max a b, .max c d =>
+    ((baseCmp a.getLevelOffset c.getLevelOffset).then (compare a.getOffset c.getOffset)).then
+      ((baseCmp b.getLevelOffset d.getLevelOffset).then (compare b.getOffset d.getOffset))
+  | .imax a b, .imax c d =>
+    ((baseCmp a.getLevelOffset c.getLevelOffset).then (compare a.getOffset c.getOffset)).then
+      ((baseCmp b.getLevelOffset d.getLevelOffset).then (compare b.getOffset d.getOffset))
+  | .param n₁, .param n₂ => Name.cmp n₁ n₂
+  | .mvar n₁, .mvar n₂ => Name.cmp n₁.name n₂.name
+  | l₁, l₂ => compare l₁.ctorToNat l₂.ctorToNat
+termination_by l₁ l₂ => size l₁ + size l₂
+decreasing_by
+  all_goals
+    first
+    | (exact Nat.lt_of_le_of_lt
+        (Nat.add_le_add (size_getLevelOffset_le _) (size_getLevelOffset_le _))
+        (by simp only [size]; omega))
+
+/-- Comparison of levels: base first, then offset. -/
+def normCmp (l₁ l₂ : Level) : Ordering :=
+  (baseCmp l₁.getLevelOffset l₂.getLevelOffset).then (compare l₁.getOffset l₂.getOffset)
+
+/-- The same-constructor part of `baseCmp`. It is `.eq` when the constructors differ, in which
+case the `ctorToNat` comparison of `baseCmp_eq` already decides the comparison. -/
+private def structCmp : Level → Level → Ordering
+  | .max a b, .max c d => (normCmp a c).then (normCmp b d)
+  | .imax a b, .imax c d => (normCmp a c).then (normCmp b d)
+  | .param n₁, .param n₂ => Name.cmp n₁ n₂
+  | .mvar n₁, .mvar n₂ => Name.cmp n₁.name n₂.name
+  | _, _ => .eq
+
+/-- `baseCmp` is the lexicographic product of the constructor tags with `structCmp`. -/
+private theorem baseCmp_eq : ∀ l₁ l₂ : Level,
+    baseCmp l₁ l₂ = (compare l₁.ctorToNat l₂.ctorToNat).then (structCmp l₁ l₂) := by
+  intro l₁ l₂
+  cases l₁ <;> cases l₂ <;> simp [baseCmp, structCmp, normCmp, ctorToNat]
+
+private theorem baseCmp_swap : ∀ l₁ l₂ : Level, baseCmp l₂ l₁ = (baseCmp l₁ l₂).swap := by
+  intro l₁ l₂
+  induction l₁, l₂ using baseCmp.induct with
+  | case1 a b c d ih₁ ih₂ | case2 a b c d ih₁ ih₂ =>
+    rw [baseCmp, baseCmp]
+    simp only [Ordering.swap_then]
+    rw [← ih₁, ← ih₂,
+      ← OrientedCmp.eq_swap (cmp := compare (α := Nat)) (a := c.getOffset) (b := a.getOffset),
+      ← OrientedCmp.eq_swap (cmp := compare (α := Nat)) (a := d.getOffset) (b := b.getOffset)]
+  | case3 n₁ n₂ | case4 n₁ n₂ =>
+    rw [baseCmp, baseCmp]; exact OrientedCmp.eq_swap
+  | case5 l₁ l₂ h₁ h₂ h₃ h₄ =>
+    rw [baseCmp, baseCmp]
+    · exact OrientedCmp.eq_swap
+    all_goals grind
+
+theorem normCmp_swap (l₁ l₂ : Level) : normCmp l₂ l₁ = (normCmp l₁ l₂).swap := by
+  rw [normCmp, normCmp, Ordering.swap_then, ← baseCmp_swap,
+    ← OrientedCmp.eq_swap (cmp := compare (α := Nat))]
+
+private theorem normCmp_rot_of {a b c : Level}
+    (h : Rot (baseCmp a.getLevelOffset b.getLevelOffset)
+      (baseCmp b.getLevelOffset c.getLevelOffset) (baseCmp a.getLevelOffset c.getLevelOffset)) :
+    Rot (normCmp a b) (normCmp b c) (normCmp a c) :=
+  h.then (Rot.of_transCmp a.getOffset b.getOffset c.getOffset)
+
+private theorem baseCmp_rot : ∀ l₁ l₂ l₃ : Level,
+    Rot (baseCmp l₁ l₂) (baseCmp l₂ l₃) (baseCmp l₁ l₃) := by
+  suffices key : ∀ n l₁ l₂ l₃, size l₁ + size l₂ + size l₃ ≤ n →
+      Rot (baseCmp l₁ l₂) (baseCmp l₂ l₃) (baseCmp l₁ l₃) from
+    fun l₁ l₂ l₃ => key _ l₁ l₂ l₃ (Nat.le_refl _)
+  intro n
+  induction n with
+  | zero =>
+    intro l₁ l₂ l₃ h
+    have := one_le_size l₁; have := one_le_size l₂; have := one_le_size l₃
+    omega
+  | succ n ih =>
+    intro l₁ l₂ l₃ hn
+    rw [baseCmp_eq, baseCmp_eq, baseCmp_eq]
+    refine (Rot.of_transCmp ..).then' fun e₁ e₂ e₃ => ?_
+    -- the sub-level comparisons are on strictly smaller levels
+    have small : ∀ x y z : Level, size x + size y + size z < size l₁ + size l₂ + size l₃ →
+        Rot (normCmp x y) (normCmp y z) (normCmp x z) := by
+      intro x y z hxyz
+      refine normCmp_rot_of (ih _ _ _ ?_)
+      have := size_getLevelOffset_le x
+      have := size_getLevelOffset_le y
+      have := size_getLevelOffset_le z
+      omega
+    -- all three constructor tags agree, so all three levels share a constructor
+    have hc₁ : l₁.ctorToNat = l₂.ctorToNat := Nat.compare_eq_eq.1 e₁
+    have hc₂ : l₂.ctorToNat = l₃.ctorToNat := Nat.compare_eq_eq.1 e₂
+    clear e₁ e₂ e₃ hn
+    cases l₁ <;> cases l₂ <;> cases hc₁ <;> cases l₃ <;> cases hc₂ <;> simp only [structCmp]
+    · exact ⟨fun _ _ => rfl, fun _ _ => rfl, fun _ _ => rfl⟩
+    · exact ⟨fun _ _ => rfl, fun _ _ => rfl, fun _ _ => rfl⟩
+    · refine Rot.then (small _ _ _ ?_) (small _ _ _ ?_) <;> (simp only [size_max]; omega)
+    · refine Rot.then (small _ _ _ ?_) (small _ _ _ ?_) <;> (simp only [size_imax]; omega)
+    · exact Rot.of_transCmp ..
+    · exact Rot.of_transCmp ..
+
+theorem normCmp_rot (a b c : Level) : Rot (normCmp a b) (normCmp b c) (normCmp a c) :=
+  normCmp_rot_of (baseCmp_rot ..)
+
+instance : TransCmp baseCmp := TransCmp.of_rot (fun a b => baseCmp_swap b a) baseCmp_rot
+instance : TransCmp normCmp := TransCmp.of_rot (fun a b => normCmp_swap b a) normCmp_rot
+
+private theorem getOffsetAux_eq : ∀ (l : Level) (k), l.getOffsetAux k = l.getOffset + k := by
+  intro l
+  induction l with
+  | succ l ih =>
+    intro k
+    show l.getOffsetAux (k+1) = l.getOffsetAux 1 + k
+    rw [ih (k+1), ih 1]; omega
+  | _ => intro k; simp [getOffsetAux, getOffset]
+
+private theorem getOffset_succ {l : Level} : (Level.succ l).getOffset = l.getOffset + 1 := by
+  show l.getOffsetAux 1 = _
+  rw [getOffsetAux_eq]
+
+private theorem getLevelOffset_succ {l : Level} :
+    (Level.succ l).getLevelOffset = l.getLevelOffset := rfl
+
+/-! ### Reflexivity and antisymmetry -/
+
+private theorem baseCmp_refl : ∀ l : Level, baseCmp l l = .eq := by
+  suffices key : ∀ n l, size l ≤ n → baseCmp l l = .eq from fun l => key _ l (Nat.le_refl _)
+  intro n
+  induction n with
+  | zero => intro l h; have := one_le_size l; omega
+  | succ n ih =>
+    intro l hn
+    have hnorm x (hx : size x ≤ n) : normCmp x x = .eq := by
+      rw [normCmp, ih _ (Nat.le_trans (size_getLevelOffset_le x) hx), Nat.compare_eq_eq.2 rfl]; rfl
+    rw [baseCmp_eq, Nat.compare_eq_eq.2 rfl]
+    show structCmp l l = .eq
+    cases l with simp only [structCmp]
+    | max a b | imax a b =>
+      rw [hnorm a, hnorm b]; rfl
+      all_goals simp only [size] at hn ⊢; omega
+    | _ => exact LawfulBEqCmp.compare_eq_iff_beq.2 (beq_self_eq_true _)
+
+theorem normCmp_refl (l : Level) : normCmp l l = .eq := by
+  rw [normCmp, baseCmp_refl, Nat.compare_eq_eq.2 rfl]; rfl
+
+instance : ReflCmp baseCmp where compare_self := baseCmp_refl _
+instance : ReflCmp normCmp where compare_self := normCmp_refl _
+
+/-- A level is determined by its base and its offset. -/
+private theorem level_ext : ∀ {l₁ l₂ : Level}, l₁.getLevelOffset = l₂.getLevelOffset →
+    l₁.getOffset = l₂.getOffset → l₁ = l₂ := by
+  intro l₁
+  induction l₁ with
+  | succ a ih =>
+    intro l₂
+    cases l₂ with
+    | succ b =>
+      intro h₁ h₂
+      rw [getLevelOffset_succ, getLevelOffset_succ] at h₁
+      rw [getOffset_succ, getOffset_succ] at h₂
+      exact congrArg Level.succ (ih h₁ (by omega))
+    | _ => intro h₁ h₂; rw [getOffset_succ] at h₂; simp [getOffset, getOffsetAux] at h₂
+  | _ =>
+    intro l₂
+    cases l₂ with
+    | succ b => intro h₁ h₂; rw [getOffset_succ] at h₂; simp [getOffset, getOffsetAux] at h₂
+    | _ => intro h₁ h₂; exact h₁
+
+private theorem getLevelOffset_ne_succ : ∀ (l a : Level), l.getLevelOffset ≠ .succ a := by
+  intro l
+  induction l with
+  | succ b ih => exact ih
+  | _ => intro a h; cases h
+
+theorem eq_of_normCmp_eq : ∀ {l₁ l₂ : Level}, normCmp l₁ l₂ = .eq → l₁ = l₂ := by
+  suffices key : ∀ n (l₁ l₂ : Level), size l₁ + size l₂ ≤ n → normCmp l₁ l₂ = .eq → l₁ = l₂ from
+    fun {l₁ l₂} h => key _ l₁ l₂ (Nat.le_refl _) h
+  intro n
+  induction n with
+  | zero => intro l₁ l₂ h; have := one_le_size l₁; have := one_le_size l₂; omega
+  | succ n ih =>
+    intro l₁ l₂ hn h
+    rw [normCmp, baseCmp_eq] at h
+    obtain ⟨h₁, hoff⟩ := Ordering.then_eq_eq.1 h
+    obtain ⟨hc, hs⟩ := Ordering.then_eq_eq.1 h₁
+    refine level_ext ?_ (Nat.compare_eq_eq.1 hoff)
+    have hb₁ := size_getLevelOffset_le l₁
+    have hb₂ := size_getLevelOffset_le l₂
+    have hns₁ := getLevelOffset_ne_succ l₁
+    have hns₂ := getLevelOffset_ne_succ l₂
+    clear h h₁ hoff
+    generalize l₁.getLevelOffset = b₁ at *
+    generalize l₂.getLevelOffset = b₂ at *
+    replace hc := Nat.compare_eq_eq.1 hc
+    cases b₁ <;> cases b₂ <;> try simp only [ctorToNat, Nat.reduceEqDiff] at hc
+    · rfl
+    · exact absurd rfl (hns₁ _)
+    · obtain ⟨e₁, e₂⟩ := Ordering.then_eq_eq.1 hs
+      rw [ih _ _ _ e₁, ih _ _ _ e₂] <;> (simp only [size_max] at hb₁ hb₂ ⊢; omega)
+    · obtain ⟨e₁, e₂⟩ := Ordering.then_eq_eq.1 hs
+      rw [ih _ _ _ e₁, ih _ _ _ e₂] <;> (simp only [size_imax] at hb₁ hb₂ ⊢; omega)
+    · simp only [structCmp] at hs
+      rw [eq_of_beq (LawfulBEqCmp.compare_eq_iff_beq.1 hs)]
+    · rename_i x y
+      have : x.name = y.name := eq_of_beq (LawfulBEqCmp.compare_eq_iff_beq.1 hs)
+      cases x; cases y; simp_all
+
+instance : LawfulEqCmp normCmp where eq_of_compare := eq_of_normCmp_eq
+
+/-! ### `normLt` in terms of `normCmp` -/
+
+private theorem compare_beq_lt (a b : Nat) : (compare a b == Ordering.lt) = decide (a < b) := by
+  apply Bool.eq_iff_iff.2; simp [Nat.compare_eq_lt]
+
+private theorem base_max {a b : Level} : (Level.max a b).getLevelOffset = .max a b := rfl
+private theorem base_imax {a b : Level} : (Level.imax a b).getLevelOffset = .imax a b := rfl
+private theorem off_max {a b : Level} : (Level.max a b).getOffset = 0 := rfl
+private theorem off_imax {a b : Level} : (Level.imax a b).getOffset = 0 := rfl
+
+/-- `normLtAux` accumulates the `succ`s into the offsets and then runs `normCmp`. -/
+private theorem normLtAux_eq : ∀ (l₁ : Level) (k₁ : Nat) (l₂ : Level) (k₂ : Nat),
+    normLtAux l₁ k₁ l₂ k₂ =
+      ((baseCmp l₁.getLevelOffset l₂.getLevelOffset).then
+        (compare (l₁.getOffset + k₁) (l₂.getOffset + k₂)) == .lt) := by
+  intro l₁ k₁ l₂ k₂
+  induction l₁, k₁, l₂, k₂ using normLtAux.induct with
+  | case1 l₁ k₁ l₂ k₂ ih =>
+    rw [normLtAux, ih]
+    simp only [getLevelOffset_succ, getOffset_succ]
+    rw [show l₁.getOffset + 1 + k₁ = l₁.getOffset + (k₁ + 1) by omega]
+  | case2 l₁ k₁ l₂ k₂ hns ih =>
+    rw [normLtAux, ih]
+    simp only [getLevelOffset_succ, getOffset_succ]
+    rw [show l₂.getOffset + 1 + k₂ = l₂.getOffset + (k₂ + 1) by omega]
+    exact hns
+  | case3 a b k₁ c d k₂ hbeq | case6 a b k₁ c d k₂ hbeq =>
+    -- the two levels are syntactically equal: the offsets decide
+    rw [normLtAux, if_pos hbeq, Bool.eq_iff_iff]
+    cases eq_of_beq hbeq
+    show _ ↔ ((baseCmp _ _).then (compare (0 + k₁) (0 + k₂)) == _)
+    rw [baseCmp_refl]
+    simp only [decide_eq_true_eq, Ordering.then, Nat.zero_add, beq_iff_eq, Nat.compare_eq_lt]
+  | case4 a b k₁ c d k₂ hbeq hne ih | case7 a b k₁ c d k₂ hbeq hne ih =>
+    -- the heads differ, so the head comparison decides
+    rw [normLtAux, if_neg (by simpa using hbeq), if_pos hne, ih]
+    have hne' : a ≠ c := by simpa using hne
+    have hac : normCmp a c ≠ .eq := fun h => hne' (eq_of_normCmp_eq h)
+    simp only [base_max, base_imax, off_max, off_imax, Nat.add_zero, Nat.zero_add]
+    rw [baseCmp]
+    show ((normCmp a c) == _) = (((normCmp a c).then (normCmp b d)).then (compare k₁ k₂) == _)
+    cases h : normCmp a c <;> simp_all [Ordering.then]
+  | case5 a b k₁ c d k₂ hbeq hne ih | case8 a b k₁ c d k₂ hbeq hne ih =>
+    -- the heads agree, so the tail comparison decides
+    rw [normLtAux, if_neg (by simpa using hbeq), if_neg hne, ih]
+    have hac : a = c := by simpa using hne
+    subst hac
+    have hne' : b ≠ d := by rintro rfl; exact absurd (by simp) hbeq
+    have hbd : normCmp b d ≠ .eq := fun h => hne' (eq_of_normCmp_eq h)
+    simp only [base_max, base_imax, off_max, off_imax, Nat.add_zero, Nat.zero_add]
+    rw [baseCmp]
+    show ((normCmp b d) == _) = (((normCmp a a).then (normCmp b d)).then (compare k₁ k₂) == _)
+    rw [normCmp_refl]
+    cases h : normCmp b d <;> simp_all [Ordering.then]
+  | case9 n₁ k₁ n₂ k₂ hbeq =>
+    rw [normLtAux, if_pos hbeq, Bool.eq_iff_iff]
+    cases eq_of_beq hbeq
+    show _ ↔ ((baseCmp (Level.param n₁) (Level.param n₁)).then (compare (0 + k₁) (0 + k₂)) == _)
+    rw [baseCmp_refl]
+    simp only [decide_eq_true_eq, Ordering.then, Nat.zero_add, beq_iff_eq, Nat.compare_eq_lt]
+  | case11 n₁ k₁ n₂ k₂ hbeq =>
+    rw [normLtAux, if_pos hbeq, Bool.eq_iff_iff]
+    cases eq_of_beq hbeq
+    show _ ↔ ((baseCmp (Level.mvar n₁) (Level.mvar n₁)).then (compare (0 + k₁) (0 + k₂)) == _)
+    rw [baseCmp_refl]
+    simp only [decide_eq_true_eq, Ordering.then, Nat.zero_add, beq_iff_eq, Nat.compare_eq_lt]
+  | case10 n₁ k₁ n₂ k₂ hbeq =>
+    rw [normLtAux, if_neg hbeq]
+    show _ = ((baseCmp (Level.param n₁) (Level.param n₂)).then
+      (compare (0 + k₁) (0 + k₂)) == _)
+    rw [baseCmp]
+    have : Name.cmp n₁ n₂ ≠ .eq := fun h =>
+      hbeq (LawfulBEqCmp.compare_eq_iff_beq.1 h)
+    cases h : Name.cmp n₁ n₂ <;> simp_all [Name.lt, Ordering.then]
+  | case12 n₁ k₁ n₂ k₂ hbeq =>
+    rw [normLtAux, if_neg hbeq]
+    show _ = ((baseCmp (Level.mvar n₁) (Level.mvar n₂)).then
+      (compare (0 + k₁) (0 + k₂)) == _)
+    rw [baseCmp]
+    have : Name.cmp n₁.name n₂.name ≠ .eq := fun h => hbeq (by
+      have := eq_of_beq (LawfulBEqCmp.compare_eq_iff_beq.1 h)
+      cases n₁; cases n₂; simp_all)
+    cases h : Name.cmp n₁.name n₂.name <;> simp_all [Name.lt, Ordering.then]
+  | case13 l₁ k₁ l₂ k₂ hs₁ hs₂ hmax himax hpar hmvar hbeq
+  | case14 l₁ k₁ l₂ k₂ hs₁ hs₂ hmax himax hpar hmvar hbeq =>
+    -- neither level is a `succ` and their constructors differ, so the tags decide
+    rw [normLtAux, baseCmp_eq]
+    · cases l₁ <;> cases l₂ <;>
+        simp_all [structCmp, ctorToNat, Ordering.then, compare_beq_lt, getLevelOffset, getOffset,
+          getOffsetAux] <;> grind
+    all_goals assumption
+
+theorem normLt_eq (l₁ l₂ : Level) : normLt l₁ l₂ = (normCmp l₁ l₂ == .lt) := by
+  rw [normLt, normLtAux_eq, normCmp, Nat.add_zero, Nat.add_zero]
+
+/-! ### `normLt` is a strict weak order -/
+
+theorem normLt_asymm {a b : Level} (h : normLt a b) : ¬normLt b a := by
+  simp only [normLt_eq, beq_iff_eq] at h ⊢
+  exact OrientedCmp.not_lt_of_lt h
+
+theorem normLt_le_trans {a b c : Level} (h₁ : ¬normLt b a) (h₂ : ¬normLt c b) : ¬normLt c a := by
+  simp only [normLt_eq, beq_iff_eq, ← Ordering.isGE_iff_ne_lt] at h₁ h₂ ⊢
+  exact TransCmp.isGE_trans h₂ h₁
+
+/-- On levels with equal bases, `normLt` compares the offsets. -/
+theorem normLt_same_base {l₁ l₂ : Level} (h : l₁.getLevelOffset = l₂.getLevelOffset) :
+    normLt l₁ l₂ = decide (l₁.getOffset < l₂.getOffset) := by
+  rw [normLt_eq, normCmp, h, baseCmp_refl]
+  simp only [Ordering.then, compare_beq_lt]
+
+end Lean.Level
diff --git a/Ix/Theory/Named/Verify/QSort.lean b/Ix/Theory/Named/Verify/QSort.lean
new file mode 100644
index 000000000..18dfdbb3f
--- /dev/null
+++ b/Ix/Theory/Named/Verify/QSort.lean
@@ -0,0 +1,398 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+/-
+Copyright (c) 2025 Lean FRO, LLC. All rights reserved.
+Released under Apache 2.0 license as described in the file LICENSE.
+Authors: Kim Morrison
+-/
+module
+public import Init.Data.Array.Basic
+import all Init.Data.Array.QSort.Basic
+
+/-!
+# Verification of `Array.qsort`
+
+Adapted from the verification in leanprover/lean4#14658
+(tests/elab/grind_qsort.lean on the `qsort_verification` branch).
+
+This file contains a verification of the `Array.qsort` function,
+using the `grind` tactic.
+
+The theorems are:
+* `size_qsort : (qsort as lt lo hi).size = as.size`
+* `qsort_perm : qsort as lt lo hi ~ as`
+
+And when `lt` is antisymmetric and `¬ lt a b` is transitive, we have:
+* `qsort_sorted' : lo ≤ i < j ≤ hi → ¬ lt (as.qsort lt lo hi)[j] (as.qsort lt lo hi)[i]`
+* `qsort_sorted : i < j → ¬ lt (as.qsort lt)[j] (as.qsort lt)[i]`
+
+(There is not currently a public theorem that `(qsort as lt lo hi)[i] = as[i]` when `i < lo` or `hi < i`.)
+
+-/
+namespace Array
+
+open List Vector
+
+-- These attributes still need to be moved to the standard library.
+
+-- set_option trace.grind.ematch.pattern true in
+-- attribute [grind] Vector.getElem?_eq_getElem -- This one requires some consideration! -- Probably not need, see Vector.Perm.extract' below.
+
+-- Hmm, we don't seem to have the Array analogues of these!
+attribute [grind =] Vector.toArray_perm_iff
+attribute [grind =] Vector.perm_toArray_iff
+
+attribute [grind .] Vector.swap_perm
+
+attribute [grind .] List.Perm.refl
+attribute [grind .] Array.Perm.refl
+attribute [grind .] Vector.Perm.refl
+
+-- attribute [grind] Array.Perm.extract
+-- attribute [grind] Vector.Perm.extract
+
+-- These are just the patterns resulting from `grind`, but the behaviour should be explained!
+grind_pattern List.Perm.trans => l₁ ~ l₂, l₁ ~ l₃
+grind_pattern Array.Perm.trans => xs ~ ys, xs ~ zs
+grind_pattern Vector.Perm.trans => xs ~ ys, xs ~ zs
+
+/-- Variant of `List.Perm.take` specifying the permutation is constant after `i` elementwise. -/
+theorem _root_.List.Perm.take_of_getElem {l₁ l₂ : List α} (h : l₁ ~ l₂) {i : Nat}
+    (w : ∀ j, i ≤ j → (_ : j < l₁.length) → l₁[j] = l₂[j]'(by have := h.length_eq; omega)) :
+    l₁.take i ~ l₂.take i := by
+  apply h.take_of_getElem?
+  intro j hij
+  by_cases h_length₁ : j < l₁.length
+  <;> have h_length₂ := h.length_eq ▸ h_length₁
+  <;> grind
+
+/-- Variant of `List.Perm.drop` specifying the permutation is constant before `i` elementwise. -/
+theorem _root_.List.Perm.drop_of_getElem {l₁ l₂ : List α} (h : l₁ ~ l₂) {i : Nat}
+    (w : ∀ j, j < i → (_ : j < l₁.length) → l₁[j] = l₂[j]'(by have := h.length_eq; omega)) :
+    l₁.drop i ~ l₂.drop i := by
+  apply h.drop_of_getElem?
+  intro j hij
+  by_cases h_length₁ : j < l₁.length
+  <;> have h_length₂ := h.length_eq ▸ h_length₁
+  <;> grind
+
+private theorem getElem_mk {l : List α} {i : Nat} (h : i < l.length) :
+    (Array.mk l)[i]'(by simpa using h) = l[i] := by
+  rw [← Array.getElem_toList]
+
+theorem _root_.Array.Perm.extract' {xs ys : Array α} (h : xs ~ ys) {lo hi : Nat}
+    (wlo : ∀ i, i < lo → (_ : i < xs.size) → xs[i] = ys[i]'(by have := h.size_eq; omega))
+    (whi : ∀ i, hi ≤ i → (_ : i < xs.size) → xs[i] = ys[i]'(by have := h.size_eq; omega)) :
+    xs.extract lo hi ~ ys.extract lo hi := by
+  rcases xs with ⟨xs⟩
+  rcases ys with ⟨ys⟩
+  simp_all only [perm_iff_toList_perm, List.extract_toArray]
+  apply List.Perm.take_of_getElem
+    (w := fun i h₁ h₂ => by
+      rw [List.getElem_drop, List.getElem_drop, ← getElem_mk, ← getElem_mk]
+      exact whi (lo + i) (by omega) (by grind))
+  apply List.Perm.drop_of_getElem
+    (w := fun i h₁ h₂ => by
+      rw [← getElem_mk, ← getElem_mk]
+      exact wlo i h₁ (by grind))
+  simpa using List.perm_iff_toArray_perm.mpr h
+
+theorem _root_.Vector.Perm.extract' {xs ys : Vector α n} (h : xs ~ ys) {lo hi : Nat}
+    (wlo : ∀ i, i < lo → (_ : i < n) → xs[i] = ys[i]) (whi : ∀ i, hi ≤ i → (_ : i < n) → xs[i] = ys[i]) :
+    xs.extract lo hi ~ ys.extract lo hi := by
+  rcases xs with ⟨xs, rfl⟩
+  rcases ys with ⟨ys, h⟩
+  exact ⟨Array.Perm.extract' h.toArray (by simpa using wlo) (by simpa using whi)⟩
+
+attribute [grind .] Array.Perm.extract'
+attribute [grind .] Vector.Perm.extract'
+
+variable (lt : α → α → Bool) (lo hi : Nat)
+
+@[simp, grind =] public theorem size_qsort (as : Array α) :
+    (qsort as lt lo hi).size = as.size := by
+  grind [qsort]
+
+private theorem qpartition_loop_perm (as : Vector α n)
+    (hhi : hi < n) (ilo : lo ≤ i) (ik : i ≤ k) (w : k ≤ hi) :
+    (qpartition.loop lt lo hi hhi pivot as i k).2 ~ as := by
+  fun_induction qpartition.loop with grind
+
+@[local grind .]
+private theorem qpartition_perm
+    (as : Vector α n) (w : lo ≤ hi) (hlo : lo < n) (hhi : hi < n) :
+    (qpartition as lt lo hi).2 ~ as := by
+  unfold qpartition
+  refine Vector.Perm.trans (qpartition_loop_perm ..) ?_
+  repeat' first
+  | split
+  | grind
+  | refine Vector.Perm.trans (Vector.swap_perm ..) ?_
+
+private theorem qsort_sort_perm
+    (as : Vector α n) (w : lo ≤ hi) (hlo : lo < n) (hhi : hi < n) :
+    qsort.sort lt as lo hi w hlo hhi ~ as := by
+  fun_induction qsort.sort with grind
+
+grind_pattern qsort_sort_perm => qsort.sort lt as lo hi w hlo hhi
+
+public theorem qsort_perm (as : Array α) : qsort as lt lo hi ~ as := by
+  grind [qsort]
+
+private theorem getElem_qpartition_loop_snd_of_lt_lo
+    (hhi : hi < n) (as : Vector α n) (i k : Nat) (ilo : lo ≤ i) (ik : i ≤ k) (w : k ≤ hi) (w' : lo ≤ hi)
+    (l : Nat) (h : l < lo) : (qpartition.loop lt lo hi hhi pivot as i k).2[l] = as[l] := by
+  fun_induction qpartition.loop <;> grind
+
+private theorem getElem_qpartition_snd_of_lt_lo (as : Vector α n)
+    (hhi : hi < n) (w : lo ≤ hi)
+    (k : Nat) (h : k < lo) : (qpartition as lt lo hi).2[k] = as[k] := by
+  grind [qpartition, getElem_qpartition_loop_snd_of_lt_lo]
+
+@[local grind =] private theorem getElem_qsort_sort_of_lt_lo
+    (as : Vector α n)
+    (hlo : lo < n) (hhi : hi < n) (w : lo ≤ hi)
+    (i : Nat) (h : i < lo) : (qsort.sort lt as lo hi)[i] = as[i] := by
+  fun_induction qsort.sort with grind [getElem_qpartition_snd_of_lt_lo]
+
+private theorem getElem_qpartition_loop_snd_of_hi_lt
+    (hhi : hi < n) (as : Vector α n) (i k)
+    (ilo : lo ≤ i) (ik : i ≤ k) (w : k ≤ hi) (z : i ≤ hi)
+    (l : Nat) (h : hi < l) (h' : l < n) : (qpartition.loop lt lo hi hhi pivot as i k).2[l] = as[l] := by
+  fun_induction qpartition.loop <;> grind
+
+private theorem getElem_qpartition_snd_of_hi_lt (as : Vector α n)
+    (hhi : hi < n) (w : lo ≤ hi)
+    (k : Nat) (h : hi < k) (h' : k < n) : (qpartition as lt lo hi).2[k] = as[k] := by
+  grind [qpartition, getElem_qpartition_loop_snd_of_hi_lt]
+
+@[local grind =] private theorem getElem_qsort_sort_of_hi_lt
+    (as : Vector α n) (w : lo ≤ hi)
+    (hlo : lo < n) (hhi : hi < n) (w : lo ≤ hi)
+    (i : Nat) (h : hi < i) (h' : i < n) : (qsort.sort lt as lo hi)[i] = as[i] := by
+  fun_induction qsort.sort with grind [getElem_qpartition_snd_of_hi_lt]
+
+private theorem extract_qsort_sort_perm (as : Vector α n) (lt : α → α → Bool)
+    (hlo := by grind) (hhi := by grind) (w : lo ≤ hi := by grind) :
+    ((qsort.sort lt as lo hi).extract lo (hi + 1)) ~ (as.extract lo (hi + 1)) := by
+  grind
+
+private theorem getElem_qsort_sort_mem
+    (as : Vector α n) (hhi : hi < n) (i : Nat) (h : i < n) (_ : lo ≤ i) (_ : i ≤ hi) :
+    (qsort.sort lt as lo hi)[i] ∈ as.extract lo (hi + 1) := by
+  rw [← (extract_qsort_sort_perm lo hi as lt).mem_iff, Vector.mem_extract_iff_getElem]
+  exact ⟨i - lo, by grind⟩
+
+private theorem qpartition_loop_spec₁
+    (hhi : hi < n) (ilo : lo ≤ i) (ik : i ≤ k) (w : k < n) (khi : k ≤ hi)
+    (as : Vector α n) (hpivot : pivot = as[hi])
+    (q : ∀ l, (hk₁ : lo ≤ l) → (hk₂ : l < i) → lt as[l] as[hi]) (mid as')
+    (w_mid : mid = (qpartition.loop lt lo hi hhi pivot as i k).fst.1) (hmid : mid < n)
+    (w_as : as' = (qpartition.loop lt lo hi hhi pivot as i k).2) :
+    ∀ l, (h₁ : lo ≤ l) → (h₂ : l < mid) → lt as'[l] as'[mid] := by
+  fun_induction qpartition.loop with unfold qpartition.loop at w_mid w_as
+  | case1
+  | case2 => apply_assumption <;> grind
+  | case3 => grind
+
+private theorem qpartition_loop_spec₂
+    (hhi : hi < n) (ilo : lo ≤ i) (ik : i ≤ k) (w : k < n) (khi : k ≤ hi)
+    (as : Vector α n) (hpivot : pivot = as[hi])
+    (q : ∀ l, (hk₁ : i ≤ l) → (hk₂ : l < k) → !lt as[l] as[hi]) (mid as')
+    (w_mid : mid = (qpartition.loop lt lo hi hhi pivot as i k).fst.1) (hmid : mid < n)
+    (w_as : as' = (qpartition.loop lt lo hi hhi pivot as i k).2) :
+    ∀ l, (h₁ : mid < l) → (h₂ : l ≤ hi) → lt as'[l] as'[mid] = false := by
+  fun_induction qpartition.loop with grind
+
+/--
+All elements in the active range before the pivot, are less than the pivot.
+-/
+private theorem qpartition_spec₁
+    (hhi : hi < n) (w : lo ≤ hi)
+    (as : Vector α n) (mid as')
+    (w_mid : mid = (qpartition as lt lo hi).fst.1) (hmid : mid < n)
+    (w_as : as' = (qpartition as lt lo hi).2) :
+    ∀ i, (h₁ : lo ≤ i) → (h₂ : i < mid) → lt as'[i] as'[mid] := by
+  grind [qpartition, qpartition_loop_spec₁]
+
+/--
+All elements in the active range after the pivot, are greater than or equal to the pivot.
+-/
+private theorem qpartition_spec₂
+    (hhi : hi < n) (w : lo ≤ hi)
+    (as : Vector α n) (mid as')
+    (w_mid : mid = (qpartition as lt lo hi).fst.1) (hmid : mid < n)
+    (w_as : as' = (qpartition as lt lo hi).2) :
+    ∀ i, (h₁ : mid < i) → (h₂ : i ≤ hi) → lt as'[i] as'[mid] = false := by
+  grind [qpartition, qpartition_loop_spec₂]
+
+/-!
+We now need to deal with a corner case:
+we need to show that `qpartition` only returns a value `≥ hi` when `hi ≤ lo`
+(and hence the slice of the array between `lo` and `hi` (inclusive) is trivially already sorted).
+
+We prove two preliminary lemmas about `qpartition.loop`.
+-/
+
+/-- If we already have `i < k`, then we're sure to return something less than `hi`. -/
+private theorem qpartition_loop_lt_hi₁
+    (ilo : lo ≤ i) (ik : i < k) (w : k ≤ hi) (z : k ≤ hi) (ik' : i ≤ k) :
+    (qpartition.loop lt lo hi hhi pivot as i k).1.val < hi := by
+  fun_induction qpartition.loop with grind
+
+/--
+Otherwise, if there is some position `k' ≥ k` which is greater than or equal to the pivot,
+then when we reach that we'll be sure `i < k`, and hence the previous lemma will apply,
+and so we're sure to return something less than `hi`.
+ -/
+private theorem qpartition_loop_lt_hi₂
+    {as : Vector α n} (ilo : lo ≤ i) (ik : i ≤ k) (w : k < n) (z : k ≤ hi)
+    (q : ∃ (k' : Nat) (hj' : k' < n), k' ≥ k ∧ k' < hi ∧ ¬ lt as[k'] pivot) :
+    (qpartition.loop lt lo hi hhi pivot as i k).1.val < hi := by
+  fun_induction qpartition.loop with
+  | case1 =>
+    -- It would be nice if a more aggressive mode in `grind` would do this.
+    apply_assumption <;> grind
+  | case2 => grind [qpartition_loop_lt_hi₁]
+  | case3 => grind
+
+/-- The only way `qpartition` returns a pivot position `≥ hi` is if `hi ≤ lo`. -/
+private theorem qpartition_fst_lt_hi (lt_asymm : ∀ {a b}, lt a b → ¬ lt b a)
+    (as : Vector α n) (hhi : hi < n) (w : lo < hi) : (qpartition as lt lo hi).fst.1 < hi := by
+  apply qpartition_loop_lt_hi₂ lt lo hi
+  · grind
+  · exact ⟨(lo + hi)/2, by grind⟩
+
+private theorem qsort_sort_spec
+    (lt_asymm : ∀ {a b}, lt a b → ¬ lt b a)
+    (le_trans : ∀ {a b c}, ¬ lt b a → ¬ lt c b → ¬ lt c a)
+    (as : Vector α n) (lo hi : Nat) (hhi : hi < n) (w : lo ≤ hi)
+    (as' : Vector α n) (w_as : as' = qsort.sort lt as lo hi) :
+    ∀ i, (h₁ : lo ≤ i) → (h₂ : i < hi) → ¬ lt (as')[i + 1] as'[i] := by
+  unfold qsort.sort at w_as
+  split at w_as <;> rename_i w₁
+  · -- The interesting case, where `lo < hi`.
+    intro i h₁ h₂
+    -- Decompose `qpartition as lt lo hi` into `mid` (the pivot) and `as'` (the partitioned array).
+    split at w_as <;> rename_i mid hmid as' w₂
+    split at w_as <;> rename_i w₃
+    · -- If the pivot was at least `hi`, then we get a contradiction from `lo < hi`.
+      simp only [Prod.ext_iff, Subtype.ext_iff] at w₂
+      obtain ⟨rfl, rfl⟩ := w₂
+      have := qpartition_fst_lt_hi lt lo hi lt_asymm as hhi w₁
+      grind
+    · -- Now we know `lo ≤ mid < hi`.
+      subst w_as
+      if p₁ : i < mid then
+        -- If `i < mid`, then the second stage of sorting is only
+        -- moving elements above where we're looking.
+        rw [getElem_qsort_sort_of_lt_lo (i := i)]
+        rw [getElem_qsort_sort_of_lt_lo (i := i + 1)]
+        -- And so we can apply the theorem recursively replacing `hi` with `mid`.
+        apply qsort_sort_spec lt_asymm le_trans as' lo mid
+        -- The remaining arithmetic side conditions are easily resolved.
+        all_goals grind
+      else
+        replace p₁ : mid ≤ i := by grind
+        -- If `mid ≤ i`, we need to consider two cases.
+        if p₃ : mid = i then
+          -- The tricky case, where `mid = i`.
+          subst i
+          -- On the right hand side, the index is below the range where the second stage of sorting is happening,
+          -- so we can drop that sort.
+          rw [getElem_qsort_sort_of_lt_lo (i := mid)]
+          -- The `mid` element of `qsort.sort lt as' lo mid ⋯`
+          -- is *some* element `lo + k` of `as'` in the range `lo ≤ lo + k ≤ mid`.
+          have z := getElem_qsort_sort_mem lt lo mid as' ?_ mid ?_ ?_ ?_
+          rw [Vector.mem_extract_iff_getElem] at z
+          obtain ⟨k, hk, z⟩ := z
+          rw [← z]
+          clear z
+          -- Similarly, the `mid + 1` element on the left hand side
+          -- is some element `mid + 1 + k'` of `qsort.sort lt as' lo mid ⋯`
+          -- in the range `mid + 1 ≤ mid + 1 + k' ≤ hi`
+          have z := getElem_qsort_sort_mem lt (mid + 1) hi
+            (qsort.sort lt as' lo mid ?_ ?_) ?_ (mid + 1) ?_ ?_ ?_
+          rw [Vector.mem_extract_iff_getElem] at z
+          obtain ⟨k', hk', z⟩ := z
+          rw [← z]
+          clear z
+          -- And then the first stage sort on the left hand side can't have any effect,
+          -- as it only moves elements between `lo` and `mid` inclusive.
+          rw [getElem_qsort_sort_of_hi_lt]
+          · by_cases p : lo + k = mid
+            · -- Now if `lo + k = mid`,
+              -- the element `as'[mid + 1 + k']` is in the top part of the partitioned array,
+              -- and `as[lo + k]` is the pivot, so we get the inequality from the specification of `qpartition`.
+              grind [qpartition_spec₂]
+            · -- Otherwise, we use transitivity:
+              -- `as[lo + k']` is in the bottom part, so is strictly less than the pivot,
+              -- while `as'[mid + 1 + k']` is in the top, so greater than or equal to the pivot.
+              apply le_trans (b := as'[mid])
+              · grind [qpartition_spec₁]
+              · grind [qpartition_spec₂]
+          -- Various arithmetic side conditions remain from the rewriting,
+          -- but are now all easy to resolve.
+          all_goals grind
+        else
+          -- If `i < mid`, we can apply the theorem recursively replacing
+          -- `as` with `qsort.sort lt as' lo mid ⋯` and `lo` with `mid + 1`.
+          apply qsort_sort_spec lt_asymm le_trans _ _ _ (w_as := rfl) <;> grind
+  · -- Just an arithmetical contradiction.
+    grind
+
+/--
+The slice of `as.qsort lt lo hi` from `lo` to `hi` (inclusive) is sorted.
+
+This variant states that adjacent elements are non-decreasing.
+See `qsort_sorted'` for a variant about arbitrary pairs of indices.
+-/
+public theorem qsort_sorted₁' (lt : α → α → Bool) (lt_asymm : ∀ {a b}, lt a b → ¬ lt b a)
+    (le_trans : ∀ {a b c}, ¬ lt b a → ¬ lt c b → ¬ lt c a)
+    (as : Array α) (lo hi : Nat) (i) (h₁ : lo ≤ i) (h₂ : i < hi) (h₃ : i + 1 < as.size) :
+      ¬ lt ((as.qsort lt lo hi)[i + 1]'(by grind)) ((as.qsort lt lo hi)[i]'(by grind)) := by
+  unfold qsort
+  split <;> rename_i w
+  · grind
+  · apply qsort_sort_spec lt lt_asymm le_trans (w_as := rfl) <;> grind
+
+/--
+`Array.qsort` returns a sorted array, i.e. adjacent elements are non-decreasing.
+
+See `qsort_sorted` for a variant about arbitrary pairs of indices.
+-/
+public theorem qsort_sorted₁ (lt : α → α → Bool) (lt_asymm : ∀ {a b}, lt a b → ¬ lt b a)
+    (le_trans : ∀ {a b c}, ¬ lt b a → ¬ lt c b → ¬ lt c a) (as : Array α)
+    (i) (h : i + 1 < (qsort as lt).size) :
+    ¬ lt (as.qsort lt)[i + 1] (as.qsort lt)[i] := by
+  have := qsort_sorted₁' lt lt_asymm le_trans
+  grind
+
+/-- The slice of `as.qsort lt lo hi` from `lo` to `hi` (inclusive) is sorted. -/
+public theorem qsort_sorted' (lt : α → α → Bool) (lt_asymm : ∀ {a b}, lt a b → ¬ lt b a)
+    (le_trans : ∀ {a b c}, ¬ lt b a → ¬ lt c b → ¬ lt c a)
+    (as : Array α) (lo hi : Nat) (i j) (h₁ : lo ≤ i) (h₂ : i < j) (h₃ : j ≤ hi) (h₄ : j < as.size) :
+      ¬ lt ((as.qsort lt lo hi)[j]'(by grind)) ((as.qsort lt lo hi)[i]'(by grind)) := by
+  induction j with
+  | zero => grind
+  | succ j ih =>
+    if p : i = j then
+      subst p
+      apply qsort_sorted₁' <;> grind
+    else
+      apply le_trans (b := (as.qsort lt lo hi)[j]'(by grind))
+      · grind
+      · apply qsort_sorted₁' <;> grind
+
+public theorem qsort_sorted (lt : α → α → Bool) (lt_asymm : ∀ {a b}, lt a b → ¬ lt b a)
+    (le_trans : ∀ {a b c}, ¬ lt b a → ¬ lt c b → ¬ lt c a) (as : Array α) :
+    ∀ i j, (h₁ : i < j) → (h₂ : j < (qsort as lt).size) →
+      ¬ lt (as.qsort lt)[j] (as.qsort lt)[i] := by
+  have := qsort_sorted' lt lt_asymm le_trans
+  grind
+
+end Array
diff --git a/Ix/Theory/Named/Verify/TypeChecker.lean b/Ix/Theory/Named/Verify/TypeChecker.lean
new file mode 100644
index 000000000..04ed1b2a3
--- /dev/null
+++ b/Ix/Theory/Named/Verify/TypeChecker.lean
@@ -0,0 +1,236 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.TypeChecker.InferType
+import Ix.Theory.Named.Verify.TypeChecker.WHNF
+import Ix.Theory.Named.Verify.TypeChecker.IsDefEq
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+open Lean hiding Environment Exception
+open Kernel
+
+structure VEnvs where
+  venv : DefinitionSafety → VEnv
+
+structure VEnvs.WF (env : Environment) (ves : VEnvs) where
+  tr : TrEnv safety env (ves.venv safety)
+  hasPrimitives : VEnv.HasPrimitives (ves.venv safety)
+  safePrimitives : env.find? n = some ci →
+    Environment.primitives.contains n → ci.safety = .safe ∧ ci.levelParams = []
+  mono : safety ≤ safety' → ves.venv safety' ≤ ves.venv safety
+  projectionReady : ProjectionReady env (ves.venv safety)
+  structureEtaReady : StructureEtaReady env (ves.venv safety)
+
+/-- Assemble a `VEnvs` from a pointwise existential. `DefinitionSafety` has three elements, so
+this is a finite case split rather than an appeal to choice -- the name records what it replaces. -/
+theorem VEnvs.axiom_of_choice {P : DefinitionSafety → VEnv → Prop} (H : ∀ sf, ∃ x, P sf x) :
+    ∃ x : VEnvs, ∀ sf, P sf (x.venv sf) := by
+  have ⟨x1, _⟩ := H .safe; have ⟨x2, _⟩ := H .partial; have ⟨x3, _⟩ := H .unsafe
+  exact ⟨⟨fun | .safe => x1 | .partial => x2 | .unsafe => x3⟩, by rintro ⟨⟩ <;> assumption⟩
+
+/-- A model of `env` at a *single* safety level, which is all the type checker consumes.
+
+`VEnvs.WF` bundles one of these at every level, but not every environment the checker runs
+against admits that: while a `partial` mutual block is being checked its members are present
+as axioms tagged `safe` (an `AxiomVal` cannot be tagged `partial`), and their types were only
+checked at `partial`, so there is no `safe`-level model of that environment. -/
+structure VEnvAt (env : Environment) (safety : DefinitionSafety) (venv : VEnv) : Prop where
+  tr : TrEnv safety env venv
+  hasPrimitives : VEnv.HasPrimitives venv
+  safePrimitives : env.find? n = some ci →
+    Environment.primitives.contains n → ci.safety = .safe ∧ ci.levelParams = []
+  projectionReady : ProjectionReady env venv
+  structureEtaReady : StructureEtaReady env venv
+
+theorem VEnvs.WF.toVEnvAt {env : Environment} {ves : VEnvs} (wf : ves.WF env)
+    (safety : DefinitionSafety) : VEnvAt env safety (ves.venv safety) where
+  tr := wf.tr
+  hasPrimitives := wf.hasPrimitives
+  safePrimitives := wf.safePrimitives
+  projectionReady := wf.projectionReady
+  structureEtaReady := wf.structureEtaReady
+
+namespace TypeChecker
+open Inner
+
+theorem Methods.withFuel.WF : ∀ {n}, (withFuel n).WF
+  | 0 =>
+    { isDefEqCore _ _ := .throw
+      whnfCore _ := .throw
+      whnf _ := .throw
+      inferType _ _ := .throw }
+  | n + 1 =>
+    have := withFuel.WF (n := n)
+    { isDefEqCore h1 h2 := isDefEqCore'.WF h1 h2 _ this
+      whnfCore h1 := whnfCore'.WF h1 _ this
+      whnf h1 := whnf'.WF h1 _ this
+      inferType h1 h2 := inferType'.WF h1 h2 _ this }
+
+theorem RecM.WF.run {x : RecM α} (H : x.WF c s Q) : (RecM.run x).WF c s Q :=
+  H _ Methods.withFuel.WF
+
+def VContext.mk1 {env : Environment} {safety : DefinitionSafety} {venv : VEnv}
+    (wf : VEnvAt env safety venv) (lparams : List Name := [])
+    (fuel : FuelConfig := {}) : VContext where
+  env; safety; lparams; fuel; venv
+  hasPrimitives := wf.hasPrimitives
+  safePrimitives := wf.safePrimitives
+  trenv := wf.tr
+  projectionReady := wf.projectionReady
+  structureEtaReady := wf.structureEtaReady
+  mlctx := .nil
+  mlctx_wf := trivial
+  lctx_eq := rfl
+
+def VContext.mk' {env : Environment} {ves : VEnvs} (wf : ves.WF env)
+    (safety : DefinitionSafety := .safe) (lparams : List Name := [])
+    (fuel : FuelConfig := {}) : VContext := .mk1 (wf.toVEnvAt safety) lparams fuel
+
+theorem VState.WF.empty1 {env : Environment} {safety : DefinitionSafety} {venv : VEnv}
+    {wf : VEnvAt env safety venv} {lparams : List Name} {fuel : FuelConfig} :
+    VState.WF (.mk1 wf lparams fuel) {} where
+  trctx := .nil
+  ngen_wf := nofun
+  ectx := ⟨[], .refl, trivial, .refl, .empty, nofun⟩
+  inferTypeI_wf := .empty
+  inferTypeC_wf := .empty
+  whnfCore_wf := .empty
+  whnf_wf := .empty
+  unfold_wf _ := by simp
+
+theorem VState.WF.empty {env : Environment} {ves : VEnvs} {wf : ves.WF env}
+    {safety : DefinitionSafety} {lparams : List Name} {fuel : FuelConfig} :
+    VState.WF (.mk' wf safety lparams fuel) {} := by
+  unfold VContext.mk'; exact .empty1
+
+theorem M.WF.run1 {env : Environment} {venv : VEnv} (wf : VEnvAt env safety venv)
+    {x : M α} {Q} (H : x.WF (.mk1 wf lparams fuel) {} fun a _ => Q a) :
+    (M.run env safety {} lparams fuel x).WF Q := by
+  intro a eq
+  simp [M.run, Functor.map, Except.map] at eq
+  split at eq <;> cases eq; rename_i eq
+  let ⟨_, _, _, _, H⟩ := H .empty1 _ _ eq
+  exact H
+
+theorem M.WF.run {env : Environment} {ves : VEnvs} (wf : ves.WF env)
+    {x : M α} {Q} (H : x.WF (.mk' wf safety lparams fuel) {} fun a _ => Q a) :
+    (M.run env safety {} lparams fuel x).WF Q := by
+  unfold VContext.mk' at H; exact M.WF.run1 _ H
+
+/-- Loop invariant rule for `for x in xs do ...`. `Inv` is indexed by the list still to be
+processed, so the conclusion `Inv []` records that every element was handled. The body must
+`yield`; a loop that can `break` is out of scope (none of the kernel's loops do). -/
+theorem M.WF.forIn {c : VContext} {f : α → β → M (ForInStep β)}
+    {Inv : List α → β → VState → Prop}
+    (H : ∀ v vs b s, Inv (v :: vs) b s →
+      (f v b).WF c s fun r s' => ∃ b', r = .yield b' ∧ Inv vs b' s') :
+    ∀ {vs : List α} {b : β} {s : VState}, Inv vs b s →
+      (forIn vs b f).WF c s fun b' s' => Inv [] b' s'
+  | [], _, _, h => .pure h
+  | v :: vs, b, s, h => by
+    rw [List.forIn_cons]
+    refine (H v vs b s h).bind fun r s' _ hr => ?_
+    obtain ⟨b', rfl, hinv⟩ := hr
+    exact M.WF.forIn H hinv
+
+theorem M.WF.bindThrow {c : VContext} {s : VState} {x : M α} {f : α → M β} {Q}
+    (h : x.WF c s fun _ _ => False) : (x >>= f).WF c s Q :=
+  h.bind fun _ _ _ hf => hf.elim
+
+/-- Loop rule for `addMutual`'s header loop, whose accumulator is the set of names seen so
+far: each iteration rejects a name already in the set, so the whole block is duplicate-free. -/
+theorem M.WF.forInFresh {c : VContext} {Q : Lean.DefinitionVal → β → Prop}
+    {f : Lean.DefinitionVal → NameSet → M (ForInStep NameSet)}
+    (H : ∀ v found s, (f v found).WF c s fun r _ =>
+      found.contains v.name = false ∧ (∃ b, Q v b) ∧ r = .yield (found.insert v.name)) :
+    ∀ {vs : List Lean.DefinitionVal} {found : NameSet} {s : VState},
+      (ForIn.forIn vs found f).WF c s fun _ _ =>
+        (∃ bs, List.Forall₂ Q vs bs) ∧ (vs.map (·.name)).Nodup ∧
+          ∀ v ∈ vs, found.contains v.name = false
+  | [], _, _ => .pure ⟨⟨[], .nil⟩, by simp, by simp⟩
+  | v :: vs, found, s => by
+    rw [List.forIn_cons]
+    refine (H v found s).bind fun r s' _ h => ?_
+    obtain ⟨hfresh, ⟨b, hb⟩, rfl⟩ := h
+    refine (M.WF.forInFresh H (vs := vs) (found := found.insert v.name)).mono
+      fun _ _ _ h => ?_
+    obtain ⟨⟨bs, hbs⟩, hnd, hmem⟩ := h
+    refine ⟨⟨b :: bs, .cons hb hbs⟩, ?_, ?_⟩
+    · rw [List.map_cons, List.nodup_cons]
+      refine ⟨fun hm => ?_, hnd⟩
+      obtain ⟨w, hw, hwn⟩ := List.mem_map.1 hm
+      have := hmem w hw
+      rw [NameSet.contains_insert, hwn] at this
+      simp at this
+    · intro w hw
+      cases hw with
+      | head => exact hfresh
+      | tail _ hw =>
+        have := hmem w hw
+        rw [NameSet.contains_insert] at this
+        exact (by simpa using this : _ ∧ _).2
+
+/-- Loop rule for a loop whose elements are already related to a list `cis`, so each iteration
+may use the datum paired with the element it processes; each refines its `ci` to a `ci'`
+related by `R`. -/
+theorem M.WF.forInForall₂ {c : VContext} {f : α → Unit → M (ForInStep Unit)}
+    {P : α → β → Prop} {R : β → β → Prop} {Q : α → β → Prop}
+    (H : ∀ v ci s, P v ci → (f v ()).WF c s fun r _ =>
+      (∃ ci', R ci ci' ∧ Q v ci') ∧ r = .yield ()) :
+    ∀ {vs : List α} {cis : List β} {s : VState}, List.Forall₂ P vs cis →
+      (ForIn.forIn vs () f).WF c s fun _ _ =>
+        ∃ cis', List.Forall₂ R cis cis' ∧ List.Forall₂ Q vs cis' := by
+  intro vs cis s h
+  induction h generalizing s with
+  | nil => exact .pure ⟨[], .nil, .nil⟩
+  | @cons v ci vs cis hd tl ih =>
+    rw [List.forIn_cons]
+    refine (H v ci s hd).bind fun r s' _ h => ?_
+    obtain ⟨⟨ci', hR, hQ⟩, rfl⟩ := h
+    refine (ih (s := s')).mono fun _ _ _ h => ?_
+    obtain ⟨cis', h1, h2⟩ := h
+    exact ⟨ci' :: cis', .cons hR h1, .cons hQ h2⟩
+
+nonrec theorem whnf.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    M.WF c s (whnf e) fun e₁ _ => c.TrExpr e₁ e' :=
+  (whnf.WF he).run.mono fun _ _ _ h => h.2
+
+nonrec theorem inferType.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    M.WF c s (inferType e) fun ty _ => ∃ ty', c.TrTyping e ty e' ty' :=
+  (inferType.WF he).run
+
+nonrec theorem checkType.WF {c : VContext} {s : VState} (h1 : e.FVarsIn (· ∈ c.vlctx.fvars)) :
+    M.WF c s (checkType e) fun ty _ => ∃ e' ty', c.TrTyping e ty e' ty' :=
+  (checkType.WF h1).run
+
+nonrec theorem isDefEq.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    M.WF c s (isDefEq e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' :=
+  (isDefEq.WF he₁ he₂).run
+
+nonrec theorem isProp.WF {c : VContext} {s : VState}
+    (he : c.TrExprS e e') : (isProp e).WF c s fun b _ => b → c.HasType e' (.sort .zero) :=
+  (isProp.WF he).run
+
+nonrec theorem ensureSort.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    M.WF c s (ensureSort e e₀) fun e1 _ => c.TrExpr e1 e' ∧ ∃ u, e1 = .sort u :=
+  (ensureSortCore.WF he).run.mono fun _ _ _ h => ⟨h.2.1, h.1⟩
+
+nonrec theorem ensureForall.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    M.WF c s (ensureForall e) fun e1 _ =>
+      c.TrExpr e1 e' ∧ ∃ name ty body bi, e1 = .forallE name ty body bi :=
+  (ensureForallCore.WF he).run.mono fun _ _ _ h => h.2
+
+nonrec theorem ensureType.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    M.WF c s (ensureType e) fun e1 _ => ∃ e', c.TrExprS e e' ∧ ∃ u u', e1 = .sort u ∧
+      VLevel.ofLevel c.lparams u = some u' ∧ c.HasType e' (.sort u') := by
+  refine (inferType.WF he).bind fun _ _ _ ⟨_, _, a1, a2, a3⟩ => ?_
+  refine (ensureSort.WF a2).mono fun _ _ _ ⟨⟨_, b1, b2⟩, b3⟩ => ?_
+  obtain ⟨_, rfl⟩ := b3; let .sort b1 := b1
+  exact ⟨_, a1, _, _, rfl, b1, a3.defeqU_r c.Ewf c.Δwf b2.symm⟩
diff --git a/Ix/Theory/Named/Verify/TypeChecker/Basic.lean b/Ix/Theory/Named/Verify/TypeChecker/Basic.lean
new file mode 100644
index 000000000..175f3c5fb
--- /dev/null
+++ b/Ix/Theory/Named/Verify/TypeChecker/Basic.lean
@@ -0,0 +1,1176 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Environment.Lemmas
+import Ix.Theory.Named.Verify.Typing.ConditionallyTyped
+import Ix.Theory.Named.Reference.TypeChecker
+
+open Ix.Theory (VLevel)
+
+namespace Except
+
+def WF (x : Except ε α) (Q : α → Prop) : Prop := ∀ a, x = .ok a → Q a
+
+theorem WF.bind {x : Except ε α} {f : α → Except ε β} {Q R}
+    (h1 : x.WF Q) (h2 : ∀ a, Q a → (f a).WF R) : (x >>= f).WF R := by
+  intro b
+  simp [(· >>= ·), Except.bind]
+  split; · simp
+  exact h2 _ (h1 _ rfl) _
+
+theorem WF.pure {Q} (H : Q a) :
+    (pure a : Except ε α).WF Q := by rintro _ ⟨⟩; exact H
+
+theorem WF.map {x : Except ε α} {f : α → β} {Q R}
+    (h1 : x.WF Q) (h2 : ∀ a, Q a → R (f a)) : (f <$> x).WF R := by
+  rw [map_eq_pure_bind]
+  exact h1.bind fun _ h => .pure (h2 _ h)
+
+theorem WF.mono {x : Except ε α} {Q R}
+    (h1 : x.WF Q) (h2 : ∀ a, Q a → R a) : x.WF R := by
+  simpa using h1.bind fun _ h => .pure (h2 _ h)
+
+theorem WF.throw {Q} : (throw e : Except ε α).WF Q := nofun
+
+theorem WF.le {Q R} {x : Except ε α}
+    (h1 : x.WF Q) (H : ∀ a, Q a → R a) :
+    x.WF R := fun _ e => H _ (h1 _ e)
+
+theorem WF.pureBind  {f : β → Except ε α} {Q}
+    {x : β} (H : WF (f x) Q) : ((Pure.pure x : Except ε β) >>= f).WF Q := H
+
+end Except
+
+namespace Ix.Theory.Named
+open Ix.Theory.Named
+open Lean hiding Environment Exception
+open Kernel
+open scoped _root_.List
+
+namespace DefEqCache
+
+variable {env : VEnv} {Us : List Name} {Δ : VLCtx}
+
+/-- The relation the positive `isDefEq` cache records: both kernel expressions translate to
+definitionally equal `VExpr`s.
+
+Unlike the union-find manager it replaces, this relation is deliberately *not* closed under
+transitivity or congruence. `isDefEq` is a sound but incomplete semi-decision procedure and so is
+not transitive, and closing over its successes would make the checker's answers depend on the order
+in which pairs were presented (lean4#14806). -/
+def IsDefEqE (env : VEnv) (Us : List Name) (Δ : VLCtx) (e₁ e₂ : Expr) : Prop :=
+  ∃ e', TrExprS env Us Δ e₁ e' ∧ TrExpr env Us Δ e₂ e'
+
+theorem IsDefEqE.symm (H : IsDefEqE env Us Δ e₁ e₂) : IsDefEqE env Us Δ e₂ e₁ :=
+  let ⟨_, h1, _, h2, h3⟩ := H; ⟨_, h2, _, h1, h3.symm⟩
+
+/-- The cache is keyed by a `BEq` hash set, so a lookup may present expressions that are only
+`Expr.eqv`-equal to the ones recorded. -/
+theorem IsDefEqE.eqv (H : IsDefEqE env Us Δ e₁ e₂) (h₁ : e₁ == e₁') (h₂ : e₂ == e₂') :
+    IsDefEqE env Us Δ e₁' e₂' :=
+  let ⟨_, h1, _, h2, h3⟩ := H; ⟨_, h1.eqv h₁, _, h2.eqv h₂, h3⟩
+
+variable! (henv : env.WF) (W : VLCtx.FVLift' Δ Δ' 0 n 0) (hΔ : VLCtx.WF env Us.length Δ') in
+theorem IsDefEqE.weak' (H : IsDefEqE env Us Δ e₁ e₂) : IsDefEqE env Us Δ' e₁ e₂ :=
+  let ⟨_, h1, h2⟩ := H; ⟨_, h1.weakFV' henv W hΔ, h2.weakFV' henv W hΔ⟩
+
+theorem IsDefEqE.uniq (henv : env.WF) (hΔ : Δ.WF env Us.length)
+    (he₁ : TrExprS env Us Δ e₁ e₁') (he₂ : TrExprS env Us Δ e₂ e₂')
+    (eq : IsDefEqE env Us Δ e₁ e₂) : env.IsDefEqU Us.length Δ.toCtx e₁' e₂' :=
+  let ⟨_, h1, _, h2, h3⟩ := eq
+  (he₁.uniq henv (.refl henv hΔ) h1).trans henv hΔ <|
+    h3.symm.trans henv hΔ (h2.uniq henv (.refl henv hΔ) he₂)
+
+variable (env Us Δ) in
+/-- Well-formedness of the positive `isDefEq` cache: every pair it answers `true` for really is a
+pair of definitionally equal expressions. -/
+def WF (m : Std.HashSet (Expr × Expr)) : Prop :=
+  ∀ ⦃p : Expr × Expr⦄, p ∈ m → IsDefEqE env Us Δ p.1 p.2
+
+theorem WF.empty : WF env Us Δ {} := by simp [WF]
+
+theorem WF.insert (wf : WF env Us Δ m) (H : IsDefEqE env Us Δ e₁ e₂) :
+    WF env Us Δ (m.insert (e₁, e₂)) := by
+  intro p hp
+  rcases Std.HashSet.mem_insert.1 hp with h | h
+  · obtain ⟨q₁, q₂⟩ := p
+    have h' : ((e₁ == q₁) && (e₂ == q₂)) = true := h
+    rw [Bool.and_eq_true] at h'
+    exact H.eqv h'.1 h'.2
+  · exact wf h
+
+theorem WF.contains (wf : WF env Us Δ m) (h : m.contains (e₁, e₂)) :
+    IsDefEqE env Us Δ e₁ e₂ := wf (Std.HashSet.contains_iff_mem.1 h)
+
+variable! (henv : env.WF) (W : VLCtx.FVLift' Δ Δ' 0 n 0) (hΔ : VLCtx.WF env Us.length Δ') in
+theorem WF.weak' (wf : WF env Us Δ m) : WF env Us Δ' m :=
+  fun _ h => (wf h).weak' henv W hΔ
+
+end DefEqCache
+
+/-- Exact alignment between one host structure record and the registered
+Theory artifact used to interpret primitive projections.  The positional
+metadata is retained explicitly because ordinary constant translation checks
+types but does not identify the kernel's parameter/constructor roles. -/
+structure ProjectionArtifact (env : Environment) (name : Name)
+    (info : InductiveVal) (venv : VEnv) where
+  view : VStructureView
+  name_eq : view.name = name
+  viewWF : view.WF venv
+  constructorInfo : ConstructorVal
+  constructor_find : env.find? view.constructorName =
+    some (.ctorInfo constructorInfo)
+  constructor_numParams_eq : constructorInfo.numParams = view.nparams
+  constructor_numFields_eq : constructorInfo.numFields = view.fields.length
+  levelParams_length : info.levelParams.length = view.uvars
+  numParams_eq : info.numParams = view.nparams
+  numIndices_eq : info.numIndices = 0
+  ctors_eq : info.ctors = [view.constructorName]
+  rawResult_sort : ∃ resultLevel,
+    view.generation.block.rawResult = .sort resultLevel
+  programsWF : view.ProgramsWF venv
+
+/-- Host/Theory coherence needed by primitive projections.
+
+Inference obtains one complete registered artifact from ready family
+metadata. Reduction additionally relies on the positional host fact that a
+constructor's cached `numParams` agrees with the registered Theory view;
+ordinary constant translation checks the constructor type but does not
+identify which leading binders the host metadata classifies as parameters. -/
+structure ProjectionReady (env : Environment) (venv : VEnv) : Prop where
+  infer : ∀ name info, env.find? name = some (.inductInfo info) →
+    env.isProjectionReadyStructure name = true →
+    Nonempty (ProjectionArtifact env name info venv)
+  constructorNumParams : ∀ (view : VStructureView) (info : ConstructorVal),
+    view.WF venv →
+    env.find? view.constructorName = some (.ctorInfo info) →
+    info.numParams = view.nparams
+
+/-- Exact host/Theory alignment for one constructor/family pair accepted by
+the runtime structure-eta heuristics.  The underlying projection artifact
+supplies the registered Theory view and its typed projector programs; the two
+equalities identify that artifact with the precise host constructor lookup
+which triggered the heuristic. -/
+structure StructureEtaArtifact (env : Environment) (familyName : Name)
+    (familyInfo : InductiveVal) (constructorName : Name)
+    (constructorInfo : ConstructorVal) (venv : VEnv) where
+  projection : ProjectionArtifact env familyName familyInfo venv
+  constructor_name_eq : projection.view.constructorName = constructorName
+  constructor_info_eq : projection.constructorInfo = constructorInfo
+  /-- The ordered registry proof fixes the exact descriptor generated from
+  the checked view.  It contains no equality oracle: the associated
+  subject-reduction package is recovered by `Ordered.structEtaWF`. -/
+  etaOrdered : venv.Ordered
+  etaRegistered : venv.structEtas
+    (projection.viewWF.toStructEta etaOrdered)
+
+/-- Host-metadata coherence required whenever the executable checker accepts
+a family/constructor pair as a nonrecursive structure.  This deliberately
+contains no Theory equality: `VEnv.HasStructureEta` is the separate semantic
+capability consumed by the verification theorem. -/
+structure StructureEtaReady (env : Environment) (venv : VEnv) : Prop where
+  resolve : ∀ familyName familyInfo constructorName constructorInfo,
+    env.find? familyName = some (.inductInfo familyInfo) →
+    env.find? constructorName = some (.ctorInfo constructorInfo) →
+    env.isNonRecStructure familyName = true →
+    Nonempty (StructureEtaArtifact env familyName familyInfo
+      constructorName constructorInfo venv)
+
+/-- Resolve the family artifact named by a constructor lookup after the
+runtime nonrecursive-structure test has succeeded. -/
+theorem StructureEtaReady.resolveConstructor
+    (self : StructureEtaReady env venv)
+    (hctor : env.find? constructorName = some (.ctorInfo constructorInfo))
+    (hnonrec : env.isNonRecStructure constructorInfo.induct = true) :
+    ∃ familyInfo,
+      env.find? constructorInfo.induct = some (.inductInfo familyInfo) ∧
+      Nonempty (StructureEtaArtifact env constructorInfo.induct familyInfo
+        constructorName constructorInfo venv) := by
+  have hshape := hnonrec
+  unfold Kernel.Environment.isNonRecStructure at hshape
+  generalize hfamily : env.find? constructorInfo.induct = found at hshape
+  cases found with
+  | none => simp at hshape
+  | some info => cases info with
+    | inductInfo familyInfo =>
+      exact ⟨familyInfo, rfl,
+        self.resolve _ _ _ _ hfamily hctor hnonrec⟩
+    | axiomInfo _ => simp at hshape
+    | defnInfo _ => simp at hshape
+    | thmInfo _ => simp at hshape
+    | opaqueInfo _ => simp at hshape
+    | quotInfo _ => simp at hshape
+    | ctorInfo _ => simp at hshape
+    | recInfo _ => simp at hshape
+
+/-- Consume the exact registered descriptor retained by a resolved host
+structure artifact.  Reconstruction typing comes from the registry's
+`VStructEta.WF` certificate; the equality is precisely the primitive Theory
+rule. -/
+theorem StructureEtaArtifact.eta
+    (self : StructureEtaArtifact env familyName familyInfo constructorName
+      constructorInfo venv)
+    {U : Nat} {Γ : List VExpr} {levels : List VLevel}
+    {params : List VExpr} {major : VExpr}
+    (hΓ : OnCtx Γ (venv.IsType U))
+    (hlevels : ∀ level ∈ levels, level.WF U)
+    (hlevelsLength : levels.length = self.projection.view.uvars)
+    (hparamsLength : params.length = self.projection.view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      venv.SpineWF U Γ
+        (self.projection.view.familyType.instL levels)
+        params (.sort resultLevel))
+    (hmajor : venv.HasType U Γ major
+      (self.projection.view.structureType levels params)) :
+    venv.IsDefEq U Γ
+      (self.projection.view.etaRebuild levels params major) major
+      (self.projection.view.structureType levels params) := by
+  let rule := self.projection.viewWF.toStructEta self.etaOrdered
+  have hruleWF : rule.WF venv :=
+    self.etaOrdered.structEtaWF self.etaRegistered
+  obtain ⟨resultLevel, hparamsSpine⟩ := hparamsSpine
+  have hrebuild := hruleWF.rebuild_hasType VEnv.LE.rfl hΓ hlevels
+    hlevelsLength hparamsLength ⟨resultLevel, hparamsSpine⟩ hmajor
+  have heta := VEnv.IsDefEq.structEta self.etaRegistered hlevels
+    hlevelsLength hparamsLength hparamsSpine hmajor hrebuild
+  simpa [rule] using heta
+
+/-- Environments which contain no constructor metadata satisfy projection
+readiness vacuously.  This is the common staging case for validation fixtures:
+families may already be present, but their constructors have not been
+installed yet. -/
+theorem ProjectionReady.of_no_ctorInfo
+    (hnoCtor : ∀ name info,
+      env.find? name ≠ some (.ctorInfo info)) :
+    ProjectionReady env venv where
+  infer name _info hfind hready := by
+    have hfalse :=
+      Kernel.Environment.isProjectionReadyStructure_false_of_no_ctorInfo
+        hfind hnoCtor
+    rw [hfalse] at hready
+    contradiction
+  constructorNumParams _view info _hview hfind :=
+    (hnoCtor _ info hfind).elim
+
+/-- Environments with no constructor metadata also satisfy structure-eta
+readiness vacuously. -/
+theorem StructureEtaReady.of_no_ctorInfo
+    (hnoCtor : ∀ name info,
+      env.find? name ≠ some (.ctorInfo info)) :
+    StructureEtaReady env venv where
+  resolve _ _ constructorName constructorInfo _ hctor _ :=
+    (hnoCtor constructorName constructorInfo hctor).elim
+
+/-- A convenient negative readiness witness for staging/indexed environments
+where the host recognizes no eta-eligible structure family. -/
+theorem StructureEtaReady.of_no_nonRecStructure
+    (hnone : ∀ name, env.isNonRecStructure name = false) :
+    StructureEtaReady env venv where
+  resolve familyName _ _ _ _ _ hnonrec := by
+    rw [hnone familyName] at hnonrec
+    contradiction
+
+namespace TypeChecker
+
+inductive MLCtx where
+  | nil : MLCtx
+  | vlam (id : FVarId) (name : Name) (ty : Expr) (ty' : VExpr) (bi : BinderInfo) : MLCtx → MLCtx
+  | vlet (id : FVarId) (name : Name) (ty v : Expr) (ty' v' : VExpr) : MLCtx → MLCtx
+
+@[simp] def MLCtx.vlctx : MLCtx → VLCtx
+  | .nil => []
+  | .vlam id _ ty ty' _ c => (some (id, ty.fvarsList), .vlam ty') :: c.vlctx
+  | .vlet id _ ty v ty' v' c => (some (id, ty.fvarsList ++ v.fvarsList), .vlet ty' v') :: c.vlctx
+
+def MLCtx.lctx : MLCtx → LocalContext
+  | .nil => {}
+  | .vlam id name ty _ bi c => c.lctx.mkLocalDecl id name ty bi
+  | .vlet id name ty val _ _ c => c.lctx.mkLetDecl id name ty val
+
+@[simp] def MLCtx.length : MLCtx → Nat
+  | .nil => 0
+  | .vlam _ _ _ _ _ c
+  | .vlet _ _ _ _ _ _ c => c.length + 1
+
+def MLCtx.decls : MLCtx → List LocalDecl
+  | .nil => {}
+  | .vlam x name ty _ bi c => .cdecl c.length x name ty bi .default :: c.decls
+  | .vlet x name ty v _ _ c => .ldecl c.length x name ty v false default :: c.decls
+
+@[simp] def MLCtx.fvarRevList (c : MLCtx) (n) (hn : n ≤ c.length) : List FVarId :=
+  match n, c, hn with
+  | 0, _, _ => []
+  | n+1, .vlam id _ _ _ _ c, h
+  | n+1, .vlet id _ _ _ _ _ c, h => id :: c.fvarRevList n (Nat.le_of_succ_le_succ h)
+termination_by structural n
+
+@[simp] theorem MLCtx.fvarRevList_length {c n hn} : (MLCtx.fvarRevList c n hn).length = n := by
+  induction n generalizing c <;> [simp; cases c <;> simp [*] at hn ⊢]
+
+@[simp] def MLCtx.letValList (c : MLCtx) (n) (hn : n ≤ c.length) : List (Option (Expr × Expr)) :=
+  match n, c, hn with
+  | 0, _, _ => []
+  | n+1, .vlam _ _ _ _ _ c, h => none :: c.letValList n (Nat.le_of_succ_le_succ h)
+  | n+1, .vlet _ _ ty v _ _ c, h => some (ty, v) :: c.letValList n (Nat.le_of_succ_le_succ h)
+termination_by structural n
+
+@[simp] theorem MLCtx.letValList_length {c n hn} : (MLCtx.letValList c n hn).length = n := by
+  induction n generalizing c <;> [simp; cases c <;> simp [*] at hn ⊢]
+
+@[simp] def MLCtx.dropN (c : MLCtx) (n) (hn : n ≤ c.length) : MLCtx :=
+  match n, c, hn with
+  | 0, c, _ => c
+  | n+1, .vlam _ _ _ _ _ c, h
+  | n+1, .vlet _ _ _ _ _ _ c, h => c.dropN n (Nat.le_of_succ_le_succ h)
+termination_by structural n
+
+def MLCtx.WF (env : VEnv) (Us : List Name) : MLCtx → Prop
+  | .nil => True
+  | .vlam fv _ ty ty' _ c =>
+    c.WF env Us ∧ c.lctx.find? fv = none ∧
+    TrExprS env Us c.vlctx ty ty' ∧
+    env.IsType Us.length c.vlctx.toCtx ty'
+  | .vlet fv _ ty v ty' v' c =>
+    c.WF env Us ∧ c.lctx.find? fv = none ∧
+    TrExprS env Us c.vlctx ty ty' ∧ TrExprS env Us c.vlctx v v' ∧
+    env.HasType Us.length c.vlctx.toCtx v' ty'
+
+theorem MLCtx.WF.tr : ∀ {c : MLCtx}, c.WF env Us → TrLCtx env Us c.lctx c.vlctx
+  | .nil, _ => ⟨.nil, .nil⟩
+  | .vlam .., ⟨h1, h2, h3, h4⟩ => .mkLocalDecl h1.tr h2 h3 h4
+  | .vlet .., ⟨h1, h2, h3, h4, h5⟩ => .mkLetDecl h1.tr h2 h3 h4 h5
+
+theorem MLCtx.WF.dropN {c : MLCtx} (n hn) : c.WF env Us → (c.dropN n hn).WF env Us :=
+  match n, c, hn with
+  | 0, _, _ => id
+  | n+1, .vlam .., h
+  | n+1, .vlet .., h => fun H => H.1.dropN n (Nat.le_of_succ_le_succ h)
+
+theorem MLCtx.dropN_fvars_subset {c : MLCtx} (n hn) : (c.dropN n hn).vlctx.fvars ⊆ c.vlctx.fvars :=
+  match n, c, hn with
+  | 0, _, _ => fun _ => id
+  | n+1, .vlam .., h
+  | n+1, .vlet .., h =>
+    List.subset_cons_of_subset _ <| dropN_fvars_subset n (Nat.le_of_succ_le_succ h)
+
+theorem MLCtx.noBV (c : MLCtx) : c.vlctx.NoBV := by
+  induction c <;> trivial
+
+structure VContext extends Context where
+  venv : VEnv
+  hasPrimitives : VEnv.HasPrimitives venv
+  safePrimitives : env.find? n = some ci →
+    Environment.primitives.contains n → ci.safety = .safe ∧ ci.levelParams = []
+  trenv : TrEnv safety env venv
+  projectionReady : ProjectionReady env venv
+  structureEtaReady : StructureEtaReady env venv
+  mlctx : MLCtx
+  mlctx_wf : mlctx.WF venv lparams
+  lctx_eq : mlctx.lctx = lctx
+
+@[simp] abbrev VContext.lctx' (c : VContext) := c.mlctx.lctx
+@[simp] abbrev VContext.vlctx (c : VContext) := c.mlctx.vlctx
+
+theorem VContext.trlctx (c : VContext) : TrLCtx c.venv c.lparams c.lctx' c.vlctx := c.mlctx_wf.tr
+theorem VContext.Ewf (c : VContext) : VEnv.WF c.venv := c.trenv.wf
+theorem VContext.Δwf (c : VContext) : c.vlctx.WF c.venv c.lparams.length := c.trlctx.wf
+
+nonrec abbrev VContext.TrExprS (c : VContext) : Expr → VExpr → Prop :=
+  TrExprS c.venv c.lparams c.vlctx
+nonrec abbrev VContext.TrExpr (c : VContext) : Expr → VExpr → Prop :=
+  TrExpr c.venv c.lparams c.vlctx
+nonrec abbrev VContext.IsType (c : VContext) : VExpr → Prop :=
+  c.venv.IsType c.lparams.length c.vlctx.toCtx
+nonrec abbrev VContext.HasType (c : VContext) : VExpr → VExpr → Prop :=
+  c.venv.HasType c.lparams.length c.vlctx.toCtx
+nonrec abbrev VContext.IsDefEqU (c : VContext) : VExpr → VExpr → Prop :=
+  c.venv.IsDefEqU c.lparams.length c.vlctx.toCtx
+nonrec abbrev VContext.TrLCtx (c : VContext) : Prop :=
+  TrLCtx c.venv c.lparams c.lctx' c.vlctx
+nonrec abbrev VContext.FVarsBelow (c : VContext) : Expr → Expr → Prop :=
+  FVarsBelow c.vlctx
+nonrec abbrev VContext.TrTyping (c : VContext) : Expr → Expr → VExpr → VExpr → Prop :=
+  TrTyping c.venv c.lparams c.vlctx
+
+class VContext.MLCWF (c : VContext) (m : MLCtx) : Prop where
+  wf : m.WF c.venv c.lparams
+
+instance (c : VContext) : c.MLCWF c.mlctx := ⟨c.mlctx_wf⟩
+
+structure VState extends State where
+
+def _root_.Ix.Theory.Named.InferCache.WF (c : VContext) (s : VState) (m : InferCache) : Prop :=
+  ∀ ⦃e ty : Expr⦄, m[e]? = some ty → ConditionallyHasType s.ngen c.venv c.lparams c.vlctx e ty
+
+theorem _root_.Ix.Theory.Named.InferCache.WF.empty : InferCache.WF c s {} := fun _ => by simp
+
+def WHNFCache.WF (c : VContext) (s : VState) (m : InferCache) : Prop :=
+  ∀ ⦃e ty : Expr⦄, m[e]? = some ty → ConditionallyWHNF s.ngen c.venv c.lparams c.vlctx e ty
+
+theorem WHNFCache.WF.empty : WHNFCache.WF c s {} := fun _ => by simp
+
+def UnfoldCache.WF (c : VContext) (m : ExprMap Expr) : Prop :=
+  ∀ ⦃e e' : Expr⦄, m[e]? = some e' → ∃ n ls ci, e = .const n ls ∧
+      c.env.find? n = some ci ∧ e' = Inner.instantiateDeltaValue ci ls
+
+class VState.WF (c : VContext) (s : VState) where
+  trctx : c.TrLCtx
+  ngen_wf : ∀ fv ∈ c.vlctx.fvars, s.ngen.Reserves fv
+  ectx : ∃ Δ' n, Δ'.WF c.venv c.lparams.length ∧ c.vlctx.FVLift' Δ' 0 n 0 ∧
+    DefEqCache.WF c.venv c.lparams Δ' s.success ∧ ∀ fv ∈ Δ'.fvars, s.ngen.Reserves fv
+  inferTypeI_wf : s.inferTypeI.WF c s
+  inferTypeC_wf : s.inferTypeC.WF c s
+  whnfCore_wf : WHNFCache.WF c s s.whnfCoreCache
+  whnf_wf : WHNFCache.WF c s s.whnfCache
+  unfold_wf : UnfoldCache.WF c s.unfold
+
+theorem VState.WF.find?_eq_none {id}
+    (wf : VState.WF c s) (H : ¬s.ngen.Reserves id) : c.lctx'.find? id = none :=
+  wf.trctx.find?_eq_none.2 fun h => H (wf.ngen_wf _ h)
+
+def VState.LE (s₁ s₂ : VState) : Prop :=
+  s₁.ngen ≤ s₂.ngen
+
+instance : LE VState := ⟨VState.LE⟩
+
+theorem VState.LE.rfl {s : VState} : s ≤ s := NameGenerator.LE.rfl
+
+theorem VState.LE.trans {s₁ s₂ s₃ : VState} (h₁ : s₁ ≤ s₂) (h₂ : s₂ ≤ s₃) : s₁ ≤ s₃ :=
+  NameGenerator.LE.trans h₁ h₂
+
+theorem VState.LE.reservesV {s₁ s₂ : VState} (h : s₁ ≤ s₂) {{fv}} :
+    s₁.ngen.Reserves fv → s₂.ngen.Reserves fv :=
+  (·.mono h)
+
+theorem VState.LE.reserves {s₁ s₂ : VState} (h : s₁ ≤ s₂) {{e}} :
+    FVarsIn s₁.ngen.Reserves e → FVarsIn s₂.ngen.Reserves e :=
+  (·.mono h.reservesV)
+
+def M.WF (c : VContext) (vs : VState) (x : M α) (Q : α → VState → Prop) : Prop :=
+  vs.WF c → ∀ a s', x c.toContext vs.toState = .ok (a, s') →
+    ∃ vs', vs'.toState = s' ∧ vs ≤ vs' ∧ vs'.WF c ∧ Q a vs'
+
+theorem M.WF.bind {c : VContext} {s : VState} {x : M α} {f : α → M β} {Q R}
+    (h1 : x.WF c s Q)
+    (h2 : ∀ a s', s ≤ s' → Q a s' → (f a).WF c s' R) :
+    (x >>= f).WF c s R := by
+  intro wf₁ a vs₁
+  simp [(· >>= ·), ReaderT.bind, StateT.bind, Except.bind]
+  split; · simp
+  intro h; rename_i v eq
+  obtain ⟨vs₂, eq1, le1, wf₂, h1⟩ := h1 wf₁ _ _ eq
+  obtain ⟨vs₃, rfl, le2, wf₃, h2⟩ := h2 _ _ le1 h1 wf₂ _ _ (eq1 ▸ h)
+  exact ⟨_, rfl, le1.trans le2, wf₃, h2⟩
+
+theorem M.WF.pure {c : VContext} {s : VState} {Q} (H : Q a s) :
+    (pure a : M α).WF c s Q := by rintro h _ _ ⟨⟩; exact ⟨_, rfl, .rfl, h, H⟩
+
+theorem M.WF.map {c : VContext} {s : VState} {x : M α} {f : α → β} {Q R}
+    (h1 : x.WF c s Q) (h2 : ∀ a s', s ≤ s' → Q a s' → R (f a) s') : (f <$> x).WF c s R := by
+  rw [map_eq_pure_bind]
+  exact h1.bind fun _ _ le h => .pure (h2 _ _ le h)
+
+theorem M.WF.mono {c : VContext} {s : VState} {x : M α} {Q R}
+    (h1 : x.WF c s Q) (h2 : ∀ a s', s ≤ s' → Q a s' → R a s') : x.WF c s R := by
+  simpa using h1.bind fun _ _ a1 a2 => .pure (h2 _ _ a1 a2)
+
+theorem M.WF.throw {c : VContext} {s : VState} {Q} : (throw e : M α).WF c s Q := nofun
+
+theorem M.WF.le {c : VContext} {s : VState} {Q R} {x : M α}
+    (h1 : x.WF c s Q) (H : ∀ a s', s ≤ s' → Q a s' → R a s') :
+    x.WF c s R := fun wf _ _ e =>
+  let ⟨_, a1, a2, a3, a4⟩ := h1 wf _ _ e
+  ⟨_, a1, a2, a3, H _ _ a2 a4⟩
+
+structure Methods.WF (m : Methods) where
+  isDefEqCore : c.TrExprS e₁ e₁' → c.TrExprS e₂ e₂' →
+    (m.isDefEqCore e₁ e₂).WF c s fun b _ => b → c.IsDefEqU e₁' e₂'
+  whnfCore : c.TrExprS e e' →
+    (m.whnfCore e cheapProj).WF c s fun e₁ _ => c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e'
+  whnf : c.TrExprS e e' →
+    (m.whnf e).WF c s fun e₁ _ => c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e'
+  inferType : e.FVarsIn (· ∈ c.vlctx.fvars) →
+    (inferOnly = true → ∃ e', c.TrExprS e e') →
+    (m.inferType e inferOnly).WF c s fun ty _ => ∃ e' ty', c.TrTyping e ty e' ty'
+
+def RecM.WF (c : VContext) (s : VState) (x : RecM α) (Q : α → VState → Prop) : Prop :=
+  ∀ m, m.WF → M.WF c s (x m) Q
+
+theorem M.WF.liftExcept {c : VContext} {s : VState} {x : Except Exception α} {Q} (h : x.WF Q) :
+    M.WF c s (liftM x) fun a _ => Q a := by
+  rintro wf _ _ eq
+  cases x <;> cases eq
+  exact ⟨s, rfl, .rfl, wf, h _ rfl⟩
+
+theorem M.WF.lift {c : VContext} {s : VState} {x : M α} {Q} (h : x.WF c s Q) :
+    RecM.WF c s x Q := fun _ _ => h
+
+instance : Coe (M.WF c s x Q) (RecM.WF c s x Q) := ⟨M.WF.lift⟩
+
+theorem RecM.WF.bind {c : VContext} {s : VState} {x : RecM α} {f : α → RecM β} {Q R}
+    (h1 : x.WF c s Q) (h2 : ∀ a s', s ≤ s' → Q a s' → (f a).WF c s' R) : (x >>= f).WF c s R :=
+  fun _ h => M.WF.bind (h1 _ h) fun _ _ h1' h2' => h2 _ _ h1' h2' _ h
+
+theorem RecM.WF.bind_le {c : VContext} {s : VState} {x : RecM α} {f : α → RecM β} {Q R}
+    (h1 : x.WF c s Q) (hs : s₀ ≤ s)
+    (h2 : ∀ a s', s₀ ≤ s' → Q a s' → (f a).WF c s' R) : (x >>= f).WF c s R :=
+  RecM.WF.bind h1 fun _ _ h => h2 _ _ (hs.trans h)
+
+theorem RecM.WF.pure {c : VContext} {s : VState} {Q} (H : Q a s) : (pure a : RecM α).WF c s Q :=
+  fun _ _ => .pure H
+
+theorem RecM.WF.map {c : VContext} {s : VState} {x : RecM α} {f : α → β} {Q R}
+    (h1 : x.WF c s Q) (h2 : ∀ a s', s ≤ s' → Q a s' → R (f a) s') : (f <$> x).WF c s R := by
+  rw [map_eq_pure_bind]
+  exact h1.bind fun _ _ le h => .pure (h2 _ _ le h)
+
+theorem RecM.WF.mono {c : VContext} {s : VState} {x : RecM α} {Q R}
+    (h1 : x.WF c s Q) (h2 : ∀ a s', s ≤ s' → Q a s' → R a s') : x.WF c s R := by
+  rw [← id_map x]; exact h1.map h2
+
+theorem RecM.WF.throw {c : VContext} {s : VState} {Q} : (throw e : RecM α).WF c s Q := nofun
+
+theorem RecM.WF.le {c : VContext} {s : VState} {Q R} {x : RecM α}
+    (h1 : x.WF c s Q) (H : ∀ a s', s ≤ s' → Q a s' → R a s') :
+    x.WF c s R := fun _ h => (h1 _ h).le H
+
+theorem RecM.WF.pureBind {c : VContext} {s : VState} {f : β → RecM α} {Q}
+    {x : β} (H : WF c s (f x) Q) : ((Pure.pure x : RecM β) >>= f).WF c s Q := H
+
+theorem get.WF {c : VContext} {s : VState} :
+    M.WF c s get fun a s' => s.toState = a ∧ s = s' := by
+  rintro wf _ _ ⟨⟩; exact ⟨_, rfl, .rfl, wf, rfl, rfl⟩
+
+theorem RecM.WF.get {c : VContext} {s : VState} {f : State → RecM α} {Q}
+    (H : WF c s (f s.toState) Q) : (get >>= f).WF c s Q := H
+
+theorem getEnv.WF {c : VContext} {s : VState} :
+    M.WF c s getEnv fun a s' => c.env = a ∧ s = s' := by
+  rintro wf _ _ ⟨⟩; exact ⟨_, rfl, .rfl, wf, rfl, rfl⟩
+
+theorem RecM.WF.getEnv {c : VContext} {s : VState} {f : Environment → RecM α} {Q}
+    (H : WF c s (f c.env) Q) : (liftM getEnv >>= f).WF c s Q := H
+
+theorem getLCtx.WF {c : VContext} {s : VState} :
+    M.WF c s getLCtx fun a s' => c.lctx' = a ∧ s = s' := by
+  rintro wf _ _ ⟨⟩; exact ⟨_, rfl, .rfl, wf, c.lctx_eq, rfl⟩
+
+theorem RecM.WF.getLCtx {c : VContext} {s : VState} {f : LocalContext → RecM α} {Q}
+    (H : WF c s (f c.lctx') Q) : (getLCtx >>= f).WF c s Q :=
+  getLCtx.WF.lift.bind <| by rintro _ _ _ ⟨rfl, rfl⟩; exact H
+
+theorem RecM.WF.readThe {c : VContext} {s : VState} {f : Context → RecM α} {Q}
+    (H : WF c s (f c.toContext) Q) : (readThe Context >>= f).WF c s Q := H
+
+theorem getNGen.WF {c : VContext} {s : VState} :
+    M.WF c s getNGen fun a s' => s.ngen = a ∧ s = s' := by
+  rintro wf _ _ ⟨⟩; exact ⟨_, rfl, .rfl, wf, rfl, rfl⟩
+
+theorem M.WF.getNGen {c : VContext} {s : VState} {f : NameGenerator → M α} {Q}
+    (H : WF c s (f s.ngen) Q) : (getNGen >>= f).WF c s Q := H
+
+theorem RecM.WF.getNGen {c : VContext} {s : VState} {f : NameGenerator → RecM α} {Q}
+    (H : WF c s (f s.ngen) Q) : (getNGen >>= f).WF c s Q := H
+
+theorem RecM.WF.stateWF {c : VContext} {s : VState} {x : RecM α} {Q}
+    (H : s.WF c → WF c s x Q) : WF c s x Q :=
+  fun _ h wf => H wf _ h wf
+
+@[simp] theorem toLBool_true {b : Bool} : b.toLBool = .true ↔ b = true := by
+  cases b <;> simp [Bool.toLBool]
+
+theorem RecM.WF.toLBoolM {Q : VState → Prop} {x : RecM Bool}
+    (H : x.WF c s fun b s => b → Q s) : (toLBoolM x).WF c s fun b s => b = .true → Q s :=
+  H.bind fun _ _ _ H => .pure fun h => H (by simpa using h)
+
+def VContext.withMLC (c : VContext) (m : MLCtx) [wf : c.MLCWF m] : VContext :=
+  { c with
+    mlctx := m
+    mlctx_wf := wf.1
+    lctx := m.lctx
+    lctx_eq := rfl }
+
+@[simp] theorem VContext.withMLC_self (c : VContext) : c.withMLC c.mlctx = c := by
+  simp [withMLC, c.lctx_eq]
+
+def VState.next (s : VState) : VState := { s with ngen := s.ngen.next }
+
+protected theorem RecM.WF.withLocalDecl {c : VContext} {m} [cwf : c.MLCWF m]
+    {s : VState} {f : Expr → RecM α} {Q name ty ty' bi}
+    (hty : (c.withMLC m).TrExprS ty ty')
+    (hty' : (c.withMLC m).IsType ty')
+    (hs : s₀ ≤ s)
+    (H : ∀ id cwf' s', s₀ ≤ s' → ¬s.ngen.Reserves id →
+      WF (c.withMLC (.vlam id name ty ty' bi m) (wf := cwf')) s' (f (.fvar id)) Q) :
+    (withLocalDecl name bi ty f).WF (c.withMLC m) s Q := by
+  intro _ mwf wf a s' e
+  let id := s.ngen.curr
+  have h0 := s.ngen.next_reserves_self
+  have h1 := s.ngen.not_reserves_self
+  have le : s ≤ s.next := .next
+  have h1' := wf.find?_eq_none h1
+  let m' := m.vlam ⟨id⟩ name ty ty' bi
+  have cwf' : c.MLCWF m' := ⟨cwf.1, h1', hty, hty'⟩
+  have : VState.WF (c.withMLC m') s.next :=
+    have trctx := wf.trctx.mkLocalDecl h1' hty hty'
+    have hic {ic} (H : InferCache.WF (c.withMLC m) s ic) : InferCache.WF (c.withMLC m') s.next ic :=
+      fun _ _ h => ((H h).fresh c.Ewf.ordered trctx.wf).mono le
+    have hwc {wc} (H : WHNFCache.WF (c.withMLC m) s wc) : WHNFCache.WF (c.withMLC m') s.next wc :=
+      fun _ _ h => ((H h).fresh c.Ewf trctx.wf).mono le
+    { ngen_wf := by
+        simp [m', VContext.withMLC]; exact ⟨h0, fun _ h => le.reservesV (wf.ngen_wf _ h)⟩
+      ectx := by
+        let ⟨_, _, a1, a2, a3, a4⟩ := wf.ectx
+        refine
+          have b1 := ⟨a1, ?_, hty'.weak' c.Ewf.ordered a2.toCtx⟩
+          ⟨_, _, b1, a2.cons_fvar _ _ hty.fvarsList, a3.weak' c.Ewf (.skip_fvar _ _ .refl) b1,
+            fun _ h => by obtain _ | ⟨_, h⟩ := h <;> [exact h0; exact (a4 _ h).mono le]⟩
+        rintro _ _ ⟨⟩; exact ⟨mt (a4 _) h1, hty.fvarsList.trans a2.fvars_sublist.subset⟩
+      trctx, inferTypeI_wf := hic wf.inferTypeI_wf, inferTypeC_wf := hic wf.inferTypeC_wf
+      whnfCore_wf := hwc wf.whnfCore_wf, whnf_wf := hwc wf.whnf_wf, unfold_wf := wf.unfold_wf }
+  let ⟨s', hs1, hs2, wf', hs4⟩ := H _ _ _ (hs.trans le) h1 _ mwf this a s' e
+  refine have le' := le.trans hs2; ⟨s', hs1, le', ?_, hs4⟩
+  have hic {ic} (H : InferCache.WF (c.withMLC m') s' ic) :
+      InferCache.WF (c.withMLC m) s' ic := fun _ _ h => (H h).weakN_inv c.Ewf wf'.trctx.wf
+  have hwc {wc} (H : WHNFCache.WF (c.withMLC m') s' wc) :
+      WHNFCache.WF (c.withMLC m) s' wc := fun _ _ h => (H h).weakN_inv c.Ewf wf'.trctx.wf
+  let ⟨_, _, a1, a2, a3⟩ := wf'.ectx
+  exact {
+    ngen_wf := (by simpa [VContext.withMLC] using wf'.ngen_wf :).2
+    ectx := ⟨_, _, a1, .comp (.skip_fvar _ _ .refl) a2, a3⟩
+    trctx := wf.trctx
+    inferTypeI_wf := hic wf'.inferTypeI_wf, inferTypeC_wf := hic wf'.inferTypeC_wf
+    whnfCore_wf := hwc wf'.whnfCore_wf, whnf_wf := hwc wf'.whnf_wf, unfold_wf := wf'.unfold_wf
+  }
+
+protected theorem RecM.WF.withLetDecl {c : VContext} {m} [cwf : c.MLCWF m]
+    {s : VState} {f : Expr → RecM α} {Q name ty ty'}
+    (hty : (c.withMLC m).TrExprS ty ty')
+    (hval : (c.withMLC m).TrExprS val val')
+    (hval' : (c.withMLC m).HasType val' ty')
+    (hs : s₀ ≤ s)
+    (H : ∀ id cwf' s', s₀ ≤ s' → ¬s.ngen.Reserves id →
+      WF (c.withMLC (.vlet id name ty val ty' val' m) (wf := cwf')) s' (f (.fvar id)) Q) :
+    (withLetDecl name ty val f).WF (c.withMLC m) s Q := by
+  intro _ mwf wf a s' e
+  let id := s.ngen.curr
+  have h0 := s.ngen.next_reserves_self
+  have h1 := s.ngen.not_reserves_self
+  have le : s ≤ s.next := .next
+  have h1' := wf.find?_eq_none h1
+  let m' := m.vlet ⟨id⟩ name ty val ty' val'
+  have cwf' : c.MLCWF m' := ⟨cwf.1, h1', hty, hval, hval'⟩
+  have : VState.WF (c.withMLC m') s.next :=
+    have trctx := wf.trctx.mkLetDecl h1' hty hval hval'
+    have hic {ic} (H : InferCache.WF (c.withMLC m) s ic) :
+        InferCache.WF (c.withMLC m') s.next ic :=
+      fun _ _ h => ((H h).fresh c.Ewf.ordered trctx.wf).mono le
+    have hwc {wc} (H : WHNFCache.WF (c.withMLC m) s wc) : WHNFCache.WF (c.withMLC m') s.next wc :=
+      fun _ _ h => ((H h).fresh c.Ewf trctx.wf).mono le
+    { ngen_wf := by
+        simp [m', VContext.withMLC]; exact ⟨h0, fun _ h => le.reservesV (wf.ngen_wf _ h)⟩
+      ectx := by
+        let ⟨_, _, a1, a2, a3, a4⟩ := wf.ectx
+        have hv := List.append_subset.2 ⟨hty.fvarsList, hval.fvarsList⟩
+        refine
+          have b1 := ⟨a1, ?_, hval'.weak' c.Ewf.ordered a2.toCtx⟩
+          ⟨_, _, b1, a2.cons_fvar _ _ hv, a3.weak' c.Ewf (.skip_fvar _ _ .refl) b1,
+            fun _ h => by obtain _ | ⟨_, h⟩ := h <;> [exact h0; exact (a4 _ h).mono le]⟩
+        rintro _ _ ⟨⟩; exact ⟨mt (a4 _) h1, hv.trans a2.fvars_sublist.subset⟩
+      trctx, inferTypeI_wf := hic wf.inferTypeI_wf, inferTypeC_wf := hic wf.inferTypeC_wf
+      whnfCore_wf := hwc wf.whnfCore_wf, whnf_wf := hwc wf.whnf_wf, unfold_wf := wf.unfold_wf }
+  let ⟨s', hs1, hs2, wf', hs4⟩ := H _ _ _ (hs.trans le) h1 _ mwf this a s' e
+  refine ⟨s', hs1, le.trans hs2, ?_, hs4⟩
+  have hic {ic} (H : InferCache.WF (c.withMLC m') s' ic) :
+      InferCache.WF (c.withMLC m) s' ic := fun _ _ h => (H h).weakN_inv c.Ewf wf'.trctx.wf
+  have hwc {wc} (H : WHNFCache.WF (c.withMLC m') s' wc) :
+      WHNFCache.WF (c.withMLC m) s' wc := fun _ _ h => (H h).weakN_inv c.Ewf wf'.trctx.wf
+  let ⟨_, _, a1, a2, a3⟩ := wf'.ectx
+  exact {
+    ngen_wf := (by simpa [VContext.withMLC] using wf'.ngen_wf :).2
+    ectx := ⟨_, _, a1, .comp (.skip_fvar _ _ .refl) a2, a3⟩
+    trctx := wf.trctx
+    inferTypeI_wf := hic wf'.inferTypeI_wf, inferTypeC_wf := hic wf'.inferTypeC_wf
+    whnfCore_wf := hwc wf'.whnfCore_wf, whnf_wf := hwc wf'.whnf_wf, unfold_wf := wf'.unfold_wf
+  }
+
+@[simp] def MLCtx.mkForall (c : MLCtx) (n) (hn : n ≤ c.length) (e : Expr) : Expr :=
+  match n, c, hn with
+  | 0, _, _ => e
+  | n+1, .vlam x name ty _ bi c, h =>
+    c.mkForall n (Nat.le_of_succ_le_succ h) (.forallE name ty (.abstract1 x e) bi)
+  | n+1, .vlet x name ty val _ _ c, h =>
+    c.mkForall n (Nat.le_of_succ_le_succ h) <|
+      let e' := Expr.abstract1 x e
+      if e'.hasLooseBVar' 0 then
+        .letE name ty val e' false
+      else
+        e'.lowerLooseBVars' 1 1
+termination_by structural n
+
+def AllAbove (Δ : VLCtx) (P : FVarId → Prop) (fv : FVarId) : Prop := fv ∈ Δ.fvars → P fv
+
+theorem AllAbove.wf (H : Δ.FVWF) : IsFVarUpSet (AllAbove Δ P) Δ ↔ IsFVarUpSet P Δ :=
+  IsFVarUpSet.congr H fun _ h => by simp [h, AllAbove]
+
+@[simp] def MLCtx.mkForall' (c : MLCtx) (n) (hn : n ≤ c.length) (e : VExpr) : VExpr :=
+  match n, c, hn, e with
+  | 0, _, _, e => e
+  | n+1, .vlam _ _ _ ty _ c, h, e => c.mkForall' n (Nat.le_of_succ_le_succ h) (.forallE ty e)
+  | n+1, .vlet _ _ _ _ _ _ c, h, e => c.mkForall' n (Nat.le_of_succ_le_succ h) e
+termination_by structural n
+
+@[simp] def MLCtx.mkLambda (c : MLCtx) (n) (hn : n ≤ c.length) (e : Expr) : Expr :=
+  match n, c, hn, e with
+  | 0, _, _, e => e
+  | n+1, .vlam x name ty _ bi c, h, e =>
+    c.mkLambda n (Nat.le_of_succ_le_succ h) (.lam name ty (.abstract1 x e) bi)
+  | n+1, .vlet x name ty val _ _ c, h, e =>
+    c.mkLambda n (Nat.le_of_succ_le_succ h) <|
+      let e' := Expr.abstract1 x e
+      if e'.hasLooseBVar' 0 then
+        .letE name ty val e' false
+      else
+        e'.lowerLooseBVars' 1 1
+termination_by structural n
+
+@[simp] def MLCtx.mkLambda' (c : MLCtx) (n) (hn : n ≤ c.length) (e : VExpr) : VExpr :=
+  match n, c, hn, e with
+  | 0, _, _, e => e
+  | n+1, .vlam _ _ _ ty _ c, h, e => c.mkLambda' n (Nat.le_of_succ_le_succ h) (.lam ty e)
+  | n+1, .vlet _ _ _ _ _ _ c, h, e => c.mkLambda' n (Nat.le_of_succ_le_succ h) e
+termination_by structural n
+
+-- HACK: MLCtx.mkLet equation generation fails if this is inlined
+def MLCtx.mkLetArg (x : FVarId) (name : Name)
+    (ty val : Expr) (nd : Option Bool) (e : Expr) : Expr :=
+  let e' := Expr.abstract1 x e
+  if e'.hasLooseBVar' 0 then
+    .letE name ty val e' (nd.getD false)
+  else if let some nd := nd then
+    .letE name ty val e' nd
+  else
+    e'.lowerLooseBVars' 1 1
+
+@[simp] def MLCtx.mkLet (c : MLCtx) (n) (hn : n ≤ c.length)
+    (nds : List (Option Bool)) (eq : nds.length = n) (e : Expr) (asForall := false) : Expr :=
+  match n, c, hn, nds, eq, e with
+  | 0, _, _, _, _, e => e
+  | n+1, .vlam x name ty _ bi c, h, _ :: nds, eq, e =>
+    c.mkLet n (Nat.le_of_succ_le_succ h) nds (Nat.succ_inj.1 eq) <|
+      if asForall then .forallE name ty (.abstract1 x e) bi else .lam name ty (.abstract1 x e) bi
+  | n+1, .vlet x name ty val _ _ c, h, nd :: nds, eq, e =>
+    c.mkLet n (Nat.le_of_succ_le_succ h) nds (Nat.succ_inj.1 eq) <| mkLetArg x name ty val nd e
+termination_by structural n
+
+variable! (henv : VEnv.WF env) in
+theorem MLCtx.WF.mkForall_trS {c : MLCtx} (wf : c.WF env Us)
+    (H1 : TrExprS env Us c.vlctx e e')
+    (H2 : env.IsType Us.length c.vlctx.toCtx e') (n hn) :
+    TrExprS env Us (c.dropN n hn).vlctx (c.mkForall n hn e) (c.mkForall' n hn e') ∧
+    env.IsType Us.length (c.dropN n hn).vlctx.toCtx (c.mkForall' n hn e') := by
+  induction n generalizing c e e' with
+  | zero => exact ⟨H1, H2⟩
+  | succ n ih =>
+    match c with
+    | .vlam x name ty ty' bi c =>
+      let ⟨h1, _, h3, h4⟩ := wf
+      refine ih h1 ?_ (.forallE h4 H2) _
+      exact .forallE h4 H2 h3 (.abstract .zero H1)
+    | .vlet x name ty val ty' val' c =>
+      let ⟨h1, _, h3, h4, h5⟩ := wf
+      refine ih h1 ?_ H2 _; dsimp; split
+      · exact .letE h5 h3 h4 (.abstract .zero H1)
+      · rename_i h; simp at h
+        rw [Expr.lowerLooseBVars_eq_instantiate h (v := val)]
+        exact .inst_let henv (.abstract .zero H1) h4
+
+theorem mkForall_hasType {c : MLCtx}
+    (hus : us.Forall₂ (VLevel.ofLevel Us · = some ·) us')
+    (hΔ : c.vlctx.SortList env Us.length us')
+    (hu : VLevel.ofLevel Us u = some u')
+    (H2 : env.HasType Us.length c.vlctx.toCtx e' (.sort u')) (n hn)
+    (hus : us.length = n) :
+    ∃ u₀', VLevel.ofLevel Us (List.foldl (fun x y => mkLevelIMax' y x) u us) = some u₀' ∧
+    env.HasType Us.length (c.dropN n hn).vlctx.toCtx (c.mkForall' n hn e') (.sort u₀') := by
+  subst hus
+  induction hus generalizing c e' u u' with
+  | nil => exact ⟨_, hu, H2⟩
+  | cons h _ ih =>
+    match c, hΔ with
+    | .vlam x name ty ty' bi c, .cons hΔ hu₁ =>
+      have ⟨_, h5, h6⟩ := ofLevel_mkLevelIMax' h hu
+      refine ih hΔ h5 ?_ (Nat.le_of_succ_le_succ hn)
+      refine .defeq (.sortDF ?_ (.of_ofLevel h5) h6.symm) (hu₁.forallE H2)
+      exact ⟨.of_ofLevel h, .of_ofLevel hu⟩
+
+theorem MLCtx.WF.mkForall'_congr {c : MLCtx} (wf : c.WF env Us)
+    (H : env.IsDefEq Us.length c.vlctx.toCtx e₁ e₂ (.sort u)) (n hn) :
+    ∃ u, env.IsDefEq Us.length (c.dropN n hn).vlctx.toCtx
+      (c.mkForall' n hn e₁) (c.mkForall' n hn e₂) (.sort u) := by
+  induction n generalizing c e₁ e₂ u with
+  | zero => exact ⟨_, H⟩
+  | succ n ih =>
+    match c with
+    | .vlam .. => let ⟨_, h⟩ := wf.2.2.2; exact ih wf.1 (.forallEDF h H) _
+    | .vlet .. => exact ih wf.1 H _
+
+theorem MLCtx.WF.mkForall_tr (henv : VEnv.WF env) {c : MLCtx} (wf : c.WF env Us)
+    (H1 : TrExpr env Us c.vlctx e e')
+    (H2 : env.IsType Us.length c.vlctx.toCtx e') (n hn) :
+    TrExpr env Us (c.dropN n hn).vlctx (c.mkForall n hn e) (c.mkForall' n hn e') ∧
+    env.IsType Us.length (c.dropN n hn).vlctx.toCtx (c.mkForall' n hn e') := by
+  let ⟨_, H1, eq⟩ := H1
+  let ⟨_, H2⟩ := H2
+  have eq := eq.of_r henv wf.tr.wf H2
+  have ⟨_, H⟩ := wf.mkForall'_congr eq n hn
+  have := wf.mkForall_trS henv H1 ⟨_, eq.hasType.1⟩ n hn
+  exact ⟨⟨_, this.1, _, H⟩, this.2.defeqU_l henv (wf.dropN n hn).tr.wf ⟨_, H⟩⟩
+
+variable! (henv : VEnv.WF env) in
+theorem MLCtx.WF.mkLambda_trS {c : MLCtx} (wf : c.WF env Us)
+    (H1 : TrExprS env Us c.vlctx e e')
+    (H2 : env.HasType Us.length c.vlctx.toCtx e' ty') (n hn) :
+    TrExprS env Us (c.dropN n hn).vlctx (c.mkLambda n hn e) (c.mkLambda' n hn e') ∧
+    env.HasType Us.length (c.dropN n hn).vlctx.toCtx
+      (c.mkLambda' n hn e') (c.mkForall' n hn ty') := by
+  induction n generalizing c e e' ty' with
+  | zero => exact ⟨H1, H2⟩
+  | succ n ih =>
+    match c with
+    | .vlam x name ty ty' bi c =>
+      let ⟨h1, _, h3, _, h4⟩ := wf
+      refine ih h1 ?_ (.lam h4 H2) _
+      exact .lam ⟨_, h4⟩ h3 (.abstract .zero H1)
+    | .vlet x name ty val ty' val' c =>
+      let ⟨h1, _, h3, h4, h5⟩ := wf
+      refine ih h1 ?_ H2 _; dsimp; split
+      · exact .letE h5 h3 h4 (.abstract .zero H1)
+      · rename_i h; simp at h
+        rw [Expr.lowerLooseBVars_eq_instantiate h (v := val)]
+        exact .inst_let henv (.abstract .zero H1) h4
+
+theorem MLCtx.WF.mkLambda'_congr {c : MLCtx} (wf : c.WF env Us)
+    (H : env.IsDefEq Us.length c.vlctx.toCtx e₁ e₂ ty) (n hn) :
+    env.IsDefEq Us.length (c.dropN n hn).vlctx.toCtx
+      (c.mkLambda' n hn e₁) (c.mkLambda' n hn e₂) (c.mkForall' n hn ty) := by
+  induction n generalizing c e₁ e₂ ty with
+  | zero => exact H
+  | succ n ih =>
+    match c with
+    | .vlam .. => let ⟨_, h⟩ := wf.2.2.2; exact ih wf.1 (.lamDF h H) _
+    | .vlet .. => exact ih wf.1 H _
+
+theorem MLCtx.WF.mkLambda_tr (henv : VEnv.WF env) {c : MLCtx} (wf : c.WF env Us)
+    (H1 : TrExpr env Us c.vlctx e e')
+    (H2 : env.HasType Us.length c.vlctx.toCtx e' ty') (n hn) :
+    TrExpr env Us (c.dropN n hn).vlctx (c.mkLambda n hn e) (c.mkLambda' n hn e') ∧
+    env.HasType Us.length (c.dropN n hn).vlctx.toCtx
+      (c.mkLambda' n hn e') (c.mkForall' n hn ty') := by
+  let ⟨_, H1, eq⟩ := H1
+  have eq := eq.of_r henv wf.tr.wf H2
+  have H := wf.mkLambda'_congr eq n hn
+  have := wf.mkLambda_trS henv H1 eq.hasType.1 n hn
+  exact ⟨⟨_, this.1, _, H⟩, this.2.defeqU_l henv (wf.dropN n hn).tr.wf ⟨_, H⟩⟩
+
+variable! (henv : VEnv.WF env) in
+theorem MLCtx.WF.mkLet_trS {c : MLCtx} (wf : c.WF env Us)
+    (H1 : TrExprS env Us c.vlctx e e')
+    (H2 : env.HasType Us.length c.vlctx.toCtx e' ty') (n hn nds hnds) :
+    TrExprS env Us (c.dropN n hn).vlctx (c.mkLet n hn nds hnds e) (c.mkLambda' n hn e') ∧
+    env.HasType Us.length (c.dropN n hn).vlctx.toCtx
+      (c.mkLambda' n hn e') (c.mkForall' n hn ty') := by
+  induction n generalizing c e e' ty' nds with
+  | zero => exact ⟨H1, H2⟩
+  | succ n ih =>
+    match c with
+    | .vlam x name ty ty' bi c =>
+      let ⟨h1, _, h3, _, h4⟩ := wf; let _ :: _ := nds
+      refine ih h1 ?_ (.lam h4 H2) ..
+      exact .lam ⟨_, h4⟩ h3 (.abstract .zero H1)
+    | .vlet x name ty val ty' val' c =>
+      let ⟨h1, _, h3, h4, h5⟩ := wf; let _ :: _ := nds
+      refine ih h1 ?_ H2 ..; dsimp [mkLetArg]; split <;> [skip; split]
+      · exact .letE h5 h3 h4 (.abstract .zero H1)
+      · exact .letE h5 h3 h4 (.abstract .zero H1)
+      · rename_i h _ _; simp at h
+        rw [Expr.lowerLooseBVars_eq_instantiate h (v := val)]
+        exact .inst_let henv (.abstract .zero H1) h4
+
+theorem MLCtx.fvarRevList_prefix (c : MLCtx)
+    {n hn} : c.fvarRevList n hn <+: c.vlctx.fvars := by
+  induction n generalizing c with
+  | zero => simp
+  | succ n ih => match c with | .vlam .. | .vlet .. => simp [ih]
+
+theorem MLCtx.WF.fvars_nodup : ∀ {c : MLCtx}, c.WF env Us → c.vlctx.fvars.Nodup
+  | .nil, _ => .nil
+  | .vlam _ _ _ _ _ c, ⟨h1, h2, _⟩
+  | .vlet _ _ _ _ _ _ c, ⟨h1, h2, _⟩ => by simp [h1.fvars_nodup, h1.tr.find?_eq_none.1 h2]
+
+theorem MLCtx.WF.fvarRevList_nodup {c : MLCtx} (wf : c.WF env Us)
+    (n hn) : (c.fvarRevList n hn).Nodup :=
+  c.fvarRevList_prefix.sublist.nodup wf.fvars_nodup
+
+theorem MLCtx.WF.decls_size {c : MLCtx} (wf : c.WF env Us) :
+    c.lctx.decls.size = c.length := by
+  rw [← wf.tr.1.decls_wf.toList'_length]
+  induction c with
+  | nil => rfl
+  | vlam _ _ _ _ _ _ ih => simp [lctx, LocalContext.mkLocalDecl, ih wf.1]
+  | vlet _ _ _ _ _ _ _ ih => simp [lctx, LocalContext.mkLetDecl, ih wf.1]
+
+theorem MLCtx.WF.toList_eq {c : MLCtx} (wf : c.WF env Us) :
+    c.lctx.toList = c.decls := by
+  simp [LocalContext.toList]
+  induction c with
+  | nil => rfl
+  | vlam _ _ _ _ _ _ ih => simp [lctx, LocalContext.mkLocalDecl, decls, ih wf.1, wf.1.decls_size]
+  | vlet _ _ _ _ _ _ _ ih => simp [lctx, LocalContext.mkLetDecl, decls, ih wf.1, wf.1.decls_size]
+
+theorem MLCtx.WF.find?_eq {c : MLCtx} (wf : c.WF env Us) :
+    c.lctx.find? x = c.decls.find? (x == ·.fvarId) := by
+  simp [wf.tr.1.find?_eq_find?_toList, wf.toList_eq]
+
+inductive MLCtx.PartialForall : MLCtx → Nat → List FVarId → Expr → Prop where
+  | nil : PartialForall c 0 [] e
+  | vlam : PartialForall c n fvs (.forallE x ty (.abstract1 fv e) bi) →
+    PartialForall (c.vlam fv x ty ty' bi) (n+1) (fv :: fvs) e
+  | vlet : PartialForall c n fvs (
+      let e' := Expr.abstract1 fv e
+      if e'.hasLooseBVar' 0 then .letE x ty v e' false
+      else e'.lowerLooseBVars' 1 1) →
+    PartialForall (c.vlet fv x ty v ty' v') (n+1) (fv :: fvs) e
+  | skip : e.looseBVarRange' = 0 → e' = Expr.abstract1 fv e → e'.hasLooseBVar' 0 = false →
+    PartialForall c n fvs e →
+    PartialForall (c.vlet fv x ty v ty' v') (n+1) fvs e
+
+theorem MLCtx.PartialForall.full : MLCtx.PartialForall c n (c.fvarRevList n hn) e := by
+  induction n generalizing c e with
+  | zero => exact .nil
+  | succ n ih => match c with | .vlam .. | .vlet .. => constructor; apply ih
+
+theorem MLCtx.PartialForall.sublist (H : MLCtx.PartialForall c n l e) : l <+ c.vlctx.fvars := by
+  induction H with
+  | nil => simp
+  | vlam _ ih | vlet _ ih => simp [ih]
+  | skip _ _ _ _ ih => exact ih.trans (List.sublist_cons_self ..)
+
+theorem MLCtx.WF.mkForall_partial {c : MLCtx} (wf : c.WF env Us) (n hn)
+    (harr : arr.toList.reverse = l.map .fvar) (hp : MLCtx.PartialForall c n l e) :
+    c.lctx.mkForall arr e = c.mkForall n hn e := by
+  have := congrArg (Array.mk ·.reverse) harr; simp at this
+  rw [LocalContext.mkForall, this, ← List.map_reverse, LocalContext.mkBinding_eq,
+    LocalContext.mkBindingList_eq_fold, List.foldr_reverse]
+  · clear harr this
+    induction hp with
+    | nil => simp
+    | vlam hp ih | vlet hp ih =>
+      simp
+      refine (List.foldl_congr fun _ y h => ?_).trans <|
+        .trans (congrFun (congrArg _ ?_) _) (ih wf.1 _)
+      · refine LocalContext.mkBindingList1_congr ?_
+        rw [wf.find?_eq, wf.1.find?_eq, decls, List.find?, (?_ : (y == _) = false)]
+        simp [LocalDecl.fvarId]; rintro ⟨⟩
+        have := (List.cons_sublist_cons.2 hp.sublist).nodup wf.fvars_nodup; simp_all
+      · simp [LocalContext.mkBindingList1, wf.find?_eq, decls, LocalDecl.fvarId]
+    | skip h1 h2 h3 hp ih =>
+      subst h2; simp [h3]
+      rw [Expr.lowerLooseBVars_eq_instantiate h3 (v := default),
+        Expr.abstract1_eq_liftLooseBVars h3, Expr.liftLooseBVars_eq_self (by simp [h1]),
+        Expr.instantiate1_eq_self h1]
+      refine (List.foldl_congr fun _ y h => ?_).trans (ih wf.1 _)
+      refine LocalContext.mkBindingList1_congr ?_
+      rw [wf.find?_eq, wf.1.find?_eq, decls, List.find?, (?_ : (y == _) = false)]
+      simp [LocalDecl.fvarId]; rintro ⟨⟩
+      have := (List.cons_sublist_cons.2 hp.sublist).nodup wf.fvars_nodup; simp_all
+  · intro _ h
+    exact wf.tr.find?_eq_some.2 (hp.sublist.subset (List.mem_reverse.1 h))
+  · exact List.nodup_reverse.2 (hp.sublist.nodup wf.fvars_nodup)
+
+theorem MLCtx.WF.mkForall_eq {c : MLCtx} (wf : c.WF env Us) (n hn)
+    (harr : arr.toList.reverse = (c.fvarRevList n hn).map .fvar) :
+    c.lctx.mkForall arr e = c.mkForall n hn e := mkForall_partial wf n hn harr .full
+
+theorem MLCtx.WF.mkLambda_eq {c : MLCtx} (wf : c.WF env Us) (n hn)
+    (harr : arr.toList.reverse = (c.fvarRevList n hn).map .fvar) :
+    c.lctx.mkLambda arr e = c.mkLambda n hn e := by
+  have := congrArg (Array.mk ·.reverse) harr; simp at this
+  rw [LocalContext.mkLambda, this, ← List.map_reverse, LocalContext.mkBinding_eq,
+    LocalContext.mkBindingList_eq_fold, List.foldr_reverse]
+  · clear harr this
+    induction n generalizing c e with
+    | zero => simp
+    | succ n ih =>
+      match c with
+      | .vlam .. | .vlet .. =>
+        simp
+        refine (List.foldl_congr fun _ y h => ?_).trans <|
+          .trans (congrFun (congrArg _ ?_) _) (ih wf.1 _)
+        · refine LocalContext.mkBindingList1_congr ?_
+          rw [wf.find?_eq, wf.1.find?_eq, decls, List.find?, (?_ : (y == _) = false)]
+          simp [LocalDecl.fvarId]; rintro ⟨⟩
+          have := wf.fvarRevList_nodup (n+1) hn; simp_all
+        · simp [LocalContext.mkBindingList1, wf.find?_eq, decls, LocalDecl.fvarId]
+  · intro _ h
+    exact wf.tr.find?_eq_some.2 ((MLCtx.fvarRevList_prefix ..).subset (List.mem_reverse.1 h))
+  · exact List.nodup_reverse.2 (wf.fvarRevList_nodup ..)
+
+namespace Inner
+
+/-- A successful host-environment lookup returns exactly the constant found
+at the requested name.  Kept in the common checker layer so both inference
+and WHNF reduction can consume the same lookup certificate. -/
+theorem envGet.WF {c : VContext} :
+    (c.env.get name).WF fun ci => c.env.find? name = some ci := by
+  simp [Environment.get]; split <;> [refine .pure ‹_›; exact .throw]
+
+theorem whnf.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (whnf e) fun e₁ _ => c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' :=
+  fun _ wf => wf.whnf he
+
+theorem isDefEqCore.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqCore e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' :=
+  fun _ wf => wf.isDefEqCore he₁ he₂
+
+theorem cacheSuccess.WF {c : VContext} {s : VState} (he₁ : c.TrExprS e₁ e') (he₂ : c.TrExpr e₂ e') :
+    RecM.WF c s (cacheSuccess e₁ e₂) fun _ _ => True := by
+  rintro _ mwf wf _ _ ⟨⟩
+  let ⟨_, _, a1, a2, ewf, a4⟩ := wf.ectx
+  refine ⟨{ s with toState := _ }, rfl, .rfl, { wf with ectx := ⟨_, _, a1, a2, ?_, a4⟩ }, trivial⟩
+  -- The insertion is keyed on the two hashes, so either order can be the one recorded.
+  have H : DefEqCache.IsDefEqE c.venv c.lparams _ e₁ e₂ :=
+    ⟨_, he₁.weakFV' c.Ewf a2 a1, he₂.weakFV' c.Ewf a2 a1⟩
+  simp only []; split <;> [exact ewf.insert H; exact ewf.insert H.symm]
+
+theorem isDefEq.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEq e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEq
+  split
+  · rename_i heq
+    exact .pure fun _ => (he₁.eqv heq).uniq c.Ewf (.refl c.Ewf c.Δwf) he₂
+  simp only []
+  refine (isDefEqCore.WF he₁ he₂).bind fun b _ _ hb => ?_
+  simp; split
+  · exact (cacheSuccess.WF he₁ ⟨_, he₂, (hb ‹_›).symm⟩).map fun _ _ _ _ => hb
+  · exact .pure hb
+
+theorem inferType.WF' {c : VContext} {s : VState} (h1 : e.FVarsIn (· ∈ c.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', c.TrExprS e e') :
+    RecM.WF c s (inferType e inferOnly) fun ty _ => ∃ e' ty', c.TrTyping e ty e' ty' :=
+  fun _ wf => wf.inferType h1 hinf
+
+theorem inferType.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (inferType e true) fun ty _ => ∃ ty', c.TrTyping e ty e' ty' := by
+  refine .stateWF fun wf => ?_
+  refine (inferType.WF' he.fvarsIn fun _ => ⟨_, he⟩).le
+    fun _ _ _ ⟨_, _, h1, h2, h3, h4⟩ => ⟨_, h1, he, h3, ?_⟩
+  have := h2.uniq c.Ewf (.refl c.Ewf c.Δwf) he
+  exact h4.defeqU_l c.Ewf c.Δwf this
+
+theorem inferType.WF_uniq {c : VContext} {s : VState}
+    (he : c.TrExprS e e') (hty : c.HasType e' ty') :
+    RecM.WF c s (inferType e true) fun ty _ => c.TrExpr ty ty' :=
+  (inferType.WF he).le fun _ _ _ ⟨_, _, _, h1, h2⟩ =>
+  ⟨_, h1, h2.uniqU c.Ewf c.Δwf hty⟩
+
+theorem checkType.WF {c : VContext} {s : VState} (h1 : e.FVarsIn (· ∈ c.vlctx.fvars)) :
+    RecM.WF c s (inferType e false) fun ty _ => ∃ e' ty', c.TrTyping e ty e' ty' :=
+  inferType.WF' h1 nofun
+
+theorem whnfCore.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (whnfCore e cheapProj) fun e₁ _ => c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' :=
+  fun _ wf => wf.whnfCore he
+
+theorem isDelta_is_some : isDelta env e = some ci ↔
+    ∃ n, env.find? n = some ci ∧ (∃ v, ci.deltaValue? = some v) ∧
+      ∃ ls, e.getAppFn = .const n ls ∧ ls.length = ci.numLevelParams := by
+  simp only [isDelta]
+  split <;> [split <;> [split; skip]; skip] <;>
+    simp_all [Option.isSome_iff_exists] <;> grind
+
+def UnfoldDefinition.WF (c : VContext) (e e₀ : Expr) (e' : VExpr) : Option Expr → Prop
+  | some e₁ => c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e'
+  | none => ∀ {{n ci v ls}}, c.env.find? n = some ci → ci.deltaValue? = some v →
+    e₀ = .const n ls → ls.length = ci.numLevelParams → False
+
+theorem unfoldDefinitionCore.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (unfoldDefinitionCore e) fun oe _ => UnfoldDefinition.WF c e e e' oe := by
+  dsimp [unfoldDefinitionCore]
+  split <;> [refine .getEnv ?_; (rename_i H; exact .pure fun _ _ _ _ _ _ h => nomatch H _ _ h)]
+  split; rotate_left
+  · rename_i H; refine .pure ?_; rintro _ _ _ _ h1 h2 ⟨⟩ hlen
+    cases H _ (isDelta_is_some.2 ⟨_, h1, ⟨_, h2⟩, _, rfl, hlen⟩)
+  rename_i n ls oci ci h1
+  obtain ⟨_, h3, ⟨_, h4⟩, _, ⟨⟩, hlen⟩ := isDelta_is_some.1 h1
+  have : UnfoldDefinition.WF c (.const n ls) (.const n ls) e'
+      (some (instantiateDeltaValue ci ls)) := by
+    let .const a1 a2 a3 := he
+    have ⟨rfl, b1, b2, b3⟩ := c.trenv.find?_uniq h3 a1
+    simp [instantiateDeltaValue, h4]
+    have c1 := c.trenv.of_value h3 b1 h4 |>.instL c.Ewf (by trivial) a2 (b2.trans a3.symm)
+    have := c1.weakFV c.Ewf (.from_nil c.mlctx.noBV) c.Δwf
+    rw [c1.wf.closedN c.Ewf trivial |>.liftN_eq (Nat.zero_le _)] at this
+    simp [VExpr.instL] at this; rw [VLevel.inst_map_id] at this
+    · exact ⟨fun _ _ _ => c1.fvarsIn.mono nofun, this⟩
+    · exact (List.mapM_eq_some.1 a2).length_eq.symm.trans <| a3.trans b2.symm
+  split <;> [rename_i h5; exact .pure this]
+  refine .pureBind <| .get ?_
+  split <;> [rename_i eq; skip]
+  · refine .stateWF fun wf => .pure ?_
+    obtain ⟨_, _, _, ⟨⟩, a1, rfl⟩ := wf.unfold_wf eq
+    cases h3.symm.trans a1; exact this
+  · refine .bind (Q := fun _ _ => True) ?_ fun _ _ _ _ => .pure this
+    rintro _ mwf wf _ _ ⟨⟩
+    refine ⟨{ s with toState := _ }, rfl, .rfl, { wf with unfold_wf := ?_ }, ⟨⟩⟩
+    intro e e'; simp only [Std.HashMap.getElem?_insert]
+    split <;> [rintro ⟨⟩; exact (wf.unfold_wf ·)]
+    rename_i eq; rw [BEq.comm, Expr.eqv_const] at eq
+    exact ⟨_, _, _, eq, h3, rfl⟩
+
+theorem unfoldDefinition.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (unfoldDefinition e) fun oe _ => UnfoldDefinition.WF c e e.getAppFn e' oe := by
+  simp [unfoldDefinition]; split; rotate_left
+  · rename_i h; refine (unfoldDefinitionCore.WF he).mono fun _ _ _ H => ?_
+    rwa [show e.getAppFn = e by revert h; unfold Expr.isApp Expr.getAppFn; split <;> simp]
+  have ⟨f', stk⟩ := AppStack.build (e.mkAppList_getAppArgsList ▸ he)
+  refine (unfoldDefinitionCore.WF stk.tr).bind fun oe _ _ H => ?_
+  cases oe <;> [exact .pure H; refine .pure ?_]
+  have ⟨h1, h2⟩ := H
+  rw [Expr.mkAppRevRange_eq (l₁ := []) (l₂ := e.getAppArgsRevList) (l₃ := [])
+    (by simp [Expr.getAppRevArgs_toList]) (by rfl) (by simp [Expr.getAppRevArgs_eq])]
+  simp only [Expr.getAppArgsRevList_reverse]; constructor
+  · exact (e.mkAppList_getAppArgsList ▸ h1.mkAppList :)
+  · exact h2.rebuild_mkAppList c.Ewf c.Δwf stk.tr (e.mkAppList_getAppArgsList ▸ he :)
+
+theorem ensureSortCore.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (ensureSortCore e e₀) fun e1 _ =>
+      (∃ u, e1 = .sort u) ∧ c.TrExpr e1 e' ∧ c.FVarsBelow e e1 := by
+  simp [ensureSortCore]; split
+  · let .sort _ := e
+    exact .pure ⟨⟨_, rfl⟩, he.trExpr c.Ewf c.Δwf, .rfl⟩
+  refine (whnf.WF he).bind fun e _ _ ⟨hb, he⟩ => ?_; split
+  · let .sort _ := e
+    exact .pure ⟨⟨_, rfl⟩, he, hb⟩
+  exact .getEnv <| .getLCtx .throw
+
+theorem getSortLevel.WF
+    (he : c.TrExprS e e') : (getSortLevel e).WF c s fun l _ =>
+      ∃ u', VLevel.ofLevel c.lparams l = some u' ∧ c.HasType e' (.sort u') := by
+  refine (inferType.WF he).bind fun ty _ le ⟨ty', _, _, h1, h2⟩ => ?_
+  refine (ensureSortCore.WF h1).bind fun ty _ le h => ?_
+  obtain ⟨⟨u, rfl⟩, ⟨ty₂, h3, h4⟩, _⟩ := h
+  let .sort hu := h3
+  exact .pure ⟨_, hu, h2.defeqU_r c.Ewf c.Δwf h4.symm⟩
+
+theorem isProp.WF
+    (he : c.TrExprS e e') : (isProp e).WF c s fun b _ =>
+      b → c.HasType e' (.sort .zero) := by
+  refine (getSortLevel.WF he).bind fun l _ le ⟨u', hu, h⟩ => .pure fun H => ?_
+  exact h.defeqU_r c.Ewf c.Δwf
+    ⟨_, .sortDF (.of_ofLevel hu) trivial (ofLevel_isAlwaysZero hu H)⟩
diff --git a/Ix/Theory/Named/Verify/TypeChecker/InferType.lean b/Ix/Theory/Named/Verify/TypeChecker/InferType.lean
new file mode 100644
index 000000000..a16d77f19
--- /dev/null
+++ b/Ix/Theory/Named/Verify/TypeChecker/InferType.lean
@@ -0,0 +1,1082 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Ix.Theory.Named.Verify.TypeChecker.Reduce
+
+open Ix.Theory (VLevel)
+
+open Ix.Theory.Named
+
+namespace Ix.Theory.Named.TypeChecker.Inner
+open Lean hiding Environment Exception
+open Kernel
+
+theorem ensureForallCore.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (ensureForallCore e e₀) fun e1 _ => c.FVarsBelow e e1 ∧
+      c.TrExpr e1 e' ∧ ∃ name ty body bi, e1 = .forallE name ty body bi := by
+  simp [ensureForallCore]; split
+  · let .forallE .. := e
+    exact .pure ⟨.rfl, he.trExpr c.Ewf c.Δwf, _, _, _, _, rfl⟩
+  refine (whnf.WF he).bind fun e _ _ ⟨hb, he⟩ => ?_; split
+  · let .forallE .. := e
+    exact .pure ⟨hb, he, _, _, _, _, rfl⟩
+  exact .getEnv <| .getLCtx .throw
+
+theorem ensureForallCore.WF' {c : VContext} {s : VState} (he : c.TrExpr e e') :
+    RecM.WF c s (ensureForallCore e e₀) fun e1 _ => c.FVarsBelow e e1 ∧
+      c.TrExpr e1 e' ∧ ∃ name ty body bi, e1 = .forallE name ty body bi :=
+  let ⟨_, he, eq⟩ := he
+  (ensureForallCore.WF he).mono fun _ _ _ ⟨h1, h2, h3⟩ =>
+    ⟨h1, h2.defeq c.Ewf c.Δwf eq, h3⟩
+
+theorem checkLevel.WF {c : VContext} (H : l.hasMVar' = false) :
+    (checkLevel c.toContext l).WF fun _ => ∃ u', VLevel.ofLevel c.lparams l = some u' := by
+  simp [checkLevel]; split <;> [exact .throw; refine .pure ?_]
+  exact Level.getUndefParam_none H (by rename_i h; simpa using h)
+
+theorem inferFVar.WF {c : VContext} :
+    (inferFVar c.toContext name).WF fun ty => ∃ e' ty', c.TrTyping (.fvar name) ty e' ty' := by
+  simp [inferFVar, ← c.lctx_eq]; split <;> [refine .pure ?_; exact .throw]
+  rename_i decl h
+  rw [c.trlctx.1.find?_eq_find?_toList] at h
+  have := List.find?_some h; simp at this; subst this
+  let ⟨e', ty', h1, _, h2, _, h3⟩ :=
+    c.trlctx.find?_of_mem c.Ewf (List.mem_of_find?_eq_some h)
+  exact ⟨_, _, h2, .fvar h1, h3, c.Δwf.find?_wf c.Ewf h1⟩
+
+theorem inferConstant.WF {c : VContext}
+    (H : ∀ l ∈ ls, l.hasMVar' = false)
+    (hinf : inferOnly = true → ∃ e', c.TrExprS (.const name ls) e') :
+    (inferConstant c.toContext name ls inferOnly).WF fun ty =>
+      ∃ e' ty', c.TrTyping (.const name ls) ty e' ty' := by
+  simp [inferConstant]; refine envGet.WF.bind fun ci eq1 => ?_
+  have : (ls.foldlM (fun b a => checkLevel c.toContext a) PUnit.unit).WF fun _ =>
+      ∃ ls', ls.Forall₂ (VLevel.ofLevel c.lparams · = some ·) ls' := by
+    clear hinf
+    induction ls with
+    | nil => exact .pure ⟨_, .nil⟩
+    | cons l ls ih =>
+      simp at H
+      refine (checkLevel.WF H.1).bind fun ⟨⟩ ⟨_, h1⟩ => ?_
+      exact (ih H.2).le fun _ ⟨_, h2⟩ => ⟨_, .cons h1 h2⟩
+  split <;> [rename_i h1; exact .throw]
+  have main {e'} (he : c.TrExprS (.const name ls) e') : ∃ e' ty',
+      c.TrTyping (.const name ls) (ci.instantiateTypeLevelParams ls) e' ty' := by
+    let .const h4 H' eq := id he
+    have ⟨_, _, h5, h6⟩ := c.trenv.find?_uniq eq1 h4
+    have H := List.mapM_eq_some.1 H'
+    have s0 := h6.instL c.Ewf (Δ := []) trivial H' (h5.trans eq.symm)
+    have s1 := s0.weakFV c.Ewf (.from_nil c.mlctx.noBV) c.Δwf
+    rw [(c.Ewf.ordered.closedC h4).instL.liftN_eq (Nat.le_refl _)] at s1
+    have ⟨_, s1, s2⟩ := s1
+    refine ⟨_, _, ?_, he, s1, .defeqU_r c.Ewf c.Δwf s2.symm ?_⟩
+    · intro _ _ _; exact s0.fvarsIn.mono nofun
+    · exact .const h4 (.of_mapM_ofLevel H') (H.length_eq.symm.trans eq)
+  split
+  · split <;> [exact .throw; rename_i h2]
+    generalize eq1 : _ <$> (_ : Except Exception _) = F
+    generalize eq2 : (fun ty : Expr => _) = P
+    suffices ci.isPartial = false ∨ c.safety ≠ .safe → F.WF P by
+      split <;> [skip; exact this (.inl (ConstantInfo.isPartial.eq_2 _ ‹_›))]
+      split <;> [exact .throw; apply this]
+      rename_i h; simpa [Decidable.or_iff_not_imp_left, ConstantInfo.isPartial] using h
+    subst eq1 eq2; intro h3
+    refine this.map fun _ ⟨_, H⟩ => ?_
+    have ⟨_, h4, _, h5, h6⟩ := c.trenv.find? eq1 <| by
+      revert h2 h3
+      simp [ConstantInfo.safety]
+      split <;> simp +contextual [*]
+      split <;> simp [DefinitionSafety.le_safe, *]
+      cases c.safety <;> decide
+    have eq := h1.symm.trans h5
+    exact main (.const h4 (List.mapM_eq_some.2 H) eq)
+  · simp_all; let ⟨_, h⟩ := hinf; refine .pure (main h)
+
+theorem inferLambda.loop.WF {c : VContext} {e₀ : Expr}
+    {m} [mwf : c.MLCWF m] {n} (hn : n ≤ m.length)
+    (hdrop : m.dropN n hn = c.mlctx)
+    (harr : arr.toList.reverse = (m.fvarRevList n hn).map .fvar)
+    (he₀ : e₀ = m.mkLambda n hn ei)
+    (hei : e.instantiateList ((m.fvarRevList n hn).map .fvar) = ei)
+    (hbelow : ∀ P, IsFVarUpSet P c.vlctx → FVarsIn P e₀ →
+      IsFVarUpSet (AllAbove c.vlctx P) m.vlctx ∧ FVarsIn (AllAbove c.vlctx P) ei ∧
+      ∀ ty, FVarsIn (AllAbove c.vlctx P) ty → FVarsIn (AllAbove c.vlctx P) (m.mkForall n hn ty))
+    (hr : e.FVarsIn (· ∈ m.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', (c.withMLC m).TrExprS ei e') :
+    (inferLambda.loop inferOnly arr e).WF (c.withMLC m) s fun ty _ =>
+      ∃ e' ty', c.TrTyping e₀ ty e' ty' := by
+  unfold inferLambda.loop
+  generalize eqfvs : (m.fvarRevList n hn).map Expr.fvar = fvs at *
+  simp [harr, -bind_pure_comp]; split
+  · rename_i name dom body bi
+    generalize eqF : withLocalDecl (m := RecM) _ _ _ _ = F
+    generalize eqP : (fun ty x => ∃ _, _) = P
+    rw [Expr.instantiateList_lam] at hei; subst ei
+    have main {s₁} (le₁ : s ≤ s₁) {dom'}
+        (domty : (c.withMLC m).venv.IsType
+          (c.withMLC m).lparams.length (c.withMLC m).vlctx.toCtx dom')
+        (hdom : (c.withMLC m).TrExprS (dom.instantiateList fvs) dom')
+        (hbody : inferOnly = true → ∃ body',
+          TrExprS c.venv c.lparams ((none, .vlam dom') :: m.vlctx)
+            (body.instantiateList fvs 1) body') :
+        F.WF (c.withMLC m) s₁ P := by
+      refine .stateWF fun wf => ?_
+      have hdom' := hdom.trExpr c.Ewf mwf.1.tr.wf
+      subst eqF eqP
+      refine .withLocalDecl hdom domty le₁ fun a mwf' s' le₂ res => ?_
+      have eq := @Expr.instantiateList_instantiate1_comm body fvs (.fvar a) (by trivial)
+      refine inferLambda.loop.WF (Nat.succ_le_succ hn) (by simp [hdrop])
+        (by simp [← eqfvs, harr]) ?_ (by simp; rfl) ?_ (hr.2.mono fun _ => .tail _) ?_
+      · rw [he₀, eqfvs, ← eq]; simp; congr 2
+        refine (FVarsIn.abstract_instantiate1 ((hr.2.instantiateList ?_ _).mono ?_)).symm
+        · simp [← eqfvs, FVarsIn]; exact m.fvarRevList_prefix.subset
+        · rintro _ h rfl; exact (mwf'.1.tr.wf.2.1 _ _ rfl).1 h
+      · intro P hP he
+        have ⟨h1, h2, h3⟩ := hbelow _ hP he
+        refine ⟨⟨h1, fun _ => (fvarsIn_iff.1 h2.1).1⟩, ?_, fun ty hty => h3 _ ⟨h2.1, hty.abstract1⟩⟩
+        rw [eqfvs, ← eq]
+        refine h2.2.instantiate1 fun h => ?_
+        exact res.elim (wf.ngen_wf _ (m.dropN_fvars_subset n hn (hdrop ▸ h)))
+      · intro h; let ⟨_, hbody⟩ := hbody h
+        exact eqfvs.symm ▸ eq ▸ ⟨_, hbody.inst_fvar c.Ewf.ordered mwf'.1.tr.wf⟩
+    split
+    · subst inferOnly
+      refine (checkType.WF ?_).bind fun uv _ le ⟨dom', uv', _, h1, h2, h3⟩ => ?_
+      · apply hr.1.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+      refine (ensureSortCore.WF h2).bind_le le fun _ _ le ⟨h4, h5, _⟩ => ?_
+      obtain ⟨_, rfl⟩ := h4; let ⟨_, .sort _, h5⟩ := h5
+      have domty := h3.defeqU_r c.Ewf mwf.1.tr.wf.toCtx h5.symm
+      have domty' : (c.withMLC m).IsType dom' := ⟨_, domty⟩
+      exact main le domty' h1 nofun
+    · simp_all; let ⟨_, h1⟩ := hinf
+      have .lam (ty' := dom') (body' := body') domty hdom hbody := h1
+      exact main .rfl domty hdom _ hbody
+  · subst ei
+    refine (inferType.WF' ?_ hinf).bind fun ty _ _ ⟨e', ty', hb, h1, h2, h3⟩ => ?_
+    · apply hr.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+    refine .stateWF fun wf => .getLCtx <| .pure ?_
+    have ⟨_, h2', e2⟩ := h2.trExpr c.Ewf.ordered wf.trctx.wf
+      |>.cheapBetaReduce c.Ewf wf.trctx.wf m.noBV
+    have h3 := h3.defeqU_r c.Ewf mwf.1.tr.wf.toCtx e2.symm
+    let ⟨h1', h2''⟩ := mwf.1.mkLambda_trS c.Ewf h1 h3 n hn
+    have h3' := (mwf.1.mkForall_trS c.Ewf h2' (h3.isType c.Ewf mwf.1.tr.wf.toCtx) n hn).1
+    simp [hdrop] at h1' h2'' h3'
+    refine mwf.1.mkForall_eq _ _ (eqfvs ▸ harr) ▸
+      ⟨_, _, fun P hP he => ?_, he₀ ▸ h1', h3', h2''⟩
+    have ⟨c1, c2, c3⟩ := hbelow _ hP he
+    have := c3 _ <| FVarsBelow.cheapBetaReduce (m.noBV ▸ h2.closed) _ c1 <| hb _ c1 c2
+    exact this.mp (fun _ => id) h3'.fvarsIn
+
+theorem inferLambda.WF
+    (h1 : e.FVarsIn (· ∈ c.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', c.TrExprS e e') :
+    (inferLambda e inferOnly).WF c s fun ty _ => ∃ e' ty', c.TrTyping e ty e' ty' := by
+  refine .stateWF fun wf => ?_
+  refine (c.withMLC_self ▸ inferLambda.loop.WF (Nat.zero_le _) rfl rfl rfl rfl ?_ h1) hinf
+  exact fun P hP he => ⟨(AllAbove.wf wf.trctx.wf.fvwf).2 hP, he.mono fun _ h _ => h, fun _ => id⟩
+
+theorem inferForall.loop.WF {c : VContext} {e₀ : Expr}
+    {m} [mwf : c.MLCWF m] {n} (hn : n ≤ m.length)
+    (hdrop : m.dropN n hn = c.mlctx)
+    (harr : arr.toList.reverse = (m.fvarRevList n hn).map .fvar)
+    (he₀ : e₀ = m.mkForall n hn ei)
+    (hei : e.instantiateList ((m.fvarRevList n hn).map .fvar) = ei)
+    (hr : e.FVarsIn (· ∈ m.vlctx.fvars))
+    (hus : us.toList.reverse.Forall₂ (VLevel.ofLevel c.lparams · = some ·) us')
+    (hΔ : m.vlctx.SortList c.venv c.lparams.length us')
+    (hlen : us'.length = n)
+    (hinf : inferOnly = true → ∃ e', (c.withMLC m).TrExprS ei e') :
+    (inferForall.loop inferOnly arr us e).WF (c.withMLC m) s fun ty _ =>
+      ∃ e' u, c.TrTyping e₀ ty e' (.sort u) := by
+  unfold inferForall.loop
+  generalize eqfvs : (m.fvarRevList n hn).map Expr.fvar = fvs at *
+  simp [harr, -bind_pure_comp]; split
+  · rename_i name dom body bi
+    rw [Expr.instantiateList_forallE] at hei; subst ei
+    refine (inferType.WF' ?_ ?_).bind fun uv _ le ⟨dom', uv', _, h1, h2, h3⟩ => ?_
+    · apply hr.1.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+    · intro h; let ⟨_, .forallE _ _ h _⟩ := hinf h; exact ⟨_, h⟩
+    refine (ensureSortCore.WF h2).bind_le le fun _ _ le ⟨h4, h5, _⟩ => ?_
+    obtain ⟨_, rfl⟩ := h4; let ⟨_, .sort h4, h5⟩ := h5
+    refine .stateWF fun wf => ?_
+    have domty := h3.defeqU_r c.Ewf mwf.1.tr.wf.toCtx h5.symm
+    have domty' : (c.withMLC m).IsType dom' := ⟨_, domty⟩
+    refine .withLocalDecl h1 domty' le fun a mwf' s' le₂ res => ?_
+    have eq := @Expr.instantiateList_instantiate1_comm body fvs (.fvar a) (by trivial)
+    refine inferForall.loop.WF (Nat.succ_le_succ hn) (by simp [hdrop])
+      (by simp [eqfvs, harr]) ?_ (by simp [eqfvs]; rfl) (hr.2.mono fun _ => .tail _)
+      (by simpa using ⟨h4, hus⟩) (.cons hΔ domty) (by simp [hlen]) ?_
+    · simp [he₀, ← eq]; congr 2
+      refine (FVarsIn.abstract_instantiate1 ((hr.2.instantiateList ?_ _).mono ?_)).symm
+      · simp [← eqfvs, FVarsIn]; exact m.fvarRevList_prefix.subset
+      · rintro _ h rfl; exact (mwf'.1.tr.wf.2.1 _ _ rfl).1 h
+    · intro h; let ⟨_, .forallE (body' := body') _ _ hdom₁ hbody₁⟩ := hinf h
+      refine have hΔ := .refl c.Ewf mwf.1.tr.wf; have H := hdom₁.uniq c.Ewf hΔ h1; ?_
+      have H := H.of_r c.Ewf mwf.1.tr.wf.toCtx domty
+      have ⟨_, hbody₂⟩ := hbody₁.defeqDFC c.Ewf <| .cons hΔ (ofv := none) nofun (.vlam H)
+      exact eq ▸ ⟨_, hbody₂.inst_fvar c.Ewf.ordered mwf'.1.tr.wf⟩
+  · subst ei; refine (inferType.WF' ?_ hinf).bind fun ty _ _ ⟨e', ty', _, h1, h2, h3⟩ => ?_
+    · apply hr.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+    refine (ensureSortCore.WF h2).bind fun _ _ le₂ ⟨h4, h5, _⟩ => ?_
+    obtain ⟨_, rfl⟩ := h4; let ⟨_, .sort (u' := u') h4, h5⟩ := h5
+    obtain ⟨us, rfl⟩ : ∃ l, ⟨List.reverse l⟩ = us := ⟨us.toList.reverse, by simp⟩
+    simp [Expr.sortLevel!] at hus ⊢
+    have h3 := h3.defeqU_r c.Ewf mwf.1.tr.wf.toCtx h5.symm
+    let ⟨h1', h2'⟩ := mwf.1.mkForall_trS c.Ewf h1 ⟨_, h3⟩ n hn
+    have ⟨_, h3', h4'⟩ := mkForall_hasType hus hΔ h4 h3 n hn (hus.length_eq.trans hlen)
+    simp [hdrop] at h1' h2' h4'
+    refine have h := .sort h3'; .pure ⟨_, _, fun _ _ _ => h.fvarsIn, he₀ ▸ h1', h, h4'⟩
+
+theorem inferForall.WF
+    (hr : e.FVarsIn (· ∈ c.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', c.TrExprS e e') :
+    (inferForall e inferOnly).WF c s fun ty _ => ∃ e' u, c.TrTyping e ty e' (.sort u) :=
+  (c.withMLC_self ▸ inferForall.loop.WF (Nat.zero_le _) rfl rfl rfl rfl hr .nil .nil rfl) hinf
+
+theorem inferApp.loop.WF {c : VContext} {s : VState}
+    {ll lm lr : List _}
+    (stk : AppStack c.venv c.lparams c.vlctx (.mkAppRevList e lm) e' lr)
+    (hbelow : FVarsBelow c.vlctx e fType)
+    (hfty : c.TrExpr (fType.instantiateList lm) fty') (hety : c.HasType e' fty')
+    (hargs : args = ll ++ lm.reverse ++ lr)
+    (hj : j = ll.length) (hi : i = ll.length + lm.length) :
+    RecM.WF c s (inferApp.loop e₀ ⟨args⟩ fType j i) fun ty _ =>
+      ∃ e₁' ty', c.TrTyping (e.mkAppRevList lm |>.mkAppList lr) ty e₁' ty' := by
+  subst i j; rw [inferApp.loop.eq_def]
+  simp [hargs, Expr.instantiateList_reverse]
+  have henv := c.Ewf; have hΔ := c.Δwf
+  cases lr with simp
+  | cons a lr =>
+    let .app hf' ha' hf ha stk := stk
+    have uf := hf'.uniqU henv hΔ hety
+    split
+    · rw [Expr.instantiateList_forallE] at hfty
+      let ⟨_, .forallE _ _ hty hbody, h3⟩ := hfty
+      have ⟨⟨_, uA⟩, _, uB⟩ := h3.trans henv hΔ uf.symm |>.forallE_inv henv hΔ
+      refine inferApp.loop.WF (lm := a::lm) stk ?_ ?_ (.app hf' ha') (by simp) rfl rfl
+      · exact fun _ hP he => (hbelow _ hP he).2
+      have ha0 := c.mlctx.noBV ▸ ha.closed
+      simp [← Expr.instantiateList_instantiate1_comm ha0.looseBVarRange_zero]
+      exact .inst henv hΔ (ha'.defeqU_r henv hΔ ⟨_, uA.symm⟩) ⟨_, hbody, _, uB⟩ (ha.trExpr henv hΔ)
+    · simp [Nat.add_sub_cancel_left, Expr.instantiateRevList_reverse]
+      refine (ensureForallCore.WF' hfty).bind fun _ _ _ ⟨hb, ⟨_, h2, h3⟩, eq⟩ => ?_
+      obtain ⟨name, ty, body, bi, rfl⟩ := eq; simp [Expr.bindingBody!]
+      let .forallE _ _ hty hbody := h2
+      have ⟨⟨_, uA⟩, _, uB⟩ := h3.trans henv hΔ uf.symm |>.forallE_inv henv hΔ
+      refine inferApp.loop.WF (ll := ll ++ lm.reverse) (lm := [a]) stk ?_ ?_
+        (.app hf' ha') (by simp) (by simp) (by simp)
+      · intro _ hP he
+        have ⟨he, hlm⟩ := FVarsIn.appRevList.1 he
+        exact (hb _ hP <| (hbelow _ hP he).instantiateList hlm).2
+      exact .inst henv hΔ (ha'.defeqU_r henv hΔ ⟨_, uA.symm⟩) ⟨_, hbody, _, uB⟩ (ha.trExpr henv hΔ)
+  | nil =>
+    rw [← List.length_reverse, List.take_length, Expr.instantiateRevList_reverse]
+    have ⟨_, hfty, h2⟩ := hfty
+    refine .pure ⟨_, _, fun _ hP he => ?_, stk.tr, hfty, hety.defeqU_r henv hΔ h2.symm⟩
+    have ⟨he, hlm⟩ := FVarsIn.appRevList.1 he
+    exact (hbelow _ hP he).instantiateList hlm
+
+theorem inferApp.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (inferApp e) fun ty _ => ∃ ty', c.TrTyping e ty e' ty' := by
+  rw [inferApp, Expr.withApp_eq, Expr.getAppArgs_eq]
+  have ⟨_, he'⟩ := AppStack.build <| e.mkAppList_getAppArgsList ▸ he
+  refine (inferType.WF he'.tr).bind fun ty _ _ ⟨ty', hb, _, hty', ety⟩ => ?_
+  have henv := c.Ewf; have hΔ := c.Δwf
+  refine (inferApp.loop.WF (ll := []) (lm := []) he' hb
+      (hty'.trExpr henv hΔ) ety rfl rfl rfl).le
+    fun _ _ _ ⟨_, _, hb, h1, h2, h3⟩ => ?_
+  have := (e.mkAppList_getAppArgsList ▸ h1).uniq henv (.refl henv hΔ) he
+  exact ⟨_, e.mkAppList_getAppArgsList ▸ hb, he, h2, h3.defeqU_l henv hΔ this⟩
+
+theorem inferLet.loop.WF {c : VContext} {e₀ : Expr}
+    {m} [mwf : c.MLCWF m] {n} (hn : n ≤ m.length) (nds hnds)
+    (hdrop : m.dropN n hn = c.mlctx)
+    (harr : arr.toList.reverse = (m.fvarRevList n hn).map .fvar)
+    (he₀ : e₀ = m.mkLet n hn nds hnds ei)
+    (hei : e.instantiateList ((m.fvarRevList n hn).map .fvar) = ei)
+    (hbelow : ∀ P, IsFVarUpSet P c.vlctx → FVarsIn P e₀ →
+      IsFVarUpSet (AllAbove c.vlctx P) m.vlctx ∧ FVarsIn (AllAbove c.vlctx P) ei ∧
+      ∀ ty, FVarsIn (AllAbove c.vlctx P) ty → FVarsIn (AllAbove c.vlctx P) (m.mkForall n hn ty))
+    (hr : e.FVarsIn (· ∈ m.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', (c.withMLC m).TrExprS ei e') :
+    (inferLet.loop inferOnly arr e).WF (c.withMLC m) s fun ty _ =>
+      ∃ e' ty', c.TrTyping e₀ ty e' ty' := by
+  generalize eqfvs : (m.fvarRevList n hn).map Expr.fvar = fvs at *
+  unfold inferLet.loop
+  simp [harr, -bind_pure_comp]; split
+  · rename_i name dom val body nd
+    generalize eqF : withLetDecl (m := RecM) _ _ _ _ = F
+    generalize eqP : (fun ty x => ∃ _, _) = P
+    rw [Expr.instantiateList_letE] at hei; subst ei
+    have main {s₁} (le₁ : s ≤ s₁) {dom' val'}
+        (hdom : (c.withMLC m).TrExprS (dom.instantiateList fvs) dom')
+        (hval : (c.withMLC m).TrExprS (val.instantiateList fvs) val')
+        (valty : (c.withMLC m).venv.HasType
+          (c.withMLC m).lparams.length (c.withMLC m).vlctx.toCtx val' dom')
+        (hbody : inferOnly = true → ∃ body',
+          TrExprS c.venv c.lparams ((none, .vlet dom' val') :: m.vlctx)
+            (body.instantiateList fvs 1) body') :
+        F.WF (c.withMLC m) s₁ P := by
+      refine .stateWF fun wf => ?_
+      have hdom' := hdom.trExpr c.Ewf mwf.1.tr.wf
+      subst eqF eqP
+      refine .withLetDecl hdom hval valty le₁ fun a mwf' s' le₂ res => ?_
+      have eq := @Expr.instantiateList_instantiate1_comm body fvs (.fvar a) (by trivial)
+      refine inferLet.loop.WF (Nat.succ_le_succ hn) (some nd :: nds)
+        (by simp [hnds]) (by simp [hdrop]) (by simp [← eqfvs, harr])
+        ?_ (by simp; rfl) ?_ (hr.2.2.mono fun _ => .tail _) ?_
+      · rw [he₀, eqfvs, ← eq]; simp [MLCtx.mkLetArg]; congr 2
+        refine (FVarsIn.abstract_instantiate1 ((hr.2.2.instantiateList ?_ _).mono ?_)).symm
+        · simp [← eqfvs, FVarsIn]; exact m.fvarRevList_prefix.subset
+        · rintro _ h rfl; exact (mwf'.1.tr.wf.2.1 _ _ rfl).1 h
+      · intro P hP he
+        have ⟨h1, h2, h3⟩ := hbelow _ hP he
+        refine ⟨⟨h1, fun _ => ?_⟩, ?_, fun ty hty => h3 _ ?_⟩
+        · simp [or_imp, forall_and]
+          exact ⟨(fvarsIn_iff.1 h2.1).1, (fvarsIn_iff.1 h2.2.1).1⟩
+        · rw [eqfvs, ← eq]
+          refine h2.2.2.instantiate1 fun h => ?_
+          exact res.elim (wf.ngen_wf _ (m.dropN_fvars_subset n hn (hdrop ▸ h)))
+        · simp; split <;> rename_i h
+          · exact ⟨h2.1, h2.2.1, hty.abstract1⟩
+          · rw [Expr.lowerLooseBVars_eq_instantiate (v := .sort .zero) (by simpa using h)]
+            exact hty.abstract1.instantiate1 rfl
+      · intro h; let ⟨_, hbody⟩ := hbody h
+        exact eqfvs.symm ▸ eq ▸ ⟨_, hbody.inst_fvar c.Ewf.ordered mwf'.1.tr.wf⟩
+    split
+    · subst inferOnly
+      refine (checkType.WF ?_).bind fun uv _ le ⟨dom', uv', _, h1, h2, h3⟩ => ?_
+      · apply hr.1.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+      refine (ensureSortCore.WF h2).bind
+        fun _ _ le₂ ⟨h4, h5, _⟩ => ?_
+      obtain ⟨_, rfl⟩ := h4; let ⟨_, .sort _, h5⟩ := h5; have le := le.trans le₂
+      refine (checkType.WF ?_).bind_le le fun ty _ le ⟨val', ty', _, h4, h5, h6⟩ => ?_
+      · apply hr.2.1.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+      refine (isDefEq.WF h5 h1).bind_le le fun b _ le h7 => ?_
+      cases b <;> simp
+      · exact .getEnv <| .getLCtx .throw
+      have valty := h6.defeqU_r c.Ewf mwf.1.tr.wf.toCtx (h7 rfl)
+      exact main le h1 h4 valty nofun
+    · simp_all; let ⟨_, h1⟩ := hinf
+      have .letE (ty' := dom') (body' := body') valty hdom hval hbody := h1
+      exact main .rfl hdom hval valty _ hbody
+  · subst ei; refine (inferType.WF' ?_ hinf).bind fun ty _ _ ⟨e', ty', hb, h1, h2, h3⟩ => ?_
+    · apply hr.instantiateList; simp [← eqfvs]; exact m.fvarRevList_prefix.subset
+    refine .stateWF fun wf => .getLCtx <| .pure ?_
+    have ⟨_, hty, e2⟩ := h2.trExpr c.Ewf.ordered wf.trctx.wf
+      |>.cheapBetaReduce c.Ewf wf.trctx.wf m.noBV
+    have h3 := h3.defeqU_r c.Ewf mwf.1.tr.wf.toCtx e2.symm
+    let ⟨h1', h2'⟩ := mwf.1.mkLet_trS c.Ewf h1 h3 n hn nds hnds
+    have h3' := (mwf.1.mkForall_trS c.Ewf hty (h3.isType c.Ewf mwf.1.tr.wf.toCtx) n hn).1
+    simp [hdrop] at h1' h2' h3'
+    erw [mwf.1.mkForall_eq _ _ (eqfvs ▸ harr)]
+    refine ⟨_, _, fun P hP he => ?_, he₀ ▸ h1', h3', h2'⟩
+    have ⟨c1, c2, c3⟩ := hbelow _ hP he
+    have := c3 _ <| FVarsBelow.cheapBetaReduce (m.noBV ▸ h2.closed) _ c1 <| hb _ c1 c2
+    refine this.mp (fun _ => id) h3'.fvarsIn
+termination_by e
+
+theorem inferLet.WF
+    (hr : e.FVarsIn (· ∈ c.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', c.TrExprS e e') :
+    (inferLet e inferOnly).WF c s fun ty _ =>
+      ∃ e' ty', c.TrTyping e ty e' ty' := by
+  refine .stateWF fun wf => ?_
+  refine (c.withMLC_self ▸ inferLet.loop.WF (Nat.zero_le _) [] rfl rfl rfl rfl rfl ?_ hr) hinf
+  exact fun P hP he => ⟨(AllAbove.wf wf.trctx.wf.fvwf).2 hP, he.mono fun _ h _ => h, fun _ => id⟩
+
+theorem AppStack.toSpineWF {c : VContext}
+    (H : AppStack c.venv c.lparams c.vlctx f f' args)
+    (hf : c.HasType f' (VExpr.forallN As C))
+    (hlen : args.length = As.length) :
+    ∃ args', args.Forall₂ (c.TrExprS · ·) args' ∧
+      c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+        (VExpr.forallN As C) args' (VExpr.instRev C args') ∧
+      c.TrExprS (f.mkAppList args) (VExpr.appN f' args') := by
+  induction args generalizing f f' As C with
+  | nil =>
+      cases As with
+      | nil =>
+          let .head hfull := H
+          exact ⟨[], .nil, .nil, by simpa⟩
+      | cons _ _ => simp at hlen
+  | cons arg args ih =>
+      cases As with
+      | nil => simp at hlen
+      | cons A As =>
+        let .app hfun harg hf' harg' Hrest := H
+        have htypes := hf.uniqU c.Ewf c.Δwf hfun
+        have ⟨⟨_, hA⟩, _⟩ := htypes.forallE_inv c.Ewf c.Δwf
+        have hargA := harg.defeqU_r c.Ewf c.Δwf ⟨_, hA.symm⟩
+        have hlen' : args.length = As.length := by simpa using hlen
+        have htailType : c.HasType (.app f' _) ((VExpr.forallN As C).inst _) :=
+          hf.app hargA
+        rw [VExpr.instN_forallN] at htailType
+        obtain ⟨args', hargs', hspine, hfull⟩ :=
+          ih Hrest htailType (by simpa [VExpr.instTelN_length] using hlen')
+        refine ⟨_ :: args', .cons harg' hargs', .cons hargA ?_, ?_⟩
+        have hlenArgsAs : args'.length = As.length :=
+          hargs'.length_eq.symm.trans hlen'
+        rw [VExpr.instN_forallN]
+        simpa [VExpr.instRev, hlenArgsAs] using hspine
+        simpa [Expr.mkAppList, VExpr.appN] using hfull
+
+theorem invalidProj.WF {c : VContext} {s : VState} :
+    (invalidProj e : RecM α).WF c s Q := by
+  unfold invalidProj
+  exact .getEnv <| .getLCtx .throw
+
+theorem inferProjParams.WF {c : VContext} {s : VState}
+    (hargs : args.Forall₂ (c.TrExprS · ·) args')
+    (hrBelow : c.FVarsBelow proj r)
+    (hargsBelow : ∀ arg ∈ args, c.FVarsBelow proj arg)
+    (hr : c.TrExpr r R)
+    (hspine : c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+      R args' T) :
+    (inferProjParams proj args r).WF c s fun out _ =>
+      c.FVarsBelow proj out ∧ c.TrExpr out T := by
+  induction hargs generalizing r R s with
+  | nil =>
+      simp [inferProjParams] at hspine ⊢
+      exact hspine.nil_inv ▸ .pure ⟨hrBelow, hr⟩
+  | @cons arg arg' args args' harg hargs ih =>
+      simp only [inferProjParams]
+      have hargBelow := hargsBelow arg (by simp)
+      have hargsBelow' : ∀ arg ∈ args, c.FVarsBelow proj arg := by
+        intro arg harg
+        exact hargsBelow arg (by simp [harg])
+      obtain ⟨A, B, rfl, hargType, hrest⟩ := hspine.cons_inv
+      obtain ⟨r', hrS, hrEq⟩ := hr
+      refine (whnf.WF hrS).bind fun out s' _
+        ⟨houtBelow, ⟨out', hout, houtEq⟩⟩ => ?_
+      have houtEq := houtEq.trans c.Ewf c.Δwf hrEq
+      cases out with
+      | forallE name dom body bi =>
+        let .forallE hdomTy hbodyTy hdom hbody := hout
+        have hforallEq := houtEq.forallE_inv c.Ewf c.Δwf
+        obtain ⟨⟨_, hdomEq⟩, _, hbodyEq⟩ := hforallEq
+        have hargType' := hargType.defeqU_r c.Ewf c.Δwf
+          ⟨_, hdomEq.symm⟩
+        have hnext : c.TrExpr (body.instantiate1 arg) (B.inst arg') := by
+          simpa only [Expr.instantiate1_eq] using
+            (.inst c.Ewf c.Δwf hargType'
+              ⟨_, hbody, _, hbodyEq⟩ (harg.trExpr c.Ewf c.Δwf))
+        have hnextBelow : c.FVarsBelow proj (body.instantiate1 arg) := by
+          intro P hP hproj
+          have houtFVars := (hrBelow.trans houtBelow) P hP hproj
+          simpa only [Expr.instantiate1_eq] using
+            houtFVars.2.instantiate1 (hargBelow P hP hproj)
+        exact ih hnextBelow hargsBelow' hnext hrest
+      | bvar | fvar | mvar | sort | const | app | lam | letE | lit |
+          mdata | proj => exact invalidProj.WF
+
+theorem inferProjFields.WF {c : VContext} {s : VState}
+    {view : VStructureView} {levels : List VLevel}
+    {params : List VExpr} {major : VExpr} {tailResult cursor : VExpr}
+    (hstruct : c.TrExprS struct major)
+    (hview : view.WF c.venv)
+    (hlevels : ∀ level ∈ levels, level.WF c.lparams.length)
+    (hlevelsLength : levels.length = view.uvars)
+    (hparamsLength : params.length = view.nparams)
+    (hparamsSpine : ∃ resultLevel,
+      c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+        (view.familyType.instL levels) params (.sort resultLevel))
+    (hprograms : view.ProgramsWF c.venv)
+    (hname : view.name = typeName)
+    (hmajor : c.HasType major (view.structureType levels params))
+    (hrBelow : c.FVarsBelow proj r)
+    (hstructBelow : c.FVarsBelow proj struct)
+    (hbound : fieldIdx + count <
+      (view.specializedFields levels params).length)
+    (hr : c.TrExpr r cursor)
+    (hcursor : VExpr.consumeForalls?
+      (VExpr.forallN (view.specializedFields levels params) tailResult)
+      (view.projectionArgs levels params fieldIdx major) = some cursor) :
+    (inferProjFields proj typeName struct maybePropType fieldIdx count r).WF
+      c s fun out _ =>
+        ∃ cursor',
+          VExpr.consumeForalls?
+            (VExpr.forallN (view.specializedFields levels params) tailResult)
+            (view.projectionArgs levels params (fieldIdx + count) major) =
+              some cursor' ∧
+          c.FVarsBelow proj out ∧ c.TrExpr out cursor' := by
+  induction count generalizing s r cursor fieldIdx with
+  | zero =>
+      simp only [inferProjFields, Nat.add_zero]
+      exact .pure ⟨cursor, hcursor, hrBelow, hr⟩
+  | succ count ih =>
+      simp only [inferProjFields]
+      have hfieldIdx : fieldIdx <
+          (view.specializedFields levels params).length := by omega
+      have hcodeIdx : fieldIdx <
+          (view.projectionCodes levels params).length := by
+        simpa using hfieldIdx
+      let code := (view.projectionCodes levels params)[fieldIdx]
+      have hcode :
+          (view.projectionCodes levels params)[fieldIdx]? = some code :=
+        List.getElem?_eq_getElem hcodeIdx
+      have hargsLength :
+          (view.projectionArgs levels params fieldIdx major).length =
+            fieldIdx :=
+        view.projectionArgs_length levels params fieldIdx major
+          (Nat.le_of_lt hcodeIdx)
+      obtain ⟨field, semanticBody, hfield, hconsume⟩ :=
+        VExpr.consumeForalls?_forallN_domain
+          (view.specializedFields levels params) tailResult
+          (view.projectionArgs levels params fieldIdx major)
+          (by simpa [hargsLength] using hfieldIdx)
+      rw [hargsLength] at hfield
+      have hcursorShape : cursor =
+          .forallE
+            (field.instRevAt
+              (view.projectionArgs levels params fieldIdx major) 0)
+            semanticBody :=
+        Option.some.inj (hcursor.symm.trans hconsume)
+      subst cursor
+      obtain ⟨field', typeBody, hfield', htypeFn,
+          hprojectorField⟩ :=
+        hprograms.projector_hasType_field c.Ewf c.Δwf hlevels
+          hlevelsLength hparamsLength hparamsSpine hcode hmajor
+      have hfieldEq : field' = field :=
+        Option.some.inj (hfield'.symm.trans hfield)
+      subst field'
+      have hprojector := hprograms c.Δwf hlevels hlevelsLength
+        hparamsLength hparamsSpine hcode
+      have hprojSem : c.venv.TrProj c.lparams.length c.vlctx.toCtx
+          view levels params fieldIdx major (.app code.projector major) := {
+        viewWF := hview
+        levelsWF := hlevels
+        levels_length := hlevelsLength
+        params_length := hparamsLength
+        paramsSpine := hparamsSpine
+        majorType := hmajor
+        program := ⟨code, hcode, rfl, hprojector⟩ }
+      have hprojStrict : c.TrExprS (.proj typeName fieldIdx struct)
+          (.app code.projector major) :=
+        .proj hstruct ⟨view, levels, params, hname, hprojSem⟩
+      obtain ⟨r', hrS, hrEq⟩ := hr
+      refine (whnf.WF hrS).bind fun out nextState _
+        ⟨houtBelow, ⟨out', hout, houtEq⟩⟩ => ?_
+      have houtEq := houtEq.trans c.Ewf c.Δwf hrEq
+      cases out with
+      | forallE name dom body bi =>
+        let .forallE hdomTy hbodyTy hdom hbody := hout
+        have hforallEq := houtEq.forallE_inv c.Ewf c.Δwf
+        obtain ⟨⟨_, hdomEq⟩, _, hbodyEq⟩ := hforallEq
+        have hprojectorField' := hprojectorField.defeqU_r
+          c.Ewf c.Δwf ⟨_, hdomEq.symm⟩
+        have hnext : c.TrExpr
+            (body.instantiate1 (.proj typeName fieldIdx struct))
+            (semanticBody.inst (.app code.projector major)) := by
+          simpa only [Expr.instantiate1_eq] using
+            (.inst c.Ewf c.Δwf hprojectorField'
+              ⟨_, hbody, _, hbodyEq⟩
+              (hprojStrict.trExpr c.Ewf.ordered c.Δwf))
+        have hnextBelow : c.FVarsBelow proj
+            (body.instantiate1 (.proj typeName fieldIdx struct)) := by
+          intro P hP hproj
+          have houtFVars := (hrBelow.trans houtBelow) P hP hproj
+          have hfieldProj : FVarsIn P
+              (.proj typeName fieldIdx struct) := by
+            simpa [FVarsIn] using hstructBelow P hP hproj
+          simpa only [Expr.instantiate1_eq] using
+            houtFVars.2.instantiate1 hfieldProj
+        have hconsumeNext : VExpr.consumeForalls?
+            (VExpr.forallN (view.specializedFields levels params) tailResult)
+            (view.projectionArgs levels params (fieldIdx + 1) major) =
+              some (semanticBody.inst (.app code.projector major)) := by
+          rw [view.projectionArgs_succ levels params fieldIdx major hcode]
+          rw [VExpr.consumeForalls?_append, hconsume]
+          rfl
+        have hbound' : fieldIdx + 1 + count <
+            (view.specializedFields levels params).length := by omega
+        have hrec (recState : VState) :=
+          ih (s := recState) hnextBelow hbound' hnext hconsumeNext
+        simp only
+        split
+        · refine (isProp.WF hdom).bind fun _ propState _ _ => ?_
+          split
+          · exact invalidProj.WF
+          · simpa only [pure_bind, Nat.add_assoc, Nat.add_left_comm,
+              Nat.add_comm] using hrec propState
+        · simpa only [pure_bind, Nat.add_assoc, Nat.add_left_comm,
+            Nat.add_comm] using hrec nextState
+      | bvar | fvar | mvar | sort | const | app | lam | letE | lit |
+          mdata | proj => exact invalidProj.WF
+
+theorem inferProj.WF
+    (heBelow : c.FVarsBelow e ety)
+    (he : c.TrExprS e e') (hty : c.TrExprS ety ety')
+    (hasty : c.HasType e' ety') :
+    (inferProj st i e ety).WF c s fun ty _ =>
+      ∃ proj' ty', c.TrTyping (.proj st i e) ty proj' ty' := by
+  unfold inferProj
+  refine (whnf.WF hty).bind fun type _ _ ⟨htypeBelow, htype⟩ => ?_
+  have hprojBelowType : c.FVarsBelow (.proj st i e) type := by
+    intro P hP hproj
+    exact htypeBelow P hP (heBelow P hP (by simpa [FVarsIn] using hproj))
+  obtain ⟨type', htypeS, htypeEq⟩ := htype
+  rw [Expr.withApp_eq]
+  have ⟨family', hstack⟩ := AppStack.build
+    (type.mkAppList_getAppArgsList ▸ htypeS)
+  simp only
+  split
+  · rename_i familyName familyLevels hfamilyShape
+    refine .getEnv ?_
+    split
+    · exact invalidProj.WF
+    · rename_i hname
+      refine (M.WF.liftExcept envGet.WF).lift.bind fun ci _ _ hfind => ?_
+      split
+      · rename_i info
+        split
+        · rename_i constructor hctors
+          split
+          · rename_i hready
+            split
+            · exact invalidProj.WF
+            · rename_i hargs
+              obtain ⟨artifact⟩ :=
+                c.projectionReady.infer familyName info hfind hready
+              have hhead := hstack.tr
+              rw [hfamilyShape] at hhead
+              let .const (us' := levels') hfamilyConst hlevelsMap
+                hlevelsLength := hhead
+              have hviewFamily := artifact.viewWF.family
+              rw [artifact.name_eq] at hviewFamily
+              rw [hviewFamily] at hfamilyConst
+              cases hfamilyConst
+              have hlevelsWF : ∀ level ∈ levels',
+                  level.WF c.lparams.length :=
+                VLevel.WF.of_mapM_ofLevel hlevelsMap
+              have hlevelsSourceLength : levels'.length =
+                  artifact.view.generation.block.sourceType.uvars :=
+                (List.mapM_eq_some.1 hlevelsMap).length_eq.symm.trans
+                  hlevelsLength
+              have hlevelsLength' : levels'.length = artifact.view.uvars := by
+                exact hlevelsSourceLength.trans
+                    artifact.view.generation.block.sourceType_uvars_eq
+              have hargsSize : type.getAppArgs.size =
+                  info.numParams + info.numIndices := by
+                simpa using hargs
+              have hargsLength : type.getAppArgsList.length =
+                  artifact.view.nparams := by
+                rw [← Expr.getAppArgs_toList]
+                simp [hargsSize,
+                  artifact.numParams_eq, artifact.numIndices_eq]
+              have hfamilyType : c.HasType (.const familyName levels')
+                  (artifact.view.familyType.instL levels') := by
+                exact VEnv.HasType.const hviewFamily hlevelsWF
+                  hlevelsSourceLength
+              have hfamilyTypeShape : c.HasType (.const familyName levels')
+                  (VExpr.forallN
+                    (artifact.view.generation.block.rawParams.map
+                      (VExpr.instL levels'))
+                    (artifact.view.generation.block.rawResult.instL
+                      levels')) := by
+                simpa [VStructureView.familyType,
+                  VInductDecl.NormalizedChecked.rawType_eq,
+                  artifact.view.raw_indices_eq,
+                  VExpr.instL_forallN, VExpr.forallN] using hfamilyType
+              have hargsRawLength : type.getAppArgsList.length =
+                  (artifact.view.generation.block.rawParams.map
+                    (VExpr.instL levels')).length := by
+                simpa [artifact.view.generation.shape.1] using hargsLength
+              obtain ⟨params', hparamsTr, hparamsSpineRaw, htypeFull⟩ :=
+                AppStack.toSpineWF hstack hfamilyTypeShape hargsRawLength
+              rw [type.mkAppList_getAppArgsList] at htypeFull
+              have htypeAppliedEq := htypeFull.uniq c.Ewf
+                (.refl c.Ewf c.Δwf) htypeS
+              have hmajorType : c.HasType e'
+                  (artifact.view.structureType levels' params') := by
+                apply hasty.defeqU_r c.Ewf c.Δwf
+                have := (htypeAppliedEq.trans c.Ewf c.Δwf htypeEq).symm
+                simpa [VStructureView.structureType,
+                  artifact.name_eq] using this
+              have hparamsLength : params'.length =
+                  artifact.view.nparams :=
+                hparamsTr.length_eq.symm.trans hargsLength
+              have hparamsRawLength : params'.length =
+                  (artifact.view.generation.block.rawParams.map
+                    (VExpr.instL levels')).length :=
+                hparamsTr.length_eq.symm.trans hargsRawLength
+              have hparamsSpine : ∃ resultLevel,
+                  c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+                    (artifact.view.familyType.instL levels') params'
+                    (.sort resultLevel) := by
+                obtain ⟨resultLevel, hresultLevel⟩ := artifact.rawResult_sort
+                refine ⟨resultLevel.inst levels', ?_⟩
+                rw [hresultLevel] at hparamsSpineRaw
+                rw [VExpr.instRev_closedN params' (by trivial)] at hparamsSpineRaw
+                simpa [VStructureView.familyType,
+                  VInductDecl.NormalizedChecked.rawType_eq,
+                  artifact.view.raw_indices_eq, hresultLevel,
+                  VExpr.instL_forallN, VExpr.forallN,
+                  VExpr.instRev, VExpr.instL] using hparamsSpineRaw
+              have hconstructorName :
+                  constructor = artifact.view.constructorName := by
+                have := hctors.symm.trans artifact.ctors_eq
+                simpa using this
+              refine (M.WF.liftExcept envGet.WF).lift.bind
+                fun c_info _ _ hctorFind => ?_
+              cases c_info with
+              | ctorInfo ctorInfo =>
+                simp only
+                split
+                · rename_i hidxHost
+                  have hctorInfoEq :
+                      ctorInfo = artifact.constructorInfo := by
+                    rw [hconstructorName, artifact.constructor_find] at hctorFind
+                    exact ConstantInfo.ctorInfo.inj
+                      (Option.some.inj hctorFind.symm)
+                  have hiFields : i <
+                      (artifact.view.specializedFields levels' params').length := by
+                    rw [hctorInfoEq,
+                      artifact.constructor_numFields_eq] at hidxHost
+                    simpa [VStructureView.specializedFields,
+                      VStructureView.fields] using hidxHost
+                  have hviewConstructor : c.venv.constants constructor =
+                      some artifact.view.constructor.raw.toVConstant := by
+                    simpa [hconstructorName] using
+                      artifact.viewWF.toRegistered.constructor
+                  obtain ⟨_, hctorTr⟩ :=
+                    c.trenv.find?_uniq hctorFind hviewConstructor
+                  have hrawCtorUvars :
+                      artifact.view.constructor.raw.uvars =
+                        artifact.view.uvars := by
+                    exact artifact.view.generation.ctor_uvars_eq
+                      (by simp [artifact.view.constructor_eq])
+                  have hctorLevelLength :
+                      ctorInfo.levelParams.length = familyLevels.length :=
+                    hctorTr.2.1.trans <| hrawCtorUvars.trans <|
+                      hlevelsLength'.symm.trans
+                        (List.mapM_eq_some.1 hlevelsMap).length_eq.symm
+                  have hctorType₀ := hctorTr.2.2.instL c.Ewf
+                    (Us := c.lparams) (ls' := levels') (Δ := [])
+                    trivial hlevelsMap hctorLevelLength
+                  have hctorType := hctorType₀.weakFV c.Ewf
+                    (.from_nil c.mlctx.noBV) c.Δwf
+                  rw [(c.Ewf.ordered.closedC
+                    hviewConstructor).instL.liftN_eq
+                      (Nat.le_refl _)] at hctorType
+                  let ctorTail := VExpr.forallN
+                    (artifact.view.fields.map (VExpr.instL levels'))
+                    ((artifact.view.constructor.rawResult
+                      artifact.view.nparams).instL levels')
+                  rw [artifact.view.constructor.rawType_eq] at hctorType
+                  have hinstantiate :
+                      ((.ctorInfo ctorInfo : ConstantInfo)
+                        |>.instantiateTypeLevelParams familyLevels) =
+                      ctorInfo.type.instantiateLevelParams
+                        ctorInfo.levelParams familyLevels := rfl
+                  have hctorTypeShape : c.TrExpr
+                      ((.ctorInfo ctorInfo : ConstantInfo)
+                        |>.instantiateTypeLevelParams familyLevels)
+                      (VExpr.forallN
+                        (artifact.view.constructorParams.map
+                          (VExpr.instL levels')) ctorTail) := by
+                    simpa [ConstantInfo.instantiateTypeLevelParams,
+                      ConstantVal.instantiateTypeLevelParams,
+                      ConstantInfo.type, ConstantInfo.toConstantVal, ctorTail,
+                      VInductDecl.NormalizedCtor.declaredBinders,
+                      VStructureView.nparams,
+                      VStructureView.constructorParams,
+                      VStructureView.fields,
+                      VExpr.instL_forallN, VExpr.forallN_append,
+                      List.map_append] using hctorType
+                  have hctorTypeBelow : c.FVarsBelow (.proj st i e)
+                      ((.ctorInfo ctorInfo : ConstantInfo)
+                        |>.instantiateTypeLevelParams familyLevels) := by
+                    intro P _ _
+                    simpa [ConstantInfo.instantiateTypeLevelParams,
+                      ConstantVal.instantiateTypeLevelParams,
+                      ConstantInfo.type, ConstantInfo.toConstantVal] using
+                        hctorType₀.fvarsIn.mono nofun
+                  have hparamArgsEq :
+                      List.take info.numParams type.getAppArgs.toList =
+                        type.getAppArgsList := by
+                    simp [Expr.getAppArgs_toList, artifact.numParams_eq,
+                      ← hargsLength]
+                  have hparamArgsTr :
+                      (List.take info.numParams
+                        type.getAppArgs.toList).Forall₂
+                        (c.TrExprS · ·) params' := by
+                    simpa [hparamArgsEq] using hparamsTr
+                  have hparamArgsBelow : ∀ arg ∈
+                      List.take info.numParams type.getAppArgs.toList,
+                      c.FVarsBelow (.proj st i e) arg := by
+                    intro arg harg P hP hproj
+                    apply FVarsIn.getAppArgsList
+                      (hprojBelowType P hP hproj)
+                    simpa [hparamArgsEq] using harg
+                  have hctorParamsSpine :=
+                    artifact.viewWF.constructorParamsSpine c.Ewf.ordered
+                      levels' hlevelsWF hlevelsLength' params' hparamsLength
+                      hparamsSpine ctorTail
+                  refine (inferProjParams.WF hparamArgsTr hctorTypeBelow
+                    hparamArgsBelow hctorTypeShape hctorParamsSpine).bind
+                      fun r _ _ hr => ?_
+                  obtain ⟨hrBelow, hr⟩ := hr
+                  let tailResult :=
+                    ((artifact.view.constructor.rawResult
+                      artifact.view.nparams).instL levels').instRevAt
+                        params' artifact.view.fields.length
+                  have hctorTailInst : ctorTail.instRev params' =
+                      VExpr.forallN
+                        (artifact.view.specializedFields levels' params')
+                        tailResult := by
+                    simp [ctorTail, tailResult,
+                      VExpr.instRev_forallN_projection,
+                      VStructureView.specializedFields,
+                      VExpr.instRevAt_map_instL_zipIdx]
+                  rw [hctorTailInst] at hr
+                  refine (getSortLevel.WF htypeS).bind
+                    fun sortLevel nextState _ _ => ?_
+                  have hstructBelow : c.FVarsBelow (.proj st i e) e := by
+                    intro P _ hproj
+                    simpa [FVarsIn] using hproj
+                  have hcursorZero : VExpr.consumeForalls?
+                      (VExpr.forallN
+                        (artifact.view.specializedFields levels' params')
+                        tailResult)
+                      (artifact.view.projectionArgs levels' params' 0 e') =
+                        some (VExpr.forallN
+                          (artifact.view.specializedFields levels' params')
+                          tailResult) := by
+                    rfl
+                  refine (inferProjFields.WF he artifact.viewWF hlevelsWF
+                    hlevelsLength' hparamsLength hparamsSpine
+                    artifact.programsWF artifact.name_eq hmajorType
+                    hrBelow hstructBelow (by simpa using hiFields) hr
+                    hcursorZero).bind
+                      fun r _ _ hr => ?_
+                  obtain ⟨cursor, hcursor, hrBelow, hr⟩ := hr
+                  have hcursor' : VExpr.consumeForalls?
+                      (VExpr.forallN
+                        (artifact.view.specializedFields levels' params')
+                        tailResult)
+                      (artifact.view.projectionArgs levels' params' i e') =
+                        some cursor := by
+                    simpa using hcursor
+                  have hcodeIdx : i <
+                      (artifact.view.projectionCodes levels' params').length := by
+                    simpa using hiFields
+                  let code :=
+                    (artifact.view.projectionCodes levels' params')[i]
+                  have hcode :
+                      (artifact.view.projectionCodes levels' params')[i]? =
+                        some code :=
+                    List.getElem?_eq_getElem hcodeIdx
+                  have hprojectionArgsLength :
+                      (artifact.view.projectionArgs levels' params' i e').length =
+                        i :=
+                    artifact.view.projectionArgs_length levels' params' i e'
+                      (Nat.le_of_lt hcodeIdx)
+                  obtain ⟨field, semanticBody, hfield, hconsume⟩ :=
+                    VExpr.consumeForalls?_forallN_domain
+                      (artifact.view.specializedFields levels' params')
+                      tailResult
+                      (artifact.view.projectionArgs levels' params' i e')
+                      (by simpa [hprojectionArgsLength] using hiFields)
+                  rw [hprojectionArgsLength] at hfield
+                  have hcursorShape : cursor =
+                      .forallE
+                        (field.instRevAt
+                          (artifact.view.projectionArgs levels' params' i e') 0)
+                        semanticBody :=
+                    Option.some.inj (hcursor'.symm.trans hconsume)
+                  subst cursor
+                  have hprograms : artifact.view.ProgramsWF c.venv :=
+                    artifact.programsWF
+                  obtain ⟨field', typeBody, hfield', htypeFn,
+                      hprojectorField⟩ :=
+                    hprograms.projector_hasType_field
+                      c.Ewf c.Δwf hlevelsWF hlevelsLength' hparamsLength
+                      hparamsSpine hcode hmajorType
+                  have hfieldEq : field' = field :=
+                    Option.some.inj (hfield'.symm.trans hfield)
+                  subst field'
+                  have hprojector := hprograms c.Δwf hlevelsWF
+                    hlevelsLength' hparamsLength hparamsSpine hcode
+                  have hprojSem : c.venv.TrProj c.lparams.length
+                      c.vlctx.toCtx artifact.view levels' params' i e'
+                      (.app code.projector e') := {
+                    viewWF := artifact.viewWF
+                    levelsWF := hlevelsWF
+                    levels_length := hlevelsLength'
+                    params_length := hparamsLength
+                    paramsSpine := hparamsSpine
+                    majorType := hmajorType
+                    program := ⟨code, hcode, rfl, hprojector⟩ }
+                  have hst : st = familyName := by
+                    simpa using hname
+                  have hprojStrict : c.TrExprS (.proj st i e)
+                      (.app code.projector e') :=
+                    .proj he ⟨artifact.view, levels', params',
+                      artifact.name_eq.trans hst.symm, hprojSem⟩
+                  obtain ⟨r', hrS, hrEq⟩ := hr
+                  refine (whnf.WF hrS).bind fun out _ _
+                    ⟨houtBelow, ⟨out', hout, houtEq⟩⟩ => ?_
+                  have houtEq := houtEq.trans c.Ewf c.Δwf hrEq
+                  cases out with
+                  | forallE name dom body bi =>
+                    let .forallE hdomTy hbodyTy hdom hbody := hout
+                    have hforallEq := houtEq.forallE_inv c.Ewf c.Δwf
+                    obtain ⟨⟨_, hdomEq⟩, _, hbodyEq⟩ := hforallEq
+                    have hprojectorField' := hprojectorField.defeqU_r
+                      c.Ewf c.Δwf ⟨_, hdomEq.symm⟩
+                    have hdomBelow : c.FVarsBelow (.proj st i e) dom := by
+                      intro P hP hproj
+                      exact ((hrBelow.trans houtBelow) P hP hproj).1
+                    have hresult : ∃ proj' ty',
+                        c.TrTyping (.proj st i e) dom proj' ty' :=
+                      ⟨.app code.projector e', _, hdomBelow, hprojStrict,
+                        hdom, hprojectorField'⟩
+                    simp only
+                    split
+                    · refine (isProp.WF hdom).bind fun _ _ _ _ => ?_
+                      split
+                      · exact invalidProj.WF
+                      · exact .pure hresult
+                    · exact .pure hresult
+                  | bvar | fvar | mvar | sort | const | app | lam | letE |
+                      lit | mdata | proj => exact invalidProj.WF
+                · exact invalidProj.WF
+              | axiomInfo | defnInfo | thmInfo | opaqueInfo | quotInfo |
+                  inductInfo | recInfo => exact invalidProj.WF
+          · exact invalidProj.WF
+        · exact invalidProj.WF
+      · exact invalidProj.WF
+  · exact invalidProj.WF
+
+theorem literal_is_primitive (H : n = ``Nat ∨ n = ``Char.ofNat ∨ n = ``String.ofList)  :
+    Environment.primitives.contains n := by
+  simp [Environment.primitives, NameSet.ofList]
+  obtain rfl|rfl|rfl := H <;> simp +decide [NameSet.contains]
+
+theorem infer_literal {c : VContext} (H : c.venv.ContainsLits l) :
+    c.TrTyping (.lit l) l.type (.trLiteral l) (.const l.typeName []) := by
+  refine
+    have := TrExprS.trLiteral c.Ewf c.hasPrimitives l H
+    ⟨fun _ _ _ => .litType, this.1, ?_, this.2⟩
+  rw [← Literal.mkConst_typeName]
+  have ⟨_, h⟩ := this.2.isType c.Ewf c.Δwf
+  have ⟨_, h1, _, h3⟩  := h.const_inv c.Ewf c.Δwf
+  exact .const h1 rfl h3
+
+theorem infer_sort {c : VContext} (H : VLevel.ofLevel c.lparams u = some u') :
+    c.TrTyping (.sort u) (.sort u.succ) (.sort u') (.sort u'.succ) := by
+  refine ⟨fun _ _ _ => (?a).fvarsIn, .sort H, ?a, .sort (.of_ofLevel H)⟩
+  exact .sort <| by simpa [VLevel.ofLevel]
+
+theorem inferType'.WF
+    (h1 : e.FVarsIn (· ∈ c.vlctx.fvars))
+    (hinf : inferOnly = true → ∃ e', c.TrExprS e e') :
+    (inferType' e inferOnly).WF c s fun ty _ => ∃ e' ty', c.TrTyping e ty e' ty' := by
+  unfold inferType'; lift_lets; intro F F1
+  split <;> [exact .throw; refine .get <| .get ?_]
+  split
+  · rename_i h; refine .stateWF fun wf => .pure ?_
+    generalize hic : cond .. = ic at h
+    have : ic.WF c s := by
+      subst ic; cases inferOnly <;> [exact wf.inferTypeC_wf; exact wf.inferTypeI_wf]
+    exact (this h).2.2.2.2 h1
+  generalize hP : (fun _ (_ : VState) => _) = P
+  have hF {ty e' ty' s} (H : c.TrTyping e ty e' ty') : (F ty).WF c s P := by
+    rintro _ mwf wf a s' ⟨⟩
+    refine let s' := _; ⟨s', rfl, ?_⟩
+    have hic {ic} (hic : InferCache.WF c s ic) : InferCache.WF c s (ic.insert e ty) := by
+      intro _ _ h
+      rw [Std.HashMap.getElem?_insert] at h; split at h <;> [cases h; exact hic h]
+      rename_i eq
+      refine .mk c.mlctx.noBV (.eqv H eq BEq.rfl) (.eqv eq ?_) ?_
+      · exact H.2.1.fvarsIn.mono wf.ngen_wf
+      · exact H.2.2.1.fvarsIn.mono wf.ngen_wf
+    subst P; revert s'; cases inferOnly <;> (dsimp -zeta; intro s'; refine ⟨.rfl, ?_, _, _, H⟩)
+    · exact { wf with inferTypeC_wf := hic wf.inferTypeC_wf }
+    · exact { wf with inferTypeI_wf := hic wf.inferTypeI_wf }
+  split
+  · extract_lets G1
+    refine (checkLitSize.WF (Q := fun _ s' => s' = _) rfl).bind fun _ _ _ h => ?_
+    subst h; split <;> [split; skip]
+    · refine .getEnv <| (M.WF.liftExcept envGet.WF).lift.bind fun _ _ _ h => ?_
+      have ⟨_, h, _⟩ := c.trenv.find? h <|
+        (c.safePrimitives h (literal_is_primitive (.inl rfl))).1 ▸ DefinitionSafety.le_safe
+      exact hF (infer_literal ⟨_, h⟩)
+    · refine .getEnv <| (M.WF.liftExcept envGet.WF).lift.bind fun _ _ _ h1 => ?_
+      refine .getEnv <| (M.WF.liftExcept envGet.WF).lift.bind fun _ _ _ h2 => ?_
+      have ⟨_, h1, _⟩ := c.trenv.find? h1 <|
+        (c.safePrimitives h1 (literal_is_primitive (.inr (.inl rfl)))).1 ▸ DefinitionSafety.le_safe
+      have ⟨_, h2, _⟩ := c.trenv.find? h2 <|
+        (c.safePrimitives h2 (literal_is_primitive (.inr (.inr rfl)))).1 ▸ DefinitionSafety.le_safe
+      exact hF (infer_literal ⟨⟨_, h1⟩, ⟨_, h2⟩⟩)
+    · rename_i h; have ⟨_, h⟩ := hinf (by simpa using h)
+      have := h.lit_has_type
+      simp [G1]; exact hF (infer_literal this)
+  · refine (inferType'.WF (by exact h1) ?_).bind fun _ _ _ ⟨_, _, hb, h1, h⟩ => ?_
+    · exact fun h => let ⟨_, .mdata h⟩ := hinf h; ⟨_, h⟩
+    exact hF ⟨hb, .mdata h1, h⟩
+  · refine (inferType'.WF (by exact h1) ?_).bind fun _ _ _ ⟨_, _, hb, h1, h2, h3⟩ => ?_
+    · exact fun h => let ⟨_, .proj h ..⟩ := hinf h; ⟨_, h⟩
+    exact (inferProj.WF hb h1 h2 h3).bind fun ty _ _ ⟨_, ty', h⟩ => hF h
+  · exact .readThe <| (M.WF.liftExcept inferFVar.WF).lift.bind fun _ _ _ ⟨_, _, h⟩ => hF h
+  · exact .throw
+  · rename_i h _; simp [Expr.hasLooseBVars, Expr.looseBVarRange'] at h
+  · split <;> rename_i h
+    · refine .readThe <| (M.WF.liftExcept (checkLevel.WF h1)).lift.bind fun _ _ _ ⟨_, h⟩ => ?_
+      exact hF (infer_sort h)
+    · let ⟨_, .sort h⟩ := hinf (by simpa using h)
+      exact hF (infer_sort h)
+  · refine .readThe <|
+      (M.WF.liftExcept (inferConstant.WF h1 hinf)).lift.bind fun _ _ _ ⟨_, _, h⟩ => hF h
+  · exact (inferLambda.WF h1 hinf).bind fun _ _ _ ⟨_, _, h⟩ => hF h
+  · exact (inferForall.WF h1 hinf).bind fun _ _ _ ⟨_, _, h⟩ => hF h
+  · split <;> rename_i h
+    · let ⟨_, h⟩ := hinf h; exact (inferApp.WF h).bind fun _ _ _ ⟨_, h⟩ => hF h
+    refine (inferType'.WF h1.1 ?_).bind fun _ _ _ ⟨_, _, hfb, hf1, hf2, hf3⟩ => ?_
+    · exact fun h => let ⟨_, .app _ _ h _⟩ := hinf h; ⟨_, h⟩
+    refine .stateWF fun wf => ?_
+    refine (ensureForallCore.WF hf2).bind fun _ _ _ H => ?_
+    obtain ⟨hb, h2, name, dType, body, bi, rfl⟩ := H
+    let ⟨_, .forallE (ty' := dType') hl1 hl2 hl3 hl4, hl5⟩ := h2
+    extract_lets _ G1
+    refine (inferType'.WF h1.2 ?_).bind fun aType _ _ ⟨_, aType', hab, ha1, ha2, ha3⟩ => ?_
+    · exact fun h => let ⟨_, .app _ _ _ h⟩ := hinf h; ⟨_, h⟩
+    extract_lets G2
+    suffices ∀ {s b} (H : b = true → c.IsDefEqU dType' aType'), RecM.WF c s (G2 b) P by
+      split
+      · refine .bind ?_ (Q := fun b _ => b = true → c.IsDefEqU dType' aType') fun b _ _ => this
+        intro _ mwf wf _ _ eq
+        let c' := { c with eagerReduce := true }
+        have ⟨_, h1, h2, h3, h4⟩ := isDefEq.WF (c := c') hl3 ha2 _ mwf { wf with } _ _ eq
+        exact ⟨_, h1, h2, { h3 with }, h4⟩
+      · exact (isDefEq.WF hl3 ha2).bind fun b _ _ => this
+    subst G2; dsimp; rintro s ⟨⟩ H
+    · exact .getEnv <| .getLCtx .throw
+    simp [G1, Expr.bindingBody!]
+    have hf3 := hf3.defeqU_r c.Ewf c.Δwf hl5.symm
+    have ha3 := ha3.defeqU_r c.Ewf c.Δwf (H rfl).symm
+    subst hP; refine hF ⟨?_, .app hf3 ha3 hf1 ha1, hl4.inst c.Ewf ha3 ha1, .app hf3 ha3⟩
+    exact fun _ hP he => (hfb.trans hb _ hP he.1).2.instantiate1 he.2
+  · exact (inferLet.WF h1 hinf).bind fun _ _ _ ⟨_, _, h⟩ => hF h
+
+#guard_named_axioms Ix.Theory.Named.TypeChecker.Inner.inferProj.WF [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Quot.sound,
+  Lean.Expr.instantiate1_eq,
+  Lean.Expr.mkAppData_eq,
+  Lean.Expr.mkData_eq,
+  Lean.Expr.replace_eq,
+  Lean.Level.hasMVar_eq,
+  Lean.Level.hasParam_eq,
+  Lean.Level.instLawfulBEqLevel,
+  Lean.PersistentArray.toList'_push,
+  Lean.PersistentHashMap.findAux_isSome,
+  Lean.PersistentHashMap.WF.find?_eq,
+  Lean.PersistentHashMap.WF.toList'_insert]
diff --git a/Ix/Theory/Named/Verify/TypeChecker/IsDefEq.lean b/Ix/Theory/Named/Verify/TypeChecker/IsDefEq.lean
new file mode 100644
index 000000000..50ae5f28b
--- /dev/null
+++ b/Ix/Theory/Named/Verify/TypeChecker/IsDefEq.lean
@@ -0,0 +1,1228 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.TypeChecker.Reduce
+import Ix.Theory.Named.Verify.TypeChecker.InferType
+
+open Ix.Theory (VLevel)
+
+open Ix.Theory.Named
+
+namespace Ix.Theory.Named.TypeChecker.Inner
+open Lean hiding Environment Exception
+
+theorem isDefEqLambda.WF {c : VContext} {s : VState}
+    {m} [mwf : c.MLCWF m]
+    {fvs : List Expr} (hsubst : subst.toList.reverse = fvs)
+    (he₁ : (c.withMLC m).TrExprS (e₁.instantiateList fvs) ei₁')
+    (he₂ : (c.withMLC m).TrExprS (e₂.instantiateList fvs) ei₂') :
+    RecM.WF (c.withMLC m) s (isDefEqLambda e₁ e₂ subst) fun b _ =>
+      b → (c.withMLC m).IsDefEqU ei₁' ei₂' := by
+  unfold isDefEqLambda; let c' := c.withMLC m
+  split <;> [rename_i n₁ d₁ b₁ bi₁ n₂ d₂ b₂ bi₂; (simp [hsubst]; exact isDefEq.WF he₁ he₂)]
+  extract_lets F di₁ di₂; unfold di₁ di₂
+  simp at he₁ he₂
+  let .lam (ty' := t₁') (body' := b₁') ⟨_, a1⟩ a2 a3 := he₁
+  let .lam (ty' := t₂') (body' := b₂') b1 b2 b3 := he₂
+  suffices ∀ {x s}
+      (_ : match x with
+        | none => d₁ == d₂
+        | some x => x = d₂.instantiateList fvs),
+      c'.IsDefEqU t₁' t₂' →
+      (F x).WF c' s fun b _ => b → c'.IsDefEqU (t₁'.lam b₁') (t₂'.lam b₂') by
+    split <;> rename_i h
+    · refine .pureBind <| this ‹_› ?_
+      exact a2.eqv (Expr.instantiateList_eqv h) |>.uniq c'.Ewf (.refl c'.Ewf c'.Δwf) b2
+    simp [hsubst]
+    refine (isDefEq.WF a2 b2).bind fun b _ _ h1 => ?_
+    split <;> [exact .pure nofun; rename_i h]
+    simp at h; exact this rfl (h1 h)
+  intros x s hx tt
+  have tt' := tt.of_l c'.Ewf c'.Δwf a1
+  have ⟨b₁'', a3', eq⟩ := a3.defeqDFC' c'.Ewf <| .cons (.refl c'.Ewf c'.Δwf) (by nofun) (.vlam tt')
+  unfold F; split <;> rename_i h
+  · extract_lets d₂'
+    have : d₂' = d₂.instantiateList fvs := by split at hx <;> [simp [d₂', hsubst]; exact hx]
+    clear_value d₂'; subst this
+    refine .withLocalDecl b2 b1 .rfl fun v mwf' _ _ _ => ?_
+    have b3' := b3.inst_fvar c.Ewf mwf'.1.tr.wf
+    have a3'' := a3'.inst_fvar c.Ewf mwf'.1.tr.wf
+    rw [Expr.instantiateList_instantiate1_comm (by rfl), ← Expr.instantiateList] at a3'' b3'
+    refine isDefEqLambda.WF (mwf := mwf') (fvs := .fvar v :: fvs) (by simp [hsubst]) a3'' b3'
+      |>.mono fun _ _ _ h hb => ?_
+    have ⟨_, bb⟩ := eq.symm.trans c'.Ewf mwf'.1.tr.wf.toCtx (h hb)
+    exact ⟨_, .symm <| .lamDF tt'.symm <| bb.symm⟩
+  · simp [Expr.hasLooseBVars] at h
+    refine .stateWF fun wf => ?_
+    have {bᵢ : Expr} {bᵢ'} (h : bᵢ.looseBVarRange' = 0)
+        (a3 : TrExprS c'.venv c'.lparams ((none, .vlam t₂') :: c'.vlctx)
+          (bᵢ.instantiateList fvs 1) bᵢ') :
+        ∃ e', (c.withMLC m).TrExprS (bᵢ.instantiateList (default :: fvs)) e' ∧
+          c'.venv.IsDefEqU c'.lparams.length (t₂' :: c'.vlctx.toCtx) bᵢ' e'.lift := by
+      simp; rw [← Expr.instantiateList_instantiate1_comm (by rfl)]
+      let v : FVarId := ⟨s.ngen.curr⟩
+      have hΔ : VLCtx.WF c'.venv c.lparams.length ((some (v, []), .vlam t₂') :: m.vlctx) := by
+        refine ⟨mwf.1.tr.wf, ?_, b1⟩
+        rintro _ _ ⟨⟩; simp; exact fun h => s.ngen.not_reserves_self (wf.ngen_wf _ h)
+      have := a3.inst_fvar c.Ewf.ordered hΔ
+      have eq {e} (hb : bᵢ.looseBVarRange' = 0) (he : e.looseBVarRange' = 0) :
+          (bᵢ.instantiateList fvs 1).instantiate1' e = bᵢ.instantiateList fvs 1 := by
+        rw [Expr.instantiate1'_eq_self]; rw [Expr.instantiateList'_eq_self] <;> simp [*]
+      rw [eq h rfl, ← eq (e := .fvar v) h rfl]
+      let ⟨_, H⟩ := this.weakFV_inv c.Ewf (.skip_fvar _ _ .refl) (.refl c.Ewf hΔ)
+        (m.noBV ▸ this.closed) (by rw [eq h rfl]; exact a3.fvarsIn)
+      refine ⟨_, H, this.uniq c'.Ewf (.refl c'.Ewf hΔ) <| H.weakFV c'.Ewf (.skip_fvar _ _ .refl) hΔ⟩
+    let ⟨_, a4, a5⟩ := this h.1 a3'
+    let ⟨_, b4, b5⟩ := this h.2 b3
+    exact isDefEqLambda.WF (fvs := default :: fvs) (by simp [hsubst]) a4 b4
+      |>.mono fun _ _ _ h hb =>
+      have hΓ := ⟨c'.Δwf, b1⟩
+      have ⟨_, bb⟩ := eq.symm.trans c'.Ewf hΓ a5
+        |>.trans c'.Ewf hΓ ((h hb).weak c'.Ewf (B := t₂')) |>.trans c'.Ewf hΓ b5.symm
+      ⟨_, .symm <| .lamDF tt'.symm bb.symm⟩
+
+theorem isDefEqForall.WF {c : VContext} {s : VState}
+    {m} [mwf : c.MLCWF m]
+    {fvs : List Expr} (hsubst : subst.toList.reverse = fvs)
+    (he₁ : (c.withMLC m).TrExprS (e₁.instantiateList fvs) ei₁')
+    (he₂ : (c.withMLC m).TrExprS (e₂.instantiateList fvs) ei₂') :
+    RecM.WF (c.withMLC m) s (isDefEqForall e₁ e₂ subst) fun b _ =>
+      b → (c.withMLC m).IsDefEqU ei₁' ei₂' := by
+  unfold isDefEqForall; let c' := c.withMLC m
+  split <;> [rename_i n₁ d₁ b₁ bi₁ n₂ d₂ b₂ bi₂; (simp [hsubst]; exact isDefEq.WF he₁ he₂)]
+  extract_lets F di₁ di₂; unfold di₁ di₂
+  simp at he₁ he₂
+  let .forallE (ty' := t₁') (body' := b₁') ⟨_, a1⟩ _ a2 a3 := he₁
+  let .forallE (ty' := t₂') (body' := b₂') b1 ⟨_, bT⟩ b2 b3 := he₂
+  suffices ∀ {x s}
+      (_ : match x with
+        | none => d₁ == d₂
+        | some x => x = d₂.instantiateList fvs),
+      c'.IsDefEqU t₁' t₂' →
+      (F x).WF c' s fun b _ => b → c'.IsDefEqU (t₁'.forallE b₁') (t₂'.forallE b₂') by
+    split <;> rename_i h
+    · refine .pureBind <| this ‹_› ?_
+      exact a2.eqv (Expr.instantiateList_eqv h) |>.uniq c'.Ewf (.refl c'.Ewf c'.Δwf) b2
+    simp [hsubst]
+    refine (isDefEq.WF a2 b2).bind fun b _ _ h1 => ?_
+    split <;> [exact .pure nofun; rename_i h]
+    simp at h; exact this rfl (h1 h)
+  intros x s hx tt
+  have tt' := tt.of_l c'.Ewf c'.Δwf a1
+  have ⟨b₁'', a3', eq⟩ := a3.defeqDFC' c'.Ewf <| .cons (.refl c'.Ewf c'.Δwf) (by nofun) (.vlam tt')
+  unfold F; split <;> rename_i h
+  · extract_lets d₂'
+    have : d₂' = d₂.instantiateList fvs := by split at hx <;> [simp [d₂', hsubst]; exact hx]
+    clear_value d₂'; subst this
+    refine .withLocalDecl b2 b1 .rfl fun v mwf' _ _ _ => ?_
+    have b3' := b3.inst_fvar c.Ewf mwf'.1.tr.wf
+    have a3'' := a3'.inst_fvar c.Ewf mwf'.1.tr.wf
+    rw [Expr.instantiateList_instantiate1_comm (by rfl), ← Expr.instantiateList] at a3'' b3'
+    refine isDefEqForall.WF (mwf := mwf') (fvs := .fvar v :: fvs) (by simp [hsubst]) a3'' b3'
+      |>.mono fun _ _ _ h hb => ?_
+    have bb := eq.symm.trans c'.Ewf mwf'.1.tr.wf.toCtx (h hb) |>.of_r c'.Ewf mwf'.1.tr.wf.toCtx bT
+    exact ⟨_, .symm <| .forallEDF tt'.symm <| bb.symm⟩
+  · simp [Expr.hasLooseBVars] at h
+    refine .stateWF fun wf => ?_
+    have {bᵢ : Expr} {bᵢ'} (h : bᵢ.looseBVarRange' = 0)
+        (a3 : TrExprS c'.venv c'.lparams ((none, .vlam t₂') :: c'.vlctx)
+          (bᵢ.instantiateList fvs 1) bᵢ') :
+        ∃ e', (c.withMLC m).TrExprS (bᵢ.instantiateList (default :: fvs)) e' ∧
+          c'.venv.IsDefEqU c'.lparams.length (t₂' :: c'.vlctx.toCtx) bᵢ' e'.lift := by
+      simp; rw [← Expr.instantiateList_instantiate1_comm (by rfl)]
+      let v : FVarId := ⟨s.ngen.curr⟩
+      have hΔ : VLCtx.WF c'.venv c.lparams.length ((some (v, []), .vlam t₂') :: m.vlctx) := by
+        refine ⟨mwf.1.tr.wf, ?_, b1⟩
+        rintro _ _ ⟨⟩; simp; exact fun h => s.ngen.not_reserves_self (wf.ngen_wf _ h)
+      have := a3.inst_fvar c.Ewf.ordered hΔ
+      have eq {e} (hb : bᵢ.looseBVarRange' = 0) (he : e.looseBVarRange' = 0) :
+          (bᵢ.instantiateList fvs 1).instantiate1' e = bᵢ.instantiateList fvs 1 := by
+        rw [Expr.instantiate1'_eq_self]; rw [Expr.instantiateList'_eq_self] <;> simp [*]
+      rw [eq h rfl, ← eq (e := .fvar v) h rfl]
+      let ⟨_, H⟩ := this.weakFV_inv c.Ewf (.skip_fvar _ _ .refl) (.refl c.Ewf hΔ)
+        (m.noBV ▸ this.closed) (by rw [eq h rfl]; exact a3.fvarsIn)
+      refine ⟨_, H, this.uniq c'.Ewf (.refl c'.Ewf hΔ) <| H.weakFV c'.Ewf (.skip_fvar _ _ .refl) hΔ⟩
+    let ⟨_, a4, a5⟩ := this h.1 a3'
+    let ⟨_, b4, b5⟩ := this h.2 b3
+    exact isDefEqForall.WF (fvs := default :: fvs) (by simp [hsubst]) a4 b4
+      |>.mono fun _ _ _ h hb =>
+      have hΓ := ⟨c'.Δwf, b1⟩
+      have bb := eq.symm.trans c'.Ewf hΓ a5 |>.trans c'.Ewf hΓ ((h hb).weak c'.Ewf (B := t₂'))
+        |>.trans c'.Ewf hΓ b5.symm |>.of_r c'.Ewf hΓ bT
+      ⟨_, .symm <| .forallEDF tt'.symm bb.symm⟩
+
+theorem quickIsDefEq.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (quickIsDefEq e₁ e₂) fun b _ => b = .true → c.IsDefEqU e₁' e₂' := by
+  unfold quickIsDefEq
+  refine .stateWF fun wf => .get ?_
+  split <;> [rename_i hcache; skip]
+  · refine .pure fun _ => ?_
+    rcases Bool.or_eq_true_iff.1 hcache with h | h
+    · exact (he₁.eqv h).uniq c.Ewf (.refl c.Ewf c.Δwf) he₂
+    -- The cache is keyed on the two hashes, so the recorded pair may be either way round.
+    let ⟨_, _, a1, a2, ewf, _⟩ := wf.ectx
+    refine (VEnv.IsDefEqU.weak'_iff c.Ewf a1 a2.toCtx).1 <|
+      DefEqCache.IsDefEqE.uniq c.Ewf a1
+        (he₁.weakFV' c.Ewf a2 a1) (he₂.weakFV' c.Ewf a2 a1) ?_
+    unfold succeededBefore at h
+    split at h; · exact ewf.contains h
+    split at h; · exact (ewf.contains h).symm
+    rcases Bool.or_eq_true_iff.1 h with h | h
+    · exact ewf.contains h
+    · exact (ewf.contains h).symm
+  split
+  · exact .toLBoolM <| c.withMLC_self ▸
+      isDefEqLambda.WF (subst := #[]) (fvs := []) rfl (c.withMLC_self ▸ he₁) (c.withMLC_self ▸ he₂)
+  · exact .toLBoolM <| c.withMLC_self ▸
+      isDefEqForall.WF (subst := #[]) (fvs := []) rfl (c.withMLC_self ▸ he₁) (c.withMLC_self ▸ he₂)
+  · have .sort hu := he₁; have .sort hv := he₂
+    refine .pure fun h => ⟨_, .sortDF (.of_ofLevel hu) (.of_ofLevel hv) ?_⟩
+    exact Level.isEquiv'_wf (toLBool_true.1 h) hu hv
+  · let .mdata he₁ := he₁; let .mdata he₂ := he₂
+    exact .toLBoolM <| isDefEq.WF he₁ he₂
+  · cases he₁
+  · rename_i a1 a2 _; refine .pure fun h => ?_
+    simp at h; subst h; exact he₁.uniq c.Ewf (.refl c.Ewf c.Δwf) he₂
+  · exact .pure nofun
+
+theorem isDefEqArgs.WF {c : VContext} {s : VState}
+    (H : ∃ e₁', c.TrExprS e₁.getAppFn e₁' ∧ ∃ e₂', c.TrExprS e₂.getAppFn e₂' ∧ c.IsDefEqU e₁' e₂')
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqArgs e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEqArgs; split <;> (unfold Expr.getAppFn at H)
+  · let .app a1 a2 a3 a4 := he₁
+    let .app b1 b2 b3 b4 := he₂
+    refine (isDefEq.WF a4 b4).bind fun _ _ _ h2 => ?_; extract_lets
+    split <;> [exact .pure nofun; rename_i hb2]
+    refine (isDefEqArgs.WF H a3 b3).mono fun _ _ _ h1 hb1 => ?_
+    simp at hb2
+    exact ⟨_, .appDF ((h1 hb1).of_l c.Ewf c.Δwf a1) ((h2 hb2).of_l c.Ewf c.Δwf a2)⟩
+  · exact .pure nofun
+  · exact .pure nofun
+  · refine .pure fun _ => ?_
+    simp [*] at H; let ⟨_, h1, _, h2, h3⟩ := H
+    have a1 := he₁.uniq c.Ewf (.refl c.Ewf c.Δwf) h1
+    have a2 := he₂.uniq c.Ewf (.refl c.Ewf c.Δwf) h2
+    exact a1.trans c.Ewf c.Δwf h3 |>.trans c.Ewf c.Δwf a2.symm
+
+theorem tryEtaExpansionCore.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryEtaExpansionCore e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  unfold tryEtaExpansionCore; split <;> [skip; exact .pure nofun]
+  refine (inferType.WF he₂).bind fun _ _ _ ⟨ty₁, a1, a2, a3, a4⟩ => ?_
+  refine (whnf.WF a3).bind fun _ _ _ ⟨b1, _, b2, b3⟩ => ?_
+  split <;> [skip; exact .pure nofun]
+  let .forallE (ty' := ty') c1 c2 c3 c4 := b2
+  replace a4 := a4.defeqU_r c.Ewf c.Δwf b3.symm
+  -- have := b2.uniq c.Ewf (.refl c.Ewf c.Δwf) (.forallE c1 c2 c3 c4)
+  refine (isDefEq.WF he₁ (.lam c1 c3 (.app (a4.weak c.Ewf) (.bvar .zero) (
+    Expr.liftLooseBVars_eq_self (c.mlctx.noBV ▸ a2.closed).looseBVarRange_le ▸
+      a2.weakBV c.Ewf (.skip (.vlam ty') .refl)) (.bvar rfl)))).mono fun _ _ _ h hb => ?_
+  exact (h hb).trans c.Ewf c.Δwf ⟨_, .eta a4⟩
+
+theorem tryEtaExpansion.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryEtaExpansion e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  simp [tryEtaExpansion, orM, toBool]
+  refine (tryEtaExpansionCore.WF he₁ he₂).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun _ => h rfl; skip]
+  exact (tryEtaExpansionCore.WF he₂ he₁).mono fun _ _ _ h hb => (h hb).symm
+
+private theorem AppStack.toSpineWF_of_isType {c : VContext}
+    (H : AppStack c.venv c.lparams c.vlctx f f' args)
+    (hf : c.HasType f' (VExpr.forallN As (.sort resultLevel)))
+    (hfull : c.TrExprS (f.mkAppList args) full')
+    (hfullType : c.venv.IsType c.lparams.length c.vlctx.toCtx full') :
+    ∃ args', args.Forall₂ (c.TrExprS · ·) args' ∧
+      c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+        (VExpr.forallN As (.sort resultLevel)) args' (.sort resultLevel) ∧
+      c.TrExprS (f.mkAppList args) (VExpr.appN f' args') := by
+  induction args generalizing f f' As full' with
+  | nil =>
+    let .head hhead := H
+    cases As with
+    | nil =>
+      refine ⟨[], .nil, .nil, ?_⟩
+      change c.TrExprS f f'
+      exact hhead
+    | cons A As =>
+      obtain ⟨sortLevel, hfullSort⟩ := hfullType
+      have hheadEq := hhead.uniq c.Ewf (.refl c.Ewf c.Δwf) hfull
+      have hheadSort := hfullSort.defeqU_l c.Ewf c.Δwf hheadEq.symm
+      have htypes := hf.uniqU c.Ewf c.Δwf hheadSort
+      exact False.elim <|
+        VEnv.IsDefEqU.sort_forallE_inv c.Ewf c.Δwf htypes.symm
+  | cons arg args ih =>
+    let .app hfun harg hhead hargTr Hrest := H
+    cases As with
+    | nil =>
+      have htypes := hf.uniqU c.Ewf c.Δwf hfun
+      exact False.elim <|
+        VEnv.IsDefEqU.sort_forallE_inv c.Ewf c.Δwf htypes
+    | cons A As =>
+      have htypes := hf.uniqU c.Ewf c.Δwf hfun
+      obtain ⟨⟨_, hdomain⟩, _, _hcodomain⟩ :=
+        htypes.forallE_inv c.Ewf c.Δwf
+      have hargA := harg.defeqU_r c.Ewf c.Δwf ⟨_, hdomain.symm⟩
+      have htailType := hf.app hargA
+      rw [VExpr.instN_forallN] at htailType
+      obtain ⟨args', hargs, hspine, htailFull⟩ :=
+        ih Hrest htailType (by simpa [Expr.mkAppList] using hfull)
+          hfullType
+      refine ⟨_ :: args', .cons hargTr hargs, .cons hargA ?_, ?_⟩
+      · rw [VExpr.instN_forallN]
+        rw [Nat.zero_add]
+        rw [(show (VExpr.sort resultLevel).ClosedN 0 by trivial).instN_eq
+          (e2 := _) (Nat.zero_le As.length)]
+        exact hspine
+      · simpa [Expr.mkAppList, VExpr.appN] using htailFull
+
+private theorem forall₂_of_getElem? {R : α → β → Prop} :
+    ∀ {xs : List α} {ys : List β},
+      xs.length = ys.length →
+      (∀ (i : Nat) (x : α) (y : β),
+        xs[i]? = some x → ys[i]? = some y → R x y) →
+      List.Forall₂ R xs ys
+  | [], [], _, _ => .nil
+  | [], _ :: _, hlen, _ => by simp at hlen
+  | _ :: _, [], hlen, _ => by simp at hlen
+  | x :: xs, y :: ys, hlen, h => by
+      refine .cons (h 0 x y (by simp) (by simp)) ?_
+      apply forall₂_of_getElem? (Nat.succ.inj hlen)
+      intro i x' y' hx hy
+      exact h (i + 1) x' y' (by simpa using hx) (by simpa using hy)
+
+
+theorem tryEtaStructCore.WF_of_structureEta {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryEtaStructCore e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  unfold tryEtaStructCore
+  split <;> [skip; exact .pure nofun]
+  refine .getEnv ?_
+  refine (M.WF.liftExcept envGet.WF).lift.bind fun _ci _ _ hfind => ?_
+  split <;> [skip; exact .pure nofun]
+  extract_lets F1
+  split <;> [skip; exact .pure nofun]
+  rename_i hostHead ctorName ctorLevels hhead state hstate hostInfo ctorInfo
+    hargs
+  split <;> [skip; exact .pure nofun]
+  rename_i hnonrec
+  refine (inferType.WF he₁).bind fun _ _ _
+    ⟨ty₁', _aBelow, _aTerm, aType, aTyped⟩ => ?_
+  refine (inferType.WF he₂).bind fun _ _ _
+    ⟨ty₂', _bBelow, _bTerm, bType, bTyped⟩ => ?_
+  refine (isDefEq.WF aType bType).bind fun _ _ _ htypes => ?_
+  split <;> [skip; exact .pure nofun]
+  rename_i htypesTrue
+  unfold F1
+  obtain ⟨familyInfo, hfamily, ⟨artifact⟩⟩ :=
+    c.structureEtaReady.resolveConstructor hfind hnonrec
+  have ⟨head', hstack⟩ := AppStack.build <|
+    e₂.mkAppList_getAppArgsList ▸ he₂
+  have hheadTr := hstack.tr
+  rw [hhead] at hheadTr
+  let .const (us' := levels) hconst hlevelsMap hlevelsHostLength := hheadTr
+  have hviewConstructor := artifact.projection.viewWF.constructor
+  rw [artifact.constructor_name_eq] at hviewConstructor
+  rw [hviewConstructor] at hconst
+  cases hconst
+  have hlevelsWF : ∀ level ∈ levels,
+      level.WF c.lparams.length :=
+    VLevel.WF.of_mapM_ofLevel hlevelsMap
+  have hrawCtorUvars : artifact.projection.view.constructor.raw.uvars =
+      artifact.projection.view.uvars :=
+    artifact.projection.view.generation.ctor_uvars_eq
+      (by simp [artifact.projection.view.constructor_eq])
+  have hlevelsLength : levels.length = artifact.projection.view.uvars :=
+    (List.mapM_eq_some.1 hlevelsMap).length_eq.symm.trans <|
+      hlevelsHostLength.trans hrawCtorUvars
+  have hctorHead : c.HasType (.const ctorName levels)
+      (artifact.projection.view.constructor.raw.type.instL levels) :=
+    VEnv.HasType.const hviewConstructor hlevelsWF
+      (hlevelsLength.trans hrawCtorUvars.symm)
+  let ctorBinders :=
+    (artifact.projection.view.constructor.declaredBinders
+      artifact.projection.view.nparams).map (VExpr.instL levels)
+  let ctorResult :=
+    (artifact.projection.view.constructor.rawResult
+      artifact.projection.view.nparams).instL levels
+  have hctorHeadShape : c.HasType (.const ctorName levels)
+      (VExpr.forallN ctorBinders ctorResult) := by
+    rw [artifact.projection.view.constructor.rawType_eq] at hctorHead
+    simpa [ctorBinders, ctorResult, VExpr.instL_forallN] using hctorHead
+  have hhostArgsLength : e₂.getAppArgsList.length =
+      ctorInfo.numParams + ctorInfo.numFields := by
+    simpa [Expr.getAppNumArgs_eq, ← Expr.getAppArgsList_reverse] using hargs
+  have hnumParams : ctorInfo.numParams = artifact.projection.view.nparams := by
+    exact (congrArg ConstructorVal.numParams
+      artifact.constructor_info_eq).symm.trans
+        artifact.projection.constructor_numParams_eq
+  have hnumFields : ctorInfo.numFields = artifact.projection.view.fields.length := by
+    exact (congrArg ConstructorVal.numFields
+      artifact.constructor_info_eq).symm.trans
+        artifact.projection.constructor_numFields_eq
+  have hconstructorMem : artifact.projection.view.constructor ∈
+      artifact.projection.view.generation.block.ctorPairs := by
+    simp [artifact.projection.view.constructor_eq]
+  have hconstructorShape :=
+    artifact.projection.view.generation.shape.2.2.2.2.2
+      artifact.projection.view.constructor hconstructorMem
+  have hhostBinderLength : e₂.getAppArgsList.length = ctorBinders.length := by
+    simpa [ctorBinders, VInductDecl.NormalizedCtor.declaredBinders,
+      VStructureView.fields, hnumParams, hnumFields,
+      hconstructorShape.2.2.1] using hhostArgsLength
+  obtain ⟨args', hargsTr, hargsSpine, hfullTr⟩ :=
+    AppStack.toSpineWF hstack hctorHeadShape hhostBinderLength
+  rw [e₂.mkAppList_getAppArgsList] at hfullTr
+  have hargsLength : args'.length = artifact.projection.view.nparams +
+      artifact.projection.view.fields.length :=
+    hargsTr.length_eq.symm.trans <| by
+      simpa [hnumParams, hnumFields] using hhostArgsLength
+  let params := args'.take artifact.projection.view.nparams
+  let fields := args'.drop artifact.projection.view.nparams
+  have hargsSplit : args' = params ++ fields := by
+    simp [params, fields]
+  have hparamsLength : params.length = artifact.projection.view.nparams := by
+    simp [params, hargsLength]
+  have hfieldsLength : fields.length = artifact.projection.view.fields.length := by
+    simp [fields, hargsLength]
+  have hargsSpineSplit := hargsSpine
+  rw [hargsSplit] at hargsSpineSplit
+  obtain ⟨paramCursor, hparamRaw, hfieldsRaw⟩ :=
+    hargsSpineSplit.split
+  let ctorTail := VExpr.forallN
+    (artifact.projection.view.fields.map (VExpr.instL levels)) ctorResult
+  have hparamCtor : c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+      (VExpr.forallN
+        (artifact.projection.view.constructorParams.map
+          (VExpr.instL levels)) ctorTail)
+      params paramCursor := by
+    simpa [ctorBinders, ctorTail,
+      VInductDecl.NormalizedCtor.declaredBinders,
+      VStructureView.constructorParams, VStructureView.fields,
+      List.map_append, VExpr.forallN_append] using hparamRaw
+  obtain ⟨resultLevel, hrawResult⟩ := artifact.projection.rawResult_sort
+  have hparamsSpine :=
+    artifact.projection.viewWF.familyParamsSpine_of_constructor
+      c.Ewf.ordered levels hlevelsWF hlevelsLength params hparamsLength
+      hparamCtor resultLevel hrawResult
+  have hdeclResult₀ :=
+    artifact.projection.viewWF.generationSemantics.constructor.declaredResult
+  have hdeclResult₁ := hdeclResult₀.instL hlevelsWF
+  have hdeclResult : c.venv.IsDefEq c.lparams.length
+      ctorBinders.reverse ctorResult
+      ((VInductDecl.NormalizedCtor.resultTarget
+        artifact.projection.view.generation.block
+        artifact.projection.view.constructor).instL levels)
+      ((VExpr.sort
+        artifact.projection.view.generation.block.checked.resultLevel).instL
+        levels) := by
+    simpa [ctorBinders, ctorResult, List.map_reverse] using hdeclResult₁
+  have hdeclTel₀ :=
+    artifact.projection.viewWF.generationSemantics.constructor.declaredTel
+  have hdeclTel := hdeclTel₀.instL hlevelsWF
+  have hctorOnTel : c.venv.OnTel c.lparams.length [] ctorBinders := by
+    simpa [ctorBinders] using hdeclTel.raw_onTel
+  have hctorCtxClosed : CtxClosed ctorBinders.reverse :=
+    VEnv.CtxWF.closed c.Ewf.ordered <| by
+      simpa using hctorOnTel.toOnCtx (by trivial)
+  have hdeclResultΓ := hdeclResult.weakR c.Ewf.ordered hctorCtxClosed
+    c.vlctx.toCtx
+  have hargsTelLength : args'.length = ctorBinders.length :=
+    hargsTr.length_eq.symm.trans hhostBinderLength
+  have hresultEq := hargsSpine.instRev_defeq c.Ewf.ordered
+    hargsTelLength hdeclResultΓ
+  let S := artifact.projection.viewWF.toGenerationEnv c.Ewf.ordered
+  have hresultIndices :
+      artifact.projection.view.constructor.view.resultIndices = [] := by
+    apply List.length_eq_zero_iff.1
+    rw [S.viewResultIndices_length hconstructorMem]
+    simp [artifact.projection.view.checked_indices_eq]
+  have hrange := VExpr.map_instRev_bvarRevRange_seg args'
+    artifact.projection.view.nparams artifact.projection.view.fields.length
+    (by omega)
+  have hrange' :
+      (VExpr.bvarRevRange
+        (artifact.projection.view.constructor.rawFields
+          artifact.projection.view.source.nparams).length
+        artifact.projection.view.source.nparams).map (VExpr.instRev · args') =
+      params := by
+    simpa [VStructureView.fields, hargsLength, params] using hrange
+  have htarget :
+      ((VInductDecl.NormalizedCtor.resultTarget
+        artifact.projection.view.generation.block
+        artifact.projection.view.constructor).instL levels).instRev args' =
+      artifact.projection.view.structureType levels params := by
+    simp only [VInductDecl.NormalizedCtor.resultTarget, VExpr.instL_appN, VExpr.instL,
+      VExpr.instRev_appN, VExpr.bvarRevRange_map_instL, hresultIndices, List.append_nil]
+    rw [VLevel.inst_map_id hlevelsLength]
+    rw [VExpr.instRev_closedN args' (by trivial)]
+    rw [hrange']
+    rfl
+  rw [htarget] at hresultEq
+  have hcanonicalRaw := hargsSpine.hasType_appN hctorHeadShape
+  have hcanonical : c.HasType
+      ((VExpr.const ctorName levels).appN args')
+      (artifact.projection.view.structureType levels params) :=
+    hcanonicalRaw.defeqU_r c.Ewf c.Δwf ⟨_, hresultEq⟩
+  have hfullEq := hfullTr.uniq c.Ewf (.refl c.Ewf c.Δwf) he₂
+  have hbStruct := hcanonical.defeqU_l c.Ewf c.Δwf hfullEq
+  have hty₂Struct := bTyped.uniqU c.Ewf c.Δwf hbStruct
+  have hty₁Struct := VEnv.IsDefEqU.trans c.Ewf c.Δwf
+    (htypes htypesTrue) hty₂Struct
+  have haStruct := aTyped.defeqU_r c.Ewf c.Δwf hty₁Struct
+  have heta := artifact.eta c.Δwf hlevelsWF hlevelsLength
+    hparamsLength ⟨_, hparamsSpine⟩ haStruct
+  have hF1Size : F1.size = args'.length := by
+    calc
+      F1.size = F1.toList.length := by simp
+      _ = e₂.getAppArgsList.length := by simp [F1, Expr.getAppArgs_toList]
+      _ = args'.length := hargsTr.length_eq
+  have hfieldData : ∀ (j : Nat), j < fields.length →
+      ∃ code : VStructureView.ProjectionCode,
+        (artifact.projection.view.projectionCodes levels params)[j]? =
+          some code ∧
+        c.TrExprS (.proj ctorInfo.induct j e₁)
+          (.app code.projector e₁') ∧
+        ∀ (hi : ctorInfo.numParams + j < F1.size),
+          c.TrExprS F1[ctorInfo.numParams + j] fields[j] := by
+    intro j hj
+    have hcodeIdx : j <
+        (artifact.projection.view.projectionCodes levels params).length := by
+      simpa [VStructureView.specializedFields, hfieldsLength] using hj
+    let code := (artifact.projection.view.projectionCodes levels params)[j]
+    have hcode :
+        (artifact.projection.view.projectionCodes levels params)[j]? =
+          some code := List.getElem?_eq_getElem hcodeIdx
+    have hprojector := artifact.projection.programsWF c.Δwf hlevelsWF
+      hlevelsLength hparamsLength ⟨_, hparamsSpine⟩ hcode
+    have hprojSem : c.venv.TrProj c.lparams.length c.vlctx.toCtx
+        artifact.projection.view levels params j e₁'
+        (.app code.projector e₁') := {
+      viewWF := artifact.projection.viewWF
+      levelsWF := hlevelsWF
+      levels_length := hlevelsLength
+      params_length := hparamsLength
+      paramsSpine := ⟨_, hparamsSpine⟩
+      majorType := haStruct
+      program := ⟨code, hcode, rfl, hprojector⟩ }
+    have hprojTr : c.TrExprS (.proj ctorInfo.induct j e₁)
+        (.app code.projector e₁') :=
+      .proj he₁ ⟨artifact.projection.view, levels, params,
+        artifact.projection.name_eq, hprojSem⟩
+    refine ⟨code, hcode, hprojTr, ?_⟩
+    intro hi
+    have hselectedList :
+        e₂.getAppArgsList[ctorInfo.numParams + j]? =
+          some F1[ctorInfo.numParams + j] := by
+      rw [← Expr.getAppArgs_toList]
+      simp [F1]
+    obtain ⟨translated, htranslated, htr⟩ :=
+      Ix.Theory.Named.List.Forall₂.getElem?_left hargsTr hselectedList
+    have hfieldGet : args'[ctorInfo.numParams + j]? = some fields[j] := by
+      rw [hargsSplit, List.getElem?_append_right]
+      · simp [hnumParams, hparamsLength]
+      · simp [hnumParams, hparamsLength]
+    have : translated = fields[j] :=
+      Option.some.inj (htranslated.symm.trans hfieldGet)
+    subst translated
+    exact htr
+  rw [Std.Legacy.Range.forIn'_eq_forIn'_range']
+  simp only [Std.Legacy.Range.size, Nat.add_sub_cancel, Nat.div_one]
+  let FieldEq := fun (j : Nat) => ∃ (field : VExpr)
+      (code : VStructureView.ProjectionCode),
+    fields[j]? = some field ∧
+    (artifact.projection.view.projectionCodes levels params)[j]? = some code ∧
+    c.IsDefEqU (.app code.projector e₁') field
+  let etaStep (indices : List Nat)
+      (hlow : ∀ i, i ∈ indices → ctorInfo.numParams ≤ i)
+      (hhigh : ∀ i, i ∈ indices → i < F1.size) :
+      (i : Nat) → i ∈ indices → Option Bool × PUnit →
+        RecM (ForInStep (Option Bool × PUnit)) :=
+    fun i hi r => tryEtaStructFieldStep e₁ ctorInfo.induct
+      ctorInfo.numParams F1 i
+      ⟨hlow i hi, hhigh i hi, by
+        change (i - ctorInfo.numParams) % 1 = 0
+        exact Nat.mod_one _⟩ r
+  have etaLoopWF : ∀ (all indices : List Nat)
+      (hsuffix : ∃ pre, pre ++ indices = all)
+      (hlow : ∀ i, i ∈ all → ctorInfo.numParams ≤ i)
+      (hhigh : ∀ i, i ∈ all → i < F1.size) {st : VState},
+      RecM.WF c st
+        (List.forIn'.loop all (etaStep all hlow hhigh) indices
+          ⟨none, PUnit.unit⟩ hsuffix)
+        fun r _ =>
+          (r.1 = none →
+            ∀ i, i ∈ indices → FieldEq (i - ctorInfo.numParams)) ∧
+          r.1 ≠ some true := by
+    intro all indices hsuffix hlow hhigh st
+    induction indices generalizing st with
+    | nil =>
+      simp only [List.forIn'.loop]
+      exact .pure (by simp)
+    | cons i indices ih =>
+      simp only [List.forIn'.loop]
+      simp only [etaStep, tryEtaStructFieldStep]
+      obtain ⟨pre, hprefix⟩ := hsuffix
+      have hiAll : i ∈ all := by
+        rw [← hprefix]
+        simp
+      have hlo := hlow i hiAll
+      have hhi := hhigh i hiAll
+      have hj : i - ctorInfo.numParams < fields.length := by
+        rw [hF1Size, hargsLength, ← hnumParams,
+          ← hfieldsLength] at hhi
+        omega
+      obtain ⟨code, hcode, hprojTr, hargTr⟩ :=
+        hfieldData (i - ctorInfo.numParams) hj
+      have hiEq : ctorInfo.numParams + (i - ctorInfo.numParams) = i :=
+        Nat.add_sub_of_le hlo
+      have hargBound :
+          ctorInfo.numParams + (i - ctorInfo.numParams) < F1.size := by
+        omega
+      have hargTr' : c.TrExprS F1[i] fields[i - ctorInfo.numParams] := by
+        simpa [hiEq] using hargTr hargBound
+      simp only [bind_assoc]
+      refine (isDefEq.WF hprojTr hargTr').bind fun b next _ hb => ?_
+      by_cases hbtrue : b = true
+      · simp only [hbtrue, if_pos, pure_bind]
+        have hcur : FieldEq (i - ctorInfo.numParams) :=
+          ⟨fields[i - ctorInfo.numParams], code,
+            List.getElem?_eq_getElem hj, hcode, hb hbtrue⟩
+        have hsuffixTail : ∃ pre, pre ++ indices = all := by
+          refine ⟨pre ++ [i], ?_⟩
+          simpa [List.append_assoc] using hprefix
+        have htail : RecM.WF c next
+            (List.forIn'.loop all (etaStep all hlow hhigh) indices
+              ⟨none, PUnit.unit⟩ hsuffixTail)
+            (fun r _ =>
+              (r.1 = none →
+                ∀ k, k ∈ i :: indices →
+                  FieldEq (k - ctorInfo.numParams)) ∧
+              r.1 ≠ some true) :=
+          (ih hsuffixTail (st := next)).mono
+          (fun r _ _ hrest => ⟨fun hnone k hk => by
+              rw [List.mem_cons] at hk
+              rcases hk with rfl | hk
+              · exact hcur
+              · exact hrest.1 hnone k hk,
+            hrest.2⟩)
+        simpa only [etaStep, tryEtaStructFieldStep, pure_bind] using htail
+      · simp only [hbtrue]
+        exact .pure (by simp)
+  have hparamsLe : ctorInfo.numParams ≤ F1.size := by
+    rw [hF1Size, hargsLength, ← hnumParams]
+    omega
+  have hlowRange : ∀ i,
+      i ∈ List.range' ctorInfo.numParams
+        (F1.size - ctorInfo.numParams) →
+      ctorInfo.numParams ≤ i := by
+    intro i hi
+    rcases List.mem_range'.mp hi with ⟨j, hj, rfl⟩
+    omega
+  have hhighRange : ∀ i,
+      i ∈ List.range' ctorInfo.numParams
+        (F1.size - ctorInfo.numParams) →
+      i < F1.size := by
+    intro i hi
+    rcases List.mem_range'.mp hi with ⟨j, hj, rfl⟩
+    omega
+  have etaForInWF : ∀ {st : VState}, RecM.WF c st
+      (List.forIn'
+        (List.range' ctorInfo.numParams (F1.size - ctorInfo.numParams))
+        ⟨none, PUnit.unit⟩
+        (etaStep
+          (List.range' ctorInfo.numParams
+            (F1.size - ctorInfo.numParams)) hlowRange hhighRange))
+      (fun r _ => (r.1 = none → ∀ i,
+          i ∈ List.range' ctorInfo.numParams
+            (F1.size - ctorInfo.numParams) →
+          FieldEq (i - ctorInfo.numParams)) ∧
+        r.1 ≠ some true) := by
+    intro st
+    exact etaLoopWF
+      (List.range' ctorInfo.numParams (F1.size - ctorInfo.numParams))
+      (List.range' ctorInfo.numParams (F1.size - ctorInfo.numParams))
+      ⟨[], by simp⟩ hlowRange hhighRange
+  change RecM.WF c _
+    (do
+      let r ← List.forIn'
+        (List.range' ctorInfo.numParams (F1.size - ctorInfo.numParams))
+        ⟨none, PUnit.unit⟩
+        (etaStep
+          (List.range' ctorInfo.numParams
+            (F1.size - ctorInfo.numParams)) hlowRange hhighRange)
+      match r.1 with
+      | none => pure true
+      | some a => pure a)
+    (fun b _ => b = true → c.IsDefEqU e₁' e₂')
+  refine etaForInWF.bind fun r next _ hr => ?_
+  cases hr₁ : r.1 with
+  | some b =>
+    simp only
+    refine .pure fun hbtrue => False.elim <|
+      hr.2 (hr₁.trans (congrArg some hbtrue))
+  | none =>
+    simp only
+    refine .pure fun _ => ?_
+    have hrangeCount :
+        F1.size - ctorInfo.numParams = fields.length := by
+      rw [hF1Size, hargsLength, hnumParams, hfieldsLength]
+      omega
+    have hfieldEq : ∀ j, j < fields.length → FieldEq j := by
+      intro j hj
+      have hjmem : ctorInfo.numParams + j ∈
+          List.range' ctorInfo.numParams
+            (F1.size - ctorInfo.numParams) := by
+        apply List.mem_range'.2
+        exact ⟨j, by simpa [hrangeCount] using hj, by simp⟩
+      simpa using hr.1 hr₁ (ctorInfo.numParams + j) hjmem
+    let projections := artifact.projection.view.projectionArgs levels params
+      (artifact.projection.view.specializedFields levels params).length e₁'
+    have hprojectionCount :
+        (artifact.projection.view.specializedFields levels params).length =
+          fields.length := by
+      simpa [VStructureView.specializedFields] using hfieldsLength.symm
+    have hprojectionsLength : projections.length = fields.length := by
+      dsimp [projections]
+      rw [artifact.projection.view.projectionArgs_length levels params
+        (artifact.projection.view.specializedFields levels params).length
+        e₁' (by simp)]
+      exact hprojectionCount
+    have hpointwise : List.Forall₂
+        (fun a a' => a = a' ∨ c.IsDefEqU a a') projections fields := by
+      apply forall₂_of_getElem? hprojectionsLength
+      intro j projection field hprojection hfield
+      have hj := (List.getElem?_eq_some_iff.mp hfield).1
+      obtain ⟨field', code, hfield', hcode, hdefeq⟩ := hfieldEq j hj
+      have hprojection' : projections[j]? =
+          some (.app code.projector e₁') := by
+        dsimp [projections, VStructureView.projectionArgs]
+        have hjspec : j <
+            (artifact.projection.view.specializedFields levels params).length :=
+          hprojectionCount.symm ▸ hj
+        rw [List.getElem?_map, List.getElem?_take_of_lt hjspec, hcode]
+        rfl
+      have hpEq : projection = .app code.projector e₁' :=
+        Option.some.inj (hprojection.symm.trans hprojection')
+      have hfEq : field = field' :=
+        Option.some.inj (hfield.symm.trans hfield')
+      subst projection
+      subst field
+      exact .inr hdefeq
+    let tailResult := VExpr.instRevAt ctorResult params
+      artifact.projection.view.fields.length
+    have hctorTailShape : VExpr.instRev ctorTail params =
+        VExpr.forallN
+          (artifact.projection.view.specializedFields levels params)
+          tailResult := by
+      simp only [ctorTail, tailResult, VExpr.instRev_forallN_projection,
+        VStructureView.specializedFields, List.length_map]
+      rw [VExpr.instRevAt_map_instL_zipIdx]
+    have hconstructorParamsLength : params.length =
+        artifact.projection.view.constructorParams.length := by
+      exact hparamsLength.trans <| by
+        simpa [VStructureView.constructorParams] using
+          hconstructorShape.2.2.1.symm
+    have hctorHeadPrefix : c.HasType (.const ctorName levels)
+        (VExpr.forallN
+          (artifact.projection.view.constructorParams.map
+            (VExpr.instL levels)) ctorTail) := by
+      simpa [ctorBinders, ctorTail,
+        VInductDecl.NormalizedCtor.declaredBinders,
+        VStructureView.constructorParams, VStructureView.fields,
+        List.map_append, VExpr.forallN_append] using hctorHeadShape
+    have hprefixSpine := hparamCtor.retarget
+      (by simpa using hconstructorParamsLength) ctorTail
+    rw [hctorTailShape] at hprefixSpine
+    have hprefixType := hprefixSpine.hasType_appN hctorHeadPrefix
+    have hprojectionSpine :=
+      VStructureView.ProgramsWF.projectionArgsSpine
+        artifact.projection.programsWF
+        c.Ewf c.Δwf hlevelsWF hlevelsLength hparamsLength
+        ⟨_, hparamsSpine⟩ haStruct tailResult
+    have hprojectionDefEq := hprojectionSpine.defEq_of_pointwise
+      c.Ewf c.Δwf (by simpa [projections] using hpointwise)
+    have happEq := VEnv.IsDefEq.appN_defEq hprefixType
+      hprojectionDefEq
+    have happEqU : c.IsDefEqU
+        (artifact.projection.view.etaRebuild levels params e₁')
+        ((VExpr.const ctorName levels).appN args') := by
+      refine ⟨VExpr.instRev tailResult projections, ?_⟩
+      simpa [VStructureView.etaRebuild, VExpr.appN_append,
+        artifact.constructor_name_eq, hargsSplit] using happEq
+    exact VEnv.IsDefEqU.trans c.Ewf c.Δwf
+      ⟨artifact.projection.view.structureType levels params, heta.symm⟩
+      (VEnv.IsDefEqU.trans c.Ewf c.Δwf happEqU hfullEq)
+
+
+theorem tryEtaStructCore.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryEtaStructCore e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' :=
+  tryEtaStructCore.WF_of_structureEta he₁ he₂
+
+theorem tryEtaStruct.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryEtaStruct e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  simp [tryEtaStruct, orM, toBool]
+  refine (tryEtaStructCore.WF he₁ he₂).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun _ => h rfl; skip]
+  exact (tryEtaStructCore.WF he₂ he₁).mono fun _ _ _ h hb => (h hb).symm
+
+theorem isDefEqApp.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqApp e₁ e₂) fun b _ => b → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEqApp; split <;> [skip; exact .pure nofun]
+  rw [Expr.withApp_eq, Expr.withApp_eq]
+  split <;> [rename_i eq; exact .pure nofun]
+  have ⟨_, he₁'⟩ := AppStack.build <| e₁.mkAppList_getAppArgsList ▸ he₁
+  have ⟨_, he₂'⟩ := AppStack.build <| e₂.mkAppList_getAppArgsList ▸ he₂
+  refine (isDefEq.WF he₁'.tr he₂'.tr).bind fun _ _ _ h => ?_
+  split <;> [skip; exact .pure nofun]
+  let rec loop.WF {s args₁ args₂ f₁ f₂ f₁' f₂' eq i} (l₁ r₁ l₂ r₂)
+      (h₁ : args₁.toList = l₁ ++ r₁) (hi₁ : l₁.length = i)
+      (h₂ : args₂.toList = l₂ ++ r₂) (hi₂ : l₂.length = i)
+      (he₁ : AppStack c.venv c.lparams c.vlctx (.mkAppList f₁ l₁) f₁' r₁)
+      (he₂ : AppStack c.venv c.lparams c.vlctx (.mkAppList f₂ l₂) f₂' r₂)
+      (H1 : c.IsDefEqU f₁' f₂') :
+      RecM.WF c s (loop args₁ args₂ eq i) fun b _ => b →
+        ∀ e₁', c.TrExprS (f₁.mkAppList args₁.toList) e₁' →
+        ∀ e₂', c.TrExprS (f₂.mkAppList args₂.toList) e₂' → c.IsDefEqU e₁' e₂' := by
+    unfold loop; split <;> rename_i h
+    · have hr₁ : r₁.length > 0 := by simp [← Array.length_toList, h₁] at h; omega
+      have hr₂ : r₂.length > 0 := by simp [eq, ← Array.length_toList, h₂] at h; omega
+      let .app (a := a₁) (as := r₁) a1 a2 a3 a4 a5 := he₁
+      let .app (a := a₂) (as := r₂) b1 b2 b3 b4 b5 := he₂
+      simp [
+        show args₁[i] = a₁ by cases args₁; cases h₁; simp [hi₁],
+        show args₂[i] = a₂ by cases args₂; cases h₂; simp [hi₂]]
+      refine (isDefEq.WF a4 b4).bind fun _ _ _ h => ?_
+      split <;> [skip; exact .pure nofun]
+      have H := (H1.of_l c.Ewf c.Δwf a1).appDF <| (h ‹_›).of_l c.Ewf c.Δwf a2
+      exact loop.WF (l₁ ++ [a₁]) r₁ (l₂ ++ [a₂]) r₂
+        (by simp [h₁]) (by simp [hi₁]) (by simp [h₂]) (by simp [hi₂])
+        (by simp [a5]) (by simp [b5]) ⟨_, H⟩
+    · have hr₁ : r₁.length = 0 := by simp [← Array.length_toList, h₁] at h; omega
+      have hr₂ : r₂.length = 0 := by simp [eq, ← Array.length_toList, h₂] at h; omega
+      simp at hr₁ hr₂; subst r₁ r₂; simp at h₁ h₂; subst l₁ l₂
+      refine .pure fun _ _ h1 _ h2 => ?_
+      have u1 := h1.uniq c.Ewf (.refl c.Ewf c.Δwf) he₁.tr
+      have u2 := h2.uniq c.Ewf (.refl c.Ewf c.Δwf) he₂.tr
+      exact u1.trans c.Ewf c.Δwf H1 |>.trans c.Ewf c.Δwf u2.symm
+  refine loop.WF [] _ [] _ (i := 0) (by simp [Expr.getAppArgs_toList]) rfl
+    (by simp [Expr.getAppArgs_toList]) rfl he₁' he₂' (h ‹_›) |>.mono fun _ _ _ h2 hb => ?_
+  simp [Expr.getAppArgs_toList, Expr.mkAppList_getAppArgsList] at h2
+  exact h2 hb _ he₁ _ he₂
+
+theorem isDefEqProofIrrel.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqProofIrrel e₁ e₂) fun b _ => b = .true → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEqProofIrrel
+  refine (inferType.WF he₁).bind fun _ _ _ ⟨_, a1, a2, a3, a4⟩ => ?_
+  refine (isProp.WF a3).bind fun _ _ _ h1 => ?_
+  split <;> [exact .pure nofun; skip]
+  rename_i h; simp at h
+  refine (inferType.WF he₂).bind fun _ _ _ ⟨_, b1, b2, b3, b4⟩ => .toLBoolM ?_
+  refine (isDefEq.WF a3 b3).mono fun _ _ _ h2 hb => ?_
+  exact ⟨_, .proofIrrel (h1 h) a4 (b4.defeqU_r c.Ewf c.Δwf (h2 hb).symm)⟩
+
+theorem cacheFailure.WF {c : VContext} {s : VState} :
+    (cacheFailure e₁ e₂).WF c s fun _ _ => True := by
+  rintro wf _ _ ⟨⟩
+  exact ⟨{ s with toState := _ }, rfl, .rfl, { wf with }, ⟨⟩⟩
+
+theorem tryUnfoldProjApp.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    (tryUnfoldProjApp e).WF c s fun oe _ =>
+    ∀ e₁, oe = some e₁ → c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' := by
+  unfold tryUnfoldProjApp; extract_lets f
+  split <;> [exact .pure nofun; skip]
+  refine (whnfCore.WF he).bind fun _ _ _ h => ?_
+  refine .pure fun _ => ?_
+  split <;> rintro ⟨⟩; exact h
+
+def _root_.Ix.Theory.Named.TypeChecker.ReductionStatus.WF
+    (c : VContext) (e₁' e₂' : VExpr) (allowContinue := false) : ReductionStatus → Prop
+  | .continue e₁ e₂ => allowContinue ∧ c.TrExpr e₁ e₁' ∧ c.TrExpr e₂ e₂'
+  | .unknown e₁ e₂ => c.TrExpr e₁ e₁' ∧ c.TrExpr e₂ e₂'
+  | .bool b => b → c.IsDefEqU e₁' e₂'
+
+theorem _root_.Ix.Theory.Named.TypeChecker.ReductionStatus.WF.defeq
+    (h1 : c.IsDefEqU e₁' e₁'') (h2 : c.IsDefEqU e₂' e₂'')
+    (H : ReductionStatus.WF c e₁' e₂' ac r) : ReductionStatus.WF c e₁'' e₂'' ac r :=
+  match r, H with
+  | .continue .., ⟨a1, a2, a3⟩ =>
+    ⟨a1, a2.defeq c.Ewf c.Δwf h1, a3.defeq c.Ewf c.Δwf h2⟩
+  | .unknown .., ⟨a2, a3⟩ =>
+    ⟨a2.defeq c.Ewf c.Δwf h1, a3.defeq c.Ewf c.Δwf h2⟩
+  | .bool _, h => fun hb => h1.symm.trans c.Ewf c.Δwf (h hb) |>.trans c.Ewf c.Δwf h2
+
+theorem lazyDeltaReductionStep.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    (lazyDeltaReductionStep e₁ e₂).WF c s fun r _ => r.WF c e₁' e₂' true := by
+  unfold lazyDeltaReductionStep
+  refine .getEnv ?_; extract_lets delta cont F1 F2
+  have hdelta {s e e' ci} (he : c.TrExprS e e') (H : isDelta c.env e = some ci) :
+      (delta e).WF c s fun r _ => c.TrExpr r e' := by
+    let ⟨n, h1, ⟨_, h2⟩, ls, h3, _⟩ := isDelta_is_some.1 H
+    have ⟨_, stk⟩ := AppStack.build (e.mkAppList_getAppArgsList ▸ he)
+    have .const a1 a2 a3 := h3 ▸ stk.tr
+    have ⟨b1, b2, b3, b4⟩ := c.trenv.find?_uniq h1 a1
+    refine (unfoldDefinition.WF he).bind fun oe _ _ H => ?_
+    obtain _ | e' := oe; · cases H h1 h2 h3 (a3.trans b3.symm)
+    have ⟨_, _, c1, c2⟩ := H
+    exact (whnfCore.WF c1).mono fun x _ _ h => h.2.defeq c.Ewf c.Δwf c2
+  have hcont {s e₁ e₂} (he₁ : c.TrExpr e₁ e₁') (he₂ : c.TrExpr e₂ e₂') :
+      (cont e₁ e₂).WF c s fun r _ => r.WF c e₁' e₂' true := by
+    let ⟨_, se₁, de₁⟩ := he₁; let ⟨_, se₂, de₂⟩ := he₂
+    refine (quickIsDefEq.WF se₁ se₂).bind fun _ _ _ h => .pure ?_; split
+    · exact ⟨rfl, he₁, he₂⟩
+    · intro; exact de₁.symm.trans c.Ewf c.Δwf (h rfl) |>.trans c.Ewf c.Δwf de₂
+    · nofun
+  split
+  · exact .pure ⟨he₁.trExpr c.Ewf c.Δwf, he₂.trExpr c.Ewf c.Δwf⟩
+  · refine (tryUnfoldProjApp.WF he₂).bind fun _ _ _ h => ?_; split
+    · exact hcont (he₁.trExpr c.Ewf c.Δwf) (h _ rfl).2
+    · exact (hdelta he₁ ‹_›).bind fun _ _ _ h => hcont h (he₂.trExpr c.Ewf c.Δwf)
+  · refine (tryUnfoldProjApp.WF he₁).bind fun _ _ _ h => ?_; split
+    · exact hcont (h _ rfl).2 (he₂.trExpr c.Ewf c.Δwf)
+    · exact (hdelta he₂ ‹_›).bind fun _ _ _ h => hcont (he₁.trExpr c.Ewf c.Δwf) h
+  rename_i dt dt' hd1 hd2; extract_lets ht hs; split <;> [skip; split]
+  · exact (hdelta he₂ ‹_›).bind fun _ _ _ h => hcont (he₁.trExpr c.Ewf c.Δwf) h
+  · exact (hdelta he₁ ‹_›).bind fun _ _ _ h => hcont h (he₂.trExpr c.Ewf c.Δwf)
+  have hF1 {s} : (F1 ⟨⟩).WF c s fun r _ => r.WF c e₁' e₂' true :=
+    (hdelta he₁ ‹_›).bind fun _ _ _ h1 => (hdelta he₂ ‹_›).bind fun _ _ _ h2 => hcont h1 h2
+  refine .get ?_; split <;> [skip; exact hF1]
+  split <;> [skip; exact cacheFailure.WF.lift.bind fun _ _ _ _ => hF1]
+  rename_i h1 h2; simp at h1
+  cases ptrEqConstantInfo_eq h1.1.1.2
+  have ⟨n₁, b1₁, ⟨_, b2₁⟩, ls₁, b3₁, _⟩ := isDelta_is_some.1 hd1
+  have ⟨n₂, b1₂, ⟨_, b2₂⟩, ls₂, b3₂, _⟩ := isDelta_is_some.1 hd2
+  simp [b3₁, b3₂, Expr.constLevels!] at h2
+  have ⟨_, stk₁⟩ := AppStack.build (e₁.mkAppList_getAppArgsList ▸ he₁)
+  have ⟨_, stk₂⟩ := AppStack.build (e₂.mkAppList_getAppArgsList ▸ he₂)
+  have .const (us' := ls₁) c1₁ c2₁ c3₁ := b3₁ ▸ stk₁.tr
+  have .const (us' := ls₂) c1₂ c2₂ c3₂ := b3₂ ▸ stk₂.tr
+  cases (c.trenv.find?_uniq b1₁ c1₁).1
+  cases (c.trenv.find?_uniq b1₂ c1₂).1
+  cases c1₁.symm.trans c1₂
+  have := VEnv.IsDefEq.constDF c1₁
+    (Γ := c.vlctx.toCtx) (.of_mapM_ofLevel c2₁) (.of_mapM_ofLevel c2₂)
+    ((List.mapM_eq_some.1 c2₁).length_eq.symm.trans c3₁)
+    (Level.isEquivList_wf h2 c2₁ c2₂)
+  refine (isDefEqArgs.WF ⟨_, stk₁.tr, _, stk₂.tr, _, this⟩ he₁ he₂).bind fun _ _ _ h => ?_
+  split <;> [skip; exact cacheFailure.WF.lift.bind fun _ _ _ _ => hF1]
+  exact .pure fun _ => h ‹_›
+
+theorem isNatZero_wf {c : VContext} (H : isNatZero e) (h : c.TrExprS e e') : e' = .natZero := by
+  have h1 : c.TrExprS (.lit (.natVal 0)) e' := by
+    simp [isNatZero] at H; obtain H|H := H
+    · have := h.eqv H; exact .lit (this.nat_of_natZero c.Ewf c.hasPrimitives) this
+    · split at H <;> [exact h; cases H]
+  have := TrExprS.lit_has_type (l := .natVal 0) h1
+  exact h1.unique (by trivial) (TrExprS.natLit c.hasPrimitives this 0).1
+
+theorem isNatSuccOf?_wf {c : VContext} (H : isNatSuccOf? e = some e₁)
+    (h : c.TrExprS e e') : ∃ x, c.TrExprS e₁ x ∧ e' = .app .natSucc x := by
+  unfold isNatSuccOf? at H; split at H <;> cases H
+  · rename_i n
+    have := TrExprS.lit_has_type (l := .natVal (n+1)) h
+    refine ⟨_, (TrExprS.natLit c.hasPrimitives this n).1, ?_⟩
+    exact h.unique (by trivial) (TrExprS.natLit c.hasPrimitives this (n+1)).1
+  · let .app a1 a2 a3 a4 := h
+    let .const b1 b2 b3 := a3
+    cases c.hasPrimitives.natSucc b1
+    simp at b3; subst b3; simp at b2; subst b2
+    exact ⟨_, a4, rfl⟩
+
+theorem isDefEqOffset.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    (isDefEqOffset e₁ e₂).WF c s fun b _ => b = .true → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEqOffset; split
+  · rename_i h; simp at h
+    cases isNatZero_wf h.1 he₁; cases isNatZero_wf h.2 he₂
+    exact .pure fun _ => .refl <| he₁.wf c.Ewf c.Δwf
+  · split <;> [skip; exact .pure nofun]
+    obtain ⟨_, a1, rfl⟩ := isNatSuccOf?_wf ‹_› he₁
+    obtain ⟨_, b1, rfl⟩ := isNatSuccOf?_wf ‹_› he₂
+    refine .toLBoolM <| (isDefEqCore.WF a1 b1).mono fun _ _ _ h hb => ?_
+    let ⟨_, de'⟩ := he₁.wf c.Ewf c.Δwf
+    let ⟨_, _, c1, c2⟩ := de'.hasType.1.app_inv c.Ewf c.Δwf
+    exact ⟨_, c1.appDF <| (h hb).of_l c.Ewf c.Δwf c2⟩
+
+theorem lazyDeltaReduction.loop.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    (lazyDeltaReduction.loop e₁ e₂ n).WF c s fun r _ => r.WF c e₁' e₂' := by
+  induction n generalizing s e₁ e₂ e₁' e₂' with | zero => exact .throw | succ n ih
+  unfold loop; extract_lets F1
+  refine (isDefEqOffset.WF he₁ he₂).bind fun _ _ _ h => ?_; split
+  · exact .pure fun hb => h (by simpa using hb)
+  suffices hF1 : ∀ {s}, (F1 ⟨⟩).WF c s fun r _ => r.WF c e₁' e₂' by
+    refine .readThe ?_; split <;> [skip; exact hF1]
+    refine (reduceNat.WF he₁).bind fun _ _ _ h => ?_; split
+    · have ⟨_, a1, a2⟩ := (h _ rfl).2
+      refine (isDefEqCore.WF a1 he₂).bind fun _ _ _ h => .pure fun hb => ?_
+      exact a2.symm.trans c.Ewf c.Δwf (h hb)
+    refine (reduceNat.WF he₂).bind fun _ _ _ h => ?_; split
+    · have ⟨_, a1, a2⟩ := (h _ rfl).2
+      refine (isDefEqCore.WF he₁ a1).bind fun _ _ _ h => .pure fun hb => ?_
+      exact (h hb).trans c.Ewf c.Δwf a2
+    exact hF1
+  intro s; unfold F1; refine .getEnv ?_
+  refine (M.WF.liftExcept reduceNative.WF).lift.bind fun _ _ _ h => ?_
+  split <;> [cases h _ rfl; skip]
+  refine (M.WF.liftExcept reduceNative.WF).lift.bind fun _ _ _ h => ?_
+  split <;> [cases h _ rfl; skip]
+  refine (lazyDeltaReductionStep.WF he₁ he₂).bind fun r _ _ h => ?_
+  obtain r|r|r := r
+  · let ⟨_, ⟨_, a1, a2⟩, ⟨_, b1, b2⟩⟩ := h
+    exact (ih a1 b1).mono fun _ _ _ h => h.defeq a2 b2
+  · exact .pure h
+  · exact .pure h
+
+theorem tryStringLitExpansionCore.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryStringLitExpansionCore e₁ e₂) fun b _ => b = .true → c.IsDefEqU e₁' e₂' := by
+  unfold tryStringLitExpansionCore; iterate 3 split <;> [skip; exact .pure nofun]
+  let .lit _ he₁ := he₁
+  exact .toLBoolM <| isDefEqCore.WF he₁ he₂
+
+theorem tryStringLitExpansion.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (tryStringLitExpansion e₁ e₂) fun b _ => b = .true → c.IsDefEqU e₁' e₂' := by
+  refine (tryStringLitExpansionCore.WF he₁ he₂).bind fun _ _ _ h => ?_
+  split <;> [skip; exact .pure h]
+  exact (tryStringLitExpansionCore.WF he₂ he₁).mono fun _ _ _ h hb => (h hb).symm
+
+theorem isDefEqUnitLike.WF_of_structureEta {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqUnitLike e₁ e₂)
+      fun b _ => b = .true → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEqUnitLike
+  refine (inferType.WF he₁).bind fun _ _ _
+    ⟨ty₁', _aBelow, _aTerm, aType, aTyped⟩ => ?_
+  refine (whnf.WF aType).bind fun normalizedType _ _
+    ⟨_aWhnfBelow, tType', tTypeTr, tTypeEq⟩ => ?_
+  split <;> [skip; exact .pure nofun]
+  rename_i _ familyName hostLevels hhead
+  refine .getEnv ?_
+  refine (M.WF.liftExcept envGet.WF).lift.bind fun _ _ _ hfamily => ?_
+  split <;> [skip; exact .pure nofun]
+  rename_i _ familyDeclName familyLevelParams familyRawType hostNumParams
+    familyAll ctorName familyNumNested familyUnsafe familyReflexive
+  refine (M.WF.liftExcept envGet.WF).lift.bind fun _ _ _ hctor => ?_
+  split <;> [skip; exact .pure nofun]
+  rename_i _ ctorDeclName ctorLevelParams ctorRawType ctorInduct ctorIndex
+    ctorNumParams ctorUnsafe
+  refine (inferType.WF he₂).bind fun _ _ _
+    ⟨ty₂', _bBelow, _bTerm, bType, bTyped⟩ => ?_
+  refine (isDefEqCore.WF tTypeTr bType).mono fun _ _ _ h hb => ?_
+  let familyInfo : InductiveVal := {
+    name := familyDeclName
+    levelParams := familyLevelParams
+    type := familyRawType
+    numParams := hostNumParams
+    numIndices := 0
+    all := familyAll
+    ctors := [ctorName]
+    numNested := familyNumNested
+    isRec := false
+    isUnsafe := familyUnsafe
+    isReflexive := familyReflexive }
+  let constructorInfo : ConstructorVal := {
+    name := ctorDeclName
+    levelParams := ctorLevelParams
+    type := ctorRawType
+    induct := ctorInduct
+    cidx := ctorIndex
+    numParams := ctorNumParams
+    numFields := 0
+    isUnsafe := ctorUnsafe }
+  have hnonrec : c.env.isNonRecStructure familyName = true := by
+    unfold Kernel.Environment.isNonRecStructure
+    rw [hfamily]
+    rfl
+  obtain ⟨artifact⟩ := c.structureEtaReady.resolve familyName familyInfo ctorName
+    constructorInfo hfamily hctor hnonrec
+  have ⟨head', hstack⟩ := AppStack.build <|
+    normalizedType.mkAppList_getAppArgsList ▸ tTypeTr
+  have hheadTr := hstack.tr
+  rw [hhead] at hheadTr
+  let .const (us' := levels) hconst hlevelsMap hlevelsHostLength := hheadTr
+  have hviewFamily := artifact.projection.viewWF.family
+  rw [artifact.projection.name_eq] at hviewFamily
+  rw [hviewFamily] at hconst
+  cases hconst
+  have hlevelsWF : ∀ level ∈ levels,
+      level.WF c.lparams.length :=
+    VLevel.WF.of_mapM_ofLevel hlevelsMap
+  have hsourceUvars :
+      artifact.projection.view.generation.block.sourceType.uvars =
+        artifact.projection.view.uvars :=
+    artifact.projection.view.generation.block.sourceType_uvars_eq
+  have hlevelsLength : levels.length = artifact.projection.view.uvars :=
+    (List.mapM_eq_some.1 hlevelsMap).length_eq.symm.trans
+      (hlevelsHostLength.trans hsourceUvars)
+  have hfamilyHead : c.HasType (.const familyName levels)
+      (artifact.projection.view.familyType.instL levels) :=
+    VEnv.HasType.const hviewFamily hlevelsWF
+      (hlevelsLength.trans hsourceUvars.symm)
+  obtain ⟨resultLevel, hrawResult⟩ := artifact.projection.rawResult_sort
+  let rawParams := artifact.projection.view.generation.block.rawParams.map
+    (VExpr.instL levels)
+  have hfamilyHeadShape : c.HasType (.const familyName levels)
+      (VExpr.forallN rawParams (.sort (resultLevel.inst levels))) := by
+    simpa [rawParams, VStructureView.familyType,
+      VInductDecl.NormalizedChecked.rawType_eq,
+      artifact.projection.view.raw_indices_eq, hrawResult,
+      VExpr.instL_forallN, VExpr.forallN, VExpr.instL] using hfamilyHead
+  have htTypeIsType : c.venv.IsType c.lparams.length c.vlctx.toCtx tType' :=
+    (aTyped.isType c.Ewf.ordered c.Δwf).defeqU_l c.Ewf c.Δwf
+      tTypeEq.symm
+  have normalizedTypeTr : c.TrExprS
+      (normalizedType.getAppFn.mkAppList normalizedType.getAppArgsList)
+      tType' := by
+    rw [normalizedType.mkAppList_getAppArgsList]
+    exact tTypeTr
+  obtain ⟨params, _hparamsTr, hparamsSpine, hfullTr⟩ :=
+    AppStack.toSpineWF_of_isType
+      (f := normalizedType.getAppFn)
+      (args := normalizedType.getAppArgsList)
+      (full' := tType') hstack hfamilyHeadShape
+      normalizedTypeTr htTypeIsType
+  have hparamsLength : params.length = artifact.projection.view.nparams :=
+    hparamsSpine.forallN_sort_length.trans <| by
+      simpa [rawParams] using
+        artifact.projection.view.generation.shape.1
+  have hfamilyShape : artifact.projection.view.familyType.instL levels =
+      VExpr.forallN rawParams (.sort (resultLevel.inst levels)) := by
+    simp [rawParams, VStructureView.familyType,
+      VInductDecl.NormalizedChecked.rawType_eq,
+      artifact.projection.view.raw_indices_eq, hrawResult,
+      VExpr.instL_forallN, VExpr.forallN, VExpr.instL]
+  have hparamsFamily : c.venv.SpineWF c.lparams.length c.vlctx.toCtx
+      (artifact.projection.view.familyType.instL levels) params
+      (.sort (resultLevel.inst levels)) := by
+    rw [hfamilyShape]
+    exact hparamsSpine
+  have hfullStruct : c.TrExprS normalizedType
+      (artifact.projection.view.structureType levels params) := by
+    rw [← normalizedType.mkAppList_getAppArgsList]
+    simpa [VStructureView.structureType,
+      artifact.projection.name_eq] using hfullTr
+  have hfullEq := hfullStruct.uniq c.Ewf (.refl c.Ewf c.Δwf) tTypeTr
+  have hstructTy₁ := VEnv.IsDefEqU.trans c.Ewf c.Δwf hfullEq tTypeEq
+  have hstructTy₂ := VEnv.IsDefEqU.trans c.Ewf c.Δwf hfullEq (h hb)
+  have haStruct := aTyped.defeqU_r c.Ewf c.Δwf hstructTy₁.symm
+  have hbStruct := bTyped.defeqU_r c.Ewf c.Δwf hstructTy₂.symm
+  have heta₁ := artifact.eta c.Δwf hlevelsWF hlevelsLength
+    hparamsLength ⟨_, hparamsFamily⟩ haStruct
+  have heta₂ := artifact.eta c.Δwf hlevelsWF hlevelsLength
+    hparamsLength ⟨_, hparamsFamily⟩ hbStruct
+  have hfieldsLength : artifact.projection.view.fields.length = 0 := by
+    calc
+      artifact.projection.view.fields.length =
+          artifact.projection.constructorInfo.numFields :=
+        artifact.projection.constructor_numFields_eq.symm
+      _ = constructorInfo.numFields :=
+        congrArg ConstructorVal.numFields artifact.constructor_info_eq
+      _ = 0 := rfl
+  have hfields : artifact.projection.view.fields = [] :=
+    List.length_eq_zero_iff.mp hfieldsLength
+  have hrebuild :
+      artifact.projection.view.etaRebuild levels params e₁' =
+        artifact.projection.view.etaRebuild levels params e₂' := by
+    simp [VStructureView.etaRebuild, VStructureView.projectionArgs,
+      VStructureView.specializedFields, hfields]
+  rw [hrebuild] at heta₁
+  exact VEnv.IsDefEqU.trans c.Ewf c.Δwf ⟨_, heta₁.symm⟩ ⟨_, heta₂⟩
+
+theorem isDefEqUnitLike.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqUnitLike e₁ e₂) fun b _ => b = .true → c.IsDefEqU e₁' e₂' :=
+  isDefEqUnitLike.WF_of_structureEta he₁ he₂
+
+theorem isDefEqCore'.WF {c : VContext} {s : VState}
+    (he₁ : c.TrExprS e₁ e₁') (he₂ : c.TrExprS e₂ e₂') :
+    RecM.WF c s (isDefEqCore' e₁ e₂) fun b _ => b = true → c.IsDefEqU e₁' e₂' := by
+  unfold isDefEqCore'; extract_lets F1
+  refine (quickIsDefEq.WF he₁ he₂).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun hb => h (by simpa using hb); skip]
+  refine .readThe ?_
+  suffices ∀ {s}, RecM.WF c s (F1 ⟨⟩) fun b _ => b = true → c.IsDefEqU e₁' e₂' by
+    split <;> [rename_i h1; exact this]
+    refine (whnf.WF he₁).bind fun _ _ _ ⟨_, _, a1, a2⟩ => ?_
+    split <;> [rename_i h2; exact this]
+    refine .pure fun _ => ?_
+    simp [Expr.isConstOf] at h1 h2
+    split at h1 <;> simp at h1; cases h1.2; split at h2 <;> simp at h2; cases h2
+    let .const b1 b2 b3 := he₂
+    let .const c1 c2 c3 := a1
+    cases c.hasPrimitives.boolTrue b1
+    cases c.hasPrimitives.boolTrue c1
+    simp at b3 c3; subst b3 c3; simp at b2 c2; subst b2 c2
+    exact a2.symm
+  intro; unfold F1
+  refine (whnfCore.WF he₁).bind fun _ _ _ ⟨_, e₁', a1, a2⟩ => ?_
+  refine (whnfCore.WF he₂).bind fun _ _ _ ⟨_, e₂', b1, b2⟩ => ?_
+  extract_lets F2
+  refine .mono (Q := fun b _ => b = true → c.IsDefEqU e₁' e₂') ?_ fun _ _ _ h hb =>
+    a2.symm.trans c.Ewf c.Δwf (h (by simpa using hb)) |>.trans c.Ewf c.Δwf b2
+  suffices ∀ {s}, RecM.WF c s (F2 ⟨⟩) fun b _ => b = true → c.IsDefEqU e₁' e₂' by
+    split <;> [skip; exact this]
+    refine (quickIsDefEq.WF a1 b1).bind fun _ _ _ h => ?_
+    split <;> [skip; exact this]
+    exact .pure fun hb => h (by simpa using hb)
+  intro; unfold F2
+  refine (isDefEqProofIrrel.WF a1 b1).bind fun _ _ _ h => ?_
+  split
+  · exact .pure fun hb => h (by simpa using hb)
+  refine (lazyDeltaReduction.loop.WF a1 b1).readThe.bind fun _ _ _ h => ?_; split
+  · cases h.1
+  · exact .pure h
+  have ⟨⟨e₁', c1, c4⟩, ⟨e₂', d1, d4⟩⟩ := h
+  refine .mono (Q := fun b _ => b = true → c.IsDefEqU e₁' e₂') ?_ fun _ _ _ h hb =>
+    c4.symm.trans c.Ewf c.Δwf (h (by simpa using hb)) |>.trans c.Ewf c.Δwf d4
+  extract_lets F3
+  suffices ∀ {s}, RecM.WF c s (F3 ⟨⟩) fun b _ => b = true → c.IsDefEqU e₁' e₂' by
+    split
+    · split <;> [rename_i h2; exact this]
+      refine .pure fun _ => ?_
+      simp at h2; cases h2.1
+      have .const c1 c2 c3 := c1; have .const d1 d2 d3 := d1
+      cases d1.symm.trans c1
+      have := VEnv.IsDefEq.constDF c1
+        (Γ := c.vlctx.toCtx) (.of_mapM_ofLevel c2) (.of_mapM_ofLevel d2)
+        ((List.mapM_eq_some.1 c2).length_eq.symm.trans c3)
+        (Level.isEquivList_wf h2.2 c2 d2)
+      exact this.toU
+    · split <;> [rename_i h; exact this]
+      simp at h; subst h
+      exact .pure fun _ => c1.uniq c.Ewf (.refl c.Ewf c.Δwf) d1
+    · split <;> [rename_i h2; exact this]
+      have .proj c1 c2 := c1; have .proj d1 d2 := d1
+      refine (isDefEq.WF c1 d1).bind fun _ _ _ h => ?_
+      split <;> [skip; exact this]
+      simp at h2; subst h2; clear h
+      exact .pure fun _ => c2.uniq c.Ewf (.refl c.Δwf) d2 (h ‹_›)
+    · exact this
+  intro; unfold F3
+  refine (whnfCore.WF c1).bind fun _ _ _ ⟨_, e₁'', c5, c6⟩ => ?_
+  refine (whnfCore.WF d1).bind fun _ _ _ ⟨_, e₂'', d5, d6⟩ => ?_
+  split
+  · exact (isDefEqCore.WF c5 d5).mono fun _ _ _ h hb =>
+      c6.symm.trans c.Ewf c.Δwf (h (by simpa using hb)) |>.trans c.Ewf c.Δwf d6
+  refine (isDefEqApp.WF c1 d1).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun _ => h ‹_›; skip]
+  refine (tryEtaExpansion.WF c1 d1).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun _ => h ‹_›; skip]
+  refine (tryEtaStruct.WF c1 d1).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun _ => h ‹_›; skip]
+  refine (tryStringLitExpansion.WF c1 d1).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun hb => h (by simpa using hb); skip]
+  refine (isDefEqUnitLike.WF c1 d1).bind fun _ _ _ h => ?_
+  split <;> [exact .pure fun _ => h ‹_›; skip]
+  exact .pure nofun
diff --git a/Ix/Theory/Named/Verify/TypeChecker/Reduce.lean b/Ix/Theory/Named/Verify/TypeChecker/Reduce.lean
new file mode 100644
index 000000000..82daec369
--- /dev/null
+++ b/Ix/Theory/Named/Verify/TypeChecker/Reduce.lean
@@ -0,0 +1,221 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.TypeChecker.Basic
+
+namespace Ix.Theory.Named.TypeChecker.Inner
+open Lean hiding Environment Exception
+open Kernel
+
+theorem reduceNative.WF :
+    (reduceNative env e).WF fun oe => ∀ e₁, oe = some e₁ → False := by
+  unfold reduceNative; split <;> [skip; exact .pure nofun]
+  split <;> [exact .throw; skip]; split <;> [exact .throw; exact .pure nofun]
+
+theorem rawNatLitExt?.WF {c : VContext} (H : rawNatLitExt? e = some n) (he : c.TrExprS e e') :
+    c.venv.contains ``Nat ∧ e' = .natLit n := by
+  have : c.TrExprS (.lit (.natVal n)) e' := by
+    unfold rawNatLitExt? at H; split at H <;> rename_i h
+    · cases H; have := he.eqv h; exact .lit (this.nat_of_natZero c.Ewf c.hasPrimitives) this
+    · unfold Expr.rawNatLit? at H; split at H <;> cases H; exact he
+  have hn := this.lit_has_type
+  exact ⟨hn, this.unique (by trivial) (TrExprS.natLit c.hasPrimitives hn n).1⟩
+
+/-- `checkNatSize` either throws or leaves the state alone, so it is transparent to any
+postcondition that already holds. -/
+theorem checkNatSize.WF {c : VContext} {s : VState} {Q : Unit → VState → Prop} (H : Q () s) :
+    RecM.WF c s (checkNatSize n) Q := by
+  unfold checkNatSize; exact .readThe (by split <;> [exact .throw; exact .pure H])
+
+@[inherit_doc checkNatSize.WF]
+theorem checkCountArg.WF {c : VContext} {s : VState} {Q : Unit → VState → Prop} (H : Q () s) :
+    RecM.WF c s (checkCountArg n op) Q := by
+  unfold checkCountArg; split <;> [exact .throw; exact .pure H]
+
+@[inherit_doc checkNatSize.WF]
+theorem checkLitSize.WF {c : VContext} {s : VState} {Q : Unit → VState → Prop} (H : Q () s) :
+    RecM.WF c s (checkLitSize l) Q := by
+  unfold checkLitSize; split <;> [exact checkNatSize.WF H; exact .pure H]
+
+@[inherit_doc checkNatSize.WF]
+theorem checkNatSizeIf.WF {c : VContext} {s : VState} {Q : Unit → VState → Prop} (H : Q () s) :
+    RecM.WF c s (checkNatSizeIf checkSize n) Q := by
+  unfold checkNatSizeIf; split <;> [exact checkNatSize.WF H; exact .pure H]
+
+@[inherit_doc checkNatSize.WF]
+theorem checkPowSize.WF {c : VContext} {s : VState} {Q : Unit → VState → Prop} (H : Q () s) :
+    RecM.WF c s (checkPowSize base exp) Q := by
+  unfold checkPowSize
+  exact (checkCountArg.WF H).bind fun _ _ _ H =>
+    .readThe (by split <;> [exact .throw; exact .pure H])
+
+@[inherit_doc checkNatSize.WF]
+theorem checkShiftLeftSize.WF {c : VContext} {s : VState} {Q : Unit → VState → Prop} (H : Q () s) :
+    RecM.WF c s (checkShiftLeftSize v shift) Q := by
+  unfold checkShiftLeftSize
+  split <;> [exact (checkCountArg.WF H).bind fun _ _ _ H => checkNatSize.WF H; exact .pure H]
+
+/-- The shared skeleton of the binary `Nat` reductions: reduce both operands to literals, run a
+size `check` that can only throw, and return the literal `f v1 v2`. -/
+theorem reduceBinNatOpCore.WF {c : VContext} {check : Nat → Nat → RecM Unit}
+    (hcheck : ∀ {v1 v2 s'} {Q : Unit → VState → Prop}, Q () s' → RecM.WF c s' (check v1 v2) Q)
+    (he : c.TrExprS (.app (.app (.const fc ls) a) b) e')
+    (hprim : Environment.primitives.contains fc)
+    (heval : c.venv.ReflectsNatNatNat fc f) :
+    RecM.WF c s (do
+        let some v1 := rawNatLitExt? (← whnf a) | return none
+        let some v2 := rawNatLitExt? (← whnf b) | return none
+        check v1 v2
+        return some <| .lit <| .natVal <| f v1 v2)
+      fun oe _ => ∀ e₁, oe = some e₁ →
+        c.FVarsBelow (.app (.app (.const fc ls) a) b) e₁ ∧ c.TrExpr e₁ e' := by
+  let .app hb1 hb2 hf hb := he
+  let .app ha1 ha2 hf ha := hf
+  let .const h1 h2 h3 := hf
+  refine (whnf.WF ha).bind fun a₁ _ _ ⟨a1, _, a2, a3⟩ => ?_
+  split <;> [rename_i v1 h; exact .pure nofun]
+  obtain ⟨hn, rfl⟩ := rawNatLitExt?.WF h a2
+  refine (whnf.WF hb).bind fun b₁ _ _ ⟨b1, _, b2, b3⟩ => ?_
+  split <;> [rename_i v2 h; exact .pure nofun]
+  cases (rawNatLitExt?.WF h b2).2
+  refine (hcheck (Q := fun _ _ => True) trivial).bind fun _ _ _ _ => ?_
+  refine .pure ?_; rintro _ ⟨⟩; refine ⟨fun _ _ _ => trivial, ?_⟩
+  have ⟨ci, c1, _⟩ := c.trenv.find?_iff.2 ⟨_, h1⟩
+  have ⟨_, c3⟩ := c.safePrimitives c1 hprim
+  have ⟨_, d1, d2, d3⟩ := c.trenv.find?_uniq c1 h1
+  simp [c3] at d2; simp [← d2] at h3; simp [h3] at h2; subst h2
+  refine ⟨_, (TrExprS.natLit c.hasPrimitives hn _).1, ?_⟩
+  have := heval ⟨_, h1⟩ v1 v2 |>.instL (U' := c.lparams.length) (ls := []) nofun
+  simp [VExpr.instL] at this
+  refine this.weak0 c.Ewf (Γ := c.vlctx.toCtx) |>.symm.trans c.Ewf c.Δwf ?_
+  have a3 := a3.of_r c.Ewf c.Δwf ha2
+  have b3 := b3.of_r c.Ewf c.Δwf hb2
+  have := ha1.appDF a3 |>.toU.of_r c.Ewf c.Δwf hb1
+  exact ⟨_, .appDF this b3⟩
+
+theorem reduceBinNatOp.WF {c : VContext}
+    (he : c.TrExprS (.app (.app (.const fc ls) a) b) e')
+    (hprim : Environment.primitives.contains fc)
+    (heval : c.venv.ReflectsNatNatNat fc f) :
+    RecM.WF c s (reduceBinNatOp f a b checkSize) fun oe _ => ∀ e₁, oe = some e₁ →
+      c.FVarsBelow (.app (.app (.const fc ls) a) b) e₁ ∧ c.TrExpr e₁ e' := by
+  unfold reduceBinNatOp
+  exact reduceBinNatOpCore.WF (fun H => checkNatSizeIf.WF H) he hprim heval
+
+theorem reducePow.WF {c : VContext}
+    (he : c.TrExprS (.app (.app (.const fc ls) a) b) e')
+    (hprim : Environment.primitives.contains fc)
+    (heval : c.venv.ReflectsNatNatNat fc Nat.pow) :
+    RecM.WF c s (reducePow a b) fun oe _ => ∀ e₁, oe = some e₁ →
+      c.FVarsBelow (.app (.app (.const fc ls) a) b) e₁ ∧ c.TrExpr e₁ e' := by
+  unfold reducePow
+  exact reduceBinNatOpCore.WF (fun H => checkPowSize.WF H) he hprim heval
+
+theorem reduceShiftLeft.WF {c : VContext}
+    (he : c.TrExprS (.app (.app (.const fc ls) a) b) e')
+    (hprim : Environment.primitives.contains fc)
+    (heval : c.venv.ReflectsNatNatNat fc (· <<< ·)) :
+    RecM.WF c s (reduceShiftLeft a b) fun oe _ => ∀ e₁, oe = some e₁ →
+      c.FVarsBelow (.app (.app (.const fc ls) a) b) e₁ ∧ c.TrExpr e₁ e' := by
+  unfold reduceShiftLeft
+  exact reduceBinNatOpCore.WF (fun H => checkShiftLeftSize.WF H) he hprim heval
+
+theorem reduceBinNatPred.WF {c : VContext}
+    (he : c.TrExprS (.app (.app (.const fc ls) a) b) e')
+    (hprim : Environment.primitives.contains fc)
+    (heval : c.venv.ReflectsNatNatBool fc f) :
+    RecM.WF c s (reduceBinNatPred f a b) fun oe _ => ∀ e₁, oe = some e₁ →
+      c.FVarsBelow (.app (.app (.const fc ls) a) b) e₁ ∧ c.TrExpr e₁ e' := by
+  let .app hb1 hb2 hf hb := he
+  let .app ha1 ha2 hf ha := hf
+  let .const h1 h2 h3 := hf
+  unfold reduceBinNatPred
+  refine (whnf.WF ha).bind fun a₁ _ _ ⟨a1, _, a2, a3⟩ => ?_
+  split <;> [rename_i v1 h; exact .pure nofun]; cases (rawNatLitExt?.WF h a2).2
+  refine (whnf.WF hb).bind fun b₁ _ _ ⟨b1, _, b2, b3⟩ => ?_
+  split <;> [rename_i v2 h; exact .pure nofun]; cases (rawNatLitExt?.WF h b2).2
+  refine .pure ?_; rintro _ ⟨⟩; refine ⟨fun _ _ _ => .boolLit, ?_⟩
+  have ⟨ci, c1, _⟩ := c.trenv.find?_iff.2 ⟨_, h1⟩
+  have ⟨_, c3⟩ := c.safePrimitives c1 hprim
+  have ⟨_, d1, d2, d3⟩ := c.trenv.find?_uniq c1 h1
+  simp [c3] at d2; simp [← d2] at h3; simp [h3] at h2; subst h2
+  have := heval ⟨_, h1⟩ v1 v2 |>.instL (U' := c.lparams.length) (ls := []) nofun
+  simp [VExpr.instL] at this
+  refine ⟨_, (TrExprS.boolLit c.hasPrimitives ?_ _).1, ?_⟩
+  · let ⟨_, H⟩ := this
+    exact VExpr.WF.boolLit_has_type c.Ewf c.hasPrimitives (Γ := []) trivial ⟨_, H.hasType.2⟩
+  refine this.weak0 c.Ewf (Γ := c.vlctx.toCtx) |>.symm.trans c.Ewf c.Δwf ?_
+  have a3 := a3.of_r c.Ewf c.Δwf ha2
+  have b3 := b3.of_r c.Ewf c.Δwf hb2
+  have := ha1.appDF a3 |>.toU.of_r c.Ewf c.Δwf hb1
+  exact  ⟨_, .appDF this b3⟩
+
+theorem reduceNat.WF {c : VContext} (he : c.TrExprS e e') :
+    RecM.WF c s (reduceNat e) fun oe _ => ∀ e₁, oe = some e₁ →
+      c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' := by
+  generalize hP : (fun oe => _) = P
+  refine let prims := _; have hprims : Environment.primitives = .ofList prims := rfl; ?_
+  replace hprims {a} : Environment.primitives.contains a ↔ a ∈ prims := by
+    simp [hprims, NameSet.contains, NameSet.ofList]
+  unfold reduceNat; extract_lets nargs F1 fn
+  cases h1 : nargs == 1 <;> simp only [Bool.false_eq_true, ↓reduceIte]
+  · cases nargs == 2 <;> [exact hP ▸ .pure nofun; simp only [↓reduceIte]]
+    split <;> [rename_i f ls a b; exact hP ▸ .pure nofun]
+    have hfun checkSize {g fc G} (hprim : fc ∈ prims)
+        (heval : c.venv.ReflectsNatNatNat fc g) (hG : RecM.WF c s G P) :
+        RecM.WF c s (do if f == fc then {return ← reduceBinNatOp g a b checkSize}; G) P := by
+      split <;> [rename_i h; exact hG]
+      simp at h ⊢; subst h
+      exact hP ▸ reduceBinNatOp.WF he (hprims.2 hprim) heval
+    have hpow {fc G} (hprim : fc ∈ prims)
+        (heval : c.venv.ReflectsNatNatNat fc Nat.pow) (hG : RecM.WF c s G P) :
+        RecM.WF c s (do if f == fc then {return ← reducePow a b}; G) P := by
+      split <;> [rename_i h; exact hG]
+      simp at h ⊢; subst h
+      exact hP ▸ reducePow.WF he (hprims.2 hprim) heval
+    have hshl {fc G} (hprim : fc ∈ prims)
+        (heval : c.venv.ReflectsNatNatNat fc (· <<< ·)) (hG : RecM.WF c s G P) :
+        RecM.WF c s (do if f == fc then {return ← reduceShiftLeft a b}; G) P := by
+      split <;> [rename_i h; exact hG]
+      simp at h ⊢; subst h
+      exact hP ▸ reduceShiftLeft.WF he (hprims.2 hprim) heval
+    have hpred {g fc G} (hprim : fc ∈ prims)
+        (heval : c.venv.ReflectsNatNatBool fc g) (hG : RecM.WF c s G P) :
+        RecM.WF c s (do if f == fc then {return ← reduceBinNatPred g a b}; G) P := by
+      split <;> [rename_i h; exact hG]
+      simp at h ⊢; subst h
+      exact hP ▸ reduceBinNatPred.WF he (hprims.2 hprim) heval
+    apply hfun true (by simp [prims]) c.hasPrimitives.natAdd
+    apply hfun true (by simp [prims]) c.hasPrimitives.natSub
+    apply hfun true (by simp [prims]) c.hasPrimitives.natMul
+    apply hpow (by simp [prims]) c.hasPrimitives.natPow
+    apply hfun false (by simp [prims]) c.hasPrimitives.natGcd
+    apply hfun false (by simp [prims]) c.hasPrimitives.natMod
+    apply hfun false (by simp [prims]) c.hasPrimitives.natDiv
+    apply hpred (by simp [prims]) c.hasPrimitives.natBEq
+    apply hpred (by simp [prims]) c.hasPrimitives.natBLE
+    apply hfun false (by simp [prims]) c.hasPrimitives.natLAnd
+    apply hfun false (by simp [prims]) c.hasPrimitives.natLOr
+    apply hfun false (by simp [prims]) c.hasPrimitives.natXor
+    apply hshl (by simp [prims]) c.hasPrimitives.natShiftLeft
+    apply hfun false (by simp [prims]) c.hasPrimitives.natShiftRight
+    exact hP ▸ .pure nofun
+  · split <;> [rename_i h2; exact hP ▸ .pure nofun]
+    simp [nargs, Expr.getAppNumArgs_eq] at h1; subst fn
+    let .app f a := e; simp [Expr.appFn!, Expr.structuralEq_const] at h2 ⊢; subst h2
+    let .app ha1 ha2 hf ha := he
+    let .const h1 h2 h3 := hf
+    refine (whnf.WF ha).bind fun a₁ _ _ ⟨a1, _, a2, a3⟩ => ?_
+    split <;> [rename_i n h; exact hP ▸ .pure nofun]
+    obtain ⟨hn, rfl⟩ := rawNatLitExt?.WF h a2
+    refine hP ▸ (checkNatSize.WF (Q := fun _ _ => True) trivial).map fun _ _ _ _ => ?_
+    rintro _ ⟨⟩; refine ⟨fun _ _ _ => trivial, ?_⟩
+    have ⟨ci, c1, _⟩ := c.trenv.find?_iff.2 ⟨_, h1⟩
+    have ⟨c2, c3⟩ := c.safePrimitives c1 <| hprims.2 (by simp [prims])
+    have ⟨d1, d2, d3⟩ := c.trenv.find?_uniq c1 h1; cases h2
+    refine have ⟨p1, p2⟩ := TrExprS.natLit c.hasPrimitives hn _; ⟨_, p1, ?_⟩
+    refine p2.toU.symm.trans c.Ewf c.Δwf ?_
+    exact ⟨_, ha1.appDF <| a3.of_r c.Ewf c.Δwf ha2⟩
diff --git a/Ix/Theory/Named/Verify/TypeChecker/WHNF.lean b/Ix/Theory/Named/Verify/TypeChecker/WHNF.lean
new file mode 100644
index 000000000..ab307a02f
--- /dev/null
+++ b/Ix/Theory/Named/Verify/TypeChecker/WHNF.lean
@@ -0,0 +1,275 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.TypeChecker.Reduce
+
+namespace Ix.Theory.Named.TypeChecker.Inner
+open Lean hiding Environment Exception
+
+set_option warn.sorry false in
+theorem reduceRecursor.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (reduceRecursor e) fun oe _ =>
+      ∀ e₁, oe = some e₁ → c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' := sorry
+
+theorem whnfFVar.WF {c : VContext} {s : VState} (he : c.TrExprS (.fvar fv) e') :
+    RecM.WF c s (whnfFVar (.fvar fv) cheapProj) fun e₁ _ =>
+      c.FVarsBelow (.fvar fv) e₁ ∧ c.TrExpr e₁ e' := by
+  refine .getLCtx ?_
+  simp [Expr.fvarId!]; split <;> [skip; exact .pure ⟨.rfl, he.trExpr c.Ewf c.Δwf⟩]
+  rename_i decl h
+  rw [c.trlctx.1.find?_eq_find?_toList] at h
+  have := List.find?_some h; simp at this; subst this
+  let ⟨e', ty', h1, h2, _, h3, _⟩ :=
+    c.trlctx.find?_of_mem c.Ewf (List.mem_of_find?_eq_some h)
+  refine (whnfCore.WF h3).mono fun _ _ _ ⟨h4, h5⟩ => ?_
+  refine ⟨h2.trans h4, h5.defeq c.Ewf c.Δwf ?_⟩
+  refine (TrExprS.fvar h1).uniq c.Ewf ?_ he
+  exact .refl c.Ewf c.Δwf
+
+theorem reduceProj.WF {c : VContext} {s : VState} (he : c.TrExprS (.proj n i e) e') :
+    RecM.WF c s (reduceProj i e cheapProj) fun oe _ =>
+      ∀ e₁, oe = some e₁ → c.FVarsBelow (.proj n i e) e₁ ∧ c.TrExpr e₁ e' := by
+  let .proj (e' := major) heMajor hproj := he
+  obtain ⟨view, levels, params, _hviewName, hsemantic⟩ := hproj
+  obtain ⟨code, hcode, hresult, hprojector⟩ := hsemantic.program
+  have finish {normal : Expr} {state : VState}
+      (hbelow : c.FVarsBelow e normal)
+      (htr : c.TrExpr normal major) :
+      RecM.WF c state
+        (normal.withApp fun mk args => do
+          let .const mkC _ := mk | return none
+          let env ← getEnv
+          let .ctorInfo mkInfo ← env.get mkC | return none
+          return args[mkInfo.numParams + i]?) (fun oe _ =>
+            ∀ e₁, oe = some e₁ →
+              c.FVarsBelow (.proj n i e) e₁ ∧ c.TrExpr e₁ e') := by
+    rw [Expr.withApp_eq]
+    split
+    · rename_i mkC hostLevels hheadShape
+      obtain ⟨runtimeMajor, hnormalS, hnormalEq⟩ := htr
+      have ⟨runtimeHead, hstack⟩ := AppStack.build
+        (normal.mkAppList_getAppArgsList ▸ hnormalS)
+      have hhead := hstack.tr
+      rw [hheadShape] at hhead
+      let .const (us' := runtimeLevels) _hconst _hlevelsMap
+          _hlevelsLength := hhead
+      obtain ⟨runtimeArgs, hargsTr, hfull⟩ := hstack.argsTranslation
+      rw [normal.mkAppList_getAppArgsList] at hfull
+      have hfullEq := hfull.uniq c.Ewf (.refl c.Ewf c.Δwf) hnormalS
+      have hmajorEq := hfullEq.trans c.Ewf c.Δwf hnormalEq
+      refine .getEnv ?_
+      refine (M.WF.liftExcept envGet.WF).lift.bind fun _ci _ _ hfind => ?_
+      split
+      · rename_i mkInfo
+        refine .pure ?_
+        intro selected hselected
+        have hconstructorName : mkC = view.constructorName :=
+          c.Ewf.registeredStructureHeadInversion.constructor_name_inv
+            c.Δwf hsemantic rfl hmajorEq
+        have hnumParams : mkInfo.numParams = view.nparams :=
+          c.projectionReady.constructorNumParams view mkInfo
+            hsemantic.viewWF (by
+              rw [← hconstructorName]
+              exact hfind)
+        have hselectedList :
+            normal.getAppArgsList[mkInfo.numParams + i]? = some selected := by
+          rw [← Expr.getAppArgs_toList, Array.getElem?_toList]
+          exact hselected
+        obtain ⟨runtimeField, hfieldGet, hfieldTr⟩ :=
+          Ix.Theory.Named.List.Forall₂.getElem?_left hargsTr hselectedList
+        have hfieldGetCanonical :
+            runtimeArgs[view.nparams + i]? = some runtimeField := by
+          rw [← hnumParams]
+          exact hfieldGet
+        obtain ⟨alignment⟩ :=
+          c.Ewf.registeredStructureHeadInversion.constructor_inv
+            c.Δwf hsemantic hcode rfl hfieldGetCanonical hmajorEq
+        have hiota := hsemantic.projector_constructor_aligned
+          c.Ewf c.Δwf hcode hprojector alignment
+        have hmajorTyped := hmajorEq.of_r c.Ewf c.Δwf hsemantic.majorType
+        have hprojectorCongr : c.IsDefEqU
+            (.app code.projector
+              (VExpr.appN (.const mkC runtimeLevels) runtimeArgs))
+            (.app code.projector major) :=
+          ⟨_, hprojector.appDF hmajorTyped⟩
+        have hfieldTarget : c.IsDefEqU runtimeField e' := by
+          rw [hresult]
+          exact hiota.symm.trans c.Ewf c.Δwf hprojectorCongr
+        refine ⟨?_, ⟨runtimeField, hfieldTr, hfieldTarget⟩⟩
+        intro P hP hprojFv
+        exact FVarsIn.getAppArgsList (hbelow P hP hprojFv)
+          (List.mem_of_getElem? hselectedList)
+      · exact .pure nofun
+    · exact .pure nofun
+  unfold reduceProj
+  split
+  · refine (whnfCore.WF heMajor).bind fun normal _ _ hnormal => ?_
+    split
+    · obtain ⟨literalMajor, hliteralS, hliteralEq⟩ := hnormal.2
+      let .lit _ hconstructorS := hliteralS
+      refine (whnf.WF hconstructorS).bind fun expanded _ _ hexpanded => ?_
+      have hbelow' : c.FVarsBelow e expanded :=
+        FVarsBelow.trans (fun _ _ _ => FVarsIn.strLitToConstructor)
+          hexpanded.1
+      have htr' := hexpanded.2.defeq c.Ewf c.Δwf hliteralEq
+      exact RecM.WF.pureBind (finish hbelow' htr')
+    · exact RecM.WF.pureBind (finish hnormal.1 hnormal.2)
+  · refine (whnf.WF heMajor).bind fun normal _ _ hnormal => ?_
+    split
+    · obtain ⟨literalMajor, hliteralS, hliteralEq⟩ := hnormal.2
+      let .lit _ hconstructorS := hliteralS
+      refine (whnf.WF hconstructorS).bind fun expanded _ _ hexpanded => ?_
+      have hbelow' : c.FVarsBelow e expanded :=
+        FVarsBelow.trans (fun _ _ _ => FVarsIn.strLitToConstructor)
+          hexpanded.1
+      have htr' := hexpanded.2.defeq c.Ewf c.Δwf hliteralEq
+      exact RecM.WF.pureBind (finish hbelow' htr')
+    · exact RecM.WF.pureBind (finish hnormal.1 hnormal.2)
+
+theorem whnfCore'.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (whnfCore' e cheapProj) fun e₁ _ =>
+      c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' := by
+  unfold whnfCore'; extract_lets F
+  let full := (· matches Expr.fvar _ | .app .. | .letE .. | .proj ..)
+  generalize hP : (fun e₁ (_ : VState) => _) = P
+  have hid {s} : RecM.WF c s (pure e) P := hP ▸ .pure ⟨.rfl, he.trExpr c.Ewf c.Δwf⟩
+  suffices hF : full e → RecM.WF c s (F ⟨⟩) P by
+    split
+    any_goals exact hid
+    any_goals exact hF rfl
+    · let .mdata he := he
+      exact hP ▸ whnfCore'.WF he
+    · refine .getLCtx ?_; split <;> [exact hid; exact hF rfl]
+  simp [F]; refine fun hfull => .get ?_; split
+  · rename_i r eq; refine .stateWF fun wf => hP ▸ .pure ?_
+    have ⟨_, h1, h2, h3⟩ := (wf.whnfCore_wf eq).2.2.2.2 he.fvarsIn
+    refine ⟨h1, h3.defeq c.Ewf c.Δwf ?_⟩
+    exact h2.uniq c.Ewf (.refl c.Ewf c.Δwf) he
+  have hsave {e₁ s} (h1 : c.FVarsBelow e e₁) (h2 : c.TrExpr e₁ e') :
+      (save e cheapProj e₁).WF c s P := by
+    simp [save]
+    split <;> [skip; exact hP ▸ .pure ⟨h1, h2⟩]
+    rintro _ mwf wf a s' ⟨⟩
+    refine let s' := _; ⟨s', rfl, ?_⟩
+    have hic {ic} (hic : WHNFCache.WF c s ic) : WHNFCache.WF c s (ic.insert e e₁) := by
+      intro _ _ h
+      rw [Std.HashMap.getElem?_insert] at h; split at h <;> [cases h; exact hic h]
+      rename_i eq
+      refine .mk c.mlctx.noBV (.eqv h1 eq BEq.rfl) (he.eqv eq) h2 (.eqv eq ?_) ?_ --_ (.eqv h2 eq BEq.rfl) (.eqv eq ?_) ?_
+      · exact he.fvarsIn.mono wf.ngen_wf
+      · exact h2.fvarsIn.mono wf.ngen_wf
+    exact hP ▸ ⟨.rfl, { wf with whnfCore_wf := hic wf.whnfCore_wf }, h1, h2⟩
+  split <;> cases hfull
+  · exact hP ▸ whnfFVar.WF he
+  · rename_i fn arg _; generalize eq : fn.app arg = e at *
+    have ⟨_, stk⟩ := AppStack.build <| e.mkAppList_getAppArgsList ▸ he
+    refine (whnfCore.WF stk.tr).bind fun _ s _ ⟨h1, h2⟩ => ?_
+    split <;> [rename_i name dom body bi _; split]
+    · let rec loop.WF {e e' i rargs f} (H : LambdaBodyN i e' f) (hi : i ≤ rargs.size) :
+        ∃ n f', LambdaBodyN n e' f' ∧ n ≤ rargs.size ∧
+          loop e cheapProj rargs i f = loop.cont e cheapProj rargs n f' := by
+        unfold loop; split
+        · split
+          · refine loop.WF (by simpa [Nat.add_comm] using H.add (.succ .zero)) ‹_›
+          · exact ⟨_, _, H, hi, rfl⟩
+        · exact ⟨_, _, H, hi, rfl⟩
+      refine
+        let ⟨i, f, h3, h4, eq⟩ := loop.WF (e' := .lam name dom body bi) (.succ .zero) <| by
+          simp [← eq, Expr.getAppRevArgs_eq, Expr.getAppArgsRevList]
+        eq ▸ ?_; clear eq
+      simp [Expr.getAppRevArgs_eq] at h4 ⊢
+      obtain ⟨l₁, l₂, h5, rfl⟩ : ∃ l₁ l₂, e.getAppArgsRevList = l₁ ++ l₂ ∧ l₂.length = i :=
+        ⟨_, _, (List.take_append_drop (e.getAppArgsRevList.length - i) ..).symm, by simp; omega⟩
+      simp [loop.cont, h5, List.take_of_length_le]
+      rw [Expr.mkAppRevRange_eq_rev (l₁ := []) (l₂ := l₁) (l₃ := l₂) (by simp) (by rfl) (by rfl)]
+      have br := BetaReduce.inst_reduce (l₁ := l₂.reverse)
+        [] (by simpa using h3) (Expr.instantiateList_append ..) (h := by
+          have := h5 ▸ (c.mlctx.noBV ▸ he.closed).getAppArgsRevList
+          simp [or_imp, forall_and] at this ⊢
+          exact this.2) |>.mkAppRevList (es := l₁)
+      simp [← Expr.mkAppRevList_reverse, ← Expr.mkAppRevList_append, ← h5] at br
+      have := h2.rebuild_mkAppRevList c.Ewf c.Δwf stk.tr <|
+        e.mkAppRevList_getAppArgsRevList ▸ he
+      have ⟨_, a1, a2⟩ := this.beta c.Ewf c.Δwf br
+      refine (whnfCore.WF a1).bind fun _ _ _ ⟨b1, b2⟩ => ?_
+      have hb := e.mkAppRevList_getAppArgsRevList ▸ h1.mkAppRevList
+      exact hsave (hb.trans (.betaReduce br) |>.trans b1) <|
+        b2.defeq c.Ewf c.Δwf a2
+    · refine (reduceRecursor.WF he).bind fun _ _ _ h => ?_
+      split <;> [skip; exact hid]
+      let ⟨h1, _, h2, eq⟩ := h _ rfl
+      refine hP ▸ (whnfCore.WF h2).mono fun _ _ _ ⟨h3, h4⟩ => ?_
+      exact ⟨h1.trans h3, h4.defeq c.Ewf c.Δwf eq⟩
+    · rw [Expr.mkAppRevRange_eq_rev (l₁ := []) (l₃ := [])
+        (by simp [Expr.getAppRevArgs_toList]; rfl) (by rfl) (by simp [Expr.getAppRevArgs_eq])]
+      have {e e₁ : Expr} (hb : c.FVarsBelow e e₁) {es e₀' e'}
+          (hes : c.TrExprS (e.mkAppRevList es) e₀') (he : c.TrExprS e e') (he₁ : c.TrExpr e₁ e') :
+          c.FVarsBelow (e.mkAppRevList es) (e₁.mkAppRevList es) ∧
+          c.TrExpr (e₁.mkAppRevList es) e₀' := by
+        induction es generalizing e₁ e₀' e' with
+        | nil =>
+          refine ⟨hb, he₁.defeq c.Ewf c.Δwf ?_⟩
+          exact he.uniq c.Ewf (.refl c.Ewf c.Δwf) hes
+        | cons _ _ ih =>
+          have .app h1 h2 h3 h4 := hes
+          have ⟨h5, h6⟩ := ih hb h3 he he₁
+          exact ⟨fun _ hP he => ⟨h5 _ hP he.1, he.2⟩,
+            .app c.Ewf c.Δwf h1 h2 h6 (h4.trExpr c.Ewf c.Δwf)⟩
+      have eq := e.mkAppRevList_getAppArgsRevList
+      let ⟨h3, _, h4, eq⟩ := eq ▸ this h1 (eq ▸ he) stk.tr h2
+      refine (whnfCore.WF h4).bind fun _ _ _ ⟨h5, h6⟩ => ?_
+      refine hsave (h3.trans h5) (h6.defeq c.Ewf c.Δwf eq)
+  · let .letE h1 h2 h3 h4 := he
+    refine (whnfCore.WF (h4.inst_let c.Ewf.ordered h3)).bind fun _ _ _ ⟨h1, h2⟩ => ?_
+    exact hsave (.trans (fun _ _ he => he.2.2.instantiate1 he.2.1) h1) h2
+  · refine (reduceProj.WF he).bind fun _ _ _ H => ?_
+    split
+    · let ⟨h1, _, h2, eq⟩ := H _ rfl
+      refine (whnfCore.WF h2).bind fun _ _ _ ⟨h3, h4⟩ => ?_
+      exact hsave (h1.trans h3) (h4.defeq c.Ewf c.Δwf eq)
+    · exact hsave .rfl (he.trExpr c.Ewf c.Δwf)
+
+theorem whnf'.WF {c : VContext} {s : VState} (he : c.TrExprS e e') :
+    RecM.WF c s (whnf' e) fun e₁ _ => c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' := by
+  unfold whnf'; extract_lets F
+  generalize hP : (fun e₁ (_ : VState) => _) = P
+  have hid {s} : RecM.WF c s (pure e) P := hP ▸ .pure ⟨.rfl, he.trExpr c.Ewf c.Δwf⟩
+  suffices hF : RecM.WF c s (F ()) P by
+    split
+    any_goals exact hid
+    any_goals exact hF
+    · let .mdata he := he
+      exact hP ▸ whnf'.WF he
+    · refine .getLCtx ?_; split <;> [exact hid; exact hF]
+  simp [F]; refine .get ?_; split
+  · rename_i r eq; refine .stateWF fun wf => hP ▸ .pure ?_
+    have ⟨_, h1, h2, h3⟩ := (wf.whnf_wf eq).2.2.2.2 he.fvarsIn
+    refine ⟨h1, h3.defeq c.Ewf c.Δwf ?_⟩
+    exact h2.uniq c.Ewf (.refl c.Ewf c.Δwf) he
+  have {e e' s n} (he : c.TrExprS e e') : (loop e n).WF c s fun e₁ _ =>
+      c.FVarsBelow e e₁ ∧ c.TrExpr e₁ e' := by
+    induction n generalizing s e e' with | zero => exact .throw | succ n ih => ?_
+    refine .getEnv <| (whnfCore'.WF he).bind fun e₁ s _ ⟨h1, _, he₁, eq⟩ => ?_
+    refine (M.WF.liftExcept reduceNative.WF).lift.bind fun _ _ _ h3 => ?_
+    split <;> [cases h3 _ rfl; skip]
+    refine (reduceNat.WF he₁).bind fun _ _ _ h3 => ?_; split
+    · exact .pure ⟨.trans h1 (h3 _ rfl).1, (h3 _ rfl).2.defeq c.Ewf c.Δwf eq⟩
+    refine (unfoldDefinition.WF he₁).bind fun _ _ _ H => ?_
+    split <;> [skip; exact .pure ⟨h1, _, he₁, eq⟩]
+    have ⟨a1, _, a2, eq'⟩ := H
+    refine (ih a2).mono fun _ _ _ ⟨b1, b2⟩ => ?_
+    exact ⟨h1.trans <| a1.trans b1, b2.defeq c.Ewf c.Δwf <| eq'.trans c.Ewf c.Δwf eq⟩
+  refine .readThe <| (this he).bind fun e₁ s _ ⟨h1, h2⟩ => ?_
+  rintro _ mwf wf a s' ⟨⟩
+  refine let s' := _; ⟨s', rfl, ?_⟩
+  have hic {ic} (hic : WHNFCache.WF c s ic) : WHNFCache.WF c s (ic.insert e e₁) := by
+    intro _ _ h
+    rw [Std.HashMap.getElem?_insert] at h; split at h <;> [cases h; exact hic h]
+    rename_i eq
+    refine .mk c.mlctx.noBV (.eqv h1 eq BEq.rfl) (he.eqv eq) h2 (.eqv eq ?_) ?_
+    · exact he.fvarsIn.mono wf.ngen_wf
+    · exact h2.fvarsIn.mono wf.ngen_wf
+  exact hP ▸ ⟨.rfl, { wf with whnf_wf := hic wf.whnf_wf }, h1, h2⟩
diff --git a/Ix/Theory/Named/Verify/Typing/ConditionallyTyped.lean b/Ix/Theory/Named/Verify/Typing/ConditionallyTyped.lean
new file mode 100644
index 000000000..80f91f5e1
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Typing/ConditionallyTyped.lean
@@ -0,0 +1,150 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Typing.Lemmas
+
+namespace Ix.Theory.Named
+open VEnv Lean
+
+def ConditionallyTyped
+    (ngen : NameGenerator) (env : VEnv) (Us : List Name) (Δ : VLCtx) (e : Expr) : Prop :=
+  Closed e ∧ FVarsIn ngen.Reserves e ∧ (FVarsIn (· ∈ Δ.fvars) e → ∃ e', TrExprS env Us Δ e e')
+
+theorem ConditionallyTyped.mk {Δ : VLCtx}
+    (noBV : Δ.NoBV) (r : FVarsIn ngen.Reserves e) (H : TrExprS env Us Δ e e') :
+    ConditionallyTyped ngen env Us Δ e := ⟨noBV ▸ H.closed, r, fun _ => ⟨_, H⟩⟩
+
+theorem ConditionallyTyped.mono (H : ngen₁ ≤ ngen₂) :
+    ConditionallyTyped ngen₁ env Us Δ e → ConditionallyTyped ngen₂ env Us Δ e
+  | ⟨h1, h2, h3⟩ => ⟨h1, h2.mono fun _ h => h.mono H, h3⟩
+
+theorem ConditionallyTyped.weakN_inv
+    (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length ((some fv, d) :: Δ))
+    (H : ConditionallyTyped ngen env Us ((some fv, d) :: Δ) e) :
+    ConditionallyTyped ngen env Us Δ e := by
+  refine ⟨H.1, H.2.1, fun H2 => ?_⟩
+  have := H.2.2
+  have ⟨e', h⟩ := H.2.2 H2.fvars_cons
+  exact TrExprS.weakFV_inv henv (.skip_fvar _ _ .refl) (.refl henv hΔ) h H.1 H2
+
+theorem ConditionallyTyped.fresh
+    (henv : Ordered env) (hΔ : VLCtx.WF env Us.length ((some (⟨ngen.curr⟩, deps), d) :: Δ))
+    (H : ConditionallyTyped ngen env Us Δ e) :
+    ConditionallyTyped ngen env Us ((some (⟨ngen.curr⟩, deps), d) :: Δ) e := by
+  refine have ⟨H1, H2, H3⟩ := H; ⟨H1, H2, fun H4 => ?_⟩
+  refine have ⟨_, h⟩ := H3 (H4.mp ?_ H2); ⟨_, h.weakFV henv (.skip_fvar _ _ .refl) hΔ⟩
+  intro _ h1 h2; simp at h1; rcases h1 with rfl | h1
+  · cases Nat.lt_irrefl _ (h2 _ rfl)
+  · exact h1
+
+def ConditionallyHasType
+    (ngen : NameGenerator) (env : VEnv) (Us : List Name) (Δ : VLCtx) (e A : Expr) : Prop :=
+  Closed e ∧ FVarsIn ngen.Reserves e ∧ Closed A ∧ FVarsIn ngen.Reserves A ∧
+    (FVarsIn (· ∈ Δ.fvars) e → ∃ e' A', TrTyping env Us Δ e A e' A')
+
+theorem ConditionallyHasType.mk {Δ : VLCtx}
+    (noBV : Δ.NoBV) (he : TrTyping env Us Δ e A e' A')
+    (re : FVarsIn ngen.Reserves e) (rA : FVarsIn ngen.Reserves A) :
+    ConditionallyHasType ngen env Us Δ e A := by
+  refine ⟨noBV ▸ he.2.1.closed, re, noBV ▸ he.2.2.1.closed, rA, fun _ => ⟨_, _, he.1, he.2⟩⟩
+
+theorem ConditionallyHasType.typed :
+    ConditionallyHasType ngen env Us Δ e A → ConditionallyTyped ngen env Us Δ e
+  | ⟨c1, f1, _, _, H⟩ => ⟨c1, f1, fun h => let ⟨_, _, _, h, _⟩ := H h; ⟨_, h⟩⟩
+
+theorem ConditionallyHasType.mono (H : ngen₁ ≤ ngen₂) :
+    ConditionallyHasType ngen₁ env Us Δ e A → ConditionallyHasType ngen₂ env Us Δ e A
+  | ⟨c1, f1, c2, f2, h'⟩ => ⟨c1, f1.mono fun _ h => h.mono H, c2, f2.mono fun _ h => h.mono H, h'⟩
+
+theorem ConditionallyHasType.weakN_inv
+    (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length ((some fv, d) :: Δ))
+    (H : ConditionallyHasType ngen env Us ((some fv, d) :: Δ) e A) :
+    ConditionallyHasType ngen env Us Δ e A := by
+  have ⟨c1, f1, c2, f2, H⟩ := H
+  refine ⟨c1, f1, c2, f2, fun H4 => ?_⟩
+  have ⟨e', A', h1, h2, h3, h4⟩ := H H4.fvars_cons
+  have W : VLCtx.FVLift Δ ((some fv, d) :: Δ) 0 (0 + d.depth) 0 := .skip_fvar _ _ .refl
+  have ⟨e'', he⟩ := TrExprS.weakFV_inv henv W (.refl henv hΔ) h2 c1 H4
+  have ee := h2.uniq henv (.refl henv hΔ) <| he.weakFV henv W hΔ
+  have := hΔ.2.1 _ _ rfl
+  have : IsFVarUpSet (· ∈ VLCtx.fvars Δ) ((some fv, d) :: Δ) :=
+    ⟨.fvars hΔ.1.fvwf, (hΔ.2.1 _ _ rfl).1.elim⟩
+  have ⟨_, hA⟩ := TrExprS.weakFV_inv henv W (.refl henv hΔ) h3 c2 <| h1 _ this H4
+  have AA := h3.uniq henv (.refl henv hΔ) <| hA.weakFV henv W hΔ
+  have h4 := h4.defeqU_r henv hΔ.toCtx AA |>.defeqU_l henv hΔ.toCtx ee
+  have h4 := (HasType.weakN_iff henv hΔ.toCtx W.toCtx).1 h4
+  refine ⟨_, _, fun P hP he' => ?_, he, hA, h4⟩
+  exact h1 _
+    ⟨(IsFVarUpSet.and_fvars hΔ.1.fvwf).1 hP, fun h => (hΔ.2.1 _ _ rfl).1.elim h.2⟩
+    (he'.mp (fun _ => .intro) he.fvarsIn) |>.mono fun _ => (·.1)
+
+theorem ConditionallyHasType.fresh
+    (henv : Ordered env)
+    (hΔ : VLCtx.WF env Us.length ((some (⟨ngen.curr⟩, deps), d) :: Δ))
+    (H : ConditionallyHasType ngen env Us Δ e A) :
+    ConditionallyHasType ngen env Us ((some (⟨ngen.curr⟩, deps), d) :: Δ) e A := by
+  refine have ⟨c1, f1, c2, f2, H⟩ := H; ⟨c1, f1, c2, f2, fun H4 => ?_⟩
+  have ⟨_, _, h1, h2, h3, h4⟩ := H (H4.mp ?_ f1)
+  · have W : VLCtx.FVLift Δ ((some (⟨ngen.curr⟩, deps), d) :: Δ) 0 (0 + d.depth) 0 :=
+      .skip_fvar _ _ .refl
+    exact ⟨_, _, fun P hP => h1 _ hP.1,
+      h2.weakFV henv W hΔ, h3.weakFV henv W hΔ, h4.weakN henv W.toCtx⟩
+  · intro _ h1 h2; simp at h1; rcases h1 with rfl | h1
+    · cases Nat.lt_irrefl _ (h2 _ rfl)
+    · exact h1
+
+def ConditionallyWHNF
+    (ngen : NameGenerator) (env : VEnv) (Us : List Name) (Δ : VLCtx) (e e₁ : Expr) : Prop :=
+  Closed e ∧ FVarsIn ngen.Reserves e ∧ Closed e₁ ∧ FVarsIn ngen.Reserves e₁ ∧
+    (FVarsIn (· ∈ Δ.fvars) e → ∃ e',
+      FVarsBelow Δ e e₁ ∧ TrExprS env Us Δ e e' ∧ TrExpr env Us Δ e₁ e')
+
+theorem ConditionallyWHNF.mk {Δ : VLCtx}
+    (noBV : Δ.NoBV) (hb : FVarsBelow Δ e e₁)
+    (he : TrExprS env Us Δ e e') (he₁ : TrExpr env Us Δ e₁ e')
+    (re : FVarsIn ngen.Reserves e) (re₁ : FVarsIn ngen.Reserves e₁) :
+    ConditionallyWHNF ngen env Us Δ e e₁ := by
+  refine ⟨noBV ▸ he.closed, re, noBV ▸ he₁.closed, re₁, fun _ => ⟨_, hb, he, he₁⟩⟩
+
+theorem ConditionallyWHNF.mono (H : ngen₁ ≤ ngen₂) :
+    ConditionallyWHNF ngen₁ env Us Δ e A → ConditionallyWHNF ngen₂ env Us Δ e A
+  | ⟨c1, f1, c2, f2, h'⟩ => ⟨c1, f1.mono fun _ h => h.mono H, c2, f2.mono fun _ h => h.mono H, h'⟩
+
+theorem ConditionallyWHNF.weakN_inv
+    (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length ((some fv, d) :: Δ))
+    (H : ConditionallyWHNF ngen env Us ((some fv, d) :: Δ) e e₁) :
+    ConditionallyWHNF ngen env Us Δ e e₁ := by
+  have ⟨c1, f1, c2, f2, H⟩ := H
+  refine ⟨c1, f1, c2, f2, fun H4 => ?_⟩
+  have ⟨e', h1, h2, _, h3, h4⟩ := H H4.fvars_cons
+  have W : VLCtx.FVLift Δ ((some fv, d) :: Δ) 0 (0 + d.depth) 0 := .skip_fvar _ _ .refl
+  have ⟨e'', he⟩ := TrExprS.weakFV_inv henv W (.refl henv hΔ) h2 c1 H4
+  have ee := h2.uniq henv (.refl henv hΔ) <| he.weakFV henv W hΔ
+  have := hΔ.2.1 _ _ rfl
+  have : IsFVarUpSet (· ∈ VLCtx.fvars Δ) ((some fv, d) :: Δ) :=
+    ⟨.fvars hΔ.1.fvwf, (hΔ.2.1 _ _ rfl).1.elim⟩
+  have ⟨_, he₁⟩ := TrExprS.weakFV_inv henv W (.refl henv hΔ) h3 c2 <| h1 _ this H4
+  have ee₁ := h3.uniq henv (.refl henv hΔ) <| he₁.weakFV henv W hΔ
+  have h4 := ee₁.symm.trans henv hΔ.toCtx h4 |>.trans henv hΔ.toCtx ee
+  have h4 := (IsDefEqU.weakN_iff henv hΔ.toCtx W.toCtx).1 h4
+  refine ⟨_, fun P hP he' => ?_, he, _, he₁, h4⟩
+  exact h1 _
+    ⟨(IsFVarUpSet.and_fvars hΔ.1.fvwf).1 hP, fun h => (hΔ.2.1 _ _ rfl).1.elim h.2⟩
+    (he'.mp (fun _ => .intro) he.fvarsIn) |>.mono fun _ => (·.1)
+
+theorem ConditionallyWHNF.fresh
+    (henv : env.WF)
+    (hΔ : VLCtx.WF env Us.length ((some (⟨ngen.curr⟩, deps), d) :: Δ))
+    (H : ConditionallyWHNF ngen env Us Δ e e₁) :
+    ConditionallyWHNF ngen env Us ((some (⟨ngen.curr⟩, deps), d) :: Δ) e e₁ := by
+  refine have ⟨c1, f1, c2, f2, H⟩ := H; ⟨c1, f1, c2, f2, fun H4 => ?_⟩
+  have ⟨_, h1, h2, h3⟩ := H (H4.mp ?_ f1)
+  · have W : VLCtx.FVLift Δ ((some (⟨ngen.curr⟩, deps), d) :: Δ) 0 (0 + d.depth) 0 :=
+      .skip_fvar _ _ .refl
+    exact ⟨_, fun P hP => h1 _ hP.1, h2.weakFV henv W hΔ, h3.weakFV henv W hΔ⟩
+  · intro _ h1 h2; simp at h1; rcases h1 with rfl | h1
+    · cases Nat.lt_irrefl _ (h2 _ rfl)
+    · exact h1
diff --git a/Ix/Theory/Named/Verify/Typing/Expr.lean b/Ix/Theory/Named/Verify/Typing/Expr.lean
new file mode 100644
index 000000000..da146d752
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Typing/Expr.lean
@@ -0,0 +1,146 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Typing.Basic
+import Ix.Theory.Named.Literals
+import Ix.Theory.Named.Projection
+import Ix.Theory.Named.Verify.NameGenerator
+import Ix.Theory.Named.Verify.VLCtx
+import Ix.Theory.Named.Verify.Axioms
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Lean
+
+def Closed : Expr → (k :_:= 0) → Prop
+  | .bvar i, k => i < k
+  | .fvar _, _ | .sort .., _ | .const .., _ | .lit .., _ => True
+  | .app f a, k => Closed f k ∧ Closed a k
+  | .lam _ d b _, k
+  | .forallE _ d b _, k => Closed d k ∧ Closed b (k+1)
+  | .letE _ d v b _, k => Closed d k ∧ Closed v k ∧ Closed b (k+1)
+  | .proj _ _ e, k | .mdata _ e, k => Closed e k
+  | .mvar .., _ => False
+
+nonrec abbrev _root_.Lean.Expr.Closed := @Closed
+
+/-- This is very inefficient, only use for spec purposes -/
+def _root_.Lean.Expr.fvarsList : Expr → List FVarId
+  | .bvar _ | .sort .. | .const .. | .lit .. | .mvar .. => []
+  | .fvar fv => [fv]
+  | .app f a => f.fvarsList ++ a.fvarsList
+  | .lam _ d b _
+  | .forallE _ d b _ => d.fvarsList ++ b.fvarsList
+  | .letE _ d v b _ => d.fvarsList ++ v.fvarsList ++ b.fvarsList
+  | .proj _ _ e | .mdata _ e => e.fvarsList
+
+variable (fvars : FVarId → Prop) in
+def FVarsIn : Expr → Prop
+  | .bvar _ => True
+  | .fvar fv => fvars fv
+  | .sort u => u.hasMVar' = false
+  | .const _ us => ∀ u ∈ us, u.hasMVar' = false
+  | .lit .. => True
+  | .app f a => FVarsIn f ∧ FVarsIn a
+  | .lam _ d b _
+  | .forallE _ d b _ => FVarsIn d ∧ FVarsIn b
+  | .letE _ d v b _ => FVarsIn d ∧ FVarsIn v ∧ FVarsIn b
+  | .proj _ _ e | .mdata _ e => FVarsIn e
+  | .mvar .. => False
+
+nonrec abbrev _root_.Lean.Expr.FVarsIn := @FVarsIn
+
+def VLCtx.FVWF : VLCtx → Prop
+  | [] => True
+  | (ofv, _) :: (Δ : VLCtx) =>
+    VLCtx.FVWF Δ ∧ (∀ fv deps, ofv = some (fv, deps) → fv ∉ Δ.fvars ∧ deps ⊆ Δ.fvars)
+
+variable (env : VEnv) (U : Nat) in
+def VLCtx.WF : VLCtx → Prop
+  | [] => True
+  | (ofv, d) :: (Δ : VLCtx) =>
+    VLCtx.WF Δ ∧ (∀ fv deps, ofv = some (fv, deps) → fv ∉ Δ.fvars ∧ deps ⊆ Δ.fvars) ∧
+    VLocalDecl.WF env U Δ.toCtx d
+
+theorem VLCtx.WF.fvwf : ∀ {Δ}, VLCtx.WF env U Δ → Δ.FVWF
+  | [], h => h
+  | _ :: _, ⟨h1, h2, _⟩ => ⟨h1.fvwf, h2⟩
+
+/-- Verify compatibility surface for Theory's environment-indexed projection
+semantics.  The view, universe instantiation, and parameter spine are hidden
+from existing expression-translation consumers, but each witness is fully
+constrained by `VEnv.TrProj`; no metadata is existentially invented. -/
+def TrProj (env : VEnv) (U : Nat) (Γ : List VExpr)
+    (structName : Name) (idx : Nat) (e result : VExpr) : Prop :=
+  ∃ view levels params,
+    view.name = structName ∧
+      env.TrProj U Γ view levels params idx e result
+
+variable (env : VEnv) (Us : List Name) in
+inductive TrExprS : VLCtx → Expr → VExpr → Prop
+  | bvar : Δ.find? (.inl i) = some (e, A) → TrExprS Δ (.bvar i) e
+  | fvar : Δ.find? (.inr fv) = some (e, A) → TrExprS Δ (.fvar fv) e
+  | sort : VLevel.ofLevel Us u = some u' → TrExprS Δ (.sort u) (.sort u')
+  | const :
+    env.constants c = some ci →
+    us.mapM (VLevel.ofLevel Us) = some us' →
+    us.length = ci.uvars →
+    TrExprS Δ (.const c us) (.const c us')
+  | app :
+    env.HasType Us.length Δ.toCtx f' (.forallE A B) →
+    env.HasType Us.length Δ.toCtx a' A →
+    TrExprS Δ f f' → TrExprS Δ a a' → TrExprS Δ (.app f a) (.app f' a')
+  | lam :
+    env.IsType Us.length Δ.toCtx ty' →
+    TrExprS Δ ty ty' → TrExprS ((none, .vlam ty') :: Δ) body body' →
+    TrExprS Δ (.lam name ty body bi) (.lam ty' body')
+  | forallE :
+    env.IsType Us.length Δ.toCtx ty' →
+    env.IsType Us.length (ty' :: Δ.toCtx) body' →
+    TrExprS Δ ty ty' → TrExprS ((none, .vlam ty') :: Δ) body body' →
+    TrExprS Δ (.forallE name ty body bi) (.forallE ty' body')
+  | letE :
+    env.HasType Us.length Δ.toCtx val' ty' →
+    TrExprS Δ ty ty' → TrExprS Δ val val' →
+    TrExprS ((none, .vlet ty' val') :: Δ) body body' →
+    TrExprS Δ (.letE name ty val body nd) body'
+  | lit : env.ContainsLits l → TrExprS Δ l.toConstructor e → TrExprS Δ (.lit l) e
+  | mdata : TrExprS Δ e e' → TrExprS Δ (.mdata d e) e'
+  | proj : TrExprS Δ e e' →
+    TrProj env Us.length Δ.toCtx s i e' e'' →
+    TrExprS Δ (.proj s i e) e''
+
+def TrExpr (env : VEnv) (Us : List Name) (Δ : VLCtx) (e : Expr) (e' : VExpr) : Prop :=
+  ∃ e₂, TrExprS env Us Δ e e₂ ∧ env.IsDefEqU Us.length Δ.toCtx e₂ e'
+
+/-- Deterministic shadow of `TrExprS`: compute the strict Theory translation
+of an expression syntactically.  Every semantic premise of `TrExprS` only
+validates a translation, it never selects between candidates, so on the
+`TrExprS.IsUnique` fragment this function returns exactly the translation of
+any derivation (`TrExprS.trExprS?_eq`).  The function checks nothing
+semantic: it is meaningful only through that agreement theorem.  The pushed
+`vlet` type is a dummy because `TrExprS` never reads it — `VLCtx.find?`
+returns a let's value, and the type component is existentially discarded. -/
+def trExprS? (Us : List Name) : VLCtx → Expr → Option VExpr
+  | Δ, .bvar i => (Δ.find? (.inl i)).map (·.1)
+  | Δ, .fvar fv => (Δ.find? (.inr fv)).map (·.1)
+  | _, .sort u => (VLevel.ofLevel Us u).map .sort
+  | _, .const c us => (us.mapM (VLevel.ofLevel Us)).map (VExpr.const c)
+  | Δ, .app f a => do return .app (← trExprS? Us Δ f) (← trExprS? Us Δ a)
+  | Δ, .lam _ ty body _ => do
+      let ty' ← trExprS? Us Δ ty
+      return .lam ty' (← trExprS? Us ((none, .vlam ty') :: Δ) body)
+  | Δ, .forallE _ ty body _ => do
+      let ty' ← trExprS? Us Δ ty
+      return .forallE ty' (← trExprS? Us ((none, .vlam ty') :: Δ) body)
+  | Δ, .letE _ _ val body _ => do
+      let val' ← trExprS? Us Δ val
+      trExprS? Us ((none, .vlet (.sort .zero) val') :: Δ) body
+  | _, .lit l => some (.trLiteral l)
+  | Δ, .mdata _ e => trExprS? Us Δ e
+  | _, .proj .. => none
+  | _, .mvar .. => none
diff --git a/Ix/Theory/Named/Verify/Typing/Lemmas.lean b/Ix/Theory/Named/Verify/Typing/Lemmas.lean
new file mode 100644
index 000000000..7e4160ac5
--- /dev/null
+++ b/Ix/Theory/Named/Verify/Typing/Lemmas.lean
@@ -0,0 +1,2636 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Std.AxiomAudit
+import Batteries.Data.String.Lemmas
+import Ix.Theory.Named.Verify.Typing.Expr
+import Ix.Theory.Named.Verify.Expr
+import Ix.Theory.Named.Typing.Strong
+import Ix.Theory.Named.Typing.UniqueTyping
+import Ix.Theory.Named.Reference.Instantiate
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+open Ix.Theory.Named VEnv Lean
+open scoped _root_.List
+
+theorem fvarsIn_iff : FVarsIn P e ↔ (∀ fv ∈ e.fvarsList, P fv) ∧ FVarsIn (fun _ => True) e := by
+  induction e <;> simp [FVarsIn, Expr.fvarsList, *] <;> grind
+
+theorem fvarsIn_iff_hasMVar : FVarsIn (fun _ => True) e ↔ e.hasMVar = false := by
+  rw [Expr.hasMVar, ← Expr.hasExprMVar, ← Expr.hasLevelMVar]; simp
+  induction e <;> simp [FVarsIn, Expr.hasExprMVar', Expr.hasLevelMVar', and_assoc, and_left_comm, *]
+
+theorem fvarsList_eq_nil {e : Expr} : e.fvarsList = [] ↔ e.hasFVar = false := by
+  rw [Expr.hasFVar_eq]
+  induction e <;> simp [Expr.fvarsList, Expr.hasFVar', and_assoc, *]
+
+theorem FVarsIn.mp (H : ∀ fv, P fv → Q fv → R fv) :
+    ∀ {e}, FVarsIn P e → FVarsIn Q e → FVarsIn R e
+  | .bvar _, l, _ | .sort .., l, _ | .const .., l, _ | .lit .., l, _ => l
+  | .fvar _, l, r => H _ l r
+  | .app .., ⟨l1, l2⟩, ⟨r1, r2⟩
+  | .lam .., ⟨l1, l2⟩, ⟨r1, r2⟩
+  | .forallE .., ⟨l1, l2⟩, ⟨r1, r2⟩ => ⟨l1.mp H r1, l2.mp H r2⟩
+  | .letE .., ⟨l1, l2, l3⟩, ⟨r1, r2, r3⟩ => ⟨l1.mp H r1, l2.mp H r2, l3.mp H r3⟩
+  | .proj _ _ e, l, r | .mdata _ e, l, r => l.mp (e := e) H r
+
+theorem FVarsIn.mono (H : ∀ fv, P fv → Q fv) (h : FVarsIn P e) : FVarsIn Q e :=
+  h.mp (fun _ h _ => H _ h) h
+
+theorem Closed.mono (H : k ≤ k') : ∀ {e}, Closed e k → Closed e k'
+  | .bvar _, h => Nat.lt_of_lt_of_le h H
+  | .fvar _, h | .sort .., h | .const .., h | .lit .., h => h
+  | .app .., ⟨h1, h2⟩ => ⟨h1.mono H, h2.mono H⟩
+  | .lam .., ⟨h1, h2⟩
+  | .forallE .., ⟨h1, h2⟩ => ⟨h1.mono H, h2.mono (Nat.succ_le_succ H)⟩
+  | .letE .., ⟨h1, h2, h3⟩ => ⟨h1.mono H, h2.mono H, h3.mono (Nat.succ_le_succ H)⟩
+  | .proj _ _ e, h | .mdata _ e, h => h.mono (e := e) H
+
+theorem FVarsIn.natLitToConstructor : FVarsIn P (.natLitToConstructor n) := by
+  cases n <;> simp [FVarsIn, Expr.natLitToConstructor, Expr.natZero, Expr.natSucc]
+
+theorem Closed.natLitToConstructor : Closed (.natLitToConstructor n) k := by
+  cases n <;> simp [Closed, Expr.natLitToConstructor, Expr.natZero, Expr.natSucc]
+
+theorem FVarsIn.strLitToConstructor : FVarsIn P (.strLitToConstructor s) := by
+  simp [FVarsIn, Expr.strLitToConstructor]
+  induction s.toList <;> simp [*, FVarsIn, Level.hasMVar']
+
+theorem Closed.strLitToConstructor : Closed (.strLitToConstructor s) k := by
+  simp [Closed, Expr.strLitToConstructor]
+  induction s.toList <;> simp [*, Closed]
+
+theorem FVarsIn.toConstructor : ∀ {l : Literal}, FVarsIn P l.toConstructor
+  | .natVal _ => .natLitToConstructor
+  | .strVal _ => .strLitToConstructor
+
+theorem FVarsIn.litType {l : Literal} : FVarsIn P l.type := by
+  cases l <;> simp [FVarsIn, Literal.type]
+
+theorem Closed.toConstructor : ∀ {l : Literal}, Closed l.toConstructor k
+  | .natVal _ => .natLitToConstructor
+  | .strVal _ => .strLitToConstructor
+
+theorem toConstructor : ∀ {l : Literal}, Closed l.toConstructor k
+  | .natVal _ => .natLitToConstructor
+  | .strVal _ => .strLitToConstructor
+
+theorem Closed.litType {l : Literal} : Closed l.type k := by cases l <;> trivial
+
+theorem FVarsIn.fvars_cons :
+    FVarsIn (· ∈ VLCtx.fvars Δ) e → FVarsIn (· ∈ VLCtx.fvars ((ofv, d) :: Δ)) e :=
+  FVarsIn.mono fun a h => by cases ofv <;> simp [h]
+
+theorem FVarsIn.abstract_instantiate1 (h : FVarsIn (· ≠ v) e) :
+    (Expr.instantiate1' e (.fvar v) k).abstract1 v k = e := by
+  induction e generalizing k with simp_all [Expr.instantiate1', Expr.abstract1, FVarsIn]
+  | bvar i =>
+    split <;> [skip; split]
+    · simp [Expr.abstract1, *]
+    · simp [Expr.abstract1, Expr.liftLooseBVars', *]
+    · obtain _|i := i <;> simp [Expr.abstract1] <;> omega
+  | fvar v' => exact Ne.symm h
+
+theorem FVarsIn.abstract_eq_self (h : FVarsIn (· ≠ v) e) (hc : Closed e k) :
+    e.abstract1 v k = e := by
+  induction e generalizing k <;> simp_all [FVarsIn, Closed, Expr.abstract1]
+  exact Ne.symm h
+
+theorem FVarsIn.liftLooseBVars (h : FVarsIn P e) : FVarsIn P (Expr.liftLooseBVars' e s d) := by
+  induction e generalizing s <;> simp_all [FVarsIn, Expr.liftLooseBVars']
+
+theorem FVarsIn.instantiate1_go (h1 : FVarsIn P e) (h2 : FVarsIn P a) :
+    FVarsIn P (Expr.instantiate1' e a k) := by
+  induction e generalizing k <;> simp_all [FVarsIn, Expr.instantiate1']
+  (repeat' split) <;> simp [*, FVarsIn.liftLooseBVars, FVarsIn]
+
+theorem FVarsIn.instantiate1 (h1 : FVarsIn P e) (h2 : FVarsIn P a) :
+    FVarsIn P (Expr.instantiate1' e a) := h1.instantiate1_go h2
+
+theorem FVarsIn.instantiateList (h1 : FVarsIn P e) (h2 : ∀ a ∈ as, FVarsIn P a) (k := 0) :
+    FVarsIn P (Expr.instantiateList e as k) := by
+  induction as generalizing e <;> simp_all [Expr.instantiateList, FVarsIn.instantiate1_go]
+
+theorem FVarsIn.abstract1 (h1 : FVarsIn P e) :
+    FVarsIn P (Expr.abstract1 a e k) := by
+  induction e generalizing k <;> simp_all [FVarsIn, Expr.abstract1]
+  split <;> simp [FVarsIn, *]
+
+theorem FVarsIn.appRevList :
+    FVarsIn P (f.mkAppRevList es) ↔ FVarsIn P f ∧ ∀ e ∈ es, FVarsIn P e := by
+  induction es <;> simp [FVarsIn, and_comm, and_left_comm, *]
+
+theorem Closed.abstract1 (h1 : Closed e k) :
+    Closed (Expr.abstract1 a e k) (k+1) := by
+  induction e generalizing k with simp_all [Closed, Expr.abstract1]
+  | bvar => omega
+  | fvar => split <;> simp [Closed]
+
+theorem Closed.getAppFn {e} (h : Closed e) : Closed e.getAppFn := by
+  unfold Expr.getAppFn; split
+  · exact Closed.getAppFn h.1
+  · exact h
+
+theorem Closed.getAppArgsRevList {e} (h : Closed e)
+    {{a}} (ha : a ∈ e.getAppArgsRevList) : Closed a := by
+  revert a; unfold Expr.getAppArgsRevList; split <;> simp
+  exact ⟨h.2, Closed.getAppArgsRevList h.1⟩
+
+theorem Closed.getAppArgsList {e} (h : Closed e)
+    {{a}} (ha : a ∈ e.getAppArgsList) : Closed a :=
+  h.getAppArgsRevList (by simpa [← Expr.getAppArgsList_reverse])
+
+theorem FVarsIn.getAppArgsRevList {e} (h : FVarsIn P e)
+    {{a}} (ha : a ∈ e.getAppArgsRevList) : FVarsIn P a := by
+  revert a
+  unfold Expr.getAppArgsRevList
+  split <;> simp
+  exact ⟨h.2, FVarsIn.getAppArgsRevList h.1⟩
+
+theorem FVarsIn.getAppArgsList {e} (h : FVarsIn P e)
+    {{a}} (ha : a ∈ e.getAppArgsList) : FVarsIn P a :=
+  h.getAppArgsRevList (by simpa [← Expr.getAppArgsList_reverse])
+
+theorem Closed.looseBVarRange_le : Closed e k → e.looseBVarRange' ≤ k := by
+  induction e generalizing k <;>
+    simp +contextual [*, Closed, Expr.looseBVarRange', Nat.max_le]
+  exact id
+
+theorem Closed.looseBVarRange_zero (H : Closed e) : e.looseBVarRange' = 0 := by
+  simpa using H.looseBVarRange_le
+
+theorem VLocalDecl.WF.hasType : ∀ {d}, VLocalDecl.WF env U (VLCtx.toCtx Δ) d →
+    env.HasType U (VLCtx.toCtx ((ofv, d) :: Δ)) d.value d.type
+  | .vlam _, _ => .bvar .zero
+  | .vlet .., hA => hA
+
+theorem VLocalDecl.is_liftN {Δ : VLCtx} :
+    ∀ {d}, Ctx.LiftN (VLocalDecl.depth d) 0 Δ.toCtx (VLCtx.toCtx ((ofv, d) :: Δ))
+  | .vlam _ => .one
+  | .vlet .. => .zero []
+
+namespace VLCtx
+
+variable! (henv : Ordered env) in
+theorem WF.find?_wf {Δ : VLCtx} (hΔ : WF env U Δ) (H : Δ.find? v = some (e, A)) :
+    env.HasType U Δ.toCtx e A := by
+  let (ofv, d') :: Δ := Δ
+  unfold find? at H; split at H
+  · cases H; exact hΔ.2.2.hasType
+  · simp at H
+    obtain ⟨d'', n', H, rfl, rfl⟩ := H
+    obtain h3 := hΔ.1.find?_wf H
+    exact h3.weakN henv VLocalDecl.is_liftN
+
+theorem WF.toCtx : ∀ {Δ}, WF env U Δ → OnCtx Δ.toCtx (env.IsType U)
+  | [], _ => ⟨⟩
+  | (_, .vlam _) :: _, ⟨hΔ, _, hA⟩ => ⟨hΔ.toCtx, hA⟩
+  | (_, .vlet ..) :: _, ⟨hΔ, _, _⟩ => hΔ.toCtx
+
+/-- A verified local context remains well formed when the global environment
+is extended. -/
+theorem WF.mono (henv : env ≤ env') : ∀ {Δ}, WF env U Δ → WF env' U Δ
+  | [], _ => trivial
+  | (_, d) :: Δ, ⟨hΔ, hfvars, hd⟩ =>
+      ⟨hΔ.mono henv, hfvars, by
+        cases d with
+        | vlam => exact hd.mono henv
+        | vlet => exact hd.mono henv⟩
+
+instance : Coe (WF env U Δ) (OnCtx Δ.toCtx (env.IsType U)) := ⟨(·.toCtx)⟩
+
+theorem WF.fvars_nodup : ∀ {Δ}, WF env U Δ → Δ.fvars.Nodup
+  | [], _ => .nil
+  | (none, _) :: Δ, ⟨hΔ, _, _⟩ => fvars_nodup (Δ := Δ) hΔ
+  | (some (fv, _), _) :: Δ, ⟨hΔ,  h, _⟩ => by
+    suffices fv ∉ fvars Δ from (fvars_nodup hΔ).cons (fun _ h (e:fv=_) => this (e ▸ h))
+    exact (h _ _ rfl).1
+
+theorem liftVar_zero : liftVar 0 k v = v := by cases v <;> simp [liftVar]
+
+inductive FVLift' : VLCtx → VLCtx → Nat → Lift → Nat → Prop
+  | refl : FVLift' Δ Δ 0 .refl 0
+  | skip_fvar (fv d) : FVLift' Δ Δ' 0 n 0 →
+    FVLift' Δ ((some fv, d) :: Δ') 0 (n.skipN d.depth) 0
+  | cons_fvar (fv d) : fv.2 ⊆ Δ.fvars → FVLift' Δ Δ' 0 n 0 →
+    FVLift' ((some fv, d) :: Δ) ((some fv, d.lift' n) :: Δ') 0 (.consN n d.depth) 0
+  | cons_bvar (d) : FVLift' Δ Δ' dk n k →
+    FVLift' ((none, d) :: Δ) ((none, d.lift' (n.consN k)) :: Δ') (dk + 1) n (k + d.depth)
+
+protected theorem FVLift'.toCtx (W : FVLift' Δ Δ' dk n k) :
+    Ctx.Lift' (n.consN k) Δ.toCtx Δ'.toCtx := by
+  induction W with
+  | refl => exact .refl
+  | skip_fvar _ d _ ih => match d with
+    | .vlet .. => exact ih
+    | .vlam A => exact .skip ih
+  | cons_fvar _ d _ _ ih => match d with
+    | .vlet .. => exact ih
+    | .vlam A => exact .cons ih
+  | cons_bvar d _ ih => match d with
+    | .vlet .. => exact ih
+    | .vlam A => exact .cons ih
+
+theorem FVLift'.comp (H1 : FVLift' Δ₁ Δ₂ 0 n₁ 0) (H2 : FVLift' Δ₂ Δ₃ dk n₂ k) :
+    FVLift' Δ₁ Δ₃ dk (n₁.comp n₂) k := by
+  induction H2 generalizing n₁ Δ₁ with
+  | refl => exact H1
+  | skip_fvar _ _ _ ih => simpa [Lift.comp_skipN] using (ih H1).skip_fvar _ _
+  | cons_fvar _ d h1 _ ih => cases H1 with
+    | refl => simpa using (ih .refl).cons_fvar _ _ h1
+    | skip_fvar _ _ h2 => simpa [Lift.skipN_comp_consN] using (ih h2).skip_fvar _ (d.lift' _)
+    | cons_fvar _ d h1 h2 =>
+      simpa [← Lift.consN_comp, ← VLocalDecl.lift'_comp] using (ih h2).cons_fvar _ d h1
+  | cons_bvar d h1 ih => cases H1 with | refl => simpa using h1.cons_bvar _
+
+theorem FVLift'.from_nil : ∀ {Δ : VLCtx}, Δ.NoBV → FVLift' [] Δ 0 (.skipN .refl Δ.toCtx.length) 0
+  | [], _ => .refl
+  | (some _, .vlam _) :: _, H => .skip_fvar _ _ (.from_nil H)
+  | (some _, .vlet _ _) :: _, H => .skip_fvar _ _ (.from_nil H)
+
+theorem FVLift'.fvars_sublist (W : FVLift' Δ Δ' dk n k) : Δ.fvars <+ Δ'.fvars := by
+  induction W with
+  | refl => exact .refl _
+  | skip_fvar _ _ _ ih => exact .cons _ ih
+  | cons_fvar _ _ _ _ ih => exact .cons_cons _ ih
+  | cons_bvar _ _ ih => exact ih
+
+theorem FVLift'.bvars_eq (W : FVLift' Δ Δ' dk n k) : Δ'.bvars = Δ.bvars := by
+  induction W with
+  | refl => rfl
+  | skip_fvar _ _ _ ih => exact ih
+  | cons_fvar _ _ _ _ ih => exact ih
+  | cons_bvar _ _ ih => exact congrArg Nat.succ ih
+
+variable! (henv : VEnv.WF env) in
+theorem FVLift'.wf (W : FVLift' Δ Δ' dk n k) (hΔ' : Δ'.WF env U) : Δ.WF env U := by
+  induction W with
+  | refl => exact hΔ'
+  | skip_fvar _ _ _ ih => exact ih hΔ'.1
+  | cons_fvar _ _ hd W ih =>
+    let ⟨hΔ', h1, h2⟩ := hΔ'
+    refine ⟨ih hΔ', ?_, (VLocalDecl.weak'_iff henv hΔ'.toCtx W.toCtx).1 h2⟩
+    rintro _ _ ⟨⟩; exact ⟨fun h => (h1 _ _ rfl).1 <| W.fvars_sublist.subset h, hd⟩
+  | cons_bvar _ W ih =>
+    let ⟨hΔ', _, h2⟩ := hΔ'
+    exact ⟨ih hΔ', nofun, (VLocalDecl.weak'_iff henv hΔ'.toCtx W.toCtx).1 h2⟩
+
+protected theorem FVLift'.find? (W : FVLift' Δ Δ' dk n k) (hΔ' : Δ'.WF env U)
+    (H : find? Δ v = some (e, A)) :
+    find? Δ' v = some (e.lift' (n.consN k), A.lift' (n.consN k)) := by
+  induction W generalizing v e A with
+  | refl => simp [H]
+  | skip_fvar fv' _ W ih =>
+    let (fv', deps) := fv'; simp [find?]
+    cases v with simp [next]
+    | inl =>
+      refine ⟨_, _, ih hΔ'.1 H, ?_⟩
+      simp [← VExpr.lift'_consN_skipN, ← VExpr.lift'_comp, Lift.comp_skipN]
+    | inr fv =>
+      cases eq : fv' == fv <;> simp
+      · refine ⟨_, _, ih hΔ'.1 H, ?_⟩
+        simp [← VExpr.lift'_consN_skipN, ← VExpr.lift'_comp, Lift.comp_skipN]
+      · refine ((List.pairwise_cons.1 hΔ'.fvars_nodup).1 fv' ?_ rfl).elim
+        exact W.fvars_sublist.subset ((beq_iff_eq ..).1 eq ▸ find?_eq_some.1 ⟨_, H⟩)
+  | cons_fvar fv' d _ W ih =>
+    let (fv', deps) := fv'; revert H; simp [find?]
+    obtain i | fv := v <;> simp [next] <;>
+      [skip; cases eq : fv' == fv <;> simp] <;>
+      [(rintro _ _ H rfl rfl; refine ⟨_, _, ih hΔ'.1 H, ?_⟩);
+       (rintro _ _ H rfl rfl; refine ⟨_, _, ih (v := .inr fv) hΔ'.1 H, ?_⟩);
+       rintro rfl rfl] <;>
+      open VLocalDecl in
+      cases d <;> simp [value, type, depth, lift', VExpr.lift,
+        ← VExpr.lift'_consN_skipN, ← VExpr.lift'_comp]
+  | cons_bvar d _ ih =>
+    simp [find?] at H ⊢
+    obtain ⟨_|i⟩ | fv := v <;> simp [next] at H ⊢ <;>
+      [(obtain ⟨rfl, rfl⟩ := H);
+       (obtain ⟨e, A, H, rfl, rfl⟩ := H
+        refine ⟨_, _, ih (v := .inl i) hΔ'.1 H, ?_⟩);
+       (obtain ⟨e, A, H, rfl, rfl⟩ := H
+        refine ⟨_, _, ih (v := .inr fv) hΔ'.1 H, ?_⟩)] <;>
+      open VLocalDecl in
+      cases d <;> simp [value, type, depth, lift', VExpr.lift,
+        ← VExpr.lift'_consN_skipN, ← VExpr.lift'_comp]
+
+inductive FVLift : VLCtx → VLCtx → Nat → Nat → Nat → Prop
+  | refl : FVLift Δ Δ 0 0 0
+  | skip_fvar (fv d) : FVLift Δ Δ' 0 n 0 → FVLift Δ ((some fv, d) :: Δ') 0 (n + d.depth) 0
+  | cons_bvar (d) : FVLift Δ Δ' dk n k →
+    FVLift ((none, d) :: Δ) ((none, d.liftN n k) :: Δ') (dk + 1) n (k + d.depth)
+
+theorem FVLift.toFVLift' (W : FVLift Δ Δ' dk n k) : FVLift' Δ Δ' dk (.skipN .refl n) k := by
+  induction W with
+  | refl => exact .refl
+  | skip_fvar fv d _ ih => simpa [Lift.skipN_skipN] using ih.skip_fvar fv d
+  | cons_bvar d _ ih =>
+    simpa [← VLocalDecl.lift'_consN_skipN, Lift.skipN_skipN] using ih.cons_bvar d
+
+protected theorem FVLift.toCtx (W : FVLift Δ Δ' dk n k) : Ctx.LiftN n k Δ.toCtx Δ'.toCtx :=
+  Ctx.liftN_iff_lift'.2 W.toFVLift'.toCtx
+
+theorem FVLift.from_nil : ∀ {Δ : VLCtx}, Δ.NoBV → FVLift [] Δ 0 Δ.toCtx.length 0
+  | [], _ => .refl
+  | (some _, .vlam _) :: _, H => .skip_fvar _ _ (.from_nil H)
+  | (some _, .vlet _ _) :: _, H => .skip_fvar _ _ (.from_nil H)
+
+variable! (henv : VEnv.WF env) in
+theorem FVLift.wf (W : FVLift Δ Δ' dk n k) (hΔ' : Δ'.WF env U) : Δ.WF env U :=
+  W.toFVLift'.wf henv hΔ'
+
+theorem FVLift.fvars_suffix (W : FVLift Δ Δ' dk n k) : Δ.fvars <:+ Δ'.fvars := by
+  induction W with
+  | refl => exact List.suffix_refl _
+  | skip_fvar _ _ _ ih => exact ih.trans (List.suffix_cons ..)
+  | cons_bvar _ _ ih => exact ih
+
+protected theorem FVLift.find? (W : FVLift Δ Δ' dk n k) (hΔ' : Δ'.WF env U)
+    (H : find? Δ v = some (e, A)) : find? Δ' v = some (e.liftN n k, A.liftN n k) := by
+  simpa [VExpr.lift'_consN_skipN] using W.toFVLift'.find? hΔ' H
+
+inductive BVLift : (Δ Δ' : VLCtx) → (dn dk n k : Nat) → Prop
+  | refl : BVLift Δ Δ 0 0 0 0
+  | skip (d) : BVLift Δ Δ' dn 0 n 0 → BVLift Δ ((none, d) :: Δ') (dn + 1) 0 (n + d.depth) 0
+  | cons (d) : BVLift Δ Δ' dn dk n k →
+    BVLift ((none, d) :: Δ) ((none, d.liftN n k) :: Δ') dn (dk + 1) n (k + d.depth)
+
+theorem BVLift.toCtx (W : BVLift Δ Δ' dn dk n k) : Ctx.LiftN n k Δ.toCtx Δ'.toCtx := by
+  induction W with
+  | refl => exact .zero []
+  | @skip _ Δ' _ _ d _ ih =>
+    match d with
+    | .vlet .. => exact ih
+    | .vlam A =>
+      generalize hΓ' : VLCtx.toCtx Δ' = Γ' at ih
+      let .zero As eq := ih
+      simp [VLCtx.toCtx, hΓ']
+      exact .zero (A :: As) (eq ▸ rfl)
+  | cons d _ ih =>
+    match d with
+    | .vlet .. => exact ih
+    | .vlam A => exact .succ ih
+
+variable! (henv : VEnv.WF env) in
+theorem BVLift.wf (W : BVLift Δ Δ' dn dk n k) (hΔ' : Δ'.WF env U) : Δ.WF env U := by
+  induction W with
+  | refl => exact hΔ'
+  | skip _ _ ih => exact ih hΔ'.1
+  | cons _ W ih =>
+    let ⟨hΔ', _, h2⟩ := hΔ'
+    exact ⟨ih hΔ', nofun, (VLocalDecl.weakN_iff henv hΔ'.toCtx W.toCtx).1 h2⟩
+
+theorem BVLift.fvars_eq (W : BVLift Δ Δ' dn dk n k) : Δ.fvars = Δ'.fvars := by
+  induction W with
+  | refl => rfl
+  | skip _ _ ih => exact ih
+  | cons _ _ ih => exact ih
+
+protected theorem BVLift.find? (W : BVLift Δ Δ' dn dk n k) (H : find? Δ v = some (e, A)) :
+    find? Δ' (liftVar dn dk v) = some (e.liftN n k, A.liftN n k) := by
+  induction W generalizing v e A with
+  | refl => simp [H, liftVar_zero]
+  | @skip _ Δ' _ fv' _ W ih =>
+    obtain v | fv := v <;> simp [find?, liftVar, next] <;>
+      exact ⟨_, _, ih H, by simp [VExpr.liftN_liftN]⟩
+  | cons d _ ih =>
+    obtain (_ | v) | fv := v <;> simp [liftVar] <;>
+      [ (simp [find?, next] at H ⊢; simp [← H]);
+        split <;> (
+          rename_i h
+          simp [Nat.add_right_comm _ 1, find?, next] at H ⊢
+          obtain ⟨e, A, H, rfl, rfl⟩ := H
+          have := ih H
+          simp [liftVar, h] at this
+          refine ⟨_, _, this, ?_⟩);
+        ( simp [find?, next] at H ⊢
+          obtain ⟨e, A, H, rfl, rfl⟩ := H
+          refine ⟨_, _, ih H, ?_⟩ )] <;>
+      open VLocalDecl in
+      cases d <;> simp [VExpr.lift_liftN', liftN, value, type, depth, VExpr.liftN]
+
+variable (Δ₀ : VLCtx) (e₀ A₀ : VExpr) in
+inductive InstN : Nat → Nat → VLCtx → VLCtx → Prop where
+  | zero : InstN 0 0 ((none, .vlam A₀) :: Δ₀) Δ₀
+  | succ : InstN dk k Γ Γ' → InstN (dk + 1) (k + d.depth) ((none, d)::Γ) ((none, d.inst e₀ k) :: Γ')
+
+protected theorem InstN.toCtx (W : InstN Δ₀ e₀ A₀ dk k Δ₁ Δ) :
+    Ctx.InstN Δ₀.toCtx e₀ A₀ k Δ₁.toCtx Δ.toCtx := by
+  induction W with
+  | zero => exact .zero
+  | @succ _ _ _ _ d _ ih =>
+    match d with
+    | .vlet .. => exact ih
+    | .vlam A => exact .succ ih
+
+variable! (henv : Ordered env) (h₀ : env.HasType U (toCtx Δ₀) e₀ A₀) in
+theorem InstN.wf (W : InstN Δ₀ e₀ A₀ dk k Δ₁ Δ) (hΔ' : Δ₁.WF env U) : Δ.WF env U := by
+  induction W with
+  | zero => exact hΔ'.1
+  | succ W ih => let ⟨hΔ', _, h2⟩ := hΔ'; exact ⟨ih hΔ', nofun, h2.instN henv W.toCtx h₀⟩
+
+theorem InstN.fvars_eq (W : InstN Δ₀ e₀ A₀ dk k Δ₁ Δ) :
+    Δ₁.fvars = Δ₀.fvars ∧ Δ.fvars = Δ₀.fvars := by
+  induction W with
+  | zero => exact ⟨rfl, rfl⟩
+  | succ _ ih => exact ih
+
+variable (Δ₀ : VLCtx) (e₀ A₀ : VExpr) in
+inductive InstLet : Nat → Nat → VLCtx → VLCtx → Prop where
+  | zero : InstLet 0 0 ((none, .vlet A₀ e₀) :: Δ₀) Δ₀
+  | succ : InstLet dk k Γ Γ' → InstLet (dk + 1) (k + d.depth) ((none, d)::Γ) ((none, d) :: Γ')
+
+protected theorem InstLet.toCtx (W : InstLet Δ₀ e₀ A₀ dk k Δ₁ Δ) : Δ₁.toCtx = Δ.toCtx := by
+  induction W with
+  | zero => rfl
+  | @succ _ _ _ _ d _ ih =>
+    match d with
+    | .vlet .. => exact ih
+    | .vlam _ => exact congrArg (_::·) ih
+
+theorem InstLet.wf (W : InstLet Δ₀ e₀ A₀ dk k Δ₁ Δ) (hΔ' : Δ₁.WF env U) : Δ.WF env U := by
+  induction W with
+  | zero => exact hΔ'.1
+  | succ W ih => let ⟨hΔ', _, h2⟩ := hΔ'; exact ⟨ih hΔ', nofun, W.toCtx ▸ h2⟩
+
+theorem InstLet.fvars_eq (W : InstLet Δ₀ e₀ A₀ dk k Δ₁ Δ) :
+    Δ₁.fvars = Δ₀.fvars ∧ Δ.fvars = Δ₀.fvars := by
+  induction W with
+  | zero => exact ⟨rfl, rfl⟩
+  | succ _ ih => exact ih
+
+variable (Δ₀ : VLCtx) (v₀ : FVarId) (d₀ : VLocalDecl) in
+inductive Abstract : Nat → Nat → VLCtx → VLCtx → Prop where
+  | zero : Abstract 0 0 ((some (v₀, deps), d₀) :: Δ₀) ((none, d₀) :: Δ₀)
+  | succ : Abstract dk k Γ Γ' → Abstract (dk + 1) (k + d.depth) ((none, d) :: Γ) ((none, d) :: Γ')
+
+protected theorem Abstract.toCtx (W : Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) : Δ₁.toCtx = Δ.toCtx := by
+  induction W with
+  | zero => cases d₀ <;> rfl
+  | @succ _ _ _ _ d _ ih =>
+    match d with
+    | .vlet .. => exact ih
+    | .vlam A => exact congrArg (_ :: ·) ih
+
+theorem Abstract.wf (W : Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) (hΔ' : Δ₁.WF env U) : Δ.WF env U := by
+  induction W with
+  | zero => exact ⟨hΔ'.1, nofun, hΔ'.2.2⟩
+  | succ W ih => let ⟨hΔ', _, h2⟩ := hΔ'; exact ⟨ih hΔ', nofun, W.toCtx ▸ h2⟩
+
+theorem Abstract.fvars_eq (W : Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) :
+    Δ₁.fvars = v₀ :: Δ₀.fvars ∧ Δ.fvars = Δ₀.fvars := by
+  induction W with
+  | zero => exact ⟨rfl, rfl⟩
+  | succ _ ih => exact ih
+
+theorem Abstract.find?_self (W : Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) :
+    Δ₁.find? (.inr v₀) = some (d₀.value.liftN k, d₀.type.liftN k) := by
+  induction W with simp [find?, next]
+  | succ _ ih => exact ⟨_, _, ih, by simp [VExpr.liftN_liftN]⟩
+
+protected theorem Abstract.find? (W : Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) (h : v ≠ .inr v₀) :
+    Δ.find? v = Δ₁.find? (clear% h; match v with
+      | .inl i => if i < dk then .inl i else if i = dk then .inr v₀ else .inl (i - 1)
+      | .inr v' => .inr v') := by
+  induction W generalizing v with
+  | zero =>
+    obtain (_|i)|v := v <;> simp [find?, next]
+    cases eq : v₀ == v; · simp
+    · simp at h eq; cases h eq.symm
+  | @succ dk k _ _ _ _ ih =>
+    obtain (_|i)|v := v <;> simp [find?, next]
+    · have := @ih (.inl i) nofun; revert this
+      by_cases h : i < dk <;> simp +contextual [h]
+      by_cases h : i = dk <;> simp +contextual [h]
+      obtain _|i := i <;> [omega; simp]
+    · simp [ih h]
+
+theorem instL_eq_map (Δ : VLCtx) : Δ.instL ls = Δ.map (fun (ofv, d) => (ofv, d.instL ls)) := by
+  induction Δ <;> simp [instL, *]
+
+@[simp] theorem instL_toCtx (Δ : VLCtx) : (Δ.instL ls).toCtx = Δ.toCtx.map (·.instL ls) := by
+  induction Δ with
+  | nil => rfl
+  | cons head => obtain ⟨_, _|_⟩ := head <;> rw [instL, VLocalDecl.instL] <;> simp [toCtx, *]
+
+variable! (hls : ∀ l ∈ (ls : List _), VLevel.WF U l) in
+protected theorem WF.instL : ∀ {Δ}, VLCtx.WF env ls.length Δ →
+    VLCtx.WF env U (Δ.instL ls)
+  | [], _ => ⟨⟩
+  | (_, d) :: Δ, ⟨h1, h2, h3⟩ =>
+    ⟨h1.instL, by simpa [instL_eq_map, fvars, Function.comp_def] using h2,
+      by simpa using h3.instL hls⟩
+
+theorem find?_instL : find? Δ v = some (e, A) →
+    find? (Δ.instL ls) v = some (e.instL ls, A.instL ls) := by
+  induction Δ generalizing v e A with
+  | nil => nofun
+  | cons d Δ ih =>
+    simp [find?, instL]; split <;> simp
+    · rintro rfl rfl; cases d.2 <;> exact ⟨rfl, by simp [VLocalDecl.instL, VLocalDecl.type]⟩
+    · rintro e A h rfl rfl
+      exact ⟨_, _, ih h, by cases d.2 <;> simp [VLocalDecl.instL, VLocalDecl.depth]⟩
+
+variable (env : VEnv) (U) in
+inductive SortList : VLCtx → List VLevel → Prop
+  | nil : SortList Δ []
+  | cons : SortList Δ ls → env.HasType U Δ.toCtx A (.sort u) →
+    SortList ((some fv, .vlam A) :: Δ) (u :: ls)
+
+end VLCtx
+
+theorem TrProj.weak' (henv : env.Ordered) (W : Ctx.Lift' n Γ Γ')
+    (H : TrProj env U Γ s i e e') :
+    TrProj env U Γ' s i (e.lift' n) (e'.lift' n) := by
+  obtain ⟨view, levels, params, hname, hproj⟩ := H
+  exact ⟨view, levels, params.map (fun param => param.lift' n),
+    hname, hproj.weak' henv W⟩
+
+theorem TrProj.weakN (henv : env.Ordered) (W : Ctx.LiftN n k Γ Γ')
+    (H : TrProj env U Γ s i e e') :
+    TrProj env U Γ' s i (e.liftN n k) (e'.liftN n k) := by
+  simpa [VExpr.lift'_consN_skipN] using
+    H.weak' henv (Ctx.liftN_iff_lift'.1 W)
+
+/-! ## Replaying closed metadata types -/
+
+variable (env : VEnv) (Us : List Name) in
+/-- The syntax-directed fragment used by kernel declaration types. Unlike
+`TrExprS`, this relation records only the representation translation; the
+typing premises are recovered from a well-formed Theory expression by
+`TrTypeExpr.to_trExprS`. Keeping the two concerns separate lets replay
+fixtures reuse the declaration's real `WF` proof instead of re-running a
+fragile type-synthesis tactic at every application and pi node. -/
+inductive TrTypeExpr : VLCtx → Expr → VExpr → Prop where
+  | bvar : Δ.find? (.inl i) = some (e, A) → TrTypeExpr Δ (.bvar i) e
+  | sort : VLevel.ofLevel Us u = some u' → TrTypeExpr Δ (.sort u) (.sort u')
+  | const :
+    env.constants c = some ci →
+    us.mapM (VLevel.ofLevel Us) = some us' →
+    us.length = ci.uvars →
+    TrTypeExpr Δ (.const c us) (.const c us')
+  | app : TrTypeExpr Δ f f' → TrTypeExpr Δ a a' →
+      TrTypeExpr Δ (.app f a) (.app f' a')
+  | mdata : TrTypeExpr Δ e e' → TrTypeExpr Δ (.mdata data e) e'
+  | forallE : TrTypeExpr Δ ty ty' →
+      TrTypeExpr ((none, .vlam ty') :: Δ) body body' →
+      TrTypeExpr Δ (.forallE name ty body bi) (.forallE ty' body')
+
+/-- Add the `TrExprS` typing premises to a structural metadata translation.
+The source grammar is deliberately restricted to the forms that can occur in
+the normalized types of constants emitted by the inductive compiler. -/
+theorem TrTypeExpr.to_trExprS
+    (H : TrTypeExpr env Us Δ e e')
+    (henv : env.Ordered)
+    (hΔ : OnCtx Δ.toCtx (env.IsType Us.length))
+    (hwf : e'.WF env Us.length Δ.toCtx) : TrExprS env Us Δ e e' := by
+  induction H with
+  | bvar h => exact .bvar h
+  | sort h => exact .sort h
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app _ _ ihf iha =>
+    obtain ⟨A, B, htf, hta⟩ := hwf.app_inv henv hΔ
+    exact .app htf hta (ihf hΔ ⟨_, htf⟩) (iha hΔ ⟨_, hta⟩)
+  | mdata _ ih => exact .mdata (ih hΔ hwf)
+  | forallE _ _ ihty ihbody =>
+    obtain ⟨_, hwf⟩ := hwf
+    obtain ⟨hty, hbody⟩ := VEnv.HasType.forallE_inv henv hwf
+    obtain ⟨u, hty⟩ := hty
+    obtain ⟨v, hbody⟩ := hbody
+    exact .forallE ⟨u, hty⟩ ⟨v, hbody⟩
+      (ihty hΔ ⟨_, hty⟩) (ihbody ⟨hΔ, ⟨u, hty⟩⟩ ⟨_, hbody⟩)
+
+#guard_named_axioms Ix.Theory.Named.TrTypeExpr.to_trExprS [propext, Classical.choice, Quot.sound]
+
+variable! (henv : Ordered env) in
+theorem TrExprS.weakFV' (W : VLCtx.FVLift' Δ Δ' dk n k) (hΔ' : Δ'.WF env Us.length)
+    (H : TrExprS env Us Δ e e') : TrExprS env Us Δ' e (e'.lift' (n.consN k)) := by
+  induction H generalizing Δ' dk k with
+  | bvar h1 => exact .bvar (W.find? hΔ' h1)
+  | fvar h1 => exact .fvar (W.find? hΔ' h1)
+  | sort h1 => exact .sort h1
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app h1 h2 _ _ ih1 ih2 =>
+    exact .app (h1.weak' henv W.toCtx) (h2.weak' henv W.toCtx) (ih1 W hΔ') (ih2 W hΔ')
+  | lam h1 _ _ ih1 ih2 =>
+    have h1 := h1.weak' henv W.toCtx
+    exact .lam h1 (ih1 W hΔ') (ih2 (W.cons_bvar _) ⟨hΔ', nofun, h1⟩)
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    have h1 := h1.weak' henv W.toCtx
+    have h2 := h2.weak' henv W.toCtx.cons
+    exact .forallE h1 h2 (ih1 W hΔ') (ih2 (W.cons_bvar _) ⟨hΔ', nofun, h1⟩)
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    have h1 := h1.weak' henv W.toCtx
+    exact .letE h1 (ih1 W hΔ') (ih2 W hΔ') (ih3 (W.cons_bvar _) ⟨hΔ', nofun, h1⟩)
+  | lit h1 _ ih => exact .lit h1 (ih W hΔ')
+  | mdata _ ih => exact .mdata (ih W hΔ')
+  | proj _ h2 ih => exact .proj (ih W hΔ') (h2.weak' henv W.toCtx)
+
+variable! (henv : WF env) in
+theorem TrExpr.weakFV' (W : VLCtx.FVLift' Δ Δ' dk n k) (hΔ' : Δ'.WF env Us.length)
+    (H : TrExpr env Us Δ e e') : TrExpr env Us Δ' e (e'.lift' (n.consN k)) :=
+  let ⟨_, H1, H2⟩ := H
+  ⟨_, H1.weakFV' henv W hΔ', H2.weak' henv W.toCtx⟩
+
+variable! (henv : Ordered env) in
+theorem TrExprS.weakFV (W : VLCtx.FVLift Δ Δ' dk n k) (hΔ' : Δ'.WF env Us.length)
+    (H : TrExprS env Us Δ e e') : TrExprS env Us Δ' e (e'.liftN n k) := by
+  simpa [VExpr.lift'_consN_skipN] using H.weakFV' henv W.toFVLift' hΔ'
+
+variable! (henv : WF env) in
+theorem TrExpr.weakFV (W : VLCtx.FVLift Δ Δ' dk n k) (hΔ' : Δ'.WF env Us.length)
+    (H : TrExpr env Us Δ e e') : TrExpr env Us Δ' e (e'.liftN n k) :=
+  let ⟨_, H1, H2⟩ := H
+  ⟨_, H1.weakFV henv W hΔ', H2.weakN henv W.toCtx⟩
+
+variable! (henv : Ordered env) in
+theorem TrExprS.weakBV (W : VLCtx.BVLift Δ Δ' dn dk n k)
+    (H : TrExprS env Us Δ e e') : TrExprS env Us Δ' (e.liftLooseBVars' dk dn) (e'.liftN n k) := by
+  induction H generalizing Δ' dk k with
+  | bvar h1 => exact .bvar (W.find? h1)
+  | fvar h1 => exact .fvar (W.find? h1)
+  | sort h1 => exact .sort h1
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app h1 h2 _ _ ih1 ih2 =>
+    exact .app (h1.weakN henv W.toCtx) (h2.weakN henv W.toCtx) (ih1 W) (ih2 W)
+  | lam h1 _ _ ih1 ih2 =>
+    exact .lam (h1.weakN henv W.toCtx) (ih1 W) (ih2 (W.cons _))
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    exact .forallE (h1.weakN henv W.toCtx) (h2.weakN henv W.toCtx.succ) (ih1 W) (ih2 (W.cons _))
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    exact .letE (h1.weakN henv W.toCtx) (ih1 W) (ih2 W) (ih3 (W.cons _))
+  | lit h1 _ ih =>
+    refine .lit h1 (Expr.liftLooseBVars_eq_self ?_ ▸ ih W :)
+    exact Closed.toConstructor.looseBVarRange_le
+  | mdata _ ih => exact .mdata (ih W)
+  | proj _ h2 ih => exact .proj (ih W) (h2.weakN henv W.toCtx)
+
+variable! (henv : WF env) in
+theorem TrExpr.weakBV (W : VLCtx.BVLift Δ Δ' dn dk n k)
+    (H : TrExpr env Us Δ e e') : TrExpr env Us Δ' (e.liftLooseBVars' dk dn) (e'.liftN n k) :=
+  let ⟨_, H1, H2⟩ := H
+  ⟨_, H1.weakBV henv W, H2.weakN henv W.toCtx⟩
+
+variable! (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U)) in
+theorem HasType.skips (W : Ctx.LiftN n k Γ Γ')
+    (h1 : env.HasType U Γ' e A) (h2 : e.Skips n k) : ∃ B, env.HasType U Γ' e B ∧ B.Skips n k :=
+  IsDefEq.skips henv hΓ' W h1 h2 h2
+
+theorem TrProj.weak'_inv (henv : VEnv.WF env) (hΓ' : OnCtx Γ' (env.IsType U))
+    (W : Ctx.Lift' l Γ Γ') :
+    TrProj env U Γ' s i (e.lift' l) e' →
+      ∃ e', TrProj env U Γ s i e e' := by
+  rintro ⟨view, levels, params, hname, hproj⟩
+  obtain ⟨params', result, hresult⟩ :=
+    henv.registeredStructureHeadInversion.weak'_inv hΓ' W hproj
+  exact ⟨result, view, levels, params', hname, hresult⟩
+
+theorem TrProj.defeqDFC (henv : VEnv.WF env) (hΓ : env.IsDefEqCtx U [] Γ₁ Γ₂)
+    (he : env.IsDefEqU U Γ₁ e₁ e₂) (H : TrProj env U Γ₁ s i e₁ e') :
+    ∃ e', TrProj env U Γ₂ s i e₂ e' := by
+  obtain ⟨view, levels, params, hname, hproj⟩ := H
+  have he₂ : env.HasType U Γ₂ e₂
+      (view.structureType levels params) :=
+    (hproj.majorType.defeqU_l henv hΓ.isType he).defeqDFC
+      henv.ordered hΓ
+  obtain ⟨result, hresult⟩ :=
+    hproj.defeqDFC henv.ordered hΓ he₂
+  exact ⟨result, view, levels, params, hname, hresult⟩
+
+theorem TrProj.mono {env env' : VEnv} (henv : env ≤ env')
+    (H : TrProj env U Γ s i e e') : TrProj env' U Γ s i e e' := by
+  obtain ⟨view, levels, params, hname, hproj⟩ := H
+  exact ⟨view, levels, params, hname, hproj.mono henv⟩
+
+variable! {env env' : VEnv} (henv : env ≤ env') in
+theorem TrExprS.mono (H : TrExprS env Us Δ e e') : TrExprS env' Us Δ e e' := by
+  induction H with
+  | bvar h1 => exact .bvar h1
+  | fvar h1 => exact .fvar h1
+  | sort h1 => exact .sort h1
+  | const h1 h2 h3 => exact .const (henv.1 h1) h2 h3
+  | app h1 h2 _ _ ih1 ih2 => exact .app (h1.mono henv) (h2.mono henv) ih1 ih2
+  | lam h1 _ _ ih1 ih2 => exact .lam (h1.mono henv) ih1 ih2
+  | forallE h1 h2 _ _ ih1 ih2 => exact .forallE (h1.mono henv) (h2.mono henv) ih1 ih2
+  | letE h1 _ _ _ ih1 ih2 ih3 => exact .letE (h1.mono henv) ih1 ih2 ih3
+  | lit h1 _ ih => refine .lit (h1.mono henv) ih
+  | mdata _ ih => exact .mdata ih
+  | proj _ h2 ih => exact .proj ih (h2.mono henv)
+
+variable! {env env' : VEnv} (henv : env ≤ env') in
+theorem TrExpr.mono (H : TrExpr env Us Δ e e') : TrExpr env' Us Δ e e' :=
+  let ⟨_, H1, H2⟩ := H; ⟨_, H1.mono henv, H2.mono henv⟩
+
+variable! (env : VEnv) (U : Nat) in
+inductive VLCtx.IsDefEq : VLCtx → VLCtx → Prop
+  | nil : VLCtx.IsDefEq [] []
+  | cons {Δ₁ Δ₂ : VLCtx} :
+    VLCtx.IsDefEq Δ₁ Δ₂ →
+    (∀ fv deps, ofv = some (fv, deps) → fv ∉ Δ₁.fvars ∧ deps ⊆ Δ₁.fvars) →
+    VLocalDecl.IsDefEq env U Δ₁.toCtx d₁ d₂ →
+    VLCtx.IsDefEq ((ofv, d₁) :: Δ₁) ((ofv, d₂) :: Δ₂)
+
+variable! (henv : Ordered env) in
+theorem VLCtx.IsDefEq.refl : ∀ {Δ}, VLCtx.WF env U Δ → VLCtx.IsDefEq env U Δ Δ
+  | [], _ => .nil
+  | (_, _) :: _, ⟨h1, h2, h3⟩ => .cons (IsDefEq.refl h1) h2 (.refl henv h1.toCtx h3)
+
+theorem VLCtx.IsDefEq.defeqCtx : VLCtx.IsDefEq env U Δ₁ Δ₂ → env.IsDefEqCtx U [] Δ₁.toCtx Δ₂.toCtx
+  | .nil => .zero
+  | .cons h1 _ (.vlam h2) => .succ h1.defeqCtx h2
+  | .cons h1 _ (.vlet ..) => h1.defeqCtx
+
+theorem VLCtx.IsDefEq.fvars : VLCtx.IsDefEq env U Δ₁ Δ₂ → Δ₁.fvars = Δ₂.fvars
+  | .nil => by simp
+  | .cons (ofv := none) h1 h2 _ => h1.fvars
+  | .cons (ofv := some fv) h1 h2 _ => by simp [h1.fvars]
+
+/-- Definitionally equal verified local contexts have bound-variable entries
+in exactly the same positions. -/
+theorem VLCtx.IsDefEq.bvars : VLCtx.IsDefEq env U Δ₁ Δ₂ → Δ₁.bvars = Δ₂.bvars
+  | .nil => rfl
+  | .cons (ofv := none) h1 _ _ => by
+      simp only [VLCtx.bvars, h1.bvars]
+  | .cons (ofv := some _) h1 _ _ => by
+      simp only [VLCtx.bvars, h1.bvars]
+
+theorem VLCtx.IsDefEq.wf : VLCtx.IsDefEq env U Δ₁ Δ₂ → VLCtx.WF env U Δ₁
+  | .nil => ⟨⟩
+  | .cons h1 h2 h3 => ⟨h1.wf, h2, h3.wf⟩
+
+theorem VLCtx.IsDefEq.mono (henv : env ≤ env') :
+    VLCtx.IsDefEq env U Δ₁ Δ₂ → VLCtx.IsDefEq env' U Δ₁ Δ₂
+  | .nil => .nil
+  | .cons h₁ h₂ h₃ => .cons (h₁.mono henv) h₂ (h₃.mono henv)
+
+/-- Definitionally equal verified contexts whose free-variable slots use the
+same identifiers.  Dependency metadata may differ because normalization can
+change the syntactic free-variable list of a definitionally equal local type;
+that metadata is irrelevant to Theory lookup and typing. -/
+inductive VLCtx.IsDefEqFVars (env : VEnv) (U : Nat) : VLCtx → VLCtx → Prop
+  | nil : IsDefEqFVars env U [] []
+  | cons_bvar :
+    IsDefEqFVars env U Δ₁ Δ₂ →
+    VLocalDecl.IsDefEq env U Δ₁.toCtx d₁ d₂ →
+    IsDefEqFVars env U ((none, d₁) :: Δ₁) ((none, d₂) :: Δ₂)
+  | cons_fvar :
+    IsDefEqFVars env U Δ₁ Δ₂ →
+    VLocalDecl.IsDefEq env U Δ₁.toCtx d₁ d₂ →
+    IsDefEqFVars env U
+      ((some (fv, deps₁), d₁) :: Δ₁)
+      ((some (fv, deps₂), d₂) :: Δ₂)
+
+theorem VLCtx.IsDefEq.toFVars :
+    VLCtx.IsDefEq env U Δ₁ Δ₂ → VLCtx.IsDefEqFVars env U Δ₁ Δ₂
+  | .nil => .nil
+  | .cons (ofv := none) h₁ _ h₃ => .cons_bvar h₁.toFVars h₃
+  | .cons (ofv := some _) h₁ _ h₃ => .cons_fvar h₁.toFVars h₃
+
+theorem VLCtx.IsDefEqFVars.defeqCtx :
+    VLCtx.IsDefEqFVars env U Δ₁ Δ₂ →
+      env.IsDefEqCtx U [] Δ₁.toCtx Δ₂.toCtx
+  | .nil => .zero
+  | .cons_bvar h₁ (.vlam h₂) => .succ h₁.defeqCtx h₂
+  | .cons_bvar h₁ (.vlet ..) => h₁.defeqCtx
+  | .cons_fvar h₁ (.vlam h₂) => .succ h₁.defeqCtx h₂
+  | .cons_fvar h₁ (.vlet ..) => h₁.defeqCtx
+
+theorem VLCtx.IsDefEqFVars.find?_uniq (henv : VEnv.WF env)
+    (hΔ : VLCtx.IsDefEqFVars env U Δ₁ Δ₂)
+    (H₁ : Δ₁.find? v = some (e₁, A₁))
+    (H₂ : Δ₂.find? v = some (e₂, A₂)) :
+    env.IsDefEqU U Δ₁.toCtx A₁ A₂ ∧
+      env.IsDefEq U Δ₁.toCtx e₁ e₂ A₁ := by
+  induction hΔ generalizing v e₁ e₂ A₁ A₂ with
+  | nil => simp [VLCtx.find?] at H₁
+  | cons_bvar hΔ hd ih =>
+      revert H₁ H₂
+      simp only [VLCtx.find?]
+      split
+      · rintro ⟨⟩ ⟨⟩
+        cases hd with
+        | vlam h => exact ⟨⟨_, h.weak henv⟩, .bvar .zero⟩
+        | vlet h₁ h₂ => exact ⟨⟨_, h₂⟩, h₁⟩
+      · simp
+        rintro d₁' n₁' H₁' rfl rfl d₂' n₂' H₂' rfl rfl
+        obtain ⟨h₂, h₃⟩ := ih H₁' H₂'
+        cases hd with
+        | vlam => exact ⟨h₂.weakN henv .one, h₃.weak henv⟩
+        | vlet => simpa [VLocalDecl.depth] using ⟨h₂, h₃⟩
+  | @cons_fvar Δ₁ Δ₂ d₁ d₂ fv deps₁ deps₂ hΔ hd ih =>
+      revert H₁ H₂
+      simp only [VLCtx.find?]
+      cases same : fv == (match v with | .inl _ => fv | .inr fv' => fv') <;>
+        simp only [VLCtx.next]
+      all_goals
+        cases v with
+        | inl i =>
+            simp
+            rintro d₁' n₁' H₁' rfl rfl d₂' n₂' H₂' rfl rfl
+            obtain ⟨h₂, h₃⟩ := ih H₁' H₂'
+            cases hd with
+            | vlam => exact ⟨h₂.weakN henv .one, h₃.weak henv⟩
+            | vlet => simpa [VLocalDecl.depth] using ⟨h₂, h₃⟩
+        | inr fv' =>
+            simp only [same]
+            split
+            · rintro ⟨⟩ ⟨⟩
+              cases hd with
+              | vlam h => exact ⟨⟨_, h.weak henv⟩, .bvar .zero⟩
+              | vlet h₁ h₂ => exact ⟨⟨_, h₂⟩, h₁⟩
+            · simp
+              rintro d₁' n₁' H₁' rfl rfl d₂' n₂' H₂' rfl rfl
+              obtain ⟨h₂, h₃⟩ := ih H₁' H₂'
+              cases hd with
+              | vlam => exact ⟨h₂.weakN henv .one, h₃.weak henv⟩
+              | vlet => simpa [VLocalDecl.depth] using ⟨h₂, h₃⟩
+
+variable! (henv : Ordered env) in
+theorem VLCtx.IsDefEq.symm : VLCtx.IsDefEq env U Δ₁ Δ₂ → VLCtx.IsDefEq env U Δ₂ Δ₁
+  | .nil => .nil
+  | .cons h1 h2 h3 =>
+    .cons h1.symm (by simpa [h1.fvars] using h2) (h3.symm.defeqDFC henv h1.defeqCtx)
+
+variable! (henv : VEnv.WF env) in
+theorem VLCtx.IsDefEq.find?_uniq (hΔ : VLCtx.IsDefEq env U Δ₁ Δ₂)
+    (H1 : Δ₁.find? v = some (e₁, A₁)) (H2 : Δ₂.find? v = some (e₂, A₂)) :
+    env.IsDefEqU U Δ₁.toCtx A₁ A₂ ∧ env.IsDefEq U Δ₁.toCtx e₁ e₂ A₁ := by
+  let .cons hΔ h1 h2 := hΔ
+  match h2 with
+  | .vlam (type₁ := A₁) (type₂ := A₂) h2 =>
+    revert H1 H2; unfold VLCtx.find?; split
+    · rintro ⟨⟩ ⟨⟩; exact ⟨⟨_, h2.weak henv⟩, .bvar .zero⟩
+    · simp
+      rintro d₁' n₁' H1' rfl rfl d₂' n₂' H2' rfl rfl
+      obtain ⟨h2, h3⟩ := find?_uniq hΔ H1' H2'
+      exact ⟨h2.weakN henv .one, h3.weak henv⟩
+  | .vlet h3 h4 =>
+    revert H1 H2; unfold VLCtx.find?; split
+    · rintro ⟨⟩ ⟨⟩; exact ⟨⟨_, h4⟩, h3⟩
+    · simp
+      rintro d₁' n₁' H1' rfl rfl d₂' n₂' H2' rfl rfl
+      simpa [VLocalDecl.depth, VLCtx.toCtx] using find?_uniq hΔ H1' H2'
+
+theorem VLCtx.IsDefEq.find?_defeqDFC (hΔ : VLCtx.IsDefEq env U Δ₁ Δ₂)
+    (H : Δ₁.find? v = some (e₁, A₁)) :
+    ∃ e₂ A₂, Δ₂.find? v = some (e₂, A₂) := by
+  let .cons hΔ _ _ := hΔ
+  revert H; unfold VLCtx.find?; split
+  · exact fun _ => ⟨_, _, rfl⟩
+  · simp; rintro e A H rfl rfl
+    obtain ⟨_, _, H⟩ := find?_defeqDFC hΔ H
+    exact ⟨_, _, _, _, H, rfl, rfl⟩
+
+theorem TrExprS.closed (H : TrExprS env Us Δ e e') : Closed e Δ.bvars := by
+  induction H with
+  | @bvar e A Δ i h1 =>
+    simp [Closed]
+    induction Δ generalizing i e A with
+    | nil => cases h1
+    | cons d Δ ih =>
+      match d, i with
+      | (none, _), 0 => exact Nat.succ_pos _
+      | (none, _), _ + 1 =>
+        simp [VLCtx.find?, VLCtx.next, bind] at h1
+        obtain ⟨_, _, h1, rfl, rfl⟩ := h1
+        exact Nat.succ_lt_succ (ih h1)
+      | (some _, _), _ =>
+        simp [VLCtx.find?, VLCtx.next, bind] at h1
+        obtain ⟨_, _, h1, rfl, rfl⟩ := h1
+        exact ih h1
+  | fvar | sort | const | lit | mdata => trivial
+  | app _ _ _ _ ih1 ih2
+  | lam _ _ _ ih1 ih2
+  | forallE _ _ _ _ ih1 ih2 => exact ⟨ih1, ih2⟩
+  | letE _ _ _ _ ih1 ih2 ih3 => exact ⟨ih1, ih2, ih3⟩
+  | proj _ _ ih => exact ih
+
+theorem ofLevel_hasMVar (h : VLevel.ofLevel ls l = some l') : l.hasMVar' = false := by
+  induction l generalizing l' with simp [VLevel.ofLevel, bind, Level.hasMVar'] at h ⊢
+  | succ _ ih => obtain ⟨l', h, ⟨⟩⟩ := h; exact ih h
+  | max _ _ ih1 ih2 | imax _ _ ih1 ih2 => obtain ⟨_, h1, _, h2, ⟨⟩⟩ := h; exact ⟨ih1 h1, ih2 h2⟩
+
+theorem TrExprS.fvarsIn (H : TrExprS env Us Δ e e') : FVarsIn (· ∈ Δ.fvars) e := by
+  induction H with
+  | fvar h1 => exact VLCtx.find?_eq_some.1 ⟨_, h1⟩
+  | sort h => exact ofLevel_hasMVar h
+  | const _ h =>
+    rw [List.mapM_eq_some] at h
+    intro _ hl
+    have ⟨_, _, h⟩ := h.forall_exists_l _ hl
+    exact ofLevel_hasMVar h
+  | bvar | lit | mdata => trivial
+  | app _ _ _ _ ih1 ih2
+  | lam _ _ _ ih1 ih2
+  | forallE _ _ _ _ ih1 ih2 => exact ⟨ih1, ih2⟩
+  | letE _ _ _ _ ih1 ih2 ih3 => exact ⟨ih1, ih2, ih3⟩
+  | proj _ _ ih => exact ih
+
+theorem TrExprS.fvarsList (H : TrExprS env Us Δ e e') : e.fvarsList ⊆ Δ.fvars :=
+  (fvarsIn_iff.1 H.fvarsIn).1
+
+theorem TrExpr.closed (H : TrExpr env Us Δ e e') : Closed e Δ.bvars :=
+  let ⟨_, H, _⟩ := H; H.closed
+
+theorem TrExpr.fvarsIn (H : TrExpr env Us Δ e e') : FVarsIn (· ∈ Δ.fvars) e :=
+  let ⟨_, H, _⟩ := H; H.fvarsIn
+
+theorem TrExpr.fvarsList (H : TrExpr env Us Δ e e') : e.fvarsList ⊆ Δ.fvars :=
+  (fvarsIn_iff.1 H.fvarsIn).1
+
+theorem TrProj.wf (H1 : TrProj env U Γ s i e e')
+    (_H2 : VExpr.WF env U Γ e) : VExpr.WF env U Γ e' := by
+  obtain ⟨view, levels, params, _hname, hproj⟩ := H1
+  obtain ⟨code, _hcode, rfl, hprojector⟩ := hproj.program
+  exact ⟨_, hprojector.app hproj.majorType⟩
+
+theorem TrExpr.wf (H : TrExpr env Us Δ e e') : VExpr.WF env Us.length Δ.toCtx e' :=
+  let ⟨_, _, _, H⟩ := H; ⟨_, H.hasType.2⟩
+
+variable! (henv : Ordered env) {Us : List Name} (hΔ : VLCtx.WF env Us.length Δ) in
+theorem TrExprS.wf (H : TrExprS env Us Δ e e') : VExpr.WF env Us.length Δ.toCtx e' := by
+  induction H with
+  | bvar h1 | fvar h1 => exact ⟨_, hΔ.find?_wf henv h1⟩
+  | sort h1 => exact ⟨_, HasType.sort (.of_ofLevel h1)⟩
+  | const h1 h2 h3 => exact ⟨_,
+    HasType.const h1 (.of_mapM_ofLevel h2) ((List.mapM_eq_some.1 h2).length_eq.symm.trans h3)⟩
+  | app h1 h2 => exact ⟨_, h1.app h2⟩
+  | lam h1 _ _ _ ih2 =>
+    have ⟨_, h1'⟩ := h1
+    have ⟨_, h2'⟩ := ih2 ⟨hΔ, nofun, h1⟩
+    refine ⟨_, h1'.lam h2'⟩
+  | forallE h1 h2 => have ⟨_, h1'⟩ := h1; have ⟨_, h2'⟩ := h2; exact ⟨_, h1'.forallE h2'⟩
+  | letE h1 _ _ _ _ _ ih3 => exact ih3 ⟨hΔ, nofun, h1⟩
+  | lit _ _ ih | mdata _ ih => exact ih hΔ
+  | proj _ h2 ih => exact h2.wf (ih hΔ)
+
+variable! (henv : Ordered env) {Us : List Name} (hΔ : VLCtx.WF env Us.length Δ) in
+theorem TrExprS.trExpr (H : TrExprS env Us Δ e e') : TrExpr env Us Δ e e' :=
+  ⟨_, H, H.wf henv hΔ⟩
+
+theorem TrExpr.defeq (henv : VEnv.WF env) (hΔ : OnCtx Δ.toCtx (env.IsType Us.length))
+    (h1 : TrExpr env Us Δ e e₁) (h2 : env.IsDefEqU Us.length Δ.toCtx e₁ e₂) :
+    TrExpr env Us Δ e e₂ := let ⟨_, H, h1⟩ := h1; ⟨_, H, h1.trans henv hΔ h2⟩
+
+theorem TrExpr.app (henv : VEnv.WF env) (hΔ : OnCtx Δ.toCtx (env.IsType Us.length))
+    (h1 : env.HasType Us.length Δ.toCtx f' (.forallE A B))
+    (h2 : env.HasType Us.length Δ.toCtx a' A)
+    (h3 : TrExpr env Us Δ f f')
+    (h4 : TrExpr env Us Δ a a') :
+    TrExpr env Us Δ (.app f a) (.app f' a') :=
+  let ⟨_, s3, h3⟩ := h3
+  let ⟨_, s4, h4⟩ := h4
+  have h3 := h3.of_r henv hΔ h1
+  have h4 := h4.of_r henv hΔ h2
+  ⟨_, .app h3.hasType.1 h4.hasType.1 s3 s4, _, h3.appDF h4⟩
+
+variable! (henv : VEnv.WF env) (hΓ : IsDefEqCtx env U [] Γ₁ Γ₂) in
+theorem TrProj.uniq (H1 : TrProj env U Γ₁ s₁ i e₁ e₁')
+    (H2 : TrProj env U Γ₂ s₂ i e₂ e₂')
+    (H : env.IsDefEqU U Γ₁ e₁ e₂) :
+    env.IsDefEqU U Γ₁ e₁' e₂' := by
+  obtain ⟨view₁, levels₁, params₁, _hname₁, hproj₁⟩ := H1
+  obtain ⟨view₂, levels₂, params₂, _hname₂, hproj₂⟩ := H2
+  exact henv.registeredStructureHeadInversion.unique
+    hΓ hproj₁ hproj₂ H
+
+variable! (henv : VEnv.WF env) {Us : List Name} (hΔ : VLCtx.IsDefEq env Us.length Δ₁ Δ₂) in
+theorem TrExprS.uniq (H1 : TrExprS env Us Δ₁ e e₁) (H2 : TrExprS env Us Δ₂ e e₂) :
+    env.IsDefEqU Us.length Δ₁.toCtx e₁ e₂ := by
+  induction H1 generalizing Δ₂ e₂ with
+  | bvar l1 => let .bvar r1 := H2; exact ⟨_, (hΔ.find?_uniq henv l1 r1).2⟩
+  | fvar l1 => let .fvar r1 := H2; exact ⟨_, (hΔ.find?_uniq henv l1 r1).2⟩
+  | sort l1 =>
+    let .sort r1 := H2; cases l1.symm.trans r1; exact ⟨_, HasType.sort (.of_ofLevel l1)⟩
+  | const l1 l2 l3 =>
+    let .const r1 r2 r3 := H2; cases l1.symm.trans r1; cases l2.symm.trans r2
+    exact (TrExprS.const l1 l2 l3).wf henv hΔ.wf
+  | app l1 l2 _ _ ih3 ih4 =>
+    let .app _ _ r3 r4 := H2
+    exact ⟨_, .appDF
+      (ih3 hΔ r3 |>.of_l henv hΔ.wf.toCtx l1)
+      (ih4 hΔ r4 |>.of_l henv hΔ.wf.toCtx l2)⟩
+  | lam l1 _ _ ih2 ih3 =>
+    let ⟨_, l1⟩ := l1; let .lam _ r2 r3 := H2
+    have hA := ih2 hΔ r2 |>.of_l henv hΔ.wf.toCtx l1
+    have ⟨_, hb⟩ := ih3 (hΔ.cons nofun <| .vlam hA) r3
+    exact ⟨_, .lamDF hA hb⟩
+  | forallE l1 l2 _ _ ih3 ih4 =>
+    let ⟨_, l1'⟩ := l1; let ⟨_, l2⟩ := l2; let .forallE _ _ r3 r4 := H2
+    have hA := ih3 hΔ r3 |>.of_l henv hΔ.wf.toCtx l1'
+    have hB := ih4 (hΔ.cons nofun <| .vlam hA) r4 |>.of_l (Γ := _::_) henv ⟨hΔ.wf.toCtx, l1⟩ l2
+    exact ⟨_, .forallEDF hA hB⟩
+  | letE l1 _ _ _ ih2 ih3 ih4 =>
+    have hΓ := hΔ.wf.toCtx
+    let .letE _ r2 r3 r4 := H2
+    have ⟨_, hb⟩ := l1.isType henv hΓ
+    refine ih4 (hΔ.cons nofun ?_) r4
+    exact .vlet (ih3 hΔ r3 |>.of_l henv hΓ l1) (ih2 hΔ r2 |>.of_l henv hΓ hb)
+  | lit _ _ ih1 => let .lit _ r2 := H2; exact ih1 hΔ r2
+  | mdata _ ih1 => let .mdata r1 := H2; exact ih1 hΔ r1
+  | proj _ l2 ih1 => let .proj r1 r2 := H2; exact l2.uniq henv hΔ.defeqCtx r2 (ih1 hΔ r1)
+
+variable! (henv : VEnv.WF env) {Us : List Name}
+  (hΔ : VLCtx.IsDefEqFVars env Us.length Δ₁ Δ₂)
+  (hΔwf : VLCtx.WF env Us.length Δ₁) in
+/-- Translation congruence across contexts with the same free-variable
+identifiers but potentially different dependency metadata. -/
+theorem TrExprS.uniqFVars
+    (H₁ : TrExprS env Us Δ₁ e e₁) (H₂ : TrExprS env Us Δ₂ e e₂) :
+    env.IsDefEqU Us.length Δ₁.toCtx e₁ e₂ := by
+  induction H₁ generalizing Δ₂ e₂ with
+  | bvar l₁ =>
+      let .bvar r₁ := H₂
+      exact ⟨_, (hΔ.find?_uniq henv l₁ r₁).2⟩
+  | fvar l₁ =>
+      let .fvar r₁ := H₂
+      exact ⟨_, (hΔ.find?_uniq henv l₁ r₁).2⟩
+  | sort l₁ =>
+      let .sort r₁ := H₂
+      cases l₁.symm.trans r₁
+      exact ⟨_, HasType.sort (.of_ofLevel l₁)⟩
+  | const l₁ l₂ l₃ =>
+      let .const r₁ r₂ r₃ := H₂
+      cases l₁.symm.trans r₁
+      cases l₂.symm.trans r₂
+      exact (TrExprS.const l₁ l₂ l₃).wf henv hΔwf
+  | app l₁ l₂ _ _ ih₃ ih₄ =>
+      let .app _ _ r₃ r₄ := H₂
+      exact ⟨_, .appDF
+        (ih₃ hΔ hΔwf r₃ |>.of_l henv hΔwf.toCtx l₁)
+        (ih₄ hΔ hΔwf r₄ |>.of_l henv hΔwf.toCtx l₂)⟩
+  | lam l₁ _ _ ih₂ ih₃ =>
+      let ⟨u, l₁'⟩ := l₁
+      let .lam _ r₂ r₃ := H₂
+      have hA := ih₂ hΔ hΔwf r₂ |>.of_l henv hΔwf.toCtx l₁'
+      have ⟨_, hb⟩ := ih₃ (.cons_bvar hΔ (.vlam hA))
+        ⟨hΔwf, nofun, ⟨u, l₁'⟩⟩ r₃
+      exact ⟨_, .lamDF hA hb⟩
+  | forallE l₁ l₂ _ _ ih₃ ih₄ =>
+      let ⟨_, l₁'⟩ := l₁
+      let ⟨_, l₂⟩ := l₂
+      let .forallE _ _ r₃ r₄ := H₂
+      have hA := ih₃ hΔ hΔwf r₃ |>.of_l henv hΔwf.toCtx l₁'
+      have hbody := ih₄ (.cons_bvar hΔ (.vlam hA))
+        ⟨hΔwf, nofun, l₁⟩ r₄
+      have hbodyCtx : OnCtx (_ :: _) (env.IsType Us.length) :=
+        ⟨hΔwf.toCtx, l₁⟩
+      have hB := hbody.of_l henv hbodyCtx l₂
+      exact ⟨_, .forallEDF hA hB⟩
+  | letE l₁ _ _ _ ih₂ ih₃ ih₄ =>
+      have hΓ := hΔwf.toCtx
+      let .letE _ r₂ r₃ r₄ := H₂
+      have ⟨_, hb⟩ := l₁.isType henv hΓ
+      refine ih₄ (.cons_bvar hΔ ?_) ⟨hΔwf, nofun, l₁⟩ r₄
+      exact .vlet
+        (ih₃ hΔ hΔwf r₃ |>.of_l henv hΓ l₁)
+        (ih₂ hΔ hΔwf r₂ |>.of_l henv hΓ hb)
+  | lit _ _ ih₁ =>
+      let .lit _ r₂ := H₂
+      exact ih₁ hΔ hΔwf r₂
+  | mdata _ ih₁ =>
+      let .mdata r₁ := H₂
+      exact ih₁ hΔ hΔwf r₁
+  | proj _ l₂ ih₁ =>
+      let .proj r₁ r₂ := H₂
+      exact l₂.uniq henv hΔ.defeqCtx r₂ (ih₁ hΔ hΔwf r₁)
+
+variable! (henv : VEnv.WF env) {Us : List Name} (hΔ : VLCtx.IsDefEq env Us.length Δ₁ Δ₂) in
+theorem TrExpr.uniq (H1 : TrExpr env Us Δ₁ e e₁) (H2 : TrExpr env Us Δ₂ e e₂) :
+    env.IsDefEqU Us.length Δ₁.toCtx e₁ e₂ := by
+  let ⟨_, H1, eq1⟩ := H1
+  let ⟨_, H2, eq2⟩ := H2
+  exact eq1.symm.trans henv hΔ.wf <| (H1.uniq henv hΔ H2).trans henv hΔ.wf <|
+    eq2.defeqDFC henv (hΔ.defeqCtx.symm henv)
+
+variable! (henv : VEnv.WF env) {Us : List Name} (hΔ : VLCtx.IsDefEq env Us.length Δ₁ Δ₂) in
+theorem TrExprS.defeqDFC (H : TrExprS env Us Δ₁ e e₁) : ∃ e₂, TrExprS env Us Δ₂ e e₂ := by
+  induction H generalizing Δ₂ with
+  | bvar h1 => have ⟨_, _, h1⟩ := hΔ.find?_defeqDFC h1; exact ⟨_, .bvar h1⟩
+  | fvar h1 => have ⟨_, _, h1⟩ := hΔ.find?_defeqDFC h1; exact ⟨_, .fvar h1⟩
+  | sort h1 => exact ⟨_, .sort h1⟩
+  | const h1 h2 h3 => exact ⟨_, .const h1 h2 h3⟩
+  | app h1 h2 h3 h4 ih3 ih4 =>
+    let ⟨_, h3'⟩ := ih3 hΔ
+    let ⟨_, h4'⟩ := ih4 hΔ
+    have h1 := h1.defeqDFC henv hΔ.defeqCtx
+    have h2 := h2.defeqDFC henv hΔ.defeqCtx
+    have h1 := h1.defeqU_l henv (hΔ.symm henv).wf (h3'.uniq henv (hΔ.symm henv) h3).symm
+    have h2 := h2.defeqU_l henv (hΔ.symm henv).wf (h4'.uniq henv (hΔ.symm henv) h4).symm
+    exact ⟨_, .app h1 h2 h3' h4'⟩
+  | lam h1 h2 h3 ih2 ih3 =>
+    let ⟨_, h1'⟩ := h1
+    let ⟨_, h2'⟩ := ih2 hΔ
+    have h1 := h1.defeqDFC henv hΔ.defeqCtx
+    have h1 := h1.defeqU_l henv (hΔ.symm henv).wf (h2'.uniq henv (hΔ.symm henv) h2).symm
+    have ht := (h2.uniq henv hΔ h2').of_l henv hΔ.wf h1'
+    let ⟨_, h3'⟩ := ih3 (hΔ.cons nofun <| .vlam ht)
+    exact ⟨_, .lam h1 h2' h3'⟩
+  | forallE h1 h2 h3 h4 ih3 ih4 =>
+    let ⟨_, h1'⟩ := h1
+    let ⟨_, h2'⟩ := h2
+    let ⟨_, h3'⟩ := ih3 hΔ
+    have ht := (h3.uniq henv hΔ h3').of_l henv hΔ.wf h1'
+    have hΔ' := hΔ.cons (ofv := none) nofun (.vlam ht)
+    let ⟨_, h4'⟩ := ih4 hΔ'
+    have h1 := h1.defeqDFC henv hΔ.defeqCtx
+    have h2 := h2.defeqDFC henv (hΔ.defeqCtx.succ ht)
+    have h1 := h1.defeqU_l henv (hΔ.symm henv).wf (h3'.uniq henv (hΔ.symm henv) h3).symm
+    have h2 := h2.defeqU_l henv (hΔ'.symm henv).wf (h4'.uniq henv (hΔ'.symm henv) h4).symm
+    exact ⟨_, .forallE h1 h2 h3' h4'⟩
+  | letE h1 h2 h3 h4 ih2 ih3 ih4 =>
+    let ⟨_, h2'⟩ := ih2 hΔ
+    let ⟨_, h3'⟩ := ih3 hΔ
+    have ⟨_, h0⟩ := h1.isType henv hΔ.wf
+    have t0 := (h2.uniq henv hΔ h2').of_l henv hΔ.wf h0
+    have t1 := (h3.uniq henv hΔ h3').of_l henv hΔ.wf h1
+    have t2 := (h2'.uniq henv (hΔ.symm henv) h2).symm
+    have t3 := (h3'.uniq henv (hΔ.symm henv) h3).symm
+    have hΔ' := hΔ.cons (ofv := none) nofun (.vlet t1 t0)
+    let ⟨_, h4'⟩ := ih4 hΔ'
+    have h0 := h0.defeqDFC henv hΔ.defeqCtx
+    have h0 := h0.defeqU_l henv (hΔ.symm henv).wf t2
+    have h1 := h1.defeqDFC henv hΔ.defeqCtx
+    have h1 := h1.defeqU_l henv (hΔ.symm henv).wf t3
+    have h1 := h1.defeqU_r henv (hΔ.symm henv).wf t2
+    exact ⟨_, .letE h1 h2' h3' h4'⟩
+  | lit h1 _ ih1 => let ⟨_, h2⟩ := ih1 hΔ; exact ⟨_, .lit h1 h2⟩
+  | mdata _ ih1 => let ⟨_, h1⟩ := ih1 hΔ; exact ⟨_, .mdata h1⟩
+  | proj h1 h2 ih1 =>
+    let ⟨_, h1'⟩ := ih1 hΔ
+    let ⟨_, h2⟩ := h2.defeqDFC henv hΔ.defeqCtx (h1.uniq henv hΔ h1')
+    exact ⟨_, .proj h1' h2⟩
+
+variable! (henv : VEnv.WF env) {Us : List Name} (hΔ : VLCtx.IsDefEq env Us.length Δ₁ Δ₂) in
+theorem TrExprS.defeqDFC' (H : TrExprS env Us Δ₁ e e') : TrExpr env Us Δ₂ e e' := by
+  let ⟨_, H'⟩ := H.defeqDFC henv hΔ
+  refine ⟨_, H', H'.uniq henv (hΔ.symm henv) H⟩
+
+theorem TrExpr.lam (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length Δ)
+    (h1 : env.IsType Us.length Δ.toCtx ty')
+    (h2 : TrExpr env Us Δ ty ty')
+    (h3 : TrExpr env Us ((none, .vlam ty') :: Δ) body body') :
+    TrExpr env Us Δ (.lam name ty body bi) (.lam ty' body') :=
+  let ⟨_, h1⟩ := h1
+  let ⟨_, s2, h2⟩ := h2
+  let ⟨_, s3, _, h3⟩ := h3
+  have := h2.symm.of_l henv hΔ h1
+  have hΔΔ := .cons (.refl henv hΔ) (ofv := none) nofun (.vlam this)
+  let ⟨_, s3'⟩ := s3.defeqDFC henv hΔΔ
+  let ⟨_, h3'⟩ := s3.uniq henv hΔΔ s3'
+  ⟨_, .lam ⟨_, this.hasType.2⟩ s2 s3', _,
+    .symm <| .lamDF this <| h3.symm.trans_l henv hΔΔ.wf.toCtx h3'⟩
+
+theorem TrExpr.forallE (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length Δ)
+    (h1 : env.IsType Us.length Δ.toCtx ty')
+    (h2 : env.IsType Us.length (ty' :: Δ.toCtx) body')
+    (h3 : TrExpr env Us Δ ty ty')
+    (h4 : TrExpr env Us ((none, .vlam ty') :: Δ) body body') :
+    TrExpr env Us Δ (.forallE name ty body bi) (.forallE ty' body') :=
+  let ⟨_, h1⟩ := h1
+  let ⟨_, h2⟩ := h2
+  let ⟨_, s3, h3⟩ := h3
+  let ⟨_, s4, _, h4⟩ := h4
+  have := h3.symm.of_l henv hΔ h1
+  have hΔΔ := .cons (.refl henv hΔ) (ofv := none) nofun (.vlam this)
+  let ⟨_, s4'⟩ := s4.defeqDFC henv hΔΔ
+  let ⟨_, h4'⟩ := s4.uniq henv hΔΔ s4'
+  have h4 := h4.trans_r henv hΔΔ.wf h2 |>.symm.trans_l henv hΔΔ.wf h4'
+  have h5 := h4.hasType.2.defeq_l henv this
+  ⟨_, .forallE ⟨_, this.hasType.2⟩ ⟨_, h5⟩ s3 s4', _, .symm <| .forallEDF this h4⟩
+
+theorem TrExpr.letE (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length Δ)
+    (h1 : env.HasType Us.length Δ.toCtx val' ty')
+    (h2 : TrExpr env Us Δ ty ty')
+    (h3 : TrExpr env Us Δ val val')
+    (h4 : TrExpr env Us ((none, .vlet ty' val') :: Δ) body body') :
+    TrExpr env Us Δ (.letE name ty val body nd) body' :=
+  have ⟨_, h0⟩ := h1.isType henv hΔ
+  let ⟨_, s2, h2⟩ := h2
+  let ⟨_, s3, h3⟩ := h3
+  let ⟨_, s4, _, h4⟩ := h4
+  have h1' := h1.defeqU_r henv hΔ h2.symm |>.defeqU_l henv hΔ h3.symm
+  have h2' := h2.symm.of_l henv hΔ h0
+  have h3' := h3.symm.of_l henv hΔ h1
+  have hΔΔ := VLCtx.IsDefEq.cons (.refl henv hΔ) (ofv := none) nofun (.vlet h3' h2')
+  let ⟨_, s4'⟩ := s4.defeqDFC henv hΔΔ
+  let ⟨_, h4'⟩ := s4.uniq henv hΔΔ s4'
+  ⟨_, .letE h1' s2 s3 s4', _, h4'.symm.trans_l henv hΔ h4⟩
+
+theorem TrExpr.lit (h1 : env.ContainsLits l)
+    (h : TrExpr env Us Δ l.toConstructor e') : TrExpr env Us Δ (.lit l) e' :=
+  let ⟨_, s2, h2⟩ := h; ⟨_, .lit h1 s2, h2⟩
+
+theorem TrExpr.mdata (h : TrExpr env Us Δ e e') : TrExpr env Us Δ (.mdata d e) e' :=
+  let ⟨_, s2, h2⟩ := h; ⟨_, .mdata s2, h2⟩
+
+theorem TrExpr.proj {env Us Δ e e' s i e''} (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length Δ)
+    (H : TrExpr env Us Δ e e')
+    (H2 : TrProj env Us.length Δ.toCtx s i e' e'') :
+    TrExpr env Us Δ (.proj s i e) e'' :=
+  let ⟨_, s2, h2⟩ := H
+  have ⟨_, H2'⟩ := H2.defeqDFC henv (.refl hΔ) h2.symm
+  ⟨_, .proj s2 H2', H2'.uniq henv (.refl hΔ) H2 h2⟩
+
+theorem TrExprS.weakFV'_inv (henv : VEnv.WF env)
+    (W : VLCtx.FVLift' Δ Δ₂ dk n k) (hΔ : VLCtx.IsDefEq env Us.length Δ₁ Δ₂)
+    (H : TrExprS env Us Δ₁ e e') (hc : Closed e dk) (hv : FVarsIn (· ∈ VLCtx.fvars Δ) e) :
+    ∃ e', TrExprS env Us Δ e e' := by
+  induction H generalizing Δ Δ₂ dk k with
+  | @bvar e A Δ₁ i h1 =>
+    suffices ∃ p, Δ.find? (.inl i) = some p from let ⟨_, h⟩ := this; ⟨_, .bvar h⟩
+    simp [Closed] at hc
+    induction W generalizing i e A Δ₁ with | @cons_bvar _ Δ₂ _ _ _ d _ ih => ?_ | _ => cases hc
+    obtain ⟨d, Δ₂, rfl, hΔ₁⟩ : ∃ d Δ₁', Δ₁ = (none, d) :: Δ₁' ∧
+        VLCtx.IsDefEq env Us.length Δ₁' Δ₂ := by cases d <;> cases hΔ <;> exact ⟨_, _, rfl, ‹_›⟩
+    simp [VLCtx.find?] at h1 ⊢
+    rcases i with _ | i <;> simp [VLCtx.next] at h1 ⊢
+    obtain ⟨_, _, h1, _⟩ := h1
+    have ⟨_, h1⟩ := ih h1 hΔ₁ (Nat.lt_of_succ_lt_succ hc) hv
+    exact ⟨_, _, _, _, h1, rfl, rfl⟩
+  | @fvar _ _ _ fv => let ⟨_, h⟩ := VLCtx.find?_eq_some.2 hv; exact ⟨_, .fvar h⟩
+  | sort h1 => exact ⟨_, .sort h1⟩
+  | const h1 h2 h3 => exact ⟨_, .const h1 h2 h3⟩
+  | app h1 h2 hf ha ih1 ih2 =>
+    have hΔ₁ := hΔ.wf; have hΔ₂ := (hΔ.symm henv).wf
+    let ⟨f₁, ih1⟩ := ih1 W hΔ hc.1 hv.1
+    let ⟨a₁, ih2⟩ := ih2 W hΔ hc.2 hv.2
+    have h1 := h1.defeqU_l henv hΔ₁.toCtx <| hf.uniq henv hΔ (ih1.weakFV' henv W hΔ₂)
+    have h2 := h2.defeqU_l henv hΔ₁.toCtx <| ha.uniq henv hΔ (ih2.weakFV' henv W hΔ₂)
+    have := VExpr.WF.weak'_iff henv hΔ₂.toCtx W.toCtx (e := f₁.app a₁)
+    have := this.1 ⟨_, (h1.app h2).defeqDFC henv hΔ.defeqCtx⟩
+    have ⟨_, _, h1, h2⟩ := this.app_inv henv (W.wf henv hΔ₂).toCtx
+    exact ⟨_, .app h1 h2 ih1 ih2⟩
+  | lam h1 ht _ ih1 ih2 =>
+    let ⟨_, h1⟩ := h1
+    have hΔ₁ := hΔ.wf; have hΔ₂ := (hΔ.symm henv).wf
+    let ⟨ty₁, ih1⟩ := ih1 W hΔ hc.1 hv.1
+    have htt := ht.uniq henv hΔ (ih1.weakFV' henv W hΔ₂) |>.of_l henv hΔ₁.toCtx h1
+    have ⟨_, ih2⟩ := ih2 (W.cons_bvar (.vlam _))
+      (hΔ.cons (ofv := none) nofun <| .vlam htt) hc.2 hv.2.fvars_cons
+    have h1 := HasType.weak'_iff (A := .sort _) henv hΔ₂.toCtx W.toCtx
+      |>.1 (htt.hasType.2.defeqDFC henv hΔ.defeqCtx)
+    exact ⟨_, .lam ⟨_, h1⟩ ih1 ih2⟩
+  | forallE h1 h2 ht hb ih1 ih2 =>
+    let ⟨_, h1⟩ := h1; let ⟨_, h2⟩ := h2
+    have hΔ₁ := hΔ.wf; have hΔ₂ := (hΔ.symm henv).wf
+    let ⟨ty₁, ih1⟩ := ih1 W hΔ hc.1 hv.1
+    have htt := ht.uniq henv hΔ (ih1.weakFV' henv W hΔ₂) |>.of_l henv hΔ₁.toCtx h1
+    have hΔ' := hΔ.cons (ofv := none) nofun <| .vlam htt
+    have ⟨_, ih2⟩ := ih2 (W.cons_bvar (.vlam _)) hΔ' hc.2 hv.2.fvars_cons
+    have h1' := htt.hasType.2.defeqDFC henv hΔ.defeqCtx
+    have h1 := HasType.weak'_iff (A := .sort _) henv hΔ₂.toCtx W.toCtx |>.1 h1'
+    have hΔ₂' : VLCtx.WF _ _ ((none, .vlam _) :: _) := ⟨hΔ₂, nofun, _, h1'⟩
+    have h2 := (HasType.weak'_iff (A := .sort _) henv hΔ₂'.toCtx (W.cons_bvar (.vlam _)).toCtx).1 <|
+      hb.uniq henv hΔ' (ih2.weakFV' henv (W.cons_bvar _) hΔ₂')
+      |>.of_l (Γ := _::_) henv ⟨hΔ₁.toCtx, _, htt.hasType.1⟩ h2
+      |>.hasType.2.defeqDFC henv (.succ hΔ.defeqCtx htt)
+    exact ⟨_, .forallE ⟨_, h1⟩ ⟨_, h2⟩ ih1 ih2⟩
+  | letE h1 ht ha _ ih1 ih2 ih3 =>
+    have hΔ₁ := hΔ.wf; have hΔ₂ := (hΔ.symm henv).wf
+    let ⟨ty₁, ih1⟩ := ih1 W hΔ hc.1 hv.1
+    let ⟨val₁, ih2⟩ := ih2 W hΔ hc.2.1 hv.2.1
+    have hvv := ha.uniq henv hΔ (ih2.weakFV' henv W hΔ₂) |>.of_l henv hΔ₁.toCtx h1
+    let ⟨_, h2⟩ := h1.isType henv hΔ₁.toCtx
+    have htt := ht.uniq henv hΔ (ih1.weakFV' henv W hΔ₂) |>.of_l henv hΔ₁.toCtx h2
+    have ⟨_, ih3⟩ := ih3 (W.cons_bvar (.vlet ..))
+      (hΔ.cons nofun <| .vlet hvv htt) hc.2.2 hv.2.2.fvars_cons
+    have h1 := HasType.weak'_iff henv hΔ₂.toCtx W.toCtx
+      |>.1 ((htt.defeqDF hvv).hasType.2.defeqDFC henv hΔ.defeqCtx)
+    exact ⟨_, .letE h1 ih1 ih2 ih3⟩
+  | lit h1 _ ih => let ⟨_, ih⟩ := ih W hΔ .toConstructor .toConstructor; exact ⟨_, .lit h1 ih⟩
+  | mdata _ ih => let ⟨_, ih⟩ := ih W hΔ hc hv; exact ⟨_, .mdata ih⟩
+  | proj h1 h2 ih =>
+    have hΔ₂ := (hΔ.symm henv).wf
+    let ⟨_, ih⟩ := ih W hΔ hc hv
+    have htt := h1.uniq henv hΔ (ih.weakFV' henv W hΔ₂)
+    have ⟨_, h2⟩ := h2.defeqDFC henv hΔ.defeqCtx htt
+    have ⟨_, h2⟩ := h2.weak'_inv henv hΔ₂.toCtx W.toCtx
+    exact ⟨_, .proj ih h2⟩
+
+theorem TrExprS.weakFV_inv (henv : VEnv.WF env)
+    (W : VLCtx.FVLift Δ Δ₂ dk n k) (hΔ : VLCtx.IsDefEq env Us.length Δ₁ Δ₂)
+    (H : TrExprS env Us Δ₁ e e') (hc : Closed e dk) (hv : FVarsIn (· ∈ VLCtx.fvars Δ) e) :
+    ∃ e', TrExprS env Us Δ e e' := H.weakFV'_inv henv W.toFVLift' hΔ hc hv
+
+variable! (henv : Ordered env) (h₀ : TrExprS env Us Δ₀ e₀ e₀') in
+theorem TrExprS.instN_var (W : VLCtx.InstN Δ₀ e₀' A₀ dk k Δ₁ Δ) (H : Δ₁.find? v = some (e', A)) :
+    TrExprS env Us Δ (Expr.instantiate1' (VLCtx.varToExpr v) e₀ dk) (e'.inst e₀' k) := by
+  induction W generalizing v e' A with
+  | zero =>
+    obtain (_|i)|fv := v <;> simp [VLCtx.varToExpr, Expr.instantiate1', Expr.liftLooseBVars_zero]
+    · cases H; simp [VLocalDecl.value, VExpr.inst]; exact h₀
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      simp [VLocalDecl.depth, VExpr.inst_liftN]
+      exact .bvar H
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      simp [VLocalDecl.depth, VExpr.inst_liftN]
+      exact .fvar H
+  | @succ _ k _ _ d _ ih =>
+    obtain (_|i)|fv := v <;> simp [VLCtx.varToExpr, Expr.instantiate1']
+    · cases H
+      cases d <;> exact .bvar <| by simp [VLocalDecl.value, VExpr.inst, VLocalDecl.depth]; rfl
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      have := ih H; revert this
+      simp [VLCtx.varToExpr, Expr.instantiate1']; split <;> [skip; split]
+      · intro | .bvar h => ?_
+        exact .bvar <| by
+          simp [VLCtx.find?, VLCtx.next]
+          refine ⟨_, _, h, ?_, rfl⟩
+          cases d <;> simp [VLocalDecl.depth, VLocalDecl.inst, VExpr.lift_instN_lo]
+      · intro H
+        have := Expr.liftLooseBVars_add ▸ H.weakBV henv (.skip (d.inst e₀' k) .refl)
+        cases d <;> simpa [← VExpr.lift_instN_lo, VExpr.liftN_zero,
+          VLocalDecl.inst, VLocalDecl.depth] using this
+      · obtain _|i := i; · omega
+        intro | .bvar h => ?_
+        exact .bvar <| by
+          simp [VLCtx.find?, VLCtx.next]
+          refine ⟨_, _, h, ?_, rfl⟩
+          cases d <;> simp [VLocalDecl.depth, VLocalDecl.inst, VExpr.lift_instN_lo]
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      have .fvar h := ih H
+      exact .fvar <| by
+        simp [VLCtx.find?, VLCtx.next]
+        refine ⟨_, _, h, ?_, rfl⟩
+        cases d <;> simp [VLocalDecl.depth, VLocalDecl.inst, VExpr.lift_instN_lo]
+
+theorem TrProj.instN (henv : env.Ordered)
+    (h₀ : env.HasType U Γ₀ e₀ A₀)
+    (W : Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ)
+    (H : TrProj env U Γ₁ s i e e') :
+    TrProj env U Γ s i (e.inst e₀ k) (e'.inst e₀ k) := by
+  obtain ⟨view, levels, params, hname, hproj⟩ := H
+  exact ⟨view, levels, params.map (fun param => param.inst e₀ k),
+    hname, hproj.instN henv W h₀⟩
+
+variable! (henv : Ordered env) (h₀ : TrExprS env Us Δ₀ e₀ e₀')
+  (t₀ : env.HasType Us.length Δ₀.toCtx e₀' A₀) in
+theorem TrExprS.instN (W : VLCtx.InstN Δ₀ e₀' A₀ dk k Δ₁ Δ) (H : TrExprS env Us Δ₁ e e') :
+    TrExprS env Us Δ (Expr.instantiate1' e e₀ dk) (e'.inst e₀' k) := by
+  induction H generalizing Δ dk k with
+  | bvar h1 | fvar h1 => exact instN_var henv h₀ W h1
+  | sort h1 => exact .sort h1
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app h1 h2 _ _ ih1 ih2 =>
+    exact .app (h1.instN henv W.toCtx t₀) (h2.instN henv W.toCtx t₀) (ih1 W) (ih2 W)
+  | lam h1 _ _ ih1 ih2 =>
+    exact .lam (h1.instN henv W.toCtx t₀) (ih1 W) (ih2 (W.succ (d := .vlam _)))
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    exact .forallE (h1.instN henv W.toCtx t₀) (h2.instN henv W.toCtx.succ t₀)
+      (ih1 W) (ih2 (W.succ (d := .vlam _)))
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    exact .letE (h1.instN henv W.toCtx t₀) (ih1 W) (ih2 W) (ih3 (W.succ (d := .vlet ..)))
+  | lit h1 _ ih =>
+    refine .lit h1 (Expr.instantiate1'_eq_self ?_ ▸ ih W :)
+    exact Closed.toConstructor.looseBVarRange_le
+  | mdata _ ih => exact .mdata (ih W)
+  | proj _ h2 ih => exact .proj (ih W) (h2.instN henv t₀ W.toCtx)
+
+theorem TrExprS.inst {Δ : VLCtx} (henv : Ordered env)
+    (t₀ : env.HasType Us.length Δ.toCtx e₀' A₀)
+    (H : TrExprS env Us ((none, .vlam A₀) :: Δ) e e')
+    (h₀ : TrExprS env Us Δ e₀ e₀') :
+    TrExprS env Us Δ (e.instantiate1' e₀) (e'.inst e₀') :=
+  h₀.instN henv t₀ .zero H
+
+theorem TrExpr.inst (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length Δ)
+    (t₀ : env.HasType Us.length Δ.toCtx e₀' A₀)
+    (H : TrExpr env Us ((none, .vlam A₀) :: Δ) e e')
+    (h₀ : TrExpr env Us Δ e₀ e₀') :
+    TrExpr env Us Δ (e.instantiate1' e₀) (e'.inst e₀') :=
+  have ⟨_, h0⟩ := t₀.isType henv hΔ
+  have ⟨_, s1, _, h1⟩ := H
+  have ⟨_, s2, h2⟩ := h₀
+  have h2' := h2.symm.of_l henv hΔ t₀
+  have hΔΔ := VLCtx.IsDefEq.cons (.refl henv hΔ) (ofv := none) nofun (.vlam h0)
+  let ⟨_, s1'⟩ := s1.defeqDFC henv hΔΔ
+  let ⟨_, h1'⟩ := s1.uniq henv hΔΔ s1'
+  ⟨_, .inst henv h2'.hasType.2 s1' s2, _,
+    .instDF henv hΔ (h1'.symm.trans_l henv hΔΔ.wf.toCtx h1) h2'.symm⟩
+
+variable! (henv : Ordered env) (h₀ : TrExprS env Us Δ₀ e₀ e₀') in
+theorem TrExprS.instN_let_var (W : VLCtx.InstLet Δ₀ e₀' A₀ dk k Δ₁ Δ)
+    (H : Δ₁.find? v = some (e', A)) :
+    TrExprS env Us Δ (Expr.instantiate1' (VLCtx.varToExpr v) e₀ dk) e' := by
+  induction W generalizing v e' A with
+  | zero =>
+    obtain (_|i)|fv := v <;> simp [VLCtx.varToExpr, Expr.instantiate1', Expr.liftLooseBVars_zero]
+    · cases H; simp [VLocalDecl.value]; exact h₀
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      simp [VLocalDecl.depth]
+      exact .bvar H
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      simp [VLocalDecl.depth]
+      exact .fvar H
+  | @succ _ k _ _ d _ ih =>
+    obtain (_|i)|fv := v <;> simp [VLCtx.varToExpr, Expr.instantiate1']
+    · cases H
+      cases d <;> exact .bvar <| by simp [VLocalDecl.value]; rfl
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      have := ih H; revert this
+      simp [VLCtx.varToExpr, Expr.instantiate1']; split <;> [skip; split]
+      · intro | .bvar h => ?_
+        exact .bvar <| by
+          simp [VLCtx.find?, VLCtx.next]
+          refine ⟨_, _, h, ?_, rfl⟩
+          cases d <;> simp [VLocalDecl.depth]
+      · intro H
+        have := Expr.liftLooseBVars_add ▸ H.weakBV henv (.skip d .refl)
+        cases d <;> simpa [VLocalDecl.depth] using this
+      · obtain _|i := i; · omega
+        intro | .bvar h => ?_
+        exact .bvar <| by
+          simp [VLCtx.find?, VLCtx.next]
+          refine ⟨_, _, h, ?_, rfl⟩
+          cases d <;> simp [VLocalDecl.depth]
+    · simp [VLCtx.find?, VLCtx.next] at H
+      obtain ⟨e, A, H, rfl, rfl⟩ := H
+      have .fvar h := ih H
+      exact .fvar <| by
+        simp [VLCtx.find?, VLCtx.next]
+        refine ⟨_, _, h, ?_, rfl⟩
+        cases d <;> simp [VLocalDecl.depth]
+
+variable! (henv : Ordered env) (h₀ : TrExprS env Us Δ₀ e₀ e₀') in
+theorem TrExprS.instN_let (W : VLCtx.InstLet Δ₀ e₀' A₀ dk k Δ₁ Δ) (H : TrExprS env Us Δ₁ e e') :
+    TrExprS env Us Δ (Expr.instantiate1' e e₀ dk) e' := by
+  induction H generalizing Δ dk k with
+  | bvar h1 | fvar h1 => exact instN_let_var henv h₀ W h1
+  | sort h1 => exact .sort h1
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app h1 h2 _ _ ih1 ih2 =>
+    exact .app (W.toCtx ▸ h1) (W.toCtx ▸ h2) (ih1 W) (ih2 W)
+  | lam h1 _ _ ih1 ih2 =>
+    exact .lam (W.toCtx ▸ h1) (ih1 W) (ih2 (W.succ (d := .vlam _)))
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    exact .forallE (W.toCtx ▸ h1) (W.toCtx ▸ h2)
+      (ih1 W) (ih2 (W.succ (d := .vlam _)))
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    exact .letE (W.toCtx ▸ h1) (ih1 W) (ih2 W) (ih3 (W.succ (d := .vlet ..)))
+  | lit h1 _ ih =>
+    refine .lit h1 (Expr.instantiate1'_eq_self ?_ ▸ ih W :)
+    exact Closed.toConstructor.looseBVarRange_le
+  | mdata _ ih => exact .mdata (ih W)
+  | proj _ h2 ih => exact .proj (ih W) (W.toCtx ▸ h2)
+
+theorem TrExprS.inst_let {Δ : VLCtx} (henv : Ordered env)
+    (H : TrExprS env Us ((none, .vlet A₀ e₀') :: Δ) e e')
+    (h₀ : TrExprS env Us Δ e₀ e₀') :
+    TrExprS env Us Δ (e.instantiate1' e₀) e' :=
+  h₀.instN_let henv .zero H
+
+theorem TrExpr.inst_let (henv : VEnv.WF env) (hΔ : VLCtx.WF env Us.length Δ)
+    (t₀ : env.HasType Us.length Δ.toCtx e₀' A₀)
+    (H : TrExpr env Us ((none, .vlet A₀ e₀') :: Δ) e e')
+    (h₀ : TrExpr env Us Δ e₀ e₀') :
+    TrExpr env Us Δ (e.instantiate1' e₀) e' :=
+  have ⟨_, h0⟩ := t₀.isType henv hΔ
+  have ⟨_, s1, _, h1⟩ := H
+  have ⟨_, s2, h2⟩ := h₀
+  have h2' := h2.symm.of_l henv hΔ t₀
+  have hΔΔ := VLCtx.IsDefEq.cons (.refl henv hΔ) (ofv := none) nofun (.vlet h2' h0)
+  let ⟨_, s1'⟩ := s1.defeqDFC henv hΔΔ
+  let ⟨_, h1'⟩ := s1.uniq henv hΔΔ s1'
+  ⟨_, .inst_let henv s1' s2, _, h1'.symm.trans_l henv hΔ h1⟩
+
+theorem ofLevel_mkLevelMax'
+    (h1 : VLevel.ofLevel Us u = some u') (h2 : VLevel.ofLevel Us v = some v') :
+    ∃ w, VLevel.ofLevel Us (mkLevelMax' u v) = some w ∧ w ≈ .max u' v' := by
+  let subsumes (u v : Level) : Bool :=
+    if v.isExplicit && u.getOffset ≥ v.getOffset then true
+    else match u with
+      | Level.max u₁ u₂ => v == u₁ || v == u₂
+      | _ => false
+  let mkLevelMaxCore (u v : Level) :=
+    if u == v then u
+    else if u.isZero then v
+    else if v.isZero then u
+    else if subsumes u v then u
+    else if subsumes v u then v
+    else if u.getLevelOffset == v.getLevelOffset then
+      if u.getOffset ≥ v.getOffset then u else v
+    else
+      .max u v
+  change ∃ w, VLevel.ofLevel Us (mkLevelMaxCore u v) = some w ∧ w ≈ .max u' v'
+  have le {u v u' v'} (h : subsumes u v)
+      (hu : VLevel.ofLevel Us u = some u')
+      (hv : VLevel.ofLevel Us v = some v') : v'.LE u' := by
+    simp [subsumes] at h
+    obtain ⟨h1, h2⟩ | h := h
+    · clear subsumes mkLevelMaxCore
+      induction v generalizing u u' v' with simp [VLevel.ofLevel] at hv h2 ⊢
+      | zero => subst v'; exact VLevel.zero_le
+      | succ _ ih =>
+        obtain ⟨_, hv, rfl⟩ := hv
+        generalize eq : u.getOffset' = n at h2
+        unfold Level.getOffset' at eq; split at eq <;> subst eq <;> [skip; cases h2]
+        simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, rfl⟩ := hu
+        simp [Level.isExplicit] at h1
+        exact VLevel.succ_le_succ (ih hu hv h1.2 (Nat.le_of_succ_le_succ h2))
+      | _ => cases h1
+    · split at h <;> [skip; cases h]
+      simp [VLevel.ofLevel] at hu; obtain ⟨_, hu1, _, hu2, rfl⟩ := hu
+      simp at h; obtain rfl | rfl := h
+      · cases hv.symm.trans hu1
+        exact VLevel.le_max_left
+      · cases hv.symm.trans hu2
+        exact VLevel.le_max_right
+  simp only [mkLevelMaxCore]; split
+  · simp_all; exact VLevel.max_self.symm
+  split
+  · let .zero := u; simp [VLevel.ofLevel] at h1; subst u'
+    exact ⟨_, h2, VLevel.zero_le.max_eq_right.symm⟩
+  split
+  · let .zero := v; simp [VLevel.ofLevel] at h2; subst v'
+    exact ⟨_, h1, VLevel.zero_le.max_eq_left.symm⟩
+  split
+  · exact ⟨_, h1, (le ‹_› h1 h2).max_eq_left.symm⟩
+  split
+  · exact ⟨_, h2, (le ‹_› h2 h1).max_eq_right.symm⟩
+  split
+  · rename_i h
+    simp at h ⊢
+    let rec lem1 {v : Level} {u' v'}
+        (hu : VLevel.ofLevel Us v.getLevelOffset = some u')
+        (hv : VLevel.ofLevel Us v = some v') : u'.LE v' := by
+      unfold Level.getLevelOffset at hu; split at hu
+      · simp [VLevel.ofLevel] at hv; obtain ⟨_, hv, rfl⟩ := hv
+        exact VLevel.le_trans (lem1 hu hv) VLevel.le_succ
+      · cases hu.symm.trans hv; exact VLevel.le_refl _
+    let rec lem2 {u v : Level} {u' v'}
+        (h1 : u.getLevelOffset = v.getLevelOffset)
+        (h2 : u.getOffset' ≤ v.getOffset')
+        (hu : VLevel.ofLevel Us u = some u')
+        (hv : VLevel.ofLevel Us v = some v') : u'.LE v' := by
+      revert h1 h2; unfold Level.getLevelOffset Level.getOffset'
+      split <;> simp <;> split <;> (try simp)
+      · simp [VLevel.ofLevel] at hu; obtain ⟨_, hu, rfl⟩ := hu
+        simp [VLevel.ofLevel] at hv; obtain ⟨_, hv, rfl⟩ := hv
+        exact (VLevel.succ_le_succ <| lem2 · · hu hv)
+      · rintro rfl; exact lem1 (v := .succ _) hu hv
+      · rintro rfl; cases hu.symm.trans hv; exact VLevel.le_refl _
+    split <;> rename_i h3
+    · exact ⟨_, h1, (lem2 h.symm h3 h2 h1).max_eq_left.symm⟩
+    · exact ⟨_, h2, (lem2 h (Nat.le_of_not_le h3) h1 h2).max_eq_right.symm⟩
+  simp [VLevel.ofLevel]; exact ⟨_, ⟨_, h1, _, h2, rfl⟩, rfl⟩
+
+theorem ofLevel_isNeverZero (h : VLevel.ofLevel Us u = some u') (H : u.isNeverZero) :
+    u'.IsNeverZero := by
+  induction u generalizing u' with simp [Level.isNeverZero, VLevel.ofLevel] at H h <;> intro ls
+  | succ =>
+    obtain ⟨_, h1, rfl⟩ := h
+    exact Nat.succ_ne_zero _
+  | max _ _ ih1 ih2 =>
+    obtain ⟨_, h1, _, h2, rfl⟩ := h
+    intro h
+    rw [VLevel.eval, ← Nat.le_zero, Nat.max_le] at h; simp at h
+    exact H.elim (ih1 h1 · _ h.1) (ih2 h2 · _ h.2)
+  | imax _ _ ih1 ih2 =>
+    obtain ⟨_, h1, _, h2, rfl⟩ := h
+    simp [VLevel.eval, Lean.Nat.imax, ih2 h2 H ls]
+
+theorem ofLevel_isAlwaysZero (h : VLevel.ofLevel Us u = some u') (H : u.isAlwaysZero) :
+    u' ≈ .zero := by
+  induction u generalizing u' with
+    simp [Level.isAlwaysZero, VLevel.ofLevel] at H h <;> subst_vars <;>
+    refine VLevel.equiv_def.2 fun ls => ?_
+  | zero => rfl
+  | max _ _ ih1 ih2 =>
+    obtain ⟨_, h1, _, h2, rfl⟩ := h
+    simp [VLevel.eval, VLevel.equiv_def.1 (ih1 h1 H.1) ls, VLevel.equiv_def.1 (ih2 h2 H.2) ls]
+  | imax _ _ _ ih2 =>
+    obtain ⟨_, _, _, h2, rfl⟩ := h
+    simp [VLevel.eval, Lean.Nat.imax, VLevel.equiv_def.1 (ih2 h2 H) ls]
+
+theorem ofLevel_mkLevelIMax'
+    (h1 : VLevel.ofLevel Us u = some u') (h2 : VLevel.ofLevel Us v = some v') :
+    ∃ w, VLevel.ofLevel Us (mkLevelIMax' u v) = some w ∧ w ≈ .imax u' v' := by
+  let mkLevelIMaxCore (u v : Level) :=
+    if v.isNeverZero then mkLevelMax' u v
+    else if v.isZero then v
+    else if u.isZero then v
+    else if u == v then u
+    else .imax u v
+  change ∃ w, VLevel.ofLevel Us (mkLevelIMaxCore u v) = some w ∧ w ≈ .imax u' v'
+  simp only [mkLevelIMaxCore]; split
+  · have ⟨_, a1, a2⟩ := ofLevel_mkLevelMax' h1 h2
+    exact ⟨_, a1, .trans a2 (ofLevel_isNeverZero h2 ‹_›).imax_eq_max.symm⟩
+  split
+  · let .zero := v; simp [VLevel.ofLevel] at h2; subst v'
+    exact ⟨.zero, rfl, rfl⟩
+  split
+  · let .zero := u; simp [VLevel.ofLevel] at h1; subst u'
+    exact ⟨_, h2, VLevel.zero_imax.symm⟩
+  split
+  · simp_all; exact VLevel.imax_self.symm
+  simp [VLevel.ofLevel]; exact ⟨_, ⟨_, h1, _, h2, rfl⟩, rfl⟩
+
+variable! {ls : List VLevel} (hls : ∀ l ∈ ls, l.WF U') in
+theorem TrProj.instL (H : TrProj env U Γ s i e e') :
+    TrProj env U' (Γ.map (VExpr.instL ls)) s i
+      (e.instL ls) (e'.instL ls) := by
+  obtain ⟨view, levels, params, hname, hproj⟩ := H
+  exact ⟨view, levels.map (VLevel.inst ls),
+    params.map (VExpr.instL ls), hname, hproj.instL hls⟩
+
+/-- The structural interface of Verify's projection translation.  The bundle
+keeps the seven laws available as one coherent capability while the named
+theorems above remain the compatibility surface for existing callers. -/
+structure TrProj.StructuralLaws (env : VEnv) : Prop where
+  weakening : ∀ {U n Γ Γ' s i e e'},
+    Ctx.Lift' n Γ Γ' → TrProj env U Γ s i e e' →
+      TrProj env U Γ' s i (e.lift' n) (e'.lift' n)
+  inverseWeakening : ∀ {U l Γ Γ' s i e e'},
+    OnCtx Γ' (env.IsType U) → Ctx.Lift' l Γ Γ' →
+      TrProj env U Γ' s i (e.lift' l) e' →
+        ∃ result, TrProj env U Γ s i e result
+  contextDefEq : ∀ {U Γ₁ Γ₂ s i e₁ e₂ result},
+    env.IsDefEqCtx U [] Γ₁ Γ₂ → env.IsDefEqU U Γ₁ e₁ e₂ →
+      TrProj env U Γ₁ s i e₁ result →
+        ∃ result', TrProj env U Γ₂ s i e₂ result'
+  wellFormed : ∀ {U Γ s i e result},
+    TrProj env U Γ s i e result → VExpr.WF env U Γ e →
+      VExpr.WF env U Γ result
+  unique : ∀ {U Γ₁ Γ₂ s₁ s₂ i e₁ e₂ result₁ result₂},
+    env.IsDefEqCtx U [] Γ₁ Γ₂ →
+      TrProj env U Γ₁ s₁ i e₁ result₁ →
+      TrProj env U Γ₂ s₂ i e₂ result₂ →
+      env.IsDefEqU U Γ₁ e₁ e₂ →
+        env.IsDefEqU U Γ₁ result₁ result₂
+  termSubstitution : ∀ {U Γ₀ Γ₁ Γ s i e e' e₀ A₀ k},
+    env.HasType U Γ₀ e₀ A₀ → Ctx.InstN Γ₀ e₀ A₀ k Γ₁ Γ →
+      TrProj env U Γ₁ s i e e' →
+        TrProj env U Γ s i (e.inst e₀ k) (e'.inst e₀ k)
+  universeInstantiation : ∀ {U U' Γ s i e e'} {ls : List VLevel},
+    (∀ level ∈ ls, level.WF U') → U = ls.length →
+      TrProj env U Γ s i e e' →
+        TrProj env U' (Γ.map (VExpr.instL ls)) s i
+          (e.instL ls) (e'.instL ls)
+
+/-- Every well-formed environment supplies the complete projection structural
+interface. -/
+theorem TrProj.structuralLaws (henv : VEnv.WF env) :
+    TrProj.StructuralLaws env where
+  weakening W H := H.weak' henv.ordered W
+  inverseWeakening hΓ' W H := H.weak'_inv henv hΓ' W
+  contextDefEq hΓ he H := H.defeqDFC henv hΓ he
+  wellFormed H he := H.wf he
+  unique hΓ H1 H2 he := H1.uniq henv hΓ H2 he
+  termSubstitution h₀ W H := H.instN henv.ordered h₀ W
+  universeInstantiation hls _ H := H.instL hls
+
+/-!
+The guards below pin both the proved laws and the inherited Tier-R boundary.
+In particular, they distinguish local proof closure from the remaining public
+registered-head inversion dependency.
+-/
+
+#guard_named_axioms Ix.Theory.Named.TrProj.weak' [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.weak'_inv [propext, sorryAx, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.defeqDFC [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.wf [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.uniq [propext, sorryAx, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.instN [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.instL [propext, Quot.sound]
+
+#guard_named_axioms Ix.Theory.Named.TrProj.structuralLaws [
+  propext,
+  sorryAx,
+  Classical.choice,
+  Quot.sound]
+
+section
+
+variable (henv : VEnv.WF env) {Us ps : List Name} {ls : List Level} {ls' : List VLevel}
+  (hΔ : VLCtx.WF env ls'.length Δ)
+  (Hls : ls.mapM (VLevel.ofLevel Us) = some ls')
+  (eq : ps.length = ls.length)
+
+include Hls eq
+
+section
+variable (eqF : (fun x => ((List.idxOf? x ps).bind fun x => ls[x]?).getD (Level.param x)) = F)
+include eqF
+
+attribute [-simp] Bool.forall_bool in
+theorem substParams_wf (red) (H : VLevel.ofLevel ps u = some u') :
+    ∃ u₁, VLevel.ofLevel Us (u.substParams' F red) = some u₁ ∧ u₁ ≈ u'.inst ls' := by
+  induction u generalizing u' red with simp_all [VLevel.ofLevel, Level.substParams']
+  | zero => subst u'; rfl
+  | succ _ ih =>
+    obtain ⟨_, H, rfl⟩ := H
+    exact let ⟨_, h1, h2⟩ := ih _ H; ⟨_, ⟨_, h1, rfl⟩, VLevel.succ_congr h2⟩
+  | max _ _ ih1 ih2 =>
+    obtain ⟨_, H1, _, H2, rfl⟩ := H
+    generalize (_ && _) = red'
+    let ⟨_, a1, a2⟩ := ih1 (red := red') H1
+    let ⟨_, b1, b2⟩ := ih2 (red := red') H2
+    split
+    · have ⟨w, c1, c2⟩ := ofLevel_mkLevelMax' a1 b1
+      exact ⟨_, c1, .trans c2 <| VLevel.max_congr a2 b2⟩
+    · simp [VLevel.ofLevel]
+      exact ⟨_, ⟨_, a1, _, b1, rfl⟩, VLevel.max_congr a2 b2⟩
+  | imax _ _ ih1 ih2 =>
+    obtain ⟨_, H1, _, H2, rfl⟩ := H
+    generalize (_ && _) = red'
+    let ⟨_, a1, a2⟩ := ih1 (red := red') H1
+    let ⟨_, b1, b2⟩ := ih2 (red := red') H2
+    split
+    · have ⟨w, c1, c2⟩ := ofLevel_mkLevelIMax' a1 b1
+      exact ⟨_, c1, .trans c2 <| VLevel.imax_congr a2 b2⟩
+    · simp [VLevel.ofLevel]
+      exact ⟨_, ⟨_, a1, _, b1, rfl⟩, VLevel.imax_congr a2 b2⟩
+  | param x =>
+    obtain ⟨H, rfl⟩ := H; subst eqF; simp
+    have := List.idxOf_eq_getD_idxOf? x ps; unfold Option.getD at this; revert this
+    split <;> simp [*, Nat.ne_of_lt, VLevel.inst]; rintro rfl; clear ‹_› eq
+    generalize List.idxOf x ps = n at *
+    rw [List.mapM_eq_some] at Hls
+    induction Hls generalizing n with
+    | nil => cases H
+    | cons Hl _ ih =>
+      obtain _|n := n <;> simp
+      · exact ⟨_, Hl, rfl⟩
+      · exact ih _ (Nat.lt_of_succ_lt_succ H)
+
+theorem substParams_wf_list (red) {us us' : List _} (H : us.mapM (VLevel.ofLevel ps) = some us') :
+    ∃ us₁, (us.map (Level.substParams' F red)).mapM (VLevel.ofLevel Us) = some us₁ ∧
+      List.Forall₂ (· ≈ ·) us₁ (us'.map (·.inst ls')) := by
+  induction us generalizing us' with simp_all
+  | cons u us ih =>
+    obtain ⟨_, H1, _, H2, rfl⟩ := H
+    have ⟨_, h1, h2⟩ := ih H2
+    have ⟨_, h3, h4⟩ := substParams_wf Hls eq eqF red H1
+    refine ⟨_, ⟨_, h3, _, h1, rfl⟩, .cons h4 h2⟩
+
+end
+
+include henv hΔ
+
+theorem TrExprS.instL (H : TrExprS env ps Δ e e') :
+    TrExpr env Us (Δ.instL ls') (e.instantiateLevelParams ps ls) (e'.instL ls') := by
+  simp [Expr.instantiateLevelParams_eq]
+  generalize (_ && _) = red, eqF : (fun x : Name => _) = F
+  have Hls' := VLevel.WF.of_mapM_ofLevel Hls
+  have eq' := eq.trans (List.mapM_eq_some.1 Hls).length_eq
+  induction H with
+  | bvar h1 => exact (bvar (VLCtx.find?_instL h1)).trExpr henv (hΔ.instL Hls')
+  | fvar h1 => exact (fvar (VLCtx.find?_instL h1)).trExpr henv (hΔ.instL Hls')
+  | sort h1 =>
+    simp [Expr.instantiateLevelParamsCore']
+    have ⟨_, a1, a2⟩ := substParams_wf Hls eq eqF red h1
+    exact ⟨_, .sort a1, _, .sortDF (.of_ofLevel a1) (.inst Hls') a2⟩
+  | const h1 h2 h3 =>
+    have ⟨_, a1, a2⟩ := substParams_wf_list Hls eq eqF red h2
+    refine ⟨_, .const h1 a1 (by simp [h3]), _, .constDF h1 (.of_mapM_ofLevel a1) ?_ ?_ a2⟩
+    · simp; exact fun _ _ => .inst Hls'
+    · simp [← (List.mapM_eq_some.1 a1).length_eq, h3]
+  | app h1 h2 _ _ ih1 ih2 =>
+    exact .app henv (hΔ.instL Hls')
+      (VLCtx.instL_toCtx _ ▸ h1.instL Hls')
+      (VLCtx.instL_toCtx _ ▸ h2.instL Hls') (ih1 hΔ) (ih2 hΔ)
+  | lam h1 h2 _ ih1 ih2 =>
+    exact .lam henv (hΔ.instL Hls')
+      (VLCtx.instL_toCtx _ ▸ h1.instL Hls') (ih1 hΔ) (ih2 ⟨hΔ, nofun, eq' ▸ h1⟩)
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    exact .forallE henv (hΔ.instL Hls')
+      (VLCtx.instL_toCtx _ ▸ h1.instL Hls')
+      (VLCtx.instL_toCtx _ ▸ h2.instL Hls') (ih1 hΔ) (ih2 ⟨hΔ, nofun, eq' ▸ h1⟩)
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    exact .letE henv (hΔ.instL Hls')
+      (VLCtx.instL_toCtx _ ▸ h1.instL Hls') (ih1 hΔ) (ih2 hΔ) (ih3 ⟨hΔ, nofun, eq' ▸ h1⟩)
+  | lit h1 _ ih =>
+    refine .lit h1 (Expr.instantiateLevelParamsCore_eq_self ?_ ▸ ih hΔ :)
+    exact Literal.toConstructor_hasLevelParam
+  | mdata _ ih => exact .mdata (ih hΔ)
+  | proj _ h2 ih =>
+    exact .proj henv (hΔ.instL Hls') (ih hΔ)
+      (VLCtx.instL_toCtx _ ▸ h2.instL Hls')
+
+theorem TrExpr.instL (H : TrExpr env ps Δ e e') :
+    TrExpr env Us (Δ.instL ls') (e.instantiateLevelParams ps ls) (e'.instL ls') :=
+  let ⟨_, s1, h1⟩ := H
+  have Hls' := .of_mapM_ofLevel Hls
+  (s1.instL henv hΔ Hls eq).defeq henv (hΔ.instL Hls') (VLCtx.instL_toCtx _ ▸ h1.instL Hls')
+
+end
+
+theorem TrExprS.abstract (W : VLCtx.Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) (H : TrExprS env Us Δ₁ e e') :
+    TrExprS env Us Δ (e.abstract1 v₀ dk) e' := by
+  induction H generalizing dk k Δ with
+  | bvar h1 =>
+    exact .bvar <| (W.find? (by nofun)).trans <| by
+      simp; split <;> [skip; rw [if_neg (by omega), if_neg (by omega)]] <;> exact h1
+  | @fvar _ _ _ fv h1 =>
+    if h : fv = v₀ then
+      rw [h, W.find?_self] at h1; cases h1
+      rw [Expr.abstract1, if_pos (by simp [h])]
+      exact .bvar <| (W.find? (by nofun)).trans (by simpa using W.find?_self)
+    else
+      have := W.find? (v := .inr fv) (by rintro ⟨⟩; trivial)
+      simp at this
+      rw [Expr.abstract1, if_neg]
+      · exact .fvar (this.trans h1)
+      · simp; rintro rfl; trivial
+  | sort h1 => exact .sort h1
+  | const h1 h2 h3 => exact .const h1 h2 h3
+  | app h1 h2 _ _ ih1 ih2 => exact .app (W.toCtx ▸ h1) (W.toCtx ▸ h2) (ih1 W) (ih2 W)
+  | lam h1 _ _ ih1 ih2 => exact .lam (W.toCtx ▸ h1) (ih1 W) (ih2 W.succ)
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    exact .forallE (W.toCtx ▸ h1) (W.toCtx ▸ h2) (ih1 W) (ih2 W.succ)
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    exact .letE (W.toCtx ▸ h1) (ih1 W) (ih2 W) (ih3 W.succ)
+  | lit h1 _ ih =>
+    exact .lit h1 (FVarsIn.toConstructor.abstract_eq_self .toConstructor ▸ ih W)
+  | mdata _ ih => exact .mdata (ih W)
+  | proj _ h2 ih => exact .proj (ih W) (W.toCtx ▸ h2)
+
+theorem TrExpr.abstract (W : VLCtx.Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ) (H : TrExpr env Us Δ₁ e e') :
+    TrExpr env Us Δ (e.abstract1 v₀ dk) e' :=
+  let ⟨_, s, h⟩ := H; ⟨_, s.abstract W, W.toCtx ▸ h⟩
+
+def TrExprS.IsUnique : Expr → Prop
+  | .bvar _
+  | .fvar _
+  | .sort _
+  | .const ..
+  | .mvar ..
+  | .lit _ => True
+  | .app f a => IsUnique f ∧ IsUnique a
+  | .lam _ t b _ => IsUnique t ∧ IsUnique b
+  | .forallE _ t b _ => IsUnique t ∧ IsUnique b
+  | .letE _ _ v b _ => IsUnique v ∧ IsUnique b
+  | .mdata _ e => IsUnique e
+  | .proj .. => False
+
+theorem TrExprS.IsUnique.natLitToConstructor : ∀ {n : Nat}, IsUnique (.natLitToConstructor n)
+  | 0 => ⟨⟩
+  | _+1 => ⟨⟨⟩, ⟨⟩⟩
+
+theorem TrExprS.IsUnique.strLitToConstructor {s : String} : IsUnique (.strLitToConstructor s) := by
+  refine ⟨⟨⟩, ?_⟩
+  induction s.toList with simp
+  | nil => exact ⟨⟨⟩, ⟨⟩⟩
+  | cons _ _ ih => exact ⟨⟨⟨⟨⟩, ⟨⟩⟩, ⟨⟨⟩, ⟨⟩⟩⟩, ih⟩
+
+theorem TrExprS.IsUnique.toConstructor : ∀ {l : Literal}, IsUnique l.toConstructor
+  | .natVal _ => .natLitToConstructor
+  | .strVal _ => .strLitToConstructor
+
+inductive TrExprS.IsUniqueDecl : VLocalDecl → VLocalDecl → Prop
+  | vlam : IsUniqueDecl (.vlam ty) (.vlam ty')
+  | vlet : IsUniqueDecl (.vlet ty val) (.vlet ty' val)
+
+inductive TrExprS.IsUniqueCtx : VLCtx → VLCtx → Prop
+  | base : IsUniqueCtx Δ Δ
+  | cons : IsUniqueCtx Δ₁ Δ₂ → IsUniqueDecl d₁ d₂ → IsUniqueCtx ((ofv, d₁) :: Δ₁) ((ofv, d₂) :: Δ₂)
+
+theorem TrExprS.IsUniqueCtx.find?_uniq (hΔ : IsUniqueCtx Δ₁ Δ₂)
+    (H1 : Δ₁.find? v = some (e₁, A₁)) (H2 : Δ₂.find? v = some (e₂, A₂)) : e₁ = e₂ := by
+  induction hΔ generalizing v e₁ e₂ A₁ A₂ with
+  | base => cases H1.symm.trans H2; rfl
+  | @cons _ _ _ _ ofv _ hd ih =>
+    revert H1 H2; simp [VLCtx.find?]; split
+    · rintro ⟨⟩ ⟨⟩; cases hd <;> rfl
+    · simp; rintro _ _ h1 rfl rfl _ _ h2 rfl rfl
+      congr 1
+      · cases hd <;> rfl
+      · exact ih h1 h2
+
+theorem TrExprS.unique' (hΔ : IsUniqueCtx Δ₁ Δ₂) (H : IsUnique e)
+    (H1 : TrExprS env Us Δ₁ e e₁) (H2 : TrExprS env Us Δ₂ e e₂) : e₁ = e₂ := by
+  induction H1 generalizing Δ₂ e₂ with cases H2
+  | bvar => exact hΔ.find?_uniq ‹_› ‹_›
+  | fvar => exact hΔ.find?_uniq ‹_› ‹_›
+  | sort h1
+  | const _ h1 => cases h1.symm.trans ‹_›; rfl
+  | app _ _ _ _ ih1 ih2 => cases ih1 hΔ H.1 ‹_›; cases ih2 hΔ H.2 ‹_›; rfl
+  | lam _ _ _ ih1 ih2
+  | forallE _ _ _ _ ih1 ih2 => cases ih1 hΔ H.1 ‹_›; cases ih2 (hΔ.cons .vlam) H.2 ‹_›; rfl
+  | letE _ _ _ _ _ ih1 ih2 => cases ih1 hΔ H.1 ‹_›; cases ih2 (hΔ.cons .vlet) H.2 ‹_›; rfl
+  | lit _ _ ih => exact ih hΔ .toConstructor ‹_›
+  | mdata _ ih => exact ih hΔ H ‹_›
+  | proj => cases H
+
+theorem TrExprS.unique (H : IsUnique e)
+    (H1 : TrExprS env Us Δ e e₁) (H2 : TrExprS env Us Δ e e₂) : e₁ = e₂ := H1.unique' .base H H2
+
+/-- A successful lookup transfers along value-preserving context alignment:
+the found value is identical and only the (discarded) type component may
+differ. -/
+theorem TrExprS.IsUniqueCtx.find?_transfer (hΔ : IsUniqueCtx Δ₁ Δ₂)
+    (H : Δ₁.find? v = some (e, A)) : ∃ A₂, Δ₂.find? v = some (e, A₂) := by
+  induction hΔ generalizing v e A with
+  | base => exact ⟨A, H⟩
+  | @cons Δ₁' Δ₂' d₁ d₂ ofv _ hd ih =>
+    revert H; simp only [VLCtx.find?]; split
+    next heq =>
+      simp only [Option.some.injEq, Prod.mk.injEq]
+      rintro ⟨rfl, rfl⟩
+      cases hd <;> exact ⟨_, rfl, rfl⟩
+    next v' heq =>
+      rintro h
+      simp only [Bind.bind, Option.bind_eq_some_iff] at h
+      obtain ⟨⟨e₁, A₁⟩, h1, h2⟩ := h
+      simp only [Option.some.injEq, Prod.mk.injEq] at h2
+      obtain ⟨rfl, rfl⟩ := h2
+      obtain ⟨A₂, h₂⟩ := ih h1
+      have hdep : d₁.depth = d₂.depth := by cases hd <;> rfl
+      refine ⟨VExpr.liftN d₂.depth A₂, ?_⟩
+      simp only [Bind.bind, Option.bind_eq_some_iff]
+      exact ⟨(e₁, A₂), h₂, by rw [hdep]⟩
+
+/-- Every strict translation of an unfolded natural-number literal is the
+canonical numeral: the constructor spine pins the Theory value
+syntactically. -/
+theorem TrExprS.natLitToConstructor_eq :
+    ∀ {n : Nat} {w}, TrExprS env Us Δ (Expr.natLitToConstructor n) w →
+      w = VExpr.natLit n
+  | 0, w, h => by
+    have h : TrExprS env Us Δ (.const ``Nat.zero []) w := h
+    cases h with
+    | const h1 h2 h3 =>
+      obtain rfl : _ = ([] : List VLevel) := by simpa using h2.symm
+      rfl
+  | n+1, w, h => by
+    have h : TrExprS env Us Δ (.app (.const ``Nat.succ []) (.lit (.natVal n))) w := h
+    cases h with
+    | app h1 h2 hf ha =>
+      cases hf with
+      | const hf1 hf2 hf3 =>
+        obtain rfl : _ = ([] : List VLevel) := by simpa using hf2.symm
+        cases ha with
+        | lit ha1 ha2 =>
+          cases natLitToConstructor_eq ha2
+          rfl
+
+/-- Every strict translation of an unfolded character-list literal is the
+canonical Theory list. -/
+theorem TrExprS.strLitToConstructor_chars_eq :
+    ∀ {cs : List Char} {w},
+      TrExprS env Us Δ
+        (cs.foldr (init := .app (.const ``List.nil [.zero]) (.const ``Char []))
+          fun c e =>
+            .app (.app (.app (.const ``List.cons [.zero]) (.const ``Char []))
+              (.app (.const ``Char.ofNat []) (.lit (.natVal c.toNat)))) e) w →
+      w = VExpr.listCharLit cs
+  | [], w, h => by
+    cases h with
+    | app h1 h2 hf ha =>
+      cases hf with
+      | const hf1 hf2 hf3 =>
+        simp [VLevel.ofLevel] at hf2
+        obtain rfl := hf2
+        cases ha with
+        | const ha1 ha2 ha3 =>
+          obtain rfl : _ = ([] : List VLevel) := by simpa using ha2.symm
+          rfl
+  | c :: cs, w, h => by
+    cases h with
+    | app h1 h2 hf ha =>
+      cases strLitToConstructor_chars_eq ha
+      cases hf with
+      | app hg1 hg2 hgf hga =>
+        cases hgf with
+        | app hh1 hh2 hhf hha =>
+          cases hhf with
+          | const hi1 hi2 hi3 =>
+            simp [VLevel.ofLevel] at hi2
+            obtain rfl := hi2
+            cases hha with
+            | const hj1 hj2 hj3 =>
+              obtain rfl : _ = ([] : List VLevel) := by simpa using hj2.symm
+              cases hga with
+              | app hk1 hk2 hkf hka =>
+                cases hkf with
+                | const hl1 hl2 hl3 =>
+                  obtain rfl : _ = ([] : List VLevel) := by simpa using hl2.symm
+                  cases hka with
+                  | lit hm1 hm2 =>
+                    cases natLitToConstructor_eq hm2
+                    rfl
+
+/-- Every strict translation of a literal's constructor unfolding is the
+canonical `VExpr.trLiteral` value. -/
+theorem TrExprS.toConstructor_eq {l : Literal} {w}
+    (h : TrExprS env Us Δ l.toConstructor w) : w = VExpr.trLiteral l := by
+  match l with
+  | .natVal n => exact natLitToConstructor_eq h
+  | .strVal s =>
+    have h : TrExprS env Us Δ (.app (.const ``String.ofList [])
+      (s.toList.foldr (init := .app (.const ``List.nil [.zero]) (.const ``Char []))
+        fun c e =>
+          .app (.app (.app (.const ``List.cons [.zero]) (.const ``Char []))
+            (.app (.const ``Char.ofNat []) (.lit (.natVal c.toNat)))) e)) w := h
+    cases h with
+    | app h1 h2 hf ha =>
+      cases strLitToConstructor_chars_eq ha
+      cases hf with
+      | const hf1 hf2 hf3 =>
+        obtain rfl : _ = ([] : List VLevel) := by simpa using hf2.symm
+        rfl
+
+/-- The Verify traversal of `Literal.toConstructor` and the direct Theory
+encoding form one ready, well-formed literal value. -/
+theorem TrExprS.toConstructor_ready {l : Literal} {w}
+    (hready : env.PreludeReady) (hcontains : env.ContainsLits l)
+    (h : TrExprS env Us Δ l.toConstructor w) :
+    w = VExpr.trLiteral l ∧ VExpr.WF env U [] w := by
+  have heq := h.toConstructor_eq
+  refine ⟨heq, ?_⟩
+  rw [heq]
+  exact hready.trLiteral_wf l hcontains
+
+/-- The deterministic translator agrees with every strict-translation
+derivation over any value-preserving context alignment: on the `IsUnique`
+fragment, `trExprS?` computes exactly the derivation's Theory value.  This
+is the replay engine for choice-free semantic packaging — a `Nonempty`
+translation witness plus this agreement pins the computed value. -/
+theorem TrExprS.trExprS?_eq' (hΔ : IsUniqueCtx Δ₁ Δ₂)
+    (H : TrExprS env Us Δ₁ e e') (hu : IsUnique e) :
+    trExprS? Us Δ₂ e = some e' := by
+  induction H generalizing Δ₂ with
+  | bvar h1 =>
+    obtain ⟨A₂, h2⟩ := hΔ.find?_transfer h1
+    simp [trExprS?, h2]
+  | fvar h1 =>
+    obtain ⟨A₂, h2⟩ := hΔ.find?_transfer h1
+    simp [trExprS?, h2]
+  | sort h1 => simp [trExprS?, h1]
+  | const h1 h2 h3 => simp [trExprS?, h2]
+  | app h1 h2 _ _ ih1 ih2 =>
+    simp [trExprS?, ih1 hΔ hu.1, ih2 hΔ hu.2]
+  | lam h1 _ _ ih1 ih2 =>
+    simp [trExprS?, ih1 hΔ hu.1, ih2 (hΔ.cons .vlam) hu.2]
+  | forallE h1 h2 _ _ ih1 ih2 =>
+    simp [trExprS?, ih1 hΔ hu.1, ih2 (hΔ.cons .vlam) hu.2]
+  | letE h1 _ _ _ ih1 ih2 ih3 =>
+    simp [trExprS?, ih2 hΔ hu.1, ih3 (hΔ.cons .vlet) hu.2]
+  | lit h1 h2 ih =>
+    cases h2.toConstructor_eq
+    simp [trExprS?]
+  | mdata _ ih => simpa [trExprS?] using ih hΔ hu
+  | proj h1 h2 => cases hu
+
+/-- Deterministic-translator agreement in a fixed context. -/
+theorem TrExprS.trExprS?_eq (H : TrExprS env Us Δ e e') (hu : IsUnique e) :
+    trExprS? Us Δ e = some e' :=
+  H.trExprS?_eq' .base hu
+
+/-- Executable totality on the unique fragment: any translation witness
+guarantees the deterministic translator succeeds. -/
+theorem TrExprS.trExprS?_isSome (hex : ∃ e', TrExprS env Us Δ e e')
+    (hu : IsUnique e) : (trExprS? Us Δ e).isSome := by
+  obtain ⟨e', H⟩ := hex
+  simp [H.trExprS?_eq hu]
+
+/-- Replay transfer: an existential translation witness holds of the computed
+translation itself.  Choice-free packagers pin their Theory data with this:
+compute by `trExprS?`, then transfer the `Nonempty`-level witness onto the
+computed value. -/
+theorem TrExprS.of_trExprS?_eq (hex : ∃ e', TrExprS env Us Δ e e')
+    (hu : IsUnique e) (h : trExprS? Us Δ e = some v) :
+    TrExprS env Us Δ e v := by
+  obtain ⟨e', H⟩ := hex
+  cases Option.some.inj ((H.trExprS?_eq hu).symm.trans h)
+  exact H
+
+theorem TrExprS.boolFalse (henv : env.HasPrimitives) (H : env.contains ``Bool) :
+    TrExprS env Us Δ (toExpr false) .boolFalse ∧
+    env.HasType Us.length Δ.toCtx .boolFalse .bool := by
+  let ⟨⟨_, H⟩, _⟩ := henv.bool H
+  cases henv.boolFalse H
+  exact ⟨.const H rfl rfl, .const H nofun rfl⟩
+
+theorem TrExprS.boolTrue (henv : env.HasPrimitives) (H : env.contains ``Bool) :
+    TrExprS env Us Δ (toExpr true) .boolTrue ∧
+    env.HasType Us.length Δ.toCtx .boolTrue .bool := by
+  let ⟨_, _, H⟩ := henv.bool H
+  cases henv.boolTrue H
+  exact ⟨.const H rfl rfl, .const H nofun rfl⟩
+
+theorem TrExprS.boolLit (henv : env.HasPrimitives) (H : env.contains ``Bool) (b : Bool) :
+    TrExprS env Us Δ (toExpr b) (.boolLit b) ∧
+    env.HasType Us.length Δ.toCtx (.boolLit b) .bool := by
+  match b with
+  | false => exact TrExprS.boolFalse henv H
+  | true => exact TrExprS.boolTrue henv H
+
+theorem FVarsIn.boolLit {b : Bool} : FVarsIn P (toExpr b) := by cases b <;> exact nofun
+
+theorem TrExprS.lit_has_type (H : TrExprS env Us Δ (.lit l) e') : env.ContainsLits l :=
+  let .lit H _ := H; H
+
+theorem TrExprS.nat_of_natZero (wf : env.Ordered) (henv : env.HasPrimitives)
+    (H : TrExprS env Us Δ .natZero e') : env.contains ``Nat := by
+  let .const H .. := H
+  have ⟨_, H⟩ := henv.natZero H ▸ wf.constWF H
+  have ⟨_, H, _⟩ := H.const_inv wf (by trivial)
+  exact ⟨_, H⟩
+
+theorem TrExprS.natZero (henv : env.HasPrimitives) (H : env.contains ``Nat) :
+    TrExprS env Us Δ .natZero .natZero ∧ env.HasType Us.length Δ.toCtx .natZero .nat := by
+  let ⟨⟨_, H⟩, _⟩ := henv.nat H
+  cases henv.natZero H
+  exact ⟨.const H rfl rfl, .const H nofun rfl⟩
+
+theorem TrExprS.natSucc (henv : env.HasPrimitives) (H : env.contains ``Nat) :
+    TrExprS env Us Δ .natSucc .natSucc ∧
+    env.HasType Us.length Δ.toCtx .natSucc (.forallE .nat .nat) := by
+  let ⟨_, _, H⟩ := henv.nat H
+  cases henv.natSucc H
+  exact ⟨.const H rfl rfl, .const H nofun rfl⟩
+
+theorem TrExprS.natLit (henv : env.HasPrimitives) (H : env.contains ``Nat) (n) :
+    TrExprS env Us Δ (.lit (.natVal n)) (.natLit n) ∧
+    env.HasType Us.length Δ.toCtx (.natLit n) .nat := by
+  induction n with
+  | zero => exact let ⟨h1, h2⟩ := natZero henv H; ⟨.lit H h1, h2⟩
+  | succ n ih => exact let ⟨h1, h2⟩ := natSucc henv H; ⟨.lit H (.app h2 ih.2 h1 ih.1), .app h2 ih.2⟩
+
+theorem TrExprS.stringOfList (henv : env.HasPrimitives) (H : env.contains ``String.ofList) :
+    TrExprS env Us Δ (.const ``String.ofList []) .stringOfList ∧
+    env.HasType Us.length Δ.toCtx .stringOfList (.forallE .listChar .string) := by
+  let ⟨_, H⟩ := H
+  cases (henv.stringOfList H).1
+  exact ⟨.const H rfl rfl, .const H nofun rfl⟩
+
+theorem TrExprS.charOfNat (henv : env.HasPrimitives) (H : env.contains ``Char.ofNat) :
+    TrExprS env Us Δ (.const ``Char.ofNat []) .charOfNat ∧
+    env.HasType Us.length Δ.toCtx .charOfNat (.forallE .nat .char) := by
+  let ⟨_, H⟩ := H
+  cases henv.charOfNat H
+  exact ⟨.const H rfl rfl, .const H nofun rfl⟩
+
+theorem TrExprS.listChar (wf : env.Ordered) (henv : env.HasPrimitives)
+    (H : env.contains ``String.ofList) :
+    TrExprS env Us Δ (.app (.const ``List [.zero]) (.const ``Char [])) .listChar ∧
+    env.IsType Us.length Δ.toCtx .listChar := by
+  let ⟨_, H⟩ := H
+  let ⟨_, H, _⟩ := henv.stringOfList H
+  let ⟨_, H⟩ := H.isType wf (by trivial)
+  refine ⟨?_, _, (H.instL (ls := []) nofun).weak0 wf⟩
+  let ⟨_, _, A, B⟩ := H.app_inv wf trivial
+  let ⟨_, A1, _, A3⟩ := A.const_inv wf trivial
+  let ⟨_, B1, _, B3⟩ := B.const_inv wf trivial
+  exact .app ((A.instL (ls := []) nofun).weak0 wf) ((B.instL (ls := []) nofun).weak0 wf)
+    (.const A1 rfl A3) (.const B1 rfl B3)
+
+theorem TrExprS.listCharNil (wf : env.Ordered) (henv : env.HasPrimitives)
+    (H : env.contains ``String.ofList) :
+    TrExprS env Us Δ (.app (.const ``List.nil [.zero]) (.const ``Char [])) .listCharNil ∧
+    env.HasType Us.length Δ.toCtx .listCharNil .listChar := by
+  let ⟨_, H⟩ := H
+  let ⟨_, H, _⟩ := henv.stringOfList H
+  refine ⟨?_, (H.instL (ls := []) nofun).weak0 wf⟩
+  let ⟨_, _, A, B⟩ := H.app_inv wf trivial
+  let ⟨_, A1, _, A3⟩ := A.const_inv wf trivial
+  let ⟨_, B1, _, B3⟩ := B.const_inv wf trivial
+  exact .app ((A.instL (ls := []) nofun).weak0 wf) ((B.instL (ls := []) nofun).weak0 wf)
+    (.const A1 rfl A3) (.const B1 rfl B3)
+
+theorem TrExprS.listCharCons (wf : env.Ordered) (henv : env.HasPrimitives)
+    (H : env.contains ``String.ofList) :
+    TrExprS env Us Δ (.app (.const ``List.cons [.zero]) (.const ``Char [])) .listCharCons ∧
+    env.HasType Us.length Δ.toCtx .listCharCons
+      (.forallE .char <| .forallE .listChar .listChar) := by
+  let ⟨_, H⟩ := H
+  let ⟨_, _, H⟩ := henv.stringOfList H
+  refine ⟨?_, (H.instL (ls := []) nofun).weak0 wf⟩
+  let ⟨_, _, A, B⟩ := H.app_inv wf trivial
+  let ⟨_, A1, _, A3⟩ := A.const_inv wf trivial
+  let ⟨_, B1, _, B3⟩ := B.const_inv wf trivial
+  exact .app ((A.instL (ls := []) nofun).weak0 wf) ((B.instL (ls := []) nofun).weak0 wf)
+    (.const A1 rfl A3) (.const B1 rfl B3)
+
+theorem TrExprS.listCharLit (wf : env.Ordered) (henv : env.HasPrimitives)
+    (H : env.ContainsLits (.strVal l)) (s : List Char) :
+    TrExprS env Us Δ (s.foldr
+      (init := .app (.const ``List.nil [.zero]) (.const ``Char []))
+      (fun c e => .app (.app
+        (.app (.const ``List.cons [.zero]) (.const ``Char []))
+        (.app (.const ``Char.ofNat []) (.lit (.natVal c.toNat)))) e)) (.listCharLit s) ∧
+    env.HasType Us.length Δ.toCtx (.listCharLit s) .listChar := by
+  induction s with
+  | nil => exact TrExprS.listCharNil wf henv H.2
+  | cons x _ ih =>
+    have a := TrExprS.listCharCons wf henv H.2 (Us := Us) (Δ := Δ)
+    have b := TrExprS.charOfNat henv H.1 (Us := Us) (Δ := Δ)
+    have c := TrExprS.natLit henv (henv.nat_of_charOfNat wf H.1) (Us := Us) (Δ := Δ) (n := x.toNat)
+    have d1 := b.1.app b.2 c.2 c.1; have d2 := b.2.app c.2
+    have e1 := a.1.app a.2 d2 d1; have e2 := a.2.app d2
+    exact ⟨e1.app e2 ih.2 ih.1, e2.app ih.2⟩
+
+theorem TrExprS.trLiteral (wf : env.Ordered) (henv : env.HasPrimitives)
+    (l) (H : env.ContainsLits l) :
+    TrExprS env Us Δ (.lit l) (.trLiteral l) ∧
+    env.HasType Us.length Δ.toCtx (.trLiteral l) (.const l.typeName []) := by
+  match l with
+  | .natVal n => exact TrExprS.natLit henv H _
+  | .strVal s =>
+    have a := TrExprS.stringOfList henv H.2 (Us := Us) (Δ := Δ)
+    have b := TrExprS.listCharLit wf henv H (Us := Us) (Δ := Δ) s.toList
+    exact ⟨.lit H (.app a.2 b.2 a.1 (String.foldr_eq .. ▸ b.1)), a.2.app b.2⟩
+
+def VLCtx.Closed : VLCtx → Prop
+  | [] => True
+  | (none, _) :: _ => False
+  | (some _, d) :: (Δ : VLCtx) => Δ.Closed ∧ d.ClosedN Δ.bvars
+
+def IsFVarUpSet (P : FVarId → Prop) : VLCtx → Prop
+  | [] => True
+  | (none, _) :: Δ => IsFVarUpSet P Δ
+  | (some (fv, deps), _) :: (Δ : VLCtx) =>
+    IsFVarUpSet P Δ ∧
+    (P fv → ∀ fv' ∈ deps, P fv')
+
+theorem IsFVarUpSet.congr : ∀ {Δ}, VLCtx.FVWF Δ →
+    (H : ∀ fv ∈ VLCtx.fvars Δ, P fv ↔ Q fv) → IsFVarUpSet P Δ ↔ IsFVarUpSet Q Δ
+  | [], _, _ => .rfl
+  | (none, _) :: Δ, ⟨h1, _⟩, H => congr (Δ := Δ) h1 H
+  | (some (fv, deps), d) :: (Δ : VLCtx), ⟨h1, h2⟩, H => by
+    refine and_congr (congr h1 fun fv h => H _ (.tail _ h)) (imp_congr (H _ (.head _)) ?_)
+    refine forall_congr' fun fv => imp_congr_right fun h => ?_
+    exact H _ (by simp [(h2 _ _ rfl).2 h])
+
+theorem IsFVarUpSet.and_fvars (H : VLCtx.FVWF Δ) :
+    IsFVarUpSet P Δ ↔ IsFVarUpSet (fun fv => P fv ∧ fv ∈ Δ.fvars) Δ :=
+  IsFVarUpSet.congr H fun _ h => (and_iff_left h).symm
+
+theorem IsFVarUpSet.trivial : ∀ {Δ}, IsFVarUpSet (fun _ => True) Δ
+  | [] => ⟨⟩
+  | (none, _) :: Δ => trivial (Δ := Δ)
+  | (some _, _) :: _ => ⟨trivial, fun _ _ _ => ⟨⟩⟩
+
+theorem IsFVarUpSet.fvars (H : VLCtx.FVWF Δ) : IsFVarUpSet (· ∈ Δ.fvars) Δ :=
+  (IsFVarUpSet.congr H fun _ => iff_true_intro).2 trivial
+
+def AllAbove (Δ : VLCtx) (P : FVarId → Prop) (fv : FVarId) : Prop := fv ∈ Δ.fvars → P fv
+
+theorem AllAbove.wf (H : Δ.FVWF) : IsFVarUpSet (AllAbove Δ P) Δ ↔ IsFVarUpSet P Δ :=
+  IsFVarUpSet.congr H fun _ h => by simp [h, AllAbove]
+
+def FVarsBelow (Δ e e') := ∀ P, IsFVarUpSet P Δ → FVarsIn P e → FVarsIn P e'
+
+theorem FVarsBelow.rfl : FVarsBelow Δ e e := fun _ _ => id
+
+theorem FVarsBelow.trans (H1 : FVarsBelow Δ e₁ e₂) (H2 : FVarsBelow Δ e₂ e₃) :
+    FVarsBelow Δ e₁ e₃ := fun _ h => H2 _ h ∘ H1 _ h
+
+def TrTyping (env : VEnv) (Us : List Name) (Δ : VLCtx) (e A : Expr) (e' A' : VExpr) : Prop :=
+  FVarsBelow Δ e A ∧ TrExprS env Us Δ e e' ∧ TrExprS env Us Δ A A' ∧
+  env.HasType Us.length Δ.toCtx e' A'
+
+theorem FVarsIn.mkAppRevList :
+    FVarsIn P (e.mkAppRevList es) ↔ FVarsIn P e ∧ ∀ a ∈ es, FVarsIn P a := by
+  induction es <;> simp [FVarsIn, and_comm, and_left_comm, *]
+
+theorem FVarsIn.mkAppList :
+    FVarsIn P (e.mkAppList es) ↔ FVarsIn P e ∧ ∀ a ∈ es, FVarsIn P a := by
+  simp [← Expr.mkAppRevList_reverse, FVarsIn.mkAppRevList]
+
+theorem FVarsBelow.mkAppList (H : FVarsBelow Δ e₁ e₂) :
+    FVarsBelow Δ (e₁.mkAppList es) (e₂.mkAppList es) := by
+  simp [FVarsBelow, FVarsIn.mkAppList] at H ⊢; grind
+
+theorem FVarsBelow.mkAppRevList (H : FVarsBelow Δ e₁ e₂) :
+    FVarsBelow Δ (e₁.mkAppRevList es) (e₂.mkAppRevList es) := by
+  simpa [← Expr.mkAppList_reverse] using H.mkAppList
+
+inductive LambdaBodyN : Nat → Expr → Expr → Prop
+  | zero : LambdaBodyN 0 e e
+  | succ : LambdaBodyN n body e → LambdaBodyN (n+1) (.lam i ty body bi) e
+
+theorem LambdaBodyN.closed (H : LambdaBodyN n e1 e2) : e1.Closed k → e2.Closed (k + n) := by
+  induction H generalizing k with
+  | zero => exact id
+  | succ _ ih => exact fun h => (Nat.add_right_comm .. ▸ ih h.2 :)
+
+theorem LambdaBodyN.add (H1 : LambdaBodyN m e1 e2) (H2 : LambdaBodyN n e2 e3) :
+    LambdaBodyN (n + m) e1 e3 := by
+  induction H1 with
+  | zero => exact H2
+  | succ _ ih => exact .succ (ih H2)
+
+theorem LambdaBodyN.instantiateList (H1 : LambdaBodyN n e1 e2) :
+    LambdaBodyN n (e1.instantiateList es k) (e2.instantiateList es (k+n)) := by
+  induction H1 generalizing k with
+  | zero => exact .zero
+  | succ _ ih =>
+    rw [Expr.instantiateList_lam]
+    refine .succ ?_
+    conv => arg 3; rw [← Nat.add_assoc, Nat.add_right_comm]
+    exact ih
+
+theorem LambdaBodyN.instantiateRevList (H1 : LambdaBodyN n e1 e2) :
+    LambdaBodyN n (e1.instantiateRevList es k) (e2.instantiateRevList es (k+n)) := by
+  simp only [← Expr.instantiateList_reverse]; exact H1.instantiateList
+
+inductive BetaReduce : Expr → Expr → Prop
+  | refl : BetaReduce e e
+  | trans : BetaReduce e₁ e₂ → BetaReduce e₂ e₃ → BetaReduce e₁ e₃
+  | app : BetaReduce f f' → BetaReduce (.app f a) (.app f' a)
+  | beta : e.looseBVarRange' = 0 → BetaReduce (.app (.lam i ty body bi) e) (body.instantiate1' e)
+
+theorem BetaReduce.mkAppRevList (H : BetaReduce f f') :
+    BetaReduce (f.mkAppRevList es) (f'.mkAppRevList es) := by
+  induction es with
+  | nil => exact H
+  | cons _ _ ih => exact .app ih
+
+theorem BetaReduce.mkAppList (H : BetaReduce f f') :
+    BetaReduce (f.mkAppList es) (f'.mkAppList es) := by
+  induction es generalizing f f' with
+  | nil => exact H
+  | cons _ _ ih => exact ih (.app H)
+
+theorem BetaReduce.instantiateList (H : BetaReduce f f') :
+    BetaReduce (f.instantiateList es) (f'.instantiateList es) := by
+  induction H with
+  | refl => exact .refl
+  | trans _ _ ih1 ih2 => exact ih1.trans ih2
+  | app _ ih => simp only [Expr.instantiateList_app]; exact .app ih
+  | beta h =>
+    simp only [Expr.instantiateList_app, Expr.instantiateList_lam]
+    rw [← Expr.instantiateList_instantiate1_comm h]
+    refine' cast _ (BetaReduce.beta _); congr 2
+    · rw [Expr.instantiateList_eq_self h]
+    · rwa [Expr.instantiateList_eq_self h]
+
+theorem BetaReduce.instantiateRevList (H : BetaReduce f f') :
+    BetaReduce (f.instantiateRevList es) (f'.instantiateRevList es) := by
+  simp only [← Expr.instantiateList_reverse]; exact H.instantiateList
+
+theorem FVarsBelow.betaReduce (H : BetaReduce e e') : FVarsBelow Δ e e' := by
+  intro P hP he
+  induction H with
+  | refl => exact he
+  | trans _ _ ih1 ih2 => exact ih2 (ih1 he)
+  | app _ ih => exact ⟨ih he.1, he.2⟩
+  | beta => exact he.1.2.instantiate1 he.2
+
+theorem BetaReduce.inst_reduce {l₁ : List Expr} {fn e₀ : Expr}
+    (h : ∀ x ∈ l₁, x.Closed) (l₂)
+    (h1 : LambdaBodyN l₁.length e₀ fn)
+    (hr : fn.instantiateList (l₁.reverse ++ l₂) = r) :
+    BetaReduce ((e₀.instantiateList l₂).mkAppList l₁) r := by
+  subst r
+  induction l₁ generalizing e₀ fn l₂ with
+  | nil => let .zero := h1; exact .refl
+  | cons a l ih =>
+    let .succ (body := body) h1 := h1
+    rw [Expr.instantiateList_lam]; simp at h ⊢
+    have h' := h.1.looseBVarRange_zero
+    refine .trans (.mkAppList (.beta h')) ?_
+    exact Expr.instantiateList_instantiate1_comm h' ▸ ih h.2 (a::l₂) h1
+
+theorem BetaReduce.cheapBetaReduce (hc : e.Closed) : BetaReduce e e.cheapBetaReduce := by
+  simp [Expr.cheapBetaReduce]
+  split; · exact .refl
+  split; · exact .refl
+  let rec loop {e' i fn args} (H : LambdaBodyN i e' fn) (hi : i ≤ args.size) :
+    ∃ n fn', LambdaBodyN n e' fn' ∧ n ≤ args.size ∧
+      Expr.cheapBetaReduce.loop e args i fn = Expr.cheapBetaReduce.cont e args n fn' := by
+    unfold Expr.cheapBetaReduce.loop; split
+    · split
+      · exact loop (by simpa [Nat.add_comm] using H.add (.succ .zero)) ‹_›
+      · exact ⟨_, _, H, Nat.le_of_lt ‹_›, rfl⟩
+    · exact ⟨_, _, H, hi, rfl⟩
+  refine let ⟨i, fn, h1, h2, eq⟩ := loop .zero (Nat.zero_le _); eq ▸ ?_; clear eq
+  simp [Expr.getAppArgs_eq] at h2 ⊢
+  obtain ⟨l₁, l₂, rfl, eq⟩ : ∃ l₁ l₂, l₁.length = i ∧ e.getAppArgsList = l₁ ++ l₂ :=
+    ⟨_, _, List.length_take_of_le (by simp [h2]), (List.take_append_drop ..).symm⟩
+  have eqr := congrArg List.reverse eq; simp at eqr
+  have hl₁ : ∀ x ∈ l₁, x.Closed := by
+    have := eqr ▸ hc.getAppArgsList; simp [or_imp, forall_and] at this
+    exact this.1
+  unfold Expr.cheapBetaReduce.cont; split <;> rename_i h3
+  · simp [Expr.hasLooseBVars] at h3
+    rw [Expr.mkAppRange_eq (l₂ := l₂) (l₃ := []) (by simp [eq]) rfl (by simp [← eq])]
+    rw [← e.mkAppList_getAppArgsList, eqr]; simp
+    refine .mkAppList <| .inst_reduce hl₁ [] h1 (Expr.instantiateList_eq_self h3)
+  split <;> [rename_i n; exact .refl]
+  have hc := h1.closed hc.getAppFn
+  simp [Closed] at hc; rw [if_pos hc]
+  rw [Expr.mkAppRange_eq (l₂ := l₂) (l₃ := []) (by simp [eq]) rfl (by simp [← eq])]
+  conv => lhs; rw [← e.mkAppList_getAppArgsList]
+  simp [eqr]
+  refine .mkAppList <| .inst_reduce hl₁ [] h1 ?_
+  rw [List.getElem?_append_left (by omega), Nat.sub_right_comm, ← List.getElem?_reverse hc]
+  suffices ∀ l₁, (∀ x ∈ l₁, x.Closed) → ∀ n < l₁.length,
+      (Expr.bvar n).instantiateList l₁ = l₁[n]?.getD default by
+    simpa [Expr.liftLooseBVars_zero] using this l₁.reverse (by simpa using hl₁) n (by simp [hc])
+  intro l₁ hl₁ n lt
+  induction l₁ generalizing n with
+  | nil => cases lt
+  | cons a l ih =>
+    simp at hl₁
+    obtain _ | n := n <;> simp [Expr.instantiate1']
+    · exact Expr.instantiateList_eq_self hl₁.1.looseBVarRange_zero
+    · exact ih hl₁.2 _ (Nat.lt_of_succ_lt_succ lt)
+
+theorem TrExpr.beta (H : TrExpr env Us Δ e e')
+    (henv : VEnv.WF env) (hΓ : VLCtx.WF env Us.length Δ)
+    (H : BetaReduce e e₂) : TrExpr env Us Δ e₂ e' := by
+  induction H generalizing e' with
+  | refl => exact H
+  | trans _ _ ih1 ih2 => exact ih2 (ih1 H)
+  | app _ ih =>
+    let ⟨_, .app hf ha tf ta, _, df⟩ := H
+    have ⟨_, _, hf', ha'⟩ := df.hasType.1.app_inv henv hΓ
+    exact ((ih ⟨_, tf, _, hf'⟩).app henv hΓ hf' ha' (ta.trExpr henv hΓ)).defeq henv hΓ ⟨_, df⟩
+  | beta =>
+    let ⟨_, .app hf ha tf ta, _, df⟩ := H
+    let .lam hA tA tb := tf
+    have ⟨⟨_, hA⟩, _, hb⟩ := hf.lam_inv henv hΓ
+    have ht := hf.uniqU henv hΓ (hA.lam hb)
+    have ⟨⟨_, Ae⟩, _, be⟩ := ht.forallE_inv henv hΓ
+    have hΓΓ := VLCtx.IsDefEq.cons (.refl henv hΓ) (ofv := none) nofun (.vlam Ae.symm)
+    have ⟨_, tb'⟩ := tb.defeqDFC henv hΓΓ
+    have beta := hb.beta (Ae.defeq ha)
+    have be' := (tb.uniq henv hΓΓ tb').of_l henv hΓΓ.wf hb
+    have hi := be'.instDF henv hΓ (.defeq Ae ha)
+    exact ⟨_, .inst henv ha tb' ta, _, beta.trans_l henv hΓ hi |>.symm.trans_l henv hΓ df⟩
+
+theorem FVarsBelow.cheapBetaReduce (he : e.Closed) : FVarsBelow Δ e e.cheapBetaReduce :=
+  .betaReduce (.cheapBetaReduce he)
+
+theorem TrExpr.cheapBetaReduce (H : TrExpr env Us Δ e e')
+    (henv : VEnv.WF env) (hΓ : VLCtx.WF env Us.length Δ)
+    (noBV : Δ.NoBV) : TrExpr env Us Δ e.cheapBetaReduce e' :=
+  H.beta henv hΓ <| .cheapBetaReduce <| noBV ▸ H.closed.mono (by simp)
+
+theorem TrExprS.uninstantiateN
+    (W : VLCtx.Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ)
+    (H : TrExprS env Us Δ₁ (Expr.instantiate1' e (.fvar v₀) dk) e')
+    (sc : FVarsIn (· ≠ v₀) e) :
+    TrExprS env Us Δ e e' := by
+  have := H.abstract W
+  rwa [sc.abstract_instantiate1] at this
+
+theorem TrExpr.uninstantiateN
+    (W : VLCtx.Abstract Δ₀ v₀ d₀ dk k Δ₁ Δ)
+    (H : TrExpr env Us Δ₁ (Expr.instantiate1' e (.fvar v₀) dk) e')
+    (sc : FVarsIn (· ≠ v₀) e) :
+    TrExpr env Us Δ e e' :=
+  let ⟨_, s, h⟩ := H; ⟨_, s.uninstantiateN W sc, W.toCtx ▸ h⟩
+
+theorem TrExprS.uninstantiate
+    (H : TrExprS env Us ((some (v, deps), d) :: Δ) (e.instantiate1' (.fvar v)) e')
+    (sc : FVarsIn (· ≠ v) e) :
+    TrExprS env Us ((none, d) :: Δ) e e' := H.uninstantiateN .zero sc
+
+theorem TrExpr.uninstantiate
+    (H : TrExpr env Us ((some (v, deps), d) :: Δ) (e.instantiate1' (.fvar v)) e')
+    (sc : FVarsIn (· ≠ v) e) :
+    TrExpr env Us ((none, d) :: Δ) e e' := H.uninstantiateN .zero sc
+
+theorem TrExprS.inst_fvar {Δ : VLCtx} (henv : Ordered env)
+    (hΔ : VLCtx.WF env Us.length ((some (a, deps), d) :: Δ))
+    (H : TrExprS env Us ((none, d) :: Δ) e e') :
+    TrExprS env Us ((some (a, deps), d) :: Δ) (e.instantiate1' (.fvar a)) e' := by
+  refine
+    have W := .skip_fvar (a, deps) d .refl
+    have := H.weakFV henv (.cons_bvar _ W) ⟨hΔ, nofun, hΔ.2.2.weakN henv W.toCtx⟩
+    ?_
+  have hf := TrExprS.fvar (env := env) (Us := Us) (fv := a) (Δ := (some (a, deps), d) :: Δ) <| by
+    simp [VLCtx.find?, VLCtx.next]; exact ⟨rfl, rfl⟩
+  match d with
+  | .vlam A₀ =>
+    have := this.inst henv (.bvar .zero) (Δ := (some (a, deps), .vlam _) :: Δ) hf
+    rwa [VLocalDecl.depth, VExpr.instN_bvar0] at this
+  | .vlet A₀ e₀ =>
+    simp [VLocalDecl.depth, VLocalDecl.liftN] at this
+    exact this.inst_let henv hf
+
+theorem TrExpr.rebuild_mkAppRevList (henv : env.WF) (hΔ : Δ.WF env Us.length)
+    (he : TrExprS env Us Δ e e') (h1 : TrExprS env Us Δ (e.mkAppRevList as) ea')
+    (h2 : TrExpr env Us Δ e₁ e') : TrExpr env Us Δ (e₁.mkAppRevList as) ea' := by
+  induction as generalizing ea' with
+  | nil => exact h2.defeq henv hΔ (he.uniq henv (.refl henv hΔ) h1)
+  | cons a as ih =>
+    let .app a1 a2 a3 a4 := h1
+    have := ih a3
+    exact .app henv hΔ a1 a2 (ih a3) (a4.trExpr henv hΔ)
+
+theorem TrExpr.rebuild_mkAppList (henv : env.WF) (hΔ : Δ.WF env Us.length)
+    (he : TrExprS env Us Δ e e') (h1 : TrExprS env Us Δ (e.mkAppList as) ea')
+    (h2 : TrExpr env Us Δ e₁ e') : TrExpr env Us Δ (e₁.mkAppList as) ea' := by
+  rw [← Expr.mkAppRevList_reverse] at h1 ⊢
+  exact h2.rebuild_mkAppRevList henv hΔ he h1
+
+theorem TrExprS.eqv (H : TrExprS env Us Δ e₁ e') : e₁ == e₂ → TrExprS env Us Δ e₂ e' := by
+  simp [(· == ·)]
+  induction H generalizing e₂ <;> (cases e₂ <;> try change false = _ → _; rintro ⟨⟩)
+  all_goals simp [Expr.eqv']; grind [TrExprS]
+
+theorem TrExpr.eqv (H : TrExpr env Us Δ e₁ e') (h : e₁ == e₂) : TrExpr env Us Δ e₂ e' :=
+  let ⟨_, h1, h2⟩ := H; ⟨_, h1.eqv h, h2⟩
+
+theorem fvarsList_eqv {e₁ e₂ : Expr} : e₁ == e₂ → e₁.fvarsList = e₂.fvarsList := by
+  simp [(· == ·)]
+  induction e₁ generalizing e₂ <;> (cases e₂ <;> try change false = _ → _; rintro ⟨⟩)
+  all_goals simp [Expr.eqv']; intros; subst_vars; simp [Expr.fvarsList]
+  all_goals grind
+
+theorem FVarsIn.eqv : e₁ == e₂ → FVarsIn P e₁ → FVarsIn P e₂ := by
+  simp [(· == ·)]
+  induction e₁ generalizing e₂ <;> (cases e₂ <;> try change false = _ → _; rintro ⟨⟩)
+  all_goals simp [Expr.eqv']; intros; subst_vars; revert ‹FVarsIn ..›; simp [FVarsIn]
+  all_goals grind
+
+theorem FVarsBelow.eqv (H : FVarsBelow Δ e₁ ty₁)
+    (eq : e₁ == e₂) (eq' : ty₁ == ty₂) : FVarsBelow Δ e₂ ty₂ :=
+  fun _ hP he => .eqv eq' (H _ hP (.eqv (BEq.symm eq) he))
+
+theorem TrTyping.eqv (H : TrTyping env Us Δ e₁ ty₁ e' ty')
+    (eq : e₁ == e₂) (eq' : ty₁ == ty₂) : TrTyping env Us Δ e₂ ty₂ e' ty' :=
+  let ⟨h1, h2, h3, h4⟩ := H
+  ⟨.eqv h1 eq eq', h2.eqv eq, h3.eqv eq', h4⟩
+
+variable (env : VEnv) (Us : List Name) (Δ : VLCtx) in
+inductive AppStack : Expr → VExpr → List Expr → Prop where
+  | head : TrExprS env Us Δ f f' → AppStack f f' []
+  | app :
+    env.HasType Us.length Δ.toCtx f' (.forallE A B) →
+    env.HasType Us.length Δ.toCtx a' A →
+    TrExprS env Us Δ f f' →
+    TrExprS env Us Δ a a' →
+    AppStack (.app f a) (.app f' a') as →
+    AppStack f f' (a :: as)
+
+theorem AppStack.build_rev {e : Expr} :
+    ∀ {as}, TrExprS env Us Δ (e.mkAppRevList as) e' →
+      AppStack env Us Δ (e.mkAppRevList as) e' as' →
+      ∃ e', AppStack env Us Δ e e' (as.reverseAux as')
+  | [], _, H2 => ⟨_, H2⟩
+  | _ :: as, .app h1 h2 h3 h4, H2 =>
+    AppStack.build_rev (as := as) h3 (.app h1 h2 h3 h4 H2)
+
+theorem AppStack.tr : AppStack env Us Δ e e' as → TrExprS env Us Δ e e'
+  | .head H | .app _ _ H _ _ => H
+
+theorem AppStack.append {e : Expr} (H : AppStack env Us Δ (e.mkAppList as) e' bs) :
+    ∃ e', AppStack env Us Δ e e' (as ++ bs) := by
+  rw [← Expr.mkAppRevList_reverse] at H
+  simpa using AppStack.build_rev H.tr H
+
+theorem AppStack.build {e : Expr} (H : TrExprS env Us Δ (e.mkAppList as) e') :
+    ∃ e', AppStack env Us Δ e e' as := by simpa using AppStack.append (.head H)
+
+/-- Recover the pointwise strict translations of an application spine and
+rebuild the complete translated application.  Unlike the checker-facing
+`AppStack.toSpineWF`, this purely syntactic projection needs no expected
+function type and is therefore available to WHNF reduction. -/
+theorem AppStack.argsTranslation
+    (H : AppStack env Us Δ f f' args) :
+    ∃ args', args.Forall₂ (TrExprS env Us Δ) args' ∧
+      TrExprS env Us Δ (f.mkAppList args) (VExpr.appN f' args') := by
+  induction H with
+  | head h => exact ⟨[], .nil, by simpa⟩
+  | app hfun harg hf ha H ih =>
+    obtain ⟨args', hargs, hfull⟩ := ih
+    refine ⟨_ :: args', .cons ha hargs, ?_⟩
+    simpa [Expr.mkAppList, VExpr.appN] using hfull
+
+/-- A successful lookup on the left side of a pointwise list relation has a
+related lookup at the same position on the right. -/
+theorem List.Forall₂.getElem?_left
+    {α : Type u} {β : Type v} {R : α → β → Prop}
+    {xs : List α} {ys : List β} {i : Nat} {x : α}
+    (H : List.Forall₂ R xs ys) (hx : xs[i]? = some x) :
+    ∃ y : β, ys[i]? = some y ∧ R x y := by
+  induction H generalizing i with
+  | nil => simp at hx
+  | cons hxy _ ih =>
+    cases i with
+    | zero =>
+      simp at hx
+      subst x
+      exact ⟨_, rfl, hxy⟩
+    | succ i => simpa using ih (i := i) (by simpa using hx)
+
+#guard_named_axioms Ix.Theory.Named.TrExprS.toConstructor_ready [propext, Classical.choice, Quot.sound]
diff --git a/Ix/Theory/Named/Verify/VLCtx.lean b/Ix/Theory/Named/Verify/VLCtx.lean
new file mode 100644
index 000000000..7d42cb195
--- /dev/null
+++ b/Ix/Theory/Named/Verify/VLCtx.lean
@@ -0,0 +1,88 @@
+/-
+Adapted for Ix: namespace, imports, and shared universe semantics.
+SPDX-License-Identifier: Apache-2.0
+Source attribution and revision: Ix/Theory/Named/NOTICE.
+-/
+
+import Ix.Theory.Named.Verify.Expr
+import Ix.Theory.Named.LocalContext
+
+open Ix.Theory (VLevel)
+
+namespace Ix.Theory.Named
+
+open Lean (FVarId Expr)
+
+@[reducible] def VLCtx := List (Option (FVarId × List FVarId) × VLocalDecl)
+
+namespace VLCtx
+
+def bvars : VLCtx → Nat
+  | [] => 0
+  | (none, _) :: Δ => bvars Δ + 1
+  | (some _, _) :: Δ => bvars Δ
+
+abbrev NoBV (Δ : VLCtx) : Prop := Δ.bvars = 0
+
+def next : Option (FVarId × List FVarId) → Nat ⊕ FVarId → Option (Nat ⊕ FVarId)
+  | none, .inl 0 => none
+  | none, .inl (n+1) => some (.inl n)
+  | some _, .inl n => some (.inl n)
+  | none, .inr fv' => some (.inr fv')
+  | some (fv, _), .inr fv' => if fv == fv' then none else some (.inr fv')
+
+def find? : VLCtx → Nat ⊕ FVarId → Option (VExpr × VExpr)
+  | [], _ => none
+  | (ofv, d) :: Δ, v =>
+    match next ofv v with
+    | none => some (d.value, d.type)
+    | some v => do let (e, A) ← find? Δ v; some (e.liftN d.depth, A.liftN d.depth)
+
+def liftVar (n k : Nat) : Nat ⊕ FVarId → Nat ⊕ FVarId
+  | .inl i => .inl (if i < k then i else i + n)
+  | .inr fv => .inr fv
+
+def varToExpr : Nat ⊕ FVarId → Expr
+  | .inl i => .bvar i
+  | .inr fv => .fvar fv
+
+def vlamName : VLCtx → Nat → Option (Option (FVarId × List FVarId))
+  | [], _ => none
+  | (_, .vlet ..) :: Δ, i
+  | (_, .vlam ..) :: Δ, i+1 => vlamName Δ i
+  | (ofv, .vlam ..) :: _, 0 => some ofv
+
+def fvars (Δ : VLCtx) : List FVarId := Δ.filterMap (·.1.map (·.1))
+
+@[simp] theorem fvars_nil : fvars [] = [] := rfl
+@[simp] theorem fvars_cons_none {Δ : VLCtx} : fvars ((none, d) :: Δ) = fvars Δ := rfl
+@[simp] theorem fvars_cons_some {Δ : VLCtx} :
+    fvars ((some fv, d) :: Δ) = fv.1 :: fvars Δ := rfl
+
+def toCtx : VLCtx → List VExpr
+  | [] => []
+  | (_, .vlam ty) :: Δ => ty :: VLCtx.toCtx Δ
+  | (_, .vlet _ _) :: Δ => VLCtx.toCtx Δ
+
+def instL (Δ : VLCtx) (ls : List VLevel) : VLCtx :=
+  match Δ with
+  | [] => []
+  | (ofv, d) :: Δ => (ofv, d.instL ls) :: instL Δ ls
+
+theorem find?_eq_some : (∃ x, Δ.find? (.inr fv) = some x) ↔ fv ∈ fvars Δ := by
+  induction Δ with simp [find?] | cons d Δ ih
+  match d with
+  | (none, _) => simp [next, ← ih]; grind
+  | (some (fv',  _), _) =>
+    simp [next]; rw [@eq_comm _ fv]
+    by_cases h : fv' == fv <;> simp [h] <;> simp at h <;> simp [h]; grind
+
+theorem vlamName_mem_fvars :
+    ∀ {Δ : VLCtx} {i}, Δ.vlamName i = some (some fv) → fv.1 ∈ fvars Δ
+  | (none, .vlet ..) :: Δ, _, h
+  | (none, .vlam ..) :: Δ, _+1, h => vlamName_mem_fvars (Δ := Δ) h
+  | (some _, .vlet ..) :: Δ, _, h
+  | (some _, .vlam ..) :: Δ, _+1, h => .tail _ <| vlamName_mem_fvars (Δ := Δ) h
+  | (some _fv, .vlam ..) :: _, 0, rfl => .head _
+
+end VLCtx
diff --git a/Ix/Theory/PORTING.md b/Ix/Theory/PORTING.md
new file mode 100644
index 000000000..4a013e8b8
--- /dev/null
+++ b/Ix/Theory/PORTING.md
@@ -0,0 +1,11 @@
+# Port notice
+
+This directory contains the selected Lean4Ix consistency model and its required
+syntax, model, and certificate modules, relocated to `Ix.Theory`. It does not
+contain the entire Lean4Ix or Ix.Theory.Named repositories.
+
+`LICENSE`, `LICENSE-MIT`, `LICENSE-APACHE`, and `NOTICE` are retained from the
+source distribution. Historical source paths in those texts describe that
+distribution. The current file selection, source hashes, con-leche attribution,
+and namespace modifications are recorded in `Tests/Theory/ImportManifest.lean`
+and the per-file headers. See `docs/theory.md` for the import boundary.
diff --git a/Ix/Theory/Quot.lean b/Ix/Theory/Quot.lean
new file mode 100644
index 000000000..f3c93b249
--- /dev/null
+++ b/Ix/Theory/Quot.lean
@@ -0,0 +1,239 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Store
+
+/-! # Canonical quotient declarations
+
+The quotient computation rules are selected by declaration content rather
+than ambient names.  This file records the exact anonymous kernel types of
+`Eq`, `Quot`, `Quot.mk`, `Quot.lift`, and `Quot.ind`, parameterized by their
+content-addressed references.
+-/
+
+namespace Ix.Theory
+namespace Store
+
+/-- References used by the primitive quotient interface, including the
+equality family appearing in the type of `Quot.lift`. -/
+structure QuotRefs (β : Type u) where
+  eq : ConstRef β
+  type : ConstRef β
+  ctor : ConstRef β
+  lift : ConstRef β
+  ind : ConstRef β
+  deriving DecidableEq
+
+/-- The two blocks whose contents make up the canonical equality and quotient
+interface. -/
+structure QuotBlocks (β : Type u) where
+  equality : β
+  quotient : β
+  deriving DecidableEq
+
+namespace QuotBlocks
+
+/-- Positional references exposed by the canonical two-block layout. -/
+def refs (blocks : QuotBlocks β) : QuotRefs β where
+  eq := .member blocks.equality 0
+  type := .member blocks.quotient 0
+  ctor := .member blocks.quotient 1
+  lift := .member blocks.quotient 2
+  ind := .member blocks.quotient 3
+
+end QuotBlocks
+
+namespace Quotient
+
+/-- Binary relation on the most recently bound sort. -/
+def relationType : VExpr β :=
+  .forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero))
+
+/-- Exact kernel type of the equality family. -/
+def eqType : VExpr β :=
+  .forallE (.sort (.param 0))
+    (.forallE (.bvar 0) (.forallE (.bvar 1) (.sort .zero)))
+
+/-- Exact kernel type of the reflexivity constructor at `eq`. -/
+def eqCtorType (eq : ConstRef β) : VExpr β :=
+  .forallE (.sort (.param 0))
+    (.forallE (.bvar 0)
+      (VExpr.appN (.const eq [.param 0]) [.bvar 1, .bvar 0, .bvar 0]))
+
+/-- Canonical equality-family member, including its nested reflexivity
+constructor. -/
+def eqConstant (eq : ConstRef β) : Const β :=
+  .induct 1 2 1 eqType
+    [{
+      uvars := 1
+      nparams := 2
+      nfields := 0
+      type := eqCtorType eq
+      safety := .safe
+    }]
+    .safe
+
+/-- Canonical one-member equality block at `block`. -/
+def eqBlock (block : β) : Block β :=
+  { members := [eqConstant (.member block 0)] }
+
+/-- Exact kernel type of the quotient family. -/
+def typeType : VExpr β :=
+  .forallE (.sort (.param 0))
+    (.forallE relationType (.sort (.param 0)))
+
+/-- Exact kernel type of the quotient constructor. -/
+def ctorType (refs : QuotRefs β) : VExpr β :=
+  .forallE (.sort (.param 0))
+    (.forallE relationType
+      (.forallE (.bvar 1)
+        (VExpr.appN (.const refs.type [.param 0]) [.bvar 2, .bvar 1])))
+
+/-- Exact kernel type of quotient lifting. -/
+def liftType (refs : QuotRefs β) : VExpr β :=
+  .forallE (.sort (.param 0))
+    (.forallE relationType
+      (.forallE (.sort (.param 1))
+        (.forallE (.forallE (.bvar 2) (.bvar 1))
+          (.forallE
+            (.forallE (.bvar 3)
+              (.forallE (.bvar 4)
+                (.forallE
+                  (VExpr.appN (.bvar 4) [.bvar 1, .bvar 0])
+                  (VExpr.appN (.const refs.eq [.param 1])
+                    [.bvar 4, .app (.bvar 3) (.bvar 2),
+                      .app (.bvar 3) (.bvar 1)]))))
+            (.forallE
+              (VExpr.appN (.const refs.type [.param 0]) [.bvar 4, .bvar 3])
+              (.bvar 3))))))
+
+/-- Exact kernel type of quotient induction. -/
+def indType (refs : QuotRefs β) : VExpr β :=
+  .forallE (.sort (.param 0))
+    (.forallE relationType
+      (.forallE
+        (.forallE
+          (VExpr.appN (.const refs.type [.param 0]) [.bvar 1, .bvar 0])
+          (.sort .zero))
+        (.forallE
+          (.forallE (.bvar 2)
+            (.app (.bvar 1)
+              (VExpr.appN (.const refs.ctor [.param 0])
+                [.bvar 3, .bvar 2, .bvar 0])))
+          (.forallE
+            (VExpr.appN (.const refs.type [.param 0]) [.bvar 3, .bvar 2])
+            (.app (.bvar 2) (.bvar 0))))))
+
+def typeConstant (_refs : QuotRefs β) : Const β :=
+  .quot .type 1 typeType
+
+def ctorConstant (refs : QuotRefs β) : Const β :=
+  .quot .ctor 1 (ctorType refs)
+
+def liftConstant (refs : QuotRefs β) : Const β :=
+  .quot .lift 2 (liftType refs)
+
+def indConstant (refs : QuotRefs β) : Const β :=
+  .quot .ind 1 (indType refs)
+
+/-- Canonical four-member quotient block at the selected block addresses. -/
+def quotBlock (blocks : QuotBlocks β) : Block β :=
+  let refs := blocks.refs
+  { members := [typeConstant refs, ctorConstant refs,
+      liftConstant refs, indConstant refs] }
+
+/-- The canonical quotient block is syntactically closed. -/
+theorem quotBlock_closed (blocks : QuotBlocks β) :
+    (quotBlock blocks).Closed := by
+  simp [Block.Closed, quotBlock, typeConstant, ctorConstant, liftConstant,
+    indConstant, Const.Closed, typeType, ctorType, liftType, indType,
+    relationType, VExpr.appN, VExpr.Closed, VExpr.ClosedN]
+
+/-- Canonical quotient blocks contain no nested inductive-family members. -/
+theorem quotBlock_no_inductive {blocks : QuotBlocks β} {member uvars
+    nparams nindices : Nat} {type : VExpr β} {ctors : List (Ctor β)}
+    {safety : Safety}
+    (found : (quotBlock blocks).members[member]? = some
+      (.induct uvars nparams nindices type ctors safety)) : False := by
+  cases member with
+  | zero => simp [quotBlock, typeConstant] at found
+  | succ member =>
+      cases member with
+      | zero => simp [quotBlock, ctorConstant] at found
+      | succ member =>
+          cases member with
+          | zero => simp [quotBlock, liftConstant] at found
+          | succ member =>
+              cases member with
+              | zero => simp [quotBlock, indConstant] at found
+              | succ member => simp [quotBlock] at found
+
+end Quotient
+
+/-- Exact content certificate for the canonical equality and quotient blocks. -/
+structure QuotBlocksCanonical (store : Store β)
+    (blocks : QuotBlocks β) : Prop where
+  equality : store.blocks blocks.equality =
+    some (Quotient.eqBlock blocks.equality)
+  quotient : store.blocks blocks.quotient =
+    some (Quotient.quotBlock blocks)
+
+/-- Exact canonical block content is stable under store inclusion. -/
+theorem QuotBlocksCanonical.mono {left right : Store β}
+    (subset : left ⊆ right) {blocks : QuotBlocks β}
+    (canonical : left.QuotBlocksCanonical blocks) :
+    right.QuotBlocksCanonical blocks where
+  equality := subset _ _ canonical.equality
+  quotient := subset _ _ canonical.quotient
+
+/-- The exact declarations selected by the primitive quotient rules. -/
+structure QuotReady (store : Store β) (refs : QuotRefs β) : Prop where
+  eq : store.lookup refs.eq = some (Quotient.eqConstant refs.eq)
+  type : store.lookup refs.type = some (Quotient.typeConstant refs)
+  ctor : store.lookup refs.ctor = some (Quotient.ctorConstant refs)
+  lift : store.lookup refs.lift = some (Quotient.liftConstant refs)
+  ind : store.lookup refs.ind = some (Quotient.indConstant refs)
+
+/-- Discover the unique canonical equality block by content. -/
+def eqBlock? [DecidableEq β] (store : Store β) : Option β :=
+  match store.dom.filter fun block =>
+      store.blocks block == some (Quotient.eqBlock block) with
+  | [block] => some block
+  | _ => none
+
+/-- Discover the unique canonical quotient block relative to `equality`. -/
+def quotBlock? [DecidableEq β] (store : Store β)
+    (equality : β) : Option β :=
+  match store.dom.filter fun quotient =>
+      let blocks : QuotBlocks β := { equality, quotient }
+      store.blocks quotient == some (Quotient.quotBlock blocks) with
+  | [block] => some block
+  | _ => none
+
+/-- Discover both uniquely designated blocks of the quotient interface. -/
+def quotBlocks? [DecidableEq β] (store : Store β) : Option (QuotBlocks β) := do
+  let equality ← store.eqBlock?
+  let quotient ← store.quotBlock? equality
+  pure { equality, quotient }
+
+/-- Exact canonical block content exposes the rule-facing declaration
+inventory. -/
+theorem QuotBlocksCanonical.ready [DecidableEq β] {store : Store β}
+    {blocks : QuotBlocks β} (canonical : store.QuotBlocksCanonical blocks) :
+    store.QuotReady blocks.refs := by
+  constructor
+  · simp [Store.lookup, QuotBlocks.refs, Quotient.eqBlock,
+      canonical.equality]
+  · simp [Store.lookup, QuotBlocks.refs, Quotient.quotBlock,
+      canonical.quotient]
+  · simp [Store.lookup, QuotBlocks.refs, Quotient.quotBlock,
+      canonical.quotient]
+  · simp [Store.lookup, QuotBlocks.refs, Quotient.quotBlock,
+      canonical.quotient]
+  · simp [Store.lookup, QuotBlocks.refs, Quotient.quotBlock,
+      canonical.quotient]
+
+end Store
+end Ix.Theory
diff --git a/Ix/Theory/Ref.lean b/Ix/Theory/Ref.lean
new file mode 100644
index 000000000..5ab55aeb6
--- /dev/null
+++ b/Ix/Theory/Ref.lean
@@ -0,0 +1,23 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+namespace Ix.Theory
+
+/-- A reference to a constant contained in a content-addressed block. -/
+inductive ConstRef (β : Type u) where
+  /-- The `i`th top-level member of block `b`. -/
+  | member (b : β) (i : Nat)
+  /-- The `c`th constructor of the `i`th inductive member of block `b`. -/
+  | ctor (b : β) (i c : Nat)
+deriving DecidableEq, Hashable
+
+namespace ConstRef
+
+/-- The block containing a referenced member or constructor. -/
+@[simp] def block : ConstRef β → β
+  | .member b _ | .ctor b _ _ => b
+
+end ConstRef
+end Ix.Theory
diff --git a/Ix/Theory/Rename.lean b/Ix/Theory/Rename.lean
new file mode 100644
index 000000000..362aa4701
--- /dev/null
+++ b/Ix/Theory/Rename.lean
@@ -0,0 +1,308 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Expr
+
+/-! # Address renaming for anonymous expressions
+
+The shared syntax operation is independent of inductive generation.
+-/
+
+namespace Ix.Theory
+
+/-- A dependency-free bijection used to transport abstract block addresses.
+The Theory intentionally does not import Lean's metadata equivalence API. -/
+structure AddressEquiv (β : Type u) (γ : Type v) where
+  toFun : β → γ
+  invFun : γ → β
+  left_inv : ∀ block, invFun (toFun block) = block
+  right_inv : ∀ block, toFun (invFun block) = block
+
+namespace AddressEquiv
+
+instance : CoeFun (AddressEquiv β γ) fun _ => β → γ :=
+  ⟨AddressEquiv.toFun⟩
+
+@[simp] theorem inv_apply_apply (mapping : AddressEquiv β γ) (block : β) :
+    mapping.invFun (mapping block) = block :=
+  mapping.left_inv block
+
+@[simp] theorem apply_inv_apply (mapping : AddressEquiv β γ) (block : γ) :
+    mapping (mapping.invFun block) = block :=
+  mapping.right_inv block
+
+theorem injective (mapping : AddressEquiv β γ) : Function.Injective mapping := by
+  intro left right equality
+  simpa using congrArg mapping.invFun equality
+
+/-- Identity address bijection. -/
+def refl (β : Type u) : AddressEquiv β β where
+  toFun := id
+  invFun := id
+  left_inv := fun _ => rfl
+  right_inv := fun _ => rfl
+
+/-- Reverse an address bijection. -/
+def symm (mapping : AddressEquiv β γ) : AddressEquiv γ β where
+  toFun := mapping.invFun
+  invFun := mapping
+  left_inv := mapping.right_inv
+  right_inv := mapping.left_inv
+
+/-- Compose address bijections. -/
+def trans (first : AddressEquiv β γ)
+    (second : AddressEquiv γ δ) : AddressEquiv β δ where
+  toFun := second ∘ first
+  invFun := first.invFun ∘ second.invFun
+  left_inv := by
+    intro block
+    simp
+  right_inv := by
+    intro block
+    simp
+
+@[simp] theorem symm_apply (mapping : AddressEquiv β γ) (block : γ) :
+    mapping.symm block = mapping.invFun block := rfl
+
+@[simp] theorem trans_apply (first : AddressEquiv β γ)
+    (second : AddressEquiv γ δ) (block : β) :
+    (first.trans second) block = second (first block) := rfl
+
+@[simp] theorem beq_apply (mapping : AddressEquiv β γ)
+    [DecidableEq β] [DecidableEq γ] (left right : β) :
+    (mapping left == mapping right) = (left == right) := by
+  rw [Bool.eq_iff_iff]
+  simp only [beq_iff_eq, mapping.injective.eq_iff]
+
+@[simp] theorem bne_apply (mapping : AddressEquiv β γ)
+    [DecidableEq β] [DecidableEq γ] (left right : β) :
+    (mapping left != mapping right) = (left != right) := by
+  simp only [bne, beq_apply]
+
+end AddressEquiv
+
+namespace ConstRef
+
+/-- Rename the block address carried by a constant reference. -/
+def rename (mapping : β → γ) : ConstRef β → ConstRef γ
+  | .member block index => .member (mapping block) index
+  | .ctor block index ctorIndex => .ctor (mapping block) index ctorIndex
+
+@[simp] theorem rename_id (ref : ConstRef β) :
+    ref.rename id = ref := by
+  cases ref <;> rfl
+
+@[simp] theorem rename_comp (second : γ → δ) (first : β → γ)
+    (ref : ConstRef β) :
+    (ref.rename first).rename second = ref.rename (second ∘ first) := by
+  cases ref <;> rfl
+
+@[simp] theorem rename_block (mapping : β → γ) (ref : ConstRef β) :
+    (ref.rename mapping).block = mapping ref.block := by
+  cases ref <;> rfl
+
+/-- Renaming references along an address bijection is injective. -/
+theorem rename_injective (mapping : AddressEquiv β γ) :
+    Function.Injective (ConstRef.rename mapping) := by
+  have inverse : Function.LeftInverse
+      (ConstRef.rename mapping.invFun) (ConstRef.rename mapping) := by
+    intro ref
+    cases ref <;> simp [ConstRef.rename]
+  exact inverse.injective
+
+@[simp] theorem rename_eq_rename_iff (mapping : AddressEquiv β γ)
+    (left right : ConstRef β) :
+    left.rename mapping = right.rename mapping ↔ left = right :=
+  (rename_injective mapping).eq_iff
+
+@[simp] theorem rename_inverse (mapping : AddressEquiv β γ)
+    (ref : ConstRef β) :
+    (ref.rename mapping).rename mapping.invFun = ref := by
+  cases ref <;> simp [ConstRef.rename]
+
+end ConstRef
+
+namespace VExpr
+
+/-- Rename every block address in an expression.  Binder indices and universe
+levels are unchanged. -/
+def rename (mapping : β → γ) : VExpr β → VExpr γ
+  | .bvar index => .bvar index
+  | .sort level => .sort level
+  | .const ref levels => .const (ref.rename mapping) levels
+  | .app function argument =>
+      .app (function.rename mapping) (argument.rename mapping)
+  | .lam domain body => .lam (domain.rename mapping) (body.rename mapping)
+  | .forallE domain body =>
+      .forallE (domain.rename mapping) (body.rename mapping)
+  | .proj ref field major =>
+      .proj (ref.rename mapping) field (major.rename mapping)
+  | .natLit value => .natLit value
+
+@[simp] theorem rename_id (expression : VExpr β) :
+    expression.rename id = expression := by
+  induction expression with
+  | const ref levels => cases ref <;> rfl
+  | proj ref field major ih => cases ref <;> simp [rename, ih]
+  | _ => simp_all [rename]
+
+@[simp] theorem rename_comp (second : γ → δ) (first : β → γ)
+    (expression : VExpr β) :
+    (expression.rename first).rename second =
+      expression.rename (second ∘ first) := by
+  induction expression with
+  | const ref levels => cases ref <;> rfl
+  | proj ref field major ih => cases ref <;> simp [rename, ih]
+  | _ => simp_all [rename]
+
+@[simp] theorem rename_inverse (mapping : AddressEquiv β γ)
+    (expression : VExpr β) :
+    (expression.rename mapping).rename mapping.invFun = expression := by
+  induction expression <;>
+    simp_all only [rename, ConstRef.rename_inverse]
+
+/-- Expression renaming along an address bijection is injective. -/
+theorem rename_injective (mapping : AddressEquiv β γ) :
+    Function.Injective (VExpr.rename mapping) := by
+  have inverse : Function.LeftInverse
+      (VExpr.rename mapping.invFun) (VExpr.rename mapping) :=
+    VExpr.rename_inverse mapping
+  exact inverse.injective
+
+@[simp] theorem rename_appN (mapping : β → γ) (function : VExpr β)
+    (arguments : List (VExpr β)) :
+    (function.appN arguments).rename mapping =
+      (function.rename mapping).appN (arguments.map (VExpr.rename mapping)) := by
+  induction arguments generalizing function with
+  | nil => rfl
+  | cons argument arguments ih =>
+      simp [VExpr.appN, VExpr.rename, ih]
+
+@[simp] theorem rename_liftN (mapping : β → γ) (expression : VExpr β)
+    (count cutoff : Nat) :
+    (expression.liftN count cutoff).rename mapping =
+      (expression.rename mapping).liftN count cutoff := by
+  induction expression generalizing cutoff <;> simp_all [VExpr.liftN, rename]
+
+@[simp] theorem rename_instL (mapping : β → γ) (expression : VExpr β)
+    (levels : List VLevel) :
+    (expression.instL levels).rename mapping =
+      (expression.rename mapping).instL levels := by
+  induction expression <;> simp_all [VExpr.instL, rename]
+
+@[simp] theorem rename_inst (mapping : β → γ) (expression argument : VExpr β)
+    (cutoff : Nat) :
+    (expression.inst argument cutoff).rename mapping =
+      (expression.rename mapping).inst (argument.rename mapping) cutoff := by
+  induction expression generalizing cutoff with
+  | bvar index =>
+      by_cases below : index < cutoff
+      · simp [VExpr.inst, VExpr.instVar, below, rename]
+      · by_cases equal : index = cutoff
+        · simp [VExpr.inst, VExpr.instVar, equal, rename]
+        · simp [VExpr.inst, VExpr.instVar, below, equal, rename]
+  | _ => simp_all [VExpr.inst, rename]
+
+@[simp] theorem rename_lamN (mapping : β → γ)
+    (binders : List (VExpr β)) (body : VExpr β) :
+    (VExpr.lamN binders body).rename mapping =
+      VExpr.lamN (binders.map (VExpr.rename mapping)) (body.rename mapping) := by
+  induction binders with
+  | nil => rfl
+  | cons binder binders ih => simp [VExpr.lamN, rename, ih]
+
+@[simp] theorem rename_forallN (mapping : β → γ)
+    (binders : List (VExpr β)) (body : VExpr β) :
+    (VExpr.forallN binders body).rename mapping =
+      VExpr.forallN (binders.map (VExpr.rename mapping))
+        (body.rename mapping) := by
+  induction binders with
+  | nil => rfl
+  | cons binder binders ih => simp [VExpr.forallN, rename, ih]
+
+@[simp] theorem rename_liftTelN (mapping : β → γ) (count : Nat) :
+    ∀ (binders : List (VExpr β)) (cutoff : Nat),
+      (VExpr.liftTelN count binders cutoff).map (VExpr.rename mapping) =
+        VExpr.liftTelN count
+          (binders.map (VExpr.rename mapping)) cutoff
+  | [], _ => rfl
+  | binder :: binders, cutoff => by
+      simp [VExpr.liftTelN, rename_liftTelN mapping count binders]
+
+@[simp] theorem rename_telN (mapping : β → γ) (count : Nat)
+    (expression : VExpr β) :
+    (expression.rename mapping).telN count =
+      (expression.telN count).map (VExpr.rename mapping) := by
+  induction count generalizing expression with
+  | zero => rfl
+  | succ count ih =>
+      cases expression with
+      | forallE domain body =>
+          simp only [rename, VExpr.telN, List.map_cons]
+          rw [ih]
+      | _ => rfl
+
+@[simp] theorem rename_dropN (mapping : β → γ) (count : Nat)
+    (expression : VExpr β) :
+    (expression.rename mapping).dropN count =
+      (expression.dropN count).rename mapping := by
+  induction count generalizing expression with
+  | zero => rfl
+  | succ count ih =>
+      cases expression <;> simp [rename, VExpr.dropN, ih]
+
+@[simp] theorem rename_resultOf (mapping : β → γ) (expression : VExpr β) :
+    (expression.rename mapping).resultOf =
+      expression.resultOf.rename mapping := by
+  induction expression <;> simp_all [rename, VExpr.resultOf]
+
+@[simp] theorem rename_appArgs (mapping : β → γ) (expression : VExpr β)
+    (accumulator : List (VExpr β)) :
+    (expression.rename mapping).appArgs
+        (accumulator.map (VExpr.rename mapping)) =
+      (expression.appArgs accumulator).map (VExpr.rename mapping) := by
+  induction expression generalizing accumulator with
+  | app function argument functionIH argumentIH =>
+      simp only [rename, VExpr.appArgs]
+      simpa only [List.map_cons] using functionIH (argument :: accumulator)
+  | _ => rfl
+
+@[simp] theorem rename_appHead (mapping : β → γ) (expression : VExpr β) :
+    (expression.rename mapping).appHead =
+      expression.appHead.rename mapping := by
+  induction expression <;> simp_all [rename, VExpr.appHead]
+
+@[simp] theorem rename_instTelN (mapping : β → γ) (argument : VExpr β) :
+    ∀ (binders : List (VExpr β)) (cutoff : Nat),
+      (VExpr.instTelN argument binders cutoff).map (VExpr.rename mapping) =
+        VExpr.instTelN (argument.rename mapping)
+          (binders.map (VExpr.rename mapping)) cutoff
+  | [], _ => rfl
+  | binder :: binders, cutoff => by
+      simp [VExpr.instTelN, rename_instTelN mapping argument binders]
+
+@[simp] theorem rename_instRev (mapping : β → γ) (expression : VExpr β)
+    (arguments : List (VExpr β)) :
+    (VExpr.instRev expression arguments).rename mapping =
+      VExpr.instRev (expression.rename mapping)
+        (arguments.map (VExpr.rename mapping)) := by
+  induction arguments generalizing expression with
+  | nil => rfl
+  | cons argument arguments ih =>
+      simp [VExpr.instRev, ih]
+
+@[simp] theorem rename_instRevAt (mapping : β → γ) (expression : VExpr β)
+    (arguments : List (VExpr β)) (cutoff : Nat) :
+    (VExpr.instRevAt expression arguments cutoff).rename mapping =
+      VExpr.instRevAt (expression.rename mapping)
+        (arguments.map (VExpr.rename mapping)) cutoff := by
+  induction arguments generalizing expression with
+  | nil => rfl
+  | cons argument arguments ih =>
+      simp [VExpr.instRevAt, ih]
+
+end VExpr
+
+end Ix.Theory
diff --git a/Ix/Theory/Std/Basic.lean b/Ix/Theory/Std/Basic.lean
new file mode 100644
index 000000000..326c00da1
--- /dev/null
+++ b/Ix/Theory/Std/Basic.lean
@@ -0,0 +1,31 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Batteries.Data.List.Basic
+import Init.Omega
+
+namespace Ix.Theory
+
+protected theorem List.Forall₂.rfl
+    {R : α → α → Prop} {xs : List α} (h : ∀ x ∈ xs, R x x) : xs.Forall₂ R xs := by
+  induction xs with
+  | nil => exact .nil
+  | cons x xs ih =>
+    simp only [List.mem_cons, forall_eq_or_imp] at h
+    exact .cons h.1 (ih h.2)
+
+protected theorem List.Forall₂.length_eq
+    {R : α → β → Prop} {left : List α} {right : List β}
+    (related : List.Forall₂ R left right) : left.length = right.length := by
+  induction related with
+  | nil => rfl
+  | cons _ _ ih => exact congrArg Nat.succ ih
+theorem List.map_id_mem {f : α → α} (xs : List α) (h : ∀ x ∈ xs, f x = x) :
+    xs.map f = xs := by
+  induction xs with
+  | nil => rfl
+  | cons x xs ih => simp only [List.mem_cons, forall_eq_or_imp] at h; simp [h.1, ih h.2]
+
+end Ix.Theory
diff --git a/Ix/Theory/Store.lean b/Ix/Theory/Store.lean
new file mode 100644
index 000000000..4365de0d0
--- /dev/null
+++ b/Ix/Theory/Store.lean
@@ -0,0 +1,116 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Const
+
+namespace Ix.Theory
+
+/-- A finite view of a content-addressed constant store. -/
+structure Store (β : Type u) where
+  dom : List β
+  nodup : dom.Nodup
+  blocks : β → Option (Block β)
+  mem_dom : ∀ b, (blocks b).isSome ↔ b ∈ dom
+
+namespace Store
+
+/-- Look up an ordinary block member. Constructor references use `lookupCtor`. -/
+def lookup (store : Store β) : ConstRef β → Option (Const β)
+  | .member block index => do
+      let contents ← store.blocks block
+      contents.members[index]?
+  | .ctor .. => none
+
+/-- Look up a constructor nested under an inductive block member. -/
+def lookupCtor (store : Store β) : ConstRef β → Option (Ctor β)
+  | .member .. => none
+  | .ctor block member ctor => do
+      let contents ← store.blocks block
+      let constant ← contents.members[member]?
+      match constant with
+      | .induct _ _ _ _ ctors _ => ctors[ctor]?
+      | _ => none
+
+/-- Flattened constructor-rule position of a nested constructor reference. -/
+def ctorRuleIndex? (store : Store β) : ConstRef β → Option Nat
+  | .member .. => none
+  | .ctor block member ctor => do
+      let some contents := store.blocks block | none
+      let some constant := contents.members[member]? | none
+      match constant with
+      | .induct _ _ _ _ ctors _ =>
+          if ctor < ctors.length then
+            some ((contents.members.take member).foldl
+              (fun offset entry => offset + entry.ctorCount) 0 + ctor)
+          else
+            none
+      | _ => none
+
+/-- Classify either an ordinary member or a nested constructor reference. -/
+def kind (store : Store β) (ref : ConstRef β) : Option ConstKind :=
+  match store.lookup ref with
+  | some constant => some constant.kind
+  | none => (store.lookupCtor ref).map fun _ => .ctor
+
+/-- Universe arity of an ordinary member or nested constructor. -/
+def uvars (store : Store β) (ref : ConstRef β) : Option Nat :=
+  match store.lookup ref with
+  | some constant => some constant.uvars
+  | none => (store.lookupCtor ref).map Ctor.uvars
+
+/-- Type of an ordinary member or nested constructor. -/
+def type (store : Store β) (ref : ConstRef β) : Option (VExpr β) :=
+  match store.lookup ref with
+  | some constant => some constant.type
+  | none => (store.lookupCtor ref).map Ctor.type
+
+/-- Distinct dependencies of a block, excluding self references. -/
+def deps [DecidableEq β] (store : Store β) (block : β) : List β :=
+  (((store.blocks block).map Block.refs).getD []).map ConstRef.block
+    |>.filter (· != block)
+    |>.eraseDups
+
+/-- `block` directly refers to `dependency`, and the dependency is present. -/
+def DependsOn [DecidableEq β] (store : Store β) (block dependency : β) : Prop :=
+  dependency ∈ store.deps block ∧ dependency ∈ store.dom
+
+/-- Reflexive transitive dependency closure of one block. -/
+inductive Closure [DecidableEq β] (store : Store β) (root : β) : β → Prop where
+  | refl : store.Closure root root
+  | step : store.Closure root block → store.DependsOn block dependency →
+      store.Closure root dependency
+
+/-- Dependencies point strictly backward in some well-founded order. -/
+def Acyclic [DecidableEq β] (store : Store β) : Prop :=
+  WellFounded (flip store.DependsOn)
+
+/-- Keep exactly the blocks satisfying `keep`. This is a proof-facing view;
+executable consumers may supply their own finite closure computation. -/
+noncomputable def restrict (store : Store β) (keep : β → Prop) : Store β := by
+  classical
+  exact {
+    dom := store.dom.filter keep
+    nodup := store.nodup.filter _
+    blocks := fun block => if keep block then store.blocks block else none
+    mem_dom := by
+      intro block
+      by_cases h : keep block <;> simp [h, store.mem_dom]
+  }
+
+/-- Pointwise inclusion of partial block maps. -/
+protected def Subset (left right : Store β) : Prop :=
+  ∀ block contents, left.blocks block = some contents →
+    right.blocks block = some contents
+
+instance : HasSubset (Store β) := ⟨Store.Subset⟩
+
+/-- Return a block identifier only when the requested content occurs exactly once. -/
+def designated [DecidableEq β] (store : Store β) (canon : Block β) : Option β :=
+  match store.dom.filter fun block => store.blocks block == some canon with
+  | [block] => some block
+  | _ => none
+
+end Store
+end Ix.Theory
diff --git a/Ix/Theory/VLevel.lean b/Ix/Theory/VLevel.lean
new file mode 100644
index 000000000..fe27e5159
--- /dev/null
+++ b/Ix/Theory/VLevel.lean
@@ -0,0 +1,128 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Std.Basic
+
+/-!
+# Semantic universe levels
+
+`VLevel` gives the implementation-independent meaning of universe levels used
+by Theory. Its equivalence relation is extensional equality under every
+valuation, so it deliberately forgets representation identity and sharing.
+-/
+
+namespace Ix.Theory
+
+inductive VLevel where
+  | zero  : VLevel
+  | succ  : VLevel → VLevel
+  | max   : VLevel → VLevel → VLevel
+  | imax  : VLevel → VLevel → VLevel
+  | param : Nat → VLevel
+deriving DecidableEq, Hashable
+
+namespace VLevel
+
+/-- The natural-number semantics of universe `imax`. -/
+def natIMax (a b : Nat) : Nat := if b = 0 then 0 else Nat.max a b
+
+instance : Inhabited VLevel := ⟨.zero⟩
+
+variable (n : Nat) in
+def WF : VLevel → Prop
+  | .zero => True
+  | .succ l => l.WF
+  | .max l₁ l₂ => l₁.WF ∧ l₂.WF
+  | .imax l₁ l₂ => l₁.WF ∧ l₂.WF
+  | .param i => i < n
+
+instance decidable_WF : ∀ {l}, Decidable (WF n l)
+  | .zero => instDecidableTrue
+  | .succ l => @decidable_WF _ l
+  | .max .. | .imax .. => @instDecidableAnd _ _ decidable_WF decidable_WF
+  | .param _ => Nat.decLt ..
+
+variable (ls : List Nat) in
+def eval : VLevel → Nat
+  | .zero => 0
+  | .succ l => l.eval + 1
+  | .max l₁ l₂ => l₁.eval.max l₂.eval
+  | .imax l₁ l₂ => natIMax l₁.eval l₂.eval
+  | .param i => ls.getD i 0
+
+protected def LE (a b : VLevel) : Prop := ∀ ls, a.eval ls ≤ b.eval ls
+
+instance : LE VLevel := ⟨VLevel.LE⟩
+
+theorem le_refl (a : VLevel) : a ≤ a := fun _ => Nat.le_refl _
+
+protected def Equiv (a b : VLevel) : Prop := a.eval = b.eval
+
+instance : HasEquiv VLevel := ⟨VLevel.Equiv⟩
+
+theorem equiv_def {a b : VLevel} : a ≈ b ↔ ∀ ls, a.eval ls = b.eval ls := funext_iff
+
+theorem le_antisymm_iff {a b : VLevel} : a ≈ b ↔ a ≤ b ∧ b ≤ a :=
+  equiv_def.trans <| (forall_congr' fun _ => Nat.le_antisymm_iff).trans forall_and
+
+theorem succ_congr {a b : VLevel} (h : a ≈ b) : succ a ≈ succ b := by
+  simpa [equiv_def, eval] using h
+
+theorem imax_congr (h₁ : a₁ ≈ b₁) (h₂ : a₂ ≈ b₂) : imax a₁ a₂ ≈ imax b₁ b₂ := by
+  simp_all [equiv_def, eval]
+
+theorem imax_self : imax a a ≈ a := by
+  simp [equiv_def, eval, natIMax, eq_comm (b := 0)]
+
+variable (ls : List VLevel) in
+def inst : VLevel → VLevel
+  | .zero => .zero
+  | .succ l => .succ l.inst
+  | .max l₁ l₂ => .max l₁.inst l₂.inst
+  | .imax l₁ l₂ => .imax l₁.inst l₂.inst
+  | .param i => ls.getD i .zero
+
+theorem inst_inst {l : VLevel} : (l.inst ls).inst ls' = l.inst (ls.map (inst ls')) := by
+  induction l <;> simp [inst, *, List.getD_eq_getElem?_getD, List.getElem?_map]
+  case param n => cases ls[n]? <;> simp [inst]
+
+def params (n : Nat) : List VLevel := (List.range n).map .param
+
+@[simp] theorem params_length {n : Nat} : (params n).length = n := by simp [params]
+
+theorem params_wf {n : Nat} : ∀ ⦃l⦄, l ∈ params n → l.WF n := by simp [params, WF]
+
+theorem inst_id {l : VLevel} (h : l.WF u) : l.inst (params u) = l := by
+  induction l <;> simp_all [params, inst, WF, List.getD_eq_getElem?_getD]
+
+theorem inst_map_id (h : ls.length = n) : (params n).map (inst ls) = ls := by
+  subst n; simp [params]; apply List.ext_get (by simp)
+  intro i _ _; simp [inst]; rw [List.getElem?_eq_getElem]; rfl
+
+theorem eval_inst {l : VLevel} : (l.inst ls).eval ns = l.eval (ls.map (eval ns)) := by
+  induction l <;> simp [eval, inst, *, List.getD_eq_getElem?_getD]
+  case param n => cases ls[n]? <;> simp [eval]
+
+theorem WF.inst {l : VLevel} (H : ∀ l ∈ ls, l.WF n) : (l.inst ls).WF n := by
+  induction l with
+  | zero => trivial
+  | succ _ ih => exact ih
+  | max _ _ ih1 ih2 | imax _ _ ih1 ih2 => exact ⟨ih1, ih2⟩
+  | param i =>
+    simp [VLevel.inst, List.getD_eq_getElem?_getD]
+    cases e : ls[i]? with
+    | none => trivial
+    | some => exact H _ (List.mem_of_getElem? e)
+
+theorem inst_congr {l : VLevel} (h1 : l ≈ l') (h2 : List.Forall₂ (·≈·) ls ls') :
+    l.inst ls ≈ l'.inst ls' := by
+  simp [equiv_def, eval_inst, ← equiv_def.1 h1]
+  intro ns; congr 1
+  induction h2 with
+  | nil => rfl
+  | cons h2 => simp [*, equiv_def.1 h2]
+
+theorem inst_congr_l {l : VLevel} (h1 : l ≈ l') : l.inst ls ≈ l'.inst ls :=
+  inst_congr h1 <| Ix.Theory.List.Forall₂.rfl fun _ _ => rfl
diff --git a/Models/SetTheory/IxSetTheoryModel.lean b/Models/SetTheory/IxSetTheoryModel.lean
new file mode 100644
index 000000000..a60e6561b
--- /dev/null
+++ b/Models/SetTheory/IxSetTheoryModel.lean
@@ -0,0 +1,6 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import IxSetTheoryModel.Audit
diff --git a/Models/SetTheory/IxSetTheoryModel/Audit.lean b/Models/SetTheory/IxSetTheoryModel/Audit.lean
new file mode 100644
index 000000000..31fe85af3
--- /dev/null
+++ b/Models/SetTheory/IxSetTheoryModel/Audit.lean
@@ -0,0 +1,52 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean.Elab.Command
+import Lean.Util.FoldConsts
+import IxSetTheoryModel.Carneiro
+
+/-!
+# Checked dependency boundary of the concrete set model
+
+The traversal reads declaration types, bodies, and constructor fields directly.
+It does not depend on imported axiom summaries or the kernel's named calculus.
+-/
+
+namespace IxSetTheoryModel.Audit
+
+open Lean Elab Command
+
+private def directConstants (info : ConstantInfo) : Array Name :=
+  info.type.getUsedConstants ++ match info with
+  | .thmInfo value => value.value.getUsedConstants
+  | .defnInfo value => value.value.getUsedConstants
+  | .opaqueInfo value => value.value.getUsedConstants
+  | .inductInfo value => value.ctors.toArray
+  | _ => #[]
+
+private partial def closure (env : Environment) (pending : List Name)
+    (seen : NameSet := {}) : NameSet :=
+  match pending with
+  | [] => seen
+  | name :: rest =>
+    if seen.contains name then closure env rest seen
+    else match env.checked.get.find? name with
+    | some info => closure env ((directConstants info).toList ++ rest) (seen.insert name)
+    | none => closure env rest (seen.insert name)
+
+run_cmd do
+  let env ← getEnv
+  let root := ``carneiro_implies_ix
+  let dependencies := closure env [root]
+  let actual := dependencies.toList.toArray.filter fun name =>
+    match env.checked.get.find? name with
+    | some (.axiomInfo _) => true
+    | _ => false
+  let expected := #[``propext, ``Classical.choice, ``Quot.sound]
+  unless actual.qsort Name.lt == expected.qsort Name.lt do
+    throwError m!"set-theory model axiom boundary changed:\n{actual.qsort Name.lt}"
+  logInfo "Set-theory model full dependency audit passed: standard Lean axioms only"
+
+end IxSetTheoryModel.Audit
diff --git a/Models/SetTheory/IxSetTheoryModel/Carneiro.lean b/Models/SetTheory/IxSetTheoryModel/Carneiro.lean
new file mode 100644
index 000000000..2bf8d3ade
--- /dev/null
+++ b/Models/SetTheory/IxSetTheoryModel/Carneiro.lean
@@ -0,0 +1,181 @@
+/-
+Ported from con-leche (86cd20a65660d757cedc81561a44579099b565d0).
+Source attribution and original path: Models/SetTheory/NOTICE.
+Modifications Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)
+Changes: namespaces and imports adapted to Ix; documentation updated.
+-/
+
+import Mathlib.SetTheory.Cardinal.Regular
+import Mathlib.SetTheory.ZFC.VonNeumann
+import Mathlib.SetTheory.ZFC.Cardinal
+import Ix.Theory.Model.SetTheory.Core
+
+/-!
+# A concrete model of Ix's set-theory interface
+
+A strictly increasing countable sequence of inaccessible cardinals gives
+`Ix.Theory.Model.SetTheory ZFSet.{u}`, with `univChain n := V_ (κ n).ord`.
+Mathlib supplies the set operations, including images of arbitrary Lean
+functions via `Classical.allZFSetDefinable`. The proof below establishes
+Tarski's universe clauses for each inaccessible stage of the von Neumann
+hierarchy and assembles the instance.
+
+This separate package is the only part of the construction that imports
+Mathlib. `Audit.lean` checks the model-existence theorem's full dependency
+graph against Lean's `propext`, `Classical.choice`, and `Quot.sound` axioms.
+The inaccessible-cardinal assumption remains a theorem hypothesis.
+-/
+
+universe u
+
+open Cardinal Order ZFSet
+
+namespace IxSetTheoryModel
+
+/-- A strictly increasing countable sequence of strongly inaccessible
+cardinals. This remains an explicit hypothesis; this package does not assert
+the existence of inaccessible cardinals. -/
+def OmegaInaccessibles : Prop :=
+  ∃ κ : ℕ → Cardinal.{u}, StrictMono κ ∧ ∀ n, (κ n).IsInaccessible
+
+/-! ### `V_ κ` is a Grothendieck universe in Tarski's form, for `κ` inaccessible -/
+
+variable {κ : Cardinal.{u}}
+
+/-- A subset of `V_ κ.ord` of cardinality `< κ` has rank `< κ.ord`:
+regularity of `κ` bounds the least strict upper bound of `< κ` many
+ordinals below `κ.ord`. -/
+theorem rank_lt_ord_of_card_lt (hκ : κ.IsRegular) {y : ZFSet.{u}}
+    (hy : y ⊆ V_ κ.ord) (hc : y.card < κ) : y.rank < κ.ord := by
+  let e : y ≃ Shrink.{u} y := equivShrink _
+  let f : Shrink.{u} y → Ordinal.{u} := fun z => rank (e.symm z).1
+  have hlt : ⨆ z, f z + 1 < κ.ord :=
+    Ordinal.iSup_add_one_lt_of_lt_cof (by rwa [hκ.cof_ord]) fun z =>
+      mem_vonNeumann.mp (hy (e.symm z).2)
+  refine lt_of_le_of_lt ?_ hlt
+  rw [rank_le_iff]
+  intro z hz
+  have := Ordinal.lt_iSup_add_one f (e ⟨z, hz⟩)
+  simpa [f, e] using this
+
+/-- Below an inaccessible, the beth function stays below it. -/
+theorem preBeth_lt_of_lt_ord (hκ : κ.IsInaccessible) :
+    ∀ {a : Ordinal.{u}}, a < κ.ord → preBeth a < κ := by
+  intro a
+  induction a using Ordinal.limitRecOn with
+  | zero => intro _; rw [preBeth_zero]; exact hκ.pos
+  | add_one a ih =>
+    intro h
+    rw [preBeth_add_one]
+    exact hκ.isStrongLimit.isStrongPrelimit (ih ((lt_add_one a).trans h))
+  | limit a ha ih =>
+    intro h
+    rw [preBeth_limit ha.isSuccPrelimit]
+    refine Cardinal.lift_iSup_lt_of_lt_cof_ord ?_ fun b => ih b b.2 (b.2.trans h)
+    rw [hκ.isRegular.lift.cof_ord, mk_Iio_ordinal, lift_lift, lift_lt]
+    exact lt_ord.mp h
+
+/-- `|V_ κ| = κ` for `κ` inaccessible. -/
+theorem card_vonNeumann_ord (hκ : κ.IsInaccessible) : card (V_ κ.ord) = κ := by
+  rw [card_vonNeumann]
+  refine le_antisymm ?_ (le_preBeth_ord κ)
+  rw [preBeth_limit (isSuccLimit_ord hκ.aleph0_lt.le).isSuccPrelimit]
+  exact ciSup_le' fun b => (preBeth_lt_of_lt_ord hκ b.2).le
+
+/-- A subset of `V_ κ` that is not a member has the cardinality of
+`V_ κ`. -/
+theorem card_eq_of_not_rank_lt (hκ : κ.IsInaccessible) {y : ZFSet.{u}}
+    (hy : y ⊆ V_ κ.ord) (hr : ¬ y.rank < κ.ord) : card y = card (V_ κ.ord) := by
+  refine le_antisymm (card_mono hy) ?_
+  rw [card_vonNeumann_ord hκ]
+  exact not_lt.mp fun h => hr (rank_lt_ord_of_card_lt hκ.isRegular hy h)
+
+/-- Equal cardinality gives Ix's meta-level equinumerosity: a global
+function `ZFSet → ZFSet` that restricts to a bijection. -/
+theorem equinumerous_of_card_eq {y s : ZFSet.{u}} (h : card y = card s) :
+    Ix.Theory.Model.Equinumerous (· ∈ ·) y s := by
+  obtain ⟨e'⟩ := Cardinal.eq.mp h
+  let e : y ≃ s := (equivShrink _).trans (e'.trans (equivShrink _).symm)
+  classical
+  refine ⟨fun z => if hz : z ∈ y then (e ⟨z, hz⟩).1 else z, ?_, ?_, ?_⟩
+  · intro z hz
+    simp only [hz, ↓reduceDIte]
+    exact (e ⟨z, hz⟩).2
+  · intro z z' hz hz' hzz'
+    simp only [hz, hz', ↓reduceDIte] at hzz'
+    have := e.injective (Subtype.ext hzz')
+    exact congrArg Subtype.val this
+  · intro w hw
+    refine ⟨(e.symm ⟨w, hw⟩).1, (e.symm ⟨w, hw⟩).2, ?_⟩
+    simp only [(e.symm ⟨w, hw⟩).2, ↓reduceDIte, Subtype.coe_eta, Equiv.apply_symm_apply]
+
+/-- **`V_ κ` is a Grothendieck universe in Tarski's form** (Ix's
+`IsTGUniverse`) for every inaccessible `κ`. -/
+theorem isTGUniverse_vonNeumann (hκ : κ.IsInaccessible) :
+    Ix.Theory.Model.IsTGUniverse (· ∈ ·) (V_ κ.ord) := by
+  have hlim : IsSuccLimit κ.ord := isSuccLimit_ord hκ.aleph0_lt.le
+  refine ⟨?_, ?_, ?_, ?_⟩
+  · -- transitivity
+    intro y z (hy : y ∈ V_ κ.ord) (hz : z ∈ y)
+    exact isTransitive_vonNeumann _ y hy hz
+  · -- subsets of members are members
+    intro y z (hy : y ∈ V_ κ.ord) hzy
+    exact mem_vonNeumann_of_subset (fun w hw => hzy w hw) hy
+  · -- power sets stay inside
+    intro y (hy : y ∈ V_ κ.ord)
+    refine ⟨powerset y, ?_, fun z hz => mem_powerset.mpr fun w hw => hz w hw⟩
+    show powerset y ∈ V_ κ.ord
+    rw [mem_vonNeumann, rank_powerset]
+    exact hlim.succ_lt (mem_vonNeumann.mp hy)
+  · -- Tarski's clause: a subset is a member or equinumerous
+    intro y hy
+    have hy' : y ⊆ V_ κ.ord := fun w hw => hy w hw
+    by_cases hr : y.rank < κ.ord
+    · exact Or.inr (mem_vonNeumann.mpr hr)
+    · exact Or.inl (equinumerous_of_card_eq (card_eq_of_not_rank_lt hκ hy' hr))
+
+/-! ### The `Ix.Theory.Model.SetTheory` instance on `ZFSet` -/
+
+set_option warn.classDefReducibility false in
+/-- Ix's set theory on Mathlib's `ZFSet.{u}`, from any strictly
+increasing sequence of inaccessibles: the ZF⁻ fields are Mathlib's
+(`ZFSet.ext`, pairs, `⋃₀`, `powerset`, `mem_wf`, `image` under
+`Classical.allZFSetDefinable`), and `univChain n := V_ (κ n).ord`. -/
+noncomputable def setTheoryOfChain (κ : ℕ → Cardinal.{u}) (hmono : StrictMono κ)
+    (hinacc : ∀ n, (κ n).IsInaccessible) : Ix.Theory.Model.SetTheory ZFSet.{u} where
+  Mem := (· ∈ ·)
+  ext h := ZFSet.ext h
+  upair a b := {a, b}
+  mem_upair := mem_pair
+  sUnion := ZFSet.sUnion
+  mem_sUnion := mem_sUnion
+  power := powerset
+  mem_power := mem_powerset
+  regularity x h := by
+    obtain ⟨y, hy, hmin⟩ := mem_wf.has_min {y | y ∈ x} h
+    exact ⟨y, hy, fun ⟨z, hzy, hzx⟩ => hmin z hzx hzy⟩
+  image f := @ZFSet.image f (Classical.allZFSetDefinable _)
+  mem_image := by
+    intro f a z
+    rw [@mem_image f (Classical.allZFSetDefinable _)]
+    exact exists_congr fun w => and_congr_right fun _ => eq_comm
+  univChain n := V_ (κ n).ord
+  univChain_mem n := vonNeumann_mem_of_lt (ord_lt_ord.mpr (hmono (Nat.lt_succ_self n)))
+  univChain_tg n := isTGUniverse_vonNeumann (hinacc n)
+
+set_option warn.classDefReducibility false in
+/-- Ix's set theory on `ZFSet.{u}` under Carneiro's hypothesis. -/
+noncomputable def setTheoryOfCarneiro (h : OmegaInaccessibles.{u}) : Ix.Theory.Model.SetTheory ZFSet.{u} :=
+  setTheoryOfChain (Classical.choose h) (Classical.choose_spec h).1 (Classical.choose_spec h).2
+
+/-- **Carneiro's hypothesis implies Ix's.**  `ω` strongly inaccessible
+cardinals give a model of
+Ix's `SetTheory` interface — on Mathlib's `ZFSet.{u}`, with the
+universe chain `V_ (κ n).ord`. -/
+theorem carneiro_implies_ix :
+    OmegaInaccessibles.{u} → Nonempty (Σ V : Type (u + 1), Ix.Theory.Model.SetTheory V) :=
+  fun h => ⟨⟨ZFSet.{u}, setTheoryOfCarneiro h⟩⟩
+
+
+end IxSetTheoryModel
diff --git a/Models/SetTheory/LICENSE-CON-LECHE b/Models/SetTheory/LICENSE-CON-LECHE
new file mode 100644
index 000000000..813da2975
--- /dev/null
+++ b/Models/SetTheory/LICENSE-CON-LECHE
@@ -0,0 +1,71 @@
+Apache License 2.0 (Apache)
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License.
+
+Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License.
+
+Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution.
+
+You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+1. You must give any other recipients of the Work or Derivative Works a copy of this License; and
+
+2. You must cause any modified files to carry prominent notices stating that You changed the files; and
+
+3. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+
+4. If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions.
+
+Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks.
+
+This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty.
+
+Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability.
+
+In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability.
+
+While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
diff --git a/Models/SetTheory/NOTICE b/Models/SetTheory/NOTICE
new file mode 100644
index 000000000..049f8aeb6
--- /dev/null
+++ b/Models/SetTheory/NOTICE
@@ -0,0 +1,11 @@
+Set-theory model construction
+
+Copied from con-leche revision 86cd20a65660d757cedc81561a44579099b565d0,
+bridge/lean4lean-model/ConLecheBridge/Carneiro.lean.
+Original SHA-256:
+389b5fff365cf47a5040e6eac540d6ddedde4b95d9f4176c3c08f675f586c1c4
+
+The countable-inaccessibles hypothesis was transcribed by con-leche from
+Mario Carneiro's Lean4LeanModel/Consistency.lean. Namespaces, imports, and
+documentation were adapted for Ix; the mathematical construction is retained.
+Con-leche's Apache-2.0 license is preserved in LICENSE-CON-LECHE.
diff --git a/Models/SetTheory/README.md b/Models/SetTheory/README.md
new file mode 100644
index 000000000..64fb0cd43
--- /dev/null
+++ b/Models/SetTheory/README.md
@@ -0,0 +1,53 @@
+# Set-theory model
+
+This separate Lake package constructs `Ix.Theory.Model.SetTheory` on Mathlib's
+`ZFSet`, assuming a strictly increasing countable sequence of strongly
+inaccessible cardinals. Its universe chain is `V_ (κ n).ord`.
+
+`IxSetTheoryModel.setTheoryOfChain` assembles the instance from a given chain.
+`setTheoryOfCarneiro` selects a chain from `OmegaInaccessibles`, and
+`carneiro_implies_ix` proves:
+
+```lean
+OmegaInaccessibles.{u} →
+  Nonempty (Σ V : Type (u + 1), Ix.Theory.Model.SetTheory V)
+```
+
+The construction includes the interface's Lean-level replacement scheme:
+Mathlib's `Classical.allZFSetDefinable` supplies images of arbitrary functions
+`ZFSet → ZFSet`. The audit traverses the theorem's checked types, bodies, and
+constructor fields and permits exactly `propext`, `Classical.choice`, and
+`Quot.sound`. Inaccessible cardinals remain an explicit
+hypothesis, rather than an added Lean axiom.
+
+The package imports the actual Ix interface by a path dependency on the
+repository root. Mathlib is confined to this package; ordinary Ix and
+`Ix.Theory` builds do not depend on it. This construction supplies the
+set-theoretic assumption used by the [consistency model](../../docs/theory.md).
+The connection from the production checker to the certified interface is a
+separate proof obligation. A converse from the interface to inaccessible
+cardinals is not proved here.
+
+## Build
+
+From `Models/SetTheory`:
+
+```sh
+lake exe cache get Mathlib.SetTheory.Cardinal.Regular Mathlib.SetTheory.ZFC.VonNeumann Mathlib.SetTheory.ZFC.Cardinal
+lake build --wfail
+```
+
+Lean and Mathlib use release `v4.33.1`; `lake-manifest.json` pins all resolved
+dependencies. The cache command retrieves the three imported Mathlib modules
+and their dependencies. The build checks the axiom guard. The separate
+`set-theory-model.yml` workflow runs these commands when the model, its interface,
+or package configuration changes.
+
+## Provenance
+
+`IxSetTheoryModel/Carneiro.lean` is copied from con-leche revision
+`86cd20a65660d757cedc81561a44579099b565d0`. The original path and source
+SHA-256 are recorded in [NOTICE](NOTICE).
+Namespaces, imports, and documentation are adapted for Ix; the mathematical
+construction is retained. Con-leche's Apache-2.0 license is preserved in
+`LICENSE-CON-LECHE`.
diff --git a/Models/SetTheory/lake-manifest.json b/Models/SetTheory/lake-manifest.json
new file mode 100644
index 000000000..65a60778b
--- /dev/null
+++ b/Models/SetTheory/lake-manifest.json
@@ -0,0 +1,123 @@
+{"version": "1.2.0",
+ "packagesDir": ".lake/packages",
+ "packages":
+ [{"type": "path",
+   "scope": "",
+   "name": "ix",
+   "manifestFile": "lake-manifest.json",
+   "inherited": false,
+   "dir": "../..",
+   "configFile": "lakefile.lean"},
+  {"url": "https://github.com/leanprover-community/mathlib4",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "0df444a360eaa60ab8c11dca51a86af692955474",
+   "name": "mathlib",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "v4.33.1",
+   "inherited": false,
+   "configFile": "lakefile.lean"},
+  {"url": "https://github.com/leanprover-community/batteries",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "4488d40d070b9700d4d5a6aa342f0d40c31b2a2d",
+   "name": "batteries",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "v4.33.0",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover/lean4-cli",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "6130a47896ce867c6a4a55373441e59e565bad0f",
+   "name": "Cli",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "v4.33.0",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/argumentcomputer/Blake3.lean",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "78f5bc4b22de1172af8a5d91e7039128084fad3a",
+   "name": "Blake3",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "78f5bc4b22de1172af8a5d91e7039128084fad3a",
+   "inherited": true,
+   "configFile": "lakefile.lean"},
+  {"url": "https://github.com/argumentcomputer/LSpec",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "ab4d5eb461941837f48eb891be755c8c73e89fdd",
+   "name": "LSpec",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "ab4d5eb461941837f48eb891be755c8c73e89fdd",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/plausible",
+   "type": "git",
+   "subDir": null,
+   "scope": "",
+   "rev": "b7eb3304aeae834b12dda98993a37f6a41f6f0bb",
+   "name": "plausible",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "v4.33.0",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/LeanSearchClient",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "5f4d51b81cbd3f6b32b156bfad9056621a040404",
+   "name": "LeanSearchClient",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/import-graph",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "16f02aa7642864af59f1ff0e384a015994db9118",
+   "name": "importGraph",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/ProofWidgets4",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "4be2e3d5087eeb272cf5a8853b8f9dd025ef5957",
+   "name": "proofwidgets",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "main",
+   "inherited": true,
+   "configFile": "lakefile.lean"},
+  {"url": "https://github.com/leanprover-community/aesop",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "3448c0bcc5ce01b2d1546e483ec3620e32df3d0e",
+   "name": "aesop",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "master",
+   "inherited": true,
+   "configFile": "lakefile.toml"},
+  {"url": "https://github.com/leanprover-community/quote4",
+   "type": "git",
+   "subDir": null,
+   "scope": "leanprover-community",
+   "rev": "92c15be17b7caf78c2ad767ec40f89052d908d81",
+   "name": "Qq",
+   "manifestFile": "lake-manifest.json",
+   "inputRev": "master",
+   "inherited": true,
+   "configFile": "lakefile.toml"}],
+ "name": "«ix-set-theory-model»",
+ "lakeDir": ".lake",
+ "fixedToolchain": false}
diff --git a/Models/SetTheory/lakefile.toml b/Models/SetTheory/lakefile.toml
new file mode 100644
index 000000000..643bcfe5b
--- /dev/null
+++ b/Models/SetTheory/lakefile.toml
@@ -0,0 +1,17 @@
+name = "ix-set-theory-model"
+defaultTargets = ["IxSetTheoryModel"]
+
+# Keep Mathlib confined to this package. Its release matches Ix's toolchain.
+# Resolve shared dependencies from Mathlib's pinned manifest first.
+[[require]]
+name = "mathlib"
+git = "https://github.com/leanprover-community/mathlib4"
+rev = "v4.33.1"
+
+[[require]]
+name = "ix"
+path = "../.."
+
+[[lean_lib]]
+name = "IxSetTheoryModel"
+
diff --git a/Models/SetTheory/lean-toolchain b/Models/SetTheory/lean-toolchain
new file mode 100644
index 000000000..a8afa7d1b
--- /dev/null
+++ b/Models/SetTheory/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:v4.33.1
diff --git a/README.md b/README.md
index 5cd891617..ec63d3be5 100644
--- a/README.md
+++ b/README.md
@@ -227,6 +227,10 @@ not this stable overview.
 - `lake test -- cli` runs CLI integration tests
 - `lake test -- rust-compile` runs the Rust cross-compilation diagnostic
 
+The [certified source and claim profile](docs/certified-checking.md) has a
+separate gate: `lake run check-certified` checks its theorem audit, provenance
+and native/CLI regressions against the frozen C7 evidence.
+
 **Rust tests:** `cargo test` or `cargo nextest run`
 
 ### Proving under SP1
diff --git a/Tests/Aiur/AIRSemantics.lean b/Tests/Aiur/AIRSemantics.lean
new file mode 100644
index 000000000..351a0af2f
--- /dev/null
+++ b/Tests/Aiur/AIRSemantics.lean
@@ -0,0 +1,189 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Execution
+import Ix.Aiur.Proofs.Memory
+import Ix.Aiur.Proofs.LocalConstraints
+
+/-! Concrete local semantics and finite-derivation regressions. The native
+supplied-row counterparts live in `synthesis/tests/advice.rs`. -/
+
+open Aiur Aiur.Bytecode Aiur.Bytecode.AIR
+
+namespace Tests.Aiur.AIRSemantics
+
+private def fixtures : Array (String × Op × Array G × Array G × Option (Array G)) := #[
+  ("constant", .const 7, #[], #[], some #[7]),
+  ("addition", .add 0 1, #[255, 2], #[], some #[257]),
+  ("subtraction", .sub 0 1, #[255, 2], #[], some #[253]),
+  ("multiplication", .mul 0 1, #[255, 2], #[], some #[510]),
+  ("zero", .eqZero 0, #[0], #[], some #[1]),
+  ("nonzero", .eqZero 0, #[9], #[], some #[0]),
+  ("constrained-call-needs-provider", .call 1 #[0] 1 false, #[3], #[7], none),
+  ("unconstrained-call-advice", .call 1 #[0] 1 true, #[3], #[7], some #[7]),
+  ("unconstrained-call-width", .call 1 #[0] 1 true, #[3], #[7, 8], none),
+  ("store-needs-memory", .store #[0], #[3], #[7], none),
+  ("load-needs-memory", .load 1 0, #[7], #[3], none),
+  ("assertion", .assertEq #[0] #[1] none, #[7, 7], #[], some #[]),
+  ("false-assertion", .assertEq #[0] #[1] none, #[7, 8], #[], none),
+  ("assertion-width", .assertEq #[0] #[0, 1] none, #[7, 8], #[], none),
+  ("key-info-advice", .ioGetInfo 0 #[], #[0], #[300, 301], some #[300, 301]),
+  ("key-insertion-no-relation", .ioSetInfo 0 #[] 1 2, #[0, 9, 4], #[], some #[]),
+  ("read-advice", .ioRead 0 1 2, #[0, 9], #[302, 303], some #[302, 303]),
+  ("read-width", .ioRead 0 1 2, #[0, 9], #[302], none),
+  ("write-no-relation", .ioWrite 0 #[1], #[0, 7], #[], some #[]),
+  ("bit-decomposition", .u8BitDecomposition 0, #[129], #[], some #[1, 0, 0, 0, 0, 0, 0, 1]),
+  ("shift-left", .u8ShiftLeft 0, #[129], #[], some #[2]),
+  ("shift-right", .u8ShiftRight 0, #[129], #[], some #[64]),
+  ("xor", .u8Xor 0 1, #[255, 2], #[], some #[253]),
+  ("add-with-carry", .u8Add 0 1, #[255, 2], #[], some #[1, 1]),
+  ("byte-product", .u8Mul 0 1, #[255, 2], #[], some #[254, 1]),
+  ("subtract-with-borrow", .u8Sub 0 1, #[2, 255], #[], some #[3, 1]),
+  ("and", .u8And 0 1, #[255, 2], #[], some #[2]),
+  ("or", .u8Or 0 1, #[255, 2], #[], some #[255]),
+  ("byte-less-than", .u8LessThan 0 1, #[2, 255], #[], some #[1]),
+  ("word-less-than", .u32LessThan 0 1, #[65536, 65537], #[], some #[1]),
+  ("word-input-range", .u32LessThan 0 1, #[4294967296, 65537], #[], none),
+  ("split-seven", .u8XorSplit7 0 1, #[255, 2], #[], some #[1, 250]),
+  ("split-four", .u8XorSplit4 0 1, #[255, 2], #[], some #[15, 208]),
+  ("debug-no-relation", .debug "test" (some #[0]), #[7], #[], some #[]),
+  ("byte-range", .u8RangeCheck 0 1, #[255, 0], #[], some #[]),
+  ("invalid-byte-range", .u8RangeCheck 0 1, #[256, 0], #[], none),
+  ("byte-operation-requires-range", .u8Xor 0 1, #[256, 0], #[], none),
+  ("division-advice", .unconstrainedBigUintDivMod 0 1, #[3, 2], #[304, 305], some #[304, 305]),
+  ("decomposition-advice", .unconstrainedGToBytes 0, #[1],
+    #[306, 307, 308, 309, 310, 311, 312, 313], some #[306, 307, 308, 309, 310, 311, 312, 313]),
+  ("inverse-advice", .unconstrainedGInverse 0, #[1], #[314], some #[314]),
+  ("word-add", .unconstrainedU32Add #[0, 1, 2, 3] #[4, 5, 6, 7],
+    #[255, 255, 255, 255, 1, 0, 0, 0], #[0, 0, 0, 0], some #[0, 0, 0, 0, 1]),
+  ("word-add-three", .unconstrainedU32Add3 #[0, 1, 2, 3] #[0, 1, 2, 3] #[0, 1, 2, 3],
+    #[255, 255, 255, 255], #[253, 255, 255, 255], some #[253, 255, 255, 255, 2]),
+  ("word-packing", .u32ToField #[0, 1, 2, 3], #[1, 2, 3, 4], #[], some #[67305985]),
+  ("word-packing-width", .u32ToField #[0, 1, 2], #[1, 2, 3], #[], none),
+  ("invalid-value-index", .mul 0 2, #[3, 5], #[], none)]
+
+private def noMemory : Memory := fun _ _ _ => False
+
+private def identity : Function :=
+  ⟨⟨#[], .return 0 #[0]⟩, ⟨1, 1, 7, 4⟩, false, true⟩
+
+private def caller : Function :=
+  ⟨⟨#[.call 1 #[0] 1 false, .call 1 #[0] 1 false, .add 1 2], .return 0 #[3]⟩,
+    ⟨1, 1, 23, 12⟩, true, true⟩
+
+private def sharedProgram : Toplevel := ⟨#[caller, identity], #[], #[]⟩
+private def child : Call := ⟨1, #[3], #[3], 1⟩
+private def parent : Call := ⟨0, #[3], #[6], 0⟩
+
+private theorem childExecutes : Execution sharedProgram noMemory child := by
+  apply Execution.function (calls := [])
+  · apply RunFunction.function (function := identity) rfl rfl
+    apply RunBlock.block (intermediate := #[3]) (opCalls := []) (ctrlCalls := [])
+    · exact RunOps.nil
+    · exact RunCtrl.returned (by cbv)
+  · simp
+
+/-- A shared callee supplies both calls; the finite derivation needs no
+sequential cache state or multiplicity-dependent replay. -/
+example : Execution sharedProgram noMemory parent := by
+  apply Execution.function (calls := [child, child])
+  · apply RunFunction.function (function := caller) rfl rfl
+    apply RunBlock.block (intermediate := #[3, 3, 3, 6])
+      (opCalls := [child, child]) (ctrlCalls := [])
+    · apply RunOps.cons (intermediate := #[3, 3]) (firstCalls := [child]) (restCalls := [child])
+      · exact Step.call (request := child) (by cbv) rfl
+      · apply RunOps.cons (intermediate := #[3, 3, 3]) (firstCalls := [child]) (restCalls := [])
+        · exact Step.call (request := child) (by cbv) rfl
+        · exact RunOps.cons (Step.primitive (outputs := #[6]) (advice := #[]) (by cbv)) RunOps.nil
+    · exact RunCtrl.returned (by cbv)
+  · intro called member
+    have : called = child := by simpa using member
+    subst called
+    exact childExecutes
+
+private def yieldingArm : Block := ⟨#[.const 99, .const 5], .yield 0 #[2]⟩
+private def continuation : Block := ⟨#[.const 7, .add 1 2], .return 1 #[3]⟩
+
+/-- The branch-local 99 does not leak into the continuation's namespace. -/
+example : RunCtrl noMemory
+    (.matchContinue 0 #[(0, yieldingArm)] none 1 0 0 continuation)
+    #[0] (.returned #[12]) [] := by
+  apply RunCtrl.matchContinueYield (branchCalls := []) (contCalls := []) (yielded := #[5])
+    (scrutinee := 0) (arm := yieldingArm) (by cbv) (SelectArm.case (by simp))
+  · apply RunBlock.block (intermediate := #[0, 99, 5]) (opCalls := []) (ctrlCalls := [])
+    · exact RunOps.cons (Step.primitive (outputs := #[99]) (advice := #[]) (by cbv))
+        (RunOps.cons (Step.primitive (outputs := #[5]) (advice := #[]) (by cbv)) RunOps.nil)
+    · exact RunCtrl.yielded (by cbv)
+  · rfl
+  · apply RunBlock.block (intermediate := #[0, 5, 7, 12]) (opCalls := []) (ctrlCalls := [])
+    · exact RunOps.cons (Step.primitive (outputs := #[7]) (advice := #[]) (by cbv))
+        (RunOps.cons (Step.primitive (outputs := #[12]) (advice := #[]) (by cbv)) RunOps.nil)
+    · exact RunCtrl.returned (by cbv)
+
+private def returningArm : Block := ⟨#[.const 5], .return 0 #[1]⟩
+private def impossibleContinuation : Block :=
+  ⟨#[.const 1, .assertEq #[0] #[1] none], .return 1 #[]⟩
+
+/-- A branch return skips an otherwise failing continuation. -/
+example : RunCtrl noMemory
+    (.matchContinue 0 #[(0, returningArm)] none 0 0 0 impossibleContinuation)
+    #[0] (.returned #[5]) [] := by
+  apply RunCtrl.matchContinueReturn (scrutinee := 0) (arm := returningArm)
+    (by cbv) (SelectArm.case (by simp))
+  apply RunBlock.block (intermediate := #[0, 5]) (opCalls := []) (ctrlCalls := [])
+  · exact RunOps.cons (Step.primitive (outputs := #[5]) (advice := #[]) (by cbv)) RunOps.nil
+  · exact RunCtrl.returned (by cbv)
+
+private def memory : Memory := fun width pointer contents =>
+  width = 1 ∧ pointer = 7 ∧ contents = #[3]
+
+example : Step memory (.store #[0]) #[3] #[3, 7] [] :=
+  Step.store (by cbv) ⟨rfl, rfl, rfl⟩
+
+example : Step memory (.load 1 0) #[7] #[7, 3] [] :=
+  Step.load (pointer := 7) (contents := #[3]) (by cbv) rfl ⟨rfl, rfl, rfl⟩
+
+private def wrappingRows : Array Aiur.AIR.MemoryRow := #[
+  ⟨1, 0, G.ofNat (gSize.toNat - 1), #[7]⟩,
+  ⟨1, 1, 0, #[8]⟩,
+  ⟨0, 0, 0, #[0]⟩,
+  ⟨0, 0, 0, #[0]⟩]
+
+/-- The same four-row wrapping memory table used by the supplied native proof. -/
+private theorem wrappingRows_polynomials : Aiur.AIR.MemoryRowsPolynomials 1 wrappingRows := by
+  constructor
+  all_goals
+    intro i hi
+    have cases : i = 0 ∨ i = 1 ∨ i = 2 ∨ i = 3 := by
+      simp only [wrappingRows, List.size_toArray, List.length_cons, List.length_nil] at hi
+      omega
+    rcases cases with rfl | rfl | rfl | rfl
+    all_goals decide +revert +kernel
+
+example : wrappingRows[0].pointer ≠ wrappingRows[1].pointer := by
+  intro same
+  have impossible := wrappingRows_polynomials.valid.pointer_injective (by decide) 0 1
+    (by decide) (by decide) rfl rfl same
+  contradiction
+
+def main : IO Unit := do
+  for (label, op, values, advice, expected) in fixtures do
+    unless primitive op values advice == expected do
+      throw (IO.userError s!"AIR semantics fixture failed: {label}")
+  -- The result bytes of an unchecked u32 sum may exceed 255, while its
+  -- computed carry must still satisfy the field equation.
+  let values : Array G := #[1, 2, 3, 4, 5, 6, 7, 8]
+  let bytes : Array G := #[316, 317, 318, 319]
+  let some output := primitive (.unconstrainedU32Add #[0, 1, 2, 3] #[4, 5, 6, 7]) values bytes
+    | throw (IO.userError "unchecked u32 advice was rejected")
+  unless output.size == 5 && output.extract 0 4 == bytes &&
+      output[4]?.getD 0 * 4294967296 + packWord bytes ==
+        packWord (values.extract 0 4) + packWord (values.extract 4 8) do
+    throw (IO.userError "virtual u32 carry equation failed")
+  IO.println s!"AIR semantics: {fixtures.size} operation fixtures and unchecked virtual carry passed."
+
+end Tests.Aiur.AIRSemantics
+
+def main := Tests.Aiur.AIRSemantics.main
diff --git a/Tests/Aiur/Backend.lean b/Tests/Aiur/Backend.lean
new file mode 100644
index 000000000..aa9442ed4
--- /dev/null
+++ b/Tests/Aiur/Backend.lean
@@ -0,0 +1,108 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.ShapedVerifier
+import Ix.Aiur.Meta
+
+/-! Nonvacuity and rejection tests for the generic program binding component.
+The arithmetic source exercises the backend API; it is not a certified Ix
+checker and does not license a logical claim about Ix declarations. -/
+
+namespace AiurTests.Backend
+
+open Aiur Aiur.BoundVerifier
+
+def product := ⟦
+  pub fn product(a: G, b: G) -> G { a * b }
+⟧
+
+def changedProduct := ⟦
+  pub fn product(a: G, b: G) -> G { a + b }
+⟧
+
+def groupedProgram := ⟦
+  fn double(x: G) -> G { x + x }
+  fn bump(x: G) -> G { x + 1 }
+  pub fn grouped_product(a: G, b: G) -> G { double(a) * bump(b) }
+⟧
+
+def requireRejected (label : String) (result : Except String α) : IO Unit :=
+  match result with
+  | .error _ => IO.println s!"PASS {label}: rejected"
+  | .ok _ => throw (IO.userError s!"unexpected acceptance: {label}")
+
+def run : IO Unit := do
+  let compiled ← IO.ofExcept product.compile
+  let some function := compiled.getFuncIdx `product
+    | throw (IO.userError "missing product entrypoint")
+  let cp : CommitmentParameters := { logBlowup := 1, capHeight := 0 }
+  let fp : FriParameters := {
+    logFinalPolyLen := 0, maxLogArity := 1,
+    numQueries := 64, commitProofOfWorkBits := 0, queryProofOfWorkBits := 0 }
+  let system := AiurSystem.build compiled.bytecode cp fp
+  let selection : Selection := {
+    source := product, entrypoint := `product,
+    function, inputSize := 2, success := #[15], commitment := cp, fri := fp,
+    key := system.vkBytes }
+  let backend ← IO.ofExcept (buildCompiled selection)
+  let (claim, proof, _) ← IO.ofExcept (system.prove function #[3, 5] default)
+  unless claim == buildClaim function #[3, 5] #[15] do
+    throw (IO.userError "unexpected public claim")
+  let bytes := proof.toBytes
+  IO.ofExcept (verifyShaped backend #[3, 5] bytes)
+  IO.println "PASS selected program/key/function/input/result: accepted"
+  requireRejected "changed public input" (verifyShaped backend #[3, 4] bytes)
+  requireRejected "public input arity" (verifyShaped backend #[3] bytes)
+  requireRejected "malformed proof" (verifyShaped backend #[3, 5] ByteArray.empty)
+  let suffixed := bytes.push 0
+  let _ ← IO.ofExcept (Proof.ofBytesChecked suffixed)
+  requireRejected "proof suffix" (verifyShaped backend #[3, 5] suffixed)
+  let checked ← IO.ofExcept (readProof backend.keyData bytes)
+  let malformed := { checked.data with stage1 := [] }
+  let malformedBytes := NativeAIR.ProofCodec.encode malformed
+  unless (NativeAIR.ProofCodec.decodeCanonical malformedBytes).isSome do
+    throw (IO.userError "shape mutation is not a canonical proof artifact")
+  requireRejected "proof opening dimensions" (verifyShaped backend #[3, 5] malformedBytes)
+  let changedResult ← IO.ofExcept (buildCompiled { selection with success := #[16] })
+  requireRejected "changed success result" (verifyShaped changedResult #[3, 5] bytes)
+  requireRejected "missing success output" (buildCompiled { selection with success := #[] })
+  requireRejected "extra zero success output" (buildCompiled { selection with success := #[15, 0] })
+  requireRejected "unselected key" (buildCompiled { selection with key := ByteArray.empty })
+  requireRejected "changed program" (buildCompiled { selection with source := changedProduct })
+  requireRejected "changed function index" (buildCompiled { selection with function := function + 1 })
+  requireRejected "changed entrypoint" (buildCompiled { selection with entrypoint := `missing })
+  requireRejected "changed expected arity" (buildCompiled { selection with inputSize := 3 })
+  requireRejected "unselected grouping" (buildCompiled { selection with groups := #[("bad", #["product"])] })
+  requireRejected "changed commitment parameters" (buildCompiled {
+    selection with commitment := { cp with logBlowup := 2 } })
+  requireRejected "changed FRI parameters" (buildCompiled {
+    selection with fri := { fp with numQueries := 32 } })
+
+  let initial ← IO.ofExcept groupedProgram.compile
+  let groups := #[("helpers", #["double", "bump"])]
+  let grouped ← IO.ofExcept (initial.groupFunctions groups)
+  unless grouped.bytecode.circuits.size + 1 == initial.bytecode.circuits.size do
+    throw (IO.userError "grouping did not merge the two helper circuits")
+  let some groupedFunction := grouped.getFuncIdx `grouped_product
+    | throw (IO.userError "missing grouped entrypoint")
+  let groupedSystem := AiurSystem.build grouped.bytecode cp fp
+  let groupedSelection : Selection := {
+    source := groupedProgram, groups, entrypoint := `grouped_product,
+    function := groupedFunction, inputSize := 2, success := #[30],
+    commitment := cp, fri := fp, key := groupedSystem.vkBytes }
+  let groupedBackend ← IO.ofExcept (buildCompiled groupedSelection)
+  let (groupedClaim, groupedProof, _) ←
+    IO.ofExcept (groupedSystem.prove groupedFunction #[3, 4] default)
+  unless groupedClaim == buildClaim groupedFunction #[3, 4] #[30] do
+    throw (IO.userError "unexpected grouped public claim")
+  IO.ofExcept (verifyShaped groupedBackend #[3, 4] groupedProof.toBytes)
+  IO.println "PASS selected grouped program: accepted"
+  requireRejected "grouped key with ungrouped program"
+    (buildCompiled { groupedSelection with groups := #[] })
+  IO.println "backend binding: 2 accepted, 17 rejected, 0 unexpected outcomes"
+
+end AiurTests.Backend
+
+def main : IO Unit := AiurTests.Backend.run
diff --git a/Tests/Aiur/Blake3.lean b/Tests/Aiur/Blake3.lean
new file mode 100644
index 000000000..6e6b46ebc
--- /dev/null
+++ b/Tests/Aiur/Blake3.lean
@@ -0,0 +1,95 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Blake3
+import Tests.Aiur.EmissionReader
+
+/-! Compare the total checked hash with the pinned native unkeyed hasher,
+Plonky3 wrapper, chunk CVs, and internal parent operations. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.Blake3 AiurTests.EmissionReader
+
+namespace AiurTests.Blake3
+
+private def readBytes : Reader (List UInt8) := do
+  return (← takeBytes (← readCount 10000000)).data.toList
+
+private def readDigest : Reader Digest := do
+  let bytes ← takeBytes 32
+  if length : bytes.data.size = 32 then return ⟨bytes.data, length⟩
+  else throw "incomplete Blake3 digest"
+
+private def digestCV (bytes : Digest) : CV :=
+  Vector.ofFn fun word => bytesWord (Vector.ofFn fun byte : Fin 4 => bytes[word.val * 4 + byte.val])
+
+private def readHashes : Reader Unit := do
+  unless (← readNat) == 258 do throw "incomplete Blake3 hash cases"
+  let mut parents := 0
+  for _ in [:258] do
+    let input ← readBytes
+    let expected ← readDigest
+    unless digest input == expected do throw s!"Blake3 digest differs at {input.length} bytes"
+    unless List.ofFn (hash input) == expected.toList do throw "Blake3 transcript byte order differs"
+    if input.length > 1024 then
+      parents := parents + 1
+      let split ← readNat
+      unless leftLen input.length == split do throw "Blake3 canonical split differs"
+      let left ← readDigest
+      let right ← readDigest
+      unless cvBytes (subtree 0 (input.take split)).chainingValue == left do throw "Blake3 left subtree differs"
+      unless cvBytes (subtree (split / 1024) (input.drop split)).chainingValue == right do throw "Blake3 right subtree differs"
+      unless (parentOutput (digestCV left) (digestCV right)).rootHash == expected do throw "Blake3 root parent differs"
+  unless parents == 58 do throw "incomplete Blake3 tree cases"
+
+private def readChunks : Reader Unit := do
+  unless (← readNat) == 42 do throw "incomplete Blake3 chunk cases"
+  let mut highCounters := 0
+  for _ in [:42] do
+    let counter ← readNat
+    let input ← readBytes
+    let expected ← readDigest
+    unless input.length > 0 && input.length ≤ 1024 && counter < 2^54 do throw "inadmissible native chunk case"
+    if counter ≥ 2^32 then highCounters := highCounters + 1
+    let output := chunkOutput counter.toUInt64 input
+    unless cvBytes output.chainingValue == expected do throw s!"Blake3 chunk differs at {counter}, {input.length}"
+    unless output.counter.toNat == counter do throw "Blake3 chunk counter changed"
+    unless output.blockLen.toNat == (input.length - 1) % 64 + 1 do throw "Blake3 final block length differs"
+    unless output.flags == (if input.length ≤ 64 then 3 else 2) do throw "Blake3 chunk flags differ"
+  unless highCounters == 12 do throw "incomplete 64-bit chunk counters"
+
+private def readParents : Reader Unit := do
+  unless (← readNat) == 64 do throw "incomplete Blake3 parent cases"
+  for _ in [:64] do
+    let left ← readDigest
+    let right ← readDigest
+    let cv ← readDigest
+    let root ← readDigest
+    let merkle ← readDigest
+    let parent := parentOutput (digestCV left) (digestCV right)
+    unless cvBytes parent.chainingValue == cv do throw "Blake3 internal parent CV differs"
+    unless parent.rootHash == root do throw "Blake3 internal parent root differs"
+    unless digest (left.toList ++ right.toList) == merkle do throw "Blake3 PCS Merkle pair differs"
+    unless root != merkle do throw "missing distinction between internal parent and Merkle hash"
+    unless cvBytes (digestCV left) == left && cvBytes (digestCV right) == right do throw "Blake3 CV byte packing differs"
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur Blake3 v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "Blake3 snapshot version differs"
+  readHashes
+  readChunks
+  readParents
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "Blake3 snapshot has trailing bytes"
+
+end AiurTests.Blake3
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    let bytes ← IO.FS.readBinFile path
+    match AiurTests.Blake3.readCorpus.run (bytes, 0) with
+    | .error error => throw (IO.userError error)
+    | .ok _ => IO.println "Blake3: 258 full hashes, 58 subtree splits, 42 chunks and 64 parent/Merkle cases match native"
+  | _ => throw (IO.userError "expected native Blake3 snapshot")
diff --git a/Tests/Aiur/BlockExpressions.lean b/Tests/Aiur/BlockExpressions.lean
new file mode 100644
index 000000000..035320f21
--- /dev/null
+++ b/Tests/Aiur/BlockExpressions.lean
@@ -0,0 +1,119 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.BlockLookups
+import Ix.Aiur.Proofs.BlockAllocation
+import Tests.Aiur.EmissionReader
+
+/-! Compare actual native control trees and full symbolic block emission,
+including incoming gates distinct from block entries and prior outer yields. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.OpEmitter Aiur.NativeAIR.Compiler
+open Aiur.NativeAIR.BlockEmitter AiurTests.EmissionReader
+
+namespace AiurTests.BlockExpressions
+
+private def readEvaluatedMap (size : Nat) : Reader (Array AIR.RowValue) := do
+  return (← readList size do return AIR.RowValue.mk (← readField) (← readNat) (← readBool)).toArray
+
+private def readReport (index : Nat) : Reader Nat := do
+  let label := s!"block {index}"
+  let branchless ← readBool
+  let context : Context := ⟨← readNat, ← readNat, ← readExpr 256⟩
+  let selectors := (← readList (← readCount) (readExpr 256)).toArray
+  let column ← readNat
+  let lookup ← readNat
+  let incoming ← readExpr 256
+  let inputs ← readMap
+  let block ← readBlock 64
+  let entry ← readExpr 256
+  unless blockSelector selectors block == some entry do throw s!"native block selector differs: {label}"
+  let some emitted := emitBlock selectors context incoming inputs column lookup block
+    | throw s!"symbolic block rejected native inputs: {label}"
+  unless (← readNat) == emitted.column && (← readNat) == emitted.lookup do
+    throw s!"native block cursors differ: {label}"
+  let nativeMap ← readMap
+  unless nativeMap == emitted.values do throw s!"native block value expressions or degrees differ: {label}"
+  let equations ← readList (← readCount 8192) (readExpr 256)
+  unless equations == emitted.equations do throw s!"native block constraint trees differ: {label}"
+  unless inputs.all (·.expr.noConstantNegs) && emitted.values.all (·.expr.noConstantNegs) do
+    throw s!"block lost the negation invariant: {label}"
+  unless inputs.all (fun row => row.degree != 0 || row.expr.isConstant) &&
+      emitted.values.all (fun row => row.degree != 0 || row.expr.isConstant) do
+    throw s!"block lost the degree-zero constant invariant: {label}"
+  let initial : Concrete.Bytecode.LayoutMState :=
+    ⟨{ inputSize := context.inputSize, selectors := 0, auxiliaries := column, lookups := lookup },
+      .empty, rowDegrees inputs⟩
+  let layout := ((Concrete.Bytecode.blockLayout block).run initial).2
+  unless rowDegrees nativeMap == layout.degrees && emitted.column == layout.functionLayout.auxiliaries do
+    throw s!"native block degrees or column allocation differs from compiler: {label}"
+  let lookupCount ← readCount 4096
+  unless lookupCount == emitted.lookup + 2 do throw "incomplete native lookup range"
+  let lookups ← readList lookupCount do
+    return ExprLookup.mk (← readExpr 256) (← readList (← readCount) (readExpr 256))
+  for (native, slot) in lookups.zipIdx do
+    unless native == BlockEmitter.lookup branchless emitted slot do
+      throw s!"native block lookup expression trees differ: {label}, slot {slot}"
+  let yields ← readList (← readCount) do
+    return YieldExpr.mk (← readExpr 256) (← readMap)
+  let expectedYields := [YieldExpr.mk (.konst 99) inputs, YieldExpr.mk (.konst 100) inputs] ++ emitted.yields
+  unless yields.map (fun part => (part.selector, part.values)) ==
+      expectedYields.map (fun part => (part.selector, part.values)) do
+    throw s!"native escaping yield expression trees differ: {label}"
+  let count ← readCount
+  unless count == 4 do throw "incomplete native block assignments"
+  for seed in [:count] do
+    let row := (← readList (← readCount 8192) readField).toArray
+    let values := assignment row
+    let outputValues ← readEvaluatedMap nativeMap.size
+    let equationValues ← readList equations.length readField
+    let some evaluated := emitted.eval values | throw s!"undefined block expression: {label}, assignment {seed}"
+    unless evaluated.values == outputValues && evaluated.equations == equationValues do
+      throw s!"native block expression values differ: {label}, assignment {seed}"
+    let some inputValues := evalRows values inputs | throw "undefined incoming block expressions"
+    let some selected := selectors.mapM (evalExpr values) | throw "undefined block selectors"
+    let some s := evalExpr values incoming | throw "undefined incoming gate"
+    let some rank := evalExpr values context.rank | throw "undefined rank"
+    let some valued := block.emitRow (fun index => row[index]?.getD 0) (selectorAt selected)
+        (context.valued rank) s inputValues column lookup
+      | throw s!"valued block rejected symbolic inputs: {label}"
+    unless sameBlockEmission evaluated valued do throw s!"symbolic/valued block differs: {label}, assignment {seed}"
+    for (native, slot) in lookups.zipIdx do
+      let weight ← readField
+      let message ← readList native.args.length readField
+      unless native.eval goldilocksOps values == some (weight, message) do
+        throw s!"native lookup values differ: {label}, slot {slot}, assignment {seed}"
+      let expected := if slot == 0 then
+          (0, AIR.slotMessage branchless (valued.returns.map fun part => (part.1, AIR.functionMessage part.2)))
+        else (AIR.querySlotMultiplicity valued.queries slot, AIR.slotMessage branchless (AIR.querySlotParts valued.queries slot))
+      unless (weight, message) == expected do throw s!"symbolic/valued lookup differs: {label}, slot {slot}"
+    for yielded in yields do
+      let gate ← readField
+      let outputs ← readEvaluatedMap yielded.values.size
+      unless yielded.eval values == some (gate, outputs) do throw s!"native yield values differ: {label}, assignment {seed}"
+  return count
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur block expressions v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "block snapshot version differs"
+  unless (← readCount) == 384 do throw "incomplete native control tree corpus"
+  let mut assignments := 0
+  for index in [:384] do assignments := assignments + (← readReport index)
+  unless assignments == 1536 do throw "incomplete native block coverage"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "block snapshot has trailing bytes"
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok _ => IO.println "block expressions: 384 native control trees and compiler allocations, 1,536 assignments match"
+
+end AiurTests.BlockExpressions
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.BlockExpressions.run path
+  | _ => throw (IO.userError "expected native block expression snapshot")
diff --git a/Tests/Aiur/BlockRows.lean b/Tests/Aiur/BlockRows.lean
new file mode 100644
index 000000000..a26d610bb
--- /dev/null
+++ b/Tests/Aiur/BlockRows.lean
@@ -0,0 +1,127 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.QuerySlotMessages
+
+open Aiur Aiur.AIR Aiur.Bytecode
+
+namespace AiurTests.BlockRows
+
+private def appendNat (out : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut out := out
+  for i in [:8] do
+    out := out.push ((value >>> (8 * i)) % 256).toUInt8
+  return out
+
+private def appendValues (out : ByteArray) (values : List G) : ByteArray :=
+  values.foldl (fun out value => appendNat out value.n) (appendNat out values.length)
+
+private def appendMap (out : ByteArray) (values : Array RowValue) : ByteArray :=
+  values.foldl (fun out value => appendNat (appendNat (appendNat out value.value.n)
+    value.degree) (if value.constant then 1 else 0)) (appendNat out values.size)
+
+private def blockOps (seed initial : Nat) : Array Op × Nat :=
+  let size := seed % 3
+  let pointer := initial + 3 + size
+  (#[.const (G.ofNat (seed + 17)), .mul 0 1,
+    .eqZero (if seed % 2 == 0 then initial else 0),
+    .call 17 #[0, initial] size false, .store #[0, initial + 1],
+    .load size pointer, .u8Add 0 1, .assertEq #[initial + 1] #[0] none],
+    initial + 6 + 2 * size)
+
+private def fixture (depth seed initial next : Nat) : Block × Nat :=
+  let (ops, count) := blockOps seed initial
+  let leaf := (⟨ops, if seed % 2 == 0 then .return next #[count - 2, count - 1]
+    else .yield next #[count - 2, count - 1]⟩, next + 1)
+  match depth with
+  | 0 => leaf
+  | depth + 1 =>
+    if seed % 5 == 0 then leaf else
+      let (left, next) := fixture depth (seed * 3 + 1) count next
+      let (right, next) := fixture depth (seed * 3 + 2) count next
+      let (fallback, next) := if seed % 2 == 0 then
+          let (block, next) := fixture depth (seed * 3 + 3) count next
+          (some block, next)
+        else (none, next)
+      let branches := #[(0, left), (1, right)]
+      let matched := if seed % 2 == 0 then initial else 0
+      if seed % 3 == 0 then (⟨ops, .match matched branches fallback⟩, next)
+      else
+        let (continuation, next) := fixture depth (seed * 3 + 4) (count + 2) next
+        (⟨ops, .matchContinue matched branches fallback 2 0 0 continuation⟩, next)
+
+private def assignment (pattern index count : Nat) : G :=
+  match pattern with
+  | 0 => 0
+  | 1 => 1
+  | 2 => 2
+  | 3 => 0 - 1
+  | 4 => G.ofNat (index + 1)
+  | 5 => 0 - G.ofNat (index + 1)
+  | 6 => if index % 2 == 0 then 1 else 0
+  | 7 => [0, 0 - 1, 1, 2][index % 4]?.getD 0
+  | pattern => if pattern < 8 + count then
+      (if index == pattern - 8 then 1 else 0)
+    else if index != pattern - 8 - count then 1 else 0
+
+private def row (seed pattern count index : Nat) : G :=
+  if 2 ≤ index ∧ index < 2 + count then assignment pattern (index - 2) count
+  else
+    let choices : List G := [0, 1, 0 - 1, 255, 256, G.ofNat (2^32), G.ofNat (2^48 - 1), 17]
+    choices[(seed + 5 * index) % 8]?.getD 0
+
+private def expected : Except String (ByteArray × Nat) := do
+  let mut out := appendNat "Aiur block rows v1\n".toUTF8 96
+  let mut checked := 0
+  for branchless in [false, true] do
+    for depth in [:4] do
+      for seed in [:12] do
+        let (block, count) := fixture depth seed 2 0
+        out := appendNat out count
+        out := appendNat out (8 + 2 * count)
+        for pattern in [:8 + 2 * count] do
+          let row := row seed pattern count
+          let selector := fun index => row (2 + index)
+          let values := #[RowValue.variable (row 0), RowValue.variable (row 1)]
+          let some emission := block.emitRow row selector ⟨37, 2, 257⟩
+              (block.selectorFlow selector).entry values (2 + count) 1
+            | throw s!"emission failed at depth {depth}, seed {seed}, pattern {pattern}"
+          out := appendNat out emission.column
+          out := appendNat out emission.lookup
+          out := appendMap out emission.values
+          out := appendValues out emission.equations
+          for slot in [:emission.lookup] do
+            let parts := if slot == 0 then emission.returns.map fun part =>
+                (part.1, functionMessage part.2)
+              else querySlotParts emission.queries slot
+            out := appendNat out (if slot == 0 then 0 else querySlotMultiplicity emission.queries slot).n
+            out := appendValues out (slotMessage branchless parts)
+          let yields := [(99, values), (100, values)] ++ emission.yields
+          out := appendNat out yields.length
+          for (gate, values) in yields do
+            out := appendNat out gate.n
+            out := appendMap out values
+          checked := checked + 1
+  return (out, checked)
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  let (expected, checked) ← match expected with
+    | .ok value => pure value
+    | .error error => throw (IO.userError error)
+  unless checked == 2028 do throw (IO.userError "incomplete block-row corpus")
+  unless native.size == expected.size do
+    throw (IO.userError s!"block-row snapshot size differs: {native.size} / {expected.size}")
+  for i in [:expected.size] do
+    unless native[i]! == expected[i]! do
+      throw (IO.userError s!"block-row mismatch at byte {i}: {native[i]!} / {expected[i]!}")
+  IO.println s!"block rows: {checked} native/Lean assignments with shared columns and slots match"
+
+end AiurTests.BlockRows
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.BlockRows.run path
+  | _ => throw (IO.userError "expected native block-row snapshot path")
diff --git a/Tests/Aiur/ByteGadgets.lean b/Tests/Aiur/ByteGadgets.lean
new file mode 100644
index 000000000..01aed8bd2
--- /dev/null
+++ b/Tests/Aiur/ByteGadgets.lean
@@ -0,0 +1,71 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ByteColumns
+
+/-! Exhaustive comparison with the actual Rust preprocessed byte-chip rows,
+lookup arguments and multiplicity columns. The component gate exports its
+native file into a temporary directory before running this comparison. -/
+
+open Aiur Aiur.AIR
+
+namespace Tests.Aiur.ByteGadgets
+
+private def appendNat (bytes : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut bytes := bytes
+  for index in [:8] do
+    bytes := bytes.push ((value >>> (8 * index)) % 256).toUInt8
+  return bytes
+
+private def appendValues (bytes : ByteArray) (values : List G) : ByteArray :=
+  values.foldl (fun bytes value => appendNat bytes value.n) bytes
+
+private def byte1Snapshot (bytes : ByteArray) : ByteArray := Id.run do
+  let mut bytes := appendNat (appendNat (appendNat bytes 256) 11) 3
+  for width in [10, 3, 3] do bytes := appendNat bytes width
+  for index in [:256] do
+    if h : index < 256 then
+      let row : Fin 256 := ⟨index, h⟩
+      bytes := appendValues bytes (byte1Preprocessed row).toList
+      for kind in Byte1Kind.all do
+        let (multiplicity, message) := byte1ColumnLookup kind (byte1PreprocessedColumns row)
+          (fun column => G.ofNat (column.val + 17))
+        bytes := appendNat bytes multiplicity.n
+        bytes := appendValues bytes message
+  return bytes
+
+private def byte2Snapshot (bytes : ByteArray) : ByteArray := Id.run do
+  let mut bytes := appendNat (appendNat (appendNat bytes 65536) 14) 10
+  for width in [4, 4, 4, 4, 4, 4, 3, 5, 5, 5] do bytes := appendNat bytes width
+  for index in [:65536] do
+    if h : index < 65536 then
+      let row : Fin 65536 := ⟨index, h⟩
+      bytes := appendValues bytes (byte2Preprocessed row).toList
+      for kind in Byte2Kind.all do
+        let (multiplicity, message) := byte2ColumnLookup kind (byte2PreprocessedColumns row)
+          (fun column => G.ofNat (column.val + 17))
+        bytes := appendNat bytes multiplicity.n
+        bytes := appendValues bytes message
+  return bytes
+
+private def expected : ByteArray :=
+  byte2Snapshot (byte1Snapshot "Aiur byte gadgets v1\n".toUTF8)
+
+def main (args : List String) : IO Unit := do
+  let [path] := args | throw (IO.userError "expected native byte-gadget snapshot path")
+  let native ← IO.FS.readBinFile path
+  let reference := expected
+  unless native == reference do
+    let mut first : Option Nat := none
+    for index in [:min native.size reference.size] do
+      if native[index]! != reference[index]! then
+        first := some index
+        break
+    throw (IO.userError s!"Byte gadget snapshot differs: native {native.size} bytes, reference {reference.size}; first mismatch {first}")
+  IO.println s!"Byte gadgets: all 65,792 rows, 656,128 lookup messages and multiplicity columns match ({native.size} bytes)."
+
+end Tests.Aiur.ByteGadgets
+
+def main := Tests.Aiur.ByteGadgets.main
diff --git a/Tests/Aiur/BytecodeCompare.lean b/Tests/Aiur/BytecodeCompare.lean
new file mode 100644
index 000000000..0633fc2e9
--- /dev/null
+++ b/Tests/Aiur/BytecodeCompare.lean
@@ -0,0 +1,70 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Stages.Bytecode
+
+/-! Native comparison/hash compatibility fixtures. The frozen output was
+captured from the original compiler derivations before making them total.
+Every operation constructor and all control forms occur, including nested
+branches, defaults, continuations and deliberately different metadata. -/
+
+open Aiur Aiur.Bytecode
+
+namespace Tests.Aiur.BytecodeCompare
+
+private def operations (n : Nat) : Array Op :=
+  let a := #[n, n + 1, n + 2, n + 3]
+  #[.const (G.ofNat n), .add n (n + 1), .sub n (n + 1), .mul n (n + 1),
+    .eqZero n, .call n a 4 false, .call n a 4 true, .call n #[] 0 false,
+    .store a, .load 4 n, .assertEq a a none, .assertEq a a (some "same fields"),
+    .ioGetInfo n a, .ioSetInfo n a n (n + 1), .ioRead n (n + 1) 4, .ioWrite n a,
+    .u8BitDecomposition n, .u8ShiftLeft n, .u8ShiftRight n,
+    .u8Xor n (n + 1), .u8Add n (n + 1), .u8Mul n (n + 1), .u8Sub n (n + 1),
+    .u8And n (n + 1), .u8Or n (n + 1), .u8LessThan n (n + 1), .u32LessThan n (n + 1),
+    .u8XorSplit7 n (n + 1), .u8XorSplit4 n (n + 1),
+    .debug "comparison fixture" none, .debug "comparison fixture" (some a),
+    .u8RangeCheck n (n + 1), .unconstrainedBigUintDivMod n (n + 1),
+    .unconstrainedGToBytes n, .unconstrainedGInverse n,
+    .unconstrainedU32Add a a.reverse, .unconstrainedU32Add3 a a.reverse a,
+    .u32ToField a]
+
+def fixtures : Array Block := Id.run do
+  let mut blocks := #[]
+  for n in #[0, 1, 255, 256, 65536] do
+    let ret : Block := ⟨#[], .return n #[n, n + 1]⟩
+    let yielded : Block := ⟨#[], .yield n #[n, n + 1]⟩
+    blocks := blocks ++ #[ret, yielded]
+    for op in operations n do
+      blocks := blocks.push ⟨#[op], ret.ctrl⟩
+    for fallback in #[none, some ret, some yielded] do
+      for branches in #[#[], #[(G.ofNat n, ret)], #[(G.ofNat n, ret), (G.ofNat (n + 1), yielded)]] do
+        blocks := blocks.push ⟨#[], .match n branches fallback⟩
+        for metadata in #[0, 1, 7] do
+          blocks := blocks.push ⟨#[], .matchContinue n branches fallback metadata
+            (n + metadata + 1) (2 * metadata + 3) ret⟩
+    -- Long shared prefixes and deep control trees exercise recursive calls
+    -- beyond the immediate constructor comparisons.
+    let mut nested := ret
+    for depth in [:24] do
+      nested := ⟨(operations n).extract 0 (depth % 8),
+        .matchContinue n #[(G.ofNat depth, nested)] (some yielded) 2 depth (depth + 1) ret⟩
+    blocks := blocks ++ #[nested, nested, ⟨(operations n).reverse, nested.ctrl⟩]
+  return blocks
+
+private def report (blocks : Array Block) : IO Unit := do
+  IO.println s!"BYTECODE COMPARISON FIXTURES {blocks.size}"
+  for h : i in [:blocks.size] do
+    let block := blocks[i]
+    unless block == block do throw (IO.userError s!"block comparison is not reflexive: {i}")
+    let mut equalIndices : Array Nat := #[]
+    for k : j in [:blocks.size] do
+      if block == blocks[j] then equalIndices := equalIndices.push j
+    IO.println s!"BLOCK {i} HASH {hash block} CONTROL {hash block.ctrl} EQUAL {equalIndices}"
+
+def main : IO Unit := report fixtures
+
+end Tests.Aiur.BytecodeCompare
+
+def main := Tests.Aiur.BytecodeCompare.main
diff --git a/Tests/Aiur/CircuitExpressions.lean b/Tests/Aiur/CircuitExpressions.lean
new file mode 100644
index 000000000..d4d232a7c
--- /dev/null
+++ b/Tests/Aiur/CircuitExpressions.lean
@@ -0,0 +1,121 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CheckedCircuit
+import Tests.Aiur.EmissionReader
+
+/-! Actual native function and circuit records drive both symbolic and valued
+emission. Check all frontend expression trees, physical slots, and metadata. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.OpEmitter Aiur.NativeAIR.Compiler
+open Aiur.NativeAIR.CircuitEmitter AiurTests.EmissionReader
+
+namespace AiurTests.CircuitExpressions
+
+private def readLayout : Reader Bytecode.FunctionLayout := do
+  return ⟨← readNat, ← readNat, ← readNat, ← readNat⟩
+
+private def sameMember (left right : AIR.MemberEmission) : Bool :=
+  left.functionIndex == right.functionIndex && left.selectorBase == right.selectorBase &&
+    left.function.layout == right.function.layout && left.function.entry == right.function.entry &&
+    left.function.constrained == right.function.constrained && sameBlockEmission left.body right.body
+
+private def sameEmission (left right : AIR.CircuitEmission) : Bool :=
+  left.members.length == right.members.length && (left.members.zip right.members).all (fun (a, b) => sameMember a b) &&
+    left.selector == right.selector && left.multiplicity == right.multiplicity &&
+    List.ofFn left.rankBytes == List.ofFn right.rankBytes &&
+    left.width == right.width && left.selectorStart == right.selectorStart && left.selectorCount == right.selectorCount &&
+    left.lookupCount == right.lookupCount && left.branchless == right.branchless && left.equations == right.equations &&
+    left.queries.map (fun part => (part.slot, part.selector, part.message)) ==
+      right.queries.map (fun part => (part.slot, part.selector, part.message)) && left.returns == right.returns
+
+private def readCircuit (program : Bytecode.Toplevel) (circuit : Bytecode.Circuit) (label : String) : Reader Nat := do
+  unless circuit.validateRowCounts program do throw s!"native circuit fails checked selector bounds: {label}"
+  unless 7 ≤ circuit.layout.auxiliaries && circuit.members.all (fun index =>
+      program.functions[index]!.layout.inputSize ≤ circuit.layout.inputSize &&
+      program.functions[index]!.layout.auxiliaries ≤ circuit.layout.auxiliaries) do
+    throw s!"native circuit fails compiler column bounds: {label}"
+  let some emitted := emitCircuit program circuit | throw s!"symbolic circuit rejected native inputs: {label}"
+  unless (← readBool) == emitted.branchless do throw s!"native circuit branchless decision differs: {label}"
+  unless (← readNat) == emitted.width && (← readNat) == emitted.selectorStart && (← readNat) == emitted.selectorCount do
+    throw s!"native circuit column layout differs: {label}"
+  unless emitted.readBound ≤ emitted.width do throw s!"circuit read premise exceeds native width: {label}"
+  let equations ← readList (← readCount 8192) (readExpr 256)
+  unless equations == emitted.equations do throw s!"native circuit constraint trees differ: {label}"
+  let lookups ← readList (← readCount 4096) do
+    return ExprLookup.mk (← readExpr 256) (← readList (← readCount) (readExpr 256))
+  unless lookups == emitted.lookups do throw s!"native circuit lookup trees differ: {label}"
+  let inactiveValues := zeroValues circuit.layout.width
+  let some inactive := emitted.eval inactiveValues
+    | throw s!"inactive circuit row has an undefined expression: {label}"
+  unless inactive.equations.all (· == 0) do throw s!"inactive circuit equation is nonzero: {label}"
+  let some compiled := compileCircuit (circuitWidths circuit) program circuit
+    | throw s!"base compilation rejected native circuit expressions: {label}"
+  let count ← readCount
+  unless count == 4 do throw "incomplete native circuit assignments"
+  for seed in [:count] do
+    let row := (← readList (← readCount 8192) readField).toArray
+    unless row.size == emitted.width do throw "native circuit assignment has wrong width"
+    let values := assignment row
+    let expectedEquations ← readList equations.length readField
+    let some evaluated := emitted.eval values | throw s!"undefined circuit expression: {label}, assignment {seed}"
+    unless evaluated.equations == expectedEquations do throw s!"native circuit values differ: {label}, assignment {seed}"
+    let some valued := circuit.emitRow (fun index => row[index]?.getD 0) program
+      | throw s!"valued circuit rejected symbolic inputs: {label}"
+    unless sameEmission evaluated valued do throw s!"symbolic/valued circuit differs: {label}, assignment {seed}"
+    let some buffer := compiled.base.graph.sweep goldilocksOps values
+      | throw s!"compiled circuit sweep is undefined: {label}"
+    let some graphLookups := compiled.base.graph.lookups.mapM (readLookup buffer)
+      | throw s!"compiled circuit lookup roots are undefined: {label}"
+    unless graphLookups == List.ofFn (fun slot : Fin valued.lookupCount => valued.lookup slot.val) do
+      throw s!"compiled circuit lookup meanings differ: {label}, assignment {seed}"
+    unless compiled.base.graph.zeros.all (fun root => buffer[root]? == some 0) == valued.equations.all (· == 0) do
+      throw s!"compiled circuit satisfaction differs: {label}, assignment {seed}"
+    for (lookup, slot) in lookups.zipIdx do
+      let weight ← readField
+      let message ← readList lookup.args.length readField
+      unless lookup.eval goldilocksOps values == some (weight, message) do
+        throw s!"native circuit lookup values differ: {label}, slot {slot}, assignment {seed}"
+      unless valued.lookup slot == (weight, message) do throw s!"symbolic/valued circuit lookup differs: {label}, slot {slot}"
+  return count
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur circuit expressions v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "circuit snapshot version differs"
+  unless (← readCount) == 12 do throw "incomplete native circuit programs"
+  let mut reports := 0
+  let mut assignments := 0
+  for seed in [:12] do
+    let functions := (← readList (← readCount) do
+      return Bytecode.Function.mk (← readBlock 64) (← readLayout) (← readBool) (← readBool)).toArray
+    let circuits := (← readList (← readCount) do
+      return Bytecode.Circuit.mk "native" (← readIndices) (← readLayout)).toArray
+    unless functions.size == 4 && circuits.size == 8 do throw "incomplete native circuit shapes"
+    for (function, index) in functions.toList.zipIdx do
+      let layout := ((Concrete.Bytecode.blockLayout function.body).run
+        (.new function.layout.inputSize)).2.functionLayout
+      unless function.layout == { layout with lookups := layout.lookups + 1 } do
+        throw s!"native function layout differs from compiler: program {seed}, function {index}"
+    let program : Bytecode.Toplevel := ⟨functions, #[], circuits⟩
+    unless program.validateEmission do throw s!"native program fails checked emission inputs: {seed}"
+    for (circuit, index) in circuits.toList.zipIdx do
+      assignments := assignments + (← readCircuit program circuit s!"program {seed}, circuit {index}")
+      reports := reports + 1
+  unless reports == 96 && assignments == 384 do throw "incomplete native circuit coverage"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "circuit snapshot has trailing bytes"
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok _ => IO.println "circuit expressions: 96 native circuit bounds, 48 compiler function layouts, 384 assignments and 96 inactive zero rows match"
+
+end AiurTests.CircuitExpressions
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.CircuitExpressions.run path
+  | _ => throw (IO.userError "expected native circuit expression snapshot")
diff --git a/Tests/Aiur/CircuitRows.lean b/Tests/Aiur/CircuitRows.lean
new file mode 100644
index 000000000..b55f08a14
--- /dev/null
+++ b/Tests/Aiur/CircuitRows.lean
@@ -0,0 +1,169 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CircuitRows
+import Ix.Aiur.RowCounts
+
+open Aiur Aiur.AIR Aiur.Bytecode
+
+namespace AiurTests.CircuitRows
+
+private def appendNat (out : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut out := out
+  for i in [:8] do
+    out := out.push ((value >>> (8 * i)) % 256).toUInt8
+  return out
+
+private def appendValues (out : ByteArray) (values : List G) : ByteArray :=
+  values.foldl (fun out value => appendNat out value.n) (appendNat out values.length)
+
+private def blockOps (seed initial : Nat) : Array Op × Nat :=
+  let size := seed % 3
+  let pointer := initial + 3 + size
+  (#[.const (G.ofNat (seed + 17)), .mul 0 1,
+    .eqZero (if seed % 2 == 0 then initial else 0),
+    .call 17 #[0, initial] size false, .store #[0, initial + 1],
+    .load size pointer, .u8Add 0 1, .assertEq #[initial + 1] #[0] none],
+    initial + 6 + 2 * size)
+
+private def fixture (depth seed initial next : Nat) : Block × Nat :=
+  let (ops, count) := blockOps seed initial
+  let leaf := (⟨ops, if seed % 2 == 0 then .return next #[count - 2, count - 1]
+    else .yield next #[count - 2, count - 1]⟩, next + 1)
+  match depth with
+  | 0 => leaf
+  | depth + 1 =>
+    if seed % 5 == 0 then leaf else
+      let (left, next) := fixture depth (seed * 3 + 1) count next
+      let (right, next) := fixture depth (seed * 3 + 2) count next
+      let (fallback, next) := if seed % 2 == 0 then
+          let (block, next) := fixture depth (seed * 3 + 3) count next
+          (some block, next)
+        else (none, next)
+      let branches := #[(0, left), (1, right)]
+      let matched := if seed % 2 == 0 then initial else 0
+      if seed % 3 == 0 then (⟨ops, .match matched branches fallback⟩, next)
+      else
+        let (continuation, next) := fixture depth (seed * 3 + 4) (count + 2) next
+        (⟨ops, .matchContinue matched branches fallback 2 0 0 continuation⟩, next)
+
+private def closeReturns (width : Nat) (escapes : Bool) : Nat → Block → Block
+  | 0, block => block
+  | fuel + 1, block => { block with ctrl := match block.ctrl with
+      | .return index outputs => .return index (outputs.extract 0 width)
+      | .yield index outputs => if escapes then .return index (outputs.extract 0 width) else .yield index outputs
+      | .match index branches fallback => .match index
+          (branches.map fun pair => (pair.1, closeReturns width escapes fuel pair.2))
+          (fallback.map (closeReturns width escapes fuel))
+      | .matchContinue index branches fallback size aux slots continuation => .matchContinue index
+          (branches.map fun pair => (pair.1, closeReturns width false fuel pair.2))
+          (fallback.map (closeReturns width false fuel)) size aux slots
+          (closeReturns width escapes fuel continuation) }
+
+private def fixtureFunction (seed index : Nat) : Except String Function := do
+  let inputSize := 2 + (seed + index) % 3
+  let depth := (seed + index) % 3
+  let (body, selectors) := fixture depth (seed * 4 + index) inputSize 0
+  let body := closeReturns (index % 3) true (depth + 1) body
+  let body := if seed % 4 == 0 && index == 0 then
+      { ops := #[], ctrl := .match 0 #[(0, { ops := #[.store #[]], ctrl := .match 0 #[] none }), (1, body)] none }
+    else body
+  let some measured := body.emitRow (fun _ => 0) (fun _ => 0) ⟨37, inputSize, 0⟩
+      (body.selectorFlow (fun _ => 0)).entry (rowAdvice (fun _ => 0) 0 inputSize)
+      (inputSize + selectors + 7) 4
+    | throw "fixture layout emission failed"
+  return ⟨body, ⟨inputSize, selectors, measured.column - inputSize - selectors, measured.lookup⟩, true, true⟩
+
+private def circuitLayout (functions : Array Function) (members : Array Nat) : Bytecode.FunctionLayout :=
+  members.foldl (fun layout index => match functions[index]? with
+    | none => layout
+    | some function => layout.merge function.layout) ⟨0, 0, 7, 4⟩
+
+private def groups : List (Array Nat) := [#[0], #[1], #[2], #[3], #[0, 1], #[2, 0, 3], #[3, 2, 1, 0], #[]]
+
+private def assignment (pattern index count : Nat) : G :=
+  match pattern with
+  | 0 => 0
+  | 1 => 1
+  | 2 => 2
+  | 3 => 0 - 1
+  | 4 => G.ofNat (index + 1)
+  | 5 => 0 - G.ofNat (index + 1)
+  | 6 => if index % 2 == 0 then 1 else 0
+  | 7 => [0, 0 - 1, 1, 2][index % 4]?.getD 0
+  | pattern => if pattern < 8 + count then
+      (if index == pattern - 8 then 1 else 0)
+    else if index != pattern - 8 - count then 1 else 0
+
+private def row (seed pattern start count index : Nat) : G :=
+  if start ≤ index ∧ index < start + count then assignment pattern (index - start) count
+  else
+    let choices : List G := [0, 1, 0 - 1, 255, 256, G.ofNat (2^32), G.ofNat (2^48 - 1), 17]
+    choices[(seed + 5 * index + 3 * pattern) % 8]?.getD 0
+
+private def expected : Except String (ByteArray × Nat) := do
+  let mut out := appendNat "Aiur circuit rows v3\n".toUTF8 96
+  let mut checked := 0
+  for seed in [:12] do
+    let functions ← (List.range 4).mapM (fixtureFunction seed)
+    let functions := functions.toArray
+    let circuits := groups.map fun members => Circuit.mk "fixture" members (circuitLayout functions members)
+    let top : Toplevel := ⟨functions, #[], circuits.toArray⟩
+    for function in functions do
+      let counts := function.body.controlCounts
+      unless counts.leaves == function.layout.selectors do throw "leaf allocation differs"
+      for count in [counts.nodes, counts.leaves, counts.returns, counts.yields] do
+        out := appendNat out count
+    unless top.validateRowCounts do throw "circuit count validation failed"
+    out := out.push (if top.validateRowCounts then 1 else 0)
+    for circuit in circuits do
+      let layout := circuit.layout
+      for limit in [0, layout.selectors - 1, layout.selectors, layout.selectors + 1] do
+        let variant := { circuit with layout := { layout with selectors := limit } }
+        out := out.push (if variant.validateRowCounts top then 1 else 0)
+      let missing := { circuit with members := circuit.members.push functions.size }
+      unless !missing.validateRowCounts top do throw "missing circuit member accepted"
+      out := out.push (if missing.validateRowCounts top then 1 else 0)
+      let doubled := { circuit with members := circuit.members ++ circuit.members }
+      out := out.push (if doubled.validateRowCounts top then 1 else 0)
+      let branchless := circuitBranchless layout.selectors
+        (circuit.members.toList.filterMap fun index => functions[index]?)
+      out := out.push (if branchless then 1 else 0)
+      out := appendNat out layout.width
+      out := appendNat out layout.inputSize
+      out := appendNat out layout.selectors
+      out := appendNat out layout.lookups
+      out := appendNat out (8 + 2 * layout.selectors)
+      for pattern in [:8 + 2 * layout.selectors] do
+        let row := row seed pattern layout.inputSize layout.selectors
+        let some emission := circuit.emitRow row top | throw "circuit emission failed"
+        unless emission.branchless == branchless do throw "branchless selection differs"
+        out := appendValues out emission.equations
+        for slot in [:layout.lookups] do
+          let (multiplicity, message) := emission.lookup slot
+          out := appendNat out multiplicity.n
+          out := appendValues out message
+        checked := checked + 1
+  return (out, checked)
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  let (expected, checked) ← match expected with
+    | .ok value => pure value
+    | .error error => throw (IO.userError error)
+  unless checked == 2022 do throw (IO.userError "incomplete circuit-row corpus")
+  unless native.size == expected.size do
+    throw (IO.userError s!"circuit-row snapshot size differs: {native.size} / {expected.size}")
+  for i in [:expected.size] do
+    unless native[i]! == expected[i]! do
+      throw (IO.userError s!"circuit-row mismatch at byte {i}: {native[i]!} / {expected[i]!}")
+  IO.println s!"circuit rows: {checked} native/Lean assignments, 48 control counts, 588 count checks and 96 branchless decisions match"
+
+end AiurTests.CircuitRows
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.CircuitRows.run path
+  | _ => throw (IO.userError "expected native circuit-row snapshot path")
diff --git a/Tests/Aiur/CompiledKey.lean b/Tests/Aiur/CompiledKey.lean
new file mode 100644
index 000000000..53c9b777c
--- /dev/null
+++ b/Tests/Aiur/CompiledKey.lean
@@ -0,0 +1,154 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CompiledKey
+import Tests.Aiur.EmissionReader
+
+/-! Compare complete native keys and wide matrix assignments with the checked
+compiler and physical row models. Structurally valid altered keys must fail
+the executable circuit-binding check. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.Compiler Aiur.NativeAIR.CircuitEmitter
+open AiurTests.EmissionReader
+
+namespace AiurTests.CompiledKeys
+
+private def readLayout : Reader Bytecode.FunctionLayout := do
+  return ⟨← readNat, ← readNat, ← readNat, ← readNat⟩
+
+private def readColumns (width : Nat) : Reader (Array G) := do
+  let columns := (← readList (← readCount 65536) readField).toArray
+  unless columns.size == width do throw "native key matrix width differs"
+  return columns
+
+private def readValues (widths : GraphWidths) : Reader (Values G) := do
+  let pre ← readColumns widths.preprocessed
+  let preNext ← readColumns widths.preprocessed
+  let main ← readColumns widths.main
+  let mainNext ← readColumns widths.main
+  let stage2 ← readColumns widths.stage2
+  let stage2Next ← readColumns widths.stage2
+  let publics ← readColumns widths.publics
+  return {
+    columns := fun source offset => match source, offset with
+      | .preprocessed, .current => pre | .preprocessed, .next => preNext
+      | .main, .current => main | .main, .next => mainNext
+      | .stage2, .current => stage2 | .stage2, .next => stage2Next
+    publics, isFirstRow := ← readField, isLastRow := ← readField, isTransition := ← readField }
+
+private def readCircuit (program : Bytecode.Toplevel) (index : Nat) (artifact : KeyCodec.Circuit) : Reader Nat := do
+  unless (← readCount) == 4 do throw "incomplete native key assignments"
+  for seed in [:4] do
+    let label := s!"circuit {index}, assignment {seed}"
+    let values ← readValues artifact.widths
+    let equations ← readList (← readCount 65536) readField
+    let lookups ← readList (← readCount 65536) do
+      return (← readField, ← readList (← readCount 65536) readField)
+    let some buffer := artifact.graph.sweep goldilocksOps values | throw s!"undefined native graph: {label}"
+    unless artifact.graph.zeros.all (fun root => buffer[root]? == some 0) == equations.all (· == 0) do
+      throw s!"native key graph satisfaction differs: {label}"
+    unless artifact.graph.lookups.mapM (readLookup buffer) == some lookups do
+      throw s!"native key graph lookup values differ: {label}"
+    if index < program.circuits.size then
+      let source := program.circuits[index]!
+      let some symbolic := compileCircuit artifact.widths program source
+        | throw s!"compilation at native widths rejected: {label}"
+      unless symbolic.base.graph == artifact.graph do throw s!"widened graph differs: {label}"
+      let some emission := source.emitRow (fun column => (values.columns .main .current)[column]?.getD 0) program
+        | throw s!"native key function row rejected: {label}"
+      unless emission.equations == equations &&
+          List.ofFn (fun slot : Fin emission.lookupCount => emission.lookup slot.val) == lookups do
+        throw s!"native key function meaning differs: {label}"
+    else if index < program.circuits.size + program.memorySizes.size then
+      let width := program.memorySizes[index - program.circuits.size]!
+      let current := CompiledKey.columns values .main .current (3 + width)
+      let next := CompiledKey.columns values .main .next (3 + width)
+      unless AIR.memoryColumnEquations width current next values.isTransition == equations &&
+          [AIR.memoryColumnLookup width current] == lookups do
+        throw s!"native key memory meaning differs: {label}"
+    else if index == program.circuits.size + program.memorySizes.size then
+      unless equations.isEmpty && lookups == (AIR.Byte1Kind.all.map fun kind => AIR.byte1ColumnLookup kind
+          (CompiledKey.columns values .preprocessed .current 11) (CompiledKey.columns values .main .current 3)) do
+        throw s!"native key byte1 meaning differs: {label}"
+    else
+      unless equations.isEmpty && lookups == (AIR.Byte2Kind.all.map fun kind => AIR.byte2ColumnLookup kind
+          (CompiledKey.columns values .preprocessed .current 14) (CompiledKey.columns values .main .current 10)) do
+        throw s!"native key byte2 meaning differs: {label}"
+  return 4
+
+private def rejectAltered (program : Bytecode.Toplevel) (original altered : KeyCodec.Key) (label : String) : Reader Unit := do
+  unless altered != original do throw s!"ineffective altered-key case: {label}"
+  unless KeyCodec.decodeCanonical (KeyCodec.encode altered) == some altered do
+    throw s!"altered key must retain valid canonical syntax: {label}"
+  if CompiledKey.check program altered then throw s!"altered native key accepted: {label}"
+
+private def alterations (program : Bytecode.Toplevel) (key : KeyCodec.Key) : Reader Nat := do
+  let some first := key.circuits.head? | throw "missing native function circuit"
+  let some lookup := first.graph.lookups.head? | throw "missing native function lookup"
+  let changedCircuits : List (String × KeyCodec.Circuit) := [
+    ("unused node", { first with graph.nodes := first.graph.nodes ++ [.konst 17] }),
+    ("missing constraint", { first with graph.zeros := first.graph.zeros.drop 1 }),
+    ("extra constraint", { first with graph := { first.graph with
+      nodes := first.graph.nodes ++ [.konst 0], zeros := first.graph.zeros ++ [first.graph.nodes.length] } }),
+    ("missing lookup", { first with graph.lookups := first.graph.lookups.drop 1 }),
+    ("zeroed provider", { first with graph := { first.graph with
+      nodes := first.graph.nodes ++ [.konst 0],
+      lookups := first.graph.lookups.set 0 { lookup with multiplicity := first.graph.nodes.length } } }),
+    ("extended message", { first with graph.lookups := first.graph.lookups.set 0 { lookup with args := lookup.args ++ [lookup.multiplicity] } }),
+    ("main width", { first with mainWidth := first.mainWidth + 1 }),
+    ("preprocessed width", { first with preprocessedWidth := first.preprocessedWidth + 1 }),
+    ("preprocessed height", { first with preprocessedHeight := first.preprocessedHeight + 1 }),
+    ("lookup grouping", { first with lookupGroupSize := if first.lookupGroupSize == 1 then 2 else 1 })]
+  for (label, raw) in changedCircuits do
+    let some degree := raw.computedDegree | throw s!"undefined altered graph degree: {label}"
+    let circuit := { raw with maxConstraintDegree := degree }
+    rejectAltered program key { key with circuits := key.circuits.set 0 circuit } label
+  rejectAltered program key { key with circuits := key.circuits.reverse, preprocessedIndices := key.preprocessedIndices.reverse } "reversed circuit order"
+  rejectAltered program key { key with circuits := first :: key.circuits, preprocessedIndices := none :: key.preprocessedIndices } "extra circuit"
+  rejectAltered program key { key with circuits := key.circuits.tail, preprocessedIndices := key.preprocessedIndices.tail } "missing circuit"
+  rejectAltered program key { key with preprocessedIndices := key.preprocessedIndices.set 0 (some 0) } "preprocessed index"
+  return changedCircuits.length + 4
+
+private def readCorpus : Reader (Nat × Nat × Nat) := do
+  let header := "Aiur compiled keys v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "compiled-key snapshot version differs"
+  unless (← readCount) == 12 do throw "incomplete native key systems"
+  let mut circuitCount := 0
+  let mut assignments := 0
+  let mut rejections := 0
+  for seed in [:12] do
+    let functions := (← readList (← readCount) do
+      return Bytecode.Function.mk (← readBlock 64) (← readLayout) (← readBool) (← readBool)).toArray
+    let circuits := (← readList (← readCount) do
+      return Bytecode.Circuit.mk "native" (← readIndices) (← readLayout)).toArray
+    let memorySizes ← readIndices
+    let program : Bytecode.Toplevel := ⟨functions, memorySizes, circuits⟩
+    let bytes ← takeBytes (← readCount 1048576)
+    let some key := KeyCodec.decodeCanonical bytes | throw s!"native key rejected: system {seed}"
+    unless CompiledKey.check program key do throw s!"native key differs from compiled program: system {seed}"
+    unless functions.size == 4 && circuits.size == 8 && memorySizes == #[0, 1, 2, 4, 8] && key.circuits.length == 15 do
+      throw "incomplete native key circuit families"
+    for (artifact, index) in key.circuits.zipIdx do
+      assignments := assignments + (← readCircuit program index artifact)
+      circuitCount := circuitCount + 1
+    rejections := rejections + (← alterations program key)
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "compiled-key snapshot has trailing bytes"
+  return (circuitCount, assignments, rejections)
+
+def run (path : System.FilePath) : IO Unit := do
+  match readCorpus.run (← IO.FS.readBinFile path, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((circuits, assignments, rejections), _) =>
+    unless circuits == 180 && assignments == 720 && rejections == 168 do
+      throw (IO.userError "incomplete native key coverage")
+    IO.println s!"compiled keys: 12 native systems, {circuits} circuits, {assignments} assignments match; {rejections} valid altered keys rejected"
+
+end AiurTests.CompiledKeys
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.CompiledKeys.run path
+  | _ => throw (IO.userError "expected native compiled-key snapshot")
diff --git a/Tests/Aiur/ConstantDegree.lean b/Tests/Aiur/ConstantDegree.lean
new file mode 100644
index 000000000..2f32c28a3
--- /dev/null
+++ b/Tests/Aiur/ConstantDegree.lean
@@ -0,0 +1,65 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur
+
+/-! Source-to-proof regressions for constants produced by expression folding
+whose conservative compiler degree remains positive. -/
+
+open Aiur
+
+namespace AiurTests.ConstantDegree
+
+def source := ⟦
+  fn zero_left(x: G) -> G { eq_zero(0 * x) }
+  fn zero_right(x: G) -> G { eq_zero(x * 0) }
+  fn shifted_one(x: G) -> G { eq_zero(0 * x + 1) }
+  fn negated_zero(x: G) -> G { eq_zero(0 - 0 * x) }
+  fn nested_zero(x: G) -> G { eq_zero(eq_zero(0 * x)) }
+  fn following_mul(x: G) -> G { eq_zero(0 * x) * x }
+  pub fn check(x: G) -> [G; 6] {
+    [zero_left(x), zero_right(x), shifted_one(x), negated_zero(x), nested_zero(x), following_mul(x)]
+  }
+⟧
+
+def run : IO Unit := do
+  let decls ← IO.ofExcept (source.mkDecls.mapError toString)
+  let compiled ← IO.ofExcept source.compile
+  let cp : CommitmentParameters := { logBlowup := 1, capHeight := 0 }
+  let fp : FriParameters := {
+    logFinalPolyLen := 0, maxLogArity := 1, numQueries := 64,
+    commitProofOfWorkBits := 0, queryProofOfWorkBits := 0 }
+  let grouped ← IO.ofExcept (compiled.groupFunctions #[
+    ("zeroes", #["zero_left", "zero_right"]),
+    ("shifted", #["shifted_one", "negated_zero"])])
+  let mut accepted := 0
+  let mut rejected := 0
+  for program in [compiled, grouped] do
+    let some index := program.getFuncIdx `check | throw (IO.userError "missing constant-degree entry")
+    for input in ([0, 1, 17, 0 - 1] : List Aiur.G) do
+      let expected : Array Aiur.G := #[1, 1, 0, 1, 0, input]
+      let (sourceValue, sourceIo) ← IO.ofExcept
+        ((Source.Eval.runFunction decls (Global.init "check") [.field input] default 100).mapError reprStr)
+      unless flattenValue decls (fun _ => none) sourceValue == expected && sourceIo == default do
+        throw (IO.userError "constant-degree source reference differs")
+      let (reference, _) ← IO.ofExcept
+        ((Bytecode.Eval.runFunction program.bytecode index #[input] default 100).mapError reprStr)
+      let (native, _, _) ← IO.ofExcept (program.bytecode.execute index #[input] default)
+      unless reference == expected && native == expected do throw (IO.userError "constant-degree execution differs")
+      IO.println s!"constant-degree reference/execution match for input {input}"
+      let system := AiurSystem.build program.bytecode cp fp
+      let (claim, proof, _) ← IO.ofExcept (system.prove index #[input] default)
+      unless claim == buildClaim index #[input] expected do throw (IO.userError "constant-degree proof claim differs")
+      IO.ofExcept (system.verify claim proof)
+      accepted := accepted + 1
+      match system.verify (buildClaim index #[input] (expected.set! 0 0)) proof with
+      | .error _ => rejected := rejected + 1
+      | .ok _ => throw (IO.userError "changed constant-degree output accepted")
+  unless accepted == 8 && rejected == 8 do throw (IO.userError "incomplete constant-degree proof corpus")
+  IO.println s!"constant degree: {accepted} honest proofs, {rejected} changed-output rejections"
+
+end AiurTests.ConstantDegree
+
+def main : IO Unit := AiurTests.ConstantDegree.run
diff --git a/Tests/Aiur/Dedup.lean b/Tests/Aiur/Dedup.lean
new file mode 100644
index 000000000..02a9b5a2f
--- /dev/null
+++ b/Tests/Aiur/Dedup.lean
@@ -0,0 +1,111 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Aiur.DedupFixtures
+import Ix.Aiur.Semantics.BytecodeEval
+
+namespace AiurTests.Dedup
+
+open Aiur Aiur.Bytecode
+
+/-- Full syntax and index maps captured before adding checked renaming. -/
+def snapshot : IO Unit := do
+  for (name, source) in fixtures do
+    let (target, rename) := source.deduplicate
+    IO.println s!"PROGRAM {name} FUNCTIONS {source.functions.size} -> {target.functions.size}"
+    IO.println s!"RENAME {(Array.range (source.functions.size + 3)).map rename}"
+    IO.println s!"MEMORY {target.memorySizes}"
+    for i in [:target.functions.size] do
+      IO.println s!"FUNCTION {i} {repr target.functions[i]!}"
+
+private def checkRejected (label : String) (source candidate : Toplevel)
+    (rename : FunIdx → FunIdx) : IO Unit := do
+  if validatesRenaming source candidate (boundedRenaming source rename) then
+    throw (IO.userError s!"invalid deduplication accepted: {label}")
+  let (selected, actualRename) := checkedRenaming source candidate rename
+  unless reprStr selected == reprStr source do
+    throw (IO.userError s!"fallback changed the original program: {label}")
+  for i in [:source.functions.size + 3] do
+    unless actualRename i == i do
+      throw (IO.userError s!"fallback changed function index {i}: {label}")
+  IO.println s!"PASS {label}: rejected and original program retained"
+
+private def checkExecution (label : String) (source : Toplevel) (args expected : Array G)
+    (fuel : Nat) (initial final : IOBuffer) : IO Unit := do
+  let (target, rename) := source.deduplicate
+  unless target.functions.size < source.functions.size do
+    throw (IO.userError s!"execution fixture did not merge functions: {label}")
+  for (program, function) in #[(source, 0), (target, rename 0)] do
+    match Eval.runFunction program function args initial fuel with
+    | .error error => throw (IO.userError s!"{label}: {repr error}")
+    | .ok (output, io) =>
+      unless output == expected && io == final do
+        throw (IO.userError s!"execution or final I/O changed: {label}")
+  IO.println s!"PASS {label}: original and merged execution agree"
+
+/-- The caller loads memory created by a merged callee, then appends to its
+I/O output. Pre-existing arena contents and key information must survive. -/
+private def stateful : Toplevel :=
+  let worker : Function := ⟨⟨#[.const 0, .store #[0], .load 1 2, .ioWrite 1 #[3]],
+    .return 0 #[2, 3]⟩, layout 1, false, false⟩
+  let main (target : Nat) : Function := ⟨⟨#[.const 7, .call target #[0] 2 false,
+    .load 1 1, .const 0, .ioWrite 4 #[3]], .return 0 #[2, 3]⟩, layout, true, false⟩
+  program #[main 2, main 3, worker, worker]
+
+def run : IO Unit := do
+  for (name, source) in fixtures do
+    let (candidate, rename) := source.deduplicateCandidate
+    unless validatesRenaming source candidate (boundedRenaming source rename) do
+      throw (IO.userError s!"original partition candidate declined: {name}")
+  IO.println s!"PASS {fixtures.size} original partition candidates: accepted"
+
+  let base := constant 7 true
+  let source := program #[base, base, base]
+  let variants : Array (String × Function) := #[
+    ("changed-constant", constant 8 true),
+    ("changed-return-value", { base with body := { base.body with ctrl := .return 0 #[1] } }),
+    ("changed-return-selector", { base with body := { base.body with ctrl := .return 1 #[0] } }),
+    ("changed-input-arity", { base with layout := layout 1 }),
+    ("changed-selector-layout", { base with layout := { layout with selectors := 3 } }),
+    ("changed-auxiliary-layout", { base with layout := { layout with auxiliaries := 9 } }),
+    ("changed-lookup-layout", { base with layout := { layout with lookups := 6 } })]
+  for (label, changed) in variants do
+    checkRejected label source (program #[changed]) (fun _ => 0)
+  checkRejected "missing-target" source (program #[]) (fun _ => 0)
+  checkRejected "invalid-call-domain-expanded" source (program #[base, base, base, base]) (fun _ => 0)
+  checkRejected "out-of-range-target" source (program #[base]) (fun _ => 1)
+
+  let (candidate, rename) := withContinuations.deduplicateCandidate
+  let original := candidate.functions[0]!
+  let .matchContinue idx branches fallback out aux lookups cont := original.body.ctrl
+    | throw (IO.userError "continuation fixture changed")
+  let mutations : Array (String × Ctrl) := #[
+    ("changed-call-target", .matchContinue idx branches fallback out aux lookups
+      { cont with ops := #[.call 0 #[2] 1 false] }),
+    ("changed-call-arguments", .matchContinue idx branches fallback out aux lookups
+      { cont with ops := #[.call 1 #[] 1 false] }),
+    ("changed-call-output-size", .matchContinue idx branches fallback out aux lookups
+      { cont with ops := #[.call 1 #[2] 2 false] }),
+    ("removed-early-return", .matchContinue idx branches none out aux lookups cont)]
+  for (label, ctrl) in mutations do
+    checkRejected label withContinuations
+      { candidate with functions := candidate.functions.set! 0 { original with body := { original.body with ctrl } } }
+      rename
+
+  checkExecution "yield-to-continuation" withContinuations #[0] #[7] 1 default default
+  checkExecution "early-return-skips-continuation" withContinuations #[5] #[5] 0 default default
+  let initial := (default : IOBuffer).extend 0 #[42] #[99]
+  let final := { initial with data := initial.data.insert 0 #[99, 7, 7] }
+  checkExecution "callee-memory-and-io" stateful #[] #[7, 7] 1 initial final
+  checkExecution "merged-public-entry" source #[] #[7] 0 default default
+  IO.println s!"deduplication: {fixtures.size} accepted candidates, {variants.size + 3 + mutations.size} rejected candidates, 4 execution cases"
+
+end AiurTests.Dedup
+
+def main (args : List String) : IO Unit :=
+  match args with
+  | [] => AiurTests.Dedup.run
+  | ["--snapshot"] => AiurTests.Dedup.snapshot
+  | _ => throw (IO.userError "usage: aiur-dedup-tests [--snapshot]")
diff --git a/Tests/Aiur/DedupFixtures.lean b/Tests/Aiur/DedupFixtures.lean
new file mode 100644
index 000000000..7955bffce
--- /dev/null
+++ b/Tests/Aiur/DedupFixtures.lean
@@ -0,0 +1,59 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Compiler.Dedup
+
+namespace AiurTests.Dedup
+
+open Aiur Aiur.Bytecode
+
+def layout (inputs : Nat := 0) : FunctionLayout := ⟨inputs, 2, 8, 5⟩
+
+def constant (n : Nat) (entry : Bool := false) : Function :=
+  ⟨⟨#[.const (G.ofNat n)], .return 0 #[0]⟩, layout, entry, false⟩
+
+def caller (target : Nat) (entry : Bool := false) : Function :=
+  ⟨⟨#[.call target #[] 1 false], .return 0 #[0]⟩, layout, entry, false⟩
+
+def program (functions : Array Function) : Toplevel := ⟨functions, #[1, 2, 10], #[]⟩
+
+/-- Two recursive functions form the same bisimulation class. Neither has
+a finite successful execution; validation must still handle this syntax. -/
+def mutualCycle : Toplevel := program #[caller 1 true, caller 0]
+
+/-- A leaf difference propagates through successive refinement rounds. -/
+def chains (depth : Nat) : Toplevel := Id.run do
+  let mut functions := #[]
+  for i in [:depth] do
+    functions := functions ++ #[caller (2 * i + 2) (i == 0), caller (2 * i + 3) (i == 0)]
+  return program (functions ++ #[constant 7, constant 9])
+
+def continuation (target : Nat) (entry : Bool) : Function :=
+  let yielded : Block := ⟨#[], .yield 0 #[1]⟩
+  let returned : Block := ⟨#[], .return 0 #[0]⟩
+  let cont : Block := ⟨#[.call target #[2] 1 false], .return 0 #[3]⟩
+  ⟨⟨#[.const 7], .matchContinue 0 #[(0, yielded)] (some returned) 1 3 2 cont⟩,
+    layout 1, entry, false⟩
+
+/-- Zero takes a yielding arm and calls the continuation. Nonzero returns
+from the function directly and must bypass that continuation. -/
+def withContinuations : Toplevel :=
+  let identity : Function := ⟨⟨#[], .return 0 #[0]⟩, layout 1, false, false⟩
+  program #[continuation 2 true, continuation 3 false, identity, identity]
+
+def fixtures : Array (String × Toplevel) := Id.run do
+  let same := constant 7
+  let mut cases := #[
+    ("empty", program #[]),
+    ("entry-union", program #[same, constant 7 true, same]),
+    ("different-layouts", program #[same, { same with layout := layout 1 },
+      { same with layout := { layout with auxiliaries := 9 } }]),
+    ("mutual-cycle", mutualCycle),
+    ("invalid-callee", program #[caller 999 true, caller 999]),
+    ("continuations", withContinuations)]
+  for depth in [:17] do cases := cases.push (s!"refinement-chain-{depth}", chains depth)
+  return cases
+
+end AiurTests.Dedup
diff --git a/Tests/Aiur/Domain.lean b/Tests/Aiur/Domain.lean
new file mode 100644
index 000000000..68c0eb3ef
--- /dev/null
+++ b/Tests/Aiur/Domain.lean
@@ -0,0 +1,135 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.DomainAccumulator
+import Ix.Aiur.Proofs.Quotient
+import Tests.Aiur.EmissionReader
+
+/-! Native domain selectors for every supported logarithm, complete small
+cosets, and the quotient arithmetic with both accepting and rejecting cases.
+The native domain methods are called directly; quotient fixtures reproduce
+the verifier's private iterator expression using native basis and field APIs.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.Domain
+
+private def readExtension : Reader Extension := do return ⟨← readField, ← readField⟩
+
+private def readSelectors : Reader (NativeAIR.Domain.Selectors Extension) := do
+  return ⟨← readExtension, ← readExtension, ← readExtension, ← readExtension⟩
+
+private def readVector : Reader (List Extension) := do readList (← readCount) readExtension
+
+private def readDomain (bits : Nat) : Reader NativeAIR.Domain.Subgroup := do
+  unless (← readNat) == bits do throw "domain logarithm order differs"
+  let some domain := NativeAIR.Domain.ofLogSize bits | throw "unsupported domain logarithm"
+  return domain
+
+private def readDomains : Reader (Nat × Nat × Nat) := do
+  let header := "Aiur trace domains v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "domain snapshot version differs"
+  unless (← readNat) == 33 do throw "incomplete domain inventory"
+  let mut rows := 0
+  let mut accepted := 0
+  let mut rejected := 0
+  for bits in [:33] do
+    let domain ← readDomain bits
+    let n := NativeAIR.Domain.size domain
+    unless (← readNat) == n do throw "native domain size differs"
+    unless (← readField) == NativeAIR.Domain.generator domain do throw "native domain generator differs"
+    unless (← readField) == NativeAIR.Domain.lastPoint domain do throw "native last point differs"
+    unless (← readField) == NativeAIR.Domain.normalizer domain do throw "native normalizer differs"
+    unless (← readField) == (NativeAIR.Domain.normalizer domain).inverse do throw "native inverse normalizer differs"
+    let indices := (List.range (min n 16) ++ [n / 2, n - 1, n - 2] ++
+      (List.range 16).map fun seed => seed * 0x0a3751c9 % n).mergeSort (· ≤ ·) |>.eraseDups
+    unless (← readNat) == indices.length do throw "incomplete domain row samples"
+    for index in indices do
+      unless (← readNat) == index do throw "native row index differs"
+      let fin : Fin n ← if bounded : index < n then pure ⟨index, bounded⟩ else throw "native row index out of bounds"
+      let point := NativeAIR.Domain.point domain fin
+      unless (← readField) == point do throw "native row point differs"
+      unless (← readExtension) == Extension.ofBase (point * NativeAIR.Domain.generator domain) do
+        throw "native next point differs"
+      unless NativeAIR.Domain.selectors domain (Extension.ofBase point) == none do throw "trace row pole accepted"
+      rows := rows + 1
+    unless (← readNat) == 64 do throw "incomplete selector assignments"
+    for _ in [:64] do
+      let point ← readExtension
+      unless (← readExtension) == NativeAIR.Domain.vanishing domain point do throw "native vanishing polynomial differs"
+      let defined ← readBool
+      let expected ← if defined then some <$> readSelectors else pure none
+      unless NativeAIR.Domain.selectors domain point == expected do throw "native point selectors differ"
+      if defined then accepted := accepted + 1 else rejected := rejected + 1
+  unless (← readNat) == 9 do throw "incomplete bulk selector domains"
+  for bits in [:9] do
+    let domain ← readDomain bits
+    let n := NativeAIR.Domain.size domain
+    unless (← readNat) == n do throw "bulk selector count differs"
+    for _ in [:n] do
+      let point ← readField
+      let expected ← readSelectors
+      unless NativeAIR.Domain.selectors domain (Extension.ofBase point) == some expected do
+        throw "native bulk selectors differ"
+  for invalid in [33, 64, 255, 256, 2^64 - 1] do
+    unless (NativeAIR.Domain.ofLogSize invalid).isNone do throw "invalid domain logarithm accepted"
+  return (rows, accepted, rejected)
+
+private def readQuotients : Reader (Nat × Nat) := do
+  let header := "Aiur quotient arithmetic v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "quotient snapshot version differs"
+  unless (← readNat) == 704 do throw "incomplete quotient inventory"
+  let mut accepted := 0
+  let mut rejected := 0
+  for bits in [0, 1, 2, 4, 8, 16, 31, 32] do
+    for count in [0, 1, 2, 3, 4, 7, 8, 9, 16, 31, 32] do
+      for seed in [:8] do
+        let domain ← readDomain bits
+        unless (← readNat) == count && (← readNat) == seed do throw "quotient assignment order differs"
+        let point ← readExtension
+        let alpha ← readExtension
+        let constraints ← readVector
+        let row ← readVector
+        unless constraints.length == count && row.length == 2 * count do throw "quotient case dimensions differ"
+        unless (← readExtension) == Quotient.composition alpha constraints do throw "native constraint fold differs"
+        let expected ← readExtension
+        unless Quotient.evaluate domain point row == some expected do throw "native quotient recombination differs"
+        let expectedAcceptance ← readBool
+        unless Quotient.check domain point alpha constraints row == some expectedAcceptance do
+          throw "native out-of-domain arithmetic check differs"
+        unless Quotient.check domain point alpha constraints (row ++ [0]) == none do throw "odd quotient row accepted"
+        unless Quotient.check domain 1 alpha constraints row == none do throw "first-row pole accepted"
+        unless Quotient.check domain (Extension.ofBase (NativeAIR.Domain.lastPoint domain)) alpha constraints row == none do
+          throw "last-row pole accepted"
+        if expectedAcceptance then
+          accepted := accepted + 1
+          if let first :: rest := row then
+            unless Quotient.check domain point alpha constraints ((first + 1) :: rest) == some false do
+              throw "altered quotient coordinate accepted"
+        else rejected := rejected + 1
+  return (accepted, rejected)
+
+private def runReader (reader : Reader α) (path : System.FilePath) : IO α := do
+  let bytes ← IO.FS.readBinFile path
+  match reader.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok (value, (_, cursor)) =>
+    unless cursor == bytes.size do throw (IO.userError "domain snapshot has trailing bytes")
+    return value
+
+def run (domains quotients : System.FilePath) : IO Unit := do
+  let (rows, accepted, rejected) ← runReader readDomains domains
+  IO.println s!"domains: 33 generators, {rows} row samples, {accepted} defined/{rejected} rejected selectors and 511 bulk points match"
+  let (accepted, rejected) ← runReader readQuotients quotients
+  IO.println s!"quotients: {accepted} accepted/{rejected} rejected native arithmetic cases, malformed rows, poles and alterations match"
+
+end AiurTests.Domain
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [domains, quotients] => AiurTests.Domain.run domains quotients
+  | _ => throw (IO.userError "expected native domain and quotient snapshots")
diff --git a/Tests/Aiur/EmissionChecks.lean b/Tests/Aiur/EmissionChecks.lean
new file mode 100644
index 000000000..310fcad8c
--- /dev/null
+++ b/Tests/Aiur/EmissionChecks.lean
@@ -0,0 +1,89 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.CheckedCircuit
+import Tests.Aiur.EmissionReader
+
+/-! Native guard decisions across operand widths, scopes and control trees. -/
+
+open Aiur Aiur.Bytecode Aiur.NativeAIR Aiur.NativeAIR.OpEmitter
+open Aiur.NativeAIR.BlockEmitter AiurTests.EmissionReader
+
+namespace AiurTests.EmissionChecks
+
+private def readCorpus : Reader (Nat × Nat × Nat) := do
+  let header := "Aiur emission checks v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "emission check snapshot version differs"
+  let scopes ← readList (← readCount) readNat
+  unless scopes == [0, 1, 2, 3, 4, 7, 8, 9, 12, 16, 2^64 - 9, 2^64 - 2, 2^64 - 1] do
+    throw "emission check snapshot scope boundaries differ"
+  let mut operationChecks := 0
+  let mut sequenceChecks := 0
+  let mut controlChecks := 0
+  for group in [:← readCount] do
+    let mut ops := #[]
+    for index in [:← readCount] do
+      let op ← readOp
+      ops := ops.push op
+      unless (← readNat) == op.outputSize do throw s!"logical output size differs: group {group}, operation {index}"
+      for available in scopes do
+        let valid ← readBool
+        unless valid == op.emissionInputs available do
+          throw s!"operand check differs: group {group}, operation {index}, scope {available}"
+        let expected ← readOption readNat
+        unless expected == checkEmissionOps [op] available do
+          throw s!"single operation scope differs: group {group}, operation {index}, scope {available}"
+        if valid && available ≤ 32 && op.outputSize ≤ 64 then
+          let some emitted := emitOp (.konst 1) (.konst 0) available op (advice 0 available)
+            | throw "checked operation failed to emit"
+          unless emitted.outputs.size == op.outputSize do throw "checked operation output size differs"
+        operationChecks := operationChecks + 1
+    for available in scopes do
+      let expected ← readOption readNat
+      unless expected == checkEmissionOps ops.toList available do
+        throw s!"operation sequence scope differs: group {group}, scope {available}"
+      if let some next := expected then
+        if available ≤ 32 && next ≤ 128 then
+          let some emitted := emitOps (.konst 1) (.konst 0) ops.toList (advice 0 available) available
+            | throw "checked operation sequence failed to emit"
+          unless emitted.values.size == next do throw "checked sequence final scope differs"
+      sequenceChecks := sequenceChecks + 1
+  for index in [:← readCount] do
+    let block ← readBlock 64
+    for _ in [:← readCount] do
+      let available ← readNat
+      let selectors ← readNat
+      let yieldSize ← readOption readNat
+      let valid ← readBool
+      unless valid == block.emissionChecks available selectors yieldSize do
+        throw s!"control scope differs: block {index}, values {available}, selectors {selectors}, yields {yieldSize}"
+      if valid && available ≤ 32 then
+        let selectorTable := CircuitEmitter.selectorExprs available selectors
+        let some entry := blockSelector selectorTable block | throw "checked block selector is absent"
+        let some emitted := emitBlock selectorTable ⟨0, available, .konst 0⟩ entry
+            (advice 0 available) (available + selectors) 0 block
+          | throw "checked block failed to emit"
+        unless emitted.yields.all (fun part => yieldSize == some part.values.size) do
+          throw "checked block escaping yield width differs"
+      controlChecks := controlChecks + 1
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "emission check snapshot has trailing bytes"
+  unless (operationChecks, sequenceChecks, controlChecks) == (1365, 1157, 6500) do
+    throw "emission check snapshot coverage differs"
+  return (operationChecks, sequenceChecks, controlChecks)
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((operations, sequences, controls), _) =>
+    IO.println s!"emission checks: {operations} operations, {sequences} sequences and {controls} control scopes match"
+
+end AiurTests.EmissionChecks
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.EmissionChecks.run path
+  | _ => throw (IO.userError "expected native emission check snapshot")
diff --git a/Tests/Aiur/EmissionReader.lean b/Tests/Aiur/EmissionReader.lean
new file mode 100644
index 000000000..9b116b1e7
--- /dev/null
+++ b/Tests/Aiur/EmissionReader.lean
@@ -0,0 +1,155 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LookupExpressions
+
+/-! Test transport for native expression trees and operation constructors. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.OpEmitter
+
+namespace AiurTests.EmissionReader
+
+abbrev Reader := StateT (ByteArray × Nat) (Except String)
+
+def takeBytes (count : Nat) : Reader ByteArray := do
+  let (bytes, cursor) ← get
+  if cursor + count > bytes.size then throw s!"operation snapshot truncated at {cursor}"
+  set (bytes, cursor + count)
+  return bytes.extract cursor (cursor + count)
+
+def readNat (count : Nat := 8) : Reader Nat := do
+  let bytes ← takeBytes count
+  let mut value := 0
+  for index in [:count] do value := value + bytes[index]!.toNat * 256^index
+  return value
+
+def readCount (limit : Nat := 1024) : Reader Nat := do
+  let count ← readNat
+  unless count ≤ limit do throw s!"operation snapshot count exceeds {limit}"
+  return count
+
+def readField : Reader G := do
+  let value ← readNat
+  unless value < gSize.toNat do throw "noncanonical operation field value"
+  return G.ofNat value
+
+def readBool : Reader Bool := do
+  match ← readNat 1 with
+  | 0 => return false
+  | 1 => return true
+  | _ => throw "invalid operation boolean"
+
+def readList (count : Nat) (reader : Reader α) : Reader (List α) :=
+  (List.range count).mapM fun _ => reader
+
+def readValues : Reader (List G) := do readList (← readCount) readField
+
+def readString : Reader String := do
+  let bytes ← takeBytes (← readCount)
+  let some string := String.fromUTF8? bytes | throw "invalid operation text"
+  return string
+
+def readOption (reader : Reader α) : Reader (Option α) := do
+  if ← readBool then return some (← reader) else return none
+
+def readIndices : Reader (Array Nat) := do
+  return (← readList (← readCount) readNat).toArray
+
+def readExpr : Nat → Reader Expr
+  | 0 => throw "operation expression exceeds snapshot depth bound"
+  | fuel + 1 => do
+    match ← readNat 1 with
+    | 0 => return .konst (← readField)
+    | 1 =>
+      let source ← match ← readNat 1 with
+        | 0 => pure Source.preprocessed | 1 => pure Source.main | 2 => pure Source.stage2
+        | _ => throw "invalid operation column source"
+      let offset ← match ← readNat 1 with
+        | 0 => pure RowOffset.current | 1 => pure RowOffset.next
+        | _ => throw "invalid operation row offset"
+      return .var ⟨source, offset, ← readNat⟩
+    | 2 => return .publicInput (← readNat)
+    | 3 => return .isFirstRow
+    | 4 => return .isLastRow
+    | 5 => return .isTransition
+    | 6 => return .add (← readExpr fuel) (← readExpr fuel)
+    | 7 => return .sub (← readExpr fuel) (← readExpr fuel)
+    | 8 => return .mul (← readExpr fuel) (← readExpr fuel)
+    | 9 => return .neg (← readExpr fuel)
+    | _ => throw "invalid operation expression tag"
+
+def readMap : Reader (Array RowExpr) := do
+  return (← readList (← readCount) do
+    return RowExpr.mk (← readExpr 64) (← readNat)).toArray
+
+def readOp : Reader Bytecode.Op := do
+  match ← readNat 1 with
+  | 0 => return .const (← readField)
+  | 1 => return .add (← readNat) (← readNat)
+  | 2 => return .sub (← readNat) (← readNat)
+  | 3 => return .mul (← readNat) (← readNat)
+  | 4 => return .eqZero (← readNat)
+  | 5 => return .call (← readNat) (← readIndices) (← readNat) (← readBool)
+  | 6 => return .store (← readIndices)
+  | 7 => return .load (← readNat) (← readNat)
+  | 8 => return .assertEq (← readIndices) (← readIndices) (← readOption readString)
+  | 9 => return .ioGetInfo (← readNat) (← readIndices)
+  | 10 => return .ioSetInfo (← readNat) (← readIndices) (← readNat) (← readNat)
+  | 11 => return .ioRead (← readNat) (← readNat) (← readNat)
+  | 12 => return .ioWrite (← readNat) (← readIndices)
+  | 13 => return .u8BitDecomposition (← readNat)
+  | 14 => return .u8ShiftLeft (← readNat)
+  | 15 => return .u8ShiftRight (← readNat)
+  | 16 => return .u8Xor (← readNat) (← readNat)
+  | 17 => return .u8Add (← readNat) (← readNat)
+  | 18 => return .u8Mul (← readNat) (← readNat)
+  | 19 => return .u8Sub (← readNat) (← readNat)
+  | 20 => return .u8And (← readNat) (← readNat)
+  | 21 => return .u8Or (← readNat) (← readNat)
+  | 22 => return .u8LessThan (← readNat) (← readNat)
+  | 23 => return .u32LessThan (← readNat) (← readNat)
+  | 24 => return .u8XorSplit7 (← readNat) (← readNat)
+  | 25 => return .u8XorSplit4 (← readNat) (← readNat)
+  | 26 => return .debug (← readString) (← readOption readIndices)
+  | 27 => return .u8RangeCheck (← readNat) (← readNat)
+  | 28 => return .unconstrainedBigUintDivMod (← readNat) (← readNat)
+  | 29 => return .unconstrainedGToBytes (← readNat)
+  | 30 => return .unconstrainedGInverse (← readNat)
+  | 31 => return .unconstrainedU32Add (← readIndices) (← readIndices)
+  | 32 => return .unconstrainedU32Add3 (← readIndices) (← readIndices) (← readIndices)
+  | 33 => return .u32ToField (← readIndices)
+  | _ => throw "invalid operation constructor tag"
+
+def readBlock : Nat → Reader Bytecode.Block
+  | 0 => throw "native control tree exceeds snapshot depth bound"
+  | fuel + 1 => do
+    let ops := (← readList (← readCount) readOp).toArray
+    let ctrl : Bytecode.Ctrl ← match ← readNat 1 with
+      | 0 => pure (Bytecode.Ctrl.return (← readNat) (← readIndices))
+      | 1 => pure (Bytecode.Ctrl.yield (← readNat) (← readIndices))
+      | tag => do
+        unless tag == 2 || tag == 3 do throw "invalid native control tag"
+        let index ← readNat
+        let branches := (← readList (← readCount) do
+          return (← readField, ← readBlock fuel)).toArray
+        let fallback ← readOption (readBlock fuel)
+        if tag == 2 then pure (Bytecode.Ctrl.match index branches fallback)
+        else pure (Bytecode.Ctrl.matchContinue index branches fallback (← readNat) (← readNat) (← readNat) (← readBlock fuel))
+    return ⟨ops, ctrl⟩
+
+def assignment (row : Array G) : Values G :=
+  ⟨(fun source _ => match source with | .main => row | _ => #[]), #[], 1, 0, 1⟩
+
+def blockCallData (calls : List (G × (Bytecode.AIR.Call × (Fin 6 → G)))) :=
+  calls.map fun (gate, call, gap) => (gate, call, List.ofFn gap)
+
+def sameBlockEmission (left right : AIR.BlockEmission) : Bool :=
+  left.values == right.values && left.column == right.column && left.lookup == right.lookup &&
+    left.equations == right.equations &&
+    left.queries.map (fun part => (part.slot, part.selector, part.message)) ==
+      right.queries.map (fun part => (part.slot, part.selector, part.message)) &&
+    left.returns == right.returns && left.yields == right.yields && blockCallData left.calls == blockCallData right.calls
+
+end AiurTests.EmissionReader
diff --git a/Tests/Aiur/ExpressionGraph.lean b/Tests/Aiur/ExpressionGraph.lean
new file mode 100644
index 000000000..8e222e1ec
--- /dev/null
+++ b/Tests/Aiur/ExpressionGraph.lean
@@ -0,0 +1,156 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.KeyCodec
+
+open Aiur Aiur.NativeAIR
+
+namespace AiurTests.ExpressionGraph
+
+private def appendNat (out : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut out := out
+  for index in [:8] do out := out.push ((value >>> (8 * index)) % 256).toUInt8
+  return out
+
+private def nodeChoices : List Node := Id.run do
+  let indices := [0, 1, 3, 7, 8, 65535, 2^32 - 1]
+  let mut choices : Array Node := #[.konst 0, .konst 1, .konst (0 - 1), .konst 65536,
+    .isFirstRow, .isLastRow, .isTransition]
+  for source in [Source.preprocessed, .main, .stage2] do
+    for offset in [RowOffset.current, .next] do
+      for index in indices do choices := choices.push (.var ⟨source, offset, index⟩)
+  for index in indices do choices := choices.push (.publicInput index)
+  for left in indices do
+    for right in indices do
+      choices := choices ++ #[.add left right, .sub left right, .mul left right]
+  for index in indices do choices := choices.push (.neg index)
+  return choices.toList
+
+private def appendShapes (out : ByteArray) (nodes : List Node) : ByteArray := Id.run do
+  let mut out := out
+  let count := nodes.length
+  for width in [0, 1, 4, 8] do
+    let widths : GraphWidths := ⟨width, width + 1, width + 2, width⟩
+    let contexts : List (List Nat × List Lookup) := [
+      ([], []), ([0], []), ([count - 1], []), ([count], []),
+      ([], [⟨0, []⟩]), ([], [⟨count - 1, [0]⟩]), ([], [⟨0, [count]⟩])]
+    for (zeros, lookups) in contexts do
+      out := match checkedGraphPrefix widths ⟨nodes, zeros, lookups⟩ with
+        | none => out.push 0
+        | some lookupEnd => appendNat (out.push 1) lookupEnd
+  return out
+
+private def expectedShapes : ByteArray × Nat := Id.run do
+  let mut out := appendShapes "Aiur graph shapes v1\n".toUTF8 []
+  let mut checked := 28
+  for count in [1, 2, 4, 8] do
+    for index in [:count] do
+      for node in nodeChoices do
+        out := appendShapes out ((List.replicate count (.konst 0)).set index node)
+        checked := checked + 28
+  return (out, checked)
+
+private abbrev Reader := StateT (ByteArray × Nat) (Except String)
+
+private def takeBytes (count : Nat) : Reader ByteArray := do
+  let (bytes, cursor) ← get
+  if cursor + count > bytes.size then throw s!"graph snapshot truncated at {cursor}"
+  set (bytes, cursor + count)
+  return bytes.extract cursor (cursor + count)
+
+private def readNat (count : Nat) : Reader Nat := do
+  let bytes ← takeBytes count
+  let mut value := 0
+  for index in [:count] do value := value + bytes[index]!.toNat * 256^index
+  return value
+
+private def readList (count : Nat) (read : Reader α) : Reader (List α) :=
+  (List.range count).mapM fun _ => read
+
+private def readValues : Reader (Array G) := do
+  let count ← readNat 8
+  return (← readList count (return G.ofNat (← readNat 8))).toArray
+
+private def readAssignment (widths : GraphWidths) (graph : Graph) (trees : Array Expr) : Reader Nat := do
+  let preCurrent ← readValues
+  let preNext ← readValues
+  let mainCurrent ← readValues
+  let mainNext ← readValues
+  let stageCurrent ← readValues
+  let stageNext ← readValues
+  let publics ← readValues
+  let first := G.ofNat (← readNat 8)
+  let last := G.ofNat (← readNat 8)
+  let transition := G.ofNat (← readNat 8)
+  let values : Values G := ⟨(fun source offset => match source, offset with
+      | .preprocessed, .current => preCurrent | .preprocessed, .next => preNext
+      | .main, .current => mainCurrent | .main, .next => mainNext
+      | .stage2, .current => stageCurrent | .stage2, .next => stageNext),
+    publics, first, last, transition⟩
+  for source in [Source.preprocessed, .main, .stage2] do
+    for offset in [RowOffset.current, .next] do
+      unless (values.columns source offset).size == widths.width source do throw "native graph column width mismatch"
+  unless publics.size == widths.publics do throw "native graph public width mismatch"
+  let full ← readValues
+  let prefixValues ← readValues
+  let zeros ← readValues
+  let lookups ← readList (← readNat 8) do
+    let multiplicity := G.ofNat (← readNat 8)
+    let args ← readValues
+    return (multiplicity, args.toList)
+  unless graph.sweep goldilocksOps values == some full do throw "native graph full sweep differs"
+  unless graph.sweepLookupPrefix goldilocksOps values == some prefixValues do throw "native graph lookup sweep differs"
+  unless readNodes full graph.zeros == some zeros.toList do throw "native graph constraints differ"
+  unless graph.lookups.mapM (readLookup prefixValues) == some lookups do throw "native graph lookups differ"
+  unless trees.size == full.size do throw "unfolded graph size differs"
+  for index in [:trees.size] do
+    let some expr := trees[index]? | throw "unfolded graph index missing"
+    unless expr.eval goldilocksOps values == full[index]? do throw s!"unfolded graph value differs at {index}"
+  return full.size
+
+private def readGraphs : Reader (Nat × Nat) := do
+  let header := "Aiur expression graphs v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "native graph snapshot version differs"
+  let mut checked := 0
+  let mut nodes := 0
+  let count ← readNat 8
+  unless count == 10 do throw "incomplete native graph circuit corpus"
+  for _ in [:count] do
+    let bytes ← takeBytes (← readNat 8)
+    let some (circuit, rest) := KeyCodec.readCircuit bytes.data.toList
+      | throw "native graph circuit failed checked v5 decoding"
+    unless rest.isEmpty do throw "native graph circuit has trailing bytes"
+    let widths := circuit.widths
+    let graph := circuit.graph
+    let some lookupEnd := checkedGraphPrefix widths graph | throw "actual native graph layout rejected"
+    unless lookupEnd ≤ graph.nodes.length do throw "native graph lookup prefix out of range"
+    let some trees := graph.unfold | throw "actual native graph unfolding failed"
+    let assignments ← readNat 8
+    unless assignments == 24 do throw "incomplete native graph assignment corpus"
+    for _ in [:assignments] do
+      nodes := nodes + (← readAssignment widths graph trees)
+      checked := checked + 1
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "native graph snapshot has trailing bytes"
+  return (checked, nodes)
+
+def run (shapePath graphPath : System.FilePath) : IO Unit := do
+  let shapeBytes ← IO.FS.readBinFile shapePath
+  let (expected, checked) := expectedShapes
+  unless checked == 88228 && nodeChoices.length == 210 do throw (IO.userError "incomplete graph-shape corpus")
+  unless shapeBytes == expected do throw (IO.userError "native/Lean graph-shape checks differ")
+  IO.println s!"graph shapes: {checked} native/Lean layouts match"
+  let graphBytes ← IO.FS.readBinFile graphPath
+  match readGraphs.run (graphBytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((assignments, nodes), _) =>
+    IO.println s!"expression graphs: {assignments} native/Lean assignments, {nodes} node values match"
+
+end AiurTests.ExpressionGraph
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [shapePath, graphPath] => AiurTests.ExpressionGraph.run shapePath graphPath
+  | _ => throw (IO.userError "expected native graph-shape and expression-graph snapshots")
diff --git a/Tests/Aiur/Extension.lean b/Tests/Aiur/Extension.lean
new file mode 100644
index 000000000..4d2472ede
--- /dev/null
+++ b/Tests/Aiur/Extension.lean
@@ -0,0 +1,122 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ExtensionField
+import Tests.Aiur.EmissionReader
+
+/-! Comparison with the pinned native field implementation and its actual
+compiled graphs. Coordinate inputs, all operations and every graph node are
+checked independently, including full-width exponents and zero inverses. -/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.ExtensionArithmetic
+
+private def readExtension : Reader Extension := do return ⟨← readField, ← readField⟩
+private def readExtensions : Reader (List Extension) := do readList (← readCount 100000) readExtension
+
+private def readArithmetic : Reader Unit := do
+  let header := "Aiur extension arithmetic v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "extension arithmetic snapshot version differs"
+  let bases ← readCount
+  unless bases == 16 do throw "incomplete base inverse cases"
+  for _ in [:bases] do
+    let value ← readField
+    unless value.inverse == (← readField) do throw "native base inverse differs"
+  let values ← readExtensions
+  unless values.length == 384 do throw "incomplete extension coordinates"
+  let powers ← readList (← readCount) (readNat 16)
+  let p := gSize.toNat
+  let expected := [0, 1, 2, 3, 7, 8, 15, 16, 31, 32, 63, 64,
+    p - 2, p - 1, p, 2^64 - 1, 2^64, p * p - 2, 2^127 + 1, 2^128 - 1]
+  unless powers == expected do throw "incomplete extension exponents"
+  let mut inverses := 0
+  for value in values do
+    unless -value == (← readExtension) do throw "native extension negation differs"
+    unless value * value == (← readExtension) do throw "native extension square differs"
+    unless value.conjugate == (← readExtension) do throw "native extension conjugate differs"
+    unless value.norm == (← readField) do throw "native extension norm differs"
+    let inverse ← readOption readExtension
+    unless value.tryInverse == inverse do throw "native extension inverse differs"
+    if let some inverse := inverse then
+      unless value * inverse == 1 do throw "extension inverse does not cancel"
+      inverses := inverses + 1
+    for exponent in powers do
+      unless value.power exponent == (← readExtension) do throw s!"native extension power differs at {exponent}"
+  unless inverses == 383 do throw "incomplete extension inverse cases"
+  for left in values do
+    for right in values do
+      unless left + right == (← readExtension) do throw "native extension addition differs"
+      unless left - right == (← readExtension) do throw "native extension subtraction differs"
+      unless left * right == (← readExtension) do throw "native extension multiplication differs"
+
+private def readAssignment (circuit : KeyCodec.Circuit) (trees : Array Expr) : Reader Nat := do
+  let preCurrent := (← readExtensions).toArray
+  let preNext := (← readExtensions).toArray
+  let mainCurrent := (← readExtensions).toArray
+  let mainNext := (← readExtensions).toArray
+  let stageCurrent := (← readExtensions).toArray
+  let stageNext := (← readExtensions).toArray
+  let publics := (← readExtensions).toArray
+  let first ← readExtension
+  let last ← readExtension
+  let transition ← readExtension
+  let values : Values Extension := ⟨(fun source offset => match source, offset with
+      | .preprocessed, .current => preCurrent | .preprocessed, .next => preNext
+      | .main, .current => mainCurrent | .main, .next => mainNext
+      | .stage2, .current => stageCurrent | .stage2, .next => stageNext),
+    publics, first, last, transition⟩
+  for source in [Source.preprocessed, .main, .stage2] do
+    for offset in [RowOffset.current, .next] do
+      unless (values.columns source offset).size == circuit.widths.width source do throw "extension graph width differs"
+  unless publics.size == circuit.widths.publics do throw "extension graph public width differs"
+  let buffer := (← readExtensions).toArray
+  let constraints ← readExtensions
+  let lookups ← readList (← readCount) do return (← readExtension, ← readExtensions)
+  unless circuit.graph.sweep Extension.evalOps values == some buffer do throw "native extension sweep differs"
+  unless readNodes buffer circuit.graph.zeros == some constraints do throw "native extension constraint roots differ"
+  unless circuit.graph.lookups.mapM (readLookup buffer) == some lookups do throw "native extension lookup roots differ"
+  unless trees.size == buffer.size do throw "extension graph unfolding length differs"
+  for index in [:trees.size] do
+    let some expr := trees[index]? | throw "extension graph expression missing"
+    unless expr.eval Extension.evalOps values == buffer[index]? do throw "extension expression evaluation differs"
+  return buffer.size
+
+private def readGraphs : Reader Unit := do
+  let header := "Aiur extension graphs v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "extension graph snapshot version differs"
+  let circuits ← readCount
+  unless circuits == 10 do throw "incomplete extension graphs"
+  let mut nodes := 0
+  for _ in [:circuits] do
+    let bytes ← takeBytes (← readCount 1000000)
+    let some (circuit, []) := KeyCodec.readCircuit bytes.data.toList | throw "invalid extension graph circuit"
+    let some _ := checkedGraphPrefix circuit.widths circuit.graph | throw "invalid extension graph reads"
+    let some trees := circuit.graph.unfold | throw "extension graph does not unfold"
+    let assignments ← readCount
+    unless assignments == 24 do throw "incomplete extension graph assignments"
+    for _ in [:assignments] do nodes := nodes + (← readAssignment circuit trees)
+  unless nodes == 8016 do throw "incomplete extension graph nodes"
+
+private def runReader (reader : Reader Unit) (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match reader.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok (_, (_, cursor)) =>
+    unless cursor == bytes.size do throw (IO.userError "extension snapshot has trailing bytes")
+
+def run (arithmetic graphs : System.FilePath) : IO Unit := do
+  runReader readArithmetic arithmetic
+  IO.println "extension arithmetic: 16 base inverses, 384 values, 7680 powers and 147456 ordered pairs match native"
+  runReader readGraphs graphs
+  IO.println "extension graphs: 240 assignments and 8016 node values match native and expression evaluation"
+
+end AiurTests.ExtensionArithmetic
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [arithmetic, graphs] => AiurTests.ExtensionArithmetic.run arithmetic graphs
+  | _ => throw (IO.userError "expected native extension arithmetic and graph snapshots")
diff --git a/Tests/Aiur/ExtensionMmcs.lean b/Tests/Aiur/ExtensionMmcs.lean
new file mode 100644
index 000000000..da2b12883
--- /dev/null
+++ b/Tests/Aiur/ExtensionMmcs.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ExtensionMmcs
+import Tests.Aiur.EmissionReader
+
+/-! Both native extension MMCS methods, their base-field delegation and
+complete hash logs, including release-mode width multiplication overflow. -/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.ExtensionMmcs
+
+private def readExtension : Reader Extension := do return ⟨← readField, ← readField⟩
+
+private def readDigest : Reader Merkle.Digest := do
+  let bytes ← takeBytes 32
+  if length : bytes.data.size = 32 then return ⟨bytes.data, length⟩
+  else throw "incomplete extension MMCS digest"
+
+private def readDigests : Reader (List Merkle.Digest) := do readList (← readCount) readDigest
+
+private def readCall : Reader (List UInt8 × Merkle.Digest) := do
+  let input ← takeBytes (← readCount 100000)
+  return (input.data.toList, ← readDigest)
+
+private def readCorpus : Reader Nat := do
+  let header := "Aiur extension MMCS v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "extension MMCS snapshot version differs"
+  let wordBits ← readCount
+  unless wordBits == 32 || wordBits == 64 do throw "unsupported extension MMCS machine width"
+  let expected ← readList 7 readNat
+  let cases := expected[0]!
+  unless expected == [9597, 7362, 2566, 1661, 507, 3513, 42969] do
+    throw "incomplete extension MMCS corpus"
+  let mut shared := 0
+  let mut accepted := 0
+  let mut omitted := 0
+  let mut overflow := 0
+  let mut late := 0
+  let mut calls := 0
+  let mut paths := 0
+  for case in [:cases] do
+    let multi ← readBool
+    let dimensions ← readList (← readCount) do
+      return Merkle.Dimensions.mk (← readNat) (← readCount 32)
+    unless dimensions.all (fun dim => dim.width < 2^wordBits) do
+      throw "extension MMCS width is not machine-representable"
+    let capHeight ← readCount
+    let indices ← readList (← readCount) readNat
+    let rows ← readList (← readCount) do
+      readList (← readCount) do readList (← readCount) readExtension
+    let proof ← readDigests
+    let cap ← readDigests
+    let native ← readBool
+    let covered ← readBool
+    let widthsFit ← readBool
+    let hashes ← readList (← readCount) readCall
+    unless (dimensions.all fun dim => dim.width * 2 < 2^wordBits) == widthsFit do
+      throw "extension MMCS width overflow differs"
+    unless Merkle.covered dimensions capHeight == covered do throw "extension MMCS cap coverage differs"
+    let inputs ← if multi then do
+      let result := ExtensionMmcs.replayMulti Blake3.digest wordBits dimensions capHeight indices rows proof
+      unless ExtensionMmcs.verifyMulti Blake3.digest wordBits dimensions capHeight indices cap rows proof == native do
+        throw s!"extension shared decision differs at {case}"
+      unless ExtensionMmcs.verifyMultiCovered Blake3.digest wordBits dimensions capHeight indices cap rows proof ==
+          (native && covered) do throw "covered extension shared decision differs"
+      if let some nodes := result.result then
+        let tickets := nodes.flatMap PrunedMerkle.Node.tickets
+        unless tickets.length == (PrunedMerkle.uniqueIndices indices).length do
+          throw "extension shared ticket count differs"
+        for (index, query) in indices.zip rows do
+          unless tickets.any (fun ticket => ticket.index == index && ticket.rows == ExtensionMmcs.baseRows query) do
+            throw "extension shared reconstruction lost a query"
+        for node in nodes do
+          for ticket in node.tickets do
+            let some (_, query) := (indices.zip rows).find? fun (index, values) =>
+                index == ticket.index && ExtensionMmcs.baseRows values == ticket.rows
+              | throw "extension shared path lost its original query"
+            let some path := ExtensionMmcs.replay Blake3.digest wordBits dimensions capHeight ticket.index query ticket.proof
+              | throw "extension shared path is not individually valid"
+            unless path.index == node.index && path.hashing.digest == node.digest do
+              throw "extension shared path reaches a different node"
+            unless path.hashing.inputs.all result.inputs.contains do
+              throw "extension shared path uses an unrecorded input"
+            paths := paths + 1
+      pure result.inputs
+    else do
+      let [index] := indices | throw "individual extension MMCS has wrong index count"
+      let [values] := rows | throw "individual extension MMCS has wrong query count"
+      unless ExtensionMmcs.verify Blake3.digest wordBits dimensions capHeight index cap values proof == native do
+        throw s!"extension individual decision differs at {case}"
+      unless ExtensionMmcs.verifyCovered Blake3.digest wordBits dimensions capHeight index cap values proof ==
+          (native && covered) do throw "covered extension individual decision differs"
+      match ExtensionMmcs.replay Blake3.digest wordBits dimensions capHeight index values proof with
+      | none => pure []
+      | some result => paths := paths + 1; pure result.hashing.inputs
+    unless inputs == hashes.map Prod.fst do throw s!"extension MMCS hash sequence differs at {case}"
+    for (input, output) in hashes do
+      unless Blake3.digest input == output do throw "extension MMCS native hash differs"
+    if widthsFit then
+      for values in rows do
+        unless ExtensionMmcs.shape dimensions values ==
+            Merkle.shape (ExtensionMmcs.baseDimensions wordBits dimensions) (ExtensionMmcs.baseRows values) do
+          throw "extension row shape differs from bounded base row shape"
+    if multi then shared := shared + 1
+    if native then accepted := accepted + 1
+    if native && !covered then omitted := omitted + 1
+    if !widthsFit then overflow := overflow + 1
+    if !native && !hashes.isEmpty then late := late + 1
+    calls := calls + hashes.length
+  unless expected == [cases, shared, accepted, omitted, overflow, late, calls] do
+    throw "extension MMCS coverage totals differ"
+  unless paths == 20448 do throw "incomplete extension MMCS individual paths"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "extension MMCS snapshot has trailing bytes"
+  return paths
+
+end AiurTests.ExtensionMmcs
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.ExtensionMmcs.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (paths, _) => IO.println s!"Extension MMCS: 9597 native decisions, 42969 hash calls and {paths} individual paths match"
+  | _ => throw (IO.userError "expected native extension MMCS snapshot")
diff --git a/Tests/Aiur/Folding.lean b/Tests/Aiur/Folding.lean
new file mode 100644
index 000000000..7c4416830
--- /dev/null
+++ b/Tests/Aiur/Folding.lean
@@ -0,0 +1,152 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Folding
+import Tests.Aiur.EmissionReader
+
+/-! Replay native row and matrix folds of global polynomials, including
+partial coefficient blocks and distinct rows attaining the agreement bound.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.Folding
+
+private def readExtension : Reader Extension := return ⟨← readField, ← readField⟩
+
+private def readDomain (bits : Nat) : Reader Domain.Subgroup := do
+  let some domain := Domain.ofLogSize bits | throw "invalid folding domain"
+  return domain
+
+private def sample (seed : Nat) : Extension := ⟨G.ofNat (seed * 67 + 3), G.ofNat (seed * 13 + 1)⟩
+
+private def coefficients (arity variant : Nat) : List Extension :=
+  let length := match variant with
+    | 0 => 0 | 1 => 1 | 2 => arity - 1 | 3 => arity
+    | 4 => arity + 1 | 5 => 2 * arity + 1 | 6 => 3 * arity | _ => 3 * arity + 2
+  (List.range length).map (fun index =>
+    if variant == 6 then (if index + 1 == length then 1 else 0)
+    else if variant == 7 && index > arity then 0
+    else sample (index + 17))
+
+private def checkValues (expected : List Extension) : Reader Unit := do
+  unless (← readCount expected.length) == expected.length do throw "native folding vector length differs"
+  unless (← readList expected.length readExtension) == expected do throw "native folding vector differs"
+
+private def checkFolded (arity : Domain.Subgroup) (challenge : Extension)
+    (polynomial : List Extension) : Reader (List Extension) := do
+  let folded := NativeAIR.Folding.foldCoefficients arity challenge polynomial
+  checkValues folded
+  let size := Domain.size arity
+  unless folded.length == (polynomial.length + size - 1) / size do
+    throw "folded coefficient bound differs"
+  return folded
+
+private def readCorpus : Reader (List Nat) := do
+  let header := "Aiur global FRI folding v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "global folding version differs"
+  let mut rows := 0
+  let mut evaluations := 0
+  for parentBits in [:33] do
+    let parent ← readDomain parentBits
+    for arityBits in [:min parentBits 6 + 1] do
+      let arity ← readDomain arityBits
+      let child ← readDomain (parentBits - arityBits)
+      let size := Domain.size arity
+      let mask := Domain.size child - 1
+      let indices := [0, mask / 2, mask] |>.mergeSort (· ≤ ·) |>.eraseDups
+      unless (← readCount 3) == indices.length do throw "folding index inventory differs"
+      for index in indices do
+        unless (← readNat) == index do throw "native folding index differs"
+        let nodes := (Polynomial.foldingNodes parent arity index).map Extension.ofBase
+        let childPoint := Extension.ofBase (FriDomain.queryPoint child index)
+        for variant in [:8] do
+          let polynomial := coefficients size variant
+          let values := nodes.map (fun node => Quotient.horner node polynomial)
+          checkValues polynomial
+          checkValues values
+          let row := NativeAIR.Folding.rowCoefficients arity childPoint polynomial
+          unless row.length ≤ size && nodes.map (fun node => Quotient.horner node row) == values do
+            throw "restriction to the folding coset differs"
+          let challenges := [0, sample 41, 1,
+            Extension.ofBase (FriDomain.foldNode parent arity index 0),
+            Extension.ofBase (FriDomain.foldNode parent arity index (size - 1))]
+          for challenge in challenges do
+            unless (← readExtension) == challenge do throw "native folding challenge differs"
+            let folded ← checkFolded arity challenge polynomial
+            let result ← readExtension
+            unless Interpolation.foldRow parent arity index values challenge == some result &&
+                Quotient.horner childPoint folded == result && Quotient.horner challenge row == result do
+              throw "native row fold differs from the global folded polynomial"
+            evaluations := evaluations + 1
+          rows := rows + 1
+  let mut matrices := 0
+  let mut matrixRows := 0
+  for parentBits in [1:10] do
+    let parent ← readDomain parentBits
+    for arityBits in [1:min parentBits 6 + 1] do
+      let arity ← readDomain arityBits
+      let child ← readDomain (parentBits - arityBits)
+      let size := Domain.size arity
+      for variant in [:8] do
+        let polynomial := coefficients size variant
+        let data := (List.range (Domain.size parent)).map (fun index =>
+          Quotient.horner (Extension.ofBase (FriDomain.queryPoint parent index)) polynomial)
+        checkValues polynomial
+        checkValues data
+        for challenge in [0, sample 41, 1] do
+          unless (← readExtension) == challenge do throw "native matrix folding challenge differs"
+          let folded ← checkFolded arity challenge polynomial
+          unless (← readCount (Domain.size child)) == Domain.size child do throw "native folded matrix height differs"
+          let result ← readList (Domain.size child) readExtension
+          for index in [:Domain.size child] do
+            let row := (data.drop (index * size)).take size
+            let expected := Quotient.horner (Extension.ofBase (FriDomain.queryPoint child index)) folded
+            unless result[index]? == some expected &&
+                Interpolation.foldRow parent arity index row challenge == some expected do
+              throw "native matrix fold differs from the global folded polynomial"
+            matrixRows := matrixRows + 1
+          matrices := matrices + 1
+  let mut pairs := 0
+  let mut pairEvaluations := 0
+  for arityBits in [:7] do
+    let arity ← readDomain arityBits
+    let parent ← readDomain (arityBits + 2)
+    let size := Domain.size arity
+    let challenges := (Polynomial.foldingNodes parent arity 1).map Extension.ofBase ++ [0, sample 41]
+    let left := (List.range size).map (fun index => sample (index + 7))
+    let right := left.set (size / 2) (sample (size / 2 + 7) + sample 131)
+    unless challenges.eraseDups == challenges && left != right do throw "row agreement preconditions differ"
+    checkValues left
+    checkValues right
+    let mut agreements := 0
+    for challenge in challenges do
+      unless (← readExtension) == challenge do throw "native row comparison challenge differs"
+      let first ← readExtension
+      let second ← readExtension
+      unless Interpolation.foldRow parent arity 1 left challenge == some first &&
+          Interpolation.foldRow parent arity 1 right challenge == some second do
+        throw "native distinct row folds differ"
+      if first == second then agreements := agreements + 1
+      pairEvaluations := pairEvaluations + 1
+    unless (← readNat) == agreements && agreements == size - 1 do throw "distinct rows miss the sharp agreement bound"
+    pairs := pairs + 1
+  let counts := [rows, evaluations, matrices, matrixRows, pairs, pairEvaluations]
+  unless counts == [4872, 24360, 936, 24048, 7, 141] do throw "incomplete global folding corpus"
+  unless (← readList 6 readNat) == counts do throw "global folding coverage totals differ"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "global folding snapshot has trailing bytes"
+  return counts
+
+end AiurTests.Folding
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.Folding.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (counts, _) => IO.println s!"Native global FRI rows, evaluations, matrices, matrix rows, distinct pairs and pair evaluations match: {counts}"
+  | _ => throw (IO.userError "expected native global FRI folding snapshot")
diff --git a/Tests/Aiur/FriDomain.lean b/Tests/Aiur/FriDomain.lean
new file mode 100644
index 000000000..5b6af1b10
--- /dev/null
+++ b/Tests/Aiur/FriDomain.lean
@@ -0,0 +1,113 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FriDomain
+import Tests.Aiur.EmissionReader
+
+/-! Actual native reversal, coset points and FRI folding at every sampled
+interpolation node, including singleton helpers and full machine widths.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+
+namespace AiurTests.FriDomain
+
+private def samples (bits exhaustive : Nat) : List Nat :=
+  let mask := 2^bits - 1
+  (List.range (min (mask + 1) exhaustive) ++ [mask, mask / 2, mask - 1] ++
+    (List.range 16).map (fun seed => seed * 0x0a3751c9 % 2^bits)).mergeSort (· ≤ ·) |>.eraseDups
+
+private def checkedIndices (expected : List Nat) : Reader Unit := do
+  unless (← readCount expected.length) == expected.length do throw "FRI domain index inventory differs"
+
+private def readDomain (bits : Nat) : Reader Domain.Subgroup := do
+  let some domain := Domain.ofLogSize bits | throw "invalid FRI domain logarithm"
+  return domain
+
+private def readCorpus : Reader (List Nat) := do
+  let header := "Aiur FRI domains v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "FRI domain version differs"
+  let wordBits ← readCount 64
+  unless wordBits == 32 || wordBits == 64 do throw "unsupported FRI native word width"
+  let mut reversals := 0
+  for bits in [:wordBits + 1] do
+    let indices := samples bits 1024
+    checkedIndices indices
+    for index in indices do
+      unless (← readNat) == index do throw "native bit reversal index differs"
+      let reversed ← readNat
+      unless FriDomain.reverseBits bits index == reversed &&
+          FriDomain.wordReverse wordBits bits index == reversed &&
+          FriDomain.reverseBits bits reversed == index do throw "native bit reversal differs"
+      reversals := reversals + 1
+  let emptyWidth ← readNat
+  unless emptyWidth == 2^(wordBits - 1) && FriDomain.wordReverse wordBits 0 1 == emptyWidth &&
+      FriDomain.reverseBits 0 1 == 0 do throw "native zero-width overflow differs"
+  let mut points := 0
+  for bits in [:33] do
+    let domain ← readDomain bits
+    let indices := samples bits 1024
+    checkedIndices indices
+    for index in indices do
+      unless (← readNat) == index do throw "FRI query index differs"
+      unless (← readField) == FriDomain.queryPoint domain index do throw "FRI query point differs"
+      unless (← readField) == FriDomain.inputPoint domain index do throw "FRI input coset point differs"
+      points := points + 1
+  let mut nested := 0
+  for parentBits in [:33] do
+    let parent ← readDomain parentBits
+    for childBits in [:parentBits + 1] do
+      let child ← readDomain childBits
+      let indices := samples childBits 4
+      checkedIndices indices
+      for index in indices do
+        unless (← readNat) == index do throw "FRI nested index differs"
+        let point ← readField
+        unless point == FriDomain.queryPoint parent index && point == FriDomain.queryPoint child index do
+          throw "FRI final-domain point differs"
+        nested := nested + 1
+  let mut rows := 0
+  let mut slots := 0
+  for parentBits in [:33] do
+    let parent ← readDomain parentBits
+    for arityBits in [:min parentBits 8 + 1] do
+      let arity ← readDomain arityBits
+      let height := parentBits - arityBits
+      let child ← readDomain height
+      let mask := 2^height - 1
+      let indices := [0, mask / 2, mask, 0x0a3751c9 % 2^height] |>.mergeSort (· ≤ ·) |>.eraseDups
+      checkedIndices indices
+      for index in indices do
+        unless (← readNat) == index do throw "FRI folding index differs"
+        for slot in [:Domain.size arity] do
+          let node ← readField
+          let power ← readField
+          let folded : ProofCodec.Extension := ⟨← readField, ← readField⟩
+          unless node == FriDomain.foldNode parent arity index slot &&
+              node == FriDomain.queryPoint parent (index * Domain.size arity + slot) do
+            throw "native FRI folding node differs"
+          unless power == FriDomain.queryPoint child index && power == node.pow (Domain.size arity) do
+            throw "native FRI reduced point differs"
+          unless folded == ProofCodec.Extension.mk (G.ofNat (slot + 1)) (G.ofNat (slot * 19 + 3)) do
+            throw "native FRI fold_row selected a different evaluation"
+          slots := slots + 1
+        rows := rows + 1
+  let counts := [reversals, points, nested, rows, slots]
+  unless counts == [if wordBits == 64 then 58295 else 24951, 24951, 9617, 990, 50042] do
+    throw "incomplete FRI domain corpus"
+  unless (← readList 5 readNat) == counts do throw "FRI domain coverage totals differ"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "FRI domain snapshot has trailing bytes"
+  return counts
+
+end AiurTests.FriDomain
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.FriDomain.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (counts, _) => IO.println s!"FRI native reversals, query points, nested points, rows and fold nodes match: {counts}"
+  | _ => throw (IO.userError "expected native FRI domain snapshot")
diff --git a/Tests/Aiur/FriQuery.lean b/Tests/Aiur/FriQuery.lean
new file mode 100644
index 000000000..d1f940d75
--- /dev/null
+++ b/Tests/Aiur/FriQuery.lean
@@ -0,0 +1,212 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FriQuery
+import Tests.Aiur.EmissionReader
+
+/-! Replay the actual private FRI query routine using calls captured through
+the public verifier's folding hook. Inputs come from known source polynomials
+and ordinary native PCS proofs, including every authenticated input row.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.FriQuery
+
+private structure Source where
+  logSize : Nat
+  columns : List (List G)
+
+private structure Opening where
+  arity : Domain.Subgroup
+  siblings : List (List Extension)
+
+private def readExtension : Reader Extension := return ⟨← readField, ← readField⟩
+
+private def domain (bits : Nat) : Reader Domain.Subgroup := do
+  let some result := Domain.ofLogSize bits | throw "invalid query domain"
+  return result
+
+private def readValues (read : Reader R) (length : Nat) : Reader (List R) := do
+  unless (← readCount length) == length do throw "native query vector length differs"
+  readList length read
+
+private def checkValues [BEq R] (read : Reader R) (expected : List R) : Reader Unit := do
+  unless (← readValues read expected.length) == expected do throw "native query vector differs"
+
+private def layout (index finalBits : Nat) : List (List Nat) :=
+  let offsets := match index with
+    | 0 => [[0]] | 1 => [[2]] | 2 => [[6, 2], [2, 0]] | _ => [[3, 6], [3]]
+  offsets.map (List.map (fun bits => bits + finalBits + if finalBits == 0 then 0 else 1))
+
+private def polynomial (seed bits column : Nat) : List G :=
+  (List.range (2^bits)).map (fun index => G.ofNat (seed * 101 + column * 29 + index * 13 + 1))
+
+private def sources (caseIndex finalBits layoutIndex : Nat) : List (List Source) :=
+  (layout layoutIndex finalBits).zipIdx.map fun (matrices, batch) =>
+    matrices.zipIdx.map fun (bits, matrix) =>
+      ⟨bits, (List.range (2 + matrix)).map (polynomial (caseIndex + batch * 7 + matrix) bits)⟩
+
+private def readSources (expected : List (List Source)) : Reader Unit := do
+  unless (← readCount expected.length) == expected.length do throw "query source batch count differs"
+  for batch in expected do
+    unless (← readCount batch.length) == batch.length do throw "query source matrix count differs"
+    for source in batch do
+      unless (← readNat) == source.logSize do throw "query source height differs"
+      unless (← readCount source.columns.length) == source.columns.length do throw "query source width differs"
+      for coefficients in source.columns do checkValues readField coefficients
+
+/-- Derive each quotient polynomial from its known source coefficients.
+The native input-reduction routine is not used to obtain these values. -/
+private def groupedPolynomials (input : List (List Source)) (points : List Extension)
+    (alpha : Extension) (blowup : Nat) : List (Nat × List Extension) := Id.run do
+  let terms := input.flatten.flatMap fun source =>
+    points.flatMap fun point => source.columns.map fun coefficients =>
+      (source.logSize + blowup, Polynomial.divide point (coefficients.map Extension.ofBase))
+  let heights := terms.map Prod.fst |>.mergeSort (· ≥ ·) |>.eraseDups
+  return heights.map fun height =>
+    let (_, coefficients) := terms.foldl (fun (power, sum) (logHeight, polynomial) =>
+      if height == logHeight then (power * alpha, Polynomial.add sum (Polynomial.scale power polynomial))
+      else (power, sum)) (1, [])
+    (height, coefficients)
+
+private def reducedOpenings (initial : Domain.Subgroup) (index : Nat)
+    (polynomials : List (Nat × List Extension)) : Reader (List (Nat × Extension)) :=
+  polynomials.mapM fun (height, coefficients) => do
+    let current ← domain height
+    unless height ≤ initial.val do throw "input exceeds the global query domain"
+    let reducedIndex := index / 2^(initial.val - height)
+    return (height, Quotient.horner (Extension.ofBase (FriDomain.inputPoint current reducedIndex)) coefficients)
+
+private def checkInputRows (input : List (List Source)) (initial : Domain.Subgroup) (indices : List Nat)
+    (blowup : Nat) (rows : List (List (List (List G)))) : Reader Unit := do
+  for (batch, queries) in input.zip rows do
+    for (index, matrices) in indices.zip queries do
+      for (source, row) in batch.zip matrices do
+        let current ← domain (source.logSize + blowup)
+        let point := FriDomain.inputPoint current (index / 2^(initial.val - current.val))
+        unless row == source.columns.map (Quotient.horner point) do throw "authenticated native input row differs from its source polynomial"
+
+private def checkGuards (initial final : Domain.Subgroup) (index : Nat)
+    (openings : List (Nat × Extension)) (rounds : List NativeAIR.FriQuery.Round)
+    (finalPolynomial : List Extension) : Reader Unit := do
+  unless (NativeAIR.FriQuery.run initial final (Domain.size initial) openings rounds).isNone &&
+      (NativeAIR.FriQuery.run initial final index [] rounds).isNone &&
+      (NativeAIR.FriQuery.check initial final index openings rounds (Polynomial.add [1] finalPolynomial)).isNone do
+    throw "query admission or final polynomial guard differs"
+  let some (height, value) := openings.head? | throw "missing initial query input"
+  unless (NativeAIR.FriQuery.run initial final index ((height + 1, value) :: openings.tail) rounds).isNone &&
+      (NativeAIR.FriQuery.run initial final index ((height, value) :: openings) rounds).isNone do
+    throw "initial or duplicated reduced height was accepted"
+  if let round :: rest := rounds then
+    let singleton ← domain 0
+    unless (NativeAIR.FriQuery.run initial initial index openings rounds).isNone &&
+        (NativeAIR.FriQuery.run initial final index openings ({ round with arity := singleton } :: rest)).isNone &&
+        (NativeAIR.FriQuery.run initial final index openings ({ round with siblings := 0 :: round.siblings } :: rest)).isNone do
+      throw "query round shape or terminal height guard differs"
+
+private def readCase (caseIndex blowup finalBits maxArity layoutIndex : Nat) : Reader (Nat × Nat × Nat) := do
+  let input := sources caseIndex finalBits layoutIndex
+  let queries := 1 + layoutIndex + finalBits
+  let globalBits := ((layout layoutIndex finalBits).flatten.foldl max 0) + blowup
+  unless (← readList 6 readNat) == [blowup, finalBits, maxArity, queries, layoutIndex, globalBits] do
+    throw "native query profile differs"
+  let initial ← domain globalBits
+  let final ← domain (finalBits + blowup)
+  readSources input
+  let points ← readValues readExtension (1 + layoutIndex % 2)
+  let some first := points.head? | throw "missing opening point"
+  unless points == (if layoutIndex % 2 == 0 then [first] else [first, first + ⟨19, 3⟩]) do
+    throw "native query opening points differ"
+  for batch in input do
+    for source in batch do
+      for point in points do
+        checkValues readExtension (source.columns.map fun coefficients =>
+          Quotient.horner point (coefficients.map Extension.ofBase))
+  let inputRows ← input.mapM fun batch =>
+    readList queries (batch.mapM fun source => readValues readField source.columns.length)
+  let random ← readList (← readCount 34) readExtension
+  let some alpha := random.head? | throw "missing query batching challenge"
+  let indices ← readList queries do
+    unless (← readNat) == globalBits do throw "native query sample width differs"
+    let index ← readNat
+    unless index < Domain.size initial do throw "native query index exceeds its domain"
+    return index
+  let roundCount ← readCount 32
+  unless random.length == roundCount + 1 do throw "native query challenge count differs"
+  let openings ← readList roundCount do
+    let arityBits ← readNat
+    unless 0 < arityBits && arityBits ≤ maxArity do throw "native query arity exceeds its profile"
+    let arity ← domain arityBits
+    let siblings ← readList queries (readValues readExtension (Domain.size arity - 1))
+    return Opening.mk arity siblings
+  unless (openings.map (fun opening => opening.arity.val)).sum + final.val == initial.val do
+    throw "native query round heights do not reach the final domain"
+  let finalPolynomial ← readValues readExtension (2^finalBits)
+  checkInputRows input initial indices blowup inputRows
+  let polynomials := groupedPolynomials input points alpha blowup
+  let callCount ← readNat
+  unless callCount == queries * roundCount do throw "native query fold call count differs"
+  let results ← indices.zipIdx.mapM fun (index, query) => do
+    let reduced ← reducedOpenings initial index polynomials
+    let rounds ← (openings.zip random.tail).mapM fun (opening, challenge) => do
+      let some siblings := opening.siblings[query]? | throw "missing native query siblings"
+      return NativeAIR.FriQuery.Round.mk opening.arity challenge siblings
+    let some result := NativeAIR.FriQuery.check initial final index reduced rounds finalPolynomial
+      | throw "native accepted query fails checked reconstruction or final evaluation"
+    unless result.rows.length == roundCount && result.state.domain == final &&
+        result.state.index == index / 2^(globalBits - final.val) do
+      throw "checked query chain dimensions differ"
+    for (round, row) in rounds.zip result.rows do
+      unless (← readList 3 readNat) == [row.index, row.domain.val, round.arity.val] &&
+          (← readExtension) == round.challenge do
+        throw "native query fold metadata differs"
+      checkValues readExtension row.values
+      let folded ← readExtension
+      let parent ← domain (row.domain.val + round.arity.val)
+      unless Interpolation.foldRow parent round.arity row.index row.values round.challenge == some folded do
+        throw "native query row folding differs"
+    checkGuards initial final index reduced rounds finalPolynomial
+    return result
+  for result in results do
+    unless (← readNat) == result.state.index && (← readExtension) == result.state.value &&
+        Quotient.horner (Extension.ofBase (FriDomain.queryPoint final result.state.index)) finalPolynomial == result.state.value do
+      throw "native query final index or polynomial value differs"
+  return (queries, roundCount, callCount)
+
+private def readCorpus : Reader (List Nat) := do
+  let header := "Aiur native FRI query chains v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "FRI query version differs"
+  let mut cases := 0
+  let mut totalQueries := 0
+  let mut totalRounds := 0
+  let mut totalCalls := 0
+  for blowup in [1:3] do
+    for finalBits in [:3] do
+      for maxArity in [1:5] do
+        for layoutIndex in [:4] do
+          let (queries, rounds, calls) ← try readCase cases blowup finalBits maxArity layoutIndex
+            catch message => throw s!"query case {cases}: {message}"
+          cases := cases + 1
+          totalQueries := totalQueries + queries
+          totalRounds := totalRounds + rounds
+          totalCalls := totalCalls + calls
+  let counts := [cases, totalQueries, totalRounds, totalCalls]
+  unless counts == [96, 336, 246, 1030] do throw "incomplete native query corpus"
+  unless (← readList 4 readNat) == counts do throw "native query coverage totals differ"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "native query snapshot has trailing bytes"
+  return counts
+
+end AiurTests.FriQuery
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.FriQuery.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (counts, _) => IO.println s!"Native FRI proofs, queries, rounds and fold calls match: {counts}"
+  | _ => throw (IO.userError "expected native FRI query snapshot")
diff --git a/Tests/Aiur/FrontendExpressions.lean b/Tests/Aiur/FrontendExpressions.lean
new file mode 100644
index 000000000..508f506cb
--- /dev/null
+++ b/Tests/Aiur/FrontendExpressions.lean
@@ -0,0 +1,181 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.FrontendExpressions
+
+open Aiur Aiur.NativeAIR
+
+namespace AiurTests.FrontendExpressions
+
+private def fixtures : Array Expr := Id.run do
+  let mut result : Array Expr := #[.konst 0, .konst 1, .konst (0 - 1), .konst 17]
+  for source in [Source.preprocessed, .main, .stage2] do
+    for offset in [RowOffset.current, .next] do
+      result := result.push (.var ⟨source, offset, 2⟩)
+  let x := (mainCurrent 0).expr
+  let y := (mainCurrent 1).expr
+  return result ++ #[.publicInput 0, .publicInput 2, .isFirstRow, .isLastRow, .isTransition,
+    .neg x, .add x y, .sub (.konst 0) x, .mul (.konst 0) y,
+    .neg (.konst 0), .neg (.konst 1), .neg (.neg x), .neg (.neg (.konst 1)),
+    .add (.konst 1) (.konst 1)]
+
+private def matrix (seed slot : Nat) : Array G := Array.ofFn fun index : Fin 16 =>
+  let choices : Array G := #[0, 1, 2, 17, 255, 256, 65536, 0 - 1]
+  if slot == 2 && index.val == 6 then (#[0, 1, 2, 0 - 1] : Array G)[seed]?.getD 0
+  else choices[(slot * 3 + seed * 5 + index.val * 7) % choices.size]?.getD 0
+
+private def assignment (seed : Nat) : Values G :=
+  ⟨(fun source offset => matrix seed
+    ((match source with | .preprocessed => 0 | .main => 2 | .stage2 => 4) +
+      (match offset with | .current => 0 | .next => 1))),
+    matrix seed 6, (if seed == 0 then 1 else 0), (if seed == 3 then 1 else 0),
+    (if seed == 3 then 0 else 1)⟩
+
+private abbrev Reader := StateT (ByteArray × Nat) (Except String)
+
+private def takeBytes (count : Nat) : Reader ByteArray := do
+  let (bytes, cursor) ← get
+  if cursor + count > bytes.size then throw s!"frontend snapshot truncated at {cursor}"
+  set (bytes, cursor + count)
+  return bytes.extract cursor (cursor + count)
+
+private def readNat (count : Nat := 8) : Reader Nat := do
+  let bytes ← takeBytes count
+  let mut value := 0
+  for index in [:count] do value := value + bytes[index]!.toNat * 256^index
+  return value
+
+private def readField : Reader G := do
+  let value ← readNat
+  unless value < gSize.toNat do throw "noncanonical frontend field value"
+  return G.ofNat value
+
+private def readBool : Reader Bool := do
+  match ← readNat with
+  | 0 => return false
+  | 1 => return true
+  | _ => throw "invalid frontend boolean"
+
+private def readList (count : Nat) (reader : Reader α) : Reader (List α) :=
+  (List.range count).mapM fun _ => reader
+
+private def readExpr : Nat → Reader Expr
+  | 0 => throw "frontend expression exceeds snapshot depth bound"
+  | fuel + 1 => do
+    match ← readNat 1 with
+    | 0 => return .konst (← readField)
+    | 1 =>
+      let source ← match ← readNat 1 with
+        | 0 => pure Source.preprocessed | 1 => pure Source.main | 2 => pure Source.stage2
+        | _ => throw "invalid frontend column source"
+      let offset ← match ← readNat 1 with
+        | 0 => pure RowOffset.current | 1 => pure RowOffset.next
+        | _ => throw "invalid frontend row offset"
+      return .var ⟨source, offset, ← readNat⟩
+    | 2 => return .publicInput (← readNat)
+    | 3 => return .isFirstRow
+    | 4 => return .isLastRow
+    | 5 => return .isTransition
+    | 6 => return .add (← readExpr fuel) (← readExpr fuel)
+    | 7 => return .sub (← readExpr fuel) (← readExpr fuel)
+    | 8 => return .mul (← readExpr fuel) (← readExpr fuel)
+    | 9 => return .neg (← readExpr fuel)
+    | _ => throw "invalid frontend expression tag"
+
+private def readFixture : Reader Expr := do
+  let index ← readNat
+  let some expr := fixtures[index]? | throw "frontend fixture index out of range"
+  return expr
+
+private def readSmart : Reader Unit := do
+  let kind ← readNat 1
+  let left ← readFixture
+  let right ← readFixture
+  let expected ← match kind with
+    | 0 => pure (left.frontAdd right)
+    | 1 => pure (left.frontSub right)
+    | 2 => pure (left.frontMul right)
+    | 3 => pure left.frontNeg
+    | _ => throw "invalid smart operation tag"
+  let actual ← readExpr 64
+  unless actual == expected do throw s!"native smart-constructor tree differs for operation {kind}"
+  unless (← readBool) == expected.isConstant do throw "native smart constant flag differs"
+  if left.noConstantNegs && (kind == 3 || right.noConstantNegs) then
+    unless expected.noConstantNegs do throw "smart constructor lost the negation invariant"
+  for seed in [:4] do
+    let value ← readField
+    unless expected.eval goldilocksOps (assignment seed) == some value do
+      throw s!"native smart value differs for operation {kind}, assignment {seed}"
+
+private def sameEmission (left right : AIR.OpEmission) : Bool :=
+  left.outputs == right.outputs && left.used == right.used && left.equations == right.equations &&
+    left.queries.isEmpty && right.queries.isEmpty && left.calls.isEmpty && right.calls.isEmpty
+
+private def readEmission : Reader Unit := do
+  let kind ← readNat 1
+  let leftExpr ← readFixture
+  let rightExpr ← readFixture
+  let left : RowExpr := ⟨leftExpr, ← readNat⟩
+  let right : RowExpr := ⟨rightExpr, ← readNat⟩
+  unless left.expr.noConstantNegs && right.expr.noConstantNegs do throw "invalid core expression fixture"
+  let used ← readNat
+  let degree ← readNat
+  let output ← readExpr 64
+  let equationCount ← readNat
+  unless equationCount ≤ 2 do throw "too many core equations"
+  let equations ← readList equationCount (readExpr 64)
+  let selector := (mainCurrent 6).expr
+  let (expected, op) ← match kind with
+    | 0 => pure (emitEqZero selector 7 left, Bytecode.Op.eqZero 0)
+    | 1 => pure (ScalarEmission.mk (left.add right) 0 [], Bytecode.Op.add 0 1)
+    | 2 => pure (ScalarEmission.mk (left.sub right) 0 [], Bytecode.Op.sub 0 1)
+    | 3 => pure (emitMul selector 7 left right, Bytecode.Op.mul 0 1)
+    | _ => throw "invalid scalar operation tag"
+  unless output == expected.output.expr && degree == expected.output.degree &&
+      used == expected.used && equations == expected.equations do
+    throw s!"native scalar expression emission differs for operation {kind}"
+  unless expected.output.expr.noConstantNegs do throw "scalar output lost the negation invariant"
+  for seed in [:4] do
+    let value ← readField
+    let constant ← readBool
+    let polynomialValues ← readList equationCount readField
+    let values := assignment seed
+    let some evaluated := expected.eval values | throw "scalar expression evaluation failed"
+    let native : AIR.OpEmission := {
+      outputs := #[⟨value, degree, constant⟩], used, equations := polynomialValues }
+    unless sameEmission evaluated native do throw "native scalar evaluated emission differs"
+    let some a := left.eval values | throw "scalar left input evaluation failed"
+    let some b := right.eval values | throw "scalar right input evaluation failed"
+    let row := fun index => (matrix seed 2)[7 + index]?.getD 0
+    let selected := (matrix seed 2)[6]?.getD 0
+    let some valued := AIR.emitOp row selected 0 op #[a, b] | throw "valued scalar emission failed"
+    unless sameEmission evaluated valued do throw "symbolic and valued scalar emissions differ"
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur frontend expressions v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "frontend snapshot version differs"
+  let count ← readNat
+  unless count == 24 && fixtures.size == 24 do throw "incomplete frontend fixtures"
+  unless (← readList count (readExpr 64)).toArray == fixtures do throw "frontend input trees differ"
+  unless (fixtures.filter (·.noConstantNegs)).size == 21 do throw "incomplete negation-invariant boundary cases"
+  unless (← readNat) == 1752 do throw "incomplete smart-constructor corpus"
+  for _ in [:1752] do readSmart
+  unless (← readNat) == 9804 do throw "incomplete scalar-emission corpus"
+  for _ in [:9804] do readEmission
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "frontend snapshot has trailing bytes"
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok _ => IO.println "frontend expressions: 1,752 smart trees, 9,804 scalar emissions and 46,224 native/Lean assignments match"
+
+end AiurTests.FrontendExpressions
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.FrontendExpressions.run path
+  | _ => throw (IO.userError "expected native frontend-expression snapshot")
diff --git a/Tests/Aiur/GraphCompilation.lean b/Tests/Aiur/GraphCompilation.lean
new file mode 100644
index 000000000..68cf01034
--- /dev/null
+++ b/Tests/Aiur/GraphCompilation.lean
@@ -0,0 +1,189 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.GraphCompilation
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.Compiler
+
+namespace AiurTests.GraphCompilation
+
+private abbrev Reader := StateT (ByteArray × Nat) (Except String)
+
+private def takeBytes (count : Nat) : Reader ByteArray := do
+  let (bytes, cursor) ← get
+  if cursor + count > bytes.size then throw s!"compiler snapshot truncated at {cursor}"
+  set (bytes, cursor + count)
+  return bytes.extract cursor (cursor + count)
+
+private def readNat (count : Nat := 8) : Reader Nat := do
+  let bytes ← takeBytes count
+  let mut value := 0
+  for index in [:count] do value := value + bytes[index]!.toNat * 256^index
+  return value
+
+private def readField : Reader G := do
+  let value ← readNat
+  unless value < gSize.toNat do throw "noncanonical compiler field value"
+  return G.ofNat value
+
+private def readList (count : Nat) (reader : Reader α) : Reader (List α) :=
+  (List.range count).mapM fun _ => reader
+
+private def readValues : Reader (Array G) := do
+  return (← readList (← readNat) readField).toArray
+
+private def readColumn : Reader ColRef := do
+  let source ← match ← readNat 1 with
+    | 0 => pure Source.preprocessed | 1 => pure Source.main | 2 => pure Source.stage2
+    | _ => throw "invalid compiler column source"
+  let offset ← match ← readNat 1 with
+    | 0 => pure RowOffset.current | 1 => pure RowOffset.next
+    | _ => throw "invalid compiler row offset"
+  return ⟨source, offset, ← readNat⟩
+
+private def readExpr : Nat → Reader Expr
+  | 0 => throw "compiler expression exceeds snapshot depth bound"
+  | fuel + 1 => do
+    match ← readNat 1 with
+    | 0 => return .konst (← readField)
+    | 1 => return .var (← readColumn)
+    | 2 => return .publicInput (← readNat)
+    | 3 => return .isFirstRow
+    | 4 => return .isLastRow
+    | 5 => return .isTransition
+    | 6 => return .add (← readExpr fuel) (← readExpr fuel)
+    | 7 => return .sub (← readExpr fuel) (← readExpr fuel)
+    | 8 => return .mul (← readExpr fuel) (← readExpr fuel)
+    | 9 => return .neg (← readExpr fuel)
+    | _ => throw "invalid compiler expression tag"
+
+private def readNode : Reader Node := do
+  match ← readNat 1 with
+  | 0 => return .konst (← readField)
+  | 1 => return .var (← readColumn)
+  | 2 => return .publicInput (← readNat)
+  | 3 => return .isFirstRow
+  | 4 => return .isLastRow
+  | 5 => return .isTransition
+  | 6 => return .add (← readNat) (← readNat)
+  | 7 => return .sub (← readNat) (← readNat)
+  | 8 => return .mul (← readNat) (← readNat)
+  | 9 => return .neg (← readNat)
+  | _ => throw "invalid compiler node tag"
+
+private def readSpec : Reader (GraphWidths × List ExprLookup × List Expr) := do
+  let widths : GraphWidths := ⟨← readNat, ← readNat, ← readNat, ← readNat⟩
+  let lookups ← readList (← readNat) do
+    let multiplicity ← readExpr 64
+    let args ← readList (← readNat) (readExpr 64)
+    return ExprLookup.mk multiplicity args
+  let constraints ← readList (← readNat) (readExpr 64)
+  return (widths, lookups, constraints)
+
+private def nodeDegree (degrees : Array Nat) : Node → Option Nat
+  | .konst _ | .publicInput _ | .isTransition => some 0
+  | .var _ | .isFirstRow | .isLastRow => some 1
+  | .add a b | .sub a b => return max (← degrees[a]?) (← degrees[b]?)
+  | .mul a b => return (← degrees[a]?) + (← degrees[b]?)
+  | .neg a => degrees[a]?
+
+private def readGraph : Reader BaseCompilation := do
+  let nodes ← readList (← readNat) readNode
+  let mut degrees : Array Nat := #[]
+  for node in nodes do
+    let native ← readNat
+    let some expected := nodeDegree degrees node | throw "native compiler emitted an invalid child read"
+    unless native == expected && native < 2^32 do throw "compiled node degree differs"
+    degrees := degrees.push expected
+  let zeros ← readList (← readNat) readNat
+  let lookups ← readList (← readNat) do
+    let multiplicity ← readNat
+    let args ← readList (← readNat) readNat
+    return Lookup.mk multiplicity args
+  let lookupEnd ← readNat
+  let maximum ← readNat
+  let some zeroDegrees := zeros.mapM (fun index => degrees[index]?) | throw "invalid native zero root"
+  unless maximum == zeroDegrees.foldl max 0 do throw "compiled maximum degree differs"
+  return ⟨⟨nodes, zeros, lookups⟩, lookupEnd⟩
+
+private def readAssignment (widths : GraphWidths) (lookups : List ExprLookup) (constraints : List Expr)
+    (compiled : BaseCompilation) : Reader Nat := do
+  let preCurrent ← readValues
+  let preNext ← readValues
+  let mainCurrent ← readValues
+  let mainNext ← readValues
+  let stageCurrent ← readValues
+  let stageNext ← readValues
+  let publics ← readValues
+  let indicators ← readValues
+  unless preCurrent.size == widths.preprocessed && preNext.size == widths.preprocessed &&
+      mainCurrent.size == widths.main && mainNext.size == widths.main &&
+      stageCurrent.size == widths.stage2 && stageNext.size == widths.stage2 &&
+      publics.size == widths.publics && indicators.size == 3 do throw "compiler assignment dimensions differ"
+  let values : Values G := ⟨(fun source offset => match source, offset with
+      | .preprocessed, .current => preCurrent | .preprocessed, .next => preNext
+      | .main, .current => mainCurrent | .main, .next => mainNext
+      | .stage2, .current => stageCurrent | .stage2, .next => stageNext),
+    publics, indicators[0]?.getD 0, indicators[1]?.getD 0, indicators[2]?.getD 0⟩
+  let native ← readValues
+  unless compiled.graph.sweep goldilocksOps values == some native do throw "compiled graph sweep differs"
+  let nativePrefix ← readValues
+  unless sweepFrom goldilocksOps values.withoutStage2 (compiled.graph.nodes.take compiled.lookupEnd) #[] == some nativePrefix do
+    throw "stored lookup-prefix sweep differs"
+  unless compiled.graph.sweepLookupPrefix goldilocksOps values == some (nativePrefix.extract 0 compiled.graph.lookupPrefix) do
+    throw "root-derived lookup-prefix sweep differs"
+  let original ← readValues
+  unless evalExprs goldilocksOps values constraints == some original.toList do throw "source constraint evaluation differs"
+  let some zeroValues := readNodes native compiled.graph.zeros | throw "compiled zero root cannot be read"
+  unless zeroValues.all (· == 0) == original.all (· == 0) do throw "constraint satisfaction changed during compilation"
+  let nativeLookups ← readList lookups.length do
+    let multiplicity ← readField
+    let args ← readValues
+    return (multiplicity, args.toList)
+  unless lookups.mapM (ExprLookup.eval goldilocksOps values) == some nativeLookups do throw "source lookup evaluation differs"
+  unless compiled.graph.lookups.mapM (readLookup native) == some nativeLookups do throw "compiled lookup evaluation differs"
+  return native.size
+
+private def readCorpus : Reader (Nat × Nat × Nat × Nat) := do
+  let header := "Aiur graph compilation v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "invalid graph compiler snapshot header"
+  let count ← readNat
+  unless count == 1484 do throw "compiler graph case count differs"
+  let mut assignments := 0
+  let mut nodeValues := 0
+  let mut shortened := 0
+  for index in [:count] do
+    let (widths, lookups, constraints) ← readSpec
+    let native ← readGraph
+    let some expected := compileBase widths lookups constraints | throw s!"Lean rejected native graph {index}"
+    unless native == expected do throw s!"compiled graph structure differs at case {index}"
+    unless checkedGraphPrefix widths native.graph == some native.graph.lookupPrefix do throw "compiled graph failed its layout guard"
+    unless native.graph.lookupPrefix ≤ native.lookupEnd && native.lookupEnd ≤ native.graph.nodes.length do throw "invalid stored lookup prefix"
+    if native.graph.lookupPrefix < native.lookupEnd then shortened := shortened + 1
+    for _ in [:8] do
+      nodeValues := nodeValues + (← readAssignment widths lookups constraints native)
+      assignments := assignments + 1
+  unless shortened > 0 do throw "compiler corpus does not cover folded unused lookup nodes"
+  let rejected ← readNat
+  unless rejected == 38 do throw "compiler rejection case count differs"
+  for index in [:rejected] do
+    let (widths, lookups, constraints) ← readSpec
+    unless (compileBase widths lookups constraints).isNone do throw s!"Lean accepted native rejection {index}"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "trailing compiler snapshot bytes"
+  return (count, rejected, assignments, nodeValues)
+
+def main (args : List String) : IO UInt32 := do
+  let [path] := args | throw (IO.userError "usage: aiur-graph-compilation-tests <native-snapshot>")
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((graphs, rejected, assignments, nodes), _) =>
+    IO.println s!"graph compilation: {graphs} complete graphs, {rejected} rejected specifications, {assignments} assignments, {nodes} node values match native Rust"
+    return 0
+
+end AiurTests.GraphCompilation
+
+def main := AiurTests.GraphCompilation.main
diff --git a/Tests/Aiur/Hoisting.lean b/Tests/Aiur/Hoisting.lean
new file mode 100644
index 000000000..5ff0462f7
--- /dev/null
+++ b/Tests/Aiur/Hoisting.lean
@@ -0,0 +1,97 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur
+
+/-! Effect-order regressions for argument normalization. These use the
+actual source compiler, both reference evaluators and the native executor. -/
+
+open Aiur Aiur.Source
+
+namespace Tests.Aiur.Hoisting
+
+private def write (n : Nat) (ret : Term) : Term :=
+  .ioWrite (.field 0) (.array #[.field (G.ofNat n)]) ret
+
+private def program (body : Term) (output : Typ)
+    (safe : sigPointerFree [] output = true) : Toplevel :=
+  ⟨#[], #[], #[Function.monoEntry (Global.init "test") [] output body safe]⟩
+
+private def returningHelper (early : Bool) : Toplevel :=
+  let x : Term := .var (.str "x")
+  let body := if early then
+      .let (.var (.str "y"))
+        (.match x [(.field 0, .ret (.field 7)), (.wildcard, .field 4)])
+        (.add (.var (.str "y")) (.field 1))
+    else .ret (.add x (.field 1))
+  let helper := Function.monoNonEntry (Global.init "helper") [(.str "x", .field)] .field body
+  let main := program (.add (.app (Global.init "helper") [.field 0] .inlined) (.field 3))
+    .field (by simp [sigPointerFree, Typ.hasPointer])
+  { main with functions := #[helper] ++ main.functions }
+
+def fixtures : Array (String × Toplevel × Array Aiur.G × Array Aiur.G) := #[
+  ("set-argument-order", program
+    (.set (.let .wildcard (write 1 .unit) (.array #[.field 5])) 0
+      (.let .wildcard (write 2 .unit) (.field 9))) (.array .field 1)
+    (by simp [sigPointerFree, Typ.hasPointer]), #[9], #[2, 1]),
+  ("operand-core-before-next-frames", program
+    (.add (write 1 (.field 3)) (.let .wildcard (write 2 .unit) (.field 4))) .field
+    (by simp [sigPointerFree, Typ.hasPointer]), #[7], #[1, 2]),
+  ("write-before-continuation", program
+    (write 1 (.let .wildcard (write 2 .unit) (.field 3))) .field
+    (by simp [sigPointerFree, Typ.hasPointer]), #[3], #[1, 2]),
+  ("tuple-element-order", program
+    (.tuple #[write 1 (.field 3), .let .wildcard (write 2 .unit) (.field 4)])
+    (.tuple #[.field, .field]) (by simp [sigPointerFree, Typ.hasPointer]), #[3, 4], #[1, 2]),
+  ("array-element-order", program
+    (.array #[write 1 (.field 3), .let .wildcard (write 2 .unit) (.field 4)])
+    (.array .field 2) (by simp [sigPointerFree, Typ.hasPointer]), #[3, 4], #[1, 2]),
+  ("lexical-binding-scope", program
+    (.let (.var (.str "x")) (.field 10)
+      (.add (.let (.var (.str "x")) (.field 3) (.var (.str "x"))) (.var (.str "x"))))
+    .field (by simp [sigPointerFree, Typ.hasPointer]), #[13], #[]),
+  ("inline-tail-return-boundary", returningHelper false, #[4], #[]),
+  ("inline-early-return-boundary", returningHelper true, #[10], #[]),
+  ("debug-value-before-continuation", program
+    (.debug "debug-value-before-continuation" (some (write 1 (.field 4)))
+      (write 2 (.field 3))) .field (by simp [sigPointerFree, Typ.hasPointer]),
+    #[3], #[1, 2])]
+
+def main : IO Unit := do
+  let mut failures := 0
+  for (label, source, expected, effects) in fixtures do
+    let decls ← IO.ofExcept (source.mkDecls.mapError toString)
+    let (value, io) ← IO.ofExcept
+      ((Source.Eval.runFunction decls (Global.init "test") [] default 100).mapError reprStr)
+    unless flattenValue decls (fun _ => none) value == expected && io.data.getD 0 #[] == effects do
+      throw (IO.userError s!"invalid source fixture: {label}")
+    let (interpreted, state) := Aiur.runFunction decls (Global.init "test") [] default
+    let interpreted ← IO.ofExcept interpreted
+    unless flattenValue decls (fun _ => none) interpreted == expected && state.ioBuffer == io do
+      throw (IO.userError s!"source interpreters disagree: {label}")
+    match source.compile with
+    | .error error =>
+      failures := failures + 1
+      IO.println s!"FAIL {label}: compilation: {error}"
+    | .ok compiled =>
+      let some index := compiled.getFuncIdx `test
+        | throw (IO.userError s!"missing function: {label}")
+      let reference := (Bytecode.Eval.runFunction compiled.bytecode index #[] default 100).mapError reprStr
+      let native := (compiled.bytecode.execute index #[] default).map fun (output, state, _) => (output, state)
+      for (engine, result) in #[("bytecode reference", reference), ("native", native)] do
+        match result with
+        | .error error =>
+          failures := failures + 1
+          IO.println s!"FAIL {label}: {engine}: {error}"
+        | .ok (output, actualIo) =>
+          if output == expected && actualIo == io then IO.println s!"PASS {label}: {engine}"
+          else
+            failures := failures + 1
+            IO.println s!"FAIL {label}: {engine}: output {output}, effects {actualIo.data.getD 0 #[]}; expected {expected}, {effects}"
+  unless failures == 0 do throw (IO.userError s!"{failures} hoisting regressions")
+
+end Tests.Aiur.Hoisting
+
+def main := Tests.Aiur.Hoisting.main
diff --git a/Tests/Aiur/Interpolation.lean b/Tests/Aiur/Interpolation.lean
new file mode 100644
index 000000000..81320cd23
--- /dev/null
+++ b/Tests/Aiur/Interpolation.lean
@@ -0,0 +1,123 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Interpolation
+import Tests.Aiur.EmissionReader
+
+/-! Replay actual native FRI row and matrix folds against the checked
+interpolator, using known coefficient polynomials and arbitrary matrix rows.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.Interpolation
+
+private def readExtension : Reader Extension := return ⟨← readField, ← readField⟩
+
+private def readDomain (bits : Nat) : Reader Domain.Subgroup := do
+  let some domain := Domain.ofLogSize bits | throw "invalid interpolation domain"
+  return domain
+
+private def sample (seed : Nat) : Extension := ⟨G.ofNat (seed * 67 + 3), G.ofNat (seed * 13 + 1)⟩
+
+private def coefficients (arity variant : Nat) : List Extension :=
+  match variant with
+  | 0 => []
+  | 1 => [sample 1]
+  | 2 => (List.range arity).map (fun index => if index + 1 == arity then 1 else 0)
+  | _ => (List.range arity).map (fun index => sample (index + 17))
+
+private def checkValues (expected : List Extension) : Reader Unit := do
+  unless (← readCount expected.length) == expected.length do throw "native interpolation input length differs"
+  unless (← readList expected.length readExtension) == expected do throw "native interpolation inputs differ"
+
+private def readCorpus : Reader (List Nat) := do
+  let header := "Aiur FRI interpolation v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "interpolation version differs"
+  let mut rows := 0
+  let mut evaluations := 0
+  for parentBits in [:33] do
+    let parent ← readDomain parentBits
+    for arityBits in [:min parentBits 6 + 1] do
+      let arity ← readDomain arityBits
+      let size := Domain.size arity
+      let mask := 2^(parentBits - arityBits) - 1
+      let indices := [0, mask / 2, mask] |>.mergeSort (· ≤ ·) |>.eraseDups
+      unless (← readCount 3) == indices.length do throw "interpolation index inventory differs"
+      for index in indices do
+        unless (← readNat) == index do throw "native interpolation index differs"
+        let nodes := (Polynomial.foldingNodes parent arity index).map Extension.ofBase
+        let scale ← readField
+        unless scale == NativeAIR.Interpolation.foldScale parent arity index do throw "native interpolation normalizer differs"
+        for variant in [:4] do
+          let polynomial := coefficients size variant
+          let values := nodes.map (fun node => Quotient.horner node polynomial)
+          checkValues polynomial
+          checkValues values
+          let samples := NativeAIR.Interpolation.foldSamples parent arity index values
+          if arityBits ≤ 3 then
+            let candidate := NativeAIR.Interpolation.coefficients samples (Extension.ofBase scale)
+            unless candidate.length ≤ size && (Polynomial.sub candidate polynomial).all (· == 0) do
+              throw "constructed interpolating coefficients differ from the native source polynomial"
+            let vanishing := Polynomial.fromRoots nodes
+            for node in nodes do
+              unless (node * Extension.ofBase scale) * Quotient.horner node (Polynomial.divide node vanishing) == 1 do
+                throw "interpolation diagonal weight differs"
+          let points := [0, Extension.ofBase 7, sample 41,
+            Extension.ofBase (FriDomain.foldNode parent arity index 0),
+            Extension.ofBase (FriDomain.foldNode parent arity index (size - 1))]
+          for point in points do
+            unless (← readExtension) == point do throw "native interpolation challenge differs"
+            let result ← readExtension
+            unless NativeAIR.Interpolation.foldRow parent arity index values point == some result &&
+                Quotient.horner point polynomial == result do throw "native FRI row interpolation differs"
+            evaluations := evaluations + 1
+          rows := rows + 1
+  let mut matrices := 0
+  let mut matrixRows := 0
+  for parentBits in [1:10] do
+    let parent ← readDomain parentBits
+    for arityBits in [1:min parentBits 6 + 1] do
+      let arity ← readDomain arityBits
+      let size := Domain.size arity
+      let height := 2^(parentBits - arityBits)
+      let data := (List.range (2^parentBits)).map (fun index => sample (index + parentBits * 19))
+      for point in [0, sample 41, 1] do
+        unless (← readExtension) == point do throw "native matrix folding challenge differs"
+        checkValues data
+        unless (← readCount height) == height do throw "native folded matrix height differs"
+        let folded ← readList height readExtension
+        unless folded.length == height do throw "native folded matrix height differs"
+        for index in [:height] do
+          let row := (data.drop (index * size)).take size
+          unless NativeAIR.Interpolation.foldRow parent arity index row point == folded[index]? do
+            throw "native FRI matrix fold differs"
+          matrixRows := matrixRows + 1
+        matrices := matrices + 1
+  let counts := [rows, evaluations, matrices, matrixRows]
+  unless counts == [2436, 12180, 117, 3006] do throw "incomplete interpolation corpus"
+  unless (← readList 4 readNat) == counts do throw "interpolation coverage totals differ"
+  let empty ← readDomain 0
+  let binary ← readDomain 1
+  unless NativeAIR.Interpolation.evaluate 1 0 [] == some 0 &&
+      NativeAIR.Interpolation.foldRow empty binary 0 [0, 1] 0 == none &&
+      NativeAIR.Interpolation.foldRow binary empty 2 [1] 0 == none &&
+      NativeAIR.Interpolation.foldRow binary binary 0 [1] 0 == none &&
+      NativeAIR.Interpolation.foldRow binary binary 0 [1, 2, 3] 0 == none do
+    throw "interpolation helper boundaries differ"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "interpolation snapshot has trailing bytes"
+  return counts
+
+end AiurTests.Interpolation
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.Interpolation.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (counts, _) => IO.println s!"Native FRI interpolation rows, challenge evaluations, matrices and matrix rows match: {counts}"
+  | _ => throw (IO.userError "expected native FRI interpolation snapshot")
diff --git a/Tests/Aiur/KeyCodec.lean b/Tests/Aiur/KeyCodec.lean
new file mode 100644
index 000000000..5b2b69077
--- /dev/null
+++ b/Tests/Aiur/KeyCodec.lean
@@ -0,0 +1,74 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.KeyCodec
+import Tests.Aiur.EmissionReader
+
+/-! Native v5 keys, canonicalization, derived metadata and malformed bytes. -/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+
+namespace AiurTests.KeyBytes
+
+private def readBytes : Reader ByteArray := do takeBytes (← readCount 1048576)
+
+private def readCorpus : Reader (Nat × Nat × Nat × Nat) := do
+  let header := "Aiur key codec v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "key codec snapshot version differs"
+  let count ← readCount 100000
+  let mut accepted := 0
+  let mut noncanonical := 0
+  let mut circuits := 0
+  for index in [:count] do
+    let bytes ← readBytes
+    let expected ← readBool
+    let decoded := KeyCodec.decode bytes
+    unless decoded.isSome == expected do throw s!"key decoder decision differs at case {index}"
+    if expected then
+      let some key := decoded | throw "accepted key missing"
+      accepted := accepted + 1
+      let canonical ← readBytes
+      unless KeyCodec.encode key == canonical do throw s!"key canonical bytes differ at case {index}"
+      unless KeyCodec.decode canonical == some key do throw s!"key round trip differs at case {index}"
+      unless (KeyCodec.decodeCanonical bytes).isSome == (bytes == canonical) do
+        throw s!"canonical key decision differs at case {index}"
+      if bytes != canonical then noncanonical := noncanonical + 1
+      unless (← readCount) == key.circuits.length do throw "key circuit count differs"
+      unless key.preprocessedIndices.length == key.circuits.length do throw "key index count differs"
+      for circuit in key.circuits do
+        circuits := circuits + 1
+        let some degrees := KeyCodec.nodeDegreesFrom circuit.graph.nodes #[]
+          | throw "accepted key has undefined node degrees"
+        let some roots := circuit.graph.zeros.mapM (fun root => degrees[root]?)
+          | throw "accepted key has undefined root degrees"
+        let metadata := [circuit.mainWidth, circuit.preprocessedWidth, circuit.preprocessedHeight,
+          circuit.maxConstraintDegree, circuit.lookupGroupSize, circuit.widths.stage2, circuit.widths.publics,
+          circuit.constraintCount, circuit.graph.lookupPrefix, roots.foldr max 0]
+        unless (← readList 10 readNat) == metadata do throw s!"derived key metadata differs at case {index}"
+        unless (← readList (← readCount 65536) readNat) == degrees.toList do
+          throw s!"key node degrees differ at case {index}"
+        unless circuit.computedDegree == some circuit.maxConstraintDegree do
+          throw "accepted key maximum degree differs"
+        unless (checkedGraphPrefix circuit.widths circuit.graph).isSome do
+          throw "accepted key has invalid graph reads"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "key codec snapshot has trailing bytes"
+  return (count, accepted, noncanonical, circuits)
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((count, accepted, noncanonical, circuits), _) =>
+    unless count == 4536 && accepted == 509 && noncanonical == 22 && circuits == 517 do
+      throw (IO.userError "incomplete key codec corpus")
+    IO.println s!"key codec: {count} native/Lean cases, {accepted} accepted, {noncanonical} noncanonical, {circuits} circuits match"
+
+end AiurTests.KeyBytes
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.KeyBytes.run path
+  | _ => throw (IO.userError "expected native key codec snapshot")
diff --git a/Tests/Aiur/LogUp.lean b/Tests/Aiur/LogUp.lean
new file mode 100644
index 000000000..1e147f32b
--- /dev/null
+++ b/Tests/Aiur/LogUp.lean
@@ -0,0 +1,150 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LogUpAccumulator
+import Tests.Aiur.EmissionReader
+
+/-! Comparison with direct native logUp, its symbolic schoolbook reference,
+and native stage-2 traces. The corpus includes every group size, empty groups,
+uneven tails, variable argument widths, poles and arbitrary extension-valued
+coordinates. Malformed reads are tested only through the checked Lean model. -/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+open LogUp (Coordinates)
+
+namespace AiurTests.LogUp
+
+private def counts : List Nat :=
+  [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 15, 16, 17, 23, 24, 25, 31, 32, 33, 63, 64, 65]
+
+private def readExtension : Reader Extension := do return ⟨← readField, ← readField⟩
+
+private def readVector (readValue : Reader W) : Reader (Array W) := do
+  return (← readList (← readCount 4096) readValue).toArray
+
+private def readLookups : Reader (List Lookup) := do
+  readList (← readCount) do
+    return ⟨← readNat, ← readList (← readCount) readNat⟩
+
+private def readDirectCases {W : Type} [Lean.Grind.CommRing W] [DecidableEq W]
+    (readValue : Reader W) : Reader Unit := do
+  unless (← readCount 10000) == 2376 do throw "incomplete direct logUp cases"
+  for count in counts do
+    for groupSize in [:9] do
+      for seed in [:12] do
+        unless (← readNat) == count && (← readNat) == groupSize && (← readNat) == seed do
+          throw "direct logUp case order differs"
+        let lookups ← readLookups
+        unless lookups.length == count do throw "direct logUp lookup count differs"
+        let nodes ← readVector readValue
+        let current ← readVector readValue
+        let next ← readVector readValue
+        let publics ← readVector readValue
+        let delta ← readVector readValue
+        let isLast ← readValue
+        let expected := (← readVector readValue).toList
+        let evaluate := fun lookups nodes current next publics delta size =>
+          NativeAIR.LogUp.constraintValues lookups nodes current next publics delta isLast size
+        unless evaluate lookups nodes current next publics delta groupSize == some expected do
+          throw s!"native logUp differs: {count} lookups, group {groupSize}, assignment {seed}"
+        unless expected.length == 2 * NativeAIR.LogUp.groupCount groupSize count do throw "logUp coordinate count differs"
+        unless evaluate lookups nodes current.pop next publics delta groupSize == none do throw "short current row accepted"
+        unless evaluate lookups nodes current (next.extract 0 1) publics delta groupSize == none do throw "short next row accepted"
+        unless evaluate lookups nodes current next (publics.extract 0 3) delta groupSize == none do throw "short public input accepted"
+        unless evaluate lookups nodes current next publics (delta.extract 0 1) groupSize == none do throw "short delta accepted"
+        unless evaluate (lookups ++ [⟨nodes.size, []⟩]) nodes current next publics delta groupSize == none do
+          throw "out-of-range multiplicity accepted"
+        unless evaluate (lookups ++ [⟨0, [nodes.size]⟩]) nodes current next publics delta groupSize == none do
+          throw "out-of-range argument accepted"
+        for invalid in [9, 256, 2^64 - 1] do
+          unless evaluate lookups nodes current next publics delta invalid == none do throw "oversized logUp group accepted"
+
+private def readDirect : Reader Unit := do
+  let header := "Aiur grouped logup v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "logUp snapshot version differs"
+  readDirectCases readField
+  readDirectCases readExtension
+
+private def baseCoordinates (values : Array Extension) : Array G :=
+  (Coordinates.flatten (values.toList.map Coordinates.fromExtension)).toArray
+
+private def readStages : Reader Unit := do
+  let header := "Aiur grouped logup stages v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "stage-2 snapshot version differs"
+  unless (← readNat) == 27 do throw "incomplete stage-2 batches"
+  let mut totalRows := 0
+  for groupSize in [:9] do
+    for seed in [:3] do
+      unless (← readNat) == groupSize && (← readNat) == seed do throw "stage-2 batch order differs"
+      let beta ← readExtension
+      let gamma ← readExtension
+      let mut entering ← readExtension
+      unless (← readNat) == 5 do throw "incomplete stage-2 circuits"
+      for (expectedHeight, expectedLookups) in [(1, 0), (2, 1), (4, 9), (8, 17), (4, 25)] do
+        let height ← readNat
+        let count ← readNat
+        let width ← readNat
+        unless height == expectedHeight && count == expectedLookups &&
+            width == NativeAIR.LogUp.groupCount groupSize count do throw "stage-2 circuit shape differs"
+        let matrix ← readVector readExtension
+        unless matrix.size == height * width do throw "stage-2 matrix length differs"
+        let leaving ← readExtension
+        let normalizer ← readField
+        unless normalizer != 0 do throw "zero last-row normalizer"
+        let delta := (Coordinates.fromExtension (leaving - entering)).scale normalizer.inverse
+        let publics := baseCoordinates #[beta, gamma, entering, leaving]
+        let mut running : Extension := 0
+        for row in [:height] do
+          let lookups ← readList (← readCount) do return (← readField, (← readVector readField).toList)
+          unless lookups.length == count do throw "stage-2 row lookup count differs"
+          let native := (← readVector readField).toList
+          let betaPair := Coordinates.fromExtension beta
+          let gammaPair := Coordinates.fromExtension gamma
+          let entries := NativeAIR.LogUp.fieldEntries (NativeAIR.LogUp.compress betaPair gammaPair lookups)
+          unless entries.all (fun entry => entry.2 != 0) do throw "unexpected stage-2 pole"
+          let rowFraction := NativeAIR.LogUp.lookupFractions betaPair gammaPair lookups
+          let before := running
+          for group in [:width] do
+            unless matrix[row * width + group]? == some running do throw "native partial accumulator differs"
+            let chunk := NativeAIR.LogUp.chunk groupSize group lookups
+            running := running + NativeAIR.LogUp.lookupFractions betaPair gammaPair chunk
+          unless running == before + rowFraction do throw "grouping changes the row fraction"
+          let current := baseCoordinates (matrix.extract (row * width) ((row + 1) * width))
+          let nextIndex := (row + 1) % height
+          let next := baseCoordinates (matrix.extract (nextIndex * width) ((nextIndex + 1) * width))
+          let isLast := if row + 1 == height then normalizer else 0
+          let evaluated := NativeAIR.LogUp.equations lookups current next publics
+            #[delta.c0, delta.c1] isLast groupSize
+          unless evaluated.map Coordinates.flatten == some native do throw "native stage-2 equations differ"
+          unless native.all (· == 0) do throw "native stage-2 equations do not vanish"
+          let some first := Coordinates.read current 0 | throw "missing stage-2 first accumulator"
+          let some following := Coordinates.read next 0 | throw "missing stage-2 next accumulator"
+          unless following.toExtension - first.toExtension + (delta.scale isLast).toExtension == rowFraction do
+            throw "stage-2 row does not telescope"
+          totalRows := totalRows + 1
+        unless entering + running == leaving do throw "native circuit accumulator differs"
+        entering := leaving
+  unless totalRows == 513 do throw "incomplete stage-2 row corpus"
+
+private def runReader (reader : Reader Unit) (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match reader.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok (_, (_, cursor)) =>
+    unless cursor == bytes.size do throw (IO.userError "logUp snapshot has trailing bytes")
+
+def run (direct stages : System.FilePath) : IO Unit := do
+  runReader readDirect direct
+  IO.println "logUp: 4752 native direct/reference cases and 42768 rejected malformed inputs match"
+  runReader readStages stages
+  IO.println "logUp stages: 27 batches, 135 circuits and 513 complete rows match native accumulators and equations"
+
+end AiurTests.LogUp
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [direct, stages] => AiurTests.LogUp.run direct stages
+  | _ => throw (IO.userError "expected native direct logUp and stage-2 snapshots")
diff --git a/Tests/Aiur/LookupBudget.lean b/Tests/Aiur/LookupBudget.lean
new file mode 100644
index 000000000..56a470542
--- /dev/null
+++ b/Tests/Aiur/LookupBudget.lean
@@ -0,0 +1,61 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.LookupBudget
+
+/-! Native/Lean guard comparison across all u8 exponents, machine/field
+boundaries, active-position indexing and malformed metadata lengths. -/
+
+open Aiur
+
+namespace AiurTests.LookupBudget
+
+private def appendResult (bytes : ByteArray) (result : Option Nat) : ByteArray := Id.run do
+  let mut bytes := bytes.push (if result.isSome then 1 else 0)
+  let value := result.getD 0
+  for index in [:8] do
+    bytes := bytes.push ((value >>> (8 * index)) % 256).toUInt8
+  return bytes
+
+private def expected : ByteArray := Id.run do
+  let mut out := "Aiur lookup budget v1\n".toUTF8
+  let p := gSize.toNat
+  let cases := [0, 1, 2, 3, 4, 255, 65536, 2 ^ 31, 2 ^ 32, 2 ^ 32 - 1,
+    p / 2 - 1, p - 3, p - 2, p - 1, p, 2 ^ 64 - 1]
+  for slots in cases do
+    for degree in [:256] do
+      out := appendResult out (lookupQueryBound [slots] [true] [degree])
+      out := appendResult out (lookupQueryBound [2 ^ 64 - 1, slots, 2 ^ 64 - 1]
+        [false, true, false] [degree])
+      out := appendResult out (lookupQueryBound [slots, 3] [true, true] [degree, 31])
+      out := appendResult out (lookupQueryBound [3, slots] [true, true] [31, degree])
+  let slots := [2, 7, 0, 13]
+  for slotCount in [:5] do
+    for activeCount in [:5] do
+      for mask in [:2 ^ activeCount] do
+        let active := (List.range activeCount).map fun bit => mask &&& (2 ^ bit) != 0
+        for degreeCount in [:6] do
+          for degree in [0, 1, 31, 63, 64, 255] do
+            out := appendResult out (lookupQueryBound (slots.take slotCount) active
+              (List.replicate degreeCount degree))
+  return out
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  unless expected.size == "Aiur lookup budget v1\n".toUTF8.size + 21964 * 9 do
+    throw (IO.userError "incomplete lookup-budget corpus")
+  unless native.size == expected.size do
+    throw (IO.userError s!"lookup-budget snapshot size differs: {native.size} / {expected.size}")
+  for i in [:expected.size] do
+    unless native[i]! == expected[i]! do
+      throw (IO.userError s!"lookup-budget mismatch at byte {i}: {native[i]!} / {expected[i]!}")
+  IO.println "lookup budget: 21,964 native/Lean boundary, alignment and active-height checks match"
+
+end AiurTests.LookupBudget
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.LookupBudget.run path
+  | _ => throw (IO.userError "expected native lookup-budget snapshot path")
diff --git a/Tests/Aiur/LookupShapes.lean b/Tests/Aiur/LookupShapes.lean
new file mode 100644
index 000000000..5950de5e3
--- /dev/null
+++ b/Tests/Aiur/LookupShapes.lean
@@ -0,0 +1,93 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.LookupShapes
+
+/-! Native parity for the structural validators. The corpus deliberately
+varies shapes independently of value indices and layouts. These programs
+are used only by the validators, never by an evaluator or AIR emitter. -/
+
+namespace AiurTests.LookupShapes
+
+open Aiur Aiur.Bytecode
+
+def returning (size : Nat) : Block := ⟨#[], .return 0 (Array.replicate size 0)⟩
+
+def yielding (size : Nat) : Block := ⟨#[], .yield 0 (Array.replicate size 0)⟩
+
+def matched (arm fallback : Option Block) : Block :=
+  ⟨#[], .match 0 (match arm with | none => #[] | some block => #[(0, block)]) fallback⟩
+
+def continued (arm continuation : Block) : Block :=
+  ⟨#[], .matchContinue 0 #[(0, arm)] (some (yielding 2)) 2 0 0 continuation⟩
+
+def body : Nat → Block
+  | 0 => returning 0
+  | 1 => returning 1
+  | 2 => returning 2
+  | 3 => yielding 0
+  | 4 => yielding 1
+  | 5 => matched (some (returning 1)) (some (returning 1))
+  | 6 => matched (some (returning 0)) (some (returning 1))
+  | 7 => matched (some (returning 1)) none
+  | 8 => matched none none
+  | 9 => continued (yielding 2) (returning 1)
+  | 10 => continued (returning 1) (returning 1)
+  | 11 => continued (returning 0) (returning 1)
+  | 12 => continued (yielding 1) (returning 1)
+  | 13 => continued (yielding 2) (yielding 0)
+  | 14 => continued (continued (yielding 2) (yielding 2)) (returning 1)
+  | 15 => continued (continued (yielding 2) (yielding 1)) (returning 1)
+  | _ => matched (some (continued (returning 1) (returning 1))) (some (returning 1))
+
+def function (body : Block) (inputs : Nat) (entry constrained : Bool) : Function :=
+  ⟨body, ⟨inputs, 1, 7, 4⟩, entry, constrained⟩
+
+def expected : ByteArray := Id.run do
+  let mut out := "Aiur lookup shapes v1\n".toUTF8
+  for tag in [:17] do
+    for size in [:4] do
+      out := out.push (if (body tag).returnsHaveSize size then 1 else 0)
+  for tag in [:17] do
+    for calleeInputs in [:4] do
+      for callerInputs in [:4] do
+        for outputs in [:4] do
+          for advice in [false, true] do
+            for constrained in [false, true] do
+              let caller := function
+                ⟨#[.call 1 (Array.replicate callerInputs 0) outputs advice], .return 0 #[]⟩
+                3 true true
+              let callee := function (body tag) calleeInputs false constrained
+              let program : Toplevel := ⟨#[caller, callee], #[], #[]⟩
+              out := out.push (if program.validateLookupShapes then 1 else 0)
+  for tag in [:17] do
+    for inputs in [:4] do
+      for entry in [false, true] do
+        for constrained in [false, true] do
+          let program : Toplevel := ⟨#[function (body tag) inputs entry constrained], #[], #[]⟩
+          for channel in [:3] do
+            for functionIndex in [0, 1, 99] do
+              for arguments in [:7] do
+                let claim := #[G.ofNat channel, G.ofNat functionIndex] ++ Array.replicate arguments 0
+                out := out.push (if program.validClaimShape claim then 1 else 0)
+  return out
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  unless expected.size == "Aiur lookup shapes v1\n".toUTF8.size + 21556 do
+    throw (IO.userError "incomplete lookup-shape corpus")
+  unless native.size == expected.size do
+    throw (IO.userError s!"lookup-shape snapshot size differs: {native.size} / {expected.size}")
+  for i in [:expected.size] do
+    unless native[i]! == expected[i]! do
+      throw (IO.userError s!"lookup-shape mismatch at byte {i}: {native[i]!} / {expected[i]!}")
+  IO.println "lookup shapes: 21,556 native/Lean return, call, continuation and public-claim checks match"
+
+end AiurTests.LookupShapes
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.LookupShapes.run path
+  | _ => throw (IO.userError "expected native lookup-shape snapshot path")
diff --git a/Tests/Aiur/MemoryRows.lean b/Tests/Aiur/MemoryRows.lean
new file mode 100644
index 000000000..3af1fd66e
--- /dev/null
+++ b/Tests/Aiur/MemoryRows.lean
@@ -0,0 +1,72 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.MemoryColumns
+
+open Aiur Aiur.AIR
+
+namespace AiurTests.MemoryRows
+
+private def appendNat (out : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut out := out
+  for i in [:8] do
+    out := out.push ((value >>> (8 * i)) % 256).toUInt8
+  return out
+
+private def appendValues (out : ByteArray) (values : List G) : ByteArray :=
+  values.foldl (fun out value => appendNat out value.n) (appendNat out values.length)
+
+private def row (height pattern index width : Nat) : MemoryColumns width := fun column =>
+  let choices : List G := [0, 1, 0 - 1, 255, 256, G.ofNat (2^32), G.ofNat (2^48 - 1), 17]
+  let selector : G := match pattern % 8 with
+    | 0 => 0
+    | 1 => 1
+    | 2 => if index < (height + 1) / 2 then 1 else 0
+    | 3 => if index + 1 == height then 1 else 0
+    | 4 => if index % 2 == 0 then 1 else 0
+    | 5 => 2
+    | 6 => 0 - 1
+    | _ => choices[(index + pattern) % 8]?.getD 0
+  if pattern == 0 then 0
+  else match column.val with
+    | 0 => if pattern < 8 && selector == 0 then 0 else choices[(3 * index + pattern) % 8]?.getD 0
+    | 1 => selector
+    | 2 => if pattern < 16 then (0 - 1) + G.ofNat index else G.ofNat (255 + 2 * index)
+    | column => choices[(5 * column + 3 * index + pattern) % 8]?.getD 0
+
+private def expected : ByteArray × Nat := Id.run do
+  let mut out := appendNat "Aiur memory rows v1\n".toUTF8 25
+  let mut checked := 0
+  for width in [0, 1, 2, 4, 8] do
+    for height in [0, 1, 2, 4, 8] do
+      for value in [width, height, 3 + width, 1, 24] do
+        out := appendNat out value
+      for pattern in [:24] do
+        let matrix := fun index : Fin height => row height pattern index.val width
+        for index in List.finRange height do
+          out := appendValues out (memoryMatrixEquations width height matrix index)
+          let (multiplicity, message) := memoryColumnLookup width (matrix index)
+          out := appendNat out multiplicity.n
+          out := appendValues out message
+          checked := checked + 1
+  return (out, checked)
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  let (expected, checked) := expected
+  unless checked == 1800 do throw (IO.userError "incomplete memory-row corpus")
+  unless native.size == expected.size do
+    throw (IO.userError s!"memory-row snapshot size differs: {native.size} / {expected.size}")
+  for i in [:expected.size] do
+    unless native[i]! == expected[i]! do
+      throw (IO.userError s!"memory-row mismatch at byte {i}: {native[i]!} / {expected[i]!}")
+  IO.println s!"memory rows: {checked} native/Lean assignments across 25 width/height pairs match"
+
+end AiurTests.MemoryRows
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.MemoryRows.run path
+  | _ => throw (IO.userError "expected native memory-row snapshot path")
diff --git a/Tests/Aiur/Merkle.lean b/Tests/Aiur/Merkle.lean
new file mode 100644
index 000000000..f91e44dd5
--- /dev/null
+++ b/Tests/Aiur/Merkle.lean
@@ -0,0 +1,82 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Merkle
+import Tests.Aiur.EmissionReader
+
+/-! Compare binary path replay with the actual pinned MMCS verifier,
+including the complete sequence of byte inputs and native BLAKE3 outputs. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.Merkle AiurTests.EmissionReader
+
+namespace AiurTests.Merkle
+
+private def readDigest : Reader Digest := do
+  let bytes ← takeBytes 32
+  if length : bytes.data.size = 32 then return ⟨bytes.data, length⟩
+  else throw "incomplete Merkle digest"
+
+private def readDigests : Reader (List Digest) := do
+  readList (← readCount) readDigest
+
+private def readCall : Reader (List UInt8 × Digest) := do
+  let input ← takeBytes (← readCount 100000)
+  return (input.data.toList, ← readDigest)
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur Merkle paths v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "Merkle path snapshot version differs"
+  for count in [8913, 1802, 1161, 3941, 16456] do
+    unless (← readNat) == count do throw "incomplete native Merkle path corpus"
+  let mut accepted := 0
+  let mut omitted := 0
+  let mut unhashed := 0
+  let mut calls := 0
+  for case in [:8913] do
+    let dimensions ← readList (← readCount) do
+      return Dimensions.mk (← readCount) (← readCount 32)
+    let capHeight ← readCount
+    let index ← readCount
+    let rows ← readList (← readCount) readValues
+    let proof ← readDigests
+    let cap ← readDigests
+    let native ← readBool
+    let coverage ← readBool
+    let hashes ← readList (← readCount) readCall
+    unless covered dimensions capHeight == coverage do throw s!"Merkle coverage differs at {case}"
+    unless verify Blake3.digest dimensions capHeight index cap rows proof == native do
+      throw s!"Merkle decision differs at {case}"
+    unless verifyCovered Blake3.digest dimensions capHeight index cap rows proof == (native && coverage) do
+      throw s!"covered Merkle decision differs at {case}"
+    match replay Blake3.digest dimensions capHeight index rows proof with
+    | none =>
+      unless hashes.isEmpty do throw s!"native hashed a structurally rejected path at {case}"
+      unhashed := unhashed + 1
+    | some result =>
+      unless result.hashing.inputs == hashes.map Prod.fst do
+        throw s!"Merkle hash input sequence differs at {case}"
+      unless result.logHeight == min capHeight (maxHeight dimensions) &&
+          result.index == index / 2^proof.length do throw "Merkle final position differs"
+      unless hashes.getLast?.map Prod.snd == some result.hashing.digest do
+        throw s!"Merkle final digest differs at {case}"
+    for (input, output) in hashes do
+      unless Blake3.digest input == output do throw s!"native Merkle hash output differs at {case}"
+    if native then accepted := accepted + 1
+    if native && !coverage then omitted := omitted + 1
+    calls := calls + hashes.length
+  unless accepted == 1802 && omitted == 1161 && unhashed == 3941 && calls == 16456 do
+    throw "Merkle path coverage totals differ"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "Merkle path snapshot has trailing bytes"
+
+end AiurTests.Merkle
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.Merkle.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok _ => IO.println "Merkle paths: 8913 native/Lean decisions and 16456 hash calls match"
+  | _ => throw (IO.userError "expected native Merkle path snapshot")
diff --git a/Tests/Aiur/MerkleCap.lean b/Tests/Aiur/MerkleCap.lean
new file mode 100644
index 000000000..b4ff2e890
--- /dev/null
+++ b/Tests/Aiur/MerkleCap.lean
@@ -0,0 +1,38 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.MerkleCap
+import Tests.Aiur.EmissionReader
+
+/-! Every native degree byte, mixed/uniform/empty batches and machine
+parameter boundaries for the binary Merkle cap coverage guard. -/
+
+open Aiur.NativeAIR AiurTests.EmissionReader
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur Merkle caps v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "Merkle cap snapshot version differs"
+  let parameters : List Nat := [0, 1, 2, 3, 8, 16, 31, 32, 63, 64, 255, 256, 65535, 2^64 - 256, 2^64 - 1]
+  let mut total := 0
+  for blowup in parameters do
+    for cap in parameters do
+      unless (← readBool) == MerkleCap.coverage blowup cap [] do throw "empty cap geometry differs"
+      total := total + 1
+      for degree in [:256] do
+        for degrees in [[degree], [degree, 0], [degree, 8, 16], [degree, degree], [255, degree]] do
+          unless (← readBool) == MerkleCap.coverage blowup cap degrees do
+            throw s!"Merkle cap coverage differs: blowup {blowup}, cap {cap}, degrees {degrees}"
+          total := total + 1
+  unless total == 288225 do throw "incomplete Merkle cap cases"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "Merkle cap snapshot has trailing bytes"
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok _ => IO.println "Merkle caps: 288225 native/Lean degree and parameter cases match"
+  | _ => throw (IO.userError "expected native Merkle cap snapshot")
diff --git a/Tests/Aiur/OperationExpressions.lean b/Tests/Aiur/OperationExpressions.lean
new file mode 100644
index 000000000..d7f9de6bd
--- /dev/null
+++ b/Tests/Aiur/OperationExpressions.lean
@@ -0,0 +1,138 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Aiur.EmissionReader
+import Ix.Aiur.Proofs.EmissionAllocation
+
+/-! Compare complete native operation and sequence expression trees, including
+metadata, cursor movement, equations, and superposed physical lookup slots.
+The corpus supplies the actual native operations, inputs, and assignments. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.OpEmitter Aiur.NativeAIR.Compiler
+
+namespace AiurTests.OperationExpressions
+
+open AiurTests.EmissionReader
+
+private def assignment (row : Array G) : Values G :=
+  ⟨(fun source _ => match source with | .main => row | _ => #[]), #[], 1, 0, 1⟩
+
+private def callData (calls : List (Bytecode.AIR.Call × (Fin 6 → G))) :=
+  calls.map fun (call, gap) => (call, List.ofFn gap)
+
+private def sameEmission (left right : AIR.OpsEmission) : Bool :=
+  left.values == right.values && left.column == right.column && left.equations == right.equations &&
+    left.queries == right.queries && callData left.calls == callData right.calls
+
+private def readSequence (rows : List (Array G)) (label : String) : Reader (List LookupEmitter.QueryExpr × Nat) := do
+  let first ← readNat
+  let lookup ← readNat
+  let selector ← readExpr 64
+  let rank ← readExpr 64
+  let inputs ← readMap
+  let ops ← readList (← readCount) readOp
+  unless inputs.all (·.expr.noConstantNegs) do throw s!"invalid incoming normal form: {label}"
+  let some emitted := emitOps selector rank ops inputs first
+    | throw s!"symbolic operation sequence rejected native inputs: {label}"
+  let column ← readNat
+  let lookupEnd ← readNat
+  let nativeMap ← readMap
+  let equations ← readList (← readCount) (readExpr 64)
+  unless column == emitted.column && lookupEnd == lookup + emitted.queries.length do
+    throw s!"native operation cursor differs: {label}"
+  unless nativeMap == emitted.values do
+    throw s!"native output expression or degree differs: {label}; ops {repr ops}"
+  unless equations == emitted.equations do
+    throw s!"native operation constraint trees differ: {label}; ops {repr ops}"
+  unless emitted.values.all (·.expr.noConstantNegs) do
+    throw s!"native output lost the negation invariant: {label}"
+  let validDegrees := inputs.all fun row => row.degree != 0 || row.expr.isConstant
+  if validDegrees then
+    let initial : Concrete.Bytecode.LayoutMState :=
+      ⟨{ inputSize := inputs.size, selectors := 0, auxiliaries := first, lookups := lookup },
+        .empty, rowDegrees inputs⟩
+    let layout := ((ops.toArray.forM Concrete.Bytecode.opLayout).run initial).2
+    unless rowDegrees nativeMap == layout.degrees && column == layout.functionLayout.auxiliaries do
+      throw s!"native operation degrees or column allocation differs from compiler: {label}"
+    unless emitted.values.all (fun row => row.degree != 0 || row.expr.isConstant) do
+      throw s!"native operation lost the degree-zero constant invariant: {label}"
+  for (row, seed) in rows.zipIdx do
+    let expected ← readList nativeMap.size do return (← readField, ← readBool)
+    let equationValues ← readList equations.length readField
+    let values := assignment row
+    let some evaluated := emitted.eval values | throw s!"symbolic evaluation failed: {label}, {seed}"
+    unless evaluated.values.toList.map (fun value => (value.value, value.constant)) == expected &&
+        evaluated.equations == equationValues do
+      throw s!"native operation values differ: {label}, assignment {seed}"
+    let some inputValues := evalRows values inputs | throw "undefined native input expressions"
+    let some s := evalExpr values selector | throw "undefined native selector"
+    let some r := evalExpr values rank | throw "undefined native rank"
+    let some valued := AIR.emitOps (fun index => row[index]?.getD 0) s r ops inputValues first
+      | throw s!"valued operation sequence rejected symbolic inputs: {label}"
+    unless sameEmission evaluated valued do throw s!"symbolic/valued sequence differs: {label}, {seed}"
+  return (LookupEmitter.queryParts lookup selector emitted.queries, if validDegrees then 1 else 0)
+
+private def readReport (rows : List (Array G)) (index : Nat) : Reader (Nat × Nat × Nat) := do
+  let branchless ← readBool
+  let writers ← readCount 3
+  unless writers == 1 || writers == 3 do throw "unexpected native writer count"
+  let mut queries := []
+  let mut allocations := 0
+  for writer in [:writers] do
+    let (parts, checked) ← readSequence rows s!"report {index}, writer {writer}"
+    queries := queries ++ parts
+    allocations := allocations + checked
+  let count ← readCount 64
+  for slot in [:count] do
+    let native : ExprLookup := ⟨← readExpr 64, ← readList (← readCount) (readExpr 64)⟩
+    let expected := LookupEmitter.slot branchless queries slot
+    unless native == expected do throw s!"native lookup expression trees differ: report {index}, slot {slot}"
+    for (row, seed) in rows.zipIdx do
+      let weight ← readField
+      let message ← readValues
+      let values := assignment row
+      unless expected.eval goldilocksOps values == some (weight, message) do
+        throw s!"native slot values differ: report {index}, slot {slot}, assignment {seed}"
+      let some parts := queries.mapM (LookupEmitter.QueryExpr.eval values)
+        | throw "undefined raw query expressions"
+      unless weight == AIR.querySlotMultiplicity parts slot &&
+          message == AIR.slotMessage branchless (AIR.querySlotParts parts slot) do
+        throw "symbolic slot and valued query parts differ"
+  return (writers, (if writers == 3 then 1 else 0), allocations)
+
+private def readCorpus : Reader Nat := do
+  let header := "Aiur operation expressions v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "operation snapshot version differs"
+  unless (← readCount) == 4 do throw "incomplete operation assignments"
+  let rows ← readList 4 do return (← readValues).toArray
+  unless rows.all (·.size == 512) do throw "operation assignment width differs"
+  unless (← readCount) == 876 do throw "incomplete operation expression corpus"
+  let mut sequences := 0
+  let mut shared := 0
+  let mut allocations := 0
+  for index in [:876] do
+    let (count, combined, checked) ← readReport rows index
+    sequences := sequences + count
+    shared := shared + combined
+    allocations := allocations + checked
+  unless sequences == 1752 && shared == 438 do throw "incomplete native operation coverage"
+  unless allocations == 1168 do throw "incomplete degree-valid compiler allocation coverage"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "operation snapshot has trailing bytes"
+  return allocations
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok (allocations, _) =>
+    IO.println s!"operation expressions: 1,752 native sequences, 7,008 assignments, 438 shared-slot cases and {allocations} compiler allocations match"
+
+end AiurTests.OperationExpressions
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.OperationExpressions.run path
+  | _ => throw (IO.userError "expected native operation expression snapshot")
diff --git a/Tests/Aiur/OperationRows.lean b/Tests/Aiur/OperationRows.lean
new file mode 100644
index 000000000..c24c4d224
--- /dev/null
+++ b/Tests/Aiur/OperationRows.lean
@@ -0,0 +1,144 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.OperationRows
+import Ix.Aiur.Proofs.SelectorMessages
+
+/-! Compare evaluated native operation emission with Lean, including every
+operation constructor, constant folding, virtual/materialized values, logical
+output reuse, column allocation, constraints and selector-gated query parts. -/
+
+open Aiur Aiur.AIR Aiur.Bytecode
+
+namespace AiurTests.OperationRows
+
+private def fixtures : List (List Op) := [
+  [.const 0], [.const 1], [.const (0 - 1)],
+  [.add 0 1], [.add 0 3], [.add 3 4],
+  [.sub 1 2], [.sub 0 3], [.sub 3 4],
+  [.mul 0 3], [.mul 1 3], [.mul 2 1], [.mul 3 4], [.mul 5 6],
+  [.eqZero 0], [.eqZero 1], [.eqZero 2], [.eqZero 3], [.eqZero 4], [.eqZero 5],
+  [.call 17 #[3, 4, 5] 0 false], [.call 17 #[3, 4, 5] 2 false],
+  [.call 17 #[3, 4, 5] 0 true], [.call 17 #[3, 4, 5] 2 true],
+  [.store #[]], [.store #[0, 3, 4]], [.load 0 3], [.load 3 4],
+  [.assertEq #[] #[] none], [.assertEq #[0, 3, 4] #[1, 4, 3] (some "row")],
+  [.ioGetInfo 0 #[1, 2]], [.ioRead 0 0 0], [.ioRead 0 3 2],
+  [.ioSetInfo 0 #[1, 2] 3 4], [.ioWrite 0 #[3, 4]],
+  [.debug "row" none], [.debug "row" (some #[3, 4])],
+  [.u8BitDecomposition 3], [.u8ShiftLeft 3], [.u8ShiftRight 3],
+  [.u8Xor 3 4], [.u8Add 3 4], [.u8Sub 3 4], [.u8And 3 4], [.u8Or 3 4],
+  [.u8LessThan 3 4], [.u8RangeCheck 3 4], [.u8Mul 3 4],
+  [.u8XorSplit7 3 4], [.u8XorSplit4 3 4], [.u32LessThan 3 4],
+  [.unconstrainedBigUintDivMod 3 4], [.unconstrainedGToBytes 3], [.unconstrainedGInverse 4],
+  [.unconstrainedU32Add #[0, 1, 2, 3] #[4, 5, 6, 7]],
+  [.unconstrainedU32Add3 #[0, 1, 2, 3] #[4, 5, 6, 7] #[7, 6, 5, 4]],
+  [.u32ToField #[0, 1, 2, 3]], [],
+  [.const 0, .mul 8 3],
+  [.mul 3 4, .add 8 3, .eqZero 9],
+  [.unconstrainedGToBytes 3, .u8RangeCheck 8 9, .u8Add 8 9,
+    .assertEq #[16] #[3] none, .unconstrainedGInverse 17],
+  [.store #[3, 4], .load 2 8, .call 17 #[9, 10] 2 false, .u8Xor 11 12],
+  [.ioRead 0 0 4, .unconstrainedU32Add #[8, 9, 10, 11] #[0, 1, 2, 7],
+    .u32ToField #[12, 13, 14, 15]],
+  [.eqZero 0, .add 8 1, .sub 9 1, .mul 10 7],
+  [.unconstrainedBigUintDivMod 3 4, .call 17 #[8, 9] 0 false, .debug "row" none]]
+
+private def inputValues (row : Nat → G) : Array RowValue := #[
+  RowValue.konst 0, RowValue.konst 1, RowValue.konst (0 - 1),
+  RowValue.variable (row 0), RowValue.variable (row 1),
+  RowValue.variable (row 0 + row 1), RowValue.variable (row 2), RowValue.konst 257]
+
+private def row (seed : Nat) (selector : G) (index : Nat) : G :=
+  let choices : Array G := #[0, 1, 255, 256, 0 - 1, 0 - 2,
+    G.ofNat (2 ^ 32 - 1), G.ofNat (2 ^ 32), G.ofNat (2 ^ 48 - 1), 17, 3, 65536]
+  match index with
+  | 0 => choices[seed]?.getD 0
+  | 1 => choices[(seed + 1) % 12]?.getD 0
+  | 2 => choices[(seed + 2) % 12]?.getD 0
+  | 3 => selector
+  | index => choices[(seed + 5 * index) % 12]?.getD 0
+
+private def appendNat (out : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut out := out
+  for i in [:8] do
+    out := out.push ((value >>> (8 * i)) % 256).toUInt8
+  return out
+
+private def appendValues (out : ByteArray) (values : List G) : ByteArray :=
+  values.foldl (fun out value => appendNat out value.n) (appendNat out values.length)
+
+private def encode (branchless : Bool) (selector : G) (emission : OpsEmission) : ByteArray := Id.run do
+  let mut out := appendNat ByteArray.empty emission.column
+  out := appendNat out emission.values.size
+  for value in emission.values do
+    out := appendNat out value.value.n
+    out := appendNat out value.degree
+    out := appendNat out (if value.constant then 1 else 0)
+  out := appendValues out emission.equations
+  out := appendNat out emission.queries.length
+  for query in emission.queries do
+    out := appendNat out selector.n
+    out := appendValues out (gateMessage branchless selector query)
+  return out
+
+private def expected (header : String) (fixtures : List (List Op)) : Except String (Array (String × ByteArray)) := do
+  let mut records := #[("header", appendNat header.toUTF8 fixtures.length)]
+  for branchless in [false, true] do
+    for seed in [:12] do
+      for selector in ([0, 1, 2, 0 - 1] : List G) do
+        let row := row seed selector
+        for (ops, index) in fixtures.zipIdx do
+          let label := s!"fixture {index}, seed {seed}, selector {selector.n}, branchless {branchless}"
+          let some emission := emitOps row selector (row 2) ops (inputValues row) 4
+            | throw s!"unexpected rejected emission: {label}"
+          records := records.push (label, encode branchless selector emission)
+  return records
+
+private def compare (path : System.FilePath) (header : String) (fixtures : List (List Op))
+    (count : Nat) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  let records ← match expected header fixtures with
+    | .ok records => pure records
+    | .error error => throw (IO.userError error)
+  unless records.size == count + 1 do
+    throw (IO.userError s!"incomplete operation-row corpus: {records.size - 1}")
+  let mut position := 0
+  for (label, expected) in records do
+    unless position + expected.size ≤ native.size do
+      throw (IO.userError s!"short operation-row snapshot at {label}")
+    for i in [:expected.size] do
+      unless native[position + i]! == expected[i]! do
+        throw (IO.userError s!"operation-row mismatch at {label}, byte {i} (absolute {position + i}): {native[position + i]!} / {expected[i]!}")
+    position := position + expected.size
+  unless position == native.size do
+    throw (IO.userError s!"extra operation-row snapshot data: {native.size - position} bytes")
+
+def run (path : System.FilePath) : IO Unit := do
+  unless fixtures.length == 65 do throw (IO.userError "incomplete operation fixture corpus")
+  compare path "Aiur operation rows v1\n" fixtures 6240
+  IO.println "operation rows: 6,240 native/Lean assignments across all 34 constructors and output-reusing sequences match"
+
+def runConstantDegree (path : System.FilePath) : IO Unit := do
+  let fixtures : List (List Op) := [
+    [.const 0, .mul 8 3, .eqZero 9],
+    [.const 0, .mul 3 8, .eqZero 9],
+    [.mul 0 3, .add 8 1, .eqZero 9],
+    [.mul 0 3, .sub 0 8, .eqZero 9],
+    [.mul 0 3, .eqZero 8, .eqZero 9],
+    [.mul 0 3, .eqZero 8, .mul 9 3],
+    [.mul 0 3, .mul 8 1, .eqZero 9],
+    [.mul 0 3, .sub 2 8, .eqZero 9]]
+  compare path "Aiur constant degree rows v1\n" fixtures 768
+  IO.println "constant degree rows: 768 native/Lean arbitrary assignments across eight sequences match"
+
+end AiurTests.OperationRows
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.OperationRows.run path
+  | [path, constantPath] =>
+    AiurTests.OperationRows.run path
+    AiurTests.OperationRows.runConstantDegree constantPath
+  | _ => throw (IO.userError "expected native operation-row snapshot and optional constant-degree snapshot")
diff --git a/Tests/Aiur/Polynomial.lean b/Tests/Aiur/Polynomial.lean
new file mode 100644
index 000000000..1f385f760
--- /dev/null
+++ b/Tests/Aiur/Polynomial.lean
@@ -0,0 +1,125 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Polynomial
+import Tests.Aiur.EmissionReader
+
+/-! Compare the native final-polynomial Horner iterator and independent
+upstream coefficient operations over both native fields.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+
+namespace AiurTests.Polynomial
+
+private def baseSample (seed : Nat) : G := if seed == 2 then 0 - 1 else G.ofNat seed
+
+private def extensionSample (seed : Nat) : ProofCodec.Extension :=
+  if seed < 3 then .ofBase (baseSample seed) else ⟨G.ofNat (seed * 67), G.ofNat (seed + 1)⟩
+
+private def coefficients [OfNat R 0] [OfNat R 1] (length seed : Nat) (sample : Nat → R) : List R :=
+  (List.range length).map fun index =>
+    if seed == 0 then 0
+    else if seed == 1 then if index + 1 == length then 1 else 0
+    else if seed == 2 && index ≥ length / 2 then 0
+    else sample (seed * 67 + index * 13 + 3)
+
+private def readCases [Lean.Grind.CommRing R] [BEq R] [LawfulBEq R]
+    (sample : Nat → R) (readValue : Reader R) : Reader (List Nat) := do
+  let readValues := do readList (← readCount) readValue
+  let domain ← readValues
+  unless domain == (List.range 80).map sample do throw "native polynomial sample domain differs"
+  let mut count := 0
+  let mut divisions := 0
+  let mut zeroCases := 0
+  let mut rootSets := 0
+  let mut repeatedSets := 0
+  for length in [0, 1, 2, 3, 4, 7, 8, 9, 16, 31, 32, 65] do
+    for rightLength in [0, 1, length, length + 3] do
+      for seed in [:8] do
+        let left ← readValues
+        let right ← readValues
+        unless left == coefficients length seed sample && right == coefficients rightLength seed sample do
+          throw "polynomial coefficient inventory differs"
+        let root ← readValue
+        let point ← readValue
+        unless root == sample seed && point == (if seed % 3 == 0 then root else sample (seed + 19)) do
+          throw "polynomial evaluation point inventory differs"
+        let atPoint ← readValue
+        let atRoot ← readValue
+        let rightValue ← readValue
+        unless atPoint == Quotient.horner point left && atRoot == Quotient.horner root left &&
+            rightValue == Quotient.horner point right do throw "native Horner iterator differs"
+        let added ← readValues
+        let difference ← readValues
+        unless added == Polynomial.add left right && difference == Polynomial.sub left right do
+          throw "native coefficient addition or subtraction differs"
+        unless Quotient.horner point added == atPoint + rightValue &&
+            Quotient.horner point difference == atPoint - rightValue do throw "coefficient evaluation identity differs"
+        if left.isEmpty then
+          unless (Polynomial.divide root left).isEmpty do throw "total empty quotient differs"
+        else
+          let quotient ← readValues
+          let remainder ← readValue
+          unless quotient == Polynomial.divide root left && remainder == atRoot do
+            throw "native synthetic quotient or remainder differs"
+          unless quotient.length + 1 == left.length &&
+              (point - root) * Quotient.horner point quotient + remainder == atPoint do
+            throw "synthetic division identity differs"
+          divisions := divisions + 1
+        let roots ← readNat
+        let agreements ← readNat
+        unless roots == domain.countP (fun value => Quotient.horner value left == 0) &&
+            agreements == domain.countP (fun value => Quotient.horner value difference == 0) do
+          throw "native polynomial root counts differ"
+        if left.all (· == 0) then zeroCases := zeroCases + 1
+        else unless roots < left.length do throw "polynomial exceeds its distinct-root bound"
+        unless difference.all (· == 0) || agreements < max left.length right.length do
+          throw "different polynomials exceed their agreement bound"
+        count := count + 1
+  for length in [0, 1, 2, 3, 7, 16, 31, 32, 63] do
+    for variant in [:4] do
+      let roots ← readValues
+      let expected := (List.range length).map fun index => sample
+        (if variant == 0 then index else if variant == 1 then length - index - 1
+          else if variant == 2 then 0 else index / 2)
+      unless roots == expected do throw "native root-set inventory differs"
+      let polynomial ← readValues
+      unless polynomial == Polynomial.fromRoots roots do throw "native vanishing coefficients differ"
+      unless polynomial.length == roots.length + 1 && polynomial.getLast? == some 1 do
+        throw "native vanishing polynomial is not monic"
+      for point in [sample 0, sample 2, sample 17, sample 79] do
+        let value ← readValue
+        unless value == Quotient.horner point polynomial && value == LogUp.product (roots.map (point - ·)) do
+          throw "native vanishing evaluation differs"
+      let rootCount ← readNat
+      unless rootCount == domain.countP (fun point => Quotient.horner point polynomial == 0) && rootCount ≤ roots.length do
+        throw "native vanishing root count differs"
+      let repeated := roots.eraseDups.length != roots.length
+      if repeated then repeatedSets := repeatedSets + 1
+      else unless rootCount == roots.length do throw "native distinct-root polynomial lost a root"
+      rootSets := rootSets + 1
+  return [count, divisions, zeroCases, rootSets, repeatedSets]
+
+private def readCorpus : Reader (List Nat × List Nat) := do
+  let header := "Aiur coefficient polynomials v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "polynomial snapshot version differs"
+  let base ← readCases baseSample readField
+  let extension ← readCases extensionSample (do return ⟨← readField, ← readField⟩)
+  unless (← readList 10 readNat) == base ++ extension do throw "native polynomial coverage totals differ"
+  unless base == [384, 352, 80, 36, 14] && extension == base do throw "incomplete native polynomial corpus"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "polynomial snapshot has trailing bytes"
+  return (base, extension)
+
+end AiurTests.Polynomial
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.Polynomial.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (counts, _) => IO.println s!"Native polynomial arithmetic/divisions/zero cases/root sets/repeated sets match: {counts}"
+  | _ => throw (IO.userError "expected native coefficient polynomial snapshot")
diff --git a/Tests/Aiur/ProofCodec.lean b/Tests/Aiur/ProofCodec.lean
new file mode 100644
index 000000000..0a4adb0cd
--- /dev/null
+++ b/Tests/Aiur/ProofCodec.lean
@@ -0,0 +1,92 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ShapedVerifier
+import Tests.Aiur.EmissionReader
+
+/-! Native serde decisions and every field of honest and malformed proofs. -/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+
+namespace AiurTests.ProofBytes
+
+private def vector (item : α → List Nat) (values : List α) : List Nat :=
+  values.length :: values.flatMap item
+
+private def extension (value : ProofCodec.Extension) : List Nat := [value.c0.n, value.c1.n]
+
+private def hashes (values : ProofCodec.Cap) : List Nat := vector (List.map UInt8.toNat) values
+
+private def openings (item : α → List Nat) (values : ProofCodec.Openings α) : List Nat :=
+  vector (vector (vector item)) values
+
+private def view (value : ProofCodec.Data) : List Nat :=
+  vector (fun degree => [degree.toNat]) value.logDegrees ++
+  vector (fun active => [if active then 1 else 0]) value.active ++
+  openings extension value.stage2 ++ openings extension value.stage1 ++
+  (match value.preprocessed with | none => [0] | some values => 1 :: openings extension values) ++
+  openings extension value.quotient ++ vector extension value.accumulators ++
+  hashes value.commitments.quotient ++ hashes value.commitments.stage2 ++ hashes value.commitments.stage1 ++
+  [value.fri.queryPowWitness.n] ++ vector extension value.fri.finalPoly ++
+  vector (fun step => hashes step.siblingHashes ++ vector (vector extension) step.siblingValues ++
+    [step.logArity.toNat]) value.fri.commitOpenings ++
+  vector (fun batch => hashes batch.siblingHashes ++ openings (fun x => [x.n]) batch.values) value.fri.inputOpenings ++
+  vector (fun x => [x.n]) value.fri.commitPowWitnesses ++ vector hashes value.fri.commits
+
+private def readBytes : Reader ByteArray := do takeBytes (← readCount 16777216)
+
+private def readCorpus : Reader (Nat × Nat × Nat) := do
+  let header := "Aiur proof codec v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "proof codec snapshot version differs"
+  let keys ← readList (← readCount) readBytes
+  unless keys.length == 4 do throw "missing honest proof systems"
+  let keys ← keys.mapM fun bytes => do
+    let some key := KeyCodec.decodeCanonical bytes | throw "honest proof key is not canonical"
+    return key
+  let count ← readCount 100000
+  let mut accepted := 0
+  let mut suffixed := 0
+  for index in [:count] do
+    let bytes ← readBytes
+    let expected ← readBool
+    let parsed := ProofCodec.readData bytes.data.toList
+    unless parsed.isSome == expected do throw s!"native proof parsing differs at case {index}"
+    if expected then
+      let some (value, rest) := parsed | throw "missing parsed proof"
+      let canonical ← readBytes
+      let words ← readList (← readCount 16777216) readNat
+      unless view value == words do throw s!"native proof fields differ at case {index}"
+      unless ProofCodec.encode value == canonical do throw s!"native proof encoding differs at case {index}"
+      if accepted % 5 == 0 then
+        let some key := keys[accepted / 5]? | throw "missing honest proof key"
+        unless (ProofShape.check key value).isSome && ProofShape.fixedHeights key value &&
+            (ProofShape.queryBound key value).isSome do throw "native proof fails preceding shape guards"
+        unless (BoundVerifier.readProof key canonical).isOk == MerkleCap.check key value do
+          throw "native proof cap coverage differs from checked admission"
+      unless ProofCodec.decodeCanonical canonical == some value do throw "canonical proof round trip failed"
+      unless (ProofCodec.decodeCanonical bytes).isSome == (bytes == canonical) do
+        throw "canonical proof framing differs"
+      unless (ProofCodec.decode bytes).isSome == rest.isEmpty do throw "proof suffix framing differs"
+      accepted := accepted + 1
+      if !rest.isEmpty then suffixed := suffixed + 1
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "proof codec snapshot has trailing bytes"
+  return (count, accepted, suffixed)
+
+def run (path : System.FilePath) : IO Unit := do
+  let bytes ← IO.FS.readBinFile path
+  match readCorpus.run (bytes, 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((count, accepted, suffixed), _) =>
+    unless count == 3636 && accepted == 20 && suffixed == 8 do
+      throw (IO.userError "incomplete proof codec corpus")
+    IO.println s!"proof codec: {count} native/Lean byte cases, {accepted} decoded field records, {suffixed} native suffixes rejected by exact framing"
+
+end AiurTests.ProofBytes
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.ProofBytes.run path
+  | _ => throw (IO.userError "expected native proof codec snapshot")
diff --git a/Tests/Aiur/ProofShape.lean b/Tests/Aiur/ProofShape.lean
new file mode 100644
index 000000000..af39afeb0
--- /dev/null
+++ b/Tests/Aiur/ProofShape.lean
@@ -0,0 +1,63 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ShapedVerifier
+import Tests.Aiur.EmissionReader
+
+/-! Native shape decisions, every u8 domain exponent, independently changed
+matrix dimensions, inactive circuits, fixed heights and global budgets. -/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+
+namespace AiurTests.ProofShapes
+
+private def readBytes : Reader ByteArray := do takeBytes (← readCount 16777216)
+
+private def readCorpus : Reader (Nat × Nat × Nat) := do
+  let header := "Aiur proof shapes v2\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "proof shape snapshot version differs"
+  let systems ← readCount
+  let mut total := 0
+  let mut accepted := 0
+  let mut guarded := 0
+  for system in [:systems] do
+    let some key := KeyCodec.decodeCanonical (← readBytes) | throw "invalid shape key"
+    let count ← readCount 100000
+    total := total + count
+    for index in [:count] do
+      let bytes ← readBytes
+      let some proof := ProofCodec.decodeCanonical bytes | throw "invalid shape proof framing"
+      let expected ← readOption (do readList (← readCount) readNat)
+      let fixed ← readBool
+      let bound ← readOption readNat
+      let cap ← readBool
+      let checked := ProofShape.check key proof
+      unless checked.map (List.map (ProofShape.quotientDegree ∘ ProofShape.Row.circuit)) == expected do
+        throw s!"native opening shape differs at system {system}, case {index}"
+      unless ProofShape.fixedHeights key proof == fixed do throw "fixed proof heights differ"
+      unless ProofShape.queryBound key proof == bound do throw "proof lookup budget differs"
+      unless MerkleCap.check key proof == cap do throw "proof Merkle cap coverage differs"
+      let ready := (BoundVerifier.readProof key bytes).isOk
+      unless ready == (expected.isSome && fixed && bound.isSome && cap) do throw "checked proof guard differs"
+      if checked.isSome then accepted := accepted + 1
+      if ready then guarded := guarded + 1
+  unless systems == 4 do throw "missing proof shape systems"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "proof shape snapshot has trailing bytes"
+  return (total, accepted, guarded)
+
+def run (path : System.FilePath) : IO Unit := do
+  match readCorpus.run ((← IO.FS.readBinFile path), 0) with
+  | .error error => throw (IO.userError error)
+  | .ok ((total, accepted, guarded), _) =>
+    unless total == 4696 && accepted == 510 do throw (IO.userError "incomplete proof shape corpus")
+    IO.println s!"proof shapes: {total} native/Lean cases, {accepted} accepted shapes, {guarded} pass fixed-height and budget guards"
+
+end AiurTests.ProofShapes
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.ProofShapes.run path
+  | _ => throw (IO.userError "expected native proof shape snapshot")
diff --git a/Tests/Aiur/PrunedMerkle.lean b/Tests/Aiur/PrunedMerkle.lean
new file mode 100644
index 000000000..05f7a5520
--- /dev/null
+++ b/Tests/Aiur/PrunedMerkle.lean
@@ -0,0 +1,97 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.PrunedMerkle
+import Ix.Aiur.Proofs.PrunedMerkle
+import Tests.Aiur.EmissionReader
+
+/-! Actual native shared openings, complete logs on success and failure,
+and reconstructed individual paths with their queried-input inclusion. -/
+
+open Aiur Aiur.NativeAIR Aiur.NativeAIR.PrunedMerkle AiurTests.EmissionReader
+
+namespace AiurTests.PrunedMerkle
+
+private def readDigest : Reader Merkle.Digest := do
+  let bytes ← takeBytes 32
+  if length : bytes.data.size = 32 then return ⟨bytes.data, length⟩
+  else throw "incomplete shared Merkle digest"
+
+private def readDigests : Reader (List Merkle.Digest) := do
+  readList (← readCount) readDigest
+
+private def readCall : Reader (List UInt8 × Merkle.Digest) := do
+  let input ← takeBytes (← readCount 100000)
+  return (input.data.toList, ← readDigest)
+
+private def readCorpus : Reader Nat := do
+  let header := "Aiur pruned Merkle v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "shared Merkle snapshot version differs"
+  let expected ← readList 6 readNat
+  let cases := expected[0]!
+  unless expected == [7946, 1619, 1069, 3854, 2534, 42803] do throw "incomplete shared Merkle corpus"
+  let mut accepted := 0
+  let mut omitted := 0
+  let mut unhashed := 0
+  let mut late := 0
+  let mut calls := 0
+  let mut paths := 0
+  for case in [:cases] do
+    let dimensions ← readList (← readCount) do
+      return Merkle.Dimensions.mk (← readCount) (← readCount 32)
+    let capHeight ← readCount
+    let indices ← readList (← readCount) readNat
+    let rows ← readList (← readCount) do readList (← readCount) readValues
+    let proof ← readDigests
+    let cap ← readDigests
+    let native ← readBool
+    let coverage ← readBool
+    let hashes ← readList (← readCount) readCall
+    let result := replay Blake3.digest dimensions capHeight indices rows proof
+    unless result.inputs == hashes.map Prod.fst do
+      throw s!"shared Merkle hash input sequence differs at {case}"
+    unless verify Blake3.digest dimensions capHeight indices cap rows proof == native do
+      throw s!"shared Merkle decision differs at {case}"
+    unless Merkle.covered dimensions capHeight == coverage do throw "shared Merkle coverage differs"
+    unless verifyCovered Blake3.digest dimensions capHeight indices cap rows proof == (native && coverage) do
+      throw "covered shared Merkle decision differs"
+    for (input, output) in hashes do
+      unless Blake3.digest input == output do throw s!"shared native hash output differs at {case}"
+    if let some nodes := result.result then
+      let tickets := nodes.flatMap Node.tickets
+      unless tickets.length == (uniqueIndices indices).length do throw "shared ticket count differs"
+      for (index, values) in indices.zip rows do
+        unless tickets.any (fun ticket => ticket.index == index && ticket.rows == values) do
+          throw "shared reconstruction lost a query"
+      for node in nodes do
+        for ticket in node.tickets do
+          let some path := Merkle.replay Blake3.digest dimensions capHeight ticket.index ticket.rows ticket.proof
+            | throw "shared reconstruction has an invalid individual path"
+          unless path.index == node.index && path.hashing.digest == node.digest do
+            throw "shared reconstruction reaches a different node"
+          unless path.hashing.inputs.all result.inputs.contains do
+            throw "shared reconstruction uses an unrecorded hash input"
+          paths := paths + 1
+    if native then accepted := accepted + 1
+    if native && !coverage then omitted := omitted + 1
+    if hashes.isEmpty then unhashed := unhashed + 1
+    if !native && !hashes.isEmpty then late := late + 1
+    calls := calls + hashes.length
+  unless expected == [cases, accepted, omitted, unhashed, late, calls] do
+    throw "shared Merkle coverage totals differ"
+  unless paths == 19709 do throw "incomplete reconstructed individual paths"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "shared Merkle snapshot has trailing bytes"
+  return paths
+
+end AiurTests.PrunedMerkle
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    match AiurTests.PrunedMerkle.readCorpus.run ((← IO.FS.readBinFile path), 0) with
+    | .error message => throw (IO.userError message)
+    | .ok (paths, _) => IO.println s!"Shared Merkle: 7946 native decisions, 42803 hash calls and {paths} individual paths match"
+  | _ => throw (IO.userError "expected native shared Merkle snapshot")
diff --git a/Tests/Aiur/SelectorControl.lean b/Tests/Aiur/SelectorControl.lean
new file mode 100644
index 000000000..4ca4e5b03
--- /dev/null
+++ b/Tests/Aiur/SelectorControl.lean
@@ -0,0 +1,110 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ReturnGates
+
+/-! Native/Lean comparison for the actual shared argument combiner, block
+selectors, selector polynomial projection and nearest-continuation yield
+collection. Fixtures include arbitrary field assignments, nested continuations,
+early returns, inactive branches and different raw message lengths. -/
+
+open Aiur Aiur.AIR Aiur.Bytecode
+
+namespace AiurTests.SelectorControl
+
+private def appendNat (out : ByteArray) (value : Nat) : ByteArray := Id.run do
+  let mut out := out
+  for i in [:8] do
+    out := out.push ((value >>> (8 * i)) % 256).toUInt8
+  return out
+
+private def appendValues (out : ByteArray) (values : List G) : ByteArray :=
+  values.foldl (fun out value => appendNat out value.n) (appendNat out values.length)
+
+private def leaf (seed next : Nat) : Block × Nat :=
+  (⟨#[], if seed % 2 == 0 then .return next #[] else .yield next #[]⟩, next + 1)
+
+private def fixture : Nat → Nat → Nat → Block × Nat
+  | 0, seed, next => leaf seed next
+  | depth + 1, seed, next =>
+    if seed % 5 == 0 then leaf seed next
+    else
+      let (left, next) := fixture depth (seed * 3 + 1) next
+      let (right, next) := fixture depth (seed * 3 + 2) next
+      let (fallback, next) := if seed % 2 == 0 then
+          let (block, next) := fixture depth (seed * 3 + 3) next
+          (some block, next)
+        else (none, next)
+      let branches := #[(0, left), (1, right)]
+      if seed % 3 == 0 then (⟨#[], .match 0 branches fallback⟩, next)
+      else
+        let (continuation, next) := fixture depth (seed * 3 + 4) next
+        (⟨#[], .matchContinue 0 branches fallback 0 0 0 continuation⟩, next)
+
+private def assignment (pattern index count : Nat) : G :=
+  match pattern with
+  | 0 => 0
+  | 1 => 1
+  | 2 => 2
+  | 3 => 0 - 1
+  | 4 => G.ofNat (index + 1)
+  | 5 => 0 - G.ofNat (index + 1)
+  | 6 => if index % 2 == 0 then 1 else 0
+  | 7 => [0, 0 - 1, 1, 2][index % 4]?.getD 0
+  | pattern => if pattern < 8 + count then
+      (if index == pattern - 8 then 1 else 0)
+    else if index != pattern - 8 - count then 1 else 0
+
+private def expected : ByteArray × Nat × Nat := Id.run do
+  let mut out := appendNat "Aiur selector control v1\n".toUTF8 48
+  let mut controls := 0
+  let mut messages := 0
+  for depth in [:4] do
+    for seed in [:12] do
+      let (block, count) := fixture depth seed 0
+      out := appendNat out count
+      out := appendNat out (8 + 2 * count)
+      for pattern in [:8 + 2 * count] do
+        let flow := block.selectorFlow fun index => assignment pattern index count
+        out := appendNat out flow.entry.n
+        out := appendValues out ([99, 100] ++ flow.yields)
+        out := appendValues out flow.equations
+        let gates := block.returnGates (fun index => assignment pattern index count) flow.entry
+        out := appendValues out (weightedMessage
+          (gates.map fun selector => (selector, [0, 37, 3, 19, 257])))
+        controls := controls + 1
+  out := appendNat out (2 * 7 * 32 * 8)
+  for branchless in [false, true] do
+    for count in [:7] do
+      for seed in [:32] do
+        for pattern in [:8] do
+          let parts := (List.range count).map fun index =>
+            (assignment pattern index count,
+              (List.range ((seed + index * 3) % 8)).map fun offset =>
+                let value := G.ofNat (17 + seed + index * 5 + offset * 11)
+                if (seed + offset) % 2 == 0 then value else 0 - value)
+          out := appendNat out (selectorSum (parts.map Prod.fst)).n
+          out := appendValues out (slotMessage branchless parts)
+          messages := messages + 1
+  return (out, controls, messages)
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  let (expected, controls, messages) := expected
+  unless messages == 3584 do
+    throw (IO.userError "incomplete shared-message corpus")
+  unless native.size == expected.size do
+    throw (IO.userError s!"selector-control snapshot size differs: {native.size} / {expected.size}")
+  for i in [:expected.size] do
+    unless native[i]! == expected[i]! do
+      throw (IO.userError s!"selector-control mismatch at byte {i}: {native[i]!} / {expected[i]!}")
+  IO.println s!"selector control: {controls} native/Lean assignments and {messages} shared messages match"
+
+end AiurTests.SelectorControl
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.SelectorControl.run path
+  | _ => throw (IO.userError "expected native selector-control snapshot path")
diff --git a/Tests/Aiur/SourceValues.lean b/Tests/Aiur/SourceValues.lean
new file mode 100644
index 000000000..067363e10
--- /dev/null
+++ b/Tests/Aiur/SourceValues.lean
@@ -0,0 +1,43 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Semantics.Flatten
+
+/-! Hash snapshots from the original native derivation. Source evaluation
+uses these hashes for its memory buckets; totalization must retain them. -/
+
+open Aiur
+
+namespace Tests.Aiur.SourceValues
+
+def fixtures : Array Value := Id.run do
+  let global := Global.init "value"
+  let other := global.pushNamespace "child"
+  let mut values := #[Value.unit, .tuple #[], .array #[], .ctor global #[], .fn global, .fn other]
+  for n in #[0, 1, 255, 256, 65536, 18446744069414584320] do
+    let field := Value.field (G.ofNat n)
+    let contents := #[Value.unit, field, .pointer n (n + 1)]
+    values := values ++ #[field, .pointer n 0, .pointer 0 n, .pointer n n,
+      .tuple contents, .array contents, .ctor global contents, .ctor other contents,
+      .tuple contents.reverse, .array contents.reverse]
+  let mut nested := Value.field 7
+  for depth in [:33] do
+    nested := match depth % 3 with
+      | 0 => .tuple #[nested, .unit]
+      | 1 => .array #[.field (G.ofNat depth), nested]
+      | _ => .ctor other #[nested, .pointer depth (depth + 1)]
+    values := values.push nested
+  return values
+
+private def report (values : Array Value) : IO Unit := do
+  IO.println s!"SOURCE VALUE HASH FIXTURES {values.size}"
+  for h : i in [:values.size] do
+    IO.println s!"VALUE {i} HASH {hash values[i]}"
+
+def main : IO Unit := report fixtures
+
+end Tests.Aiur.SourceValues
+
+def main := Tests.Aiur.SourceValues.main
diff --git a/Tests/Aiur/TailMatches.lean b/Tests/Aiur/TailMatches.lean
new file mode 100644
index 000000000..2df4f97a5
--- /dev/null
+++ b/Tests/Aiur/TailMatches.lean
@@ -0,0 +1,81 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Stages.Source
+
+/-! Native syntax snapshots captured before replacing partial tail-match
+restoration. Every term and pattern constructor occurs. Tail positions,
+non-tail subexpressions, distinct local names and nested matches are covered. -/
+
+open Aiur Aiur.Source
+
+namespace Tests.Aiur.TailMatches
+
+private def eta (name : Local) (value : Term) : Term :=
+  .let (.var name) value (.var name)
+
+private def constructors (value : Term) : Array Term :=
+  let global := Global.init "fixture"
+  #[.unit, .var (.str "x"), .ref global, .field 7,
+    .tuple #[value], .array #[value], .ret value,
+    .let .wildcard value value, .match value [(.wildcard, value)],
+    .app global [value] .normal, .app global [value] .unconstrained,
+    .app global [value] .inlined,
+    .add value value, .sub value value, .mul value value, .eqZero value,
+    .proj value 0, .get value 0, .slice value 0 1, .set value 0 value,
+    .store value, .load value, .ptrVal value, .ann .field value,
+    .assertEq value value none value, .assertEq value value (some "check") value,
+    .ioGetInfo value value, .ioSetInfo value value value value value,
+    .ioRead value value 1, .ioWrite value value value,
+    .u8BitDecomposition value, .u8ShiftLeft value, .u8ShiftRight value,
+    .u8Xor value value, .u8Add value value, .u8Mul value value,
+    .u8Sub value value, .u8And value value, .u8Or value value,
+    .u8LessThan value value, .u32LessThan value value,
+    .u8XorSplit7 value value, .u8XorSplit4 value value,
+    .unconstrainedU32Add value value, .unconstrainedU32Add3 value value value,
+    .u32ToField value, .unconstrainedBigUintDivMod value value,
+    .unconstrainedGToBytes value, .unconstrainedGInverse value,
+    .u8Lit 255, .u8RangeCheck value value, .toField value,
+    .u8FromFieldUnsafe value, .debug "message" none value,
+    .debug "message" (some value) value]
+
+private def patterns : Array Pattern :=
+  #[.var (.str "x"), .var (.idx 0), .wildcard,
+    .ref (Global.init "Ctor") [.var (.str "x")], .field 7,
+    .tuple #[.var (.str "x")], .array #[.wildcard],
+    .or (.field 7) (.var (.str "x")), .pointer (.var (.str "x"))]
+
+def fixtures : Array Term := Id.run do
+  let name : Local := .str "x"
+  let wrapped := eta name (.field 7)
+  let mut terms := #[]
+  for term in constructors wrapped do
+    terms := terms ++ #[term, eta name term,
+      .let (.var name) term (.var (.str "y")),
+      .let .wildcard wrapped (eta name term)]
+  for pattern in patterns do
+    terms := terms ++ #[.let pattern wrapped wrapped,
+      .match wrapped [(pattern, wrapped), (.wildcard, eta name (.ret wrapped))]]
+  for x in #[Local.str "x", .str "0", .idx 0, .idx 1] do
+    for y in #[Local.str "x", .str "0", .idx 0, .idx 1] do
+      terms := terms.push (.let (.var x) wrapped (.var y))
+  terms := terms ++ #[.match wrapped [], .match wrapped [(.field 9, wrapped)]]
+  let mut nested := wrapped
+  for depth in [:25] do
+    nested := eta (.idx depth)
+      (.match wrapped [(.field 7, nested), (.wildcard, eta name (.ret wrapped))])
+    terms := terms.push nested
+  return terms
+
+private def report (terms : Array Term) : IO Unit := do
+  IO.println s!"TAIL MATCH FIXTURES {terms.size}"
+  for h : i in [:terms.size] do
+    IO.println s!"TERM {i} {(repr terms[i].restoreTailMatches).pretty 1000000}"
+
+def main : IO Unit := report fixtures
+
+end Tests.Aiur.TailMatches
+
+def main := Tests.Aiur.TailMatches.main
diff --git a/Tests/Aiur/TraceHeights.lean b/Tests/Aiur/TraceHeights.lean
new file mode 100644
index 000000000..2f6b0d4f3
--- /dev/null
+++ b/Tests/Aiur/TraceHeights.lean
@@ -0,0 +1,49 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.ByteColumns
+
+open Aiur
+
+namespace AiurTests.TraceHeights
+
+private def append (out : ByteArray) (heights : List Nat) (active : List Bool) (degrees : List Nat) : ByteArray :=
+  out.push (if fixedTraceHeights heights active degrees then 1 else 0)
+
+private def expected : ByteArray := Id.run do
+  let mut out := "Aiur fixed trace heights v1\n".toUTF8
+  for height in [0, 1, 2, 3, 256, 65536, 2^31, 2^32, 2^63, 2^64 - 1] do
+    for degree in [:256] do
+      out := append out [height] [true] [degree]
+      out := append out [0, height, 0] [false, true, false] [degree]
+      out := append out [0, height, 65536] [true, true, true] [2, degree, 16]
+  let heights := [0, 256, 0, 65536]
+  for heightCount in [:5] do
+    for activeCount in [:5] do
+      for mask in [:2^activeCount] do
+        let active := (List.range activeCount).map fun bit => (mask &&& (2^bit)) != 0
+        for degreeCount in [:6] do
+          for degree in [0, 1, 7, 8, 9, 15, 16, 17, 63, 64, 255] do
+            out := append out (heights.take heightCount) active (List.replicate degreeCount degree)
+  return out
+
+def run (path : System.FilePath) : IO Unit := do
+  let native ← IO.FS.readBinFile path
+  let reference := expected
+  unless reference.size == "Aiur fixed trace heights v1\n".toUTF8.size + 17910 do
+    throw (IO.userError "incomplete fixed-trace-height corpus")
+  unless native.size == reference.size do
+    throw (IO.userError s!"fixed-trace-height snapshot size differs: {native.size} / {reference.size}")
+  for index in [:reference.size] do
+    unless native[index]! == reference[index]! do
+      throw (IO.userError s!"fixed-trace-height mismatch at byte {index}: {native[index]!} / {reference[index]!}")
+  IO.println "fixed trace heights: all 17,910 native/Lean checks match"
+
+end AiurTests.TraceHeights
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.TraceHeights.run path
+  | _ => throw (IO.userError "expected native fixed-trace-height snapshot path")
diff --git a/Tests/Aiur/Transcript.lean b/Tests/Aiur/Transcript.lean
new file mode 100644
index 000000000..f10d214fc
--- /dev/null
+++ b/Tests/Aiur/Transcript.lean
@@ -0,0 +1,212 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.Transcript
+import Ix.Aiur.Proofs.Blake3
+import Tests.Aiur.EmissionReader
+import Blake3.Rust
+
+/-! Comparison with the instrumented native verifier, including challenger
+calls in PCS verification. Replay uses the checked concrete Blake3 hash;
+the test also compares it with the independent FFI implementation.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open NativeAIR.Challenger
+
+namespace AiurTests.Transcript
+
+private def nativeHash (bytes : List UInt8) : Fin 32 → UInt8 :=
+  let digest := Blake3.Rust.hash bytes.toByteArray
+  fun index => digest.val[index.val]'(by simpa only [digest.property] using index.isLt)
+
+private def pureHash : Hash32 := NativeAIR.Blake3.hash
+
+private def readBytes : Reader (List UInt8) := do
+  return (← takeBytes (← readCount 10000000)).data.toList
+
+private inductive Event where
+  | observe (bytes : List UInt8)
+  | field (value : G)
+  | bits (count value : Nat)
+  | byte (value : UInt8)
+  deriving DecidableEq, Repr
+
+private def readEvent : Reader Event := do
+  match ← readNat 1 with
+  | 0 => return .observe (← readBytes)
+  | 1 => return .field (← readField)
+  | 2 => return .bits (← readNat) (← readNat)
+  | 3 => return .byte (← readNat 1).toUInt8
+  | _ => throw "invalid transcript event"
+
+private def runEvent (state : State) (event : Event) : Except String State := do
+  match event with
+  | .observe bytes => return observeBytes state bytes
+  | .field expected =>
+    unless sampleField pureHash 16 state == sampleField nativeHash 16 state do throw "pure/FFI field sampling differs"
+    let some (actual, next) := sampleField pureHash 16 state | throw "native transcript field exhausted"
+    unless actual == expected do throw "native transcript field differs"
+    return next
+  | .bits bits expected =>
+    unless sampleBits pureHash bits state == sampleBits nativeHash bits state do throw "pure/FFI bit sampling differs"
+    let some (actual, next) := sampleBits pureHash bits state | throw "native transcript bit count invalid"
+    unless actual == expected do throw "native transcript bits differ"
+    return next
+  | .byte expected =>
+    unless sampleByte pureHash state == sampleByte nativeHash state do throw "pure/FFI byte sampling differs"
+    let (actual, next) := sampleByte pureHash state
+    unless actual == expected do throw "native transcript byte differs"
+    return next
+
+private def observed : List Event → List UInt8 × List Event
+  | .observe bytes :: rest =>
+    let (more, remaining) := observed rest
+    (bytes ++ more, remaining)
+  | rest => ([], rest)
+
+private def stage (expected : List UInt8) (value : ProofCodec.Extension) (events : List Event) :
+    Except String (List Event) := do
+  let (bytes, rest) := observed events
+  unless bytes == expected do throw "native transcript observation schedule differs"
+  match rest with
+  | .field c0 :: .field c1 :: rest =>
+    unless c0 == value.c0 && c1 == value.c1 do throw "native transcript extension basis order differs"
+    return rest
+  | _ => throw "native transcript extension sample missing"
+
+private def checkSchedule (key : KeyCodec.Key) (proof : ProofCodec.Data) (claims : List (List G))
+    (result : NativeAIR.Transcript.Replay) (events : List Event) : Except String (List Event) := do
+  let ch := result.challenges
+  let rest ← stage (NativeAIR.Transcript.prefixBytes key proof claims) ch.beta events
+  let rest ← stage (ProofCodec.encodeExtension ch.beta) ch.gamma rest
+  let rest ← stage (ProofCodec.encodeExtension ch.gamma ++ proof.commitments.stage2.flatten ++
+    proof.accumulators.flatMap ProofCodec.encodeExtension) ch.alpha rest
+  stage proof.commitments.quotient.flatten ch.zeta rest
+
+private def readStreams : Reader Unit := do
+  unless (← readNat) == 16 do throw "incomplete byte-stream cases"
+  for seed in [:16] do
+    let bytes ← readBytes
+    unless bytes.length == seed * 17 do throw "byte-stream seed length differs"
+    unless (← readNat) == 80 do throw "incomplete byte-stream operations"
+    let events ← readList 80 readEvent
+    let final ← ofExcept (events.foldlM runEvent (initial bytes))
+    unless final.pending.length ≤ 32 do throw "byte-stream pending buffer oversized"
+
+private def readRejections : Reader Unit := do
+  unless (← readNat) == 16 do throw "incomplete rejection cases"
+  let mut rejected := 0
+  for mask in [:16] do
+    unless (← readNat 1) == mask do throw "rejection mask differs"
+    let first ← takeBytes 32
+    let later ← takeBytes 32
+    let hash : Hash32 := fun input index =>
+      (if input.length == 1 then first else later)[index.val]!
+    let c0 ← readField
+    let c1 ← readField
+    let firstAttempts ← readCount 5
+    let secondAttempts ← readCount 4
+    unless firstAttempts > 0 && secondAttempts > 0 do throw "zero rejection attempts"
+    rejected := rejected + firstAttempts + secondAttempts - 2
+    let start := initial [mask.toUInt8]
+    let some (actual0, middle) := sampleField hash firstAttempts start | throw "forced first field exhausted"
+    let some (actual1, final) := sampleField hash secondAttempts middle | throw "forced second field exhausted"
+    unless actual0 == c0 && actual1 == c1 do throw "forced canonical/rejected limb differs"
+    unless (sampleField hash (firstAttempts - 1) start).isNone &&
+      (sampleField hash (secondAttempts - 1) middle).isNone do throw "rejection sampler returned too early"
+    unless sampleExtension hash 5 start == some (⟨c0, c1⟩, final) do throw "forced extension sample differs"
+    unless (sampleExtension hash (max firstAttempts secondAttempts - 1) start).isNone do
+      throw "extension sampler bypassed exhausted coordinate"
+    let mut state := final
+    for bits in [0, 1, 7, 31, 32, 63] do
+      let expected ← readNat
+      let some (actual, next) := sampleBits hash bits state | throw "forced bit sample invalid"
+      unless actual == expected do throw "forced sampling continuation differs"
+      state := next
+    for invalid in [64, 65, 100] do
+      unless (sampleBits hash invalid state).isNone do throw "oversized bit sample accepted"
+  unless rejected == 26 do throw s!"incomplete forced rejection coverage: {rejected}"
+  let noncanonical : Hash32 := fun _ _ => 255
+  unless (sampleField noncanonical 32 (initial [])).isNone do throw "exhausted sampler fabricated a field"
+
+private def readWitnesses : Reader Unit := do
+  unless (← readNat) == 48 do throw "incomplete witness cases"
+  let mut zeroBits := 0
+  for _ in [:48] do
+    let seed ← readBytes
+    let before ← readField
+    let bits ← readNat
+    let witness ← readField
+    let accepted ← readBool
+    let after ← readField
+    let some (actualBefore, state) := sampleField pureHash 16 (initial seed) | throw "witness prelude exhausted"
+    unless actualBefore == before do throw "witness prelude sample differs"
+    let some (actual, next) := checkWitness pureHash bits witness state | throw "witness check undefined"
+    unless actual == accepted do throw "witness acceptance differs"
+    if bits == 0 then
+      zeroBits := zeroBits + 1
+      unless next == state do throw "zero-bit witness changed pending output"
+    let some (actualAfter, _) := sampleField pureHash 16 next | throw "witness continuation exhausted"
+    unless actualAfter == after do throw "witness continuation differs"
+  unless zeroBits == 8 do throw "incomplete zero-bit witness coverage"
+
+private def readVerifiers : Reader Unit := do
+  unless (← readNat) == 40 do throw "incomplete native verifier cases"
+  let mut acceptedCount := 0
+  let mut eventCount := 0
+  let mut pcsCount := 0
+  for index in [:40] do
+    let keyBytes := (← readBytes).toByteArray
+    let proofBytes := (← readBytes).toByteArray
+    let some key := KeyCodec.decodeCanonical keyBytes | throw "transcript key is not canonical"
+    let some proof := ProofCodec.decodeCanonical proofBytes | throw "transcript proof is not canonical"
+    let claims ← readList (← readCount) readValues
+    let accepted ← readBool
+    unless accepted == (index % 10 == 0) do throw "native verifier acceptance inventory differs"
+    let events ← readList (← readCount 100000) readEvent
+    eventCount := eventCount + events.length
+    let some result := NativeAIR.Blake3.replay 16 key proof claims | throw "transcript replay exhausted"
+    unless NativeAIR.Transcript.replay nativeHash 16 key proof claims == some result do
+      throw "pure/FFI transcript replay differs"
+    let pcs ← ofExcept (checkSchedule key proof claims result events)
+    pcsCount := pcsCount + pcs.length
+    unless !pcs.isEmpty do throw "native PCS continuation missing"
+    let continued ← ofExcept (pcs.foldlM runEvent result.state)
+    let all ← ofExcept (events.foldlM runEvent (initial (NativeAIR.Transcript.seed key.parameters)))
+    unless continued == all do throw "PCS received a different challenger state"
+    unless NativeAIR.Blake3.replay 32 key proof claims == some result do
+      throw "larger replay fuel changed native challenges/state"
+    unless (NativeAIR.Blake3.replay 0 key proof claims).isNone do throw "zero replay fuel accepted"
+    let some rows := ProofShape.check key proof | throw "native transcript fixture has invalid shape"
+    if accepted then
+      acceptedCount := acceptedCount + 1
+      unless NativeAIR.Blake3.verifyArithmetic 16 key proof claims rows == some result do
+        throw "native accepted proof fails transcript-derived arithmetic"
+  unless acceptedCount == 4 do throw "incomplete accepted transcript proofs"
+  unless eventCount > 1000 && pcsCount > 500 do throw "incomplete native transcript/PCS calls"
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur transcript v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "transcript snapshot version differs"
+  readStreams
+  readRejections
+  readWitnesses
+  readVerifiers
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "transcript snapshot has trailing bytes"
+
+end AiurTests.Transcript
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] =>
+    let bytes ← IO.FS.readBinFile path
+    match AiurTests.Transcript.readCorpus.run (bytes, 0) with
+    | .error error => throw (IO.userError error)
+    | .ok _ =>
+      IO.println "transcript: 1280 byte operations, 16 forced rejection cases and 48 witness checks match"
+      IO.println "transcript: pure Blake3 matches FFI and 40 native verifier schedules/PCS continuations; 4 accepted proofs satisfy derived arithmetic"
+  | _ => throw (IO.userError "expected native transcript snapshot")
diff --git a/Tests/Aiur/VerifierArithmetic.lean b/Tests/Aiur/VerifierArithmetic.lean
new file mode 100644
index 000000000..cd4737579
--- /dev/null
+++ b/Tests/Aiur/VerifierArithmetic.lean
@@ -0,0 +1,172 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Aiur.Proofs.VerifierAccumulator
+import Tests.Aiur.EmissionReader
+
+/-! Combined comparison with native graph, LogUp and selector calls. The
+native test reproduces the verifier's private wiring/fold/recombination;
+its constructed openings are arithmetic fixtures, not authenticated proofs.
+-/
+
+open Aiur Aiur.NativeAIR AiurTests.EmissionReader
+open ProofCodec (Extension)
+
+namespace AiurTests.VerifierArithmetic
+
+open NativeAIR.VerifierArithmetic
+
+private def readExtension : Reader Extension := do return ⟨← readField, ← readField⟩
+private def readExtensions : Reader (List Extension) := do readList (← readCount 100000) readExtension
+private def readPair : Reader ProofShape.Pair := do return ⟨← readExtensions, ← readExtensions⟩
+private def readClaims : Reader (List (List G)) := do readList (← readCount) readValues
+private def readChallenges : Reader Challenges := do
+  return ⟨← readExtension, ← readExtension, ← readExtension, ← readExtension⟩
+
+private def readOpening (circuits : Array KeyCodec.Circuit) : Reader ProofShape.Row := do
+  let index ← readNat
+  let some circuit := circuits[index]? | throw "opening circuit index out of bounds"
+  let bits ← readNat
+  unless bits < 256 do throw "opening exponent is not a byte"
+  let main ← readPair
+  let stage2 ← readPair
+  let preprocessed ← readOption readPair
+  let quotient ← readExtensions
+  let accumulator ← readExtension
+  let row : ProofShape.Row := ⟨index, circuit, bits.toUInt8, main, stage2, preprocessed, quotient, accumulator⟩
+  unless row.fits ⟨1, 0, 0, 1, 64, 0, 0⟩ do throw "opening fixture is not shaped"
+  unless row.preprocessed.isNone == (row.circuit.preprocessedWidth == 0) do throw "opening preprocessed slot differs"
+  return row
+
+private def readEvaluation (challenges : Challenges) (row : ProofShape.Row) (entering : Extension) : Reader (Nat × Bool) := do
+  let selectors : NativeAIR.Domain.Selectors Extension :=
+    ⟨← readExtension, ← readExtension, ← readExtension, ← readExtension⟩
+  let publics := (← readExtensions).toArray
+  let delta := (← readExtensions).toArray
+  let nodes := (← readExtensions).toArray
+  let user ← readExtensions
+  let lookups ← readExtensions
+  let composition ← readExtension
+  let quotient ← readExtension
+  let accepted ← readBool
+  let some result := evaluate challenges row entering | throw "opening arithmetic unexpectedly undefined"
+  unless result.domain.val == row.logDegree.toNat && result.selectors == selectors do throw "opening domain/selectors differ"
+  unless NativeAIR.VerifierArithmetic.publics challenges entering row.accumulator == publics do
+    throw "opening public coordinates differ"
+  unless deltaScaled result.domain entering row.accumulator == delta do throw "opening normalized delta differs"
+  unless result.nodeValues == nodes do throw "opening graph node values differ"
+  unless result.userValues == user && result.lookupValues == lookups do throw "opening constraint order/coordinates differ"
+  unless result.constraints.length == row.circuit.constraintCount do throw "opening constraint count differs"
+  unless Quotient.composition challenges.alpha result.constraints == composition do throw "opening Horner fold differs"
+  unless result.quotientValue == quotient do throw "opening quotient recombination differs"
+  unless result.accepts challenges.alpha == accepted && check challenges row entering == some accepted do
+    throw "opening arithmetic acceptance differs"
+  unless (composition == NativeAIR.Domain.vanishing result.domain challenges.zeta * quotient) == accepted do
+    throw "opening quotient polynomial identity differs"
+  return (nodes.size, accepted)
+
+private def checkGuards (challenges : Challenges) (row : ProofShape.Row) (entering : Extension) (accepted : Bool) : Reader Unit := do
+  let badCurrent := { row with stage2 := { row.stage2 with current := [] } }
+  let badNext := { row with stage2 := { row.stage2 with next := [] } }
+  let badQuotient := { row with quotient := row.quotient ++ [0] }
+  let badLog := { row with logDegree := 33 }
+  let badRoot := { row with circuit := { row.circuit with graph :=
+    { row.circuit.graph with zeros := row.circuit.graph.zeros ++ [row.circuit.graph.nodes.length] } } }
+  for malformed in [badCurrent, badNext, badQuotient, badLog, badRoot] do
+    unless (evaluate challenges malformed entering).isNone do throw "malformed opening read accepted"
+  let some domain := NativeAIR.Domain.ofLogSize row.logDegree.toNat | throw "opening domain missing"
+  for pole in [1, Extension.ofBase (NativeAIR.Domain.lastPoint domain)] do
+    unless (evaluate { challenges with zeta := pole } row entering).isNone do throw "opening selector pole accepted"
+  if row.preprocessed.isSome then
+    unless (evaluate challenges { row with preprocessed := none } entering).isNone do
+      throw "missing preprocessed opening accepted"
+  if accepted then
+    let first :: rest := row.quotient | throw "empty shaped quotient"
+    unless check challenges { row with quotient := (first + 1) :: rest } entering == some false do
+      throw "altered opening quotient accepted"
+
+private def readCorpus : Reader Unit := do
+  let header := "Aiur verifier arithmetic v1\n".toUTF8
+  unless (← takeBytes header.size) == header do throw "verifier arithmetic snapshot version differs"
+  unless (← readNat) == 10 do throw "incomplete opening circuits"
+  let circuits := (← readList 10 do
+    let bytes ← takeBytes (← readCount 1000000)
+    let some (circuit, []) := KeyCodec.readCircuit bytes.data.toList | throw "invalid opening circuit"
+    return circuit).toArray
+  unless (← readNat) == 960 do throw "incomplete opening assignments"
+  let mut nodeCount := 0
+  let mut acceptedCount := 0
+  for index in [:circuits.size] do
+    let some circuit := circuits[index]? | throw "missing opening circuit"
+    let largest := 31 - (ProofShape.quotientDegree circuit).log2
+    for bits in [0, 1, 2, 4, 8, 16, 24, largest] do
+      for seed in [:12] do
+        unless (← readNat) == seed do throw "opening seed order differs"
+        let challenges ← readChallenges
+        let entering ← readExtension
+        let row ← readOpening circuits
+        unless row.circuitIndex == index && row.logDegree.toNat == bits do throw "opening fixture order differs"
+        let (nodes, accepted) ← readEvaluation challenges row entering
+        unless accepted == (seed % 2 == 0) do throw "opening acceptance inventory differs"
+        nodeCount := nodeCount + nodes
+        if accepted then acceptedCount := acceptedCount + 1
+        checkGuards challenges row entering accepted
+  unless nodeCount == 32064 && acceptedCount == 480 do throw "incomplete opening node/acceptance coverage"
+  unless (← readNat) == 72 do throw "incomplete claim assignments"
+  let mut definedClaims := 0
+  for seed in [:12] do
+    for count in [0, 1, 2, 3, 7, 16] do
+      let challenges ← readChallenges
+      let claims ← readClaims
+      unless claims.length == count do throw "public claim count differs"
+      for claim in claims do
+        unless claimMessage challenges claim == (← readExtension) do throw "public claim compression differs"
+      let expected ← readOption readExtension
+      unless initialAccumulator challenges claims == expected do throw "initial accumulator differs"
+      unless expected.isSome == (seed % 3 != 0 || count == 0) do throw "public claim pole inventory differs"
+      if expected.isSome then definedClaims := definedClaims + 1
+      unless (verify challenges claims []).isNone do throw "empty active circuit list accepted"
+  unless definedClaims == 52 do throw "incomplete public claim pole coverage"
+  unless (← readNat) == 48 do throw "incomplete accumulator chains"
+  let mut acceptedChains := 0
+  let mut unbalancedChains := 0
+  let mut rejectedChains := 0
+  for _seed in [:12] do
+    for count in [1, 2, 3, 10] do
+      let challenges ← readChallenges
+      let claims ← readClaims
+      unless (← readNat) == count do throw "accumulator chain length differs"
+      let some initial := initialAccumulator challenges claims | throw "unexpected chain claim pole"
+      let mut entering := initial
+      let mut rows := []
+      for _ in [:count] do
+        let row ← readOpening circuits
+        let _ ← readEvaluation challenges row entering
+        rows := rows ++ [row]
+        entering := row.accumulator
+      let expected ← readOption readBool
+      unless verify challenges claims rows == expected do throw "ordered accumulator chain differs"
+      match expected with
+      | some true => acceptedChains := acceptedChains + 1
+      | some false => unbalancedChains := unbalancedChains + 1
+      | none => rejectedChains := rejectedChains + 1
+  unless acceptedChains == 16 && unbalancedChains == 16 && rejectedChains == 16 do
+    throw "incomplete final/interior accumulator rejection coverage"
+  let (bytes, cursor) ← get
+  unless cursor == bytes.size do throw "verifier arithmetic snapshot has trailing bytes"
+
+def run (path : System.FilePath) : IO Unit := do
+  match readCorpus.run ((← IO.FS.readBinFile path), 0) with
+  | .error error => throw (IO.userError error)
+  | .ok _ =>
+    IO.println "verifier arithmetic: 960 openings, 32064 node values and malformed reads/quotients/poles match"
+    IO.println "verifier accumulators: 52 defined/20 rejected claim cases and 16 accepted/16 unbalanced/16 rejected chains match"
+
+end AiurTests.VerifierArithmetic
+
+def main (args : List String) : IO Unit := do
+  match args with
+  | [path] => AiurTests.VerifierArithmetic.run path
+  | _ => throw (IO.userError "expected native verifier arithmetic snapshot")
diff --git a/Tests/Aiur/backend-foundation.txt b/Tests/Aiur/backend-foundation.txt
new file mode 100644
index 000000000..f79a676bd
--- /dev/null
+++ b/Tests/Aiur/backend-foundation.txt
@@ -0,0 +1,26064 @@
+ROOT Aiur.G.ofNat_n
+∀ (a : Aiur.G), Aiur.G.ofNat a.n = a
+AXIOMS [propext]
+ROOT Aiur.G.mul_one
+∀ (a : Aiur.G), a * 1 = a
+AXIOMS [propext]
+ROOT Aiur.G.mul_zero
+∀ (a : Aiur.G), a * 0 = 0
+AXIOMS [propext]
+ROOT Aiur.AIR.inactive_multiplicity_zero
+∀ {multiplicity selector : Aiur.G},
+  selector = 0 → Aiur.AIR.activityConstraint multiplicity selector = 0 → multiplicity = 0
+AXIOMS [propext]
+ROOT Aiur.AIR.nonzero_multiplicity_active
+∀ {multiplicity selector : Aiur.G},
+  Aiur.AIR.activityConstraint multiplicity selector = 0 → multiplicity ≠ 0 → selector ≠ 0
+AXIOMS [propext]
+ROOT Aiur.AIR.active_satisfies
+∀ (multiplicity : Aiur.G), Aiur.AIR.activityConstraint multiplicity 1 = 0
+AXIOMS [propext]
+ROOT Aiur.Bytecode.Eval.runFunction_sameCode
+∀ {a b : Aiur.Bytecode.Toplevel},
+  Aiur.Bytecode.Eval.SameCode a b →
+    ∀ (function : Aiur.Bytecode.FunIdx) (args : Array Aiur.G) (io : Aiur.IOBuffer) (fuel : Nat),
+      Aiur.Bytecode.Eval.runFunction a function args io fuel = Aiur.Bytecode.Eval.runFunction b function args io fuel
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_sameCode
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.Eval.SameCode (Aiur.finishCompilation source raw names).bytecode raw.deduplicate.fst
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_reflects
+∀ {source : Aiur.Source.Toplevel} {raw : Aiur.Bytecode.Toplevel} {names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx}
+  {function : Aiur.Bytecode.FunIdx} {args : Array Aiur.G} {io : Aiur.IOBuffer} {fuel : Nat}
+  {result : Array Aiur.G × Aiur.IOBuffer},
+  Aiur.Bytecode.Eval.runFunction (Aiur.finishCompilation source raw names).bytecode function args io fuel =
+      Except.ok result →
+    Aiur.Bytecode.Eval.runFunction raw.deduplicate.fst function args io fuel = Except.ok result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_artifact_of_ok
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled →
+    ∃ inlined typed concrete raw names,
+      source.inlineCalls = Except.ok inlined ∧
+        inlined.checkAndSimplify = Except.ok typed ∧
+          typed.concretize = Except.ok concrete ∧
+            concrete.toBytecode = Except.ok (raw, names) ∧ compiled = Aiur.finishCompilation inlined raw names
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.build
+(selection : Aiur.BoundVerifier.Selection) → Except String (Aiur.BoundVerifier.Backend selection)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.verify_success
+∀ {selection : Aiur.BoundVerifier.Selection} {backend : Aiur.BoundVerifier.Backend selection} {input : Array Aiur.G}
+  {bytes : ByteArray},
+  Aiur.BoundVerifier.verify backend input bytes = Except.ok () →
+    input.size = selection.inputSize ∧
+      ∃ proof,
+        Aiur.Proof.ofBytesChecked bytes = Except.ok proof ∧
+          backend.system.verify (Aiur.buildClaim selection.function input selection.success) proof = Except.ok ()
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.compilation_stages
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  ∃ initial,
+    selection.source.compile = Except.ok initial ∧
+      (if selection.groups.isEmpty = true then Except.ok initial else initial.groupFunctions selection.groups) =
+        Except.ok backend.compiled
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.CompiledToplevel.groupFunctions_preserves_code
+∀ {before after : Aiur.CompiledToplevel} {groups : Array (String × Array String)},
+  before.groupFunctions groups = Except.ok after →
+    after.source = before.source ∧
+      after.nameMap = before.nameMap ∧
+        after.bytecode.functions = before.bytecode.functions ∧ after.bytecode.memorySizes = before.bytecode.memorySizes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.CompiledToplevel.groupFunctions_sameCode
+∀ {before after : Aiur.CompiledToplevel} {groups : Array (String × Array String)},
+  before.groupFunctions groups = Except.ok after → Aiur.Bytecode.Eval.SameCode after.bytecode before.bytecode
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.CompiledToplevel.groupFunctions_preserves_execution
+∀ {before after : Aiur.CompiledToplevel} {groups : Array (String × Array String)},
+  before.groupFunctions groups = Except.ok after →
+    ∀ (function : Aiur.Bytecode.FunIdx) (args : Array Aiur.G) (io : Aiur.IOBuffer) (fuel : Nat),
+      Aiur.Bytecode.Eval.runFunction after.bytecode function args io fuel =
+        Aiur.Bytecode.Eval.runFunction before.bytecode function args io fuel
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.reference_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (function : Aiur.Bytecode.FunIdx) (args : Array Aiur.G) (io : Aiur.IOBuffer) (fuel : Nat),
+  ∃ initial,
+    selection.source.compile = Except.ok initial ∧
+      Aiur.Bytecode.Eval.runFunction backend.compiled.bytecode function args io fuel =
+        Aiur.Bytecode.Eval.runFunction initial.bytecode function args io fuel
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.execution_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection) {args : Array Aiur.G}
+  {io : Aiur.IOBuffer} {fuel : Nat} {result : Array Aiur.G × Aiur.IOBuffer},
+  Aiur.Bytecode.Eval.runFunction backend.compiled.bytecode selection.function args io fuel = Except.ok result →
+    ∃ inlined typed concrete raw names,
+      selection.source.inlineCalls = Except.ok inlined ∧
+        inlined.checkAndSimplify = Except.ok typed ∧
+          typed.concretize = Except.ok concrete ∧
+            concrete.toBytecode = Except.ok (raw, names) ∧
+              Aiur.Bytecode.Eval.runFunction raw.deduplicate.fst selection.function args io fuel = Except.ok result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Ctrl.beq_eq_true_iff
+∀ (left right : Aiur.Bytecode.Ctrl), left.beq right = true ↔ left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.beq_eq_true_iff
+∀ (left right : Aiur.Bytecode.Block), left.beq right = true ↔ left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Eval.runFunction_renamed_iff
+∀ {a b : Aiur.Bytecode.Toplevel} {rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx},
+  Aiur.Bytecode.Eval.RenamedCode a b rename →
+    ∀ (function : Aiur.Bytecode.FunIdx) (args : Array Aiur.G) (io : Aiur.IOBuffer) (fuel : Nat)
+      (result : Array Aiur.G × Aiur.IOBuffer),
+      Aiur.Bytecode.Eval.runFunction a function args io fuel = Except.ok result ↔
+        Aiur.Bytecode.Eval.runFunction b (rename function) args io fuel = Except.ok result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Eval.deduplicate_preserves_execution
+∀ (source : Aiur.Bytecode.Toplevel) (function : Aiur.Bytecode.FunIdx) (args : Array Aiur.G) (io : Aiur.IOBuffer)
+  (fuel : Nat) (result : Array Aiur.G × Aiur.IOBuffer),
+  Aiur.Bytecode.Eval.runFunction source function args io fuel = Except.ok result ↔
+    Aiur.Bytecode.Eval.runFunction source.deduplicate.fst (source.deduplicate.snd function) args io fuel =
+      Except.ok result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_preserves_execution
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx)
+  (function : Aiur.Bytecode.FunIdx) (args : Array Aiur.G) (io : Aiur.IOBuffer) (fuel : Nat)
+  (result : Array Aiur.G × Aiur.IOBuffer),
+  Aiur.Bytecode.Eval.runFunction raw function args io fuel = Except.ok result ↔
+    Aiur.Bytecode.Eval.runFunction (Aiur.finishCompilation source raw names).bytecode (raw.deduplicate.snd function)
+        args io fuel =
+      Except.ok result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_nameMap_image
+∀ {source : Aiur.Source.Toplevel} {raw : Aiur.Bytecode.Toplevel} {names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx}
+  {name : Name} {function : Aiur.Bytecode.FunIdx},
+  (Aiur.finishCompilation source raw names).getFuncIdx name = some function →
+    ∃ original, names[{ toName := name }]? = some original ∧ raw.deduplicate.snd original = function
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.execution_reflects_raw
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection) {args : Array Aiur.G}
+  {io : Aiur.IOBuffer} {fuel : Nat} {result : Array Aiur.G × Aiur.IOBuffer},
+  Aiur.Bytecode.Eval.runFunction backend.compiled.bytecode selection.function args io fuel = Except.ok result →
+    ∃ inlined typed concrete raw names original,
+      selection.source.inlineCalls = Except.ok inlined ∧
+        inlined.checkAndSimplify = Except.ok typed ∧
+          typed.concretize = Except.ok concrete ∧
+            concrete.toBytecode = Except.ok (raw, names) ∧
+              names[{ toName := selection.entrypoint }]? = some original ∧
+                raw.deduplicate.snd original = selection.function ∧
+                  Aiur.Bytecode.Eval.runFunction raw original args io fuel = Except.ok result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_restoreTailMatches
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (term : Aiur.Source.Term) (bindings : Aiur.Source.Eval.Bindings)
+  (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings term st =
+    Aiur.Source.Eval.interp decls fuel bindings term.restoreTailMatches st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_wrapLets
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (frames : List (Aiur.Pattern × Aiur.Source.Term)) (body : Aiur.Source.Term)
+  (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (Aiur.Source.Term.wrapLets frames body) st = do
+    let __x ← Aiur.Source.Eval.evalFrames decls fuel frames bindings st
+    match __x with
+      | (bindings, st) => Aiur.Source.Eval.interp decls fuel bindings body st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.evalFrames_append
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (first rest : List (Aiur.Pattern × Aiur.Source.Term))
+  (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.evalFrames decls fuel (first ++ rest) bindings st = do
+    let __x ← Aiur.Source.Eval.evalFrames decls fuel first bindings st
+    match __x with
+      | (bindings, st) => Aiur.Source.Eval.evalFrames decls fuel rest bindings st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_peelLets
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (term : Aiur.Source.Term) (bindings : Aiur.Source.Eval.Bindings)
+  (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings term st = do
+    let __x ← Aiur.Source.Eval.evalFrames decls fuel term.peelLets.fst bindings st
+    match __x with
+      | (bindings, st) => Aiur.Source.Eval.interp decls fuel bindings term.peelLets.snd st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_ret_wrapLets
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (frames : List (Aiur.Pattern × Aiur.Source.Term)) (body : Aiur.Source.Term)
+  (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (Aiur.Source.Term.wrapLets frames body).ret st =
+    Aiur.Source.Eval.interp decls fuel bindings (Aiur.Source.Term.wrapLets frames body.ret) st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_ioWrite_sequence
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (channel data continuation : Aiur.Source.Term)
+  (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (channel.ioWrite data continuation) st =
+    Aiur.Source.Eval.interp decls fuel bindings
+      (Aiur.Source.Term.let Aiur.Pattern.wildcard (channel.ioWrite data Aiur.Source.Term.unit) continuation) st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_debug_sequence
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (label : String) (value : Option Aiur.Source.Term)
+  (continuation : Aiur.Source.Term) (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (Aiur.Source.Term.debug label value continuation) st =
+    Aiur.Source.Eval.interp decls fuel bindings
+      (Aiur.Source.Term.let Aiur.Pattern.wildcard (Aiur.Source.Term.debug label value Aiur.Source.Term.unit)
+        continuation)
+      st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_assertEq_sequence
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (first second : Aiur.Source.Term) (message : Option String)
+  (continuation : Aiur.Source.Term) (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (first.assertEq second message continuation) st =
+    Aiur.Source.Eval.interp decls fuel bindings
+      (Aiur.Source.Term.let Aiur.Pattern.wildcard (first.assertEq second message Aiur.Source.Term.unit) continuation) st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_ioSetInfo_sequence
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (channel key index length continuation : Aiur.Source.Term)
+  (bindings : Aiur.Source.Eval.Bindings) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (channel.ioSetInfo key index length continuation) st =
+    Aiur.Source.Eval.interp decls fuel bindings
+      (Aiur.Source.Term.let Aiur.Pattern.wildcard (channel.ioSetInfo key index length Aiur.Source.Term.unit)
+        continuation)
+      st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Eval.interp_app_mode
+∀ (decls : Aiur.Source.Decls) (fuel : Nat) (bindings : Aiur.Source.Eval.Bindings) (global : Aiur.Global)
+  (args : List Aiur.Source.Term) (before after : Aiur.Source.CallMode) (st : Aiur.Source.Eval.EvalState),
+  Aiur.Source.Eval.interp decls fuel bindings (Aiur.Source.Term.app global args before) st =
+    Aiur.Source.Eval.interp decls fuel bindings (Aiur.Source.Term.app global args after) st
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.memoryPointerCycle_valid
+Aiur.AIR.MemoryRowsValid 1 (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.memoryPointerCycle_inconsistent
+∃ i j,
+  (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)[i].selector = 1 ∧
+    (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)[j].selector = 1 ∧
+      (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)[i].pointer =
+          (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)[j].pointer ∧
+        (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)[i].contents ≠
+          (Aiur.AIR.memoryPointerCycle Aiur.gSize.toNat)[j].contents
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.n_ofNat
+∀ (n : Nat), (Aiur.G.ofNat n).n = n % Aiur.gSize.toNat
+AXIOMS [propext]
+ROOT Aiur.G.sub_eq_zero_iff
+∀ (a b : Aiur.G), a - b = 0 ↔ a = b
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.G.n_add
+∀ (a b : Aiur.G), (a + b).n = (a.n + b.n) % Aiur.gSize.toNat
+AXIOMS [propext]
+ROOT Aiur.G.n_mul
+∀ (a b : Aiur.G), (a * b).n = a.n * b.n % Aiur.gSize.toNat
+AXIOMS [propext]
+ROOT Aiur.AIR.packRank_lt
+∀ (bytes : Fin 6 → Aiur.G), (∀ (i : Fin 6), (bytes i).n < 256) → (Aiur.AIR.packRank bytes).n < Aiur.AIR.callRankBound
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.call_order_strict
+∀ {parent child gap : Aiur.G},
+  parent.n < Aiur.AIR.callRankBound →
+    child.n < Aiur.AIR.callRankBound →
+      gap.n < Aiur.AIR.callRankBound → Aiur.AIR.callOrderConstraint parent child gap = 0 → parent.n < child.n
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.call_order_irrefl
+∀ (rank gap : Aiur.G),
+  rank.n < Aiur.AIR.callRankBound → gap.n < Aiur.AIR.callRankBound → Aiur.AIR.callOrderConstraint rank rank gap ≠ 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.active_call_order_strict
+∀ {selector parent child gap : Aiur.G},
+  selector = 1 →
+    parent.n < Aiur.AIR.callRankBound →
+      child.n < Aiur.AIR.callRankBound →
+        gap.n < Aiur.AIR.callRankBound →
+          selector * Aiur.AIR.callOrderConstraint parent child gap = 0 → parent.n < child.n
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.packed_call_order_strict
+∀ (parent child gap : Fin 6 → Aiur.G),
+  (∀ (i : Fin 6), (parent i).n < 256) →
+    (∀ (i : Fin 6), (child i).n < 256) →
+      (∀ (i : Fin 6), (gap i).n < 256) →
+        Aiur.AIR.callOrderConstraint (Aiur.AIR.packRank parent) (Aiur.AIR.packRank child) (Aiur.AIR.packRank gap) = 0 →
+          (Aiur.AIR.packRank parent).n < (Aiur.AIR.packRank child).n
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.call_relation_wellFounded
+∀ {α : Sort u} (rank : α → Aiur.G),
+  (∀ (node : α), (rank node).n < Aiur.AIR.callRankBound) →
+    ∀ (calls : α → α → Prop),
+      (∀ (child parent : α),
+          calls child parent →
+            ∃ gap, gap.n < Aiur.AIR.callRankBound ∧ Aiur.AIR.callOrderConstraint (rank parent) (rank child) gap = 0) →
+        WellFounded calls
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.G.zero_add
+∀ (a : Aiur.G), 0 + a = a
+AXIOMS [propext]
+ROOT Aiur.G.ofNat_ne_zero_of_lt
+∀ {n : Nat}, 0 < n → n < Aiur.gSize.toNat → Aiur.G.ofNat n ≠ 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.characteristic_queries_balance
+∀ {α : Type u_1} [inst : DecidableEq α] (message : α),
+  Aiur.AIR.ExactLookupBalance (List.replicate Aiur.gSize.toNat message) []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.suppliedWeight_nonzero_provider
+∀ {α : Type u_1} [inst : DecidableEq α] (message : α) (providers : List (Aiur.AIR.Provider α)),
+  Aiur.AIR.suppliedWeight message providers ≠ 0 →
+    ∃ provider, provider ∈ providers ∧ provider.fst = message ∧ provider.snd ≠ 0
+AXIOMS [propext]
+ROOT Aiur.AIR.exactLookupBalance_provider
+∀ {α : Type u_1} [inst : DecidableEq α] {queries : List α} {providers : List (Aiur.AIR.Provider α)},
+  Aiur.AIR.ExactLookupBalance queries providers →
+    queries.length < Aiur.gSize.toNat →
+      ∀ {message : α}, message ∈ queries → ∃ provider, provider ∈ providers ∧ provider.fst = message ∧ provider.snd ≠ 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.byteRangeMessage_bounded
+∀ (row : Fin 65536), (Aiur.AIR.byteRangeMessage row).fst.n < 256 ∧ (Aiur.AIR.byteRangeMessage row).snd.n < 256
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_byteRange
+∀ {queries : List (Aiur.G × Aiur.G)} (weights : Fin 65536 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byteRangeProviders weights) →
+    queries.length < Aiur.gSize.toNat → ∀ {a b : Aiur.G}, (a, b) ∈ queries → a.n < 256 ∧ b.n < 256
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_rankBytes
+∀ {queries : List (Aiur.G × Aiur.G)} (weights : Fin 65536 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byteRangeProviders weights) →
+    queries.length < Aiur.gSize.toNat →
+      ∀ (bytes : Fin 6 → Aiur.G), Aiur.AIR.rankByteQueries bytes ⊆ queries → ∀ (i : Fin 6), (bytes i).n < 256
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_call_order
+∀ {queries : List (Aiur.G × Aiur.G)} (weights : Fin 65536 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byteRangeProviders weights) →
+    queries.length < Aiur.gSize.toNat →
+      ∀ (parent child gap : Fin 6 → Aiur.G),
+        Aiur.AIR.rankByteQueries parent ⊆ queries →
+          Aiur.AIR.rankByteQueries child ⊆ queries →
+            Aiur.AIR.rankByteQueries gap ⊆ queries →
+              Aiur.AIR.callOrderConstraint (Aiur.AIR.packRank parent) (Aiur.AIR.packRank child)
+                    (Aiur.AIR.packRank gap) =
+                  0 →
+                (Aiur.AIR.packRank parent).n < (Aiur.AIR.packRank child).n
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.FunctionRow.Valid.active_of_nonzero
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {row : Aiur.AIR.FunctionRow},
+  Aiur.AIR.FunctionRow.Valid program memory row → row.multiplicity ≠ 0 → row.selector = 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.functionQueries_provider
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {roots : List Aiur.Bytecode.AIR.Call}
+  {rows : List Aiur.AIR.FunctionRow},
+  (∀ (row : Aiur.AIR.FunctionRow), row ∈ rows → Aiur.AIR.FunctionRow.Valid program memory row) →
+    Aiur.AIR.ExactLookupBalance (Aiur.AIR.functionQueries roots rows) (Aiur.AIR.functionProviders rows) →
+      (Aiur.AIR.functionQueries roots rows).length < Aiur.gSize.toNat →
+        ∀ {request : Aiur.Bytecode.AIR.Call},
+          request ∈ Aiur.AIR.functionQueries roots rows → ∃ row, row ∈ rows ∧ row.request = request ∧ row.selector = 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.balancedRows_execute
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {roots : List Aiur.Bytecode.AIR.Call}
+  {rows : List Aiur.AIR.FunctionRow},
+  (∀ (row : Aiur.AIR.FunctionRow), row ∈ rows → Aiur.AIR.FunctionRow.Valid program memory row) →
+    Aiur.AIR.ExactLookupBalance (Aiur.AIR.functionQueries roots rows) (Aiur.AIR.functionProviders rows) →
+      (Aiur.AIR.functionQueries roots rows).length < Aiur.gSize.toNat →
+        ∀ (weights : Fin 65536 → Aiur.G),
+          Aiur.AIR.ExactLookupBalance (Aiur.AIR.functionByteQueries rows) (Aiur.AIR.byteRangeProviders weights) →
+            (Aiur.AIR.functionByteQueries rows).length < Aiur.gSize.toNat →
+              ∀ {row : Aiur.AIR.FunctionRow},
+                row ∈ rows → row.selector = 1 → Aiur.Bytecode.AIR.Execution program memory row.request
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.balancedRoots_execute
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {roots : List Aiur.Bytecode.AIR.Call}
+  {rows : List Aiur.AIR.FunctionRow},
+  (∀ (row : Aiur.AIR.FunctionRow), row ∈ rows → Aiur.AIR.FunctionRow.Valid program memory row) →
+    Aiur.AIR.ExactLookupBalance (Aiur.AIR.functionQueries roots rows) (Aiur.AIR.functionProviders rows) →
+      (Aiur.AIR.functionQueries roots rows).length < Aiur.gSize.toNat →
+        ∀ (weights : Fin 65536 → Aiur.G),
+          Aiur.AIR.ExactLookupBalance (Aiur.AIR.functionByteQueries rows) (Aiur.AIR.byteRangeProviders weights) →
+            (Aiur.AIR.functionByteQueries rows).length < Aiur.gSize.toNat →
+              ∀ {request : Aiur.Bytecode.AIR.Call}, request ∈ roots → Aiur.Bytecode.AIR.Execution program memory request
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.MemoryRowsValid.pointer_injective
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  Aiur.AIR.MemoryRowsValid width rows →
+    rows.size < Aiur.gSize.toNat →
+      ∀ (i j : Nat) (hi : i < rows.size) (hj : j < rows.size),
+        rows[i].selector = 1 → rows[j].selector = 1 → rows[i].pointer = rows[j].pointer → i = j
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.memoryFacts_functional
+∀ (tables : Nat → Array Aiur.AIR.MemoryRow),
+  (∀ (width : Nat), Aiur.AIR.MemoryRowsValid width (tables width)) →
+    (∀ (width : Nat), (tables width).size < Aiur.gSize.toNat) →
+      ∀ {width : Nat} {pointer : Aiur.G} {left right : Array Aiur.G},
+        Aiur.AIR.memoryFacts tables width pointer left → Aiur.AIR.memoryFacts tables width pointer right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.memoryQueries_provider
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  Aiur.AIR.MemoryRowsValid width rows →
+    ∀ {queries : List (Aiur.G × Array Aiur.G)},
+      Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.memoryProviders rows) →
+        queries.length < Aiur.gSize.toNat →
+          ∀ {pointer : Aiur.G} {contents : Array Aiur.G},
+            (pointer, contents) ∈ queries →
+              ∃ i hi, rows[i].selector = 1 ∧ rows[i].pointer = pointer ∧ rows[i].contents = contents
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.memoryQueries_width
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  Aiur.AIR.MemoryRowsValid width rows →
+    ∀ {queries : List (Aiur.G × Array Aiur.G)},
+      Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.memoryProviders rows) →
+        queries.length < Aiur.gSize.toNat →
+          ∀ {pointer : Aiur.G} {contents : Array Aiur.G}, (pointer, contents) ∈ queries → contents.size = width
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.memoryQueries_consistent
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  Aiur.AIR.MemoryRowsValid width rows →
+    rows.size < Aiur.gSize.toNat →
+      ∀ {queries : List (Aiur.G × Array Aiur.G)},
+        Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.memoryProviders rows) →
+          queries.length < Aiur.gSize.toNat →
+            ∀ {pointer : Aiur.G} {left right : Array Aiur.G},
+              (pointer, left) ∈ queries → (pointer, right) ∈ queries → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.memoryQueries_fact
+∀ (tables : Nat → Array Aiur.AIR.MemoryRow),
+  (∀ (width : Nat), Aiur.AIR.MemoryRowsValid width (tables width)) →
+    ∀ (queries : Nat → List (Aiur.G × Array Aiur.G)),
+      (∀ (width : Nat), Aiur.AIR.ExactLookupBalance (queries width) (Aiur.AIR.memoryProviders (tables width))) →
+        (∀ (width : Nat), (queries width).length < Aiur.gSize.toNat) →
+          ∀ {width : Nat} {pointer : Aiur.G} {contents : Array Aiur.G},
+            (pointer, contents) ∈ queries width → Aiur.AIR.memoryFacts tables width pointer contents
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.gSize_prime
+1 < Aiur.gSize.toNat ∧ ∀ (d : Nat), d ∣ Aiur.gSize.toNat → d = 1 ∨ d = Aiur.gSize.toNat
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.mul_eq_zero_iff
+∀ (a b : Aiur.G), a * b = 0 ↔ a = 0 ∨ b = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.boolean_of_constraint
+∀ {value : Aiur.G}, value * (value - 1) = 0 → value = 0 ∨ value = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.boolean_of_one_sub_constraint
+∀ {value : Aiur.G}, value * (1 - value) = 0 → value = 0 ∨ value = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.eqZero_of_constraints
+∀ {input inverse output : Aiur.G}, input * output = 0 → input * inverse + output - 1 = 0 → output = input.eqZero
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.selectorSum_count_le_one
+∀ {selectors : List Aiur.G},
+  (∀ (value : Aiur.G), value ∈ selectors → Aiur.AIR.booleanConstraint value = 0) →
+    Aiur.AIR.oneSubBooleanConstraint (Aiur.AIR.selectorSum selectors) = 0 →
+      selectors.length < Aiur.gSize.toNat → List.count 1 selectors ≤ 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.selectorSum_inactive
+∀ {selectors : List Aiur.G},
+  (∀ (value : Aiur.G), value ∈ selectors → Aiur.AIR.booleanConstraint value = 0) →
+    selectors.length < Aiur.gSize.toNat →
+      Aiur.AIR.selectorSum selectors = 0 → ∀ (value : Aiur.G), value ∈ selectors → value = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.selectorSum_active_split
+∀ {selectors : List Aiur.G},
+  (∀ (value : Aiur.G), value ∈ selectors → Aiur.AIR.booleanConstraint value = 0) →
+    selectors.length < Aiur.gSize.toNat →
+      Aiur.AIR.selectorSum selectors = 1 →
+        ∃ before after, selectors = before ++ 1 :: after ∧ ∀ (value : Aiur.G), value ∈ before ++ after → value = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.selectorSum_characteristic_cancel
+Aiur.AIR.selectorSum (List.replicate Aiur.gSize.toNat 1) = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.nonzero_multiplicity_selector_one
+∀ {multiplicity selector : Aiur.G},
+  Aiur.AIR.activityConstraint multiplicity selector = 0 → multiplicity ≠ 0 → selector = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.active_eqZero
+∀ {selector input inverse output : Aiur.G},
+  selector = 1 → selector * input * output = 0 → selector * (input * inverse + output - 1) = 0 → output = input.eqZero
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.active_case
+∀ {selector matched key : Aiur.G}, selector = 1 → selector * (matched - key) = 0 → matched = key
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.active_default
+∀ {selector matched key inverse : Aiur.G}, selector = 1 → selector * ((matched - key) * inverse - 1) = 0 → matched ≠ key
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.MemoryRowsPolynomials.valid
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  Aiur.AIR.MemoryRowsPolynomials width rows → Aiur.AIR.MemoryRowsValid width rows
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryRowsPolynomials.functional
+∀ (tables : Nat → Array Aiur.AIR.MemoryRow),
+  (∀ (width : Nat), Aiur.AIR.MemoryRowsPolynomials width (tables width)) →
+    (∀ (width : Nat), (tables width).size < Aiur.gSize.toNat) →
+      ∀ {width : Nat} {pointer : Aiur.G} {left right : Array Aiur.G},
+        Aiur.AIR.memoryFacts tables width pointer left → Aiur.AIR.memoryFacts tables width pointer right → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.inverse256_correct
+Aiur.AIR.inverse256 * 256 = 1
+AXIOMS [propext]
+ROOT Aiur.AIR.byte_add_carry
+∀ {x y low : Aiur.G},
+  x.n < 256 →
+    y.n < 256 →
+      low = Aiur.G.ofNat ((x.n + y.n) % 256) → (x + y - low) * Aiur.AIR.inverse256 = Aiur.G.ofNat ((x.n + y.n) / 256)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.byte_sub_borrow
+∀ {x y low : Aiur.G},
+  x.n < 256 →
+    y.n < 256 →
+      low = Aiur.G.ofNat ((x.n + 256 - y.n) % 256) → (low + y - x) * Aiur.AIR.inverse256 = if x.n < y.n then 1 else 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.byte_carry_relation
+∀ {x y z previous carry : Aiur.G},
+  x.n < 256 →
+    y.n < 256 →
+      z.n < 256 →
+        previous = 0 ∨ previous = 1 →
+          carry = 0 ∨ carry = 1 →
+            carry = (x + y + previous - z) * Aiur.AIR.inverse256 → x.n + y.n + previous.n = z.n + 256 * carry.n
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.pack4_n
+∀ (bytes : Fin 4 → Aiur.G),
+  (∀ (i : Fin 4), (bytes i).n < 256) →
+    (Aiur.AIR.pack4 bytes).n = Aiur.AIR.pack4Nat bytes ∧ (Aiur.AIR.pack4 bytes).n < 2 ^ 32
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.u32Carry_relation
+∀ (x y z : Fin 4 → Aiur.G),
+  (∀ (i : Fin 4), (x i).n < 256) →
+    (∀ (i : Fin 4), (y i).n < 256) →
+      (∀ (i : Fin 4), (z i).n < 256) →
+        (∀ (i : Fin 4), Aiur.AIR.booleanConstraint (Aiur.AIR.u32Carries x y z i.succ) = 0) →
+          Aiur.AIR.pack4Nat x + Aiur.AIR.pack4Nat y + 1 = Aiur.AIR.pack4Nat z + 2 ^ 32 * (Aiur.AIR.u32Carries x y z 4).n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.u32_less_than
+∀ (x y z : Fin 4 → Aiur.G),
+  (∀ (i : Fin 4), (x i).n < 256) →
+    (∀ (i : Fin 4), (y i).n < 256) →
+      (∀ (i : Fin 4), (z i).n < 256) →
+        (∀ (i : Fin 4), Aiur.AIR.booleanConstraint (Aiur.AIR.u32Carries x y z i.succ) = 0) →
+          1 - Aiur.AIR.u32Carries x y z 4 = (Aiur.AIR.pack4 x).u32LessThan (Aiur.AIR.pack4 z)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.active_u32_less_than
+∀ {selector a b : Aiur.G},
+  selector = 1 →
+    ∀ (x y z : Fin 4 → Aiur.G),
+      (∀ (i : Fin 4), (x i).n < 256) →
+        (∀ (i : Fin 4), (y i).n < 256) →
+          (∀ (i : Fin 4), (z i).n < 256) →
+            selector * (a - Aiur.AIR.pack4 x) = 0 →
+              selector * (b - Aiur.AIR.pack4 z) = 0 →
+                (∀ (i : Fin 4), selector * Aiur.AIR.booleanConstraint (Aiur.AIR.u32Carries x y z i.succ) = 0) →
+                  a.n < 2 ^ 32 ∧ b.n < 2 ^ 32 ∧ 1 - Aiur.AIR.u32Carries x y z 4 = a.u32LessThan b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_byte1
+∀ {queries : List (List Aiur.G)} (weights : Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byte1Providers weights) →
+    queries.length < Aiur.gSize.toNat →
+      ∀ {kind : Aiur.AIR.Byte1Kind} {input : Aiur.G} {outputs : Array Aiur.G},
+        Aiur.AIR.byte1Request kind input outputs ∈ queries → input.n < 256 ∧ outputs = kind.result input
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_byte2
+∀ {queries : List (List Aiur.G)} (weights : Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byte2Providers weights) →
+    queries.length < Aiur.gSize.toNat →
+      ∀ {kind : Aiur.AIR.Byte2Kind} {x y : Aiur.G} {outputs : Array Aiur.G},
+        Aiur.AIR.byte2Request kind x y outputs ∈ queries → x.n < 256 ∧ y.n < 256 ∧ outputs = kind.result x y
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_byte1_step
+∀ {queries : List (List Aiur.G)} (weights : Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byte1Providers weights) →
+    queries.length < Aiur.gSize.toNat →
+      ∀ (memory : Aiur.Bytecode.AIR.Memory) {kind : Aiur.AIR.Byte1Kind} {values : Array Aiur.G}
+        {index : Aiur.Bytecode.ValIdx} {input : Aiur.G} {outputs : Array Aiur.G},
+        values[index]? = some input →
+          Aiur.AIR.byte1Request kind input outputs ∈ queries →
+            Aiur.Bytecode.AIR.Step memory (kind.op index) values (values ++ outputs) []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_byte2_step
+∀ {queries : List (List Aiur.G)} (weights : Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G),
+  Aiur.AIR.ExactLookupBalance queries (Aiur.AIR.byte2Providers weights) →
+    queries.length < Aiur.gSize.toNat →
+      ∀ (memory : Aiur.Bytecode.AIR.Memory) {kind : Aiur.AIR.Byte2Kind} {values : Array Aiur.G}
+        {left right : Aiur.Bytecode.ValIdx} {x y : Aiur.G} {outputs : Array Aiur.G},
+        values[left]? = some x →
+          values[right]? = some y →
+            Aiur.AIR.byte2Request kind x y outputs ∈ queries →
+              Aiur.Bytecode.AIR.Step memory (kind.op left right) values (values ++ kind.extendOutputs x y outputs) []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.active_u32_less_than_step
+∀ (memory : Aiur.Bytecode.AIR.Memory) {selector a b : Aiur.G} {values : Array Aiur.G}
+  {left right : Aiur.Bytecode.ValIdx},
+  selector = 1 →
+    values[left]? = some a →
+      values[right]? = some b →
+        ∀ (x y z : Fin 4 → Aiur.G),
+          (∀ (i : Fin 4), (x i).n < 256) →
+            (∀ (i : Fin 4), (y i).n < 256) →
+              (∀ (i : Fin 4), (z i).n < 256) →
+                selector * (a - Aiur.AIR.pack4 x) = 0 →
+                  selector * (b - Aiur.AIR.pack4 z) = 0 →
+                    (∀ (i : Fin 4), selector * Aiur.AIR.booleanConstraint (Aiur.AIR.u32Carries x y z i.succ) = 0) →
+                      Aiur.Bytecode.AIR.Step memory (Aiur.Bytecode.Op.u32LessThan left right) values
+                        (values ++ #[1 - Aiur.AIR.u32Carries x y z 4]) []
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.padMessage_injective_of_shape
+∀ {width : Nat} {widths : Aiur.G → Aiur.G → Nat} {left right : List Aiur.G},
+  Aiur.AIR.HasMessageShape widths left →
+    Aiur.AIR.HasMessageShape widths right →
+      left.length ≤ width → Aiur.AIR.padMessage width left = Aiur.AIR.padMessage width right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.exactLookupBalance_of_injective_on
+∀ {α : Type u_1} {β : Type u_2} [inst : DecidableEq α] [inst_1 : DecidableEq β] (encode : α → β)
+  (admissible : α → Prop),
+  (∀ {left right : α}, admissible left → admissible right → encode left = encode right → left = right) →
+    ∀ {queries : List α} {providers : List (Aiur.AIR.Provider α)},
+      (∀ (query : α), query ∈ queries → admissible query) →
+        (∀ (provider : Aiur.AIR.Provider α), provider ∈ providers → provider.snd ≠ 0 → admissible provider.fst) →
+          Aiur.AIR.ExactLookupBalance (List.map encode queries) (Aiur.AIR.mapProviders encode providers) →
+            Aiur.AIR.ExactLookupBalance queries providers
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.ExactLookupBalance.filter
+∀ {α : Type u_1} [inst : DecidableEq α] {queries : List α} {providers : List (Aiur.AIR.Provider α)},
+  Aiur.AIR.ExactLookupBalance queries providers →
+    ∀ (keep : α → Bool),
+      Aiur.AIR.ExactLookupBalance (List.filter keep queries) (List.filter (fun provider => keep provider.fst) providers)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.paddedLookupBalance_provider
+∀ {width : Nat} {queries : List (List Aiur.G)} {providers : List (Aiur.AIR.Provider (List Aiur.G))},
+  Aiur.AIR.PaddedLookupBalance width queries providers →
+    queries.length < Aiur.gSize.toNat →
+      ∀ {message : List Aiur.G},
+        message ∈ queries →
+          ∃ provider,
+            provider ∈ providers ∧
+              Aiur.AIR.padMessage width provider.fst = Aiur.AIR.padMessage width message ∧ provider.snd ≠ 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.paddedLookupBalance_exact
+∀ {width : Nat} (widths : Aiur.G → Aiur.G → Nat) {queries : List (List Aiur.G)}
+  {providers : List (Aiur.AIR.Provider (List Aiur.G))},
+  (∀ (query : List Aiur.G), query ∈ queries → Aiur.AIR.HasMessageShape widths query ∧ query.length ≤ width) →
+    (∀ (provider : Aiur.AIR.Provider (List Aiur.G)),
+        provider ∈ providers →
+          provider.snd ≠ 0 → Aiur.AIR.HasMessageShape widths provider.fst ∧ provider.fst.length ≤ width) →
+      Aiur.AIR.PaddedLookupBalance width queries providers → Aiur.AIR.ExactLookupBalance queries providers
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.functionMessage_shape
+∀ (arities : Aiur.AIR.FunctionArities) (request : Aiur.Bytecode.AIR.Call),
+  Aiur.AIR.FunctionMessageValid arities request →
+    Aiur.AIR.HasMessageShape (Aiur.AIR.lookupMessageWidth arities) (Aiur.AIR.functionMessage request)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.memoryMessage_shape
+∀ (arities : Aiur.AIR.FunctionArities) (width : Nat) (pointer : Aiur.G) (contents : Array Aiur.G),
+  width < Aiur.gSize.toNat →
+    contents.size = width →
+      Aiur.AIR.HasMessageShape (Aiur.AIR.lookupMessageWidth arities) (Aiur.AIR.memoryMessage width pointer contents)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.byte1Request_shape
+∀ (arities : Aiur.AIR.FunctionArities) (kind : Aiur.AIR.Byte1Kind) (input : Aiur.G) (outputs : Array Aiur.G),
+  outputs.size = kind.outputSize →
+    Aiur.AIR.HasMessageShape (Aiur.AIR.lookupMessageWidth arities) (Aiur.AIR.byte1Request kind input outputs)
+AXIOMS [propext]
+ROOT Aiur.AIR.byte2Request_shape
+∀ (arities : Aiur.AIR.FunctionArities) (kind : Aiur.AIR.Byte2Kind) (x y : Aiur.G) (outputs : Array Aiur.G),
+  outputs.size = kind.outputSize →
+    Aiur.AIR.HasMessageShape (Aiur.AIR.lookupMessageWidth arities) (Aiur.AIR.byte2Request kind x y outputs)
+AXIOMS [propext]
+ROOT Aiur.AIR.functionMessage_injective
+∀ {arities : Aiur.AIR.FunctionArities} {left right : Aiur.Bytecode.AIR.Call},
+  Aiur.AIR.FunctionMessageValid arities left →
+    Aiur.AIR.FunctionMessageValid arities right →
+      Aiur.AIR.functionMessage left = Aiur.AIR.functionMessage right → left = right
+AXIOMS [propext]
+ROOT Aiur.AIR.exactLookupBalance_functionMessages
+∀ (arities : Aiur.AIR.FunctionArities) {queries : List Aiur.Bytecode.AIR.Call}
+  {providers : List (Aiur.AIR.Provider Aiur.Bytecode.AIR.Call)},
+  (∀ (query : Aiur.Bytecode.AIR.Call), query ∈ queries → Aiur.AIR.FunctionMessageValid arities query) →
+    (∀ (provider : Aiur.AIR.Provider Aiur.Bytecode.AIR.Call),
+        provider ∈ providers → provider.snd ≠ 0 → Aiur.AIR.FunctionMessageValid arities provider.fst) →
+      Aiur.AIR.ExactLookupBalance (List.map Aiur.AIR.functionMessage queries)
+          (Aiur.AIR.mapProviders Aiur.AIR.functionMessage providers) →
+        Aiur.AIR.ExactLookupBalance queries providers
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.memoryMessage_injective
+∀ {width : Nat} {left right : Aiur.G × Array Aiur.G},
+  Aiur.AIR.memoryMessage width left.fst left.snd = Aiur.AIR.memoryMessage width right.fst right.snd → left = right
+AXIOMS [propext]
+ROOT Aiur.AIR.exactLookupBalance_memoryMessages
+∀ (width : Nat) {queries : List (Aiur.G × Array Aiur.G)} {providers : List (Aiur.AIR.Provider (Aiur.G × Array Aiur.G))},
+  Aiur.AIR.ExactLookupBalance (List.map (fun request => Aiur.AIR.memoryMessage width request.fst request.snd) queries)
+      (Aiur.AIR.mapProviders (fun request => Aiur.AIR.memoryMessage width request.fst request.snd) providers) →
+    Aiur.AIR.ExactLookupBalance queries providers
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.padMessage_append_zero
+∀ {width : Nat} (message : List Aiur.G), Aiur.AIR.padMessage width (message ++ [0]) = Aiur.AIR.padMessage width message
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.functionMessage_rank_alias
+∀ (width : Nat),
+  have output := { function := 0, inputs := #[], outputs := #[7], rank := 0 };
+  have rank := { function := 0, inputs := #[], outputs := #[], rank := 7 };
+  output ≠ rank ∧
+    Aiur.AIR.padMessage width (Aiur.AIR.functionMessage output) =
+      Aiur.AIR.padMessage width (Aiur.AIR.functionMessage rank)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.AIR.RunBlock.return_size
+∀ {memory : Aiur.Bytecode.AIR.Memory} {block : Aiur.Bytecode.Block} {values : Array Aiur.G}
+  {outcome : Aiur.Bytecode.AIR.Outcome} {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunBlock memory block values outcome calls →
+    ∀ (size : Nat), Aiur.Bytecode.Block.returnsHaveSize size block = true → outcome.ReturnSize size
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.AIR.RunFunction.return_size
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {request : Aiur.Bytecode.AIR.Call}
+  {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunFunction program memory request calls →
+    ∀ {callee : Aiur.Bytecode.Function},
+      program.functions[request.function]? = some callee →
+        ∀ (size : Nat), Aiur.Bytecode.Block.returnsHaveSize size callee.body = true → request.outputs.size = size
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.AIR.Step.calls_lookupShape
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {op : Aiur.Bytecode.Op}
+  {values outputs : Array Aiur.G} {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.Step memory op values outputs calls →
+    Aiur.Bytecode.Op.lookupShape program op = true →
+      ∀ (request : Aiur.Bytecode.AIR.Call), request ∈ calls → Aiur.Bytecode.AIR.Call.LookupShape program request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.AIR.RunOps.calls_lookupShape
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {ops : List Aiur.Bytecode.Op}
+  {values outputs : Array Aiur.G} {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunOps memory ops values outputs calls →
+    (∀ (op : Aiur.Bytecode.Op), op ∈ ops → Aiur.Bytecode.Op.lookupShape program op = true) →
+      ∀ (request : Aiur.Bytecode.AIR.Call), request ∈ calls → Aiur.Bytecode.AIR.Call.LookupShape program request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.AIR.RunBlock.calls_lookupShape
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {block : Aiur.Bytecode.Block}
+  {values : Array Aiur.G} {outcome : Aiur.Bytecode.AIR.Outcome} {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunBlock memory block values outcome calls →
+    ∀ (yieldSize : Option Nat),
+      Aiur.Bytecode.Block.lookupShapes program yieldSize block = true →
+        ∀ (request : Aiur.Bytecode.AIR.Call), request ∈ calls → Aiur.Bytecode.AIR.Call.LookupShape program request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.AIR.RunFunction.calls_lookupShape
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {request : Aiur.Bytecode.AIR.Call}
+  {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunFunction program memory request calls →
+    program.validateLookupShapes = true →
+      ∀ {callee : Aiur.Bytecode.Function},
+        program.functions[request.function]? = some callee →
+          callee.constrained = true →
+            ∀ (child : Aiur.Bytecode.AIR.Call), child ∈ calls → Aiur.Bytecode.AIR.Call.LookupShape program child
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.air_return_size
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {memory : Aiur.Bytecode.AIR.Memory} {request : Aiur.Bytecode.AIR.Call} {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunFunction backend.compiled.bytecode memory request calls →
+    request.function = selection.function → request.outputs.size = selection.success.size
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.claim_shape
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection) (input : Array Aiur.G),
+  input.size = selection.inputSize →
+    backend.compiled.bytecode.validClaimShape (Aiur.buildClaim selection.function input selection.success) = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.padded_functionMessage_reflects
+∀ {width : Nat} {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory}
+  {request provided : Aiur.Bytecode.AIR.Call} {calls : List Aiur.Bytecode.AIR.Call},
+  program.functions.size < Aiur.gSize.toNat →
+    Aiur.Bytecode.AIR.Call.LookupShape program request →
+      Aiur.Bytecode.AIR.RunFunction program memory provided calls →
+        (Aiur.AIR.functionMessage request).length ≤ width →
+          Aiur.AIR.padMessage width (Aiur.AIR.functionMessage request) =
+              Aiur.AIR.padMessage width (Aiur.AIR.functionMessage provided) →
+            request = provided
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.function_provider
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory},
+      (∀ (row : Aiur.AIR.FunctionRow), row ∈ tables.functions → Aiur.AIR.FunctionRow.Valid program memory row) →
+        program.functions.size < Aiur.gSize.toNat →
+          ∀ {request : Aiur.Bytecode.AIR.Call},
+            Aiur.Bytecode.AIR.Call.LookupShape program request →
+              Aiur.AIR.functionMessage request ∈ queries →
+                ∃ row, row ∈ tables.functions ∧ row.request = request ∧ row.selector = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.byte1
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ {kind : Aiur.AIR.Byte1Kind} {input : Aiur.G} {outputs : Array Aiur.G},
+      outputs.size = kind.outputSize →
+        Aiur.AIR.byte1Request kind input outputs ∈ queries → input.n < 256 ∧ outputs = kind.result input
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.byte2
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ {kind : Aiur.AIR.Byte2Kind} {x y : Aiur.G} {outputs : Array Aiur.G},
+      outputs.size = kind.outputSize →
+        Aiur.AIR.byte2Request kind x y outputs ∈ queries → x.n < 256 ∧ y.n < 256 ∧ outputs = kind.result x y
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.memory_fact
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ {size : Nat} {pointer : Aiur.G} {contents : Array Aiur.G},
+          size < Aiur.gSize.toNat →
+            contents.size = size →
+              Aiur.AIR.memoryMessage size pointer contents ∈ queries →
+                Aiur.AIR.memoryFacts tables.memory size pointer contents
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.memory_consistent
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), (tables.memory size).size < Aiur.gSize.toNat) →
+        (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+          ∀ {size : Nat} {pointer : Aiur.G} {left right : Array Aiur.G},
+            size < Aiur.gSize.toNat →
+              left.size = size →
+                right.size = size →
+                  Aiur.AIR.memoryMessage size pointer left ∈ queries →
+                    Aiur.AIR.memoryMessage size pointer right ∈ queries → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.byte1_step
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ (memory : Aiur.Bytecode.AIR.Memory) {kind : Aiur.AIR.Byte1Kind} {values : Array Aiur.G}
+      {index : Aiur.Bytecode.ValIdx} {input : Aiur.G} {outputs : Array Aiur.G},
+      values[index]? = some input →
+        outputs.size = kind.outputSize →
+          Aiur.AIR.byte1Request kind input outputs ∈ queries →
+            Aiur.Bytecode.AIR.Step memory (kind.op index) values (values ++ outputs) []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.byte2_step
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ (memory : Aiur.Bytecode.AIR.Memory) {kind : Aiur.AIR.Byte2Kind} {values : Array Aiur.G}
+      {left right : Aiur.Bytecode.ValIdx} {x y : Aiur.G} {outputs : Array Aiur.G},
+      values[left]? = some x →
+        values[right]? = some y →
+          outputs.size = kind.outputSize →
+            Aiur.AIR.byte2Request kind x y outputs ∈ queries →
+              Aiur.Bytecode.AIR.Step memory (kind.op left right) values (values ++ kind.extendOutputs x y outputs) []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.rank_bytes
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ (bytes : Fin 6 → Aiur.G),
+      List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries bytes) ⊆ queries → ∀ (i : Fin 6), (bytes i).n < 256
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.rows_execute
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {roots : List Aiur.Bytecode.AIR.Call},
+      program.validateLookupShapes = true →
+        (∀ (row : Aiur.AIR.FunctionRow), row ∈ tables.functions → Aiur.AIR.FunctionRow.Valid program memory row) →
+          List.map Aiur.AIR.functionMessage (Aiur.AIR.functionQueries roots tables.functions) ⊆ queries →
+            List.map Aiur.AIR.rangeMessage (Aiur.AIR.functionByteQueries tables.functions) ⊆ queries →
+              ∀ {row : Aiur.AIR.FunctionRow},
+                row ∈ tables.functions →
+                  row.selector = 1 →
+                    Aiur.Bytecode.AIR.Call.LookupShape program row.request →
+                      Aiur.Bytecode.AIR.Execution program memory row.request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.roots_execute
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {roots : List Aiur.Bytecode.AIR.Call},
+      program.validateLookupShapes = true →
+        (∀ (row : Aiur.AIR.FunctionRow), row ∈ tables.functions → Aiur.AIR.FunctionRow.Valid program memory row) →
+          List.map Aiur.AIR.functionMessage (Aiur.AIR.functionQueries roots tables.functions) ⊆ queries →
+            List.map Aiur.AIR.rangeMessage (Aiur.AIR.functionByteQueries tables.functions) ⊆ queries →
+              ∀ {request : Aiur.Bytecode.AIR.Call},
+                Aiur.Bytecode.AIR.Call.LookupShape program request →
+                  request ∈ roots → Aiur.Bytecode.AIR.Execution program memory request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.root_lookupShape
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection) (input : Array Aiur.G),
+  input.size = selection.inputSize →
+    Aiur.Bytecode.AIR.Call.LookupShape backend.compiled.bytecode
+      { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.claim_padding
+∀ (selection : Aiur.BoundVerifier.Selection) (width : Nat) (input : Array Aiur.G),
+  Aiur.AIR.padMessage width
+      (Aiur.AIR.functionMessage
+        { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }) =
+    Aiur.AIR.padMessage width (Aiur.buildClaim selection.function input selection.success).toList
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.global_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    ∀ {memory : Aiur.Bytecode.AIR.Memory} (input : Array Aiur.G),
+      input.size = selection.inputSize →
+        (∀ (row : Aiur.AIR.FunctionRow),
+            row ∈ tables.functions → Aiur.AIR.FunctionRow.Valid backend.compiled.bytecode memory row) →
+          List.map Aiur.AIR.functionMessage
+                (Aiur.AIR.functionQueries
+                  [{ function := selection.function, inputs := input, outputs := selection.success, rank := 0 }]
+                  tables.functions) ⊆
+              queries →
+            List.map Aiur.AIR.rangeMessage (Aiur.AIR.functionByteQueries tables.functions) ⊆ queries →
+              Aiur.Bytecode.AIR.Execution backend.compiled.bytecode memory
+                { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.lookupQueryBound_sound
+∀ {slots : List Nat} {active : List Bool} {degrees : List Nat} {result : Nat},
+  Aiur.lookupQueryBound slots active degrees = some result →
+    active.any id = true ∧
+      ∃ total, Aiur.lookupSlotSum slots active degrees = some total ∧ result = 1 + total ∧ result < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.lookupQueryBound_consumer_count
+∀ {slots : List Nat} {active : List Bool} {degrees : List Nat} {result total : Nat},
+  Aiur.lookupQueryBound slots active degrees = some result →
+    Aiur.lookupSlotSum slots active degrees = some total →
+      ∀ {α : Type u} (queries : List α), queries.length ≤ total → queries.length + 1 < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.lookupQueryBound_shape
+∀ {slots : List Nat} {active : List Bool} {degrees : List Nat} {result : Nat},
+  Aiur.lookupQueryBound slots active degrees = some result →
+    active.any id = true ∧
+      slots.length = active.length ∧
+        degrees.length = List.count true active ∧ ∀ (degree : Nat), degree ∈ degrees → degree < 64
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.lookupQueryBound_step_no_overflow
+∀ {used height slots : Nat},
+  used + height * slots < Aiur.gSize.toNat → height * slots < 2 ^ 64 ∧ used + height * slots < 2 ^ 64
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.lookupQueryBound_complete
+∀ {slots : List Nat} {active : List Bool} {degrees : List Nat} {total : Nat},
+  active.any id = true →
+    Aiur.lookupSlotSum slots active degrees = some total →
+      (∀ (degree : Nat), degree ∈ degrees → degree < 64) →
+        1 + total < Aiur.gSize.toNat → Aiur.lookupQueryBound slots active degrees = some (1 + total)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.lookupSlotSum_bounded
+∀ {slots : List Nat} {active : List Bool} {degrees : List Nat} {total maxSlots maxDegree : Nat},
+  Aiur.lookupSlotSum slots active degrees = some total →
+    (∀ (count : Nat), count ∈ slots → count ≤ maxSlots) →
+      (∀ (degree : Nat), degree ∈ degrees → degree ≤ maxDegree) → total ≤ slots.length * (2 ^ maxDegree * maxSlots)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.lookupQueryBound_encodedKey
+∀ {slots : List Nat} {active : List Bool} {degrees : List Nat} {total : Nat},
+  active.any id = true →
+    Aiur.lookupSlotSum slots active degrees = some total →
+      slots.length < 65536 →
+        (∀ (count : Nat), count ∈ slots → count < 65536) →
+          (∀ (degree : Nat), degree ∈ degrees → degree ≤ 32) →
+            Aiur.lookupQueryBound slots active degrees = some (1 + total)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.GlobalLookups.of_budget
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {slots : List Nat} {active : List Bool} {degrees : List Nat}
+  {result total : Nat},
+  Aiur.lookupQueryBound slots active degrees = some result →
+    Aiur.lookupSlotSum slots active degrees = some total →
+      ∀ (root : List Aiur.G) (queries : List (List Aiur.G)),
+        queries.length ≤ total →
+          Aiur.AIR.PaddedLookupBalance width (root :: queries) tables.providers →
+            (∀ (query : List Aiur.G), query ∈ root :: queries → query.length ≤ width) →
+              Aiur.AIR.GlobalLookups tables width (root :: queries)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.weightedMessage_active
+∀ (width : Nat) {parts : List (Aiur.G × List Aiur.G)},
+  (∀ (part : Aiur.G × List Aiur.G), part ∈ parts → Aiur.AIR.booleanConstraint part.fst = 0) →
+    parts.length < Aiur.gSize.toNat →
+      Aiur.AIR.selectorSum (List.map Prod.fst parts) = 1 →
+        ∃ chosen,
+          chosen ∈ parts ∧
+            chosen.fst = 1 ∧
+              Aiur.AIR.padMessage width (Aiur.AIR.weightedMessage parts) = Aiur.AIR.padMessage width chosen.snd
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.weightedMessage_inactive
+∀ (width : Nat) {parts : List (Aiur.G × List Aiur.G)},
+  (∀ (part : Aiur.G × List Aiur.G), part ∈ parts → Aiur.AIR.booleanConstraint part.fst = 0) →
+    parts.length < Aiur.gSize.toNat →
+      Aiur.AIR.selectorSum (List.map Prod.fst parts) = 0 →
+        Aiur.AIR.padMessage width (Aiur.AIR.weightedMessage parts) = Aiur.AIR.padMessage width []
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.slotMessage_active
+∀ (width : Nat) (branchless : Bool) {parts : List (Aiur.G × List Aiur.G)},
+  (branchless = true → parts.length = 1) →
+    (∀ (part : Aiur.G × List Aiur.G), part ∈ parts → Aiur.AIR.booleanConstraint part.fst = 0) →
+      parts.length < Aiur.gSize.toNat →
+        Aiur.AIR.selectorSum (List.map Prod.fst parts) = 1 →
+          ∃ chosen,
+            chosen ∈ parts ∧
+              chosen.fst = 1 ∧
+                Aiur.AIR.padMessage width (Aiur.AIR.slotMessage branchless parts) = Aiur.AIR.padMessage width chosen.snd
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.continuation_merge
+∀ {parent : Aiur.G} {parts : List (Aiur.G × List Aiur.G)} {merged : List Aiur.G},
+  parent = 1 →
+    (∀ (part : Aiur.G × List Aiur.G), part ∈ parts → Aiur.AIR.booleanConstraint part.fst = 0) →
+      parts.length < Aiur.gSize.toNat →
+        Aiur.AIR.selectorSum (List.map Prod.fst parts) = 1 →
+          (∀ (part : Aiur.G × List Aiur.G), part ∈ parts → part.snd.length = merged.length) →
+            (∀ (i : Nat),
+                i < merged.length →
+                  parent *
+                      (merged[i]?.getD 0 -
+                        Aiur.AIR.selectorSum (List.map (fun part => part.fst * part.snd[i]?.getD 0) parts)) =
+                    0) →
+              ∃ chosen, chosen ∈ parts ∧ chosen.fst = 1 ∧ merged = chosen.snd
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.selectorFlow_sound
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block),
+  (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied → (Aiur.Bytecode.Block.selectorFlow selector block).Sound
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.selectorFlow_yields_empty
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block) (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.Block.lookupShapes program none block = true →
+    (Aiur.Bytecode.Block.selectorFlow selector block).yields = []
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.selectorFlow_active_return
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block) (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.Block.lookupShapes program none block = true →
+    (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied →
+      (Aiur.Bytecode.Block.selectorFlow selector block).returns.length < Aiur.gSize.toNat →
+        (Aiur.Bytecode.Block.selectorFlow selector block).entry = 1 →
+          ∃ before after,
+            (Aiur.Bytecode.Block.selectorFlow selector block).returns = before ++ 1 :: after ∧
+              ∀ (value : Aiur.G), value ∈ before ++ after → value = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.selectorFlow_provider_return
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block) (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.Block.lookupShapes program none block = true →
+    (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied →
+      (Aiur.Bytecode.Block.selectorFlow selector block).returns.length < Aiur.gSize.toNat →
+        ∀ (multiplicity : Aiur.G),
+          multiplicity ≠ 0 →
+            Aiur.AIR.activityConstraint multiplicity (Aiur.Bytecode.Block.selectorFlow selector block).entry = 0 →
+              ∃ before after,
+                (Aiur.Bytecode.Block.selectorFlow selector block).returns = before ++ 1 :: after ∧
+                  ∀ (value : Aiur.G), value ∈ before ++ after → value = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.SelectorFlow.Sound.inactive_terminal
+∀ {flow : Aiur.AIR.SelectorFlow},
+  flow.Sound →
+    flow.returns.length + flow.yields.length < Aiur.gSize.toNat →
+      flow.entry = 0 → ∀ (value : Aiur.G), value ∈ flow.returns ++ flow.yields → value = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.SelectorFlow.Sound.return_stops_continuation
+∀ {flow : Aiur.AIR.SelectorFlow},
+  flow.Sound →
+    flow.returns.length + flow.yields.length < Aiur.gSize.toNat →
+      flow.entry = 1 → 1 ∈ flow.returns → Aiur.AIR.selectorSum flow.yields = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.SelectorFlow.Sound.yield_starts_continuation
+∀ {flow : Aiur.AIR.SelectorFlow},
+  flow.Sound →
+    flow.returns.length + flow.yields.length < Aiur.gSize.toNat →
+      flow.entry = 1 → 1 ∈ flow.yields → Aiur.AIR.selectorSum flow.yields = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.returnGates_reflects
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (incoming : Aiur.G) (block : Aiur.Bytecode.Block),
+  (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied →
+    incoming = (Aiur.Bytecode.Block.selectorFlow selector block).entry →
+      Aiur.Bytecode.Block.returnGates selector incoming block =
+        (Aiur.Bytecode.Block.selectorFlow selector block).returns
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.return_message
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block) (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.Block.lookupShapes program none block = true →
+    (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied →
+      (Aiur.Bytecode.Block.selectorFlow selector block).returns.length < Aiur.gSize.toNat →
+        ∀ (multiplicity : Aiur.G),
+          multiplicity ≠ 0 →
+            Aiur.AIR.activityConstraint multiplicity (Aiur.Bytecode.Block.selectorFlow selector block).entry = 0 →
+              ∀ (width : Nat) (branchless : Bool) (parts : List (Aiur.G × List Aiur.G)),
+                List.map Prod.fst parts =
+                    Aiur.Bytecode.Block.returnGates selector (Aiur.Bytecode.Block.selectorFlow selector block).entry
+                      block →
+                  (branchless = true → parts.length = 1) →
+                    ∃ chosen,
+                      chosen ∈ parts ∧
+                        chosen.fst = 1 ∧
+                          Aiur.AIR.padMessage width (Aiur.AIR.slotMessage branchless parts) =
+                            Aiur.AIR.padMessage width chosen.snd
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitOp_step
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ {program : Aiur.Bytecode.Toplevel} {op : Aiur.Bytecode.Op},
+          Aiur.Bytecode.Op.lookupShape program op = true →
+            ∀ {row : Nat → Aiur.G} {selector rank : Aiur.G} {values : Array Aiur.AIR.RowValue}
+              {emission : Aiur.AIR.OpEmission},
+              Aiur.AIR.emitOp row selector rank op values = some emission →
+                selector = 1 →
+                  (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                    emission.queries ⊆ queries →
+                      Aiur.Bytecode.AIR.Step (Aiur.AIR.memoryFacts tables.memory) op (Aiur.AIR.rowValues values)
+                        (Aiur.AIR.rowValues values ++ Aiur.AIR.rowValues emission.outputs)
+                        (List.map Prod.fst emission.calls)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitOps_run
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ {program : Aiur.Bytecode.Toplevel} {ops : List Aiur.Bytecode.Op},
+          (∀ (op : Aiur.Bytecode.Op), op ∈ ops → Aiur.Bytecode.Op.lookupShape program op = true) →
+            ∀ {row : Nat → Aiur.G} {selector rank : Aiur.G} {values : Array Aiur.AIR.RowValue} {column : Nat}
+              {emission : Aiur.AIR.OpsEmission},
+              Aiur.AIR.emitOps row selector rank ops values column = some emission →
+                selector = 1 →
+                  (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                    emission.queries ⊆ queries →
+                      Aiur.Bytecode.AIR.RunOps (Aiur.AIR.memoryFacts tables.memory) ops (Aiur.AIR.rowValues values)
+                        (Aiur.AIR.rowValues emission.values) (List.map Prod.fst emission.calls)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitOp_calls
+∀ {row : Nat → Aiur.G} {selector rank : Aiur.G} {op : Aiur.Bytecode.Op} {values : Array Aiur.AIR.RowValue}
+  {emission : Aiur.AIR.OpEmission},
+  Aiur.AIR.emitOp row selector rank op values = some emission →
+    Aiur.AIR.CallsEmitted rank selector emission.equations emission.queries emission.calls
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.emitOps_calls
+∀ {row : Nat → Aiur.G} {selector rank : Aiur.G} {ops : List Aiur.Bytecode.Op} {values : Array Aiur.AIR.RowValue}
+  {column : Nat} {emission : Aiur.AIR.OpsEmission},
+  Aiur.AIR.emitOps row selector rank ops values column = some emission →
+    Aiur.AIR.CallsEmitted rank selector emission.equations emission.queries emission.calls
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.CallsEmitted.ordered
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {pool : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width pool →
+    ∀ {rank selector : Aiur.G} {equations : List Aiur.G} {queries : List (List Aiur.G)}
+      {calls : List (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G))},
+      Aiur.AIR.CallsEmitted rank selector equations queries calls →
+        selector = 1 →
+          (∀ (equation : Aiur.G), equation ∈ equations → equation = 0) →
+            queries ⊆ pool →
+              rank.n < Aiur.AIR.callRankBound →
+                ∀ {edge : Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)},
+                  edge ∈ calls →
+                    edge.fst.rank.n < Aiur.AIR.callRankBound →
+                      Aiur.AIR.functionMessage edge.fst ∈ pool ∧ rank.n < edge.fst.rank.n
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.active_array_equality
+∀ {selector : Aiur.G} {left right : Array Aiur.G},
+  selector = 1 →
+    ∀ (sizes : left.size = right.size),
+      (∀ (equation : Aiur.G), (equation ∈ List.ofFn fun i => selector * (left[i] - right[↑i]?.getD 0)) → equation = 0) →
+        left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.Block.selectorFlow_boolean
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block),
+  (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied →
+    Aiur.AIR.booleanConstraint (Aiur.Bytecode.Block.selectorFlow selector block).entry = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.MatchPolynomials.active_branch
+∀ {selector : Aiur.Bytecode.SelIdx → Aiur.G} {scrutinee : Aiur.G} {branches : Array (Aiur.G × Aiur.Bytecode.Block)}
+  {fallback : Option Aiur.Bytecode.Block},
+  Aiur.Bytecode.MatchPolynomials selector scrutinee branches fallback →
+    (Aiur.AIR.SelectorFlow.join (Aiur.Bytecode.branchSelectorFlows selector branches fallback)).Satisfied →
+      branches.size + fallback.toList.length < Aiur.gSize.toNat →
+        (Aiur.AIR.SelectorFlow.join (Aiur.Bytecode.branchSelectorFlows selector branches fallback)).entry = 1 →
+          ∃ block,
+            Aiur.Bytecode.AIR.SelectArm scrutinee branches fallback block ∧
+              (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied ∧
+                (Aiur.Bytecode.Block.selectorFlow selector block).entry = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.MatchPolynomials.active_match
+∀ {selector : Aiur.Bytecode.SelIdx → Aiur.G} {scrutinee : Aiur.G} {index : Aiur.Bytecode.ValIdx}
+  {branches : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block},
+  Aiur.Bytecode.MatchPolynomials selector scrutinee branches fallback →
+    (Aiur.Bytecode.Ctrl.selectorFlow selector (Aiur.Bytecode.Ctrl.match index branches fallback)).Satisfied →
+      branches.size + fallback.toList.length < Aiur.gSize.toNat →
+        (Aiur.Bytecode.Ctrl.selectorFlow selector (Aiur.Bytecode.Ctrl.match index branches fallback)).entry = 1 →
+          ∃ block,
+            Aiur.Bytecode.AIR.SelectArm scrutinee branches fallback block ∧
+              (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied ∧
+                (Aiur.Bytecode.Block.selectorFlow selector block).entry = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.MatchPolynomials.active_matchContinue
+∀ {selector : Aiur.Bytecode.SelIdx → Aiur.G} {scrutinee : Aiur.G} {index : Aiur.Bytecode.ValIdx}
+  {branches : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block} {outputs aux lookups : Nat}
+  {continuation : Aiur.Bytecode.Block},
+  Aiur.Bytecode.MatchPolynomials selector scrutinee branches fallback →
+    (Aiur.Bytecode.Ctrl.selectorFlow selector
+          (Aiur.Bytecode.Ctrl.matchContinue index branches fallback outputs aux lookups continuation)).Satisfied →
+      branches.size + fallback.toList.length < Aiur.gSize.toNat →
+        (Aiur.Bytecode.Ctrl.selectorFlow selector
+                (Aiur.Bytecode.Ctrl.matchContinue index branches fallback outputs aux lookups continuation)).entry =
+            1 →
+          ∃ block,
+            Aiur.Bytecode.AIR.SelectArm scrutinee branches fallback block ∧
+              (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied ∧
+                (Aiur.Bytecode.Block.selectorFlow selector block).entry = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_projection
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block)
+  {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+    Aiur.AIR.EmissionProjection (Aiur.Bytecode.Block.selectorFlow selector block)
+      (Aiur.Bytecode.Block.returnGates selector incoming block) emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_selectors
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block)
+  {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+    (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+      (Aiur.Bytecode.Block.selectorFlow selector block).Satisfied
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.mergeEquations_chosen
+∀ (row : Nat → Aiur.G) {parent : Aiur.G} {column size : Nat} {parts : List (Aiur.G × Array Aiur.AIR.RowValue)},
+  parent = 1 →
+    (∀ (part : Aiur.G × Array Aiur.AIR.RowValue), part ∈ parts → Aiur.AIR.booleanConstraint part.fst = 0) →
+      parts.length < Aiur.gSize.toNat →
+        Aiur.AIR.selectorSum (List.map Prod.fst parts) = 1 →
+          ∀ {chosen : Array Aiur.AIR.RowValue},
+            (1, chosen) ∈ parts →
+              chosen.size = size →
+                (∀ (equation : Aiur.G),
+                    equation ∈ Aiur.AIR.mergeEquations row parent column size parts → equation = 0) →
+                  Aiur.AIR.rowValues (Aiur.AIR.rowAdvice row column size) = Aiur.AIR.rowValues chosen
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.branchRows_selected
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (matched : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  (fallback : Option Aiur.Bytecode.Block) {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.branchRows row selector context matched values column lookup branches fallback = some emission →
+    (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+      branches.size + fallback.toList.length < Aiur.gSize.toNat →
+        (Aiur.AIR.SelectorFlow.join (Aiur.Bytecode.branchSelectorFlows selector branches fallback)).entry = 1 →
+          ∃ block bodyColumn body,
+            Aiur.Bytecode.AIR.SelectArm matched branches fallback block ∧
+              (Aiur.Bytecode.Block.selectorFlow selector block).entry = 1 ∧
+                Aiur.Bytecode.Block.emitRow row selector context (Aiur.Bytecode.Block.selectorFlow selector block).entry
+                      values bodyColumn lookup block =
+                    some body ∧
+                  Aiur.AIR.EmissionIncluded body emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_run
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (program : Aiur.Bytecode.Toplevel) (yieldSize : Option Nat) (row : Nat → Aiur.G)
+          (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+          (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block),
+          Aiur.Bytecode.Block.lookupShapes program yieldSize block = true →
+            Aiur.Bytecode.Block.rowBounds selector block →
+              ∀ {emission : Aiur.AIR.BlockEmission},
+                Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+                  incoming = 1 →
+                    incoming = (Aiur.Bytecode.Block.selectorFlow selector block).entry →
+                      (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                        emission.QueriesIn queries →
+                          ∃ outcome calls,
+                            Aiur.Bytecode.AIR.RunBlock (Aiur.AIR.memoryFacts tables.memory) block
+                                (Aiur.AIR.rowValues values) outcome (List.map Prod.fst calls) ∧
+                              emission.TerminalAt outcome ∧ emission.CallsAt calls
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_tracks_calls
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block)
+  {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+    Aiur.AIR.BlockEmission.TracksCalls context.rank emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_inputs
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block)
+  {emission : Aiur.AIR.BlockEmission} {inputs : Array Aiur.G},
+  Aiur.AIR.RowInputs context.inputSize inputs values →
+    Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+      Aiur.AIR.InputPreservation context inputs emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.emitRow_run
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (program : Aiur.Bytecode.Toplevel) (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G)
+          (functionIndex : Aiur.Bytecode.FunIdx) (rank : Aiur.G) (values : Array Aiur.AIR.RowValue)
+          (column lookup : Nat) (function : Aiur.Bytecode.Function),
+          program.functions[functionIndex]? = some function →
+            values.size = function.layout.inputSize →
+              Aiur.Bytecode.Block.lookupShapes program none function.body = true →
+                Aiur.Bytecode.Block.rowBounds selector function.body →
+                  ∀ {emission : Aiur.AIR.BlockEmission},
+                    Aiur.Bytecode.Function.emitRow row selector functionIndex rank values column lookup function =
+                        some emission →
+                      (Aiur.Bytecode.Block.selectorFlow selector function.body).entry = 1 →
+                        (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                          emission.QueriesIn queries →
+                            ∃ request calls,
+                              (1, request) ∈ emission.returns ∧
+                                request.function = functionIndex ∧
+                                  request.inputs = Aiur.AIR.rowValues values ∧
+                                    request.rank = rank ∧
+                                      Aiur.Bytecode.AIR.RunFunction program (Aiur.AIR.memoryFacts tables.memory) request
+                                          (List.map Prod.fst calls) ∧
+                                        emission.CallsAt calls ∧
+                                          Aiur.AIR.CallsEmitted rank 1 emission.equations queries calls
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.emitRow_valid
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (program : Aiur.Bytecode.Toplevel) (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G)
+          (functionIndex : Aiur.Bytecode.FunIdx) (rankBytes : Fin 6 → Aiur.G) (values : Array Aiur.AIR.RowValue)
+          (column lookup : Nat) (function : Aiur.Bytecode.Function),
+          program.functions[functionIndex]? = some function →
+            values.size = function.layout.inputSize →
+              Aiur.Bytecode.Block.lookupShapes program none function.body = true →
+                Aiur.Bytecode.Block.rowBounds selector function.body →
+                  ∀ {emission : Aiur.AIR.BlockEmission},
+                    Aiur.Bytecode.Function.emitRow row selector functionIndex (Aiur.AIR.packRank rankBytes) values
+                          column lookup function =
+                        some emission →
+                      ∀ (multiplicity : Aiur.G),
+                        multiplicity ≠ 0 →
+                          Aiur.AIR.activityConstraint multiplicity
+                                (Aiur.Bytecode.Block.selectorFlow selector function.body).entry =
+                              0 →
+                            (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                              emission.QueriesIn queries →
+                                ∃ interpreted,
+                                  Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory) interpreted ∧
+                                    (1, interpreted.request) ∈ emission.returns ∧
+                                      interpreted.request.function = functionIndex ∧
+                                        interpreted.request.inputs = Aiur.AIR.rowValues values ∧
+                                          interpreted.request.rank = Aiur.AIR.packRank rankBytes ∧
+                                            interpreted.rankBytes = rankBytes ∧
+                                              interpreted.selector =
+                                                  (Aiur.Bytecode.Block.selectorFlow selector function.body).entry ∧
+                                                interpreted.multiplicity = multiplicity ∧
+                                                  emission.CallsAt interpreted.calls ∧
+                                                    Aiur.AIR.CallsEmitted (Aiur.AIR.packRank rankBytes) 1
+                                                      emission.equations queries interpreted.calls
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.slotMessage_chosen
+∀ (width : Nat) (branchless : Bool) {parts : List (Aiur.G × List Aiur.G)},
+  (branchless = true → parts.length = 1) →
+    (∀ (part : Aiur.G × List Aiur.G), part ∈ parts → Aiur.AIR.booleanConstraint part.fst = 0) →
+      parts.length < Aiur.gSize.toNat →
+        Aiur.AIR.selectorSum (List.map Prod.fst parts) = 1 →
+          ∀ {chosen : Aiur.G × List Aiur.G},
+            chosen ∈ parts →
+              chosen.fst = 1 →
+                Aiur.AIR.padMessage width (Aiur.AIR.slotMessage branchless parts) = Aiur.AIR.padMessage width chosen.snd
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.emitRow_message
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (functionIndex : Aiur.Bytecode.FunIdx) (rank : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (function : Aiur.Bytecode.Function)
+  (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.Block.lookupShapes program none function.body = true →
+    ∀ {emission : Aiur.AIR.BlockEmission},
+      Aiur.Bytecode.Function.emitRow row selector functionIndex rank values column lookup function = some emission →
+        (Aiur.Bytecode.Block.selectorFlow selector function.body).entry = 1 →
+          (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+            emission.returns.length < Aiur.gSize.toNat →
+              ∀ (width : Nat) (branchless : Bool),
+                (branchless = true → emission.returns.length = 1) →
+                  ∀ {request : Aiur.Bytecode.AIR.Call},
+                    (1, request) ∈ emission.returns →
+                      Aiur.AIR.padMessage width
+                          (Aiur.AIR.slotMessage branchless
+                            (List.map (fun part => (part.fst, Aiur.AIR.functionMessage part.snd)) emission.returns)) =
+                        Aiur.AIR.padMessage width (Aiur.AIR.functionMessage request)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_equation_querySlots
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block),
+  Aiur.Bytecode.Block.rowBounds selector block →
+    ∀ {emission : Aiur.AIR.BlockEmission},
+      Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+        incoming = (Aiur.Bytecode.Block.selectorFlow selector block).entry →
+          (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+            Aiur.AIR.QuerySlots incoming lookup emission.lookup emission.queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.QuerySlots.slot_multiplicity
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ (slot : Nat), Aiur.AIR.querySlotMultiplicity queries slot = Aiur.G.ofNat (Aiur.AIR.queryCount queries slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.QuerySlots.multiplicity_boolean
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ (slot : Nat), Aiur.AIR.querySlotMultiplicity queries slot = 0 ∨ Aiur.AIR.querySlotMultiplicity queries slot = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.QuerySlots.active_singleton
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ {query : Aiur.AIR.QueryPart},
+      query ∈ queries → query.selector = 1 → Aiur.AIR.activeQuerySlot queries query.slot = [query]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.QuerySlots.slot_message
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ (width : Nat) (branchless : Bool),
+      (branchless = true → ∀ (slot : Nat), (Aiur.AIR.querySlotParts queries slot).length ≤ 1) →
+        ∀ {query : Aiur.AIR.QueryPart},
+          query ∈ queries →
+            query.selector = 1 →
+              Aiur.AIR.padMessage width (Aiur.AIR.slotMessage branchless (Aiur.AIR.querySlotParts queries query.slot)) =
+                Aiur.AIR.padMessage width query.message
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.QuerySlots.queries_reflect
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ (width : Nat) (branchless : Bool),
+      (branchless = true → ∀ (slot : Nat), (Aiur.AIR.querySlotParts queries slot).length ≤ 1) →
+        ∀ (limit : Nat),
+          List.map (Aiur.AIR.padMessage width) (Aiur.AIR.encodedQueries branchless queries limit) =
+            List.map (Aiur.AIR.padMessage width) (Aiur.AIR.decodedQueries queries limit)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.QuerySlots.padded_balance
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ (width : Nat) (branchless : Bool),
+      (branchless = true → ∀ (slot : Nat), (Aiur.AIR.querySlotParts queries slot).length ≤ 1) →
+        ∀ (limit : Nat) (providers : List (Aiur.AIR.Provider (List Aiur.G))),
+          Aiur.AIR.PaddedLookupBalance width (Aiur.AIR.encodedQueries branchless queries limit) providers →
+            Aiur.AIR.PaddedLookupBalance width (Aiur.AIR.decodedQueries queries limit) providers
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.decodedQueries_length
+∀ (queries : List Aiur.AIR.QueryPart) (limit : Nat), (Aiur.AIR.decodedQueries queries limit).length ≤ limit
+AXIOMS [propext]
+ROOT Aiur.Bytecode.Block.emitRow_queried_pool
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block),
+  Aiur.Bytecode.Block.rowBounds selector block →
+    ∀ {emission : Aiur.AIR.BlockEmission},
+      Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+        incoming = (Aiur.Bytecode.Block.selectorFlow selector block).entry →
+          (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+            ∀ {emissions : List Aiur.AIR.BlockEmission},
+              emission ∈ emissions → emission.QueriesIn (Aiur.AIR.blockQueryPool emissions)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.emitRow_pool_valid
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {emissions : List Aiur.AIR.BlockEmission},
+  Aiur.AIR.GlobalLookups tables width (Aiur.AIR.blockQueryPool emissions) →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (program : Aiur.Bytecode.Toplevel) (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G)
+          (functionIndex : Aiur.Bytecode.FunIdx) (rankBytes : Fin 6 → Aiur.G) (values : Array Aiur.AIR.RowValue)
+          (column lookup : Nat) (function : Aiur.Bytecode.Function),
+          program.functions[functionIndex]? = some function →
+            values.size = function.layout.inputSize →
+              Aiur.Bytecode.Block.lookupShapes program none function.body = true →
+                Aiur.Bytecode.Block.rowBounds selector function.body →
+                  ∀ {emission : Aiur.AIR.BlockEmission},
+                    Aiur.Bytecode.Function.emitRow row selector functionIndex (Aiur.AIR.packRank rankBytes) values
+                          column lookup function =
+                        some emission →
+                      emission ∈ emissions →
+                        ∀ (multiplicity : Aiur.G),
+                          multiplicity ≠ 0 →
+                            Aiur.AIR.activityConstraint multiplicity
+                                  (Aiur.Bytecode.Block.selectorFlow selector function.body).entry =
+                                0 →
+                              (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                                ∃ interpreted,
+                                  Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory) interpreted ∧
+                                    (1, interpreted.request) ∈ emission.returns ∧
+                                      interpreted.request.function = functionIndex ∧
+                                        interpreted.request.inputs = Aiur.AIR.rowValues values ∧
+                                          interpreted.request.rank = Aiur.AIR.packRank rankBytes ∧
+                                            interpreted.rankBytes = rankBytes ∧
+                                              interpreted.selector =
+                                                  (Aiur.Bytecode.Block.selectorFlow selector function.body).entry ∧
+                                                interpreted.multiplicity = multiplicity ∧
+                                                  emission.CallsAt interpreted.calls ∧
+                                                    Aiur.AIR.CallsEmitted (Aiur.AIR.packRank rankBytes) 1
+                                                      emission.equations (Aiur.AIR.blockQueryPool emissions)
+                                                      interpreted.calls
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitMembers_spec
+∀ (row : Nat → Aiur.G) (rank : Aiur.G) (column lookup selectorBase : Nat) (program : Aiur.Bytecode.Toplevel)
+  (indices : List Aiur.Bytecode.FunIdx) {members : List Aiur.AIR.MemberEmission},
+  Aiur.AIR.emitMembers row rank column lookup selectorBase program indices = some members →
+    List.map Aiur.AIR.MemberEmission.functionIndex members = indices ∧
+      ∀ (member : Aiur.AIR.MemberEmission),
+        member ∈ members → Aiur.AIR.MemberEmission.FromProgram row rank column lookup program member
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_spec
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    emission = Aiur.AIR.circuitEmission row circuit emission.members ∧
+      List.map Aiur.AIR.MemberEmission.functionIndex emission.members = circuit.members.toList ∧
+        ∀ (member : Aiur.AIR.MemberEmission),
+          member ∈ emission.members →
+            Aiur.AIR.MemberEmission.FromProgram row (Aiur.AIR.packRank (Aiur.AIR.circuitRankBytes row circuit.layout))
+              (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6) 4 program member
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_boolean
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+      Aiur.AIR.booleanConstraint emission.selector = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_active_member
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+      circuit.members.size < Aiur.gSize.toNat →
+        emission.multiplicity ≠ 0 →
+          ∃ member,
+            member ∈ emission.members ∧
+              Aiur.AIR.MemberEmission.entry row member = 1 ∧
+                Aiur.AIR.MemberEmission.FromProgram row (Aiur.AIR.packRank emission.rankBytes)
+                  (circuit.layout.inputSize + circuit.layout.selectors + 1 + 6) 4 program member
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_querySlots
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    circuit.members.size < Aiur.gSize.toNat →
+      (∀ (member : Aiur.AIR.MemberEmission),
+          member ∈ emission.members →
+            Aiur.Bytecode.Block.rowBounds (Aiur.AIR.MemberEmission.selector row member) member.function.body) →
+        4 ≤ circuit.layout.lookups →
+          (∀ (member : Aiur.AIR.MemberEmission),
+              member ∈ emission.members → member.body.lookup ≤ circuit.layout.lookups) →
+            (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+              Aiur.AIR.QuerySlots emission.selector 1 emission.lookupCount emission.queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitEmission_rank_queried
+∀ {row : Nat → Aiur.G} {circuit : Aiur.Bytecode.Circuit} {members : List Aiur.AIR.MemberEmission}
+  {queries : List (List Aiur.G)},
+  (Aiur.AIR.circuitEmission row circuit members).QueriesIn queries →
+    (Aiur.AIR.circuitEmission row circuit members).selector = 1 →
+      List.map Aiur.AIR.rangeMessage
+          (Aiur.AIR.rankByteQueries (Aiur.AIR.circuitEmission row circuit members).rankBytes) ⊆
+        queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemberEmission.FromProgram.return_count
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} {column lookup : Nat} {program : Aiur.Bytecode.Toplevel}
+  {member : Aiur.AIR.MemberEmission},
+  Aiur.AIR.MemberEmission.FromProgram row rank column lookup program member →
+    Aiur.Bytecode.Block.lookupShapes program none member.function.body = true →
+      (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row member)
+                member.function.body).returns.length <
+          Aiur.gSize.toNat →
+        (∀ (equation : Aiur.G), equation ∈ member.body.equations → equation = 0) →
+          List.count 1 (List.map Prod.fst member.body.returns) =
+            Aiur.AIR.gateCount (Aiur.AIR.MemberEmission.entry row member)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitEmission_return_count
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} {column lookup : Nat} {program : Aiur.Bytecode.Toplevel}
+  {circuit : Aiur.Bytecode.Circuit} {members : List Aiur.AIR.MemberEmission},
+  (∀ (member : Aiur.AIR.MemberEmission),
+      member ∈ members → Aiur.AIR.MemberEmission.FromProgram row rank column lookup program member) →
+    (∀ (member : Aiur.AIR.MemberEmission),
+        member ∈ members → Aiur.Bytecode.Block.lookupShapes program none member.function.body = true) →
+      members.length < Aiur.gSize.toNat →
+        (∀ (member : Aiur.AIR.MemberEmission),
+            member ∈ members →
+              (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row member)
+                      member.function.body).returns.length <
+                Aiur.gSize.toNat) →
+          (∀ (equation : Aiur.G), equation ∈ (Aiur.AIR.circuitEmission row circuit members).equations → equation = 0) →
+            (Aiur.AIR.circuitEmission row circuit members).selector = 1 →
+              List.count 1 (List.map Prod.fst (Aiur.AIR.circuitEmission row circuit members).returns) = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitEmission_return_message
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} {column lookup : Nat} {program : Aiur.Bytecode.Toplevel}
+  {circuit : Aiur.Bytecode.Circuit} {members : List Aiur.AIR.MemberEmission},
+  (∀ (member : Aiur.AIR.MemberEmission),
+      member ∈ members → Aiur.AIR.MemberEmission.FromProgram row rank column lookup program member) →
+    (∀ (member : Aiur.AIR.MemberEmission),
+        member ∈ members → Aiur.Bytecode.Block.lookupShapes program none member.function.body = true) →
+      members.length < Aiur.gSize.toNat →
+        (∀ (member : Aiur.AIR.MemberEmission),
+            member ∈ members →
+              (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row member)
+                      member.function.body).returns.length <
+                Aiur.gSize.toNat) →
+          (∀ (equation : Aiur.G), equation ∈ (Aiur.AIR.circuitEmission row circuit members).equations → equation = 0) →
+            (Aiur.AIR.circuitEmission row circuit members).selector = 1 →
+              ∀ (width : Nat),
+                ((Aiur.AIR.circuitEmission row circuit members).branchless = true →
+                    (Aiur.AIR.circuitEmission row circuit members).returns.length ≤ 1) →
+                  ∀ {request : Aiur.Bytecode.AIR.Call},
+                    (1, request) ∈ (Aiur.AIR.circuitEmission row circuit members).returns →
+                      Aiur.AIR.padMessage width ((Aiur.AIR.circuitEmission row circuit members).lookup 0).snd =
+                        Aiur.AIR.padMessage width (Aiur.AIR.functionMessage request)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_valid
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {emissions : List Aiur.AIR.CircuitEmission},
+  Aiur.AIR.GlobalLookups tables width (Aiur.AIR.circuitQueryPool emissions) →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+          {emission : Aiur.AIR.CircuitEmission},
+          Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+            emission ∈ emissions →
+              circuit.members.size < Aiur.gSize.toNat →
+                (∀ (part : Aiur.AIR.MemberEmission),
+                    part ∈ emission.members →
+                      Aiur.Bytecode.Block.rowBounds (Aiur.AIR.MemberEmission.selector row part) part.function.body) →
+                  (∀ (part : Aiur.AIR.MemberEmission),
+                      part ∈ emission.members →
+                        Aiur.Bytecode.Block.lookupShapes program none part.function.body = true) →
+                    (∀ (part : Aiur.AIR.MemberEmission),
+                        part ∈ emission.members →
+                          (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row part)
+                                  part.function.body).returns.length <
+                            Aiur.gSize.toNat) →
+                      4 ≤ circuit.layout.lookups →
+                        (∀ (part : Aiur.AIR.MemberEmission),
+                            part ∈ emission.members → part.body.lookup ≤ circuit.layout.lookups) →
+                          (emission.branchless = true → emission.returns.length ≤ 1) →
+                            (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                              emission.multiplicity ≠ 0 →
+                                ∃ selected,
+                                  selected ∈ emission.members ∧
+                                    ∃ interpreted,
+                                      Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory)
+                                          interpreted ∧
+                                        interpreted.request.function = selected.functionIndex ∧
+                                          interpreted.request.inputs =
+                                              Aiur.AIR.rowValues
+                                                (Aiur.AIR.rowAdvice row 0 selected.function.layout.inputSize) ∧
+                                            interpreted.request.rank = Aiur.AIR.packRank emission.rankBytes ∧
+                                              interpreted.rankBytes = emission.rankBytes ∧
+                                                interpreted.selector = emission.selector ∧
+                                                  interpreted.multiplicity = emission.multiplicity ∧
+                                                    (1, interpreted.request) ∈ emission.returns ∧
+                                                      Aiur.AIR.padMessage width (emission.lookup 0).snd =
+                                                          Aiur.AIR.padMessage width
+                                                            (Aiur.AIR.functionMessage interpreted.request) ∧
+                                                        selected.body.CallsAt interpreted.calls ∧
+                                                          List.map Aiur.AIR.functionMessage interpreted.requests ⊆
+                                                              Aiur.AIR.circuitQueryPool emissions ∧
+                                                            List.map Aiur.AIR.rangeMessage interpreted.byteQueries ⊆
+                                                              Aiur.AIR.circuitQueryPool emissions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Ctrl.controlCounts_spec
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (ctrl : Aiur.Bytecode.Ctrl),
+  ctrl.controlCounts.Describes (Aiur.Bytecode.Ctrl.selectorFlow selector ctrl) ∧
+    0 < ctrl.controlCounts.nodes ∧
+      (ctrl.controlCounts.nodes < Aiur.gSize.toNat → Aiur.Bytecode.Ctrl.rowBounds selector ctrl)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.controlCounts_spec
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block),
+  block.controlCounts.Describes (Aiur.Bytecode.Block.selectorFlow selector block) ∧
+    0 < block.controlCounts.nodes ∧
+      (block.controlCounts.nodes < Aiur.gSize.toNat → Aiur.Bytecode.Block.rowBounds selector block)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.rowBounds_of_controlCounts
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block),
+  block.controlCounts.nodes < Aiur.gSize.toNat → Aiur.Bytecode.Block.rowBounds selector block
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.return_bound_of_controlCounts
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block),
+  block.controlCounts.nodes < Aiur.gSize.toNat →
+    (Aiur.Bytecode.Block.selectorFlow selector block).returns.length < Aiur.gSize.toNat
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.returns_le_selectors
+∀ (selector : Aiur.Bytecode.SelIdx → Aiur.G) (block : Aiur.Bytecode.Block),
+  (Aiur.Bytecode.Block.selectorFlow selector block).returns.length ≤ block.controlCounts.leaves
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.validateRowCounts_circuit
+∀ {program : Aiur.Bytecode.Toplevel},
+  program.validateRowCounts = true →
+    ∀ {circuit : Aiur.Bytecode.Circuit},
+      circuit ∈ program.circuits → Aiur.Bytecode.Circuit.validateRowCounts program circuit = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.validateRowCounts_spec
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+      circuit.members.size < Aiur.gSize.toNat ∧
+        (∀ (part : Aiur.AIR.MemberEmission),
+            part ∈ emission.members → part.function.body.controlCounts.nodes < Aiur.gSize.toNat) ∧
+          (List.map (fun part => part.function.body.controlCounts.leaves) emission.members).sum ≤
+            circuit.layout.selectors
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_count_bounds
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+      (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+        circuit.members.size < Aiur.gSize.toNat ∧
+          (∀ (part : Aiur.AIR.MemberEmission),
+              part ∈ emission.members →
+                Aiur.Bytecode.Block.rowBounds (Aiur.AIR.MemberEmission.selector row part) part.function.body) ∧
+            (∀ (part : Aiur.AIR.MemberEmission),
+                part ∈ emission.members →
+                  (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row part)
+                          part.function.body).returns.length <
+                    Aiur.gSize.toNat) ∧
+              (emission.branchless = true → emission.returns.length ≤ 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_valid_checked
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {emissions : List Aiur.AIR.CircuitEmission},
+  Aiur.AIR.GlobalLookups tables width (Aiur.AIR.circuitQueryPool emissions) →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+          {emission : Aiur.AIR.CircuitEmission},
+          Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+            emission ∈ emissions →
+              Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+                (∀ (part : Aiur.AIR.MemberEmission),
+                    part ∈ emission.members → Aiur.Bytecode.Block.lookupShapes program none part.function.body = true) →
+                  4 ≤ circuit.layout.lookups →
+                    (∀ (part : Aiur.AIR.MemberEmission),
+                        part ∈ emission.members → part.body.lookup ≤ circuit.layout.lookups) →
+                      (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                        emission.multiplicity ≠ 0 →
+                          ∃ selected,
+                            selected ∈ emission.members ∧
+                              ∃ interpreted,
+                                Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory) interpreted ∧
+                                  interpreted.request.function = selected.functionIndex ∧
+                                    interpreted.request.inputs =
+                                        Aiur.AIR.rowValues
+                                          (Aiur.AIR.rowAdvice row 0 selected.function.layout.inputSize) ∧
+                                      interpreted.request.rank = Aiur.AIR.packRank emission.rankBytes ∧
+                                        interpreted.rankBytes = emission.rankBytes ∧
+                                          interpreted.selector = emission.selector ∧
+                                            interpreted.multiplicity = emission.multiplicity ∧
+                                              (1, interpreted.request) ∈ emission.returns ∧
+                                                Aiur.AIR.padMessage width (emission.lookup 0).snd =
+                                                    Aiur.AIR.padMessage width
+                                                      (Aiur.AIR.functionMessage interpreted.request) ∧
+                                                  selected.body.CallsAt interpreted.calls ∧
+                                                    List.map Aiur.AIR.functionMessage interpreted.requests ⊆
+                                                        Aiur.AIR.circuitQueryPool emissions ∧
+                                                      List.map Aiur.AIR.rangeMessage interpreted.byteQueries ⊆
+                                                        Aiur.AIR.circuitQueryPool emissions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuit_row_counts
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    Aiur.Bytecode.Circuit.validateRowCounts backend.compiled.bytecode circuit = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_valid_in_pool
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {emissions : List Aiur.AIR.CircuitEmission}
+  {queries : List (List Aiur.G)},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+          {emission : Aiur.AIR.CircuitEmission},
+          Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+            emission ∈ emissions →
+              Aiur.AIR.circuitQueryPool emissions ⊆ queries →
+                circuit.members.size < Aiur.gSize.toNat →
+                  (∀ (part : Aiur.AIR.MemberEmission),
+                      part ∈ emission.members →
+                        Aiur.Bytecode.Block.rowBounds (Aiur.AIR.MemberEmission.selector row part) part.function.body) →
+                    (∀ (part : Aiur.AIR.MemberEmission),
+                        part ∈ emission.members →
+                          Aiur.Bytecode.Block.lookupShapes program none part.function.body = true) →
+                      (∀ (part : Aiur.AIR.MemberEmission),
+                          part ∈ emission.members →
+                            (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row part)
+                                    part.function.body).returns.length <
+                              Aiur.gSize.toNat) →
+                        4 ≤ circuit.layout.lookups →
+                          (∀ (part : Aiur.AIR.MemberEmission),
+                              part ∈ emission.members → part.body.lookup ≤ circuit.layout.lookups) →
+                            (emission.branchless = true → emission.returns.length ≤ 1) →
+                              (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+                                emission.multiplicity ≠ 0 →
+                                  ∃ selected,
+                                    selected ∈ emission.members ∧
+                                      ∃ interpreted,
+                                        Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory)
+                                            interpreted ∧
+                                          interpreted.request.function = selected.functionIndex ∧
+                                            interpreted.request.inputs =
+                                                Aiur.AIR.rowValues
+                                                  (Aiur.AIR.rowAdvice row 0 selected.function.layout.inputSize) ∧
+                                              interpreted.request.rank = Aiur.AIR.packRank emission.rankBytes ∧
+                                                interpreted.rankBytes = emission.rankBytes ∧
+                                                  interpreted.selector = emission.selector ∧
+                                                    interpreted.multiplicity = emission.multiplicity ∧
+                                                      (1, interpreted.request) ∈ emission.returns ∧
+                                                        Aiur.AIR.padMessage width (emission.lookup 0).snd =
+                                                            Aiur.AIR.padMessage width
+                                                              (Aiur.AIR.functionMessage interpreted.request) ∧
+                                                          selected.body.CallsAt interpreted.calls ∧
+                                                            List.map Aiur.AIR.functionMessage interpreted.requests ⊆
+                                                                queries ∧
+                                                              List.map Aiur.AIR.rangeMessage interpreted.byteQueries ⊆
+                                                                queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.suppliedWeight_padded_congr
+∀ {width : Nat} {left right : List (Aiur.AIR.Provider (List Aiur.G))},
+  List.Forall₂ (Aiur.AIR.Provider.PaddedEq width) left right →
+    ∀ (message : List Aiur.G),
+      Aiur.AIR.suppliedWeight message (Aiur.AIR.mapProviders (Aiur.AIR.padMessage width) left) =
+        Aiur.AIR.suppliedWeight message (Aiur.AIR.mapProviders (Aiur.AIR.padMessage width) right)
+AXIOMS [propext]
+ROOT Aiur.AIR.PaddedLookupBalance.congr_providers
+∀ {width : Nat} {queries : List (List Aiur.G)} {left right : List (Aiur.AIR.Provider (List Aiur.G))},
+  Aiur.AIR.PaddedLookupBalance width queries left →
+    List.Forall₂ (Aiur.AIR.Provider.PaddedEq width) left right → Aiur.AIR.PaddedLookupBalance width queries right
+AXIOMS [propext]
+ROOT Aiur.Bytecode.Circuit.emitRow_provider
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+      (∀ (part : Aiur.AIR.MemberEmission),
+          part ∈ emission.members → Aiur.Bytecode.Block.lookupShapes program none part.function.body = true) →
+        (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+          emission.multiplicity ≠ 0 →
+            ∀ (width : Nat),
+              ∃ request,
+                (1, request) ∈ emission.returns ∧
+                  Aiur.AIR.padMessage width (emission.lookup 0).snd =
+                    Aiur.AIR.padMessage width (Aiur.AIR.functionMessage request)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.AuxiliaryTables.global_of_circuit_balance
+∀ (tables : Aiur.AIR.AuxiliaryTables) {width : Nat} {queries : List (List Aiur.G)}
+  {emissions : List Aiur.AIR.CircuitEmission} {functions : List Aiur.AIR.FunctionRow},
+  Aiur.AIR.PaddedLookupBalance width queries (tables.circuitProviders emissions) →
+    queries.length < Aiur.gSize.toNat →
+      (∀ (query : List Aiur.G), query ∈ queries → query.length ≤ width) →
+        List.Forall₂ (Aiur.AIR.FunctionRow.Provides width) emissions functions →
+          Aiur.AIR.GlobalLookups (tables.withFunctions functions) width queries
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.FunctionRow.inactive_valid
+∀ (program : Aiur.Bytecode.Toplevel) (memory : Aiur.Bytecode.AIR.Memory),
+  Aiur.AIR.FunctionRow.Valid program memory Aiur.AIR.FunctionRow.inactive
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.CircuitWitness.provider_row
+∀ {program : Aiur.Bytecode.Toplevel} (witness : Aiur.AIR.CircuitWitness),
+  Aiur.AIR.CircuitWitness.Emitted program witness →
+    witness.Satisfied →
+      Aiur.Bytecode.Circuit.validateRowCounts program witness.circuit = true →
+        Aiur.AIR.CircuitWitness.Shapes program witness →
+          ∀ (width : Nat), ∃ row, Aiur.AIR.FunctionRow.Provides width witness.emission row
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.CircuitWitness.interpreted_row
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)}
+  {emissions : List Aiur.AIR.CircuitEmission},
+  Aiur.AIR.GlobalLookups tables width queries →
+    (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+      (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+        ∀ {program : Aiur.Bytecode.Toplevel} (witness : Aiur.AIR.CircuitWitness),
+          Aiur.AIR.CircuitWitness.Emitted program witness →
+            witness.Satisfied →
+              Aiur.Bytecode.Circuit.validateRowCounts program witness.circuit = true →
+                Aiur.AIR.CircuitWitness.Shapes program witness →
+                  witness.LookupBounds →
+                    witness.emission ∈ emissions →
+                      Aiur.AIR.circuitQueryPool emissions ⊆ queries →
+                        ∃ row,
+                          Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory) row ∧
+                            Aiur.AIR.FunctionRow.Provides width witness.emission row ∧
+                              Aiur.AIR.FunctionRow.QueriesIn queries row
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitWitnesses_interpret
+∀ (tables : Aiur.AIR.AuxiliaryTables) {program : Aiur.Bytecode.Toplevel} (witnesses : List Aiur.AIR.CircuitWitness)
+  {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.PaddedLookupBalance width queries (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+    queries.length < Aiur.gSize.toNat →
+      (∀ (query : List Aiur.G), query ∈ queries → query.length ≤ width) →
+        (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+          (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+            program.validateRowCounts = true →
+              (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.circuit ∈ program.circuits) →
+                (∀ (witness : Aiur.AIR.CircuitWitness),
+                    witness ∈ witnesses → Aiur.AIR.CircuitWitness.Emitted program witness) →
+                  (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                    (∀ (witness : Aiur.AIR.CircuitWitness),
+                        witness ∈ witnesses → Aiur.AIR.CircuitWitness.Shapes program witness) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+                        Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses) ⊆ queries →
+                          ∃ functions,
+                            List.Forall₂ (Aiur.AIR.FunctionRow.Provides width)
+                                (List.map (fun x => x.emission) witnesses) functions ∧
+                              Aiur.AIR.GlobalLookups (tables.withFunctions functions) width queries ∧
+                                (∀ (row : Aiur.AIR.FunctionRow),
+                                    row ∈ functions →
+                                      Aiur.AIR.FunctionRow.Valid program (Aiur.AIR.memoryFacts tables.memory) row) ∧
+                                  ∀ (row : Aiur.AIR.FunctionRow),
+                                    row ∈ functions → Aiur.AIR.FunctionRow.QueriesIn queries row
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitWitnesses_execute
+∀ (tables : Aiur.AIR.AuxiliaryTables) {program : Aiur.Bytecode.Toplevel} (witnesses : List Aiur.AIR.CircuitWitness)
+  {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.PaddedLookupBalance width queries (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+    queries.length < Aiur.gSize.toNat →
+      (∀ (query : List Aiur.G), query ∈ queries → query.length ≤ width) →
+        (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+          (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+            program.validateRowCounts = true →
+              program.validateLookupShapes = true →
+                (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.circuit ∈ program.circuits) →
+                  (∀ (witness : Aiur.AIR.CircuitWitness),
+                      witness ∈ witnesses → Aiur.AIR.CircuitWitness.Emitted program witness) →
+                    (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness),
+                          witness ∈ witnesses → Aiur.AIR.CircuitWitness.Shapes program witness) →
+                        (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+                          Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses) ⊆ queries →
+                            ∀ {request : Aiur.Bytecode.AIR.Call},
+                              Aiur.Bytecode.AIR.Call.LookupShape program request →
+                                Aiur.AIR.functionMessage request ∈ queries →
+                                  Aiur.Bytecode.AIR.Execution program (Aiur.AIR.memoryFacts tables.memory) request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.PaddedLookupBalance.congr_queries
+∀ {width : Nat} {left right : List (List Aiur.G)} {providers : List (Aiur.AIR.Provider (List Aiur.G))},
+  Aiur.AIR.PaddedLookupBalance width left providers →
+    List.map (Aiur.AIR.padMessage width) left = List.map (Aiur.AIR.padMessage width) right →
+      Aiur.AIR.PaddedLookupBalance width right providers
+AXIOMS [propext]
+ROOT Aiur.BoundVerifier.Backend.public_circuit_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (tables : Aiur.AIR.AuxiliaryTables) (witnesses : List Aiur.AIR.CircuitWitness) (width : Nat) (input : Array Aiur.G),
+  input.size = selection.inputSize →
+    Aiur.AIR.PaddedLookupBalance width
+        ((Aiur.buildClaim selection.function input selection.success).toList ::
+          Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses))
+        (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+      (Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses)).length + 1 < Aiur.gSize.toNat →
+        (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+          (∀ (query : List Aiur.G),
+              query ∈ Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses) → query.length ≤ width) →
+            (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+              (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+                (∀ (witness : Aiur.AIR.CircuitWitness),
+                    witness ∈ witnesses → witness.circuit ∈ backend.compiled.bytecode.circuits) →
+                  (∀ (witness : Aiur.AIR.CircuitWitness),
+                      witness ∈ witnesses → Aiur.AIR.CircuitWitness.Emitted backend.compiled.bytecode witness) →
+                    (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness),
+                          witness ∈ witnesses → Aiur.AIR.CircuitWitness.Shapes backend.compiled.bytecode witness) →
+                        (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+                          Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts tables.memory)
+                            { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.QueryWriters.single
+∀ {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QueryWriters start finish queries → ∀ (slot : Nat), (Aiur.AIR.querySlotParts queries slot).length ≤ 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.emitRow_terminal_writers
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (function : Aiur.Bytecode.Function)
+  (functionIndex : Aiur.Bytecode.FunIdx) (rank : Aiur.G) (inputs : Array Aiur.AIR.RowValue) (column lookup : Nat)
+  {emission : Aiur.AIR.BlockEmission},
+  function.hasTerminalControl = true →
+    Aiur.Bytecode.Function.emitRow row selector functionIndex rank inputs column lookup function = some emission →
+      Aiur.AIR.QueryWriters lookup emission.lookup emission.queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitEmission_queryWriters
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} {column : Nat} {program : Aiur.Bytecode.Toplevel}
+  {circuit : Aiur.Bytecode.Circuit} {members : List Aiur.AIR.MemberEmission},
+  (∀ (member : Aiur.AIR.MemberEmission),
+      member ∈ members → Aiur.AIR.MemberEmission.FromProgram row rank column 4 program member) →
+    (Aiur.AIR.circuitEmission row circuit members).branchless = true →
+      (∀ (member : Aiur.AIR.MemberEmission), member ∈ members → member.body.lookup ≤ circuit.layout.lookups) →
+        Aiur.AIR.QueryWriters 1 circuit.layout.lookups (Aiur.AIR.circuitEmission row circuit members).queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_queryWriters
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    emission.branchless = true →
+      (∀ (member : Aiur.AIR.MemberEmission), member ∈ emission.members → member.body.lookup ≤ circuit.layout.lookups) →
+        Aiur.AIR.QueryWriters 1 emission.lookupCount emission.queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_queries_reflect
+∀ (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow row program circuit = some emission →
+    Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+      4 ≤ circuit.layout.lookups →
+        (∀ (member : Aiur.AIR.MemberEmission),
+            member ∈ emission.members → member.body.lookup ≤ circuit.layout.lookups) →
+          (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) →
+            ∀ (width : Nat),
+              List.map (Aiur.AIR.padMessage width)
+                  (Aiur.AIR.encodedQueries emission.branchless emission.queries emission.lookupCount) =
+                List.map (Aiur.AIR.padMessage width) (Aiur.AIR.decodedQueries emission.queries emission.lookupCount)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.slotMessage_member_length
+∀ (branchless : Bool) {parts : List (Aiur.G × List Aiur.G)} {part : Aiur.G × List Aiur.G},
+  part ∈ parts → part.snd.length ≤ (Aiur.AIR.slotMessage branchless parts).length
+AXIOMS [propext]
+ROOT Aiur.AIR.QuerySlots.decoded_widths
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  Aiur.AIR.QuerySlots gate start finish queries →
+    ∀ (branchless : Bool) (width : Nat),
+      (∀ (message : List Aiur.G),
+          message ∈ Aiur.AIR.encodedQueries branchless queries finish → message.length ≤ width) →
+        ∀ (message : List Aiur.G), message ∈ Aiur.AIR.decodedQueries queries finish → message.length ≤ width
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitWitnesses_queries_reflect
+∀ {program : Aiur.Bytecode.Toplevel} (witnesses : List Aiur.AIR.CircuitWitness),
+  program.validateRowCounts = true →
+    (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.circuit ∈ program.circuits) →
+      (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → Aiur.AIR.CircuitWitness.Emitted program witness) →
+        (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+          (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+            ∀ (width : Nat),
+              List.map (Aiur.AIR.padMessage width)
+                  (Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses)) =
+                List.map (Aiur.AIR.padMessage width)
+                  (Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitWitnesses_decoded_widths
+∀ {program : Aiur.Bytecode.Toplevel} (witnesses : List Aiur.AIR.CircuitWitness),
+  program.validateRowCounts = true →
+    (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.circuit ∈ program.circuits) →
+      (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → Aiur.AIR.CircuitWitness.Emitted program witness) →
+        (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+          (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+            ∀ (width : Nat),
+              (∀ (query : List Aiur.G),
+                  query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                    query.length ≤ width) →
+                ∀ (query : List Aiur.G),
+                  query ∈ Aiur.AIR.circuitQueryPool (List.map (fun x => x.emission) witnesses) → query.length ≤ width
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.encoded_circuit_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (tables : Aiur.AIR.AuxiliaryTables) (witnesses : List Aiur.AIR.CircuitWitness) (width : Nat) (input : Array Aiur.G),
+  input.size = selection.inputSize →
+    Aiur.AIR.PaddedLookupBalance width
+        ((Aiur.buildClaim selection.function input selection.success).toList ::
+          Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses))
+        (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+      (Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses)).length + 1 < Aiur.gSize.toNat →
+        (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+          (∀ (query : List Aiur.G),
+              query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                query.length ≤ width) →
+            (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+              (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+                (∀ (witness : Aiur.AIR.CircuitWitness),
+                    witness ∈ witnesses → witness.circuit ∈ backend.compiled.bytecode.circuits) →
+                  (∀ (witness : Aiur.AIR.CircuitWitness),
+                      witness ∈ witnesses → Aiur.AIR.CircuitWitness.Emitted backend.compiled.bytecode witness) →
+                    (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness),
+                          witness ∈ witnesses → Aiur.AIR.CircuitWitness.Shapes backend.compiled.bytecode witness) →
+                        (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+                          Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts tables.memory)
+                            { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.CircuitTraces.slot_sum_append
+∀ {circuits : List Aiur.Bytecode.Circuit} (traces : Aiur.AIR.CircuitTraces circuits) (otherSlots : List Nat)
+  (otherActive : List Bool) (otherDegrees : List Nat),
+  Aiur.lookupSlotSum (List.map (fun x => x.layout.lookups) circuits ++ otherSlots) (traces.bitmap ++ otherActive)
+      (traces.degrees ++ otherDegrees) =
+    Option.map (fun x => traces.capacity + x) (Aiur.lookupSlotSum otherSlots otherActive otherDegrees)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.CircuitTraces.capacity_bounded
+∀ {circuits : List Aiur.Bytecode.Circuit} (traces : Aiur.AIR.CircuitTraces circuits) {otherSlots : List Nat}
+  {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat},
+  Aiur.lookupQueryBound (List.map (fun x => x.layout.lookups) circuits ++ otherSlots) (traces.bitmap ++ otherActive)
+        (traces.degrees ++ otherDegrees) =
+      some result →
+    traces.capacity + 1 < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.emitCircuitWitness_spec
+∀ {program : Aiur.Bytecode.Toplevel} {circuit : Aiur.Bytecode.Circuit} {values : Nat → Aiur.G}
+  {witness : Aiur.AIR.CircuitWitness},
+  Aiur.AIR.emitCircuitWitness program circuit values = some witness →
+    witness.circuit = circuit ∧
+      witness.values = values ∧
+        Aiur.AIR.CircuitWitness.Emitted program witness ∧ witness.emission.lookupCount = circuit.layout.lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.encodedQueries_length
+∀ (branchless : Bool) (queries : List Aiur.AIR.QueryPart) (limit : Nat),
+  (Aiur.AIR.encodedQueries branchless queries limit).length ≤ limit
+AXIOMS [propext]
+ROOT Aiur.AIR.encodedCircuitQueryPool_uniform_bound
+∀ (witnesses : List Aiur.AIR.CircuitWitness) (slots : Nat),
+  (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.emission.lookupCount ≤ slots) →
+    (Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses)).length ≤ witnesses.length * slots
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.emitCircuitWitnesses_spec
+∀ {program : Aiur.Bytecode.Toplevel} {circuit : Aiur.Bytecode.Circuit} {values : List (Nat → Aiur.G)}
+  {witnesses : List Aiur.AIR.CircuitWitness},
+  List.mapM (Aiur.AIR.emitCircuitWitness program circuit) values = some witnesses →
+    witnesses.length = values.length ∧
+      ∀ (witness : Aiur.AIR.CircuitWitness),
+        witness ∈ witnesses →
+          witness.circuit = circuit ∧
+            Aiur.AIR.CircuitWitness.Emitted program witness ∧ witness.emission.lookupCount = circuit.layout.lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.CircuitTraces.emitWitnesses_spec
+∀ {circuits : List Aiur.Bytecode.Circuit} (traces : Aiur.AIR.CircuitTraces circuits) {program : Aiur.Bytecode.Toplevel}
+  {witnesses : List Aiur.AIR.CircuitWitness},
+  Aiur.AIR.CircuitTraces.emitWitnesses program traces = some witnesses →
+    (∀ (witness : Aiur.AIR.CircuitWitness),
+        witness ∈ witnesses → witness.circuit ∈ circuits ∧ Aiur.AIR.CircuitWitness.Emitted program witness) ∧
+      (Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses)).length ≤ traces.capacity
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.trace_circuit_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (tables : Aiur.AIR.AuxiliaryTables) (traces : Aiur.AIR.CircuitTraces backend.compiled.bytecode.circuits.toList)
+  {witnesses : List Aiur.AIR.CircuitWitness},
+  Aiur.AIR.CircuitTraces.emitWitnesses backend.compiled.bytecode traces = some witnesses →
+    ∀ {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat},
+      Aiur.lookupQueryBound
+            (List.map (fun x => x.layout.lookups) backend.compiled.bytecode.circuits.toList ++ otherSlots)
+            (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) =
+          some result →
+        ∀ (width : Nat) (input : Array Aiur.G),
+          input.size = selection.inputSize →
+            Aiur.AIR.PaddedLookupBalance width
+                ((Aiur.buildClaim selection.function input selection.success).toList ::
+                  Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses))
+                (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+              (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+                (∀ (query : List Aiur.G),
+                    query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                      query.length ≤ width) →
+                  (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+                    (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                        (∀ (witness : Aiur.AIR.CircuitWitness),
+                            witness ∈ witnesses → Aiur.AIR.CircuitWitness.Shapes backend.compiled.bytecode witness) →
+                          (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+                            Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts tables.memory)
+                              { function := selection.function, inputs := input, outputs := selection.success,
+                                rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.singletonCircuits_constrained
+∀ (program : Aiur.Bytecode.Toplevel) (nameOf : Aiur.Bytecode.FunIdx → String),
+  Aiur.Bytecode.CircuitsConstrained program.functions (program.singletonCircuits nameOf)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.CompiledToplevel.groupFunctions_constrained
+∀ {before after : Aiur.CompiledToplevel} {groups : Array (String × Array String)},
+  Aiur.Bytecode.CircuitsConstrained before.bytecode.functions before.bytecode.circuits →
+    before.groupFunctions groups = Except.ok after →
+      Aiur.Bytecode.CircuitsConstrained after.bytecode.functions after.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_circuits_constrained
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.CircuitsConstrained (Aiur.finishCompilation source raw names).bytecode.functions
+    (Aiur.finishCompilation source raw names).bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_circuits_constrained
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled →
+    Aiur.Bytecode.CircuitsConstrained compiled.bytecode.functions compiled.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuits_constrained
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.Bytecode.CircuitsConstrained backend.compiled.bytecode.functions backend.compiled.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.validateLookupShapes_function
+∀ {program : Aiur.Bytecode.Toplevel},
+  program.validateLookupShapes = true →
+    ∀ {function : Aiur.Bytecode.Function} {index : Aiur.Bytecode.FunIdx},
+      program.functions[index]? = some function →
+        function.constrained = true → Aiur.Bytecode.Block.lookupShapes program none function.body = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.CircuitWitness.shapes_of_compiled
+∀ {program : Aiur.Bytecode.Toplevel},
+  program.validateLookupShapes = true →
+    Aiur.Bytecode.CircuitsConstrained program.functions program.circuits →
+      ∀ (witness : Aiur.AIR.CircuitWitness),
+        witness.circuit ∈ program.circuits →
+          Aiur.AIR.CircuitWitness.Emitted program witness → Aiur.AIR.CircuitWitness.Shapes program witness
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.witness_shapes
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (witness : Aiur.AIR.CircuitWitness),
+  witness.circuit ∈ backend.compiled.bytecode.circuits →
+    Aiur.AIR.CircuitWitness.Emitted backend.compiled.bytecode witness →
+      Aiur.AIR.CircuitWitness.Shapes backend.compiled.bytecode witness
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.compiled_trace_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (tables : Aiur.AIR.AuxiliaryTables) (traces : Aiur.AIR.CircuitTraces backend.compiled.bytecode.circuits.toList)
+  {witnesses : List Aiur.AIR.CircuitWitness},
+  Aiur.AIR.CircuitTraces.emitWitnesses backend.compiled.bytecode traces = some witnesses →
+    ∀ {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat},
+      Aiur.lookupQueryBound
+            (List.map (fun x => x.layout.lookups) backend.compiled.bytecode.circuits.toList ++ otherSlots)
+            (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) =
+          some result →
+        ∀ (width : Nat) (input : Array Aiur.G),
+          input.size = selection.inputSize →
+            Aiur.AIR.PaddedLookupBalance width
+                ((Aiur.buildClaim selection.function input selection.success).toList ::
+                  Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses))
+                (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+              (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+                (∀ (query : List Aiur.G),
+                    query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                      query.length ≤ width) →
+                  (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+                    (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                        (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.LookupBounds) →
+                          Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts tables.memory)
+                            { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.opLayout_lookupUsage
+∀ (op : Aiur.Bytecode.Op) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.functionLayout.lookups =
+    initial.functionLayout.lookups + op.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.opsLayout_lookupUsage
+∀ (ops : Array Aiur.Bytecode.Op) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Array.forM Aiur.Concrete.Bytecode.opLayout ops) initial).snd.functionLayout.lookups =
+    initial.functionLayout.lookups + (List.map Aiur.Bytecode.Op.lookupUsage ops.toList).sum
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitOp_lookupUsage
+∀ {row : Nat → Aiur.G} {selector rank : Aiur.G} {op : Aiur.Bytecode.Op} {values : Array Aiur.AIR.RowValue}
+  {emission : Aiur.AIR.OpEmission},
+  Aiur.AIR.emitOp row selector rank op values = some emission → emission.queries.length = op.lookupUsage
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.emitOps_lookupUsage
+∀ {row : Nat → Aiur.G} {selector rank : Aiur.G} {ops : List Aiur.Bytecode.Op} {values : Array Aiur.AIR.RowValue}
+  {column : Nat} {emission : Aiur.AIR.OpsEmission},
+  Aiur.AIR.emitOps row selector rank ops values column = some emission →
+    emission.queries.length = (List.map Aiur.Bytecode.Op.lookupUsage ops).sum
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.branchRows_lookupUsage
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (matched : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  (fallback : Option Aiur.Bytecode.Block) {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.branchRows row selector context matched values column lookup branches fallback = some emission →
+    (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+        pair ∈ branches.toList →
+          ∀ (emission : Aiur.AIR.BlockEmission),
+            Aiur.Bytecode.Block.emitRow row selector context (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry
+                  values column lookup pair.snd =
+                some emission →
+              emission.lookup = lookup + pair.snd.lookupUsage) →
+      (∀ (block : Aiur.Bytecode.Block),
+          fallback = some block →
+            ∀ (emission : Aiur.AIR.BlockEmission),
+              Aiur.Bytecode.Block.emitRow row selector context (Aiur.Bytecode.Block.selectorFlow selector block).entry
+                    values (column + branches.size) lookup block =
+                  some emission →
+                emission.lookup = lookup + block.lookupUsage) →
+        emission.lookup = lookup + Aiur.Bytecode.branchLookupUsage branches fallback
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Ctrl.emitRow_lookupUsage
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (ctrl : Aiur.Bytecode.Ctrl)
+  {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Ctrl.emitRow row selector context incoming values column lookup ctrl = some emission →
+    emission.lookup = lookup + ctrl.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_lookupUsage
+∀ (row : Nat → Aiur.G) (selector : Aiur.Bytecode.SelIdx → Aiur.G) (context : Aiur.AIR.RowContext) (incoming : Aiur.G)
+  (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (block : Aiur.Bytecode.Block)
+  {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Block.emitRow row selector context incoming values column lookup block = some emission →
+    emission.lookup = lookup + block.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.ctrlLayout_lookupUsage
+∀ (ctrl : Aiur.Bytecode.Ctrl) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout ctrl) initial).snd.functionLayout.lookups =
+    initial.functionLayout.lookups + ctrl.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.blockLayout_lookupUsage
+∀ (block : Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) initial).snd.functionLayout.lookups =
+    initial.functionLayout.lookups + block.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Function.compile_lookupLayout
+∀ {layoutMap : Aiur.LayoutMap} {function : Aiur.Concrete.Function} {body : Aiur.Bytecode.Block}
+  {state : Aiur.Concrete.Bytecode.LayoutMState},
+  Aiur.Concrete.Function.compile layoutMap function = Except.ok (body, state) →
+    state.functionLayout.lookups = 4 + body.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Decls.toBytecode_lookupLayout
+∀ {decls : Aiur.Concrete.Decls} {program : Aiur.Bytecode.Toplevel}
+  {names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx},
+  decls.toBytecode = Except.ok (program, names) → Aiur.Bytecode.FunctionsLookupLayout program.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.rewriteCtrl_lookupUsage
+∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) (ctrl : Aiur.Bytecode.Ctrl),
+  (Aiur.Bytecode.rewriteCtrl rename ctrl).lookupUsage = ctrl.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.rewriteBlock_lookupUsage
+∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) (block : Aiur.Bytecode.Block),
+  (Aiur.Bytecode.rewriteBlock rename block).lookupUsage = block.lookupUsage
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.deduplicate_lookupLayout
+∀ (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.FunctionsLookupLayout program.functions →
+    Aiur.Bytecode.FunctionsLookupLayout program.deduplicate.fst.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_lookupLayout
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsLookupLayout raw.functions →
+    Aiur.Bytecode.FunctionsLookupLayout (Aiur.finishCompilation source raw names).bytecode.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_lookupLayout
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled → Aiur.Bytecode.FunctionsLookupLayout compiled.bytecode.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.functions_lookupLayout
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.Bytecode.FunctionsLookupLayout backend.compiled.bytecode.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.singletonCircuits_lookupBound
+∀ (program : Aiur.Bytecode.Toplevel) (nameOf : Aiur.Bytecode.FunIdx → String),
+  Aiur.Bytecode.FunctionsLookupLayout program.functions →
+    Aiur.Bytecode.CircuitsLookupBound program.functions (program.singletonCircuits nameOf)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.merged_lookupBound
+∀ (functions : Array Aiur.Bytecode.Function) (members : Array Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsLookupLayout functions →
+    0 < functions.size →
+      Aiur.Bytecode.MembersConstrained functions members →
+        Aiur.Bytecode.MembersLookupBound functions members
+          (Array.foldl
+              (fun acc index => if (index == members[0]!) = true then acc else acc.merge functions[index]!.layout)
+              functions[members[0]!]!.layout members).lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.CompiledToplevel.groupFunctions_lookupBound
+∀ {before after : Aiur.CompiledToplevel} {groups : Array (String × Array String)},
+  Aiur.Bytecode.FunctionsLookupLayout before.bytecode.functions →
+    0 < before.bytecode.functions.size →
+      Aiur.Bytecode.CircuitsLookupBound before.bytecode.functions before.bytecode.circuits →
+        before.groupFunctions groups = Except.ok after →
+          Aiur.Bytecode.CircuitsLookupBound after.bytecode.functions after.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_lookupBound
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsLookupLayout raw.functions →
+    Aiur.Bytecode.CircuitsLookupBound (Aiur.finishCompilation source raw names).bytecode.functions
+      (Aiur.finishCompilation source raw names).bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_lookupBound
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled →
+    Aiur.Bytecode.CircuitsLookupBound compiled.bytecode.functions compiled.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuits_lookupBound
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.Bytecode.CircuitsLookupBound backend.compiled.bytecode.functions backend.compiled.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.CircuitWitness.lookupBounds_of_compiled
+∀ {program : Aiur.Bytecode.Toplevel},
+  Aiur.Bytecode.FunctionsLookupLayout program.functions →
+    Aiur.Bytecode.CircuitsLookupBound program.functions program.circuits →
+      ∀ (witness : Aiur.AIR.CircuitWitness),
+        witness.circuit ∈ program.circuits → Aiur.AIR.CircuitWitness.Emitted program witness → witness.LookupBounds
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.witness_lookupBounds
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (witness : Aiur.AIR.CircuitWitness),
+  witness.circuit ∈ backend.compiled.bytecode.circuits →
+    Aiur.AIR.CircuitWitness.Emitted backend.compiled.bytecode witness → witness.LookupBounds
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.bounded_trace_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (tables : Aiur.AIR.AuxiliaryTables) (traces : Aiur.AIR.CircuitTraces backend.compiled.bytecode.circuits.toList)
+  {witnesses : List Aiur.AIR.CircuitWitness},
+  Aiur.AIR.CircuitTraces.emitWitnesses backend.compiled.bytecode traces = some witnesses →
+    ∀ {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat},
+      Aiur.lookupQueryBound
+            (List.map (fun x => x.layout.lookups) backend.compiled.bytecode.circuits.toList ++ otherSlots)
+            (traces.bitmap ++ otherActive) (traces.degrees ++ otherDegrees) =
+          some result →
+        ∀ (width : Nat) (input : Array Aiur.G),
+          input.size = selection.inputSize →
+            Aiur.AIR.PaddedLookupBalance width
+                ((Aiur.buildClaim selection.function input selection.success).toList ::
+                  Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses))
+                (tables.circuitProviders (List.map (fun x => x.emission) witnesses)) →
+              (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+                (∀ (query : List Aiur.G),
+                    query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                      query.length ≤ width) →
+                  (∀ (size : Nat), Aiur.AIR.MemoryRowsValid size (tables.memory size)) →
+                    (∀ (size : Nat), size ∈ tables.memoryWidths → size < Aiur.gSize.toNat) →
+                      (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                        Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts tables.memory)
+                          { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.decodeMemoryRow_width
+∀ (width : Nat) (columns : Aiur.AIR.MemoryColumns width), (Aiur.AIR.decodeMemoryRow width columns).contents.size = width
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.decodeMemoryRows_size
+∀ (width height : Nat) (matrix : Fin height → Aiur.AIR.MemoryColumns width),
+  (Aiur.AIR.decodeMemoryRows width height matrix).size = height
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.memoryColumnProvider_reflect
+∀ (width : Nat) (current next : Aiur.AIR.MemoryColumns width) (transition : Aiur.G),
+  (∀ (equation : Aiur.G), equation ∈ Aiur.AIR.memoryColumnEquations width current next transition → equation = 0) →
+    ∀ (messageWidth : Nat),
+      Aiur.AIR.Provider.PaddedEq messageWidth (Aiur.AIR.memoryColumnProvider width current)
+        (Aiur.AIR.memoryMessage width (Aiur.AIR.decodeMemoryRow width current).pointer
+            (Aiur.AIR.decodeMemoryRow width current).contents,
+          (Aiur.AIR.decodeMemoryRow width current).multiplicity)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.decodeMemoryRows_polynomials
+∀ (width height : Nat) (matrix : Fin height → Aiur.AIR.MemoryColumns width),
+  Aiur.AIR.MemoryMatrixSatisfied width height matrix →
+    Aiur.AIR.MemoryRowsPolynomials width (Aiur.AIR.decodeMemoryRows width height matrix)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.decodeMemoryRows_valid
+∀ (width height : Nat) (matrix : Fin height → Aiur.AIR.MemoryColumns width),
+  Aiur.AIR.MemoryMatrixSatisfied width height matrix →
+    Aiur.AIR.MemoryRowsValid width (Aiur.AIR.decodeMemoryRows width height matrix)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.decodeMemoryRows_providers
+∀ (width height : Nat) (matrix : Fin height → Aiur.AIR.MemoryColumns width),
+  Aiur.AIR.mapProviders (fun request => Aiur.AIR.memoryMessage width request.fst request.snd)
+      (Aiur.AIR.memoryProviders (Aiur.AIR.decodeMemoryRows width height matrix)) =
+    List.ofFn fun index =>
+      (Aiur.AIR.memoryMessage width (Aiur.AIR.decodeMemoryRow width (matrix index)).pointer
+          (Aiur.AIR.decodeMemoryRow width (matrix index)).contents,
+        (Aiur.AIR.decodeMemoryRow width (matrix index)).multiplicity)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.memoryMatrixProviders_reflect
+∀ (width height : Nat) (matrix : Fin height → Aiur.AIR.MemoryColumns width),
+  Aiur.AIR.MemoryMatrixSatisfied width height matrix →
+    ∀ (messageWidth : Nat),
+      List.Forall₂ (Aiur.AIR.Provider.PaddedEq messageWidth) (Aiur.AIR.memoryMatrixProviders width height matrix)
+        (Aiur.AIR.mapProviders (fun request => Aiur.AIR.memoryMessage width request.fst request.snd)
+          (Aiur.AIR.memoryProviders (Aiur.AIR.decodeMemoryRows width height matrix)))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Decls.toBytecode_memorySizes_distinct
+∀ {decls : Aiur.Concrete.Decls} {program : Aiur.Bytecode.Toplevel}
+  {names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx},
+  decls.toBytecode = Except.ok (program, names) → program.memorySizes.toList.Nodup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.deduplicate_memorySizes
+∀ (program : Aiur.Bytecode.Toplevel), program.deduplicate.fst.memorySizes = program.memorySizes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_memorySizes
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  (Aiur.finishCompilation source raw names).bytecode.memorySizes = raw.memorySizes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_memorySizes_distinct
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled → compiled.bytecode.memorySizes.toList.Nodup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.memorySizes_distinct
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  backend.compiled.bytecode.memorySizes.toList.Nodup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.memorySizes_canonical
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection) (width : Nat),
+  width ∈ backend.compiled.bytecode.memorySizes.toList → width < Aiur.gSize.toNat
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.slot_sum_append
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths) (otherSlots : List Nat) (otherActive : List Bool)
+  (otherDegrees : List Nat),
+  Aiur.lookupSlotSum (List.replicate widths.length 1 ++ otherSlots) (traces.bitmap ++ otherActive)
+      (traces.degrees ++ otherDegrees) =
+    Option.map (fun x => traces.capacity + x) (Aiur.lookupSlotSum otherSlots otherActive otherDegrees)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.rows_valid
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths),
+  traces.Satisfied → ∀ (width : Nat), Aiur.AIR.MemoryRowsValid width (traces.rows width)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.rows_size_le
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths) (width : Nat), (traces.rows width).size ≤ traces.capacity
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.providers_reflect
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths),
+  widths.Nodup →
+    traces.Satisfied →
+      ∀ (messageWidth : Nat),
+        List.Forall₂ (Aiur.AIR.Provider.PaddedEq messageWidth) traces.providers
+          (Aiur.AIR.memoryTableProviders widths traces.rows)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.capacity_bounded
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths) {circuits : List Aiur.Bytecode.Circuit}
+  (functions : Aiur.AIR.CircuitTraces circuits) {otherSlots : List Nat} {otherActive : List Bool}
+  {otherDegrees : List Nat} {result : Nat},
+  Aiur.lookupQueryBound
+        (List.map (fun x => x.layout.lookups) circuits ++ (List.replicate widths.length 1 ++ otherSlots))
+        (functions.bitmap ++ (traces.bitmap ++ otherActive)) (functions.degrees ++ (traces.degrees ++ otherDegrees)) =
+      some result →
+    traces.capacity + 1 < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.functional
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths),
+  traces.Satisfied →
+    traces.capacity < Aiur.gSize.toNat →
+      ∀ {width : Nat} {pointer : Aiur.G} {left right : Array Aiur.G},
+        Aiur.AIR.memoryFacts traces.rows width pointer left →
+          Aiur.AIR.memoryFacts traces.rows width pointer right → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.functional_of_budget
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths) {circuits : List Aiur.Bytecode.Circuit}
+  (functions : Aiur.AIR.CircuitTraces circuits) {otherSlots : List Nat} {otherActive : List Bool}
+  {otherDegrees : List Nat} {result : Nat},
+  Aiur.lookupQueryBound
+        (List.map (fun x => x.layout.lookups) circuits ++ (List.replicate widths.length 1 ++ otherSlots))
+        (functions.bitmap ++ (traces.bitmap ++ otherActive)) (functions.degrees ++ (traces.degrees ++ otherDegrees)) =
+      some result →
+    traces.Satisfied →
+      ∀ {width : Nat} {pointer : Aiur.G} {left right : Array Aiur.G},
+        Aiur.AIR.memoryFacts traces.rows width pointer left →
+          Aiur.AIR.memoryFacts traces.rows width pointer right → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.circuitProviders_reflect
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths),
+  widths.Nodup →
+    traces.Satisfied →
+      ∀ (messageWidth : Nat) (byte1 : Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G)
+        (byte2 : Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G) (circuits : List Aiur.AIR.CircuitEmission),
+        List.Forall₂ (Aiur.AIR.Provider.PaddedEq messageWidth)
+          (Aiur.AIR.circuitProviders circuits ++
+            (traces.providers ++ Aiur.AIR.byte1Providers byte1 ++ Aiur.AIR.byte2Providers byte2))
+          ((traces.auxiliary byte1 byte2).circuitProviders circuits)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.memory_trace_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (functions : Aiur.AIR.CircuitTraces backend.compiled.bytecode.circuits.toList)
+  (memories : Aiur.AIR.MemoryTraces backend.compiled.bytecode.memorySizes.toList)
+  (byte1 : Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G) (byte2 : Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G)
+  {witnesses : List Aiur.AIR.CircuitWitness},
+  Aiur.AIR.CircuitTraces.emitWitnesses backend.compiled.bytecode functions = some witnesses →
+    ∀ {otherSlots : List Nat} {otherActive : List Bool} {otherDegrees : List Nat} {result : Nat},
+      Aiur.lookupQueryBound
+            (List.map (fun x => x.layout.lookups) backend.compiled.bytecode.circuits.toList ++
+              (List.replicate backend.compiled.bytecode.memorySizes.size 1 ++ otherSlots))
+            (functions.bitmap ++ (memories.bitmap ++ otherActive))
+            (functions.degrees ++ (memories.degrees ++ otherDegrees)) =
+          some result →
+        ∀ (width : Nat) (input : Array Aiur.G),
+          input.size = selection.inputSize →
+            Aiur.AIR.PaddedLookupBalance width
+                ((Aiur.buildClaim selection.function input selection.success).toList ::
+                  Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses))
+                (Aiur.AIR.circuitProviders (List.map (fun x => x.emission) witnesses) ++
+                  (memories.providers ++ Aiur.AIR.byte1Providers byte1 ++ Aiur.AIR.byte2Providers byte2)) →
+              (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+                (∀ (query : List Aiur.G),
+                    query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                      query.length ≤ width) →
+                  (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                    memories.Satisfied →
+                      Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts memories.rows)
+                        { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.fixedTraceHeights_sound
+∀ {heights : List Nat} {active : List Bool} {degrees : List Nat},
+  Aiur.fixedTraceHeights heights active degrees = true → Aiur.FixedTraceHeights heights active degrees
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.fixedTraceHeights_complete
+∀ {heights : List Nat} {active : List Bool} {degrees : List Nat},
+  Aiur.FixedTraceHeights heights active degrees → Aiur.fixedTraceHeights heights active degrees = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.FixedTraceHeights.alignment
+∀ {heights : List Nat} {active : List Bool} {degrees : List Nat},
+  Aiur.FixedTraceHeights heights active degrees →
+    heights.length = active.length ∧ degrees.length = (List.filter id active).length
+AXIOMS [propext]
+ROOT Aiur.fixedTraceHeights_bytes
+∀ {active : List Bool} {degrees : List Nat},
+  Aiur.fixedTraceHeights [256, 65536] active degrees = true → active = [true, true] ∧ degrees = [8, 16]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.byte1ColumnProvider_reflect
+∀ (kind : Aiur.AIR.Byte1Kind) (row : Fin 256) (columns : Aiur.AIR.Byte1Columns),
+  Aiur.AIR.byte1ColumnProvider kind row columns =
+    (Aiur.AIR.byte1Request kind (Aiur.G.ofNat ↑row) (Aiur.AIR.byte1Outputs kind row), columns kind.column)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.byte2ColumnProvider_reflect
+∀ (kind : Aiur.AIR.Byte2Kind) (row : Fin 65536) (columns : Aiur.AIR.Byte2Columns),
+  Aiur.AIR.byte2ColumnProvider kind row columns =
+    (Aiur.AIR.byte2Request kind (Aiur.AIR.byteRangeMessage row).fst (Aiur.AIR.byteRangeMessage row).snd
+        (Aiur.AIR.byte2Outputs kind row),
+      columns kind.column)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.CircuitTraces.fixed_heights_append
+∀ {circuits : List Aiur.Bytecode.Circuit} (traces : Aiur.AIR.CircuitTraces circuits) (heights : List Nat)
+  (active : List Bool) (degrees : List Nat),
+  Aiur.fixedTraceHeights (List.replicate circuits.length 0 ++ heights) (traces.bitmap ++ active)
+      (traces.degrees ++ degrees) =
+    Aiur.fixedTraceHeights heights active degrees
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemoryTraces.fixed_heights_append
+∀ {widths : List Nat} (traces : Aiur.AIR.MemoryTraces widths) (heights : List Nat) (active : List Bool)
+  (degrees : List Nat),
+  Aiur.fixedTraceHeights (List.replicate widths.length 0 ++ heights) (traces.bitmap ++ active)
+      (traces.degrees ++ degrees) =
+    Aiur.fixedTraceHeights heights active degrees
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.canonical_byte_metadata
+∀ {circuits : List Aiur.Bytecode.Circuit} (functions : Aiur.AIR.CircuitTraces circuits) {widths : List Nat}
+  (memories : Aiur.AIR.MemoryTraces widths) {active : List Bool} {degrees : List Nat},
+  Aiur.fixedTraceHeights (List.replicate circuits.length 0 ++ (List.replicate widths.length 0 ++ [256, 65536]))
+        (functions.bitmap ++ (memories.bitmap ++ active)) (functions.degrees ++ (memories.degrees ++ degrees)) =
+      true →
+    active = [true, true] ∧ degrees = [8, 16]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.suppliedWeight_perm
+∀ {α : Type} [inst : DecidableEq α] {left right : List (Aiur.AIR.Provider α)},
+  left.Perm right → ∀ (message : α), Aiur.AIR.suppliedWeight message left = Aiur.AIR.suppliedWeight message right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.PaddedLookupBalance.perm_providers
+∀ {width : Nat} {queries : List (List Aiur.G)} {left right : List (Aiur.AIR.Provider (List Aiur.G))},
+  Aiur.AIR.PaddedLookupBalance width queries left → left.Perm right → Aiur.AIR.PaddedLookupBalance width queries right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.flatMap_map_swap
+∀ {α β γ : Type} (left : List α) (right : List β) (value : α → β → γ),
+  (List.flatMap (fun a => List.map (value a) right) left).Perm
+    (List.flatMap (fun b => List.map (fun a => value a b) left) right)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.byte1MatrixProviders_reflect
+∀ (matrix : Fin 256 → Aiur.AIR.Byte1Columns),
+  (Aiur.AIR.byte1MatrixProviders matrix).Perm (Aiur.AIR.byte1Providers fun kind row => matrix row kind.column)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.byte2MatrixProviders_reflect
+∀ (matrix : Fin 65536 → Aiur.AIR.Byte2Columns),
+  (Aiur.AIR.byte2MatrixProviders matrix).Perm (Aiur.AIR.byte2Providers fun kind row => matrix row kind.column)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.ByteTraces.providers_reflect
+∀ (traces : Aiur.AIR.ByteTraces),
+  traces.providers.Perm (Aiur.AIR.byte1Providers traces.byte1Weights ++ Aiur.AIR.byte2Providers traces.byte2Weights)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.SystemTraces.fixed_heights
+∀ {program : Aiur.Bytecode.Toplevel} (traces : Aiur.AIR.SystemTraces program),
+  Aiur.fixedTraceHeights (Aiur.AIR.systemFixedHeights program) traces.bitmap traces.degrees = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.SystemTraces.memory_functional
+∀ {program : Aiur.Bytecode.Toplevel} (traces : Aiur.AIR.SystemTraces program) {result : Nat},
+  traces.queryBound = some result →
+    traces.memories.Satisfied →
+      ∀ {width : Nat} {pointer : Aiur.G} {left right : Array Aiur.G},
+        Aiur.AIR.memoryFacts traces.memories.rows width pointer left →
+          Aiur.AIR.memoryFacts traces.memories.rows width pointer right → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.column_trace_execution
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  (traces : Aiur.AIR.SystemTraces backend.compiled.bytecode) {witnesses : List Aiur.AIR.CircuitWitness},
+  Aiur.AIR.CircuitTraces.emitWitnesses backend.compiled.bytecode traces.functions = some witnesses →
+    ∀ {result : Nat},
+      traces.queryBound = some result →
+        ∀ (width : Nat) (input : Array Aiur.G),
+          input.size = selection.inputSize →
+            Aiur.AIR.PaddedLookupBalance width
+                ((Aiur.buildClaim selection.function input selection.success).toList ::
+                  Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses))
+                (traces.providers (List.map (fun x => x.emission) witnesses)) →
+              (Aiur.buildClaim selection.function input selection.success).size + 1 ≤ width →
+                (∀ (query : List Aiur.G),
+                    query ∈ Aiur.AIR.encodedCircuitQueryPool (List.map (fun x => x.emission) witnesses) →
+                      query.length ≤ width) →
+                  (∀ (witness : Aiur.AIR.CircuitWitness), witness ∈ witnesses → witness.Satisfied) →
+                    traces.memories.Satisfied →
+                      Aiur.Bytecode.AIR.Execution backend.compiled.bytecode (Aiur.AIR.memoryFacts traces.memories.rows)
+                        { function := selection.function, inputs := input, outputs := selection.success, rank := 0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Node.check_iff
+∀ (widths : Aiur.NativeAIR.GraphWidths) (lookupEnd index : Nat) (node : Aiur.NativeAIR.Node),
+  Aiur.NativeAIR.Node.check widths lookupEnd index node = true ↔ Aiur.NativeAIR.Node.Valid widths lookupEnd index node
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.checkNodes_iff
+∀ (widths : Aiur.NativeAIR.GraphWidths) (lookupEnd index : Nat) (nodes : List Aiur.NativeAIR.Node),
+  Aiur.NativeAIR.checkNodes widths lookupEnd index nodes = true ↔ Aiur.NativeAIR.ValidNodes widths lookupEnd index nodes
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.checkedGraphPrefix_iff
+∀ (widths : Aiur.NativeAIR.GraphWidths) (graph : Aiur.NativeAIR.Graph) (lookupEnd : Nat),
+  Aiur.NativeAIR.checkedGraphPrefix widths graph = some lookupEnd ↔
+    Aiur.NativeAIR.Graph.Valid widths graph ∧ lookupEnd = graph.lookupPrefix
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.roots_below_prefix
+∀ (roots : List Nat) (index : Nat), index ∈ roots → index < List.foldr (fun root rest => max (root + 1) rest) 0 roots
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.prefix_bounded
+∀ (roots : List Nat) (bound : Nat),
+  (∀ (index : Nat), index ∈ roots → index < bound) → List.foldr (fun root rest => max (root + 1) rest) 0 roots ≤ bound
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Graph.Valid.prefix_bounded
+∀ {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph → graph.lookupPrefix ≤ graph.nodes.length
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Node.eval_defined
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (buffer : Array W)
+  {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd : Nat} {node : Aiur.NativeAIR.Node},
+  values.Fits widths →
+    Aiur.NativeAIR.Node.Valid widths lookupEnd buffer.size node →
+      ∃ value, Aiur.NativeAIR.Node.eval ops values buffer node = some value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.sweepFrom_defined
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (nodes : List Aiur.NativeAIR.Node)
+  (buffer : Array W) {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd : Nat},
+  values.Fits widths →
+    Aiur.NativeAIR.ValidNodes widths lookupEnd buffer.size nodes →
+      ∃ result,
+        Aiur.NativeAIR.sweepFrom ops values nodes buffer = some result ∧ result.size = buffer.size + nodes.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.Valid.sweep_defined
+∀ {W : Type u_1} {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph →
+    ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W),
+      values.Fits widths → ∃ result, graph.sweep ops values = some result ∧ result.size = graph.nodes.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ValidNodes.take
+∀ {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd index : Nat} {nodes : List Aiur.NativeAIR.Node},
+  Aiur.NativeAIR.ValidNodes widths lookupEnd index nodes →
+    ∀ (count : Nat), Aiur.NativeAIR.ValidNodes widths lookupEnd index (List.take count nodes)
+AXIOMS []
+ROOT Aiur.NativeAIR.Node.eval_withoutStage2
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (buffer : Array W)
+  {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd : Nat} {node : Aiur.NativeAIR.Node},
+  Aiur.NativeAIR.Node.Valid widths lookupEnd buffer.size node →
+    buffer.size < lookupEnd →
+      Aiur.NativeAIR.Node.eval ops values.withoutStage2 buffer node = Aiur.NativeAIR.Node.eval ops values buffer node
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.sweepFrom_withoutStage2
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (nodes : List Aiur.NativeAIR.Node)
+  (buffer : Array W) {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd : Nat},
+  Aiur.NativeAIR.ValidNodes widths lookupEnd buffer.size nodes →
+    buffer.size + nodes.length ≤ lookupEnd →
+      Aiur.NativeAIR.sweepFrom ops values.withoutStage2 nodes buffer = Aiur.NativeAIR.sweepFrom ops values nodes buffer
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.sweepFrom_append
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W)
+  (left right : List Aiur.NativeAIR.Node) (buffer : Array W),
+  Aiur.NativeAIR.sweepFrom ops values (left ++ right) buffer =
+    (Aiur.NativeAIR.sweepFrom ops values left buffer).bind (Aiur.NativeAIR.sweepFrom ops values right)
+AXIOMS []
+ROOT Aiur.NativeAIR.sweepFrom_preserves
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (nodes : List Aiur.NativeAIR.Node)
+  {buffer result : Array W},
+  Aiur.NativeAIR.sweepFrom ops values nodes buffer = some result →
+    ∀ (index : Nat), index < buffer.size → result[index]? = buffer[index]?
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.Valid.lookup_sweep_defined
+∀ {W : Type u_1} {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph →
+    ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W),
+      values.Fits widths → ∃ result, graph.sweepLookupPrefix ops values = some result ∧ result.size = graph.lookupPrefix
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.Valid.lookup_sweep_agrees
+∀ {W : Type u_1} {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph →
+    ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) {full prefixValues : Array W},
+      graph.sweep ops values = some full →
+        graph.sweepLookupPrefix ops values = some prefixValues →
+          ∀ (index : Nat), index < prefixValues.size → full[index]? = prefixValues[index]?
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Node.unfold_eval
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) {trees : Array Aiur.NativeAIR.Expr}
+  {buffer : Array W},
+  Aiur.NativeAIR.Reflects ops values trees buffer →
+    ∀ (node : Aiur.NativeAIR.Node) {expr : Aiur.NativeAIR.Expr},
+      Aiur.NativeAIR.Node.unfold trees node = some expr →
+        Aiur.NativeAIR.Node.eval ops values buffer node = Aiur.NativeAIR.Expr.eval ops values expr
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Reflects.push
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {trees : Array Aiur.NativeAIR.Expr}
+  {buffer : Array W},
+  Aiur.NativeAIR.Reflects ops values trees buffer →
+    ∀ (expr : Aiur.NativeAIR.Expr) (value : W),
+      Aiur.NativeAIR.Expr.eval ops values expr = some value →
+        Aiur.NativeAIR.Reflects ops values (trees.push expr) (buffer.push value)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Node.unfold_defined
+∀ {trees : Array Aiur.NativeAIR.Expr} {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd : Nat}
+  {node : Aiur.NativeAIR.Node},
+  Aiur.NativeAIR.Node.Valid widths lookupEnd trees.size node → ∃ expr, Aiur.NativeAIR.Node.unfold trees node = some expr
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.unfoldFrom_defined
+∀ {nodes : List Aiur.NativeAIR.Node} {trees : Array Aiur.NativeAIR.Expr} {widths : Aiur.NativeAIR.GraphWidths}
+  {lookupEnd : Nat},
+  Aiur.NativeAIR.ValidNodes widths lookupEnd trees.size nodes →
+    ∃ result, Aiur.NativeAIR.unfoldFrom nodes trees = some result ∧ result.size = trees.size + nodes.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.unfoldFrom_reflects
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (nodes : List Aiur.NativeAIR.Node)
+  {trees resultTrees : Array Aiur.NativeAIR.Expr} {buffer resultBuffer : Array W},
+  Aiur.NativeAIR.Reflects ops values trees buffer →
+    Aiur.NativeAIR.unfoldFrom nodes trees = some resultTrees →
+      Aiur.NativeAIR.sweepFrom ops values nodes buffer = some resultBuffer →
+        Aiur.NativeAIR.Reflects ops values resultTrees resultBuffer
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.Valid.unfold_defined
+∀ {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph → ∃ trees, graph.unfold = some trees ∧ trees.size = graph.nodes.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.sweep_reflects
+∀ {W : Type u_1} (graph : Aiur.NativeAIR.Graph) (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W)
+  {trees : Array Aiur.NativeAIR.Expr} {buffer : Array W},
+  graph.unfold = some trees → graph.sweep ops values = some buffer → Aiur.NativeAIR.Reflects ops values trees buffer
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Reflects.readNodes
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {trees : Array Aiur.NativeAIR.Expr}
+  {buffer : Array W},
+  Aiur.NativeAIR.Reflects ops values trees buffer →
+    ∀ (roots : List Nat), Aiur.NativeAIR.readNodes buffer roots = Aiur.NativeAIR.evalRoots ops values trees roots
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Reflects.readLookup
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {trees : Array Aiur.NativeAIR.Expr}
+  {buffer : Array W},
+  Aiur.NativeAIR.Reflects ops values trees buffer →
+    ∀ (lookup : Aiur.NativeAIR.Lookup),
+      Aiur.NativeAIR.readLookup buffer lookup = Aiur.NativeAIR.evalLookup ops values trees lookup
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.readNodes_congr
+∀ {W : Type u_1} (left right : Array W) (roots : List Nat),
+  (∀ (index : Nat), index ∈ roots → left[index]? = right[index]?) →
+    Aiur.NativeAIR.readNodes left roots = Aiur.NativeAIR.readNodes right roots
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.readNodes_defined
+∀ {W : Type u_1} (buffer : Array W) (roots : List Nat),
+  (∀ (index : Nat), index ∈ roots → index < buffer.size) →
+    ∃ values, Aiur.NativeAIR.readNodes buffer roots = some values ∧ values.length = roots.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.readLookup_defined
+∀ {W : Type u_1} (buffer : Array W) (lookup : Aiur.NativeAIR.Lookup),
+  (∀ (index : Nat), index ∈ lookup.roots → index < buffer.size) →
+    ∃ value, Aiur.NativeAIR.readLookup buffer lookup = some value ∧ value.snd.length = lookup.args.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.Valid.lookup_values_agree
+∀ {W : Type u_1} {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph →
+    ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) {full prefixValues : Array W},
+      graph.sweep ops values = some full →
+        graph.sweepLookupPrefix ops values = some prefixValues →
+          prefixValues.size = graph.lookupPrefix →
+            ∀ (lookup : Aiur.NativeAIR.Lookup),
+              lookup ∈ graph.lookups →
+                Aiur.NativeAIR.readLookup full lookup = Aiur.NativeAIR.readLookup prefixValues lookup
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Graph.Valid.lookup_values_reflect
+∀ {W : Type u_1} {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.Graph.Valid widths graph →
+    ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) {trees : Array Aiur.NativeAIR.Expr}
+      {full prefixValues : Array W},
+      graph.unfold = some trees →
+        graph.sweep ops values = some full →
+          graph.sweepLookupPrefix ops values = some prefixValues →
+            prefixValues.size = graph.lookupPrefix →
+              ∀ (lookup : Aiur.NativeAIR.Lookup),
+                lookup ∈ graph.lookups →
+                  Aiur.NativeAIR.readLookup prefixValues lookup = Aiur.NativeAIR.evalLookup ops values trees lookup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.sub_zero
+∀ (value : Aiur.G), value - 0 = value
+AXIOMS [propext]
+ROOT Aiur.G.neg_neg
+∀ (value : Aiur.G), 0 - (0 - value) = value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Expr.isConstant_eq
+∀ (expr : Aiur.NativeAIR.Expr), expr.isConstant = expr.constantValue.isSome
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontNeg_noConstantNegs
+∀ {expr : Aiur.NativeAIR.Expr}, expr.noConstantNegs = true → expr.frontNeg.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontNeg_isConstant
+∀ {expr : Aiur.NativeAIR.Expr}, expr.noConstantNegs = true → expr.frontNeg.isConstant = expr.isConstant
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontAdd_isConstant
+∀ (left right : Aiur.NativeAIR.Expr), (left.frontAdd right).isConstant = (left.isConstant && right.isConstant)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontSub_isConstant
+∀ (left right : Aiur.NativeAIR.Expr),
+  right.noConstantNegs = true → (left.frontSub right).isConstant = (left.isConstant && right.isConstant)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontAdd_noConstantNegs
+∀ {left right : Aiur.NativeAIR.Expr},
+  left.noConstantNegs = true → right.noConstantNegs = true → (left.frontAdd right).noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontSub_noConstantNegs
+∀ {left right : Aiur.NativeAIR.Expr},
+  left.noConstantNegs = true → right.noConstantNegs = true → (left.frontSub right).noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontMul_noConstantNegs
+∀ {left right : Aiur.NativeAIR.Expr},
+  left.noConstantNegs = true → right.noConstantNegs = true → (left.frontMul right).noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontNeg_eval
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.EvalLaws ops →
+    ∀ (values : Aiur.NativeAIR.Values W) {expr : Aiur.NativeAIR.Expr} {value : W},
+      Aiur.NativeAIR.Expr.eval ops values expr = some value →
+        Aiur.NativeAIR.Expr.eval ops values expr.frontNeg = some (ops.neg value)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.eval_constantValue
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) {expr : Aiur.NativeAIR.Expr}
+  {value : W} {constant : Aiur.G},
+  Aiur.NativeAIR.Expr.eval ops values expr = some value →
+    expr.constantValue = some constant → ops.konst constant = value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontAdd_eval
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.EvalLaws ops →
+    ∀ (values : Aiur.NativeAIR.Values W) {left right : Aiur.NativeAIR.Expr} {a b : W},
+      Aiur.NativeAIR.Expr.eval ops values left = some a →
+        Aiur.NativeAIR.Expr.eval ops values right = some b →
+          Aiur.NativeAIR.Expr.eval ops values (left.frontAdd right) = some (ops.add a b)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontSub_eval
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.EvalLaws ops →
+    ∀ (values : Aiur.NativeAIR.Values W) {left right : Aiur.NativeAIR.Expr} {a b : W},
+      Aiur.NativeAIR.Expr.eval ops values left = some a →
+        Aiur.NativeAIR.Expr.eval ops values right = some b →
+          Aiur.NativeAIR.Expr.eval ops values (left.frontSub right) = some (ops.sub a b)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontMul_eval
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.EvalLaws ops →
+    ∀ (values : Aiur.NativeAIR.Values W) {left right : Aiur.NativeAIR.Expr} {a b : W},
+      Aiur.NativeAIR.Expr.eval ops values left = some a →
+        Aiur.NativeAIR.Expr.eval ops values right = some b →
+          Aiur.NativeAIR.Expr.eval ops values (left.frontMul right) = some (ops.mul a b)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_add_zero
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.add a (Aiur.NativeAIR.goldilocksOps.konst 0) = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_zero_add
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.add (Aiur.NativeAIR.goldilocksOps.konst 0) a = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_sub_zero
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.sub a (Aiur.NativeAIR.goldilocksOps.konst 0) = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_zero_sub
+∀ (a : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.sub (Aiur.NativeAIR.goldilocksOps.konst 0) a = Aiur.NativeAIR.goldilocksOps.neg a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_mul_zero
+∀ (a : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.mul a (Aiur.NativeAIR.goldilocksOps.konst 0) = Aiur.NativeAIR.goldilocksOps.konst 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_zero_mul
+∀ (a : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.mul (Aiur.NativeAIR.goldilocksOps.konst 0) a = Aiur.NativeAIR.goldilocksOps.konst 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_mul_one
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.mul a (Aiur.NativeAIR.goldilocksOps.konst 1) = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_one_mul
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.mul (Aiur.NativeAIR.goldilocksOps.konst 1) a = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_neg_neg
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.neg (Aiur.NativeAIR.goldilocksOps.neg a) = a
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.goldilocks_konst_add
+∀ (a b : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.konst (a + b) =
+    Aiur.NativeAIR.goldilocksOps.add (Aiur.NativeAIR.goldilocksOps.konst a) (Aiur.NativeAIR.goldilocksOps.konst b)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_konst
+∀ (a : Aiur.G), Aiur.NativeAIR.goldilocksOps.konst a = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_add
+∀ (a b : Aiur.G), Aiur.NativeAIR.goldilocksOps.add a b = a + b
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_sub
+∀ (a b : Aiur.G), Aiur.NativeAIR.goldilocksOps.sub a b = a - b
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_mul
+∀ (a b : Aiur.G), Aiur.NativeAIR.goldilocksOps.mul a b = a * b
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_konst_sub
+∀ (a b : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.konst (a - b) =
+    Aiur.NativeAIR.goldilocksOps.sub (Aiur.NativeAIR.goldilocksOps.konst a) (Aiur.NativeAIR.goldilocksOps.konst b)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_konst_mul
+∀ (a b : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.konst (a * b) =
+    Aiur.NativeAIR.goldilocksOps.mul (Aiur.NativeAIR.goldilocksOps.konst a) (Aiur.NativeAIR.goldilocksOps.konst b)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocks_konst_neg
+∀ (a : Aiur.G),
+  Aiur.NativeAIR.goldilocksOps.konst (0 - a) = Aiur.NativeAIR.goldilocksOps.neg (Aiur.NativeAIR.goldilocksOps.konst a)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.goldilocksLaws
+Aiur.NativeAIR.EvalLaws Aiur.NativeAIR.goldilocksOps
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Expr.constantValue_eq_of_eval
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {expr : Aiur.NativeAIR.Expr} {value constant : Aiur.G},
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values expr = some value →
+    expr.constantValue = some constant → constant = value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Expr.frontMul_isConstant
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {left right : Aiur.NativeAIR.Expr} {a b : Aiur.G},
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values left = some a →
+    Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values right = some b →
+      (left.frontMul right).isConstant =
+        (left.isConstant && right.isConstant || left.isConstant && a == 0 || right.isConstant && b == 0)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.RowExpr.reflects_iff_eval
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (expr : Aiur.NativeAIR.RowExpr) (value : Aiur.AIR.RowValue),
+  Aiur.NativeAIR.RowExpr.Reflects values expr value ↔ Aiur.NativeAIR.RowExpr.eval values expr = some value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.RowExpr.konst_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (value : Aiur.G),
+  Aiur.NativeAIR.RowExpr.Reflects values (Aiur.NativeAIR.RowExpr.konst value) (Aiur.AIR.RowValue.konst value)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.RowExpr.variable_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {column : Aiur.NativeAIR.ColRef} {value : Aiur.G},
+  (values.columns column.source column.offset)[column.index]? = some value →
+    Aiur.NativeAIR.RowExpr.Reflects values (Aiur.NativeAIR.RowExpr.variable column) (Aiur.AIR.RowValue.variable value)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.RowExpr.add_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b → Aiur.NativeAIR.RowExpr.Reflects values (left.add right) (a.add b)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.RowExpr.sub_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b →
+      right.expr.noConstantNegs = true → Aiur.NativeAIR.RowExpr.Reflects values (left.sub right) (a.sub b)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.RowExpr.mul_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b → Aiur.NativeAIR.RowExpr.Reflects values (left.mul right) (a.mul b)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ScalarEmission.eval_of
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {output : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue} {used : Nat}
+  {equations : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  Aiur.NativeAIR.RowExpr.Reflects values output value →
+    List.mapM (Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values) equations = some results →
+      Aiur.NativeAIR.ScalarEmission.eval values { output := output, used := used, equations := equations } =
+        some { outputs := #[value], used := used, equations := results }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.eqZeroRegular_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {first : Nat} {input : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values selector = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values input value →
+      (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first]? = some (row 0) →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + 1]? = some (row 1) →
+          Aiur.NativeAIR.ScalarEmission.eval values (Aiur.NativeAIR.eqZeroRegular selector first input) =
+            some
+              { outputs := #[Aiur.AIR.RowValue.variable (row 1)], used := 2,
+                equations := [s * value.value * row 1, s * (value.value * row 0 + row 1 - 1)] }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.emitEqZero_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {first : Nat} {input : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values selector = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values input value →
+      (∀ (index : Nat),
+          index < (Aiur.NativeAIR.emitEqZero selector first input).used →
+            (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+              some (row index)) →
+        Aiur.NativeAIR.ScalarEmission.eval values (Aiur.NativeAIR.emitEqZero selector first input) =
+          Aiur.AIR.emitOp row s 0 (Aiur.Bytecode.Op.eqZero 0) #[value]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.mulRegular_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {first : Nat} {product : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values selector = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values product value →
+      (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first]? = some (row 0) →
+        Aiur.NativeAIR.ScalarEmission.eval values (Aiur.NativeAIR.mulRegular selector first product) =
+          some { outputs := #[Aiur.AIR.RowValue.variable (row 0)], used := 1, equations := [s * (row 0 - value.value)] }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.emitMul_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {first : Nat} {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values selector = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values left a →
+      Aiur.NativeAIR.RowExpr.Reflects values right b →
+        (∀ (index : Nat),
+            index < (Aiur.NativeAIR.emitMul selector first left right).used →
+              (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+                some (row index)) →
+          Aiur.NativeAIR.ScalarEmission.eval values (Aiur.NativeAIR.emitMul selector first left right) =
+            Aiur.AIR.emitOp row s 0 (Aiur.Bytecode.Op.mul 0 1) #[a, b]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.emitEqZero_noConstantNegs
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) (input : Aiur.NativeAIR.RowExpr),
+  (Aiur.NativeAIR.emitEqZero selector first input).output.expr.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.emitMul_noConstantNegs
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) {left right : Aiur.NativeAIR.RowExpr},
+  left.expr.noConstantNegs = true →
+    right.expr.noConstantNegs = true →
+      (Aiur.NativeAIR.emitMul selector first left right).output.expr.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.emitAdd_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (selector rank : Aiur.G)
+  {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b →
+      Aiur.NativeAIR.ScalarEmission.eval values { output := left.add right } =
+        Aiur.AIR.emitOp row selector rank (Aiur.Bytecode.Op.add 0 1) #[a, b]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.emitSub_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (selector rank : Aiur.G)
+  {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b →
+      right.expr.noConstantNegs = true →
+        Aiur.NativeAIR.ScalarEmission.eval values { output := left.sub right } =
+          Aiur.AIR.emitOp row selector rank (Aiur.Bytecode.Op.sub 0 1) #[a, b]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.G.sub_self
+∀ (value : Aiur.G), value - value = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.goldilocksGraphLaws
+Aiur.NativeAIR.GraphEvalLaws Aiur.NativeAIR.goldilocksOps
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.Extends.refl
+∀ {W : Type u_1} (buffer : Array W), Aiur.NativeAIR.Compiler.Extends buffer buffer
+AXIOMS []
+ROOT Aiur.NativeAIR.Compiler.Extends.trans
+∀ {W : Type u_1} {first second third : Array W},
+  Aiur.NativeAIR.Compiler.Extends first second →
+    Aiur.NativeAIR.Compiler.Extends second third → Aiur.NativeAIR.Compiler.Extends first third
+AXIOMS []
+ROOT Aiur.NativeAIR.Compiler.Extends.push
+∀ {W : Type u_1} (buffer : Array W) (value : W), Aiur.NativeAIR.Compiler.Extends buffer (buffer.push value)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.eval_extends
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) {before after : Array W},
+  Aiur.NativeAIR.Compiler.Extends before after →
+    ∀ (node : Aiur.NativeAIR.Node) {value : W},
+      Aiur.NativeAIR.Node.eval ops values before node = some value →
+        Aiur.NativeAIR.Node.eval ops values after node = some value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.Evaluation.empty
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W),
+  Aiur.NativeAIR.Compiler.Evaluation ops values [] #[]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.Evaluation.push
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    ∀ (node : Aiur.NativeAIR.Node) (value : W),
+      Aiur.NativeAIR.Node.eval ops values buffer node = some value →
+        Aiur.NativeAIR.Compiler.Evaluation ops values (nodes ++ [node]) (buffer.push value)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.result_same
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    ∀ {index : Nat} {value : W},
+      buffer[index]? = some value → Aiur.NativeAIR.Compiler.Result ops values buffer (nodes, index) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.intern_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    ∀ (node : Aiur.NativeAIR.Node) {value : W},
+      Aiur.NativeAIR.Node.eval ops values buffer node = some value →
+        Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.intern nodes node) value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.asConst_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    ∀ {index : Nat} {constant : Aiur.G},
+      Aiur.NativeAIR.Compiler.asConst nodes index = some constant → buffer[index]? = some (ops.konst constant)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.asConst_value
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    ∀ {index : Nat} {constant : Aiur.G} {value : W},
+      Aiur.NativeAIR.Compiler.asConst nodes index = some constant →
+        buffer[index]? = some value → value = ops.konst constant
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.konst_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    ∀ (value : Aiur.G),
+      Aiur.NativeAIR.Compiler.Result ops values buffer
+        (Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst value)) (ops.konst value)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.neg_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.EvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+      Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+        ∀ {a : Nat} {value : W},
+          buffer[a]? = some value →
+            Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.neg nodes a) (ops.neg value)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.sortedAdd_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+      Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+        ∀ {a b : Nat} {left right : W},
+          buffer[a]? = some left →
+            buffer[b]? = some right →
+              Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.sortedAdd nodes a b)
+                (ops.add left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.sortedMul_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+      Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+        ∀ {a b : Nat} {left right : W},
+          buffer[a]? = some left →
+            buffer[b]? = some right →
+              Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.sortedMul nodes a b)
+                (ops.mul left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.add_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+      Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+        ∀ {a b : Nat} {left right : W},
+          buffer[a]? = some left →
+            buffer[b]? = some right →
+              Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.add nodes a b)
+                (ops.add left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.sub_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+      Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+        ∀ {a b : Nat} {left right : W},
+          buffer[a]? = some left →
+            buffer[b]? = some right →
+              Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.sub nodes a b)
+                (ops.sub left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.mul_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+      Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+        ∀ {a b : Nat} {left right : W},
+          buffer[a]? = some left →
+            buffer[b]? = some right →
+              Aiur.NativeAIR.Compiler.Result ops values buffer (Aiur.NativeAIR.Compiler.mul nodes a b)
+                (ops.mul left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.result_prepend
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {before middle : Array W},
+  Aiur.NativeAIR.Compiler.Extends before middle →
+    ∀ {result : List Aiur.NativeAIR.Node × Nat} {value : W},
+      Aiur.NativeAIR.Compiler.Result ops values middle result value →
+        Aiur.NativeAIR.Compiler.Result ops values before result value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.compileExpr_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (allowStage2 : Bool) (expr : Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+          Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+            ∀ {result : List Aiur.NativeAIR.Node × Nat},
+              Aiur.NativeAIR.Compiler.compileExpr widths allowStage2 expr nodes = some result →
+                ∃ value,
+                  Aiur.NativeAIR.Expr.eval ops values expr = some value ∧
+                    Aiur.NativeAIR.Compiler.Result ops values buffer result value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileExpr_sweep
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (allowStage2 : Bool) (expr : Aiur.NativeAIR.Expr) {result : List Aiur.NativeAIR.Node × Nat},
+          Aiur.NativeAIR.Compiler.compileExpr widths allowStage2 expr [] = some result →
+            ∃ buffer,
+              Aiur.NativeAIR.sweepFrom ops values result.fst #[] = some buffer ∧
+                buffer[result.snd]? = Aiur.NativeAIR.Expr.eval ops values expr
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.RootsReflect.grow
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {before after : Array W},
+  Aiur.NativeAIR.Compiler.Extends before after →
+    ∀ {roots : List Nat} {exprs : List Aiur.NativeAIR.Expr},
+      Aiur.NativeAIR.Compiler.RootsReflect ops values before roots exprs →
+        Aiur.NativeAIR.Compiler.RootsReflect ops values after roots exprs
+AXIOMS []
+ROOT Aiur.NativeAIR.Compiler.compileExprs_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (allowStage2 : Bool) (exprs : List Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+          Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+            ∀ {result : List Aiur.NativeAIR.Node × List Nat},
+              Aiur.NativeAIR.Compiler.compileExprs widths allowStage2 exprs nodes = some result →
+                ∃ after,
+                  Aiur.NativeAIR.Compiler.Evaluation ops values result.fst after ∧
+                    Aiur.NativeAIR.Compiler.Extends buffer after ∧
+                      Aiur.NativeAIR.Compiler.RootsReflect ops values after result.snd exprs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.RootsReflect.read
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W}
+  {roots : List Nat} {exprs : List Aiur.NativeAIR.Expr},
+  Aiur.NativeAIR.Compiler.RootsReflect ops values buffer roots exprs →
+    ∃ result,
+      Aiur.NativeAIR.Compiler.evalExprs ops values exprs = some result ∧
+        Aiur.NativeAIR.readNodes buffer roots = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileLookup_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (lookup : Aiur.NativeAIR.Compiler.ExprLookup) {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+          Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+            ∀ {result : List Aiur.NativeAIR.Node × Aiur.NativeAIR.Lookup},
+              Aiur.NativeAIR.Compiler.compileLookup widths lookup nodes = some result →
+                ∃ after,
+                  Aiur.NativeAIR.Compiler.Evaluation ops values result.fst after ∧
+                    Aiur.NativeAIR.Compiler.Extends buffer after ∧
+                      Aiur.NativeAIR.Compiler.RootsReflect ops values after result.snd.roots lookup.exprs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.RootsReflect.readLookup
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W}
+  {lookup : Aiur.NativeAIR.Lookup} {exprs : Aiur.NativeAIR.Compiler.ExprLookup},
+  Aiur.NativeAIR.Compiler.RootsReflect ops values buffer lookup.roots exprs.exprs →
+    ∃ read,
+      Aiur.NativeAIR.Compiler.ExprLookup.eval ops values exprs = some read ∧
+        Aiur.NativeAIR.readLookup buffer lookup = some read
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.LookupsReflect.grow
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {before after : Array W},
+  Aiur.NativeAIR.Compiler.Extends before after →
+    ∀ {lookups : List Aiur.NativeAIR.Lookup} {exprs : List Aiur.NativeAIR.Compiler.ExprLookup},
+      Aiur.NativeAIR.Compiler.LookupsReflect ops values before lookups exprs →
+        Aiur.NativeAIR.Compiler.LookupsReflect ops values after lookups exprs
+AXIOMS []
+ROOT Aiur.NativeAIR.Compiler.compileLookups_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+          Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+            ∀ {result : List Aiur.NativeAIR.Node × List Aiur.NativeAIR.Lookup},
+              Aiur.NativeAIR.Compiler.compileLookups widths lookups nodes = some result →
+                ∃ after,
+                  Aiur.NativeAIR.Compiler.Evaluation ops values result.fst after ∧
+                    Aiur.NativeAIR.Compiler.Extends buffer after ∧
+                      Aiur.NativeAIR.Compiler.LookupsReflect ops values after result.snd lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.recordZero_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer after : Array W},
+  Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+    Aiur.NativeAIR.Compiler.Extends buffer after →
+      ∀ {root : Nat} {value : W},
+        buffer[root]? = some value →
+          ∀ {roots : List Nat},
+            Aiur.NativeAIR.Compiler.recordZero nodes root = some roots →
+              (Aiur.NativeAIR.Compiler.Vanishes ops after roots ↔ value = ops.konst 0)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.Vanishes.append
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (buffer : Array W) (left right : List Nat),
+  Aiur.NativeAIR.Compiler.Vanishes ops buffer (left ++ right) ↔
+    Aiur.NativeAIR.Compiler.Vanishes ops buffer left ∧ Aiur.NativeAIR.Compiler.Vanishes ops buffer right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.ExprsVanish.cons
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W) (head : Aiur.NativeAIR.Expr)
+  (tail : List Aiur.NativeAIR.Expr),
+  Aiur.NativeAIR.Compiler.ExprsVanish ops values (head :: tail) ↔
+    Aiur.NativeAIR.Expr.eval ops values head = some (ops.konst 0) ∧ Aiur.NativeAIR.Compiler.ExprsVanish ops values tail
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.compileZeros_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (exprs : List Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+          Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+            ∀ {result : List Aiur.NativeAIR.Node × List Nat},
+              Aiur.NativeAIR.Compiler.compileZeros widths exprs nodes = some result →
+                ∃ after,
+                  Aiur.NativeAIR.Compiler.Evaluation ops values result.fst after ∧
+                    Aiur.NativeAIR.Compiler.Extends buffer after ∧
+                      (Aiur.NativeAIR.Compiler.Vanishes ops after result.snd ↔
+                        Aiur.NativeAIR.Compiler.ExprsVanish ops values exprs)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.canonicalZeros_vanish
+∀ {W : Type u_1} (ops : Aiur.NativeAIR.EvalOps W) (buffer : Array W) (roots : List Nat),
+  Aiur.NativeAIR.Compiler.Vanishes ops buffer (Aiur.NativeAIR.Compiler.canonicalZeros roots) ↔
+    Aiur.NativeAIR.Compiler.Vanishes ops buffer roots
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileBase_reflects
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) (constraints : List Aiur.NativeAIR.Expr)
+          {result : Aiur.NativeAIR.Compiler.BaseCompilation},
+          Aiur.NativeAIR.Compiler.compileBase widths lookups constraints = some result →
+            ∃ buffer,
+              result.graph.sweep ops values = some buffer ∧
+                Aiur.NativeAIR.Compiler.LookupsReflect ops values buffer result.graph.lookups lookups ∧
+                  (Aiur.NativeAIR.Compiler.Vanishes ops buffer result.graph.zeros ↔
+                    Aiur.NativeAIR.Compiler.ExprsVanish ops values constraints)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.LookupsReflect.read
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W}
+  {lookups : List Aiur.NativeAIR.Lookup} {exprs : List Aiur.NativeAIR.Compiler.ExprLookup},
+  Aiur.NativeAIR.Compiler.LookupsReflect ops values buffer lookups exprs →
+    ∃ result,
+      List.mapM (Aiur.NativeAIR.Compiler.ExprLookup.eval ops values) exprs = some result ∧
+        List.mapM (Aiur.NativeAIR.readLookup buffer) lookups = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileBase_satisfaction
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+      values.Fits widths →
+        ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) (constraints : List Aiur.NativeAIR.Expr)
+          {result : Aiur.NativeAIR.Compiler.BaseCompilation},
+          Aiur.NativeAIR.Compiler.compileBase widths lookups constraints = some result →
+            ∀ {buffer : Array W},
+              result.graph.sweep ops values = some buffer →
+                (Aiur.NativeAIR.Compiler.Vanishes ops buffer result.graph.zeros ↔
+                    Aiur.NativeAIR.Compiler.ExprsVanish ops values constraints) ∧
+                  List.mapM (Aiur.NativeAIR.readLookup buffer) result.graph.lookups =
+                    List.mapM (Aiur.NativeAIR.Compiler.ExprLookup.eval ops values) lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_mapM_read
+∀ {α β : Type u_1} {read : α → Option β} {inputs : List α} {outputs : List β},
+  List.mapM read inputs = some outputs → ∀ (index : Nat), inputs[index]? >>= read = outputs[index]?
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_read
+∀ {α β : Type u_1} {read : α → Option β} {inputs : Array α} {outputs : Array β},
+  Array.mapM read inputs = some outputs → ∀ (index : Nat), inputs[index]? >>= read = outputs[index]?
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_size
+∀ {α : Type u_1} {β : Type u_2} {read : α → Option β} {inputs : Array α} {outputs : Array β},
+  Array.mapM read inputs = some outputs → outputs.size = inputs.size
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_push
+∀ {α : Type u_1} {β : Type u_2} (read : α → Option β) (inputs : Array α) (input : α),
+  Array.mapM read (inputs.push input) = do
+    let outputs ← Array.mapM read inputs
+    let output ← read input
+    pure (outputs.push output)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_mapM_of_map
+∀ {α : Type u_1} {β : Type u_2} {γ : Type u_3} (items : List α) (input : α → β) (output : α → γ) (read : β → Option γ),
+  (∀ (item : α), item ∈ items → read (input item) = some (output item)) →
+    List.mapM read (List.map input items) = some (List.map output items)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_ofFn
+∀ {α : Type u_1} {β : Type u_2} {n : Nat} (input : Fin n → α) (output : Fin n → β) (read : α → Option β),
+  (∀ (index : Fin n), read (input index) = some (output index)) →
+    Array.mapM read (Array.ofFn input) = some (Array.ofFn output)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_mapM_ofFn
+∀ {α : Type u_1} {β : Type u_2} {n : Nat} (input : Fin n → α) (output : Fin n → β) (read : α → Option β),
+  (∀ (index : Fin n), read (input index) = some (output index)) →
+    List.mapM read (List.ofFn input) = some (List.ofFn output)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_mapM_transform
+∀ {α : Type u_1} {β : Type u_2} {γ : Type u_3} {δ : Type u_4} {read : α → Option β} {inputs : List α}
+  {outputs : List β},
+  List.mapM read inputs = some outputs →
+    ∀ (input : α → γ) (output : β → δ) (next : γ → Option δ),
+      (∀ (a : α) (b : β), read a = some b → next (input a) = some (output b)) →
+        List.mapM next (List.map input inputs) = some (List.map output outputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_transform
+∀ {α : Type u_1} {β : Type u_2} {γ : Type u_3} {δ : Type u_4} {read : α → Option β} {inputs : Array α}
+  {outputs : Array β},
+  Array.mapM read inputs = some outputs →
+    ∀ (input : α → γ) (output : β → δ) (next : γ → Option δ),
+      (∀ (a : α) (b : β), read a = some b → next (input a) = some (output b)) →
+        Array.mapM next (Array.map input inputs) = some (Array.map output outputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_mapM_refine
+∀ {α : Type u_1} {β : Type u_2} {γ : Type u_3} {first : α → Option β} {second : α → Option γ} {evaluate : β → Option γ}
+  {inputs : List α} {outputs : List β},
+  List.mapM first inputs = some outputs →
+    (∀ (input : α) (output : β),
+        first input = some output → ∃ value, second input = some value ∧ evaluate output = some value) →
+      ∃ values, List.mapM second inputs = some values ∧ List.mapM evaluate outputs = some values
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_refine
+∀ {α : Type u_1} {β : Type u_2} {γ : Type u_3} {first : α → Option β} {second : α → Option γ} {evaluate : β → Option γ}
+  {inputs : Array α} {outputs : Array β},
+  Array.mapM first inputs = some outputs →
+    (∀ (input : α) (output : β),
+        first input = some output → ∃ value, second input = some value ∧ evaluate output = some value) →
+      ∃ values, Array.mapM second inputs = some values ∧ Array.mapM evaluate outputs = some values
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.evalRows_empty
+∀ (values : Aiur.NativeAIR.Values Aiur.G), Aiur.NativeAIR.OpEmitter.evalRows values #[] = some #[]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.evalRows_singleton
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {expr : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values expr value → Aiur.NativeAIR.OpEmitter.evalRows values #[expr] = some #[value]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.evalRows_values
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {outputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some outputs →
+    Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Aiur.NativeAIR.OpEmitter.rowExprs rows) =
+      some (Aiur.AIR.rowValues outputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.evalRows_read
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {outputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some outputs →
+    ∀ {index : Nat} {row : Aiur.NativeAIR.RowExpr},
+      rows[index]? = some row →
+        ∃ output, outputs[index]? = some output ∧ Aiur.NativeAIR.RowExpr.Reflects values row output
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.select_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {outputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some outputs →
+    ∀ {indices : Array Nat} {selected : Array Aiur.NativeAIR.RowExpr},
+      Aiur.NativeAIR.OpEmitter.select rows indices = some selected →
+        ∃ results,
+          Array.mapM (fun index => outputs[index]?) indices = some results ∧
+            Aiur.NativeAIR.OpEmitter.evalRows values selected = some results
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.select_values
+∀ {rows : Array Aiur.AIR.RowValue} {indices : Array Nat} {outputs : Array Aiur.AIR.RowValue},
+  Array.mapM (fun index => rows[index]?) indices = some outputs →
+    Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues rows) indices = some (Aiur.AIR.rowValues outputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.select_normal
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    ∀ {indices : Array Nat} {selected : Array Aiur.NativeAIR.RowExpr},
+      Aiur.NativeAIR.OpEmitter.select rows indices = some selected → Aiur.NativeAIR.OpEmitter.Normal selected
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_ofFn_getD
+∀ {α : Type u_1} (items : Array α) (fallback : α) {count : Nat},
+  items.size = count → (Array.ofFn fun index => items[↑index]?.getD fallback) = items
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_map_getD_of_mapM
+∀ {α : Type} {items : Array α} {indices : Array Nat} {selected : Array α} (fallback : α),
+  Array.mapM (fun index => items[index]?) indices = some selected →
+    Array.map (fun index => items[index]?.getD fallback) indices = selected
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.evalRows_getD
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {outputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some outputs →
+    ∀ {index : Nat},
+      index < rows.size →
+        Aiur.NativeAIR.RowExpr.Reflects values (rows[index]?.getD (Aiur.NativeAIR.RowExpr.konst 0))
+          (outputs[index]?.getD (Aiur.AIR.RowValue.konst 0))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.advice_eval
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first count : Nat),
+  (∀ (index : Nat),
+      index < count →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+          some (row index)) →
+    Aiur.NativeAIR.OpEmitter.evalRows values (Aiur.NativeAIR.OpEmitter.advice first count) =
+      some (Aiur.AIR.rowAdvice row 0 count)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.advice_normal
+∀ (first count : Nat), Aiur.NativeAIR.OpEmitter.Normal (Aiur.NativeAIR.OpEmitter.advice first count)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.CallExpr.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {call : Aiur.NativeAIR.OpEmitter.CallExpr} {inputs outputs : Array Aiur.G}
+  {rank : Aiur.G} {gap : Fin 6 → Aiur.G},
+  Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) call.inputs = some inputs →
+    Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) call.outputs = some outputs →
+      Aiur.NativeAIR.OpEmitter.evalExpr values call.rank = some rank →
+        (∀ (index : Fin 6), Aiur.NativeAIR.OpEmitter.evalExpr values (call.gap index) = some (gap index)) →
+          Aiur.NativeAIR.OpEmitter.CallExpr.eval values call =
+            some ({ function := call.function, inputs := inputs, outputs := outputs, rank := rank }, gap)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitAdvice_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first count : Nat),
+  (∀ (index : Nat),
+      index < count →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+          some (row index)) →
+    Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitAdvice first count) =
+      some (Aiur.AIR.emitAdvice row count)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.Emission.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.OpEmitter.Emission} {result : Aiur.AIR.OpEmission},
+  Aiur.NativeAIR.OpEmitter.evalRows values emission.outputs = some result.outputs →
+    emission.used = result.used →
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations →
+        List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) emission.queries = some result.queries →
+          List.mapM (Aiur.NativeAIR.OpEmitter.CallExpr.eval values) emission.calls = some result.calls →
+            Aiur.NativeAIR.OpEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte1_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat) (kind : Aiur.AIR.Byte1Kind)
+  {input : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values input value →
+    (∀ (index : Nat),
+        index < kind.outputSize →
+          (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+            some (row index)) →
+      Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitByte1 first kind input) =
+        some
+          { outputs := Aiur.AIR.rowAdvice row 0 kind.outputSize, used := kind.outputSize,
+            queries :=
+              [Aiur.AIR.byte1Request kind value.value (Aiur.AIR.rowValues (Aiur.AIR.rowAdvice row 0 kind.outputSize))] }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.scale_isConstant
+∀ (expr : Aiur.NativeAIR.Expr) {coefficient : Aiur.G},
+  coefficient ≠ 0 → (expr.frontMul (Aiur.NativeAIR.Expr.konst coefficient)).isConstant = expr.isConstant
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.byteCarry_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat) (subtract : Bool)
+  {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b →
+      left.expr.noConstantNegs = true →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first]? = some (row 0) →
+          Aiur.NativeAIR.RowExpr.Reflects values (Aiur.NativeAIR.OpEmitter.byteCarry first subtract left right)
+            {
+              value :=
+                (if subtract = true then row 0 + b.value - a.value else a.value + b.value - row 0) *
+                  Aiur.AIR.inverse256,
+              degree := max (max a.degree b.degree) 1, constant := false }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.byteCarry_normal
+∀ (first : Nat) (subtract : Bool) {left right : Aiur.NativeAIR.RowExpr},
+  left.expr.noConstantNegs = true →
+    right.expr.noConstantNegs = true →
+      (Aiur.NativeAIR.OpEmitter.byteCarry first subtract left right).expr.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat) (kind : Aiur.AIR.Byte2Kind)
+  {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values left a →
+    Aiur.NativeAIR.RowExpr.Reflects values right b →
+      left.expr.noConstantNegs = true →
+        (∀ (index : Nat),
+            index < kind.outputSize →
+              (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+                some (row index)) →
+          Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitByte2 first kind left right) =
+            some
+              { outputs := kind.extendRowOutputs a b (Aiur.AIR.rowAdvice row 0 kind.outputSize),
+                used := kind.outputSize,
+                queries :=
+                  [Aiur.AIR.byte2Request kind a.value b.value
+                      (Aiur.AIR.rowValues (Aiur.AIR.rowAdvice row 0 kind.outputSize))] }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_normal
+∀ (first : Nat) (kind : Aiur.AIR.Byte2Kind) {left right : Aiur.NativeAIR.RowExpr},
+  left.expr.noConstantNegs = true →
+    right.expr.noConstantNegs = true →
+      Aiur.NativeAIR.OpEmitter.Normal (Aiur.NativeAIR.OpEmitter.emitByte2 first kind left right).outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.scale_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) {expr : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values expr value →
+    ∀ (coefficient : Aiur.G),
+      coefficient ≠ 0 →
+        Aiur.NativeAIR.RowExpr.Reflects values (expr.mul (Aiur.NativeAIR.RowExpr.konst coefficient))
+          { value := value.value * coefficient, degree := value.degree, constant := value.constant }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_ofFn_four
+∀ {α : Type u_1} (values : Fin 4 → α), List.ofFn values = [values 0, values 1, values 2, values 3]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_foldl_zip_four
+∀ {α : Type u_1} {β : Type u_2} (values : Fin 4 → α) (step : β → α × Nat → β) (initial : β),
+  List.foldl step initial (List.ofFn values).zipIdx =
+    step (step (step (step initial (values 0, 0)) (values 1, 1)) (values 2, 2)) (values 3, 3)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packFour_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (bytes : Fin 4 → Aiur.NativeAIR.RowExpr)
+  (results : Fin 4 → Aiur.AIR.RowValue),
+  (∀ (index : Fin 4), Aiur.NativeAIR.RowExpr.Reflects values (bytes index) (results index)) →
+    Aiur.NativeAIR.RowExpr.Reflects values (Aiur.NativeAIR.OpEmitter.packFour bytes)
+      (Aiur.AIR.RowValue.pack (Array.ofFn results))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packFour_normal
+∀ (bytes : Fin 4 → Aiur.NativeAIR.RowExpr),
+  (∀ (index : Fin 4), (bytes index).expr.noConstantNegs = true) →
+    (Aiur.NativeAIR.OpEmitter.packFour bytes).expr.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.readWord_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {outputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some outputs →
+    ∀ {indices : Array Nat} {word : Aiur.NativeAIR.RowExpr},
+      Aiur.NativeAIR.OpEmitter.readWord rows indices = some word →
+        ∃ value, Aiur.AIR.readRowWord outputs indices = some value ∧ Aiur.NativeAIR.RowExpr.Reflects values word value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.readWord_normal
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    ∀ {indices : Array Nat} {word : Aiur.NativeAIR.RowExpr},
+      Aiur.NativeAIR.OpEmitter.readWord rows indices = some word → word.expr.noConstantNegs = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packedAdvice_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat),
+  (∀ (index : Nat),
+      index < 4 →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+          some (row index)) →
+    Aiur.NativeAIR.RowExpr.Reflects values (Aiur.NativeAIR.OpEmitter.packedAdvice first)
+      (Aiur.AIR.RowValue.pack (Aiur.AIR.rowAdvice row 0 4))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packedAdvice_normal
+∀ (first : Nat), (Aiur.NativeAIR.OpEmitter.packedAdvice first).expr.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.packed_advice_not_constant
+∀ (row : Nat → Aiur.G), (Aiur.AIR.RowValue.pack (Aiur.AIR.rowAdvice row 0 4)).constant = false
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitWordSum_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat) {sum : Aiur.NativeAIR.RowExpr}
+  {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values sum value →
+    (∀ (index : Nat),
+        index < 4 →
+          (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+            some (row index)) →
+      Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitWordSum first sum) =
+        some
+          {
+            outputs :=
+              (Aiur.AIR.rowAdvice row 0 4).push
+                {
+                  value :=
+                    (value.value - (Aiur.AIR.RowValue.pack (Aiur.AIR.rowAdvice row 0 4)).value) * 18446744065119617026,
+                  degree := max value.degree (Aiur.AIR.RowValue.pack (Aiur.AIR.rowAdvice row 0 4)).degree,
+                  constant := false },
+            used := 4 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitWordSum_normal
+∀ (first : Nat) {sum : Aiur.NativeAIR.RowExpr},
+  sum.expr.noConstantNegs = true →
+    Aiur.NativeAIR.OpEmitter.Normal (Aiur.NativeAIR.OpEmitter.emitWordSum first sum).outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packed_advice_value
+∀ (row : Nat → Aiur.G),
+  (Aiur.AIR.RowValue.pack (Aiur.AIR.rowAdvice row 0 4)).value = Aiur.AIR.pack4 fun index => row ↑index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.carryStep_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {x y z previous : Aiur.NativeAIR.Expr} {a b c d : Aiur.G},
+  Aiur.NativeAIR.OpEmitter.evalExpr values x = some a →
+    Aiur.NativeAIR.OpEmitter.evalExpr values y = some b →
+      Aiur.NativeAIR.OpEmitter.evalExpr values z = some c →
+        Aiur.NativeAIR.OpEmitter.evalExpr values previous = some d →
+          Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.OpEmitter.carryStep x y z previous) =
+            some (Aiur.AIR.carryStep a b c d)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.carryStep_normal
+∀ {x y z previous : Aiur.NativeAIR.Expr},
+  x.noConstantNegs = true →
+    y.noConstantNegs = true →
+      z.noConstantNegs = true →
+        previous.noConstantNegs = true → (Aiur.NativeAIR.OpEmitter.carryStep x y z previous).noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.carryStep_not_constant
+∀ {x y z previous : Aiur.NativeAIR.Expr},
+  z.noConstantNegs = true →
+    z.isConstant = false → (Aiur.NativeAIR.OpEmitter.carryStep x y z previous).isConstant = false
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.carries_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {x y z : Fin 4 → Aiur.NativeAIR.Expr} {a b c : Fin 4 → Aiur.G},
+  (∀ (index : Fin 4), Aiur.NativeAIR.OpEmitter.evalExpr values (x index) = some (a index)) →
+    (∀ (index : Fin 4), Aiur.NativeAIR.OpEmitter.evalExpr values (y index) = some (b index)) →
+      (∀ (index : Fin 4), Aiur.NativeAIR.OpEmitter.evalExpr values (z index) = some (c index)) →
+        ∀ (index : Fin 5),
+          Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.OpEmitter.carries x y z index) =
+            some (Aiur.AIR.u32Carries a b c index)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.carries_normal
+∀ {x y z : Fin 4 → Aiur.NativeAIR.Expr},
+  (∀ (index : Fin 4), (x index).noConstantNegs = true) →
+    (∀ (index : Fin 4), (y index).noConstantNegs = true) →
+      (∀ (index : Fin 4), (z index).noConstantNegs = true) →
+        ∀ (index : Fin 5), (Aiur.NativeAIR.OpEmitter.carries x y z index).noConstantNegs = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packSix_eval
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (bytes : Fin 6 → Aiur.NativeAIR.Expr) (results : Fin 6 → Aiur.G),
+  (∀ (index : Fin 6), Aiur.NativeAIR.OpEmitter.evalExpr values (bytes index) = some (results index)) →
+    Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.OpEmitter.packSix bytes) = some (Aiur.AIR.packRank results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rangePair_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {left right : Aiur.NativeAIR.Expr} {a b : Aiur.G},
+  Aiur.NativeAIR.OpEmitter.evalExpr values left = some a →
+    Aiur.NativeAIR.OpEmitter.evalExpr values right = some b →
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Aiur.NativeAIR.OpEmitter.rangePair left right) =
+        some (Aiur.AIR.rangeMessage (a, b))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rangeSix_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (bytes : Fin 6 → Aiur.NativeAIR.Expr) (results : Fin 6 → Aiur.G),
+  (∀ (index : Fin 6), Aiur.NativeAIR.OpEmitter.evalExpr values (bytes index) = some (results index)) →
+    List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) (Aiur.NativeAIR.OpEmitter.rangeSix bytes) =
+      some (List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries results))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitCall_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first function size : Nat)
+  {selector rank : Aiur.NativeAIR.Expr} {s r : Aiur.G} {inputs : Array Aiur.NativeAIR.RowExpr}
+  {arguments : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    Aiur.NativeAIR.OpEmitter.evalExpr values rank = some r →
+      Aiur.NativeAIR.OpEmitter.evalRows values inputs = some arguments →
+        (∀ (index : Nat),
+            index < size + 7 →
+              (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+                some (row index)) →
+          Aiur.NativeAIR.OpEmitter.Emission.eval values
+              (Aiur.NativeAIR.OpEmitter.emitCall selector rank first function inputs size) =
+            some
+              { outputs := Aiur.AIR.rowAdvice row 0 size, used := size + 7,
+                equations :=
+                  [s *
+                      Aiur.AIR.callOrderConstraint r (row size)
+                        (Aiur.AIR.packRank fun index => row (size + 1 + ↑index))],
+                queries :=
+                  Aiur.AIR.functionMessage
+                      { function := function, inputs := Aiur.AIR.rowValues arguments,
+                        outputs := Aiur.AIR.rowValues (Aiur.AIR.rowAdvice row 0 size), rank := row size } ::
+                    List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries fun index => row (size + 1 + ↑index)),
+                calls :=
+                  [({ function := function, inputs := Aiur.AIR.rowValues arguments,
+                        outputs := Aiur.AIR.rowValues (Aiur.AIR.rowAdvice row 0 size), rank := row size },
+                      fun index => row (size + 1 + ↑index))] }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitStore_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat) {contents : Array Aiur.NativeAIR.RowExpr}
+  {stored : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values contents = some stored →
+    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first]? = some (row 0) →
+      Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitStore first contents) =
+        some
+          { outputs := Aiur.AIR.rowAdvice row 0 1, used := 1,
+            queries := [Aiur.AIR.memoryMessage contents.size (row 0) (Aiur.AIR.rowValues stored)] }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitLoad_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first size : Nat) {pointer : Aiur.NativeAIR.RowExpr}
+  {address : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.RowExpr.Reflects values pointer address →
+    (∀ (index : Nat),
+        index < size →
+          (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+            some (row index)) →
+      Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitLoad first size pointer) =
+        some
+          { outputs := Aiur.AIR.rowAdvice row 0 size, used := size,
+            queries :=
+              [Aiur.AIR.memoryMessage size address.value (Aiur.AIR.rowValues (Aiur.AIR.rowAdvice row 0 size))] }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rangeFour_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (bytes : Fin 4 → Aiur.NativeAIR.Expr) (results : Fin 4 → Aiur.G),
+  (∀ (index : Fin 4), Aiur.NativeAIR.OpEmitter.evalExpr values (bytes index) = some (results index)) →
+    List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) (Aiur.NativeAIR.OpEmitter.rangeFour bytes) =
+      some (Aiur.AIR.range4Queries results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.booleanExpr_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {expr : Aiur.NativeAIR.Expr} {value : Aiur.G},
+  Aiur.NativeAIR.OpEmitter.evalExpr values expr = some value →
+    Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.OpEmitter.booleanExpr expr) =
+      some (Aiur.AIR.booleanConstraint value)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitU32LessThan_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (first : Nat) {selector : Aiur.NativeAIR.Expr}
+  {s : Aiur.G} {left right : Aiur.NativeAIR.RowExpr} {a b : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values left a →
+      Aiur.NativeAIR.RowExpr.Reflects values right b →
+        (∀ (index : Nat),
+            index < 12 →
+              (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+                some (row index)) →
+          Aiur.NativeAIR.OpEmitter.Emission.eval values
+              (Aiur.NativeAIR.OpEmitter.emitU32LessThan selector first left right) =
+            some
+              {
+                outputs :=
+                  #[{
+                      value :=
+                        1 - Aiur.AIR.u32Carries (fun i => row ↑i) (fun i => row (4 + ↑i)) (fun i => row (8 + ↑i)) 4,
+                      degree := 1, constant := false }],
+                used := 12,
+                equations :=
+                  s * (a.value - Aiur.AIR.pack4 fun i => row ↑i) ::
+                    s * (b.value - Aiur.AIR.pack4 fun i => row (8 + ↑i)) ::
+                      List.ofFn fun i =>
+                        s *
+                          Aiur.AIR.booleanConstraint
+                            (Aiur.AIR.u32Carries (fun i => row ↑i) (fun i => row (4 + ↑i)) (fun i => row (8 + ↑i))
+                              i.succ),
+                queries :=
+                  ((Aiur.AIR.range4Queries fun i => row ↑i) ++ Aiur.AIR.range4Queries fun i => row (4 + ↑i)) ++
+                    Aiur.AIR.range4Queries fun i => row (8 + ↑i) }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitU32LessThan_normal
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) (left right : Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.Normal (Aiur.NativeAIR.OpEmitter.emitU32LessThan selector first left right).outputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rowValues_getD
+∀ (rows : Array Aiur.AIR.RowValue) (index : Nat),
+  (Aiur.AIR.rowValues rows)[index]?.getD 0 = (rows[index]?.getD (Aiur.AIR.RowValue.konst 0)).value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitAssert_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {left right : Array Aiur.NativeAIR.RowExpr} {a b : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    Aiur.NativeAIR.OpEmitter.evalRows values left = some a →
+      Aiur.NativeAIR.OpEmitter.evalRows values right = some b →
+        left.size = right.size →
+          Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.emitAssert selector left right) =
+            some
+              {
+                equations :=
+                  List.ofFn fun index =>
+                    s * ((Aiur.AIR.rowValues a)[↑index]?.getD 0 - (Aiur.AIR.rowValues b)[↑index]?.getD 0) }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.fromScalar_eval
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (emission : Aiur.NativeAIR.ScalarEmission),
+  Aiur.NativeAIR.OpEmitter.Emission.eval values (Aiur.NativeAIR.OpEmitter.fromScalar emission) =
+    Aiur.NativeAIR.ScalarEmission.eval values emission
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.empty_eval
+∀ (values : Aiur.NativeAIR.Values Aiur.G), Aiur.NativeAIR.OpEmitter.Emission.eval values { } = some { }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.normal_empty
+Aiur.NativeAIR.OpEmitter.Normal #[]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.normal_singleton
+∀ {row : Aiur.NativeAIR.RowExpr}, row.expr.noConstantNegs = true → Aiur.NativeAIR.OpEmitter.Normal #[row]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.Normal.read
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    ∀ {index : Nat} {row : Aiur.NativeAIR.RowExpr}, rows[index]? = some row → row.expr.noConstantNegs = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_byte1
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte1Kind) (index : Nat)
+  (rows : Array Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op index) rows = do
+    let __do_lift ← rows[index]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte1 first kind __do_lift)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_byte2
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte2Kind) (left right : Nat)
+  (rows : Array Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op left right) rows = do
+    let __do_lift ← rows[left]?
+    let __do_lift_1 ← rows[right]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first kind __do_lift __do_lift_1)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte1_dispatch
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (selector rank : Aiur.NativeAIR.Expr) (s r : Aiur.G)
+  (first : Nat) (kind : Aiur.AIR.Byte1Kind) (index : Nat) {rows : Array Aiur.NativeAIR.RowExpr}
+  {inputs : Array Aiur.AIR.RowValue} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+    Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op index) rows = some emission →
+      (∀ (index : Nat),
+          index < emission.used →
+            (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+              some (row index)) →
+        ∃ result,
+          Aiur.AIR.emitOp row s r (kind.op index) inputs = some result ∧
+            Aiur.NativeAIR.OpEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_dispatch
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) (selector rank : Aiur.NativeAIR.Expr) (s r : Aiur.G)
+  (first : Nat) (kind : Aiur.AIR.Byte2Kind) (left right : Nat) {rows : Array Aiur.NativeAIR.RowExpr}
+  {inputs : Array Aiur.AIR.RowValue} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+    Aiur.NativeAIR.OpEmitter.Normal rows →
+      Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op left right) rows = some emission →
+        (∀ (index : Nat),
+            index < emission.used →
+              (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+                some (row index)) →
+          ∃ result,
+            Aiur.AIR.emitOp row s r (kind.op left right) inputs = some result ∧
+              Aiur.NativeAIR.OpEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.list_ofFn_getD_pair
+∀ {α β γ : Type} (left : Array α) (right : Array β) (leftDefault : α) (rightDefault : β) (f : α → β → γ) {count : Nat}
+  (size : left.size = count),
+  (List.ofFn fun index => f (left[↑index]?.getD leftDefault) (right[↑index]?.getD rightDefault)) =
+    List.ofFn fun index => f left[index] (right[↑index]?.getD rightDefault)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selector rank : Aiur.NativeAIR.Expr} {s r : Aiur.G}
+  {first : Nat} {op : Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr} {inputs : Array Aiur.AIR.RowValue}
+  {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    Aiur.NativeAIR.OpEmitter.evalExpr values rank = some r →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission →
+            (∀ (index : Nat),
+                index < emission.used →
+                  (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[first + index]? =
+                    some (row index)) →
+              ∃ result,
+                Aiur.AIR.emitOp row s r op inputs = some result ∧
+                  Aiur.NativeAIR.OpEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_normal
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte1Kind) (index : Nat)
+  {rows : Array Aiur.NativeAIR.RowExpr} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op index) rows = some emission →
+    Aiur.NativeAIR.OpEmitter.Normal emission.outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_normal
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte2Kind) (a b : Nat)
+  {rows : Array Aiur.NativeAIR.RowExpr} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op a b) rows = some emission →
+      Aiur.NativeAIR.OpEmitter.Normal emission.outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_normal
+∀ {selector rank : Aiur.NativeAIR.Expr} {first : Nat} {op : Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission →
+      Aiur.NativeAIR.OpEmitter.Normal emission.outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.evalRows_append
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {left right : Array Aiur.NativeAIR.RowExpr} {a b : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values left = some a →
+    Aiur.NativeAIR.OpEmitter.evalRows values right = some b →
+      Aiur.NativeAIR.OpEmitter.evalRows values (left ++ right) = some (a ++ b)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.Normal.append
+∀ {left right : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.Normal left →
+    Aiur.NativeAIR.OpEmitter.Normal right → Aiur.NativeAIR.OpEmitter.Normal (left ++ right)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.Emission.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.OpEmitter.Emission} {result : Aiur.AIR.OpEmission},
+  Aiur.NativeAIR.OpEmitter.Emission.eval values emission = some result →
+    Aiur.NativeAIR.OpEmitter.evalRows values emission.outputs = some result.outputs ∧
+      emission.used = result.used ∧
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations ∧
+          List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) emission.queries = some result.queries ∧
+            List.mapM (Aiur.NativeAIR.OpEmitter.CallExpr.eval values) emission.calls = some result.calls
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.OpsEmission.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission}
+  {result : Aiur.AIR.OpsEmission},
+  Aiur.NativeAIR.OpEmitter.evalRows values emission.values = some result.values →
+    emission.column = result.column →
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations →
+        List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) emission.queries = some result.queries →
+          List.mapM (Aiur.NativeAIR.OpEmitter.CallExpr.eval values) emission.calls = some result.calls →
+            Aiur.NativeAIR.OpEmitter.OpsEmission.eval values emission = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.OpsEmission.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission}
+  {result : Aiur.AIR.OpsEmission},
+  Aiur.NativeAIR.OpEmitter.OpsEmission.eval values emission = some result →
+    Aiur.NativeAIR.OpEmitter.evalRows values emission.values = some result.values ∧
+      emission.column = result.column ∧
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations ∧
+          List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) emission.queries = some result.queries ∧
+            List.mapM (Aiur.NativeAIR.OpEmitter.CallExpr.eval values) emission.calls = some result.calls
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_column
+∀ {selector rank : Aiur.NativeAIR.Expr} {ops : List Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {column : Nat} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission},
+  Aiur.NativeAIR.OpEmitter.emitOps selector rank ops rows column = some emission → column ≤ emission.column
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_normal
+∀ {selector rank : Aiur.NativeAIR.Expr} {ops : List Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {column : Nat} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.OpEmitter.emitOps selector rank ops rows column = some emission →
+      Aiur.NativeAIR.OpEmitter.Normal emission.values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selector rank : Aiur.NativeAIR.Expr} {s r : Aiur.G}
+  {ops : List Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr} {inputs : Array Aiur.AIR.RowValue} {column : Nat}
+  {emission : Aiur.NativeAIR.OpEmitter.OpsEmission},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    Aiur.NativeAIR.OpEmitter.evalExpr values rank = some r →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.OpEmitter.emitOps selector rank ops rows column = some emission →
+            (∀ (index : Nat),
+                column ≤ index →
+                  index < emission.column →
+                    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                      some (row index)) →
+              ∃ result,
+                Aiur.AIR.emitOps row s r ops inputs column = some result ∧
+                  Aiur.NativeAIR.OpEmitter.OpsEmission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.addArgs_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {left right : List Aiur.NativeAIR.Expr} {a b : List Aiur.G},
+  List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) left = some a →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) right = some b →
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Aiur.NativeAIR.LookupEmitter.addArgs left right) =
+        some (Aiur.AIR.addMessages a b)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.gateArgs_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {args : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) args = some results →
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)
+          (Aiur.NativeAIR.LookupEmitter.gateArgs branchless selector args) =
+        some (Aiur.AIR.gateMessage branchless s results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.QueryExpr.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {query : Aiur.NativeAIR.LookupEmitter.QueryExpr}
+  {result : Aiur.AIR.QueryPart},
+  Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values query = some result →
+    query.slot = result.slot ∧
+      Aiur.NativeAIR.OpEmitter.evalExpr values query.selector = some result.selector ∧
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) query.message = some result.message
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LookupEmitter.queryParts_cons
+∀ (slot : Nat) (selector : Aiur.NativeAIR.Expr) (message : List Aiur.NativeAIR.Expr)
+  (queries : List (List Aiur.NativeAIR.Expr)),
+  Aiur.NativeAIR.LookupEmitter.queryParts slot selector (message :: queries) =
+    { slot := slot, selector := selector, message := message } ::
+      Aiur.NativeAIR.LookupEmitter.queryParts (slot + 1) selector queries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.queryParts_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {queries : List (List Aiur.NativeAIR.Expr)} {messages : List (List Aiur.G)},
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) queries = some messages →
+      ∀ (slot : Nat),
+        List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values)
+            (Aiur.NativeAIR.LookupEmitter.queryParts slot selector queries) =
+          some (Aiur.AIR.queryParts slot s messages)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.accumulate_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {lookup : Aiur.NativeAIR.Compiler.ExprLookup}
+  {query : Aiur.NativeAIR.LookupEmitter.QueryExpr} {initial : Aiur.G × List Aiur.G} {part : Aiur.AIR.QueryPart},
+  Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values lookup = some initial →
+    Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values query = some part →
+      Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+          (Aiur.NativeAIR.LookupEmitter.accumulate branchless lookup query) =
+        some
+          (initial.fst + part.selector,
+            Aiur.AIR.addMessages initial.snd (Aiur.AIR.gateMessage branchless part.selector part.message))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.fold_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {queries : List Aiur.NativeAIR.LookupEmitter.QueryExpr}
+  {parts : List Aiur.AIR.QueryPart},
+  List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) queries = some parts →
+    ∀ {initial : Aiur.NativeAIR.Compiler.ExprLookup} {start : Aiur.G × List Aiur.G},
+      Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values initial = some start →
+        Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+            (List.foldl (Aiur.NativeAIR.LookupEmitter.accumulate branchless) initial queries) =
+          some (List.foldl (Aiur.NativeAIR.LookupEmitter.valuedAccumulate branchless) start parts)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.filter_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {queries : List Aiur.NativeAIR.LookupEmitter.QueryExpr}
+  {parts : List Aiur.AIR.QueryPart},
+  List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) queries = some parts →
+    ∀ (slot : Nat),
+      List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values)
+          (List.filter (fun query => query.slot == slot) queries) =
+        some (List.filter (fun query => query.slot == slot) parts)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.valuedFold_eq
+∀ (branchless : Bool) (parts : List Aiur.AIR.QueryPart) (start : Aiur.G × List Aiur.G),
+  List.foldl (Aiur.NativeAIR.LookupEmitter.valuedAccumulate branchless) start parts =
+    (List.foldl (fun x1 x2 => x1 + x2) start.fst (List.map Aiur.AIR.QueryPart.selector parts),
+      List.foldl (fun args part => Aiur.AIR.addMessages args (Aiur.AIR.gateMessage branchless part.fst part.snd))
+        start.snd (List.map (fun part => (part.selector, part.message)) parts))
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LookupEmitter.slot_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {queries : List Aiur.NativeAIR.LookupEmitter.QueryExpr}
+  {parts : List Aiur.AIR.QueryPart},
+  List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) queries = some parts →
+    ∀ (index : Nat),
+      Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+          (Aiur.NativeAIR.LookupEmitter.slot branchless queries index) =
+        some
+          (Aiur.AIR.querySlotMultiplicity parts index,
+            Aiur.AIR.slotMessage branchless (Aiur.AIR.querySlotParts parts index))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LookupEmitter.slots_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {queries : List Aiur.NativeAIR.LookupEmitter.QueryExpr}
+  {parts : List Aiur.AIR.QueryPart},
+  List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) queries = some parts →
+    ∀ (count : Nat),
+      List.mapM (Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values)
+          (Aiur.NativeAIR.LookupEmitter.slots branchless queries count) =
+        some
+          (List.ofFn fun index =>
+            (Aiur.AIR.querySlotMultiplicity parts ↑index,
+              Aiur.AIR.slotMessage branchless (Aiur.AIR.querySlotParts parts ↑index)))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.evaluated_read
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {expressions : Array Aiur.NativeAIR.Expr} {results : Array Aiur.G},
+  Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) expressions = some results →
+    ∀ {index : Nat} {expr : Aiur.NativeAIR.Expr},
+      expressions[index]? = some expr → Aiur.NativeAIR.OpEmitter.evalExpr values expr = some (results[index]?.getD 0)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.list_mapM_evaluate
+∀ {α β γ : Type} {first : α → Option β} {evaluate : β → Option γ} {inputs : List α} {outputs : List β},
+  List.mapM first inputs = some outputs →
+    ∀ (value : α → γ),
+      (∀ (input : α) (output : β), first input = some output → evaluate output = some (value input)) →
+        List.mapM evaluate outputs = some (List.map value inputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.sum_fold_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {expressions : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) expressions = some results →
+    ∀ {initial : Aiur.NativeAIR.Expr} {start : Aiur.G},
+      Aiur.NativeAIR.OpEmitter.evalExpr values initial = some start →
+        Aiur.NativeAIR.OpEmitter.evalExpr values (List.foldl Aiur.NativeAIR.Expr.frontAdd initial expressions) =
+          some (List.foldl (fun x1 x2 => x1 + x2) start results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.sum_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {expressions : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) expressions = some results →
+    Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.BlockEmitter.sum expressions) =
+      some (Aiur.AIR.selectorSum results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.selectors_array_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selectors : Array Aiur.NativeAIR.Expr} {results : Array Aiur.G},
+  Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) selectors = some results →
+    Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors fun index => results[index]?.getD 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.ctrlSelector_reads
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selectors : Array Aiur.NativeAIR.Expr} {selector : Nat → Aiur.G},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selector →
+    ∀ (ctrl : Aiur.Bytecode.Ctrl) {expr : Aiur.NativeAIR.Expr},
+      Aiur.NativeAIR.BlockEmitter.ctrlSelector selectors ctrl = some expr →
+        Aiur.NativeAIR.OpEmitter.evalExpr values expr = some (Aiur.Bytecode.Ctrl.selectorFlow selector ctrl).entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.blockSelector_reads
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selectors : Array Aiur.NativeAIR.Expr} {selector : Nat → Aiur.G},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selector →
+    ∀ (block : Aiur.Bytecode.Block) {expr : Aiur.NativeAIR.Expr},
+      Aiur.NativeAIR.BlockEmitter.blockSelector selectors block = some expr →
+        Aiur.NativeAIR.OpEmitter.evalExpr values expr = some (Aiur.Bytecode.Block.selectorFlow selector block).entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.ctrlSelector_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selectors : Array Aiur.NativeAIR.Expr} {results : Array Aiur.G},
+  Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) selectors = some results →
+    ∀ (ctrl : Aiur.Bytecode.Ctrl) {expr : Aiur.NativeAIR.Expr},
+      Aiur.NativeAIR.BlockEmitter.ctrlSelector selectors ctrl = some expr →
+        Aiur.NativeAIR.OpEmitter.evalExpr values expr =
+          some (Aiur.Bytecode.Ctrl.selectorFlow (fun index => results[index]?.getD 0) ctrl).entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.blockSelector_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selectors : Array Aiur.NativeAIR.Expr} {results : Array Aiur.G},
+  Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) selectors = some results →
+    ∀ (block : Aiur.Bytecode.Block) {expr : Aiur.NativeAIR.Expr},
+      Aiur.NativeAIR.BlockEmitter.blockSelector selectors block = some expr →
+        Aiur.NativeAIR.OpEmitter.evalExpr values expr =
+          some (Aiur.Bytecode.Block.selectorFlow (fun index => results[index]?.getD 0) block).entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.list_mapM_flatMap
+∀ {α β γ δ : Type} {read : α → Option β} {inputs : List α} {outputs : List β},
+  List.mapM read inputs = some outputs →
+    ∀ (first : α → List γ) (second : β → List δ) (evaluate : γ → Option δ),
+      (∀ (input : α) (output : β), read input = some output → List.mapM evaluate (first input) = some (second output)) →
+        List.mapM evaluate (List.flatMap first inputs) = some (List.flatMap second outputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.list_mapM_foldl
+∀ {α β γ : Type} {read : α → Option β} {inputs : List α} {outputs : List β},
+  List.mapM read inputs = some outputs →
+    ∀ (first : γ → α → γ) (second : γ → β → γ),
+      (∀ (input : α) (output : β), read input = some output → ∀ (start : γ), first start input = second start output) →
+        ∀ (start : γ), List.foldl first start inputs = List.foldl second start outputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.Emission.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  {result : Aiur.AIR.BlockEmission},
+  Aiur.NativeAIR.OpEmitter.evalRows values emission.values = some result.values →
+    emission.column = result.column →
+      emission.lookup = result.lookup →
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations →
+          List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) emission.queries = some result.queries →
+            List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) emission.returns = some result.returns →
+              List.mapM (Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values) emission.yields = some result.yields →
+                List.mapM (Aiur.NativeAIR.BlockEmitter.evalGatedCall values) emission.calls = some result.calls →
+                  Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.Emission.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  {result : Aiur.AIR.BlockEmission},
+  Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result →
+    Aiur.NativeAIR.OpEmitter.evalRows values emission.values = some result.values ∧
+      emission.column = result.column ∧
+        emission.lookup = result.lookup ∧
+          List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations ∧
+            List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) emission.queries = some result.queries ∧
+              List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) emission.returns = some result.returns ∧
+                List.mapM (Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values) emission.yields = some result.yields ∧
+                  List.mapM (Aiur.NativeAIR.BlockEmitter.evalGatedCall values) emission.calls = some result.calls
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.BlockEmitter.Emission.prefix_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  {result : Aiur.AIR.BlockEmission} {equations : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) equations = some results →
+      Aiur.NativeAIR.BlockEmitter.Emission.eval values
+          (Aiur.NativeAIR.BlockEmitter.Emission.prefix equations emission) =
+        some (Aiur.AIR.BlockEmission.prefix results result)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.Emission.afterOps_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {incoming : Aiur.NativeAIR.Expr} {s : Aiur.G} (lookup : Nat)
+  {ops : Aiur.NativeAIR.OpEmitter.OpsEmission} {operations : Aiur.AIR.OpsEmission}
+  {control : Aiur.NativeAIR.BlockEmitter.Emission} {result : Aiur.AIR.BlockEmission},
+  Aiur.NativeAIR.OpEmitter.evalExpr values incoming = some s →
+    Aiur.NativeAIR.OpEmitter.OpsEmission.eval values ops = some operations →
+      Aiur.NativeAIR.BlockEmitter.Emission.eval values control = some result →
+        Aiur.NativeAIR.BlockEmitter.Emission.eval values
+            (Aiur.NativeAIR.BlockEmitter.Emission.afterOps incoming lookup ops control) =
+          some (Aiur.AIR.BlockEmission.afterOps s lookup operations result)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.join_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {inputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+    ∀ (column lookup : Nat) {emissions : List Aiur.NativeAIR.BlockEmitter.Emission}
+      {results : List Aiur.AIR.BlockEmission},
+      List.mapM (Aiur.NativeAIR.BlockEmitter.Emission.eval values) emissions = some results →
+        Aiur.NativeAIR.BlockEmitter.Emission.eval values
+            (Aiur.NativeAIR.BlockEmitter.join rows column lookup emissions) =
+          some (Aiur.AIR.joinBlockEmissions inputs column lookup results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.Emission.continued_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {branches continuation : Aiur.NativeAIR.BlockEmitter.Emission}
+  {first last : Aiur.AIR.BlockEmission} {equations : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  Aiur.NativeAIR.BlockEmitter.Emission.eval values branches = some first →
+    Aiur.NativeAIR.BlockEmitter.Emission.eval values continuation = some last →
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) equations = some results →
+        Aiur.NativeAIR.BlockEmitter.Emission.eval values (branches.continued equations continuation) =
+          some (first.continued results last)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.YieldExpr.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {yielded : Aiur.NativeAIR.BlockEmitter.YieldExpr} {s : Aiur.G}
+  {outputs : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalExpr values yielded.selector = some s →
+    Aiur.NativeAIR.OpEmitter.evalRows values yielded.values = some outputs →
+      Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values yielded = some (s, outputs)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.YieldExpr.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {yielded : Aiur.NativeAIR.BlockEmitter.YieldExpr}
+  {result : Aiur.G × Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values yielded = some result →
+    Aiur.NativeAIR.OpEmitter.evalExpr values yielded.selector = some result.fst ∧
+      Aiur.NativeAIR.OpEmitter.evalRows values yielded.values = some result.snd
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {returned : Aiur.NativeAIR.BlockEmitter.ReturnExpr} {s r : Aiur.G}
+  {inputs outputs : Array Aiur.G},
+  Aiur.NativeAIR.OpEmitter.evalExpr values returned.selector = some s →
+    Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.inputs = some inputs →
+      Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.outputs = some outputs →
+        Aiur.NativeAIR.OpEmitter.evalExpr values returned.rank = some r →
+          Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values returned =
+            some (s, { function := returned.function, inputs := inputs, outputs := outputs, rank := r })
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {returned : Aiur.NativeAIR.BlockEmitter.ReturnExpr}
+  {result : Aiur.G × Aiur.Bytecode.AIR.Call},
+  Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values returned = some result →
+    returned.function = result.snd.function ∧
+      Aiur.NativeAIR.OpEmitter.evalExpr values returned.selector = some result.fst ∧
+        Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.inputs = some result.snd.inputs ∧
+          Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.outputs = some result.snd.outputs ∧
+            Aiur.NativeAIR.OpEmitter.evalExpr values returned.rank = some result.snd.rank
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.BlockEmitter.ReturnExpr.message_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {returned : Aiur.NativeAIR.BlockEmitter.ReturnExpr}
+  {result : Aiur.G × Aiur.Bytecode.AIR.Call},
+  Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values returned = some result →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.message = some (Aiur.AIR.functionMessage result.snd)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.returned_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {s r : Aiur.G} {rows inputs outputs : Array Aiur.NativeAIR.RowExpr}
+  {a b c : Array Aiur.AIR.RowValue} (column lookup : Nat),
+  Aiur.NativeAIR.OpEmitter.evalExpr values incoming = some s →
+    Aiur.NativeAIR.OpEmitter.evalExpr values context.rank = some r →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some a →
+        Aiur.NativeAIR.OpEmitter.evalRows values inputs = some b →
+          Aiur.NativeAIR.OpEmitter.evalRows values outputs = some c →
+            Aiur.NativeAIR.BlockEmitter.Emission.eval values
+                (Aiur.NativeAIR.BlockEmitter.returned context incoming rows inputs outputs column lookup) =
+              some
+                { values := a, column := column, lookup := lookup,
+                  returns :=
+                    [(s,
+                        { function := context.function, inputs := Aiur.AIR.rowValues b, outputs := Aiur.AIR.rowValues c,
+                          rank := r })] }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.yielded_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {selector : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {rows outputs : Array Aiur.NativeAIR.RowExpr} {a b : Array Aiur.AIR.RowValue} (column lookup : Nat),
+  Aiur.NativeAIR.OpEmitter.evalExpr values selector = some s →
+    Aiur.NativeAIR.OpEmitter.evalRows values rows = some a →
+      Aiur.NativeAIR.OpEmitter.evalRows values outputs = some b →
+        Aiur.NativeAIR.BlockEmitter.Emission.eval values
+            (Aiur.NativeAIR.BlockEmitter.yielded selector rows outputs column lookup) =
+          some { values := a, column := column, lookup := lookup, yields := [(s, b)] }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.evalRows_getD_any
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {results : Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalRows values rows = some results →
+    ∀ (index : Nat),
+      Aiur.NativeAIR.RowExpr.Reflects values (rows[index]?.getD (Aiur.NativeAIR.RowExpr.konst 0))
+        (results[index]?.getD (Aiur.AIR.RowValue.konst 0))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.yieldValue_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {yielded : Aiur.NativeAIR.BlockEmitter.YieldExpr}
+  {result : Aiur.G × Array Aiur.AIR.RowValue},
+  Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values yielded = some result →
+    ∀ (index : Nat),
+      Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.BlockEmitter.yieldValue yielded index) =
+        some (result.fst * (Aiur.AIR.rowValues result.snd)[index]?.getD 0)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.yieldGate_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {yields : List Aiur.NativeAIR.BlockEmitter.YieldExpr}
+  {results : List (Aiur.G × Array Aiur.AIR.RowValue)},
+  List.mapM (Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values) yields = some results →
+    Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.BlockEmitter.yieldGate yields) =
+      some (Aiur.AIR.selectorSum (List.map Prod.fst results))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.mergeEquations_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {incoming : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  (column size : Nat) {yields : List Aiur.NativeAIR.BlockEmitter.YieldExpr}
+  {results : List (Aiur.G × Array Aiur.AIR.RowValue)},
+  Aiur.NativeAIR.OpEmitter.evalExpr values incoming = some s →
+    List.mapM (Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values) yields = some results →
+      (∀ (index : Nat),
+          index < size →
+            (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[column + index]? =
+              some (row (column + index))) →
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)
+            (Aiur.NativeAIR.BlockEmitter.mergeEquations incoming column size yields) =
+          some (Aiur.AIR.mergeEquations row s column size results)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.yields_size
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {yields : List Aiur.NativeAIR.BlockEmitter.YieldExpr}
+  {results : List (Aiur.G × Array Aiur.AIR.RowValue)},
+  List.mapM (Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values) yields = some results →
+    ∀ (size : Nat), (yields.all fun part => part.values.size == size) = results.all fun part => part.snd.size == size
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.caseEquation_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {entry : Aiur.NativeAIR.Expr} {s : Aiur.G} {matched : Aiur.NativeAIR.RowExpr}
+  {value : Aiur.AIR.RowValue},
+  Aiur.NativeAIR.OpEmitter.evalExpr values entry = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values matched value →
+      ∀ (branch : Aiur.G),
+        Aiur.NativeAIR.OpEmitter.evalExpr values (Aiur.NativeAIR.BlockEmitter.caseEquation entry matched branch) =
+          some (s * (value.value - branch))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.defaultEquations_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {entry : Aiur.NativeAIR.Expr} {s : Aiur.G}
+  {matched : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue} (column : Nat)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)),
+  Aiur.NativeAIR.OpEmitter.evalExpr values entry = some s →
+    Aiur.NativeAIR.RowExpr.Reflects values matched value →
+      (∀ (index : Nat),
+          index < branches.size →
+            (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[column + index]? =
+              some (row (column + index))) →
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)
+            (Aiur.NativeAIR.BlockEmitter.defaultEquations entry matched column branches) =
+          some
+            (List.mapIdx (fun index pair => s * ((value.value - pair.fst) * row (column + index) - 1)) branches.toList)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.fold_max_start
+∀ {α : Type u_1} (measure : α → Nat) (items : List α) (start : Nat),
+  start ≤ List.foldl (fun current item => max current (measure item)) start items
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.BlockEmitter.fold_max_member
+∀ {α : Type u_1} (measure : α → Nat) {items : List α} {item : α},
+  item ∈ items → ∀ (start : Nat), measure item ≤ List.foldl (fun current item => max current (measure item)) start items
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.BlockEmitter.emitCtrl_match
+∀ (selectors : Array Aiur.NativeAIR.Expr) (context : Aiur.NativeAIR.BlockEmitter.Context)
+  (incoming : Aiur.NativeAIR.Expr) (rows : Array Aiur.NativeAIR.RowExpr) (column lookup index : Nat)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block),
+  Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup
+      (Aiur.Bytecode.Ctrl.match index branches fallback) =
+    do
+    let matched ← rows[index]?
+    Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitCtrl_matchContinue
+∀ (selectors : Array Aiur.NativeAIR.Expr) (context : Aiur.NativeAIR.BlockEmitter.Context)
+  (incoming : Aiur.NativeAIR.Expr) (rows : Array Aiur.NativeAIR.RowExpr) (column lookup index : Nat)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block) (size aux slots : Nat)
+  (continuation : Aiur.Bytecode.Block),
+  Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup
+      (Aiur.Bytecode.Ctrl.matchContinue index branches fallback size aux slots continuation) =
+    do
+    let matched ← rows[index]?
+    let joined ← Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback
+    Aiur.NativeAIR.BlockEmitter.continueRow selectors context incoming rows size continuation joined
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.branchRows_invariants
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {matched : Aiur.NativeAIR.RowExpr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  {branches : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block}
+  {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback =
+        some emission →
+      Aiur.NativeAIR.OpEmitter.Normal emission.values ∧ column ≤ emission.column
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitCtrl_invariants
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  (ctrl : Aiur.Bytecode.Ctrl) {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup ctrl = some emission →
+      Aiur.NativeAIR.OpEmitter.Normal emission.values ∧ column ≤ emission.column
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitBlock_invariants
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  (block : Aiur.Bytecode.Block) {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.BlockEmitter.emitBlock selectors context incoming rows column lookup block = some emission →
+      Aiur.NativeAIR.OpEmitter.Normal emission.values ∧ column ≤ emission.column
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.list_mapM_refine_mem
+∀ {α β γ : Type} {first : α → Option β} {second : α → Option γ} {evaluate : β → Option γ} {inputs : List α}
+  {outputs : List β},
+  List.mapM first inputs = some outputs →
+    (∀ (input : α),
+        input ∈ inputs →
+          ∀ (output : β),
+            output ∈ outputs →
+              first input = some output → ∃ value, second input = some value ∧ evaluate output = some value) →
+      ∃ values, List.mapM second inputs = some values ∧ List.mapM evaluate outputs = some values
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.caseRows_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {selectors : Array Aiur.NativeAIR.Expr}
+  {selected : Nat → Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context} (rank : Aiur.G)
+  {matched : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue} {rows : Array Aiur.NativeAIR.RowExpr}
+  {inputs : Array Aiur.AIR.RowValue} (column lookup limit : Nat) {branches : Array (Aiur.G × Aiur.Bytecode.Block)}
+  {emissions : List Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selected →
+    Aiur.NativeAIR.RowExpr.Reflects values matched value →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          List.mapM (Aiur.NativeAIR.BlockEmitter.caseRow selectors context matched rows column lookup) branches.toList =
+              some emissions →
+            (∀ (emission : Aiur.NativeAIR.BlockEmitter.Emission), emission ∈ emissions → emission.column ≤ limit) →
+              (∀ (index : Nat),
+                  column ≤ index →
+                    index < limit →
+                      (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                        some (row index)) →
+                (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+                    pair ∈ branches.toList →
+                      Aiur.NativeAIR.BlockEmitter.BlockReflects values row selectors selected context rank pair.snd) →
+                  ∃ results,
+                    List.mapM
+                          (Aiur.Bytecode.caseRow row selected (context.valued rank) value.value inputs column lookup)
+                          branches.toList =
+                        some results ∧
+                      List.mapM (Aiur.NativeAIR.BlockEmitter.Emission.eval values) emissions = some results
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.defaultRow_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {selectors : Array Aiur.NativeAIR.Expr}
+  {selected : Nat → Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context} (rank : Aiur.G)
+  {matched : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue} {rows : Array Aiur.NativeAIR.RowExpr}
+  {inputs : Array Aiur.AIR.RowValue} (column lookup limit : Nat) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  {fallback : Option Aiur.Bytecode.Block} {emissions : List Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selected →
+    Aiur.NativeAIR.RowExpr.Reflects values matched value →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.BlockEmitter.defaultRow selectors context matched rows column lookup branches fallback =
+              some emissions →
+            (∀ (emission : Aiur.NativeAIR.BlockEmitter.Emission), emission ∈ emissions → emission.column ≤ limit) →
+              (∀ (index : Nat),
+                  column ≤ index →
+                    index < limit →
+                      (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                        some (row index)) →
+                (∀ (block : Aiur.Bytecode.Block),
+                    block ∈ fallback.toList →
+                      Aiur.NativeAIR.BlockEmitter.BlockReflects values row selectors selected context rank block) →
+                  ∃ results,
+                    Aiur.Bytecode.defaultRow row selected (context.valued rank) value.value inputs column lookup
+                          branches fallback =
+                        some results ∧
+                      List.mapM (Aiur.NativeAIR.BlockEmitter.Emission.eval values) emissions = some results
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.branchRows_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {selectors : Array Aiur.NativeAIR.Expr}
+  {selected : Nat → Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context} (rank : Aiur.G)
+  {matched : Aiur.NativeAIR.RowExpr} {value : Aiur.AIR.RowValue} {rows : Array Aiur.NativeAIR.RowExpr}
+  {inputs : Array Aiur.AIR.RowValue} {column lookup : Nat} {branches : Array (Aiur.G × Aiur.Bytecode.Block)}
+  {fallback : Option Aiur.Bytecode.Block} {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selected →
+    Aiur.NativeAIR.RowExpr.Reflects values matched value →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback =
+              some emission →
+            (∀ (index : Nat),
+                column ≤ index →
+                  index < emission.column →
+                    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                      some (row index)) →
+              (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+                  pair ∈ branches.toList →
+                    Aiur.NativeAIR.BlockEmitter.BlockReflects values row selectors selected context rank pair.snd) →
+                (∀ (block : Aiur.Bytecode.Block),
+                    block ∈ fallback.toList →
+                      Aiur.NativeAIR.BlockEmitter.BlockReflects values row selectors selected context rank block) →
+                  ∃ result,
+                    Aiur.Bytecode.branchRows row selected (context.valued rank) value.value inputs column lookup
+                          branches fallback =
+                        some result ∧
+                      Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.continueRow_column
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {size : Nat}
+  {continuation : Aiur.Bytecode.Block} {joined emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.Normal rows →
+    Aiur.NativeAIR.BlockEmitter.continueRow selectors context incoming rows size continuation joined = some emission →
+      joined.column ≤ emission.column
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.advice_absolute_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) (column size : Nat),
+  (∀ (index : Nat),
+      index < size →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[column + index]? =
+          some (row (column + index))) →
+    Aiur.NativeAIR.OpEmitter.evalRows values (Aiur.NativeAIR.OpEmitter.advice column size) =
+      some (Aiur.AIR.rowAdvice row column size)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.continueRow_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {selectors : Array Aiur.NativeAIR.Expr}
+  {selected : Nat → Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context} (rank : Aiur.G)
+  {incoming : Aiur.NativeAIR.Expr} {s : Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr} {inputs : Array Aiur.AIR.RowValue}
+  (size : Nat) (continuation : Aiur.Bytecode.Block) {joined emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  {branches : Aiur.AIR.BlockEmission},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selected →
+    Aiur.NativeAIR.OpEmitter.evalExpr values incoming = some s →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.BlockEmitter.Emission.eval values joined = some branches →
+            Aiur.NativeAIR.BlockEmitter.continueRow selectors context incoming rows size continuation joined =
+                some emission →
+              (∀ (index : Nat),
+                  joined.column ≤ index →
+                    index < emission.column →
+                      (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                        some (row index)) →
+                Aiur.NativeAIR.BlockEmitter.BlockReflects values row selectors selected context rank continuation →
+                  ∃ result,
+                    Aiur.Bytecode.continueRow row selected (context.valued rank) s inputs size continuation branches =
+                        some result ∧
+                      Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.ctrl_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selectors : Array Aiur.NativeAIR.Expr}
+  {selected : Nat → Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context} {rank : Aiur.G},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selected →
+    Aiur.NativeAIR.OpEmitter.evalExpr values context.rank = some rank →
+      ∀ (ctrl : Aiur.Bytecode.Ctrl),
+        Aiur.NativeAIR.BlockEmitter.CtrlReflects values row selectors selected context rank ctrl
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.block_reflects
+∀ (values : Aiur.NativeAIR.Values Aiur.G) (row : Nat → Aiur.G) {selectors : Array Aiur.NativeAIR.Expr}
+  {selected : Nat → Aiur.G} {context : Aiur.NativeAIR.BlockEmitter.Context} {rank : Aiur.G},
+  Aiur.NativeAIR.BlockEmitter.SelectorReads values selectors selected →
+    Aiur.NativeAIR.OpEmitter.evalExpr values context.rank = some rank →
+      ∀ (block : Aiur.Bytecode.Block),
+        Aiur.NativeAIR.BlockEmitter.BlockReflects values row selectors selected context rank block
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.returnArgs_fold_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {returns : List Aiur.NativeAIR.BlockEmitter.ReturnExpr}
+  {results : List (Aiur.G × Aiur.Bytecode.AIR.Call)},
+  List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) returns = some results →
+    ∀ {initial : List Aiur.NativeAIR.Expr} {start : List Aiur.G},
+      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) initial = some start →
+        List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)
+            (List.foldl
+              (fun args returned =>
+                Aiur.NativeAIR.LookupEmitter.addArgs args
+                  (Aiur.NativeAIR.LookupEmitter.gateArgs branchless returned.selector returned.message))
+              initial returns) =
+          some
+            (List.foldl
+              (fun args part =>
+                Aiur.AIR.addMessages args
+                  (Aiur.AIR.gateMessage branchless part.fst (Aiur.AIR.functionMessage part.snd)))
+              start results)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.returnArgs_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {returns : List Aiur.NativeAIR.BlockEmitter.ReturnExpr}
+  {results : List (Aiur.G × Aiur.Bytecode.AIR.Call)},
+  List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) returns = some results →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Aiur.NativeAIR.BlockEmitter.returnArgs branchless returns) =
+      some
+        (Aiur.AIR.slotMessage branchless (List.map (fun part => (part.fst, Aiur.AIR.functionMessage part.snd)) results))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.lookup_eval
+∀ (branchless : Bool) {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  {result : Aiur.AIR.BlockEmission},
+  Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result →
+    ∀ (slot : Nat),
+      Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+          (Aiur.NativeAIR.BlockEmitter.lookup branchless emission slot) =
+        some
+          (if slot = 0 then
+            (0,
+              Aiur.AIR.slotMessage branchless
+                (List.map (fun part => (part.fst, Aiur.AIR.functionMessage part.snd)) result.returns))
+          else
+            (Aiur.AIR.querySlotMultiplicity result.queries slot,
+              Aiur.AIR.slotMessage branchless (Aiur.AIR.querySlotParts result.queries slot)))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.selectorExprs_reads
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) (base count : Nat),
+  (∀ (index : Nat),
+      index < count →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[base + index]? =
+          some (row (base + index))) →
+    Aiur.NativeAIR.BlockEmitter.SelectorReads values (Aiur.NativeAIR.CircuitEmitter.selectorExprs base count)
+      fun index => row (base + index)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.Member.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {member : Aiur.NativeAIR.CircuitEmitter.Member}
+  {body : Aiur.AIR.BlockEmission},
+  Aiur.NativeAIR.BlockEmitter.Emission.eval values member.body = some body →
+    Aiur.NativeAIR.CircuitEmitter.Member.eval values member =
+      some
+        { functionIndex := member.functionIndex, function := member.function, selectorBase := member.selectorBase,
+          body := body }
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CircuitEmitter.Member.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {member : Aiur.NativeAIR.CircuitEmitter.Member}
+  {result : Aiur.AIR.MemberEmission},
+  Aiur.NativeAIR.CircuitEmitter.Member.eval values member = some result →
+    member.functionIndex = result.functionIndex ∧
+      member.function = result.function ∧
+        member.selectorBase = result.selectorBase ∧
+          Aiur.NativeAIR.BlockEmitter.Emission.eval values member.body = some result.body
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CircuitEmitter.selectorEquations_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) (layout : Aiur.Bytecode.FunctionLayout),
+  (∀ (index : Nat),
+      index < layout.selectors →
+        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[layout.inputSize + index]? =
+          some (row (layout.inputSize + index))) →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Aiur.NativeAIR.CircuitEmitter.selectorEquations layout) =
+      some
+        (List.map (fun index => Aiur.AIR.booleanConstraint (row (layout.inputSize + index)))
+          (List.range layout.selectors))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.evalFin_of
+∀ {size : Nat} {values : Aiur.NativeAIR.Values Aiur.G} {expressions : Fin size → Aiur.NativeAIR.Expr}
+  {results : Fin size → Aiur.G},
+  (∀ (index : Fin size), Aiur.NativeAIR.OpEmitter.evalExpr values (expressions index) = some (results index)) →
+    Aiur.NativeAIR.CircuitEmitter.evalFin values expressions = some results
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.evalFin_components
+∀ {size : Nat} {values : Aiur.NativeAIR.Values Aiur.G} {expressions : Fin size → Aiur.NativeAIR.Expr}
+  {results : Fin size → Aiur.G},
+  Aiur.NativeAIR.CircuitEmitter.evalFin values expressions = some results →
+    ∀ (index : Fin size), Aiur.NativeAIR.OpEmitter.evalExpr values (expressions index) = some (results index)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.Emission.eval_of
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.CircuitEmitter.Emission}
+  {result : Aiur.AIR.CircuitEmission},
+  List.mapM (Aiur.NativeAIR.CircuitEmitter.Member.eval values) emission.members = some result.members →
+    Aiur.NativeAIR.OpEmitter.evalExpr values emission.selector = some result.selector →
+      Aiur.NativeAIR.OpEmitter.evalExpr values emission.multiplicity = some result.multiplicity →
+        (∀ (index : Fin 6),
+            Aiur.NativeAIR.OpEmitter.evalExpr values (emission.rankBytes index) = some (result.rankBytes index)) →
+          emission.width = result.width →
+            emission.selectorStart = result.selectorStart →
+              emission.selectorCount = result.selectorCount →
+                emission.lookupCount = result.lookupCount →
+                  emission.branchless = result.branchless →
+                    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations →
+                      List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) emission.queries =
+                          some result.queries →
+                        List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) emission.returns =
+                            some result.returns →
+                          Aiur.NativeAIR.CircuitEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.Emission.eval_components
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.CircuitEmitter.Emission}
+  {result : Aiur.AIR.CircuitEmission},
+  Aiur.NativeAIR.CircuitEmitter.Emission.eval values emission = some result →
+    List.mapM (Aiur.NativeAIR.CircuitEmitter.Member.eval values) emission.members = some result.members ∧
+      Aiur.NativeAIR.OpEmitter.evalExpr values emission.selector = some result.selector ∧
+        Aiur.NativeAIR.OpEmitter.evalExpr values emission.multiplicity = some result.multiplicity ∧
+          (∀ (index : Fin 6),
+              Aiur.NativeAIR.OpEmitter.evalExpr values (emission.rankBytes index) = some (result.rankBytes index)) ∧
+            emission.width = result.width ∧
+              emission.selectorStart = result.selectorStart ∧
+                emission.selectorCount = result.selectorCount ∧
+                  emission.lookupCount = result.lookupCount ∧
+                    emission.branchless = result.branchless ∧
+                      List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations = some result.equations ∧
+                        List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) emission.queries =
+                            some result.queries ∧
+                          List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) emission.returns =
+                            some result.returns
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.Emission.lookup_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.CircuitEmitter.Emission}
+  {result : Aiur.AIR.CircuitEmission},
+  Aiur.NativeAIR.CircuitEmitter.Emission.eval values emission = some result →
+    ∀ (slot : Nat),
+      Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values (emission.lookup slot) =
+        some (result.lookup slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.Emission.lookups_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {emission : Aiur.NativeAIR.CircuitEmitter.Emission}
+  {result : Aiur.AIR.CircuitEmission},
+  Aiur.NativeAIR.CircuitEmitter.Emission.eval values emission = some result →
+    List.mapM (Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values) emission.lookups =
+      some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMember_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {rank : Aiur.NativeAIR.Expr} {r : Aiur.G}
+  {column lookup selectorBase : Nat} {program : Aiur.Bytecode.Toplevel} {functionIndex : Nat}
+  {member : Aiur.NativeAIR.CircuitEmitter.Member},
+  Aiur.NativeAIR.OpEmitter.evalExpr values rank = some r →
+    Aiur.NativeAIR.CircuitEmitter.emitMember rank column lookup selectorBase program functionIndex = some member →
+      (∀ (index : Nat),
+          index < member.readBound →
+            (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? = some (row index)) →
+        ∃ result,
+          Aiur.AIR.emitMember row r column lookup selectorBase program functionIndex = some result ∧
+            Aiur.NativeAIR.CircuitEmitter.Member.eval values member = some result ∧
+              Aiur.NativeAIR.OpEmitter.evalExpr values member.entry = some (Aiur.AIR.MemberEmission.entry row result)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMembers_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {rank : Aiur.NativeAIR.Expr} {r : Aiur.G}
+  (column lookup selectorBase : Nat) (program : Aiur.Bytecode.Toplevel) (indices : List Nat)
+  {members : List Aiur.NativeAIR.CircuitEmitter.Member},
+  Aiur.NativeAIR.OpEmitter.evalExpr values rank = some r →
+    Aiur.NativeAIR.CircuitEmitter.emitMembers rank column lookup selectorBase program indices = some members →
+      (∀ (member : Aiur.NativeAIR.CircuitEmitter.Member),
+          member ∈ members →
+            ∀ (index : Nat),
+              index < member.readBound →
+                (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                  some (row index)) →
+        ∃ results,
+          Aiur.AIR.emitMembers row r column lookup selectorBase program indices = some results ∧
+            List.mapM (Aiur.NativeAIR.CircuitEmitter.Member.eval values) members = some results ∧
+              List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)
+                  (List.map Aiur.NativeAIR.CircuitEmitter.Member.entry members) =
+                some (List.map (fun x => Aiur.AIR.MemberEmission.entry row x) results)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.circuitEmission_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) (circuit : Aiur.Bytecode.Circuit)
+  {members : List Aiur.NativeAIR.CircuitEmitter.Member} {results : List Aiur.AIR.MemberEmission},
+  List.mapM (Aiur.NativeAIR.CircuitEmitter.Member.eval values) members = some results →
+    List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (List.map Aiur.NativeAIR.CircuitEmitter.Member.entry members) =
+        some (List.map (fun x => Aiur.AIR.MemberEmission.entry row x) results) →
+      (∀ (index : Nat),
+          index < circuit.layout.inputSize + circuit.layout.selectors + 1 + 6 →
+            (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? = some (row index)) →
+        Aiur.NativeAIR.CircuitEmitter.Emission.eval values
+            (Aiur.NativeAIR.CircuitEmitter.circuitEmission circuit members) =
+          some (Aiur.AIR.circuitEmission row circuit results)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitCircuit_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) (program : Aiur.Bytecode.Toplevel)
+  (circuit : Aiur.Bytecode.Circuit) {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+  Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit = some emission →
+    (∀ (index : Nat),
+        index < emission.readBound →
+          (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? = some (row index)) →
+      ∃ result,
+        Aiur.Bytecode.Circuit.emitRow row program circuit = some result ∧
+          Aiur.NativeAIR.CircuitEmitter.Emission.eval values emission = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.equations_vanish
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {expressions : List Aiur.NativeAIR.Expr} {results : List Aiur.G},
+  List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) expressions = some results →
+    (Aiur.NativeAIR.Compiler.ExprsVanish Aiur.NativeAIR.goldilocksOps values expressions ↔
+      ∀ (result : Aiur.G), result ∈ results → result = 0)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.compileCircuit_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} (row : Nat → Aiur.G) {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+      {compiled : Aiur.NativeAIR.CircuitEmitter.Compiled},
+      Aiur.NativeAIR.CircuitEmitter.compileCircuit widths program circuit = some compiled →
+        (∀ (index : Nat),
+            index < compiled.emission.readBound →
+              (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? = some (row index)) →
+          ∃ result buffer,
+            Aiur.Bytecode.Circuit.emitRow row program circuit = some result ∧
+              compiled.base.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+                (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer compiled.base.graph.zeros ↔
+                    ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0) ∧
+                  List.mapM (Aiur.NativeAIR.readLookup buffer) compiled.base.graph.lookups =
+                    some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.selectedDegree_initial
+∀ (degrees indices : Array Nat) (initial : Nat),
+  Aiur.Bytecode.selectedDegree degrees indices initial = max initial (Aiur.Bytecode.selectedDegree degrees indices 0)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.selectedDegree_append
+∀ (degrees left right : Array Nat) (initial : Nat),
+  Aiur.Bytecode.selectedDegree degrees (left ++ right) initial =
+    max (Aiur.Bytecode.selectedDegree degrees left initial) (Aiur.Bytecode.selectedDegree degrees right 0)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.getDegree_list
+∀ (indices : List Aiur.Bytecode.ValIdx) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  StateT.run (List.mapM Aiur.Concrete.Bytecode.getDegree indices) initial =
+    (List.map (fun i => initial.degrees[i]?.getD 0) indices, initial)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.getDegree_array
+∀ (indices : Array Aiur.Bytecode.ValIdx),
+  Array.mapM Aiur.Concrete.Bytecode.getDegree indices = fun initial =>
+    pure (Array.map (fun i => initial.degrees[i]?.getD 0) indices, initial)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.opLayout_allocation
+∀ (op : Aiur.Bytecode.Op) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.degrees =
+      initial.degrees ++ (Aiur.Bytecode.Op.allocation initial.degrees op).degrees ∧
+    (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.functionLayout.auxiliaries =
+      initial.functionLayout.auxiliaries + (Aiur.Bytecode.Op.allocation initial.degrees op).auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.RowExpr.ZeroConstant.konst
+∀ (value : Aiur.G), (Aiur.NativeAIR.RowExpr.konst value).ZeroConstant
+AXIOMS []
+ROOT Aiur.NativeAIR.RowExpr.ZeroConstant.variable
+∀ (column : Aiur.NativeAIR.ColRef), (Aiur.NativeAIR.RowExpr.variable column).ZeroConstant
+AXIOMS []
+ROOT Aiur.NativeAIR.RowExpr.ZeroConstant.add
+∀ {left right : Aiur.NativeAIR.RowExpr}, left.ZeroConstant → right.ZeroConstant → (left.add right).ZeroConstant
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.RowExpr.ZeroConstant.sub
+∀ {left right : Aiur.NativeAIR.RowExpr}, left.ZeroConstant → right.ZeroConstant → (left.sub right).ZeroConstant
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.RowExpr.ZeroConstant.mul
+∀ {left right : Aiur.NativeAIR.RowExpr}, left.ZeroConstant → right.ZeroConstant → (left.mul right).ZeroConstant
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.empty
+Aiur.NativeAIR.OpEmitter.DegreeValid #[]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.singleton
+∀ {row : Aiur.NativeAIR.RowExpr}, row.ZeroConstant → Aiur.NativeAIR.OpEmitter.DegreeValid #[row]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.append
+∀ {left right : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.DegreeValid left →
+    Aiur.NativeAIR.OpEmitter.DegreeValid right → Aiur.NativeAIR.OpEmitter.DegreeValid (left ++ right)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.push
+∀ {rows : Array Aiur.NativeAIR.RowExpr} {row : Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows → row.ZeroConstant → Aiur.NativeAIR.OpEmitter.DegreeValid (rows.push row)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.read
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    ∀ {index : Nat} {row : Aiur.NativeAIR.RowExpr}, rows[index]? = some row → row.ZeroConstant
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.getD
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    ∀ (index : Nat), (rows[index]?.getD (Aiur.NativeAIR.RowExpr.konst 0)).ZeroConstant
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.DegreeValid.select
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    ∀ {indices : Array Nat} {selected : Array Aiur.NativeAIR.RowExpr},
+      Aiur.NativeAIR.OpEmitter.select rows indices = some selected → Aiur.NativeAIR.OpEmitter.DegreeValid selected
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.advice_degreeValid
+∀ (first count : Nat), Aiur.NativeAIR.OpEmitter.DegreeValid (Aiur.NativeAIR.OpEmitter.advice first count)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packFour_degreeValid
+∀ (bytes : Fin 4 → Aiur.NativeAIR.RowExpr),
+  (∀ (index : Fin 4), (bytes index).ZeroConstant) → (Aiur.NativeAIR.OpEmitter.packFour bytes).ZeroConstant
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.readWord_degreeValid
+∀ {rows : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    ∀ {indices : Array Nat} {word : Aiur.NativeAIR.RowExpr},
+      Aiur.NativeAIR.OpEmitter.readWord rows indices = some word → word.ZeroConstant
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.fromScalar_degreeValid
+∀ {scalar : Aiur.NativeAIR.ScalarEmission},
+  scalar.output.ZeroConstant → Aiur.NativeAIR.OpEmitter.DegreeValid (Aiur.NativeAIR.OpEmitter.fromScalar scalar).outputs
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitMul_degreeValid
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) {left right : Aiur.NativeAIR.RowExpr},
+  left.ZeroConstant → right.ZeroConstant → (Aiur.NativeAIR.emitMul selector first left right).output.ZeroConstant
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitEqZero_degreeValid
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) (input : Aiur.NativeAIR.RowExpr),
+  (Aiur.NativeAIR.emitEqZero selector first input).output.ZeroConstant
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_degreeValid
+∀ (first : Nat) (kind : Aiur.AIR.Byte2Kind) (left right : Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.DegreeValid (Aiur.NativeAIR.OpEmitter.emitByte2 first kind left right).outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitWordSum_degreeValid
+∀ (first : Nat) {sum : Aiur.NativeAIR.RowExpr},
+  sum.ZeroConstant → Aiur.NativeAIR.OpEmitter.DegreeValid (Aiur.NativeAIR.OpEmitter.emitWordSum first sum).outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitU32LessThan_degreeValid
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) (left right : Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.DegreeValid (Aiur.NativeAIR.OpEmitter.emitU32LessThan selector first left right).outputs
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_degreeValid
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte1Kind) (index : Nat)
+  {rows : Array Aiur.NativeAIR.RowExpr} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op index) rows = some emission →
+    Aiur.NativeAIR.OpEmitter.DegreeValid emission.outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_degreeValid
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte2Kind) (a b : Nat)
+  {rows : Array Aiur.NativeAIR.RowExpr} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op a b) rows = some emission →
+    Aiur.NativeAIR.OpEmitter.DegreeValid emission.outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_degreeValid
+∀ {selector rank : Aiur.NativeAIR.Expr} {first : Nat} {op : Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission →
+      Aiur.NativeAIR.OpEmitter.DegreeValid emission.outputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_degreeValid
+∀ {selector rank : Aiur.NativeAIR.Expr} {ops : List Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {column : Nat} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.emitOps selector rank ops rows column = some emission →
+      Aiur.NativeAIR.OpEmitter.DegreeValid emission.values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitEqZero_allocation
+∀ (selector : Aiur.NativeAIR.Expr) (first : Nat) {input : Aiur.NativeAIR.RowExpr},
+  input.ZeroConstant →
+    ((Aiur.NativeAIR.emitEqZero selector first input).used,
+        (Aiur.NativeAIR.emitEqZero selector first input).output.degree) =
+      if input.degree = 0 then (0, 0) else (2, 1)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.rowDegrees_empty
+Aiur.NativeAIR.OpEmitter.rowDegrees #[] = #[]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rowDegrees_append
+∀ (left right : Array Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.rowDegrees (left ++ right) =
+    Aiur.NativeAIR.OpEmitter.rowDegrees left ++ Aiur.NativeAIR.OpEmitter.rowDegrees right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rowDegrees_push
+∀ (rows : Array Aiur.NativeAIR.RowExpr) (row : Aiur.NativeAIR.RowExpr),
+  Aiur.NativeAIR.OpEmitter.rowDegrees (rows.push row) = (Aiur.NativeAIR.OpEmitter.rowDegrees rows).push row.degree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rowDegrees_singleton
+∀ (row : Aiur.NativeAIR.RowExpr), Aiur.NativeAIR.OpEmitter.rowDegrees #[row] = #[row.degree]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rowDegrees_getD
+∀ (rows : Array Aiur.NativeAIR.RowExpr) (index : Nat),
+  (Aiur.NativeAIR.OpEmitter.rowDegrees rows)[index]?.getD 0 =
+    (rows[index]?.getD (Aiur.NativeAIR.RowExpr.konst 0)).degree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.rowDegrees_read
+∀ {rows : Array Aiur.NativeAIR.RowExpr} {index : Nat} {row : Aiur.NativeAIR.RowExpr},
+  rows[index]? = some row → (Aiur.NativeAIR.OpEmitter.rowDegrees rows)[index]?.getD 0 = row.degree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.select_degrees
+∀ {rows : Array Aiur.NativeAIR.RowExpr} {indices : Array Nat} {selected : Array Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.select rows indices = some selected →
+    Array.map (fun index => (Aiur.NativeAIR.OpEmitter.rowDegrees rows)[index]?.getD 0) indices =
+      Aiur.NativeAIR.OpEmitter.rowDegrees selected
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.advice_degrees
+∀ (first count : Nat),
+  Aiur.NativeAIR.OpEmitter.rowDegrees (Aiur.NativeAIR.OpEmitter.advice first count) = Array.replicate count 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.packFour_degree
+∀ (bytes : Fin 4 → Aiur.NativeAIR.RowExpr),
+  (Aiur.NativeAIR.OpEmitter.packFour bytes).degree =
+    Array.foldl Nat.max 0 (Aiur.NativeAIR.OpEmitter.rowDegrees (Array.ofFn bytes))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.readWord_degree
+∀ {rows : Array Aiur.NativeAIR.RowExpr} {indices : Array Nat} {word : Aiur.NativeAIR.RowExpr},
+  Aiur.NativeAIR.OpEmitter.readWord rows indices = some word →
+    word.degree = Aiur.Bytecode.selectedDegree (Aiur.NativeAIR.OpEmitter.rowDegrees rows) indices 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitAdvice_allocation
+∀ (first count : Nat),
+  (Aiur.NativeAIR.OpEmitter.emitAdvice first count).allocation = Aiur.Bytecode.OpAllocation.advice count
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitWordSum_allocation
+∀ (first : Nat) (sum : Aiur.NativeAIR.RowExpr),
+  (Aiur.NativeAIR.OpEmitter.emitWordSum first sum).allocation =
+    { degrees := (Array.replicate 4 1).push (max sum.degree 1), auxiliaries := 4 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte1_dispatch_allocation
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte1Kind) (index : Nat)
+  {rows : Array Aiur.NativeAIR.RowExpr} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op index) rows = some emission →
+    emission.allocation = Aiur.Bytecode.Op.allocation (Aiur.NativeAIR.OpEmitter.rowDegrees rows) (kind.op index)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitByte2_dispatch_allocation
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (kind : Aiur.AIR.Byte2Kind) (a b : Nat)
+  {rows : Array Aiur.NativeAIR.RowExpr} {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.emitOp selector rank first (kind.op a b) rows = some emission →
+    emission.allocation = Aiur.Bytecode.Op.allocation (Aiur.NativeAIR.OpEmitter.rowDegrees rows) (kind.op a b)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_allocation
+∀ {selector rank : Aiur.NativeAIR.Expr} {first : Nat} {op : Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission →
+      emission.allocation = Aiur.Bytecode.Op.allocation (Aiur.NativeAIR.OpEmitter.rowDegrees rows) op
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_layout
+∀ {selector rank : Aiur.NativeAIR.Expr} {first : Nat} {op : Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {emission : Aiur.NativeAIR.OpEmitter.Emission} (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.rowDegrees rows = initial.degrees →
+      Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission →
+        (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.degrees =
+            Aiur.NativeAIR.OpEmitter.rowDegrees (rows ++ emission.outputs) ∧
+          (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.functionLayout.auxiliaries =
+            initial.functionLayout.auxiliaries + emission.used
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_fold_layout
+∀ {selector rank : Aiur.NativeAIR.Expr} {ops : List Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {column : Nat} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission} (initial : Aiur.Concrete.Bytecode.LayoutMState)
+  (base : Nat),
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.rowDegrees rows = initial.degrees →
+      column = base + initial.functionLayout.auxiliaries →
+        Aiur.NativeAIR.OpEmitter.emitOps selector rank ops rows column = some emission →
+          (StateT.run (List.foldlM (fun x op => Aiur.Concrete.Bytecode.opLayout op) () ops) initial).snd.degrees =
+              Aiur.NativeAIR.OpEmitter.rowDegrees emission.values ∧
+            emission.column =
+              base +
+                (StateT.run (List.foldlM (fun x op => Aiur.Concrete.Bytecode.opLayout op) () ops)
+                        initial).snd.functionLayout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_layout
+∀ {selector rank : Aiur.NativeAIR.Expr} {ops : Array Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {column : Nat} {emission : Aiur.NativeAIR.OpEmitter.OpsEmission} (initial : Aiur.Concrete.Bytecode.LayoutMState)
+  (base : Nat),
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.rowDegrees rows = initial.degrees →
+      column = base + initial.functionLayout.auxiliaries →
+        Aiur.NativeAIR.OpEmitter.emitOps selector rank ops.toList rows column = some emission →
+          (StateT.run (Array.forM Aiur.Concrete.Bytecode.opLayout ops) initial).snd.degrees =
+              Aiur.NativeAIR.OpEmitter.rowDegrees emission.values ∧
+            emission.column =
+              base +
+                (StateT.run (Array.forM Aiur.Concrete.Bytecode.opLayout ops) initial).snd.functionLayout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.allocationBranchStep_degrees
+∀ (shared : Aiur.Concrete.Bytecode.SharedData) (degrees : Array Nat) (acc : Aiur.Concrete.Bytecode.SharedData)
+  (block : Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc block) initial).snd.degrees = degrees
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.allocationBranchStep_column
+∀ (shared : Aiur.Concrete.Bytecode.SharedData) (degrees : Array Nat) (acc : Aiur.Concrete.Bytecode.SharedData)
+  (block : Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState) (base column : Nat),
+  initial.degrees = degrees →
+    (∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+        state.degrees = degrees →
+          state.functionLayout.auxiliaries = shared.auxiliaries →
+            column =
+              base + (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) state).snd.functionLayout.auxiliaries) →
+      base +
+          (StateT.run (Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc block) initial).fst.auxiliaries =
+        max (base + acc.auxiliaries) column
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.allocationBranchFold
+∀ {α β : Type} {items : List α} {emissions : List β} (blockOf : α → Aiur.Bytecode.Block) (measure : β → Nat)
+  (shared : Aiur.Concrete.Bytecode.SharedData) (degrees : Array Nat) (base : Nat),
+  List.Forall₂
+      (fun item emission =>
+        ∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+          state.degrees = degrees →
+            state.functionLayout.auxiliaries = shared.auxiliaries →
+              measure emission =
+                base +
+                  (StateT.run (Aiur.Concrete.Bytecode.blockLayout (blockOf item)) state).snd.functionLayout.auxiliaries)
+      items emissions →
+    ∀ (acc : Aiur.Concrete.Bytecode.SharedData) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+      initial.degrees = degrees →
+        (StateT.run
+                  (List.foldlM
+                    (fun acc item => Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc (blockOf item)) acc
+                    items)
+                  initial).snd.degrees =
+            degrees ∧
+          base +
+              (StateT.run
+                    (List.foldlM
+                      (fun acc item => Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc (blockOf item))
+                      acc items)
+                    initial).fst.auxiliaries =
+            List.foldl (fun current emission => max current (measure emission)) (base + acc.auxiliaries) emissions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.allocationBranchLoop
+∀ (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (shared : Aiur.Concrete.Bytecode.SharedData) (degrees : Array Nat),
+  Array.foldlM (fun acc pair => Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc pair.val.snd) shared
+      branches.attach =
+    List.foldlM (fun acc pair => Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc pair.snd) shared
+      branches.toList
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.matchLayout_allocation
+∀ {β : Type} (index : Aiur.Bytecode.ValIdx) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  (fallback : Option Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState) (base : Nat)
+  (measure : β → Nat) {cases defaults : List β},
+  List.Forall₂
+      (fun pair emission =>
+        ∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+          state.degrees = initial.degrees →
+            state.functionLayout.auxiliaries = initial.functionLayout.auxiliaries →
+              measure emission =
+                base + (StateT.run (Aiur.Concrete.Bytecode.blockLayout pair.snd) state).snd.functionLayout.auxiliaries)
+      branches.toList cases →
+    List.Forall₂
+        (fun block emission =>
+          ∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+            state.degrees = initial.degrees →
+              state.functionLayout.auxiliaries = initial.functionLayout.auxiliaries + branches.size →
+                measure emission =
+                  base + (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) state).snd.functionLayout.auxiliaries)
+        fallback.toList defaults →
+      (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback))
+                initial).snd.degrees =
+          initial.degrees ∧
+        base +
+            (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback))
+                    initial).snd.functionLayout.auxiliaries =
+          List.foldl (fun current emission => max current (measure emission))
+            (base + initial.functionLayout.auxiliaries) (cases ++ defaults)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.ctrlLayout_continue
+∀ (index : Aiur.Bytecode.ValIdx) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  (fallback : Option Aiur.Bytecode.Block) (size aux slots : Nat) (continuation : Aiur.Bytecode.Block),
+  Aiur.Concrete.Bytecode.ctrlLayout
+      (Aiur.Bytecode.Ctrl.matchContinue index branches fallback size aux slots continuation) =
+    do
+    Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries size
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate size 1)
+    Aiur.Concrete.Bytecode.blockLayout continuation
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.branchRows_values
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {matched : Aiur.NativeAIR.RowExpr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  {branches : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block}
+  {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback =
+      some emission →
+    emission.values = rows
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitCtrl_degreeValid
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  (ctrl : Aiur.Bytecode.Ctrl) {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup ctrl = some emission →
+      Aiur.NativeAIR.OpEmitter.DegreeValid emission.values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitBlock_degreeValid
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  (block : Aiur.Bytecode.Block) {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.BlockEmitter.emitBlock selectors context incoming rows column lookup block = some emission →
+      Aiur.NativeAIR.OpEmitter.DegreeValid emission.values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.branchRows_layout
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {matched : Aiur.NativeAIR.RowExpr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  {branches : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block}
+  {emission : Aiur.NativeAIR.BlockEmitter.Emission} (index : Nat) (initial : Aiur.Concrete.Bytecode.LayoutMState)
+  (base : Nat),
+  Aiur.NativeAIR.OpEmitter.rowDegrees rows = initial.degrees →
+    column = base + initial.functionLayout.auxiliaries →
+      Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback =
+          some emission →
+        (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+            pair ∈ branches.toList →
+              ∀ (entry : Aiur.NativeAIR.Expr) (result : Aiur.NativeAIR.BlockEmitter.Emission)
+                (state : Aiur.Concrete.Bytecode.LayoutMState),
+                Aiur.NativeAIR.OpEmitter.rowDegrees rows = state.degrees →
+                  column = base + state.functionLayout.auxiliaries →
+                    Aiur.NativeAIR.BlockEmitter.emitBlock selectors context entry rows column lookup pair.snd =
+                        some result →
+                      result.column =
+                        base +
+                          (StateT.run (Aiur.Concrete.Bytecode.blockLayout pair.snd)
+                                  state).snd.functionLayout.auxiliaries) →
+          (∀ (block : Aiur.Bytecode.Block),
+              fallback = some block →
+                ∀ (entry : Aiur.NativeAIR.Expr) (result : Aiur.NativeAIR.BlockEmitter.Emission)
+                  (state : Aiur.Concrete.Bytecode.LayoutMState),
+                  Aiur.NativeAIR.OpEmitter.rowDegrees rows = state.degrees →
+                    column + branches.size = base + state.functionLayout.auxiliaries →
+                      Aiur.NativeAIR.BlockEmitter.emitBlock selectors context entry rows (column + branches.size) lookup
+                            block =
+                          some result →
+                        result.column =
+                          base +
+                            (StateT.run (Aiur.Concrete.Bytecode.blockLayout block)
+                                    state).snd.functionLayout.auxiliaries) →
+            (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback))
+                      initial).snd.degrees =
+                Aiur.NativeAIR.OpEmitter.rowDegrees emission.values ∧
+              emission.column =
+                base +
+                  (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback))
+                          initial).snd.functionLayout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitCtrl_layout
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  (ctrl : Aiur.Bytecode.Ctrl) {emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  (initial : Aiur.Concrete.Bytecode.LayoutMState) (base : Nat),
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.rowDegrees rows = initial.degrees →
+      column = base + initial.functionLayout.auxiliaries →
+        Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup ctrl = some emission →
+          (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout ctrl) initial).snd.degrees =
+              Aiur.NativeAIR.OpEmitter.rowDegrees emission.values ∧
+            emission.column =
+              base + (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout ctrl) initial).snd.functionLayout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitBlock_layout
+∀ {selectors : Array Aiur.NativeAIR.Expr} {context : Aiur.NativeAIR.BlockEmitter.Context}
+  {incoming : Aiur.NativeAIR.Expr} {rows : Array Aiur.NativeAIR.RowExpr} {column lookup : Nat}
+  (block : Aiur.Bytecode.Block) {emission : Aiur.NativeAIR.BlockEmitter.Emission}
+  (initial : Aiur.Concrete.Bytecode.LayoutMState) (base : Nat),
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.rowDegrees rows = initial.degrees →
+      column = base + initial.functionLayout.auxiliaries →
+        Aiur.NativeAIR.BlockEmitter.emitBlock selectors context incoming rows column lookup block = some emission →
+          (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) initial).snd.degrees =
+              Aiur.NativeAIR.OpEmitter.rowDegrees emission.values ∧
+            emission.column =
+              base + (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) initial).snd.functionLayout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.opLayout_fixed
+∀ (op : Aiur.Bytecode.Op) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.functionLayout.inputSize =
+      initial.functionLayout.inputSize ∧
+    (StateT.run (Aiur.Concrete.Bytecode.opLayout op) initial).snd.functionLayout.selectors =
+      initial.functionLayout.selectors
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.opsLayout_fields
+∀ (ops : Array Aiur.Bytecode.Op) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  have final := (StateT.run (Array.forM Aiur.Concrete.Bytecode.opLayout ops) initial).snd.functionLayout;
+  final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors ∧ initial.functionLayout.auxiliaries ≤ final.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.allocationBranchStep_fields
+∀ (shared : Aiur.Concrete.Bytecode.SharedData) (degrees : Array Nat) (acc : Aiur.Concrete.Bytecode.SharedData)
+  (block : Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+      (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) state).snd.functionLayout.inputSize =
+          state.functionLayout.inputSize ∧
+        (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) state).snd.functionLayout.selectors =
+          state.functionLayout.selectors + block.controlCounts.leaves) →
+    have final := StateT.run (Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc block) initial;
+    final.snd.functionLayout.inputSize = initial.functionLayout.inputSize ∧
+      final.snd.functionLayout.selectors = initial.functionLayout.selectors + block.controlCounts.leaves ∧
+        acc.auxiliaries ≤ final.fst.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.allocationBranchFold_fields
+∀ {α : Type} (items : List α) (blockOf : α → Aiur.Bytecode.Block) (shared : Aiur.Concrete.Bytecode.SharedData)
+  (degrees : Array Nat) (acc : Aiur.Concrete.Bytecode.SharedData) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (∀ (item : α),
+      item ∈ items →
+        ∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+          (StateT.run (Aiur.Concrete.Bytecode.blockLayout (blockOf item)) state).snd.functionLayout.inputSize =
+              state.functionLayout.inputSize ∧
+            (StateT.run (Aiur.Concrete.Bytecode.blockLayout (blockOf item)) state).snd.functionLayout.selectors =
+              state.functionLayout.selectors + (blockOf item).controlCounts.leaves) →
+    have final :=
+      StateT.run
+        (List.foldlM (fun acc item => Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc (blockOf item)) acc
+          items)
+        initial;
+    final.snd.functionLayout.inputSize = initial.functionLayout.inputSize ∧
+      final.snd.functionLayout.selectors =
+          initial.functionLayout.selectors + (List.map (fun item => (blockOf item).controlCounts.leaves) items).sum ∧
+        acc.auxiliaries ≤ final.fst.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.matchLayout_fields
+∀ (index : Aiur.Bytecode.ValIdx) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  (fallback : Option Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+      pair ∈ branches.toList →
+        ∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+          (StateT.run (Aiur.Concrete.Bytecode.blockLayout pair.snd) state).snd.functionLayout.inputSize =
+              state.functionLayout.inputSize ∧
+            (StateT.run (Aiur.Concrete.Bytecode.blockLayout pair.snd) state).snd.functionLayout.selectors =
+              state.functionLayout.selectors + pair.snd.controlCounts.leaves) →
+    (∀ (block : Aiur.Bytecode.Block),
+        fallback = some block →
+          ∀ (state : Aiur.Concrete.Bytecode.LayoutMState),
+            (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) state).snd.functionLayout.inputSize =
+                state.functionLayout.inputSize ∧
+              (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) state).snd.functionLayout.selectors =
+                state.functionLayout.selectors + block.controlCounts.leaves) →
+      have final :=
+        (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback))
+              initial).snd.functionLayout;
+      final.inputSize = initial.functionLayout.inputSize ∧
+        final.selectors =
+            initial.functionLayout.selectors +
+              (Aiur.Bytecode.ControlCounts.sum (Aiur.Bytecode.branchControlCounts branches fallback)).leaves ∧
+          initial.functionLayout.auxiliaries ≤ final.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.ctrlLayout_fields
+∀ (ctrl : Aiur.Bytecode.Ctrl) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  have final := (StateT.run (Aiur.Concrete.Bytecode.ctrlLayout ctrl) initial).snd.functionLayout;
+  final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors + ctrl.controlCounts.leaves ∧
+      initial.functionLayout.auxiliaries ≤ final.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.blockLayout_fields
+∀ (block : Aiur.Bytecode.Block) (initial : Aiur.Concrete.Bytecode.LayoutMState),
+  have final := (StateT.run (Aiur.Concrete.Bytecode.blockLayout block) initial).snd.functionLayout;
+  final.inputSize = initial.functionLayout.inputSize ∧
+    final.selectors = initial.functionLayout.selectors + block.controlCounts.leaves ∧
+      initial.functionLayout.auxiliaries ≤ final.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.ctrlLayout_match_list
+∀ (index : Aiur.Bytecode.ValIdx) (branches : Array (Aiur.G × Aiur.Bytecode.Block))
+  (fallback : Option Aiur.Bytecode.Block),
+  Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback) = do
+    let shared ← Aiur.Concrete.Bytecode.getSharedData
+    let degrees ← Aiur.Concrete.Bytecode.getDegrees
+    let acc ←
+      List.foldlM (fun acc pair => Aiur.Concrete.Bytecode.allocationBranchStep shared degrees acc pair.snd) shared
+          branches.toList
+    have __do_jp : Aiur.Concrete.Bytecode.SharedData → Aiur.Concrete.Bytecode.LayoutM Unit := fun final =>
+      Aiur.Concrete.Bytecode.setSharedData final
+    match fallback with
+      | none => do
+        let final ← pure acc
+        __do_jp final
+      | some block => do
+        Aiur.Concrete.Bytecode.setSharedData shared
+        Aiur.Concrete.Bytecode.bumpAuxiliaries branches.size
+        Aiur.Concrete.Bytecode.blockLayout block
+        let used ← Aiur.Concrete.Bytecode.getSharedData
+        Aiur.Concrete.Bytecode.setDegrees degrees
+        let final ← pure (acc.maximals used)
+        __do_jp final
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.rewriteOp_layout
+∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) (op : Aiur.Bytecode.Op),
+  Aiur.Concrete.Bytecode.opLayout (Aiur.Bytecode.rewriteOp rename op) = Aiur.Concrete.Bytecode.opLayout op
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.matchLayout_rewrite
+∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) (index : Aiur.Bytecode.ValIdx)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block),
+  (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+      pair ∈ branches.toList →
+        Aiur.Concrete.Bytecode.blockLayout (Aiur.Bytecode.rewriteBlock rename pair.snd) =
+          Aiur.Concrete.Bytecode.blockLayout pair.snd) →
+    (∀ (block : Aiur.Bytecode.Block),
+        fallback = some block →
+          Aiur.Concrete.Bytecode.blockLayout (Aiur.Bytecode.rewriteBlock rename block) =
+            Aiur.Concrete.Bytecode.blockLayout block) →
+      Aiur.Concrete.Bytecode.ctrlLayout
+          (Aiur.Bytecode.Ctrl.match index
+            (Array.map
+              (fun x =>
+                match x with
+                | ⟨(tag, block), property⟩ => (tag, Aiur.Bytecode.rewriteBlock rename block))
+              branches.attach)
+            (Option.map (Aiur.Bytecode.rewriteBlock rename) fallback)) =
+        Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.Ctrl.match index branches fallback)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.rewriteCtrl_layout
+∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) (ctrl : Aiur.Bytecode.Ctrl),
+  Aiur.Concrete.Bytecode.ctrlLayout (Aiur.Bytecode.rewriteCtrl rename ctrl) = Aiur.Concrete.Bytecode.ctrlLayout ctrl
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Bytecode.rewriteBlock_layout
+∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) (block : Aiur.Bytecode.Block),
+  Aiur.Concrete.Bytecode.blockLayout (Aiur.Bytecode.rewriteBlock rename block) =
+    Aiur.Concrete.Bytecode.blockLayout block
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.functionsComputedLayout_empty
+Aiur.Bytecode.FunctionsComputedLayout #[]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.functionsComputedLayout_push
+∀ {functions : Array Aiur.Bytecode.Function} {function : Aiur.Bytecode.Function},
+  Aiur.Bytecode.FunctionsComputedLayout functions →
+    function.ComputedLayout → Aiur.Bytecode.FunctionsComputedLayout (functions.push function)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.ComputedLayout.auxiliaries
+∀ {function : Aiur.Bytecode.Function},
+  function.ComputedLayout →
+    function.layout.auxiliaries =
+      (StateT.run (Aiur.Concrete.Bytecode.blockLayout function.body)
+              (Aiur.Concrete.Bytecode.LayoutMState.new function.layout.inputSize)).snd.functionLayout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.ComputedLayout.reserved
+∀ {function : Aiur.Bytecode.Function}, function.ComputedLayout → 7 ≤ function.layout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.ComputedLayout.selectors
+∀ {function : Aiur.Bytecode.Function},
+  function.ComputedLayout → function.layout.selectors = function.body.controlCounts.leaves
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Function.compile_computedLayout
+∀ {layoutMap : Aiur.LayoutMap} {function : Aiur.Concrete.Function} {body : Aiur.Bytecode.Block}
+  {state : Aiur.Concrete.Bytecode.LayoutMState},
+  Aiur.Concrete.Function.compile layoutMap function = Except.ok (body, state) →
+    ∀ (entry constrained : Bool),
+      { body := body, layout := state.functionLayout, entry := entry, constrained := constrained }.ComputedLayout
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Concrete.Decls.toBytecode_computedLayout
+∀ {decls : Aiur.Concrete.Decls} {program : Aiur.Bytecode.Toplevel}
+  {names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx},
+  decls.toBytecode = Except.ok (program, names) → Aiur.Bytecode.FunctionsComputedLayout program.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Function.ComputedLayout.rewrite
+∀ {function : Aiur.Bytecode.Function},
+  function.ComputedLayout →
+    ∀ (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx),
+      { body := Aiur.Bytecode.rewriteBlock rename function.body, layout := function.layout, entry := function.entry,
+          constrained := function.constrained }.ComputedLayout
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.deduplicate_newFunctions_computedLayout
+∀ (functions : Array Aiur.Bytecode.Function) (classes : Array Nat) (canonical : Array Bool)
+  (rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsComputedLayout functions →
+    Aiur.Bytecode.FunctionsComputedLayout (Aiur.Bytecode.deduplicate_newFunctions functions classes canonical rename)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.deduplicateCandidate_computedLayout
+∀ (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.FunctionsComputedLayout program.deduplicateCandidate.fst.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.deduplicate_computedLayout
+∀ (program : Aiur.Bytecode.Toplevel),
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.FunctionsComputedLayout program.deduplicate.fst.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_computedLayout
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsComputedLayout raw.functions →
+    Aiur.Bytecode.FunctionsComputedLayout (Aiur.finishCompilation source raw names).bytecode.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_computedLayout
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled → Aiur.Bytecode.FunctionsComputedLayout compiled.bytecode.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.functions_computedLayout
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.Bytecode.FunctionsComputedLayout backend.compiled.bytecode.functions
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.merged_columnBound
+∀ (functions : Array Aiur.Bytecode.Function) (members : Array Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsComputedLayout functions →
+    0 < functions.size →
+      Aiur.Bytecode.MembersConstrained functions members →
+        Aiur.Bytecode.MembersColumnBound functions members
+          (Array.foldl
+            (fun acc index => if (index == members[0]!) = true then acc else acc.merge functions[index]!.layout)
+            functions[members[0]!]!.layout members)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.singletonCircuits_columnBound
+∀ (program : Aiur.Bytecode.Toplevel) (nameOf : Aiur.Bytecode.FunIdx → String),
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.CircuitsColumnBound program.functions (program.singletonCircuits nameOf)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.CompiledToplevel.groupFunctions_columnBound
+∀ {before after : Aiur.CompiledToplevel} {groups : Array (String × Array String)},
+  Aiur.Bytecode.FunctionsComputedLayout before.bytecode.functions →
+    0 < before.bytecode.functions.size →
+      Aiur.Bytecode.CircuitsColumnBound before.bytecode.functions before.bytecode.circuits →
+        before.groupFunctions groups = Except.ok after →
+          Aiur.Bytecode.CircuitsColumnBound after.bytecode.functions after.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.finishCompilation_columnBound
+∀ (source : Aiur.Source.Toplevel) (raw : Aiur.Bytecode.Toplevel) (names : Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx),
+  Aiur.Bytecode.FunctionsComputedLayout raw.functions →
+    Aiur.Bytecode.CircuitsColumnBound (Aiur.finishCompilation source raw names).bytecode.functions
+      (Aiur.finishCompilation source raw names).bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Source.Toplevel.compile_columnBound
+∀ {source : Aiur.Source.Toplevel} {compiled : Aiur.CompiledToplevel},
+  source.compile = Except.ok compiled →
+    Aiur.Bytecode.CircuitsColumnBound compiled.bytecode.functions compiled.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuits_columnBound
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.Bytecode.CircuitsColumnBound backend.compiled.bytecode.functions backend.compiled.bytecode.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMember_layout
+∀ {rank : Aiur.NativeAIR.Expr} {column lookup selectorBase base : Nat} {program : Aiur.Bytecode.Toplevel}
+  {functionIndex : Nat} {member : Aiur.NativeAIR.CircuitEmitter.Member},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    column = base + 7 →
+      Aiur.NativeAIR.CircuitEmitter.emitMember rank column lookup selectorBase program functionIndex = some member →
+        member.functionIndex = functionIndex ∧
+          program.functions[functionIndex]? = some member.function ∧
+            member.selectorBase = selectorBase ∧ member.body.column = base + member.function.layout.auxiliaries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMembers_layout
+∀ {rank : Aiur.NativeAIR.Expr} (column lookup selectorBase base : Nat) (program : Aiur.Bytecode.Toplevel)
+  (indices : List Nat) {members : List Aiur.NativeAIR.CircuitEmitter.Member},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    column = base + 7 →
+      Aiur.NativeAIR.CircuitEmitter.emitMembers rank column lookup selectorBase program indices = some members →
+        List.map Aiur.NativeAIR.CircuitEmitter.Member.functionIndex members = indices ∧
+          ∀ (member : Aiur.NativeAIR.CircuitEmitter.Member),
+            member ∈ members →
+              program.functions[member.functionIndex]? = some member.function ∧
+                member.body.column = base + member.function.layout.auxiliaries ∧
+                  member.selectorBase + member.function.layout.selectors ≤
+                    selectorBase + (List.map (fun part => part.function.layout.selectors) members).sum
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMembers_selectors
+∀ {rank : Aiur.NativeAIR.Expr} (column lookup selectorBase base : Nat) (program : Aiur.Bytecode.Toplevel)
+  (circuit : Aiur.Bytecode.Circuit) {members : List Aiur.NativeAIR.CircuitEmitter.Member},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    column = base + 7 →
+      Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+        Aiur.NativeAIR.CircuitEmitter.emitMembers rank column lookup selectorBase program circuit.members.toList =
+            some members →
+          (List.map (fun member => member.function.layout.selectors) members).sum ≤ circuit.layout.selectors
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitCircuit_readBound
+∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.MembersColumnBound program.functions circuit.members circuit.layout →
+      Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+        Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit = some emission →
+          emission.readBound ≤ circuit.layout.width
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.compileCircuit_readBound
+∀ {widths : Aiur.NativeAIR.GraphWidths} (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {compiled : Aiur.NativeAIR.CircuitEmitter.Compiled},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.MembersColumnBound program.functions circuit.members circuit.layout →
+      Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+        Aiur.NativeAIR.CircuitEmitter.compileCircuit widths program circuit = some compiled →
+          compiled.emission.readBound ≤ circuit.layout.width
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.compileCircuit_physical_reflects
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+      {compiled : Aiur.NativeAIR.CircuitEmitter.Compiled},
+      Aiur.Bytecode.FunctionsComputedLayout program.functions →
+        Aiur.Bytecode.MembersColumnBound program.functions circuit.members circuit.layout →
+          Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+            widths.main = circuit.layout.width →
+              Aiur.NativeAIR.CircuitEmitter.compileCircuit widths program circuit = some compiled →
+                ∃ result buffer,
+                  Aiur.Bytecode.Circuit.emitRow
+                        (fun index =>
+                          (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]?.getD 0)
+                        program circuit =
+                      some result ∧
+                    compiled.base.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+                      (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer compiled.base.graph.zeros ↔
+                          ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0) ∧
+                        List.mapM (Aiur.NativeAIR.readLookup buffer) compiled.base.graph.lookups =
+                          some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuit_readBound
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    ∀ {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+      Aiur.NativeAIR.CircuitEmitter.emitCircuit backend.compiled.bytecode circuit = some emission →
+        emission.readBound ≤ circuit.layout.width
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.compileCircuit_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ {circuit : Aiur.Bytecode.Circuit},
+      circuit ∈ backend.compiled.bytecode.circuits →
+        ∀ {compiled : Aiur.NativeAIR.CircuitEmitter.Compiled},
+          widths.main = circuit.layout.width →
+            Aiur.NativeAIR.CircuitEmitter.compileCircuit widths backend.compiled.bytecode circuit = some compiled →
+              ∃ result buffer,
+                Aiur.Bytecode.Circuit.emitRow
+                      (fun index =>
+                        (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]?.getD 0)
+                      backend.compiled.bytecode circuit =
+                    some result ∧
+                  compiled.base.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+                    (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer compiled.base.graph.zeros ↔
+                        ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0) ∧
+                      List.mapM (Aiur.NativeAIR.readLookup buffer) compiled.base.graph.lookups =
+                        some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileExpr_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W}
+  {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (allowStage2 : Bool),
+      widths.stage2 = 0 ∨ allowStage2 = true →
+        ∀ (expr : Aiur.NativeAIR.Expr) (nodes : List Aiur.NativeAIR.Node) {value : W},
+          Aiur.NativeAIR.Expr.eval ops values expr = some value →
+            ∃ result, Aiur.NativeAIR.Compiler.compileExpr widths allowStage2 expr nodes = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileExprs_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W}
+  {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (allowStage2 : Bool),
+      widths.stage2 = 0 ∨ allowStage2 = true →
+        ∀ (exprs : List Aiur.NativeAIR.Expr) (nodes : List Aiur.NativeAIR.Node) {results : List W},
+          Aiur.NativeAIR.Compiler.evalExprs ops values exprs = some results →
+            ∃ result, Aiur.NativeAIR.Compiler.compileExprs widths allowStage2 exprs nodes = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileLookup_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W}
+  {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    widths.stage2 = 0 →
+      ∀ (lookup : Aiur.NativeAIR.Compiler.ExprLookup) (nodes : List Aiur.NativeAIR.Node) {value : W × List W},
+        Aiur.NativeAIR.Compiler.ExprLookup.eval ops values lookup = some value →
+          ∃ result, Aiur.NativeAIR.Compiler.compileLookup widths lookup nodes = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileLookups_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W}
+  {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    widths.stage2 = 0 →
+      ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) (nodes : List Aiur.NativeAIR.Node)
+        {valuesRead : List (W × List W)},
+        List.mapM (Aiur.NativeAIR.Compiler.ExprLookup.eval ops values) lookups = some valuesRead →
+          ∃ result, Aiur.NativeAIR.Compiler.compileLookups widths lookups nodes = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.recordZero_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  Function.Injective ops.konst →
+    Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+      ∀ {root : Nat},
+        buffer[root]? = some (ops.konst 0) → ∃ roots, Aiur.NativeAIR.Compiler.recordZero nodes root = some roots
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileZeros_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    Function.Injective ops.konst →
+      ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+        values.Fits widths →
+          widths.stage2 = 0 →
+            ∀ (exprs : List Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node} {buffer : Array W},
+              Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer →
+                Aiur.NativeAIR.Compiler.ExprsVanish ops values exprs →
+                  ∃ result, Aiur.NativeAIR.Compiler.compileZeros widths exprs nodes = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileBase_defined
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.GraphEvalLaws ops →
+    Function.Injective ops.konst →
+      ∀ {values : Aiur.NativeAIR.Values W} {widths : Aiur.NativeAIR.GraphWidths},
+        values.Fits widths →
+          widths.stage2 = 0 →
+            ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) (constraints : List Aiur.NativeAIR.Expr)
+              {valuesRead : List (W × List W)},
+              List.mapM (Aiur.NativeAIR.Compiler.ExprLookup.eval ops values) lookups = some valuesRead →
+                Aiur.NativeAIR.Compiler.ExprsVanish ops values constraints →
+                  ∃ result, Aiur.NativeAIR.Compiler.compileBase widths lookups constraints = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.selectorSum_zero
+∀ (values : List Aiur.G), (∀ (value : Aiur.G), value ∈ values → value = 0) → Aiur.AIR.selectorSum values = 0
+AXIOMS [propext]
+ROOT Aiur.AIR.emitOp_inactive
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} (op : Aiur.Bytecode.Op) {values : Array Aiur.AIR.RowValue}
+  {emission : Aiur.AIR.OpEmission},
+  Aiur.AIR.emitOp row 0 rank op values = some emission →
+    ∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.emitOps_inactive
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} (ops : List Aiur.Bytecode.Op) {values : Array Aiur.AIR.RowValue} {column : Nat}
+  {emission : Aiur.AIR.OpsEmission},
+  Aiur.AIR.emitOps row 0 rank ops values column = some emission →
+    ∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.BlockEmission.Inactive.prefix
+∀ {emission : Aiur.AIR.BlockEmission},
+  emission.Inactive →
+    ∀ (equations : List Aiur.G),
+      (∀ (equation : Aiur.G), equation ∈ equations → equation = 0) →
+        (Aiur.AIR.BlockEmission.prefix equations emission).Inactive
+AXIOMS [propext]
+ROOT Aiur.AIR.BlockEmission.Inactive.afterOps
+∀ {emission : Aiur.AIR.BlockEmission},
+  emission.Inactive →
+    ∀ (incoming : Aiur.G) (lookup : Nat) (ops : Aiur.AIR.OpsEmission),
+      (∀ (equation : Aiur.G), equation ∈ ops.equations → equation = 0) →
+        (Aiur.AIR.BlockEmission.afterOps incoming lookup ops emission).Inactive
+AXIOMS [propext]
+ROOT Aiur.AIR.joinBlockEmissions_inactive
+∀ (values : Array Aiur.AIR.RowValue) (column lookup : Nat) (emissions : List Aiur.AIR.BlockEmission),
+  (∀ (emission : Aiur.AIR.BlockEmission), emission ∈ emissions → emission.Inactive) →
+    (Aiur.AIR.joinBlockEmissions values column lookup emissions).Inactive
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.AIR.BlockEmission.Inactive.continued
+∀ {branches continuation : Aiur.AIR.BlockEmission},
+  branches.Inactive →
+    continuation.Inactive →
+      ∀ (equations : List Aiur.G),
+        (∀ (equation : Aiur.G), equation ∈ equations → equation = 0) →
+          (branches.continued equations continuation).Inactive
+AXIOMS [propext]
+ROOT Aiur.Bytecode.branchSelectorFlows_entry_zero
+∀ (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block),
+  (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+      pair ∈ branches.toList → (Aiur.Bytecode.Block.selectorFlow (fun x => 0) pair.snd).entry = 0) →
+    (∀ (block : Aiur.Bytecode.Block),
+        fallback = some block → (Aiur.Bytecode.Block.selectorFlow (fun x => 0) block).entry = 0) →
+      (Aiur.AIR.SelectorFlow.join (Aiur.Bytecode.branchSelectorFlows (fun x => 0) branches fallback)).entry = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Ctrl.selectorFlow_entry_zero
+∀ (ctrl : Aiur.Bytecode.Ctrl), (Aiur.Bytecode.Ctrl.selectorFlow (fun x => 0) ctrl).entry = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.selectorFlow_entry_zero
+∀ (block : Aiur.Bytecode.Block), (Aiur.Bytecode.Block.selectorFlow (fun x => 0) block).entry = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.branchRows_inactive
+∀ (row : Nat → Aiur.G) (context : Aiur.AIR.RowContext) (matched : Aiur.G) (values : Array Aiur.AIR.RowValue)
+  (column lookup : Nat) (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block)
+  {emission : Aiur.AIR.BlockEmission},
+  (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+      pair ∈ branches.toList →
+        ∀ (result : Aiur.AIR.BlockEmission),
+          Aiur.Bytecode.Block.emitRow row (fun x => 0) context 0 values column lookup pair.snd = some result →
+            result.Inactive) →
+    (∀ (block : Aiur.Bytecode.Block),
+        fallback = some block →
+          ∀ (result : Aiur.AIR.BlockEmission),
+            Aiur.Bytecode.Block.emitRow row (fun x => 0) context 0 values (column + branches.size) lookup block =
+                some result →
+              result.Inactive) →
+      Aiur.Bytecode.branchRows row (fun x => 0) context matched values column lookup branches fallback = some emission →
+        emission.Inactive
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Ctrl.emitRow_inactive
+∀ (row : Nat → Aiur.G) (context : Aiur.AIR.RowContext) (ctrl : Aiur.Bytecode.Ctrl) (values : Array Aiur.AIR.RowValue)
+  (column lookup : Nat) {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Ctrl.emitRow row (fun x => 0) context 0 values column lookup ctrl = some emission → emission.Inactive
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emitRow_inactive
+∀ (row : Nat → Aiur.G) (context : Aiur.AIR.RowContext) (block : Aiur.Bytecode.Block) (values : Array Aiur.AIR.RowValue)
+  (column lookup : Nat) {emission : Aiur.AIR.BlockEmission},
+  Aiur.Bytecode.Block.emitRow row (fun x => 0) context 0 values column lookup block = some emission → emission.Inactive
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.MemberEmission.entry_zero
+∀ (member : Aiur.AIR.MemberEmission), Aiur.AIR.MemberEmission.entry (fun x => 0) member = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitMember_zero
+∀ {rank : Aiur.G} {column lookup selectorBase : Nat} {program : Aiur.Bytecode.Toplevel}
+  {functionIndex : Aiur.Bytecode.FunIdx} {member : Aiur.AIR.MemberEmission},
+  Aiur.AIR.emitMember (fun x => 0) rank column lookup selectorBase program functionIndex = some member →
+    member.body.Inactive
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.emitMembers_zero
+∀ {rank : Aiur.G} (column lookup selectorBase : Nat) (program : Aiur.Bytecode.Toplevel)
+  (indices : List Aiur.Bytecode.FunIdx) {members : List Aiur.AIR.MemberEmission},
+  Aiur.AIR.emitMembers (fun x => 0) rank column lookup selectorBase program indices = some members →
+    ∀ (member : Aiur.AIR.MemberEmission), member ∈ members → member.body.Inactive
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.AIR.circuitEmission_zero
+∀ (circuit : Aiur.Bytecode.Circuit) (members : List Aiur.AIR.MemberEmission),
+  (∀ (member : Aiur.AIR.MemberEmission), member ∈ members → member.body.Inactive) →
+    ∀ (equation : Aiur.G), equation ∈ (Aiur.AIR.circuitEmission (fun x => 0) circuit members).equations → equation = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Circuit.emitRow_zero
+∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit) {emission : Aiur.AIR.CircuitEmission},
+  Aiur.Bytecode.Circuit.emitRow (fun x => 0) program circuit = some emission →
+    ∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.zeroValues_fits
+∀ (circuit : Aiur.Bytecode.Circuit),
+  (Aiur.NativeAIR.CircuitEmitter.zeroValues circuit.layout.width).Fits
+    (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CircuitEmitter.zeroValues_read
+∀ (width index : Nat),
+  index < width →
+    ((Aiur.NativeAIR.CircuitEmitter.zeroValues width).columns Aiur.NativeAIR.Source.main
+          Aiur.NativeAIR.RowOffset.current)[index]? =
+      some 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitCircuit_zero_eval
+∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.MembersColumnBound program.functions circuit.members circuit.layout →
+      Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+        Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit = some emission →
+          ∃ result,
+            Aiur.NativeAIR.CircuitEmitter.Emission.eval (Aiur.NativeAIR.CircuitEmitter.zeroValues circuit.layout.width)
+                  emission =
+                some result ∧
+              ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitCircuit_compiles
+∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+  {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.MembersColumnBound program.functions circuit.members circuit.layout →
+      Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+        Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit = some emission →
+          ∃ compiled,
+            Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit) program
+                  circuit =
+                some compiled ∧
+              compiled.emission = emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.compileCircuit_defined_iff
+∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit),
+  Aiur.Bytecode.FunctionsComputedLayout program.functions →
+    Aiur.Bytecode.MembersColumnBound program.functions circuit.members circuit.layout →
+      Aiur.Bytecode.Circuit.validateRowCounts program circuit = true →
+        ((Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit) program
+                circuit).isSome =
+            true ↔
+          (Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit).isSome = true)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.emitCircuit_compiles
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    ∀ {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+      Aiur.NativeAIR.CircuitEmitter.emitCircuit backend.compiled.bytecode circuit = some emission →
+        ∃ compiled,
+          Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit)
+                backend.compiled.bytecode circuit =
+              some compiled ∧
+            compiled.emission = emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.emittedCircuit_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit) →
+        ∀ {emission : Aiur.NativeAIR.CircuitEmitter.Emission},
+          Aiur.NativeAIR.CircuitEmitter.emitCircuit backend.compiled.bytecode circuit = some emission →
+            ∃ compiled result buffer,
+              Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit)
+                    backend.compiled.bytecode circuit =
+                  some compiled ∧
+                compiled.emission = emission ∧
+                  Aiur.Bytecode.Circuit.emitRow
+                        (fun index =>
+                          (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]?.getD 0)
+                        backend.compiled.bytecode circuit =
+                      some result ∧
+                    compiled.base.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+                      (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer compiled.base.graph.zeros ↔
+                          ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0) ∧
+                        List.mapM (Aiur.NativeAIR.readLookup buffer) compiled.base.graph.lookups =
+                          some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.indicesInScope_spec
+∀ (available : Nat) (indices : Array Aiur.Bytecode.ValIdx),
+  Aiur.Bytecode.indicesInScope available indices = true ↔
+    ∀ (index : Aiur.Bytecode.ValIdx), index ∈ indices → index < available
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.wordInScope_spec
+∀ (available : Nat) (indices : Array Aiur.Bytecode.ValIdx),
+  Aiur.Bytecode.wordInScope available indices = true ↔
+    indices.size = 4 ∧ Aiur.Bytecode.indicesInScope available indices = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.addScope_eq
+∀ {available count next : Nat},
+  Aiur.Bytecode.addScope available count = some next → next = available + count ∧ next < 2 ^ 64
+AXIOMS []
+ROOT Aiur.Bytecode.checkEmissionOps_cons
+∀ {op : Aiur.Bytecode.Op} {ops : List Aiur.Bytecode.Op} {available next : Nat},
+  Aiur.Bytecode.checkEmissionOps (op :: ops) available = some next →
+    Aiur.Bytecode.Op.emissionInputs available op = true ∧
+      ∃ after,
+        Aiur.Bytecode.addScope available op.outputSize = some after ∧
+          Aiur.Bytecode.checkEmissionOps ops after = some next
+AXIOMS [propext]
+ROOT Aiur.Bytecode.checkEmissionOps_le
+∀ {ops : List Aiur.Bytecode.Op} {available next : Nat},
+  Aiur.Bytecode.checkEmissionOps ops available = some next → available ≤ next
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.Bytecode.Op.allocation_outputSize
+∀ (op : Aiur.Bytecode.Op) (degrees : Array Nat), (Aiur.Bytecode.Op.allocation degrees op).degrees.size = op.outputSize
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.OpEmitter.list_mapM_defined
+∀ {α : Type u_1} {β : Type u_2} {read : α → Option β} (inputs : List α),
+  (∀ (input : α), input ∈ inputs → ∃ output, read input = some output) → ∃ outputs, List.mapM read inputs = some outputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.array_mapM_defined
+∀ {α : Type u_1} {β : Type u_2} {read : α → Option β} (inputs : Array α),
+  (∀ (input : α), input ∈ inputs → ∃ output, read input = some output) →
+    ∃ outputs, Array.mapM read inputs = some outputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.select_defined
+∀ {rows : Array Aiur.NativeAIR.RowExpr} {indices : Array Nat},
+  Aiur.Bytecode.indicesInScope rows.size indices = true →
+    ∃ outputs, Aiur.NativeAIR.OpEmitter.select rows indices = some outputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.readWord_defined
+∀ {rows : Array Aiur.NativeAIR.RowExpr} {indices : Array Nat},
+  Aiur.Bytecode.wordInScope rows.size indices = true →
+    ∃ output, Aiur.NativeAIR.OpEmitter.readWord rows indices = some output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_defined
+∀ (selector rank : Aiur.NativeAIR.Expr) (first : Nat) (op : Aiur.Bytecode.Op) (rows : Array Aiur.NativeAIR.RowExpr),
+  Aiur.Bytecode.Op.emissionInputs rows.size op = true →
+    ∃ emission, Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOp_outputSize
+∀ {selector rank : Aiur.NativeAIR.Expr} {first : Nat} {op : Aiur.Bytecode.Op} {rows : Array Aiur.NativeAIR.RowExpr}
+  {emission : Aiur.NativeAIR.OpEmitter.Emission},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.NativeAIR.OpEmitter.emitOp selector rank first op rows = some emission → emission.outputs.size = op.outputSize
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.OpEmitter.emitOps_defined
+∀ (selector rank : Aiur.NativeAIR.Expr) (ops : List Aiur.Bytecode.Op) (rows : Array Aiur.NativeAIR.RowExpr)
+  (column : Nat) {next : Nat},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    Aiur.Bytecode.checkEmissionOps ops rows.size = some next →
+      ∃ emission,
+        Aiur.NativeAIR.OpEmitter.emitOps selector rank ops rows column = some emission ∧ emission.values.size = next
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.emissionChecks_match
+∀ (available selectors : Nat) (yieldSize : Option Nat) (index : Aiur.Bytecode.ValIdx)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block),
+  Aiur.Bytecode.Ctrl.emissionChecks available selectors yieldSize (Aiur.Bytecode.Ctrl.match index branches fallback) =
+      true ↔
+    index < available ∧
+      (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+          pair ∈ branches.toList → Aiur.Bytecode.Block.emissionChecks available selectors yieldSize pair.snd = true) ∧
+        ∀ (block : Aiur.Bytecode.Block),
+          fallback = some block → Aiur.Bytecode.Block.emissionChecks available selectors yieldSize block = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.emissionChecks_matchContinue
+∀ (available selectors : Nat) (yieldSize : Option Nat) (index : Aiur.Bytecode.ValIdx)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block) (size aux lookups : Nat)
+  (continuation : Aiur.Bytecode.Block),
+  Aiur.Bytecode.Ctrl.emissionChecks available selectors yieldSize
+        (Aiur.Bytecode.Ctrl.matchContinue index branches fallback size aux lookups continuation) =
+      true ↔
+    index < available ∧
+      (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+          pair ∈ branches.toList → Aiur.Bytecode.Block.emissionChecks available selectors (some size) pair.snd = true) ∧
+        (∀ (block : Aiur.Bytecode.Block),
+            fallback = some block → Aiur.Bytecode.Block.emissionChecks available selectors (some size) block = true) ∧
+          ∃ next,
+            Aiur.Bytecode.addScope available size = some next ∧
+              Aiur.Bytecode.Block.emissionChecks next selectors yieldSize continuation = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Block.emissionChecks_parts
+∀ {block : Aiur.Bytecode.Block} {available selectors : Nat} {yieldSize : Option Nat},
+  Aiur.Bytecode.Block.emissionChecks available selectors yieldSize block = true →
+    ∃ next,
+      Aiur.Bytecode.checkEmissionOps block.ops.toList available = some next ∧
+        Aiur.Bytecode.Ctrl.emissionChecks next selectors yieldSize block.ctrl = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.Bytecode.Toplevel.validateEmission_function
+∀ {program : Aiur.Bytecode.Toplevel},
+  program.validateEmission = true →
+    ∀ {function : Aiur.Bytecode.Function},
+      function ∈ program.functions → function.constrained = true → function.emissionChecks = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.ctrlSelector_defined
+∀ (selectors : Array Aiur.NativeAIR.Expr) (ctrl : Aiur.Bytecode.Ctrl) {available : Nat} {yieldSize : Option Nat},
+  Aiur.Bytecode.Ctrl.emissionChecks available selectors.size yieldSize ctrl = true →
+    ∃ entry, Aiur.NativeAIR.BlockEmitter.ctrlSelector selectors ctrl = some entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.blockSelector_defined
+∀ (selectors : Array Aiur.NativeAIR.Expr) (block : Aiur.Bytecode.Block) {available : Nat} {yieldSize : Option Nat},
+  Aiur.Bytecode.Block.emissionChecks available selectors.size yieldSize block = true →
+    ∃ entry, Aiur.NativeAIR.BlockEmitter.blockSelector selectors block = some entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.Emission.YieldShape.prefix
+∀ {emission : Aiur.NativeAIR.BlockEmitter.Emission} {size : Option Nat},
+  Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission →
+    ∀ (equations : List Aiur.NativeAIR.Expr),
+      Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size
+        (Aiur.NativeAIR.BlockEmitter.Emission.prefix equations emission)
+AXIOMS []
+ROOT Aiur.NativeAIR.BlockEmitter.join_yieldShape
+∀ (rows : Array Aiur.NativeAIR.RowExpr) (column lookup : Nat) (emissions : List Aiur.NativeAIR.BlockEmitter.Emission)
+  {size : Option Nat},
+  (∀ (emission : Aiur.NativeAIR.BlockEmitter.Emission),
+      emission ∈ emissions → Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission) →
+    Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size (Aiur.NativeAIR.BlockEmitter.join rows column lookup emissions)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.branchRows_defined
+∀ (selectors : Array Aiur.NativeAIR.Expr) (context : Aiur.NativeAIR.BlockEmitter.Context)
+  (matched : Aiur.NativeAIR.RowExpr) (rows : Array Aiur.NativeAIR.RowExpr) (column lookup : Nat)
+  (branches : Array (Aiur.G × Aiur.Bytecode.Block)) (fallback : Option Aiur.Bytecode.Block) (size : Option Nat),
+  (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+      pair ∈ branches.toList →
+        ∃ entry emission,
+          Aiur.NativeAIR.BlockEmitter.blockSelector selectors pair.snd = some entry ∧
+            Aiur.NativeAIR.BlockEmitter.emitBlock selectors context entry rows column lookup pair.snd = some emission ∧
+              Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission) →
+    (∀ (block : Aiur.Bytecode.Block),
+        fallback = some block →
+          ∃ entry emission,
+            Aiur.NativeAIR.BlockEmitter.blockSelector selectors block = some entry ∧
+              Aiur.NativeAIR.BlockEmitter.emitBlock selectors context entry rows (column + branches.size) lookup block =
+                  some emission ∧
+                Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission) →
+      ∃ emission,
+        Aiur.NativeAIR.BlockEmitter.branchRows selectors context matched rows column lookup branches fallback =
+            some emission ∧
+          Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitCtrl_defined
+∀ (selectors : Array Aiur.NativeAIR.Expr) (context : Aiur.NativeAIR.BlockEmitter.Context)
+  (incoming : Aiur.NativeAIR.Expr) (rows : Array Aiur.NativeAIR.RowExpr) (column lookup : Nat)
+  (ctrl : Aiur.Bytecode.Ctrl) {size : Option Nat},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    context.inputSize ≤ rows.size →
+      Aiur.Bytecode.Ctrl.emissionChecks rows.size selectors.size size ctrl = true →
+        ∃ emission,
+          Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup ctrl = some emission ∧
+            Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.BlockEmitter.emitBlock_defined
+∀ (selectors : Array Aiur.NativeAIR.Expr) (context : Aiur.NativeAIR.BlockEmitter.Context)
+  (incoming : Aiur.NativeAIR.Expr) (rows : Array Aiur.NativeAIR.RowExpr) (column lookup : Nat)
+  (block : Aiur.Bytecode.Block) {size : Option Nat},
+  Aiur.NativeAIR.OpEmitter.DegreeValid rows →
+    context.inputSize ≤ rows.size →
+      Aiur.Bytecode.Block.emissionChecks rows.size selectors.size size block = true →
+        ∃ emission,
+          Aiur.NativeAIR.BlockEmitter.emitBlock selectors context incoming rows column lookup block = some emission ∧
+            Aiur.NativeAIR.BlockEmitter.Emission.YieldShape size emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMember_defined
+∀ (rank : Aiur.NativeAIR.Expr) (column lookup selectorBase : Nat) (program : Aiur.Bytecode.Toplevel) (index : Nat)
+  {function : Aiur.Bytecode.Function},
+  program.functions[index]? = some function →
+    function.emissionChecks = true →
+      ∃ member, Aiur.NativeAIR.CircuitEmitter.emitMember rank column lookup selectorBase program index = some member
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitMembers_defined
+∀ (rank : Aiur.NativeAIR.Expr) (column lookup selectorBase : Nat) (program : Aiur.Bytecode.Toplevel)
+  (indices : List Nat),
+  (∀ (index : Nat),
+      index ∈ indices → ∃ function, program.functions[index]? = some function ∧ function.emissionChecks = true) →
+    ∃ members, Aiur.NativeAIR.CircuitEmitter.emitMembers rank column lookup selectorBase program indices = some members
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.emitCircuit_defined
+∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit),
+  program.validateEmission = true →
+    Aiur.Bytecode.MembersConstrained program.functions circuit.members →
+      ∃ emission, Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit = some emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuit_emits
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    ∃ emission, Aiur.NativeAIR.CircuitEmitter.emitCircuit backend.compiled.bytecode circuit = some emission
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuit_compiles
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    ∃ compiled,
+      Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit)
+          backend.compiled.bytecode circuit =
+        some compiled
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.circuit_graph_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.Bytecode.Circuit},
+  circuit ∈ backend.compiled.bytecode.circuits →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit) →
+        ∃ compiled result buffer,
+          Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit)
+                backend.compiled.bytecode circuit =
+              some compiled ∧
+            Aiur.Bytecode.Circuit.emitRow
+                  (fun index =>
+                    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]?.getD 0)
+                  backend.compiled.bytecode circuit =
+                some result ∧
+              compiled.base.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+                (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer compiled.base.graph.zeros ↔
+                    ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0) ∧
+                  List.mapM (Aiur.NativeAIR.readLookup buffer) compiled.base.graph.lookups =
+                    some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.Reads.pure
+∀ {α : Type} (value : α), Aiur.NativeAIR.KeyCodec.Reads (pure value) [] value
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.Reads.bind
+∀ {α β : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {next : α → Aiur.NativeAIR.KeyCodec.Reader β}
+  {left right : List UInt8} {middle : α} {value : β},
+  Aiur.NativeAIR.KeyCodec.Reads read left middle →
+    Aiur.NativeAIR.KeyCodec.Reads (next middle) right value →
+      Aiur.NativeAIR.KeyCodec.Reads (read >>= next) (left ++ right) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.Reads.map
+∀ {α β : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {bytes : List UInt8} {value : α},
+  Aiur.NativeAIR.KeyCodec.Reads read bytes value →
+    ∀ (f : α → β), Aiur.NativeAIR.KeyCodec.Reads (f <$> read) bytes (f value)
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.Reads.result
+∀ {α β : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {bytes : List UInt8} {value : α},
+  Aiur.NativeAIR.KeyCodec.Reads read bytes value →
+    ∀ (f : α → β),
+      Aiur.NativeAIR.KeyCodec.Reads
+        (do
+          let value ← read
+          pure (f value))
+        bytes (f value)
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.readByte_reads
+∀ (byte : UInt8), Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readByte [byte] byte
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.Reads.byte
+∀ {α : Type} {next : UInt8 → Aiur.NativeAIR.KeyCodec.Reader α} {byte : UInt8} {bytes : List UInt8} {value : α},
+  Aiur.NativeAIR.KeyCodec.Reads (next byte) bytes value →
+    Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.KeyCodec.readByte >>= next) (byte :: bytes) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.encodeNat_length
+∀ (count value : Nat), (Aiur.NativeAIR.KeyCodec.encodeNat count value).length = count
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readNat_reads
+∀ (count value : Nat),
+  value < 256 ^ count →
+    Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.KeyCodec.readNat count)
+      (Aiur.NativeAIR.KeyCodec.encodeNat count value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readMany_reads
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} (encode : α → List UInt8) (values : List α),
+  (∀ (value : α), value ∈ values → Aiur.NativeAIR.KeyCodec.Reads read (encode value) value) →
+    Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.KeyCodec.readMany read values.length) (List.flatMap encode values)
+      values
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readVector_reads
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} (encode : α → List UInt8) (values : List α),
+  values.length < 65536 →
+    (∀ (value : α), value ∈ values → Aiur.NativeAIR.KeyCodec.Reads read (encode value) value) →
+      Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.KeyCodec.readVector read)
+        (Aiur.NativeAIR.KeyCodec.encodeVector encode values) values
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readNode_reads
+∀ (node : Aiur.NativeAIR.Node),
+  Aiur.NativeAIR.KeyCodec.NodeWireFits node →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readNode (Aiur.NativeAIR.KeyCodec.encodeNode node) node
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readLookup_reads
+∀ (lookup : Aiur.NativeAIR.Lookup),
+  Aiur.NativeAIR.KeyCodec.LookupWireFits lookup →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readLookup (Aiur.NativeAIR.KeyCodec.encodeLookup lookup)
+      lookup
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readCircuitData_reads
+∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit),
+  Aiur.NativeAIR.KeyCodec.CircuitWireFits circuit →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readCircuitData
+      (Aiur.NativeAIR.KeyCodec.encodeCircuit circuit) circuit
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readCircuit_reads
+∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit),
+  Aiur.NativeAIR.KeyCodec.CircuitWireFits circuit →
+    circuit.valid = true →
+      Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readCircuit (Aiur.NativeAIR.KeyCodec.encodeCircuit circuit)
+        circuit
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readParameters_reads
+∀ (parameters : Aiur.NativeAIR.KeyCodec.Parameters),
+  Aiur.NativeAIR.KeyCodec.ParametersWireFits parameters →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readParameters
+      (Aiur.NativeAIR.KeyCodec.encodeParameters parameters) parameters
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readCommitment_reads
+∀ (commitment : Option Aiur.NativeAIR.KeyCodec.MerkleCap),
+  Aiur.NativeAIR.KeyCodec.CommitmentWireFits commitment →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readCommitment
+      (Aiur.NativeAIR.KeyCodec.encodeCommitment commitment) commitment
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readIndex_reads
+∀ (index : Option Nat),
+  Aiur.NativeAIR.KeyCodec.IndexWireFits index →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readIndex (Aiur.NativeAIR.KeyCodec.encodeIndex index) index
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readKey_reads
+∀ (key : Aiur.NativeAIR.KeyCodec.Key),
+  Aiur.NativeAIR.KeyCodec.KeyWireFits key →
+    (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ key.circuits → circuit.valid = true) →
+      Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.KeyCodec.readKey (Aiur.NativeAIR.KeyCodec.encodeKey key) key
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decode_encode
+∀ (key : Aiur.NativeAIR.KeyCodec.Key),
+  Aiur.NativeAIR.KeyCodec.KeyWireFits key →
+    (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ key.circuits → circuit.valid = true) →
+      Aiur.NativeAIR.KeyCodec.decode (Aiur.NativeAIR.KeyCodec.encode key) = some key
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decodeCanonical_success
+∀ {bytes : ByteArray} {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.decodeCanonical bytes = some key →
+    Aiur.NativeAIR.KeyCodec.decode bytes = some key ∧ Aiur.NativeAIR.KeyCodec.encode key = bytes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decodeCanonical_encode
+∀ (key : Aiur.NativeAIR.KeyCodec.Key),
+  Aiur.NativeAIR.KeyCodec.KeyWireFits key →
+    (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ key.circuits → circuit.valid = true) →
+      Aiur.NativeAIR.KeyCodec.decodeCanonical (Aiur.NativeAIR.KeyCodec.encode key) = some key
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.canonical_bytes_unique
+∀ {first second : ByteArray} {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.decodeCanonical first = some key →
+    Aiur.NativeAIR.KeyCodec.decodeCanonical second = some key → first = second
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.encode_injective
+∀ {first second : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.KeyWireFits first →
+    Aiur.NativeAIR.KeyCodec.KeyWireFits second →
+      (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ first.circuits → circuit.valid = true) →
+        (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ second.circuits → circuit.valid = true) →
+          Aiur.NativeAIR.KeyCodec.encode first = Aiur.NativeAIR.KeyCodec.encode second → first = second
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.Returns.pure
+∀ {α : Type} {value : α} {property : α → Prop}, property value → Aiur.NativeAIR.KeyCodec.Returns (pure value) property
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.Returns.failure
+∀ {α : Type} (property : α → Prop), Aiur.NativeAIR.KeyCodec.Returns failure property
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.Returns.bind
+∀ {α β : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {next : α → Aiur.NativeAIR.KeyCodec.Reader β} {left : α → Prop}
+  {right : β → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read left →
+    (∀ (value : α), left value → Aiur.NativeAIR.KeyCodec.Returns (next value) right) →
+      Aiur.NativeAIR.KeyCodec.Returns (read >>= next) right
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.Returns.bind_any
+∀ {α β : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {next : α → Aiur.NativeAIR.KeyCodec.Reader β}
+  {property : β → Prop},
+  (∀ (value : α), Aiur.NativeAIR.KeyCodec.Returns (next value) property) →
+    Aiur.NativeAIR.KeyCodec.Returns (read >>= next) property
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.Returns.weaken
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {left right : α → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read left →
+    (∀ (value : α), left value → right value) → Aiur.NativeAIR.KeyCodec.Returns read right
+AXIOMS []
+ROOT Aiur.NativeAIR.KeyCodec.Returns.result
+∀ {α β : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {left : α → Prop} {right : β → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read left →
+    ∀ (f : α → β),
+      (∀ (value : α), left value → right (f value)) →
+        Aiur.NativeAIR.KeyCodec.Returns
+          (do
+            let value ← read
+            pure (f value))
+          right
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readMany_returns
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {property : α → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read property →
+    ∀ (count : Nat),
+      Aiur.NativeAIR.KeyCodec.Returns (Aiur.NativeAIR.KeyCodec.readMany read count) fun values =>
+        values.length = count ∧ ∀ (value : α), value ∈ values → property value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readVector_returns
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {property : α → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read property →
+    Aiur.NativeAIR.KeyCodec.Returns (Aiur.NativeAIR.KeyCodec.readVector read) fun values =>
+      ∀ (value : α), value ∈ values → property value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readCircuit_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.KeyCodec.readCircuit fun circuit => circuit.valid = true
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.KeyCodec.readCommitment_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.KeyCodec.readCommitment Aiur.NativeAIR.KeyCodec.CommitmentValid
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readKey_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.KeyCodec.readKey fun key =>
+  (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ key.circuits → circuit.valid = true) ∧
+    key.preprocessedIndices.length = key.circuits.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decode_success
+∀ {bytes : ByteArray} {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.decode bytes = some key → Aiur.NativeAIR.KeyCodec.readKey bytes.data.toList = some (key, [])
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decode_valid
+∀ {bytes : ByteArray} {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.decode bytes = some key →
+    (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ key.circuits → circuit.valid = true) ∧
+      key.preprocessedIndices.length = key.circuits.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.readKey_commitment
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.KeyCodec.readKey fun key =>
+  Aiur.NativeAIR.KeyCodec.CommitmentValid key.preprocessedCommitment
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decode_commitment
+∀ {bytes : ByteArray} {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.decode bytes = some key → Aiur.NativeAIR.KeyCodec.CommitmentValid key.preprocessedCommitment
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.Circuit.valid_graph
+∀ {circuit : Aiur.NativeAIR.KeyCodec.Circuit},
+  circuit.valid = true →
+    1 ≤ circuit.lookupGroupSize ∧
+      circuit.lookupGroupSize ≤ 8 ∧
+        Aiur.NativeAIR.Graph.Valid circuit.widths circuit.graph ∧
+          circuit.computedDegree = some circuit.maxConstraintDegree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decoded_graph_sweeps
+∀ {W : Type u_1} {bytes : ByteArray} {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.decode bytes = some key →
+    ∀ {circuit : Aiur.NativeAIR.KeyCodec.Circuit},
+      circuit ∈ key.circuits →
+        ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W),
+          values.Fits circuit.widths →
+            ∃ buffer, circuit.graph.sweep ops values = some buffer ∧ buffer.size = circuit.graph.nodes.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.KeyCodec.decode_encoded_suffix
+∀ (key : Aiur.NativeAIR.KeyCodec.Key),
+  Aiur.NativeAIR.KeyCodec.KeyWireFits key →
+    (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), circuit ∈ key.circuits → circuit.valid = true) →
+      ∀ (rest : List UInt8),
+        Aiur.NativeAIR.KeyCodec.decode (Aiur.NativeAIR.KeyCodec.encodeKey key ++ rest).toByteArray =
+          if rest = [] then some key else none
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.key_decodes
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.NativeAIR.KeyCodec.decode selection.key = some backend.keyData
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.native_key_decodes
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.NativeAIR.KeyCodec.decodeCanonical backend.system.vkBytes = some backend.keyData
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.native_key_encoding
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.NativeAIR.KeyCodec.encode backend.keyData = backend.system.vkBytes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.key_commitment
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection),
+  Aiur.NativeAIR.KeyCodec.CommitmentValid backend.keyData.preprocessedCommitment
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.key_graph_valid
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.NativeAIR.KeyCodec.Circuit},
+  circuit ∈ backend.keyData.circuits → Aiur.NativeAIR.Graph.Valid circuit.widths circuit.graph
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.Backend.key_graph_reflects
+∀ {W : Type u_1} {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.Backend selection)
+  {circuit : Aiur.NativeAIR.KeyCodec.Circuit},
+  circuit ∈ backend.keyData.circuits →
+    ∀ (ops : Aiur.NativeAIR.EvalOps W) (values : Aiur.NativeAIR.Values W),
+      values.Fits circuit.widths →
+        ∃ trees full lookupValues,
+          circuit.graph.unfold = some trees ∧
+            circuit.graph.sweep ops values = some full ∧
+              circuit.graph.sweepLookupPrefix ops values = some lookupValues ∧
+                trees.size = circuit.graph.nodes.length ∧
+                  full.size = circuit.graph.nodes.length ∧
+                    lookupValues.size = circuit.graph.lookupPrefix ∧
+                      Aiur.NativeAIR.Reflects ops values trees full ∧
+                        Aiur.NativeAIR.readNodes full circuit.graph.zeros =
+                            Aiur.NativeAIR.evalRoots ops values trees circuit.graph.zeros ∧
+                          ∀ (lookup : Aiur.NativeAIR.Lookup),
+                            lookup ∈ circuit.graph.lookups →
+                              Aiur.NativeAIR.readLookup lookupValues lookup = Aiur.NativeAIR.readLookup full lookup ∧
+                                Aiur.NativeAIR.readLookup lookupValues lookup =
+                                  Aiur.NativeAIR.evalLookup ops values trees lookup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.circuits_bound
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection),
+  Aiur.NativeAIR.CompiledKey.circuits backend.compiled.bytecode = some backend.keyData.circuits
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.preprocessed_indices
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection),
+  backend.keyData.preprocessedIndices = Aiur.NativeAIR.CompiledKey.preprocessedIndices backend.compiled.bytecode
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.verifyCompiled_success
+∀ {selection : Aiur.BoundVerifier.Selection} {backend : Aiur.BoundVerifier.CompiledBackend selection}
+  {input : Array Aiur.G} {bytes : ByteArray},
+  Aiur.BoundVerifier.verifyCompiled backend input bytes = Except.ok () →
+    input.size = selection.inputSize ∧
+      ∃ proof,
+        Aiur.Proof.ofBytesChecked bytes = Except.ok proof ∧
+          backend.system.verify (Aiur.buildClaim selection.function input selection.success) proof = Except.ok ()
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileExpr_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (allowStage2 : Bool) (expr : Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node}
+      {result : List Aiur.NativeAIR.Node × Nat},
+      Aiur.NativeAIR.Compiler.compileExpr small allowStage2 expr nodes = some result →
+        Aiur.NativeAIR.Compiler.compileExpr large allowStage2 expr nodes = some result
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.compileExprs_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (allowStage2 : Bool) (exprs : List Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node}
+      {result : List Aiur.NativeAIR.Node × List Nat},
+      Aiur.NativeAIR.Compiler.compileExprs small allowStage2 exprs nodes = some result →
+        Aiur.NativeAIR.Compiler.compileExprs large allowStage2 exprs nodes = some result
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.compileLookup_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (lookup : Aiur.NativeAIR.Compiler.ExprLookup) {nodes : List Aiur.NativeAIR.Node}
+      {result : List Aiur.NativeAIR.Node × Aiur.NativeAIR.Lookup},
+      Aiur.NativeAIR.Compiler.compileLookup small lookup nodes = some result →
+        Aiur.NativeAIR.Compiler.compileLookup large lookup nodes = some result
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.compileLookups_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) {nodes : List Aiur.NativeAIR.Node}
+      {result : List Aiur.NativeAIR.Node × List Aiur.NativeAIR.Lookup},
+      Aiur.NativeAIR.Compiler.compileLookups small lookups nodes = some result →
+        Aiur.NativeAIR.Compiler.compileLookups large lookups nodes = some result
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Compiler.compileZeros_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (exprs : List Aiur.NativeAIR.Expr) {nodes : List Aiur.NativeAIR.Node}
+      {result : List Aiur.NativeAIR.Node × List Nat},
+      Aiur.NativeAIR.Compiler.compileZeros small exprs nodes = some result →
+        Aiur.NativeAIR.Compiler.compileZeros large exprs nodes = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Compiler.compileBase_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (lookups : List Aiur.NativeAIR.Compiler.ExprLookup) (constraints : List Aiur.NativeAIR.Expr)
+      {result : Aiur.NativeAIR.Compiler.BaseCompilation},
+      Aiur.NativeAIR.Compiler.compileBase small lookups constraints = some result →
+        Aiur.NativeAIR.Compiler.compileBase large lookups constraints = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.compileCircuit_widen
+∀ {small large : Aiur.NativeAIR.GraphWidths},
+  small.Le large →
+    ∀ (program : Aiur.Bytecode.Toplevel) (circuit : Aiur.Bytecode.Circuit)
+      {compiled : Aiur.NativeAIR.CircuitEmitter.Compiled},
+      Aiur.NativeAIR.CircuitEmitter.compileCircuit small program circuit = some compiled →
+        Aiur.NativeAIR.CircuitEmitter.compileCircuit large program circuit = some compiled
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CircuitEmitter.circuitWidths_le
+∀ {circuit : Aiur.Bytecode.Circuit} {widths : Aiur.NativeAIR.GraphWidths},
+  circuit.layout.width ≤ widths.main → (Aiur.NativeAIR.CircuitEmitter.circuitWidths circuit).Le widths
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CompiledKey.column_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (source : Aiur.NativeAIR.Source) (offset : Aiur.NativeAIR.RowOffset) {width : Nat},
+      width ≤ widths.width source →
+        ∀ (index : Fin width),
+          Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values
+              (Aiur.NativeAIR.Expr.var { source := source, offset := offset, index := ↑index }) =
+            some (Aiur.NativeAIR.CompiledKey.columns values source offset width index)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CompiledKey.memoryEquations_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (width : Nat),
+      3 + width ≤ widths.main →
+        List.mapM (Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values)
+            Aiur.NativeAIR.CompiledKey.memoryEquations =
+          some
+            (Aiur.AIR.memoryColumnEquations width
+              (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current
+                (3 + width))
+              (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.next
+                (3 + width))
+              values.isTransition)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.memoryLookup_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    ∀ (width : Nat),
+      3 + width ≤ widths.main →
+        Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+            (Aiur.NativeAIR.CompiledKey.memoryLookup width) =
+          some
+            (Aiur.AIR.memoryColumnLookup width
+              (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current
+                (3 + width)))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.byte1Lookup_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    3 ≤ widths.main →
+      11 ≤ widths.preprocessed →
+        ∀ (kind : Aiur.AIR.Byte1Kind),
+          Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+              (Aiur.NativeAIR.CompiledKey.byte1Lookup kind) =
+            some
+              (Aiur.AIR.byte1ColumnLookup kind
+                (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.preprocessed
+                  Aiur.NativeAIR.RowOffset.current 11)
+                (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current
+                  3))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.byte2Lookup_eval
+∀ {values : Aiur.NativeAIR.Values Aiur.G} {widths : Aiur.NativeAIR.GraphWidths},
+  values.Fits widths →
+    10 ≤ widths.main →
+      14 ≤ widths.preprocessed →
+        ∀ (kind : Aiur.AIR.Byte2Kind),
+          Aiur.NativeAIR.Compiler.ExprLookup.eval Aiur.NativeAIR.goldilocksOps values
+              (Aiur.NativeAIR.CompiledKey.byte2Lookup kind) =
+            some
+              (Aiur.AIR.byte2ColumnLookup kind
+                (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.preprocessed
+                  Aiur.NativeAIR.RowOffset.current 14)
+                (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current
+                  10))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.circuit_success
+∀ {mainWidth preprocessedWidth preprocessedHeight groupSize : Nat} {base : Aiur.NativeAIR.Compiler.BaseCompilation}
+  {result : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuit mainWidth preprocessedWidth preprocessedHeight groupSize base = some result →
+    result.graph = base.graph ∧
+      result.mainWidth = mainWidth ∧
+        result.preprocessedWidth = preprocessedWidth ∧
+          result.preprocessedHeight = preprocessedHeight ∧ result.lookupGroupSize = groupSize ∧ result.valid = true
+AXIOMS [Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.functionCircuit_success
+∀ {program : Aiur.Bytecode.Toplevel} {source : Aiur.Bytecode.Circuit} {result : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.functionCircuit program source = some result →
+    ∃ compiled,
+      Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths source) program source =
+          some compiled ∧
+        result.graph = compiled.base.graph ∧
+          result.mainWidth = source.layout.width ∧
+            result.preprocessedWidth = 0 ∧
+              result.preprocessedHeight = 0 ∧
+                result.lookupGroupSize =
+                  if (compiled.emission.branchless && decide (2 ≤ compiled.emission.lookups.length)) = true then 2
+                  else 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.memoryCircuit_success
+∀ {width : Nat} {result : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.memoryCircuit width = some result →
+    ∃ base,
+      Aiur.NativeAIR.Compiler.compileBase { preprocessed := 0, main := 3 + width, stage2 := 0, publics := 0 }
+            [Aiur.NativeAIR.CompiledKey.memoryLookup width] Aiur.NativeAIR.CompiledKey.memoryEquations =
+          some base ∧
+        result.graph = base.graph ∧
+          result.mainWidth = 3 + width ∧
+            result.preprocessedWidth = 0 ∧ result.preprocessedHeight = 0 ∧ result.lookupGroupSize = 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.byte1Circuit_success
+∀ {result : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.byte1Circuit = some result →
+    ∃ base,
+      Aiur.NativeAIR.Compiler.compileBase { preprocessed := 11, main := 3, stage2 := 0, publics := 0 }
+            (List.map Aiur.NativeAIR.CompiledKey.byte1Lookup Aiur.AIR.Byte1Kind.all) [] =
+          some base ∧
+        result.graph = base.graph ∧
+          result.mainWidth = 3 ∧
+            result.preprocessedWidth = 11 ∧ result.preprocessedHeight = 256 ∧ result.lookupGroupSize = 2
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.byte2Circuit_success
+∀ {result : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.byte2Circuit = some result →
+    ∃ base,
+      Aiur.NativeAIR.Compiler.compileBase { preprocessed := 14, main := 10, stage2 := 0, publics := 0 }
+            (List.map Aiur.NativeAIR.CompiledKey.byte2Lookup Aiur.AIR.Byte2Kind.all) [] =
+          some base ∧
+        result.graph = base.graph ∧
+          result.mainWidth = 10 ∧
+            result.preprocessedWidth = 14 ∧ result.preprocessedHeight = 65536 ∧ result.lookupGroupSize = 2
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.circuits_parts
+∀ {program : Aiur.Bytecode.Toplevel} {result : List Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuits program = some result →
+    ∃ functions memories byte1 byte2,
+      List.mapM (Aiur.NativeAIR.CompiledKey.functionCircuit program) program.circuits.toList = some functions ∧
+        List.mapM Aiur.NativeAIR.CompiledKey.memoryCircuit program.memorySizes.toList = some memories ∧
+          Aiur.NativeAIR.CompiledKey.byte1Circuit = some byte1 ∧
+            Aiur.NativeAIR.CompiledKey.byte2Circuit = some byte2 ∧ result = functions ++ memories ++ [byte1, byte2]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.circuits_length
+∀ {program : Aiur.Bytecode.Toplevel} {result : List Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuits program = some result →
+    result.length = program.circuits.size + program.memorySizes.size + 2
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.circuits_function
+∀ {program : Aiur.Bytecode.Toplevel} {result : List Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuits program = some result →
+    ∀ {index : Nat} {source : Aiur.Bytecode.Circuit} {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+      program.circuits[index]? = some source →
+        result[index]? = some artifact → Aiur.NativeAIR.CompiledKey.functionCircuit program source = some artifact
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.circuits_memory
+∀ {program : Aiur.Bytecode.Toplevel} {result : List Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuits program = some result →
+    ∀ {index width : Nat} {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+      program.memorySizes[index]? = some width →
+        result[program.circuits.size + index]? = some artifact →
+          Aiur.NativeAIR.CompiledKey.memoryCircuit width = some artifact
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.circuits_bytes
+∀ {program : Aiur.Bytecode.Toplevel} {result : List Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuits program = some result →
+    ∃ byte1 byte2,
+      Aiur.NativeAIR.CompiledKey.byte1Circuit = some byte1 ∧
+        Aiur.NativeAIR.CompiledKey.byte2Circuit = some byte2 ∧
+          result[program.circuits.size + program.memorySizes.size]? = some byte1 ∧
+            result[program.circuits.size + program.memorySizes.size + 1]? = some byte2
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.memoryCircuit_reflects
+∀ {width : Nat} {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.memoryCircuit width = some artifact →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits artifact.widths →
+        ∃ buffer,
+          artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+            (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ↔
+                ∀ (equation : Aiur.G),
+                  equation ∈
+                      Aiur.AIR.memoryColumnEquations width
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.current (3 + width))
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.next (3 + width))
+                        values.isTransition →
+                    equation = 0) ∧
+              List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                some
+                  [Aiur.AIR.memoryColumnLookup width
+                      (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                        Aiur.NativeAIR.RowOffset.current (3 + width))]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.byte1Circuit_reflects
+∀ {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.byte1Circuit = some artifact →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits artifact.widths →
+        ∃ buffer,
+          artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+            Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ∧
+              List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                some
+                  (List.map
+                    (fun kind =>
+                      Aiur.AIR.byte1ColumnLookup kind
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.preprocessed
+                          Aiur.NativeAIR.RowOffset.current 11)
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.current 3))
+                    Aiur.AIR.Byte1Kind.all)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.byte2Circuit_reflects
+∀ {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.byte2Circuit = some artifact →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits artifact.widths →
+        ∃ buffer,
+          artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+            Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ∧
+              List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                some
+                  (List.map
+                    (fun kind =>
+                      Aiur.AIR.byte2ColumnLookup kind
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.preprocessed
+                          Aiur.NativeAIR.RowOffset.current 14)
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.current 10))
+                    Aiur.AIR.Byte2Kind.all)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.circuit_count
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection),
+  backend.keyData.circuits.length =
+    backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size + 2
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.function_graph_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection) {index : Nat}
+  {source : Aiur.Bytecode.Circuit} {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  backend.compiled.bytecode.circuits[index]? = some source →
+    backend.keyData.circuits[index]? = some artifact →
+      ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+        values.Fits artifact.widths →
+          ∃ result buffer,
+            Aiur.Bytecode.Circuit.emitRow
+                  (fun index =>
+                    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]?.getD 0)
+                  backend.compiled.bytecode source =
+                some result ∧
+              artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+                (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ↔
+                    ∀ (equation : Aiur.G), equation ∈ result.equations → equation = 0) ∧
+                  List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                    some (List.ofFn fun slot => result.lookup ↑slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.memory_graph_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {index width : Nat} {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  backend.compiled.bytecode.memorySizes[index]? = some width →
+    backend.keyData.circuits[backend.compiled.bytecode.circuits.size + index]? = some artifact →
+      ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+        values.Fits artifact.widths →
+          ∃ buffer,
+            artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+              (Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ↔
+                  ∀ (equation : Aiur.G),
+                    equation ∈
+                        Aiur.AIR.memoryColumnEquations width
+                          (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                            Aiur.NativeAIR.RowOffset.current (3 + width))
+                          (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                            Aiur.NativeAIR.RowOffset.next (3 + width))
+                          values.isTransition →
+                      equation = 0) ∧
+                List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                  some
+                    [Aiur.AIR.memoryColumnLookup width
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.current (3 + width))]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.byte_graphs
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection),
+  ∃ byte1 byte2,
+    Aiur.NativeAIR.CompiledKey.byte1Circuit = some byte1 ∧
+      Aiur.NativeAIR.CompiledKey.byte2Circuit = some byte2 ∧
+        backend.keyData.circuits[backend.compiled.bytecode.circuits.size +
+                backend.compiled.bytecode.memorySizes.size]? =
+            some byte1 ∧
+          backend.keyData.circuits[backend.compiled.bytecode.circuits.size +
+                  backend.compiled.bytecode.memorySizes.size +
+                1]? =
+            some byte2
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.byte1_graph_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  backend.keyData.circuits[backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size]? =
+      some artifact →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits artifact.widths →
+        ∃ buffer,
+          artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+            Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ∧
+              List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                some
+                  (List.map
+                    (fun kind =>
+                      Aiur.AIR.byte1ColumnLookup kind
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.preprocessed
+                          Aiur.NativeAIR.RowOffset.current 11)
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.current 3))
+                    Aiur.AIR.Byte1Kind.all)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.byte2_graph_reflects
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+  backend.keyData.circuits[backend.compiled.bytecode.circuits.size + backend.compiled.bytecode.memorySizes.size + 1]? =
+      some artifact →
+    ∀ {values : Aiur.NativeAIR.Values Aiur.G},
+      values.Fits artifact.widths →
+        ∃ buffer,
+          artifact.graph.sweep Aiur.NativeAIR.goldilocksOps values = some buffer ∧
+            Aiur.NativeAIR.Compiler.Vanishes Aiur.NativeAIR.goldilocksOps buffer artifact.graph.zeros ∧
+              List.mapM (Aiur.NativeAIR.readLookup buffer) artifact.graph.lookups =
+                some
+                  (List.map
+                    (fun kind =>
+                      Aiur.AIR.byte2ColumnLookup kind
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.preprocessed
+                          Aiur.NativeAIR.RowOffset.current 14)
+                        (Aiur.NativeAIR.CompiledKey.columns values Aiur.NativeAIR.Source.main
+                          Aiur.NativeAIR.RowOffset.current 10))
+                    Aiur.AIR.Byte2Kind.all)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.verifyShaped_success
+∀ {selection : Aiur.BoundVerifier.Selection} {backend : Aiur.BoundVerifier.CompiledBackend selection}
+  {input : Array Aiur.G} {bytes : ByteArray},
+  Aiur.BoundVerifier.verifyShaped backend input bytes = Except.ok () →
+    ∃ checked,
+      Aiur.BoundVerifier.readProof backend.keyData bytes = Except.ok checked ∧
+        Aiur.BoundVerifier.verifyCompiled backend input bytes = Except.ok ()
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readVector_reads
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} (encode : α → List UInt8) (values : List α),
+  values.length < 256 ^ 8 →
+    (∀ (value : α), value ∈ values → Aiur.NativeAIR.KeyCodec.Reads read (encode value) value) →
+      Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.ProofCodec.readVector read)
+        (Aiur.NativeAIR.ProofCodec.encodeVector encode values) values
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readOption_reads
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} (encode : α → List UInt8) (value : Option α),
+  (∀ (entry : α), value = some entry → Aiur.NativeAIR.KeyCodec.Reads read (encode entry) entry) →
+    Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.ProofCodec.readOption read)
+      (Aiur.NativeAIR.ProofCodec.encodeOption encode value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readBool_reads
+∀ (value : Bool),
+  Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readBool (Aiur.NativeAIR.ProofCodec.encodeBool value) value
+AXIOMS []
+ROOT Aiur.NativeAIR.ProofCodec.readField_reads
+∀ (value : Aiur.G),
+  Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readField (Aiur.NativeAIR.ProofCodec.encodeField value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readExtension_reads
+∀ (value : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readExtension
+    (Aiur.NativeAIR.ProofCodec.encodeExtension value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readCap_reads
+∀ (cap : Aiur.NativeAIR.ProofCodec.Cap),
+  Aiur.NativeAIR.ProofCodec.CapFits cap →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readCap (Aiur.NativeAIR.ProofCodec.encodeCap cap) cap
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readOpenings_reads
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} (encode : α → List UInt8),
+  (∀ (value : α), Aiur.NativeAIR.KeyCodec.Reads read (encode value) value) →
+    ∀ (values : Aiur.NativeAIR.ProofCodec.Openings α),
+      Aiur.NativeAIR.ProofCodec.OpeningsFits values →
+        Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.ProofCodec.readOpenings read)
+          (Aiur.NativeAIR.ProofCodec.encodeOpenings encode values) values
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readCommitments_reads
+∀ (value : Aiur.NativeAIR.ProofCodec.Commitments),
+  Aiur.NativeAIR.ProofCodec.CommitmentsFits value →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readCommitments
+      (Aiur.NativeAIR.ProofCodec.encodeCommitments value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readBatchOpening_reads
+∀ (value : Aiur.NativeAIR.ProofCodec.BatchOpening),
+  Aiur.NativeAIR.ProofCodec.BatchOpeningFits value →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readBatchOpening
+      (Aiur.NativeAIR.ProofCodec.encodeBatchOpening value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readCommitStep_reads
+∀ (value : Aiur.NativeAIR.ProofCodec.CommitStep),
+  Aiur.NativeAIR.ProofCodec.CommitStepFits value →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readCommitStep
+      (Aiur.NativeAIR.ProofCodec.encodeCommitStep value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readFri_reads
+∀ (value : Aiur.NativeAIR.ProofCodec.Fri),
+  Aiur.NativeAIR.ProofCodec.FriFits value →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readFri (Aiur.NativeAIR.ProofCodec.encodeFri value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readData_reads
+∀ (value : Aiur.NativeAIR.ProofCodec.Data),
+  Aiur.NativeAIR.ProofCodec.DataFits value →
+    Aiur.NativeAIR.KeyCodec.Reads Aiur.NativeAIR.ProofCodec.readData (Aiur.NativeAIR.ProofCodec.encodeData value) value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.decode_encode
+∀ (value : Aiur.NativeAIR.ProofCodec.Data),
+  Aiur.NativeAIR.ProofCodec.DataFits value →
+    Aiur.NativeAIR.ProofCodec.decode (Aiur.NativeAIR.ProofCodec.encode value) = some value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.decode_success
+∀ {bytes : ByteArray} {value : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.ProofCodec.decode bytes = some value →
+    Aiur.NativeAIR.ProofCodec.readData bytes.data.toList = some (value, [])
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.decodeCanonical_success
+∀ {bytes : ByteArray} {value : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.ProofCodec.decodeCanonical bytes = some value →
+    Aiur.NativeAIR.ProofCodec.decode bytes = some value ∧ Aiur.NativeAIR.ProofCodec.encode value = bytes
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.decodeCanonical_encode
+∀ (value : Aiur.NativeAIR.ProofCodec.Data),
+  Aiur.NativeAIR.ProofCodec.DataFits value →
+    Aiur.NativeAIR.ProofCodec.decodeCanonical (Aiur.NativeAIR.ProofCodec.encode value) = some value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.canonical_bytes_unique
+∀ {first second : ByteArray} {value : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.ProofCodec.decodeCanonical first = some value →
+    Aiur.NativeAIR.ProofCodec.decodeCanonical second = some value → first = second
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.encode_injective
+∀ {first second : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.ProofCodec.DataFits first →
+    Aiur.NativeAIR.ProofCodec.DataFits second →
+      Aiur.NativeAIR.ProofCodec.encode first = Aiur.NativeAIR.ProofCodec.encode second → first = second
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.decode_append_rejected
+∀ (value : Aiur.NativeAIR.ProofCodec.Data),
+  Aiur.NativeAIR.ProofCodec.DataFits value →
+    ∀ (suffix : List UInt8),
+      suffix ≠ [] →
+        Aiur.NativeAIR.ProofCodec.decode (Aiur.NativeAIR.ProofCodec.encodeData value ++ suffix).toByteArray = none
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readNat_returns
+∀ (count : Nat),
+  Aiur.NativeAIR.KeyCodec.Returns (Aiur.NativeAIR.KeyCodec.readNat count) fun value => value < 256 ^ count
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readVector_returns
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {property : α → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read property →
+    Aiur.NativeAIR.KeyCodec.Returns (Aiur.NativeAIR.ProofCodec.readVector read)
+      (Aiur.NativeAIR.ProofCodec.VectorFits property)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readOption_returns
+∀ {α : Type} {read : Aiur.NativeAIR.KeyCodec.Reader α} {property : α → Prop},
+  Aiur.NativeAIR.KeyCodec.Returns read property →
+    Aiur.NativeAIR.KeyCodec.Returns (Aiur.NativeAIR.ProofCodec.readOption read) fun result =>
+      ∀ (value : α), result = some value → property value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.readCap_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.ProofCodec.readCap Aiur.NativeAIR.ProofCodec.CapFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readOpenings_returns
+∀ {α : Type} (read : Aiur.NativeAIR.KeyCodec.Reader α),
+  Aiur.NativeAIR.KeyCodec.Returns (Aiur.NativeAIR.ProofCodec.readOpenings read) Aiur.NativeAIR.ProofCodec.OpeningsFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readCommitments_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.ProofCodec.readCommitments Aiur.NativeAIR.ProofCodec.CommitmentsFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readBatchOpening_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.ProofCodec.readBatchOpening Aiur.NativeAIR.ProofCodec.BatchOpeningFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readCommitStep_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.ProofCodec.readCommitStep Aiur.NativeAIR.ProofCodec.CommitStepFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readFri_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.ProofCodec.readFri Aiur.NativeAIR.ProofCodec.FriFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.readData_returns
+Aiur.NativeAIR.KeyCodec.Returns Aiur.NativeAIR.ProofCodec.readData Aiur.NativeAIR.ProofCodec.DataFits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.decode_fits
+∀ {bytes : ByteArray} {value : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.ProofCodec.decode bytes = some value → Aiur.NativeAIR.ProofCodec.DataFits value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.pair_success
+∀ {values : List (List Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.ProofShape.Pair},
+  Aiur.NativeAIR.ProofShape.pair values = some result → values = [result.current, result.next]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofShape.single_success
+∀ {α : Type u_1} {values : List α} {result : α},
+  Aiur.NativeAIR.ProofShape.single values = some result → values = [result]
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofShape.readPreprocessed_none
+∀ (proof : Aiur.NativeAIR.ProofCodec.Data), Aiur.NativeAIR.ProofShape.readPreprocessed proof none = some none
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofShape.readPreprocessed_some
+∀ {proof : Aiur.NativeAIR.ProofCodec.Data} {slot : Nat} {result : Option Aiur.NativeAIR.ProofShape.Pair},
+  Aiur.NativeAIR.ProofShape.readPreprocessed proof (some slot) = some result →
+    ∃ values opened,
+      proof.preprocessed = some opened ∧ opened[slot]? = some [values.current, values.next] ∧ result = some values
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.readRow_success
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data} {index position : Nat}
+  {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.readRow key proof index position = some row →
+    Aiur.NativeAIR.ProofShape.Row.Sourced key proof index position row
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.Pair.hasWidth_success
+∀ {values : Aiur.NativeAIR.ProofShape.Pair} {width : Nat},
+  values.hasWidth width = true → values.current.length = width ∧ values.next.length = width
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.Row.fits_success
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.fits parameters row = true → Aiur.NativeAIR.ProofShape.Row.Fits parameters row
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.check_success
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data}
+  {result : List Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.check key proof = some result →
+    Aiur.NativeAIR.ProofShape.header key proof = true ∧
+      Aiur.NativeAIR.ProofShape.inactivePreprocessed key proof = true ∧
+        Aiur.NativeAIR.ProofShape.rows key proof = some result ∧
+          ∀ (row : Aiur.NativeAIR.ProofShape.Row), row ∈ result → Aiur.NativeAIR.ProofShape.Row.Fits key.parameters row
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.check_length
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data}
+  {result : List Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.check key proof = some result →
+    result.length = (Aiur.NativeAIR.ProofShape.activeIndices proof).length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.activeIndices_mem
+∀ {proof : Aiur.NativeAIR.ProofCodec.Data} {index : Nat},
+  index ∈ Aiur.NativeAIR.ProofShape.activeIndices proof ↔ proof.active[index]? = some true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.check_row
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data}
+  {result : List Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.check key proof = some result →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      result[position]? = some row →
+        ∃ index,
+          (Aiur.NativeAIR.ProofShape.activeIndices proof)[position]? = some index ∧
+            Aiur.NativeAIR.ProofShape.Row.Sourced key proof index position row ∧
+              Aiur.NativeAIR.ProofShape.Row.Fits key.parameters row
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.check_row_active
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data}
+  {result : List Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.check key proof = some result →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      result[position]? = some row → proof.active[row.circuitIndex]? = some true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.check_nonempty
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data}
+  {result : List Aiur.NativeAIR.ProofShape.Row}, Aiur.NativeAIR.ProofShape.check key proof = some result → result ≠ []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.fixedHeights_sound
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.ProofShape.fixedHeights key proof = true →
+    Aiur.FixedTraceHeights (List.map (fun x => x.preprocessedHeight) key.circuits) proof.active
+      (List.map UInt8.toNat proof.logDegrees)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofShape.queryBound_sound
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data} {bound : Nat},
+  Aiur.NativeAIR.ProofShape.queryBound key proof = some bound →
+    ∃ total,
+      Aiur.lookupSlotSum (List.map (fun x => x.graph.lookups.length) key.circuits) proof.active
+            (List.map UInt8.toNat proof.logDegrees) =
+          some total ∧
+        bound = 1 + total ∧ bound < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.framing
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes),
+  Aiur.NativeAIR.ProofCodec.readData bytes.data.toList = some (checked.data, []) ∧
+    Aiur.NativeAIR.ProofCodec.encode checked.data = bytes
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.wire_bounds
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes),
+  Aiur.NativeAIR.ProofCodec.DataFits checked.data
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.row
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes)
+  {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+  checked.rows[position]? = some row →
+    checked.data.active[row.circuitIndex]? = some true ∧
+      Aiur.NativeAIR.ProofShape.Row.Sourced key checked.data row.circuitIndex position row ∧
+        Aiur.NativeAIR.ProofShape.Row.Fits key.parameters row
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.nonempty
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes),
+  checked.rows ≠ []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.fixed_heights
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes),
+  Aiur.FixedTraceHeights (List.map (fun x => x.preprocessedHeight) key.circuits) checked.data.active
+    (List.map UInt8.toNat checked.data.logDegrees)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.lookup_budget
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes),
+  ∃ total,
+    Aiur.lookupSlotSum (List.map (fun x => x.graph.lookups.length) key.circuits) checked.data.active
+          (List.map UInt8.toNat checked.data.logDegrees) =
+        some total ∧
+      checked.bound = 1 + total ∧ checked.bound < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.verifyShaped_acceptance
+∀ {selection : Aiur.BoundVerifier.Selection} {backend : Aiur.BoundVerifier.CompiledBackend selection}
+  {input : Array Aiur.G} {bytes : ByteArray},
+  Aiur.BoundVerifier.verifyShaped backend input bytes = Except.ok () →
+    input.size = selection.inputSize ∧
+      ∃ checked native,
+        Aiur.BoundVerifier.readProof backend.keyData bytes = Except.ok checked ∧
+          Aiur.Proof.ofBytesChecked bytes = Except.ok native ∧
+            backend.system.verify (Aiur.buildClaim selection.function input selection.success) native = Except.ok ()
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.residue_injective
+∀ {a b : Aiur.G}, a.residue = b.residue → a = b
+AXIOMS []
+ROOT Aiur.G.residue_ofNat
+∀ (n : Nat), (Aiur.G.ofNat n).residue = Fin.ofNat Aiur.gSize.toNat n
+AXIOMS [propext]
+ROOT Aiur.G.residue_add
+∀ (a b : Aiur.G), (a + b).residue = a.residue + b.residue
+AXIOMS [propext]
+ROOT Aiur.G.residue_mul
+∀ (a b : Aiur.G), (a * b).residue = a.residue * b.residue
+AXIOMS [propext]
+ROOT Aiur.G.residue_sub
+∀ (a b : Aiur.G), (a - b).residue = a.residue - b.residue
+AXIOMS [propext]
+ROOT Aiur.G.residue_numeral
+∀ (n : Nat), Aiur.G.residue (OfNat.ofNat n) = OfNat.ofNat n
+AXIOMS [propext]
+ROOT Aiur.G.residue_zero
+Aiur.G.residue 0 = 0
+AXIOMS [propext]
+ROOT Aiur.G.residue_one
+Aiur.G.residue 1 = 1
+AXIOMS [propext]
+ROOT Aiur.G.residue_neg
+∀ (a : Aiur.G), (-a).residue = -a.residue
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.residue_ofInt
+∀ (n : Int), (Aiur.G.ofInt n).residue = ↑n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.left_distrib
+∀ (a b c : Aiur.G), a * (b + c) = a * b + a * c
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.neg_add_cancel
+∀ (a : Aiur.G), -a + a = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.sub_eq_add_neg
+∀ (a b : Aiur.G), a - b = a + -b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.ofInt_neg
+∀ (n : Int), Aiur.G.ofInt (-n) = -Aiur.G.ofInt n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.neg_mul
+∀ (a b : Aiur.G), -a * b = -(a * b)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.pow_go_eq
+∀ (a : Aiur.G) (n fuel : Nat), n < 2 ^ fuel → Aiur.G.pow.go✝ a n fuel = a ^ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.pow_eq
+∀ (a : Aiur.G) (n : Nat), n < 2 ^ 64 → a.pow n = a ^ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.inverse_eq_power
+∀ (a : Aiur.G), a.inverse = a ^ (Aiur.gSize.toNat - 2)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.n_power
+∀ (a : Aiur.G) (n : Nat), (a ^ n).n = a.n ^ n % Aiur.gSize.toNat
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.mul_right_cancel
+∀ {a b c : Aiur.G}, c ≠ 0 → a * c = b * c → a = b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.nonzeroResidues_length
+Aiur.G.nonzeroResidues.length = Aiur.gSize.toNat - 1
+AXIOMS [propext]
+ROOT Aiur.G.mem_nonzeroResidues
+∀ (a : Aiur.G), a ∈ Aiur.G.nonzeroResidues ↔ a ≠ 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.G.nonzeroResidues_nodup
+Aiur.G.nonzeroResidues.Nodup
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.G.map_perm_of_injective
+∀ (values : List Aiur.G) (f : Aiur.G → Aiur.G),
+  values.Nodup → (∀ {x y : Aiur.G}, f x = f y → x = y) → List.map f values ⊆ values → (List.map f values).Perm values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.multiplication_perm
+∀ (a : Aiur.G), a ≠ 0 → (List.map (fun x => a * x) Aiur.G.nonzeroResidues).Perm Aiur.G.nonzeroResidues
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.product_nonzero
+∀ (values : List Aiur.G), (∀ (x : Aiur.G), x ∈ values → x ≠ 0) → Aiur.G.product values ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.product_perm
+∀ {left right : List Aiur.G}, left.Perm right → Aiur.G.product left = Aiur.G.product right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.product_map_mul
+∀ (a : Aiur.G) (values : List Aiur.G),
+  Aiur.G.product (List.map (fun x => a * x) values) = a ^ values.length * Aiur.G.product values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.power_eq_one_of_perm
+∀ (a : Aiur.G) (values : List Aiur.G),
+  (∀ (x : Aiur.G), x ∈ values → x ≠ 0) → (List.map (fun x => a * x) values).Perm values → a ^ values.length = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.fermat
+∀ (a : Aiur.G), a ≠ 0 → a ^ (Aiur.gSize.toNat - 1) = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.inverse_zero
+Aiur.G.inverse 0 = 0
+AXIOMS [propext]
+ROOT Aiur.G.mul_inverse_cancel
+∀ (a : Aiur.G), a ≠ 0 → a * a.inverse = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ext
+∀ {a b : Aiur.NativeAIR.ProofCodec.Extension}, a.c0 = b.c0 → a.c1 = b.c1 → a = b
+AXIOMS []
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ofBase_injective
+∀ {a b : Aiur.G}, Aiur.NativeAIR.ProofCodec.Extension.ofBase a = Aiur.NativeAIR.ProofCodec.Extension.ofBase b → a = b
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ofBase_add
+∀ (a b : Aiur.G),
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase (a + b) =
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase a + Aiur.NativeAIR.ProofCodec.Extension.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ofBase_sub
+∀ (a b : Aiur.G),
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase (a - b) =
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase a - Aiur.NativeAIR.ProofCodec.Extension.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ofBase_neg
+∀ (a : Aiur.G), Aiur.NativeAIR.ProofCodec.Extension.ofBase (-a) = -Aiur.NativeAIR.ProofCodec.Extension.ofBase a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ofBase_mul
+∀ (a b : Aiur.G),
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase (a * b) =
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase a * Aiur.NativeAIR.ProofCodec.Extension.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.add_zero
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), a + 0 = a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.add_comm
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), a + b = b + a
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.add_assoc
+∀ (a b c : Aiur.NativeAIR.ProofCodec.Extension), a + b + c = a + (b + c)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.mul_one
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), a * 1 = a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.zero_mul
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), 0 * a = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.mul_comm
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), a * b = b * a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.mul_assoc
+∀ (a b c : Aiur.NativeAIR.ProofCodec.Extension), a * b * c = a * (b * c)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.left_distrib
+∀ (a b c : Aiur.NativeAIR.ProofCodec.Extension), a * (b + c) = a * b + a * c
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.neg_add_cancel
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), -a + a = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.sub_eq_add_neg
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), a - b = a + -b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.neg_mul
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), -a * b = -(a * b)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.basis_square
+Aiur.NativeAIR.ProofCodec.Extension.basis * Aiur.NativeAIR.ProofCodec.Extension.basis =
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase 7
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.coordinates
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension),
+  a =
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase a.c0 +
+      Aiur.NativeAIR.ProofCodec.Extension.ofBase a.c1 * Aiur.NativeAIR.ProofCodec.Extension.basis
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.scale_eq_mul
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension) (b : Aiur.G), a.scale b = a * Aiur.NativeAIR.ProofCodec.Extension.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.conjugate_conjugate
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), a.conjugate.conjugate = a
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.mul_conjugate
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), a * a.conjugate = Aiur.NativeAIR.ProofCodec.Extension.ofBase a.norm
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.conjugate_mul
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), (a * b).conjugate = a.conjugate * b.conjugate
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.norm_mul
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), (a * b).norm = a.norm * b.norm
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.evalLaws
+Aiur.NativeAIR.EvalLaws Aiur.NativeAIR.ProofCodec.Extension.evalOps
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.powBits_eq
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension) (n fuel : Nat), n < 2 ^ fuel → a.powBits n fuel = a ^ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.power_eq
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension) (n : Nat), a.power n = a ^ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.ofBase_power
+∀ (a : Aiur.G) (n : Nat),
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase (a ^ n) = Aiur.NativeAIR.ProofCodec.Extension.ofBase a ^ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.inverse_formula
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension),
+  a.tryInverse =
+    if a = 0 then none
+    else some (a.conjugate * Aiur.NativeAIR.ProofCodec.Extension.ofBase (a.norm ^ (Aiur.gSize.toNat - 2)))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.seven_euler_certificate
+Aiur.G.pow 7 ((Aiur.gSize.toNat - 1) / 2) = 0 - 1
+AXIOMS [propext]
+ROOT Aiur.G.seven_not_square
+∀ (a : Aiur.G), a * a ≠ 7
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.G.square_ratio
+∀ (x y inverse : Aiur.G), x * x = 7 * (y * y) → y * inverse = 1 → x * inverse * (x * inverse) = 7
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.norm_zero_iff
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), a.norm = 0 ↔ a = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.mul_eq_zero_iff
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), a * b = 0 ↔ a = 0 ∨ b = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.one_ne_zero
+1 ≠ 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.mul_left_cancel
+∀ {a b c : Aiur.NativeAIR.ProofCodec.Extension}, a ≠ 0 → a * b = a * c → b = c
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.inverse_correct
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension),
+  a ≠ 0 → a.tryInverse = some (a.conjugate.scale a.norm.inverse) ∧ a * a.conjugate.scale a.norm.inverse = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.tryInverse_none_iff
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), a.tryInverse = none ↔ a = 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ProofCodec.Extension.tryInverse_some_iff
+∀ (a b : Aiur.NativeAIR.ProofCodec.Extension), a.tryInverse = some b ↔ a * b = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.ext
+∀ {W : Type u_1} {a b : Aiur.NativeAIR.LogUp.Coordinates W}, a.c0 = b.c0 → a.c1 = b.c1 → a = b
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.Coordinates.zero_iff
+∀ {W : Type u_1} [inst : OfNat W 0] (a : Aiur.NativeAIR.LogUp.Coordinates W), a = 0 ↔ a.c0 = 0 ∧ a.c1 = 0
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.Coordinates.flatten_length
+∀ {W : Type u_1} (values : List (Aiur.NativeAIR.LogUp.Coordinates W)),
+  (Aiur.NativeAIR.LogUp.Coordinates.flatten values).length = 2 * values.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.flatten_zero_iff
+∀ {W : Type u_1} [inst : OfNat W 0] (values : List (Aiur.NativeAIR.LogUp.Coordinates W)),
+  (∀ (x : W), x ∈ Aiur.NativeAIR.LogUp.Coordinates.flatten values → x = 0) ↔
+    ∀ (value : Aiur.NativeAIR.LogUp.Coordinates W), value ∈ values → value = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.mul_schoolbook
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : Aiur.NativeAIR.LogUp.Coordinates W),
+  a * b = { c0 := a.c0 * b.c0 + 7 * a.c1 * b.c1, c1 := a.c0 * b.c1 + a.c1 * b.c0 }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.add_zero
+∀ {W : Type u} [inst : Grind.CommRing W] (a : Aiur.NativeAIR.LogUp.Coordinates W), a + 0 = a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.add_comm
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : Aiur.NativeAIR.LogUp.Coordinates W), a + b = b + a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.add_assoc
+∀ {W : Type u} [inst : Grind.CommRing W] (a b c : Aiur.NativeAIR.LogUp.Coordinates W), a + b + c = a + (b + c)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.mul_one
+∀ {W : Type u} [inst : Grind.CommRing W] (a : Aiur.NativeAIR.LogUp.Coordinates W), a * 1 = a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.mul_zero
+∀ {W : Type u} [inst : Grind.CommRing W] (a : Aiur.NativeAIR.LogUp.Coordinates W), a * 0 = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.mul_comm
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : Aiur.NativeAIR.LogUp.Coordinates W), a * b = b * a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.mul_assoc
+∀ {W : Type u} [inst : Grind.CommRing W] (a b c : Aiur.NativeAIR.LogUp.Coordinates W), a * b * c = a * (b * c)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.left_distrib
+∀ {W : Type u} [inst : Grind.CommRing W] (a b c : Aiur.NativeAIR.LogUp.Coordinates W), a * (b + c) = a * b + a * c
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.neg_add_cancel
+∀ {W : Type u} [inst : Grind.CommRing W] (a : Aiur.NativeAIR.LogUp.Coordinates W), -a + a = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.sub_eq_add_neg
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : Aiur.NativeAIR.LogUp.Coordinates W), a - b = a + -b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.ofBase_add
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : W),
+  Aiur.NativeAIR.LogUp.Coordinates.ofBase (a + b) =
+    Aiur.NativeAIR.LogUp.Coordinates.ofBase a + Aiur.NativeAIR.LogUp.Coordinates.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.ofBase_neg
+∀ {W : Type u} [inst : Grind.CommRing W] (a : W),
+  Aiur.NativeAIR.LogUp.Coordinates.ofBase (-a) = -Aiur.NativeAIR.LogUp.Coordinates.ofBase a
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.ofBase_mul
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : W),
+  Aiur.NativeAIR.LogUp.Coordinates.ofBase (a * b) =
+    Aiur.NativeAIR.LogUp.Coordinates.ofBase a * Aiur.NativeAIR.LogUp.Coordinates.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.neg_mul
+∀ {W : Type u} [inst : Grind.CommRing W] (a b : Aiur.NativeAIR.LogUp.Coordinates W), -a * b = -(a * b)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.scale_eq_mul
+∀ {W : Type u} [inst : Grind.CommRing W] (a : Aiur.NativeAIR.LogUp.Coordinates W) (b : W),
+  a.scale b = a * Aiur.NativeAIR.LogUp.Coordinates.ofBase b
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_injective
+∀ {a b : Aiur.NativeAIR.LogUp.Coordinates Aiur.G}, a.toExtension = b.toExtension → a = b
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_fromExtension
+∀ (a : Aiur.NativeAIR.ProofCodec.Extension), (Aiur.NativeAIR.LogUp.Coordinates.fromExtension a).toExtension = a
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.Coordinates.fromExtension_toExtension
+∀ (a : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), Aiur.NativeAIR.LogUp.Coordinates.fromExtension a.toExtension = a
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_zero_iff
+∀ (a : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), a.toExtension = 0 ↔ a = 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_ofBase
+∀ (a : Aiur.G), (Aiur.NativeAIR.LogUp.Coordinates.ofBase a).toExtension = Aiur.NativeAIR.ProofCodec.Extension.ofBase a
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_add
+∀ (a b : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), (a + b).toExtension = a.toExtension + b.toExtension
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_sub
+∀ (a b : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), (a - b).toExtension = a.toExtension - b.toExtension
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.toExtension_mul
+∀ (a b : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), (a * b).toExtension = a.toExtension * b.toExtension
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.Coordinates.collapse_loses_constraint
+have a := { c0 := -Aiur.NativeAIR.ProofCodec.Extension.basis, c1 := 1 };
+a ≠ 0 ∧ a.c0 + a.c1 * Aiur.NativeAIR.ProofCodec.Extension.basis = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.sub_zero_iff
+∀ {R : Type u} [inst : Grind.CommRing R] (left right : R), left - right = 0 ↔ left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.clears_cons
+∀ {R : Type u} [inst : Grind.CommRing R] (weight message inverse denominator fractions cleared : R),
+  message * inverse = 1 →
+    denominator * fractions = cleared →
+      message * denominator * (weight * inverse + fractions) = weight * denominator + message * cleared
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.product_cons
+∀ {R : Type u} [inst : Grind.CommRing R] (value : R) (values : List R),
+  Aiur.NativeAIR.LogUp.product (value :: values) = value * Aiur.NativeAIR.LogUp.product values
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.product_append
+∀ {R : Type u} [inst : Grind.CommRing R] (left right : List R),
+  Aiur.NativeAIR.LogUp.product (left ++ right) = Aiur.NativeAIR.LogUp.product left * Aiur.NativeAIR.LogUp.product right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.product_foldl
+∀ {R : Type u} [inst : Grind.CommRing R] (values : List R) (initial : R),
+  List.foldl (fun x1 x2 => x1 * x2) initial values = initial * Aiur.NativeAIR.LogUp.product values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.sum_foldl
+∀ {R : Type u} [inst : Grind.CommRing R] (values : List R) (initial : R),
+  List.foldl (fun x1 x2 => x1 + x2) initial values = initial + Aiur.NativeAIR.LogUp.sum values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.sum_append
+∀ {R : Type u} [inst : Grind.CommRing R] (left right : List R),
+  Aiur.NativeAIR.LogUp.sum (left ++ right) = Aiur.NativeAIR.LogUp.sum left + Aiur.NativeAIR.LogUp.sum right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.telescope
+∀ {R : Type u} [inst : Grind.CommRing R] (states increments : Nat → R) (count : Nat),
+  (∀ (index : Nat), index < count → states (index + 1) - states index = increments index) →
+    states count - states 0 = Aiur.NativeAIR.LogUp.sum (List.map increments (List.range count))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.cyclic_accumulator
+∀ {R : Type u} [inst : Grind.CommRing R] (states fractions : Nat → R) (count : Nat) (delta : R),
+  0 < count →
+    states count = states 0 →
+      (∀ (index : Nat),
+          index < count →
+            (states (index + 1) - states index + if index + 1 = count then delta else 0) = fractions index) →
+        Aiur.NativeAIR.LogUp.sum (List.map fractions (List.range count)) = delta
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.final_accumulator
+∀ {R : Type u} [inst : Grind.CommRing R] (accumulators contributions : Nat → R) (count : Nat),
+  accumulators count = 0 →
+    (∀ (index : Nat), index < count → accumulators (index + 1) - accumulators index = contributions index) →
+      accumulators 0 + Aiur.NativeAIR.LogUp.sum (List.map contributions (List.range count)) = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.prefix_products
+∀ {R : Type u} [inst : Grind.CommRing R] (values : List R) (initial : R) (index : Nat),
+  (List.scanl (fun x1 x2 => x1 * x2) initial values)[index]? =
+    if index ≤ values.length then some (initial * Aiur.NativeAIR.LogUp.product (List.take index values)) else none
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.prefix_seeded
+∀ {R : Type u} [inst : Grind.CommRing R] (first : R) (rest : List R),
+  List.scanl (fun x1 x2 => x1 * x2) 1 (first :: rest) = 1 :: List.scanl (fun x1 x2 => x1 * x2) first rest
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.suffix_seeded
+∀ {R : Type u} [inst : Grind.CommRing R] (rest : List R) (last : R),
+  List.scanr (fun x1 x2 => x1 * x2) 1 (rest ++ [last]) = List.scanr (fun x1 x2 => x1 * x2) last rest ++ [1]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.suffix_products
+∀ {R : Type u} [inst : Grind.CommRing R] (values : List R) (index : Nat),
+  (List.scanr (fun x1 x2 => x1 * x2) 1 values)[index]? =
+    if index ≤ values.length then some (Aiur.NativeAIR.LogUp.product (List.drop index values)) else none
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.prefixSuffixTerms_cons
+∀ {R : Type u} [inst : Grind.CommRing R] (weight message initial : R) (entries : List (R × R)),
+  Aiur.NativeAIR.LogUp.prefixSuffixTerms initial ((weight, message) :: entries) =
+    initial * Aiur.NativeAIR.LogUp.product (List.map Prod.snd entries) * weight ::
+      Aiur.NativeAIR.LogUp.prefixSuffixTerms (initial * message) entries
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.prefixSuffixTerms_sum
+∀ {R : Type u} [inst : Grind.CommRing R] (entries : List (R × R)) (initial : R),
+  Aiur.NativeAIR.LogUp.sum (Aiur.NativeAIR.LogUp.prefixSuffixTerms initial entries) =
+    initial * Aiur.NativeAIR.LogUp.numerator entries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupEquation_polynomial
+∀ {R : Type u} [inst : Grind.CommRing R] (entries : List (R × R)) (difference : R),
+  Aiur.NativeAIR.LogUp.groupEquation entries difference =
+    Aiur.NativeAIR.LogUp.product (List.map Prod.snd entries) * difference - Aiur.NativeAIR.LogUp.numerator entries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.numerator_append
+∀ {R : Type u} [inst : Grind.CommRing R] (left right : List (R × R)),
+  Aiur.NativeAIR.LogUp.numerator (left ++ right) =
+    Aiur.NativeAIR.LogUp.numerator left * Aiur.NativeAIR.LogUp.product (List.map Prod.snd right) +
+      Aiur.NativeAIR.LogUp.product (List.map Prod.snd left) * Aiur.NativeAIR.LogUp.numerator right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fingerprint_reverse_horner
+∀ {W : Type u} [inst : Grind.CommRing W] (gamma : Aiur.NativeAIR.LogUp.Coordinates W) (args : List W),
+  Aiur.NativeAIR.LogUp.fingerprint gamma args =
+    List.foldl (fun acc arg => acc * gamma + Aiur.NativeAIR.LogUp.Coordinates.ofBase arg) 0 args.reverse
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fingerprint_nil
+∀ {W : Type u} [inst : Grind.CommRing W] (gamma : Aiur.NativeAIR.LogUp.Coordinates W),
+  Aiur.NativeAIR.LogUp.fingerprint gamma [] = 0
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.fingerprint_cons
+∀ {W : Type u} [inst : Grind.CommRing W] (gamma : Aiur.NativeAIR.LogUp.Coordinates W) (arg : W) (args : List W),
+  Aiur.NativeAIR.LogUp.fingerprint gamma (arg :: args) =
+    Aiur.NativeAIR.LogUp.fingerprint gamma args * gamma + Aiur.NativeAIR.LogUp.Coordinates.ofBase arg
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.fingerprint_trailing_zero
+∀ {W : Type u} [inst : Grind.CommRing W] (gamma : Aiur.NativeAIR.LogUp.Coordinates W) (args : List W),
+  Aiur.NativeAIR.LogUp.fingerprint gamma (args ++ [0]) = Aiur.NativeAIR.LogUp.fingerprint gamma args
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fingerprint_padding
+∀ {W : Type u} [inst : Grind.CommRing W] (gamma : Aiur.NativeAIR.LogUp.Coordinates W) (args : List W) (count : Nat),
+  Aiur.NativeAIR.LogUp.fingerprint gamma (args ++ List.replicate count 0) = Aiur.NativeAIR.LogUp.fingerprint gamma args
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupCount_positive
+∀ (groupSize lookupCount : Nat), 0 < Aiur.NativeAIR.LogUp.groupCount groupSize lookupCount
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupCount_covers
+∀ (groupSize lookupCount : Nat), lookupCount ≤ Aiur.NativeAIR.LogUp.groupCount groupSize lookupCount * max groupSize 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupCount_zero
+∀ (lookupCount : Nat), Aiur.NativeAIR.LogUp.groupCount 0 lookupCount = Aiur.NativeAIR.LogUp.groupCount 1 lookupCount
+AXIOMS []
+ROOT Aiur.NativeAIR.LogUp.groupCount_empty
+∀ (groupSize : Nat), Aiur.NativeAIR.LogUp.groupCount groupSize 0 = 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupCount_key
+∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit),
+  0 < circuit.lookupGroupSize →
+    Aiur.NativeAIR.LogUp.groupCount circuit.lookupGroupSize circuit.graph.lookups.length = circuit.groups
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.chunk_length
+∀ {α : Type u_1} (groupSize index : Nat) (values : List α),
+  (Aiur.NativeAIR.LogUp.chunk groupSize index values).length =
+    min (max groupSize 1) (values.length - index * max groupSize 1)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.chunks_take
+∀ {α : Type u_1} (groupSize count : Nat) (values : List α),
+  List.flatMap (fun index => Aiur.NativeAIR.LogUp.chunk groupSize index values) (List.range count) =
+    List.take (count * max groupSize 1) values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.chunks_cover
+∀ {α : Type u_1} (groupSize : Nat) (values : List α),
+  List.flatMap (fun index => Aiur.NativeAIR.LogUp.chunk groupSize index values)
+      (List.range (Aiur.NativeAIR.LogUp.groupCount groupSize values.length)) =
+    values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.chunk_mem
+∀ {α : Type u_1} {groupSize index : Nat} {values : List α} {value : α},
+  value ∈ Aiur.NativeAIR.LogUp.chunk groupSize index values → value ∈ values
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.chunk_map
+∀ {α : Type u_1} {β : Type u_2} (groupSize index : Nat) (values : List α) (f : α → β),
+  Aiur.NativeAIR.LogUp.chunk groupSize index (List.map f values) =
+    List.map f (Aiur.NativeAIR.LogUp.chunk groupSize index values)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.mapM_some_reads
+∀ {α : Type u_1} {β : Type u_2} {read : α → Option β} {inputs : List α} {outputs : List β},
+  List.mapM read inputs = some outputs →
+    outputs.length = inputs.length ∧
+      ∀ (index : Nat) (input : α),
+        inputs[index]? = some input → ∃ output, outputs[index]? = some output ∧ read input = some output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.mapM_defined
+∀ {α : Type u_1} {β : Type u_2} (inputs : List α) (read : α → Option β),
+  (∀ (input : α), input ∈ inputs → ∃ output, read input = some output) → ∃ outputs, List.mapM read inputs = some outputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.read_coordinates_defined
+∀ {W : Type u_1} (values : Array W) (slot : Nat),
+  2 * slot + 1 < values.size → ∃ value, Aiur.NativeAIR.LogUp.Coordinates.read values slot = some value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.read_coordinates_success
+∀ {W : Type u_1} {values : Array W} {slot : Nat} {value : Aiur.NativeAIR.LogUp.Coordinates W},
+  Aiur.NativeAIR.LogUp.Coordinates.read values slot = some value →
+    values[2 * slot]? = some value.c0 ∧ values[2 * slot + 1]? = some value.c1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.step_polynomial
+∀ {W : Type u} [inst : Grind.CommRing W] {beta gamma injection next : Aiur.NativeAIR.LogUp.Coordinates W}
+  {stageCurrent : Array W} {lookups : List (W × List W)} {groupSize index : Nat}
+  {result : Aiur.NativeAIR.LogUp.Coordinates W},
+  Aiur.NativeAIR.LogUp.step beta gamma injection next stageCurrent lookups groupSize index = some result →
+    ∃ source target,
+      Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent index = some source ∧
+        (if index + 1 < Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length then
+              Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent (index + 1)
+            else some (next + injection)) =
+            some target ∧
+          result =
+            Aiur.NativeAIR.LogUp.product
+                  (List.map Prod.snd
+                    (Aiur.NativeAIR.LogUp.compress beta gamma (Aiur.NativeAIR.LogUp.chunk groupSize index lookups))) *
+                (target - source) -
+              Aiur.NativeAIR.LogUp.numerator
+                (Aiur.NativeAIR.LogUp.compress beta gamma (Aiur.NativeAIR.LogUp.chunk groupSize index lookups))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.step_defined
+∀ {W : Type u} [inst : Grind.CommRing W] (beta gamma injection next : Aiur.NativeAIR.LogUp.Coordinates W)
+  (stageCurrent : Array W) (lookups : List (W × List W)) (groupSize index : Nat),
+  Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length * 2 ≤ stageCurrent.size →
+    index < Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length →
+      ∃ result, Aiur.NativeAIR.LogUp.step beta gamma injection next stageCurrent lookups groupSize index = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.equations_success
+∀ {W : Type u} [inst : Grind.CommRing W] {lookups : List (W × List W)}
+  {stageCurrent stageNext publics deltaScaled : Array W} {isLast : W} {groupSize : Nat}
+  {result : List (Aiur.NativeAIR.LogUp.Coordinates W)},
+  Aiur.NativeAIR.LogUp.equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result →
+    groupSize ≤ 8 ∧
+      ∃ beta gamma delta next,
+        Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta ∧
+          Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma ∧
+            Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 = some delta ∧
+              Aiur.NativeAIR.LogUp.Coordinates.read stageNext 0 = some next ∧
+                result.length = Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length ∧
+                  ∀ (index : Nat),
+                    index < Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length →
+                      ∃ value,
+                        result[index]? = some value ∧
+                          Aiur.NativeAIR.LogUp.step beta gamma (delta.scale isLast) next stageCurrent lookups groupSize
+                              index =
+                            some value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.equations_defined
+∀ {W : Type u} [inst : Grind.CommRing W] (lookups : List (W × List W))
+  (stageCurrent stageNext publics deltaScaled : Array W) (isLast : W) (groupSize : Nat),
+  groupSize ≤ 8 →
+    Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length * 2 ≤ stageCurrent.size →
+      2 ≤ stageNext.size →
+        4 ≤ publics.size →
+          2 ≤ deltaScaled.size →
+            ∃ result,
+              Aiur.NativeAIR.LogUp.equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize =
+                some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.equations_zero
+∀ {W : Type u} [inst : Grind.CommRing W] {lookups : List (W × List W)}
+  {stageCurrent stageNext publics deltaScaled : Array W} {isLast : W} {groupSize : Nat}
+  {result : List (Aiur.NativeAIR.LogUp.Coordinates W)},
+  Aiur.NativeAIR.LogUp.equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result →
+    (∀ (value : Aiur.NativeAIR.LogUp.Coordinates W), value ∈ result → value = 0) →
+      ∃ beta gamma delta next,
+        Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta ∧
+          Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma ∧
+            Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 = some delta ∧
+              Aiur.NativeAIR.LogUp.Coordinates.read stageNext 0 = some next ∧
+                ∀ (index : Nat),
+                  index < Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length →
+                    ∃ source target,
+                      Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent index = some source ∧
+                        (if index + 1 < Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length then
+                              Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent (index + 1)
+                            else some (next + delta.scale isLast)) =
+                            some target ∧
+                          Aiur.NativeAIR.LogUp.product
+                                (List.map Prod.snd
+                                  (Aiur.NativeAIR.LogUp.compress beta gamma
+                                    (Aiur.NativeAIR.LogUp.chunk groupSize index lookups))) *
+                              (target - source) =
+                            Aiur.NativeAIR.LogUp.numerator
+                              (Aiur.NativeAIR.LogUp.compress beta gamma
+                                (Aiur.NativeAIR.LogUp.chunk groupSize index lookups))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.constraintValues_success
+∀ {W : Type u} [inst : Grind.CommRing W] {lookups : List Aiur.NativeAIR.Lookup}
+  {nodeValues stageCurrent stageNext publics deltaScaled : Array W} {isLast : W} {groupSize : Nat} {result : List W},
+  Aiur.NativeAIR.LogUp.constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast groupSize =
+      some result →
+    ∃ values coordinates,
+      List.mapM (Aiur.NativeAIR.readLookup nodeValues) lookups = some values ∧
+        Aiur.NativeAIR.LogUp.equations values stageCurrent stageNext publics deltaScaled isLast groupSize =
+            some coordinates ∧
+          result = Aiur.NativeAIR.LogUp.Coordinates.flatten coordinates
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.constraintValues_length
+∀ {W : Type u} [inst : Grind.CommRing W] {lookups : List Aiur.NativeAIR.Lookup}
+  {nodeValues stageCurrent stageNext publics deltaScaled : Array W} {isLast : W} {groupSize : Nat} {result : List W},
+  Aiur.NativeAIR.LogUp.constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast groupSize =
+      some result →
+    result.length = 2 * Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.constraintValues_defined
+∀ {W : Type u} [inst : Grind.CommRing W] (lookups : List Aiur.NativeAIR.Lookup)
+  (nodeValues stageCurrent stageNext publics deltaScaled : Array W) (isLast : W) (groupSize : Nat),
+  groupSize ≤ 8 →
+    (∀ (lookup : Aiur.NativeAIR.Lookup),
+        lookup ∈ lookups → ∀ (index : Nat), index ∈ lookup.roots → index < nodeValues.size) →
+      Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length * 2 ≤ stageCurrent.size →
+        2 ≤ stageNext.size →
+          4 ≤ publics.size →
+            2 ≤ deltaScaled.size →
+              ∃ result,
+                Aiur.NativeAIR.LogUp.constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled
+                    isLast groupSize =
+                  some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.constraintValues_reflect
+∀ {W : Type u} [inst : Grind.CommRing W] {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W}
+  {trees : Array Aiur.NativeAIR.Expr} {buffer : Array W},
+  Aiur.NativeAIR.Reflects ops values trees buffer →
+    ∀ (lookups : List Aiur.NativeAIR.Lookup) (stageCurrent stageNext publics deltaScaled : Array W) (isLast : W)
+      (groupSize : Nat),
+      Aiur.NativeAIR.LogUp.constraintValues lookups buffer stageCurrent stageNext publics deltaScaled isLast groupSize =
+        do
+        let lookupValues ← List.mapM (Aiur.NativeAIR.evalLookup ops values trees) lookups
+        let __do_lift ←
+          Aiur.NativeAIR.LogUp.equations lookupValues stageCurrent stageNext publics deltaScaled isLast groupSize
+        pure (Aiur.NativeAIR.LogUp.Coordinates.flatten __do_lift)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.inverseValue_correct
+∀ (value : Aiur.NativeAIR.ProofCodec.Extension), value ≠ 0 → value * Aiur.NativeAIR.LogUp.inverseValue value = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.product_nonzero
+∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+  (∀ (value : Aiur.NativeAIR.ProofCodec.Extension), value ∈ values → value ≠ 0) →
+    Aiur.NativeAIR.LogUp.product values ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.poleFree_product
+∀ (entries : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.LogUp.PoleFree entries → Aiur.NativeAIR.LogUp.product (List.map Prod.snd entries) ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fractionSum_cons
+∀ (weight message : Aiur.NativeAIR.ProofCodec.Extension)
+  (entries : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.LogUp.fractionSum ((weight, message) :: entries) =
+    weight * Aiur.NativeAIR.LogUp.inverseValue message + Aiur.NativeAIR.LogUp.fractionSum entries
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.fractionSum_append
+∀ (left right : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.LogUp.fractionSum (left ++ right) =
+    Aiur.NativeAIR.LogUp.fractionSum left + Aiur.NativeAIR.LogUp.fractionSum right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fractionSum_clears
+∀ (entries : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.LogUp.PoleFree entries →
+    Aiur.NativeAIR.LogUp.product (List.map Prod.snd entries) * Aiur.NativeAIR.LogUp.fractionSum entries =
+      Aiur.NativeAIR.LogUp.numerator entries
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupEquation_zero_iff
+∀ (entries : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension))
+  (difference : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.LogUp.PoleFree entries →
+    (Aiur.NativeAIR.LogUp.groupEquation entries difference = 0 ↔ difference = Aiur.NativeAIR.LogUp.fractionSum entries)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.product_toExtension
+∀ (values : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G)),
+  (Aiur.NativeAIR.LogUp.product values).toExtension =
+    Aiur.NativeAIR.LogUp.product (List.map Aiur.NativeAIR.LogUp.Coordinates.toExtension values)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fieldEntries_messages
+∀ (entries : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G × Aiur.NativeAIR.LogUp.Coordinates Aiur.G)),
+  List.map Prod.snd (Aiur.NativeAIR.LogUp.fieldEntries entries) =
+    List.map Aiur.NativeAIR.LogUp.Coordinates.toExtension (List.map Prod.snd entries)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.numerator_toExtension
+∀ (entries : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G × Aiur.NativeAIR.LogUp.Coordinates Aiur.G)),
+  (Aiur.NativeAIR.LogUp.numerator entries).toExtension =
+    Aiur.NativeAIR.LogUp.numerator (Aiur.NativeAIR.LogUp.fieldEntries entries)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.groupEquation_toExtension
+∀ (entries : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G × Aiur.NativeAIR.LogUp.Coordinates Aiur.G))
+  (difference : Aiur.NativeAIR.LogUp.Coordinates Aiur.G),
+  (Aiur.NativeAIR.LogUp.groupEquation entries difference).toExtension =
+    Aiur.NativeAIR.LogUp.groupEquation (Aiur.NativeAIR.LogUp.fieldEntries entries) difference.toExtension
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.coordinate_group_zero_iff
+∀ (entries : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G × Aiur.NativeAIR.LogUp.Coordinates Aiur.G))
+  (difference : Aiur.NativeAIR.LogUp.Coordinates Aiur.G),
+  Aiur.NativeAIR.LogUp.PoleFree (Aiur.NativeAIR.LogUp.fieldEntries entries) →
+    (Aiur.NativeAIR.LogUp.groupEquation entries difference = 0 ↔
+      difference.toExtension = Aiur.NativeAIR.LogUp.fractionSum (Aiur.NativeAIR.LogUp.fieldEntries entries))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.coordinate_polynomial_zero_iff
+∀ (entries : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G × Aiur.NativeAIR.LogUp.Coordinates Aiur.G))
+  (difference : Aiur.NativeAIR.LogUp.Coordinates Aiur.G),
+  Aiur.NativeAIR.LogUp.PoleFree (Aiur.NativeAIR.LogUp.fieldEntries entries) →
+    (Aiur.NativeAIR.LogUp.product (List.map Prod.snd entries) * difference = Aiur.NativeAIR.LogUp.numerator entries ↔
+      difference.toExtension = Aiur.NativeAIR.LogUp.fractionSum (Aiur.NativeAIR.LogUp.fieldEntries entries))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fingerprint_toExtension
+∀ (gamma : Aiur.NativeAIR.LogUp.Coordinates Aiur.G) (args : List Aiur.G),
+  (Aiur.NativeAIR.LogUp.fingerprint gamma args).toExtension =
+    List.foldr (fun arg acc => acc * gamma.toExtension + Aiur.NativeAIR.ProofCodec.Extension.ofBase arg) 0 args
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.pole_can_hide_step
+Aiur.NativeAIR.LogUp.groupEquation [(0, 0)] 1 = 0 ∧ 1 ≠ Aiur.NativeAIR.LogUp.fractionSum [(0, 0)]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fractionSum_flatMap
+∀ {α : Type u_1} (inputs : List α)
+  (entries : α → List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.LogUp.fractionSum (List.flatMap entries inputs) =
+    Aiur.NativeAIR.LogUp.sum (List.map (fun input => Aiur.NativeAIR.LogUp.fractionSum (entries input)) inputs)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.fieldEntries_compress_chunk
+∀ (beta gamma : Aiur.NativeAIR.LogUp.Coordinates Aiur.G) (lookups : List (Aiur.G × List Aiur.G))
+  (groupSize index : Nat),
+  Aiur.NativeAIR.LogUp.fieldEntries
+      (Aiur.NativeAIR.LogUp.compress beta gamma (Aiur.NativeAIR.LogUp.chunk groupSize index lookups)) =
+    Aiur.NativeAIR.LogUp.chunk groupSize index
+      (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma lookups))
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.LogUp.lookupFractions_chunks
+∀ (beta gamma : Aiur.NativeAIR.LogUp.Coordinates Aiur.G) (lookups : List (Aiur.G × List Aiur.G)) (groupSize : Nat),
+  Aiur.NativeAIR.LogUp.sum
+      (List.map
+        (fun index =>
+          Aiur.NativeAIR.LogUp.lookupFractions beta gamma (Aiur.NativeAIR.LogUp.chunk groupSize index lookups))
+        (List.range (Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length))) =
+    Aiur.NativeAIR.LogUp.lookupFractions beta gamma lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.equations_accumulator
+∀ {lookups : List (Aiur.G × List Aiur.G)} {stageCurrent stageNext publics deltaScaled : Array Aiur.G} {isLast : Aiur.G}
+  {groupSize : Nat} {result : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G)}
+  {beta gamma : Aiur.NativeAIR.LogUp.Coordinates Aiur.G},
+  Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta →
+    Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma →
+      Aiur.NativeAIR.LogUp.equations lookups stageCurrent stageNext publics deltaScaled isLast groupSize = some result →
+        (∀ (value : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), value ∈ result → value = 0) →
+          Aiur.NativeAIR.LogUp.PoleFree
+              (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma lookups)) →
+            ∃ first next delta,
+              Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent 0 = some first ∧
+                Aiur.NativeAIR.LogUp.Coordinates.read stageNext 0 = some next ∧
+                  Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 = some delta ∧
+                    next.toExtension - first.toExtension + (delta.scale isLast).toExtension =
+                      Aiur.NativeAIR.LogUp.lookupFractions beta gamma lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.constraintValues_accumulator
+∀ {lookups : List Aiur.NativeAIR.Lookup} {nodeValues stageCurrent stageNext publics deltaScaled : Array Aiur.G}
+  {isLast : Aiur.G} {groupSize : Nat} {result : List Aiur.G} {beta gamma : Aiur.NativeAIR.LogUp.Coordinates Aiur.G},
+  Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta →
+    Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma →
+      Aiur.NativeAIR.LogUp.constraintValues lookups nodeValues stageCurrent stageNext publics deltaScaled isLast
+            groupSize =
+          some result →
+        (∀ (value : Aiur.G), value ∈ result → value = 0) →
+          (∀ (values : List (Aiur.G × List Aiur.G)),
+              List.mapM (Aiur.NativeAIR.readLookup nodeValues) lookups = some values →
+                Aiur.NativeAIR.LogUp.PoleFree
+                  (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma values))) →
+            ∃ values first next delta,
+              List.mapM (Aiur.NativeAIR.readLookup nodeValues) lookups = some values ∧
+                Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent 0 = some first ∧
+                  Aiur.NativeAIR.LogUp.Coordinates.read stageNext 0 = some next ∧
+                    Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 = some delta ∧
+                      next.toExtension - first.toExtension + (delta.scale isLast).toExtension =
+                        Aiur.NativeAIR.LogUp.lookupFractions beta gamma values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generators_size
+Aiur.NativeAIR.Domain.generators.size = 33
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.Algebra.power_zero
+∀ {R : Type} [inst : Grind.CommRing R] (n : Nat), 0 < n → 0 ^ n = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.Algebra.power_mul
+∀ {R : Type} [inst : Grind.CommRing R] (a : R) (m n : Nat), a ^ (m * n) = (a ^ m) ^ n
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.Algebra.power_period
+∀ {R : Type} [inst : Grind.CommRing R] (a : R) {period : Nat}, a ^ period = 1 → ∀ (n : Nat), a ^ n = a ^ (n % period)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.Algebra.power_inverse
+∀ {R : Type} [inst : Grind.CommRing R] (a inverse : R), a * inverse = 1 → ∀ (n : Nat), a ^ n * inverse ^ n = 1
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.Algebra.predecessor_inverse
+∀ {R : Type} [inst : Grind.CommRing R] (a inverse : R) {n : Nat},
+  0 < n → a ^ n = 1 → a * inverse = 1 → a ^ (n - 1) = inverse
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.Algebra.dividedPowers_factor
+∀ {R : Type} [inst : Grind.CommRing R] (x a : R) (n : Nat),
+  (x - a) * Aiur.NativeAIR.Domain.Algebra.dividedPowers x a n = x ^ n - a ^ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.Algebra.dividedPowers_diagonal
+∀ {R : Type} [inst : Grind.CommRing R] (a : R) (n : Nat),
+  Aiur.NativeAIR.Domain.Algebra.dividedPowers a a n = ↑n * a ^ (n - 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.Algebra.root_dividedPowers
+∀ {R : Type} [inst : Grind.CommRing R] (x a : R) {n : Nat},
+  a ^ n = 1 → (x - a) * Aiur.NativeAIR.Domain.Algebra.dividedPowers x a n = x ^ n - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.Algebra.dividedPowers_off_root
+∀ {R : Type} [inst : Grind.CommRing R] (x a inverse : R) {n : Nat},
+  a ^ n = 1 → (x - a) * inverse = 1 → (x ^ n - 1) * inverse = Aiur.NativeAIR.Domain.Algebra.dividedPowers x a n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.ofLogSize_some
+∀ {bits : Nat} {domain : Aiur.NativeAIR.Domain.Subgroup},
+  Aiur.NativeAIR.Domain.ofLogSize bits = some domain → ↑domain = bits
+AXIOMS []
+ROOT Aiur.NativeAIR.Domain.ofLogSize_defined
+∀ (bits : Nat), ((Aiur.NativeAIR.Domain.ofLogSize bits).isSome = true) = (bits < 33)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.size_positive
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), 0 < Aiur.NativeAIR.Domain.size domain
+AXIOMS []
+ROOT Aiur.NativeAIR.Domain.size_bound
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.size domain ≤ 2 ^ 32
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.size_lt_characteristic
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.size domain < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.size_lt_u64
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.size domain < 2 ^ 64
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generator_zero
+Aiur.NativeAIR.Domain.generator 0 = 1
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.generator_square_certificate
+∀ (index : Fin 32),
+  Aiur.NativeAIR.Domain.generator ⟨↑index + 1, ⋯⟩ * Aiur.NativeAIR.Domain.generator ⟨↑index + 1, ⋯⟩ =
+    Aiur.NativeAIR.Domain.generator ⟨↑index, ⋯⟩
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generator_full_certificate
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  (Aiur.NativeAIR.Domain.generator domain).pow (Aiur.NativeAIR.Domain.size domain) = 1
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Domain.generator_half_certificate
+∀ (index : Fin 32), (Aiur.NativeAIR.Domain.generator ⟨↑index + 1, ⋯⟩).pow (2 ^ ↑index) = 0 - 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generator_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.Domain.generator domain ^ Aiur.NativeAIR.Domain.size domain = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generator_half
+∀ (index : Fin 32), Aiur.NativeAIR.Domain.generator ⟨↑index + 1, ⋯⟩ ^ 2 ^ ↑index = 0 - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generator_nonzero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.generator domain ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_eq
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain index = Aiur.NativeAIR.Domain.generator domain ^ ↑index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_injective
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) {i j : Fin (Aiur.NativeAIR.Domain.size domain)},
+  Aiur.NativeAIR.Domain.point domain i = Aiur.NativeAIR.Domain.point domain j → i = j
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.generator_order
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (n : Nat),
+  Aiur.NativeAIR.Domain.generator domain ^ n = 1 ↔ Aiur.NativeAIR.Domain.size domain ∣ n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_zero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.point domain ⟨0, ⋯⟩ = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain index ^ Aiur.NativeAIR.Domain.size domain = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_nonzero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain index ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_next
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain ⟨(↑index + 1) % Aiur.NativeAIR.Domain.size domain, ⋯⟩ =
+    Aiur.NativeAIR.Domain.point domain index * Aiur.NativeAIR.Domain.generator domain
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_first_iff
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain index = 1 ↔ ↑index = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.lastPoint_eq_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.Domain.lastPoint domain =
+    Aiur.NativeAIR.Domain.generator domain ^ (Aiur.NativeAIR.Domain.size domain - 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_last
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.Domain.point domain ⟨Aiur.NativeAIR.Domain.size domain - 1, ⋯⟩ = Aiur.NativeAIR.Domain.lastPoint domain
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.lastPoint_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.Domain.lastPoint domain ^ Aiur.NativeAIR.Domain.size domain = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.point_last_iff
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain index = Aiur.NativeAIR.Domain.lastPoint domain ↔
+    ↑index = Aiur.NativeAIR.Domain.size domain - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.lastPoint_nonzero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.lastPoint domain ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.lastPoint_inverse
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.Domain.lastPoint domain * Aiur.NativeAIR.Domain.generator domain = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.lastPoint_predecessor
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.Domain.lastPoint domain ^ (Aiur.NativeAIR.Domain.size domain - 1) =
+    Aiur.NativeAIR.Domain.generator domain
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.normalizer_nonzero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.Domain.normalizer domain ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.first_at_row
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.Domain.point domain index) 1
+      (Aiur.NativeAIR.Domain.size domain) =
+    if ↑index = 0 then Aiur.G.ofNat (Aiur.NativeAIR.Domain.size domain) else 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.last_at_row
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.Domain.point domain index)
+      (Aiur.NativeAIR.Domain.lastPoint domain) (Aiur.NativeAIR.Domain.size domain) =
+    if ↑index = Aiur.NativeAIR.Domain.size domain - 1 then Aiur.NativeAIR.Domain.normalizer domain else 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.transition_at_row
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.point domain index - Aiur.NativeAIR.Domain.lastPoint domain = 0 ↔
+    ↑index = Aiur.NativeAIR.Domain.size domain - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.ofBase_dividedPowers
+∀ (x a : Aiur.G) (n : Nat),
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.Algebra.dividedPowers x a n) =
+    Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.ProofCodec.Extension.ofBase x)
+      (Aiur.NativeAIR.ProofCodec.Extension.ofBase a) n
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.vanishing_eq
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (value : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.Domain.vanishing domain value = value ^ Aiur.NativeAIR.Domain.size domain - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.vanishing_at_row
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.vanishing domain
+      (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.point domain index)) =
+    0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.lastPoint_extension_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup),
+  Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.lastPoint domain) ^
+      Aiur.NativeAIR.Domain.size domain =
+    1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.root_difference_nonzero
+∀ (x a : Aiur.NativeAIR.ProofCodec.Extension) {n : Nat}, a ^ n = 1 → x ^ n - 1 ≠ 0 → x - a ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.selectors_success
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (value : Aiur.NativeAIR.ProofCodec.Extension)
+  (selected : Aiur.NativeAIR.Domain.Selectors Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.Domain.selectors domain value = some selected →
+    selected.isFirst = Aiur.NativeAIR.Domain.Algebra.dividedPowers value 1 (Aiur.NativeAIR.Domain.size domain) ∧
+      selected.isLast =
+          Aiur.NativeAIR.Domain.Algebra.dividedPowers value
+            (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.lastPoint domain))
+            (Aiur.NativeAIR.Domain.size domain) ∧
+        selected.isTransition =
+            value - Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.lastPoint domain) ∧
+          Aiur.NativeAIR.Domain.vanishing domain value * selected.invVanishing = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.selectors_defined
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (value : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.Domain.vanishing domain value ≠ 0 →
+    ∃ selected, Aiur.NativeAIR.Domain.selectors domain value = some selected
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.selectors_defined_iff
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (value : Aiur.NativeAIR.ProofCodec.Extension),
+  (∃ selected, Aiur.NativeAIR.Domain.selectors domain value = some selected) ↔
+    Aiur.NativeAIR.Domain.vanishing domain value ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Domain.selectors_none_at_row
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  Aiur.NativeAIR.Domain.selectors domain
+      (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.point domain index)) =
+    none
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.normalized_injection
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain))
+  (delta : Aiur.NativeAIR.LogUp.Coordinates Aiur.G),
+  (delta.scale (Aiur.NativeAIR.Domain.normalizer domain).inverse).scale
+      (Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.Domain.point domain index)
+        (Aiur.NativeAIR.Domain.lastPoint domain) (Aiur.NativeAIR.Domain.size domain)) =
+    if ↑index = Aiur.NativeAIR.Domain.size domain - 1 then delta else 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.equations_domain_row
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain))
+  {lookups : List (Aiur.G × List Aiur.G)} {stageCurrent stageNext publics deltaScaled : Array Aiur.G} {groupSize : Nat}
+  {result : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G)}
+  {beta gamma delta : Aiur.NativeAIR.LogUp.Coordinates Aiur.G},
+  Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta →
+    Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma →
+      Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 =
+          some (delta.scale (Aiur.NativeAIR.Domain.normalizer domain).inverse) →
+        Aiur.NativeAIR.LogUp.equations lookups stageCurrent stageNext publics deltaScaled
+              (Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.Domain.point domain index)
+                (Aiur.NativeAIR.Domain.lastPoint domain) (Aiur.NativeAIR.Domain.size domain))
+              groupSize =
+            some result →
+          (∀ (value : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), value ∈ result → value = 0) →
+            Aiur.NativeAIR.LogUp.PoleFree
+                (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma lookups)) →
+              ∃ first next,
+                Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent 0 = some first ∧
+                  Aiur.NativeAIR.LogUp.Coordinates.read stageNext 0 = some next ∧
+                    (next.toExtension - first.toExtension +
+                        if ↑index = Aiur.NativeAIR.Domain.size domain - 1 then delta.toExtension else 0) =
+                      Aiur.NativeAIR.LogUp.lookupFractions beta gamma lookups
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.equations_domain_sum
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup)
+  (lookups : Fin (Aiur.NativeAIR.Domain.size domain) → List (Aiur.G × List Aiur.G))
+  (stageRows : Fin (Aiur.NativeAIR.Domain.size domain) → Array Aiur.G) (publics deltaScaled : Array Aiur.G)
+  (groupSize : Nat) (beta gamma delta : Aiur.NativeAIR.LogUp.Coordinates Aiur.G),
+  Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta →
+    Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma →
+      Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 =
+          some (delta.scale (Aiur.NativeAIR.Domain.normalizer domain).inverse) →
+        (∀ (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+            ∃ result,
+              Aiur.NativeAIR.LogUp.equations (lookups index) (stageRows index)
+                    (stageRows ⟨(↑index + 1) % Aiur.NativeAIR.Domain.size domain, ⋯⟩) publics deltaScaled
+                    (Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.Domain.point domain index)
+                      (Aiur.NativeAIR.Domain.lastPoint domain) (Aiur.NativeAIR.Domain.size domain))
+                    groupSize =
+                  some result ∧
+                ∀ (value : Aiur.NativeAIR.LogUp.Coordinates Aiur.G), value ∈ result → value = 0) →
+          (∀ (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+              Aiur.NativeAIR.LogUp.PoleFree
+                (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma (lookups index)))) →
+            Aiur.NativeAIR.LogUp.sum
+                (List.ofFn fun index => Aiur.NativeAIR.LogUp.lookupFractions beta gamma (lookups index)) =
+              delta.toExtension
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.LogUp.constraintValues_domain_sum
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (lookups : List Aiur.NativeAIR.Lookup)
+  (nodeRows stageRows : Fin (Aiur.NativeAIR.Domain.size domain) → Array Aiur.G) (publics deltaScaled : Array Aiur.G)
+  (groupSize : Nat) (beta gamma delta : Aiur.NativeAIR.LogUp.Coordinates Aiur.G),
+  Aiur.NativeAIR.LogUp.Coordinates.read publics 0 = some beta →
+    Aiur.NativeAIR.LogUp.Coordinates.read publics 1 = some gamma →
+      Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0 =
+          some (delta.scale (Aiur.NativeAIR.Domain.normalizer domain).inverse) →
+        (∀ (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+            ∃ result,
+              Aiur.NativeAIR.LogUp.constraintValues lookups (nodeRows index) (stageRows index)
+                    (stageRows ⟨(↑index + 1) % Aiur.NativeAIR.Domain.size domain, ⋯⟩) publics deltaScaled
+                    (Aiur.NativeAIR.Domain.Algebra.dividedPowers (Aiur.NativeAIR.Domain.point domain index)
+                      (Aiur.NativeAIR.Domain.lastPoint domain) (Aiur.NativeAIR.Domain.size domain))
+                    groupSize =
+                  some result ∧
+                ∀ (value : Aiur.G), value ∈ result → value = 0) →
+          (∀ (index : Fin (Aiur.NativeAIR.Domain.size domain)) (values : List (Aiur.G × List Aiur.G)),
+              List.mapM (Aiur.NativeAIR.readLookup (nodeRows index)) lookups = some values →
+                Aiur.NativeAIR.LogUp.PoleFree
+                  (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma values))) →
+            ∃ values,
+              (∀ (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+                  List.mapM (Aiur.NativeAIR.readLookup (nodeRows index)) lookups = some (values index)) ∧
+                Aiur.NativeAIR.LogUp.sum
+                    (List.ofFn fun index => Aiur.NativeAIR.LogUp.lookupFractions beta gamma (values index)) =
+                  delta.toExtension
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.horner_nil
+∀ {W : Type} [inst : Grind.CommRing W] (point : W), Aiur.NativeAIR.Quotient.horner point [] = 0
+AXIOMS []
+ROOT Aiur.NativeAIR.Quotient.horner_cons
+∀ {W : Type} [inst : Grind.CommRing W] (point first : W) (rest : List W),
+  Aiur.NativeAIR.Quotient.horner point (first :: rest) = first + point * Aiur.NativeAIR.Quotient.horner point rest
+AXIOMS []
+ROOT Aiur.NativeAIR.Quotient.horner_append
+∀ {W : Type} [inst : Grind.CommRing W] (point : W) (left right : List W),
+  Aiur.NativeAIR.Quotient.horner point (left ++ right) =
+    Aiur.NativeAIR.Quotient.horner point left + point ^ left.length * Aiur.NativeAIR.Quotient.horner point right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.horner_powers
+∀ {W : Type} [inst : Grind.CommRing W] (point : W) (values : List W) (offset : Nat),
+  point ^ offset * Aiur.NativeAIR.Quotient.horner point values =
+    Aiur.NativeAIR.LogUp.sum
+      (List.map
+        (fun x =>
+          match x with
+          | (value, index) => point ^ index * value)
+        (values.zipIdx offset))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.composition_from
+∀ {W : Type} [inst : Grind.CommRing W] (point initial : W) (values : List W),
+  List.foldl (fun accumulated value => accumulated * point + value) initial values =
+    initial * point ^ values.length + Aiur.NativeAIR.Quotient.horner point values.reverse
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.composition_horner
+∀ {W : Type} [inst : Grind.CommRing W] (point : W) (values : List W),
+  Aiur.NativeAIR.Quotient.composition point values = Aiur.NativeAIR.Quotient.horner point values.reverse
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.composition_order
+∀ {W : Type} [inst : Grind.CommRing W] (point : W) (values : List W),
+  Aiur.NativeAIR.Quotient.composition point values =
+    Aiur.NativeAIR.LogUp.sum
+      (List.map
+        (fun x =>
+          match x with
+          | (value, index) => point ^ index * value)
+        values.reverse.zipIdx)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.composition_append
+∀ {W : Type} [inst : Grind.CommRing W] (point : W) (user lookup : List W),
+  Aiur.NativeAIR.Quotient.composition point (user ++ lookup) =
+    Aiur.NativeAIR.Quotient.composition point user * point ^ lookup.length +
+      Aiur.NativeAIR.Quotient.composition point lookup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.composition_zero
+∀ {W : Type} [inst : Grind.CommRing W] (point : W) (values : List W),
+  (∀ (value : W), value ∈ values → value = 0) → Aiur.NativeAIR.Quotient.composition point values = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.inverse_check
+∀ {W : Type} [inst : Grind.CommRing W] (vanishing inverse composition quotient : W),
+  vanishing * inverse = 1 → (composition * inverse = quotient ↔ composition = vanishing * quotient)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.coefficients_flatten
+∀ (pairs : List (Aiur.NativeAIR.LogUp.Coordinates Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.Quotient.coefficients (Aiur.NativeAIR.LogUp.Coordinates.flatten pairs) =
+    some (List.map (fun pair => pair.c0 + pair.c1 * Aiur.NativeAIR.ProofCodec.Extension.basis) pairs)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Quotient.coefficients_success
+∀ {row values : List Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Quotient.coefficients row = some values →
+    ∃ pairs,
+      row = Aiur.NativeAIR.LogUp.Coordinates.flatten pairs ∧
+        values = List.map (fun pair => pair.c0 + pair.c1 * Aiur.NativeAIR.ProofCodec.Extension.basis) pairs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.coefficients_length
+∀ {row values : List Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Quotient.coefficients row = some values → row.length = 2 * values.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.coefficients_defined
+∀ (row : List Aiur.NativeAIR.ProofCodec.Extension),
+  row.length % 2 = 0 → ∃ values, Aiur.NativeAIR.Quotient.coefficients row = some values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.coefficients_defined_iff
+∀ (row : List Aiur.NativeAIR.ProofCodec.Extension),
+  (∃ values, Aiur.NativeAIR.Quotient.coefficients row = some values) ↔ row.length % 2 = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.evaluate_success
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (point : Aiur.NativeAIR.ProofCodec.Extension)
+  {row : List Aiur.NativeAIR.ProofCodec.Extension} {value : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Quotient.evaluate domain point row = some value →
+    ∃ values,
+      Aiur.NativeAIR.Quotient.coefficients row = some values ∧
+        value = Aiur.NativeAIR.Quotient.horner (point ^ Aiur.NativeAIR.Domain.size domain) values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.evaluate_powers
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (point : Aiur.NativeAIR.ProofCodec.Extension)
+  {row : List Aiur.NativeAIR.ProofCodec.Extension} {value : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Quotient.evaluate domain point row = some value →
+    ∃ pairs,
+      row = Aiur.NativeAIR.LogUp.Coordinates.flatten pairs ∧
+        value =
+          Aiur.NativeAIR.LogUp.sum
+            (List.map
+              (fun x =>
+                match x with
+                | (pair, index) =>
+                  point ^ (Aiur.NativeAIR.Domain.size domain * index) *
+                    (pair.c0 + pair.c1 * Aiur.NativeAIR.ProofCodec.Extension.basis))
+              pairs.zipIdx)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Quotient.check_true_iff
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (point alpha : Aiur.NativeAIR.ProofCodec.Extension)
+  (constraints row : List Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.Quotient.check domain point alpha constraints row = some true ↔
+    Aiur.NativeAIR.Domain.vanishing domain point ≠ 0 ∧
+      ∃ values,
+        Aiur.NativeAIR.Quotient.coefficients row = some values ∧
+          Aiur.NativeAIR.Quotient.composition alpha constraints =
+            Aiur.NativeAIR.Domain.vanishing domain point *
+              Aiur.NativeAIR.Quotient.horner (point ^ Aiur.NativeAIR.Domain.size domain) values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.CompiledKey.preprocessedIndices_none
+∀ (program : Aiur.Bytecode.Toplevel) (index : Nat),
+  (Aiur.NativeAIR.CompiledKey.preprocessedIndices program)[index]? = some none ↔
+    index < program.circuits.size + program.memorySizes.size
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.CompiledKey.circuits_preprocessed_absent
+∀ {program : Aiur.Bytecode.Toplevel} {result : List Aiur.NativeAIR.KeyCodec.Circuit},
+  Aiur.NativeAIR.CompiledKey.circuits program = some result →
+    ∀ {index : Nat} {artifact : Aiur.NativeAIR.KeyCodec.Circuit},
+      result[index]? = some artifact →
+        (Aiur.NativeAIR.CompiledKey.preprocessedIndices program)[index]? = some none → artifact.preprocessedWidth = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.row_preprocessed_absent
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {index position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.Sourced backend.keyData proof index position row →
+    row.preprocessed = none → row.circuit.preprocessedWidth = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.publics_size
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering leaving).size = 8
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.publics_beta
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.LogUp.Coordinates.read (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering leaving) 0 =
+    some
+      (Aiur.NativeAIR.LogUp.Coordinates.map Aiur.NativeAIR.ProofCodec.Extension.ofBase
+        (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.beta))
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.publics_gamma
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.LogUp.Coordinates.read (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering leaving) 1 =
+    some
+      (Aiur.NativeAIR.LogUp.Coordinates.map Aiur.NativeAIR.ProofCodec.Extension.ofBase
+        (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.gamma))
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.publics_entering
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.LogUp.Coordinates.read (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering leaving) 2 =
+    some
+      (Aiur.NativeAIR.LogUp.Coordinates.map Aiur.NativeAIR.ProofCodec.Extension.ofBase
+        (Aiur.NativeAIR.LogUp.Coordinates.fromExtension entering))
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.publics_leaving
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.LogUp.Coordinates.read (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering leaving) 3 =
+    some
+      (Aiur.NativeAIR.LogUp.Coordinates.map Aiur.NativeAIR.ProofCodec.Extension.ofBase
+        (Aiur.NativeAIR.LogUp.Coordinates.fromExtension leaving))
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.deltaScaled_size
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  (Aiur.NativeAIR.VerifierArithmetic.deltaScaled domain entering leaving).size = 2
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.deltaScaled_coordinates
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (entering leaving : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.LogUp.Coordinates.read (Aiur.NativeAIR.VerifierArithmetic.deltaScaled domain entering leaving) 0 =
+    some
+      (Aiur.NativeAIR.LogUp.Coordinates.map Aiur.NativeAIR.ProofCodec.Extension.ofBase
+        ((Aiur.NativeAIR.LogUp.Coordinates.fromExtension (leaving - entering)).scale
+          (Aiur.NativeAIR.Domain.normalizer domain).inverse))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.view_fits
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.Fits parameters row →
+    (row.preprocessed = none → row.circuit.preprocessedWidth = 0) →
+      ∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering : Aiur.NativeAIR.ProofCodec.Extension)
+        (selectors : Aiur.NativeAIR.Domain.Selectors Aiur.NativeAIR.ProofCodec.Extension),
+        (Aiur.NativeAIR.VerifierArithmetic.view challenges row entering selectors).Fits row.circuit.widths
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.domain_defined
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.Fits parameters row →
+    ∃ domain, Aiur.NativeAIR.Domain.ofLogSize row.logDegree.toNat = some domain
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.stage2_width
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.Fits parameters row →
+    0 < row.circuit.lookupGroupSize →
+      Aiur.NativeAIR.LogUp.groupCount row.circuit.lookupGroupSize row.circuit.graph.lookups.length * 2 ≤
+          (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+              Aiur.NativeAIR.RowOffset.current).size ∧
+        2 ≤
+          (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+              Aiur.NativeAIR.RowOffset.next).size
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.evaluate_success
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result →
+    Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads challenges row entering result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.evaluate
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads challenges row entering result →
+    Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.evaluate_defined
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.Fits parameters row →
+    row.circuit.valid = true →
+      (row.preprocessed = none → row.circuit.preprocessedWidth = 0) →
+        ∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering : Aiur.NativeAIR.ProofCodec.Extension)
+          {domain : Aiur.NativeAIR.Domain.Subgroup},
+          Aiur.NativeAIR.Domain.ofLogSize row.logDegree.toNat = some domain →
+            Aiur.NativeAIR.Domain.vanishing domain challenges.zeta ≠ 0 →
+              ∃ result, Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.evaluate_defined_iff
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.ProofShape.Row.Fits parameters row →
+    row.circuit.valid = true →
+      (row.preprocessed = none → row.circuit.preprocessedWidth = 0) →
+        ∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering : Aiur.NativeAIR.ProofCodec.Extension),
+          (∃ result, Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result) ↔
+            ∃ domain,
+              Aiur.NativeAIR.Domain.ofLogSize row.logDegree.toNat = some domain ∧
+                Aiur.NativeAIR.Domain.vanishing domain challenges.zeta ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.evaluate_constraint_count
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result →
+    0 < row.circuit.lookupGroupSize → result.constraints.length = row.circuit.constraintCount
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.evaluate_reflects
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result →
+    Aiur.NativeAIR.Graph.Valid row.circuit.widths row.circuit.graph →
+      ∃ trees lookups coordinates,
+        row.circuit.graph.unfold = some trees ∧
+          Aiur.NativeAIR.Reflects Aiur.NativeAIR.ProofCodec.Extension.evalOps
+              (Aiur.NativeAIR.VerifierArithmetic.view challenges row entering result.selectors) trees
+              result.nodeValues ∧
+            Aiur.NativeAIR.evalRoots Aiur.NativeAIR.ProofCodec.Extension.evalOps
+                  (Aiur.NativeAIR.VerifierArithmetic.view challenges row entering result.selectors) trees
+                  row.circuit.graph.zeros =
+                some result.userValues ∧
+              List.mapM
+                    (Aiur.NativeAIR.evalLookup Aiur.NativeAIR.ProofCodec.Extension.evalOps
+                      (Aiur.NativeAIR.VerifierArithmetic.view challenges row entering result.selectors) trees)
+                    row.circuit.graph.lookups =
+                  some lookups ∧
+                Aiur.NativeAIR.LogUp.equations lookups
+                      (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+                        Aiur.NativeAIR.RowOffset.current)
+                      (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+                        Aiur.NativeAIR.RowOffset.next)
+                      (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering row.accumulator)
+                      (Aiur.NativeAIR.VerifierArithmetic.deltaScaled result.domain entering row.accumulator)
+                      result.selectors.isLast row.circuit.lookupGroupSize =
+                    some coordinates ∧
+                  result.lookupValues = Aiur.NativeAIR.LogUp.Coordinates.flatten coordinates
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.identity
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads challenges row entering result →
+    (result.accepts challenges.alpha = true ↔
+      Aiur.NativeAIR.Quotient.composition challenges.alpha result.constraints =
+        Aiur.NativeAIR.Domain.vanishing result.domain challenges.zeta * result.quotientValue)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.check_true_iff
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (row : Aiur.NativeAIR.ProofShape.Row)
+  (entering : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.VerifierArithmetic.check challenges row entering = some true ↔
+    ∃ result,
+      Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result ∧
+        Aiur.NativeAIR.Quotient.composition challenges.alpha result.constraints =
+          Aiur.NativeAIR.Domain.vanishing result.domain challenges.zeta * result.quotientValue
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.check_quotient
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result →
+    Aiur.NativeAIR.VerifierArithmetic.check challenges row entering =
+      Aiur.NativeAIR.Quotient.check result.domain challenges.zeta challenges.alpha result.constraints row.quotient
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.checked_row_arithmetic
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof backend.keyData bytes) {position : Nat}
+  {row : Aiur.NativeAIR.ProofShape.Row},
+  checked.rows[position]? = some row →
+    ∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (entering : Aiur.NativeAIR.ProofCodec.Extension),
+      ∃ domain,
+        Aiur.NativeAIR.Domain.ofLogSize row.logDegree.toNat = some domain ∧
+          ((∃ result, Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering = some result) ↔
+            Aiur.NativeAIR.Domain.vanishing domain challenges.zeta ≠ 0)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.claimMessage_native
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (claim : List Aiur.G),
+  Aiur.NativeAIR.VerifierArithmetic.claimMessage challenges claim =
+    challenges.beta +
+      List.foldr
+        (fun arg accumulated => accumulated * challenges.gamma + Aiur.NativeAIR.ProofCodec.Extension.ofBase arg) 0 claim
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.publicEntries_compress
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (claims : List (List Aiur.G)),
+  Aiur.NativeAIR.LogUp.fieldEntries
+      (Aiur.NativeAIR.LogUp.compress (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.beta)
+        (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.gamma) (List.map (fun claim => (1, claim)) claims)) =
+    Aiur.NativeAIR.VerifierArithmetic.publicEntries challenges claims
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_nil
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges),
+  Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges [] = some 0
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_cons
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (claim : List Aiur.G) (claims : List (List Aiur.G)),
+  Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges (claim :: claims) = do
+    let inverse ← (Aiur.NativeAIR.VerifierArithmetic.claimMessage challenges claim).tryInverse
+    let rest ← Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims
+    pure (inverse + rest)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_success
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {claims : List (List Aiur.G)}
+  {accumulator : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some accumulator →
+    Aiur.NativeAIR.LogUp.PoleFree (Aiur.NativeAIR.VerifierArithmetic.publicEntries challenges claims) ∧
+      accumulator = Aiur.NativeAIR.LogUp.fractionSum (Aiur.NativeAIR.VerifierArithmetic.publicEntries challenges claims)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_defined
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (claims : List (List Aiur.G)),
+  Aiur.NativeAIR.LogUp.PoleFree (Aiur.NativeAIR.VerifierArithmetic.publicEntries challenges claims) →
+    ∃ accumulator, Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some accumulator
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_defined_iff
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (claims : List (List Aiur.G)),
+  (∃ accumulator, Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some accumulator) ↔
+    Aiur.NativeAIR.LogUp.PoleFree (Aiur.NativeAIR.VerifierArithmetic.publicEntries challenges claims)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.initialAccumulator_lookupFractions
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {claims : List (List Aiur.G)}
+  {accumulator : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some accumulator →
+    accumulator =
+      Aiur.NativeAIR.LogUp.lookupFractions (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.beta)
+        (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.gamma) (List.map (fun claim => (1, claim)) claims)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.checkRows_cons
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (row : Aiur.NativeAIR.ProofShape.Row)
+  (rows : List Aiur.NativeAIR.ProofShape.Row) (entering final : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.VerifierArithmetic.checkRows challenges (row :: rows) entering = some final ↔
+    Aiur.NativeAIR.VerifierArithmetic.check challenges row entering = some true ∧
+      Aiur.NativeAIR.VerifierArithmetic.checkRows challenges rows row.accumulator = some final
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.checkRows_final
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {rows : List Aiur.NativeAIR.ProofShape.Row}
+  {entering final : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.VerifierArithmetic.checkRows challenges rows entering = some final →
+    List.foldl (fun x row => row.accumulator) entering rows = final
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.checkRows_row
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {rows : List Aiur.NativeAIR.ProofShape.Row}
+  {entering final : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.VerifierArithmetic.checkRows challenges rows entering = some final →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      rows[position]? = some row →
+        ∃ before,
+          (entering :: List.map (fun x => x.accumulator) rows)[position]? = some before ∧
+            Aiur.NativeAIR.VerifierArithmetic.check challenges row before = some true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.checkRows_sum
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {rows : List Aiur.NativeAIR.ProofShape.Row}
+  {entering final : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.VerifierArithmetic.checkRows challenges rows entering = some final →
+    ∀ (fraction : Aiur.NativeAIR.ProofShape.Row → Aiur.NativeAIR.ProofCodec.Extension),
+      (∀ (row : Aiur.NativeAIR.ProofShape.Row),
+          row ∈ rows →
+            ∀ (before : Aiur.NativeAIR.ProofCodec.Extension),
+              Aiur.NativeAIR.VerifierArithmetic.check challenges row before = some true →
+                fraction row = row.accumulator - before) →
+        Aiur.NativeAIR.LogUp.sum (List.map fraction rows) = final - entering
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.verify_true_iff
+∀ (challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges) (claims : List (List Aiur.G))
+  (rows : List Aiur.NativeAIR.ProofShape.Row),
+  Aiur.NativeAIR.VerifierArithmetic.verify challenges claims rows = some true ↔
+    rows ≠ [] ∧
+      ∃ entering,
+        Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some entering ∧
+          Aiur.NativeAIR.VerifierArithmetic.checkRows challenges rows entering = some 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.verify_lookup_balance
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {claims : List (List Aiur.G)}
+  {rows : List Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.VerifierArithmetic.verify challenges claims rows = some true →
+    ∀ (fraction : Aiur.NativeAIR.ProofShape.Row → Aiur.NativeAIR.ProofCodec.Extension),
+      (∀ (row : Aiur.NativeAIR.ProofShape.Row),
+          row ∈ rows →
+            ∀ (before : Aiur.NativeAIR.ProofCodec.Extension),
+              Aiur.NativeAIR.VerifierArithmetic.check challenges row before = some true →
+                fraction row = row.accumulator - before) →
+        Aiur.NativeAIR.LogUp.lookupFractions (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.beta)
+              (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.gamma)
+              (List.map (fun claim => (1, claim)) claims) +
+            Aiur.NativeAIR.LogUp.sum (List.map fraction rows) =
+          0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.VerifierArithmetic.verify_row
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {claims : List (List Aiur.G)}
+  {rows : List Aiur.NativeAIR.ProofShape.Row},
+  Aiur.NativeAIR.VerifierArithmetic.verify challenges claims rows = some true →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      rows[position]? = some row →
+        ∃ initial before result,
+          Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some initial ∧
+            (initial :: List.map (fun x => x.accumulator) rows)[position]? = some before ∧
+              Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row before = some result ∧
+                Aiur.NativeAIR.Quotient.composition challenges.alpha result.constraints =
+                  Aiur.NativeAIR.Domain.vanishing result.domain challenges.zeta * result.quotientValue
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.checked_row_values
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof backend.keyData bytes)
+  {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {claims : List (List Aiur.G)},
+  Aiur.NativeAIR.VerifierArithmetic.verify challenges claims checked.rows = some true →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      checked.rows[position]? = some row →
+        Aiur.NativeAIR.ProofShape.Row.Sourced backend.keyData checked.data row.circuitIndex position row ∧
+          Aiur.NativeAIR.ProofShape.Row.Fits backend.keyData.parameters row ∧
+            ∃ initial before result trees lookups coordinates,
+              Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims = some initial ∧
+                (initial :: List.map (fun x => x.accumulator) checked.rows)[position]? = some before ∧
+                  Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row before = some result ∧
+                    row.circuit.graph.unfold = some trees ∧
+                      Aiur.NativeAIR.evalRoots Aiur.NativeAIR.ProofCodec.Extension.evalOps
+                            (Aiur.NativeAIR.VerifierArithmetic.view challenges row before result.selectors) trees
+                            row.circuit.graph.zeros =
+                          some result.userValues ∧
+                        List.mapM
+                              (Aiur.NativeAIR.evalLookup Aiur.NativeAIR.ProofCodec.Extension.evalOps
+                                (Aiur.NativeAIR.VerifierArithmetic.view challenges row before result.selectors) trees)
+                              row.circuit.graph.lookups =
+                            some lookups ∧
+                          Aiur.NativeAIR.LogUp.equations lookups
+                                (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+                                  Aiur.NativeAIR.RowOffset.current)
+                                (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+                                  Aiur.NativeAIR.RowOffset.next)
+                                (Aiur.NativeAIR.VerifierArithmetic.publics challenges before row.accumulator)
+                                (Aiur.NativeAIR.VerifierArithmetic.deltaScaled result.domain before row.accumulator)
+                                result.selectors.isLast row.circuit.lookupGroupSize =
+                              some coordinates ∧
+                            result.lookupValues = Aiur.NativeAIR.LogUp.Coordinates.flatten coordinates ∧
+                              Aiur.NativeAIR.Quotient.composition challenges.alpha result.constraints =
+                                Aiur.NativeAIR.Domain.vanishing result.domain challenges.zeta * result.quotientValue
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.initial_valid
+∀ (seed : List UInt8), (Aiur.NativeAIR.Challenger.initial seed).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.State.Valid.bound
+∀ {state : Aiur.NativeAIR.Challenger.State}, state.Valid → state.pending.length ≤ 32
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.observeBytes_nil
+∀ (state : Aiur.NativeAIR.Challenger.State), Aiur.NativeAIR.Challenger.observeBytes state [] = state
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeBytes_append
+∀ (state : Aiur.NativeAIR.Challenger.State) (left right : List UInt8),
+  Aiur.NativeAIR.Challenger.observeBytes state (left ++ right) =
+    Aiur.NativeAIR.Challenger.observeBytes (Aiur.NativeAIR.Challenger.observeBytes state left) right
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.observeBytes_value
+∀ (state : Aiur.NativeAIR.Challenger.State) (bytes : List UInt8),
+  Aiur.NativeAIR.Challenger.observeBytes state bytes =
+    if bytes.isEmpty = true then state else { input := state.input ++ bytes, pending := [] }
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeBytes_fold
+∀ (state : Aiur.NativeAIR.Challenger.State) (bytes : List UInt8),
+  Aiur.NativeAIR.Challenger.observeBytes state bytes = List.foldl Aiur.NativeAIR.Challenger.observeByte state bytes
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.observeBytes_valid
+∀ {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid → ∀ (bytes : List UInt8), (Aiur.NativeAIR.Challenger.observeBytes state bytes).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeField_value
+∀ (state : Aiur.NativeAIR.Challenger.State) (value : Aiur.G),
+  Aiur.NativeAIR.Challenger.observeField state value =
+    { input := state.input ++ Aiur.NativeAIR.ProofCodec.encodeField value, pending := [] }
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeField_valid
+∀ {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid → ∀ (value : Aiur.G), (Aiur.NativeAIR.Challenger.observeField state value).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeExtension_bytes
+∀ (state : Aiur.NativeAIR.Challenger.State) (value : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.Challenger.observeExtension state value =
+    Aiur.NativeAIR.Challenger.observeBytes state (Aiur.NativeAIR.ProofCodec.encodeExtension value)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.observeExtension_valid
+∀ {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid →
+    ∀ (value : Aiur.NativeAIR.ProofCodec.Extension), (Aiur.NativeAIR.Challenger.observeExtension state value).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeExtensions_valid
+∀ {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid →
+    ∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+      (List.foldl Aiur.NativeAIR.Challenger.observeExtension state values).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeCap_empty
+∀ (state : Aiur.NativeAIR.Challenger.State), Aiur.NativeAIR.Challenger.observeCap state [] = state
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.observeCap_valid
+∀ {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid → ∀ (cap : Aiur.NativeAIR.KeyCodec.MerkleCap), (Aiur.NativeAIR.Challenger.observeCap state cap).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Challenger.sampleByte_buffered
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (input : List UInt8) (byte : UInt8) (rest : List UInt8),
+  Aiur.NativeAIR.Challenger.sampleByte hash { input := input, pending := byte :: rest } =
+    (byte, { input := input, pending := rest })
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleByte_refill
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (input : List UInt8),
+  Aiur.NativeAIR.Challenger.sampleByte hash { input := input, pending := [] } =
+    (hash input 31, { input := List.ofFn (hash input), pending := List.drop 1 (List.ofFn (hash input)).reverse })
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleByte_valid
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid → (Aiur.NativeAIR.Challenger.sampleByte hash state).snd.Valid
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.digest_reverse
+∀ (digest : Fin 32 → UInt8), (List.ofFn digest).reverse = digest 31 :: List.drop 1 (List.ofFn digest).reverse
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleByte_pending_bound
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (state : Aiur.NativeAIR.Challenger.State),
+  state.pending.length ≤ 32 → (Aiur.NativeAIR.Challenger.sampleByte hash state).snd.pending.length ≤ 32
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleBytes_length
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (count : Nat) (state : Aiur.NativeAIR.Challenger.State),
+  (Aiur.NativeAIR.Challenger.sampleBytes hash count state).fst.length = count
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleBytes_pending_bound
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (count : Nat) (state : Aiur.NativeAIR.Challenger.State),
+  state.pending.length ≤ 32 → (Aiur.NativeAIR.Challenger.sampleBytes hash count state).snd.pending.length ≤ 32
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleBytes_valid
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (count : Nat) {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid → (Aiur.NativeAIR.Challenger.sampleBytes hash count state).snd.Valid
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleBytes_buffered
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (input bytes rest : List UInt8),
+  Aiur.NativeAIR.Challenger.sampleBytes hash bytes.length { input := input, pending := bytes ++ rest } =
+    (bytes, { input := input, pending := rest })
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleBytes_refill
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (input : List UInt8),
+  Aiur.NativeAIR.Challenger.sampleBytes hash 32 { input := input, pending := [] } =
+    ((List.ofFn (hash input)).reverse, { input := List.ofFn (hash input), pending := [] })
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.littleEndian_bound
+∀ (bytes : List UInt8), Aiur.NativeAIR.Challenger.littleEndian bytes < 256 ^ bytes.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.littleEndian_encode
+∀ (count value : Nat),
+  value < 256 ^ count → Aiur.NativeAIR.Challenger.littleEndian (Aiur.NativeAIR.KeyCodec.encodeNat count value) = value
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.littleEndian_reads
+∀ (bytes : List UInt8),
+  Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.KeyCodec.readNat bytes.length) bytes
+    (Aiur.NativeAIR.Challenger.littleEndian bytes)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleWord_bound
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (state : Aiur.NativeAIR.Challenger.State),
+  (Aiur.NativeAIR.Challenger.sampleWord hash state).fst < 2 ^ 64
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleWord_full_mask
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (state : Aiur.NativeAIR.Challenger.State),
+  (Aiur.NativeAIR.Challenger.sampleWord hash state).fst &&& 2 ^ 64 - 1 =
+    (Aiur.NativeAIR.Challenger.sampleWord hash state).fst
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleWord_reads
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (state : Aiur.NativeAIR.Challenger.State),
+  Aiur.NativeAIR.KeyCodec.Reads (Aiur.NativeAIR.KeyCodec.readNat 8)
+    (Aiur.NativeAIR.Challenger.sampleBytes hash 8 state).fst (Aiur.NativeAIR.Challenger.sampleWord hash state).fst
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.FieldSample.positive
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {state final : Aiur.NativeAIR.Challenger.State} {count : Nat}
+  {value : Aiur.G}, Aiur.NativeAIR.Challenger.FieldSample hash state count value final → 0 < count
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleField_success
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.G},
+  Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value, final) →
+    ∃ count, count ≤ fuel ∧ Aiur.NativeAIR.Challenger.FieldSample hash state count value final
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.FieldSample.complete
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {state final : Aiur.NativeAIR.Challenger.State} {count : Nat}
+  {value : Aiur.G},
+  Aiur.NativeAIR.Challenger.FieldSample hash state count value final →
+    ∀ (fuel : Nat), count ≤ fuel → Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value, final)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleField_iff
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (fuel : Nat) (state final : Aiur.NativeAIR.Challenger.State)
+  (value : Aiur.G),
+  Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value, final) ↔
+    ∃ count, count ≤ fuel ∧ Aiur.NativeAIR.Challenger.FieldSample hash state count value final
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleField_mono
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel more : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.G},
+  Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value, final) →
+    fuel ≤ more → Aiur.NativeAIR.Challenger.sampleField hash more state = some (value, final)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleField_unique
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel other : Nat} {state left right : Aiur.NativeAIR.Challenger.State}
+  {a b : Aiur.G},
+  Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (a, left) →
+    Aiur.NativeAIR.Challenger.sampleField hash other state = some (b, right) → a = b ∧ left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.FieldSample.valid
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {state final : Aiur.NativeAIR.Challenger.State} {count : Nat}
+  {value : Aiur.G}, Aiur.NativeAIR.Challenger.FieldSample hash state count value final → state.Valid → final.Valid
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleField_valid
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.G},
+  Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value, final) → state.Valid → final.Valid
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleField_canonical
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.G},
+  Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value, final) →
+    ∃ before, Aiur.NativeAIR.Challenger.sampleWord hash before = (value.n, final) ∧ value.n < Aiur.gSize.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleExtension_success
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Challenger.sampleExtension hash fuel state = some (value, final) →
+    ∃ next,
+      Aiur.NativeAIR.Challenger.sampleField hash fuel state = some (value.c0, next) ∧
+        Aiur.NativeAIR.Challenger.sampleField hash fuel next = some (value.c1, final)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleExtension_mono
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel more : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Challenger.sampleExtension hash fuel state = some (value, final) →
+    fuel ≤ more → Aiur.NativeAIR.Challenger.sampleExtension hash more state = some (value, final)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleExtension_valid
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {state final : Aiur.NativeAIR.Challenger.State}
+  {value : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Challenger.sampleExtension hash fuel state = some (value, final) → state.Valid → final.Valid
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleBits_success
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {bits value : Nat} {state final : Aiur.NativeAIR.Challenger.State},
+  Aiur.NativeAIR.Challenger.sampleBits hash bits state = some (value, final) →
+    bits < 64 ∧
+      2 ^ bits < Aiur.gSize.toNat ∧
+        value = (Aiur.NativeAIR.Challenger.sampleWord hash state).fst % 2 ^ bits ∧
+          final = (Aiur.NativeAIR.Challenger.sampleWord hash state).snd ∧ value < 2 ^ bits
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleBits_zero
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (state : Aiur.NativeAIR.Challenger.State),
+  Aiur.NativeAIR.Challenger.sampleBits hash 0 state = some (0, (Aiur.NativeAIR.Challenger.sampleWord hash state).snd)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.sampleBits_mask
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {bits value : Nat} {state final : Aiur.NativeAIR.Challenger.State},
+  Aiur.NativeAIR.Challenger.sampleBits hash bits state = some (value, final) →
+    value = (Aiur.NativeAIR.Challenger.sampleWord hash state).fst &&& 2 ^ bits - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.sampleBits_valid
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {bits value : Nat} {state final : Aiur.NativeAIR.Challenger.State},
+  Aiur.NativeAIR.Challenger.sampleBits hash bits state = some (value, final) → state.Valid → final.Valid
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.checkWitness_zero
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (witness : Aiur.G) (state : Aiur.NativeAIR.Challenger.State),
+  Aiur.NativeAIR.Challenger.checkWitness hash 0 witness state = some (true, state)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.checkWitness_positive
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) {bits : Nat},
+  bits ≠ 0 →
+    ∀ (witness : Aiur.G) (state : Aiur.NativeAIR.Challenger.State),
+      Aiur.NativeAIR.Challenger.checkWitness hash bits witness state = do
+        let __x ← Aiur.NativeAIR.Challenger.sampleBits hash bits (Aiur.NativeAIR.Challenger.observeField state witness)
+        match __x with
+          | (value, next) => pure (value == 0, next)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Challenger.checkWitness_true_iff
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (bits : Nat) (witness : Aiur.G)
+  (state final : Aiur.NativeAIR.Challenger.State),
+  Aiur.NativeAIR.Challenger.checkWitness hash bits witness state = some (true, final) ↔
+    bits = 0 ∧ final = state ∨
+      bits ≠ 0 ∧
+        Aiur.NativeAIR.Challenger.sampleBits hash bits (Aiur.NativeAIR.Challenger.observeField state witness) =
+          some (0, final)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Challenger.checkWitness_valid
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {bits : Nat} {witness : Aiur.G}
+  {state final : Aiur.NativeAIR.Challenger.State} {accepted : Bool},
+  Aiur.NativeAIR.Challenger.checkWitness hash bits witness state = some (accepted, final) → state.Valid → final.Valid
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.seed_length
+∀ (parameters : Aiur.NativeAIR.KeyCodec.Parameters), (Aiur.NativeAIR.Transcript.seed parameters).length = 70
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.circuitShape_length
+∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit), (Aiur.NativeAIR.Transcript.circuitShape circuit).length = 7
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.shape_length
+∀ (key : Aiur.NativeAIR.KeyCodec.Key), (Aiur.NativeAIR.Transcript.shape key).length = 1 + 7 * key.circuits.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.fieldsBytes_length
+∀ (values : List Aiur.G), (Aiur.NativeAIR.Transcript.fieldsBytes values).length = 8 * values.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.observeFields_bytes
+∀ (state : Aiur.NativeAIR.Challenger.State) (values : List Aiur.G),
+  List.foldl Aiur.NativeAIR.Challenger.observeField state values =
+    Aiur.NativeAIR.Challenger.observeBytes state (Aiur.NativeAIR.Transcript.fieldsBytes values)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.claimsFields_framing
+∀ (claims : List (List Aiur.G)),
+  Aiur.NativeAIR.Transcript.claimsFields claims =
+    Aiur.G.ofNat claims.length :: List.flatMap (fun claim => Aiur.G.ofNat claim.length :: claim) claims
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.lookupState_schedule
+∀ (key : Aiur.NativeAIR.KeyCodec.Key) (proof : Aiur.NativeAIR.ProofCodec.Data) (claims : List (List Aiur.G)),
+  Aiur.NativeAIR.Transcript.lookupState key proof claims =
+    List.foldl Aiur.NativeAIR.Challenger.observeField
+      (List.foldl Aiur.NativeAIR.Challenger.observeField
+        (Aiur.NativeAIR.Challenger.observeCap
+          (Aiur.NativeAIR.Challenger.observeCap
+            (List.foldl Aiur.NativeAIR.Challenger.observeField
+              (List.foldl Aiur.NativeAIR.Challenger.observeField
+                (Aiur.NativeAIR.Challenger.initial (Aiur.NativeAIR.Transcript.seed key.parameters))
+                (Aiur.NativeAIR.Transcript.shape key))
+              (List.map (fun active => if active = true then 1 else 0) proof.active))
+            (key.preprocessedCommitment.getD []))
+          proof.commitments.stage1)
+        (List.map (fun degree => Aiur.G.ofNat degree.toNat) proof.logDegrees))
+      (Aiur.NativeAIR.Transcript.claimsFields claims)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.lookupState_valid
+∀ (key : Aiur.NativeAIR.KeyCodec.Key) (proof : Aiur.NativeAIR.ProofCodec.Data) (claims : List (List Aiur.G)),
+  (Aiur.NativeAIR.Transcript.lookupState key proof claims).Valid
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.accumulatorState_valid
+∀ (proof : Aiur.NativeAIR.ProofCodec.Data) {state : Aiur.NativeAIR.Challenger.State},
+  state.Valid → (Aiur.NativeAIR.Transcript.accumulatorState proof state).Valid
+AXIOMS []
+ROOT Aiur.NativeAIR.Transcript.replay_success
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result →
+    Aiur.NativeAIR.Transcript.Replay.Reads hash fuel key proof claims result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.Replay.Reads.complete
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.Replay.Reads hash fuel key proof claims result →
+    Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Transcript.replay_iff
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (fuel : Nat) (key : Aiur.NativeAIR.KeyCodec.Key)
+  (proof : Aiur.NativeAIR.ProofCodec.Data) (claims : List (List Aiur.G)) (result : Aiur.NativeAIR.Transcript.Replay),
+  Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result ↔
+    Aiur.NativeAIR.Transcript.Replay.Reads hash fuel key proof claims result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.replay_mono
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel more : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result →
+    fuel ≤ more → Aiur.NativeAIR.Transcript.replay hash more key proof claims = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.replay_unique
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel other : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)}
+  {left right : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some left →
+    Aiur.NativeAIR.Transcript.replay hash other key proof claims = some right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.replay_valid
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result → result.state.Valid
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.verifyArithmetic_success
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {rows : List Aiur.NativeAIR.ProofShape.Row}
+  {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.verifyArithmetic hash fuel key proof claims rows = some result →
+    Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result ∧
+      Aiur.NativeAIR.VerifierArithmetic.verify result.challenges claims rows = some true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.verifyArithmetic_iff
+∀ (hash : Aiur.NativeAIR.Challenger.Hash32) (fuel : Nat) (key : Aiur.NativeAIR.KeyCodec.Key)
+  (proof : Aiur.NativeAIR.ProofCodec.Data) (claims : List (List Aiur.G)) (rows : List Aiur.NativeAIR.ProofShape.Row)
+  (result : Aiur.NativeAIR.Transcript.Replay),
+  Aiur.NativeAIR.Transcript.verifyArithmetic hash fuel key proof claims rows = some result ↔
+    Aiur.NativeAIR.Transcript.replay hash fuel key proof claims = some result ∧
+      Aiur.NativeAIR.VerifierArithmetic.verify result.challenges claims rows = some true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Transcript.verifyArithmetic_mono
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel more : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {rows : List Aiur.NativeAIR.ProofShape.Row}
+  {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.verifyArithmetic hash fuel key proof claims rows = some result →
+    fuel ≤ more → Aiur.NativeAIR.Transcript.verifyArithmetic hash more key proof claims rows = some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.transcript_row
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof backend.keyData bytes)
+  {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {claims : List (List Aiur.G)}
+  {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Transcript.verifyArithmetic hash fuel backend.keyData checked.data claims checked.rows = some result →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      checked.rows[position]? = some row →
+        Aiur.NativeAIR.Transcript.Replay.Reads hash fuel backend.keyData checked.data claims result ∧
+          Aiur.NativeAIR.ProofShape.Row.Sourced backend.keyData checked.data row.circuitIndex position row ∧
+            Aiur.NativeAIR.ProofShape.Row.Fits backend.keyData.parameters row ∧
+              ∃ initial before evaluation,
+                Aiur.NativeAIR.VerifierArithmetic.initialAccumulator result.challenges claims = some initial ∧
+                  (initial :: List.map (fun x => x.accumulator) checked.rows)[position]? = some before ∧
+                    Aiur.NativeAIR.VerifierArithmetic.evaluate result.challenges row before = some evaluation ∧
+                      Aiur.NativeAIR.Quotient.composition result.challenges.alpha evaluation.constraints =
+                        Aiur.NativeAIR.Domain.vanishing evaluation.domain result.challenges.zeta *
+                          evaluation.quotientValue
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.leftLen_positive
+∀ (size : Nat), 0 < Aiur.NativeAIR.Blake3.leftLen size
+AXIOMS []
+ROOT Aiur.NativeAIR.Blake3.leftLen_lt
+∀ {size : Nat}, 1024 < size → Aiur.NativeAIR.Blake3.leftLen size < size
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.schedules_permute
+∀ (index : Fin 7), Aiur.NativeAIR.Blake3.schedules[index].toList.Perm (List.finRange 16)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.schedules_next
+∀ (index : Fin 6),
+  Aiur.NativeAIR.Blake3.schedules[↑index + 1] =
+    Vector.ofFn fun position => Aiur.NativeAIR.Blake3.schedules[↑index][Aiur.NativeAIR.Blake3.schedules[1][position]]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.rotateRight_bits
+∀ (word count : UInt32),
+  0 < count.toNat →
+    count.toNat < 32 → (Aiur.NativeAIR.Blake3.rotateRight word count).toBitVec = word.toBitVec.rotateRight count.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.bytesWord_value
+∀ (bytes : Vector UInt8 4),
+  (Aiur.NativeAIR.Blake3.bytesWord bytes).toNat = Aiur.NativeAIR.Challenger.littleEndian bytes.toList
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.wordBytes_encoding
+∀ (word : UInt32), (Aiur.NativeAIR.Blake3.wordBytes word).toList = Aiur.NativeAIR.KeyCodec.encodeNat 4 word.toNat
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.bytesWord_wordBytes
+∀ (word : UInt32), Aiur.NativeAIR.Blake3.bytesWord (Aiur.NativeAIR.Blake3.wordBytes word) = word
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.bytesWord_pack
+∀ (a b c d : UInt8),
+  (Aiur.NativeAIR.Blake3.bytesWord #v[a, b, c, d]).toNat = a.toNat + 256 * (b.toNat + 256 * (c.toNat + 256 * d.toNat))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.wordBytes_pack
+∀ (a b c d : UInt8), Aiur.NativeAIR.Blake3.wordBytes (Aiur.NativeAIR.Blake3.bytesWord #v[a, b, c, d]) = #v[a, b, c, d]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.wordBytes_bytesWord
+∀ (bytes : Vector UInt8 4), Aiur.NativeAIR.Blake3.wordBytes (Aiur.NativeAIR.Blake3.bytesWord bytes) = bytes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.bytesWord_injective
+∀ {first second : Vector UInt8 4},
+  Aiur.NativeAIR.Blake3.bytesWord first = Aiur.NativeAIR.Blake3.bytesWord second → first = second
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.blockWords_byte
+∀ (input : List UInt8) (word : Fin 16) (byte : Fin 4),
+  (Vector.ofFn fun byte => input.toArray[↑word * 4 + ↑byte]?.getD 0)[byte] = input[↑word * 4 + ↑byte]?.getD 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.blockWords_value
+∀ (input : List UInt8) (word : Fin 16),
+  (Aiur.NativeAIR.Blake3.blockWords input)[word].toNat =
+    Aiur.NativeAIR.Challenger.littleEndian (List.ofFn fun byte => input[↑word * 4 + ↑byte]?.getD 0)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.cvBytes_value
+∀ (cv : Aiur.NativeAIR.Blake3.CV) (index : Fin 32),
+  (Aiur.NativeAIR.Blake3.cvBytes cv)[index] = (cv[↑index / 4].toNat / 256 ^ (↑index % 4)).toUInt8
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.g_unchanged
+∀ (state : Aiur.NativeAIR.Blake3.Block) (a b c d index : Fin 16) (x y : UInt32),
+  a ≠ index → b ≠ index → c ≠ index → d ≠ index → (Aiur.NativeAIR.Blake3.g state a b c d x y)[index] = state[index]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.g_values
+∀ (state : Aiur.NativeAIR.Blake3.Block) (a b c d : Fin 16) (x y : UInt32),
+  a ≠ b →
+    a ≠ c →
+      a ≠ d →
+        b ≠ c →
+          b ≠ d →
+            c ≠ d →
+              have words := Aiur.NativeAIR.Blake3.mix state[a] state[b] state[c] state[d] x y;
+              (Aiur.NativeAIR.Blake3.g state a b c d x y)[a] = words[0] ∧
+                (Aiur.NativeAIR.Blake3.g state a b c d x y)[b] = words[1] ∧
+                  (Aiur.NativeAIR.Blake3.g state a b c d x y)[c] = words[2] ∧
+                    (Aiur.NativeAIR.Blake3.g state a b c d x y)[d] = words[3]
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.initialWords_counter
+∀ (cv : Aiur.NativeAIR.Blake3.CV) (counter : UInt64) (blockLen flags : UInt32),
+  (Aiur.NativeAIR.Blake3.initialWords cv counter blockLen flags)[12].toNat +
+      2 ^ 32 * (Aiur.NativeAIR.Blake3.initialWords cv counter blockLen flags)[13].toNat =
+    counter.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.parentOutput_values
+∀ (left right : Aiur.NativeAIR.Blake3.CV),
+  (Aiur.NativeAIR.Blake3.parentOutput left right).cv = Aiur.NativeAIR.Blake3.iv ∧
+    (Aiur.NativeAIR.Blake3.parentOutput left right).block = left ++ right ∧
+      (Aiur.NativeAIR.Blake3.parentOutput left right).blockLen = 64 ∧
+        (Aiur.NativeAIR.Blake3.parentOutput left right).counter = 0 ∧
+          (Aiur.NativeAIR.Blake3.parentOutput left right).flags = 4
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.leftLen_bounds
+∀ {size : Nat}, 1024 < size → Aiur.NativeAIR.Blake3.leftLen size < size ∧ size ≤ 2 * Aiur.NativeAIR.Blake3.leftLen size
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.leftLen_chunks
+∀ {size : Nat}, 1024 < size → ∃ exponent, Aiur.NativeAIR.Blake3.leftLen size = 1024 * 2 ^ exponent
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.leftLen_chunk_multiple
+∀ {size : Nat}, 1024 < size → Aiur.NativeAIR.Blake3.leftLen size / 1024 * 1024 = Aiur.NativeAIR.Blake3.leftLen size
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.leftLen_unique
+∀ {left right exponent : Nat},
+  left = 1024 * 2 ^ exponent → 0 < right → right ≤ left → Aiur.NativeAIR.Blake3.leftLen (left + right) = left
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkLoop_small
+∀ (counter : UInt64) (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8),
+  input.length ≤ 64 →
+    Aiur.NativeAIR.Blake3.chunkLoop counter cv start input =
+      { cv := cv, block := Aiur.NativeAIR.Blake3.blockWords input, blockLen := input.length.toUInt32,
+        counter := counter, flags := (if start = true then 1 else 0) ||| 2 }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkLoop_step
+∀ (counter : UInt64) (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8),
+  64 < input.length →
+    Aiur.NativeAIR.Blake3.chunkLoop counter cv start input =
+      Aiur.NativeAIR.Blake3.chunkLoop counter
+        (Aiur.NativeAIR.Blake3.compress cv (Aiur.NativeAIR.Blake3.blockWords (List.take 64 input)) counter 64
+          (if start = true then 1 else 0))
+        false (List.drop 64 input)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkLoop_counter
+∀ (counter : UInt64) (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8),
+  (Aiur.NativeAIR.Blake3.chunkLoop counter cv start input).counter = counter
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkOutput_counter
+∀ (counter : UInt64) (input : List UInt8), (Aiur.NativeAIR.Blake3.chunkOutput counter input).counter = counter
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkLoop_reads
+∀ (counter : UInt64) (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8),
+  Aiur.NativeAIR.Blake3.ChunkReads counter cv start input (Aiur.NativeAIR.Blake3.chunkLoop counter cv start input)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.ChunkReads.complete
+∀ {counter : UInt64} {cv : Aiur.NativeAIR.Blake3.CV} {start : Bool} {input : List UInt8}
+  {output : Aiur.NativeAIR.Blake3.Output},
+  Aiur.NativeAIR.Blake3.ChunkReads counter cv start input output →
+    Aiur.NativeAIR.Blake3.chunkLoop counter cv start input = output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkLoop_iff
+∀ (counter : UInt64) (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8)
+  (output : Aiur.NativeAIR.Blake3.Output),
+  Aiur.NativeAIR.Blake3.chunkLoop counter cv start input = output ↔
+    Aiur.NativeAIR.Blake3.ChunkReads counter cv start input output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.ChunkReads.framing
+∀ {counter : UInt64} {cv : Aiur.NativeAIR.Blake3.CV} {start : Bool} {input : List UInt8}
+  {output : Aiur.NativeAIR.Blake3.Output},
+  Aiur.NativeAIR.Blake3.ChunkReads counter cv start input output →
+    ∃ count,
+      have remaining := List.drop (64 * count) input;
+      remaining.length ≤ 64 ∧
+        (input ≠ [] → 0 < remaining.length) ∧
+          output.block = Aiur.NativeAIR.Blake3.blockWords remaining ∧
+            output.blockLen.toNat = remaining.length ∧
+              output.counter = counter ∧ output.flags = (if (start && count == 0) = true then 1 else 0) ||| 2
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.chunkOutput_framing
+∀ (counter : UInt64) (input : List UInt8),
+  input.length ≤ 1024 →
+    ∃ count,
+      count < 16 ∧
+        have remaining := List.drop (64 * count) input;
+        remaining.length ≤ 64 ∧
+          (input ≠ [] → 0 < remaining.length) ∧
+            (Aiur.NativeAIR.Blake3.chunkOutput counter input).block = Aiur.NativeAIR.Blake3.blockWords remaining ∧
+              (Aiur.NativeAIR.Blake3.chunkOutput counter input).blockLen.toNat = remaining.length ∧
+                (Aiur.NativeAIR.Blake3.chunkOutput counter input).counter = counter ∧
+                  (Aiur.NativeAIR.Blake3.chunkOutput counter input).flags = if count = 0 then 3 else 2
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.subtree_small
+∀ (counter : Nat) (input : List UInt8),
+  input.length ≤ 1024 →
+    Aiur.NativeAIR.Blake3.subtree counter input = Aiur.NativeAIR.Blake3.chunkOutput counter.toUInt64 input
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.subtree_step
+∀ (counter : Nat) (input : List UInt8),
+  1024 < input.length →
+    Aiur.NativeAIR.Blake3.subtree counter input =
+      Aiur.NativeAIR.Blake3.parentOutput
+        (Aiur.NativeAIR.Blake3.subtree counter
+            (List.take (Aiur.NativeAIR.Blake3.leftLen input.length) input)).chainingValue
+        (Aiur.NativeAIR.Blake3.subtree (counter + Aiur.NativeAIR.Blake3.leftLen input.length / 1024)
+            (List.drop (Aiur.NativeAIR.Blake3.leftLen input.length) input)).chainingValue
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.subtree_root_counter
+∀ (input : List UInt8), (Aiur.NativeAIR.Blake3.subtree 0 input).counter = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.subtree_tree
+∀ (counter : Nat) (input : List UInt8),
+  Aiur.NativeAIR.Blake3.TreeHash counter input (Aiur.NativeAIR.Blake3.subtree counter input)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.TreeHash.complete
+∀ {counter : Nat} {input : List UInt8} {output : Aiur.NativeAIR.Blake3.Output},
+  Aiur.NativeAIR.Blake3.TreeHash counter input output → Aiur.NativeAIR.Blake3.subtree counter input = output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.subtree_iff
+∀ (counter : Nat) (input : List UInt8) (output : Aiur.NativeAIR.Blake3.Output),
+  Aiur.NativeAIR.Blake3.subtree counter input = output ↔ Aiur.NativeAIR.Blake3.TreeHash counter input output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.TreeHash.unique
+∀ {counter : Nat} {input : List UInt8} {first second : Aiur.NativeAIR.Blake3.Output},
+  Aiur.NativeAIR.Blake3.TreeHash counter input first →
+    Aiur.NativeAIR.Blake3.TreeHash counter input second → first = second
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.native_counter
+∀ {counter : Nat} {input : List UInt8},
+  counter * 1024 + input.length < 2 ^ 64 → counter < 2 ^ 54 ∧ counter.toUInt64.toNat = counter
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.native_child_spans
+∀ {counter : Nat} {input : List UInt8},
+  counter * 1024 + input.length < 2 ^ 64 →
+    1024 < input.length →
+      counter * 1024 + (List.take (Aiur.NativeAIR.Blake3.leftLen input.length) input).length < 2 ^ 64 ∧
+        (counter + Aiur.NativeAIR.Blake3.leftLen input.length / 1024) * 1024 +
+            (List.drop (Aiur.NativeAIR.Blake3.leftLen input.length) input).length <
+          2 ^ 64
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.ChunkAt.native
+∀ {counter leaf : Nat} {input bytes : List UInt8},
+  Aiur.NativeAIR.Blake3.ChunkAt counter input leaf bytes →
+    counter * 1024 + input.length < 2 ^ 64 → bytes.length ≤ 1024 ∧ leaf < 2 ^ 54 ∧ leaf.toUInt64.toNat = leaf
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.digest_native_counters
+∀ {input bytes : List UInt8},
+  Aiur.NativeAIR.Blake3.NativeInput input →
+    ∀ {leaf : Nat},
+      Aiur.NativeAIR.Blake3.ChunkAt 0 input leaf bytes →
+        bytes.length ≤ 1024 ∧ leaf < 2 ^ 54 ∧ leaf.toUInt64.toNat = leaf
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.digest_tree
+∀ (input : List UInt8),
+  ∃ output,
+    Aiur.NativeAIR.Blake3.TreeHash 0 input output ∧
+      output.counter = 0 ∧ Aiur.NativeAIR.Blake3.digest input = output.rootHash
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.replay_iff
+∀ (fuel : Nat) (key : Aiur.NativeAIR.KeyCodec.Key) (proof : Aiur.NativeAIR.ProofCodec.Data)
+  (claims : List (List Aiur.G)) (result : Aiur.NativeAIR.Transcript.Replay),
+  Aiur.NativeAIR.Blake3.replay fuel key proof claims = some result ↔
+    Aiur.NativeAIR.Transcript.Replay.Reads Aiur.NativeAIR.Blake3.hash fuel key proof claims result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.replay_unique
+∀ {fuel more : Nat} {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data}
+  {claims : List (List Aiur.G)} {first second : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Blake3.replay fuel key proof claims = some first →
+    Aiur.NativeAIR.Blake3.replay more key proof claims = some second → first = second
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.verifyArithmetic_iff
+∀ (fuel : Nat) (key : Aiur.NativeAIR.KeyCodec.Key) (proof : Aiur.NativeAIR.ProofCodec.Data)
+  (claims : List (List Aiur.G)) (rows : List Aiur.NativeAIR.ProofShape.Row) (result : Aiur.NativeAIR.Transcript.Replay),
+  Aiur.NativeAIR.Blake3.verifyArithmetic fuel key proof claims rows = some result ↔
+    Aiur.NativeAIR.Blake3.replay fuel key proof claims = some result ∧
+      Aiur.NativeAIR.VerifierArithmetic.verify result.challenges claims rows = some true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Blake3.hash_bytes
+∀ (input : List UInt8),
+  List.ofFn (Aiur.NativeAIR.Blake3.hash input) = Vector.toList (Aiur.NativeAIR.Blake3.digest input)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.BoundVerifier.CompiledBackend.blake3_transcript_row
+∀ {selection : Aiur.BoundVerifier.Selection} (backend : Aiur.BoundVerifier.CompiledBackend selection)
+  {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof backend.keyData bytes) {fuel : Nat}
+  {claims : List (List Aiur.G)} {result : Aiur.NativeAIR.Transcript.Replay},
+  Aiur.NativeAIR.Blake3.verifyArithmetic fuel backend.keyData checked.data claims checked.rows = some result →
+    ∀ {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+      checked.rows[position]? = some row →
+        Aiur.NativeAIR.Transcript.Replay.Reads Aiur.NativeAIR.Blake3.hash fuel backend.keyData checked.data claims
+            result ∧
+          Aiur.NativeAIR.ProofShape.Row.Sourced backend.keyData checked.data row.circuitIndex position row ∧
+            Aiur.NativeAIR.ProofShape.Row.Fits backend.keyData.parameters row ∧
+              ∃ initial before evaluation,
+                Aiur.NativeAIR.VerifierArithmetic.initialAccumulator result.challenges claims = some initial ∧
+                  (initial :: List.map (fun x => x.accumulator) checked.rows)[position]? = some before ∧
+                    Aiur.NativeAIR.VerifierArithmetic.evaluate result.challenges row before = some evaluation ∧
+                      Aiur.NativeAIR.Quotient.composition result.challenges.alpha evaluation.constraints =
+                        Aiur.NativeAIR.Domain.vanishing evaluation.domain result.challenges.zeta *
+                          evaluation.quotientValue
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.maxDegree_nil
+Aiur.NativeAIR.MerkleCap.maxDegree [] = 0
+AXIOMS []
+ROOT Aiur.NativeAIR.MerkleCap.maxDegree_cons
+∀ (degree : Nat) (degrees : List Nat),
+  Aiur.NativeAIR.MerkleCap.maxDegree (degree :: degrees) = max degree (Aiur.NativeAIR.MerkleCap.maxDegree degrees)
+AXIOMS []
+ROOT Aiur.NativeAIR.MerkleCap.degree_le_max
+∀ {degree : Nat} {degrees : List Nat}, degree ∈ degrees → degree ≤ Aiur.NativeAIR.MerkleCap.maxDegree degrees
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.maxDegree_le
+∀ {degrees : List Nat} {bound : Nat},
+  (∀ (degree : Nat), degree ∈ degrees → degree ≤ bound) → Aiur.NativeAIR.MerkleCap.maxDegree degrees ≤ bound
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.maxDegree_mono
+∀ {selected degrees : List Nat},
+  (∀ (degree : Nat), degree ∈ selected → degree ∈ degrees) →
+    Aiur.NativeAIR.MerkleCap.maxDegree selected ≤ Aiur.NativeAIR.MerkleCap.maxDegree degrees
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_iff
+∀ {logBlowup capHeight : Nat} {degrees : List Nat},
+  Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true ↔
+    ∀ (degree : Nat),
+      degree ∈ degrees → min (capHeight - logBlowup) (Aiur.NativeAIR.MerkleCap.maxDegree degrees) ≤ degree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_height_iff
+∀ {logBlowup capHeight : Nat} {degrees : List Nat},
+  Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true ↔
+    ∀ (degree : Nat),
+      degree ∈ degrees → min capHeight (logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees) ≤ logBlowup + degree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_empty
+∀ (logBlowup capHeight : Nat), Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight [] = true
+AXIOMS []
+ROOT Aiur.NativeAIR.MerkleCap.coverage_low_cap
+∀ {logBlowup capHeight : Nat},
+  capHeight ≤ logBlowup → ∀ (degrees : List Nat), Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_uniform
+∀ {logBlowup capHeight degree : Nat} {degrees : List Nat},
+  (∀ (d : Nat), d ∈ degrees → d = degree) → Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_subset
+∀ {logBlowup capHeight : Nat} {degrees selected : List Nat},
+  Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true →
+    (∀ (degree : Nat), degree ∈ selected → degree ∈ degrees) →
+      Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight selected = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_injection
+∀ {logBlowup capHeight : Nat} {degrees : List Nat},
+  Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true →
+    ∀ {degree : Nat},
+      degree ∈ degrees →
+        logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees - (logBlowup + degree) ≤
+          logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees -
+            min capHeight (logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.coverage_cap_size
+∀ {logBlowup capHeight : Nat} {degrees : List Nat},
+  Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = true →
+    ∀ {degree : Nat},
+      degree ∈ degrees →
+        2 ^ min capHeight (logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees) ≤ 2 ^ (logBlowup + degree)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.omitted_rejected
+∀ {logBlowup capHeight degree : Nat} {degrees : List Nat},
+  degree ∈ degrees →
+    logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees -
+          min capHeight (logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees) <
+        logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree degrees - (logBlowup + degree) →
+      Aiur.NativeAIR.MerkleCap.coverage logBlowup capHeight degrees = false
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.shorter_matrix_rejected
+Aiur.NativeAIR.MerkleCap.coverage 0 2 [3, 1] = false
+AXIOMS []
+ROOT Aiur.NativeAIR.MerkleCap.exact_injection_accepted
+Aiur.NativeAIR.MerkleCap.coverage 0 1 [3, 1] = true
+AXIOMS []
+ROOT Aiur.NativeAIR.MerkleCap.check_iff
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.MerkleCap.check key proof = true ↔
+    ∀ (degree : UInt8),
+      degree ∈ proof.logDegrees →
+        min key.parameters.capHeight
+            (key.parameters.logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree (List.map UInt8.toNat proof.logDegrees)) ≤
+          key.parameters.logBlowup + degree.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.MerkleCap.check_degree
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data},
+  Aiur.NativeAIR.MerkleCap.check key proof = true →
+    ∀ {position : Nat} {degree : UInt8},
+      proof.logDegrees[position]? = some degree →
+        min key.parameters.capHeight
+            (key.parameters.logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree (List.map UInt8.toNat proof.logDegrees)) ≤
+          key.parameters.logBlowup + degree.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.cap_coverage
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes),
+  Aiur.NativeAIR.MerkleCap.coverage key.parameters.logBlowup key.parameters.capHeight
+      (List.map UInt8.toNat checked.data.logDegrees) =
+    true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.row_cap
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes)
+  {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+  checked.rows[position]? = some row →
+    min key.parameters.capHeight
+        (key.parameters.logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree (List.map UInt8.toNat checked.data.logDegrees)) ≤
+      key.parameters.logBlowup + row.logDegree.toNat
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.CheckedProof.row_injection
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {bytes : ByteArray} (checked : Aiur.BoundVerifier.CheckedProof key bytes)
+  {position : Nat} {row : Aiur.NativeAIR.ProofShape.Row},
+  checked.rows[position]? = some row →
+    key.parameters.logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree (List.map UInt8.toNat checked.data.logDegrees) -
+        (key.parameters.logBlowup + row.logDegree.toNat) ≤
+      key.parameters.logBlowup + Aiur.NativeAIR.MerkleCap.maxDegree (List.map UInt8.toNat checked.data.logDegrees) -
+        key.parameters.capHeight
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.BoundVerifier.verifyShaped_cap
+∀ {selection : Aiur.BoundVerifier.Selection} {backend : Aiur.BoundVerifier.CompiledBackend selection}
+  {input : Array Aiur.G} {bytes : ByteArray},
+  Aiur.BoundVerifier.verifyShaped backend input bytes = Except.ok () →
+    ∃ checked,
+      Aiur.BoundVerifier.readProof backend.keyData bytes = Except.ok checked ∧
+        Aiur.NativeAIR.MerkleCap.check backend.keyData checked.data = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.fieldsBytes_injective
+∀ {left right : List Aiur.G},
+  Aiur.NativeAIR.Transcript.fieldsBytes left = Aiur.NativeAIR.Transcript.fieldsBytes right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.pairBytes_length
+∀ (left right : Aiur.NativeAIR.Merkle.Digest), (Aiur.NativeAIR.Merkle.pairBytes left right).length = 64
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Merkle.pairBytes_injective
+∀ {left right otherLeft otherRight : Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.pairBytes left right = Aiur.NativeAIR.Merkle.pairBytes otherLeft otherRight →
+    left = otherLeft ∧ right = otherRight
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Merkle.branchBytes_injective
+∀ {index : Nat} {left right leftSibling rightSibling : Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.branchBytes index left leftSibling =
+      Aiur.NativeAIR.Merkle.branchBytes index right rightSibling →
+    left = right ∧ leftSibling = rightSibling
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Merkle.shape_length
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {rows : List (List Aiur.G)},
+  Aiur.NativeAIR.Merkle.shape dimensions rows = true → rows.length = dimensions.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.rowsAt_absent
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {rows : List (List Aiur.G)} {height : Nat},
+  Aiur.NativeAIR.Merkle.hasHeight dimensions height = false → Aiur.NativeAIR.Merkle.rowsAt dimensions rows height = []
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.rowsAt_injective
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {left right : List (List Aiur.G)},
+  Aiur.NativeAIR.Merkle.shape dimensions left = true →
+    Aiur.NativeAIR.Merkle.shape dimensions right = true →
+      (∀ (height : Nat),
+          (Aiur.NativeAIR.Merkle.rowsAt dimensions left height).flatten =
+            (Aiur.NativeAIR.Merkle.rowsAt dimensions right height).flatten) →
+        left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.rowBytes_injective
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {left right : List (List Aiur.G)},
+  Aiur.NativeAIR.Merkle.shape dimensions left = true →
+    Aiur.NativeAIR.Merkle.shape dimensions right = true →
+      (∀ (height : Nat),
+          Aiur.NativeAIR.Merkle.rowBytes dimensions left height =
+            Aiur.NativeAIR.Merkle.rowBytes dimensions right height) →
+        left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.CollisionOn.mono
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {smaller larger : List (List UInt8)},
+  (∀ (input : List UInt8), input ∈ smaller → input ∈ larger) →
+    Aiur.NativeAIR.Merkle.CollisionOn hash smaller → Aiur.NativeAIR.Merkle.CollisionOn hash larger
+AXIOMS []
+ROOT Aiur.NativeAIR.Merkle.equal_of_no_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {inputs : List (List UInt8)},
+  ¬Aiur.NativeAIR.Merkle.CollisionOn hash inputs →
+    ∀ {left right : List UInt8}, left ∈ inputs → right ∈ inputs → hash left = hash right → left = right
+AXIOMS []
+ROOT Aiur.NativeAIR.Merkle.step_calls
+∀ (hash : Aiur.NativeAIR.Merkle.Hash) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions) (rows : List (List Aiur.G))
+  (height index : Nat) (current sibling : Aiur.NativeAIR.Merkle.Digest),
+  (Aiur.NativeAIR.Merkle.step hash dimensions rows height index current sibling).inputs.length ≤ 3
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.walk_calls
+∀ (hash : Aiur.NativeAIR.Merkle.Hash) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions) (rows : List (List Aiur.G))
+  (height index : Nat) (current : Aiur.NativeAIR.Merkle.Digest) (proof : List Aiur.NativeAIR.Merkle.Digest),
+  (Aiur.NativeAIR.Merkle.walk hash dimensions rows height index current proof).inputs.length ≤ 3 * proof.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.step_binding
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions}
+  {leftRows rightRows : List (List Aiur.G)} {height index : Nat}
+  {left right leftSibling rightSibling : Aiur.NativeAIR.Merkle.Digest},
+  ¬Aiur.NativeAIR.Merkle.CollisionOn hash
+        ((Aiur.NativeAIR.Merkle.step hash dimensions leftRows height index left leftSibling).inputs ++
+          (Aiur.NativeAIR.Merkle.step hash dimensions rightRows height index right rightSibling).inputs) →
+    (Aiur.NativeAIR.Merkle.step hash dimensions leftRows height index left leftSibling).digest =
+        (Aiur.NativeAIR.Merkle.step hash dimensions rightRows height index right rightSibling).digest →
+      left = right ∧
+        (Aiur.NativeAIR.Merkle.hasHeight dimensions height = true →
+          Aiur.NativeAIR.Merkle.rowBytes dimensions leftRows height =
+            Aiur.NativeAIR.Merkle.rowBytes dimensions rightRows height)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Merkle.walk_binding
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions}
+  {leftRows rightRows : List (List Aiur.G)} {height index : Nat} {left right : Aiur.NativeAIR.Merkle.Digest}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  leftProof.length = rightProof.length →
+    ¬Aiur.NativeAIR.Merkle.CollisionOn hash
+          ((Aiur.NativeAIR.Merkle.walk hash dimensions leftRows height index left leftProof).inputs ++
+            (Aiur.NativeAIR.Merkle.walk hash dimensions rightRows height index right rightProof).inputs) →
+      (Aiur.NativeAIR.Merkle.walk hash dimensions leftRows height index left leftProof).digest =
+          (Aiur.NativeAIR.Merkle.walk hash dimensions rightRows height index right rightProof).digest →
+        left = right ∧
+          ∀ (depth : Nat),
+            depth < leftProof.length →
+              Aiur.NativeAIR.Merkle.hasHeight dimensions (height - (depth + 1)) = true →
+                Aiur.NativeAIR.Merkle.rowBytes dimensions leftRows (height - (depth + 1)) =
+                  Aiur.NativeAIR.Merkle.rowBytes dimensions rightRows (height - (depth + 1))
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_success
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result →
+    dimensions ≠ [] ∧
+      Aiur.NativeAIR.Merkle.shape dimensions rows = true ∧
+        proof.length = Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight ∧
+          index < 2 ^ Aiur.NativeAIR.Merkle.maxHeight dimensions ∧
+            result =
+              { logHeight := Aiur.NativeAIR.Merkle.maxHeight dimensions - proof.length,
+                index := index / 2 ^ proof.length,
+                hashing :=
+                  {
+                    digest :=
+                      (Aiur.NativeAIR.Merkle.walk hash dimensions rows (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                          index
+                          (hash
+                            (Aiur.NativeAIR.Merkle.rowBytes dimensions rows
+                              (Aiur.NativeAIR.Merkle.maxHeight dimensions)))
+                          proof).digest,
+                    inputs :=
+                      Aiur.NativeAIR.Merkle.rowBytes dimensions rows (Aiur.NativeAIR.Merkle.maxHeight dimensions) ::
+                        (Aiur.NativeAIR.Merkle.walk hash dimensions rows (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                            index
+                            (hash
+                              (Aiur.NativeAIR.Merkle.rowBytes dimensions rows
+                                (Aiur.NativeAIR.Merkle.maxHeight dimensions)))
+                            proof).inputs } }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_complete
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  dimensions ≠ [] →
+    Aiur.NativeAIR.Merkle.shape dimensions rows = true →
+      proof.length = Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight →
+        index < 2 ^ Aiur.NativeAIR.Merkle.maxHeight dimensions →
+          Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof =
+            some
+              { logHeight := Aiur.NativeAIR.Merkle.maxHeight dimensions - proof.length,
+                index := index / 2 ^ proof.length,
+                hashing :=
+                  {
+                    digest :=
+                      (Aiur.NativeAIR.Merkle.walk hash dimensions rows (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                          index
+                          (hash
+                            (Aiur.NativeAIR.Merkle.rowBytes dimensions rows
+                              (Aiur.NativeAIR.Merkle.maxHeight dimensions)))
+                          proof).digest,
+                    inputs :=
+                      Aiur.NativeAIR.Merkle.rowBytes dimensions rows (Aiur.NativeAIR.Merkle.maxHeight dimensions) ::
+                        (Aiur.NativeAIR.Merkle.walk hash dimensions rows (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                            index
+                            (hash
+                              (Aiur.NativeAIR.Merkle.rowBytes dimensions rows
+                                (Aiur.NativeAIR.Merkle.maxHeight dimensions)))
+                            proof).inputs } }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_calls
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result →
+    result.hashing.inputs.length ≤ 1 + 3 * proof.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_position
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result →
+    result.logHeight = min capHeight (Aiur.NativeAIR.Merkle.maxHeight dimensions) ∧
+      result.index = index / 2 ^ (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_index_bound
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result →
+    result.index < 2 ^ result.logHeight
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.hasHeight_iff
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat},
+  Aiur.NativeAIR.Merkle.hasHeight dimensions height = true ↔
+    ∃ dimension, dimension ∈ dimensions ∧ dimension.logHeight = height
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.height_le_max
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {dimension : Aiur.NativeAIR.Merkle.Dimensions},
+  dimension ∈ dimensions → dimension.logHeight ≤ Aiur.NativeAIR.Merkle.maxHeight dimensions
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.covered_iff
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight : Nat},
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight = true ↔
+    ∀ (dimension : Aiur.NativeAIR.Merkle.Dimensions),
+      dimension ∈ dimensions → min capHeight (Aiur.NativeAIR.Merkle.maxHeight dimensions) ≤ dimension.logHeight
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_binding
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {leftRows rightRows : List (List Aiur.G)} {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest}
+  {left right : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight = true →
+    Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index leftRows leftProof = some left →
+      Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rightRows rightProof = some right →
+        ¬Aiur.NativeAIR.Merkle.CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) →
+          left.hashing.digest = right.hashing.digest → leftRows = rightRows
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.verify_success
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {cap : List Aiur.NativeAIR.Merkle.Digest} {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.verify hash dimensions capHeight index cap rows proof = true →
+    ∃ result,
+      Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result ∧
+        cap[result.index]? = some result.hashing.digest
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.verify_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {cap : List Aiur.NativeAIR.Merkle.Digest} {leftRows rightRows : List (List Aiur.G)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight = true →
+    Aiur.NativeAIR.Merkle.verify hash dimensions capHeight index cap leftRows leftProof = true →
+      Aiur.NativeAIR.Merkle.verify hash dimensions capHeight index cap rightRows rightProof = true →
+        leftRows ≠ rightRows →
+          ∃ left right,
+            Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index leftRows leftProof = some left ∧
+              Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rightRows rightProof = some right ∧
+                Aiur.NativeAIR.Merkle.CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) ∧
+                  (left.hashing.inputs ++ right.hashing.inputs).length ≤
+                    2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.verifyCovered_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {cap : List Aiur.NativeAIR.Merkle.Digest} {leftRows rightRows : List (List Aiur.G)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.verifyCovered hash dimensions capHeight index cap leftRows leftProof = true →
+    Aiur.NativeAIR.Merkle.verifyCovered hash dimensions capHeight index cap rightRows rightProof = true →
+      leftRows ≠ rightRows →
+        ∃ left right,
+          Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index leftRows leftProof = some left ∧
+            Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rightRows rightProof = some right ∧
+              Aiur.NativeAIR.Merkle.CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) ∧
+                (left.hashing.inputs ++ right.hashing.inputs).length ≤
+                  2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.blake3_collision
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {leftRows rightRows : List (List Aiur.G)} {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.verifyCovered Aiur.NativeAIR.Blake3.digest dimensions capHeight index cap leftRows leftProof =
+      true →
+    Aiur.NativeAIR.Merkle.verifyCovered Aiur.NativeAIR.Blake3.digest dimensions capHeight index cap rightRows
+          rightProof =
+        true →
+      leftRows ≠ rightRows →
+        ∃ left right,
+          Aiur.NativeAIR.Merkle.replay Aiur.NativeAIR.Blake3.digest dimensions capHeight index leftRows leftProof =
+              some left ∧
+            Aiur.NativeAIR.Merkle.replay Aiur.NativeAIR.Blake3.digest dimensions capHeight index rightRows rightProof =
+                some right ∧
+              Aiur.NativeAIR.Merkle.CollisionOn Aiur.NativeAIR.Blake3.digest
+                  (left.hashing.inputs ++ right.hashing.inputs) ∧
+                (left.hashing.inputs ++ right.hashing.inputs).length ≤
+                  2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.branchBytes_length
+∀ (index : Nat) (current sibling : Aiur.NativeAIR.Merkle.Digest),
+  (Aiur.NativeAIR.Merkle.branchBytes index current sibling).length = 64
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Merkle.rowsAt_fields_le
+∀ (dimensions : List Aiur.NativeAIR.Merkle.Dimensions) (rows : List (List Aiur.G)) (height : Nat),
+  (Aiur.NativeAIR.Merkle.rowsAt dimensions rows height).flatten.length ≤ rows.flatten.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.rowBytes_length_le
+∀ (dimensions : List Aiur.NativeAIR.Merkle.Dimensions) (rows : List (List Aiur.G)) (height : Nat),
+  (Aiur.NativeAIR.Merkle.rowBytes dimensions rows height).length ≤ 8 * rows.flatten.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.step_input_length
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {rows : List (List Aiur.G)}
+  {height index : Nat} {current sibling : Aiur.NativeAIR.Merkle.Digest} {input : List UInt8},
+  input ∈ (Aiur.NativeAIR.Merkle.step hash dimensions rows height index current sibling).inputs →
+    input.length ≤ max 64 (8 * rows.flatten.length)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.walk_input_length
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {rows : List (List Aiur.G)}
+  {height index : Nat} {current : Aiur.NativeAIR.Merkle.Digest} {proof : List Aiur.NativeAIR.Merkle.Digest}
+  {input : List UInt8},
+  input ∈ (Aiur.NativeAIR.Merkle.walk hash dimensions rows height index current proof).inputs →
+    input.length ≤ max 64 (8 * rows.flatten.length)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_input_length
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result →
+    ∀ {input : List UInt8}, input ∈ result.hashing.inputs → input.length ≤ max 64 (8 * rows.flatten.length)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.replay_native_input
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {rows : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof = some result →
+    rows.flatten.length < 2 ^ 61 →
+      ∀ {input : List UInt8}, input ∈ result.hashing.inputs → Aiur.NativeAIR.Blake3.NativeInput input
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Merkle.walk_append
+∀ (hash : Aiur.NativeAIR.Merkle.Hash) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions) (rows : List (List Aiur.G))
+  (height index : Nat) (current : Aiur.NativeAIR.Merkle.Digest) (before after : List Aiur.NativeAIR.Merkle.Digest),
+  Aiur.NativeAIR.Merkle.walk hash dimensions rows height index current (before ++ after) =
+    have middle := Aiur.NativeAIR.Merkle.walk hash dimensions rows height index current before;
+    have final :=
+      Aiur.NativeAIR.Merkle.walk hash dimensions rows (height - before.length) (index / 2 ^ before.length) middle.digest
+        after;
+    { digest := final.digest, inputs := middle.inputs ++ final.inputs }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.Logged.bind_success
+∀ {α β : Type} {first : Aiur.NativeAIR.PrunedMerkle.Logged α} {next : α → Aiur.NativeAIR.PrunedMerkle.Logged β}
+  {value : β},
+  (first >>= next).result = some value →
+    ∃ middle,
+      first.result = some middle ∧
+        (next middle).result = some value ∧ (first >>= next).inputs = first.inputs ++ (next middle).inputs
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.Logged.bind_input_left
+∀ {α β : Type} {first : Aiur.NativeAIR.PrunedMerkle.Logged α} {next : α → Aiur.NativeAIR.PrunedMerkle.Logged β}
+  {input : List UInt8}, input ∈ first.inputs → input ∈ (first >>= next).inputs
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.Logged.bind_input_right
+∀ {α β : Type} {first : Aiur.NativeAIR.PrunedMerkle.Logged α} {next : α → Aiur.NativeAIR.PrunedMerkle.Logged β}
+  {middle : α},
+  first.result = some middle → ∀ {input : List UInt8}, input ∈ (next middle).inputs → input ∈ (first >>= next).inputs
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.Logged.bind_if
+∀ {α β : Type} (condition : Prop) [inst : Decidable condition] (left right : Aiur.NativeAIR.PrunedMerkle.Logged α)
+  (next : α → Aiur.NativeAIR.PrunedMerkle.Logged β),
+  (if condition then left else right) >>= next = if condition then left >>= next else right >>= next
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.hashInput_value
+∀ (hash : Aiur.NativeAIR.Merkle.Hash) (input : List UInt8),
+  (Aiur.NativeAIR.PrunedMerkle.hashInput hash input).result = some (hash input)
+AXIOMS []
+ROOT Aiur.NativeAIR.PrunedMerkle.hashInput_inputs
+∀ (hash : Aiur.NativeAIR.Merkle.Hash) (input : List UInt8),
+  (Aiur.NativeAIR.PrunedMerkle.hashInput hash input).inputs = [input]
+AXIOMS []
+ROOT Aiur.NativeAIR.PrunedMerkle.TicketAt.mono
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {before after : List (List UInt8)}
+  {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket},
+  Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height index digest before ticket →
+    before ⊆ after → Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height index digest after ticket
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.NodeAt.mono
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat}
+  {before after : List (List UInt8)} {node : Aiur.NativeAIR.PrunedMerkle.Node},
+  Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions height before node →
+    before ⊆ after → Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions height after node
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.PendingAt.mono
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {before after : List (List UInt8)}
+  {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket},
+  Aiur.NativeAIR.PrunedMerkle.PendingAt hash dimensions height index digest before ticket →
+    before ⊆ after → Aiur.NativeAIR.PrunedMerkle.PendingAt hash dimensions height index digest after ticket
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.PendingNode.mono
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat}
+  {before after : List (List UInt8)} {node : Aiur.NativeAIR.PrunedMerkle.Node},
+  Aiur.NativeAIR.PrunedMerkle.PendingNode hash dimensions height before node →
+    before ⊆ after → Aiur.NativeAIR.PrunedMerkle.PendingNode hash dimensions height after node
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.TicketAt.extend
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {inputs : List (List UInt8)} {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket}
+  (sibling : Aiur.NativeAIR.Merkle.Digest),
+  Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions (height + 1) index digest inputs ticket →
+    Aiur.NativeAIR.Merkle.branchBytes index digest sibling ∈ inputs →
+      Aiur.NativeAIR.PrunedMerkle.PendingAt hash dimensions height (index / 2)
+        (hash (Aiur.NativeAIR.Merkle.branchBytes index digest sibling)) inputs
+        (Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling ticket)
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.TicketAt.finish
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {inputs : List (List UInt8)} {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket}
+  (sibling : Aiur.NativeAIR.Merkle.Digest),
+  Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions (height + 1) index digest inputs ticket →
+    (Aiur.NativeAIR.Merkle.step hash dimensions ticket.rows height index digest sibling).inputs ⊆ inputs →
+      Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height (index / 2)
+        (Aiur.NativeAIR.Merkle.step hash dimensions ticket.rows height index digest sibling).digest inputs
+        (Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling ticket)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.PendingAt.finish_absent
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {inputs : List (List UInt8)} {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket},
+  Aiur.NativeAIR.PrunedMerkle.PendingAt hash dimensions height index digest inputs ticket →
+    Aiur.NativeAIR.Merkle.hasHeight dimensions height = false →
+      Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height index digest inputs ticket
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.PendingAt.finish_injected
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {inputs : List (List UInt8)} {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket}
+  {rows : List (List Aiur.G)},
+  Aiur.NativeAIR.PrunedMerkle.PendingAt hash dimensions height index digest inputs ticket →
+    Aiur.NativeAIR.Merkle.hasHeight dimensions height = true →
+      Aiur.NativeAIR.Merkle.rowsAt dimensions ticket.rows height = Aiur.NativeAIR.Merkle.rowsAt dimensions rows height →
+        Aiur.NativeAIR.Merkle.rowBytes dimensions rows height ∈ inputs →
+          Aiur.NativeAIR.Merkle.pairBytes digest (hash (Aiur.NativeAIR.Merkle.rowBytes dimensions rows height)) ∈
+              inputs →
+            Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height index
+              (hash
+                (Aiur.NativeAIR.Merkle.pairBytes digest (hash (Aiur.NativeAIR.Merkle.rowBytes dimensions rows height))))
+              inputs ticket
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.NodeAt.singleton
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat}
+  {inputs : List (List UInt8)} {node : Aiur.NativeAIR.PrunedMerkle.Node} (sibling : Aiur.NativeAIR.Merkle.Digest),
+  Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions (height + 1) inputs node →
+    Aiur.NativeAIR.Merkle.branchBytes node.index node.digest sibling ∈ inputs →
+      Aiur.NativeAIR.PrunedMerkle.PendingNode hash dimensions height inputs
+        { index := node.index / 2, digest := hash (Aiur.NativeAIR.Merkle.branchBytes node.index node.digest sibling),
+          tickets := List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling) node.tickets }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.NodeAt.pair
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat}
+  {inputs : List (List UInt8)} {first second : Aiur.NativeAIR.PrunedMerkle.Node},
+  Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions (height + 1) inputs first →
+    Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions (height + 1) inputs second →
+      first.index % 2 = 0 ∧ second.index = first.index + 1 →
+        Aiur.NativeAIR.Merkle.pairBytes first.digest second.digest ∈ inputs →
+          Aiur.NativeAIR.PrunedMerkle.PendingNode hash dimensions height inputs
+            { index := first.index / 2, digest := hash (Aiur.NativeAIR.Merkle.pairBytes first.digest second.digest),
+              tickets :=
+                List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend second.digest) first.tickets ++
+                  List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend first.digest) second.tickets }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.origins_cons
+∀ (node : Aiur.NativeAIR.PrunedMerkle.Node) (nodes : List Aiur.NativeAIR.PrunedMerkle.Node),
+  Aiur.NativeAIR.PrunedMerkle.origins (node :: nodes) =
+    List.map (fun ticket => (ticket.index, ticket.rows)) node.tickets ++ Aiur.NativeAIR.PrunedMerkle.origins nodes
+AXIOMS []
+ROOT Aiur.NativeAIR.PrunedMerkle.origins_extend
+∀ (tickets : List Aiur.NativeAIR.PrunedMerkle.Ticket) (sibling : Aiur.NativeAIR.Merkle.Digest),
+  List.map (fun ticket => (ticket.index, ticket.rows))
+      (List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling) tickets) =
+    List.map (fun ticket => (ticket.index, ticket.rows)) tickets
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.PrunedMerkle.combine_refines
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat}
+  {inputs : List (List UInt8)} {nodes : List Aiur.NativeAIR.PrunedMerkle.Node}
+  {proof : List Aiur.NativeAIR.Merkle.Digest} {parents : List Aiur.NativeAIR.PrunedMerkle.Node}
+  {remaining : List Aiur.NativeAIR.Merkle.Digest},
+  (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+      node ∈ nodes → Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions (height + 1) inputs node) →
+    (Aiur.NativeAIR.PrunedMerkle.combine hash nodes proof).result = some (parents, remaining) →
+      (∀ (parent : Aiur.NativeAIR.PrunedMerkle.Node),
+          parent ∈ parents →
+            Aiur.NativeAIR.PrunedMerkle.PendingNode hash dimensions height
+              (inputs ++ (Aiur.NativeAIR.PrunedMerkle.combine hash nodes proof).inputs) parent) ∧
+        Aiur.NativeAIR.PrunedMerkle.origins parents = Aiur.NativeAIR.PrunedMerkle.origins nodes
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.inject_refines
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height : Nat}
+  {inputs : List (List UInt8)} {nodes output : List Aiur.NativeAIR.PrunedMerkle.Node},
+  Aiur.NativeAIR.Merkle.hasHeight dimensions height = true →
+    (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+        node ∈ nodes → Aiur.NativeAIR.PrunedMerkle.PendingNode hash dimensions height inputs node) →
+      (Aiur.NativeAIR.PrunedMerkle.inject hash dimensions height nodes).result = some output →
+        (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+            node ∈ output →
+              Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions height
+                (inputs ++ (Aiur.NativeAIR.PrunedMerkle.inject hash dimensions height nodes).inputs) node) ∧
+          Aiur.NativeAIR.PrunedMerkle.origins output = Aiur.NativeAIR.PrunedMerkle.origins nodes
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.initial_refines
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {inputs : List (List UInt8)}
+  {tickets : List Aiur.NativeAIR.PrunedMerkle.Ticket} {nodes : List Aiur.NativeAIR.PrunedMerkle.Node},
+  (∀ (ticket : Aiur.NativeAIR.PrunedMerkle.Ticket),
+      ticket ∈ tickets →
+        Aiur.NativeAIR.Merkle.shape dimensions ticket.rows = true ∧
+          ticket.index < 2 ^ Aiur.NativeAIR.Merkle.maxHeight dimensions ∧ ticket.proof = []) →
+    (Aiur.NativeAIR.PrunedMerkle.initial hash dimensions (Aiur.NativeAIR.Merkle.maxHeight dimensions) tickets).result =
+        some nodes →
+      (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+          node ∈ nodes →
+            Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+              (inputs ++
+                (Aiur.NativeAIR.PrunedMerkle.initial hash dimensions (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                    tickets).inputs)
+              node) ∧
+        Aiur.NativeAIR.PrunedMerkle.origins nodes = List.map (fun ticket => (ticket.index, ticket.rows)) tickets
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.walk_refines
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {steps height : Nat}
+  {inputs : List (List UInt8)} {nodes output : List Aiur.NativeAIR.PrunedMerkle.Node}
+  {proof remaining : List Aiur.NativeAIR.Merkle.Digest},
+  steps ≤ height →
+    (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+        node ∈ nodes → Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions height inputs node) →
+      (Aiur.NativeAIR.PrunedMerkle.walk hash dimensions steps height nodes proof).result = some (output, remaining) →
+        (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+            node ∈ output →
+              Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions (height - steps)
+                (inputs ++ (Aiur.NativeAIR.PrunedMerkle.walk hash dimensions steps height nodes proof).inputs) node) ∧
+          Aiur.NativeAIR.PrunedMerkle.origins output = Aiur.NativeAIR.PrunedMerkle.origins nodes
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.mapM_members
+∀ {α : Type u_1} {β : Type u_2} {read : α → Option β} {inputs : List α} {outputs : List β},
+  List.mapM read inputs = some outputs →
+    (∀ (input : α), input ∈ inputs → ∃ output, output ∈ outputs ∧ read input = some output) ∧
+      ∀ (output : β), output ∈ outputs → ∃ input, input ∈ inputs ∧ read input = some output
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.representatives_refines
+∀ {indices : List Nat} {rows : List (List (List Aiur.G))} {tickets : List Aiur.NativeAIR.PrunedMerkle.Ticket},
+  Aiur.NativeAIR.PrunedMerkle.representatives indices rows = some tickets →
+    (∀ (ticket : Aiur.NativeAIR.PrunedMerkle.Ticket), ticket ∈ tickets → ticket.index ∈ indices ∧ ticket.proof = []) ∧
+      ∀ (source : Nat × List (List Aiur.G)),
+        source ∈ indices.zip rows → ∃ ticket, ticket ∈ tickets ∧ ticket.index = source.fst ∧ ticket.rows = source.snd
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.replay_refines
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight : Nat}
+  {indices : List Nat} {rows : List (List (List Aiur.G))} {proof : List Aiur.NativeAIR.Merkle.Digest}
+  {nodes : List Aiur.NativeAIR.PrunedMerkle.Node},
+  (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).result = some nodes →
+    dimensions ≠ [] ∧
+      rows.length = indices.length ∧
+        (∀ (node : Aiur.NativeAIR.PrunedMerkle.Node),
+            node ∈ nodes →
+              Aiur.NativeAIR.PrunedMerkle.NodeAt hash dimensions
+                (min capHeight (Aiur.NativeAIR.Merkle.maxHeight dimensions))
+                (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).inputs node) ∧
+          ∀ (source : Nat × List (List Aiur.G)),
+            source ∈ indices.zip rows → source ∈ Aiur.NativeAIR.PrunedMerkle.origins nodes
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.replay_individual
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {indices : List Nat} {rows : List (List (List Aiur.G))} {query : List (List Aiur.G)}
+  {proof : List Aiur.NativeAIR.Merkle.Digest} {nodes : List Aiur.NativeAIR.PrunedMerkle.Node},
+  (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).result = some nodes →
+    (index, query) ∈ indices.zip rows →
+      ∃ node,
+        node ∈ nodes ∧
+          ∃ path result,
+            Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index query path = some result ∧
+              result.index = node.index ∧
+                result.hashing.digest = node.digest ∧
+                  result.hashing.inputs ⊆
+                    (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).inputs
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.verify_individual
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {indices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest} {rows : List (List (List Aiur.G))}
+  {query : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.PrunedMerkle.verify hash dimensions capHeight indices cap rows proof = true →
+    (index, query) ∈ indices.zip rows →
+      ∃ path result,
+        Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index query path = some result ∧
+          Aiur.NativeAIR.Merkle.verify hash dimensions capHeight index cap query path = true ∧
+            result.hashing.inputs ⊆
+              (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).inputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.verifyCovered_individual
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {indices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest} {rows : List (List (List Aiur.G))}
+  {query : List (List Aiur.G)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.PrunedMerkle.verifyCovered hash dimensions capHeight indices cap rows proof = true →
+    (index, query) ∈ indices.zip rows →
+      ∃ path result,
+        Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index query path = some result ∧
+          Aiur.NativeAIR.Merkle.verifyCovered hash dimensions capHeight index cap query path = true ∧
+            result.hashing.inputs ⊆
+              (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).inputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.verify_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {leftIndices rightIndices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {leftRows rightRows : List (List (List Aiur.G))} {leftQuery rightQuery : List (List Aiur.G)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight = true →
+    Aiur.NativeAIR.PrunedMerkle.verify hash dimensions capHeight leftIndices cap leftRows leftProof = true →
+      Aiur.NativeAIR.PrunedMerkle.verify hash dimensions capHeight rightIndices cap rightRows rightProof = true →
+        (index, leftQuery) ∈ leftIndices.zip leftRows →
+          (index, rightQuery) ∈ rightIndices.zip rightRows →
+            leftQuery ≠ rightQuery →
+              ∃ inputs,
+                inputs ⊆
+                    (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight leftIndices leftRows
+                          leftProof).inputs ++
+                      (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight rightIndices rightRows
+                          rightProof).inputs ∧
+                  Aiur.NativeAIR.Merkle.CollisionOn hash inputs ∧
+                    inputs.length ≤ 2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                      ∀ (input : List UInt8),
+                        input ∈ inputs →
+                          input.length ≤ max 64 (8 * max leftQuery.flatten.length rightQuery.flatten.length)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.verifyCovered_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat}
+  {leftIndices rightIndices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {leftRows rightRows : List (List (List Aiur.G))} {leftQuery rightQuery : List (List Aiur.G)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.PrunedMerkle.verifyCovered hash dimensions capHeight leftIndices cap leftRows leftProof = true →
+    Aiur.NativeAIR.PrunedMerkle.verifyCovered hash dimensions capHeight rightIndices cap rightRows rightProof = true →
+      (index, leftQuery) ∈ leftIndices.zip leftRows →
+        (index, rightQuery) ∈ rightIndices.zip rightRows →
+          leftQuery ≠ rightQuery →
+            ∃ inputs,
+              inputs ⊆
+                  (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight leftIndices leftRows
+                        leftProof).inputs ++
+                    (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight rightIndices rightRows
+                        rightProof).inputs ∧
+                Aiur.NativeAIR.Merkle.CollisionOn hash inputs ∧
+                  inputs.length ≤ 2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                    ∀ (input : List UInt8),
+                      input ∈ inputs →
+                        input.length ≤ max 64 (8 * max leftQuery.flatten.length rightQuery.flatten.length)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.blake3_collision
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat} {leftIndices rightIndices : List Nat}
+  {cap : List Aiur.NativeAIR.Merkle.Digest} {leftRows rightRows : List (List (List Aiur.G))}
+  {leftQuery rightQuery : List (List Aiur.G)} {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.PrunedMerkle.verifyCovered Aiur.NativeAIR.Blake3.digest dimensions capHeight leftIndices cap leftRows
+        leftProof =
+      true →
+    Aiur.NativeAIR.PrunedMerkle.verifyCovered Aiur.NativeAIR.Blake3.digest dimensions capHeight rightIndices cap
+          rightRows rightProof =
+        true →
+      (index, leftQuery) ∈ leftIndices.zip leftRows →
+        (index, rightQuery) ∈ rightIndices.zip rightRows →
+          leftQuery ≠ rightQuery →
+            ∃ inputs,
+              inputs ⊆
+                  (Aiur.NativeAIR.PrunedMerkle.replay Aiur.NativeAIR.Blake3.digest dimensions capHeight leftIndices
+                        leftRows leftProof).inputs ++
+                    (Aiur.NativeAIR.PrunedMerkle.replay Aiur.NativeAIR.Blake3.digest dimensions capHeight rightIndices
+                        rightRows rightProof).inputs ∧
+                Aiur.NativeAIR.Merkle.CollisionOn Aiur.NativeAIR.Blake3.digest inputs ∧
+                  inputs.length ≤ 2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                    ∀ (input : List UInt8),
+                      input ∈ inputs →
+                        input.length ≤ max 64 (8 * max leftQuery.flatten.length rightQuery.flatten.length)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.PrunedMerkle.blake3_native_collision
+∀ {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {capHeight index : Nat} {leftIndices rightIndices : List Nat}
+  {cap : List Aiur.NativeAIR.Merkle.Digest} {leftRows rightRows : List (List (List Aiur.G))}
+  {leftQuery rightQuery : List (List Aiur.G)} {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.PrunedMerkle.verifyCovered Aiur.NativeAIR.Blake3.digest dimensions capHeight leftIndices cap leftRows
+        leftProof =
+      true →
+    Aiur.NativeAIR.PrunedMerkle.verifyCovered Aiur.NativeAIR.Blake3.digest dimensions capHeight rightIndices cap
+          rightRows rightProof =
+        true →
+      (index, leftQuery) ∈ leftIndices.zip leftRows →
+        (index, rightQuery) ∈ rightIndices.zip rightRows →
+          leftQuery ≠ rightQuery →
+            leftQuery.flatten.length < 2 ^ 61 →
+              rightQuery.flatten.length < 2 ^ 61 →
+                ∃ inputs,
+                  inputs ⊆
+                      (Aiur.NativeAIR.PrunedMerkle.replay Aiur.NativeAIR.Blake3.digest dimensions capHeight leftIndices
+                            leftRows leftProof).inputs ++
+                        (Aiur.NativeAIR.PrunedMerkle.replay Aiur.NativeAIR.Blake3.digest dimensions capHeight
+                            rightIndices rightRows rightProof).inputs ∧
+                    Aiur.NativeAIR.Merkle.CollisionOn Aiur.NativeAIR.Blake3.digest inputs ∧
+                      inputs.length ≤ 2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                        ∀ (input : List UInt8), input ∈ inputs → Aiur.NativeAIR.Blake3.NativeInput input
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseRow_length
+∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+  (Aiur.NativeAIR.ExtensionMmcs.baseRow values).length = values.length * 2
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseRow_injective
+∀ {left right : List Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.ExtensionMmcs.baseRow left = Aiur.NativeAIR.ExtensionMmcs.baseRow right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseRows_length
+∀ (rows : List (List Aiur.NativeAIR.ProofCodec.Extension)),
+  (Aiur.NativeAIR.ExtensionMmcs.baseRows rows).length = rows.length
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseRows_injective
+∀ {left right : List (List Aiur.NativeAIR.ProofCodec.Extension)},
+  Aiur.NativeAIR.ExtensionMmcs.baseRows left = Aiur.NativeAIR.ExtensionMmcs.baseRows right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseRows_fields
+∀ (rows : List (List Aiur.NativeAIR.ProofCodec.Extension)),
+  (Aiur.NativeAIR.ExtensionMmcs.baseRows rows).flatten.length = rows.flatten.length * 2
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseDimensions_length
+∀ (wordBits : Nat) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions),
+  (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions).length = dimensions.length
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseDimensions_heights
+∀ (wordBits : Nat) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions),
+  List.map Aiur.NativeAIR.Merkle.Dimensions.logHeight
+      (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) =
+    List.map Aiur.NativeAIR.Merkle.Dimensions.logHeight dimensions
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseDimensions_maxHeight
+∀ (wordBits : Nat) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions),
+  Aiur.NativeAIR.Merkle.maxHeight (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) =
+    Aiur.NativeAIR.Merkle.maxHeight dimensions
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseDimensions_covered
+∀ (wordBits : Nat) (dimensions : List Aiur.NativeAIR.Merkle.Dimensions) (capHeight : Nat),
+  Aiur.NativeAIR.Merkle.covered (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) capHeight =
+    Aiur.NativeAIR.Merkle.covered dimensions capHeight
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseDimensions_exact
+∀ {wordBits : Nat} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions},
+  Aiur.NativeAIR.ExtensionMmcs.WidthsFit wordBits dimensions →
+    Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions =
+      List.map (fun dimension => { width := dimension.width * 2, logHeight := dimension.logHeight }) dimensions
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.shape_base
+∀ {wordBits : Nat} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions}
+  {rows : List (List Aiur.NativeAIR.ProofCodec.Extension)},
+  Aiur.NativeAIR.ExtensionMmcs.WidthsFit wordBits dimensions →
+    Aiur.NativeAIR.Merkle.shape (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions)
+        (Aiur.NativeAIR.ExtensionMmcs.baseRows rows) =
+      Aiur.NativeAIR.ExtensionMmcs.shape dimensions rows
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.fri_width_fits
+∀ {logArity height : Nat},
+  logArity ≤ 32 → Aiur.NativeAIR.ExtensionMmcs.WidthsFit 64 [{ width := 2 ^ logArity, logHeight := height }]
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.baseRows_query
+∀ {indices : List Nat} {rows : List (List (List Aiur.NativeAIR.ProofCodec.Extension))} {index : Nat}
+  {query : List (List Aiur.NativeAIR.ProofCodec.Extension)},
+  (index, query) ∈ indices.zip rows →
+    (index, Aiur.NativeAIR.ExtensionMmcs.baseRows query) ∈
+      indices.zip (List.map Aiur.NativeAIR.ExtensionMmcs.baseRows rows)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.replay_shape
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {rows : List (List Aiur.NativeAIR.ProofCodec.Extension)}
+  {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.ExtensionMmcs.WidthsFit wordBits dimensions →
+    Aiur.NativeAIR.ExtensionMmcs.replay hash wordBits dimensions capHeight index rows proof = some result →
+      Aiur.NativeAIR.ExtensionMmcs.shape dimensions rows = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.verifyMulti_individual
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {indices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {rows : List (List (List Aiur.NativeAIR.ProofCodec.Extension))}
+  {query : List (List Aiur.NativeAIR.ProofCodec.Extension)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.verifyMulti hash wordBits dimensions capHeight indices cap rows proof = true →
+    (index, query) ∈ indices.zip rows →
+      ∃ path result,
+        Aiur.NativeAIR.ExtensionMmcs.replay hash wordBits dimensions capHeight index query path = some result ∧
+          Aiur.NativeAIR.ExtensionMmcs.verify hash wordBits dimensions capHeight index cap query path = true ∧
+            result.hashing.inputs ⊆
+              (Aiur.NativeAIR.ExtensionMmcs.replayMulti hash wordBits dimensions capHeight indices rows proof).inputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.verifyMulti_shape
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {indices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {rows : List (List (List Aiur.NativeAIR.ProofCodec.Extension))}
+  {query : List (List Aiur.NativeAIR.ProofCodec.Extension)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.WidthsFit wordBits dimensions →
+    Aiur.NativeAIR.ExtensionMmcs.verifyMulti hash wordBits dimensions capHeight indices cap rows proof = true →
+      (index, query) ∈ indices.zip rows → Aiur.NativeAIR.ExtensionMmcs.shape dimensions query = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered_individual
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {indices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {rows : List (List (List Aiur.NativeAIR.ProofCodec.Extension))}
+  {query : List (List Aiur.NativeAIR.ProofCodec.Extension)} {proof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered hash wordBits dimensions capHeight indices cap rows proof = true →
+    (index, query) ∈ indices.zip rows →
+      ∃ path result,
+        Aiur.NativeAIR.ExtensionMmcs.replay hash wordBits dimensions capHeight index query path = some result ∧
+          Aiur.NativeAIR.ExtensionMmcs.verifyCovered hash wordBits dimensions capHeight index cap query path = true ∧
+            result.hashing.inputs ⊆
+              (Aiur.NativeAIR.ExtensionMmcs.replayMulti hash wordBits dimensions capHeight indices rows proof).inputs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.replay_native_input
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {rows : List (List Aiur.NativeAIR.ProofCodec.Extension)}
+  {proof : List Aiur.NativeAIR.Merkle.Digest} {result : Aiur.NativeAIR.Merkle.Replay},
+  Aiur.NativeAIR.ExtensionMmcs.replay hash wordBits dimensions capHeight index rows proof = some result →
+    rows.flatten.length < 2 ^ 60 →
+      ∀ {input : List UInt8}, input ∈ result.hashing.inputs → Aiur.NativeAIR.Blake3.NativeInput input
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.verifyCovered_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {leftRows rightRows : List (List Aiur.NativeAIR.ProofCodec.Extension)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.verifyCovered hash wordBits dimensions capHeight index cap leftRows leftProof = true →
+    Aiur.NativeAIR.ExtensionMmcs.verifyCovered hash wordBits dimensions capHeight index cap rightRows rightProof =
+        true →
+      leftRows ≠ rightRows →
+        ∃ left right,
+          Aiur.NativeAIR.ExtensionMmcs.replay hash wordBits dimensions capHeight index leftRows leftProof = some left ∧
+            Aiur.NativeAIR.ExtensionMmcs.replay hash wordBits dimensions capHeight index rightRows rightProof =
+                some right ∧
+              Aiur.NativeAIR.Merkle.CollisionOn hash (left.hashing.inputs ++ right.hashing.inputs) ∧
+                (left.hashing.inputs ++ right.hashing.inputs).length ≤
+                  2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered_collision
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {wordBits capHeight index : Nat}
+  {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {leftIndices rightIndices : List Nat}
+  {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {leftRows rightRows : List (List (List Aiur.NativeAIR.ProofCodec.Extension))}
+  {leftQuery rightQuery : List (List Aiur.NativeAIR.ProofCodec.Extension)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered hash wordBits dimensions capHeight leftIndices cap leftRows
+        leftProof =
+      true →
+    Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered hash wordBits dimensions capHeight rightIndices cap rightRows
+          rightProof =
+        true →
+      (index, leftQuery) ∈ leftIndices.zip leftRows →
+        (index, rightQuery) ∈ rightIndices.zip rightRows →
+          leftQuery ≠ rightQuery →
+            ∃ inputs,
+              inputs ⊆
+                  (Aiur.NativeAIR.ExtensionMmcs.replayMulti hash wordBits dimensions capHeight leftIndices leftRows
+                        leftProof).inputs ++
+                    (Aiur.NativeAIR.ExtensionMmcs.replayMulti hash wordBits dimensions capHeight rightIndices rightRows
+                        rightProof).inputs ∧
+                Aiur.NativeAIR.Merkle.CollisionOn hash inputs ∧
+                  inputs.length ≤ 2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                    ∀ (input : List UInt8),
+                      input ∈ inputs →
+                        input.length ≤ max 64 (16 * max leftQuery.flatten.length rightQuery.flatten.length)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.blake3_native_collision
+∀ {wordBits capHeight index : Nat} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions}
+  {cap : List Aiur.NativeAIR.Merkle.Digest} {leftRows rightRows : List (List Aiur.NativeAIR.ProofCodec.Extension)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.verifyCovered Aiur.NativeAIR.Blake3.digest wordBits dimensions capHeight index cap
+        leftRows leftProof =
+      true →
+    Aiur.NativeAIR.ExtensionMmcs.verifyCovered Aiur.NativeAIR.Blake3.digest wordBits dimensions capHeight index cap
+          rightRows rightProof =
+        true →
+      leftRows ≠ rightRows →
+        leftRows.flatten.length < 2 ^ 60 →
+          rightRows.flatten.length < 2 ^ 60 →
+            ∃ left right,
+              Aiur.NativeAIR.ExtensionMmcs.replay Aiur.NativeAIR.Blake3.digest wordBits dimensions capHeight index
+                    leftRows leftProof =
+                  some left ∧
+                Aiur.NativeAIR.ExtensionMmcs.replay Aiur.NativeAIR.Blake3.digest wordBits dimensions capHeight index
+                      rightRows rightProof =
+                    some right ∧
+                  Aiur.NativeAIR.Merkle.CollisionOn Aiur.NativeAIR.Blake3.digest
+                      (left.hashing.inputs ++ right.hashing.inputs) ∧
+                    (left.hashing.inputs ++ right.hashing.inputs).length ≤
+                        2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                      ∀ (input : List UInt8),
+                        input ∈ left.hashing.inputs ++ right.hashing.inputs → Aiur.NativeAIR.Blake3.NativeInput input
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.ExtensionMmcs.blake3_multi_native_collision
+∀ {wordBits capHeight index : Nat} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions}
+  {leftIndices rightIndices : List Nat} {cap : List Aiur.NativeAIR.Merkle.Digest}
+  {leftRows rightRows : List (List (List Aiur.NativeAIR.ProofCodec.Extension))}
+  {leftQuery rightQuery : List (List Aiur.NativeAIR.ProofCodec.Extension)}
+  {leftProof rightProof : List Aiur.NativeAIR.Merkle.Digest},
+  Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered Aiur.NativeAIR.Blake3.digest wordBits dimensions capHeight leftIndices
+        cap leftRows leftProof =
+      true →
+    Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered Aiur.NativeAIR.Blake3.digest wordBits dimensions capHeight
+          rightIndices cap rightRows rightProof =
+        true →
+      (index, leftQuery) ∈ leftIndices.zip leftRows →
+        (index, rightQuery) ∈ rightIndices.zip rightRows →
+          leftQuery ≠ rightQuery →
+            leftQuery.flatten.length < 2 ^ 60 →
+              rightQuery.flatten.length < 2 ^ 60 →
+                ∃ inputs,
+                  inputs ⊆
+                      (Aiur.NativeAIR.ExtensionMmcs.replayMulti Aiur.NativeAIR.Blake3.digest wordBits dimensions
+                            capHeight leftIndices leftRows leftProof).inputs ++
+                        (Aiur.NativeAIR.ExtensionMmcs.replayMulti Aiur.NativeAIR.Blake3.digest wordBits dimensions
+                            capHeight rightIndices rightRows rightProof).inputs ∧
+                    Aiur.NativeAIR.Merkle.CollisionOn Aiur.NativeAIR.Blake3.digest inputs ∧
+                      inputs.length ≤ 2 + 6 * (Aiur.NativeAIR.Merkle.maxHeight dimensions - capHeight) ∧
+                        ∀ (input : List UInt8), input ∈ inputs → Aiur.NativeAIR.Blake3.NativeInput input
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_bound
+∀ (bits index : Nat), Aiur.NativeAIR.FriDomain.reverseBits bits index < 2 ^ bits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_zero
+∀ (bits : Nat), Aiur.NativeAIR.FriDomain.reverseBits bits 0 = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_zero_width
+∀ (index : Nat), Aiur.NativeAIR.FriDomain.reverseBits 0 index = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_mod
+∀ (bits index : Nat),
+  Aiur.NativeAIR.FriDomain.reverseBits bits (index % 2 ^ bits) = Aiur.NativeAIR.FriDomain.reverseBits bits index
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_involution
+∀ (bits index : Nat),
+  Aiur.NativeAIR.FriDomain.reverseBits bits (Aiur.NativeAIR.FriDomain.reverseBits bits index) = index % 2 ^ bits
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_injective
+∀ {bits left right : Nat},
+  left < 2 ^ bits →
+    right < 2 ^ bits →
+      Aiur.NativeAIR.FriDomain.reverseBits bits left = Aiur.NativeAIR.FriDomain.reverseBits bits right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_surjective
+∀ {bits index : Nat},
+  index < 2 ^ bits → ∃ original, original < 2 ^ bits ∧ Aiur.NativeAIR.FriDomain.reverseBits bits original = index
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.index_split_bound
+∀ {low high index : Nat}, index < 2 ^ (high + low) → index / 2 ^ low < 2 ^ high
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_split
+∀ {high low index : Nat},
+  index < 2 ^ (high + low) →
+    Aiur.NativeAIR.FriDomain.reverseBits (high + low) index =
+      Aiur.NativeAIR.FriDomain.reverseBits low (index % 2 ^ low) * 2 ^ high +
+        Aiur.NativeAIR.FriDomain.reverseBits high (index / 2 ^ low)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_padding
+∀ {bits index : Nat},
+  index < 2 ^ bits →
+    ∀ (extra : Nat),
+      Aiur.NativeAIR.FriDomain.reverseBits (extra + bits) index =
+        Aiur.NativeAIR.FriDomain.reverseBits bits index * 2 ^ extra
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.wordReverse_eq
+∀ {wordBits bits index : Nat},
+  bits ≤ wordBits →
+    index < 2 ^ bits →
+      Aiur.NativeAIR.FriDomain.wordReverse wordBits bits index = Aiur.NativeAIR.FriDomain.reverseBits bits index
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.generator_nested
+∀ (parent child : Aiur.NativeAIR.Domain.Subgroup),
+  ↑child ≤ ↑parent →
+    Aiur.NativeAIR.Domain.generator parent ^ 2 ^ (↑parent - ↑child) = Aiur.NativeAIR.Domain.generator child
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_eq
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat),
+  Aiur.NativeAIR.FriDomain.queryPoint domain index =
+    Aiur.NativeAIR.Domain.generator domain ^ Aiur.NativeAIR.FriDomain.reverseBits (↑domain) index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_domain
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat),
+  Aiur.NativeAIR.FriDomain.queryPoint domain index =
+    Aiur.NativeAIR.Domain.point domain ⟨Aiur.NativeAIR.FriDomain.reverseBits (↑domain) index, ⋯⟩
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_injective
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) {left right : Nat},
+  left < Aiur.NativeAIR.Domain.size domain →
+    right < Aiur.NativeAIR.Domain.size domain →
+      Aiur.NativeAIR.FriDomain.queryPoint domain left = Aiur.NativeAIR.FriDomain.queryPoint domain right → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_surjective
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Fin (Aiur.NativeAIR.Domain.size domain)),
+  ∃ query,
+    query < Aiur.NativeAIR.Domain.size domain ∧
+      Aiur.NativeAIR.FriDomain.queryPoint domain query = Aiur.NativeAIR.Domain.point domain index
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_nonzero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat), Aiur.NativeAIR.FriDomain.queryPoint domain index ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat),
+  Aiur.NativeAIR.FriDomain.queryPoint domain index ^ Aiur.NativeAIR.Domain.size domain = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_zero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), Aiur.NativeAIR.FriDomain.queryPoint domain 0 = 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_padding
+∀ (parent child : Aiur.NativeAIR.Domain.Subgroup),
+  ↑child ≤ ↑parent →
+    ∀ {index : Nat},
+      index < Aiur.NativeAIR.Domain.size child →
+        Aiur.NativeAIR.FriDomain.queryPoint parent index = Aiur.NativeAIR.FriDomain.queryPoint child index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.index_join_bound
+∀ {high low index slot : Nat}, index < 2 ^ high → slot < 2 ^ low → index * 2 ^ low + slot < 2 ^ (high + low)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.reverseBits_join
+∀ {high low index slot : Nat},
+  index < 2 ^ high →
+    slot < 2 ^ low →
+      Aiur.NativeAIR.FriDomain.reverseBits (high + low) (index * 2 ^ low + slot) =
+        Aiur.NativeAIR.FriDomain.reverseBits low slot * 2 ^ high + Aiur.NativeAIR.FriDomain.reverseBits high index
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.foldNode_eq
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑arity ≤ ↑parent →
+    ∀ {index slot : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        slot < Aiur.NativeAIR.Domain.size arity →
+          Aiur.NativeAIR.FriDomain.foldNode parent arity index slot =
+            Aiur.NativeAIR.FriDomain.queryPoint parent (index * Aiur.NativeAIR.Domain.size arity + slot)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.foldNode_injective
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑arity ≤ ↑parent →
+    ∀ {index left right : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        left < Aiur.NativeAIR.Domain.size arity →
+          right < Aiur.NativeAIR.Domain.size arity →
+            Aiur.NativeAIR.FriDomain.foldNode parent arity index left =
+                Aiur.NativeAIR.FriDomain.foldNode parent arity index right →
+              left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.foldNode_nonzero
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑arity ≤ ↑parent →
+    ∀ {index slot : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        slot < Aiur.NativeAIR.Domain.size arity → Aiur.NativeAIR.FriDomain.foldNode parent arity index slot ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.foldNode_power
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ (index slot : Nat),
+      Aiur.NativeAIR.FriDomain.foldNode parent arity index slot ^ Aiur.NativeAIR.Domain.size arity =
+        Aiur.NativeAIR.FriDomain.queryPoint child index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.queryPoint_reduce
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < Aiur.NativeAIR.Domain.size parent →
+        Aiur.NativeAIR.FriDomain.queryPoint parent index ^ Aiur.NativeAIR.Domain.size arity =
+          Aiur.NativeAIR.FriDomain.queryPoint child (index / Aiur.NativeAIR.Domain.size arity)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.inputPoint_nonzero
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat), Aiur.NativeAIR.FriDomain.inputPoint domain index ≠ 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.inputPoint_injective
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) {left right : Nat},
+  left < Aiur.NativeAIR.Domain.size domain →
+    right < Aiur.NativeAIR.Domain.size domain →
+      Aiur.NativeAIR.FriDomain.inputPoint domain left = Aiur.NativeAIR.FriDomain.inputPoint domain right → left = right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.inputPoint_power
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat),
+  Aiur.NativeAIR.FriDomain.inputPoint domain index ^ Aiur.NativeAIR.Domain.size domain =
+    7 ^ Aiur.NativeAIR.Domain.size domain
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.coset_shift_certificate
+Aiur.G.pow 7 (2 ^ 32) ≠ 1
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.FriDomain.coset_shift_not_root
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup), 7 ^ Aiur.NativeAIR.Domain.size domain ≠ 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.inputPoint_not_root
+∀ (domain : Aiur.NativeAIR.Domain.Subgroup) (index : Nat),
+  Aiur.NativeAIR.FriDomain.inputPoint domain index ^ Aiur.NativeAIR.Domain.size domain ≠ 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriDomain.inputPoint_trace_disjoint
+∀ (query trace : Aiur.NativeAIR.Domain.Subgroup),
+  ↑trace ≤ ↑query →
+    ∀ (index : Nat) (row : Fin (Aiur.NativeAIR.Domain.size trace)),
+      Aiur.NativeAIR.FriDomain.inputPoint query index ≠ Aiur.NativeAIR.Domain.point trace row
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.isZero_nil
+∀ {R : Type} [inst : Grind.CommRing R], Aiur.NativeAIR.Polynomial.IsZero []
+AXIOMS []
+ROOT Aiur.NativeAIR.Polynomial.isZero_iff_all
+∀ {R : Type} [inst : Grind.CommRing R] [inst_1 : BEq R] [LawfulBEq R] (coefficients : List R),
+  Aiur.NativeAIR.Polynomial.IsZero coefficients ↔ (coefficients.all fun x => x == 0) = true
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.isZero_cons
+∀ {R : Type} [inst : Grind.CommRing R] (coefficient : R) (rest : List R),
+  Aiur.NativeAIR.Polynomial.IsZero (coefficient :: rest) ↔ coefficient = 0 ∧ Aiur.NativeAIR.Polynomial.IsZero rest
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.isZero_append
+∀ {R : Type} [inst : Grind.CommRing R] (left right : List R),
+  Aiur.NativeAIR.Polynomial.IsZero (left ++ right) ↔
+    Aiur.NativeAIR.Polynomial.IsZero left ∧ Aiur.NativeAIR.Polynomial.IsZero right
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Polynomial.monic_nonzero
+∀ {R : Type} [inst : Grind.CommRing R] {coefficients : List R},
+  Aiur.NativeAIR.Polynomial.Monic coefficients → 1 ≠ 0 → ¬Aiur.NativeAIR.Polynomial.IsZero coefficients
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Polynomial.sub_nil
+∀ {R : Type} [inst : Grind.CommRing R] (left : List R), Aiur.NativeAIR.Polynomial.sub left [] = left
+AXIOMS []
+ROOT Aiur.NativeAIR.Polynomial.horner_zero
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) {coefficients : List R},
+  Aiur.NativeAIR.Polynomial.IsZero coefficients → Aiur.NativeAIR.Quotient.horner point coefficients = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.add_length
+∀ {R : Type} [inst : Grind.CommRing R] (left right : List R),
+  (Aiur.NativeAIR.Polynomial.add left right).length = max left.length right.length
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Polynomial.sub_length
+∀ {R : Type} [inst : Grind.CommRing R] (left right : List R),
+  (Aiur.NativeAIR.Polynomial.sub left right).length = max left.length right.length
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Polynomial.scale_length
+∀ {R : Type} [inst : Grind.CommRing R] (scalar : R) (coefficients : List R),
+  (Aiur.NativeAIR.Polynomial.scale scalar coefficients).length = coefficients.length
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.Polynomial.sub_append
+∀ {R : Type} [inst : Grind.CommRing R] (left right firstTail secondTail : List R),
+  left.length = right.length →
+    Aiur.NativeAIR.Polynomial.sub (left ++ firstTail) (right ++ secondTail) =
+      Aiur.NativeAIR.Polynomial.sub left right ++ Aiur.NativeAIR.Polynomial.sub firstTail secondTail
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.sub_append_left
+∀ {R : Type} [inst : Grind.CommRing R] (left right tail : List R),
+  right.length ≤ left.length →
+    Aiur.NativeAIR.Polynomial.sub (left ++ tail) right = Aiur.NativeAIR.Polynomial.sub left right ++ tail
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_add
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (left right : List R),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.add left right) =
+    Aiur.NativeAIR.Quotient.horner point left + Aiur.NativeAIR.Quotient.horner point right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_neg
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner point (List.map (fun x => 0 - x) coefficients) =
+    0 - Aiur.NativeAIR.Quotient.horner point coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_sub
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (left right : List R),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.sub left right) =
+    Aiur.NativeAIR.Quotient.horner point left - Aiur.NativeAIR.Quotient.horner point right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_scale
+∀ {R : Type} [inst : Grind.CommRing R] (point scalar : R) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.scale scalar coefficients) =
+    scalar * Aiur.NativeAIR.Quotient.horner point coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.mulLinear_length
+∀ {R : Type} [inst : Grind.CommRing R] (root : R) (coefficients : List R),
+  (Aiur.NativeAIR.Polynomial.mulLinear root coefficients).length = coefficients.length + 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_mulLinear
+∀ {R : Type} [inst : Grind.CommRing R] (point root : R) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.mulLinear root coefficients) =
+    (point - root) * Aiur.NativeAIR.Quotient.horner point coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.fromRoots_length
+∀ {R : Type} [inst : Grind.CommRing R] (roots : List R),
+  (Aiur.NativeAIR.Polynomial.fromRoots roots).length = roots.length + 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_fromRoots
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (roots : List R),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.fromRoots roots) =
+    Aiur.NativeAIR.LogUp.product (List.map (fun x => point - x) roots)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.mulLinear_monic
+∀ {R : Type} [inst : Grind.CommRing R] (root : R) {coefficients : List R},
+  Aiur.NativeAIR.Polynomial.Monic coefficients →
+    Aiur.NativeAIR.Polynomial.Monic (Aiur.NativeAIR.Polynomial.mulLinear root coefficients)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.fromRoots_monic
+∀ {R : Type} [inst : Grind.CommRing R] (roots : List R),
+  Aiur.NativeAIR.Polynomial.Monic (Aiur.NativeAIR.Polynomial.fromRoots roots)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.fromRoots_nonzero
+∀ {R : Type} [inst : Grind.CommRing R] (roots : List R),
+  1 ≠ 0 → ¬Aiur.NativeAIR.Polynomial.IsZero (Aiur.NativeAIR.Polynomial.fromRoots roots)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.fromRoots_vanishes
+∀ {R : Type} [inst : Grind.CommRing R] (roots : List R) (point : R),
+  point ∈ roots → Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.fromRoots roots) = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.powerMinus_length
+∀ {R : Type} [inst : Grind.CommRing R] (degree : Nat) (constant : R),
+  (Aiur.NativeAIR.Polynomial.powerMinus degree constant).length = degree + 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.powerMinus_monic
+∀ {R : Type} [inst : Grind.CommRing R] {degree : Nat},
+  0 < degree → ∀ (constant : R), Aiur.NativeAIR.Polynomial.Monic (Aiur.NativeAIR.Polynomial.powerMinus degree constant)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_replicate_zero
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (count : Nat),
+  Aiur.NativeAIR.Quotient.horner point (List.replicate count 0) = 0
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.horner_powerMinus
+∀ {R : Type} [inst : Grind.CommRing R] (point constant : R) (degree : Nat),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.powerMinus degree constant) =
+    point ^ degree - constant
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.divide_length
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (coefficients : List R),
+  (Aiur.NativeAIR.Polynomial.divide point coefficients).length = coefficients.length - 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.divide_factor
+∀ {R : Type} [inst : Grind.CommRing R] (point root : R) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner point coefficients =
+    Aiur.NativeAIR.Quotient.horner root coefficients +
+      (point - root) * Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.divide root coefficients)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.zero_of_divide_zero
+∀ {R : Type} [inst : Grind.CommRing R] (root : R) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner root coefficients = 0 →
+    Aiur.NativeAIR.Polynomial.IsZero (Aiur.NativeAIR.Polynomial.divide root coefficients) →
+      Aiur.NativeAIR.Polynomial.IsZero coefficients
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.divide_nonzero
+∀ {R : Type} [inst : Grind.CommRing R] (root : R) {coefficients : List R},
+  ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+    Aiur.NativeAIR.Quotient.horner root coefficients = 0 →
+      ¬Aiur.NativeAIR.Polynomial.IsZero (Aiur.NativeAIR.Polynomial.divide root coefficients)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.divide_root
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (root point : R) (coefficients : List R),
+      Aiur.NativeAIR.Quotient.horner root coefficients = 0 →
+        Aiur.NativeAIR.Quotient.horner point coefficients = 0 →
+          point ≠ root → Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.divide root coefficients) = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.roots_lt_length
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (coefficients roots : List R),
+      ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+        roots.Nodup →
+          (∀ (point : R), point ∈ roots → Aiur.NativeAIR.Quotient.horner point coefficients = 0) →
+            roots.length < coefficients.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.roots_le_degree
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (coefficients roots : List R),
+      ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+        roots.Nodup →
+          (∀ (point : R), point ∈ roots → Aiur.NativeAIR.Quotient.horner point coefficients = 0) →
+            roots.length ≤ coefficients.length - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.zero_of_roots
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (coefficients roots : List R),
+      roots.Nodup →
+        coefficients.length ≤ roots.length →
+          (∀ (point : R), point ∈ roots → Aiur.NativeAIR.Quotient.horner point coefficients = 0) →
+            Aiur.NativeAIR.Polynomial.IsZero coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.zero_sub_of_samples
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (left right samples : List R),
+      samples.Nodup →
+        left.length ≤ samples.length →
+          right.length ≤ samples.length →
+            (∀ (point : R),
+                point ∈ samples →
+                  Aiur.NativeAIR.Quotient.horner point left = Aiur.NativeAIR.Quotient.horner point right) →
+              Aiur.NativeAIR.Polynomial.IsZero (Aiur.NativeAIR.Polynomial.sub left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.equal_of_samples
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (left right samples : List R),
+      samples.Nodup →
+        left.length ≤ samples.length →
+          right.length ≤ samples.length →
+            (∀ (point : R),
+                point ∈ samples →
+                  Aiur.NativeAIR.Quotient.horner point left = Aiur.NativeAIR.Quotient.horner point right) →
+              ∀ (point : R), Aiur.NativeAIR.Quotient.horner point left = Aiur.NativeAIR.Quotient.horner point right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.monic_zero_sub_of_samples
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (left right samples : List R),
+      Aiur.NativeAIR.Polynomial.Monic left →
+        Aiur.NativeAIR.Polynomial.Monic right →
+          samples.Nodup →
+            left.length = right.length →
+              left.length ≤ samples.length + 1 →
+                (∀ (point : R),
+                    point ∈ samples →
+                      Aiur.NativeAIR.Quotient.horner point left = Aiur.NativeAIR.Quotient.horner point right) →
+                  Aiur.NativeAIR.Polynomial.IsZero (Aiur.NativeAIR.Polynomial.sub left right)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.monic_equal_of_samples
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (left right samples : List R),
+      Aiur.NativeAIR.Polynomial.Monic left →
+        Aiur.NativeAIR.Polynomial.Monic right →
+          samples.Nodup →
+            left.length = right.length →
+              left.length ≤ samples.length + 1 →
+                (∀ (point : R),
+                    point ∈ samples →
+                      Aiur.NativeAIR.Quotient.horner point left = Aiur.NativeAIR.Quotient.horner point right) →
+                  ∀ (point : R), Aiur.NativeAIR.Quotient.horner point left = Aiur.NativeAIR.Quotient.horner point right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.root_product_identity
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (roots : List R) (constant : R),
+      roots.Nodup →
+        0 < roots.length →
+          (∀ (root : R), root ∈ roots → root ^ roots.length = constant) →
+            ∀ (point : R),
+              Aiur.NativeAIR.LogUp.product (List.map (fun x => point - x) roots) = point ^ roots.length - constant
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.root_count_le
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ [inst_1 : BEq R] [LawfulBEq R] (coefficients samples : List R),
+      ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+        samples.Nodup →
+          (List.filter (fun point => Aiur.NativeAIR.Quotient.horner point coefficients == 0) samples).length ≤
+            coefficients.length - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.equal_count_le
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ [inst_1 : BEq R] [LawfulBEq R] (left right samples : List R),
+      ¬Aiur.NativeAIR.Polynomial.IsZero (Aiur.NativeAIR.Polynomial.sub left right) →
+        samples.Nodup →
+          (List.filter
+                (fun point => Aiur.NativeAIR.Quotient.horner point left == Aiur.NativeAIR.Quotient.horner point right)
+                samples).length ≤
+            max left.length right.length - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.base_roots_lt_length
+∀ (coefficients roots : List Aiur.G),
+  ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+    roots.Nodup →
+      (∀ (point : Aiur.G), point ∈ roots → Aiur.NativeAIR.Quotient.horner point coefficients = 0) →
+        roots.length < coefficients.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.extension_roots_lt_length
+∀ (coefficients roots : List Aiur.NativeAIR.ProofCodec.Extension),
+  ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+    roots.Nodup →
+      (∀ (point : Aiur.NativeAIR.ProofCodec.Extension),
+          point ∈ roots → Aiur.NativeAIR.Quotient.horner point coefficients = 0) →
+        roots.length < coefficients.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.base_root_count_le
+∀ (coefficients samples : List Aiur.G),
+  ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+    samples.Nodup →
+      (List.filter (fun point => Aiur.NativeAIR.Quotient.horner point coefficients == 0) samples).length ≤
+        coefficients.length - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.extension_root_count_le
+∀ (coefficients samples : List Aiur.NativeAIR.ProofCodec.Extension),
+  ¬Aiur.NativeAIR.Polynomial.IsZero coefficients →
+    samples.Nodup →
+      (List.filter (fun point => Aiur.NativeAIR.Quotient.horner point coefficients == 0) samples).length ≤
+        coefficients.length - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.foldingNodes_length
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup) (index : Nat),
+  (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index).length = Aiur.NativeAIR.Domain.size arity
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.foldingNodes_nodup
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑arity ≤ ↑parent →
+    ∀ {index : Nat}, index < 2 ^ (↑parent - ↑arity) → (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index).Nodup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.foldingNodes_powers
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ (index : Nat) (node : Aiur.G),
+      node ∈ Aiur.NativeAIR.Polynomial.foldingNodes parent arity index →
+        node ^ Aiur.NativeAIR.Domain.size arity = Aiur.NativeAIR.FriDomain.queryPoint child index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Polynomial.folding_product_identity
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (point : Aiur.NativeAIR.ProofCodec.Extension),
+          Aiur.NativeAIR.LogUp.product
+              (List.map (fun node => point - Aiur.NativeAIR.ProofCodec.Extension.ofBase node)
+                (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index)) =
+            point ^ Aiur.NativeAIR.Domain.size arity -
+              Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint child index)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.derivative_zero
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) {coefficients : List R},
+  Aiur.NativeAIR.Polynomial.IsZero coefficients → Aiur.NativeAIR.Interpolation.derivativeValue point coefficients = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.derivative_neg
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (coefficients : List R),
+  Aiur.NativeAIR.Interpolation.derivativeValue point (List.map (fun x => 0 - x) coefficients) =
+    0 - Aiur.NativeAIR.Interpolation.derivativeValue point coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.derivative_sub
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (left right : List R),
+  Aiur.NativeAIR.Interpolation.derivativeValue point (Aiur.NativeAIR.Polynomial.sub left right) =
+    Aiur.NativeAIR.Interpolation.derivativeValue point left - Aiur.NativeAIR.Interpolation.derivativeValue point right
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.divide_diagonal
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.divide point coefficients) =
+    Aiur.NativeAIR.Interpolation.derivativeValue point coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.monomial_value
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (degree : Nat),
+  Aiur.NativeAIR.Quotient.horner point (List.replicate degree 0 ++ [1]) = point ^ degree
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.monomial_derivative
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (degree : Nat),
+  Aiur.NativeAIR.Interpolation.derivativeValue point (List.replicate degree 0 ++ [1]) = ↑degree * point ^ (degree - 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.powerMinus_derivative
+∀ {R : Type} [inst : Grind.CommRing R] (point constant : R) (degree : Nat),
+  Aiur.NativeAIR.Interpolation.derivativeValue point (Aiur.NativeAIR.Polynomial.powerMinus degree constant) =
+    ↑degree * point ^ (degree - 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.root_product_derivative
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (roots : List R) (constant : R),
+      roots.Nodup →
+        0 < roots.length →
+          (∀ (root : R), root ∈ roots → root ^ roots.length = constant) →
+            ∀ (point : R),
+              Aiur.NativeAIR.Interpolation.derivativeValue point (Aiur.NativeAIR.Polynomial.fromRoots roots) =
+                ↑roots.length * point ^ (roots.length - 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.root_quotient_diagonal
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (roots : List R) (constant : R),
+      roots.Nodup →
+        0 < roots.length →
+          (∀ (root : R), root ∈ roots → root ^ roots.length = constant) →
+            ∀ (point : R),
+              Aiur.NativeAIR.Quotient.horner point
+                  (Aiur.NativeAIR.Polynomial.divide point (Aiur.NativeAIR.Polynomial.fromRoots roots)) =
+                ↑roots.length * point ^ (roots.length - 1)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.closed_weight_diagonal
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (roots : List R) (constant scale root : R),
+      roots.Nodup →
+        0 < roots.length →
+          (∀ (root : R), root ∈ roots → root ^ roots.length = constant) →
+            root ∈ roots →
+              ↑roots.length * constant * scale = 1 →
+                root * scale *
+                    Aiur.NativeAIR.Quotient.horner root
+                      (Aiur.NativeAIR.Polynomial.divide root (Aiur.NativeAIR.Polynomial.fromRoots roots)) =
+                  1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.combine_length
+∀ {R : Type} [inst : Grind.CommRing R] (vanishing : List R) (scale : R) (samples : List (R × R)),
+  (Aiur.NativeAIR.Interpolation.combine vanishing scale samples).length ≤ vanishing.length - 1
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.coefficients_length
+∀ {R : Type} [inst : Grind.CommRing R] (samples : List (R × R)) (scale : R),
+  (Aiur.NativeAIR.Interpolation.coefficients samples scale).length ≤ samples.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.combine_zero
+∀ {R : Type} [inst : Grind.CommRing R] (vanishing : List R) (scale point : R) (samples : List (R × R)),
+  (∀ (sample : R × R),
+      sample ∈ samples →
+        Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.divide sample.fst vanishing) = 0) →
+    Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Interpolation.combine vanishing scale samples) = 0
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.combine_at_node
+∀ {R : Type} [inst : Grind.CommRing R] (vanishing : List R) (scale root value : R) (samples : List (R × R)),
+  (List.map Prod.fst samples).Nodup →
+    (root, value) ∈ samples →
+      root * scale * Aiur.NativeAIR.Quotient.horner root (Aiur.NativeAIR.Polynomial.divide root vanishing) = 1 →
+        (∀ (sample : R × R),
+            sample ∈ samples →
+              sample.fst ≠ root →
+                Aiur.NativeAIR.Quotient.horner root (Aiur.NativeAIR.Polynomial.divide sample.fst vanishing) = 0) →
+          Aiur.NativeAIR.Quotient.horner root (Aiur.NativeAIR.Interpolation.combine vanishing scale samples) = value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.coefficients_at_node
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (samples : List (R × R)) (constant scale root value : R),
+      (List.map Prod.fst samples).Nodup →
+        0 < samples.length →
+          (∀ (sample : R × R), sample ∈ samples → sample.fst ^ samples.length = constant) →
+            ↑samples.length * constant * scale = 1 →
+              (root, value) ∈ samples →
+                Aiur.NativeAIR.Quotient.horner root (Aiur.NativeAIR.Interpolation.coefficients samples scale) = value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.coefficients_unique
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (samples : List (R × R)) (constant scale : R) (candidate : List R),
+      (List.map Prod.fst samples).Nodup →
+        0 < samples.length →
+          (∀ (sample : R × R), sample ∈ samples → sample.fst ^ samples.length = constant) →
+            ↑samples.length * constant * scale = 1 →
+              candidate.length ≤ samples.length →
+                (∀ (sample : R × R),
+                    sample ∈ samples → Aiur.NativeAIR.Quotient.horner sample.fst candidate = sample.snd) →
+                  Aiur.NativeAIR.Polynomial.IsZero
+                    (Aiur.NativeAIR.Polynomial.sub candidate (Aiur.NativeAIR.Interpolation.coefficients samples scale))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.coefficients_evaluate
+∀ {R : Type} [inst : Grind.CommRing R],
+  (∀ (a b : R), a * b = 0 → a = 0 ∨ b = 0) →
+    ∀ (samples : List (R × R)) (constant scale : R) (candidate : List R),
+      (List.map Prod.fst samples).Nodup →
+        0 < samples.length →
+          (∀ (sample : R × R), sample ∈ samples → sample.fst ^ samples.length = constant) →
+            ↑samples.length * constant * scale = 1 →
+              candidate.length ≤ samples.length →
+                (∀ (sample : R × R),
+                    sample ∈ samples → Aiur.NativeAIR.Quotient.horner sample.fst candidate = sample.snd) →
+                  ∀ (point : R),
+                    Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Interpolation.coefficients samples scale) =
+                      Aiur.NativeAIR.Quotient.horner point candidate
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.divide_inverse_value
+∀ {R : Type} [inst : Grind.CommRing R] (vanishing : List R) (point root inverse : R),
+  Aiur.NativeAIR.Quotient.horner root vanishing = 0 →
+    (point - root) * inverse = 1 →
+      inverse * Aiur.NativeAIR.Quotient.horner point vanishing =
+        Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Polynomial.divide root vanishing)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.weightedSum_polynomial
+∀ (vanishing : List Aiur.NativeAIR.ProofCodec.Extension) (scale point : Aiur.NativeAIR.ProofCodec.Extension)
+  (samples : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)),
+  (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+      sample ∈ samples → Aiur.NativeAIR.Quotient.horner sample.fst vanishing = 0) →
+    (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+        sample ∈ samples → point ≠ sample.fst) →
+      ∃ result,
+        Aiur.NativeAIR.Interpolation.weightedSum scale point samples = some result ∧
+          result * Aiur.NativeAIR.Quotient.horner point vanishing =
+            Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Interpolation.combine vanishing scale samples)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.evaluate_polynomial
+∀ (samples : List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension))
+  (constant scale point : Aiur.NativeAIR.ProofCodec.Extension),
+  (List.map Prod.fst samples).Nodup →
+    0 < samples.length →
+      (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+          sample ∈ samples → sample.fst ^ samples.length = constant) →
+        ↑samples.length * constant * scale = 1 →
+          Aiur.NativeAIR.Interpolation.evaluate scale point samples =
+            some (Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Interpolation.coefficients samples scale))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldSamples_roots
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup) (index : Nat) (values : List Aiur.NativeAIR.ProofCodec.Extension),
+  values.length = Aiur.NativeAIR.Domain.size arity →
+    List.map Prod.fst (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values) =
+      List.map Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldSamples_length
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup) (index : Nat) (values : List Aiur.NativeAIR.ProofCodec.Extension),
+  values.length = Aiur.NativeAIR.Domain.size arity →
+    (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values).length = Aiur.NativeAIR.Domain.size arity
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldSamples_nodup
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑arity ≤ ↑parent →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+          values.length = Aiur.NativeAIR.Domain.size arity →
+            (List.map Prod.fst (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values)).Nodup
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldSamples_powers
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ (index : Nat) (values : List Aiur.NativeAIR.ProofCodec.Extension),
+      values.length = Aiur.NativeAIR.Domain.size arity →
+        ∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+          sample ∈ Aiur.NativeAIR.Interpolation.foldSamples parent arity index values →
+            sample.fst ^ (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values).length =
+              Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint child index)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldScale_inverse
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ (index : Nat),
+      ↑(Aiur.NativeAIR.Domain.size arity) *
+            Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint child index) *
+          Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Interpolation.foldScale parent arity index) =
+        1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldRow_polynomial
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+          values.length = Aiur.NativeAIR.Domain.size arity →
+            ∀ (point : Aiur.NativeAIR.ProofCodec.Extension),
+              Aiur.NativeAIR.Interpolation.foldRow parent arity index values point =
+                some
+                  (Aiur.NativeAIR.Quotient.horner point
+                    (Aiur.NativeAIR.Interpolation.coefficients
+                      (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values)
+                      (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                        (Aiur.NativeAIR.Interpolation.foldScale parent arity index))))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldRow_reject_shape
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup) (index : Nat) (values : List Aiur.NativeAIR.ProofCodec.Extension)
+  (point : Aiur.NativeAIR.ProofCodec.Extension),
+  ↑arity > ↑parent ∨ index ≥ 2 ^ (↑parent - ↑arity) ∨ values.length ≠ Aiur.NativeAIR.Domain.size arity →
+    Aiur.NativeAIR.Interpolation.foldRow parent arity index values point = none
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldRow_at_node
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+          values.length = Aiur.NativeAIR.Domain.size arity →
+            ∀ (root value : Aiur.NativeAIR.ProofCodec.Extension),
+              (root, value) ∈ Aiur.NativeAIR.Interpolation.foldSamples parent arity index values →
+                Aiur.NativeAIR.Interpolation.foldRow parent arity index values root = some value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldRow_evaluate
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (values candidate : List Aiur.NativeAIR.ProofCodec.Extension),
+          values.length = Aiur.NativeAIR.Domain.size arity →
+            candidate.length ≤ Aiur.NativeAIR.Domain.size arity →
+              (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+                  sample ∈ Aiur.NativeAIR.Interpolation.foldSamples parent arity index values →
+                    Aiur.NativeAIR.Quotient.horner sample.fst candidate = sample.snd) →
+                ∀ (point : Aiur.NativeAIR.ProofCodec.Extension),
+                  Aiur.NativeAIR.Interpolation.foldRow parent arity index values point =
+                    some (Aiur.NativeAIR.Quotient.horner point candidate)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Interpolation.foldRow_success
+∀ {parent arity : Aiur.NativeAIR.Domain.Subgroup} {index : Nat} {values : List Aiur.NativeAIR.ProofCodec.Extension}
+  {point result : Aiur.NativeAIR.ProofCodec.Extension},
+  Aiur.NativeAIR.Interpolation.foldRow parent arity index values point = some result →
+    ↑arity ≤ ↑parent ∧
+      index < 2 ^ (↑parent - ↑arity) ∧
+        values.length = Aiur.NativeAIR.Domain.size arity ∧
+          ∃ candidate,
+            candidate.length ≤ Aiur.NativeAIR.Domain.size arity ∧
+              (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+                  sample ∈ Aiur.NativeAIR.Interpolation.foldSamples parent arity index values →
+                    Aiur.NativeAIR.Quotient.horner sample.fst candidate = sample.snd) ∧
+                result = Aiur.NativeAIR.Quotient.horner point candidate
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.horner_split
+∀ {R : Type} [inst : Grind.CommRing R] (point : R) (width : Nat) (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner point coefficients =
+    Aiur.NativeAIR.Quotient.horner point (List.take width coefficients) +
+      point ^ width * Aiur.NativeAIR.Quotient.horner point (List.drop width coefficients)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.rowCoefficients_length
+∀ {R : Type} [inst : Grind.CommRing R] (arity : Aiur.NativeAIR.Domain.Subgroup) (point : R) (coefficients : List R),
+  (Aiur.NativeAIR.Folding.rowCoefficients arity point coefficients).length ≤ Aiur.NativeAIR.Domain.size arity
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.rowCoefficients_value
+∀ {R : Type} [inst : Grind.CommRing R] (arity : Aiur.NativeAIR.Domain.Subgroup) (point root : R)
+  (coefficients : List R),
+  root ^ Aiur.NativeAIR.Domain.size arity = point →
+    Aiur.NativeAIR.Quotient.horner root (Aiur.NativeAIR.Folding.rowCoefficients arity point coefficients) =
+      Aiur.NativeAIR.Quotient.horner root coefficients
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.rowCoefficients_fold
+∀ {R : Type} [inst : Grind.CommRing R] (arity : Aiur.NativeAIR.Domain.Subgroup) (point challenge : R)
+  (coefficients : List R),
+  Aiur.NativeAIR.Quotient.horner challenge (Aiur.NativeAIR.Folding.rowCoefficients arity point coefficients) =
+    Aiur.NativeAIR.Quotient.horner point (Aiur.NativeAIR.Folding.foldCoefficients arity challenge coefficients)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.foldCoefficients_degree
+∀ {R : Type} [inst : Grind.CommRing R] (arity : Aiur.NativeAIR.Domain.Subgroup) (challenge : R) (degree : Nat)
+  (coefficients : List R),
+  coefficients.length ≤ Aiur.NativeAIR.Domain.size arity * degree →
+    (Aiur.NativeAIR.Folding.foldCoefficients arity challenge coefficients).length ≤ degree
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.foldRow_global
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (values coefficients : List Aiur.NativeAIR.ProofCodec.Extension),
+          values.length = Aiur.NativeAIR.Domain.size arity →
+            (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+                sample ∈ Aiur.NativeAIR.Interpolation.foldSamples parent arity index values →
+                  Aiur.NativeAIR.Quotient.horner sample.fst coefficients = sample.snd) →
+              ∀ (challenge : Aiur.NativeAIR.ProofCodec.Extension),
+                Aiur.NativeAIR.Interpolation.foldRow parent arity index values challenge =
+                  some
+                    (Aiur.NativeAIR.Quotient.horner
+                      (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint child index))
+                      (Aiur.NativeAIR.Folding.foldCoefficients arity challenge coefficients))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.foldRow_codeword
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (coefficients : List Aiur.NativeAIR.ProofCodec.Extension) (challenge : Aiur.NativeAIR.ProofCodec.Extension),
+          Aiur.NativeAIR.Interpolation.foldRow parent arity index
+              (List.map
+                (fun root =>
+                  Aiur.NativeAIR.Quotient.horner (Aiur.NativeAIR.ProofCodec.Extension.ofBase root) coefficients)
+                (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index))
+              challenge =
+            some
+              (Aiur.NativeAIR.Quotient.horner
+                (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint child index))
+                (Aiur.NativeAIR.Folding.foldCoefficients arity challenge coefficients))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.foldRow_codeword_degree
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ (degree : Nat) (coefficients : List Aiur.NativeAIR.ProofCodec.Extension),
+      coefficients.length ≤ Aiur.NativeAIR.Domain.size arity * degree →
+        ∀ (challenge : Aiur.NativeAIR.ProofCodec.Extension),
+          ∃ folded,
+            folded.length ≤ degree ∧
+              ∀ (index : Nat),
+                index < 2 ^ (↑parent - ↑arity) →
+                  Aiur.NativeAIR.Interpolation.foldRow parent arity index
+                      (List.map
+                        (fun root =>
+                          Aiur.NativeAIR.Quotient.horner (Aiur.NativeAIR.ProofCodec.Extension.ofBase root) coefficients)
+                        (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index))
+                      challenge =
+                    some
+                      (Aiur.NativeAIR.Quotient.horner
+                        (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint child index))
+                        folded)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.values_of_agreement
+∀ (parent arity : Aiur.NativeAIR.Domain.Subgroup) (index : Nat)
+  (values coefficients : List Aiur.NativeAIR.ProofCodec.Extension),
+  values.length = Aiur.NativeAIR.Domain.size arity →
+    (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+        sample ∈ Aiur.NativeAIR.Interpolation.foldSamples parent arity index values →
+          Aiur.NativeAIR.Quotient.horner sample.fst coefficients = sample.snd) →
+      values =
+        List.map
+          (fun root => Aiur.NativeAIR.Quotient.horner (Aiur.NativeAIR.ProofCodec.Extension.ofBase root) coefficients)
+          (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.interpolant_values
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (values : List Aiur.NativeAIR.ProofCodec.Extension),
+          values.length = Aiur.NativeAIR.Domain.size arity →
+            values =
+              List.map
+                (fun root =>
+                  Aiur.NativeAIR.Quotient.horner (Aiur.NativeAIR.ProofCodec.Extension.ofBase root)
+                    (Aiur.NativeAIR.Interpolation.coefficients
+                      (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values)
+                      (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                        (Aiur.NativeAIR.Interpolation.foldScale parent arity index))))
+                (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.interpolants_different
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (left right : List Aiur.NativeAIR.ProofCodec.Extension),
+          left.length = Aiur.NativeAIR.Domain.size arity →
+            right.length = Aiur.NativeAIR.Domain.size arity →
+              left ≠ right →
+                ¬Aiur.NativeAIR.Polynomial.IsZero
+                    (Aiur.NativeAIR.Polynomial.sub
+                      (Aiur.NativeAIR.Interpolation.coefficients
+                        (Aiur.NativeAIR.Interpolation.foldSamples parent arity index left)
+                        (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                          (Aiur.NativeAIR.Interpolation.foldScale parent arity index)))
+                      (Aiur.NativeAIR.Interpolation.coefficients
+                        (Aiur.NativeAIR.Interpolation.foldSamples parent arity index right)
+                        (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                          (Aiur.NativeAIR.Interpolation.foldScale parent arity index))))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.Folding.foldRow_equal_count_le
+∀ (parent child arity : Aiur.NativeAIR.Domain.Subgroup),
+  ↑parent = ↑child + ↑arity →
+    ∀ {index : Nat},
+      index < 2 ^ (↑parent - ↑arity) →
+        ∀ (left right challenges : List Aiur.NativeAIR.ProofCodec.Extension),
+          left.length = Aiur.NativeAIR.Domain.size arity →
+            right.length = Aiur.NativeAIR.Domain.size arity →
+              left ≠ right →
+                challenges.Nodup →
+                  (List.filter
+                        (fun challenge =>
+                          Aiur.NativeAIR.Interpolation.foldRow parent arity index left challenge ==
+                            Aiur.NativeAIR.Interpolation.foldRow parent arity index right challenge)
+                        challenges).length ≤
+                    Aiur.NativeAIR.Domain.size arity - 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.reconstruct_eq
+∀ {R : Type u_1} (arity : Aiur.NativeAIR.Domain.Subgroup) (index : Nat) (value : R) (siblings : List R),
+  siblings.length + 1 = Aiur.NativeAIR.Domain.size arity →
+    Aiur.NativeAIR.FriQuery.reconstruct arity index value siblings =
+      some (siblings.insertIdx (index % Aiur.NativeAIR.Domain.size arity) value)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.reconstruct_success
+∀ {R : Type u_1} {arity : Aiur.NativeAIR.Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R},
+  Aiur.NativeAIR.FriQuery.reconstruct arity index value siblings = some row →
+    siblings.length + 1 = Aiur.NativeAIR.Domain.size arity ∧
+      row = siblings.insertIdx (index % Aiur.NativeAIR.Domain.size arity) value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.reconstruct_length
+∀ {R : Type u_1} {arity : Aiur.NativeAIR.Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R},
+  Aiur.NativeAIR.FriQuery.reconstruct arity index value siblings = some row →
+    row.length = Aiur.NativeAIR.Domain.size arity
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.reconstruct_self
+∀ {R : Type u_1} {arity : Aiur.NativeAIR.Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R},
+  Aiur.NativeAIR.FriQuery.reconstruct arity index value siblings = some row →
+    row[index % Aiur.NativeAIR.Domain.size arity]? = some value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.reconstruct_siblings
+∀ {R : Type u_1} {arity : Aiur.NativeAIR.Domain.Subgroup} {index : Nat} {value : R} {siblings row : List R},
+  Aiur.NativeAIR.FriQuery.reconstruct arity index value siblings = some row →
+    row.eraseIdx (index % Aiur.NativeAIR.Domain.size arity) = siblings
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_success
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    0 < ↑round.arity ∧
+      ↑round.arity ≤ ↑state.domain ∧
+        ∃ child values folded,
+          Aiur.NativeAIR.Domain.ofLogSize (↑state.domain - ↑round.arity) = some child ∧
+            Aiur.NativeAIR.FriQuery.reconstruct round.arity state.index state.value round.siblings = some values ∧
+              Aiur.NativeAIR.Interpolation.foldRow state.domain round.arity
+                    (state.index / Aiur.NativeAIR.Domain.size round.arity) values round.challenge =
+                  some folded ∧
+                result =
+                  {
+                    state :=
+                      { domain := child, index := state.index / Aiur.NativeAIR.Domain.size round.arity,
+                        value :=
+                          (Aiur.NativeAIR.FriQuery.roll (↑child)
+                              (round.challenge.power (Aiur.NativeAIR.Domain.size round.arity)) folded openings).fst },
+                    remaining :=
+                      (Aiur.NativeAIR.FriQuery.roll (↑child)
+                          (round.challenge.power (Aiur.NativeAIR.Domain.size round.arity)) folded openings).snd,
+                    row :=
+                      { domain := child, index := state.index / Aiur.NativeAIR.Domain.size round.arity,
+                        values := values } }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_dimensions
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    0 < ↑round.arity ∧
+      ↑state.domain = ↑result.state.domain + ↑round.arity ∧
+        result.state.index = state.index / Aiur.NativeAIR.Domain.size round.arity ∧
+          result.state.index < Aiur.NativeAIR.Domain.size result.state.domain ∧
+            result.row.domain = result.state.domain ∧ result.row.index = result.state.index
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_row
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    result.row.values.length = Aiur.NativeAIR.Domain.size round.arity ∧
+      result.row.values[state.index % Aiur.NativeAIR.Domain.size round.arity]? = some state.value ∧
+        result.row.values.eraseIdx (state.index % Aiur.NativeAIR.Domain.size round.arity) = round.siblings
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_index_bound
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    state.index < Aiur.NativeAIR.Domain.size state.domain
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_self_sample
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint state.domain state.index),
+        state.value) ∈
+      Aiur.NativeAIR.Interpolation.foldSamples state.domain round.arity result.state.index result.row.values
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_polynomial
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    ∃ candidate,
+      candidate.length ≤ Aiur.NativeAIR.Domain.size round.arity ∧
+        Aiur.NativeAIR.Quotient.horner
+              (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                (Aiur.NativeAIR.FriDomain.queryPoint state.domain state.index))
+              candidate =
+            state.value ∧
+          (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+              sample ∈
+                  Aiur.NativeAIR.Interpolation.foldSamples state.domain round.arity result.state.index
+                    result.row.values →
+                Aiur.NativeAIR.Quotient.horner sample.fst candidate = sample.snd) ∧
+            (result.state.value, result.remaining) =
+              Aiur.NativeAIR.FriQuery.roll (↑result.state.domain)
+                (round.challenge.power (Aiur.NativeAIR.Domain.size round.arity))
+                (Aiur.NativeAIR.Quotient.horner round.challenge candidate) openings
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.step_global
+∀ {state : Aiur.NativeAIR.FriQuery.State} {round : Aiur.NativeAIR.FriQuery.Round}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.StepResult},
+  Aiur.NativeAIR.FriQuery.step state round openings = some result →
+    ∀ (coefficients : List Aiur.NativeAIR.ProofCodec.Extension),
+      (∀ (sample : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension),
+          sample ∈
+              Aiur.NativeAIR.Interpolation.foldSamples state.domain round.arity result.state.index result.row.values →
+            Aiur.NativeAIR.Quotient.horner sample.fst coefficients = sample.snd) →
+        (result.state.value, result.remaining) =
+          Aiur.NativeAIR.FriQuery.roll (↑result.state.domain)
+            (round.challenge.power (Aiur.NativeAIR.Domain.size round.arity))
+            (Aiur.NativeAIR.Quotient.horner
+              (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                (Aiur.NativeAIR.FriDomain.queryPoint result.state.domain result.state.index))
+              (Aiur.NativeAIR.Folding.foldCoefficients round.arity round.challenge coefficients))
+            openings
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.roll_length
+∀ (height : Nat) (factor value : Aiur.NativeAIR.ProofCodec.Extension)
+  (openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)),
+  (Aiur.NativeAIR.FriQuery.roll height factor value openings).snd.length ≤ openings.length
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.roll_empty
+∀ (height : Nat) (factor value : Aiur.NativeAIR.ProofCodec.Extension),
+  Aiur.NativeAIR.FriQuery.roll height factor value [] = (value, [])
+AXIOMS [propext]
+ROOT Aiur.NativeAIR.FriQuery.roll_matching
+∀ (height : Nat) (factor value next : Aiur.NativeAIR.ProofCodec.Extension)
+  (rest : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)),
+  Aiur.NativeAIR.FriQuery.roll height factor value ((height, next) :: rest) = (value + factor * next, rest)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.roll_other
+∀ (height nextHeight : Nat) (factor value next : Aiur.NativeAIR.ProofCodec.Extension)
+  (rest : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)),
+  nextHeight ≠ height →
+    Aiur.NativeAIR.FriQuery.roll height factor value ((nextHeight, next) :: rest) = (value, (nextHeight, next) :: rest)
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.roll_count
+∀ (height : Nat) (factor value : Aiur.NativeAIR.ProofCodec.Extension)
+  (openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)),
+  openings.length ≤ (Aiur.NativeAIR.FriQuery.roll height factor value openings).snd.length + 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.roll_order
+∀ (height : Nat) (factor value : Aiur.NativeAIR.ProofCodec.Extension)
+  (openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)),
+  List.Pairwise (fun left right => right.fst < left.fst)
+      (Aiur.NativeAIR.FriQuery.roll height factor value openings).snd →
+    (∀ (entry : Nat × Aiur.NativeAIR.ProofCodec.Extension),
+        entry ∈ (Aiur.NativeAIR.FriQuery.roll height factor value openings).snd → entry.fst < height) →
+      List.Pairwise (fun left right => right.fst < left.fst) openings ∧
+        ∀ (entry : Nat × Aiur.NativeAIR.ProofCodec.Extension), entry ∈ openings → entry.fst ≤ height
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.walk_nil_success
+∀ {final : Aiur.NativeAIR.Domain.Subgroup} {state : Aiur.NativeAIR.FriQuery.State}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.walk final state openings [] = some result →
+    state.domain = final ∧ openings = [] ∧ result = { state := state, rows := [] }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.walk_cons_success
+∀ {final : Aiur.NativeAIR.Domain.Subgroup} {state : Aiur.NativeAIR.FriQuery.State}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {round : Aiur.NativeAIR.FriQuery.Round}
+  {rest : List Aiur.NativeAIR.FriQuery.Round} {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.walk final state openings (round :: rest) = some result →
+    ∃ head tail,
+      Aiur.NativeAIR.FriQuery.step state round openings = some head ∧
+        Aiur.NativeAIR.FriQuery.walk final head.state head.remaining rest = some tail ∧
+          result = { state := tail.state, rows := head.row :: tail.rows }
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.walk_summary
+∀ {final : Aiur.NativeAIR.Domain.Subgroup} {state : Aiur.NativeAIR.FriQuery.State}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {rounds : List Aiur.NativeAIR.FriQuery.Round}
+  {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.walk final state openings rounds = some result →
+    result.state.domain = final ∧
+      result.rows.length = rounds.length ∧
+        ↑state.domain = ↑final + (List.map (fun round => ↑round.arity) rounds).sum ∧
+          result.state.index = state.index / 2 ^ (List.map (fun round => ↑round.arity) rounds).sum
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.walk_openings
+∀ {final : Aiur.NativeAIR.Domain.Subgroup} {state : Aiur.NativeAIR.FriQuery.State}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {rounds : List Aiur.NativeAIR.FriQuery.Round}
+  {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.walk final state openings rounds = some result →
+    List.Pairwise (fun left right => right.fst < left.fst) openings ∧
+      (∀ (entry : Nat × Aiur.NativeAIR.ProofCodec.Extension), entry ∈ openings → entry.fst < ↑state.domain) ∧
+        openings.length ≤ rounds.length
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.run_success
+∀ {initial final : Aiur.NativeAIR.Domain.Subgroup} {index : Nat}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {rounds : List Aiur.NativeAIR.FriQuery.Round}
+  {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.run initial final index openings rounds = some result →
+    index < Aiur.NativeAIR.Domain.size initial ∧
+      ∃ value rest,
+        openings = (↑initial, value) :: rest ∧
+          Aiur.NativeAIR.FriQuery.walk final { domain := initial, index := index, value := value } rest rounds =
+            some result
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.run_summary
+∀ {initial final : Aiur.NativeAIR.Domain.Subgroup} {index : Nat}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {rounds : List Aiur.NativeAIR.FriQuery.Round}
+  {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.run initial final index openings rounds = some result →
+    index < Aiur.NativeAIR.Domain.size initial ∧
+      result.state.domain = final ∧
+        result.rows.length = rounds.length ∧
+          ↑initial = ↑final + (List.map (fun round => ↑round.arity) rounds).sum ∧
+            result.state.index = index / 2 ^ (List.map (fun round => ↑round.arity) rounds).sum ∧
+              result.state.index < Aiur.NativeAIR.Domain.size final ∧
+                List.Pairwise (fun left right => right.fst < left.fst) openings ∧ openings.length ≤ rounds.length + 1
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.check_success
+∀ {initial final : Aiur.NativeAIR.Domain.Subgroup} {index : Nat}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {rounds : List Aiur.NativeAIR.FriQuery.Round}
+  {finalPolynomial : List Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.check initial final index openings rounds finalPolynomial = some result →
+    Aiur.NativeAIR.FriQuery.run initial final index openings rounds = some result ∧
+      Aiur.NativeAIR.Quotient.horner
+          (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint initial result.state.index))
+          finalPolynomial =
+        result.state.value
+AXIOMS [propext, Quot.sound]
+ROOT Aiur.NativeAIR.FriQuery.check_final_polynomial
+∀ {initial final : Aiur.NativeAIR.Domain.Subgroup} {index : Nat}
+  {openings : List (Nat × Aiur.NativeAIR.ProofCodec.Extension)} {rounds : List Aiur.NativeAIR.FriQuery.Round}
+  {finalPolynomial : List Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.FriQuery.Result},
+  Aiur.NativeAIR.FriQuery.check initial final index openings rounds finalPolynomial = some result →
+    Aiur.NativeAIR.Quotient.horner
+        (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.FriDomain.queryPoint final result.state.index))
+        finalPolynomial =
+      result.state.value
+AXIOMS [propext, Classical.choice, Quot.sound]
+PREMISE Aiur.AIR.activityConstraint
+Aiur.G → Aiur.G → Aiur.G
+DEFINITION
+fun multiplicity selector => multiplicity * (1 - selector)
+PREMISE Aiur.Bytecode.Eval.SameCode.mk
+∀ {a b : Aiur.Bytecode.Toplevel},
+  a.functions.size = b.functions.size →
+    (∀ (i : Nat) (ha : i < a.functions.size) (hb : i < b.functions.size), a.functions[i].body = b.functions[i].body) →
+      (∀ (i : Nat) (ha : i < a.functions.size) (hb : i < b.functions.size),
+          a.functions[i].layout.inputSize = b.functions[i].layout.inputSize) →
+        Aiur.Bytecode.Eval.SameCode a b
+PREMISE Aiur.finishCompilation
+Aiur.Source.Toplevel → Aiur.Bytecode.Toplevel → Std.HashMap Aiur.Global Aiur.Bytecode.FunIdx → Aiur.CompiledToplevel
+DEFINITION
+fun t bytecodeRaw preNameMap =>
+  (match bytecodeRaw.deduplicate with
+    | (bytecodeDedup, remap) =>
+      have needs := bytecodeDedup.needsCircuit;
+      have bytecode :=
+        {
+          functions :=
+            Array.mapIdx (fun i f => { body := f.body, layout := f.layout, entry := f.entry, constrained := needs[i]! })
+              bytecodeDedup.functions,
+          memorySizes := bytecodeDedup.memorySizes, circuits := bytecodeDedup.circuits };
+      have nameMap := Std.HashMap.fold (fun acc name idx => acc.insert name (remap idx)) ∅ preNameMap;
+      have reverseMap :=
+        Std.HashMap.fold
+          (fun acc global idx => if acc.contains idx = true then acc else acc.insert idx (toString global)) ∅ nameMap;
+      have bytecode :=
+        { functions := bytecode.functions, memorySizes := bytecode.memorySizes,
+          circuits :=
+            bytecode.singletonCircuits fun i => reverseMap[i]?.getD (toString "<fn " ++ toString i ++ toString ">") };
+      pure { source := t, bytecode := bytecode, nameMap := nameMap }).run
+PREMISE Aiur.BoundVerifier.Selection.mk
+Aiur.Source.Toplevel →
+  Array (String × Array String) →
+    Name →
+      Aiur.Bytecode.FunIdx →
+        Nat → Array Aiur.G → Aiur.CommitmentParameters → Aiur.FriParameters → ByteArray → Aiur.BoundVerifier.Selection
+PREMISE Aiur.BoundVerifier.Selection.compile
+Aiur.BoundVerifier.Selection → Except String Aiur.CompiledToplevel
+DEFINITION
+fun selection => do
+  let compiled ← selection.source.compile
+  if selection.groups.isEmpty = true then pure compiled else compiled.groupFunctions selection.groups
+PREMISE Aiur.BoundVerifier.Selection.system
+Aiur.BoundVerifier.Selection → Aiur.CompiledToplevel → Aiur.AiurSystem
+DEFINITION
+fun selection compiled => Aiur.AiurSystem.build compiled.bytecode selection.commitment selection.fri
+PREMISE Aiur.BoundVerifier.Backend.mk
+{selection : Aiur.BoundVerifier.Selection} →
+  (compiled : Aiur.CompiledToplevel) →
+    selection.compile = Except.ok compiled →
+      (system : Aiur.AiurSystem) →
+        system = selection.system compiled →
+          compiled.getFuncIdx selection.entrypoint = some selection.function →
+            selection.function < Aiur.gSize.toNat →
+              (entry : Aiur.Bytecode.Function) →
+                compiled.bytecode.functions[selection.function]? = some entry →
+                  entry.entry = true →
+                    entry.constrained = true →
+                      entry.layout.inputSize = selection.inputSize →
+                        Aiur.Bytecode.Block.returnsHaveSize selection.success.size entry.body = true →
+                          compiled.bytecode.validateLookupShapes = true →
+                            compiled.bytecode.validateRowCounts = true →
+                              compiled.bytecode.validateEmission = true →
+                                system.vkBytes = selection.key →
+                                  (keyData : Aiur.NativeAIR.KeyCodec.Key) →
+                                    Aiur.NativeAIR.KeyCodec.decodeCanonical selection.key = some keyData →
+                                      keyData.parameters = selection.keyParameters →
+                                        Aiur.BoundVerifier.Backend selection
+PREMISE Aiur.BoundVerifier.verify
+{selection : Aiur.BoundVerifier.Selection} →
+  Aiur.BoundVerifier.Backend selection → Array Aiur.G → ByteArray → Except String Unit
+DEFINITION
+fun {selection} backend input bytes =>
+  have __do_jp := fun __r => do
+    let proof ← Aiur.Proof.ofBytesChecked bytes
+    backend.system.verify (Aiur.buildClaim selection.function input selection.success) proof;
+  if (input.size != selection.inputSize) = true then do
+    let __r ← throw "public input arity differs"
+    __do_jp __r
+  else __do_jp ()
+PREMISE Aiur.CompiledToplevel.groupFunctions
+Aiur.CompiledToplevel → Array (String × Array String) → Except String Aiur.CompiledToplevel
+DEFINITION
+fun ct groups =>
+  have t := ct.bytecode;
+  have byName := Std.HashMap.fold (fun acc g i => acc.insert (toString g) i) ∅ ct.nameMap;
+  have grouped := ∅;
+  have resolved := #[];
+  do
+  let __s ←
+    forIn groups (grouped, resolved) fun x __s =>
+        have grouped := __s.fst;
+        have resolved := __s.snd;
+        match x with
+        | (gname, names) =>
+          have __do_jp := fun __r =>
+            have members := #[];
+            do
+            let __s ←
+              forIn names (grouped, members) fun name __s =>
+                  have grouped := __s.fst;
+                  have members := __s.snd;
+                  match byName[name]? with
+                  | some i =>
+                    have f := t.functions[i]!;
+                    have __do_jp := fun __r =>
+                      have __do_jp := fun __r =>
+                        have __do_jp := fun __r =>
+                          have grouped := grouped.insert i resolved.size;
+                          have members := members.push i;
+                          pure (ForInStep.yield (grouped, members));
+                        if grouped.contains i = true then do
+                          let __r ←
+                            throw
+                                (toString "group " ++ toString gname ++ toString ": " ++ toString name ++
+                                  toString " is already grouped")
+                          __do_jp __r
+                        else __do_jp ();
+                      if f.entry = true then do
+                        let __r ←
+                          throw
+                              (toString "group " ++ toString gname ++ toString ": " ++ toString name ++
+                                toString " is an entry function")
+                        __do_jp __r
+                      else __do_jp ();
+                    if f.constrained = true then __do_jp ()
+                    else do
+                      let __r ←
+                        throw
+                            (toString "group " ++ toString gname ++ toString ": " ++ toString name ++
+                              toString " is unconstrained (it has no circuit)")
+                      __do_jp __r
+                  | x => do
+                    throw (toString "group " ++ toString gname ++ toString ": unknown function " ++ toString name)
+                    pure (ForInStep.yield (grouped, members))
+            have grouped : Std.HashMap Aiur.Bytecode.FunIdx Nat := __s.fst
+            have members : Array Aiur.Bytecode.FunIdx := __s.snd
+            have resolved : Array (String × Array Aiur.Bytecode.FunIdx) := resolved.push (gname, members)
+            pure (ForInStep.yield (grouped, resolved));
+          if names.isEmpty = true then do
+            let __r ← throw (toString "group " ++ toString gname ++ toString " is empty")
+            __do_jp __r
+          else __do_jp ()
+  have grouped : Std.HashMap Aiur.Bytecode.FunIdx Nat := __s.fst
+  have resolved : Array (String × Array Aiur.Bytecode.FunIdx) := __s.snd
+  have circuits : Array Aiur.Bytecode.Circuit := #[]
+  have placed : Array Bool := Array.replicate resolved.size false
+  let __s ←
+    forIn t.circuits (circuits, placed) fun c __s =>
+        have circuits := __s.fst;
+        have placed := __s.snd;
+        let members := c.members;
+        if h : members.size = 1 then
+          have i := members[0];
+          match grouped[i]? with
+          | none =>
+            have circuits := circuits.push c;
+            pure (ForInStep.yield (circuits, placed))
+          | some g =>
+            if placed[g]! = true then pure (ForInStep.yield (circuits, placed))
+            else
+              have placed := placed.set! g true;
+              match resolved[g]! with
+              | (gname, ms) =>
+                have layout :=
+                  Array.foldl (fun acc m => if (m == ms[0]!) = true then acc else acc.merge t.functions[m]!.layout)
+                    t.functions[ms[0]!]!.layout ms;
+                have circuits := circuits.push { name := gname, members := ms, layout := layout };
+                pure (ForInStep.yield (circuits, placed))
+        else do
+          throw "groupFunctions: partition already grouped; group from a freshly compiled toplevel"
+          pure (ForInStep.yield (circuits, placed))
+  have circuits : Array Aiur.Bytecode.Circuit := __s.fst
+  pure
+      { source := ct.source,
+        bytecode := { functions := t.functions, memorySizes := t.memorySizes, circuits := circuits },
+        nameMap := ct.nameMap }
+PREMISE Aiur.AIR.callRankBound
+Nat
+DEFINITION
+2 ^ 48
+PREMISE Aiur.AIR.packRank
+(Fin 6 → Aiur.G) → Aiur.G
+DEFINITION
+fun bytes =>
+  bytes 0 + 256 * bytes 1 + 65536 * bytes 2 + 16777216 * bytes 3 + 4294967296 * bytes 4 + 1099511627776 * bytes 5
+PREMISE Aiur.AIR.callOrderConstraint
+Aiur.G → Aiur.G → Aiur.G → Aiur.G
+DEFINITION
+fun parent child gap => child - parent - 1 - gap
+PREMISE Aiur.Concrete.Bytecode.LayoutMState.new
+Nat → Aiur.Concrete.Bytecode.LayoutMState
+DEFINITION
+fun inputSize =>
+  { functionLayout := { inputSize := inputSize, selectors := 0, auxiliaries := 7, lookups := 3 },
+    memSizes := Std.TreeSet.empty, degrees := Array.replicate inputSize 1 }
+PREMISE Aiur.Concrete.Bytecode.opLayout
+Aiur.Bytecode.Op → Aiur.Concrete.Bytecode.LayoutM Unit
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Op.const a => Aiur.Concrete.Bytecode.pushDegree 0
+  | Aiur.Bytecode.Op.add a b => do
+    let aDegree ← Aiur.Concrete.Bytecode.getDegree a
+    let bDegree ← Aiur.Concrete.Bytecode.getDegree b
+    Aiur.Concrete.Bytecode.pushDegree (aDegree.max bDegree)
+  | Aiur.Bytecode.Op.sub a b => do
+    let aDegree ← Aiur.Concrete.Bytecode.getDegree a
+    let bDegree ← Aiur.Concrete.Bytecode.getDegree b
+    Aiur.Concrete.Bytecode.pushDegree (aDegree.max bDegree)
+  | Aiur.Bytecode.Op.mul a b => do
+    let aDegree ← Aiur.Concrete.Bytecode.getDegree a
+    let bDegree ← Aiur.Concrete.Bytecode.getDegree b
+    have degree : Nat := aDegree + bDegree
+    if degree < 2 then Aiur.Concrete.Bytecode.pushDegree degree
+      else do
+        Aiur.Concrete.Bytecode.pushDegree 1
+        Aiur.Concrete.Bytecode.bumpAuxiliaries
+  | Aiur.Bytecode.Op.eqZero a => do
+    let degree ← Aiur.Concrete.Bytecode.getDegree a
+    if degree = 0 then Aiur.Concrete.Bytecode.pushDegree 0
+      else do
+        Aiur.Concrete.Bytecode.pushDegree 1
+        Aiur.Concrete.Bytecode.bumpAuxiliaries 2
+  | Aiur.Bytecode.Op.call a a_1 outputSize unconstrained => do
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate outputSize 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries outputSize
+    if (!unconstrained) = true then do
+        Aiur.Concrete.Bytecode.bumpAuxiliaries 7
+        Aiur.Concrete.Bytecode.bumpLookups 4
+      else pure ()
+  | Aiur.Bytecode.Op.store values => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+    Aiur.Concrete.Bytecode.addMemSize values.size
+  | Aiur.Bytecode.Op.load size a => do
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate size 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries size
+    Aiur.Concrete.Bytecode.bumpLookups
+    Aiur.Concrete.Bytecode.addMemSize size
+  | Aiur.Bytecode.Op.assertEq a a_1 a_2 => pure ()
+  | Aiur.Bytecode.Op.ioGetInfo a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegrees #[1, 1]
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 2
+  | Aiur.Bytecode.Op.ioSetInfo a a_1 a_2 a_3 => pure ()
+  | Aiur.Bytecode.Op.ioRead a a_1 len => do
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate len 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries len
+  | Aiur.Bytecode.Op.ioWrite a a_1 => pure ()
+  | Aiur.Bytecode.Op.u8BitDecomposition a => do
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate 8 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 8
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8ShiftLeft a => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8ShiftRight a => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8Xor a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8And a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8Or a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8Add a b => do
+    let aDegree ← Aiur.Concrete.Bytecode.getDegree a
+    let bDegree ← Aiur.Concrete.Bytecode.getDegree b
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.pushDegree ((aDegree.max bDegree).max 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8Sub a b => do
+    let aDegree ← Aiur.Concrete.Bytecode.getDegree a
+    let bDegree ← Aiur.Concrete.Bytecode.getDegree b
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.pushDegree ((aDegree.max bDegree).max 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8Mul a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegrees #[1, 1]
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 2
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8XorSplit7 a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegrees #[1, 1]
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 2
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8XorSplit4 a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegrees #[1, 1]
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 2
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u8LessThan a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+    Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.u32LessThan a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 12
+    Aiur.Concrete.Bytecode.bumpLookups 6
+  | Aiur.Bytecode.Op.unconstrainedU32Add a b => do
+    let degrees ← Array.mapM Aiur.Concrete.Bytecode.getDegree (a ++ b)
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate 4 1)
+    Aiur.Concrete.Bytecode.pushDegree (Array.foldl Nat.max 1 degrees)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 4
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a b c => do
+    let degrees ← Array.mapM Aiur.Concrete.Bytecode.getDegree (a ++ b ++ c)
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate 4 1)
+    Aiur.Concrete.Bytecode.pushDegree (Array.foldl Nat.max 1 degrees)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 4
+  | Aiur.Bytecode.Op.u32ToField a => do
+    let degrees ← Array.mapM Aiur.Concrete.Bytecode.getDegree a
+    Aiur.Concrete.Bytecode.pushDegree (Array.foldl Nat.max 0 degrees)
+  | Aiur.Bytecode.Op.u8RangeCheck a a_1 => Aiur.Concrete.Bytecode.bumpLookups
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a a_1 => do
+    Aiur.Concrete.Bytecode.pushDegrees #[1, 1]
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 2
+  | Aiur.Bytecode.Op.unconstrainedGToBytes a => do
+    Aiur.Concrete.Bytecode.pushDegrees (Array.replicate 8 1)
+    Aiur.Concrete.Bytecode.bumpAuxiliaries 8
+  | Aiur.Bytecode.Op.unconstrainedGInverse a => do
+    Aiur.Concrete.Bytecode.pushDegree 1
+    Aiur.Concrete.Bytecode.bumpAuxiliaries
+  | Aiur.Bytecode.Op.debug a a_1 => pure ()
+PREMISE Aiur.AIR.suppliedWeight
+{α : Type u_1} → [DecidableEq α] → α → List (Aiur.AIR.Provider α) → Aiur.G
+DEFINITION
+fun {α} [DecidableEq α] message providers =>
+  List.foldr (fun provider rest => if provider.fst = message then provider.snd + rest else rest) 0 providers
+PREMISE Aiur.AIR.ExactLookupBalance
+{α : Type u_1} → [DecidableEq α] → List α → List (Aiur.AIR.Provider α) → Prop
+DEFINITION
+fun {α} [DecidableEq α] queries providers =>
+  ∀ (message : α), Aiur.G.ofNat (List.count message queries) = Aiur.AIR.suppliedWeight message providers
+PREMISE Aiur.AIR.byteRangeMessage
+Fin 65536 → Aiur.G × Aiur.G
+DEFINITION
+fun row => (Aiur.G.ofNat (↑row / 256), Aiur.G.ofNat (↑row % 256))
+PREMISE Aiur.AIR.byteRangeProviders
+(Fin 65536 → Aiur.G) → List (Aiur.AIR.Provider (Aiur.G × Aiur.G))
+DEFINITION
+fun weights => List.ofFn fun row => (Aiur.AIR.byteRangeMessage row, weights row)
+PREMISE Aiur.AIR.rankByteQueries
+(Fin 6 → Aiur.G) → List (Aiur.G × Aiur.G)
+DEFINITION
+fun bytes => [(bytes 0, bytes 1), (bytes 2, bytes 3), (bytes 4, bytes 5)]
+PREMISE Aiur.Bytecode.instBEqCtrl
+BEq Aiur.Bytecode.Ctrl
+DEFINITION
+{ beq := Aiur.Bytecode.Ctrl.beq }
+PREMISE Aiur.Bytecode.instBEqBlock
+BEq Aiur.Bytecode.Block
+DEFINITION
+{ beq := Aiur.Bytecode.Block.beq }
+PREMISE Aiur.Bytecode.instHashableCtrl
+Hashable Aiur.Bytecode.Ctrl
+DEFINITION
+{ hash := Aiur.Bytecode.Ctrl.hash }
+PREMISE Aiur.Bytecode.instHashableBlock
+Hashable Aiur.Bytecode.Block
+DEFINITION
+{ hash := Aiur.Bytecode.Block.hash }
+PREMISE Aiur.Bytecode.Eval.RenamedCode.mk
+∀ {a b : Aiur.Bytecode.Toplevel} {rename : Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx},
+  (∀ (i : Nat), i < a.functions.size ↔ rename i < b.functions.size) →
+    (∀ (i : Nat) (ha : i < a.functions.size) (hb : rename i < b.functions.size),
+        Aiur.Bytecode.rewriteBlock rename a.functions[i].body = b.functions[rename i].body) →
+      (∀ (i : Nat) (ha : i < a.functions.size) (hb : rename i < b.functions.size),
+          a.functions[i].layout.inputSize = b.functions[rename i].layout.inputSize) →
+        Aiur.Bytecode.Eval.RenamedCode a b rename
+PREMISE Aiur.Bytecode.boundedRenaming
+Aiur.Bytecode.Toplevel → (Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) → Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx
+DEFINITION
+fun source rename i => if i < source.functions.size then rename i else i
+PREMISE Aiur.Bytecode.validatesRenaming
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Toplevel → (Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) → Bool
+DEFINITION
+fun source target rename =>
+  decide (target.functions.size ≤ source.functions.size) &&
+    (Array.range source.functions.size).all fun i =>
+      if hi : i < source.functions.size then
+        if hj : rename i < target.functions.size then
+          source.functions[i].layout == target.functions[rename i].layout &&
+            Aiur.Bytecode.rewriteBlock rename source.functions[i].body == target.functions[rename i].body
+        else false
+      else false
+PREMISE Aiur.Bytecode.checkedRenaming
+Aiur.Bytecode.Toplevel →
+  Aiur.Bytecode.Toplevel →
+    (Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) →
+      Aiur.Bytecode.Toplevel × (Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx)
+DEFINITION
+fun source candidate rename =>
+  have bounded := Aiur.Bytecode.boundedRenaming source rename;
+  if Aiur.Bytecode.validatesRenaming source candidate bounded = true then (candidate, bounded) else (source, id)
+PREMISE Aiur.Bytecode.Toplevel.deduplicate
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Toplevel × (Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx)
+DEFINITION
+fun source =>
+  have candidate := source.deduplicateCandidate;
+  Aiur.Bytecode.checkedRenaming source candidate.fst candidate.snd
+PREMISE Aiur.Bytecode.Toplevel.deduplicateCandidate
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Toplevel × (Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx)
+DEFINITION
+fun t =>
+  have functions := t.functions;
+  have n := functions.size;
+  if (n == 0) = true then (t, id)
+  else
+    have skeletons := Array.map (fun f => (Aiur.Bytecode.skeletonBlock f.body, f.layout)) functions;
+    match Aiur.Bytecode.assignClasses skeletons with
+    | (initClasses, snd) =>
+      have callees := Array.map (fun f => Aiur.Bytecode.collectCalleesBlock f.body) functions;
+      have classes := Aiur.Bytecode.partitionRefine initClasses callees;
+      match Aiur.Bytecode.deduplicate_canonical classes with
+      | (canonical, _top_cls) =>
+        have remapFn := Aiur.Bytecode.deduplicate_remap classes;
+        have newFunctions := Aiur.Bytecode.deduplicate_newFunctions functions classes canonical remapFn;
+        ({ functions := newFunctions, memorySizes := t.memorySizes, circuits := t.circuits }, remapFn)
+PREMISE Aiur.Source.Term.restoreTailMatches
+Aiur.Source.Term → Aiur.Source.Term
+DEFINITION
+WellFounded.Nat.fix (fun x => sizeOf x) fun a a_1 =>
+  (match (motive :=
+      (x : Aiur.Source.Term) →
+        ((y : Aiur.Source.Term) → InvImage (fun x1 x2 => x1 < x2) (fun x => sizeOf x) y x → Aiur.Source.Term) →
+          Aiur.Source.Term)
+      a with
+    | Aiur.Source.Term.let (Aiur.Pattern.var x) v (Aiur.Source.Term.var y) => fun x_1 =>
+      if h : (x == y) = true then x_1 v ⋯ else Aiur.Source.Term.let (Aiur.Pattern.var x) v (Aiur.Source.Term.var y)
+    | Aiur.Source.Term.let p v b => fun x => Aiur.Source.Term.let p v (x b ⋯)
+    | s.match arms => fun x => s.match (List.map (fun arm => (arm.val.fst, x arm.val.snd ⋯)) arms.attach)
+    | t => fun x => t)
+    a_1
+PREMISE Aiur.instHashableValue
+Hashable Aiur.Value
+DEFINITION
+{ hash := Aiur.Value.hash }
+PREMISE Aiur.Source.Term.hoistLets
+Aiur.Source.Term → Aiur.Source.Term
+DEFINITION
+fun term =>
+  have stem := String.ofList (List.replicate (term.maxNameLength + 1) '#');
+  match Aiur.Source.Term.freshenWith stem 0 ∅ term with
+  | (next, renamed) => StateT.run' (Aiur.Source.Term.hoistLetsAux stem renamed) next
+PREMISE Aiur.Source.Term.bindArguments
+String → List Aiur.Source.Term → StateM Nat (List (Aiur.Pattern × Aiur.Source.Term) × List Aiur.Source.Term)
+DEFINITION
+fun stem x => List.brecOn x (Aiur.Source.Term.bindArguments._f stem)
+PREMISE Aiur.Source.Toplevel.inlineCalls
+Aiur.Source.Toplevel → Except String Aiur.Source.Toplevel
+DEFINITION
+fun t =>
+  have funcs := Array.foldl (fun m f => m.insert f.name f) ∅ t.functions;
+  do
+  let deps ←
+    Array.foldlM
+        (fun deps f => do
+          let gs ←
+            List.foldlM
+                (fun acc x =>
+                  match x with
+                  | (g, n) =>
+                    match funcs[g]? with
+                    | some callee =>
+                      have __do_jp := fun __r => pure (acc ++ [g]);
+                      if (n != callee.inputs.length) = true then do
+                        let __r ←
+                          throw
+                              (toString "inline `" ++ toString g.toName ++ toString "`: got " ++ toString n ++
+                                  toString " args, expects " ++
+                                toString callee.inputs.length)
+                        __do_jp __r
+                      else __do_jp ()
+                    | x => throw (toString "inline call to unknown function `" ++ toString g.toName ++ toString "`"))
+                [] f.body.inlineCallSites
+          pure (deps.insert f.name gs))
+        ∅ t.functions
+  have names : List Aiur.Global := List.map Aiur.Source.Function.name t.functions.toList
+  let order ← Aiur.Source.inlineTopo deps names.length names ∅ []
+  have done : Std.HashMap Aiur.Global (List Aiur.Local × Aiur.Source.Term) :=
+    List.foldl
+      (fun done g =>
+        match funcs[g]? with
+        | none => done
+        | some f => done.insert g (List.map Prod.fst f.inputs, (Aiur.Source.Term.expandOnce done 0 f.body).snd))
+      ∅ order
+  have functions : Array Aiur.Source.Function :=
+    Array.map
+      (fun f =>
+        match done[f.name]? with
+        | none => f
+        | some (fst, body) =>
+          { name := f.name, params := f.params, inputs := f.inputs, output := f.output,
+            body := body.restoreTailMatches.hoistLets, entry := f.entry, entryMonomorphic := ⋯, entryPointerFree := ⋯ })
+      t.functions
+  pure { dataTypes := t.dataTypes, typeAliases := t.typeAliases, functions := functions }
+PREMISE Aiur.Bytecode.AIR.Memory
+Type
+DEFINITION
+Nat → Aiur.G → Array Aiur.G → Prop
+PREMISE Aiur.Bytecode.AIR.Call.mk
+Aiur.Bytecode.FunIdx → Array Aiur.G → Array Aiur.G → Aiur.G → Aiur.Bytecode.AIR.Call
+PREMISE Aiur.Bytecode.AIR.primitive
+Aiur.Bytecode.Op → Array Aiur.G → Array Aiur.G → Option (Array Aiur.G)
+DEFINITION
+fun op values advice =>
+  match op with
+  | Aiur.Bytecode.Op.const value => some #[value]
+  | Aiur.Bytecode.Op.add a b => do
+    let __do_lift ← values[a]?
+    let __do_lift_1 ← values[b]?
+    pure #[__do_lift + __do_lift_1]
+  | Aiur.Bytecode.Op.sub a b => do
+    let __do_lift ← values[a]?
+    let __do_lift_1 ← values[b]?
+    pure #[__do_lift - __do_lift_1]
+  | Aiur.Bytecode.Op.mul a b => do
+    let __do_lift ← values[a]?
+    let __do_lift_1 ← values[b]?
+    pure #[__do_lift * __do_lift_1]
+  | Aiur.Bytecode.Op.eqZero a => do
+    let __do_lift ← values[a]?
+    pure #[__do_lift.eqZero]
+  | Aiur.Bytecode.Op.call a a_1 outputSize true => Aiur.Bytecode.AIR.adviceOfSize outputSize advice
+  | Aiur.Bytecode.Op.call a a_1 outputSize false => none
+  | Aiur.Bytecode.Op.store a => none
+  | Aiur.Bytecode.Op.load size a => none
+  | Aiur.Bytecode.Op.assertEq xs ys a => do
+    let left ← Aiur.Bytecode.AIR.readValues values xs
+    let right ← Aiur.Bytecode.AIR.readValues values ys
+    if left = right then some #[] else none
+  | Aiur.Bytecode.Op.ioGetInfo a a_1 => Aiur.Bytecode.AIR.adviceOfSize 2 advice
+  | Aiur.Bytecode.Op.ioRead a a_1 size => Aiur.Bytecode.AIR.adviceOfSize size advice
+  | Aiur.Bytecode.Op.ioSetInfo a a_1 a_2 a_3 => some #[]
+  | Aiur.Bytecode.Op.ioWrite a a_1 => some #[]
+  | Aiur.Bytecode.Op.debug a a_1 => some #[]
+  | Aiur.Bytecode.Op.u8BitDecomposition a =>
+    Aiur.Bytecode.AIR.unaryByte values a (Array.ofFn ∘ Aiur.G.u8BitDecomposition)
+  | Aiur.Bytecode.Op.u8ShiftLeft a => Aiur.Bytecode.AIR.unaryByte values a fun x => #[x.u8ShiftLeft]
+  | Aiur.Bytecode.Op.u8ShiftRight a => Aiur.Bytecode.AIR.unaryByte values a fun x => #[x.u8ShiftRight]
+  | Aiur.Bytecode.Op.u8Xor a b => Aiur.Bytecode.AIR.binaryByte values a b fun x y => #[x.u8Xor y]
+  | Aiur.Bytecode.Op.u8Add a b =>
+    Aiur.Bytecode.AIR.binaryByte values a b fun x y => Aiur.Bytecode.AIR.pairValues (x.u8Add y)
+  | Aiur.Bytecode.Op.u8Mul a b =>
+    Aiur.Bytecode.AIR.binaryByte values a b fun x y => Aiur.Bytecode.AIR.pairValues (x.u8Mul y)
+  | Aiur.Bytecode.Op.u8Sub a b =>
+    Aiur.Bytecode.AIR.binaryByte values a b fun x y => Aiur.Bytecode.AIR.pairValues (x.u8Sub y)
+  | Aiur.Bytecode.Op.u8And a b => Aiur.Bytecode.AIR.binaryByte values a b fun x y => #[x.u8And y]
+  | Aiur.Bytecode.Op.u8Or a b => Aiur.Bytecode.AIR.binaryByte values a b fun x y => #[x.u8Or y]
+  | Aiur.Bytecode.Op.u8LessThan a b => Aiur.Bytecode.AIR.binaryByte values a b fun x y => #[x.u8LessThan y]
+  | Aiur.Bytecode.Op.u8XorSplit7 a b =>
+    Aiur.Bytecode.AIR.binaryByte values a b fun x y =>
+      have z := x.n ^^^ y.n;
+      #[Aiur.G.ofNat (z / 128), Aiur.G.ofNat (z * 2 % 256)]
+  | Aiur.Bytecode.Op.u8XorSplit4 a b =>
+    Aiur.Bytecode.AIR.binaryByte values a b fun x y =>
+      have z := x.n ^^^ y.n;
+      #[Aiur.G.ofNat (z / 16), Aiur.G.ofNat (z * 16 % 256)]
+  | Aiur.Bytecode.Op.u8RangeCheck a b => Aiur.Bytecode.AIR.binaryByte values a b fun x x_1 => #[]
+  | Aiur.Bytecode.Op.u32LessThan a b => do
+    let x ← values[a]?
+    let y ← values[b]?
+    if x.n < 2 ^ 32 ∧ y.n < 2 ^ 32 then some #[x.u32LessThan y] else none
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a a_1 => Aiur.Bytecode.AIR.adviceOfSize 2 advice
+  | Aiur.Bytecode.Op.unconstrainedGToBytes a => Aiur.Bytecode.AIR.adviceOfSize 8 advice
+  | Aiur.Bytecode.Op.unconstrainedGInverse a => Aiur.Bytecode.AIR.adviceOfSize 1 advice
+  | Aiur.Bytecode.Op.unconstrainedU32Add a b => do
+    let x ← Aiur.Bytecode.AIR.readWord values a
+    let y ← Aiur.Bytecode.AIR.readWord values b
+    let bytes ← Aiur.Bytecode.AIR.adviceOfSize 4 advice
+    pure (bytes.push ((x + y - Aiur.Bytecode.AIR.packWord bytes) * 18446744065119617026))
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a b c => do
+    let x ← Aiur.Bytecode.AIR.readWord values a
+    let y ← Aiur.Bytecode.AIR.readWord values b
+    let z ← Aiur.Bytecode.AIR.readWord values c
+    let bytes ← Aiur.Bytecode.AIR.adviceOfSize 4 advice
+    pure (bytes.push ((x + y + z - Aiur.Bytecode.AIR.packWord bytes) * 18446744065119617026))
+  | Aiur.Bytecode.Op.u32ToField bytes => do
+    let __do_lift ← Aiur.Bytecode.AIR.readWord values bytes
+    pure #[__do_lift]
+PREMISE Aiur.Bytecode.AIR.readValues
+Array Aiur.G → Array Aiur.Bytecode.ValIdx → Option (Array Aiur.G)
+DEFINITION
+fun values indices => Array.mapM (fun index => values[index]?) indices
+PREMISE Aiur.Bytecode.AIR.packWord
+Array Aiur.G → Aiur.G
+DEFINITION
+fun bytes =>
+  List.foldl
+    (fun value x =>
+      match x with
+      | (byte, index) => value + byte * Aiur.G.ofNat (256 ^ index))
+    0 bytes.toList.zipIdx
+PREMISE Aiur.Bytecode.AIR.adviceOfSize
+Nat → Array Aiur.G → Option (Array Aiur.G)
+DEFINITION
+fun size advice => if advice.size = size then some advice else none
+PREMISE Aiur.Bytecode.AIR.unaryByte
+Array Aiur.G → Aiur.Bytecode.ValIdx → (Aiur.G → Array Aiur.G) → Option (Array Aiur.G)
+DEFINITION
+fun values index compute => do
+  let value ← values[index]?
+  if value.n < 256 then some (compute value) else none
+PREMISE Aiur.Bytecode.AIR.binaryByte
+Array Aiur.G → Aiur.Bytecode.ValIdx → Aiur.Bytecode.ValIdx → (Aiur.G → Aiur.G → Array Aiur.G) → Option (Array Aiur.G)
+DEFINITION
+fun values left right compute => do
+  let x ← values[left]?
+  let y ← values[right]?
+  if x.n < 256 ∧ y.n < 256 then some (compute x y) else none
+PREMISE Aiur.Bytecode.AIR.pairValues
+Aiur.G × Aiur.G → Array Aiur.G
+DEFINITION
+fun pair => #[pair.fst, pair.snd]
+PREMISE Aiur.Bytecode.AIR.readWord
+Array Aiur.G → Array Aiur.Bytecode.ValIdx → Option Aiur.G
+DEFINITION
+fun values indices =>
+  if indices.size ≠ 4 then none
+  else do
+    let bytes ← Aiur.Bytecode.AIR.readValues values indices
+    some (Aiur.Bytecode.AIR.packWord bytes)
+PREMISE Aiur.Bytecode.AIR.Step.primitive
+∀ {memory : Aiur.Bytecode.AIR.Memory} {op : Aiur.Bytecode.Op} {values advice outputs : Array Aiur.G},
+  Aiur.Bytecode.AIR.primitive op values advice = some outputs →
+    Aiur.Bytecode.AIR.Step memory op values (values ++ outputs) []
+PREMISE Aiur.Bytecode.AIR.Step.call
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {indices : Array Aiur.Bytecode.ValIdx} {size : Nat}
+  {request : Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.readValues values indices = some request.inputs →
+    request.outputs.size = size →
+      Aiur.Bytecode.AIR.Step memory (Aiur.Bytecode.Op.call request.function indices size false) values
+        (values ++ request.outputs) [request]
+PREMISE Aiur.Bytecode.AIR.Step.store
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {indices : Array Aiur.Bytecode.ValIdx}
+  {contents : Array Aiur.G} {pointer : Aiur.G},
+  Aiur.Bytecode.AIR.readValues values indices = some contents →
+    memory contents.size pointer contents →
+      Aiur.Bytecode.AIR.Step memory (Aiur.Bytecode.Op.store indices) values (values.push pointer) []
+PREMISE Aiur.Bytecode.AIR.Step.load
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {index : Aiur.Bytecode.ValIdx} {pointer : Aiur.G}
+  {size : Nat} {contents : Array Aiur.G},
+  values[index]? = some pointer →
+    contents.size = size →
+      memory size pointer contents →
+        Aiur.Bytecode.AIR.Step memory (Aiur.Bytecode.Op.load size index) values (values ++ contents) []
+PREMISE Aiur.Bytecode.AIR.RunOps.nil
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G}, Aiur.Bytecode.AIR.RunOps memory [] values values []
+PREMISE Aiur.Bytecode.AIR.RunOps.cons
+∀ {memory : Aiur.Bytecode.AIR.Memory} {op : Aiur.Bytecode.Op} {values intermediate : Array Aiur.G}
+  {firstCalls : List Aiur.Bytecode.AIR.Call} {ops : List Aiur.Bytecode.Op} {finalValues : Array Aiur.G}
+  {restCalls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.Step memory op values intermediate firstCalls →
+    Aiur.Bytecode.AIR.RunOps memory ops intermediate finalValues restCalls →
+      Aiur.Bytecode.AIR.RunOps memory (op :: ops) values finalValues (firstCalls ++ restCalls)
+PREMISE Aiur.Bytecode.AIR.SelectArm.case
+∀ {scrutinee : Aiur.G} {cases : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block}
+  {block : Aiur.Bytecode.Block},
+  (scrutinee, block) ∈ cases.toList → Aiur.Bytecode.AIR.SelectArm scrutinee cases fallback block
+PREMISE Aiur.Bytecode.AIR.SelectArm.fallback
+∀ {scrutinee : Aiur.G} {cases : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block}
+  {block : Aiur.Bytecode.Block},
+  fallback = some block →
+    (∀ (pair : Aiur.G × Aiur.Bytecode.Block), pair ∈ cases.toList → pair.fst ≠ scrutinee) →
+      Aiur.Bytecode.AIR.SelectArm scrutinee cases fallback block
+PREMISE Aiur.Bytecode.AIR.RunBlock.block
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values intermediate : Array Aiur.G} {opCalls : List Aiur.Bytecode.AIR.Call}
+  {outcome : Aiur.Bytecode.AIR.Outcome} {ctrlCalls : List Aiur.Bytecode.AIR.Call} {block : Aiur.Bytecode.Block},
+  Aiur.Bytecode.AIR.RunOps memory block.ops.toList values intermediate opCalls →
+    Aiur.Bytecode.AIR.RunCtrl memory block.ctrl intermediate outcome ctrlCalls →
+      Aiur.Bytecode.AIR.RunBlock memory block values outcome (opCalls ++ ctrlCalls)
+PREMISE Aiur.Bytecode.AIR.RunCtrl.returned
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {indices : Array Aiur.Bytecode.ValIdx}
+  {outputs : Array Aiur.G} {selector : Aiur.Bytecode.SelIdx},
+  Aiur.Bytecode.AIR.readValues values indices = some outputs →
+    Aiur.Bytecode.AIR.RunCtrl memory (Aiur.Bytecode.Ctrl.return selector indices) values
+      (Aiur.Bytecode.AIR.Outcome.returned outputs) []
+PREMISE Aiur.Bytecode.AIR.RunCtrl.yielded
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {indices : Array Aiur.Bytecode.ValIdx}
+  {outputs : Array Aiur.G} {selector : Aiur.Bytecode.SelIdx},
+  Aiur.Bytecode.AIR.readValues values indices = some outputs →
+    Aiur.Bytecode.AIR.RunCtrl memory (Aiur.Bytecode.Ctrl.yield selector indices) values
+      (Aiur.Bytecode.AIR.Outcome.yielded outputs) []
+PREMISE Aiur.Bytecode.AIR.RunCtrl.match
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {index : Aiur.Bytecode.ValIdx} {scrutinee : Aiur.G}
+  {cases : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block} {arm : Aiur.Bytecode.Block}
+  {outcome : Aiur.Bytecode.AIR.Outcome} {calls : List Aiur.Bytecode.AIR.Call},
+  values[index]? = some scrutinee →
+    Aiur.Bytecode.AIR.SelectArm scrutinee cases fallback arm →
+      Aiur.Bytecode.AIR.RunBlock memory arm values outcome calls →
+        Aiur.Bytecode.AIR.RunCtrl memory (Aiur.Bytecode.Ctrl.match index cases fallback) values outcome calls
+PREMISE Aiur.Bytecode.AIR.RunCtrl.matchContinueReturn
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {index : Aiur.Bytecode.ValIdx} {scrutinee : Aiur.G}
+  {cases : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block} {arm : Aiur.Bytecode.Block}
+  {outputs : Array Aiur.G} {calls : List Aiur.Bytecode.AIR.Call} {size aux lookups : Nat}
+  {continuation : Aiur.Bytecode.Block},
+  values[index]? = some scrutinee →
+    Aiur.Bytecode.AIR.SelectArm scrutinee cases fallback arm →
+      Aiur.Bytecode.AIR.RunBlock memory arm values (Aiur.Bytecode.AIR.Outcome.returned outputs) calls →
+        Aiur.Bytecode.AIR.RunCtrl memory
+          (Aiur.Bytecode.Ctrl.matchContinue index cases fallback size aux lookups continuation) values
+          (Aiur.Bytecode.AIR.Outcome.returned outputs) calls
+PREMISE Aiur.Bytecode.AIR.RunCtrl.matchContinueYield
+∀ {memory : Aiur.Bytecode.AIR.Memory} {values : Array Aiur.G} {index : Aiur.Bytecode.ValIdx} {scrutinee : Aiur.G}
+  {cases : Array (Aiur.G × Aiur.Bytecode.Block)} {fallback : Option Aiur.Bytecode.Block} {arm : Aiur.Bytecode.Block}
+  {yielded : Array Aiur.G} {branchCalls : List Aiur.Bytecode.AIR.Call} {size : Nat} {continuation : Aiur.Bytecode.Block}
+  {outcome : Aiur.Bytecode.AIR.Outcome} {contCalls : List Aiur.Bytecode.AIR.Call} {aux lookups : Nat},
+  values[index]? = some scrutinee →
+    Aiur.Bytecode.AIR.SelectArm scrutinee cases fallback arm →
+      Aiur.Bytecode.AIR.RunBlock memory arm values (Aiur.Bytecode.AIR.Outcome.yielded yielded) branchCalls →
+        yielded.size = size →
+          Aiur.Bytecode.AIR.RunBlock memory continuation (values ++ yielded) outcome contCalls →
+            Aiur.Bytecode.AIR.RunCtrl memory
+              (Aiur.Bytecode.Ctrl.matchContinue index cases fallback size aux lookups continuation) values outcome
+              (branchCalls ++ contCalls)
+PREMISE Aiur.Bytecode.AIR.RunFunction.function
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {function : Aiur.Bytecode.Function}
+  {calls : List Aiur.Bytecode.AIR.Call} {request : Aiur.Bytecode.AIR.Call},
+  program.functions[request.function]? = some function →
+    function.layout.inputSize = request.inputs.size →
+      Aiur.Bytecode.AIR.RunBlock memory function.body request.inputs
+          (Aiur.Bytecode.AIR.Outcome.returned request.outputs) calls →
+        Aiur.Bytecode.AIR.RunFunction program memory request calls
+PREMISE Aiur.Bytecode.AIR.Execution.function
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {request : Aiur.Bytecode.AIR.Call}
+  {calls : List Aiur.Bytecode.AIR.Call},
+  Aiur.Bytecode.AIR.RunFunction program memory request calls →
+    (∀ (child : Aiur.Bytecode.AIR.Call), child ∈ calls → Aiur.Bytecode.AIR.Execution program memory child) →
+      Aiur.Bytecode.AIR.Execution program memory request
+PREMISE Aiur.AIR.FunctionRow.mk
+Aiur.Bytecode.AIR.Call →
+  List (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)) → (Fin 6 → Aiur.G) → Aiur.G → Aiur.G → Aiur.AIR.FunctionRow
+PREMISE Aiur.AIR.FunctionRow.Valid.mk
+∀ {program : Aiur.Bytecode.Toplevel} {memory : Aiur.Bytecode.AIR.Memory} {row : Aiur.AIR.FunctionRow},
+  row.selector = 0 ∨ row.selector = 1 →
+    Aiur.AIR.activityConstraint row.multiplicity row.selector = 0 →
+      (row.selector = 1 → row.request.rank = Aiur.AIR.packRank row.rankBytes) →
+        (row.selector = 1 → Aiur.Bytecode.AIR.RunFunction program memory row.request row.requests) →
+          (∀ (edge : Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)),
+              edge ∈ row.calls →
+                row.selector *
+                    Aiur.AIR.callOrderConstraint row.request.rank edge.fst.rank (Aiur.AIR.packRank edge.snd) =
+                  0) →
+            Aiur.AIR.FunctionRow.Valid program memory row
+PREMISE Aiur.AIR.FunctionRow.requests
+Aiur.AIR.FunctionRow → List Aiur.Bytecode.AIR.Call
+DEFINITION
+fun row => List.map Prod.fst row.calls
+PREMISE Aiur.AIR.FunctionRow.byteQueries
+Aiur.AIR.FunctionRow → List (Aiur.G × Aiur.G)
+DEFINITION
+fun row =>
+  Aiur.AIR.rankByteQueries row.rankBytes ++ List.flatMap (fun edge => Aiur.AIR.rankByteQueries edge.snd) row.calls
+PREMISE Aiur.AIR.functionProviders
+List Aiur.AIR.FunctionRow → List (Aiur.AIR.Provider Aiur.Bytecode.AIR.Call)
+DEFINITION
+fun rows => List.map (fun row => (row.request, row.multiplicity)) rows
+PREMISE Aiur.AIR.functionQueries
+List Aiur.Bytecode.AIR.Call → List Aiur.AIR.FunctionRow → List Aiur.Bytecode.AIR.Call
+DEFINITION
+fun roots rows => roots ++ List.flatMap (fun row => if row.selector = 1 then row.requests else []) rows
+PREMISE Aiur.AIR.functionByteQueries
+List Aiur.AIR.FunctionRow → List (Aiur.G × Aiur.G)
+DEFINITION
+fun rows => List.flatMap (fun row => if row.selector = 1 then row.byteQueries else []) rows
+PREMISE Aiur.AIR.MemoryRow.mk
+Aiur.G → Aiur.G → Aiur.G → Array Aiur.G → Aiur.AIR.MemoryRow
+PREMISE Aiur.AIR.memoryActivityTransition
+Aiur.AIR.MemoryRow → Aiur.AIR.MemoryRow → Aiur.G
+DEFINITION
+fun row next => next.selector * (row.selector - 1)
+PREMISE Aiur.AIR.memoryPointerTransition
+Aiur.AIR.MemoryRow → Aiur.AIR.MemoryRow → Aiur.G
+DEFINITION
+fun row next => next.selector * (row.pointer + 1 - next.pointer)
+PREMISE Aiur.AIR.MemoryRowsValid.mk
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  (∀ (i : Nat) (hi : i < rows.size), rows[i].selector = 0 ∨ rows[i].selector = 1) →
+    (∀ (i : Nat) (hi : i < rows.size), Aiur.AIR.activityConstraint rows[i].multiplicity rows[i].selector = 0) →
+      (∀ (i : Nat) (hi : i < rows.size), rows[i].contents.size = width) →
+        (∀ (i : Nat) (hi : i + 1 < rows.size), Aiur.AIR.memoryActivityTransition rows[i] rows[i + 1] = 0) →
+          (∀ (i : Nat) (hi : i + 1 < rows.size), Aiur.AIR.memoryPointerTransition rows[i] rows[i + 1] = 0) →
+            Aiur.AIR.MemoryRowsValid width rows
+PREMISE Aiur.AIR.memoryFacts
+(Nat → Array Aiur.AIR.MemoryRow) → Aiur.Bytecode.AIR.Memory
+DEFINITION
+fun tables width pointer contents =>
+  ∃ i hi, (tables width)[i].selector = 1 ∧ (tables width)[i].pointer = pointer ∧ (tables width)[i].contents = contents
+PREMISE Aiur.AIR.memoryProviders
+Array Aiur.AIR.MemoryRow → List (Aiur.AIR.Provider (Aiur.G × Array Aiur.G))
+DEFINITION
+fun rows => List.ofFn fun i => ((rows[i].pointer, rows[i].contents), rows[i].multiplicity)
+PREMISE Aiur.AIR.memoryPointerCycle
+Nat → Array Aiur.AIR.MemoryRow
+DEFINITION
+fun period =>
+  Array.ofFn fun i =>
+    { selector := 1, multiplicity := 0, pointer := Aiur.G.ofNat ↑i, contents := #[Aiur.G.ofNat (↑i / period)] }
+PREMISE Aiur.GoldilocksProof.squareMod
+Nat → Nat → Nat → Nat
+DEFINITION
+fun modulus base x => Nat.brecOn x (Aiur.GoldilocksProof.squareMod._f modulus base)
+PREMISE Aiur.AIR.booleanConstraint
+Aiur.G → Aiur.G
+DEFINITION
+fun value => value * (value - 1)
+PREMISE Aiur.AIR.oneSubBooleanConstraint
+Aiur.G → Aiur.G
+DEFINITION
+fun value => value * (1 - value)
+PREMISE Aiur.AIR.selectorSum
+List Aiur.G → Aiur.G
+DEFINITION
+fun selectors => List.foldl (fun x1 x2 => x1 + x2) 0 selectors
+PREMISE Aiur.AIR.MemoryRowsPolynomials.mk
+∀ {width : Nat} {rows : Array Aiur.AIR.MemoryRow},
+  (∀ (i : Nat) (hi : i < rows.size), Aiur.AIR.booleanConstraint rows[i].selector = 0) →
+    (∀ (i : Nat) (hi : i < rows.size), Aiur.AIR.activityConstraint rows[i].multiplicity rows[i].selector = 0) →
+      (∀ (i : Nat) (hi : i < rows.size), rows[i].contents.size = width) →
+        (∀ (i : Nat) (hi : i + 1 < rows.size), Aiur.AIR.memoryActivityTransition rows[i] rows[i + 1] = 0) →
+          (∀ (i : Nat) (hi : i + 1 < rows.size), Aiur.AIR.memoryPointerTransition rows[i] rows[i + 1] = 0) →
+            Aiur.AIR.MemoryRowsPolynomials width rows
+PREMISE Aiur.AIR.inverse256
+Aiur.G
+DEFINITION
+18374686475393433601
+PREMISE Aiur.AIR.pack4
+(Fin 4 → Aiur.G) → Aiur.G
+DEFINITION
+fun bytes => bytes 0 + 256 * bytes 1 + 65536 * bytes 2 + 16777216 * bytes 3
+PREMISE Aiur.AIR.pack4Nat
+(Fin 4 → Aiur.G) → Nat
+DEFINITION
+fun bytes => (bytes 0).n + 256 * (bytes 1).n + 65536 * (bytes 2).n + 16777216 * (bytes 3).n
+PREMISE Aiur.AIR.carryStep
+Aiur.G → Aiur.G → Aiur.G → Aiur.G → Aiur.G
+DEFINITION
+fun x y z previous => (x + y + previous - z) * Aiur.AIR.inverse256
+PREMISE Aiur.AIR.u32Carries
+(Fin 4 → Aiur.G) → (Fin 4 → Aiur.G) → (Fin 4 → Aiur.G) → Fin 5 → Aiur.G
+DEFINITION
+fun x y z =>
+  have c1 := Aiur.AIR.carryStep (x 0) (y 0) (z 0) 1;
+  have c2 := Aiur.AIR.carryStep (x 1) (y 1) (z 1) c1;
+  have c3 := Aiur.AIR.carryStep (x 2) (y 2) (z 2) c2;
+  have c4 := Aiur.AIR.carryStep (x 3) (y 3) (z 3) c3;
+  fun i =>
+  match i with
+  | 0 => 1
+  | 1 => c1
+  | 2 => c2
+  | 3 => c3
+  | 4 => c4
+PREMISE Aiur.AIR.Byte1Kind.all
+List Aiur.AIR.Byte1Kind
+DEFINITION
+[Aiur.AIR.Byte1Kind.bits, Aiur.AIR.Byte1Kind.shiftLeft, Aiur.AIR.Byte1Kind.shiftRight]
+PREMISE Aiur.AIR.Byte1Kind.channel
+Aiur.AIR.Byte1Kind → Aiur.G
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.AIR.Byte1Kind.bits => 2
+  | Aiur.AIR.Byte1Kind.shiftLeft => 3
+  | Aiur.AIR.Byte1Kind.shiftRight => 4
+PREMISE Aiur.AIR.Byte1Kind.result
+Aiur.AIR.Byte1Kind → Aiur.G → Array Aiur.G
+DEFINITION
+fun x x_1 =>
+  match x, x_1 with
+  | Aiur.AIR.Byte1Kind.bits, input => Array.ofFn input.u8BitDecomposition
+  | Aiur.AIR.Byte1Kind.shiftLeft, input => #[input.u8ShiftLeft]
+  | Aiur.AIR.Byte1Kind.shiftRight, input => #[input.u8ShiftRight]
+PREMISE Aiur.AIR.byte1Outputs
+Aiur.AIR.Byte1Kind → Fin 256 → Array Aiur.G
+DEFINITION
+fun kind row =>
+  match kind with
+  | Aiur.AIR.Byte1Kind.bits => Array.ofFn fun bit => Aiur.G.ofNat (↑row >>> ↑bit &&& 1)
+  | Aiur.AIR.Byte1Kind.shiftLeft => #[Aiur.G.ofNat (↑row * 2 % 256)]
+  | Aiur.AIR.Byte1Kind.shiftRight => #[Aiur.G.ofNat (↑row / 2)]
+PREMISE Aiur.AIR.byte1Request
+Aiur.AIR.Byte1Kind → Aiur.G → Array Aiur.G → List Aiur.G
+DEFINITION
+fun kind input outputs => kind.channel :: input :: outputs.toList
+PREMISE Aiur.AIR.byte1Providers
+(Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G) → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun weights =>
+  List.flatMap
+    (fun kind =>
+      List.ofFn fun row =>
+        (Aiur.AIR.byte1Request kind (Aiur.G.ofNat ↑row) (Aiur.AIR.byte1Outputs kind row), weights kind row))
+    Aiur.AIR.Byte1Kind.all
+PREMISE Aiur.AIR.Byte1Kind.op
+Aiur.AIR.Byte1Kind → Aiur.Bytecode.ValIdx → Aiur.Bytecode.Op
+DEFINITION
+fun x =>
+  match (motive := Aiur.AIR.Byte1Kind → Aiur.Bytecode.ValIdx → Aiur.Bytecode.Op) x with
+  | Aiur.AIR.Byte1Kind.bits => Aiur.Bytecode.Op.u8BitDecomposition
+  | Aiur.AIR.Byte1Kind.shiftLeft => Aiur.Bytecode.Op.u8ShiftLeft
+  | Aiur.AIR.Byte1Kind.shiftRight => Aiur.Bytecode.Op.u8ShiftRight
+PREMISE Aiur.AIR.Byte2Kind.all
+List Aiur.AIR.Byte2Kind
+DEFINITION
+[Aiur.AIR.Byte2Kind.xor, Aiur.AIR.Byte2Kind.add, Aiur.AIR.Byte2Kind.sub, Aiur.AIR.Byte2Kind.and, Aiur.AIR.Byte2Kind.or,
+  Aiur.AIR.Byte2Kind.lessThan, Aiur.AIR.Byte2Kind.range, Aiur.AIR.Byte2Kind.mul, Aiur.AIR.Byte2Kind.split7,
+  Aiur.AIR.Byte2Kind.split4]
+PREMISE Aiur.AIR.Byte2Kind.channel
+Aiur.AIR.Byte2Kind → Aiur.G
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.AIR.Byte2Kind.xor => 5
+  | Aiur.AIR.Byte2Kind.add => 6
+  | Aiur.AIR.Byte2Kind.sub => 7
+  | Aiur.AIR.Byte2Kind.and => 8
+  | Aiur.AIR.Byte2Kind.or => 9
+  | Aiur.AIR.Byte2Kind.lessThan => 10
+  | Aiur.AIR.Byte2Kind.range => 11
+  | Aiur.AIR.Byte2Kind.mul => 12
+  | Aiur.AIR.Byte2Kind.split7 => 13
+  | Aiur.AIR.Byte2Kind.split4 => 14
+PREMISE Aiur.AIR.Byte2Kind.result
+Aiur.AIR.Byte2Kind → Aiur.G → Aiur.G → Array Aiur.G
+DEFINITION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Aiur.AIR.Byte2Kind.xor, x, y => #[x.u8Xor y]
+  | Aiur.AIR.Byte2Kind.add, x, y => #[(x.u8Add y).fst]
+  | Aiur.AIR.Byte2Kind.sub, x, y => #[(x.u8Sub y).fst]
+  | Aiur.AIR.Byte2Kind.and, x, y => #[x.u8And y]
+  | Aiur.AIR.Byte2Kind.or, x, y => #[x.u8Or y]
+  | Aiur.AIR.Byte2Kind.lessThan, x, y => #[x.u8LessThan y]
+  | Aiur.AIR.Byte2Kind.range, x, x_3 => #[]
+  | Aiur.AIR.Byte2Kind.mul, x, y => Aiur.Bytecode.AIR.pairValues (x.u8Mul y)
+  | Aiur.AIR.Byte2Kind.split7, x, y => #[Aiur.G.ofNat ((x.n ^^^ y.n) / 128), Aiur.G.ofNat ((x.n ^^^ y.n) * 2 % 256)]
+  | Aiur.AIR.Byte2Kind.split4, x, y => #[Aiur.G.ofNat ((x.n ^^^ y.n) / 16), Aiur.G.ofNat ((x.n ^^^ y.n) * 16 % 256)]
+PREMISE Aiur.AIR.byte2Outputs
+Aiur.AIR.Byte2Kind → Fin 65536 → Array Aiur.G
+DEFINITION
+fun kind row =>
+  have x := ↑row / 256;
+  have y := ↑row % 256;
+  match kind with
+  | Aiur.AIR.Byte2Kind.xor => #[Aiur.G.ofNat (x ^^^ y)]
+  | Aiur.AIR.Byte2Kind.add => #[Aiur.G.ofNat ((x + y) % 256)]
+  | Aiur.AIR.Byte2Kind.sub => #[Aiur.G.ofNat ((x + 256 - y) % 256)]
+  | Aiur.AIR.Byte2Kind.and => #[Aiur.G.ofNat (x &&& y)]
+  | Aiur.AIR.Byte2Kind.or => #[Aiur.G.ofNat (x ||| y)]
+  | Aiur.AIR.Byte2Kind.lessThan => #[if x < y then 1 else 0]
+  | Aiur.AIR.Byte2Kind.range => #[]
+  | Aiur.AIR.Byte2Kind.mul => #[Aiur.G.ofNat (x * y % 256), Aiur.G.ofNat (x * y / 256)]
+  | Aiur.AIR.Byte2Kind.split7 => #[Aiur.G.ofNat ((x ^^^ y) / 128), Aiur.G.ofNat ((x ^^^ y) * 2 % 256)]
+  | Aiur.AIR.Byte2Kind.split4 => #[Aiur.G.ofNat ((x ^^^ y) / 16), Aiur.G.ofNat ((x ^^^ y) * 16 % 256)]
+PREMISE Aiur.AIR.byte2Request
+Aiur.AIR.Byte2Kind → Aiur.G → Aiur.G → Array Aiur.G → List Aiur.G
+DEFINITION
+fun kind x y outputs => kind.channel :: x :: y :: outputs.toList
+PREMISE Aiur.AIR.byte2Providers
+(Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G) → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun weights =>
+  List.flatMap
+    (fun kind =>
+      List.ofFn fun row =>
+        have inputs := Aiur.AIR.byteRangeMessage row;
+        (Aiur.AIR.byte2Request kind inputs.fst inputs.snd (Aiur.AIR.byte2Outputs kind row), weights kind row))
+    Aiur.AIR.Byte2Kind.all
+PREMISE Aiur.AIR.Byte2Kind.op
+Aiur.AIR.Byte2Kind → Aiur.Bytecode.ValIdx → Aiur.Bytecode.ValIdx → Aiur.Bytecode.Op
+DEFINITION
+fun x =>
+  match (motive := Aiur.AIR.Byte2Kind → Aiur.Bytecode.ValIdx → Aiur.Bytecode.ValIdx → Aiur.Bytecode.Op) x with
+  | Aiur.AIR.Byte2Kind.xor => Aiur.Bytecode.Op.u8Xor
+  | Aiur.AIR.Byte2Kind.add => Aiur.Bytecode.Op.u8Add
+  | Aiur.AIR.Byte2Kind.sub => Aiur.Bytecode.Op.u8Sub
+  | Aiur.AIR.Byte2Kind.and => Aiur.Bytecode.Op.u8And
+  | Aiur.AIR.Byte2Kind.or => Aiur.Bytecode.Op.u8Or
+  | Aiur.AIR.Byte2Kind.lessThan => Aiur.Bytecode.Op.u8LessThan
+  | Aiur.AIR.Byte2Kind.range => Aiur.Bytecode.Op.u8RangeCheck
+  | Aiur.AIR.Byte2Kind.mul => Aiur.Bytecode.Op.u8Mul
+  | Aiur.AIR.Byte2Kind.split7 => Aiur.Bytecode.Op.u8XorSplit7
+  | Aiur.AIR.Byte2Kind.split4 => Aiur.Bytecode.Op.u8XorSplit4
+PREMISE Aiur.AIR.Byte2Kind.extendOutputs
+Aiur.AIR.Byte2Kind → Aiur.G → Aiur.G → Array Aiur.G → Array Aiur.G
+DEFINITION
+fun kind x y outputs =>
+  match kind with
+  | Aiur.AIR.Byte2Kind.add => outputs.push ((x + y - outputs[0]?.getD 0) * Aiur.AIR.inverse256)
+  | Aiur.AIR.Byte2Kind.sub => outputs.push ((outputs[0]?.getD 0 + y - x) * Aiur.AIR.inverse256)
+  | x => outputs
+PREMISE Aiur.AIR.byte1Preprocessed
+Fin 256 → Array Aiur.G
+DEFINITION
+fun row =>
+  #[Aiur.G.ofNat ↑row] ++ Aiur.AIR.byte1Outputs Aiur.AIR.Byte1Kind.bits row ++
+      Aiur.AIR.byte1Outputs Aiur.AIR.Byte1Kind.shiftLeft row ++
+    Aiur.AIR.byte1Outputs Aiur.AIR.Byte1Kind.shiftRight row
+PREMISE Aiur.AIR.byte2Preprocessed
+Fin 65536 → Array Aiur.G
+DEFINITION
+fun row =>
+  have inputs := Aiur.AIR.byteRangeMessage row;
+  #[inputs.fst, inputs.snd] ++ Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.xor row ++
+                  Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.add row ++
+                Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.sub row ++
+              Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.and row ++
+            Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.or row ++
+          Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.lessThan row ++
+        Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.mul row ++
+      Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.split7 row ++
+    Aiur.AIR.byte2Outputs Aiur.AIR.Byte2Kind.split4 row
+PREMISE Aiur.AIR.padMessage
+Nat → List Aiur.G → List Aiur.G
+DEFINITION
+fun width message => List.ofFn fun i => message[↑i]?.getD 0
+PREMISE Aiur.AIR.HasMessageShape
+(Aiur.G → Aiur.G → Nat) → List Aiur.G → Prop
+DEFINITION
+fun widths message => 2 ≤ message.length ∧ message.length = widths (message[0]?.getD 0) (message[1]?.getD 0)
+PREMISE Aiur.AIR.mapProviders
+{α : Type u_1} → {β : Type u_2} → (α → β) → List (Aiur.AIR.Provider α) → List (Aiur.AIR.Provider β)
+DEFINITION
+fun {α} {β} encode providers => List.map (fun provider => (encode provider.fst, provider.snd)) providers
+PREMISE Aiur.AIR.PaddedLookupBalance
+Nat → List (List Aiur.G) → List (Aiur.AIR.Provider (List Aiur.G)) → Prop
+DEFINITION
+fun width queries providers =>
+  Aiur.AIR.ExactLookupBalance (List.map (Aiur.AIR.padMessage width) queries)
+    (Aiur.AIR.mapProviders (Aiur.AIR.padMessage width) providers)
+PREMISE Aiur.AIR.functionMessage
+Aiur.Bytecode.AIR.Call → List Aiur.G
+DEFINITION
+fun request => 0 :: Aiur.G.ofNat request.function :: (request.inputs.toList ++ request.outputs.toList ++ [request.rank])
+PREMISE Aiur.AIR.memoryMessage
+Nat → Aiur.G → Array Aiur.G → List Aiur.G
+DEFINITION
+fun width pointer contents => 1 :: Aiur.G.ofNat width :: pointer :: contents.toList
+PREMISE Aiur.AIR.Byte1Kind.outputSize
+Aiur.AIR.Byte1Kind → Nat
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.AIR.Byte1Kind.bits => 8
+  | Aiur.AIR.Byte1Kind.shiftLeft => 1
+  | Aiur.AIR.Byte1Kind.shiftRight => 1
+PREMISE Aiur.AIR.Byte2Kind.outputSize
+Aiur.AIR.Byte2Kind → Nat
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.AIR.Byte2Kind.range => 0
+  | Aiur.AIR.Byte2Kind.mul => 2
+  | Aiur.AIR.Byte2Kind.split7 => 2
+  | Aiur.AIR.Byte2Kind.split4 => 2
+  | x => 1
+PREMISE Aiur.AIR.lookupMessageWidth
+Aiur.AIR.FunctionArities → Aiur.G → Aiur.G → Nat
+DEFINITION
+fun arities channel key =>
+  match channel.n with
+  | 0 => 3 + (arities key.n).fst + (arities key.n).snd
+  | 1 => 3 + key.n
+  | 2 => 10
+  | 3 => 3
+  | 4 => 3
+  | 5 => 4
+  | 6 => 4
+  | 7 => 4
+  | 8 => 4
+  | 9 => 4
+  | 10 => 4
+  | 11 => 3
+  | 12 => 5
+  | 13 => 5
+  | 14 => 5
+  | x => 0
+PREMISE Aiur.AIR.FunctionMessageValid
+Aiur.AIR.FunctionArities → Aiur.Bytecode.AIR.Call → Prop
+DEFINITION
+fun arities request =>
+  request.function < Aiur.gSize.toNat ∧
+    request.inputs.size = (arities request.function).fst ∧ request.outputs.size = (arities request.function).snd
+PREMISE Aiur.Bytecode.Ctrl.returnsHaveSize
+Nat → Aiur.Bytecode.Ctrl → Bool
+DEFINITION
+fun size a => Aiur.Bytecode.Ctrl.returnsHaveSize._mutual size (PSum.inl a)
+PREMISE Aiur.Bytecode.Block.returnsHaveSize
+Nat → Aiur.Bytecode.Block → Bool
+DEFINITION
+fun size block => Aiur.Bytecode.Ctrl.returnsHaveSize._mutual size (PSum.inr block)
+PREMISE Aiur.Bytecode.Op.lookupShape
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Op → Bool
+DEFINITION
+fun program x =>
+  match x with
+  | Aiur.Bytecode.Op.call index inputs outputs false =>
+    match program.functions[index]? with
+    | none => false
+    | some callee =>
+      callee.constrained &&
+        (callee.layout.inputSize == inputs.size && Aiur.Bytecode.Block.returnsHaveSize outputs callee.body)
+  | Aiur.Bytecode.Op.store values => decide (values.size < Aiur.gSize.toNat)
+  | Aiur.Bytecode.Op.load size a => decide (size < Aiur.gSize.toNat)
+  | x => true
+PREMISE Aiur.Bytecode.Ctrl.lookupShapes
+Aiur.Bytecode.Toplevel → Option Nat → Aiur.Bytecode.Ctrl → Bool
+DEFINITION
+fun program yieldSize a => Aiur.Bytecode.Ctrl.lookupShapes._mutual program (PSum.inl ⟨yieldSize, a⟩)
+PREMISE Aiur.Bytecode.Block.lookupShapes
+Aiur.Bytecode.Toplevel → Option Nat → Aiur.Bytecode.Block → Bool
+DEFINITION
+fun program yieldSize block => Aiur.Bytecode.Ctrl.lookupShapes._mutual program (PSum.inr ⟨yieldSize, block⟩)
+PREMISE Aiur.Bytecode.Toplevel.validateLookupShapes
+Aiur.Bytecode.Toplevel → Bool
+DEFINITION
+fun program =>
+  decide (program.functions.size < Aiur.gSize.toNat) &&
+    ((program.memorySizes.all fun size => decide (size < Aiur.gSize.toNat)) &&
+      program.functions.all fun function =>
+        !function.constrained || Aiur.Bytecode.Block.lookupShapes program none function.body)
+PREMISE Aiur.Bytecode.Toplevel.validClaimShape
+Aiur.Bytecode.Toplevel → Array Aiur.G → Bool
+DEFINITION
+fun program claim =>
+  match claim.toList with
+  | channel :: index :: arguments =>
+    channel == 0 &&
+      match program.functions[index.n]? with
+      | none => false
+      | some function =>
+        function.entry && function.constrained &&
+          (decide (function.layout.inputSize ≤ arguments.length) &&
+            Aiur.Bytecode.Block.returnsHaveSize (arguments.length - function.layout.inputSize) function.body)
+  | x => false
+PREMISE Aiur.Bytecode.AIR.Call.LookupShape
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.AIR.Call → Prop
+DEFINITION
+fun program request =>
+  ∃ callee,
+    program.functions[request.function]? = some callee ∧
+      callee.constrained = true ∧
+        callee.layout.inputSize = request.inputs.size ∧
+          Aiur.Bytecode.Block.returnsHaveSize request.outputs.size callee.body = true
+PREMISE Aiur.Bytecode.AIR.Outcome.ReturnSize
+Aiur.Bytecode.AIR.Outcome → Nat → Prop
+DEFINITION
+fun outcome size =>
+  match outcome with
+  | Aiur.Bytecode.AIR.Outcome.returned outputs => outputs.size = size
+  | Aiur.Bytecode.AIR.Outcome.yielded a => True
+PREMISE Aiur.AIR.LookupTables.mk
+List Aiur.AIR.FunctionRow →
+  List Nat →
+    (Nat → Array Aiur.AIR.MemoryRow) →
+      (Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G) → (Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G) → Aiur.AIR.LookupTables
+PREMISE Aiur.AIR.LookupTables.providers
+Aiur.AIR.LookupTables → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun tables =>
+  Aiur.AIR.mapProviders Aiur.AIR.functionMessage (Aiur.AIR.functionProviders tables.functions) ++
+        List.flatMap
+          (fun width =>
+            Aiur.AIR.mapProviders (fun request => Aiur.AIR.memoryMessage width request.fst request.snd)
+              (Aiur.AIR.memoryProviders (tables.memory width)))
+          tables.memoryWidths ++
+      Aiur.AIR.byte1Providers tables.byte1 ++
+    Aiur.AIR.byte2Providers tables.byte2
+PREMISE Aiur.AIR.GlobalLookups.mk
+∀ {tables : Aiur.AIR.LookupTables} {width : Nat} {queries : List (List Aiur.G)},
+  Aiur.AIR.PaddedLookupBalance width queries tables.providers →
+    queries.length < Aiur.gSize.toNat →
+      (∀ (query : List Aiur.G), query ∈ queries → query.length ≤ width) → Aiur.AIR.GlobalLookups tables width queries
+PREMISE Aiur.AIR.rangeMessage
+Aiur.G × Aiur.G → List Aiur.G
+DEFINITION
+fun pair => Aiur.AIR.byte2Request Aiur.AIR.Byte2Kind.range pair.fst pair.snd #[]
+PREMISE Aiur.lookupSlotSum
+List Nat → List Bool → List Nat → Option Nat
+DEFINITION
+fun x x_1 x_2 => List.brecOn (motive := fun x => List Bool → List Nat → Option Nat) x Aiur.lookupSlotSum._f x_1 x_2
+PREMISE Aiur.lookupQueryBoundAux
+List Nat → List Bool → List Nat → Nat → Option Nat
+DEFINITION
+fun x x_1 x_2 x_3 =>
+  List.brecOn (motive := fun x => List Bool → List Nat → Nat → Option Nat) x Aiur.lookupQueryBoundAux._f x_1 x_2 x_3
+PREMISE Aiur.lookupQueryBound
+List Nat → List Bool → List Nat → Option Nat
+DEFINITION
+fun slots active degrees => if active.any id = true then Aiur.lookupQueryBoundAux slots active degrees 1 else none
+PREMISE Aiur.AIR.addMessages
+List Aiur.G → List Aiur.G → List Aiur.G
+DEFINITION
+fun x x_1 => List.brecOn (motive := fun x => List Aiur.G → List Aiur.G) x Aiur.AIR.addMessages._f x_1
+PREMISE Aiur.AIR.scaleMessage
+Aiur.G → List Aiur.G → List Aiur.G
+DEFINITION
+fun selector message => List.map (fun x => selector * x) message
+PREMISE Aiur.AIR.weightedMessage
+List (Aiur.G × List Aiur.G) → List Aiur.G
+DEFINITION
+fun parts =>
+  List.foldl (fun combined part => Aiur.AIR.addMessages combined (Aiur.AIR.scaleMessage part.fst part.snd)) [] parts
+PREMISE Aiur.AIR.gateMessage
+Bool → Aiur.G → List Aiur.G → List Aiur.G
+DEFINITION
+fun branchless selector message => if branchless = true then message else Aiur.AIR.scaleMessage selector message
+PREMISE Aiur.AIR.slotMessage
+Bool → List (Aiur.G × List Aiur.G) → List Aiur.G
+DEFINITION
+fun branchless parts =>
+  List.foldl (fun combined part => Aiur.AIR.addMessages combined (Aiur.AIR.gateMessage branchless part.fst part.snd)) []
+    parts
+PREMISE Aiur.AIR.SelectorFlow.mk
+Aiur.G → List Aiur.G → List Aiur.G → List Aiur.G → Aiur.AIR.SelectorFlow
+PREMISE Aiur.AIR.SelectorFlow.guard
+Aiur.AIR.SelectorFlow → Aiur.AIR.SelectorFlow
+DEFINITION
+fun flow =>
+  { entry := flow.entry, returns := flow.returns, yields := flow.yields,
+    equations := Aiur.AIR.oneSubBooleanConstraint flow.entry :: flow.equations }
+PREMISE Aiur.AIR.SelectorFlow.join
+List Aiur.AIR.SelectorFlow → Aiur.AIR.SelectorFlow
+DEFINITION
+fun flows =>
+  { entry := Aiur.AIR.selectorSum (List.map (fun x => x.entry) flows),
+    returns := List.flatMap (fun x => x.returns) flows, yields := List.flatMap (fun x => x.yields) flows,
+    equations := List.flatMap (fun x => x.equations) flows }
+PREMISE Aiur.AIR.SelectorFlow.continue
+Aiur.AIR.SelectorFlow → Aiur.AIR.SelectorFlow → Aiur.AIR.SelectorFlow
+DEFINITION
+fun branches continuation =>
+  { entry := branches.entry, returns := branches.returns ++ continuation.returns, yields := continuation.yields,
+    equations :=
+      branches.equations ++ (continuation.entry - Aiur.AIR.selectorSum branches.yields) :: continuation.equations }
+PREMISE Aiur.AIR.SelectorFlow.Satisfied
+Aiur.AIR.SelectorFlow → Prop
+DEFINITION
+fun flow => ∀ (equation : Aiur.G), equation ∈ flow.equations → equation = 0
+PREMISE Aiur.AIR.SelectorFlow.Sound.mk
+∀ {flow : Aiur.AIR.SelectorFlow},
+  flow.entry = Aiur.AIR.selectorSum flow.returns + Aiur.AIR.selectorSum flow.yields →
+    (∀ (value : Aiur.G), value ∈ flow.returns → Aiur.AIR.booleanConstraint value = 0) →
+      (∀ (value : Aiur.G), value ∈ flow.yields → Aiur.AIR.booleanConstraint value = 0) → flow.Sound
+PREMISE Aiur.Bytecode.Ctrl.selectorFlow
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Ctrl → Aiur.AIR.SelectorFlow
+DEFINITION
+fun selector a => Aiur.Bytecode.Ctrl.selectorFlow._mutual selector (PSum.inl a)
+PREMISE Aiur.Bytecode.Block.selectorFlow
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Block → Aiur.AIR.SelectorFlow
+DEFINITION
+fun selector block => Aiur.Bytecode.Ctrl.selectorFlow._mutual selector (PSum.inr block)
+PREMISE Aiur.Bytecode.branchSelectorFlows
+(Aiur.Bytecode.SelIdx → Aiur.G) →
+  Array (Aiur.G × Aiur.Bytecode.Block) → Option Aiur.Bytecode.Block → List Aiur.AIR.SelectorFlow
+DEFINITION
+fun selector branches fallback =>
+  List.map (fun pair => Aiur.Bytecode.Block.selectorFlow selector pair.snd) branches.toList ++
+    List.map (fun block => Aiur.Bytecode.Block.selectorFlow selector block) fallback.toList
+PREMISE Aiur.Bytecode.Ctrl.returnGates
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.G → Aiur.Bytecode.Ctrl → List Aiur.G
+DEFINITION
+fun selector incoming a => Aiur.Bytecode.Ctrl.returnGates._mutual selector (PSum.inl ⟨incoming, a⟩)
+PREMISE Aiur.Bytecode.Block.returnGates
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.G → Aiur.Bytecode.Block → List Aiur.G
+DEFINITION
+fun selector incoming block => Aiur.Bytecode.Ctrl.returnGates._mutual selector (PSum.inr ⟨incoming, block⟩)
+PREMISE Aiur.Bytecode.branchReturnGates
+(Aiur.Bytecode.SelIdx → Aiur.G) → Array (Aiur.G × Aiur.Bytecode.Block) → Option Aiur.Bytecode.Block → List Aiur.G
+DEFINITION
+fun selector branches fallback =>
+  List.flatMap
+      (fun pair =>
+        Aiur.Bytecode.Block.returnGates selector (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry pair.snd)
+      branches.toList ++
+    List.flatMap
+      (fun block =>
+        Aiur.Bytecode.Block.returnGates selector (Aiur.Bytecode.Block.selectorFlow selector block).entry block)
+      fallback.toList
+PREMISE Aiur.AIR.RowValue.mk
+Aiur.G → Nat → Bool → Aiur.AIR.RowValue
+PREMISE Aiur.AIR.RowValue.variable
+Aiur.G → Aiur.AIR.RowValue
+DEFINITION
+fun value => { value := value, degree := 1, constant := false }
+PREMISE Aiur.AIR.RowValue.konst
+Aiur.G → Aiur.AIR.RowValue
+DEFINITION
+fun value => { value := value, degree := 0, constant := true }
+PREMISE Aiur.AIR.rowValues
+Array Aiur.AIR.RowValue → Array Aiur.G
+DEFINITION
+fun values => Array.map Aiur.AIR.RowValue.value values
+PREMISE Aiur.AIR.RowValue.add
+Aiur.AIR.RowValue → Aiur.AIR.RowValue → Aiur.AIR.RowValue
+DEFINITION
+fun left right =>
+  { value := left.value + right.value, degree := max left.degree right.degree,
+    constant := left.constant && right.constant }
+PREMISE Aiur.AIR.RowValue.sub
+Aiur.AIR.RowValue → Aiur.AIR.RowValue → Aiur.AIR.RowValue
+DEFINITION
+fun left right =>
+  { value := left.value - right.value, degree := max left.degree right.degree,
+    constant := left.constant && right.constant }
+PREMISE Aiur.AIR.RowValue.mul
+Aiur.AIR.RowValue → Aiur.AIR.RowValue → Aiur.AIR.RowValue
+DEFINITION
+fun left right =>
+  { value := left.value * right.value, degree := left.degree + right.degree,
+    constant :=
+      left.constant && right.constant || left.constant && left.value == 0 || right.constant && right.value == 0 }
+PREMISE Aiur.AIR.rowAdvice
+(Nat → Aiur.G) → Nat → Nat → Array Aiur.AIR.RowValue
+DEFINITION
+fun row start count => Array.ofFn fun index => Aiur.AIR.RowValue.variable (row (start + ↑index))
+PREMISE Aiur.AIR.RowValue.pack
+Array Aiur.AIR.RowValue → Aiur.AIR.RowValue
+DEFINITION
+fun values =>
+  { value := Aiur.Bytecode.AIR.packWord (Aiur.AIR.rowValues values),
+    degree := List.foldl (fun degree value => max degree value.degree) 0 values.toList,
+    constant := values.all fun x => x.constant }
+PREMISE Aiur.AIR.readRowWord
+Array Aiur.AIR.RowValue → Array Aiur.Bytecode.ValIdx → Option Aiur.AIR.RowValue
+DEFINITION
+fun values indices => do
+  let word ← Aiur.Bytecode.AIR.readWord (Aiur.AIR.rowValues values) indices
+  have bytes : Array Aiur.AIR.RowValue :=
+    Array.map (fun index => values[index]?.getD (Aiur.AIR.RowValue.konst 0)) indices
+  pure
+      (have __src := Aiur.AIR.RowValue.pack bytes;
+      { value := word, degree := __src.degree, constant := __src.constant })
+PREMISE Aiur.AIR.OpEmission.mk
+Array Aiur.AIR.RowValue →
+  Nat → List Aiur.G → List (List Aiur.G) → List (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)) → Aiur.AIR.OpEmission
+PREMISE Aiur.AIR.emitAdvice
+(Nat → Aiur.G) → Nat → Aiur.AIR.OpEmission
+DEFINITION
+fun row count => { outputs := Aiur.AIR.rowAdvice row 0 count, used := count }
+PREMISE Aiur.AIR.emitByte1
+(Nat → Aiur.G) → Aiur.AIR.Byte1Kind → Aiur.Bytecode.ValIdx → Array Aiur.AIR.RowValue → Option Aiur.AIR.OpEmission
+DEFINITION
+fun row kind index values => do
+  let input ← values[index]?
+  have outputs : Array Aiur.AIR.RowValue := Aiur.AIR.rowAdvice row 0 kind.outputSize
+  pure
+      { outputs := outputs, used := kind.outputSize,
+        queries := [Aiur.AIR.byte1Request kind input.value (Aiur.AIR.rowValues outputs)] }
+PREMISE Aiur.AIR.Byte2Kind.extendRowOutputs
+Aiur.AIR.Byte2Kind → Aiur.AIR.RowValue → Aiur.AIR.RowValue → Array Aiur.AIR.RowValue → Array Aiur.AIR.RowValue
+DEFINITION
+fun kind left right outputs =>
+  have low := (Aiur.AIR.rowValues outputs)[0]?.getD 0;
+  have degree := max (max left.degree right.degree) 1;
+  match kind with
+  | Aiur.AIR.Byte2Kind.add =>
+    outputs.push
+      { value := (left.value + right.value - low) * Aiur.AIR.inverse256, degree := degree, constant := false }
+  | Aiur.AIR.Byte2Kind.sub =>
+    outputs.push
+      { value := (low + right.value - left.value) * Aiur.AIR.inverse256, degree := degree, constant := false }
+  | x => outputs
+PREMISE Aiur.AIR.emitByte2
+(Nat → Aiur.G) →
+  Aiur.AIR.Byte2Kind →
+    Aiur.Bytecode.ValIdx → Aiur.Bytecode.ValIdx → Array Aiur.AIR.RowValue → Option Aiur.AIR.OpEmission
+DEFINITION
+fun row kind left right values => do
+  let x ← values[left]?
+  let y ← values[right]?
+  have outputs : Array Aiur.AIR.RowValue := Aiur.AIR.rowAdvice row 0 kind.outputSize
+  pure
+      { outputs := kind.extendRowOutputs x y outputs, used := kind.outputSize,
+        queries := [Aiur.AIR.byte2Request kind x.value y.value (Aiur.AIR.rowValues outputs)] }
+PREMISE Aiur.AIR.range4Queries
+(Fin 4 → Aiur.G) → List (List Aiur.G)
+DEFINITION
+fun bytes => [Aiur.AIR.rangeMessage (bytes 0, bytes 1), Aiur.AIR.rangeMessage (bytes 2, bytes 3)]
+PREMISE Aiur.AIR.emitU32LessThan
+(Nat → Aiur.G) →
+  Aiur.G → Aiur.Bytecode.ValIdx → Aiur.Bytecode.ValIdx → Array Aiur.AIR.RowValue → Option Aiur.AIR.OpEmission
+DEFINITION
+fun row selector left right values => do
+  let a ← values[left]?
+  let b ← values[right]?
+  have x : Fin 4 → Aiur.G := fun index => row ↑index
+  have y : Fin 4 → Aiur.G := fun index => row (4 + ↑index)
+  have z : Fin 4 → Aiur.G := fun index => row (8 + ↑index)
+  pure
+      { outputs := #[{ value := 1 - Aiur.AIR.u32Carries x y z 4, degree := 1, constant := false }], used := 12,
+        equations :=
+          selector * (a.value - Aiur.AIR.pack4 x) ::
+            selector * (b.value - Aiur.AIR.pack4 z) ::
+              List.ofFn fun index => selector * Aiur.AIR.booleanConstraint (Aiur.AIR.u32Carries x y z index.succ),
+        queries := Aiur.AIR.range4Queries x ++ Aiur.AIR.range4Queries y ++ Aiur.AIR.range4Queries z }
+PREMISE Aiur.AIR.emitU32Add
+(Nat → Aiur.G) →
+  Array Aiur.Bytecode.ValIdx →
+    Array Aiur.Bytecode.ValIdx →
+      Option (Array Aiur.Bytecode.ValIdx) → Array Aiur.AIR.RowValue → Option Aiur.AIR.OpEmission
+DEFINITION
+fun row left right third values => do
+  let x ← Aiur.AIR.readRowWord values left
+  let y ← Aiur.AIR.readRowWord values right
+  have __do_jp : Aiur.AIR.RowValue → Option Aiur.AIR.OpEmission := fun sum =>
+    have bytes := Aiur.AIR.rowAdvice row 0 4;
+    have packed := Aiur.AIR.RowValue.pack bytes;
+    pure
+      {
+        outputs :=
+          bytes.push
+            { value := (sum.value - packed.value) * 18446744065119617026, degree := max sum.degree packed.degree,
+              constant := false },
+        used := 4 }
+  match third with
+    | none => do
+      let sum ← some (x.add y)
+      __do_jp sum
+    | some indices => do
+      let sum ← Option.map (fun z => (x.add y).add z) (Aiur.AIR.readRowWord values indices)
+      __do_jp sum
+PREMISE Aiur.AIR.emitOp
+(Nat → Aiur.G) → Aiur.G → Aiur.G → Aiur.Bytecode.Op → Array Aiur.AIR.RowValue → Option Aiur.AIR.OpEmission
+DEFINITION
+fun row selector rank op values =>
+  match op with
+  | Aiur.Bytecode.Op.const value => some { outputs := #[Aiur.AIR.RowValue.konst value] }
+  | Aiur.Bytecode.Op.add a b => do
+    let __do_lift ← values[a]?
+    let __do_lift_1 ← values[b]?
+    pure { outputs := #[__do_lift.add __do_lift_1] }
+  | Aiur.Bytecode.Op.sub a b => do
+    let __do_lift ← values[a]?
+    let __do_lift_1 ← values[b]?
+    pure { outputs := #[__do_lift.sub __do_lift_1] }
+  | Aiur.Bytecode.Op.mul a b => do
+    let x ← values[a]?
+    let y ← values[b]?
+    have product : Aiur.AIR.RowValue := x.mul y
+    if product.degree < 2 then pure { outputs := #[product] }
+      else
+        pure
+          { outputs := #[Aiur.AIR.RowValue.variable (row 0)], used := 1,
+            equations := [selector * (row 0 - product.value)] }
+  | Aiur.Bytecode.Op.eqZero a => do
+    let input ← values[a]?
+    if (input.constant && input.degree == 0) = true then
+        pure { outputs := #[Aiur.AIR.RowValue.konst input.value.eqZero] }
+      else
+        pure
+          { outputs := #[Aiur.AIR.RowValue.variable (row 1)], used := 2,
+            equations := [selector * input.value * row 1, selector * (input.value * row 0 + row 1 - 1)] }
+  | Aiur.Bytecode.Op.call function indices size unconstrained =>
+    if unconstrained = true then some (Aiur.AIR.emitAdvice row size)
+    else do
+      let inputs ← Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) indices
+      have outputs : Array Aiur.AIR.RowValue := Aiur.AIR.rowAdvice row 0 size
+      have request : Aiur.Bytecode.AIR.Call :=
+        { function := function, inputs := inputs, outputs := Aiur.AIR.rowValues outputs, rank := row size }
+      have gap : Fin 6 → Aiur.G := fun index => row (size + 1 + ↑index)
+      pure
+          { outputs := outputs, used := size + 7,
+            equations := [selector * Aiur.AIR.callOrderConstraint rank request.rank (Aiur.AIR.packRank gap)],
+            queries :=
+              Aiur.AIR.functionMessage request :: List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries gap),
+            calls := [(request, gap)] }
+  | Aiur.Bytecode.Op.store indices => do
+    let contents ← Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) indices
+    pure
+        { outputs := #[Aiur.AIR.RowValue.variable (row 0)], used := 1,
+          queries := [Aiur.AIR.memoryMessage indices.size (row 0) contents] }
+  | Aiur.Bytecode.Op.load size index => do
+    let pointer ← values[index]?
+    have outputs : Array Aiur.AIR.RowValue := Aiur.AIR.rowAdvice row 0 size
+    pure
+        { outputs := outputs, used := size,
+          queries := [Aiur.AIR.memoryMessage size pointer.value (Aiur.AIR.rowValues outputs)] }
+  | Aiur.Bytecode.Op.assertEq xs ys a =>
+    if xs.size ≠ ys.size then none
+    else do
+      let left ← Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) xs
+      let right ← Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) ys
+      pure { equations := List.ofFn fun i => selector * (left[i] - right[↑i]?.getD 0) }
+  | Aiur.Bytecode.Op.ioGetInfo a a_1 => some (Aiur.AIR.emitAdvice row 2)
+  | Aiur.Bytecode.Op.ioRead a a_1 size => some (Aiur.AIR.emitAdvice row size)
+  | Aiur.Bytecode.Op.ioSetInfo a a_1 a_2 a_3 => some { }
+  | Aiur.Bytecode.Op.ioWrite a a_1 => some { }
+  | Aiur.Bytecode.Op.debug a a_1 => some { }
+  | Aiur.Bytecode.Op.u8BitDecomposition index => Aiur.AIR.emitByte1 row Aiur.AIR.Byte1Kind.bits index values
+  | Aiur.Bytecode.Op.u8ShiftLeft index => Aiur.AIR.emitByte1 row Aiur.AIR.Byte1Kind.shiftLeft index values
+  | Aiur.Bytecode.Op.u8ShiftRight index => Aiur.AIR.emitByte1 row Aiur.AIR.Byte1Kind.shiftRight index values
+  | Aiur.Bytecode.Op.u8Xor a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.xor a b values
+  | Aiur.Bytecode.Op.u8Add a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.add a b values
+  | Aiur.Bytecode.Op.u8Sub a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.sub a b values
+  | Aiur.Bytecode.Op.u8And a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.and a b values
+  | Aiur.Bytecode.Op.u8Or a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.or a b values
+  | Aiur.Bytecode.Op.u8LessThan a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.lessThan a b values
+  | Aiur.Bytecode.Op.u8RangeCheck a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.range a b values
+  | Aiur.Bytecode.Op.u8Mul a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.mul a b values
+  | Aiur.Bytecode.Op.u8XorSplit7 a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.split7 a b values
+  | Aiur.Bytecode.Op.u8XorSplit4 a b => Aiur.AIR.emitByte2 row Aiur.AIR.Byte2Kind.split4 a b values
+  | Aiur.Bytecode.Op.u32LessThan a b => Aiur.AIR.emitU32LessThan row selector a b values
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a a_1 => some (Aiur.AIR.emitAdvice row 2)
+  | Aiur.Bytecode.Op.unconstrainedGToBytes a => some (Aiur.AIR.emitAdvice row 8)
+  | Aiur.Bytecode.Op.unconstrainedGInverse a => some (Aiur.AIR.emitAdvice row 1)
+  | Aiur.Bytecode.Op.unconstrainedU32Add a b => Aiur.AIR.emitU32Add row a b none values
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a b c => Aiur.AIR.emitU32Add row a b (some c) values
+  | Aiur.Bytecode.Op.u32ToField indices => do
+    let __do_lift ← Aiur.AIR.readRowWord values indices
+    pure { outputs := #[__do_lift] }
+PREMISE Aiur.AIR.OpsEmission.mk
+Array Aiur.AIR.RowValue →
+  Nat → List Aiur.G → List (List Aiur.G) → List (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)) → Aiur.AIR.OpsEmission
+PREMISE Aiur.AIR.emitOps
+(Nat → Aiur.G) → Aiur.G → Aiur.G → List Aiur.Bytecode.Op → Array Aiur.AIR.RowValue → Nat → Option Aiur.AIR.OpsEmission
+DEFINITION
+fun row selector rank x x_1 x_2 =>
+  List.brecOn (motive := fun x => Array Aiur.AIR.RowValue → Nat → Option Aiur.AIR.OpsEmission) x
+    (Aiur.AIR.emitOps._f row selector rank) x_1 x_2
+PREMISE Aiur.AIR.CallsEmitted
+Aiur.G → Aiur.G → List Aiur.G → List (List Aiur.G) → List (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)) → Prop
+DEFINITION
+fun rank selector equations queries calls =>
+  ∀ (edge : Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)),
+    edge ∈ calls →
+      Aiur.AIR.functionMessage edge.fst ∈ queries ∧
+        List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries edge.snd) ⊆ queries ∧
+          selector * Aiur.AIR.callOrderConstraint rank edge.fst.rank (Aiur.AIR.packRank edge.snd) ∈ equations
+PREMISE Aiur.Bytecode.MatchPolynomials.mk
+∀ {selector : Aiur.Bytecode.SelIdx → Aiur.G} {scrutinee : Aiur.G} {branches : Array (Aiur.G × Aiur.Bytecode.Block)}
+  {fallback : Option Aiur.Bytecode.Block},
+  (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+      pair ∈ branches.toList →
+        (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry * (scrutinee - pair.fst) = 0) →
+    (∀ (block : Aiur.Bytecode.Block),
+        fallback = some block →
+          ∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+            pair ∈ branches.toList →
+              ∃ inverse,
+                (Aiur.Bytecode.Block.selectorFlow selector block).entry * ((scrutinee - pair.fst) * inverse - 1) = 0) →
+      Aiur.Bytecode.MatchPolynomials selector scrutinee branches fallback
+PREMISE Aiur.AIR.RowContext.mk
+Aiur.Bytecode.FunIdx → Nat → Aiur.G → Aiur.AIR.RowContext
+PREMISE Aiur.AIR.QueryPart.mk
+Nat → Aiur.G → List Aiur.G → Aiur.AIR.QueryPart
+PREMISE Aiur.AIR.queryParts
+Nat → Aiur.G → List (List Aiur.G) → List Aiur.AIR.QueryPart
+DEFINITION
+fun slot selector queries =>
+  List.mapIdx (fun index message => { slot := slot + index, selector := selector, message := message }) queries
+PREMISE Aiur.AIR.BlockEmission.mk
+Array Aiur.AIR.RowValue →
+  Nat →
+    Nat →
+      List Aiur.G →
+        List Aiur.AIR.QueryPart →
+          List (Aiur.G × Aiur.Bytecode.AIR.Call) →
+            List (Aiur.G × Array Aiur.AIR.RowValue) →
+              List (Aiur.G × Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)) → Aiur.AIR.BlockEmission
+PREMISE Aiur.AIR.BlockEmission.prefix
+List Aiur.G → Aiur.AIR.BlockEmission → Aiur.AIR.BlockEmission
+DEFINITION
+fun equations emission =>
+  { values := emission.values, column := emission.column, lookup := emission.lookup,
+    equations := equations ++ emission.equations, queries := emission.queries, returns := emission.returns,
+    yields := emission.yields, calls := emission.calls }
+PREMISE Aiur.AIR.BlockEmission.afterOps
+Aiur.G → Nat → Aiur.AIR.OpsEmission → Aiur.AIR.BlockEmission → Aiur.AIR.BlockEmission
+DEFINITION
+fun incoming lookup ops control =>
+  { values := control.values, column := control.column, lookup := control.lookup,
+    equations := ops.equations ++ control.equations,
+    queries := Aiur.AIR.queryParts lookup incoming ops.queries ++ control.queries, returns := control.returns,
+    yields := control.yields, calls := List.map (fun x => (incoming, x)) ops.calls ++ control.calls }
+PREMISE Aiur.AIR.joinBlockEmissions
+Array Aiur.AIR.RowValue → Nat → Nat → List Aiur.AIR.BlockEmission → Aiur.AIR.BlockEmission
+DEFINITION
+fun values column lookup emissions =>
+  { values := values, column := List.foldl (fun column emission => max column emission.column) column emissions,
+    lookup := List.foldl (fun lookup emission => max lookup emission.lookup) lookup emissions,
+    equations := List.flatMap (fun x => x.equations) emissions, queries := List.flatMap (fun x => x.queries) emissions,
+    returns := List.flatMap (fun x => x.returns) emissions, yields := List.flatMap (fun x => x.yields) emissions,
+    calls := List.flatMap (fun x => x.calls) emissions }
+PREMISE Aiur.AIR.mergeEquations
+(Nat → Aiur.G) → Aiur.G → Nat → Nat → List (Aiur.G × Array Aiur.AIR.RowValue) → List Aiur.G
+DEFINITION
+fun row parent column size yields =>
+  List.map
+    (fun index =>
+      parent *
+        (row (column + index) -
+          Aiur.AIR.selectorSum (List.map (fun part => part.fst * (Aiur.AIR.rowValues part.snd)[index]?.getD 0) yields)))
+    (List.range size)
+PREMISE Aiur.AIR.BlockEmission.continued
+Aiur.AIR.BlockEmission → List Aiur.G → Aiur.AIR.BlockEmission → Aiur.AIR.BlockEmission
+DEFINITION
+fun branches equations continuation =>
+  { values := continuation.values, column := continuation.column, lookup := continuation.lookup,
+    equations := branches.equations ++ equations ++ continuation.equations,
+    queries := branches.queries ++ continuation.queries, returns := branches.returns ++ continuation.returns,
+    yields := continuation.yields, calls := branches.calls ++ continuation.calls }
+PREMISE Aiur.Bytecode.Ctrl.emitRow
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G → Array Aiur.AIR.RowValue → Nat → Nat → Aiur.Bytecode.Ctrl → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun row selector context incoming values column lookup a =>
+  Aiur.Bytecode.Ctrl.emitRow._mutual row selector context (PSum.inl ⟨incoming, ⟨values, ⟨column, ⟨lookup, a⟩⟩⟩⟩)
+PREMISE Aiur.Bytecode.Block.emitRow
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G → Array Aiur.AIR.RowValue → Nat → Nat → Aiur.Bytecode.Block → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun row selector context incoming values column lookup block =>
+  Aiur.Bytecode.Ctrl.emitRow._mutual row selector context (PSum.inr ⟨incoming, ⟨values, ⟨column, ⟨lookup, block⟩⟩⟩⟩)
+PREMISE Aiur.AIR.SelectorFlow.unguard
+Aiur.AIR.SelectorFlow → Aiur.AIR.SelectorFlow
+DEFINITION
+fun flow => { entry := flow.entry, returns := flow.returns, yields := flow.yields, equations := flow.equations.tail }
+PREMISE Aiur.AIR.EmissionProjection.mk
+∀ {flow : Aiur.AIR.SelectorFlow} {gates : List Aiur.G} {emission : Aiur.AIR.BlockEmission},
+  List.map Prod.fst emission.returns = gates →
+    List.map Prod.fst emission.yields = flow.yields →
+      flow.equations ⊆ emission.equations → Aiur.AIR.EmissionProjection flow gates emission
+PREMISE Aiur.Bytecode.caseRow
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G → Array Aiur.AIR.RowValue → Nat → Nat → Aiur.G × Aiur.Bytecode.Block → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun row selector context matched values column lookup pair =>
+  have entry := (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry;
+  do
+  let emission ← Aiur.Bytecode.Block.emitRow row selector context entry values column lookup pair.snd
+  pure (Aiur.AIR.BlockEmission.prefix [entry * (matched - pair.fst)] emission)
+PREMISE Aiur.Bytecode.defaultRow
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G →
+        Array Aiur.AIR.RowValue →
+          Nat →
+            Nat →
+              Array (Aiur.G × Aiur.Bytecode.Block) → Option Aiur.Bytecode.Block → Option (List Aiur.AIR.BlockEmission)
+DEFINITION
+fun row selector context matched values column lookup branches fallback =>
+  match fallback with
+  | none => some []
+  | some block =>
+    have entry := (Aiur.Bytecode.Block.selectorFlow selector block).entry;
+    do
+    let emission ← Aiur.Bytecode.Block.emitRow row selector context entry values (column + branches.size) lookup block
+    pure
+        [Aiur.AIR.BlockEmission.prefix
+            (List.mapIdx (fun i pair => entry * ((matched - pair.fst) * row (column + i) - 1)) branches.toList)
+            emission]
+PREMISE Aiur.Bytecode.branchRows
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G →
+        Array Aiur.AIR.RowValue →
+          Nat → Nat → Array (Aiur.G × Aiur.Bytecode.Block) → Option Aiur.Bytecode.Block → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun row selector context matched values column lookup branches fallback => do
+  let cases ← List.mapM (Aiur.Bytecode.caseRow row selector context matched values column lookup) branches.toList
+  let default ← Aiur.Bytecode.defaultRow row selector context matched values column lookup branches fallback
+  pure (Aiur.AIR.joinBlockEmissions values column lookup (cases ++ default))
+PREMISE Aiur.Bytecode.continueRow
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G →
+        Array Aiur.AIR.RowValue → Nat → Aiur.Bytecode.Block → Aiur.AIR.BlockEmission → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun row selector context incoming values size continuation joined =>
+  if (joined.yields.all fun part => part.snd.size == size) = true then
+    have gate := Aiur.AIR.selectorSum (List.map Prod.fst joined.yields);
+    have merged := Aiur.AIR.rowAdvice row joined.column size;
+    have equations :=
+      Aiur.AIR.mergeEquations row incoming joined.column size joined.yields ++
+        [(Aiur.Bytecode.Block.selectorFlow selector continuation).entry - gate];
+    do
+    let continued ←
+      Aiur.Bytecode.Block.emitRow row selector context gate (values ++ merged) (joined.column + size) joined.lookup
+          continuation
+    pure (joined.continued equations continued)
+  else none
+PREMISE Aiur.AIR.BlockEmission.QueriesIn
+Aiur.AIR.BlockEmission → List (List Aiur.G) → Prop
+DEFINITION
+fun emission queries =>
+  ∀ (part : Aiur.AIR.QueryPart), part ∈ emission.queries → part.selector = 1 → part.message ∈ queries
+PREMISE Aiur.AIR.BlockEmission.CallsAt
+Aiur.AIR.BlockEmission → List (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)) → Prop
+DEFINITION
+fun emission calls => ∀ (edge : Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)), edge ∈ calls → (1, edge) ∈ emission.calls
+PREMISE Aiur.AIR.BlockEmission.TerminalAt
+Aiur.AIR.BlockEmission → Aiur.Bytecode.AIR.Outcome → Prop
+DEFINITION
+fun emission x =>
+  match x with
+  | Aiur.Bytecode.AIR.Outcome.returned outputs => ∃ request, (1, request) ∈ emission.returns ∧ request.outputs = outputs
+  | Aiur.Bytecode.AIR.Outcome.yielded outputs =>
+    ∃ yielded, (1, yielded) ∈ emission.yields ∧ Aiur.AIR.rowValues yielded = outputs
+PREMISE Aiur.AIR.EmissionIncluded.mk
+∀ {part whole : Aiur.AIR.BlockEmission},
+  part.equations ⊆ whole.equations →
+    part.queries ⊆ whole.queries →
+      part.returns ⊆ whole.returns →
+        part.yields ⊆ whole.yields → part.calls ⊆ whole.calls → Aiur.AIR.EmissionIncluded part whole
+PREMISE Aiur.Bytecode.Ctrl.rowBounds
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Ctrl → Prop
+DEFINITION
+fun selector a => Aiur.Bytecode.Ctrl.rowBounds._mutual selector (PSum.inl a)
+PREMISE Aiur.Bytecode.Block.rowBounds
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Block → Prop
+DEFINITION
+fun selector block => Aiur.Bytecode.Ctrl.rowBounds._mutual selector (PSum.inr block)
+PREMISE Aiur.AIR.BlockEmission.HasQuery
+Aiur.AIR.BlockEmission → Aiur.G → List Aiur.G → Prop
+DEFINITION
+fun emission selector message => ∃ part, part ∈ emission.queries ∧ part.selector = selector ∧ part.message = message
+PREMISE Aiur.AIR.BlockEmission.TracksCalls
+Aiur.G → Aiur.AIR.BlockEmission → Prop
+DEFINITION
+fun rank emission =>
+  ∀ (part : Aiur.G × Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G)),
+    part ∈ emission.calls →
+      emission.HasQuery part.fst (Aiur.AIR.functionMessage part.snd.fst) ∧
+        (∀ (message : List Aiur.G),
+            message ∈ List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries part.snd.snd) →
+              emission.HasQuery part.fst message) ∧
+          part.fst * Aiur.AIR.callOrderConstraint rank part.snd.fst.rank (Aiur.AIR.packRank part.snd.snd) ∈
+            emission.equations
+PREMISE Aiur.AIR.RowInputs
+Nat → Array Aiur.G → Array Aiur.AIR.RowValue → Prop
+DEFINITION
+fun size inputs values => Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) (Array.range size) = some inputs
+PREMISE Aiur.AIR.InputPreservation.mk
+∀ {context : Aiur.AIR.RowContext} {inputs : Array Aiur.G} {emission : Aiur.AIR.BlockEmission},
+  Aiur.AIR.RowInputs context.inputSize inputs emission.values →
+    (∀ (part : Aiur.G × Aiur.Bytecode.AIR.Call),
+        part ∈ emission.returns →
+          part.snd.function = context.function ∧ part.snd.inputs = inputs ∧ part.snd.rank = context.rank) →
+      Aiur.AIR.InputPreservation context inputs emission
+PREMISE Aiur.Bytecode.Function.emitRow
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.Bytecode.FunIdx →
+      Aiur.G → Array Aiur.AIR.RowValue → Nat → Nat → Aiur.Bytecode.Function → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun row selector functionIndex rank values column lookup function =>
+  Aiur.Bytecode.Block.emitRow row selector
+    { function := functionIndex, inputSize := function.layout.inputSize, rank := rank }
+    (Aiur.Bytecode.Block.selectorFlow selector function.body).entry values column lookup function.body
+PREMISE Aiur.AIR.gateCount
+Aiur.G → Nat
+DEFINITION
+fun gate => if gate = 1 then 1 else 0
+PREMISE Aiur.AIR.queryCount
+List Aiur.AIR.QueryPart → Nat → Nat
+DEFINITION
+fun queries slot => (List.filter (fun query => query.slot == slot && query.selector == 1) queries).length
+PREMISE Aiur.AIR.QuerySlots.mk
+∀ {gate : Aiur.G} {start finish : Nat} {queries : List Aiur.AIR.QueryPart},
+  start ≤ finish →
+    (∀ (query : Aiur.AIR.QueryPart), query ∈ queries → start ≤ query.slot ∧ query.slot < finish) →
+      (∀ (query : Aiur.AIR.QueryPart), query ∈ queries → Aiur.AIR.booleanConstraint query.selector = 0) →
+        (∀ (slot : Nat), Aiur.AIR.queryCount queries slot ≤ Aiur.AIR.gateCount gate) →
+          Aiur.AIR.QuerySlots gate start finish queries
+PREMISE Aiur.AIR.activeQuerySlot
+List Aiur.AIR.QueryPart → Nat → List Aiur.AIR.QueryPart
+DEFINITION
+fun queries slot => List.filter (fun query => query.slot == slot && query.selector == 1) queries
+PREMISE Aiur.AIR.querySlotParts
+List Aiur.AIR.QueryPart → Nat → List (Aiur.G × List Aiur.G)
+DEFINITION
+fun queries slot =>
+  List.map (fun query => (query.selector, query.message)) (List.filter (fun query => query.slot == slot) queries)
+PREMISE Aiur.AIR.querySlotMultiplicity
+List Aiur.AIR.QueryPart → Nat → Aiur.G
+DEFINITION
+fun queries slot => Aiur.AIR.selectorSum (List.map Prod.fst (Aiur.AIR.querySlotParts queries slot))
+PREMISE Aiur.AIR.decodedQuery
+List Aiur.AIR.QueryPart → Nat → Option (List Aiur.G)
+DEFINITION
+fun queries slot => Option.map (fun x => x.message) (Aiur.AIR.activeQuerySlot queries slot).head?
+PREMISE Aiur.AIR.encodedQuery
+Bool → List Aiur.AIR.QueryPart → Nat → Option (List Aiur.G)
+DEFINITION
+fun branchless queries slot =>
+  if Aiur.AIR.querySlotMultiplicity queries slot = 1 then
+    some (Aiur.AIR.slotMessage branchless (Aiur.AIR.querySlotParts queries slot))
+  else none
+PREMISE Aiur.AIR.decodedQueries
+List Aiur.AIR.QueryPart → Nat → List (List Aiur.G)
+DEFINITION
+fun queries limit => List.filterMap (Aiur.AIR.decodedQuery queries) (List.range limit)
+PREMISE Aiur.AIR.encodedQueries
+Bool → List Aiur.AIR.QueryPart → Nat → List (List Aiur.G)
+DEFINITION
+fun branchless queries limit => List.filterMap (Aiur.AIR.encodedQuery branchless queries) (List.range limit)
+PREMISE Aiur.AIR.blockQueryPool
+List Aiur.AIR.BlockEmission → List (List Aiur.G)
+DEFINITION
+fun emissions => List.flatMap (fun emission => Aiur.AIR.decodedQueries emission.queries emission.lookup) emissions
+PREMISE Aiur.AIR.MemberEmission.mk
+Aiur.Bytecode.FunIdx → Aiur.Bytecode.Function → Nat → Aiur.AIR.BlockEmission → Aiur.AIR.MemberEmission
+PREMISE Aiur.AIR.MemberEmission.selector
+(Nat → Aiur.G) → Aiur.AIR.MemberEmission → Aiur.Bytecode.SelIdx → Aiur.G
+DEFINITION
+fun row member index => row (member.selectorBase + index)
+PREMISE Aiur.AIR.MemberEmission.entry
+(Nat → Aiur.G) → Aiur.AIR.MemberEmission → Aiur.G
+DEFINITION
+fun row member =>
+  (Aiur.Bytecode.Block.selectorFlow (Aiur.AIR.MemberEmission.selector row member) member.function.body).entry
+PREMISE Aiur.AIR.emitMember
+(Nat → Aiur.G) →
+  Aiur.G → Nat → Nat → Nat → Aiur.Bytecode.Toplevel → Aiur.Bytecode.FunIdx → Option Aiur.AIR.MemberEmission
+DEFINITION
+fun row rank column lookup selectorBase program functionIndex => do
+  let function ← program.functions[functionIndex]?
+  let body ←
+    Aiur.Bytecode.Function.emitRow row (fun index => row (selectorBase + index)) functionIndex rank
+        (Aiur.AIR.rowAdvice row 0 function.layout.inputSize) column lookup function
+  pure { functionIndex := functionIndex, function := function, selectorBase := selectorBase, body := body }
+PREMISE Aiur.AIR.emitMembers
+(Nat → Aiur.G) →
+  Aiur.G → Nat → Nat → Nat → Aiur.Bytecode.Toplevel → List Aiur.Bytecode.FunIdx → Option (List Aiur.AIR.MemberEmission)
+DEFINITION
+fun row rank column lookup selectorBase program x =>
+  List.brecOn (motive := fun x => Nat → Option (List Aiur.AIR.MemberEmission)) x
+    (Aiur.AIR.emitMembers._f row rank column lookup program) selectorBase
+PREMISE Aiur.AIR.CircuitEmission.mk
+List Aiur.AIR.MemberEmission →
+  Aiur.G →
+    Aiur.G →
+      (Fin 6 → Aiur.G) →
+        Nat →
+          Nat →
+            Nat →
+              Nat →
+                Bool →
+                  List Aiur.G →
+                    List Aiur.AIR.QueryPart → List (Aiur.G × Aiur.Bytecode.AIR.Call) → Aiur.AIR.CircuitEmission
+PREMISE Aiur.AIR.circuitRankBytes
+(Nat → Aiur.G) → Aiur.Bytecode.FunctionLayout → Fin 6 → Aiur.G
+DEFINITION
+fun row layout index => row (layout.inputSize + layout.selectors + 1 + ↑index)
+PREMISE Aiur.AIR.circuitEmission
+(Nat → Aiur.G) → Aiur.Bytecode.Circuit → List Aiur.AIR.MemberEmission → Aiur.AIR.CircuitEmission
+DEFINITION
+fun row circuit members =>
+  have selector := Aiur.AIR.selectorSum (List.map (fun x => Aiur.AIR.MemberEmission.entry row x) members);
+  have multiplicity := row (circuit.layout.inputSize + circuit.layout.selectors);
+  have rankBytes := Aiur.AIR.circuitRankBytes row circuit.layout;
+  { members := members, selector := selector, multiplicity := multiplicity, rankBytes := rankBytes,
+    width := circuit.layout.width, selectorStart := circuit.layout.inputSize, selectorCount := circuit.layout.selectors,
+    lookupCount := circuit.layout.lookups,
+    branchless := Aiur.Bytecode.circuitBranchless circuit.layout.selectors (List.map (fun x => x.function) members),
+    equations :=
+      (List.flatMap (fun x => x.body.equations) members ++
+            List.map (fun index => Aiur.AIR.booleanConstraint (row (circuit.layout.inputSize + index)))
+              (List.range circuit.layout.selectors) ++
+          if 1 < circuit.members.size then [Aiur.AIR.oneSubBooleanConstraint selector] else []) ++
+        [Aiur.AIR.activityConstraint multiplicity selector],
+    queries :=
+      List.flatMap (fun x => x.body.queries) members ++
+        Aiur.AIR.queryParts 1 selector (List.map Aiur.AIR.rangeMessage (Aiur.AIR.rankByteQueries rankBytes)),
+    returns := List.flatMap (fun x => x.body.returns) members }
+PREMISE Aiur.AIR.CircuitEmission.lookup
+Aiur.AIR.CircuitEmission → Nat → Aiur.G × List Aiur.G
+DEFINITION
+fun emission slot =>
+  if slot = 0 then
+    (0 - emission.multiplicity,
+      Aiur.AIR.slotMessage emission.branchless
+        (List.map (fun part => (part.fst, Aiur.AIR.functionMessage part.snd)) emission.returns))
+  else
+    (Aiur.AIR.querySlotMultiplicity emission.queries slot,
+      Aiur.AIR.slotMessage emission.branchless (Aiur.AIR.querySlotParts emission.queries slot))
+PREMISE Aiur.Bytecode.Circuit.emitRow
+(Nat → Aiur.G) → Aiur.Bytecode.Toplevel → Aiur.Bytecode.Circuit → Option Aiur.AIR.CircuitEmission
+DEFINITION
+fun row program circuit =>
+  have rank := Aiur.AIR.packRank (Aiur.AIR.circuitRankBytes row circuit.layout);
+  have column := circuit.layout.inputSize + circuit.layout.selectors + 1 + 6;
+  do
+  let members ← Aiur.AIR.emitMembers row rank column 4 circuit.layout.inputSize program circuit.members.toList
+  pure (Aiur.AIR.circuitEmission row circuit members)
+PREMISE Aiur.AIR.MemberEmission.FromProgram.mk
+∀ {row : Nat → Aiur.G} {rank : Aiur.G} {column lookup : Nat} {program : Aiur.Bytecode.Toplevel}
+  {member : Aiur.AIR.MemberEmission},
+  program.functions[member.functionIndex]? = some member.function →
+    Aiur.Bytecode.Function.emitRow row (Aiur.AIR.MemberEmission.selector row member) member.functionIndex rank
+          (Aiur.AIR.rowAdvice row 0 member.function.layout.inputSize) column lookup member.function =
+        some member.body →
+      Aiur.AIR.MemberEmission.FromProgram row rank column lookup program member
+PREMISE Aiur.AIR.CircuitEmission.QueriesIn
+Aiur.AIR.CircuitEmission → List (List Aiur.G) → Prop
+DEFINITION
+fun emission queries =>
+  ∀ (part : Aiur.AIR.QueryPart), part ∈ emission.queries → part.selector = 1 → part.message ∈ queries
+PREMISE Aiur.AIR.circuitQueryPool
+List Aiur.AIR.CircuitEmission → List (List Aiur.G)
+DEFINITION
+fun emissions => List.flatMap (fun emission => Aiur.AIR.decodedQueries emission.queries emission.lookupCount) emissions
+PREMISE Aiur.Bytecode.FunctionLayout.width
+Aiur.Bytecode.FunctionLayout → Nat
+DEFINITION
+fun l => l.inputSize + l.selectors + l.auxiliaries
+PREMISE Aiur.Bytecode.ControlCounts.mk
+Nat → Nat → Nat → Nat → Aiur.Bytecode.ControlCounts
+PREMISE Aiur.Bytecode.ControlCounts.sum
+List Aiur.Bytecode.ControlCounts → Aiur.Bytecode.ControlCounts
+DEFINITION
+fun items =>
+  { nodes := (List.map (fun x => x.nodes) items).sum, leaves := (List.map (fun x => x.leaves) items).sum,
+    returns := (List.map (fun x => x.returns) items).sum, yields := (List.map (fun x => x.yields) items).sum }
+PREMISE Aiur.Bytecode.ControlCounts.branch
+List Aiur.Bytecode.ControlCounts → Aiur.Bytecode.ControlCounts
+DEFINITION
+fun items =>
+  have __src := Aiur.Bytecode.ControlCounts.sum items;
+  { nodes := (Aiur.Bytecode.ControlCounts.sum items).nodes + 1, leaves := __src.leaves, returns := __src.returns,
+    yields := __src.yields }
+PREMISE Aiur.Bytecode.ControlCounts.continue
+Aiur.Bytecode.ControlCounts → Aiur.Bytecode.ControlCounts → Aiur.Bytecode.ControlCounts
+DEFINITION
+fun branches continuation =>
+  { nodes := branches.nodes + continuation.nodes, leaves := branches.leaves + continuation.leaves,
+    returns := branches.returns + continuation.returns, yields := continuation.yields }
+PREMISE Aiur.Bytecode.Ctrl.controlCounts
+Aiur.Bytecode.Ctrl → Aiur.Bytecode.ControlCounts
+DEFINITION
+fun a => Aiur.Bytecode.Ctrl.controlCounts._mutual (PSum.inl a)
+PREMISE Aiur.Bytecode.Block.controlCounts
+Aiur.Bytecode.Block → Aiur.Bytecode.ControlCounts
+DEFINITION
+fun block => Aiur.Bytecode.Ctrl.controlCounts._mutual (PSum.inr block)
+PREMISE Aiur.Bytecode.branchControlCounts
+Array (Aiur.G × Aiur.Bytecode.Block) → Option Aiur.Bytecode.Block → List Aiur.Bytecode.ControlCounts
+DEFINITION
+fun branches fallback =>
+  List.map (fun pair => pair.snd.controlCounts) branches.toList ++
+    List.map (fun block => block.controlCounts) fallback.toList
+PREMISE Aiur.Bytecode.Circuit.validateRowCounts
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Circuit → Bool
+DEFINITION
+fun program circuit =>
+  decide (circuit.members.size < Aiur.gSize.toNat) &&
+    match List.mapM (fun index => program.functions[index]?) circuit.members.toList with
+    | none => false
+    | some functions =>
+      (functions.all fun function => decide (function.body.controlCounts.nodes < Aiur.gSize.toNat)) &&
+        decide
+          ((List.map (fun function => function.body.controlCounts.leaves) functions).sum ≤ circuit.layout.selectors)
+PREMISE Aiur.Bytecode.Toplevel.validateRowCounts
+Aiur.Bytecode.Toplevel → Bool
+DEFINITION
+fun program => program.circuits.all (Aiur.Bytecode.Circuit.validateRowCounts program)
+PREMISE Aiur.Bytecode.ControlCounts.Describes.mk
+∀ {counts : Aiur.Bytecode.ControlCounts} {flow : Aiur.AIR.SelectorFlow},
+  flow.returns.length = counts.returns →
+    flow.yields.length = counts.yields →
+      counts.returns + counts.yields ≤ counts.leaves → counts.leaves ≤ counts.nodes → counts.Describes flow
+PREMISE Aiur.BoundVerifier.build
+(selection : Aiur.BoundVerifier.Selection) → Except String (Aiur.BoundVerifier.Backend selection)
+DEFINITION
+fun selection =>
+  match hc : selection.compile with
+  | Except.error e => Except.error e
+  | Except.ok compiled =>
+    if hs : compiled.getFuncIdx selection.entrypoint = some selection.function then
+      if hr : selection.function < Aiur.gSize.toNat then
+        match hp : compiled.bytecode.functions[selection.function]? with
+        | none => Except.error "selected function is absent"
+        | some entry =>
+          if he : entry.entry = true ∧ entry.constrained = true ∧ entry.layout.inputSize = selection.inputSize then
+            if ho : Aiur.Bytecode.Block.returnsHaveSize selection.success.size entry.body = true then
+              if hl : compiled.bytecode.validateLookupShapes = true then
+                if hn : compiled.bytecode.validateRowCounts = true then
+                  if hi : compiled.bytecode.validateEmission = true then
+                    let system := selection.system compiled;
+                    if hk : system.vkBytes = selection.key then
+                      match hd : Aiur.NativeAIR.KeyCodec.decodeCanonical selection.key with
+                      | none => Except.error "verification key is not a checked canonical v5 artifact"
+                      | some keyData =>
+                        if hm : keyData.parameters = selection.keyParameters then
+                          Except.ok
+                            { compiled := compiled, compilation := hc, system := system, systemBuilt := ⋯,
+                              selected := hs, functionRange := hr, entry := entry, present := hp, publicEntry := ⋯,
+                              constrained := ⋯, arity := ⋯, returnArity := ho, lookupShapes := hl, rowCounts := hn,
+                              emissionChecks := hi, keyBound := hk, keyData := keyData, keyDecoded := hd,
+                              keyParameters := hm }
+                        else Except.error "verification key parameters differ from the selected parameters"
+                    else Except.error "verification key differs from the selected key"
+                  else Except.error "compiled circuit reads an invalid logical value or selector"
+                else Except.error "compiled circuit control counts exceed their bounds"
+              else Except.error "compiled lookup message arities differ"
+            else Except.error "selected success result has the wrong output arity"
+          else Except.error "selected function is not a constrained public entry of the expected arity"
+      else Except.error "function index is not a canonical field element"
+    else Except.error "entrypoint differs from the selected function"
+PREMISE Aiur.AIR.Provider.PaddedEq
+Nat → Aiur.AIR.Provider (List Aiur.G) → Aiur.AIR.Provider (List Aiur.G) → Prop
+DEFINITION
+fun width left right =>
+  left.snd = right.snd ∧ (left.snd ≠ 0 → Aiur.AIR.padMessage width left.fst = Aiur.AIR.padMessage width right.fst)
+PREMISE Aiur.AIR.CircuitEmission.provider
+Aiur.AIR.CircuitEmission → Aiur.AIR.Provider (List Aiur.G)
+DEFINITION
+fun emission => ((emission.lookup 0).snd, emission.multiplicity)
+PREMISE Aiur.AIR.AuxiliaryTables.mk
+List Nat →
+  (Nat → Array Aiur.AIR.MemoryRow) →
+    (Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G) → (Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G) → Aiur.AIR.AuxiliaryTables
+PREMISE Aiur.AIR.AuxiliaryTables.withFunctions
+Aiur.AIR.AuxiliaryTables → List Aiur.AIR.FunctionRow → Aiur.AIR.LookupTables
+DEFINITION
+fun tables functions =>
+  { functions := functions, memoryWidths := tables.memoryWidths, memory := tables.memory, byte1 := tables.byte1,
+    byte2 := tables.byte2 }
+PREMISE Aiur.AIR.AuxiliaryTables.providers
+Aiur.AIR.AuxiliaryTables → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun tables =>
+  List.flatMap
+        (fun width =>
+          Aiur.AIR.mapProviders (fun request => Aiur.AIR.memoryMessage width request.fst request.snd)
+            (Aiur.AIR.memoryProviders (tables.memory width)))
+        tables.memoryWidths ++
+      Aiur.AIR.byte1Providers tables.byte1 ++
+    Aiur.AIR.byte2Providers tables.byte2
+PREMISE Aiur.AIR.AuxiliaryTables.circuitProviders
+Aiur.AIR.AuxiliaryTables → List Aiur.AIR.CircuitEmission → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun tables emissions => Aiur.AIR.circuitProviders emissions ++ tables.providers
+PREMISE Aiur.AIR.circuitProviders
+List Aiur.AIR.CircuitEmission → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun emissions => List.map Aiur.AIR.CircuitEmission.provider emissions
+PREMISE Aiur.AIR.FunctionRow.Provides
+Nat → Aiur.AIR.CircuitEmission → Aiur.AIR.FunctionRow → Prop
+DEFINITION
+fun width emission row =>
+  Aiur.AIR.Provider.PaddedEq width emission.provider (Aiur.AIR.functionMessage row.request, row.multiplicity)
+PREMISE Aiur.AIR.FunctionRow.inactive
+Aiur.AIR.FunctionRow
+DEFINITION
+{ request := { function := 0, inputs := #[], outputs := #[], rank := 0 }, calls := [], rankBytes := fun x => 0,
+  selector := 0, multiplicity := 0 }
+PREMISE Aiur.AIR.FunctionRow.QueriesIn
+List (List Aiur.G) → Aiur.AIR.FunctionRow → Prop
+DEFINITION
+fun queries row =>
+  row.selector = 1 →
+    List.map Aiur.AIR.functionMessage row.requests ⊆ queries ∧ List.map Aiur.AIR.rangeMessage row.byteQueries ⊆ queries
+PREMISE Aiur.AIR.CircuitWitness.mk
+Aiur.Bytecode.Circuit → (Nat → Aiur.G) → Aiur.AIR.CircuitEmission → Aiur.AIR.CircuitWitness
+PREMISE Aiur.AIR.CircuitWitness.Emitted
+Aiur.Bytecode.Toplevel → Aiur.AIR.CircuitWitness → Prop
+DEFINITION
+fun program witness => Aiur.Bytecode.Circuit.emitRow witness.values program witness.circuit = some witness.emission
+PREMISE Aiur.AIR.CircuitWitness.Satisfied
+Aiur.AIR.CircuitWitness → Prop
+DEFINITION
+fun witness => ∀ (equation : Aiur.G), equation ∈ witness.emission.equations → equation = 0
+PREMISE Aiur.AIR.CircuitWitness.Shapes
+Aiur.Bytecode.Toplevel → Aiur.AIR.CircuitWitness → Prop
+DEFINITION
+fun program witness =>
+  ∀ (part : Aiur.AIR.MemberEmission),
+    part ∈ witness.emission.members → Aiur.Bytecode.Block.lookupShapes program none part.function.body = true
+PREMISE Aiur.AIR.CircuitWitness.LookupBounds
+Aiur.AIR.CircuitWitness → Prop
+DEFINITION
+fun witness =>
+  4 ≤ witness.circuit.layout.lookups ∧
+    ∀ (part : Aiur.AIR.MemberEmission),
+      part ∈ witness.emission.members → part.body.lookup ≤ witness.circuit.layout.lookups
+PREMISE Aiur.Bytecode.Function.hasTerminalControl
+Aiur.Bytecode.Function → Bool
+DEFINITION
+fun function =>
+  match function.body.ctrl with
+  | Aiur.Bytecode.Ctrl.return a a_1 => true
+  | Aiur.Bytecode.Ctrl.yield a a_1 => true
+  | x => false
+PREMISE Aiur.Bytecode.circuitBranchless
+Nat → List Aiur.Bytecode.Function → Bool
+DEFINITION
+fun selectors functions =>
+  selectors == 1 &&
+    match functions with
+    | [function] => function.hasTerminalControl
+    | x => false
+PREMISE Aiur.AIR.unitQuerySelectors
+List Aiur.AIR.QueryPart → List Aiur.AIR.QueryPart
+DEFINITION
+fun queries => List.map (fun query => { slot := query.slot, selector := 1, message := query.message }) queries
+PREMISE Aiur.AIR.QueryWriters
+Nat → Nat → List Aiur.AIR.QueryPart → Prop
+DEFINITION
+fun start finish queries => Aiur.AIR.QuerySlots 1 start finish (Aiur.AIR.unitQuerySelectors queries)
+PREMISE Aiur.AIR.encodedCircuitQueryPool
+List Aiur.AIR.CircuitEmission → List (List Aiur.G)
+DEFINITION
+fun emissions =>
+  List.flatMap (fun emission => Aiur.AIR.encodedQueries emission.branchless emission.queries emission.lookupCount)
+    emissions
+PREMISE Aiur.AIR.CircuitTraces.nil
+Aiur.AIR.CircuitTraces []
+PREMISE Aiur.AIR.CircuitTraces.inactive
+(circuit : Aiur.Bytecode.Circuit) →
+  {circuits : List Aiur.Bytecode.Circuit} →
+    Aiur.AIR.CircuitTraces circuits → Aiur.AIR.CircuitTraces (circuit :: circuits)
+PREMISE Aiur.AIR.CircuitTraces.active
+(circuit : Aiur.Bytecode.Circuit) →
+  (degree : Nat) →
+    (Fin (2 ^ degree) → Nat → Aiur.G) →
+      {circuits : List Aiur.Bytecode.Circuit} →
+        Aiur.AIR.CircuitTraces circuits → Aiur.AIR.CircuitTraces (circuit :: circuits)
+PREMISE Aiur.AIR.CircuitTraces.bitmap
+{circuits : List Aiur.Bytecode.Circuit} → Aiur.AIR.CircuitTraces circuits → List Bool
+DEFINITION
+fun {circuits} x => Aiur.AIR.CircuitTraces.brecOn x @Aiur.AIR.CircuitTraces.bitmap._f
+PREMISE Aiur.AIR.CircuitTraces.degrees
+{circuits : List Aiur.Bytecode.Circuit} → Aiur.AIR.CircuitTraces circuits → List Nat
+DEFINITION
+fun {circuits} x => Aiur.AIR.CircuitTraces.brecOn x @Aiur.AIR.CircuitTraces.degrees._f
+PREMISE Aiur.AIR.CircuitTraces.capacity
+{circuits : List Aiur.Bytecode.Circuit} → Aiur.AIR.CircuitTraces circuits → Nat
+DEFINITION
+fun {circuits} x => Aiur.AIR.CircuitTraces.brecOn x @Aiur.AIR.CircuitTraces.capacity._f
+PREMISE Aiur.AIR.emitCircuitWitness
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Circuit → (Nat → Aiur.G) → Option Aiur.AIR.CircuitWitness
+DEFINITION
+fun program circuit values => do
+  let emission ← Aiur.Bytecode.Circuit.emitRow values program circuit
+  pure { circuit := circuit, values := values, emission := emission }
+PREMISE Aiur.AIR.CircuitTraces.emitWitnesses
+{circuits : List Aiur.Bytecode.Circuit} →
+  Aiur.Bytecode.Toplevel → Aiur.AIR.CircuitTraces circuits → Option (List Aiur.AIR.CircuitWitness)
+DEFINITION
+fun {circuits} program x => Aiur.AIR.CircuitTraces.brecOn x (@Aiur.AIR.CircuitTraces.emitWitnesses._f program)
+PREMISE Aiur.Bytecode.Toplevel.singletonCircuits
+Aiur.Bytecode.Toplevel → (Aiur.Bytecode.FunIdx → String) → Array Aiur.Bytecode.Circuit
+DEFINITION
+fun t nameOf =>
+  (have circuits := #[];
+    do
+    let __s ←
+      forIn' [:t.functions.size] circuits fun i h __s =>
+          have circuits := __s;
+          have f := t.functions[i];
+          if f.constrained = true then
+            have circuits := circuits.push { name := nameOf i, members := #[i], layout := f.layout };
+            pure (ForInStep.yield circuits)
+          else pure (ForInStep.yield circuits)
+    have circuits : Array Aiur.Bytecode.Circuit := __s
+    pure circuits).run
+PREMISE Aiur.Bytecode.MembersConstrained
+Array Aiur.Bytecode.Function → Array Aiur.Bytecode.FunIdx → Prop
+DEFINITION
+fun functions members =>
+  ∀ (index : Aiur.Bytecode.FunIdx),
+    index ∈ members → ∃ function, functions[index]? = some function ∧ function.constrained = true
+PREMISE Aiur.Bytecode.CircuitsConstrained
+Array Aiur.Bytecode.Function → Array Aiur.Bytecode.Circuit → Prop
+DEFINITION
+fun functions circuits =>
+  ∀ (circuit : Aiur.Bytecode.Circuit), circuit ∈ circuits → Aiur.Bytecode.MembersConstrained functions circuit.members
+PREMISE Aiur.Bytecode.Op.lookupUsage
+Aiur.Bytecode.Op → Nat
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Op.call a a_1 outputSize unconstrained => if unconstrained = true then 0 else 4
+  | Aiur.Bytecode.Op.store a => 1
+  | Aiur.Bytecode.Op.load size a => 1
+  | Aiur.Bytecode.Op.u8BitDecomposition a => 1
+  | Aiur.Bytecode.Op.u8ShiftLeft a => 1
+  | Aiur.Bytecode.Op.u8ShiftRight a => 1
+  | Aiur.Bytecode.Op.u8Xor a a_1 => 1
+  | Aiur.Bytecode.Op.u8And a a_1 => 1
+  | Aiur.Bytecode.Op.u8Or a a_1 => 1
+  | Aiur.Bytecode.Op.u8Add a a_1 => 1
+  | Aiur.Bytecode.Op.u8Sub a a_1 => 1
+  | Aiur.Bytecode.Op.u8Mul a a_1 => 1
+  | Aiur.Bytecode.Op.u8XorSplit7 a a_1 => 1
+  | Aiur.Bytecode.Op.u8XorSplit4 a a_1 => 1
+  | Aiur.Bytecode.Op.u8LessThan a a_1 => 1
+  | Aiur.Bytecode.Op.u8RangeCheck a a_1 => 1
+  | Aiur.Bytecode.Op.u32LessThan a a_1 => 6
+  | x => 0
+PREMISE Aiur.Bytecode.Ctrl.lookupUsage
+Aiur.Bytecode.Ctrl → Nat
+DEFINITION
+fun a => Aiur.Bytecode.Ctrl.lookupUsage._mutual (PSum.inl a)
+PREMISE Aiur.Bytecode.Block.lookupUsage
+Aiur.Bytecode.Block → Nat
+DEFINITION
+fun block => Aiur.Bytecode.Ctrl.lookupUsage._mutual (PSum.inr block)
+PREMISE Aiur.Bytecode.branchLookupUsage
+Array (Aiur.G × Aiur.Bytecode.Block) → Option Aiur.Bytecode.Block → Nat
+DEFINITION
+fun branches fallback =>
+  List.foldl Nat.max 0
+    (List.map (fun pair => pair.snd.lookupUsage) branches.toList ++
+      List.map (fun block => block.lookupUsage) fallback.toList)
+PREMISE Aiur.Bytecode.Function.LookupLayout
+Aiur.Bytecode.Function → Prop
+DEFINITION
+fun function => function.layout.lookups = 4 + function.body.lookupUsage
+PREMISE Aiur.Bytecode.FunctionsLookupLayout
+Array Aiur.Bytecode.Function → Prop
+DEFINITION
+fun functions => ∀ (function : Aiur.Bytecode.Function), function ∈ functions → function.LookupLayout
+PREMISE Aiur.Bytecode.MembersLookupBound
+Array Aiur.Bytecode.Function → Array Aiur.Bytecode.FunIdx → Nat → Prop
+DEFINITION
+fun functions members slots =>
+  4 ≤ slots ∧ ∀ (index : Aiur.Bytecode.FunIdx), index ∈ members → functions[index]!.layout.lookups ≤ slots
+PREMISE Aiur.Bytecode.CircuitsLookupBound
+Array Aiur.Bytecode.Function → Array Aiur.Bytecode.Circuit → Prop
+DEFINITION
+fun functions circuits =>
+  ∀ (circuit : Aiur.Bytecode.Circuit),
+    circuit ∈ circuits → Aiur.Bytecode.MembersLookupBound functions circuit.members circuit.layout.lookups
+PREMISE Aiur.AIR.MemoryColumns
+Nat → Type
+DEFINITION
+fun width => Fin (3 + width) → Aiur.G
+PREMISE Aiur.AIR.decodeMemoryRow
+(width : Nat) → Aiur.AIR.MemoryColumns width → Aiur.AIR.MemoryRow
+DEFINITION
+fun width columns =>
+  { selector := columns ⟨1, ⋯⟩, multiplicity := columns ⟨0, ⋯⟩, pointer := columns ⟨2, ⋯⟩,
+    contents := Array.ofFn fun i => columns ⟨3 + ↑i, ⋯⟩ }
+PREMISE Aiur.AIR.memoryColumnEquations
+(width : Nat) → Aiur.AIR.MemoryColumns width → Aiur.AIR.MemoryColumns width → Aiur.G → List Aiur.G
+DEFINITION
+fun width current next transition =>
+  have selector := current ⟨1, ⋯⟩;
+  have nextSelector := next ⟨1, ⋯⟩;
+  [selector * (selector - 1), current ⟨0, ⋯⟩ * (1 - selector), nextSelector * transition * (selector - 1),
+    nextSelector * transition * (current ⟨2, ⋯⟩ + 1 - next ⟨2, ⋯⟩)]
+PREMISE Aiur.AIR.memoryColumnLookup
+(width : Nat) → Aiur.AIR.MemoryColumns width → Aiur.G × List Aiur.G
+DEFINITION
+fun width columns =>
+  (0 - columns ⟨0, ⋯⟩,
+    List.map (fun value => columns ⟨1, ⋯⟩ * value)
+      (Aiur.AIR.memoryMessage width (columns ⟨2, ⋯⟩) (Aiur.AIR.decodeMemoryRow width columns).contents))
+PREMISE Aiur.AIR.memoryColumnProvider
+(width : Nat) → Aiur.AIR.MemoryColumns width → Aiur.AIR.Provider (List Aiur.G)
+DEFINITION
+fun width columns => ((Aiur.AIR.memoryColumnLookup width columns).snd, columns ⟨0, ⋯⟩)
+PREMISE Aiur.AIR.memoryNextIndex
+{height : Nat} → Fin height → Fin height
+DEFINITION
+fun {height} index => if next : ↑index + 1 < height then ⟨↑index + 1, next⟩ else ⟨0, ⋯⟩
+PREMISE Aiur.AIR.memoryMatrixEquations
+(width height : Nat) → (Fin height → Aiur.AIR.MemoryColumns width) → Fin height → List Aiur.G
+DEFINITION
+fun width height matrix index =>
+  Aiur.AIR.memoryColumnEquations width (matrix index) (matrix (Aiur.AIR.memoryNextIndex index))
+    (if ↑index + 1 < height then 1 else 0)
+PREMISE Aiur.AIR.MemoryMatrixSatisfied
+(width height : Nat) → (Fin height → Aiur.AIR.MemoryColumns width) → Prop
+DEFINITION
+fun width height matrix =>
+  ∀ (index : Fin height) (equation : Aiur.G),
+    equation ∈ Aiur.AIR.memoryMatrixEquations width height matrix index → equation = 0
+PREMISE Aiur.AIR.decodeMemoryRows
+(width height : Nat) → (Fin height → Aiur.AIR.MemoryColumns width) → Array Aiur.AIR.MemoryRow
+DEFINITION
+fun width height matrix => Array.ofFn fun index => Aiur.AIR.decodeMemoryRow width (matrix index)
+PREMISE Aiur.AIR.memoryMatrixProviders
+(width height : Nat) → (Fin height → Aiur.AIR.MemoryColumns width) → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun width height matrix => List.ofFn fun index => Aiur.AIR.memoryColumnProvider width (matrix index)
+PREMISE Aiur.AIR.MemoryTraces.nil
+Aiur.AIR.MemoryTraces []
+PREMISE Aiur.AIR.MemoryTraces.inactive
+(width : Nat) → {widths : List Nat} → Aiur.AIR.MemoryTraces widths → Aiur.AIR.MemoryTraces (width :: widths)
+PREMISE Aiur.AIR.MemoryTraces.active
+(width degree : Nat) →
+  (Fin (2 ^ degree) → Aiur.AIR.MemoryColumns width) →
+    {widths : List Nat} → Aiur.AIR.MemoryTraces widths → Aiur.AIR.MemoryTraces (width :: widths)
+PREMISE Aiur.AIR.MemoryTraces.bitmap
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → List Bool
+DEFINITION
+fun {widths} x => Aiur.AIR.MemoryTraces.brecOn x @Aiur.AIR.MemoryTraces.bitmap._f
+PREMISE Aiur.AIR.MemoryTraces.degrees
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → List Nat
+DEFINITION
+fun {widths} x => Aiur.AIR.MemoryTraces.brecOn x @Aiur.AIR.MemoryTraces.degrees._f
+PREMISE Aiur.AIR.MemoryTraces.capacity
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → Nat
+DEFINITION
+fun {widths} x => Aiur.AIR.MemoryTraces.brecOn x @Aiur.AIR.MemoryTraces.capacity._f
+PREMISE Aiur.AIR.MemoryTraces.rows
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → Nat → Array Aiur.AIR.MemoryRow
+DEFINITION
+fun {widths} x x_1 =>
+  Aiur.AIR.MemoryTraces.brecOn (motive := fun {widths} x => Nat → Array Aiur.AIR.MemoryRow) x
+    (@Aiur.AIR.MemoryTraces.rows._f) x_1
+PREMISE Aiur.AIR.MemoryTraces.providers
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun {widths} x => Aiur.AIR.MemoryTraces.brecOn x @Aiur.AIR.MemoryTraces.providers._f
+PREMISE Aiur.AIR.MemoryTraces.Satisfied
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → Prop
+DEFINITION
+fun {widths} x => Aiur.AIR.MemoryTraces.brecOn x @Aiur.AIR.MemoryTraces.Satisfied._f
+PREMISE Aiur.AIR.memoryTableProviders
+List Nat → (Nat → Array Aiur.AIR.MemoryRow) → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun widths rows =>
+  List.flatMap
+    (fun width =>
+      Aiur.AIR.mapProviders (fun request => Aiur.AIR.memoryMessage width request.fst request.snd)
+        (Aiur.AIR.memoryProviders (rows width)))
+    widths
+PREMISE Aiur.AIR.MemoryTraces.auxiliary
+{widths : List Nat} →
+  Aiur.AIR.MemoryTraces widths →
+    (Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G) → (Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G) → Aiur.AIR.AuxiliaryTables
+DEFINITION
+fun {widths} traces byte1 byte2 => { memoryWidths := widths, memory := traces.rows, byte1 := byte1, byte2 := byte2 }
+PREMISE Aiur.fixedTraceHeights
+List Nat → List Bool → List Nat → Bool
+DEFINITION
+fun x x_1 x_2 => List.brecOn (motive := fun x => List Bool → List Nat → Bool) x Aiur.fixedTraceHeights._f x_1 x_2
+PREMISE Aiur.FixedTraceHeights.nil
+Aiur.FixedTraceHeights [] [] []
+PREMISE Aiur.FixedTraceHeights.inactive
+∀ {heights : List Nat} {active : List Bool} {degrees : List Nat},
+  Aiur.FixedTraceHeights heights active degrees → Aiur.FixedTraceHeights (0 :: heights) (false :: active) degrees
+PREMISE Aiur.FixedTraceHeights.active
+∀ (height degree : Nat) {heights : List Nat} {active : List Bool} {degrees : List Nat},
+  height = 0 ∨ degree < 64 ∧ height = 2 ^ degree →
+    Aiur.FixedTraceHeights heights active degrees →
+      Aiur.FixedTraceHeights (height :: heights) (true :: active) (degree :: degrees)
+PREMISE Aiur.AIR.Byte1Columns
+Type
+DEFINITION
+Fin 3 → Aiur.G
+PREMISE Aiur.AIR.Byte2Columns
+Type
+DEFINITION
+Fin 10 → Aiur.G
+PREMISE Aiur.AIR.Byte1Kind.column
+Aiur.AIR.Byte1Kind → Fin 3
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.AIR.Byte1Kind.bits => 0
+  | Aiur.AIR.Byte1Kind.shiftLeft => 1
+  | Aiur.AIR.Byte1Kind.shiftRight => 2
+PREMISE Aiur.AIR.Byte2Kind.column
+Aiur.AIR.Byte2Kind → Fin 10
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.AIR.Byte2Kind.xor => 0
+  | Aiur.AIR.Byte2Kind.add => 1
+  | Aiur.AIR.Byte2Kind.sub => 2
+  | Aiur.AIR.Byte2Kind.and => 3
+  | Aiur.AIR.Byte2Kind.or => 4
+  | Aiur.AIR.Byte2Kind.lessThan => 5
+  | Aiur.AIR.Byte2Kind.range => 6
+  | Aiur.AIR.Byte2Kind.mul => 7
+  | Aiur.AIR.Byte2Kind.split7 => 8
+  | Aiur.AIR.Byte2Kind.split4 => 9
+PREMISE Aiur.AIR.byte1PreprocessedColumns
+Fin 256 → Fin 11 → Aiur.G
+DEFINITION
+fun row column => (Aiur.AIR.byte1Preprocessed row)[↑column]?.getD 0
+PREMISE Aiur.AIR.byte2PreprocessedColumns
+Fin 65536 → Fin 14 → Aiur.G
+DEFINITION
+fun row column => (Aiur.AIR.byte2Preprocessed row)[↑column]?.getD 0
+PREMISE Aiur.AIR.byte1ColumnLookup
+Aiur.AIR.Byte1Kind → (Fin 11 → Aiur.G) → Aiur.AIR.Byte1Columns → Aiur.G × List Aiur.G
+DEFINITION
+fun kind preprocessed columns =>
+  (0 - columns kind.column,
+    match kind with
+    | Aiur.AIR.Byte1Kind.bits => [2, preprocessed 0] ++ List.ofFn fun bit => preprocessed ⟨1 + ↑bit, ⋯⟩
+    | Aiur.AIR.Byte1Kind.shiftLeft => [3, preprocessed 0, preprocessed 9]
+    | Aiur.AIR.Byte1Kind.shiftRight => [4, preprocessed 0, preprocessed 10])
+PREMISE Aiur.AIR.byte2ColumnLookup
+Aiur.AIR.Byte2Kind → (Fin 14 → Aiur.G) → Aiur.AIR.Byte2Columns → Aiur.G × List Aiur.G
+DEFINITION
+fun kind preprocessed columns =>
+  (0 - columns kind.column,
+    [kind.channel, preprocessed 0, preprocessed 1] ++
+      match kind with
+      | Aiur.AIR.Byte2Kind.xor => [preprocessed 2]
+      | Aiur.AIR.Byte2Kind.add => [preprocessed 3]
+      | Aiur.AIR.Byte2Kind.sub => [preprocessed 4]
+      | Aiur.AIR.Byte2Kind.and => [preprocessed 5]
+      | Aiur.AIR.Byte2Kind.or => [preprocessed 6]
+      | Aiur.AIR.Byte2Kind.lessThan => [preprocessed 7]
+      | Aiur.AIR.Byte2Kind.range => []
+      | Aiur.AIR.Byte2Kind.mul => [preprocessed 8, preprocessed 9]
+      | Aiur.AIR.Byte2Kind.split7 => [preprocessed 10, preprocessed 11]
+      | Aiur.AIR.Byte2Kind.split4 => [preprocessed 12, preprocessed 13])
+PREMISE Aiur.AIR.byte1ColumnProvider
+Aiur.AIR.Byte1Kind → Fin 256 → Aiur.AIR.Byte1Columns → Aiur.AIR.Provider (List Aiur.G)
+DEFINITION
+fun kind row columns =>
+  ((Aiur.AIR.byte1ColumnLookup kind (Aiur.AIR.byte1PreprocessedColumns row) columns).snd, columns kind.column)
+PREMISE Aiur.AIR.byte2ColumnProvider
+Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.AIR.Byte2Columns → Aiur.AIR.Provider (List Aiur.G)
+DEFINITION
+fun kind row columns =>
+  ((Aiur.AIR.byte2ColumnLookup kind (Aiur.AIR.byte2PreprocessedColumns row) columns).snd, columns kind.column)
+PREMISE Aiur.AIR.byte1MatrixProviders
+(Fin 256 → Aiur.AIR.Byte1Columns) → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun matrix =>
+  List.flatMap
+    (fun row => List.map (fun kind => Aiur.AIR.byte1ColumnProvider kind row (matrix row)) Aiur.AIR.Byte1Kind.all)
+    (List.finRange 256)
+PREMISE Aiur.AIR.byte2MatrixProviders
+(Fin 65536 → Aiur.AIR.Byte2Columns) → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun matrix =>
+  List.flatMap
+    (fun row => List.map (fun kind => Aiur.AIR.byte2ColumnProvider kind row (matrix row)) Aiur.AIR.Byte2Kind.all)
+    (List.finRange 65536)
+PREMISE Aiur.AIR.ByteTraces.mk
+(Fin 256 → Aiur.AIR.Byte1Columns) → (Fin 65536 → Aiur.AIR.Byte2Columns) → Aiur.AIR.ByteTraces
+PREMISE Aiur.AIR.ByteTraces.providers
+Aiur.AIR.ByteTraces → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun traces => Aiur.AIR.byte1MatrixProviders traces.unary ++ Aiur.AIR.byte2MatrixProviders traces.binary
+PREMISE Aiur.AIR.ByteTraces.byte1Weights
+Aiur.AIR.ByteTraces → Aiur.AIR.Byte1Kind → Fin 256 → Aiur.G
+DEFINITION
+fun traces kind row => traces.unary row kind.column
+PREMISE Aiur.AIR.ByteTraces.byte2Weights
+Aiur.AIR.ByteTraces → Aiur.AIR.Byte2Kind → Fin 65536 → Aiur.G
+DEFINITION
+fun traces kind row => traces.binary row kind.column
+PREMISE Aiur.AIR.SystemTraces.mk
+{program : Aiur.Bytecode.Toplevel} →
+  Aiur.AIR.CircuitTraces program.circuits.toList →
+    Aiur.AIR.MemoryTraces program.memorySizes.toList → Aiur.AIR.ByteTraces → Aiur.AIR.SystemTraces program
+PREMISE Aiur.AIR.SystemTraces.bitmap
+{program : Aiur.Bytecode.Toplevel} → Aiur.AIR.SystemTraces program → List Bool
+DEFINITION
+fun {program} traces => traces.functions.bitmap ++ (traces.memories.bitmap ++ [true, true])
+PREMISE Aiur.AIR.SystemTraces.degrees
+{program : Aiur.Bytecode.Toplevel} → Aiur.AIR.SystemTraces program → List Nat
+DEFINITION
+fun {program} traces => traces.functions.degrees ++ (traces.memories.degrees ++ [8, 16])
+PREMISE Aiur.AIR.SystemTraces.queryBound
+{program : Aiur.Bytecode.Toplevel} → Aiur.AIR.SystemTraces program → Option Nat
+DEFINITION
+fun {program} traces => Aiur.lookupQueryBound (Aiur.AIR.systemLookupSlots program) traces.bitmap traces.degrees
+PREMISE Aiur.AIR.SystemTraces.providers
+{program : Aiur.Bytecode.Toplevel} →
+  Aiur.AIR.SystemTraces program → List Aiur.AIR.CircuitEmission → List (Aiur.AIR.Provider (List Aiur.G))
+DEFINITION
+fun {program} traces circuits =>
+  Aiur.AIR.circuitProviders circuits ++ (traces.memories.providers ++ traces.bytes.providers)
+PREMISE Aiur.AIR.systemFixedHeights
+Aiur.Bytecode.Toplevel → List Nat
+DEFINITION
+fun program => List.replicate program.circuits.size 0 ++ (List.replicate program.memorySizes.size 0 ++ [256, 65536])
+PREMISE Aiur.AIR.systemLookupSlots
+Aiur.Bytecode.Toplevel → List Nat
+DEFINITION
+fun program =>
+  List.map (fun x => x.layout.lookups) program.circuits.toList ++ (List.replicate program.memorySizes.size 1 ++ [3, 10])
+PREMISE Aiur.NativeAIR.Source.preprocessed
+Aiur.NativeAIR.Source
+PREMISE Aiur.NativeAIR.Source.main
+Aiur.NativeAIR.Source
+PREMISE Aiur.NativeAIR.Source.stage2
+Aiur.NativeAIR.Source
+PREMISE Aiur.NativeAIR.RowOffset.current
+Aiur.NativeAIR.RowOffset
+PREMISE Aiur.NativeAIR.RowOffset.next
+Aiur.NativeAIR.RowOffset
+PREMISE Aiur.NativeAIR.ColRef.mk
+Aiur.NativeAIR.Source → Aiur.NativeAIR.RowOffset → Nat → Aiur.NativeAIR.ColRef
+PREMISE Aiur.NativeAIR.Node.konst
+Aiur.G → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.var
+Aiur.NativeAIR.ColRef → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.publicInput
+Nat → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.isFirstRow
+Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.isLastRow
+Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.isTransition
+Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.add
+Nat → Nat → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.sub
+Nat → Nat → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.mul
+Nat → Nat → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.Node.neg
+Nat → Aiur.NativeAIR.Node
+PREMISE Aiur.NativeAIR.GraphWidths.mk
+Nat → Nat → Nat → Nat → Aiur.NativeAIR.GraphWidths
+PREMISE Aiur.NativeAIR.GraphWidths.width
+Aiur.NativeAIR.GraphWidths → Aiur.NativeAIR.Source → Nat
+DEFINITION
+fun widths x =>
+  match x with
+  | Aiur.NativeAIR.Source.preprocessed => widths.preprocessed
+  | Aiur.NativeAIR.Source.main => widths.main
+  | Aiur.NativeAIR.Source.stage2 => widths.stage2
+PREMISE Aiur.NativeAIR.Lookup.mk
+Nat → List Nat → Aiur.NativeAIR.Lookup
+PREMISE Aiur.NativeAIR.Graph.mk
+List Aiur.NativeAIR.Node → List Nat → List Aiur.NativeAIR.Lookup → Aiur.NativeAIR.Graph
+PREMISE Aiur.NativeAIR.Lookup.roots
+Aiur.NativeAIR.Lookup → List Nat
+DEFINITION
+fun lookup => lookup.multiplicity :: lookup.args
+PREMISE Aiur.NativeAIR.Graph.lookupRoots
+Aiur.NativeAIR.Graph → List Nat
+DEFINITION
+fun graph => List.flatMap Aiur.NativeAIR.Lookup.roots graph.lookups
+PREMISE Aiur.NativeAIR.Graph.lookupPrefix
+Aiur.NativeAIR.Graph → Nat
+DEFINITION
+fun graph => List.foldr (fun index rest => max (index + 1) rest) 0 graph.lookupRoots
+PREMISE Aiur.NativeAIR.Node.Valid
+Aiur.NativeAIR.GraphWidths → Nat → Nat → Aiur.NativeAIR.Node → Prop
+DEFINITION
+fun widths lookupEnd index x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value => True
+  | Aiur.NativeAIR.Node.isFirstRow => True
+  | Aiur.NativeAIR.Node.isLastRow => True
+  | Aiur.NativeAIR.Node.isTransition => True
+  | Aiur.NativeAIR.Node.var column =>
+    column.index < widths.width column.source ∧ (column.source = Aiur.NativeAIR.Source.stage2 → lookupEnd ≤ index)
+  | Aiur.NativeAIR.Node.publicInput input => input < widths.publics
+  | Aiur.NativeAIR.Node.add a b => a < index ∧ b < index
+  | Aiur.NativeAIR.Node.sub a b => a < index ∧ b < index
+  | Aiur.NativeAIR.Node.mul a b => a < index ∧ b < index
+  | Aiur.NativeAIR.Node.neg a => a < index
+PREMISE Aiur.NativeAIR.Node.check
+Aiur.NativeAIR.GraphWidths → Nat → Nat → Aiur.NativeAIR.Node → Bool
+DEFINITION
+fun widths lookupEnd index x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value => true
+  | Aiur.NativeAIR.Node.isFirstRow => true
+  | Aiur.NativeAIR.Node.isLastRow => true
+  | Aiur.NativeAIR.Node.isTransition => true
+  | Aiur.NativeAIR.Node.var column =>
+    decide (column.index < widths.width column.source) &&
+      (column.source != Aiur.NativeAIR.Source.stage2 || decide (lookupEnd ≤ index))
+  | Aiur.NativeAIR.Node.publicInput input => decide (input < widths.publics)
+  | Aiur.NativeAIR.Node.add a b => decide (a < index) && decide (b < index)
+  | Aiur.NativeAIR.Node.sub a b => decide (a < index) && decide (b < index)
+  | Aiur.NativeAIR.Node.mul a b => decide (a < index) && decide (b < index)
+  | Aiur.NativeAIR.Node.neg a => decide (a < index)
+PREMISE Aiur.NativeAIR.checkNodes
+Aiur.NativeAIR.GraphWidths → Nat → Nat → List Aiur.NativeAIR.Node → Bool
+DEFINITION
+fun widths lookupEnd x x_1 =>
+  List.brecOn (motive := fun x => Nat → Bool) x_1 (Aiur.NativeAIR.checkNodes._f widths lookupEnd) x
+PREMISE Aiur.NativeAIR.ValidNodes.nil
+∀ {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd : Nat} (index : Nat),
+  Aiur.NativeAIR.ValidNodes widths lookupEnd index []
+PREMISE Aiur.NativeAIR.ValidNodes.cons
+∀ {widths : Aiur.NativeAIR.GraphWidths} {lookupEnd index : Nat} {node : Aiur.NativeAIR.Node}
+  {nodes : List Aiur.NativeAIR.Node},
+  Aiur.NativeAIR.Node.Valid widths lookupEnd index node →
+    Aiur.NativeAIR.ValidNodes widths lookupEnd (index + 1) nodes →
+      Aiur.NativeAIR.ValidNodes widths lookupEnd index (node :: nodes)
+PREMISE Aiur.NativeAIR.checkedGraphPrefix
+Aiur.NativeAIR.GraphWidths → Aiur.NativeAIR.Graph → Option Nat
+DEFINITION
+fun widths graph =>
+  if
+      (((graph.zeros.all fun x => decide (x < graph.nodes.length)) &&
+            graph.lookupRoots.all fun x => decide (x < graph.nodes.length)) &&
+          Aiur.NativeAIR.checkNodes widths graph.lookupPrefix 0 graph.nodes) =
+        true then
+    some graph.lookupPrefix
+  else none
+PREMISE Aiur.NativeAIR.Graph.Valid.mk
+∀ {widths : Aiur.NativeAIR.GraphWidths} {graph : Aiur.NativeAIR.Graph},
+  Aiur.NativeAIR.ValidNodes widths graph.lookupPrefix 0 graph.nodes →
+    (∀ (index : Nat), index ∈ graph.zeros → index < graph.nodes.length) →
+      (∀ (index : Nat), index ∈ graph.lookupRoots → index < graph.nodes.length) →
+        Aiur.NativeAIR.Graph.Valid widths graph
+PREMISE Aiur.NativeAIR.EvalOps.mk
+{W : Type u} → (Aiur.G → W) → (W → W → W) → (W → W → W) → (W → W → W) → (W → W) → Aiur.NativeAIR.EvalOps W
+PREMISE Aiur.NativeAIR.Values.mk
+{W : Type u} →
+  (Aiur.NativeAIR.Source → Aiur.NativeAIR.RowOffset → Array W) → Array W → W → W → W → Aiur.NativeAIR.Values W
+PREMISE Aiur.NativeAIR.Values.Fits
+{W : Type u_1} → Aiur.NativeAIR.Values W → Aiur.NativeAIR.GraphWidths → Prop
+DEFINITION
+fun {W} values widths =>
+  (∀ (source : Aiur.NativeAIR.Source) (offset : Aiur.NativeAIR.RowOffset),
+      (values.columns source offset).size = widths.width source) ∧
+    values.publics.size = widths.publics
+PREMISE Aiur.NativeAIR.Node.eval
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Array W → Aiur.NativeAIR.Node → Option W
+DEFINITION
+fun {W} ops values buffer x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value => some (ops.konst value)
+  | Aiur.NativeAIR.Node.var column => (values.columns column.source column.offset)[column.index]?
+  | Aiur.NativeAIR.Node.publicInput index => values.publics[index]?
+  | Aiur.NativeAIR.Node.isFirstRow => some values.isFirstRow
+  | Aiur.NativeAIR.Node.isLastRow => some values.isLastRow
+  | Aiur.NativeAIR.Node.isTransition => some values.isTransition
+  | Aiur.NativeAIR.Node.add a b => do
+    let __do_lift ← buffer[a]?
+    let __do_lift_1 ← buffer[b]?
+    pure (ops.add __do_lift __do_lift_1)
+  | Aiur.NativeAIR.Node.sub a b => do
+    let __do_lift ← buffer[a]?
+    let __do_lift_1 ← buffer[b]?
+    pure (ops.sub __do_lift __do_lift_1)
+  | Aiur.NativeAIR.Node.mul a b => do
+    let __do_lift ← buffer[a]?
+    let __do_lift_1 ← buffer[b]?
+    pure (ops.mul __do_lift __do_lift_1)
+  | Aiur.NativeAIR.Node.neg a => do
+    let __do_lift ← buffer[a]?
+    pure (ops.neg __do_lift)
+PREMISE Aiur.NativeAIR.sweepFrom
+{W : Type u_1} →
+  Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → List Aiur.NativeAIR.Node → Array W → Option (Array W)
+DEFINITION
+fun {W} ops values x x_1 =>
+  List.brecOn (motive := fun x => Array W → Option (Array W)) x (Aiur.NativeAIR.sweepFrom._f ops values) x_1
+PREMISE Aiur.NativeAIR.Graph.sweep
+{W : Type u_1} → Aiur.NativeAIR.Graph → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Option (Array W)
+DEFINITION
+fun {W} graph ops values => Aiur.NativeAIR.sweepFrom ops values graph.nodes #[]
+PREMISE Aiur.NativeAIR.Values.withoutStage2
+{W : Type u_1} → Aiur.NativeAIR.Values W → Aiur.NativeAIR.Values W
+DEFINITION
+fun {W} values =>
+  {
+    columns := fun source offset =>
+      match source with
+      | Aiur.NativeAIR.Source.stage2 => #[]
+      | x => values.columns source offset,
+    publics := values.publics, isFirstRow := values.isFirstRow, isLastRow := values.isLastRow,
+    isTransition := values.isTransition }
+PREMISE Aiur.NativeAIR.Graph.sweepLookupPrefix
+{W : Type u_1} → Aiur.NativeAIR.Graph → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Option (Array W)
+DEFINITION
+fun {W} graph ops values =>
+  Aiur.NativeAIR.sweepFrom ops values.withoutStage2 (List.take graph.lookupPrefix graph.nodes) #[]
+PREMISE Aiur.NativeAIR.Expr.konst
+Aiur.G → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.var
+Aiur.NativeAIR.ColRef → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.publicInput
+Nat → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.isFirstRow
+Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.isLastRow
+Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.isTransition
+Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.add
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.sub
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.mul
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.neg
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+PREMISE Aiur.NativeAIR.Expr.eval
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Aiur.NativeAIR.Expr → Option W
+DEFINITION
+fun {W} ops values x => Aiur.NativeAIR.Expr.brecOn x (Aiur.NativeAIR.Expr.eval._f ops values)
+PREMISE Aiur.NativeAIR.Node.unfold
+Array Aiur.NativeAIR.Expr → Aiur.NativeAIR.Node → Option Aiur.NativeAIR.Expr
+DEFINITION
+fun trees x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value => some (Aiur.NativeAIR.Expr.konst value)
+  | Aiur.NativeAIR.Node.var column => some (Aiur.NativeAIR.Expr.var column)
+  | Aiur.NativeAIR.Node.publicInput index => some (Aiur.NativeAIR.Expr.publicInput index)
+  | Aiur.NativeAIR.Node.isFirstRow => some Aiur.NativeAIR.Expr.isFirstRow
+  | Aiur.NativeAIR.Node.isLastRow => some Aiur.NativeAIR.Expr.isLastRow
+  | Aiur.NativeAIR.Node.isTransition => some Aiur.NativeAIR.Expr.isTransition
+  | Aiur.NativeAIR.Node.add a b => do
+    let __do_lift ← trees[a]?
+    let __do_lift_1 ← trees[b]?
+    pure (__do_lift.add __do_lift_1)
+  | Aiur.NativeAIR.Node.sub a b => do
+    let __do_lift ← trees[a]?
+    let __do_lift_1 ← trees[b]?
+    pure (__do_lift.sub __do_lift_1)
+  | Aiur.NativeAIR.Node.mul a b => do
+    let __do_lift ← trees[a]?
+    let __do_lift_1 ← trees[b]?
+    pure (__do_lift.mul __do_lift_1)
+  | Aiur.NativeAIR.Node.neg a => do
+    let __do_lift ← trees[a]?
+    pure __do_lift.neg
+PREMISE Aiur.NativeAIR.Reflects
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Array Aiur.NativeAIR.Expr → Array W → Prop
+DEFINITION
+fun {W} ops values trees buffer =>
+  buffer.size = trees.size ∧ ∀ (index : Nat), buffer[index]? = trees[index]?.bind (Aiur.NativeAIR.Expr.eval ops values)
+PREMISE Aiur.NativeAIR.unfoldFrom
+List Aiur.NativeAIR.Node → Array Aiur.NativeAIR.Expr → Option (Array Aiur.NativeAIR.Expr)
+DEFINITION
+fun x x_1 =>
+  List.brecOn (motive := fun x => Array Aiur.NativeAIR.Expr → Option (Array Aiur.NativeAIR.Expr)) x
+    Aiur.NativeAIR.unfoldFrom._f x_1
+PREMISE Aiur.NativeAIR.Graph.unfold
+Aiur.NativeAIR.Graph → Option (Array Aiur.NativeAIR.Expr)
+DEFINITION
+fun graph => Aiur.NativeAIR.unfoldFrom graph.nodes #[]
+PREMISE Aiur.NativeAIR.readNodes
+{W : Type u_1} → Array W → List Nat → Option (List W)
+DEFINITION
+fun {W} buffer roots => List.mapM (fun index => buffer[index]?) roots
+PREMISE Aiur.NativeAIR.evalRoots
+{W : Type u_1} →
+  Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Array Aiur.NativeAIR.Expr → List Nat → Option (List W)
+DEFINITION
+fun {W} ops values trees roots =>
+  List.mapM (fun index => trees[index]?.bind (Aiur.NativeAIR.Expr.eval ops values)) roots
+PREMISE Aiur.NativeAIR.readLookup
+{W : Type u_1} → Array W → Aiur.NativeAIR.Lookup → Option (W × List W)
+DEFINITION
+fun {W} buffer lookup => do
+  let multiplicity ← buffer[lookup.multiplicity]?
+  let args ← Aiur.NativeAIR.readNodes buffer lookup.args
+  pure (multiplicity, args)
+PREMISE Aiur.NativeAIR.evalLookup
+{W : Type u_1} →
+  Aiur.NativeAIR.EvalOps W →
+    Aiur.NativeAIR.Values W → Array Aiur.NativeAIR.Expr → Aiur.NativeAIR.Lookup → Option (W × List W)
+DEFINITION
+fun {W} ops values trees lookup => do
+  let multiplicity ← trees[lookup.multiplicity]?.bind (Aiur.NativeAIR.Expr.eval ops values)
+  let args ← Aiur.NativeAIR.evalRoots ops values trees lookup.args
+  pure (multiplicity, args)
+PREMISE Aiur.NativeAIR.goldilocksOps
+Aiur.NativeAIR.EvalOps Aiur.G
+DEFINITION
+{ konst := id, add := fun x1 x2 => x1 + x2, sub := fun x1 x2 => x1 - x2, mul := fun x1 x2 => x1 * x2,
+  neg := fun x => 0 - x }
+PREMISE Aiur.NativeAIR.Expr.isConstant
+Aiur.NativeAIR.Expr → Bool
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.NativeAIR.Expr.konst value => true
+  | x => false
+PREMISE Aiur.NativeAIR.Expr.constantValue
+Aiur.NativeAIR.Expr → Option Aiur.G
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.NativeAIR.Expr.konst value => some value
+  | x => none
+PREMISE Aiur.NativeAIR.Expr.frontNeg
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.NativeAIR.Expr.konst value => Aiur.NativeAIR.Expr.konst (0 - value)
+  | value.neg => value
+  | value => value.neg
+PREMISE Aiur.NativeAIR.Expr.frontAdd
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun left right =>
+  match left.constantValue, right.constantValue with
+  | some a, some b => Aiur.NativeAIR.Expr.konst (a + b)
+  | some a, none => if (a == 0) = true then right else left.add right
+  | none, some b => if (b == 0) = true then left else left.add right
+  | none, none => left.add right
+PREMISE Aiur.NativeAIR.Expr.frontSub
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun left right =>
+  match left.constantValue, right.constantValue with
+  | some a, some b => Aiur.NativeAIR.Expr.konst (a - b)
+  | none, some b => if (b == 0) = true then left else left.sub right
+  | some a, none => if (a == 0) = true then right.frontNeg else left.sub right
+  | none, none => left.sub right
+PREMISE Aiur.NativeAIR.Expr.frontMul
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun left right =>
+  match left.constantValue, right.constantValue with
+  | some a, some b => Aiur.NativeAIR.Expr.konst (a * b)
+  | some a, none =>
+    if (a == 0) = true then Aiur.NativeAIR.Expr.konst 0 else if (a == 1) = true then right else left.mul right
+  | none, some b =>
+    if (b == 0) = true then Aiur.NativeAIR.Expr.konst 0 else if (b == 1) = true then left else left.mul right
+  | none, none => left.mul right
+PREMISE Aiur.NativeAIR.EvalLaws.mk
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  (∀ (a b : Aiur.G), ops.konst (a + b) = ops.add (ops.konst a) (ops.konst b)) →
+    (∀ (a b : Aiur.G), ops.konst (a - b) = ops.sub (ops.konst a) (ops.konst b)) →
+      (∀ (a b : Aiur.G), ops.konst (a * b) = ops.mul (ops.konst a) (ops.konst b)) →
+        (∀ (a : Aiur.G), ops.konst (0 - a) = ops.neg (ops.konst a)) →
+          (∀ (a : W), ops.add a (ops.konst 0) = a) →
+            (∀ (a : W), ops.add (ops.konst 0) a = a) →
+              (∀ (a : W), ops.sub a (ops.konst 0) = a) →
+                (∀ (a : W), ops.sub (ops.konst 0) a = ops.neg a) →
+                  (∀ (a : W), ops.mul a (ops.konst 0) = ops.konst 0) →
+                    (∀ (a : W), ops.mul (ops.konst 0) a = ops.konst 0) →
+                      (∀ (a : W), ops.mul a (ops.konst 1) = a) →
+                        (∀ (a : W), ops.mul (ops.konst 1) a = a) →
+                          (∀ (a : W), ops.neg (ops.neg a) = a) → Aiur.NativeAIR.EvalLaws ops
+PREMISE Aiur.NativeAIR.Expr.noConstantNegs
+Aiur.NativeAIR.Expr → Bool
+DEFINITION
+fun x => Aiur.NativeAIR.Expr.brecOn x Aiur.NativeAIR.Expr.noConstantNegs._f
+PREMISE Aiur.NativeAIR.RowExpr.mk
+Aiur.NativeAIR.Expr → Nat → Aiur.NativeAIR.RowExpr
+PREMISE Aiur.NativeAIR.RowExpr.konst
+Aiur.G → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun value => { expr := Aiur.NativeAIR.Expr.konst value, degree := 0 }
+PREMISE Aiur.NativeAIR.RowExpr.variable
+Aiur.NativeAIR.ColRef → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun column => { expr := Aiur.NativeAIR.Expr.var column, degree := 1 }
+PREMISE Aiur.NativeAIR.RowExpr.add
+Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun left right => { expr := left.expr.frontAdd right.expr, degree := max left.degree right.degree }
+PREMISE Aiur.NativeAIR.RowExpr.sub
+Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun left right => { expr := left.expr.frontSub right.expr, degree := max left.degree right.degree }
+PREMISE Aiur.NativeAIR.RowExpr.mul
+Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun left right => { expr := left.expr.frontMul right.expr, degree := left.degree + right.degree }
+PREMISE Aiur.NativeAIR.RowExpr.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.RowExpr → Option Aiur.AIR.RowValue
+DEFINITION
+fun values expr => do
+  let value ← Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values expr.expr
+  pure { value := value, degree := expr.degree, constant := expr.expr.isConstant }
+PREMISE Aiur.NativeAIR.RowExpr.Reflects
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.RowExpr → Aiur.AIR.RowValue → Prop
+DEFINITION
+fun values expr value =>
+  Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values expr.expr = some value.value ∧
+    expr.degree = value.degree ∧ expr.expr.isConstant = value.constant
+PREMISE Aiur.NativeAIR.ScalarEmission.mk
+Aiur.NativeAIR.RowExpr → Nat → List Aiur.NativeAIR.Expr → Aiur.NativeAIR.ScalarEmission
+PREMISE Aiur.NativeAIR.ScalarEmission.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.ScalarEmission → Option Aiur.AIR.OpEmission
+DEFINITION
+fun values emission => do
+  let output ← Aiur.NativeAIR.RowExpr.eval values emission.output
+  let equations ← List.mapM (Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values) emission.equations
+  pure { outputs := #[output], used := emission.used, equations := equations }
+PREMISE Aiur.NativeAIR.mainCurrent
+Nat → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun index =>
+  Aiur.NativeAIR.RowExpr.variable
+    { source := Aiur.NativeAIR.Source.main, offset := Aiur.NativeAIR.RowOffset.current, index := index }
+PREMISE Aiur.NativeAIR.eqZeroRegular
+Aiur.NativeAIR.Expr → Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.ScalarEmission
+DEFINITION
+fun selector first input =>
+  have d := Aiur.NativeAIR.mainCurrent first;
+  have x := Aiur.NativeAIR.mainCurrent (first + 1);
+  { output := x, used := 2,
+    equations :=
+      [(selector.frontMul input.expr).frontMul x.expr,
+        selector.frontMul (((input.expr.frontMul d.expr).frontAdd x.expr).frontSub (Aiur.NativeAIR.Expr.konst 1))] }
+PREMISE Aiur.NativeAIR.emitEqZero
+Aiur.NativeAIR.Expr → Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.ScalarEmission
+DEFINITION
+fun selector first input =>
+  match input.expr.constantValue, input.degree with
+  | some value, 0 => { output := Aiur.NativeAIR.RowExpr.konst value.eqZero }
+  | x, x_1 => Aiur.NativeAIR.eqZeroRegular selector first input
+PREMISE Aiur.NativeAIR.mulRegular
+Aiur.NativeAIR.Expr → Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.ScalarEmission
+DEFINITION
+fun selector first product =>
+  have output := Aiur.NativeAIR.mainCurrent first;
+  { output := output, used := 1, equations := [selector.frontMul (output.expr.frontSub product.expr)] }
+PREMISE Aiur.NativeAIR.emitMul
+Aiur.NativeAIR.Expr → Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.ScalarEmission
+DEFINITION
+fun selector first left right =>
+  have product := left.mul right;
+  if product.degree < 2 then { output := product } else Aiur.NativeAIR.mulRegular selector first product
+PREMISE Aiur.NativeAIR.GraphEvalLaws.mk
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W},
+  Aiur.NativeAIR.EvalLaws ops →
+    (∀ (a b : W), ops.add a b = ops.add b a) →
+      (∀ (a b : W), ops.mul a b = ops.mul b a) →
+        (∀ (a : W), ops.sub a a = ops.konst 0) → Aiur.NativeAIR.GraphEvalLaws ops
+PREMISE Aiur.NativeAIR.Compiler.Extends
+{W : Type u_1} → Array W → Array W → Prop
+DEFINITION
+fun {W} before after => ∀ (index : Nat) (value : W), before[index]? = some value → after[index]? = some value
+PREMISE Aiur.NativeAIR.Compiler.Evaluation.mk
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {nodes : List Aiur.NativeAIR.Node}
+  {buffer : Array W},
+  buffer.size = nodes.length →
+    Aiur.NativeAIR.sweepFrom ops values nodes #[] = some buffer →
+      (∀ (index : Nat) (node : Aiur.NativeAIR.Node),
+          nodes[index]? = some node → Aiur.NativeAIR.Node.eval ops values buffer node = buffer[index]?) →
+        Aiur.NativeAIR.Compiler.Evaluation ops values nodes buffer
+PREMISE Aiur.NativeAIR.Compiler.intern
+List Aiur.NativeAIR.Node → Aiur.NativeAIR.Node → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes node =>
+  match List.findIdx? (fun old => decide (old = node)) nodes with
+  | some index => (nodes, index)
+  | none => (nodes ++ [node], nodes.length)
+PREMISE Aiur.NativeAIR.Compiler.asConst
+List Aiur.NativeAIR.Node → Nat → Option Aiur.G
+DEFINITION
+fun nodes index =>
+  match nodes[index]? with
+  | some (Aiur.NativeAIR.Node.konst value) => some value
+  | x => none
+PREMISE Aiur.NativeAIR.Compiler.Result
+{W : Type u_1} →
+  Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Array W → List Aiur.NativeAIR.Node × Nat → W → Prop
+DEFINITION
+fun {W} ops values before result value =>
+  ∃ after,
+    Aiur.NativeAIR.Compiler.Evaluation ops values result.fst after ∧
+      Aiur.NativeAIR.Compiler.Extends before after ∧ after[result.snd]? = some value
+PREMISE Aiur.NativeAIR.Compiler.neg
+List Aiur.NativeAIR.Node → Nat → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes a =>
+  match Aiur.NativeAIR.Compiler.asConst nodes a with
+  | some value => Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst (0 - value))
+  | none =>
+    match nodes[a]? with
+    | some (Aiur.NativeAIR.Node.neg inner) => (nodes, inner)
+    | x => Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.neg a)
+PREMISE Aiur.NativeAIR.Compiler.sortedAdd
+List Aiur.NativeAIR.Node → Nat → Nat → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes a b =>
+  Aiur.NativeAIR.Compiler.intern nodes (if a ≤ b then Aiur.NativeAIR.Node.add a b else Aiur.NativeAIR.Node.add b a)
+PREMISE Aiur.NativeAIR.Compiler.sortedMul
+List Aiur.NativeAIR.Node → Nat → Nat → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes a b =>
+  Aiur.NativeAIR.Compiler.intern nodes (if a ≤ b then Aiur.NativeAIR.Node.mul a b else Aiur.NativeAIR.Node.mul b a)
+PREMISE Aiur.NativeAIR.Compiler.add
+List Aiur.NativeAIR.Node → Nat → Nat → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes a b =>
+  match Aiur.NativeAIR.Compiler.asConst nodes a, Aiur.NativeAIR.Compiler.asConst nodes b with
+  | some x, some y => Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst (x + y))
+  | some x, none => if (x == 0) = true then (nodes, b) else Aiur.NativeAIR.Compiler.sortedAdd nodes a b
+  | none, some y => if (y == 0) = true then (nodes, a) else Aiur.NativeAIR.Compiler.sortedAdd nodes a b
+  | none, none => Aiur.NativeAIR.Compiler.sortedAdd nodes a b
+PREMISE Aiur.NativeAIR.Compiler.sub
+List Aiur.NativeAIR.Node → Nat → Nat → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes a b =>
+  if a = b then Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst 0)
+  else
+    match Aiur.NativeAIR.Compiler.asConst nodes a, Aiur.NativeAIR.Compiler.asConst nodes b with
+    | some x, some y => Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst (x - y))
+    | none, some y =>
+      if (y == 0) = true then (nodes, a) else Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.sub a b)
+    | some x, none =>
+      if (x == 0) = true then Aiur.NativeAIR.Compiler.neg nodes b
+      else Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.sub a b)
+    | none, none => Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.sub a b)
+PREMISE Aiur.NativeAIR.Compiler.mul
+List Aiur.NativeAIR.Node → Nat → Nat → List Aiur.NativeAIR.Node × Nat
+DEFINITION
+fun nodes a b =>
+  match Aiur.NativeAIR.Compiler.asConst nodes a, Aiur.NativeAIR.Compiler.asConst nodes b with
+  | some x, some y => Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst (x * y))
+  | some x, none =>
+    if (x == 0) = true then (nodes, a)
+    else if (x == 1) = true then (nodes, b) else Aiur.NativeAIR.Compiler.sortedMul nodes a b
+  | none, some y =>
+    if (y == 0) = true then (nodes, b)
+    else if (y == 1) = true then (nodes, a) else Aiur.NativeAIR.Compiler.sortedMul nodes a b
+  | none, none => Aiur.NativeAIR.Compiler.sortedMul nodes a b
+PREMISE Aiur.NativeAIR.Compiler.compileExpr
+Aiur.NativeAIR.GraphWidths →
+  Bool → Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × Nat)
+DEFINITION
+fun widths allowStage2 x x_1 =>
+  Aiur.NativeAIR.Expr.brecOn (motive := fun x => List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × Nat)) x
+    (Aiur.NativeAIR.Compiler.compileExpr._f widths allowStage2) x_1
+PREMISE Aiur.NativeAIR.Compiler.compileExprs
+Aiur.NativeAIR.GraphWidths →
+  Bool → List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Nat)
+DEFINITION
+fun widths allowStage2 x x_1 =>
+  List.brecOn (motive := fun x => List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Nat)) x
+    (Aiur.NativeAIR.Compiler.compileExprs._f widths allowStage2) x_1
+PREMISE Aiur.NativeAIR.Compiler.RootsReflect.nil
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W},
+  Aiur.NativeAIR.Compiler.RootsReflect ops values buffer [] []
+PREMISE Aiur.NativeAIR.Compiler.RootsReflect.cons
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W} {root : Nat}
+  {expr : Aiur.NativeAIR.Expr} {roots : List Nat} {exprs : List Aiur.NativeAIR.Expr},
+  (∃ value, Aiur.NativeAIR.Expr.eval ops values expr = some value ∧ buffer[root]? = some value) →
+    Aiur.NativeAIR.Compiler.RootsReflect ops values buffer roots exprs →
+      Aiur.NativeAIR.Compiler.RootsReflect ops values buffer (root :: roots) (expr :: exprs)
+PREMISE Aiur.NativeAIR.Compiler.evalExprs
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → List Aiur.NativeAIR.Expr → Option (List W)
+DEFINITION
+fun {W} ops values exprs => List.mapM (Aiur.NativeAIR.Expr.eval ops values) exprs
+PREMISE Aiur.NativeAIR.Compiler.ExprLookup.mk
+Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr → Aiur.NativeAIR.Compiler.ExprLookup
+PREMISE Aiur.NativeAIR.Compiler.ExprLookup.exprs
+Aiur.NativeAIR.Compiler.ExprLookup → List Aiur.NativeAIR.Expr
+DEFINITION
+fun lookup => lookup.multiplicity :: lookup.args
+PREMISE Aiur.NativeAIR.Compiler.ExprLookup.eval
+{W : Type u_1} →
+  Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Aiur.NativeAIR.Compiler.ExprLookup → Option (W × List W)
+DEFINITION
+fun {W} ops values lookup => do
+  let multiplicity ← Aiur.NativeAIR.Expr.eval ops values lookup.multiplicity
+  let args ← Aiur.NativeAIR.Compiler.evalExprs ops values lookup.args
+  pure (multiplicity, args)
+PREMISE Aiur.NativeAIR.Compiler.compileLookup
+Aiur.NativeAIR.GraphWidths →
+  Aiur.NativeAIR.Compiler.ExprLookup →
+    List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × Aiur.NativeAIR.Lookup)
+DEFINITION
+fun widths lookup nodes => do
+  let __x ← Aiur.NativeAIR.Compiler.compileExprs widths false lookup.exprs nodes
+  match __x with
+    | (nodes, roots) =>
+      match roots with
+      | [] => none
+      | root :: roots => pure (nodes, { multiplicity := root, args := roots })
+PREMISE Aiur.NativeAIR.Compiler.compileLookups
+Aiur.NativeAIR.GraphWidths →
+  List Aiur.NativeAIR.Compiler.ExprLookup →
+    List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Aiur.NativeAIR.Lookup)
+DEFINITION
+fun widths x x_1 =>
+  List.brecOn (motive := fun x =>
+    List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Aiur.NativeAIR.Lookup)) x
+    (Aiur.NativeAIR.Compiler.compileLookups._f widths) x_1
+PREMISE Aiur.NativeAIR.Compiler.LookupsReflect.nil
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W},
+  Aiur.NativeAIR.Compiler.LookupsReflect ops values buffer [] []
+PREMISE Aiur.NativeAIR.Compiler.LookupsReflect.cons
+∀ {W : Type u_1} {ops : Aiur.NativeAIR.EvalOps W} {values : Aiur.NativeAIR.Values W} {buffer : Array W}
+  {lookup : Aiur.NativeAIR.Lookup} {expr : Aiur.NativeAIR.Compiler.ExprLookup} {lookups : List Aiur.NativeAIR.Lookup}
+  {exprs : List Aiur.NativeAIR.Compiler.ExprLookup},
+  Aiur.NativeAIR.Compiler.RootsReflect ops values buffer lookup.roots expr.exprs →
+    Aiur.NativeAIR.Compiler.LookupsReflect ops values buffer lookups exprs →
+      Aiur.NativeAIR.Compiler.LookupsReflect ops values buffer (lookup :: lookups) (expr :: exprs)
+PREMISE Aiur.NativeAIR.Compiler.recordZero
+List Aiur.NativeAIR.Node → Nat → Option (List Nat)
+DEFINITION
+fun nodes root =>
+  match Aiur.NativeAIR.Compiler.asConst nodes root with
+  | none => some [root]
+  | some value => if (value == 0) = true then some [] else none
+PREMISE Aiur.NativeAIR.Compiler.Vanishes
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Array W → List Nat → Prop
+DEFINITION
+fun {W} ops buffer roots => ∀ (root : Nat), root ∈ roots → buffer[root]? = some (ops.konst 0)
+PREMISE Aiur.NativeAIR.Compiler.ExprsVanish
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → List Aiur.NativeAIR.Expr → Prop
+DEFINITION
+fun {W} ops values exprs =>
+  ∀ (expr : Aiur.NativeAIR.Expr), expr ∈ exprs → Aiur.NativeAIR.Expr.eval ops values expr = some (ops.konst 0)
+PREMISE Aiur.NativeAIR.Compiler.compileZeros
+Aiur.NativeAIR.GraphWidths →
+  List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Nat)
+DEFINITION
+fun widths x x_1 =>
+  List.brecOn (motive := fun x => List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Nat)) x
+    (Aiur.NativeAIR.Compiler.compileZeros._f widths) x_1
+PREMISE Aiur.NativeAIR.Compiler.canonicalZeros
+List Nat → List Nat
+DEFINITION
+fun roots => (roots.mergeSort fun x1 x2 => decide (x1 ≤ x2)).eraseDups
+PREMISE Aiur.NativeAIR.Compiler.BaseCompilation.mk
+Aiur.NativeAIR.Graph → Nat → Aiur.NativeAIR.Compiler.BaseCompilation
+PREMISE Aiur.NativeAIR.Compiler.compileBase
+Aiur.NativeAIR.GraphWidths →
+  List Aiur.NativeAIR.Compiler.ExprLookup → List Aiur.NativeAIR.Expr → Option Aiur.NativeAIR.Compiler.BaseCompilation
+DEFINITION
+fun widths lookups constraints => do
+  let __x ← Aiur.NativeAIR.Compiler.compileLookups widths lookups []
+  match __x with
+    | (lookupNodes, lookups) => do
+      let __x ← Aiur.NativeAIR.Compiler.compileZeros widths constraints lookupNodes
+      match __x with
+        | (nodes, zeros) =>
+          pure
+            { graph := { nodes := nodes, zeros := Aiur.NativeAIR.Compiler.canonicalZeros zeros, lookups := lookups },
+              lookupEnd := lookupNodes.length }
+PREMISE Aiur.NativeAIR.OpEmitter.evalExpr
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.Expr → Option Aiur.G
+DEFINITION
+fun values => Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values
+PREMISE Aiur.NativeAIR.OpEmitter.evalRows
+Aiur.NativeAIR.Values Aiur.G → Array Aiur.NativeAIR.RowExpr → Option (Array Aiur.AIR.RowValue)
+DEFINITION
+fun values rows => Array.mapM (Aiur.NativeAIR.RowExpr.eval values) rows
+PREMISE Aiur.NativeAIR.OpEmitter.rowExprs
+Array Aiur.NativeAIR.RowExpr → Array Aiur.NativeAIR.Expr
+DEFINITION
+fun rows => Array.map Aiur.NativeAIR.RowExpr.expr rows
+PREMISE Aiur.NativeAIR.OpEmitter.Normal
+Array Aiur.NativeAIR.RowExpr → Prop
+DEFINITION
+fun rows => ∀ (row : Aiur.NativeAIR.RowExpr), row ∈ rows → row.expr.noConstantNegs = true
+PREMISE Aiur.NativeAIR.OpEmitter.select
+Array Aiur.NativeAIR.RowExpr → Array Nat → Option (Array Aiur.NativeAIR.RowExpr)
+DEFINITION
+fun rows indices => Array.mapM (fun index => rows[index]?) indices
+PREMISE Aiur.NativeAIR.OpEmitter.advice
+Nat → Nat → Array Aiur.NativeAIR.RowExpr
+DEFINITION
+fun first count => Array.ofFn fun index => Aiur.NativeAIR.mainCurrent (first + ↑index)
+PREMISE Aiur.NativeAIR.OpEmitter.CallExpr.mk
+Nat →
+  Array Aiur.NativeAIR.Expr →
+    Array Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → (Fin 6 → Aiur.NativeAIR.Expr) → Aiur.NativeAIR.OpEmitter.CallExpr
+PREMISE Aiur.NativeAIR.OpEmitter.CallExpr.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.OpEmitter.CallExpr → Option (Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G))
+DEFINITION
+fun values call => do
+  let inputs ← Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) call.inputs
+  let outputs ← Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) call.outputs
+  let rank ← Aiur.NativeAIR.Expr.eval Aiur.NativeAIR.goldilocksOps values call.rank
+  let gap ← Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Array.ofFn call.gap)
+  pure
+      ({ function := call.function, inputs := inputs, outputs := outputs, rank := rank }, fun index =>
+        gap[↑index]?.getD 0)
+PREMISE Aiur.NativeAIR.OpEmitter.Emission.mk
+Array Aiur.NativeAIR.RowExpr →
+  Nat →
+    List Aiur.NativeAIR.Expr →
+      List (List Aiur.NativeAIR.Expr) → List Aiur.NativeAIR.OpEmitter.CallExpr → Aiur.NativeAIR.OpEmitter.Emission
+PREMISE Aiur.NativeAIR.OpEmitter.Emission.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.OpEmitter.Emission → Option Aiur.AIR.OpEmission
+DEFINITION
+fun values emission => do
+  let outputs ← Aiur.NativeAIR.OpEmitter.evalRows values emission.outputs
+  let equations ← List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations
+  let queries ← List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) emission.queries
+  let calls ← List.mapM (Aiur.NativeAIR.OpEmitter.CallExpr.eval values) emission.calls
+  pure { outputs := outputs, used := emission.used, equations := equations, queries := queries, calls := calls }
+PREMISE Aiur.NativeAIR.OpEmitter.fromScalar
+Aiur.NativeAIR.ScalarEmission → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun emission => { outputs := #[emission.output], used := emission.used, equations := emission.equations }
+PREMISE Aiur.NativeAIR.OpEmitter.emitAdvice
+Nat → Nat → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun first count => { outputs := Aiur.NativeAIR.OpEmitter.advice first count, used := count }
+PREMISE Aiur.NativeAIR.OpEmitter.emitByte1
+Nat → Aiur.AIR.Byte1Kind → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun first kind input =>
+  have outputs := Aiur.NativeAIR.OpEmitter.advice first kind.outputSize;
+  { outputs := outputs, used := kind.outputSize,
+    queries :=
+      [[Aiur.NativeAIR.Expr.konst kind.channel, input.expr] ++ (Aiur.NativeAIR.OpEmitter.rowExprs outputs).toList] }
+PREMISE Aiur.NativeAIR.OpEmitter.byteCarry
+Nat → Bool → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun first subtract left right =>
+  have low := (Aiur.NativeAIR.mainCurrent first).expr;
+  have numerator :=
+    if subtract = true then (low.frontAdd right.expr).frontSub left.expr
+    else (left.expr.frontAdd right.expr).frontSub low;
+  { expr := numerator.frontMul (Aiur.NativeAIR.Expr.konst Aiur.AIR.inverse256),
+    degree := max (max left.degree right.degree) 1 }
+PREMISE Aiur.NativeAIR.OpEmitter.emitByte2
+Nat → Aiur.AIR.Byte2Kind → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun first kind left right =>
+  have allocated := Aiur.NativeAIR.OpEmitter.advice first kind.outputSize;
+  have outputs :=
+    match kind with
+    | Aiur.AIR.Byte2Kind.add => allocated.push (Aiur.NativeAIR.OpEmitter.byteCarry first false left right)
+    | Aiur.AIR.Byte2Kind.sub => allocated.push (Aiur.NativeAIR.OpEmitter.byteCarry first true left right)
+    | x => allocated;
+  { outputs := outputs, used := kind.outputSize,
+    queries :=
+      [[Aiur.NativeAIR.Expr.konst kind.channel, left.expr, right.expr] ++
+          (Aiur.NativeAIR.OpEmitter.rowExprs allocated).toList] }
+PREMISE Aiur.NativeAIR.OpEmitter.packFour
+(Fin 4 → Aiur.NativeAIR.RowExpr) → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun bytes =>
+  ((((Aiur.NativeAIR.RowExpr.konst 0).add ((bytes 0).mul (Aiur.NativeAIR.RowExpr.konst (Aiur.G.ofNat (256 ^ 0))))).add
+            ((bytes 1).mul (Aiur.NativeAIR.RowExpr.konst (Aiur.G.ofNat (256 ^ 1))))).add
+        ((bytes 2).mul (Aiur.NativeAIR.RowExpr.konst (Aiur.G.ofNat (256 ^ 2))))).add
+    ((bytes 3).mul (Aiur.NativeAIR.RowExpr.konst (Aiur.G.ofNat (256 ^ 3))))
+PREMISE Aiur.NativeAIR.OpEmitter.readWord
+Array Aiur.NativeAIR.RowExpr → Array Nat → Option Aiur.NativeAIR.RowExpr
+DEFINITION
+fun rows indices =>
+  if indices.size ≠ 4 then none
+  else do
+    let bytes ← Aiur.NativeAIR.OpEmitter.select rows indices
+    pure (Aiur.NativeAIR.OpEmitter.packFour fun index => bytes[↑index]?.getD (Aiur.NativeAIR.RowExpr.konst 0))
+PREMISE Aiur.NativeAIR.OpEmitter.packedAdvice
+Nat → Aiur.NativeAIR.RowExpr
+DEFINITION
+fun first => Aiur.NativeAIR.OpEmitter.packFour fun index => Aiur.NativeAIR.mainCurrent (first + ↑index)
+PREMISE Aiur.NativeAIR.OpEmitter.emitWordSum
+Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun first sum =>
+  have packed := Aiur.NativeAIR.OpEmitter.packedAdvice first;
+  {
+    outputs :=
+      (Aiur.NativeAIR.OpEmitter.advice first 4).push
+        ((sum.sub packed).mul (Aiur.NativeAIR.RowExpr.konst 18446744065119617026)),
+    used := 4 }
+PREMISE Aiur.NativeAIR.OpEmitter.carryStep
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun x y z previous =>
+  (((x.frontAdd y).frontAdd previous).frontSub z).frontMul (Aiur.NativeAIR.Expr.konst Aiur.AIR.inverse256)
+PREMISE Aiur.NativeAIR.OpEmitter.carries
+(Fin 4 → Aiur.NativeAIR.Expr) →
+  (Fin 4 → Aiur.NativeAIR.Expr) → (Fin 4 → Aiur.NativeAIR.Expr) → Fin 5 → Aiur.NativeAIR.Expr
+DEFINITION
+fun x y z =>
+  have c1 := Aiur.NativeAIR.OpEmitter.carryStep (x 0) (y 0) (z 0) (Aiur.NativeAIR.Expr.konst 1);
+  have c2 := Aiur.NativeAIR.OpEmitter.carryStep (x 1) (y 1) (z 1) c1;
+  have c3 := Aiur.NativeAIR.OpEmitter.carryStep (x 2) (y 2) (z 2) c2;
+  have c4 := Aiur.NativeAIR.OpEmitter.carryStep (x 3) (y 3) (z 3) c3;
+  fun index =>
+  match index with
+  | 0 => Aiur.NativeAIR.Expr.konst 1
+  | 1 => c1
+  | 2 => c2
+  | 3 => c3
+  | 4 => c4
+PREMISE Aiur.NativeAIR.OpEmitter.packSix
+(Fin 6 → Aiur.NativeAIR.Expr) → Aiur.NativeAIR.Expr
+DEFINITION
+fun bytes =>
+  ((((((Aiur.NativeAIR.Expr.konst 0).frontAdd ((bytes 0).frontMul (Aiur.NativeAIR.Expr.konst 1))).frontAdd
+                    ((bytes 1).frontMul (Aiur.NativeAIR.Expr.konst 256))).frontAdd
+                ((bytes 2).frontMul (Aiur.NativeAIR.Expr.konst 65536))).frontAdd
+            ((bytes 3).frontMul (Aiur.NativeAIR.Expr.konst 16777216))).frontAdd
+        ((bytes 4).frontMul (Aiur.NativeAIR.Expr.konst 4294967296))).frontAdd
+    ((bytes 5).frontMul (Aiur.NativeAIR.Expr.konst 1099511627776))
+PREMISE Aiur.NativeAIR.OpEmitter.rangePair
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr
+DEFINITION
+fun left right => [Aiur.NativeAIR.Expr.konst 11, left, right]
+PREMISE Aiur.NativeAIR.OpEmitter.rangeSix
+(Fin 6 → Aiur.NativeAIR.Expr) → List (List Aiur.NativeAIR.Expr)
+DEFINITION
+fun bytes =>
+  [Aiur.NativeAIR.OpEmitter.rangePair (bytes 0) (bytes 1), Aiur.NativeAIR.OpEmitter.rangePair (bytes 2) (bytes 3),
+    Aiur.NativeAIR.OpEmitter.rangePair (bytes 4) (bytes 5)]
+PREMISE Aiur.NativeAIR.OpEmitter.emitCall
+Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.Expr → Nat → Nat → Array Aiur.NativeAIR.RowExpr → Nat → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun selector rank first function inputs size =>
+  have outputs := Aiur.NativeAIR.OpEmitter.advice first size;
+  have child := (Aiur.NativeAIR.mainCurrent (first + size)).expr;
+  have gap := fun index => (Aiur.NativeAIR.mainCurrent (first + size + 1 + ↑index)).expr;
+  { outputs := outputs, used := size + 7,
+    equations :=
+      [selector.frontMul
+          (((child.frontSub rank).frontSub (Aiur.NativeAIR.Expr.konst 1)).frontSub
+            (Aiur.NativeAIR.OpEmitter.packSix gap))],
+    queries :=
+      ([Aiur.NativeAIR.Expr.konst 0, Aiur.NativeAIR.Expr.konst (Aiur.G.ofNat function)] ++
+              (Aiur.NativeAIR.OpEmitter.rowExprs inputs).toList ++
+            (Aiur.NativeAIR.OpEmitter.rowExprs outputs).toList ++
+          [child]) ::
+        Aiur.NativeAIR.OpEmitter.rangeSix gap,
+    calls :=
+      [{ function := function, inputs := Aiur.NativeAIR.OpEmitter.rowExprs inputs,
+          outputs := Aiur.NativeAIR.OpEmitter.rowExprs outputs, rank := child, gap := gap }] }
+PREMISE Aiur.NativeAIR.OpEmitter.emitStore
+Nat → Array Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun first contents =>
+  { outputs := Aiur.NativeAIR.OpEmitter.advice first 1, used := 1,
+    queries :=
+      [[Aiur.NativeAIR.Expr.konst 1, Aiur.NativeAIR.Expr.konst (Aiur.G.ofNat contents.size),
+            (Aiur.NativeAIR.mainCurrent first).expr] ++
+          (Aiur.NativeAIR.OpEmitter.rowExprs contents).toList] }
+PREMISE Aiur.NativeAIR.OpEmitter.emitLoad
+Nat → Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun first size pointer =>
+  have outputs := Aiur.NativeAIR.OpEmitter.advice first size;
+  { outputs := outputs, used := size,
+    queries :=
+      [[Aiur.NativeAIR.Expr.konst 1, Aiur.NativeAIR.Expr.konst (Aiur.G.ofNat size), pointer.expr] ++
+          (Aiur.NativeAIR.OpEmitter.rowExprs outputs).toList] }
+PREMISE Aiur.NativeAIR.OpEmitter.rangeFour
+(Fin 4 → Aiur.NativeAIR.Expr) → List (List Aiur.NativeAIR.Expr)
+DEFINITION
+fun bytes =>
+  [Aiur.NativeAIR.OpEmitter.rangePair (bytes 0) (bytes 1), Aiur.NativeAIR.OpEmitter.rangePair (bytes 2) (bytes 3)]
+PREMISE Aiur.NativeAIR.OpEmitter.booleanExpr
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun expr => expr.frontMul (expr.frontSub (Aiur.NativeAIR.Expr.konst 1))
+PREMISE Aiur.NativeAIR.OpEmitter.emitU32LessThan
+Aiur.NativeAIR.Expr → Nat → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun selector first left right =>
+  have x := fun index => (Aiur.NativeAIR.mainCurrent (first + ↑index)).expr;
+  have y := fun index => (Aiur.NativeAIR.mainCurrent (first + 4 + ↑index)).expr;
+  have z := fun index => (Aiur.NativeAIR.mainCurrent (first + 8 + ↑index)).expr;
+  have chain := Aiur.NativeAIR.OpEmitter.carries x y z;
+  { outputs := #[{ expr := (Aiur.NativeAIR.Expr.konst 1).frontSub (chain 4), degree := 1 }], used := 12,
+    equations :=
+      selector.frontMul (left.expr.frontSub (Aiur.NativeAIR.OpEmitter.packedAdvice first).expr) ::
+        selector.frontMul (right.expr.frontSub (Aiur.NativeAIR.OpEmitter.packedAdvice (first + 8)).expr) ::
+          List.ofFn fun index => selector.frontMul (Aiur.NativeAIR.OpEmitter.booleanExpr (chain index.succ)),
+    queries :=
+      Aiur.NativeAIR.OpEmitter.rangeFour x ++ Aiur.NativeAIR.OpEmitter.rangeFour y ++
+        Aiur.NativeAIR.OpEmitter.rangeFour z }
+PREMISE Aiur.NativeAIR.OpEmitter.emitAssert
+Aiur.NativeAIR.Expr → Array Aiur.NativeAIR.RowExpr → Array Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun selector left right =>
+  {
+    equations :=
+      List.ofFn fun index =>
+        selector.frontMul
+          ((left[↑index]?.getD (Aiur.NativeAIR.RowExpr.konst 0)).expr.frontSub
+            (right[↑index]?.getD (Aiur.NativeAIR.RowExpr.konst 0)).expr) }
+PREMISE Aiur.NativeAIR.OpEmitter.emitOp
+Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.Expr → Nat → Aiur.Bytecode.Op → Array Aiur.NativeAIR.RowExpr → Option Aiur.NativeAIR.OpEmitter.Emission
+DEFINITION
+fun selector rank first op rows =>
+  match op with
+  | Aiur.Bytecode.Op.const value =>
+    some (Aiur.NativeAIR.OpEmitter.fromScalar { output := Aiur.NativeAIR.RowExpr.konst value })
+  | Aiur.Bytecode.Op.add a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.fromScalar { output := __do_lift.add __do_lift_1 })
+  | Aiur.Bytecode.Op.sub a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.fromScalar { output := __do_lift.sub __do_lift_1 })
+  | Aiur.Bytecode.Op.mul a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.fromScalar (Aiur.NativeAIR.emitMul selector first __do_lift __do_lift_1))
+  | Aiur.Bytecode.Op.eqZero a => do
+    let __do_lift ← rows[a]?
+    pure (Aiur.NativeAIR.OpEmitter.fromScalar (Aiur.NativeAIR.emitEqZero selector first __do_lift))
+  | Aiur.Bytecode.Op.call function indices size unconstrained =>
+    if unconstrained = true then some (Aiur.NativeAIR.OpEmitter.emitAdvice first size)
+    else do
+      let __do_lift ← Aiur.NativeAIR.OpEmitter.select rows indices
+      pure (Aiur.NativeAIR.OpEmitter.emitCall selector rank first function __do_lift size)
+  | Aiur.Bytecode.Op.store indices => do
+    let __do_lift ← Aiur.NativeAIR.OpEmitter.select rows indices
+    pure (Aiur.NativeAIR.OpEmitter.emitStore first __do_lift)
+  | Aiur.Bytecode.Op.load size index => do
+    let __do_lift ← rows[index]?
+    pure (Aiur.NativeAIR.OpEmitter.emitLoad first size __do_lift)
+  | Aiur.Bytecode.Op.assertEq xs ys a =>
+    if xs.size ≠ ys.size then none
+    else do
+      let __do_lift ← Aiur.NativeAIR.OpEmitter.select rows xs
+      let __do_lift_1 ← Aiur.NativeAIR.OpEmitter.select rows ys
+      pure (Aiur.NativeAIR.OpEmitter.emitAssert selector __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.ioGetInfo a a_1 => some (Aiur.NativeAIR.OpEmitter.emitAdvice first 2)
+  | Aiur.Bytecode.Op.ioRead a a_1 size => some (Aiur.NativeAIR.OpEmitter.emitAdvice first size)
+  | Aiur.Bytecode.Op.ioSetInfo a a_1 a_2 a_3 => some { }
+  | Aiur.Bytecode.Op.ioWrite a a_1 => some { }
+  | Aiur.Bytecode.Op.debug a a_1 => some { }
+  | Aiur.Bytecode.Op.u8BitDecomposition index => do
+    let __do_lift ← rows[index]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte1 first Aiur.AIR.Byte1Kind.bits __do_lift)
+  | Aiur.Bytecode.Op.u8ShiftLeft index => do
+    let __do_lift ← rows[index]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte1 first Aiur.AIR.Byte1Kind.shiftLeft __do_lift)
+  | Aiur.Bytecode.Op.u8ShiftRight index => do
+    let __do_lift ← rows[index]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte1 first Aiur.AIR.Byte1Kind.shiftRight __do_lift)
+  | Aiur.Bytecode.Op.u8Xor a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.xor __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8Add a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.add __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8Sub a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.sub __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8And a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.and __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8Or a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.or __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8LessThan a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.lessThan __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8RangeCheck a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.range __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8Mul a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.mul __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8XorSplit7 a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.split7 __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u8XorSplit4 a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitByte2 first Aiur.AIR.Byte2Kind.split4 __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.u32LessThan a b => do
+    let __do_lift ← rows[a]?
+    let __do_lift_1 ← rows[b]?
+    pure (Aiur.NativeAIR.OpEmitter.emitU32LessThan selector first __do_lift __do_lift_1)
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a a_1 => some (Aiur.NativeAIR.OpEmitter.emitAdvice first 2)
+  | Aiur.Bytecode.Op.unconstrainedGToBytes a => some (Aiur.NativeAIR.OpEmitter.emitAdvice first 8)
+  | Aiur.Bytecode.Op.unconstrainedGInverse a => some (Aiur.NativeAIR.OpEmitter.emitAdvice first 1)
+  | Aiur.Bytecode.Op.unconstrainedU32Add a b => do
+    let __do_lift ← Aiur.NativeAIR.OpEmitter.readWord rows a
+    let __do_lift_1 ← Aiur.NativeAIR.OpEmitter.readWord rows b
+    pure (Aiur.NativeAIR.OpEmitter.emitWordSum first (__do_lift.add __do_lift_1))
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a b c => do
+    let __do_lift ← Aiur.NativeAIR.OpEmitter.readWord rows a
+    let __do_lift_1 ← Aiur.NativeAIR.OpEmitter.readWord rows b
+    let __do_lift_2 ← Aiur.NativeAIR.OpEmitter.readWord rows c
+    pure (Aiur.NativeAIR.OpEmitter.emitWordSum first ((__do_lift.add __do_lift_1).add __do_lift_2))
+  | Aiur.Bytecode.Op.u32ToField indices => do
+    let __do_lift ← Aiur.NativeAIR.OpEmitter.readWord rows indices
+    pure (Aiur.NativeAIR.OpEmitter.fromScalar { output := __do_lift })
+PREMISE Aiur.NativeAIR.OpEmitter.OpsEmission.mk
+Array Aiur.NativeAIR.RowExpr →
+  Nat →
+    List Aiur.NativeAIR.Expr →
+      List (List Aiur.NativeAIR.Expr) → List Aiur.NativeAIR.OpEmitter.CallExpr → Aiur.NativeAIR.OpEmitter.OpsEmission
+PREMISE Aiur.NativeAIR.OpEmitter.OpsEmission.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.OpEmitter.OpsEmission → Option Aiur.AIR.OpsEmission
+DEFINITION
+fun values emission => do
+  let outputs ← Aiur.NativeAIR.OpEmitter.evalRows values emission.values
+  let equations ← List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations
+  let queries ← List.mapM (List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values)) emission.queries
+  let calls ← List.mapM (Aiur.NativeAIR.OpEmitter.CallExpr.eval values) emission.calls
+  pure { values := outputs, column := emission.column, equations := equations, queries := queries, calls := calls }
+PREMISE Aiur.NativeAIR.OpEmitter.emitOps
+Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.Expr →
+    List Aiur.Bytecode.Op → Array Aiur.NativeAIR.RowExpr → Nat → Option Aiur.NativeAIR.OpEmitter.OpsEmission
+DEFINITION
+fun selector rank x x_1 x_2 =>
+  List.brecOn (motive := fun x => Array Aiur.NativeAIR.RowExpr → Nat → Option Aiur.NativeAIR.OpEmitter.OpsEmission) x
+    (Aiur.NativeAIR.OpEmitter.emitOps._f selector rank) x_1 x_2
+PREMISE Aiur.NativeAIR.LookupEmitter.addArgs
+List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr
+DEFINITION
+fun x x_1 =>
+  List.brecOn (motive := fun x => List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr) x
+    Aiur.NativeAIR.LookupEmitter.addArgs._f x_1
+PREMISE Aiur.NativeAIR.LookupEmitter.gateArgs
+Bool → Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr
+DEFINITION
+fun branchless selector args => if branchless = true then args else List.map selector.frontMul args
+PREMISE Aiur.NativeAIR.LookupEmitter.QueryExpr.mk
+Nat → Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr → Aiur.NativeAIR.LookupEmitter.QueryExpr
+PREMISE Aiur.NativeAIR.LookupEmitter.QueryExpr.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.LookupEmitter.QueryExpr → Option Aiur.AIR.QueryPart
+DEFINITION
+fun values query => do
+  let selector ← Aiur.NativeAIR.OpEmitter.evalExpr values query.selector
+  let message ← List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) query.message
+  pure { slot := query.slot, selector := selector, message := message }
+PREMISE Aiur.NativeAIR.LookupEmitter.queryParts
+Nat → Aiur.NativeAIR.Expr → List (List Aiur.NativeAIR.Expr) → List Aiur.NativeAIR.LookupEmitter.QueryExpr
+DEFINITION
+fun slot selector queries =>
+  List.mapIdx (fun index message => { slot := slot + index, selector := selector, message := message }) queries
+PREMISE Aiur.NativeAIR.LookupEmitter.accumulate
+Bool → Aiur.NativeAIR.Compiler.ExprLookup → Aiur.NativeAIR.LookupEmitter.QueryExpr → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun branchless lookup query =>
+  { multiplicity := lookup.multiplicity.frontAdd query.selector,
+    args :=
+      Aiur.NativeAIR.LookupEmitter.addArgs lookup.args
+        (Aiur.NativeAIR.LookupEmitter.gateArgs branchless query.selector query.message) }
+PREMISE Aiur.NativeAIR.LookupEmitter.valuedAccumulate
+Bool → Aiur.G × List Aiur.G → Aiur.AIR.QueryPart → Aiur.G × List Aiur.G
+DEFINITION
+fun branchless lookup query =>
+  (lookup.fst + query.selector,
+    Aiur.AIR.addMessages lookup.snd (Aiur.AIR.gateMessage branchless query.selector query.message))
+PREMISE Aiur.NativeAIR.LookupEmitter.slot
+Bool → List Aiur.NativeAIR.LookupEmitter.QueryExpr → Nat → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun branchless queries index =>
+  List.foldl (Aiur.NativeAIR.LookupEmitter.accumulate branchless)
+    { multiplicity := Aiur.NativeAIR.Expr.konst 0, args := [] } (List.filter (fun query => query.slot == index) queries)
+PREMISE Aiur.NativeAIR.LookupEmitter.slots
+Bool → List Aiur.NativeAIR.LookupEmitter.QueryExpr → Nat → List Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun branchless queries count => List.ofFn fun index => Aiur.NativeAIR.LookupEmitter.slot branchless queries ↑index
+PREMISE Aiur.NativeAIR.BlockEmitter.sum
+List Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr
+DEFINITION
+fun expressions => List.foldl Aiur.NativeAIR.Expr.frontAdd (Aiur.NativeAIR.Expr.konst 0) expressions
+PREMISE Aiur.NativeAIR.BlockEmitter.SelectorReads
+Aiur.NativeAIR.Values Aiur.G → Array Aiur.NativeAIR.Expr → (Nat → Aiur.G) → Prop
+DEFINITION
+fun values selectors selector =>
+  ∀ {index : Nat} {expr : Aiur.NativeAIR.Expr},
+    selectors[index]? = some expr → Aiur.NativeAIR.OpEmitter.evalExpr values expr = some (selector index)
+PREMISE Aiur.NativeAIR.BlockEmitter.ctrlSelector
+Array Aiur.NativeAIR.Expr → Aiur.Bytecode.Ctrl → Option Aiur.NativeAIR.Expr
+DEFINITION
+fun selectors a => Aiur.NativeAIR.BlockEmitter.ctrlSelector._mutual selectors (PSum.inl a)
+PREMISE Aiur.NativeAIR.BlockEmitter.blockSelector
+Array Aiur.NativeAIR.Expr → Aiur.Bytecode.Block → Option Aiur.NativeAIR.Expr
+DEFINITION
+fun selectors block => Aiur.NativeAIR.BlockEmitter.ctrlSelector._mutual selectors (PSum.inr block)
+PREMISE Aiur.NativeAIR.BlockEmitter.Context.mk
+Nat → Nat → Aiur.NativeAIR.Expr → Aiur.NativeAIR.BlockEmitter.Context
+PREMISE Aiur.NativeAIR.BlockEmitter.ReturnExpr.mk
+Aiur.NativeAIR.Expr →
+  Nat →
+    Array Aiur.NativeAIR.Expr → Array Aiur.NativeAIR.Expr → Aiur.NativeAIR.Expr → Aiur.NativeAIR.BlockEmitter.ReturnExpr
+PREMISE Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.BlockEmitter.ReturnExpr → Option (Aiur.G × Aiur.Bytecode.AIR.Call)
+DEFINITION
+fun values returned => do
+  let selector ← Aiur.NativeAIR.OpEmitter.evalExpr values returned.selector
+  let inputs ← Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.inputs
+  let outputs ← Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) returned.outputs
+  let rank ← Aiur.NativeAIR.OpEmitter.evalExpr values returned.rank
+  pure (selector, { function := returned.function, inputs := inputs, outputs := outputs, rank := rank })
+PREMISE Aiur.NativeAIR.BlockEmitter.ReturnExpr.message
+Aiur.NativeAIR.BlockEmitter.ReturnExpr → List Aiur.NativeAIR.Expr
+DEFINITION
+fun returned =>
+  [Aiur.NativeAIR.Expr.konst 0, Aiur.NativeAIR.Expr.konst (Aiur.G.ofNat returned.function)] ++ returned.inputs.toList ++
+      returned.outputs.toList ++
+    [returned.rank]
+PREMISE Aiur.NativeAIR.BlockEmitter.YieldExpr.mk
+Aiur.NativeAIR.Expr → Array Aiur.NativeAIR.RowExpr → Aiur.NativeAIR.BlockEmitter.YieldExpr
+PREMISE Aiur.NativeAIR.BlockEmitter.YieldExpr.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.BlockEmitter.YieldExpr → Option (Aiur.G × Array Aiur.AIR.RowValue)
+DEFINITION
+fun values yielded => do
+  let selector ← Aiur.NativeAIR.OpEmitter.evalExpr values yielded.selector
+  let outputs ← Aiur.NativeAIR.OpEmitter.evalRows values yielded.values
+  pure (selector, outputs)
+PREMISE Aiur.NativeAIR.BlockEmitter.evalGatedCall
+Aiur.NativeAIR.Values Aiur.G →
+  Aiur.NativeAIR.Expr × Aiur.NativeAIR.OpEmitter.CallExpr → Option (Aiur.G × Aiur.Bytecode.AIR.Call × (Fin 6 → Aiur.G))
+DEFINITION
+fun values called => do
+  let selector ← Aiur.NativeAIR.OpEmitter.evalExpr values called.fst
+  let call ← Aiur.NativeAIR.OpEmitter.CallExpr.eval values called.snd
+  pure (selector, call)
+PREMISE Aiur.NativeAIR.BlockEmitter.Emission.mk
+Array Aiur.NativeAIR.RowExpr →
+  Nat →
+    Nat →
+      List Aiur.NativeAIR.Expr →
+        List Aiur.NativeAIR.LookupEmitter.QueryExpr →
+          List Aiur.NativeAIR.BlockEmitter.ReturnExpr →
+            List Aiur.NativeAIR.BlockEmitter.YieldExpr →
+              List (Aiur.NativeAIR.Expr × Aiur.NativeAIR.OpEmitter.CallExpr) → Aiur.NativeAIR.BlockEmitter.Emission
+PREMISE Aiur.NativeAIR.BlockEmitter.Emission.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.BlockEmitter.Emission → Option Aiur.AIR.BlockEmission
+DEFINITION
+fun values emission => do
+  let outputs ← Aiur.NativeAIR.OpEmitter.evalRows values emission.values
+  let equations ← List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations
+  let queries ← List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) emission.queries
+  let returns ← List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) emission.returns
+  let yields ← List.mapM (Aiur.NativeAIR.BlockEmitter.YieldExpr.eval values) emission.yields
+  let calls ← List.mapM (Aiur.NativeAIR.BlockEmitter.evalGatedCall values) emission.calls
+  pure
+      { values := outputs, column := emission.column, lookup := emission.lookup, equations := equations,
+        queries := queries, returns := returns, yields := yields, calls := calls }
+PREMISE Aiur.NativeAIR.BlockEmitter.Emission.prefix
+List Aiur.NativeAIR.Expr → Aiur.NativeAIR.BlockEmitter.Emission → Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun equations emission =>
+  { values := emission.values, column := emission.column, lookup := emission.lookup,
+    equations := equations ++ emission.equations, queries := emission.queries, returns := emission.returns,
+    yields := emission.yields, calls := emission.calls }
+PREMISE Aiur.NativeAIR.BlockEmitter.Emission.afterOps
+Aiur.NativeAIR.Expr →
+  Nat →
+    Aiur.NativeAIR.OpEmitter.OpsEmission → Aiur.NativeAIR.BlockEmitter.Emission → Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun incoming lookup ops control =>
+  { values := control.values, column := control.column, lookup := control.lookup,
+    equations := ops.equations ++ control.equations,
+    queries := Aiur.NativeAIR.LookupEmitter.queryParts lookup incoming ops.queries ++ control.queries,
+    returns := control.returns, yields := control.yields,
+    calls := List.map (fun x => (incoming, x)) ops.calls ++ control.calls }
+PREMISE Aiur.NativeAIR.BlockEmitter.join
+Array Aiur.NativeAIR.RowExpr →
+  Nat → Nat → List Aiur.NativeAIR.BlockEmitter.Emission → Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun values column lookup emissions =>
+  { values := values, column := List.foldl (fun column emission => max column emission.column) column emissions,
+    lookup := List.foldl (fun lookup emission => max lookup emission.lookup) lookup emissions,
+    equations := List.flatMap (fun x => x.equations) emissions, queries := List.flatMap (fun x => x.queries) emissions,
+    returns := List.flatMap (fun x => x.returns) emissions, yields := List.flatMap (fun x => x.yields) emissions,
+    calls := List.flatMap (fun x => x.calls) emissions }
+PREMISE Aiur.NativeAIR.BlockEmitter.Emission.continued
+Aiur.NativeAIR.BlockEmitter.Emission →
+  List Aiur.NativeAIR.Expr → Aiur.NativeAIR.BlockEmitter.Emission → Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun branches equations continuation =>
+  { values := continuation.values, column := continuation.column, lookup := continuation.lookup,
+    equations := branches.equations ++ equations ++ continuation.equations,
+    queries := branches.queries ++ continuation.queries, returns := branches.returns ++ continuation.returns,
+    yields := continuation.yields, calls := branches.calls ++ continuation.calls }
+PREMISE Aiur.NativeAIR.BlockEmitter.returned
+Aiur.NativeAIR.BlockEmitter.Context →
+  Aiur.NativeAIR.Expr →
+    Array Aiur.NativeAIR.RowExpr →
+      Array Aiur.NativeAIR.RowExpr → Array Aiur.NativeAIR.RowExpr → Nat → Nat → Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun context incoming rows inputs outputs column lookup =>
+  { values := rows, column := column, lookup := lookup,
+    returns :=
+      [{ selector := incoming, function := context.function, inputs := Aiur.NativeAIR.OpEmitter.rowExprs inputs,
+          outputs := Aiur.NativeAIR.OpEmitter.rowExprs outputs, rank := context.rank }] }
+PREMISE Aiur.NativeAIR.BlockEmitter.yielded
+Aiur.NativeAIR.Expr →
+  Array Aiur.NativeAIR.RowExpr → Array Aiur.NativeAIR.RowExpr → Nat → Nat → Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun selector rows outputs column lookup =>
+  { values := rows, column := column, lookup := lookup, yields := [{ selector := selector, values := outputs }] }
+PREMISE Aiur.NativeAIR.BlockEmitter.yieldValue
+Aiur.NativeAIR.BlockEmitter.YieldExpr → Nat → Aiur.NativeAIR.Expr
+DEFINITION
+fun yielded index => yielded.selector.frontMul (yielded.values[index]?.getD (Aiur.NativeAIR.RowExpr.konst 0)).expr
+PREMISE Aiur.NativeAIR.BlockEmitter.yieldGate
+List Aiur.NativeAIR.BlockEmitter.YieldExpr → Aiur.NativeAIR.Expr
+DEFINITION
+fun yields => Aiur.NativeAIR.BlockEmitter.sum (List.map (fun x => x.selector) yields)
+PREMISE Aiur.NativeAIR.BlockEmitter.mergeEquations
+Aiur.NativeAIR.Expr → Nat → Nat → List Aiur.NativeAIR.BlockEmitter.YieldExpr → List Aiur.NativeAIR.Expr
+DEFINITION
+fun incoming column size yields =>
+  List.map
+    (fun index =>
+      incoming.frontMul
+        ((Aiur.NativeAIR.mainCurrent (column + index)).expr.frontSub
+          (Aiur.NativeAIR.BlockEmitter.sum
+            (List.map (fun x => Aiur.NativeAIR.BlockEmitter.yieldValue x index) yields))))
+    (List.range size)
+PREMISE Aiur.NativeAIR.BlockEmitter.caseEquation
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.RowExpr → Aiur.G → Aiur.NativeAIR.Expr
+DEFINITION
+fun entry matched value => entry.frontMul (matched.expr.frontSub (Aiur.NativeAIR.Expr.konst value))
+PREMISE Aiur.NativeAIR.BlockEmitter.defaultEquations
+Aiur.NativeAIR.Expr → Aiur.NativeAIR.RowExpr → Nat → Array (Aiur.G × Aiur.Bytecode.Block) → List Aiur.NativeAIR.Expr
+DEFINITION
+fun entry matched column branches =>
+  List.mapIdx
+    (fun index pair =>
+      entry.frontMul
+        (((matched.expr.frontSub (Aiur.NativeAIR.Expr.konst pair.fst)).frontMul
+              (Aiur.NativeAIR.mainCurrent (column + index)).expr).frontSub
+          (Aiur.NativeAIR.Expr.konst 1)))
+    branches.toList
+PREMISE Aiur.NativeAIR.BlockEmitter.emitCtrl
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.Expr →
+      Array Aiur.NativeAIR.RowExpr → Nat → Nat → Aiur.Bytecode.Ctrl → Option Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun selectors context incoming rows column lookup a =>
+  Aiur.NativeAIR.BlockEmitter.emitCtrl._mutual selectors context (PSum.inl ⟨incoming, ⟨rows, ⟨column, ⟨lookup, a⟩⟩⟩⟩)
+PREMISE Aiur.NativeAIR.BlockEmitter.emitBlock
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.Expr →
+      Array Aiur.NativeAIR.RowExpr → Nat → Nat → Aiur.Bytecode.Block → Option Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun selectors context incoming rows column lookup block =>
+  Aiur.NativeAIR.BlockEmitter.emitCtrl._mutual selectors context
+    (PSum.inr ⟨incoming, ⟨rows, ⟨column, ⟨lookup, block⟩⟩⟩⟩)
+PREMISE Aiur.NativeAIR.BlockEmitter.caseRow
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.RowExpr →
+      Array Aiur.NativeAIR.RowExpr →
+        Nat → Nat → Aiur.G × Aiur.Bytecode.Block → Option Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun selectors context matched rows column lookup pair => do
+  let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors pair.snd
+  let emission ← Aiur.NativeAIR.BlockEmitter.emitBlock selectors context entry rows column lookup pair.snd
+  pure
+      (Aiur.NativeAIR.BlockEmitter.Emission.prefix [Aiur.NativeAIR.BlockEmitter.caseEquation entry matched pair.fst]
+        emission)
+PREMISE Aiur.NativeAIR.BlockEmitter.defaultRow
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.RowExpr →
+      Array Aiur.NativeAIR.RowExpr →
+        Nat →
+          Nat →
+            Array (Aiur.G × Aiur.Bytecode.Block) →
+              Option Aiur.Bytecode.Block → Option (List Aiur.NativeAIR.BlockEmitter.Emission)
+DEFINITION
+fun selectors context matched rows column lookup branches fallback =>
+  match fallback with
+  | none => some []
+  | some block => do
+    let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors block
+    let emission ←
+      Aiur.NativeAIR.BlockEmitter.emitBlock selectors context entry rows (column + branches.size) lookup block
+    pure
+        [Aiur.NativeAIR.BlockEmitter.Emission.prefix
+            (Aiur.NativeAIR.BlockEmitter.defaultEquations entry matched column branches) emission]
+PREMISE Aiur.NativeAIR.BlockEmitter.branchRows
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.RowExpr →
+      Array Aiur.NativeAIR.RowExpr →
+        Nat →
+          Nat →
+            Array (Aiur.G × Aiur.Bytecode.Block) →
+              Option Aiur.Bytecode.Block → Option Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun selectors context matched rows column lookup branches fallback => do
+  let cases ←
+    List.mapM (Aiur.NativeAIR.BlockEmitter.caseRow selectors context matched rows column lookup) branches.toList
+  let default ← Aiur.NativeAIR.BlockEmitter.defaultRow selectors context matched rows column lookup branches fallback
+  pure (Aiur.NativeAIR.BlockEmitter.join rows column lookup (cases ++ default))
+PREMISE Aiur.NativeAIR.BlockEmitter.continueRow
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.Expr →
+      Array Aiur.NativeAIR.RowExpr →
+        Nat → Aiur.Bytecode.Block → Aiur.NativeAIR.BlockEmitter.Emission → Option Aiur.NativeAIR.BlockEmitter.Emission
+DEFINITION
+fun selectors context incoming rows size continuation joined =>
+  if (joined.yields.all fun part => part.values.size == size) = true then
+    have gate := Aiur.NativeAIR.BlockEmitter.yieldGate joined.yields;
+    do
+    let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors continuation
+    have equations : List Aiur.NativeAIR.Expr :=
+      Aiur.NativeAIR.BlockEmitter.mergeEquations incoming joined.column size joined.yields ++ [entry.frontSub gate]
+    let continued ←
+      Aiur.NativeAIR.BlockEmitter.emitBlock selectors context gate
+          (rows ++ Aiur.NativeAIR.OpEmitter.advice joined.column size) (joined.column + size) joined.lookup continuation
+    pure (joined.continued equations continued)
+  else none
+PREMISE Aiur.NativeAIR.BlockEmitter.selectorAt
+Array Aiur.G → Nat → Aiur.G
+DEFINITION
+fun selectors index => selectors[index]?.getD 0
+PREMISE Aiur.NativeAIR.BlockEmitter.Context.valued
+Aiur.NativeAIR.BlockEmitter.Context → Aiur.G → Aiur.AIR.RowContext
+DEFINITION
+fun context rank => { function := context.function, inputSize := context.inputSize, rank := rank }
+PREMISE Aiur.NativeAIR.BlockEmitter.BlockReflects
+Aiur.NativeAIR.Values Aiur.G →
+  (Nat → Aiur.G) →
+    Array Aiur.NativeAIR.Expr →
+      (Nat → Aiur.G) → Aiur.NativeAIR.BlockEmitter.Context → Aiur.G → Aiur.Bytecode.Block → Prop
+DEFINITION
+fun values row selectors selected context rank block =>
+  ∀ {incoming : Aiur.NativeAIR.Expr} {s : Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr}
+    {inputs : Array Aiur.AIR.RowValue} {column lookup : Nat} {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+    Aiur.NativeAIR.OpEmitter.evalExpr values incoming = some s →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.BlockEmitter.emitBlock selectors context incoming rows column lookup block = some emission →
+            (∀ (index : Nat),
+                column ≤ index →
+                  index < emission.column →
+                    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                      some (row index)) →
+              ∃ result,
+                Aiur.Bytecode.Block.emitRow row selected (context.valued rank) s inputs column lookup block =
+                    some result ∧
+                  Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result
+PREMISE Aiur.NativeAIR.BlockEmitter.CtrlReflects
+Aiur.NativeAIR.Values Aiur.G →
+  (Nat → Aiur.G) →
+    Array Aiur.NativeAIR.Expr →
+      (Nat → Aiur.G) → Aiur.NativeAIR.BlockEmitter.Context → Aiur.G → Aiur.Bytecode.Ctrl → Prop
+DEFINITION
+fun values row selectors selected context rank ctrl =>
+  ∀ {incoming : Aiur.NativeAIR.Expr} {s : Aiur.G} {rows : Array Aiur.NativeAIR.RowExpr}
+    {inputs : Array Aiur.AIR.RowValue} {column lookup : Nat} {emission : Aiur.NativeAIR.BlockEmitter.Emission},
+    Aiur.NativeAIR.OpEmitter.evalExpr values incoming = some s →
+      Aiur.NativeAIR.OpEmitter.evalRows values rows = some inputs →
+        Aiur.NativeAIR.OpEmitter.Normal rows →
+          Aiur.NativeAIR.BlockEmitter.emitCtrl selectors context incoming rows column lookup ctrl = some emission →
+            (∀ (index : Nat),
+                column ≤ index →
+                  index < emission.column →
+                    (values.columns Aiur.NativeAIR.Source.main Aiur.NativeAIR.RowOffset.current)[index]? =
+                      some (row index)) →
+              ∃ result,
+                Aiur.Bytecode.Ctrl.emitRow row selected (context.valued rank) s inputs column lookup ctrl =
+                    some result ∧
+                  Aiur.NativeAIR.BlockEmitter.Emission.eval values emission = some result
+PREMISE Aiur.NativeAIR.BlockEmitter.returnArgs
+Bool → List Aiur.NativeAIR.BlockEmitter.ReturnExpr → List Aiur.NativeAIR.Expr
+DEFINITION
+fun branchless returns =>
+  List.foldl
+    (fun args returned =>
+      Aiur.NativeAIR.LookupEmitter.addArgs args
+        (Aiur.NativeAIR.LookupEmitter.gateArgs branchless returned.selector returned.message))
+    [] returns
+PREMISE Aiur.NativeAIR.BlockEmitter.lookup
+Bool → Aiur.NativeAIR.BlockEmitter.Emission → Nat → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun branchless emission slot =>
+  if slot = 0 then
+    { multiplicity := Aiur.NativeAIR.Expr.konst 0,
+      args := Aiur.NativeAIR.BlockEmitter.returnArgs branchless emission.returns }
+  else Aiur.NativeAIR.LookupEmitter.slot branchless emission.queries slot
+PREMISE Aiur.NativeAIR.CircuitEmitter.selectorExprs
+Nat → Nat → Array Aiur.NativeAIR.Expr
+DEFINITION
+fun base count => Array.ofFn fun index => (Aiur.NativeAIR.mainCurrent (base + ↑index)).expr
+PREMISE Aiur.NativeAIR.CircuitEmitter.Member.mk
+Nat →
+  Aiur.Bytecode.Function →
+    Nat → Aiur.NativeAIR.Expr → Aiur.NativeAIR.BlockEmitter.Emission → Aiur.NativeAIR.CircuitEmitter.Member
+PREMISE Aiur.NativeAIR.CircuitEmitter.Member.readBound
+Aiur.NativeAIR.CircuitEmitter.Member → Nat
+DEFINITION
+fun member =>
+  max member.function.layout.inputSize (max (member.selectorBase + member.function.layout.selectors) member.body.column)
+PREMISE Aiur.NativeAIR.CircuitEmitter.Member.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.CircuitEmitter.Member → Option Aiur.AIR.MemberEmission
+DEFINITION
+fun values member => do
+  let body ← Aiur.NativeAIR.BlockEmitter.Emission.eval values member.body
+  pure
+      { functionIndex := member.functionIndex, function := member.function, selectorBase := member.selectorBase,
+        body := body }
+PREMISE Aiur.NativeAIR.CircuitEmitter.emitMember
+Aiur.NativeAIR.Expr → Nat → Nat → Nat → Aiur.Bytecode.Toplevel → Nat → Option Aiur.NativeAIR.CircuitEmitter.Member
+DEFINITION
+fun rank column lookup selectorBase program functionIndex => do
+  let function ← program.functions[functionIndex]?
+  have selectors : Array Aiur.NativeAIR.Expr :=
+    Aiur.NativeAIR.CircuitEmitter.selectorExprs selectorBase function.layout.selectors
+  let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors function.body
+  let body ←
+    Aiur.NativeAIR.BlockEmitter.emitBlock selectors
+        { function := functionIndex, inputSize := function.layout.inputSize, rank := rank } entry
+        (Aiur.NativeAIR.OpEmitter.advice 0 function.layout.inputSize) column lookup function.body
+  pure
+      { functionIndex := functionIndex, function := function, selectorBase := selectorBase, entry := entry,
+        body := body }
+PREMISE Aiur.NativeAIR.CircuitEmitter.emitMembers
+Aiur.NativeAIR.Expr →
+  Nat → Nat → Nat → Aiur.Bytecode.Toplevel → List Nat → Option (List Aiur.NativeAIR.CircuitEmitter.Member)
+DEFINITION
+fun rank column lookup selectorBase program x =>
+  List.brecOn (motive := fun x => Nat → Option (List Aiur.NativeAIR.CircuitEmitter.Member)) x
+    (Aiur.NativeAIR.CircuitEmitter.emitMembers._f rank column lookup program) selectorBase
+PREMISE Aiur.NativeAIR.CircuitEmitter.rankBytes
+Aiur.Bytecode.FunctionLayout → Fin 6 → Aiur.NativeAIR.Expr
+DEFINITION
+fun layout index => (Aiur.NativeAIR.mainCurrent (layout.inputSize + layout.selectors + 1 + ↑index)).expr
+PREMISE Aiur.NativeAIR.CircuitEmitter.selectorEquations
+Aiur.Bytecode.FunctionLayout → List Aiur.NativeAIR.Expr
+DEFINITION
+fun layout =>
+  List.map
+    (fun index =>
+      have selector := (Aiur.NativeAIR.mainCurrent (layout.inputSize + index)).expr;
+      selector.frontMul (selector.frontSub (Aiur.NativeAIR.Expr.konst 1)))
+    (List.range layout.selectors)
+PREMISE Aiur.NativeAIR.CircuitEmitter.Emission.mk
+List Aiur.NativeAIR.CircuitEmitter.Member →
+  Aiur.NativeAIR.Expr →
+    Aiur.NativeAIR.Expr →
+      (Fin 6 → Aiur.NativeAIR.Expr) →
+        Nat →
+          Nat →
+            Nat →
+              Nat →
+                Bool →
+                  List Aiur.NativeAIR.Expr →
+                    List Aiur.NativeAIR.LookupEmitter.QueryExpr →
+                      List Aiur.NativeAIR.BlockEmitter.ReturnExpr → Aiur.NativeAIR.CircuitEmitter.Emission
+PREMISE Aiur.NativeAIR.CircuitEmitter.Emission.readBound
+Aiur.NativeAIR.CircuitEmitter.Emission → Nat
+DEFINITION
+fun emission =>
+  List.foldl (fun bound member => max bound member.readBound) (emission.selectorStart + emission.selectorCount + 1 + 6)
+    emission.members
+PREMISE Aiur.NativeAIR.CircuitEmitter.circuitEmission
+Aiur.Bytecode.Circuit → List Aiur.NativeAIR.CircuitEmitter.Member → Aiur.NativeAIR.CircuitEmitter.Emission
+DEFINITION
+fun circuit members =>
+  have selector := Aiur.NativeAIR.BlockEmitter.sum (List.map (fun x => x.entry) members);
+  have multiplicity := (Aiur.NativeAIR.mainCurrent (circuit.layout.inputSize + circuit.layout.selectors)).expr;
+  have bytes := Aiur.NativeAIR.CircuitEmitter.rankBytes circuit.layout;
+  { members := members, selector := selector, multiplicity := multiplicity, rankBytes := bytes,
+    width := circuit.layout.width, selectorStart := circuit.layout.inputSize, selectorCount := circuit.layout.selectors,
+    lookupCount := circuit.layout.lookups,
+    branchless := Aiur.Bytecode.circuitBranchless circuit.layout.selectors (List.map (fun x => x.function) members),
+    equations :=
+      (List.flatMap (fun x => x.body.equations) members ++
+            Aiur.NativeAIR.CircuitEmitter.selectorEquations circuit.layout ++
+          if 1 < circuit.members.size then [selector.frontMul ((Aiur.NativeAIR.Expr.konst 1).frontSub selector)]
+          else []) ++
+        [multiplicity.frontMul ((Aiur.NativeAIR.Expr.konst 1).frontSub selector)],
+    queries :=
+      List.flatMap (fun x => x.body.queries) members ++
+        Aiur.NativeAIR.LookupEmitter.queryParts 1 selector (Aiur.NativeAIR.OpEmitter.rangeSix bytes),
+    returns := List.flatMap (fun x => x.body.returns) members }
+PREMISE Aiur.NativeAIR.CircuitEmitter.emitCircuit
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Circuit → Option Aiur.NativeAIR.CircuitEmitter.Emission
+DEFINITION
+fun program circuit =>
+  have rank := Aiur.NativeAIR.OpEmitter.packSix (Aiur.NativeAIR.CircuitEmitter.rankBytes circuit.layout);
+  have column := circuit.layout.inputSize + circuit.layout.selectors + 1 + 6;
+  do
+  let members ←
+    Aiur.NativeAIR.CircuitEmitter.emitMembers rank column 4 circuit.layout.inputSize program circuit.members.toList
+  pure (Aiur.NativeAIR.CircuitEmitter.circuitEmission circuit members)
+PREMISE Aiur.NativeAIR.CircuitEmitter.Emission.lookup
+Aiur.NativeAIR.CircuitEmitter.Emission → Nat → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun emission slot =>
+  if slot = 0 then
+    { multiplicity := emission.multiplicity.frontNeg,
+      args := Aiur.NativeAIR.BlockEmitter.returnArgs emission.branchless emission.returns }
+  else Aiur.NativeAIR.LookupEmitter.slot emission.branchless emission.queries slot
+PREMISE Aiur.NativeAIR.CircuitEmitter.Emission.lookups
+Aiur.NativeAIR.CircuitEmitter.Emission → List Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun emission => List.ofFn fun slot => emission.lookup ↑slot
+PREMISE Aiur.NativeAIR.CircuitEmitter.evalFin
+{size : Nat} → Aiur.NativeAIR.Values Aiur.G → (Fin size → Aiur.NativeAIR.Expr) → Option (Fin size → Aiur.G)
+DEFINITION
+fun {size} values expressions => do
+  let results ← Array.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) (Array.ofFn expressions)
+  pure fun index => results[↑index]?.getD 0
+PREMISE Aiur.NativeAIR.CircuitEmitter.Emission.eval
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.CircuitEmitter.Emission → Option Aiur.AIR.CircuitEmission
+DEFINITION
+fun values emission => do
+  let members ← List.mapM (Aiur.NativeAIR.CircuitEmitter.Member.eval values) emission.members
+  let selector ← Aiur.NativeAIR.OpEmitter.evalExpr values emission.selector
+  let multiplicity ← Aiur.NativeAIR.OpEmitter.evalExpr values emission.multiplicity
+  let rankBytes ← Aiur.NativeAIR.CircuitEmitter.evalFin values emission.rankBytes
+  let equations ← List.mapM (Aiur.NativeAIR.OpEmitter.evalExpr values) emission.equations
+  let queries ← List.mapM (Aiur.NativeAIR.LookupEmitter.QueryExpr.eval values) emission.queries
+  let returns ← List.mapM (Aiur.NativeAIR.BlockEmitter.ReturnExpr.eval values) emission.returns
+  pure
+      { members := members, selector := selector, multiplicity := multiplicity, rankBytes := rankBytes,
+        width := emission.width, selectorStart := emission.selectorStart, selectorCount := emission.selectorCount,
+        lookupCount := emission.lookupCount, branchless := emission.branchless, equations := equations,
+        queries := queries, returns := returns }
+PREMISE Aiur.NativeAIR.CircuitEmitter.Compiled.mk
+Aiur.NativeAIR.CircuitEmitter.Emission →
+  Aiur.NativeAIR.Compiler.BaseCompilation → Aiur.NativeAIR.CircuitEmitter.Compiled
+PREMISE Aiur.NativeAIR.CircuitEmitter.compileCircuit
+Aiur.NativeAIR.GraphWidths →
+  Aiur.Bytecode.Toplevel → Aiur.Bytecode.Circuit → Option Aiur.NativeAIR.CircuitEmitter.Compiled
+DEFINITION
+fun widths program circuit => do
+  let emission ← Aiur.NativeAIR.CircuitEmitter.emitCircuit program circuit
+  let base ← Aiur.NativeAIR.Compiler.compileBase widths emission.lookups emission.equations
+  pure { emission := emission, base := base }
+PREMISE Aiur.Bytecode.OpAllocation.mk
+Array Nat → Nat → Aiur.Bytecode.OpAllocation
+PREMISE Aiur.Bytecode.OpAllocation.advice
+Nat → Aiur.Bytecode.OpAllocation
+DEFINITION
+fun size => { degrees := Array.replicate size 1, auxiliaries := size }
+PREMISE Aiur.Bytecode.selectedDegree
+Array Nat → Array Nat → Nat → Nat
+DEFINITION
+fun degrees indices initial => Array.foldl Nat.max initial (Array.map (fun index => degrees[index]?.getD 0) indices)
+PREMISE Aiur.Bytecode.Op.allocation
+Array Nat → Aiur.Bytecode.Op → Aiur.Bytecode.OpAllocation
+DEFINITION
+fun degrees x =>
+  match x with
+  | Aiur.Bytecode.Op.const a => { degrees := #[0], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.add a b => { degrees := #[max (degrees[a]?.getD 0) (degrees[b]?.getD 0)], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.sub a b => { degrees := #[max (degrees[a]?.getD 0) (degrees[b]?.getD 0)], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.mul a b =>
+    have degree := degrees[a]?.getD 0 + degrees[b]?.getD 0;
+    if degree < 2 then { degrees := #[degree], auxiliaries := 0 } else Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.eqZero a =>
+    if degrees[a]?.getD 0 = 0 then { degrees := #[0], auxiliaries := 0 } else { degrees := #[1], auxiliaries := 2 }
+  | Aiur.Bytecode.Op.call a a_1 size unconstrained =>
+    { degrees := Array.replicate size 1, auxiliaries := size + if unconstrained = true then 0 else 7 }
+  | Aiur.Bytecode.Op.store a => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.load size a => Aiur.Bytecode.OpAllocation.advice size
+  | Aiur.Bytecode.Op.ioRead a a_1 size => Aiur.Bytecode.OpAllocation.advice size
+  | Aiur.Bytecode.Op.assertEq a a_1 a_2 => { degrees := #[], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.ioSetInfo a a_1 a_2 a_3 => { degrees := #[], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.ioWrite a a_1 => { degrees := #[], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.debug a a_1 => { degrees := #[], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.u8RangeCheck a a_1 => { degrees := #[], auxiliaries := 0 }
+  | Aiur.Bytecode.Op.ioGetInfo a a_1 => Aiur.Bytecode.OpAllocation.advice 2
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a a_1 => Aiur.Bytecode.OpAllocation.advice 2
+  | Aiur.Bytecode.Op.u8BitDecomposition a => Aiur.Bytecode.OpAllocation.advice 8
+  | Aiur.Bytecode.Op.unconstrainedGToBytes a => Aiur.Bytecode.OpAllocation.advice 8
+  | Aiur.Bytecode.Op.u8ShiftLeft a => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.u8ShiftRight a => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.u8Xor a a_1 => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.u8And a a_1 => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.u8Or a a_1 => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.u8LessThan a a_1 => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.unconstrainedGInverse a => Aiur.Bytecode.OpAllocation.advice 1
+  | Aiur.Bytecode.Op.u8Add a b =>
+    { degrees := #[1, max (max (degrees[a]?.getD 0) (degrees[b]?.getD 0)) 1], auxiliaries := 1 }
+  | Aiur.Bytecode.Op.u8Sub a b =>
+    { degrees := #[1, max (max (degrees[a]?.getD 0) (degrees[b]?.getD 0)) 1], auxiliaries := 1 }
+  | Aiur.Bytecode.Op.u8Mul a a_1 => Aiur.Bytecode.OpAllocation.advice 2
+  | Aiur.Bytecode.Op.u8XorSplit7 a a_1 => Aiur.Bytecode.OpAllocation.advice 2
+  | Aiur.Bytecode.Op.u8XorSplit4 a a_1 => Aiur.Bytecode.OpAllocation.advice 2
+  | Aiur.Bytecode.Op.u32LessThan a a_1 => { degrees := #[1], auxiliaries := 12 }
+  | Aiur.Bytecode.Op.unconstrainedU32Add a b =>
+    { degrees := (Array.replicate 4 1).push (Aiur.Bytecode.selectedDegree degrees (a ++ b) 1), auxiliaries := 4 }
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a b c =>
+    { degrees := (Array.replicate 4 1).push (Aiur.Bytecode.selectedDegree degrees (a ++ b ++ c) 1), auxiliaries := 4 }
+  | Aiur.Bytecode.Op.u32ToField indices =>
+    { degrees := #[Aiur.Bytecode.selectedDegree degrees indices 0], auxiliaries := 0 }
+PREMISE Aiur.NativeAIR.RowExpr.ZeroConstant
+Aiur.NativeAIR.RowExpr → Prop
+DEFINITION
+fun row => row.degree = 0 → ∃ value, row.expr = Aiur.NativeAIR.Expr.konst value
+PREMISE Aiur.NativeAIR.OpEmitter.DegreeValid
+Array Aiur.NativeAIR.RowExpr → Prop
+DEFINITION
+fun rows => ∀ (row : Aiur.NativeAIR.RowExpr), row ∈ rows → row.ZeroConstant
+PREMISE Aiur.NativeAIR.OpEmitter.rowDegrees
+Array Aiur.NativeAIR.RowExpr → Array Nat
+DEFINITION
+fun rows => Array.map Aiur.NativeAIR.RowExpr.degree rows
+PREMISE Aiur.NativeAIR.OpEmitter.Emission.allocation
+Aiur.NativeAIR.OpEmitter.Emission → Aiur.Bytecode.OpAllocation
+DEFINITION
+fun emission => { degrees := Aiur.NativeAIR.OpEmitter.rowDegrees emission.outputs, auxiliaries := emission.used }
+PREMISE Aiur.Concrete.Bytecode.allocationBranchStep
+Aiur.Concrete.Bytecode.SharedData →
+  Array Nat →
+    Aiur.Concrete.Bytecode.SharedData →
+      Aiur.Bytecode.Block → Aiur.Concrete.Bytecode.LayoutM Aiur.Concrete.Bytecode.SharedData
+DEFINITION
+fun shared degrees acc block => do
+  Aiur.Concrete.Bytecode.setSharedData shared
+  Aiur.Concrete.Bytecode.blockLayout block
+  let used ← Aiur.Concrete.Bytecode.getSharedData
+  Aiur.Concrete.Bytecode.setDegrees degrees
+  pure (acc.maximals used)
+PREMISE Aiur.Bytecode.Function.ComputedLayout
+Aiur.Bytecode.Function → Prop
+DEFINITION
+fun function =>
+  have computed :=
+    (StateT.run (Aiur.Concrete.Bytecode.blockLayout function.body)
+          (Aiur.Concrete.Bytecode.LayoutMState.new function.layout.inputSize)).snd.functionLayout;
+  function.layout =
+    { inputSize := computed.inputSize, selectors := computed.selectors, auxiliaries := computed.auxiliaries,
+      lookups := computed.lookups + 1 }
+PREMISE Aiur.Bytecode.FunctionsComputedLayout
+Array Aiur.Bytecode.Function → Prop
+DEFINITION
+fun functions => ∀ (function : Aiur.Bytecode.Function), function ∈ functions → function.ComputedLayout
+PREMISE Aiur.Bytecode.MembersColumnBound
+Array Aiur.Bytecode.Function → Array Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunctionLayout → Prop
+DEFINITION
+fun functions members layout =>
+  7 ≤ layout.auxiliaries ∧
+    ∀ (index : Aiur.Bytecode.FunIdx),
+      index ∈ members →
+        functions[index]!.layout.inputSize ≤ layout.inputSize ∧
+          functions[index]!.layout.auxiliaries ≤ layout.auxiliaries
+PREMISE Aiur.Bytecode.CircuitsColumnBound
+Array Aiur.Bytecode.Function → Array Aiur.Bytecode.Circuit → Prop
+DEFINITION
+fun functions circuits =>
+  ∀ (circuit : Aiur.Bytecode.Circuit),
+    circuit ∈ circuits → Aiur.Bytecode.MembersColumnBound functions circuit.members circuit.layout
+PREMISE Aiur.AIR.BlockEmission.Inactive
+Aiur.AIR.BlockEmission → Prop
+DEFINITION
+fun emission =>
+  (∀ (equation : Aiur.G), equation ∈ emission.equations → equation = 0) ∧
+    ∀ (part : Aiur.G × Array Aiur.AIR.RowValue), part ∈ emission.yields → part.fst = 0
+PREMISE Aiur.NativeAIR.CircuitEmitter.circuitWidths
+Aiur.Bytecode.Circuit → Aiur.NativeAIR.GraphWidths
+DEFINITION
+fun circuit => { preprocessed := 0, main := circuit.layout.width, stage2 := 0, publics := 0 }
+PREMISE Aiur.NativeAIR.CircuitEmitter.zeroValues
+Nat → Aiur.NativeAIR.Values Aiur.G
+DEFINITION
+fun width =>
+  {
+    columns := fun source x =>
+      match source with
+      | Aiur.NativeAIR.Source.main => Array.replicate width 0
+      | x => #[],
+    publics := #[], isFirstRow := 0, isLastRow := 0, isTransition := 0 }
+PREMISE Aiur.Bytecode.indicesInScope
+Nat → Array Aiur.Bytecode.ValIdx → Bool
+DEFINITION
+fun available indices => indices.all fun index => decide (index < available)
+PREMISE Aiur.Bytecode.wordInScope
+Nat → Array Aiur.Bytecode.ValIdx → Bool
+DEFINITION
+fun available indices => indices.size == 4 && Aiur.Bytecode.indicesInScope available indices
+PREMISE Aiur.Bytecode.Op.outputSize
+Aiur.Bytecode.Op → Nat
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Op.const a => 1
+  | Aiur.Bytecode.Op.add a a_1 => 1
+  | Aiur.Bytecode.Op.sub a a_1 => 1
+  | Aiur.Bytecode.Op.mul a a_1 => 1
+  | Aiur.Bytecode.Op.eqZero a => 1
+  | Aiur.Bytecode.Op.store a => 1
+  | Aiur.Bytecode.Op.u8ShiftLeft a => 1
+  | Aiur.Bytecode.Op.u8ShiftRight a => 1
+  | Aiur.Bytecode.Op.u8Xor a a_1 => 1
+  | Aiur.Bytecode.Op.u8And a a_1 => 1
+  | Aiur.Bytecode.Op.u8Or a a_1 => 1
+  | Aiur.Bytecode.Op.u8LessThan a a_1 => 1
+  | Aiur.Bytecode.Op.u32LessThan a a_1 => 1
+  | Aiur.Bytecode.Op.unconstrainedGInverse a => 1
+  | Aiur.Bytecode.Op.u32ToField a => 1
+  | Aiur.Bytecode.Op.call a a_1 size unconstrained => size
+  | Aiur.Bytecode.Op.load size a => size
+  | Aiur.Bytecode.Op.ioRead a a_1 size => size
+  | Aiur.Bytecode.Op.assertEq a a_1 a_2 => 0
+  | Aiur.Bytecode.Op.ioSetInfo a a_1 a_2 a_3 => 0
+  | Aiur.Bytecode.Op.ioWrite a a_1 => 0
+  | Aiur.Bytecode.Op.debug a a_1 => 0
+  | Aiur.Bytecode.Op.u8RangeCheck a a_1 => 0
+  | Aiur.Bytecode.Op.ioGetInfo a a_1 => 2
+  | Aiur.Bytecode.Op.u8Add a a_1 => 2
+  | Aiur.Bytecode.Op.u8Mul a a_1 => 2
+  | Aiur.Bytecode.Op.u8Sub a a_1 => 2
+  | Aiur.Bytecode.Op.u8XorSplit7 a a_1 => 2
+  | Aiur.Bytecode.Op.u8XorSplit4 a a_1 => 2
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a a_1 => 2
+  | Aiur.Bytecode.Op.u8BitDecomposition a => 8
+  | Aiur.Bytecode.Op.unconstrainedGToBytes a => 8
+  | Aiur.Bytecode.Op.unconstrainedU32Add a a_1 => 5
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a a_1 a_2 => 5
+PREMISE Aiur.Bytecode.Op.emissionInputs
+Nat → Aiur.Bytecode.Op → Bool
+DEFINITION
+fun available x =>
+  match x with
+  | Aiur.Bytecode.Op.add a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.sub a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.mul a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8Xor a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8Add a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8Mul a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8Sub a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8And a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8Or a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8LessThan a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u32LessThan a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8XorSplit7 a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8XorSplit4 a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.u8RangeCheck a b => decide (a < available) && decide (b < available)
+  | Aiur.Bytecode.Op.eqZero index => decide (index < available)
+  | Aiur.Bytecode.Op.load size index => decide (index < available)
+  | Aiur.Bytecode.Op.u8BitDecomposition index => decide (index < available)
+  | Aiur.Bytecode.Op.u8ShiftLeft index => decide (index < available)
+  | Aiur.Bytecode.Op.u8ShiftRight index => decide (index < available)
+  | Aiur.Bytecode.Op.call a indices outputSize false => Aiur.Bytecode.indicesInScope available indices
+  | Aiur.Bytecode.Op.store indices => Aiur.Bytecode.indicesInScope available indices
+  | Aiur.Bytecode.Op.assertEq left right a =>
+    left.size == right.size &&
+      (Aiur.Bytecode.indicesInScope available left && Aiur.Bytecode.indicesInScope available right)
+  | Aiur.Bytecode.Op.unconstrainedU32Add left right =>
+    Aiur.Bytecode.wordInScope available left && Aiur.Bytecode.wordInScope available right
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 left middle right =>
+    Aiur.Bytecode.wordInScope available left &&
+      (Aiur.Bytecode.wordInScope available middle && Aiur.Bytecode.wordInScope available right)
+  | Aiur.Bytecode.Op.u32ToField indices => Aiur.Bytecode.wordInScope available indices
+  | x => true
+PREMISE Aiur.Bytecode.addScope
+Nat → Nat → Option Nat
+DEFINITION
+fun available count =>
+  have next := available + count;
+  if next < 2 ^ 64 then some next else none
+PREMISE Aiur.Bytecode.checkEmissionOps
+List Aiur.Bytecode.Op → Nat → Option Nat
+DEFINITION
+fun x x_1 => List.brecOn (motive := fun x => Nat → Option Nat) x Aiur.Bytecode.checkEmissionOps._f x_1
+PREMISE Aiur.Bytecode.Ctrl.emissionChecks
+Nat → Nat → Option Nat → Aiur.Bytecode.Ctrl → Bool
+DEFINITION
+fun available selectors yieldSize a =>
+  Aiur.Bytecode.Ctrl.emissionChecks._mutual selectors (PSum.inl ⟨available, ⟨yieldSize, a⟩⟩)
+PREMISE Aiur.Bytecode.Block.emissionChecks
+Nat → Nat → Option Nat → Aiur.Bytecode.Block → Bool
+DEFINITION
+fun available selectors yieldSize block =>
+  Aiur.Bytecode.Ctrl.emissionChecks._mutual selectors (PSum.inr ⟨available, ⟨yieldSize, block⟩⟩)
+PREMISE Aiur.Bytecode.Function.emissionChecks
+Aiur.Bytecode.Function → Bool
+DEFINITION
+fun function =>
+  decide (function.layout.inputSize < 2 ^ 64) &&
+    Aiur.Bytecode.Block.emissionChecks function.layout.inputSize function.layout.selectors none function.body
+PREMISE Aiur.Bytecode.Toplevel.validateEmission
+Aiur.Bytecode.Toplevel → Bool
+DEFINITION
+fun program => program.functions.all fun function => !function.constrained || function.emissionChecks
+PREMISE Aiur.NativeAIR.BlockEmitter.Emission.YieldShape
+Option Nat → Aiur.NativeAIR.BlockEmitter.Emission → Prop
+DEFINITION
+fun size emission =>
+  ∀ (part : Aiur.NativeAIR.BlockEmitter.YieldExpr), part ∈ emission.yields → size = some part.values.size
+PREMISE Aiur.BoundVerifier.Selection.keyParameters
+Aiur.BoundVerifier.Selection → Aiur.NativeAIR.KeyCodec.Parameters
+DEFINITION
+fun selection =>
+  { logBlowup := selection.commitment.logBlowup, capHeight := selection.commitment.capHeight,
+    logFinalPolyLen := selection.fri.logFinalPolyLen, maxLogArity := selection.fri.maxLogArity,
+    numQueries := selection.fri.numQueries, commitProofOfWorkBits := selection.fri.commitProofOfWorkBits,
+    queryProofOfWorkBits := selection.fri.queryProofOfWorkBits }
+PREMISE Aiur.NativeAIR.KeyCodec.Reader
+Type → Type
+DEFINITION
+StateT (List UInt8) Option
+PREMISE Aiur.NativeAIR.KeyCodec.readByte
+Aiur.NativeAIR.KeyCodec.Reader UInt8
+DEFINITION
+fun x =>
+  match x with
+  | [] => none
+  | byte :: rest => some (byte, rest)
+PREMISE Aiur.NativeAIR.KeyCodec.readNat
+Nat → Aiur.NativeAIR.KeyCodec.Reader Nat
+DEFINITION
+fun x => Nat.brecOn x Aiur.NativeAIR.KeyCodec.readNat._f
+PREMISE Aiur.NativeAIR.KeyCodec.readMany
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → Nat → Aiur.NativeAIR.KeyCodec.Reader (List α)
+DEFINITION
+fun {α} read x => Nat.brecOn x (Aiur.NativeAIR.KeyCodec.readMany._f read)
+PREMISE Aiur.NativeAIR.KeyCodec.readVector
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → Aiur.NativeAIR.KeyCodec.Reader (List α)
+DEFINITION
+fun {α} read => do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+  Aiur.NativeAIR.KeyCodec.readMany read __do_lift
+PREMISE Aiur.NativeAIR.KeyCodec.encodeNat
+Nat → Nat → List UInt8
+DEFINITION
+fun x x_1 => Nat.brecOn (motive := fun x => Nat → List UInt8) x Aiur.NativeAIR.KeyCodec.encodeNat._f x_1
+PREMISE Aiur.NativeAIR.KeyCodec.encodeVector
+{α : Type u_1} → (α → List UInt8) → List α → List UInt8
+DEFINITION
+fun {α} encode values => Aiur.NativeAIR.KeyCodec.encodeNat 2 values.length ++ List.flatMap encode values
+PREMISE Aiur.NativeAIR.KeyCodec.readNode
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.Node
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readByte
+  match __do_lift.toNat with
+    | 0 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure (Aiur.NativeAIR.Node.konst (Aiur.G.ofNat __do_lift))
+    | 1 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 8
+      pure (Aiur.NativeAIR.Node.konst (Aiur.G.ofNat __do_lift))
+    | 2 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 1
+      pure (Aiur.NativeAIR.Node.publicInput __do_lift)
+    | 3 => pure Aiur.NativeAIR.Node.isFirstRow
+    | 4 => pure Aiur.NativeAIR.Node.isLastRow
+    | 5 => pure Aiur.NativeAIR.Node.isTransition
+    | 6 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      let __do_lift_1 ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure (Aiur.NativeAIR.Node.add __do_lift __do_lift_1)
+    | 7 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      let __do_lift_1 ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure (Aiur.NativeAIR.Node.sub __do_lift __do_lift_1)
+    | 8 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      let __do_lift_1 ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure (Aiur.NativeAIR.Node.mul __do_lift __do_lift_1)
+    | 9 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure (Aiur.NativeAIR.Node.neg __do_lift)
+    | 10 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure
+          (Aiur.NativeAIR.Node.var
+            { source := Aiur.NativeAIR.Source.preprocessed, offset := Aiur.NativeAIR.RowOffset.current,
+              index := __do_lift })
+    | 11 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure
+          (Aiur.NativeAIR.Node.var
+            { source := Aiur.NativeAIR.Source.preprocessed, offset := Aiur.NativeAIR.RowOffset.next,
+              index := __do_lift })
+    | 12 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure
+          (Aiur.NativeAIR.Node.var
+            { source := Aiur.NativeAIR.Source.main, offset := Aiur.NativeAIR.RowOffset.current, index := __do_lift })
+    | 13 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure
+          (Aiur.NativeAIR.Node.var
+            { source := Aiur.NativeAIR.Source.main, offset := Aiur.NativeAIR.RowOffset.next, index := __do_lift })
+    | 14 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure
+          (Aiur.NativeAIR.Node.var
+            { source := Aiur.NativeAIR.Source.stage2, offset := Aiur.NativeAIR.RowOffset.current, index := __do_lift })
+    | 15 => do
+      let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+      pure
+          (Aiur.NativeAIR.Node.var
+            { source := Aiur.NativeAIR.Source.stage2, offset := Aiur.NativeAIR.RowOffset.next, index := __do_lift })
+    | x => failure
+PREMISE Aiur.NativeAIR.KeyCodec.encodeNode
+Aiur.NativeAIR.Node → List UInt8
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value =>
+    if value.n < 65536 then 0 :: Aiur.NativeAIR.KeyCodec.encodeNat 2 value.n
+    else 1 :: Aiur.NativeAIR.KeyCodec.encodeNat 8 value.n
+  | Aiur.NativeAIR.Node.publicInput index => 2 :: Aiur.NativeAIR.KeyCodec.encodeNat 1 index
+  | Aiur.NativeAIR.Node.isFirstRow => [3]
+  | Aiur.NativeAIR.Node.isLastRow => [4]
+  | Aiur.NativeAIR.Node.isTransition => [5]
+  | Aiur.NativeAIR.Node.add a b => 6 :: (Aiur.NativeAIR.KeyCodec.encodeNat 2 a ++ Aiur.NativeAIR.KeyCodec.encodeNat 2 b)
+  | Aiur.NativeAIR.Node.sub a b => 7 :: (Aiur.NativeAIR.KeyCodec.encodeNat 2 a ++ Aiur.NativeAIR.KeyCodec.encodeNat 2 b)
+  | Aiur.NativeAIR.Node.mul a b => 8 :: (Aiur.NativeAIR.KeyCodec.encodeNat 2 a ++ Aiur.NativeAIR.KeyCodec.encodeNat 2 b)
+  | Aiur.NativeAIR.Node.neg child => 9 :: Aiur.NativeAIR.KeyCodec.encodeNat 2 child
+  | Aiur.NativeAIR.Node.var column =>
+    have tag :=
+      match column.source, column.offset with
+      | Aiur.NativeAIR.Source.preprocessed, Aiur.NativeAIR.RowOffset.current => 10
+      | Aiur.NativeAIR.Source.preprocessed, Aiur.NativeAIR.RowOffset.next => 11
+      | Aiur.NativeAIR.Source.main, Aiur.NativeAIR.RowOffset.current => 12
+      | Aiur.NativeAIR.Source.main, Aiur.NativeAIR.RowOffset.next => 13
+      | Aiur.NativeAIR.Source.stage2, Aiur.NativeAIR.RowOffset.current => 14
+      | Aiur.NativeAIR.Source.stage2, Aiur.NativeAIR.RowOffset.next => 15;
+    tag :: Aiur.NativeAIR.KeyCodec.encodeNat 2 column.index
+PREMISE Aiur.NativeAIR.KeyCodec.readLookup
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.Lookup
+DEFINITION
+do
+  let multiplicity ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let args ← Aiur.NativeAIR.KeyCodec.readVector (Aiur.NativeAIR.KeyCodec.readNat 2)
+  pure { multiplicity := multiplicity, args := args }
+PREMISE Aiur.NativeAIR.KeyCodec.encodeLookup
+Aiur.NativeAIR.Lookup → List UInt8
+DEFINITION
+fun lookup =>
+  Aiur.NativeAIR.KeyCodec.encodeNat 2 lookup.multiplicity ++
+    Aiur.NativeAIR.KeyCodec.encodeVector (Aiur.NativeAIR.KeyCodec.encodeNat 2) lookup.args
+PREMISE Aiur.NativeAIR.KeyCodec.Circuit.mk
+Nat → Nat → Nat → Nat → Nat → Aiur.NativeAIR.Graph → Aiur.NativeAIR.KeyCodec.Circuit
+PREMISE Aiur.NativeAIR.KeyCodec.Circuit.groups
+Aiur.NativeAIR.KeyCodec.Circuit → Nat
+DEFINITION
+fun circuit => max 1 ((circuit.graph.lookups.length + circuit.lookupGroupSize - 1) / circuit.lookupGroupSize)
+PREMISE Aiur.NativeAIR.KeyCodec.Circuit.widths
+Aiur.NativeAIR.KeyCodec.Circuit → Aiur.NativeAIR.GraphWidths
+DEFINITION
+fun circuit =>
+  { preprocessed := circuit.preprocessedWidth, main := circuit.mainWidth, stage2 := circuit.groups * 2, publics := 8 }
+PREMISE Aiur.NativeAIR.KeyCodec.Circuit.constraintCount
+Aiur.NativeAIR.KeyCodec.Circuit → Nat
+DEFINITION
+fun circuit => circuit.graph.zeros.length + circuit.groups * 2
+PREMISE Aiur.NativeAIR.KeyCodec.nodeDegree
+Array Nat → Aiur.NativeAIR.Node → Option Nat
+DEFINITION
+fun degrees x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value => some 0
+  | Aiur.NativeAIR.Node.publicInput index => some 0
+  | Aiur.NativeAIR.Node.isTransition => some 0
+  | Aiur.NativeAIR.Node.var column => some 1
+  | Aiur.NativeAIR.Node.isFirstRow => some 1
+  | Aiur.NativeAIR.Node.isLastRow => some 1
+  | Aiur.NativeAIR.Node.add a b => do
+    let __do_lift ← degrees[a]?
+    let __do_lift_1 ← degrees[b]?
+    pure (max __do_lift __do_lift_1)
+  | Aiur.NativeAIR.Node.sub a b => do
+    let __do_lift ← degrees[a]?
+    let __do_lift_1 ← degrees[b]?
+    pure (max __do_lift __do_lift_1)
+  | Aiur.NativeAIR.Node.mul a b => do
+    let __do_lift ← degrees[a]?
+    let __do_lift_1 ← degrees[b]?
+    have sum : Nat := __do_lift + __do_lift_1
+    if sum < 2 ^ 32 then some sum else none
+  | Aiur.NativeAIR.Node.neg child => degrees[child]?
+PREMISE Aiur.NativeAIR.KeyCodec.nodeDegreesFrom
+List Aiur.NativeAIR.Node → Array Nat → Option (Array Nat)
+DEFINITION
+fun x x_1 =>
+  List.brecOn (motive := fun x => Array Nat → Option (Array Nat)) x Aiur.NativeAIR.KeyCodec.nodeDegreesFrom._f x_1
+PREMISE Aiur.NativeAIR.KeyCodec.lookupDegrees
+Array Nat → Aiur.NativeAIR.Lookup → Option (Nat × Nat)
+DEFINITION
+fun degrees lookup => do
+  let multiplicity ← degrees[lookup.multiplicity]?
+  let args ← List.mapM (fun index => degrees[index]?) lookup.args
+  pure (multiplicity, List.foldr max 0 args)
+PREMISE Aiur.NativeAIR.KeyCodec.groupDegree
+List (Nat × Nat) → Nat
+DEFINITION
+fun degrees =>
+  have sum := (List.map Prod.snd degrees).sum;
+  List.foldr max (sum + 1)
+    (List.map
+      (fun x =>
+        match x with
+        | (multiplicity, message) => multiplicity + sum - message)
+      degrees)
+PREMISE Aiur.NativeAIR.KeyCodec.Circuit.computedDegree
+Aiur.NativeAIR.KeyCodec.Circuit → Option Nat
+DEFINITION
+fun circuit => do
+  let degrees ← Aiur.NativeAIR.KeyCodec.nodeDegreesFrom circuit.graph.nodes #[]
+  let zeros ← List.mapM (fun index => degrees[index]?) circuit.graph.zeros
+  let lookups ← List.mapM (Aiur.NativeAIR.KeyCodec.lookupDegrees degrees) circuit.graph.lookups
+  have groups : List Nat :=
+    List.map
+      (fun index =>
+        Aiur.NativeAIR.KeyCodec.groupDegree
+          (List.take circuit.lookupGroupSize (List.drop (index * circuit.lookupGroupSize) lookups)))
+      (List.range circuit.groups)
+  pure (List.foldr max (max 1 (List.foldr max 0 zeros)) groups)
+PREMISE Aiur.NativeAIR.KeyCodec.Circuit.valid
+Aiur.NativeAIR.KeyCodec.Circuit → Bool
+DEFINITION
+fun circuit =>
+  decide (1 ≤ circuit.lookupGroupSize) && decide (circuit.lookupGroupSize ≤ 8) &&
+      (Aiur.NativeAIR.checkedGraphPrefix circuit.widths circuit.graph).isSome &&
+    circuit.computedDegree == some circuit.maxConstraintDegree
+PREMISE Aiur.NativeAIR.KeyCodec.readCircuitData
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+do
+  let main ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let preprocessed ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let height ← Aiur.NativeAIR.KeyCodec.readNat 4
+  let degree ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let group ← Aiur.NativeAIR.KeyCodec.readNat 1
+  let nodes ← Aiur.NativeAIR.KeyCodec.readVector Aiur.NativeAIR.KeyCodec.readNode
+  let zeros ← Aiur.NativeAIR.KeyCodec.readVector (Aiur.NativeAIR.KeyCodec.readNat 2)
+  let lookups ← Aiur.NativeAIR.KeyCodec.readVector Aiur.NativeAIR.KeyCodec.readLookup
+  pure
+      { mainWidth := main, preprocessedWidth := preprocessed, preprocessedHeight := height,
+        maxConstraintDegree := degree, lookupGroupSize := group,
+        graph := { nodes := nodes, zeros := zeros, lookups := lookups } }
+PREMISE Aiur.NativeAIR.KeyCodec.readCircuit
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+do
+  let circuit ← Aiur.NativeAIR.KeyCodec.readCircuitData
+  if circuit.valid = true then pure circuit else failure
+PREMISE Aiur.NativeAIR.KeyCodec.encodeCircuit
+Aiur.NativeAIR.KeyCodec.Circuit → List UInt8
+DEFINITION
+fun circuit =>
+  Aiur.NativeAIR.KeyCodec.encodeNat 2 circuit.mainWidth ++
+                Aiur.NativeAIR.KeyCodec.encodeNat 2 circuit.preprocessedWidth ++
+              Aiur.NativeAIR.KeyCodec.encodeNat 4 circuit.preprocessedHeight ++
+            Aiur.NativeAIR.KeyCodec.encodeNat 2 circuit.maxConstraintDegree ++
+          Aiur.NativeAIR.KeyCodec.encodeNat 1 circuit.lookupGroupSize ++
+        Aiur.NativeAIR.KeyCodec.encodeVector Aiur.NativeAIR.KeyCodec.encodeNode circuit.graph.nodes ++
+      Aiur.NativeAIR.KeyCodec.encodeVector (Aiur.NativeAIR.KeyCodec.encodeNat 2) circuit.graph.zeros ++
+    Aiur.NativeAIR.KeyCodec.encodeVector Aiur.NativeAIR.KeyCodec.encodeLookup circuit.graph.lookups
+PREMISE Aiur.NativeAIR.KeyCodec.Parameters.mk
+Nat → Nat → Nat → Nat → Nat → Nat → Nat → Aiur.NativeAIR.KeyCodec.Parameters
+PREMISE Aiur.NativeAIR.KeyCodec.readParameters
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.KeyCodec.Parameters
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let __do_lift_1 ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let __do_lift_2 ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let __do_lift_3 ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let __do_lift_4 ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let __do_lift_5 ← Aiur.NativeAIR.KeyCodec.readNat 2
+  let __do_lift_6 ← Aiur.NativeAIR.KeyCodec.readNat 2
+  pure
+      { logBlowup := __do_lift, capHeight := __do_lift_1, logFinalPolyLen := __do_lift_2, maxLogArity := __do_lift_3,
+        numQueries := __do_lift_4, commitProofOfWorkBits := __do_lift_5, queryProofOfWorkBits := __do_lift_6 }
+PREMISE Aiur.NativeAIR.KeyCodec.encodeParameters
+Aiur.NativeAIR.KeyCodec.Parameters → List UInt8
+DEFINITION
+fun parameters =>
+  List.flatMap (Aiur.NativeAIR.KeyCodec.encodeNat 2)
+    [parameters.logBlowup, parameters.capHeight, parameters.logFinalPolyLen, parameters.maxLogArity,
+      parameters.numQueries, parameters.commitProofOfWorkBits, parameters.queryProofOfWorkBits]
+PREMISE Aiur.NativeAIR.KeyCodec.MerkleCap
+Type
+DEFINITION
+List (List UInt8)
+PREMISE Aiur.NativeAIR.KeyCodec.readCommitment
+Aiur.NativeAIR.KeyCodec.Reader (Option Aiur.NativeAIR.KeyCodec.MerkleCap)
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readByte
+  match __do_lift.toNat with
+    | 0 => pure none
+    | 1 => do
+      let cap ←
+        Aiur.NativeAIR.KeyCodec.readVector (Aiur.NativeAIR.KeyCodec.readMany Aiur.NativeAIR.KeyCodec.readByte 32)
+      if cap.length.isPowerOfTwo then pure (some cap) else failure
+    | x => failure
+PREMISE Aiur.NativeAIR.KeyCodec.encodeCommitment
+Option Aiur.NativeAIR.KeyCodec.MerkleCap → List UInt8
+DEFINITION
+fun x =>
+  match x with
+  | none => [0]
+  | some cap => 1 :: Aiur.NativeAIR.KeyCodec.encodeVector id cap
+PREMISE Aiur.NativeAIR.KeyCodec.readIndex
+Aiur.NativeAIR.KeyCodec.Reader (Option Nat)
+DEFINITION
+do
+  let index ← Aiur.NativeAIR.KeyCodec.readNat 2
+  pure (if index = 65535 then none else some index)
+PREMISE Aiur.NativeAIR.KeyCodec.encodeIndex
+Option Nat → List UInt8
+DEFINITION
+fun index => Aiur.NativeAIR.KeyCodec.encodeNat 2 (index.getD 65535)
+PREMISE Aiur.NativeAIR.KeyCodec.Key.mk
+Aiur.NativeAIR.KeyCodec.Parameters →
+  List Aiur.NativeAIR.KeyCodec.Circuit →
+    Option Aiur.NativeAIR.KeyCodec.MerkleCap → List (Option Nat) → Aiur.NativeAIR.KeyCodec.Key
+PREMISE Aiur.NativeAIR.KeyCodec.readKey
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.KeyCodec.Key
+DEFINITION
+do
+  let parameters ← Aiur.NativeAIR.KeyCodec.readParameters
+  let circuits ← Aiur.NativeAIR.KeyCodec.readVector Aiur.NativeAIR.KeyCodec.readCircuit
+  let commitment ← Aiur.NativeAIR.KeyCodec.readCommitment
+  let indices ← Aiur.NativeAIR.KeyCodec.readMany Aiur.NativeAIR.KeyCodec.readIndex circuits.length
+  pure
+      { parameters := parameters, circuits := circuits, preprocessedCommitment := commitment,
+        preprocessedIndices := indices }
+PREMISE Aiur.NativeAIR.KeyCodec.encodeKey
+Aiur.NativeAIR.KeyCodec.Key → List UInt8
+DEFINITION
+fun key =>
+  Aiur.NativeAIR.KeyCodec.encodeParameters key.parameters ++
+        Aiur.NativeAIR.KeyCodec.encodeVector Aiur.NativeAIR.KeyCodec.encodeCircuit key.circuits ++
+      Aiur.NativeAIR.KeyCodec.encodeCommitment key.preprocessedCommitment ++
+    List.flatMap Aiur.NativeAIR.KeyCodec.encodeIndex key.preprocessedIndices
+PREMISE Aiur.NativeAIR.KeyCodec.decode
+ByteArray → Option Aiur.NativeAIR.KeyCodec.Key
+DEFINITION
+fun bytes => do
+  let __x ← Aiur.NativeAIR.KeyCodec.readKey bytes.data.toList
+  match __x with
+    | (key, rest) => if rest.isEmpty = true then some key else none
+PREMISE Aiur.NativeAIR.KeyCodec.encode
+Aiur.NativeAIR.KeyCodec.Key → ByteArray
+DEFINITION
+fun key => (Aiur.NativeAIR.KeyCodec.encodeKey key).toByteArray
+PREMISE Aiur.NativeAIR.KeyCodec.decodeCanonical
+ByteArray → Option Aiur.NativeAIR.KeyCodec.Key
+DEFINITION
+fun bytes => do
+  let key ← Aiur.NativeAIR.KeyCodec.decode bytes
+  if Aiur.NativeAIR.KeyCodec.encode key = bytes then some key else none
+PREMISE Aiur.NativeAIR.KeyCodec.Reads
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → List UInt8 → α → Prop
+DEFINITION
+fun {α} read bytes value => ∀ (rest : List UInt8), read (bytes ++ rest) = some (value, rest)
+PREMISE Aiur.NativeAIR.KeyCodec.NodeWireFits
+Aiur.NativeAIR.Node → Prop
+DEFINITION
+fun x =>
+  match x with
+  | Aiur.NativeAIR.Node.konst value => True
+  | Aiur.NativeAIR.Node.isFirstRow => True
+  | Aiur.NativeAIR.Node.isLastRow => True
+  | Aiur.NativeAIR.Node.isTransition => True
+  | Aiur.NativeAIR.Node.var column => column.index < 65536
+  | Aiur.NativeAIR.Node.publicInput index => index < 256
+  | Aiur.NativeAIR.Node.add a b => a < 65536 ∧ b < 65536
+  | Aiur.NativeAIR.Node.sub a b => a < 65536 ∧ b < 65536
+  | Aiur.NativeAIR.Node.mul a b => a < 65536 ∧ b < 65536
+  | Aiur.NativeAIR.Node.neg child => child < 65536
+PREMISE Aiur.NativeAIR.KeyCodec.LookupWireFits.mk
+∀ {lookup : Aiur.NativeAIR.Lookup},
+  lookup.multiplicity < 65536 →
+    lookup.args.length < 65536 →
+      (∀ (arg : Nat), arg ∈ lookup.args → arg < 65536) → Aiur.NativeAIR.KeyCodec.LookupWireFits lookup
+PREMISE Aiur.NativeAIR.KeyCodec.CircuitWireFits.mk
+∀ {circuit : Aiur.NativeAIR.KeyCodec.Circuit},
+  circuit.mainWidth < 65536 →
+    circuit.preprocessedWidth < 65536 →
+      circuit.preprocessedHeight < 2 ^ 32 →
+        circuit.maxConstraintDegree < 65536 →
+          circuit.lookupGroupSize < 256 →
+            circuit.graph.nodes.length < 65536 →
+              (∀ (node : Aiur.NativeAIR.Node), node ∈ circuit.graph.nodes → Aiur.NativeAIR.KeyCodec.NodeWireFits node) →
+                circuit.graph.zeros.length < 65536 →
+                  (∀ (index : Nat), index ∈ circuit.graph.zeros → index < 65536) →
+                    circuit.graph.lookups.length < 65536 →
+                      (∀ (lookup : Aiur.NativeAIR.Lookup),
+                          lookup ∈ circuit.graph.lookups → Aiur.NativeAIR.KeyCodec.LookupWireFits lookup) →
+                        Aiur.NativeAIR.KeyCodec.CircuitWireFits circuit
+PREMISE Aiur.NativeAIR.KeyCodec.ParametersWireFits
+Aiur.NativeAIR.KeyCodec.Parameters → Prop
+DEFINITION
+fun parameters =>
+  ∀ (value : Nat),
+    value ∈
+        [parameters.logBlowup, parameters.capHeight, parameters.logFinalPolyLen, parameters.maxLogArity,
+          parameters.numQueries, parameters.commitProofOfWorkBits, parameters.queryProofOfWorkBits] →
+      value < 65536
+PREMISE Aiur.NativeAIR.KeyCodec.CommitmentWireFits
+Option Aiur.NativeAIR.KeyCodec.MerkleCap → Prop
+DEFINITION
+fun x =>
+  match x with
+  | none => True
+  | some cap =>
+    List.length cap < 65536 ∧
+      (List.length cap).isPowerOfTwo ∧ ∀ (digest : List UInt8), digest ∈ cap → digest.length = 32
+PREMISE Aiur.NativeAIR.KeyCodec.IndexWireFits
+Option Nat → Prop
+DEFINITION
+fun x =>
+  match x with
+  | none => True
+  | some index => index < 65535
+PREMISE Aiur.NativeAIR.KeyCodec.KeyWireFits.mk
+∀ {key : Aiur.NativeAIR.KeyCodec.Key},
+  Aiur.NativeAIR.KeyCodec.ParametersWireFits key.parameters →
+    key.circuits.length < 65536 →
+      (∀ (circuit : Aiur.NativeAIR.KeyCodec.Circuit),
+          circuit ∈ key.circuits → Aiur.NativeAIR.KeyCodec.CircuitWireFits circuit) →
+        Aiur.NativeAIR.KeyCodec.CommitmentWireFits key.preprocessedCommitment →
+          key.preprocessedIndices.length = key.circuits.length →
+            (∀ (index : Option Nat), index ∈ key.preprocessedIndices → Aiur.NativeAIR.KeyCodec.IndexWireFits index) →
+              Aiur.NativeAIR.KeyCodec.KeyWireFits key
+PREMISE Aiur.NativeAIR.KeyCodec.Returns
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → (α → Prop) → Prop
+DEFINITION
+fun {α} read property =>
+  ∀ (bytes : List UInt8) (value : α) (rest : List UInt8), read bytes = some (value, rest) → property value
+PREMISE Aiur.NativeAIR.KeyCodec.CommitmentValid
+Option Aiur.NativeAIR.KeyCodec.MerkleCap → Prop
+DEFINITION
+fun x =>
+  match x with
+  | none => True
+  | some cap => (List.length cap).isPowerOfTwo ∧ ∀ (digest : List UInt8), digest ∈ cap → digest.length = 32
+PREMISE Aiur.NativeAIR.CompiledKey.main
+Nat → Aiur.NativeAIR.Expr
+DEFINITION
+fun index =>
+  Aiur.NativeAIR.Expr.var
+    { source := Aiur.NativeAIR.Source.main, offset := Aiur.NativeAIR.RowOffset.current, index := index }
+PREMISE Aiur.NativeAIR.CompiledKey.next
+Nat → Aiur.NativeAIR.Expr
+DEFINITION
+fun index =>
+  Aiur.NativeAIR.Expr.var
+    { source := Aiur.NativeAIR.Source.main, offset := Aiur.NativeAIR.RowOffset.next, index := index }
+PREMISE Aiur.NativeAIR.CompiledKey.preprocessed
+Nat → Aiur.NativeAIR.Expr
+DEFINITION
+fun index =>
+  Aiur.NativeAIR.Expr.var
+    { source := Aiur.NativeAIR.Source.preprocessed, offset := Aiur.NativeAIR.RowOffset.current, index := index }
+PREMISE Aiur.NativeAIR.CompiledKey.memoryEquations
+List Aiur.NativeAIR.Expr
+DEFINITION
+have selector := Aiur.NativeAIR.CompiledKey.main 1;
+have transition := (Aiur.NativeAIR.CompiledKey.next 1).frontMul Aiur.NativeAIR.Expr.isTransition;
+[selector.frontMul (selector.frontSub (Aiur.NativeAIR.Expr.konst 1)),
+  (Aiur.NativeAIR.CompiledKey.main 0).frontMul ((Aiur.NativeAIR.Expr.konst 1).frontSub selector),
+  transition.frontMul (selector.frontSub (Aiur.NativeAIR.Expr.konst 1)),
+  transition.frontMul
+    (((Aiur.NativeAIR.CompiledKey.main 2).frontAdd (Aiur.NativeAIR.Expr.konst 1)).frontSub
+      (Aiur.NativeAIR.CompiledKey.next 2))]
+PREMISE Aiur.NativeAIR.CompiledKey.memoryLookup
+Nat → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun width =>
+  { multiplicity := (Aiur.NativeAIR.CompiledKey.main 0).frontNeg,
+    args :=
+      List.map (Aiur.NativeAIR.CompiledKey.main 1).frontMul
+          [Aiur.NativeAIR.Expr.konst 1, Aiur.NativeAIR.Expr.konst (Aiur.G.ofNat width),
+            Aiur.NativeAIR.CompiledKey.main 2] ++
+        List.ofFn fun i => (Aiur.NativeAIR.CompiledKey.main 1).frontMul (Aiur.NativeAIR.CompiledKey.main (3 + ↑i)) }
+PREMISE Aiur.NativeAIR.CompiledKey.byte1Lookup
+Aiur.AIR.Byte1Kind → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun kind =>
+  { multiplicity := (Aiur.NativeAIR.CompiledKey.main ↑kind.column).frontNeg,
+    args :=
+      match kind with
+      | Aiur.AIR.Byte1Kind.bits =>
+        [Aiur.NativeAIR.Expr.konst 2, Aiur.NativeAIR.CompiledKey.preprocessed 0] ++
+          List.ofFn fun i => Aiur.NativeAIR.CompiledKey.preprocessed (1 + ↑i)
+      | Aiur.AIR.Byte1Kind.shiftLeft =>
+        [Aiur.NativeAIR.Expr.konst 3, Aiur.NativeAIR.CompiledKey.preprocessed 0,
+          Aiur.NativeAIR.CompiledKey.preprocessed 9]
+      | Aiur.AIR.Byte1Kind.shiftRight =>
+        [Aiur.NativeAIR.Expr.konst 4, Aiur.NativeAIR.CompiledKey.preprocessed 0,
+          Aiur.NativeAIR.CompiledKey.preprocessed 10] }
+PREMISE Aiur.NativeAIR.CompiledKey.byte2Lookup
+Aiur.AIR.Byte2Kind → Aiur.NativeAIR.Compiler.ExprLookup
+DEFINITION
+fun kind =>
+  { multiplicity := (Aiur.NativeAIR.CompiledKey.main ↑kind.column).frontNeg,
+    args :=
+      [Aiur.NativeAIR.Expr.konst kind.channel, Aiur.NativeAIR.CompiledKey.preprocessed 0,
+          Aiur.NativeAIR.CompiledKey.preprocessed 1] ++
+        match kind with
+        | Aiur.AIR.Byte2Kind.xor => [Aiur.NativeAIR.CompiledKey.preprocessed 2]
+        | Aiur.AIR.Byte2Kind.add => [Aiur.NativeAIR.CompiledKey.preprocessed 3]
+        | Aiur.AIR.Byte2Kind.sub => [Aiur.NativeAIR.CompiledKey.preprocessed 4]
+        | Aiur.AIR.Byte2Kind.and => [Aiur.NativeAIR.CompiledKey.preprocessed 5]
+        | Aiur.AIR.Byte2Kind.or => [Aiur.NativeAIR.CompiledKey.preprocessed 6]
+        | Aiur.AIR.Byte2Kind.lessThan => [Aiur.NativeAIR.CompiledKey.preprocessed 7]
+        | Aiur.AIR.Byte2Kind.range => []
+        | Aiur.AIR.Byte2Kind.mul =>
+          [Aiur.NativeAIR.CompiledKey.preprocessed 8, Aiur.NativeAIR.CompiledKey.preprocessed 9]
+        | Aiur.AIR.Byte2Kind.split7 =>
+          [Aiur.NativeAIR.CompiledKey.preprocessed 10, Aiur.NativeAIR.CompiledKey.preprocessed 11]
+        | Aiur.AIR.Byte2Kind.split4 =>
+          [Aiur.NativeAIR.CompiledKey.preprocessed 12, Aiur.NativeAIR.CompiledKey.preprocessed 13] }
+PREMISE Aiur.NativeAIR.CompiledKey.circuit
+Nat → Nat → Nat → Nat → Aiur.NativeAIR.Compiler.BaseCompilation → Option Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+fun mainWidth preprocessedWidth preprocessedHeight groupSize base =>
+  have raw :=
+    { mainWidth := mainWidth, preprocessedWidth := preprocessedWidth, preprocessedHeight := preprocessedHeight,
+      maxConstraintDegree := 0, lookupGroupSize := groupSize, graph := base.graph };
+  do
+  let degree ← raw.computedDegree
+  have result : Aiur.NativeAIR.KeyCodec.Circuit :=
+    { mainWidth := raw.mainWidth, preprocessedWidth := raw.preprocessedWidth,
+      preprocessedHeight := raw.preprocessedHeight, maxConstraintDegree := degree,
+      lookupGroupSize := raw.lookupGroupSize, graph := raw.graph }
+  if result.valid = true then some result else none
+PREMISE Aiur.NativeAIR.CompiledKey.functionCircuit
+Aiur.Bytecode.Toplevel → Aiur.Bytecode.Circuit → Option Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+fun program source => do
+  let compiled ←
+    Aiur.NativeAIR.CircuitEmitter.compileCircuit (Aiur.NativeAIR.CircuitEmitter.circuitWidths source) program source
+  have groupSize : Nat :=
+    if (compiled.emission.branchless && decide (2 ≤ compiled.emission.lookups.length)) = true then 2 else 1
+  Aiur.NativeAIR.CompiledKey.circuit source.layout.width 0 0 groupSize compiled.base
+PREMISE Aiur.NativeAIR.CompiledKey.memoryCircuit
+Nat → Option Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+fun width => do
+  let base ←
+    Aiur.NativeAIR.Compiler.compileBase { preprocessed := 0, main := 3 + width, stage2 := 0, publics := 0 }
+        [Aiur.NativeAIR.CompiledKey.memoryLookup width] Aiur.NativeAIR.CompiledKey.memoryEquations
+  Aiur.NativeAIR.CompiledKey.circuit (3 + width) 0 0 1 base
+PREMISE Aiur.NativeAIR.CompiledKey.byte1Circuit
+Option Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+do
+  let base ←
+    Aiur.NativeAIR.Compiler.compileBase { preprocessed := 11, main := 3, stage2 := 0, publics := 0 }
+        (List.map Aiur.NativeAIR.CompiledKey.byte1Lookup Aiur.AIR.Byte1Kind.all) []
+  Aiur.NativeAIR.CompiledKey.circuit 3 11 256 2 base
+PREMISE Aiur.NativeAIR.CompiledKey.byte2Circuit
+Option Aiur.NativeAIR.KeyCodec.Circuit
+DEFINITION
+do
+  let base ←
+    Aiur.NativeAIR.Compiler.compileBase { preprocessed := 14, main := 10, stage2 := 0, publics := 0 }
+        (List.map Aiur.NativeAIR.CompiledKey.byte2Lookup Aiur.AIR.Byte2Kind.all) []
+  Aiur.NativeAIR.CompiledKey.circuit 10 14 65536 2 base
+PREMISE Aiur.NativeAIR.CompiledKey.circuits
+Aiur.Bytecode.Toplevel → Option (List Aiur.NativeAIR.KeyCodec.Circuit)
+DEFINITION
+fun program => do
+  let functions ← List.mapM (Aiur.NativeAIR.CompiledKey.functionCircuit program) program.circuits.toList
+  let memories ← List.mapM Aiur.NativeAIR.CompiledKey.memoryCircuit program.memorySizes.toList
+  let byte1 ← Aiur.NativeAIR.CompiledKey.byte1Circuit
+  let byte2 ← Aiur.NativeAIR.CompiledKey.byte2Circuit
+  pure (functions ++ memories ++ [byte1, byte2])
+PREMISE Aiur.NativeAIR.CompiledKey.preprocessedIndices
+Aiur.Bytecode.Toplevel → List (Option Nat)
+DEFINITION
+fun program => List.replicate (program.circuits.size + program.memorySizes.size) none ++ [some 0, some 1]
+PREMISE Aiur.NativeAIR.CompiledKey.check
+Aiur.Bytecode.Toplevel → Aiur.NativeAIR.KeyCodec.Key → Bool
+DEFINITION
+fun program key =>
+  Aiur.NativeAIR.CompiledKey.circuits program == some key.circuits &&
+    key.preprocessedIndices == Aiur.NativeAIR.CompiledKey.preprocessedIndices program
+PREMISE Aiur.BoundVerifier.CompiledBackend.mk
+{selection : Aiur.BoundVerifier.Selection} →
+  (toBackend : Aiur.BoundVerifier.Backend selection) →
+    Aiur.NativeAIR.CompiledKey.check toBackend.compiled.bytecode toBackend.keyData = true →
+      Aiur.BoundVerifier.CompiledBackend selection
+PREMISE Aiur.BoundVerifier.buildCompiled
+(selection : Aiur.BoundVerifier.Selection) → Except String (Aiur.BoundVerifier.CompiledBackend selection)
+DEFINITION
+fun selection => do
+  let backend ← Aiur.BoundVerifier.build selection
+  if checked : Aiur.NativeAIR.CompiledKey.check backend.compiled.bytecode backend.keyData = true then
+      pure { toBackend := backend, graphsChecked := checked }
+    else throw "verification key circuits differ from the checked compilation"
+PREMISE Aiur.BoundVerifier.verifyCompiled
+{selection : Aiur.BoundVerifier.Selection} →
+  Aiur.BoundVerifier.CompiledBackend selection → Array Aiur.G → ByteArray → Except String Unit
+DEFINITION
+fun {selection} backend input bytes => Aiur.BoundVerifier.verify backend.toBackend input bytes
+PREMISE Aiur.NativeAIR.GraphWidths.Le
+Aiur.NativeAIR.GraphWidths → Aiur.NativeAIR.GraphWidths → Prop
+DEFINITION
+fun small large =>
+  (∀ (source : Aiur.NativeAIR.Source), small.width source ≤ large.width source) ∧ small.publics ≤ large.publics
+PREMISE Aiur.NativeAIR.CompiledKey.columns
+Aiur.NativeAIR.Values Aiur.G → Aiur.NativeAIR.Source → Aiur.NativeAIR.RowOffset → (width : Nat) → Fin width → Aiur.G
+DEFINITION
+fun values source offset width index => (values.columns source offset)[↑index]?.getD 0
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.mk
+Aiur.G → Aiur.G → Aiur.NativeAIR.ProofCodec.Extension
+PREMISE Aiur.NativeAIR.ProofCodec.Digest
+Type
+DEFINITION
+List UInt8
+PREMISE Aiur.NativeAIR.ProofCodec.Cap
+Type
+DEFINITION
+List Aiur.NativeAIR.ProofCodec.Digest
+PREMISE Aiur.NativeAIR.ProofCodec.Openings
+Type → Type
+DEFINITION
+fun α => List (List (List α))
+PREMISE Aiur.NativeAIR.ProofCodec.readVector
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → Aiur.NativeAIR.KeyCodec.Reader (List α)
+DEFINITION
+fun {α} read => do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readNat 8
+  Aiur.NativeAIR.KeyCodec.readMany read __do_lift
+PREMISE Aiur.NativeAIR.ProofCodec.encodeVector
+{α : Type u_1} → (α → List UInt8) → List α → List UInt8
+DEFINITION
+fun {α} encode values => Aiur.NativeAIR.KeyCodec.encodeNat 8 values.length ++ List.flatMap encode values
+PREMISE Aiur.NativeAIR.ProofCodec.readOption
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → Aiur.NativeAIR.KeyCodec.Reader (Option α)
+DEFINITION
+fun {α} read => do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readByte
+  match __do_lift.toNat with
+    | 0 => pure none
+    | 1 => do
+      let __do_lift ← read
+      pure (some __do_lift)
+    | x => failure
+PREMISE Aiur.NativeAIR.ProofCodec.encodeOption
+{α : Type u_1} → (α → List UInt8) → Option α → List UInt8
+DEFINITION
+fun {α} encode x =>
+  match x with
+  | none => [0]
+  | some value => 1 :: encode value
+PREMISE Aiur.NativeAIR.ProofCodec.readBool
+Aiur.NativeAIR.KeyCodec.Reader Bool
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readByte
+  match __do_lift.toNat with
+    | 0 => pure false
+    | 1 => pure true
+    | x => failure
+PREMISE Aiur.NativeAIR.ProofCodec.encodeBool
+Bool → List UInt8
+DEFINITION
+fun value => [if value = true then 1 else 0]
+PREMISE Aiur.NativeAIR.ProofCodec.readField
+Aiur.NativeAIR.KeyCodec.Reader Aiur.G
+DEFINITION
+do
+  let value ← Aiur.NativeAIR.KeyCodec.readNat 8
+  if value < Aiur.gSize.toNat then pure (Aiur.G.ofNat value) else failure
+PREMISE Aiur.NativeAIR.ProofCodec.encodeField
+Aiur.G → List UInt8
+DEFINITION
+fun value => Aiur.NativeAIR.KeyCodec.encodeNat 8 value.n
+PREMISE Aiur.NativeAIR.ProofCodec.readExtension
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.ProofCodec.readField
+  let __do_lift_1 ← Aiur.NativeAIR.ProofCodec.readField
+  pure { c0 := __do_lift, c1 := __do_lift_1 }
+PREMISE Aiur.NativeAIR.ProofCodec.encodeExtension
+Aiur.NativeAIR.ProofCodec.Extension → List UInt8
+DEFINITION
+fun value => Aiur.NativeAIR.ProofCodec.encodeField value.c0 ++ Aiur.NativeAIR.ProofCodec.encodeField value.c1
+PREMISE Aiur.NativeAIR.ProofCodec.readCap
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.Cap
+DEFINITION
+Aiur.NativeAIR.ProofCodec.readVector (Aiur.NativeAIR.KeyCodec.readMany Aiur.NativeAIR.KeyCodec.readByte 32)
+PREMISE Aiur.NativeAIR.ProofCodec.encodeCap
+Aiur.NativeAIR.ProofCodec.Cap → List UInt8
+DEFINITION
+fun cap => Aiur.NativeAIR.ProofCodec.encodeVector id cap
+PREMISE Aiur.NativeAIR.ProofCodec.readOpenings
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → Aiur.NativeAIR.KeyCodec.Reader (Aiur.NativeAIR.ProofCodec.Openings α)
+DEFINITION
+fun {α} read =>
+  Aiur.NativeAIR.ProofCodec.readVector
+    (Aiur.NativeAIR.ProofCodec.readVector (Aiur.NativeAIR.ProofCodec.readVector read))
+PREMISE Aiur.NativeAIR.ProofCodec.encodeOpenings
+{α : Type} → (α → List UInt8) → Aiur.NativeAIR.ProofCodec.Openings α → List UInt8
+DEFINITION
+fun {α} encode values =>
+  Aiur.NativeAIR.ProofCodec.encodeVector
+    (Aiur.NativeAIR.ProofCodec.encodeVector (Aiur.NativeAIR.ProofCodec.encodeVector encode)) values
+PREMISE Aiur.NativeAIR.ProofCodec.Commitments.mk
+Aiur.NativeAIR.ProofCodec.Cap →
+  Aiur.NativeAIR.ProofCodec.Cap → Aiur.NativeAIR.ProofCodec.Cap → Aiur.NativeAIR.ProofCodec.Commitments
+PREMISE Aiur.NativeAIR.ProofCodec.readCommitments
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.Commitments
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.ProofCodec.readCap
+  let __do_lift_1 ← Aiur.NativeAIR.ProofCodec.readCap
+  let __do_lift_2 ← Aiur.NativeAIR.ProofCodec.readCap
+  pure { stage1 := __do_lift, stage2 := __do_lift_1, quotient := __do_lift_2 }
+PREMISE Aiur.NativeAIR.ProofCodec.encodeCommitments
+Aiur.NativeAIR.ProofCodec.Commitments → List UInt8
+DEFINITION
+fun value =>
+  Aiur.NativeAIR.ProofCodec.encodeCap value.stage1 ++ Aiur.NativeAIR.ProofCodec.encodeCap value.stage2 ++
+    Aiur.NativeAIR.ProofCodec.encodeCap value.quotient
+PREMISE Aiur.NativeAIR.ProofCodec.BatchOpening.mk
+Aiur.NativeAIR.ProofCodec.Openings Aiur.G →
+  List Aiur.NativeAIR.ProofCodec.Digest → Aiur.NativeAIR.ProofCodec.BatchOpening
+PREMISE Aiur.NativeAIR.ProofCodec.readBatchOpening
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.BatchOpening
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.ProofCodec.readOpenings Aiur.NativeAIR.ProofCodec.readField
+  let __do_lift_1 ← Aiur.NativeAIR.ProofCodec.readCap
+  pure { values := __do_lift, siblingHashes := __do_lift_1 }
+PREMISE Aiur.NativeAIR.ProofCodec.encodeBatchOpening
+Aiur.NativeAIR.ProofCodec.BatchOpening → List UInt8
+DEFINITION
+fun value =>
+  Aiur.NativeAIR.ProofCodec.encodeOpenings Aiur.NativeAIR.ProofCodec.encodeField value.values ++
+    Aiur.NativeAIR.ProofCodec.encodeCap value.siblingHashes
+PREMISE Aiur.NativeAIR.ProofCodec.CommitStep.mk
+UInt8 →
+  List (List Aiur.NativeAIR.ProofCodec.Extension) →
+    List Aiur.NativeAIR.ProofCodec.Digest → Aiur.NativeAIR.ProofCodec.CommitStep
+PREMISE Aiur.NativeAIR.ProofCodec.readCommitStep
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.CommitStep
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.KeyCodec.readByte
+  let __do_lift_1 ←
+    Aiur.NativeAIR.ProofCodec.readVector (Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readExtension)
+  let __do_lift_2 ← Aiur.NativeAIR.ProofCodec.readCap
+  pure { logArity := __do_lift, siblingValues := __do_lift_1, siblingHashes := __do_lift_2 }
+PREMISE Aiur.NativeAIR.ProofCodec.encodeCommitStep
+Aiur.NativeAIR.ProofCodec.CommitStep → List UInt8
+DEFINITION
+fun value =>
+  value.logArity ::
+    (Aiur.NativeAIR.ProofCodec.encodeVector
+        (Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeExtension) value.siblingValues ++
+      Aiur.NativeAIR.ProofCodec.encodeCap value.siblingHashes)
+PREMISE Aiur.NativeAIR.ProofCodec.Fri.mk
+List Aiur.NativeAIR.ProofCodec.Cap →
+  List Aiur.G →
+    List Aiur.NativeAIR.ProofCodec.BatchOpening →
+      List Aiur.NativeAIR.ProofCodec.CommitStep →
+        List Aiur.NativeAIR.ProofCodec.Extension → Aiur.G → Aiur.NativeAIR.ProofCodec.Fri
+PREMISE Aiur.NativeAIR.ProofCodec.readFri
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.Fri
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readCap
+  let __do_lift_1 ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readField
+  let __do_lift_2 ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readBatchOpening
+  let __do_lift_3 ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readCommitStep
+  let __do_lift_4 ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readExtension
+  let __do_lift_5 ← Aiur.NativeAIR.ProofCodec.readField
+  pure
+      { commits := __do_lift, commitPowWitnesses := __do_lift_1, inputOpenings := __do_lift_2,
+        commitOpenings := __do_lift_3, finalPoly := __do_lift_4, queryPowWitness := __do_lift_5 }
+PREMISE Aiur.NativeAIR.ProofCodec.encodeFri
+Aiur.NativeAIR.ProofCodec.Fri → List UInt8
+DEFINITION
+fun value =>
+  Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeCap value.commits ++
+            Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeField value.commitPowWitnesses ++
+          Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeBatchOpening value.inputOpenings ++
+        Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeCommitStep value.commitOpenings ++
+      Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeExtension value.finalPoly ++
+    Aiur.NativeAIR.ProofCodec.encodeField value.queryPowWitness
+PREMISE Aiur.NativeAIR.ProofCodec.Data.mk
+List Bool →
+  Aiur.NativeAIR.ProofCodec.Commitments →
+    List Aiur.NativeAIR.ProofCodec.Extension →
+      List UInt8 →
+        Aiur.NativeAIR.ProofCodec.Fri →
+          Aiur.NativeAIR.ProofCodec.Openings Aiur.NativeAIR.ProofCodec.Extension →
+            Option (Aiur.NativeAIR.ProofCodec.Openings Aiur.NativeAIR.ProofCodec.Extension) →
+              Aiur.NativeAIR.ProofCodec.Openings Aiur.NativeAIR.ProofCodec.Extension →
+                Aiur.NativeAIR.ProofCodec.Openings Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofCodec.Data
+PREMISE Aiur.NativeAIR.ProofCodec.readData
+Aiur.NativeAIR.KeyCodec.Reader Aiur.NativeAIR.ProofCodec.Data
+DEFINITION
+do
+  let __do_lift ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readBool
+  let __do_lift_1 ← Aiur.NativeAIR.ProofCodec.readCommitments
+  let __do_lift_2 ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.ProofCodec.readExtension
+  let __do_lift_3 ← Aiur.NativeAIR.ProofCodec.readVector Aiur.NativeAIR.KeyCodec.readByte
+  let __do_lift_4 ← Aiur.NativeAIR.ProofCodec.readFri
+  let __do_lift_5 ← Aiur.NativeAIR.ProofCodec.readOpenings Aiur.NativeAIR.ProofCodec.readExtension
+  let __do_lift_6 ←
+    Aiur.NativeAIR.ProofCodec.readOption
+        (Aiur.NativeAIR.ProofCodec.readOpenings Aiur.NativeAIR.ProofCodec.readExtension)
+  let __do_lift_7 ← Aiur.NativeAIR.ProofCodec.readOpenings Aiur.NativeAIR.ProofCodec.readExtension
+  let __do_lift_8 ← Aiur.NativeAIR.ProofCodec.readOpenings Aiur.NativeAIR.ProofCodec.readExtension
+  pure
+      { active := __do_lift, commitments := __do_lift_1, accumulators := __do_lift_2, logDegrees := __do_lift_3,
+        fri := __do_lift_4, quotient := __do_lift_5, preprocessed := __do_lift_6, stage1 := __do_lift_7,
+        stage2 := __do_lift_8 }
+PREMISE Aiur.NativeAIR.ProofCodec.encodeData
+Aiur.NativeAIR.ProofCodec.Data → List UInt8
+DEFINITION
+fun value =>
+  Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeBool value.active ++
+                  Aiur.NativeAIR.ProofCodec.encodeCommitments value.commitments ++
+                Aiur.NativeAIR.ProofCodec.encodeVector Aiur.NativeAIR.ProofCodec.encodeExtension value.accumulators ++
+              Aiur.NativeAIR.ProofCodec.encodeVector (fun b => [b]) value.logDegrees ++
+            Aiur.NativeAIR.ProofCodec.encodeFri value.fri ++
+          Aiur.NativeAIR.ProofCodec.encodeOpenings Aiur.NativeAIR.ProofCodec.encodeExtension value.quotient ++
+        Aiur.NativeAIR.ProofCodec.encodeOption
+          (Aiur.NativeAIR.ProofCodec.encodeOpenings Aiur.NativeAIR.ProofCodec.encodeExtension) value.preprocessed ++
+      Aiur.NativeAIR.ProofCodec.encodeOpenings Aiur.NativeAIR.ProofCodec.encodeExtension value.stage1 ++
+    Aiur.NativeAIR.ProofCodec.encodeOpenings Aiur.NativeAIR.ProofCodec.encodeExtension value.stage2
+PREMISE Aiur.NativeAIR.ProofCodec.decode
+ByteArray → Option Aiur.NativeAIR.ProofCodec.Data
+DEFINITION
+fun bytes => do
+  let __x ← Aiur.NativeAIR.ProofCodec.readData bytes.data.toList
+  match __x with
+    | (value, rest) => if rest.isEmpty = true then some value else none
+PREMISE Aiur.NativeAIR.ProofCodec.encode
+Aiur.NativeAIR.ProofCodec.Data → ByteArray
+DEFINITION
+fun value => (Aiur.NativeAIR.ProofCodec.encodeData value).toByteArray
+PREMISE Aiur.NativeAIR.ProofCodec.decodeCanonical
+ByteArray → Option Aiur.NativeAIR.ProofCodec.Data
+DEFINITION
+fun bytes => do
+  let value ← Aiur.NativeAIR.ProofCodec.decode bytes
+  if Aiur.NativeAIR.ProofCodec.encode value = bytes then some value else none
+PREMISE Aiur.NativeAIR.ProofShape.Pair.mk
+List Aiur.NativeAIR.ProofCodec.Extension → List Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofShape.Pair
+PREMISE Aiur.NativeAIR.ProofShape.pair
+List (List Aiur.NativeAIR.ProofCodec.Extension) → Option Aiur.NativeAIR.ProofShape.Pair
+DEFINITION
+fun x =>
+  match x with
+  | [current, next] => some { current := current, next := next }
+  | x => none
+PREMISE Aiur.NativeAIR.ProofShape.single
+{α : Type u_1} → List α → Option α
+DEFINITION
+fun {α} x =>
+  match x with
+  | [value] => some value
+  | x => none
+PREMISE Aiur.NativeAIR.ProofShape.activeIndices
+Aiur.NativeAIR.ProofCodec.Data → List Nat
+DEFINITION
+fun proof =>
+  List.filterMap
+    (fun x =>
+      match x with
+      | (active, index) => if active = true then some index else none)
+    proof.active.zipIdx
+PREMISE Aiur.NativeAIR.ProofShape.quotientDegree
+Aiur.NativeAIR.KeyCodec.Circuit → Nat
+DEFINITION
+fun circuit => (max circuit.maxConstraintDegree 2 - 1).nextPowerOfTwo
+PREMISE Aiur.NativeAIR.ProofShape.Row.mk
+Nat →
+  Aiur.NativeAIR.KeyCodec.Circuit →
+    UInt8 →
+      Aiur.NativeAIR.ProofShape.Pair →
+        Aiur.NativeAIR.ProofShape.Pair →
+          Option Aiur.NativeAIR.ProofShape.Pair →
+            List Aiur.NativeAIR.ProofCodec.Extension →
+              Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofShape.Row
+PREMISE Aiur.NativeAIR.ProofShape.readPreprocessed
+Aiur.NativeAIR.ProofCodec.Data → Option Nat → Option (Option Aiur.NativeAIR.ProofShape.Pair)
+DEFINITION
+fun proof x =>
+  match x with
+  | none => some none
+  | some slot => Option.map some (proof.preprocessed >>= fun opened => opened[slot]? >>= Aiur.NativeAIR.ProofShape.pair)
+PREMISE Aiur.NativeAIR.ProofShape.readRow
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Nat → Nat → Option Aiur.NativeAIR.ProofShape.Row
+DEFINITION
+fun key proof index position => do
+  let circuit ← key.circuits[index]?
+  let preprocessedIndex ← key.preprocessedIndices[index]?
+  let degree ← proof.logDegrees[position]?
+  let __do_lift ← proof.stage1[position]?
+  let stage1 ← Aiur.NativeAIR.ProofShape.pair __do_lift
+  let __do_lift ← proof.stage2[position]?
+  let stage2 ← Aiur.NativeAIR.ProofShape.pair __do_lift
+  let __do_lift ← proof.quotient[position]?
+  let quotient ← Aiur.NativeAIR.ProofShape.single __do_lift
+  let accumulator ← proof.accumulators[position]?
+  let preprocessed ← Aiur.NativeAIR.ProofShape.readPreprocessed proof preprocessedIndex
+  pure
+      { circuitIndex := index, circuit := circuit, logDegree := degree, stage1 := stage1, stage2 := stage2,
+        preprocessed := preprocessed, quotient := quotient, accumulator := accumulator }
+PREMISE Aiur.NativeAIR.ProofShape.Pair.hasWidth
+Aiur.NativeAIR.ProofShape.Pair → Nat → Bool
+DEFINITION
+fun values width => values.current.length == width && values.next.length == width
+PREMISE Aiur.NativeAIR.ProofShape.Row.fits
+Aiur.NativeAIR.KeyCodec.Parameters → Aiur.NativeAIR.ProofShape.Row → Bool
+DEFINITION
+fun parameters row =>
+  (row.stage1.hasWidth row.circuit.mainWidth && row.stage2.hasWidth row.circuit.widths.stage2 &&
+        match row.preprocessed with
+        | none => true
+        | some values => values.hasWidth row.circuit.preprocessedWidth) &&
+      row.quotient.length == Aiur.NativeAIR.ProofShape.quotientDegree row.circuit * 2 &&
+    decide
+      (row.logDegree.toNat + (Aiur.NativeAIR.ProofShape.quotientDegree row.circuit).log2 ≤ 32 - parameters.logBlowup)
+PREMISE Aiur.NativeAIR.ProofShape.header
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Bool
+DEFINITION
+fun key proof =>
+  have active := (Aiur.NativeAIR.ProofShape.activeIndices proof).length;
+  have preprocessed := (List.filter Option.isSome key.preprocessedIndices).length;
+  !key.circuits.isEmpty && proof.active.length == key.circuits.length && decide (active > 0) &&
+                  key.preprocessedIndices.length == key.circuits.length &&
+                proof.logDegrees.length == active &&
+              key.preprocessedCommitment.isNone == (preprocessed == 0) &&
+            List.length (proof.preprocessed.getD []) == preprocessed &&
+          List.length proof.stage1 == active &&
+        List.length proof.stage2 == active &&
+      List.length proof.quotient == active &&
+    proof.accumulators.length == active
+PREMISE Aiur.NativeAIR.ProofShape.inactivePreprocessed
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Bool
+DEFINITION
+fun key proof =>
+  (key.preprocessedIndices.zip proof.active).all fun x =>
+    match x with
+    | (slot, active) =>
+      match slot, active with
+      | some index, false => (proof.preprocessed.getD [])[index]? == some []
+      | x, x_1 => true
+PREMISE Aiur.NativeAIR.ProofShape.rows
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Option (List Aiur.NativeAIR.ProofShape.Row)
+DEFINITION
+fun key proof =>
+  List.mapM
+    (fun x =>
+      match x with
+      | (index, position) => Aiur.NativeAIR.ProofShape.readRow key proof index position)
+    (Aiur.NativeAIR.ProofShape.activeIndices proof).zipIdx
+PREMISE Aiur.NativeAIR.ProofShape.check
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Option (List Aiur.NativeAIR.ProofShape.Row)
+DEFINITION
+fun key proof =>
+  if
+      (Aiur.NativeAIR.ProofShape.header key proof && Aiur.NativeAIR.ProofShape.inactivePreprocessed key proof) =
+        true then
+    do
+    let result ← Aiur.NativeAIR.ProofShape.rows key proof
+    if result.all (Aiur.NativeAIR.ProofShape.Row.fits key.parameters) = true then some result else none
+  else none
+PREMISE Aiur.NativeAIR.ProofShape.fixedHeights
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Bool
+DEFINITION
+fun key proof =>
+  Aiur.fixedTraceHeights (List.map (fun x => x.preprocessedHeight) key.circuits) proof.active
+    (List.map UInt8.toNat proof.logDegrees)
+PREMISE Aiur.NativeAIR.ProofShape.queryBound
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Option Nat
+DEFINITION
+fun key proof =>
+  Aiur.lookupQueryBound (List.map (fun x => x.graph.lookups.length) key.circuits) proof.active
+    (List.map UInt8.toNat proof.logDegrees)
+PREMISE Aiur.BoundVerifier.CheckedProof.mk
+{key : Aiur.NativeAIR.KeyCodec.Key} →
+  {bytes : ByteArray} →
+    (data : Aiur.NativeAIR.ProofCodec.Data) →
+      (rows : List Aiur.NativeAIR.ProofShape.Row) →
+        (bound : Nat) →
+          Aiur.NativeAIR.ProofCodec.decodeCanonical bytes = some data →
+            Aiur.NativeAIR.ProofShape.check key data = some rows →
+              Aiur.NativeAIR.ProofShape.fixedHeights key data = true →
+                Aiur.NativeAIR.ProofShape.queryBound key data = some bound →
+                  Aiur.NativeAIR.MerkleCap.check key data = true → Aiur.BoundVerifier.CheckedProof key bytes
+PREMISE Aiur.BoundVerifier.readProof
+(key : Aiur.NativeAIR.KeyCodec.Key) → (bytes : ByteArray) → Except String (Aiur.BoundVerifier.CheckedProof key bytes)
+DEFINITION
+fun key bytes =>
+  match parsed : Aiur.NativeAIR.ProofCodec.decodeCanonical bytes with
+  | none => Except.error "proof is not a canonical complete artifact"
+  | some data =>
+    match shape : Aiur.NativeAIR.ProofShape.check key data with
+    | none => Except.error "proof opening shape differs from the selected key"
+    | some rows =>
+      if fixed : Aiur.NativeAIR.ProofShape.fixedHeights key data = true then
+        match budget : Aiur.NativeAIR.ProofShape.queryBound key data with
+        | none => Except.error "proof lookup budget exceeds its bound"
+        | some bound =>
+          if cap : Aiur.NativeAIR.MerkleCap.check key data = true then
+            Except.ok
+              { data := data, rows := rows, bound := bound, decoded := parsed, shape := shape, fixed := fixed,
+                budget := budget, cap := cap }
+          else Except.error "proof Merkle cap omits a committed matrix height"
+      else Except.error "proof fixed table heights differ from the selected key"
+PREMISE Aiur.BoundVerifier.verifyShaped
+{selection : Aiur.BoundVerifier.Selection} →
+  Aiur.BoundVerifier.CompiledBackend selection → Array Aiur.G → ByteArray → Except String Unit
+DEFINITION
+fun {selection} backend input bytes => do
+  let _ ← Aiur.BoundVerifier.readProof backend.keyData bytes
+  Aiur.BoundVerifier.verifyCompiled backend input bytes
+PREMISE Aiur.NativeAIR.ProofCodec.VectorFits
+{α : Type u_1} → (α → Prop) → List α → Prop
+DEFINITION
+fun {α} property values => values.length < 256 ^ 8 ∧ ∀ (value : α), value ∈ values → property value
+PREMISE Aiur.NativeAIR.ProofCodec.CapFits
+Aiur.NativeAIR.ProofCodec.Cap → Prop
+DEFINITION
+fun cap => Aiur.NativeAIR.ProofCodec.VectorFits (fun digest => List.length digest = 32) cap
+PREMISE Aiur.NativeAIR.ProofCodec.OpeningsFits
+{α : Type} → Aiur.NativeAIR.ProofCodec.Openings α → Prop
+DEFINITION
+fun {α} values =>
+  Aiur.NativeAIR.ProofCodec.VectorFits
+    (Aiur.NativeAIR.ProofCodec.VectorFits (Aiur.NativeAIR.ProofCodec.VectorFits fun x => True)) values
+PREMISE Aiur.NativeAIR.ProofCodec.CommitmentsFits.mk
+∀ {value : Aiur.NativeAIR.ProofCodec.Commitments},
+  Aiur.NativeAIR.ProofCodec.CapFits value.stage1 →
+    Aiur.NativeAIR.ProofCodec.CapFits value.stage2 →
+      Aiur.NativeAIR.ProofCodec.CapFits value.quotient → Aiur.NativeAIR.ProofCodec.CommitmentsFits value
+PREMISE Aiur.NativeAIR.ProofCodec.BatchOpeningFits.mk
+∀ {value : Aiur.NativeAIR.ProofCodec.BatchOpening},
+  Aiur.NativeAIR.ProofCodec.OpeningsFits value.values →
+    Aiur.NativeAIR.ProofCodec.CapFits value.siblingHashes → Aiur.NativeAIR.ProofCodec.BatchOpeningFits value
+PREMISE Aiur.NativeAIR.ProofCodec.CommitStepFits.mk
+∀ {value : Aiur.NativeAIR.ProofCodec.CommitStep},
+  Aiur.NativeAIR.ProofCodec.VectorFits (Aiur.NativeAIR.ProofCodec.VectorFits fun x => True) value.siblingValues →
+    Aiur.NativeAIR.ProofCodec.CapFits value.siblingHashes → Aiur.NativeAIR.ProofCodec.CommitStepFits value
+PREMISE Aiur.NativeAIR.ProofCodec.FriFits.mk
+∀ {value : Aiur.NativeAIR.ProofCodec.Fri},
+  Aiur.NativeAIR.ProofCodec.VectorFits Aiur.NativeAIR.ProofCodec.CapFits value.commits →
+    value.commitPowWitnesses.length < 256 ^ 8 →
+      Aiur.NativeAIR.ProofCodec.VectorFits Aiur.NativeAIR.ProofCodec.BatchOpeningFits value.inputOpenings →
+        Aiur.NativeAIR.ProofCodec.VectorFits Aiur.NativeAIR.ProofCodec.CommitStepFits value.commitOpenings →
+          value.finalPoly.length < 256 ^ 8 → Aiur.NativeAIR.ProofCodec.FriFits value
+PREMISE Aiur.NativeAIR.ProofCodec.DataFits.mk
+∀ {value : Aiur.NativeAIR.ProofCodec.Data},
+  value.active.length < 256 ^ 8 →
+    Aiur.NativeAIR.ProofCodec.CommitmentsFits value.commitments →
+      value.accumulators.length < 256 ^ 8 →
+        value.logDegrees.length < 256 ^ 8 →
+          Aiur.NativeAIR.ProofCodec.FriFits value.fri →
+            Aiur.NativeAIR.ProofCodec.OpeningsFits value.quotient →
+              (∀ (openings : Aiur.NativeAIR.ProofCodec.Openings Aiur.NativeAIR.ProofCodec.Extension),
+                  value.preprocessed = some openings → Aiur.NativeAIR.ProofCodec.OpeningsFits openings) →
+                Aiur.NativeAIR.ProofCodec.OpeningsFits value.stage1 →
+                  Aiur.NativeAIR.ProofCodec.OpeningsFits value.stage2 → Aiur.NativeAIR.ProofCodec.DataFits value
+PREMISE Aiur.NativeAIR.ProofShape.Row.Sourced.mk
+∀ {key : Aiur.NativeAIR.KeyCodec.Key} {proof : Aiur.NativeAIR.ProofCodec.Data} {index position : Nat}
+  {row : Aiur.NativeAIR.ProofShape.Row},
+  row.circuitIndex = index →
+    key.circuits[index]? = some row.circuit →
+      proof.logDegrees[position]? = some row.logDegree →
+        proof.stage1[position]? = some [row.stage1.current, row.stage1.next] →
+          proof.stage2[position]? = some [row.stage2.current, row.stage2.next] →
+            proof.quotient[position]? = some [row.quotient] →
+              proof.accumulators[position]? = some row.accumulator →
+                (∃ slot,
+                    key.preprocessedIndices[index]? = some slot ∧
+                      Aiur.NativeAIR.ProofShape.readPreprocessed proof slot = some row.preprocessed) →
+                  Aiur.NativeAIR.ProofShape.Row.Sourced key proof index position row
+PREMISE Aiur.NativeAIR.ProofShape.Row.Fits.mk
+∀ {parameters : Aiur.NativeAIR.KeyCodec.Parameters} {row : Aiur.NativeAIR.ProofShape.Row},
+  row.stage1.current.length = row.circuit.mainWidth ∧ row.stage1.next.length = row.circuit.mainWidth →
+    row.stage2.current.length = row.circuit.widths.stage2 ∧ row.stage2.next.length = row.circuit.widths.stage2 →
+      (∀ (values : Aiur.NativeAIR.ProofShape.Pair),
+          row.preprocessed = some values →
+            values.current.length = row.circuit.preprocessedWidth ∧
+              values.next.length = row.circuit.preprocessedWidth) →
+        row.quotient.length = Aiur.NativeAIR.ProofShape.quotientDegree row.circuit * 2 →
+          row.logDegree.toNat + (Aiur.NativeAIR.ProofShape.quotientDegree row.circuit).log2 ≤
+              32 - parameters.logBlowup →
+            Aiur.NativeAIR.ProofShape.Row.Fits parameters row
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.ofBase
+Aiur.G → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value => { c0 := value, c1 := 0 }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.ofNat
+{n : Nat} → OfNat Aiur.NativeAIR.ProofCodec.Extension n
+DEFINITION
+fun {n} => { ofNat := Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.G.ofNat n) }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.add
+Add Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ add := fun a b => { c0 := a.c0 + b.c0, c1 := a.c1 + b.c1 } }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.sub
+Sub Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ sub := fun a b => { c0 := a.c0 - b.c0, c1 := a.c1 - b.c1 } }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.neg
+Neg Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ neg := fun a => { c0 := 0 - a.c0, c1 := 0 - a.c1 } }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.mul
+Mul Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ mul := fun a b => { c0 := a.c0 * b.c0 + a.c1 * (b.c1 * 7), c1 := a.c0 * b.c1 + a.c1 * b.c0 } }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.basis
+Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ c0 := 0, c1 := 1 }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.conjugate
+Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value => { c0 := value.c0, c1 := 0 - value.c1 }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.norm
+Aiur.NativeAIR.ProofCodec.Extension → Aiur.G
+DEFINITION
+fun value => value.c0 * value.c0 - 7 * (value.c1 * value.c1)
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.scale
+Aiur.NativeAIR.ProofCodec.Extension → Aiur.G → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value scalar => { c0 := value.c0 * scalar, c1 := value.c1 * scalar }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.powBits
+Aiur.NativeAIR.ProofCodec.Extension → Nat → Nat → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value exponent x =>
+  Nat.brecOn (motive := fun x => Nat → Aiur.NativeAIR.ProofCodec.Extension) x
+    (Aiur.NativeAIR.ProofCodec.Extension.powBits._f value) exponent
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.power
+Aiur.NativeAIR.ProofCodec.Extension → Nat → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value exponent => value.powBits exponent (exponent.log2 + 1)
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.tryInverse
+Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value => if (value == 0) = true then none else some (value.conjugate.scale value.norm.inverse)
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.evalOps
+Aiur.NativeAIR.EvalOps Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ konst := Aiur.NativeAIR.ProofCodec.Extension.ofBase, add := fun x1 x2 => x1 + x2, sub := fun x1 x2 => x1 - x2,
+  mul := fun x1 x2 => x1 * x2, neg := fun x => -x }
+PREMISE Aiur.G.characteristicNeZero
+NeZero Aiur.gSize.toNat
+PREMISE Aiur.G.residue
+Aiur.G → Fin Aiur.gSize.toNat
+DEFINITION
+fun value => ⟨value.n, ⋯⟩
+PREMISE Aiur.G.neg
+Neg Aiur.G
+DEFINITION
+{ neg := fun x => 0 - x }
+PREMISE Aiur.G.natCast
+NatCast Aiur.G
+DEFINITION
+{ natCast := Aiur.G.ofNat }
+PREMISE Aiur.G.ofInt
+Int → Aiur.G
+DEFINITION
+fun x =>
+  match x with
+  | Int.ofNat n => Aiur.G.ofNat n
+  | Int.negSucc n => -Aiur.G.ofNat (n + 1)
+PREMISE Aiur.G.intCast
+IntCast Aiur.G
+DEFINITION
+{ intCast := Aiur.G.ofInt }
+PREMISE Aiur.G.nsmul
+SMul Nat Aiur.G
+DEFINITION
+{ smul := fun n a => Aiur.G.ofNat n * a }
+PREMISE Aiur.G.zsmul
+SMul Int Aiur.G
+DEFINITION
+{ smul := fun n a => Aiur.G.ofInt n * a }
+PREMISE Aiur.G.npow
+HPow Aiur.G Nat Aiur.G
+DEFINITION
+{ hPow := fun a n => npowRec n a }
+PREMISE Aiur.G.commRing
+Grind.CommRing Aiur.G
+DEFINITION
+{ toAdd := Aiur.instAddG, toMul := Aiur.instMulG, natCast := Aiur.G.natCast, ofNat := @Aiur.instOfNatG,
+  nsmul := Aiur.G.nsmul, npow := Aiur.G.npow, add_zero := Aiur.G.add_zero, add_comm := Aiur.G.add_comm,
+  add_assoc := Aiur.G.add_assoc, mul_assoc := Aiur.G.mul_assoc, mul_one := Aiur.G.mul_one,
+  one_mul := Aiur.G.commRing._proof_1, left_distrib := Aiur.G.left_distrib, right_distrib := Aiur.G.commRing._proof_2,
+  zero_mul := Aiur.G.commRing._proof_3, mul_zero := Aiur.G.mul_zero, pow_zero := Aiur.G.commRing._proof_4,
+  pow_succ := Aiur.G.commRing._proof_5, ofNat_succ := Aiur.G.commRing._proof_6,
+  ofNat_eq_natCast := Aiur.G.commRing._proof_7, nsmul_eq_natCast_mul := Aiur.G.commRing._proof_8, toNeg := Aiur.G.neg,
+  toSub := Aiur.instSubG, intCast := Aiur.G.intCast, zsmul := Aiur.G.zsmul, neg_add_cancel := Aiur.G.neg_add_cancel,
+  sub_eq_add_neg := Aiur.G.sub_eq_add_neg, neg_zsmul := Aiur.G.commRing._proof_9,
+  zsmul_natCast_eq_nsmul := Aiur.G.commRing._proof_10, intCast_ofNat := Aiur.G.commRing._proof_11,
+  intCast_neg := Aiur.G.ofInt_neg, mul_comm := Aiur.G.mul_comm }
+PREMISE Aiur.G.nonzeroResidues
+List Aiur.G
+DEFINITION
+List.ofFn fun index => Aiur.G.ofNat (↑index + 1)
+PREMISE Aiur.G.product
+List Aiur.G → Aiur.G
+DEFINITION
+fun x => List.brecOn x Aiur.G.product._f
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.natCast
+NatCast Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ natCast := fun n => Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.G.ofNat n) }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.intCast
+IntCast Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ intCast := fun n => Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.G.ofInt n) }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.nsmul
+SMul Nat Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ smul := fun n a => Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.G.ofNat n) * a }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.zsmul
+SMul Int Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ smul := fun n a => Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.G.ofInt n) * a }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.npow
+HPow Aiur.NativeAIR.ProofCodec.Extension Nat Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ hPow := fun a n => npowRec n a }
+PREMISE Aiur.NativeAIR.ProofCodec.Extension.commRing
+Grind.CommRing Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+{ toAdd := Aiur.NativeAIR.ProofCodec.Extension.add, toMul := Aiur.NativeAIR.ProofCodec.Extension.mul,
+  natCast := Aiur.NativeAIR.ProofCodec.Extension.natCast, ofNat := @Aiur.NativeAIR.ProofCodec.Extension.ofNat,
+  nsmul := Aiur.NativeAIR.ProofCodec.Extension.nsmul, npow := Aiur.NativeAIR.ProofCodec.Extension.npow,
+  add_zero := Aiur.NativeAIR.ProofCodec.Extension.add_zero, add_comm := Aiur.NativeAIR.ProofCodec.Extension.add_comm,
+  add_assoc := Aiur.NativeAIR.ProofCodec.Extension.add_assoc,
+  mul_assoc := Aiur.NativeAIR.ProofCodec.Extension.mul_assoc, mul_one := Aiur.NativeAIR.ProofCodec.Extension.mul_one,
+  one_mul := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_1,
+  left_distrib := Aiur.NativeAIR.ProofCodec.Extension.left_distrib,
+  right_distrib := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_2,
+  zero_mul := Aiur.NativeAIR.ProofCodec.Extension.zero_mul,
+  mul_zero := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_3,
+  pow_zero := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_4,
+  pow_succ := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_5,
+  ofNat_succ := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_6,
+  ofNat_eq_natCast := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_7,
+  nsmul_eq_natCast_mul := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_8,
+  toNeg := Aiur.NativeAIR.ProofCodec.Extension.neg, toSub := Aiur.NativeAIR.ProofCodec.Extension.sub,
+  intCast := Aiur.NativeAIR.ProofCodec.Extension.intCast, zsmul := Aiur.NativeAIR.ProofCodec.Extension.zsmul,
+  neg_add_cancel := Aiur.NativeAIR.ProofCodec.Extension.neg_add_cancel,
+  sub_eq_add_neg := Aiur.NativeAIR.ProofCodec.Extension.sub_eq_add_neg,
+  neg_zsmul := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_9,
+  zsmul_natCast_eq_nsmul := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_10,
+  intCast_ofNat := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_11,
+  intCast_neg := Aiur.NativeAIR.ProofCodec.Extension.commRing._proof_12,
+  mul_comm := Aiur.NativeAIR.ProofCodec.Extension.mul_comm }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.mk
+{W : Type u} → W → W → Aiur.NativeAIR.LogUp.Coordinates W
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.ofBase
+{W : Type u_1} → [OfNat W 0] → W → Aiur.NativeAIR.LogUp.Coordinates W
+DEFINITION
+fun {W} [OfNat W 0] value => { c0 := value, c1 := 0 }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.ofNat
+{W : Type u_1} → {n : Nat} → [OfNat W n] → [OfNat W 0] → OfNat (Aiur.NativeAIR.LogUp.Coordinates W) n
+DEFINITION
+fun {W} {n} [OfNat W n] [OfNat W 0] => { ofNat := Aiur.NativeAIR.LogUp.Coordinates.ofBase (OfNat.ofNat n) }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.add
+{W : Type u_1} → [Add W] → Add (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Add W] => { add := fun a b => { c0 := a.c0 + b.c0, c1 := a.c1 + b.c1 } }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.sub
+{W : Type u_1} → [Sub W] → Sub (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Sub W] => { sub := fun a b => { c0 := a.c0 - b.c0, c1 := a.c1 - b.c1 } }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.neg
+{W : Type u_1} → [Neg W] → Neg (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Neg W] => { neg := fun a => { c0 := -a.c0, c1 := -a.c1 } }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.mul
+{W : Type u_1} → [OfNat W 7] → [Add W] → [Sub W] → [Mul W] → Mul (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [OfNat W 7] [Add W] [Sub W] [Mul W] =>
+  {
+    mul := fun a b =>
+      have v0 := a.c0 * b.c0;
+      have v1 := a.c1 * b.c1;
+      { c0 := v0 + v1 * 7, c1 := (a.c0 + a.c1) * (b.c0 + b.c1) - v0 - v1 } }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.scale
+{W : Type u_1} → [Mul W] → Aiur.NativeAIR.LogUp.Coordinates W → W → Aiur.NativeAIR.LogUp.Coordinates W
+DEFINITION
+fun {W} [Mul W] value scalar => { c0 := value.c0 * scalar, c1 := value.c1 * scalar }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.map
+{W : Type u_1} → {V : Type u_2} → (W → V) → Aiur.NativeAIR.LogUp.Coordinates W → Aiur.NativeAIR.LogUp.Coordinates V
+DEFINITION
+fun {W} {V} f value => { c0 := f value.c0, c1 := f value.c1 }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.read
+{W : Type u_1} → Array W → Nat → Option (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} values slot => do
+  let __do_lift ← values[2 * slot]?
+  let __do_lift_1 ← values[2 * slot + 1]?
+  pure { c0 := __do_lift, c1 := __do_lift_1 }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.flatten
+{W : Type u_1} → List (Aiur.NativeAIR.LogUp.Coordinates W) → List W
+DEFINITION
+fun {W} values => List.flatMap (fun value => [value.c0, value.c1]) values
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.toExtension
+Aiur.NativeAIR.LogUp.Coordinates Aiur.G → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value => { c0 := value.c0, c1 := value.c1 }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.fromExtension
+Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.LogUp.Coordinates Aiur.G
+DEFINITION
+fun value => { c0 := value.c0, c1 := value.c1 }
+PREMISE Aiur.NativeAIR.LogUp.product
+{R : Type u_1} → [OfNat R 1] → [Mul R] → List R → R
+DEFINITION
+fun {R} [OfNat R 1] [Mul R] values => List.foldr (fun x1 x2 => x1 * x2) 1 values
+PREMISE Aiur.NativeAIR.LogUp.sum
+{R : Type u_1} → [OfNat R 0] → [Add R] → List R → R
+DEFINITION
+fun {R} [OfNat R 0] [Add R] values => List.foldr (fun x1 x2 => x1 + x2) 0 values
+PREMISE Aiur.NativeAIR.LogUp.numerator
+{R : Type u_1} → [OfNat R 0] → [OfNat R 1] → [Add R] → [Mul R] → List (R × R) → R
+DEFINITION
+fun {R} [OfNat R 0] [OfNat R 1] [Add R] [Mul R] x => List.brecOn x Aiur.NativeAIR.LogUp.numerator._f
+PREMISE Aiur.NativeAIR.LogUp.prefixSuffixTerms
+{R : Type u_1} → [OfNat R 1] → [Mul R] → R → List (R × R) → List R
+DEFINITION
+fun {R} [OfNat R 1] [Mul R] initial entries =>
+  have messages := List.map Prod.snd entries;
+  have prefixes := List.scanl (fun x1 x2 => x1 * x2) initial messages;
+  have suffixes := (List.scanr (fun x1 x2 => x1 * x2) 1 messages).tail;
+  List.map
+    (fun x =>
+      match x with
+      | (entry, before, after) => before * after * entry.fst)
+    (entries.zip (prefixes.zip suffixes))
+PREMISE Aiur.NativeAIR.LogUp.groupEquation
+{R : Type u_1} → [OfNat R 0] → [OfNat R 1] → [Add R] → [Sub R] → [Mul R] → List (R × R) → R → R
+DEFINITION
+fun {R} [OfNat R 0] [OfNat R 1] [Add R] [Sub R] [Mul R] entries difference =>
+  match entries with
+  | [] => difference
+  | [(weight, message)] => message * difference - weight
+  | x =>
+    List.foldl (fun x1 x2 => x1 * x2) 1 (List.map Prod.snd entries) * difference -
+      List.foldl (fun x1 x2 => x1 + x2) 0 (Aiur.NativeAIR.LogUp.prefixSuffixTerms 1 entries)
+PREMISE Aiur.NativeAIR.LogUp.fingerprint
+{W : Type u} →
+  [OfNat W 0] →
+    [OfNat W 7] →
+      [Add W] → [Sub W] → [Mul W] → Aiur.NativeAIR.LogUp.Coordinates W → List W → Aiur.NativeAIR.LogUp.Coordinates W
+DEFINITION
+fun {W} [OfNat W 0] [OfNat W 7] [Add W] [Sub W] [Mul W] gamma args =>
+  List.foldr (fun arg acc => acc * gamma + Aiur.NativeAIR.LogUp.Coordinates.ofBase arg) 0 args
+PREMISE Aiur.NativeAIR.LogUp.compress
+{W : Type u} →
+  [OfNat W 0] →
+    [OfNat W 7] →
+      [Add W] →
+        [Sub W] →
+          [Mul W] →
+            Aiur.NativeAIR.LogUp.Coordinates W →
+              Aiur.NativeAIR.LogUp.Coordinates W →
+                List (W × List W) → List (Aiur.NativeAIR.LogUp.Coordinates W × Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [OfNat W 0] [OfNat W 7] [Add W] [Sub W] [Mul W] beta gamma lookups =>
+  List.map
+    (fun x =>
+      match x with
+      | (multiplicity, args) =>
+        (Aiur.NativeAIR.LogUp.Coordinates.ofBase multiplicity, Aiur.NativeAIR.LogUp.fingerprint gamma args + beta))
+    lookups
+PREMISE Aiur.NativeAIR.LogUp.groupCount
+Nat → Nat → Nat
+DEFINITION
+fun groupSize lookupCount => max 1 ((lookupCount + max groupSize 1 - 1) / max groupSize 1)
+PREMISE Aiur.NativeAIR.LogUp.chunk
+{α : Type u_1} → Nat → Nat → List α → List α
+DEFINITION
+fun {α} groupSize index lookups => List.take (max groupSize 1) (List.drop (index * max groupSize 1) lookups)
+PREMISE Aiur.NativeAIR.LogUp.step
+{W : Type u} →
+  [OfNat W 0] →
+    [OfNat W 1] →
+      [OfNat W 7] →
+        [Add W] →
+          [Sub W] →
+            [Mul W] →
+              Aiur.NativeAIR.LogUp.Coordinates W →
+                Aiur.NativeAIR.LogUp.Coordinates W →
+                  Aiur.NativeAIR.LogUp.Coordinates W →
+                    Aiur.NativeAIR.LogUp.Coordinates W →
+                      Array W → List (W × List W) → Nat → Nat → Option (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [OfNat W 0] [OfNat W 1] [OfNat W 7] [Add W] [Sub W] [Mul W] beta gamma injection next stageCurrent lookups
+    groupSize index =>
+  do
+  let source ← Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent index
+  have __do_jp : Aiur.NativeAIR.LogUp.Coordinates W → Option (Aiur.NativeAIR.LogUp.Coordinates W) := fun target =>
+    pure
+      (Aiur.NativeAIR.LogUp.groupEquation
+        (Aiur.NativeAIR.LogUp.compress beta gamma (Aiur.NativeAIR.LogUp.chunk groupSize index lookups))
+        (target - source))
+  if index + 1 < Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length then do
+      let target ← Aiur.NativeAIR.LogUp.Coordinates.read stageCurrent (index + 1)
+      __do_jp target
+    else do
+      let target ← some (next + injection)
+      __do_jp target
+PREMISE Aiur.NativeAIR.LogUp.equations
+{W : Type u} →
+  [OfNat W 0] →
+    [OfNat W 1] →
+      [OfNat W 7] →
+        [Add W] →
+          [Sub W] →
+            [Mul W] →
+              List (W × List W) →
+                Array W → Array W → Array W → Array W → W → Nat → Option (List (Aiur.NativeAIR.LogUp.Coordinates W))
+DEFINITION
+fun {W} [OfNat W 0] [OfNat W 1] [OfNat W 7] [Add W] [Sub W] [Mul W] lookups stageCurrent stageNext publics deltaScaled
+    isLast groupSize =>
+  if 8 < groupSize then none
+  else do
+    let beta ← Aiur.NativeAIR.LogUp.Coordinates.read publics 0
+    let gamma ← Aiur.NativeAIR.LogUp.Coordinates.read publics 1
+    let delta ← Aiur.NativeAIR.LogUp.Coordinates.read deltaScaled 0
+    have injection : Aiur.NativeAIR.LogUp.Coordinates W := delta.scale isLast
+    let next ← Aiur.NativeAIR.LogUp.Coordinates.read stageNext 0
+    have groups : Nat := Aiur.NativeAIR.LogUp.groupCount groupSize lookups.length
+    List.mapM (Aiur.NativeAIR.LogUp.step beta gamma injection next stageCurrent lookups groupSize) (List.range groups)
+PREMISE Aiur.NativeAIR.LogUp.constraintValues
+{W : Type u} →
+  [OfNat W 0] →
+    [OfNat W 1] →
+      [OfNat W 7] →
+        [Add W] →
+          [Sub W] →
+            [Mul W] →
+              List Aiur.NativeAIR.Lookup → Array W → Array W → Array W → Array W → Array W → W → Nat → Option (List W)
+DEFINITION
+fun {W} [OfNat W 0] [OfNat W 1] [OfNat W 7] [Add W] [Sub W] [Mul W] lookups nodeValues stageCurrent stageNext publics
+    deltaScaled isLast groupSize =>
+  do
+  let values ← List.mapM (Aiur.NativeAIR.readLookup nodeValues) lookups
+  let __do_lift ← Aiur.NativeAIR.LogUp.equations values stageCurrent stageNext publics deltaScaled isLast groupSize
+  pure (Aiur.NativeAIR.LogUp.Coordinates.flatten __do_lift)
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.natCast
+{W : Type u} → [Grind.CommRing W] → NatCast (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Grind.CommRing W] => { natCast := fun n => Aiur.NativeAIR.LogUp.Coordinates.ofBase ↑n }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.intCast
+{W : Type u} → [Grind.CommRing W] → IntCast (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Grind.CommRing W] => { intCast := fun n => Aiur.NativeAIR.LogUp.Coordinates.ofBase ↑n }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.nsmul
+{W : Type u} → [Grind.CommRing W] → SMul Nat (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Grind.CommRing W] => { smul := fun n a => Aiur.NativeAIR.LogUp.Coordinates.ofBase ↑n * a }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.zsmul
+{W : Type u} → [Grind.CommRing W] → SMul Int (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Grind.CommRing W] => { smul := fun n a => Aiur.NativeAIR.LogUp.Coordinates.ofBase ↑n * a }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.npow
+{W : Type u} → [Grind.CommRing W] → HPow (Aiur.NativeAIR.LogUp.Coordinates W) Nat (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Grind.CommRing W] => { hPow := fun a n => npowRec n a }
+PREMISE Aiur.NativeAIR.LogUp.Coordinates.commRing
+{W : Type u} → [Grind.CommRing W] → Grind.CommRing (Aiur.NativeAIR.LogUp.Coordinates W)
+DEFINITION
+fun {W} [Grind.CommRing W] =>
+  { toAdd := Aiur.NativeAIR.LogUp.Coordinates.add, toMul := Aiur.NativeAIR.LogUp.Coordinates.mul,
+    natCast := Aiur.NativeAIR.LogUp.Coordinates.natCast, ofNat := fun n => Aiur.NativeAIR.LogUp.Coordinates.ofNat,
+    nsmul := Aiur.NativeAIR.LogUp.Coordinates.nsmul, npow := Aiur.NativeAIR.LogUp.Coordinates.npow, add_zero := ⋯,
+    add_comm := ⋯, add_assoc := ⋯, mul_assoc := ⋯, mul_one := ⋯, one_mul := ⋯, left_distrib := ⋯, right_distrib := ⋯,
+    zero_mul := ⋯, mul_zero := ⋯, pow_zero := ⋯, pow_succ := ⋯, ofNat_succ := ⋯, ofNat_eq_natCast := ⋯,
+    nsmul_eq_natCast_mul := ⋯, toNeg := Aiur.NativeAIR.LogUp.Coordinates.neg,
+    toSub := Aiur.NativeAIR.LogUp.Coordinates.sub, intCast := Aiur.NativeAIR.LogUp.Coordinates.intCast,
+    zsmul := Aiur.NativeAIR.LogUp.Coordinates.zsmul, neg_add_cancel := ⋯, sub_eq_add_neg := ⋯, neg_zsmul := ⋯,
+    zsmul_natCast_eq_nsmul := ⋯, intCast_ofNat := ⋯, intCast_neg := ⋯, mul_comm := ⋯ }
+PREMISE Aiur.NativeAIR.LogUp.inverseValue
+Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun value => value.tryInverse.getD 0
+PREMISE Aiur.NativeAIR.LogUp.fractionSum
+List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension) → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun entries =>
+  Aiur.NativeAIR.LogUp.sum
+    (List.map
+      (fun x =>
+        match x with
+        | (weight, message) => weight * Aiur.NativeAIR.LogUp.inverseValue message)
+      entries)
+PREMISE Aiur.NativeAIR.LogUp.PoleFree
+List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension) → Prop
+DEFINITION
+fun entries =>
+  ∀ (entry : Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension), entry ∈ entries → entry.snd ≠ 0
+PREMISE Aiur.NativeAIR.LogUp.fieldEntries
+List (Aiur.NativeAIR.LogUp.Coordinates Aiur.G × Aiur.NativeAIR.LogUp.Coordinates Aiur.G) →
+  List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)
+DEFINITION
+fun entries =>
+  List.map
+    (fun x =>
+      match x with
+      | (weight, message) => (weight.toExtension, message.toExtension))
+    entries
+PREMISE Aiur.NativeAIR.LogUp.lookupFractions
+Aiur.NativeAIR.LogUp.Coordinates Aiur.G →
+  Aiur.NativeAIR.LogUp.Coordinates Aiur.G → List (Aiur.G × List Aiur.G) → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun beta gamma lookups =>
+  Aiur.NativeAIR.LogUp.fractionSum
+    (Aiur.NativeAIR.LogUp.fieldEntries (Aiur.NativeAIR.LogUp.compress beta gamma lookups))
+PREMISE Aiur.NativeAIR.Domain.generators
+Array Aiur.G
+DEFINITION
+(have y :=
+    have y :=
+      have y :=
+        [6414415596519834757, 16116352524544190054, 9123114210336311365, 4614640910117430873, 1753635133440165772];
+      9713644485405565297 :: 5456943929260765144 :: 17096174751763063430 :: 1213594585890690845 :: y;
+    have y := 3511170319078647661 :: 17654865857378133588 :: 5416168637041100469 :: 16905767614792059275 :: y;
+    6115771955107415310 :: 12380578893860276750 :: 9306717745644682924 :: 18146160046829613826 :: y;
+  have y :=
+    have y := 17492915097719143606 :: 1532612707718625687 :: 16207902636198568418 :: 17776499369601055404 :: y;
+    13797081185216407910 :: 1803076106186727246 :: 11353340290879379826 :: 455906449640507599 :: y;
+  have y := 17293822564807737345 :: 70368744161280 :: 549755813888 :: 17870292113338400769 :: y;
+  1 :: 18446744069414584320 :: 281474976710656 :: 18446744069397807105 :: y).toArray
+PREMISE Aiur.NativeAIR.Domain.Subgroup
+Type
+DEFINITION
+Fin 33
+PREMISE Aiur.NativeAIR.Domain.ofLogSize
+Nat → Option Aiur.NativeAIR.Domain.Subgroup
+DEFINITION
+fun bits => if bounded : bits < 33 then some ⟨bits, bounded⟩ else none
+PREMISE Aiur.NativeAIR.Domain.size
+Aiur.NativeAIR.Domain.Subgroup → Nat
+DEFINITION
+fun domain => 2 ^ ↑domain
+PREMISE Aiur.NativeAIR.Domain.generator
+Aiur.NativeAIR.Domain.Subgroup → Aiur.G
+DEFINITION
+fun domain => Aiur.NativeAIR.Domain.generators[↑domain]
+PREMISE Aiur.NativeAIR.Domain.point
+(domain : Aiur.NativeAIR.Domain.Subgroup) → Fin (Aiur.NativeAIR.Domain.size domain) → Aiur.G
+DEFINITION
+fun domain index => (Aiur.NativeAIR.Domain.generator domain).pow ↑index
+PREMISE Aiur.NativeAIR.Domain.lastPoint
+Aiur.NativeAIR.Domain.Subgroup → Aiur.G
+DEFINITION
+fun domain => (Aiur.NativeAIR.Domain.generator domain).inverse
+PREMISE Aiur.NativeAIR.Domain.normalizer
+Aiur.NativeAIR.Domain.Subgroup → Aiur.G
+DEFINITION
+fun domain => Aiur.G.ofNat (Aiur.NativeAIR.Domain.size domain) * Aiur.NativeAIR.Domain.generator domain
+PREMISE Aiur.NativeAIR.Domain.Selectors.mk
+{W : Type} → W → W → W → W → Aiur.NativeAIR.Domain.Selectors W
+PREMISE Aiur.NativeAIR.Domain.vanishing
+Aiur.NativeAIR.Domain.Subgroup → Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun domain value => value.power (Aiur.NativeAIR.Domain.size domain) - 1
+PREMISE Aiur.NativeAIR.Domain.selectors
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.ProofCodec.Extension → Option (Aiur.NativeAIR.Domain.Selectors Aiur.NativeAIR.ProofCodec.Extension)
+DEFINITION
+fun domain value =>
+  have z := Aiur.NativeAIR.Domain.vanishing domain value;
+  have lastDenominator := value - Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.lastPoint domain);
+  do
+  let firstInverse ← (value - 1).tryInverse
+  let lastInverse ← lastDenominator.tryInverse
+  let vanishingInverse ← z.tryInverse
+  pure
+      { isFirst := z * firstInverse, isLast := z * lastInverse, isTransition := lastDenominator,
+        invVanishing := vanishingInverse }
+PREMISE Aiur.NativeAIR.Quotient.horner
+{W : Type u_1} → [OfNat W 0] → [Add W] → [Mul W] → W → List W → W
+DEFINITION
+fun {W} [OfNat W 0] [Add W] [Mul W] point coefficients =>
+  List.foldr (fun coefficient rest => coefficient + point * rest) 0 coefficients
+PREMISE Aiur.NativeAIR.Quotient.composition
+{W : Type u_1} → [OfNat W 0] → [Add W] → [Mul W] → W → List W → W
+DEFINITION
+fun {W} [OfNat W 0] [Add W] [Mul W] alpha constraints =>
+  List.foldl (fun accumulated value => accumulated * alpha + value) 0 constraints
+PREMISE Aiur.NativeAIR.Quotient.coefficients
+List Aiur.NativeAIR.ProofCodec.Extension → Option (List Aiur.NativeAIR.ProofCodec.Extension)
+DEFINITION
+fun x => List.brecOn x Aiur.NativeAIR.Quotient.coefficients._f
+PREMISE Aiur.NativeAIR.Quotient.evaluate
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    List Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun domain point row => do
+  let __do_lift ← Aiur.NativeAIR.Quotient.coefficients row
+  pure (Aiur.NativeAIR.Quotient.horner (point.power (Aiur.NativeAIR.Domain.size domain)) __do_lift)
+PREMISE Aiur.NativeAIR.Quotient.check
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    Aiur.NativeAIR.ProofCodec.Extension →
+      List Aiur.NativeAIR.ProofCodec.Extension → List Aiur.NativeAIR.ProofCodec.Extension → Option Bool
+DEFINITION
+fun domain point alpha constraints row => do
+  let selected ← Aiur.NativeAIR.Domain.selectors domain point
+  let quotient ← Aiur.NativeAIR.Quotient.evaluate domain point row
+  pure (Aiur.NativeAIR.Quotient.composition alpha constraints * selected.invVanishing == quotient)
+PREMISE Aiur.NativeAIR.Domain.Algebra.dividedPowers
+{R : Type} → [Grind.CommRing R] → R → R → Nat → R
+DEFINITION
+fun {R} [Grind.CommRing R] x a x_1 => Nat.brecOn x_1 (Aiur.NativeAIR.Domain.Algebra.dividedPowers._f x a)
+PREMISE Aiur.NativeAIR.VerifierArithmetic.Challenges.mk
+Aiur.NativeAIR.ProofCodec.Extension →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    Aiur.NativeAIR.ProofCodec.Extension →
+      Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.VerifierArithmetic.Challenges
+PREMISE Aiur.NativeAIR.VerifierArithmetic.pairColumns
+Aiur.NativeAIR.ProofShape.Pair → Aiur.NativeAIR.RowOffset → Array Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun pair x =>
+  match x with
+  | Aiur.NativeAIR.RowOffset.current => pair.current.toArray
+  | Aiur.NativeAIR.RowOffset.next => pair.next.toArray
+PREMISE Aiur.NativeAIR.VerifierArithmetic.rowColumns
+Aiur.NativeAIR.ProofShape.Row →
+  Aiur.NativeAIR.Source → Aiur.NativeAIR.RowOffset → Array Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun row x =>
+  match (motive := Aiur.NativeAIR.Source → Aiur.NativeAIR.RowOffset → Array Aiur.NativeAIR.ProofCodec.Extension) x with
+  | Aiur.NativeAIR.Source.preprocessed =>
+    match (motive :=
+      Option Aiur.NativeAIR.ProofShape.Pair → Aiur.NativeAIR.RowOffset → Array Aiur.NativeAIR.ProofCodec.Extension)
+      row.preprocessed with
+    | none => fun x => #[]
+    | some pair => Aiur.NativeAIR.VerifierArithmetic.pairColumns pair
+  | Aiur.NativeAIR.Source.main => Aiur.NativeAIR.VerifierArithmetic.pairColumns row.stage1
+  | Aiur.NativeAIR.Source.stage2 => Aiur.NativeAIR.VerifierArithmetic.pairColumns row.stage2
+PREMISE Aiur.NativeAIR.VerifierArithmetic.publics
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofCodec.Extension → Array Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun challenges entering leaving =>
+  #[Aiur.NativeAIR.ProofCodec.Extension.ofBase challenges.beta.c0,
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase challenges.beta.c1,
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase challenges.gamma.c0,
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase challenges.gamma.c1,
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase entering.c0, Aiur.NativeAIR.ProofCodec.Extension.ofBase entering.c1,
+    Aiur.NativeAIR.ProofCodec.Extension.ofBase leaving.c0, Aiur.NativeAIR.ProofCodec.Extension.ofBase leaving.c1]
+PREMISE Aiur.NativeAIR.VerifierArithmetic.deltaScaled
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.ProofCodec.Extension → Array Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun domain entering leaving =>
+  have normalizer := Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Domain.normalizer domain).inverse;
+  #[(Aiur.NativeAIR.ProofCodec.Extension.ofBase leaving.c0 - Aiur.NativeAIR.ProofCodec.Extension.ofBase entering.c0) *
+      normalizer,
+    (Aiur.NativeAIR.ProofCodec.Extension.ofBase leaving.c1 - Aiur.NativeAIR.ProofCodec.Extension.ofBase entering.c1) *
+      normalizer]
+PREMISE Aiur.NativeAIR.VerifierArithmetic.view
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  Aiur.NativeAIR.ProofShape.Row →
+    Aiur.NativeAIR.ProofCodec.Extension →
+      Aiur.NativeAIR.Domain.Selectors Aiur.NativeAIR.ProofCodec.Extension →
+        Aiur.NativeAIR.Values Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun challenges row entering selectors =>
+  { columns := Aiur.NativeAIR.VerifierArithmetic.rowColumns row,
+    publics := Aiur.NativeAIR.VerifierArithmetic.publics challenges entering row.accumulator,
+    isFirstRow := selectors.isFirst, isLastRow := selectors.isLast, isTransition := selectors.isTransition }
+PREMISE Aiur.NativeAIR.VerifierArithmetic.Evaluation.mk
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.Domain.Selectors Aiur.NativeAIR.ProofCodec.Extension →
+    Array Aiur.NativeAIR.ProofCodec.Extension →
+      List Aiur.NativeAIR.ProofCodec.Extension →
+        List Aiur.NativeAIR.ProofCodec.Extension →
+          Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.VerifierArithmetic.Evaluation
+PREMISE Aiur.NativeAIR.VerifierArithmetic.Evaluation.constraints
+Aiur.NativeAIR.VerifierArithmetic.Evaluation → List Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun result => result.userValues ++ result.lookupValues
+PREMISE Aiur.NativeAIR.VerifierArithmetic.Evaluation.accepts
+Aiur.NativeAIR.VerifierArithmetic.Evaluation → Aiur.NativeAIR.ProofCodec.Extension → Bool
+DEFINITION
+fun result alpha =>
+  Aiur.NativeAIR.Quotient.composition alpha result.constraints * result.selectors.invVanishing == result.quotientValue
+PREMISE Aiur.NativeAIR.VerifierArithmetic.evaluate
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  Aiur.NativeAIR.ProofShape.Row →
+    Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.VerifierArithmetic.Evaluation
+DEFINITION
+fun challenges row entering => do
+  let domain ← Aiur.NativeAIR.Domain.ofLogSize row.logDegree.toNat
+  let selectors ← Aiur.NativeAIR.Domain.selectors domain challenges.zeta
+  have values : Aiur.NativeAIR.Values Aiur.NativeAIR.ProofCodec.Extension :=
+    Aiur.NativeAIR.VerifierArithmetic.view challenges row entering selectors
+  let nodes ← row.circuit.graph.sweep Aiur.NativeAIR.ProofCodec.Extension.evalOps values
+  let userValues ← Aiur.NativeAIR.readNodes nodes row.circuit.graph.zeros
+  let lookupValues ←
+    Aiur.NativeAIR.LogUp.constraintValues row.circuit.graph.lookups nodes
+        (values.columns Aiur.NativeAIR.Source.stage2 Aiur.NativeAIR.RowOffset.current)
+        (values.columns Aiur.NativeAIR.Source.stage2 Aiur.NativeAIR.RowOffset.next) values.publics
+        (Aiur.NativeAIR.VerifierArithmetic.deltaScaled domain entering row.accumulator) values.isLastRow
+        row.circuit.lookupGroupSize
+  let quotientValue ← Aiur.NativeAIR.Quotient.evaluate domain challenges.zeta row.quotient
+  pure
+      { domain := domain, selectors := selectors, nodeValues := nodes, userValues := userValues,
+        lookupValues := lookupValues, quotientValue := quotientValue }
+PREMISE Aiur.NativeAIR.VerifierArithmetic.check
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  Aiur.NativeAIR.ProofShape.Row → Aiur.NativeAIR.ProofCodec.Extension → Option Bool
+DEFINITION
+fun challenges row entering => do
+  let __do_lift ← Aiur.NativeAIR.VerifierArithmetic.evaluate challenges row entering
+  pure (__do_lift.accepts challenges.alpha)
+PREMISE Aiur.NativeAIR.VerifierArithmetic.checkRows
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  List Aiur.NativeAIR.ProofShape.Row → Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun challenges x x_1 =>
+  List.brecOn (motive := fun x => Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.ProofCodec.Extension) x
+    (Aiur.NativeAIR.VerifierArithmetic.checkRows._f challenges) x_1
+PREMISE Aiur.NativeAIR.VerifierArithmetic.claimMessage
+Aiur.NativeAIR.VerifierArithmetic.Challenges → List Aiur.G → Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun challenges claim =>
+  challenges.beta +
+    (Aiur.NativeAIR.LogUp.fingerprint (Aiur.NativeAIR.LogUp.Coordinates.fromExtension challenges.gamma)
+        claim).toExtension
+PREMISE Aiur.NativeAIR.VerifierArithmetic.initialAccumulator
+Aiur.NativeAIR.VerifierArithmetic.Challenges → List (List Aiur.G) → Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun challenges claims => do
+  let inverses ←
+    List.mapM (fun claim => (Aiur.NativeAIR.VerifierArithmetic.claimMessage challenges claim).tryInverse) claims
+  pure (Aiur.NativeAIR.LogUp.sum inverses)
+PREMISE Aiur.NativeAIR.VerifierArithmetic.verify
+Aiur.NativeAIR.VerifierArithmetic.Challenges → List (List Aiur.G) → List Aiur.NativeAIR.ProofShape.Row → Option Bool
+DEFINITION
+fun challenges claims rows =>
+  if rows.isEmpty = true then none
+  else do
+    let entering ← Aiur.NativeAIR.VerifierArithmetic.initialAccumulator challenges claims
+    let __do_lift ← Aiur.NativeAIR.VerifierArithmetic.checkRows challenges rows entering
+    pure (__do_lift == 0)
+PREMISE Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads.mk
+∀ {challenges : Aiur.NativeAIR.VerifierArithmetic.Challenges} {row : Aiur.NativeAIR.ProofShape.Row}
+  {entering : Aiur.NativeAIR.ProofCodec.Extension} {result : Aiur.NativeAIR.VerifierArithmetic.Evaluation},
+  Aiur.NativeAIR.Domain.ofLogSize row.logDegree.toNat = some result.domain →
+    Aiur.NativeAIR.Domain.selectors result.domain challenges.zeta = some result.selectors →
+      row.circuit.graph.sweep Aiur.NativeAIR.ProofCodec.Extension.evalOps
+            (Aiur.NativeAIR.VerifierArithmetic.view challenges row entering result.selectors) =
+          some result.nodeValues →
+        Aiur.NativeAIR.readNodes result.nodeValues row.circuit.graph.zeros = some result.userValues →
+          Aiur.NativeAIR.LogUp.constraintValues row.circuit.graph.lookups result.nodeValues
+                (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+                  Aiur.NativeAIR.RowOffset.current)
+                (Aiur.NativeAIR.VerifierArithmetic.rowColumns row Aiur.NativeAIR.Source.stage2
+                  Aiur.NativeAIR.RowOffset.next)
+                (Aiur.NativeAIR.VerifierArithmetic.publics challenges entering row.accumulator)
+                (Aiur.NativeAIR.VerifierArithmetic.deltaScaled result.domain entering row.accumulator)
+                result.selectors.isLast row.circuit.lookupGroupSize =
+              some result.lookupValues →
+            Aiur.NativeAIR.Quotient.evaluate result.domain challenges.zeta row.quotient = some result.quotientValue →
+              Aiur.NativeAIR.VerifierArithmetic.Evaluation.Reads challenges row entering result
+PREMISE Aiur.NativeAIR.VerifierArithmetic.publicEntries
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  List (List Aiur.G) → List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)
+DEFINITION
+fun challenges claims =>
+  List.map (fun claim => (1, Aiur.NativeAIR.VerifierArithmetic.claimMessage challenges claim)) claims
+PREMISE Aiur.NativeAIR.Challenger.Hash32
+Type
+DEFINITION
+List UInt8 → Fin 32 → UInt8
+PREMISE Aiur.NativeAIR.Challenger.State.mk
+List UInt8 → List UInt8 → Aiur.NativeAIR.Challenger.State
+PREMISE Aiur.NativeAIR.Challenger.initial
+List UInt8 → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun seed => { input := seed, pending := [] }
+PREMISE Aiur.NativeAIR.Challenger.observeByte
+Aiur.NativeAIR.Challenger.State → UInt8 → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun state byte => { input := state.input ++ [byte], pending := [] }
+PREMISE Aiur.NativeAIR.Challenger.observeBytes
+Aiur.NativeAIR.Challenger.State → List UInt8 → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun state bytes => if bytes.isEmpty = true then state else { input := state.input ++ bytes, pending := [] }
+PREMISE Aiur.NativeAIR.Challenger.observeField
+Aiur.NativeAIR.Challenger.State → Aiur.G → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun state value => Aiur.NativeAIR.Challenger.observeBytes state (Aiur.NativeAIR.ProofCodec.encodeField value)
+PREMISE Aiur.NativeAIR.Challenger.observeExtension
+Aiur.NativeAIR.Challenger.State → Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun state value =>
+  Aiur.NativeAIR.Challenger.observeField (Aiur.NativeAIR.Challenger.observeField state value.c0) value.c1
+PREMISE Aiur.NativeAIR.Challenger.observeCap
+Aiur.NativeAIR.Challenger.State → Aiur.NativeAIR.KeyCodec.MerkleCap → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun state cap => Aiur.NativeAIR.Challenger.observeBytes state (List.flatten cap)
+PREMISE Aiur.NativeAIR.Challenger.sampleByte
+Aiur.NativeAIR.Challenger.Hash32 → Aiur.NativeAIR.Challenger.State → UInt8 × Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun hash state =>
+  match state.pending with
+  | byte :: rest => (byte, { input := state.input, pending := rest })
+  | [] =>
+    have digest := hash state.input;
+    (digest 31, { input := List.ofFn digest, pending := List.drop 1 (List.ofFn digest).reverse })
+PREMISE Aiur.NativeAIR.Challenger.sampleBytes
+Aiur.NativeAIR.Challenger.Hash32 → Nat → Aiur.NativeAIR.Challenger.State → List UInt8 × Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun hash x x_1 =>
+  Nat.brecOn (motive := fun x => Aiur.NativeAIR.Challenger.State → List UInt8 × Aiur.NativeAIR.Challenger.State) x
+    (Aiur.NativeAIR.Challenger.sampleBytes._f hash) x_1
+PREMISE Aiur.NativeAIR.Challenger.littleEndian
+List UInt8 → Nat
+DEFINITION
+fun bytes => List.foldr (fun byte rest => byte.toNat + 256 * rest) 0 bytes
+PREMISE Aiur.NativeAIR.Challenger.sampleWord
+Aiur.NativeAIR.Challenger.Hash32 → Aiur.NativeAIR.Challenger.State → Nat × Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun hash state =>
+  match Aiur.NativeAIR.Challenger.sampleBytes hash 8 state with
+  | (bytes, next) => (Aiur.NativeAIR.Challenger.littleEndian bytes, next)
+PREMISE Aiur.NativeAIR.Challenger.sampleField
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat → Aiur.NativeAIR.Challenger.State → Option (Aiur.G × Aiur.NativeAIR.Challenger.State)
+DEFINITION
+fun hash x x_1 =>
+  Nat.brecOn (motive := fun x => Aiur.NativeAIR.Challenger.State → Option (Aiur.G × Aiur.NativeAIR.Challenger.State)) x
+    (Aiur.NativeAIR.Challenger.sampleField._f hash) x_1
+PREMISE Aiur.NativeAIR.Challenger.sampleExtension
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat → Aiur.NativeAIR.Challenger.State → Option (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.Challenger.State)
+DEFINITION
+fun hash fuel state => do
+  let __x ← Aiur.NativeAIR.Challenger.sampleField hash fuel state
+  match __x with
+    | (c0, next) => do
+      let __x ← Aiur.NativeAIR.Challenger.sampleField hash fuel next
+      match __x with
+        | (c1, final) => pure ({ c0 := c0, c1 := c1 }, final)
+PREMISE Aiur.NativeAIR.Challenger.sampleBits
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat → Aiur.NativeAIR.Challenger.State → Option (Nat × Aiur.NativeAIR.Challenger.State)
+DEFINITION
+fun hash bits state =>
+  if bits < 64 ∧ 2 ^ bits < Aiur.gSize.toNat then
+    match Aiur.NativeAIR.Challenger.sampleWord hash state with
+    | (word, next) => some (word % 2 ^ bits, next)
+  else none
+PREMISE Aiur.NativeAIR.Challenger.checkWitness
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat → Aiur.G → Aiur.NativeAIR.Challenger.State → Option (Bool × Aiur.NativeAIR.Challenger.State)
+DEFINITION
+fun hash bits witness state =>
+  if bits = 0 then pure (true, state)
+  else do
+    let __x ← Aiur.NativeAIR.Challenger.sampleBits hash bits (Aiur.NativeAIR.Challenger.observeField state witness)
+    match __x with
+      | (value, next) => pure (value == 0, next)
+PREMISE Aiur.NativeAIR.Transcript.parameterWords
+Aiur.NativeAIR.KeyCodec.Parameters → List Nat
+DEFINITION
+fun parameters =>
+  [parameters.logBlowup, parameters.capHeight, parameters.logFinalPolyLen, parameters.maxLogArity,
+    parameters.numQueries, parameters.commitProofOfWorkBits, parameters.queryProofOfWorkBits]
+PREMISE Aiur.NativeAIR.Transcript.seed
+Aiur.NativeAIR.KeyCodec.Parameters → List UInt8
+DEFINITION
+fun parameters =>
+  "multi-stark/v0".toUTF8.data.toList ++
+    List.flatMap (Aiur.NativeAIR.KeyCodec.encodeNat 8) (Aiur.NativeAIR.Transcript.parameterWords parameters)
+PREMISE Aiur.NativeAIR.Transcript.circuitShape
+Aiur.NativeAIR.KeyCodec.Circuit → List Aiur.G
+DEFINITION
+fun circuit =>
+  List.map Aiur.G.ofNat
+    [circuit.constraintCount, circuit.maxConstraintDegree, circuit.preprocessedHeight, circuit.preprocessedWidth,
+      circuit.mainWidth, circuit.widths.stage2, circuit.lookupGroupSize]
+PREMISE Aiur.NativeAIR.Transcript.shape
+Aiur.NativeAIR.KeyCodec.Key → List Aiur.G
+DEFINITION
+fun key => Aiur.G.ofNat key.circuits.length :: List.flatMap Aiur.NativeAIR.Transcript.circuitShape key.circuits
+PREMISE Aiur.NativeAIR.Transcript.claimsFields
+List (List Aiur.G) → List Aiur.G
+DEFINITION
+fun claims => Aiur.G.ofNat claims.length :: List.flatMap (fun claim => Aiur.G.ofNat claim.length :: claim) claims
+PREMISE Aiur.NativeAIR.Transcript.fieldsBytes
+List Aiur.G → List UInt8
+DEFINITION
+fun values => List.flatMap Aiur.NativeAIR.ProofCodec.encodeField values
+PREMISE Aiur.NativeAIR.Transcript.prefixBytes
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → List (List Aiur.G) → List UInt8
+DEFINITION
+fun key proof claims =>
+  Aiur.NativeAIR.Transcript.fieldsBytes (Aiur.NativeAIR.Transcript.shape key) ++
+            Aiur.NativeAIR.Transcript.fieldsBytes
+              (List.map (fun active => if active = true then 1 else 0) proof.active) ++
+          List.flatten (key.preprocessedCommitment.getD []) ++
+        List.flatten proof.commitments.stage1 ++
+      Aiur.NativeAIR.Transcript.fieldsBytes (List.map (fun degree => Aiur.G.ofNat degree.toNat) proof.logDegrees) ++
+    Aiur.NativeAIR.Transcript.fieldsBytes (Aiur.NativeAIR.Transcript.claimsFields claims)
+PREMISE Aiur.NativeAIR.Transcript.lookupState
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → List (List Aiur.G) → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun key proof claims =>
+  Aiur.NativeAIR.Challenger.observeBytes
+    (Aiur.NativeAIR.Challenger.initial (Aiur.NativeAIR.Transcript.seed key.parameters))
+    (Aiur.NativeAIR.Transcript.prefixBytes key proof claims)
+PREMISE Aiur.NativeAIR.Transcript.accumulatorState
+Aiur.NativeAIR.ProofCodec.Data → Aiur.NativeAIR.Challenger.State → Aiur.NativeAIR.Challenger.State
+DEFINITION
+fun proof state =>
+  List.foldl Aiur.NativeAIR.Challenger.observeExtension
+    (Aiur.NativeAIR.Challenger.observeCap state proof.commitments.stage2) proof.accumulators
+PREMISE Aiur.NativeAIR.Transcript.Replay.mk
+Aiur.NativeAIR.VerifierArithmetic.Challenges → Aiur.NativeAIR.Challenger.State → Aiur.NativeAIR.Transcript.Replay
+PREMISE Aiur.NativeAIR.Transcript.replay
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat →
+    Aiur.NativeAIR.KeyCodec.Key →
+      Aiur.NativeAIR.ProofCodec.Data → List (List Aiur.G) → Option Aiur.NativeAIR.Transcript.Replay
+DEFINITION
+fun hash fuel key proof claims => do
+  let __x ← Aiur.NativeAIR.Challenger.sampleExtension hash fuel (Aiur.NativeAIR.Transcript.lookupState key proof claims)
+  match __x with
+    | (beta, afterBeta) => do
+      let __x ←
+        Aiur.NativeAIR.Challenger.sampleExtension hash fuel (Aiur.NativeAIR.Challenger.observeExtension afterBeta beta)
+      match __x with
+        | (gamma, afterGamma) => do
+          let __x ←
+            Aiur.NativeAIR.Challenger.sampleExtension hash fuel
+                (Aiur.NativeAIR.Transcript.accumulatorState proof
+                  (Aiur.NativeAIR.Challenger.observeExtension afterGamma gamma))
+          match __x with
+            | (alpha, afterAlpha) => do
+              let __x ←
+                Aiur.NativeAIR.Challenger.sampleExtension hash fuel
+                    (Aiur.NativeAIR.Challenger.observeCap afterAlpha proof.commitments.quotient)
+              match __x with
+                | (zeta, final) =>
+                  pure { challenges := { beta := beta, gamma := gamma, alpha := alpha, zeta := zeta }, state := final }
+PREMISE Aiur.NativeAIR.Transcript.verifyArithmetic
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat →
+    Aiur.NativeAIR.KeyCodec.Key →
+      Aiur.NativeAIR.ProofCodec.Data →
+        List (List Aiur.G) → List Aiur.NativeAIR.ProofShape.Row → Option Aiur.NativeAIR.Transcript.Replay
+DEFINITION
+fun hash fuel key proof claims rows => do
+  let result ← Aiur.NativeAIR.Transcript.replay hash fuel key proof claims
+  let __do_lift ← Aiur.NativeAIR.VerifierArithmetic.verify result.challenges claims rows
+  if __do_lift = true then some result else none
+PREMISE Aiur.NativeAIR.Challenger.State.Valid
+Aiur.NativeAIR.Challenger.State → Prop
+DEFINITION
+fun state =>
+  state.pending = [] ∨ ∃ consumed, state.input.length = 32 ∧ state.pending = List.drop consumed state.input.reverse
+PREMISE Aiur.NativeAIR.Challenger.FieldSample.accept
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {state : Aiur.NativeAIR.Challenger.State},
+  (Aiur.NativeAIR.Challenger.sampleWord hash state).fst < Aiur.gSize.toNat →
+    Aiur.NativeAIR.Challenger.FieldSample hash state 1
+      (Aiur.G.ofNat (Aiur.NativeAIR.Challenger.sampleWord hash state).fst)
+      (Aiur.NativeAIR.Challenger.sampleWord hash state).snd
+PREMISE Aiur.NativeAIR.Challenger.FieldSample.reject
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {state final : Aiur.NativeAIR.Challenger.State} {count : Nat}
+  {value : Aiur.G},
+  ¬(Aiur.NativeAIR.Challenger.sampleWord hash state).fst < Aiur.gSize.toNat →
+    Aiur.NativeAIR.Challenger.FieldSample hash (Aiur.NativeAIR.Challenger.sampleWord hash state).snd count value final →
+      Aiur.NativeAIR.Challenger.FieldSample hash state (count + 1) value final
+PREMISE Aiur.NativeAIR.Transcript.Replay.Reads.mk
+∀ {hash : Aiur.NativeAIR.Challenger.Hash32} {fuel : Nat} {key : Aiur.NativeAIR.KeyCodec.Key}
+  {proof : Aiur.NativeAIR.ProofCodec.Data} {claims : List (List Aiur.G)} {result : Aiur.NativeAIR.Transcript.Replay},
+  (∃ afterBeta afterGamma afterAlpha,
+      Aiur.NativeAIR.Challenger.sampleExtension hash fuel (Aiur.NativeAIR.Transcript.lookupState key proof claims) =
+          some (result.challenges.beta, afterBeta) ∧
+        Aiur.NativeAIR.Challenger.sampleExtension hash fuel
+              (Aiur.NativeAIR.Challenger.observeExtension afterBeta result.challenges.beta) =
+            some (result.challenges.gamma, afterGamma) ∧
+          Aiur.NativeAIR.Challenger.sampleExtension hash fuel
+                (Aiur.NativeAIR.Transcript.accumulatorState proof
+                  (Aiur.NativeAIR.Challenger.observeExtension afterGamma result.challenges.gamma)) =
+              some (result.challenges.alpha, afterAlpha) ∧
+            Aiur.NativeAIR.Challenger.sampleExtension hash fuel
+                (Aiur.NativeAIR.Challenger.observeCap afterAlpha proof.commitments.quotient) =
+              some (result.challenges.zeta, result.state)) →
+    Aiur.NativeAIR.Transcript.Replay.Reads hash fuel key proof claims result
+PREMISE Aiur.NativeAIR.Blake3.CV
+Type
+DEFINITION
+Vector UInt32 8
+PREMISE Aiur.NativeAIR.Blake3.Block
+Type
+DEFINITION
+Vector UInt32 16
+PREMISE Aiur.NativeAIR.Blake3.Digest
+Type
+DEFINITION
+Vector UInt8 32
+PREMISE Aiur.NativeAIR.Blake3.iv
+Aiur.NativeAIR.Blake3.CV
+DEFINITION
+#v[1779033703, 3144134277, 1013904242, 2773480762, 1359893119, 2600822924, 528734635, 1541459225]
+PREMISE Aiur.NativeAIR.Blake3.schedules
+Vector (Vector (Fin 16) 16) 7
+DEFINITION
+#v[#v[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], #v[2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8],
+  #v[3, 4, 10, 12, 13, 2, 7, 14, 6, 5, 9, 0, 11, 15, 8, 1], #v[10, 7, 12, 9, 14, 3, 13, 15, 4, 0, 11, 2, 5, 8, 1, 6],
+  #v[12, 13, 9, 11, 15, 10, 14, 8, 7, 2, 5, 3, 0, 1, 6, 4], #v[9, 14, 11, 5, 8, 12, 15, 1, 13, 3, 0, 10, 2, 6, 4, 7],
+  #v[11, 15, 5, 0, 1, 9, 8, 6, 14, 10, 2, 12, 3, 4, 7, 13]]
+PREMISE Aiur.NativeAIR.Blake3.rotateRight
+UInt32 → UInt32 → UInt32
+DEFINITION
+fun word count => word >>> count ||| word <<< (32 - count)
+PREMISE Aiur.NativeAIR.Blake3.mix
+UInt32 → UInt32 → UInt32 → UInt32 → UInt32 → UInt32 → Vector UInt32 4
+DEFINITION
+fun a b c d x y =>
+  let a_1 := a + b + x;
+  let d_1 := Aiur.NativeAIR.Blake3.rotateRight (d ^^^ a_1) 16;
+  let c_1 := c + d_1;
+  let b_1 := Aiur.NativeAIR.Blake3.rotateRight (b ^^^ c_1) 12;
+  let a_2 := a_1 + b_1 + y;
+  let d_2 := Aiur.NativeAIR.Blake3.rotateRight (d_1 ^^^ a_2) 8;
+  let c_2 := c_1 + d_2;
+  let b_2 := Aiur.NativeAIR.Blake3.rotateRight (b_1 ^^^ c_2) 7;
+  #v[a_2, b_2, c_2, d_2]
+PREMISE Aiur.NativeAIR.Blake3.g
+Aiur.NativeAIR.Blake3.Block → Fin 16 → Fin 16 → Fin 16 → Fin 16 → UInt32 → UInt32 → Aiur.NativeAIR.Blake3.Block
+DEFINITION
+fun state a b c d x y =>
+  have words := Aiur.NativeAIR.Blake3.mix state[a] state[b] state[c] state[d] x y;
+  (((Vector.set state (↑a) words[0] ⋯).set (↑b) words[1] ⋯).set (↑c) words[2] ⋯).set (↑d) words[3] ⋯
+PREMISE Aiur.NativeAIR.Blake3.round
+Aiur.NativeAIR.Blake3.Block → Aiur.NativeAIR.Blake3.Block → Vector (Fin 16) 16 → Aiur.NativeAIR.Blake3.Block
+DEFINITION
+fun state message schedule =>
+  have state := Aiur.NativeAIR.Blake3.g state 0 4 8 12 message[schedule[0]] message[schedule[1]];
+  have state := Aiur.NativeAIR.Blake3.g state 1 5 9 13 message[schedule[2]] message[schedule[3]];
+  have state := Aiur.NativeAIR.Blake3.g state 2 6 10 14 message[schedule[4]] message[schedule[5]];
+  have state := Aiur.NativeAIR.Blake3.g state 3 7 11 15 message[schedule[6]] message[schedule[7]];
+  have state := Aiur.NativeAIR.Blake3.g state 0 5 10 15 message[schedule[8]] message[schedule[9]];
+  have state := Aiur.NativeAIR.Blake3.g state 1 6 11 12 message[schedule[10]] message[schedule[11]];
+  have state := Aiur.NativeAIR.Blake3.g state 2 7 8 13 message[schedule[12]] message[schedule[13]];
+  Aiur.NativeAIR.Blake3.g state 3 4 9 14 message[schedule[14]] message[schedule[15]]
+PREMISE Aiur.NativeAIR.Blake3.initialWords
+Aiur.NativeAIR.Blake3.CV → UInt64 → UInt32 → UInt32 → Aiur.NativeAIR.Blake3.Block
+DEFINITION
+fun cv counter blockLen flags =>
+  #v[cv[0], cv[1], cv[2], cv[3], cv[4], cv[5], cv[6], cv[7], Aiur.NativeAIR.Blake3.iv[0], Aiur.NativeAIR.Blake3.iv[1],
+    Aiur.NativeAIR.Blake3.iv[2], Aiur.NativeAIR.Blake3.iv[3], counter.toUInt32, (counter >>> 32).toUInt32, blockLen,
+    flags]
+PREMISE Aiur.NativeAIR.Blake3.compress
+Aiur.NativeAIR.Blake3.CV → Aiur.NativeAIR.Blake3.Block → UInt64 → UInt32 → UInt32 → Aiur.NativeAIR.Blake3.CV
+DEFINITION
+fun cv message counter blockLen flags =>
+  have state :=
+    Vector.foldl (fun state schedule => Aiur.NativeAIR.Blake3.round state message schedule)
+      (Aiur.NativeAIR.Blake3.initialWords cv counter blockLen flags) Aiur.NativeAIR.Blake3.schedules;
+  Vector.ofFn fun index => state[↑index] ^^^ state[↑index + 8]
+PREMISE Aiur.NativeAIR.Blake3.wordBytes
+UInt32 → Vector UInt8 4
+DEFINITION
+fun word => Vector.ofFn fun index => (word.toNat / 256 ^ ↑index).toUInt8
+PREMISE Aiur.NativeAIR.Blake3.bytesWord
+Vector UInt8 4 → UInt32
+DEFINITION
+fun bytes => UInt32.ofNat (Aiur.NativeAIR.Challenger.littleEndian bytes.toList)
+PREMISE Aiur.NativeAIR.Blake3.blockWords
+List UInt8 → Aiur.NativeAIR.Blake3.Block
+DEFINITION
+fun bytes =>
+  have input := bytes.toArray;
+  Vector.ofFn fun word => Aiur.NativeAIR.Blake3.bytesWord (Vector.ofFn fun byte => input[↑word * 4 + ↑byte]?.getD 0)
+PREMISE Aiur.NativeAIR.Blake3.cvBytes
+Aiur.NativeAIR.Blake3.CV → Aiur.NativeAIR.Blake3.Digest
+DEFINITION
+fun cv => Vector.ofFn fun index => (Aiur.NativeAIR.Blake3.wordBytes cv[↑index / 4])[↑index % 4]
+PREMISE Aiur.NativeAIR.Blake3.Output.mk
+Aiur.NativeAIR.Blake3.CV → Aiur.NativeAIR.Blake3.Block → UInt32 → UInt64 → UInt32 → Aiur.NativeAIR.Blake3.Output
+PREMISE Aiur.NativeAIR.Blake3.Output.chainingValue
+Aiur.NativeAIR.Blake3.Output → Aiur.NativeAIR.Blake3.CV
+DEFINITION
+fun output => Aiur.NativeAIR.Blake3.compress output.cv output.block output.counter output.blockLen output.flags
+PREMISE Aiur.NativeAIR.Blake3.Output.rootHash
+Aiur.NativeAIR.Blake3.Output → Aiur.NativeAIR.Blake3.Digest
+DEFINITION
+fun output =>
+  Aiur.NativeAIR.Blake3.cvBytes
+    (Aiur.NativeAIR.Blake3.compress output.cv output.block 0 output.blockLen (output.flags ||| 8))
+PREMISE Aiur.NativeAIR.Blake3.chunkLoop
+UInt64 → Aiur.NativeAIR.Blake3.CV → Bool → List UInt8 → Aiur.NativeAIR.Blake3.Output
+DEFINITION
+fun counter cv start input => Aiur.NativeAIR.Blake3.chunkLoop._unary counter ⟨cv, ⟨start, input⟩⟩
+PREMISE Aiur.NativeAIR.Blake3.chunkOutput
+UInt64 → List UInt8 → Aiur.NativeAIR.Blake3.Output
+DEFINITION
+fun counter input => Aiur.NativeAIR.Blake3.chunkLoop counter Aiur.NativeAIR.Blake3.iv true input
+PREMISE Aiur.NativeAIR.Blake3.parentOutput
+Aiur.NativeAIR.Blake3.CV → Aiur.NativeAIR.Blake3.CV → Aiur.NativeAIR.Blake3.Output
+DEFINITION
+fun left right => { cv := Aiur.NativeAIR.Blake3.iv, block := left ++ right, blockLen := 64, counter := 0, flags := 4 }
+PREMISE Aiur.NativeAIR.Blake3.leftLen
+Nat → Nat
+DEFINITION
+fun size => 2 ^ (size - 1).log2
+PREMISE Aiur.NativeAIR.Blake3.subtree
+Nat → List UInt8 → Aiur.NativeAIR.Blake3.Output
+DEFINITION
+fun counter input => Aiur.NativeAIR.Blake3.subtree._unary ⟨counter, input⟩
+PREMISE Aiur.NativeAIR.Blake3.digest
+List UInt8 → Aiur.NativeAIR.Blake3.Digest
+DEFINITION
+fun input => (Aiur.NativeAIR.Blake3.subtree 0 input).rootHash
+PREMISE Aiur.NativeAIR.Blake3.hash
+Aiur.NativeAIR.Challenger.Hash32
+DEFINITION
+fun input =>
+  have bytes := Aiur.NativeAIR.Blake3.digest input;
+  fun index => bytes[index]
+PREMISE Aiur.NativeAIR.Blake3.NativeInput
+List UInt8 → Prop
+DEFINITION
+fun input => input.length < 2 ^ 64
+PREMISE Aiur.NativeAIR.Blake3.replay
+Nat →
+  Aiur.NativeAIR.KeyCodec.Key →
+    Aiur.NativeAIR.ProofCodec.Data → List (List Aiur.G) → Option Aiur.NativeAIR.Transcript.Replay
+DEFINITION
+fun fuel key proof claims => Aiur.NativeAIR.Transcript.replay Aiur.NativeAIR.Blake3.hash fuel key proof claims
+PREMISE Aiur.NativeAIR.Blake3.verifyArithmetic
+Nat →
+  Aiur.NativeAIR.KeyCodec.Key →
+    Aiur.NativeAIR.ProofCodec.Data →
+      List (List Aiur.G) → List Aiur.NativeAIR.ProofShape.Row → Option Aiur.NativeAIR.Transcript.Replay
+DEFINITION
+fun fuel key proof claims rows =>
+  Aiur.NativeAIR.Transcript.verifyArithmetic Aiur.NativeAIR.Blake3.hash fuel key proof claims rows
+PREMISE Aiur.NativeAIR.Blake3.ChunkReads.last
+∀ {counter : UInt64} (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8),
+  input.length ≤ 64 →
+    Aiur.NativeAIR.Blake3.ChunkReads counter cv start input
+      { cv := cv, block := Aiur.NativeAIR.Blake3.blockWords input, blockLen := input.length.toUInt32,
+        counter := counter, flags := (if start = true then 1 else 0) ||| 2 }
+PREMISE Aiur.NativeAIR.Blake3.ChunkReads.step
+∀ {counter : UInt64} (cv : Aiur.NativeAIR.Blake3.CV) (start : Bool) (input : List UInt8)
+  (output : Aiur.NativeAIR.Blake3.Output),
+  64 < input.length →
+    Aiur.NativeAIR.Blake3.ChunkReads counter
+        (Aiur.NativeAIR.Blake3.compress cv (Aiur.NativeAIR.Blake3.blockWords (List.take 64 input)) counter 64
+          (if start = true then 1 else 0))
+        false (List.drop 64 input) output →
+      Aiur.NativeAIR.Blake3.ChunkReads counter cv start input output
+PREMISE Aiur.NativeAIR.Blake3.TreeHash.chunk
+∀ (counter : Nat) (input : List UInt8) (output : Aiur.NativeAIR.Blake3.Output),
+  input.length ≤ 1024 →
+    Aiur.NativeAIR.Blake3.ChunkReads counter.toUInt64 Aiur.NativeAIR.Blake3.iv true input output →
+      Aiur.NativeAIR.Blake3.TreeHash counter input output
+PREMISE Aiur.NativeAIR.Blake3.TreeHash.parent
+∀ (counter exponent : Nat) (left right : List UInt8) (leftOutput rightOutput : Aiur.NativeAIR.Blake3.Output),
+  left.length = 1024 * 2 ^ exponent →
+    0 < right.length →
+      right.length ≤ left.length →
+        Aiur.NativeAIR.Blake3.TreeHash counter left leftOutput →
+          Aiur.NativeAIR.Blake3.TreeHash (counter + left.length / 1024) right rightOutput →
+            Aiur.NativeAIR.Blake3.TreeHash counter (left ++ right)
+              (Aiur.NativeAIR.Blake3.parentOutput leftOutput.chainingValue rightOutput.chainingValue)
+PREMISE Aiur.NativeAIR.Blake3.ChunkAt.leaf
+∀ (counter : Nat) (input : List UInt8), input.length ≤ 1024 → Aiur.NativeAIR.Blake3.ChunkAt counter input counter input
+PREMISE Aiur.NativeAIR.Blake3.ChunkAt.left
+∀ {counter leaf : Nat} {input bytes : List UInt8},
+  1024 < input.length →
+    Aiur.NativeAIR.Blake3.ChunkAt counter (List.take (Aiur.NativeAIR.Blake3.leftLen input.length) input) leaf bytes →
+      Aiur.NativeAIR.Blake3.ChunkAt counter input leaf bytes
+PREMISE Aiur.NativeAIR.Blake3.ChunkAt.right
+∀ {counter leaf : Nat} {input bytes : List UInt8},
+  1024 < input.length →
+    Aiur.NativeAIR.Blake3.ChunkAt (counter + Aiur.NativeAIR.Blake3.leftLen input.length / 1024)
+        (List.drop (Aiur.NativeAIR.Blake3.leftLen input.length) input) leaf bytes →
+      Aiur.NativeAIR.Blake3.ChunkAt counter input leaf bytes
+PREMISE Aiur.NativeAIR.MerkleCap.maxDegree
+List Nat → Nat
+DEFINITION
+fun degrees => List.foldr max 0 degrees
+PREMISE Aiur.NativeAIR.MerkleCap.coverage
+Nat → Nat → List Nat → Bool
+DEFINITION
+fun logBlowup capHeight degrees =>
+  have effective := min (capHeight - logBlowup) (Aiur.NativeAIR.MerkleCap.maxDegree degrees);
+  degrees.all fun degree => decide (effective ≤ degree)
+PREMISE Aiur.NativeAIR.MerkleCap.check
+Aiur.NativeAIR.KeyCodec.Key → Aiur.NativeAIR.ProofCodec.Data → Bool
+DEFINITION
+fun key proof =>
+  Aiur.NativeAIR.MerkleCap.coverage key.parameters.logBlowup key.parameters.capHeight
+    (List.map UInt8.toNat proof.logDegrees)
+PREMISE Aiur.NativeAIR.Merkle.Digest
+Type
+DEFINITION
+Aiur.NativeAIR.Blake3.Digest
+PREMISE Aiur.NativeAIR.Merkle.Hash
+Type
+DEFINITION
+List UInt8 → Aiur.NativeAIR.Merkle.Digest
+PREMISE Aiur.NativeAIR.Merkle.Dimensions.mk
+Nat → Nat → Aiur.NativeAIR.Merkle.Dimensions
+PREMISE Aiur.NativeAIR.Merkle.maxHeight
+List Aiur.NativeAIR.Merkle.Dimensions → Nat
+DEFINITION
+fun dimensions => Aiur.NativeAIR.MerkleCap.maxDegree (List.map Aiur.NativeAIR.Merkle.Dimensions.logHeight dimensions)
+PREMISE Aiur.NativeAIR.Merkle.shape
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.G) → Bool
+DEFINITION
+fun x x_1 => List.brecOn (motive := fun x => List (List Aiur.G) → Bool) x Aiur.NativeAIR.Merkle.shape._f x_1
+PREMISE Aiur.NativeAIR.Merkle.hasHeight
+List Aiur.NativeAIR.Merkle.Dimensions → Nat → Bool
+DEFINITION
+fun dimensions height => dimensions.any fun dimension => dimension.logHeight == height
+PREMISE Aiur.NativeAIR.Merkle.rowsAt
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.G) → Nat → List (List Aiur.G)
+DEFINITION
+fun x x_1 x_2 =>
+  List.brecOn (motive := fun x => List (List Aiur.G) → Nat → List (List Aiur.G)) x Aiur.NativeAIR.Merkle.rowsAt._f x_1
+    x_2
+PREMISE Aiur.NativeAIR.Merkle.rowBytes
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.G) → Nat → List UInt8
+DEFINITION
+fun dimensions rows height =>
+  Aiur.NativeAIR.Transcript.fieldsBytes (Aiur.NativeAIR.Merkle.rowsAt dimensions rows height).flatten
+PREMISE Aiur.NativeAIR.Merkle.pairBytes
+Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Digest → List UInt8
+DEFINITION
+fun left right => Vector.toList left ++ Vector.toList right
+PREMISE Aiur.NativeAIR.Merkle.branchBytes
+Nat → Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Digest → List UInt8
+DEFINITION
+fun index current sibling =>
+  if index % 2 = 0 then Aiur.NativeAIR.Merkle.pairBytes current sibling
+  else Aiur.NativeAIR.Merkle.pairBytes sibling current
+PREMISE Aiur.NativeAIR.Merkle.Hashing.mk
+Aiur.NativeAIR.Merkle.Digest → List (List UInt8) → Aiur.NativeAIR.Merkle.Hashing
+PREMISE Aiur.NativeAIR.Merkle.step
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    List (List Aiur.G) →
+      Nat → Nat → Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Hashing
+DEFINITION
+fun hash dimensions rows height index current sibling =>
+  have input := Aiur.NativeAIR.Merkle.branchBytes index current sibling;
+  have parent := hash input;
+  if Aiur.NativeAIR.Merkle.hasHeight dimensions height = true then
+    have leaf := Aiur.NativeAIR.Merkle.rowBytes dimensions rows height;
+    have inject := Aiur.NativeAIR.Merkle.pairBytes parent (hash leaf);
+    { digest := hash inject, inputs := [input, leaf, inject] }
+  else { digest := parent, inputs := [input] }
+PREMISE Aiur.NativeAIR.Merkle.walk
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    List (List Aiur.G) →
+      Nat → Nat → Aiur.NativeAIR.Merkle.Digest → List Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Hashing
+DEFINITION
+fun hash dimensions rows height index current x =>
+  List.brecOn (motive := fun x => Nat → Nat → Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Hashing) x
+    (Aiur.NativeAIR.Merkle.walk._f hash dimensions rows) height index current
+PREMISE Aiur.NativeAIR.Merkle.Replay.mk
+Nat → Nat → Aiur.NativeAIR.Merkle.Hashing → Aiur.NativeAIR.Merkle.Replay
+PREMISE Aiur.NativeAIR.Merkle.replay
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat → Nat → List (List Aiur.G) → List Aiur.NativeAIR.Merkle.Digest → Option Aiur.NativeAIR.Merkle.Replay
+DEFINITION
+fun hash dimensions capHeight index rows proof =>
+  have height := Aiur.NativeAIR.Merkle.maxHeight dimensions;
+  if
+      (dimensions.isEmpty || !Aiur.NativeAIR.Merkle.shape dimensions rows || proof.length != height - capHeight ||
+          !decide (index < 2 ^ height)) =
+        true then
+    none
+  else
+    have leaf := Aiur.NativeAIR.Merkle.rowBytes dimensions rows height;
+    have result := Aiur.NativeAIR.Merkle.walk hash dimensions rows height index (hash leaf) proof;
+    some
+      { logHeight := height - proof.length, index := index / 2 ^ proof.length,
+        hashing := { digest := result.digest, inputs := leaf :: result.inputs } }
+PREMISE Aiur.NativeAIR.Merkle.accepts
+List Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Replay → Bool
+DEFINITION
+fun cap result => cap[result.index]? == some result.hashing.digest
+PREMISE Aiur.NativeAIR.Merkle.verify
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat → Nat → List Aiur.NativeAIR.Merkle.Digest → List (List Aiur.G) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash dimensions capHeight index cap rows proof =>
+  match Aiur.NativeAIR.Merkle.replay hash dimensions capHeight index rows proof with
+  | none => false
+  | some result => Aiur.NativeAIR.Merkle.accepts cap result
+PREMISE Aiur.NativeAIR.Merkle.covered
+List Aiur.NativeAIR.Merkle.Dimensions → Nat → Bool
+DEFINITION
+fun dimensions capHeight =>
+  Aiur.NativeAIR.MerkleCap.coverage 0 capHeight (List.map Aiur.NativeAIR.Merkle.Dimensions.logHeight dimensions)
+PREMISE Aiur.NativeAIR.Merkle.verifyCovered
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat → Nat → List Aiur.NativeAIR.Merkle.Digest → List (List Aiur.G) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash dimensions capHeight index cap rows proof =>
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight &&
+    Aiur.NativeAIR.Merkle.verify hash dimensions capHeight index cap rows proof
+PREMISE Aiur.NativeAIR.Merkle.CollisionOn
+Aiur.NativeAIR.Merkle.Hash → List (List UInt8) → Prop
+DEFINITION
+fun hash inputs => ∃ left, left ∈ inputs ∧ ∃ right, right ∈ inputs ∧ left ≠ right ∧ hash left = hash right
+PREMISE Aiur.NativeAIR.PrunedMerkle.Logged.mk
+{α : Type} → Option α → List (List UInt8) → Aiur.NativeAIR.PrunedMerkle.Logged α
+PREMISE Aiur.NativeAIR.PrunedMerkle.Logged.pure
+{α : Type} → α → Aiur.NativeAIR.PrunedMerkle.Logged α
+DEFINITION
+fun {α} value => { result := some value, inputs := [] }
+PREMISE Aiur.NativeAIR.PrunedMerkle.Logged.bind
+{α β : Type} →
+  Aiur.NativeAIR.PrunedMerkle.Logged α →
+    (α → Aiur.NativeAIR.PrunedMerkle.Logged β) → Aiur.NativeAIR.PrunedMerkle.Logged β
+DEFINITION
+fun {α β} first next =>
+  match first.result with
+  | none => { result := none, inputs := first.inputs }
+  | some value =>
+    have rest := next value;
+    { result := rest.result, inputs := first.inputs ++ rest.inputs }
+PREMISE Aiur.NativeAIR.PrunedMerkle.reject
+{α : Type} → Aiur.NativeAIR.PrunedMerkle.Logged α
+DEFINITION
+fun {α} => { result := none, inputs := [] }
+PREMISE Aiur.NativeAIR.PrunedMerkle.ofOption
+{α : Type} → Option α → Aiur.NativeAIR.PrunedMerkle.Logged α
+DEFINITION
+fun {α} value => { result := value, inputs := [] }
+PREMISE Aiur.NativeAIR.PrunedMerkle.hashInput
+Aiur.NativeAIR.Merkle.Hash → List UInt8 → Aiur.NativeAIR.PrunedMerkle.Logged Aiur.NativeAIR.Merkle.Digest
+DEFINITION
+fun hash input => { result := some (hash input), inputs := [input] }
+PREMISE Aiur.NativeAIR.PrunedMerkle.Ticket.mk
+Nat → List (List Aiur.G) → List Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.PrunedMerkle.Ticket
+PREMISE Aiur.NativeAIR.PrunedMerkle.Ticket.extend
+Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.PrunedMerkle.Ticket → Aiur.NativeAIR.PrunedMerkle.Ticket
+DEFINITION
+fun sibling ticket => { index := ticket.index, rows := ticket.rows, proof := ticket.proof ++ [sibling] }
+PREMISE Aiur.NativeAIR.PrunedMerkle.Node.mk
+Nat → Aiur.NativeAIR.Merkle.Digest → List Aiur.NativeAIR.PrunedMerkle.Ticket → Aiur.NativeAIR.PrunedMerkle.Node
+PREMISE Aiur.NativeAIR.PrunedMerkle.uniqueIndices
+List Nat → List Nat
+DEFINITION
+fun indices => (indices.mergeSort fun x1 x2 => decide (x1 ≤ x2)).eraseDups
+PREMISE Aiur.NativeAIR.PrunedMerkle.parentIndices
+List Nat → List Nat
+DEFINITION
+fun indices => (List.map (fun x => x / 2) indices).eraseDups
+PREMISE Aiur.NativeAIR.PrunedMerkle.boundaryCount
+Nat → List Nat → Nat
+DEFINITION
+fun x x_1 => Nat.brecOn (motive := fun x => List Nat → Nat) x Aiur.NativeAIR.PrunedMerkle.boundaryCount._f x_1
+PREMISE Aiur.NativeAIR.PrunedMerkle.representatives
+List Nat → List (List (List Aiur.G)) → Option (List Aiur.NativeAIR.PrunedMerkle.Ticket)
+DEFINITION
+fun indices rows =>
+  have originals := indices.zip rows;
+  List.mapM
+    (fun index => do
+      let __x ← List.find? (fun entry => entry.fst == index) originals
+      match __x with
+        | (fst, values) =>
+          if (originals.all fun entry => entry.fst != index || entry.snd == values) = true then
+            some { index := index, rows := values, proof := [] }
+          else none)
+    (Aiur.NativeAIR.PrunedMerkle.uniqueIndices indices)
+PREMISE Aiur.NativeAIR.PrunedMerkle.initial
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Aiur.NativeAIR.PrunedMerkle.Ticket →
+        Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node)
+DEFINITION
+fun hash dimensions height x => List.brecOn x (Aiur.NativeAIR.PrunedMerkle.initial._f hash dimensions height)
+PREMISE Aiur.NativeAIR.PrunedMerkle.combine
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.PrunedMerkle.Node →
+    List Aiur.NativeAIR.Merkle.Digest →
+      Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node × List Aiur.NativeAIR.Merkle.Digest)
+DEFINITION
+fun hash a a_1 => Aiur.NativeAIR.PrunedMerkle.combine._unary hash ⟨a, a_1⟩
+PREMISE Aiur.NativeAIR.PrunedMerkle.inject
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Aiur.NativeAIR.PrunedMerkle.Node → Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node)
+DEFINITION
+fun hash dimensions height x => List.brecOn x (Aiur.NativeAIR.PrunedMerkle.inject._f hash dimensions height)
+PREMISE Aiur.NativeAIR.PrunedMerkle.walk
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      Nat →
+        List Aiur.NativeAIR.PrunedMerkle.Node →
+          List Aiur.NativeAIR.Merkle.Digest →
+            Aiur.NativeAIR.PrunedMerkle.Logged
+              (List Aiur.NativeAIR.PrunedMerkle.Node × List Aiur.NativeAIR.Merkle.Digest)
+DEFINITION
+fun hash dimensions x x_1 x_2 x_3 =>
+  Nat.brecOn (motive := fun x =>
+    Nat →
+      List Aiur.NativeAIR.PrunedMerkle.Node →
+        List Aiur.NativeAIR.Merkle.Digest →
+          Aiur.NativeAIR.PrunedMerkle.Logged
+            (List Aiur.NativeAIR.PrunedMerkle.Node × List Aiur.NativeAIR.Merkle.Digest))
+    x (Aiur.NativeAIR.PrunedMerkle.walk._f hash dimensions) x_1 x_2 x_3
+PREMISE Aiur.NativeAIR.PrunedMerkle.replay
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Nat →
+        List (List (List Aiur.G)) →
+          List Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node)
+DEFINITION
+fun hash dimensions capHeight indices rows proof =>
+  if (dimensions.isEmpty || rows.length != indices.length) = true then Aiur.NativeAIR.PrunedMerkle.reject
+  else
+    have height := Aiur.NativeAIR.Merkle.maxHeight dimensions;
+    have steps := height - capHeight;
+    if (!indices.all fun index => decide (index < 2 ^ height)) = true then Aiur.NativeAIR.PrunedMerkle.reject
+    else do
+      let tickets ← Aiur.NativeAIR.PrunedMerkle.ofOption (Aiur.NativeAIR.PrunedMerkle.representatives indices rows)
+      if
+            (proof.length !=
+                  Aiur.NativeAIR.PrunedMerkle.boundaryCount steps (Aiur.NativeAIR.PrunedMerkle.uniqueIndices indices) ||
+                !tickets.all fun ticket => Aiur.NativeAIR.Merkle.shape dimensions ticket.rows) =
+              true then
+          Aiur.NativeAIR.PrunedMerkle.reject
+        else do
+          let leaves ← Aiur.NativeAIR.PrunedMerkle.initial hash dimensions height tickets
+          let __x ← Aiur.NativeAIR.PrunedMerkle.walk hash dimensions steps height leaves proof
+          match __x with
+            | (nodes, remaining) => if remaining.isEmpty = true then pure nodes else Aiur.NativeAIR.PrunedMerkle.reject
+PREMISE Aiur.NativeAIR.PrunedMerkle.accepts
+List Aiur.NativeAIR.Merkle.Digest → List Aiur.NativeAIR.PrunedMerkle.Node → Bool
+DEFINITION
+fun cap nodes => nodes.all fun node => cap[node.index]? == some node.digest
+PREMISE Aiur.NativeAIR.PrunedMerkle.verify
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Nat →
+        List Aiur.NativeAIR.Merkle.Digest → List (List (List Aiur.G)) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash dimensions capHeight indices cap rows proof =>
+  match (Aiur.NativeAIR.PrunedMerkle.replay hash dimensions capHeight indices rows proof).result with
+  | none => false
+  | some nodes => Aiur.NativeAIR.PrunedMerkle.accepts cap nodes
+PREMISE Aiur.NativeAIR.PrunedMerkle.verifyCovered
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Nat →
+        List Aiur.NativeAIR.Merkle.Digest → List (List (List Aiur.G)) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash dimensions capHeight indices cap rows proof =>
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight &&
+    Aiur.NativeAIR.PrunedMerkle.verify hash dimensions capHeight indices cap rows proof
+PREMISE Aiur.NativeAIR.PrunedMerkle.TicketAt.mk
+∀ {hash : Aiur.NativeAIR.Merkle.Hash} {dimensions : List Aiur.NativeAIR.Merkle.Dimensions} {height index : Nat}
+  {digest : Aiur.NativeAIR.Merkle.Digest} {inputs : List (List UInt8)} {ticket : Aiur.NativeAIR.PrunedMerkle.Ticket},
+  Aiur.NativeAIR.Merkle.shape dimensions ticket.rows = true →
+    ticket.index < 2 ^ Aiur.NativeAIR.Merkle.maxHeight dimensions →
+      ticket.proof.length + height = Aiur.NativeAIR.Merkle.maxHeight dimensions →
+        ticket.index / 2 ^ ticket.proof.length = index →
+          (Aiur.NativeAIR.Merkle.walk hash dimensions ticket.rows (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                  ticket.index
+                  (hash
+                    (Aiur.NativeAIR.Merkle.rowBytes dimensions ticket.rows
+                      (Aiur.NativeAIR.Merkle.maxHeight dimensions)))
+                  ticket.proof).digest =
+              digest →
+            Aiur.NativeAIR.Merkle.rowBytes dimensions ticket.rows (Aiur.NativeAIR.Merkle.maxHeight dimensions) ::
+                  (Aiur.NativeAIR.Merkle.walk hash dimensions ticket.rows (Aiur.NativeAIR.Merkle.maxHeight dimensions)
+                      ticket.index
+                      (hash
+                        (Aiur.NativeAIR.Merkle.rowBytes dimensions ticket.rows
+                          (Aiur.NativeAIR.Merkle.maxHeight dimensions)))
+                      ticket.proof).inputs ⊆
+                inputs →
+              Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height index digest inputs ticket
+PREMISE Aiur.NativeAIR.PrunedMerkle.NodeAt
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions → Nat → List (List UInt8) → Aiur.NativeAIR.PrunedMerkle.Node → Prop
+DEFINITION
+fun hash dimensions height inputs node =>
+  ∀ (ticket : Aiur.NativeAIR.PrunedMerkle.Ticket),
+    ticket ∈ node.tickets →
+      Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions height node.index node.digest inputs ticket
+PREMISE Aiur.NativeAIR.PrunedMerkle.PendingAt
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat → Nat → Aiur.NativeAIR.Merkle.Digest → List (List UInt8) → Aiur.NativeAIR.PrunedMerkle.Ticket → Prop
+DEFINITION
+fun hash dimensions height index digest inputs ticket =>
+  ∃ before sibling previousIndex previousDigest,
+    ticket = Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling before ∧
+      Aiur.NativeAIR.PrunedMerkle.TicketAt hash dimensions (height + 1) previousIndex previousDigest inputs before ∧
+        index = previousIndex / 2 ∧
+          digest = hash (Aiur.NativeAIR.Merkle.branchBytes previousIndex previousDigest sibling) ∧
+            Aiur.NativeAIR.Merkle.branchBytes previousIndex previousDigest sibling ∈ inputs
+PREMISE Aiur.NativeAIR.PrunedMerkle.PendingNode
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions → Nat → List (List UInt8) → Aiur.NativeAIR.PrunedMerkle.Node → Prop
+DEFINITION
+fun hash dimensions height inputs node =>
+  ∀ (ticket : Aiur.NativeAIR.PrunedMerkle.Ticket),
+    ticket ∈ node.tickets →
+      Aiur.NativeAIR.PrunedMerkle.PendingAt hash dimensions height node.index node.digest inputs ticket
+PREMISE Aiur.NativeAIR.PrunedMerkle.origins
+List Aiur.NativeAIR.PrunedMerkle.Node → List (Nat × List (List Aiur.G))
+DEFINITION
+fun nodes => List.flatMap (fun node => List.map (fun ticket => (ticket.index, ticket.rows)) node.tickets) nodes
+PREMISE Aiur.NativeAIR.PrunedMerkle.instMonadLogged
+Monad Aiur.NativeAIR.PrunedMerkle.Logged
+DEFINITION
+{
+  map := fun {α β} f x =>
+    (fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind) x ((fun {α} => Aiur.NativeAIR.PrunedMerkle.Logged.pure) ∘ f),
+  pure := fun {α} => Aiur.NativeAIR.PrunedMerkle.Logged.pure,
+  seq := fun {α β} f x =>
+    (fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind) f fun y =>
+      (fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind) (x ())
+        ((fun {α} => Aiur.NativeAIR.PrunedMerkle.Logged.pure) ∘ y),
+  seqLeft := fun {α β} x y =>
+    (fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind) x fun a =>
+      (fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind) (y ()) fun x =>
+        (fun {α} => Aiur.NativeAIR.PrunedMerkle.Logged.pure) a,
+  seqRight := fun {α β} x y => (fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind) x fun x => y (),
+  bind := fun {α β} => Aiur.NativeAIR.PrunedMerkle.Logged.bind }
+PREMISE Aiur.NativeAIR.ExtensionMmcs.baseRow
+List Aiur.NativeAIR.ProofCodec.Extension → List Aiur.G
+DEFINITION
+fun values => List.flatMap (fun value => [value.c0, value.c1]) values
+PREMISE Aiur.NativeAIR.ExtensionMmcs.baseRows
+List (List Aiur.NativeAIR.ProofCodec.Extension) → List (List Aiur.G)
+DEFINITION
+fun rows => List.map Aiur.NativeAIR.ExtensionMmcs.baseRow rows
+PREMISE Aiur.NativeAIR.ExtensionMmcs.baseDimensions
+Nat → List Aiur.NativeAIR.Merkle.Dimensions → List Aiur.NativeAIR.Merkle.Dimensions
+DEFINITION
+fun wordBits dimensions =>
+  List.map (fun dimension => { width := dimension.width * 2 % 2 ^ wordBits, logHeight := dimension.logHeight })
+    dimensions
+PREMISE Aiur.NativeAIR.ExtensionMmcs.WidthsFit
+Nat → List Aiur.NativeAIR.Merkle.Dimensions → Prop
+DEFINITION
+fun wordBits dimensions =>
+  ∀ (dimension : Aiur.NativeAIR.Merkle.Dimensions), dimension ∈ dimensions → dimension.width * 2 < 2 ^ wordBits
+PREMISE Aiur.NativeAIR.ExtensionMmcs.shape
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.NativeAIR.ProofCodec.Extension) → Bool
+DEFINITION
+fun x x_1 =>
+  List.brecOn (motive := fun x => List (List Aiur.NativeAIR.ProofCodec.Extension) → Bool) x
+    Aiur.NativeAIR.ExtensionMmcs.shape._f x_1
+PREMISE Aiur.NativeAIR.ExtensionMmcs.replay
+Aiur.NativeAIR.Merkle.Hash →
+  Nat →
+    List Aiur.NativeAIR.Merkle.Dimensions →
+      Nat →
+        Nat →
+          List (List Aiur.NativeAIR.ProofCodec.Extension) →
+            List Aiur.NativeAIR.Merkle.Digest → Option Aiur.NativeAIR.Merkle.Replay
+DEFINITION
+fun hash wordBits dimensions capHeight index rows proof =>
+  Aiur.NativeAIR.Merkle.replay hash (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) capHeight index
+    (Aiur.NativeAIR.ExtensionMmcs.baseRows rows) proof
+PREMISE Aiur.NativeAIR.ExtensionMmcs.verify
+Aiur.NativeAIR.Merkle.Hash →
+  Nat →
+    List Aiur.NativeAIR.Merkle.Dimensions →
+      Nat →
+        Nat →
+          List Aiur.NativeAIR.Merkle.Digest →
+            List (List Aiur.NativeAIR.ProofCodec.Extension) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash wordBits dimensions capHeight index cap rows proof =>
+  Aiur.NativeAIR.Merkle.verify hash (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) capHeight index
+    cap (Aiur.NativeAIR.ExtensionMmcs.baseRows rows) proof
+PREMISE Aiur.NativeAIR.ExtensionMmcs.verifyCovered
+Aiur.NativeAIR.Merkle.Hash →
+  Nat →
+    List Aiur.NativeAIR.Merkle.Dimensions →
+      Nat →
+        Nat →
+          List Aiur.NativeAIR.Merkle.Digest →
+            List (List Aiur.NativeAIR.ProofCodec.Extension) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash wordBits dimensions capHeight index cap rows proof =>
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight &&
+    Aiur.NativeAIR.ExtensionMmcs.verify hash wordBits dimensions capHeight index cap rows proof
+PREMISE Aiur.NativeAIR.ExtensionMmcs.replayMulti
+Aiur.NativeAIR.Merkle.Hash →
+  Nat →
+    List Aiur.NativeAIR.Merkle.Dimensions →
+      Nat →
+        List Nat →
+          List (List (List Aiur.NativeAIR.ProofCodec.Extension)) →
+            List Aiur.NativeAIR.Merkle.Digest →
+              Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node)
+DEFINITION
+fun hash wordBits dimensions capHeight indices rows proof =>
+  Aiur.NativeAIR.PrunedMerkle.replay hash (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) capHeight
+    indices (List.map Aiur.NativeAIR.ExtensionMmcs.baseRows rows) proof
+PREMISE Aiur.NativeAIR.ExtensionMmcs.verifyMulti
+Aiur.NativeAIR.Merkle.Hash →
+  Nat →
+    List Aiur.NativeAIR.Merkle.Dimensions →
+      Nat →
+        List Nat →
+          List Aiur.NativeAIR.Merkle.Digest →
+            List (List (List Aiur.NativeAIR.ProofCodec.Extension)) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash wordBits dimensions capHeight indices cap rows proof =>
+  Aiur.NativeAIR.PrunedMerkle.verify hash (Aiur.NativeAIR.ExtensionMmcs.baseDimensions wordBits dimensions) capHeight
+    indices cap (List.map Aiur.NativeAIR.ExtensionMmcs.baseRows rows) proof
+PREMISE Aiur.NativeAIR.ExtensionMmcs.verifyMultiCovered
+Aiur.NativeAIR.Merkle.Hash →
+  Nat →
+    List Aiur.NativeAIR.Merkle.Dimensions →
+      Nat →
+        List Nat →
+          List Aiur.NativeAIR.Merkle.Digest →
+            List (List (List Aiur.NativeAIR.ProofCodec.Extension)) → List Aiur.NativeAIR.Merkle.Digest → Bool
+DEFINITION
+fun hash wordBits dimensions capHeight indices cap rows proof =>
+  Aiur.NativeAIR.Merkle.covered dimensions capHeight &&
+    Aiur.NativeAIR.ExtensionMmcs.verifyMulti hash wordBits dimensions capHeight indices cap rows proof
+PREMISE Aiur.NativeAIR.FriDomain.reverseBits
+Nat → Nat → Nat
+DEFINITION
+fun bits index => (BitVec.ofNat bits index).reverse.toNat
+PREMISE Aiur.NativeAIR.FriDomain.wordReverse
+Nat → Nat → Nat → Nat
+DEFINITION
+fun wordBits bits index => ((BitVec.ofNat wordBits index).reverse >>> ((wordBits - bits) % wordBits)).toNat
+PREMISE Aiur.NativeAIR.FriDomain.queryPoint
+Aiur.NativeAIR.Domain.Subgroup → Nat → Aiur.G
+DEFINITION
+fun domain index => (Aiur.NativeAIR.Domain.generator domain).pow (Aiur.NativeAIR.FriDomain.reverseBits (↑domain) index)
+PREMISE Aiur.NativeAIR.FriDomain.inputPoint
+Aiur.NativeAIR.Domain.Subgroup → Nat → Aiur.G
+DEFINITION
+fun domain index => 7 * Aiur.NativeAIR.FriDomain.queryPoint domain index
+PREMISE Aiur.NativeAIR.FriDomain.foldNode
+Aiur.NativeAIR.Domain.Subgroup → Aiur.NativeAIR.Domain.Subgroup → Nat → Nat → Aiur.G
+DEFINITION
+fun parent arity index slot =>
+  (Aiur.NativeAIR.Domain.generator parent).pow (Aiur.NativeAIR.FriDomain.reverseBits (↑parent - ↑arity) index) *
+    (Aiur.NativeAIR.Domain.generator arity).pow (Aiur.NativeAIR.FriDomain.reverseBits (↑arity) slot)
+PREMISE Aiur.NativeAIR.Polynomial.IsZero
+{R : Type u_1} → [OfNat R 0] → List R → Prop
+DEFINITION
+fun {R} [OfNat R 0] coefficients => ∀ (coefficient : R), coefficient ∈ coefficients → coefficient = 0
+PREMISE Aiur.NativeAIR.Polynomial.Monic
+{R : Type u_1} → [OfNat R 1] → List R → Prop
+DEFINITION
+fun {R} [OfNat R 1] coefficients => ∃ initial, coefficients = initial ++ [1]
+PREMISE Aiur.NativeAIR.Polynomial.add
+{R : Type u_1} → [Add R] → List R → List R → List R
+DEFINITION
+fun {R} [Add R] x x_1 => List.brecOn (motive := fun x => List R → List R) x Aiur.NativeAIR.Polynomial.add._f x_1
+PREMISE Aiur.NativeAIR.Polynomial.sub
+{R : Type u_1} → [OfNat R 0] → [Sub R] → List R → List R → List R
+DEFINITION
+fun {R} [OfNat R 0] [Sub R] x x_1 =>
+  List.brecOn (motive := fun x => List R → List R) x Aiur.NativeAIR.Polynomial.sub._f x_1
+PREMISE Aiur.NativeAIR.Polynomial.scale
+{R : Type u_1} → [Mul R] → R → List R → List R
+DEFINITION
+fun {R} [Mul R] scalar coefficients => List.map (fun x => scalar * x) coefficients
+PREMISE Aiur.NativeAIR.Polynomial.mulLinear
+{R : Type u_1} → [OfNat R 0] → [Sub R] → [Mul R] → R → List R → List R
+DEFINITION
+fun {R} [OfNat R 0] [Sub R] [Mul R] root coefficients =>
+  Aiur.NativeAIR.Polynomial.sub (0 :: coefficients) (Aiur.NativeAIR.Polynomial.scale root coefficients)
+PREMISE Aiur.NativeAIR.Polynomial.fromRoots
+{R : Type u_1} → [OfNat R 0] → [OfNat R 1] → [Sub R] → [Mul R] → List R → List R
+DEFINITION
+fun {R} [OfNat R 0] [OfNat R 1] [Sub R] [Mul R] roots => List.foldr Aiur.NativeAIR.Polynomial.mulLinear [1] roots
+PREMISE Aiur.NativeAIR.Polynomial.powerMinus
+{R : Type u_1} → [OfNat R 0] → [OfNat R 1] → [Sub R] → Nat → R → List R
+DEFINITION
+fun {R} [OfNat R 0] [OfNat R 1] [Sub R] degree constant =>
+  Aiur.NativeAIR.Polynomial.sub (List.replicate degree 0 ++ [1]) [constant]
+PREMISE Aiur.NativeAIR.Polynomial.divide
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → R → List R → List R
+DEFINITION
+fun {R} [OfNat R 0] [Add R] [Mul R] point x => List.brecOn x (Aiur.NativeAIR.Polynomial.divide._f point)
+PREMISE Aiur.NativeAIR.Polynomial.foldingNodes
+Aiur.NativeAIR.Domain.Subgroup → Aiur.NativeAIR.Domain.Subgroup → Nat → List Aiur.G
+DEFINITION
+fun parent arity index =>
+  List.map (Aiur.NativeAIR.FriDomain.foldNode parent arity index) (List.range (Aiur.NativeAIR.Domain.size arity))
+PREMISE Aiur.NativeAIR.Interpolation.derivativeValue
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → R → List R → R
+DEFINITION
+fun {R} [OfNat R 0] [Add R] [Mul R] point x => List.brecOn x (Aiur.NativeAIR.Interpolation.derivativeValue._f point)
+PREMISE Aiur.NativeAIR.Interpolation.combine
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → List R → R → List (R × R) → List R
+DEFINITION
+fun {R} [OfNat R 0] [Add R] [Mul R] vanishing scale x =>
+  List.brecOn x (Aiur.NativeAIR.Interpolation.combine._f vanishing scale)
+PREMISE Aiur.NativeAIR.Interpolation.coefficients
+{R : Type u_1} → [OfNat R 0] → [OfNat R 1] → [Add R] → [Sub R] → [Mul R] → List (R × R) → R → List R
+DEFINITION
+fun {R} [OfNat R 0] [OfNat R 1] [Add R] [Sub R] [Mul R] samples scale =>
+  Aiur.NativeAIR.Interpolation.combine (Aiur.NativeAIR.Polynomial.fromRoots (List.map Prod.fst samples)) scale samples
+PREMISE Aiur.NativeAIR.Interpolation.weightedSum
+Aiur.NativeAIR.ProofCodec.Extension →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension) →
+      Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun scale point x => List.brecOn x (Aiur.NativeAIR.Interpolation.weightedSum._f scale point)
+PREMISE Aiur.NativeAIR.Interpolation.evaluate
+Aiur.NativeAIR.ProofCodec.Extension →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension) →
+      Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun scale point samples =>
+  match List.find? (fun sample => point == sample.fst) samples with
+  | some sample => some sample.snd
+  | none => do
+    let sum ← Aiur.NativeAIR.Interpolation.weightedSum scale point samples
+    pure (sum * Aiur.NativeAIR.LogUp.product (List.map (fun sample => point - sample.fst) samples))
+PREMISE Aiur.NativeAIR.Interpolation.foldSamples
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.Domain.Subgroup →
+    Nat →
+      List Aiur.NativeAIR.ProofCodec.Extension →
+        List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension)
+DEFINITION
+fun parent arity index values =>
+  (List.map Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Polynomial.foldingNodes parent arity index)).zip
+    values
+PREMISE Aiur.NativeAIR.Interpolation.foldScale
+Aiur.NativeAIR.Domain.Subgroup → Aiur.NativeAIR.Domain.Subgroup → Nat → Aiur.G
+DEFINITION
+fun parent arity index =>
+  (Aiur.G.ofNat (Aiur.NativeAIR.Domain.size arity) *
+      (Aiur.NativeAIR.FriDomain.foldNode parent arity index 0).pow (Aiur.NativeAIR.Domain.size arity)).inverse
+PREMISE Aiur.NativeAIR.Interpolation.foldRow
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.Domain.Subgroup →
+    Nat →
+      List Aiur.NativeAIR.ProofCodec.Extension →
+        Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.ProofCodec.Extension
+DEFINITION
+fun parent arity index values point =>
+  if
+      (decide (↑arity > ↑parent) || decide (index ≥ 2 ^ (↑parent - ↑arity)) ||
+          values.length != Aiur.NativeAIR.Domain.size arity) =
+        true then
+    none
+  else
+    Aiur.NativeAIR.Interpolation.evaluate
+      (Aiur.NativeAIR.ProofCodec.Extension.ofBase (Aiur.NativeAIR.Interpolation.foldScale parent arity index)) point
+      (Aiur.NativeAIR.Interpolation.foldSamples parent arity index values)
+PREMISE Aiur.NativeAIR.Folding.foldCoefficients
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → Aiur.NativeAIR.Domain.Subgroup → R → List R → List R
+DEFINITION
+fun {R} [OfNat R 0] [Add R] [Mul R] arity challenge =>
+  WellFounded.Nat.fix (fun x => x.length) fun coefficients a =>
+    if _empty : coefficients = [] then []
+    else
+      Aiur.NativeAIR.Quotient.horner challenge (List.take (Aiur.NativeAIR.Domain.size arity) coefficients) ::
+        a (List.drop (Aiur.NativeAIR.Domain.size arity) coefficients) ⋯
+PREMISE Aiur.NativeAIR.Folding.rowCoefficients
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → Aiur.NativeAIR.Domain.Subgroup → R → List R → List R
+DEFINITION
+fun {R} [OfNat R 0] [Add R] [Mul R] arity point =>
+  WellFounded.Nat.fix (fun x => x.length) fun coefficients a =>
+    if _empty : coefficients = [] then []
+    else
+      Aiur.NativeAIR.Polynomial.add (List.take (Aiur.NativeAIR.Domain.size arity) coefficients)
+        (Aiur.NativeAIR.Polynomial.scale point (a (List.drop (Aiur.NativeAIR.Domain.size arity) coefficients) ⋯))
+PREMISE Aiur.NativeAIR.FriQuery.reconstruct
+{R : Type u_1} → Aiur.NativeAIR.Domain.Subgroup → Nat → R → List R → Option (List R)
+DEFINITION
+fun {R} arity index value siblings =>
+  if (siblings.length + 1 == Aiur.NativeAIR.Domain.size arity) = true then
+    some (siblings.insertIdx (index % Aiur.NativeAIR.Domain.size arity) value)
+  else none
+PREMISE Aiur.NativeAIR.FriQuery.State.mk
+Aiur.NativeAIR.Domain.Subgroup → Nat → Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.FriQuery.State
+PREMISE Aiur.NativeAIR.FriQuery.Round.mk
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.ProofCodec.Extension → List Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.FriQuery.Round
+PREMISE Aiur.NativeAIR.FriQuery.Row.mk
+Aiur.NativeAIR.Domain.Subgroup → Nat → List Aiur.NativeAIR.ProofCodec.Extension → Aiur.NativeAIR.FriQuery.Row
+PREMISE Aiur.NativeAIR.FriQuery.roll
+Nat →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    Aiur.NativeAIR.ProofCodec.Extension →
+      List (Nat × Aiur.NativeAIR.ProofCodec.Extension) →
+        Aiur.NativeAIR.ProofCodec.Extension × List (Nat × Aiur.NativeAIR.ProofCodec.Extension)
+DEFINITION
+fun height factor value x =>
+  match x with
+  | [] => (value, [])
+  | (nextHeight, next) :: rest =>
+    if (nextHeight == height) = true then (value + factor * next, rest) else (value, (nextHeight, next) :: rest)
+PREMISE Aiur.NativeAIR.FriQuery.StepResult.mk
+Aiur.NativeAIR.FriQuery.State →
+  List (Nat × Aiur.NativeAIR.ProofCodec.Extension) → Aiur.NativeAIR.FriQuery.Row → Aiur.NativeAIR.FriQuery.StepResult
+PREMISE Aiur.NativeAIR.FriQuery.step
+Aiur.NativeAIR.FriQuery.State →
+  Aiur.NativeAIR.FriQuery.Round →
+    List (Nat × Aiur.NativeAIR.ProofCodec.Extension) → Option Aiur.NativeAIR.FriQuery.StepResult
+DEFINITION
+fun state round openings =>
+  if (↑round.arity == 0 || decide (↑round.arity > ↑state.domain)) = true then none
+  else do
+    let child ← Aiur.NativeAIR.Domain.ofLogSize (↑state.domain - ↑round.arity)
+    let values ← Aiur.NativeAIR.FriQuery.reconstruct round.arity state.index state.value round.siblings
+    have index : Nat := state.index / Aiur.NativeAIR.Domain.size round.arity
+    let folded ← Aiur.NativeAIR.Interpolation.foldRow state.domain round.arity index values round.challenge
+    match
+        Aiur.NativeAIR.FriQuery.roll (↑child) (round.challenge.power (Aiur.NativeAIR.Domain.size round.arity)) folded
+          openings with
+      | (value, remaining) =>
+        pure
+          { state := { domain := child, index := index, value := value }, remaining := remaining,
+            row := { domain := child, index := index, values := values } }
+PREMISE Aiur.NativeAIR.FriQuery.Result.mk
+Aiur.NativeAIR.FriQuery.State → List Aiur.NativeAIR.FriQuery.Row → Aiur.NativeAIR.FriQuery.Result
+PREMISE Aiur.NativeAIR.FriQuery.walk
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.FriQuery.State →
+    List (Nat × Aiur.NativeAIR.ProofCodec.Extension) →
+      List Aiur.NativeAIR.FriQuery.Round → Option Aiur.NativeAIR.FriQuery.Result
+DEFINITION
+fun final state openings x =>
+  List.brecOn (motive := fun x =>
+    Aiur.NativeAIR.FriQuery.State →
+      List (Nat × Aiur.NativeAIR.ProofCodec.Extension) → Option Aiur.NativeAIR.FriQuery.Result)
+    x (Aiur.NativeAIR.FriQuery.walk._f final) state openings
+PREMISE Aiur.NativeAIR.FriQuery.run
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.Domain.Subgroup →
+    Nat →
+      List (Nat × Aiur.NativeAIR.ProofCodec.Extension) →
+        List Aiur.NativeAIR.FriQuery.Round → Option Aiur.NativeAIR.FriQuery.Result
+DEFINITION
+fun initial final index openings rounds =>
+  if index ≥ Aiur.NativeAIR.Domain.size initial then none
+  else
+    match openings with
+    | [] => none
+    | (height, value) :: rest =>
+      if (height == ↑initial) = true then
+        Aiur.NativeAIR.FriQuery.walk final { domain := initial, index := index, value := value } rest rounds
+      else none
+PREMISE Aiur.NativeAIR.FriQuery.check
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.Domain.Subgroup →
+    Nat →
+      List (Nat × Aiur.NativeAIR.ProofCodec.Extension) →
+        List Aiur.NativeAIR.FriQuery.Round →
+          List Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.FriQuery.Result
+DEFINITION
+fun initial final index openings rounds finalPolynomial => do
+  let result ← Aiur.NativeAIR.FriQuery.run initial final index openings rounds
+  if
+        (Aiur.NativeAIR.Quotient.horner
+              (Aiur.NativeAIR.ProofCodec.Extension.ofBase
+                (Aiur.NativeAIR.FriDomain.queryPoint initial result.state.index))
+              finalPolynomial ==
+            result.state.value) =
+          true then
+      some result
+    else none
+RECURSION WORKER Aiur.buildArgs._unsafe_rec
+Aiur.LayoutMap →
+  Std.HashMap Aiur.Local (Array Aiur.Bytecode.ValIdx) →
+    List Aiur.Concrete.Term → optParam (Array Aiur.Bytecode.ValIdx) #[] → Aiur.CompileM (Array Aiur.Bytecode.ValIdx)
+IMPLEMENTATION
+fun layoutMap bindings args init =>
+  List.foldlM
+    (fun acc x =>
+      match x with
+      | ⟨arg, property⟩ => do
+        let __do_lift ← Aiur.toIndex._unsafe_rec layoutMap bindings arg
+        pure (acc.append __do_lift))
+    init args.attach
+RECURSION WORKER Aiur.checkArgsAndInputs._unsafe_rec
+Aiur.Global → List Aiur.Source.Term → List Aiur.Typ → Aiur.CheckM (List Aiur.Typed.Term)
+IMPLEMENTATION
+fun func args inputs =>
+  let lenArgs := args.length;
+  let lenInputs := inputs.length;
+  have __do_jp := fun __r =>
+    List.mapM
+      (fun x =>
+        match x with
+        | (⟨arg, property⟩, input) => Aiur.checkNoEscape._unsafe_rec arg input)
+      (args.attach.zip inputs);
+  if (lenArgs == lenInputs) = true then __do_jp ()
+  else do
+    let __r ← throw (Aiur.CheckError.wrongNumArgs func lenArgs lenInputs)
+    __do_jp __r
+RECURSION WORKER Aiur.checkMatchBranch._unsafe_rec
+Aiur.Typ →
+  Aiur.Pattern × Aiur.Source.Term →
+    List (Aiur.Pattern × Aiur.Typed.Term) × Option (Aiur.Typ × Bool) →
+      Aiur.CheckM (List (Aiur.Pattern × Aiur.Typed.Term) × Option (Aiur.Typ × Bool))
+IMPLEMENTATION
+fun patTyp branchData acc =>
+  match branchData with
+  | (pat, branch) =>
+    match acc with
+    | (typedBranches, currentTypOpt) => do
+      let bindings ← Aiur.checkPattern pat patTyp
+      withReader (Aiur.bindIdents bindings)
+          (match currentTypOpt with
+          | none => do
+            let typedBranch ← Aiur.inferTerm._unsafe_rec branch
+            pure ((pat, typedBranch) :: typedBranches, some (typedBranch.typ, typedBranch.escapes))
+          | some (matchTyp, matchEscapes) => do
+            let typedBranch ← Aiur.inferTerm._unsafe_rec branch
+            let typedBranches : List (Aiur.Pattern × Aiur.Typed.Term) := (pat, typedBranch) :: typedBranches
+            if typedBranch.escapes = true then pure (typedBranches, currentTypOpt)
+              else
+                if matchEscapes = true then pure (typedBranches, some (typedBranch.typ, false))
+                else do
+                  let __do_lift ← Aiur.unifyTyp matchTyp typedBranch.typ
+                  have __do_jp :
+                    Unit → Aiur.CheckM (List (Aiur.Pattern × Aiur.Typed.Term) × Option (Aiur.Typ × Bool)) := fun __r =>
+                    pure (typedBranches, currentTypOpt)
+                  if __do_lift = true then __do_jp ()
+                    else do
+                      let __r ← throw (Aiur.CheckError.branchMismatch matchTyp typedBranch.typ)
+                      __do_jp __r)
+RECURSION WORKER Aiur.checkNoEscape._unsafe_rec
+Aiur.Source.Term → Aiur.Typ → Aiur.CheckM Aiur.Typed.Term
+IMPLEMENTATION
+fun term typ => do
+  let typedTerm ← Aiur.inferTerm._unsafe_rec term
+  have __do_jp : Unit → Aiur.CheckM Aiur.Typed.Term := fun __r => do
+    let __do_lift ← Aiur.unifyTyp typ typedTerm.typ
+    have __do_jp : Unit → Aiur.CheckM Aiur.Typed.Term := fun __r => pure typedTerm
+    if __do_lift = true then __do_jp ()
+      else do
+        let __r ← throw (Aiur.CheckError.typeMismatch typ typedTerm.typ)
+        __do_jp __r
+  if typedTerm.escapes = true then do
+      let __r ← throw Aiur.CheckError.illegalReturn
+      __do_jp __r
+    else __do_jp ()
+RECURSION WORKER Aiur.checkPatternAux._unsafe_rec
+Aiur.Pattern → Aiur.Typ → Aiur.CheckM (List (Aiur.Local × Aiur.Typ))
+IMPLEMENTATION
+fun pat typ => do
+  let typ ← Aiur.walkTyp typ
+  match pat with
+    | Aiur.Pattern.var var => pure [(var, typ)]
+    | Aiur.Pattern.wildcard => pure []
+    | Aiur.Pattern.field a =>
+      match typ with
+      | Aiur.Typ.field => pure []
+      | Aiur.Typ.u8 => pure []
+      | x => throw (Aiur.CheckError.incompatiblePattern pat typ)
+    | Aiur.Pattern.tuple pats =>
+      match typ with
+      | Aiur.Typ.tuple typs =>
+        have __do_jp := fun __r => Aiur.checkPatternsArr._unsafe_rec pats typs;
+        if (pats.size == typs.size) = true then __do_jp ()
+        else do
+          let __r ← throw (Aiur.CheckError.incompatiblePattern pat typ)
+          __do_jp __r
+      | x => throw (Aiur.CheckError.incompatiblePattern pat typ)
+    | Aiur.Pattern.array pats =>
+      match typ with
+      | innerTyp.array n =>
+        have __do_jp := fun __r => Aiur.checkPatternsArrUniform._unsafe_rec pats innerTyp;
+        if (pats.size == n) = true then __do_jp ()
+        else do
+          let __r ← throw (Aiur.CheckError.incompatiblePattern pat typ)
+          __do_jp __r
+      | x => throw (Aiur.CheckError.incompatiblePattern pat typ)
+    | Aiur.Pattern.ref refName pats =>
+      match typ with
+      | tFn@h:(Aiur.Typ.function a a_1) =>
+        if pats.isEmpty = true then do
+          let ctx ← read
+          match IndexMap.getByKey ctx.decls refName with
+            | some (Aiur.Source.Declaration.function function) =>
+              let typ' := Aiur.Typ.function (List.map Prod.snd function.inputs) function.output;
+              do
+              let __do_lift ← Aiur.unifyTyp tFn typ'
+              have __do_jp : Unit → Aiur.CheckM (List (Aiur.Local × Aiur.Typ)) := fun __r => pure []
+              if __do_lift = true then __do_jp ()
+                else do
+                  let __r ← throw (Aiur.CheckError.typeMismatch tFn typ')
+                  __do_jp __r
+            | x => throw (Aiur.CheckError.incompatiblePattern pat typ)
+        else throw (Aiur.CheckError.incompatiblePattern pat typ)
+      | Aiur.Typ.ref dataTypeRef => do
+        let ctx ← read
+        match IndexMap.getByKey ctx.decls dataTypeRef with
+          | some (Aiur.Source.Declaration.dataType dataType) =>
+            match IndexMap.getByKey ctx.decls refName with
+            | some (Aiur.Source.Declaration.constructor dataType' constr) =>
+              have __do_jp := fun __r =>
+                let typs := constr.argTypes;
+                have __do_jp := fun __r => Aiur.checkPatternsList._unsafe_rec pats typs;
+                if (pats.length == typs.length) = true then __do_jp ()
+                else do
+                  let __r ← throw (Aiur.CheckError.wrongNumArgs refName pats.length typs.length)
+                  __do_jp __r;
+              if (dataType == dataType') = true then __do_jp ()
+              else do
+                let __r ← throw (Aiur.CheckError.incompatiblePattern pat typ)
+                __do_jp __r
+            | x => throw (Aiur.CheckError.notAConstructor refName)
+          | x => throw (Aiur.CheckError.unboundGlobal dataTypeRef)
+      | Aiur.Typ.app dataTypeRef args => do
+        let ctx ← read
+        match IndexMap.getByKey ctx.decls dataTypeRef with
+          | some (Aiur.Source.Declaration.dataType dataType) =>
+            match IndexMap.getByKey ctx.decls refName with
+            | some (Aiur.Source.Declaration.constructor dataType' constr) =>
+              have __do_jp := fun __r =>
+                let subst := Aiur.mkParamSubst dataType.params args;
+                let typs := List.map (Aiur.Typ.instantiate subst) constr.argTypes;
+                have __do_jp := fun __r => Aiur.checkPatternsList._unsafe_rec pats typs;
+                if (pats.length == typs.length) = true then __do_jp ()
+                else do
+                  let __r ← throw (Aiur.CheckError.wrongNumArgs refName pats.length typs.length)
+                  __do_jp __r;
+              if (dataType == dataType') = true then __do_jp ()
+              else do
+                let __r ← throw (Aiur.CheckError.incompatiblePattern pat typ)
+                __do_jp __r
+            | x => throw (Aiur.CheckError.notAConstructor refName)
+          | x => throw (Aiur.CheckError.unboundGlobal dataTypeRef)
+      | x => throw (Aiur.CheckError.incompatiblePattern pat typ)
+    | p1.or p2 => do
+      let bind ← Aiur.checkPatternAux._unsafe_rec p1 typ
+      let bind' ← Aiur.checkPatternAux._unsafe_rec p2 typ
+      if (bind != bind') = true then throw (Aiur.CheckError.differentBindings bind bind') else pure bind
+    | p.pointer =>
+      match typ with
+      | innerTyp.pointer => Aiur.checkPatternAux._unsafe_rec p innerTyp
+      | x => throw (Aiur.CheckError.incompatiblePattern pat typ)
+RECURSION WORKER Aiur.checkPatternsArr._unsafe_rec
+Array Aiur.Pattern → Array Aiur.Typ → Aiur.CheckM (List (Aiur.Local × Aiur.Typ))
+IMPLEMENTATION
+fun pats typs =>
+  Array.foldlM
+    (fun acc x =>
+      match x with
+      | (⟨pat, hmem⟩, typ) =>
+        have this := ⋯;
+        do
+        let sub ← Aiur.checkPatternAux._unsafe_rec pat typ
+        pure (acc.append sub))
+    [] (pats.attach.zip typs)
+RECURSION WORKER Aiur.checkPatternsArrUniform._unsafe_rec
+Array Aiur.Pattern → Aiur.Typ → Aiur.CheckM (List (Aiur.Local × Aiur.Typ))
+IMPLEMENTATION
+fun pats innerTyp =>
+  Array.foldlM
+    (fun acc x =>
+      match x with
+      | ⟨pat, hmem⟩ =>
+        have this := ⋯;
+        do
+        let sub ← Aiur.checkPatternAux._unsafe_rec pat innerTyp
+        pure (acc.append sub))
+    [] pats.attach
+RECURSION WORKER Aiur.checkPatternsList._unsafe_rec
+List Aiur.Pattern → List Aiur.Typ → Aiur.CheckM (List (Aiur.Local × Aiur.Typ))
+IMPLEMENTATION
+fun pats typs =>
+  List.foldlM
+    (fun acc x =>
+      match x with
+      | (⟨pat, hmem⟩, typ) =>
+        have this := ⋯;
+        do
+        let sub ← Aiur.checkPatternAux._unsafe_rec pat typ
+        pure (acc.append sub))
+    [] (pats.attach.zip typs)
+RECURSION WORKER Aiur.collectCalls._unsafe_rec
+Aiur.Typed.Decls →
+  Std.HashSet (Aiur.Global × Array Aiur.Typ) → Aiur.Typed.Term → Std.HashSet (Aiur.Global × Array Aiur.Typ)
+IMPLEMENTATION
+fun decls seen x =>
+  match x with
+  | Aiur.Typed.Term.app typ escapes g tArgs args unconstrained =>
+    let seen :=
+      List.foldl
+        (fun s x =>
+          match x with
+          | ⟨a, property⟩ => Aiur.collectCalls._unsafe_rec decls s a)
+        seen args.attach;
+    if tArgs.isEmpty = true then seen
+    else
+      match IndexMap.getByKey decls g with
+      | some (Aiur.Typed.Declaration.function a) => seen.insert (g, tArgs)
+      | some (Aiur.Typed.Declaration.constructor dt a) => seen.insert (dt.name, tArgs)
+      | x => seen
+  | Aiur.Typed.Term.ref typ escapes g tArgs =>
+    if tArgs.isEmpty = true then seen
+    else
+      match IndexMap.getByKey decls g with
+      | some (Aiur.Typed.Declaration.function a) => seen.insert (g, tArgs)
+      | some (Aiur.Typed.Declaration.constructor dt a) => seen.insert (dt.name, tArgs)
+      | x => seen
+  | Aiur.Typed.Term.unit typ escapes => seen
+  | Aiur.Typed.Term.var typ escapes l => seen
+  | Aiur.Typed.Term.field typ escapes g => seen
+  | Aiur.Typed.Term.tuple typ escapes ts =>
+    Array.foldl
+      (fun s x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.collectCalls._unsafe_rec decls s t)
+      seen ts.attach
+  | Aiur.Typed.Term.array typ escapes ts =>
+    Array.foldl
+      (fun s x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.collectCalls._unsafe_rec decls s t)
+      seen ts.attach
+  | Aiur.Typed.Term.ret typ escapes r => Aiur.collectCalls._unsafe_rec decls seen r
+  | Aiur.Typed.Term.let typ escapes pat v b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen v) b
+  | Aiur.Typed.Term.match typ escapes scrut bs =>
+    let seen := Aiur.collectCalls._unsafe_rec decls seen scrut;
+    List.foldl
+      (fun s x =>
+        match x with
+        | ⟨(fst, b), property⟩ => Aiur.collectCalls._unsafe_rec decls s b)
+      seen bs.attach
+  | Aiur.Typed.Term.add typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.sub typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.mul typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8Xor typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8Add typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8Mul typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8Sub typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8XorSplit7 typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8XorSplit4 typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8RangeCheck typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8And typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8Or typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u8LessThan typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.u32LessThan typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.unconstrainedU32Add typ escapes a b =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b
+  | Aiur.Typed.Term.unconstrainedU32Add3 typ escapes a b c =>
+    Aiur.collectCalls._unsafe_rec decls
+      (Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b) c
+  | Aiur.Typed.Term.eqZero typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.store typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.load typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.ptrVal typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.toField typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.u8FromFieldUnsafe typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.unconstrainedGToBytes typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.unconstrainedGInverse typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.u32ToField typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.u8BitDecomposition typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.u8ShiftLeft typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.u8ShiftRight typ escapes a => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.ioGetInfo typ escapes c k =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen c) k
+  | Aiur.Typed.Term.proj typ escapes a n => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.get typ escapes a n => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.slice typ escapes a i j => Aiur.collectCalls._unsafe_rec decls seen a
+  | Aiur.Typed.Term.set typ escapes a n v =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) v
+  | Aiur.Typed.Term.assertEq typ escapes a b msg r =>
+    Aiur.collectCalls._unsafe_rec decls
+      (Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen a) b) r
+  | Aiur.Typed.Term.ioSetInfo typ escapes c k i l r =>
+    Aiur.collectCalls._unsafe_rec decls
+      (Aiur.collectCalls._unsafe_rec decls
+        (Aiur.collectCalls._unsafe_rec decls
+          (Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen c) k) i)
+        l)
+      r
+  | Aiur.Typed.Term.ioRead typ escapes c i n =>
+    Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen c) i
+  | Aiur.Typed.Term.ioWrite typ escapes c d r =>
+    Aiur.collectCalls._unsafe_rec decls
+      (Aiur.collectCalls._unsafe_rec decls (Aiur.collectCalls._unsafe_rec decls seen c) d) r
+  | Aiur.Typed.Term.debug typ escapes label t r =>
+    let seen :=
+      match t with
+      | some t => Aiur.collectCalls._unsafe_rec decls seen t
+      | none => seen;
+    Aiur.collectCalls._unsafe_rec decls seen r
+RECURSION WORKER Aiur.collectInTyp._unsafe_rec
+Std.HashSet (Aiur.Global × Array Aiur.Typ) → Aiur.Typ → Std.HashSet (Aiur.Global × Array Aiur.Typ)
+IMPLEMENTATION
+fun seen x =>
+  match x with
+  | Aiur.Typ.app g args =>
+    let seen :=
+      Array.foldl
+        (fun s x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.collectInTyp._unsafe_rec s t)
+        seen args.attach;
+    seen.insert (g, args)
+  | Aiur.Typ.tuple ts =>
+    Array.foldl
+      (fun s x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.collectInTyp._unsafe_rec s t)
+      seen ts.attach
+  | t.array a => Aiur.collectInTyp._unsafe_rec seen t
+  | t.pointer => Aiur.collectInTyp._unsafe_rec seen t
+  | Aiur.Typ.function ins out =>
+    let seen :=
+      List.foldl
+        (fun s x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.collectInTyp._unsafe_rec s t)
+        seen ins.attach;
+    Aiur.collectInTyp._unsafe_rec seen out
+  | x => seen
+RECURSION WORKER Aiur.collectInTypedTerm._unsafe_rec
+Std.HashSet (Aiur.Global × Array Aiur.Typ) → Aiur.Typed.Term → Std.HashSet (Aiur.Global × Array Aiur.Typ)
+IMPLEMENTATION
+fun seen x =>
+  match x with
+  | Aiur.Typed.Term.unit τ escapes => Aiur.collectInTyp seen τ
+  | Aiur.Typed.Term.var τ escapes l => Aiur.collectInTyp seen τ
+  | Aiur.Typed.Term.ref τ escapes g tArgs =>
+    let seen := Aiur.collectInTyp seen τ;
+    Array.foldl Aiur.collectInTyp seen tArgs
+  | Aiur.Typed.Term.field τ escapes g => Aiur.collectInTyp seen τ
+  | Aiur.Typed.Term.tuple τ escapes ts =>
+    let seen := Aiur.collectInTyp seen τ;
+    Array.foldl
+      (fun s x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.collectInTypedTerm._unsafe_rec s t)
+      seen ts.attach
+  | Aiur.Typed.Term.array τ escapes ts =>
+    let seen := Aiur.collectInTyp seen τ;
+    Array.foldl
+      (fun s x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.collectInTypedTerm._unsafe_rec s t)
+      seen ts.attach
+  | Aiur.Typed.Term.ret τ escapes r => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) r
+  | Aiur.Typed.Term.let τ escapes pat v b =>
+    let seen := Aiur.collectInTyp seen τ;
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec seen v) b
+  | Aiur.Typed.Term.match τ escapes scrut bs =>
+    let seen := Aiur.collectInTyp seen τ;
+    let seen := Aiur.collectInTypedTerm._unsafe_rec seen scrut;
+    List.foldl
+      (fun s x =>
+        match x with
+        | ⟨(fst, b), property⟩ => Aiur.collectInTypedTerm._unsafe_rec s b)
+      seen bs.attach
+  | Aiur.Typed.Term.app τ escapes g tArgs args unconstrained =>
+    let seen := Aiur.collectInTyp seen τ;
+    let seen := Array.foldl Aiur.collectInTyp seen tArgs;
+    List.foldl
+      (fun s x =>
+        match x with
+        | ⟨a, property⟩ => Aiur.collectInTypedTerm._unsafe_rec s a)
+      seen args.attach
+  | Aiur.Typed.Term.add τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.sub τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.mul τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8Xor τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8Add τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8Mul τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8Sub τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8XorSplit7 τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8XorSplit4 τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8RangeCheck τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8And τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8Or τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u8LessThan τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.u32LessThan τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.unconstrainedU32Add τ escapes a b =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b
+  | Aiur.Typed.Term.unconstrainedU32Add3 τ escapes a b c =>
+    Aiur.collectInTypedTerm._unsafe_rec
+      (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b) c
+  | Aiur.Typed.Term.eqZero τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.store τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.load τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.ptrVal τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.toField τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.u8FromFieldUnsafe τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.unconstrainedGToBytes τ escapes a =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.unconstrainedGInverse τ escapes a =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.u32ToField τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.u8BitDecomposition τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.u8ShiftLeft τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.u8ShiftRight τ escapes a => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.ioGetInfo τ escapes c k =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) c) k
+  | Aiur.Typed.Term.proj τ escapes a n => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.get τ escapes a n => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.slice τ escapes a i j => Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a
+  | Aiur.Typed.Term.set τ escapes a n v =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) v
+  | Aiur.Typed.Term.assertEq τ escapes a b msg r =>
+    Aiur.collectInTypedTerm._unsafe_rec
+      (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) a) b) r
+  | Aiur.Typed.Term.ioSetInfo τ escapes c k i l r =>
+    Aiur.collectInTypedTerm._unsafe_rec
+      (Aiur.collectInTypedTerm._unsafe_rec
+        (Aiur.collectInTypedTerm._unsafe_rec
+          (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) c) k) i)
+        l)
+      r
+  | Aiur.Typed.Term.ioRead τ escapes c i n =>
+    Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) c) i
+  | Aiur.Typed.Term.ioWrite τ escapes c d r =>
+    Aiur.collectInTypedTerm._unsafe_rec
+      (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTypedTerm._unsafe_rec (Aiur.collectInTyp seen τ) c) d) r
+  | Aiur.Typed.Term.debug τ escapes label t r =>
+    let seen := Aiur.collectInTyp seen τ;
+    let seen :=
+      match t with
+      | some t => Aiur.collectInTypedTerm._unsafe_rec seen t
+      | none => seen;
+    Aiur.collectInTypedTerm._unsafe_rec seen r
+RECURSION WORKER Aiur.concretizeDrain._unsafe_rec
+Aiur.Typed.Decls → Nat → Aiur.DrainState → Except Aiur.ConcretizeError Aiur.DrainState
+IMPLEMENTATION
+fun decls x x_1 =>
+  match x, x_1 with
+  | 0, state => if state.pending.isEmpty = true then pure state else throw Aiur.ConcretizeError.fuelExhausted
+  | fuel.succ, state =>
+    if state.pending.isEmpty = true then pure state
+    else do
+      let state' ← Aiur.concretizeDrainIter decls state
+      Aiur.concretizeDrain._unsafe_rec decls fuel state'
+RECURSION WORKER Aiur.dataTypeFlatSizeBound._unsafe_rec
+Aiur.Source.Decls → Nat → Std.HashSet Aiur.Global → Aiur.DataType → Nat
+IMPLEMENTATION
+fun decls x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, x, x_3 => 1
+  | bound.succ, visited, dt =>
+    let ctorSizes :=
+      List.map
+        (fun ctor =>
+          List.foldl (fun acc t => acc + Aiur.typFlatSizeBound._unsafe_rec decls bound visited t) 0 ctor.argTypes)
+        dt.constructors;
+    if (dt.constructors.length == 1) = true then List.foldl max 0 ctorSizes else List.foldl max 0 ctorSizes + 1
+RECURSION WORKER Aiur.expandPattern._unsafe_rec
+Aiur.Concrete.Typ →
+  Aiur.Local →
+    Aiur.Pattern → Aiur.Concrete.Term → Except Aiur.ConcretizeError (Array (Aiur.Concrete.Pattern × Aiur.Concrete.Term))
+IMPLEMENTATION
+fun scrutTyp scrutLocal x x_1 =>
+  match x, x_1 with
+  | Aiur.Pattern.wildcard, cb => pure #[(Aiur.Concrete.Pattern.wildcard, cb)]
+  | Aiur.Pattern.var x, cb =>
+    pure
+      #[(Aiur.Concrete.Pattern.wildcard,
+          Aiur.Concrete.Term.letVar cb.typ cb.escapes x (Aiur.Concrete.Term.var scrutTyp false scrutLocal) cb)]
+  | Aiur.Pattern.field g, cb => pure #[(Aiur.Concrete.Pattern.field g, cb)]
+  | Aiur.Pattern.ref g pats, cb => do
+    let locals ← Aiur.subPatternsToLocals pats
+    pure #[(Aiur.Concrete.Pattern.ref g locals, cb)]
+  | Aiur.Pattern.tuple pats, cb => do
+    let locals ← Aiur.subPatternsToLocalsArr pats
+    pure #[(Aiur.Concrete.Pattern.tuple locals, cb)]
+  | Aiur.Pattern.array pats, cb => do
+    let locals ← Aiur.subPatternsToLocalsArr pats
+    pure #[(Aiur.Concrete.Pattern.array locals, cb)]
+  | p1.or p2, cb => do
+    let __do_lift ← Aiur.expandPattern._unsafe_rec scrutTyp scrutLocal p1 cb
+    let __do_lift_1 ← Aiur.expandPattern._unsafe_rec scrutTyp scrutLocal p2 cb
+    pure (__do_lift ++ __do_lift_1)
+  | x, x_2 => throw Aiur.ConcretizeError.unsupportedPattern
+RECURSION WORKER Aiur.expandTypeMBound._unsafe_rec
+Nat →
+  Std.HashSet Aiur.Global →
+    Array Aiur.TypeAlias → Aiur.Typ → StateT (Std.HashMap Aiur.Global Aiur.Typ) (Except Aiur.CheckError) Aiur.Typ
+IMPLEMENTATION
+fun x x_1 x_2 x_3 =>
+  match x, x_1, x_2, x_3 with
+  | x, x_4, x_5, Aiur.Typ.unit => pure Aiur.Typ.unit
+  | x, x_4, x_5, Aiur.Typ.field => pure Aiur.Typ.field
+  | x, x_4, x_5, Aiur.Typ.u8 => pure Aiur.Typ.u8
+  | bound, visited, tops, t.pointer => do
+    let __do_lift ← Aiur.expandTypeMBound._unsafe_rec bound visited tops t
+    pure __do_lift.pointer
+  | bound, visited, tops, Aiur.Typ.function inputs output => do
+    let inputs' ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.expandTypeMBound._unsafe_rec bound visited tops t)
+          inputs.attach
+    let output' ← Aiur.expandTypeMBound._unsafe_rec bound visited tops output
+    pure (Aiur.Typ.function inputs' output')
+  | bound, visited, tops, Aiur.Typ.tuple ts => do
+    let ts' ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.expandTypeMBound._unsafe_rec bound visited tops t)
+          ts.attach
+    pure (Aiur.Typ.tuple ts')
+  | bound, visited, tops, t.array n => do
+    let t' ← Aiur.expandTypeMBound._unsafe_rec bound visited tops t
+    pure (t'.array n)
+  | bound, visited, tops, Aiur.Typ.app g args => do
+    let args' ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.expandTypeMBound._unsafe_rec bound visited tops t)
+          args.attach
+    match Array.find? (fun x => x.name == g) tops with
+      | some «alias» =>
+        have __do_jp := fun __r =>
+          have __do_jp := fun __r =>
+            let subst := Aiur.mkParamSubst «alias».params args';
+            let instantiated := Aiur.Typ.instantiate subst «alias».expansion;
+            match bound with
+            | 0 => pure (Aiur.Typ.app g args')
+            | bound.succ => Aiur.expandTypeMBound._unsafe_rec bound (visited.insert g) tops instantiated;
+          if («alias».params.length != args'.size) = true then do
+            let __r ← throw (Aiur.CheckError.wrongNumTypeArgs g «alias».params.length args'.size)
+            __do_jp __r
+          else __do_jp ();
+        if visited.contains g = true then do
+          let __r ← throw (Aiur.CheckError.typeAliasCycle g)
+          __do_jp __r
+        else __do_jp ()
+      | x => pure (Aiur.Typ.app g args')
+  | bound, visited, tops, Aiur.Typ.ref g => do
+    let aliasMap ← get
+    match aliasMap[g]? with
+      | some expanded => pure expanded
+      | x =>
+        match Array.find? (fun x => x.name == g) tops with
+        | some «alias» =>
+          have __do_jp := fun __r =>
+            have __do_jp := fun __r =>
+              match bound with
+              | 0 => pure (Aiur.Typ.ref g)
+              | bound.succ => do
+                let expanded ← Aiur.expandTypeMBound._unsafe_rec bound (visited.insert g) tops «alias».expansion
+                set (aliasMap.insert g expanded)
+                pure expanded;
+            if (!«alias».params.isEmpty) = true then do
+              let __r ← throw (Aiur.CheckError.wrongNumTypeArgs g «alias».params.length 0)
+              __do_jp __r
+            else __do_jp ();
+          if visited.contains g = true then do
+            let __r ← throw (Aiur.CheckError.typeAliasCycle g)
+            __do_jp __r
+          else __do_jp ()
+        | x => pure (Aiur.Typ.ref g)
+  | x, x_4, x_5, Aiur.Typ.mvar n => pure (Aiur.Typ.mvar n)
+RECURSION WORKER Aiur.expectIdx._unsafe_rec
+Aiur.LayoutMap →
+  Std.HashMap Aiur.Local (Array Aiur.Bytecode.ValIdx) → Aiur.Concrete.Term → Aiur.CompileM Aiur.Bytecode.ValIdx
+IMPLEMENTATION
+fun layoutMap bindings term => do
+  let idxs ← Aiur.toIndex._unsafe_rec layoutMap bindings term
+  if h : idxs.size = 1 then
+      have this := ⋯;
+      pure idxs[0]
+    else throw "Term is not of size 1"
+RECURSION WORKER Aiur.fixedTraceHeights._unsafe_rec
+List Nat → List Bool → List Nat → Bool
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], [], [] => true
+  | height :: heights, false :: active, degrees =>
+    height == 0 && Aiur.fixedTraceHeights._unsafe_rec heights active degrees
+  | height :: heights, true :: active, degree :: degrees =>
+    (height == 0 || decide (degree < 64) && height == 2 ^ degree) &&
+      Aiur.fixedTraceHeights._unsafe_rec heights active degrees
+  | x, x_3, x_4 => false
+RECURSION WORKER Aiur.flattenValue._unsafe_rec
+Aiur.Source.Decls → (Aiur.Global → Option Nat) → Aiur.Value → Array Aiur.G
+IMPLEMENTATION
+fun decls funcIdx x =>
+  match x with
+  | Aiur.Value.unit => #[]
+  | Aiur.Value.field g => #[g]
+  | Aiur.Value.pointer width n => #[Aiur.G.ofNat n]
+  | Aiur.Value.fn g => #[Aiur.G.ofNat ((funcIdx g).getD 0)]
+  | Aiur.Value.tuple vs =>
+    Array.flatMap
+      (fun x =>
+        match x with
+        | ⟨v, property⟩ => Aiur.flattenValue._unsafe_rec decls funcIdx v)
+      vs.attach
+  | Aiur.Value.array vs =>
+    Array.flatMap
+      (fun x =>
+        match x with
+        | ⟨v, property⟩ => Aiur.flattenValue._unsafe_rec decls funcIdx v)
+      vs.attach
+  | Aiur.Value.ctor g args =>
+    match IndexMap.getByKey decls g with
+    | some (Aiur.Source.Declaration.constructor dt ctor) =>
+      let dtSize := Aiur.dataTypeFlatSize decls ∅ dt;
+      let argsFlat :=
+        Array.flatMap
+          (fun x =>
+            match x with
+            | ⟨v, property⟩ => Aiur.flattenValue._unsafe_rec decls funcIdx v)
+          args.attach;
+      let flat :=
+        if (dt.constructors.length == 1) = true then argsFlat
+        else
+          let ctorIndex := (List.findIdx? (fun x => x == ctor) dt.constructors).getD 0;
+          #[Aiur.G.ofNat ctorIndex] ++ argsFlat;
+      let padding := dtSize - flat.size;
+      flat ++ Array.replicate padding 0
+    | x =>
+      Array.flatMap
+        (fun x =>
+          match x with
+          | ⟨v, property⟩ => Aiur.flattenValue._unsafe_rec decls funcIdx v)
+        args.attach
+RECURSION WORKER Aiur.inferNoEscape._unsafe_rec
+Aiur.Source.Term → Aiur.CheckM Aiur.Typed.Term
+IMPLEMENTATION
+fun term => do
+  let typedTerm ← Aiur.inferTerm._unsafe_rec term
+  have __do_jp : Unit → Aiur.CheckM Aiur.Typed.Term := fun __r => pure typedTerm
+  if typedTerm.escapes = true then do
+      let __r ← throw Aiur.CheckError.illegalReturn
+      __do_jp __r
+    else __do_jp ()
+RECURSION WORKER Aiur.inferTerm._unsafe_rec
+Aiur.Source.Term → Aiur.CheckM Aiur.Typed.Term
+IMPLEMENTATION
+fun t =>
+  match t with
+  | Aiur.Source.Term.unit => pure (Aiur.Typed.Term.unit Aiur.Typ.unit false)
+  | Aiur.Source.Term.var x => do
+    let ctx ← read
+    match (ctx.varTypes[x]?, x) with
+      | (some t, snd) => pure (Aiur.Typed.Term.var t false x)
+      | (none, Aiur.Local.str localName) => do
+        let __x ← Aiur.refLookup (Aiur.Global.init localName)
+        match __x with
+          | (typ, snd) => pure (Aiur.Typed.Term.var typ false x)
+      | (none, snd) => throw (Aiur.CheckError.unboundLocal x)
+  | Aiur.Source.Term.ref x => do
+    let __x ← Aiur.refLookup x
+    match __x with
+      | (typ, tArgs) => pure (Aiur.Typed.Term.ref typ false x tArgs)
+  | term.ret => do
+    let ctx ← read
+    let term' ← Aiur.checkNoEscape._unsafe_rec term ctx.returnType
+    pure (Aiur.Typed.Term.ret ctx.returnType true term')
+  | Aiur.Source.Term.field g => pure (Aiur.Typed.Term.field Aiur.Typ.field false g)
+  | Aiur.Source.Term.tuple ts => do
+    let typedTerms ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.inferNoEscape._unsafe_rec t)
+          ts.attach
+    let typs : Array Aiur.Typ := Array.map (fun x => x.typ) typedTerms
+    pure (Aiur.Typed.Term.tuple (Aiur.Typ.tuple typs) false typedTerms)
+  | Aiur.Source.Term.array ts =>
+    if h : ts.size > 0 then do
+      let first ← Aiur.inferNoEscape._unsafe_rec ts[0]
+      let typedTerms ←
+        Array.mapM
+            (fun x =>
+              match x with
+              | ⟨t, property⟩ => Aiur.checkNoEscape._unsafe_rec t first.typ)
+            ts.attach
+      pure (Aiur.Typed.Term.array (first.typ.array ts.size) false typedTerms)
+    else throw Aiur.CheckError.emptyArray
+  | Aiur.Source.Term.let pat expr body => do
+    let expr' ← Aiur.inferNoEscape._unsafe_rec expr
+    let bindings ← Aiur.checkPattern pat expr'.typ
+    let body' ← withReader (Aiur.bindIdents bindings) (Aiur.inferTerm._unsafe_rec body)
+    pure (Aiur.Typed.Term.let body'.typ body'.escapes pat expr' body')
+  | term.match branches => do
+    let term' ← Aiur.inferNoEscape._unsafe_rec term
+    let init : List (Aiur.Pattern × Aiur.Typed.Term) × Option (Aiur.Typ × Bool) := ([], none)
+    let __x ←
+      List.foldrM
+          (fun x acc =>
+            match x with
+            | ⟨branchData, property⟩ => Aiur.checkMatchBranch._unsafe_rec term'.typ branchData acc)
+          init branches.attach
+    match __x with
+      | (branches', typOpt) =>
+        match typOpt with
+        | some (typ, escapes) => pure (Aiur.Typed.Term.match typ escapes term' branches')
+        | none => throw Aiur.CheckError.emptyMatch
+  | Aiur.Source.Term.app func args mode =>
+    have __do_jp := fun u => do
+      let ctx ← read
+      let localLookup : Option (Except Aiur.CheckError (Aiur.Typ × List Aiur.Typ)) :=
+        match func.toName with
+        | Name.anonymous.str s =>
+          match ctx.varTypes[Aiur.Local.str s]? with
+          | some (Aiur.Typ.function ins out) => some (Except.ok (out, ins))
+          | some val => some (Except.error (Aiur.CheckError.notAFunction func))
+          | none => none
+        | x => none
+      match localLookup with
+        | some (Except.error e) => throw e
+        | some (Except.ok (output, inputs)) => do
+          let args' ← Aiur.checkArgsAndInputs._unsafe_rec func args inputs
+          pure (Aiur.Typed.Term.app output false func #[] args' u)
+        | none =>
+          match IndexMap.getByKey ctx.decls func with
+          | some (Aiur.Source.Declaration.function function) =>
+            if function.params.isEmpty = true then do
+              let args' ← Aiur.checkArgsAndInputs._unsafe_rec func args (List.map Prod.snd function.inputs)
+              pure (Aiur.Typed.Term.app function.output false func #[] args' u)
+            else do
+              let __x ← Aiur.instantiateParams function.params
+              match __x with
+                | (mvars, subst) =>
+                  let inputTypes := List.map (Aiur.Typ.instantiate subst ∘ Prod.snd) function.inputs;
+                  let output := Aiur.Typ.instantiate subst function.output;
+                  do
+                  let args' ← Aiur.checkArgsAndInputs._unsafe_rec func args inputTypes
+                  pure (Aiur.Typed.Term.app output false func mvars args' u)
+          | some (Aiur.Source.Declaration.constructor dataType constr) =>
+            have __do_jp := fun __r =>
+              if dataType.params.isEmpty = true then do
+                let args' ← Aiur.checkArgsAndInputs._unsafe_rec func args constr.argTypes
+                pure (Aiur.Typed.Term.app (Aiur.Typ.ref dataType.name) false func #[] args' u)
+              else do
+                let __x ← Aiur.instantiateParams dataType.params
+                match __x with
+                  | (mvars, subst) =>
+                    let argTypes := List.map (Aiur.Typ.instantiate subst) constr.argTypes;
+                    do
+                    let args' ← Aiur.checkArgsAndInputs._unsafe_rec func args argTypes
+                    pure (Aiur.Typed.Term.app (Aiur.Typ.app dataType.name mvars) false func mvars args' u);
+            if u = true then do
+              let __r ← throw (Aiur.CheckError.unconstrainedConstructor func)
+              __do_jp __r
+            else __do_jp ()
+          | x => throw (Aiur.CheckError.cannotApply func);
+    match mode with
+    | Aiur.Source.CallMode.normal => do
+      let u ← pure false
+      __do_jp u
+    | Aiur.Source.CallMode.unconstrained => do
+      let u ← pure true
+      __do_jp u
+    | Aiur.Source.CallMode.inlined => do
+      let u ← throw (Aiur.CheckError.cannotApply func)
+      __do_jp u
+  | Aiur.Source.Term.ann typ term => Aiur.checkNoEscape._unsafe_rec term typ
+  | tup.proj i => do
+    let tup' ← Aiur.inferNoEscape._unsafe_rec tup
+    let __do_lift ← Aiur.walkTyp tup'.typ
+    match __do_lift with
+      | Aiur.Typ.tuple typs =>
+        if h : i < typs.size then pure (Aiur.Typed.Term.proj typs[i] false tup' i)
+        else throw (Aiur.CheckError.indexOoB i)
+      | typ' => throw (Aiur.CheckError.notATuple typ')
+  | arr.get i => do
+    let arr' ← Aiur.inferNoEscape._unsafe_rec arr
+    let __do_lift ← Aiur.walkTyp arr'.typ
+    match __do_lift with
+      | typ.array n => if i ≥ n then throw (Aiur.CheckError.indexOoB i) else pure (Aiur.Typed.Term.get typ false arr' i)
+      | typ' => throw (Aiur.CheckError.notAnArray typ')
+  | arr.slice i j =>
+    if j < i then throw (Aiur.CheckError.negativeRange i j)
+    else do
+      let arr' ← Aiur.inferNoEscape._unsafe_rec arr
+      let __do_lift ← Aiur.walkTyp arr'.typ
+      match __do_lift with
+        | typ.array n =>
+          if j ≤ n then pure (Aiur.Typed.Term.slice (typ.array (j - i)) false arr' i j)
+          else throw (Aiur.CheckError.rangeOoB i j)
+        | typ' => throw (Aiur.CheckError.notAnArray typ')
+  | arr.set i val => do
+    let arr' ← Aiur.inferNoEscape._unsafe_rec arr
+    let __do_lift ← Aiur.walkTyp arr'.typ
+    match __do_lift with
+      | typ.array n =>
+        if i ≥ n then throw (Aiur.CheckError.indexOoB i)
+        else do
+          let val' ← Aiur.checkNoEscape._unsafe_rec val typ
+          pure (Aiur.Typed.Term.set (typ.array n) false arr' i val')
+      | typ' => throw (Aiur.CheckError.notAnArray typ')
+  | term.store => do
+    let term' ← Aiur.inferNoEscape._unsafe_rec term
+    pure (Aiur.Typed.Term.store term'.typ.pointer false term')
+  | term.load => do
+    let term' ← Aiur.inferNoEscape._unsafe_rec term
+    let __do_lift ← Aiur.walkTyp term'.typ
+    match __do_lift with
+      | innerTyp.pointer => pure (Aiur.Typed.Term.load innerTyp false term')
+      | typ' => throw (Aiur.CheckError.notAPointer typ')
+  | term.ptrVal => do
+    let term' ← Aiur.inferNoEscape._unsafe_rec term
+    let __do_lift ← Aiur.walkTyp term'.typ
+    match __do_lift with
+      | a.pointer => pure (Aiur.Typed.Term.ptrVal Aiur.Typ.field false term')
+      | typ' => throw (Aiur.CheckError.notAPointer typ')
+  | a.eqZero => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    pure (Aiur.Typed.Term.eqZero Aiur.Typ.field false a')
+  | a.add b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.field
+    pure (Aiur.Typed.Term.add Aiur.Typ.field false a' b')
+  | a.sub b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.field
+    pure (Aiur.Typed.Term.sub Aiur.Typ.field false a' b')
+  | a.mul b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.field
+    pure (Aiur.Typed.Term.mul Aiur.Typ.field false a' b')
+  | a.u8ShiftLeft => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8ShiftLeft Aiur.Typ.u8 false a')
+  | a.u8ShiftRight => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8ShiftRight Aiur.Typ.u8 false a')
+  | a.u8BitDecomposition => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8BitDecomposition (Aiur.Typ.field.array 8) false a')
+  | a.u8Xor b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8Xor Aiur.Typ.u8 false a' b')
+  | a.u8And b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8And Aiur.Typ.u8 false a' b')
+  | a.u8Or b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8Or Aiur.Typ.u8 false a' b')
+  | a.u8Add b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8Add (Aiur.Typ.tuple #[Aiur.Typ.u8, Aiur.Typ.u8]) false a' b')
+  | a.u8Mul b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8Mul (Aiur.Typ.tuple #[Aiur.Typ.u8, Aiur.Typ.u8]) false a' b')
+  | a.u8XorSplit7 b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8XorSplit7 (Aiur.Typ.tuple #[Aiur.Typ.u8, Aiur.Typ.u8]) false a' b')
+  | a.u8XorSplit4 b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8XorSplit4 (Aiur.Typ.tuple #[Aiur.Typ.u8, Aiur.Typ.u8]) false a' b')
+  | a.u8Sub b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8Sub (Aiur.Typ.tuple #[Aiur.Typ.u8, Aiur.Typ.u8]) false a' b')
+  | a.u8LessThan b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.u8
+    pure (Aiur.Typed.Term.u8LessThan Aiur.Typ.field false a' b')
+  | a.u32LessThan b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.field
+    pure (Aiur.Typed.Term.u32LessThan Aiur.Typ.field false a' b')
+  | a.unconstrainedU32Add b =>
+    let word := Aiur.Typ.u8.array 4;
+    do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a word
+    let b' ← Aiur.checkNoEscape._unsafe_rec b word
+    pure (Aiur.Typed.Term.unconstrainedU32Add (Aiur.Typ.tuple #[Aiur.Typ.field.array 4, Aiur.Typ.field]) false a' b')
+  | a.unconstrainedU32Add3 b c =>
+    let word := Aiur.Typ.u8.array 4;
+    do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a word
+    let b' ← Aiur.checkNoEscape._unsafe_rec b word
+    let c' ← Aiur.checkNoEscape._unsafe_rec c word
+    pure
+        (Aiur.Typed.Term.unconstrainedU32Add3 (Aiur.Typ.tuple #[Aiur.Typ.field.array 4, Aiur.Typ.field]) false a' b' c')
+  | a.u32ToField => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a (Aiur.Typ.u8.array 4)
+    pure (Aiur.Typed.Term.u32ToField Aiur.Typ.field false a')
+  | Aiur.Source.Term.u8Lit n =>
+    have __do_jp := fun __r => pure (Aiur.Typed.Term.field Aiur.Typ.u8 false (Aiur.G.ofNat n));
+    if n ≥ 256 then do
+      let __r ← throw (Aiur.CheckError.u8LitOutOfRange n)
+      __do_jp __r
+    else __do_jp ()
+  | a.u8RangeCheck b => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    let b' ← Aiur.checkNoEscape._unsafe_rec b Aiur.Typ.field
+    pure (Aiur.Typed.Term.u8RangeCheck (Aiur.Typ.tuple #[Aiur.Typ.u8, Aiur.Typ.u8]) false a' b')
+  | a.unconstrainedBigUintDivMod b => do
+    let a' ← Aiur.inferNoEscape._unsafe_rec a
+    let b' ← Aiur.checkNoEscape._unsafe_rec b a'.typ
+    let __do_lift ← Aiur.zonkTyp a'.typ
+    let τ ← Aiur.bigUintDivModResultTyp __do_lift
+    pure (Aiur.Typed.Term.unconstrainedBigUintDivMod (Aiur.Typ.tuple #[τ, τ]) false a' b')
+  | a.unconstrainedGToBytes => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    pure (Aiur.Typed.Term.unconstrainedGToBytes (Aiur.Typ.field.array 8) false a')
+  | a.unconstrainedGInverse => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    pure (Aiur.Typed.Term.unconstrainedGInverse Aiur.Typ.field false a')
+  | a.toField => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.u8
+    pure (Aiur.Typed.Term.toField Aiur.Typ.field false a')
+  | a.u8FromFieldUnsafe => do
+    let a' ← Aiur.checkNoEscape._unsafe_rec a Aiur.Typ.field
+    pure (Aiur.Typed.Term.u8FromFieldUnsafe Aiur.Typ.u8 false a')
+  | channel.ioGetInfo key => do
+    let channel' ← Aiur.checkNoEscape._unsafe_rec channel Aiur.Typ.field
+    let key' ← Aiur.inferNoEscape._unsafe_rec key
+    let __do_lift ← Aiur.walkTyp key'.typ
+    match __do_lift with
+      | a.array a_1 =>
+        pure (Aiur.Typed.Term.ioGetInfo (Aiur.Typ.tuple #[Aiur.Typ.field, Aiur.Typ.field]) false channel' key')
+      | typ' => throw (Aiur.CheckError.notAnArray typ')
+  | channel.ioSetInfo key idx len ret => do
+    let channel' ← Aiur.checkNoEscape._unsafe_rec channel Aiur.Typ.field
+    let key' ← Aiur.inferNoEscape._unsafe_rec key
+    let __do_lift ← Aiur.walkTyp key'.typ
+    match __do_lift with
+      | keyEltTyp.array a => do
+        let __do_lift ← Aiur.unifyTyp keyEltTyp Aiur.Typ.field
+        have __do_jp : Unit → Aiur.CheckM Aiur.Typed.Term := fun __r => do
+          let idx' ← Aiur.checkNoEscape._unsafe_rec idx Aiur.Typ.field
+          let len' ← Aiur.checkNoEscape._unsafe_rec len Aiur.Typ.field
+          let ret' ← Aiur.inferTerm._unsafe_rec ret
+          pure (Aiur.Typed.Term.ioSetInfo ret'.typ ret'.escapes channel' key' idx' len' ret')
+        if __do_lift = true then __do_jp ()
+          else do
+            let __r ← throw (Aiur.CheckError.typeMismatch Aiur.Typ.field keyEltTyp)
+            __do_jp __r
+      | typ' => throw (Aiur.CheckError.notAnArray typ')
+  | channel.ioRead idx len =>
+    have __do_jp := fun __r => do
+      let channel' ← Aiur.checkNoEscape._unsafe_rec channel Aiur.Typ.field
+      let idx' ← Aiur.checkNoEscape._unsafe_rec idx Aiur.Typ.field
+      pure (Aiur.Typed.Term.ioRead (Aiur.Typ.field.array len) false channel' idx' len);
+    if len = 0 then do
+      let __r ← throw Aiur.CheckError.emptyArray
+      __do_jp __r
+    else __do_jp ()
+  | channel.ioWrite data ret => do
+    let channel' ← Aiur.checkNoEscape._unsafe_rec channel Aiur.Typ.field
+    let data' ← Aiur.inferNoEscape._unsafe_rec data
+    let __do_lift ← Aiur.walkTyp data'.typ
+    match __do_lift with
+      | dataEltTyp.array a => do
+        let __do_lift ← Aiur.unifyTyp dataEltTyp Aiur.Typ.field
+        have __do_jp : Unit → Aiur.CheckM Aiur.Typed.Term := fun __r => do
+          let ret' ← Aiur.inferTerm._unsafe_rec ret
+          pure (Aiur.Typed.Term.ioWrite ret'.typ ret'.escapes channel' data' ret')
+        if __do_lift = true then __do_jp ()
+          else do
+            let __r ← throw (Aiur.CheckError.typeMismatch Aiur.Typ.field dataEltTyp)
+            __do_jp __r
+      | typ' => throw (Aiur.CheckError.notAnArray typ')
+  | a.assertEq b msg ret => do
+    let a' ← Aiur.inferNoEscape._unsafe_rec a
+    let b' ← Aiur.checkNoEscape._unsafe_rec b a'.typ
+    let ret' ← Aiur.inferTerm._unsafe_rec ret
+    pure (Aiur.Typed.Term.assertEq ret'.typ ret'.escapes a' b' msg ret')
+  | Aiur.Source.Term.debug label term ret =>
+    have __do_jp := fun term' => do
+      let ret' ← Aiur.inferTerm._unsafe_rec ret
+      pure (Aiur.Typed.Term.debug ret'.typ ret'.escapes label term' ret');
+    match term with
+    | none => do
+      let term' ← pure none
+      __do_jp term'
+    | some sub => do
+      let __do_lift ← Aiur.inferTerm._unsafe_rec sub
+      let term' ← pure (some __do_lift)
+      __do_jp term'
+RECURSION WORKER Aiur.lookupQueryBoundAux._unsafe_rec
+List Nat → List Bool → List Nat → Nat → Option Nat
+IMPLEMENTATION
+fun x x_1 x_2 x_3 =>
+  match x, x_1, x_2, x_3 with
+  | [], [], [], used => some used
+  | head :: slots, false :: active, degrees, used => Aiur.lookupQueryBoundAux._unsafe_rec slots active degrees used
+  | slots :: rest, true :: active, degree :: degrees, used =>
+    if degree < 64 then
+      let next := used + 2 ^ degree * slots;
+      if next < Aiur.gSize.toNat then Aiur.lookupQueryBoundAux._unsafe_rec rest active degrees next else none
+    else none
+  | x, x_4, x_5, x_6 => none
+RECURSION WORKER Aiur.lookupSlotSum._unsafe_rec
+List Nat → List Bool → List Nat → Option Nat
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], [], [] => some 0
+  | head :: slots, false :: active, degrees => Aiur.lookupSlotSum._unsafe_rec slots active degrees
+  | slots :: rest, true :: active, degree :: degrees => do
+    let tail ← Aiur.lookupSlotSum._unsafe_rec rest active degrees
+    pure (2 ^ degree * slots + tail)
+  | x, x_3, x_4 => none
+RECURSION WORKER Aiur.mkLetFloating._unsafe_rec
+Aiur.Typ → Bool → Aiur.Pattern → Aiur.Typed.Term → Aiur.Typed.Term → Aiur.Typed.Term
+IMPLEMENTATION
+fun τ e pat v b =>
+  match v with
+  | Aiur.Typed.Term.let τ' e' pat' v' rest =>
+    Aiur.Typed.Term.let τ' e' pat' v' (Aiur.mkLetFloating._unsafe_rec τ e pat rest b)
+  | x => Aiur.Typed.Term.let τ e pat v b
+RECURSION WORKER Aiur.natToLimbsLE._unsafe_rec
+Nat → List (Array Aiur.G)
+IMPLEMENTATION
+fun n =>
+  if h : n = 0 then []
+  else
+    let limb := n % 2 ^ 64;
+    let bytes := Array.ofFn fun i => Aiur.G.ofNat (limb >>> (8 * ↑i) % 256);
+    bytes :: Aiur.natToLimbsLE._unsafe_rec (n / 2 ^ 64)
+RECURSION WORKER Aiur.occursInBound._unsafe_rec
+Nat → Nat → Std.HashSet Nat → Aiur.Typ → Aiur.CheckM Bool
+IMPLEMENTATION
+fun x x_1 x_2 x_3 =>
+  match x, x_1, x_2, x_3 with
+  | id, bound, visited, Aiur.Typ.mvar id' =>
+    if (id == id') = true then pure true
+    else
+      if visited.contains id' = true then pure false
+      else
+        match bound with
+        | 0 => pure false
+        | bound.succ => do
+          let __do_lift ← get
+          match __do_lift.mvarSubst[id']? with
+            | some t => Aiur.occursInBound._unsafe_rec id bound (visited.insert id') t
+            | none => pure false
+  | id, bound, visited, Aiur.Typ.tuple ts =>
+    Array.anyM
+      (fun x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.occursInBound._unsafe_rec id bound visited t)
+      ts.attach
+  | id, bound, visited, t.array a => Aiur.occursInBound._unsafe_rec id bound visited t
+  | id, bound, visited, t.pointer => Aiur.occursInBound._unsafe_rec id bound visited t
+  | id, bound, visited, Aiur.Typ.function ins out => do
+    let __do_lift ←
+      List.anyM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.occursInBound._unsafe_rec id bound visited t)
+          ins.attach
+    if __do_lift = true then pure true else Aiur.occursInBound._unsafe_rec id bound visited out
+  | id, bound, visited, Aiur.Typ.app a args =>
+    Array.anyM
+      (fun x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.occursInBound._unsafe_rec id bound visited t)
+      args.attach
+  | x, x_4, x_5, x_6 => pure false
+RECURSION WORKER Aiur.rewritePattern._unsafe_rec
+Aiur.Typed.Decls → Aiur.MonoMap → Aiur.Typ → Aiur.Pattern → Aiur.Pattern
+IMPLEMENTATION
+fun decls mono expectedTyp x =>
+  match x with
+  | Aiur.Pattern.ref g pats =>
+    let tArgs :=
+      match expectedTyp with
+      | Aiur.Typ.app a args => args
+      | x => #[];
+    let g' := Aiur.rewriteGlobal decls mono g tArgs;
+    let pats' :=
+      List.map
+        (fun x =>
+          match x with
+          | ⟨p, property⟩ => Aiur.rewritePattern._unsafe_rec decls mono Aiur.Typ.unit p)
+        pats.attach;
+    Aiur.Pattern.ref g' pats'
+  | Aiur.Pattern.tuple pats =>
+    Aiur.Pattern.tuple
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨p, property⟩ => Aiur.rewritePattern._unsafe_rec decls mono Aiur.Typ.unit p)
+        pats.attach)
+  | Aiur.Pattern.array pats =>
+    let innerTyp :=
+      match expectedTyp with
+      | t.array a => t
+      | x => Aiur.Typ.unit;
+    Aiur.Pattern.array
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨p, property⟩ => Aiur.rewritePattern._unsafe_rec decls mono innerTyp p)
+        pats.attach)
+  | a.or b =>
+    (Aiur.rewritePattern._unsafe_rec decls mono expectedTyp a).or
+      (Aiur.rewritePattern._unsafe_rec decls mono expectedTyp b)
+  | p.pointer =>
+    match expectedTyp with
+    | inner.pointer => (Aiur.rewritePattern._unsafe_rec decls mono inner p).pointer
+    | x => p.pointer
+  | p => p
+RECURSION WORKER Aiur.rewriteTyp._unsafe_rec
+(Aiur.Global → Option Aiur.Typ) → Aiur.MonoMap → Aiur.Typ → Aiur.Typ
+IMPLEMENTATION
+fun subst mono x =>
+  match x with
+  | Aiur.Typ.ref g => (subst g).getD (Aiur.Typ.ref g)
+  | Aiur.Typ.app g args =>
+    match mono[(g, args)]? with
+    | some concName => Aiur.Typ.ref concName
+    | none =>
+      Aiur.Typ.app g
+        (Array.map
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.rewriteTyp._unsafe_rec subst mono t)
+          args.attach)
+  | Aiur.Typ.tuple ts =>
+    Aiur.Typ.tuple
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.rewriteTyp._unsafe_rec subst mono t)
+        ts.attach)
+  | t.array n => (Aiur.rewriteTyp._unsafe_rec subst mono t).array n
+  | t.pointer => (Aiur.rewriteTyp._unsafe_rec subst mono t).pointer
+  | Aiur.Typ.function ins out =>
+    Aiur.Typ.function
+      (List.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.rewriteTyp._unsafe_rec subst mono t)
+        ins.attach)
+      (Aiur.rewriteTyp._unsafe_rec subst mono out)
+  | t => t
+RECURSION WORKER Aiur.rewriteTypedTerm._unsafe_rec
+Aiur.Typed.Decls → (Aiur.Global → Option Aiur.Typ) → Aiur.MonoMap → Aiur.Typed.Term → Aiur.Typed.Term
+IMPLEMENTATION
+fun decls subst mono x =>
+  match x with
+  | Aiur.Typed.Term.unit τ e => Aiur.Typed.Term.unit (Aiur.rewriteTyp subst mono τ) e
+  | Aiur.Typed.Term.var τ e x => Aiur.Typed.Term.var (Aiur.rewriteTyp subst mono τ) e x
+  | Aiur.Typed.Term.ref τ e g tArgs =>
+    let g' := Aiur.rewriteGlobal decls mono g tArgs;
+    Aiur.Typed.Term.ref (Aiur.rewriteTyp subst mono τ) e g' (Array.map (Aiur.rewriteTyp subst mono) tArgs)
+  | Aiur.Typed.Term.field τ e v => Aiur.Typed.Term.field (Aiur.rewriteTyp subst mono τ) e v
+  | Aiur.Typed.Term.tuple τ e ts =>
+    Aiur.Typed.Term.tuple (Aiur.rewriteTyp subst mono τ) e
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.rewriteTypedTerm._unsafe_rec decls subst mono t)
+        ts.attach)
+  | Aiur.Typed.Term.array τ e ts =>
+    Aiur.Typed.Term.array (Aiur.rewriteTyp subst mono τ) e
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.rewriteTypedTerm._unsafe_rec decls subst mono t)
+        ts.attach)
+  | Aiur.Typed.Term.ret τ e r =>
+    Aiur.Typed.Term.ret (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono r)
+  | Aiur.Typed.Term.let τ e p v b =>
+    let vTyp := v.typ;
+    Aiur.Typed.Term.let (Aiur.rewriteTyp subst mono τ) e (Aiur.rewritePattern decls mono vTyp p)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono v) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.match τ e scrut bs =>
+    let scrutTyp := scrut.typ;
+    Aiur.Typed.Term.match (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono scrut)
+      (List.map
+        (fun x =>
+          match x with
+          | ⟨(p, b), property⟩ =>
+            (Aiur.rewritePattern decls mono scrutTyp p, Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b))
+        bs.attach)
+  | Aiur.Typed.Term.app τ e g tArgs args u =>
+    let g' := Aiur.rewriteGlobal decls mono g tArgs;
+    Aiur.Typed.Term.app (Aiur.rewriteTyp subst mono τ) e g' #[]
+      (List.map
+        (fun x =>
+          match x with
+          | ⟨a, property⟩ => Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+        args.attach)
+      u
+  | Aiur.Typed.Term.add τ e a b =>
+    Aiur.Typed.Term.add (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.sub τ e a b =>
+    Aiur.Typed.Term.sub (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.mul τ e a b =>
+    Aiur.Typed.Term.mul (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.eqZero τ e a =>
+    Aiur.Typed.Term.eqZero (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.proj τ e a n =>
+    Aiur.Typed.Term.proj (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) n
+  | Aiur.Typed.Term.get τ e a n =>
+    Aiur.Typed.Term.get (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) n
+  | Aiur.Typed.Term.slice τ e a i j =>
+    Aiur.Typed.Term.slice (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) i j
+  | Aiur.Typed.Term.set τ e a n v =>
+    Aiur.Typed.Term.set (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) n
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono v)
+  | Aiur.Typed.Term.store τ e a =>
+    Aiur.Typed.Term.store (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.load τ e a =>
+    Aiur.Typed.Term.load (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.ptrVal τ e a =>
+    Aiur.Typed.Term.ptrVal (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.assertEq τ e a b msg r =>
+    Aiur.Typed.Term.assertEq (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b) msg (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono r)
+  | Aiur.Typed.Term.ioGetInfo τ e c k =>
+    Aiur.Typed.Term.ioGetInfo (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono c)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono k)
+  | Aiur.Typed.Term.ioSetInfo τ e c k i l r =>
+    Aiur.Typed.Term.ioSetInfo (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono c)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono k) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono i)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono l) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono r)
+  | Aiur.Typed.Term.ioRead τ e c i n =>
+    Aiur.Typed.Term.ioRead (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono c)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono i) n
+  | Aiur.Typed.Term.ioWrite τ e c d r =>
+    Aiur.Typed.Term.ioWrite (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono c)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono d) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono r)
+  | Aiur.Typed.Term.u8BitDecomposition τ e a =>
+    Aiur.Typed.Term.u8BitDecomposition (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.u8ShiftLeft τ e a =>
+    Aiur.Typed.Term.u8ShiftLeft (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.u8ShiftRight τ e a =>
+    Aiur.Typed.Term.u8ShiftRight (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.u8Xor τ e a b =>
+    Aiur.Typed.Term.u8Xor (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8Add τ e a b =>
+    Aiur.Typed.Term.u8Add (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8Mul τ e a b =>
+    Aiur.Typed.Term.u8Mul (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8XorSplit7 τ e a b =>
+    Aiur.Typed.Term.u8XorSplit7 (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8XorSplit4 τ e a b =>
+    Aiur.Typed.Term.u8XorSplit4 (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8Sub τ e a b =>
+    Aiur.Typed.Term.u8Sub (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8And τ e a b =>
+    Aiur.Typed.Term.u8And (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8Or τ e a b =>
+    Aiur.Typed.Term.u8Or (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u8LessThan τ e a b =>
+    Aiur.Typed.Term.u8LessThan (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.u32LessThan τ e a b =>
+    Aiur.Typed.Term.u32LessThan (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.unconstrainedU32Add τ e a b =>
+    Aiur.Typed.Term.unconstrainedU32Add (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.unconstrainedU32Add3 τ e a b c =>
+    Aiur.Typed.Term.unconstrainedU32Add3 (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono c)
+  | Aiur.Typed.Term.u32ToField τ e a =>
+    Aiur.Typed.Term.u32ToField (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.u8RangeCheck τ e a b =>
+    Aiur.Typed.Term.u8RangeCheck (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod τ e a b =>
+    Aiur.Typed.Term.unconstrainedBigUintDivMod (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a) (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono b)
+  | Aiur.Typed.Term.unconstrainedGToBytes τ e a =>
+    Aiur.Typed.Term.unconstrainedGToBytes (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.unconstrainedGInverse τ e a =>
+    Aiur.Typed.Term.unconstrainedGInverse (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.toField τ e a =>
+    Aiur.Typed.Term.toField (Aiur.rewriteTyp subst mono τ) e (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.u8FromFieldUnsafe τ e a =>
+    Aiur.Typed.Term.u8FromFieldUnsafe (Aiur.rewriteTyp subst mono τ) e
+      (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono a)
+  | Aiur.Typed.Term.debug τ e l t r =>
+    let t' :=
+      match t with
+      | none => none
+      | some sub => some (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono sub);
+    Aiur.Typed.Term.debug (Aiur.rewriteTyp subst mono τ) e l t' (Aiur.rewriteTypedTerm._unsafe_rec decls subst mono r)
+RECURSION WORKER Aiur.simplifyTypedTerm._unsafe_rec
+Aiur.Source.Decls → Aiur.Typed.Term → Except Aiur.CheckError Aiur.Typed.Term
+IMPLEMENTATION
+fun decls x =>
+  match x with
+  | Aiur.Typed.Term.let τ e (Aiur.Pattern.var x) v b => do
+    let v' ← Aiur.simplifyTypedTerm._unsafe_rec decls v
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.mkLetFloating τ e (Aiur.Pattern.var x) v' b')
+  | Aiur.Typed.Term.let τ e Aiur.Pattern.wildcard v b => do
+    let v' ← Aiur.simplifyTypedTerm._unsafe_rec decls v
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.mkLetFloating τ e Aiur.Pattern.wildcard v' b')
+  | Aiur.Typed.Term.let τ e pat v b => do
+    let v' ← Aiur.simplifyTypedTerm._unsafe_rec decls v
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    let tmp : Aiur.Typed.Term := Aiur.Typed.Term.var v'.typ false Aiur.tmpVar
+    match Aiur.MatchCompiler.runMatchCompiler decls tmp [(pat, b')] with
+      | (tree, _diag) =>
+        let body :=
+          match Aiur.MatchCompiler.decisionToTyped b'.typ tmp.typ tree with
+          | some rewrite => rewrite
+          | none => Aiur.Typed.Term.match b'.typ b'.escapes tmp [(pat, b')];
+        pure (Aiur.mkLetFloating τ e (Aiur.Pattern.var Aiur.tmpVar) v' body)
+  | Aiur.Typed.Term.match τ e scrut branches => do
+    let scrut' ← Aiur.simplifyTypedTerm._unsafe_rec decls scrut
+    let branches' ←
+      List.mapM (fun pb => Except.map (Prod.mk pb.val.fst) (Aiur.simplifyTypedTerm._unsafe_rec decls pb.val.snd))
+          branches.attach
+    match Aiur.MatchCompiler.runMatchCompiler decls scrut' branches' with
+      | (tree, _diag) =>
+        match Aiur.MatchCompiler.decisionToTyped τ scrut'.typ tree with
+        | some rewrite => pure rewrite
+        | none =>
+          match scrut' with
+          | Aiur.Typed.Term.var typ escapes l => pure (Aiur.Typed.Term.match τ e scrut' branches')
+          | x =>
+            let tmp := Aiur.Typed.Term.var scrut'.typ false Aiur.tmpVar;
+            let inner := Aiur.Typed.Term.match τ e tmp branches';
+            pure (Aiur.Typed.Term.let τ e (Aiur.Pattern.var Aiur.tmpVar) scrut' inner)
+  | Aiur.Typed.Term.ret τ e r => do
+    let r' ← Aiur.simplifyTypedTerm._unsafe_rec decls r
+    pure (Aiur.Typed.Term.ret τ e r')
+  | Aiur.Typed.Term.app τ e g tArgs args u => do
+    let args' ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨a, property⟩ => Aiur.simplifyTypedTerm._unsafe_rec decls a)
+          args.attach
+    pure (Aiur.Typed.Term.app τ e g tArgs args' u)
+  | Aiur.Typed.Term.tuple τ e ts => do
+    let ts' ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.simplifyTypedTerm._unsafe_rec decls t)
+          ts.attach
+    pure (Aiur.Typed.Term.tuple τ e ts')
+  | Aiur.Typed.Term.array τ e ts => do
+    let ts' ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.simplifyTypedTerm._unsafe_rec decls t)
+          ts.attach
+    pure (Aiur.Typed.Term.array τ e ts')
+  | Aiur.Typed.Term.debug τ e l t r =>
+    have __do_jp := fun t' => do
+      let r' ← Aiur.simplifyTypedTerm._unsafe_rec decls r
+      pure (Aiur.Typed.Term.debug τ e l t' r');
+    match t with
+    | none => do
+      let t' ← pure none
+      __do_jp t'
+    | some sub => do
+      let __do_lift ← Aiur.simplifyTypedTerm._unsafe_rec decls sub
+      let t' ← pure (some __do_lift)
+      __do_jp t'
+  | Aiur.Typed.Term.assertEq τ e a b msg r => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    let r' ← Aiur.simplifyTypedTerm._unsafe_rec decls r
+    pure (Aiur.Typed.Term.assertEq τ e a' b' msg r')
+  | Aiur.Typed.Term.ioSetInfo τ e c k i l r => do
+    let c' ← Aiur.simplifyTypedTerm._unsafe_rec decls c
+    let k' ← Aiur.simplifyTypedTerm._unsafe_rec decls k
+    let i' ← Aiur.simplifyTypedTerm._unsafe_rec decls i
+    let l' ← Aiur.simplifyTypedTerm._unsafe_rec decls l
+    let r' ← Aiur.simplifyTypedTerm._unsafe_rec decls r
+    pure (Aiur.Typed.Term.ioSetInfo τ e c' k' i' l' r')
+  | Aiur.Typed.Term.ioWrite τ e c d r => do
+    let c' ← Aiur.simplifyTypedTerm._unsafe_rec decls c
+    let d' ← Aiur.simplifyTypedTerm._unsafe_rec decls d
+    let r' ← Aiur.simplifyTypedTerm._unsafe_rec decls r
+    pure (Aiur.Typed.Term.ioWrite τ e c' d' r')
+  | Aiur.Typed.Term.u8LessThan τ e a b => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.u8LessThan τ e a' b')
+  | Aiur.Typed.Term.u8XorSplit7 τ e a b => do
+    let __do_lift ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let __do_lift_1 ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.u8XorSplit7 τ e __do_lift __do_lift_1)
+  | Aiur.Typed.Term.u8XorSplit4 τ e a b => do
+    let __do_lift ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let __do_lift_1 ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.u8XorSplit4 τ e __do_lift __do_lift_1)
+  | Aiur.Typed.Term.u32LessThan τ e a b => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.u32LessThan τ e a' b')
+  | Aiur.Typed.Term.u8RangeCheck τ e a b => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.u8RangeCheck τ e a' b')
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod τ e a b => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let b' ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.unconstrainedBigUintDivMod τ e a' b')
+  | Aiur.Typed.Term.unconstrainedGToBytes τ e a => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    pure (Aiur.Typed.Term.unconstrainedGToBytes τ e a')
+  | Aiur.Typed.Term.unconstrainedU32Add τ e a b => do
+    let __do_lift ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let __do_lift_1 ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    pure (Aiur.Typed.Term.unconstrainedU32Add τ e __do_lift __do_lift_1)
+  | Aiur.Typed.Term.unconstrainedU32Add3 τ e a b c => do
+    let __do_lift ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    let __do_lift_1 ← Aiur.simplifyTypedTerm._unsafe_rec decls b
+    let __do_lift_2 ← Aiur.simplifyTypedTerm._unsafe_rec decls c
+    pure (Aiur.Typed.Term.unconstrainedU32Add3 τ e __do_lift __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u32ToField τ e a => do
+    let __do_lift ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    pure (Aiur.Typed.Term.u32ToField τ e __do_lift)
+  | Aiur.Typed.Term.unconstrainedGInverse τ e a => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    pure (Aiur.Typed.Term.unconstrainedGInverse τ e a')
+  | Aiur.Typed.Term.toField τ e a => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    pure (Aiur.Typed.Term.toField τ e a')
+  | Aiur.Typed.Term.u8FromFieldUnsafe τ e a => do
+    let a' ← Aiur.simplifyTypedTerm._unsafe_rec decls a
+    pure (Aiur.Typed.Term.u8FromFieldUnsafe τ e a')
+  | t => pure t
+RECURSION WORKER Aiur.substInTypedTerm._unsafe_rec
+(Aiur.Global → Option Aiur.Typ) → Aiur.Typed.Term → Aiur.Typed.Term
+IMPLEMENTATION
+fun subst x =>
+  match x with
+  | Aiur.Typed.Term.unit τ e => Aiur.Typed.Term.unit (Aiur.Typ.instantiate subst τ) e
+  | Aiur.Typed.Term.var τ e x => Aiur.Typed.Term.var (Aiur.Typ.instantiate subst τ) e x
+  | Aiur.Typed.Term.ref τ e g tArgs =>
+    Aiur.Typed.Term.ref (Aiur.Typ.instantiate subst τ) e g (Array.map (Aiur.Typ.instantiate subst) tArgs)
+  | Aiur.Typed.Term.field τ e v => Aiur.Typed.Term.field (Aiur.Typ.instantiate subst τ) e v
+  | Aiur.Typed.Term.tuple τ e ts =>
+    Aiur.Typed.Term.tuple (Aiur.Typ.instantiate subst τ) e
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.substInTypedTerm._unsafe_rec subst t)
+        ts.attach)
+  | Aiur.Typed.Term.array τ e ts =>
+    Aiur.Typed.Term.array (Aiur.Typ.instantiate subst τ) e
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.substInTypedTerm._unsafe_rec subst t)
+        ts.attach)
+  | Aiur.Typed.Term.ret τ e r =>
+    Aiur.Typed.Term.ret (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst r)
+  | Aiur.Typed.Term.let τ e p v b =>
+    Aiur.Typed.Term.let (Aiur.Typ.instantiate subst τ) e p (Aiur.substInTypedTerm._unsafe_rec subst v)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.match τ e scrut bs =>
+    Aiur.Typed.Term.match (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst scrut)
+      (List.map
+        (fun x =>
+          match x with
+          | ⟨(p, b), property⟩ => (p, Aiur.substInTypedTerm._unsafe_rec subst b))
+        bs.attach)
+  | Aiur.Typed.Term.app τ e g tArgs args u =>
+    Aiur.Typed.Term.app (Aiur.Typ.instantiate subst τ) e g (Array.map (Aiur.Typ.instantiate subst) tArgs)
+      (List.map
+        (fun x =>
+          match x with
+          | ⟨a, property⟩ => Aiur.substInTypedTerm._unsafe_rec subst a)
+        args.attach)
+      u
+  | Aiur.Typed.Term.add τ e a b =>
+    Aiur.Typed.Term.add (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.sub τ e a b =>
+    Aiur.Typed.Term.sub (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.mul τ e a b =>
+    Aiur.Typed.Term.mul (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.eqZero τ e a =>
+    Aiur.Typed.Term.eqZero (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.proj τ e a n =>
+    Aiur.Typed.Term.proj (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a) n
+  | Aiur.Typed.Term.get τ e a n =>
+    Aiur.Typed.Term.get (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a) n
+  | Aiur.Typed.Term.slice τ e a i j =>
+    Aiur.Typed.Term.slice (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a) i j
+  | Aiur.Typed.Term.set τ e a n v =>
+    Aiur.Typed.Term.set (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a) n
+      (Aiur.substInTypedTerm._unsafe_rec subst v)
+  | Aiur.Typed.Term.store τ e a =>
+    Aiur.Typed.Term.store (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.load τ e a =>
+    Aiur.Typed.Term.load (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.ptrVal τ e a =>
+    Aiur.Typed.Term.ptrVal (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.assertEq τ e a b msg r =>
+    Aiur.Typed.Term.assertEq (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b) msg (Aiur.substInTypedTerm._unsafe_rec subst r)
+  | Aiur.Typed.Term.ioGetInfo τ e c k =>
+    Aiur.Typed.Term.ioGetInfo (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst c)
+      (Aiur.substInTypedTerm._unsafe_rec subst k)
+  | Aiur.Typed.Term.ioSetInfo τ e c k i l r =>
+    Aiur.Typed.Term.ioSetInfo (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst c)
+      (Aiur.substInTypedTerm._unsafe_rec subst k) (Aiur.substInTypedTerm._unsafe_rec subst i)
+      (Aiur.substInTypedTerm._unsafe_rec subst l) (Aiur.substInTypedTerm._unsafe_rec subst r)
+  | Aiur.Typed.Term.ioRead τ e c i n =>
+    Aiur.Typed.Term.ioRead (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst c)
+      (Aiur.substInTypedTerm._unsafe_rec subst i) n
+  | Aiur.Typed.Term.ioWrite τ e c d r =>
+    Aiur.Typed.Term.ioWrite (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst c)
+      (Aiur.substInTypedTerm._unsafe_rec subst d) (Aiur.substInTypedTerm._unsafe_rec subst r)
+  | Aiur.Typed.Term.u8BitDecomposition τ e a =>
+    Aiur.Typed.Term.u8BitDecomposition (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.u8ShiftLeft τ e a =>
+    Aiur.Typed.Term.u8ShiftLeft (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.u8ShiftRight τ e a =>
+    Aiur.Typed.Term.u8ShiftRight (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.u8Xor τ e a b =>
+    Aiur.Typed.Term.u8Xor (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8Add τ e a b =>
+    Aiur.Typed.Term.u8Add (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8Mul τ e a b =>
+    Aiur.Typed.Term.u8Mul (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8XorSplit7 τ e a b =>
+    Aiur.Typed.Term.u8XorSplit7 (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8XorSplit4 τ e a b =>
+    Aiur.Typed.Term.u8XorSplit4 (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8Sub τ e a b =>
+    Aiur.Typed.Term.u8Sub (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8And τ e a b =>
+    Aiur.Typed.Term.u8And (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8Or τ e a b =>
+    Aiur.Typed.Term.u8Or (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u8LessThan τ e a b =>
+    Aiur.Typed.Term.u8LessThan (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.u32LessThan τ e a b =>
+    Aiur.Typed.Term.u32LessThan (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.unconstrainedU32Add τ e a b =>
+    Aiur.Typed.Term.unconstrainedU32Add (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.unconstrainedU32Add3 τ e a b c =>
+    Aiur.Typed.Term.unconstrainedU32Add3 (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b) (Aiur.substInTypedTerm._unsafe_rec subst c)
+  | Aiur.Typed.Term.u32ToField τ e a =>
+    Aiur.Typed.Term.u32ToField (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.u8RangeCheck τ e a b =>
+    Aiur.Typed.Term.u8RangeCheck (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+      (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod τ e a b =>
+    Aiur.Typed.Term.unconstrainedBigUintDivMod (Aiur.Typ.instantiate subst τ) e
+      (Aiur.substInTypedTerm._unsafe_rec subst a) (Aiur.substInTypedTerm._unsafe_rec subst b)
+  | Aiur.Typed.Term.unconstrainedGToBytes τ e a =>
+    Aiur.Typed.Term.unconstrainedGToBytes (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.unconstrainedGInverse τ e a =>
+    Aiur.Typed.Term.unconstrainedGInverse (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.toField τ e a =>
+    Aiur.Typed.Term.toField (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.u8FromFieldUnsafe τ e a =>
+    Aiur.Typed.Term.u8FromFieldUnsafe (Aiur.Typ.instantiate subst τ) e (Aiur.substInTypedTerm._unsafe_rec subst a)
+  | Aiur.Typed.Term.debug τ e l t r =>
+    let t' :=
+      match t with
+      | none => none
+      | some sub => some (Aiur.substInTypedTerm._unsafe_rec subst sub);
+    Aiur.Typed.Term.debug (Aiur.Typ.instantiate subst τ) e l t' (Aiur.substInTypedTerm._unsafe_rec subst r)
+RECURSION WORKER Aiur.termToConcrete._unsafe_rec
+Std.HashMap (Aiur.Global × Array Aiur.Typ) Aiur.Global →
+  Aiur.Typed.Term → Except Aiur.ConcretizeError Aiur.Concrete.Term
+IMPLEMENTATION
+fun mono x =>
+  match x with
+  | Aiur.Typed.Term.unit τ e => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    pure (Aiur.Concrete.Term.unit __do_lift e)
+  | Aiur.Typed.Term.var τ e x => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    pure (Aiur.Concrete.Term.var __do_lift e x)
+  | Aiur.Typed.Term.ref τ e g _tArgs => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    pure (Aiur.Concrete.Term.ref __do_lift e g)
+  | Aiur.Typed.Term.field τ e g => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    pure (Aiur.Concrete.Term.field __do_lift e g)
+  | Aiur.Typed.Term.tuple τ e ts => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Array.mapM (Aiur.termToConcrete._unsafe_rec mono) ts
+    pure (Aiur.Concrete.Term.tuple __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.array τ e ts => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Array.mapM (Aiur.termToConcrete._unsafe_rec mono) ts
+    pure (Aiur.Concrete.Term.array __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.ret τ e r => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono r
+    pure (Aiur.Concrete.Term.ret __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.let τ e pat v b => do
+    let τ' ← Aiur.typToConcrete mono τ
+    let v' ← Aiur.termToConcrete._unsafe_rec mono v
+    let b' ← Aiur.termToConcrete._unsafe_rec mono b
+    match pat with
+      | Aiur.Pattern.var x => pure (Aiur.Concrete.Term.letVar τ' e x v' b')
+      | x => pure (Aiur.Concrete.Term.letWild τ' e v' b')
+  | Aiur.Typed.Term.match τ e scrut bs => do
+    let τ' ← Aiur.typToConcrete mono τ
+    let scrut' ← Aiur.termToConcrete._unsafe_rec mono scrut
+    match scrut' with
+      | Aiur.Concrete.Term.var scrutTyp escapes scrutLocal =>
+        let scrutTerm := Aiur.Concrete.Term.var scrutTyp false scrutLocal;
+        have __do_jp := fun __r =>
+          have __do_jp := fun __r => do
+            let cases ←
+              Array.foldlM
+                  (fun acc x =>
+                    match x with
+                    | ⟨(p, b), property⟩ => do
+                      let cb ← Aiur.termToConcrete._unsafe_rec mono b
+                      let __do_lift ← Aiur.expandPattern scrutTyp scrutLocal p cb
+                      pure (acc ++ __do_lift))
+                  #[] bs.toArray.attach
+            pure (Aiur.Concrete.Term.match τ' e scrutLocal cases none);
+          match bs with
+          | [(Aiur.Pattern.array pats, body)] =>
+            match scrutTyp with
+            | eltTyp.array a => do
+              let cb ← Aiur.termToConcrete._unsafe_rec mono body
+              pure (Aiur.destructureArray scrutTerm pats eltTyp cb)
+            | x => __do_jp ()
+          | x => __do_jp ();
+        match bs with
+        | [(Aiur.Pattern.tuple pats, body)] =>
+          match scrutTyp with
+          | Aiur.Concrete.Typ.tuple ts => do
+            let cb ← Aiur.termToConcrete._unsafe_rec mono body
+            pure (Aiur.destructureTuple scrutTerm pats ts cb)
+          | x => __do_jp ()
+        | x => __do_jp ()
+      | x => throw Aiur.ConcretizeError.unsupportedMatchScrutinee
+  | Aiur.Typed.Term.app τ e g _tArgs args u => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← List.mapM (Aiur.termToConcrete._unsafe_rec mono) args
+    pure (Aiur.Concrete.Term.app __do_lift e g __do_lift_1 u)
+  | Aiur.Typed.Term.add τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.add __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.sub τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.sub __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.mul τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.mul __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.eqZero τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.eqZero __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.proj τ e a n => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.proj __do_lift e __do_lift_1 n)
+  | Aiur.Typed.Term.get τ e a n => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.get __do_lift e __do_lift_1 n)
+  | Aiur.Typed.Term.slice τ e a i j => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.slice __do_lift e __do_lift_1 i j)
+  | Aiur.Typed.Term.set τ e a n v => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono v
+    pure (Aiur.Concrete.Term.set __do_lift e __do_lift_1 n __do_lift_2)
+  | Aiur.Typed.Term.store τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.store __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.load τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.load __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.ptrVal τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.ptrVal __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.assertEq τ e a b msg r => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    let __do_lift_3 ← Aiur.termToConcrete._unsafe_rec mono r
+    pure (Aiur.Concrete.Term.assertEq __do_lift e __do_lift_1 __do_lift_2 msg __do_lift_3)
+  | Aiur.Typed.Term.ioGetInfo τ e c k => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono c
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono k
+    pure (Aiur.Concrete.Term.ioGetInfo __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.ioSetInfo τ e c k i l r => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono c
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono k
+    let __do_lift_3 ← Aiur.termToConcrete._unsafe_rec mono i
+    let __do_lift_4 ← Aiur.termToConcrete._unsafe_rec mono l
+    let __do_lift_5 ← Aiur.termToConcrete._unsafe_rec mono r
+    pure (Aiur.Concrete.Term.ioSetInfo __do_lift e __do_lift_1 __do_lift_2 __do_lift_3 __do_lift_4 __do_lift_5)
+  | Aiur.Typed.Term.ioRead τ e c i n => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono c
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono i
+    pure (Aiur.Concrete.Term.ioRead __do_lift e __do_lift_1 __do_lift_2 n)
+  | Aiur.Typed.Term.ioWrite τ e c d r => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono c
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono d
+    let __do_lift_3 ← Aiur.termToConcrete._unsafe_rec mono r
+    pure (Aiur.Concrete.Term.ioWrite __do_lift e __do_lift_1 __do_lift_2 __do_lift_3)
+  | Aiur.Typed.Term.u8BitDecomposition τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.u8BitDecomposition __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8ShiftLeft τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.u8ShiftLeft __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8ShiftRight τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.u8ShiftRight __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8Xor τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8Xor __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Add τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8Add __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Mul τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8Mul __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8XorSplit7 τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8XorSplit7 __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8XorSplit4 τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8XorSplit4 __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Sub τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8Sub __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8And τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8And __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Or τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8Or __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8LessThan τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8LessThan __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u32LessThan τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u32LessThan __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedU32Add τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.unconstrainedU32Add __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedU32Add3 τ e a b c => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    let __do_lift_3 ← Aiur.termToConcrete._unsafe_rec mono c
+    pure (Aiur.Concrete.Term.unconstrainedU32Add3 __do_lift e __do_lift_1 __do_lift_2 __do_lift_3)
+  | Aiur.Typed.Term.u32ToField τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.u32ToField __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8RangeCheck τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.u8RangeCheck __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod τ e a b => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    let __do_lift_2 ← Aiur.termToConcrete._unsafe_rec mono b
+    pure (Aiur.Concrete.Term.unconstrainedBigUintDivMod __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedGToBytes τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.unconstrainedGToBytes __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.unconstrainedGInverse τ e a => do
+    let __do_lift ← Aiur.typToConcrete mono τ
+    let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono a
+    pure (Aiur.Concrete.Term.unconstrainedGInverse __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.toField typ escapes a => Aiur.termToConcrete._unsafe_rec mono a
+  | Aiur.Typed.Term.u8FromFieldUnsafe typ escapes a => Aiur.termToConcrete._unsafe_rec mono a
+  | Aiur.Typed.Term.debug τ e l t r =>
+    have __do_jp := fun t' => do
+      let __do_lift ← Aiur.typToConcrete mono τ
+      let __do_lift_1 ← Aiur.termToConcrete._unsafe_rec mono r
+      pure (Aiur.Concrete.Term.debug __do_lift e l t' __do_lift_1);
+    match t with
+    | none => do
+      let t' ← pure none
+      __do_jp t'
+    | some sub => do
+      let __do_lift ← Aiur.termToConcrete._unsafe_rec mono sub
+      let t' ← pure (some __do_lift)
+      __do_jp t'
+RECURSION WORKER Aiur.toIndex._unsafe_rec
+Aiur.LayoutMap →
+  Std.HashMap Aiur.Local (Array Aiur.Bytecode.ValIdx) → Aiur.Concrete.Term → Aiur.CompileM (Array Aiur.Bytecode.ValIdx)
+IMPLEMENTATION
+fun layoutMap bindings term =>
+  match term with
+  | Aiur.Concrete.Term.unit typ escapes => pure #[]
+  | Aiur.Concrete.Term.ret typ escapes sub => throw "ret in value position (should not happen after typechecking)"
+  | Aiur.Concrete.Term.match typ escapes scrut cases defaultOpt =>
+    throw "Non-tail match in arbitrary position (not supported)"
+  | Aiur.Concrete.Term.letLoad typ escapes dst dstTyp src bod =>
+    have __do_jp := fun size =>
+      let ptrIdxs := bindings[src]?.getD #[0];
+      do
+      let loaded ← Aiur.pushOp (Aiur.Bytecode.Op.load size ptrIdxs[0]!) size
+      Aiur.toIndex._unsafe_rec layoutMap (bindings.insert dst loaded) bod;
+    match Aiur.typSize layoutMap dstTyp with
+    | Except.error e => do
+      let size ← throw e
+      __do_jp size
+    | Except.ok n => do
+      let size ← pure n
+      __do_jp size
+  | Aiur.Concrete.Term.var typ escapes name => pure (bindings[name]?.getD #[])
+  | Aiur.Concrete.Term.ref typ escapes name =>
+    match layoutMap[name]? with
+    | some (Aiur.Layout.function layout) => Aiur.pushOp (Aiur.Bytecode.Op.const (Aiur.G.ofNat layout.index))
+    | some (Aiur.Layout.constructor layout) =>
+      let size := layout.size;
+      if layout.tagless = true then
+        if (size == 0) = true then pure #[]
+        else do
+          let __do_lift ← Aiur.pushOp (Aiur.Bytecode.Op.const (Aiur.G.ofNat 0))
+          let padding : Aiur.Bytecode.ValIdx := __do_lift[0]!
+          pure (Array.replicate size padding)
+      else
+        let paddingOp := Aiur.Bytecode.Op.const (Aiur.G.ofNat layout.index);
+        do
+        let index ← Aiur.pushOp paddingOp
+        if index.size < size then do
+            let __do_lift ← Aiur.pushOp paddingOp
+            let padding : Aiur.Bytecode.ValIdx := __do_lift[0]!
+            pure (index ++ Array.replicate (size - index.size) padding)
+          else pure index
+    | x => throw (toString "ref: layout missing for `" ++ toString name ++ toString "`")
+  | Aiur.Concrete.Term.field typ escapes g => Aiur.pushOp (Aiur.Bytecode.Op.const g)
+  | Aiur.Concrete.Term.tuple typ escapes terms =>
+    Array.foldlM
+      (fun acc arg => do
+        let __do_lift ← Aiur.toIndex._unsafe_rec layoutMap bindings arg
+        pure (acc ++ __do_lift))
+      #[] terms
+  | Aiur.Concrete.Term.array typ escapes terms =>
+    Array.foldlM
+      (fun acc arg => do
+        let __do_lift ← Aiur.toIndex._unsafe_rec layoutMap bindings arg
+        pure (acc ++ __do_lift))
+      #[] terms
+  | Aiur.Concrete.Term.letVar typ escapes var val bod => do
+    let val ← Aiur.toIndex._unsafe_rec layoutMap bindings val
+    Aiur.toIndex._unsafe_rec layoutMap (bindings.insert var val) bod
+  | Aiur.Concrete.Term.letWild typ escapes val bod => do
+    let _ ← Aiur.toIndex._unsafe_rec layoutMap bindings val
+    Aiur.toIndex._unsafe_rec layoutMap bindings bod
+  | Aiur.Concrete.Term.add typ escapes a b => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    let b ← Aiur.expectIdx._unsafe_rec layoutMap bindings b
+    Aiur.pushOp (Aiur.Bytecode.Op.add a b)
+  | Aiur.Concrete.Term.sub typ escapes a b => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    let b ← Aiur.expectIdx._unsafe_rec layoutMap bindings b
+    Aiur.pushOp (Aiur.Bytecode.Op.sub a b)
+  | Aiur.Concrete.Term.mul typ escapes a b => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    let b ← Aiur.expectIdx._unsafe_rec layoutMap bindings b
+    Aiur.pushOp (Aiur.Bytecode.Op.mul a b)
+  | Aiur.Concrete.Term.eqZero typ escapes a => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    Aiur.pushOp (Aiur.Bytecode.Op.eqZero a)
+  | Aiur.Concrete.Term.app typ escapes name args unconstrained =>
+    match layoutMap[name]? with
+    | some (Aiur.Layout.function layout) => do
+      let args ← Aiur.buildArgs._unsafe_rec layoutMap bindings args
+      Aiur.pushOp (Aiur.Bytecode.Op.call layout.index args layout.outputSize unconstrained) layout.outputSize
+    | some (Aiur.Layout.constructor layout) =>
+      let size := layout.size;
+      have __do_jp := fun index => do
+        let index ← Aiur.buildArgs._unsafe_rec layoutMap bindings args index
+        if index.size < size then do
+            let __do_lift ← Aiur.pushOp (Aiur.Bytecode.Op.const (Aiur.G.ofNat 0))
+            let padding : Aiur.Bytecode.ValIdx := __do_lift[0]!
+            pure (index ++ Array.replicate (size - index.size) padding)
+          else pure index;
+      if layout.tagless = true then do
+        let index ← pure #[]
+        __do_jp index
+      else do
+        let index ← Aiur.pushOp (Aiur.Bytecode.Op.const (Aiur.G.ofNat layout.index))
+        __do_jp index
+    | x => throw (toString "app: layout missing for `" ++ toString name ++ toString "`")
+  | Aiur.Concrete.Term.proj typ escapes arg i =>
+    have __do_jp := fun typs => do
+      let offset ←
+        Array.foldlM
+            (fun acc typ =>
+              have __do_jp := fun typLen => pure (typLen + acc);
+              match Aiur.typSize layoutMap typ with
+              | Except.error e => do
+                let typLen ← throw e
+                __do_jp typLen
+              | Except.ok len => do
+                let typLen ← pure len
+                __do_jp typLen)
+            0 (typs.extract 0 i)
+      let arg ← Aiur.toIndex._unsafe_rec layoutMap bindings arg
+      have __do_jp : Nat → Aiur.CompileM (Array Aiur.Bytecode.ValIdx) := fun iLen =>
+        pure (arg.extract offset (offset + iLen))
+      match Aiur.typSize layoutMap (typs[i]?.getD Aiur.Concrete.Typ.unit) with
+        | Except.error e => do
+          let iLen ← throw e
+          __do_jp iLen
+        | Except.ok len => do
+          let iLen ← pure len
+          __do_jp iLen;
+    match arg.typ with
+    | Aiur.Concrete.Typ.tuple typs => do
+      let typs ← pure typs
+      __do_jp typs
+    | x => do
+      let typs ← throw "proj on non-tuple"
+      __do_jp typs
+  | Aiur.Concrete.Term.get typ escapes arr i =>
+    have __do_jp := fun eltTyp =>
+      have __do_jp := fun eltSize =>
+        let offset := i * eltSize;
+        do
+        let arr ← Aiur.toIndex._unsafe_rec layoutMap bindings arr
+        pure (arr.extract offset (offset + eltSize));
+      match Aiur.typSize layoutMap eltTyp with
+      | Except.error e => do
+        let eltSize ← throw e
+        __do_jp eltSize
+      | Except.ok len => do
+        let eltSize ← pure len
+        __do_jp eltSize;
+    match arr.typ with
+    | typ.array a => do
+      let eltTyp ← pure typ
+      __do_jp eltTyp
+    | x => do
+      let eltTyp ← throw "get on non-array"
+      __do_jp eltTyp
+  | Aiur.Concrete.Term.slice typ escapes arr i j =>
+    have __do_jp := fun eltTyp =>
+      have __do_jp := fun eltSize => do
+        let arr ← Aiur.toIndex._unsafe_rec layoutMap bindings arr
+        pure (arr.extract (i * eltSize) (j * eltSize));
+      match Aiur.typSize layoutMap eltTyp with
+      | Except.error e => do
+        let eltSize ← throw e
+        __do_jp eltSize
+      | Except.ok len => do
+        let eltSize ← pure len
+        __do_jp eltSize;
+    match arr.typ with
+    | typ.array a => do
+      let eltTyp ← pure typ
+      __do_jp eltTyp
+    | x => do
+      let eltTyp ← throw "slice on non-array"
+      __do_jp eltTyp
+  | Aiur.Concrete.Term.set typ escapes arr i val =>
+    have __do_jp := fun eltTyp =>
+      have __do_jp := fun eltSize => do
+        let val ← Aiur.toIndex._unsafe_rec layoutMap bindings val
+        let arr ← Aiur.toIndex._unsafe_rec layoutMap bindings arr
+        let left : Array Aiur.Bytecode.ValIdx := arr.extract 0 (i * eltSize)
+        let right : Array Aiur.Bytecode.ValIdx := arr.extract ((i + 1) * eltSize)
+        pure (left ++ val ++ right);
+      match Aiur.typSize layoutMap eltTyp with
+      | Except.error e => do
+        let eltSize ← throw e
+        __do_jp eltSize
+      | Except.ok len => do
+        let eltSize ← pure len
+        __do_jp eltSize;
+    match arr.typ with
+    | typ.array a => do
+      let eltTyp ← pure typ
+      __do_jp eltTyp
+    | x => do
+      let eltTyp ← throw "set on non-array"
+      __do_jp eltTyp
+  | Aiur.Concrete.Term.store typ escapes arg => do
+    let args ← Aiur.toIndex._unsafe_rec layoutMap bindings arg
+    Aiur.pushOp (Aiur.Bytecode.Op.store args)
+  | Aiur.Concrete.Term.load typ escapes ptr =>
+    have __do_jp := fun size => do
+      let ptr ← Aiur.expectIdx._unsafe_rec layoutMap bindings ptr
+      Aiur.pushOp (Aiur.Bytecode.Op.load size ptr) size;
+    match ptr.typ with
+    | typ.pointer =>
+      match Aiur.typSize layoutMap typ with
+      | Except.error e => do
+        let size ← throw e
+        __do_jp size
+      | Except.ok len => do
+        let size ← pure len
+        __do_jp size
+    | x => do
+      let size ← throw "load on non-pointer"
+      __do_jp size
+  | Aiur.Concrete.Term.ptrVal typ escapes ptr => Aiur.toIndex._unsafe_rec layoutMap bindings ptr
+  | Aiur.Concrete.Term.assertEq typ escapes a b msg ret => do
+    let a ← Aiur.toIndex._unsafe_rec layoutMap bindings a
+    let b ← Aiur.toIndex._unsafe_rec layoutMap bindings b
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.assertEq a b msg), selIdx := stt.selIdx,
+          degrees := stt.degrees }
+    Aiur.toIndex._unsafe_rec layoutMap bindings ret
+  | Aiur.Concrete.Term.ioGetInfo typ escapes channel key => do
+    let channel ← Aiur.expectIdx._unsafe_rec layoutMap bindings channel
+    let key ← Aiur.toIndex._unsafe_rec layoutMap bindings key
+    Aiur.pushOp (Aiur.Bytecode.Op.ioGetInfo channel key) 2
+  | Aiur.Concrete.Term.ioSetInfo typ escapes channel key idx len ret => do
+    let channel ← Aiur.expectIdx._unsafe_rec layoutMap bindings channel
+    let key ← Aiur.toIndex._unsafe_rec layoutMap bindings key
+    let idx ← Aiur.expectIdx._unsafe_rec layoutMap bindings idx
+    let len ← Aiur.expectIdx._unsafe_rec layoutMap bindings len
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.ioSetInfo channel key idx len),
+          selIdx := stt.selIdx, degrees := stt.degrees }
+    Aiur.toIndex._unsafe_rec layoutMap bindings ret
+  | Aiur.Concrete.Term.ioRead typ escapes channel idx len => do
+    let channel ← Aiur.expectIdx._unsafe_rec layoutMap bindings channel
+    let idx ← Aiur.expectIdx._unsafe_rec layoutMap bindings idx
+    Aiur.pushOp (Aiur.Bytecode.Op.ioRead channel idx len) len
+  | Aiur.Concrete.Term.ioWrite typ escapes channel data ret => do
+    let channel ← Aiur.expectIdx._unsafe_rec layoutMap bindings channel
+    let data ← Aiur.toIndex._unsafe_rec layoutMap bindings data
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.ioWrite channel data), selIdx := stt.selIdx,
+          degrees := stt.degrees }
+    Aiur.toIndex._unsafe_rec layoutMap bindings ret
+  | Aiur.Concrete.Term.u8BitDecomposition typ escapes byte => do
+    let byte ← Aiur.expectIdx._unsafe_rec layoutMap bindings byte
+    Aiur.pushOp (Aiur.Bytecode.Op.u8BitDecomposition byte) 8
+  | Aiur.Concrete.Term.u8ShiftLeft typ escapes byte => do
+    let byte ← Aiur.expectIdx._unsafe_rec layoutMap bindings byte
+    Aiur.pushOp (Aiur.Bytecode.Op.u8ShiftLeft byte)
+  | Aiur.Concrete.Term.u8ShiftRight typ escapes byte => do
+    let byte ← Aiur.expectIdx._unsafe_rec layoutMap bindings byte
+    Aiur.pushOp (Aiur.Bytecode.Op.u8ShiftRight byte)
+  | Aiur.Concrete.Term.u8Xor typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8Xor i j)
+  | Aiur.Concrete.Term.u8Add typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8Add i j) 2
+  | Aiur.Concrete.Term.u8Mul typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8Mul i j) 2
+  | Aiur.Concrete.Term.u8XorSplit7 typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8XorSplit7 i j) 2
+  | Aiur.Concrete.Term.u8XorSplit4 typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8XorSplit4 i j) 2
+  | Aiur.Concrete.Term.u8Sub typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8Sub i j) 2
+  | Aiur.Concrete.Term.u8And typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8And i j)
+  | Aiur.Concrete.Term.u8Or typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8Or i j)
+  | Aiur.Concrete.Term.u8LessThan typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u8LessThan i j)
+  | Aiur.Concrete.Term.u32LessThan typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    Aiur.pushOp (Aiur.Bytecode.Op.u32LessThan i j)
+  | Aiur.Concrete.Term.unconstrainedU32Add typ escapes a b => do
+    let a ← Aiur.toIndex._unsafe_rec layoutMap bindings a
+    let b ← Aiur.toIndex._unsafe_rec layoutMap bindings b
+    Aiur.pushOp (Aiur.Bytecode.Op.unconstrainedU32Add a b) 5
+  | Aiur.Concrete.Term.unconstrainedU32Add3 typ escapes a b c => do
+    let a ← Aiur.toIndex._unsafe_rec layoutMap bindings a
+    let b ← Aiur.toIndex._unsafe_rec layoutMap bindings b
+    let c ← Aiur.toIndex._unsafe_rec layoutMap bindings c
+    Aiur.pushOp (Aiur.Bytecode.Op.unconstrainedU32Add3 a b c) 5
+  | Aiur.Concrete.Term.u32ToField typ escapes a => do
+    let a ← Aiur.toIndex._unsafe_rec layoutMap bindings a
+    Aiur.pushOp (Aiur.Bytecode.Op.u32ToField a)
+  | Aiur.Concrete.Term.u8RangeCheck typ escapes i j => do
+    let i ← Aiur.expectIdx._unsafe_rec layoutMap bindings i
+    let j ← Aiur.expectIdx._unsafe_rec layoutMap bindings j
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.u8RangeCheck i j), selIdx := stt.selIdx,
+          degrees := stt.degrees }
+    pure #[i, j]
+  | Aiur.Concrete.Term.unconstrainedBigUintDivMod typ escapes a b => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    let b ← Aiur.expectIdx._unsafe_rec layoutMap bindings b
+    Aiur.pushOp (Aiur.Bytecode.Op.unconstrainedBigUintDivMod a b) 2
+  | Aiur.Concrete.Term.unconstrainedGToBytes typ escapes a => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    Aiur.pushOp (Aiur.Bytecode.Op.unconstrainedGToBytes a) 8
+  | Aiur.Concrete.Term.unconstrainedGInverse typ escapes a => do
+    let a ← Aiur.expectIdx._unsafe_rec layoutMap bindings a
+    Aiur.pushOp (Aiur.Bytecode.Op.unconstrainedGInverse a)
+  | Aiur.Concrete.Term.debug typ escapes label term ret =>
+    have __do_jp := fun term => do
+      modify fun stt =>
+          { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.debug label term), selIdx := stt.selIdx,
+            degrees := stt.degrees }
+      Aiur.toIndex._unsafe_rec layoutMap bindings ret;
+    match term with
+    | none => do
+      let term ← pure none
+      __do_jp term
+    | some sub => do
+      let __do_lift ← Aiur.toIndex._unsafe_rec layoutMap bindings sub
+      let term ← pure (some __do_lift)
+      __do_jp term
+RECURSION WORKER Aiur.typFlatSizeBound._unsafe_rec
+Aiur.Source.Decls → Nat → Std.HashSet Aiur.Global → Aiur.Typ → Nat
+IMPLEMENTATION
+fun decls x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, x, x_3 => 0
+  | n.succ, x, Aiur.Typ.unit => 0
+  | n.succ, x, Aiur.Typ.field => 1
+  | n.succ, x, Aiur.Typ.u8 => 1
+  | n.succ, x, a.pointer => 1
+  | n.succ, x, Aiur.Typ.function a a_1 => 1
+  | bound.succ, visited, Aiur.Typ.tuple ts =>
+    Array.foldl
+      (fun acc x =>
+        match x with
+        | ⟨t, property⟩ => acc + Aiur.typFlatSizeBound._unsafe_rec decls bound visited t)
+      0 ts.attach
+  | bound.succ, visited, t.array n => n * Aiur.typFlatSizeBound._unsafe_rec decls bound visited t
+  | bound.succ, visited, Aiur.Typ.ref g =>
+    if visited.contains g = true then 0
+    else
+      match IndexMap.getByKey decls g with
+      | some (Aiur.Source.Declaration.dataType dt) =>
+        Aiur.dataTypeFlatSizeBound._unsafe_rec decls bound (visited.insert g) dt
+      | x => 0
+  | bound.succ, visited, Aiur.Typ.app g a =>
+    if visited.contains g = true then 0
+    else
+      match IndexMap.getByKey decls g with
+      | some (Aiur.Source.Declaration.dataType dt) =>
+        Aiur.dataTypeFlatSizeBound._unsafe_rec decls bound (visited.insert g) dt
+      | x => 0
+  | n.succ, x, Aiur.Typ.mvar a => 0
+RECURSION WORKER Aiur.typSize._unsafe_rec
+Aiur.LayoutMap → Aiur.Concrete.Typ → Except String Nat
+IMPLEMENTATION
+fun layoutMap x =>
+  match x with
+  | Aiur.Concrete.Typ.unit => pure 0
+  | Aiur.Concrete.Typ.field => pure 1
+  | a.pointer => pure 1
+  | Aiur.Concrete.Typ.function a a_1 => pure 1
+  | Aiur.Concrete.Typ.tuple ts =>
+    Array.foldlM
+      (fun acc t => do
+        let tSize ← Aiur.typSize._unsafe_rec layoutMap t
+        pure (acc + tSize))
+      0 ts
+  | typ.array n => do
+    let size ← Aiur.typSize._unsafe_rec layoutMap typ
+    pure (n * size)
+  | Aiur.Concrete.Typ.ref g =>
+    match layoutMap[g]? with
+    | some (Aiur.Layout.dataType size) => pure size
+    | x => throw (toString "Layout missing for `" ++ toString g ++ toString "`")
+RECURSION WORKER Aiur.typToConcrete._unsafe_rec
+Std.HashMap (Aiur.Global × Array Aiur.Typ) Aiur.Global → Aiur.Typ → Except Aiur.ConcretizeError Aiur.Concrete.Typ
+IMPLEMENTATION
+fun mono x =>
+  match x with
+  | Aiur.Typ.unit => pure Aiur.Concrete.Typ.unit
+  | Aiur.Typ.field => pure Aiur.Concrete.Typ.field
+  | Aiur.Typ.u8 => pure Aiur.Concrete.Typ.field
+  | Aiur.Typ.tuple ts => do
+    let __do_lift ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.typToConcrete._unsafe_rec mono t)
+          ts.attach
+    pure (Aiur.Concrete.Typ.tuple __do_lift)
+  | t.array n => do
+    let __do_lift ← Aiur.typToConcrete._unsafe_rec mono t
+    pure (__do_lift.array n)
+  | t.pointer => do
+    let __do_lift ← Aiur.typToConcrete._unsafe_rec mono t
+    pure __do_lift.pointer
+  | Aiur.Typ.function ins out => do
+    let ins' ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.typToConcrete._unsafe_rec mono t)
+          ins.attach
+    let out' ← Aiur.typToConcrete._unsafe_rec mono out
+    pure (Aiur.Concrete.Typ.function ins' out')
+  | Aiur.Typ.ref g => pure (Aiur.Concrete.Typ.ref g)
+  | Aiur.Typ.app g args =>
+    match mono[(g, args)]? with
+    | some concName => pure (Aiur.Concrete.Typ.ref concName)
+    | none => pure (Aiur.Concrete.Typ.ref g)
+  | Aiur.Typ.mvar n => Except.error (Aiur.ConcretizeError.unresolvedMVar n)
+RECURSION WORKER Aiur.unifyTypBound._unsafe_rec
+Nat → Aiur.Typ → Aiur.Typ → Aiur.CheckM Bool
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, x, x_3 => pure false
+  | bound.succ, t1, t2 => do
+    let t1 ← Aiur.walkTyp t1
+    let t2 ← Aiur.walkTyp t2
+    match t1, t2 with
+      | Aiur.Typ.mvar a, Aiur.Typ.mvar b =>
+        if (a == b) = true then pure true
+        else do
+          Aiur.bindMVar a (Aiur.Typ.mvar b)
+          pure true
+      | Aiur.Typ.mvar a, x => do
+        Aiur.bindMVar a t2
+        pure true
+      | x, Aiur.Typ.mvar b => do
+        Aiur.bindMVar b t1
+        pure true
+      | Aiur.Typ.unit, Aiur.Typ.unit => pure true
+      | Aiur.Typ.field, Aiur.Typ.field => pure true
+      | Aiur.Typ.u8, Aiur.Typ.u8 => pure true
+      | Aiur.Typ.tuple ts1, Aiur.Typ.tuple ts2 =>
+        if (ts1.size != ts2.size) = true then pure false
+        else
+          Array.allM
+            (fun x =>
+              match x with
+              | (x, y) => Aiur.unifyTypBound._unsafe_rec bound x y)
+            (ts1.zip ts2)
+      | t1'.array n1, t2'.array n2 =>
+        if (n1 != n2) = true then pure false else Aiur.unifyTypBound._unsafe_rec bound t1' t2'
+      | t1'.pointer, t2'.pointer => Aiur.unifyTypBound._unsafe_rec bound t1' t2'
+      | Aiur.Typ.ref g1, Aiur.Typ.ref g2 => pure (g1 == g2)
+      | Aiur.Typ.function ins1 out1, Aiur.Typ.function ins2 out2 =>
+        if (ins1.length != ins2.length) = true then pure false
+        else do
+          let inOk ←
+            List.allM
+                (fun x =>
+                  match x with
+                  | (x, y) => Aiur.unifyTypBound._unsafe_rec bound x y)
+                (ins1.zip ins2)
+          if (!inOk) = true then pure false else Aiur.unifyTypBound._unsafe_rec bound out1 out2
+      | Aiur.Typ.app g1 a1, Aiur.Typ.app g2 a2 =>
+        if (g1 != g2 || a1.size != a2.size) = true then pure false
+        else
+          Array.allM
+            (fun x =>
+              match x with
+              | (x, y) => Aiur.unifyTypBound._unsafe_rec bound x y)
+            (a1.zip a2)
+      | x, x_3 => pure false
+RECURSION WORKER Aiur.walkTypBound._unsafe_rec
+Nat → Std.HashSet Nat → Aiur.Typ → Aiur.CheckM Aiur.Typ
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | bound, visited, Aiur.Typ.mvar id =>
+    if visited.contains id = true then pure (Aiur.Typ.mvar id)
+    else
+      match bound with
+      | 0 => pure (Aiur.Typ.mvar id)
+      | bound.succ => do
+        let __do_lift ← get
+        match __do_lift.mvarSubst[id]? with
+          | some t => Aiur.walkTypBound._unsafe_rec bound (visited.insert id) t
+          | none => pure (Aiur.Typ.mvar id)
+  | x, x_3, t => pure t
+RECURSION WORKER Aiur.zonkTypBound._unsafe_rec
+Nat → Std.HashSet Nat → Aiur.Typ → Aiur.CheckM Aiur.Typ
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | bound, visited, Aiur.Typ.mvar id =>
+    if visited.contains id = true then pure (Aiur.Typ.mvar id)
+    else
+      match bound with
+      | 0 => pure (Aiur.Typ.mvar id)
+      | bound.succ => do
+        let __do_lift ← get
+        match __do_lift.mvarSubst[id]? with
+          | some t => Aiur.zonkTypBound._unsafe_rec bound (visited.insert id) t
+          | none => pure (Aiur.Typ.mvar id)
+  | bound, visited, Aiur.Typ.tuple ts => do
+    let __do_lift ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.zonkTypBound._unsafe_rec bound visited t)
+          ts.attach
+    pure (Aiur.Typ.tuple __do_lift)
+  | bound, visited, t.array n => do
+    let __do_lift ← Aiur.zonkTypBound._unsafe_rec bound visited t
+    pure (__do_lift.array n)
+  | bound, visited, t.pointer => do
+    let __do_lift ← Aiur.zonkTypBound._unsafe_rec bound visited t
+    pure __do_lift.pointer
+  | bound, visited, Aiur.Typ.function ins out => do
+    let __do_lift ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.zonkTypBound._unsafe_rec bound visited t)
+          ins.attach
+    let __do_lift_1 ← Aiur.zonkTypBound._unsafe_rec bound visited out
+    pure (Aiur.Typ.function __do_lift __do_lift_1)
+  | bound, visited, Aiur.Typ.app g args => do
+    let __do_lift ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.zonkTypBound._unsafe_rec bound visited t)
+          args.attach
+    pure (Aiur.Typ.app g __do_lift)
+  | x, x_3, t => pure t
+RECURSION WORKER Aiur.zonkTypedTerm._unsafe_rec
+Aiur.Typed.Term → Aiur.CheckM Aiur.Typed.Term
+IMPLEMENTATION
+fun t =>
+  match t with
+  | Aiur.Typed.Term.unit τ e => do
+    let __do_lift ← Aiur.zonkTyp τ
+    pure (Aiur.Typed.Term.unit __do_lift e)
+  | Aiur.Typed.Term.var τ e l => do
+    let __do_lift ← Aiur.zonkTyp τ
+    pure (Aiur.Typed.Term.var __do_lift e l)
+  | Aiur.Typed.Term.ref τ e g tArgs => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Array.mapM Aiur.zonkTyp tArgs
+    pure (Aiur.Typed.Term.ref __do_lift e g __do_lift_1)
+  | Aiur.Typed.Term.field τ e g => do
+    let __do_lift ← Aiur.zonkTyp τ
+    pure (Aiur.Typed.Term.field __do_lift e g)
+  | Aiur.Typed.Term.tuple τ e ts => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.zonkTypedTerm._unsafe_rec t)
+          ts.attach
+    pure (Aiur.Typed.Term.tuple __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.array τ e ts => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ←
+      Array.mapM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.zonkTypedTerm._unsafe_rec t)
+          ts.attach
+    pure (Aiur.Typed.Term.array __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.ret τ e sub => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec sub
+    pure (Aiur.Typed.Term.ret __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.let τ e pat v b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec v
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.let __do_lift e pat __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.match τ e scrut bs => do
+    let scrut' ← Aiur.zonkTypedTerm._unsafe_rec scrut
+    let bs' ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨(p, b), property⟩ => do
+              let __do_lift ← Aiur.zonkTypedTerm._unsafe_rec b
+              pure (p, __do_lift))
+          bs.attach
+    let __do_lift ← Aiur.zonkTyp τ
+    pure (Aiur.Typed.Term.match __do_lift e scrut' bs')
+  | Aiur.Typed.Term.app τ e g tArgs args u => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Array.mapM Aiur.zonkTyp tArgs
+    let __do_lift_2 ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨a, property⟩ => Aiur.zonkTypedTerm._unsafe_rec a)
+          args.attach
+    pure (Aiur.Typed.Term.app __do_lift e g __do_lift_1 __do_lift_2 u)
+  | Aiur.Typed.Term.add τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.add __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.sub τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.sub __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.mul τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.mul __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.eqZero τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.eqZero __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.proj τ e a n => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.proj __do_lift e __do_lift_1 n)
+  | Aiur.Typed.Term.get τ e a n => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.get __do_lift e __do_lift_1 n)
+  | Aiur.Typed.Term.slice τ e a i j => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.slice __do_lift e __do_lift_1 i j)
+  | Aiur.Typed.Term.set τ e a n v => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec v
+    pure (Aiur.Typed.Term.set __do_lift e __do_lift_1 n __do_lift_2)
+  | Aiur.Typed.Term.store τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.store __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.load τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.load __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.ptrVal τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.ptrVal __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.assertEq τ e a b msg r => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    let __do_lift_3 ← Aiur.zonkTypedTerm._unsafe_rec r
+    pure (Aiur.Typed.Term.assertEq __do_lift e __do_lift_1 __do_lift_2 msg __do_lift_3)
+  | Aiur.Typed.Term.ioGetInfo τ e c k => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec c
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec k
+    pure (Aiur.Typed.Term.ioGetInfo __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.ioSetInfo τ e c k i l r => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec c
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec k
+    let __do_lift_3 ← Aiur.zonkTypedTerm._unsafe_rec i
+    let __do_lift_4 ← Aiur.zonkTypedTerm._unsafe_rec l
+    let __do_lift_5 ← Aiur.zonkTypedTerm._unsafe_rec r
+    pure (Aiur.Typed.Term.ioSetInfo __do_lift e __do_lift_1 __do_lift_2 __do_lift_3 __do_lift_4 __do_lift_5)
+  | Aiur.Typed.Term.ioRead τ e c i n => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec c
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec i
+    pure (Aiur.Typed.Term.ioRead __do_lift e __do_lift_1 __do_lift_2 n)
+  | Aiur.Typed.Term.ioWrite τ e c d r => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec c
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec d
+    let __do_lift_3 ← Aiur.zonkTypedTerm._unsafe_rec r
+    pure (Aiur.Typed.Term.ioWrite __do_lift e __do_lift_1 __do_lift_2 __do_lift_3)
+  | Aiur.Typed.Term.u8BitDecomposition τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.u8BitDecomposition __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8ShiftLeft τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.u8ShiftLeft __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8ShiftRight τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.u8ShiftRight __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8Xor τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8Xor __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Add τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8Add __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Mul τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8Mul __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8XorSplit7 τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8XorSplit7 __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8XorSplit4 τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8XorSplit4 __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Sub τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8Sub __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8And τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8And __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8Or τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8Or __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8LessThan τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8LessThan __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u32LessThan τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u32LessThan __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.u8RangeCheck τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.u8RangeCheck __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedBigUintDivMod τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.unconstrainedBigUintDivMod __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedGToBytes τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.unconstrainedGToBytes __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.unconstrainedGInverse τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.unconstrainedGInverse __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.unconstrainedU32Add τ e a b => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    pure (Aiur.Typed.Term.unconstrainedU32Add __do_lift e __do_lift_1 __do_lift_2)
+  | Aiur.Typed.Term.unconstrainedU32Add3 τ e a b c => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    let __do_lift_2 ← Aiur.zonkTypedTerm._unsafe_rec b
+    let __do_lift_3 ← Aiur.zonkTypedTerm._unsafe_rec c
+    pure (Aiur.Typed.Term.unconstrainedU32Add3 __do_lift e __do_lift_1 __do_lift_2 __do_lift_3)
+  | Aiur.Typed.Term.u32ToField τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.u32ToField __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.toField τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.toField __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.u8FromFieldUnsafe τ e a => do
+    let __do_lift ← Aiur.zonkTyp τ
+    let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec a
+    pure (Aiur.Typed.Term.u8FromFieldUnsafe __do_lift e __do_lift_1)
+  | Aiur.Typed.Term.debug τ e label t r =>
+    have __do_jp := fun t' => do
+      let __do_lift ← Aiur.zonkTyp τ
+      let __do_lift_1 ← Aiur.zonkTypedTerm._unsafe_rec r
+      pure (Aiur.Typed.Term.debug __do_lift e label t' __do_lift_1);
+    match t with
+    | none => do
+      let t' ← pure none
+      __do_jp t'
+    | some sub => do
+      let __do_lift ← Aiur.zonkTypedTerm._unsafe_rec sub
+      let t' ← pure (some __do_lift)
+      __do_jp t'
+RECURSION WORKER Aiur.AIR.addMessages._unsafe_rec
+List Aiur.G → List Aiur.G → List Aiur.G
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], right => right
+  | left, [] => left
+  | x :: left, y :: right => (x + y) :: Aiur.AIR.addMessages._unsafe_rec left right
+RECURSION WORKER Aiur.AIR.emitMembers._unsafe_rec
+(Nat → Aiur.G) →
+  Aiur.G → Nat → Nat → Nat → Aiur.Bytecode.Toplevel → List Aiur.Bytecode.FunIdx → Option (List Aiur.AIR.MemberEmission)
+IMPLEMENTATION
+fun row rank column lookup selectorBase program x =>
+  match x with
+  | [] => some []
+  | index :: indices => do
+    let member ← Aiur.AIR.emitMember row rank column lookup selectorBase program index
+    let rest ←
+      Aiur.AIR.emitMembers._unsafe_rec row rank column lookup (selectorBase + member.function.layout.selectors) program
+          indices
+    pure (member :: rest)
+RECURSION WORKER Aiur.AIR.emitOps._unsafe_rec
+(Nat → Aiur.G) → Aiur.G → Aiur.G → List Aiur.Bytecode.Op → Array Aiur.AIR.RowValue → Nat → Option Aiur.AIR.OpsEmission
+IMPLEMENTATION
+fun row selector rank x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], values, column => some { values := values, column := column }
+  | op :: ops, values, column => do
+    let first ← Aiur.AIR.emitOp (fun i => row (column + i)) selector rank op values
+    let rest ← Aiur.AIR.emitOps._unsafe_rec row selector rank ops (values ++ first.outputs) (column + first.used)
+    pure
+        { values := rest.values, column := rest.column, equations := first.equations ++ rest.equations,
+          queries := first.queries ++ rest.queries, calls := first.calls ++ rest.calls }
+RECURSION WORKER Aiur.Bytecode.beqBranches._unsafe_rec
+Array (Aiur.G × Aiur.Bytecode.Block) → Array (Aiur.G × Aiur.Bytecode.Block) → Bool
+IMPLEMENTATION
+fun left right =>
+  if h : left.size = right.size then Aiur.Bytecode.beqBranchesAux._unsafe_rec left right h left.size ⋯ else false
+RECURSION WORKER Aiur.Bytecode.beqBranchesAux._unsafe_rec
+(left right : Array (Aiur.G × Aiur.Bytecode.Block)) → left.size = right.size → (n : Nat) → n ≤ left.size → Bool
+IMPLEMENTATION
+fun left right hsz x x_1 =>
+  match x, x_1 with
+  | 0, x => true
+  | n.succ, h =>
+    left[n].fst == right[n].fst && Aiur.Bytecode.Block.beq._unsafe_rec left[n].snd right[n].snd &&
+      Aiur.Bytecode.beqBranchesAux._unsafe_rec left right hsz n ⋯
+RECURSION WORKER Aiur.Bytecode.beqFallback._unsafe_rec
+Option Aiur.Bytecode.Block → Option Aiur.Bytecode.Block → Bool
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | none, none => true
+  | some left, some right => Aiur.Bytecode.Block.beq._unsafe_rec left right
+  | x, x_2 => false
+RECURSION WORKER Aiur.Bytecode.checkEmissionOps._unsafe_rec
+List Aiur.Bytecode.Op → Nat → Option Nat
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], available => some available
+  | op :: ops, available =>
+    if (!Aiur.Bytecode.Op.emissionInputs available op) = true then none
+    else do
+      let next ← Aiur.Bytecode.addScope available op.outputSize
+      Aiur.Bytecode.checkEmissionOps._unsafe_rec ops next
+RECURSION WORKER Aiur.Bytecode.collectCalleesBlock._unsafe_rec
+Aiur.Bytecode.Block → Array Aiur.Bytecode.FunIdx
+IMPLEMENTATION
+fun block =>
+  let opCallees := Array.foldl (fun acc op => acc ++ Aiur.Bytecode.collectCalleesOp op) #[] block.ops;
+  opCallees ++ Aiur.Bytecode.collectCalleesCtrl._unsafe_rec block.ctrl
+RECURSION WORKER Aiur.Bytecode.collectCalleesCtrl._unsafe_rec
+Aiur.Bytecode.Ctrl → Array Aiur.Bytecode.FunIdx
+IMPLEMENTATION
+fun c =>
+  match c with
+  | Aiur.Bytecode.Ctrl.match a branches def_ =>
+    let branchCallees :=
+      Array.foldl
+        (fun acc x =>
+          match x with
+          | ⟨(fst, b), property⟩ => acc ++ Aiur.Bytecode.collectCalleesBlock._unsafe_rec b)
+        #[] branches.attach;
+    match def_ with
+    | none => branchCallees
+    | some b => branchCallees ++ Aiur.Bytecode.collectCalleesBlock._unsafe_rec b
+  | Aiur.Bytecode.Ctrl.return a a_1 => #[]
+  | Aiur.Bytecode.Ctrl.yield a a_1 => #[]
+  | Aiur.Bytecode.Ctrl.matchContinue a branches def_ outputSize sharedAuxiliaries sharedLookups cont =>
+    let branchCallees :=
+      Array.foldl
+        (fun acc x =>
+          match x with
+          | ⟨(fst, b), property⟩ => acc ++ Aiur.Bytecode.collectCalleesBlock._unsafe_rec b)
+        #[] branches.attach;
+    let withDefault :=
+      match def_ with
+      | none => branchCallees
+      | some b => branchCallees ++ Aiur.Bytecode.collectCalleesBlock._unsafe_rec b;
+    withDefault ++ Aiur.Bytecode.collectCalleesBlock._unsafe_rec cont
+RECURSION WORKER Aiur.Bytecode.partitionRefineBound._unsafe_rec
+Nat → Array Nat → Array (Array Aiur.Bytecode.FunIdx) → Array Nat
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, classes, x => classes
+  | bound.succ, classes, callees =>
+    let signatures :=
+      Array.mapIdx (fun i cls => (cls, Array.map (fun callee => classes[callee]?.getD 0) (callees[i]?.getD #[])))
+        classes;
+    match Aiur.Bytecode.assignClasses signatures with
+    | (newClasses, snd) =>
+      if (newClasses == classes) = true then classes
+      else Aiur.Bytecode.partitionRefineBound._unsafe_rec bound newClasses callees
+RECURSION WORKER Aiur.Bytecode.rewriteBlock._unsafe_rec
+(Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) → Aiur.Bytecode.Block → Aiur.Bytecode.Block
+IMPLEMENTATION
+fun f block =>
+  { ops := Array.map (Aiur.Bytecode.rewriteOp f) block.ops, ctrl := Aiur.Bytecode.rewriteCtrl._unsafe_rec f block.ctrl }
+RECURSION WORKER Aiur.Bytecode.rewriteCtrl._unsafe_rec
+(Aiur.Bytecode.FunIdx → Aiur.Bytecode.FunIdx) → Aiur.Bytecode.Ctrl → Aiur.Bytecode.Ctrl
+IMPLEMENTATION
+fun f c =>
+  match c with
+  | Aiur.Bytecode.Ctrl.match v branches def_ =>
+    Aiur.Bytecode.Ctrl.match v
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨(g, b), property⟩ => (g, Aiur.Bytecode.rewriteBlock._unsafe_rec f b))
+        branches.attach)
+      (match def_ with
+      | none => none
+      | some b => some (Aiur.Bytecode.rewriteBlock._unsafe_rec f b))
+  | Aiur.Bytecode.Ctrl.return s vs => Aiur.Bytecode.Ctrl.return s vs
+  | Aiur.Bytecode.Ctrl.yield s vs => Aiur.Bytecode.Ctrl.yield s vs
+  | Aiur.Bytecode.Ctrl.matchContinue v branches def_ outputSize sharedAux sharedLookups cont =>
+    Aiur.Bytecode.Ctrl.matchContinue v
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨(g, b), property⟩ => (g, Aiur.Bytecode.rewriteBlock._unsafe_rec f b))
+        branches.attach)
+      (match def_ with
+      | none => none
+      | some b => some (Aiur.Bytecode.rewriteBlock._unsafe_rec f b))
+      outputSize sharedAux sharedLookups (Aiur.Bytecode.rewriteBlock._unsafe_rec f cont)
+RECURSION WORKER Aiur.Bytecode.skeletonBlock._unsafe_rec
+Aiur.Bytecode.Block → Aiur.Bytecode.Block
+IMPLEMENTATION
+fun block =>
+  { ops := Array.map Aiur.Bytecode.skeletonOp block.ops, ctrl := Aiur.Bytecode.skeletonCtrl._unsafe_rec block.ctrl }
+RECURSION WORKER Aiur.Bytecode.skeletonCtrl._unsafe_rec
+Aiur.Bytecode.Ctrl → Aiur.Bytecode.Ctrl
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.match v branches def_ =>
+    Aiur.Bytecode.Ctrl.match v
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨(g, b), property⟩ => (g, Aiur.Bytecode.skeletonBlock._unsafe_rec b))
+        branches.attach)
+      (match def_ with
+      | none => none
+      | some b => some (Aiur.Bytecode.skeletonBlock._unsafe_rec b))
+  | Aiur.Bytecode.Ctrl.return s vs => Aiur.Bytecode.Ctrl.return s vs
+  | Aiur.Bytecode.Ctrl.yield s vs => Aiur.Bytecode.Ctrl.yield s vs
+  | Aiur.Bytecode.Ctrl.matchContinue v branches def_ outputSize sharedAux sharedLookups cont =>
+    Aiur.Bytecode.Ctrl.matchContinue v
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨(g, b), property⟩ => (g, Aiur.Bytecode.skeletonBlock._unsafe_rec b))
+        branches.attach)
+      (match def_ with
+      | none => none
+      | some b => some (Aiur.Bytecode.skeletonBlock._unsafe_rec b))
+      outputSize sharedAux sharedLookups (Aiur.Bytecode.skeletonBlock._unsafe_rec cont)
+RECURSION WORKER Aiur.Concrete.addCase._unsafe_rec
+Aiur.LayoutMap →
+  Std.HashMap Aiur.Local (Array Aiur.Bytecode.ValIdx) →
+    Aiur.Concrete.Typ →
+      Array Aiur.Bytecode.ValIdx →
+        optParam Bool false →
+          Array (Aiur.G × Aiur.Bytecode.Block) × Option Aiur.Bytecode.Block →
+            Aiur.Concrete.Pattern × Aiur.Concrete.Term →
+              Aiur.CompileM (Array (Aiur.G × Aiur.Bytecode.Block) × Option Aiur.Bytecode.Block)
+IMPLEMENTATION
+fun layoutMap bindings returnTyp idxs yieldCtrl x x_1 =>
+  match x with
+  | (cases, defaultBlock) =>
+    match x_1 with
+    | (pat, term) =>
+      match pat with
+      | Aiur.Concrete.Pattern.field g => do
+        let initState ← get
+        let term ← Aiur.Concrete.Term.compile._unsafe_rec term returnTyp layoutMap bindings yieldCtrl
+        let __do_lift ← get
+        set
+            { valIdx := initState.valIdx, ops := initState.ops, selIdx := __do_lift.selIdx,
+              degrees := initState.degrees }
+        pure (cases.push (g, term), defaultBlock)
+      | Aiur.Concrete.Pattern.ref global pats =>
+        have __do_jp := fun __x =>
+          match __x with
+          | (index, offsets, tagless) =>
+            let base := if tagless = true then 0 else 1;
+            let ptrBindings :=
+              Array.foldl
+                (fun acc i =>
+                  let startOff := base + offsets[i]?.getD 0;
+                  let endOff := base + offsets[i + 1]?.getD (offsets[i]?.getD 0);
+                  let slice := idxs.extract startOff endOff;
+                  let patLocal := pats[i]?.getD (Aiur.Local.idx 0);
+                  acc.insert patLocal slice)
+                bindings (Array.range pats.size);
+            do
+            let initState ← get
+            let term ← Aiur.Concrete.Term.compile._unsafe_rec term returnTyp layoutMap ptrBindings yieldCtrl
+            let __do_lift ← get
+            set
+                { valIdx := initState.valIdx, ops := initState.ops, selIdx := __do_lift.selIdx,
+                  degrees := initState.degrees }
+            if tagless = true then pure (cases, some term)
+              else pure (cases.push (Aiur.G.ofNat index, term), defaultBlock);
+        match layoutMap[global]? with
+        | some (Aiur.Layout.function layout) => do
+          let __x ← pure (layout.index, layout.offsets, false)
+          __do_jp __x
+        | some (Aiur.Layout.constructor layout) => do
+          let __x ← pure (layout.index, layout.offsets, layout.tagless)
+          __do_jp __x
+        | x => do
+          let __x ← throw (toString "addCase: layout missing for `" ++ toString global ++ toString "`")
+          __do_jp __x
+      | Aiur.Concrete.Pattern.wildcard => do
+        let initState ← get
+        let term ← Aiur.Concrete.Term.compile._unsafe_rec term returnTyp layoutMap bindings yieldCtrl
+        let __do_lift ← get
+        set
+            { valIdx := initState.valIdx, ops := initState.ops, selIdx := __do_lift.selIdx,
+              degrees := initState.degrees }
+        pure (cases, some term)
+      | x => throw "addCase: unsupported pattern in concrete lower"
+RECURSION WORKER Aiur.G.product._unsafe_rec
+List Aiur.G → Aiur.G
+IMPLEMENTATION
+fun x =>
+  match x with
+  | [] => 1
+  | value :: values => value * Aiur.G.product._unsafe_rec values
+RECURSION WORKER Aiur.GoldilocksProof.squareMod._unsafe_rec
+Nat → Nat → Nat → Nat
+IMPLEMENTATION
+fun modulus base x =>
+  match x with
+  | 0 => base % modulus
+  | n.succ =>
+    let previous := Aiur.GoldilocksProof.squareMod._unsafe_rec modulus base n;
+    previous * previous % modulus
+RECURSION WORKER Aiur.MatchCompiler.compileRowsBound._unsafe_rec
+Nat → Array Aiur.MatchCompiler.Row → Aiur.MatchCompiler.CompilerM Aiur.MatchCompiler.Decision
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | 0, x => do
+    Aiur.MatchCompiler.modifyDiagnostics fun d => { missing := true, reachable := d.reachable }
+    pure Aiur.MatchCompiler.Decision.failure
+  | bound.succ, rows =>
+    match rows[0]? with
+    | some row =>
+      match row.clauses[0]? with
+      | some clause => Aiur.MatchCompiler.compileSwitchBound._unsafe_rec bound rows clause.body
+      | none => do
+        Aiur.MatchCompiler.modifyDiagnostics fun d =>
+            { missing := d.missing, reachable := row.body.value :: d.reachable }
+        pure (Aiur.MatchCompiler.Decision.success row.body)
+    | none => do
+      Aiur.MatchCompiler.modifyDiagnostics fun d => { missing := true, reachable := d.reachable }
+      pure Aiur.MatchCompiler.Decision.failure
+RECURSION WORKER Aiur.MatchCompiler.compileSwitchBound._unsafe_rec
+Nat →
+  Array Aiur.MatchCompiler.Row → Aiur.MatchCompiler.UniqTerm → Aiur.MatchCompiler.CompilerM Aiur.MatchCompiler.Decision
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, x, x_3 => pure Aiur.MatchCompiler.Decision.failure
+  | bound.succ, rows, term => do
+    let stt ← get
+    let numCases : Nat := Aiur.MatchCompiler.patTypeLength stt.decls rows[0]!.clauses[0]!.pat
+    let spatMap : SmallMap Aiur.MatchCompiler.SPattern (Array Aiur.MatchCompiler.Row) :=
+      Aiur.MatchCompiler.extractSPatterns rows term
+    let size : Nat := spatMap.size
+    if (size == numCases) = true then do
+        let __x ← Array.foldlM (Aiur.MatchCompiler.processRow✝ term) (spatMap, #[]) rows
+        match __x with
+          | (rowMap, snd) => do
+            let cases ←
+              List.mapM
+                  (fun x =>
+                    match x with
+                    | (pat, rows) => Prod.mk pat <$> Aiur.MatchCompiler.compileRowsBound._unsafe_rec bound rows)
+                  rowMap.toList
+            Aiur.MatchCompiler.setId stt.uniqId
+            pure (Aiur.MatchCompiler.switch cases Aiur.MatchCompiler.Decision.failure term)
+      else do
+        let __x ← Array.foldlM (Aiur.MatchCompiler.processRow✝ term) (spatMap, #[]) rows
+        match __x with
+          | (rowMap, fallbackRows) => do
+            let cases ←
+              List.mapM
+                  (fun x =>
+                    match x with
+                    | (pat, rows) => Prod.mk pat <$> Aiur.MatchCompiler.compileRowsBound._unsafe_rec bound rows)
+                  rowMap.toList
+            let fallback ← Aiur.MatchCompiler.compileRowsBound._unsafe_rec bound fallbackRows
+            Aiur.MatchCompiler.setId stt.uniqId
+            pure (Aiur.MatchCompiler.switch cases fallback term)
+RECURSION WORKER Aiur.MatchCompiler.decisionToTyped._unsafe_rec
+Aiur.Typ → Aiur.Typ → Aiur.MatchCompiler.Decision → Option Aiur.Typed.Term
+IMPLEMENTATION
+fun retTyp scrutTyp x =>
+  match x with
+  | Aiur.MatchCompiler.Decision.failure => none
+  | Aiur.MatchCompiler.Decision.success { renames := renames, value := value } =>
+    some
+      (Array.foldr
+        (fun x acc =>
+          match x with
+          | (x, term) => Aiur.Typed.Term.let acc.typ acc.escapes (Aiur.Pattern.var x) term acc)
+        value renames)
+  | Aiur.MatchCompiler.Decision.switch ptr a [(Aiur.MatchCompiler.SPattern.pointer val innerTyp, body)] a_1 =>
+    match Aiur.MatchCompiler.decisionToTyped._unsafe_rec retTyp innerTyp body with
+    | none => none
+    | some body' =>
+      let loadTerm := Aiur.Typed.Term.load innerTyp false (Aiur.Typed.Term.var innerTyp.pointer false ptr);
+      some (Aiur.Typed.Term.let body'.typ body'.escapes (Aiur.Pattern.var val) loadTerm body')
+  | Aiur.MatchCompiler.Decision.switch var switchTyp branches dflt =>
+    let defaultOpt := Aiur.MatchCompiler.decisionToTyped._unsafe_rec retTyp switchTyp dflt;
+    do
+    let cases ←
+      List.foldlM
+          (fun acc x =>
+            match x with
+            | ⟨(spat, tree), property⟩ =>
+              match Aiur.MatchCompiler.sPatternToTypedPattern spat with
+              | none => none
+              | some pat => do
+                let body ← Aiur.MatchCompiler.decisionToTyped._unsafe_rec retTyp switchTyp tree
+                pure (acc.push (pat, body)))
+          #[] branches.attach
+    let casesList : List (Aiur.Pattern × Aiur.Typed.Term) := cases.toList
+    let casesList : List (Aiur.Pattern × Aiur.Typed.Term) :=
+      match defaultOpt with
+      | some d => casesList ++ [(Aiur.Pattern.wildcard, d)]
+      | none => casesList
+    some (Aiur.Typed.Term.match retTyp false (Aiur.Typed.Term.var switchTyp false var) casesList)
+  | Aiur.MatchCompiler.Decision.letLoad dst dstTyp src body =>
+    match Aiur.MatchCompiler.decisionToTyped._unsafe_rec retTyp scrutTyp body with
+    | none => none
+    | some body' =>
+      let loadTerm := Aiur.Typed.Term.load dstTyp false (Aiur.Typed.Term.var dstTyp.pointer false src);
+      some (Aiur.Typed.Term.let body'.typ body'.escapes (Aiur.Pattern.var dst) loadTerm body')
+  | Aiur.MatchCompiler.Decision.let var term body =>
+    match Aiur.MatchCompiler.decisionToTyped._unsafe_rec retTyp scrutTyp body with
+    | none => none
+    | some body' => some (Aiur.Typed.Term.let body'.typ body'.escapes (Aiur.Pattern.var var) term body')
+RECURSION WORKER Aiur.NativeAIR.checkNodes._unsafe_rec
+Aiur.NativeAIR.GraphWidths → Nat → Nat → List Aiur.NativeAIR.Node → Bool
+IMPLEMENTATION
+fun widths lookupEnd x x_1 =>
+  match x, x_1 with
+  | x, [] => true
+  | index, node :: nodes =>
+    Aiur.NativeAIR.Node.check widths lookupEnd index node &&
+      Aiur.NativeAIR.checkNodes._unsafe_rec widths lookupEnd (index + 1) nodes
+RECURSION WORKER Aiur.NativeAIR.sweepFrom._unsafe_rec
+{W : Type u_1} →
+  Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → List Aiur.NativeAIR.Node → Array W → Option (Array W)
+IMPLEMENTATION
+fun {W} ops values x x_1 =>
+  match x, x_1 with
+  | [], buffer => some buffer
+  | node :: nodes, buffer => do
+    let value ← Aiur.NativeAIR.Node.eval ops values buffer node
+    Aiur.NativeAIR.sweepFrom._unsafe_rec ops values nodes (buffer.push value)
+RECURSION WORKER Aiur.NativeAIR.unfoldFrom._unsafe_rec
+List Aiur.NativeAIR.Node → Array Aiur.NativeAIR.Expr → Option (Array Aiur.NativeAIR.Expr)
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], trees => some trees
+  | node :: nodes, trees => do
+    let expr ← Aiur.NativeAIR.Node.unfold trees node
+    Aiur.NativeAIR.unfoldFrom._unsafe_rec nodes (trees.push expr)
+RECURSION WORKER Aiur.Source.inlineTopo._unsafe_rec
+Std.HashMap Aiur.Global (List Aiur.Global) →
+  Nat → List Aiur.Global → Std.HashSet Aiur.Global → List Aiur.Global → Except String (List Aiur.Global)
+IMPLEMENTATION
+fun deps x x_1 x_2 x_3 =>
+  match x, x_1, x_2, x_3 with
+  | 0, remaining, x, acc =>
+    if remaining.isEmpty = true then pure acc else throw "inline recursion: dependency graph did not converge"
+  | rounds.succ, remaining, emitted, acc =>
+    match remaining with
+    | [] => pure acc
+    | x =>
+      match List.partition (fun g => (deps.getD g []).all emitted.contains) remaining with
+      | (ready, notReady) =>
+        match ready with
+        | [] => throw (toString "inline recursion among: " ++ toString (List.map Aiur.Global.toName remaining))
+        | x =>
+          let emitted := List.foldl (fun s g => s.insert g) emitted ready;
+          Aiur.Source.inlineTopo._unsafe_rec deps rounds notReady emitted (acc ++ ready)
+RECURSION WORKER Aiur.Typ.appendNameLimbs._unsafe_rec
+Aiur.Global → Aiur.Typ → Aiur.Global
+IMPLEMENTATION
+fun g x =>
+  match x with
+  | Aiur.Typ.field => g.pushNamespace "G"
+  | Aiur.Typ.u8 => g.pushNamespace "U8"
+  | Aiur.Typ.unit => g.pushNamespace "Unit"
+  | Aiur.Typ.ref g' => Aiur.Typ.appendNameLimbs.pushAll g g'.toName
+  | t.pointer => Aiur.Typ.appendNameLimbs._unsafe_rec (g.pushNamespace "Ptr") t
+  | Aiur.Typ.tuple ts =>
+    Array.foldl
+      (fun acc x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.Typ.appendNameLimbs._unsafe_rec acc t)
+      (g.pushNamespace "Tup") ts.attach
+  | t.array n => g.pushNamespace (t.toFlatName ++ "_" ++ toString n)
+  | Aiur.Typ.function a a_1 => g.pushNamespace "Fn"
+  | Aiur.Typ.app name args =>
+    Array.foldl
+      (fun acc x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.Typ.appendNameLimbs._unsafe_rec acc t)
+      (Aiur.Typ.appendNameLimbs._unsafe_rec g (Aiur.Typ.ref name)) args.attach
+  | Aiur.Typ.mvar id => g.pushNamespace (toString "?" ++ toString id)
+RECURSION WORKER Aiur.Typ.beq._unsafe_rec
+Aiur.Typ → Aiur.Typ → Bool
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | Aiur.Typ.unit, Aiur.Typ.unit => true
+  | Aiur.Typ.field, Aiur.Typ.field => true
+  | Aiur.Typ.u8, Aiur.Typ.u8 => true
+  | Aiur.Typ.tuple ts, Aiur.Typ.tuple ts' =>
+    if hsz : ts.size = ts'.size then (List.finRange ts.size).all fun i => Aiur.Typ.beq._unsafe_rec ts[↑i] ts'[↑i]
+    else false
+  | t.array n, t'.array n' => Aiur.Typ.beq._unsafe_rec t t' && n == n'
+  | t.pointer, t'.pointer => Aiur.Typ.beq._unsafe_rec t t'
+  | Aiur.Typ.ref g, Aiur.Typ.ref g' => g == g'
+  | Aiur.Typ.app g args, Aiur.Typ.app g' args' =>
+    g == g' &&
+      if hsz : args.size = args'.size then
+        (List.finRange args.size).all fun i => Aiur.Typ.beq._unsafe_rec args[↑i] args'[↑i]
+      else false
+  | Aiur.Typ.function ins out, Aiur.Typ.function ins' out' =>
+    Aiur.Typ.beq._unsafe_rec out out' && Aiur.Typ.beq.listBeqAux._unsafe_rec ins ins'
+  | Aiur.Typ.mvar n, Aiur.Typ.mvar n' => n == n'
+  | x, x_2 => false
+RECURSION WORKER Aiur.Typ.hasPointer._unsafe_rec
+Aiur.Typ → Bool
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Typ.unit => false
+  | Aiur.Typ.field => false
+  | Aiur.Typ.u8 => false
+  | Aiur.Typ.ref a => false
+  | Aiur.Typ.mvar a => false
+  | a.pointer => true
+  | Aiur.Typ.tuple ts =>
+    ts.attach.any fun x =>
+      match x with
+      | ⟨t, property⟩ => Aiur.Typ.hasPointer._unsafe_rec t
+  | t.array a => Aiur.Typ.hasPointer._unsafe_rec t
+  | Aiur.Typ.app a args =>
+    args.attach.any fun x =>
+      match x with
+      | ⟨t, property⟩ => Aiur.Typ.hasPointer._unsafe_rec t
+  | Aiur.Typ.function ins out =>
+    Aiur.Typ.hasPointer._unsafe_rec out ||
+      ins.attach.any fun x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.Typ.hasPointer._unsafe_rec t
+RECURSION WORKER Aiur.Typ.instantiate._unsafe_rec
+(Aiur.Global → Option Aiur.Typ) → Aiur.Typ → Aiur.Typ
+IMPLEMENTATION
+fun subst x =>
+  match x with
+  | Aiur.Typ.unit => Aiur.Typ.unit
+  | Aiur.Typ.field => Aiur.Typ.field
+  | Aiur.Typ.u8 => Aiur.Typ.u8
+  | Aiur.Typ.tuple ts =>
+    Aiur.Typ.tuple
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.Typ.instantiate._unsafe_rec subst t)
+        ts.attach)
+  | t.array n => (Aiur.Typ.instantiate._unsafe_rec subst t).array n
+  | t.pointer => (Aiur.Typ.instantiate._unsafe_rec subst t).pointer
+  | Aiur.Typ.ref g => (subst g).getD (Aiur.Typ.ref g)
+  | Aiur.Typ.app g args =>
+    Aiur.Typ.app g
+      (Array.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.Typ.instantiate._unsafe_rec subst t)
+        args.attach)
+  | Aiur.Typ.function ins out =>
+    Aiur.Typ.function
+      (List.map
+        (fun x =>
+          match x with
+          | ⟨t, property⟩ => Aiur.Typ.instantiate._unsafe_rec subst t)
+        ins.attach)
+      (Aiur.Typ.instantiate._unsafe_rec subst out)
+  | Aiur.Typ.mvar n => Aiur.Typ.mvar n
+RECURSION WORKER Aiur.Typ.nodeCount._unsafe_rec
+Aiur.Typ → Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Typ.unit => 1
+  | Aiur.Typ.field => 1
+  | Aiur.Typ.u8 => 1
+  | Aiur.Typ.mvar a => 1
+  | Aiur.Typ.ref a => 1
+  | t.pointer => 1 + Aiur.Typ.nodeCount._unsafe_rec t
+  | t.array a => 1 + Aiur.Typ.nodeCount._unsafe_rec t
+  | Aiur.Typ.tuple ts =>
+    1 +
+      Array.foldl
+        (fun acc x =>
+          match x with
+          | ⟨t, property⟩ => acc + Aiur.Typ.nodeCount._unsafe_rec t)
+        0 ts.attach
+  | Aiur.Typ.function ins out =>
+    1 + Aiur.Typ.nodeCount._unsafe_rec out + List.foldl (fun acc t => acc + Aiur.Typ.nodeCount._unsafe_rec t) 0 ins
+  | Aiur.Typ.app a args =>
+    1 +
+      Array.foldl
+        (fun acc x =>
+          match x with
+          | ⟨t, property⟩ => acc + Aiur.Typ.nodeCount._unsafe_rec t)
+        0 args.attach
+RECURSION WORKER Aiur.Typ.toFlatName._unsafe_rec
+Aiur.Typ → String
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Typ.field => "G"
+  | Aiur.Typ.u8 => "U8"
+  | Aiur.Typ.unit => "Unit"
+  | Aiur.Typ.ref g => g.toName.toString false
+  | t.pointer => "Ptr_" ++ Aiur.Typ.toFlatName._unsafe_rec t
+  | Aiur.Typ.tuple ts =>
+    "Tup_" ++
+      "_".intercalate
+        (Array.map
+            (fun x =>
+              match x with
+              | ⟨t, property⟩ => Aiur.Typ.toFlatName._unsafe_rec t)
+            ts.attach).toList
+  | t.array n => Aiur.Typ.toFlatName._unsafe_rec t ++ "_" ++ toString n
+  | Aiur.Typ.function a a_1 => "Fn"
+  | Aiur.Typ.app name args =>
+    name.toName.toString false ++ "_" ++
+      "_".intercalate
+        (Array.map
+            (fun x =>
+              match x with
+              | ⟨t, property⟩ => Aiur.Typ.toFlatName._unsafe_rec t)
+            args.attach).toList
+  | Aiur.Typ.mvar id => toString "?" ++ toString id
+RECURSION WORKER Aiur.Value.arrayDecEq._unsafe_rec
+(a b : Array Aiur.Value) → Decidable (a = b)
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | { toList := as }, { toList := bs } =>
+    match Aiur.Value.listDecEq._unsafe_rec as bs with
+    | isTrue h => isTrue ⋯
+    | isFalse h => isFalse ⋯
+RECURSION WORKER Aiur.Value.decEq._unsafe_rec
+(a b : Aiur.Value) → Decidable (a = b)
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | Aiur.Value.unit, Aiur.Value.unit => isTrue ⋯
+  | Aiur.Value.field g₁, Aiur.Value.field g₂ => if h : g₁ = g₂ then isTrue ⋯ else isFalse ⋯
+  | Aiur.Value.tuple vs₁, Aiur.Value.tuple vs₂ =>
+    match Aiur.Value.arrayDecEq._unsafe_rec vs₁ vs₂ with
+    | isTrue h => isTrue ⋯
+    | isFalse h => isFalse ⋯
+  | Aiur.Value.array vs₁, Aiur.Value.array vs₂ =>
+    match Aiur.Value.arrayDecEq._unsafe_rec vs₁ vs₂ with
+    | isTrue h => isTrue ⋯
+    | isFalse h => isFalse ⋯
+  | Aiur.Value.ctor g₁ vs₁, Aiur.Value.ctor g₂ vs₂ =>
+    if hg : g₁ = g₂ then
+      match Aiur.Value.arrayDecEq._unsafe_rec vs₁ vs₂ with
+      | isTrue hvs => isTrue ⋯
+      | isFalse hvs => isFalse ⋯
+    else isFalse ⋯
+  | Aiur.Value.fn g₁, Aiur.Value.fn g₂ => if h : g₁ = g₂ then isTrue ⋯ else isFalse ⋯
+  | Aiur.Value.pointer w₁ n₁, Aiur.Value.pointer w₂ n₂ =>
+    if hw : w₁ = w₂ then if hn : n₁ = n₂ then isTrue ⋯ else isFalse ⋯ else isFalse ⋯
+  | Aiur.Value.unit, Aiur.Value.field a => isFalse ⋯
+  | Aiur.Value.unit, Aiur.Value.tuple a => isFalse ⋯
+  | Aiur.Value.unit, Aiur.Value.array a => isFalse ⋯
+  | Aiur.Value.unit, Aiur.Value.ctor a a_1 => isFalse ⋯
+  | Aiur.Value.unit, Aiur.Value.fn a => isFalse ⋯
+  | Aiur.Value.unit, Aiur.Value.pointer width index => isFalse ⋯
+  | Aiur.Value.field a, Aiur.Value.unit => isFalse ⋯
+  | Aiur.Value.field a, Aiur.Value.tuple a_1 => isFalse ⋯
+  | Aiur.Value.field a, Aiur.Value.array a_1 => isFalse ⋯
+  | Aiur.Value.field a, Aiur.Value.ctor a_1 a_2 => isFalse ⋯
+  | Aiur.Value.field a, Aiur.Value.fn a_1 => isFalse ⋯
+  | Aiur.Value.field a, Aiur.Value.pointer width index => isFalse ⋯
+  | Aiur.Value.tuple a, Aiur.Value.unit => isFalse ⋯
+  | Aiur.Value.tuple a, Aiur.Value.field a_1 => isFalse ⋯
+  | Aiur.Value.tuple a, Aiur.Value.array a_1 => isFalse ⋯
+  | Aiur.Value.tuple a, Aiur.Value.ctor a_1 a_2 => isFalse ⋯
+  | Aiur.Value.tuple a, Aiur.Value.fn a_1 => isFalse ⋯
+  | Aiur.Value.tuple a, Aiur.Value.pointer width index => isFalse ⋯
+  | Aiur.Value.array a, Aiur.Value.unit => isFalse ⋯
+  | Aiur.Value.array a, Aiur.Value.field a_1 => isFalse ⋯
+  | Aiur.Value.array a, Aiur.Value.tuple a_1 => isFalse ⋯
+  | Aiur.Value.array a, Aiur.Value.ctor a_1 a_2 => isFalse ⋯
+  | Aiur.Value.array a, Aiur.Value.fn a_1 => isFalse ⋯
+  | Aiur.Value.array a, Aiur.Value.pointer width index => isFalse ⋯
+  | Aiur.Value.ctor a a_1, Aiur.Value.unit => isFalse ⋯
+  | Aiur.Value.ctor a a_1, Aiur.Value.field a_2 => isFalse ⋯
+  | Aiur.Value.ctor a a_1, Aiur.Value.tuple a_2 => isFalse ⋯
+  | Aiur.Value.ctor a a_1, Aiur.Value.array a_2 => isFalse ⋯
+  | Aiur.Value.ctor a a_1, Aiur.Value.fn a_2 => isFalse ⋯
+  | Aiur.Value.ctor a a_1, Aiur.Value.pointer width index => isFalse ⋯
+  | Aiur.Value.fn a, Aiur.Value.unit => isFalse ⋯
+  | Aiur.Value.fn a, Aiur.Value.field a_1 => isFalse ⋯
+  | Aiur.Value.fn a, Aiur.Value.tuple a_1 => isFalse ⋯
+  | Aiur.Value.fn a, Aiur.Value.array a_1 => isFalse ⋯
+  | Aiur.Value.fn a, Aiur.Value.ctor a_1 a_2 => isFalse ⋯
+  | Aiur.Value.fn a, Aiur.Value.pointer width index => isFalse ⋯
+  | Aiur.Value.pointer width index, Aiur.Value.unit => isFalse ⋯
+  | Aiur.Value.pointer width index, Aiur.Value.field a => isFalse ⋯
+  | Aiur.Value.pointer width index, Aiur.Value.tuple a => isFalse ⋯
+  | Aiur.Value.pointer width index, Aiur.Value.array a => isFalse ⋯
+  | Aiur.Value.pointer width index, Aiur.Value.ctor a a_1 => isFalse ⋯
+  | Aiur.Value.pointer width index, Aiur.Value.fn a => isFalse ⋯
+RECURSION WORKER Aiur.Value.hash._unsafe_rec
+Aiur.Value → UInt64
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Value.unit => 0
+  | Aiur.Value.field g => mixHash 1 (hash g)
+  | Aiur.Value.tuple values =>
+    mixHash 2 (Array.foldl (fun acc value => mixHash acc (Aiur.Value.hash._unsafe_rec value.val)) 7 values.attach)
+  | Aiur.Value.array values =>
+    mixHash 3 (Array.foldl (fun acc value => mixHash acc (Aiur.Value.hash._unsafe_rec value.val)) 7 values.attach)
+  | Aiur.Value.ctor global values =>
+    mixHash (mixHash 4 (hash global))
+      (Array.foldl (fun acc value => mixHash acc (Aiur.Value.hash._unsafe_rec value.val)) 7 values.attach)
+  | Aiur.Value.fn global => mixHash 5 (hash global)
+  | Aiur.Value.pointer width index => mixHash (mixHash 6 (hash width)) (hash index)
+RECURSION WORKER Aiur.Value.listDecEq._unsafe_rec
+(as bs : List Aiur.Value) → Decidable (as = bs)
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], [] => isTrue ⋯
+  | [], head :: tail => isFalse ⋯
+  | head :: tail, [] => isFalse ⋯
+  | a :: as, b :: bs =>
+    match Aiur.Value.decEq._unsafe_rec a b, Aiur.Value.listDecEq._unsafe_rec as bs with
+    | isTrue ha, isTrue ht => isTrue ⋯
+    | isFalse h, x => isFalse ⋯
+    | x, isFalse h => isFalse ⋯
+RECURSION WORKER Aiur.instHashableTyp.hash._unsafe_rec
+Aiur.Typ → UInt64
+IMPLEMENTATION
+fun x =>
+  let localinst := { hash := Aiur.instHashableTyp.hash._unsafe_rec };
+  match x with
+  | Aiur.Typ.unit => 0
+  | Aiur.Typ.field => 1
+  | Aiur.Typ.u8 => 2
+  | Aiur.Typ.tuple a => mixHash 3 (hash a)
+  | a.array a_1 => mixHash (mixHash 4 (Aiur.instHashableTyp.hash._unsafe_rec a)) (hash a_1)
+  | a.pointer => mixHash 5 (Aiur.instHashableTyp.hash._unsafe_rec a)
+  | Aiur.Typ.ref a => mixHash 6 (hash a)
+  | Aiur.Typ.app a a_1 => mixHash (mixHash 7 (hash a)) (hash a_1)
+  | Aiur.Typ.function a a_1 => mixHash (mixHash 8 (hash a)) (Aiur.instHashableTyp.hash._unsafe_rec a_1)
+  | Aiur.Typ.mvar a => mixHash 9 (hash a)
+RECURSION WORKER Aiur.instReprPattern.repr._unsafe_rec
+Aiur.Pattern → Nat → Format
+IMPLEMENTATION
+fun x prec =>
+  let localinst := { reprPrec := Aiur.instReprPattern.repr._unsafe_rec };
+  match x with
+  | Aiur.Pattern.var a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Pattern.var" ++ Format.line ++ reprArg a)).group
+      prec
+  | Aiur.Pattern.wildcard =>
+    Repr.addAppParen (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Pattern.wildcard")).group prec
+  | Aiur.Pattern.ref a a_1 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Pattern.ref" ++ Format.line ++ reprArg a ++ Format.line ++ reprArg a_1)).group
+      prec
+  | Aiur.Pattern.field a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Pattern.field" ++ Format.line ++ reprArg a)).group
+      prec
+  | Aiur.Pattern.tuple a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Pattern.tuple" ++ Format.line ++ reprArg a)).group
+      prec
+  | Aiur.Pattern.array a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Pattern.array" ++ Format.line ++ reprArg a)).group
+      prec
+  | a.or a_1 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Pattern.or" ++ Format.line ++ Aiur.instReprPattern.repr._unsafe_rec a 1024 ++
+              Format.line ++
+            Aiur.instReprPattern.repr._unsafe_rec a_1 1024)).group
+      prec
+  | a.pointer =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Pattern.pointer" ++ Format.line ++ Aiur.instReprPattern.repr._unsafe_rec a 1024)).group
+      prec
+RECURSION WORKER Aiur.instReprTyp.repr._unsafe_rec
+Aiur.Typ → Nat → Format
+IMPLEMENTATION
+fun x prec =>
+  let localinst := { reprPrec := Aiur.instReprTyp.repr._unsafe_rec };
+  match x with
+  | Aiur.Typ.unit =>
+    Repr.addAppParen (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Typ.unit")).group prec
+  | Aiur.Typ.field =>
+    Repr.addAppParen (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Typ.field")).group prec
+  | Aiur.Typ.u8 => Repr.addAppParen (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Typ.u8")).group prec
+  | Aiur.Typ.tuple a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Typ.tuple" ++ Format.line ++ reprArg a)).group prec
+  | a.array a_1 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Typ.array" ++ Format.line ++ Aiur.instReprTyp.repr._unsafe_rec a 1024 ++ Format.line ++
+            reprArg a_1)).group
+      prec
+  | a.pointer =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Typ.pointer" ++ Format.line ++ Aiur.instReprTyp.repr._unsafe_rec a 1024)).group
+      prec
+  | Aiur.Typ.ref a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Typ.ref" ++ Format.line ++ reprArg a)).group prec
+  | Aiur.Typ.app a a_1 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Typ.app" ++ Format.line ++ reprArg a ++ Format.line ++ reprArg a_1)).group
+      prec
+  | Aiur.Typ.function a a_1 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Aiur.Typ.function" ++ Format.line ++ reprArg a ++ Format.line ++
+            Aiur.instReprTyp.repr._unsafe_rec a_1 1024)).group
+      prec
+  | Aiur.Typ.mvar a =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Aiur.Typ.mvar" ++ Format.line ++ reprArg a)).group prec
+RECURSION WORKER Aiur.wellFormedDecls.wellFormedType._unsafe_rec
+Aiur.Source.Decls → List String → Aiur.Typ → EStateM Aiur.CheckError (Std.HashSet Aiur.Global) Unit
+IMPLEMENTATION
+fun decls params a =>
+  match a with
+  | Aiur.Typ.tuple typs =>
+    Array.forM
+      (fun x =>
+        match x with
+        | ⟨t, property⟩ => Aiur.wellFormedDecls.wellFormedType._unsafe_rec decls params t)
+      typs.attach
+  | pointerTyp.pointer => Aiur.wellFormedDecls.wellFormedType._unsafe_rec decls params pointerTyp
+  | t.array a => Aiur.wellFormedDecls.wellFormedType._unsafe_rec decls params t
+  | Aiur.Typ.ref ref =>
+    if (params.any fun x => x == ref.toName.toString) = true then pure ()
+    else
+      match IndexMap.getByKey decls ref with
+      | some (Aiur.Source.Declaration.dataType dt) =>
+        if dt.params.isEmpty = true then pure () else throw (Aiur.CheckError.wrongNumTypeArgs ref 0 dt.params.length)
+      | some val => throw (Aiur.CheckError.notADataType ref)
+      | none => throw (Aiur.CheckError.unboundGlobal ref)
+  | Aiur.Typ.app g args =>
+    match IndexMap.getByKey decls g with
+    | some (Aiur.Source.Declaration.dataType dt) =>
+      have __do_jp := fun __r =>
+        Array.forM
+          (fun x =>
+            match x with
+            | ⟨t, property⟩ => Aiur.wellFormedDecls.wellFormedType._unsafe_rec decls params t)
+          args.attach;
+      if (args.size == dt.params.length) = true then __do_jp ()
+      else do
+        let __r ← throw (Aiur.CheckError.wrongNumTypeArgs g args.size dt.params.length)
+        __do_jp __r
+    | some val => throw (Aiur.CheckError.notADataType g)
+    | none => throw (Aiur.CheckError.unboundGlobal g)
+  | x => pure ()
+RECURSION WORKER Aiur.AIR.CircuitTraces.bitmap._unsafe_rec
+{circuits : List Aiur.Bytecode.Circuit} → Aiur.AIR.CircuitTraces circuits → List Bool
+IMPLEMENTATION
+fun {circuits} x =>
+  match circuits, x with
+  | .([]), Aiur.AIR.CircuitTraces.nil => []
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.inactive circuit rest =>
+    false :: Aiur.AIR.CircuitTraces.bitmap._unsafe_rec rest
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.active circuit degree values rest =>
+    true :: Aiur.AIR.CircuitTraces.bitmap._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.CircuitTraces.capacity._unsafe_rec
+{circuits : List Aiur.Bytecode.Circuit} → Aiur.AIR.CircuitTraces circuits → Nat
+IMPLEMENTATION
+fun {circuits} x =>
+  match circuits, x with
+  | .([]), Aiur.AIR.CircuitTraces.nil => 0
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.inactive circuit rest =>
+    Aiur.AIR.CircuitTraces.capacity._unsafe_rec rest
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.active circuit degree values rest =>
+    2 ^ degree * circuit.layout.lookups + Aiur.AIR.CircuitTraces.capacity._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.CircuitTraces.degrees._unsafe_rec
+{circuits : List Aiur.Bytecode.Circuit} → Aiur.AIR.CircuitTraces circuits → List Nat
+IMPLEMENTATION
+fun {circuits} x =>
+  match circuits, x with
+  | .([]), Aiur.AIR.CircuitTraces.nil => []
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.inactive circuit rest =>
+    Aiur.AIR.CircuitTraces.degrees._unsafe_rec rest
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.active circuit degree values rest =>
+    degree :: Aiur.AIR.CircuitTraces.degrees._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.CircuitTraces.emitWitnesses._unsafe_rec
+{circuits : List Aiur.Bytecode.Circuit} →
+  Aiur.Bytecode.Toplevel → Aiur.AIR.CircuitTraces circuits → Option (List Aiur.AIR.CircuitWitness)
+IMPLEMENTATION
+fun {circuits} program x =>
+  match circuits, x with
+  | .([]), Aiur.AIR.CircuitTraces.nil => some []
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.inactive circuit rest =>
+    Aiur.AIR.CircuitTraces.emitWitnesses._unsafe_rec program rest
+  | .(circuit :: circuits), Aiur.AIR.CircuitTraces.active circuit degree values rest => do
+    let first ← List.mapM (Aiur.AIR.emitCircuitWitness program circuit) (List.ofFn values)
+    let later ← Aiur.AIR.CircuitTraces.emitWitnesses._unsafe_rec program rest
+    pure (first ++ later)
+RECURSION WORKER Aiur.AIR.MemoryTraces.Satisfied._unsafe_rec
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → Prop
+IMPLEMENTATION
+fun {widths} x =>
+  match widths, x with
+  | .([]), Aiur.AIR.MemoryTraces.nil => True
+  | .(width :: widths), Aiur.AIR.MemoryTraces.inactive width rest => Aiur.AIR.MemoryTraces.Satisfied._unsafe_rec rest
+  | .(width :: widths), Aiur.AIR.MemoryTraces.active width degree matrix rest =>
+    Aiur.AIR.MemoryMatrixSatisfied width (2 ^ degree) matrix ∧ Aiur.AIR.MemoryTraces.Satisfied._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.MemoryTraces.bitmap._unsafe_rec
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → List Bool
+IMPLEMENTATION
+fun {widths} x =>
+  match widths, x with
+  | .([]), Aiur.AIR.MemoryTraces.nil => []
+  | .(width :: widths), Aiur.AIR.MemoryTraces.inactive width rest =>
+    false :: Aiur.AIR.MemoryTraces.bitmap._unsafe_rec rest
+  | .(width :: widths), Aiur.AIR.MemoryTraces.active width degree matrix rest =>
+    true :: Aiur.AIR.MemoryTraces.bitmap._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.MemoryTraces.capacity._unsafe_rec
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → Nat
+IMPLEMENTATION
+fun {widths} x =>
+  match widths, x with
+  | .([]), Aiur.AIR.MemoryTraces.nil => 0
+  | .(width :: widths), Aiur.AIR.MemoryTraces.inactive width rest => Aiur.AIR.MemoryTraces.capacity._unsafe_rec rest
+  | .(width :: widths), Aiur.AIR.MemoryTraces.active width degree matrix rest =>
+    2 ^ degree + Aiur.AIR.MemoryTraces.capacity._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.MemoryTraces.degrees._unsafe_rec
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → List Nat
+IMPLEMENTATION
+fun {widths} x =>
+  match widths, x with
+  | .([]), Aiur.AIR.MemoryTraces.nil => []
+  | .(width :: widths), Aiur.AIR.MemoryTraces.inactive width rest => Aiur.AIR.MemoryTraces.degrees._unsafe_rec rest
+  | .(width :: widths), Aiur.AIR.MemoryTraces.active width degree matrix rest =>
+    degree :: Aiur.AIR.MemoryTraces.degrees._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.MemoryTraces.providers._unsafe_rec
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → List (Aiur.AIR.Provider (List Aiur.G))
+IMPLEMENTATION
+fun {widths} x =>
+  match widths, x with
+  | .([]), Aiur.AIR.MemoryTraces.nil => []
+  | .(width :: widths), Aiur.AIR.MemoryTraces.inactive width rest => Aiur.AIR.MemoryTraces.providers._unsafe_rec rest
+  | .(width :: widths), Aiur.AIR.MemoryTraces.active width degree matrix rest =>
+    Aiur.AIR.memoryMatrixProviders width (2 ^ degree) matrix ++ Aiur.AIR.MemoryTraces.providers._unsafe_rec rest
+RECURSION WORKER Aiur.AIR.MemoryTraces.rows._unsafe_rec
+{widths : List Nat} → Aiur.AIR.MemoryTraces widths → Nat → Array Aiur.AIR.MemoryRow
+IMPLEMENTATION
+fun {widths} x x_1 =>
+  match widths, x, x_1 with
+  | .([]), Aiur.AIR.MemoryTraces.nil, x => #[]
+  | .(width :: widths), Aiur.AIR.MemoryTraces.inactive width rest, size =>
+    if size = width then #[] else Aiur.AIR.MemoryTraces.rows._unsafe_rec rest size
+  | .(width :: widths), Aiur.AIR.MemoryTraces.active width degree matrix rest, size =>
+    if size = width then Aiur.AIR.decodeMemoryRows width (2 ^ degree) matrix
+    else Aiur.AIR.MemoryTraces.rows._unsafe_rec rest size
+RECURSION WORKER Aiur.Bytecode.Block.beq._unsafe_rec
+Aiur.Bytecode.Block → Aiur.Bytecode.Block → Bool
+IMPLEMENTATION
+fun left right => left.ops == right.ops && Aiur.Bytecode.Ctrl.beq._unsafe_rec left.ctrl right.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.collectConstrainedCallees._unsafe_rec
+Aiur.Bytecode.Block → Array Aiur.Bytecode.FunIdx
+IMPLEMENTATION
+fun b =>
+  let opCallees :=
+    Array.foldl
+      (fun acc op =>
+        match op with
+        | Aiur.Bytecode.Op.call idx a outputSize false => acc.push idx
+        | x => acc)
+      #[] b.ops;
+  opCallees ++ Aiur.Bytecode.Ctrl.collectConstrainedCallees._unsafe_rec b.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.controlCounts._unsafe_rec
+Aiur.Bytecode.Block → Aiur.Bytecode.ControlCounts
+IMPLEMENTATION
+fun block => Aiur.Bytecode.Ctrl.controlCounts._unsafe_rec block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.emissionChecks._unsafe_rec
+Nat → Nat → Option Nat → Aiur.Bytecode.Block → Bool
+IMPLEMENTATION
+fun available selectors yieldSize block =>
+  match Aiur.Bytecode.checkEmissionOps block.ops.toList available with
+  | none => false
+  | some next => Aiur.Bytecode.Ctrl.emissionChecks._unsafe_rec next selectors yieldSize block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.emitRow._unsafe_rec
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G → Array Aiur.AIR.RowValue → Nat → Nat → Aiur.Bytecode.Block → Option Aiur.AIR.BlockEmission
+IMPLEMENTATION
+fun row selector context incoming values column lookup block => do
+  let operations ← Aiur.AIR.emitOps row incoming context.rank block.ops.toList values column
+  let control ←
+    Aiur.Bytecode.Ctrl.emitRow._unsafe_rec row selector context incoming operations.values operations.column
+        (lookup + operations.queries.length) block.ctrl
+  pure
+      (Aiur.AIR.BlockEmission.prefix
+        [Aiur.AIR.oneSubBooleanConstraint (Aiur.Bytecode.Block.selectorFlow selector block).entry]
+        (Aiur.AIR.BlockEmission.afterOps incoming lookup operations control))
+RECURSION WORKER Aiur.Bytecode.Block.hash._unsafe_rec
+Aiur.Bytecode.Block → UInt64
+IMPLEMENTATION
+fun block => mixHash (mixHash 0 (hash block.ops)) (Aiur.Bytecode.Ctrl.hash._unsafe_rec block.ctrl)
+RECURSION WORKER Aiur.Bytecode.Block.lookupShapes._unsafe_rec
+Aiur.Bytecode.Toplevel → Option Nat → Aiur.Bytecode.Block → Bool
+IMPLEMENTATION
+fun program yieldSize block =>
+  block.ops.all (Aiur.Bytecode.Op.lookupShape program) &&
+    Aiur.Bytecode.Ctrl.lookupShapes._unsafe_rec program yieldSize block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.lookupUsage._unsafe_rec
+Aiur.Bytecode.Block → Nat
+IMPLEMENTATION
+fun block =>
+  (List.map Aiur.Bytecode.Op.lookupUsage block.ops.toList).sum + Aiur.Bytecode.Ctrl.lookupUsage._unsafe_rec block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.returnGates._unsafe_rec
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.G → Aiur.Bytecode.Block → List Aiur.G
+IMPLEMENTATION
+fun selector incoming block => Aiur.Bytecode.Ctrl.returnGates._unsafe_rec selector incoming block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.returnsHaveSize._unsafe_rec
+Nat → Aiur.Bytecode.Block → Bool
+IMPLEMENTATION
+fun size block => Aiur.Bytecode.Ctrl.returnsHaveSize._unsafe_rec size block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.rowBounds._unsafe_rec
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Block → Prop
+IMPLEMENTATION
+fun selector block => Aiur.Bytecode.Ctrl.rowBounds._unsafe_rec selector block.ctrl
+RECURSION WORKER Aiur.Bytecode.Block.selectorFlow._unsafe_rec
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Block → Aiur.AIR.SelectorFlow
+IMPLEMENTATION
+fun selector block => Aiur.Bytecode.Ctrl.selectorFlow._unsafe_rec selector block.ctrl
+RECURSION WORKER Aiur.Bytecode.Ctrl.beq._unsafe_rec
+Aiur.Bytecode.Ctrl → Aiur.Bytecode.Ctrl → Bool
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | Aiur.Bytecode.Ctrl.match idx cases fallback, Aiur.Bytecode.Ctrl.match idx' cases' fallback' =>
+    idx == idx' &&
+      (Aiur.Bytecode.beqBranches._unsafe_rec cases cases' && Aiur.Bytecode.beqFallback._unsafe_rec fallback fallback')
+  | Aiur.Bytecode.Ctrl.return sel outs, Aiur.Bytecode.Ctrl.return sel' outs' => sel == sel' && outs == outs'
+  | Aiur.Bytecode.Ctrl.yield sel outs, Aiur.Bytecode.Ctrl.yield sel' outs' => sel == sel' && outs == outs'
+  | Aiur.Bytecode.Ctrl.matchContinue idx cases fallback outputs aux lookups cont,
+    Aiur.Bytecode.Ctrl.matchContinue idx' cases' fallback' outputs' aux' lookups' cont' =>
+    idx == idx' &&
+      (Aiur.Bytecode.beqBranches._unsafe_rec cases cases' &&
+        (Aiur.Bytecode.beqFallback._unsafe_rec fallback fallback' &&
+          (outputs == outputs' &&
+            (aux == aux' && (lookups == lookups' && Aiur.Bytecode.Block.beq._unsafe_rec cont cont')))))
+  | x, x_2 => false
+RECURSION WORKER Aiur.Bytecode.Ctrl.collectConstrainedCallees._unsafe_rec
+Aiur.Bytecode.Ctrl → Array Aiur.Bytecode.FunIdx
+IMPLEMENTATION
+fun c =>
+  match c with
+  | Aiur.Bytecode.Ctrl.match a cases default? =>
+    let branchCallees :=
+      Array.foldl
+        (fun acc x =>
+          match x with
+          | ⟨(fst, block), property⟩ => acc ++ Aiur.Bytecode.Block.collectConstrainedCallees._unsafe_rec block)
+        #[] cases.attach;
+    match default? with
+    | some block => branchCallees ++ Aiur.Bytecode.Block.collectConstrainedCallees._unsafe_rec block
+    | none => branchCallees
+  | Aiur.Bytecode.Ctrl.matchContinue a cases default? outputSize sharedAuxiliaries sharedLookups continuation =>
+    let branchCallees :=
+      Array.foldl
+        (fun acc x =>
+          match x with
+          | ⟨(fst, block), property⟩ => acc ++ Aiur.Bytecode.Block.collectConstrainedCallees._unsafe_rec block)
+        #[] cases.attach;
+    let withDefault :=
+      match default? with
+      | some block => branchCallees ++ Aiur.Bytecode.Block.collectConstrainedCallees._unsafe_rec block
+      | none => branchCallees;
+    withDefault ++ Aiur.Bytecode.Block.collectConstrainedCallees._unsafe_rec continuation
+  | Aiur.Bytecode.Ctrl.return a a_1 => #[]
+  | Aiur.Bytecode.Ctrl.yield a a_1 => #[]
+RECURSION WORKER Aiur.Bytecode.Ctrl.controlCounts._unsafe_rec
+Aiur.Bytecode.Ctrl → Aiur.Bytecode.ControlCounts
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a a_1 => { nodes := 1, leaves := 1, returns := 1, yields := 0 }
+  | Aiur.Bytecode.Ctrl.yield a a_1 => { nodes := 1, leaves := 1, returns := 0, yields := 1 }
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    Aiur.Bytecode.ControlCounts.branch
+      (List.map
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ => Aiur.Bytecode.Block.controlCounts._unsafe_rec pair.snd)
+          branches.attach.toList ++
+        match fallback with
+        | none => []
+        | some block => [Aiur.Bytecode.Block.controlCounts._unsafe_rec block])
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups continuation =>
+    (Aiur.Bytecode.ControlCounts.branch
+          (List.map
+              (fun x =>
+                match x with
+                | ⟨pair, property⟩ => Aiur.Bytecode.Block.controlCounts._unsafe_rec pair.snd)
+              branches.attach.toList ++
+            match fallback with
+            | none => []
+            | some block => [Aiur.Bytecode.Block.controlCounts._unsafe_rec block])).continue
+      (Aiur.Bytecode.Block.controlCounts._unsafe_rec continuation)
+RECURSION WORKER Aiur.Bytecode.Ctrl.emissionChecks._unsafe_rec
+Nat → Nat → Option Nat → Aiur.Bytecode.Ctrl → Bool
+IMPLEMENTATION
+fun available selectors yieldSize x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return index outputs =>
+    decide (index < selectors) && Aiur.Bytecode.indicesInScope available outputs
+  | Aiur.Bytecode.Ctrl.yield index outputs =>
+    decide (index < selectors) && (Aiur.Bytecode.indicesInScope available outputs && yieldSize == some outputs.size)
+  | Aiur.Bytecode.Ctrl.match index branches fallback =>
+    decide (index < available) &&
+      ((branches.attach.all fun x =>
+          match x with
+          | ⟨(fst, block), property⟩ =>
+            Aiur.Bytecode.Block.emissionChecks._unsafe_rec available selectors yieldSize block) &&
+        match fallback with
+        | none => true
+        | some block => Aiur.Bytecode.Block.emissionChecks._unsafe_rec available selectors yieldSize block)
+  | Aiur.Bytecode.Ctrl.matchContinue index branches fallback size sharedAuxiliaries sharedLookups continuation =>
+    decide (index < available) &&
+      ((branches.attach.all fun x =>
+          match x with
+          | ⟨(fst, block), property⟩ =>
+            Aiur.Bytecode.Block.emissionChecks._unsafe_rec available selectors (some size) block) &&
+        ((match fallback with
+          | none => true
+          | some block => Aiur.Bytecode.Block.emissionChecks._unsafe_rec available selectors (some size) block) &&
+          match Aiur.Bytecode.addScope available size with
+          | none => false
+          | some next => Aiur.Bytecode.Block.emissionChecks._unsafe_rec next selectors yieldSize continuation))
+RECURSION WORKER Aiur.Bytecode.Ctrl.emitRow._unsafe_rec
+(Nat → Aiur.G) →
+  (Aiur.Bytecode.SelIdx → Aiur.G) →
+    Aiur.AIR.RowContext →
+      Aiur.G → Array Aiur.AIR.RowValue → Nat → Nat → Aiur.Bytecode.Ctrl → Option Aiur.AIR.BlockEmission
+IMPLEMENTATION
+fun row selector context incoming values column lookup x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a indices => do
+    let inputs ← Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) (Array.range context.inputSize)
+    let outputs ← Aiur.Bytecode.AIR.readValues (Aiur.AIR.rowValues values) indices
+    pure
+        { values := values, column := column, lookup := lookup,
+          returns :=
+            [(incoming, { function := context.function, inputs := inputs, outputs := outputs, rank := context.rank })] }
+  | Aiur.Bytecode.Ctrl.yield index indices => do
+    let outputs ← List.mapM (fun index => values[index]?) indices.toList
+    pure { values := values, column := column, lookup := lookup, yields := [(selector index, outputs.toArray)] }
+  | Aiur.Bytecode.Ctrl.match index branches fallback => do
+    let matched ← values[index]?
+    let cases ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ =>
+              let entry := (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry;
+              do
+              let emission ←
+                Aiur.Bytecode.Block.emitRow._unsafe_rec row selector context entry values column lookup pair.snd
+              pure (Aiur.AIR.BlockEmission.prefix [entry * (matched.value - pair.fst)] emission))
+          branches.attach.toList
+    have __do_jp : List Aiur.AIR.BlockEmission → Option Aiur.AIR.BlockEmission := fun default =>
+      pure (Aiur.AIR.joinBlockEmissions values column lookup (cases ++ default))
+    match fallback with
+      | none => do
+        let default ← some []
+        __do_jp default
+      | some block =>
+        let entry := (Aiur.Bytecode.Block.selectorFlow selector block).entry;
+        do
+        let emission ←
+          Aiur.Bytecode.Block.emitRow._unsafe_rec row selector context entry values (column + branches.size) lookup
+              block
+        let default ←
+          pure
+              [Aiur.AIR.BlockEmission.prefix
+                  (List.mapIdx (fun i pair => entry * ((matched.value - pair.fst) * row (column + i) - 1))
+                    branches.toList)
+                  emission]
+        __do_jp default
+  | Aiur.Bytecode.Ctrl.matchContinue index branches fallback size sharedAuxiliaries sharedLookups continuation => do
+    let matched ← values[index]?
+    let cases ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ =>
+              let entry := (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry;
+              do
+              let emission ←
+                Aiur.Bytecode.Block.emitRow._unsafe_rec row selector context entry values column lookup pair.snd
+              pure (Aiur.AIR.BlockEmission.prefix [entry * (matched.value - pair.fst)] emission))
+          branches.attach.toList
+    have __do_jp : List Aiur.AIR.BlockEmission → Option Aiur.AIR.BlockEmission := fun default =>
+      let joined := Aiur.AIR.joinBlockEmissions values column lookup (cases ++ default);
+      if (joined.yields.all fun part => part.snd.size == size) = true then
+        let gate := Aiur.AIR.selectorSum (List.map Prod.fst joined.yields);
+        let merged := Aiur.AIR.rowAdvice row joined.column size;
+        let equations :=
+          Aiur.AIR.mergeEquations row incoming joined.column size joined.yields ++
+            [(Aiur.Bytecode.Block.selectorFlow selector continuation).entry - gate];
+        do
+        let continued ←
+          Aiur.Bytecode.Block.emitRow._unsafe_rec row selector context gate (values ++ merged) (joined.column + size)
+              joined.lookup continuation
+        pure (joined.continued equations continued)
+      else none
+    match fallback with
+      | none => do
+        let default ← some []
+        __do_jp default
+      | some block =>
+        let entry := (Aiur.Bytecode.Block.selectorFlow selector block).entry;
+        do
+        let emission ←
+          Aiur.Bytecode.Block.emitRow._unsafe_rec row selector context entry values (column + branches.size) lookup
+              block
+        let default ←
+          pure
+              [Aiur.AIR.BlockEmission.prefix
+                  (List.mapIdx (fun i pair => entry * ((matched.value - pair.fst) * row (column + i) - 1))
+                    branches.toList)
+                  emission]
+        __do_jp default
+RECURSION WORKER Aiur.Bytecode.Ctrl.hash._unsafe_rec
+Aiur.Bytecode.Ctrl → UInt64
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.match idx branches fallback =>
+    let branchesHash :=
+      Array.foldl
+        (fun acc pair => mixHash acc (mixHash (hash pair.val.fst) (Aiur.Bytecode.Block.hash._unsafe_rec pair.val.snd)))
+        7 branches.attach;
+    let fallbackHash :=
+      match fallback with
+      | none => 11
+      | some block => mixHash (Aiur.Bytecode.Block.hash._unsafe_rec block) 13;
+    mixHash (mixHash (mixHash 0 (hash idx)) branchesHash) fallbackHash
+  | Aiur.Bytecode.Ctrl.return sel outs => mixHash (mixHash 1 (hash sel)) (hash outs)
+  | Aiur.Bytecode.Ctrl.yield sel outs => mixHash (mixHash 2 (hash sel)) (hash outs)
+  | Aiur.Bytecode.Ctrl.matchContinue idx branches fallback outputs aux lookups cont =>
+    let branchesHash :=
+      Array.foldl
+        (fun acc pair => mixHash acc (mixHash (hash pair.val.fst) (Aiur.Bytecode.Block.hash._unsafe_rec pair.val.snd)))
+        7 branches.attach;
+    let fallbackHash :=
+      match fallback with
+      | none => 11
+      | some block => mixHash (Aiur.Bytecode.Block.hash._unsafe_rec block) 13;
+    mixHash
+      (mixHash
+        (mixHash (mixHash (mixHash (mixHash (mixHash 3 (hash idx)) branchesHash) fallbackHash) (hash outputs))
+          (hash aux))
+        (hash lookups))
+      (Aiur.Bytecode.Block.hash._unsafe_rec cont)
+RECURSION WORKER Aiur.Bytecode.Ctrl.lookupShapes._unsafe_rec
+Aiur.Bytecode.Toplevel → Option Nat → Aiur.Bytecode.Ctrl → Bool
+IMPLEMENTATION
+fun program yieldSize x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a a_1 => true
+  | Aiur.Bytecode.Ctrl.yield a values => yieldSize == some values.size
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    (branches.attach.all fun x =>
+        match x with
+        | ⟨(fst, block), property⟩ => Aiur.Bytecode.Block.lookupShapes._unsafe_rec program yieldSize block) &&
+      match fallback with
+      | none => true
+      | some block => Aiur.Bytecode.Block.lookupShapes._unsafe_rec program yieldSize block
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback size sharedAuxiliaries sharedLookups continuation =>
+    (branches.attach.all fun x =>
+        match x with
+        | ⟨(fst, block), property⟩ => Aiur.Bytecode.Block.lookupShapes._unsafe_rec program (some size) block) &&
+      ((match fallback with
+        | none => true
+        | some block => Aiur.Bytecode.Block.lookupShapes._unsafe_rec program (some size) block) &&
+        Aiur.Bytecode.Block.lookupShapes._unsafe_rec program yieldSize continuation)
+RECURSION WORKER Aiur.Bytecode.Ctrl.lookupUsage._unsafe_rec
+Aiur.Bytecode.Ctrl → Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a a_1 => 0
+  | Aiur.Bytecode.Ctrl.yield a a_1 => 0
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    List.foldl Nat.max 0
+      (List.map
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ => Aiur.Bytecode.Block.lookupUsage._unsafe_rec pair.snd)
+          branches.attach.toList ++
+        match fallback with
+        | none => []
+        | some block => [Aiur.Bytecode.Block.lookupUsage._unsafe_rec block])
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups continuation =>
+    List.foldl Nat.max 0
+        (List.map
+            (fun x =>
+              match x with
+              | ⟨pair, property⟩ => Aiur.Bytecode.Block.lookupUsage._unsafe_rec pair.snd)
+            branches.attach.toList ++
+          match fallback with
+          | none => []
+          | some block => [Aiur.Bytecode.Block.lookupUsage._unsafe_rec block]) +
+      Aiur.Bytecode.Block.lookupUsage._unsafe_rec continuation
+RECURSION WORKER Aiur.Bytecode.Ctrl.returnGates._unsafe_rec
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.G → Aiur.Bytecode.Ctrl → List Aiur.G
+IMPLEMENTATION
+fun selector incoming x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a a_1 => [incoming]
+  | Aiur.Bytecode.Ctrl.yield a a_1 => []
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    List.flatMap
+        (fun x =>
+          match x with
+          | ⟨pair, property⟩ =>
+            Aiur.Bytecode.Block.returnGates._unsafe_rec selector
+              (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry pair.snd)
+        branches.attach.toList ++
+      match fallback with
+      | none => []
+      | some block =>
+        Aiur.Bytecode.Block.returnGates._unsafe_rec selector (Aiur.Bytecode.Block.selectorFlow selector block).entry
+          block
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups continuation =>
+    (List.flatMap
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ =>
+              Aiur.Bytecode.Block.returnGates._unsafe_rec selector
+                (Aiur.Bytecode.Block.selectorFlow selector pair.snd).entry pair.snd)
+          branches.attach.toList ++
+        match fallback with
+        | none => []
+        | some block =>
+          Aiur.Bytecode.Block.returnGates._unsafe_rec selector (Aiur.Bytecode.Block.selectorFlow selector block).entry
+            block) ++
+      Aiur.Bytecode.Block.returnGates._unsafe_rec selector
+        (Aiur.AIR.selectorSum
+          (Aiur.AIR.SelectorFlow.join (Aiur.Bytecode.branchSelectorFlows selector branches fallback)).yields)
+        continuation
+RECURSION WORKER Aiur.Bytecode.Ctrl.returnsHaveSize._unsafe_rec
+Nat → Aiur.Bytecode.Ctrl → Bool
+IMPLEMENTATION
+fun size x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a values => values.size == size
+  | Aiur.Bytecode.Ctrl.yield a a_1 => true
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    (branches.attach.all fun x =>
+        match x with
+        | ⟨(fst, block), property⟩ => Aiur.Bytecode.Block.returnsHaveSize._unsafe_rec size block) &&
+      match fallback with
+      | none => true
+      | some block => Aiur.Bytecode.Block.returnsHaveSize._unsafe_rec size block
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups continuation =>
+    (branches.attach.all fun x =>
+        match x with
+        | ⟨(fst, block), property⟩ => Aiur.Bytecode.Block.returnsHaveSize._unsafe_rec size block) &&
+      ((match fallback with
+        | none => true
+        | some block => Aiur.Bytecode.Block.returnsHaveSize._unsafe_rec size block) &&
+        Aiur.Bytecode.Block.returnsHaveSize._unsafe_rec size continuation)
+RECURSION WORKER Aiur.Bytecode.Ctrl.rowBounds._unsafe_rec
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Ctrl → Prop
+IMPLEMENTATION
+fun selector x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a a_1 => True
+  | Aiur.Bytecode.Ctrl.yield a a_1 => True
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    branches.size + fallback.toList.length < Aiur.gSize.toNat ∧
+      (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+          pair ∈ branches.toList → Aiur.Bytecode.Block.rowBounds._unsafe_rec selector pair.snd) ∧
+        match fallback with
+        | none => True
+        | some block => Aiur.Bytecode.Block.rowBounds._unsafe_rec selector block
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups continuation =>
+    let flow := Aiur.AIR.SelectorFlow.join (Aiur.Bytecode.branchSelectorFlows selector branches fallback);
+    branches.size + fallback.toList.length < Aiur.gSize.toNat ∧
+      flow.returns.length + flow.yields.length < Aiur.gSize.toNat ∧
+        (∀ (pair : Aiur.G × Aiur.Bytecode.Block),
+            pair ∈ branches.toList → Aiur.Bytecode.Block.rowBounds._unsafe_rec selector pair.snd) ∧
+          (match fallback with
+            | none => True
+            | some block => Aiur.Bytecode.Block.rowBounds._unsafe_rec selector block) ∧
+            Aiur.Bytecode.Block.rowBounds._unsafe_rec selector continuation
+RECURSION WORKER Aiur.Bytecode.Ctrl.selectorFlow._unsafe_rec
+(Aiur.Bytecode.SelIdx → Aiur.G) → Aiur.Bytecode.Ctrl → Aiur.AIR.SelectorFlow
+IMPLEMENTATION
+fun selector x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return index a =>
+    { entry := selector index, returns := [selector index], yields := [], equations := [] }.guard
+  | Aiur.Bytecode.Ctrl.yield index a =>
+    { entry := selector index, returns := [], yields := [selector index], equations := [] }.guard
+  | Aiur.Bytecode.Ctrl.match a branches fallback =>
+    (Aiur.AIR.SelectorFlow.join
+        (List.map
+            (fun x =>
+              match x with
+              | ⟨pair, property⟩ => Aiur.Bytecode.Block.selectorFlow._unsafe_rec selector pair.snd)
+            branches.attach.toList ++
+          match fallback with
+          | none => []
+          | some block => [Aiur.Bytecode.Block.selectorFlow._unsafe_rec selector block])).guard
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups continuation =>
+    ((Aiur.AIR.SelectorFlow.join
+            (List.map
+                (fun x =>
+                  match x with
+                  | ⟨pair, property⟩ => Aiur.Bytecode.Block.selectorFlow._unsafe_rec selector pair.snd)
+                branches.attach.toList ++
+              match fallback with
+              | none => []
+              | some block => [Aiur.Bytecode.Block.selectorFlow._unsafe_rec selector block])).continue
+        (Aiur.Bytecode.Block.selectorFlow._unsafe_rec selector continuation)).guard
+RECURSION WORKER Aiur.Bytecode.Eval.buildLimbChain._unsafe_rec
+Aiur.Bytecode.Eval.EvalState → List (Array Aiur.G) → Aiur.Bytecode.Eval.EvalState × Nat
+IMPLEMENTATION
+fun st x =>
+  match x with
+  | [] => Aiur.Bytecode.Eval.memStore st (#[1] ++ Array.replicate 9 0)
+  | limb :: rest =>
+    match Aiur.Bytecode.Eval.buildLimbChain._unsafe_rec st rest with
+    | (st', restPtr) => Aiur.Bytecode.Eval.memStore st' (#[0] ++ limb ++ #[Aiur.G.ofNat restPtr])
+RECURSION WORKER Aiur.Bytecode.Eval.evalBlock._unsafe_rec
+Aiur.Bytecode.Toplevel →
+  Nat →
+    Aiur.Bytecode.Block →
+      Aiur.Bytecode.Eval.EvalState →
+        Except Aiur.Bytecode.Eval.BytecodeError (Array Aiur.G × Aiur.Bytecode.Eval.EvalState)
+IMPLEMENTATION
+fun t fuel b st =>
+  match Aiur.Bytecode.Eval.runOps._unsafe_rec t fuel b.ops st 0 with
+  | Except.error e => Except.error e
+  | Except.ok st' => Aiur.Bytecode.Eval.evalCtrl._unsafe_rec t fuel b.ctrl st'
+RECURSION WORKER Aiur.Bytecode.Eval.evalCtrl._unsafe_rec
+Aiur.Bytecode.Toplevel →
+  Nat →
+    Aiur.Bytecode.Ctrl →
+      Aiur.Bytecode.Eval.EvalState →
+        Except Aiur.Bytecode.Eval.BytecodeError (Array Aiur.G × Aiur.Bytecode.Eval.EvalState)
+IMPLEMENTATION
+fun t fuel ctrl st =>
+  match ctrl with
+  | Aiur.Bytecode.Ctrl.return a outs =>
+    match Aiur.Bytecode.Eval.readIdxs st outs with
+    | Except.error e => Except.error e
+    | Except.ok gs => Except.error (Aiur.Bytecode.Eval.BytecodeError.earlyReturn gs st)
+  | Aiur.Bytecode.Ctrl.yield a outs =>
+    match Aiur.Bytecode.Eval.readIdxs st outs with
+    | Except.error e => Except.error e
+    | Except.ok gs => Except.ok (gs, st)
+  | Aiur.Bytecode.Ctrl.match scrutIdx cases defaultBlock =>
+    match Aiur.Bytecode.Eval.readIdx st scrutIdx with
+    | Except.error e => Except.error e
+    | Except.ok scrut => Aiur.Bytecode.Eval.evalMatchArm._unsafe_rec t fuel cases defaultBlock scrut st
+  | Aiur.Bytecode.Ctrl.matchContinue scrutIdx cases defaultBlock _outputSize _sharedAux _sharedLookups cont =>
+    match Aiur.Bytecode.Eval.readIdx st scrutIdx with
+    | Except.error e => Except.error e
+    | Except.ok scrut =>
+      match Aiur.Bytecode.Eval.evalMatchArm._unsafe_rec t fuel cases defaultBlock scrut st with
+      | Except.error e => Except.error e
+      | Except.ok (gs, st') =>
+        let stMerged := { map := st.map ++ gs, memory := st'.memory, ioBuffer := st'.ioBuffer };
+        Aiur.Bytecode.Eval.evalBlock._unsafe_rec t fuel cont stMerged
+RECURSION WORKER Aiur.Bytecode.Eval.evalDefaultBlock._unsafe_rec
+Aiur.Bytecode.Toplevel →
+  Nat →
+    Option Aiur.Bytecode.Block →
+      Aiur.Bytecode.Eval.EvalState →
+        Except Aiur.Bytecode.Eval.BytecodeError (Array Aiur.G × Aiur.Bytecode.Eval.EvalState)
+IMPLEMENTATION
+fun t fuel defaultBlock st =>
+  match defaultBlock with
+  | some block => Aiur.Bytecode.Eval.evalBlock._unsafe_rec t fuel block st
+  | none => Except.error Aiur.Bytecode.Eval.BytecodeError.unreachableAfterLayout
+RECURSION WORKER Aiur.Bytecode.Eval.evalMatchArm._unsafe_rec
+Aiur.Bytecode.Toplevel →
+  Nat →
+    Array (Aiur.G × Aiur.Bytecode.Block) →
+      Option Aiur.Bytecode.Block →
+        Aiur.G →
+          Aiur.Bytecode.Eval.EvalState →
+            optParam Nat 0 → Except Aiur.Bytecode.Eval.BytecodeError (Array Aiur.G × Aiur.Bytecode.Eval.EvalState)
+IMPLEMENTATION
+fun t fuel cases defaultBlock scrut st i =>
+  if h : i < cases.size then
+    if (cases[i].fst == scrut) = true then Aiur.Bytecode.Eval.evalBlock._unsafe_rec t fuel cases[i].snd st
+    else Aiur.Bytecode.Eval.evalMatchArm._unsafe_rec t fuel cases defaultBlock scrut st (i + 1)
+  else Aiur.Bytecode.Eval.evalDefaultBlock._unsafe_rec t fuel defaultBlock st
+RECURSION WORKER Aiur.Bytecode.Eval.evalOp._unsafe_rec
+Aiur.Bytecode.Toplevel →
+  Nat →
+    Aiur.Bytecode.Op →
+      Aiur.Bytecode.Eval.EvalState → Except Aiur.Bytecode.Eval.BytecodeError Aiur.Bytecode.Eval.EvalState
+IMPLEMENTATION
+fun t fuel op st =>
+  match op with
+  | Aiur.Bytecode.Op.const g => Except.ok (Aiur.Bytecode.Eval.pushMap st g)
+  | Aiur.Bytecode.Op.add a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (x + y))
+  | Aiur.Bytecode.Op.sub a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (x - y))
+  | Aiur.Bytecode.Op.mul a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (x * y))
+  | Aiur.Bytecode.Op.eqZero a => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    pure (Aiur.Bytecode.Eval.pushMap st (if (x.val == 0) = true then 1 else 0))
+  | Aiur.Bytecode.Op.call fi args outputSize _unconstrained => do
+    let argGs ← Aiur.Bytecode.Eval.readIdxs st args
+    if h : fi < t.functions.size then
+        let f := t.functions[fi];
+        if (f.layout.inputSize != argGs.size) = true then
+          Except.error (Aiur.Bytecode.Eval.BytecodeError.arityMismatch fi)
+        else
+          let innerSt := { map := argGs, memory := st.memory, ioBuffer := st.ioBuffer };
+          match fuel with
+          | 0 => Except.error Aiur.Bytecode.Eval.BytecodeError.outOfFuel
+          | fuel.succ =>
+            match Aiur.Bytecode.Eval.evalBlock._unsafe_rec t fuel f.body innerSt with
+            | Except.error (Aiur.Bytecode.Eval.BytecodeError.earlyReturn outs innerSt') =>
+              if (outs.size != outputSize) = true then
+                Except.error Aiur.Bytecode.Eval.BytecodeError.callOutputSizeMismatch
+              else
+                pure
+                  (Aiur.Bytecode.Eval.appendMap
+                    (Aiur.Bytecode.Eval.setIoBuffer
+                      { map := st.map, memory := innerSt'.memory, ioBuffer := st.ioBuffer } innerSt'.ioBuffer)
+                    outs)
+            | Except.ok (outs, innerSt') =>
+              if (outs.size != outputSize) = true then
+                Except.error Aiur.Bytecode.Eval.BytecodeError.callOutputSizeMismatch
+              else
+                pure
+                  (Aiur.Bytecode.Eval.appendMap
+                    (Aiur.Bytecode.Eval.setIoBuffer
+                      { map := st.map, memory := innerSt'.memory, ioBuffer := st.ioBuffer } innerSt'.ioBuffer)
+                    outs)
+            | Except.error e => Except.error e
+      else Except.error (Aiur.Bytecode.Eval.BytecodeError.invalidFunIdx fi)
+  | Aiur.Bytecode.Op.store vals => do
+    let argGs ← Aiur.Bytecode.Eval.readIdxs st vals
+    match Aiur.Bytecode.Eval.memStore st argGs with
+      | (st', idx) => pure (Aiur.Bytecode.Eval.pushMap st' (Aiur.G.ofNat idx))
+  | Aiur.Bytecode.Op.load size ptr => do
+    let ptrG ← Aiur.Bytecode.Eval.readIdx st ptr
+    let vs ← Aiur.Bytecode.Eval.memLoad st size ptrG.val.toNat
+    pure (Aiur.Bytecode.Eval.appendMap st vs)
+  | Aiur.Bytecode.Op.assertEq as bs a => do
+    let aGs ← Aiur.Bytecode.Eval.readIdxs st as
+    let bGs ← Aiur.Bytecode.Eval.readIdxs st bs
+    if (aGs == bGs) = true then Except.ok st else Except.error Aiur.Bytecode.Eval.BytecodeError.assertFailed
+  | Aiur.Bytecode.Op.ioGetInfo channelIdx keyIdxs => do
+    let channelG ← Aiur.Bytecode.Eval.readIdx st channelIdx
+    let keyGs ← Aiur.Bytecode.Eval.readIdxs st keyIdxs
+    match st.ioBuffer.map[(channelG, keyGs)]? with
+      | some info =>
+        let st1 := Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofNat info.idx);
+        pure (Aiur.Bytecode.Eval.pushMap st1 (Aiur.G.ofNat info.len))
+      | none => Except.error Aiur.Bytecode.Eval.BytecodeError.ioKeyNotFound
+  | Aiur.Bytecode.Op.ioSetInfo channelIdx keyIdxs idxIdx lenIdx => do
+    let channelG ← Aiur.Bytecode.Eval.readIdx st channelIdx
+    let keyGs ← Aiur.Bytecode.Eval.readIdxs st keyIdxs
+    let iG ← Aiur.Bytecode.Eval.readIdx st idxIdx
+    let lG ← Aiur.Bytecode.Eval.readIdx st lenIdx
+    if st.ioBuffer.map.contains (channelG, keyGs) = true then
+        Except.error Aiur.Bytecode.Eval.BytecodeError.ioKeyAlreadySet
+      else
+        let info := { idx := iG.val.toNat, len := lG.val.toNat };
+        let newMap := st.ioBuffer.map.insert (channelG, keyGs) info;
+        pure
+          (Aiur.Bytecode.Eval.setIoBuffer st
+            (let __src := st.ioBuffer;
+            { data := __src.data, map := newMap }))
+  | Aiur.Bytecode.Op.ioRead channelIdx idxIdx len => do
+    let channelG ← Aiur.Bytecode.Eval.readIdx st channelIdx
+    let iG ← Aiur.Bytecode.Eval.readIdx st idxIdx
+    let start : Nat := iG.val.toNat
+    let arena : Array Aiur.G := st.ioBuffer.data.getD channelG #[]
+    if start + len > arena.size then Except.error Aiur.Bytecode.Eval.BytecodeError.ioReadOoB
+      else pure (Aiur.Bytecode.Eval.appendMap st (arena.extract start (start + len)))
+  | Aiur.Bytecode.Op.ioWrite channelIdx dataIdxs => do
+    let channelG ← Aiur.Bytecode.Eval.readIdx st channelIdx
+    let dataGs ← Aiur.Bytecode.Eval.readIdxs st dataIdxs
+    let arena : Array Aiur.G := st.ioBuffer.data.getD channelG #[]
+    let newData : Std.HashMap Aiur.G (Array Aiur.G) := st.ioBuffer.data.insert channelG (arena ++ dataGs)
+    pure
+        (Aiur.Bytecode.Eval.setIoBuffer st
+          (let __src := st.ioBuffer;
+          { data := newData, map := __src.map }))
+  | Aiur.Bytecode.Op.u8BitDecomposition idx => do
+    let g ← Aiur.Bytecode.Eval.readIdx st idx
+    let byte : UInt8 := g.val.toUInt8
+    let bits : Array Aiur.G := Array.ofFn fun i => Aiur.G.ofUInt8 (byte >>> (↑i).toUInt8 &&& 1)
+    pure (Aiur.Bytecode.Eval.appendMap st bits)
+  | Aiur.Bytecode.Op.u8ShiftLeft idx => do
+    let g ← Aiur.Bytecode.Eval.readIdx st idx
+    pure (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (g.val.toUInt8 <<< 1)))
+  | Aiur.Bytecode.Op.u8ShiftRight idx => do
+    let g ← Aiur.Bytecode.Eval.readIdx st idx
+    pure (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (g.val.toUInt8 >>> 1)))
+  | Aiur.Bytecode.Op.u8Xor a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (x.val.toUInt8 ^^^ y.val.toUInt8)))
+  | Aiur.Bytecode.Op.u8Add a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    let sum : Nat := x.val.toUInt8.toNat + y.val.toUInt8.toNat
+    let st1 : Aiur.Bytecode.Eval.EvalState := Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 sum.toUInt8)
+    pure (Aiur.Bytecode.Eval.pushMap st1 (if sum ≥ 256 then 1 else 0))
+  | Aiur.Bytecode.Op.u8Mul a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    let prod : Nat := x.val.toUInt8.toNat * y.val.toUInt8.toNat
+    let st1 : Aiur.Bytecode.Eval.EvalState := Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 prod.toUInt8)
+    pure (Aiur.Bytecode.Eval.pushMap st1 (Aiur.G.ofUInt8 (prod / 256).toUInt8))
+  | Aiur.Bytecode.Op.u8XorSplit7 a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    let z : UInt8 := x.val.toUInt8 ^^^ y.val.toUInt8
+    pure
+        (Aiur.Bytecode.Eval.pushMap (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (z >>> 7)))
+          (Aiur.G.ofUInt8 (z <<< 1)))
+  | Aiur.Bytecode.Op.u8XorSplit4 a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    let z : UInt8 := x.val.toUInt8 ^^^ y.val.toUInt8
+    pure
+        (Aiur.Bytecode.Eval.pushMap (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (z >>> 4)))
+          (Aiur.G.ofUInt8 (z <<< 4)))
+  | Aiur.Bytecode.Op.u8Sub a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    let i : UInt8 := x.val.toUInt8
+    let j : UInt8 := y.val.toUInt8
+    let st1 : Aiur.Bytecode.Eval.EvalState := Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (i - j))
+    pure (Aiur.Bytecode.Eval.pushMap st1 (if j > i then 1 else 0))
+  | Aiur.Bytecode.Op.u8And a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (x.val.toUInt8 &&& y.val.toUInt8)))
+  | Aiur.Bytecode.Op.u8Or a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofUInt8 (x.val.toUInt8 ||| y.val.toUInt8)))
+  | Aiur.Bytecode.Op.u8LessThan a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (if x.val.toUInt8 < y.val.toUInt8 then 1 else 0))
+  | Aiur.Bytecode.Op.u32LessThan a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    pure (Aiur.Bytecode.Eval.pushMap st (if x.val.toUInt32 < y.val.toUInt32 then 1 else 0))
+  | Aiur.Bytecode.Op.unconstrainedU32Add a b =>
+    let pack := fun idxs =>
+      List.foldl
+        (fun n x =>
+          match x with
+          | (idx, i) => n + (st.map[idx]?.getD 0).val.toNat * 256 ^ i)
+        0 idxs.toList.zipIdx;
+    let sum := pack a + pack b;
+    let bytes := Array.map (fun i => Aiur.G.ofNat (sum / 256 ^ i % 256)) #[0, 1, 2, 3];
+    pure (Aiur.Bytecode.Eval.pushMap (Aiur.Bytecode.Eval.appendMap st bytes) (Aiur.G.ofNat (sum / 4294967296)))
+  | Aiur.Bytecode.Op.unconstrainedU32Add3 a b c =>
+    let pack := fun idxs =>
+      List.foldl
+        (fun n x =>
+          match x with
+          | (idx, i) => n + (st.map[idx]?.getD 0).val.toNat * 256 ^ i)
+        0 idxs.toList.zipIdx;
+    let sum := pack a + pack b + pack c;
+    let bytes := Array.map (fun i => Aiur.G.ofNat (sum / 256 ^ i % 256)) #[0, 1, 2, 3];
+    pure (Aiur.Bytecode.Eval.pushMap (Aiur.Bytecode.Eval.appendMap st bytes) (Aiur.G.ofNat (sum / 4294967296)))
+  | Aiur.Bytecode.Op.u32ToField bytes =>
+    let word :=
+      List.foldl
+        (fun n x =>
+          match x with
+          | (idx, i) => n + (st.map[idx]?.getD 0).val.toNat * 256 ^ i)
+        0 bytes.toList.zipIdx;
+    pure (Aiur.Bytecode.Eval.pushMap st (Aiur.G.ofNat word))
+  | Aiur.Bytecode.Op.u8RangeCheck a b => do
+    let x ← Aiur.Bytecode.Eval.readIdx st a
+    let y ← Aiur.Bytecode.Eval.readIdx st b
+    if (decide (x.val < 256) && decide (y.val < 256)) = true then Except.ok st
+      else Except.error Aiur.Bytecode.Eval.BytecodeError.u8RangeCheckFailed
+  | Aiur.Bytecode.Op.unconstrainedBigUintDivMod a b => do
+    let aPtr ← Aiur.Bytecode.Eval.readIdx st a
+    let bPtr ← Aiur.Bytecode.Eval.readIdx st b
+    let bound : Nat := (Option.map (fun x => x.size) (IndexMap.getByKey st.memory 10)).getD 0 + 1
+    let aLimbs ← Aiur.Bytecode.Eval.readLimbChain st bound aPtr.val.toNat
+    let bLimbs ← Aiur.Bytecode.Eval.readLimbChain st bound bPtr.val.toNat
+    let aVal : Nat := Aiur.limbsVal aLimbs
+    let bVal : Nat := Aiur.limbsVal bLimbs
+    match Aiur.Bytecode.Eval.buildLimbChain st (Aiur.natToLimbsLE (aVal / bVal)) with
+      | (st1, qPtr) =>
+        match Aiur.Bytecode.Eval.buildLimbChain st1 (Aiur.natToLimbsLE (aVal % bVal)) with
+        | (st2, rPtr) =>
+          pure (Aiur.Bytecode.Eval.pushMap (Aiur.Bytecode.Eval.pushMap st2 (Aiur.G.ofNat qPtr)) (Aiur.G.ofNat rPtr))
+  | Aiur.Bytecode.Op.unconstrainedGToBytes idx => do
+    let g ← Aiur.Bytecode.Eval.readIdx st idx
+    pure (Aiur.Bytecode.Eval.appendMap st (Array.ofFn g.toLeBytes))
+  | Aiur.Bytecode.Op.unconstrainedGInverse idx => do
+    let g ← Aiur.Bytecode.Eval.readIdx st idx
+    pure (Aiur.Bytecode.Eval.pushMap st g.inverse)
+  | Aiur.Bytecode.Op.debug a a_1 => Except.ok st
+RECURSION WORKER Aiur.Bytecode.Eval.readLimbChain._unsafe_rec
+Aiur.Bytecode.Eval.EvalState → Nat → Nat → Except Aiur.Bytecode.Eval.BytecodeError (List (Array Aiur.G))
+IMPLEMENTATION
+fun st x x_1 =>
+  match x, x_1 with
+  | 0, x => Except.error Aiur.Bytecode.Eval.BytecodeError.unconstrainedBigUintDivModFailed
+  | steps.succ, ptr => do
+    let vs ← Aiur.Bytecode.Eval.memLoad st 10 ptr
+    match vs[0]?, vs[9]? with
+      | some tag, some next =>
+        if (tag == 1) = true then pure []
+        else
+          if (tag == 0) = true then
+            let bytes := vs.extract 1 9;
+            if (bytes.size == 8 && bytes.all fun x => decide (x.val < 256)) = true then do
+              let rest ← Aiur.Bytecode.Eval.readLimbChain._unsafe_rec st steps next.val.toNat
+              pure (bytes :: rest)
+            else Except.error Aiur.Bytecode.Eval.BytecodeError.unconstrainedBigUintDivModFailed
+          else Except.error Aiur.Bytecode.Eval.BytecodeError.unconstrainedBigUintDivModFailed
+      | x, x_2 => Except.error Aiur.Bytecode.Eval.BytecodeError.unconstrainedBigUintDivModFailed
+RECURSION WORKER Aiur.Bytecode.Eval.runOps._unsafe_rec
+Aiur.Bytecode.Toplevel →
+  Nat →
+    Array Aiur.Bytecode.Op →
+      Aiur.Bytecode.Eval.EvalState → Nat → Except Aiur.Bytecode.Eval.BytecodeError Aiur.Bytecode.Eval.EvalState
+IMPLEMENTATION
+fun t fuel ops st i =>
+  if h : i < ops.size then
+    match Aiur.Bytecode.Eval.evalOp._unsafe_rec t fuel ops[i] st with
+    | Except.error e => Except.error e
+    | Except.ok st' => Aiur.Bytecode.Eval.runOps._unsafe_rec t fuel ops st' (i + 1)
+  else Except.ok st
+RECURSION WORKER Aiur.Concrete.Bytecode.blockLayout._unsafe_rec
+Aiur.Bytecode.Block → Aiur.Concrete.Bytecode.LayoutM Unit
+IMPLEMENTATION
+fun block => do
+  Array.forM Aiur.Concrete.Bytecode.opLayout block.ops
+  Aiur.Concrete.Bytecode.ctrlLayout._unsafe_rec block.ctrl
+RECURSION WORKER Aiur.Concrete.Bytecode.ctrlLayout._unsafe_rec
+Aiur.Bytecode.Ctrl → Aiur.Concrete.Bytecode.LayoutM Unit
+IMPLEMENTATION
+fun c =>
+  match c with
+  | Aiur.Bytecode.Ctrl.match a branches defaultBranch => do
+    let initSharedData ← Aiur.Concrete.Bytecode.getSharedData
+    let degrees ← Aiur.Concrete.Bytecode.getDegrees
+    let maximalSharedData ←
+      Array.foldlM
+          (fun currMax x =>
+            match x with
+            | ⟨(fst, block), property⟩ => do
+              Aiur.Concrete.Bytecode.setSharedData initSharedData
+              Aiur.Concrete.Bytecode.blockLayout._unsafe_rec block
+              let blockSharedData ← Aiur.Concrete.Bytecode.getSharedData
+              Aiur.Concrete.Bytecode.setDegrees degrees
+              pure (currMax.maximals blockSharedData))
+          initSharedData branches.attach
+    have __do_jp : Aiur.Concrete.Bytecode.SharedData → Aiur.Concrete.Bytecode.LayoutM Unit := fun finalMax =>
+      Aiur.Concrete.Bytecode.setSharedData finalMax
+    match defaultBranch with
+      | none => do
+        let finalMax ← pure maximalSharedData
+        __do_jp finalMax
+      | some defaultBlock => do
+        Aiur.Concrete.Bytecode.setSharedData initSharedData
+        Aiur.Concrete.Bytecode.bumpAuxiliaries branches.size
+        Aiur.Concrete.Bytecode.blockLayout._unsafe_rec defaultBlock
+        let defaultBlockSharedData ← Aiur.Concrete.Bytecode.getSharedData
+        Aiur.Concrete.Bytecode.setDegrees degrees
+        let finalMax ← pure (maximalSharedData.maximals defaultBlockSharedData)
+        __do_jp finalMax
+  | Aiur.Bytecode.Ctrl.return a a_1 => Aiur.Concrete.Bytecode.bumpSelectors
+  | Aiur.Bytecode.Ctrl.yield a a_1 => Aiur.Concrete.Bytecode.bumpSelectors
+  | Aiur.Bytecode.Ctrl.matchContinue a branches defaultBranch outputSize _sharedAux _sharedLookups continuation => do
+    let initSharedData ← Aiur.Concrete.Bytecode.getSharedData
+    let degrees ← Aiur.Concrete.Bytecode.getDegrees
+    let maximalSharedData ←
+      Array.foldlM
+          (fun currMax x =>
+            match x with
+            | ⟨(fst, block), property⟩ => do
+              Aiur.Concrete.Bytecode.setSharedData initSharedData
+              Aiur.Concrete.Bytecode.blockLayout._unsafe_rec block
+              let blockSharedData ← Aiur.Concrete.Bytecode.getSharedData
+              Aiur.Concrete.Bytecode.setDegrees degrees
+              pure (currMax.maximals blockSharedData))
+          initSharedData branches.attach
+    have __do_jp : Aiur.Concrete.Bytecode.SharedData → Aiur.Concrete.Bytecode.LayoutM Unit := fun finalMax => do
+      Aiur.Concrete.Bytecode.setSharedData finalMax
+      Aiur.Concrete.Bytecode.bumpAuxiliaries outputSize
+      Aiur.Concrete.Bytecode.pushDegrees (Array.replicate outputSize 1)
+      Aiur.Concrete.Bytecode.blockLayout._unsafe_rec continuation
+    match defaultBranch with
+      | none => do
+        let finalMax ← pure maximalSharedData
+        __do_jp finalMax
+      | some defaultBlock => do
+        Aiur.Concrete.Bytecode.setSharedData initSharedData
+        Aiur.Concrete.Bytecode.bumpAuxiliaries branches.size
+        Aiur.Concrete.Bytecode.blockLayout._unsafe_rec defaultBlock
+        let defaultBlockSharedData ← Aiur.Concrete.Bytecode.getSharedData
+        Aiur.Concrete.Bytecode.setDegrees degrees
+        let finalMax ← pure (maximalSharedData.maximals defaultBlockSharedData)
+        __do_jp finalMax
+RECURSION WORKER Aiur.Concrete.Constructor.sizeBound._unsafe_rec
+Aiur.Concrete.Decls → Nat → Std.HashSet Aiur.Global → Aiur.Concrete.Constructor → Except String Nat
+IMPLEMENTATION
+fun decls bound visited c =>
+  List.foldlM
+    (fun acc t => do
+      let s ← Aiur.Concrete.Typ.sizeBound._unsafe_rec decls bound visited t
+      pure (acc + s))
+    0 c.argTypes
+RECURSION WORKER Aiur.Concrete.DataType.sizeBound._unsafe_rec
+Aiur.Concrete.Decls → Nat → Std.HashSet Aiur.Global → Aiur.Concrete.DataType → Except String Nat
+IMPLEMENTATION
+fun decls x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, x, x_3 => pure 1
+  | bound.succ, visited, dt =>
+    if visited.contains dt.name = true then
+      throw (toString "Cycle detected at datatype `" ++ toString dt.name ++ toString "`")
+    else
+      let visited := visited.insert dt.name;
+      do
+      let ctorSizes ← List.mapM (Aiur.Concrete.Constructor.sizeBound._unsafe_rec decls bound visited) dt.constructors
+      let maxFields : Nat := List.foldl max 0 ctorSizes
+      if (dt.constructors.length == 1) = true then pure maxFields else pure (maxFields + 1)
+RECURSION WORKER Aiur.Concrete.Term.compile._unsafe_rec
+Aiur.Concrete.Term →
+  Aiur.Concrete.Typ →
+    Aiur.LayoutMap →
+      Std.HashMap Aiur.Local (Array Aiur.Bytecode.ValIdx) → optParam Bool false → Aiur.CompileM Aiur.Bytecode.Block
+IMPLEMENTATION
+fun term returnTyp layoutMap bindings yieldCtrl =>
+  match term with
+  |
+  Aiur.Concrete.Term.letVar typ escapes var (Aiur.Concrete.Term.match matchTyp valEscapes scrut cases defaultOpt) bod =>
+    if valEscapes = true then
+      Aiur.Concrete.Term.compile._unsafe_rec (Aiur.Concrete.Term.match matchTyp valEscapes scrut cases defaultOpt)
+        returnTyp layoutMap bindings yieldCtrl
+    else
+      let idxs := bindings[scrut]?.getD #[0];
+      do
+      let ops ← Aiur.extractOps
+      let __x ←
+        Array.foldlM (Aiur.Concrete.addCase._unsafe_rec layoutMap bindings returnTyp idxs true) (#[], none) cases
+      match __x with
+        | (matchCases, defaultBlock) =>
+          have __do_jp := fun defaultBlock =>
+            have __do_jp := fun outputSize => do
+              let __x ← Aiur.Concrete.computeSharedLayout matchCases defaultBlock
+              match __x with
+                | (sharedAux, sharedLookups) => do
+                  let __do_lift ← get
+                  let mergedStart : Aiur.Bytecode.ValIdx := __do_lift.valIdx
+                  modify fun s =>
+                      { valIdx := s.valIdx + outputSize, ops := s.ops, selIdx := s.selIdx,
+                        degrees := Array.foldl (fun x1 x2 => x1.push x2) s.degrees (Array.replicate outputSize 1) }
+                  let mergedIdxs : Array Nat := Array.range' mergedStart outputSize
+                  let continuation ←
+                    Aiur.Concrete.Term.compile._unsafe_rec bod returnTyp layoutMap (bindings.insert var mergedIdxs)
+                        yieldCtrl
+                  let ctrl : Aiur.Bytecode.Ctrl :=
+                    Aiur.Bytecode.Ctrl.matchContinue idxs[0]! matchCases defaultBlock outputSize sharedAux sharedLookups
+                      continuation
+                  pure { ops := ops, ctrl := ctrl };
+            match Aiur.typSize layoutMap matchTyp with
+            | Except.error e => do
+              let outputSize ← throw e
+              __do_jp outputSize
+            | Except.ok n => do
+              let outputSize ← pure n
+              __do_jp outputSize;
+          match defaultOpt with
+          | some t => do
+            let blk ← Aiur.Concrete.Term.compile._unsafe_rec t returnTyp layoutMap bindings true
+            let defaultBlock ← pure (some blk)
+            __do_jp defaultBlock
+          | none => do
+            let defaultBlock ← pure defaultBlock
+            __do_jp defaultBlock
+  | Aiur.Concrete.Term.letWild typ escapes (Aiur.Concrete.Term.match matchTyp valEscapes scrut cases defaultOpt) bod =>
+    if valEscapes = true then
+      Aiur.Concrete.Term.compile._unsafe_rec (Aiur.Concrete.Term.match matchTyp valEscapes scrut cases defaultOpt)
+        returnTyp layoutMap bindings yieldCtrl
+    else
+      let idxs := bindings[scrut]?.getD #[0];
+      do
+      let ops ← Aiur.extractOps
+      let __x ←
+        Array.foldlM (Aiur.Concrete.addCase._unsafe_rec layoutMap bindings returnTyp idxs true) (#[], none) cases
+      match __x with
+        | (matchCases, defaultBlock) =>
+          have __do_jp := fun defaultBlock =>
+            have __do_jp := fun outputSize => do
+              let __x ← Aiur.Concrete.computeSharedLayout matchCases defaultBlock
+              match __x with
+                | (sharedAux, sharedLookups) => do
+                  modify fun s =>
+                      { valIdx := s.valIdx + outputSize, ops := s.ops, selIdx := s.selIdx,
+                        degrees := Array.foldl (fun x1 x2 => x1.push x2) s.degrees (Array.replicate outputSize 1) }
+                  let continuation ← Aiur.Concrete.Term.compile._unsafe_rec bod returnTyp layoutMap bindings yieldCtrl
+                  let ctrl : Aiur.Bytecode.Ctrl :=
+                    Aiur.Bytecode.Ctrl.matchContinue idxs[0]! matchCases defaultBlock outputSize sharedAux sharedLookups
+                      continuation
+                  pure { ops := ops, ctrl := ctrl };
+            match Aiur.typSize layoutMap matchTyp with
+            | Except.error e => do
+              let outputSize ← throw e
+              __do_jp outputSize
+            | Except.ok n => do
+              let outputSize ← pure n
+              __do_jp outputSize;
+          match defaultOpt with
+          | some t => do
+            let blk ← Aiur.Concrete.Term.compile._unsafe_rec t returnTyp layoutMap bindings true
+            let defaultBlock ← pure (some blk)
+            __do_jp defaultBlock
+          | none => do
+            let defaultBlock ← pure defaultBlock
+            __do_jp defaultBlock
+  | Aiur.Concrete.Term.letVar typ escapes var val bod => do
+    let val ← Aiur.toIndex layoutMap bindings val
+    Aiur.Concrete.Term.compile._unsafe_rec bod returnTyp layoutMap (bindings.insert var val) yieldCtrl
+  | Aiur.Concrete.Term.letWild typ escapes val bod => do
+    let _ ← Aiur.toIndex layoutMap bindings val
+    Aiur.Concrete.Term.compile._unsafe_rec bod returnTyp layoutMap bindings yieldCtrl
+  | Aiur.Concrete.Term.letLoad typ escapes dst dstTyp src bod =>
+    have __do_jp := fun size =>
+      let ptrIdxs := bindings[src]?.getD #[0];
+      do
+      let loaded ← Aiur.pushOp (Aiur.Bytecode.Op.load size ptrIdxs[0]!) size
+      Aiur.Concrete.Term.compile._unsafe_rec bod returnTyp layoutMap (bindings.insert dst loaded) yieldCtrl;
+    match Aiur.typSize layoutMap dstTyp with
+    | Except.error e => do
+      let size ← throw e
+      __do_jp size
+    | Except.ok n => do
+      let size ← pure n
+      __do_jp size
+  | Aiur.Concrete.Term.debug typ escapes label term ret => do
+    let term ← Option.mapM (Aiur.toIndex layoutMap bindings) term
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.debug label term), selIdx := stt.selIdx,
+          degrees := stt.degrees }
+    Aiur.Concrete.Term.compile._unsafe_rec ret returnTyp layoutMap bindings yieldCtrl
+  | Aiur.Concrete.Term.assertEq typ escapes a b msg ret => do
+    let a ← Aiur.toIndex layoutMap bindings a
+    let b ← Aiur.toIndex layoutMap bindings b
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.assertEq a b msg), selIdx := stt.selIdx,
+          degrees := stt.degrees }
+    Aiur.Concrete.Term.compile._unsafe_rec ret returnTyp layoutMap bindings yieldCtrl
+  | Aiur.Concrete.Term.ioSetInfo typ escapes channel key idx len ret => do
+    let channel ← Aiur.toIndex layoutMap bindings channel
+    let key ← Aiur.toIndex layoutMap bindings key
+    let idx ← Aiur.toIndex layoutMap bindings idx
+    let len ← Aiur.toIndex layoutMap bindings len
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.ioSetInfo channel[0]! key idx[0]! len[0]!),
+          selIdx := stt.selIdx, degrees := stt.degrees }
+    Aiur.Concrete.Term.compile._unsafe_rec ret returnTyp layoutMap bindings yieldCtrl
+  | Aiur.Concrete.Term.ioWrite typ escapes channel data ret => do
+    let channel ← Aiur.toIndex layoutMap bindings channel
+    let data ← Aiur.toIndex layoutMap bindings data
+    modify fun stt =>
+        { valIdx := stt.valIdx, ops := stt.ops.push (Aiur.Bytecode.Op.ioWrite channel[0]! data), selIdx := stt.selIdx,
+          degrees := stt.degrees }
+    Aiur.Concrete.Term.compile._unsafe_rec ret returnTyp layoutMap bindings yieldCtrl
+  | Aiur.Concrete.Term.match typ escapes scrut cases defaultOpt =>
+    let idxs := bindings[scrut]?.getD #[0];
+    do
+    let ops ← Aiur.extractOps
+    let __x ←
+      Array.foldlM (Aiur.Concrete.addCase._unsafe_rec layoutMap bindings returnTyp idxs yieldCtrl) (#[], none) cases
+    match __x with
+      | (bcCases, defaultBlock) =>
+        have __do_jp := fun defaultBlock =>
+          let ctrl := Aiur.Bytecode.Ctrl.match idxs[0]! bcCases defaultBlock;
+          pure { ops := ops, ctrl := ctrl };
+        match defaultOpt with
+        | some t => do
+          let blk ← Aiur.Concrete.Term.compile._unsafe_rec t returnTyp layoutMap bindings yieldCtrl
+          let defaultBlock ← pure (some blk)
+          __do_jp defaultBlock
+        | none => do
+          let defaultBlock ← pure defaultBlock
+          __do_jp defaultBlock
+  | Aiur.Concrete.Term.ret typ escapes term => do
+    let idxs ← Aiur.toIndex layoutMap bindings term
+    let state ← get
+    let state : Aiur.CompilerState :=
+      { valIdx := state.valIdx, ops := state.ops, selIdx := state.selIdx + 1, degrees := state.degrees }
+    set state
+    let ops : Array Aiur.Bytecode.Op := state.ops
+    let id : Aiur.Bytecode.SelIdx := state.selIdx
+    pure { ops := ops, ctrl := Aiur.Bytecode.Ctrl.return (id - 1) idxs }
+  | x => do
+    let idxs ← Aiur.toIndex layoutMap bindings term
+    let state ← get
+    let state : Aiur.CompilerState :=
+      { valIdx := state.valIdx, ops := state.ops, selIdx := state.selIdx + 1, degrees := state.degrees }
+    set state
+    let ops : Array Aiur.Bytecode.Op := state.ops
+    let id : Aiur.Bytecode.SelIdx := state.selIdx
+    let ctrl : Aiur.Bytecode.Ctrl :=
+      if (yieldCtrl && !term.escapes) = true then Aiur.Bytecode.Ctrl.yield (id - 1) idxs
+      else Aiur.Bytecode.Ctrl.return (id - 1) idxs
+    pure { ops := ops, ctrl := ctrl }
+RECURSION WORKER Aiur.Concrete.Typ.sizeBound._unsafe_rec
+Aiur.Concrete.Decls → Nat → Std.HashSet Aiur.Global → Aiur.Concrete.Typ → Except String Nat
+IMPLEMENTATION
+fun decls x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | 0, x, x_3 => pure 0
+  | n.succ, x, Aiur.Concrete.Typ.unit => pure 0
+  | n.succ, x, Aiur.Concrete.Typ.field => pure 1
+  | n.succ, x, a.pointer => pure 1
+  | n.succ, x, Aiur.Concrete.Typ.function a a_1 => pure 1
+  | bound.succ, visited, Aiur.Concrete.Typ.tuple ts =>
+    Array.foldlM
+      (fun acc x =>
+        match x with
+        | ⟨t, property⟩ => do
+          let s ← Aiur.Concrete.Typ.sizeBound._unsafe_rec decls bound visited t
+          pure (acc + s))
+      0 ts.attach
+  | bound.succ, visited, t.array n => do
+    let s ← Aiur.Concrete.Typ.sizeBound._unsafe_rec decls bound visited t
+    pure (n * s)
+  | bound.succ, visited, Aiur.Concrete.Typ.ref g =>
+    match IndexMap.getByKey decls g with
+    | some (Aiur.Concrete.Declaration.dataType dt) =>
+      Aiur.Concrete.DataType.sizeBound._unsafe_rec decls bound visited dt
+    | x => throw (toString "Datatype not found: `" ++ toString g ++ toString "`")
+RECURSION WORKER Aiur.NativeAIR.Blake3.chunkLoop._unsafe_rec
+UInt64 → Aiur.NativeAIR.Blake3.CV → Bool → List UInt8 → Aiur.NativeAIR.Blake3.Output
+IMPLEMENTATION
+fun counter cv start input =>
+  if h : input.length ≤ 64 then
+    { cv := cv, block := Aiur.NativeAIR.Blake3.blockWords input, blockLen := input.length.toUInt32, counter := counter,
+      flags := (if start = true then 1 else 0) ||| 2 }
+  else
+    let next :=
+      Aiur.NativeAIR.Blake3.compress cv (Aiur.NativeAIR.Blake3.blockWords (List.take 64 input)) counter 64
+        (if start = true then 1 else 0);
+    Aiur.NativeAIR.Blake3.chunkLoop._unsafe_rec counter next false (List.drop 64 input)
+RECURSION WORKER Aiur.NativeAIR.Blake3.subtree._unsafe_rec
+Nat → List UInt8 → Aiur.NativeAIR.Blake3.Output
+IMPLEMENTATION
+fun counter input =>
+  if _h : input.length ≤ 1024 then Aiur.NativeAIR.Blake3.chunkOutput counter.toUInt64 input
+  else
+    let split := Aiur.NativeAIR.Blake3.leftLen input.length;
+    let left := Aiur.NativeAIR.Blake3.subtree._unsafe_rec counter (List.take split input);
+    let right := Aiur.NativeAIR.Blake3.subtree._unsafe_rec (counter + split / 1024) (List.drop split input);
+    Aiur.NativeAIR.Blake3.parentOutput left.chainingValue right.chainingValue
+RECURSION WORKER Aiur.NativeAIR.BlockEmitter.blockSelector._unsafe_rec
+Array Aiur.NativeAIR.Expr → Aiur.Bytecode.Block → Option Aiur.NativeAIR.Expr
+IMPLEMENTATION
+fun selectors block => Aiur.NativeAIR.BlockEmitter.ctrlSelector._unsafe_rec selectors block.ctrl
+RECURSION WORKER Aiur.NativeAIR.BlockEmitter.ctrlSelector._unsafe_rec
+Array Aiur.NativeAIR.Expr → Aiur.Bytecode.Ctrl → Option Aiur.NativeAIR.Expr
+IMPLEMENTATION
+fun selectors x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return index a => selectors[index]?
+  | Aiur.Bytecode.Ctrl.yield index a => selectors[index]?
+  | Aiur.Bytecode.Ctrl.match a branches fallback => do
+    let entries ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ => Aiur.NativeAIR.BlockEmitter.blockSelector._unsafe_rec selectors pair.snd)
+          branches.attach.toList
+    have __do_jp : List Aiur.NativeAIR.Expr → Option Aiur.NativeAIR.Expr := fun last =>
+      pure (Aiur.NativeAIR.BlockEmitter.sum (entries ++ last))
+    match fallback with
+      | none => do
+        let last ← some []
+        __do_jp last
+      | some block => do
+        let last ←
+          Option.map (fun expr => [expr]) (Aiur.NativeAIR.BlockEmitter.blockSelector._unsafe_rec selectors block)
+        __do_jp last
+  | Aiur.Bytecode.Ctrl.matchContinue a branches fallback outputSize sharedAuxiliaries sharedLookups a_1 => do
+    let entries ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ => Aiur.NativeAIR.BlockEmitter.blockSelector._unsafe_rec selectors pair.snd)
+          branches.attach.toList
+    have __do_jp : List Aiur.NativeAIR.Expr → Option Aiur.NativeAIR.Expr := fun last =>
+      pure (Aiur.NativeAIR.BlockEmitter.sum (entries ++ last))
+    match fallback with
+      | none => do
+        let last ← some []
+        __do_jp last
+      | some block => do
+        let last ←
+          Option.map (fun expr => [expr]) (Aiur.NativeAIR.BlockEmitter.blockSelector._unsafe_rec selectors block)
+        __do_jp last
+RECURSION WORKER Aiur.NativeAIR.BlockEmitter.emitBlock._unsafe_rec
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.Expr →
+      Array Aiur.NativeAIR.RowExpr → Nat → Nat → Aiur.Bytecode.Block → Option Aiur.NativeAIR.BlockEmitter.Emission
+IMPLEMENTATION
+fun selectors context incoming rows column lookup block => do
+  let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors block
+  let operations ← Aiur.NativeAIR.OpEmitter.emitOps incoming context.rank block.ops.toList rows column
+  let control ←
+    Aiur.NativeAIR.BlockEmitter.emitCtrl._unsafe_rec selectors context incoming operations.values operations.column
+        (lookup + operations.queries.length) block.ctrl
+  pure
+      (Aiur.NativeAIR.BlockEmitter.Emission.prefix [entry.frontMul ((Aiur.NativeAIR.Expr.konst 1).frontSub entry)]
+        (Aiur.NativeAIR.BlockEmitter.Emission.afterOps incoming lookup operations control))
+RECURSION WORKER Aiur.NativeAIR.BlockEmitter.emitCtrl._unsafe_rec
+Array Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.BlockEmitter.Context →
+    Aiur.NativeAIR.Expr →
+      Array Aiur.NativeAIR.RowExpr → Nat → Nat → Aiur.Bytecode.Ctrl → Option Aiur.NativeAIR.BlockEmitter.Emission
+IMPLEMENTATION
+fun selectors context incoming rows column lookup x =>
+  match x with
+  | Aiur.Bytecode.Ctrl.return a indices => do
+    let inputs ← Aiur.NativeAIR.OpEmitter.select rows (Array.range context.inputSize)
+    let outputs ← Aiur.NativeAIR.OpEmitter.select rows indices
+    pure (Aiur.NativeAIR.BlockEmitter.returned context incoming rows inputs outputs column lookup)
+  | Aiur.Bytecode.Ctrl.yield index indices => do
+    let selector ← selectors[index]?
+    let outputs ← Aiur.NativeAIR.OpEmitter.select rows indices
+    pure (Aiur.NativeAIR.BlockEmitter.yielded selector rows outputs column lookup)
+  | Aiur.Bytecode.Ctrl.match index branches fallback => do
+    let matched ← rows[index]?
+    let cases ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ => do
+              let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors pair.snd
+              let emission ←
+                Aiur.NativeAIR.BlockEmitter.emitBlock._unsafe_rec selectors context entry rows column lookup pair.snd
+              pure
+                  (Aiur.NativeAIR.BlockEmitter.Emission.prefix
+                    [Aiur.NativeAIR.BlockEmitter.caseEquation entry matched pair.fst] emission))
+          branches.attach.toList
+    have __do_jp : List Aiur.NativeAIR.BlockEmitter.Emission → Option Aiur.NativeAIR.BlockEmitter.Emission :=
+      fun default => pure (Aiur.NativeAIR.BlockEmitter.join rows column lookup (cases ++ default))
+    match fallback with
+      | none => do
+        let default ← some []
+        __do_jp default
+      | some block => do
+        let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors block
+        let emission ←
+          Aiur.NativeAIR.BlockEmitter.emitBlock._unsafe_rec selectors context entry rows (column + branches.size) lookup
+              block
+        let default ←
+          pure
+              [Aiur.NativeAIR.BlockEmitter.Emission.prefix
+                  (Aiur.NativeAIR.BlockEmitter.defaultEquations entry matched column branches) emission]
+        __do_jp default
+  | Aiur.Bytecode.Ctrl.matchContinue index branches fallback size sharedAuxiliaries sharedLookups continuation => do
+    let matched ← rows[index]?
+    let cases ←
+      List.mapM
+          (fun x =>
+            match x with
+            | ⟨pair, property⟩ => do
+              let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors pair.snd
+              let emission ←
+                Aiur.NativeAIR.BlockEmitter.emitBlock._unsafe_rec selectors context entry rows column lookup pair.snd
+              pure
+                  (Aiur.NativeAIR.BlockEmitter.Emission.prefix
+                    [Aiur.NativeAIR.BlockEmitter.caseEquation entry matched pair.fst] emission))
+          branches.attach.toList
+    have __do_jp : List Aiur.NativeAIR.BlockEmitter.Emission → Option Aiur.NativeAIR.BlockEmitter.Emission :=
+      fun default =>
+      let joined := Aiur.NativeAIR.BlockEmitter.join rows column lookup (cases ++ default);
+      if (joined.yields.all fun part => part.values.size == size) = true then
+        let gate := Aiur.NativeAIR.BlockEmitter.yieldGate joined.yields;
+        do
+        let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors continuation
+        let equations : List Aiur.NativeAIR.Expr :=
+          Aiur.NativeAIR.BlockEmitter.mergeEquations incoming joined.column size joined.yields ++ [entry.frontSub gate]
+        let continued ←
+          Aiur.NativeAIR.BlockEmitter.emitBlock._unsafe_rec selectors context gate
+              (rows ++ Aiur.NativeAIR.OpEmitter.advice joined.column size) (joined.column + size) joined.lookup
+              continuation
+        pure (joined.continued equations continued)
+      else none
+    match fallback with
+      | none => do
+        let default ← some []
+        __do_jp default
+      | some block => do
+        let entry ← Aiur.NativeAIR.BlockEmitter.blockSelector selectors block
+        let emission ←
+          Aiur.NativeAIR.BlockEmitter.emitBlock._unsafe_rec selectors context entry rows (column + branches.size) lookup
+              block
+        let default ←
+          pure
+              [Aiur.NativeAIR.BlockEmitter.Emission.prefix
+                  (Aiur.NativeAIR.BlockEmitter.defaultEquations entry matched column branches) emission]
+        __do_jp default
+RECURSION WORKER Aiur.NativeAIR.Challenger.sampleBytes._unsafe_rec
+Aiur.NativeAIR.Challenger.Hash32 → Nat → Aiur.NativeAIR.Challenger.State → List UInt8 × Aiur.NativeAIR.Challenger.State
+IMPLEMENTATION
+fun hash x x_1 =>
+  match x, x_1 with
+  | 0, state => ([], state)
+  | count.succ, state =>
+    match Aiur.NativeAIR.Challenger.sampleByte hash state with
+    | (byte, next) =>
+      match Aiur.NativeAIR.Challenger.sampleBytes._unsafe_rec hash count next with
+      | (rest, final) => (byte :: rest, final)
+RECURSION WORKER Aiur.NativeAIR.Challenger.sampleField._unsafe_rec
+Aiur.NativeAIR.Challenger.Hash32 →
+  Nat → Aiur.NativeAIR.Challenger.State → Option (Aiur.G × Aiur.NativeAIR.Challenger.State)
+IMPLEMENTATION
+fun hash x x_1 =>
+  match x, x_1 with
+  | 0, x => none
+  | fuel.succ, state =>
+    match Aiur.NativeAIR.Challenger.sampleWord hash state with
+    | (word, next) =>
+      if word < Aiur.gSize.toNat then some (Aiur.G.ofNat word, next)
+      else Aiur.NativeAIR.Challenger.sampleField._unsafe_rec hash fuel next
+RECURSION WORKER Aiur.NativeAIR.CircuitEmitter.emitMembers._unsafe_rec
+Aiur.NativeAIR.Expr →
+  Nat → Nat → Nat → Aiur.Bytecode.Toplevel → List Nat → Option (List Aiur.NativeAIR.CircuitEmitter.Member)
+IMPLEMENTATION
+fun rank column lookup selectorBase program x =>
+  match x with
+  | [] => some []
+  | index :: indices => do
+    let member ← Aiur.NativeAIR.CircuitEmitter.emitMember rank column lookup selectorBase program index
+    let rest ←
+      Aiur.NativeAIR.CircuitEmitter.emitMembers._unsafe_rec rank column lookup
+          (selectorBase + member.function.layout.selectors) program indices
+    pure (member :: rest)
+RECURSION WORKER Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec
+Aiur.NativeAIR.GraphWidths →
+  Bool → Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × Nat)
+IMPLEMENTATION
+fun widths allowStage2 x x_1 =>
+  match x, x_1 with
+  | Aiur.NativeAIR.Expr.konst value, nodes =>
+    some (Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.konst value))
+  | Aiur.NativeAIR.Expr.var column, nodes =>
+    if
+        ((column.source != Aiur.NativeAIR.Source.stage2 || allowStage2) &&
+            decide (column.index < widths.width column.source)) =
+          true then
+      some (Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.var column))
+    else none
+  | Aiur.NativeAIR.Expr.publicInput index, nodes =>
+    if index < widths.publics then some (Aiur.NativeAIR.Compiler.intern nodes (Aiur.NativeAIR.Node.publicInput index))
+    else none
+  | Aiur.NativeAIR.Expr.isFirstRow, nodes => some (Aiur.NativeAIR.Compiler.intern nodes Aiur.NativeAIR.Node.isFirstRow)
+  | Aiur.NativeAIR.Expr.isLastRow, nodes => some (Aiur.NativeAIR.Compiler.intern nodes Aiur.NativeAIR.Node.isLastRow)
+  | Aiur.NativeAIR.Expr.isTransition, nodes =>
+    some (Aiur.NativeAIR.Compiler.intern nodes Aiur.NativeAIR.Node.isTransition)
+  | left.add right, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 left nodes
+    match __x with
+      | (nodes, a) => do
+        let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 right nodes
+        match __x with
+          | (nodes, b) => pure (Aiur.NativeAIR.Compiler.add nodes a b)
+  | left.sub right, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 left nodes
+    match __x with
+      | (nodes, a) => do
+        let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 right nodes
+        match __x with
+          | (nodes, b) => pure (Aiur.NativeAIR.Compiler.sub nodes a b)
+  | left.mul right, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 left nodes
+    match __x with
+      | (nodes, a) => do
+        let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 right nodes
+        match __x with
+          | (nodes, b) => pure (Aiur.NativeAIR.Compiler.mul nodes a b)
+  | child.neg, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileExpr._unsafe_rec widths allowStage2 child nodes
+    match __x with
+      | (nodes, a) => pure (Aiur.NativeAIR.Compiler.neg nodes a)
+RECURSION WORKER Aiur.NativeAIR.Compiler.compileExprs._unsafe_rec
+Aiur.NativeAIR.GraphWidths →
+  Bool → List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Nat)
+IMPLEMENTATION
+fun widths allowStage2 x x_1 =>
+  match x, x_1 with
+  | [], nodes => some (nodes, [])
+  | expr :: exprs, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileExpr widths allowStage2 expr nodes
+    match __x with
+      | (nodes, root) => do
+        let __x ← Aiur.NativeAIR.Compiler.compileExprs._unsafe_rec widths allowStage2 exprs nodes
+        match __x with
+          | (nodes, roots) => pure (nodes, root :: roots)
+RECURSION WORKER Aiur.NativeAIR.Compiler.compileLookups._unsafe_rec
+Aiur.NativeAIR.GraphWidths →
+  List Aiur.NativeAIR.Compiler.ExprLookup →
+    List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Aiur.NativeAIR.Lookup)
+IMPLEMENTATION
+fun widths x x_1 =>
+  match x, x_1 with
+  | [], nodes => some (nodes, [])
+  | lookup :: lookups, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileLookup widths lookup nodes
+    match __x with
+      | (nodes, root) => do
+        let __x ← Aiur.NativeAIR.Compiler.compileLookups._unsafe_rec widths lookups nodes
+        match __x with
+          | (nodes, roots) => pure (nodes, root :: roots)
+RECURSION WORKER Aiur.NativeAIR.Compiler.compileZeros._unsafe_rec
+Aiur.NativeAIR.GraphWidths →
+  List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Node → Option (List Aiur.NativeAIR.Node × List Nat)
+IMPLEMENTATION
+fun widths x x_1 =>
+  match x, x_1 with
+  | [], nodes => some (nodes, [])
+  | expr :: exprs, nodes => do
+    let __x ← Aiur.NativeAIR.Compiler.compileExpr widths false expr nodes
+    match __x with
+      | (nodes, root) => do
+        let head ← Aiur.NativeAIR.Compiler.recordZero nodes root
+        let __x ← Aiur.NativeAIR.Compiler.compileZeros._unsafe_rec widths exprs nodes
+        match __x with
+          | (nodes, roots) => pure (nodes, head ++ roots)
+RECURSION WORKER Aiur.NativeAIR.Expr.eval._unsafe_rec
+{W : Type u_1} → Aiur.NativeAIR.EvalOps W → Aiur.NativeAIR.Values W → Aiur.NativeAIR.Expr → Option W
+IMPLEMENTATION
+fun {W} ops values x =>
+  match x with
+  | Aiur.NativeAIR.Expr.konst value => some (ops.konst value)
+  | Aiur.NativeAIR.Expr.var column => (values.columns column.source column.offset)[column.index]?
+  | Aiur.NativeAIR.Expr.publicInput index => values.publics[index]?
+  | Aiur.NativeAIR.Expr.isFirstRow => some values.isFirstRow
+  | Aiur.NativeAIR.Expr.isLastRow => some values.isLastRow
+  | Aiur.NativeAIR.Expr.isTransition => some values.isTransition
+  | a.add b => do
+    let __do_lift ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values a
+    let __do_lift_1 ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values b
+    pure (ops.add __do_lift __do_lift_1)
+  | a.sub b => do
+    let __do_lift ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values a
+    let __do_lift_1 ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values b
+    pure (ops.sub __do_lift __do_lift_1)
+  | a.mul b => do
+    let __do_lift ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values a
+    let __do_lift_1 ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values b
+    pure (ops.mul __do_lift __do_lift_1)
+  | a.neg => do
+    let __do_lift ← Aiur.NativeAIR.Expr.eval._unsafe_rec ops values a
+    pure (ops.neg __do_lift)
+RECURSION WORKER Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec
+Aiur.NativeAIR.Expr → Bool
+IMPLEMENTATION
+fun x =>
+  match x with
+  | child.neg => !child.isConstant && Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec child
+  | a.add b => Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec a && Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec b
+  | a.sub b => Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec a && Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec b
+  | a.mul b => Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec a && Aiur.NativeAIR.Expr.noConstantNegs._unsafe_rec b
+  | x => true
+RECURSION WORKER Aiur.NativeAIR.ExtensionMmcs.shape._unsafe_rec
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.NativeAIR.ProofCodec.Extension) → Bool
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], [] => true
+  | dimension :: dimensions, row :: rows =>
+    row.length == dimension.width && Aiur.NativeAIR.ExtensionMmcs.shape._unsafe_rec dimensions rows
+  | x, x_2 => false
+RECURSION WORKER Aiur.NativeAIR.Folding.foldCoefficients._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → Aiur.NativeAIR.Domain.Subgroup → R → List R → List R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [Add R] [Mul R] arity challenge coefficients =>
+  if _empty : coefficients = [] then []
+  else
+    Aiur.NativeAIR.Quotient.horner challenge (List.take (Aiur.NativeAIR.Domain.size arity) coefficients) ::
+      Aiur.NativeAIR.Folding.foldCoefficients._unsafe_rec arity challenge
+        (List.drop (Aiur.NativeAIR.Domain.size arity) coefficients)
+RECURSION WORKER Aiur.NativeAIR.Folding.rowCoefficients._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → Aiur.NativeAIR.Domain.Subgroup → R → List R → List R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [Add R] [Mul R] arity point coefficients =>
+  if _empty : coefficients = [] then []
+  else
+    Aiur.NativeAIR.Polynomial.add (List.take (Aiur.NativeAIR.Domain.size arity) coefficients)
+      (Aiur.NativeAIR.Polynomial.scale point
+        (Aiur.NativeAIR.Folding.rowCoefficients._unsafe_rec arity point
+          (List.drop (Aiur.NativeAIR.Domain.size arity) coefficients)))
+RECURSION WORKER Aiur.NativeAIR.FriQuery.walk._unsafe_rec
+Aiur.NativeAIR.Domain.Subgroup →
+  Aiur.NativeAIR.FriQuery.State →
+    List (Nat × Aiur.NativeAIR.ProofCodec.Extension) →
+      List Aiur.NativeAIR.FriQuery.Round → Option Aiur.NativeAIR.FriQuery.Result
+IMPLEMENTATION
+fun final state openings x =>
+  match x with
+  | [] => if (state.domain == final && openings.isEmpty) = true then some { state := state, rows := [] } else none
+  | round :: rest => do
+    let result ← Aiur.NativeAIR.FriQuery.step state round openings
+    let tail ← Aiur.NativeAIR.FriQuery.walk._unsafe_rec final result.state result.remaining rest
+    pure { state := tail.state, rows := result.row :: tail.rows }
+RECURSION WORKER Aiur.NativeAIR.Interpolation.combine._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → List R → R → List (R × R) → List R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [Add R] [Mul R] vanishing scale x =>
+  match x with
+  | [] => []
+  | (root, value) :: rest =>
+    Aiur.NativeAIR.Polynomial.add
+      (Aiur.NativeAIR.Polynomial.scale (value * (root * scale)) (Aiur.NativeAIR.Polynomial.divide root vanishing))
+      (Aiur.NativeAIR.Interpolation.combine._unsafe_rec vanishing scale rest)
+RECURSION WORKER Aiur.NativeAIR.Interpolation.derivativeValue._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → R → List R → R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [Add R] [Mul R] point x =>
+  match x with
+  | [] => 0
+  | head :: rest =>
+    Aiur.NativeAIR.Quotient.horner point rest +
+      point * Aiur.NativeAIR.Interpolation.derivativeValue._unsafe_rec point rest
+RECURSION WORKER Aiur.NativeAIR.Interpolation.weightedSum._unsafe_rec
+Aiur.NativeAIR.ProofCodec.Extension →
+  Aiur.NativeAIR.ProofCodec.Extension →
+    List (Aiur.NativeAIR.ProofCodec.Extension × Aiur.NativeAIR.ProofCodec.Extension) →
+      Option Aiur.NativeAIR.ProofCodec.Extension
+IMPLEMENTATION
+fun scale point x =>
+  match x with
+  | [] => some 0
+  | (root, value) :: rest => do
+    let inverse ← (point - root).tryInverse
+    let tail ← Aiur.NativeAIR.Interpolation.weightedSum._unsafe_rec scale point rest
+    pure (value * (root * scale) * inverse + tail)
+RECURSION WORKER Aiur.NativeAIR.KeyCodec.encodeNat._unsafe_rec
+Nat → Nat → List UInt8
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | 0, x => []
+  | count.succ, value => value.toUInt8 :: Aiur.NativeAIR.KeyCodec.encodeNat._unsafe_rec count (value / 256)
+RECURSION WORKER Aiur.NativeAIR.KeyCodec.nodeDegreesFrom._unsafe_rec
+List Aiur.NativeAIR.Node → Array Nat → Option (Array Nat)
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], degrees => some degrees
+  | node :: nodes, degrees => do
+    let __do_lift ← Aiur.NativeAIR.KeyCodec.nodeDegree degrees node
+    Aiur.NativeAIR.KeyCodec.nodeDegreesFrom._unsafe_rec nodes (degrees.push __do_lift)
+RECURSION WORKER Aiur.NativeAIR.KeyCodec.readMany._unsafe_rec
+{α : Type} → Aiur.NativeAIR.KeyCodec.Reader α → Nat → Aiur.NativeAIR.KeyCodec.Reader (List α)
+IMPLEMENTATION
+fun {α} read x =>
+  match x with
+  | 0 => pure []
+  | count.succ => do
+    let first ← read
+    let rest ← Aiur.NativeAIR.KeyCodec.readMany._unsafe_rec read count
+    pure (first :: rest)
+RECURSION WORKER Aiur.NativeAIR.KeyCodec.readNat._unsafe_rec
+Nat → Aiur.NativeAIR.KeyCodec.Reader Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | 0 => pure 0
+  | count.succ => do
+    let byte ← Aiur.NativeAIR.KeyCodec.readByte
+    let rest ← Aiur.NativeAIR.KeyCodec.readNat._unsafe_rec count
+    pure (byte.toNat + 256 * rest)
+RECURSION WORKER Aiur.NativeAIR.LogUp.numerator._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [OfNat R 1] → [Add R] → [Mul R] → List (R × R) → R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [OfNat R 1] [Add R] [Mul R] x =>
+  match x with
+  | [] => 0
+  | (weight, message) :: rest =>
+    weight * Aiur.NativeAIR.LogUp.product (List.map Prod.snd rest) +
+      message * Aiur.NativeAIR.LogUp.numerator._unsafe_rec rest
+RECURSION WORKER Aiur.NativeAIR.LookupEmitter.addArgs._unsafe_rec
+List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr → List Aiur.NativeAIR.Expr
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], right => right
+  | left, [] => left
+  | x :: left, y :: right => x.frontAdd y :: Aiur.NativeAIR.LookupEmitter.addArgs._unsafe_rec left right
+RECURSION WORKER Aiur.NativeAIR.Merkle.rowsAt._unsafe_rec
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.G) → Nat → List (List Aiur.G)
+IMPLEMENTATION
+fun x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | dimension :: dimensions, row :: rows, height =>
+    if dimension.logHeight = height then row :: Aiur.NativeAIR.Merkle.rowsAt._unsafe_rec dimensions rows height
+    else Aiur.NativeAIR.Merkle.rowsAt._unsafe_rec dimensions rows height
+  | x, x_3, x_4 => []
+RECURSION WORKER Aiur.NativeAIR.Merkle.shape._unsafe_rec
+List Aiur.NativeAIR.Merkle.Dimensions → List (List Aiur.G) → Bool
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], [] => true
+  | dimension :: dimensions, row :: rows =>
+    row.length == dimension.width && Aiur.NativeAIR.Merkle.shape._unsafe_rec dimensions rows
+  | x, x_2 => false
+RECURSION WORKER Aiur.NativeAIR.Merkle.walk._unsafe_rec
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    List (List Aiur.G) →
+      Nat → Nat → Aiur.NativeAIR.Merkle.Digest → List Aiur.NativeAIR.Merkle.Digest → Aiur.NativeAIR.Merkle.Hashing
+IMPLEMENTATION
+fun hash dimensions rows height index current x =>
+  match x with
+  | [] => { digest := current, inputs := [] }
+  | sibling :: proof =>
+    let first := Aiur.NativeAIR.Merkle.step hash dimensions rows (height - 1) index current sibling;
+    let rest := Aiur.NativeAIR.Merkle.walk._unsafe_rec hash dimensions rows (height - 1) (index / 2) first.digest proof;
+    { digest := rest.digest, inputs := first.inputs ++ rest.inputs }
+RECURSION WORKER Aiur.NativeAIR.OpEmitter.emitOps._unsafe_rec
+Aiur.NativeAIR.Expr →
+  Aiur.NativeAIR.Expr →
+    List Aiur.Bytecode.Op → Array Aiur.NativeAIR.RowExpr → Nat → Option Aiur.NativeAIR.OpEmitter.OpsEmission
+IMPLEMENTATION
+fun selector rank x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], rows, column => some { values := rows, column := column }
+  | op :: ops, rows, column => do
+    let first ← Aiur.NativeAIR.OpEmitter.emitOp selector rank column op rows
+    let rest ←
+      Aiur.NativeAIR.OpEmitter.emitOps._unsafe_rec selector rank ops (rows ++ first.outputs) (column + first.used)
+    pure
+        { values := rest.values, column := rest.column, equations := first.equations ++ rest.equations,
+          queries := first.queries ++ rest.queries, calls := first.calls ++ rest.calls }
+RECURSION WORKER Aiur.NativeAIR.Polynomial.add._unsafe_rec
+{R : Type u_1} → [Add R] → List R → List R → List R
+IMPLEMENTATION
+fun {R} [Add R] x x_1 =>
+  match x, x_1 with
+  | [], right => right
+  | left, [] => left
+  | first :: left, second :: right => (first + second) :: Aiur.NativeAIR.Polynomial.add._unsafe_rec left right
+RECURSION WORKER Aiur.NativeAIR.Polynomial.divide._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [Add R] → [Mul R] → R → List R → List R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [Add R] [Mul R] point x =>
+  match x with
+  | [] => []
+  | [head] => []
+  | head :: next :: rest =>
+    Aiur.NativeAIR.Quotient.horner point (next :: rest) ::
+      Aiur.NativeAIR.Polynomial.divide._unsafe_rec point (next :: rest)
+RECURSION WORKER Aiur.NativeAIR.Polynomial.sub._unsafe_rec
+{R : Type u_1} → [OfNat R 0] → [Sub R] → List R → List R → List R
+IMPLEMENTATION
+fun {R} [OfNat R 0] [Sub R] x x_1 =>
+  match x, x_1 with
+  | [], right => List.map (fun x => 0 - x) right
+  | left, [] => left
+  | first :: left, second :: right => (first - second) :: Aiur.NativeAIR.Polynomial.sub._unsafe_rec left right
+RECURSION WORKER Aiur.NativeAIR.PrunedMerkle.boundaryCount._unsafe_rec
+Nat → List Nat → Nat
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | 0, x => 0
+  | steps.succ, indices =>
+    let parents := Aiur.NativeAIR.PrunedMerkle.parentIndices indices;
+    2 * parents.length - indices.length + Aiur.NativeAIR.PrunedMerkle.boundaryCount._unsafe_rec steps parents
+RECURSION WORKER Aiur.NativeAIR.PrunedMerkle.combine._unsafe_rec
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.PrunedMerkle.Node →
+    List Aiur.NativeAIR.Merkle.Digest →
+      Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node × List Aiur.NativeAIR.Merkle.Digest)
+IMPLEMENTATION
+fun hash x x_1 =>
+  match x, x_1 with
+  | [], proof => pure ([], proof)
+  | first :: rest, proof =>
+    match rest with
+    | second :: tail =>
+      if first.index % 2 = 0 ∧ second.index = first.index + 1 then do
+        let digest ←
+          Aiur.NativeAIR.PrunedMerkle.hashInput hash (Aiur.NativeAIR.Merkle.pairBytes first.digest second.digest)
+        let __x ← Aiur.NativeAIR.PrunedMerkle.combine._unsafe_rec hash tail proof
+        match __x with
+          | (nodes, remaining) =>
+            let tickets :=
+              List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend second.digest) first.tickets ++
+                List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend first.digest) second.tickets;
+            pure ({ index := first.index / 2, digest := digest, tickets := tickets } :: nodes, remaining)
+      else
+        match proof with
+        | sibling :: remaining => do
+          let digest ←
+            Aiur.NativeAIR.PrunedMerkle.hashInput hash
+                (Aiur.NativeAIR.Merkle.branchBytes first.index first.digest sibling)
+          let __x ← Aiur.NativeAIR.PrunedMerkle.combine._unsafe_rec hash rest remaining
+          match __x with
+            | (nodes, remaining) =>
+              pure
+                ({ index := first.index / 2, digest := digest,
+                      tickets := List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling) first.tickets } ::
+                    nodes,
+                  remaining)
+        | x => Aiur.NativeAIR.PrunedMerkle.reject
+    | [] =>
+      match proof with
+      | sibling :: remaining => do
+        let digest ←
+          Aiur.NativeAIR.PrunedMerkle.hashInput hash
+              (Aiur.NativeAIR.Merkle.branchBytes first.index first.digest sibling)
+        pure
+            ([{ index := first.index / 2, digest := digest,
+                  tickets := List.map (Aiur.NativeAIR.PrunedMerkle.Ticket.extend sibling) first.tickets }],
+              remaining)
+      | x => Aiur.NativeAIR.PrunedMerkle.reject
+RECURSION WORKER Aiur.NativeAIR.PrunedMerkle.initial._unsafe_rec
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Aiur.NativeAIR.PrunedMerkle.Ticket →
+        Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node)
+IMPLEMENTATION
+fun hash dimensions height x =>
+  match x with
+  | [] => pure []
+  | ticket :: tickets => do
+    let digest ←
+      Aiur.NativeAIR.PrunedMerkle.hashInput hash (Aiur.NativeAIR.Merkle.rowBytes dimensions ticket.rows height)
+    let rest ← Aiur.NativeAIR.PrunedMerkle.initial._unsafe_rec hash dimensions height tickets
+    pure ({ index := ticket.index, digest := digest, tickets := [ticket] } :: rest)
+RECURSION WORKER Aiur.NativeAIR.PrunedMerkle.inject._unsafe_rec
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      List Aiur.NativeAIR.PrunedMerkle.Node → Aiur.NativeAIR.PrunedMerkle.Logged (List Aiur.NativeAIR.PrunedMerkle.Node)
+IMPLEMENTATION
+fun hash dimensions height x =>
+  match x with
+  | [] => pure []
+  | node :: nodes =>
+    match node.tickets with
+    | lead :: members =>
+      if
+          (!members.all fun ticket =>
+                Aiur.NativeAIR.Merkle.rowsAt dimensions ticket.rows height ==
+                  Aiur.NativeAIR.Merkle.rowsAt dimensions lead.rows height) =
+            true then
+        Aiur.NativeAIR.PrunedMerkle.reject
+      else do
+        let leaf ←
+          Aiur.NativeAIR.PrunedMerkle.hashInput hash (Aiur.NativeAIR.Merkle.rowBytes dimensions lead.rows height)
+        let digest ← Aiur.NativeAIR.PrunedMerkle.hashInput hash (Aiur.NativeAIR.Merkle.pairBytes node.digest leaf)
+        let rest ← Aiur.NativeAIR.PrunedMerkle.inject._unsafe_rec hash dimensions height nodes
+        pure ({ index := node.index, digest := digest, tickets := node.tickets } :: rest)
+    | x => Aiur.NativeAIR.PrunedMerkle.reject
+RECURSION WORKER Aiur.NativeAIR.PrunedMerkle.walk._unsafe_rec
+Aiur.NativeAIR.Merkle.Hash →
+  List Aiur.NativeAIR.Merkle.Dimensions →
+    Nat →
+      Nat →
+        List Aiur.NativeAIR.PrunedMerkle.Node →
+          List Aiur.NativeAIR.Merkle.Digest →
+            Aiur.NativeAIR.PrunedMerkle.Logged
+              (List Aiur.NativeAIR.PrunedMerkle.Node × List Aiur.NativeAIR.Merkle.Digest)
+IMPLEMENTATION
+fun hash dimensions x x_1 x_2 x_3 =>
+  match x, x_1, x_2, x_3 with
+  | 0, x, nodes, proof => pure (nodes, proof)
+  | steps.succ, height, nodes, proof => do
+    let __x ← Aiur.NativeAIR.PrunedMerkle.combine hash nodes proof
+    match __x with
+      | (parents, remaining) =>
+        have __do_jp := fun next =>
+          Aiur.NativeAIR.PrunedMerkle.walk._unsafe_rec hash dimensions steps (height - 1) next remaining;
+        if Aiur.NativeAIR.Merkle.hasHeight dimensions (height - 1) = true then do
+          let next ← Aiur.NativeAIR.PrunedMerkle.inject hash dimensions (height - 1) parents
+          __do_jp next
+        else do
+          let next ← pure parents
+          __do_jp next
+RECURSION WORKER Aiur.NativeAIR.Quotient.coefficients._unsafe_rec
+List Aiur.NativeAIR.ProofCodec.Extension → Option (List Aiur.NativeAIR.ProofCodec.Extension)
+IMPLEMENTATION
+fun x =>
+  match x with
+  | [] => some []
+  | [head] => none
+  | first :: second :: rest => do
+    let __do_lift ← Aiur.NativeAIR.Quotient.coefficients._unsafe_rec rest
+    pure ((first + second * Aiur.NativeAIR.ProofCodec.Extension.basis) :: __do_lift)
+RECURSION WORKER Aiur.NativeAIR.VerifierArithmetic.checkRows._unsafe_rec
+Aiur.NativeAIR.VerifierArithmetic.Challenges →
+  List Aiur.NativeAIR.ProofShape.Row → Aiur.NativeAIR.ProofCodec.Extension → Option Aiur.NativeAIR.ProofCodec.Extension
+IMPLEMENTATION
+fun challenges x x_1 =>
+  match x, x_1 with
+  | [], entering => some entering
+  | row :: rows, entering => do
+    let __do_lift ← Aiur.NativeAIR.VerifierArithmetic.check challenges row entering
+    if __do_lift = true then Aiur.NativeAIR.VerifierArithmetic.checkRows._unsafe_rec challenges rows row.accumulator
+      else none
+RECURSION WORKER Aiur.Source.Eval.applyGlobal._unsafe_rec
+Aiur.Source.Decls → Nat → Aiur.Global → List Aiur.Value → Aiur.Source.Eval.EvalState → Aiur.Source.Eval.EvalResult
+IMPLEMENTATION
+fun decls fuel g args st =>
+  match fuel with
+  | 0 => Except.error Aiur.Source.Eval.SourceError.outOfFuel
+  | fuel.succ =>
+    match IndexMap.getByKey decls g with
+    | some (Aiur.Source.Declaration.function f) =>
+      if (args.length != f.inputs.length) = true then Except.error (Aiur.Source.Eval.SourceError.arityMismatch g)
+      else
+        let bindings := (List.map (fun x => x.fst) f.inputs).zip args;
+        match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings f.body st with
+        | Except.error (Aiur.Source.Eval.SourceError.earlyReturn v st') => Except.ok (v, st')
+        | Except.error e => Except.error e
+        | Except.ok (v, st') => Except.ok (v, st')
+    | some (Aiur.Source.Declaration.constructor a a_1) => Except.ok (Aiur.Value.ctor g args.toArray, st)
+    | none => Except.error (Aiur.Source.Eval.SourceError.unboundGlobal g)
+    | some (Aiur.Source.Declaration.dataType a) => Except.error (Aiur.Source.Eval.SourceError.notCallable g)
+RECURSION WORKER Aiur.Source.Eval.applyLocal._unsafe_rec
+Aiur.Source.Decls → Nat → Aiur.Value → List Aiur.Value → Aiur.Source.Eval.EvalState → Aiur.Source.Eval.EvalResult
+IMPLEMENTATION
+fun decls fuel v args st =>
+  match v with
+  | Aiur.Value.fn g => Aiur.Source.Eval.applyGlobal._unsafe_rec decls fuel g args st
+  | x => Except.error Aiur.Source.Eval.SourceError.notAFunctionValue
+RECURSION WORKER Aiur.Source.Eval.buildLimbChain._unsafe_rec
+Aiur.Source.Decls →
+  Aiur.Global → Aiur.Global → Aiur.Source.Eval.EvalState → List (Array Aiur.G) → Aiur.Value × Aiur.Source.Eval.EvalState
+IMPLEMENTATION
+fun decls consG nilG st x =>
+  match x with
+  | [] => Aiur.Source.Eval.storeValue decls st (Aiur.Value.ctor nilG #[])
+  | limb :: rest =>
+    match Aiur.Source.Eval.buildLimbChain._unsafe_rec decls consG nilG st rest with
+    | (restPtr, st') =>
+      Aiur.Source.Eval.storeValue decls st'
+        (Aiur.Value.ctor consG #[Aiur.Value.array (Array.map Aiur.Value.field limb), restPtr])
+RECURSION WORKER Aiur.Source.Eval.evalFrames._unsafe_rec
+Aiur.Source.Decls →
+  Nat →
+    List (Aiur.Pattern × Aiur.Source.Term) →
+      Aiur.Source.Eval.Bindings →
+        Aiur.Source.Eval.EvalState →
+          Except Aiur.Source.Eval.SourceError (Aiur.Source.Eval.Bindings × Aiur.Source.Eval.EvalState)
+IMPLEMENTATION
+fun decls fuel x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], bindings, st => Except.ok (bindings, st)
+  | (pattern, value) :: frames, bindings, st => do
+    let __x ← Aiur.Source.Eval.interp decls fuel bindings value st
+    match __x with
+      | (value, st) =>
+        match Aiur.Source.Eval.matchPattern st.store pattern value with
+        | some added => Aiur.Source.Eval.evalFrames._unsafe_rec decls fuel frames (added ++ bindings) st
+        | x => Except.error Aiur.Source.Eval.SourceError.patternFail
+RECURSION WORKER Aiur.Source.Eval.evalList._unsafe_rec
+Aiur.Source.Decls →
+  Nat →
+    Aiur.Source.Eval.Bindings →
+      List Aiur.Source.Term →
+        Aiur.Source.Eval.EvalState → Except Aiur.Source.Eval.SourceError (Array Aiur.Value × Aiur.Source.Eval.EvalState)
+IMPLEMENTATION
+fun decls fuel bindings x x_1 =>
+  match x, x_1 with
+  | [], st => Except.ok (#[], st)
+  | t :: ts, st =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match Aiur.Source.Eval.evalList._unsafe_rec decls fuel bindings ts st' with
+      | Except.error e => Except.error e
+      | Except.ok (vs, st'') => Except.ok (#[v] ++ vs, st'')
+RECURSION WORKER Aiur.Source.Eval.evalMatchCases._unsafe_rec
+Aiur.Source.Decls →
+  Nat →
+    Aiur.Source.Eval.Bindings →
+      Aiur.Source.Eval.EvalState → Aiur.Value → List (Aiur.Pattern × Aiur.Source.Term) → Aiur.Source.Eval.EvalResult
+IMPLEMENTATION
+fun decls fuel bindings st v x =>
+  match x with
+  | [] => Except.error Aiur.Source.Eval.SourceError.nonExhaustiveMatch
+  | (p, body) :: rest =>
+    match Aiur.Source.Eval.matchPattern st.store p v with
+    | some bs => Aiur.Source.Eval.interp._unsafe_rec decls fuel (bs ++ bindings) body st
+    | none => Aiur.Source.Eval.evalMatchCases._unsafe_rec decls fuel bindings st v rest
+RECURSION WORKER Aiur.Source.Eval.interp._unsafe_rec
+Aiur.Source.Decls →
+  Nat → Aiur.Source.Eval.Bindings → Aiur.Source.Term → Aiur.Source.Eval.EvalState → Aiur.Source.Eval.EvalResult
+IMPLEMENTATION
+fun decls fuel bindings t st =>
+  match t with
+  | Aiur.Source.Term.unit => Except.ok (Aiur.Value.unit, st)
+  | Aiur.Source.Term.var l =>
+    match List.find? (fun x => x.fst == l) bindings with
+    | some (fst, v) => Except.ok (v, st)
+    | none => Except.error (Aiur.Source.Eval.SourceError.unboundVar l)
+  | Aiur.Source.Term.ref g =>
+    match IndexMap.getByKey decls g with
+    | some (Aiur.Source.Declaration.function a) => Except.ok (Aiur.Value.fn g, st)
+    | some (Aiur.Source.Declaration.constructor a ctor) =>
+      if ctor.argTypes.isEmpty = true then Except.ok (Aiur.Value.ctor g #[], st)
+      else Except.error (Aiur.Source.Eval.SourceError.notCallable g)
+    | some (Aiur.Source.Declaration.dataType a) => Except.error (Aiur.Source.Eval.SourceError.notCallable g)
+    | none => Except.error (Aiur.Source.Eval.SourceError.unboundGlobal g)
+  | Aiur.Source.Term.field g => Except.ok (Aiur.Value.field g, st)
+  | Aiur.Source.Term.tuple ts =>
+    match Aiur.Source.Eval.evalList._unsafe_rec decls fuel bindings ts.toList st with
+    | Except.error e => Except.error e
+    | Except.ok (vs, st') => Except.ok (Aiur.Value.tuple vs, st')
+  | Aiur.Source.Term.array ts =>
+    match Aiur.Source.Eval.evalList._unsafe_rec decls fuel bindings ts.toList st with
+    | Except.error e => Except.error e
+    | Except.ok (vs, st') => Except.ok (Aiur.Value.array vs, st')
+  | Aiur.Source.Term.ann a t => Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st
+  | sub.ret =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings sub st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') => Except.error (Aiur.Source.Eval.SourceError.earlyReturn v st')
+  | Aiur.Source.Term.let p t1 t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match Aiur.Source.Eval.matchPattern st'.store p v with
+      | some bs => Aiur.Source.Eval.interp._unsafe_rec decls fuel (bs ++ bindings) t2 st'
+      | none => Except.error Aiur.Source.Eval.SourceError.patternFail
+  | t.match cases =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') => Aiur.Source.Eval.evalMatchCases._unsafe_rec decls fuel bindings st' v cases
+  | Aiur.Source.Term.app g args mode =>
+    match Aiur.Source.Eval.evalList._unsafe_rec decls fuel bindings args st with
+    | Except.error e => Except.error e
+    | Except.ok (vs, st') =>
+      match Aiur.Source.Eval.tryLocalLookup g bindings with
+      | some v => Aiur.Source.Eval.applyLocal._unsafe_rec decls fuel v vs.toList st'
+      | none => Aiur.Source.Eval.applyGlobal._unsafe_rec decls fuel g vs.toList st'
+  | t1.add t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        match v1, v2 with
+        | Aiur.Value.field a, Aiur.Value.field b => Except.ok (Aiur.Value.field (a + b), st2)
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "add")
+  | t1.sub t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        match v1, v2 with
+        | Aiur.Value.field a, Aiur.Value.field b => Except.ok (Aiur.Value.field (a - b), st2)
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "sub")
+  | t1.mul t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        match v1, v2 with
+        | Aiur.Value.field a, Aiur.Value.field b => Except.ok (Aiur.Value.field (a * b), st2)
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "mul")
+  | t.eqZero =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.field g => Except.ok (Aiur.Value.field (if (g.val == 0) = true then 1 else 0), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "eqZero")
+  | t.proj n =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.tuple vs =>
+        if h : n < vs.size then Except.ok (vs[n], st') else Except.error (Aiur.Source.Eval.SourceError.indexOoB n)
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "proj")
+  | t.get n =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.array vs =>
+        if h : n < vs.size then Except.ok (vs[n], st') else Except.error (Aiur.Source.Eval.SourceError.indexOoB n)
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "get")
+  | t.slice i j =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.array vs => Except.ok (Aiur.Value.array (vs.extract i j), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "slice")
+  | t.set n vT =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings vT st with
+    | Except.error e => Except.error e
+    | Except.ok (val, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st1 with
+      | Except.error e => Except.error e
+      | Except.ok (arr, st2) =>
+        match arr with
+        | Aiur.Value.array vs =>
+          if h : n < vs.size then Except.ok (Aiur.Value.array (vs.set n val h), st2)
+          else Except.error (Aiur.Source.Eval.SourceError.indexOoB n)
+        | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "set")
+  | t.store =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match Aiur.Source.Eval.storeValue decls st' v with
+      | (ptr, st'') => Except.ok (ptr, st'')
+  | t.load =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.pointer w n =>
+        match Aiur.Source.Eval.loadValue st' w n with
+        | Except.ok v' => Except.ok (v', st')
+        | Except.error e => Except.error e
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "load")
+  | t.ptrVal =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.pointer width n => Except.ok (Aiur.Value.field (Aiur.G.ofNat n), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ptrVal")
+  | t1.assertEq t2 msg ret =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        if (v1 != v2) = true then
+          Except.error
+            (Aiur.Source.Eval.SourceError.typeMismatch
+              (match msg with
+              | some m => toString "assertEq: " ++ toString m
+              | none => "assertEq"))
+        else Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings ret st2
+  | t.u8BitDecomposition =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.field g =>
+        let byte := g.val.toUInt8;
+        Except.ok
+          (Aiur.Value.array (Array.ofFn fun i => Aiur.Value.field (Aiur.G.ofUInt8 (byte >>> (↑i).toUInt8 &&& 1))), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "u8BitDecomposition")
+  | t.u8ShiftLeft =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.field g => Except.ok (Aiur.Value.field (Aiur.G.ofUInt8 (g.val.toUInt8 <<< 1)), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "u8ShiftLeft")
+  | t.u8ShiftRight =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.field g => Except.ok (Aiur.Value.field (Aiur.G.ofUInt8 (g.val.toUInt8 >>> 1)), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "u8ShiftRight")
+  | t1.u8Xor t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b => Aiur.Value.field (Aiur.G.ofUInt8 (a.val.toUInt8 ^^^ b.val.toUInt8)))
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8Add t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b =>
+        let x := a.val.toUInt8.toNat + b.val.toUInt8.toNat;
+        Aiur.Value.tuple #[Aiur.Value.field (Aiur.G.ofUInt8 x.toUInt8), Aiur.Value.field (if x ≥ 256 then 1 else 0)])
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8Mul t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b =>
+        let x := a.val.toUInt8.toNat * b.val.toUInt8.toNat;
+        Aiur.Value.tuple
+          #[Aiur.Value.field (Aiur.G.ofUInt8 x.toUInt8), Aiur.Value.field (Aiur.G.ofUInt8 (x / 256).toUInt8)])
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8XorSplit7 t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b =>
+        let x := a.val.toUInt8 ^^^ b.val.toUInt8;
+        Aiur.Value.tuple #[Aiur.Value.field (Aiur.G.ofUInt8 (x >>> 7)), Aiur.Value.field (Aiur.G.ofUInt8 (x <<< 1))])
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8XorSplit4 t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b =>
+        let x := a.val.toUInt8 ^^^ b.val.toUInt8;
+        Aiur.Value.tuple #[Aiur.Value.field (Aiur.G.ofUInt8 (x >>> 4)), Aiur.Value.field (Aiur.G.ofUInt8 (x <<< 4))])
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8Sub t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b =>
+        let i := a.val.toUInt8;
+        let j := b.val.toUInt8;
+        Aiur.Value.tuple #[Aiur.Value.field (Aiur.G.ofUInt8 (i - j)), Aiur.Value.field (if j > i then 1 else 0)])
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8And t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b => Aiur.Value.field (Aiur.G.ofUInt8 (a.val.toUInt8 &&& b.val.toUInt8)))
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8Or t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b => Aiur.Value.field (Aiur.G.ofUInt8 (a.val.toUInt8 ||| b.val.toUInt8)))
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u8LessThan t2 =>
+    Aiur.Source.Eval.combineFieldsResult (fun a b => Aiur.Value.field (if a.val.toUInt8 < b.val.toUInt8 then 1 else 0))
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.u32LessThan t2 =>
+    Aiur.Source.Eval.combineFieldsResult
+      (fun a b => Aiur.Value.field (if a.val.toUInt32 < b.val.toUInt32 then 1 else 0))
+      (Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st) fun st1 =>
+      Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1
+  | t1.unconstrainedU32Add t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        match v1, v2 with
+        | Aiur.Value.array a, Aiur.Value.array b =>
+          let pack := fun xs =>
+            List.foldl
+              (fun n x =>
+                match x with
+                | (v, i) =>
+                  match v with
+                  | Aiur.Value.field g => n + g.val.toNat * 256 ^ i
+                  | x => n)
+              0 xs.toList.zipIdx;
+          let sum := pack a + pack b;
+          Except.ok
+            (Aiur.Value.tuple
+                #[Aiur.Value.array
+                    (Array.map (fun i => Aiur.Value.field (Aiur.G.ofNat (sum / 256 ^ i % 256))) #[0, 1, 2, 3]),
+                  Aiur.Value.field (Aiur.G.ofNat (sum / 4294967296))],
+              st2)
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedU32Add")
+  | t1.unconstrainedU32Add3 t2 t3 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t3 st2 with
+        | Except.error e => Except.error e
+        | Except.ok (v3, st3) =>
+          match v1, v2, v3 with
+          | Aiur.Value.array a, Aiur.Value.array b, Aiur.Value.array c =>
+            let pack := fun xs =>
+              List.foldl
+                (fun n x =>
+                  match x with
+                  | (v, i) =>
+                    match v with
+                    | Aiur.Value.field g => n + g.val.toNat * 256 ^ i
+                    | x => n)
+                0 xs.toList.zipIdx;
+            let sum := pack a + pack b + pack c;
+            Except.ok
+              (Aiur.Value.tuple
+                  #[Aiur.Value.array
+                      (Array.map (fun i => Aiur.Value.field (Aiur.G.ofNat (sum / 256 ^ i % 256))) #[0, 1, 2, 3]),
+                    Aiur.Value.field (Aiur.G.ofNat (sum / 4294967296))],
+                st3)
+          | x, x_1, x_2 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedU32Add3")
+  | t.u32ToField =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (Aiur.Value.array a, st') =>
+      Except.ok
+        (Aiur.Value.field
+            (Aiur.G.ofNat
+              (List.foldl
+                (fun n x =>
+                  match x with
+                  | (v, i) =>
+                    match v with
+                    | Aiur.Value.field g => n + g.val.toNat * 256 ^ i
+                    | x => n)
+                0 a.toList.zipIdx)),
+          st')
+    | Except.ok a => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "u32ToField")
+  | t1.u8RangeCheck t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (v1, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (v2, st2) =>
+        match v1, v2 with
+        | Aiur.Value.field a, Aiur.Value.field b =>
+          if (decide (a.val < 256) && decide (b.val < 256)) = true then
+            Except.ok (Aiur.Value.tuple #[Aiur.Value.field a, Aiur.Value.field b], st2)
+          else Except.error (Aiur.Source.Eval.SourceError.typeMismatch "u8RangeCheck")
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "u8RangeCheck")
+  | t1.unconstrainedBigUintDivMod t2 =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t1 st with
+    | Except.error e => Except.error e
+    | Except.ok (aPtr, st1) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t2 st1 with
+      | Except.error e => Except.error e
+      | Except.ok (bPtr, st2) => Aiur.Source.Eval.bigUintDivModValue decls aPtr bPtr st2
+  | t.unconstrainedGToBytes =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.field g => Except.ok (Aiur.Value.array (Array.ofFn fun i => Aiur.Value.field (g.toLeBytes i)), st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedGToBytes")
+  | t.unconstrainedGInverse =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st with
+    | Except.error e => Except.error e
+    | Except.ok (v, st') =>
+      match v with
+      | Aiur.Value.field g => Except.ok (Aiur.Value.field g.inverse, st')
+      | x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedGInverse")
+  | t.toField => Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st
+  | t.u8FromFieldUnsafe => Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings t st
+  | Aiur.Source.Term.u8Lit n => Except.ok (Aiur.Value.field (Aiur.G.ofNat n), st)
+  | Aiur.Source.Term.debug a none ret => Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings ret st
+  | Aiur.Source.Term.debug a (some value) ret =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings value st with
+    | Except.error error => Except.error error
+    | Except.ok (fst, st') => Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings ret st'
+  | channel.ioGetInfo key =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings channel st with
+    | Except.error e => Except.error e
+    | Except.ok (vc, stc) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings key stc with
+      | Except.error e => Except.error e
+      | Except.ok (v, st') =>
+        match vc, v with
+        | Aiur.Value.field channelG, Aiur.Value.array vs =>
+          match Aiur.Source.Eval.expectFieldArray vs with
+          | none => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioGetInfo key")
+          | some keyGs =>
+            match st'.ioBuffer.map[(channelG, keyGs)]? with
+            | some info =>
+              Except.ok
+                (Aiur.Value.tuple #[Aiur.Value.field (Aiur.G.ofNat info.idx), Aiur.Value.field (Aiur.G.ofNat info.len)],
+                  st')
+            | none => Except.error Aiur.Source.Eval.SourceError.ioKeyNotFound
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioGetInfo")
+  | channel.ioSetInfo key idx len ret =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings channel st with
+    | Except.error e => Except.error e
+    | Except.ok (vc, stc) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings key stc with
+      | Except.error e => Except.error e
+      | Except.ok (vk, stk) =>
+        match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings idx stk with
+        | Except.error e => Except.error e
+        | Except.ok (vi, sti) =>
+          match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings len sti with
+          | Except.error e => Except.error e
+          | Except.ok (vl, stl) =>
+            match vc, vk, vi, vl with
+            | Aiur.Value.field channelG, Aiur.Value.array vs, Aiur.Value.field iG, Aiur.Value.field lG =>
+              match Aiur.Source.Eval.expectFieldArray vs with
+              | none => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioSetInfo key")
+              | some keyGs =>
+                if stl.ioBuffer.map.contains (channelG, keyGs) = true then
+                  Except.error Aiur.Source.Eval.SourceError.ioKeyAlreadySet
+                else
+                  let info := { idx := iG.val.toNat, len := lG.val.toNat };
+                  let st' :=
+                    { store := stl.store,
+                      ioBuffer :=
+                        let __src := stl.ioBuffer;
+                        { data := __src.data, map := stl.ioBuffer.map.insert (channelG, keyGs) info } };
+                  Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings ret st'
+            | x, x_1, x_2, x_3 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioSetInfo")
+  | channel.ioRead idx len =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings channel st with
+    | Except.error e => Except.error e
+    | Except.ok (vc, stc) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings idx stc with
+      | Except.error e => Except.error e
+      | Except.ok (v, st') =>
+        match vc, v with
+        | Aiur.Value.field channelG, Aiur.Value.field g =>
+          let start := g.val.toNat;
+          let arena := st'.ioBuffer.data.getD channelG #[];
+          if start + len > arena.size then Except.error Aiur.Source.Eval.SourceError.ioReadOoB
+          else Except.ok (Aiur.Value.array (Array.map Aiur.Value.field (arena.extract start (start + len))), st')
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioRead")
+  | channel.ioWrite data ret =>
+    match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings channel st with
+    | Except.error e => Except.error e
+    | Except.ok (vc, stc) =>
+      match Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings data stc with
+      | Except.error e => Except.error e
+      | Except.ok (v, st') =>
+        match vc, v with
+        | Aiur.Value.field channelG, Aiur.Value.array vs =>
+          match Aiur.Source.Eval.expectFieldArray vs with
+          | none => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioWrite")
+          | some dataGs =>
+            let arena := st'.ioBuffer.data.getD channelG #[];
+            let st'' :=
+              { store := st'.store,
+                ioBuffer :=
+                  let __src := st'.ioBuffer;
+                  { data := st'.ioBuffer.data.insert channelG (arena ++ dataGs), map := __src.map } };
+            Aiur.Source.Eval.interp._unsafe_rec decls fuel bindings ret st''
+        | x, x_1 => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "ioWrite")
+RECURSION WORKER Aiur.Source.Eval.matchPatsArr._unsafe_rec
+Aiur.Source.Eval.Store → Array Aiur.Pattern → Array Aiur.Value → Option Aiur.Source.Eval.Bindings
+IMPLEMENTATION
+fun store pats vs => Aiur.Source.Eval.matchPatsList._unsafe_rec store pats.toList vs.toList
+RECURSION WORKER Aiur.Source.Eval.matchPatsList._unsafe_rec
+Aiur.Source.Eval.Store → List Aiur.Pattern → List Aiur.Value → Option Aiur.Source.Eval.Bindings
+IMPLEMENTATION
+fun store x x_1 =>
+  match x, x_1 with
+  | [], [] => some []
+  | p :: ps, v :: vs => do
+    let b1 ← Aiur.Source.Eval.matchPattern._unsafe_rec store p v
+    let b2 ← Aiur.Source.Eval.matchPatsList._unsafe_rec store ps vs
+    pure (b1 ++ b2)
+  | x, x_2 => none
+RECURSION WORKER Aiur.Source.Eval.matchPattern._unsafe_rec
+Aiur.Source.Eval.Store → Aiur.Pattern → Aiur.Value → Option Aiur.Source.Eval.Bindings
+IMPLEMENTATION
+fun store x x_1 =>
+  match x, x_1 with
+  | Aiur.Pattern.wildcard, x => some []
+  | Aiur.Pattern.var l, v => some [(l, v)]
+  | Aiur.Pattern.field g, Aiur.Value.field g' => if (g == g') = true then some [] else none
+  | Aiur.Pattern.tuple pats, Aiur.Value.tuple vs => Aiur.Source.Eval.matchPatsArr._unsafe_rec store pats vs
+  | Aiur.Pattern.array pats, Aiur.Value.array vs => Aiur.Source.Eval.matchPatsArr._unsafe_rec store pats vs
+  | Aiur.Pattern.ref g pats, Aiur.Value.ctor g' vs =>
+    if (g != g') = true then none else Aiur.Source.Eval.matchPatsList._unsafe_rec store pats vs.toList
+  | p1.or p2, v =>
+    Aiur.Source.Eval.matchPattern._unsafe_rec store p1 v <|> Aiur.Source.Eval.matchPattern._unsafe_rec store p2 v
+  | p.pointer, Aiur.Value.pointer w n =>
+    match store[w]? with
+    | some inner =>
+      match inner.getByIdx n with
+      | some (vs, snd) => vs[0]?.bind fun x => Aiur.Source.Eval.matchPattern._unsafe_rec store p x
+      | none => none
+    | none => none
+  | x, x_2 => none
+RECURSION WORKER Aiur.Source.Eval.readLimbChain._unsafe_rec
+Aiur.Source.Decls →
+  Aiur.Source.Eval.EvalState →
+    Nat → Aiur.Value → Except Aiur.Source.Eval.SourceError (Aiur.DataType × List (Array Aiur.G))
+IMPLEMENTATION
+fun decls st x x_1 =>
+  match x, x_1 with
+  | 0, x => Except.error (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedBigUintDivMod: cyclic limb list")
+  | steps.succ, ptrVal =>
+    match ptrVal with
+    | Aiur.Value.pointer w n => do
+      let __do_lift ← Aiur.Source.Eval.loadValue st w n
+      match __do_lift with
+        | Aiur.Value.ctor g args => do
+          let __x ← Aiur.Source.Eval.ctorInfo decls g
+          match __x with
+            | (dt, tag) =>
+              if (tag == 1) = true then pure (dt, [])
+              else
+                if (tag == 0) = true then
+                  match args with
+                  | #[Aiur.Value.array byteVals, rest] => do
+                    let bytes ←
+                      Array.mapM
+                          (fun bv =>
+                            match bv with
+                            | Aiur.Value.field b =>
+                              if b.val < 256 then pure b
+                              else
+                                throw
+                                  (Aiur.Source.Eval.SourceError.typeMismatch
+                                    "unconstrainedBigUintDivMod: limb byte out of range")
+                            | x =>
+                              throw
+                                (Aiur.Source.Eval.SourceError.typeMismatch
+                                  "unconstrainedBigUintDivMod: limb byte not a field"))
+                          byteVals
+                    if (bytes.size == 8) = true then do
+                        let __x ← Aiur.Source.Eval.readLimbChain._unsafe_rec decls st steps rest
+                        match __x with
+                          | (fst, restLimbs) => pure (dt, bytes :: restLimbs)
+                      else
+                        throw
+                          (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedBigUintDivMod: limb is not [U8; 8]")
+                  | x =>
+                    throw (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedBigUintDivMod: malformed Cons node")
+                else
+                  throw
+                    (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedBigUintDivMod: unexpected constructor tag")
+        | x => throw (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedBigUintDivMod: node is not a constructor")
+    | x => throw (Aiur.Source.Eval.SourceError.typeMismatch "unconstrainedBigUintDivMod: input is not a pointer")
+RECURSION WORKER Aiur.Source.Pattern.freshenBindings._unsafe_rec
+String → Nat → Std.HashMap Aiur.Local Aiur.Local → Aiur.Pattern → Nat × Std.HashMap Aiur.Local Aiur.Local × Aiur.Pattern
+IMPLEMENTATION
+fun stem cnt subst x =>
+  match x with
+  | Aiur.Pattern.var x =>
+    match subst[x]? with
+    | some x' => (cnt, subst, Aiur.Pattern.var x')
+    | x_1 =>
+      let x' := Aiur.Local.str (stem ++ toString cnt);
+      (cnt + 1, subst.insert x x', Aiur.Pattern.var x')
+  | Aiur.Pattern.wildcard => (cnt, subst, Aiur.Pattern.wildcard)
+  | Aiur.Pattern.field g => (cnt, subst, Aiur.Pattern.field g)
+  | Aiur.Pattern.ref g ps =>
+    match
+      List.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, subst, acc) =>
+            match x_1 with
+            | ⟨p, property⟩ =>
+              match Aiur.Source.Pattern.freshenBindings._unsafe_rec stem cnt subst p with
+              | (cnt, subst, p') => (cnt, subst, acc ++ [p']))
+        (cnt, subst, []) ps.attach with
+    | (cnt, subst, ps') => (cnt, subst, Aiur.Pattern.ref g ps')
+  | Aiur.Pattern.tuple ps =>
+    match
+      Array.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, subst, acc) =>
+            match x_1 with
+            | ⟨p, property⟩ =>
+              match Aiur.Source.Pattern.freshenBindings._unsafe_rec stem cnt subst p with
+              | (cnt, subst, p') => (cnt, subst, acc.push p'))
+        (cnt, subst, #[]) ps.attach with
+    | (cnt, subst, ps') => (cnt, subst, Aiur.Pattern.tuple ps')
+  | Aiur.Pattern.array ps =>
+    match
+      Array.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, subst, acc) =>
+            match x_1 with
+            | ⟨p, property⟩ =>
+              match Aiur.Source.Pattern.freshenBindings._unsafe_rec stem cnt subst p with
+              | (cnt, subst, p') => (cnt, subst, acc.push p'))
+        (cnt, subst, #[]) ps.attach with
+    | (cnt, subst, ps') => (cnt, subst, Aiur.Pattern.array ps')
+  | p.or q =>
+    match Aiur.Source.Pattern.freshenBindings._unsafe_rec stem cnt subst p with
+    | (cnt, subst, p') =>
+      match Aiur.Source.Pattern.freshenBindings._unsafe_rec stem cnt subst q with
+      | (cnt, subst, q') => (cnt, subst, p'.or q')
+  | p.pointer =>
+    match Aiur.Source.Pattern.freshenBindings._unsafe_rec stem cnt subst p with
+    | (cnt, subst, p') => (cnt, subst, p'.pointer)
+RECURSION WORKER Aiur.Source.Pattern.maxNameLength._unsafe_rec
+Aiur.Pattern → Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Pattern.var (Aiur.Local.str name) => name.length
+  | Aiur.Pattern.var (Aiur.Local.idx a) => 0
+  | Aiur.Pattern.wildcard => 0
+  | Aiur.Pattern.field a => 0
+  | Aiur.Pattern.ref global ps =>
+    List.foldl (fun n p => max n (Aiur.Source.Pattern.maxNameLength._unsafe_rec p.val)) global.toName.toString.length
+      ps.attach
+  | Aiur.Pattern.tuple ps =>
+    Array.foldl (fun n p => max n (Aiur.Source.Pattern.maxNameLength._unsafe_rec p.val)) 0 ps.attach
+  | Aiur.Pattern.array ps =>
+    Array.foldl (fun n p => max n (Aiur.Source.Pattern.maxNameLength._unsafe_rec p.val)) 0 ps.attach
+  | p.or q => max (Aiur.Source.Pattern.maxNameLength._unsafe_rec p) (Aiur.Source.Pattern.maxNameLength._unsafe_rec q)
+  | p.pointer => Aiur.Source.Pattern.maxNameLength._unsafe_rec p
+RECURSION WORKER Aiur.Source.Term.bindArguments._unsafe_rec
+String → List Aiur.Source.Term → StateM Nat (List (Aiur.Pattern × Aiur.Source.Term) × List Aiur.Source.Term)
+IMPLEMENTATION
+fun stem x =>
+  match x with
+  | [] => pure ([], [])
+  | arg :: args => do
+    let name ← Aiur.Source.freshTemporary stem
+    match arg.peelLets with
+      | (leading, core) => do
+        let __x ← Aiur.Source.Term.bindArguments._unsafe_rec stem args
+        match __x with
+          | (frames, values) =>
+            pure (leading ++ [(Aiur.Pattern.var name, core)] ++ frames, Aiur.Source.Term.var name :: values)
+RECURSION WORKER Aiur.Source.Term.expandOnce._unsafe_rec
+Std.HashMap Aiur.Global (List Aiur.Local × Aiur.Source.Term) → Nat → Aiur.Source.Term → Nat × Aiur.Source.Term
+IMPLEMENTATION
+fun done cnt t =>
+  match t with
+  | Aiur.Source.Term.app g args Aiur.Source.CallMode.inlined =>
+    match
+      List.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨a, property⟩ =>
+              match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+              | (cnt, a') => (cnt, acc ++ [a']))
+        (cnt, []) args.attach with
+    | (cnt, args') =>
+      match done[g]? with
+      | none => (cnt, Aiur.Source.Term.app g args' Aiur.Source.CallMode.inlined)
+      | some (ins, body) =>
+        if body.hasExplicitReturn = true then (cnt, Aiur.Source.Term.app g args' Aiur.Source.CallMode.normal)
+        else
+          match
+            List.foldl
+              (fun x inp =>
+                match x with
+                | (cnt, subst, acc) =>
+                  let inp' := Aiur.Local.str (toString "inl#" ++ toString cnt);
+                  (cnt + 1, subst.insert inp inp', acc ++ [inp']))
+              (cnt, ∅, []) ins with
+          | (cnt, subst, freshInputs) =>
+            match Aiur.Source.Term.freshen cnt subst body with
+            | (cnt, freshBody) =>
+              match
+                match freshBody.peelLets with
+                | (fs, core@h:(a.match a_1)) =>
+                  let out := Aiur.Local.str (toString "inl#" ++ toString cnt);
+                  (cnt + 1,
+                    Aiur.Source.Term.wrapLets fs
+                      (Aiur.Source.Term.let (Aiur.Pattern.var out) core (Aiur.Source.Term.var out)))
+                | x => (cnt, freshBody) with
+              | (cnt, freshBody) =>
+                (cnt,
+                  List.foldr
+                    (fun x acc =>
+                      match x with
+                      | (input, arg) => Aiur.Source.Term.let (Aiur.Pattern.var input) arg acc)
+                    freshBody (freshInputs.zip args'))
+  | Aiur.Source.Term.app g args mode =>
+    match
+      List.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨a, property⟩ =>
+              match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+              | (cnt, a') => (cnt, acc ++ [a']))
+        (cnt, []) args.attach with
+    | (cnt, args') => (cnt, Aiur.Source.Term.app g args' mode)
+  | Aiur.Source.Term.unit => (cnt, t)
+  | Aiur.Source.Term.var a => (cnt, t)
+  | Aiur.Source.Term.ref a => (cnt, t)
+  | Aiur.Source.Term.field a => (cnt, t)
+  | Aiur.Source.Term.u8Lit a => (cnt, t)
+  | Aiur.Source.Term.tuple ts =>
+    match
+      Array.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨a, property⟩ =>
+              match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+              | (cnt, a') => (cnt, acc.push a'))
+        (cnt, #[]) ts.attach with
+    | (cnt, ts') => (cnt, Aiur.Source.Term.tuple ts')
+  | Aiur.Source.Term.array ts =>
+    match
+      Array.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨a, property⟩ =>
+              match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+              | (cnt, a') => (cnt, acc.push a'))
+        (cnt, #[]) ts.attach with
+    | (cnt, ts') => (cnt, Aiur.Source.Term.array ts')
+  | s.match arms =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt s with
+    | (cnt, s') =>
+      match
+        List.foldl
+          (fun x x_1 =>
+            match x with
+            | (cnt, acc) =>
+              match x_1 with
+              | ⟨(p, a), property⟩ =>
+                match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+                | (cnt, a') => (cnt, acc ++ [(p, a')]))
+          (cnt, []) arms.attach with
+      | (cnt, arms') => (cnt, s'.match arms')
+  | Aiur.Source.Term.let p v b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt v with
+    | (cnt, v') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, Aiur.Source.Term.let p v' b')
+  | a.ret =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.ret)
+  | a.add b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.add b')
+  | a.sub b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.sub b')
+  | a.mul b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.mul b')
+  | a.eqZero =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.eqZero)
+  | a.proj n =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.proj n)
+  | a.get n =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.get n)
+  | a.slice i j =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.slice i j)
+  | a.set n v =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt v with
+      | (cnt, v') => (cnt, a'.set n v')
+  | a.store =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.store)
+  | a.load =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.load)
+  | a.ptrVal =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.ptrVal)
+  | Aiur.Source.Term.ann τ a =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, Aiur.Source.Term.ann τ a')
+  | a.assertEq b msg c =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') =>
+        match Aiur.Source.Term.expandOnce._unsafe_rec done cnt c with
+        | (cnt, c') => (cnt, a'.assertEq b' msg c')
+  | c.ioGetInfo k =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt k with
+      | (cnt, k') => (cnt, c'.ioGetInfo k')
+  | c.ioSetInfo k i l rv =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt k with
+      | (cnt, k') =>
+        match Aiur.Source.Term.expandOnce._unsafe_rec done cnt i with
+        | (cnt, i') =>
+          match Aiur.Source.Term.expandOnce._unsafe_rec done cnt l with
+          | (cnt, l') =>
+            match Aiur.Source.Term.expandOnce._unsafe_rec done cnt rv with
+            | (cnt, rv') => (cnt, c'.ioSetInfo k' i' l' rv')
+  | c.ioRead i n =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt i with
+      | (cnt, i') => (cnt, c'.ioRead i' n)
+  | c.ioWrite d rv =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt d with
+      | (cnt, d') =>
+        match Aiur.Source.Term.expandOnce._unsafe_rec done cnt rv with
+        | (cnt, rv') => (cnt, c'.ioWrite d' rv')
+  | a.u8BitDecomposition =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.u8BitDecomposition)
+  | a.u8ShiftLeft =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.u8ShiftLeft)
+  | a.u8ShiftRight =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.u8ShiftRight)
+  | a.u8Xor b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8Xor b')
+  | a.u8Add b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8Add b')
+  | a.u8Mul b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8Mul b')
+  | a.u8Sub b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8Sub b')
+  | a.u8And b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8And b')
+  | a.u8Or b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8Or b')
+  | a.u8LessThan b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8LessThan b')
+  | a.u32LessThan b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u32LessThan b')
+  | a.u8XorSplit7 b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8XorSplit7 b')
+  | a.u8XorSplit4 b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8XorSplit4 b')
+  | a.unconstrainedU32Add b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.unconstrainedU32Add b')
+  | a.unconstrainedU32Add3 b c =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') =>
+        match Aiur.Source.Term.expandOnce._unsafe_rec done cnt c with
+        | (cnt, c') => (cnt, a'.unconstrainedU32Add3 b' c')
+  | a.u32ToField =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.u32ToField)
+  | a.unconstrainedBigUintDivMod b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.unconstrainedBigUintDivMod b')
+  | a.u8RangeCheck b =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt b with
+      | (cnt, b') => (cnt, a'.u8RangeCheck b')
+  | a.toField =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.toField)
+  | a.u8FromFieldUnsafe =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.u8FromFieldUnsafe)
+  | a.unconstrainedGToBytes =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.unconstrainedGToBytes)
+  | a.unconstrainedGInverse =>
+    match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+    | (cnt, a') => (cnt, a'.unconstrainedGInverse)
+  | Aiur.Source.Term.debug s o a =>
+    match
+      match o with
+      | none => (cnt, none)
+      | some x =>
+        match Aiur.Source.Term.expandOnce._unsafe_rec done cnt x with
+        | (cnt, x') => (cnt, some x') with
+    | (cnt, o') =>
+      match Aiur.Source.Term.expandOnce._unsafe_rec done cnt a with
+      | (cnt, a') => (cnt, Aiur.Source.Term.debug s o' a')
+RECURSION WORKER Aiur.Source.Term.freshenWith._unsafe_rec
+String → Nat → Std.HashMap Aiur.Local Aiur.Local → Aiur.Source.Term → Nat × Aiur.Source.Term
+IMPLEMENTATION
+fun stem cnt subst t =>
+  match t with
+  | Aiur.Source.Term.var x => (cnt, Aiur.Source.Term.var (subst.getD x x))
+  | Aiur.Source.Term.unit => (cnt, t)
+  | Aiur.Source.Term.ref a => (cnt, t)
+  | Aiur.Source.Term.field a => (cnt, t)
+  | Aiur.Source.Term.u8Lit a => (cnt, t)
+  | Aiur.Source.Term.let p v b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst v with
+    | (cnt, v') =>
+      match Aiur.Source.Pattern.freshenWith stem cnt subst p with
+      | (cnt, subst', p') =>
+        match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst' b with
+        | (cnt, b') => (cnt, Aiur.Source.Term.let p' v' b')
+  | s.match arms =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst s with
+    | (cnt, s') =>
+      match
+        List.foldl
+          (fun x x_1 =>
+            match x with
+            | (cnt, acc) =>
+              match x_1 with
+              | ⟨(p, a), property⟩ =>
+                match Aiur.Source.Pattern.freshenWith stem cnt subst p with
+                | (cnt, subst', p') =>
+                  match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst' a with
+                  | (cnt, a') => (cnt, acc ++ [(p', a')]))
+          (cnt, []) arms.attach with
+      | (cnt, arms') => (cnt, s'.match arms')
+  | Aiur.Source.Term.tuple ts =>
+    match
+      Array.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨x, property⟩ =>
+              match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst x with
+              | (cnt, x') => (cnt, acc.push x'))
+        (cnt, #[]) ts.attach with
+    | (cnt, ts') => (cnt, Aiur.Source.Term.tuple ts')
+  | Aiur.Source.Term.array ts =>
+    match
+      Array.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨x, property⟩ =>
+              match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst x with
+              | (cnt, x') => (cnt, acc.push x'))
+        (cnt, #[]) ts.attach with
+    | (cnt, ts') => (cnt, Aiur.Source.Term.array ts')
+  | Aiur.Source.Term.app g args mode =>
+    match
+      List.foldl
+        (fun x x_1 =>
+          match x with
+          | (cnt, acc) =>
+            match x_1 with
+            | ⟨x, property⟩ =>
+              match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst x with
+              | (cnt, x') => (cnt, acc ++ [x']))
+        (cnt, []) args.attach with
+    | (cnt, args') => (cnt, Aiur.Source.Term.app (Aiur.Source.renameLocalCall subst g) args' mode)
+  | a.ret =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.ret)
+  | a.add b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.add b')
+  | a.sub b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.sub b')
+  | a.mul b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.mul b')
+  | a.eqZero =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.eqZero)
+  | a.proj n =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.proj n)
+  | a.get n =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.get n)
+  | a.slice i j =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.slice i j)
+  | a.set n v =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst v with
+      | (cnt, v') => (cnt, a'.set n v')
+  | a.store =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.store)
+  | a.load =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.load)
+  | a.ptrVal =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.ptrVal)
+  | Aiur.Source.Term.ann τ a =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, Aiur.Source.Term.ann τ a')
+  | a.assertEq b msg c =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') =>
+        match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst c with
+        | (cnt, c') => (cnt, a'.assertEq b' msg c')
+  | c.ioGetInfo k =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst k with
+      | (cnt, k') => (cnt, c'.ioGetInfo k')
+  | c.ioSetInfo k i l rv =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst k with
+      | (cnt, k') =>
+        match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst i with
+        | (cnt, i') =>
+          match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst l with
+          | (cnt, l') =>
+            match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst rv with
+            | (cnt, rv') => (cnt, c'.ioSetInfo k' i' l' rv')
+  | c.ioRead i n =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst i with
+      | (cnt, i') => (cnt, c'.ioRead i' n)
+  | c.ioWrite d rv =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst c with
+    | (cnt, c') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst d with
+      | (cnt, d') =>
+        match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst rv with
+        | (cnt, rv') => (cnt, c'.ioWrite d' rv')
+  | a.u8BitDecomposition =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.u8BitDecomposition)
+  | a.u8ShiftLeft =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.u8ShiftLeft)
+  | a.u8ShiftRight =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.u8ShiftRight)
+  | a.u8Xor b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8Xor b')
+  | a.u8Add b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8Add b')
+  | a.u8Mul b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8Mul b')
+  | a.u8Sub b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8Sub b')
+  | a.u8And b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8And b')
+  | a.u8Or b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8Or b')
+  | a.u8LessThan b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8LessThan b')
+  | a.u32LessThan b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u32LessThan b')
+  | a.u8XorSplit7 b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8XorSplit7 b')
+  | a.u8XorSplit4 b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8XorSplit4 b')
+  | a.unconstrainedU32Add b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.unconstrainedU32Add b')
+  | a.unconstrainedU32Add3 b c =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') =>
+        match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst c with
+        | (cnt, c') => (cnt, a'.unconstrainedU32Add3 b' c')
+  | a.u32ToField =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.u32ToField)
+  | a.unconstrainedBigUintDivMod b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.unconstrainedBigUintDivMod b')
+  | a.u8RangeCheck b =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst b with
+      | (cnt, b') => (cnt, a'.u8RangeCheck b')
+  | a.toField =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.toField)
+  | a.u8FromFieldUnsafe =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.u8FromFieldUnsafe)
+  | a.unconstrainedGToBytes =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.unconstrainedGToBytes)
+  | a.unconstrainedGInverse =>
+    match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+    | (cnt, a') => (cnt, a'.unconstrainedGInverse)
+  | Aiur.Source.Term.debug s o a =>
+    match
+      match o with
+      | none => (cnt, none)
+      | some x =>
+        match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst x with
+        | (cnt, x') => (cnt, some x') with
+    | (cnt, o') =>
+      match Aiur.Source.Term.freshenWith._unsafe_rec stem cnt subst a with
+      | (cnt, a') => (cnt, Aiur.Source.Term.debug s o' a')
+RECURSION WORKER Aiur.Source.Term.hasExplicitReturn._unsafe_rec
+Aiur.Source.Term → Bool
+IMPLEMENTATION
+fun x =>
+  match x with
+  | a.ret => true
+  | Aiur.Source.Term.var a => false
+  | Aiur.Source.Term.unit => false
+  | Aiur.Source.Term.field a => false
+  | Aiur.Source.Term.u8Lit a => false
+  | Aiur.Source.Term.ref a => false
+  | Aiur.Source.Term.app a args mode =>
+    args.attach.any fun arg => Aiur.Source.Term.hasExplicitReturn._unsafe_rec arg.val
+  | Aiur.Source.Term.tuple terms => terms.attach.any fun term => Aiur.Source.Term.hasExplicitReturn._unsafe_rec term.val
+  | Aiur.Source.Term.array terms => terms.attach.any fun term => Aiur.Source.Term.hasExplicitReturn._unsafe_rec term.val
+  | Aiur.Source.Term.let a value body =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec value || Aiur.Source.Term.hasExplicitReturn._unsafe_rec body
+  | scrut.match arms =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec scrut ||
+      arms.attach.any fun arm => Aiur.Source.Term.hasExplicitReturn._unsafe_rec arm.val.snd
+  | a.eqZero => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.proj a_1 => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.get a_1 => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.slice a_1 a_2 => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.store => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.load => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.ptrVal => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | Aiur.Source.Term.ann a a_1 => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a_1
+  | a.u8BitDecomposition => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.u8ShiftLeft => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.u8ShiftRight => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.u32ToField => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.unconstrainedGToBytes => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.unconstrainedGInverse => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.toField => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.u8FromFieldUnsafe => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a
+  | a.add b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.sub b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.mul b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.set a_1 b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.ioGetInfo b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.ioRead b len =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8Xor b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8Add b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8Mul b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8Sub b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8And b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8Or b => Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8LessThan b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u32LessThan b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8XorSplit7 b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8XorSplit4 b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.unconstrainedU32Add b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.unconstrainedBigUintDivMod b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.u8RangeCheck b =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b
+  | a.assertEq b msg c =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b ||
+      Aiur.Source.Term.hasExplicitReturn._unsafe_rec c
+  | a.ioWrite b c =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b ||
+      Aiur.Source.Term.hasExplicitReturn._unsafe_rec c
+  | a.unconstrainedU32Add3 b c =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b ||
+      Aiur.Source.Term.hasExplicitReturn._unsafe_rec c
+  | a.ioSetInfo b c d e =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec a || Aiur.Source.Term.hasExplicitReturn._unsafe_rec b ||
+          Aiur.Source.Term.hasExplicitReturn._unsafe_rec c ||
+        Aiur.Source.Term.hasExplicitReturn._unsafe_rec d ||
+      Aiur.Source.Term.hasExplicitReturn._unsafe_rec e
+  | Aiur.Source.Term.debug a none continuation => Aiur.Source.Term.hasExplicitReturn._unsafe_rec continuation
+  | Aiur.Source.Term.debug a (some value) continuation =>
+    Aiur.Source.Term.hasExplicitReturn._unsafe_rec value || Aiur.Source.Term.hasExplicitReturn._unsafe_rec continuation
+RECURSION WORKER Aiur.Source.Term.hoistLetsAux._unsafe_rec
+String → Aiur.Source.Term → StateM Nat Aiur.Source.Term
+IMPLEMENTATION
+fun stem term =>
+  match term with
+  | Aiur.Source.Term.unit => pure term
+  | Aiur.Source.Term.var a => pure term
+  | Aiur.Source.Term.ref a => pure term
+  | Aiur.Source.Term.field a => pure term
+  | Aiur.Source.Term.u8Lit a => pure term
+  | Aiur.Source.Term.let pattern value body => do
+    let value ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem value
+    let body ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem body
+    match value.peelLets with
+      | (frames, core) => pure (Aiur.Source.Term.wrapLets frames (Aiur.Source.Term.let pattern core body))
+  | scrut.match arms => do
+    let scrut ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem scrut
+    let arms ←
+      List.mapM
+          (fun arm => do
+            let __do_lift ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem arm.val.snd
+            pure (arm.val.fst, __do_lift))
+          arms.attach
+    Aiur.Source.buildWithArguments stem [scrut] fun x =>
+        match x with
+        | [scrut] => scrut.match arms
+        | x => term
+  | value.ret => do
+    let value ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem value
+    match value.peelLets with
+      | (frames, core) => pure (Aiur.Source.Term.wrapLets frames core.ret)
+  | Aiur.Source.Term.debug label value continuation => do
+    let continuation ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem continuation
+    pure
+        (Aiur.Source.Term.let Aiur.Pattern.wildcard (Aiur.Source.Term.debug label value Aiur.Source.Term.unit)
+          continuation)
+  | Aiur.Source.Term.tuple terms => do
+    let terms ← Array.mapM (fun t => Aiur.Source.Term.hoistLetsAux._unsafe_rec stem t.val) terms.attach
+    Aiur.Source.buildWithArguments stem terms.toList (Aiur.Source.Term.tuple ∘ List.toArray)
+  | Aiur.Source.Term.array terms => do
+    let terms ← Array.mapM (fun t => Aiur.Source.Term.hoistLetsAux._unsafe_rec stem t.val) terms.attach
+    Aiur.Source.buildWithArguments stem terms.toList (Aiur.Source.Term.array ∘ List.toArray)
+  | Aiur.Source.Term.app global args mode => do
+    let args ← List.mapM (fun t => Aiur.Source.Term.hoistLetsAux._unsafe_rec stem t.val) args.attach
+    Aiur.Source.buildWithArguments stem args fun x => Aiur.Source.Term.app global x mode
+  | a.assertEq b msg continuation => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    let continuation ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem continuation
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => Aiur.Source.Term.let Aiur.Pattern.wildcard (a.assertEq b msg Aiur.Source.Term.unit) continuation
+        | x => term
+  | channel.ioWrite data continuation => do
+    let channel ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem channel
+    let data ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem data
+    let continuation ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem continuation
+    Aiur.Source.buildWithArguments stem [channel, data] fun x =>
+        match x with
+        | [channel, data] =>
+          Aiur.Source.Term.let Aiur.Pattern.wildcard (channel.ioWrite data Aiur.Source.Term.unit) continuation
+        | x => term
+  | channel.ioSetInfo key idx len continuation => do
+    let channel ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem channel
+    let key ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem key
+    let idx ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem idx
+    let len ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem len
+    let continuation ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem continuation
+    Aiur.Source.buildWithArguments stem [channel, key, idx, len] fun x =>
+        match x with
+        | [channel, key, idx, len] =>
+          Aiur.Source.Term.let Aiur.Pattern.wildcard (channel.ioSetInfo key idx len Aiur.Source.Term.unit) continuation
+        | x => term
+  | arr.set index value => do
+    let value ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem value
+    let arr ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem arr
+    Aiur.Source.buildWithArguments stem [value, arr] fun x =>
+        match x with
+        | [value, arr] => arr.set index value
+        | x => term
+  | a.add b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.add b
+        | x => term
+  | a.sub b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.sub b
+        | x => term
+  | a.mul b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.mul b
+        | x => term
+  | a.ioGetInfo b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.ioGetInfo b
+        | x => term
+  | a.ioRead b len => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.ioRead b len
+        | x => term
+  | a.u8Xor b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8Xor b
+        | x => term
+  | a.u8Add b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8Add b
+        | x => term
+  | a.u8Mul b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8Mul b
+        | x => term
+  | a.u8Sub b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8Sub b
+        | x => term
+  | a.u8And b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8And b
+        | x => term
+  | a.u8Or b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8Or b
+        | x => term
+  | a.u8LessThan b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8LessThan b
+        | x => term
+  | a.u32LessThan b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u32LessThan b
+        | x => term
+  | a.u8XorSplit7 b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8XorSplit7 b
+        | x => term
+  | a.u8XorSplit4 b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8XorSplit4 b
+        | x => term
+  | a.unconstrainedU32Add b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.unconstrainedU32Add b
+        | x => term
+  | a.unconstrainedBigUintDivMod b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.unconstrainedBigUintDivMod b
+        | x => term
+  | a.u8RangeCheck b => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    Aiur.Source.buildWithArguments stem [a, b] fun x =>
+        match x with
+        | [a, b] => a.u8RangeCheck b
+        | x => term
+  | a.unconstrainedU32Add3 b c => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    let b ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem b
+    let c ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem c
+    Aiur.Source.buildWithArguments stem [a, b, c] fun x =>
+        match x with
+        | [a, b, c] => a.unconstrainedU32Add3 b c
+        | x => term
+  | a.eqZero => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.eqZero
+        | x => term
+  | a.proj index => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.proj index
+        | x => term
+  | a.get index => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.get index
+        | x => term
+  | a.slice start stop => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.slice start stop
+        | x => term
+  | a.store => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.store
+        | x => term
+  | a.load => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.load
+        | x => term
+  | a.ptrVal => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.ptrVal
+        | x => term
+  | Aiur.Source.Term.ann typ a => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => Aiur.Source.Term.ann typ a
+        | x => term
+  | a.u8BitDecomposition => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.u8BitDecomposition
+        | x => term
+  | a.u8ShiftLeft => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.u8ShiftLeft
+        | x => term
+  | a.u8ShiftRight => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.u8ShiftRight
+        | x => term
+  | a.u32ToField => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.u32ToField
+        | x => term
+  | a.unconstrainedGToBytes => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.unconstrainedGToBytes
+        | x => term
+  | a.unconstrainedGInverse => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.unconstrainedGInverse
+        | x => term
+  | a.toField => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.toField
+        | x => term
+  | a.u8FromFieldUnsafe => do
+    let a ← Aiur.Source.Term.hoistLetsAux._unsafe_rec stem a
+    Aiur.Source.buildWithArguments stem [a] fun x =>
+        match x with
+        | [a] => a.u8FromFieldUnsafe
+        | x => term
+RECURSION WORKER Aiur.Source.Term.inlineCallSites._unsafe_rec
+Aiur.Source.Term → List (Aiur.Global × Nat)
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Source.Term.app g args Aiur.Source.CallMode.inlined =>
+    List.foldl
+      (fun acc x =>
+        match x with
+        | ⟨a, property⟩ => acc ++ Aiur.Source.Term.inlineCallSites._unsafe_rec a)
+      [(g, args.length)] args.attach
+  | Aiur.Source.Term.app a args mode =>
+    List.foldl
+      (fun acc x =>
+        match x with
+        | ⟨a, property⟩ => acc ++ Aiur.Source.Term.inlineCallSites._unsafe_rec a)
+      [] args.attach
+  | Aiur.Source.Term.unit => []
+  | Aiur.Source.Term.var a => []
+  | Aiur.Source.Term.ref a => []
+  | Aiur.Source.Term.field a => []
+  | Aiur.Source.Term.u8Lit a => []
+  | Aiur.Source.Term.tuple ts =>
+    Array.foldl
+      (fun acc x =>
+        match x with
+        | ⟨a, property⟩ => acc ++ Aiur.Source.Term.inlineCallSites._unsafe_rec a)
+      [] ts.attach
+  | Aiur.Source.Term.array ts =>
+    Array.foldl
+      (fun acc x =>
+        match x with
+        | ⟨a, property⟩ => acc ++ Aiur.Source.Term.inlineCallSites._unsafe_rec a)
+      [] ts.attach
+  | s.match arms =>
+    List.foldl
+      (fun acc x =>
+        match x with
+        | ⟨(fst, a), property⟩ => acc ++ Aiur.Source.Term.inlineCallSites._unsafe_rec a)
+      (Aiur.Source.Term.inlineCallSites._unsafe_rec s) arms.attach
+  | Aiur.Source.Term.let a v b =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec v ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.add b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.sub b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.mul b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.set a_1 b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8Xor b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8Add b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8Mul b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8Sub b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8And b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8Or b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8LessThan b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u32LessThan b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8XorSplit7 b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8XorSplit4 b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.unconstrainedU32Add b =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.unconstrainedBigUintDivMod b =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.u8RangeCheck b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.ioGetInfo b => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.assertEq b msg c =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b ++
+      Aiur.Source.Term.inlineCallSites._unsafe_rec c
+  | a.ioWrite b c =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b ++
+      Aiur.Source.Term.inlineCallSites._unsafe_rec c
+  | c.ioSetInfo k i l rv =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec c ++ Aiur.Source.Term.inlineCallSites._unsafe_rec k ++
+          Aiur.Source.Term.inlineCallSites._unsafe_rec i ++
+        Aiur.Source.Term.inlineCallSites._unsafe_rec l ++
+      Aiur.Source.Term.inlineCallSites._unsafe_rec rv
+  | a.ioRead b len => Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b
+  | a.ret => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.eqZero => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.proj a_1 => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.get a_1 => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.slice a_1 a_2 => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.store => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.load => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.ptrVal => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | Aiur.Source.Term.ann a a_1 => Aiur.Source.Term.inlineCallSites._unsafe_rec a_1
+  | a.u8BitDecomposition => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.u8ShiftLeft => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.u8ShiftRight => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.toField => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.u8FromFieldUnsafe => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.unconstrainedGToBytes => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.unconstrainedGInverse => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.u32ToField => Aiur.Source.Term.inlineCallSites._unsafe_rec a
+  | a.unconstrainedU32Add3 b c =>
+    Aiur.Source.Term.inlineCallSites._unsafe_rec a ++ Aiur.Source.Term.inlineCallSites._unsafe_rec b ++
+      Aiur.Source.Term.inlineCallSites._unsafe_rec c
+  | Aiur.Source.Term.debug a o a_1 =>
+    (match o with
+      | none => []
+      | some x => Aiur.Source.Term.inlineCallSites._unsafe_rec x) ++
+      Aiur.Source.Term.inlineCallSites._unsafe_rec a_1
+RECURSION WORKER Aiur.Source.Term.maxNameLength._unsafe_rec
+Aiur.Source.Term → Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Source.Term.var (Aiur.Local.str name) => name.length
+  | Aiur.Source.Term.var (Aiur.Local.idx a) => 0
+  | Aiur.Source.Term.unit => 0
+  | Aiur.Source.Term.field a => 0
+  | Aiur.Source.Term.u8Lit a => 0
+  | Aiur.Source.Term.ref global => global.toName.toString.length
+  | Aiur.Source.Term.app global args mode =>
+    List.foldl (fun n arg => max n (Aiur.Source.Term.maxNameLength._unsafe_rec arg.val)) global.toName.toString.length
+      args.attach
+  | Aiur.Source.Term.tuple terms =>
+    Array.foldl (fun n term => max n (Aiur.Source.Term.maxNameLength._unsafe_rec term.val)) 0 terms.attach
+  | Aiur.Source.Term.array terms =>
+    Array.foldl (fun n term => max n (Aiur.Source.Term.maxNameLength._unsafe_rec term.val)) 0 terms.attach
+  | Aiur.Source.Term.let pattern value body =>
+    max (Aiur.Source.Pattern.maxNameLength pattern)
+      (max (Aiur.Source.Term.maxNameLength._unsafe_rec value) (Aiur.Source.Term.maxNameLength._unsafe_rec body))
+  | scrut.match arms =>
+    List.foldl
+      (fun n arm =>
+        max n
+          (max (Aiur.Source.Pattern.maxNameLength arm.val.fst)
+            (Aiur.Source.Term.maxNameLength._unsafe_rec arm.val.snd)))
+      (Aiur.Source.Term.maxNameLength._unsafe_rec scrut) arms.attach
+  | a.ret => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.eqZero => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.proj a_1 => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.get a_1 => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.slice a_1 a_2 => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.store => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.load => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.ptrVal => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | Aiur.Source.Term.ann a a_1 => Aiur.Source.Term.maxNameLength._unsafe_rec a_1
+  | a.u8BitDecomposition => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.u8ShiftLeft => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.u8ShiftRight => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.u32ToField => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.unconstrainedGToBytes => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.unconstrainedGInverse => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.toField => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.u8FromFieldUnsafe => Aiur.Source.Term.maxNameLength._unsafe_rec a
+  | a.add b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.sub b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.mul b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.set a_1 b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.ioGetInfo b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.ioRead b len => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8Xor b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8Add b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8Mul b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8Sub b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8And b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8Or b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8LessThan b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u32LessThan b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8XorSplit7 b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8XorSplit4 b => max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.unconstrainedU32Add b =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.unconstrainedBigUintDivMod b =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.u8RangeCheck b =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a) (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+  | a.assertEq b msg c =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a)
+      (max (Aiur.Source.Term.maxNameLength._unsafe_rec b) (Aiur.Source.Term.maxNameLength._unsafe_rec c))
+  | a.ioWrite b c =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a)
+      (max (Aiur.Source.Term.maxNameLength._unsafe_rec b) (Aiur.Source.Term.maxNameLength._unsafe_rec c))
+  | a.unconstrainedU32Add3 b c =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a)
+      (max (Aiur.Source.Term.maxNameLength._unsafe_rec b) (Aiur.Source.Term.maxNameLength._unsafe_rec c))
+  | a.ioSetInfo b c d e =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec a)
+      (max (Aiur.Source.Term.maxNameLength._unsafe_rec b)
+        (max (Aiur.Source.Term.maxNameLength._unsafe_rec c)
+          (max (Aiur.Source.Term.maxNameLength._unsafe_rec d) (Aiur.Source.Term.maxNameLength._unsafe_rec e))))
+  | Aiur.Source.Term.debug a none continuation => Aiur.Source.Term.maxNameLength._unsafe_rec continuation
+  | Aiur.Source.Term.debug a (some value) continuation =>
+    max (Aiur.Source.Term.maxNameLength._unsafe_rec value) (Aiur.Source.Term.maxNameLength._unsafe_rec continuation)
+RECURSION WORKER Aiur.Source.Term.peelLets._unsafe_rec
+Aiur.Source.Term → List (Aiur.Pattern × Aiur.Source.Term) × Aiur.Source.Term
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Source.Term.let p v b =>
+    match Aiur.Source.Term.peelLets._unsafe_rec b with
+    | (fs, c) => ((p, v) :: fs, c)
+  | t => ([], t)
+RECURSION WORKER Aiur.Source.Term.restoreTailMatches._unsafe_rec
+Aiur.Source.Term → Aiur.Source.Term
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Aiur.Source.Term.let (Aiur.Pattern.var x) v (Aiur.Source.Term.var y) =>
+    if (x == y) = true then Aiur.Source.Term.restoreTailMatches._unsafe_rec v
+    else Aiur.Source.Term.let (Aiur.Pattern.var x) v (Aiur.Source.Term.var y)
+  | Aiur.Source.Term.let p v b => Aiur.Source.Term.let p v (Aiur.Source.Term.restoreTailMatches._unsafe_rec b)
+  | s.match arms =>
+    s.match
+      (List.map (fun arm => (arm.val.fst, Aiur.Source.Term.restoreTailMatches._unsafe_rec arm.val.snd)) arms.attach)
+  | t => t
+RECURSION WORKER Aiur.Source.Term.wrapLets._unsafe_rec
+List (Aiur.Pattern × Aiur.Source.Term) → Aiur.Source.Term → Aiur.Source.Term
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | [], body => body
+  | (p, v) :: fs, body => Aiur.Source.Term.let p v (Aiur.Source.Term.wrapLets._unsafe_rec fs body)
+RECURSION WORKER Aiur.Typ.appendNameLimbs.pushAll._unsafe_rec
+Aiur.Global → Name → Aiur.Global
+IMPLEMENTATION
+fun g a =>
+  match a with
+  | parent.str s => (Aiur.Typ.appendNameLimbs.pushAll._unsafe_rec g parent).pushNamespace s
+  | x => g
+RECURSION WORKER Aiur.Typ.beq.listBeqAux._unsafe_rec
+List Aiur.Typ → List Aiur.Typ → Bool
+IMPLEMENTATION
+fun a a_1 =>
+  match a, a_1 with
+  | [], [] => true
+  | head :: tail, [] => false
+  | [], head :: tail => false
+  | t :: rest, t' :: rest' => Aiur.Typ.beq._unsafe_rec t t' && Aiur.Typ.beq.listBeqAux._unsafe_rec rest rest'
+RECURSION WORKER Aiur.wellFormedDecls.checkUniqueParams.go._unsafe_rec
+Aiur.Global → List String → Std.HashSet String → EStateM Aiur.CheckError (Std.HashSet Aiur.Global) Unit
+IMPLEMENTATION
+fun name a a_1 =>
+  match a, a_1 with
+  | [], x => pure ()
+  | p :: ps, seen =>
+    if seen.contains p = true then throw (Aiur.CheckError.duplicatedTypeParam name p)
+    else Aiur.wellFormedDecls.checkUniqueParams.go._unsafe_rec name ps (seen.insert p)
+RECURSION WORKER _private.Ix.Aiur.Goldilocks.0.Aiur.G.pow.go._unsafe_rec
+Aiur.G → Nat → Nat → Aiur.G
+IMPLEMENTATION
+fun x n fuel =>
+  match fuel with
+  | 0 => 1
+  | fuel.succ =>
+    if (n == 0) = true then 1
+    else
+      let h := Aiur.G.pow.go._unsafe_rec✝ x (n / 2) fuel;
+      let sq := h * h;
+      if (n % 2 == 0) = true then sq else sq * x
+RECURSION WORKER _private.Ix.Aiur.Compiler.Match.0.Aiur.MatchCompiler.dnfProd.aux._unsafe_rec
+Aiur.MatchCompiler.TermId →
+  Aiur.Source.Decls →
+    Array (Aiur.Local × Aiur.Typed.Term) →
+      Array Aiur.MatchCompiler.Clause →
+        List (Aiur.Pattern × Aiur.MatchCompiler.UniqTerm) →
+          Aiur.MatchCompiler.ExtTerm → Aiur.MatchCompiler.CompilerM (Array Aiur.MatchCompiler.Row)
+IMPLEMENTATION
+fun initId decls renames clauses branches body =>
+  match branches with
+  | [] => do
+    let id ← Aiur.MatchCompiler.Compiler.uniqId <$> get
+    let row : Aiur.MatchCompiler.Row :=
+      { clauses := clauses, body := { renames := body.renames ++ renames, value := body.value }, uniqId := id }
+    Aiur.MatchCompiler.setId initId
+    pure #[row]
+  | (patL.or patR, term) :: rest => do
+    let rowsL ← Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames clauses ((patL, term) :: rest) body
+    let rowsR ← Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames clauses ((patR, term) :: rest) body
+    pure (rowsL ++ rowsR)
+  | (Aiur.Pattern.wildcard, snd) :: rest =>
+    Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames clauses rest body
+  | (Aiur.Pattern.var var, fst, term) :: rest =>
+    Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls (renames.push (var, term)) clauses rest body
+  | (Aiur.Pattern.field g, term) :: rest =>
+    Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames
+      (clauses.push { pat := Aiur.MatchCompiler.SPattern.field g, guards := #[], body := term }) rest body
+  | (Aiur.Pattern.tuple args, term) :: rest =>
+    let argTypes :=
+      match term.snd.typ with
+      | Aiur.Typ.tuple ts => ts
+      | x => Array.replicate args.size Aiur.Typ.unit;
+    do
+    let __x ← Aiur.MatchCompiler.dnfProd.flattenArgs✝ args argTypes
+    match __x with
+      | (vars, guards) =>
+        let clause := { pat := Aiur.MatchCompiler.SPattern.tuple vars, guards := guards, body := term };
+        Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames (clauses.push clause) rest body
+  | (Aiur.Pattern.array args, term) :: rest =>
+    let eltTyp :=
+      match term.snd.typ with
+      | t.array a => t
+      | x => Aiur.Typ.unit;
+    let argTypes := Array.replicate args.size eltTyp;
+    do
+    let __x ← Aiur.MatchCompiler.dnfProd.flattenArgs✝ args argTypes
+    match __x with
+      | (vars, guards) =>
+        let clause := { pat := Aiur.MatchCompiler.SPattern.array vars, guards := guards, body := term };
+        Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames (clauses.push clause) rest body
+  | (Aiur.Pattern.ref global args, term) :: rest =>
+    let argTypes := Aiur.MatchCompiler.constructorArgTypes✝ decls global term.snd.typ;
+    do
+    let __x ← Aiur.MatchCompiler.dnfProd.flattenArgs✝ args.toArray argTypes
+    match __x with
+      | (vars, guards) =>
+        let clause := { pat := Aiur.MatchCompiler.SPattern.ref global vars, guards := guards, body := term };
+        Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames (clauses.push clause) rest body
+  | (arg.pointer, term) :: rest => do
+    let id ← Aiur.MatchCompiler.newId
+    let var : Aiur.Local := Aiur.Local.idx id
+    let innerTyp : Aiur.Typ :=
+      match term.snd.typ with
+      | t.pointer => t
+      | x => Aiur.Typ.unit
+    let guards : Array (Aiur.Pattern × Aiur.MatchCompiler.TermId × Aiur.Typed.Term) :=
+      #[(arg, id, Aiur.Typed.Term.var innerTyp false var)]
+    let clause : Aiur.MatchCompiler.Clause :=
+      { pat := Aiur.MatchCompiler.SPattern.pointer var innerTyp, guards := guards, body := term }
+    Aiur.MatchCompiler.dnfProd.aux._unsafe_rec✝ initId decls renames (clauses.push clause) rest body
+RECURSION WORKER Aiur.NativeAIR.ProofCodec.Extension.powBits._unsafe_rec
+Aiur.NativeAIR.ProofCodec.Extension → Nat → Nat → Aiur.NativeAIR.ProofCodec.Extension
+IMPLEMENTATION
+fun value exponent x =>
+  match x with
+  | 0 => 1
+  | fuel.succ =>
+    if (exponent == 0) = true then 1
+    else
+      let half := Aiur.NativeAIR.ProofCodec.Extension.powBits._unsafe_rec value (exponent / 2) fuel;
+      let square := half * half;
+      if (exponent % 2 == 0) = true then square else square * value
+C8 component ROOTS 1544; LOGICAL DECLARATIONS 20298; WITH RUNTIME 21114
+IX RUNTIME EXTERNS [Aiur.AiurSystem.build, Aiur.AiurSystem.verify, Aiur.AiurSystem.vkBytes, Aiur.Proof.ofBytesChecked]
+PARTIAL OPAQUE SOURCES [Aiur.instHashableTyp.hash, Aiur.instReprPattern.repr, Aiur.instReprTyp.repr]
+OTHER UNSAFE RUNTIME []
+RECURSION WORKERS 196
+Runtime diagnostics cover Ix modules, including private constants. Lean/Std runtime primitives remain an external execution boundary. Partial opaque implementations are inventoried, not proved to refine their logical defaults.
+The runtime inventory and theorem premises are frozen separately. These roots do not establish full compiler/AIR reflection or public certified claim semantics.
diff --git a/Tests/Aiur/bytecode-compatibility.txt b/Tests/Aiur/bytecode-compatibility.txt
new file mode 100644
index 000000000..6b604e6e8
--- /dev/null
+++ b/Tests/Aiur/bytecode-compatibility.txt
@@ -0,0 +1,396 @@
+BYTECODE COMPARISON FIXTURES 395
+BLOCK 0 HASH 618374249549425031 CONTROL 9285540956611923268 EQUAL #[0]
+BLOCK 1 HASH 10767362259901604917 CONTROL 6836250532619648879 EQUAL #[1]
+BLOCK 2 HASH 11672108002333575424 CONTROL 9285540956611923268 EQUAL #[2]
+BLOCK 3 HASH 13567776331674792218 CONTROL 9285540956611923268 EQUAL #[3]
+BLOCK 4 HASH 5882612929627746006 CONTROL 9285540956611923268 EQUAL #[4]
+BLOCK 5 HASH 15738423084920187207 CONTROL 9285540956611923268 EQUAL #[5]
+BLOCK 6 HASH 8339378633421865408 CONTROL 9285540956611923268 EQUAL #[6]
+BLOCK 7 HASH 9048624632441819154 CONTROL 9285540956611923268 EQUAL #[7]
+BLOCK 8 HASH 476257331868625673 CONTROL 9285540956611923268 EQUAL #[8]
+BLOCK 9 HASH 9619198049311423339 CONTROL 9285540956611923268 EQUAL #[9]
+BLOCK 10 HASH 10053140698542559660 CONTROL 9285540956611923268 EQUAL #[10]
+BLOCK 11 HASH 16142299799675066055 CONTROL 9285540956611923268 EQUAL #[11]
+BLOCK 12 HASH 8460708323736300895 CONTROL 9285540956611923268 EQUAL #[12]
+BLOCK 13 HASH 14064263600456978268 CONTROL 9285540956611923268 EQUAL #[13]
+BLOCK 14 HASH 349930326508970344 CONTROL 9285540956611923268 EQUAL #[14]
+BLOCK 15 HASH 2823160669760411641 CONTROL 9285540956611923268 EQUAL #[15]
+BLOCK 16 HASH 15190639785503822565 CONTROL 9285540956611923268 EQUAL #[16]
+BLOCK 17 HASH 2618898095466958846 CONTROL 9285540956611923268 EQUAL #[17]
+BLOCK 18 HASH 4016723164930384913 CONTROL 9285540956611923268 EQUAL #[18]
+BLOCK 19 HASH 7522974378207777983 CONTROL 9285540956611923268 EQUAL #[19]
+BLOCK 20 HASH 291555211599457042 CONTROL 9285540956611923268 EQUAL #[20]
+BLOCK 21 HASH 3930346390669372951 CONTROL 9285540956611923268 EQUAL #[21]
+BLOCK 22 HASH 3206432457045056339 CONTROL 9285540956611923268 EQUAL #[22]
+BLOCK 23 HASH 9646947391128649297 CONTROL 9285540956611923268 EQUAL #[23]
+BLOCK 24 HASH 1434544142018062473 CONTROL 9285540956611923268 EQUAL #[24]
+BLOCK 25 HASH 11531913990625414641 CONTROL 9285540956611923268 EQUAL #[25]
+BLOCK 26 HASH 17864658416170291104 CONTROL 9285540956611923268 EQUAL #[26]
+BLOCK 27 HASH 15707162891451276999 CONTROL 9285540956611923268 EQUAL #[27]
+BLOCK 28 HASH 9110709247370404019 CONTROL 9285540956611923268 EQUAL #[28]
+BLOCK 29 HASH 7282864665841768941 CONTROL 9285540956611923268 EQUAL #[29]
+BLOCK 30 HASH 17878598160472452876 CONTROL 9285540956611923268 EQUAL #[30]
+BLOCK 31 HASH 9131874713094089536 CONTROL 9285540956611923268 EQUAL #[31]
+BLOCK 32 HASH 9206845510160007850 CONTROL 9285540956611923268 EQUAL #[32]
+BLOCK 33 HASH 18411462278693569584 CONTROL 9285540956611923268 EQUAL #[33]
+BLOCK 34 HASH 12249543226618914073 CONTROL 9285540956611923268 EQUAL #[34]
+BLOCK 35 HASH 13305176274105683490 CONTROL 9285540956611923268 EQUAL #[35]
+BLOCK 36 HASH 626254262210408935 CONTROL 9285540956611923268 EQUAL #[36]
+BLOCK 37 HASH 66266134359554334 CONTROL 9285540956611923268 EQUAL #[37]
+BLOCK 38 HASH 4722821071429242579 CONTROL 9285540956611923268 EQUAL #[38]
+BLOCK 39 HASH 2591955576747446219 CONTROL 9285540956611923268 EQUAL #[39]
+BLOCK 40 HASH 123081820534452520 CONTROL 442260967249929706 EQUAL #[40]
+BLOCK 41 HASH 2269127429092526664 CONTROL 7368886074157430835 EQUAL #[41]
+BLOCK 42 HASH 6972128161722958508 CONTROL 8099949975056009608 EQUAL #[42]
+BLOCK 43 HASH 9378383683697981412 CONTROL 12287981519385779728 EQUAL #[43]
+BLOCK 44 HASH 13030451103740552621 CONTROL 8750347727180497316 EQUAL #[44]
+BLOCK 45 HASH 7163820565924969022 CONTROL 8541860137754334797 EQUAL #[45]
+BLOCK 46 HASH 16811152477437330821 CONTROL 3731605226305634582 EQUAL #[46]
+BLOCK 47 HASH 7259229959211084775 CONTROL 9727055256702545294 EQUAL #[47]
+BLOCK 48 HASH 792296228035146239 CONTROL 2624280346791568358 EQUAL #[48]
+BLOCK 49 HASH 9462357318678034408 CONTROL 1025175301796357359 EQUAL #[49]
+BLOCK 50 HASH 13907099015722761018 CONTROL 10046770220800461300 EQUAL #[50]
+BLOCK 51 HASH 17877525535566776336 CONTROL 9256014151676554028 EQUAL #[51]
+BLOCK 52 HASH 9332988922403297458 CONTROL 17794894587962055635 EQUAL #[52]
+BLOCK 53 HASH 6962274207880604662 CONTROL 18252359267413485426 EQUAL #[53]
+BLOCK 54 HASH 16513437812367402178 CONTROL 16818496739035924833 EQUAL #[54]
+BLOCK 55 HASH 14293640645409139514 CONTROL 8625692579045300697 EQUAL #[55]
+BLOCK 56 HASH 16526029939492997083 CONTROL 8934133331990604517 EQUAL #[56]
+BLOCK 57 HASH 13823931130195299110 CONTROL 1320777040509452772 EQUAL #[57]
+BLOCK 58 HASH 1144443015364867233 CONTROL 9711647431898321223 EQUAL #[58]
+BLOCK 59 HASH 7176117492116446776 CONTROL 549193491256352175 EQUAL #[59]
+BLOCK 60 HASH 4342164131208559031 CONTROL 3352624905678114087 EQUAL #[60]
+BLOCK 61 HASH 13179500588532732117 CONTROL 12158506884767977126 EQUAL #[61]
+BLOCK 62 HASH 1072227324077203834 CONTROL 5919442857798660357 EQUAL #[62]
+BLOCK 63 HASH 8936741155375479642 CONTROL 9460575193024119757 EQUAL #[63]
+BLOCK 64 HASH 2528818410938476416 CONTROL 13659450731802344926 EQUAL #[64]
+BLOCK 65 HASH 9971581454819281316 CONTROL 8326825899499085215 EQUAL #[65]
+BLOCK 66 HASH 10411899777951044952 CONTROL 11787513862943280324 EQUAL #[66]
+BLOCK 67 HASH 13542459157806783444 CONTROL 7276143994603534460 EQUAL #[67]
+BLOCK 68 HASH 14861287983348871617 CONTROL 2738270753240256240 EQUAL #[68]
+BLOCK 69 HASH 11868535493272160426 CONTROL 7935514033972273153 EQUAL #[69]
+BLOCK 70 HASH 4840191378550344899 CONTROL 12588597752625930266 EQUAL #[70]
+BLOCK 71 HASH 14002491812871334650 CONTROL 5974536654261613602 EQUAL #[71]
+BLOCK 72 HASH 17194110321127950249 CONTROL 6218681475608484146 EQUAL #[72]
+BLOCK 73 HASH 15383477069917739851 CONTROL 5226745078584996419 EQUAL #[73]
+BLOCK 74 HASH 8644283588974591927 CONTROL 18221978229553308984 EQUAL #[74]
+BLOCK 75 HASH 793158955187790018 CONTROL 5942474650035376320 EQUAL #[75]
+BLOCK 76 HASH 5046099744285162722 CONTROL 1227879464581278383 EQUAL #[76, 77]
+BLOCK 77 HASH 5046099744285162722 CONTROL 1227879464581278383 EQUAL #[76, 77]
+BLOCK 78 HASH 14434027012720595378 CONTROL 1227879464581278383 EQUAL #[78]
+BLOCK 79 HASH 15593214182835131542 CONTROL 8784252495883746449 EQUAL #[79]
+BLOCK 80 HASH 6870429911899794176 CONTROL 5031497259189885290 EQUAL #[80]
+BLOCK 81 HASH 11228586072522957117 CONTROL 8784252495883746449 EQUAL #[81]
+BLOCK 82 HASH 13477987559259585252 CONTROL 8784252495883746449 EQUAL #[82]
+BLOCK 83 HASH 17135159117916155065 CONTROL 8784252495883746449 EQUAL #[83]
+BLOCK 84 HASH 11794633473663537442 CONTROL 8784252495883746449 EQUAL #[84]
+BLOCK 85 HASH 12950004568662697645 CONTROL 8784252495883746449 EQUAL #[85]
+BLOCK 86 HASH 15491984793067098838 CONTROL 8784252495883746449 EQUAL #[86]
+BLOCK 87 HASH 3030620686625893817 CONTROL 8784252495883746449 EQUAL #[87]
+BLOCK 88 HASH 4669408539669772990 CONTROL 8784252495883746449 EQUAL #[88]
+BLOCK 89 HASH 7768620375418789214 CONTROL 8784252495883746449 EQUAL #[89]
+BLOCK 90 HASH 2654856332192868711 CONTROL 8784252495883746449 EQUAL #[90]
+BLOCK 91 HASH 11140533640375000682 CONTROL 8784252495883746449 EQUAL #[91]
+BLOCK 92 HASH 15744784955530291696 CONTROL 8784252495883746449 EQUAL #[92]
+BLOCK 93 HASH 17601358025109035212 CONTROL 8784252495883746449 EQUAL #[93]
+BLOCK 94 HASH 16883637298171234440 CONTROL 8784252495883746449 EQUAL #[94]
+BLOCK 95 HASH 14507023773745916734 CONTROL 8784252495883746449 EQUAL #[95]
+BLOCK 96 HASH 9316443224328059401 CONTROL 8784252495883746449 EQUAL #[96]
+BLOCK 97 HASH 17461166695896006315 CONTROL 8784252495883746449 EQUAL #[97]
+BLOCK 98 HASH 6128950249435413453 CONTROL 8784252495883746449 EQUAL #[98]
+BLOCK 99 HASH 1831537920616591979 CONTROL 8784252495883746449 EQUAL #[99]
+BLOCK 100 HASH 14350866197508785408 CONTROL 8784252495883746449 EQUAL #[100]
+BLOCK 101 HASH 10761897014089548388 CONTROL 8784252495883746449 EQUAL #[101]
+BLOCK 102 HASH 5020673946780198162 CONTROL 8784252495883746449 EQUAL #[102]
+BLOCK 103 HASH 7344345781785311212 CONTROL 8784252495883746449 EQUAL #[103]
+BLOCK 104 HASH 16495682629274189661 CONTROL 8784252495883746449 EQUAL #[104]
+BLOCK 105 HASH 5171338963310349593 CONTROL 8784252495883746449 EQUAL #[105]
+BLOCK 106 HASH 11657291387755173558 CONTROL 8784252495883746449 EQUAL #[106]
+BLOCK 107 HASH 7519375929998021380 CONTROL 8784252495883746449 EQUAL #[107]
+BLOCK 108 HASH 8841095143167053894 CONTROL 8784252495883746449 EQUAL #[108]
+BLOCK 109 HASH 12204384250884847614 CONTROL 8784252495883746449 EQUAL #[109]
+BLOCK 110 HASH 13287577812951221113 CONTROL 8784252495883746449 EQUAL #[110]
+BLOCK 111 HASH 17806865421501680675 CONTROL 8784252495883746449 EQUAL #[111]
+BLOCK 112 HASH 1090978459723504726 CONTROL 8784252495883746449 EQUAL #[112]
+BLOCK 113 HASH 16486163545670406625 CONTROL 8784252495883746449 EQUAL #[113]
+BLOCK 114 HASH 10317805833216091280 CONTROL 8784252495883746449 EQUAL #[114]
+BLOCK 115 HASH 18432780923276165067 CONTROL 8784252495883746449 EQUAL #[115]
+BLOCK 116 HASH 6862647800684957780 CONTROL 8784252495883746449 EQUAL #[116]
+BLOCK 117 HASH 1699812483050273097 CONTROL 8784252495883746449 EQUAL #[117]
+BLOCK 118 HASH 13693044082596212025 CONTROL 8784252495883746449 EQUAL #[118]
+BLOCK 119 HASH 14456975777343617427 CONTROL 6203731646402738190 EQUAL #[119]
+BLOCK 120 HASH 10822122504004831819 CONTROL 5122488561581784412 EQUAL #[120]
+BLOCK 121 HASH 209350869627849625 CONTROL 2470556298702175255 EQUAL #[121]
+BLOCK 122 HASH 1984990494015217724 CONTROL 18339464206584115167 EQUAL #[122]
+BLOCK 123 HASH 11568910206272915584 CONTROL 13529796445238207056 EQUAL #[123]
+BLOCK 124 HASH 1832402004605126241 CONTROL 47464743328756682 EQUAL #[124]
+BLOCK 125 HASH 15025537237962902193 CONTROL 4520577957331705713 EQUAL #[125]
+BLOCK 126 HASH 2449783759168503400 CONTROL 13065218925294200329 EQUAL #[126]
+BLOCK 127 HASH 518562794364551831 CONTROL 5073790739569167119 EQUAL #[127]
+BLOCK 128 HASH 14918149910095476447 CONTROL 14218246878766364077 EQUAL #[128]
+BLOCK 129 HASH 5887591544949002135 CONTROL 8401608799272219326 EQUAL #[129]
+BLOCK 130 HASH 16583739283095924894 CONTROL 4955196834704457846 EQUAL #[130]
+BLOCK 131 HASH 16252481252968914360 CONTROL 6857465993183697657 EQUAL #[131]
+BLOCK 132 HASH 6292858437620421432 CONTROL 7750032337035065955 EQUAL #[132]
+BLOCK 133 HASH 11484065554089991150 CONTROL 16210096123913723904 EQUAL #[133]
+BLOCK 134 HASH 11823408709769897484 CONTROL 933528679431178984 EQUAL #[134]
+BLOCK 135 HASH 7142567934441389978 CONTROL 183835739773987727 EQUAL #[135]
+BLOCK 136 HASH 13131128633786316581 CONTROL 14239324964574065229 EQUAL #[136]
+BLOCK 137 HASH 17078064776857431687 CONTROL 9266877669054722718 EQUAL #[137]
+BLOCK 138 HASH 2148828171051292821 CONTROL 3296820152665538198 EQUAL #[138]
+BLOCK 139 HASH 1722994774935311210 CONTROL 7510598364130417360 EQUAL #[139]
+BLOCK 140 HASH 16329381174783010487 CONTROL 7693462472108927402 EQUAL #[140]
+BLOCK 141 HASH 12150683071829182844 CONTROL 15400027340878189073 EQUAL #[141]
+BLOCK 142 HASH 10409933514622992242 CONTROL 18018849807154746857 EQUAL #[142]
+BLOCK 143 HASH 12271041658409189545 CONTROL 13777559853531555046 EQUAL #[143]
+BLOCK 144 HASH 947419858078852370 CONTROL 11285603661166613876 EQUAL #[144]
+BLOCK 145 HASH 14767787222335820379 CONTROL 11203312843384486319 EQUAL #[145]
+BLOCK 146 HASH 18100704755056617074 CONTROL 12655290107111833223 EQUAL #[146]
+BLOCK 147 HASH 11134828345163871534 CONTROL 656857140206167336 EQUAL #[147]
+BLOCK 148 HASH 1916137348187063063 CONTROL 13951641050356124242 EQUAL #[148]
+BLOCK 149 HASH 16334426986765523389 CONTROL 5754028386739114873 EQUAL #[149]
+BLOCK 150 HASH 15023064395313836703 CONTROL 13445039757214890209 EQUAL #[150]
+BLOCK 151 HASH 4933993368756487521 CONTROL 15133198741730790887 EQUAL #[151]
+BLOCK 152 HASH 13701879806998378282 CONTROL 6665581908433556629 EQUAL #[152]
+BLOCK 153 HASH 7755549216534273852 CONTROL 244239508757426726 EQUAL #[153]
+BLOCK 154 HASH 15458302475149362676 CONTROL 4664917923743035406 EQUAL #[154]
+BLOCK 155 HASH 12651650412334410450 CONTROL 5815682396845256326 EQUAL #[155, 156]
+BLOCK 156 HASH 12651650412334410450 CONTROL 5815682396845256326 EQUAL #[155, 156]
+BLOCK 157 HASH 12838375498233594114 CONTROL 5815682396845256326 EQUAL #[157]
+BLOCK 158 HASH 1283267760902138737 CONTROL 7672978788370522085 EQUAL #[158]
+BLOCK 159 HASH 1884363252718491921 CONTROL 5149645617458545238 EQUAL #[159]
+BLOCK 160 HASH 15123317700383798921 CONTROL 7672978788370522085 EQUAL #[160]
+BLOCK 161 HASH 13947326510846006736 CONTROL 7672978788370522085 EQUAL #[161]
+BLOCK 162 HASH 3426605980619719249 CONTROL 7672978788370522085 EQUAL #[162]
+BLOCK 163 HASH 7209255731814999571 CONTROL 7672978788370522085 EQUAL #[163]
+BLOCK 164 HASH 18228949997554902956 CONTROL 7672978788370522085 EQUAL #[164]
+BLOCK 165 HASH 1411810313083244633 CONTROL 7672978788370522085 EQUAL #[165]
+BLOCK 166 HASH 567972741979504646 CONTROL 7672978788370522085 EQUAL #[166]
+BLOCK 167 HASH 1574972134704558712 CONTROL 7672978788370522085 EQUAL #[167]
+BLOCK 168 HASH 7097805197569488943 CONTROL 7672978788370522085 EQUAL #[168]
+BLOCK 169 HASH 3598976423589741836 CONTROL 7672978788370522085 EQUAL #[169]
+BLOCK 170 HASH 18076216439856153132 CONTROL 7672978788370522085 EQUAL #[170]
+BLOCK 171 HASH 14427324802773785495 CONTROL 7672978788370522085 EQUAL #[171]
+BLOCK 172 HASH 5664450267676950274 CONTROL 7672978788370522085 EQUAL #[172]
+BLOCK 173 HASH 672982601460096800 CONTROL 7672978788370522085 EQUAL #[173]
+BLOCK 174 HASH 8508828043863792852 CONTROL 7672978788370522085 EQUAL #[174]
+BLOCK 175 HASH 18429923591208970006 CONTROL 7672978788370522085 EQUAL #[175]
+BLOCK 176 HASH 16082858208762997193 CONTROL 7672978788370522085 EQUAL #[176]
+BLOCK 177 HASH 12832962972040815598 CONTROL 7672978788370522085 EQUAL #[177]
+BLOCK 178 HASH 18267133736975463729 CONTROL 7672978788370522085 EQUAL #[178]
+BLOCK 179 HASH 3571883277244661591 CONTROL 7672978788370522085 EQUAL #[179]
+BLOCK 180 HASH 8257699755391402114 CONTROL 7672978788370522085 EQUAL #[180]
+BLOCK 181 HASH 6900735505115440733 CONTROL 7672978788370522085 EQUAL #[181]
+BLOCK 182 HASH 10706003055777563366 CONTROL 7672978788370522085 EQUAL #[182]
+BLOCK 183 HASH 6629805224997183593 CONTROL 7672978788370522085 EQUAL #[183]
+BLOCK 184 HASH 10209298439094032157 CONTROL 7672978788370522085 EQUAL #[184]
+BLOCK 185 HASH 5200245702257074099 CONTROL 7672978788370522085 EQUAL #[185]
+BLOCK 186 HASH 567159334841412781 CONTROL 7672978788370522085 EQUAL #[186]
+BLOCK 187 HASH 14903449863862145522 CONTROL 7672978788370522085 EQUAL #[187]
+BLOCK 188 HASH 15348691934452634153 CONTROL 7672978788370522085 EQUAL #[188]
+BLOCK 189 HASH 5288489006398901758 CONTROL 7672978788370522085 EQUAL #[189]
+BLOCK 190 HASH 13955901823420288825 CONTROL 7672978788370522085 EQUAL #[190]
+BLOCK 191 HASH 1918250980888382833 CONTROL 7672978788370522085 EQUAL #[191]
+BLOCK 192 HASH 12117297154071734272 CONTROL 7672978788370522085 EQUAL #[192]
+BLOCK 193 HASH 6306647992692426176 CONTROL 7672978788370522085 EQUAL #[193]
+BLOCK 194 HASH 18291848165696743141 CONTROL 7672978788370522085 EQUAL #[194]
+BLOCK 195 HASH 7733461127087210941 CONTROL 7672978788370522085 EQUAL #[195]
+BLOCK 196 HASH 3822529860578977889 CONTROL 7672978788370522085 EQUAL #[196]
+BLOCK 197 HASH 7828019728678658568 CONTROL 7672978788370522085 EQUAL #[197]
+BLOCK 198 HASH 198431472103947920 CONTROL 16825163729238218580 EQUAL #[198]
+BLOCK 199 HASH 2328022609132471740 CONTROL 16864498735519437028 EQUAL #[199]
+BLOCK 200 HASH 5518293941933170447 CONTROL 705860499898407377 EQUAL #[200]
+BLOCK 201 HASH 7086633813526480806 CONTROL 2120727659526319965 EQUAL #[201]
+BLOCK 202 HASH 7544604200239110848 CONTROL 5501555016000168213 EQUAL #[202]
+BLOCK 203 HASH 1327977292673188868 CONTROL 7167479335275031301 EQUAL #[203]
+BLOCK 204 HASH 6995139991587641016 CONTROL 5306712755674392544 EQUAL #[204]
+BLOCK 205 HASH 2869329674000347995 CONTROL 13838270730535029092 EQUAL #[205]
+BLOCK 206 HASH 7540513984832443031 CONTROL 3351801062277294600 EQUAL #[206]
+BLOCK 207 HASH 14351243101849938939 CONTROL 7614625664420287296 EQUAL #[207]
+BLOCK 208 HASH 13531312153612296043 CONTROL 7891804896811708485 EQUAL #[208]
+BLOCK 209 HASH 1998244710432636421 CONTROL 17285568389751612585 EQUAL #[209]
+BLOCK 210 HASH 11941311214155962856 CONTROL 520615414868360800 EQUAL #[210]
+BLOCK 211 HASH 5197532886255551202 CONTROL 8560734315700569392 EQUAL #[211]
+BLOCK 212 HASH 12576702381080013224 CONTROL 16334122009680349909 EQUAL #[212]
+BLOCK 213 HASH 16417317276331008323 CONTROL 11512241375656347097 EQUAL #[213]
+BLOCK 214 HASH 7282052706654027122 CONTROL 12075866798987247561 EQUAL #[214]
+BLOCK 215 HASH 6356154908647557244 CONTROL 17730125356489253065 EQUAL #[215]
+BLOCK 216 HASH 13254216122449771798 CONTROL 11431982434788764524 EQUAL #[216]
+BLOCK 217 HASH 9537842138074422592 CONTROL 3059905783217945816 EQUAL #[217]
+BLOCK 218 HASH 9349095545095618561 CONTROL 6364398609764915452 EQUAL #[218]
+BLOCK 219 HASH 5371829853627181735 CONTROL 14853108725724458868 EQUAL #[219]
+BLOCK 220 HASH 11990493234764055494 CONTROL 7648355342318868161 EQUAL #[220]
+BLOCK 221 HASH 7166728261378469222 CONTROL 4476462443417450093 EQUAL #[221]
+BLOCK 222 HASH 10107621913334223336 CONTROL 15670488636498815496 EQUAL #[222]
+BLOCK 223 HASH 4743457210413836307 CONTROL 27611921795077048 EQUAL #[223]
+BLOCK 224 HASH 6507888404916187446 CONTROL 1761815328202991213 EQUAL #[224]
+BLOCK 225 HASH 9466209696331067265 CONTROL 12885850262253222945 EQUAL #[225]
+BLOCK 226 HASH 10989349617707478133 CONTROL 4709089612658109297 EQUAL #[226]
+BLOCK 227 HASH 10661371310995142763 CONTROL 16200754376417689185 EQUAL #[227]
+BLOCK 228 HASH 16225858480419194612 CONTROL 5362159836533946996 EQUAL #[228]
+BLOCK 229 HASH 8944826474749893854 CONTROL 2661323665792140752 EQUAL #[229]
+BLOCK 230 HASH 14708006028794950073 CONTROL 9512598258868672340 EQUAL #[230]
+BLOCK 231 HASH 1910416286691691802 CONTROL 17765048123077364028 EQUAL #[231]
+BLOCK 232 HASH 14606456589376999212 CONTROL 7907470118315484697 EQUAL #[232]
+BLOCK 233 HASH 8591020620007062366 CONTROL 13834573667365444661 EQUAL #[233]
+BLOCK 234 HASH 829527346973826275 CONTROL 11030345794345088650 EQUAL #[234, 235]
+BLOCK 235 HASH 829527346973826275 CONTROL 11030345794345088650 EQUAL #[234, 235]
+BLOCK 236 HASH 8138522887513815913 CONTROL 11030345794345088650 EQUAL #[236]
+BLOCK 237 HASH 13995316751874110918 CONTROL 1412341037314722380 EQUAL #[237]
+BLOCK 238 HASH 18020510042460779070 CONTROL 14509346486066595023 EQUAL #[238]
+BLOCK 239 HASH 2325722907376616799 CONTROL 1412341037314722380 EQUAL #[239]
+BLOCK 240 HASH 16369690687557828028 CONTROL 1412341037314722380 EQUAL #[240]
+BLOCK 241 HASH 2675804253565710522 CONTROL 1412341037314722380 EQUAL #[241]
+BLOCK 242 HASH 3761327872365045708 CONTROL 1412341037314722380 EQUAL #[242]
+BLOCK 243 HASH 8179585094746246508 CONTROL 1412341037314722380 EQUAL #[243]
+BLOCK 244 HASH 4073918353814983293 CONTROL 1412341037314722380 EQUAL #[244]
+BLOCK 245 HASH 4905762299860004433 CONTROL 1412341037314722380 EQUAL #[245]
+BLOCK 246 HASH 12596693210464903654 CONTROL 1412341037314722380 EQUAL #[246]
+BLOCK 247 HASH 16599953839193188956 CONTROL 1412341037314722380 EQUAL #[247]
+BLOCK 248 HASH 15850628249433035745 CONTROL 1412341037314722380 EQUAL #[248]
+BLOCK 249 HASH 4179529552794659453 CONTROL 1412341037314722380 EQUAL #[249]
+BLOCK 250 HASH 9468805364482338310 CONTROL 1412341037314722380 EQUAL #[250]
+BLOCK 251 HASH 3863474582015271553 CONTROL 1412341037314722380 EQUAL #[251]
+BLOCK 252 HASH 7205344154507129833 CONTROL 1412341037314722380 EQUAL #[252]
+BLOCK 253 HASH 13436535963662627343 CONTROL 1412341037314722380 EQUAL #[253]
+BLOCK 254 HASH 12377483774483520813 CONTROL 1412341037314722380 EQUAL #[254]
+BLOCK 255 HASH 4282037769824259431 CONTROL 1412341037314722380 EQUAL #[255]
+BLOCK 256 HASH 7385376240264034152 CONTROL 1412341037314722380 EQUAL #[256]
+BLOCK 257 HASH 806452055526413109 CONTROL 1412341037314722380 EQUAL #[257]
+BLOCK 258 HASH 15000388160001968739 CONTROL 1412341037314722380 EQUAL #[258]
+BLOCK 259 HASH 17367695747249965684 CONTROL 1412341037314722380 EQUAL #[259]
+BLOCK 260 HASH 1122340963572135819 CONTROL 1412341037314722380 EQUAL #[260]
+BLOCK 261 HASH 7789880408650510209 CONTROL 1412341037314722380 EQUAL #[261]
+BLOCK 262 HASH 1869500212260374831 CONTROL 1412341037314722380 EQUAL #[262]
+BLOCK 263 HASH 14845287494291971596 CONTROL 1412341037314722380 EQUAL #[263]
+BLOCK 264 HASH 14075713458717556763 CONTROL 1412341037314722380 EQUAL #[264]
+BLOCK 265 HASH 10864881960281298525 CONTROL 1412341037314722380 EQUAL #[265]
+BLOCK 266 HASH 13459867850344339846 CONTROL 1412341037314722380 EQUAL #[266]
+BLOCK 267 HASH 2819728148997170702 CONTROL 1412341037314722380 EQUAL #[267]
+BLOCK 268 HASH 4527503802875146153 CONTROL 1412341037314722380 EQUAL #[268]
+BLOCK 269 HASH 18029620499192445347 CONTROL 1412341037314722380 EQUAL #[269]
+BLOCK 270 HASH 7402134703085508897 CONTROL 1412341037314722380 EQUAL #[270]
+BLOCK 271 HASH 5257146648189379704 CONTROL 1412341037314722380 EQUAL #[271]
+BLOCK 272 HASH 1395176487860975178 CONTROL 1412341037314722380 EQUAL #[272]
+BLOCK 273 HASH 15691405994808164562 CONTROL 1412341037314722380 EQUAL #[273]
+BLOCK 274 HASH 16453288715351159105 CONTROL 1412341037314722380 EQUAL #[274]
+BLOCK 275 HASH 1379807177850769112 CONTROL 1412341037314722380 EQUAL #[275]
+BLOCK 276 HASH 11377702386000080636 CONTROL 1412341037314722380 EQUAL #[276]
+BLOCK 277 HASH 5198926819085355727 CONTROL 4103347131404716257 EQUAL #[277]
+BLOCK 278 HASH 17268730218823233171 CONTROL 4007854741778933750 EQUAL #[278]
+BLOCK 279 HASH 6923055678665536144 CONTROL 10499270455681555439 EQUAL #[279]
+BLOCK 280 HASH 10427933834192710213 CONTROL 8711154114120874639 EQUAL #[280]
+BLOCK 281 HASH 3433869452976212206 CONTROL 16702709322516330853 EQUAL #[281]
+BLOCK 282 HASH 9924846121775755015 CONTROL 6073005231246686738 EQUAL #[282]
+BLOCK 283 HASH 14362650825028221940 CONTROL 6462996632176444379 EQUAL #[283]
+BLOCK 284 HASH 6210270071042925381 CONTROL 9815223537327002699 EQUAL #[284]
+BLOCK 285 HASH 12376074138572659249 CONTROL 12492989825141361904 EQUAL #[285]
+BLOCK 286 HASH 10160745485024405551 CONTROL 2527833134488699487 EQUAL #[286]
+BLOCK 287 HASH 13032917679763405545 CONTROL 7939604329859445710 EQUAL #[287]
+BLOCK 288 HASH 4069468452703318071 CONTROL 11731051236880384494 EQUAL #[288]
+BLOCK 289 HASH 6019780007050549552 CONTROL 1745119938756421140 EQUAL #[289]
+BLOCK 290 HASH 2669765899957771226 CONTROL 17965183165604085707 EQUAL #[290]
+BLOCK 291 HASH 16695280086327466198 CONTROL 6291746971986477946 EQUAL #[291]
+BLOCK 292 HASH 3970101118045276049 CONTROL 3508421241767877690 EQUAL #[292]
+BLOCK 293 HASH 12475248795862969402 CONTROL 6164182821519423720 EQUAL #[293]
+BLOCK 294 HASH 6793070773433536541 CONTROL 18404655147469866807 EQUAL #[294]
+BLOCK 295 HASH 11591324004765997935 CONTROL 4284497748849439318 EQUAL #[295]
+BLOCK 296 HASH 2292506223546533055 CONTROL 15379096783635824966 EQUAL #[296]
+BLOCK 297 HASH 3349721624328230677 CONTROL 13368057163843177117 EQUAL #[297]
+BLOCK 298 HASH 5987935174962115052 CONTROL 8264178947098801098 EQUAL #[298]
+BLOCK 299 HASH 3544709462059876847 CONTROL 6684397670075172195 EQUAL #[299]
+BLOCK 300 HASH 14514956999628286581 CONTROL 8096479539679101667 EQUAL #[300]
+BLOCK 301 HASH 7753915019778992118 CONTROL 1548763615490106882 EQUAL #[301]
+BLOCK 302 HASH 15339629469836035716 CONTROL 16445791782020682133 EQUAL #[302]
+BLOCK 303 HASH 18404753015914565380 CONTROL 12224237222522533764 EQUAL #[303]
+BLOCK 304 HASH 17657906620874486700 CONTROL 2836452298334761684 EQUAL #[304]
+BLOCK 305 HASH 12564877604107370077 CONTROL 6670796226598270766 EQUAL #[305]
+BLOCK 306 HASH 6021569980085899890 CONTROL 2078114244397823785 EQUAL #[306]
+BLOCK 307 HASH 13362446263138031960 CONTROL 15980171678204417448 EQUAL #[307]
+BLOCK 308 HASH 11828915085031845700 CONTROL 12085007552390234184 EQUAL #[308]
+BLOCK 309 HASH 9572299576371803449 CONTROL 9584311880370436259 EQUAL #[309]
+BLOCK 310 HASH 7032639628468476577 CONTROL 4355079370103907660 EQUAL #[310]
+BLOCK 311 HASH 10375434173908757476 CONTROL 596485669595795621 EQUAL #[311]
+BLOCK 312 HASH 5429498755990243399 CONTROL 4838876700937453365 EQUAL #[312]
+BLOCK 313 HASH 17347111138569683660 CONTROL 6891737007990255529 EQUAL #[313, 314]
+BLOCK 314 HASH 17347111138569683660 CONTROL 6891737007990255529 EQUAL #[313, 314]
+BLOCK 315 HASH 12793518802252659619 CONTROL 6891737007990255529 EQUAL #[315]
+BLOCK 316 HASH 17396942995469564620 CONTROL 10111039913815581524 EQUAL #[316]
+BLOCK 317 HASH 7395771211528490766 CONTROL 4923741496511561015 EQUAL #[317]
+BLOCK 318 HASH 11958775702934124315 CONTROL 10111039913815581524 EQUAL #[318]
+BLOCK 319 HASH 12558764532647427787 CONTROL 10111039913815581524 EQUAL #[319]
+BLOCK 320 HASH 3303962430515397446 CONTROL 10111039913815581524 EQUAL #[320]
+BLOCK 321 HASH 14497296920499756023 CONTROL 10111039913815581524 EQUAL #[321]
+BLOCK 322 HASH 9293355396482176270 CONTROL 10111039913815581524 EQUAL #[322]
+BLOCK 323 HASH 17020255087388553673 CONTROL 10111039913815581524 EQUAL #[323]
+BLOCK 324 HASH 18022541800919561563 CONTROL 10111039913815581524 EQUAL #[324]
+BLOCK 325 HASH 5329262065989236996 CONTROL 10111039913815581524 EQUAL #[325]
+BLOCK 326 HASH 8103858485944049393 CONTROL 10111039913815581524 EQUAL #[326]
+BLOCK 327 HASH 14955793653111087838 CONTROL 10111039913815581524 EQUAL #[327]
+BLOCK 328 HASH 13265825227251964457 CONTROL 10111039913815581524 EQUAL #[328]
+BLOCK 329 HASH 13797303288319867553 CONTROL 10111039913815581524 EQUAL #[329]
+BLOCK 330 HASH 13526190796425931218 CONTROL 10111039913815581524 EQUAL #[330]
+BLOCK 331 HASH 17653705181118661873 CONTROL 10111039913815581524 EQUAL #[331]
+BLOCK 332 HASH 9888594606432366249 CONTROL 10111039913815581524 EQUAL #[332]
+BLOCK 333 HASH 16061937400486026778 CONTROL 10111039913815581524 EQUAL #[333]
+BLOCK 334 HASH 1339991747367352032 CONTROL 10111039913815581524 EQUAL #[334]
+BLOCK 335 HASH 4106839568144158271 CONTROL 10111039913815581524 EQUAL #[335]
+BLOCK 336 HASH 624488278046428057 CONTROL 10111039913815581524 EQUAL #[336]
+BLOCK 337 HASH 4791780238874226976 CONTROL 10111039913815581524 EQUAL #[337]
+BLOCK 338 HASH 2549204908341292891 CONTROL 10111039913815581524 EQUAL #[338]
+BLOCK 339 HASH 17393202699407333126 CONTROL 10111039913815581524 EQUAL #[339]
+BLOCK 340 HASH 16729521677551450223 CONTROL 10111039913815581524 EQUAL #[340]
+BLOCK 341 HASH 14046795466796139769 CONTROL 10111039913815581524 EQUAL #[341]
+BLOCK 342 HASH 17244808746743603066 CONTROL 10111039913815581524 EQUAL #[342]
+BLOCK 343 HASH 357131586064755288 CONTROL 10111039913815581524 EQUAL #[343]
+BLOCK 344 HASH 9825633885977324157 CONTROL 10111039913815581524 EQUAL #[344]
+BLOCK 345 HASH 6093831873016308859 CONTROL 10111039913815581524 EQUAL #[345]
+BLOCK 346 HASH 3334986794196549607 CONTROL 10111039913815581524 EQUAL #[346]
+BLOCK 347 HASH 12990557889253082435 CONTROL 10111039913815581524 EQUAL #[347]
+BLOCK 348 HASH 15707689599940537801 CONTROL 10111039913815581524 EQUAL #[348]
+BLOCK 349 HASH 8483639990306509221 CONTROL 10111039913815581524 EQUAL #[349]
+BLOCK 350 HASH 12316535972453623549 CONTROL 10111039913815581524 EQUAL #[350]
+BLOCK 351 HASH 2119475818599562037 CONTROL 10111039913815581524 EQUAL #[351]
+BLOCK 352 HASH 12460275699257548894 CONTROL 10111039913815581524 EQUAL #[352]
+BLOCK 353 HASH 17723859533048463367 CONTROL 10111039913815581524 EQUAL #[353]
+BLOCK 354 HASH 5642427221652085281 CONTROL 10111039913815581524 EQUAL #[354]
+BLOCK 355 HASH 3077243899097199008 CONTROL 10111039913815581524 EQUAL #[355]
+BLOCK 356 HASH 13280011609265517776 CONTROL 15500831552078857548 EQUAL #[356]
+BLOCK 357 HASH 7905944290590112291 CONTROL 6275641937893928157 EQUAL #[357]
+BLOCK 358 HASH 4131924236762677050 CONTROL 12884018430940676164 EQUAL #[358]
+BLOCK 359 HASH 6916397007785288159 CONTROL 8576487449635554020 EQUAL #[359]
+BLOCK 360 HASH 15210863163515614870 CONTROL 969811232201239729 EQUAL #[360]
+BLOCK 361 HASH 15195684589045868964 CONTROL 4905959146870202528 EQUAL #[361]
+BLOCK 362 HASH 1503938963055340732 CONTROL 1985079156278829681 EQUAL #[362]
+BLOCK 363 HASH 2365151368809476361 CONTROL 2077361599890669393 EQUAL #[363]
+BLOCK 364 HASH 10999260526465423687 CONTROL 6185567526471332579 EQUAL #[364]
+BLOCK 365 HASH 3446508141076101049 CONTROL 5944627260938225042 EQUAL #[365]
+BLOCK 366 HASH 17978585659460548788 CONTROL 5208797646224817875 EQUAL #[366]
+BLOCK 367 HASH 4926882075722585297 CONTROL 9953689383195313651 EQUAL #[367]
+BLOCK 368 HASH 1100093574257362442 CONTROL 5593113768580818747 EQUAL #[368]
+BLOCK 369 HASH 762571127927728934 CONTROL 13135516762971280330 EQUAL #[369]
+BLOCK 370 HASH 4312654927614717844 CONTROL 6798742700128601403 EQUAL #[370]
+BLOCK 371 HASH 5189908211140690792 CONTROL 16172196083033309579 EQUAL #[371]
+BLOCK 372 HASH 1523660456902965926 CONTROL 96537915912427798 EQUAL #[372]
+BLOCK 373 HASH 14809050674462328488 CONTROL 11145844428156386855 EQUAL #[373]
+BLOCK 374 HASH 6289283848394829839 CONTROL 5306547137240675726 EQUAL #[374]
+BLOCK 375 HASH 6248289876444817171 CONTROL 8736063782003645758 EQUAL #[375]
+BLOCK 376 HASH 18044315872383447031 CONTROL 9409322752807515732 EQUAL #[376]
+BLOCK 377 HASH 2384528439596981710 CONTROL 13132565993859078085 EQUAL #[377]
+BLOCK 378 HASH 5984068352564312457 CONTROL 17160255557431003644 EQUAL #[378]
+BLOCK 379 HASH 7370891269108435707 CONTROL 17455658824208243724 EQUAL #[379]
+BLOCK 380 HASH 3864065152202817903 CONTROL 10811805574918315592 EQUAL #[380]
+BLOCK 381 HASH 18423723933967337188 CONTROL 7543598783917654769 EQUAL #[381]
+BLOCK 382 HASH 3987886884471801983 CONTROL 7489975184861568472 EQUAL #[382]
+BLOCK 383 HASH 1146403553216458886 CONTROL 16503978377546628136 EQUAL #[383]
+BLOCK 384 HASH 16241997409853664705 CONTROL 8630172209403223821 EQUAL #[384]
+BLOCK 385 HASH 8042865936385108754 CONTROL 15522664873330487684 EQUAL #[385]
+BLOCK 386 HASH 17526027368373611076 CONTROL 4179870005768539125 EQUAL #[386]
+BLOCK 387 HASH 5058091090490480864 CONTROL 16043815558281953093 EQUAL #[387]
+BLOCK 388 HASH 18200964524490689 CONTROL 7376963370091842527 EQUAL #[388]
+BLOCK 389 HASH 11609471004306675606 CONTROL 5573518497212771958 EQUAL #[389]
+BLOCK 390 HASH 6707570023566297342 CONTROL 14602017055763573303 EQUAL #[390]
+BLOCK 391 HASH 15709873628515650384 CONTROL 16115191450497768871 EQUAL #[391]
+BLOCK 392 HASH 7721969574442238250 CONTROL 8703802100742699184 EQUAL #[392, 393]
+BLOCK 393 HASH 7721969574442238250 CONTROL 8703802100742699184 EQUAL #[392, 393]
+BLOCK 394 HASH 1378429354119706722 CONTROL 8703802100742699184 EQUAL #[394]
diff --git a/Tests/Aiur/dedup-compatibility.txt b/Tests/Aiur/dedup-compatibility.txt
new file mode 100644
index 000000000..92b628aef
--- /dev/null
+++ b/Tests/Aiur/dedup-compatibility.txt
@@ -0,0 +1,1333 @@
+PROGRAM empty FUNCTIONS 0 -> 0
+RENAME #[0, 1, 2]
+MEMORY #[1, 2, 10]
+PROGRAM entry-union FUNCTIONS 3 -> 1
+RENAME #[0, 0, 0, 3, 4, 5]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+PROGRAM different-layouts FUNCTIONS 3 -> 3
+RENAME #[0, 1, 2, 3, 4, 5]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 1, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 9, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM mutual-cycle FUNCTIONS 2 -> 1
+RENAME #[0, 0, 2, 3, 4]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 0 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+PROGRAM invalid-callee FUNCTIONS 2 -> 1
+RENAME #[0, 0, 2, 3, 4]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 999 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+PROGRAM continuations FUNCTIONS 4 -> 2
+RENAME #[0, 0, 1, 1, 4, 5, 6]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.const 7],
+            ctrl := Aiur.Bytecode.Ctrl.matchContinue
+                      0
+                      #[(0, { ops := #[], ctrl := Aiur.Bytecode.Ctrl.yield 0 #[1] })]
+                      (some { ops := #[], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] })
+                      1
+                      3
+                      2
+                      { ops := #[Aiur.Bytecode.Op.call 1 #[2] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[3] } },
+  layout := { inputSize := 1, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 1, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-0 FUNCTIONS 2 -> 2
+RENAME #[0, 1, 2, 3, 4]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-1 FUNCTIONS 4 -> 4
+RENAME #[0, 1, 2, 3, 4, 5, 6]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-2 FUNCTIONS 6 -> 6
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-3 FUNCTIONS 8 -> 8
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-4 FUNCTIONS 10 -> 10
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-5 FUNCTIONS 12 -> 12
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-6 FUNCTIONS 14 -> 14
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-7 FUNCTIONS 16 -> 16
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-8 FUNCTIONS 18 -> 18
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-9 FUNCTIONS 20 -> 20
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-10 FUNCTIONS 22 -> 22
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-11 FUNCTIONS 24 -> 24
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.call 22 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.call 23 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 22 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 23 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-12 FUNCTIONS 26 -> 26
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.call 22 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.call 23 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 22 { body := { ops := #[Aiur.Bytecode.Op.call 24 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 23 { body := { ops := #[Aiur.Bytecode.Op.call 25 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 24 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 25 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-13 FUNCTIONS 28 -> 28
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.call 22 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.call 23 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 22 { body := { ops := #[Aiur.Bytecode.Op.call 24 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 23 { body := { ops := #[Aiur.Bytecode.Op.call 25 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 24 { body := { ops := #[Aiur.Bytecode.Op.call 26 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 25 { body := { ops := #[Aiur.Bytecode.Op.call 27 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 26 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 27 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-14 FUNCTIONS 30 -> 30
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.call 22 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.call 23 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 22 { body := { ops := #[Aiur.Bytecode.Op.call 24 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 23 { body := { ops := #[Aiur.Bytecode.Op.call 25 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 24 { body := { ops := #[Aiur.Bytecode.Op.call 26 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 25 { body := { ops := #[Aiur.Bytecode.Op.call 27 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 26 { body := { ops := #[Aiur.Bytecode.Op.call 28 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 27 { body := { ops := #[Aiur.Bytecode.Op.call 29 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 28 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 29 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-15 FUNCTIONS 32 -> 32
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.call 22 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.call 23 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 22 { body := { ops := #[Aiur.Bytecode.Op.call 24 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 23 { body := { ops := #[Aiur.Bytecode.Op.call 25 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 24 { body := { ops := #[Aiur.Bytecode.Op.call 26 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 25 { body := { ops := #[Aiur.Bytecode.Op.call 27 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 26 { body := { ops := #[Aiur.Bytecode.Op.call 28 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 27 { body := { ops := #[Aiur.Bytecode.Op.call 29 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 28 { body := { ops := #[Aiur.Bytecode.Op.call 30 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 29 { body := { ops := #[Aiur.Bytecode.Op.call 31 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 30 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 31 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+PROGRAM refinement-chain-16 FUNCTIONS 34 -> 34
+RENAME #[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36]
+MEMORY #[1, 2, 10]
+FUNCTION 0 { body := { ops := #[Aiur.Bytecode.Op.call 2 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 1 { body := { ops := #[Aiur.Bytecode.Op.call 3 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := true,
+  constrained := false }
+FUNCTION 2 { body := { ops := #[Aiur.Bytecode.Op.call 4 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 3 { body := { ops := #[Aiur.Bytecode.Op.call 5 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 4 { body := { ops := #[Aiur.Bytecode.Op.call 6 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 5 { body := { ops := #[Aiur.Bytecode.Op.call 7 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 6 { body := { ops := #[Aiur.Bytecode.Op.call 8 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 7 { body := { ops := #[Aiur.Bytecode.Op.call 9 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 8 { body := { ops := #[Aiur.Bytecode.Op.call 10 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 9 { body := { ops := #[Aiur.Bytecode.Op.call 11 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 10 { body := { ops := #[Aiur.Bytecode.Op.call 12 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 11 { body := { ops := #[Aiur.Bytecode.Op.call 13 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 12 { body := { ops := #[Aiur.Bytecode.Op.call 14 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 13 { body := { ops := #[Aiur.Bytecode.Op.call 15 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 14 { body := { ops := #[Aiur.Bytecode.Op.call 16 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 15 { body := { ops := #[Aiur.Bytecode.Op.call 17 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 16 { body := { ops := #[Aiur.Bytecode.Op.call 18 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 17 { body := { ops := #[Aiur.Bytecode.Op.call 19 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 18 { body := { ops := #[Aiur.Bytecode.Op.call 20 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 19 { body := { ops := #[Aiur.Bytecode.Op.call 21 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 20 { body := { ops := #[Aiur.Bytecode.Op.call 22 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 21 { body := { ops := #[Aiur.Bytecode.Op.call 23 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 22 { body := { ops := #[Aiur.Bytecode.Op.call 24 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 23 { body := { ops := #[Aiur.Bytecode.Op.call 25 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 24 { body := { ops := #[Aiur.Bytecode.Op.call 26 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 25 { body := { ops := #[Aiur.Bytecode.Op.call 27 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 26 { body := { ops := #[Aiur.Bytecode.Op.call 28 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 27 { body := { ops := #[Aiur.Bytecode.Op.call 29 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 28 { body := { ops := #[Aiur.Bytecode.Op.call 30 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 29 { body := { ops := #[Aiur.Bytecode.Op.call 31 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 30 { body := { ops := #[Aiur.Bytecode.Op.call 32 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 31 { body := { ops := #[Aiur.Bytecode.Op.call 33 #[] 1 false], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 32 { body := { ops := #[Aiur.Bytecode.Op.const 7], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
+FUNCTION 33 { body := { ops := #[Aiur.Bytecode.Op.const 9], ctrl := Aiur.Bytecode.Ctrl.return 0 #[0] },
+  layout := { inputSize := 0, selectors := 2, auxiliaries := 8, lookups := 5 },
+  entry := false,
+  constrained := false }
diff --git a/Tests/Aiur/source-value-compatibility.txt b/Tests/Aiur/source-value-compatibility.txt
new file mode 100644
index 000000000..a7fec6baa
--- /dev/null
+++ b/Tests/Aiur/source-value-compatibility.txt
@@ -0,0 +1,100 @@
+SOURCE VALUE HASH FIXTURES 99
+VALUE 0 HASH 0
+VALUE 1 HASH 8749354384435707241
+VALUE 2 HASH 12882348691112465364
+VALUE 3 HASH 2377845632408581361
+VALUE 4 HASH 11632597162316755711
+VALUE 5 HASH 5530045286768123853
+VALUE 6 HASH 7999773623304365860
+VALUE 7 HASH 3720670971919179042
+VALUE 8 HASH 3720670971919179042
+VALUE 9 HASH 3720670971919179042
+VALUE 10 HASH 15320573189724115100
+VALUE 11 HASH 11187578883047356977
+VALUE 12 HASH 425165588333083028
+VALUE 13 HASH 15849745100916035534
+VALUE 14 HASH 458840319313485945
+VALUE 15 HASH 4591834625990244068
+VALUE 16 HASH 3904241366544532200
+VALUE 17 HASH 2372720083837327878
+VALUE 18 HASH 13396906709469468990
+VALUE 19 HASH 8630906389795451290
+VALUE 20 HASH 3549314381222846376
+VALUE 21 HASH 17863064148255639869
+VALUE 22 HASH 16889408581382503904
+VALUE 23 HASH 1362967498803569690
+VALUE 24 HASH 14155676960900291531
+VALUE 25 HASH 18288671267577049654
+VALUE 26 HASH 16813174585923137922
+VALUE 27 HASH 4522384026810106468
+VALUE 28 HASH 1159157090964788868
+VALUE 29 HASH 8242814138854491714
+VALUE 30 HASH 5206700930677556320
+VALUE 31 HASH 1073706624000798197
+VALUE 32 HASH 10031353126198601256
+VALUE 33 HASH 1057982919846479074
+VALUE 34 HASH 17831831747438059647
+VALUE 35 HASH 3518081980405266154
+VALUE 36 HASH 16936691439974984567
+VALUE 37 HASH 17497591706831603213
+VALUE 38 HASH 11728232621475673721
+VALUE 39 HASH 14617821723611521678
+VALUE 40 HASH 3390044753914760435
+VALUE 41 HASH 7523039060591518558
+VALUE 42 HASH 11978281817061994171
+VALUE 43 HASH 15448649667467085601
+VALUE 44 HASH 17726834112050484513
+VALUE 45 HASH 3413084345017691020
+VALUE 46 HASH 8486376434432214938
+VALUE 47 HASH 6539708471159116732
+VALUE 48 HASH 13577379645960254956
+VALUE 49 HASH 9535173859574451250
+VALUE 50 HASH 3340619801374861623
+VALUE 51 HASH 7473614108051619746
+VALUE 52 HASH 4438482188659876207
+VALUE 53 HASH 308585577653266613
+VALUE 54 HASH 1575809756895362131
+VALUE 55 HASH 5708804063572120254
+VALUE 56 HASH 5877511752852517224
+VALUE 57 HASH 8037021573386070406
+VALUE 58 HASH 14668200699750263486
+VALUE 59 HASH 10055143394274591386
+VALUE 60 HASH 15854127891854726589
+VALUE 61 HASH 1540378124821933096
+VALUE 62 HASH 10160078024048964597
+VALUE 63 HASH 5647184145953969711
+VALUE 64 HASH 1670291516117959835
+VALUE 65 HASH 5803285822794717958
+VALUE 66 HASH 16947754315310826609
+VALUE 67 HASH 3811587103178222492
+VALUE 68 HASH 3586205689759573117
+VALUE 69 HASH 13857231994817767843
+VALUE 70 HASH 6449109682227641737
+VALUE 71 HASH 456604136828682370
+VALUE 72 HASH 10282900939567356395
+VALUE 73 HASH 12598141728558465643
+VALUE 74 HASH 18305444248414093273
+VALUE 75 HASH 6521790106739756299
+VALUE 76 HASH 11782062519623288512
+VALUE 77 HASH 7957016415365316137
+VALUE 78 HASH 1613491961129078381
+VALUE 79 HASH 14344968043142879526
+VALUE 80 HASH 3369383947544867319
+VALUE 81 HASH 511930786863132171
+VALUE 82 HASH 2998475890800806647
+VALUE 83 HASH 3183140925414804714
+VALUE 84 HASH 13040122459803691049
+VALUE 85 HASH 3165285364197100220
+VALUE 86 HASH 8868022099410756417
+VALUE 87 HASH 8038379054726876786
+VALUE 88 HASH 15903808653746511106
+VALUE 89 HASH 11524449674585483172
+VALUE 90 HASH 15385025462028698787
+VALUE 91 HASH 7885845618262242016
+VALUE 92 HASH 11534418552294313664
+VALUE 93 HASH 14697586262333512277
+VALUE 94 HASH 18421564212326130901
+VALUE 95 HASH 16458453681622390642
+VALUE 96 HASH 4664628051155748896
+VALUE 97 HASH 3714145596340391514
+VALUE 98 HASH 16235546750463173208
diff --git a/Tests/Aiur/tail-match-compatibility.txt b/Tests/Aiur/tail-match-compatibility.txt
new file mode 100644
index 000000000..22f4af00b
--- /dev/null
+++ b/Tests/Aiur/tail-match-compatibility.txt
@@ -0,0 +1,282 @@
+TAIL MATCH FIXTURES 281
+TERM 0 Aiur.Source.Term.unit
+TERM 1 Aiur.Source.Term.unit
+TERM 2 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.unit) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 3 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.unit)
+TERM 4 Aiur.Source.Term.var (Aiur.Local.str "x")
+TERM 5 Aiur.Source.Term.var (Aiur.Local.str "x")
+TERM 6 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.var (Aiur.Local.str "x")) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 7 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "x"))
+TERM 8 Aiur.Source.Term.ref { toName := `fixture }
+TERM 9 Aiur.Source.Term.ref { toName := `fixture }
+TERM 10 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ref { toName := `fixture }) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 11 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ref { toName := `fixture })
+TERM 12 Aiur.Source.Term.field 7
+TERM 13 Aiur.Source.Term.field 7
+TERM 14 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 15 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 16 Aiur.Source.Term.tuple #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))]
+TERM 17 Aiur.Source.Term.tuple #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))]
+TERM 18 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.tuple #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))]) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 19 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.tuple #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))])
+TERM 20 Aiur.Source.Term.array #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))]
+TERM 21 Aiur.Source.Term.array #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))]
+TERM 22 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.array #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))]) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 23 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.array #[Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))])
+TERM 24 Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 25 Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 26 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 27 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 28 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 29 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 30 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 31 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7))
+TERM 32 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.wildcard, Aiur.Source.Term.field 7)]
+TERM 33 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.wildcard, Aiur.Source.Term.field 7)]
+TERM 34 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.wildcard, Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))]) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 35 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.wildcard, Aiur.Source.Term.field 7)])
+TERM 36 Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.normal)
+TERM 37 Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.normal)
+TERM 38 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.normal)) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 39 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.normal))
+TERM 40 Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.unconstrained)
+TERM 41 Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.unconstrained)
+TERM 42 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.unconstrained)) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 43 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.unconstrained))
+TERM 44 Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.inlined)
+TERM 45 Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.inlined)
+TERM 46 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.inlined)) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 47 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.app { toName := `fixture } [Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))] (Aiur.Source.CallMode.inlined))
+TERM 48 Aiur.Source.Term.add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 49 Aiur.Source.Term.add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 50 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 51 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 52 Aiur.Source.Term.sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 53 Aiur.Source.Term.sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 54 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 55 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 56 Aiur.Source.Term.mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 57 Aiur.Source.Term.mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 58 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 59 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 60 Aiur.Source.Term.eqZero (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 61 Aiur.Source.Term.eqZero (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 62 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.eqZero (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 63 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.eqZero (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 64 Aiur.Source.Term.proj (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0
+TERM 65 Aiur.Source.Term.proj (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0
+TERM 66 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.proj (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 67 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.proj (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0)
+TERM 68 Aiur.Source.Term.get (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0
+TERM 69 Aiur.Source.Term.get (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0
+TERM 70 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.get (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 71 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.get (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0)
+TERM 72 Aiur.Source.Term.slice (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 1
+TERM 73 Aiur.Source.Term.slice (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 1
+TERM 74 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.slice (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 1) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 75 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.slice (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 1)
+TERM 76 Aiur.Source.Term.set (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 77 Aiur.Source.Term.set (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 78 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.set (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 79 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.set (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 0 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 80 Aiur.Source.Term.store (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 81 Aiur.Source.Term.store (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 82 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.store (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 83 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.store (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 84 Aiur.Source.Term.load (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 85 Aiur.Source.Term.load (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 86 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.load (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 87 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.load (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 88 Aiur.Source.Term.ptrVal (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 89 Aiur.Source.Term.ptrVal (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 90 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ptrVal (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 91 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ptrVal (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 92 Aiur.Source.Term.ann (Aiur.Typ.field) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 93 Aiur.Source.Term.ann (Aiur.Typ.field) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 94 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ann (Aiur.Typ.field) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 95 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ann (Aiur.Typ.field) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 96 Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 97 Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 98 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 99 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 100 Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (some "check") (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 101 Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (some "check") (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 102 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (some "check") (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 103 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.assertEq (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (some "check") (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 104 Aiur.Source.Term.ioGetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 105 Aiur.Source.Term.ioGetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 106 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ioGetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 107 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ioGetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 108 Aiur.Source.Term.ioSetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 109 Aiur.Source.Term.ioSetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 110 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ioSetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 111 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ioSetInfo (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 112 Aiur.Source.Term.ioRead (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 1
+TERM 113 Aiur.Source.Term.ioRead (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 1
+TERM 114 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ioRead (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 1) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 115 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ioRead (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) 1)
+TERM 116 Aiur.Source.Term.ioWrite (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 117 Aiur.Source.Term.ioWrite (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 118 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.ioWrite (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 119 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.ioWrite (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 120 Aiur.Source.Term.u8BitDecomposition (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 121 Aiur.Source.Term.u8BitDecomposition (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 122 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8BitDecomposition (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 123 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8BitDecomposition (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 124 Aiur.Source.Term.u8ShiftLeft (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 125 Aiur.Source.Term.u8ShiftLeft (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 126 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8ShiftLeft (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 127 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8ShiftLeft (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 128 Aiur.Source.Term.u8ShiftRight (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 129 Aiur.Source.Term.u8ShiftRight (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 130 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8ShiftRight (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 131 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8ShiftRight (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 132 Aiur.Source.Term.u8Xor (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 133 Aiur.Source.Term.u8Xor (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 134 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8Xor (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 135 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8Xor (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 136 Aiur.Source.Term.u8Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 137 Aiur.Source.Term.u8Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 138 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 139 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 140 Aiur.Source.Term.u8Mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 141 Aiur.Source.Term.u8Mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 142 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8Mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 143 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8Mul (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 144 Aiur.Source.Term.u8Sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 145 Aiur.Source.Term.u8Sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 146 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8Sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 147 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8Sub (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 148 Aiur.Source.Term.u8And (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 149 Aiur.Source.Term.u8And (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 150 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8And (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 151 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8And (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 152 Aiur.Source.Term.u8Or (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 153 Aiur.Source.Term.u8Or (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 154 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8Or (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 155 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8Or (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 156 Aiur.Source.Term.u8LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 157 Aiur.Source.Term.u8LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 158 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 159 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 160 Aiur.Source.Term.u32LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 161 Aiur.Source.Term.u32LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 162 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u32LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 163 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u32LessThan (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 164 Aiur.Source.Term.u8XorSplit7 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 165 Aiur.Source.Term.u8XorSplit7 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 166 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8XorSplit7 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 167 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8XorSplit7 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 168 Aiur.Source.Term.u8XorSplit4 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 169 Aiur.Source.Term.u8XorSplit4 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 170 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8XorSplit4 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 171 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8XorSplit4 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 172 Aiur.Source.Term.unconstrainedU32Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 173 Aiur.Source.Term.unconstrainedU32Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 174 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.unconstrainedU32Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 175 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.unconstrainedU32Add (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 176 Aiur.Source.Term.unconstrainedU32Add3 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 177 Aiur.Source.Term.unconstrainedU32Add3 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 178 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.unconstrainedU32Add3 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 179 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.unconstrainedU32Add3 (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 180 Aiur.Source.Term.u32ToField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 181 Aiur.Source.Term.u32ToField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 182 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u32ToField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 183 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u32ToField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 184 Aiur.Source.Term.unconstrainedBigUintDivMod (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 185 Aiur.Source.Term.unconstrainedBigUintDivMod (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 186 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.unconstrainedBigUintDivMod (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 187 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.unconstrainedBigUintDivMod (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 188 Aiur.Source.Term.unconstrainedGToBytes (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 189 Aiur.Source.Term.unconstrainedGToBytes (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 190 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.unconstrainedGToBytes (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 191 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.unconstrainedGToBytes (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 192 Aiur.Source.Term.unconstrainedGInverse (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 193 Aiur.Source.Term.unconstrainedGInverse (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 194 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.unconstrainedGInverse (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 195 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.unconstrainedGInverse (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 196 Aiur.Source.Term.u8Lit 255
+TERM 197 Aiur.Source.Term.u8Lit 255
+TERM 198 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8Lit 255) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 199 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8Lit 255)
+TERM 200 Aiur.Source.Term.u8RangeCheck (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 201 Aiur.Source.Term.u8RangeCheck (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 202 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8RangeCheck (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 203 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8RangeCheck (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 204 Aiur.Source.Term.toField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 205 Aiur.Source.Term.toField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 206 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.toField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 207 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.toField (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 208 Aiur.Source.Term.u8FromFieldUnsafe (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 209 Aiur.Source.Term.u8FromFieldUnsafe (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 210 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.u8FromFieldUnsafe (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 211 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.u8FromFieldUnsafe (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 212 Aiur.Source.Term.debug "message" none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 213 Aiur.Source.Term.debug "message" none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 214 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.debug "message" none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 215 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.debug "message" none (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 216 Aiur.Source.Term.debug "message" (some (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 217 Aiur.Source.Term.debug "message" (some (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))
+TERM 218 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.debug "message" (some (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.var (Aiur.Local.str "y"))
+TERM 219 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.debug "message" (some (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x")))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))
+TERM 220 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 221 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.var (Aiur.Local.str "x"), Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 222 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 0)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 223 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.var (Aiur.Local.idx 0), Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 224 Aiur.Source.Term.let (Aiur.Pattern.wildcard) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 225 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.wildcard, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 226 Aiur.Source.Term.let (Aiur.Pattern.ref { toName := `Ctor } [Aiur.Pattern.var (Aiur.Local.str "x")]) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 227 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.ref { toName := `Ctor } [Aiur.Pattern.var (Aiur.Local.str "x")], Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 228 Aiur.Source.Term.let (Aiur.Pattern.field 7) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 229 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 230 Aiur.Source.Term.let (Aiur.Pattern.tuple #[Aiur.Pattern.var (Aiur.Local.str "x")]) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 231 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.tuple #[Aiur.Pattern.var (Aiur.Local.str "x")], Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 232 Aiur.Source.Term.let (Aiur.Pattern.array #[Aiur.Pattern.wildcard]) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 233 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.array #[Aiur.Pattern.wildcard], Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 234 Aiur.Source.Term.let (Aiur.Pattern.or (Aiur.Pattern.field 7) (Aiur.Pattern.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 235 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.or (Aiur.Pattern.field 7) (Aiur.Pattern.var (Aiur.Local.str "x")), Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 236 Aiur.Source.Term.let (Aiur.Pattern.pointer (Aiur.Pattern.var (Aiur.Local.str "x"))) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.field 7)
+TERM 237 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.pointer (Aiur.Pattern.var (Aiur.Local.str "x")), Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 238 Aiur.Source.Term.field 7
+TERM 239 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "0"))
+TERM 240 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.idx 0))
+TERM 241 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.idx 1))
+TERM 242 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "0")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "x"))
+TERM 243 Aiur.Source.Term.field 7
+TERM 244 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "0")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.idx 0))
+TERM 245 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "0")) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.idx 1))
+TERM 246 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 0)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "x"))
+TERM 247 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 0)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "0"))
+TERM 248 Aiur.Source.Term.field 7
+TERM 249 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 0)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.idx 1))
+TERM 250 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 1)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "x"))
+TERM 251 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 1)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.str "0"))
+TERM 252 Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.idx 1)) (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) (Aiur.Source.Term.var (Aiur.Local.idx 0))
+TERM 253 Aiur.Source.Term.field 7
+TERM 254 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) []
+TERM 255 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 9, Aiur.Source.Term.field 7)]
+TERM 256 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 257 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 258 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 259 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 260 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 261 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 262 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 263 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 264 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 265 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 266 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 267 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 268 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 269 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 270 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 271 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 272 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 273 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 274 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 275 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 276 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 277 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 278 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 279 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
+TERM 280 Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.match (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))) [(Aiur.Pattern.field 7, Aiur.Source.Term.field 7), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]), (Aiur.Pattern.wildcard, Aiur.Source.Term.ret (Aiur.Source.Term.let (Aiur.Pattern.var (Aiur.Local.str "x")) (Aiur.Source.Term.field 7) (Aiur.Source.Term.var (Aiur.Local.str "x"))))]
diff --git a/Tests/Certified/CLI.lean b/Tests/Certified/CLI.lean
new file mode 100644
index 000000000..85345a1f8
--- /dev/null
+++ b/Tests/Certified/CLI.lean
@@ -0,0 +1,264 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean
+
+/-! Native command regressions ported from the frozen C5–C7 CLI drivers.
+JSON is retained for the existing command protocol and differential evidence. -/
+
+open Lean System
+
+namespace Tests.Certified.CLI
+
+private def readJson (path : FilePath) : IO Json := do
+  IO.ofExcept (Json.parse (← IO.FS.readFile path))
+
+private def writeJson (path : FilePath) (value : Json) : IO Unit :=
+  IO.FS.writeFile path (value.pretty ++ "\n")
+
+private def field (value : Json) (key : String) : Json := value.getObjValD key
+private def array (value : Json) : Array Json := value.getArr?.toOption.get!
+private def string (value : Json) : String := value.getStr?.toOption.get!
+private def set := Json.setObjVal!
+
+private def directories (path : FilePath) : IO (Array FilePath) := do
+  let entries ← path.readDir
+  let mut result := #[]
+  for entry in entries do
+    if ← entry.path.isDir then result := result.push entry.path
+  return result.qsort (fun a b => a.toString < b.toString)
+
+private def name (path : FilePath) : String := path.fileName.get!
+private def truncate (bytes : ByteArray) := bytes.extract 0 (bytes.size / 2)
+private def corrupt (bytes : ByteArray) := bytes.set! 0 (bytes[0]! ^^^ 255)
+private def zeros : Json := .str (String.ofList (List.replicate 64 '0'))
+
+private def check (executable : String) (directory : FilePath) (source : ByteArray)
+    (request : Json) (expected : Bool) (mode : Option String := none)
+    (envelope : ByteArray := ByteArray.empty) : IO Json := do
+  IO.FS.createDirAll directory
+  let sourcePath := directory / "source.ixe"
+  let requestPath := directory / "request.json"
+  IO.FS.writeBinFile sourcePath source
+  writeJson requestPath request
+  let (args, success) ← match mode with
+    | some mode => pure (#[mode, sourcePath.toString, requestPath.toString],
+        Json.mkObj [("accepted", .bool true), ("mode", .str mode)])
+    | none => do
+      let envelopePath := directory / "envelope.bin"
+      IO.FS.writeBinFile envelopePath envelope
+      pure (#[sourcePath.toString, envelopePath.toString, requestPath.toString],
+        Json.mkObj [("accepted", .bool true), ("address", field request "address")])
+  let result ← IO.Process.output { cmd := "timeout", args := #["60", executable] ++ args }
+  IO.FS.writeFile (directory / "stdout.txt") result.stdout
+  IO.FS.writeFile (directory / "stderr.txt") result.stderr
+  unless result.exitCode == 0 || result.exitCode == 1 do
+    throw (IO.userError s!"abnormal exit {directory}: {result.exitCode}\n{result.stderr}")
+  let accepted := result.exitCode == 0
+  unless accepted == expected do
+    throw (IO.userError s!"unexpected acceptance {directory}: {accepted}\n{result.stderr}")
+  if accepted then
+    unless (← IO.ofExcept (Json.parse result.stdout)) == success do
+      throw (IO.userError s!"incorrect success output {directory}: {result.stdout}")
+  else unless result.stdout.trimAscii.isEmpty do
+    throw (IO.userError s!"rejected command printed a success result {directory}: {result.stdout}")
+  return Json.mkObj [("accepted", .bool accepted), ("exitCode", toJson result.exitCode.toNat)]
+
+private def acceptedCount (records : Array Json) : Nat :=
+  (records.filter (fun record => field record "accepted" == .bool true)).size
+
+private def finish (output : FilePath) (records : Array Json) (fields : List (String × Json)) : IO Unit := do
+  writeJson (output / "results.json") (.arr records)
+  let report := Json.mkObj (fields ++ [
+    ("rejected", toJson (records.size - acceptedCount records)), ("unexpectedErrors", toJson (0 : Nat))])
+  writeJson (output / "summary.json") report
+  IO.println report.compress
+
+private def sourceTests (executable : String) (inputs output : FilePath) : IO Unit := do
+  let cases ← directories inputs
+  unless cases.size == 42 do throw (IO.userError "expected the 42-case C5 corpus")
+  let mut records := #[]
+  for directory in cases do
+    let bytes ← IO.FS.readBinFile (directory / "source.ixe")
+    let request ← readJson (directory / "request.json")
+    let objects := array (field request "objects")
+    let mut variants := #[
+      ("valid", bytes, request, true),
+      ("missing-target", bytes, set request "objects" (.arr (objects.filter (· != field request "target"))), false),
+      ("duplicate-object", bytes, set request "objects" (.arr (objects.push objects[0]!)), false),
+      ("wrong-false-pin", bytes, set request "falseType" (field request "target"), false),
+      ("malformed-address", bytes, set request "falseElim" (.str "01"), false),
+      ("truncated-source", truncate bytes, request, false),
+      ("invalid-header", corrupt bytes, request, false)]
+    if field request "natType" != .null then
+      variants := variants.push ("missing-nat-pin", bytes, set request "natType" .null, false)
+    for (scenario, source, requested, expected) in variants do
+      for mode in #["proof", "store"] do
+        let record ← check executable (output / name directory / scenario / mode)
+          source requested expected (some mode)
+        records := records.push (set (set (set record "case" (.str (name directory)))
+          "scenario" (.str scenario)) "mode" (.str mode))
+    let record ← check executable (output / name directory / "unsupported-mode" / "infer-only")
+      bytes request false (some "infer-only")
+    records := records.push (set (set (set record "case" (.str (name directory)))
+      "scenario" (.str "unsupported-mode")) "mode" (.str "infer-only"))
+  unless acceptedCount records == 84 do throw (IO.userError "missing source success coverage")
+  finish output records [("cases", toJson cases.size), ("proofAccepted", toJson (42 : Nat)),
+    ("storesAccepted", toJson (42 : Nat))]
+
+private def claimTests (executable : String) (inputs output : FilePath) : IO Unit := do
+  let cases ← directories inputs
+  let required := #["cycle-A-assuming-B", "cycle-B-assuming-A", "cycle-closed-AB", "cycle-closed-BA",
+    "cycle-own-assumption", "contains-padding", "contains-as-logical"]
+  unless cases.size ≥ 1500 && required.all (fun x => (cases.map name).contains x) do
+    throw (IO.userError "expected complete claim, cycle, catalog and structural coverage")
+  let mut records := #[]
+  for directory in cases do
+    let source ← IO.FS.readBinFile (directory / "source.ixe")
+    let envelope ← IO.FS.readBinFile (directory / "envelope.bin")
+    let request ← readJson (directory / "request.json")
+    let expected := field (← readJson (directory / "expected.json")) "accepted" == .bool true
+    let record ← check executable (output / name directory / "original") source request expected none envelope
+    records := records.push (set (set (set record "case" (.str (name directory)))
+      "scenario" (.str "original")) "kind" (field request "kind"))
+    unless expected do continue
+    let mut variants := #[
+      ("wrong-digest", source, envelope, set request "address" zeros),
+      ("short-address", source, envelope, set request "address" (.str "01")),
+      ("unsupported-kind", source, envelope, set request "kind" (.str "infer-only")),
+      ("changed-envelope", source, corrupt envelope, request),
+      ("trailing-envelope", source, envelope.push 0, request),
+      ("truncated-envelope", source, truncate envelope, request),
+      ("truncated-source", truncate source, envelope, request)]
+    if field request "kind" == .str "logical" then
+      let objects := array (field request "objects")
+      variants := variants.push ("duplicate-object", source, envelope,
+        set request "objects" (.arr (objects.push objects[0]!)))
+      variants := variants.push ("missing-leaves", source, envelope, set request "leaves" (.arr #[]))
+      if field request "axioms" != .null then
+        variants := variants.push ("omitted-logical-axioms", source, envelope, set request "axioms" .null)
+      for key in #["subjects", "members", "frontier", "axioms"] do
+        if field request key != .null then
+          variants := variants.push (s!"trailing-{key}", source, envelope,
+            set request key (.str (string (field request key) ++ "00")))
+      let leaves := array (field request "leaves")
+      let leaf := leaves[0]!
+      variants := variants.push ("trailing-leaf-claim", source, envelope,
+        set request "leaves" (.arr (leaves.set! 0
+          (set leaf "claim" (.str (string (field leaf "claim") ++ "00"))))))
+    for (scenario, changedSource, changedEnvelope, changedRequest) in variants do
+      let record ← check executable (output / name directory / scenario)
+        changedSource changedRequest false none changedEnvelope
+      records := records.push (set (set (set record "case" (.str (name directory)))
+        "scenario" (.str scenario)) "kind" (field changedRequest "kind"))
+  unless acceptedCount records ≥ 500 do throw (IO.userError "missing claim nonvacuity coverage")
+  finish output records [("cases", toJson cases.size), ("accepted", toJson (acceptedCount records))]
+
+private def modelVariants (request : Json) : Array (String × Json) := Id.run do
+  let models := array (field request "models")
+  let model := models[0]!
+  let recursors := array (field model "recursors")
+  let targets := array (field model "targets")
+  let withoutModels := match request with
+    | .obj fields => Json.obj (fields.erase "models")
+    | _ => request
+  let mut variants := #[("missing-models", withoutModels),
+    ("malformed-models", set request "models" (.bool true))]
+  let edits := #[
+    ("unknown-model-source", "source", zeros), ("short-model-address", "source", .str "01"),
+    ("recursor-order", "recursors", .arr recursors.reverse),
+    ("target-order", "targets", .arr targets.reverse),
+    ("missing-target", "targets", .arr targets.pop),
+    ("circular-target", "targets", .arr (targets.set! (targets.size - 1) recursors.back!)),
+    ("unknown-target", "targets", .arr (targets.set! (targets.size - 1) zeros)),
+    ("unknown-recursor", "recursors", .arr (recursors.set! (recursors.size - 1) zeros)),
+    ("missing-recursor", "recursors", .arr (recursors.extract 1 recursors.size))]
+  for (scenario, key, value) in edits do
+    variants := variants.push (scenario, set request "models" (.arr (models.set! 0 (set model key value))))
+  let rulesArray := array (field model "proofs")
+  unless rulesArray.isEmpty do
+    let rules := rulesArray[0]!
+    let proofs := array (field rules "proofs")
+    for scenario in #["wrong-equation-owner", "wrong-equation-proof", "wrong-equality-family",
+        "wrong-reflexivity", "wrong-equality-eliminator", "malformed-proof-list"] do
+      let changed := if scenario == "wrong-equation-owner" then set rules "owner" recursors.back!
+        else if scenario == "malformed-proof-list" then set rules "proofs" (.bool true)
+        else Id.run do
+          let index := proofs.findIdx? (· != .null) |>.get!
+          let key := if scenario == "wrong-equation-proof" then "proof"
+            else if scenario == "wrong-equality-family" then "equality"
+            else if scenario == "wrong-reflexivity" then "reflexivity" else "eliminator"
+          return set rules "proofs" (.arr (proofs.set! index (set proofs[index]! key targets[0]!)))
+      let changedModel := set model "proofs" (.arr (rulesArray.set! 0 changed))
+      variants := variants.push (scenario, set request "models" (.arr (models.set! 0 changedModel)))
+  return variants
+
+private def positives := #["mutual-unequal", "mutual-permuted", "auxiliary-merged", "nested-parameter",
+  "nested-recursive-Pi", "propositional-equations"]
+
+private def modeledTests (sourceExe claimExe : String) (inputs output : FilePath) : IO Unit := do
+  let sourceCases ← directories (inputs / "source")
+  let claimCases ← directories (inputs / "claims")
+  let mut records := #[]
+  let mut acceptedSources := #[]
+  for directory in sourceCases do
+    let source ← IO.FS.readBinFile (directory / "source.ixe")
+    let request ← readJson (directory / "request.json")
+    let expected ← readJson (directory / "expected.json")
+    if field expected "proof" == .bool true && field expected "store" == .bool true then
+      acceptedSources := acceptedSources.push (name directory)
+    for mode in #["proof", "store"] do
+      let accept := field expected mode == .bool true
+      let mut variants := #[("original", source, request, accept)]
+      if accept then
+        variants := variants ++ (modelVariants request).map (fun (scenario, changed) =>
+          (scenario, source, changed, false))
+        variants := variants.push ("truncated-source", truncate source, request, false)
+      for (scenario, changedSource, changedRequest, accept) in variants do
+        let record ← check sourceExe (output / "source" / name directory / scenario / mode)
+          changedSource changedRequest accept (some mode)
+        records := records.push (set (set (set (set record "kind" (.str "source"))
+          "case" (.str (name directory))) "scenario" (.str scenario)) "mode" (.str mode))
+  unless sourceCases.size == 44 && acceptedSources.qsort (· < ·) == positives.qsort (· < ·) do
+    throw (IO.userError "missing complete modeled source controls")
+  let mut acceptedClaims := #[]
+  for directory in claimCases do
+    let source ← IO.FS.readBinFile (directory / "source.ixe")
+    let envelope ← IO.FS.readBinFile (directory / "envelope.bin")
+    let request ← readJson (directory / "request.json")
+    let expected := field (← readJson (directory / "expected.json")) "accepted" == .bool true
+    let mut variants := #[("original", envelope, request, expected)]
+    if expected then
+      acceptedClaims := acceptedClaims.push (name directory)
+      variants := variants ++ (modelVariants request).map (fun (scenario, changed) =>
+        (scenario, envelope, changed, false))
+      variants := variants.push ("changed-public-bytes", corrupt envelope, request, false)
+      variants := variants.push ("trailing-public-bytes", envelope.push 0, request, false)
+    for (scenario, changedEnvelope, changedRequest, accept) in variants do
+      let record ← check claimExe (output / "claims" / name directory / scenario / "claim")
+        source changedRequest accept none changedEnvelope
+      records := records.push (set (set (set (set record "kind" (.str "claims"))
+        "case" (.str (name directory))) "scenario" (.str scenario)) "mode" .null)
+  let requiredClaims := positives.flatMap (fun caseName =>
+    #["check", "environment", "shared-model"].map (fun kind => s!"{caseName}-{kind}"))
+  unless claimCases.size == 74 && acceptedClaims.qsort (· < ·) == requiredClaims.qsort (· < ·) do
+    throw (IO.userError "missing complete modeled claim controls")
+  finish output records [("sourceCases", toJson sourceCases.size), ("claimCases", toJson claimCases.size),
+    ("accepted", toJson (acceptedCount records))]
+
+end Tests.Certified.CLI
+
+def main (args : List String) : IO UInt32 := do
+  match args with
+  | [kind, sourceExe, claimExe, inputs, output] =>
+    match kind with
+    | "source" => Tests.Certified.CLI.sourceTests sourceExe inputs output
+    | "claims" => Tests.Certified.CLI.claimTests claimExe inputs output
+    | "modeled" => Tests.Certified.CLI.modeledTests sourceExe claimExe inputs output
+    | _ => throw (IO.userError s!"unknown corpus: {kind}")
+    return 0
+  | _ =>
+    IO.eprintln "usage: certified-cli-tests (source|claims|modeled) SOURCE_EXE CLAIM_EXE INPUTS OUTPUTS"
+    return 2
diff --git a/Tests/Certified/Check.lean b/Tests/Certified/Check.lean
new file mode 100644
index 000000000..1d2e2d7ed
--- /dev/null
+++ b/Tests/Certified/Check.lean
@@ -0,0 +1,132 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean
+import Tests.Certified.ImportManifest
+
+/-! Independent provenance and byte/command regressions for the maintained
+certified adapters. All historical inputs come from the local frozen archive. -/
+
+open Lean System Tests.Certified.ImportManifest
+
+namespace Tests.Certified.Check
+
+private def need (condition : Bool) (message : String) : IO Unit :=
+  unless condition do throw (IO.userError message)
+
+private def run (cmd : String) (args : Array String) : IO IO.Process.Output := do
+  let result ← IO.Process.output { cmd, args }
+  need (result.exitCode == 0) s!"{cmd} failed ({result.exitCode}): {result.stdout}{result.stderr}"
+  return result
+
+private def sha256 (path : FilePath) : IO String := do
+  return ((← run "sha256sum" #["--", path.toString]).stdout.splitOn " ").headD ""
+
+private def files (directory : FilePath) : IO (Array String) := do
+  let mut result := #[]
+  for path in ← directory.walkDir do
+    unless ← path.isDir do
+      result := result.push ((path.toString.drop (directory.toString.length + 1)).toString)
+  return result.qsort (· < ·)
+
+private def compareTree (expected actual : FilePath) (jsonEquivalent : Bool := false) : IO Unit := do
+  let expectedFiles ← files expected
+  let actualFiles ← files actual
+  need (expectedFiles == actualFiles) s!"fixture inventory differs: {expected} / {actual}"
+  for relative in expectedFiles do
+    let old ← IO.FS.readBinFile (expected / relative)
+    let current ← IO.FS.readBinFile (actual / relative)
+    if old == current then continue
+    if jsonEquivalent && (FilePath.mk relative).extension == some "json" then
+      let old ← IO.ofExcept (Json.parse (String.fromUTF8! old))
+      let current ← IO.ofExcept (Json.parse (String.fromUTF8! current))
+      need (old == current) s!"JSON protocol value differs: {relative}"
+    else throw (IO.userError s!"fixture bytes differ: {relative} ({expected} / {actual})")
+
+private def unpack (directory : FilePath) : IO Unit := do
+  need ((← sha256 archive) == archiveSha256) "frozen C7 handoff archive identity changed"
+  IO.FS.createDirAll directory
+  let _ ← run "tar" #["-xzf", archive, "--no-same-owner", "--no-same-permissions", "-C", directory.toString]
+  for row in selected do
+    need ((← sha256 (directory / "adapters" / row.source)) == row.sourceSha256)
+      s!"frozen adapter source identity changed: {row.source}"
+    if let some target := row.target then
+      need ((← sha256 target) == row.importedSha256)
+        s!"maintained adapter changed; review import manifest: {target}"
+  IO.println s!"C7 provenance passed: {selected.size} frozen sources, {(selected.filter (·.target.isSome)).size} maintained ports."
+
+private def nativeCases := #[
+  ("feature", "certified-feature-tests", none),
+  ("ordinary", "certified-ordinary-tests", none),
+  ("vm", "certified-vm-tests", none),
+  ("source", "certified-source-tests", some "inputs"),
+  ("fidelity", "certified-fidelity-tests", some "fidelity-inputs"),
+  ("claim", "certified-claim-tests", some "claim-inputs"),
+  ("modeled", "certified-modeled-tests", some "modeled-inputs")]
+
+private def compareNative (frozen actual : FilePath) : IO Unit := do
+  for (label, _, _) in nativeCases do
+    need ((← IO.FS.readFile (frozen / s!"evidence/c7/{label}-tests.txt")) ==
+      (← IO.FS.readFile (actual / s!"{label}-tests.txt"))) s!"native report differs: {label}"
+    if #["source", "fidelity", "claim", "modeled"].contains label then
+      need ((← IO.FS.readFile (frozen / s!"evidence/c7/{label}-loader.txt")) ==
+        (← IO.FS.readFile (actual / s!"{label}-loader.txt"))) s!"loader report differs: {label}"
+  for (old, current) in #[
+      ("c5/inputs", "inputs"), ("c6/fidelity-inputs", "fidelity-inputs"),
+      ("c7/claim-inputs", "claim-inputs"), ("c7/modeled-inputs", "modeled-inputs")] do
+    compareTree (frozen / "evidence" / old) (actual / current)
+  IO.println "Native reports and all generated source/envelope fixtures match frozen C7 bytes."
+
+private def compareCLI (frozen actual : FilePath) : IO Unit := do
+  for (old, current) in #[
+      ("c5/cli-inputs", "cli-source"), ("c7/claim-cli-inputs", "cli-claims"),
+      ("c7/modeled-cli-inputs", "cli-modeled")] do
+    -- The new Lean driver prints JSON differently. Compare parsed protocol
+    -- values; source, envelope, stdout and stderr remain byte-exact checks.
+    compareTree (frozen / "evidence" / old) (actual / current) true
+  IO.println "All CLI scenarios match the frozen inventory, protocol values, source/envelope bytes and process results."
+
+private def runNative (frozen output : FilePath) : IO Unit := do
+  for (label, executable, directory) in nativeCases do
+    let args := directory.toArray.map (fun item => (output / FilePath.mk item).toString)
+    let result ← run s!".lake/build/bin/{executable}" args
+    IO.FS.writeFile (output / s!"{label}-tests.txt") result.stdout
+    IO.FS.writeFile (output / s!"{label}-loader.txt") result.stderr
+    IO.println s!"Native {label} tests passed."
+  compareNative frozen output
+
+private def runCLI (frozen output : FilePath) : IO Unit := do
+  for (kind, inputs, target) in #[
+      ("source", "inputs", "cli-source"), ("claims", "claim-inputs", "cli-claims"),
+      ("modeled", "modeled-inputs", "cli-modeled")] do
+    let result ← run ".lake/build/bin/certified-cli-tests" #[kind,
+      ".lake/build/bin/certified-check", ".lake/build/bin/certified-claim-check",
+      (output / inputs).toString, (output / target).toString]
+    IO.print s!"CLI {kind}: {result.stdout}"
+  compareCLI frozen output
+
+def main (args : List String) : IO UInt32 := do
+  match args with
+  | [] =>
+    IO.FS.withTempDir fun directory => do
+      let frozen := directory / "frozen"
+      let output := directory / "actual"
+      unpack frozen
+      IO.FS.createDirAll output
+      runNative frozen output
+      runCLI frozen output
+    IO.println "Certified adapter checks passed."
+    return 0
+  | ["--compare", frozen, actual] =>
+    compareNative frozen actual
+    compareCLI frozen actual
+    return 0
+  | _ =>
+    IO.eprintln "usage: certified-adapter-tests [--compare FROZEN_DIRECTORY ACTUAL_DIRECTORY]"
+    return 2
+
+end Tests.Certified.Check
+
+def main := Tests.Certified.Check.main
diff --git a/Tests/Certified/Claims.lean b/Tests/Certified/Claims.lean
new file mode 100644
index 000000000..b9ee1f2d5
--- /dev/null
+++ b/Tests/Certified/Claims.lean
@@ -0,0 +1,375 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.FeatureCases
+import Tests.Certified.Source
+import Ix.Certified.ClaimSuggest
+import Ix.Certified.ClaimCommand
+import Tests.Theory.Claims
+
+/-! Native tests of the versioned claim byte boundary. All hints are built
+outside the checker and every outcome goes through `acceptsClaimBytes`. -/
+
+namespace Tests.Certified.Claims
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model Ix.Certified Serialize
+open Lean (toJson)
+
+set_option maxRecDepth 32768
+set_option maxHeartbeats 32000000
+
+def fuel : Nat := 6400
+
+def tree : List Address → Ix.AssumptionTree
+  | [] => .padding
+  | [a] => .leaf a
+  | a :: rest => .node (.leaf a) (tree rest)
+
+def optionalRoot (addresses : List Address) : Option Address :=
+  if addresses.isEmpty then none else some (treeRoot (tree addresses))
+
+def optionalBytes (addresses : List Address) : Option ByteArray :=
+  if addresses.isEmpty then none else some (treeBytes (tree addresses))
+
+structure Fixture where
+  name : String
+  source : Case
+  envelope : Envelope
+  hint : LogicalHint
+  witness : LogicalWitness
+
+def Fixture.bytes (f : Fixture) : ByteArray := envelopeBytes f.envelope
+def Fixture.address (f : Fixture) : Address := Address.blake3 f.bytes
+def Fixture.accepted (f : Fixture) : Bool :=
+  acceptsClaimBytes.{0} fuel (Source.source f.source) f.address f.bytes (.logical f.witness)
+
+/-- Untrusted test producer computes the logical-use tree from the checked
+leaf manifest. The public acceptance call independently recomputes it. -/
+def finish? (name : String) (c : Case) (claim : Ix.Claim) (hint : LogicalHint) : Option Fixture := do
+  let envelope : Envelope := ⟨Protocol.current, c.profile, claim, none⟩
+  let source := Source.source c
+  let witness ← suggestLogical? fuel source envelope hint
+  let (snapshot, _) ← readSnapshot? fuel source hint.selection {}
+  let signature ← readSignature? c.profile snapshot.decodedObjects
+  let store ← readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals
+  let leaves ← witness.leaves.mapM (readLeafInput? fuel snapshot.decodedObjects)
+  let batch ← checkBatch?.{0,0} fuel signature store witness.frontier
+    (leaves.map (fun leaf => leaf.prepared.node signature))
+  let axioms := hint.selection.objects.filter fun address =>
+    (subjectReferences? snapshot.decodedObjects address).any fun refs =>
+      !refs.isEmpty && refs.all batch.logicalUses.contains
+  let axiomTree := optionalBytes axioms
+  return ⟨name, c, { envelope with logicalAxioms := optionalRoot axioms },
+    { hint with axiomTree }, { witness with axiomTree }⟩
+
+def single? (c : Case) : Option Fixture :=
+  let claim : Ix.Claim := .check c.target none
+  finish? (c.name ++ "-check") c claim
+    ⟨Source.selection c, [⟨claim, none, none⟩], none, none, none, none, []⟩
+
+def environment? (c : Case) : Option Fixture :=
+  let subjects := tree (Source.subjects c)
+  let claim : Ix.Claim := .checkEnv (treeRoot subjects) none
+  finish? (c.name ++ "-environment") c claim
+    ⟨Source.selection c, [⟨claim, some (treeBytes subjects), none⟩],
+      some (treeBytes subjects), none, none, none, []⟩
+
+def rejectsEnvelope (f : Fixture) (envelope : Envelope) : Bool :=
+  let bytes := envelopeBytes envelope
+  !acceptsClaimBytes.{0} fuel (Source.source f.source) (Address.blake3 bytes) bytes (.logical f.witness)
+
+def hostile (f : Fixture) : Bool := Id.run do
+  let source := Source.source f.source
+  let check := fun w => acceptsClaimBytes.{0} fuel source f.address f.bytes (.logical w)
+  if !f.accepted then return false
+  if acceptsClaimBytes.{0} 0 source f.address f.bytes (.logical f.witness) then return false
+  if acceptsClaimBytes.{0} fuel source f.source.target f.bytes (.logical f.witness) then return false
+  let trailing := f.bytes.push 0
+  if acceptsClaimBytes.{0} fuel source (Address.blake3 trailing) trailing (.logical f.witness) then return false
+  for protocol in [
+      { Protocol.current with format := 2 }, { Protocol.current with codec := 2 },
+      { Protocol.current with checker := Protocol.current.checker + 1 }, { Protocol.current with policy := 2 },
+      { Protocol.current with aggregation := 2 }] do
+    if !rejectsEnvelope f { f.envelope with protocol } then return false
+  if !rejectsEnvelope f { f.envelope with profile := { f.envelope.profile with
+      falseType := f.source.profile.falseElim, falseElim := f.source.profile.falseType } } then return false
+  if check { f.witness with leaves := [] } then return false
+  if check { f.witness with leaves := f.witness.leaves.map fun leaf => { leaf with declarations := [] } } then
+    return false
+  if check { f.witness with selection := { f.witness.selection with
+      objects := f.source.target :: f.witness.selection.objects } } then return false
+  if check { f.witness with selection := { f.witness.selection with
+      objects := f.witness.selection.objects.filter (· != f.source.target) } } then return false
+  let forged := treeBytes (.leaf f.source.target)
+  if check { f.witness with frontierTree := some forged } then return false
+  if check { f.witness with axiomTree := some forged } then return false
+  if check { f.witness with leaves := f.witness.leaves.map fun leaf =>
+      { leaf with
+        claim := .contains (treeRoot (.leaf f.source.target)) f.source.target,
+        subjects := none } } then return false
+  if !rejectsEnvelope f { f.envelope with claim := .eval f.source.target f.source.target none } then
+    return false
+  if f.envelope.logicalAxioms.isSome && !rejectsEnvelope f { f.envelope with logicalAxioms := none } then
+    return false
+  return true
+
+def diamondCase? : Option Case :=
+  let T := (Tests.Theory.Checker.identityType (.param 0)).erase
+  let store := Tests.Theory.Claims.store fun n c => if n = 14 then
+    .defn 1 .theorem T (.app (.lam T (.bvar 0)) (.const (.member 12 0) [.param 0])) .safe else c
+  make? "diamond" Tests.Theory.Certified.primitives
+    ⟨store, 1, .const (.member 15 0) [.param 0], T⟩
+
+def checkLeaf (subject : Address) (frontier : List Address) : LeafHint :=
+  ⟨.check subject (optionalRoot frontier), none, optionalBytes frontier⟩
+
+def envLeaf (subjects frontier : List Address) : LeafHint :=
+  ⟨.checkEnv (treeRoot (tree subjects)) (optionalRoot frontier),
+    some (treeBytes (tree subjects)), optionalBytes frontier⟩
+
+def diamond? (openFrontier : Bool := false) (catalog : Bool := false) : Option Fixture := do
+  let c ← diamondCase?
+  let a ← reference c.references (.member 12 0)
+  let b ← reference c.references (.member 13 0)
+  let d ← reference c.references (.member 14 0)
+  let e ← reference c.references (.member 15 0)
+  let specs := if openFrontier then [([b], [a]), ([d], [a]), ([e], [b, d])]
+    else [([a], []), ([b], [a]), ([d], [a]), ([e], [b, d])]
+  let leaves := specs.map fun (subjects, frontier) =>
+    if catalog then envLeaf subjects frontier else checkLeaf subjects[0]! frontier
+  let content := tree (specs.flatMap Prod.fst)
+  let frontier := if openFrontier then [a] else []
+  let members := tree (leaves.filterMap fun leaf => environmentRoot? leaf.claim)
+  let claim := if catalog then .catalog (treeRoot members) (treeRoot content) (optionalRoot frontier)
+    else .checkEnv (treeRoot content) (optionalRoot frontier)
+  finish? s!"diamond-{openFrontier}-{catalog}" c claim
+    ⟨Source.selection c, leaves, some (treeBytes content),
+      if catalog then some (treeBytes members) else none, optionalBytes frontier, none, []⟩
+
+def diamondTests (f : Fixture) : Bool := Id.run do
+  if !f.accepted then return false
+  let source := Source.source f.source
+  let check := fun w => acceptsClaimBytes.{0} fuel source f.address f.bytes (.logical w)
+  if check { f.witness with leaves := f.witness.leaves.reverse } then return false
+  if check { f.witness with leaves := f.witness.leaves.drop 1 } then return false
+  if !check { f.witness with leaves := f.witness.leaves ++ f.witness.leaves } then return false
+  if check { f.witness with frontier := [] } && (claimFrontier f.envelope.claim).isSome then return false
+  if check { f.witness with members := f.witness.subjects } && f.witness.members.isSome then return false
+  return true
+
+def warm (f : Fixture) : Bool := Id.run do
+  let source := Source.source f.source
+  let step := Ix.Kernel.certifiedClaimStep.{0} fuel source f.address f.bytes (.logical f.witness)
+  let .ok _ cold := step.run Ix.Kernel.initialCertifiedState | return false
+  let start := { cold with checker := Source.poisonedChecker f.source }
+  let .ok _ cached := step.run start | return false
+  let size := f.witness.selection.objects.length + f.witness.selection.naturals.length
+  if cached.inputCache.hits != size || cached.inputCache.misses != size then return false
+  let .error _ failed := (Ix.Kernel.certifiedClaimStep.{0} fuel source f.address f.bytes
+    (.logical { f.witness with leaves := [] })).run cached | return false
+  if failed.inputCache.hits != cached.inputCache.hits || failed.inputCache.misses != cached.inputCache.misses then
+    return false
+  let changed := { source with consts := source.consts.erase f.source.target }
+  let .error _ absent := (Ix.Kernel.certifiedClaimStep.{0} fuel changed f.address f.bytes (.logical f.witness)).run failed
+    | return false
+  if absent.inputCache.hits != cached.inputCache.hits || absent.inputCache.misses != cached.inputCache.misses then
+    return false
+  let .ok _ retry := step.run absent | return false
+  return retry.inputCache.hits == 2 * size && retry.inputCache.misses == size && retry.checker.inferOnly
+
+structure WireCase where
+  name : String
+  source : Case
+  envelope : Envelope
+  hint : ClaimCommand.Hint
+  expected : Bool := true
+
+def WireCase.bytes (w : WireCase) : ByteArray := envelopeBytes w.envelope
+def WireCase.request (w : WireCase) : ClaimCommand.Request := ⟨Address.blake3 w.bytes, w.hint⟩
+def WireCase.passes (w : WireCase) : Bool :=
+  (ClaimCommand.run.{0} fuel (Source.source w.source) w.bytes w.request).isOk == w.expected
+
+def Fixture.wire (f : Fixture) : WireCase := ⟨f.name, f.source, f.envelope, .logical f.hint, true⟩
+
+def rawFalseAlias (index : UInt64) : Ixon.MutConst := .defn {
+  kind := .thm, safety := .safe, lvls := 0, typ := .ref 0 #[], value := .recur index #[] }
+
+/-- Self-block indices make this a finite, canonically hashed source cycle;
+there is no assumed collision or circular hash-address construction. -/
+def cycleCase : Case :=
+  let block := Fixtures.encode ⟨.muts #[rawFalseAlias 1, rawFalseAlias 0], #[], #[Fixtures.profile.falseType], #[]⟩
+  let a := Fixtures.encode ⟨.dPrj ⟨0, block.1⟩, #[], #[], #[]⟩
+  let b := Fixtures.encode ⟨.dPrj ⟨1, block.1⟩, #[], #[], #[]⟩
+  ⟨"cycle", Fixtures.profile, a.1, Fixtures.prelude ++ [block, a, b], [],
+    [(.member 20 0, a.1), (.member 20 1, b.1)], [(20, block.1)]⟩
+
+def cycleWires? : Option (List WireCase) := do
+  let c := cycleCase
+  let a ← reference c.references (.member 20 0)
+  let b ← reference c.references (.member 20 1)
+  let left := checkLeaf a [b]
+  let right := checkLeaf b [a]
+  let one := fun leaf => LogicalHint.mk (Source.selection c) [leaf] none none leaf.frontierTree none []
+  let subjects := tree [a, b]
+  let envelope : Envelope := ⟨Protocol.current, c.profile, .checkEnv (treeRoot subjects) none, none⟩
+  let both := fun leaves => LogicalHint.mk (Source.selection c) leaves (some (treeBytes subjects)) none none none []
+  return [
+    (← finish? "cycle-A-assuming-B" c left.claim (one left)).wire,
+    (← finish? "cycle-B-assuming-A" c right.claim (one right)).wire,
+    ⟨"cycle-closed-AB", c, envelope, .logical (both [left, right]), false⟩,
+    ⟨"cycle-closed-BA", c, envelope, .logical (both [right, left]), false⟩,
+    ⟨"cycle-own-assumption", c, ⟨Protocol.current, c.profile, (checkLeaf a [a]).claim, none⟩,
+      .logical (one (checkLeaf a [a])), false⟩]
+
+def containsWires (c : Case) : List WireCase :=
+  let content : Ix.AssumptionTree := .node (.leaf c.target) (.node .padding (.leaf c.profile.falseType))
+  let claim := Ix.Claim.contains (treeRoot content) c.target
+  let envelope : Envelope := ⟨Protocol.current, c.profile, claim, none⟩
+  [⟨"contains-padding", c, envelope, .contains (treeBytes content), true⟩,
+   ⟨"contains-absent", c, { envelope with claim := .contains (treeRoot content) c.profile.falseElim },
+     .contains (treeBytes content), false⟩,
+   ⟨"contains-wrong-root", c, { envelope with claim := .contains c.target c.target },
+     .contains (treeBytes content), false⟩,
+   ⟨"contains-trailing-tree", c, envelope, .contains ((treeBytes content).push 0), false⟩,
+   ⟨"contains-logical-axioms", c, { envelope with logicalAxioms := some (treeRoot content) },
+     .contains (treeBytes content), false⟩,
+   ⟨"contains-as-logical", c, envelope,
+     .logical ⟨Source.selection c, [⟨claim, none, none⟩], none, none, none, none, []⟩, false⟩]
+
+def revealCtor (ctor : Ixon.Constructor) : Ix.RevealConstructorInfo :=
+  ⟨some ctor.isUnsafe, some ctor.lvls, some ctor.cidx, some ctor.params, some ctor.fields,
+    some (expressionAddress ctor.typ)⟩
+
+def revealCtors (ctors : Array Ixon.Constructor) : Option (Array (UInt64 × Ix.RevealConstructorInfo)) :=
+  some (ctors.toList.zipIdx.map fun (ctor, index) => (index.toUInt64, revealCtor ctor)).toArray
+
+def revealRules (rules : Array Ixon.RecursorRule) : Option (Array Ix.RevealRecursorRule) :=
+  some (rules.toList.zipIdx.map fun (rule, index) =>
+    ⟨index.toUInt64, rule.fields, expressionAddress rule.rhs⟩).toArray
+
+def revealMut : Ixon.MutConst → Ix.RevealMutConstInfo
+  | .defn d => .defn (some d.kind) (some d.safety) (some d.lvls)
+      (some (expressionAddress d.typ)) (some (expressionAddress d.value))
+  | .indc d => .indc (some d.isUnsafe) (some d.lvls) (some d.params) (some d.indices)
+      (some (expressionAddress d.typ)) (revealCtors d.ctors)
+  | .recr d => .recr (some d.k) (some d.isUnsafe) (some d.lvls) (some d.params) (some d.indices)
+      (some d.motives) (some d.minors) (some (expressionAddress d.typ)) (revealRules d.rules)
+
+def revealInfo : Ixon.ConstantInfo → Ix.RevealConstantInfo
+  | .defn d => .defn (some d.kind) (some d.safety) (some d.lvls)
+      (some (expressionAddress d.typ)) (some (expressionAddress d.value))
+  | .recr d => .recr (some d.k) (some d.isUnsafe) (some d.lvls) (some d.params) (some d.indices)
+      (some d.motives) (some d.minors) (some (expressionAddress d.typ)) (revealRules d.rules)
+  | .axio d => .axio (some d.isUnsafe) (some d.lvls) (some (expressionAddress d.typ))
+  | .quot d => .quot (some d.kind) (some d.lvls) (some (expressionAddress d.typ))
+  | .cPrj d => .cPrj (some d.idx) (some d.cidx) (some d.block)
+  | .iPrj d => .iPrj (some d.idx) (some d.block)
+  | .rPrj d => .rPrj (some d.idx) (some d.block)
+  | .dPrj d => .dPrj (some d.idx) (some d.block)
+  | .muts ds => .muts (ds.toList.zipIdx.map fun (d, index) => (index.toUInt64, revealMut d)).toArray
+
+def corruptInfo : Ix.RevealConstantInfo → Ix.RevealConstantInfo
+  | .defn k s u t b => .defn k s ((u.getD 0 + 1) |> some) t b
+  | .recr k s u p i m n t r => .recr k s u p i (some (m.getD 0 + 1)) n t r
+  | .axio s u t => .axio (some (!(s.getD false))) u t
+  | .quot k u t => .quot k (some (u.getD 0 + 1)) t
+  | .cPrj i c b => .cPrj i (some (c.getD 0 + 1)) b
+  | .iPrj i b => .iPrj (some (i.getD 0 + 1)) b
+  | .rPrj i b => .rPrj (some (i.getD 0 + 1)) b
+  | .dPrj i b => .dPrj (some (i.getD 0 + 1)) b
+  | .muts ds => .muts (ds.push (100000, .defn none none none none none))
+
+def revealWires? (c : Case) : Option (List WireCase) := do
+  let mut result := []
+  for ((address, bytes), index) in c.blobs.zipIdx do
+    let object ← decodeObject? address bytes
+    let info := revealInfo object.val.info
+    let opening : Ixon.Comm := ⟨Address.blake3 "C6 reveal secret".toUTF8, address⟩
+    let envelope : Envelope := ⟨Protocol.current, c.profile, .reveal opening.commit info, none⟩
+    result := result ++ [
+      ⟨s!"{c.name}-reveal-{index}", c, envelope, .reveal ⟨opening⟩, true⟩,
+      ⟨s!"{c.name}-reveal-altered-{index}", c,
+        { envelope with claim := .reveal opening.commit (corruptInfo info) }, .reveal ⟨opening⟩, false⟩,
+      ⟨s!"{c.name}-reveal-secret-{index}", c, envelope,
+        .reveal ⟨{ opening with secret := c.target }⟩, false⟩]
+  return result
+
+def hexJson (bytes : Option ByteArray) : Lean.Json := toJson (bytes.map hexOfBytes)
+
+def leafJson (hint : LeafHint) : Lean.Json := Lean.Json.mkObj [
+  ("claim", toJson (hexOfBytes (Ix.Claim.ser hint.claim))),
+  ("subjects", hexJson hint.subjects), ("frontier", hexJson hint.frontierTree)]
+
+def requestJson (request : ClaimCommand.Request) : Lean.Json :=
+  let fields := match request.hint with
+    | .logical hint => [
+      ("kind", toJson "logical"),
+      ("objects", toJson (hint.selection.objects.map fun a => hexOfBytes a.hash)),
+      ("naturals", toJson (hint.selection.naturals.map fun a => hexOfBytes a.hash)),
+      ("leaves", toJson (hint.leaves.map leafJson)),
+      ("subjects", hexJson hint.subjects), ("members", hexJson hint.members),
+      ("frontier", hexJson hint.frontierTree), ("axioms", hexJson hint.axiomTree)] ++
+      (if hint.models.isEmpty then [] else [("models", toJson (hint.models.map ModelHint.json))])
+    | .contains bytes => [("kind", toJson "contains"), ("tree", toJson (hexOfBytes bytes))]
+    | .reveal witness => [("kind", toJson "reveal"),
+      ("secret", toJson (hexOfBytes witness.opening.secret.hash)),
+      ("payload", toJson (hexOfBytes witness.opening.payload.hash))]
+  Lean.Json.mkObj (("address", toJson (hexOfBytes request.address.hash)) :: fields)
+
+def writeWire (directory : System.FilePath) (w : WireCase) : IO Unit := do
+  let directory := directory / w.name
+  IO.FS.createDirAll directory
+  let .ok source := Ixon.serEnv (Source.source w.source)
+    | throw (IO.userError s!"cannot serialize {w.name}")
+  IO.FS.writeBinFile (directory / "source.ixe") source
+  IO.FS.writeBinFile (directory / "envelope.bin") w.bytes
+  IO.FS.writeFile (directory / "request.json") ((requestJson w.request).pretty ++ "\n")
+  IO.FS.writeFile (directory / "expected.json")
+    ((Lean.Json.mkObj [("accepted", toJson w.expected)]).compress ++ "\n")
+
+def runWire (directory : Option System.FilePath) (w : WireCase) : IO Unit := do
+  unless w.passes do throw (IO.userError s!"claim command outcome failed: {w.name}")
+  let .ok request := ClaimCommand.readRequest (requestJson w.request)
+    | throw (IO.userError s!"claim request parsing failed: {w.name}")
+  unless (ClaimCommand.run.{0} fuel (Source.source w.source) w.bytes request).isOk == w.expected do
+    throw (IO.userError s!"claim parsed request outcome failed: {w.name}")
+  if let some directory := directory then writeWire directory w
+
+def run (directory : Option System.FilePath) : IO Unit := do
+  let mut count := 0
+  let mut axioms := 0
+  let mut revelations := 0
+  for c in Source.cases do
+    for (label, produce) in [("check", single?), ("environment", environment?)] do
+      let some f := produce c | throw (IO.userError s!"claim producer declined {c.name}/{label}")
+      unless f.accepted do throw (IO.userError s!"claim rejected {f.name}")
+      unless hostile f do throw (IO.userError s!"claim mutation escaped {f.name}")
+      unless warm f do throw (IO.userError s!"claim cache rollback failed {f.name}")
+      runWire directory f.wire
+      count := count + 1
+      if f.envelope.logicalAxioms.isSome then axioms := axioms + 1
+    let some reveals := revealWires? c | throw (IO.userError s!"reveal producer declined {c.name}")
+    for w in reveals do runWire directory w
+    revelations := revelations + reveals.length
+  for openFrontier in [false, true] do
+    for catalog in [false, true] do
+      let some f := diamond? openFrontier catalog | throw (IO.userError s!"diamond producer declined {openFrontier}/{catalog}")
+      unless diamondTests f do throw (IO.userError s!"diamond failed {f.name}")
+      runWire directory f.wire
+  let some cycles := cycleWires? | throw (IO.userError "cycle producer declined")
+  for w in cycles do runWire directory w
+  let some cycleReveals := revealWires? cycleCase | throw (IO.userError "cycle reveal producer declined")
+  for w in cycleReveals do runWire directory w
+  revelations := revelations + cycleReveals.length
+  for w in containsWires cycleCase do runWire directory w
+  IO.println <| (Lean.Json.mkObj [
+    ("sourceClaimsAccepted", toJson count), ("nonemptyAxiomRoots", toJson axioms),
+    ("sourceMutationScenarios", toJson count), ("diamondScenarios", toJson (4 : Nat)),
+    ("warmClaimScenarios", toJson count), ("cycleScenarios", toJson cycles.length),
+    ("containsScenarios", toJson (containsWires cycleCase).length),
+    ("revealScenarios", toJson revelations),
+    ("unexpectedErrors", toJson (0 : Nat))]).compress
+
+end Tests.Certified.Claims
diff --git a/Tests/Certified/ClaimsMain.lean b/Tests/Certified/ClaimsMain.lean
new file mode 100644
index 000000000..ab82d621b
--- /dev/null
+++ b/Tests/Certified/ClaimsMain.lean
@@ -0,0 +1,13 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Claims
+
+def main (args : List String) : IO UInt32 := do
+  if args.length > 1 then
+    IO.eprintln "usage: certified-claim-tests [OUTPUT_DIRECTORY]"
+    return 2
+  Tests.Certified.Claims.run (args.head?.map System.FilePath.mk)
+  return 0
diff --git a/Tests/Certified/FeatureCases.lean b/Tests/Certified/FeatureCases.lean
new file mode 100644
index 000000000..33b1b3b04
--- /dev/null
+++ b/Tests/Certified/FeatureCases.lean
@@ -0,0 +1,296 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Serialize
+import Ix.Certified.Packet
+import Ix.Certified.Corpus
+import Tests.Theory.Standard
+import Tests.Theory.Quotient
+import Tests.Theory.Structure
+import Tests.Theory.Natural
+
+/-! C4 canonical serialized acceptance corpus. All certificates are generated
+from decoded stores, and all outcomes run the independent serialized gate. -/
+
+namespace Tests.Certified.Features
+
+open Ix.Theory Ix.Theory.Model Ix.Theory.Certified Ix.Certified Serialize
+open Tests.Theory.Certified (primitives)
+open Lean (toJson)
+
+set_option maxRecDepth 32768
+set_option maxHeartbeats 32000000
+
+abbrev std := Tests.Theory.Standard.input
+abbrev quo := Tests.Theory.Quotient.input
+abbrev struc := Tests.Theory.Structure.input
+abbrev natural := Tests.Theory.Natural.input
+
+structure Scenario where
+  name : String
+  input : ProofInput Nat
+  signature : PrimitiveSignature Nat := primitives
+
+def positive : List Scenario := [
+  ⟨"propext", Tests.Theory.Standard.propextInput, primitives⟩,
+  ⟨"choice-Prop", std 0 (.const Tests.Theory.Standard.choiceRef [.zero])
+      (Tests.Theory.Standard.choiceSpec.type.instL [.zero]), primitives⟩,
+  ⟨"choice-universe", std 1 (Tests.Theory.Standard.choiceRefl (.param 0))
+      (Tests.Theory.Standard.choiceReflType (.param 0)), primitives⟩,
+  ⟨"choice-Type", std 0 (Tests.Theory.Standard.choiceRefl (.succ .zero))
+      (Tests.Theory.Standard.choiceReflType (.succ .zero)), primitives⟩,
+  ⟨"choice-Type1", std 0 (Tests.Theory.Standard.choiceRefl (.succ (.succ .zero)))
+      (Tests.Theory.Standard.choiceReflType (.succ (.succ .zero))), primitives⟩,
+  ⟨"Eq-K", std 0 Tests.Theory.Standard.kProof Tests.Theory.Standard.kProposition, primitives⟩,
+  ⟨"Quot-sound", quo 1 (.const Tests.Theory.Quotient.refs.sound [.param 0])
+      (Certified.Quotient.soundType Tests.Theory.Quotient.refs), primitives⟩,
+  ⟨"Quot-ind", quo 1 (.const Tests.Theory.Quotient.refs.ind [.param 0])
+      (Certified.Quotient.indType Tests.Theory.Quotient.refs), primitives⟩,
+  ⟨"Quot-lift-universe", Tests.Theory.Quotient.betaInput, primitives⟩,
+  ⟨"Quot-lift-Prop", quo 0 (Tests.Theory.Quotient.betaProof .zero)
+      (Tests.Theory.Quotient.betaProposition .zero), primitives⟩,
+  ⟨"Quot-lift-Type", quo 0 (Tests.Theory.Quotient.betaProof (.succ .zero))
+      (Tests.Theory.Quotient.betaProposition (.succ .zero)), primitives⟩,
+  ⟨"Quot-proof-universe", quo 1 (Tests.Theory.Quotient.propLiftProof (.param 0))
+      (Tests.Theory.Quotient.propLiftProposition (.param 0)), primitives⟩,
+  ⟨"Quot-proof-Prop", quo 0 (Tests.Theory.Quotient.propLiftProof .zero)
+      (Tests.Theory.Quotient.propLiftProposition .zero), primitives⟩,
+  ⟨"Box-dependent-projection", Tests.Theory.Structure.boxInput, primitives⟩,
+  ⟨"Box-eta-Prop", struc Tests.Theory.Structure.box 0 (Tests.Theory.Structure.etaProof .zero)
+      (Tests.Theory.Structure.etaProposition .zero), primitives⟩,
+  ⟨"Box-eta-universe", struc Tests.Theory.Structure.box 1 (Tests.Theory.Structure.etaProof (.param 0))
+      (Tests.Theory.Structure.etaProposition (.param 0)), primitives⟩,
+  ⟨"Pair-projection", struc Tests.Theory.Structure.pair 0 Tests.Theory.Structure.pairProof
+      Tests.Theory.Structure.boxProposition, primitives⟩,
+  ⟨"Box-field-Prop", struc Tests.Theory.Structure.box 0 (Tests.Theory.Structure.fieldProof .zero)
+      (Tests.Theory.Structure.fieldProposition .zero), primitives⟩,
+  ⟨"Box-field-Type", struc Tests.Theory.Structure.box 0 (Tests.Theory.Structure.fieldProof (.succ .zero))
+      (Tests.Theory.Structure.fieldProposition (.succ .zero)), primitives⟩,
+  ⟨"Box-field-universe", struc Tests.Theory.Structure.box 1 (Tests.Theory.Structure.fieldProof (.param 0))
+      (Tests.Theory.Structure.fieldProposition (.param 0)), primitives⟩,
+  ⟨"Pair-eta-Prop", struc Tests.Theory.Structure.pair 0 (Tests.Theory.Structure.pairEtaProof .zero)
+      (Tests.Theory.Structure.pairEtaProposition .zero), primitives⟩,
+  ⟨"Pair-eta-universe", struc Tests.Theory.Structure.pair 1 (Tests.Theory.Structure.pairEtaProof (.param 0))
+      (Tests.Theory.Structure.pairEtaProposition (.param 0)), primitives⟩,
+  ⟨"Nat-zero", natural Tests.Theory.Natural.zero 0, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-literal", natural (Tests.Theory.Natural.numeral 4) 4, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-succ", natural (Tests.Theory.Natural.succ (.natLit 8)) 9, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-definition", natural (.const (.member 302 0) []) 3, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-add-zero", natural (Tests.Theory.Natural.add (.natLit 0) (.natLit 0)) 0, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-add", Tests.Theory.Natural.sampleInput, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-mul", natural (Tests.Theory.Natural.mul (.natLit 2) (.natLit 3)) 6, Tests.Theory.Natural.profile⟩,
+  ⟨"Nat-mul-zero", natural (Tests.Theory.Natural.mul (.natLit 5) (.natLit 0)) 0, Tests.Theory.Natural.profile⟩
+]
+
+#guard positive.length = 30
+
+def witness? (c : Case) : Option (PreparedInput × ProofWitness Address) := do
+  let p ← prepare? 6400 c.profile c.target c.blobs c.literals
+  let w ← Ix.Theory.Certificate.proofWitness? 6400 p.signature p.input
+  return (p, w)
+
+def accepted (c : Case) : Bool :=
+  (witness? c).any fun (_, w) => acceptsSerialized.{0} 6400 c.profile c.target c.blobs w c.literals
+
+def pilotDeclines (c : Case) : Bool :=
+  (witness? c).any fun (p, w) => match Packet.words p.signature p.input w with
+    | .error _ => true
+    | .ok _ => false
+
+#guard positive.all fun s => (make? s.name s.signature s.input).any accepted
+#guard positive.all fun s => (make? s.name s.signature s.input).any pilotDeclines
+
+structure Mutation where
+  name : String
+  original : ProofInput Nat
+  altered : ProofInput Nat
+  signature : PrimitiveSignature Nat := primitives
+
+def mutatedSources : List Mutation :=
+  [Tests.Theory.Standard.falseAxiom, Tests.Theory.Standard.unsafeAxiom,
+    Tests.Theory.Standard.wrongArity].zipIdx.map (fun (alter, i) =>
+      ⟨s!"bad-standard-{i}", Tests.Theory.Standard.propextInput,
+        { Tests.Theory.Standard.propextInput with store := Tests.Theory.Standard.store alter }, primitives⟩) ++
+  [Tests.Theory.Quotient.wrongKind, Tests.Theory.Quotient.wrongArity,
+    Tests.Theory.Quotient.falseSound, Tests.Theory.Quotient.unsafeSound,
+    Tests.Theory.Quotient.wrongLift].zipIdx.map (fun (alter, i) =>
+      ⟨s!"bad-quotient-{i}", Tests.Theory.Quotient.betaInput,
+        { Tests.Theory.Quotient.betaInput with store := Tests.Theory.Quotient.store alter }, primitives⟩) ++
+  [Tests.Theory.Structure.wrongFieldCount, Tests.Theory.Structure.wrongRecursor].zipIdx.map (fun (alter, i) =>
+      ⟨s!"bad-structure-{i}", Tests.Theory.Structure.boxInput,
+        { Tests.Theory.Structure.boxInput with store := Tests.Theory.Structure.store Tests.Theory.Structure.box alter }, primitives⟩) ++
+  [Tests.Theory.Natural.unsafeNat, Tests.Theory.Natural.forgedRule,
+    Tests.Theory.Natural.changedAdd].zipIdx.map (fun (alter, i) =>
+      ⟨s!"bad-natural-{i}", Tests.Theory.Natural.sampleInput,
+        { Tests.Theory.Natural.sampleInput with store := Tests.Theory.Natural.store alter }, Tests.Theory.Natural.profile⟩) ++
+  [(.member 200 0, 2), (.member 100 0, 1)].zipIdx.map (fun ((r, field), i) =>
+      ⟨s!"bad-projection-{i}", Tests.Theory.Structure.boxInput,
+        { Tests.Theory.Structure.boxInput with proof := (Tests.Theory.Structure.badProjectionProof r field).erase }, primitives⟩) ++
+  [⟨"bad-Nat-answer", Tests.Theory.Natural.sampleInput,
+    { Tests.Theory.Natural.sampleInput with proposition :=
+      (Tests.Theory.Natural.proposition (Tests.Theory.Natural.add (.natLit 2) (.natLit 3)) (.natLit 6)).erase },
+    Tests.Theory.Natural.profile⟩]
+
+/-- The altered bytes are validly hashed. A certificate is obtained for the
+original complete declarations at these addresses and first validated on the
+control input. Reusing it on the altered authenticated input must fail. -/
+def rejectsSource (m : Mutation) : Bool := Id.run do
+  let some c := make? m.name m.signature m.altered | return false
+  let some p := repaired? c m.original | return false
+  let some w := Ix.Theory.Certificate.proofWitness? 6400 p.signature p.input | return false
+  return acceptsCertified.{0,0} 6400 p.signature p.input w &&
+    !acceptsSerialized.{0} 6400 c.profile c.target c.blobs w c.literals
+
+#guard mutatedSources.length = 16
+#guard mutatedSources.all rejectsSource
+
+
+structure WitnessMutation where
+  scenario : Nat
+  name : String
+  alter : ProofWitness Address → ProofWitness Address
+
+def mapDeclarations (f : DeclarationWitness Address → DeclarationWitness Address)
+    (w : ProofWitness Address) : ProofWitness Address :=
+  { w with declarations := w.declarations.map f }
+
+def witnessMutations : List WitnessMutation := [
+  ⟨0, "standard-before-prerequisites", fun w => { w with declarations := w.declarations.reverse }⟩,
+  ⟨8, "quotient-missing-type", mapDeclarations fun d => match d with
+    | .quotient q => .quotient { q with types := q.types.drop 1 }
+    | other => other⟩,
+  ⟨8, "quotient-wrong-rule", mapDeclarations fun d => match d with
+    | .quotient q => .quotient { q with liftRule := q.indRule }
+    | other => other⟩,
+  ⟨8, "quotient-wrong-owner", mapDeclarations fun d => match d with
+    | .quotient q => .quotient { q with refs := { q.refs with ctor := q.refs.type } }
+    | other => other⟩,
+  ⟨13, "structure-without-facts", mapDeclarations fun d => match d with
+    | .structure s => .ordinary s.facts.block
+    | other => other⟩,
+  ⟨13, "structure-wrong-field-sorts", mapDeclarations fun d => match d with
+    | .structure s => .structure { s with facts := { s.facts with description :=
+        { s.facts.description with fields := s.facts.description.fields.map fun f => { f with level := .zero } } } }
+    | other => other⟩,
+  ⟨13, "structure-dependent-rule-order", mapDeclarations fun d => match d with
+    | .structure s => .structure { s with iota := s.iota.reverse }
+    | other => other⟩,
+  ⟨27, "natural-without-facts", mapDeclarations fun d => match d with
+    | .natural n => .ordinary n
+    | other => other⟩
+]
+
+def rejectsWitness (m : WitnessMutation) : Bool := Id.run do
+  let some s := positive[m.scenario]? | return false
+  let some c := make? s.name s.signature s.input | return false
+  let some (_, w) := witness? c | return false
+  return acceptsSerialized.{0} 6400 c.profile c.target c.blobs w c.literals &&
+    !acceptsSerialized.{0} 6400 c.profile c.target c.blobs (m.alter w) c.literals
+
+#guard witnessMutations.all rejectsWitness
+
+def naturalCase := make? "Nat-add" Tests.Theory.Natural.profile Tests.Theory.Natural.sampleInput
+
+def missingPin (c : Case) : Case := { c with profile := { c.profile with natType := none } }
+def wrongPin (c : Case) : Case :=
+  { c with profile := { c.profile with natType := reference c.references (.member 100 0) } }
+
+def rejectsProfile (alter : Case → Case) : Bool := Id.run do
+  let some c := naturalCase | return false
+  let some (_, w) := witness? c | return false
+  let changed := alter c
+  return !acceptsSerialized.{0} 6400 changed.profile changed.target changed.blobs w changed.literals
+
+#guard [missingPin, wrongPin].all rejectsProfile
+#guard naturalCase.any fun c => (witness? c).any fun (p, _) =>
+  match Packet.args p.signature with | .error _ => true | .ok _ => false
+
+structure IngressMutation where
+  name : String
+  altered : Option Case
+
+def ingressMutations : List IngressMutation := [
+  ⟨"missing-literal-blob", naturalCase.map fun c => { c with literals := [] }⟩,
+  ⟨"literal-bytes-under-old-hash", naturalCase.map fun c =>
+    { c with literals := c.literals.map fun (a, bytes) => (a, bytes.push 1) }⟩,
+  ⟨"noncanonical-literal-new-hash", naturalCase.bind fun c => rehash? c (fun bytes => bytes.push 0)⟩,
+  ⟨"duplicate-literal-blob", naturalCase.map fun c => { c with literals := c.literals ++ c.literals }⟩,
+  ⟨"literal-in-constant-domain", naturalCase.map fun c => { c with blobs := c.blobs ++ c.literals, literals := [] }⟩,
+  ⟨"constant-in-literal-domain", naturalCase.bind fun c => do
+    let eq ← reference c.references (.member 100 0)
+    rehash? c id fun a source =>
+      if a = c.target then match source.info with
+        | .defn d => { source with
+            refs := source.refs.push eq
+            info := .defn { d with
+              typ := mapLiterals source.refs.size.toUInt64 d.typ
+              value := mapLiterals source.refs.size.toUInt64 d.value } }
+        | _ => source
+      else source⟩,
+  ⟨"projection-wrapper-wrong-kind", do
+    let c ← make? "Box-dependent-projection" primitives Tests.Theory.Structure.boxInput
+    let owner ← reference c.references (.member 200 0)
+    rehash? c id fun a source => if a = owner then match source.info with
+      | .iPrj p => { source with info := .rPrj ⟨p.idx, p.block⟩ }
+      | _ => source
+    else source⟩
+]
+
+def rejectsIngress (m : IngressMutation) : Bool :=
+  m.altered.any fun c => (prepare? 6400 c.profile c.target c.blobs c.literals).isNone
+
+#guard ingressMutations.length = 7
+#guard ingressMutations.all rejectsIngress
+
+def writeCase (directory : System.FilePath) (c : Case) : IO Unit := do
+  let directory := directory / c.name
+  IO.FS.createDirAll directory
+  for (a, bytes) in c.blobs do
+    IO.FS.writeBinFile (directory / s!"{hexOfBytes a.hash}.ixon") bytes
+  for (a, bytes) in c.literals do
+    IO.FS.writeBinFile (directory / s!"{hexOfBytes a.hash}.nat") bytes
+  let metadata := Lean.Json.mkObj [
+    ("target", toJson (hexOfBytes c.target.hash)),
+    ("falseType", toJson (hexOfBytes c.profile.falseType.hash)),
+    ("falseElim", toJson (hexOfBytes c.profile.falseElim.hash)),
+    ("natType", toJson (c.profile.natType.map fun a => hexOfBytes a.hash)),
+    ("constants", toJson (c.blobs.map fun (a, _) => hexOfBytes a.hash)),
+    ("naturals", toJson (c.literals.map fun (a, _) => hexOfBytes a.hash))]
+  IO.FS.writeFile (directory / "target.json") (metadata.pretty ++ "\n")
+
+def run (directory : Option System.FilePath) : IO Unit := do
+  for s in positive do
+    let some c := make? s.name s.signature s.input | throw (IO.userError s!"fixture construction failed: {s.name}")
+    unless accepted c do throw (IO.userError s!"serialized acceptance failed: {s.name}")
+    unless pilotDeclines c do throw (IO.userError s!"C2 pilot exclusion failed: {s.name}")
+    if let some directory := directory then writeCase directory c
+  for m in mutatedSources do
+    unless rejectsSource m do throw (IO.userError s!"source rejection failed: {m.name}")
+    if let some directory := directory then
+      let some c := make? m.name m.signature m.altered | throw (IO.userError s!"mutation construction failed: {m.name}")
+      writeCase directory c
+  for m in witnessMutations do
+    unless rejectsWitness m do throw (IO.userError s!"witness rejection failed: {m.name}")
+  for (name, alter) in [("missing-Nat-pin", missingPin), ("wrong-Nat-pin", wrongPin)] do
+    unless rejectsProfile alter do throw (IO.userError s!"profile rejection failed: {name}")
+    if let some directory := directory then
+      let some c := naturalCase | throw (IO.userError "natural fixture construction failed")
+      writeCase directory { (alter c) with name }
+  for m in ingressMutations do
+    unless rejectsIngress m do throw (IO.userError s!"ingress rejection failed: {m.name}")
+    if let some directory := directory then
+      let some c := m.altered | throw (IO.userError s!"ingress mutation construction failed: {m.name}")
+      writeCase directory { c with name := m.name }
+  IO.println <| (Lean.Json.mkObj [
+    ("serializedAccepted", toJson positive.length),
+    ("sourceRejectedWithValidWitness", toJson mutatedSources.length),
+    ("forgedWitnessRejected", toJson witnessMutations.length),
+    ("profileRejected", toJson (2 : Nat)),
+    ("ingressRejected", toJson ingressMutations.length),
+    ("pilotDeclined", toJson positive.length),
+    ("unexpectedErrors", toJson (0 : Nat))]).compress
+
+end Tests.Certified.Features
+
diff --git a/Tests/Certified/Features.lean b/Tests/Certified/Features.lean
new file mode 100644
index 000000000..4b1be4415
--- /dev/null
+++ b/Tests/Certified/Features.lean
@@ -0,0 +1,13 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.FeatureCases
+
+def main (args : List String) : IO UInt32 := do
+  if args.length > 1 then
+    IO.eprintln "usage: certified-feature-tests [OUTPUT_DIRECTORY]"
+    return 2
+  Tests.Certified.Features.run (args.head?.map System.FilePath.mk)
+  return 0
diff --git a/Tests/Certified/Fidelity.lean b/Tests/Certified/Fidelity.lean
new file mode 100644
index 000000000..ff5a89e65
--- /dev/null
+++ b/Tests/Certified/Fidelity.lean
@@ -0,0 +1,132 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Source
+import Ix.Certified.SourceMeaning
+
+namespace Tests.Certified.Fidelity
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Ix.Kernel Serialize
+open Lean (toJson)
+
+set_option maxRecDepth 32768
+set_option maxHeartbeats 32000000
+
+def whole (source : Ixon.Constant) : Ixon.Constant :=
+  match source.info with
+  | .defn value => { source with
+      info := .defn { value with typ := .share 0, value := .share 1 },
+      sharing := #[value.typ, value.value] }
+  | _ => source
+
+def base := whole Fixtures.identity
+
+def nested : Ixon.Constant :=
+  match base.info with
+  | .defn value => { base with
+      info := .defn { value with typ := .share 2, value := .share 3 },
+      sharing := base.sharing ++ #[.share 0, .share 1] }
+  | _ => base
+
+def permuted : Ixon.Constant :=
+  match base.info with
+  | .defn value => { base with
+      info := .defn { value with typ := .share 1, value := .share 0 },
+      sharing := #[Corpus.idBody 0, Corpus.idType 0] }
+  | _ => base
+
+def underBinders : Ixon.Constant :=
+  match base.info with
+  | .defn value => { base with
+      info := .defn { value with
+        typ := .leanAll (.sort 0) (.share 0), value := .leanLam (.sort 0) (.share 1) },
+      sharing := #[.leanAll (.var 0) (.var 1), .leanLam (.var 0) (.var 0)] }
+  | _ => base
+
+def input (name : String) (source : Ixon.Constant) (dependencies : List Ixon.Constant := []) : Case :=
+  let c := Corpus.one name source dependencies
+  { name, profile := Fixtures.profile, target := c.target, blobs := c.blobs,
+    literals := [], references := [], blocks := c.blobs.map fun (a, _) => (0, a) }
+
+def positive : List Case := [
+  input "sharing-whole-identity" base,
+  input "sharing-nested-identity" nested,
+  input "sharing-permuted-identity" permuted,
+  input "sharing-under-binders" underBinders,
+  input "sharing-beta-statement" (whole Corpus.betaStatement),
+  input "sharing-eta-statement" (whole Corpus.etaStatement),
+  input "sharing-dependent-polymorphic" (whole (Corpus.dependent 1 (.var 0))),
+  input "sharing-defined-polymorphic-use" (whole (Corpus.polyUse .defn true)) [Corpus.polyId .defn]
+]
+
+#guard positive.length = 8
+#guard positive.all Source.accepted
+#guard positive.all Source.storeAccepted
+#guard positive.all Source.ixeAccepted
+#guard positive.all Source.warmAndRollback
+
+def negative : List Case := [
+  input "sharing-out-of-bounds" { base with sharing := #[.share 999, Corpus.idBody 0] },
+  input "sharing-self-cycle" { base with sharing := #[.share 0, Corpus.idBody 0] },
+  input "sharing-mutual-cycle" { base with sharing := #[.share 1, .share 0] },
+  input "sharing-altered-statement" { base with
+    sharing := #[.ref 0 #[], Corpus.idBody 0], refs := #[Fixtures.falseObject.1] },
+  input "sharing-linear-body" { base with
+    sharing := #[Corpus.idType 0, .lam .linear (.sort 0) (.leanLam (.var 0) (.var 0))] },
+  input "sharing-missing-universe" { base with univs := #[] },
+  input "sharing-free-variable" { base with sharing := #[Corpus.idType 0, .var 0] },
+  input "sharing-missing-reference" { base with sharing := #[Corpus.idType 0, .ref 999 #[]] }
+]
+
+/-- The control certificate checks the complete original declaration at the
+altered address. It is then submitted to the actual authenticated source
+gate, so witness-search refusal cannot explain these rejections. -/
+def validControlRejected (c : Case) : Bool := Id.run do
+  let some objects := decodeObjects? c.blobs | return false
+  let original := objects.map fun (a, value) => (a, if a = c.target then base else value)
+  let some signature := readSignature? c.profile original | return false
+  let some prepared := readProofInput? 6400 original c.target | return false
+  let some witness := Ix.Theory.Certificate.proofWitness? 6400 signature prepared | return false
+  return acceptsCertified.{0,0} 6400 signature prepared witness &&
+    !acceptsCertifiedSource.{0} 6400 (Source.source c) c.profile c.target (Source.selection c) witness &&
+    !acceptsCertifiedStoreSource.{0} 6400 (Source.source c) c.profile [c.target] (Source.selection c) witness.declarations
+
+#guard negative.length = 8
+#guard negative.all validControlRejected
+
+/-- Equal expanded statements do not identify their different wire encodings.
+The current bytes must still authenticate under the exact requested address. -/
+def distinctEncoding : Bool := Id.run do
+  let first := input "first" base
+  let second := input "second" permuted
+  if first.target = second.target then return false
+  let some a := prepare? 6400 first.profile first.target first.blobs | return false
+  let some b := prepare? 6400 second.profile second.target second.blobs | return false
+  if a.input.proposition != b.input.proposition then return false
+  let some witness := suggestSource? 6400 (Source.source first) first.profile first.target (Source.selection first)
+    | return false
+  let some value := (Source.source second).consts.get? second.target | return false
+  let changed := { (Source.source first) with
+    consts := (Source.source first).consts.insert first.target value }
+  return !acceptsCertifiedSource.{0} 6400 changed first.profile first.target (Source.selection first) witness
+
+#guard distinctEncoding
+
+def run (directory : Option System.FilePath) : IO Unit := do
+  for c in positive do
+    unless Source.accepted c && Source.storeAccepted c && Source.ixeAccepted c && Source.warmAndRollback c do
+      throw (IO.userError s!"source fidelity acceptance failed: {c.name}")
+    if let some directory := directory then Source.writeCase directory c
+  for c in negative do
+    unless validControlRejected c do throw (IO.userError s!"source fidelity mutation escaped: {c.name}")
+    if let some directory := directory then Source.writeCase directory c
+  unless distinctEncoding do throw (IO.userError "semantic equality was used as byte identity")
+  IO.println <| (Lean.Json.mkObj [
+    ("proofAccepted", toJson positive.length), ("storesAccepted", toJson positive.length),
+    ("ixeAccepted", toJson positive.length), ("warmProofScenarios", toJson positive.length),
+    ("validControlSourceMutationsRejected", toJson negative.length),
+    ("distinctEncodingRejected", toJson distinctEncoding), ("unexpectedErrors", toJson (0 : Nat))]).compress
+
+end Tests.Certified.Fidelity
diff --git a/Tests/Certified/FidelityMain.lean b/Tests/Certified/FidelityMain.lean
new file mode 100644
index 000000000..3076e1835
--- /dev/null
+++ b/Tests/Certified/FidelityMain.lean
@@ -0,0 +1,13 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Fidelity
+
+def main (args : List String) : IO UInt32 := do
+  if args.length > 1 then
+    IO.eprintln "usage: certified-fidelity-tests [OUTPUT_DIRECTORY]"
+    return 2
+  Tests.Certified.Fidelity.run (args.head?.map System.FilePath.mk)
+  return 0
diff --git a/Tests/Certified/ImportManifest.lean b/Tests/Certified/ImportManifest.lean
new file mode 100644
index 000000000..8d8478c8c
--- /dev/null
+++ b/Tests/Certified/ImportManifest.lean
@@ -0,0 +1,80 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+/-! Frozen cumulative C2-C7 adapter identities. The archive includes the original
+patches, source identities, reports and differential corpora. Maintained code
+uses Ix.Theory and Ix.Kernel; five audits now traverse full checked declarations.
+The unused historical native profiling counters are preserved but not imported. -/
+
+namespace Tests.Certified.ImportManifest
+
+def archive : String := "Tests/Fixtures/Certified/c7-handoff.tar.gz"
+def archiveSha256 : String := "94d7b43e2942f9a9f5c3407964905beddb834b8223ce9eb52d8df494fb17faf0"
+def ixBaseRevision : String := "3e7586a7adb0c6f3cd3ff5854da832701288ec90"
+
+structure SourceFile where
+  source : String
+  target : Option String
+  sourceSha256 : String
+  importedSha256 : String
+  deriving Repr
+
+def selected : Array SourceFile := #[
+  ⟨"Ix/Certified/Audit.lean", some "Ix/Certified/Audit.lean", "06635e487e0db2bbe57f110245c0dc6e2a9c633ebfe074797567e114da8aec52", "793ea6e189ab20f68120c58d4d5483c08124715c67ffa511424c1522e249080f"⟩,
+  ⟨"Ix/Certified/Bytes.lean", some "Ix/Certified/Bytes.lean", "5b01039400a830a3f80420cb011cb76c6a52511b901905f4bf7f811e19986328", "f34bea30bdf4735f5c7779a74189fdb6ec3a36db2095bdc057e207f6fbf81535"⟩,
+  ⟨"Ix/Certified/ClaimAccept.lean", some "Ix/Certified/ClaimAccept.lean", "0c179bd4ea2c1a9d8a3b239ffe2feb60b88038f8f9f09c5d9fd8e1e83011f981", "198d8b9b436b937c311bf7ae7e47d4523bdc80022447e42dcc03a131fb01ef38"⟩,
+  ⟨"Ix/Certified/ClaimAudit.lean", some "Ix/Certified/ClaimAudit.lean", "8916803f12bb53e22fa1c94318a6b2a736ec9634ffae811f710b579d3d278bf4", "363f6524397b56c2225d2bdc5cadee29522959d043cfa8a5ace854078a5c30bb"⟩,
+  ⟨"Ix/Certified/ClaimCheck.lean", some "Ix/Certified/ClaimCheck.lean", "e4d598badcb189897a339e187b9529658e2ef75445645e1463704cc6b349a196", "8f8f6c94581ed08c8b8b00d3157bd351e7aed29cd8aa53e491cb53dc48e8845f"⟩,
+  ⟨"Ix/Certified/ClaimCommand.lean", some "Ix/Certified/ClaimCommand.lean", "8f360b0d0a586ab15e3b8bb3a375f5dc56ad6157344295a67673d876bf8650eb", "e053cb7bab6e1ca19e36de92bcb44c60be9764fc30ab160b92224f4703a4fb4d"⟩,
+  ⟨"Ix/Certified/ClaimInput.lean", some "Ix/Certified/ClaimInput.lean", "d2d0df3ef446690600e843c84683a8f2056e1d8a843a523fc57b550763963f32", "861b0cfd3a1dac9c683dbd1b71088065a00d9a47be9ddbdce304722271027451"⟩,
+  ⟨"Ix/Certified/ClaimMain.lean", some "Ix/Certified/ClaimMain.lean", "ed1f1b0edaec4e0928d90a814f35673a8989e55037c9cc023a6e0e287c7574e7", "ed1f1b0edaec4e0928d90a814f35673a8989e55037c9cc023a6e0e287c7574e7"⟩,
+  ⟨"Ix/Certified/ClaimMeaning.lean", some "Ix/Certified/ClaimMeaning.lean", "78edb69d209768d8010b28b16d334fd2fa8bc6225490f9b2bbe5fd66cc906f36", "5f2550f0235fe84927d654a360a4298f426e7ca2e7911245c84f91dbd11eef6f"⟩,
+  ⟨"Ix/Certified/ClaimSuggest.lean", some "Ix/Certified/ClaimSuggest.lean", "5f83e6b65542661c4efacd6389c5c6ca0a0eeaffb2d0d24cb58168be514a10f6", "285ed4b14540aa47afa67e28f20bc44e7fdce93fd94d0742971711f15df8336b"⟩,
+  ⟨"Ix/Certified/Command.lean", some "Ix/Certified/Command.lean", "f9f8a32be2761dc97bf7215585cde40b0e310153482707a570f7c1a106252abe", "c6803f699ed2edd6508e2db73b55f4abb163f6425bcf6b755da11b885991ad17"⟩,
+  ⟨"Ix/Certified/Corpus.lean", some "Ix/Certified/Corpus.lean", "fc1d66c81430461bed9e0045e6a26a1e01c85de90854eccea2343f24fe5dde97", "fc1d66c81430461bed9e0045e6a26a1e01c85de90854eccea2343f24fe5dde97"⟩,
+  ⟨"Ix/Certified/Envelope.lean", some "Ix/Certified/Envelope.lean", "da0269803ff6f48c6d0347627d57a7f7699c0ea06e54f959406e3d8570a326f1", "da0269803ff6f48c6d0347627d57a7f7699c0ea06e54f959406e3d8570a326f1"⟩,
+  ⟨"Ix/Certified/Fixtures.lean", some "Ix/Certified/Fixtures.lean", "fe7a503a0e436a2ecf924b48d9b66ed3f6ef901c7bcbe6098853c62c7748675a", "f85f883f498cdee55ab674876dd1fb19bae5dbe8aa729118cffd29ab626c8b25"⟩,
+  ⟨"Ix/Certified/Ingress.lean", some "Ix/Certified/Ingress.lean", "1fe00c0a512ae94fddd2847196f1bafa415ff2c452412f0e69e9e060883dd0cf", "afd9e82827fed62d453c3979fbfdb1238f83573f19af3b6728574f97ff1a86a4"⟩,
+  ⟨"Ix/Certified/Ixon.lean", some "Ix/Certified/Ixon.lean", "9b7f0d64f08c03ed3a215ff5b23e136bd85c71f953e9198fb940b597d7b54410", "5e37eaa6b5cb872edad7954cde413706f30996950c71d21417174f8166377bcb"⟩,
+  ⟨"Ix/Certified/Main.lean", some "Ix/Certified/Main.lean", "c571357f5e1120efbe23c7db4906fc3eeaebffccf2956e1899212494800d38a5", "c571357f5e1120efbe23c7db4906fc3eeaebffccf2956e1899212494800d38a5"⟩,
+  ⟨"Ix/Certified/ModelHints.lean", some "Ix/Certified/ModelHints.lean", "74fd6763d56ac5c8aa9af4507172879739c2dc681969a3f342aadbc30ab27837", "de098f48fc03893643c8de08c3bf2bed315f91767c71e9e229816784abb8f124"⟩,
+  ⟨"Ix/Certified/ModeledAudit.lean", some "Ix/Certified/ModeledAudit.lean", "55101ebfee84fd89e4c99f08d88aac7edb7000302ef6d022a8c639e331fb3ec2", "c37969f6a69e11d62547bc91b685695cd08f002c115db70a05069f34fe111de1"⟩,
+  ⟨"Ix/Certified/Native.lean", none, "7b617483cbeef932b9caaf6ca3e118be93e5621aaf1ca6bb8132821b336b1c82", ""⟩,
+  ⟨"Ix/Certified/Packet.lean", some "Ix/Certified/Packet.lean", "a694ff77c95d6fe3bd31b99e28597769604b901926d4e0a3dfea7802fb57711d", "001f59925175f865d86263a3e3395b1ee913acfd2c5027f35911de6dc380ce44"⟩,
+  ⟨"Ix/Certified/Reveal.lean", some "Ix/Certified/Reveal.lean", "2d31e94a72208eddbd52e51ff819131430e374403e8411a9fd90b909f965af2b", "2d31e94a72208eddbd52e51ff819131430e374403e8411a9fd90b909f965af2b"⟩,
+  ⟨"Ix/Certified/SourceAudit.lean", some "Ix/Certified/SourceAudit.lean", "fb916b0e7eede60d3d225d7fd8045acf175dc327e83c8705379fd01a52c7866f", "5cfe1d6492cd5c11c5be9af28d77673b283feec8fbf86959762183e1e39d184b"⟩,
+  ⟨"Ix/Certified/SourceExpr.lean", some "Ix/Certified/SourceExpr.lean", "f4de024bc68cb991bbad57bbe0d1c147cfe32329fb9a34dc91a4dbde1177f805", "03417c4f256de2158e71407560d60abeaf77bbacd00533654c67c9c5b4f63334"⟩,
+  ⟨"Ix/Certified/SourceMeaning.lean", some "Ix/Certified/SourceMeaning.lean", "69f916348389e4e7d93b67b3d2c3d8abf8e30b89b417de828620627c6012209a", "f96eedf1b7d46564f6c3abf0bf3450bffb5ffca85a68071f567d75837c84ee14"⟩,
+  ⟨"Ix/Certified/SourceStore.lean", some "Ix/Certified/SourceStore.lean", "7b963da22cb0d2199ce4bf02353cfff0a6e8a3d571a82e19b3c9edb99336d545", "390d260608e9f4f638758751306e1cf06d4a129379a4ebcf902f5873969d832d"⟩,
+  ⟨"Ix/Certified/Store.lean", some "Ix/Certified/Store.lean", "23cd4434c7e1f1784a438bdeecd66378bda1ad280f28f452cb6d51443dd7e3be", "86394770b2c96176e7478a6cdd64bc0a1057b30968b4301030ffdb59751ad733"⟩,
+  ⟨"Ix/Certified/Suggest.lean", some "Ix/Certified/Suggest.lean", "cec35a4826b6b6d55bbcf62563d99d192bcb511a25c9d00be7d4341c64189d53", "214b6a2652c46ee93720a8a6f017268f7f06173cfa2e146ce6c067f08b0fa861"⟩,
+  ⟨"Ix/Certified/TcAudit.lean", some "Ix/Certified/TcAudit.lean", "a0c0177157fa1a4a891f80e3aa437901a48c2c3814bc66cb26eeaaf5808f6862", "1bf7f93099baff8dde83fb96efd6af8c0927d0eba584c145d11cd3dcf8674629"⟩,
+  ⟨"Ix/Certified/Trees.lean", some "Ix/Certified/Trees.lean", "cf96fa2ee3ea6263c62c630c848b8f90449d8380a454ba291ed5e7e67011c3a5", "cf96fa2ee3ea6263c62c630c848b8f90449d8380a454ba291ed5e7e67011c3a5"⟩,
+  ⟨"Ix/IxVM/Certified/Accept.lean", some "Ix/IxVM/Certified/Accept.lean", "8c35df5d77369c3bc77747fa872399da1b9709fdfb53f28623809cea60637e71", "8c35df5d77369c3bc77747fa872399da1b9709fdfb53f28623809cea60637e71"⟩,
+  ⟨"Ix/IxVM/Certified/Checker.lean", some "Ix/IxVM/Certified/Checker.lean", "7da05836aa7701570a6cc35c0dd856ff0ce1b09cfbce58cbec942e9a066c76a3", "6510807d8f49f970fe799898c63898f2c0df40a0d5361682eb2fa9c1b5b4e4bf"⟩,
+  ⟨"Ix/IxVM/Certified/Expr.lean", some "Ix/IxVM/Certified/Expr.lean", "63906b989d6ade2f3a8b72c3e84c68e887a857227a9f3bacf6a94a6c873a9a1b", "63906b989d6ade2f3a8b72c3e84c68e887a857227a9f3bacf6a94a6c873a9a1b"⟩,
+  ⟨"Ix/IxVM/Certified/Levels.lean", some "Ix/IxVM/Certified/Levels.lean", "c59aea708f0ef66dc61d32754fa3956e597268514917546cd9ce48a1cce71be4", "c59aea708f0ef66dc61d32754fa3956e597268514917546cd9ce48a1cce71be4"⟩,
+  ⟨"Ix/IxVM/Certified/Read.lean", some "Ix/IxVM/Certified/Read.lean", "6e25a90521af8c0dc1ba9dfb9c849a2dd4e95854484688461f1962c85f1bc650", "6e25a90521af8c0dc1ba9dfb9c849a2dd4e95854484688461f1962c85f1bc650"⟩,
+  ⟨"Ix/IxVM/Certified/Types.lean", some "Ix/IxVM/Certified/Types.lean", "a5bc3333435eee693e5c2af7b444c4ea5de8ca56f9aed37dde6e80f23690a87a", "a5bc3333435eee693e5c2af7b444c4ea5de8ca56f9aed37dde6e80f23690a87a"⟩,
+  ⟨"Ix/Tc/Certified.lean", some "Ix/Kernel/Certified.lean", "ef7be3a4a372fe1c781c4d3e407fd14c55ba0f9289392ab7e8ab5806972ad90b", "cf7d2b617336af369fa5678bcfede46c6e4a9a06f91d5334c8b7b8a6a3b85f2c"⟩,
+  ⟨"Ix/Tc/CertifiedClaims.lean", some "Ix/Kernel/CertifiedClaims.lean", "ef79fbdc511c9ae90b729e639f0d57a54f68e40caab1f66d84ebba35501a30a6", "fa6d66105ade421b155c76165f7ad77c900313120e8436ce563b16e0f2451421"⟩,
+  ⟨"Tests/Certified/Claims.lean", some "Tests/Certified/Claims.lean", "1a678f07b5645c1f88ff07028793663c37ab74164759953dab5a2a3e311c6a22", "1b358ef41f6b701ca1dad5f309f65e9931a2fe120aa5e22f4feae7500535db49"⟩,
+  ⟨"Tests/Certified/ClaimsMain.lean", some "Tests/Certified/ClaimsMain.lean", "01f900c1a61940910c7131fc42a3757d2f7ea1a508f55668f6d54da8ee6eb136", "01f900c1a61940910c7131fc42a3757d2f7ea1a508f55668f6d54da8ee6eb136"⟩,
+  ⟨"Tests/Certified/FeatureCases.lean", some "Tests/Certified/FeatureCases.lean", "d68e7731b4864cdf823bdcf94af492158bf8f9a4da3d5dcfc659cf8582795591", "ed4088ddc98d36b97e7fe1c00b63cb2e7f814503d62a6060712eefa4405ac233"⟩,
+  ⟨"Tests/Certified/Features.lean", some "Tests/Certified/Features.lean", "65b70e67a51698b4921c6592419658e8b528ac544cdd1b0fedc84a69effa9470", "65b70e67a51698b4921c6592419658e8b528ac544cdd1b0fedc84a69effa9470"⟩,
+  ⟨"Tests/Certified/Fidelity.lean", some "Tests/Certified/Fidelity.lean", "7d8fdea26a63bc94ace55943f6c062340ab3b263867ecd21705c70b288784946", "b64958afa2dfbdb90de98f6a0908a8aa18c78f944bcfd6060db317636c8c4f9a"⟩,
+  ⟨"Tests/Certified/FidelityMain.lean", some "Tests/Certified/FidelityMain.lean", "47dbf7899235312d4ea171879940cf6eb98028eccbbdaeaa86b8a41a6449bb17", "47dbf7899235312d4ea171879940cf6eb98028eccbbdaeaa86b8a41a6449bb17"⟩,
+  ⟨"Tests/Certified/ModelSerialize.lean", some "Tests/Certified/ModelSerialize.lean", "d470f6a95bc48ccc65f141d90abb99d2211ba82b9fa3b9d13e42f7698c755f2b", "86f064fcdd3940bd1385463a6ad65e2a455e5de8950eb025ffbae0397c8cd3e2"⟩,
+  ⟨"Tests/Certified/Modeled.lean", some "Tests/Certified/Modeled.lean", "772dcd81eee47d73bbd40b25d068ce4e2f209df6fe22740db456c0b5e6e6353a", "37b14d02dd0f99b8a057e6c1d162932e7e8a2cc023043b4bd0989cdffbe93a95"⟩,
+  ⟨"Tests/Certified/ModeledAdversarial.lean", some "Tests/Certified/ModeledAdversarial.lean", "6147577fa6afdf0b2f05813462c99c32846443717eaea86cfbf6547d42b82e42", "b9cf6da28961c0b582be0d12225c64d907854f363f7d81b45eae54b225a546bf"⟩,
+  ⟨"Tests/Certified/ModeledMain.lean", some "Tests/Certified/ModeledMain.lean", "459171f71e7d845d1aadead559b1224a07b4d86e9be7ff97f5182fd1a88b974d", "459171f71e7d845d1aadead559b1224a07b4d86e9be7ff97f5182fd1a88b974d"⟩,
+  ⟨"Tests/Certified/Ordinary.lean", some "Tests/Certified/Ordinary.lean", "59cbe0be253cda1854481989f9d02d44624db0fa3493dd7dac9cdf68480e0684", "abd822059c97677fe10482ffcaba9dbb2490f6aa94b870b7f6e6ebfbf58b0f50"⟩,
+  ⟨"Tests/Certified/Serialize.lean", some "Tests/Certified/Serialize.lean", "ef9286ca27377f034c97e8549e91484e67612aeb83dc0baf1926dff640d07f74", "593acdcb84d7d350bc258df2ad841233e946bf123583f844b516a45669a71af2"⟩,
+  ⟨"Tests/Certified/Source.lean", some "Tests/Certified/Source.lean", "78a98301be394278ad90d55599aa1deba55f9463b735626c4cc1965a01200ce0", "7137e1f76267cf4b01848c917dc5754a792e872b9553d828793af061b61e27a8"⟩,
+  ⟨"Tests/Certified/SourceMain.lean", some "Tests/Certified/SourceMain.lean", "5a07d03d9f3e37b5e6e3fd84af66241c2e530054fa01c8157a8f938172c84d58", "5a07d03d9f3e37b5e6e3fd84af66241c2e530054fa01c8157a8f938172c84d58"⟩,
+  ⟨"Tests/Certified/VM.lean", some "Tests/Certified/VM.lean", "7699c996e3238243314318ef63c7e4436bce81264420d9db231b19535552a828", "d3497e3244742d286fc9272e3ead84c2521f079ce97ab0c2323f5c1dd3bc6661"⟩
+]
+
+end Tests.Certified.ImportManifest
diff --git a/Tests/Certified/ModelSerialize.lean b/Tests/Certified/ModelSerialize.lean
new file mode 100644
index 000000000..6f7709f0b
--- /dev/null
+++ b/Tests/Certified/ModelSerialize.lean
@@ -0,0 +1,113 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Serialize
+import Ix.Certified.ModelHints
+
+/-! General test serializer for complete mutual blocks, including recursors
+and every public member/constructor projection. All model declarations are
+ordinary source objects in the same authenticated .ixe environment. -/
+
+namespace Tests.Certified.ModelSerialize
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Serialize
+
+def mutualInfo (self : Nat) (resolve : ConstRef Nat → Option Address) (source : Const Nat) :
+    Write Ixon.MutConst := do
+  match ← constantInfo self resolve source with
+  | .muts #[.indc family] => return .indc family
+  | .defn definition => return .defn definition
+  | .recr recursor => return .recr recursor
+  | _ => failure
+
+def block (self : Nat) (resolve : ConstRef Nat → Option Address) (source : Block Nat) :
+    Option (Ixon.Constant × ConstantBlobs) := do
+  let action : Write Ixon.ConstantInfo := match source.members with
+    | [member] => constantInfo self resolve member
+    | [] => failure
+    | members => return .muts (← members.mapM (mutualInfo self resolve)).toArray
+  let (info, tables) ← action {}
+  return (⟨info, #[], tables.refs, tables.univs⟩, tables.literals)
+
+def memberProjection? (kind : ConstKind) (index : Nat) (address : Address) : Option Ixon.Constant :=
+  match kind with
+  | .induct => some ⟨.iPrj ⟨index.toUInt64, address⟩, #[], #[], #[]⟩
+  | .recursor => some ⟨.rPrj ⟨index.toUInt64, address⟩, #[], #[], #[]⟩
+  | .defn _ => some ⟨.dPrj ⟨index.toUInt64, address⟩, #[], #[], #[]⟩
+  | _ => none
+
+/-- The finite domain is in source dependency order; unused empty slots are
+omitted. Every nonempty member and source field is serialized literally. -/
+def make? (name : String) (signature : PrimitiveSignature Nat) (input : ProofInput Nat) : Option Case := do
+  if 900 ∈ input.store.dom then none else do
+    let mut blobs : ConstantBlobs := []
+    let mut literals : ConstantBlobs := []
+    let mut references : List (ConstRef Nat × Address) := []
+    let mut blocks : List (Nat × Address) := []
+    for b in input.store.dom do
+      let source ← input.store.blocks b
+      if !source.members.isEmpty then
+        let (raw, extra) ← block b (reference references) source
+        let encoded := Fixtures.encode raw
+        blobs := blobs ++ [encoded]
+        literals := literals ++ extra
+        blocks := blocks ++ [(b, encoded.1)]
+        for (member, index) in source.members.zipIdx do
+          let address ← match raw.info with
+            | .muts _ => do
+              let projection ← memberProjection? member.kind index encoded.1
+              let projection := Fixtures.encode projection
+              blobs := blobs ++ [projection]
+              pure projection.1
+            | _ => pure encoded.1
+          references := references ++ [(.member b index, address)]
+          match member with
+          | .induct _ _ _ _ ctors _ =>
+            for ctor in List.range ctors.length do
+              let projection := Fixtures.encode ⟨.cPrj ⟨index.toUInt64, ctor.toUInt64, encoded.1⟩, #[], #[], #[]⟩
+              blobs := blobs ++ [projection]
+              references := references ++ [(.ctor b index ctor, projection.1)]
+          | _ => pure ()
+    let (raw, extra) ← constant 900 (reference references)
+      (.defn input.universes .theorem input.proposition input.proof .safe)
+    let target := Fixtures.encode raw
+    let falseType ← reference references signature.falseType
+    let falseElim ← reference references signature.falseElim
+    let natType ← signature.natType.mapM (reference references)
+    return ⟨name, ⟨falseType, falseElim, natType⟩, target.1, uniqueBlobs (blobs ++ [target]),
+      uniqueBlobs (literals ++ extra), references ++ [(.member 900 0, target.1)], blocks ++ [(900, target.1)]⟩
+
+def hint? (c : Case) (candidate : Certificate.Modeled.Candidate Nat) : Option ModelHint := do
+  let source ← ((c.blocks.find? (fun (key, _) => key = candidate.source)).map Prod.snd)
+  let recursors ← candidate.recursors.mapM (reference c.references)
+  let targets ← candidate.models.mapM (reference c.references)
+  let proofs ← candidate.proofs.mapM fun (owner, proofs) => do
+    let owner ← reference c.references owner
+    let proofs ← proofs.mapM fun proof => proof.mapM fun proof => do
+      let .const term _ := proof.proof | none
+      return (⟨← reference c.references proof.equality, ← reference c.references proof.reflexivity,
+        ← reference c.references proof.recursor, ← reference c.references term⟩ : ModelProofHint)
+    return (⟨owner, proofs⟩ : ModelRuleHints)
+  return ⟨source, recursors, targets, proofs⟩
+
+/-- Reconstruct every original mutual member at the mutated wire addresses.
+This deliberately unauthenticated control is used only to obtain a complete,
+valid certificate before attacking the authenticated acceptance gate. -/
+def repaired? (c : Case) (original : ProofInput Nat) : Option PreparedInput := do
+  let prepared ← prepare? 6400 c.profile c.target c.blobs c.literals
+  let mapping := fun b => ((c.blocks.find? fun (key, _) => key = b).map Prod.snd).getD c.target
+  let originals := c.blocks.map fun (b, a) => (a, (if b = 900 then
+    some (⟨[.defn original.universes .theorem original.proposition original.proof .safe]⟩ : Block Nat)
+    else original.store.blocks b).map (fun source =>
+      (⟨source.members.map (renameConstant mapping)⟩ : Block Address)))
+  let old := prepared.input.store
+  let store : Store Address := {
+    dom := old.dom, nodup := old.nodup,
+    blocks := fun a => (old.blocks a).map fun block => ((lookup originals a).join).getD block,
+    mem_dom := by intro a; simp [old.mem_dom] }
+  let .defn _ _ proposition proof _ ← store.lookup (.member c.target 0) | none
+  return { prepared with input := { prepared.input with store, proposition, proof } }
+
+end Tests.Certified.ModelSerialize
diff --git a/Tests/Certified/Modeled.lean b/Tests/Certified/Modeled.lean
new file mode 100644
index 000000000..2c73857b0
--- /dev/null
+++ b/Tests/Certified/Modeled.lean
@@ -0,0 +1,147 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.FeatureCases
+import Tests.Certified.ModelSerialize
+import Tests.Certified.Claims
+import Ix.Certified.Command
+import Tests.Theory.ModeledNested
+import Tests.Theory.ModeledPermutation
+import Tests.Theory.ModeledEquations
+
+/-! C7 exercises actual canonical mutual Ixon blocks, lazy .ixe loading,
+checked model declarations, public TcM execution and versioned claims. -/
+
+namespace Tests.Certified.Modeled
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Ix.Kernel Serialize
+open Tests.Theory.Certified (primitives)
+open Lean (toJson)
+
+set_option maxRecDepth 32768
+set_option maxHeartbeats 64000000
+
+def fuel := 6400
+
+structure Scenario where
+  name : String
+  input : ProofInput Nat
+  candidate : Certificate.Modeled.Candidate Nat
+
+def scenarios : List Scenario := [
+  ⟨"mutual-unequal", Tests.Theory.Modeled.input, Tests.Theory.Modeled.candidate⟩,
+  ⟨"mutual-permuted", Tests.Theory.ModeledPermutation.input, Tests.Theory.ModeledPermutation.candidate⟩,
+  ⟨"auxiliary-merged", Tests.Theory.ModeledPermutation.mergedInput, Tests.Theory.ModeledPermutation.mergedCandidate⟩,
+  ⟨"nested-parameter", Tests.Theory.ModeledNested.input false, Tests.Theory.ModeledNested.candidate⟩,
+  ⟨"nested-recursive-Pi", Tests.Theory.ModeledNested.input true, Tests.Theory.ModeledNested.candidate⟩,
+  ⟨"propositional-equations", Tests.Theory.ModeledEquations.input, Tests.Theory.ModeledEquations.candidate⟩]
+
+structure Fixture where
+  scenario : Scenario
+  source : Case
+  model : ModelHint
+
+def fixture? (scenario : Scenario) : Option Fixture := do
+  let source ← ModelSerialize.make? scenario.name primitives scenario.input
+  let model ← ModelSerialize.hint? source scenario.candidate
+  return ⟨scenario, source, model⟩
+
+def Fixture.request (f : Fixture) : Command.Request :=
+  ⟨f.source.profile, f.source.target, Source.subjects f.source, Source.selection f.source, [f.model]⟩
+
+def requestJson (request : Command.Request) : Lean.Json := Lean.Json.mkObj [
+  ("falseType", toJson (hexOfBytes request.profile.falseType.hash)),
+  ("falseElim", toJson (hexOfBytes request.profile.falseElim.hash)),
+  ("natType", toJson (request.profile.natType.map (hexOfBytes ·.hash))),
+  ("target", toJson (hexOfBytes request.target.hash)),
+  ("subjects", toJson (request.subjects.map (hexOfBytes ·.hash))),
+  ("objects", toJson (request.selection.objects.map (hexOfBytes ·.hash))),
+  ("naturals", toJson (request.selection.naturals.map (hexOfBytes ·.hash))),
+  ("models", toJson (request.models.map ModelHint.json))]
+
+def sourceAccepted (f : Fixture) : Bool := Id.run do
+  let some (_, env) := Source.loadedIxe? f.source | return false
+  let .ok request := Command.readRequest (requestJson f.request) | return false
+  return (Command.run.{0} "proof" fuel env request).isOk && (Command.run.{0} "store" fuel env request).isOk
+
+def pilotDeclines (f : Fixture) : Bool := Id.run do
+  let some prepared := prepare? fuel f.source.profile f.source.target f.source.blobs f.source.literals | return false
+  let some models := modelCandidates? (decodeObjects? f.source.blobs |>.getD []) prepared.input.store [f.model] | return false
+  let some witness := Certificate.proofWitness? fuel prepared.signature prepared.input models | return false
+  return !(Packet.words prepared.signature prepared.input witness).isOk
+
+/-- Poisoned legacy caches do not skip either a model declaration or an
+equation proof. Failed model checks leave the actual byte cache unchanged. -/
+def warmAndRollback (f : Fixture) : Bool := Id.run do
+  let some (_, env) := Source.loadedIxe? f.source | return false
+  let c := f.source
+  let count := c.blobs.length + c.literals.length
+  let some witness := suggestSource? fuel env c.profile c.target (Source.selection c) [f.model] | return false
+  let .ok _ cold := (certifiedStep.{0} fuel env c.profile c.target (Source.selection c) witness).run initialCertifiedState
+    | return false
+  if cold.inputCache.misses != count || cold.inputCache.hits != 0 then return false
+  let start := { cold with checker := Source.poisonedChecker c }
+  let .ok _ warm := (certifiedStep.{0} fuel env c.profile c.target (Source.selection c) witness).run start | return false
+  if warm.inputCache.hits != count || warm.inputCache.misses != count then return false
+  let bad := { witness with declarations := witness.declarations.map fun declaration => match declaration with
+    | .modeled model => .modeled { model with equations := model.equations.map (fun proofs =>
+        proofs.map (fun proof => { proof with proof := .conversion .refl })) }
+    | declaration => declaration }
+  let .error _ failed := (certifiedStep.{0} fuel env c.profile c.target (Source.selection c) bad).run warm | return false
+  if failed.inputCache.hits != warm.inputCache.hits || failed.inputCache.misses != warm.inputCache.misses then return false
+  let .error _ exhausted := (certifiedStep.{0} 0 env c.profile c.target (Source.selection c) witness).run failed | return false
+  if exhausted.inputCache.hits != warm.inputCache.hits || exhausted.inputCache.misses != warm.inputCache.misses then return false
+  let .ok _ retry := (certifiedStep.{0} fuel env c.profile c.target (Source.selection c) witness).run exhausted | return false
+  return retry.inputCache.hits == 2 * count && retry.inputCache.misses == count
+
+def checkClaim? (f : Fixture) : Option Claims.Fixture :=
+  Claims.finish? s!"{f.scenario.name}-check" f.source (.check f.source.target none)
+    ⟨Source.selection f.source, [⟨.check f.source.target none, none, none⟩], none, none, none, none, [f.model]⟩
+
+def environmentClaim? (f : Fixture) : Option Claims.Fixture := do
+  let subjects := Claims.tree (Source.subjects f.source)
+  let claim := Ix.Claim.checkEnv (treeRoot subjects) none
+  Claims.finish? s!"{f.scenario.name}-environment" f.source claim
+    ⟨Source.selection f.source, [⟨claim, some (treeBytes subjects), none⟩],
+      some (treeBytes subjects), none, none, none, [f.model]⟩
+
+def sharedClaim? (f : Fixture) : Option Claims.Fixture := do
+  let model ← f.model.targets.getLast?
+  let subjects := Claims.tree [model, f.source.target]
+  let claim := Ix.Claim.checkEnv (treeRoot subjects) none
+  Claims.finish? s!"{f.scenario.name}-shared-model" f.source claim
+    ⟨Source.selection f.source, [⟨.check model none, none, none⟩, ⟨.check f.source.target none, none, none⟩],
+      some (treeBytes subjects), none, none, none, [f.model]⟩
+
+def claimCases? (f : Fixture) : Option (List Claims.WireCase) := do
+  let fixtures ← [checkClaim? f, environmentClaim? f, sharedClaim? f].mapM id
+  return fixtures.flatMap fun fixture => [
+    ⟨fixture.name, fixture.source, fixture.envelope, .logical fixture.hint, true⟩,
+    ⟨s!"{fixture.name}-old-checker", fixture.source,
+      { fixture.envelope with protocol := { fixture.envelope.protocol with checker := 1 } },
+      .logical fixture.hint, false⟩]
+
+def writeSource (directory : System.FilePath) (f : Fixture) : IO Unit := do
+  let directory := directory / f.scenario.name
+  IO.FS.createDirAll directory
+  let some (bytes, _) := Source.loadedIxe? f.source | throw (IO.userError "cannot write modeled .ixe")
+  IO.FS.writeBinFile (directory / "source.ixe") bytes
+  IO.FS.writeFile (directory / "request.json") ((requestJson f.request).pretty ++ "\n")
+  IO.FS.writeFile (directory / "expected.json")
+    ((Lean.Json.mkObj [("proof", toJson true), ("store", toJson true)]).compress ++ "\n")
+
+def run (directory : Option System.FilePath := none) : IO Unit := do
+  for scenario in scenarios do
+    let some f := fixture? scenario | throw (IO.userError s!"C7 serialization failed: {scenario.name}")
+    unless sourceAccepted f do throw (IO.userError s!"C7 source acceptance failed: {scenario.name}")
+    unless pilotDeclines f do throw (IO.userError s!"C7 unexpectedly selected C2 VM: {scenario.name}")
+    unless warmAndRollback f do throw (IO.userError s!"C7 cache or rollback failed: {scenario.name}")
+    let some claims := claimCases? f | throw (IO.userError s!"C7 claim construction failed: {scenario.name}")
+    for claim in claims do Claims.runWire (directory.map (· / "claims")) claim
+    if let some directory := directory then writeSource (directory / "source") f
+    IO.println <| (Lean.Json.mkObj [("case", toJson scenario.name), ("source", toJson true),
+      ("cacheRollback", toJson true), ("pilotDeclines", toJson true), ("claims", toJson claims.length)]).compress
+
+end Tests.Certified.Modeled
diff --git a/Tests/Certified/ModeledAdversarial.lean b/Tests/Certified/ModeledAdversarial.lean
new file mode 100644
index 000000000..ec9f1506b
--- /dev/null
+++ b/Tests/Certified/ModeledAdversarial.lean
@@ -0,0 +1,232 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Modeled
+
+namespace Tests.Certified.ModeledAdversarial
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Ix.Kernel Serialize Modeled
+open Lean (toJson)
+
+set_option maxRecDepth 32768
+set_option maxHeartbeats 64000000
+
+def changeBlock (input : ProofInput Nat) (key : Nat) (alter : Block Nat → Block Nat) : ProofInput Nat :=
+  let old := input.store
+  { input with store := {
+      dom := old.dom, nodup := old.nodup,
+      blocks := fun b => (old.blocks b).map fun block => if b = key then alter block else block,
+      mem_dom := by intro b; simp [old.mem_dom] } }
+
+def changeMembers (input : ProofInput Nat) (key : Nat) (alter : Const Nat → Const Nat) : ProofInput Nat :=
+  changeBlock input key fun block => ⟨block.members.map alter⟩
+
+def changeRecursor (tag : String) : Const Nat → Const Nat
+  | .recursor u p i m n t rs k s => match tag with
+    | "global-rule-order" => .recursor u p i m n t rs.reverse k s
+    | "omitted-global-rule" => .recursor u p i m n t (rs.take 2) k s
+    | "rule-fields" => .recursor u p i m n t (rs.map fun r => { r with nfields := r.nfields + 1 }) k s
+    | "rule-rhs" => .recursor u p i m n t (rs.map fun r => { r with rhs := .sort .zero }) k s
+    | "rule-telescope" => .recursor u p i m n t (rs.map fun r => { r with rhs := match r.rhs with
+        | .lam _ body => .lam (.sort .zero) body | body => body }) k s
+    | "k" => .recursor u p i m n t rs true s
+    | "unsafe-recursor" => .recursor u p i m n t rs k .unsafe
+    | "parameters" => .recursor u (p + 1) i m n t rs k s
+    | "indices" => .recursor u p (i + 1) m n t rs k s
+    | "motives" => .recursor u p i (m + 1) n t rs k s
+    | "minors" => .recursor u p i m (n + 1) t rs k s
+    | "levels" => .recursor (u + 1) p i m n t rs k s
+    | "level-permutation" => .recursor u p i m n (t.instL [.param 1, .param 0]) rs k s
+    | _ => .recursor u p i m n t rs k s
+  | c => c
+
+def changeFamily (tag : String) : Const Nat → Const Nat
+  | .induct u p i t cs s => match tag with
+    | "constructor-order" => .induct u p i t cs.reverse s
+    | "constructor-fields" => .induct u p i t (cs.map fun c => { c with nfields := c.nfields + 1 }) s
+    | "constructor-levels" => .induct u p i t (cs.map fun c => { c with uvars := c.uvars + 1 }) s
+    | "constructor-parameters" => .induct u p i t (cs.map fun c => { c with nparams := c.nparams + 1 }) s
+    | "unsafe-family" => .induct u p i t cs .unsafe
+    | "unsafe-constructor" => .induct u p i t (cs.map fun c => { c with safety := .unsafe }) s
+    | _ => .induct u p i t cs s
+  | c => c
+
+structure SourceMutation where
+  name : String
+  original : Scenario
+  input : ProofInput Nat
+
+def mutualCase : Scenario := ⟨"mutual-unequal", Tests.Theory.Modeled.input, Tests.Theory.Modeled.candidate⟩
+def nested : Scenario := ⟨"nested-parameter", Tests.Theory.ModeledNested.input false, Tests.Theory.ModeledNested.candidate⟩
+def recursivePi : Scenario := ⟨"nested-recursive-Pi", Tests.Theory.ModeledNested.input true, Tests.Theory.ModeledNested.candidate⟩
+def propositional : Scenario := ⟨"propositional-equations", Tests.Theory.ModeledEquations.input, Tests.Theory.ModeledEquations.candidate⟩
+
+def sourceMutations : List SourceMutation :=
+  (["global-rule-order", "omitted-global-rule", "rule-fields", "rule-rhs", "rule-telescope",
+    "k", "unsafe-recursor", "parameters", "indices", "motives", "minors", "levels"].map fun tag =>
+      ⟨s!"mutual-{tag}", mutualCase, changeMembers mutualCase.input 31 (changeRecursor tag)⟩) ++
+  (["constructor-order", "constructor-fields", "constructor-levels", "constructor-parameters",
+    "unsafe-family", "unsafe-constructor"].map fun tag =>
+      ⟨s!"mutual-{tag}", mutualCase, changeMembers mutualCase.input 30 (changeFamily tag)⟩) ++ [
+    ⟨"mutual-family-type", mutualCase, changeMembers mutualCase.input 30 fun c => match c with
+      | .induct u p i _ cs s => .induct u p i (.sort (.succ (.succ .zero))) cs s | c => c⟩,
+    ⟨"mutual-recursor-order", mutualCase, changeBlock mutualCase.input 31 fun b => ⟨b.members.reverse⟩⟩,
+    ⟨"unproved-model-axiom", mutualCase, changeMembers mutualCase.input 40 fun c => .axiom c.uvars c.type .safe⟩,
+    ⟨"changed-model-body", mutualCase, changeMembers mutualCase.input 40 fun c => match c with
+      | .defn n k t _ s => .defn n k t (.lam Tests.Theory.Modeled.natType (.const (.ctor 20 0 0) [])) s
+      | c => c⟩,
+    ⟨"circular-model", mutualCase, changeMembers mutualCase.input 40 fun c => match c with
+      | .defn n k t _ s => .defn n k t (.const (.ctor 30 1 0) []) s | c => c⟩,
+    ⟨"nested-level-permutation", nested, changeMembers nested.input 41 (changeRecursor "level-permutation")⟩,
+    ⟨"nested-rule-fields", nested, changeMembers nested.input 41 (changeRecursor "rule-fields")⟩,
+    ⟨"recursive-Pi-level-permutation", recursivePi,
+      changeMembers recursivePi.input 41 (changeRecursor "level-permutation")⟩,
+    ⟨"recursive-Pi-rule-telescope", recursivePi,
+      changeMembers recursivePi.input 41 (changeRecursor "rule-telescope")⟩,
+    ⟨"unproved-equation-axiom", propositional,
+      changeMembers propositional.input 70 fun c => .axiom c.uvars c.type .safe⟩,
+    ⟨"unrelated-equation-proof", propositional,
+      changeMembers propositional.input 70 fun c => match c with
+        | .defn n k t _ s => .defn n k t (.const (.member 40 0) []) s
+        | c => c⟩]
+
+def mutationFixture? (m : SourceMutation) : Option Fixture :=
+  fixture? { m.original with name := m.name, input := m.input }
+
+def control? (f : Fixture) (original : ProofInput Nat) : Option (PreparedInput × ProofWitness Address) := do
+  let prepared ← ModelSerialize.repaired? f.source original
+  let objects ← decodeObjects? f.source.blobs
+  let models ← modelCandidates? objects prepared.input.store [f.model]
+  let witness ← Certificate.proofWitness? fuel prepared.signature prepared.input models
+  return (prepared, witness)
+
+/-- A complete semantic certificate succeeds on the original declarations at
+the new addresses, then fails on the actual authenticated altered source.
+The same declaration certificate is submitted to the claim acceptance root. -/
+def rejectsSource (f : Fixture) (original : ProofInput Nat) : Bool := Id.run do
+  let some (prepared, witness) := control? f original | return false
+  unless acceptsCertified.{0,0} fuel prepared.signature prepared.input witness do return false
+  let some (_, env) := Source.loadedIxe? f.source | return false
+  if acceptsCertifiedSource.{0} fuel env f.source.profile f.source.target (Source.selection f.source) witness then
+    return false
+  if acceptsCertifiedStoreSource.{0} fuel env f.source.profile (Source.subjects f.source)
+      (Source.selection f.source) witness.declarations then return false
+  let claim := Ix.Claim.check f.source.target none
+  let envelope : Envelope := ⟨Protocol.current, f.source.profile, claim, none⟩
+  let leaf : LeafWitness := ⟨claim, none, none, [], witness.declarations⟩
+  let logical : LogicalWitness := ⟨Source.selection f.source, [leaf], none, none, none, [], none⟩
+  let bytes := envelopeBytes envelope
+  return !acceptsCertifiedClaim.{0} fuel env (Address.blake3 bytes) bytes (.logical logical)
+
+def witnessMutations : List (String × (Ix.Theory.Certified.Modeled.Witness Address →
+    Ix.Theory.Certified.Modeled.Witness Address)) := [
+  ("recursor-order", fun w => { w with recursors := w.recursors.reverse }),
+  ("companion-order", fun w => { w with companions := w.companions.reverse }),
+  ("missing-companion", fun w => { w with companions := w.companions.drop 1 }),
+  ("missing-equation", fun w => { w with equations := w.equations.drop 1 }),
+  ("self-model", fun w => { w with companions := w.companions.map fun c => { c with model := c.header.ref } }),
+  ("unrelated-left-side", fun w => { w with companions := w.companions.map fun c =>
+      { c with rules := c.rules.map fun r => { r with lhs := r.rhs } } }),
+  ("forged-conversion", fun w => { w with equations := w.equations.map (fun ps =>
+      ps.map fun p => { p with proof := .conversion .refl }) })]
+
+def rejectsWitnesses (f : Fixture) : Bool := Id.run do
+  let env := Source.source f.source
+  let some witness := suggestSource? fuel env f.source.profile f.source.target (Source.selection f.source) [f.model]
+    | return false
+  return witnessMutations.all fun (_, alter) =>
+    let witness := { witness with declarations := witness.declarations.map fun declaration => match declaration with
+      | .modeled model => .modeled (alter model) | declaration => declaration }
+    !acceptsCertifiedSource.{0} fuel env f.source.profile f.source.target (Source.selection f.source) witness &&
+      !acceptsCertifiedStoreSource.{0} fuel env f.source.profile (Source.subjects f.source)
+        (Source.selection f.source) witness.declarations
+
+def negativeWire (f : Fixture) : Claims.WireCase :=
+  let claim := Ix.Claim.check f.source.target none
+  ⟨f.scenario.name, f.source, ⟨Protocol.current, f.source.profile, claim, none⟩,
+    .logical ⟨Source.selection f.source, [⟨claim, none, none⟩], none, none, none, none, [f.model]⟩, false⟩
+
+def writeNegative (directory : System.FilePath) (f : Fixture) : IO Unit := do
+  let directory := directory / f.scenario.name
+  IO.FS.createDirAll directory
+  let some (bytes, _) := Source.loadedIxe? f.source | throw (IO.userError "cannot write mutated .ixe")
+  IO.FS.writeBinFile (directory / "source.ixe") bytes
+  IO.FS.writeFile (directory / "request.json") ((Modeled.requestJson f.request).pretty ++ "\n")
+  IO.FS.writeFile (directory / "expected.json")
+    ((Lean.Json.mkObj [("proof", toJson false), ("store", toJson false)]).compress ++ "\n")
+
+def ingressNames : List String := ["family-order", "constructor-index", "family-wrapper-kind",
+  "family-wrapper-slot", "recursor-wrapper-kind", "recursor-wrapper-slot", "constructor-wrapper-slot",
+  "missing-universe-table", "missing-reference-table"]
+
+/-- These mutations preserve fresh hashes and update every dependent address.
+Malformed mutual projections and tables must fail even before model search. -/
+def ingressFixture? (name : String) : Option Fixture := do
+  let original ← fixture? mutualCase
+  let family ← reference original.source.references (.member 30 0)
+  let recursor ← reference original.source.references (.member 31 0)
+  let constructor ← reference original.source.references (.ctor 30 1 0)
+  let source ← rehash? original.source id fun address source =>
+    if address = original.model.source && name = "family-order" then
+      match source.info with
+      | .muts members => { source with info := .muts members.reverse }
+      | _ => source
+    else if address = original.model.source && name = "constructor-index" then
+      match source.info with
+      | .muts members => { source with info := .muts (members.map fun member => match member with
+          | .indc family => .indc { family with ctors := family.ctors.map fun ctor => { ctor with cidx := ctor.cidx + 1 } }
+          | member => member) }
+      | _ => source
+    else if address = family && name = "family-wrapper-kind" then
+      match source.info with
+      | .iPrj p => { source with info := .rPrj ⟨p.idx, p.block⟩ } | _ => source
+    else if address = family && name = "family-wrapper-slot" then
+      match source.info with
+      | .iPrj p => { source with info := .iPrj { p with idx := 999 } } | _ => source
+    else if address = recursor && name = "recursor-wrapper-kind" then
+      match source.info with
+      | .rPrj p => { source with info := .dPrj ⟨p.idx, p.block⟩ } | _ => source
+    else if address = recursor && name = "recursor-wrapper-slot" then
+      match source.info with
+      | .rPrj p => { source with info := .rPrj { p with idx := 999 } } | _ => source
+    else if address = constructor && name = "constructor-wrapper-slot" then
+      match source.info with
+      | .cPrj p => { source with info := .cPrj { p with cidx := 999 } } | _ => source
+    else if address = original.source.target && name = "missing-universe-table" then { source with univs := #[] }
+    else if address = original.source.target && name = "missing-reference-table" then { source with refs := #[] }
+    else source
+  let name := s!"ingress-{name}"
+  let model ← ModelSerialize.hint? source mutualCase.candidate
+  return ⟨{ mutualCase with name }, { source with name }, model⟩
+
+def run (directory : Option System.FilePath := none) : IO Unit := do
+  for scenario in scenarios do
+    let some f := fixture? scenario | throw (IO.userError s!"C7 witness fixture failed: {scenario.name}")
+    unless rejectsWitnesses f do throw (IO.userError s!"C7 forged witness escaped: {scenario.name}")
+  for m in sourceMutations do
+    let some f := mutationFixture? m | throw (IO.userError s!"C7 mutation serialization failed: {m.name}")
+    unless rejectsSource f m.original.input do throw (IO.userError s!"C7 valid-control source mutation escaped: {m.name}")
+    let some (_, env) := Source.loadedIxe? f.source | throw (IO.userError s!"C7 mutation load failed: {m.name}")
+    if (Command.run.{0} "proof" fuel env f.request).isOk || (Command.run.{0} "store" fuel env f.request).isOk then
+      throw (IO.userError s!"C7 mutated command accepted: {m.name}")
+    Claims.runWire (directory.map (· / "claims")) (negativeWire f)
+    if let some directory := directory then writeNegative (directory / "source") f
+    IO.println <| (Lean.Json.mkObj [("sourceMutation", toJson m.name), ("controlAccepted", toJson true),
+      ("sourceRejected", toJson true), ("claimRejected", toJson true)]).compress
+  for name in ingressNames do
+    let some f := ingressFixture? name | throw (IO.userError s!"C7 ingress construction failed: {name}")
+    unless (prepare? fuel f.source.profile f.source.target f.source.blobs f.source.literals).isNone do
+      throw (IO.userError s!"C7 malformed mutual source decoded: {name}")
+    let some (_, env) := Source.loadedIxe? f.source | throw (IO.userError s!"C7 ingress .ixe load failed: {name}")
+    if (Command.run.{0} "proof" fuel env f.request).isOk || (Command.run.{0} "store" fuel env f.request).isOk then
+      throw (IO.userError s!"C7 malformed mutual command accepted: {name}")
+    Claims.runWire (directory.map (· / "claims")) (negativeWire f)
+    if let some directory := directory then writeNegative (directory / "source") f
+  IO.println <| (Lean.Json.mkObj [("sourceMutations", toJson sourceMutations.length),
+    ("forgedWitnesses", toJson (scenarios.length * witnessMutations.length)),
+    ("ingressMutations", toJson ingressNames.length),
+    ("unexpectedErrors", toJson (0 : Nat))]).compress
+
+end Tests.Certified.ModeledAdversarial
diff --git a/Tests/Certified/ModeledMain.lean b/Tests/Certified/ModeledMain.lean
new file mode 100644
index 000000000..45dedc808
--- /dev/null
+++ b/Tests/Certified/ModeledMain.lean
@@ -0,0 +1,11 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.ModeledAdversarial
+
+def main (args : List String) : IO Unit := do
+  let directory := (args.head?).map System.FilePath.mk
+  Tests.Certified.Modeled.run directory
+  Tests.Certified.ModeledAdversarial.run directory
diff --git a/Tests/Certified/Ordinary.lean b/Tests/Certified/Ordinary.lean
new file mode 100644
index 000000000..25aba9aa8
--- /dev/null
+++ b/Tests/Certified/Ordinary.lean
@@ -0,0 +1,252 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Corpus
+import Ix.Certified.Packet
+import Tests.Theory.OrdinaryAcceptance
+
+/-! Actual canonical Ixon bytes for ordinary source blocks and closed proofs.
+The serializer is test infrastructure. Witness generation receives only the
+decoded store and original target, and the serialized acceptance gate reruns
+all independent checks. -/
+
+namespace Tests.Certified.Ordinary
+
+open Ix.Theory Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certified.Ordinary
+open Ix.Certified Ix.Certified.Fixtures
+open Tests.Theory.OrdinaryAcceptance
+open Lean (toJson)
+
+set_option maxRecDepth 8192
+set_option maxHeartbeats 8000000
+
+local instance : DecidableEq Address := Ix.Certified.addressDecidableEq
+
+structure Tables where
+  refs : Array Address := #[]
+  univs : Array Ixon.Univ := #[]
+
+abbrev Write := StateT Tables Option
+
+def univ : VLevel → Ixon.Univ
+  | .zero => .zero
+  | .succ u => .succ (univ u)
+  | .max u v => .max (univ u) (univ v)
+  | .imax u v => .imax (univ u) (univ v)
+  | .param i => .var i.toUInt64
+
+def level (u : VLevel) : Write UInt64 := do
+  let s ← get
+  set { s with univs := s.univs.push (univ u) }
+  return s.univs.size.toUInt64
+
+def address (a : Address) : Write UInt64 := do
+  let s ← get
+  set { s with refs := s.refs.push a }
+  return s.refs.size.toUInt64
+
+def expression (self : Nat) (resolve : ConstRef Nat → Option Address) :
+    VExpr Nat → Write Ixon.Expr
+  | .sort u => return .sort (← level u)
+  | .bvar i => return .var i.toUInt64
+  | .const r us => do
+    let us ← us.mapM level
+    match r with
+    | .member block member =>
+      if block = self then return .recur member.toUInt64 us.toArray
+      else return .ref (← address (← resolve r)) us.toArray
+    | .ctor .. => return .ref (← address (← resolve r)) us.toArray
+  | .app f a => return .app (← expression self resolve f) (← expression self resolve a)
+  | .lam A b => return .leanLam (← expression self resolve A) (← expression self resolve b)
+  | .forallE A B => return .leanAll (← expression self resolve A) (← expression self resolve B)
+  | .proj .. | .natLit .. => failure
+
+def constructor (self : Nat) (resolve : ConstRef Nat → Option Address)
+    (ctor : Ctor Nat) (index : Nat) : Write Ixon.Constructor := do
+  return {
+    isUnsafe := ctor.safety != .safe, lvls := ctor.uvars.toUInt64,
+    cidx := index.toUInt64, params := ctor.nparams.toUInt64, fields := ctor.nfields.toUInt64,
+    typ := ← expression self resolve ctor.type }
+
+def constantInfo (self : Nat) (resolve : ConstRef Nat → Option Address) :
+    Const Nat → Write Ixon.ConstantInfo
+  | .induct n p i type ctors safety => do
+    let typ ← expression self resolve type
+    let ctors ← ctors.zipIdx.mapM fun (ctor, index) => constructor self resolve ctor index
+    return .muts #[.indc {
+      isUnsafe := safety != .safe,
+      lvls := n.toUInt64, params := p.toUInt64, indices := i.toUInt64, typ, ctors := ctors.toArray }]
+  | .recursor n p i m b type rules k safety => do
+    let typ ← expression self resolve type
+    let rules ← rules.mapM fun rule => do
+      return ({
+        fields := rule.nfields.toUInt64,
+        rhs := ← expression self resolve rule.rhs } : Ixon.RecursorRule)
+    return .recr {
+      k, isUnsafe := safety != .safe, lvls := n.toUInt64,
+      params := p.toUInt64, indices := i.toUInt64, motives := m.toUInt64,
+      minors := b.toUInt64, typ, rules := rules.toArray }
+  | .defn n _ type body .safe => do
+    return .defn {
+      kind := .thm, safety := .safe, lvls := n.toUInt64,
+      typ := ← expression self resolve type, value := ← expression self resolve body }
+  | _ => failure
+
+def constant (self : Nat) (resolve : ConstRef Nat → Option Address) (source : Const Nat) :
+    Option Ixon.Constant := do
+  let (info, tables) ← constantInfo self resolve source {}
+  return ⟨info, #[], tables.refs, tables.univs⟩
+
+structure Case extends Corpus.Case where
+  source : Address
+  recursor : Address
+  mode : Inductive.ElimMode
+
+def make? (name : String) (shape : Shape Nat) (mode : Inductive.ElimMode)
+    (body proposition : AExpr Nat) (mutateRec : Const Nat → Const Nat := id)
+    (mutateFamily : Ixon.Constant → Ixon.Constant := id) : Option Case := do
+  let family := mutateFamily (← constant 100 (fun _ => none) (shape.source 100))
+  let source := encode family
+  let projection := encode ⟨.iPrj ⟨0, source.1⟩, #[], #[], #[]⟩
+  let ctors := (List.range shape.constructors.length).map fun index =>
+    encode ⟨.cPrj ⟨0, index.toUInt64, source.1⟩, #[], #[], #[]⟩
+  let resolve := fun r => match r with
+    | .member 100 0 => some projection.1
+    | .ctor 100 0 index => (ctors[index]?).map Prod.fst
+    | _ => none
+  let recursor ← constant 101 resolve (mutateRec (shape.recursorSource 100 101 mode))
+  let recursor := encode recursor
+  let resolve := fun r => if r = .member 101 0 then some recursor.1 else resolve r
+  let target ← constant 200 resolve (.defn 0 .theorem proposition.erase body.erase .safe)
+  let target := encode target
+  return {
+    name, target := target.1,
+    blobs := prelude ++ [source, projection] ++ ctors ++ [recursor, target],
+    source := source.1, recursor := recursor.1, mode }
+
+def acceptedCase (c : Case) : Bool :=
+  match prepare? 2000 profile c.target c.blobs with
+  | none => false
+  | some prepared => (Ix.Theory.Certificate.proofWitness? 2000 prepared.signature prepared.input).any
+      (acceptsSerialized.{0} 2000 profile c.target c.blobs)
+
+def positive : List (Option Case) := [
+  make? "Nat-iota" Tests.Theory.Ordinary.natShape .large identity (proposition natComputed),
+  make? "List-distinct-universes" Tests.Theory.Ordinary.listShape .large identity (proposition listComputed),
+  make? "indexed-iota" Tests.Theory.Ordinary.indexedShape .large identity (proposition indexedComputed),
+  make? "function-field-iota" functionalShape .large identity (proposition functionalComputed),
+  make? "multiple-Prop-small" Tests.Theory.Ordinary.manyProp .small smallProof identityType
+]
+
+#guard positive.length = 5
+#guard positive.all (fun c => c.any acceptedCase)
+
+def pilotDeclines (c : Case) : Bool :=
+  match prepare? 2000 profile c.target c.blobs with
+  | none => false
+  | some prepared =>
+    match Ix.Theory.Certificate.proofWitness? 2000 prepared.signature prepared.input with
+    | none => false
+    | some witness => match Packet.words prepared.signature prepared.input witness with
+      | .error _ => true
+      | .ok _ => false
+
+#guard positive.all (fun c => c.any pilotDeclines)
+
+def corruptRule : Const Nat → Const Nat
+  | .recursor n p i m b type (_ :: rules) k safety =>
+    .recursor n p i m b type (⟨0, .sort .zero⟩ :: rules) k safety
+  | other => other
+
+def unsafeRecursor : Const Nat → Const Nat
+  | .recursor n p i m b type rules k _ => .recursor n p i m b type rules k .unsafe
+  | other => other
+
+def enableK : Const Nat → Const Nat
+  | .recursor n p i m b type rules _ safety => .recursor n p i m b type rules true safety
+  | other => other
+
+def replaceBlock (store : Store Address) (address : Address) (block : Block Address) : Store Address where
+  dom := store.dom
+  nodup := store.nodup
+  blocks a := (store.blocks a).map fun old => if a = address then block else old
+  mem_dom a := by simp [store.mem_dom]
+
+/-- Construct a valid certificate with the original canonical recursor at the
+new address, then submit it against the authenticated altered source. This
+tests the acceptance boundary independently of producer refusal. -/
+def rejectsWithValidWitness (c : Case) : Bool := Id.run do
+  let some prepared := prepare? 2000 profile c.target c.blobs | return false
+  let some raw := prepared.input.store.lookup (.member c.source 0) | return false
+  let some shape := Ix.Theory.Certificate.Ordinary.description? 2000
+    prepared.signature.environment c.source raw | return false
+  let repaired := replaceBlock prepared.input.store c.recursor
+    ⟨[shape.recursorSource c.source c.recursor c.mode]⟩
+  let input := { prepared.input with store := repaired }
+  let some witness := Ix.Theory.Certificate.proofWitness? 2000 prepared.signature input | return false
+  return acceptsCertified.{0,0} 2000 prepared.signature input witness &&
+    !acceptsSerialized.{0} 2000 profile c.target c.blobs witness
+
+#guard [corruptRule, unsafeRecursor, enableK].all fun mutation =>
+  (make? "forged-recursor" Tests.Theory.Ordinary.natShape .large identity
+    (proposition natComputed) mutation).any rejectsWithValidWitness
+
+def wrongPosition (source : Ixon.Constant) : Ixon.Constant :=
+  match source.info with
+  | .muts #[.indc family] => { source with info := .muts #[.indc
+      { family with ctors := family.ctors.map fun ctor => { ctor with cidx := ctor.cidx + 1 } }] }
+  | _ => source
+
+#guard (make? "wrong-constructor-position" Tests.Theory.Ordinary.natShape .large identity
+  (proposition natComputed) id wrongPosition).any fun c =>
+    (prepare? 2000 profile c.target c.blobs).isNone
+
+def writeCase (directory : System.FilePath) (c : Case) : IO Unit := do
+  let directory := directory / c.name
+  IO.FS.createDirAll directory
+  for (address, bytes) in c.blobs do
+    IO.FS.writeBinFile (directory / s!"{hexOfBytes address.hash}.ixon") bytes
+  let metadata := Lean.Json.mkObj [
+    ("target", toJson (hexOfBytes c.target.hash)),
+    ("falseType", toJson (hexOfBytes profile.falseType.hash)),
+    ("falseElim", toJson (hexOfBytes profile.falseElim.hash))]
+  IO.FS.writeFile (directory / "target.json") (metadata.pretty ++ "\n")
+
+def run (directory : Option System.FilePath) : IO Unit := do
+  let mut accepted := 0
+  let mut declined := 0
+  for candidate in positive do
+    let some c := candidate | throw (IO.userError "serialized fixture construction failed")
+    unless acceptedCase c do throw (IO.userError s!"serialized acceptance failed: {c.name}")
+    unless pilotDeclines c do throw (IO.userError s!"C2 pilot exclusion failed: {c.name}")
+    accepted := accepted + 1
+    declined := declined + 1
+    if let some directory := directory then writeCase directory c
+  let mut rejected := 0
+  for (name, mutation) in [("changed-rule", corruptRule), ("unsafe-recursor", unsafeRecursor),
+      ("unsupported-K", enableK)] do
+    let some c := make? name Tests.Theory.Ordinary.natShape .large identity
+      (proposition natComputed) mutation | throw (IO.userError "malformed fixture construction failed")
+    unless rejectsWithValidWitness c do throw (IO.userError s!"malformed source accepted: {name}")
+    rejected := rejected + 1
+    if let some directory := directory then writeCase directory c
+  let some wrong := make? "wrong-constructor-position" Tests.Theory.Ordinary.natShape .large identity
+    (proposition natComputed) id wrongPosition | throw (IO.userError "position fixture construction failed")
+  unless (prepare? 2000 profile wrong.target wrong.blobs).isNone do
+    throw (IO.userError "wrong constructor position accepted")
+  if let some directory := directory then writeCase directory wrong
+  IO.println <| (Lean.Json.mkObj [
+    ("serializedAccepted", toJson accepted), ("serializedRejected", toJson rejected),
+    ("ingressRejected", toJson (1 : Nat)), ("pilotDeclined", toJson declined),
+    ("unexpectedErrors", toJson (0 : Nat))]).compress
+
+end Tests.Certified.Ordinary
+
+def main (args : List String) : IO UInt32 := do
+  if args.length > 1 then
+    IO.eprintln "usage: certified-ordinary-tests [OUTPUT_DIRECTORY]"
+    return 2
+  Tests.Certified.Ordinary.run (args.head?.map System.FilePath.mk)
+  return 0
diff --git a/Tests/Certified/Serialize.lean b/Tests/Certified/Serialize.lean
new file mode 100644
index 000000000..5289854c6
--- /dev/null
+++ b/Tests/Certified/Serialize.lean
@@ -0,0 +1,243 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Fixtures
+
+/-! Test-only serializer for singleton source stores. It preserves every
+source kind and field, emits real content-addressed projection wrappers, and
+places natural literal bytes in their separate authenticated blob domain. -/
+
+namespace Tests.Certified.Serialize
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Ix.Certified.Fixtures
+
+structure Tables where
+  refs : Array Address := #[]
+  univs : Array Ixon.Univ := #[]
+  literals : ConstantBlobs := []
+
+abbrev Write := StateT Tables Option
+
+def univ : VLevel → Ixon.Univ
+  | .zero => .zero
+  | .succ u => .succ (univ u)
+  | .max u v => .max (univ u) (univ v)
+  | .imax u v => .imax (univ u) (univ v)
+  | .param i => .var i.toUInt64
+
+def level (u : VLevel) : Write UInt64 := do
+  let s ← get
+  set { s with univs := s.univs.push (univ u) }
+  return s.univs.size.toUInt64
+
+def address (a : Address) : Write UInt64 := do
+  let s ← get
+  set { s with refs := s.refs.push a }
+  return s.refs.size.toUInt64
+
+def expression (self : Nat) (resolve : ConstRef Nat → Option Address) :
+    VExpr Nat → Write Ixon.Expr
+  | .sort u => return .sort (← level u)
+  | .bvar i => return .var i.toUInt64
+  | .const r us => do
+    let us ← us.mapM level
+    match r with
+    | .member block member =>
+      if block = self then return .recur member.toUInt64 us.toArray
+      else return .ref (← address (← resolve r)) us.toArray
+    | .ctor .. => return .ref (← address (← resolve r)) us.toArray
+  | .app f a => return .app (← expression self resolve f) (← expression self resolve a)
+  | .lam A b => return .leanLam (← expression self resolve A) (← expression self resolve b)
+  | .forallE A B => return .leanAll (← expression self resolve A) (← expression self resolve B)
+  | .proj r i s => return .prj (← address (← resolve r)) i.toUInt64 (← expression self resolve s)
+  | .natLit n => do
+    let bytes := ByteArray.mk n.toBytesLE
+    let a := Address.blake3 bytes
+    modify fun s => { s with literals := s.literals ++ [(a, bytes)] }
+    return .nat (← address a)
+
+def safety : Safety → Ix.DefinitionSafety
+  | .safe => .safe
+  | .unsafe => .unsaf
+  | .partial => .part
+
+def kind : Ix.Theory.DefKind → Ix.DefKind
+  | .definition => .defn
+  | .theorem => .thm
+  | .opaque => .opaq
+
+def quotKind : Ix.Theory.QuotKind → Ix.QuotKind
+  | .type => .type
+  | .ctor => .ctor
+  | .lift => .lift
+  | .ind => .ind
+
+def constantInfo (self : Nat) (resolve : ConstRef Nat → Option Address) :
+    Const Nat → Write Ixon.ConstantInfo
+  | .induct n p i type ctors s => do
+    let typ ← expression self resolve type
+    let ctors ← ctors.zipIdx.mapM fun (ctor, index) => do
+      return ({
+        isUnsafe := ctor.safety != .safe, lvls := ctor.uvars.toUInt64,
+        cidx := index.toUInt64, params := ctor.nparams.toUInt64, fields := ctor.nfields.toUInt64,
+        typ := ← expression self resolve ctor.type } : Ixon.Constructor)
+    return .muts #[.indc {
+      isUnsafe := s != .safe, lvls := n.toUInt64,
+      params := p.toUInt64, indices := i.toUInt64, typ, ctors := ctors.toArray }]
+  | .recursor n p i m b type rules k s => do
+    let typ ← expression self resolve type
+    let rules ← rules.mapM fun rule => do
+      return ({
+        fields := rule.nfields.toUInt64,
+        rhs := ← expression self resolve rule.rhs } : Ixon.RecursorRule)
+    return .recr {
+      k, isUnsafe := s != .safe, lvls := n.toUInt64,
+      params := p.toUInt64, indices := i.toUInt64, motives := m.toUInt64,
+      minors := b.toUInt64, typ, rules := rules.toArray }
+  | .defn n k type body s => do
+    return .defn {
+      kind := kind k, safety := safety s, lvls := n.toUInt64,
+      typ := ← expression self resolve type, value := ← expression self resolve body }
+  | .axiom n type s => do
+    return .axio { isUnsafe := s != .safe, lvls := n.toUInt64, typ := ← expression self resolve type }
+  | .quot k n type => do
+    return .quot { kind := quotKind k, lvls := n.toUInt64, typ := ← expression self resolve type }
+
+def constant (self : Nat) (resolve : ConstRef Nat → Option Address) (source : Const Nat) :
+    Option (Ixon.Constant × ConstantBlobs) := do
+  let (info, tables) ← constantInfo self resolve source {}
+  return (⟨info, #[], tables.refs, tables.univs⟩, tables.literals)
+
+structure Case where
+  name : String
+  profile : Profile
+  target : Address
+  blobs : ConstantBlobs
+  literals : ConstantBlobs
+  references : List (ConstRef Nat × Address)
+  blocks : List (Nat × Address)
+
+def reference (references : List (ConstRef Nat × Address)) (r : ConstRef Nat) : Option Address :=
+  (references.find? fun (key, _) => key = r).map Prod.snd
+
+def uniqueBlobs (blobs : ConstantBlobs) : ConstantBlobs :=
+  blobs.foldl (fun acc entry => if (lookup acc entry.1).isSome then acc else acc ++ [entry]) []
+
+/-- Source domains are supplied in dependency order. Each fixture must provide
+all declarations; witness construction receives only the decoded result. -/
+def make? (name : String) (signature : PrimitiveSignature Nat) (input : ProofInput Nat) :
+    Option Case := do
+  if signature.falseType != .member 10 0 || signature.falseElim != .member 11 0 || 900 ∈ input.store.dom then
+    none
+  else do
+    let mut blobs := prelude
+    let mut literals := []
+    let mut references := [(.member 10 0, falseObject.1), (.member 11 0, falseElimObject.1)]
+    let mut blocks := [(10, falseBlockObject.1), (11, falseElimObject.1)]
+    for b in input.store.dom.filter (fun b => b != 10 && b != 11) do
+      let source ← input.store.lookup (.member b 0)
+      let (raw, extra) ← constant b (reference references) source
+      let encoded := encode raw
+      blobs := blobs ++ [encoded]
+      literals := literals ++ extra
+      blocks := blocks ++ [(b, encoded.1)]
+      match source with
+      | .induct _ _ _ _ ctors _ =>
+        let projection := encode ⟨.iPrj ⟨0, encoded.1⟩, #[], #[], #[]⟩
+        blobs := blobs ++ [projection]
+        references := references ++ [(.member b 0, projection.1)]
+        for i in List.range ctors.length do
+          let ctor := encode ⟨.cPrj ⟨0, i.toUInt64, encoded.1⟩, #[], #[], #[]⟩
+          blobs := blobs ++ [ctor]
+          references := references ++ [(.ctor b 0 i, ctor.1)]
+      | _ => references := references ++ [(.member b 0, encoded.1)]
+    let (raw, extra) ← constant 900 (reference references)
+      (.defn input.universes .theorem input.proposition input.proof .safe)
+    let target := encode raw
+    let natType ← match signature.natType with
+      | none => some none
+      | some r => (reference references r).map some
+    return {
+      name, profile := { profile with natType }, target := target.1,
+      blobs := blobs ++ [target], literals := uniqueBlobs (literals ++ extra),
+      references := references ++ [(.member 900 0, target.1)], blocks := blocks ++ [(900, target.1)] }
+
+def renameConstant (mapping : Nat → Address) : Const Nat → Const Address
+  | .axiom n type s => .axiom n (type.rename mapping) s
+  | .defn n k type body s => .defn n k (type.rename mapping) (body.rename mapping) s
+  | .quot k n type => .quot k n (type.rename mapping)
+  | .induct n p i type ctors s => .induct n p i (type.rename mapping)
+      (ctors.map fun c => ⟨c.uvars, c.nparams, c.nfields, c.type.rename mapping, c.safety⟩) s
+  | .recursor n p i m b type rules k s => .recursor n p i m b (type.rename mapping)
+      (rules.map fun r => ⟨r.nfields, r.rhs.rename mapping⟩) k s
+
+/-- A control input with original declarations under the altered source's
+addresses. It intentionally bypasses authentication only to obtain an
+independently valid certificate to attack the real serialized gate. -/
+def repaired? (c : Case) (original : ProofInput Nat) : Option PreparedInput := do
+  let prepared ← prepare? 6400 c.profile c.target c.blobs c.literals
+  let mapping := fun b => ((c.blocks.find? fun (key, _) => key = b).map Prod.snd).getD c.target
+  let originals := c.blocks.map fun (b, a) => (a, (if b = 900 then
+    some (Const.defn original.universes .theorem original.proposition original.proof .safe)
+    else original.store.lookup (.member b 0)).map (fun source =>
+      (⟨[renameConstant mapping source]⟩ : Block Address)))
+  let old := prepared.input.store
+  let store : Store Address := {
+    dom := old.dom, nodup := old.nodup,
+    blocks := fun a => (old.blocks a).map fun block => ((lookup originals a).join).getD block,
+    mem_dom := by intro a; simp [old.mem_dom] }
+  let target ← store.lookup (.member c.target 0)
+  return { prepared with input := { prepared.input with store, proposition := target.type } }
+
+end Tests.Certified.Serialize
+
+namespace Tests.Certified.Serialize
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Ix.Certified.Fixtures
+
+/-- Rehash an entire fixture after changing one raw blob or constant. Every
+reference and projection wrapper is updated in dependency order, so tests of
+canonical encoding and field ownership do not merely fail at an old hash. -/
+def rehash? (c : Case) (alterLiteral : ByteArray → ByteArray := id)
+    (alterConstant : Address → Ixon.Constant → Ixon.Constant := fun _ source => source) : Option Case := do
+  let mut changed : List (Address × Address) := []
+  let mut literals := []
+  for (a, bytes) in c.literals do
+    let bytes := alterLiteral bytes
+    let a' := Address.blake3 bytes
+    changed := changed ++ [(a, a')]
+    literals := literals ++ [(a', bytes)]
+  let mut blobs := []
+  for (a, bytes) in c.blobs do
+    let source ← decodeObject? a bytes
+    let rewrite := fun a => (lookup changed a).getD a
+    let info := match source.val.info with
+      | .iPrj p => .iPrj { p with block := rewrite p.block }
+      | .rPrj p => .rPrj { p with block := rewrite p.block }
+      | .dPrj p => .dPrj { p with block := rewrite p.block }
+      | .cPrj p => .cPrj { p with block := rewrite p.block }
+      | info => info
+    let source := alterConstant a { source.val with info, refs := source.val.refs.map rewrite }
+    let encoded := encode source
+    changed := changed ++ [(a, encoded.1)]
+    blobs := blobs ++ [encoded]
+  let rewrite := fun a => (lookup changed a).getD a
+  return { c with
+    profile := {
+      falseType := rewrite c.profile.falseType, falseElim := rewrite c.profile.falseElim,
+      natType := c.profile.natType.map rewrite },
+    target := rewrite c.target, blobs, literals,
+    references := c.references.map fun (r, a) => (r, rewrite a),
+    blocks := c.blocks.map fun (b, a) => (b, rewrite a) }
+
+def mapLiterals (index : UInt64) : Ixon.Expr → Ixon.Expr
+  | .nat _ => .nat index
+  | .app f a => .app (mapLiterals index f) (mapLiterals index a)
+  | .lam u A b => .lam u (mapLiterals index A) (mapLiterals index b)
+  | .all u c A B => .all u c (mapLiterals index A) (mapLiterals index B)
+  | .prj owner field value => .prj owner field (mapLiterals index value)
+  | other => other
+
+end Tests.Certified.Serialize
diff --git a/Tests/Certified/Source.lean b/Tests/Certified/Source.lean
new file mode 100644
index 000000000..697709ed9
--- /dev/null
+++ b/Tests/Certified/Source.lean
@@ -0,0 +1,272 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.FeatureCases
+import Ix.Kernel.Certified
+import Ix.Certified.Suggest
+
+/-! Actual lazy Ixon environments, empty/cached TcM runs, full declaration
+subjects and hostile cache/state/selection inputs for C5. -/
+
+namespace Tests.Certified.Source
+
+open Ix.Theory Ix.Theory.Certified Ix.Certified Ix.Kernel Serialize
+open Lean (toJson)
+
+set_option maxRecDepth 32768
+set_option maxHeartbeats 32000000
+
+def cases : List Case :=
+  (Corpus.positive.map fun c => {
+    name := c.name, profile := Fixtures.profile,
+    target := c.target, blobs := c.blobs, literals := [], references := [],
+    blocks := c.blobs.map fun (a, _) => (0, a) }) ++
+  Features.positive.filterMap fun s => make? s.name s.signature s.input
+
+#guard cases.length = 42
+
+def selection (c : Case) : InputSelection := ⟨c.blobs.map Prod.fst, c.literals.map Prod.fst⟩
+
+/-- All constants are real offset windows with no materialized cache. -/
+def source (c : Case) : Ixon.Env := Id.run do
+  let mut env : Ixon.Env := { main := some c.target }
+  for (a, bytes) in c.blobs do
+    let backing := (ByteArray.mk #[17, 19]) ++ bytes ++ (ByteArray.mk #[23])
+    env := { env with consts := env.consts.insert a (Ixon.LazyConstant.ofSlice backing 2 bytes.size) }
+  for (a, bytes) in c.literals do env := { env with blobs := env.blobs.insert a bytes }
+  return env
+
+def subjects (c : Case) : List Address :=
+  c.blocks.map Prod.snd
+
+def accepted (c : Case) : Bool :=
+  let env := source c
+  (suggestSource? 6400 env c.profile c.target (selection c)).any fun w =>
+    acceptsCertifiedSource.{0} 6400 env c.profile c.target (selection c) w
+
+def storeAccepted (c : Case) : Bool :=
+  let env := source c
+  (suggestStore? 6400 env c.profile (subjects c) (selection c)).any fun w =>
+    acceptsCertifiedStoreSource.{0} 6400 env c.profile (subjects c) (selection c) w
+
+#guard cases.all accepted
+#guard cases.all storeAccepted
+
+/-- A forged legacy equivalence, type cache, block verdict and inference-only
+flag are carried through the actual TcM state. Certified checking is full and
+independent of each of these fields. -/
+def poisonedChecker (c : Case) : TcState .anon :=
+  let state := TcState.ofEnvAnon {}
+  let lhs : KExpr .anon := KExpr.mkNatLit 0
+  let rhs : KExpr .anon := KExpr.mkConst ⟨c.profile.falseType, ()⟩ #[]
+  { state with
+    inferOnly := true, eagerReduce := true, recFuel := 0, noAccel := false,
+    equivManager := state.equivManager.addEquiv ⟨lhs.addr, state.ctxId, 0, 0⟩ ⟨rhs.addr, state.ctxId, 0, 0⟩,
+    env := { state.env with
+      inferCache := state.env.inferCache.insert (lhs.addr, state.ctxId) rhs,
+      inferOnlyCache := state.env.inferOnlyCache.insert (lhs.addr, state.ctxId) rhs,
+      whnfCache := state.env.whnfCache.insert (lhs.addr, state.ctxId) rhs,
+      defEqCache := state.env.defEqCache.insert (lhs.addr, rhs.addr, state.ctxId) true,
+      blockCheckResults := state.env.blockCheckResults.insert ⟨c.target, ()⟩ (.ok ()) } }
+
+def warmAndRollback (c : Case) : Bool := Id.run do
+  let env := source c
+  let count := c.blobs.length + c.literals.length
+  let some w := suggestSource? 6400 env c.profile c.target (selection c) | return false
+  let .ok _ cold := (certifiedStep.{0} 6400 env c.profile c.target (selection c) w).run initialCertifiedState | return false
+  if cold.inputCache.misses != count || cold.inputCache.hits != 0 then return false
+  let start := { cold with checker := poisonedChecker c }
+  let .ok _ warm := (certifiedStep.{0} 6400 env c.profile c.target (selection c) w).run start | return false
+  if warm.inputCache.hits != count || warm.inputCache.misses != count then return false
+  if !warm.checker.inferOnly || warm.checker.recFuel != 0 then return false
+  let bad := { w with proofWitness := .sort }
+  let .error _ failed := (certifiedStep.{0} 6400 env c.profile c.target (selection c) bad).run warm | return false
+  if failed.inputCache.hits != warm.inputCache.hits || failed.inputCache.misses != warm.inputCache.misses then return false
+  let .error _ exhausted := (certifiedStep.{0} 0 env c.profile c.target (selection c) w).run failed | return false
+  if exhausted.inputCache.hits != warm.inputCache.hits || exhausted.inputCache.misses != warm.inputCache.misses then return false
+  let .ok _ retry := (certifiedStep.{0} 6400 env c.profile c.target (selection c) w).run exhausted | return false
+  return retry.inputCache.hits == 2 * count && retry.inputCache.misses == count
+
+#guard cases.all warmAndRollback
+
+def loadedIxe? (c : Case) : Option (ByteArray × Ixon.Env) := do
+  let bytes ← (Ixon.serEnv (source c)).toOption
+  let parts ← (Ixon.deEnvVerifiedLazy bytes).toOption
+  return (bytes, parts.env)
+
+def ixeAccepted (c : Case) : Bool := Id.run do
+  let some (_, env) := loadedIxe? c | return false
+  let some target := env.consts.get? c.target | return false
+  if target.cache.isSome || target.buf.size ≤ target.len then return false
+  let some w := suggestSource? 6400 env c.profile c.target (selection c) | return false
+  return acceptsCertifiedSource.{0} 6400 env c.profile c.target (selection c) w
+
+#guard cases.all ixeAccepted
+
+def extraMalformed : Address := Address.blake3 "C5-unvisited-malformed-constant".toUTF8
+
+def lazyOnlySelected (c : Case) : Bool := Id.run do
+  let raw := source c
+  let env := { raw with
+    consts := raw.consts.insert extraMalformed
+      (Ixon.LazyConstant.ofSlice (ByteArray.mk #[255, 254]) 0 2) }
+  let some w := suggestSource? 6400 env c.profile c.target (selection c) | return false
+  return env.consts.size > c.blobs.length &&
+    acceptsCertifiedSource.{0} 6400 env c.profile c.target (selection c) w &&
+    !acceptsCertifiedSource.{0} 6400 env c.profile c.target
+      ⟨extraMalformed :: (selection c).objects, (selection c).naturals⟩ w
+
+#guard cases.all lazyOnlySelected
+
+def materializedCacheIgnored (c : Case) : Bool := Id.run do
+  let raw := source c
+  let some entry := raw.consts.get? c.target | return false
+  let bogus : Ixon.Constant := ⟨.axio ⟨false, 0, .sort 0⟩, #[], #[], #[.zero]⟩
+  let env := { raw with consts := raw.consts.insert c.target { entry with cache := some bogus } }
+  let some w := suggestSource? 6400 env c.profile c.target (selection c) | return false
+  return acceptsCertifiedSource.{0} 6400 env c.profile c.target (selection c) w
+
+#guard cases.all materializedCacheIgnored
+
+/-- Warm byte caches must not hide changed source bytes, windows, pins,
+missing dependencies, or a modified selection. -/
+def hostileSource (c : Case) : Bool := Id.run do
+  let env := source c
+  let some w := suggestSource? 6400 env c.profile c.target (selection c) | return false
+  let .ok _ warm := (certifiedStep.{0} 6400 env c.profile c.target (selection c) w).run initialCertifiedState | return false
+  let some entry := env.consts.get? c.target | return false
+  let changed := { env with
+    consts := env.consts.insert c.target
+      (Ixon.LazyConstant.ofSlice (entry.rawBytes.push 0) 0 (entry.rawBytes.size + 1)) }
+  let .error _ _ := (certifiedStep.{0} 6400 changed c.profile c.target (selection c) w).run warm | return false
+  let outside := { env with consts := env.consts.insert c.target { entry with off := entry.buf.size + 1 } }
+  let .error _ _ := (certifiedStep.{0} 6400 outside c.profile c.target (selection c) w).run warm | return false
+  let truncated := { env with consts := env.consts.insert c.target { entry with len := entry.buf.size + 1 } }
+  let .error _ _ := (certifiedStep.{0} 6400 truncated c.profile c.target (selection c) w).run warm | return false
+  let missing := { (selection c) with objects := (selection c).objects.filter (· != c.target) }
+  let .error _ _ := (certifiedStep.{0} 6400 env c.profile c.target missing w).run warm | return false
+  let duplicate := { (selection c) with objects := c.target :: (selection c).objects }
+  let .error _ _ := (certifiedStep.{0} 6400 env c.profile c.target duplicate w).run warm | return false
+  let badProfile := { c.profile with falseType := c.profile.falseElim, falseElim := c.profile.falseType }
+  let .error _ _ := (certifiedStep.{0} 6400 env badProfile c.target (selection c) w).run warm | return false
+  let reordered := { (selection c) with objects := (selection c).objects.reverse, naturals := (selection c).naturals.reverse }
+  let .ok _ _ := (certifiedStep.{0} 6400 env c.profile c.target reordered w).run warm | return false
+  return true
+
+#guard cases.all hostileSource
+
+def rejectsMutation (m : Features.Mutation) : Bool := Id.run do
+  let some c := make? m.name m.signature m.altered | return false
+  let some p := repaired? c m.original | return false
+  let some w := Ix.Theory.Certificate.proofWitness? 6400 p.signature p.input | return false
+  return acceptsCertified.{0,0} 6400 p.signature p.input w &&
+    !acceptsCertifiedSource.{0} 6400 (source c) c.profile c.target (selection c) w
+
+#guard Features.mutatedSources.all rejectsMutation
+
+
+def rejectsStoreMutation (m : Features.Mutation) : Bool := Id.run do
+  let some c := make? m.name m.signature m.altered | return false
+  let some p := repaired? c m.original | return false
+  let some w := Ix.Theory.Certificate.proofWitness? 6400 p.signature p.input | return false
+  return acceptsStoreCertified.{0,0} 6400 p.signature p.input.store [.member c.target 0] w.declarations &&
+    !acceptsCertifiedStoreSource.{0} 6400 (source c) c.profile [c.target] (selection c) w.declarations
+
+#guard Features.mutatedSources.all rejectsStoreMutation
+
+def rejectsIngressMutation (m : Features.IngressMutation) : Bool :=
+  m.altered.any fun c =>
+    match readSnapshot? 6400 (source c) (selection c) {} with
+    | none => true
+    | some (snapshot, _) => (snapshot.prepare? 6400 c.profile c.target).isNone
+
+#guard Features.ingressMutations.all rejectsIngressMutation
+
+def naturalState : Bool := Id.run do
+  let some c := Features.naturalCase | return false
+  let env := source c
+  let some w := suggestSource? 6400 env c.profile c.target (selection c) | return false
+  let .ok _ warm := (certifiedStep.{0} 6400 env c.profile c.target (selection c) w).run initialCertifiedState | return false
+  for alter in [Features.missingPin, Features.wrongPin] do
+    let other := alter c
+    let .error _ _ := (certifiedStep.{0} 6400 env other.profile c.target (selection c) w).run warm | return false
+  let some (literal, bytes) := c.literals.head? | return false
+  let changed := { env with blobs := env.blobs.insert literal (bytes.push 1) }
+  let .error _ _ := (certifiedStep.{0} 6400 changed c.profile c.target (selection c) w).run warm | return false
+  let missing := { env with blobs := env.blobs.erase literal }
+  let .error _ _ := (certifiedStep.{0} 6400 missing c.profile c.target (selection c) w).run warm | return false
+  let some recursor := reference c.references (.member 201 0) | return false
+  let thin := { (selection c) with objects := (selection c).objects.filter (· != recursor) }
+  let assumed := { env with assumptions := env.assumptions.insert recursor }
+  let .error _ _ := (certifiedStep.{0} 6400 assumed c.profile c.target thin w).run warm | return false
+  let reversed := { w with declarations := w.declarations.reverse }
+  let .error _ _ := (certifiedStep.{0} 6400 env c.profile c.target (selection c) reversed).run warm | return false
+  return true
+
+#guard naturalState
+
+def storeRollback (c : Case) : Bool := Id.run do
+  let env := source c
+  let some w := suggestStore? 6400 env c.profile (subjects c) (selection c) | return false
+  let .ok _ cold := (certifiedStoreStep.{0} 6400 env c.profile (subjects c) (selection c) w).run initialCertifiedState | return false
+  let start := { cold with checker := poisonedChecker c }
+  let .ok _ warm := (certifiedStoreStep.{0} 6400 env c.profile (subjects c) (selection c) w).run start | return false
+  let .error _ failed := (certifiedStoreStep.{0} 6400 env c.profile (subjects c) (selection c) []).run warm | return false
+  if failed.inputCache.hits != warm.inputCache.hits || failed.inputCache.misses != warm.inputCache.misses then return false
+  let .ok _ retry := (certifiedStoreStep.{0} 6400 env c.profile (subjects c) (selection c) w).run failed | return false
+  return retry.inputCache.misses == cold.inputCache.misses
+
+#guard cases.all storeRollback
+
+def emptyBlockRejected : Bool := Id.run do
+  let empty := Fixtures.encode ⟨.muts #[], #[], #[], #[]⟩
+  let c : Case := {
+    name := "empty-source-block", profile := Fixtures.profile, target := empty.1,
+    blobs := Fixtures.prelude ++ [empty], literals := [], references := [], blocks := [] }
+  return !acceptsCertifiedStoreSource.{0} 6400 (source c) c.profile [empty.1] (selection c) []
+
+#guard emptyBlockRejected
+
+def writeCase (directory : System.FilePath) (c : Case) : IO Unit := do
+  let some (bytes, _) := loadedIxe? c | throw (IO.userError s!"cannot serialize source case: {c.name}")
+  let directory := directory / c.name
+  IO.FS.createDirAll directory
+  IO.FS.writeBinFile (directory / "source.ixe") bytes
+  let request := Lean.Json.mkObj [
+    ("target", toJson (hexOfBytes c.target.hash)),
+    ("subjects", toJson ((subjects c).map fun a => hexOfBytes a.hash)),
+    ("falseType", toJson (hexOfBytes c.profile.falseType.hash)),
+    ("falseElim", toJson (hexOfBytes c.profile.falseElim.hash)),
+    ("natType", toJson (c.profile.natType.map fun a => hexOfBytes a.hash)),
+    ("objects", toJson ((selection c).objects.map fun a => hexOfBytes a.hash)),
+    ("naturals", toJson ((selection c).naturals.map fun a => hexOfBytes a.hash))]
+  IO.FS.writeFile (directory / "request.json") (request.pretty ++ "\n")
+
+def run (directory : Option System.FilePath) : IO Unit := do
+  for c in cases do
+    for (name, test) in [("proof", accepted), ("declarations", storeAccepted),
+        ("cache-and-rollback", warmAndRollback), ("ixe", ixeAccepted),
+        ("lazy-selection", lazyOnlySelected), ("materialized-cache", materializedCacheIgnored),
+        ("hostile-source", hostileSource), ("store-rollback", storeRollback)] do
+      unless test c do throw (IO.userError s!"{name} failed: {c.name}")
+    if let some directory := directory then writeCase directory c
+  for m in Features.mutatedSources do
+    unless rejectsMutation m && rejectsStoreMutation m do
+      throw (IO.userError s!"source mutation escaped a TcM gate: {m.name}")
+  for m in Features.ingressMutations do
+    unless rejectsIngressMutation m do throw (IO.userError s!"ingress mutation escaped: {m.name}")
+  unless naturalState && emptyBlockRejected do throw (IO.userError "profile/dependency or empty-block rejection failed")
+  IO.println <| (Lean.Json.mkObj [
+    ("proofAccepted", toJson cases.length), ("storesAccepted", toJson cases.length),
+    ("ixeAccepted", toJson cases.length), ("warmProofScenarios", toJson cases.length),
+    ("warmStoreScenarios", toJson cases.length), ("lazySelectionScenarios", toJson cases.length),
+    ("materializedCacheScenarios", toJson cases.length), ("hostileSourceScenarios", toJson cases.length),
+    ("proofSourceMutationsRejected", toJson Features.mutatedSources.length),
+    ("storeSourceMutationsRejected", toJson Features.mutatedSources.length),
+    ("ingressMutationsRejected", toJson Features.ingressMutations.length),
+    ("naturalStateScenario", toJson true), ("emptyBlockRejected", toJson true),
+    ("unexpectedErrors", toJson (0 : Nat))]).compress
+
+end Tests.Certified.Source
diff --git a/Tests/Certified/SourceMain.lean b/Tests/Certified/SourceMain.lean
new file mode 100644
index 000000000..78bb696fc
--- /dev/null
+++ b/Tests/Certified/SourceMain.lean
@@ -0,0 +1,13 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Certified.Source
+
+def main (args : List String) : IO UInt32 := do
+  if args.length > 1 then
+    IO.eprintln "usage: certified-source-tests [OUTPUT_DIRECTORY]"
+    return 2
+  Tests.Certified.Source.run (args.head?.map System.FilePath.mk)
+  return 0
diff --git a/Tests/Certified/VM.lean b/Tests/Certified/VM.lean
new file mode 100644
index 000000000..cabfbdaa9
--- /dev/null
+++ b/Tests/Certified/VM.lean
@@ -0,0 +1,136 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Certified.Corpus
+import Ix.Certified.Packet
+import Ix.IxVM.Certified.Accept
+import Ix.Aiur.Interpret
+import Ix.Aiur.Semantics.SourceEval
+
+namespace Ix.Certified.VmTests
+
+open Ix.Theory Ix.Theory.Certified Ix.Theory.Model
+
+structure Input where
+  prepared : PreparedInput
+  witness : ProofWitness Address
+  words : Array Nat
+  args : Array Aiur.G
+
+def fromCase (c : Corpus.Case) : Except String Input := do
+  let some prepared := prepare? 300 Fixtures.profile c.target c.blobs
+    | throw "serialized preparation declined"
+  let some witness := Ix.Theory.Certificate.proofWitness? 300 prepared.signature prepared.input
+    | throw "witness construction declined"
+  return ⟨prepared, witness, ← Packet.words prepared.signature prepared.input witness,
+    ← Packet.args prepared.signature⟩
+
+def asValues (args : Array Aiur.G) : List Aiur.Value :=
+  [.array (args.extract 0 32 |>.map .field), .field (args[32]?.getD 0),
+   .array (args.extract 33 65 |>.map .field), .field (args[65]?.getD 0)]
+
+def emitWords (emit : Packet.Emit Unit) : Except String (Array Nat) := do
+  return (← emit #[]).2
+
+def prelude (i : Input) : Packet.Emit Unit := do
+  Packet.nat 1
+  Packet.source (← Packet.lookup i.prepared.input i.prepared.signature.falseType)
+  Packet.source (← Packet.lookup i.prepared.input i.prepared.signature.falseElim)
+
+def changes (i : Input) : Except String (List (String × Array Nat)) := do
+  let some (.definition definition) := i.witness.declarations.head?
+    | throw "test requires one admitted definition"
+  let source ← match i.prepared.input.store.lookup definition.ref with
+    | some s => pure s | none => throw "source missing"
+  let .defn n kind typ body _ := source | throw "test requires a definition"
+  let sourcePrefix ← emitWords do
+    prelude i
+    Packet.nat i.witness.declarations.length
+    Packet.ref definition.ref
+  let original ← emitWords (Packet.source source)
+  let replaceSource := fun (source : Const Address) => do
+    let replacement ← emitWords (Packet.source source)
+    return sourcePrefix ++ replacement ++ i.words.extract (sourcePrefix.size + original.size) i.words.size
+  let prefixPrelude ← emitWords (prelude i)
+  let wrongAnnotations := { definition with bodyAnnotations :=
+    match definition.bodyAnnotations with
+    | .lam _ domain body => .lam none domain body
+    | other => other }
+  let badAnnotationWitness := { i.witness with declarations := [.definition wrongAnnotations] }
+  let badRuleWitness := { i.witness with declarations :=
+    [.definition { definition with bodyWitness := .sort }] }
+  let changedStatement : ProofInput Address := { i.prepared.input with proposition :=
+    (VExpr.forallE (.sort (.succ .zero)) (.forallE (.bvar 0) (.bvar 1))) }
+  return [
+    ("trailing-word", i.words.push 0),
+    ("truncated-packet", i.words.extract 0 (i.words.size - 1)),
+    ("unknown-packet-version", i.words.set! 0 2),
+    ("out-of-range-scalar", i.words.set! 0 65536),
+    ("primitive-universe-arity", i.words.set! 2 1),
+    ("primitive-K-flag", i.words.set! (prefixPrelude.size - 2) 1),
+    ("axiom-in-admission", ← replaceSource (Const.axiom n typ .safe)),
+    ("unsafe-in-admission", ← replaceSource (.defn n kind typ body .«unsafe»)),
+    ("partial-in-admission", ← replaceSource (.defn n kind typ body .«partial»)),
+    ("changed-source-body", ← replaceSource (.defn n kind typ (.sort .zero) .safe)),
+    ("wrong-annotation", ← Packet.words i.prepared.signature i.prepared.input badAnnotationWitness),
+    ("wrong-typing-rule", ← Packet.words i.prepared.signature i.prepared.input badRuleWitness),
+    ("missing-declaration", ← Packet.words i.prepared.signature i.prepared.input
+      { i.witness with declarations := [] }),
+    ("duplicate-declaration", ← Packet.words i.prepared.signature i.prepared.input
+      { i.witness with declarations := i.witness.declarations ++ i.witness.declarations }),
+    ("changed-original-statement", ← Packet.words i.prepared.signature changedStatement i.witness)
+  ]
+
+def run : IO Unit := do
+  let compiled ← IO.ofExcept IxVM.Certified.compiled
+  let some function := compiled.getFuncIdx `c_accept | throw (IO.userError "entrypoint missing")
+  let vm ← IO.ofExcept (IxVM.Certified.toplevel.mapError toString)
+  let decls ← IO.ofExcept (vm.mkDecls.mapError toString)
+  for c in Corpus.positive do
+    let input ← IO.ofExcept (fromCase c)
+    let io := Packet.ioBuffer input.words
+    let (output, _, _) ← IO.ofExcept (compiled.bytecode.execute function input.args io)
+    unless output == #[1] do throw (IO.userError s!"native declined {c.name}")
+    let (result, state) := Aiur.runFunction decls ⟨`c_accept⟩ (asValues input.args) io
+    match result with
+    | .ok (.field value) =>
+      unless value == 1 do throw (IO.userError s!"interpreter declined {c.name}")
+    | .ok _ => throw (IO.userError s!"interpreter result shape changed for {c.name}")
+    | .error error => throw (IO.userError (error.ppDeref state.store 4 3))
+    -- A source-evaluator check on each conversion-using case keeps a
+    -- second executable semantics in the differential corpus.
+    if c.name == "identity" || c.name == "beta-statement" || c.name == "eta-statement" then
+      match Aiur.Source.Eval.runFunction decls ⟨`c_accept⟩ (asValues input.args) io 5000 with
+      | .ok (.field value, _) =>
+        unless value == 1 do throw (IO.userError s!"source evaluator declined {c.name}")
+      | .ok _ => throw (IO.userError s!"source result shape changed for {c.name}")
+      | .error error => throw (IO.userError s!"source evaluator: {repr error}")
+    IO.println s!"PASS {c.name}: native/interpreter agreement"
+  let input ← IO.ofExcept (fromCase (Corpus.one "identity" Fixtures.identity))
+  let negative ← IO.ofExcept (changes input)
+  for (name, words) in negative do
+    match compiled.bytecode.execute function input.args (Packet.ioBuffer words) with
+    | .error _ => IO.println s!"PASS {name}: native rejection"
+    | .ok _ => throw (IO.userError s!"native accepted malformed certificate: {name}")
+  -- Public address coordinates must be bytes, even before any private
+  -- source/certificate data is used.
+  match compiled.bytecode.execute function (input.args.set! 0 256) (Packet.ioBuffer input.words) with
+  | .error _ => IO.println "PASS public-address-range: native rejection"
+  | .ok _ => throw (IO.userError "native accepted a non-byte public address coordinate")
+  for c in Corpus.declined do
+    if acceptsSerialized.{0} 300 Fixtures.profile c.target c.blobs input.witness then
+      throw (IO.userError s!"serialized boundary accepted excluded syntax: {c.name}")
+    unless (prepare? 300 Fixtures.profile c.target c.blobs).isNone do
+      throw (IO.userError s!"profile exclusion changed: {c.name}")
+    IO.println s!"DECLINE {c.name}: serialized profile exclusion"
+  IO.println <| (Lean.Json.mkObj [
+    ("accepted", Lean.toJson Corpus.positive.length),
+    ("declined", Lean.toJson Corpus.declined.length),
+    ("vmRejected", Lean.toJson (negative.length + 1)),
+    ("unexpectedErrors", Lean.toJson (0 : Nat))]).compress
+
+end Ix.Certified.VmTests
+
+def main : IO Unit := Ix.Certified.VmTests.run
diff --git a/Tests/Certified/foundation.txt b/Tests/Certified/foundation.txt
new file mode 100644
index 000000000..5bd8291bd
--- /dev/null
+++ b/Tests/Certified/foundation.txt
@@ -0,0 +1,4243 @@
+ROOT Ix.Certified.decodeObject?
+(address : Address) → (bytes : ByteArray) → Option (DecodedObject address bytes)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.decodeNatural?
+(address : Address) →
+  (bytes : ByteArray) →
+    Option
+      { value //
+        address.hash.size = 32 ∧
+          Address.blake3 bytes = address ∧ Nat.fromBytesLE bytes.data = value ∧ { data := value.toBytesLE } = bytes }
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.readSignature?
+Profile → Objects → Option (Theory.Certified.PrimitiveSignature Address)
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.prepare?
+Nat → Profile → Address → ConstantBlobs → optParam ConstantBlobs [] → Option PreparedInput
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.acceptsSerialized_prepared
+∀ {fuel : Nat} {profile : Profile} {target : Address} {blobs literalBlobs : ConstantBlobs}
+  {witness : Theory.Certified.ProofWitness Address},
+  acceptsSerialized fuel profile target blobs witness literalBlobs = true →
+    ∃ prepared,
+      prepare? fuel profile target blobs literalBlobs = some prepared ∧
+        Theory.Certified.acceptsCertified fuel prepared.signature prepared.input witness = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.accepted_serialized_has_model
+∀ {fuel : Nat} {profile : Profile} {target : Address} {blobs literalBlobs : ConstantBlobs}
+  {witness : Theory.Certified.ProofWitness Address},
+  acceptsSerialized fuel profile target blobs witness literalBlobs = true →
+    ∀ (V : Type v) [inst : Theory.Model.SetTheory V] (levels : List Nat) (env : Nat → V),
+      ∃ prepared,
+        prepare? fuel profile target blobs literalBlobs = some prepared ∧
+          ∃ result,
+            Theory.Certified.checkProofCertified fuel prepared.signature prepared.input witness = some result ∧
+              ∃ constants,
+                prepared.signature.Compatible result.environment.entries constants ∧
+                  Theory.Model.WellDenoted constants levels env result.proof.val ∧
+                    Theory.Model.WellDenoted constants levels env result.proposition.val ∧
+                      Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels env result.proof.val)
+                        (Theory.Model.interp constants levels env result.proposition.val)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.no_serialized_proof_of_False
+∀ {fuel : Nat} {profile : Profile} {target : Address} {blobs literalBlobs : ConstantBlobs}
+  {witness : Theory.Certified.ProofWitness Address} (V : Type v) [Theory.Model.SetTheory V],
+  isFalseStatement fuel profile target blobs literalBlobs = true →
+    acceptsSerialized fuel profile target blobs witness literalBlobs = true → False
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.constantBytes?
+Ixon.Env → Address → Option ByteArray
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.decodeObject_complete
+∀ {address : Address} {bytes : ByteArray} (value : DecodedObject address bytes),
+  decodeObject? address bytes = some value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.decodeNatural_complete
+∀ {address : Address} {bytes : ByteArray} (value : DecodedNatural address bytes),
+  decodeNatural? address bytes = some value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceSnapshot.prepare_eq
+∀ {source : Ixon.Env} (fuel : Nat) (profile : Profile) (target : Address) (snapshot : SourceSnapshot source),
+  prepare? fuel profile target snapshot.blobs snapshot.literalBlobs =
+    SourceSnapshot.prepare? fuel profile target snapshot
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceSnapshot.prepareStore_eq
+∀ {source : Ixon.Env} (fuel : Nat) (profile : Profile) (subjects : List Address) (snapshot : SourceSnapshot source),
+  prepareStore? fuel profile subjects snapshot.blobs snapshot.literalBlobs =
+    SourceSnapshot.prepareStore? fuel profile subjects snapshot
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceSnapshot.objects_from_source
+∀ {source : Ixon.Env} (snapshot : SourceSnapshot source) {address : Address} {bytes : ByteArray},
+  (address, bytes) ∈ snapshot.blobs → constantBytes? source address = some bytes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceSnapshot.naturals_from_source
+∀ {source : Ixon.Env} (snapshot : SourceSnapshot source) {address : Address} {bytes : ByteArray},
+  (address, bytes) ∈ snapshot.literalBlobs → source.getBlob? address = some bytes
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceReceipt.serialized
+∀ {source : Ixon.Env} {fuel : Nat} {profile : Profile} {target : Address}
+  {witness : Theory.Certified.ProofWitness Address} (receipt : SourceReceipt source fuel profile target witness),
+  acceptsSerialized fuel profile target receipt.snapshot.blobs witness receipt.snapshot.literalBlobs = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.StoreReceipt.serialized
+∀ {source : Ixon.Env} {fuel : Nat} {profile : Profile} {subjects : List Address}
+  {witness : List (Theory.Certified.DeclarationWitness Address)}
+  (receipt : StoreReceipt source fuel profile subjects witness),
+  acceptsSerializedStore fuel profile subjects receipt.snapshot.blobs witness receipt.snapshot.literalBlobs = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.accepted_serialized_store_has_model
+∀ {fuel : Nat} {profile : Profile} {subjects : List Address} {blobs literalBlobs : ConstantBlobs}
+  {witness : List (Theory.Certified.DeclarationWitness Address)},
+  acceptsSerializedStore fuel profile subjects blobs witness literalBlobs = true →
+    ∀ (V : Type v) [inst : Theory.Model.SetTheory V],
+      ∃ prepared,
+        prepareStore? fuel profile subjects blobs literalBlobs = some prepared ∧
+          ∃ result,
+            Theory.Certified.checkStoreCertified fuel prepared.signature prepared.store prepared.targets witness =
+                some result ∧
+              ∃ constants,
+                prepared.signature.Compatible result.environment.entries constants ∧
+                  ∀ (r : Theory.ConstRef Address),
+                    r ∈ prepared.targets →
+                      ∃ entry,
+                        result.environment.entries r = some entry ∧
+                          Theory.Certified.EntrySource prepared.signature prepared.store r entry ∧
+                            ∀ (levels : List Nat),
+                              levels.length = entry.universes →
+                                ∀ (env : Nat → V),
+                                  Theory.Model.WellDenoted constants levels env entry.type ∧
+                                    Theory.Model.SetTheory.Mem (constants r levels)
+                                      (Theory.Model.interp constants levels env entry.type)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.TcM.checkCertified_success
+∀ {m : Kernel.Mode} {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address} {selection : InputSelection}
+  {witness : Theory.Certified.ProofWitness Address} {cache nextCache : InputCache} {before after : Kernel.TcState m}
+  {receipt : SourceReceipt source fuel profile target witness},
+  EStateM.run (Kernel.TcM.checkCertified fuel source profile target selection witness cache) before =
+      EStateM.Result.ok (receipt, nextCache) after →
+    checkSource? fuel source profile target selection witness cache = some (receipt, nextCache) ∧ after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.TcM.checkCertified_failure
+∀ {m : Kernel.Mode} {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address} {selection : InputSelection}
+  {witness : Theory.Certified.ProofWitness Address} {cache : InputCache} {before after : Kernel.TcState m}
+  {error : Kernel.TcError m},
+  EStateM.run (Kernel.TcM.checkCertified fuel source profile target selection witness cache) before =
+      EStateM.Result.error error after →
+    checkSource? fuel source profile target selection witness cache = none ∧ after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.TcM.checkStoreCertified_success
+∀ {m : Kernel.Mode} {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address}
+  {selection : InputSelection} {witness : List (Theory.Certified.DeclarationWitness Address)}
+  {cache nextCache : InputCache} {before after : Kernel.TcState m}
+  {receipt : StoreReceipt source fuel profile subjects witness},
+  EStateM.run (Kernel.TcM.checkStoreCertified fuel source profile subjects selection witness cache) before =
+      EStateM.Result.ok (receipt, nextCache) after →
+    checkSourceStore? fuel source profile subjects selection witness cache = some (receipt, nextCache) ∧ after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.certifiedStep_success
+∀ {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address} {selection : InputSelection}
+  {witness : Theory.Certified.ProofWitness Address} {before after : Kernel.CertifiedState}
+  {receipt : SourceReceipt source fuel profile target witness},
+  (Kernel.certifiedStep fuel source profile target selection witness).run before = EStateM.Result.ok receipt after →
+    checkSource? fuel source profile target selection witness before.inputCache = some (receipt, after.inputCache) ∧
+      after.checker = before.checker
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.certifiedStep_failure
+∀ {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address} {selection : InputSelection}
+  {witness : Theory.Certified.ProofWitness Address} {before after : Kernel.CertifiedState}
+  {error : Kernel.TcError Kernel.Mode.anon},
+  (Kernel.certifiedStep fuel source profile target selection witness).run before = EStateM.Result.error error after →
+    after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.certifiedStoreStep_success
+∀ {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address} {selection : InputSelection}
+  {witness : List (Theory.Certified.DeclarationWitness Address)} {before after : Kernel.CertifiedState}
+  {receipt : StoreReceipt source fuel profile subjects witness},
+  (Kernel.certifiedStoreStep fuel source profile subjects selection witness).run before =
+      EStateM.Result.ok receipt after →
+    checkSourceStore? fuel source profile subjects selection witness before.inputCache =
+        some (receipt, after.inputCache) ∧
+      after.checker = before.checker
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.certifiedStoreStep_failure
+∀ {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address} {selection : InputSelection}
+  {witness : List (Theory.Certified.DeclarationWitness Address)} {before after : Kernel.CertifiedState}
+  {error : Kernel.TcError Kernel.Mode.anon},
+  (Kernel.certifiedStoreStep fuel source profile subjects selection witness).run before =
+      EStateM.Result.error error after →
+    after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.initialCertifiedState
+Kernel.CertifiedState
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.accepted_tc_has_model
+∀ {fuel : Nat} {source : Ixon.Env} {profile : Profile} {target : Address} {selection : InputSelection}
+  {witness : Theory.Certified.ProofWitness Address},
+  Kernel.acceptsCertifiedSource fuel source profile target selection witness = true →
+    ∀ (V : Type v) [inst : Theory.Model.SetTheory V] (levels : List Nat) (env : Nat → V),
+      ∃ receipt,
+        Kernel.runCertified fuel source profile target selection witness = some receipt ∧
+          (∀ (address : Address) (bytes : ByteArray),
+              (address, bytes) ∈ receipt.snapshot.blobs → constantBytes? source address = some bytes) ∧
+            (∀ (address : Address) (bytes : ByteArray),
+                (address, bytes) ∈ receipt.snapshot.literalBlobs → source.getBlob? address = some bytes) ∧
+              ∃ constants,
+                receipt.prepared.signature.Compatible receipt.proof.environment.entries constants ∧
+                  Theory.Model.WellDenoted constants levels env receipt.proof.proof.val ∧
+                    Theory.Model.WellDenoted constants levels env receipt.proof.proposition.val ∧
+                      Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels env receipt.proof.proof.val)
+                        (Theory.Model.interp constants levels env receipt.proof.proposition.val)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.accepted_tc_store_has_model
+∀ {fuel : Nat} {source : Ixon.Env} {profile : Profile} {subjects : List Address} {selection : InputSelection}
+  {witness : List (Theory.Certified.DeclarationWitness Address)},
+  Kernel.acceptsCertifiedStoreSource fuel source profile subjects selection witness = true →
+    ∀ (V : Type v) [inst : Theory.Model.SetTheory V],
+      ∃ receipt,
+        Kernel.runCertifiedStore fuel source profile subjects selection witness = some receipt ∧
+          (∀ (address : Address) (bytes : ByteArray),
+              (address, bytes) ∈ receipt.snapshot.blobs → constantBytes? source address = some bytes) ∧
+            (∀ (address : Address) (bytes : ByteArray),
+                (address, bytes) ∈ receipt.snapshot.literalBlobs → source.getBlob? address = some bytes) ∧
+              ∃ constants,
+                receipt.prepared.signature.Compatible receipt.result.environment.entries constants ∧
+                  ∀ (r : Theory.ConstRef Address),
+                    r ∈ receipt.prepared.targets →
+                      ∃ entry,
+                        receipt.result.environment.entries r = some entry ∧
+                          Theory.Certified.EntrySource receipt.prepared.signature receipt.prepared.store r entry ∧
+                            ∀ (levels : List Nat),
+                              levels.length = entry.universes →
+                                ∀ (env : Nat → V),
+                                  Theory.Model.WellDenoted constants levels env entry.type ∧
+                                    Theory.Model.SetTheory.Mem (constants r levels)
+                                      (Theory.Model.interp constants levels env entry.type)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.no_tc_proof_of_False
+∀ {source : Ixon.Env} {fuel : Nat} {profile : Profile} {target : Address}
+  {witness : Theory.Certified.ProofWitness Address} (receipt : SourceReceipt source fuel profile target witness)
+  (V : Type v) [Theory.Model.SetTheory V],
+  receipt.prepared.input.proposition = receipt.prepared.signature.falseExpr → False
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.Command.run_success
+∀ {mode : String} {fuel : Nat} {source : Ixon.Env} {request : Command.Request},
+  Command.run mode fuel source request = Except.ok () →
+    (mode = "proof" ∧
+        ∃ witness,
+          Kernel.acceptsCertifiedSource fuel source request.profile request.target request.selection witness = true) ∨
+      mode = "store" ∧
+        ∃ witness,
+          Kernel.acceptsCertifiedStoreSource fuel source request.profile request.subjects request.selection witness =
+            true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.resolveReference_iff
+∀ {objects : Objects} {address : Address} {ref : Theory.ConstRef Address},
+  resolveReference? objects address = some ref ↔ ReferenceMeaning objects address ref
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.readLevel_value
+∀ (level : Ixon.Univ) (levels : List Nat), Theory.VLevel.eval levels (readLevel level) = sourceLevelValue levels level
+AXIOMS [propext]
+ROOT Ix.Certified.readExpr_sound
+∀ {fuel : Nat} {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant}
+  {expression : Ixon.Expr} {reading : Theory.VExpr Address},
+  readExpr? fuel objects naturals block source expression = some reading →
+    ExprReading objects naturals block source expression reading
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.ExprReading.unique
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {expression : Ixon.Expr}
+  {left right : Theory.VExpr Address},
+  ExprReading objects naturals block source expression left →
+    ExprReading objects naturals block source expression right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.readExpr_fuel_independent
+∀ {fuel₁ fuel₂ : Nat} {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant}
+  {expression : Ixon.Expr} {left right : Theory.VExpr Address},
+  readExpr? fuel₁ objects naturals block source expression = some left →
+    readExpr? fuel₂ objects naturals block source expression = some right → left = right
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.readBlock_sourceHeader
+∀ {fuel : Nat} {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant}
+  {result : Theory.Block Address} {ref : Theory.ConstRef Address} {universes : Nat} {type : Theory.VExpr Address},
+  readBlock? fuel objects naturals block source = some result →
+    blockHeader? result ref = some (universes, type) →
+      ∃ raw, rawHeader? source ref = some (universes, raw) ∧ ExprReading objects naturals block source raw type
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.readStore_sourceHeader
+∀ {fuel : Nat} {objects : Objects} {naturals : Naturals} {store : Theory.Store Address} {ref : Theory.ConstRef Address}
+  {entry : Theory.Model.ConstantEntry Address},
+  readStore? fuel objects naturals = some store →
+    Theory.Certified.SourceHeader store ref entry →
+      ∃ source raw,
+        lookup objects ref.block = some source ∧
+          rawHeader? source ref = some (entry.universes, raw) ∧
+            ExprReading objects naturals ref.block source raw entry.type.erase
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.SourceSnapshot.object_bytes
+∀ {source : Ixon.Env} (snapshot : SourceSnapshot source) {address : Address} {value : Ixon.Constant},
+  lookup snapshot.decodedObjects address = some value → ∃ bytes, ObjectBytes source address bytes value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceSnapshot.natural_bytes
+∀ {source : Ixon.Env} (snapshot : SourceSnapshot source) {address : Address} {value : Nat},
+  lookup snapshot.decodedNaturals address = some value → ∃ bytes, NaturalBytes source address bytes value
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.readSignature_sound
+∀ {profile : Profile} {objects : Objects} {signature : Theory.Certified.PrimitiveSignature Address},
+  readSignature? profile objects = some signature → SignatureReading profile objects signature
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.StoreReceipt.subject_meaning
+∀ {source : Ixon.Env} {fuel : Nat} {profile : Profile} {subjects : List Address}
+  {witness : List (Theory.Certified.DeclarationWitness Address)}
+  (receipt : StoreReceipt source fuel profile subjects witness) {ref : Theory.ConstRef Address},
+  ref ∈ receipt.prepared.targets →
+    ∃ entry,
+      receipt.result.environment.entries ref = some entry ∧
+        SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+          ∀ (V : Type v) [inst : Theory.Model.SetTheory V] (constants : Theory.Model.Assignment Address V),
+            receipt.prepared.signature.Compatible receipt.result.environment.entries constants →
+              ∀ (levels : List Nat),
+                levels.length = entry.universes →
+                  ∀ (env : Nat → V),
+                    Theory.Model.WellDenoted constants levels env entry.type ∧
+                      Theory.Model.SetTheory.Mem (constants ref levels)
+                        (Theory.Model.interp constants levels env entry.type)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.SourceReceipt.proposition_meaning
+∀ {source : Ixon.Env} {fuel : Nat} {profile : Profile} {target : Address}
+  {witness : Theory.Certified.ProofWitness Address} (receipt : SourceReceipt source fuel profile target witness),
+  SignatureReading profile receipt.snapshot.decodedObjects receipt.prepared.signature ∧
+    ∃ ref bytes declaration rawType,
+      ReferenceMeaning receipt.snapshot.decodedObjects target ref ∧
+        ObjectBytes source ref.block bytes declaration ∧
+          rawHeader? declaration ref = some (receipt.prepared.input.universes, rawType) ∧
+            ExprReading receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref.block declaration rawType
+                receipt.proof.proposition.val.erase ∧
+              ∀ (V : Type v) [inst : Theory.Model.SetTheory V] (constants : Theory.Model.Assignment Address V),
+                receipt.prepared.signature.Compatible receipt.proof.environment.entries constants →
+                  ∀ (levels : List Nat) (env : Nat → V),
+                    Theory.Model.WellDenoted constants levels env receipt.proof.proposition.val ∧
+                      Theory.Model.SetTheory.Mem
+                          (Theory.Model.interp constants levels env receipt.proof.proposition.val)
+                          (Theory.Model.SetTheory.univ 0) ∧
+                        Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels env receipt.proof.proof.val)
+                          (Theory.Model.interp constants levels env receipt.proof.proposition.val)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.StoreReceipt.subject_coverage
+∀ {source : Ixon.Env} {fuel : Nat} {profile : Profile} {subjects : List Address}
+  {witness : List (Theory.Certified.DeclarationWitness Address)}
+  (receipt : StoreReceipt source fuel profile subjects witness) (ref : Theory.ConstRef Address),
+  ref ∈ receipt.prepared.targets ↔
+    ∃ subject, subject ∈ subjects ∧ ∃ refs, SubjectReading receipt.snapshot.decodedObjects subject refs ∧ ref ∈ refs
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.TreeOpening.membership
+∀ {fuel : Nat} {root : Address} {bytes : ByteArray} (opening : TreeOpening fuel root bytes) {target : Address},
+  target ∈ treeLeaves opening.tree → TreeMembership root target
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.TreeOpening.unique
+∀ {fuel : Nat} {root : Address} {bytes : ByteArray} {a b : TreeOpening fuel root bytes}, a.tree = b.tree
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.treeLeaves_join
+∀ (left right : AssumptionTree) (address : Address),
+  address ∈ treeLeaves (left.node right) ↔ address ∈ treeLeaves left ∨ address ∈ treeLeaves right
+AXIOMS [propext]
+ROOT Ix.Certified.EnvelopeReading.unique
+∀ {address : Address} {bytes : ByteArray} {a b : EnvelopeReading address bytes}, a.envelope = b.envelope
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.readEnvelope?
+Nat → (address : Address) → (bytes : ByteArray) → Option (EnvelopeReading address bytes)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.readTree?
+(fuel : Nat) → (root : Address) → (bytes : ByteArray) → Option (TreeOpening fuel root bytes)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalChecking.original_subject
+∀ {source : Ixon.Env} {snapshot : SourceSnapshot source} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (checked : LogicalChecking snapshot fuel envelope witness) {ref : Theory.ConstRef Address},
+  ref ∈ checked.subjects →
+    ∃ entry,
+      checked.batch.receipt.checked.result.entries ref = some entry ∧
+        SourceDeclarationReading source snapshot.decodedObjects snapshot.decodedNaturals ref entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalChecking.original_frontier
+∀ {source : Ixon.Env} {snapshot : SourceSnapshot source} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (checked : LogicalChecking snapshot fuel envelope witness) {ref : Theory.ConstRef Address},
+  ref ∈ checked.frontierRefs →
+    ∃ entry,
+      checked.batch.receipt.frontier.interface.entries ref = some entry ∧
+        SourceDeclarationReading source snapshot.decodedObjects snapshot.decodedNaturals ref entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalChecking.logical_policy
+∀ {source : Ixon.Env} {snapshot : SourceSnapshot source} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (checked : LogicalChecking snapshot fuel envelope witness) {ref : Theory.ConstRef Address},
+  ref ∈ checked.axiomRefs →
+    ∃ entry,
+      Theory.Certified.Standard.EntrySource checked.store ref entry ∨
+        Theory.Certified.Quotient.EntrySource checked.store ref entry
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalChecking.closed_frontier
+∀ {source : Ixon.Env} {snapshot : SourceSnapshot source} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (checked : LogicalChecking snapshot fuel envelope witness),
+  claimFrontier envelope.claim = none → checked.batch.receipt.frontier.refs = []
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalReceipt.subject_meaning
+∀ {source : Ixon.Env} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (receipt : LogicalReceipt source fuel envelope witness) (V : Type v) [inst : Theory.Model.SetTheory V]
+  (constants : Theory.Model.Assignment Address V),
+  receipt.checked.signature.Compatible receipt.checked.batch.receipt.frontier.interface.entries constants →
+    ∃ constants',
+      receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants' ∧
+        Theory.Model.Assignment.AgreesOn receipt.checked.batch.receipt.frontier.interface.entries constants constants' ∧
+          ∀ (ref : Theory.ConstRef Address),
+            ref ∈ receipt.checked.subjects →
+              ∃ entry,
+                SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref
+                    entry ∧
+                  ∀ (levels : List Nat),
+                    levels.length = entry.universes →
+                      ∀ (env : Nat → V),
+                        Theory.Model.WellDenoted constants' levels env entry.type ∧
+                          Theory.Model.SetTheory.Mem (constants' ref levels)
+                            (Theory.Model.interp constants' levels env entry.type)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalReceipt.closed_subject_meaning
+∀ {source : Ixon.Env} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (receipt : LogicalReceipt source fuel envelope witness),
+  claimFrontier envelope.claim = none →
+    ∀ (V : Type v) [inst : Theory.Model.SetTheory V],
+      ∃ constants,
+        receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants ∧
+          ∀ (ref : Theory.ConstRef Address),
+            ref ∈ receipt.checked.subjects →
+              ∃ entry,
+                SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref
+                    entry ∧
+                  ∀ (levels : List Nat),
+                    levels.length = entry.universes →
+                      ∀ (env : Nat → V),
+                        Theory.Model.WellDenoted constants levels env entry.type ∧
+                          Theory.Model.SetTheory.Mem (constants ref levels)
+                            (Theory.Model.interp constants levels env entry.type)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.LogicalReceipt.no_False
+∀ {source : Ixon.Env} {fuel : Nat} {envelope : Envelope} {witness : LogicalWitness}
+  (receipt : LogicalReceipt source fuel envelope witness),
+  claimFrontier envelope.claim = none →
+    ∀ {ref : Theory.ConstRef Address},
+      ref ∈ receipt.checked.subjects →
+        receipt.checked.store.type ref = some receipt.checked.signature.falseExpr →
+          ∀ (V : Type v) [Theory.Model.SetTheory V], False
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.RevealReceipt.meaning
+∀ {source : Ixon.Env} {commitment : Address} {info : RevealConstantInfo} {witness : RevealWitness}
+  (receipt : RevealReceipt source commitment info witness), RevealMeaning source commitment info
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.ClaimReceipt.meaning
+∀ {source : Ixon.Env} {fuel : Nat} {address : Address} {bytes : ByteArray}
+  (receipt : ClaimReceipt source fuel address bytes), SemanticClaimMeaning source fuel receipt.reading.envelope
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.accepted_claim_meaning
+∀ {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray} {witness : ClaimWitness},
+  acceptsClaimBytes fuel source address bytes witness = true →
+    ∃ receipt cache,
+      checkClaimBytes? fuel source address bytes witness { } = some (receipt, cache) ∧
+        Address.blake3 bytes = address ∧
+          envelopeBytes receipt.reading.envelope = bytes ∧ SemanticClaimMeaning source fuel receipt.reading.envelope
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.evaluation_not_semantic
+∀ {source : Ixon.Env} {fuel : Nat} {envelope : Envelope} {input output : Address} {frontier : Option Address},
+  envelope.claim = Claim.eval input output frontier → ¬SemanticClaimMeaning source fuel envelope
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.membership_not_leaf
+∀ {fuel : Nat} {root target : Address} {bytes : Option ByteArray},
+  readSubjectView? fuel (Claim.contains root target) bytes = none
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.revelation_not_leaf
+∀ {fuel : Nat} {commitment : Address} {info : RevealConstantInfo} {bytes : Option ByteArray},
+  readSubjectView? fuel (Claim.reveal commitment info) bytes = none
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.TcM.checkClaimCertified_success
+∀ {m : Kernel.Mode} {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray} {witness : ClaimWitness}
+  {cache nextCache : InputCache} {before after : Kernel.TcState m} {receipt : ClaimReceipt source fuel address bytes},
+  EStateM.run (Kernel.TcM.checkClaimCertified fuel source address bytes witness cache) before =
+      EStateM.Result.ok (receipt, nextCache) after →
+    checkClaimBytes? fuel source address bytes witness cache = some (receipt, nextCache) ∧ after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.certifiedClaimStep_failure
+∀ {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray} {witness : ClaimWitness}
+  {before after : Kernel.CertifiedState} {error : Kernel.TcError Kernel.Mode.anon},
+  (Kernel.certifiedClaimStep fuel source address bytes witness).run before = EStateM.Result.error error after →
+    after = before
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.certifiedClaimStep_success
+∀ {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray} {witness : ClaimWitness}
+  {before after : Kernel.CertifiedState} {receipt : ClaimReceipt source fuel address bytes},
+  (Kernel.certifiedClaimStep fuel source address bytes witness).run before = EStateM.Result.ok receipt after →
+    checkClaimBytes? fuel source address bytes witness before.inputCache = some (receipt, after.inputCache) ∧
+      after.checker = before.checker
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.accepted_tc_claim_meaning
+∀ {fuel : Nat} {source : Ixon.Env} {address : Address} {bytes : ByteArray} {witness : ClaimWitness},
+  Kernel.acceptsCertifiedClaim fuel source address bytes witness = true →
+    ∃ receipt,
+      Kernel.runCertifiedClaim fuel source address bytes witness = some receipt ∧
+        Address.blake3 bytes = address ∧
+          envelopeBytes receipt.reading.envelope = bytes ∧ SemanticClaimMeaning source fuel receipt.reading.envelope
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.ClaimCommand.readRequest
+Lean.Json → Except String ClaimCommand.Request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.ClaimCommand.run_success
+∀ {fuel : Nat} {source : Ixon.Env} {bytes : ByteArray} {request : ClaimCommand.Request},
+  ClaimCommand.run fuel source bytes request = Except.ok () →
+    ∃ witness, Kernel.acceptsCertifiedClaim fuel source request.address bytes witness = true
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.ClaimCommand.run_meaning
+∀ {fuel : Nat} {source : Ixon.Env} {bytes : ByteArray} {request : ClaimCommand.Request},
+  ClaimCommand.run fuel source bytes request = Except.ok () →
+    ∃ receipt,
+      Address.blake3 bytes = request.address ∧
+        envelopeBytes receipt.reading.envelope = bytes ∧ SemanticClaimMeaning source fuel receipt.reading.envelope
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Theory.Certified.Modeled.check?_sound
+∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Theory.Model.Environment β} {store : Theory.Store β}
+  {witness : Theory.Certified.Modeled.Witness β}
+  {result : Theory.Certified.CheckedClaim (Theory.Certified.Modeled.Checked entries store witness)},
+  Theory.Certified.Modeled.check? fuel entries store witness = some result →
+    Theory.Certified.Modeled.Checked entries store witness
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Theory.Certified.Modeled.checkEquation?_sound
+∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Theory.Model.Environment β}
+  {rule : Theory.Certified.Signature.Rule β} {witness : Theory.Certified.Modeled.EquationWitness β}
+  {result : Theory.Certified.CheckedClaim (Theory.Certified.Modeled.CheckedEquation entries rule)},
+  Theory.Certified.Modeled.checkEquation? fuel entries rule witness = some result →
+    Theory.Certified.Modeled.CheckedEquation entries rule
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Theory.Certified.Modeled.assignment_realizes
+∀ {β : Type u} [inst : DecidableEq β] {V : Type v} [inst_1 : Theory.Model.SetTheory V]
+  {entries : Theory.Model.Environment β} {companions : List (Theory.Certified.Modeled.Companion β)},
+  Theory.Certified.Modeled.CheckedCompanions entries companions →
+    entries.WF →
+      ∀ (constants : Theory.Model.Assignment β V),
+        Theory.Model.Realizes constants entries →
+          Theory.Model.Realizes (Theory.Certified.Modeled.assignment constants companions)
+            (Theory.Certified.Modeled.environment entries companions)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Theory.Certified.Modeled.assignment_agrees
+∀ {β : Type u} [inst : DecidableEq β] {V : Type v} {entries : Theory.Model.Environment β}
+  {companions : List (Theory.Certified.Modeled.Companion β)},
+  Theory.Certified.Modeled.CheckedCompanions entries companions →
+    ∀ (constants : Theory.Model.Assignment β V),
+      Theory.Model.Assignment.AgreesOn entries constants (Theory.Certified.Modeled.assignment constants companions)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Theory.Certified.checkModeledExtension?
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Theory.Certified.PrimitiveSignature β} →
+        {store : Theory.Store β} →
+          (state : Theory.Certified.CheckedInterface signature) →
+            Theory.Certified.Modeled.Witness β → Option (Theory.Certified.CheckedExtension signature store state)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Theory.Certificate.Modeled.witness?
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Theory.Model.Environment β →
+          Theory.Store β →
+            β →
+              List (Theory.ConstRef β) →
+                List (Theory.ConstRef β) →
+                  (optParam (Theory.ConstRef β → Nat → Option (Theory.Certificate.Modeled.ProofHint β)) fun x x_1 =>
+                      none) →
+                    Option (Theory.Certified.Modeled.Witness β)
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Theory.Certificate.sourceGroup?
+{β : Type u} →
+  [DecidableEq β] →
+    Theory.Store β →
+      Theory.ConstRef β →
+        optParam (Option (Theory.ConstRef β)) none →
+          optParam (List (Theory.Certificate.Modeled.Candidate β)) [] → Option (Theory.Certificate.SourceGroup β)
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Theory.Certificate.proofWitness?
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Theory.Certified.PrimitiveSignature β →
+        Theory.Certified.ProofInput β →
+          optParam (List (Theory.Certificate.Modeled.Candidate β)) [] → Option (Theory.Certified.ProofWitness β)
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.modelCandidate?
+Objects → Theory.Store Address → ModelHint → Option (Theory.Certificate.Modeled.Candidate Address)
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.modelCandidates?
+Objects → Theory.Store Address → List ModelHint → Option (List (Theory.Certificate.Modeled.Candidate Address))
+AXIOMS [propext, Quot.sound]
+ROOT Ix.Certified.ModelHint.readOptional
+Lean.Json → Except String (List ModelHint)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.ModelHint.read
+Lean.Json → Except String ModelHint
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.suggestSource?
+Nat →
+  Ixon.Env →
+    Profile → Address → InputSelection → optParam (List ModelHint) [] → Option (Theory.Certified.ProofWitness Address)
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.suggestStore?
+Nat →
+  Ixon.Env →
+    Profile →
+      List Address →
+        InputSelection → optParam (List ModelHint) [] → Option (List (Theory.Certified.DeclarationWitness Address))
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.Command.readRequest
+Lean.Json → Except String Command.Request
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Certified.suggestLogical?
+Nat → Ixon.Env → Envelope → LogicalHint → Option LogicalWitness
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.acceptsCertifiedSource
+Nat → Ixon.Env → Profile → Address → InputSelection → Theory.Certified.ProofWitness Address → Bool
+AXIOMS [propext, Classical.choice, Quot.sound]
+ROOT Ix.Kernel.acceptsCertifiedStoreSource
+Nat → Ixon.Env → Profile → List Address → InputSelection → List (Theory.Certified.DeclarationWitness Address) → Bool
+AXIOMS [propext, Classical.choice, Quot.sound]
+PREMISE Ix.Certified.InputCache.mk
+List CachedObject → List CachedNatural → Nat → Nat → InputCache
+PREMISE Ix.Certified.CachedObject.mk
+(address : Address) → (bytes : ByteArray) → DecodedObject address bytes → CachedObject
+PREMISE Ix.Certified.CachedNatural.mk
+(address : Address) → (bytes : ByteArray) → DecodedNatural address bytes → CachedNatural
+PREMISE Ix.Certified.DecodedObject
+Address → ByteArray → Type
+DEFINITION
+fun address bytes =>
+  { value //
+    address.hash.size = 32 ∧
+      Address.blake3 bytes = address ∧
+        Ixon.runGetExact Ixon.getConstant bytes = Except.ok value ∧ Ixon.serConstant value = bytes }
+PREMISE Ix.Certified.DecodedNatural
+Address → ByteArray → Type
+DEFINITION
+fun address bytes =>
+  { value //
+    address.hash.size = 32 ∧
+      Address.blake3 bytes = address ∧ Nat.fromBytesLE bytes.data = value ∧ { data := value.toBytesLE } = bytes }
+PREMISE Ix.Certified.SourceObject.mk
+{source : Ixon.Env} →
+  (toCachedObject : CachedObject) →
+    constantBytes? source toCachedObject.address = some toCachedObject.bytes → SourceObject source
+PREMISE Ix.Certified.SourceNatural.mk
+{source : Ixon.Env} →
+  (toCachedNatural : CachedNatural) →
+    source.getBlob? toCachedNatural.address = some toCachedNatural.bytes → SourceNatural source
+PREMISE Ix.Certified.SourceReceipt.mk
+{source : Ixon.Env} →
+  {fuel : Nat} →
+    {profile : Profile} →
+      {target : Address} →
+        {witness : Theory.Certified.ProofWitness Address} →
+          (snapshot : SourceSnapshot source) →
+            (prepared : PreparedInput) →
+              SourceSnapshot.prepare? fuel profile target snapshot = some prepared →
+                (proof : Theory.Certified.CheckedProof prepared.signature prepared.input) →
+                  Theory.Certified.checkProofCertified fuel prepared.signature prepared.input witness = some proof →
+                    SourceReceipt source fuel profile target witness
+PREMISE Ix.Certified.StoreReceipt.mk
+{source : Ixon.Env} →
+  {fuel : Nat} →
+    {profile : Profile} →
+      {subjects : List Address} →
+        {witness : List (Theory.Certified.DeclarationWitness Address)} →
+          (snapshot : SourceSnapshot source) →
+            (prepared : PreparedStore) →
+              SourceSnapshot.prepareStore? fuel profile subjects snapshot = some prepared →
+                (result : Theory.Certified.CheckedStore prepared.signature prepared.store prepared.targets) →
+                  Theory.Certified.checkStoreCertified fuel prepared.signature prepared.store prepared.targets witness =
+                      some result →
+                    StoreReceipt source fuel profile subjects witness
+PREMISE Ix.Certified.InputSelection.mk
+List Address → List Address → InputSelection
+PREMISE Ix.Certified.subjectReferences?
+Objects → Address → Option (List (Theory.ConstRef Address))
+DEFINITION
+fun objects subject => do
+  let source ← lookup objects subject
+  match source.info with
+    | Ixon.ConstantInfo.muts members =>
+      if members.isEmpty = true then none
+      else
+        pure
+          (List.flatMap
+            (fun x =>
+              match x with
+              | (member, index) =>
+                Theory.ConstRef.member subject index ::
+                  match member with
+                  | Ixon.MutConst.indc family =>
+                    List.map (fun x => Theory.ConstRef.ctor subject index x) (List.range family.ctors.size)
+                  | x => [])
+            members.toList.zipIdx)
+    | x => do
+      let __do_lift ← resolveReference? objects subject
+      pure [__do_lift]
+PREMISE Ix.Kernel.CertifiedState.mk
+Kernel.TcState Kernel.Mode.anon → InputCache → Kernel.CertifiedState
+PREMISE Ix.Certified.MemberMeaning
+Objects → Address → UInt64 → Ixon.MutConst → Prop
+DEFINITION
+fun objects block index member =>
+  ∃ source members,
+    lookup objects block = some source ∧
+      source.info = Ixon.ConstantInfo.muts members ∧ members[index.toNat]? = some member
+PREMISE Ix.Certified.ReferenceTarget
+Objects → Address → Ixon.Constant → Theory.ConstRef Address → Prop
+DEFINITION
+fun objects address source ref =>
+  match source.info with
+  | Ixon.ConstantInfo.defn a => ref = Theory.ConstRef.member address 0
+  | Ixon.ConstantInfo.recr a => ref = Theory.ConstRef.member address 0
+  | Ixon.ConstantInfo.axio a => ref = Theory.ConstRef.member address 0
+  | Ixon.ConstantInfo.quot a => ref = Theory.ConstRef.member address 0
+  | Ixon.ConstantInfo.iPrj projection =>
+    (∃ family, MemberMeaning objects projection.block projection.idx (Ixon.MutConst.indc family)) ∧
+      ref = Theory.ConstRef.member projection.block projection.idx.toNat
+  | Ixon.ConstantInfo.rPrj projection =>
+    (∃ recursor, MemberMeaning objects projection.block projection.idx (Ixon.MutConst.recr recursor)) ∧
+      ref = Theory.ConstRef.member projection.block projection.idx.toNat
+  | Ixon.ConstantInfo.dPrj projection =>
+    (∃ definition, MemberMeaning objects projection.block projection.idx (Ixon.MutConst.defn definition)) ∧
+      ref = Theory.ConstRef.member projection.block projection.idx.toNat
+  | Ixon.ConstantInfo.cPrj projection =>
+    (∃ family ctor,
+        MemberMeaning objects projection.block projection.idx (Ixon.MutConst.indc family) ∧
+          family.ctors[projection.cidx.toNat]? = some ctor) ∧
+      ref = Theory.ConstRef.ctor projection.block projection.idx.toNat projection.cidx.toNat
+  | Ixon.ConstantInfo.muts a => False
+PREMISE Ix.Certified.ReferenceMeaning
+Objects → Address → Theory.ConstRef Address → Prop
+DEFINITION
+fun objects address ref => ∃ source, lookup objects address = some source ∧ ReferenceTarget objects address source ref
+PREMISE Ix.Certified.LevelsReading.nil
+∀ {source : Ixon.Constant}, LevelsReading source [] []
+PREMISE Ix.Certified.LevelsReading.cons
+∀ {source : Ixon.Constant} {index : UInt64} {indices : List UInt64} {level : Ixon.Univ} {levels : List Theory.VLevel},
+  source.univs[index.toNat]? = some level →
+    LevelsReading source indices levels → LevelsReading source (index :: indices) (readLevel level :: levels)
+PREMISE Ix.Certified.ExprReading.var
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} (index : UInt64),
+  ExprReading objects naturals block source (Ixon.Expr.var index) (Theory.VExpr.bvar index.toNat)
+PREMISE Ix.Certified.ExprReading.sort
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {index : UInt64}
+  {level : Ixon.Univ},
+  source.univs[index.toNat]? = some level →
+    ExprReading objects naturals block source (Ixon.Expr.sort index) (Theory.VExpr.sort (readLevel level))
+PREMISE Ix.Certified.ExprReading.ref
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {index : UInt64}
+  {indices : Array UInt64} {address : Address} {ref : Theory.ConstRef Address} {levels : List Theory.VLevel},
+  source.refs[index.toNat]? = some address →
+    ReferenceMeaning objects address ref →
+      LevelsReading source indices.toList levels →
+        ExprReading objects naturals block source (Ixon.Expr.ref index indices) (Theory.VExpr.const ref levels)
+PREMISE Ix.Certified.ExprReading.recur
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {index : UInt64}
+  {indices : Array UInt64} {levels : List Theory.VLevel},
+  LevelsReading source indices.toList levels →
+    ExprReading objects naturals block source (Ixon.Expr.recur index indices)
+      (Theory.VExpr.const (Theory.ConstRef.member block index.toNat) levels)
+PREMISE Ix.Certified.ExprReading.app
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {f a : Ixon.Expr}
+  {fr ar : Theory.VExpr Address},
+  ExprReading objects naturals block source f fr →
+    ExprReading objects naturals block source a ar → ExprReading objects naturals block source (f.app a) (fr.app ar)
+PREMISE Ix.Certified.ExprReading.lam
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {A b : Ixon.Expr}
+  {Ar br : Theory.VExpr Address},
+  ExprReading objects naturals block source A Ar →
+    ExprReading objects naturals block source b br →
+      ExprReading objects naturals block source (Ixon.Expr.lam Ixon.Uses.many A b) (Ar.lam br)
+PREMISE Ix.Certified.ExprReading.all
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {A B : Ixon.Expr}
+  {Ar Br : Theory.VExpr Address},
+  ExprReading objects naturals block source A Ar →
+    ExprReading objects naturals block source B Br →
+      ExprReading objects naturals block source (Ixon.Expr.all Ixon.Uses.many Ixon.Owned.shared A B) (Ar.forallE Br)
+PREMISE Ix.Certified.ExprReading.prj
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {owner field : UInt64}
+  {value : Ixon.Expr} {address : Address} {ownerSource : Ixon.Constant} {projection : Ixon.InductiveProj}
+  {ref : Theory.ConstRef Address} {reading : Theory.VExpr Address},
+  source.refs[owner.toNat]? = some address →
+    lookup objects address = some ownerSource →
+      ownerSource.info = Ixon.ConstantInfo.iPrj projection →
+        ReferenceMeaning objects address ref →
+          ExprReading objects naturals block source value reading →
+            ExprReading objects naturals block source (Ixon.Expr.prj owner field value)
+              (Theory.VExpr.proj ref field.toNat reading)
+PREMISE Ix.Certified.ExprReading.nat
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {index : UInt64}
+  {address : Address} {value : Nat},
+  source.refs[index.toNat]? = some address →
+    lookup naturals address = some value →
+      ExprReading objects naturals block source (Ixon.Expr.nat index) (Theory.VExpr.natLit value)
+PREMISE Ix.Certified.ExprReading.share
+∀ {objects : Objects} {naturals : Naturals} {block : Address} {source : Ixon.Constant} {index : UInt64}
+  {shared : Ixon.Expr} {reading : Theory.VExpr Address},
+  source.sharing[index.toNat]? = some shared →
+    ExprReading objects naturals block source shared reading →
+      ExprReading objects naturals block source (Ixon.Expr.share index) reading
+PREMISE Ix.Certified.rawHeader?
+Ixon.Constant → Theory.ConstRef Address → Option (Nat × Ixon.Expr)
+DEFINITION
+fun source x =>
+  match x with
+  | Theory.ConstRef.member b index =>
+    match source.info with
+    | Ixon.ConstantInfo.muts members => Option.map memberRawHeader members[index]?
+    | Ixon.ConstantInfo.defn value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | Ixon.ConstantInfo.recr value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | Ixon.ConstantInfo.axio value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | Ixon.ConstantInfo.quot value => if index = 0 then some (value.lvls.toNat, value.typ) else none
+    | x => none
+  | Theory.ConstRef.ctor b index field =>
+    match source.info with
+    | Ixon.ConstantInfo.muts members => do
+      let __x ← members[index]?
+      match __x with
+        | Ixon.MutConst.indc family => do
+          let ctor ← family.ctors[field]?
+          pure (ctor.lvls.toNat, ctor.typ)
+        | x => none
+    | x => none
+PREMISE Ix.Certified.ObjectBytes
+Ixon.Env → Address → ByteArray → Ixon.Constant → Prop
+DEFINITION
+fun source address bytes value =>
+  constantBytes? source address = some bytes ∧
+    address.hash.size = 32 ∧
+      Address.blake3 bytes = address ∧
+        Ixon.runGetExact Ixon.getConstant bytes = Except.ok value ∧ Ixon.serConstant value = bytes
+PREMISE Ix.Certified.NaturalBytes
+Ixon.Env → Address → ByteArray → Nat → Prop
+DEFINITION
+fun source address bytes value =>
+  source.getBlob? address = some bytes ∧
+    address.hash.size = 32 ∧
+      Address.blake3 bytes = address ∧ Nat.fromBytesLE bytes.data = value ∧ { data := value.toBytesLE } = bytes
+PREMISE Ix.Certified.SignatureReading
+Profile → Objects → Theory.Certified.PrimitiveSignature Address → Prop
+DEFINITION
+fun profile objects signature =>
+  ReferenceMeaning objects profile.falseType signature.falseType ∧
+    ReferenceMeaning objects profile.falseElim signature.falseElim ∧
+      match profile.natType, signature.natType with
+      | none, none => True
+      | some address, some ref => ReferenceMeaning objects address ref
+      | x, x_1 => False
+PREMISE Ix.Certified.SourceDeclarationReading
+Ixon.Env → Objects → Naturals → Theory.ConstRef Address → Theory.Model.ConstantEntry Address → Prop
+DEFINITION
+fun source objects naturals ref entry =>
+  ∃ bytes declaration rawType,
+    ObjectBytes source ref.block bytes declaration ∧
+      lookup objects ref.block = some declaration ∧
+        rawHeader? declaration ref = some (entry.universes, rawType) ∧
+          ExprReading objects naturals ref.block declaration rawType entry.type.erase
+PREMISE Ix.Certified.SubjectReading
+Objects → Address → List (Theory.ConstRef Address) → Prop
+DEFINITION
+fun objects subject refs =>
+  ∃ source,
+    lookup objects subject = some source ∧
+      match source.info with
+      | Ixon.ConstantInfo.muts members =>
+        members.isEmpty = false ∧
+          refs =
+            List.flatMap
+              (fun x =>
+                match x with
+                | (member, index) =>
+                  Theory.ConstRef.member subject index ::
+                    match member with
+                    | Ixon.MutConst.indc family =>
+                      List.map (fun x => Theory.ConstRef.ctor subject index x) (List.range family.ctors.size)
+                    | x => [])
+              members.toList.zipIdx
+      | x => ∃ ref, ReferenceMeaning objects subject ref ∧ refs = [ref]
+PREMISE Ix.Certified.Protocol.current
+Protocol
+DEFINITION
+{ checker := 2 }
+PREMISE Ix.Certified.envelopeMagic
+ByteArray
+DEFINITION
+"IX-CERTIFIED-CLAIM".toUTF8 ++ { data := #[0] }
+PREMISE Ix.Certified.putEnvelope
+Envelope → Ixon.PutM Unit
+DEFINITION
+fun envelope => do
+  Ixon.putBytes envelopeMagic
+  Ixon.putTag0 { size := envelope.protocol.format }
+  Ixon.putTag0 { size := envelope.protocol.codec }
+  Ixon.putTag0 { size := envelope.protocol.checker }
+  Ixon.putTag0 { size := envelope.protocol.policy }
+  Ixon.putTag0 { size := envelope.protocol.aggregation }
+  Ixon.Serialize.put envelope.profile.falseType
+  Ixon.Serialize.put envelope.profile.falseElim
+  Claim.putOptAddr envelope.profile.natType
+  envelope.claim.put
+  Claim.putOptAddr envelope.logicalAxioms
+PREMISE Ix.Certified.getEnvelope
+Ixon.GetM Envelope
+DEFINITION
+do
+  let __do_lift ← Ixon.getBytes envelopeMagic.size
+  have __do_jp : Unit → Ixon.GetM Envelope := fun __r => do
+    let __do_lift ← Ixon.getTag0
+    have format : UInt64 := __do_lift.size
+    let __do_lift ← Ixon.getTag0
+    have codec : UInt64 := __do_lift.size
+    let __do_lift ← Ixon.getTag0
+    have checker : UInt64 := __do_lift.size
+    let __do_lift ← Ixon.getTag0
+    have policy : UInt64 := __do_lift.size
+    let __do_lift ← Ixon.getTag0
+    have aggregation : UInt64 := __do_lift.size
+    let falseType ← Ixon.Serialize.get
+    let falseElim ← Ixon.Serialize.get
+    let natType ← Claim.getOptAddr
+    let claim ← Claim.get
+    let logicalAxioms ← Claim.getOptAddr
+    pure
+        {
+          protocol :=
+            { format := format, codec := codec, checker := checker, policy := policy, aggregation := aggregation },
+          profile := { falseType := falseType, falseElim := falseElim, natType := natType }, claim := claim,
+          logicalAxioms := logicalAxioms }
+  if (__do_lift != envelopeMagic) = true then do
+      let __r ← throw "invalid certified claim magic"
+      __do_jp __r
+    else __do_jp ()
+PREMISE Ix.Certified.EnvelopeReading.mk
+{address : Address} →
+  {bytes : ByteArray} →
+    (envelope : Envelope) →
+      address.hash.size = 32 →
+        Address.blake3 bytes = address →
+          Ixon.runGetExact getEnvelope bytes = Except.ok envelope →
+            envelopeBytes envelope = bytes → envelope.protocol = Protocol.current → EnvelopeReading address bytes
+PREMISE Ix.Certified.TreeOpening.mk
+{fuel : Nat} →
+  {root : Address} →
+    {bytes : ByteArray} →
+      (tree : AssumptionTree) →
+        Ixon.runGetExact (getTree fuel) bytes = Except.ok tree →
+          treeBytes tree = bytes →
+            treeRoot tree = root →
+              (∀ (address : Address), address ∈ treeLeaves tree → address.hash.size = 32) → TreeOpening fuel root bytes
+PREMISE Ix.Certified.OptionalTreeOpening.mk
+{fuel : Nat} →
+  {root : Option Address} →
+    {bytes : Option ByteArray} →
+      (leaves : List Address) →
+        (match root, bytes with
+          | none, none => leaves = []
+          | some root, some bytes => ∃ opening, treeLeaves opening.tree = leaves
+          | x, x_1 => False) →
+          OptionalTreeOpening fuel root bytes
+PREMISE Ix.Certified.SubjectView.mk
+{fuel : Nat} →
+  {claim : Claim} →
+    {bytes : Option ByteArray} →
+      (addresses : List Address) →
+        (match claim with
+          | Claim.check address assumptions => bytes = none ∧ addresses = [address]
+          | Claim.checkEnv root assumptions => ∃ raw, bytes = some raw ∧ ∃ opening, treeLeaves opening.tree = addresses
+          | x => False) →
+          SubjectView fuel claim bytes
+PREMISE Ix.Certified.PreparedLeaf.mk
+{fuel : Nat} →
+  {objects : Objects} →
+    {witness : LeafWitness} →
+      (subjectView : SubjectView fuel witness.claim witness.subjects) →
+        (subjectRefs : List (Theory.ConstRef Address)) →
+          List.flatMapM (subjectReferences? objects) subjectView.addresses = some subjectRefs →
+            (frontierView : OptionalTreeOpening fuel (claimFrontier witness.claim) witness.frontierTree) →
+              (frontierRefs : List (Theory.ConstRef Address)) →
+                List.flatMapM (subjectReferences? objects) frontierView.leaves = some frontierRefs →
+                  (∀ (ref : Theory.ConstRef Address),
+                      ref ∈ List.map (fun x => x.ref) witness.frontier ↔ ref ∈ frontierRefs) →
+                    PreparedLeaf fuel objects witness
+PREMISE Ix.Certified.ContentView.mk
+{fuel : Nat} →
+  {claim : Claim} →
+    {subjects members : Option ByteArray} →
+      {objects : Objects} →
+        {leaves : List (LeafInput fuel objects)} →
+          (addresses : List Address) →
+            (∀ (address : Address), address ∈ addresses ↔ address ∈ leafAddresses leaves) →
+              (match claim with
+                | Claim.check address assumptions => subjects = none ∧ members = none ∧ addresses = [address]
+                | Claim.checkEnv root assumptions =>
+                  members = none ∧ ∃ raw, subjects = some raw ∧ ∃ opening, treeLeaves opening.tree = addresses
+                | Claim.catalog memberRoot contentRoot assumptions =>
+                  ∃ rawContent rawMembers,
+                    subjects = some rawContent ∧
+                      members = some rawMembers ∧
+                        ∃ content membership,
+                          treeLeaves content.tree = addresses ∧
+                            ∃ roots,
+                              List.mapM (fun leaf => environmentRoot? leaf.witness.claim) leaves = some roots ∧
+                                ∀ (root : Address), root ∈ treeLeaves membership.tree ↔ root ∈ roots
+                | x => False) →
+                ContentView fuel claim subjects members leaves
+PREMISE Ix.Certified.ownedReferences
+Theory.Certified.PrimitiveSignature Address → List (Theory.ConstRef Address) → List (Theory.ConstRef Address)
+DEFINITION
+fun signature refs => (List.filter (fun ref => ref != signature.falseType && ref != signature.falseElim) refs).eraseDups
+PREMISE Ix.Certified.claimFrontier
+Claim → Option Address
+DEFINITION
+fun x =>
+  match x with
+  | Claim.check const frontier => frontier
+  | Claim.checkEnv root frontier => frontier
+  | Claim.catalog members content frontier => frontier
+  | Claim.eval input output frontier => frontier
+  | x => none
+PREMISE Ix.Certified.LogicalChecking.mk
+{source : Ixon.Env} →
+  {snapshot : SourceSnapshot source} →
+    {fuel : Nat} →
+      {envelope : Envelope} →
+        {witness : LogicalWitness} →
+          (List.map Prod.fst (snapshot.blobs ++ snapshot.literalBlobs)).Nodup →
+            (signature : Theory.Certified.PrimitiveSignature Address) →
+              readSignature? envelope.profile snapshot.decodedObjects = some signature →
+                (store : Theory.Store Address) →
+                  readStore? fuel snapshot.decodedObjects snapshot.decodedNaturals = some store →
+                    (leaves : List (LeafInput fuel snapshot.decodedObjects)) →
+                      List.mapM (readLeafInput? fuel snapshot.decodedObjects) witness.leaves = some leaves →
+                        (content : ContentView fuel envelope.claim witness.subjects witness.members leaves) →
+                          (subjects : List (Theory.ConstRef Address)) →
+                            List.flatMapM (subjectReferences? snapshot.decodedObjects) content.addresses =
+                                some subjects →
+                              (frontier :
+                                  OptionalTreeOpening fuel (claimFrontier envelope.claim) witness.frontierTree) →
+                                (frontierRefs : List (Theory.ConstRef Address)) →
+                                  List.flatMapM (subjectReferences? snapshot.decodedObjects) frontier.leaves =
+                                      some frontierRefs →
+                                    (batch :
+                                        Theory.Certified.CheckedBatch fuel signature store
+                                          (List.map (fun leaf => leaf.prepared.node signature) leaves)) →
+                                      Theory.Certified.checkBatch? fuel signature store witness.frontier
+                                            (List.map (fun leaf => leaf.prepared.node signature) leaves) =
+                                          some batch →
+                                        (∀ (ref : Theory.ConstRef Address),
+                                            ref ∈ Theory.Certified.nodeSubjects batch.nodes ↔
+                                              ref ∈ ownedReferences signature subjects) →
+                                          (∀ (ref : Theory.ConstRef Address),
+                                              ref ∈ batch.receipt.frontier.refs ↔ ref ∈ frontierRefs) →
+                                            (axioms :
+                                                OptionalTreeOpening fuel envelope.logicalAxioms witness.axiomTree) →
+                                              (axiomRefs : List (Theory.ConstRef Address)) →
+                                                List.flatMapM (subjectReferences? snapshot.decodedObjects)
+                                                      axioms.leaves =
+                                                    some axiomRefs →
+                                                  (∀ (ref : Theory.ConstRef Address),
+                                                      ref ∈ batch.logicalUses ↔ ref ∈ axiomRefs) →
+                                                    LogicalChecking snapshot fuel envelope witness
+PREMISE Ix.Certified.LogicalReceipt.mk
+{source : Ixon.Env} →
+  {fuel : Nat} →
+    {envelope : Envelope} →
+      {witness : LogicalWitness} →
+        (snapshot : SourceSnapshot source) →
+          LogicalChecking snapshot fuel envelope witness →
+            envelope.protocol = Protocol.current → LogicalReceipt source fuel envelope witness
+PREMISE Ix.Certified.SubjectsInterpreted
+{source : Ixon.Env} →
+  {fuel : Nat} →
+    {envelope : Envelope} →
+      {witness : LogicalWitness} →
+        LogicalReceipt source fuel envelope witness →
+          (V : Type v) → [Theory.Model.SetTheory V] → Theory.Model.Assignment Address V → Prop
+DEFINITION
+fun {source} {fuel} {envelope} {witness} receipt V [Theory.Model.SetTheory V] constants =>
+  ∀ (ref : Theory.ConstRef Address),
+    ref ∈ receipt.checked.subjects →
+      ∃ entry,
+        SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref entry ∧
+          ∀ (levels : List Nat),
+            levels.length = entry.universes →
+              ∀ (env : Nat → V),
+                Theory.Model.WellDenoted constants levels env entry.type ∧
+                  Theory.Model.SetTheory.Mem (constants ref levels)
+                    (Theory.Model.interp constants levels env entry.type)
+PREMISE Ix.Certified.LogicalMeaning
+Ixon.Env → Nat → Envelope → Prop
+DEFINITION
+fun source fuel envelope =>
+  ∃ witness receipt,
+    SignatureReading envelope.profile receipt.snapshot.decodedObjects receipt.checked.signature ∧
+      (∀ (ref : Theory.ConstRef Address),
+          ref ∈ receipt.checked.frontierRefs →
+            ∃ entry,
+              receipt.checked.batch.receipt.frontier.interface.entries ref = some entry ∧
+                SourceDeclarationReading source receipt.snapshot.decodedObjects receipt.snapshot.decodedNaturals ref
+                  entry) ∧
+        (∀ (ref : Theory.ConstRef Address),
+            ref ∈ receipt.checked.axiomRefs →
+              ∃ entry,
+                Theory.Certified.Standard.EntrySource receipt.checked.store ref entry ∨
+                  Theory.Certified.Quotient.EntrySource receipt.checked.store ref entry) ∧
+          (∀ (V : Type v) [inst : Theory.Model.SetTheory V] (constants : Theory.Model.Assignment Address V),
+              receipt.checked.signature.Compatible receipt.checked.batch.receipt.frontier.interface.entries constants →
+                ∃ constants',
+                  receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants' ∧
+                    Theory.Model.Assignment.AgreesOn receipt.checked.batch.receipt.frontier.interface.entries constants
+                        constants' ∧
+                      SubjectsInterpreted receipt V constants') ∧
+            (claimFrontier envelope.claim = none →
+              ∀ (V : Type v) [inst : Theory.Model.SetTheory V],
+                ∃ constants,
+                  receipt.checked.signature.Compatible receipt.checked.batch.receipt.checked.result.entries constants ∧
+                    SubjectsInterpreted receipt V constants)
+PREMISE Ix.Certified.RevealMatches
+RevealConstantInfo → Ixon.ConstantInfo → Prop
+DEFINITION
+fun expected actual =>
+  match expected, actual with
+  | RevealConstantInfo.defn kind safety levels type value, Ixon.ConstantInfo.defn actual =>
+    Selected kind actual.kind ∧
+      Selected safety actual.safety ∧
+        Selected levels actual.lvls ∧
+          Selected type (expressionAddress actual.typ) ∧ Selected value (expressionAddress actual.value)
+  | RevealConstantInfo.recr k safety levels params indices motives minors type rules, Ixon.ConstantInfo.recr actual =>
+    Selected k actual.k ∧
+      Selected safety actual.isUnsafe ∧
+        Selected levels actual.lvls ∧
+          Selected params actual.params ∧
+            Selected indices actual.indices ∧
+              Selected motives actual.motives ∧
+                Selected minors actual.minors ∧
+                  Selected type (expressionAddress actual.typ) ∧ RulesMatch rules actual.rules
+  | RevealConstantInfo.axio safety levels type, Ixon.ConstantInfo.axio actual =>
+    Selected safety actual.isUnsafe ∧ Selected levels actual.lvls ∧ Selected type (expressionAddress actual.typ)
+  | RevealConstantInfo.quot kind levels type, Ixon.ConstantInfo.quot actual =>
+    Selected kind actual.kind ∧ Selected levels actual.lvls ∧ Selected type (expressionAddress actual.typ)
+  | RevealConstantInfo.cPrj index constructor block, Ixon.ConstantInfo.cPrj actual =>
+    Selected index actual.idx ∧ Selected constructor actual.cidx ∧ Selected block actual.block
+  | RevealConstantInfo.iPrj index block, Ixon.ConstantInfo.iPrj actual =>
+    Selected index actual.idx ∧ Selected block actual.block
+  | RevealConstantInfo.rPrj index block, Ixon.ConstantInfo.rPrj actual =>
+    Selected index actual.idx ∧ Selected block actual.block
+  | RevealConstantInfo.dPrj index block, Ixon.ConstantInfo.dPrj actual =>
+    Selected index actual.idx ∧ Selected block actual.block
+  | RevealConstantInfo.muts components, Ixon.ConstantInfo.muts actual => ComponentsMatch components actual
+  | x, x_1 => False
+PREMISE Ix.Certified.ConstructorMatches
+RevealConstructorInfo → Ixon.Constructor → Prop
+DEFINITION
+fun expected actual =>
+  Selected expected.isUnsafe actual.isUnsafe ∧
+    Selected expected.lvls actual.lvls ∧
+      Selected expected.cidx actual.cidx ∧
+        Selected expected.params actual.params ∧
+          Selected expected.fields actual.fields ∧ Selected expected.typ (expressionAddress actual.typ)
+PREMISE Ix.Certified.ConstructorsMatch
+Option (Array (UInt64 × RevealConstructorInfo)) → Array Ixon.Constructor → Prop
+DEFINITION
+fun expected actual =>
+  match expected with
+  | none => True
+  | some constructors =>
+    ∀ (pair : UInt64 × RevealConstructorInfo),
+      pair ∈ constructors.toList →
+        match actual[pair.fst.toNat]? with
+        | none => False
+        | some constructor => ConstructorMatches pair.snd constructor
+PREMISE Ix.Certified.MutMatches
+RevealMutConstInfo → Ixon.MutConst → Prop
+DEFINITION
+fun expected actual =>
+  match expected, actual with
+  | RevealMutConstInfo.defn kind safety levels type value, Ixon.MutConst.defn actual =>
+    Selected kind actual.kind ∧
+      Selected safety actual.safety ∧
+        Selected levels actual.lvls ∧
+          Selected type (expressionAddress actual.typ) ∧ Selected value (expressionAddress actual.value)
+  | RevealMutConstInfo.indc safety levels params indices type ctors, Ixon.MutConst.indc actual =>
+    Selected safety actual.isUnsafe ∧
+      Selected levels actual.lvls ∧
+        Selected params actual.params ∧
+          Selected indices actual.indices ∧
+            Selected type (expressionAddress actual.typ) ∧ ConstructorsMatch ctors actual.ctors
+  | RevealMutConstInfo.recr k safety levels params indices motives minors type rules, Ixon.MutConst.recr actual =>
+    Selected k actual.k ∧
+      Selected safety actual.isUnsafe ∧
+        Selected levels actual.lvls ∧
+          Selected params actual.params ∧
+            Selected indices actual.indices ∧
+              Selected motives actual.motives ∧
+                Selected minors actual.minors ∧
+                  Selected type (expressionAddress actual.typ) ∧ RulesMatch rules actual.rules
+  | x, x_1 => False
+PREMISE Ix.Certified.ComponentsMatch
+Array (UInt64 × RevealMutConstInfo) → Array Ixon.MutConst → Prop
+DEFINITION
+fun expected actual =>
+  ∀ (pair : UInt64 × RevealMutConstInfo),
+    pair ∈ expected.toList →
+      match actual[pair.fst.toNat]? with
+      | none => False
+      | some member => MutMatches pair.snd member
+PREMISE Ix.Certified.RulesMatch
+Option (Array RevealRecursorRule) → Array Ixon.RecursorRule → Prop
+DEFINITION
+fun expected actual =>
+  match expected with
+  | none => True
+  | some rules =>
+    ∀ (rule : RevealRecursorRule),
+      rule ∈ rules.toList →
+        match actual[rule.ruleIdx.toNat]? with
+        | none => False
+        | some actual => rule.fields = actual.fields ∧ rule.rhs = expressionAddress actual.rhs
+PREMISE Ix.Certified.RevealMeaning
+Ixon.Env → Address → RevealConstantInfo → Prop
+DEFINITION
+fun source commitment info =>
+  ∃ opening,
+    opening.secret.hash.size = 32 ∧
+      opening.payload.hash.size = 32 ∧
+        opening.commit = commitment ∧
+          ∃ bytes object, ObjectBytes source opening.payload bytes object ∧ RevealMatches info object.info
+PREMISE Ix.Certified.SemanticClaimMeaning
+Ixon.Env → Nat → Envelope → Prop
+DEFINITION
+fun source fuel envelope =>
+  envelope.protocol = Protocol.current ∧
+    match envelope.claim with
+    | Claim.check const assumptions => LogicalMeaning source fuel envelope
+    | Claim.checkEnv root assumptions => LogicalMeaning source fuel envelope
+    | Claim.catalog members content assumptions => LogicalMeaning source fuel envelope
+    | Claim.contains root target => envelope.logicalAxioms = none ∧ TreeMembership root target
+    | Claim.reveal commitment info => envelope.logicalAxioms = none ∧ RevealMeaning source commitment info
+    | Claim.eval input output assumptions => False
+PREMISE Ix.Certified.ModelHint.mk
+Address → List Address → List Address → List ModelRuleHints → ModelHint
+PREMISE Ix.Certified.ModelRuleHints.mk
+Address → List (Option ModelProofHint) → ModelRuleHints
+PREMISE Ix.Certified.ModelProofHint.mk
+Address → Address → Address → Address → ModelProofHint
+PREMISE Ix.Theory.Certificate.Modeled.Candidate.mk
+{β : Type u} →
+  β →
+    List (Theory.ConstRef β) →
+      List (Theory.ConstRef β) →
+        List (Theory.ConstRef β × List (Option (Theory.Certificate.Modeled.ProofHint β))) →
+          Theory.Certificate.Modeled.Candidate β
+PREMISE Ix.Theory.Certificate.Modeled.ProofHint.mk
+{β : Type u} →
+  Theory.ConstRef β → Theory.ConstRef β → Theory.ConstRef β → Theory.VExpr β → Theory.Certificate.Modeled.ProofHint β
+PREMISE Ix.Theory.Certified.Modeled.Witness.mk
+{β : Type u} →
+  β →
+    List (Theory.ConstRef β) →
+      List (Theory.Certified.Modeled.Companion β) →
+        List (List (Theory.Certified.Modeled.EquationWitness β)) → Theory.Certified.Modeled.Witness β
+PREMISE Ix.Theory.Certified.Modeled.Checked.mk
+∀ {β : Type u} [inst : DecidableEq β] {entries : Theory.Model.Environment β} {store : Theory.Store β}
+  {witness : Theory.Certified.Modeled.Witness β},
+  Theory.Certified.Modeled.sourceRefs? store witness.source witness.recursors =
+      some (List.map (fun x => x.header.ref) witness.companions) →
+    (∀ (companion : Theory.Certified.Modeled.Companion β),
+        companion ∈ witness.companions → Theory.Certified.Modeled.SourceMatches store companion) →
+      Theory.Certified.Modeled.CheckedCompanions entries witness.companions →
+        Theory.Certified.Modeled.Checked entries store witness
+PREMISE Ix.Theory.Certified.Modeled.SourceMatches
+{β : Type u} → [DecidableEq β] → Theory.Store β → Theory.Certified.Modeled.Companion β → Prop
+DEFINITION
+fun {β} [DecidableEq β] store companion =>
+  store.type companion.header.ref = some companion.header.type.erase ∧
+    store.uvars companion.header.ref = some companion.header.universes ∧
+      Theory.Certified.Modeled.sourceRules? store companion.header.ref =
+        some (List.map Theory.Certified.Modeled.eraseRule companion.rules)
+PREMISE Ix.Theory.Certified.Modeled.sourceRefs?
+{β : Type u} → [DecidableEq β] → Theory.Store β → β → List (Theory.ConstRef β) → Option (List (Theory.ConstRef β))
+DEFINITION
+fun {β} [DecidableEq β] store source recursors => do
+  let families ← Theory.Certified.Modeled.sourceFamilies? store source
+  if recursors.length < families.length then none
+    else do
+      let majors ←
+        List.mapM
+            (fun ref => do
+              let info ← Theory.Certified.Modeled.recursorSource? store ref
+              let major ← Theory.Certified.Modeled.majorSource? store info
+              pure major.family)
+            recursors
+      if (List.take families.length majors != families) = true then none
+        else do
+          let members ←
+            List.mapM
+                (fun family => do
+                  let ctors ← Theory.Certified.Modeled.familyConstructors? store family
+                  pure (family :: ctors))
+                families
+          pure (members.flatten ++ recursors)
+PREMISE Ix.Theory.Certified.Modeled.recursorSource?
+{β : Type u} → Theory.Store β → Theory.ConstRef β → Option (Theory.Certified.Modeled.RecursorSource β)
+DEFINITION
+fun {β} store ref => do
+  let __x ← store.lookup ref
+  match __x with
+    | Theory.Const.recursor universes parameters indices motives minors type rules false Theory.Safety.safe =>
+      pure
+        { universes := universes, parameters := parameters, indices := indices, motives := motives, minors := minors,
+          type := type, rules := rules }
+    | x => none
+PREMISE Ix.Theory.Certified.Modeled.majorSource?
+{β : Type u} →
+  [DecidableEq β] →
+    Theory.Store β → Theory.Certified.Modeled.RecursorSource β → Option (Theory.Certified.Modeled.MajorSource β)
+DEFINITION
+fun {β} [DecidableEq β] store source => do
+  let __x ← Theory.Certified.Modeled.splitPi? source.prefix source.type
+  match __x with
+    | (prefixDomains, tail) => do
+      let __x ← Theory.Certified.Modeled.splitPi? source.indices tail
+      match __x with
+        | (fst, major.forallE body) => do
+          let major ← Theory.Certified.Modeled.betaHead? 512 major
+          match major.appHead with
+            | Theory.VExpr.const family levels => do
+              let info ← Theory.Certified.Modeled.familySource? store family
+              if (info.indices != source.indices || levels.length != info.universes) = true then none
+                else
+                  have arguments := major.appArgs [];
+                  if (arguments.length != info.parameters + source.indices) = true then none
+                  else
+                    if (List.drop info.parameters arguments != Theory.VExpr.bvarRevRange 0 source.indices) = true then
+                      none
+                    else
+                      have actual := List.take info.parameters arguments;
+                      have parameters := List.map (fun p => p.unliftN source.indices 0) actual;
+                      if (List.map (fun x => Theory.VExpr.liftN source.indices x) parameters != actual) = true then none
+                      else
+                        pure
+                          { family := family, levels := levels, parameters := parameters,
+                            prefixDomains := prefixDomains }
+            | x => none
+        | x => none
+PREMISE Ix.Theory.Certified.Modeled.ruleSource?
+{β : Type u} →
+  [DecidableEq β] →
+    Theory.Store β →
+      Theory.ConstRef β →
+        Theory.Certified.Modeled.RecursorSource β →
+          Theory.Certified.Modeled.MajorSource β → Theory.ConstRef β → Option (Theory.Certified.Modeled.RawRule β)
+DEFINITION
+fun {β} [DecidableEq β] store recursor source major constructor =>
+  match constructor with
+  | Theory.ConstRef.ctor block member c =>
+    if (major.family != Theory.ConstRef.member block member) = true then none
+    else do
+      let family ← Theory.Certified.Modeled.familySource? store major.family
+      let ctor ← store.lookupCtor constructor
+      if
+            (ctor.safety != Theory.Safety.safe || ctor.uvars != family.universes || ctor.nparams != family.parameters) =
+              true then
+          none
+        else
+          match store.ctorRuleIndex? constructor with
+          | some slot => do
+            let stored ← source.rules[slot]?
+            if (stored.nfields != ctor.nfields) = true then none
+              else do
+                let specialized ←
+                  Theory.Certified.Modeled.applyPi?
+                      (Theory.VExpr.liftN source.prefix (Theory.VExpr.instL major.levels ctor.type)) major.parameters
+                let __x ← Theory.Certified.Modeled.splitPi? ctor.nfields specialized
+                match __x with
+                  | (fields, result) =>
+                    if (result.appHead != Theory.VExpr.const major.family major.levels) = true then none
+                    else
+                      have args := result.appArgs [];
+                      have parameters := List.map (fun x => Theory.VExpr.liftN ctor.nfields x) major.parameters;
+                      if
+                          (args.length != ctor.nparams + source.indices || List.take ctor.nparams args != parameters) =
+                            true then
+                        none
+                      else
+                        have constructorValue :=
+                          (Theory.VExpr.const constructor major.levels).appN
+                            (parameters ++ Theory.VExpr.bvarRevRange 0 ctor.nfields);
+                        have callArgs :=
+                          Theory.VExpr.bvarRevRange ctor.nfields source.prefix ++ List.drop ctor.nparams args ++
+                            [constructorValue];
+                        do
+                        let resultType ←
+                          Theory.Certified.Modeled.applyPi?
+                              (Theory.VExpr.liftN (source.prefix + ctor.nfields) source.type) callArgs
+                        have telescope : List (Theory.VExpr β) := major.prefixDomains ++ fields
+                        let _ ← Theory.Certified.Modeled.splitLam? telescope.length stored.rhs
+                        pure
+                            { universes := source.universes, type := Theory.VExpr.forallN telescope resultType,
+                              lhs :=
+                                Theory.VExpr.lamN telescope
+                                  ((Theory.VExpr.const recursor
+                                        (List.map Theory.VLevel.param (List.range source.universes))).appN
+                                    callArgs),
+                              rhs := stored.rhs }
+          | x => none
+  | x => none
+PREMISE Ix.Theory.Certified.Modeled.Companion.entry
+{β : Type u} → Theory.Certified.Modeled.Companion β → Theory.Model.ConstantEntry β
+DEFINITION
+fun {β} companion =>
+  { universes := companion.header.universes, type := companion.header.type, body := none,
+    equations := List.map (fun rule => { lhs := rule.lhs, rhs := rule.rhs }) companion.rules }
+PREMISE Ix.Theory.Certified.Modeled.CompanionChecked.mk
+∀ {β : Type u} [inst : DecidableEq β] {entries : Theory.Model.Environment β}
+  {companions : List (Theory.Certified.Modeled.Companion β)} {companion : Theory.Certified.Modeled.Companion β},
+  (∃ entry,
+      entries companion.model = some entry ∧
+        entry.universes = companion.header.universes ∧
+          entry.type = Theory.Model.AExpr.mapRefs (Theory.Certified.Modeled.mapping companions) companion.header.type) →
+    Theory.Model.AExpr.Scope companion.header.universes 0 companion.header.type →
+      Theory.Model.AExpr.ReferencesIn (Theory.Certified.Modeled.environment entries companions) companion.header.type →
+        (∀ (rule : Theory.Certified.Signature.Rule β),
+            rule ∈ companion.rules →
+              rule.universes = companion.header.universes ∧
+                Theory.Model.AExpr.Scope companion.header.universes 0 rule.lhs ∧
+                  Theory.Model.AExpr.Scope companion.header.universes 0 rule.rhs) →
+          (∀ (rule : Theory.Certified.Signature.Rule β),
+              rule ∈ companion.rules →
+                Theory.Model.AExpr.ReferencesIn (Theory.Certified.Modeled.environment entries companions) rule.lhs ∧
+                  Theory.Model.AExpr.ReferencesIn (Theory.Certified.Modeled.environment entries companions) rule.rhs) →
+            (∀ (rule : Theory.Certified.Signature.Rule β),
+                rule ∈ companion.rules →
+                  Theory.Certified.Modeled.CheckedEquation entries (Theory.Certified.Modeled.mapRule companions rule)) →
+              Theory.Certified.Modeled.CompanionChecked entries companions companion
+PREMISE Ix.Theory.Certified.Modeled.CheckedCompanions.mk
+∀ {β : Type u} [inst : DecidableEq β] {entries : Theory.Model.Environment β}
+  {companions : List (Theory.Certified.Modeled.Companion β)},
+  (List.map (fun x => x.header.ref) companions).Nodup →
+    (∀ (companion : Theory.Certified.Modeled.Companion β),
+        companion ∈ companions → entries companion.header.ref = none) →
+      (∀ (companion : Theory.Certified.Modeled.Companion β),
+          companion ∈ companions → Theory.Certified.Modeled.CompanionChecked entries companions companion) →
+        Theory.Certified.Modeled.CheckedCompanions entries companions
+PREMISE Ix.Theory.Certified.Modeled.CheckedEquation.mk
+∀ {β : Type u} {entries : Theory.Model.Environment β} {rule : Theory.Certified.Signature.Rule β},
+  Theory.Certified.Signature.RuleFormed entries rule →
+    Theory.Model.ConversionClaim entries [] rule.lhs rule.rhs → Theory.Certified.Modeled.CheckedEquation entries rule
+PREMISE Ix.Theory.Certified.Modeled.checkEquation?
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (rule : Theory.Certified.Signature.Rule β) →
+          Theory.Certified.Modeled.EquationWitness β →
+            Option (Theory.Certified.CheckedClaim (Theory.Certified.Modeled.CheckedEquation entries rule))
+DEFINITION
+fun {β} [DecidableEq β] fuel entries rule witness => do
+  let formed ← Theory.Certified.Signature.checkRule fuel entries rule witness.formation
+  match witness.proof with
+    | Theory.Certified.Modeled.EquationProof.conversion witness => do
+      let equality ← Theory.Certified.verifyConversion fuel rule.universes entries [] rule.lhs rule.rhs witness
+      pure { down := ⋯ }
+    | Theory.Certified.Modeled.EquationProof.propositional family reflexivity recursor proof typing =>
+      if hi : Theory.Certified.Basis.Equality.Interface entries family reflexivity recursor then do
+        let type ←
+          Theory.Certified.verifyType fuel rule.universes entries [] rule.type
+              (Theory.Model.AExpr.sort witness.formation.level) witness.formation.type
+        let checked ←
+          Theory.Certified.verifyType fuel rule.universes entries [] proof
+              (Theory.Certified.Basis.Equality.applied family witness.formation.level rule.type rule.lhs rule.rhs)
+              typing
+        pure { down := ⋯ }
+      else none
+RUNTIME EXTERN Blake3.Rust.hasherFinalize
+Blake3.Rust.Hasher → (length : USize) → { r // r.size = length.toNat }
+RUNTIME EXTERN Blake3.Rust.hasherInit
+Unit → Blake3.Rust.Hasher
+RUNTIME EXTERN Blake3.Rust.hasherInitDeriveKey
+ByteArray → Blake3.Rust.Hasher
+RUNTIME EXTERN Blake3.Rust.hasherInitKeyed
+Blake3.Blake3Key → Blake3.Rust.Hasher
+RUNTIME EXTERN Blake3.Rust.hasherUpdate
+Blake3.Rust.Hasher → ByteArray → Blake3.Rust.Hasher
+RECURSION WORKER Ixon.getExprAllBinders._unsafe_rec
+Ixon.GetM Ixon.Expr → Nat → Ixon.GetM (List (Ixon.Uses × Ixon.Owned × Ixon.Expr))
+IMPLEMENTATION
+fun recur x =>
+  match x with
+  | 0 => pure []
+  | count.succ => do
+    let mode ← Ixon.getU8
+    have __do_jp : Unit → Ixon.GetM (List (Ixon.Uses × Ixon.Owned × Ixon.Expr)) := fun __r =>
+      match Ixon.Uses.ofBits? (mode &&& 3) with
+      | some uses =>
+        match Ixon.Owned.ofBits? (mode >>> 2 &&& 1) with
+        | some owned => do
+          let ty ← recur
+          let tail ← Ixon.getExprAllBinders._unsafe_rec recur count
+          pure ((uses, owned, ty) :: tail)
+        | x => throw (toString "getExpr: invalid forall ownership mode " ++ toString mode)
+      | x => throw (toString "getExpr: invalid forall usage mode " ++ toString mode)
+    if mode > 7 then do
+        let __r ← throw (toString "getExpr: invalid forall mode " ++ toString mode)
+        __do_jp __r
+      else __do_jp ()
+RECURSION WORKER Ixon.getExprAppArgs._unsafe_rec
+Ixon.GetM Ixon.Expr → Nat → Ixon.Expr → Ixon.GetM Ixon.Expr
+IMPLEMENTATION
+fun recur x x_1 =>
+  match x, x_1 with
+  | 0, result => pure result
+  | count.succ, result => do
+    let arg ← recur
+    Ixon.getExprAppArgs._unsafe_rec recur count (result.app arg)
+RECURSION WORKER Ixon.getExprFuel._unsafe_rec
+Nat → Ixon.GetM Ixon.Expr
+IMPLEMENTATION
+fun x =>
+  match x with
+  | 0 => throw "getExpr: recursion budget exhausted"
+  | fuel.succ => Ixon.getTag4 >>= Ixon.getExprFromTag (Ixon.getExprFuel._unsafe_rec fuel)
+RECURSION WORKER Ixon.getExprLamBinders._unsafe_rec
+Ixon.GetM Ixon.Expr → Nat → Ixon.GetM (List (Ixon.Uses × Ixon.Expr))
+IMPLEMENTATION
+fun recur x =>
+  match x with
+  | 0 => pure []
+  | count.succ => do
+    let mode ← Ixon.getU8
+    match Ixon.Uses.ofBits? mode with
+      | some uses => do
+        let ty ← recur
+        let tail ← Ixon.getExprLamBinders._unsafe_rec recur count
+        pure ((uses, ty) :: tail)
+      | x => throw (toString "getExpr: invalid lambda mode " ++ toString mode)
+RECURSION WORKER Ixon.getTag0Sizes._unsafe_rec
+Nat → Ixon.GetM (List UInt64)
+IMPLEMENTATION
+fun x =>
+  match x with
+  | 0 => pure []
+  | count.succ => do
+    let __do_lift ← Ixon.getTag0
+    let head : UInt64 := __do_lift.size
+    let tail ← Ixon.getTag0Sizes._unsafe_rec count
+    pure (head :: tail)
+RECURSION WORKER Ixon.getU64TrimmedLEAux._unsafe_rec
+Nat → Ixon.GetM UInt64
+IMPLEMENTATION
+fun x =>
+  match x with
+  | 0 => pure 0
+  | len.succ => do
+    let low ← Ixon.getU8
+    let high ← Ixon.getU64TrimmedLEAux._unsafe_rec len
+    pure (low.toUInt64 ||| high <<< 8)
+RECURSION WORKER Ixon.getUnivFuel._unsafe_rec
+Nat → Ixon.GetM Ixon.Univ
+IMPLEMENTATION
+fun x =>
+  match x with
+  | 0 => throw "getUniv: recursion budget exhausted"
+  | fuel.succ => Ixon.getTag2 >>= Ixon.getUnivFromTag (Ixon.getUnivFuel._unsafe_rec fuel)
+RECURSION WORKER Ixon.putExpr._unsafe_rec
+Ixon.Expr → Ixon.PutM Unit
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Ixon.Expr.sort idx => Ixon.putTag4 { flag := Ixon.Expr.FLAG_SORT, size := idx }
+  | Ixon.Expr.var idx => Ixon.putTag4 { flag := Ixon.Expr.FLAG_VAR, size := idx }
+  | Ixon.Expr.ref refIdx univIdxs => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_REF, size := univIdxs.size.toUInt64 }
+    Ixon.putTag0 { size := refIdx }
+    forIn univIdxs PUnit.unit fun idx __s => do
+        Ixon.putTag0 { size := idx }
+        pure (ForInStep.yield PUnit.unit)
+    pure ()
+  | Ixon.Expr.recur recIdx univIdxs => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_REC, size := univIdxs.size.toUInt64 }
+    Ixon.putTag0 { size := recIdx }
+    forIn univIdxs PUnit.unit fun idx __s => do
+        Ixon.putTag0 { size := idx }
+        pure (ForInStep.yield PUnit.unit)
+    pure ()
+  | Ixon.Expr.prj typeRefIdx fieldIdx val => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_PRJ, size := fieldIdx }
+    Ixon.putTag0 { size := typeRefIdx }
+    Ixon.putExpr._unsafe_rec val
+  | Ixon.Expr.str refIdx => Ixon.putTag4 { flag := Ixon.Expr.FLAG_STR, size := refIdx }
+  | Ixon.Expr.nat refIdx => Ixon.putTag4 { flag := Ixon.Expr.FLAG_NAT, size := refIdx }
+  | e@h:(a.app a_1) => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_APP, size := e.collectAppArgs.fst.length.toUInt64 }
+    Ixon.putExpr._unsafe_rec e.collectAppArgs.snd
+    forIn e.collectAppArgs.fst PUnit.unit fun arg __s => do
+        Ixon.putExpr._unsafe_rec arg
+        pure (ForInStep.yield PUnit.unit)
+    pure ()
+  | e@h:(Ixon.Expr.lam a a_1 a_2) => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_LAM, size := e.collectLamBinders.fst.length.toUInt64 }
+    forIn e.collectLamBinders.fst PUnit.unit fun binder __s => do
+        Ixon.putU8 binder.fst.toBits
+        Ixon.putExpr._unsafe_rec binder.snd
+        pure (ForInStep.yield PUnit.unit)
+    Ixon.putExpr._unsafe_rec e.collectLamBinders.snd
+  | e@h:(Ixon.Expr.all a a_1 a_2 a_3) => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_ALL, size := e.collectAllBinders.fst.length.toUInt64 }
+    forIn e.collectAllBinders.fst PUnit.unit fun binder __s => do
+        Ixon.putU8 (binder.fst.toBits ||| binder.snd.fst.toBits <<< 2)
+        Ixon.putExpr._unsafe_rec binder.snd.snd
+        pure (ForInStep.yield PUnit.unit)
+    Ixon.putExpr._unsafe_rec e.collectAllBinders.snd
+  | Ixon.Expr.letE nonDep ty val body => do
+    Ixon.putTag4 { flag := Ixon.Expr.FLAG_LET, size := if nonDep = true then 1 else 0 }
+    Ixon.putExpr._unsafe_rec ty
+    Ixon.putExpr._unsafe_rec val
+    Ixon.putExpr._unsafe_rec body
+  | Ixon.Expr.share idx => Ixon.putTag4 { flag := Ixon.Expr.FLAG_SHARE, size := idx }
+RECURSION WORKER Ixon.putU64TrimmedLEAux._unsafe_rec
+UInt64 → Nat → Ixon.PutM Unit
+IMPLEMENTATION
+fun x x_1 =>
+  match x_1 with
+  | 0 => pure ()
+  | len.succ => do
+    Ixon.putU8 x.toUInt8
+    Ixon.putU64TrimmedLEAux._unsafe_rec (x >>> 8) len
+RECURSION WORKER Ixon.putUniv._unsafe_rec
+Ixon.Univ → Ixon.PutM Unit
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Ixon.Univ.zero => Ixon.putTag2 { flag := Ixon.Univ.FLAG_ZERO_SUCC, size := 0 }
+  | u@h:a.succ => do
+    Ixon.putTag2 { flag := Ixon.Univ.FLAG_ZERO_SUCC, size := u.succCount }
+    Ixon.putUniv._unsafe_rec u.succBase
+  | a.max b => do
+    Ixon.putTag2 { flag := Ixon.Univ.FLAG_MAX, size := 0 }
+    Ixon.putUniv._unsafe_rec a
+    Ixon.putUniv._unsafe_rec b
+  | a.imax b => do
+    Ixon.putTag2 { flag := Ixon.Univ.FLAG_IMAX, size := 0 }
+    Ixon.putUniv._unsafe_rec a
+    Ixon.putUniv._unsafe_rec b
+  | Ixon.Univ.var idx => Ixon.putTag2 { flag := Ixon.Univ.FLAG_VAR, size := idx }
+RECURSION WORKER _private.Ix.Address.0.bytesOfHex.go._unsafe_rec
+List Char → Option (List UInt8)
+IMPLEMENTATION
+fun a =>
+  match a with
+  | hi :: lo :: rest => do
+    let b ← byteOfHex hi lo
+    let bs ← bytesOfHex.go._unsafe_rec✝ rest
+    some (b :: bs)
+  | [] => pure []
+  | x => none
+RECURSION WORKER Ix.Certified.frontierOrder?._unsafe_rec
+Nat →
+  Theory.Certified.PrimitiveSignature Address →
+    Theory.Store Address →
+      List (Theory.ConstRef Address) →
+        List (Theory.ConstRef Address) →
+          List (Theory.ConstRef Address) → List (Theory.ConstRef Address) → Option (List (Theory.ConstRef Address))
+IMPLEMENTATION
+fun fuel signature store allowed pending visited active =>
+  match fuel, pending with
+  | x, [] => some visited
+  | 0, head :: tail => none
+  | fuel.succ, ref :: rest =>
+    if ref = signature.falseType ∨ ref = signature.falseElim ∨ ref ∈ visited then
+      frontierOrder?._unsafe_rec fuel signature store allowed rest visited active
+    else
+      if ref ∈ active ∨ ¬ref ∈ allowed then none
+      else do
+        let type ← store.type ref
+        let visited ← frontierOrder?._unsafe_rec fuel signature store allowed type.refs visited (ref :: active)
+        frontierOrder?._unsafe_rec fuel signature store allowed rest (visited ++ [ref]) active
+RECURSION WORKER Ix.Certified.getTreeBody._unsafe_rec
+Nat → Ixon.GetM AssumptionTree
+IMPLEMENTATION
+fun x =>
+  match x with
+  | 0 => throw "certified tree depth limit"
+  | fuel.succ => do
+    let __do_lift ← Ixon.getU8
+    match __do_lift with
+      | 0 => do
+        let __do_lift ← Ixon.Serialize.get
+        pure (AssumptionTree.leaf __do_lift)
+      | 1 => pure AssumptionTree.padding
+      | 2 => do
+        let __do_lift ← getTreeBody._unsafe_rec fuel
+        let __do_lift_1 ← getTreeBody._unsafe_rec fuel
+        pure (__do_lift.node __do_lift_1)
+      | x => throw "invalid certified tree node"
+RECURSION WORKER Ix.Certified.lookup._unsafe_rec
+{α : Type u_1} → List (Address × α) → Address → Option α
+IMPLEMENTATION
+fun {α} entries address =>
+  match entries with
+  | [] => none
+  | (key, value) :: rest => if address = key then some value else lookup._unsafe_rec rest address
+RECURSION WORKER Ix.Certified.putTreeBody._unsafe_rec
+AssumptionTree → Ixon.PutM Unit
+IMPLEMENTATION
+fun x =>
+  match x with
+  | AssumptionTree.leaf address => do
+    Ixon.putU8 0
+    Ixon.Serialize.put address
+  | AssumptionTree.padding => Ixon.putU8 1
+  | left.node right => do
+    Ixon.putU8 2
+    putTreeBody._unsafe_rec left
+    putTreeBody._unsafe_rec right
+RECURSION WORKER Ix.Certified.readBlocks?._unsafe_rec
+Nat → Objects → Naturals → Objects → Option (List (Address × Theory.Block Address))
+IMPLEMENTATION
+fun fuel objects naturals x =>
+  match x with
+  | [] => some []
+  | (address, source) :: rest =>
+    if isProjection source.info = true then do
+      let _ ← resolveReference? objects address
+      readBlocks?._unsafe_rec fuel objects naturals rest
+    else do
+      let block ← readBlock? fuel objects naturals address source
+      let rest ← readBlocks?._unsafe_rec fuel objects naturals rest
+      pure ((address, block) :: rest)
+RECURSION WORKER Ix.Certified.readExpr?._unsafe_rec
+Nat → Objects → Naturals → Address → Ixon.Constant → Ixon.Expr → Option (Theory.VExpr Address)
+IMPLEMENTATION
+fun fuel objects naturals block source =>
+  match (motive := Nat → Ixon.Expr → Option (Theory.VExpr Address)) fuel with
+  | 0 => fun x => none
+  | fuel.succ => fun expression =>
+    match expression with
+    | Ixon.Expr.var index => some (Theory.VExpr.bvar index.toNat)
+    | Ixon.Expr.sort index => Option.map (Theory.VExpr.sort ∘ readLevel) source.univs[index.toNat]?
+    | Ixon.Expr.ref index levels => do
+      let address ← source.refs[index.toNat]?
+      let reference ← resolveReference? objects address
+      let levels ← readLevels? source levels
+      pure (Theory.VExpr.const reference levels)
+    | Ixon.Expr.recur index levels => do
+      let levels ← readLevels? source levels
+      pure (Theory.VExpr.const (Theory.ConstRef.member block index.toNat) levels)
+    | f.app a => do
+      let f ← readExpr?._unsafe_rec fuel objects naturals block source f
+      let a ← readExpr?._unsafe_rec fuel objects naturals block source a
+      pure (f.app a)
+    | Ixon.Expr.lam Ixon.Uses.many A b => do
+      let A ← readExpr?._unsafe_rec fuel objects naturals block source A
+      let b ← readExpr?._unsafe_rec fuel objects naturals block source b
+      pure (A.lam b)
+    | Ixon.Expr.all Ixon.Uses.many Ixon.Owned.shared A B => do
+      let A ← readExpr?._unsafe_rec fuel objects naturals block source A
+      let B ← readExpr?._unsafe_rec fuel objects naturals block source B
+      pure (A.forallE B)
+    | Ixon.Expr.prj owner field value => do
+      let address ← source.refs[owner.toNat]?
+      let ownerSource ← lookup objects address
+      match ownerSource.info with
+        | Ixon.ConstantInfo.iPrj a => do
+          let reference ← resolveReference? objects address
+          let value ← readExpr?._unsafe_rec fuel objects naturals block source value
+          pure (Theory.VExpr.proj reference field.toNat value)
+        | x => none
+    | Ixon.Expr.nat index => do
+      let address ← source.refs[index.toNat]?
+      let __do_lift ← lookup naturals address
+      pure (Theory.VExpr.natLit __do_lift)
+    | Ixon.Expr.share index => do
+      let shared ← source.sharing[index.toNat]?
+      readExpr?._unsafe_rec fuel objects naturals block source shared
+    | x => none
+RECURSION WORKER Ix.Certified.readLevel._unsafe_rec
+Ixon.Univ → Theory.VLevel
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Ixon.Univ.zero => Theory.VLevel.zero
+  | u.succ => (readLevel._unsafe_rec u).succ
+  | u.max v => (readLevel._unsafe_rec u).max (readLevel._unsafe_rec v)
+  | u.imax v => (readLevel._unsafe_rec u).imax (readLevel._unsafe_rec v)
+  | Ixon.Univ.var i => Theory.VLevel.param i.toNat
+RECURSION WORKER Ix.Certified.sourceLevelValue._unsafe_rec
+List Nat → Ixon.Univ → Nat
+IMPLEMENTATION
+fun levels x =>
+  match x with
+  | Ixon.Univ.zero => 0
+  | level.succ => sourceLevelValue._unsafe_rec levels level + 1
+  | left.max right => max (sourceLevelValue._unsafe_rec levels left) (sourceLevelValue._unsafe_rec levels right)
+  | left.imax right =>
+    if sourceLevelValue._unsafe_rec levels right = 0 then 0
+    else max (sourceLevelValue._unsafe_rec levels left) (sourceLevelValue._unsafe_rec levels right)
+  | Ixon.Univ.var index => levels.getD index.toNat 0
+RECURSION WORKER Ix.Certified.treeLeaves._unsafe_rec
+AssumptionTree → List Address
+IMPLEMENTATION
+fun x =>
+  match x with
+  | AssumptionTree.leaf address => [address]
+  | AssumptionTree.padding => []
+  | left.node right => treeLeaves._unsafe_rec left ++ treeLeaves._unsafe_rec right
+RECURSION WORKER Ix.Certified.treeRoot._unsafe_rec
+AssumptionTree → Address
+IMPLEMENTATION
+fun x =>
+  match x with
+  | AssumptionTree.leaf address => Merkle.leafHash address
+  | AssumptionTree.padding => Merkle.zeroAddress
+  | left.node right => Merkle.nodeHash (treeRoot._unsafe_rec left) (treeRoot._unsafe_rec right)
+RECURSION WORKER Ixon.Expr.collectAllBinders._unsafe_rec
+Ixon.Expr → List (Ixon.Uses × Ixon.Owned × Ixon.Expr) × Ixon.Expr
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Ixon.Expr.all uses owned ty body =>
+    match Ixon.Expr.collectAllBinders._unsafe_rec body with
+    | (binders, base) => ((uses, owned, ty) :: binders, base)
+  | e => ([], e)
+RECURSION WORKER Ixon.Expr.collectAppArgs._unsafe_rec
+Ixon.Expr → List Ixon.Expr × Ixon.Expr
+IMPLEMENTATION
+fun x =>
+  match x with
+  | f.app a =>
+    match Ixon.Expr.collectAppArgs._unsafe_rec f with
+    | (args, base) => (args ++ [a], base)
+  | e => ([], e)
+RECURSION WORKER Ixon.Expr.collectLamBinders._unsafe_rec
+Ixon.Expr → List (Ixon.Uses × Ixon.Expr) × Ixon.Expr
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Ixon.Expr.lam uses ty body =>
+    match Ixon.Expr.collectLamBinders._unsafe_rec body with
+    | (binders, base) => ((uses, ty) :: binders, base)
+  | e => ([], e)
+RECURSION WORKER Ixon.Expr.nodeCount._unsafe_rec
+Ixon.Expr → Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Ixon.Expr.sort a => 1
+  | Ixon.Expr.var a => 1
+  | Ixon.Expr.ref a a_1 => 1
+  | Ixon.Expr.recur a a_1 => 1
+  | Ixon.Expr.str a => 1
+  | Ixon.Expr.nat a => 1
+  | Ixon.Expr.share a => 1
+  | Ixon.Expr.prj a a_1 val => Ixon.Expr.nodeCount._unsafe_rec val + 1
+  | fn.app arg => Ixon.Expr.nodeCount._unsafe_rec fn + Ixon.Expr.nodeCount._unsafe_rec arg + 1
+  | Ixon.Expr.lam a fn arg => Ixon.Expr.nodeCount._unsafe_rec fn + Ixon.Expr.nodeCount._unsafe_rec arg + 1
+  | Ixon.Expr.all a a_1 fn arg => Ixon.Expr.nodeCount._unsafe_rec fn + Ixon.Expr.nodeCount._unsafe_rec arg + 1
+  | Ixon.Expr.letE a ty val body =>
+    Ixon.Expr.nodeCount._unsafe_rec ty + Ixon.Expr.nodeCount._unsafe_rec val + Ixon.Expr.nodeCount._unsafe_rec body + 1
+RECURSION WORKER Ixon.Univ.addSucc._unsafe_rec
+Nat → Ixon.Univ → Ixon.Univ
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | 0, base => base
+  | count.succ, base => (Ixon.Univ.addSucc._unsafe_rec count base).succ
+RECURSION WORKER Ixon.Univ.succBase._unsafe_rec
+Ixon.Univ → Ixon.Univ
+IMPLEMENTATION
+fun x =>
+  match x with
+  | inner.succ => Ixon.Univ.succBase._unsafe_rec inner
+  | u => u
+RECURSION WORKER Ixon.Univ.succCountNat._unsafe_rec
+Ixon.Univ → Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | inner.succ => 1 + Ixon.Univ.succCountNat._unsafe_rec inner
+  | x => 0
+RECURSION WORKER _private.Ix.Common.0.Nat.toBytesLE.go._unsafe_rec
+Nat → Nat → List UInt8
+IMPLEMENTATION
+fun a a_1 =>
+  match a, a_1 with
+  | x, 0 => []
+  | 0, x => []
+  | f.succ, x => x.toUInt8 :: Nat.toBytesLE.go._unsafe_rec✝ f (x / 256)
+RECURSION WORKER Ix.Certified.InputCache.natural?._unsafe_rec
+(address : Address) → (bytes : ByteArray) → List CachedNatural → Option (DecodedNatural address bytes)
+IMPLEMENTATION
+fun address bytes x =>
+  match x with
+  | [] => none
+  | entry :: rest =>
+    if ha : entry.address = address then
+      if hb : entry.bytes = bytes then some (⋯.mpr entry.decoded)
+      else InputCache.natural?._unsafe_rec address bytes rest
+    else InputCache.natural?._unsafe_rec address bytes rest
+RECURSION WORKER Ix.Certified.InputCache.object?._unsafe_rec
+(address : Address) → (bytes : ByteArray) → List CachedObject → Option (DecodedObject address bytes)
+IMPLEMENTATION
+fun address bytes x =>
+  match x with
+  | [] => none
+  | entry :: rest =>
+    if ha : entry.address = address then
+      if hb : entry.bytes = bytes then some (⋯.mpr entry.decoded) else InputCache.object?._unsafe_rec address bytes rest
+    else InputCache.object?._unsafe_rec address bytes rest
+RECURSION WORKER Ix.Theory.Certificate.annotations._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → Theory.Model.AnnotationTree
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.Model.AExpr.bvar index => Theory.Model.AnnotationTree.leaf
+  | Theory.Model.AExpr.sort level => Theory.Model.AnnotationTree.leaf
+  | Theory.Model.AExpr.const ref levels => Theory.Model.AnnotationTree.leaf
+  | Theory.Model.AExpr.natLit value => Theory.Model.AnnotationTree.leaf
+  | f.app a => (Theory.Certificate.annotations._unsafe_rec f).app (Theory.Certificate.annotations._unsafe_rec a)
+  | Theory.Model.AExpr.lam p A b =>
+    Theory.Model.AnnotationTree.lam p.toRaw (Theory.Certificate.annotations._unsafe_rec A)
+      (Theory.Certificate.annotations._unsafe_rec b)
+  | Theory.Model.AExpr.forallE p A B =>
+    Theory.Model.AnnotationTree.forallE p.toRaw (Theory.Certificate.annotations._unsafe_rec A)
+      (Theory.Certificate.annotations._unsafe_rec B)
+  | Theory.Model.AExpr.proj ref field e => (Theory.Certificate.annotations._unsafe_rec e).proj
+RECURSION WORKER Ix.Theory.Certificate.applicationArgs._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → List (Theory.Model.AExpr β) → List (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | f.app a, args => Theory.Certificate.applicationArgs._unsafe_rec f (a :: args)
+  | x, args => args
+RECURSION WORKER Ix.Theory.Certificate.applyFact?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Certificate.Suggestion β → List (Theory.Model.AExpr β) → Option (Theory.Certificate.Suggestion β)
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ fact args =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    match args with
+    | [] => some fact
+    | arg :: rest =>
+      match fact.expression with
+      | Theory.Model.AExpr.lam p D body =>
+        match fact.type with
+        | Theory.Model.AExpr.forallE q A B =>
+          if (p != q || D != A) = true then none
+          else do
+            let a ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ arg
+            let aw ← Theory.Certificate.castWith?._unsafe_rec fuel n entries Γ a D
+            Theory.Certificate.applyFact?._unsafe_rec fuel n entries Γ
+                { expression := body.inst arg, type := B.inst arg,
+                  witness := Theory.Certified.TypingWitness.betaResult p D body arg B fact.witness aw }
+                rest
+        | x => none
+      | x => none
+RECURSION WORKER Ix.Theory.Certificate.beta?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Model.AExpr β → Option (Theory.Model.AExpr β × Theory.Certified.ConversionWitness β)
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ e =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    match e with
+    | (Theory.Model.AExpr.lam p D body).app arg => do
+      let fn ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ (Theory.Model.AExpr.lam p D body)
+      let a ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ arg
+      let aw ← Theory.Certificate.castWith?._unsafe_rec fuel n entries Γ a D
+      pure (body.inst arg, Theory.Certified.ConversionWitness.beta fn.type fn.witness aw)
+    | x => none
+RECURSION WORKER Ix.Theory.Certificate.castWith?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Certificate.Suggestion β → Theory.Model.AExpr β → Option (Theory.Certified.TypingWitness β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ suggestion type =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    match Theory.Certificate.cast? n suggestion type with
+    | some witness => some witness
+    | none => do
+      let target ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ type
+      let target ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ target
+      match target.type with
+        | Theory.Model.AExpr.sort l => do
+          let witness ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ suggestion.type type
+          pure (Theory.Certified.TypingWitness.conv suggestion.type l suggestion.witness target.witness witness)
+        | x => none
+RECURSION WORKER Ix.Theory.Certificate.conversion?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Model.AExpr β → Theory.Model.AExpr β → Option (Theory.Certified.ConversionWitness β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ a b =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    if a = b then some Theory.Certified.ConversionWitness.refl
+    else
+      match Theory.Certificate.headStep?._unsafe_rec fuel n entries Γ a with
+      | some (a', w) => do
+        let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ a' b
+        pure (Theory.Certified.ConversionWitness.trans a' w __do_lift)
+      | none =>
+        match Theory.Certificate.headStep?._unsafe_rec fuel n entries Γ b with
+        | some (b', w) => do
+          let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ a b'
+          pure (Theory.Certified.ConversionWitness.trans b' __do_lift w.symm)
+        | none =>
+          let congruence := fun x =>
+            match a, b with
+            | Theory.Model.AExpr.sort l, Theory.Model.AExpr.sort l' =>
+              if Theory.Certified.LevelEq.check n l l' = true then some Theory.Certified.ConversionWitness.sort
+              else none
+            | f.app x, g.app y => do
+              let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ f g
+              let __do_lift_1 ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ x y
+              pure (__do_lift.app __do_lift_1)
+            | Theory.Model.AExpr.proj r i x, Theory.Model.AExpr.proj q j y =>
+              if r = q ∧ i = j then
+                (fun x => x.proj) <$> Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ x y
+              else none
+            | Theory.Model.AExpr.lam p D body, Theory.Model.AExpr.lam q D' body' =>
+              if (p != q) = true then none
+              else do
+                let domain ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ D
+                match domain.type with
+                  | Theory.Model.AExpr.sort l => do
+                    let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ D D'
+                    let __do_lift_1 ←
+                      Theory.Certificate.conversion?._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) body
+                          body'
+                    pure (Theory.Certified.ConversionWitness.lam l domain.witness __do_lift __do_lift_1)
+                  | x => none
+            | Theory.Model.AExpr.forallE p D B, Theory.Model.AExpr.forallE q D' B' =>
+              if (p != q) = true then none
+              else do
+                let domain ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ D
+                match domain.type with
+                  | Theory.Model.AExpr.sort l => do
+                    let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ D D'
+                    let __do_lift_1 ←
+                      Theory.Certificate.conversion?._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) B B'
+                    pure (Theory.Certified.ConversionWitness.forallE l domain.witness __do_lift __do_lift_1)
+                  | x => none
+            | x, x_1 => none;
+          let proofIrrel := fun x => do
+            let left ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ a
+            let type ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ left.type
+            let typeWitness ← Theory.Certificate.cast? n type (Theory.Model.AExpr.sort Theory.VLevel.zero)
+            let right ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ b
+            let rightWitness ← Theory.Certificate.castWith?._unsafe_rec fuel n entries Γ right left.type
+            pure (Theory.Certified.ConversionWitness.proofIrrel left.type typeWitness left.witness rightWitness);
+          Theory.Certificate.eta?._unsafe_rec fuel n entries Γ a b <|>
+            (fun x => x.symm) <$> Theory.Certificate.eta?._unsafe_rec fuel n entries Γ b a <|>
+              congruence () <|>
+                match Theory.Certificate.equationStep?._unsafe_rec fuel n entries Γ a with
+                | some (a', w) => do
+                  let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ a' b
+                  pure (Theory.Certified.ConversionWitness.trans a' w __do_lift)
+                | none =>
+                  match Theory.Certificate.equationStep?._unsafe_rec fuel n entries Γ b with
+                  | some (b', w) => do
+                    let __do_lift ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ a b'
+                    pure (Theory.Certified.ConversionWitness.trans b' __do_lift w.symm)
+                  | none => proofIrrel ()
+RECURSION WORKER Ix.Theory.Certificate.declarationWitnesses?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Theory.Store β →
+          Theory.Model.Environment β →
+            List (Theory.Certificate.DeclarationSource β) →
+              Option (Theory.Model.Environment β × List (Theory.Certified.DeclarationWitness β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel store entries x =>
+  match x with
+  | [] => some (entries, [])
+  | Theory.Certificate.DeclarationSource.definition r :: rest => do
+    let source ← store.lookup r
+    let witness ← Theory.Certificate.definitionWitness? fuel entries r source
+    let reading ← Theory.Certified.readDefinition? source witness.typeAnnotations witness.bodyAnnotations
+    let __x ← Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store (entries.insert r reading.val.entry) rest
+    match __x with
+      | (entries', witnesses) => pure (entries', Theory.Certified.DeclarationWitness.definition witness :: witnesses)
+  | Theory.Certificate.DeclarationSource.ordinary source recursor :: rest => do
+    let witness ← Theory.Certificate.Ordinary.sourceBlock? fuel entries store source recursor
+    if Theory.Certificate.Hints.natural = some (Theory.ConstRef.member source 0) then
+        if (witness.shape.shape != Theory.Certified.Natural.shape) = true then none
+        else do
+          let __x ←
+            Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store
+                (Theory.Certified.Natural.environment entries source recursor witness.mode) rest
+          match __x with
+            | (entries', witnesses) => pure (entries', Theory.Certified.DeclarationWitness.natural witness :: witnesses)
+      else
+        match Theory.Certificate.Structure.witness? fuel entries witness with
+        | some structured => do
+          let __x ←
+            Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store
+                (structured.facts.description.publishedEnvironment entries source recursor witness.mode) rest
+          match __x with
+            | (entries', witnesses) =>
+              pure (entries', Theory.Certified.DeclarationWitness.structure structured :: witnesses)
+        | none => do
+          let __x ←
+            Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store
+                (witness.shape.shape.publishedEnvironment entries source recursor witness.mode) rest
+          match __x with
+            | (entries', witnesses) =>
+              pure (entries', Theory.Certified.DeclarationWitness.ordinary witness :: witnesses)
+  | Theory.Certificate.DeclarationSource.standard ref :: rest => do
+    let source ← store.lookup ref
+    let witness ← Theory.Certificate.Standard.witness? fuel store entries ref source
+    let __x ←
+      Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store (entries.insert ref witness.spec.entry) rest
+    match __x with
+      | (entries', witnesses) => pure (entries', Theory.Certified.DeclarationWitness.standard witness :: witnesses)
+  | Theory.Certificate.DeclarationSource.quotient refs :: rest => do
+    let witness ← Theory.Certificate.Quotient.witness? fuel entries refs
+    let __x ← Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store (refs.environment entries) rest
+    match __x with
+      | (entries', witnesses) => pure (entries', Theory.Certified.DeclarationWitness.quotient witness :: witnesses)
+  | Theory.Certificate.DeclarationSource.modeled candidate :: rest => do
+    let witness ← candidate.witness? fuel entries store
+    let __x ←
+      Theory.Certificate.declarationWitnesses?._unsafe_rec fuel store
+          (Theory.Certified.Modeled.environment entries witness.companions) rest
+    match __x with
+      | (entries', witnesses) => pure (entries', Theory.Certified.DeclarationWitness.modeled witness :: witnesses)
+RECURSION WORKER Ix.Theory.Certificate.dependencyOrder?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Theory.Certified.PrimitiveSignature β →
+        Theory.Store β →
+          List (Theory.ConstRef β) →
+            List (Theory.ConstRef β) →
+              List (Theory.ConstRef β) →
+                optParam (List (Theory.Certificate.DeclarationSource β)) [] →
+                  optParam (List (Theory.Certificate.Modeled.Candidate β)) [] →
+                    Option (List (Theory.ConstRef β) × List (Theory.Certificate.DeclarationSource β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel signature store pending visited active order models =>
+  match fuel, pending with
+  | x, [] => some (visited, order)
+  | 0, head :: tail => none
+  | fuel.succ, r :: rest =>
+    if r = signature.falseType ∨ r = signature.falseElim ∨ r ∈ visited then
+      Theory.Certificate.dependencyOrder?._unsafe_rec fuel signature store rest visited active order models
+    else
+      if r ∈ active then none
+      else do
+        let group ← Theory.Certificate.sourceGroup? store r signature.natType models
+        if (group.references.any fun x => active.contains x) = true then none
+          else do
+            let __x ←
+              Theory.Certificate.dependencyOrder?._unsafe_rec fuel signature store group.dependencies visited
+                  (group.references ++ active) order models
+            match __x with
+              | (visited, order) =>
+                Theory.Certificate.dependencyOrder?._unsafe_rec fuel signature store rest (visited ++ group.references)
+                  active (order ++ [group.declaration]) models
+RECURSION WORKER Ix.Theory.Certificate.equationStep?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Model.AExpr β → Option (Theory.Model.AExpr β × Theory.Certified.ConversionWitness β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ e =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    have __do_jp := fun __x =>
+      match __x with
+      | (ref, levels) => do
+        let entry ← entries ref
+        if (levels.length != entry.universes) = true then none
+          else
+            List.findSome?
+              (fun x =>
+                match x with
+                | (law, i) =>
+                  let lhs := Theory.Model.AExpr.instL levels law.lhs;
+                  let rhs := Theory.Model.AExpr.instL levels law.rhs;
+                  do
+                  let args ←
+                    Theory.Certificate.equationArguments? lhs e <|>
+                        (match Theory.Certificate.lambdaBody lhs with
+                          | (fst, fn.app constructor) => do
+                            let __x ← Theory.Certificate.headConstant? constructor
+                            match __x with
+                              | (Theory.ConstRef.ctor b i c, snd) =>
+                                match e with
+                                | fn.app major => do
+                                  let expanded ← Theory.Certificate.etaMajor?._unsafe_rec fuel n entries Γ major
+                                  Theory.Certificate.equationArguments? lhs (fn.app expanded)
+                                | x => none
+                              | x => none
+                          | x => none) <|>
+                          match e with
+                          | fn.app major => do
+                            let typed ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ major
+                            let type ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ typed.type
+                            let _ ← Theory.Certificate.cast? n type (Theory.Model.AExpr.sort Theory.VLevel.zero)
+                            Theory.Certificate.equationProofArguments? lhs e
+                          | x => none
+                  let lhsApplied : Theory.Model.AExpr β := List.foldl Theory.Model.AExpr.app lhs args
+                  let rhsApplied : Theory.Model.AExpr β := List.foldl Theory.Model.AExpr.app rhs args
+                  let beta ← Theory.Certificate.conversion?._unsafe_rec fuel n entries Γ lhsApplied e
+                  let equation : Theory.Certified.ConversionWitness β :=
+                    List.foldl (fun w x => w.app Theory.Certified.ConversionWitness.refl)
+                      (Theory.Certified.ConversionWitness.equation ref i levels) args
+                  pure (rhsApplied, Theory.Certified.ConversionWitness.trans lhsApplied beta.symm equation))
+              entry.equations.zipIdx;
+    match e with
+    | Theory.Model.AExpr.proj ref field major => do
+      let typed ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ major
+      let typed ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ typed
+      let __x ← Theory.Certificate.headConstant? typed.type
+      match __x with
+        | (owner, levels) =>
+          if owner = ref then do
+            let __x ← some (ref, levels)
+            __do_jp __x
+          else do
+            let __x ← none
+            __do_jp __x
+    | x => do
+      let __x ← Theory.Certificate.headConstant? e
+      match __x with
+        | (ref, levels) =>
+          let owner :=
+            match ref with
+            | Theory.ConstRef.ctor source member c => Theory.ConstRef.member source member
+            | x => ref;
+          do
+          let __x ← some (owner, levels)
+          __do_jp __x
+RECURSION WORKER Ix.Theory.Certificate.eta?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Model.AExpr β → Theory.Model.AExpr β → Option (Theory.Certified.ConversionWitness β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ a b =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    match a with
+    | Theory.Model.AExpr.lam p D body => do
+      let fn ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ b
+      let fn ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ fn
+      match fn.type with
+        | Theory.Model.AExpr.forallE q D' B =>
+          if p = q ∧ D = D' ∧ body = (Theory.Model.AExpr.liftN 1 b).app (Theory.Model.AExpr.bvar 0) then
+            pure (Theory.Certified.ConversionWitness.eta B fn.witness)
+          else none
+        | x => none
+    | x => none
+RECURSION WORKER Ix.Theory.Certificate.etaMajor?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat → Theory.Model.Environment β → Theory.Model.Context β → Theory.Model.AExpr β → Option (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ major =>
+  match fuel with
+  | 0 => none
+  | fuel.succ => do
+    let typed ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ major
+    let typed ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ typed
+    let __x ← Theory.Certificate.headConstant? typed.type
+    match __x with
+      | (family, levels) => do
+        let entry ← entries family
+        if (levels.length != entry.universes) = true then none
+          else
+            List.findSome?
+              (fun law =>
+                let arguments := Theory.Certificate.applicationArgs typed.type [] ++ [major];
+                do
+                let rhs ← Theory.Certificate.instantiateLambdas? (Theory.Model.AExpr.instL levels law.rhs) arguments
+                if (rhs != major) = true then none
+                  else do
+                    let lhs ← Theory.Certificate.instantiateLambdas? (Theory.Model.AExpr.instL levels law.lhs) arguments
+                    if lhs = major then none else some lhs)
+              entry.equations
+RECURSION WORKER Ix.Theory.Certificate.frontierWitnesses?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Theory.Store β →
+          Theory.Model.Environment β →
+            List (Theory.ConstRef β) → Option (Theory.Model.Environment β × List (Theory.Certified.FrontierWitness β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel store entries x =>
+  match x with
+  | [] => some (entries, [])
+  | ref :: refs =>
+    match store.uvars ref, store.type ref with
+    | some universes, some type => do
+      let inferred ← Theory.Certificate.inferSource? fuel universes entries [] type
+      match inferred.type with
+        | Theory.Model.AExpr.sort level =>
+          let witness :=
+            { ref := ref, annotations := Theory.Certificate.annotations inferred.expression, level := level,
+              typing := inferred.witness };
+          do
+          let reading ← Theory.Certified.readFrontierHeader? store witness
+          let __x ←
+            Theory.Certificate.frontierWitnesses?._unsafe_rec fuel store (entries.insert ref reading.header.entry) refs
+          match __x with
+            | (entries', rest) => pure (entries', witness :: rest)
+        | x => none
+    | x, x_1 => none
+RECURSION WORKER Ix.Theory.Certificate.hasLiteral._unsafe_rec
+{β : Type u} → Theory.VExpr β → Bool
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.VExpr.natLit value => true
+  | a.app b => Theory.Certificate.hasLiteral._unsafe_rec a || Theory.Certificate.hasLiteral._unsafe_rec b
+  | a.lam b => Theory.Certificate.hasLiteral._unsafe_rec a || Theory.Certificate.hasLiteral._unsafe_rec b
+  | a.forallE b => Theory.Certificate.hasLiteral._unsafe_rec a || Theory.Certificate.hasLiteral._unsafe_rec b
+  | Theory.VExpr.proj ref index e => Theory.Certificate.hasLiteral._unsafe_rec e
+  | x => false
+RECURSION WORKER Ix.Theory.Certificate.headConstant?._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → Option (Theory.ConstRef β × List Theory.VLevel)
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.Model.AExpr.const r levels => some (r, levels)
+  | f.app arg => Theory.Certificate.headConstant?._unsafe_rec f
+  | x => none
+RECURSION WORKER Ix.Theory.Certificate.headStep?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              Theory.Model.AExpr β → Option (Theory.Model.AExpr β × Theory.Certified.ConversionWitness β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ e =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    let delta := fun x =>
+      match e with
+      | Theory.Model.AExpr.const r ls => do
+        let entry ← entries r
+        if (ls.length != entry.universes) = true then none
+          else do
+            let body ← entry.body
+            pure (Theory.Model.AExpr.instL ls body, Theory.Certified.ConversionWitness.delta)
+      | x => none;
+    let app := fun x =>
+      match e with
+      | f.app x => do
+        let __x ←
+          Theory.Certificate.headStep?._unsafe_rec fuel n entries Γ f <|>
+              Theory.Certificate.equationStep?._unsafe_rec fuel n entries Γ f
+        match __x with
+          | (f', w) => pure (f'.app x, w.app Theory.Certified.ConversionWitness.refl)
+      | x => none;
+    let argument := fun x =>
+      match e with
+      | f.app x => do
+        let __x ←
+          Theory.Certificate.headStep?._unsafe_rec fuel n entries Γ x <|>
+              Theory.Certificate.equationStep?._unsafe_rec fuel n entries Γ x
+        match __x with
+          | (x', w) => pure (f.app x', Theory.Certified.ConversionWitness.refl.app w)
+      | x => none;
+    let projection := fun x =>
+      match e with
+      | Theory.Model.AExpr.proj r i x => do
+        let __x ←
+          Theory.Certificate.headStep?._unsafe_rec fuel n entries Γ x <|>
+              Theory.Certificate.equationStep?._unsafe_rec fuel n entries Γ x
+        match __x with
+          | (x', w) => pure (Theory.Model.AExpr.proj r i x', w.proj)
+      | x => none;
+    let literal := fun x =>
+      match e with
+      | Theory.Model.AExpr.natLit value => do
+        let ref ← Theory.Certificate.Hints.natural
+        let entry ← entries ref
+        if (entry.universes != 0) = true then none
+          else
+            List.findSome?
+              (fun x =>
+                match x with
+                | (fact, i) =>
+                  match fact with
+                  | Theory.Model.ConstantFact.natural zero succ =>
+                    some
+                      (match value with
+                        | 0 => Theory.Model.AExpr.const zero []
+                        | n.succ => (Theory.Model.AExpr.const succ []).app (Theory.Model.AExpr.natLit n),
+                        Theory.Certified.ConversionWitness.natLiteral ref i)
+                  | x => none)
+              entry.facts.zipIdx
+      | x => none;
+    Theory.Certificate.beta?._unsafe_rec fuel n entries Γ e <|>
+      delta () <|> app () <|> argument () <|> projection () <|> literal ()
+RECURSION WORKER Ix.Theory.Certificate.inferAnnotated?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β → Theory.Model.AExpr β → Option (Theory.Certificate.Suggestion β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ e =>
+  match fuel with
+  | 0 => none
+  | fuel.succ => do
+    let result ← Theory.Certificate.inferSource?._unsafe_rec fuel n entries Γ e.erase
+    if result.expression = e then some result else none
+RECURSION WORKER Ix.Theory.Certificate.inferSource?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β → Theory.VExpr β → Option (Theory.Certificate.Suggestion β)
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ =>
+  match (motive := Nat → Theory.VExpr β → Option (Theory.Certificate.Suggestion β)) fuel with
+  | 0 => fun x => none
+  | fuel.succ => fun source =>
+    match source with
+    | Theory.VExpr.bvar i => do
+      let A ← Γ[i]?
+      pure { expression := Theory.Model.AExpr.bvar i, type := A, witness := Theory.Certified.TypingWitness.bvar }
+    | Theory.VExpr.sort l =>
+      if Theory.VLevel.WF n l then
+        some
+          { expression := Theory.Model.AExpr.sort l, type := Theory.Model.AExpr.sort l.succ,
+            witness := Theory.Certified.TypingWitness.sort }
+      else none
+    | Theory.VExpr.const r ls => do
+      let entry ← entries r
+      if ls.length = entry.universes ∧ ∀ (l : Theory.VLevel), l ∈ ls → Theory.VLevel.WF n l then
+          pure
+            { expression := Theory.Model.AExpr.const r ls, type := Theory.Model.AExpr.instL ls entry.type,
+              witness := Theory.Certified.TypingWitness.const }
+        else none
+    | A.forallE B => do
+      let a ← Theory.Certificate.inferSource?._unsafe_rec fuel n entries Γ A
+      let a ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ a
+      match a.type with
+        | Theory.Model.AExpr.sort lA => do
+          let b ←
+            Theory.Certificate.inferSource?._unsafe_rec fuel n entries (Theory.Model.Context.push a.expression Γ) B
+          let b ←
+            Theory.Certificate.normalizeType?._unsafe_rec fuel n entries (Theory.Model.Context.push a.expression Γ) b
+          match b.type with
+            | Theory.Model.AExpr.sort lB =>
+              pure
+                {
+                  expression :=
+                    Theory.Model.AExpr.forallE (Theory.Certified.zeroCondition lB) a.expression b.expression,
+                  type := Theory.Model.AExpr.sort (lA.imax lB),
+                  witness := Theory.Certified.TypingWitness.forallE lA lB a.witness b.witness }
+            | x => none
+        | x => none
+    | A.lam body => do
+      let a ← Theory.Certificate.inferSource?._unsafe_rec fuel n entries Γ A
+      let a ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ a
+      match a.type with
+        | Theory.Model.AExpr.sort lA => do
+          let b ←
+            Theory.Certificate.inferSource?._unsafe_rec fuel n entries (Theory.Model.Context.push a.expression Γ) body
+          let b ←
+            Theory.Certificate.normalizeType?._unsafe_rec fuel n entries (Theory.Model.Context.push a.expression Γ) b
+          let B ←
+            Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries (Theory.Model.Context.push a.expression Γ)
+                b.type
+          let B ←
+            Theory.Certificate.normalizeType?._unsafe_rec fuel n entries (Theory.Model.Context.push a.expression Γ) B
+          match B.type with
+            | Theory.Model.AExpr.sort lB =>
+              pure
+                { expression := Theory.Model.AExpr.lam (Theory.Certified.zeroCondition lB) a.expression b.expression,
+                  type := Theory.Model.AExpr.forallE (Theory.Certified.zeroCondition lB) a.expression b.type,
+                  witness := Theory.Certified.TypingWitness.lam lA lB b.type a.witness B.witness b.witness }
+            | x => none
+        | x => none
+    | f.app arg => do
+      let fn ← Theory.Certificate.inferSource?._unsafe_rec fuel n entries Γ f
+      let fn ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ fn
+      match fn.type with
+        | Theory.Model.AExpr.forallE p A B => do
+          let a ← Theory.Certificate.inferSource?._unsafe_rec fuel n entries Γ arg
+          let aw ← Theory.Certificate.castWith?._unsafe_rec fuel n entries Γ a A
+          pure
+              { expression := fn.expression.app a.expression, type := B.inst a.expression,
+                witness := Theory.Certified.TypingWitness.app p A B fn.witness aw }
+        | x => none
+    | Theory.VExpr.proj ref index major => do
+      let major ← Theory.Certificate.inferSource?._unsafe_rec fuel n entries Γ major
+      let typed ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ major
+      let __x ← Theory.Certificate.headConstant? typed.type
+      match __x with
+        | (owner, ls) =>
+          if (owner != ref) = true then none
+          else do
+            let entry ← entries ref
+            if (ls.length != entry.universes) = true then none
+              else
+                List.findSome?
+                  (fun x =>
+                    match x with
+                    | (fact, factIndex) =>
+                      match fact with
+                      | Theory.Model.ConstantFact.typed expression type =>
+                        match Theory.Certificate.lambdaBody expression with
+                        | (fst, Theory.Model.AExpr.proj family field major_1) =>
+                          if (family != ref || field != index) = true then none
+                          else do
+                            let result ←
+                              Theory.Certificate.applyFact?._unsafe_rec fuel n entries Γ
+                                  { expression := Theory.Model.AExpr.instL ls expression,
+                                    type := Theory.Model.AExpr.instL ls type,
+                                    witness := Theory.Certified.TypingWitness.fact ref factIndex ls }
+                                  (Theory.Certificate.applicationArgs typed.type [] ++ [major.expression])
+                            if result.expression = Theory.Model.AExpr.proj ref index major.expression then some result
+                              else none
+                        | x => none
+                      | x => none)
+                  entry.facts.zipIdx
+    | Theory.VExpr.natLit value => do
+      let ref ← Theory.Certificate.Hints.natural
+      let entry ← entries ref
+      if (entry.universes != 0) = true then none
+        else
+          List.findSome?
+            (fun x =>
+              match x with
+              | (fact, i) =>
+                match fact with
+                | Theory.Model.ConstantFact.natural zero succ =>
+                  some
+                    { expression := Theory.Model.AExpr.natLit value, type := Theory.Model.AExpr.const ref [],
+                      witness := Theory.Certified.TypingWitness.natLit ref i }
+                | x => none)
+            entry.facts.zipIdx
+RECURSION WORKER Ix.Theory.Certificate.instantiateLambdas?._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → List (Theory.Model.AExpr β) → Option (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | e, [] => some e
+  | Theory.Model.AExpr.lam condition domain body, arg :: rest =>
+    Theory.Certificate.instantiateLambdas?._unsafe_rec (body.inst arg) rest
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certificate.lambdaBody._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → Nat × Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.Model.AExpr.lam condition domain body =>
+    match Theory.Certificate.lambdaBody._unsafe_rec body with
+    | (n, result) => (n + 1, result)
+  | e => (0, e)
+RECURSION WORKER Ix.Theory.Certificate.matchEquationArgs?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Theory.Model.AExpr β →
+      Theory.Model.AExpr β → List (Option (Theory.Model.AExpr β)) → Option (List (Option (Theory.Model.AExpr β)))
+IMPLEMENTATION
+fun {β} [DecidableEq β] x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Theory.Model.AExpr.bvar i, actual, slots => do
+    let slot ← slots[i]?
+    match slot with
+      | none => some (slots.set i (some actual))
+      | some previous => if previous = actual then some slots else none
+  | f.app x, g.app y, slots => do
+    let slots ← Theory.Certificate.matchEquationArgs?._unsafe_rec f g slots
+    Theory.Certificate.matchEquationArgs?._unsafe_rec x y slots
+  | Theory.Model.AExpr.const r ls, Theory.Model.AExpr.const q ms, slots => if r = q ∧ ls = ms then some slots else none
+  | Theory.Model.AExpr.sort l, Theory.Model.AExpr.sort m, slots => if l = m then some slots else none
+  | Theory.Model.AExpr.proj r i major, Theory.Model.AExpr.proj q j actual, slots =>
+    if r = q ∧ i = j then Theory.Certificate.matchEquationArgs?._unsafe_rec major actual slots else none
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.lam condition_1 domain_1 body_1, slots =>
+    some slots
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.forallE condition_1 domain_1 body_1, slots =>
+    some slots
+  | x, x_3, x_4 => none
+RECURSION WORKER Ix.Theory.Certificate.normalizeType?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β → Theory.Certificate.Suggestion β → Option (Theory.Certificate.Suggestion β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ suggestion =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    match suggestion.type with
+    | Theory.Model.AExpr.sort level => some suggestion
+    | Theory.Model.AExpr.forallE condition domain body => some suggestion
+    | x =>
+      match
+        Theory.Certificate.headStep?._unsafe_rec fuel n entries Γ suggestion.type <|>
+          Theory.Certificate.equationStep?._unsafe_rec fuel n entries Γ suggestion.type with
+      | none => some suggestion
+      | some (type, conversion) => do
+        let formed ← Theory.Certificate.inferAnnotated?._unsafe_rec fuel n entries Γ type
+        let formed ← Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ formed
+        match formed.type with
+          | Theory.Model.AExpr.sort level =>
+            Theory.Certificate.normalizeType?._unsafe_rec fuel n entries Γ
+              { expression := suggestion.expression, type := type,
+                witness :=
+                  Theory.Certified.TypingWitness.conv suggestion.type level suggestion.witness formed.witness
+                    conversion }
+          | x => none
+RECURSION WORKER Ix.Theory.Certificate.recursorFamily?._unsafe_rec
+{β : Type u} → Theory.VExpr β → Option β
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | binderType.forallE (A.forallE B) => Theory.Certificate.recursorFamily?._unsafe_rec (A.forallE B)
+  | A.forallE body =>
+    match A.appHead with
+    | Theory.VExpr.const (Theory.ConstRef.member source 0) levels => some source
+    | x => none
+  | x => none
+RECURSION WORKER Ix.Theory.Certified.checkDeclarationExtensions?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Theory.Certified.PrimitiveSignature β} →
+        {store : Theory.Store β} →
+          (state : Theory.Certified.CheckedInterface signature) →
+            List (Theory.Certified.DeclarationWitness β) →
+              Option (Theory.Certified.CheckedExtension signature store state)
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel {signature} {store} state x =>
+  match x with
+  | [] => some (Theory.Certified.CheckedExtension.refl state)
+  | witness :: rest => do
+    let step ← Theory.Certified.checkDeclarationExtension? fuel state witness
+    let rest ← Theory.Certified.checkDeclarationExtensions?._unsafe_rec fuel step.result rest
+    pure (step.trans rest)
+RECURSION WORKER Ix.Theory.Certified.replayDeclarations?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Theory.Certified.PrimitiveSignature β} →
+        {store : Theory.Store β} →
+          (state : Theory.Certified.CheckedInterface signature) →
+            List (Theory.Certified.DeclarationWitness β) →
+              Option (Theory.Certified.CheckedExtension signature store state)
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel {signature} {store} state x =>
+  match x with
+  | [] => some (Theory.Certified.CheckedExtension.refl state)
+  | witness :: rest =>
+    have __do_jp := fun step => do
+      let rest ← Theory.Certified.replayDeclarations?._unsafe_rec fuel step.result rest
+      pure (step.trans rest);
+    if (witness.outputs.all fun ref => (state.entries ref).isSome) = true then do
+      let step ← some (Theory.Certified.CheckedExtension.refl state)
+      __do_jp step
+    else do
+      let step ← Theory.Certified.checkDeclarationExtension? fuel state witness
+      __do_jp step
+RECURSION WORKER Ix.Theory.Certified.replayNodes?._unsafe_rec
+{β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Theory.Certified.PrimitiveSignature β} →
+        {store : Theory.Store β} →
+          (state : Theory.Certified.CheckedInterface signature) →
+            (known : List (Theory.ConstRef β)) →
+              (nodes : List (Theory.Certified.CheckedNode fuel signature store)) →
+                Option (Theory.Certified.ReplayResult state known nodes)
+IMPLEMENTATION
+fun {β} [DecidableEq β] {fuel} {signature} {store} state known x =>
+  match x with
+  | [] => some { checked := Theory.Certified.CheckedExtension.refl state, order := ⋯, subjects := ⋯, frontiers := ⋯ }
+  | node :: nodes =>
+    if available : (node.receipt.frontier.refs.all fun x => known.contains x) = true then
+      if aligned :
+          (node.receipt.frontier.headers.all fun h => decide (Theory.Certified.HeaderPresent state.entries h)) =
+            true then
+        do
+        let step ← Theory.Certified.replayDeclarations? fuel state node.input.declarations
+        if present : (node.input.subjects.all fun ref => (step.result.entries ref).isSome) = true then do
+            let tail ← Theory.Certified.replayNodes?._unsafe_rec step.result (known ++ node.input.subjects) nodes
+            pure { checked := step.trans tail.checked, order := ⋯, subjects := ⋯, frontiers := ⋯ }
+          else none
+      else none
+    else none
+RECURSION WORKER Ix.Theory.Certified.verifyArguments._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Theory.Model.Environment β) →
+          (Γ : Theory.Model.Context β) →
+            (domains args : List (Theory.Model.AExpr β)) →
+              List (Theory.Certified.TypingWitness β) →
+                Option (Theory.Certified.CheckedClaim (Theory.Certified.ArgumentsFit entries Γ domains args))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel n entries Γ x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], [], [] => some { down := ⋯ }
+  | A :: domains, a :: args, witness :: witnesses => do
+    let ha ← Theory.Certified.verifyType fuel n entries Γ a A witness
+    let hrest ←
+      Theory.Certified.verifyArguments._unsafe_rec fuel n entries Γ (Theory.Model.Telescope.inst a domains) args
+          witnesses
+    pure { down := ⋯ }
+  | x, x_3, x_4 => none
+RECURSION WORKER Ix.Theory.Certified.verifyConversion._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Theory.Model.Environment β) →
+          (Γ : Theory.Model.Context β) →
+            (a b : Theory.Model.AExpr β) →
+              Theory.Certified.ConversionWitness β →
+                Option (Theory.Certified.CheckedClaim (Theory.Model.ConversionClaim entries Γ a b))
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] fuel n entries Γ a b witness =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    if Theory.Model.AExpr.Scope n (List.length Γ) a ∧ Theory.Model.AExpr.Scope n (List.length Γ) b then
+      match a, b, witness with
+      | a, b, Theory.Certified.ConversionWitness.refl => if h : a = b then some { down := ⋯ } else none
+      | a, b, w.symm => do
+        let h ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ b a w
+        pure { down := ⋯ }
+      | a, b, Theory.Certified.ConversionWitness.trans c w₁ w₂ => do
+        let h₁ ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ a c w₁
+        let h₂ ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ c b w₂
+        pure { down := ⋯ }
+      | f.app a, f'.app a', wf.app wa => do
+        let hf ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ f f' wf
+        let ha ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ a a' wa
+        pure { down := ⋯ }
+      | Theory.Model.AExpr.proj r i a, Theory.Model.AExpr.proj r' i' b, w.proj =>
+        if hr : r = r' then
+          if hi : i = i' then do
+            let h ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ a b w
+            pure { down := ⋯ }
+          else none
+        else none
+      | Theory.Model.AExpr.lam p D body, Theory.Model.AExpr.lam p' D' body',
+        Theory.Certified.ConversionWitness.lam lD wD wd wb =>
+        if hp : p = p' then do
+          let hD ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ D (Theory.Model.AExpr.sort lD) wD
+          let hd ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ D D' wd
+          let hb ←
+            Theory.Certified.verifyConversion._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) body body' wb
+          pure { down := ⋯ }
+        else none
+      | Theory.Model.AExpr.forallE p D B, Theory.Model.AExpr.forallE p' D' B',
+        Theory.Certified.ConversionWitness.forallE lD wD wd wb =>
+        if hp : p = p' then do
+          let hD ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ D (Theory.Model.AExpr.sort lD) wD
+          let hd ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ D D' wd
+          let hb ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) B B' wb
+          pure { down := ⋯ }
+        else none
+      | (Theory.Model.AExpr.lam p D body).app arg, result, Theory.Certified.ConversionWitness.beta T wl wa =>
+        if hr : result = body.inst arg then do
+          let hl ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ (Theory.Model.AExpr.lam p D body) T wl
+          let ha ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ arg D wa
+          pure { down := ⋯ }
+        else none
+      | Theory.Model.AExpr.lam p D body, f, Theory.Certified.ConversionWitness.eta B wf =>
+        if hb : body = (Theory.Model.AExpr.liftN 1 f).app (Theory.Model.AExpr.bvar 0) then do
+          let hf ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ f (Theory.Model.AExpr.forallE p D B) wf
+          pure { down := ⋯ }
+        else none
+      | a, b, Theory.Certified.ConversionWitness.proofIrrel A wA wa wb => do
+        let hA ←
+          Theory.Certified.verifyType._unsafe_rec fuel n entries Γ A (Theory.Model.AExpr.sort Theory.VLevel.zero) wA
+        let ha ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ a A wa
+        let hb ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ b A wb
+        pure { down := ⋯ }
+      | Theory.Model.AExpr.const r ls, b, Theory.Certified.ConversionWitness.delta =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match h_1 : entry.body with
+          | none => none
+          | some body =>
+            if hn : ls.length = entry.universes then
+              if hB : b = Theory.Model.AExpr.instL ls body then some { down := ⋯ } else none
+            else none
+      | Theory.Model.AExpr.sort l, Theory.Model.AExpr.sort l', Theory.Certified.ConversionWitness.sort =>
+        if h : Theory.Certified.LevelEq.check n l l' = true then some { down := ⋯ } else none
+      | a, b, Theory.Certified.ConversionWitness.equation r index ls =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match he : entry.equations[index]? with
+          | none => none
+          | some law =>
+            if hn : ls.length = entry.universes then
+              if hls : ∀ (l : Theory.VLevel), l ∈ ls → Theory.VLevel.WF n l then
+                if ha : a = Theory.Model.AExpr.instL ls law.lhs then
+                  if hb : b = Theory.Model.AExpr.instL ls law.rhs then some { down := ⋯ } else none
+                else none
+              else none
+            else none
+      | Theory.Model.AExpr.natLit value, result, Theory.Certified.ConversionWitness.natLiteral r index =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (Theory.Model.ConstantFact.natural zero succ) =>
+            if hn : entry.universes = 0 then
+              match value with
+              | 0 => if he : result = Theory.Model.AExpr.const zero [] then some { down := ⋯ } else none
+              | value.succ =>
+                if he : result = (Theory.Model.AExpr.const succ []).app (Theory.Model.AExpr.natLit value) then
+                  some { down := ⋯ }
+                else none
+            else none
+          | x => none
+      | x, x_1, x_2 => none
+    else none
+RECURSION WORKER Ix.Theory.Certified.verifyPropTelescope._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Theory.Model.Environment β) →
+          (atLevel : Theory.VLevel) →
+            (Γ : Theory.Model.Context β) →
+              (domains : List (Theory.Model.AExpr β)) →
+                List (Theory.Certified.DomainWitness β) →
+                  Option (Theory.Certified.CheckedClaim (Theory.Certified.TelescopeProp entries Γ domains atLevel))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel n entries atLevel x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Γ, [], [] => some { down := ⋯ }
+  | Γ, A :: rest, witness :: witnesses =>
+    if hl : Theory.Certified.checkZeroImplies atLevel witness.level = true then do
+      let hA ← Theory.Certified.verifyType fuel n entries Γ A (Theory.Model.AExpr.sort witness.level) witness.typing
+      let htail ←
+        Theory.Certified.verifyPropTelescope._unsafe_rec fuel n entries atLevel (Theory.Model.Context.push A Γ) rest
+            witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_3, x_4 => none
+RECURSION WORKER Ix.Theory.Certified.verifyTelescope._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Theory.Model.Environment β) →
+          (bound : Option Theory.VLevel) →
+            (Γ : Theory.Model.Context β) →
+              (domains : List (Theory.Model.AExpr β)) →
+                List (Theory.Certified.DomainWitness β) →
+                  Option
+                    (Theory.Certified.CheckedClaim
+                      (Theory.Model.Telescope.Formed entries Γ domains ∧
+                        Theory.Certified.TelescopeBound entries Γ domains bound))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel n entries bound x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Γ, [], [] => some { down := ⋯ }
+  | Γ, A :: rest, witness :: witnesses =>
+    if hl : Theory.Certified.checkDomainBound n bound witness.level = true then do
+      let hA ← Theory.Certified.verifyType fuel n entries Γ A (Theory.Model.AExpr.sort witness.level) witness.typing
+      let hrest ←
+        Theory.Certified.verifyTelescope._unsafe_rec fuel n entries bound (Theory.Model.Context.push A Γ) rest witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_3, x_4 => none
+RECURSION WORKER Ix.Theory.Certified.verifyType._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Theory.Model.Environment β) →
+          (Γ : Theory.Model.Context β) →
+            (e A : Theory.Model.AExpr β) →
+              Theory.Certified.TypingWitness β →
+                Option (Theory.Certified.CheckedClaim (Theory.Model.TypingClaim entries Γ e A))
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] fuel n entries Γ e A witness =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    if Theory.Model.AExpr.Scope n (List.length Γ) e ∧ Theory.Model.AExpr.Scope n (List.length Γ) A then
+      match e, witness with
+      | Theory.Model.AExpr.sort l, Theory.Certified.TypingWitness.sort =>
+        if h : A = Theory.Model.AExpr.sort l.succ then some { down := ⋯ } else none
+      | Theory.Model.AExpr.bvar i, Theory.Certified.TypingWitness.bvar =>
+        match h : Γ[i]? with
+        | none => none
+        | some B => if hA : A = B then some { down := ⋯ } else none
+      | Theory.Model.AExpr.const r ls, Theory.Certified.TypingWitness.const =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          if hn : ls.length = entry.universes then
+            if hA : A = Theory.Model.AExpr.instL ls entry.type then some { down := ⋯ } else none
+          else none
+      | f.app a, Theory.Certified.TypingWitness.app p D B wf wa =>
+        if hA : A = B.inst a then do
+          let hf ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ f (Theory.Model.AExpr.forallE p D B) wf
+          let ha ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ a D wa
+          pure { down := ⋯ }
+        else none
+      | Theory.Model.AExpr.lam p D body, Theory.Certified.TypingWitness.lam lD lB B wD wB wb =>
+        if hp : p = Theory.Certified.zeroCondition lB then
+          if hA : A = Theory.Model.AExpr.forallE p D B then do
+            let hD ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ D (Theory.Model.AExpr.sort lD) wD
+            let hB ←
+              Theory.Certified.verifyType._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) B
+                  (Theory.Model.AExpr.sort lB) wB
+            let hb ← Theory.Certified.verifyType._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) body B wb
+            pure { down := ⋯ }
+          else none
+        else none
+      | Theory.Model.AExpr.forallE p D B, Theory.Certified.TypingWitness.forallE lD lB wD wB =>
+        if hp : p = Theory.Certified.zeroCondition lB then
+          if hA : A = Theory.Model.AExpr.sort (lD.imax lB) then do
+            let hD ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ D (Theory.Model.AExpr.sort lD) wD
+            let hB ←
+              Theory.Certified.verifyType._unsafe_rec fuel n entries (Theory.Model.Context.push D Γ) B
+                  (Theory.Model.AExpr.sort lB) wB
+            pure { down := ⋯ }
+          else none
+        else none
+      | e, Theory.Certified.TypingWitness.conv B lA we wA wc => do
+        let he ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ e B we
+        let hA ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ A (Theory.Model.AExpr.sort lA) wA
+        let hc ← Theory.Certified.verifyConversion._unsafe_rec fuel n entries Γ B A wc
+        pure { down := ⋯ }
+      | e, Theory.Certified.TypingWitness.fact r index ls =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (Theory.Model.ConstantFact.typed value type) =>
+            if hn : ls.length = entry.universes then
+              if ∀ (l : Theory.VLevel), l ∈ ls → Theory.VLevel.WF n l then
+                if he : e = Theory.Model.AExpr.instL ls value then
+                  if hA : A = Theory.Model.AExpr.instL ls type then some { down := ⋯ } else none
+                else none
+              else none
+            else none
+          | x => none
+      | Theory.Model.AExpr.natLit value, Theory.Certified.TypingWitness.natLit r index =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (Theory.Model.ConstantFact.natural zero succ) =>
+            if hn : entry.universes = 0 then if hA : A = Theory.Model.AExpr.const r [] then some { down := ⋯ } else none
+            else none
+          | x => none
+      | e, Theory.Certified.TypingWitness.betaResult p D body arg B wl wa =>
+        if he : e = body.inst arg then
+          if hA : A = B.inst arg then do
+            let hl ←
+              Theory.Certified.verifyType._unsafe_rec fuel n entries Γ (Theory.Model.AExpr.lam p D body)
+                  (Theory.Model.AExpr.forallE p D B) wl
+            let ha ← Theory.Certified.verifyType._unsafe_rec fuel n entries Γ arg D wa
+            pure { down := ⋯ }
+          else none
+        else none
+      | x, x_1 => none
+    else none
+RECURSION WORKER Ix.Theory.Certified.zeroCondition._unsafe_rec
+Theory.VLevel → Theory.Certified.PropWhen
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Theory.VLevel.zero => Theory.Certified.PropWhen.always
+  | a.succ => Theory.Certified.PropWhen.never
+  | a.max b => (Theory.Certified.zeroCondition._unsafe_rec a).inter (Theory.Certified.zeroCondition._unsafe_rec b)
+  | a.imax b => Theory.Certified.zeroCondition._unsafe_rec b
+  | Theory.VLevel.param i => Theory.Certified.PropWhen.param i
+RECURSION WORKER Ix.Theory.Model.WellDenoted._unsafe_rec
+{β : Type u} →
+  {V : Type v} →
+    [Theory.Model.SetTheory V] → Theory.Model.Assignment β V → List Nat → (Nat → V) → Theory.Model.AExpr β → Prop
+IMPLEMENTATION
+fun {β} {V} [Theory.Model.SetTheory V] constants levels env x =>
+  match x with
+  | Theory.Model.AExpr.bvar index => True
+  | Theory.Model.AExpr.sort level => True
+  | Theory.Model.AExpr.const ref levels => True
+  | f.app a =>
+    Theory.Model.WellDenoted._unsafe_rec constants levels env f ∧
+      Theory.Model.WellDenoted._unsafe_rec constants levels env a ∧
+        ∃ v A B,
+          Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels env f) (Theory.Model.SetModel.piR v A B) ∧
+            Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels env a) A ∧
+              ∀ (x : V),
+                Theory.Model.SetTheory.Mem x A → Theory.Model.SetTheory.Mem (B x) (Theory.Model.SetTheory.univ v)
+  | Theory.Model.AExpr.lam p A b =>
+    Theory.Model.WellDenoted._unsafe_rec constants levels env A ∧
+      (∀ (x : V),
+          Theory.Model.SetTheory.Mem x (Theory.Model.interp constants levels env A) →
+            Theory.Model.WellDenoted._unsafe_rec constants levels (Theory.Model.Valuation.cons x env) b) ∧
+        ∃ v B,
+          (Theory.Model.regime p levels = 0 ↔ v = 0) ∧
+            ∀ (x : V),
+              Theory.Model.SetTheory.Mem x (Theory.Model.interp constants levels env A) →
+                Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels (Theory.Model.Valuation.cons x env) b)
+                    (B x) ∧
+                  Theory.Model.SetTheory.Mem (B x) (Theory.Model.SetTheory.univ v)
+  | Theory.Model.AExpr.forallE p A B =>
+    Theory.Model.WellDenoted._unsafe_rec constants levels env A ∧
+      (∀ (x : V),
+          Theory.Model.SetTheory.Mem x (Theory.Model.interp constants levels env A) →
+            Theory.Model.WellDenoted._unsafe_rec constants levels (Theory.Model.Valuation.cons x env) B) ∧
+        ∃ v,
+          (Theory.Model.regime p levels = 0 ↔ v = 0) ∧
+            ∀ (x : V),
+              Theory.Model.SetTheory.Mem x (Theory.Model.interp constants levels env A) →
+                Theory.Model.SetTheory.Mem (Theory.Model.interp constants levels (Theory.Model.Valuation.cons x env) B)
+                  (Theory.Model.SetTheory.univ v)
+  | Theory.Model.AExpr.proj ref field e => Theory.Model.WellDenoted._unsafe_rec constants levels env e
+  | Theory.Model.AExpr.natLit value => True
+RECURSION WORKER Ix.Theory.Model.readAnnotations?._unsafe_rec
+{β : Type u} →
+  (n k : Nat) → (source : Theory.VExpr β) → Theory.Model.AnnotationTree → Option (Theory.Model.Reading n k source)
+IMPLEMENTATION
+fun {β} n k source tree =>
+  match source, tree with
+  | Theory.VExpr.bvar i, Theory.Model.AnnotationTree.leaf =>
+    if h : i < k then some ⟨Theory.Model.AExpr.bvar i, ⋯⟩ else none
+  | Theory.VExpr.sort l, Theory.Model.AnnotationTree.leaf =>
+    if h : Theory.VLevel.WF n l then some ⟨Theory.Model.AExpr.sort l, ⋯⟩ else none
+  | Theory.VExpr.const r ls, Theory.Model.AnnotationTree.leaf =>
+    if h : ∀ (l : Theory.VLevel), l ∈ ls → Theory.VLevel.WF n l then some ⟨Theory.Model.AExpr.const r ls, ⋯⟩ else none
+  | f.app a, tf.app ta => do
+    let f' ← Theory.Model.readAnnotations?._unsafe_rec n k f tf
+    let a' ← Theory.Model.readAnnotations?._unsafe_rec n k a ta
+    pure ⟨f'.val.app a'.val, ⋯⟩
+  | a.lam b, Theory.Model.AnnotationTree.lam raw ta tb =>
+    match Ix.Theory.Model.readCondition?✝ n raw with
+    | none => none
+    | some p => do
+      let a' ← Theory.Model.readAnnotations?._unsafe_rec n k a ta
+      let b' ← Theory.Model.readAnnotations?._unsafe_rec n (k + 1) b tb
+      pure ⟨Theory.Model.AExpr.lam p.val a'.val b'.val, ⋯⟩
+  | a.forallE b, Theory.Model.AnnotationTree.forallE raw ta tb =>
+    match Ix.Theory.Model.readCondition?✝ n raw with
+    | none => none
+    | some p => do
+      let a' ← Theory.Model.readAnnotations?._unsafe_rec n k a ta
+      let b' ← Theory.Model.readAnnotations?._unsafe_rec n (k + 1) b tb
+      pure ⟨Theory.Model.AExpr.forallE p.val a'.val b'.val, ⋯⟩
+  | Theory.VExpr.proj r i e, te.proj => do
+    let e' ← Theory.Model.readAnnotations?._unsafe_rec n k e te
+    pure ⟨Theory.Model.AExpr.proj r i e'.val, ⋯⟩
+  | Theory.VExpr.natLit v, Theory.Model.AnnotationTree.leaf => some ⟨Theory.Model.AExpr.natLit v, ⋯⟩
+  | x, x_1 => none
+RECURSION WORKER Ix.Theory.VExpr.appArgs._unsafe_rec
+{β : Type u_1} → Theory.VExpr β → List (Theory.VExpr β) → List (Theory.VExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | f.app a, acc => Theory.VExpr.appArgs._unsafe_rec f (a :: acc)
+  | x, acc => acc
+RECURSION WORKER Ix.Theory.VExpr.appHead._unsafe_rec
+{β : Type u_1} → Theory.VExpr β → Theory.VExpr β
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | f.app arg => Theory.VExpr.appHead._unsafe_rec f
+  | e => e
+RECURSION WORKER Ix.Theory.VExpr.appN._unsafe_rec
+{β : Type u_1} → Theory.VExpr β → List (Theory.VExpr β) → Theory.VExpr β
+IMPLEMENTATION
+fun {β} f x =>
+  match x with
+  | [] => f
+  | a :: as => Theory.VExpr.appN._unsafe_rec (f.app a) as
+RECURSION WORKER Ix.Theory.VExpr.bvarRevRange._unsafe_rec
+{β : Type u_1} → Nat → Nat → List (Theory.VExpr β)
+IMPLEMENTATION
+fun {β} off x =>
+  match x with
+  | 0 => []
+  | m.succ => Theory.VExpr.bvar (off + m) :: Theory.VExpr.bvarRevRange._unsafe_rec off m
+RECURSION WORKER Ix.Theory.VExpr.forallN._unsafe_rec
+{β : Type u_1} → List (Theory.VExpr β) → Theory.VExpr β → Theory.VExpr β
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | [], e => e
+  | A :: As, e => A.forallE (Theory.VExpr.forallN._unsafe_rec As e)
+RECURSION WORKER Ix.Theory.VExpr.inst._unsafe_rec
+{β : Type u_1} → Theory.VExpr β → Theory.VExpr β → optParam Nat 0 → Theory.VExpr β
+IMPLEMENTATION
+fun {β} x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Theory.VExpr.bvar i, e, k => Theory.VExpr.instVar i e k
+  | Theory.VExpr.sort u, x, x_3 => Theory.VExpr.sort u
+  | Theory.VExpr.const r us, x, x_3 => Theory.VExpr.const r us
+  | fn.app arg, e, k => (Theory.VExpr.inst._unsafe_rec fn e k).app (Theory.VExpr.inst._unsafe_rec arg e k)
+  | ty.lam body, e, k => (Theory.VExpr.inst._unsafe_rec ty e k).lam (Theory.VExpr.inst._unsafe_rec body e (k + 1))
+  | ty.forallE body, e, k =>
+    (Theory.VExpr.inst._unsafe_rec ty e k).forallE (Theory.VExpr.inst._unsafe_rec body e (k + 1))
+  | Theory.VExpr.proj r i p, e, k => Theory.VExpr.proj r i (Theory.VExpr.inst._unsafe_rec p e k)
+  | Theory.VExpr.natLit value, x, x_3 => Theory.VExpr.natLit value
+RECURSION WORKER Ix.Theory.VExpr.instL._unsafe_rec
+List Theory.VLevel → {β : Type u_1} → Theory.VExpr β → Theory.VExpr β
+IMPLEMENTATION
+fun levels {β} x =>
+  match x with
+  | Theory.VExpr.bvar i => Theory.VExpr.bvar i
+  | Theory.VExpr.sort u => Theory.VExpr.sort (Theory.VLevel.inst levels u)
+  | Theory.VExpr.const r us => Theory.VExpr.const r (List.map (Theory.VLevel.inst levels) us)
+  | fn.app arg => (Theory.VExpr.instL._unsafe_rec levels fn).app (Theory.VExpr.instL._unsafe_rec levels arg)
+  | ty.lam body => (Theory.VExpr.instL._unsafe_rec levels ty).lam (Theory.VExpr.instL._unsafe_rec levels body)
+  | ty.forallE body => (Theory.VExpr.instL._unsafe_rec levels ty).forallE (Theory.VExpr.instL._unsafe_rec levels body)
+  | Theory.VExpr.proj r i e => Theory.VExpr.proj r i (Theory.VExpr.instL._unsafe_rec levels e)
+  | Theory.VExpr.natLit value => Theory.VExpr.natLit value
+RECURSION WORKER Ix.Theory.VExpr.lamN._unsafe_rec
+{β : Type u_1} → List (Theory.VExpr β) → Theory.VExpr β → Theory.VExpr β
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | [], e => e
+  | A :: As, e => A.lam (Theory.VExpr.lamN._unsafe_rec As e)
+RECURSION WORKER Ix.Theory.VExpr.liftN._unsafe_rec
+Nat → {β : Type u_1} → Theory.VExpr β → optParam Nat 0 → Theory.VExpr β
+IMPLEMENTATION
+fun n {β} x x_1 =>
+  match x, x_1 with
+  | Theory.VExpr.bvar i, k => Theory.VExpr.bvar (Theory.liftVar n i k)
+  | Theory.VExpr.sort u, x => Theory.VExpr.sort u
+  | Theory.VExpr.const r us, x => Theory.VExpr.const r us
+  | fn.app arg, k => (Theory.VExpr.liftN._unsafe_rec n fn k).app (Theory.VExpr.liftN._unsafe_rec n arg k)
+  | ty.lam body, k => (Theory.VExpr.liftN._unsafe_rec n ty k).lam (Theory.VExpr.liftN._unsafe_rec n body (k + 1))
+  | ty.forallE body, k =>
+    (Theory.VExpr.liftN._unsafe_rec n ty k).forallE (Theory.VExpr.liftN._unsafe_rec n body (k + 1))
+  | Theory.VExpr.proj r i e, k => Theory.VExpr.proj r i (Theory.VExpr.liftN._unsafe_rec n e k)
+  | Theory.VExpr.natLit value, x => Theory.VExpr.natLit value
+RECURSION WORKER Ix.Theory.VExpr.mapRefs._unsafe_rec
+{β : Type u} → {γ : Type v} → (Theory.ConstRef β → Theory.ConstRef γ) → Theory.VExpr β → Theory.VExpr γ
+IMPLEMENTATION
+fun {β} {γ} mapping x =>
+  match x with
+  | Theory.VExpr.bvar i => Theory.VExpr.bvar i
+  | Theory.VExpr.sort level => Theory.VExpr.sort level
+  | Theory.VExpr.const ref levels => Theory.VExpr.const (mapping ref) levels
+  | f.app a => (Theory.VExpr.mapRefs._unsafe_rec mapping f).app (Theory.VExpr.mapRefs._unsafe_rec mapping a)
+  | type.lam body => (Theory.VExpr.mapRefs._unsafe_rec mapping type).lam (Theory.VExpr.mapRefs._unsafe_rec mapping body)
+  | type.forallE body =>
+    (Theory.VExpr.mapRefs._unsafe_rec mapping type).forallE (Theory.VExpr.mapRefs._unsafe_rec mapping body)
+  | Theory.VExpr.proj ref index major =>
+    Theory.VExpr.proj (mapping ref) index (Theory.VExpr.mapRefs._unsafe_rec mapping major)
+  | Theory.VExpr.natLit n => Theory.VExpr.natLit n
+RECURSION WORKER Ix.Theory.VExpr.refs._unsafe_rec
+{β : Type u_1} → Theory.VExpr β → List (Theory.ConstRef β)
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.VExpr.bvar deBruijnIndex => []
+  | Theory.VExpr.sort u => []
+  | Theory.VExpr.natLit value => []
+  | Theory.VExpr.const r levels => [r]
+  | e₁.app e₂ => Theory.VExpr.refs._unsafe_rec e₁ ++ Theory.VExpr.refs._unsafe_rec e₂
+  | e₁.lam e₂ => Theory.VExpr.refs._unsafe_rec e₁ ++ Theory.VExpr.refs._unsafe_rec e₂
+  | e₁.forallE e₂ => Theory.VExpr.refs._unsafe_rec e₁ ++ Theory.VExpr.refs._unsafe_rec e₂
+  | Theory.VExpr.proj r index e => r :: Theory.VExpr.refs._unsafe_rec e
+RECURSION WORKER Ix.Theory.VExpr.unliftN._unsafe_rec
+{β : Type u_1} → Theory.VExpr β → Nat → Nat → Theory.VExpr β
+IMPLEMENTATION
+fun {β} e n k =>
+  match n with
+  | 0 => e
+  | n.succ => Theory.VExpr.unliftN._unsafe_rec (e.inst default k) n k
+RECURSION WORKER Ix.Theory.VLevel.WF._unsafe_rec
+Nat → Theory.VLevel → Prop
+IMPLEMENTATION
+fun n x =>
+  match x with
+  | Theory.VLevel.zero => True
+  | l.succ => Theory.VLevel.WF._unsafe_rec n l
+  | l₁.max l₂ => Theory.VLevel.WF._unsafe_rec n l₁ ∧ Theory.VLevel.WF._unsafe_rec n l₂
+  | l₁.imax l₂ => Theory.VLevel.WF._unsafe_rec n l₁ ∧ Theory.VLevel.WF._unsafe_rec n l₂
+  | Theory.VLevel.param i => i < n
+RECURSION WORKER Ix.Theory.VLevel.decidable_WF._unsafe_rec
+{n : Nat} → {l : Theory.VLevel} → Decidable (Theory.VLevel.WF n l)
+IMPLEMENTATION
+fun {n} x =>
+  match x with
+  | Theory.VLevel.zero => instDecidableTrue
+  | l.succ => Theory.VLevel.decidable_WF._unsafe_rec
+  | a.max a_1 => instDecidableAnd
+  | a.imax a_1 => instDecidableAnd
+  | Theory.VLevel.param a => a.decLt n
+RECURSION WORKER Ix.Theory.VLevel.eval._unsafe_rec
+List Nat → Theory.VLevel → Nat
+IMPLEMENTATION
+fun ls x =>
+  match x with
+  | Theory.VLevel.zero => 0
+  | l.succ => Theory.VLevel.eval._unsafe_rec ls l + 1
+  | l₁.max l₂ => (Theory.VLevel.eval._unsafe_rec ls l₁).max (Theory.VLevel.eval._unsafe_rec ls l₂)
+  | l₁.imax l₂ => Theory.VLevel.natIMax (Theory.VLevel.eval._unsafe_rec ls l₁) (Theory.VLevel.eval._unsafe_rec ls l₂)
+  | Theory.VLevel.param i => ls.getD i 0
+RECURSION WORKER Ix.Theory.VLevel.inst._unsafe_rec
+List Theory.VLevel → Theory.VLevel → Theory.VLevel
+IMPLEMENTATION
+fun ls x =>
+  match x with
+  | Theory.VLevel.zero => Theory.VLevel.zero
+  | l.succ => (Theory.VLevel.inst._unsafe_rec ls l).succ
+  | l₁.max l₂ => (Theory.VLevel.inst._unsafe_rec ls l₁).max (Theory.VLevel.inst._unsafe_rec ls l₂)
+  | l₁.imax l₂ => (Theory.VLevel.inst._unsafe_rec ls l₁).imax (Theory.VLevel.inst._unsafe_rec ls l₂)
+  | Theory.VLevel.param i => ls.getD i Theory.VLevel.zero
+RECURSION WORKER Ix.Theory.instDecidableEqVExpr.decEq._unsafe_rec
+{β : Type u_1} → [DecidableEq β] → (x x_1 : Theory.VExpr β) → Decidable (x = x_1)
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | Theory.VExpr.bvar a, Theory.VExpr.bvar b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, Theory.VExpr.sort u => isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, Theory.VExpr.const ref levels => isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, fn.app arg => isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, binderType.lam body => isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, binderType.forallE body => isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, Theory.VExpr.proj ref index expr => isFalse ⋯
+  | Theory.VExpr.bvar deBruijnIndex, Theory.VExpr.natLit value => isFalse ⋯
+  | Theory.VExpr.sort u, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | Theory.VExpr.sort a, Theory.VExpr.sort b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | Theory.VExpr.sort u, Theory.VExpr.const ref levels => isFalse ⋯
+  | Theory.VExpr.sort u, fn.app arg => isFalse ⋯
+  | Theory.VExpr.sort u, binderType.lam body => isFalse ⋯
+  | Theory.VExpr.sort u, binderType.forallE body => isFalse ⋯
+  | Theory.VExpr.sort u, Theory.VExpr.proj ref index expr => isFalse ⋯
+  | Theory.VExpr.sort u, Theory.VExpr.natLit value => isFalse ⋯
+  | Theory.VExpr.const ref levels, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | Theory.VExpr.const ref levels, Theory.VExpr.sort u => isFalse ⋯
+  | Theory.VExpr.const a a_1, Theory.VExpr.const b b_1 =>
+    if h : a = b then h ▸ if h : a_1 = b_1 then h ▸ isTrue ⋯ else isFalse ⋯ else isFalse ⋯
+  | Theory.VExpr.const ref levels, fn.app arg => isFalse ⋯
+  | Theory.VExpr.const ref levels, binderType.lam body => isFalse ⋯
+  | Theory.VExpr.const ref levels, binderType.forallE body => isFalse ⋯
+  | Theory.VExpr.const ref levels, Theory.VExpr.proj ref_1 index expr => isFalse ⋯
+  | Theory.VExpr.const ref levels, Theory.VExpr.natLit value => isFalse ⋯
+  | fn.app arg, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | fn.app arg, Theory.VExpr.sort u => isFalse ⋯
+  | fn.app arg, Theory.VExpr.const ref levels => isFalse ⋯
+  | a.app a_1, b.app b_1 =>
+    let inst_1 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a a;
+        let inst_3 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | fn.app arg, binderType.lam body => isFalse ⋯
+  | fn.app arg, binderType.forallE body => isFalse ⋯
+  | fn.app arg, Theory.VExpr.proj ref index expr => isFalse ⋯
+  | fn.app arg, Theory.VExpr.natLit value => isFalse ⋯
+  | binderType.lam body, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | binderType.lam body, Theory.VExpr.sort u => isFalse ⋯
+  | binderType.lam body, Theory.VExpr.const ref levels => isFalse ⋯
+  | binderType.lam body, fn.app arg => isFalse ⋯
+  | a.lam a_1, b.lam b_1 =>
+    let inst_1 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a a;
+        let inst_3 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | binderType.lam body, binderType_1.forallE body_1 => isFalse ⋯
+  | binderType.lam body, Theory.VExpr.proj ref index expr => isFalse ⋯
+  | binderType.lam body, Theory.VExpr.natLit value => isFalse ⋯
+  | binderType.forallE body, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | binderType.forallE body, Theory.VExpr.sort u => isFalse ⋯
+  | binderType.forallE body, Theory.VExpr.const ref levels => isFalse ⋯
+  | binderType.forallE body, fn.app arg => isFalse ⋯
+  | binderType.forallE body, binderType_1.lam body_1 => isFalse ⋯
+  | a.forallE a_1, b.forallE b_1 =>
+    let inst_1 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a a;
+        let inst_3 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | binderType.forallE body, Theory.VExpr.proj ref index expr => isFalse ⋯
+  | binderType.forallE body, Theory.VExpr.natLit value => isFalse ⋯
+  | Theory.VExpr.proj ref index expr, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | Theory.VExpr.proj ref index expr, Theory.VExpr.sort u => isFalse ⋯
+  | Theory.VExpr.proj ref index expr, Theory.VExpr.const ref_1 levels => isFalse ⋯
+  | Theory.VExpr.proj ref index expr, fn.app arg => isFalse ⋯
+  | Theory.VExpr.proj ref index expr, binderType.lam body => isFalse ⋯
+  | Theory.VExpr.proj ref index expr, binderType.forallE body => isFalse ⋯
+  | Theory.VExpr.proj a a_1 a_2, Theory.VExpr.proj b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_1 := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Theory.instDecidableEqVExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Theory.VExpr.proj ref index expr, Theory.VExpr.natLit value => isFalse ⋯
+  | Theory.VExpr.natLit value, Theory.VExpr.bvar deBruijnIndex => isFalse ⋯
+  | Theory.VExpr.natLit value, Theory.VExpr.sort u => isFalse ⋯
+  | Theory.VExpr.natLit value, Theory.VExpr.const ref levels => isFalse ⋯
+  | Theory.VExpr.natLit value, fn.app arg => isFalse ⋯
+  | Theory.VExpr.natLit value, binderType.lam body => isFalse ⋯
+  | Theory.VExpr.natLit value, binderType.forallE body => isFalse ⋯
+  | Theory.VExpr.natLit value, Theory.VExpr.proj ref index expr => isFalse ⋯
+  | Theory.VExpr.natLit a, Theory.VExpr.natLit b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+RECURSION WORKER Ix.Theory.instDecidableEqVLevel.decEq._unsafe_rec
+(x x_1 : Theory.VLevel) → Decidable (x = x_1)
+IMPLEMENTATION
+fun x x_1 =>
+  match x, x_1 with
+  | Theory.VLevel.zero, Theory.VLevel.zero => isTrue ⋯
+  | Theory.VLevel.zero, a.succ => isFalse ⋯
+  | Theory.VLevel.zero, a.max a_1 => isFalse ⋯
+  | Theory.VLevel.zero, a.imax a_1 => isFalse ⋯
+  | Theory.VLevel.zero, Theory.VLevel.param a => isFalse ⋯
+  | a.succ, Theory.VLevel.zero => isFalse ⋯
+  | a.succ, b.succ =>
+    let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a a;
+        isTrue ⋯
+    else isFalse ⋯
+  | a.succ, a_1.max a_2 => isFalse ⋯
+  | a.succ, a_1.imax a_2 => isFalse ⋯
+  | a.succ, Theory.VLevel.param a_1 => isFalse ⋯
+  | a.max a_1, Theory.VLevel.zero => isFalse ⋯
+  | a.max a_1, a_2.succ => isFalse ⋯
+  | a.max a_1, b.max b_1 =>
+    let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a a;
+        let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | a.max a_1, a_2.imax a_3 => isFalse ⋯
+  | a.max a_1, Theory.VLevel.param a_2 => isFalse ⋯
+  | a.imax a_1, Theory.VLevel.zero => isFalse ⋯
+  | a.imax a_1, a_2.succ => isFalse ⋯
+  | a.imax a_1, a_2.max a_3 => isFalse ⋯
+  | a.imax a_1, b.imax b_1 =>
+    let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a a;
+        let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Theory.instDecidableEqVLevel.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | a.imax a_1, Theory.VLevel.param a_2 => isFalse ⋯
+  | Theory.VLevel.param a, Theory.VLevel.zero => isFalse ⋯
+  | Theory.VLevel.param a, a_1.succ => isFalse ⋯
+  | Theory.VLevel.param a, a_1.max a_2 => isFalse ⋯
+  | Theory.VLevel.param a, a_1.imax a_2 => isFalse ⋯
+  | Theory.VLevel.param a, Theory.VLevel.param b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+RECURSION WORKER Ix.Theory.Certificate.Ordinary.arguments?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β →
+              List (Theory.Model.AExpr β) →
+                List (Theory.Model.AExpr β) → Option (List (Theory.Certified.TypingWitness β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries Γ x x_1 =>
+  match x, x_1 with
+  | [], [] => some []
+  | A :: domains, a :: args => do
+    let typed ← Theory.Certificate.inferAnnotated? fuel n entries Γ a
+    let witness ← Theory.Certificate.castWith? fuel n entries Γ typed A
+    let tail ←
+      Theory.Certificate.Ordinary.arguments?._unsafe_rec fuel n entries Γ (Theory.Model.Telescope.inst a domains) args
+    pure (witness :: tail)
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certificate.Ordinary.domains?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β → List (Theory.Model.AExpr β) → Option (List (Theory.Certified.DomainWitness β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries x x_1 =>
+  match x, x_1 with
+  | x, [] => some []
+  | Γ, A :: rest => do
+    let typed ← Theory.Certificate.inferAnnotated? fuel n entries Γ A
+    match typed.type with
+      | Theory.Model.AExpr.sort level => do
+        let tail ← Theory.Certificate.Ordinary.domains?._unsafe_rec fuel n entries (Theory.Model.Context.push A Γ) rest
+        pure ({ level := level, typing := typed.witness } :: tail)
+      | x => none
+RECURSION WORKER Ix.Theory.Certificate.Ordinary.sourceDomains?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Nat →
+          Theory.Model.Environment β →
+            Theory.Model.Context β → List (Theory.VExpr β) → Option (List (Theory.Model.AExpr β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel n entries x x_1 =>
+  match x, x_1 with
+  | x, [] => some []
+  | Γ, A :: rest => do
+    let typed ← Theory.Certificate.inferSource? fuel n entries Γ A
+    match typed.type with
+      | Theory.Model.AExpr.sort level => do
+        let tail ←
+          Theory.Certificate.Ordinary.sourceDomains?._unsafe_rec fuel n entries
+              (Theory.Model.Context.push typed.expression Γ) rest
+        pure (typed.expression :: tail)
+      | x => none
+RECURSION WORKER Ix.Theory.Certificate.Ordinary.telescope._unsafe_rec
+{β : Type u} → Theory.VExpr β → List (Theory.VExpr β) × Theory.VExpr β
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | A.forallE B =>
+    match Theory.Certificate.Ordinary.telescope._unsafe_rec B with
+    | (tail, result) => (A :: tail, result)
+  | e => ([], e)
+RECURSION WORKER Ix.Theory.Certificate.Quotient.typeWitnesses?._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    [Theory.Certificate.Hints β] →
+      Nat →
+        Theory.Model.Environment β →
+          List (Theory.Certified.Signature.Header β) → Option (List (Theory.Certified.Signature.TypeWitness β))
+IMPLEMENTATION
+fun {β} [DecidableEq β] [Theory.Certificate.Hints β] fuel entries x =>
+  match x with
+  | [] => some []
+  | header :: headers => do
+    let inferred ← Theory.Certificate.inferAnnotated? fuel header.universes entries [] header.type
+    match inferred.type with
+      | Theory.Model.AExpr.sort level => do
+        let rest ←
+          Theory.Certificate.Quotient.typeWitnesses?._unsafe_rec fuel (entries.insert header.ref header.entry) headers
+        pure ({ level := level, typing := inferred.witness } :: rest)
+      | x => none
+RECURSION WORKER Ix.Theory.Certified.IndexSet.insert._unsafe_rec
+Nat → List Nat → List Nat
+IMPLEMENTATION
+fun x x_1 =>
+  match x_1 with
+  | [] => [x]
+  | y :: ys =>
+    if x < y then x :: y :: ys else if x = y then y :: ys else y :: Theory.Certified.IndexSet.insert._unsafe_rec x ys
+RECURSION WORKER Ix.Theory.Certified.IndexSet.normalize._unsafe_rec
+List Nat → List Nat
+IMPLEMENTATION
+fun x =>
+  match x with
+  | [] => []
+  | x :: xs => Theory.Certified.IndexSet.insert x (Theory.Certified.IndexSet.normalize._unsafe_rec xs)
+RECURSION WORKER Ix.Theory.Certified.LevelEq.leq._unsafe_rec
+Theory.VLevel → Theory.VLevel → Bool
+IMPLEMENTATION
+fun a b =>
+  if a = b then true
+  else
+    match a, b with
+    | Theory.VLevel.zero, x => true
+    | a.max b, c => Theory.Certified.LevelEq.leq._unsafe_rec a c && Theory.Certified.LevelEq.leq._unsafe_rec b c
+    | a, b.max c => Theory.Certified.LevelEq.leq._unsafe_rec a b || Theory.Certified.LevelEq.leq._unsafe_rec a c
+    | a.succ, b.succ => Theory.Certified.LevelEq.leq._unsafe_rec a b
+    | a, b.succ => Theory.Certified.LevelEq.leq._unsafe_rec a b
+    | a.imax b, c => Theory.Certified.LevelEq.leq._unsafe_rec a c && Theory.Certified.LevelEq.leq._unsafe_rec b c
+    | x, x_1 => false
+RECURSION WORKER Ix.Theory.Certified.LevelEq.normalize._unsafe_rec
+Theory.VLevel → Theory.VLevel
+IMPLEMENTATION
+fun x =>
+  match x with
+  | Theory.VLevel.zero => Theory.VLevel.zero
+  | Theory.VLevel.param i => Theory.VLevel.param i
+  | a.succ => (Theory.Certified.LevelEq.normalize._unsafe_rec a).succ
+  | a.max b =>
+    Theory.Certified.LevelEq.max (Theory.Certified.LevelEq.normalize._unsafe_rec a)
+      (Theory.Certified.LevelEq.normalize._unsafe_rec b)
+  | a.imax b =>
+    Theory.Certified.LevelEq.imax (Theory.Certified.LevelEq.normalize._unsafe_rec a)
+      (Theory.Certified.LevelEq.normalize._unsafe_rec b)
+RECURSION WORKER Ix.Theory.Certified.Modeled.applyPi?._unsafe_rec
+{β : Type u} → Theory.VExpr β → List (Theory.VExpr β) → Option (Theory.VExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | type, [] => some type
+  | binderType.forallE body, argument :: rest => Theory.Certified.Modeled.applyPi?._unsafe_rec (body.inst argument) rest
+  | x, head :: tail => none
+RECURSION WORKER Ix.Theory.Certified.Modeled.betaHead?._unsafe_rec
+{β : Type u} → Nat → Theory.VExpr β → Option (Theory.VExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, x => none
+  | fuel.succ, function.app argument => do
+    let function ← Theory.Certified.Modeled.betaHead?._unsafe_rec fuel function
+    match function with
+      | binderType.lam body => Theory.Certified.Modeled.betaHead?._unsafe_rec fuel (body.inst argument)
+      | x => some (function.app argument)
+  | n.succ, expression => some expression
+RECURSION WORKER Ix.Theory.Certified.Modeled.checkEach?._unsafe_rec
+{β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (companions pending : List (Theory.Certified.Modeled.Companion β)) →
+          List (List (Theory.Certified.Modeled.EquationWitness β)) →
+            Option
+              (Theory.Certified.CheckedClaim
+                (∀ (companion : Theory.Certified.Modeled.Companion β),
+                  companion ∈ pending → Theory.Certified.Modeled.CompanionChecked entries companions companion))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries companions x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | companion :: rest, witnesses :: remaining => do
+    let first ← Theory.Certified.Modeled.checkCompanion? fuel entries companions companion witnesses
+    let others ← Theory.Certified.Modeled.checkEach?._unsafe_rec fuel entries companions rest remaining
+    pure { down := ⋯ }
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certified.Modeled.checkRules?._unsafe_rec
+{β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (companions : List (Theory.Certified.Modeled.Companion β)) →
+          (rules : List (Theory.Certified.Signature.Rule β)) →
+            List (Theory.Certified.Modeled.EquationWitness β) →
+              Option
+                (Theory.Certified.CheckedClaim
+                  (∀ (rule : Theory.Certified.Signature.Rule β),
+                    rule ∈ rules →
+                      Theory.Certified.Modeled.CheckedEquation entries
+                        (Theory.Certified.Modeled.mapRule companions rule)))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries companions x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | rule :: rules, witness :: witnesses => do
+    let first ←
+      Theory.Certified.Modeled.checkEquation? fuel entries (Theory.Certified.Modeled.mapRule companions rule) witness
+    let rest ← Theory.Certified.Modeled.checkRules?._unsafe_rec fuel entries companions rules witnesses
+    pure { down := ⋯ }
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certified.Modeled.lookupCompanion._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    List (Theory.Certified.Modeled.Companion β) → Theory.ConstRef β → Option (Theory.Certified.Modeled.Companion β)
+IMPLEMENTATION
+fun {β} [DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | [], x => none
+  | companion :: rest, ref =>
+    if companion.header.ref = ref then some companion else Theory.Certified.Modeled.lookupCompanion._unsafe_rec rest ref
+RECURSION WORKER Ix.Theory.Certified.Modeled.splitLam?._unsafe_rec
+{β : Type u} → Nat → Theory.VExpr β → Option (List (Theory.VExpr β) × Theory.VExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, expression => some ([], expression)
+  | n.succ, domain.lam body => do
+    let __x ← Theory.Certified.Modeled.splitLam?._unsafe_rec n body
+    match __x with
+      | (domains, result) => pure (domain :: domains, result)
+  | n.succ, x => none
+RECURSION WORKER Ix.Theory.Certified.Modeled.splitPi?._unsafe_rec
+{β : Type u} → Nat → Theory.VExpr β → Option (List (Theory.VExpr β) × Theory.VExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, type => some ([], type)
+  | n.succ, domain.forallE body => do
+    let __x ← Theory.Certified.Modeled.splitPi?._unsafe_rec n body
+    match __x with
+      | (domains, result) => pure (domain :: domains, result)
+  | n.succ, x => none
+RECURSION WORKER Ix.Theory.Certified.Ordinary.checkConstructors._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (shape : Theory.Certified.Ordinary.Shape β) →
+          (ctors : List (Theory.Certified.Ordinary.Constructor β)) →
+            List (Theory.Certified.Ordinary.ConstructorWitness β) →
+              Option
+                (Theory.Certified.CheckedClaim
+                  (∀ (ctor : Theory.Certified.Ordinary.Constructor β),
+                    ctor ∈ ctors → Theory.Certified.Ordinary.ConstructorEvidence entries shape ctor))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries shape x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | ctor :: ctors, witness :: witnesses =>
+    if hrefs :
+        ∀ (e : Theory.Model.AExpr β), e ∈ ctor.fields ++ ctor.indices → Theory.Model.AExpr.ReferencesIn entries e then
+      do
+      let fields ←
+        Theory.Certified.verifyTelescope fuel shape.universes entries (some shape.level) shape.parameterContext
+            ctor.fields witness.fields
+      let indices ←
+        Theory.Certified.verifyArguments fuel shape.universes entries (ctor.context shape)
+            (Theory.Model.Telescope.lift ctor.fields.length shape.indices) ctor.indices witness.indices
+      let recursive ← Theory.Certified.Ordinary.checkRecursive fuel entries shape ctor ctor.recursive witness.recursive
+      let rest ← Theory.Certified.Ordinary.checkConstructors._unsafe_rec fuel entries shape ctors witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certified.Ordinary.checkRecursive._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (shape : Theory.Certified.Ordinary.Shape β) →
+          (ctor : Theory.Certified.Ordinary.Constructor β) →
+            (fields : List (Theory.Certified.Ordinary.RecursiveField β)) →
+              List (Theory.Certified.Ordinary.RecursiveWitness β) →
+                Option
+                  (Theory.Certified.CheckedClaim
+                    (∀ (field : Theory.Certified.Ordinary.RecursiveField β),
+                      field ∈ fields → Theory.Certified.Ordinary.RecursiveEvidence entries shape ctor field))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries shape ctor x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | field :: fields, witness :: witnesses =>
+    if hrefs :
+        ∀ (e : Theory.Model.AExpr β),
+          e ∈ field.domains ++ field.indices → Theory.Model.AExpr.ReferencesIn entries e then
+      do
+      let domains ←
+        Theory.Certified.verifyTelescope fuel shape.universes entries (some shape.level) (ctor.context shape)
+            field.domains witness.domains
+      let indices ←
+        Theory.Certified.verifyArguments fuel shape.universes entries
+            (Theory.Model.Telescope.context (ctor.context shape) field.domains)
+            (Theory.Model.Telescope.lift (ctor.fields.length + field.domains.length) shape.indices) field.indices
+            witness.indices
+      let rest ← Theory.Certified.Ordinary.checkRecursive._unsafe_rec fuel entries shape ctor fields witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certified.Ordinary.parameterVars._unsafe_rec
+{β : Type u} → Nat → Nat → List (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} offset x =>
+  match x with
+  | 0 => []
+  | n.succ => Theory.Model.AExpr.bvar (offset + n) :: Theory.Certified.Ordinary.parameterVars._unsafe_rec offset n
+RECURSION WORKER Ix.Theory.Certified.PropWhen.bindList._unsafe_rec
+(Nat → Theory.Certified.PropWhen) → List Nat → Theory.Certified.PropWhen
+IMPLEMENTATION
+fun f x =>
+  match x with
+  | [] => Theory.Certified.PropWhen.always
+  | i :: ps => (f i).inter (Theory.Certified.PropWhen.bindList._unsafe_rec f ps)
+RECURSION WORKER Ix.Theory.Certified.Signature.checkTypes._unsafe_rec
+{β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (headers : List (Theory.Certified.Signature.Header β)) →
+          List (Theory.Certified.Signature.TypeWitness β) →
+            Option (Theory.Certified.CheckedClaim (Theory.Certified.Signature.Formed entries headers))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | header :: headers, witness :: witnesses =>
+    if hf : entries header.ref = none then
+      if hs : Theory.Model.AExpr.Scope header.universes 0 header.type then
+        if hr : Theory.Model.AExpr.ReferencesIn entries header.type then do
+          let ht ←
+            Theory.Certified.verifyType fuel header.universes entries [] header.type
+                (Theory.Model.AExpr.sort witness.level) witness.typing
+          let rest ←
+            Theory.Certified.Signature.checkTypes._unsafe_rec fuel (entries.insert header.ref header.entry) headers
+                witnesses
+          pure { down := ⋯ }
+        else none
+      else none
+    else none
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certified.Signature.environment._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] → Theory.Model.Environment β → List (Theory.Certified.Signature.Header β) → Theory.Model.Environment β
+IMPLEMENTATION
+fun {β} [DecidableEq β] entries x =>
+  match x with
+  | [] => entries
+  | header :: rest => Theory.Certified.Signature.environment._unsafe_rec (entries.insert header.ref header.entry) rest
+RECURSION WORKER Ix.Theory.Certified.Structure.checkFields._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Theory.Model.Environment β) →
+          (w : Theory.VLevel) →
+            (Γ : Theory.Model.Context β) →
+              (fields : List (Theory.Certified.Structure.Field β)) →
+                List (Theory.Certified.TypingWitness β) →
+                  Option (Theory.Certified.CheckedClaim (Theory.Certified.Structure.FieldsFormed entries w Γ fields))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel n entries w x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | x, [], [] => some { down := ⋯ }
+  | Γ, field :: fields, witness :: witnesses =>
+    if hz : Theory.Certified.checkZeroImplies w field.level = true then do
+      let hA ← Theory.Certified.verifyType fuel n entries Γ field.domain (Theory.Model.AExpr.sort field.level) witness
+      let rest ←
+        Theory.Certified.Structure.checkFields._unsafe_rec fuel n entries w (Theory.Model.Context.push field.domain Γ)
+            fields witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_3, x_4 => none
+RECURSION WORKER Ix.Theory.Certified.Structure.checkIota._unsafe_rec
+{β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (d : Theory.Certified.Structure.Description β) →
+          (source recursor : β) →
+            (mode : Theory.Inductive.ElimMode) →
+              (fields : List (Theory.Certified.Structure.Field β × Nat)) →
+                List (Theory.Certified.Signature.RuleWitness β) →
+                  Option
+                    (Theory.Certified.CheckedClaim
+                      (∀ (field : Theory.Certified.Structure.Field β) (i : Nat),
+                        (field, i) ∈ fields →
+                          Theory.Certified.Signature.RuleFormed (d.iotaEnvironment entries source recursor mode i)
+                            (d.iotaRule source i field)))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries d source recursor mode x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | (field, i) :: fields, witness :: witnesses => do
+    let ht ←
+      Theory.Certified.Signature.checkRule fuel (d.iotaEnvironment entries source recursor mode i)
+          (d.iotaRule source i field) witness
+    let rest ← Theory.Certified.Structure.checkIota._unsafe_rec fuel entries d source recursor mode fields witnesses
+    pure { down := ⋯ }
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Model.AExpr.Scope._unsafe_rec
+{β : Type u_1} → Nat → Nat → Theory.Model.AExpr β → Prop
+IMPLEMENTATION
+fun {β} universes depth x =>
+  match x with
+  | Theory.Model.AExpr.bvar i => i < depth
+  | Theory.Model.AExpr.sort l => Theory.VLevel.WF universes l
+  | Theory.Model.AExpr.const ref ls => ∀ (l : Theory.VLevel), l ∈ ls → Theory.VLevel.WF universes l
+  | f.app a =>
+    Theory.Model.AExpr.Scope._unsafe_rec universes depth f ∧ Theory.Model.AExpr.Scope._unsafe_rec universes depth a
+  | Theory.Model.AExpr.lam p a b =>
+    Theory.Certified.PropWhen.WF universes p ∧
+      Theory.Model.AExpr.Scope._unsafe_rec universes depth a ∧
+        Theory.Model.AExpr.Scope._unsafe_rec universes (depth + 1) b
+  | Theory.Model.AExpr.forallE p a b =>
+    Theory.Certified.PropWhen.WF universes p ∧
+      Theory.Model.AExpr.Scope._unsafe_rec universes depth a ∧
+        Theory.Model.AExpr.Scope._unsafe_rec universes (depth + 1) b
+  | Theory.Model.AExpr.proj ref field e => Theory.Model.AExpr.Scope._unsafe_rec universes depth e
+  | Theory.Model.AExpr.natLit value => True
+RECURSION WORKER Ix.Theory.Model.AExpr.appN._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → List (Theory.Model.AExpr β) → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} f x =>
+  match x with
+  | [] => f
+  | x :: xs => Theory.Model.AExpr.appN._unsafe_rec (f.app x) xs
+RECURSION WORKER Ix.Theory.Model.AExpr.decidableScope._unsafe_rec
+{β : Type u_1} → {n k : Nat} → {e : Theory.Model.AExpr β} → Decidable (Theory.Model.AExpr.Scope n k e)
+IMPLEMENTATION
+fun {β} {n k} x =>
+  match x with
+  | Theory.Model.AExpr.bvar i => Theory.Model.AExpr.decidableScope._aux_1 i
+  | Theory.Model.AExpr.sort l => Theory.VLevel.decidable_WF
+  | Theory.Model.AExpr.const ref ls => Theory.Model.AExpr.decidableScope._aux_3 ref ls
+  | f.app a => instDecidableAnd
+  | Theory.Model.AExpr.lam p A b => instDecidableAnd
+  | Theory.Model.AExpr.forallE p A b => instDecidableAnd
+  | Theory.Model.AExpr.proj ref field e => Theory.Model.AExpr.decidableScope._unsafe_rec
+  | Theory.Model.AExpr.natLit value => instDecidableTrue
+RECURSION WORKER Ix.Theory.Model.AExpr.erase._unsafe_rec
+{β : Type u_1} → Theory.Model.AExpr β → Theory.VExpr β
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.Model.AExpr.bvar i => Theory.VExpr.bvar i
+  | Theory.Model.AExpr.sort l => Theory.VExpr.sort l
+  | Theory.Model.AExpr.const r ls => Theory.VExpr.const r ls
+  | f.app a => (Theory.Model.AExpr.erase._unsafe_rec f).app (Theory.Model.AExpr.erase._unsafe_rec a)
+  | Theory.Model.AExpr.lam condition a b =>
+    (Theory.Model.AExpr.erase._unsafe_rec a).lam (Theory.Model.AExpr.erase._unsafe_rec b)
+  | Theory.Model.AExpr.forallE condition a b =>
+    (Theory.Model.AExpr.erase._unsafe_rec a).forallE (Theory.Model.AExpr.erase._unsafe_rec b)
+  | Theory.Model.AExpr.proj r i e => Theory.VExpr.proj r i (Theory.Model.AExpr.erase._unsafe_rec e)
+  | Theory.Model.AExpr.natLit v => Theory.VExpr.natLit v
+RECURSION WORKER Ix.Theory.Model.AExpr.forallN._unsafe_rec
+{β : Type u} → Theory.Certified.PropWhen → List (Theory.Model.AExpr β) → Theory.Model.AExpr β → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} p x x_1 =>
+  match x, x_1 with
+  | [], B => B
+  | A :: rest, B => Theory.Model.AExpr.forallE p A (Theory.Model.AExpr.forallN._unsafe_rec p rest B)
+RECURSION WORKER Ix.Theory.Model.AExpr.inst._unsafe_rec
+{β : Type u_1} → Theory.Model.AExpr β → Theory.Model.AExpr β → optParam Nat 0 → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Theory.Model.AExpr.bvar i, a, k => Theory.Model.AExpr.instVar i a k
+  | Theory.Model.AExpr.sort l, x, x_3 => Theory.Model.AExpr.sort l
+  | Theory.Model.AExpr.const r ls, x, x_3 => Theory.Model.AExpr.const r ls
+  | f.app a, e, k => (Theory.Model.AExpr.inst._unsafe_rec f e k).app (Theory.Model.AExpr.inst._unsafe_rec a e k)
+  | Theory.Model.AExpr.lam p a b, e, k =>
+    Theory.Model.AExpr.lam p (Theory.Model.AExpr.inst._unsafe_rec a e k)
+      (Theory.Model.AExpr.inst._unsafe_rec b e (k + 1))
+  | Theory.Model.AExpr.forallE p a b, e, k =>
+    Theory.Model.AExpr.forallE p (Theory.Model.AExpr.inst._unsafe_rec a e k)
+      (Theory.Model.AExpr.inst._unsafe_rec b e (k + 1))
+  | Theory.Model.AExpr.proj r i e, a, k => Theory.Model.AExpr.proj r i (Theory.Model.AExpr.inst._unsafe_rec e a k)
+  | Theory.Model.AExpr.natLit v, x, x_3 => Theory.Model.AExpr.natLit v
+RECURSION WORKER Ix.Theory.Model.AExpr.instL._unsafe_rec
+{β : Type u_1} → List Theory.VLevel → Theory.Model.AExpr β → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} levels x =>
+  match x with
+  | Theory.Model.AExpr.bvar i => Theory.Model.AExpr.bvar i
+  | Theory.Model.AExpr.sort l => Theory.Model.AExpr.sort (Theory.VLevel.inst levels l)
+  | Theory.Model.AExpr.const r ls => Theory.Model.AExpr.const r (List.map (Theory.VLevel.inst levels) ls)
+  | f.app a => (Theory.Model.AExpr.instL._unsafe_rec levels f).app (Theory.Model.AExpr.instL._unsafe_rec levels a)
+  | Theory.Model.AExpr.lam p a b =>
+    Theory.Model.AExpr.lam (Theory.Certified.instCondition levels p) (Theory.Model.AExpr.instL._unsafe_rec levels a)
+      (Theory.Model.AExpr.instL._unsafe_rec levels b)
+  | Theory.Model.AExpr.forallE p a b =>
+    Theory.Model.AExpr.forallE (Theory.Certified.instCondition levels p) (Theory.Model.AExpr.instL._unsafe_rec levels a)
+      (Theory.Model.AExpr.instL._unsafe_rec levels b)
+  | Theory.Model.AExpr.proj r i e => Theory.Model.AExpr.proj r i (Theory.Model.AExpr.instL._unsafe_rec levels e)
+  | Theory.Model.AExpr.natLit v => Theory.Model.AExpr.natLit v
+RECURSION WORKER Ix.Theory.Model.AExpr.instRev._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → List (Theory.Model.AExpr β) → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | e, [] => e
+  | e, a :: rest => Theory.Model.AExpr.instRev._unsafe_rec (e.inst a rest.length) rest
+RECURSION WORKER Ix.Theory.Model.AExpr.lamN._unsafe_rec
+{β : Type u} → Theory.Certified.PropWhen → List (Theory.Model.AExpr β) → Theory.Model.AExpr β → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} p x x_1 =>
+  match x, x_1 with
+  | [], body => body
+  | A :: rest, body => Theory.Model.AExpr.lam p A (Theory.Model.AExpr.lamN._unsafe_rec p rest body)
+RECURSION WORKER Ix.Theory.Model.AExpr.liftN._unsafe_rec
+{β : Type u_1} → Nat → Theory.Model.AExpr β → optParam Nat 0 → Theory.Model.AExpr β
+IMPLEMENTATION
+fun {β} count x x_1 =>
+  match x, x_1 with
+  | Theory.Model.AExpr.bvar i, k => Theory.Model.AExpr.bvar (Theory.liftVar count i k)
+  | Theory.Model.AExpr.sort l, x => Theory.Model.AExpr.sort l
+  | Theory.Model.AExpr.const r ls, x => Theory.Model.AExpr.const r ls
+  | f.app a, k => (Theory.Model.AExpr.liftN._unsafe_rec count f k).app (Theory.Model.AExpr.liftN._unsafe_rec count a k)
+  | Theory.Model.AExpr.lam p a b, k =>
+    Theory.Model.AExpr.lam p (Theory.Model.AExpr.liftN._unsafe_rec count a k)
+      (Theory.Model.AExpr.liftN._unsafe_rec count b (k + 1))
+  | Theory.Model.AExpr.forallE p a b, k =>
+    Theory.Model.AExpr.forallE p (Theory.Model.AExpr.liftN._unsafe_rec count a k)
+      (Theory.Model.AExpr.liftN._unsafe_rec count b (k + 1))
+  | Theory.Model.AExpr.proj r i e, k => Theory.Model.AExpr.proj r i (Theory.Model.AExpr.liftN._unsafe_rec count e k)
+  | Theory.Model.AExpr.natLit v, x => Theory.Model.AExpr.natLit v
+RECURSION WORKER Ix.Theory.Model.AExpr.mapRefs._unsafe_rec
+{β : Type u} → {γ : Type v} → (Theory.ConstRef β → Theory.ConstRef γ) → Theory.Model.AExpr β → Theory.Model.AExpr γ
+IMPLEMENTATION
+fun {β} {γ} mapping x =>
+  match x with
+  | Theory.Model.AExpr.bvar i => Theory.Model.AExpr.bvar i
+  | Theory.Model.AExpr.sort level => Theory.Model.AExpr.sort level
+  | Theory.Model.AExpr.const ref levels => Theory.Model.AExpr.const (mapping ref) levels
+  | f.app a => (Theory.Model.AExpr.mapRefs._unsafe_rec mapping f).app (Theory.Model.AExpr.mapRefs._unsafe_rec mapping a)
+  | Theory.Model.AExpr.lam condition type body =>
+    Theory.Model.AExpr.lam condition (Theory.Model.AExpr.mapRefs._unsafe_rec mapping type)
+      (Theory.Model.AExpr.mapRefs._unsafe_rec mapping body)
+  | Theory.Model.AExpr.forallE condition type body =>
+    Theory.Model.AExpr.forallE condition (Theory.Model.AExpr.mapRefs._unsafe_rec mapping type)
+      (Theory.Model.AExpr.mapRefs._unsafe_rec mapping body)
+  | Theory.Model.AExpr.proj ref index major =>
+    Theory.Model.AExpr.proj (mapping ref) index (Theory.Model.AExpr.mapRefs._unsafe_rec mapping major)
+  | Theory.Model.AExpr.natLit n => Theory.Model.AExpr.natLit n
+RECURSION WORKER Ix.Theory.Model.AExpr.references._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → List (Theory.ConstRef β)
+IMPLEMENTATION
+fun {β} x =>
+  match x with
+  | Theory.Model.AExpr.bvar index => []
+  | Theory.Model.AExpr.sort level => []
+  | Theory.Model.AExpr.natLit value => []
+  | Theory.Model.AExpr.const r levels => [r]
+  | f.app a => Theory.Model.AExpr.references._unsafe_rec f ++ Theory.Model.AExpr.references._unsafe_rec a
+  | Theory.Model.AExpr.lam condition f a =>
+    Theory.Model.AExpr.references._unsafe_rec f ++ Theory.Model.AExpr.references._unsafe_rec a
+  | Theory.Model.AExpr.forallE condition f a =>
+    Theory.Model.AExpr.references._unsafe_rec f ++ Theory.Model.AExpr.references._unsafe_rec a
+  | Theory.Model.AExpr.proj r field e => r :: Theory.Model.AExpr.references._unsafe_rec e
+RECURSION WORKER Ix.Theory.Model.Telescope.context._unsafe_rec
+{β : Type u} → Theory.Model.Context β → List (Theory.Model.AExpr β) → Theory.Model.Context β
+IMPLEMENTATION
+fun {β} Γ x =>
+  match x with
+  | [] => Γ
+  | A :: rest => Theory.Model.Telescope.context._unsafe_rec (Theory.Model.Context.push A Γ) rest
+RECURSION WORKER Ix.Theory.Model.Telescope.extend._unsafe_rec
+{V : Type v} → (Nat → V) → List V → Nat → V
+IMPLEMENTATION
+fun {V} env x =>
+  match (motive := List V → Nat → V) x with
+  | [] => env
+  | x :: xs => Theory.Model.Telescope.extend._unsafe_rec (Theory.Model.Valuation.cons x env) xs
+RECURSION WORKER Ix.Theory.Model.Telescope.independent._unsafe_rec
+{β : Type u} → List (Theory.Model.AExpr β) → optParam Nat 0 → List (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: rest, offset =>
+    Theory.Model.AExpr.liftN offset A :: Theory.Model.Telescope.independent._unsafe_rec rest (offset + 1)
+RECURSION WORKER Ix.Theory.Model.Telescope.inst._unsafe_rec
+{β : Type u} → Theory.Model.AExpr β → List (Theory.Model.AExpr β) → optParam Nat 0 → List (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} arg x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: rest, k => A.inst arg k :: Theory.Model.Telescope.inst._unsafe_rec arg rest (k + 1)
+RECURSION WORKER Ix.Theory.Model.Telescope.lift._unsafe_rec
+{β : Type u} → Nat → List (Theory.Model.AExpr β) → optParam Nat 0 → List (Theory.Model.AExpr β)
+IMPLEMENTATION
+fun {β} count x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: rest, k => Theory.Model.AExpr.liftN count A k :: Theory.Model.Telescope.lift._unsafe_rec count rest (k + 1)
+RECURSION WORKER Ix.Theory.Model.Telescope.simple._unsafe_rec
+{V : Type v} → (domains : List V) → Theory.Model.SetTheory.Tower.TeleS V domains.length
+IMPLEMENTATION
+fun {V} x =>
+  match x with
+  | [] => Theory.Model.SetTheory.Tower.TeleS.nil
+  | A :: rest => Theory.Model.SetTheory.Tower.TeleS.cons A fun x => Theory.Model.Telescope.simple._unsafe_rec rest
+RECURSION WORKER Ix.Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec
+{β : Type u_1} → [DecidableEq β] → (x x_1 : Theory.Model.AExpr β) → Decidable (x = x_1)
+IMPLEMENTATION
+fun {β} [inst : DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | Theory.Model.AExpr.bvar a, Theory.Model.AExpr.bvar b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | Theory.Model.AExpr.bvar index, Theory.Model.AExpr.sort level => isFalse ⋯
+  | Theory.Model.AExpr.bvar index, Theory.Model.AExpr.const ref levels => isFalse ⋯
+  | Theory.Model.AExpr.bvar index, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.bvar index, Theory.Model.AExpr.lam condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.bvar index, Theory.Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.bvar index, Theory.Model.AExpr.proj ref field major => isFalse ⋯
+  | Theory.Model.AExpr.bvar index, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | Theory.Model.AExpr.sort level, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | Theory.Model.AExpr.sort a, Theory.Model.AExpr.sort b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | Theory.Model.AExpr.sort level, Theory.Model.AExpr.const ref levels => isFalse ⋯
+  | Theory.Model.AExpr.sort level, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.sort level, Theory.Model.AExpr.lam condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.sort level, Theory.Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.sort level, Theory.Model.AExpr.proj ref field major => isFalse ⋯
+  | Theory.Model.AExpr.sort level, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, Theory.Model.AExpr.sort level => isFalse ⋯
+  | Theory.Model.AExpr.const a a_1, Theory.Model.AExpr.const b b_1 =>
+    if h : a = b then h ▸ if h : a_1 = b_1 then h ▸ isTrue ⋯ else isFalse ⋯ else isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, Theory.Model.AExpr.lam condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, Theory.Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, Theory.Model.AExpr.proj ref_1 field major => isFalse ⋯
+  | Theory.Model.AExpr.const ref levels, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.sort level => isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.const ref levels => isFalse ⋯
+  | a.app a_1, b.app b_1 =>
+    let inst_1 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a a;
+        let inst_3 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.lam condition domain body => isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.forallE condition domain body => isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.proj ref field major => isFalse ⋯
+  | fn.app arg, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.sort level => isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.const ref levels => isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.lam a a_1 a_2, Theory.Model.AExpr.lam b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        let inst_1 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_2 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 a_1;
+            let inst_3 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.forallE condition_1 domain_1 body_1 => isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.proj ref field major => isFalse ⋯
+  | Theory.Model.AExpr.lam condition domain body, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.sort level => isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.const ref levels => isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.lam condition_1 domain_1 body_1 => isFalse ⋯
+  | Theory.Model.AExpr.forallE a a_1 a_2, Theory.Model.AExpr.forallE b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        let inst_1 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_2 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 a_1;
+            let inst_3 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.proj ref field major => isFalse ⋯
+  | Theory.Model.AExpr.forallE condition domain body, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, Theory.Model.AExpr.sort level => isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, Theory.Model.AExpr.const ref_1 levels => isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, Theory.Model.AExpr.lam condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, Theory.Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.proj a a_1 a_2, Theory.Model.AExpr.proj b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_1 := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Theory.Model.AExpr.proj ref field major, Theory.Model.AExpr.natLit value => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, Theory.Model.AExpr.bvar index => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, Theory.Model.AExpr.sort level => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, Theory.Model.AExpr.const ref levels => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, fn.app arg => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, Theory.Model.AExpr.lam condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, Theory.Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Theory.Model.AExpr.natLit value, Theory.Model.AExpr.proj ref field major => isFalse ⋯
+  | Theory.Model.AExpr.natLit a, Theory.Model.AExpr.natLit b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+RECURSION WORKER Ix.Theory.Certified.Ordinary.Shape.checkConstructorTypes._unsafe_rec
+{β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (shape : Theory.Certified.Ordinary.Shape β) →
+          (source : β) →
+            (ctors : List (Theory.Certified.Ordinary.Constructor β)) →
+              List (Theory.Certified.Ordinary.Shape.TypeWitness β) →
+                Option
+                  (Theory.Certified.CheckedClaim
+                    (∀ (ctor : Theory.Certified.Ordinary.Constructor β),
+                      ctor ∈ ctors →
+                        Theory.Model.EntryClosed (shape.familyEnvironment entries source)
+                            (shape.constructorEntry source ctor) ∧
+                          ∃ l,
+                            Theory.Model.TypingClaim (shape.familyEnvironment entries source) []
+                              (ctor.type shape source) (Theory.Model.AExpr.sort l)))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries shape source x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | ctor :: ctors, witness :: witnesses =>
+    if hs : Theory.Model.AExpr.Scope shape.universes 0 (ctor.type shape source) then
+      if hr : Theory.Model.AExpr.ReferencesIn (shape.familyEnvironment entries source) (ctor.type shape source) then do
+        let ht ←
+          Theory.Certified.verifyType fuel shape.universes (shape.familyEnvironment entries source) []
+              (ctor.type shape source) (Theory.Model.AExpr.sort witness.level) witness.witness
+        let rest ←
+          Theory.Certified.Ordinary.Shape.checkConstructorTypes._unsafe_rec fuel entries shape source ctors witnesses
+        pure { down := ⋯ }
+      else none
+    else none
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Certified.Ordinary.Shape.checkRules._unsafe_rec
+{β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Theory.Model.Environment β) →
+        (shape : Theory.Certified.Ordinary.Shape β) →
+          (source recursor : β) →
+            (mode : Theory.Inductive.ElimMode) →
+              (ctors : List (Theory.Certified.Ordinary.Constructor β × Nat)) →
+                List (Theory.Certified.Ordinary.RuleWitness β) →
+                  Option
+                    (Theory.Certified.CheckedClaim
+                      (∀ (ctor : Theory.Certified.Ordinary.Constructor β) (i : Nat),
+                        (ctor, i) ∈ ctors →
+                          Theory.Certified.Ordinary.Shape.RuleFormation entries shape source recursor mode i ctor))
+IMPLEMENTATION
+fun {β} [DecidableEq β] fuel entries shape source recursor mode x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | (ctor, i) :: ctors, witness :: witnesses => do
+    let rule ← Theory.Certified.Ordinary.Shape.checkRule fuel entries shape source recursor mode i ctor witness
+    let rest ←
+      Theory.Certified.Ordinary.Shape.checkRules._unsafe_rec fuel entries shape source recursor mode ctors witnesses
+    pure { down := ⋯ }
+  | x, x_2 => none
+RECURSION WORKER Ix.Theory.Model.SetTheory.Tower.BoundS._unsafe_rec
+{V : Type u} → [Theory.Model.SetTheory V] → Nat → {n : Nat} → Theory.Model.SetTheory.Tower.TeleS V n → Prop
+IMPLEMENTATION
+fun {V} [Theory.Model.SetTheory V] w x x_1 =>
+  match x, x_1 with
+  | .(0), Theory.Model.SetTheory.Tower.TeleS.nil => True
+  | .(n + 1), Theory.Model.SetTheory.Tower.TeleS.cons A B =>
+    Theory.Model.SetTheory.Mem A (Theory.Model.SetTheory.univ w) ∧
+      ∀ (a : V), Theory.Model.SetTheory.Mem a A → Theory.Model.SetTheory.Tower.BoundS._unsafe_rec w (B a)
+RECURSION WORKER Ix.Theory.Model.SetTheory.Tower.FitsS._unsafe_rec
+{V : Type u} → [Theory.Model.SetTheory V] → {n : Nat} → Theory.Model.SetTheory.Tower.TeleS V n → List V → Prop
+IMPLEMENTATION
+fun {V} [Theory.Model.SetTheory V] x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | .(0), Theory.Model.SetTheory.Tower.TeleS.nil, [] => True
+  | .(0), Theory.Model.SetTheory.Tower.TeleS.nil, head :: tail => False
+  | .(n + 1), Theory.Model.SetTheory.Tower.TeleS.cons A B, [] => False
+  | .(n + 1), Theory.Model.SetTheory.Tower.TeleS.cons A B, a :: as =>
+    Theory.Model.SetTheory.Mem a A ∧ Theory.Model.SetTheory.Tower.FitsS._unsafe_rec (B a) as
+RECURSION WORKER Ix.Theory.Model.SetTheory.Tower.PropS._unsafe_rec
+{V : Type u} → [Theory.Model.SetTheory V] → {n : Nat} → Theory.Model.SetTheory.Tower.TeleS V n → Prop
+IMPLEMENTATION
+fun {V} [Theory.Model.SetTheory V] x x_1 =>
+  match x, x_1 with
+  | .(0), Theory.Model.SetTheory.Tower.TeleS.nil => True
+  | .(n + 1), Theory.Model.SetTheory.Tower.TeleS.cons A B =>
+    Theory.Model.SetTheory.Mem A Theory.Model.SetTheory.univZero ∧
+      ∀ (a : V), Theory.Model.SetTheory.Mem a A → Theory.Model.SetTheory.Tower.PropS._unsafe_rec (B a)
+Certified host adapters ROOTS 86; LOGICAL DECLARATIONS 9682; WITH RUNTIME 10957
+RUNTIME EXTERNS [Blake3.Rust.hasherFinalize,
+ Blake3.Rust.hasherInit,
+ Blake3.Rust.hasherInitDeriveKey,
+ Blake3.Rust.hasherInitKeyed,
+ Blake3.Rust.hasherUpdate]
+RECURSION WORKERS 130
+All inventoried recursion workers have safe logical sources; no partial opaque source or executable replacement is permitted. Runtime diagnostics cover Ix and Blake3 modules, including private constants. Lean/Std execution and the BLAKE3 foreign interface remain external runtime boundaries.
+These host-adapter roots establish semantic claims under the enforced profile and explicit model premises. They do not establish full production-checker refinement or Aiur compiler/AIR soundness.
diff --git a/Tests/Compiler/CatalogContact.lean b/Tests/Compiler/CatalogContact.lean
new file mode 100644
index 000000000..6b00d4ca0
--- /dev/null
+++ b/Tests/Compiler/CatalogContact.lean
@@ -0,0 +1,33 @@
+import Ix.Compiler
+
+/-!
+Executable corpus-contact harness.  It loads one exact ix `.ixc` directory
+through the bounded filesystem adapter, runs the complete deep catalog gate,
+then sends the semantic constant union through `Pipeline.checkProgram`.
+-/
+
+open Ix.Compiler
+open Ix.Compiler.Ixon
+
+private def usage : String :=
+  "usage: lake exe compiler-catalog-contact -- <catalog.ixc>"
+
+def main (args : List String) : IO UInt32 := do
+  let [directory] := args
+    | IO.eprintln usage
+      return 2
+  match ← CatalogIO.loadDir directory with
+  | .error error =>
+    IO.eprintln s!"catalog-contact: ingress rejected: {repr error}"
+    return 1
+  | .ok loaded =>
+    IO.println s!"members_root={loaded.manifest.membersRoot}"
+    IO.println s!"content_root={loaded.manifest.contentRoot}"
+    IO.println s!"stats={repr loaded.stats}"
+    match Pipeline.checkProgram loaded.constants with
+    | .error error =>
+      IO.eprintln s!"catalog-contact: pipeline rejected: {repr error}"
+      return 1
+    | .ok _ =>
+      IO.println "pipeline=accepted"
+      return 0
diff --git a/Tests/Compiler/Checks/CheckSourceBorrow.lean b/Tests/Compiler/Checks/CheckSourceBorrow.lean
new file mode 100644
index 000000000..90962d9c6
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceBorrow.lean
@@ -0,0 +1,167 @@
+import Ix.Compiler.Tools.BorrowExecution
+
+/-! Two fresh compiler processes, independent caller/callee reconstruction
+and full execution replay, fixed source roots, and corrupted-artifact guards.
+No compiler, optimizer, ownership-validator, evaluator, or fixture imports. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.BorrowCheck
+
+private def fieldsPresent (value : Json) (keys : List String) : IO Unit := do
+  for key in keys do
+    let _ ← field value key
+
+private def inspectSnapshot (row snapshot : Json) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-borrow-case/1" &&
+    (← field snapshot "summary") == row) "borrow snapshot/report mismatch"
+  let depth ← number row "depth"
+  let successorCase := (← field row "successor") == toJson true
+  let expected := if successorCase then 22 else 11
+  need (depth ≤ 8 && (← number row "number") == expected &&
+    (← strField row "origin") == "synthetic-ixon") "borrow source-domain mismatch"
+  let compilation ← field snapshot "compilation"
+  need ((← strField compilation "format") == "compilatrix/compiler-snapshot/1") "missing compiler attachment"
+  let source ← field compilation "source"
+  need ((← field source "root") == (← field row "source_root") &&
+    (← arrField source "constants").size == 6) "source inventory mismatch"
+  for constant in ← arrField source "constants" do hashField constant "bytes" "key"
+  for stage in ["ixir0", "ixir1"] do
+    fieldsPresent (← field compilation stage)
+      ["raw_declarations", "raw_main", "declarations", "main", "address_map"]
+  let hpt ← field compilation "hpt"
+  fieldsPresent hpt ["producer_limits", "producer_stats", "candidate", "artifacts"]
+  need (!(← arrField hpt "artifacts").isEmpty) "missing checked HPT artifacts"
+  let diagnostics ← field compilation "ixir2_diagnostic"
+  fieldsPresent diagnostics ["validation_stats", "parameter_worlds", "constructors", "recursor_origins"]
+  let baseline ← field diagnostics "program"
+  let rewritten ← field snapshot "rewritten"
+  let inference ← field row "inference"
+  let summaries ← arrField inference "summaries"
+  need (summaries.size == depth + 3 && (← number inference "attempts") == depth + 3 &&
+    (← number inference "rounds") == 2 && (← number inference "rejected") == 0) "borrow inference work mismatch"
+  inspectRewrite baseline rewritten summaries
+  need ((← field row "baseline_size") == (← programSize baseline) &&
+    (← field row "borrowed_size") == (← programSize rewritten)) "borrow artifact growth mismatch"
+  let options ← field snapshot "options"
+  need ((← number options "maxCandidates") == 32 && (← number options "maxRounds") == 16 &&
+    (← number options "maxAttempts") == 256 && (← number options "sourceFuel") == 1000 &&
+    (← number (← field options "budget") "control") == 1000 &&
+    (← number (← field options "budget") "heap") == 1000) "borrow checking budget changed"
+  let observations ← field snapshot "observations"
+  for stage in ["ixon", "raw_ixir0", "ixir0"] do
+    need ((← nat (← field observations stage)) == expected) s!"{stage} result mismatch"
+  for stage in ["raw_ixir1", "ixir1", "logical_ixir2", "physical_ixir2"] do
+    let observation ← field observations stage
+    need ((← number observation "nat") == expected) s!"{stage} result mismatch"
+    let heap ← field observation "heap"
+    need ((← number heap "allocs") == 3 && (← number heap "frees") == 3 &&
+      (← number heap "rcops") == 5 && (← number heap "live") == 0 && (← number heap "reuses") == 0)
+      s!"{stage} baseline resource mismatch"
+  need ((← field observations "logical_ixir2") == (← field observations "physical_ixir2"))
+    "baseline interpretation disagreement"
+  for (label, program, rcops, extraSteps) in [
+      ("baseline", baseline, 5, 0), ("borrowed", rewritten, 3, 3)] do
+    let result ← field snapshot s!"{label}_execution"
+    inspectExecution program (← field snapshot s!"{label}_prefixes") result expected
+    let summary ← field row label
+    let store ← field result "store"
+    let heap ← field store "heap"
+    for key in ["allocs", "frees", "rcops", "reuses"] do
+      need ((← field summary key) == (← field heap key)) s!"{label} report counter mismatch"
+    for key in ["peakLiveNodes", "resetAttempts", "hotResets", "coldResets", "reusedPayloadUnits"] do
+      need ((← field summary key) == (← field store key)) s!"{label} report resource mismatch"
+    need ((← number summary "rcops") == rcops && (← number summary "allocs") == 3 &&
+      (← number summary "frees") == 3 && (← number summary "peakLiveNodes") == 2) "RC or peak policy mismatch"
+    let steps := 21 + 2 * depth + (if successorCase then 2 else 0) + extraSteps
+    let work := (if label == "baseline" then 6 else 5) + (if successorCase then 1 else 0)
+    need ((← number row s!"{label}_control_steps") == steps &&
+      (← number row s!"{label}_heap_work") == work &&
+      (← number result "control_remaining") + steps == 1000 &&
+      (← number result "heap_remaining") + work == 1000) "borrow execution cost mismatch"
+    need ((← strField row s!"native_{label}") == "missingConstructorSchema") "native selection boundary changed"
+  let fallbacks ← arrField snapshot "fallbacks"
+  need (fallbacks.size == (if depth == 0 && !successorCase then 3 else 0)) "fallback coverage mismatch"
+  for fallback in fallbacks do
+    need ((← field fallback "program") == baseline) "fallback changed the checked baseline"
+    need (!(← strField fallback "reason").isEmpty) "missing fallback reason"
+
+private def alter (value : Json) (path : List String) (replacement : Json) : IO Json := do
+  match path with
+  | [] => return replacement
+  | key :: rest =>
+      match value with
+      | .arr values =>
+          let some index := key.toNat? | throw (IO.userError "invalid mutation array index")
+          let old ← present values[index]? "mutation array index out of bounds"
+          return toJson (values.set! index (← alter old rest replacement))
+      | _ => replace value key (← alter (← field value key) rest replacement)
+
+private def corruptionGuards (snapshot : Json) : IO Nat := do
+  let row ← field snapshot "summary"
+  let baseline ← field (← field (← field snapshot "compilation") "ixir2_diagnostic") "program"
+  let baseCount := (← arrField baseline "declarations").size
+  let variant := toString baseCount
+  let mutations : List (List String × Json) := [
+    (["rewritten", "declarations", "1", "1", "fn", "definition", "blocks", "0", "instructions", "1"],
+      tagged "releaseShared" [("target", reg 1)]),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "signature", "params", "0", "passing"], toJson "owned"),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "blocks", "0", "valueParams", "0"], owned),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "blocks", "1", "terminator"],
+      tagged "ret" [("value", reg 0)]),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "signature", "papSafe"], toJson true),
+    (["borrowed_execution", "store", "heap", "rcops"], toJson (2 : Nat)),
+    (["borrowed_execution", "store", "peakLiveNodes"], toJson (1 : Nat)),
+    (["borrowed_prefixes", "3", "store", "heap", "nodes", "0", "rc"], toJson (17 : Nat)),
+    (["borrowed_prefixes", "3", "control", "values", "0", "loc", "l"], toJson (99 : Nat)),
+    (["borrowed_prefixes", "3", "heap_remaining"], toJson (0 : Nat)),
+    (["borrowed_execution", "store", "heap", "nodes", "0"], obj [("fake", toJson true)]),
+    (["fallbacks", "0", "program", "main", "blocks", "0", "terminator"], tagged "ret" [("value", reg 0)]),
+    (["compilation", "source", "constants", "0", "bytes"], toJson "00")]
+  for (path, value) in mutations do
+    let corrupted ← alter snapshot path value
+    let rejected ← try
+        inspectSnapshot row corrupted
+        pure false
+      catch _ => pure true
+    need rejected s!"independent checker accepted corrupted artifact at {path}"
+  return mutations.length
+
+private def compareFiles (first second : FilePath) (rows : Array Json) : IO Unit := do
+  let expected := ("report.json" :: (← rows.toList.mapM (strField · "snapshot"))).mergeSort (· ≤ ·)
+  need (expected.eraseDups.length == expected.length && expected.all (fun name =>
+    !name.contains '/' && !name.contains '\\' && !name.contains ".." && !name.startsWith "."))
+    "invalid or duplicate borrow artifact path"
+  for directory in [first, second] do
+    let entries ← directory.readDir
+    need ((entries.toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == expected) "borrow artifact inventory mismatch"
+    for entry in entries do need (!(← entry.path.isDir)) "unexpected nested borrow artifact directory"
+  for name in expected do
+    need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name)))
+      s!"borrow artifacts differ between fresh compiler processes: {name}"
+
+def main (args : List String) : IO UInt32 := cli "source borrow check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-borrow/expected.json")
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      let message ← run fixture #[output.toString]
+      requireAll message ["source-borrow ok: 18 accepted Ixon cases"] "borrow producer"
+      IO.print message
+    let report ← readJson (first / "report.json")
+    need ((← strField report "format") == "compilatrix/source-borrow/1" &&
+      (← strField report "policy") == "closed-scalar-borrow/1" &&
+      (← strField report "peak_policy") == "nonincreasing-peak-live-heap-nodes") "unknown borrow policy"
+    let rows ← arrField report "cases"
+    let expectedRows ← arrField expected "cases"
+    need (rows.size == 18 && expectedRows.size == rows.size &&
+      (← field report "negative_guards") == (← field expected "negative_guards")) "borrow coverage inventory mismatch"
+    compareFiles first second rows
+    for index in [:rows.size] do
+      let row := rows[index]!
+      for key in ["name", "depth", "successor", "source_root", "number"] do
+        need ((← field row key) == (← field expectedRows[index]! key)) s!"borrow source pin drifted: {key}"
+      inspectSnapshot row (← readJson (first / (← strField row "snapshot")))
+    let corruptions ← corruptionGuards (← readJson (first / "read-tag-0-zero.json"))
+    IO.println s!"source borrow check ok: {rows.size} complete artifact sets, independent rewrite and heap replay, {corruptions} corrupted artifacts rejected"
diff --git a/Tests/Compiler/Checks/CheckSourceBorrowRuntime.lean b/Tests/Compiler/Checks/CheckSourceBorrowRuntime.lean
new file mode 100644
index 000000000..b44f4a406
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceBorrowRuntime.lean
@@ -0,0 +1,146 @@
+import Ix.Compiler.Tools.BorrowRuntimeCheck
+
+/-! Two fresh compiler processes, pinned source inputs, independently rebuilt
+borrowed graphs and caller heaps, and every exported runtime transition. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.BorrowCheck Ix.Compiler.Tools.BorrowRuntimeCheck
+
+private def inspectSnapshot (row snapshot : Json) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-borrow-runtime-case/1" &&
+    (← field snapshot "summary") == row && (← strField row "origin") == "synthetic-ixon" &&
+    (← number row "depth") ≤ 8) "runtime snapshot/report mismatch"
+  let compilation ← field snapshot "compilation"
+  need ((← strField compilation "format") == "compilatrix/compiler-snapshot/1") "missing original compiler attachment"
+  let source ← field compilation "source"
+  need ((← field source "root") == (← field row "source_root") &&
+    (← arrField source "constants").size == 5) "runtime source inventory changed"
+  for constant in ← arrField source "constants" do hashField constant "bytes" "key"
+  let literals ← arrField source "literal_inputs"
+  need (literals.size == 2 && (← number literals[0]! "nat") == 11 && (← number literals[1]! "nat") == 22)
+    "runtime payload leaked into compiler source inputs"
+  for stage in ["ixir0", "ixir1"] do
+    let graph ← field compilation stage
+    for key in ["raw_declarations", "raw_main", "declarations", "main", "address_map"] do
+      let _ ← field graph key
+  let hpt ← field compilation "hpt"
+  need (!(← arrField hpt "artifacts").isEmpty) "missing checked HPT artifacts"
+  let diagnostics ← field compilation "ixir2_diagnostic"
+  for key in ["validation_stats", "parameter_worlds", "constructors", "recursor_origins"] do
+    let _ ← field diagnostics key
+  let baseline ← field diagnostics "program"
+  let rewritten ← field snapshot "rewritten"
+  inspectGraph row baseline rewritten
+  let depth ← number row "depth"
+  let inference ← field row "inference"
+  need ((← arrField inference "summaries").size == depth + 2 && (← number inference "attempts") == depth + 2 &&
+    (← number inference "rounds") == 2 && (← number inference "rejected") == 0) "runtime inference work mismatch"
+  let options ← field snapshot "options"
+  need ((← number options "maxCandidates") == 32 && (← number options "maxRounds") == 16 &&
+    (← number options "maxAttempts") == 256 && (← number options "maxSourceDepth") == 32 &&
+    (← number (← field options "policy") "maxDepth") == 32 &&
+    (← field (← field options "policy") "enabled") == toJson true) "runtime structural policy changed"
+  need ((← pairs options).length == 5) "unexpected runtime replay option"
+  let observations ← arrField snapshot "observations"
+  need (observations.size == expectedInputs.size && (← number row "runtime_inputs") == expectedInputs.size)
+    "runtime input matrix mismatch"
+  for index in [:expectedInputs.size] do
+    let (name, argument) := expectedInputs[index]!
+    inspectInput row baseline rewritten observations[index]! name argument
+  inspectLender row rewritten (← field snapshot "lender")
+  need ((← strField row "native_baseline") == "missingConstructorSchema" &&
+    (← strField row "native_borrowed") == "missingConstructorSchema") "native borrowing boundary changed"
+  let fallbacks ← arrField snapshot "fallbacks"
+  let expectedFallbacks := #["disabled", "inference-budget", "target-structure-budget", "source-structure-budget"]
+  need (fallbacks.size == 4) "missing runtime fallback coverage"
+  for index in [:4] do
+    need ((← strField fallbacks[index]! "name") == expectedFallbacks[index]! &&
+      (← field fallbacks[index]! "program") == baseline && !(← strField fallbacks[index]! "reason").isEmpty)
+      "open-input fallback changed the checked baseline"
+
+private def alter (value : Json) (path : List String) (replacement : Json) : IO Json := do
+  match path with
+  | [] => return replacement
+  | key :: rest =>
+      match value with
+      | .arr values =>
+          let some index := key.toNat? | throw (IO.userError "invalid corruption index")
+          let old ← present values[index]? "corruption index out of bounds"
+          return toJson (values.set! index (← alter old rest replacement))
+      | _ => replace value key (← alter (← field value key) rest replacement)
+
+private def corruptionGuards (snapshot : Json) : IO Nat := do
+  let row ← field snapshot "summary"
+  let baseline ← field (← field (← field snapshot "compilation") "ixir2_diagnostic") "program"
+  let variant := toString (← arrField baseline "declarations").size
+  let mutations : List (List String × Json) := [
+    (["rewritten", "declarations", "1", "1", "fn", "definition", "blocks", "0", "instructions", "1"],
+      tagged "releaseShared" [("target", reg 1)]),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "signature", "params", "0", "passing"], toJson "owned"),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "blocks", "0", "valueParams", "0"], owned),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "blocks", "1", "terminator"], ret (reg 0)),
+    (["rewritten", "declarations", variant, "1", "fn", "definition", "signature", "papSafe"], toJson true),
+    (["observations", "0", "input_store", "heap", "nodes", "0", "rc"], toJson (2 : Nat)),
+    (["observations", "0", "input_value", "loc", "l"], toJson (8 : Nat)),
+    (["observations", "0", "paths", "0", "borrowed", "store", "heap", "rcops"], toJson (0 : Nat)),
+    (["observations", "0", "paths", "0", "borrowed", "store", "peakLiveNodes"], toJson (2 : Nat)),
+    (["observations", "0", "paths", "0", "borrowed_prefixes", "2", "control", "values", "0", "loc", "l"], toJson (10 : Nat)),
+    (["observations", "0", "paths", "1", "borrowed_prefixes", "2", "heap_remaining"], toJson (0 : Nat)),
+    (["observations", "6", "paths", "0", "borrowed", "store", "heap", "frees"], toJson (1 : Nat)),
+    (["observations", "3", "argument", "succ", "payload", "scalar", "value"], toJson (42 : Nat)),
+    (["lender", "input_store", "heap", "nodes", "8", "rc"], toJson (1 : Nat)),
+    (["lender", "prefixes", "3", "store", "heap", "nodes", "8", "rc"], toJson (2 : Nat)),
+    (["lender", "cleanup_store", "heap", "frees"], toJson (0 : Nat)),
+    (["fallbacks", "0", "program", "main", "blocks", "0", "terminator"], ret (atomNat 11)),
+    (["compilation", "source", "constants", "0", "bytes"], toJson "00"),
+    (["compilation", "source", "literal_inputs", "0", "nat"], toJson (42 : Nat)),
+    (["options", "maxSourceDepth"], toJson (0 : Nat))]
+  for (path, value) in mutations do
+    let corrupted ← alter snapshot path value
+    let rejected ← try
+        inspectSnapshot row corrupted
+        pure false
+      catch _ => pure true
+    need rejected s!"runtime checker accepted corrupted artifact at {path}"
+  return mutations.length
+
+private def compareFiles (first second : FilePath) (rows : Array Json) : IO Unit := do
+  let expected := ("report.json" :: (← rows.toList.mapM (strField · "snapshot"))).mergeSort (· ≤ ·)
+  need (expected.eraseDups.length == expected.length && expected.all (fun name =>
+    !name.contains '/' && !name.contains '\\' && !name.contains ".." && !name.startsWith ".")) "invalid runtime artifact path"
+  for directory in [first, second] do
+    let entries ← directory.readDir
+    need ((entries.toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == expected) "runtime artifact inventory mismatch"
+    for entry in entries do need (!(← entry.path.isDir)) "unexpected nested runtime artifact directory"
+  for name in expected do
+    need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name)))
+      s!"runtime artifacts differ between fresh processes: {name}"
+
+def main (args : List String) : IO UInt32 := cli "source borrow runtime check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-borrow-runtime/expected.json")
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      let message ← run fixture #[output.toString]
+      requireAll message ["source-borrow-runtime ok: 9 source functions; 72 runtime inputs"] "borrow runtime producer"
+      IO.print message
+    let report ← readJson (first / "report.json")
+    need ((← strField report "format") == "compilatrix/source-borrow-runtime/1" &&
+      (← strField report "policy") == "open-shared-tag-borrow/1" &&
+      (← strField report "input_policy") == "one-owned-shared-root-allocation-ordered-heap" &&
+      (← strField report "peak_policy") == "nonincreasing-peak-live-heap-nodes") "unknown runtime borrowing policy"
+    let rows ← arrField report "cases"
+    let expectedRows ← arrField expected "cases"
+    need (rows.size == 9 && expectedRows.size == rows.size) "runtime source matrix mismatch"
+    for key in ["structural_guards", "ownership_guards"] do
+      need ((← field report key) == (← field expected key)) "runtime guard matrix mismatch"
+    compareFiles first second rows
+    for index in [:rows.size] do
+      let row := rows[index]!
+      for key in ["name", "depth", "source_root", "entry", "borrowed_entry", "factory"] do
+        need ((← field row key) == (← field expectedRows[index]! key)) s!"runtime source/export pin drifted: {key}"
+      inspectSnapshot row (← readJson (first / (← strField row "snapshot")))
+    let corruptions ← corruptionGuards (← readJson (first / "read-tag-runtime-0.json"))
+    IO.println s!"source borrow runtime check ok: 9 source functions, 72 runtime inputs, 144 independent direct/PAP comparisons, 9 aliased lenders, {corruptions} corrupted artifacts rejected"
diff --git a/Tests/Compiler/Checks/CheckSourceCallReuse.lean b/Tests/Compiler/Checks/CheckSourceCallReuse.lean
new file mode 100644
index 000000000..189293d36
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceCallReuse.lean
@@ -0,0 +1,184 @@
+import Ix.Compiler.Tools.Check
+
+/-! Independent fresh-process artifact, resource, and reservation gate.
+This checker imports no compiler, optimizer, evaluator, or fixture code. -/
+
+open Lean System Ix.Compiler.Tools.Check
+
+private def requireFields (value : Json) (keys : List String) : IO Unit := do
+  for key in keys do need ((← field value key) != Json.null) s!"missing map snapshot field {key}"
+
+private def number (value : Json) (key : String) : IO Nat := do nat (← field value key)
+
+private def inspectSnapshot (row snapshot : Json) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-call-reuse-case/1") "unknown map snapshot format"
+  need ((← field snapshot "summary") == row) "map snapshot/report disagreement"
+  let source ← field snapshot "source"
+  requireFields source ["root", "limits", "fuel", "constants", "literals"]
+  need ((← field source "root") == (← field row "source_root")) "map source identity disagreement"
+  need ((← arrField source "constants").size == (← number row "source_constants")) "source inventory disagreement"
+  let ir0 ← field snapshot "ixir0"
+  requireFields ir0 ["raw", "raw_main", "groups", "declarations", "main", "blocks", "address_map"]
+  for (key, rootKey) in [("ixir1", "ixir1_root"), ("literal_ixir1", "literal_ixir1_root")] do
+    let graph ← field snapshot key
+    requireFields graph ["root", "raw_declarations", "raw_main", "artifacts", "declarations", "main", "address_map", "reserved"]
+    need ((← field graph "root") == (← field row rootKey)) s!"{key} identity disagreement"
+  let specialization ← field snapshot "map_specialization"
+  requireFields specialization ["policy", "plan", "derived_key", "declarations", "main"]
+  need ((← strField specialization "policy") == "closed-map-specialize/1" &&
+    (← field specialization "derived_key") == (← field row "map_specialization")) "map specialization identity disagreement"
+  let lowering ← field snapshot "ownership_lowering"
+  for key in ["declarations", "main"] do
+    need ((← field lowering key) == (← field specialization key)) s!"ownership lowering changed specialized {key}"
+  for key in ["source_rows_selected", "source_externs_rejected", "target_externs_rejected"] do
+    need ((← field lowering key) == toJson true) s!"ownership certificate failed: {key}"
+  let hpt ← field snapshot "hpt"
+  requireFields hpt ["producer_limits", "producer_stats", "candidate", "artifacts"]
+  let artifacts ← arrField hpt "artifacts"
+  need (!artifacts.isEmpty && (← artifacts.mapM (field · "root")) == (← arrField row "hpt_roots")) "map HPT identity disagreement"
+  for artifact in artifacts do requireFields artifact ["program_root", "cache_key", "root", "dependencies", "members", "bytes"]
+  let sidecars ← field snapshot "sidecars"
+  requireFields sidecars ["input_declarations", "input_main", "main_world", "parameter_worlds", "constructors", "recursor_origins", "hpt_certificate"]
+  let graph ← field snapshot "ixir1"
+  need ((← field sidecars "input_declarations") == (← field graph "declarations") &&
+    (← field sidecars "input_main") == (← field graph "main")) "sidecar input differs from specialized IxIR1"
+  need ((← field sidecars "hpt_certificate") == (← field hpt "candidate")) "sidecar HPT certificate disagreement"
+  let provenance ← field snapshot "provenance"
+  requireFields provenance ["kind", "identity", "bytes", "lowering_version", "pass", "execution_policy", "optimized", "specialization"]
+  need ((← strField provenance "kind") == "ixir1-plus-policy" &&
+    (← field provenance "identity") == (← field row "provenance")) "map provenance identity disagreement"
+  need ((← strField provenance "pass") == "shared-call-reuse/1" &&
+    (← field provenance "pass") == (← field row "pass") &&
+    (← strField provenance "execution_policy") == "suspended-direct-calls/1" &&
+    (← field provenance "execution_policy") == (← field row "policy")) "map execution policy disagreement"
+  requireFields (← field snapshot "ixir2_diagnostic") ["baseline", "baseline_stats", "selected", "selected_stats", "reuse", "max_depth", "schemas"]
+  let observations ← field snapshot "observations"
+  for stage in ["literal_raw_ixir1", "literal_ixir1", "raw_ixir1", "ixir1",
+      "baseline_logical", "baseline_physical", "selected_logical", "selected_physical"] do
+    let observation ← field observations stage
+    need ((← field observation "value") == (← field row "value")) s!"{stage}: map value disagreement"
+    let returned ← field observation "store"
+    let heap ← if stage.endsWith "ixir1" then pure returned else field returned "heap"
+    let live := (← arrField heap "nodes").countP (· != Json.null)
+    need (live + (← number heap "frees") == (← number heap "allocs")) s!"{stage}: terminal allocation balance"
+    let released ← field observation "reclaimed"
+    let releasedHeap ← if stage.endsWith "ixir1" then pure released else field released "heap"
+    need ((← arrField releasedHeap "nodes").all (· == Json.null)) s!"{stage}: incomplete reclamation"
+    need ((← field releasedHeap "allocs") == (← field releasedHeap "frees")) s!"{stage}: reclaimed allocation balance"
+  let baseline ← field observations "baseline_physical"
+  let selected ← field observations "selected_physical"
+  for phase in ["store", "reclaimed"] do
+    let base ← field baseline phase
+    let physical ← field selected phase
+    let b ← field base "heap"
+    let p ← field physical "heap"
+    let reuses ← number p "reuses"
+    need ((← number b "reuses") == 0) s!"{phase}: baseline executed reuse"
+    need ((← number b "allocs") == (← number p "allocs") + reuses) s!"{phase}: selected allocation law"
+    need ((← number b "frees") == (← number p "frees") + reuses) s!"{phase}: selected free law"
+    need ((← number p "rcops") ≤ (← number b "rcops")) s!"{phase}: selected RC bound"
+    need ((← number physical "peakLiveNodes") ≤ (← number base "peakLiveNodes")) s!"{phase}: selected peak bound"
+  for (stage, summary) in [("baseline_physical", "baseline"), ("selected_logical", "logical"), ("selected_physical", "physical")] do
+    let store ← field (← field observations stage) "store"
+    let heap ← field store "heap"
+    let counters ← field row summary
+    for key in ["allocs", "reuses", "frees", "rcops"] do
+      need ((← field counters key) == (← field heap key)) s!"{stage}: report heap counters disagree"
+    for key in ["resetAttempts", "hotResets", "coldResets", "reusedPayloadUnits", "peakLiveNodes"] do
+      need ((← field counters key) == (← field store key)) s!"{stage}: report observation counters disagree"
+  let base ← field row "baseline"
+  let prefixes ← arrField snapshot "prefixes"
+  need (!prefixes.isEmpty && prefixes.size == (← number row "prefixes")) "map prefix inventory disagreement"
+  let mut maximum := 0
+  for index in [:prefixes.size] do
+    let state := prefixes[index]!
+    need ((← number state "step") == index) "map prefix sequence has a gap"
+    let counters ← field state "counters"
+    let live ← number state "live"
+    let owners ← (← arrField state "owners").toList.mapM (fun owner => do (← array owner).toList.mapM nat)
+    let locations := owners.flatten
+    let emptySlots ← (← arrField state "empty_slots").toList.mapM nat
+    need (locations.eraseDups.length == locations.length) "prefix duplicates a reservation owner"
+    need (locations.all emptySlots.contains) "prefix reservation aliases a live heap slot"
+    need (live + (← number counters "frees") + locations.length == (← number counters "allocs")) "prefix reservation accounting"
+    need ((← number counters "rcops") ≤ (← number base "rcops")) "prefix RC bound"
+    need (live ≤ (← number counters "peakLiveNodes") &&
+      (← number counters "peakLiveNodes") ≤ (← number base "peakLiveNodes")) "prefix peak bound"
+    let counts ← (← arrField state "credit_counts").toList.mapM nat
+    maximum := max maximum counts.sum
+  need (maximum == (← number row "maximum_credits")) "maximum suspended credit count disagreement"
+  need ((← field prefixes.back! "counters") == (← field row "physical")) "prefix terminal counters disagree"
+
+private def replaceAt (value : Json) (path : List String) (replacement : Json) : IO Json := do
+  match path with
+  | [] => return replacement
+  | key :: rest =>
+      let entries ← pairs value
+      need (entries.any (·.1 == key)) s!"regression field absent: {key}"
+      let changed ← replaceAt (← field value key) rest replacement
+      return Json.mkObj (entries.map fun (name, old) => (name, if name == key then changed else old))
+
+private def rejects (label fragment : String) (action : IO Unit) : IO Unit := do
+  let error ← try action; pure none catch error => pure (some error.toString)
+  let some error := error | throw (IO.userError s!"{label}: checker accepted corruption")
+  need (error.contains fragment) s!"{label}: wrong checker rejection: {error}"
+
+private def regressionChecks (row snapshot : Json) : IO Unit := do
+  for phase in ["store", "reclaimed"] do
+    let base ← field (← field (← field snapshot "observations") "baseline_physical") phase
+    let raisedRC := (← number (← field base "heap") "rcops") + 1
+    let changed ← replaceAt snapshot ["observations", "selected_physical", phase, "heap", "rcops"] (toJson raisedRC)
+    rejects s!"{phase} RC corruption" s!"{phase}: selected RC bound" (inspectSnapshot row changed)
+    let raisedPeak := (← number base "peakLiveNodes") + 1
+    let changed ← replaceAt snapshot ["observations", "selected_physical", phase, "peakLiveNodes"] (toJson raisedPeak)
+    rejects s!"{phase} peak corruption" s!"{phase}: selected peak bound" (inspectSnapshot row changed)
+  let changed ← replaceAt snapshot ["provenance", "execution_policy"] (toJson "call-local/0")
+  rejects "old policy corruption" "map execution policy disagreement" (inspectSnapshot row changed)
+  let prefixes ← arrField snapshot "prefixes"
+  let some index := prefixes.findIdx? (fun state =>
+    ((state.getObjVal? "owners").bind Json.getArr?).toOption.any fun owners =>
+      owners.any (fun owner => owner.getArr?.toOption.any (!·.isEmpty)))
+    | throw (IO.userError "regression case has no physical reservation")
+  let state := prefixes[index]!
+  let changedState ← replaceAt state ["owners"] (toJson ([[0, 0]] : List (List Nat)))
+  let changed ← replaceAt snapshot ["prefixes"] (Json.arr (prefixes.set! index changedState))
+  rejects "duplicate reservation corruption" "prefix duplicates a reservation owner" (inspectSnapshot row changed)
+  let changedState ← replaceAt state ["empty_slots"] (toJson ([] : List Nat))
+  let changed ← replaceAt snapshot ["prefixes"] (Json.arr (prefixes.set! index changedState))
+  rejects "live-slot reservation corruption" "prefix reservation aliases a live heap slot" (inspectSnapshot row changed)
+
+def main (args : List String) : IO UInt32 := cli "source call reuse check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected"] args)
+  let some exe := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-call-reuse/expected.json")
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      let result ← run exe #[output.toString]
+      requireAll result ["source-call-reuse ok:"] "source map producer"
+    let report ← readJson (first / "report.json")
+    need (report == expected) "reviewed source map, policy, address, counter, or rejection matrix drifted"
+    let rows ← arrField report "cases"
+    need (!rows.isEmpty) "source map matrix has no cases"
+    need (!(← arrField report "policy_and_rejection_checks").isEmpty) "source map rejection matrix is empty"
+    let mut inventory := ["report.json"]
+    for row in rows do
+      let name ← strField row "snapshot"
+      need (!name.isEmpty && !name.startsWith "." && !name.contains ".." &&
+        name.toList.all (fun c => c.isAlphanum || c == '-' || c == '.') && !inventory.contains name)
+        "invalid or duplicate source map snapshot name"
+      inventory := name :: inventory
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      let files ← output.readDir
+      need ((files.toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "fresh map artifact inventory drifted"
+      for file in files do need (!(← file.path.isDir)) "unexpected directory in map artifacts"
+    for name in inventory do
+      need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name)))
+        s!"fresh compiler processes produced different map artifacts: {name}"
+    for row in rows do inspectSnapshot row (← readJson (first / (← strField row "snapshot")))
+    let some hot := rows.find? (fun row => (row.getObjValAs? String "name").toOption == some "three-hot")
+      | throw (IO.userError "missing hot map regression case")
+    regressionChecks hot (← readJson (first / (← strField hot "snapshot")))
+    IO.println s!"source call reuse check ok: {rows.size} Ixon maps, two fresh artifact sets, 7 corruption regressions, all prefixes and reclaimed heaps checked"
diff --git a/Tests/Compiler/Checks/CheckSourceCoverage.lean b/Tests/Compiler/Checks/CheckSourceCoverage.lean
new file mode 100644
index 000000000..fe3bc13ae
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceCoverage.lean
@@ -0,0 +1,204 @@
+import Ix.Compiler.Tools.X86Check
+import Ix.Compiler.Tools.UpstreamNativeCheck
+
+/-! Compare complete artifacts from two fresh compiler processes, check the
+reviewed stage/identity/counter matrix, and independently inspect native exits.
+The checker imports no compiler code; the producer is a separate executable. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.X86Check
+
+private def fileName (name : String) : Bool :=
+  !name.isEmpty && name.toList.all (fun char => char.isAlphanum || char == '-' || char == '.')
+    && !name.contains ".." && !name.startsWith "."
+
+private def requiredFields (value : Json) (keys : List String) (label : String) : IO Unit := do
+  for key in keys do
+    let _ ← field value key
+  need (value != Json.null) s!"missing {label}"
+
+private def inspectUpstream (row input compiled observations : Json) : IO Unit := do
+  requiredFields input ["manifest_bytes", "piece_bytes", "blob_inputs", "policy", "provenance"] "original upstream input"
+  need ((← field input "provenance") == (← field row "provenance")) "upstream provenance disagreement"
+  let provenance ← field row "provenance"
+  need ((← strField provenance "source_pin") == "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4" &&
+      (← strField provenance "toolchain") == "leanprover/lean4:v4.33.1") "upstream writer pin drifted"
+  requiredFields provenance ["source_module", "source_module_hash", "piece_hash", "members_root", "content_root"] "upstream provenance"
+  if compiled == Json.null || (← strField row "last_accepted_stage") == "addressed-ixir0" then return
+  need ((← field (← field compiled "source") "constants") == (← field input "constants"))
+    "compiled upstream constants differ from their original byte records"
+  let summary ← field row "observation"
+  let number ← field summary "nat"
+  for stage in ["ixon", "raw_ixir0", "ixir0"] do
+    need ((← field observations stage) == number) s!"{stage} upstream result disagreement"
+  for stage in ["raw_ixir1", "ixir1", "logical_ixir2", "physical_ixir2"] do
+    let observation ← field observations stage
+    need ((← field observation "nat") == number) s!"{stage} upstream result disagreement"
+    requiredFields observation ["value", "store", "reclaimed"] "upstream heap observation"
+    let store ← field observation "store"
+    let reclaimed ← field observation "reclaimed"
+    let (store, reclaimed) ← if stage.endsWith "ixir2" then
+        pure (← field store "heap", ← field reclaimed "heap")
+      else pure (store, reclaimed)
+    let nodes ← arrField store "nodes"
+    let live := nodes.countP (· != Json.null)
+    need ((← nat (← field store "allocs")) == (← nat (← field store "frees")) + live)
+      s!"{stage} upstream live-node balance disagrees"
+    for key in ["allocs", "frees", "rcops", "reuses"] do
+      need ((← field store key) == (← field (← field summary "heap") key)) s!"{stage} terminal counters disagree"
+      need ((← field reclaimed key) == (← field (← field summary "reclaimed") key)) s!"{stage} reclaimed counters disagree"
+    need ((← arrField reclaimed "nodes").all (· == Json.null) &&
+        (← field reclaimed "allocs") == (← field reclaimed "frees")) s!"{stage} upstream result leaked"
+  need ((← field observations "logical_ixir2") == (← field observations "physical_ixir2"))
+    "complete upstream baseline stores or execution budgets disagree"
+
+private def inspectAddressed (row compiled : Json) : IO Unit := do
+  need ((← strField compiled "format") == "compilatrix/addressed-erasure/1" &&
+      (← field compiled "source_erasure_certified") == toJson false)
+    "partial addressed output was mislabeled as certified source erasure"
+  need ((← strField (← field row "rejection") "stage") == "validated-erasure")
+    "addressed source has an inconsistent next boundary"
+  let ir0 ← field compiled "ixir0"
+  requiredFields ir0 ["raw_declarations", "raw_main", "groups", "declarations", "main", "blocks", "address_map"] "addressed IxIR0"
+  let groups ← arrField ir0 "groups"
+  let blocks ← arrField ir0 "blocks"
+  let mapping ← arrField ir0 "address_map"
+  let mut raw := #[]
+  let mut blockMaps := #[]
+  let mut seen := #[]
+  let mut index := 0
+  for group in groups do
+    let entries ← arrField group "entries"
+    raw := raw ++ entries
+    if (← strField group "kind") != "mutual" then continue
+    let some block := blocks[index]? | throw (IO.userError "mutual producer block missing")
+    index := index + 1
+    let pairs ← arrField block "address_map"
+    let members ← arrField block "members"
+    need (pairs.size == entries.size && members.size == entries.size)
+      "mutual producer/member map lost a row"
+    for i in [:pairs.size] do
+      let pair ← array pairs[i]!
+      need (pair.size == 2 && pair[0]? == some (← field entries[i]! "key") &&
+          pair[1]? == some (← field members[i]! "key")) "mutual producer map has wrong order or identity"
+      need (!seen.contains pair[0]!) "mutual producer key was duplicated"
+      seen := seen.push pair[0]!
+    blockMaps := blockMaps ++ pairs
+  need (index == blocks.size && blockMaps == mapping && raw == (← arrField ir0 "raw_declarations"))
+    "addressed output omitted or reordered producers"
+  let declarations ← arrField ir0 "declarations"
+  need (declarations.size == raw.size) "addressed output dropped duplicate declaration rows"
+  for left in declarations do
+    for right in declarations do
+      if (← field left "key") == (← field right "key") then
+        need (left == right) "shared member identity has conflicting declarations"
+  let name ← strField row "name"
+  if name == "upstream-addClosed" || name == "std-failure-closure" then
+    need (blocks.size == 3 && mapping.size == 3) "repeated-erasure upstream fixture lost a producer"
+    for block in blocks do
+      for key in ["root", "preimage", "members"] do
+        need ((← field block key) == (← field blocks[0]! key)) "reused block artifact is not byte-exact"
+
+private def inspectSnapshot (directory : FilePath) (row : Json) : IO Unit := do
+  let path ← strField row "snapshot"
+  need (fileName path) s!"invalid snapshot path {path}"
+  let snapshot ← readJson (directory / path)
+  need ((← strField snapshot "format") == "compilatrix/source-case/1") "unknown source snapshot format"
+  let input ← field snapshot "input"
+  need ((← field input "root") == (← field row "root")) "snapshot/report source root disagreement"
+  need ((← arrField input "constants").size == (← nat (← field row "source_constants")))
+    "snapshot/report source constant count disagreement"
+  let stage ← strField row "last_accepted_stage"
+  let compiled ← field snapshot "compilation"
+  if stage == "ixir2" || stage == "elf" then
+    need ((← strField compiled "format") == "compilatrix/compiler-snapshot/1") "missing compiler snapshot"
+    let ir0 ← field compiled "ixir0"
+    requiredFields ir0 ["raw_declarations", "raw_main", "groups", "declarations", "main", "blocks", "address_map"] "IxIR0"
+    let ir1 ← field compiled "ixir1"
+    requiredFields ir1 ["raw_declarations", "raw_main", "artifacts", "declarations", "main", "address_map", "reserved"] "IxIR1"
+    need ((← field ir1 "root") == (← field row "ir1_root")) "snapshot/report IxIR1 root disagreement"
+    let hpt ← field compiled "hpt"
+    requiredFields hpt ["producer_limits", "producer_stats", "candidate", "artifacts"] "HPT"
+    let certificates ← arrField hpt "artifacts"
+    let roots ← certificates.mapM (field · "root")
+    need (roots == (← arrField row "hpt_roots") && !roots.isEmpty) "snapshot/report HPT identity disagreement"
+    for certificate in certificates do
+      requiredFields certificate ["program_root", "cache_key", "dependencies", "members", "bytes"] "HPT certificate"
+    requiredFields (← field compiled "ixir2_diagnostic")
+      ["program", "validation_stats", "parameter_worlds", "constructors", "recursor_origins"] "IxIR2"
+  else if stage == "addressed-ixir0" then
+    inspectAddressed row compiled
+  else
+    need (compiled == Json.null) "negative source snapshot unexpectedly contains a compiler output"
+  if (← strField row "origin") == "upstream-lean" then
+    inspectUpstream row input compiled (← field snapshot "observations")
+
+private def compareFiles (first second : FilePath) (report : Json) : IO (Array Json) := do
+  let rows ← arrField report "source_cases"
+  let mut expected := ["report.json"]
+  for row in rows do
+    let snapshot ← strField row "snapshot"
+    need (fileName snapshot && !expected.contains snapshot) s!"invalid/duplicate snapshot {snapshot}"
+    expected := snapshot :: expected
+    let object ← field row "object"
+    if object != Json.null then
+      let name ← string object
+      need (fileName name && !expected.contains name) s!"invalid/duplicate object {name}"
+      expected := name :: expected
+  expected := expected.mergeSort (· ≤ ·)
+  for directory in [first, second] do
+    let entries ← directory.readDir
+    let actual := entries.toList.map (·.fileName) |>.mergeSort (· ≤ ·)
+    need (actual == expected) s!"compiler output file inventory drifted: {repr actual}"
+    for entry in entries do need (!(← entry.path.isDir)) s!"unexpected output directory {entry.path}"
+  for name in expected do
+    need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name)))
+      s!"fresh compiler processes produced different complete artifacts: {name}"
+  return rows
+
+def main (args : List String) : IO UInt32 := cli "source coverage check failed" do
+  let args ← checked (parseArgs [
+    "--fixture", "--contact", "--upstream", "--expected", "--readelf", "--objdump", "--cc", "--harness"] args)
+  let some exe := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let contact := option args "--contact" "Tests/Fixtures/Compiler/ixon-std-contact"
+  let upstream := option args "--upstream" "Tests/Fixtures/Compiler/ixon-upstream"
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-coverage/expected.json")
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  let native ← nativeArgs args
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    -- Each invocation constructs and compiles all source inputs from scratch.
+    for output in [first, second] do
+      let result ← run exe #[output.toString, contact, upstream]
+      requireAll result ["source-coverage ok:"] "coverage producer"
+    let report ← readJson (first / "report.json")
+    need (report == expected) "reviewed source coverage, identity, or counter matrix drifted"
+    let rows ← compareFiles first second report
+    let mut objectCount := 0
+    for row in rows do
+      inspectSnapshot first row
+      let object ← field row "object"
+      if object == Json.null then continue
+      objectCount := objectCount + 1
+      let path := first / (← string object)
+      let elf ← inspectElf readelf path
+      need (elf.contains "There are no relocations in this file.") "source scalar has unexpected relocations"
+      let observation ← field row "observation"
+      let number ← nat (← field observation "nat")
+      let disassembly ← disassemble objdump path
+      let bytes ← IO.FS.readBinFile path
+      if (← strField row "origin") == "upstream-lean" then
+        let snapshot ← readJson (first / (← strField row "snapshot"))
+        Ix.Compiler.Tools.UpstreamNativeCheck.inspect row snapshot bytes
+        Ix.Compiler.Tools.UpstreamNativeCheck.regressions row snapshot bytes
+        requireAll disassembly ["call", "add    rax,0x1"] "upstream computational target"
+      else
+        requireAll disassembly [s!"movabs rax,0x{hexNat number}"] "source scalar target"
+        need (containsBytes bytes (← provenance (← strField row "ir1_root")))
+          "source object lost its exact addressed IxIR1 provenance"
+      if let some (cc, harness) := native then
+        linkAndRun cc readelf harness path (directory / s!"{← strField row "name"}-native") number
+    need (objectCount > 0) "source coverage has no native-capable exit"
+    let suffix := if native.isSome then ", native results agree" else ""
+    IO.println s!"source coverage check ok: {rows.size} Ixon cases, two fresh complete artifact sets, {objectCount} ELF objects{suffix}"
diff --git a/Tests/Compiler/Checks/CheckSourceNativeCapturedScalar.lean b/Tests/Compiler/Checks/CheckSourceNativeCapturedScalar.lean
new file mode 100644
index 000000000..98d81175c
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceNativeCapturedScalar.lean
@@ -0,0 +1,62 @@
+import Ix.Compiler.Tools.CapturedScalarNativeCheck
+import Ix.Compiler.Tools.X86Check
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+open Ix.Compiler.Tools.X86Check Ix.Compiler.Tools.CapturedScalarNativeCheck
+
+def main (args : List String) : IO UInt32 := cli "source native captured scalar check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected", "--cc", "--harness", "--readelf", "--objdump"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-native-captured-scalar/expected.json")
+  let native ← nativeArgs args
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      requireAll (← run fixture #[output.toString]) ["source-native-captured-scalar ok:"] "captured scalar source producer"
+    need ((← readJson (first / "report.json")) == expected) "captured scalar reviewed report drifted"
+    let rows ← arrField expected "cases"
+    need (rows.size == families.size * captures.size) "captured scalar source inventory drifted"
+    let mut inventory := ["report.json"]
+    for index in [:rows.size] do
+      let row := rows[index]!
+      let name ← strField row "name"
+      let family := families[index / captures.size]!
+      let tag := tags[index % captures.size]!
+      let capture := captures[index % captures.size]!
+      need (name == s!"{family}-{tag}" && (← strField row "family") == family && (← number row "capture") == capture)
+        "captured scalar family/capture order drifted"
+      let snapshotName ← strField row "snapshot"
+      let objectName ← strField row "object"
+      need (snapshotName == s!"{name}.json" && objectName == s!"{name}.o") "unsafe captured scalar artifact name"
+      inventory := snapshotName :: objectName :: inventory
+      let snapshot ← readJson (first / snapshotName)
+      let bytes ← IO.FS.readBinFile (first / objectName)
+      inspect row snapshot bytes
+      regressions row snapshot bytes
+      let elf ← inspectElf readelf (first / objectName) "compilatrix_scalar"
+      requireAll elf ["There are no relocations"] "captured scalar local-call object"
+      let assembly ← disassemble objdump (first / objectName) "compilatrix_scalar"
+      requireAll assembly ["push", "rbp", "rdi", "call", "ret"] "captured scalar ABI/wrapper instructions"
+      if index ≥ captures.size then requireAll assembly ["cmp", "je"] "captured scalar helper branches"
+      if let some (cc, harness) := native then
+        let executable := directory / s!"native-{name}"
+        let depth ← number row "stack_depth"
+        let _ ← run cc #["-O2", "-fomit-frame-pointer", "-fno-lto", "-Wall", "-Wextra", "-Werror",
+          s!"-DFAMILY={index / captures.size}", s!"-DCAPTURE={capture}ULL", s!"-DSTACK_DEPTH={depth}",
+          harness.toString, (first / objectName).toString, "-Wl,-z,noexecstack", "-Wl,--fatal-warnings", "-o", executable.toString]
+        let result ← checked (Json.parse (← run executable.toString))
+        need ((← number result "calls") == 166) "captured scalar native call inventory changed"
+        for key in ["saved_registers", "stack", "caller_frame", "guarded_stack"] do
+          need ((← field result key) == toJson true) s!"captured scalar native {key} failed"
+        let headers ← run readelf #["-W", "-l", executable.toString]
+        let stacks := (headers.splitOn "\n").filter (·.contains "GNU_STACK")
+        need (stacks.length == 1 && !stacks.any (·.contains "RWE")) "captured scalar executable stack policy changed"
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      need (((← output.readDir).toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "captured scalar complete file inventory drifted"
+    for file in inventory do
+      need ((← IO.FS.readBinFile (first / file)) == (← IO.FS.readBinFile (second / file))) s!"fresh captured scalar artifact differs: {file}"
+    IO.println "source native captured scalar check ok: nine fresh source artifacts, 171 source/application/object runs, 135 corruptions, native ABI and guarded stack checks"
diff --git a/Tests/Compiler/Checks/CheckSourceNativePhysicalScalar.lean b/Tests/Compiler/Checks/CheckSourceNativePhysicalScalar.lean
new file mode 100644
index 000000000..ff58ef70e
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceNativePhysicalScalar.lean
@@ -0,0 +1,59 @@
+import Ix.Compiler.Tools.PhysicalScalarNativeCheck
+import Ix.Compiler.Tools.X86Check
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+open Ix.Compiler.Tools.X86Check Ix.Compiler.Tools.PhysicalScalarNativeCheck
+
+def main (args : List String) : IO UInt32 := cli "source native physical scalar check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected", "--cc", "--harness", "--readelf", "--objdump"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-native-physical-scalar/expected.json")
+  let native ← nativeArgs args
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      requireAll (← run fixture #[output.toString]) ["source-native-physical-scalar ok:"] "physical scalar source producer"
+    need ((← readJson (first / "report.json")) == expected) "physical scalar reviewed report drifted"
+    let rows ← arrField expected "cases"
+    need (rows.size == names.size) "physical scalar source inventory drifted"
+    let mut inventory := ["report.json"]
+    for index in [:rows.size] do
+      let row := rows[index]!
+      let name ← strField row "name"
+      need (name == names[index]!) "physical scalar family order drifted"
+      let snapshotName ← strField row "snapshot"
+      let objectName ← strField row "object"
+      need (snapshotName == s!"{name}.json" && objectName == s!"{name}.o") "unsafe physical scalar artifact name"
+      inventory := snapshotName :: objectName :: inventory
+      let snapshot ← readJson (first / snapshotName)
+      let bytes ← IO.FS.readBinFile (first / objectName)
+      inspect row snapshot bytes
+      regressions row snapshot bytes
+      let elf ← inspectElf readelf (first / objectName) "compilatrix_scalar"
+      requireAll elf ["There are no relocations"] "physical scalar local-call object"
+      let assembly ← disassemble objdump (first / objectName) "compilatrix_scalar"
+      requireAll assembly ["push", "rbp", "rdi", "ret"] "physical scalar ABI instructions"
+      if (← number row "runtime_parameters") == 2 then requireAll assembly ["rsi"] "physical scalar second argument"
+      if index > 0 then requireAll assembly ["call", "cmp", "je"] "physical scalar helpers/branches"
+      if let some (cc, harness) := native then
+        let executable := directory / s!"native-{name}"
+        let depth ← number row "stack_depth"
+        let _ ← run cc #["-O2", "-fomit-frame-pointer", "-fno-lto", "-Wall", "-Wextra", "-Werror",
+          s!"-DFAMILY={index}", s!"-DSTACK_DEPTH={depth}", harness.toString, (first / objectName).toString,
+          "-Wl,-z,noexecstack", "-Wl,--fatal-warnings", "-o", executable.toString]
+        let result ← checked (Json.parse (← run executable.toString))
+        need ((← number result "calls") == 166) "physical scalar native call inventory changed"
+        for key in ["saved_registers", "stack", "caller_frame", "guarded_stack"] do
+          need ((← field result key) == toJson true) s!"physical scalar native {key} failed"
+        let headers ← run readelf #["-W", "-l", executable.toString]
+        let stacks := (headers.splitOn "\n").filter (·.contains "GNU_STACK")
+        need (stacks.length == 1 && !stacks.any (·.contains "RWE")) "physical scalar executable stack policy changed"
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      need (((← output.readDir).toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "physical scalar complete file inventory drifted"
+    for file in inventory do
+      need ((← IO.FS.readBinFile (first / file)) == (← IO.FS.readBinFile (second / file))) s!"fresh physical scalar artifact differs: {file}"
+    IO.println "source native physical scalar check ok: seven fresh source artifacts, 133 source/application/object runs, 76 CFG stream runs, 70 corruptions, native ABI and guarded stack checks"
diff --git a/Tests/Compiler/Checks/CheckSourceNativeRuntime.lean b/Tests/Compiler/Checks/CheckSourceNativeRuntime.lean
new file mode 100644
index 000000000..9495031f7
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceNativeRuntime.lean
@@ -0,0 +1,348 @@
+import Ix.Compiler.Tools.UniqueCheck
+import Ix.Compiler.Tools.X86Check
+
+/-! Independent runtime-function artifact gate. No compiler, selector,
+encoder, writer, or evaluator is imported. One object pair is linked once;
+the resulting process supplies every runtime argument and observes release. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck Ix.Compiler.Tools.X86Check
+
+private def fileName (name : String) : Bool :=
+  !name.isEmpty && !name.startsWith "." && !name.contains ".." &&
+    name.toList.all (fun char => char.isAlphanum || char == '-' || char == '.')
+
+private def rejectionNames (count : Nat) : List String :=
+  ["length-sixty-five", "length-word-max", "null-descriptor", "misaligned-descriptor", "wrong-cursor",
+   "insufficient-capacity", "zero-capacity", "excess-capacity", "misaligned-capacity", "wrong-allocs", "wrong-frees",
+   "wrong-reuses", "wrong-live", "wrong-peak", "wrong-rcops", "wrong-payload", "wrong-reservations",
+   "nil-tag", "nil-head", "nil-tail", "nil-padding"] ++
+  (if count == 0 then [] else ["cons-tag", "cons-self-tail", "cons-null-tail", "cons-outside-tail", "cons-padding"])
+
+private def inspectHeap (heap : Json) (input : Array Json) (phase : String) : IO Unit := do
+  let count := input.size
+  let initial := phase == "input"
+  let reclaimed := phase == "reclaimed"
+  let header ← (← arrField heap "header").mapM nat
+  need (header.size == 10) "runtime header shape disagreement"
+  need (header[7]! == 0 && header[9]! == 0) "runtime RC or reservation disagreement"
+  let expected : Array Nat := if initial then
+      #[32 * (count + 1), 32 * (count + 2), count + 1, 0, 0, count + 1, count + 1, 0, 0, 0]
+    else #[32 * (count + 2), 32 * (count + 2), count + 2, if reclaimed then count + 2 else 1,
+      count, if reclaimed then 0 else count + 1, count + 2, 0, 2 * count, 0]
+  need (header == expected) "runtime allocation or reclamation disagreement"
+  let cells ← arrField heap "cells"
+  need (cells.size == count + 2) "runtime cell inventory disagreement"
+  for index in [:cells.size] do
+    let fields ← array cells[index]!
+    need (fields.size == 4 && (← nat fields[3]!) == 0) "runtime padding disagreement"
+    if reclaimed || (!initial && index == 0) then
+      need (fields == #[toJson (3 : Nat), toJson (0 : Nat), Json.null, toJson (0 : Nat)]) "runtime cell not fully reclaimed"
+    else if index == count + 1 || (initial && index == 0) then
+      need (fields == #[toJson (0 : Nat), toJson (0 : Nat), Json.null, toJson (0 : Nat)]) "runtime nil or spare cell disagreement"
+    else
+      need ((← nat fields[0]!) == 1 && fields[1]! == input[count - index]!) "runtime payload disagreement"
+      need (fields[2]! == toJson (if initial then index - 1 else index + 1)) "runtime pointer disagreement"
+
+private def inspectPrefixes (observations : Json) (count : Nat) (foldCounters : Bool) : IO Unit := do
+  let prefixes ← arrField observations "prefixes"
+  need (prefixes.size == (if foldCounters then 7 else 8) * count + 22) "runtime macro-boundary inventory disagreement"
+  let mut previous := 0
+  for index in [:prefixes.size] do
+    let row := prefixes[index]!
+    let step ← number row "step"
+    need ((index == 0 && step == 0) || (index > 0 && previous < step)) "runtime prefix sequence gap"
+    previous := step
+    let block ← number row "block"
+    let offset ← number row "offset"
+    let halted := (← field row "halted") == toJson true
+    need (offset == 0 || (block == 2 && offset == 20) || (!foldCounters && block == 5 && offset == 10) || halted)
+      "runtime observation is not a macro boundary"
+    let header ← (← arrField row "header").mapM nat
+    let tags ← (← arrField row "tags").mapM nat
+    need (header.size == 10 && tags.all (· < 4)) "runtime prefix memory shape disagreement"
+    let live := tags.countP (fun tag => tag == 0 || tag == 1)
+    let reservations := tags.countP (· == 2)
+    let freed := tags.countP (· == 3)
+    need (header[0]! == 32 * tags.size && header[1]! == 32 * (count + 2) &&
+      header[2]! == tags.size && header[3]! == freed && header[5]! == live && header[9]! == reservations &&
+      reservations ≤ 1 && count + 1 ≤ tags.size && tags.size ≤ count + 2) "runtime prefix ownership accounting disagreement"
+    need (header[7]! == 0 && live ≤ header[6]! && header[6]! ≤ count + 2) "runtime prefix RC or peak disagreement"
+    need (halted == (index + 1 == prefixes.size)) "runtime prefix halt disagreement"
+  need (previous == (if foldCounters then 30 else 42) * count + 82) "runtime control cost disagreement"
+  need ((← field prefixes.back! "header") == (← field (← field observations "returned") "header"))
+    "runtime terminal prefix disagrees"
+
+private def inspectPipeline (report pipeline : Json) (foldCounters : Bool) : IO Unit := do
+  need ((← strField pipeline "format") == "compilatrix/source-native-runtime-pipeline/1") "runtime pipeline format disagreement"
+  let source ← field pipeline "source"
+  need ((← field source "identity") == (← field report "source_identity") &&
+    (← field source "argument_worlds") == toJson ["unique"] && (← strField source "result_world") == "unique" &&
+    (← field source "entry_refs") == Json.arr #[← field source "root"]) "runtime source function contract disagreement"
+  let constants ← arrField source "constants"
+  need (constants.size == 8) "runtime source inventory disagreement"
+  let constantBytes ← constants.mapM fun entry => do
+    hashField entry "bytes" "key" "Ixon constant"
+    return (← byteField entry "key") ++ blob (← byteField entry "bytes")
+  let refs ← (← arrField source "entry_refs").mapM bytes
+  let univs ← (← arrField source "entry_univs").mapM fun value => do return blob (← bytes value)
+  let sourceBytes := "compilatrix/closed-ixon-input/1\x00".toUTF8 ++ vector constantBytes ++ vector refs ++ vector univs ++
+    blob (← byteField source "entry")
+  need (sourceBytes == (← byteField source "input_bytes")) "runtime source canonical preimage disagreement"
+  hashField source "input_bytes" "identity" "source"
+  let ir0 ← field pipeline "ixir0"
+  for name in ["raw", "raw_main", "declarations", "main", "groups", "blocks", "address_map"] do
+    need ((← field ir0 name) != Json.null) s!"missing runtime IxIR0 artifact: {name}"
+  let graph ← field pipeline "ixir1"
+  need ((← field graph "root") == (← field report "ixir1_root")) "runtime graph identity disagreement"
+  let artifacts ← arrField graph "artifacts"
+  need (artifacts.size == 2 && (← field artifacts[0]! "root") == (← field pipeline "entry_address") &&
+    (← field artifacts[1]! "root") == (← field pipeline "worker_address") &&
+    (← field pipeline "entry_address") != (← field pipeline "worker_address")) "runtime function inventory disagreement"
+  let artifactBytes ← artifacts.mapM fun artifact => do
+    need ((← strField artifact "kind") == "ordinary") "runtime function is not canonically addressed"
+    hashField artifact "preimage" "root" "IxIR1 declaration"
+    return tag 1 ++ (← byteField artifact "root") ++ blob (← byteField artifact "preimage")
+  let graphBytes := "compilatrix/ixir1/optimizer-graph/1\x00".toUTF8 ++ vector artifactBytes ++ blob (← byteField graph "main")
+  need (digest graphBytes == (← strField graph "root")) "runtime graph preimage disagreement"
+  let abi ← field pipeline "abi"
+  let selector := if foldCounters then "unique-reverse-runtime-x86/2" else "unique-reverse-runtime-x86/1"
+  need ((← strField abi "policy") == "unique-list-runtime-arena/1" &&
+    (← strField abi "selector") == selector &&
+    (← number abi "max_length") == 64 && (← number abi "header_words") == 10 && (← number abi "cell_words") == 4)
+    "runtime ABI disagreement"
+  let policies ← field pipeline "policies"
+  let policyValues := [("source", "unique-reverse-runtime/1"), ("usage", "recursor-modes/1"),
+    ("lowering", "consuming-unique-recursor/1"), ("reuse", "static-unique-reuse/1"), ("execution", "call-local/0")]
+  for (key, expected) in policyValues do
+    need ((← strField policies key) == expected) "runtime policy disagreement"
+  let target ← field pipeline "ixir2_diagnostic"
+  for key in ["baseline", "selected", "baseline_stats", "selected_stats"] do
+    need ((← field target key) != Json.null) s!"missing runtime target artifact: {key}"
+  let limits ← field target "limits"
+  let limitValues ← ["maxDeclarations", "maxBlocks", "maxBlocksPerFunction", "maxInstructionsPerBlock", "maxValueParams",
+    "maxCreditParams", "maxOperands", "maxAlternatives", "maxValueRegisters", "maxCreditRegisters", "maxScalarLeafFacts",
+    "maxFlowWork"].toArray.mapM fun key => do return uleb (← number limits key)
+  let schema ← field pipeline "schema"
+  for role in ["main", "release"] do
+    let object ← field pipeline role
+    let version := if role == "main" then (if foldCounters then 3 else 1) else 2
+    need ((← strField object "file") == s!"{role}.o" && (← strField object "role") == role &&
+      (← strField object "symbol") == (if role == "main" then "compilatrix_runtime_reverse" else "compilatrix_runtime_drop"))
+      "runtime object role disagreement"
+    need ((← number object "lowering_version") == 3 && (← number object "role_version") == version)
+      "runtime object version disagreement"
+    let expected := "compilatrix/native-runtime-unique-provenance/1\x00".toUTF8 ++
+      (← byteField source "identity") ++ (← byteField graph "root") ++
+      (← byteField pipeline "entry_address") ++ (← byteField pipeline "worker_address") ++
+      (policyValues.foldl (fun out pair => out ++ blob pair.2.toUTF8) ByteArray.empty) ++
+      uleb (← number policies "check_fuel") ++ uleb (← number policies "erase_fuel") ++ vector limitValues ++
+      blob "unique-list-runtime-arena/1".toUTF8 ++ blob selector.toUTF8 ++ uleb 64 ++ uleb 10 ++ uleb 4 ++
+      (← byteField schema "nil") ++ (← byteField schema "cons") ++ blob role.toUTF8 ++ uleb 3 ++ uleb version ++
+      (if foldCounters then blob "unique-reserve-reuse-counter-fold/1".toUTF8 else ByteArray.empty)
+    need (expected == (← byteField object "policy_bytes")) "runtime policy preimage disagreement"
+    hashField object "policy_bytes" "policy_identity" "runtime policy"
+    need ((← field object "policy_identity") == (← field report s!"{role}_policy") &&
+      (← field object "identity") == (← field report s!"{role}_identity")) "runtime object summary disagreement"
+    let provenance := "compilatrix/x86-object-provenance/1".toUTF8 ++
+      (← checked (unhex ("00 00 " ++ (← strField graph "root") ++ " 03 00 00 00 " ++
+        (if role == "main" then (if foldCounters then "03" else "01") else "02") ++ " 00 00 00")))
+    need (provenance == (← byteField object "provenance")) "runtime ELF provenance disagreement"
+    need ((← number object "relocations") == 0 && !(← strField object "typed_program_diagnostic").isEmpty)
+      "runtime leaf artifact disagreement"
+
+private def inspectCase (schema row snapshot : Json) (foldCounters : Bool) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-native-runtime-case/1" &&
+    (← field snapshot "summary") == row) "runtime snapshot/report disagreement"
+  let input ← arrField row "input"
+  let count := input.size
+  need (count ≤ 64) "runtime accepted excess length"
+  for value in input do need ((← nat value) < 18446744073709551616) "runtime truncated a Nat"
+  need ((← field row "value") == Json.arr input.reverse && (← field snapshot "source") == Json.arr input.reverse &&
+    (← field snapshot "ixir0") == Json.arr input.reverse) "runtime source result disagreement"
+  for stage in ["ixir1", "baseline_logical", "baseline_physical", "selected_logical", "selected_physical"] do
+    let observed ← field snapshot stage
+    need ((← field observed "value") == Json.arr input.reverse) s!"{stage}: runtime value disagreement"
+    let reused := if stage == "selected_physical" then count else 0
+    for phase in ["input", "store", "reclaimed"] do
+      let store ← field observed phase
+      let heap ← if stage == "ixir1" then pure store else field store "heap"
+      let initial := phase == "input"
+      let saved := if initial then 0 else reused
+      let live := (← arrField heap "nodes").countP (· != Json.null)
+      if phase != "reclaimed" then
+        inspectList schema heap (← field observed (if initial then "argument" else "result")) (if initial then input else input.reverse)
+      need ((← number heap "rcops") == 0) "runtime physical RC disagreement"
+      need ((← number heap "allocs") + saved == (if initial then count + 1 else 2 * count + 2) &&
+        (← number heap "reuses") == saved && live + (← number heap "frees") == (← number heap "allocs") &&
+        live == (if phase == "reclaimed" then 0 else count + 1)) "runtime physical allocation or reclamation disagreement"
+      if stage != "ixir1" then
+        need ((← number store "peakLiveNodes") == count + (if initial then 1 else 2) &&
+          (← number store "reusedPayloadUnits") == 2 * saved) "runtime physical peak or payload disagreement"
+        for key in ["resetAttempts", "hotResets", "coldResets"] do
+          need ((← number store key) == 0) "runtime shared reset disagreement"
+    if stage != "ixir1" then
+      need ((← number observed "control_cost") == (if stage.startsWith "selected" then 4 else 5) * count + 6 &&
+        (← number observed "control_remaining") == 0 && (← number observed "heap_remaining") == 0 &&
+        (← number observed "reclamation_remaining") == 0) "runtime physical control cost disagreement"
+  let native ← field snapshot "native"
+  need ((← number native "root") == 1 && (← field native "value") == Json.arr input.reverse) "runtime result root disagreement"
+  need ((← number row "main_steps") == (if foldCounters then 30 else 42) * count + 82 &&
+    (← number row "release_steps") == 17 * count + 16)
+    "runtime step budget disagreement"
+  for phase in ["input", "returned", "reclaimed"] do inspectHeap (← field native phase) input phase
+  need ((← field native "rejections") == toJson (rejectionNames count) &&
+    (← field row "rejections") == (← field native "rejections")) "runtime rejection inventory disagreement"
+  inspectPrefixes native count foldCounters
+  need ((← number row "prefixes") == (← arrField native "prefixes").size) "runtime prefix summary disagreement"
+
+private def hexValue (value : String) : IO Nat := do
+  let mut number := 0
+  for char in value.toList do
+    let some digit := hexDigit char | throw (IO.userError "invalid readelf hex offset")
+    number := 16 * number + digit
+  return number
+
+private def inspectText (readelf : String) (path : FilePath) (expected : ByteArray) : IO Unit := do
+  let dump ← run readelf #["-W", "-x", ".text", path.toString]
+  let mut actual := ByteArray.empty
+  for line in dump.splitOn "\n" do
+    let parts := words line
+    if !(parts.headD "").startsWith "0x" then continue
+    let offset ← hexValue ((parts.headD "").drop 2).toString
+    need (offset == actual.size && offset < expected.size) "readelf text offsets disagree"
+    let count := min 16 (expected.size - offset)
+    let row ← checked (unhex (String.join (parts.drop 1 |>.take ((count + 3) / 4))))
+    need (row.size == count) "readelf text row size disagrees"
+    actual := actual ++ row
+  need (actual == expected) "ELF text differs from selected encoding"
+
+private def inspectObject (directory : FilePath) (pipeline : Json) (role readelf objdump : String) : IO Unit := do
+  let object ← field pipeline role
+  let path := directory / (← strField object "file")
+  let content ← IO.FS.readBinFile path
+  need (content.size == (← number object "size") && digest content == (← strField object "identity"))
+    "runtime object bytes disagree with identity"
+  let elf ← inspectElf readelf path (← strField object "symbol")
+  need (elf.contains "There are no relocations in this file.") "runtime object has external relocations"
+  need (containsBytes content (← byteField object "provenance")) "runtime object lost exact provenance"
+  inspectText readelf path (← byteField object "text")
+  let disassembly ← disassemble objdump path (← strField object "symbol")
+  for forbidden in ["call ", "push ", "pop ", "rsp", "rbx", "rbp", "r12", "r13", "r14", "r15"] do
+    need (!disassembly.contains forbidden) s!"runtime leaf uses forbidden instruction or register: {forbidden}"
+
+private def nativeRun (cc readelf : String) (harness directory executable : FilePath)
+    (rows : Array Json) (snapshots : Array Json) : IO Unit := do
+  let initializers ← rows.mapM fun row => do
+    let name ← strField row "name"
+    need (fileName name) "unsafe native case name"
+    let values ← (← arrField row "input").mapM fun value => do return s!"UINT64_C({← nat value})"
+    return "{\"" ++ name ++ "\"," ++ toString values.size ++ ",{ " ++
+      (if values.isEmpty then "0" else String.intercalate "," values.toList) ++ " }}"
+  IO.FS.writeFile (directory / "runtime_cases.h")
+    ("static const Input inputs[] = {\n" ++ String.intercalate ",\n" initializers.toList ++ "\n};\n")
+  let _ ← run cc #["-std=c11", "-O2", "-fomit-frame-pointer", "-Wall", "-Wextra", "-Werror",
+    "-Wl,--fatal-warnings", "-no-pie", "-I", directory.toString, harness.toString,
+    (directory / "main.o").toString, (directory / "release.o").toString, "-o", executable.toString]
+  let observed ← array (← checked (Json.parse (← run executable.toString #[])))
+  need (observed.size == rows.size) "linked runtime case inventory disagreement"
+  for index in [:rows.size] do
+    need ((← field observed[index]! "name") == (← field rows[index]! "name")) "linked runtime case order disagreement"
+    let expected ← field snapshots[index]! "native"
+    for key in ["input", "root", "value", "returned", "reclaimed", "rejections"] do
+      need ((← field observed[index]! key) == (← field expected key)) s!"linked runtime observation differs from byte evaluator: {key}"
+  let headers ← run readelf #["-W", "-l", executable.toString]
+  let stacks := (headers.splitOn "\n").filter (·.contains "GNU_STACK")
+  need (stacks.length == 1 && !stacks.any (·.contains "RWE")) "runtime executable stack is executable"
+
+private def regressions (report pipeline row snapshot : Json) (foldCounters : Bool) : IO Unit := do
+  for (name, path, replacement, fragment) in [
+      ("ABI", ["abi", "cell_words"], toJson (3 : Nat), "runtime ABI"),
+      ("word bound", ["abi", "max_length"], toJson (65 : Nat), "runtime ABI"),
+      ("argument world", ["source", "argument_worlds"], toJson ["shared"], "source function contract"),
+      ("policy", ["main", "policy_bytes"], toJson "00", "policy preimage"),
+      ("ELF root", ["release", "provenance"], toJson "00", "ELF provenance"),
+      ("role", ["release", "symbol"], toJson "compilatrix_runtime_reverse", "object role"),
+      ("graph", ["ixir1", "main"], toJson "00", "graph preimage"),
+      ("entry", ["entry_address"], ← field pipeline "worker_address", "function inventory")] do
+    rejects s!"{name} corruption" fragment (inspectPipeline report (← replaceAt pipeline path replacement) foldCounters)
+  rejects "counter-fold selector corruption" "runtime ABI"
+    (inspectPipeline report (← replaceAt pipeline ["abi", "selector"]
+      (toJson (if foldCounters then "unique-reverse-runtime-x86/1" else "unique-reverse-runtime-x86/2"))) foldCounters)
+  rejects "counter-fold role corruption" "object version"
+    (inspectPipeline report (← replaceAt pipeline ["main", "role_version"]
+      (toJson (if foldCounters then (1 : Nat) else 3))) foldCounters)
+  let schema ← field pipeline "schema"
+  for (name, path, replacement, fragment) in [
+      ("root", ["native", "root"], toJson (0 : Nat), "result root"),
+      ("rejections", ["native", "rejections"], toJson ([] : List String), "rejection inventory"),
+      ("physical RC", ["selected_physical", "store", "heap", "rcops"], toJson (1 : Nat), "physical RC"),
+      ("peak", ["selected_physical", "store", "peakLiveNodes"], toJson (99 : Nat), "peak or payload")] do
+    rejects s!"{name} corruption" fragment (inspectCase schema row (← replaceAt snapshot path replacement) foldCounters)
+  let changedRow ← replaceAt row ["main_steps"] (toJson (0 : Nat))
+  rejects "counter-fold step corruption" "step budget"
+    (inspectCase schema changedRow (← replaceAt snapshot ["summary"] changedRow) foldCounters)
+  let cells ← arrField (← field (← field snapshot "native") "returned") "cells"
+  let cell ← array cells[1]!
+  for (fieldIndex, replacement, fragment) in [(2, toJson (1 : Nat), "runtime pointer"), (3, toJson (1 : Nat), "runtime padding")] do
+    let changed ← replaceAt snapshot ["native", "returned", "cells"] (Json.arr (cells.set! 1 (Json.arr (cell.set! fieldIndex replacement))))
+    rejects "cell corruption" fragment (inspectCase schema row changed foldCounters)
+  let freed ← arrField (← field (← field snapshot "native") "reclaimed") "cells"
+  let changed ← replaceAt snapshot ["native", "reclaimed", "cells"] (Json.arr (freed.set! 1 cells[1]!))
+  rejects "reclamation corruption" "cell not fully reclaimed" (inspectCase schema row changed foldCounters)
+
+def main (args : List String) : IO UInt32 := cli "source native runtime check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected", "--readelf", "--objdump", "--cc", "--harness", "--variant", "--artifacts"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let variant := option args "--variant" "baseline"
+  need (variant == "baseline" || variant == "counter-fold") "--variant must be baseline or counter-fold"
+  let foldCounters := variant == "counter-fold"
+  let expected ← readJson (option args "--expected" (if foldCounters then
+    "Tests/Fixtures/Compiler/source-native-runtime/expected-counter-fold.json" else "Tests/Fixtures/Compiler/source-native-runtime/expected.json"))
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  let native ← nativeArgs args
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      requireAll (← run fixture ((if foldCounters then #["--counter-fold"] else #[]) ++ #[output.toString]))
+        ["source-native-runtime ok:"] "runtime producer"
+    let report ← readJson (first / "report.json")
+    need (report == expected && (← strField report "format") == "compilatrix/source-native-runtime-report/1")
+      "reviewed runtime source, object, resource, or rejection matrix drifted"
+    let pipeline ← readJson (first / "pipeline.json")
+    need ((← strField report "pipeline") == "pipeline.json" &&
+      digest pipeline.compress.toUTF8 == (← strField report "pipeline_identity")) "runtime pipeline snapshot identity disagreement"
+    let rows ← arrField report "cases"
+    need (rows.size == 8 && (← arrField report "adapter_and_selection_rejections").size == 6) "runtime matrix inventory disagreement"
+    let mut inventory := ["report.json", "pipeline.json", "main.o", "release.o"]
+    for row in rows do
+      let name ← strField row "snapshot"
+      need (fileName name && !inventory.contains name) "invalid or duplicate runtime artifact path"
+      inventory := name :: inventory
+    inventory := inventory.mergeSort (· ≤ ·)
+    let outputs := [first, second] ++ (optional args "--artifacts").toList.map FilePath.mk
+    for output in outputs do
+      let files ← output.readDir
+      need ((files.toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "runtime artifact inventory drifted"
+      for file in files do need (!(← file.path.isDir)) "unexpected runtime artifact directory"
+    for name in inventory do
+      for output in outputs.tail do
+        need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (output / name))) s!"fresh or supplied runtime artifacts differ: {name}"
+    inspectPipeline report pipeline foldCounters
+    for role in ["main", "release"] do inspectObject first pipeline role readelf objdump
+    let snapshots ← rows.mapM fun row => do
+      let snapshot ← readJson (first / (← strField row "snapshot"))
+      inspectCase (← field pipeline "schema") row snapshot foldCounters
+      return snapshot
+    if let some (cc, harness) := native then nativeRun cc readelf harness first (directory / "runtime-native") rows snapshots
+    let some three := rows.findIdx? (fun row => (row.getObjValAs? String "name").toOption == some "three")
+      | throw (IO.userError "missing runtime three-element regression")
+    regressions report pipeline rows[three]! snapshots[three]! foldCounters
+    let mainBytes ← IO.FS.readBinFile (first / "main.o")
+    for corrupt in [mainBytes.extract 0 (mainBytes.size - 1), ← IO.FS.readBinFile (first / "release.o")] do
+      IO.FS.writeBinFile (first / "main.o") corrupt
+      rejects "object corruption" "object bytes disagree" (inspectObject first pipeline "main" readelf objdump)
+    IO.FS.writeBinFile (first / "main.o") mainBytes
+    let suffix := if native.isSome then ", one linked process runs all eight inputs" else ""
+    IO.println s!"source native runtime check ok: {variant}, two fresh artifact sets, one compiled function and ELF pair, canonical provenance, 20 corruption regressions, complete reclamation{suffix}"
diff --git a/Tests/Compiler/Checks/CheckSourceNativeScalar.lean b/Tests/Compiler/Checks/CheckSourceNativeScalar.lean
new file mode 100644
index 000000000..9deebe110
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceNativeScalar.lean
@@ -0,0 +1,58 @@
+import Ix.Compiler.Tools.ScalarNativeCheck
+import Ix.Compiler.Tools.X86Check
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+open Ix.Compiler.Tools.X86Check Ix.Compiler.Tools.ScalarNativeCheck
+
+def main (args : List String) : IO UInt32 := cli "source native scalar check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected", "--cc", "--harness", "--readelf", "--objdump"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-native-scalar/expected.json")
+  let native ← nativeArgs args
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      requireAll (← run fixture #[output.toString]) ["source-native-scalar ok:"] "scalar source producer"
+    need ((← readJson (first / "report.json")) == expected) "scalar reviewed report drifted"
+    let rows ← arrField expected "cases"
+    need (rows.size == 5) "scalar source inventory drifted"
+    let mut inventory := ["report.json"]
+    for index in [:rows.size] do
+      let row := rows[index]!
+      let name ← strField row "name"
+      need (name == #["add", "sub", "diamond", "helpers", "nested"][index]!) "scalar family order drifted"
+      let snapshotName ← strField row "snapshot"
+      let objectName ← strField row "object"
+      need (snapshotName == s!"{name}.json" && objectName == s!"{name}.o") "unsafe scalar artifact name"
+      inventory := snapshotName :: objectName :: inventory
+      let snapshot ← readJson (first / snapshotName)
+      let bytes ← IO.FS.readBinFile (first / objectName)
+      inspect row snapshot bytes
+      regressions row snapshot bytes
+      let elf ← inspectElf readelf (first / objectName) "compilatrix_scalar"
+      requireAll elf ["There are no relocations"] "scalar local-call object"
+      let assembly ← disassemble objdump (first / objectName) "compilatrix_scalar"
+      requireAll assembly ["push", "rbp", "rdi", "rsi", "ret"] "scalar ABI instructions"
+      if index == 3 || index == 4 then requireAll assembly ["call"] "scalar helper calls"
+      if let some (cc, harness) := native then
+        let executable := directory / s!"native-{name}"
+        let depth ← number row "stack_depth"
+        let _ ← run cc #["-O2", "-fomit-frame-pointer", "-fno-lto", "-Wall", "-Wextra", "-Werror",
+          s!"-DFAMILY={index}", s!"-DSTACK_DEPTH={depth}", harness.toString, (first / objectName).toString,
+          "-Wl,-z,noexecstack", "-Wl,--fatal-warnings", "-o", executable.toString]
+        let result ← checked (Json.parse (← run executable.toString))
+        need ((← number result "calls") == 166) "scalar native call inventory changed"
+        for key in ["saved_registers", "stack", "caller_frame", "guarded_stack"] do
+          need ((← field result key) == toJson true) s!"scalar native {key} failed"
+        let headers ← run readelf #["-W", "-l", executable.toString]
+        let stacks := (headers.splitOn "\n").filter (·.contains "GNU_STACK")
+        need (stacks.length == 1 && !stacks.any (·.contains "RWE")) "scalar executable stack policy changed"
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      need (((← output.readDir).toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "scalar complete file inventory drifted"
+    for file in inventory do
+      need ((← IO.FS.readBinFile (first / file)) == (← IO.FS.readBinFile (second / file))) s!"fresh scalar artifact differs: {file}"
+    IO.println "source native scalar check ok: five fresh source artifacts, 95 object runs, 25 corruption checks, native ABI and guarded stack checks"
diff --git a/Tests/Compiler/Checks/CheckSourceNativeUnique.lean b/Tests/Compiler/Checks/CheckSourceNativeUnique.lean
new file mode 100644
index 000000000..b53111084
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceNativeUnique.lean
@@ -0,0 +1,241 @@
+import Ix.Compiler.Tools.UniqueCheck
+import Ix.Compiler.Tools.X86Check
+
+/-! Independent Ixon-to-native artifact checker. Compiler, selector, encoder,
+writer, and evaluator modules are absent. Canonical preimages are rebuilt;
+binutils decodes the objects and the C harness observes actual machine runs. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck Ix.Compiler.Tools.X86Check
+
+private def fileName (name : String) : Bool :=
+  !name.isEmpty && !name.startsWith "." && !name.contains ".." &&
+    name.toList.all (fun char => char.isAlphanum || char == '-' || char == '.')
+
+private def inspectHeap (heap : Json) (input : Array Json) (reclaimed : Bool) : IO Unit := do
+  let count := input.size
+  let header ← (← arrField heap "header").mapM nat
+  need (header.size == 10) "native header shape disagreement"
+  need (header[7]! == 0) "native RC disagreement"
+  need (header[6]! == count + 2) "native peak disagreement"
+  need (header[8]! == 2 * count) "native payload disagreement"
+  need (header[9]! == 0) "native reservation leaked"
+  let expected : Array Nat := #[32 * (count + 2), 32 * (count + 2), count + 2,
+    if reclaimed then count + 2 else 1, count, if reclaimed then 0 else count + 1, count + 2, 0, 2 * count, 0]
+  need (header == expected) "native allocation or reclamation disagreement"
+  let cells ← arrField heap "cells"
+  need (cells.size == count + 2) "native cell inventory disagreement"
+  for index in [:cells.size] do
+    let fields ← array cells[index]!
+    need (fields.size == 4) "native cell arity disagreement"
+    need ((← nat fields[3]!) == 0) "native padding disagreement"
+    if reclaimed || index == 0 then
+      need (fields == #[toJson (3 : Nat), toJson (0 : Nat), Json.null, toJson (0 : Nat)]) "native cell not fully reclaimed"
+    else if index == count + 1 then
+      need (fields == #[toJson (0 : Nat), toJson (0 : Nat), Json.null, toJson (0 : Nat)]) "native nil disagreement"
+    else
+      need ((← nat fields[0]!) == 1 && fields[1]! == input[count - index]!) "native reversed payload disagreement"
+      need (fields[2]! == toJson (index + 1)) "native pointer is cyclic, aliased, or outside its owned chain"
+
+private def inspectPrefixes (observations : Json) (count : Nat) : IO Unit := do
+  let prefixes ← arrField observations "prefixes"
+  need (prefixes.size == 4 * count + 8) "native macro-boundary inventory disagreement"
+  let mut previous := 0
+  for index in [:prefixes.size] do
+    let row := prefixes[index]!
+    let step ← number row "step"
+    need ((index == 0 && step == 0) || (index > 0 && previous < step)) "native prefix sequence gap"
+    previous := step
+    let block ← number row "block"
+    let offset ← number row "offset"
+    let halted := (← field row "halted") == toJson true
+    need (offset == 0 || (block == 2 && offset % 20 == 0) || (block == 5 && offset == 10) || halted)
+      "native observation is not a macro boundary"
+    let header ← (← arrField row "header").mapM nat
+    let tags ← (← arrField row "tags").mapM nat
+    need (header.size == 10 && tags.all (· < 4)) "native prefix memory shape disagreement"
+    let live := tags.countP (fun tag => tag == 0 || tag == 1)
+    let reservations := tags.countP (· == 2)
+    let freed := tags.countP (· == 3)
+    need (header[0]! == 32 * tags.size && header[1]! == 32 * (count + 2) &&
+      header[2]! == tags.size && header[3]! == freed && header[5]! == live && header[9]! == reservations &&
+      reservations ≤ 1 && tags.size ≤ count + 2) "native prefix ownership accounting disagreement"
+    need (header[7]! == 0 && live ≤ header[6]! && header[6]! ≤ count + 2) "native prefix RC or peak disagreement"
+    need (halted == (index + 1 == prefixes.size)) "native prefix halt disagreement"
+  need (previous == 51 * count + 62) "native control cost disagreement"
+  need ((← field prefixes.back! "header") == (← field (← field observations "returned") "header"))
+    "native terminal prefix disagrees"
+
+private def inspectPolicy (row snapshot : Json) (role : String) : IO Unit := do
+  let object ← field snapshot role
+  let source ← field snapshot "source_pipeline"
+  let schema ← field (← field (← field source "specialization") "plan") "schema"
+  let input ← arrField row "input"
+  let encodedInput ← input.mapM fun value => do return uleb (← nat value)
+  let version := if role == "main" then 1 else 2
+  need ((← strField object "role") == role && (← strField object "symbol") ==
+    (if role == "main" then "compilatrix_main" else "compilatrix_unique_drop")) "native object role disagreement"
+  need ((← number object "lowering_version") == 2 && (← number object "role_version") == version)
+    "native object policy version disagreement"
+  let expected := "compilatrix/native-unique-provenance/1\x00".toUTF8 ++
+    (← byteField row "source_policy") ++ (← byteField row "ixir1_root") ++
+    blob "unique-list-arena/1".toUTF8 ++ blob "unique-reverse-x86/1".toUTF8 ++ uleb 64 ++ uleb 10 ++ uleb 4 ++
+    (← byteField schema "nil") ++ (← byteField schema "cons") ++ vector encodedInput ++
+    blob role.toUTF8 ++ uleb 2 ++ uleb version
+  need (expected == (← byteField object "policy_bytes")) "native policy preimage disagreement"
+  hashField object "policy_bytes" "policy_identity" "native policy"
+  need ((← field object "policy_identity") == (← field row s!"{role}_policy")) "native policy summary disagreement"
+  let provenance := "compilatrix/x86-object-provenance/1".toUTF8 ++
+    (← checked (unhex ("00 00 " ++ (← strField row "ixir1_root") ++ " 02 00 00 00 " ++
+      (if role == "main" then "01" else "02") ++ " 00 00 00")))
+  need (provenance == (← byteField object "provenance")) "native ELF provenance disagreement"
+  need ((← number object "relocations") == 0 && !(← strField object "typed_program_diagnostic").isEmpty)
+    "native leaf artifact disagreement"
+  need ((← strField object "file") == (← strField row s!"{role}_object") &&
+    (← field object "identity") == (← field row s!"{role}_object_identity")) "native object summary disagreement"
+
+private def inspectNative (row snapshot : Json) : IO Unit := do
+  need ((← strField snapshot "format") == "compilatrix/source-native-unique-case/1" &&
+    (← field snapshot "summary") == row) "native snapshot/report disagreement"
+  let input ← arrField row "input"
+  need (input.size ≤ 64) "native accepted excess length"
+  for value in input do need ((← nat value) < 18446744073709551616) "native truncated a Nat"
+  need ((← field row "value") == Json.arr input.reverse) "native source result disagreement"
+  let source ← field snapshot "source_pipeline"
+  let sourceRow ← field source "summary"
+  inspectSnapshot sourceRow source
+  need ((← field sourceRow "input") == Json.arr input && (← field sourceRow "optimized") == toJson true &&
+    (← field sourceRow "source_identity") == (← field row "source_identity") &&
+    (← field sourceRow "ixir1_root") == (← field row "ixir1_root") &&
+    (← field sourceRow "provenance") == (← field row "source_policy")) "native/source compilation disagreement"
+  let abi ← field snapshot "abi"
+  need ((← strField abi "policy") == "unique-list-arena/1" && (← strField abi "selector") == "unique-reverse-x86/1" &&
+    (← number abi "max_length") == 64 && (← number abi "header_words") == 10 && (← number abi "cell_words") == 4)
+    "native ABI disagreement"
+  for role in ["main", "release"] do inspectPolicy row snapshot role
+  need ((← number row "main_steps") == 51 * input.size + 62 &&
+    (← number row "release_steps") == 17 * input.size + 16) "native step budget disagreement"
+  let observations ← field snapshot "observations"
+  need ((← field observations "value") == (← field row "value") && (← number observations "root") == 1)
+    "native result root disagreement"
+  for (phase, reclaimed) in [("returned", false), ("reclaimed", true)] do
+    let heap ← field observations phase
+    inspectHeap heap input reclaimed
+    need ((← field heap "header") == (← field (← field row "headers") phase)) "native summary counters disagree"
+  need ((← field observations "capacity_rejections") == toJson ["one-byte-short", "zero-capacity", "nonzero-cursor", "cursor-overflow"])
+    "native capacity rejection inventory disagreement"
+  inspectPrefixes observations input.size
+
+private def hexValue (value : String) : IO Nat := do
+  let mut number := 0
+  for char in value.toList do
+    let some digit := hexDigit char | throw (IO.userError "invalid readelf hex offset")
+    number := 16 * number + digit
+  return number
+
+private def inspectText (readelf : String) (path : FilePath) (expected : ByteArray) : IO Unit := do
+  let dump ← run readelf #["-W", "-x", ".text", path.toString]
+  let mut actual := ByteArray.empty
+  for line in dump.splitOn "\n" do
+    let parts := words line
+    if !(parts.headD "").startsWith "0x" then continue
+    let offset ← hexValue ((parts.headD "").drop 2).toString
+    need (offset == actual.size && offset < expected.size) "readelf text offsets disagree"
+    let count := min 16 (expected.size - offset)
+    let groups := parts.drop 1 |>.take ((count + 3) / 4)
+    let row ← checked (unhex (String.join groups))
+    need (row.size == count) "readelf text row size disagrees"
+    actual := actual ++ row
+  need (actual == expected) "ELF text differs from selected encoding"
+
+private def inspectObject (directory : FilePath) (row snapshot : Json) (role readelf objdump : String) : IO Unit := do
+  let object ← field snapshot role
+  let path := directory / (← strField object "file")
+  let content ← IO.FS.readBinFile path
+  need (content.size == (← number object "size") && digest content == (← strField object "identity"))
+    "native object bytes disagree with identity"
+  let elf ← inspectElf readelf path (← strField object "symbol")
+  need (elf.contains "There are no relocations in this file.") "native object has external relocations"
+  need (containsBytes content (← byteField object "provenance")) "native object lost exact provenance"
+  inspectText readelf path (← byteField object "text")
+  let disassembly ← disassemble objdump path (← strField object "symbol")
+  for forbidden in ["call ", "push ", "pop ", "rsp", "rbx", "rbp", "r12", "r13", "r14", "r15"] do
+    need (!disassembly.contains forbidden) s!"native leaf uses forbidden instruction or register: {forbidden}"
+  need ((← strField row s!"{role}_object") == path.fileName.getD "") "native object path disagreement"
+
+private def nativeRun (cc readelf : String) (harness directory executable : FilePath) (row snapshot : Json) : IO Unit := do
+  let _ ← run cc #["-std=c11", "-O2", "-fomit-frame-pointer", "-Wall", "-Wextra", "-Werror",
+    "-Wl,--fatal-warnings", "-no-pie", harness.toString,
+    (directory / (← strField row "main_object")).toString, (directory / (← strField row "release_object")).toString,
+    "-o", executable.toString]
+  let input ← arrField row "input"
+  let args ← input.mapM fun value => do return toString (← nat value)
+  let observed ← checked (Json.parse (← run executable.toString args))
+  let expected ← field snapshot "observations"
+  for key in ["root", "value", "returned", "reclaimed", "capacity_rejections"] do
+    need ((← field observed key) == (← field expected key)) s!"linked native observation differs from byte evaluator: {key}"
+  let headers ← run readelf #["-W", "-l", executable.toString]
+  let stacks := (headers.splitOn "\n").filter (·.contains "GNU_STACK")
+  need (stacks.length == 1 && !stacks.any (·.contains "RWE")) "native executable stack is executable"
+
+private def regressions (row snapshot : Json) : IO Unit := do
+  for (name, path, replacement, fragment) in [
+      ("ABI corruption", ["abi", "cell_words"], toJson (3 : Nat), "native ABI disagreement"),
+      ("native policy corruption", ["main", "policy_bytes"], toJson "00", "native policy preimage"),
+      ("ELF root corruption", ["release", "provenance"], toJson "00", "native ELF provenance"),
+      ("role corruption", ["release", "symbol"], toJson "compilatrix_main", "native object role"),
+      ("root corruption", ["observations", "root"], toJson (0 : Nat), "native result root")] do
+    rejects name fragment (inspectNative row (← replaceAt snapshot path replacement))
+  for (fieldIndex, replacement, fragment) in [(7, 1, "native RC"), (6, 99, "native peak"),
+      (8, 0, "native payload"), (9, 1, "native reservation")] do
+    let header ← arrField (← field (← field snapshot "observations") "returned") "header"
+    let changed ← replaceAt snapshot ["observations", "returned", "header"] (Json.arr (header.set! fieldIndex (toJson replacement)))
+    rejects "counter corruption" fragment (inspectNative row changed)
+  let cells ← arrField (← field (← field snapshot "observations") "returned") "cells"
+  let cell ← array cells[1]!
+  for (fieldIndex, replacement, fragment) in [(2, toJson (1 : Nat), "native pointer"), (3, toJson (1 : Nat), "native padding")] do
+    let changed ← replaceAt snapshot ["observations", "returned", "cells"]
+      (Json.arr (cells.set! 1 (Json.arr (cell.set! fieldIndex replacement))))
+    rejects "cell corruption" fragment (inspectNative row changed)
+  let freed ← arrField (← field (← field snapshot "observations") "reclaimed") "cells"
+  let changed ← replaceAt snapshot ["observations", "reclaimed", "cells"] (Json.arr (freed.set! 1 cells[1]!))
+  rejects "reclamation corruption" "native cell not fully reclaimed" (inspectNative row changed)
+
+def main (args : List String) : IO UInt32 := cli "source native unique check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected", "--readelf", "--objdump", "--cc", "--harness"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-native-unique/expected.json")
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  let native ← nativeArgs args
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      requireAll (← run fixture #[output.toString]) ["source-native-unique ok:"] "native producer"
+    let report ← readJson (first / "report.json")
+    need (report == expected) "reviewed native source, object, resource, or fallback matrix drifted"
+    let rows ← arrField report "cases"
+    need (rows.size == 8 && (← arrField report "selection_rejections").size == 6) "native matrix inventory disagreement"
+    let mut inventory := ["report.json"]
+    for row in rows do
+      for key in ["snapshot", "main_object", "release_object"] do
+        let name ← strField row key
+        need (fileName name && !inventory.contains name) "invalid or duplicate native artifact path"
+        inventory := name :: inventory
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      let files ← output.readDir
+      need ((files.toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "native artifact inventory drifted"
+      for file in files do need (!(← file.path.isDir)) "unexpected native artifact directory"
+    for name in inventory do
+      need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name))) s!"fresh native artifacts differ: {name}"
+    for row in rows do
+      let snapshot ← readJson (first / (← strField row "snapshot"))
+      inspectNative row snapshot
+      for role in ["main", "release"] do inspectObject first row snapshot role readelf objdump
+      if let some (cc, harness) := native then nativeRun cc readelf harness first (directory / s!"{← strField row "name"}-native") row snapshot
+    let some three := rows.find? (fun row => (row.getObjValAs? String "name").toOption == some "three")
+      | throw (IO.userError "missing native three-element regression")
+    regressions three (← readJson (first / (← strField three "snapshot")))
+    let suffix := if native.isSome then ", all eight linked native runs agree" else ""
+    IO.println s!"source native unique check ok: two fresh artifact sets, 16 ELF objects, canonical provenance, 12 native corruption regressions, complete reclamation{suffix}"
diff --git a/Tests/Compiler/Checks/CheckSourceNativeUpstream.lean b/Tests/Compiler/Checks/CheckSourceNativeUpstream.lean
new file mode 100644
index 000000000..53327447d
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceNativeUpstream.lean
@@ -0,0 +1,67 @@
+import Ix.Compiler.Tools.UpstreamNativeCheck
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+open Ix.Compiler.Tools.X86Check Ix.Compiler.Tools.UpstreamNativeCheck
+
+def main (args : List String) : IO UInt32 := cli "source native upstream check failed" do
+  if let ["inspect", directory] := args then
+    let directory : FilePath := directory
+    let report ← readJson (directory / "report.json")
+    let rows ← arrField report "cases"
+    need (rows.size == 1) "named upstream check needs one entry"
+    let row := rows[0]!
+    let snapshot ← readJson (directory / (← strField row "snapshot"))
+    let bytes ← IO.FS.readBinFile (directory / (← strField row "object"))
+    inspect row snapshot bytes
+    IO.println "source native upstream named artifact check ok"
+    return
+  let args ← checked (parseArgs ["--fixture", "--expected", "--cc", "--harness", "--readelf", "--objdump"] args)
+  let some fixture := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-native-upstream/expected.json")
+  let native ← nativeArgs args
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      requireAll (← run fixture #[output.toString]) ["source-native-upstream ok:"] "upstream native producer"
+    need ((← readJson (first / "report.json")) == expected) "upstream native reviewed report drifted"
+    let rows ← arrField expected "cases"
+    need (rows.size == 5) "upstream native source inventory drifted"
+    let mut inventory := ["report.json"]
+    let mut objects := 0
+    for row in rows do
+      let snapshotName ← strField row "snapshot"
+      need (!snapshotName.contains "/" && !snapshotName.contains "..") "unsafe upstream snapshot name"
+      inventory := snapshotName :: inventory
+      if (← field row "object") == Json.null then continue
+      let objectName ← strField row "object"
+      need (!objectName.contains "/" && !objectName.contains "..") "unsafe upstream object name"
+      inventory := objectName :: inventory
+      objects := objects + 1
+      let snapshot ← readJson (first / snapshotName)
+      let bytes ← IO.FS.readBinFile (first / objectName)
+      inspect row snapshot bytes
+      regressions row snapshot bytes
+      let _ ← inspectElf readelf (first / objectName)
+      requireAll (← disassemble objdump (first / objectName)) ["call", "add    rax,0x1"] "computational upstream object"
+      if let some (cc, harness) := native then
+        let value ← number (← field row "observation") "nat"
+        let executable := directory / s!"native-{value}"
+        let _ ← run cc #["-O3", "-fomit-frame-pointer", "-fno-lto", "-Wall", "-Wextra", "-Werror",
+          s!"-DEXPECTED_RESULT={value}", harness.toString, (first / objectName).toString,
+          "-Wl,-z,noexecstack", "-o", executable.toString]
+        let result ← checked (Json.parse (← run executable.toString))
+        need ((← number result "value") == value && (← number result "heap_allocations") == 0)
+          "linked upstream native result or representation disagrees"
+        for key in ["saved_registers", "stack", "caller_frame"] do
+          need ((← field result key) == toJson true) s!"linked upstream native {key} failed"
+    need (objects == 3) "upstream native object inventory drifted"
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      need (((← output.readDir).toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "upstream native complete file inventory drifted"
+    for file in inventory do
+      need ((← IO.FS.readBinFile (first / file)) == (← IO.FS.readBinFile (second / file)))
+        s!"fresh upstream native artifact differs: {file}"
+    IO.println "source native upstream check ok: five unchanged entries, two fresh complete artifact sets, three computational objects, capture transport/corruption/fallback and ABI checks"
diff --git a/Tests/Compiler/Checks/CheckSourceRecursion.lean b/Tests/Compiler/Checks/CheckSourceRecursion.lean
new file mode 100644
index 000000000..278aa5742
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceRecursion.lean
@@ -0,0 +1,122 @@
+import Ix.Compiler.Tools.Check
+
+/-! Independent process/file gate for recursion recovery. The producer builds
+each Ixon program from scratch; this checker imports no compiler or evaluator.
+-/
+
+open Lean System Ix.Compiler.Tools.Check
+
+private def safeName (name : String) : Bool :=
+  !name.isEmpty && name.toList.all (fun c => c.isAlphanum || c == '-' || c == '.') &&
+    !name.contains ".." && !name.startsWith "."
+
+private def requireFields (value : Json) (keys : List String) : IO Unit := do
+  for key in keys do
+    let child ← field value key
+    need (child != Json.null) s!"missing recursion snapshot field {key}"
+
+private def inspectSnapshot (directory : FilePath) (row : Json) : IO Unit := do
+  let snapshot ← readJson (directory / (← strField row "snapshot"))
+  need ((← strField snapshot "format") == "compilatrix/source-recursion-case/2") "unknown snapshot format"
+  need ((← field snapshot "summary") == row) "snapshot/report disagreement"
+  let source ← field snapshot "source"
+  need ((← field source "root") == (← field row "source_root")) "source root disagreement"
+  need ((← arrField source "constants").size == (← nat (← field row "source_constants"))) "source inventory disagreement"
+  requireFields source ["constants", "limits", "fuel", "literals"]
+  requireFields (← field snapshot "literal_ixir0")
+    ["raw", "raw_main", "groups", "declarations", "main", "blocks", "address_map"]
+  for (graphKey, root) in [("literal_ixir1", "literal_ixir1_root"),
+      ("recovered_ixir1", "recovered_ixir1_root")] do
+    let graph ← field snapshot graphKey
+    requireFields graph ["root", "raw_declarations", "raw_main", "artifacts", "declarations", "main", "address_map", "reserved"]
+    need ((← field graph "root") == (← field row root)) s!"{graphKey} root disagreement"
+  let recovery ← field snapshot "recovery"
+  requireFields recovery ["plan", "derived_key", "declarations", "main"]
+  need ((← field recovery "derived_key") == (← field row "recovered_recursion_root")) "derived recursor root disagreement"
+  let lowering ← field snapshot "ownership_lowering"
+  for key in ["declarations", "main"] do
+    need ((← field lowering key) == (← field recovery key)) s!"ownership lowering changed recovered {key}"
+  for key in ["source_rows_selected", "source_externs_rejected", "target_externs_rejected"] do
+    need ((← field lowering key) == toJson true) s!"ownership lowering certificate failed: {key}"
+  let hpt ← field snapshot "hpt"
+  requireFields hpt ["producer_limits", "producer_stats", "candidate", "artifacts"]
+  let hptArtifacts ← arrField hpt "artifacts"
+  let hptRoots ← hptArtifacts.mapM (field · "root")
+  need (!hptRoots.isEmpty && hptRoots == (← arrField row "hpt_roots")) "snapshot/report HPT identity disagreement"
+  for candidate in ← arrField hpt "candidate" do
+    requireFields candidate ["program_root", "members"]
+  for artifact in hptArtifacts do
+    requireFields artifact ["program_root", "cache_key", "root", "dependencies", "members", "bytes"]
+  let sidecars ← field snapshot "sidecars"
+  requireFields sidecars
+    ["input_declarations", "input_main", "main_world", "parameter_worlds", "constructors", "recursor_origins", "hpt_certificate"]
+  let recoveredGraph ← field snapshot "recovered_ixir1"
+  need ((← field sidecars "input_declarations") == (← field recoveredGraph "declarations") &&
+    (← field sidecars "input_main") == (← field recoveredGraph "main")) "sidecar input differs from recovered IxIR1"
+  need ((← field sidecars "hpt_certificate") == (← field hpt "candidate")) "sidecars use a different HPT certificate"
+  requireFields (← field snapshot "ixir2_diagnostic")
+    ["baseline", "baseline_stats", "selected", "selected_stats", "parameters", "schemas", "case_constructors", "max_depth", "reuse"]
+  let observations ← field snapshot "observations"
+  for stage in ["literal_raw_ixir1", "literal_ixir1", "recovered_raw_ixir1", "recovered_ixir1",
+      "baseline_logical", "baseline_physical", "reuse_logical", "reuse_physical"] do
+    let observation ← field observations stage
+    need ((← field observation "value") == (← field row "value")) s!"{stage}: value disagreement"
+    let returned ← field observation "store"
+    let returnedHeap ← if stage.endsWith "ixir1" then pure returned else field returned "heap"
+    let live := (← arrField returnedHeap "nodes").countP (· != Json.null)
+    need (live + (← nat (← field returnedHeap "frees")) ==
+      (← nat (← field returnedHeap "allocs"))) s!"{stage}: terminal allocation balance disagrees"
+    let reclaimed ← field observation "reclaimed"
+    let heap ← if stage.endsWith "ixir1" then pure reclaimed else field reclaimed "heap"
+    need ((← arrField heap "nodes").all (· == Json.null)) s!"{stage}: returned heap was not fully reclaimed"
+    need ((← field heap "allocs") == (← field heap "frees")) s!"{stage}: reclaimed allocator balance disagrees"
+  let baseline ← field observations "baseline_physical"
+  let selected ← field observations "reuse_physical"
+  for phase in ["store", "reclaimed"] do
+    let baselineStore ← field baseline phase
+    let selectedStore ← field selected phase
+    let baselineHeap ← field baselineStore "heap"
+    let selectedHeap ← field selectedStore "heap"
+    let reuses ← nat (← field selectedHeap "reuses")
+    need ((← nat (← field baselineHeap "reuses")) == 0) s!"{phase}: physical baseline executed reuse"
+    need ((← nat (← field baselineHeap "allocs")) ==
+      (← nat (← field selectedHeap "allocs")) + reuses)
+      s!"{phase}: physical baseline/selected allocation law disagrees"
+    need ((← nat (← field baselineHeap "frees")) ==
+      (← nat (← field selectedHeap "frees")) + reuses)
+      s!"{phase}: physical baseline/selected free law disagrees"
+    need ((← nat (← field selectedHeap "rcops")) ≤ (← nat (← field baselineHeap "rcops")))
+      s!"{phase}: physical selected RC operations exceed baseline"
+    need ((← nat (← field selectedStore "peakLiveNodes")) ≤ (← nat (← field baselineStore "peakLiveNodes")))
+      s!"{phase}: physical selected peak live nodes exceed baseline"
+
+def main (args : List String) : IO UInt32 := cli "source recursion check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected"] args)
+  let some exe := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-recursion/expected.json")
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      let result ← run exe #[output.toString]
+      requireAll result ["source-recursion ok:"] "source recursion producer"
+    let report ← readJson (first / "report.json")
+    need (report == expected) "reviewed source recursion, address, counter, or rejection matrix drifted"
+    let rows ← arrField report "cases"
+    need (!rows.isEmpty) "source recursion matrix has no cases"
+    let mut inventory := ["report.json"]
+    for row in rows do
+      let name ← strField row "snapshot"
+      need (safeName name && !inventory.contains name) s!"invalid or duplicate snapshot name: {name}"
+      inventory := name :: inventory
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      let files ← output.readDir
+      let actual := files.toList.map (·.fileName) |>.mergeSort (· ≤ ·)
+      need (actual == inventory) "fresh compiler output inventory drifted"
+      for file in files do need (!(← file.path.isDir)) "unexpected directory in compiler output"
+    for name in inventory do
+      need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name)))
+        s!"fresh compiler processes produced different program artifacts: {name}"
+    for row in rows do inspectSnapshot first row
+    IO.println s!"source recursion check ok: {rows.size} Ixon cases, two fresh program artifact sets, all heaps reclaimed"
diff --git a/Tests/Compiler/Checks/CheckSourceUniqueReuse.lean b/Tests/Compiler/Checks/CheckSourceUniqueReuse.lean
new file mode 100644
index 000000000..8417d6f74
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckSourceUniqueReuse.lean
@@ -0,0 +1,38 @@
+import Ix.Compiler.Tools.UniqueCheck
+
+/-! Fresh-process gate for checked source unique reversal artifacts. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.UniqueCheck
+
+def main (args : List String) : IO UInt32 := cli "source unique reuse check failed" do
+  let args ← checked (parseArgs ["--fixture", "--expected"] args)
+  let some exe := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let expected ← readJson (option args "--expected" "Tests/Fixtures/Compiler/source-unique-reuse/expected.json")
+  IO.FS.withTempDir fun directory => do
+    let first := directory / "first"
+    let second := directory / "second"
+    for output in [first, second] do
+      let result ← run exe #[output.toString]
+      requireAll result ["source-unique-reuse ok:"] "unique producer"
+    let report ← readJson (first / "report.json")
+    need (report == expected) "reviewed unique source, identity, counter, or rejection matrix drifted"
+    let rows ← arrField report "cases"
+    need (rows.size == 7 && (← arrField report "policy_and_rejection_checks").size == 43) "unique matrix inventory disagreement"
+    let mut inventory := ["report.json"]
+    for row in rows do
+      let name ← strField row "snapshot"
+      need (!name.isEmpty && !name.startsWith "." && !name.contains ".." &&
+        name.toList.all (fun c => c.isAlphanum || c == '-' || c == '.') && !inventory.contains name) "invalid snapshot name"
+      inventory := name :: inventory
+    inventory := inventory.mergeSort (· ≤ ·)
+    for output in [first, second] do
+      let files ← output.readDir
+      need ((files.toList.map (·.fileName) |>.mergeSort (· ≤ ·)) == inventory) "unique artifact inventory drifted"
+      for file in files do need (!(← file.path.isDir)) "unexpected unique artifact directory"
+    for name in inventory do
+      need ((← IO.FS.readBinFile (first / name)) == (← IO.FS.readBinFile (second / name))) s!"fresh artifact disagreement: {name}"
+    for row in rows do inspectSnapshot row (← readJson (first / (← strField row "snapshot")))
+    let some three := rows.find? (fun row => (row.getObjValAs? String "name").toOption == some "three")
+      | throw (IO.userError "missing three-element regression")
+    regressionChecks three (← readJson (first / (← strField three "snapshot")))
+    IO.println s!"source unique reuse check ok: {rows.size} Ixon reversals, two fresh artifact sets, canonical preimages, 12 corruption regressions, all prefixes and reclaimed heaps checked"
diff --git a/Tests/Compiler/Checks/CheckToolsTests.lean b/Tests/Compiler/Checks/CheckToolsTests.lean
new file mode 100644
index 000000000..b8791ff5b
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckToolsTests.lean
@@ -0,0 +1,133 @@
+import Ix.Compiler.Tools.TrustLedger
+
+/-! Regression tests for the trust gate's failure paths. Mutations are confined
+to fresh temporary copies; the source tree and reviewed ledger are never edited. -/
+
+open Lean System Ix.Compiler.Tools.Check Ix.Compiler.Tools.SourceScan
+open Ix.Compiler.Tools.TrustLedger
+
+private def rejects (label fragment : String) (action : IO Unit) : IO Unit := do
+  let error ← try action; pure none catch error => pure (some error.toString)
+  let some error := error | throw (IO.userError s!"{label}: unexpectedly accepted")
+  need (error.contains fragment) s!"{label}: rejected for the wrong reason: {error}"
+
+private def withFile (path : FilePath) (value : String) (action : IO Unit) : IO Unit := do
+  let original ← if ← path.pathExists then some <$> IO.FS.readBinFile path else pure none
+  if let some parent := path.parent then IO.FS.createDirAll parent
+  try
+    IO.FS.writeFile path value
+    action
+  finally
+    match original with
+    | some bytes => IO.FS.writeBinFile path bytes
+    | none => IO.FS.removeFile path
+
+private def copyFile (source target : FilePath) : IO Unit := do
+  if let some parent := target.parent then IO.FS.createDirAll parent
+  IO.FS.writeBinFile target (← IO.FS.readBinFile source)
+
+private def copyRelative (sourceRoot targetRoot source : FilePath) : IO Unit := do
+  let source ← IO.FS.realPath source
+  let base := sourceRoot.toString ++ "/"
+  need (source.toString.startsWith base) s!"test source escapes root: {source}"
+  copyFile source (targetRoot / (source.toString.drop base.length).toString)
+
+private def cloneProject (source target : FilePath) : IO Unit := do
+  let lake ← compilerLake source
+  for path in ← leanSources source lake do copyRelative source target path
+  for path in ["lakefile.lean", "lake-manifest.json", "flake.lock", "lean-toolchain", "native/compiler/hpt_cache_sync.c"] do
+    copyFile (source / path) (target / path)
+
+private def lexerTests : IO Unit := do
+  let safe := "/- outer /- axiom hidden : False -/ sorry -/\n" ++
+    "-- native_decide\n" ++
+    "def text := \"sorry axiom native_decide @[extern nope]\"\n" ++
+    "def quote := '\"'\ndef indexed := values[0]'(by omega)\n" ++
+    "def f' := Namespace.sorry\n"
+  checked (hygiene (← checked (scan safe)))
+  for token in ["axiom", "sorry", "native_decide"] do
+    rejects token (token ++ " is not allowed") do
+      checked (hygiene (← checked (scan s!"def safe := \"{token}\"\n{token} injected")))
+  rejects "Unicode-delimited proof hole" "sorry is not allowed" do
+    checked (hygiene (← checked (scan "def pair : Nat × Nat := ⟨sorry, 0⟩")))
+  rejects "Unicode-delimited native tactic" "native_decide is not allowed" do
+    checked (hygiene (← checked (scan "by exact ⟨by native_decide⟩")))
+  let externInput := "/- @[extern \"ignored\"] opaque absent : Nat -/\n" ++
+    "@[extern 1 \"ffi_first\"] private unsafe opaque first : Nat\n" ++
+    "attribute [extern \"ffi_second\"] second Qualified.third\n"
+  let found ← checked (externs (← checked (scan externInput)))
+  need (found == [("ffi_first", "first"), ("ffi_second", "second"), ("ffi_second", "Qualified.third")])
+    "extern declaration/attribute inventory changed"
+  rejects "unsupported extern" "unrecognized extern declaration" do
+    let _ ← checked (externs (← checked (scan "@[extern \"unaccounted\"] theorem unsupported : True := by trivial")))
+  rejects "implicit extern" "explicit symbol" do
+    let _ ← checked (externs (← checked (scan "@[extern] opaque unsupported : Nat")))
+  rejects "unterminated comment" "unterminated block comment" do
+    let _ ← checked (scan "/- nested /- closed -/")
+  let cInput := "/* LEAN_EXPORT int ignored(void); */\n" ++
+    "const char *text = \"LEAN_EXPORT int fake(void)\";\n" ++
+    "LEAN_EXPORT lean_obj_res actual(b_lean_obj_arg x) { return x; }\n"
+  need ((← checked (cExports (← checked (scan cInput true)))) == ["actual"])
+    "C comments/literals leaked into export inventory"
+  let tick := String.singleton (Char.ofNat 96)
+  let roots ← lakeRoots (← checked (scan (
+    s!"lean_lib Main where\n  roots := #[{tick}Main, {tick}Aux]\n" ++
+    s!"lean_exe «extra-cli» where\n  srcDir := \"tools\"\n  root := {tick}Extra\n")))
+  need (roots == [(".", "Main"), (".", "Aux"), ("tools", "Extra")]) "Lake root discovery changed"
+  rejects "empty roots" "empty Lake roots" do
+    let _ ← lakeRoots (← checked (scan "lean_lib Main where\n  roots := #[]\n"))
+  rejects "unauditable roots" "unsupported Lake roots" do
+    let _ ← lakeRoots (← checked (scan "lean_lib Main where\n  roots := computedRoots\n"))
+
+private def regressionTests (source blakeSource : FilePath) : IO Unit := IO.FS.withTempDir fun temporary => do
+  let root := temporary / "project"
+  let blake := temporary / "Blake3"
+  cloneProject source root
+  for path in (← files blakeSource true).filter (·.extension == some "lean") do
+    copyRelative blakeSource blake path
+  copyFile (blakeSource / "rust/Cargo.lock") (blake / "rust/Cargo.lock")
+  let profile := Ix.Compiler.Tools.TrustProfile.reviewed
+  let check := auditWith profile root blake
+  check
+  let regression := root / "Ix/Compiler/AuditRegression.lean"
+  for token in ["axiom", "sorry", "native_decide"] do
+    withFile regression s!"{token} injected\n" do
+      rejects token (token ++ " is not allowed") check
+  withFile regression "@[extern \"unexpected_symbol\"] opaque rogue : Nat\n" do
+    rejects "project extern drift" "project extern inventory drifted" check
+  for name in ["UnreviewedPackage", "Ix.TypeChecker", "Ix.Theory"] do
+    withFile regression s!"import {name}\n" do
+      rejects "external import drift" "external Lean imports drifted" check
+  withFile regression "def drift := Blake3.Rust.internalVersion\n" do
+    rejects "native entrypoint drift" "qualified uses of Blake3.Rust drifted" check
+  withFile (root / "lean-toolchain") "leanprover/lean4:v4.33.0\n" do
+    rejects "seed drift" "Lean seed version drifted" check
+  let native := root / "native/compiler/hpt_cache_sync.c"
+  withFile native ((← IO.FS.readFile native) ++ "\n") do
+    rejects "C source drift" "foreign source hash drifted" check
+  let lake := root / "lakefile.lean"
+  let added := (← IO.FS.readFile lake).replace "end Compiler\n"
+    ("lean_exe regression where\n  root := " ++ String.singleton (Char.ofNat 96) ++ "Regression\nend Compiler\n")
+  withFile lake added do
+    rejects "build drift" "Compiler Lake section hash drifted" check
+    -- Even a newly reviewed build section must inventory additional roots.
+    let profile := { profile with lakeSectionSha256 := ← textSha256 (← compilerSection added) }
+    withFile (root / "Regression.lean") "axiom outsideLibrary : False\n" do
+      rejects "new executable inventory" "axiom is not allowed" (auditWith profile root blake)
+  withFile (blake / "Sibling.lean") "@[extern \"unreviewed_sibling\"] opaque sibling : Nat\n" do
+    rejects "dependency sibling extern" "package-tree extern inventory drifted" check
+  let cargo := blake / "rust/Cargo.lock"
+  let duplicate := (← IO.FS.readFile cargo) ++ "\n[[package]]\nname = \"blake3\"\nversion = \"1.8.7\"\n"
+  for (contents, diagnostic) in [(duplicate, "duplicate Cargo package identity"), ("package = [", "invalid Cargo TOML")] do
+    withFile cargo contents do
+      rejects "Cargo hash drift" "Cargo lockfile hash drifted" check
+      let profile := { profile with cargoSha256 := ← sha256 cargo }
+      rejects "Cargo metadata drift" diagnostic (auditWith profile root blake)
+
+def main (args : List String) : IO UInt32 := cli "Lean check regressions failed" do
+  let args ← checked (parseArgs ["--root", "--blake3"] args)
+  let root ← IO.FS.realPath (option args "--root" ".")
+  let blake ← IO.FS.realPath (option args "--blake3" (root / ".lake/packages/Blake3").toString)
+  lexerTests
+  regressionTests root blake
+  IO.println "Lean check regressions OK: source lexing, component roots, native inventories, build/seed pins, Cargo rejection paths"
diff --git a/Tests/Compiler/Checks/CheckTrustedExterns.lean b/Tests/Compiler/Checks/CheckTrustedExterns.lean
new file mode 100644
index 000000000..50493a831
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckTrustedExterns.lean
@@ -0,0 +1,16 @@
+import Ix.Compiler.Tools.TrustLedger
+
+open Ix.Compiler.Tools.Check Ix.Compiler.Tools.TrustLedger
+
+def main (args : List String) : IO UInt32 := cli "trusted-extern ledger check failed" do
+  let args ← checked (parseArgs ["--root", "--dependency-root"]
+    args ["--dependency-root"])
+  let mut overrides := []
+  for (_, value) in args.filter (·.1 == "--dependency-root") do
+    let parts := value.splitOn "="
+    let name := parts.headD ""
+    let path := "=".intercalate (parts.drop 1)
+    need (!name.isEmpty && !path.isEmpty) s!"bad --dependency-root {value}; use NAME=PATH"
+    need (!(optional overrides name).isSome) s!"duplicate dependency root for {name}"
+    overrides := (name, path) :: overrides
+  audit (option args "--root" ".") overrides
diff --git a/Tests/Compiler/Checks/CheckX86Bytes.lean b/Tests/Compiler/Checks/CheckX86Bytes.lean
new file mode 100644
index 000000000..29b1e9af3
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckX86Bytes.lean
@@ -0,0 +1,262 @@
+import Ix.Compiler.Tools.Check
+import Ix.Compiler.X86.ByteBranch
+import Ix.Compiler.X86.ByteCall
+import Ix.Compiler.X86.EvalExamples
+import Ix.Compiler.UniqueReuse.RuntimeNative
+import Ix.Compiler.UniqueReuse.NativeObservations
+import Ix.Compiler.X86.RuntimeExecution
+import Ix.Compiler.X86.RuntimeInput
+
+/-! Finite regression evidence for the independent decoder and byte evaluator.
+The universal local laws live in EncodeExecution/ByteBranch/ByteCall. This gate
+also executes the actual source-selected runtime text; the separate GNU and
+linked-native gates remain external oracles. -/
+
+open Ix.Compiler Ix.Compiler.X86
+open Ix.Compiler.Tools.Check (checked cli)
+
+private def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+private def registers : List GPR :=
+  [.rax, .rcx, .rdx, .rbx, .rsp, .rbp, .rsi, .rdi,
+   .r8, .r9, .r10, .r11, .r12, .r13, .r14, .r15]
+
+private def indices : List (Option IndexReg) :=
+  [none, some .rax, some .rcx, some .rdx, some .rbx, some .rbp, some .rsi, some .rdi,
+   some .r8, some .r9, some .r10, some .r11, some .r12, some .r13, some .r14, some .r15]
+
+private def widths : List Width := [.w8, .w16, .w32, .w64]
+private def operations : List AluOp := [.add, .sub, .and, .or, .xor]
+private def conditions : List Condition :=
+  [.eq, .ne, .unsignedLt, .unsignedLe, .unsignedGt, .unsignedGe,
+   .signedLt, .signedLe, .signedGt, .signedGe]
+private def immediates : List Word :=
+  [0, 1, 0x7f, 0x80, 0xff, 0x8000, 0xffff, 0x7fffffff, 0x80000000,
+   0xffffffff, 0x8000000000000000, 0xffffffffffffffff]
+
+private def initial : Core :=
+  { registers := fun register =>
+      if register == .rsp then 0x8008 else if register == .rbp then 0x9000
+      else 0xfedcba9876543210 + (Encode.gprCode register).toUInt64 * 0x102030405
+    memory := { Memory.flat with bytes := fun address => (address ^^^ (address >>> 8)).toUInt8 } }
+
+private def sameRegisters (left right : Core) : Bool :=
+  registers.all fun register => left.readReg register == right.readReg register
+
+private def sameBytes (left right : Memory) (addresses : List Word) : Bool :=
+  addresses.all fun address => left.bytes address == right.bytes address &&
+    left.readable address == right.readable address && left.writable address == right.writable address
+
+private def touched (instruction : Instr) (core : Core) : Word :=
+  match instruction with
+  | .load _ _ address | .store _ address _ | .lea _ address => address.eval core
+  | .push _ => core.readReg .rsp - 8
+  | .pop _ => core.readReg .rsp
+  | .spill slot _ | .reload _ slot => core.readReg .rbp - slot.displacement
+  | _ => 0
+
+private def instructionCase (target : Checked) (instruction : Instr) (core : Core) : Except String Unit := do
+  let bytes := (Encode.encodeInstr instruction).bytes
+  let text := Encode.bytes [0xaa, 0xbb] ++ bytes ++ Encode.bytes [0xc3, 0xff]
+  need (Decode.decodeAt text 2 == some ⟨Encode.instructionOperation instruction, bytes.size⟩)
+    s!"decode or length: {repr instruction}"
+  for cut in [:bytes.size] do
+    need ((Decode.decodeAt (bytes.extract 0 cut) 0).isNone) s!"accepted truncated form: {repr instruction}, {cut}"
+  if Encode.linearInstruction instruction then
+    let typed := executeInstr Runtime.rejecting target instruction (Machine.initial target core)
+    match ByteEval.step text 0x1000 ⟨core, 0x1002, {}⟩ with
+    | .error (.memory fault) =>
+        need (typed.status == .trapped (.memoryFault fault)) s!"fault disagreement: {repr instruction}"
+    | .error fault => throw s!"unexpected byte fault: {repr instruction}, {repr fault}"
+    | .ok result =>
+        need (typed.status == .running && sameRegisters typed.core result.core &&
+          result.rip == 0x1002 + UInt64.ofNat bytes.size) s!"register or RIP disagreement: {repr instruction}"
+        let address := touched instruction core
+        let probes := (List.range 24).map fun index => address - 8 + UInt64.ofNat index
+        need (sameBytes typed.core.memory result.core.memory probes) s!"memory disagreement: {repr instruction}"
+
+private def instructionMatrix (target : Checked) : Except String Nat := do
+  let mut cases : Array Instr := #[]
+  for width in widths do
+    for destination in registers do
+      for source in registers do
+        cases := cases.push (.mov width destination (.reg source))
+        for operation in operations do cases := cases.push (.alu operation width destination (.reg source))
+      for value in immediates do
+        cases := cases.push (.mov width destination (.imm value))
+        for operation in operations do cases := cases.push (.alu operation width destination (.imm value.toUInt32))
+  for width in ([.w16, .w32, .w64] : List MulWidth) do
+    for destination in registers do
+      for source in registers do cases := cases.push (.imul width destination source)
+  for register in registers do
+    cases := cases.push (.push register) |>.push (.pop register)
+    for index in ([0, 1, 0x7fff, 0xffff] : List UInt16) do
+      cases := cases.push (.spill ⟨index⟩ register) |>.push (.reload register ⟨index⟩)
+  for size in ([0, 1, 0x7fff, 0xffff] : List UInt16) do
+    cases := cases.push (.allocFrame ⟨size⟩) |>.push (.freeFrame ⟨size⟩)
+  -- Cross all base/index/scale combinations, including the RSP/R12 and
+  -- RBP/R13 SIB holes, with both low and extended destination fields.
+  for base in none :: registers.map some do
+    for index in indices do
+      for scale in ([.one, .two, .four, .eight] : List Scale) do
+        for destination in ([.rdi, .r9] : List GPR) do
+          let address : MemAddr := { base, index, scale, displacement := 0x80000000 }
+          cases := cases.push (.lea destination address)
+          for width in widths do
+            cases := cases.push (.load width destination address) |>.push (.store width address destination)
+  for displacement in ([0, 1, 0x7fffffff, 0x80000000, 0xffffffff] : List Imm32) do
+    for register in registers do
+      for width in widths do
+        let address : MemAddr := { base := some .r13, index := some .r12, scale := .eight, displacement }
+        cases := cases.push (.load width register address) |>.push (.store width address register)
+  cases := cases.push (.call 0)
+  for intrinsic in ([.allocate, .reserve, .reuse, .releaseReservation, .retainShared,
+      .releaseShared, .memcpy, .unsignedDiv] : List Intrinsic) do
+    cases := cases.push (.callRuntime intrinsic)
+  for instruction in cases do instructionCase target instruction initial
+  return cases.size
+
+private def branchMatrix : Except String Nat := do
+  let mut count := 0
+  for width in widths do
+    let values := [0, 1, width.mask, width.mask >>> 1, (width.mask >>> 1) + 1]
+    for left in values do
+      for right in values do
+        for source in ([.reg .r12, .imm right.toUInt32] : List AluSource) do
+          let core := (initial.setReg .r9 left).setReg .r12 right
+          let comparison : Compare := { width, left := .r9, right := source }
+          for condition in conditions do
+            let raw := (Encode.encodeTerminator (.branch comparison condition 0 0)).bytes
+            let comparisonSize := (Encode.encodeCompare comparison).size
+            let bytes ← (Encode.patchSigned32 raw (comparisonSize + 2) 13).mapError reprStr
+            let bytes ← (Encode.patchSigned32 bytes (comparisonSize + 7) (-19)).mapError reprStr
+            let take := comparison.holds condition core
+            let result ← (ByteEval.run bytes 0x2000 (if take then 2 else 3) ⟨core, 0x2000, {}⟩).mapError reprStr
+            let expected := if take then 0x2000 + UInt64.ofNat (comparisonSize + 6) + 13
+              else 0x2000 + UInt64.ofNat (comparisonSize + 11) - 19
+            need (result.rip == expected && sameRegisters core result.core && result.flags.test condition == some take)
+              s!"patched branch mismatch: {repr comparison}, {repr condition}, {left}, {right}"
+            count := count + 1
+  return count
+
+private def failureCases (target : Checked) : Except String Unit := do
+  for bytes in ([[], [0x90], [0x66, 0x66, 0x48, 0x89, 0xc0], [0x48, 0x48, 0x89, 0xc0],
+      [0x66, 0x48, 0x89, 0xc0], [0x42, 0x89, 0xc0], [0x88, 0xe0],
+      [0xf0, 0x48, 0x01, 0xc0], [0x0f, 0x0b]] : List (List UInt8)) do
+    need ((Decode.decodeAt (Encode.bytes bytes) 0).isNone) s!"unsupported encoding accepted: {repr bytes}"
+  for width in widths do
+    for byte in [:width.bytes] do
+      let memory : Memory := { initial.memory with
+        readable := fun address => address != 0x5000 + UInt64.ofNat byte
+        writable := fun address => address != 0x5000 + UInt64.ofNat byte }
+      let core := { initial with memory }
+      instructionCase target (.load width .rax { displacement := 0x5000 }) core
+      instructionCase target (.store width { displacement := 0x5000 } .rax) core
+  for instruction in ([.push .rsp, .pop .rsp, .spill ⟨0⟩ .r9, .reload .r9 ⟨0⟩] : List Instr) do
+    instructionCase target instruction { initial with memory := Memory.unmapped }
+  let denied : ByteEval.State := ⟨{ initial with memory := Memory.unmapped }, 0x1000, {}⟩
+  for bytes in [Encode.byte 0xc3, (Encode.encodeInstr (.call 0)).bytes] do
+    let .error (.memory _) := ByteEval.step bytes 0x1000 denied | throw "unmapped control stack access succeeded"
+  let product ← (ByteEval.step (Encode.encodeInstr (.imul .w64 .rax .rax)).bytes 0x1000 ⟨initial, 0x1000, {}⟩).mapError reprStr
+  need (product.flags.zero.isNone && product.flags.sign.isNone && product.flags.carry.isSome && product.flags.overflow.isSome)
+    "IMUL undefined flag policy changed"
+  let .error (.undefinedCondition .eq) := ByteEval.step (Encode.bytes [0x0f, 0x84, 0, 0, 0, 0]) product.rip product
+    | throw "branch read an undefined IMUL flag"
+  let .error (.invalidPatch _ _) := Encode.patchSigned32 (Encode.bytes [0xe9, 0, 0, 0, 0]) 2 0
+    | throw "out-of-bounds relocation accepted"
+  for value in ([-2147483648, 2147483647] : List Int) do
+    need (Encode.fitsSigned32 value) "signed rel32 endpoint rejected"
+    let bytes := Encode.byte 0xe9 ++ Encode.signed32Bytes value
+    let result ← (ByteEval.step bytes 0x1000 ⟨initial, 0x1000, {}⟩).mapError reprStr
+    need (result.rip == UInt64.ofInt (0x1005 + value)) "signed rel32 endpoint changed target"
+  for value in ([-2147483649, 2147483648] : List Int) do
+    need (!Encode.fitsSigned32 value) "out-of-range rel32 accepted"
+  -- A one-byte corruption must change the decoded operand, and a branch
+  -- relocation corruption must change its destination.
+  let mov := (Encode.encodeInstr (.mov .w64 .rax (.imm 42))).bytes
+  need (Decode.decodeAt (mov.set! 2 43) 0 != Decode.decodeAt mov 0) "immediate corruption was invisible"
+  let jump := Encode.byte 0xe9 ++ Encode.imm32Bytes 0
+  let changed ← (ByteEval.step (jump.set! 1 1) 0x1000 ⟨initial, 0x1000, {}⟩).mapError reprStr
+  need (changed.rip == 0x1006) "relocation corruption was invisible"
+
+private def sentinel : Word := 0xff00
+private def textBase : Word := 0x100000
+
+private def runUntilReturn (text : ByteArray) : Nat → ByteEval.State → Except String (ByteEval.State × Nat)
+  | 0, _ => .error "byte execution exhausted fuel before returning to the harness"
+  | fuel + 1, state => do
+      let some decoded := Decode.decodeAt text (state.rip - textBase).toNat
+        | throw s!"decode fault at {state.rip}"
+      let next ← (ByteEval.step text textBase state).mapError reprStr
+      if next.rip == sentinel then
+        need (decoded.operation == .ret) "harness exit was not a return"
+        return (next, 1)
+      let (result, count) ← runUntilReturn text fuel next
+      return (result, count + 1)
+
+private def entry (encoded : Encode.Output) (target : Checked) (core : Core) : Except String ByteEval.State := do
+  let some offset := encoded.blockOffsets[target.program.entry.toNat]? | throw "encoded entry offset missing"
+  return ⟨core, textBase + UInt64.ofNat offset, {}⟩
+
+private def smallPrograms : Except String Unit := do
+  for program in [Examples.arithmeticProgram, Examples.stackProgram, Examples.callProgram,
+      { entry := 0, blocks := #[{ instructions := #[], terminator := .tailCall 1 },
+        { instructions := #[.mov .w64 .rax (.imm 42)], terminator := .ret }] }] do
+    let target ← program.check.mapError reprStr
+    let encoded ← (Encode.encode target).mapError reprStr
+    let core := { (Core.empty 0x8008) with memory := Memory.flat.write64 0x8008 sentinel }
+    let typed := runFrom Runtime.rejecting target 100 core
+    let (result, _) ← runUntilReturn encoded.text 100 (← entry encoded target core)
+    need (typed.status == .halted 42 && result.core.readReg .rax == 42 && result.core.readReg .rsp == 0x8010 &&
+      sameRegisters typed.core (result.core.setReg .rsp 0x8008)) "complete arithmetic/stack/call/tail stream mismatch"
+
+private def runtimePrograms : Except String Nat := do
+  let source ← UniqueReuse.Runtime.source
+  let compilation ← UniqueReuse.Runtime.compile source.constants source.entry
+  let .native output := UniqueReuse.Runtime.Native.select compilation | throw "runtime native selection failed"
+  let main ← output.emit .main
+  let release ← output.emit .release
+  need (main.encoded.relocations.isEmpty && release.encoded.relocations.isEmpty) "runtime text has unresolved externals"
+  let mut steps := 0
+  for (name, values) in UniqueReuse.Native.Examples.cases do
+    let words ← UniqueReuse.Runtime.Native.ofNats values
+    let bound : PLift (words.length ≤ UniqueABI.maxLength) ←
+      if h : words.length ≤ UniqueABI.maxLength then pure ⟨h⟩ else throw "runtime input bound lost"
+    let layout := RuntimeExecution.canonicalLayout words bound.down
+    let stack : Memory := { Memory.unmapped with
+      readable := fun address => 0x7f00 ≤ address && address < 0x8100
+      writable := fun address => 0x7f00 ≤ address && address < 0x8100 }
+    let core : Core := {
+      registers := ((Registers.zero.set .rsp 0x8008).set .rdi layout.base).set .rsi (UInt64.ofNat words.length)
+      memory := RuntimeExecution.inputMemory layout words (stack.write64 0x8008 sentinel) }
+    let typed := runFrom Runtime.rejecting RuntimeTarget.checked (RuntimeTarget.controlCost words.length) core
+    let (result, count) ← runUntilReturn main.encoded.text (3 * RuntimeTarget.controlCost words.length)
+      (← entry main.encoded RuntimeTarget.checked core)
+    steps := steps + count
+    need (typed.status == .halted (layout.cell 1) && result.core.readReg .rsp == 0x8010 &&
+      sameRegisters typed.core (result.core.setReg .rsp 0x8008)) s!"runtime return registers: {name}"
+    let probes := (List.range (8 * layout.slots)).map fun index => layout.base + UInt64.ofNat index
+    need (sameBytes typed.core.memory result.core.memory probes) s!"runtime returned arena: {name}"
+    let observed ← UniqueReuse.Native.Examples.nativeList layout result.core.memory words.length (result.core.readReg .rax)
+    need (observed == values.reverse) s!"runtime byte reversal: {name}"
+    let typedDrop := runFrom Runtime.rejecting RuntimeTarget.releaseChecked (UniqueTarget.releaseCost words.length) typed.core
+    let releaseCore := result.core.setReg .rsp 0x8008
+    let (dropped, count) ← runUntilReturn release.encoded.text (3 * UniqueTarget.releaseCost words.length)
+      (← entry release.encoded RuntimeTarget.releaseChecked releaseCore)
+    steps := steps + count
+    need (typedDrop.status == .halted 0 && dropped.core.readReg .rsp == 0x8010 &&
+      sameRegisters typedDrop.core (dropped.core.setReg .rsp 0x8008) && sameBytes typedDrop.core.memory dropped.core.memory probes)
+      s!"runtime release registers/arena: {name}"
+    let header := UniqueReuse.Native.Examples.headerValues layout dropped.core.memory
+    need (header[2]! == header[3]! && header[5]! == 0 && header[7]! == 0 && header[9]! == 0) s!"runtime byte release leaked: {name}"
+  return steps
+
+def main : IO UInt32 := cli "x86 byte execution check failed" do
+  let target ← checked (Examples.arithmeticProgram.check.mapError reprStr)
+  let forms ← checked (instructionMatrix target)
+  let branches ← checked branchMatrix
+  checked (failureCases target)
+  checked smallPrograms
+  let runtimeSteps ← checked runtimePrograms
+  IO.println s!"x86 byte execution check ok: {forms} instruction cases, {branches} patched branches, truncation/fault/corruption checks, four complete streams, eight source-selected runtime main/release inputs ({runtimeSteps} byte steps)"
diff --git a/Tests/Compiler/Checks/CheckX86Encoder.lean b/Tests/Compiler/Checks/CheckX86Encoder.lean
new file mode 100644
index 000000000..6147cf741
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckX86Encoder.lean
@@ -0,0 +1,42 @@
+import Ix.Compiler.Tools.Check
+
+/-! Independently decode the byte-exact E0 Lean goldens with GNU objdump. -/
+
+open Ix.Compiler.Tools.Check
+
+private def forms := "48 b8 2a 00 00 00 00 00 00 00 40 b6 07 4d 89 d1 " ++
+  "4f 0f b6 8c ec 10 00 00 00 4c 89 a5 f8 ff ff ff 4e 8d 94 8b 20 00 00 00 " ++
+  "48 81 c0 02 00 00 00 45 31 d1 4d 0f af ca 41 54 41 5c " ++
+  "48 81 ec 10 00 00 00 48 81 f8 2a 00 00 00"
+
+private def arithmetic := "48 b8 28 00 00 00 00 00 00 00 48 81 c0 02 00 00 00 " ++
+  "48 81 f8 2a 00 00 00 0f 84 05 00 00 00 e9 01 00 00 00 c3 " ++
+  "48 b8 00 00 00 00 00 00 00 00 c3"
+
+private def callProgram := "55 e8 09 00 00 00 5d 48 81 c0 02 00 00 00 c3 " ++
+  "48 b8 28 00 00 00 00 00 00 00 c3"
+
+private def decode (objdump : String) (payload : String) (expected : List String)
+    (label : String) : IO Unit := IO.FS.withTempDir fun directory => do
+  let path := directory / "fixture.bin"
+  IO.FS.writeBinFile path (← checked (unhex payload))
+  let output := (← run objdump
+    #["-D", "-b", "binary", "-m", "i386:x86-64", "-M", "intel", path.toString]).toLower
+  requireAll output expected label
+  need (!output.contains "(bad)") s!"{label}: decoder emitted (bad)\n{output}"
+
+def main (args : List String) : IO UInt32 := cli "x86 encoder decoder check failed" do
+  let args ← checked (parseArgs ["--objdump"] args)
+  let objdump := option args "--objdump" "objdump"
+  decode objdump forms [
+    "movabs rax,0x2a", "mov    sil,0x7", "mov    r9,r10",
+    "movzx  r9,byte ptr [r12+r13*8+0x10]", "mov    qword ptr [rbp-0x8],r12",
+    "lea    r10,[rbx+r9*4+0x20]", "add    rax,0x2", "xor    r9d,r10d",
+    "imul   r9,r10", "push   r12", "pop    r12", "sub    rsp,0x10", "cmp    rax,0x2a"
+  ] "instruction forms"
+  decode objdump arithmetic ["je     0x23", "jmp    0x24", "movabs rax,0x0", "ret"]
+    "arithmetic branch program"
+  decode objdump callProgram [
+    "push   rbp", "call   0xf", "pop    rbp", "add    rax,0x2", "movabs rax,0x28", "ret"
+  ] "direct call program"
+  IO.println "x86 encoder decoder check ok: 13 forms, branch layout, direct call"
diff --git a/Tests/Compiler/Checks/CheckX86Object.lean b/Tests/Compiler/Checks/CheckX86Object.lean
new file mode 100644
index 000000000..d105951ec
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckX86Object.lean
@@ -0,0 +1,108 @@
+import Ix.Compiler.Tools.X86Check
+
+/-! Inspect and natively run independently generated ELF files. All byte and
+address expectations are frozen here rather than obtained from compiler code. -/
+
+open System Ix.Compiler.Tools.Check Ix.Compiler.Tools.X86Check
+
+private structure Fixture where
+  name : String
+  kind : String
+  expected : Nat
+  ixonRoot : String := "-"
+  ir1Root : String := String.join (List.replicate 32 "42")
+
+private def fixtures : List Fixture := [
+  ⟨"arithmetic", "arithmetic", 42, "-", String.join (List.replicate 32 "42")⟩,
+  { name := "direct-call", kind := "direct-call", expected := 42 },
+  { name := "runtime", kind := "runtime", expected := 0x2000 },
+  { name := "selected-scalar", kind := "selected-scalar", expected := 42 },
+  { name := "validated-zero", kind := "validated-scalar", expected := 0
+    ixonRoot := "11f9a7889be4f23e910d35b8501542c842e16ef4b4c013525b617b2a9c4f8829"
+    ir1Root := "a6fd56bbb40c863cd3767059ea82f62fa649e4c906d56fc1d7aec40017c86936" },
+  { name := "validated-42", kind := "validated-scalar", expected := 42
+    ixonRoot := "2e926c5f48aec39e7f8dccde8e2289a8a97821714339767dc7c789fbb4479874"
+    ir1Root := "1898b54e998f21f0f2615354eda8014fb47188a00d9511e6e4ca8f11ac5e20d8" },
+  { name := "validated-max", kind := "validated-scalar", expected := 18446744073709551615
+    ixonRoot := "b1657e7f011436f0ed6d2c8eafa4269a8996742f3baaf6845199a00891336781"
+    ir1Root := "03cec8b3b1f9fa35a552a76dc26f74499cd62be1e7d3e81bb3c7e2f337e8611f" }
+]
+
+private def reportValue (text key : String) : IO String := do
+  need (text.startsWith key) s!"expected {key} in fixture report: {text}"
+  return (text.drop key.length).toString
+
+private def generate (exe : String) (fixture : Fixture) (path : FilePath)
+    : IO (ByteArray × Option Nat × Nat) := do
+  let extra := if fixture.kind == "validated-scalar" then #[toString fixture.expected] else #[]
+  let output ← run exe (#[fixture.kind, path.toString] ++ extra)
+  let fields := words output
+  need (output == " ".intercalate fields || output == " ".intercalate fields ++ "\n")
+    s!"malformed fixture report: {output}"
+  let [kind, source, localValue, size, ixon, ir1] := fields
+    | throw (IO.userError s!"fixture did not report success: {output}")
+  need (kind == s!"fixture={fixture.kind}") s!"wrong fixture report: {output}"
+  let source ← reportValue source "source="
+  let source ← if source == "-" then pure none
+    else some <$> present source.toNat? "invalid source observation"
+  let localValue ← present (← reportValue localValue "local=").toNat? "invalid local observation"
+  let size ← present (← reportValue size "bytes=").toNat? "invalid byte count"
+  need (ixon == s!"ixon={fixture.ixonRoot}" && ir1 == s!"ir1={fixture.ir1Root}")
+    s!"address golden drifted for {fixture.name}\n{output}"
+  let payload ← IO.FS.readBinFile path
+  need (payload.size == size) s!"wrong reported byte size for {fixture.name}"
+  need (payload.extract 0 7 == (← checked (unhex "7f 45 4c 46 02 01 01")))
+    s!"invalid ELF64 prefix for {fixture.name}"
+  need (containsBytes payload (← provenance fixture.ir1Root))
+    s!"missing exact provenance bytes for {fixture.name}"
+  return (payload, source, localValue)
+
+private def inspect (readelf objdump : String) (fixture : Fixture) (path : FilePath) : IO Unit := do
+  let elf ← inspectElf readelf path
+  let disassembly ← disassemble objdump path
+  let expected ← match fixture.kind with
+    | "arithmetic" => pure ["movabs rax,0x28", "add    rax,0x2", "je     23", "jmp    24"]
+    | "direct-call" => pure ["push   rbp", "call   f", "pop    rbp", "add    rax,0x2", "movabs rax,0x28"]
+    | "runtime" => pure [
+        "push   rbp", "movabs rdi,0x10", "movabs rsi,0x8",
+        "r_x86_64_pc32\tcompilatrix_rt_allocate-0x4", "pop    rbp"]
+    | "selected-scalar" | "validated-scalar" => pure [s!"movabs rax,0x{hexNat fixture.expected}"]
+    | _ => throw (IO.userError "unknown fixture kind")
+  requireAll disassembly expected s!"{fixture.name}: disassembly"
+  if fixture.kind == "runtime" then
+    requireAll elf ["R_X86_64_PC32", "compilatrix_rt_allocate - 4"] "runtime relocation"
+  else
+    need (elf.contains "There are no relocations in this file.")
+      s!"unexpected relocation for {fixture.name}\n{elf}"
+
+private def rejectOverflow (exe : String) (directory : FilePath) : IO Unit := do
+  let path := directory / "overflow.o"
+  let result ← IO.Process.output
+    { cmd := exe, args := #["validated-scalar", path.toString, "18446744073709551616"] }
+  need (result.exitCode == 2 && result.stderr.contains "unsupportedScalarShape" &&
+    !(← path.pathExists)) s!"overflow was not rejected before writing an object\n{result.stdout}{result.stderr}"
+
+def main (args : List String) : IO UInt32 := cli "x86 ELF object check failed" do
+  let args ← checked (parseArgs ["--fixture", "--readelf", "--objdump", "--cc", "--harness"] args)
+  let some exe := optional args "--fixture" | throw (IO.userError "--fixture is required")
+  let readelf := option args "--readelf" "readelf"
+  let objdump := option args "--objdump" "objdump"
+  let native ← nativeArgs args
+  IO.FS.withTempDir fun directory => do
+    for fixture in fixtures do
+      let path := directory / s!"{fixture.name}.o"
+      let (payload, source, localValue) ← generate exe fixture path
+      let (duplicate, duplicateSource, duplicateValue) ←
+        generate exe fixture (directory / s!"{fixture.name}-duplicate.o")
+      need (payload == duplicate) s!"nondeterministic object for {fixture.name}"
+      need (source == duplicateSource && localValue == duplicateValue && localValue == fixture.expected)
+        s!"fixture observation drifted for {fixture.name}"
+      let expectedSource := if fixture.kind == "selected-scalar" || fixture.kind == "validated-scalar"
+        then some localValue else none
+      need (source == expectedSource) s!"source/target observation disagrees for {fixture.name}"
+      inspect readelf objdump fixture path
+      if let some (cc, harness) := native then
+        linkAndRun cc readelf harness path (directory / s!"{fixture.name}-native") localValue
+    rejectOverflow exe directory
+  let suffix := if native.isSome then ", native link/run result match" else ""
+  IO.println s!"x86 ELF object check ok: {fixtures.length} deterministic objects, validated Ixon/IR/target agreement, real provenance goldens, overflow rejection, local semantics, readelf, objdump{suffix}"
diff --git a/Tests/Compiler/Checks/CheckX86Streams.lean b/Tests/Compiler/Checks/CheckX86Streams.lean
new file mode 100644
index 000000000..d0e5c782c
--- /dev/null
+++ b/Tests/Compiler/Checks/CheckX86Streams.lean
@@ -0,0 +1,309 @@
+import Ix.Compiler.Tools.Check
+import Ix.Compiler.X86.StreamExamples
+import Ix.Compiler.UniqueReuse.RuntimeObjectSim
+import Ix.Compiler.UniqueReuse.NativeObservations
+import Ix.Compiler.X86.RuntimeInput
+
+/-! Complete-stream and serialized-object regressions. The universal laws
+live in StreamTrace, ObjectExecution and RuntimeObjectSim. Mutations below
+alter concrete instruction and ELF fields, independently of the writers. -/
+
+open Ix.Compiler Ix.Compiler.X86
+open Ix.Compiler.Tools.Check (checked cli)
+
+private def need (condition : Bool) (message : String) : Except String Unit :=
+  if condition then .ok () else .error message
+
+private def registers : List GPR :=
+  [.rax, .rcx, .rdx, .rbx, .rsp, .rbp, .rsi, .rdi,
+   .r8, .r9, .r10, .r11, .r12, .r13, .r14, .r15]
+
+private def sameRegisters (left right : Core) : Bool :=
+  registers.all fun register => left.readReg register == right.readReg register
+
+private def sameBytes (left right : Memory) (addresses : List Word) : Bool :=
+  addresses.all fun address => left.bytes address == right.bytes address &&
+    left.readable address == right.readable address && left.writable address == right.writable address
+
+private def provenance : ELF.Provenance := .ixir1Policy (Ixon.Address.replicate 0x42) 3 7
+private def sentinel : Word := 0xff00
+private def textBase : Word := 0x100000
+
+private def artifact (program : Program) (name := "stream_test") : Except String (Checked × ELF.Input × ByteArray) := do
+  let target ← program.check.mapError reprStr
+  let stream ← (Stream.encode target).mapError reprStr
+  let input : ELF.Input := { encoded := stream.output, entryBlock := program.entry, exportName := name, provenance }
+  let object ← (ELF.writeChecked input).mapError reprStr
+  return (target, input, object.bytes)
+
+private def runUntilReturn (text : ByteArray) (base : Word) : Nat → ByteEval.State → Except String (ByteEval.State × Nat)
+  | 0, _ => .error "byte execution exhausted its bound"
+  | fuel + 1, state => do
+      let some decoded := Decode.decodeAt text (state.rip - base).toNat | throw "missing instruction boundary"
+      let next ← (ByteEval.step text base state).mapError reprStr
+      if next.rip == sentinel then
+        need (decoded.operation == .ret) "harness exit was not RET"
+        return (next, 1)
+      let (result, count) ← runUntilReturn text base fuel next
+      return (result, count + 1)
+
+private def runObject (bytes : ByteArray) (name : String) (base : Word) (fuel : Nat) (core : Core) :
+    Except String (ByteEval.State × Nat) := do
+  let some text := ELFRead.text? bytes | throw "object text extraction failed"
+  let some offset := ELF.entry? bytes name | throw "object entry extraction failed"
+  let (after, count) ← runUntilReturn text base fuel ⟨core, base + UInt64.ofNat offset, {}⟩
+  let replay ← (ObjectEval.run bytes name base count core).mapError reprStr
+  need (replay.rip == after.rip && sameRegisters replay.core after.core) "whole-object execution disagrees"
+  return (after, count)
+
+private def programCase (program : Program) (base : Word) : Except String Unit := do
+  let (target, input, bytes) ← artifact program
+  let core := StreamExamples.core
+  let typed := runFrom Runtime.rejecting target 100 core
+  need (decide (Stream.SafeTrace Runtime.rejecting target 100 (fun _ => False) (Machine.initial target core)))
+    "complete stream violates the concrete call/stack contract"
+  let .halted expected := typed.status | throw "typed stream did not return"
+  let (result, count) ← runObject bytes input.exportName base 300 core
+  need (result.core.readReg .rax == expected && result.core.readReg .rsp == 0x8010 && count ≤ 300 &&
+    sameRegisters typed.core (result.core.setReg .rsp 0x8008)) "complete stream register/return disagreement"
+  need (sameBytes typed.core.memory result.core.memory [0x8000, 0x8008, 0x800f, 0x9000])
+    "caller/saved-stack memory disagreement"
+
+private def completePrograms : Except String Nat := do
+  let programs := [Examples.arithmeticProgram, Examples.stackProgram, Examples.callProgram,
+    StreamExamples.tailCall, StreamExamples.nestedCalls, StreamExamples.reusedCalls,
+    { entry := 1, blocks := #[{ instructions := #[], terminator := .ret },
+      { instructions := #[.mov .w64 .rax (.imm 42)], terminator := .ret }] }]
+  for program in programs do
+    programCase program textBase
+    programCase program 0xfffffffffffffff0
+  let (target, input, bytes) ← artifact StreamExamples.reusedCalls
+  let typed := runFrom Runtime.rejecting target 11 StreamExamples.core
+  let (result, _) ← runObject bytes input.exportName textBase 33 StreamExamples.core
+  need (result.core.readReg .rcx == 42 && result.core.memory.read64 0x7ff8 == 42 &&
+    sameBytes typed.core.memory result.core.memory ((List.range 32).map fun i => 0x7ff0 + UInt64.ofNat i))
+    "ordinary store did not overwrite the reused return slot"
+  return programs.length * 2
+
+private def branchCases : Except String Nat := do
+  let conditions : List Condition := [.eq, .ne, .unsignedLt, .unsignedLe, .unsignedGt, .unsignedGe,
+    .signedLt, .signedLe, .signedGt, .signedGe]
+  let pairs : List (Word × Word) := [(0, 0), (0, 1), (1, 0),
+    (0x8000000000000000, 1), (0x7fffffffffffffff, 0xffffffffffffffff)]
+  for condition in conditions do
+    for (left, right) in pairs do
+      let program : Program := {
+        entry := 0
+        blocks := #[
+          { instructions := #[.mov .w64 .rax (.imm left), .mov .w64 .rcx (.imm right)]
+            terminator := .branch { width := .w64, left := .rax, right := .reg .rcx } condition 1 2 },
+          { instructions := #[.mov .w64 .rax (.imm 42)], terminator := .ret },
+          { instructions := #[.mov .w64 .rax (.imm 99)], terminator := .ret }] }
+      programCase program textBase
+  return conditions.length * pairs.length
+
+private def streamCorruptions : Except String Nat := do
+  let (target, input, _) ← artifact Examples.arithmeticProgram
+  let encoded := input.encoded
+  let mut corruptions : List (String × Encode.Output) := [
+    ("truncated text", { encoded with text := encoded.text.extract 0 (encoded.text.size - 1) }),
+    ("extra text", { encoded with text := encoded.text.push 0x90 }),
+    ("changed immediate", { encoded with text := encoded.text.set! 2 41 }),
+    ("unsupported opcode", { encoded with text := encoded.text.set! 0 0xf0 }),
+    ("wrong entry offset", { encoded with blockOffsets := encoded.blockOffsets.set! 0 1 }),
+    ("missing block offset", { encoded with blockOffsets := #[] }),
+    ("unclaimed relocation", { encoded with relocations := #[{ offset := 2, symbol := "unexpected", addend := -4 }] })]
+  let block := target.program.blocks[0]!
+  let term := Stream.instructionOffset block block.instructions.size
+  let .branch comparison _ _ _ := block.terminator | throw "branch fixture changed"
+  let jcc := term + (Encode.encodeCompare comparison).size
+  corruptions := corruptions ++ [
+    ("wrong conditional target", { encoded with text := encoded.text.set! (jcc + 2) 1 }),
+    ("wrong fallthrough target", { encoded with text := encoded.text.set! (jcc + 7) 0 }),
+    ("changed unreachable block", { encoded with text := encoded.text.set! (encoded.text.size - 1) 0x90 })]
+  for (name, changed) in corruptions do need (!Stream.check target.program changed) s!"stream accepted {name}"
+  let (runtime, runtimeInput, _) ← artifact Examples.runtimeProgram
+  let encoded := runtimeInput.encoded
+  let relocation := encoded.relocations[0]!
+  let runtimeCorruptions := [
+    { encoded with relocations := #[] },
+    { encoded with relocations := #[{ relocation with offset := relocation.offset + 1 }] },
+    { encoded with relocations := #[{ relocation with symbol := "wrong_runtime" }] },
+    { encoded with relocations := #[{ relocation with addend := 0 }] },
+    { encoded with text := encoded.text.set! relocation.offset 1 }]
+  for changed in runtimeCorruptions do need (!Stream.check runtime.program changed) "stream accepted corrupted external fixup"
+  return corruptions.length + runtimeCorruptions.length
+
+-- Mutate little-endian fields without calling the serializer or its helpers.
+private def putNatural (bytes : ByteArray) (offset count value : Nat) : ByteArray :=
+  (List.range count).foldl (fun bytes index => bytes.set! (offset + index) (UInt8.ofNat (value / 256 ^ index % 256))) bytes
+
+private def objectCorruptions : Except String Nat := do
+  let (_, input, bytes) ← artifact Examples.runtimeProgram
+  let some view := ELFRead.parse bytes | throw "baseline object did not parse"
+  need (ELF.check input bytes) "baseline object did not validate"
+  let table := view.header.sectionOffset
+  let text := view.sections[1]!.header.offset
+  let rela := view.sections[2]!.header.offset
+  let note := view.sections[3]!.header.offset
+  let symbols := view.sections[4]!.header.offset
+  let strings := view.sections[5]!.header
+  let names := view.sections[7]!.header
+  let descriptor := note + 24
+  let domainSize := "compilatrix/x86-object-provenance/1".toUTF8.size
+  let fieldMutations : List (String × Nat × Nat × Nat) := [
+    ("magic", 0, 1, 0), ("class", 4, 1, 1), ("endianness", 5, 1, 2),
+    ("ident padding", 15, 1, 1), ("object type", 16, 2, 2), ("machine", 18, 2, 3),
+    ("ELF version", 20, 4, 0), ("executable entry", 24, 8, 1), ("program table", 32, 8, 64),
+    ("section table bounds", 40, 8, bytes.size), ("section table overflow", 40, 8, 2^64-1),
+    ("header size", 52, 2, 63), ("program count", 56, 2, 1), ("section entry size", 58, 2, 63),
+    ("section count", 60, 2, 65535), ("section string index", 62, 2, 5),
+    ("text section type", table + 64 + 4, 4, 8), ("writable text", table + 64 + 8, 8, 7),
+    ("nonzero section address", table + 64 + 16, 8, 1), ("text alignment", table + 64 + 48, 8, 0),
+    ("text bounds", table + 64 + 24, 8, bytes.size), ("text size", table + 64 + 32, 8, 2^64-1),
+    ("overlapping sections", table + 128 + 24, 8, text),
+    ("missing relocation", table + 128 + 32, 8, 0), ("relocation target section", table + 128 + 44, 4, 3),
+    ("symbol strings link", table + 256 + 40, 4, 7), ("local symbol boundary", table + 256 + 44, 4, 3),
+    ("executable stack", table + 384 + 8, 8, 4),
+    ("instruction byte", text, 1, 0xf0), ("symbol name", symbols + 48, 4, 0),
+    ("symbol binding", symbols + 52, 1, 2), ("symbol visibility", symbols + 53, 1, 1),
+    ("symbol section", symbols + 54, 2, 0), ("export value", symbols + 56, 8, 1),
+    ("export size", symbols + 64, 8, 0), ("runtime symbol defined", symbols + 78, 2, 1),
+    ("relocation offset", rela, 8, view.text.size), ("relocation kind", rela + 8, 4, 1),
+    ("relocation symbol", rela + 12, 4, 2), ("relocation symbol bounds", rela + 12, 4, 99),
+    ("relocation addend", rela + 16, 8, 0), ("note name size", note, 4, 2^32-1),
+    ("note descriptor size", note + 4, 4, 2^32-1), ("note type", note + 8, 4, 0),
+    ("note name", note + 12, 1, 0), ("provenance domain", descriptor, 1, 0),
+    ("provenance separator", descriptor + domainSize, 1, 1),
+    ("provenance kind", descriptor + domainSize + 1, 1, 2),
+    ("provenance root", descriptor + domainSize + 2, 1, 0x43),
+    ("lowering version", descriptor + domainSize + 34, 4, 4),
+    ("policy version", descriptor + domainSize + 38, 4, 8),
+    ("string table initial NUL", strings.offset, 1, 1),
+    ("unterminated symbol name", strings.offset + strings.size - 1, 1, 1),
+    ("unterminated section name", names.offset + names.size - 1, 1, 1)]
+  for (name, offset, count, value) in fieldMutations do
+    let changed := putNatural bytes offset count value
+    need (changed != bytes) s!"ineffective corruption: {name}"
+    need (!ELF.check input changed) s!"object accepted {name}"
+  for cut in [:bytes.size] do need (!ELF.check input (bytes.extract 0 cut)) s!"object accepted truncated prefix {cut}"
+  need (!ELF.check input (bytes.push 0)) "object accepted trailing data"
+  need ((ELF.entry? bytes "wrong_export").isNone) "wrong exported name resolved"
+  need (!ELF.check { input with provenance := .ixir2 (Ixon.Address.replicate 0x42) } bytes) "wrong provenance family accepted"
+  let (_, otherInput, otherBytes) ← artifact Examples.arithmeticProgram
+  need (!ELF.check otherInput bytes && !ELF.check input otherBytes) "cross-object substitution accepted"
+  return fieldMutations.length + bytes.size + 4
+
+private def relocationCases : Except String Nat := do
+  let target ← Examples.runtimeProgram.check.mapError reprStr
+  let stream ← (Stream.encode target).mapError reprStr
+  let input : ELF.Input := { encoded := stream.output, entryBlock := 0, exportName := "runtime_test", provenance }
+  let object ← (ELF.writeChecked input).mapError reprStr
+  let some view := ELFRead.parse object.bytes | throw "runtime ELF parse failed"
+  let relocation := view.relocations[0]!
+  let next := relocation.offset + 4
+  let targets : List Int := [0x1000, -0x1000, (next : Int) - 2147483648, (next : Int) + 2147483647]
+  for destination in targets do
+    let symbols : ELFLink.Symbols := fun name => if name == "compilatrix_rt_allocate" then some destination else none
+    let linked ← (ELFLink.resolve target input object symbols).mapError reprStr
+    need (linked.view.relocations == view.relocations) "linker changed relocation interpretation"
+    let state ← (ByteEval.run linked.output.text textBase 4 ⟨StreamExamples.core, textBase, {}⟩).mapError reprStr
+    need (state.rip == ELFLink.address textBase destination && state.core.readReg .rsp == 0x7ff8 &&
+      state.core.memory.read64 0x7ff8 == textBase + UInt64.ofNat next) "resolved runtime CALL target or return slot differs"
+    for index in [:stream.output.text.size] do
+      if index < relocation.offset || relocation.offset + 4 ≤ index then
+        need (linked.output.text[index]? == stream.output.text[index]?) "relocation changed an unrelated byte"
+    need (!Stream.check target.program { linked.output with text := linked.output.text.set! 0 0xf0 } (ELFLink.targets symbols))
+      "linked stream accepted unrelated corruption"
+  let .error (.missingSymbol _) := ELFLink.resolve target input object (fun _ => none) | throw "missing runtime symbol accepted"
+  for displacement in ([-2147483649, 2147483648] : List Int) do
+    let .error (.overflow _ _) := ELFLink.resolve target input object (fun _ => some ((next : Int) + displacement))
+      | throw "overflowing runtime relocation accepted"
+  let symbols : ELFLink.Symbols := fun _ => some 42
+  for bad in [{ relocation with relocationType := 1 }, { relocation with offset := stream.output.text.size },
+      { relocation with symbolName := ⟨#[0xff]⟩ }] do
+    need (!(ELFLink.apply symbols [bad] stream.output.text).isOk) "malformed relocation accepted"
+  return targets.length + 6
+
+private def returnFault : Except String Unit := do
+  let (_, input, bytes) ← artifact { entry := 0, blocks := #[{ instructions := #[], terminator := .ret }] }
+  let .error (.machine (.memory ⟨.read, 0x8008, 8⟩)) :=
+    ObjectEval.run bytes input.exportName textBase 1 { StreamExamples.core with memory := Memory.unmapped }
+    | throw "top-level RET did not require a readable caller slot"
+
+private def contractCases : Except String Nat := do
+  for instruction in ([.load .w64 .rcx { base := some .rsp },
+      .store .w64 { base := some .rsp } .rax, .mov .w64 .rbx (.imm 1)] : List Instr) do
+    let program : Program := {
+      entry := 0
+      blocks := #[{ instructions := #[.push .rbp, .call 1, .pop .rbp], terminator := .ret },
+        { instructions := #[instruction], terminator := .ret }] }
+    let target ← program.check.mapError reprStr
+    need (!decide (Stream.SafeTrace Runtime.rejecting target 10 (fun _ => False)
+      (Machine.initial target StreamExamples.core))) "unsafe return-slot/callee-save behavior accepted"
+  let target ← Examples.callProgram.check.mapError reprStr
+  need (!decide (Stream.SafeTrace Runtime.rejecting target 10 (fun _ => False)
+    (Machine.initial target (StreamExamples.core.setReg .rsp 0x8000)))) "misaligned call contract accepted"
+  let program : Program := {
+    entry := 0
+    blocks := #[
+      { instructions := #[.push .rbp, .call 1,
+          .load .w64 .rcx { base := some .rsp, displacement := 0xfffffff8 }, .pop .rbp]
+        terminator := .ret },
+      { instructions := #[.mov .w64 .rax (.imm 42)], terminator := .ret }] }
+  let target ← program.check.mapError reprStr
+  need (!decide (Stream.SafeTrace Runtime.rejecting target 10 (fun _ => False)
+    (Machine.initial target StreamExamples.core))) "read of a retired physical return address accepted"
+  let holes := Stream.clearRange (Stream.addRange (fun _ => False) 0x7ff8 8) 0x7ff8 4
+  need (decide (Stream.ReadableData holes 0x7ff8 4) && !decide (Stream.ReadableData holes 0x7ff8 8))
+    "partial store cleared the wrong return-slot bytes"
+  return 6
+
+private def runtimeObjects : Except String Nat := do
+  let source ← UniqueReuse.Runtime.source
+  let compilation ← UniqueReuse.Runtime.compile source.constants source.entry
+  let .native output := UniqueReuse.Runtime.Native.select compilation | throw "runtime native selection failed"
+  let main ← output.emit .main
+  let release ← output.emit .release
+  let mut steps := 0
+  for (name, values) in UniqueReuse.Native.Examples.cases do
+    let words ← UniqueReuse.Runtime.Native.ofNats values
+    let bound : PLift (words.length ≤ UniqueABI.maxLength) ←
+      if h : words.length ≤ UniqueABI.maxLength then pure ⟨h⟩ else throw "runtime input exceeds ABI"
+    let layout := RuntimeExecution.canonicalLayout words bound.down
+    let stack : Memory := { Memory.unmapped with
+      readable := fun address => 0x7f00 ≤ address && address < 0x8100
+      writable := fun address => 0x7f00 ≤ address && address < 0x8100 }
+    let core : Core := {
+      registers := ((Registers.zero.set .rsp 0x8008).set .rdi layout.base).set .rsi (UInt64.ofNat words.length)
+      memory := RuntimeExecution.inputMemory layout words (stack.write64 0x8008 sentinel) }
+    let typed := runFrom Runtime.rejecting RuntimeTarget.checked (RuntimeTarget.controlCost words.length) core
+    let (result, count) ← runObject main.bytes main.role.symbol textBase (3 * RuntimeTarget.controlCost words.length) core
+    steps := steps + count
+    need (typed.status == .halted (layout.cell 1) && result.core.readReg .rsp == 0x8010 &&
+      sameRegisters typed.core (result.core.setReg .rsp 0x8008)) s!"runtime object return: {name}"
+    let probes := (List.range (8 * layout.slots)).map fun index => layout.base + UInt64.ofNat index
+    need (sameBytes typed.core.memory result.core.memory probes) s!"runtime object arena: {name}"
+    let observed ← UniqueReuse.Native.Examples.nativeList layout result.core.memory words.length (result.core.readReg .rax)
+    need (observed == values.reverse) s!"runtime object reversal: {name}"
+    let typedDrop := runFrom Runtime.rejecting RuntimeTarget.releaseChecked (UniqueTarget.releaseCost words.length) typed.core
+    let (dropped, count) ← runObject release.bytes release.role.symbol textBase (3 * UniqueTarget.releaseCost words.length)
+      (result.core.setReg .rsp 0x8008)
+    steps := steps + count
+    need (typedDrop.status == .halted 0 && dropped.core.readReg .rsp == 0x8010 &&
+      sameRegisters typedDrop.core (dropped.core.setReg .rsp 0x8008) && sameBytes typedDrop.core.memory dropped.core.memory probes)
+      s!"runtime object release: {name}"
+    let header := UniqueReuse.Native.Examples.headerValues layout dropped.core.memory
+    need (header[2]! == header[3]! && header[5]! == 0 && header[7]! == 0 && header[9]! == 0) s!"runtime object leaked: {name}"
+  return steps
+
+def main : IO UInt32 := cli "x86 stream/object check failed" do
+  let streams ← checked completePrograms
+  let branches ← checked branchCases
+  let streamNegatives ← checked streamCorruptions
+  let objectNegatives ← checked objectCorruptions
+  let relocations ← checked relocationCases
+  checked returnFault
+  let contracts ← checked contractCases
+  let runtimeSteps ← checked runtimeObjects
+  IO.println s!"x86 stream/object check ok: {streams} complete streams, {branches} branch objects, {streamNegatives} stream corruptions, {objectNegatives} object corruptions/truncations, {relocations} relocation cases, {contracts} stack contracts, caller-slot fault, eight actual runtime object pairs ({runtimeSteps} byte steps)"
diff --git a/Tests/Compiler/SourceBorrow.lean b/Tests/Compiler/SourceBorrow.lean
new file mode 100644
index 000000000..e73350512
--- /dev/null
+++ b/Tests/Compiler/SourceBorrow.lean
@@ -0,0 +1,35 @@
+import Ix.Compiler.Borrow.Report
+
+open Lean Ix.Compiler
+
+private def writeJson (path : System.FilePath) (json : Json) : IO Unit :=
+  IO.FS.writeFile path (json.pretty 100 ++ "\n")
+
+def main (args : List String) : IO UInt32 := do
+  let [directory] := args
+    | IO.eprintln "usage: lake exe compiler-source-borrow <new-output-directory>"
+      return 2
+  try
+    let directory : System.FilePath := directory
+    if ← directory.pathExists then throw (IO.userError "source-borrow requires a new output directory")
+    let mut results := #[]
+    for depth in [:9] do
+      for successorCase in [false, true] do
+        results := results.push (← Borrow.runCase depth successorCase)
+    if !IxIR2.Borrow.Examples.guards.all (·.2) then
+      throw (IO.userError "borrow ownership or resource rejection guard failed")
+    IO.FS.createDirAll directory
+    for result in results do writeJson (directory / s!"{result.name}.json") result.snapshot
+    writeJson (directory / "report.json") (Json.mkObj [
+      ("format", toJson "compilatrix/source-borrow/1"),
+      ("policy", toJson "closed-scalar-borrow/1"),
+      ("peak_policy", toJson "nonincreasing-peak-live-heap-nodes"),
+      ("cases", toJson (results.map (·.row))),
+      ("negative_guards", toJson IxIR2.Borrow.Examples.guards)])
+    let compileMs := results.foldl (fun total result => total + result.compileMs) 0
+    let borrowMs := results.foldl (fun total result => total + result.borrowMs) 0
+    IO.println s!"source-borrow ok: {results.size} accepted Ixon cases; RC 5 -> 3, peak 2, full reclamation; compile {compileMs} ms, borrow checks {borrowMs} ms"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-borrow: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceBorrowRuntime.lean b/Tests/Compiler/SourceBorrowRuntime.lean
new file mode 100644
index 000000000..2887c7c8e
--- /dev/null
+++ b/Tests/Compiler/SourceBorrowRuntime.lean
@@ -0,0 +1,36 @@
+import Ix.Compiler.Borrow.RuntimeReport
+import Ix.Compiler.IxIR2.Borrow.OpenExamples
+
+open Lean Ix.Compiler
+
+private def writeJson (path : System.FilePath) (value : Json) : IO Unit :=
+  IO.FS.writeFile path (value.pretty 100 ++ "\n")
+
+def main (args : List String) : IO UInt32 := do
+  let [directory] := args
+    | IO.eprintln "usage: source-borrow-runtime <new-output-directory>"
+      return 2
+  try
+    let directory : System.FilePath := directory
+    if ← directory.pathExists then throw (IO.userError "source-borrow-runtime requires a new output directory")
+    let mut results := #[]
+    for depth in [:9] do results := results.push (← Borrow.Runtime.runCase depth)
+    if !IxIR2.Borrow.Open.Examples.guards.all (·.2) || !IxIR2.Borrow.Examples.guards.all (·.2) then
+      throw (IO.userError "borrow runtime structural or ownership guard failed")
+    IO.FS.createDirAll directory
+    for result in results do writeJson (directory / s!"{result.name}.json") result.snapshot
+    writeJson (directory / "report.json") (Json.mkObj [
+      ("format", toJson "compilatrix/source-borrow-runtime/1"),
+      ("policy", toJson "open-shared-tag-borrow/1"),
+      ("input_policy", toJson "one-owned-shared-root-allocation-ordered-heap"),
+      ("peak_policy", toJson "nonincreasing-peak-live-heap-nodes"),
+      ("structural_guards", toJson IxIR2.Borrow.Open.Examples.guards),
+      ("ownership_guards", toJson IxIR2.Borrow.Examples.guards),
+      ("cases", toJson (results.map (·.row)))])
+    let compileMs := results.foldl (fun total result => total + result.compileMs) 0
+    let checkMs := results.foldl (fun total result => total + result.checkMs) 0
+    IO.println s!"source-borrow-runtime ok: {results.size} source functions; 72 runtime inputs, 144 direct/PAP comparisons; 2 fewer RC operations, full reclamation, unchanged peak; compile {compileMs} ms, structural checks {checkMs} ms"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-borrow-runtime: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceCallReuse.lean b/Tests/Compiler/SourceCallReuse.lean
new file mode 100644
index 000000000..2f41e06e6
--- /dev/null
+++ b/Tests/Compiler/SourceCallReuse.lean
@@ -0,0 +1,29 @@
+import Ix.Compiler.CallReuse.Rejections
+
+/-! Fresh-process source map artifacts and versioned policy observations. -/
+
+open Lean Ix.Compiler.CallReuse.Examples
+
+def main (args : List String) : IO UInt32 := do
+  let output : Option System.FilePath ← match args with
+    | [] => pure none
+    | [path] => pure (some path)
+    | _ =>
+        IO.eprintln "usage: lake exe compiler-source-call-reuse [new-output-directory]"
+        return 2
+  try
+    if let some path := output then
+      if ← path.pathExists then throw (IO.userError "source-call-reuse requires a new output directory")
+    let (results, checks) ← match runAll with
+      | .error message => throw (IO.userError message)
+      | .ok value => pure value
+    if let some path := output then
+      IO.FS.createDirAll path
+      for result in results do
+        IO.FS.writeFile (path / s!"{result.name}.json") (result.snapshot.pretty 100 ++ "\n")
+      IO.FS.writeFile (path / "report.json") ((report results checks).pretty 100 ++ "\n")
+    IO.println s!"source-call-reuse ok: {results.length} Ixon maps, {checks.length} policy/rejection checks; values, reservation prefixes, costs, and reclamation agree"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-call-reuse: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceCoverage.lean b/Tests/Compiler/SourceCoverage.lean
new file mode 100644
index 000000000..dadafc4de
--- /dev/null
+++ b/Tests/Compiler/SourceCoverage.lean
@@ -0,0 +1,51 @@
+import Ix.Compiler.Coverage.Report
+import Ix.Compiler.Coverage.UpstreamNative
+
+/-! Emit a deterministic coverage report and complete compiler snapshots.
+The independent Lean gate runs this executable in two fresh directories. -/
+
+open Ix.Compiler Ix.Compiler.Coverage
+
+private def usage : String :=
+  "usage: lake exe compiler-source-coverage <new-output-directory> [ixon-std-contact-directory [ixon-upstream-directory]]"
+
+private def checked {α : Type} (result : Except String α) : IO α :=
+  match result with
+  | .ok value => pure value
+  | .error message => throw (IO.userError message)
+
+private def writeJson (path : System.FilePath) (value : Lean.Json) : IO Unit :=
+  IO.FS.writeFile path (value.pretty 100 ++ "\n")
+
+def main (args : List String) : IO UInt32 := do
+  let some (output, contact, upstream) := (match args with
+      | [output] => some (output, CatalogContactFixture.directory, Upstream.directory)
+      | [output, contact] => some (output, contact, Upstream.directory)
+      | [output, contact, upstream] => some (output, contact, upstream)
+      | _ => none)
+    | IO.eprintln usage
+      return 2
+  try
+    let output : System.FilePath := output
+    if ← output.pathExists then
+      throw (IO.userError "source-coverage requires a new output directory")
+    -- Finish every gate before publishing any snapshot or report.
+    let sources ← checked Coverage.sources
+    let synthetic ← checked (sources.mapM fun source =>
+      (runSource source).mapError (fun error => s!"{source.name}: {error}"))
+    let loaded ← checked (← CatalogContactFixture.load contact)
+    let production ← checked (productionCases loaded)
+    let upstream ← checked (← UpstreamNative.cases upstream)
+    let corpus ← checked generatedCorpus
+    let results := synthetic ++ production ++ upstream
+    IO.FS.createDirAll output
+    for result in results do
+      writeJson (output / s!"{result.name}.json") result.snapshot
+      if let some object := result.object then
+        IO.FS.writeBinFile (output / s!"{result.name}.o") object
+    writeJson (output / "report.json") (report results corpus)
+    IO.println s!"source-coverage ok: {results.length} Ixon cases, {results.countP (·.object.isSome)} ELF objects, {IxIR1.WellModedGen.defaultCases} generated IxIR0 cases"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-coverage: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceNativeCapturedScalar.lean b/Tests/Compiler/SourceNativeCapturedScalar.lean
new file mode 100644
index 000000000..657c75f9e
--- /dev/null
+++ b/Tests/Compiler/SourceNativeCapturedScalar.lean
@@ -0,0 +1,251 @@
+import Ix.Compiler.X86.PhysicalScalarSources
+import Ix.Compiler.X86.PhysicalScalarCapturedSourceObject
+import Ix.Compiler.X86.PhysicalScalarExamples
+import Ix.Compiler.X86.ScalarNat
+import Ix.Compiler.Coverage.Snapshot
+import Ix.Compiler.Tools.Check
+
+open Lean Ix.Compiler Ix.Compiler.X86 Ix.Compiler.Tools.Check
+namespace CapturedGate
+open PhysicalScalar.Captured
+
+def families : List String := ["capture-project", "capture-choice", "capture-nested"]
+def captures : List (String × Nat) := [("zero", 0), ("seven", 7), ("max", UInt64.size - 1)]
+
+def inputs : List (Nat × Nat) :=
+  let m := UInt64.size - 1
+  [(0,0), (0,1), (1,0), (1,1), (2,3), (3,2), (7,7), (7,19), (19,7),
+    (0,m), (m,0), (m,1), (1,m), (m,m), (m-1,1), (m-1,2), (2,m-1), (m,m-1), (m-1,m)]
+
+def expected (name : String) (capture argument : Nat) : Nat := match name with
+  | "capture-project" => capture
+  | "capture-choice" => if argument == 0 then capture else argument - 1
+  | _ => if argument ≤ 2 then capture else argument - 3
+
+def core (depth a b : Nat) : Core :=
+  let low : Word := 0x10000
+  let top := low + (272 * depth - 8).toUInt64
+  let allowed := fun address : Word => decide (low ≤ address ∧ address < top + 8)
+  let memory : Memory := { bytes := fun address => (address ^^^ 0xa7).toUInt8, readable := allowed, writable := allowed }
+  let registers : Registers := fun register => 0x1020304050607080 + (SysV.calleeSaved.toList.idxOf register + 1).toUInt64
+  { registers := ((registers.set .rsp top).set .rdi a.toUInt64).set .rsi b.toUInt64
+    memory := memory.write64 top 0x12345678 }
+
+def native (target : X86.Checked) (text : ByteArray) (entry : Nat) (initial : Core) (wanted : Nat) : IO Nat := do
+  let typed := X86.runFrom Runtime.rejecting target 1000 initial
+  need (typed.status == .halted wanted.toUInt64 && typed.core.readReg .rax == wanted.toUInt64 && typed.core.readReg .rdx == 0)
+    "captured scalar typed native result disagrees"
+  need (typed.core.readReg .rsp == initial.readReg .rsp && typed.core.calleeSavedMatch initial.calleeSavedSnapshot)
+    "captured scalar typed stack/register restoration failed"
+  let base : Word := 0x400000
+  let mut state : ByteEval.State := ⟨initial, base + entry.toUInt64, {}⟩
+  let mut count := 0
+  for _ in [:1000] do
+    if state.rip == 0x12345678 then break
+    state ← checked ((ByteEval.step text base state).mapError reprStr)
+    count := count + 1
+  need (state.rip == 0x12345678 && state.core.readReg .rax == wanted.toUInt64 && state.core.readReg .rdx == 0)
+    "captured scalar byte result/status/return address disagrees"
+  need (state.core.readReg .rsp == initial.readReg .rsp + 8 && state.core.calleeSavedMatch initial.calleeSavedSnapshot)
+    "captured scalar byte stack/register restoration failed"
+  for address in [(0xffff : Word), 0xfff8, initial.readReg .rsp + 8, initial.readReg .rsp + 16] do
+    need (state.core.memory.bytes address == initial.memory.bytes address) "captured scalar outside canary changed"
+  return count
+
+def observePhysical (program : IxIR2.Program) (definition : IxIR2.Function)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema) (values : Array Word) (wanted : Nat)
+    (initial : IxIR2.Eval.Store := {}) : IO (Nat × Nat) := do
+  let ctx := IxIR2.Eval.Context.ofProgram program schemas
+  let mut costs := (0, 0)
+  for mode in [IxIR2.Eval.Interpretation.logical, .physical] do
+    let result ← checked ((IxIR2.Eval.runFunction ctx mode definition (values.map PhysicalScalar.rval) 1000 1000 initial).mapError reprStr)
+    need (result.value == .lit (.nat wanted)) "captured scalar CFG result disagrees"
+    need (result.store.counters == initial.counters && result.store.live == 0 &&
+      result.store.heap.nodes.size == initial.heap.nodes.size && result.store.heap.nodes.all Option.isNone)
+      "captured scalar CFG changed the heap or allocation/reference counters"
+    costs := (1000 - result.controlRemaining, 1000 - result.heapRemaining)
+  return costs
+
+def heapJSON (store : IxIR1.Store) : Json := Json.mkObj [
+  ("allocs", toJson store.allocs), ("frees", toJson store.frees), ("rcops", toJson store.rcops),
+  ("reuses", toJson store.reuses), ("slots", toJson store.nodes.size), ("live", toJson store.live)]
+
+def sameHeap (left right : IxIR1.Store) : Bool :=
+  heapJSON left == heapJSON right && (left.nodes.zip right.nodes).all fun (a, b) =>
+    match a, b with
+    | none, none => true
+    | some a, some b => a.world == b.world && a.rc == b.rc && a.node == b.node
+    | _, _ => false
+
+def rejected {α : Type} (name : String) (result : Except String α) : IO Unit := do
+  match result with
+  | .error _ => pure ()
+  | .ok _ => throw (IO.userError s!"captured scalar accepted {name}")
+
+def initializerRejections {program schemas limits provenance}
+    (compiled : Compiled program schemas limits provenance) : IO (Array String) := do
+  let source := compiled.source
+  let main := fun instructions terminator => PhysicalScalar.Examples.function 0
+    #[PhysicalScalar.Examples.block 0 instructions terminator]
+  let pap := IxIR2.Instr.papp source.address #[.lit (.nat source.capture.toNat)]
+  let replace := fun definition => { program with declarations := program.declarations.map fun (address, old) =>
+    (address, if address == source.address then .fn definition else old) }
+  let malformed : List (String × IxIR2.Program) := [
+    ("non-nullary", { program with main := { program.main with signature := { program.main.signature with
+      params := #[⟨.shared, .owned⟩] } } }),
+    ("empty-main", { program with main := { program.main with blocks := #[] } }),
+    ("non-closure", { program with main := main #[] (.ret (.lit (.nat 0))) }),
+    ("zero-captures", { program with main := main #[.papp source.address #[]] (.ret (.reg 0)) }),
+    ("non-word-capture", { program with main := main #[.papp source.address #[.erased]] (.ret (.reg 0)) }),
+    ("capture-overflow", { program with main := main #[.papp source.address #[.lit (.nat UInt64.size)]] (.ret (.reg 0)) }),
+    ("extra-live-closure", { program with main := main #[pap, pap] (.ret (.reg 1)) }),
+    ("shared-rc-two", { program with main := main #[pap, .retainShared (.reg 0)] (.ret (.reg 1)) }),
+    ("missing-target", { program with declarations := program.declarations.filter (fun pair => pair.1 != source.address) }),
+    ("unsafe-target", replace { source.target with signature := { source.target.signature with papSafe := false } }),
+    ("target-arity", replace { source.target with signature := { source.target.signature with params := #[] } }),
+    ("multiple-captures", { (replace { source.target with signature := { source.target.signature with
+      params := Array.replicate 3 ⟨.shared, .owned⟩ } }) with
+      main := main #[.papp source.address #[.lit (.nat 0), .lit (.nat 1)]] (.ret (.reg 0)) })]
+  for (name, changed) in malformed do
+    rejected name (checkInitializer changed schemas)
+  for (name, limits) in [("control-limit", { control := 0 : Limits }), ("heap-limit", { heap := 0 : Limits }),
+      ("slot-limit", { slots := 1 : Limits })] do
+    rejected name (checkInitializer program schemas limits)
+  return malformed.toArray.map (·.1) ++ #["control-limit", "heap-limit", "slot-limit"]
+
+def stackRejections (target : X86.Checked) (depth : Nat) : IO Unit := do
+  let initial := core depth 2 3
+  let inaccessible := { initial with memory := { initial.memory with writable := fun _ => false } }
+  let .trapped (.memoryFault _) := (X86.runFrom Runtime.rejecting target 1000 inaccessible).status
+    | throw (IO.userError "captured scalar unwritable stack did not trap")
+  let floor := initial.readReg .rsp - 264
+  let short := { initial with memory := { initial.memory with
+    readable := fun address => decide (floor ≤ address ∧ address < initial.readReg .rsp + 8)
+    writable := fun address => decide (floor ≤ address ∧ address < initial.readReg .rsp + 8) } }
+  let .trapped (.memoryFault _) := (X86.runFrom Runtime.rejecting target 1000 short).status
+    | throw (IO.userError "captured scalar insufficient nested-call stack did not trap")
+
+def admission : IO Unit := do
+  for values in [#[UInt64.size], #[UInt64.size * 2]] do
+    need ((Scalar.encodeArguments values).isNone) "captured scalar argument conversion wrapped"
+  need (Scalar.encodeArguments #[UInt64.size - 1] == some #[0xffffffffffffffff]) "maximum exact argument rejected"
+  let full ← present (Scalar.check { functions := Array.replicate 32 ⟨2, .atom (.var 0)⟩, entry := 31 })
+    "32-function boundary fixture is invalid"
+  rejected "33-function wrapper" (Scalar.bind full 7)
+  let unary ← present (Scalar.check { functions := #[⟨1, .atom (.var 0)⟩], entry := 0 }) "unary fixture is invalid"
+  rejected "unary underlying target" (Scalar.bind unary 7)
+  let tooLarge ← checked (PhysicalScalar.Examples.source "capture-project" (some UInt64.size))
+  let attached ← checked (tooLarge.compile.mapError reprStr)
+  rejected "actual source capture overflow" (compileSource attached)
+
+end CapturedGate
+
+def main (args : List String) : IO UInt32 := cli "source-native-captured-scalar" do
+  let [directory] := args | throw (IO.userError "usage: source-native-captured-scalar <new-output-directory>")
+  let directory : System.FilePath := directory
+  need (!(← directory.pathExists)) "captured scalar producer requires a fresh output directory"
+  CapturedGate.admission
+  IO.FS.createDirAll directory
+  let mut rows : Array Json := #[]
+  let mut rejected : Array String := #[]
+  for family in CapturedGate.families do
+    for (tag, capture) in CapturedGate.captures do
+      let name := s!"{family}-{tag}"
+      let source ← checked (PhysicalScalar.Examples.source family (some capture))
+      let attached ← checked (source.compile.mapError reprStr)
+      let compiled ← checked (PhysicalScalar.Captured.compileSource attached "compilatrix_scalar")
+      need (compiled.source.capture.toNat == capture && compiled.source.target.signature.params.size == 2 &&
+        compiled.bound.checked.program.functions[compiled.bound.checked.program.entry]?.map (·.parameters) == some 1)
+        "captured scalar capture or ABI changed"
+      let failures ← CapturedGate.initializerRejections compiled
+      if rejected.isEmpty then rejected := failures else need (rejected == failures) "initializer rejection inventory differs"
+      let depth := compiled.bound.checked.program.entry + 1
+      CapturedGate.stackRejections compiled.native.target depth
+      let program := attached.target.artifact.program
+      let schemas := attached.target.artifact.validationContext.schemas
+      let physicalContext := IxIR2.Eval.Context.ofProgram program schemas
+      let initialized := compiled.source.result
+      let location := compiled.source.heap.location
+      need (location == 1 && initialized.store.heap.nodes.size == 2 && initialized.store.heap.allocs == 2 &&
+        initialized.store.heap.frees == 1 && initialized.store.heap.rcops == 1 && initialized.store.heap.reuses == 0 &&
+        initialized.store.live == 1 && initialized.store.peakLiveNodes == 1)
+        "captured scalar initializer allocation/capture layout changed"
+      let ir1Context := attached.compiled.simulationSourceContext
+      let (moduleStore, moduleValue) ← checked ((IxIR1.runMain ir1Context attached.source.artifact.main 1000).mapError reprStr)
+      need (moduleValue == initialized.value && CapturedGate.sameHeap moduleStore initialized.store.heap)
+        "IxIR1 and physical captured initializer disagree"
+      let spent := compiled.source.heap.spent
+      need (spent.nodes.all Option.isNone && spent.allocs == 2 && spent.frees == 2 && spent.rcops == 2 && spent.reuses == 0)
+        "captured scalar closure reclamation disagrees"
+      let ctx := Pipeline.validatedEvalCtx source.constants source.config
+      let function ← checked ((Ixon.Eval.eval ctx 2000 (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError reprStr)
+      let rawCtx : IxIR0.Ctx := { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+      let rawFunction ← checked ((IxIR0.eval rawCtx 2000 [] (.ref source.root)).mapError reprStr)
+      let .error (.stuck _) := Ixon.Eval.applyMany ctx 20000 function [.litV (.natL 2), .litV (.natL 3)]
+        | throw (IO.userError "captured source overapplication accepted")
+      let .error (.stuck _) := IxIR1.applyGo ir1Context 1000 moduleStore moduleValue [.lit (.nat 2), .lit (.nat 3)]
+        | throw (IO.userError "captured IxIR1 overapplication accepted")
+      for badArgs in [#[.lit (.nat 2)], #[.lit (.nat capture), .lit (.nat 2), .lit (.nat 3)]] do
+        let .error (.stuck message) := IxIR2.Eval.runFunction physicalContext .physical compiled.source.target badArgs 1000 1000
+          | throw (IO.userError "captured physical invocation accepted wrong arity")
+        need (message == "function argument arity mismatch") "captured physical invocation rejected for the wrong reason"
+      let text ← present (ELFRead.text? compiled.object.bytes) "captured scalar ELF text missing"
+      let offset ← present (ELF.entry? compiled.object.bytes compiled.input.exportName) "captured scalar ELF export missing"
+      let mut observations : Array Json := #[]
+      for (a, b) in CapturedGate.inputs do
+        let wanted := CapturedGate.expected family capture a
+        let values : Array Word := #[a.toUInt64]
+        let result ← checked ((Ixon.Eval.applyMany ctx 20000 function (PhysicalScalar.sourceArguments values)).mapError reprStr)
+        need (match result with | .litV (.natL n) => n == wanted | _ => false) s!"{name}({a}): source Nat result disagrees"
+        let resultRaw ← checked ((IxIR0.apply rawCtx 20000 rawFunction (.lit (.nat a))).mapError reprStr)
+        need (match resultRaw with | .lit (.nat n) => n == wanted | _ => false) "captured scalar raw IxIR0 result disagrees"
+        let (ir1Store, ir1Value) ← checked ((IxIR1.applyGo ir1Context 1000 moduleStore moduleValue
+          [.lit (.nat a)]).mapError reprStr)
+        need (ir1Value == .lit (.nat wanted) && CapturedGate.sameHeap ir1Store spent)
+          "captured scalar IxIR1 application disagrees or leaked"
+        let fullValues : Array Word := #[capture.toUInt64, a.toUInt64]
+        let (invokedStore, invokedValue) ← checked ((IxIR1.invoke ir1Context 1000 compiled.source.address
+          (fullValues.map PhysicalScalar.rval).toList spent).mapError reprStr)
+        need (invokedValue == ir1Value && CapturedGate.sameHeap invokedStore spent)
+          "captured scalar addressed invocation changed capture order or heap"
+        let (controlCost, heapCost) ← CapturedGate.observePhysical program compiled.source.target schemas fullValues wanted { heap := spent }
+        let initial := CapturedGate.core depth a b
+        let count ← CapturedGate.native compiled.native.target text offset initial wanted
+        let finalState ← checked ((ObjectEval.run compiled.object.bytes compiled.input.exportName 0x400000 count initial).mapError reprStr)
+        need (finalState.rip == 0x12345678 && finalState.core.readReg .rax == wanted.toUInt64 && finalState.core.readReg .rdx == 0)
+          "captured scalar complete ObjectEval disagrees"
+        observations := observations.push (Json.mkObj [("argument", toJson a), ("unused_rsi", toJson b), ("value", toJson wanted),
+          ("status", toJson (0 : Nat)), ("byte_steps", toJson count), ("physical_control", toJson controlCost),
+          ("physical_heap_fuel", toJson heapCost), ("source_evaluated", toJson true),
+          ("source_arguments", toJson (values.map UInt64.toNat)), ("physical_arguments", toJson (fullValues.map UInt64.toNat)),
+          ("application_heap", CapturedGate.heapJSON ir1Store)])
+      let physicalBlocks := compiled.selected.entries.foldl (fun total entry => total + entry.2.blocks.size) 0
+      let row := Json.mkObj [("name", toJson name), ("family", toJson family), ("capture", toJson capture),
+        ("source_root", toJson source.root), ("ir1_root", toJson compiled.input.provenance.root),
+        ("physical_entry", toJson compiled.source.address), ("runtime_parameters", toJson (1 : Nat)),
+        ("physical_parameters", toJson (2 : Nat)), ("selected_functions", toJson compiled.selected.scalar.program.functions.size),
+        ("functions", toJson compiled.bound.checked.program.functions.size), ("physical_blocks", toJson physicalBlocks),
+        ("native_blocks", toJson compiled.native.target.program.blocks.size), ("stack_depth", toJson depth),
+        ("stack_bytes", toJson (272 * depth)), ("below_entry_bytes", toJson (272 * depth - 8)),
+        ("text_bytes", toJson text.size), ("text_hash", toJson (Coverage.hex (Blake3.Rust.hash text).val)),
+        ("object_bytes", toJson compiled.object.bytes.size), ("snapshot", toJson s!"{name}.json"), ("object", toJson s!"{name}.o")]
+      let snapshot := Json.mkObj [("format", toJson "compilatrix/source-native-captured-scalar/1"),
+        ("policy", toJson PhysicalScalar.Captured.policy), ("row", row), ("text", toJson (Coverage.hex text)),
+        ("provenance", toJson (Coverage.hex compiled.input.provenance.bytes)), ("entry_offset", toJson offset),
+        ("selected_entries", toJson (compiled.selected.entries.map (·.1))),
+        ("initializer", Json.mkObj [("location", toJson location), ("capture", toJson capture),
+          ("heap", CapturedGate.heapJSON initialized.store.heap), ("peak_live", toJson initialized.store.peakLiveNodes),
+          ("control_steps", toJson (4096 - initialized.controlRemaining)), ("heap_fuel", toJson (16384 - initialized.heapRemaining))]),
+        ("observations", toJson observations), ("source_compilation", source.compilationSnapshot attached)]
+      IO.FS.writeBinFile (directory / s!"{name}.o") compiled.object.bytes
+      IO.FS.writeFile (directory / s!"{name}.json") (snapshot.pretty 100 ++ "\n")
+      rows := rows.push row
+  let runs := rows.size * CapturedGate.inputs.length
+  let report := Json.mkObj [("format", toJson "compilatrix/source-native-captured-scalar-report/1"),
+    ("policy", toJson PhysicalScalar.Captured.policy), ("runtime_parameters", toJson (1 : Nat)),
+    ("source_evaluations", toJson runs), ("object_executions", toJson runs),
+    ("initializer_rejections", toJson rejected), ("initializer_rejection_runs", toJson (rejected.size * rows.size)),
+    ("application_boundary_checks", toJson (4 * rows.size)), ("wrapper_rejections", toJson (2 : Nat)),
+    ("conversion_rejections", toJson (3 : Nat)), ("capacity_rejections", toJson (2 * rows.size)), ("cases", toJson rows)]
+  IO.FS.writeFile (directory / "report.json") (report.pretty 100 ++ "\n")
+  IO.println "source-native-captured-scalar ok: nine captured source exports, 171 source/application/object runs, initializer/wrapper/conversion/capacity checks"
diff --git a/Tests/Compiler/SourceNativePhysicalScalar.lean b/Tests/Compiler/SourceNativePhysicalScalar.lean
new file mode 100644
index 000000000..608d89998
--- /dev/null
+++ b/Tests/Compiler/SourceNativePhysicalScalar.lean
@@ -0,0 +1,270 @@
+import Ix.Compiler.X86.PhysicalScalarSources
+import Ix.Compiler.X86.PhysicalScalarSourceObject
+import Ix.Compiler.X86.PhysicalScalarExamples
+import Ix.Compiler.X86.ScalarNat
+import Ix.Compiler.Coverage.Snapshot
+import Ix.Compiler.Tools.Check
+
+open Lean Ix.Compiler Ix.Compiler.X86 Ix.Compiler.Tools.Check
+namespace PhysicalGate
+
+def names : List String := ["project", "tag", "pred", "choose", "helpers", "nested", "unary-pred"]
+
+def inputs : List (Nat × Nat) :=
+  let m := UInt64.size - 1
+  [(0,0), (0,1), (1,0), (1,1), (2,3), (3,2), (7,7), (7,19), (19,7),
+    (0,m), (m,0), (m,1), (1,m), (m,m), (m-1,1), (m-1,2), (2,m-1), (m,m-1), (m-1,m)]
+
+def expected (name : String) (a b : Nat) : Nat := match name with
+  | "project" | "swap" => a
+  | "tag" => if a == 0 then 11 else 22
+  | "pred" | "unary-pred" => a - 1
+  | "choose" | "diamond" => if a == 0 then b else a - 1
+  | "helpers" => if a ≤ 1 then 11 else 22
+  | "nested" => if a ≤ 2 then b else a - 3
+  | "permuted" => if a == 0 then b else a
+  | "constant" => UInt64.size - 1
+  | _ => 0
+
+def core (depth a b : Nat) : Core :=
+  let low : Word := 0x10000
+  let top := low + (272 * depth - 8).toUInt64
+  let allowed := fun address : Word => decide (low ≤ address ∧ address < top + 8)
+  let memory : Memory := { bytes := fun address => (address ^^^ 0xa7).toUInt8, readable := allowed, writable := allowed }
+  let registers : Registers := fun register => 0x1020304050607080 + (SysV.calleeSaved.toList.idxOf register + 1).toUInt64
+  { registers := ((registers.set .rsp top).set .rdi a.toUInt64).set .rsi b.toUInt64
+    memory := memory.write64 top 0x12345678 }
+
+def native (target : X86.Checked) (text : ByteArray) (entry : Nat) (initial : Core) (wanted : Nat) : IO Nat := do
+  let typed := X86.runFrom Runtime.rejecting target 1000 initial
+  need (typed.status == .halted wanted.toUInt64 && typed.core.readReg .rax == wanted.toUInt64 && typed.core.readReg .rdx == 0)
+    "physical scalar typed native result disagrees"
+  need (typed.core.readReg .rsp == initial.readReg .rsp && typed.core.calleeSavedMatch initial.calleeSavedSnapshot)
+    "physical scalar typed stack/register restoration failed"
+  let base : Word := 0x400000
+  let mut state : ByteEval.State := ⟨initial, base + entry.toUInt64, {}⟩
+  let mut count := 0
+  for _ in [:1000] do
+    if state.rip == 0x12345678 then break
+    state ← checked ((ByteEval.step text base state).mapError reprStr)
+    count := count + 1
+  need (state.rip == 0x12345678 && state.core.readReg .rax == wanted.toUInt64 && state.core.readReg .rdx == 0)
+    "physical scalar byte result/status/return address disagrees"
+  need (state.core.readReg .rsp == initial.readReg .rsp + 8 && state.core.calleeSavedMatch initial.calleeSavedSnapshot)
+    "physical scalar byte stack/register restoration failed"
+  for address in [(0xffff : Word), 0xfff8, initial.readReg .rsp + 8, initial.readReg .rsp + 16] do
+    need (state.core.memory.bytes address == initial.memory.bytes address) "physical scalar outside canary changed"
+  return count
+
+def observePhysical (program : IxIR2.Program) (definition : IxIR2.Function)
+    (schemas : Ixon.Owned → IxIR2.CtorId → Option IxIR2.CtorSchema) (values : Array Word) (wanted : Nat)
+    (initial : IxIR2.Eval.Store := {}) : IO (Nat × Nat) := do
+  let ctx := IxIR2.Eval.Context.ofProgram program schemas
+  let mut costs := (0, 0)
+  for mode in [IxIR2.Eval.Interpretation.logical, .physical] do
+    let result ← checked ((IxIR2.Eval.runFunction ctx mode definition (values.map PhysicalScalar.rval) 1000 1000 initial).mapError reprStr)
+    need (result.value == .lit (.nat wanted)) "physical scalar CFG result disagrees"
+    need (result.store.counters == initial.counters && result.store.live == 0 &&
+      result.store.heap.nodes.size == initial.heap.nodes.size && result.store.heap.nodes.all Option.isNone)
+      "physical scalar CFG changed the heap or allocation/reference counters"
+    costs := (1000 - result.controlRemaining, 1000 - result.heapRemaining)
+  return costs
+
+def admission : IO (Array String) := do
+  let mut rejected := #[]
+  for (name, program) in PhysicalScalar.Examples.rejections do
+    match PhysicalScalar.select program PhysicalScalar.Examples.root with
+    | .ok _ => throw (IO.userError s!"physical scalar accepted invalid CFG: {name}")
+    | .error error =>
+      if name == "expansion-budget" then need (error.contains "work limit") "CFG expansion was not bounded before native emission"
+      rejected := rejected.push name
+  for values in [#[UInt64.size, 0], #[0, UInt64.size], #[UInt64.size * 2, 1]] do
+    need ((Scalar.encodeArguments values).isNone) "physical scalar argument conversion silently wrapped"
+  need (Scalar.encodeArguments #[UInt64.size - 1, 0] == some #[0xffffffffffffffff, 0]) "physical scalar maximum input rejected"
+  return rejected
+
+def rawCFGs : IO (Array Json) := do
+  let mut rows := #[]
+  for (name, program) in PhysicalScalar.Examples.cfgs do
+    let selected ← checked (PhysicalScalar.select program PhysicalScalar.Examples.root)
+    let nativeCode ← checked (Scalar.compile selected.scalar)
+    let stream ← checked ((Stream.encode nativeCode.target).mapError reprStr)
+    let (_, definition) ← present selected.entries[selected.scalar.program.entry]? "raw CFG entry is missing"
+    let depth := selected.scalar.program.entry + 1
+    for (a, b) in inputs do
+      let wanted := expected name a b
+      let _ ← observePhysical program definition (fun _ _ => none) #[a.toUInt64, b.toUInt64] wanted
+      let _ ← native nativeCode.target stream.output.text
+        (stream.output.blockOffsets[nativeCode.target.program.entry.toNat]?.getD 0) (core depth a b) wanted
+    rows := rows.push (Json.mkObj [("name", toJson name), ("physical_blocks", toJson definition.blocks.size),
+      ("functions", toJson selected.scalar.program.functions.size), ("inputs", toJson inputs.length)])
+  return rows
+
+def exportRejections {program provenance} (exported : PhysicalScalar.Exported program provenance) : IO Unit := do
+  let replace := fun definition => { program with declarations := program.declarations.map fun (address, old) =>
+    (address, if address == exported.source.address then .fn definition else old) }
+  let captured := { program with main := PhysicalScalar.Examples.function 0 #[PhysicalScalar.Examples.block 0
+    #[.papp exported.source.address #[.lit (.nat 0)]] (.ret (.reg 0))] }
+  let missing := { program with main := PhysicalScalar.Examples.function 0 #[PhysicalScalar.papBlock (Ixon.Address.replicate 0xee)] }
+  let saturated := replace { exported.source.target with signature := { exported.source.target.signature with params := #[] } }
+  let unsafeTarget := replace { exported.source.target with signature := { exported.source.target.signature with papSafe := false } }
+  let cyclic := { program with
+    main := PhysicalScalar.Examples.function 0 #[PhysicalScalar.tailBlock exported.source.address]
+    declarations := [(exported.source.address, .fn (PhysicalScalar.Examples.function 0 #[PhysicalScalar.tailBlock exported.source.address]))] }
+  for changed in [captured, missing, saturated, unsafeTarget, cyclic] do
+    match PhysicalScalar.resolveExport changed with
+    | .error _ => pure ()
+    | .ok _ => throw (IO.userError "physical scalar accepted invalid module export")
+
+def stackRejections {program root provenance} (compiled : PhysicalScalar.Compiled program root provenance) : IO Nat := do
+  let depth := compiled.selected.scalar.program.entry + 1
+  let initial := core depth 2 3
+  let inaccessible := { initial with memory := { initial.memory with writable := fun _ => false } }
+  match (X86.runFrom Runtime.rejecting compiled.native.target 1000 inaccessible).status with
+  | .trapped (.memoryFault _) => pure ()
+  | _ => throw (IO.userError "physical scalar unwritable stack did not trap")
+  if depth > 1 then
+    let floor := initial.readReg .rsp - 264
+    let short := { initial with memory := { initial.memory with
+      readable := fun address => decide (floor ≤ address ∧ address < initial.readReg .rsp + 8)
+      writable := fun address => decide (floor ≤ address ∧ address < initial.readReg .rsp + 8) } }
+    match (X86.runFrom Runtime.rejecting compiled.native.target 1000 short).status with
+    | .trapped (.memoryFault _) => return 2
+    | _ => throw (IO.userError "physical scalar insufficient call stack did not trap")
+  return 1
+
+def reclaimed (store : IxIR1.Store) (closures : Nat) : Bool :=
+  store.nodes.size == closures && store.nodes.all Option.isNone && store.allocs == closures &&
+    store.frees == closures && store.rcops == closures && store.reuses == 0
+
+def applicationBoundaries (context : Ixon.Eval.EvalCtx) (function : Ixon.Eval.Value)
+    (ir1Context : IxIR1.Ctx) (store : IxIR1.Store) (ir1Function : IxIR1.RVal)
+    (physicalContext : IxIR2.Eval.Context) (definition : IxIR2.Function) (arity wanted : Nat) : IO Unit := do
+  let values : Array Word := if arity == 1 then #[2] else #[2, 3]
+  let args := PhysicalScalar.sourceArguments values
+  let short := args.take (arity - 1)
+  let pending ← checked ((Ixon.Eval.applyMany context 20000 function short).mapError reprStr)
+  need (match pending with | .closV .. | .papV .. => true | _ => false) "under-applied source lost its closure"
+  let completed ← checked ((Ixon.Eval.applyMany context 20000 pending (args.drop (arity - 1))).mapError reprStr)
+  need (match completed with | .litV (.natL n) => n == wanted | _ => false) "split source application disagrees"
+  let .error (.stuck _) := Ixon.Eval.applyMany context 20000 function (args ++ [.litV (.natL 0)])
+    | throw (IO.userError "over-applied scalar source did not reject")
+  let ir1Args := (values.map PhysicalScalar.rval).toList
+  let (partialStore, partialValue) ← checked ((IxIR1.applyGo ir1Context 1000 store ir1Function
+    (ir1Args.take (arity - 1))).mapError reprStr)
+  let .loc location := partialValue | throw (IO.userError "under-applied IxIR1 lost its PAP")
+  let some box := partialStore.get? location | throw (IO.userError "under-applied IxIR1 PAP is missing")
+  need (box.world == .shared && box.rc == 1 && partialStore.allocs == 2 && partialStore.frees == 1 &&
+    partialStore.rcops == 1 && partialStore.live == 1) "under-applied IxIR1 PAP ownership disagrees"
+  let (completedStore, completedValue) ← checked ((IxIR1.applyGo ir1Context 1000 partialStore partialValue
+    (ir1Args.drop (arity - 1))).mapError reprStr)
+  need (completedValue == .lit (.nat wanted) && reclaimed completedStore 2) "split IxIR1 application leaked or disagrees"
+  let .error (.stuck _) := IxIR1.applyGo ir1Context 1000 store ir1Function (ir1Args ++ [.lit (.nat 0)])
+    | throw (IO.userError "over-applied scalar IxIR1 did not reject")
+  for badArgs in [ir1Args.take (arity - 1), ir1Args ++ [.lit (.nat 0)]] do
+    let .error (.stuck message) := IxIR2.Eval.runFunction physicalContext .physical definition badArgs.toArray 1000 1000
+      | throw (IO.userError "physical scalar accepted incorrect invocation arity")
+    need (message == "function argument arity mismatch") "physical scalar invocation rejected for the wrong reason"
+
+end PhysicalGate
+
+def main (args : List String) : IO UInt32 := cli "source-native-physical-scalar" do
+  let [directory] := args | throw (IO.userError "usage: source-native-physical-scalar <new-output-directory>")
+  let directory : System.FilePath := directory
+  need (!(← directory.pathExists)) "physical scalar producer requires a fresh output directory"
+  let rejected ← PhysicalGate.admission
+  let cfgs ← PhysicalGate.rawCFGs
+  IO.FS.createDirAll directory
+  let mut rows : Array Json := #[]
+  let mut stackRejections := 0
+  for name in PhysicalGate.names do
+    let source ← checked (PhysicalScalar.Examples.source name)
+    let attached ← checked (source.compile.mapError reprStr)
+    let exported ← checked (PhysicalScalar.compileSourceExport attached "compilatrix_scalar")
+    let compiled := exported.compiled
+    PhysicalGate.exportRejections exported
+    stackRejections := stackRejections + (← PhysicalGate.stackRejections compiled)
+    let program := attached.target.artifact.program
+    let schemas := attached.target.artifact.validationContext.schemas
+    let physicalContext := IxIR2.Eval.Context.ofProgram program schemas
+    let arity := exported.source.target.signature.params.size
+    need (arity == if name == "unary-pred" then 1 else 2) "physical scalar runtime arity disagrees"
+    let mainResult ← checked ((IxIR2.Eval.runMain physicalContext .physical program 100 100).mapError reprStr)
+    let .loc location := mainResult.value | throw (IO.userError "physical module main did not return a closure")
+    let some box := mainResult.store.get? location | throw (IO.userError "physical module closure is missing")
+    need (location == 0 && box.node == .papN exported.source.address arity #[] && box.world == .shared && box.rc == 1 &&
+      mainResult.store.heap.nodes.size == 1 && mainResult.store.heap.allocs == 1 && mainResult.store.heap.frees == 0 &&
+      mainResult.store.heap.rcops == 0 && mainResult.store.heap.reuses == 0)
+      "physical module export differs from the selected uncaptured function"
+    let ir1Context := attached.compiled.simulationSourceContext
+    let (moduleStore, moduleValue) ← checked ((IxIR1.runMain ir1Context attached.source.artifact.main 1000).mapError reprStr)
+    let some ir1Box := moduleStore.get? 0 | throw (IO.userError "IxIR1 module closure is missing")
+    need (moduleValue == .loc 0 && ir1Box.node == box.node && ir1Box.world == .shared && ir1Box.rc == 1 &&
+      moduleStore.nodes.size == 1 && moduleStore.allocs == 1 && moduleStore.frees == 0 && moduleStore.rcops == 0 && moduleStore.reuses == 0)
+      "IxIR1 module export differs from the selected physical closure"
+    let ctx := Pipeline.validatedEvalCtx source.constants source.config
+    let function ← checked ((Ixon.Eval.eval ctx 2000 (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError reprStr)
+    let rawCtx : IxIR0.Ctx := { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+    let rawFunction ← checked ((IxIR0.eval rawCtx 2000 [] (.ref source.root)).mapError reprStr)
+    PhysicalGate.applicationBoundaries ctx function ir1Context moduleStore moduleValue physicalContext compiled.definition
+      arity (PhysicalGate.expected name 2 3)
+    let depth := compiled.selected.scalar.program.entry + 1
+    let text ← present (ELFRead.text? compiled.object.bytes) "physical scalar actual ELF text missing"
+    let offset ← present (ELF.entry? compiled.object.bytes compiled.input.exportName) "physical scalar actual ELF export missing"
+    let mut observations : Array Json := #[]
+    for (a, b) in PhysicalGate.inputs do
+      let wanted := PhysicalGate.expected name a b
+      let values : Array Word := if arity == 1 then #[a.toUInt64] else #[a.toUInt64, b.toUInt64]
+      let result ← checked ((Ixon.Eval.applyMany ctx 20000 function (PhysicalScalar.sourceArguments values)).mapError reprStr)
+      need (match result with | .litV (.natL n) => n == wanted | _ => false) s!"{name}({a},{b}): source Nat result disagrees"
+      let mut resultRaw := rawFunction
+      for argument in PhysicalScalar.rawArguments values do
+        resultRaw ← checked ((IxIR0.apply rawCtx 20000 resultRaw argument).mapError reprStr)
+      need (match resultRaw with | .lit (.nat n) => n == wanted | _ => false) "physical scalar raw IxIR0 result disagrees"
+      let (ir1Store, ir1Value) ← checked ((IxIR1.applyGo ir1Context 1000 moduleStore moduleValue
+        (values.map PhysicalScalar.rval).toList).mapError reprStr)
+      need (ir1Value == .lit (.nat wanted) && PhysicalGate.reclaimed ir1Store 1)
+        "physical scalar IxIR1 application disagrees or failed to reclaim its closure"
+      let (invokedStore, invokedValue) ← checked ((IxIR1.invoke ir1Context 1000 exported.source.address
+        (values.map PhysicalScalar.rval).toList PhysicalScalar.invocationHeap).mapError reprStr)
+      need (invokedValue == ir1Value && PhysicalGate.reclaimed invokedStore 1)
+        "physical scalar IxIR1 invocation differs from the source application"
+      let (controlCost, heapCost) ← PhysicalGate.observePhysical program compiled.definition schemas values wanted
+        { heap := PhysicalScalar.invocationHeap }
+      let initial := PhysicalGate.core depth a b
+      let count ← PhysicalGate.native compiled.native.target text offset initial wanted
+      let finalState ← checked ((ObjectEval.run compiled.object.bytes compiled.input.exportName 0x400000 count initial).mapError reprStr)
+      need (finalState.rip == 0x12345678 && finalState.core.readReg .rax == wanted.toUInt64 && finalState.core.readReg .rdx == 0)
+        "physical scalar complete ObjectEval result disagrees"
+      observations := observations.push (Json.mkObj [("left", toJson a), ("right", toJson b), ("value", toJson wanted),
+        ("status", toJson (0 : Nat)), ("byte_steps", toJson count), ("physical_control", toJson controlCost),
+        ("physical_heap_fuel", toJson heapCost), ("source_evaluated", toJson true),
+        ("source_arguments", toJson (values.map UInt64.toNat)),
+        ("application_heap", Json.mkObj [("allocs", toJson ir1Store.allocs), ("frees", toJson ir1Store.frees),
+          ("rcops", toJson ir1Store.rcops), ("reuses", toJson ir1Store.reuses),
+          ("slots", toJson ir1Store.nodes.size), ("live", toJson ir1Store.live)])])
+    let physicalBlocks := compiled.selected.entries.foldl (fun total entry => total + entry.2.blocks.size) 0
+    let row := Json.mkObj [("name", toJson name), ("source_root", toJson source.root),
+      ("ir1_root", toJson compiled.input.provenance.root), ("physical_entry", toJson exported.source.address),
+      ("runtime_parameters", toJson arity),
+      ("functions", toJson compiled.selected.scalar.program.functions.size), ("physical_blocks", toJson physicalBlocks),
+      ("native_blocks", toJson compiled.native.target.program.blocks.size), ("stack_depth", toJson depth),
+      ("stack_bytes", toJson (272 * depth)), ("below_entry_bytes", toJson (272 * depth - 8)),
+      ("text_bytes", toJson text.size), ("text_hash", toJson (Coverage.hex (Blake3.Rust.hash text).val)),
+      ("object_bytes", toJson compiled.object.bytes.size), ("snapshot", toJson s!"{name}.json"), ("object", toJson s!"{name}.o")]
+    let snapshot := Json.mkObj [("format", toJson "compilatrix/source-native-physical-scalar/2"), ("policy", toJson PhysicalScalar.policy),
+      ("row", row), ("text", toJson (Coverage.hex text)), ("provenance", toJson (Coverage.hex compiled.input.provenance.bytes)),
+      ("entry_offset", toJson offset), ("selected_entries", toJson (compiled.selected.entries.map (·.1))),
+      ("observations", toJson observations), ("source_compilation", source.compilationSnapshot attached)]
+    IO.FS.writeBinFile (directory / s!"{name}.o") compiled.object.bytes
+    IO.FS.writeFile (directory / s!"{name}.json") (snapshot.pretty 100 ++ "\n")
+    rows := rows.push row
+  let runs := PhysicalGate.names.length * PhysicalGate.inputs.length
+  let report := Json.mkObj [("format", toJson "compilatrix/source-native-physical-scalar-report/2"), ("policy", toJson PhysicalScalar.policy),
+    ("source_arities", toJson (#[1, 2] : Array Nat)), ("source_evaluations", toJson runs), ("object_executions", toJson runs),
+    ("application_boundary_checks", toJson (6 * PhysicalGate.names.length)),
+    ("cfg_stream_executions", toJson (76 : Nat)), ("cfg_cases", toJson cfgs), ("admission_rejections", toJson rejected),
+    ("export_rejections", toJson (5 * PhysicalGate.names.length)), ("conversion_rejections", toJson (3 : Nat)),
+    ("capacity_rejections", toJson stackRejections), ("cases", toJson rows)]
+  IO.FS.writeFile (directory / "report.json") (report.pretty 100 ++ "\n")
+  IO.println "source-native-physical-scalar ok: seven source exports, 133 source/application/object runs, 76 CFG stream runs, admission/application/export/capacity checks"
diff --git a/Tests/Compiler/SourceNativeRuntime.lean b/Tests/Compiler/SourceNativeRuntime.lean
new file mode 100644
index 000000000..18b4be39d
--- /dev/null
+++ b/Tests/Compiler/SourceNativeRuntime.lean
@@ -0,0 +1,30 @@
+import Ix.Compiler.UniqueReuse.RuntimeObservations
+
+open Ix.Compiler.UniqueReuse.Runtime.Native.Examples
+
+def main (args : List String) : IO UInt32 := do
+  let (foldCounters, output) : Bool × Option System.FilePath ← match args with
+    | [] => pure (false, none)
+    | ["--counter-fold"] => pure (true, none)
+    | [path] => pure (false, some path)
+    | ["--counter-fold", path] => pure (true, some path)
+    | _ => IO.eprintln "usage: lake exe compiler-source-native-runtime [--counter-fold] [new-output-directory]"; return 2
+  try
+    if let some path := output then
+      if ← path.pathExists then throw (IO.userError "source-native-runtime requires a new output directory")
+    let result ← match run foldCounters with
+      | .ok result => pure result
+      | .error reason => throw (IO.userError reason)
+    if let some path := output then
+      IO.FS.createDirAll path
+      IO.FS.writeFile (path / "pipeline.json") (result.pipeline.pretty 100 ++ "\n")
+      IO.FS.writeBinFile (path / "main.o") result.mainObject
+      IO.FS.writeBinFile (path / "release.o") result.releaseObject
+      for (name, snapshot) in result.cases do
+        IO.FS.writeFile (path / s!"{name}.json") (snapshot.pretty 100 ++ "\n")
+      IO.FS.writeFile (path / "report.json") (result.report.pretty 100 ++ "\n")
+    IO.println s!"source-native-runtime ok: one compiled function, one ELF pair, {result.cases.length} runtime inputs and complete reclamation"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-native-runtime: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceNativeScalar.lean b/Tests/Compiler/SourceNativeScalar.lean
new file mode 100644
index 000000000..2130cb8f1
--- /dev/null
+++ b/Tests/Compiler/SourceNativeScalar.lean
@@ -0,0 +1,173 @@
+import Ix.Compiler.X86.ScalarSources
+import Ix.Compiler.X86.ScalarSourceObject
+import Ix.Compiler.Coverage.Snapshot
+import Ix.Compiler.Tools.Check
+
+open Lean Ix.Compiler Ix.Compiler.X86 Ix.Compiler.Tools.Check
+
+private def inputs : List (Nat × Nat) :=
+  let m := UInt64.size - 1
+  [(0, 0), (0, 1), (1, 0), (1, 1), (2, 3), (3, 2), (7, 7), (7, 19), (19, 7),
+    (0, m), (m, 0), (m, 1), (1, m), (m, m), (m - 1, 1), (m - 1, 2),
+    (2, m - 1), (m, m - 1), (m - 1, m)]
+
+private def expected (name : String) (a b : Nat) : Option Nat :=
+  match name with
+  | "sub" => some (a - b)
+  | "nested" => if a == 0 then some 7 else if a > b then some (a - b)
+      else if a + b < UInt64.size then some (a + b) else none
+  | "add" => if a + b < UInt64.size then some (a + b) else none
+  | _ => if a + b < UInt64.size then some (a + b - 1) else none
+
+private def sourceNat : Nat → Ixon.Address → Ixon.Eval.Value → Option Nat
+  | 0, _, _ => none
+  | _ + 1, _, .litV (.natL number) => some number
+  | fuel + 1, block, .ctorV found 0 1 [tail] =>
+      if found == block then (sourceNat fuel block tail).map (· + 1) else none
+  | _, _, _ => none
+
+private def rawNat : Nat → Ixon.Address → IxIR0.Value → Option Nat
+  | 0, _, _ => none
+  | _ + 1, _, .lit (.nat number) => some number
+  | fuel + 1, successor, .ctor found 1 [tail] =>
+      if found == successor then (rawNat fuel successor tail).map (· + 1) else none
+  | _, _, _ => none
+
+private def core (depth a b : Nat) : Core :=
+  let low : Word := 0x10000
+  let top := low + (272 * depth - 8).toUInt64
+  let allowed := fun address : Word => decide (low ≤ address ∧ address < top + 8)
+  let memory : Memory := {
+    bytes := fun address => (address ^^^ 0xa7).toUInt8
+    readable := allowed, writable := allowed }
+  let registers : Registers := fun register => 0x1020304050607080 + (SysV.calleeSaved.toList.idxOf register + 1).toUInt64
+  { registers := ((registers.set .rsp top).set .rdi a.toUInt64).set .rsi b.toUInt64
+    memory := memory.write64 top 0x12345678 }
+
+private def nativeObservation {source : Coverage.Source} {attached : source.Attached}
+    (compiled : Scalar.Source.Compiled attached.source) (a b : Nat) (wanted : Option Nat) : IO Json := do
+  let initial := core (compiled.selected.scalar.program.entry + 1) a b
+  let typed := X86.runFrom Runtime.rejecting compiled.native.target 1000 initial
+  let value := (wanted.getD 0).toUInt64
+  let tag : Word := if wanted.isSome then 0 else 1
+  need (typed.status == .halted value && typed.core.readReg .rax == value && typed.core.readReg .rdx == tag)
+    "typed native value/status disagrees with independent Nat arithmetic"
+  need (typed.core.readReg .rsp == initial.readReg .rsp && typed.core.calleeSavedMatch initial.calleeSavedSnapshot)
+    "typed native stack/register restoration failed"
+  let text ← present (ELFRead.text? compiled.object.bytes) "actual ELF text missing"
+  let offset ← present (ELF.entry? compiled.object.bytes compiled.input.exportName) "actual ELF export missing"
+  let base : Word := 0x400000
+  let mut state : ByteEval.State := ⟨initial, base + offset.toUInt64, {}⟩
+  let mut count := 0
+  for _ in [:1000] do
+    if state.rip == 0x12345678 then break
+    state ← checked ((ByteEval.step text base state).mapError reprStr)
+    count := count + 1
+  need (state.rip == 0x12345678 && state.core.readReg .rax == value && state.core.readReg .rdx == tag)
+    "actual object byte execution returned the wrong value/status/address"
+  need (state.core.readReg .rsp == initial.readReg .rsp + 8 && state.core.calleeSavedMatch initial.calleeSavedSnapshot)
+    "actual object byte execution changed stack/saved registers"
+  for address in [(0xffff : Word), 0xfff8, initial.readReg .rsp + 8, initial.readReg .rsp + 16] do
+    need (state.core.memory.bytes address == initial.memory.bytes address) "native execution changed an outside canary"
+  let finalState ← checked ((ObjectEval.run compiled.object.bytes compiled.input.exportName base count initial).mapError reprStr)
+  need (finalState.rip == state.rip && finalState.core.readReg .rax == value && finalState.core.readReg .rdx == tag)
+    "complete ObjectEval entry/run disagrees"
+  return Json.mkObj [("left", toJson a), ("right", toJson b), ("value", toJson value.toNat),
+    ("status", toJson tag.toNat), ("byte_steps", toJson count), ("source_evaluated", toJson (a < 32 && b < 32))]
+
+private def rejectSelection (declarations : List (Ixon.Address × IxIR0.Decl)) (root : Ixon.Address) : IO Unit := do
+  match Scalar.Source.select declarations root with
+  | .error _ => pure ()
+  | .ok _ => throw (IO.userError "malformed scalar source unexpectedly selected")
+
+private def rejections {source : Coverage.Source} (attached : source.Attached)
+    (compiled : Scalar.Source.Compiled attached.source) : IO Unit := do
+  let declarations := attached.source.erasure.result.raw
+  let replace := fun address replacement => declarations.map fun (found, declaration) =>
+    (found, if found == address then replacement else declaration)
+  let binary := fun body => IxIR0.Decl.defn .shared (.lam .many (.lam .many body))
+  rejectSelection (replace source.root (binary .erased)) source.root
+  rejectSelection (replace source.root (binary (.app (.app (.ref source.root) (.var 1)) (.var 0)))) source.root
+  rejectSelection (replace source.root (binary (.ref (Ixon.Address.replicate 0x99)))) source.root
+  rejectSelection (replace source.root (.defn .shared (.lam .many (.var 0)))) source.root
+  rejectSelection (replace source.root (binary (IxIR0.NatArithmetic.sharedLiteral UInt64.size))) source.root
+  rejectSelection (replace compiled.selected.primitives.arithmetic.successor (.ctor 0 1)) source.root
+  rejectSelection (replace source.root (binary (.var 2))) source.root
+  let initial := core (compiled.selected.scalar.program.entry + 1) 2 3
+  let inaccessible := { initial with memory := { initial.memory with writable := fun _ => false } }
+  match (X86.runFrom Runtime.rejecting compiled.native.target 1000 inaccessible).status with
+  | .trapped (.memoryFault _) => pure ()
+  | _ => throw (IO.userError "unwritable native stack did not trap in the model")
+  if compiled.selected.scalar.program.entry > 0 then
+    let floor := initial.readReg .rsp - 264
+    let short := { initial with memory := { initial.memory with
+      readable := fun address => decide (floor ≤ address ∧ address < initial.readReg .rsp + 8)
+      writable := fun address => decide (floor ≤ address ∧ address < initial.readReg .rsp + 8) } }
+    match (X86.runFrom Runtime.rejecting compiled.native.target 1000 short).status with
+    | .trapped (.memoryFault _) => pure ()
+    | _ => throw (IO.userError "insufficient nested-call stack did not trap in the model")
+
+private def admissionChecks : IO Unit := do
+  for program in [
+    { functions := #[⟨3, .atom (.var 0)⟩], entry := 0 : Scalar.Program },
+    { functions := #[⟨2, .atom (.var 2)⟩], entry := 0 },
+    { functions := #[⟨2, .call 0 #[.var 0, .var 1]⟩], entry := 0 },
+    { functions := Array.replicate 33 ⟨2, .atom (.var 0)⟩, entry := 0 },
+    { functions := #[⟨2, (List.range 31).foldl (fun body _ => .letE (.atom (.constant 0)) body) (.atom (.var 0))⟩], entry := 0 }
+  ] do
+    need (Scalar.check program |>.isNone) "invalid scalar scope/arity/graph/capacity accepted"
+  for values in [#[UInt64.size, 0], #[0, UInt64.size], #[UInt64.size * 2, 1]] do
+    need ((Scalar.encodeArguments values).isNone) "oversized source Nat converted by wrapping"
+  need (Scalar.encodeArguments #[UInt64.size - 1, 0] == some #[0xffffffffffffffff, 0]) "largest exact input rejected"
+
+def main (args : List String) : IO UInt32 := cli "source-native-scalar" do
+  let [directory] := args | throw (IO.userError "usage: source-native-scalar <new-output-directory>")
+  let directory : System.FilePath := directory
+  need (!(← directory.pathExists)) "source-native-scalar requires a fresh output directory"
+  admissionChecks
+  IO.FS.createDirAll directory
+  let mut rows : Array Json := #[]
+  for (name, program) in Scalar.Examples.families do
+    let source ← checked (Scalar.Examples.source name program)
+    let attached ← checked (source.compile.mapError reprStr)
+    let compiled ← checked (Scalar.Source.compile attached.source "compilatrix_scalar")
+    rejections attached compiled
+    let ctx := Pipeline.validatedEvalCtx source.constants source.config
+    let function ← checked ((Ixon.Eval.eval ctx 2000 (Pipeline.validatedMainFrame source.root) [] Pipeline.validatedMainSource).mapError reprStr)
+    let rawCtx : IxIR0.Ctx := { env := IxIR0.Env.ofList attached.source.erasure.result.raw }
+    let rawFunction ← checked ((IxIR0.eval rawCtx 2000 [] (.ref source.root)).mapError reprStr)
+    let mut observations : Array Json := #[]
+    for (a, b) in inputs do
+      let wanted := expected name a b
+      if a < 32 && b < 32 then
+        let first ← checked ((Ixon.Eval.apply ctx 20000 function (.litV (.natL a))).mapError reprStr)
+        let result ← checked ((Ixon.Eval.apply ctx 20000 first (.litV (.natL b))).mapError reprStr)
+        let firstRaw ← checked ((IxIR0.apply rawCtx 20000 rawFunction (.lit (.nat a))).mapError reprStr)
+        let resultRaw ← checked ((IxIR0.apply rawCtx 20000 firstRaw (.lit (.nat b))).mapError reprStr)
+        let natBlock ← present source.natBlock "source Nat block missing"
+        need (sourceNat 1000 natBlock result == wanted && rawNat 1000 compiled.selected.primitives.arithmetic.successor resultRaw == wanted)
+          s!"{name}({a},{b}): Ixon/raw IxIR0 disagree with exact Nat arithmetic"
+      observations := observations.push (← nativeObservation compiled a b wanted)
+    let depth := compiled.selected.scalar.program.entry + 1
+    let text := compiled.stream.output.text
+    let row := Json.mkObj [("name", toJson name), ("source_root", toJson source.root),
+      ("ir1_root", toJson compiled.input.provenance.root), ("functions", toJson compiled.selected.scalar.program.functions.size),
+      ("blocks", toJson compiled.native.target.program.blocks.size), ("stack_depth", toJson depth),
+      ("stack_bytes", toJson (272 * depth)), ("below_entry_bytes", toJson (272 * depth - 8)),
+      ("text_bytes", toJson text.size), ("text_hash", toJson (Coverage.hex (Blake3.Rust.hash text).val)),
+      ("object_bytes", toJson compiled.object.bytes.size),
+      ("snapshot", toJson s!"{name}.json"), ("object", toJson s!"{name}.o")]
+    let snapshot := Json.mkObj [("format", toJson "compilatrix/source-native-scalar/1"), ("policy", toJson Scalar.Source.policy),
+      ("row", row), ("text", toJson (Coverage.hex text)), ("provenance", toJson (Coverage.hex compiled.input.provenance.bytes)),
+      ("entry_offset", toJson (compiled.stream.output.blockOffsets[compiled.input.entryBlock.toNat]?.getD 0)),
+      ("observations", toJson observations), ("source_compilation", source.compilationSnapshot attached)]
+    IO.FS.writeBinFile (directory / s!"{name}.o") compiled.object.bytes
+    IO.FS.writeFile (directory / s!"{name}.json") (snapshot.pretty 100 ++ "\n")
+    rows := rows.push row
+  let report := Json.mkObj [("format", toJson "compilatrix/source-native-scalar-report/1"), ("policy", toJson Scalar.Source.policy),
+    ("runtime_arguments", toJson (2 : Nat)), ("source_evaluations", toJson (45 : Nat)),
+    ("object_executions", toJson (95 : Nat)), ("source_rejections", toJson (35 : Nat)),
+    ("admission_rejections", toJson (5 : Nat)), ("conversion_rejections", toJson (3 : Nat)),
+    ("capacity_rejections", toJson (7 : Nat)), ("cases", toJson rows)]
+  IO.FS.writeFile (directory / "report.json") (report.pretty 100 ++ "\n")
+  IO.println "source-native-scalar ok: five source functions, 45 source evaluations, 95 runtime object executions, exact arithmetic and admission/capacity checks"
diff --git a/Tests/Compiler/SourceNativeUnique.lean b/Tests/Compiler/SourceNativeUnique.lean
new file mode 100644
index 000000000..c522b0a1b
--- /dev/null
+++ b/Tests/Compiler/SourceNativeUnique.lean
@@ -0,0 +1,32 @@
+import Ix.Compiler.UniqueReuse.NativeObservations
+
+/-! Emit complete Ixon-to-native artifacts into a fresh output directory. -/
+
+open Lean Ix.Compiler.UniqueReuse.Native.Examples
+
+def main (args : List String) : IO UInt32 := do
+  let output : Option System.FilePath ← match args with
+    | [] => pure none
+    | [path] => pure (some path)
+    | _ => IO.eprintln "usage: lake exe compiler-source-native-unique [new-output-directory]"; return 2
+  try
+    if let some path := output then
+      if ← path.pathExists then throw (IO.userError "source-native-unique requires a new output directory")
+    let results ← match cases.mapM fun (name, values) => runCase name values with
+      | .ok results => pure results
+      | .error reason => throw (IO.userError reason)
+    let rejected ← match rejections with
+      | .ok results => pure results
+      | .error reason => throw (IO.userError reason)
+    if let some path := output then
+      IO.FS.createDirAll path
+      for result in results do
+        IO.FS.writeFile (path / s!"{result.name}.json") (result.snapshot.pretty 100 ++ "\n")
+        IO.FS.writeBinFile (path / s!"{result.name}-main.o") result.mainObject
+        IO.FS.writeBinFile (path / s!"{result.name}-release.o") result.releaseObject
+      IO.FS.writeFile (path / "report.json") ((report results rejected).pretty 100 ++ "\n")
+    IO.println s!"source-native-unique ok: {results.length} Ixon reversals, main/release ELF pairs, byte-memory observations, {rejected.size} checked native fallbacks"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-native-unique: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceNativeUpstream.lean b/Tests/Compiler/SourceNativeUpstream.lean
new file mode 100644
index 000000000..7c2f2a893
--- /dev/null
+++ b/Tests/Compiler/SourceNativeUpstream.lean
@@ -0,0 +1,33 @@
+import Ix.Compiler.Coverage.UpstreamNative
+
+open Lean Ix.Compiler Ix.Compiler.Coverage
+
+def main (args : List String) : IO UInt32 := do
+  try
+    let (directory, name) ← match args with
+      | [directory] => pure (directory, none)
+      | [directory, name] => pure (directory, some name)
+      | _ => throw (IO.userError "usage: lake exe compiler-source-native-upstream <new-output-directory> [upstream-name]")
+    let directory : System.FilePath := directory
+    if ← directory.pathExists then throw (IO.userError "source-native-upstream requires a fresh output directory")
+    let cases ← if let some name := name then do
+        let some fixture := Upstream.fixtures.find? (fun fixture => fixture.name == name) |
+          throw (IO.userError "unknown upstream entry")
+        let .ok result := (← Upstream.load Upstream.directory fixture).bind UpstreamNative.run |
+          throw (IO.userError "upstream source/native compilation failed")
+        pure [result]
+      else do
+        let .ok cases ← UpstreamNative.cases | throw (IO.userError "upstream source/native compilation failed")
+        pure cases
+    IO.FS.createDirAll directory
+    for result in cases do
+      IO.FS.writeFile (directory / s!"{result.name}.json") (result.snapshot.pretty 100 ++ "\n")
+      if let some bytes := result.object then IO.FS.writeBinFile (directory / s!"{result.name}.o") bytes
+    let report := Json.mkObj [("format", toJson "compilatrix/source-native-upstream-report/1"),
+      ("policy", toJson UpstreamNative.policy), ("cases", toJson (cases.map CaseResult.row))]
+    IO.FS.writeFile (directory / "report.json") (report.pretty 100 ++ "\n")
+    IO.println s!"source-native-upstream ok: {cases.length} unchanged upstream entries, {cases.countP (·.object.isSome)} checked computational objects"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-native-upstream: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceRecursion.lean b/Tests/Compiler/SourceRecursion.lean
new file mode 100644
index 000000000..e686766a2
--- /dev/null
+++ b/Tests/Compiler/SourceRecursion.lean
@@ -0,0 +1,30 @@
+import Ix.Compiler.Recursion.Rejections
+
+/-! Source-driven recursion, loop, and reuse checks. An optional new output
+directory receives complete program snapshots for the fresh-process gate. -/
+
+open Ix.Compiler.Recursion.Examples
+
+def main (args : List String) : IO UInt32 := do
+  let output : Option System.FilePath ← match args with
+    | [] => pure none
+    | [path] => pure (some path)
+    | _ =>
+        IO.eprintln "usage: lake exe compiler-source-recursion [new-output-directory]"
+        return 2
+  try
+    if let some path := output then
+      if ← path.pathExists then throw (IO.userError "source-recursion requires a new output directory")
+    let (results, rejections) ← match runAll with
+      | .ok value => pure value
+      | .error message => throw (IO.userError message)
+    if let some path := output then
+      IO.FS.createDirAll path
+      for result in results do
+        IO.FS.writeFile (path / s!"{result.name}.json") (result.snapshot.pretty 100 ++ "\n")
+      IO.FS.writeFile (path / "report.json") ((report results rejections).pretty 100 ++ "\n")
+    IO.println s!"source-recursion ok: {results.length} Ixon cases, {rejections.length} rejection/fallback checks; values agree and every heap reclaims"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-recursion: {error}"
+    return 1
diff --git a/Tests/Compiler/SourceUniqueReuse.lean b/Tests/Compiler/SourceUniqueReuse.lean
new file mode 100644
index 000000000..c6ed34eba
--- /dev/null
+++ b/Tests/Compiler/SourceUniqueReuse.lean
@@ -0,0 +1,29 @@
+import Ix.Compiler.UniqueReuse.Rejections
+
+/-! Fresh-process source unique reversal artifacts and static unique reuse observations. -/
+
+open Lean Ix.Compiler.UniqueReuse.Examples
+
+def main (args : List String) : IO UInt32 := do
+  let output : Option System.FilePath ← match args with
+    | [] => pure none
+    | [path] => pure (some path)
+    | _ =>
+        IO.eprintln "usage: lake exe compiler-source-unique-reuse [new-output-directory]"
+        return 2
+  try
+    if let some path := output then
+      if ← path.pathExists then throw (IO.userError "source-unique-reuse requires a new output directory")
+    let (results, checks) ← match runAll with
+      | .error message => throw (IO.userError message)
+      | .ok value => pure value
+    if let some path := output then
+      IO.FS.createDirAll path
+      for result in results do
+        IO.FS.writeFile (path / s!"{result.name}.json") (result.snapshot.pretty 100 ++ "\n")
+      IO.FS.writeFile (path / "report.json") ((report results checks).pretty 100 ++ "\n")
+    IO.println s!"source-unique-reuse ok: {results.length} Ixon reversals, {checks.length} policy/rejection checks; values, reservation prefixes, costs, and reclamation agree"
+    return 0
+  catch error =>
+    IO.eprintln s!"source-unique-reuse: {error}"
+    return 1
diff --git a/Tests/Compiler/Tests.lean b/Tests/Compiler/Tests.lean
new file mode 100644
index 000000000..3e733fda5
--- /dev/null
+++ b/Tests/Compiler/Tests.lean
@@ -0,0 +1,6083 @@
+import Ix.Compiler
+
+/-!
+Runtime test executable: everything that must *execute* FFI (blake3)
+lives here, compiled and linked against the static lib — elaboration-
+time `#guard`s can't run FFI (no dynlib in the interpreter). Run by the
+flake's `tests` check; prints `tests-ok` on success.
+-/
+
+open Ix.Compiler.Ixon
+
+/-- The universal BLAKE3 empty-input test vector:
+`af1349b9f5f9a1a6a0404dea36dcc9499bcb25c9adc112b7cc9a93cae41f3262`. -/
+def expectedEmptyBlake3 : List Nat :=
+  [0xaf, 0x13, 0x49, 0xb9, 0xf5, 0xf9, 0xa1, 0xa6,
+   0xa0, 0x40, 0x4d, 0xea, 0x36, 0xdc, 0xc9, 0x49,
+   0x9b, 0xcb, 0x25, 0xc9, 0xad, 0xc1, 0x12, 0xb7,
+   0xcc, 0x9a, 0x93, 0xca, 0xe4, 0x1f, 0x32, 0x62]
+
+/-! Exact ix-side capture at `Sharing.ixParityRevision`. The clean archived
+source tree was `c09cfe3df1ee6ff92009672cc9077b4b7e2db63a`; the revision itself is
+single-sourced in `Sharing.ixParityRevision`. These are external golden
+artifacts, deliberately independent of the local serializer definitions. -/
+
+namespace IxRebaseline
+
+def sourceTree : String := "c09cfe3df1ee6ff92009672cc9077b4b7e2db63a"
+def wireFormat : String := "ixon-v2"
+
+def sampleAxiomBytes : ByteArray := ByteArray.mk #[210, 0, 1, 3, 0, 0, 1, 0]
+
+def sampleAxiomAddress : List Nat :=
+  [175, 190, 20, 2, 194, 88, 190, 182, 79, 114, 28, 108, 112, 136,
+   43, 71, 254, 192, 235, 145, 134, 231, 227, 179, 11, 181, 74, 208,
+   29, 62, 109, 135]
+
+def goldenV2Bytes : ByteArray := ByteArray.mk #[
+  208, 1, 128, 128, 148, 0, 0, 5, 8, 31, 2, 8, 32, 7, 8, 128,
+  3, 132, 0, 0, 1, 8, 31, 2, 8, 32, 3, 8, 128, 120, 8, 40,
+  8, 0, 0, 1, 2, 3, 4, 0, 1, 2, 19, 18, 17, 16, 176, 176,
+  80, 9, 0, 1, 1, 114, 49, 0, 4, 65, 0, 16, 16, 1, 171, 171,
+  171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171,
+  171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171, 171,
+  171, 171, 5, 0, 1, 0, 64, 192, 1, 193, 128, 194, 64, 0, 195, 225,
+  0, 1]
+
+def goldenV2Address : List Nat :=
+  [238, 16, 204, 23, 76, 138, 70, 122, 24, 3, 187, 143, 106, 4,
+   178, 63, 183, 235, 146, 24, 170, 118, 219, 68, 149, 59, 34, 171,
+   73, 90, 205, 116]
+
+structure SharingCapture where
+  name : String
+  input : ByteArray
+  output : ByteArray
+
+def sharingCaptures : List SharingCapture := [
+  { name := "simple"
+    input := ByteArray.mk #[1, 148, 7, 32, 0, 7, 32, 0, 7, 32, 0, 7, 32, 0, 1]
+    output := ByteArray.mk #[1, 148, 7, 176, 7, 176, 7, 176, 7, 176, 1, 1, 32, 0] },
+  { name := "content-hash"
+    input := ByteArray.mk #[3, 145, 7, 32, 0, 0, 145, 7, 32, 0, 1,
+      145, 7, 32, 0, 2]
+    output := ByteArray.mk #[3, 145, 7, 176, 0, 145, 7, 176, 1,
+      145, 7, 176, 2, 1, 32, 0] },
+  { name := "recursor"
+    input := ByteArray.mk #[4, 149, 7, 145, 7, 32, 0, 1, 7, 113, 17, 32,
+      1, 7, 113, 18, 32, 2, 7, 113, 19, 32, 3, 7, 32, 0, 113, 17, 16,
+      17, 18, 19]
+    output := ByteArray.mk #[4, 149, 7, 145, 7, 32, 0, 1, 7, 113, 17,
+      32, 1, 7, 113, 18, 32, 2, 7, 113, 19, 32, 3, 7, 32, 0, 113, 17,
+      16, 17, 18, 19, 0] },
+  { name := "forall-imp-sharing"
+    input := ByteArray.mk #[2, 146, 7, 19, 7, 113, 18, 17, 113, 18, 16,
+      146, 7, 19, 7, 113, 18, 16, 113, 18, 17]
+    output := ByteArray.mk #[2, 146, 7, 19, 7, 176, 177, 146, 7, 19, 7,
+      177, 176, 2, 113, 18, 17, 113, 18, 16] },
+  { name := "forall-imp-real"
+    input := ByteArray.mk #[2, 150, 7, 0, 7, 145, 7, 16, 1, 7, 145, 7,
+      17, 1, 7, 146, 7, 18, 7, 113, 18, 16, 113, 18, 17, 7, 145, 7, 19,
+      113, 19, 16, 7, 20, 113, 19, 16, 134, 3, 0, 3, 145, 7, 16, 1, 3,
+      145, 7, 17, 1, 3, 146, 7, 18, 7, 113, 18, 16, 113, 18, 17, 3, 145,
+      7, 19, 113, 19, 16, 3, 20, 114, 18, 16, 113, 17, 16]
+    output := ByteArray.mk #[2, 150, 7, 0, 7, 183, 7, 179, 7, 182, 7,
+      178, 7, 20, 177, 134, 3, 0, 3, 183, 3, 179, 3, 182, 3, 178, 3, 20,
+      113, 180, 113, 17, 16, 8, 113, 18, 17, 113, 19, 16, 145, 7, 19,
+      177, 145, 7, 17, 1, 113, 18, 16, 145, 7, 180, 176, 145, 7, 18,
+      181, 145, 7, 16, 1] },
+  { name := "flip"
+    input := ByteArray.mk #[2, 150, 7, 0, 7, 1, 7, 2, 7, 146, 7, 18, 7,
+      18, 18, 7, 18, 7, 20, 19, 134, 3, 0, 3, 1, 3, 2, 3, 146, 7, 18,
+      7, 18, 18, 3, 18, 3, 20, 114, 18, 16, 17]
+    output := ByteArray.mk #[2, 150, 7, 0, 7, 1, 7, 2, 7, 177, 7, 18, 7,
+      20, 19, 134, 3, 0, 3, 1, 3, 2, 3, 177, 3, 18, 3, 20, 114, 18, 16,
+      17, 2, 145, 7, 18, 18, 145, 7, 18, 176] }
+]
+
+def sharingCapture? (name : String) : Option SharingCapture :=
+  sharingCaptures.find? fun capture => capture.name == name
+
+end IxRebaseline
+
+def hashNats (a : Address) : List Nat :=
+  a.hash.data.toList.map (fun (b : UInt8) => b.toNat)
+
+/-- Deterministic distinct addresses for the compiled environment-index smoke
+test. The first three bytes are a little-endian natural; the remaining bytes
+are zero. -/
+def indexedAddress (n : Nat) : Address :=
+  Address.ofFn fun index =>
+    if index.val == 0 then n.toUInt8
+    else if index.val == 1 then (n / 256).toUInt8
+    else if index.val == 2 then (n / (256 * 256)).toUInt8
+    else 0
+
+namespace IxIRAddressFixtures
+
+def ir0Decl : Ix.Compiler.IxIR0.Decl :=
+  .recursor 2 false #[
+    ⟨0, .lit (.nat 128)⟩,
+    ⟨1, .app (.var 1) (.lit (.str "x"))⟩]
+
+def ir1Decl : Ix.Compiler.IxIR1.Decl :=
+  .fn ⟨2, .unique, false,
+    .letOp
+      (.alloc .unique
+        ⟨Address.replicate 0x2a, 1, 2⟩
+        #[.var 1, .lit (.nat 128)])
+      (.case (.var 0) true #[
+        .mk 2 1 (.ret (.lit (.str "x")))])⟩
+
+def expectedIr0Bytes : ByteArray := ByteArray.mk #[
+  99, 111, 109, 112, 105, 108, 97, 116, 114, 105, 120, 47, 105, 120,
+  105, 114, 48, 47, 100, 101, 99, 108, 47, 49, 0, 2, 2, 0, 2, 0, 6,
+  0, 128, 1, 1, 2, 0, 1, 6, 1, 1, 120]
+
+def expectedIr0Hash : List Nat :=
+  [87, 159, 186, 175, 104, 210, 117, 212, 187, 180, 242, 170, 245,
+   247, 102, 207, 47, 63, 157, 187, 179, 63, 228, 86, 156, 71, 29,
+   197, 105, 126, 184, 124]
+
+def expectedIr1Bytes : ByteArray := ByteArray.mk #[
+  99, 111, 109, 112, 105, 108, 97, 116, 114, 105, 120, 47, 105, 120,
+  105, 114, 49, 47, 100, 101, 99, 108, 47, 50, 0, 0, 2, 0, 0, 1, 1, 0,
+  42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42,
+  42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42, 42,
+  1, 2, 2, 0, 1, 1, 0, 128, 1, 2, 0, 0, 1, 1, 2, 1, 0, 1, 1, 1,
+  120]
+
+def expectedIr1Hash : List Nat :=
+  [168, 15, 142, 42, 202, 39, 215, 3, 84, 101, 26, 27, 100, 29, 247,
+   9, 29, 165, 55, 137, 160, 249, 47, 228, 54, 229, 201, 244, 99, 5,
+   108, 71]
+
+private def rejected {alpha : Type} : Except String alpha → Bool
+  | .error _ => true
+  | .ok _ => false
+
+def ir0DecodeOk : Bool :=
+  match Ix.Compiler.IxIR0.Decl.decodePreimage expectedIr0Bytes with
+  | .ok declaration => declaration.preimage == expectedIr0Bytes
+  | .error _ => false
+
+def ir1DecodeOk : Bool :=
+  match Ix.Compiler.IxIR1.Decl.decodePreimage expectedIr1Bytes with
+  | .ok declaration => declaration.preimage == expectedIr1Bytes
+  | .error _ => false
+
+/-- Malformed framing, tags, LEB128, UTF-8, and truncation must all fail
+closed. The nonminimal LEB128 fixture parses as zero at the raw-reader layer
+and is rejected by the canonical re-encoding check. -/
+def ir0Malformed : List (String × ByteArray) := [
+  ("trailing byte", expectedIr0Bytes.push 0),
+  ("wrong domain", expectedIr0Bytes.set! 0 0),
+  ("invalid declaration tag", expectedIr0Bytes.set! 25 0xff),
+  ("nonminimal LEB128",
+    Ix.Compiler.IxIR0.Decl.addressDomain ++ ByteArray.mk #[3, 128, 0]),
+  ("invalid nested UTF-8",
+    Ix.Compiler.IxIR0.Decl.addressDomain ++
+      ByteArray.mk #[0, 0, 6, 1, 1, 0xff]),
+  ("truncated declaration",
+    expectedIr0Bytes.extract 0 (expectedIr0Bytes.size - 1))]
+
+def ir1Malformed : List (String × ByteArray) := [
+  ("trailing byte", expectedIr1Bytes.push 0),
+  ("wrong domain", expectedIr1Bytes.set! 0 0),
+  ("invalid declaration tag", expectedIr1Bytes.set! 25 0xff),
+  ("nonminimal LEB128",
+    Ix.Compiler.IxIR1.Decl.addressDomain ++ ByteArray.mk #[1, 128, 0]),
+  ("invalid nested UTF-8",
+    Ix.Compiler.IxIR1.Decl.addressDomain ++
+      ByteArray.mk #[0, 0, 0, 0, 0, 1, 1, 1, 0xff]),
+  ("truncated declaration",
+    expectedIr1Bytes.extract 0 (expectedIr1Bytes.size - 1))]
+
+def ir0Rejects (bytes : ByteArray) : Bool :=
+  rejected (Ix.Compiler.IxIR0.Decl.decodePreimage bytes)
+
+def ir1Rejects (bytes : ByteArray) : Bool :=
+  rejected (Ix.Compiler.IxIR1.Decl.decodePreimage bytes)
+
+end IxIRAddressFixtures
+
+namespace IxIRReaddressFixtures
+
+open Ix.Compiler.IxIR1
+
+def oldLeaf : Address := Address.replicate 0xfa
+def oldParent : Address := Address.replicate 0xfb
+def sourceKey : Address := Address.replicate 0x11
+
+def leaf : Decl :=
+  .fn ⟨0, .shared, true, .ret (.lit (.nat 7))⟩
+
+def parent : Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call oldLeaf #[]) (.ret (.var 0))⟩
+
+def sourceDeclaration : Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call oldParent #[])
+      (.letOp (.papp oldLeaf #[]) (.ret (.var 0)))⟩
+
+def mainCode : Code :=
+  .letOp (.call oldParent #[]) (.ret (.var 0))
+
+def chain : Except String Readdress.Result :=
+  Readdress.run [(sourceKey, sourceDeclaration)]
+    [(oldParent, parent), (oldLeaf, leaf)] mainCode
+
+def chainRuntimeAgrees (result : Readdress.Result) : Bool :=
+  let ctx : Ctx :=
+    { decls := Env.ofList result.declarations,
+      oracle := Ix.Compiler.IxIR1.Lower.tgtOracle }
+  match runMain ctx result.main with
+  | .ok (_, .lit (.nat 7)) => true
+  | _ => false
+
+def contentHexes (result : Readdress.Result) : List String :=
+  result.addressMap.map fun entry => Address.toHex entry.2
+
+def expectedChainContent : List String :=
+  ["bffd28385492968a674f7090824348301087119dfa377a6b682bff177ede78d1",
+   "571f9c86b9289add35eda891c1f019c0da121f6e7738a1767193da7948261ff9"]
+
+def chainOk (result : Readdress.Result) : Bool :=
+  let mapAddress := Readdress.Renaming.apply result.addressMap
+  let expectedParent := Readdress.Decl.mapAddresses mapAddress parent
+  match result.generated with
+  | [(leafAddress, emittedLeaf), (parentAddress, emittedParent)] =>
+      result.addressMap.lookup oldLeaf == some leafAddress &&
+      result.addressMap.lookup oldParent == some parentAddress &&
+      leafAddress == leaf.address &&
+      parentAddress == expectedParent.address &&
+      emittedLeaf.preimage == leaf.preimage &&
+      emittedParent.preimage == expectedParent.preimage &&
+      result.source.flatMap (fun entry =>
+        Readdress.Decl.references entry.2) == [parentAddress, leafAddress] &&
+      Readdress.Code.references result.main == [parentAddress] &&
+      contentHexes result == expectedChainContent &&
+      result.noTransientKeys && result.noTransientReferences &&
+      result.generatedAreAddressed &&
+      result.semanticAudit
+        ([(sourceKey, sourceDeclaration)] ++
+          [(oldParent, parent), (oldLeaf, leaf)]) mainCode &&
+      chainRuntimeAgrees result
+  | _ => false
+
+def oldDuplicateA : Address := Address.replicate 0xfc
+def oldDuplicateB : Address := Address.replicate 0xfd
+
+def deduplicate : Except String Readdress.Result :=
+  Readdress.run [] [(oldDuplicateA, leaf), (oldDuplicateB, leaf)]
+    (.letOp (.call oldDuplicateA #[])
+      (.letOp (.call oldDuplicateB #[]) (.ret (.var 0))))
+
+def expectedDeduplicatedContent : List String :=
+  ["bffd28385492968a674f7090824348301087119dfa377a6b682bff177ede78d1",
+   "bffd28385492968a674f7090824348301087119dfa377a6b682bff177ede78d1"]
+
+def deduplicateOk (result : Readdress.Result) : Bool :=
+  match result.generated with
+  | [(address, declaration)] =>
+      result.addressMap.lookup oldDuplicateA == some address &&
+      result.addressMap.lookup oldDuplicateB == some address &&
+      declaration.preimage == leaf.preimage &&
+      Readdress.Code.references result.main == [address, address] &&
+      contentHexes result == expectedDeduplicatedContent &&
+      result.noTransientKeys && result.noTransientReferences &&
+      result.generatedAreAddressed &&
+      result.semanticAudit
+        [(oldDuplicateA, leaf), (oldDuplicateB, leaf)]
+        (.letOp (.call oldDuplicateA #[])
+          (.letOp (.call oldDuplicateB #[]) (.ret (.var 0))))
+  | _ => false
+
+def cycleA : Address := Address.replicate 0xf1
+def cycleB : Address := Address.replicate 0xf2
+
+def cycleDeclA : Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call cycleB #[]) (.ret (.var 0))⟩
+
+def cycleDeclB : Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call cycleA #[]) (.ret (.var 0))⟩
+
+def cycleRejected : Bool :=
+  match Readdress.run [] [(cycleA, cycleDeclA), (cycleB, cycleDeclB)]
+      (.ret .erased) with
+  | .error message =>
+      message == "generated declaration address dependency cycle"
+  | .ok _ => false
+
+def overlapRejected : Bool :=
+  match Readdress.run [(oldLeaf, .extern 0)] [(oldLeaf, leaf)]
+      (.ret .erased) with
+  | .error message =>
+      message == s!"generated temporary address overlaps source declaration {Address.toHex oldLeaf}"
+  | .ok _ => false
+
+def sourceKeyCollisionRejected : Bool :=
+  let address := leaf.address
+  match Readdress.run [(address, .extern 0)] [(oldLeaf, leaf)]
+      (.ret .erased) with
+  | .error message =>
+      message == s!"generated content address collides with source declaration key {Address.toHex address}"
+  | .ok _ => false
+
+def contentTemporaryOverlapRejected : Bool :=
+  let address := leaf.address
+  match Readdress.run [] [(address, leaf)] (.ret .erased) with
+  | .error message =>
+      message == s!"generated content address overlaps temporary namespace {Address.toHex address}"
+  | .ok _ => false
+
+def nestedExpression : Ix.Compiler.IxIR0.Expr :=
+  .app
+    (.lam .many
+      (.app (.lam .many (.var 1))
+        (Ix.Compiler.IxIR0.Examples.natE 2)))
+    (Ix.Compiler.IxIR0.Examples.natE 3)
+
+def nestedLowering : Except String Readdress.Result :=
+  Ix.Compiler.IxIR1.Lower.lowerAllIndexedAddressed
+    Ix.Compiler.IxIR0.Examples.declList nestedExpression
+
+def loweringAudits (source : List (Address × Ix.Compiler.IxIR0.Decl))
+    (main : Ix.Compiler.IxIR0.Expr) (result : Readdress.Result) : Bool :=
+  match (Ix.Compiler.IxIR1.Lower.lowerAllIndexedAction source main
+      .shared 10000).run {} with
+  | .ok (raw, rawMain) _ =>
+      result.semanticAudit raw rawMain &&
+        result.protects (source.map Prod.fst)
+  | .error _ _ => false
+
+def expectedNestedContent : List String :=
+  ["acdd7ed6dd2ff0f364ea7697b85c32098d843b7ff3daa1f62b4ec2e0dc6d9fc5",
+   "04374cf03ca115a555c4cc2b3fccac7009b405ae83d6df238e1f05b533c72f0c",
+   "5a51d499b2f13429d9a04cf59d8f20a2e5b5def8d27a454bc821e8d0d7508393",
+   "df504cb4ec73814775bb8d0cae6f3f360d01972a66df694b9ca0c0d1ee7e2fa6",
+   "ca360f51322575138a9b9025f245bd18117a2c48c9286ce763ceeccd635e8976"]
+
+def nestedLoweringOk (result : Readdress.Result) : Bool :=
+  let ctx : Ctx :=
+    { decls := Env.ofList result.declarations,
+      oracle := Ix.Compiler.IxIR1.Lower.tgtOracle }
+  -- The corpus declarations themselves contribute three wrappers/lifts;
+  -- the nested expression contributes its inner and outer lifted functions.
+  result.addressMap.length == 5 && result.generated.length == 5 &&
+    contentHexes result == expectedNestedContent &&
+    result.noTransientKeys && result.noTransientReferences &&
+    result.generatedAreAddressed &&
+    loweringAudits Ix.Compiler.IxIR0.Examples.declList nestedExpression
+      result &&
+    match runMain ctx result.main with
+    | .ok (store, value) =>
+        (Ix.Compiler.IxIR1.Lower.treeOfR store 1000 value).bind
+          Ix.Compiler.IxIR1.Lower.natT? == some 3
+    | .error _ => false
+
+def wrapperExpression : Ix.Compiler.IxIR0.Expr :=
+  .app (.ref Ix.Compiler.IxIR0.Examples.pairMk)
+    (Ix.Compiler.IxIR0.Examples.natE 1)
+
+def wrapperLowering : Except String Readdress.Result :=
+  Ix.Compiler.IxIR1.Lower.lowerAllIndexedAddressed
+    Ix.Compiler.IxIR0.Examples.declList wrapperExpression
+
+def expectedWrapperContent : List String :=
+  ["2ff8127bf306efa22913c6c3c44ba3f560e1aedf94a94b85939f0f772aa97138",
+   "5a51d499b2f13429d9a04cf59d8f20a2e5b5def8d27a454bc821e8d0d7508393",
+   "df504cb4ec73814775bb8d0cae6f3f360d01972a66df694b9ca0c0d1ee7e2fa6",
+   "ca360f51322575138a9b9025f245bd18117a2c48c9286ce763ceeccd635e8976"]
+
+def wrapperLoweringOk (result : Readdress.Result) : Bool :=
+  -- Three generated declarations come from the corpus; this partial
+  -- constructor application contributes the fourth wrapper.
+  result.addressMap.length == 4 && result.generated.length == 4 &&
+    contentHexes result == expectedWrapperContent &&
+    result.noTransientKeys && result.noTransientReferences &&
+    result.generatedAreAddressed &&
+    loweringAudits Ix.Compiler.IxIR0.Examples.declList wrapperExpression
+      result
+
+/-- A constructor address is a source identity even though constructors emit
+no raw IxIR₁ declaration.  Deliberately collide it with the first transient
+lambda key and ensure the production boundary rejects the would-be rewrite. -/
+def protectedCtorKey : Address :=
+  Ix.Compiler.IxIR1.Lower.synthAddr 0
+
+def protectedSourceIdentityRejected : Bool :=
+  let source : List (Address × Ix.Compiler.IxIR0.Decl) :=
+    [(protectedCtorKey, .ctor 0 0)]
+  let expression : Ix.Compiler.IxIR0.Expr :=
+    .app (.lam .many (.var 0)) (.ref protectedCtorKey)
+  match Ix.Compiler.IxIR1.Lower.lowerAllIndexedAddressed source expression with
+  | .error message =>
+      message == "generated address map rewrites a protected source identity"
+  | .ok _ => false
+
+end IxIRReaddressFixtures
+
+namespace IxIR1ReaddressAllFixtures
+
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.ReaddressAll
+
+def oldRoot : Address := Address.replicate 0xd0
+def oldA : Address := Address.replicate 0xd1
+def oldB : Address := Address.replicate 0xd2
+def oldLeaf : Address := Address.replicate 0xd3
+def external : Address := Address.replicate 0xd4
+
+def leaf : Decl := .extern 1
+
+def declarationA : Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call oldB #[])
+      (.letOp (.call oldLeaf #[]) (.ret .erased))⟩
+
+def declarationB : Decl :=
+  .fn ⟨0, .unique, false,
+    .letOp (.papp oldA #[])
+      (.letOp (.extern external #[]) (.ret .erased))⟩
+
+def root : Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call oldA #[]) (.ret (.var 0))⟩
+
+/-- Source order deliberately opposes dependency order. -/
+def raw : List (Address × Decl) :=
+  [(oldRoot, root), (oldA, declarationA), (oldB, declarationB),
+   (oldLeaf, leaf)]
+
+def mainCode : Code :=
+  .letOp (.call oldRoot #[]) (.ret (.var 0))
+
+def built : Except String ReaddressAll.Result :=
+  ReaddressAll.run [external] raw mainCode
+
+def expectedTargetHexes : List String :=
+  ["d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3",
+   "9f879169042641be6111442a373d7799aa1aa34b44ea6aca2b303013815b2287",
+   "eded0797fe0dc6c8f382111845bfefc7d83eef1bfe3813d65d5b268774deed05",
+   "c86d1f0cbfa5eb1ad35d6990f7582ef4c872663779143f732a41c53cbd46075c"]
+
+def expectedBlockHex : String :=
+  "fac32ac632054612f912abec284c37b0a331f84e4ebe72ec09e16f4966f1cddd"
+
+def componentsOk : Bool :=
+  (ReaddressAll.discoverComponents raw).map Component.keys ==
+    [[oldRoot], [oldA, oldB], [oldLeaf]]
+
+/-- The public SCC boundary must remain iterative on a dependency chain large
+enough to expose accidental native-stack recursion. -/
+def longChainLength : Nat := 8192
+
+def longChainRaw : List (Address × Decl) :=
+  (List.range longChainLength).map fun index =>
+    let address := Ix.Compiler.IxIR1.Lower.synthAddr index
+    let body :=
+      if index + 1 < longChainLength then
+        .letOp (.call (Ix.Compiler.IxIR1.Lower.synthAddr (index + 1)) #[])
+          (.ret .erased)
+      else
+        .ret .erased
+    (address, .fn ⟨0, .shared, true, body⟩)
+
+def longChainComponentsOk : Bool :=
+  let components := ReaddressAll.discoverComponents longChainRaw
+  components.length == longChainLength &&
+    components.all fun component => component.members.length == 1
+
+def builtOk (result : ReaddressAll.Result) : Bool :=
+  let targets := result.addressMap.map fun entry => Address.toHex entry.2
+  match result.artifacts, result.blocks, result.stable, result.ordinary,
+      result.addressMap.lookup oldLeaf, result.addressMap.lookup oldA,
+      result.addressMap.lookup oldB, result.addressMap.lookup oldRoot with
+  | [.stable leafAddress emittedLeaf, .mutual block,
+        .ordinary rootAddress emittedRoot], [onlyBlock],
+      [(stableLeaf, _)], [(ordinaryRoot, _)],
+      some mappedLeaf, some mappedA, some mappedB, some mappedRoot =>
+      targets == expectedTargetHexes &&
+        Address.toHex block.blockAddress == expectedBlockHex &&
+        onlyBlock.blockAddress == block.blockAddress &&
+        leafAddress == mappedLeaf && rootAddress == mappedRoot &&
+        stableLeaf == leafAddress && ordinaryRoot == rootAddress &&
+        emittedLeaf.preimage == leaf.preimage &&
+        emittedRoot.address == rootAddress &&
+        block.derivedAddresses == [mappedA, mappedB] &&
+        (result.declarations.map fun entry =>
+          (Readdress.Decl.references entry.2).map Address.toHex) ==
+            [[], [Address.toHex mappedB, Address.toHex mappedLeaf],
+              [Address.toHex mappedA, Address.toHex external],
+              [Address.toHex mappedA]] &&
+        (Readdress.Code.references result.main).map Address.toHex ==
+          [Address.toHex mappedRoot] &&
+        result.addressMap.length == raw.length &&
+        result.declarations.length == raw.length &&
+        result.contentAddressed && result.noTransientKeys &&
+        result.noTransientReferences && result.semanticAudit raw mainCode &&
+        result.rebuildSemanticAudit raw mainCode
+  | _, _, _, _, _, _, _, _ => false
+
+def newRoot : Address := Address.replicate 0xe0
+def newA : Address := Address.replicate 0xe1
+def newB : Address := Address.replicate 0xe2
+def renamedRaw : List (Address × Decl) :=
+  [(newRoot,
+      .fn ⟨0, .shared, true,
+        .letOp (.call newA #[]) (.ret (.var 0))⟩),
+   (newA,
+    .fn ⟨0, .shared, true,
+      .letOp (.call newB #[])
+          (.letOp (.call oldLeaf #[]) (.ret .erased))⟩),
+   (newB,
+      .fn ⟨0, .unique, false,
+        .letOp (.papp newA #[])
+          (.letOp (.extern external #[]) (.ret .erased))⟩),
+   (oldLeaf, leaf)]
+
+def renamedMain : Code :=
+  .letOp (.call newRoot #[]) (.ret (.var 0))
+
+def transientSpellingIndependent : Bool :=
+  match built, ReaddressAll.run [external] renamedRaw renamedMain with
+  | .ok original, .ok renamed =>
+      original.finalAddresses == renamed.finalAddresses &&
+        original.blockAddresses == renamed.blockAddresses &&
+        original.declarations.map (fun entry => entry.2.preimage) ==
+          renamed.declarations.map (fun entry => entry.2.preimage)
+  | _, _ => false
+
+def memberOrderSensitive : Bool :=
+  let reordered : List (Address × Decl) :=
+    [(oldRoot, root), (oldB, declarationB), (oldA, declarationA),
+     (oldLeaf, leaf)]
+  match built, ReaddressAll.run [external] reordered mainCode with
+  | .ok original, .ok changed =>
+      original.blockAddresses != changed.blockAddresses &&
+        original.finalAddresses != changed.finalAddresses
+  | _, _ => false
+
+def duplicateA : Address := Address.replicate 0xf0
+def duplicateB : Address := Address.replicate 0xf1
+
+def plainLeaf : Decl :=
+  .fn ⟨0, .shared, true, .ret (.lit (.nat 7))⟩
+
+def ordinaryDeduplicates : Bool :=
+  match ReaddressAll.run []
+      [(duplicateA, plainLeaf), (duplicateB, plainLeaf)]
+      (.ret .erased) with
+  | .ok result =>
+      match result.addressMap.lookup duplicateA,
+          result.addressMap.lookup duplicateB with
+      | some addressA, some addressB =>
+          addressA == addressB && result.artifacts.length == 1 &&
+            result.declarations.length == 1 &&
+            result.semanticAudit
+              [(duplicateA, plainLeaf), (duplicateB, plainLeaf)]
+              (.ret .erased)
+      | _, _ => false
+  | .error _ => false
+
+def selfKey : Address := Address.replicate 0xf2
+
+def explicitSelfUsesBlock : Bool :=
+  let declaration : Decl :=
+    .fn ⟨0, .shared, true,
+      .letOp (.call selfKey #[]) (.ret .erased)⟩
+  match ReaddressAll.run [] [(selfKey, declaration)] (.ret .erased) with
+  | .ok result => result.blocks.length == 1 && result.ordinary.isEmpty
+  | .error _ => false
+
+def callSelfUsesOrdinaryHash : Bool :=
+  let declaration : Decl :=
+    .fn ⟨0, .shared, true,
+      .letOp (.callSelf #[]) (.ret .erased)⟩
+  match ReaddressAll.run [] [(selfKey, declaration)] (.ret .erased) with
+  | .ok result => result.blocks.isEmpty && result.ordinary.length == 1
+  | .error _ => false
+
+def emptyOk : Bool :=
+  match ReaddressAll.run [] [] (.ret .erased) with
+  | .ok result =>
+      result.artifacts.isEmpty && result.addressMap.isEmpty &&
+        result.semanticAudit [] (.ret .erased)
+  | .error _ => false
+
+def rejectsDuplicateProducer : Bool :=
+  match ReaddressAll.run [] [(oldLeaf, leaf), (oldLeaf, .extern 2)]
+      (.ret .erased) with
+  | .error message =>
+      message == s!"duplicate IxIR1 declaration producer key {Address.toHex oldLeaf}"
+  | .ok _ => false
+
+def rejectsReservedProducer : Bool :=
+  match ReaddressAll.run [oldLeaf] [(oldLeaf, leaf)] (.ret .erased) with
+  | .error message =>
+      message == s!"IxIR1 declaration producer key overlaps reserved identity {Address.toHex oldLeaf}"
+  | .ok _ => false
+
+def rejectsProtectedContent : Bool :=
+  let content := plainLeaf.address
+  match ReaddressAll.run [content] [(oldLeaf, plainLeaf)] (.ret .erased) with
+  | .error message =>
+      message == s!"IxIR1 content address collides with protected identity {Address.toHex content}"
+  | .ok _ => false
+
+def rejectsContentInTransientNamespace : Bool :=
+  let content := plainLeaf.address
+  match ReaddressAll.run [] [(content, plainLeaf)] (.ret .erased) with
+  | .error message =>
+      message == s!"IxIR1 content address overlaps transient namespace {Address.toHex content}"
+  | .ok _ => false
+
+def fullyNested : Except String ReaddressAll.Result :=
+  Ix.Compiler.IxIR1.Lower.lowerAllIndexedFullyAddressed
+    Ix.Compiler.IxIR0.Examples.declList
+    IxIRReaddressFixtures.nestedExpression
+
+def expectedFullyNestedTargets : List String :=
+  ["4982c3a7b9dedd44f9319e71e6f1c9f3a283bdf9ea756f7e0222f46384992fdf",
+   "b09b67046ea7c5f432aaf8d9a0ad364f275859425285e2f0d13b1ff2a4ce745b",
+   "b23ea729574d305094e1a192cd98fb9f4c6ac6c3b426e64d17149cb2330c2a9c",
+   "93b0f7191ee298a04c041218a2c31b2a6d47e716c9f06adabf6b4ffa52aa59b5",
+   "4040404040404040404040404040404040404040404040404040404040404040",
+   "acdd7ed6dd2ff0f364ea7697b85c32098d843b7ff3daa1f62b4ec2e0dc6d9fc5",
+   "04374cf03ca115a555c4cc2b3fccac7009b405ae83d6df238e1f05b533c72f0c",
+   "5a51d499b2f13429d9a04cf59d8f20a2e5b5def8d27a454bc821e8d0d7508393",
+   "33c1a0b2b85fab57e9310cc224469ae678bfea3771bc40cf29da7286d590f008",
+   "df504cb4ec73814775bb8d0cae6f3f360d01972a66df694b9ca0c0d1ee7e2fa6",
+   "5cddf5abadbb430a64d074bee0c0580ac0001429265aacc5d844139d0714e5ed",
+   "ca360f51322575138a9b9025f245bd18117a2c48c9286ce763ceeccd635e8976",
+   "9193adfb5265d9d0db333d02918ac51134c8dff437538e09b82f30414079ddd9"]
+
+def fullyLoweredAudit
+    (source : List (Address × Ix.Compiler.IxIR0.Decl))
+    (main : Ix.Compiler.IxIR0.Expr)
+    (result : ReaddressAll.Result) : Bool :=
+  match (Ix.Compiler.IxIR1.Lower.lowerAllIndexedAction source main
+      .shared 10000).run {} with
+  | .error _ _ => false
+  | .ok (rawTarget, rawMain) _ =>
+      let functionProducers := rawTarget.filterMap fun
+        | (address, .fn _) => some address
+        | _ => none
+      let externProducers := rawTarget.filterMap fun
+        | (address, .extern _) => some address
+        | _ => none
+      result.semanticAudit rawTarget rawMain &&
+        !result.finalAddresses.any functionProducers.contains &&
+        result.stable.length == externProducers.length &&
+        (result.stable.all fun entry => externProducers.contains entry.1) &&
+        (Ix.Compiler.IxIR1.Lower.constructorIdentities source).all fun address =>
+          Readdress.Renaming.apply result.addressMap address == address
+
+def fullyNestedOk (result : ReaddressAll.Result) : Bool :=
+  let ctx := result.addressedCtx Ix.Compiler.IxIR1.Lower.tgtOracle
+  result.addressMap.map (fun entry => Address.toHex entry.2) ==
+      expectedFullyNestedTargets && result.blocks.isEmpty &&
+    result.noTransientKeys && result.noTransientReferences &&
+    result.contentAddressed &&
+    fullyLoweredAudit Ix.Compiler.IxIR0.Examples.declList
+      IxIRReaddressFixtures.nestedExpression result &&
+    match runMain ctx result.main with
+    | .ok (store, value) =>
+        (Ix.Compiler.IxIR1.Lower.treeOfR store 1000 value).bind
+          Ix.Compiler.IxIR1.Lower.natT? == some 3
+    | .error _ => false
+
+def cyclicSourceKey : Address := Address.replicate 0xb7
+
+/-- Lowering this definition emits a closure whose body refers back to the
+source function, while the source function body refers to that closure. -/
+def cyclicSourceDeclaration : Ix.Compiler.IxIR0.Decl :=
+  .defn .shared
+    (.lam .many
+      (.app (.lam .many (.ref cyclicSourceKey)) (.var 0)))
+
+def fullyCyclicLowering : Except String ReaddressAll.Result :=
+  Ix.Compiler.IxIR1.Lower.lowerAllIndexedFullyAddressed
+    [(cyclicSourceKey, cyclicSourceDeclaration)]
+    (.ref cyclicSourceKey)
+
+def expectedFullyCyclicTargets : List String :=
+  ["82bf8557e67293e4a0e19784fb206c0bc0d7a7e38f2ad34d4df6b3cc4da86a9a",
+   "d9699af86a4c4726934dae674b3e420c4376bbfaf30a1d08eff073fa37681c7b"]
+
+def expectedFullyCyclicBlock : String :=
+  "28cb53ac21a976d278cb1294be05a273214bbab09768afb32b221044896106c5"
+
+def fullyCyclicLoweringOk (result : ReaddressAll.Result) : Bool :=
+  fullyLoweredAudit [(cyclicSourceKey, cyclicSourceDeclaration)]
+      (.ref cyclicSourceKey) result &&
+    result.addressMap.map (fun entry => Address.toHex entry.2) ==
+      expectedFullyCyclicTargets &&
+    result.blocks.length == 1 &&
+    match result.blocks with
+    | [block] =>
+        Address.toHex block.blockAddress == expectedFullyCyclicBlock &&
+          block.derivedAddresses.map Address.toHex ==
+            expectedFullyCyclicTargets && block.members.length == 2
+    | _ => false
+
+def fullyProtectedSourceIdentityRejected : Bool :=
+  let source : List (Address × Ix.Compiler.IxIR0.Decl) :=
+    [(Ix.Compiler.IxIR1.Lower.synthAddr 0, .ctor 0 0)]
+  let expression : Ix.Compiler.IxIR0.Expr :=
+    .app (.lam .many (.var 0))
+      (.ref (Ix.Compiler.IxIR1.Lower.synthAddr 0))
+  match Ix.Compiler.IxIR1.Lower.lowerAllIndexedFullyAddressed
+      source expression with
+  | .error message =>
+      message == s!"IxIR1 declaration producer key overlaps reserved identity {Address.toHex (Ix.Compiler.IxIR1.Lower.synthAddr 0)}"
+  | .ok _ => false
+
+end IxIR1ReaddressAllFixtures
+
+namespace IxIRMutualBlockFixtures
+
+open Ix.Compiler.IxIR0
+open Ix.Compiler.IxIR0.MutualBlock
+
+def oldA : Address := Address.replicate 0xf1
+def oldB : Address := Address.replicate 0xf2
+def external : Address := Address.replicate 0x42
+
+/-- A genuine local cycle: the definition points to the recursor and one
+recursor rule points back to the definition.  The extra external edge checks
+that only block-local names are abstracted. -/
+def raw : List (Address × Ix.Compiler.IxIR0.Decl) :=
+  [(oldA,
+      .defn .shared
+        (.lam .many (.app (.ref oldB) (.ref external)))),
+   (oldB,
+      .recursor 0 false #[⟨0, .app (.ref oldA) (.var 0)⟩])]
+
+def symbolic : List MutualBlock.Decl := abstractMembers raw
+
+def expectedBlockBytes : ByteArray := ByteArray.mk #[
+  99, 111, 109, 112, 105, 108, 97, 116, 114, 105, 120, 47, 105, 120,
+  105, 114, 48, 47, 109, 117, 116, 117, 97, 108, 45, 98, 108, 111,
+  99, 107, 47, 49, 0, 2, 0, 1, 3, 3, 2, 1, 0, 1, 1, 1,
+  66, 66, 66, 66, 66, 66, 66, 66,
+  66, 66, 66, 66, 66, 66, 66, 66,
+  66, 66, 66, 66, 66, 66, 66, 66,
+  66, 66, 66, 66, 66, 66, 66, 66, 2,
+  0, 0, 1, 0, 2, 1, 0, 0, 0, 0]
+
+def expectedBlockHex : String :=
+  "5ea95e2ae3fda21872339a280eb713a33a8f4452a3746c7c5dd05e29e34e6fdb"
+
+def expectedMemberHexes : List String :=
+  ["d0cf65a4d9b4ee7bbe57e56db69b52a7e5b2468482655b03411334a496e3201d",
+   "3f2c1b81c862e5a85d73391021af6a1910bf27ae6ba6f2a424bfd035be7204dd"]
+
+def built : Except String MutualBlock.Result := MutualBlock.run [] raw
+
+def decodeOk : Bool :=
+  match Block.decodePreimage expectedBlockBytes with
+  | .error _ => false
+  | .ok decoded =>
+      decoded == symbolic &&
+        match Block.decodeMaterialized [] expectedBlockBytes, built with
+        | .ok artifact, .ok result =>
+            artifact.blockAddress == result.blockAddress &&
+              artifact.blockMembers == result.blockMembers &&
+              artifact.members == result.members && artifact.audit
+        | _, _ => false
+
+def malformed : List (String × ByteArray) := [
+  ("trailing byte", expectedBlockBytes.push 0),
+  ("wrong domain", expectedBlockBytes.set! 0 0),
+  ("invalid local-reference tag", expectedBlockBytes.set! 40 0xff),
+  ("nonminimal member count",
+    Block.addressDomain ++ ByteArray.mk #[130, 0] ++
+      expectedBlockBytes.extract 34 expectedBlockBytes.size),
+  ("out-of-range local reference", expectedBlockBytes.set! 41 2),
+  ("truncated block",
+    expectedBlockBytes.extract 0 (expectedBlockBytes.size - 1)),
+  ("empty block", Block.addressDomain ++ ByteArray.mk #[0])]
+
+def rejectsArtifactBytes (bytes : ByteArray) : Bool :=
+  match Block.decodeArtifact bytes with
+  | .error _ => true
+  | .ok _ => false
+
+def concreteShape (result : MutualBlock.Result) : Bool :=
+  match result.members with
+  | [(addressA,
+        .defn .shared
+          (.lam .many (.app (.ref targetB) (.ref foundExternal)))),
+     (addressB,
+        .recursor 0 false rules)] =>
+      rules == #[⟨0, .app (.ref addressA) (.var 0)⟩] &&
+      targetB == addressB && foundExternal == external &&
+      result.addressMap.lookup oldA == some addressA &&
+      result.addressMap.lookup oldB == some addressB
+  | _ => false
+
+def expectedRenamedRaw (result : MutualBlock.Result) :
+    List (Address × Ix.Compiler.IxIR0.Decl) :=
+  let rename := MutualBlock.Renaming.apply result.addressMap
+  raw.map fun entry =>
+    (rename entry.1, MutualBlock.Concrete.Decl.mapAddresses rename entry.2)
+
+def builtOk (result : MutualBlock.Result) : Bool :=
+  Block.preimage result.blockMembers == expectedBlockBytes &&
+    Address.toHex result.blockAddress == expectedBlockHex &&
+    result.derivedAddresses.map Address.toHex == expectedMemberHexes &&
+    result.blockMembers == symbolic && result.members == expectedRenamedRaw result &&
+    result.memberKeysDerived && result.blockStable &&
+    result.noTransientKeys && result.noTransientReferences &&
+    result.semanticAudit raw && concreteShape result
+
+/-- Changing only the transient spellings cannot change the symbolic artifact
+or its block address. -/
+def renamedRaw : List (Address × Ix.Compiler.IxIR0.Decl) :=
+  let newA := Address.replicate 0xa1
+  let newB := Address.replicate 0xa2
+  [(newA,
+      .defn .shared
+        (.lam .many (.app (.ref newB) (.ref external)))),
+   (newB,
+      .recursor 0 false #[⟨0, .app (.ref newA) (.var 0)⟩])]
+
+def transientSpellingIndependent : Bool :=
+  abstractMembers renamedRaw == symbolic &&
+    Block.preimage (abstractMembers renamedRaw) == expectedBlockBytes
+
+/-- Member order is semantic because local indices are order-relative. -/
+def orderSensitive : Bool :=
+  let reversed := raw.reverse
+  Block.preimage (abstractMembers reversed) != expectedBlockBytes &&
+    Block.address (abstractMembers reversed) != Block.address symbolic
+
+def rejectsEmpty : Bool :=
+  match MutualBlock.run [] [] with
+  | .error message => message == "mutual block must contain at least one member"
+  | .ok _ => false
+
+def rejectsDuplicateTemporary : Bool :=
+  match MutualBlock.run [] [(oldA, .extern 0), (oldA, .extern 1)] with
+  | .error message =>
+      message == s!"duplicate mutual-block temporary address {Address.toHex oldA}"
+  | .ok _ => false
+
+/-- This is the exact alias that makes the old XOR scheme unsafe.  The new
+boundary detects it before hashing whenever the surrounding block identity is
+protected. -/
+def legacyWrapIndex : Nat := 2 ^ 64 - 1
+
+def rejectsLegacyWrapAlias : Bool :=
+  let block := Address.replicate 0x7a
+  let legacy := Address.memberAddr block legacyWrapIndex
+  legacy == block &&
+    match MutualBlock.run [block] [(legacy, .extern 0)] with
+    | .error message =>
+        message == s!"mutual-block temporary address overlaps reserved identity {Address.toHex block}"
+    | .ok _ => false
+
+def rejectsDerivedReservedCollision : Bool :=
+  match built with
+  | .error _ => false
+  | .ok result =>
+      match MutualBlock.run [result.derivedAddresses.head!] raw with
+      | .error message =>
+          message == s!"mutual-block member key collides with reserved identity {Address.toHex result.derivedAddresses.head!}"
+      | .ok _ => false
+
+end IxIRMutualBlockFixtures
+
+namespace IxIR1MutualBlockFixtures
+
+open Ix.Compiler.IxIR1
+open Ix.Compiler.IxIR1.MutualBlock
+
+def oldA : Address := Address.replicate 0xc1
+def oldB : Address := Address.replicate 0xc2
+def external : Address := Address.replicate 0xc3
+
+/-- A source/generated-style cycle with a stable external oracle edge nested
+beneath a case alternative. -/
+def declarationA : Ix.Compiler.IxIR1.Decl :=
+  .fn ⟨1, .shared, true,
+    .letOp (.call oldB #[.var 0]) (.ret (.var 0))⟩
+
+def declarationB : Ix.Compiler.IxIR1.Decl :=
+  .fn ⟨0, .unique, false,
+    .case .erased false #[.mk 0 0
+      (.letOp (.papp oldA #[])
+        (.letOp (.extern external #[]) (.ret .erased)))]⟩
+
+def raw : List (Address × Ix.Compiler.IxIR1.Decl) :=
+  [(oldA, declarationA), (oldB, declarationB)]
+
+def symbolic : List MutualBlock.Decl := abstractMembers raw
+
+def expectedBlockBytes : ByteArray := ByteArray.mk #[
+  99, 111, 109, 112, 105, 108, 97, 116, 114, 105, 120, 47, 105, 120,
+  105, 114, 49, 47, 109, 117, 116, 117, 97, 108, 45, 98, 108, 111,
+  99, 107, 47, 50, 0, 2,
+  0, 1, 1, 1, 1, 8, 0, 1, 1, 0, 0, 0, 0, 0, 0,
+  0, 0, 0, 2, 2, 0, 1, 0, 0, 1, 10, 0, 0, 0, 1, 12, 1,
+  195, 195, 195, 195, 195, 195, 195, 195,
+  195, 195, 195, 195, 195, 195, 195, 195,
+  195, 195, 195, 195, 195, 195, 195, 195,
+  195, 195, 195, 195, 195, 195, 195, 195,
+  0, 0, 2]
+
+def expectedBlockHex : String :=
+  "200b6f0ff4d00b038d54ac7f9f63801347c14e71f9ffa6cf655c3542e8131e66"
+
+def expectedMemberHexes : List String :=
+  ["5f5829956d0ffdafba051bc63ca0f922561e10bbd9782012fcf2d48bf4e2e09f",
+   "c8a8aef455e2b56a4d80b41bf9cbb171c428bce2a3d5e16a02d81283be70013e"]
+
+def built : Except String MutualBlock.Result :=
+  MutualBlock.run [external] raw
+
+def concreteEntriesEq :
+    List (Address × Ix.Compiler.IxIR1.Decl) →
+      List (Address × Ix.Compiler.IxIR1.Decl) → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      left.1 == right.1 &&
+        Ix.Compiler.IxIR1.Readdress.Decl.structurallyEq left.2 right.2 &&
+        concreteEntriesEq leftRest rightRest
+  | _, _ => false
+
+def decodeOk : Bool :=
+  match Block.decodePreimage expectedBlockBytes with
+  | .error _ => false
+  | .ok decoded =>
+      DeclList.structurallyEq decoded symbolic &&
+        match Block.decodeMaterialized [external] expectedBlockBytes, built with
+        | .ok artifact, .ok result =>
+            artifact.blockAddress == result.blockAddress &&
+              DeclList.structurallyEq artifact.blockMembers
+                result.blockMembers &&
+              concreteEntriesEq artifact.members result.members &&
+              artifact.audit
+        | _, _ => false
+
+def malformed : List (String × ByteArray) := [
+  ("trailing byte", expectedBlockBytes.push 0),
+  ("wrong domain", expectedBlockBytes.set! 0 0),
+  ("invalid local-reference tag", expectedBlockBytes.set! 40 0xff),
+  ("nonminimal member count",
+    Block.addressDomain ++ ByteArray.mk #[130, 0] ++
+      expectedBlockBytes.extract 34 expectedBlockBytes.size),
+  ("out-of-range local reference", expectedBlockBytes.set! 41 2),
+  ("truncated block",
+    expectedBlockBytes.extract 0 (expectedBlockBytes.size - 1)),
+  ("empty block", Block.addressDomain ++ ByteArray.mk #[0])]
+
+def rejectsArtifactBytes (bytes : ByteArray) : Bool :=
+  match Block.decodeArtifact bytes with
+  | .error _ => true
+  | .ok _ => false
+
+def expectedRenamedRaw (result : MutualBlock.Result) :
+    List (Address × Ix.Compiler.IxIR1.Decl) :=
+  let rename := Ix.Compiler.IxIR1.Readdress.Renaming.apply result.addressMap
+  raw.map fun entry =>
+    (rename entry.1,
+      Ix.Compiler.IxIR1.Readdress.Decl.mapAddresses rename entry.2)
+
+def concreteShape (result : MutualBlock.Result) : Bool :=
+  match result.members with
+  | [(addressA, declarationA), (addressB, declarationB)] =>
+      Ix.Compiler.IxIR1.Readdress.Decl.references declarationA == [addressB] &&
+        Ix.Compiler.IxIR1.Readdress.Decl.references declarationB ==
+          [addressA, external] &&
+        result.addressMap.lookup oldA == some addressA &&
+        result.addressMap.lookup oldB == some addressB
+  | _ => false
+
+def builtOk (result : MutualBlock.Result) : Bool :=
+  Block.preimage result.blockMembers == expectedBlockBytes &&
+    Address.toHex result.blockAddress == expectedBlockHex &&
+    result.derivedAddresses.map Address.toHex == expectedMemberHexes &&
+    DeclList.structurallyEq result.blockMembers symbolic &&
+    concreteEntriesEq result.members (expectedRenamedRaw result) &&
+    result.memberKeysDerived && result.blockStable &&
+    result.noTransientKeys && result.noTransientReferences &&
+    result.semanticAudit raw && concreteShape result
+
+def renamedRaw : List (Address × Ix.Compiler.IxIR1.Decl) :=
+  let newA := Address.replicate 0xa1
+  let newB := Address.replicate 0xa2
+  [(newA,
+      .fn ⟨1, .shared, true,
+        .letOp (.call newB #[.var 0]) (.ret (.var 0))⟩),
+   (newB,
+      .fn ⟨0, .unique, false,
+        .case .erased false #[.mk 0 0
+          (.letOp (.papp newA #[])
+            (.letOp (.extern external #[]) (.ret .erased)))]⟩)]
+
+def transientSpellingIndependent : Bool :=
+  DeclList.structurallyEq (abstractMembers renamedRaw) symbolic &&
+    Block.preimage (abstractMembers renamedRaw) == expectedBlockBytes
+
+def orderSensitive : Bool :=
+  let reversed := raw.reverse
+  Block.preimage (abstractMembers reversed) != expectedBlockBytes &&
+    Block.address (abstractMembers reversed) != Block.address symbolic
+
+def rejectsEmpty : Bool :=
+  match MutualBlock.run [] [] with
+  | .error message =>
+      message == "IxIR1 mutual block must contain at least one member"
+  | .ok _ => false
+
+def rejectsDuplicateTemporary : Bool :=
+  match MutualBlock.run []
+      [(oldA, .extern 0), (oldA, .extern 1)] with
+  | .error message =>
+      message == s!"duplicate IxIR1 mutual-block temporary address {Address.toHex oldA}"
+  | .ok _ => false
+
+def rejectsDerivedReservedCollision : Bool :=
+  match built with
+  | .error _ => false
+  | .ok result =>
+      match MutualBlock.run [result.derivedAddresses.head!] raw with
+      | .error message =>
+          message == s!"IxIR1 mutual-block member key collides with reserved identity {Address.toHex result.derivedAddresses.head!}"
+      | .ok _ => false
+
+end IxIR1MutualBlockFixtures
+
+namespace RepeatedErasureFixtures
+
+open Ix.Compiler Ix.Compiler.Ixon
+
+def first : Address := Address.replicate 0xc1
+def second : Address := Address.replicate 0xc2
+
+def groups : List IxIR0.Readdress.Group :=
+  [.mutual [(first, .defn .shared .erased)],
+   .mutual [(second, .defn .shared .erased)]]
+
+def mainExpr : IxIR0.Expr :=
+  .letE .many (.ref first)
+    (.letE .many (.ref second) (.lit (.nat 17)))
+
+def built := IxIR0.Readdress.run [] groups mainExpr
+
+/-- Both erased producers survive, even though their output identities and
+declarations coincide. The existing semantic transport theorem still applies. -/
+theorem transport (result : IxIR0.Readdress.Result) (hrun : built = .ok result) :
+    result.addressedCtx.run result.main 100 =
+      IxIR0.Readdress.mapResult
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap)
+        ((result.preAddressCtx groups).run mainExpr 100) := by
+  exact IxIR0.Readdress.run_emptyOracle_of_run_eq_ok hrun 100
+
+def checkedReuse : Bool :=
+  match built with
+  | .error _ => false
+  | .ok result =>
+    match result.blocks, result.addressMap with
+    | [left, right], [(oldA, newA), (oldB, newB)] =>
+      oldA == first && oldB == second && newA == newB &&
+        left.blockAddress == right.blockAddress &&
+        left.blockMembers == [.defn .shared .erased] &&
+        left.members == right.members && left.addressMap != right.addressMap &&
+        result.declarations.length == 2 &&
+        result.semanticAudit [] groups mainExpr &&
+        (match (result.preAddressCtx groups).run mainExpr 100,
+            result.addressedCtx.run result.main 100 with
+        | .ok (.lit (.nat 17)), .ok (.lit (.nat 17)) => true
+        | _, _ => false)
+    | _, _ => false
+
+/-- Collision tests inject candidate results into the exact production
+comparison. They do not need to discover an actual BLAKE3 collision. -/
+def conflictsRejected : Bool :=
+  match IxIR0.MutualBlock.run [] [(first, .defn .shared .erased)] with
+  | .error _ => false
+  | .ok original =>
+    let compatible := IxIR0.Readdress.compatibleBlocks original
+    let member := original.derivedAddresses.head!
+    compatible { original with addressMap := [(second, member)] } &&
+      !compatible { original with blockMembers := [.extern 0] } &&
+      !compatible { original with members := [(member, .extern 0)] } &&
+      !compatible { original with addressMap := [(second, second)] } &&
+      !compatible { original with blockAddress := second } &&
+      !compatible { original with blockAddress := member } &&
+      !compatible { original with
+        members := [(original.blockAddress, .defn .shared .erased)]
+        addressMap := [(second, original.blockAddress)] }
+
+def protectedNamespaces : Bool :=
+  match IxIR0.MutualBlock.run [] [(first, .defn .shared .erased)] with
+  | .error _ => false
+  | .ok block =>
+    let rejects := fun reserved groups main =>
+      match IxIR0.Readdress.run reserved groups main with
+      | .error _ => true
+      | .ok _ => false
+    let identities := block.blockAddress :: block.derivedAddresses
+    identities.all fun key =>
+      rejects [key] groups mainExpr &&
+        rejects [] (groups ++ [.stable [(key, .extern 0)]]) mainExpr &&
+        rejects [] groups (.ref key)
+
+/-- Alpha-renamed two-member cycles share an entire block, including the
+position-sensitive derived member identities and all four producer mappings. -/
+def repeatedCycles : Bool :=
+  let make := fun a b => IxIR0.Readdress.Group.mutual
+    [(a, .defn .shared (.lam .many (.ref b))),
+     (b, .defn .shared (.lam .many (.ref a)))]
+  let a := Address.replicate 0xb1
+  let b := Address.replicate 0xb2
+  let groups := [make first second, make a b]
+  match IxIR0.Readdress.run [] groups .erased with
+  | .error _ => false
+  | .ok result =>
+    match result.addressMap with
+    | [(old0, key0), (old1, key1), (old2, key2), (old3, key3)] =>
+      [old0, old1, old2, old3] == [first, second, a, b] &&
+        key0 == key2 && key1 == key3 && key0 != key1 &&
+        result.blocks.length == 2 && result.declarations.length == 4 &&
+        result.semanticAudit [] groups .erased
+    | _ => false
+
+end RepeatedErasureFixtures
+
+namespace AddressedErasureFixtures
+
+open Ix.Compiler
+open Ix.Compiler.Ixon
+
+def block : Address := Address.replicate 0x66
+def projection : Address := Address.replicate 0x67
+def result0 : Address := Address.replicate 0x68
+def result1 : Address := Address.replicate 0x69
+
+def definition0 : Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0) (.recur 1 #[]) (.nat 0) }
+
+def definition1 : Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0)
+      (.lam .many (.sort 0) (.recur 0 #[])) (.nat 1) }
+
+def blockConstant : Constant :=
+  { info := .muts #[.defn definition0, .defn definition1]
+    sharing := #[], refs := #[result0, result1], univs := #[] }
+
+def projectionConstant : Constant :=
+  { info := .dPrj { idx := 0, block }
+    sharing := #[], refs := #[], univs := #[] }
+
+def constants : List (Address × Constant) :=
+  [(block, blockConstant), (projection, projectionConstant)]
+
+def resolve : Address → Option Constant := fun address =>
+  (constants.find? fun entry => entry.1 == address).map (·.2)
+
+def eraseCtx : Erase.EraseCtx :=
+  { resolve
+    blobs := fun address =>
+      if address == result0 then some (.natB 71)
+      else if address == result1 then some (.natB 72)
+      else none }
+
+def old0 : Address := Address.memberAddr block 0
+def old1 : Address := Address.memberAddr block 1
+
+def expectedRaw : List (Address × IxIR0.Decl) :=
+  [(old0,
+      .defn .shared
+        (.letE .many (.ref old1) (.lit (.nat 71)))),
+   (old1,
+      .defn .shared
+        (.letE .many (.lam .many (.ref old0)) (.lit (.nat 72)))),
+   (projection, .defn .shared (.ref old0))]
+
+def built : Except EraseAddressed.Error EraseAddressed.Result :=
+  EraseAddressed.run eraseCtx constants (.ref projection) 200
+
+def expectedBlockHex : String :=
+  "6312e058809a62a40401b625ea5c0ded43148db937372bc8c6fa0d4fbd38bce2"
+def expectedMemberHexes : List String :=
+  ["4fcbdd06089faacd05289a959ad6ce05ac3281e70260f3a820a12f43f0b6c8d2",
+   "08618a2f9659ce402c41bdb5237b558318911ac27aa98041208e4d5ca9eda708"]
+
+def runtimeOk (result : EraseAddressed.Result) : Bool :=
+  let ctx : IxIR0.Ctx := { env := IxIR0.Env.ofList result.declarations }
+  match IxIR0.eval ctx 200 [] result.main with
+  | .ok (.lit (.nat 71)) => true
+  | _ => false
+
+/-- The certified pre-address context executes the legacy main, and the
+emitted context executes its exact address image. -/
+def transportRuntimeOk (result : EraseAddressed.Result) : Bool :=
+  let before := result.addressed.preAddressCtx result.groups
+  let after := result.addressed.addressedCtx
+  match before.run (.ref projection) 200, after.run result.main 200 with
+  | .ok (.lit (.nat 71)), .ok (.lit (.nat 71)) => true
+  | _, _ => false
+
+theorem semanticTransport (result : EraseAddressed.Result)
+    (hrun : built = .ok result) :
+    (result.addressed.addressedCtx).run result.main 200 =
+      IxIR0.Readdress.mapResult
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap)
+        ((result.addressed.preAddressCtx result.groups).run
+          (.ref projection) 200) := by
+  exact EraseAddressed.run_emptyOracle_semantics_of_run_eq_ok hrun 200
+
+def builtOk (result : EraseAddressed.Result) : Bool :=
+  let map := result.addressMap
+  let new0 := map.lookup old0
+  let new1 := map.lookup old1
+  result.raw == expectedRaw && result.groups.length == 2 &&
+    result.addressed.blocks.length == 1 && map.length == 2 &&
+    result.addressed.blockAddresses.map Address.toHex == [expectedBlockHex] &&
+    result.addressed.derivedAddresses.map Address.toHex == expectedMemberHexes &&
+    result.addressed.noTransientKeys &&
+    result.addressed.noTransientReferences &&
+    result.semanticAudit eraseCtx constants (.ref projection) 200 &&
+    (match new0, new1,
+        (IxIR0.Env.ofList result.declarations) projection with
+      | some address0, some address1,
+          some (.defn .shared (.ref projected)) =>
+          projected == address0 && address0 != old0 && address1 != old1
+      | _, _, _ => false) && runtimeOk result && transportRuntimeOk result
+
+/-- A local edge to another block's transient namespace cannot be given the
+meaning of an external stable address. -/
+def crossBlockTemporaryRejected : Bool :=
+  let tempA := Address.replicate 0xd1
+  let tempB := Address.replicate 0xd2
+  let groups : List IxIR0.Readdress.Group :=
+    [.mutual [(tempA, .defn .shared (.ref tempB))],
+     .mutual [(tempB, .defn .shared .erased)]]
+  match IxIR0.Readdress.run [] groups .erased with
+  | .error message =>
+      message == s!"cross-block reference uses another mutual block's temporary address {Address.toHex tempB}"
+  | .ok _ => false
+
+/-! The same genuine member cycle must cross the complete executable pipeline,
+where it becomes an IxIR₀ block and then a distinct IxIR₁ block. -/
+
+def pipelineDefinition0 : Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0) (.recur 1 #[]) (.sort 0) }
+
+def pipelineDefinition1 : Definition :=
+  { kind := .defn, safety := .safe, lvls := 0
+    typ := .sort 0
+    value := .letE false (.sort 0) (.recur 0 #[]) (.sort 0) }
+
+def pipelineBlockConstant : Constant :=
+  { info := .muts #[.defn pipelineDefinition0, .defn pipelineDefinition1]
+    sharing := #[], refs := #[], univs := #[] }
+
+def pipelineConstants : List (Address × Constant) :=
+  [(block, pipelineBlockConstant), (projection, projectionConstant)]
+
+/-- An unused, well-formed sharing entry selects the sharing-aware validator
+branch without changing erasure or target identity. -/
+def sharedPipelineBlockConstant : Constant :=
+  { pipelineBlockConstant with sharing := #[.sort 0] }
+
+def sharedPipelineConstants : List (Address × Constant) :=
+  [(block, sharedPipelineBlockConstant), (projection, projectionConstant)]
+
+def pipelineBuilt : Except Pipeline.Error Pipeline.Artifact :=
+  Pipeline.compile pipelineConstants projection
+
+def validatedPipelineBuilt : Except Pipeline.Error Pipeline.Artifact :=
+  Pipeline.compileValidated sharedPipelineConstants projection
+
+/-- The conservative sidecar attachment accepts this constructor-free cyclic
+program, validates the resulting IxIR₂ graph, and preserves its observable
+control-fuel divergence. -/
+def validatedIxIR2AttachmentOk : Bool :=
+  match Ix.Compiler.IxIR2.Pipeline.compileValidated
+      sharedPipelineConstants projection with
+  | .error _ => false
+  | .ok attached =>
+      let artifact := attached.target.artifact
+      let context := Ix.Compiler.IxIR2.Eval.Context.ofProgram
+        artifact.program artifact.validationContext.schemas
+      attached.sidecars.parameterEntries.length ==
+        attached.source.artifact.targetDecls.length &&
+        attached.sidecars.sourceNoReuse artifact.trace &&
+        attached.sidecars.tracePappsSafe artifact.trace &&
+        attached.sidecars.traceExactCaseTargetsMatch artifact.trace &&
+        !artifact.trace.positions.isEmpty &&
+        match Ix.Compiler.IxIR2.Eval.runMain context .logical
+            artifact.program 20 20 with
+        | .error .controlFuel => true
+        | _ => false
+
+def expectedTargetBlockHex : String :=
+  "3ecbe37b727c6fbe939db9fa01c4c9b3dfbbf376b2812d1b045546846a3715cb"
+
+def expectedTargetMapHexes : List String :=
+  ["eec1f36398b68ed5b253505079e260a21a8b3d6c148b4766a0cd9a00e93a6d9e",
+   "0e400d87105ce7a391d272bc3cb535598242ad2cb65e11dbf921571be985929a",
+   "d9fc41365f30d4397fdefd6626449cfae2d744bd21461aff8e3b7a82c482f412"]
+
+def pipelineOk (artifact : Pipeline.Artifact) : Bool :=
+  let finalKeys := artifact.targetDecls.map (Prod.fst)
+  let targetCtx : IxIR1.Ctx :=
+    { decls := (IxIR1.Env.Index.ofList artifact.targetDecls).toEnv }
+  match artifact.erasedAddressMap.lookup old0,
+      artifact.erasedAddressMap.lookup old1 with
+  | some erased0, some erased1 =>
+    match artifact.targetAddressMap.lookup erased0,
+        artifact.targetAddressMap.lookup erased1,
+        artifact.targetAddressMap.lookup projection with
+    | some target0, some target1, some targetProjection =>
+      artifact.erasedBlocks.length == 1 &&
+        artifact.targetBlocks.length == 1 &&
+        artifact.targetBlocks.map (Address.toHex ∘ (·.blockAddress)) ==
+          [expectedTargetBlockHex] &&
+        artifact.targetAddressMap.map (Address.toHex ∘ (·.2)) ==
+          expectedTargetMapHexes &&
+        artifact.targetAddressMap.length == 3 &&
+        artifact.targetDecls.length == 3 && target0 != erased0 &&
+        target1 != erased1 && targetProjection != projection &&
+        !finalKeys.contains old0 && !finalKeys.contains old1 &&
+        !finalKeys.contains erased0 && !finalKeys.contains erased1 &&
+        !finalKeys.contains projection &&
+        artifact.targetBlocks.any fun block =>
+          block.derivedAddresses.contains target0 &&
+            block.derivedAddresses.contains target1 &&
+        match IxIR1.runMain targetCtx artifact.main 200 with
+        | .error .fuel => true
+        | _ => false
+    | _, _, _ => false
+  | _, _ => false
+
+def targetDeclsEq : List (Address × IxIR1.Decl) →
+    List (Address × IxIR1.Decl) → Bool
+  | [], [] => true
+  | left :: leftRest, right :: rightRest =>
+      left.1 == right.1 &&
+        IxIR1.Readdress.Decl.structurallyEq left.2 right.2 &&
+        targetDeclsEq leftRest rightRest
+  | _, _ => false
+
+def validatedPipelineAgrees (direct gated : Pipeline.Artifact) : Bool :=
+  direct.rawErasedDecls == gated.rawErasedDecls &&
+    direct.erasedDecls == gated.erasedDecls &&
+    direct.erasedAddressMap == gated.erasedAddressMap &&
+    targetDeclsEq direct.targetDecls gated.targetDecls &&
+    direct.targetAddressMap == gated.targetAddressMap &&
+    direct.targetBlocks.map (·.blockAddress) ==
+      gated.targetBlocks.map (·.blockAddress) &&
+    pipelineOk gated
+
+end AddressedErasureFixtures
+
+namespace IxIR1OwnedMainFixtures
+
+open Ix.Compiler
+open Ix.Compiler.IxIR1
+
+def constructor : CtorId :=
+  { block := Address.replicate 0xc7, indIdx := 0, cidx := 0 }
+
+def uniqueMain : Code :=
+  .letOp (.alloc .unique constructor #[]) (.ret (.var 0))
+
+def mismatchedMain : Code :=
+  .letOp (.alloc .shared constructor #[]) (.ret (.var 0))
+
+def nestedReuse : Code :=
+  .case .erased false #[
+    .mk 0 0 (.letOp (.reuse .erased constructor #[]) (.ret (.var 0)))]
+
+/-- `runOwnedMain` both accepts the declared unique result and rejects a live
+shared location at that boundary. -/
+def ownedBoundaryOk : Bool :=
+  let context : Ctx := { decls := Env.empty }
+  match runOwnedMain context .unique uniqueMain 4,
+      runOwnedMain context .unique mismatchedMain 4 with
+  | .ok (store, .loc location),
+      .error (.mem "function result ownership mismatch") =>
+      match store.get? location with
+      | some box => box.world == .unique
+      | none => false
+  | _, _ => false
+
+/-- The executable no-reuse reflection walk reaches nested case bodies and
+finite declaration lists. -/
+def noReuseChecksOk : Bool :=
+  NoReuse.checkCode uniqueMain && !NoReuse.checkCode nestedReuse &&
+    NoReuse.checkDeclarations
+      [(Address.replicate 0xc8,
+        .fn ⟨0, .unique, false, uniqueMain⟩)] &&
+    !NoReuse.checkDeclarations
+      [(Address.replicate 0xc9,
+        .fn ⟨0, .shared, false, nestedReuse⟩)]
+
+end IxIR1OwnedMainFixtures
+
+namespace IxIR2PipelineFixtures
+
+open Ix.Compiler
+open Ix.Compiler.Ixon
+
+def constructorBlockA : Address := Address.replicate 0xb1
+def constructorBlockB : Address := Address.replicate 0xb2
+
+def constructorA : IxIR2.CtorId :=
+  { block := constructorBlockA, indIdx := 0, cidx := 0 }
+
+def constructorB : IxIR2.CtorId :=
+  { block := constructorBlockB, indIdx := 0, cidx := 0 }
+
+def ambiguousInput : IxIR2.Lower.Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .shared constructorA #[.lit (.nat 9)])
+        (.letOp (.fetch (.var 0) 0) (.ret (.var 1)))
+    mainResult := .shared }
+
+def ambiguousSidecars : IxIR2.Pipeline.Sidecars :=
+  { input := ambiguousInput
+    parameterEntries := []
+    constructors :=
+      [{ identity := constructorA, arity := 1 },
+       { identity := constructorB, arity := 1 }] }
+
+/-- Global constructor ambiguity no longer blocks a projection whose lexical
+producer is an exact local allocation. -/
+def ambiguousFetchAcceptedByProducerFact : Bool :=
+  match IxIR2.Lower.lowerChecked ambiguousSidecars.context ambiguousInput with
+  | .error _ => false
+  | .ok checked =>
+      let context := IxIR2.Eval.Context.ofProgram checked.artifact.program
+        checked.artifact.validationContext.schemas
+      checked.artifact.trace.fetchCapabilitiesMatch &&
+        ambiguousSidecars.traceExactFetchesMatch checked.artifact.trace &&
+        match IxIR2.Eval.runMain context .logical checked.artifact.program 8 2 with
+        | .ok result =>
+            match result.value with
+            | .loc _ => result.store.live == 1
+            | _ => false
+        | .error _ => false
+
+def ambiguousCaseInput : IxIR2.Lower.Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .shared constructorA #[.lit (.nat 9)])
+        (.case (.var 0) false
+          #[.mk 0 1
+            (.letOp (.drop (.var 1)) (.ret (.lit (.nat 9))))])
+    mainResult := .shared }
+
+def ambiguousCaseSidecars : IxIR2.Pipeline.Sidecars :=
+  { ambiguousSidecars with input := ambiguousCaseInput }
+
+/-- Exact path-local HPT provenance also disambiguates a constructor switch.
+The independent trace check certifies that the selected identity occurs in
+the emitted terminator, and execution takes that branch successfully. -/
+def ambiguousCaseAcceptedByProducerFact : Bool :=
+  match IxIR2.Lower.lowerChecked ambiguousCaseSidecars.context
+      ambiguousCaseInput with
+  | .error _ => false
+  | .ok checked =>
+      let context := IxIR2.Eval.Context.ofProgram checked.artifact.program
+        checked.artifact.validationContext.schemas
+      ambiguousCaseSidecars.traceExactCaseTargetsMatch
+          checked.artifact.trace &&
+        match IxIR2.Eval.runMain context .logical checked.artifact.program 16 4 with
+        | .ok result =>
+            result.value == .lit (.nat 9) && result.store.live == 0
+        | .error _ => false
+
+def unresolvedFetcher : Address := Address.replicate 0xba
+
+def unresolvedFetchInput : IxIR2.Lower.Input :=
+  { declarations :=
+      [(unresolvedFetcher,
+        .fn
+          { arity := 1
+            result := .shared
+            papSafe := true
+            body :=
+              .letOp (.fetch (.var 0) 0) (.ret (.var 0)) })]
+    main :=
+      .letOp (.alloc .shared constructorA #[.lit (.nat 9)])
+        (.letOp (.call unresolvedFetcher #[.var 0]) (.ret (.var 0)))
+    mainResult := .shared }
+
+def unresolvedFetchSidecars : IxIR2.Pipeline.Sidecars :=
+  { input := unresolvedFetchInput
+    parameterEntries := [(unresolvedFetcher, #[.shared])]
+    constructors :=
+      [{ identity := constructorA, arity := 1 },
+       { identity := constructorB, arity := 1 }] }
+
+/-- An unrefined function parameter remains ambiguous and fails closed. -/
+def unresolvedFetchRejected : Bool :=
+  match IxIR2.Lower.lowerChecked unresolvedFetchSidecars.context
+      unresolvedFetchInput with
+  | .error (.schema _ _) => true
+  | _ => false
+
+def scalarConstructorA : IxIR2.CtorId :=
+  { block := Address.replicate 0xbb, indIdx := 0, cidx := 0 }
+
+def scalarConstructorB : IxIR2.CtorId :=
+  { block := Address.replicate 0xbc, indIdx := 0, cidx := 0 }
+
+def ambiguousScalarFreeInput : IxIR2.Lower.Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .unique scalarConstructorA #[])
+        (.letOp (.free (.var 0)) (.ret (.lit (.nat 4))))
+    mainResult := .shared }
+
+def ambiguousScalarFreeSidecars : IxIR2.Pipeline.Sidecars :=
+  { input := ambiguousScalarFreeInput
+    parameterEntries := []
+    constructors :=
+      [{ identity := scalarConstructorA, arity := 0 },
+       { identity := scalarConstructorB, arity := 0 }] }
+
+/-- The same exact-producer rule disambiguates a shallow unique free and the
+logical machine observes an empty live heap afterward. -/
+def ambiguousScalarFreeAcceptedByProducerFact : Bool :=
+  match IxIR2.Lower.lowerChecked ambiguousScalarFreeSidecars.context
+      ambiguousScalarFreeInput with
+  | .error _ => false
+  | .ok checked =>
+      let context := IxIR2.Eval.Context.ofProgram checked.artifact.program
+        checked.artifact.validationContext.schemas
+      ambiguousScalarFreeSidecars.traceScalarLeavesMatch
+          checked.artifact.trace &&
+        match IxIR2.Eval.runMain context .logical checked.artifact.program 8 2 with
+        | .ok result =>
+            result.value == .lit (.nat 4) && result.store.live == 0
+        | .error _ => false
+
+def pappTarget : Address := Address.replicate 0xbd
+
+def pappInput : IxIR2.Lower.Input :=
+  { declarations :=
+      [(pappTarget,
+        .fn
+          { arity := 2
+            result := .shared
+            papSafe := true
+            body :=
+              .letOp (.drop (.var 0))
+                (.letOp (.drop (.var 2)) (.ret (.lit (.nat 0)))) })]
+    main :=
+      .letOp (.papp pappTarget #[.lit (.nat 7)]) (.ret (.var 0))
+    mainResult := .shared }
+
+def pappSidecars : IxIR2.Pipeline.Sidecars :=
+  { input := pappInput
+    parameterEntries := [(pappTarget, #[.shared, .shared])]
+    constructors := [] }
+
+/-- Checked function-PAP lowering records the exact shared capture transition
+and the logical machine retains precisely the fresh PAP owner. -/
+def pappCapabilityTransitionAccepted : Bool :=
+  match IxIR2.Lower.lowerChecked pappSidecars.context pappInput with
+  | .error _ => false
+  | .ok checked =>
+      let emittedPapp :=
+        match checked.artifact.program.main.blocks[0]? with
+        | some block =>
+            block.instructions[0]? ==
+              some (.papp pappTarget #[.lit (.nat 7)])
+        | none => false
+      let context := IxIR2.Eval.Context.ofProgram checked.artifact.program
+        checked.artifact.validationContext.schemas
+      emittedPapp &&
+        pappSidecars.tracePappsSafe checked.artifact.trace &&
+        checked.artifact.trace.allocationCapabilitiesMatch &&
+        match IxIR2.Eval.runMain context .logical checked.artifact.program 4 1 with
+        | .ok result =>
+            match result.value with
+            | .loc location =>
+                result.store.live == 1 &&
+                  match result.store.get? location with
+                  | some box =>
+                      box.world == .shared && box.rc == 1 &&
+                        match box.node with
+                        | .papN address arity arguments =>
+                            address == pappTarget && arity == 2 &&
+                              arguments == #[.lit (.nat 7)]
+                        | _ => false
+                  | none => false
+            | _ => false
+        | .error _ => false
+
+def unsafePappInput : IxIR2.Lower.Input :=
+  { pappInput with
+    declarations :=
+      [(pappTarget,
+        .fn
+          { arity := 2
+            result := .shared
+            papSafe := false
+            body :=
+              .letOp (.drop (.var 0))
+                (.letOp (.drop (.var 2)) (.ret (.lit (.nat 0)))) })] }
+
+def unsafePappSidecars : IxIR2.Pipeline.Sidecars :=
+  { pappSidecars with input := unsafePappInput }
+
+/-- The attachment-side trace check fails closed if the exact declaration
+environment no longer marks a retained `papp` target safe. -/
+def pappSafetyCheckRejectsUnsafe : Bool :=
+  match IxIR2.Lower.lowerChecked pappSidecars.context pappInput with
+  | .error _ => false
+  | .ok checked =>
+      !unsafePappSidecars.tracePappsSafe checked.artifact.trace
+
+def retiredBorrowInput : IxIR2.Lower.Input :=
+  { declarations := []
+    main :=
+      .letOp (.alloc .shared constructorA #[.lit (.nat 9)])
+        (.letOp (.fetch (.var 0) 0)
+          (.letOp (.drop (.var 1)) (.ret (.lit (.nat 4)))))
+    mainResult := .shared }
+
+def retiredBorrowSidecars : IxIR2.Pipeline.Sidecars :=
+  { input := retiredBorrowInput
+    parameterEntries := []
+    constructors := [{ identity := constructorA, arity := 1 }] }
+
+/-- Consuming an owner after its loan's final use retires both the owner and
+the validator-dead borrow in the producer continuation. -/
+def lenderDestructionRetiresBorrow : Bool :=
+  match IxIR2.Lower.lowerChecked retiredBorrowSidecars.context
+      retiredBorrowInput with
+  | .error _ => false
+  | .ok checked =>
+      let retired := checked.artifact.trace.positions.any fun position =>
+        position.source.owner == IxIR2.Validate.Owner.main &&
+          position.source.offset == 3 &&
+          position.sourceCapabilities ==
+            #[.scalar, .dead, .dead]
+      let context := IxIR2.Eval.Context.ofProgram checked.artifact.program
+        checked.artifact.validationContext.schemas
+      checked.artifact.trace.destructionCapabilitiesMatch && retired &&
+        match IxIR2.Eval.runMain context .logical checked.artifact.program 6 2 with
+        | .ok result =>
+            result.value == .lit (.nat 4) && result.store.live == 0
+        | .error _ => false
+
+def recursorOwner : Address := Address.replicate 0xb3
+def recursorGroupA : Address := Address.replicate 0xb4
+def recursorGroupB : Address := Address.replicate 0xb5
+
+def caseConstructorA : IxIR2.CtorId :=
+  { block := Address.replicate 0xb6, indIdx := 0, cidx := 0 }
+
+def caseConstructorB : IxIR2.CtorId :=
+  { block := Address.replicate 0xb7, indIdx := 0, cidx := 0 }
+
+def exactRecursorInput : IxIR2.Lower.Input :=
+  { declarations :=
+      [(recursorOwner,
+        .fn
+          { arity := 1
+            result := .shared
+            papSafe := true
+            body :=
+              .case (.var 0) false #[
+                .mk 0 0
+                  (.letOp (.drop (.var 0))
+                    (.ret (.lit (.nat 3))))] })]
+    main :=
+      .letOp (.alloc .shared caseConstructorA #[])
+        (.letOp (.call recursorOwner #[.var 0]) (.ret (.var 0)))
+    mainResult := .shared }
+
+def residualRecursorInput : IxIR2.Lower.Input :=
+  { exactRecursorInput with
+    main :=
+      .letOp (.alloc .shared caseConstructorB #[])
+        (.letOp (.call recursorOwner #[.var 0]) (.ret (.var 0))) }
+
+def exactRecursorSidecars : IxIR2.Pipeline.Sidecars :=
+  { input := exactRecursorInput
+    parameterEntries := [(recursorOwner, #[.shared])]
+    constructors :=
+      [{ identity := caseConstructorA
+         arity := 0
+         group := some recursorGroupA },
+       { identity := caseConstructorB
+         arity := 0
+         group := some recursorGroupB }]
+    recursorOrigins :=
+      [{ owner := recursorOwner, group := recursorGroupA }] }
+
+/-- A recursor parameter whose HPT fact remains ambiguous is lowered with
+both producer-known full identities sharing its erased tag/arity.  Executing
+the same checked branch with either constructor demonstrates that residual
+coverage no longer guesses one mutual-block identity. -/
+def exactRecursorCaseAccepted : Bool :=
+  let accepts := fun input =>
+    let sidecars := { exactRecursorSidecars with input := input }
+    match IxIR2.Lower.lowerChecked sidecars.context input with
+    | .error _ => false
+    | .ok checked =>
+        let declaration := checked.artifact.program.declarations.find? fun entry =>
+          entry.1 == recursorOwner
+        let coveredSwitch := match declaration with
+          | some (_, .fn definition) =>
+              match definition.blocks[0]? with
+              | some block =>
+                  match block.terminator with
+                  | .switchValue _ constructors _ =>
+                      constructors.size == 2 &&
+                        constructors.any (fun target =>
+                          target.cid == caseConstructorA) &&
+                        constructors.any (fun target =>
+                          target.cid == caseConstructorB)
+                  | _ => false
+              | none => false
+          | _ => false
+        let context := IxIR2.Eval.Context.ofProgram checked.artifact.program
+          checked.artifact.validationContext.schemas
+        coveredSwitch &&
+          sidecars.traceResidualCaseTargetsMatch checked.artifact.trace &&
+          sidecars.traceConstructorsKnown checked.artifact.trace &&
+          match IxIR2.Eval.runMain context .logical checked.artifact.program
+              8 2 with
+          | .ok result =>
+              result.value == .lit (.nat 3) && result.store.live == 0
+          | .error _ => false
+  accepts exactRecursorInput && accepts residualRecursorInput
+
+def recursorSourceA : Address := Address.replicate 0xb8
+def recursorSourceB : Address := Address.replicate 0xb9
+
+def sourceRecursor : IxIR0.Decl :=
+  .recursor 0 false #[{ fields := 0, rhs := .lit (.nat 3) }]
+
+def sourceRecursorFn : IxIR1.Decl :=
+  .fn
+    { arity := 1
+      result := .shared
+      papSafe := true
+      body :=
+        .case (.var 0) false #[
+          .mk 0 0
+            (.letOp (.drop (.var 0)) (.ret (.lit (.nat 3))))] }
+
+def originBlock (group source constructor : Address) :
+    IxIR0.MutualBlock.Result :=
+  { blockAddress := group
+    blockMembers := []
+    members := [(source, sourceRecursor), (constructor, .ctor 0 0)]
+    addressMap := [] }
+
+/-- The production extractor follows the complete final owner map, and rejects
+two distinct mutual-block origins collapsed onto one IxIR₁ identity. -/
+def recursorOriginExtractionOk : Bool :=
+  let sourceA :=
+    [(recursorSourceA, sourceRecursor),
+     (caseConstructorA.block, IxIR0.Decl.ctor 0 0)]
+  let blockA := originBlock recursorGroupA recursorSourceA
+    caseConstructorA.block
+  let exact := IxIR2.Pipeline.deriveRecursorOrigins sourceA [blockA]
+    [(recursorSourceA, sourceRecursorFn)]
+    [(recursorSourceA, recursorOwner)]
+  let sourceBoth := sourceA ++
+    [(recursorSourceB, sourceRecursor),
+     (caseConstructorB.block, IxIR0.Decl.ctor 0 0)]
+  let blockB := originBlock recursorGroupB recursorSourceB
+    caseConstructorB.block
+  let conflict := IxIR2.Pipeline.deriveRecursorOrigins sourceBoth
+    [blockA, blockB]
+    [(recursorSourceA, sourceRecursorFn),
+     (recursorSourceB, sourceRecursorFn)]
+    [(recursorSourceA, recursorOwner),
+     (recursorSourceB, recursorOwner)]
+  let exactOk := match exact with
+    | .ok [origin] =>
+        origin.owner == recursorOwner && origin.group == recursorGroupA
+    | _ => false
+  exactOk &&
+    match conflict with
+    | .error (.recursorOriginConflict owner) => owner == recursorOwner
+    | _ => false
+
+end IxIR2PipelineFixtures
+
+namespace ReaddressOracleFixtures
+
+open Ix.Compiler
+open Ix.Compiler.Ixon
+
+def legacyKey : Address := Address.replicate 0xe1
+def addressedKey : Address := Address.replicate 0xe2
+
+def mapping : IxIR0.MutualBlock.Renaming :=
+  [(legacyKey, addressedKey)]
+
+/-- A representative address-insensitive scalar ABI. Its result depends only
+on argument count, so structurally mapping argument values cannot change the
+legacy answer. -/
+def lengthOracle : IxIR0.Oracle := fun _ arguments =>
+  if arguments.length == 2 then some (.lit (.nat 37)) else none
+
+theorem lengthOracle_readdressable :
+    IxIR0.Readdress.Oracle.Readdressable mapping lengthOracle := by
+  apply IxIR0.Readdress.Oracle.Readdressable.of_key_and_arguments
+  · intro address arguments
+    rfl
+  · intro address arguments
+    simp [lengthOracle]
+
+/-- Key-sensitive stand-in for a legacy opaque member. It intentionally knows
+only the transient key; the executable adapter supplies the final-key view. -/
+def legacyKeyOracle : IxIR0.Oracle := fun address arguments =>
+  if address == legacyKey && arguments.length == 2 then
+    some (.ctor legacyKey 7 [])
+  else none
+
+def adapterOk : Bool :=
+  let arguments : List IxIR0.Value := [.erased, .lit (.nat 5)]
+  let addressed :=
+    IxIR0.Readdress.Oracle.readdress mapping legacyKeyOracle
+  match legacyKeyOracle addressedKey arguments,
+      addressed addressedKey arguments,
+      addressed addressedKey [.erased] with
+  | none, some (.ctor resultKey 7 []), none => resultKey == addressedKey
+  | _, _, _ => false
+
+/-! A real mutual block whose executable path calls the modeled Nat-add ABI.
+The back-edge sits beneath a lambda, so the static graph is cyclic while the
+selected call terminates with the contentful ledger answer. -/
+
+def cycleLeft : Address := Address.replicate 0xe6
+def cycleRight : Address := Address.replicate 0xe7
+
+def cycleLeftDecl : IxIR0.Decl :=
+  .defn .shared (.lam .many
+    (.letE .many (.ref cycleRight)
+      (.app (.app (.ref IxIR0.Examples.natAddExt) (.lit (.nat 20)))
+        (.lit (.nat 22)))))
+
+def cycleRightDecl : IxIR0.Decl :=
+  .defn .shared (.lam .many
+    (.letE .many (.ref cycleLeft) (.lit (.nat 0))))
+
+def ledgerMembers : List (Address × IxIR0.Decl) :=
+  [(cycleLeft, cycleLeftDecl), (cycleRight, cycleRightDecl)]
+
+def ledgerGroups : List IxIR0.Readdress.Group :=
+  [.mutual ledgerMembers,
+   .stable [(IxIR0.Examples.natAddExt, .extern 2)]]
+
+def ledgerMain : IxIR0.Expr :=
+  .app (.ref cycleLeft) .erased
+
+def ledgerBuilt : Except String IxIR0.Readdress.Result :=
+  IxIR0.Readdress.run [] ledgerGroups ledgerMain
+
+def expectedLedgerBlock : String :=
+  "521738161fb5195ac8a994d6386a6851253d826624abb4b6e3e398979e32a276"
+
+def expectedLedgerMembers : List String :=
+  ["f4598bb11abeed019d5dd722ca8f185a6ee2f7f9e6b6ef4c18d06d047f482396",
+   "de3b531d467cbdfe5a8ebdd90c2d7a40e3c495fac9241dcf5608862a8b67ee8c"]
+
+theorem ledgerOracleReaddressable (result : IxIR0.Readdress.Result)
+    (hrun : ledgerBuilt = .ok result) :
+    IxIR0.Readdress.Oracle.Readdressable result.addressMap
+      IxIR0.Examples.oracle := by
+  apply IxIR0.Readdress.Oracle.Readdressable.examples_of_run_eq_ok
+    (by simpa [ledgerBuilt] using hrun)
+  simp [IxIR0.Readdress.oracleIdentities, ledgerGroups,
+    IxIR0.Readdress.stableKeys]
+
+theorem ledgerCycleTransport (result : IxIR0.Readdress.Result)
+    (hrun : ledgerBuilt = .ok result) :
+    (result.addressedCtx
+        (IxIR0.Readdress.Oracle.readdress result.addressMap
+          IxIR0.Examples.oracle)).run result.main 200 =
+      IxIR0.Readdress.mapResult
+        (IxIR0.MutualBlock.Renaming.apply result.addressMap)
+        ((result.preAddressCtx ledgerGroups IxIR0.Examples.oracle).run
+          ledgerMain 200) := by
+  exact result.run_readdressOracle_of_run_eq_ok
+    (by simpa [ledgerBuilt] using hrun) IxIR0.Examples.oracle
+    (ledgerOracleReaddressable result hrun) 200
+
+def ledgerCycleOk (result : IxIR0.Readdress.Result) : Bool :=
+  let before := result.preAddressCtx ledgerGroups IxIR0.Examples.oracle
+  let after := result.addressedCtx
+    (IxIR0.Readdress.Oracle.readdress result.addressMap
+      IxIR0.Examples.oracle)
+  result.blocks.length == 1 && result.addressMap.length == 2 &&
+    result.blockAddresses.map Address.toHex == [expectedLedgerBlock] &&
+    result.derivedAddresses.map Address.toHex == expectedLedgerMembers &&
+    IxIR0.Readdress.Renaming.isolates result.addressMap
+      IxIR0.Examples.natAddExt &&
+    match before.run ledgerMain 200, after.run result.main 200 with
+    | .ok (.lit (.nat 42)), .ok (.lit (.nat 42)) => true
+    | _, _ => false
+
+/-- Main-code external identities participate in the same no-capture check as
+declaration references. -/
+def mainExternalCaptureRejected : Bool :=
+  match IxIR0.MutualBlock.run [IxIR0.Examples.natAddExt] ledgerMembers with
+  | .error _ => false
+  | .ok block =>
+    match block.derivedAddresses with
+    | captured :: _ =>
+      match IxIR0.Readdress.run [IxIR0.Examples.natAddExt]
+          [.mutual ledgerMembers] (.ref captured) with
+      | .error message =>
+        message == s!"derived mutual-member key captures a program external reference {Address.toHex captured}"
+      | .ok _ => false
+    | [] => false
+
+end ReaddressOracleFixtures
+
+namespace HPTFixtures
+
+open Ix.Compiler
+open Ix.Compiler.Ixon
+
+def rawExtern : Address := Address.replicate 0xd0
+def rawTarget : Address := Address.replicate 0xd1
+def rawCaller : Address := Address.replicate 0xd2
+def rawConstructor : Address := Address.replicate 0xd3
+def rawCycleLeft : Address := Address.replicate 0xd4
+def rawCycleRight : Address := Address.replicate 0xd5
+def constructorBlock : Address := Address.replicate 0xda
+
+def constructorId : IxIR1.CtorId := ⟨constructorBlock, 0, 0⟩
+
+def targetDeclaration : IxIR1.Decl :=
+  .fn ⟨2, .shared, true, .ret (.lit (.nat 42))⟩
+
+def callerDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.papp rawTarget #[.lit (.nat 20)])
+      (.letOp (.apply (.var 0) #[.lit (.nat 22)])
+        (.ret (.var 0)))⟩
+
+def constructorDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.alloc .shared constructorId #[.lit (.nat 7)])
+      (.ret (.var 0))⟩
+
+def cycleLeftDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call rawCycleRight #[]) (.ret (.var 0))⟩
+
+def cycleRightDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .case (.lit (.nat 0)) true #[
+      .mk 0 0
+        (.letOp (.alloc .shared constructorId #[.lit (.nat 7)])
+          (.letOp (.fetch (.var 0) 0) (.ret (.var 0)))),
+      .mk 1 1 (.letOp (.call rawCycleLeft #[]) (.ret (.var 0)))]⟩
+
+def rawDeclarations : List (Address × IxIR1.Decl) :=
+  [(rawCaller, callerDeclaration),
+   (rawTarget, targetDeclaration),
+   (rawConstructor, constructorDeclaration),
+   (rawCycleLeft, cycleLeftDeclaration),
+   (rawCycleRight, cycleRightDeclaration),
+   (rawExtern, .extern 2)]
+
+def rawMain : IxIR1.Code :=
+  .letOp (.call rawCaller #[]) (.ret (.var 0))
+
+def addressed : Except String IxIR1.ReaddressAll.Result :=
+  IxIR1.ReaddressAll.run [constructorBlock] rawDeclarations rawMain
+
+def finalAddress (result : IxIR1.ReaddressAll.Result)
+    (raw : Address) : Address :=
+  IxIR1.Readdress.Renaming.apply result.addressMap raw
+
+def programIdentity : IxIR1.ReaddressAll.Artifact → Address
+  | .stable address _ | .ordinary address _ => address
+  | .mutual block => block.blockAddress
+
+def detailedConstructorFact : IxIR1.HPT.Fact :=
+  IxIR1.HPT.Fact.heap
+    (.ctor constructorId (some [IxIR1.HPT.FieldFact.scalar]))
+
+def factFor (result : IxIR1.ReaddressAll.Result)
+    (targetFact callerFact : IxIR1.HPT.Fact)
+    (address : Address) : IxIR1.HPT.Fact :=
+  if address == finalAddress result rawTarget then
+    targetFact
+  else if address == finalAddress result rawCaller then
+    callerFact
+  else if address == finalAddress result rawConstructor then
+    detailedConstructorFact
+  else
+    IxIR1.HPT.Fact.scalar
+
+def certificate (result : IxIR1.ReaddressAll.Result)
+    (targetFact callerFact : IxIR1.HPT.Fact) : IxIR1.HPT.Certificate :=
+  ⟨result.artifacts.map fun artifact =>
+    { programIdentity := programIdentity artifact
+      members := artifact.declarations.map fun member =>
+        (member.1, factFor result targetFact callerFact member.1) }⟩
+
+def preciseCertificate (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  certificate result .scalar .scalar
+
+def widenedCertificate (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  certificate result .top .top
+
+def precise (result : IxIR1.ReaddressAll.Result) :
+    Except String IxIR1.HPT.Result :=
+  IxIR1.HPT.run result.artifacts (preciseCertificate result)
+
+def widened (result : IxIR1.ReaddressAll.Result) :
+    Except String IxIR1.HPT.Result :=
+  IxIR1.HPT.run result.artifacts (widenedCertificate result)
+
+def expectedCacheKeys : List String :=
+  ["aa0edd4e751dcf06272bc2732dececb251cbfe069f938cfc2714e3954699692d",
+   "e25e2f1ac5d876e00bb1a500896fcc6c9f08a463c2a116b847e759c9ea66e6cd",
+   "0425d4800a33f31155d461ebb7c42fd1c5f98ba7a13ef22012236c779ef841c3",
+   "49e96f64307e0b092fcf7d0d80ebc8b3954fcf7394bb4d6183962bf6c5df7e7a",
+   "b3545b3b84a80b48985948ce2cf695100997782b53b9ee6047f2a7fdc02e10f5"]
+
+def expectedSummaryAddresses : List String :=
+  ["e63bfc3574ff2dcc567f40c08742b392872cff5727191ab69bd21e312b2c26d8",
+   "0440bda2b04538bf529aacced15dcdd26251d749476daef6f03a63d88fc7cc5c",
+   "9e0beee98136479c7a2c8d2389210fd6087659790709963646dd1a9a519ac164",
+   "8c2eae674fa8fe6efab7f98d5f94462e7c678fd76298a87f2b379a95e1cdca8b",
+   "ce6e76ed9c44e92f8a659583dfb8461241f8e9dd6d937a30fc1b9d5a96d18994"]
+
+def findSummary (analysis : IxIR1.HPT.Result) (function : Address) :
+    Option IxIR1.HPT.Artifact :=
+  analysis.artifacts.find? fun artifact =>
+    artifact.members.any fun member => member.1 == function
+
+def cacheConeOk (program : IxIR1.ReaddressAll.Result)
+    (preciseResult widenedResult : IxIR1.HPT.Result) : Bool :=
+  let target := finalAddress program rawTarget
+  let caller := finalAddress program rawCaller
+  let constructor := finalAddress program rawConstructor
+  match findSummary preciseResult target, findSummary widenedResult target,
+      findSummary preciseResult caller, findSummary widenedResult caller,
+      findSummary preciseResult constructor,
+      findSummary widenedResult constructor with
+  | some preciseTarget, some widenedTarget,
+      some preciseCaller, some widenedCaller,
+      some preciseConstructor, some widenedConstructor =>
+      preciseTarget.cacheKey == widenedTarget.cacheKey &&
+        preciseTarget.address != widenedTarget.address &&
+        preciseCaller.cacheKey != widenedCaller.cacheKey &&
+        preciseCaller.dependencies.contains preciseTarget.address &&
+        widenedCaller.dependencies.contains widenedTarget.address &&
+        preciseConstructor.cacheKey == widenedConstructor.cacheKey &&
+        preciseConstructor.address == widenedConstructor.address &&
+        preciseResult.artifacts.filter (fun artifact =>
+          artifact.kind == .mutual) ==
+          widenedResult.artifacts.filter (fun artifact =>
+            artifact.kind == .mutual)
+  | _, _, _, _, _, _ => false
+
+def cacheBytes (store : IxIR1.HPT.Cache.Store) : Nat :=
+  store.entries.foldl (fun total entry => total + entry.2.size) 0
+
+def cacheMaxEntryBytes (store : IxIR1.HPT.Cache.Store) : Nat :=
+  store.entries.foldl (fun largest entry => max largest entry.2.size) 0
+
+def cacheIsError {ε α : Type} : Except ε α → Bool
+  | .error _ => true
+  | .ok _ => false
+
+def cacheCodecOk (analysis : IxIR1.HPT.Result) : Bool :=
+  analysis.artifacts.all fun artifact =>
+    match IxIR1.HPT.Cache.decodeArtifact
+        (IxIR1.HPT.Cache.encodeArtifact artifact) with
+    | .ok decoded => decoded == artifact
+    | .error _ => false
+
+private def cacheStoreEntryBytes (entry : Address × ByteArray) : ByteArray :=
+  IxIR.Encoding.address entry.1 ++ IxIR.Encoding.blob entry.2
+
+def cacheStoreCodecOk (analysis : IxIR1.HPT.Result) : Bool :=
+  let store := IxIR1.HPT.Cache.Store.ofResult analysis
+  let canonical := store.canonicalize
+  let encoded := IxIR1.HPT.Cache.encodeStore store
+  let bytes := cacheBytes store
+  let limits : IxIR1.HPT.Cache.Limits :=
+    { maxEntries := store.entries.length
+      maxEntryBytes := cacheMaxEntryBytes store
+      maxBytes := bytes
+      maxWriteBytes := bytes
+      maxStoreBytes := encoded.size }
+  let reversedBytes := IxIR1.HPT.Cache.storeDomain ++
+    IxIR.Encoding.list cacheStoreEntryBytes canonical.entries.reverse
+  match IxIR1.HPT.Cache.prepareStoreWith limits store,
+      IxIR1.HPT.Cache.encodeStoreWith limits store,
+      IxIR1.HPT.Cache.decodeStoreWith limits encoded with
+  | .ok prepared, .ok checkedBytes, .ok decoded =>
+      prepared == canonical &&
+        prepared.framedSize == encoded.size &&
+        checkedBytes == encoded &&
+        decoded == canonical &&
+        IxIR1.HPT.Cache.encodeStore ⟨store.entries.reverse⟩ == encoded &&
+        cacheIsError (IxIR1.HPT.Cache.decodeStoreWith limits
+          (encoded ++ ByteArray.mk #[0])) &&
+        cacheIsError (IxIR1.HPT.Cache.decodeStoreWith limits reversedBytes) &&
+        cacheIsError (IxIR1.HPT.Cache.encodeStoreWith
+          { limits with maxEntryBytes := limits.maxEntryBytes - 1 } store) &&
+        cacheIsError (IxIR1.HPT.Cache.decodeStoreWith
+          { limits with maxStoreBytes := encoded.size - 1 } encoded)
+  | _, _, _ => false
+
+/-- Count and coordinate numerals are rejected at their bounded canonical
+width, before the generic decoder could construct an oversized `Nat`. -/
+def cacheBoundedNumeralOk (analysis : IxIR1.HPT.Result) : Bool :=
+  let overlongStoreCount := IxIR1.HPT.Cache.storeDomain ++
+    ByteArray.mk #[128, 0]
+  let countLimits : IxIR1.HPT.Cache.Limits := { maxEntries := 0 }
+  let coordinateLimits : IxIR1.HPT.Cache.Limits :=
+    { producer := { checker := { maxShapeIndex := 0 } } }
+  cacheIsError (IxIR1.HPT.Cache.decodeStoreWith countLimits
+      overlongStoreCount) &&
+    match analysis.artifacts with
+    | [] => false
+    | artifact :: _ =>
+        match artifact.members with
+        | [] => false
+        | member :: members =>
+            let fact : IxIR1.HPT.Fact :=
+              { mayScalar := false
+                unknownHeap := false
+                shapes := [.pap member.1 1] }
+            let oversized : IxIR1.HPT.Artifact :=
+              { artifact with members := (member.1, fact) :: members }
+            cacheIsError (IxIR1.HPT.Cache.decodeArtifactWith
+              coordinateLimits (IxIR1.HPT.Cache.encodeArtifact oversized))
+
+/-- Cold production, exact warm hits, malformed-record recovery, and a
+dependency-cone rekey all cross the persistent-cache scheduler. -/
+def persistentCacheOk (program : IxIR1.ReaddressAll.Result)
+    (preciseResult widenedResult : IxIR1.HPT.Result) : Bool :=
+  let empty : IxIR1.HPT.Cache.Store := ⟨[]⟩
+  match IxIR1.HPT.Cache.run program.artifacts empty with
+  | .error _ => false
+  | .ok cold =>
+      let store := cold.completeStore
+      let bytes := cacheBytes store
+      let target := finalAddress program rawTarget
+      let constructor := finalAddress program rawConstructor
+      match IxIR1.HPT.Cache.run program.artifacts store,
+          findSummary preciseResult target, findSummary widenedResult target,
+          findSummary preciseResult constructor with
+      | .ok warm, some preciseTarget, some widenedTarget,
+          some constructorSummary =>
+          let corrupted := store.applyWrites
+            [(constructorSummary.cacheKey,
+              IxIR1.HPT.Cache.encodeArtifact constructorSummary ++
+                ByteArray.mk #[0])]
+          let mixed := store.applyWrites
+            [(preciseTarget.cacheKey,
+              IxIR1.HPT.Cache.encodeArtifact widenedTarget)]
+          match IxIR1.HPT.Cache.run program.artifacts corrupted,
+              IxIR1.HPT.Cache.run program.artifacts mixed with
+          | .ok repaired, .ok mixedRun =>
+              let updated := mixed.applyWrites mixedRun.writes
+              match IxIR1.HPT.Cache.run program.artifacts updated with
+              | .ok rewarmed =>
+                  cacheCodecOk preciseResult &&
+                    cacheStoreCodecOk preciseResult &&
+                    cacheBoundedNumeralOk preciseResult &&
+                    cold.certificate == preciseCertificate program &&
+                    cold.result == preciseResult &&
+                    cold.stats ==
+                      { ingressEntries := 0
+                        ingressBytes := 0
+                        hits := 0
+                        misses := 5
+                        rejected := 0
+                        rounds := 9
+                        widenedArtifacts := 0
+                        writes := 5
+                        writeBytes := bytes } &&
+                    empty.applyWrites cold.writes == store &&
+                    warm.certificate == preciseCertificate program &&
+                    warm.result == preciseResult &&
+                    warm.stats ==
+                      { ingressEntries := 5
+                        ingressBytes := bytes
+                        hits := 5
+                        misses := 0
+                        rejected := 0
+                        rounds := 0
+                        widenedArtifacts := 0
+                        writes := 0
+                        writeBytes := 0 } &&
+                    repaired.result == preciseResult &&
+                    repaired.stats.hits == 4 &&
+                    repaired.stats.misses == 1 &&
+                    repaired.stats.rejected == 1 &&
+                    repaired.stats.writes == 1 &&
+                    repaired.rejections.length == 1 &&
+                    mixedRun.result == widenedResult &&
+                    mixedRun.stats.hits == 4 &&
+                    mixedRun.stats.misses == 1 &&
+                    mixedRun.stats.rejected == 0 &&
+                    mixedRun.stats.writes == 1 &&
+                    rewarmed.result == widenedResult &&
+                    rewarmed.stats.hits == 5 &&
+                    rewarmed.stats.misses == 0 &&
+                    rewarmed.stats.rejected == 0
+              | .error _ => false
+          | _, _ => false
+      | _, _, _, _ => false
+
+def persistentCacheBudgetsOk (program : IxIR1.ReaddressAll.Result)
+    (analysis : IxIR1.HPT.Result) : Bool :=
+  let store := IxIR1.HPT.Cache.Store.ofResult analysis
+  let bytes := cacheBytes store
+  let largest := cacheMaxEntryBytes store
+  let exact : IxIR1.HPT.Cache.Limits :=
+    { maxEntries := store.entries.length
+      maxEntryBytes := largest
+      maxBytes := bytes
+      maxWriteBytes := bytes }
+  let duplicate := match store.entries with
+    | entry :: entries => (⟨entry :: entry :: entries⟩ : IxIR1.HPT.Cache.Store)
+    | [] => store
+  match IxIR1.HPT.Cache.runWith exact program.artifacts store,
+      IxIR1.HPT.Cache.runWith exact program.artifacts ⟨[]⟩ with
+  | .ok warm, .ok cold =>
+      warm.stats.hits == store.entries.length &&
+        warm.stats.misses == 0 &&
+        cold.stats.misses == store.entries.length &&
+        cold.stats.writeBytes == bytes &&
+        cacheIsError (IxIR1.HPT.Cache.runWith
+          { exact with maxEntries := store.entries.length - 1 }
+          program.artifacts store) &&
+        cacheIsError (IxIR1.HPT.Cache.runWith
+          { exact with maxBytes := bytes - 1 }
+          program.artifacts store) &&
+        cacheIsError (IxIR1.HPT.Cache.runWith
+          { exact with maxEntryBytes := largest - 1 }
+          program.artifacts store) &&
+        cacheIsError (IxIR1.HPT.Cache.runWith
+          { exact with maxWriteBytes := bytes - 1 }
+          program.artifacts ⟨[]⟩) &&
+        cacheIsError (IxIR1.HPT.Cache.runWith exact program.artifacts duplicate)
+  | _, _ => false
+
+def preciseOk (program : IxIR1.ReaddressAll.Result)
+    (analysis : IxIR1.HPT.Result) : Bool :=
+  analysis.semanticAudit &&
+    analysis.artifacts.length == program.artifacts.length &&
+    analysis.cacheKeys.map Address.toHex == expectedCacheKeys &&
+    analysis.addresses.map Address.toHex == expectedSummaryAddresses &&
+    analysis.artifacts.any (fun artifact =>
+      artifact.kind == .mutual && artifact.members.length == 2) &&
+    match findSummary analysis (finalAddress program rawConstructor) with
+    | some artifact =>
+        artifact.members ==
+          [(finalAddress program rawConstructor,
+            detailedConstructorFact)]
+    | none => false
+
+/-- The first field-sensitive HPT slice records the allocated scalar field,
+projects it back to a root fact, and agrees with both concrete fixture paths. -/
+def fieldSensitiveOk (program : IxIR1.ReaddressAll.Result)
+    (analysis : IxIR1.HPT.Result) : Bool :=
+  let constructor := finalAddress program rawConstructor
+  let cycleRight := finalAddress program rawCycleRight
+  let declarations := IxIR1.HPT.programDeclEnv program.artifacts
+  let ctx : IxIR1.Ctx := { decls := declarations }
+  detailedConstructorFact.exactConstructor? == some constructorId &&
+    IxIR1.HPT.Fact.top.exactConstructor? == none &&
+    (IxIR1.HPT.Fact.heap (.pap constructor 0)).exactConstructor? == none &&
+    detailedConstructorFact.fetch 0 == IxIR1.HPT.Fact.scalar &&
+    detailedConstructorFact.fetch 1 == IxIR1.HPT.Fact.bottom &&
+    (IxIR1.HPT.Fact.heap (.ctor constructorId none)).fetch 0 ==
+      IxIR1.HPT.Fact.top &&
+    match findSummary analysis constructor, findSummary analysis cycleRight,
+        IxIR1.invoke ctx 16 constructor [] {},
+        IxIR1.invoke ctx 32 cycleRight [] {} with
+    | some constructorSummary, some cycleSummary,
+        .ok (constructorStore, .loc location),
+        .ok (_, .lit (.nat 7)) =>
+        constructorSummary.members == [(constructor, detailedConstructorFact)] &&
+          cycleSummary.members.contains (cycleRight, IxIR1.HPT.Fact.scalar) &&
+          match constructorStore.get? location with
+          | some box =>
+              box.node == .ctorN constructorId #[.lit (.nat 7)]
+          | none => false
+    | _, _, _, _ => false
+
+/-! Case-binder field recovery fixture.  Keep it separate from the frozen
+five-artifact cache graph so improving the transfer does not silently rewrite
+the cache identity vectors used above. -/
+
+def rawCaseBinder : Address := Address.replicate 0xde
+
+def caseBinderDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call rawConstructor #[])
+      (.case (.var 0) false #[
+        .mk 0 1 (.ret (.var 0))])⟩
+
+def caseBinderRawDeclarations : List (Address × IxIR1.Decl) :=
+  [(rawCaseBinder, caseBinderDeclaration),
+   (rawConstructor, constructorDeclaration)]
+
+def caseBinderRawMain : IxIR1.Code :=
+  .letOp (.call rawCaseBinder #[]) (.ret (.var 0))
+
+def caseBinderAddressed : Except String IxIR1.ReaddressAll.Result :=
+  IxIR1.ReaddressAll.run [constructorBlock]
+    caseBinderRawDeclarations caseBinderRawMain
+
+/-- The checked interpreter and deterministic producer both recover a scalar
+result through a constructor case binder.  The local vectors also pin tag
+filtering, source-to-de-Bruijn reversal, multi-shape joins, identity-only and
+unknown widening, Nat peeling, and alias-forgotten field identities. -/
+def caseBinderFieldOk : Bool :=
+  let otherIdentity : IxIR1.CtorId := ⟨constructorBlock, 0, 1⟩
+  let nestedField := IxIR1.HPT.FieldFact.heap
+    (.ctor otherIdentity none)
+  let twoFields := IxIR1.HPT.Fact.heap
+    (.ctor constructorId
+      (some [IxIR1.HPT.FieldFact.scalar, nestedField]))
+  let alternateField := IxIR1.HPT.Fact.heap
+    (.ctor constructorId (some [nestedField]))
+  let joinedFields := detailedConstructorFact.join alternateField
+  let joinedExpected := IxIR1.HPT.Fact.scalar.join
+    (IxIR1.HPT.Fact.heap (.ctor otherIdentity none))
+  let wrongTag := detailedConstructorFact.join
+    (IxIR1.HPT.Fact.heap (.ctor otherIdentity none))
+  let forgottenField : IxIR1.HPT.FieldFact := ⟨false, true, []⟩
+  let forgottenOuter := IxIR1.HPT.Fact.heap
+    (.ctor constructorId (some [forgottenField]))
+  detailedConstructorFact.caseFields false 0 1 ==
+      [IxIR1.HPT.Fact.scalar] &&
+    twoFields.caseFields false 0 2 ==
+      [IxIR1.HPT.Fact.heap (.ctor otherIdentity none),
+       IxIR1.HPT.Fact.scalar] &&
+    joinedFields.caseFields false 0 1 == [joinedExpected] &&
+    wrongTag.caseFields false 0 1 == [IxIR1.HPT.Fact.scalar] &&
+    (IxIR1.HPT.Fact.heap (.ctor constructorId none)).caseFields
+      false 0 1 == [IxIR1.HPT.Fact.top] &&
+    IxIR1.HPT.Fact.top.caseFields false 0 1 ==
+      [IxIR1.HPT.Fact.top] &&
+    forgottenOuter.caseFields false 0 1 ==
+      [⟨false, true, []⟩] &&
+    IxIR1.HPT.Fact.scalar.caseFields true 1 1 ==
+      [IxIR1.HPT.Fact.scalar] &&
+    match caseBinderAddressed with
+    | .error _ => false
+    | .ok program =>
+        let candidate := preciseCertificate program
+        let binder := finalAddress program rawCaseBinder
+        let declarations := IxIR1.HPT.programDeclEnv program.artifacts
+        let ctx : IxIR1.Ctx := { decls := declarations }
+        match IxIR1.HPT.run program.artifacts candidate,
+            IxIR1.HPT.produce program.artifacts,
+            IxIR1.Env.ofList program.declarations binder,
+            IxIR1.invoke ctx 32 binder [] {} with
+        | .ok analysis, .ok production, some (.fn function),
+            .ok (store, .lit (.nat 7)) =>
+            analysis.semanticAudit && production.result.semanticAudit &&
+              candidate.summaryEnv binder == some IxIR1.HPT.Fact.scalar &&
+              production.certificate.summaryEnv binder ==
+                some IxIR1.HPT.Fact.scalar &&
+              match IxIR1.HPT.inferFunction declarations
+                  candidate.summaryEnv binder function with
+              | .ok inferred => inferred == IxIR1.HPT.Fact.scalar &&
+                  store.allocs == 1 && store.live == 1
+              | .error _ => false
+        | _, _, _, _ => false
+
+/-! Recursive field-refinement fixture.  This stays outside the frozen
+five-artifact cache graph above while exercising the complete depth-two path:
+allocation, projection, case binders, producer widening, and cache ingress. -/
+
+def rawDeepConstructor : Address := Address.replicate 0xe1
+def rawDeepFetch : Address := Address.replicate 0xe2
+def rawDeepCase : Address := Address.replicate 0xe3
+
+def deepInnerId : IxIR1.CtorId := ⟨constructorBlock, 0, 0⟩
+def deepOuterId : IxIR1.CtorId := ⟨constructorBlock, 0, 1⟩
+
+def deepConstructorDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.alloc .shared deepInnerId #[.lit (.nat 11)])
+      (.letOp (.alloc .shared deepOuterId #[.var 0])
+        (.ret (.var 0)))⟩
+
+def deepFetchDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call rawDeepConstructor #[])
+      (.letOp (.fetch (.var 0) 0)
+        (.letOp (.fetch (.var 0) 0)
+          (.ret (.var 0))))⟩
+
+def deepCaseDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call rawDeepConstructor #[])
+      (.case (.var 0) false #[
+        .mk 1 1
+          (.case (.var 0) false #[
+            .mk 0 1 (.ret (.var 0))])])⟩
+
+def deepRawDeclarations : List (Address × IxIR1.Decl) :=
+  [(rawDeepFetch, deepFetchDeclaration),
+   (rawDeepCase, deepCaseDeclaration),
+   (rawDeepConstructor, deepConstructorDeclaration)]
+
+def deepRawMain : IxIR1.Code :=
+  .letOp (.call rawDeepCase #[]) (.ret (.var 0))
+
+def deepAddressed : Except String IxIR1.ReaddressAll.Result :=
+  IxIR1.ReaddressAll.run [constructorBlock] deepRawDeclarations deepRawMain
+
+def deepInnerFact : IxIR1.HPT.Fact :=
+  IxIR1.HPT.Fact.heap
+    (.ctor deepInnerId (some [IxIR1.HPT.FieldFact.scalar]))
+
+def deepConstructorFact : IxIR1.HPT.Fact :=
+  IxIR1.HPT.Fact.heap
+    (.ctor deepOuterId
+      (some [IxIR1.HPT.FieldFact.heap
+        (.ctor deepInnerId (some [IxIR1.HPT.FieldFact.scalar]))]))
+
+/-- Recursive facts survive both transfer paths and strict cache decoding.
+The checker admits depth two exactly and rejects depth one; the deterministic
+producer shares that boundary and falls back conservatively when configured
+one level below it. -/
+def recursiveFieldOk : Bool :=
+  deepConstructorFact.fetch 0 == deepInnerFact &&
+    (deepConstructorFact.fetch 0).fetch 0 == IxIR1.HPT.Fact.scalar &&
+    deepConstructorFact.caseFields false 1 1 == [deepInnerFact] &&
+    deepInnerFact.caseFields false 0 1 == [IxIR1.HPT.Fact.scalar] &&
+    match deepAddressed with
+    | .error _ => false
+    | .ok program =>
+        let constructor := finalAddress program rawDeepConstructor
+        let fetch := finalAddress program rawDeepFetch
+        let deepCase := finalAddress program rawDeepCase
+        let declarations := IxIR1.HPT.programDeclEnv program.artifacts
+        let ctx : IxIR1.Ctx := { decls := declarations }
+        let exactChecker :=
+          { IxIR1.HPT.defaultLimits with maxFieldDepth := 2 }
+        let shallowChecker :=
+          { IxIR1.HPT.defaultLimits with maxFieldDepth := 1 }
+        let shallowProducer : IxIR1.HPT.ProducerLimits :=
+          { checker := shallowChecker }
+        let exactCache : IxIR1.HPT.Cache.Limits :=
+          { producer := { checker := exactChecker } }
+        let shallowCache : IxIR1.HPT.Cache.Limits :=
+          { producer := { checker := shallowChecker } }
+        match IxIR1.HPT.produce program.artifacts,
+            IxIR1.HPT.produceWith shallowProducer program.artifacts,
+            IxIR1.invoke ctx 64 fetch [] {},
+            IxIR1.invoke ctx 64 deepCase [] {} with
+        | .ok production, .ok widened,
+            .ok (fetchStore, .lit (.nat 11)),
+            .ok (caseStore, .lit (.nat 11)) =>
+            match findSummary production.result constructor,
+                IxIR1.HPT.preflight exactChecker program.artifacts
+                  production.certificate,
+                IxIR1.HPT.runWith exactChecker program.artifacts
+                  production.certificate with
+            | some constructorSummary, .ok stats, .ok checked =>
+                let encoded :=
+                  IxIR1.HPT.Cache.encodeArtifact constructorSummary
+                match IxIR1.HPT.Cache.decodeArtifactWith exactCache encoded with
+                | .ok decoded =>
+                    production.result.semanticAudit &&
+                      checked == production.result &&
+                      production.certificate.summaryEnv constructor ==
+                        some deepConstructorFact &&
+                      production.certificate.summaryEnv fetch ==
+                        some IxIR1.HPT.Fact.scalar &&
+                      production.certificate.summaryEnv deepCase ==
+                        some IxIR1.HPT.Fact.scalar &&
+                      stats.shapes == 2 && stats.fields == 2 &&
+                      stats.fieldDepth == 2 &&
+                      fetchStore.allocs == 2 && fetchStore.live == 2 &&
+                      caseStore.allocs == 2 && caseStore.live == 2 &&
+                      cacheCodecOk production.result &&
+                      cacheStoreCodecOk production.result &&
+                      decoded == constructorSummary &&
+                      cacheIsError
+                        (IxIR1.HPT.preflight shallowChecker program.artifacts
+                          production.certificate) &&
+                      cacheIsError
+                        (IxIR1.HPT.runWith shallowChecker program.artifacts
+                          production.certificate) &&
+                      cacheIsError
+                        (IxIR1.HPT.Cache.decodeArtifactWith shallowCache encoded) &&
+                      widened.certificate.postFixpoint program.artifacts &&
+                      widened.result.semanticAudit &&
+                      widened.stats.widenedArtifacts != 0
+                | .error _ => false
+            | _, _, _ => false
+        | _, _, _, _ => false
+
+/-- A non-degenerate root redex for the first checked HPT consumer.  The
+called function can only return constructor index zero; the second alternative
+is therefore unreachable under the precise certificate. -/
+def casePruneInput (program : IxIR1.ReaddressAll.Result) : IxIR1.Code :=
+  .letOp (.call (finalAddress program rawConstructor) #[])
+    (.case (.var 0) false #[
+      .mk 0 1 (.ret (.lit (.nat 41))),
+      .mk 1 0 (.ret (.lit (.nat 99)))])
+
+private def rootCallCaseIndices : IxIR1.Code → Option (List Nat)
+  | .letOp (.call _ _) (.case (.var 0) _ alternatives) =>
+      some (alternatives.toList.map (fun alternative => alternative.cidx))
+  | _ => none
+
+private def rootCallHasUnaryFetch : IxIR1.Code → Bool
+  | .letOp (.call _ _)
+      (.letOp (.fetch (.var 0) 0) _) => true
+  | _ => false
+
+private def casePruneExecutionOk :
+    Except IxIR1.Err (IxIR1.Store × IxIR1.RVal) → Bool
+  | .ok (store, .lit (.nat 41)) =>
+      store.nodes.size == 1 && store.allocs == 1 && store.reuses == 0 &&
+        store.frees == 0 && store.rcops == 0 && store.live == 1 &&
+        match store.get? 0 with
+        | some box =>
+            box.world == .shared && box.rc == 1 &&
+              box.node == .ctorN constructorId #[.lit (.nat 7)]
+        | none => false
+  | _ => false
+
+/-- The precise checked row removes one impossible constructor branch,
+collapses the remaining unary case to a checked fetch, and preserves concrete
+execution. Conservative facts and duplicate matches remain pruning-only. -/
+def casePruneOk (program : IxIR1.ReaddressAll.Result) : Bool :=
+  let preciseCandidate := preciseCertificate program
+  let topCandidate := IxIR1.HPT.Certificate.top program.artifacts
+  match IxIR1.HPT.run program.artifacts preciseCandidate,
+      IxIR1.HPT.run program.artifacts topCandidate with
+  | .ok preciseAnalysis, .ok topAnalysis =>
+      let declarations := IxIR1.HPT.programDeclEnv program.artifacts
+      let input := casePruneInput program
+      let pruned := IxIR1.HPT.CasePrune.run declarations
+        preciseCandidate.summaryEnv input
+      let conservative := IxIR1.HPT.CasePrune.run declarations
+        topCandidate.summaryEnv input
+      let constructor := finalAddress program rawConstructor
+      let identityOnlyFact :=
+        IxIR1.HPT.Fact.heap (.ctor constructorId none)
+      let exactUnaryFact :=
+        IxIR1.HPT.Fact.heap
+          (.ctor constructorId (some [IxIR1.HPT.FieldFact.scalar]))
+      let nullaryFact :=
+        IxIR1.HPT.Fact.heap (.ctor constructorId (some []))
+      let binaryFact :=
+        IxIR1.HPT.Fact.heap
+          (.ctor constructorId
+            (some [IxIR1.HPT.FieldFact.scalar,
+              IxIR1.HPT.FieldFact.scalar]))
+      let identityOnlySummary : IxIR1.HPT.SummaryEnv := fun address =>
+        if address == constructor then some identityOnlyFact else none
+      let exactUnarySummary : IxIR1.HPT.SummaryEnv := fun address =>
+        if address == constructor then some exactUnaryFact else none
+      let identityOnly := IxIR1.HPT.CasePrune.run declarations
+        identityOnlySummary input
+      let singletonInput : IxIR1.Code :=
+        .letOp (.call constructor #[])
+          (.case (.var 0) false #[
+            .mk 0 1 (.ret (.lit (.nat 41)))])
+      let singleton := IxIR1.HPT.CasePrune.run declarations
+        exactUnarySummary singletonInput
+      let duplicateInput : IxIR1.Code :=
+        .letOp (.call constructor #[])
+          (.case (.var 0) false #[
+            .mk 0 1 (.ret (.lit (.nat 41))),
+            .mk 0 1 (.ret (.lit (.nat 42))),
+            .mk 1 0 (.ret (.lit (.nat 99)))])
+      let duplicate := IxIR1.HPT.CasePrune.run declarations
+        exactUnarySummary duplicateInput
+      let ctx : IxIR1.Ctx := { decls := declarations }
+      -- `runCode_run_eq` deliberately holds the current frame fixed; this
+      -- fixture contains no `callSelf`, so that boundary is explicit here.
+      let current : IxIR1.FnDef := ⟨0, .shared, false, input⟩
+      preciseAnalysis.semanticAudit && topAnalysis.semanticAudit &&
+        pruned.removedAlternatives == 1 &&
+        pruned.collapsedCases == 1 &&
+        pruned.materializedFetches == 1 &&
+        conservative.removedAlternatives == 0 &&
+        conservative.collapsedCases == 0 &&
+        conservative.materializedFetches == 0 &&
+        rootCallCaseIndices input == some [0, 1] &&
+        rootCallHasUnaryFetch pruned.code &&
+        rootCallCaseIndices conservative.code == some [0, 1] &&
+        identityOnly.removedAlternatives == 1 &&
+        identityOnly.collapsedCases == 0 &&
+        identityOnly.materializedFetches == 0 &&
+        rootCallCaseIndices identityOnly.code == some [0] &&
+        singleton.removedAlternatives == 0 &&
+        singleton.collapsedCases == 1 &&
+        singleton.materializedFetches == 1 &&
+        rootCallHasUnaryFetch singleton.code &&
+        duplicate.removedAlternatives == 1 &&
+        duplicate.collapsedCases == 0 &&
+        duplicate.materializedFetches == 0 &&
+        rootCallCaseIndices duplicate.code == some [0, 0] &&
+        IxIR1.HPT.CasePrune.exactUnaryConstructor? exactUnaryFact ==
+          some constructorId &&
+        IxIR1.HPT.CasePrune.exactUnaryConstructor? identityOnlyFact == none &&
+        IxIR1.HPT.CasePrune.exactUnaryConstructor? nullaryFact == none &&
+        IxIR1.HPT.CasePrune.exactUnaryConstructor? binaryFact == none &&
+        casePruneExecutionOk
+          (IxIR1.runCode ctx 64 current {} [] input) &&
+        casePruneExecutionOk
+          (IxIR1.runCode ctx 64 current {} [] pruned.code)
+  | _, _ => false
+
+/-- Two eligible redexes nested in separate case alternatives.  Only the
+first alternative executes, while structural checks ensure traversal reaches
+both bodies. -/
+def recursiveCasePruneInput
+    (program : IxIR1.ReaddressAll.Result) : IxIR1.Code :=
+  .case (.lit (.nat 0)) true #[
+    .mk 0 0 (casePruneInput program),
+    .mk 1 1 (casePruneInput program)]
+
+private def alternativeRootCallCaseIndices : IxIR1.Alt → Option (List Nat)
+  | .mk _ _ body => rootCallCaseIndices body
+
+private def caseAlternativeRootIndices : IxIR1.Code →
+    Option (List (Option (List Nat)))
+  | .case _ _ alternatives =>
+      some (alternatives.toList.map alternativeRootCallCaseIndices)
+  | _ => none
+
+private def alternativeRootCallHasUnaryFetch : IxIR1.Alt → Bool
+  | .mk _ _ body => rootCallHasUnaryFetch body
+
+private def caseAlternativeRootUnaryFetches : IxIR1.Code →
+    Option (List Bool)
+  | .case _ _ alternatives =>
+      some (alternatives.toList.map alternativeRootCallHasUnaryFetch)
+  | _ => none
+
+/-- Recursive simplification reaches every alternative body, sums all pass
+counters, preserves concrete execution, and remains conservative for a
+checked top certificate. The one-root API leaves this input untouched. -/
+def recursiveCasePruneOk (program : IxIR1.ReaddressAll.Result) : Bool :=
+  let preciseCandidate := preciseCertificate program
+  let topCandidate := IxIR1.HPT.Certificate.top program.artifacts
+  match IxIR1.HPT.run program.artifacts preciseCandidate,
+      IxIR1.HPT.run program.artifacts topCandidate with
+  | .ok preciseAnalysis, .ok topAnalysis =>
+      let declarations := IxIR1.HPT.programDeclEnv program.artifacts
+      let input := recursiveCasePruneInput program
+      let rootOnly := IxIR1.HPT.CasePrune.run declarations
+        preciseCandidate.summaryEnv input
+      let pruned := IxIR1.HPT.CasePrune.runRecursive declarations
+        preciseCandidate.summaryEnv input
+      let conservative := IxIR1.HPT.CasePrune.runRecursive declarations
+        topCandidate.summaryEnv input
+      let ctx : IxIR1.Ctx := { decls := declarations }
+      let current : IxIR1.FnDef := ⟨0, .shared, false, input⟩
+      preciseAnalysis.semanticAudit && topAnalysis.semanticAudit &&
+        rootOnly.removedAlternatives == 0 &&
+        rootOnly.collapsedCases == 0 &&
+        rootOnly.materializedFetches == 0 &&
+        pruned.removedAlternatives == 2 &&
+        pruned.collapsedCases == 2 &&
+        pruned.materializedFetches == 2 &&
+        conservative.removedAlternatives == 0 &&
+        conservative.collapsedCases == 0 &&
+        conservative.materializedFetches == 0 &&
+        caseAlternativeRootIndices rootOnly.code ==
+          some [some [0, 1], some [0, 1]] &&
+        caseAlternativeRootIndices pruned.code ==
+          some [none, none] &&
+        caseAlternativeRootUnaryFetches pruned.code == some [true, true] &&
+        caseAlternativeRootIndices conservative.code ==
+          some [some [0, 1], some [0, 1]] &&
+        casePruneExecutionOk
+          (IxIR1.runCode ctx 64 current {} [] input) &&
+        casePruneExecutionOk
+          (IxIR1.runCode ctx 64 current {} [] pruned.code)
+  | _, _ => false
+
+/-- A one-argument current body recursively peels a Nat with `callSelf`; its
+zero branch contains the checked call-result case redex. -/
+def callSelfCasePruneInput
+    (program : IxIR1.ReaddressAll.Result) : IxIR1.Code :=
+  .case (.var 0) true #[
+    .mk 0 0 (casePruneInput program),
+    .mk 1 1
+      (.letOp (.callSelf #[.var 0])
+        (.ret (.var 0)))]
+
+/-- Rewriting both the supplied body and the dynamic current frame preserves
+a terminating recursive execution.  Three self calls reach the rewritten
+zero branch, whose impossible constructor alternative is absent. -/
+def callSelfCasePruneOk (program : IxIR1.ReaddressAll.Result) : Bool :=
+  let candidate := preciseCertificate program
+  match IxIR1.HPT.run program.artifacts candidate with
+  | .error _ => false
+  | .ok analysis =>
+      let declarations := IxIR1.HPT.programDeclEnv program.artifacts
+      let input := callSelfCasePruneInput program
+      let pruned := IxIR1.HPT.CasePrune.runRecursive declarations
+        candidate.summaryEnv input
+      let current : IxIR1.FnDef := ⟨1, .shared, false, input⟩
+      let rewritten := IxIR1.HPT.CasePrune.rewriteCurrent declarations
+        candidate.summaryEnv current
+      let ctx : IxIR1.Ctx := { decls := declarations }
+      analysis.semanticAudit &&
+        pruned.removedAlternatives == 1 &&
+        pruned.collapsedCases == 1 &&
+        pruned.materializedFetches == 1 &&
+        caseAlternativeRootIndices input == some [some [0, 1], none] &&
+        caseAlternativeRootIndices pruned.code == some [none, none] &&
+        caseAlternativeRootUnaryFetches pruned.code == some [true, false] &&
+        caseAlternativeRootIndices rewritten.body == some [none, none] &&
+        caseAlternativeRootUnaryFetches rewritten.body == some [true, false] &&
+        casePruneExecutionOk
+          (IxIR1.runCode ctx 128 current {} [.lit (.nat 3)] input) &&
+        casePruneExecutionOk
+          (IxIR1.runCode ctx 128 rewritten {} [.lit (.nat 3)] pruned.code)
+
+/-- A zero-argument artifact main that dynamically re-enters itself after the
+eligible redex. Finite evaluator fuel makes the observable result exact and
+bounded. -/
+def callSelfMainPruneInput
+    (program : IxIR1.ReaddressAll.Result) : IxIR1.Code :=
+  .letOp (.call (finalAddress program rawConstructor) #[])
+    (.case (.var 0) false #[
+      .mk 0 1
+        (.letOp (.callSelf #[])
+          (.ret (.var 0))),
+      .mk 1 0 (.ret (.lit (.nat 99)))])
+
+private def artifactWithMain (program : IxIR1.ReaddressAll.Result)
+    (main : IxIR1.Code) : Pipeline.Artifact :=
+  { rawErasedDecls := []
+    erasedDecls := []
+    erasedBlocks := []
+    erasedAddressMap := []
+    targetArtifacts := program.artifacts
+    main := main
+    targetAddressMap := program.addressMap }
+
+private def isFuelError : Except IxIR1.Err (IxIR1.Store × IxIR1.RVal) → Bool
+  | .error .fuel => true
+  | _ => false
+
+/-- The checked pipeline main API simplifies the artifact main and preserves
+an actual zero-argument `callSelf` loop's exact finite-fuel error. -/
+def pipelineCallSelfMainPruneOk
+    (program : IxIR1.ReaddressAll.Result) : Bool :=
+  let input := callSelfMainPruneInput program
+  let artifact := artifactWithMain program input
+  let candidate := preciseCertificate program
+  match artifact.checkAndPruneMain candidate with
+  | .error _ => false
+  | .ok (analysis, pruned) =>
+      let ctx : IxIR1.Ctx := { decls := artifact.targetDeclEnv }
+      analysis.semanticAudit &&
+        pruned.removedAlternatives == 1 &&
+        pruned.collapsedCases == 1 &&
+        pruned.materializedFetches == 1 &&
+        rootCallCaseIndices input == some [0, 1] &&
+        rootCallHasUnaryFetch pruned.code &&
+        isFuelError (IxIR1.runMain ctx input 64) &&
+        isFuelError (IxIR1.runMain ctx pruned.code 64)
+
+/-! Complete declaration-graph consumer fixture. -/
+
+def graphRawCaller : Address := Address.replicate 0xdb
+
+def graphCallerBody : IxIR1.Code :=
+  .letOp (.call rawConstructor #[])
+    (.letOp (.pure (.var 0))
+      (.case (.var 0) false #[
+        .mk 0 1 (.ret (.lit (.nat 41))),
+        .mk 1 0 (.ret (.lit (.nat 99))) ]))
+
+def graphCallerDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true, graphCallerBody⟩
+
+def graphRawDeclarations : List (Address × IxIR1.Decl) :=
+  [(graphRawCaller, graphCallerDeclaration),
+   (rawConstructor, constructorDeclaration)]
+
+def graphRawMain : IxIR1.Code :=
+  .letOp (.call graphRawCaller #[]) (.ret (.var 0))
+
+private def rootCallTarget : IxIR1.Code → Option Address
+  | .letOp (.call function _) _ => some function
+  | _ => none
+
+private def rootCallAliasHasUnaryFetch : IxIR1.Code → Bool
+  | .letOp (.call _ _)
+      (.letOp (.pure (.var 0))
+        (.letOp (.fetch (.var 0) 0) _)) => true
+  | _ => false
+
+/-- Complete checked simplification propagates a call fact through an alias,
+rewrites the stored function body, changes its content address, rewrites the
+main edge, preserves execution, and composes the pipeline's original producer
+map through the rebuild. -/
+def declarationGraphCasePruneOk : Bool :=
+  match IxIR1.ReaddressAll.run [constructorBlock]
+      graphRawDeclarations graphRawMain with
+  | .error _ => false
+  | .ok program =>
+      let artifact := artifactWithMain program program.main
+      let candidate := preciseCertificate program
+      match artifact.checkAndPruneProgram candidate with
+      | .error _ => false
+      | .ok (analysis, outcome) =>
+          let oldCaller := finalAddress program graphRawCaller
+          let newCaller := IxIR1.Readdress.Renaming.apply
+            outcome.result.addressMap oldCaller
+          let installed := artifact.installPrunedProgram outcome
+          let oldCtx : IxIR1.Ctx := { decls := artifact.targetDeclEnv }
+          let newCtx := outcome.result.addressedCtx (fun _ _ => none)
+          analysis.semanticAudit &&
+            outcome.removedAlternatives == 1 &&
+            outcome.collapsedCases == 1 &&
+            outcome.materializedFetches == 1 &&
+            oldCaller != newCaller &&
+            outcome.result.semanticAudit
+              (artifact.prunedTargetEntries candidate.summaryEnv)
+              (IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+                candidate.summaryEnv artifact.main).code &&
+            outcome.result.rebuildSemanticAudit
+              (artifact.prunedTargetEntries candidate.summaryEnv)
+              (IxIR1.HPT.CasePrune.runRecursive artifact.targetDeclEnv
+                candidate.summaryEnv artifact.main).code &&
+            outcome.result.contentAddressed &&
+            outcome.result.noTransientKeys &&
+            outcome.result.noTransientReferences &&
+            rootCallTarget outcome.result.main == some newCaller &&
+            IxIR1.Readdress.Renaming.apply installed.targetAddressMap
+              graphRawCaller == newCaller &&
+            match IxIR1.Env.ofList outcome.result.declarations newCaller with
+            | some (.fn function) =>
+                rootCallAliasHasUnaryFetch function.body &&
+                  casePruneExecutionOk
+                    (IxIR1.runMain oldCtx artifact.main 64) &&
+                  casePruneExecutionOk
+                    (IxIR1.runMain newCtx outcome.result.main 64)
+            | _ => false
+
+/-- The optimizer harness observes a non-degenerate whole-program rewrite,
+composes the rebuilt addresses into the pipeline artifact, reproduces the same
+report on an independent run, skips deterministically under explicit controls,
+and reaches a structural fixed point after recomputing HPT on the new root. -/
+def optimizerHarnessOk : Bool :=
+  match IxIR1.ReaddressAll.run [constructorBlock]
+      graphRawDeclarations graphRawMain with
+  | .error _ => false
+  | .ok program =>
+      let artifact := artifactWithMain program program.main
+      match artifact.produceHPT with
+      | .error _ => false
+      | .ok production =>
+          let (firstArtifact, firstReport) :=
+            artifact.optimizeWithProducedHPT
+              IxIR1.Optimizer.defaultPolicy production
+          let (repeatArtifact, repeatReport) :=
+            artifact.optimizeWithProducedHPT
+              IxIR1.Optimizer.defaultPolicy production
+          let disabledPolicy : IxIR1.Optimizer.Policy :=
+            { casePrune := { enabled := false }
+              fetchForward := { enabled := false }
+              destruction := { enabled := false }
+              papFuse := { enabled := false }
+              reachability := { enabled := false } }
+          let disabled := IxIR1.Optimizer.runWithProducedHPT disabledPolicy
+            artifact.targetArtifacts artifact.main production
+          let budgetPolicy : IxIR1.Optimizer.Policy :=
+            { casePrune :=
+                { budget := { maxInputInstructions := 0 } } }
+          let budgeted := IxIR1.Optimizer.runWithProducedHPT budgetPolicy
+            artifact.targetArtifacts artifact.main production
+          let newCaller := IxIR1.Readdress.Renaming.apply
+            firstArtifact.targetAddressMap graphRawCaller
+          let firstRoot := IxIR1.Optimizer.graphRoot
+            firstArtifact.targetArtifacts firstArtifact.main
+          let repeatRoot := IxIR1.Optimizer.graphRoot
+            repeatArtifact.targetArtifacts repeatArtifact.main
+          let firstChecks :=
+            firstReport.disposition == .changed &&
+              firstReport.removedAlternatives == 1 &&
+              firstReport.collapsedCases == 1 &&
+              firstReport.materializedFetches == 1 &&
+              firstReport.forwardedFetches == 0 &&
+              firstReport.removedDeclarations == 0 &&
+              firstReport.inputRoot != firstReport.outputRoot &&
+              firstReport.outputRoot == firstRoot &&
+              firstReport.before.counts.alternatives ==
+                firstReport.after.counts.alternatives + 2 &&
+              firstReport.before.counts.cases ==
+                firstReport.after.counts.cases + 1 &&
+              firstReport.after.counts.fetches ==
+                firstReport.before.counts.fetches + 1 &&
+              firstReport.after.codeBytes < firstReport.before.codeBytes &&
+              firstReport.after == IxIR1.Optimizer.observe
+                firstArtifact.targetArtifacts firstArtifact.main &&
+              firstRoot == repeatRoot &&
+              firstReport.bytes == repeatReport.bytes &&
+              firstReport.address == repeatReport.address &&
+              rootCallTarget firstArtifact.main == some newCaller &&
+              (match firstArtifact.targetDeclEnv newCaller with
+               | some (.fn function) =>
+                   rootCallAliasHasUnaryFetch function.body
+               | _ => false) &&
+              disabled.rebuilt.isNone &&
+              disabled.report.disposition ==
+                .skipped IxIR1.Optimizer.SkipReason.disabled &&
+              disabled.report.inputRoot == disabled.report.outputRoot &&
+              budgeted.rebuilt.isNone &&
+              budgeted.report.disposition ==
+                .skipped (.instructionBudget
+                  firstReport.before.counts.instructions 0)
+          firstChecks &&
+            match firstArtifact.produceHPT with
+            | .error _ => false
+            | .ok secondProduction =>
+                let (secondArtifact, secondReport) :=
+                  firstArtifact.optimizeWithProducedHPT
+                    IxIR1.Optimizer.defaultPolicy secondProduction
+                secondReport.disposition == .unchanged &&
+                  secondReport.removedAlternatives == 0 &&
+                  secondReport.collapsedCases == 0 &&
+                  secondReport.materializedFetches == 0 &&
+                  secondReport.forwardedFetches == 0 &&
+                  secondReport.removedDeclarations == 0 &&
+                  secondReport.inputRoot == firstReport.outputRoot &&
+                  secondReport.outputRoot == firstReport.outputRoot &&
+                  secondReport.before == secondReport.after &&
+                  IxIR1.Optimizer.graphRoot secondArtifact.targetArtifacts
+                    secondArtifact.main == firstReport.outputRoot
+
+/-! Checked rooted declaration reachability fixture. -/
+
+def reachRawLeaf : Address := Address.replicate 0xf1
+def reachRawMiddle : Address := Address.replicate 0xf2
+def reachRawDeadLeft : Address := Address.replicate 0xf3
+def reachRawDeadRight : Address := Address.replicate 0xf4
+
+def reachLeafDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true, .ret (.lit (.nat 42))⟩
+
+def reachMiddleDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call reachRawLeaf #[]) (.ret (.var 0))⟩
+
+def reachDeadLeftDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call reachRawDeadRight #[]) (.ret (.var 0))⟩
+
+def reachDeadRightDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .shared, true,
+    .letOp (.call reachRawDeadLeft #[]) (.ret (.var 0))⟩
+
+def reachRawDeclarations : List (Address × IxIR1.Decl) :=
+  [(reachRawMiddle, reachMiddleDeclaration),
+   (reachRawLeaf, reachLeafDeclaration),
+   (reachRawDeadLeft, reachDeadLeftDeclaration),
+   (reachRawDeadRight, reachDeadRightDeclaration)]
+
+def reachRawMain : IxIR1.Code :=
+  .letOp (.call reachRawMiddle #[]) (.ret (.var 0))
+
+private def isReachabilityResult :
+    Except IxIR1.Err (IxIR1.Store × IxIR1.RVal) → Bool
+  | .ok (store, .lit (.nat 42)) => store.live == 0
+  | _ => false
+
+/-- The untrusted producer and small checker agree on a direct-call closure,
+retain a rooted SCC as a unit, follow PAP edges, and fall back to the complete
+world for dynamic apply or an invalid configured root.  Stale identities,
+root substitution, and a canonical-but-not-closed retained set are rejected;
+filtering preserves the concrete result. -/
+def reachabilityCertificateOk : Bool :=
+  match IxIR1.ReaddressAll.run [] reachRawDeclarations reachRawMain with
+  | .error _ => false
+  | .ok program =>
+      let entries := program.declarations
+      let leaf := finalAddress program reachRawLeaf
+      let middle := finalAddress program reachRawMiddle
+      let deadLeft := finalAddress program reachRawDeadLeft
+      let deadRight := finalAddress program reachRawDeadRight
+      let outcome := IxIR1.Reachability.run [] entries program.main
+      let rooted := IxIR1.Reachability.run [deadLeft] entries program.main
+      let papMain : IxIR1.Code :=
+        .letOp (.papp leaf #[]) (.ret (.var 0))
+      let pap := IxIR1.Reachability.run [] entries papMain
+      let applyMain : IxIR1.Code :=
+        .letOp (.papp leaf #[])
+          (.letOp (.apply (.var 0) #[]) (.ret (.var 0)))
+      let dynamic := IxIR1.Reachability.run [] entries applyMain
+      let absent := Address.replicate 0xf5
+      let invalidRoot := IxIR1.Reachability.run [absent] entries program.main
+      let stale : IxIR1.Reachability.Certificate :=
+        { outcome.certificate with inputRoot := Address.replicate 0xf6 }
+      let notClosed : IxIR1.Reachability.Certificate :=
+        { outcome.certificate with
+          retained := (entries.map (fun entry => entry.1)).filter
+            (fun address => address != leaf) }
+      let entryKeys := entries.map (fun entry => entry.1)
+      let retainedKeys := outcome.entries.map (fun entry => entry.1)
+      let oldCtx : IxIR1.Ctx := { decls := IxIR1.Env.ofList entries }
+      let filteredCtx : IxIR1.Ctx :=
+        { decls := IxIR1.Env.ofList outcome.entries }
+      outcome.accepted && outcome.removedDeclarations == 2 &&
+        outcome.entries.length == 2 && retainedKeys.contains middle &&
+        retainedKeys.contains leaf && !retainedKeys.contains deadLeft &&
+        !retainedKeys.contains deadRight &&
+        rooted.accepted && rooted.removedDeclarations == 0 &&
+        rooted.entries.map (fun entry => entry.1) == entryKeys && pap.accepted &&
+        pap.certificate.retained.contains leaf &&
+        pap.removedDeclarations == 3 && dynamic.accepted &&
+        dynamic.removedDeclarations == 0 &&
+        dynamic.entries.map (fun entry => entry.1) == entryKeys &&
+        !invalidRoot.accepted &&
+        invalidRoot.entries.map (fun entry => entry.1) == entryKeys &&
+        !IxIR1.Reachability.validate entries program.main [] stale &&
+        !IxIR1.Reachability.validate entries program.main [deadLeft]
+          outcome.certificate &&
+        !IxIR1.Reachability.validate entries program.main [] notClosed &&
+        (match IxIR1.Reachability.check entries program.main []
+            outcome.certificate with
+         | .ok _ => true
+         | .error _ => false) &&
+        isReachabilityResult (IxIR1.runMain oldCtx program.main 64) &&
+        isReachabilityResult (IxIR1.runMain filteredCtx program.main 64)
+
+/-- The public optimizer removes the unreachable mutual component before its
+single rebuild, reports the exact declaration delta, preserves execution and
+content addressing, honors an exported root, and rejects an unsupported pass
+schema fail-softly. -/
+def reachabilityHarnessOk : Bool :=
+  match IxIR1.ReaddressAll.run [] reachRawDeclarations reachRawMain with
+  | .error _ => false
+  | .ok program =>
+      let artifact := artifactWithMain program program.main
+      match artifact.produceHPT with
+      | .error _ => false
+      | .ok production =>
+          let outcome := IxIR1.Optimizer.runWithProducedHPT
+            IxIR1.Optimizer.defaultPolicy program.artifacts program.main
+            production
+          let deadLeft := finalAddress program reachRawDeadLeft
+          let rootedPolicy : IxIR1.Optimizer.Policy :=
+            { reachability := { roots := [deadLeft] } }
+          let rooted := IxIR1.Optimizer.runWithProducedHPT rootedPolicy
+            program.artifacts program.main production
+          let unsupportedPolicy : IxIR1.Optimizer.Policy :=
+            { reachability := { version := 0 } }
+          let unsupported := IxIR1.Optimizer.runWithProducedHPT
+            unsupportedPolicy program.artifacts program.main production
+          let oldCtx : IxIR1.Ctx :=
+            { decls := IxIR1.HPT.programDeclEnv program.artifacts }
+          outcome.report.disposition == .changed &&
+            outcome.report.removedDeclarations == 2 &&
+            outcome.report.before.functions == 4 &&
+            outcome.report.after.functions == 2 &&
+            (match outcome.rebuilt with
+             | none => false
+             | some result =>
+                 result.declarations.length == 2 &&
+                   result.contentAddressed && result.noTransientKeys &&
+                   result.noTransientReferences &&
+                   isReachabilityResult
+                     (IxIR1.runMain oldCtx program.main 64) &&
+                   isReachabilityResult
+                     (IxIR1.runMain
+                       (result.addressedCtx (fun _ _ => none)) result.main 64)) &&
+            rooted.report.removedDeclarations == 0 &&
+            rooted.report.after.functions == 4 &&
+            unsupported.rebuilt.isNone &&
+            unsupported.report.disposition ==
+              .skipped (.unsupportedReachabilityVersion 0
+                IxIR1.Optimizer.currentReachabilityVersion)
+
+/-! Local PAP/application fusion fixture. -/
+
+def papRawScalarTarget : Address := Address.replicate 0xe0
+def papRawMaker : Address := Address.replicate 0xe1
+def papRawUnary : Address := Address.replicate 0xe2
+
+def papScalarTargetDeclaration : IxIR1.Decl :=
+  .fn ⟨2, .shared, true, .ret (.lit (.nat 42))⟩
+
+def papUnaryDeclaration : IxIR1.Decl :=
+  .fn ⟨1, .shared, true, .ret (.lit (.nat 99))⟩
+
+def papMakerDeclaration : IxIR1.Decl :=
+  .fn ⟨2, .shared, true,
+    .letOp (.papp papRawUnary #[]) (.ret (.var 0))⟩
+
+def papFusionRawDeclarations : List (Address × IxIR1.Decl) :=
+  [(papRawScalarTarget, papScalarTargetDeclaration),
+   (papRawMaker, papMakerDeclaration),
+   (papRawUnary, papUnaryDeclaration)]
+
+/-- The first pair remains under-saturated and is explicitly released; the
+second saturates exactly; the third over-saturates a function which returns a
+unary PAP.  Literal captures make the scalar certificate independent of the
+entry environment. -/
+def papFusionRawMain : IxIR1.Code :=
+  .letOp (.papp papRawScalarTarget #[.lit (.nat 10)])
+    (.letOp (.apply (.var 0) #[])
+      (.letOp (.drop (.var 0))
+        (.letOp (.papp papRawScalarTarget #[.lit (.nat 20)])
+          (.letOp (.apply (.var 0) #[.lit (.nat 22)])
+            (.letOp (.papp papRawMaker #[.lit (.nat 1)])
+              (.letOp (.apply (.var 0)
+                  #[.lit (.nat 2), .lit (.nat 3)])
+                (.ret (.var 0))))))))
+
+private def hasFusedPAPShape : IxIR1.Code → Bool
+  | .letOp (.papp _ under)
+      (.letOp (.pure (.var 0))
+        (.letOp (.drop (.var 0))
+          (.letOp (.call _ exact)
+            (.letOp (.pure (.var 0))
+              (.letOp (.call _ saturated)
+                (.letOp (.apply (.var 0) residual) (.ret (.var 0)))))))) =>
+      under.size == 1 && exact.size == 2 && saturated.size == 2 &&
+        residual.size == 1
+  | _ => false
+
+private def isPapFusionResult :
+    Except IxIR1.Err (IxIR1.Store × IxIR1.RVal) → Bool
+  | .ok (store, .lit (.nat 99)) => store.live == 0
+  | _ => false
+
+/-- The versioned harness fuses all saturation classes through one rebuild,
+reports the operation delta, preserves the scalar result with no live heap,
+rejects every unsupported local shape, and reaches a fixed point after HPT is
+recomputed on the rewritten graph. -/
+def papFusionHarnessOk : Bool :=
+  match IxIR1.ReaddressAll.run [] papFusionRawDeclarations papFusionRawMain with
+  | .error _ => false
+  | .ok program =>
+      let artifact := artifactWithMain program program.main
+      match artifact.produceHPT with
+      | .error _ => false
+      | .ok production =>
+          let policy := IxIR1.Optimizer.defaultPolicy
+          let (optimized, report) :=
+            artifact.optimizeWithProducedHPT policy production
+          let oldCtx : IxIR1.Ctx := { decls := artifact.targetDeclEnv }
+          let newCtx : IxIR1.Ctx := { decls := optimized.targetDeclEnv }
+          let declarations := artifact.targetDeclEnv
+          let target := finalAddress program papRawScalarTarget
+          let accepted := IxIR1.HPT.PAPFuse.fusePair? declarations [] target
+            #[.lit (.nat 1)] #[.lit (.nat 2)] (.ret (.var 0))
+          let rejectsHeapCapture :=
+            (IxIR1.HPT.PAPFuse.fusePair? declarations [IxIR1.HPT.Fact.top]
+              target #[.var 0] #[.lit (.nat 2)] (.ret (.var 0))).isNone
+          let rejectsPAPOperand :=
+            (IxIR1.HPT.PAPFuse.fusePair? declarations [] target
+              #[.lit (.nat 1)] #[.var 0] (.ret (.var 0))).isNone
+          let rejectsLiveBinder :=
+            (IxIR1.HPT.PAPFuse.fusePair? declarations [] target
+              #[.lit (.nat 1)] #[.lit (.nat 2)] (.ret (.var 1))).isNone
+          let rejectsSaturatingCapture :=
+            (IxIR1.HPT.PAPFuse.fusePair? declarations [] target
+              #[.lit (.nat 1), .lit (.nat 2)] #[]
+              (.ret (.var 0))).isNone
+          report.disposition == .changed &&
+            report.removedAlternatives == 0 &&
+            report.collapsedCases == 0 &&
+            report.materializedFetches == 0 &&
+            report.forwardedFetches == 0 &&
+            report.fusedPaps == 3 &&
+            report.underSaturatedPaps == 1 &&
+            report.exactlySaturatedPaps == 1 &&
+            report.overSaturatedPaps == 1 &&
+            report.before.counts.papAllocations == 4 &&
+            report.after.counts.papAllocations == 2 &&
+            report.before.counts.applies == 3 &&
+            report.after.counts.applies == 1 &&
+            report.after.counts.directCalls ==
+              report.before.counts.directCalls + 2 &&
+            hasFusedPAPShape optimized.main && accepted.isSome &&
+            rejectsHeapCapture && rejectsPAPOperand && rejectsLiveBinder &&
+            rejectsSaturatingCapture &&
+            isPapFusionResult (IxIR1.runMain oldCtx artifact.main 128) &&
+            isPapFusionResult (IxIR1.runMain newCtx optimized.main 128) &&
+            match optimized.produceHPT with
+            | .error _ => false
+            | .ok secondProduction =>
+                let (fixed, fixedReport) :=
+                  optimized.optimizeWithProducedHPT policy secondProduction
+                fixedReport.disposition == .unchanged &&
+                  fixedReport.forwardedFetches == 0 &&
+                  fixedReport.fusedPaps == 0 &&
+                  fixedReport.underSaturatedPaps == 0 &&
+                  fixedReport.exactlySaturatedPaps == 0 &&
+                  fixedReport.overSaturatedPaps == 0 &&
+                  fixedReport.inputRoot == report.outputRoot &&
+                  fixedReport.outputRoot == report.outputRoot &&
+                  IxIR1.Optimizer.graphRoot fixed.targetArtifacts fixed.main ==
+                    report.outputRoot
+
+/-! Scalar constructor-fetch forwarding fixture. -/
+
+def fetchForwardConstructorBlock : Address := Address.replicate 0xe3
+
+def fetchForwardCtor : IxIR1.CtorId :=
+  ⟨fetchForwardConstructorBlock, 0, 0⟩
+
+/-- One projection follows an in-place reuse and one follows a fresh
+allocation.  The second constructor stores the first projected scalar, which
+also exercises de Bruijn lifting across the retained allocation binder. -/
+def fetchForwardRawMain : IxIR1.Code :=
+  .letOp (.alloc .unique fetchForwardCtor #[.lit (.nat 7)])
+    (.letOp (.reuse (.var 0) fetchForwardCtor #[.lit (.nat 41)])
+      (.letOp (.fetch (.var 0) 0)
+        (.letOp (.alloc .unique fetchForwardCtor #[.var 0])
+          (.letOp (.fetch (.var 0) 0)
+            (.letOp (.free (.var 1))
+              (.letOp (.free (.var 4))
+                (.ret (.var 2))))))))
+
+private def hasFetchForwardShape : IxIR1.Code → Bool
+  | .letOp (.alloc .unique _ #[.lit (.nat 7)])
+      (.letOp (.reuse (.var 0) _ #[.lit (.nat 41)])
+        (.letOp (.pure (.lit (.nat 41)))
+          (.letOp (.alloc .unique _ #[.var 0])
+            (.letOp (.pure (.var 1)) _)))) => true
+  | _ => false
+
+private def isFetchForwardResult :
+    Except IxIR1.Err (IxIR1.Store × IxIR1.RVal) → Bool
+  | .ok (store, .lit (.nat 41)) =>
+      store.live == 0 && store.allocs == 2 && store.reuses == 1 &&
+        store.frees == 2
+  | _ => false
+
+/-- The whole-program harness forwards certified scalar fields after both
+allocation kinds, rejects heap and out-of-range sources, preserves exact
+execution counters/results, and reaches a fixed point after HPT recomputation. -/
+def fetchForwardHarnessOk : Bool :=
+  match IxIR1.ReaddressAll.run [fetchForwardConstructorBlock] []
+      fetchForwardRawMain with
+  | .error _ => false
+  | .ok program =>
+      let artifact := artifactWithMain program program.main
+      match artifact.produceHPT with
+      | .error _ => false
+      | .ok production =>
+          let policy := IxIR1.Optimizer.defaultPolicy
+          let (optimized, report) :=
+            artifact.optimizeWithProducedHPT policy production
+          let oldCtx : IxIR1.Ctx := { decls := artifact.targetDeclEnv }
+          let newCtx : IxIR1.Ctx := { decls := optimized.targetDeclEnv }
+          let rewritten := IxIR1.HPT.OptimizeProgram.rewriteMain {}
+            artifact.targetDeclEnv production.certificate.summaryEnv
+            artifact.main
+          let fetchRest : IxIR1.Code :=
+            .letOp (.fetch (.var 0) 0) (.ret (.var 0))
+          let rejectsHeapSource :=
+            (IxIR1.HPT.FetchForward.forwardHead? [IxIR1.HPT.Fact.top]
+              (.alloc .unique fetchForwardCtor #[.var 0]) fetchRest).isNone
+          let rejectsMissingField :=
+            (IxIR1.HPT.FetchForward.forwardHead? []
+              (.alloc .unique fetchForwardCtor #[.lit (.nat 1)])
+              (.letOp (.fetch (.var 0) 1) (.ret (.var 0)))).isNone
+          let acceptsReuse :=
+            match IxIR1.HPT.FetchForward.forwardHead? []
+                (.reuse .erased fetchForwardCtor #[.lit (.nat 41)])
+                fetchRest with
+            | some forwarding =>
+                forwarding.kind == .reuse &&
+                  forwarding.source == .lit (.nat 41)
+            | none => false
+          report.disposition == .changed &&
+            report.removedAlternatives == 0 &&
+            report.collapsedCases == 0 &&
+            report.materializedFetches == 0 &&
+            report.forwardedFetches == 2 &&
+            report.fusedPaps == 0 &&
+            report.before.counts.fetches == 2 &&
+            report.after.counts.fetches == 0 &&
+            report.before.counts.allocations == 2 &&
+            report.after.counts.allocations == 2 &&
+            report.before.counts.reuses == 1 &&
+            report.after.counts.reuses == 1 &&
+            rewritten.changes.fetchForward.afterAllocations == 1 &&
+            rewritten.changes.fetchForward.afterReuses == 1 &&
+            hasFetchForwardShape optimized.main &&
+            rejectsHeapSource && rejectsMissingField && acceptsReuse &&
+            isFetchForwardResult (IxIR1.runMain oldCtx artifact.main 64) &&
+            isFetchForwardResult (IxIR1.runMain newCtx optimized.main 64) &&
+            match optimized.produceHPT with
+            | .error _ => false
+            | .ok secondProduction =>
+                let (fixed, fixedReport) :=
+                  optimized.optimizeWithProducedHPT policy secondProduction
+                fixedReport.disposition == .unchanged &&
+                  fixedReport.forwardedFetches == 0 &&
+                  fixedReport.inputRoot == report.outputRoot &&
+                  fixedReport.outputRoot == report.outputRoot &&
+                  fixed.main.bytes == optimized.main.bytes
+
+def underclaimed (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  certificate result .bottom .scalar
+
+def noncanonical (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  let constructor := finalAddress result rawConstructor
+  let duplicate : IxIR1.HPT.Fact :=
+    ⟨false, false,
+      [.ctor constructorId (some [IxIR1.HPT.FieldFact.scalar]),
+       .ctor constructorId (some [IxIR1.HPT.FieldFact.scalar])]⟩
+  ⟨(preciseCertificate result).artifacts.map fun artifact =>
+    { artifact with members := artifact.members.map fun member =>
+        if member.1 == constructor then (member.1, duplicate) else member }⟩
+
+def wrongIdentity (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  match (preciseCertificate result).artifacts with
+  | [] => preciseCertificate result
+  | first :: rest =>
+      ⟨{ first with programIdentity := Address.replicate 0xee } :: rest⟩
+
+def excessiveShapeIndex (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  let constructor := finalAddress result rawConstructor
+  let oversized := IxIR1.HPT.Fact.heap
+    (.ctor ⟨constructorBlock, 0, 1⟩ none)
+  ⟨(preciseCertificate result).artifacts.map fun artifact =>
+    { artifact with members := artifact.members.map fun member =>
+        if member.1 == constructor then (member.1, oversized) else member }⟩
+
+def fieldRootShapeCertificate (result : IxIR1.ReaddressAll.Result)
+    (identity : IxIR1.CtorId) : IxIR1.HPT.Certificate :=
+  let constructor := finalAddress result rawConstructor
+  let nested := IxIR1.HPT.Fact.heap
+    (.ctor constructorId
+      (some [IxIR1.HPT.FieldFact.heap (.ctor identity none)]))
+  ⟨(preciseCertificate result).artifacts.map fun artifact =>
+    { artifact with members := artifact.members.map fun member =>
+        if member.1 == constructor then (member.1, nested) else member }⟩
+
+def exactLimits : IxIR1.HPT.Limits :=
+  { maxProgramArtifacts := 5
+    maxProgramMembers := 6
+    maxCertificateArtifacts := 5
+    maxCertificateMembers := 6
+    maxShapesPerFact := 1
+    maxShapes := 1
+    maxFieldsPerShape := 1
+    maxFields := 1
+    maxFieldDepth := 1
+    maxShapeIndex := 0 }
+
+def expectedStats : IxIR1.HPT.Stats :=
+  { programArtifacts := 5
+    programMembers := 6
+    certificateArtifacts := 5
+    certificateMembers := 6
+    shapes := 1
+    fields := 1
+    fieldDepth := 1 }
+
+def isError {α : Type} : Except String α → Bool
+  | .error _ => true
+  | .ok _ => false
+
+def resourceBudgetsOk (result : IxIR1.ReaddressAll.Result) : Bool :=
+  let candidate := preciseCertificate result
+  let fieldRoot := fieldRootShapeCertificate result constructorId
+  let excessiveFieldRoot := fieldRootShapeCertificate result
+    ⟨constructorBlock, 0, 1⟩
+  let fieldRootLimits := { exactLimits with maxShapes := 2 }
+  match IxIR1.HPT.preflight exactLimits result.artifacts candidate,
+      IxIR1.HPT.runWith exactLimits result.artifacts candidate,
+      IxIR1.HPT.preflight fieldRootLimits result.artifacts fieldRoot with
+  | .ok stats, .ok analysis, .ok fieldRootStats =>
+      stats == expectedStats && analysis.semanticAudit &&
+        fieldRootStats == { expectedStats with shapes := 2 } &&
+        isError (IxIR1.HPT.runWith
+          { exactLimits with maxProgramArtifacts := 4 }
+          result.artifacts candidate) &&
+        isError (IxIR1.HPT.runWith
+          { exactLimits with maxCertificateMembers := 5 }
+          result.artifacts candidate) &&
+        isError (IxIR1.HPT.runWith
+          { exactLimits with maxShapes := 0 }
+          result.artifacts candidate) &&
+        isError (IxIR1.HPT.runWith
+          { exactLimits with maxFieldsPerShape := 0 }
+          result.artifacts candidate) &&
+        isError (IxIR1.HPT.runWith
+          { exactLimits with maxFields := 0 }
+          result.artifacts candidate) &&
+        isError (IxIR1.HPT.runWith
+          { exactLimits with maxFieldDepth := 0 }
+          result.artifacts candidate) &&
+        isError (IxIR1.HPT.preflight exactLimits result.artifacts fieldRoot) &&
+        isError (IxIR1.HPT.preflight fieldRootLimits result.artifacts
+          excessiveFieldRoot) &&
+        isError (IxIR1.HPT.runWith exactLimits result.artifacts
+          (excessiveShapeIndex result))
+  | _, _, _ => false
+
+def rejectsBadCertificates (result : IxIR1.ReaddressAll.Result) : Bool :=
+  !(underclaimed result).postFixpoint result.artifacts &&
+    !(noncanonical result).postFixpoint result.artifacts &&
+    !(wrongIdentity result).postFixpoint result.artifacts &&
+    !(preciseCertificate result).postFixpoint result.artifacts.reverse &&
+    match IxIR1.HPT.run result.artifacts (underclaimed result),
+        IxIR1.HPT.run result.artifacts (noncanonical result),
+        IxIR1.HPT.run result.artifacts (wrongIdentity result) with
+    | .error _, .error _, .error _ => true
+    | _, _, _ => false
+
+def pipelineTopOk (artifact : Pipeline.Artifact) : Bool :=
+  match artifact.checkHPT
+      (IxIR1.HPT.Certificate.top artifact.targetArtifacts) with
+  | .ok analysis =>
+      analysis.semanticAudit &&
+        analysis.artifacts.length == artifact.targetArtifacts.length
+  | .error _ => false
+
+def pipelineProducerOk (artifact : Pipeline.Artifact) : Bool :=
+  match artifact.produceHPT with
+  | .ok production =>
+      production.certificate.postFixpoint artifact.targetArtifacts &&
+        production.result.semanticAudit
+  | .error _ => false
+
+def pipelineCacheOk (artifact : Pipeline.Artifact) : Bool :=
+  match artifact.produceHPTCached ⟨[]⟩ with
+  | .error _ => false
+  | .ok cold =>
+      match artifact.produceHPTCached cold.completeStore with
+      | .error _ => false
+      | .ok warm =>
+          cold.certificate.postFixpoint artifact.targetArtifacts &&
+            cold.result.semanticAudit &&
+            warm.result == cold.result &&
+            warm.stats.hits == artifact.targetArtifacts.length &&
+            warm.stats.misses == 0
+
+private def cleanupCacheFixture (directory path : System.FilePath) : IO Unit := do
+  try IO.FS.removeFile path catch _ => pure ()
+  try IO.FS.removeDir path catch _ => pure ()
+  try IO.FS.removeDirAll directory catch _ => pure ()
+
+private def cacheTransactionDirsAbsent (directory : System.FilePath) :
+    IO Bool := do
+  let entries ← directory.readDir
+  return !(entries.any fun entry =>
+    IxIR1.HPT.CacheIO.isTransactionDirectoryName entry.fileName)
+
+/-- Exercise the production pipeline's absent-file cold start and exact warm
+reuse through the bounded filesystem adapter. -/
+def pipelineCacheFileOk (artifact : Pipeline.Artifact) : IO Bool := do
+  try
+    let directory ← IO.FS.createTempDir
+    let path := directory / "compilatrix-pipeline-hpt.cache"
+    let result ← try
+      match ← artifact.produceHPTCachedFile path with
+      | .error _ => pure false
+      | .ok cold =>
+          match ← artifact.produceHPTCachedFile path with
+          | .error _ => pure false
+          | .ok warm =>
+              pure (cold.stats.misses == artifact.targetArtifacts.length &&
+                warm.stats.hits == artifact.targetArtifacts.length &&
+                warm.stats.misses == 0 && warm.result == cold.result)
+      catch _ => pure false
+    cleanupCacheFixture directory path
+    return result
+  catch _ => return false
+
+/-- Exercise the pipeline's metadata-indexed, lazily loaded cache-directory
+entry point through an absent-directory cold start and exact warm reuse. -/
+def pipelineCacheDirectoryOk (artifact : Pipeline.Artifact) : IO Bool := do
+  try
+    let parent ← IO.FS.createTempDir
+    let directory := parent / "compilatrix-pipeline-hpt-chunks"
+    let result ← try
+      match ← artifact.produceHPTCachedDirectory directory with
+      | .error _ => pure false
+      | .ok cold =>
+          match ← artifact.produceHPTCachedDirectory directory,
+              ← IxIR1.HPT.CacheDirIO.indexDirectory directory with
+          | .ok warm, .ok index =>
+              pure (cold.stats.misses == artifact.targetArtifacts.length &&
+                cold.stats.writes == artifact.targetArtifacts.length &&
+                warm.stats.hits == artifact.targetArtifacts.length &&
+                warm.stats.misses == 0 && warm.result == cold.result &&
+                index.ingress.entries == artifact.targetArtifacts.length)
+          | _, _ => pure false
+      catch _ => pure false
+    cleanupCacheFixture parent directory
+    return result
+  catch _ => return false
+
+/-- Persist, reload, reject an outer framing corruption, and locally repair a
+canonically framed store containing one malformed record. -/
+def persistentCacheFileOk (program : IxIR1.ReaddressAll.Result) : IO Bool := do
+  try
+    let directory ← IO.FS.createTempDir
+    let path := directory / "compilatrix-hpt.cache"
+    let result ← try
+      match ← IxIR1.HPT.CacheIO.refreshFile program.artifacts path with
+      | .error _ => pure false
+      | .ok cold =>
+          match ← IxIR1.HPT.CacheIO.refreshFile program.artifacts path,
+              ← IxIR1.HPT.CacheIO.loadFile path with
+          | .ok warm, .ok loaded =>
+              let durableSyncKinds ←
+                match ← (Ix.Compiler.DurableSync.file path).toBaseIO,
+                    ← (Ix.Compiler.DurableSync.directory directory).toBaseIO,
+                    ← (Ix.Compiler.DurableSync.file directory).toBaseIO,
+                    ← (Ix.Compiler.DurableSync.directory path).toBaseIO with
+                | .ok (), .ok (), .error _, .error _ => pure true
+                | _, _, _, _ => pure false
+              let cleanAfterWarm ← cacheTransactionDirsAbsent directory
+              let encoded := IxIR1.HPT.Cache.encodeStore loaded
+              let persistedBytes ← IO.FS.readBinFile path
+              let exactBoundary ←
+                match ← IxIR1.HPT.CacheIO.loadFileWith
+                    { IxIR1.HPT.Cache.defaultLimits with
+                      maxStoreBytes := encoded.size } path with
+                | .ok exact => pure (exact == loaded)
+                | .error _ => pure false
+              let streamedCodecExact :=
+                loaded.framedSize == encoded.size && persistedBytes == encoded
+              let orphanName :=
+                IxIR1.HPT.CacheIO.transactionDirectoryPrefix ++
+                  "interrupted" ++
+                  IxIR1.HPT.CacheIO.transactionDirectorySuffix
+              let orphan := directory / orphanName
+              IO.FS.createDir orphan
+              IO.FS.writeBinFile (orphan / "store") (ByteArray.mk #[0xde, 0xad])
+              let orphanIgnored ←
+                match ← IxIR1.HPT.CacheIO.loadFile path with
+                | .ok unchanged => pure (unchanged == loaded)
+                | .error _ => pure false
+              try IO.FS.removeFile (orphan / "store") catch _ => pure ()
+              try IO.FS.removeDir orphan catch _ => pure ()
+              match loaded.entries with
+              | [] => pure false
+              | entry :: _ =>
+                  let malformed := loaded.applyWrites
+                    [(entry.1, entry.2 ++ ByteArray.mk #[0])]
+                  match ← IxIR1.HPT.CacheIO.saveFile path malformed with
+                  | .error _ => pure false
+                  | .ok () =>
+                      let replacementCommitted ←
+                        match ← IxIR1.HPT.CacheIO.loadFile path with
+                        | .ok committed =>
+                            pure (committed == malformed.canonicalize)
+                        | .error _ => pure false
+                      let cleanAfterReplace ←
+                        cacheTransactionDirsAbsent directory
+                      match ← IxIR1.HPT.CacheIO.refreshFile
+                          program.artifacts path with
+                      | .error _ => pure false
+                      | .ok repaired =>
+                          match ← IxIR1.HPT.CacheIO.refreshFile
+                              program.artifacts path with
+                          | .error _ => pure false
+                          | .ok rewarmed =>
+                              IO.FS.writeBinFile path
+                                (encoded ++ ByteArray.mk #[0])
+                              let outerRejected ←
+                                IxIR1.HPT.CacheIO.loadFile path
+                              let tooSmall ← IxIR1.HPT.CacheIO.loadFileWith
+                                { IxIR1.HPT.Cache.defaultLimits with
+                                  maxStoreBytes := encoded.size - 1 } path
+                              IO.FS.writeBinFile path
+                                (IxIR1.HPT.Cache.storeDomain ++
+                                  ByteArray.mk #[128, 0])
+                              let overlongCount ←
+                                IxIR1.HPT.CacheIO.loadFile path
+                              IO.FS.writeBinFile path
+                                (encoded.extract 0 (encoded.size - 1))
+                              let truncatedRecord ←
+                                IxIR1.HPT.CacheIO.loadFile path
+                              let reversedBytes :=
+                                IxIR1.HPT.Cache.storeDomain ++
+                                  IxIR.Encoding.list cacheStoreEntryBytes
+                                    loaded.entries.reverse
+                              IO.FS.writeBinFile path reversedBytes
+                              let reversedOrder ←
+                                IxIR1.HPT.CacheIO.loadFile path
+                              try IO.FS.removeFile path catch _ => pure ()
+                              IO.FS.createDir path
+                              let nonFileLoad ←
+                                IxIR1.HPT.CacheIO.loadFile path
+                              let nonFileSave ←
+                                IxIR1.HPT.CacheIO.saveFile path loaded
+                              pure (cold.stats.misses ==
+                                  program.artifacts.length &&
+                                warm.stats.hits == program.artifacts.length &&
+                                repaired.stats.hits + 1 ==
+                                  program.artifacts.length &&
+                                repaired.stats.misses == 1 &&
+                                repaired.stats.rejected == 1 &&
+                                rewarmed.stats.hits == program.artifacts.length &&
+                                streamedCodecExact && exactBoundary &&
+                                durableSyncKinds &&
+                                cleanAfterWarm && orphanIgnored &&
+                                replacementCommitted && cleanAfterReplace &&
+                                cacheIsError outerRejected &&
+                                cacheIsError tooSmall &&
+                                cacheIsError overlongCount &&
+                                cacheIsError truncatedRecord &&
+                                cacheIsError reversedOrder &&
+                                cacheIsError nonFileLoad &&
+                                cacheIsError nonFileSave)
+          | _, _ => pure false
+      catch _ => pure false
+    cleanupCacheFixture directory path
+    return result
+  catch _ => return false
+
+/-- Exercise metadata-only indexing, dependency-selected lazy reads, durable
+per-record writes, stale-malformed isolation, selected-record repair, and exact
+directory/read budgets. -/
+def persistentCacheDirectoryOk (program : IxIR1.ReaddressAll.Result) : IO Bool := do
+  try
+    let parent ← IO.FS.createTempDir
+    let directory := parent / "compilatrix-hpt-chunks"
+    let result ← try
+      match ← IxIR1.HPT.CacheDirIO.refreshDirectory program.artifacts directory with
+      | .error _ => pure false
+      | .ok cold =>
+          match ← IxIR1.HPT.CacheDirIO.refreshDirectory program.artifacts directory,
+              ← IxIR1.HPT.CacheDirIO.indexDirectory directory with
+          | .ok warm, .ok initialIndex =>
+              let cleanAfterWarm ← cacheTransactionDirsAbsent directory
+              let staleKey := Ixon.Address.replicate 0xe7
+              if cold.writes.any (fun write => write.1 == staleKey) then
+                pure false
+              else
+                let stalePath := directory /
+                  IxIR1.HPT.CacheDirIO.recordFileName staleKey
+                IO.FS.writeBinFile stalePath (ByteArray.mk #[0xde, 0xad])
+                let orphan := directory /
+                  (IxIR1.HPT.CacheIO.transactionDirectoryPrefix ++
+                    "interrupted" ++
+                    IxIR1.HPT.CacheIO.transactionDirectorySuffix)
+                IO.FS.createDir orphan
+                IO.FS.writeBinFile (orphan / "record")
+                  (ByteArray.mk #[0xba, 0xd0])
+                match ← IxIR1.HPT.CacheDirIO.refreshDirectory
+                    program.artifacts directory,
+                    ← IxIR1.HPT.CacheDirIO.indexDirectory directory with
+                | .ok staleWarm, .ok indexedWithStale =>
+                    try IO.FS.removeFile (orphan / "record") catch _ => pure ()
+                    try IO.FS.removeDir orphan catch _ => pure ()
+                    let exactIndexLimits :=
+                      { IxIR1.HPT.CacheDirIO.defaultLimits with
+                        maxIndexEntries := indexedWithStale.ingress.entries
+                        maxIndexBytes := indexedWithStale.ingress.bytes }
+                    let exactIndex ← IxIR1.HPT.CacheDirIO.indexDirectoryWith
+                      exactIndexLimits directory
+                    let entryOneBelow ← IxIR1.HPT.CacheDirIO.indexDirectoryWith
+                      { exactIndexLimits with
+                        maxIndexEntries :=
+                          indexedWithStale.ingress.entries - 1 } directory
+                    let bytesOneBelow ← IxIR1.HPT.CacheDirIO.indexDirectoryWith
+                      { exactIndexLimits with
+                        maxIndexBytes := indexedWithStale.ingress.bytes - 1 }
+                      directory
+                    match cold.writes with
+                    | [] => pure false
+                    | selected :: _ =>
+                        let selectedPath := directory /
+                          IxIR1.HPT.CacheDirIO.recordFileName selected.1
+                        IO.FS.writeBinFile selectedPath
+                          (ByteArray.mk #[0xca, 0xfe])
+                        match ← IxIR1.HPT.CacheDirIO.refreshDirectory
+                            program.artifacts directory with
+                        | .error _ => pure false
+                        | .ok repaired =>
+                            match ← IxIR1.HPT.CacheDirIO.refreshDirectory
+                                program.artifacts directory with
+                            | .error _ => pure false
+                            | .ok rewarmed =>
+                                let payloadBytes := cold.completeStore.entries.foldl
+                                  (fun total entry => total + entry.2.size) 0
+                                let exactReadLimits :=
+                                  { IxIR1.HPT.CacheDirIO.defaultLimits with
+                                    maxReadBytes := payloadBytes }
+                                let exactRead ←
+                                  IxIR1.HPT.CacheDirIO.refreshDirectoryWith
+                                    exactReadLimits program.artifacts directory
+                                let readOneBelow ←
+                                  IxIR1.HPT.CacheDirIO.refreshDirectoryWith
+                                    { exactReadLimits with
+                                      maxReadBytes := payloadBytes - 1 }
+                                    program.artifacts directory
+                                let cleanAfterRepair ←
+                                  cacheTransactionDirsAbsent directory
+                                let canonicalNameOk :=
+                                  IxIR1.HPT.CacheDirIO.recordAddress?
+                                      (IxIR1.HPT.CacheDirIO.recordFileName
+                                        staleKey) == some staleKey &&
+                                    (IxIR1.HPT.CacheDirIO.recordAddress?
+                                      (staleKey.toHex ++ ".HPT")).isNone
+                                let unknownPath := directory / "unexpected"
+                                IO.FS.writeBinFile unknownPath
+                                  (ByteArray.mk #[0])
+                                let unknownRejected ←
+                                  IxIR1.HPT.CacheDirIO.indexDirectory directory
+                                try IO.FS.removeFile unknownPath catch _ => pure ()
+                                pure (cold.stats.misses ==
+                                    program.artifacts.length &&
+                                  cold.stats.writes == program.artifacts.length &&
+                                  warm.stats.hits == program.artifacts.length &&
+                                  initialIndex.ingress.entries ==
+                                    program.artifacts.length &&
+                                  staleWarm.stats.hits ==
+                                    program.artifacts.length &&
+                                  staleWarm.stats.rejected == 0 &&
+                                  indexedWithStale.ingress.entries ==
+                                    program.artifacts.length + 1 &&
+                                  repaired.stats.hits + 1 ==
+                                    program.artifacts.length &&
+                                  repaired.stats.misses == 1 &&
+                                  repaired.stats.rejected == 1 &&
+                                  rewarmed.stats.hits == program.artifacts.length &&
+                                  rewarmed.stats.misses == 0 &&
+                                  cleanAfterWarm && cleanAfterRepair &&
+                                  !cacheIsError exactIndex &&
+                                  cacheIsError entryOneBelow &&
+                                  cacheIsError bytesOneBelow &&
+                                  !cacheIsError exactRead &&
+                                  cacheIsError readOneBelow &&
+                                  canonicalNameOk &&
+                                  cacheIsError unknownRejected)
+                | _, _ => pure false
+          | _, _ => pure false
+      catch _ => pure false
+    cleanupCacheFixture parent directory
+    return result
+  catch _ => return false
+
+def producerExactLimits : IxIR1.HPT.ProducerLimits :=
+  { maxRoundsPerArtifact := 3
+    maxRounds := 9 }
+
+def producerOneBelowLimits : IxIR1.HPT.ProducerLimits :=
+  { maxRoundsPerArtifact := 3
+    maxRounds := 8 }
+
+def producerLocalOneBelowLimits : IxIR1.HPT.ProducerLimits :=
+  { maxRoundsPerArtifact := 2
+    maxRounds := 9 }
+
+def producerShapeFallbackLimits : IxIR1.HPT.ProducerLimits :=
+  { checker := { IxIR1.HPT.defaultLimits with
+      maxShapesPerFact := 0
+      maxShapes := 0 }
+    maxRoundsPerArtifact := 3
+    maxRounds := 9 }
+
+def producerFieldFallbackLimits : IxIR1.HPT.ProducerLimits :=
+  { checker := { IxIR1.HPT.defaultLimits with
+      maxFieldsPerShape := 0
+      maxFields := 0 }
+    maxRoundsPerArtifact := 3
+    maxRounds := 9 }
+
+def producerOk (program : IxIR1.ReaddressAll.Result) : Bool :=
+  match IxIR1.HPT.produce program.artifacts,
+      IxIR1.HPT.produce program.artifacts,
+      IxIR1.HPT.produceWith producerExactLimits program.artifacts,
+      IxIR1.HPT.produceWith producerOneBelowLimits program.artifacts,
+      IxIR1.HPT.produceWith producerLocalOneBelowLimits program.artifacts,
+      IxIR1.HPT.produceWith producerShapeFallbackLimits program.artifacts,
+      IxIR1.HPT.produceWith producerFieldFallbackLimits program.artifacts with
+  | .ok first, .ok second, .ok exact, .ok oneBelow, .ok localOneBelow,
+      .ok shapeFallback, .ok fieldFallback =>
+      first.certificate == preciseCertificate program &&
+        first.result == second.result &&
+        first.certificate == second.certificate &&
+        first.stats == { rounds := 9, widenedArtifacts := 0 } &&
+        exact.certificate == preciseCertificate program &&
+        exact.stats == { rounds := 9, widenedArtifacts := 0 } &&
+        oneBelow.certificate.postFixpoint program.artifacts &&
+        oneBelow.result.semanticAudit &&
+        oneBelow.stats == { rounds := 8, widenedArtifacts := 1 } &&
+        oneBelow.certificate != preciseCertificate program &&
+        localOneBelow.certificate.postFixpoint program.artifacts &&
+        localOneBelow.result.semanticAudit &&
+        localOneBelow.stats == { rounds := 8, widenedArtifacts := 1 } &&
+        localOneBelow.certificate == oneBelow.certificate &&
+        shapeFallback.certificate.postFixpoint program.artifacts &&
+        shapeFallback.result.semanticAudit &&
+        shapeFallback.stats.widenedArtifacts == 1 &&
+        fieldFallback.certificate.postFixpoint program.artifacts &&
+        fieldFallback.result.semanticAudit &&
+        fieldFallback.stats.widenedArtifacts == 1
+  | _, _, _, _, _, _, _ => false
+
+/-- The accepted detailed constructor row covers every successful concrete
+invocation, including the exact scalar field stored by the fixture. -/
+theorem detailedConstructorAcceptedFact_sound
+    {result : IxIR1.ReaddressAll.Result} {analysis : IxIR1.HPT.Result}
+    {ctx : IxIR1.Ctx} {arguments : List IxIR1.RVal}
+    {store outputStore : IxIR1.Store} {outputValue : IxIR1.RVal}
+    {fuel : Nat}
+    (hcheck : IxIR1.HPT.run result.artifacts
+      (preciseCertificate result) = .ok analysis)
+    (hctx : ctx.decls = IxIR1.HPT.programDeclEnv result.artifacts)
+    (hdeclaration : IxIR1.HPT.programDeclEnv result.artifacts
+      (finalAddress result rawConstructor) = some constructorDeclaration)
+    (hsummary : (preciseCertificate result).summaryEnv
+      (finalAddress result rawConstructor) = some detailedConstructorFact)
+    (hinvoke : IxIR1.invoke ctx fuel (finalAddress result rawConstructor)
+      arguments store = .ok (outputStore, outputValue)) :
+    detailedConstructorFact.Holds
+      (IxIR1.HPT.programDeclEnv result.artifacts) outputStore outputValue := by
+  exact IxIR1.HPT.functionSummary_sound_of_run_eq_ok hcheck hctx
+    hdeclaration hsummary hinvoke
+
+/-- A checked scalar row inferred through a constructor field binder covers
+every successful concrete invocation of that addressed caller. -/
+theorem caseBinderAcceptedFact_sound
+    {result : IxIR1.ReaddressAll.Result} {analysis : IxIR1.HPT.Result}
+    {ctx : IxIR1.Ctx} {function : IxIR1.FnDef}
+    {arguments : List IxIR1.RVal}
+    {store outputStore : IxIR1.Store} {outputValue : IxIR1.RVal}
+    {fuel : Nat}
+    (hcheck : IxIR1.HPT.run result.artifacts
+      (preciseCertificate result) = .ok analysis)
+    (hctx : ctx.decls = IxIR1.HPT.programDeclEnv result.artifacts)
+    (hdeclaration : IxIR1.HPT.programDeclEnv result.artifacts
+      (finalAddress result rawCaseBinder) = some (.fn function))
+    (hsummary : (preciseCertificate result).summaryEnv
+      (finalAddress result rawCaseBinder) = some IxIR1.HPT.Fact.scalar)
+    (hinvoke : IxIR1.invoke ctx fuel (finalAddress result rawCaseBinder)
+      arguments store = .ok (outputStore, outputValue)) :
+    IxIR1.HPT.Fact.scalar.Holds
+      (IxIR1.HPT.programDeclEnv result.artifacts) outputStore outputValue := by
+  exact IxIR1.HPT.functionSummary_sound_of_run_eq_ok hcheck hctx
+    hdeclaration hsummary hinvoke
+
+/-! Alias safety under in-place reuse.  This intentionally is not well-moded:
+`pure` keeps two names for one unique location.  The evaluator nevertheless
+executes it, so result-shape soundness cannot retain constructor A on the old
+alias after another alias reuses the node as constructor B. -/
+
+def aliasRawFunction : Address := Address.replicate 0xdb
+def aliasConstructorBlock : Address := Address.replicate 0xdc
+
+def aliasCtorA : IxIR1.CtorId := ⟨aliasConstructorBlock, 0, 0⟩
+def aliasCtorB : IxIR1.CtorId := ⟨aliasConstructorBlock, 0, 1⟩
+
+def aliasReuseDeclaration : IxIR1.Decl :=
+  .fn ⟨0, .unique, false,
+    .letOp (.alloc .unique aliasCtorA #[])
+      (.letOp (.pure (.var 0))
+        (.letOp (.reuse (.var 0) aliasCtorB #[])
+          (.ret (.var 1))))⟩
+
+def aliasAddressed : Except String IxIR1.ReaddressAll.Result :=
+  IxIR1.ReaddressAll.run [aliasConstructorBlock]
+    [(aliasRawFunction, aliasReuseDeclaration)]
+    (.letOp (.call aliasRawFunction #[]) (.ret (.var 0)))
+
+def aliasFinalFunction (result : IxIR1.ReaddressAll.Result) : Address :=
+  IxIR1.Readdress.Renaming.apply result.addressMap aliasRawFunction
+
+def aliasUnknownFact : IxIR1.HPT.Fact := ⟨false, true, []⟩
+
+def aliasCertificate (result : IxIR1.ReaddressAll.Result)
+    (claim : IxIR1.HPT.Fact) : IxIR1.HPT.Certificate :=
+  ⟨result.artifacts.map fun artifact =>
+    { programIdentity := programIdentity artifact
+      members := artifact.declarations.map fun member => (member.1, claim) }⟩
+
+def aliasExactCertificate (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  aliasCertificate result (IxIR1.HPT.Fact.heap (.ctor aliasCtorA none))
+
+def aliasUnknownCertificate (result : IxIR1.ReaddressAll.Result) :
+    IxIR1.HPT.Certificate :=
+  aliasCertificate result aliasUnknownFact
+
+def aliasReuseRegressionOk (result : IxIR1.ReaddressAll.Result) : Bool :=
+  let exact := aliasExactCertificate result
+  let unknown := aliasUnknownCertificate result
+  let declarations := IxIR1.HPT.programDeclEnv result.artifacts
+  let ctx : IxIR1.Ctx := { decls := declarations }
+  !exact.postFixpoint result.artifacts &&
+    unknown.postFixpoint result.artifacts &&
+    match IxIR1.HPT.run result.artifacts exact,
+        IxIR1.HPT.run result.artifacts unknown,
+        IxIR1.invoke ctx 16 (aliasFinalFunction result) [] {} with
+    | .error _, .ok analysis, .ok (store, .loc location) =>
+        analysis.semanticAudit && store.reuses == 1 &&
+          match store.get? location with
+          | some box => box.node == .ctorN aliasCtorB #[]
+          | none => false
+    | _, _, _ => false
+
+/-- The accepted unknown-heap row in the alias/reuse fixture covers any
+successful concrete result; in particular it cannot retain the overwritten
+constructor-A identity. -/
+theorem aliasReuseAcceptedFact_sound
+    {result : IxIR1.ReaddressAll.Result} {analysis : IxIR1.HPT.Result}
+    {ctx : IxIR1.Ctx} {arguments : List IxIR1.RVal}
+    {store outputStore : IxIR1.Store} {outputValue : IxIR1.RVal}
+    {fuel : Nat}
+    (hcheck : IxIR1.HPT.run result.artifacts
+      (aliasUnknownCertificate result) = .ok analysis)
+    (hctx : ctx.decls = IxIR1.HPT.programDeclEnv result.artifacts)
+    (hdeclaration : IxIR1.HPT.programDeclEnv result.artifacts
+      (aliasFinalFunction result) = some aliasReuseDeclaration)
+    (hsummary : (aliasUnknownCertificate result).summaryEnv
+      (aliasFinalFunction result) = some aliasUnknownFact)
+    (hinvoke : IxIR1.invoke ctx fuel (aliasFinalFunction result) arguments
+      store = .ok (outputStore, outputValue)) :
+    aliasUnknownFact.Holds (IxIR1.HPT.programDeclEnv result.artifacts)
+      outputStore outputValue := by
+  exact IxIR1.HPT.functionSummary_sound_of_run_eq_ok hcheck hctx
+    hdeclaration hsummary hinvoke
+
+end HPTFixtures
+
+/-! The six structural cases in ix's pinned Lean/Rust sharing parity suite,
+translated mechanically to Ixon v2's `.many`/`.shared` Lean fragment. -/
+
+namespace SharingPolicy
+
+def all (domain body : Expr) : Expr :=
+  .all .many .shared domain body
+
+def lam (domain body : Expr) : Expr :=
+  .lam .many domain body
+
+def simple : Array Expr :=
+  let t := Expr.ref 0 #[]
+  let e1 := all t (.sort 1)
+  let e2 := all t e1
+  let e3 := all t e2
+  #[all t e3]
+
+def contentHash : Array Expr := #[
+  all (.ref 0 #[]) (.sort 0),
+  all (.ref 0 #[]) (.sort 1),
+  all (.ref 0 #[]) (.sort 2)]
+
+def recursor : Array Expr :=
+  let tRef := Expr.ref 0 #[]
+  let target := all tRef (.app (.var 1) (.var 0))
+  let withMinor3 := all (.app (.var 3) (.ref 3 #[])) target
+  let withMinor2 := all (.app (.var 2) (.ref 2 #[])) withMinor3
+  let withMinor1 := all (.app (.var 1) (.ref 1 #[])) withMinor2
+  let motiveType := all tRef (.sort 1)
+  #[all motiveType withMinor1, .var 1, .var 2, .var 3]
+
+def forallImpReal : Array Expr :=
+  let typ := all (.sort 0)
+    (all (all (.var 0) (.sort 1))
+      (all (all (.var 1) (.sort 1))
+        (all
+          (all (.var 2)
+            (all (.app (.var 2) (.var 0))
+                 (.app (.var 2) (.var 1))))
+          (all
+            (all (.var 3) (.app (.var 3) (.var 0)))
+            (all (.var 4) (.app (.var 3) (.var 0)))))))
+  let value := lam (.sort 0)
+    (lam (all (.var 0) (.sort 1))
+      (lam (all (.var 1) (.sort 1))
+        (lam
+          (all (.var 2)
+            (all (.app (.var 2) (.var 0))
+                 (.app (.var 2) (.var 1))))
+          (lam
+            (all (.var 3) (.app (.var 3) (.var 0)))
+            (lam (.var 4)
+              (.app
+                (.app (.var 2) (.var 0))
+                (.app (.var 1) (.var 0))))))))
+  #[typ, value]
+
+def forallImpSharing : Array Expr :=
+  let app21 := Expr.app (.var 2) (.var 1)
+  let app20 := Expr.app (.var 2) (.var 0)
+  let e1 := all app21 app20
+  let e2 := all app20 app21
+  #[all (.var 3) e1, all (.var 3) e2]
+
+def flipCase : Array Expr :=
+  let innerAll := all (.var 2) (.var 2)
+  let funcType := all (.var 2) innerAll
+  let resultType := all (.var 2) (all (.var 4) (.var 3))
+  let typ := all (.sort 0)
+    (all (.sort 1)
+      (all (.sort 2) (all funcType resultType)))
+  let body := Expr.app (.app (.var 2) (.var 0)) (.var 1)
+  let value := lam (.sort 0)
+    (lam (.sort 1)
+      (lam (.sort 2)
+        (lam funcType
+          (lam (.var 2) (lam (.var 4) body)))))
+  #[typ, value]
+
+def simpleOutput : Sharing.Compression :=
+  { bodies := #[all (.share 0)
+      (all (.share 0) (all (.share 0) (all (.share 0) (.sort 1))))]
+    table := #[.ref 0 #[]] }
+
+def contentHashOutput : Sharing.Compression :=
+  { bodies := #[
+      all (.share 0) (.sort 0),
+      all (.share 0) (.sort 1),
+      all (.share 0) (.sort 2)]
+    table := #[.ref 0 #[]] }
+
+def recursorOutput : Sharing.Compression :=
+  { bodies := recursor, table := #[] }
+
+def forallImpSharingOutput : Sharing.Compression :=
+  { bodies := #[
+      all (.var 3) (all (.share 0) (.share 1)),
+      all (.var 3) (all (.share 1) (.share 0))]
+    table := #[
+      .app (.var 2) (.var 1),
+      .app (.var 2) (.var 0)] }
+
+/-- Exact eight-entry output captured from ix's v2 compressor at
+`Sharing.ixParityRevision`. The local exact-byte audit intentionally does not
+retain this nested table. -/
+def ixForallImpRealOutput : Sharing.Compression :=
+  { bodies := #[
+      all (.sort 0)
+        (all (.share 7)
+          (all (.share 3)
+            (all (.share 6)
+              (all (.share 2) (all (.var 4) (.share 1)))))),
+      lam (.sort 0)
+        (lam (.share 7)
+          (lam (.share 3)
+            (lam (.share 6)
+              (lam (.share 2)
+                (lam (.var 4)
+                  (.app (.share 4) (.app (.var 1) (.var 0))))))))]
+    table := #[
+      .app (.var 2) (.var 1),
+      .app (.var 3) (.var 0),
+      all (.var 3) (.share 1),
+      all (.var 1) (.sort 1),
+      .app (.var 2) (.var 0),
+      all (.share 4) (.share 0),
+      all (.var 2) (.share 5),
+      all (.var 0) (.sort 1)] }
+
+/-- Audited v2 output for `forall_imp`: three stale nested entries disappear,
+and the surviving mode-bearing representatives have v2 Merkle order. -/
+def v2ForallImpRealOutput : Sharing.Compression :=
+  { bodies := #[
+      all (.sort 0)
+        (all (.share 4)
+          (all (.share 2)
+            (all (.share 3)
+              (all (.share 1) (all (.var 4) (.share 0)))))),
+      lam (.sort 0)
+        (lam (.share 4)
+          (lam (.share 2)
+            (lam (.share 3)
+              (lam (.share 1)
+                (lam (.var 4)
+                  (.app (.app (.var 2) (.var 0))
+                    (.app (.var 1) (.var 0))))))))]
+    table := #[
+      .app (.var 3) (.var 0),
+      all (.var 3) (.share 0),
+      all (.var 1) (.sort 1),
+      all (.var 2)
+        (all (.app (.var 2) (.var 0)) (.app (.var 2) (.var 1))),
+      all (.var 0) (.sort 1)] }
+
+/-- Exact two-entry output captured from ix's v2 compressor at
+`Sharing.ixParityRevision`. -/
+def ixFlipOutput : Sharing.Compression :=
+  { bodies := #[
+      all (.sort 0)
+        (all (.sort 1)
+          (all (.sort 2)
+            (all (.share 1)
+              (all (.var 2) (all (.var 4) (.var 3)))))),
+      lam (.sort 0)
+        (lam (.sort 1)
+          (lam (.sort 2)
+            (lam (.share 1)
+              (lam (.var 2)
+                (lam (.var 4)
+                  (.app (.app (.var 2) (.var 0)) (.var 1)))))))]
+    table := #[
+      all (.var 2) (.var 2),
+      all (.var 2) (.share 0)] }
+
+/-- V2 keeps only the maximal two-binder telescope; sharing its inner suffix
+would split the canonical `all` run. -/
+def v2FlipOutput : Sharing.Compression :=
+  { bodies := #[
+      all (.sort 0)
+        (all (.sort 1)
+          (all (.sort 2)
+            (all (.share 0)
+              (all (.var 2) (all (.var 4) (.var 3)))))),
+      lam (.sort 0)
+        (lam (.sort 1)
+          (lam (.sort 2)
+            (lam (.share 0)
+              (lam (.var 2)
+                (lam (.var 4)
+                  (.app (.app (.var 2) (.var 0)) (.var 1)))))))]
+    table := #[all (.var 2) (all (.var 2) (.var 2))] }
+
+inductive Relation where
+  | exactParity
+  | intentionalV2Delta
+  deriving BEq, Repr
+
+structure Case where
+  name : String
+  input : Array Expr
+  ixOutput : Sharing.Compression
+  v2Output : Sharing.Compression
+  relation : Relation
+
+def cases : Array Case := #[
+  ⟨"simple", simple, simpleOutput, simpleOutput, .exactParity⟩,
+  ⟨"content-hash", contentHash, contentHashOutput, contentHashOutput,
+    .exactParity⟩,
+  ⟨"recursor", recursor, recursorOutput, recursorOutput, .exactParity⟩,
+  ⟨"forall-imp-sharing", forallImpSharing, forallImpSharingOutput,
+    forallImpSharingOutput, .exactParity⟩,
+  ⟨"forall-imp-real", forallImpReal, ixForallImpRealOutput,
+    v2ForallImpRealOutput, .intentionalV2Delta⟩,
+  ⟨"flip", flipCase, ixFlipOutput, v2FlipOutput, .intentionalV2Delta⟩]
+
+def putExprArray (exprs : Array Expr) : PutM Unit := do
+  putTag0 ⟨exprs.size.toUInt64⟩
+  for e in exprs do putExpr e
+
+def putCompression (c : Sharing.Compression) : PutM Unit := do
+  putExprArray c.bodies
+  putExprArray c.table
+
+/-- Canonically framed transcript of the inputs, pinned ix vectors, intended
+v2 vectors, and parity/delta classification. -/
+def transcript : ByteArray := runPut do
+  putTag0 ⟨cases.size.toUInt64⟩
+  for c in cases do
+    putU8 (match c.relation with | .exactParity => 0 | .intentionalV2Delta => 1)
+    putExprArray c.input
+    putCompression c.ixOutput
+    putCompression c.v2Output
+
+def fingerprint : Address := .blake3 transcript
+
+/-- `19aa227e6be89cbabef37366bdc3a48fcf1d8f856892054511ae6b6fcf1db4ce`.
+Bump only after reviewing both the pinned ix vector and the intended v2
+output for every case. -/
+def expectedFingerprint : List Nat :=
+  [25, 170, 34, 126, 107, 232, 156, 186,
+   190, 243, 115, 102, 189, 195, 164, 143,
+   207, 29, 143, 133, 104, 146, 5, 69,
+   17, 174, 107, 111, 207, 29, 180, 206]
+
+end SharingPolicy
+
+/-! Structured checked-ingress fixtures.  Every malformed constant below is
+still valid Ixon syntax, so its exact `DecodeCheck.Error` must come from the
+post-decode validator rather than from the raw parser. -/
+
+namespace DecodeCheckFixtures
+
+open DecodeCheck
+
+def address : Address := Address.replicate 0x5a
+
+def axiomConstant (lvls : UInt64) (typ : Expr) (refs : Array Address := #[])
+    (univs : Array Univ := #[]) (sharing : Array Expr := #[]) : Constant :=
+  { info := .axio { isUnsafe := false, lvls, typ }
+    sharing, refs, univs }
+
+def validAxiom : Constant :=
+  axiomConstant 1 (.app (.ref 0 #[0]) (.sort 0)) #[address] #[.var 0]
+
+def validShared : Constant :=
+  axiomConstant 0 (.app (.share 0) (.share 0)) #[] #[] #[.var 0]
+
+def validUniverse : Constant :=
+  axiomConstant 1 (.sort 0) #[]
+    #[.imax (.succ (.var 0)) (.max .zero (.var 0))]
+
+def validDefinition : Constant :=
+  { info := .defn
+      { kind := .thm, safety := .safe, lvls := 0
+        typ := .all .many .shared (.var 0) (.var 0)
+        value := .lam .many (.var 0)
+          (.letE false (.var 0) (.var 0) (.var 0)) }
+    sharing := #[], refs := #[], univs := #[] }
+
+def validMutualRecur : Constant :=
+  { info := .muts #[.defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .var 0, value := .recur 0 #[] }]
+    sharing := #[], refs := #[], univs := #[] }
+
+def invalidMutualRecur : Constant :=
+  { validMutualRecur with info := .muts #[.defn
+      { kind := .defn, safety := .safe, lvls := 0
+        typ := .var 0, value := .recur 1 #[] }] }
+
+def recursor (typ : Expr) (rules : Array RecursorRule) : Constant :=
+  { info := .recr
+      { k := false, isUnsafe := false, lvls := 0
+        params := 0, indices := 0, motives := 0, minors := 0
+        typ, rules }
+    sharing := #[], refs := #[], univs := #[] }
+
+def validRecursor : Constant :=
+  recursor
+    (.all .many .shared (.var 0) (.var 0))
+    #[{ fields := 1, rhs := .lam .many (.var 0) (.var 0) }]
+
+def invalidRecursorType : Constant := recursor (.var 0) #[]
+
+def invalidRecursorRule : Constant :=
+  recursor
+    (.all .many .shared (.var 0) (.var 0))
+    #[{ fields := 1, rhs := .var 0 }]
+
+def allN : Nat → Expr → Expr
+  | 0, body => body
+  | count + 1, body => .all .many .shared (.var 0) (allN count body)
+
+def lamN : Nat → Expr → Expr
+  | 0, body => body
+  | count + 1, body => .lam .many (.var 0) (lamN count body)
+
+def validRichRecursor : Constant :=
+  { info := .recr
+      { k := true, isUnsafe := true, lvls := 0
+        params := 1, indices := 2, motives := 3, minors := 4
+        typ := allN 11 (.var 0)
+        rules := #[{ fields := 5, rhs := lamN 13 (.var 0) }] }
+    sharing := #[], refs := #[], univs := #[] }
+
+def validInductiveBlock : Constant :=
+  { info := .muts #[.indc
+      { isUnsafe := true, lvls := 0, params := 2, indices := 3
+        typ := .var 0
+        ctors := #[
+          { isUnsafe := false, lvls := 0, cidx := 7, params := 2,
+            fields := 5, typ := .recur 0 #[] }] }]
+    sharing := #[], refs := #[], univs := #[] }
+
+def validQuotient : Constant :=
+  { info := .quot { kind := .ind, lvls := 0, typ := .var 0 }
+    sharing := #[], refs := #[], univs := #[] }
+
+def validProjections : Array Constant := #[
+  { info := .cPrj { idx := 1, cidx := 2, block := address }
+    sharing := #[], refs := #[], univs := #[] },
+  { info := .rPrj { idx := 3, block := address }
+    sharing := #[], refs := #[], univs := #[] },
+  { info := .iPrj { idx := 4, block := address }
+    sharing := #[], refs := #[], univs := #[] },
+  { info := .dPrj { idx := 5, block := address }
+    sharing := #[], refs := #[], univs := #[] }
+]
+
+/-- A positive corpus spanning every constant-info variant exercised by the
+checked decoder.  The fuzz harness mutates the exact encodings of these
+values, so it always contains successful inputs as well as malformed ones. -/
+def validConstants : Array Constant := #[
+  validAxiom,
+  validShared,
+  validUniverse,
+  validDefinition,
+  validMutualRecur,
+  validRecursor,
+  validRichRecursor,
+  validInductiveBlock,
+  validQuotient
+] ++ validProjections
+
+structure Case where
+  name : String
+  constant : Constant
+  expected : Except Error Constant
+
+def axiomSite : Site := ⟨none, .axiomType⟩
+
+def cases : Array Case := #[
+  ⟨"last valid ref/universe index", validAxiom, .ok validAxiom⟩,
+  ⟨"sharing is checked before inlining", validShared, .ok validShared⟩,
+  ⟨"recursive universe forms", validUniverse, .ok validUniverse⟩,
+  ⟨"definition and let forms", validDefinition, .ok validDefinition⟩,
+  ⟨"last valid mutual self index", validMutualRecur, .ok validMutualRecur⟩,
+  ⟨"valid recursor slicing counts", validRecursor, .ok validRecursor⟩,
+  ⟨"distinct recursor metadata fields", validRichRecursor,
+    .ok validRichRecursor⟩,
+  ⟨"inductive/constructor metadata", validInductiveBlock,
+    .ok validInductiveBlock⟩,
+  ⟨"quotient variant", validQuotient, .ok validQuotient⟩,
+  ⟨"constant ref index", axiomConstant 0 (.ref 1 #[]) #[address],
+    .error (.refIndex axiomSite .constant 1 1)⟩,
+  ⟨"string ref index", axiomConstant 0 (.str 1) #[address],
+    .error (.refIndex axiomSite .string 1 1)⟩,
+  ⟨"natural ref index", axiomConstant 0 (.nat 1) #[address],
+    .error (.refIndex axiomSite .natural 1 1)⟩,
+  ⟨"projection type-ref index", axiomConstant 0 (.prj 1 0 (.var 0)) #[address],
+    .error (.refIndex axiomSite .projectionType 1 1)⟩,
+  ⟨"sort universe index", axiomConstant 0 (.sort 1) #[] #[.zero],
+    .error (.universeIndex axiomSite 1 1)⟩,
+  ⟨"reference universe-argument index", axiomConstant 0 (.ref 0 #[1])
+      #[address] #[.zero],
+    .error (.universeIndex axiomSite 1 1)⟩,
+  ⟨"universe variable scope", axiomConstant 1 (.sort 0) #[] #[.var 1],
+    .error (.universeVariable axiomSite 1 1)⟩,
+  ⟨"mutual self index", invalidMutualRecur,
+    .error (.recurIndex ⟨some 0, .definitionValue⟩ 1 1)⟩,
+  ⟨"recursor type arity", invalidRecursorType,
+    .error (.recursorTypeArity ⟨none, .recursorType⟩ 1 0)⟩,
+  ⟨"recursor rule arity", invalidRecursorRule,
+    .error (.recursorRuleArity ⟨none, .recursorRule 0⟩ 1 0)⟩
+]
+
+def allCases : Array Case := cases ++ validProjections.map fun constant =>
+  ⟨"projection variant", constant, .ok constant⟩
+
+def resultEq : Except Error Constant → Except Error Constant → Bool
+  | .ok left, .ok right => left == right
+  | .error left, .error right => left == right
+  | _, _ => false
+
+def hostileAppCountBytes (count : Nat) : ByteArray := runPut do
+  putTag4 ⟨Constant.FLAG, ConstantInfo.CONST_AXIO⟩
+  putU8 0
+  putTag0 ⟨0⟩
+  putTag4 ⟨Expr.FLAG_APP, count.toUInt64⟩
+
+def hostileExpressionDepthBytes (depth : Nat) : ByteArray := runPut do
+  putTag4 ⟨Constant.FLAG, ConstantInfo.CONST_AXIO⟩
+  putU8 0
+  putTag0 ⟨0⟩
+  for _ in [:depth] do
+    putTag4 ⟨Expr.FLAG_PRJ, 0⟩
+    putTag0 ⟨0⟩
+
+def hostileReferenceCountBytes (count : Nat) : ByteArray := runPut do
+  putTag4 ⟨Constant.FLAG, ConstantInfo.CONST_AXIO⟩
+  putU8 0
+  putTag0 ⟨0⟩
+  putTag4 ⟨Expr.FLAG_VAR, 0⟩
+  putTag0 ⟨0⟩
+  putTag0 ⟨count.toUInt64⟩
+
+def hostileUniverseDepthBytes (depth : Nat) : ByteArray := runPut do
+  putTag4 ⟨Constant.FLAG, ConstantInfo.CONST_AXIO⟩
+  putU8 0
+  putTag0 ⟨0⟩
+  putTag4 ⟨Expr.FLAG_SORT, 0⟩
+  putTag0 ⟨0⟩
+  putTag0 ⟨0⟩
+  putTag0 ⟨1⟩
+  for _ in [:depth] do
+    putTag2 ⟨Univ.FLAG_MAX, 0⟩
+
+structure ResourceCase where
+  name : String
+  bytes : ByteArray
+  expected : Error
+
+def resourceCases : Array ResourceCase :=
+  let limits := DecodeCheck.defaultLimits
+  let tooLong := limits.maxSequenceLength + 1
+  #[
+    ⟨"flat application count",
+      hostileAppCountBytes tooLong,
+      .sequenceTooLong .applicationSpine tooLong limits.maxSequenceLength⟩,
+    ⟨"flat reference-table count",
+      hostileReferenceCountBytes tooLong,
+      .sequenceTooLong .references tooLong limits.maxSequenceLength⟩,
+    ⟨"expression nesting",
+      hostileExpressionDepthBytes limits.maxExpressionDepth,
+      .expressionDepth limits.maxExpressionDepth⟩,
+    ⟨"universe nesting",
+      hostileUniverseDepthBytes limits.maxUniverseDepth,
+      .universeDepth limits.maxUniverseDepth⟩
+  ]
+
+end DecodeCheckFixtures
+
+/-! Deterministic checked-codec fuzzing.  This deliberately has no external
+randomness or fuzzing dependency, so the ordinary flake test reproduces every
+case.  Rejection is a valid result; acceptance requires exact canonical bytes
+and successful passage through the checked writer. -/
+
+namespace DecodeFuzz
+
+inductive Outcome where
+  | rejected
+  | accepted
+  | roundTripFailure
+deriving BEq
+
+def classify (bytes : ByteArray) : Outcome :=
+  match DecodeCheck.decodeChecked bytes with
+  | .error _ => .rejected
+  | .ok constant =>
+    if ser constant != bytes then
+      .roundTripFailure
+    else
+      match DecodeCheck.encodeChecked constant with
+      | .ok encoded =>
+        if encoded == bytes then .accepted else .roundTripFailure
+      | .error _ => .roundTripFailure
+
+/-- Original bytes, every strict prefix, every single-byte low-bit flip, and
+two trailing-byte mutations. -/
+def mutations (bytes : ByteArray) : Array ByteArray :=
+  let prefixes := (Array.range bytes.size).map fun size =>
+    bytes.extract 0 size
+  let flips := (Array.range bytes.size).map fun index =>
+    bytes.set! index (bytes.get! index ^^^ (1 : UInt8))
+  #[bytes] ++ prefixes ++ flips ++ #[bytes.push 0, bytes.push 0xff]
+
+def nextState (state : UInt64) : UInt64 :=
+  state * 6364136223846793005 + 1442695040888963407
+
+def randomBytes (seed : UInt64) (size : Nat) : ByteArray × UInt64 := Id.run do
+  let mut state := seed
+  let mut bytes : ByteArray := ByteArray.empty
+  for _ in [:size] do
+    state := nextState state
+    bytes := bytes.push state.toUInt8
+  return (bytes, state)
+
+def randomCaseCount : Nat := 4096
+def maxRandomBytes : Nat := 256
+
+end DecodeFuzz
+
+namespace WorkBudgetFixtures
+
+/-- A tiny valid backward sharing chain whose stored size is linear while its
+fully inlined body size doubles at each table entry. -/
+def doublingTable (steps : Nat) : Array Expr := Id.run do
+  let mut table : Array Expr := #[.sort 0]
+  for _ in [:steps] do
+    let previous := table.size - 1
+    table := table.push (.app (.share previous.toUInt64)
+      (.share previous.toUInt64))
+  return table
+
+def doublingBodies (table : Array Expr) : Array Expr :=
+  let final := table.size - 1
+  #[.app (.share final.toUInt64) (.share final.toUInt64)]
+
+end WorkBudgetFixtures
+
+namespace MerkleFixture
+
+/-! Independent ix artifact capture: the 19 member env roots and stored
+`members_root` from `Palomar.ix/palomar.ixc/manifest` on 2026-08-25.  Keeping
+the leaves as well as the result prevents a local manifest writer and reader
+from masking the same Merkle drift. -/
+
+def memberRoots : Array Address := #[
+  Address.ofFn fun i => (#[34, 234, 228, 113, 117, 211, 236, 250, 12, 20, 221, 253, 121, 13, 252, 195, 27, 240, 149, 55, 73, 7, 144, 92, 155, 122, 46, 147, 113, 226, 5, 97])[i.val]!,
+  Address.ofFn fun i => (#[116, 97, 231, 128, 84, 148, 77, 83, 202, 126, 202, 150, 124, 0, 176, 235, 222, 183, 166, 224, 113, 238, 25, 56, 13, 65, 96, 181, 182, 57, 119, 229])[i.val]!,
+  Address.ofFn fun i => (#[178, 247, 193, 242, 219, 45, 196, 228, 122, 118, 69, 100, 245, 136, 74, 92, 136, 86, 221, 152, 221, 79, 234, 103, 78, 74, 238, 176, 138, 27, 92, 106])[i.val]!,
+  Address.ofFn fun i => (#[197, 210, 150, 170, 96, 111, 211, 193, 207, 253, 183, 138, 222, 220, 222, 247, 164, 30, 184, 199, 158, 0, 192, 87, 18, 208, 78, 245, 30, 161, 4, 208])[i.val]!,
+  Address.ofFn fun i => (#[113, 24, 108, 74, 6, 70, 166, 135, 172, 152, 118, 176, 59, 121, 135, 128, 234, 238, 153, 16, 145, 9, 141, 42, 37, 45, 197, 2, 254, 60, 76, 14])[i.val]!,
+  Address.ofFn fun i => (#[67, 233, 29, 165, 155, 181, 250, 65, 95, 83, 213, 85, 21, 66, 190, 24, 249, 255, 96, 99, 118, 74, 59, 235, 185, 33, 23, 128, 50, 60, 161, 23])[i.val]!,
+  Address.ofFn fun i => (#[214, 146, 214, 62, 98, 89, 36, 231, 71, 40, 100, 222, 168, 79, 138, 76, 235, 220, 215, 112, 83, 235, 245, 15, 114, 217, 214, 181, 22, 81, 143, 80])[i.val]!,
+  Address.ofFn fun i => (#[234, 135, 20, 248, 51, 210, 152, 133, 138, 210, 227, 25, 114, 172, 242, 166, 193, 1, 80, 143, 221, 170, 160, 94, 109, 29, 140, 218, 161, 149, 55, 90])[i.val]!,
+  Address.ofFn fun i => (#[15, 124, 132, 78, 214, 243, 93, 39, 51, 53, 88, 135, 122, 178, 188, 204, 21, 225, 138, 112, 175, 10, 166, 85, 198, 167, 171, 38, 142, 182, 33, 247])[i.val]!,
+  Address.ofFn fun i => (#[104, 43, 172, 14, 231, 2, 233, 90, 35, 84, 74, 53, 139, 125, 192, 24, 248, 243, 12, 41, 244, 76, 41, 94, 140, 68, 19, 232, 161, 228, 72, 195])[i.val]!,
+  Address.ofFn fun i => (#[210, 7, 24, 253, 31, 165, 232, 69, 246, 142, 248, 60, 244, 106, 1, 74, 111, 133, 218, 46, 12, 58, 0, 149, 147, 253, 165, 66, 191, 99, 159, 167])[i.val]!,
+  Address.ofFn fun i => (#[119, 83, 141, 120, 37, 67, 242, 190, 143, 237, 20, 18, 67, 237, 49, 133, 131, 127, 229, 206, 100, 241, 62, 189, 140, 61, 199, 43, 154, 68, 243, 225])[i.val]!,
+  Address.ofFn fun i => (#[183, 152, 5, 233, 133, 174, 139, 144, 196, 62, 15, 196, 222, 227, 79, 11, 5, 100, 167, 42, 171, 88, 166, 146, 212, 81, 54, 23, 35, 156, 184, 62])[i.val]!,
+  Address.ofFn fun i => (#[35, 234, 146, 78, 94, 211, 112, 27, 116, 122, 186, 146, 57, 78, 196, 65, 226, 124, 96, 74, 131, 53, 150, 60, 2, 54, 157, 227, 189, 54, 194, 99])[i.val]!,
+  Address.ofFn fun i => (#[180, 90, 29, 76, 86, 71, 8, 189, 92, 197, 78, 85, 64, 190, 142, 172, 202, 89, 154, 26, 98, 188, 116, 17, 20, 119, 104, 192, 53, 135, 230, 34])[i.val]!,
+  Address.ofFn fun i => (#[252, 125, 42, 67, 124, 240, 172, 16, 227, 226, 107, 203, 54, 148, 155, 175, 239, 89, 88, 86, 119, 198, 5, 130, 7, 71, 92, 183, 184, 74, 227, 65])[i.val]!,
+  Address.ofFn fun i => (#[219, 250, 226, 156, 208, 225, 113, 112, 219, 44, 135, 127, 76, 197, 101, 87, 228, 216, 169, 28, 38, 37, 85, 26, 48, 215, 104, 219, 144, 245, 134, 187])[i.val]!,
+  Address.ofFn fun i => (#[66, 225, 49, 195, 52, 228, 129, 12, 82, 120, 164, 31, 84, 71, 0, 25, 22, 103, 200, 130, 69, 165, 23, 39, 95, 181, 243, 241, 53, 230, 47, 40])[i.val]!,
+  Address.ofFn fun i => (#[149, 80, 218, 120, 189, 201, 21, 41, 23, 137, 28, 249, 223, 95, 95, 135, 137, 34, 248, 77, 249, 114, 119, 233, 44, 68, 79, 107, 71, 146, 240, 54])[i.val]!
+]
+
+def membersRoot : Address :=
+  Address.ofFn fun i => (#[131, 134, 112, 180, 85, 1, 141, 183, 156,
+    87, 54, 99, 118, 196, 117, 184, 37, 253, 59, 105, 99, 209, 139,
+    201, 67, 197, 39, 27, 64, 28, 41, 13])[i.val]!
+
+end MerkleFixture
+
+namespace CatalogFixtures
+
+private def putU16LE (value : UInt16) : PutM Unit :=
+  putBytes (u64LEBytes value.toUInt64 2)
+
+private def putU32LE (value : UInt32) : PutM Unit :=
+  putBytes (u64LEBytes value.toUInt64 4)
+
+private def putU64LE (value : UInt64) : PutM Unit :=
+  putBytes (u64LEBytes value 8)
+
+private def putAddress (address : Address) : PutM Unit :=
+  putBytes address.hash
+
+private def putString16 (value : String) : PutM Unit := do
+  let bytes := value.toUTF8
+  putU16LE bytes.size.toUInt16
+  putBytes bytes
+
+private def putMember (member : Catalog.Member) : PutM Unit := do
+  putAddress member.envRoot
+  putU64LE member.constCount
+  putString16 member.label
+  putString16 member.toolchain
+  putString16 member.sourcePin
+  putU32LE member.deps.size.toUInt32
+  for dependency in member.deps do
+    putU32LE dependency
+  match member.preimage with
+  | none => putU8 0
+  | some address => putU8 1; putAddress address
+
+/-- Test-side exact manifest writer, kept independent of the production
+decoder so the loader is exercised from bytes. -/
+def manifestBytes (manifest : Catalog.Manifest) : ByteArray := runPut do
+  putBytes Catalog.magic
+  putU32LE Catalog.version
+  putU32LE (match manifest.storage with
+    | .fat _ => 0
+    | .chunked _ => Catalog.flagChunked)
+  putAddress manifest.membersRoot
+  putAddress manifest.contentRoot
+  putU32LE manifest.members.size.toUInt32
+  for member in manifest.members do
+    putMember member
+  match manifest.storage with
+  | .fat pieces =>
+    for piece in pieces do
+      putAddress piece.fileHash
+      putU64LE piece.fileBytes
+  | .chunked chunks =>
+    putU32LE chunks.size.toUInt32
+    for chunk in chunks do
+      putAddress chunk.chunkRoot
+      putAddress chunk.fileHash
+      putU64LE chunk.fileBytes
+      putU32LE chunk.owner
+  putBytes manifest.trailing
+
+structure PieceArtifact where
+  bytes : ByteArray
+  envRoot : Address
+  addresses : Array Address
+  deriving Inhabited
+
+/-- Minimal complete anonymous `.ixe`: the loader consumes through §3 and
+retains the three empty metadata-section counts opaquely. -/
+def pieceBytes (constants : Array Constant)
+    (blobs : Array ByteArray := #[])
+    (assumptions : Array Address := #[]) : Except String PieceArtifact := do
+  let mut encodedConstants : Array (Address × ByteArray) := #[]
+  for constant in constants do
+    let address ← match constant.addressChecked with
+      | .ok address => pure address
+      | .error error => throw s!"unaddressable fixture: {repr error}"
+    encodedConstants := encodedConstants.push (address, ser constant)
+  encodedConstants := encodedConstants.qsort fun left right =>
+    Merkle.addressLT left.1 right.1
+  let mut encodedBlobs : Array (Address × ByteArray) := #[]
+  for bytes in blobs do
+    encodedBlobs := encodedBlobs.push (Address.blake3 bytes, bytes)
+  encodedBlobs := encodedBlobs.qsort fun left right =>
+    Merkle.addressLT left.1 right.1
+  let assumptions := Merkle.dedupSorted (Merkle.sortAddresses assumptions)
+  let addresses := encodedConstants.map (·.1)
+  let envRoot := Merkle.rootCanonical addresses
+  let bytes := runPut do
+    putTag4 ⟨Catalog.envFlag, Catalog.envVersion⟩
+    putAddress envRoot
+    putU8 0
+    putTag0 ⟨assumptions.size.toUInt64⟩
+    for address in assumptions do putAddress address
+    putTag0 ⟨encodedBlobs.size.toUInt64⟩
+    for (address, payload) in encodedBlobs do
+      putAddress address
+      putTag0 ⟨payload.size.toUInt64⟩
+      putBytes payload
+    putTag0 ⟨encodedConstants.size.toUInt64⟩
+    for (address, payload) in encodedConstants do
+      putAddress address
+      putTag0 ⟨payload.size.toUInt64⟩
+      putBytes payload
+    putTag0 ⟨0⟩
+    -- Empty §4 names, §5 named entries, and §6 comms.  These are opaque to
+    -- the anonymous loader but make the fixture a complete `.ixe`.
+    putTag0 ⟨0⟩
+    putTag0 ⟨0⟩
+    putTag0 ⟨0⟩
+  return ⟨bytes, envRoot, addresses⟩
+
+def member (label : String) (piece : PieceArtifact)
+    (deps : Array UInt32 := #[]) : Catalog.Member :=
+  { envRoot := piece.envRoot
+    constCount := piece.addresses.size.toUInt64
+    label
+    toolchain := "lean-4.33.0"
+    sourcePin := "catalog-fixture"
+    deps
+    preimage := none }
+
+def fatManifest (members : Array Catalog.Member)
+    (pieces : Array PieceArtifact) : Catalog.Manifest :=
+  let allAddresses := pieces.foldl
+    (fun addresses piece => addresses.append piece.addresses) #[]
+  { membersRoot := Catalog.membersRootOf members
+    contentRoot := Merkle.rootCanonical allAddresses
+    members
+    storage := .fat (pieces.map fun piece =>
+      { fileHash := Address.blake3 piece.bytes
+        fileBytes := piece.bytes.size.toUInt64 }) }
+
+def chunkedManifest (members : Array Catalog.Member)
+    (pieces : Array PieceArtifact) (owners : Array UInt32) :
+    Catalog.Manifest :=
+  let allAddresses := pieces.foldl
+    (fun addresses piece => addresses.append piece.addresses) #[]
+  { membersRoot := Catalog.membersRootOf members
+    contentRoot := Merkle.rootCanonical allAddresses
+    members
+    storage := .chunked (pieces.zip owners |>.map fun (piece, owner) =>
+      { chunkRoot := piece.envRoot
+        fileHash := Address.blake3 piece.bytes
+        fileBytes := piece.bytes.size.toUInt64
+        owner }) }
+
+def axiomFixture (isUnsafe : Bool) : Constant :=
+  { info := .axio { isUnsafe, lvls := 0, typ := .sort 0 }
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+def block (constructorOrdinal : UInt64 := 0) : Constant :=
+  { info := .muts #[.indc
+      { isUnsafe := false, lvls := 0, params := 0, indices := 0
+        typ := .sort 0
+        ctors := #[
+          { isUnsafe := false, lvls := 0, cidx := constructorOrdinal
+            params := 0, fields := 0, typ := .sort 0 }] }]
+    sharing := #[], refs := #[], univs := #[.zero] }
+
+def inductiveProjection (blockAddress : Address) (index : UInt64 := 0) :
+    Constant :=
+  { info := .iPrj { idx := index, block := blockAddress }
+    sharing := #[], refs := #[], univs := #[] }
+
+def constructorProjection (blockAddress : Address) (index : UInt64 := 0)
+    (ctorIndex : UInt64 := 0) : Constant :=
+  { info := .cPrj
+      { idx := index
+        cidx := ctorIndex
+        block := blockAddress }
+    sharing := #[], refs := #[], univs := #[] }
+
+structure Input where
+  manifest : Catalog.Manifest
+  manifestBytes : ByteArray
+  pieces : Array PieceArtifact
+
+def inputOf (manifest : Catalog.Manifest) (pieces : Array PieceArtifact) :
+    Input :=
+  ⟨manifest, manifestBytes manifest, pieces⟩
+
+def validFatInput : Except String Input := do
+  let blockConstant := block
+  let blockAddress ← match blockConstant.addressChecked with
+    | .ok address => pure address
+    | .error error => throw s!"block address: {repr error}"
+  let sharedAxiom := axiomFixture false
+  let pieceA ← pieceBytes #[sharedAxiom, blockConstant,
+    inductiveProjection blockAddress,
+    constructorProjection blockAddress]
+  let pieceB ← pieceBytes #[sharedAxiom, axiomFixture true]
+  let members := #[member "Core" pieceA,
+    member "Extra" pieceB #[0]]
+  let pieces := #[pieceA, pieceB]
+  return inputOf (fatManifest members pieces) pieces
+
+def invalidMemberInput : Except String Input := do
+  let blockConstant := block
+  let blockAddress ← match blockConstant.addressChecked with
+    | .ok address => pure address
+    | .error error => throw s!"block address: {repr error}"
+  let piece ← pieceBytes #[blockConstant,
+    inductiveProjection blockAddress 1]
+  let pieces := #[piece]
+  let members := #[member "BadMember" piece]
+  return inputOf (fatManifest members pieces) pieces
+
+def invalidOrdinalInput : Except String Input := do
+  let piece ← pieceBytes #[block 7]
+  let pieces := #[piece]
+  let members := #[member "BadOrdinal" piece]
+  return inputOf (fatManifest members pieces) pieces
+
+def duplicateChunkInput : Except String Input := do
+  let piece ← pieceBytes #[axiomFixture false]
+  let pieces := #[piece, piece]
+  let members := #[member "Chunked" piece]
+  let manifest := chunkedManifest members pieces #[0, 0]
+  return inputOf manifest pieces
+
+def replaceFatBytes (manifest : Catalog.Manifest) (index : Nat)
+    (bytes : ByteArray) : Catalog.Manifest :=
+  match manifest.storage with
+  | .fat rows =>
+    let replacement : Catalog.FatPiece :=
+      { fileHash := Address.blake3 bytes
+        fileBytes := bytes.size.toUInt64 }
+    { manifest with storage := .fat (rows.set! index replacement) }
+  | .chunked _ => manifest
+
+end CatalogFixtures
+
+
+def main : IO UInt32 := do
+  let mut ok := true
+
+  for check in Ix.Compiler.Pipeline.nativeIntegrationChecks do
+    if !check.2 then
+      IO.eprintln s!"FAIL: pipeline integration: {check.1}"
+      ok := false
+
+  let ir0Bytes := Ix.Compiler.IxIR0.Decl.preimage IxIRAddressFixtures.ir0Decl
+  if ir0Bytes != IxIRAddressFixtures.expectedIr0Bytes then
+    IO.eprintln s!"FAIL: IxIR₀ declaration preimage drifted: {repr ir0Bytes.data.toList}"
+    ok := false
+  let ir0Address := Ix.Compiler.IxIR0.Decl.address IxIRAddressFixtures.ir0Decl
+  if hashNats ir0Address != IxIRAddressFixtures.expectedIr0Hash then
+    IO.eprintln s!"FAIL: IxIR₀ declaration address drifted: {ir0Address}"
+    ok := false
+  if !IxIRAddressFixtures.ir0DecodeOk then
+    IO.eprintln "FAIL: IxIR₀ canonical declaration did not decode"
+    ok := false
+  for fixture in IxIRAddressFixtures.ir0Malformed do
+    if !IxIRAddressFixtures.ir0Rejects fixture.2 then
+      IO.eprintln s!"FAIL: IxIR₀ decoder accepted {fixture.1}"
+      ok := false
+
+  let ir1Bytes := Ix.Compiler.IxIR1.Decl.preimage IxIRAddressFixtures.ir1Decl
+  if ir1Bytes != IxIRAddressFixtures.expectedIr1Bytes then
+    IO.eprintln s!"FAIL: IxIR₁ declaration preimage drifted: {repr ir1Bytes.data.toList}"
+    ok := false
+  let ir1Address := Ix.Compiler.IxIR1.Decl.address IxIRAddressFixtures.ir1Decl
+  if hashNats ir1Address != IxIRAddressFixtures.expectedIr1Hash then
+    IO.eprintln s!"FAIL: IxIR₁ declaration address drifted: {ir1Address}"
+    ok := false
+  if !IxIRAddressFixtures.ir1DecodeOk then
+    IO.eprintln "FAIL: IxIR₁ canonical declaration did not decode"
+    ok := false
+  for fixture in IxIRAddressFixtures.ir1Malformed do
+    if !IxIRAddressFixtures.ir1Rejects fixture.2 then
+      IO.eprintln s!"FAIL: IxIR₁ decoder accepted {fixture.1}"
+      ok := false
+
+  if !IxIR1OwnedMainFixtures.ownedBoundaryOk then
+    IO.eprintln "FAIL: IxIR₁ owned-main result-world boundary drifted"
+    ok := false
+
+  if !IxIR1OwnedMainFixtures.noReuseChecksOk then
+    IO.eprintln "FAIL: IxIR₁ executable no-reuse reflection drifted"
+    ok := false
+
+  match IxIRMutualBlockFixtures.built with
+  | .error message =>
+    IO.eprintln s!"FAIL: cycle-safe IxIR₀ mutual block failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIRMutualBlockFixtures.builtOk result then
+      IO.eprintln s!"FAIL: IxIR₀ mutual-block identity drifted (block={result.blockAddress}, members={repr (result.derivedAddresses.map Address.toHex)}, audit={result.semanticAudit IxIRMutualBlockFixtures.raw})"
+      ok := false
+  if !IxIRMutualBlockFixtures.decodeOk then
+    IO.eprintln "FAIL: canonical mutual block did not decode and materialize identically"
+    ok := false
+  for fixture in IxIRMutualBlockFixtures.malformed do
+    if !IxIRMutualBlockFixtures.rejectsArtifactBytes fixture.2 then
+      IO.eprintln s!"FAIL: mutual-block decoder accepted {fixture.1}"
+      ok := false
+  if !IxIRMutualBlockFixtures.transientSpellingIndependent then
+    IO.eprintln "FAIL: mutual-block identity depends on transient member names"
+    ok := false
+  if !IxIRMutualBlockFixtures.orderSensitive then
+    IO.eprintln "FAIL: mutual-block member order did not affect identity"
+    ok := false
+  if !IxIRMutualBlockFixtures.rejectsEmpty then
+    IO.eprintln "FAIL: empty mutual block was accepted"
+    ok := false
+  if !IxIRMutualBlockFixtures.rejectsDuplicateTemporary then
+    IO.eprintln "FAIL: duplicate mutual-block temporary key was accepted"
+    ok := false
+  if !IxIRMutualBlockFixtures.rejectsLegacyWrapAlias then
+    IO.eprintln "FAIL: the legacy 2^64 member-address alias crossed the block boundary"
+    ok := false
+  if !IxIRMutualBlockFixtures.rejectsDerivedReservedCollision then
+    IO.eprintln "FAIL: a derived mutual-member key captured a reserved identity"
+    ok := false
+
+  match IxIR1MutualBlockFixtures.built with
+  | .error message =>
+    IO.eprintln s!"FAIL: cycle-safe IxIR₁ mutual block failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIR1MutualBlockFixtures.builtOk result then
+      IO.eprintln s!"FAIL: IxIR₁ mutual-block identity drifted (block={result.blockAddress}, members={repr (result.derivedAddresses.map Address.toHex)}, audit={result.semanticAudit IxIR1MutualBlockFixtures.raw})"
+      ok := false
+  if !IxIR1MutualBlockFixtures.decodeOk then
+    IO.eprintln "FAIL: canonical IxIR₁ mutual block did not decode and materialize identically"
+    ok := false
+  for fixture in IxIR1MutualBlockFixtures.malformed do
+    if !IxIR1MutualBlockFixtures.rejectsArtifactBytes fixture.2 then
+      IO.eprintln s!"FAIL: IxIR₁ mutual-block decoder accepted {fixture.1}"
+      ok := false
+  if !IxIR1MutualBlockFixtures.transientSpellingIndependent then
+    IO.eprintln "FAIL: IxIR₁ mutual-block identity depends on transient member names"
+    ok := false
+  if !IxIR1MutualBlockFixtures.orderSensitive then
+    IO.eprintln "FAIL: IxIR₁ mutual-block member order did not affect identity"
+    ok := false
+  if !IxIR1MutualBlockFixtures.rejectsEmpty then
+    IO.eprintln "FAIL: empty IxIR₁ mutual block was accepted"
+    ok := false
+  if !IxIR1MutualBlockFixtures.rejectsDuplicateTemporary then
+    IO.eprintln "FAIL: duplicate IxIR₁ mutual-block temporary key was accepted"
+    ok := false
+  if !IxIR1MutualBlockFixtures.rejectsDerivedReservedCollision then
+    IO.eprintln "FAIL: a derived IxIR₁ mutual-member key captured a reserved identity"
+    ok := false
+
+  for (label, passed) in [
+      ("repeated erased blocks preserve both producers", RepeatedErasureFixtures.checkedReuse),
+      ("conflicting block/member identities reject", RepeatedErasureFixtures.conflictsRejected),
+      ("repeated blocks preserve protected namespaces", RepeatedErasureFixtures.protectedNamespaces),
+      ("repeated cycles preserve ordered member maps", RepeatedErasureFixtures.repeatedCycles)] do
+    if !passed then
+      IO.eprintln s!"FAIL: {label}"
+      ok := false
+  match AddressedErasureFixtures.built with
+  | .error error =>
+    IO.eprintln s!"FAIL: addressed erasure rejected a cyclic program: {repr error}"
+    ok := false
+  | .ok result =>
+    if !AddressedErasureFixtures.builtOk result then
+      IO.eprintln s!"FAIL: addressed erasure drifted (blocks={repr (result.addressed.blockAddresses.map Address.toHex)}, members={repr (result.addressed.derivedAddresses.map Address.toHex)}, audit={result.semanticAudit AddressedErasureFixtures.eraseCtx AddressedErasureFixtures.constants (.ref AddressedErasureFixtures.projection) 200})"
+      ok := false
+  if !AddressedErasureFixtures.crossBlockTemporaryRejected then
+    IO.eprintln "FAIL: a cross-block transient reference was accepted"
+    ok := false
+  match AddressedErasureFixtures.pipelineBuilt with
+  | .error error =>
+    IO.eprintln s!"FAIL: full pipeline rejected the cyclic definition fixture: {repr error}"
+    ok := false
+  | .ok artifact =>
+    if !AddressedErasureFixtures.pipelineOk artifact then
+      IO.eprintln s!"FAIL: full pipeline did not emit the expected IxIR₁ block (blocks={repr (artifact.targetBlocks.map fun block => Address.toHex block.blockAddress)}, map={repr (artifact.targetAddressMap.map fun entry => Address.toHex entry.2)})"
+      ok := false
+    if !HPTFixtures.pipelineTopOk artifact then
+      IO.eprintln "FAIL: the production target artifact rejected the universal checked HPT fallback"
+      ok := false
+    if !HPTFixtures.pipelineProducerOk artifact then
+      IO.eprintln "FAIL: the production target artifact rejected deterministic HPT production"
+      ok := false
+    if !HPTFixtures.pipelineCacheOk artifact then
+      IO.eprintln "FAIL: the production target artifact rejected checked persistent HPT caching"
+      ok := false
+    if !(← HPTFixtures.pipelineCacheFileOk artifact) then
+      IO.eprintln "FAIL: the production target artifact rejected file-backed persistent HPT caching"
+      ok := false
+    if !(← HPTFixtures.pipelineCacheDirectoryOk artifact) then
+      IO.eprintln "FAIL: the production target artifact rejected indexed chunk-directory HPT caching"
+      ok := false
+  match AddressedErasureFixtures.pipelineBuilt,
+      AddressedErasureFixtures.validatedPipelineBuilt with
+  | .ok direct, .ok gated =>
+    if !AddressedErasureFixtures.validatedPipelineAgrees direct gated then
+      IO.eprintln "FAIL: direct and validated cyclic pipelines disagree"
+      ok := false
+  | _, .error error =>
+    IO.eprintln s!"FAIL: validated pipeline rejected the certified cyclic fixture: {repr error}"
+    ok := false
+  | _, _ =>
+    IO.eprintln "FAIL: direct cyclic pipeline failed during agreement check"
+    ok := false
+
+  if !AddressedErasureFixtures.validatedIxIR2AttachmentOk then
+    IO.eprintln "FAIL: validated IxIR₁ pipeline did not attach and validate the conservative IxIR₂ sidecars"
+    ok := false
+
+  for number in [0, 42, 4294967296, UInt64.size - 1] do
+    match Ix.Compiler.X86.ValidatedScalar.compile number with
+    | .error error =>
+        IO.eprintln s!"FAIL: validated Ixon scalar {number} did not compile: {repr error}"
+        ok := false
+    | .ok compiled =>
+        match compiled.observe with
+        | .ok _ => pure ()
+        | .error message =>
+            IO.eprintln s!"FAIL: validated Ixon scalar {number}: {message}"
+            ok := false
+  if !Ix.Compiler.X86.ValidatedScalar.rejectsBareLiteral 42 then
+    IO.eprintln "FAIL: bare unique source literal lost its shared-result freezeNeeded rejection"
+    ok := false
+  if !Ix.Compiler.X86.ValidatedScalar.rejectsOverflow then
+    IO.eprintln "FAIL: validated Ixon scalar above 64 bits lost its selector rejection"
+    ok := false
+
+  match Ix.Compiler.Recursion.Examples.runAll with
+  | .ok _ => pure ()
+  | .error message =>
+    IO.eprintln s!"FAIL: Ixon source recursion/reuse: {message}"
+    ok := false
+
+  match Ix.Compiler.CallReuse.Examples.runAll with
+  | .ok _ => pure ()
+  | .error message =>
+    IO.eprintln s!"FAIL: Ixon source call reuse: {message}"
+    ok := false
+
+  match Ix.Compiler.UniqueReuse.Examples.runAll with
+  | .ok _ => pure ()
+  | .error message =>
+    IO.eprintln s!"FAIL: Ixon source unique reuse: {message}"
+    ok := false
+
+  match Ix.Compiler.IxIR2.Reuse.Examples.checkUnaliased with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  match Ix.Compiler.IxIR2.Reuse.Examples.checkAliased with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  for aliased in [false, true] do
+    match Ix.Compiler.IxIR2.Reuse.Examples.checkZeroFieldChild aliased with
+    | .ok _ => pure ()
+    | .error message =>
+        IO.eprintln s!"FAIL: {message}"
+        ok := false
+
+  for overApplied in [false, true] do
+    for aliased in [false, true] do
+      match Ix.Compiler.IxIR2.Reuse.Examples.checkPapTailReturn overApplied aliased with
+      | .ok _ => pure ()
+      | .error message =>
+          IO.eprintln s!"FAIL: {message}"
+          ok := false
+
+  for underApplied in [false, true] do
+    match Ix.Compiler.IxIR2.Reuse.Examples.checkImmediateApplyMore underApplied with
+    | .ok _ => pure ()
+    | .error message =>
+        IO.eprintln s!"FAIL: {message}"
+        ok := false
+
+  for fallback in [false, true] do
+    match Ix.Compiler.IxIR2.Reuse.Examples.checkProductionSelection fallback with
+    | .ok _ => pure ()
+    | .error message =>
+        IO.eprintln s!"FAIL: {message}"
+        ok := false
+
+  match Ix.Compiler.IxIR2.Reuse.Examples.checkProductionSourceRejection with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  match Ix.Compiler.IxIR2.Reuse.Examples.checkIncompatibleLayout with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  match Ix.Compiler.IxIR2.Reuse.Examples.checkGeneralizedShape with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  match Ix.Compiler.IxIR2.Reuse.Examples.checkLateSourceUse with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  match Ix.Compiler.IxIR2.Liveness.Examples.checkSuite with
+  | .ok _ => pure ()
+  | .error message =>
+      IO.eprintln s!"FAIL: {message}"
+      ok := false
+
+  if !IxIR2PipelineFixtures.ambiguousFetchAcceptedByProducerFact then
+    IO.eprintln "FAIL: exact local HPT producer provenance did not disambiguate an IxIR₂ fetch"
+    ok := false
+
+  if !IxIR2PipelineFixtures.ambiguousCaseAcceptedByProducerFact then
+    IO.eprintln "FAIL: exact local HPT producer provenance did not disambiguate an IxIR₂ constructor switch"
+    ok := false
+
+  if !IxIR2PipelineFixtures.unresolvedFetchRejected then
+    IO.eprintln "FAIL: IxIR₂ producer provenance accepted an unresolved fetch parameter"
+    ok := false
+
+  if !IxIR2PipelineFixtures.ambiguousScalarFreeAcceptedByProducerFact then
+    IO.eprintln "FAIL: exact local HPT producer provenance did not disambiguate an IxIR₂ shallow free"
+    ok := false
+
+  if !IxIR2PipelineFixtures.pappCapabilityTransitionAccepted then
+    IO.eprintln "FAIL: checked IxIR₂ function-PAP capability transition drifted"
+    ok := false
+
+  if !IxIR2PipelineFixtures.pappSafetyCheckRejectsUnsafe then
+    IO.eprintln "FAIL: IxIR₂ attachment PAP-safety check accepted an unsafe declaration"
+    ok := false
+
+  if !IxIR2PipelineFixtures.lenderDestructionRetiresBorrow then
+    IO.eprintln "FAIL: checked IxIR₂ destruction retained a dead lender loan"
+    ok := false
+
+  if !IxIR2PipelineFixtures.exactRecursorCaseAccepted then
+    IO.eprintln "FAIL: ambiguous recursor case did not cover and execute both full IxIR₂ constructor identities"
+    ok := false
+
+  if !IxIR2PipelineFixtures.recursorOriginExtractionOk then
+    IO.eprintln "FAIL: recursor-origin extraction lost the final owner map or accepted conflicting blocks"
+    ok := false
+
+  if !ReaddressOracleFixtures.adapterOk then
+    IO.eprintln "FAIL: the IxIR₀ opaque-oracle adapter did not reverse the call key, preserve scalar arity, and map the result"
+    ok := false
+  match ReaddressOracleFixtures.ledgerBuilt with
+  | .error message =>
+    IO.eprintln s!"FAIL: the ledger-oracle mutual-block fixture did not readdress: {message}"
+    ok := false
+  | .ok result =>
+    if !ReaddressOracleFixtures.ledgerCycleOk result then
+      IO.eprintln s!"FAIL: the concrete Nat-add oracle lost coherence across the member map (blocks={repr (result.blockAddresses.map Address.toHex)}, members={repr (result.derivedAddresses.map Address.toHex)})"
+      ok := false
+  if !ReaddressOracleFixtures.mainExternalCaptureRejected then
+    IO.eprintln "FAIL: an IxIR₀ member key captured an external identity referenced only by main"
+    ok := false
+
+  match IxIRReaddressFixtures.chain with
+  | .error message =>
+    IO.eprintln s!"FAIL: dependency-ordered IxIR₁ readdressing failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIRReaddressFixtures.chainOk result then
+      IO.eprintln s!"FAIL: dependency-ordered IxIR₁ readdressing drifted (content={repr (IxIRReaddressFixtures.contentHexes result)})"
+      ok := false
+
+  match IxIRReaddressFixtures.deduplicate with
+  | .error message =>
+    IO.eprintln s!"FAIL: identical IxIR₁ content did not deduplicate: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIRReaddressFixtures.deduplicateOk result then
+      IO.eprintln s!"FAIL: IxIR₁ content deduplication drifted (content={repr (IxIRReaddressFixtures.contentHexes result)})"
+      ok := false
+
+  if !IxIRReaddressFixtures.cycleRejected then
+    IO.eprintln "FAIL: generated IxIR₁ address cycle did not fail closed"
+    ok := false
+  if !IxIRReaddressFixtures.overlapRejected then
+    IO.eprintln "FAIL: generated/source temporary-address overlap was accepted"
+    ok := false
+  if !IxIRReaddressFixtures.sourceKeyCollisionRejected then
+    IO.eprintln "FAIL: generated content/source-key collision was accepted"
+    ok := false
+  if !IxIRReaddressFixtures.contentTemporaryOverlapRejected then
+    IO.eprintln "FAIL: generated content/temporary namespace overlap was accepted"
+    ok := false
+  if !IxIRReaddressFixtures.protectedSourceIdentityRejected then
+    IO.eprintln "FAIL: a transient key rewrote a constructor source identity"
+    ok := false
+
+  if !IxIR1ReaddressAllFixtures.componentsOk then
+    IO.eprintln "FAIL: IxIR₁ SCC discovery did not preserve deterministic source-member order"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.longChainComponentsOk then
+    IO.eprintln "FAIL: IxIR₁ SCC discovery failed the iterative long-chain guard"
+    ok := false
+  match IxIR1ReaddressAllFixtures.built with
+  | .error message =>
+    IO.eprintln s!"FAIL: whole-program IxIR₁ SCC readdressing failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIR1ReaddressAllFixtures.builtOk result then
+      IO.eprintln s!"FAIL: whole-program IxIR₁ SCC identities or audit drifted (targets={repr (result.addressMap.map fun entry => Address.toHex entry.2)}, blocks={repr (result.blockAddresses.map Address.toHex)}, audit={result.semanticAudit IxIR1ReaddressAllFixtures.raw IxIR1ReaddressAllFixtures.mainCode})"
+      ok := false
+  if !IxIR1ReaddressAllFixtures.transientSpellingIndependent then
+    IO.eprintln "FAIL: whole-program IxIR₁ identities depend on transient producer names"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.memberOrderSensitive then
+    IO.eprintln "FAIL: IxIR₁ SCC member order did not affect block/program identity"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.ordinaryDeduplicates then
+    IO.eprintln "FAIL: whole-program IxIR₁ ordinary content did not deduplicate"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.explicitSelfUsesBlock then
+    IO.eprintln "FAIL: an explicit IxIR₁ self-address edge did not use a block artifact"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.callSelfUsesOrdinaryHash then
+    IO.eprintln "FAIL: address-free IxIR₁ callSelf did not retain the ordinary hash path"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.emptyOk then
+    IO.eprintln "FAIL: empty whole-program IxIR₁ readdressing drifted"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.rejectsDuplicateProducer then
+    IO.eprintln "FAIL: duplicate whole-program IxIR₁ producer key was accepted"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.rejectsReservedProducer then
+    IO.eprintln "FAIL: an IxIR₁ producer key overlapped a reserved identity"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.rejectsProtectedContent then
+    IO.eprintln "FAIL: an IxIR₁ content address captured a protected identity"
+    ok := false
+  if !IxIR1ReaddressAllFixtures.rejectsContentInTransientNamespace then
+    IO.eprintln "FAIL: an IxIR₁ content address overlapped the transient namespace"
+    ok := false
+
+  match HPTFixtures.addressed with
+  | .error message =>
+    IO.eprintln s!"FAIL: HPT fixture did not content-address: {message}"
+    ok := false
+  | .ok program =>
+    match HPTFixtures.precise program, HPTFixtures.widened program with
+    | .ok precise, .ok widened =>
+      if !HPTFixtures.preciseOk program precise then
+        IO.eprintln s!"FAIL: checked HPT facts or SCC materialization drifted (cacheKeys={repr (precise.cacheKeys.map Address.toHex)}, addresses={repr (precise.addresses.map Address.toHex)})"
+        ok := false
+      if !HPTFixtures.fieldSensitiveOk program precise then
+        IO.eprintln "FAIL: field-sensitive HPT allocation/fetch facts disagreed with concrete execution"
+        ok := false
+      if !HPTFixtures.caseBinderFieldOk then
+        IO.eprintln "FAIL: HPT case binders lost field precision, binding order, tag filtering, or conservative widening"
+        ok := false
+      if !HPTFixtures.recursiveFieldOk then
+        IO.eprintln "FAIL: recursive HPT fields lost depth-two projection, case-binder, budget, producer, or cache precision"
+        ok := false
+      if !HPTFixtures.casePruneOk program then
+        IO.eprintln "FAIL: checked HPT case simplification changed execution or crossed a conservative collapse boundary"
+        ok := false
+      if !HPTFixtures.recursiveCasePruneOk program then
+        IO.eprintln "FAIL: recursive checked HPT case simplification missed a nested rewrite or changed execution"
+        ok := false
+      if !HPTFixtures.callSelfCasePruneOk program then
+        IO.eprintln "FAIL: recursive checked HPT case simplification changed a terminating callSelf execution or failed to rewrite its current frame"
+        ok := false
+      if !HPTFixtures.pipelineCallSelfMainPruneOk program then
+        IO.eprintln "FAIL: checked HPT artifact-main pruning changed an exact finite-fuel callSelf result"
+        ok := false
+      if !HPTFixtures.declarationGraphCasePruneOk then
+        IO.eprintln "FAIL: checked HPT declaration-graph simplification failed to readdress a changed body, rewrite its main edge, or preserve execution"
+        ok := false
+      if !HPTFixtures.optimizerHarnessOk then
+        IO.eprintln "FAIL: optimizer policy, observations, deterministic report, fail-soft controls, address transport, or idempotence drifted"
+        ok := false
+      if !HPTFixtures.reachabilityCertificateOk then
+        IO.eprintln "FAIL: rooted reachability production, validation, adversarial rejection, fallback, or exact execution drifted"
+        ok := false
+      if !HPTFixtures.reachabilityHarnessOk then
+        IO.eprintln "FAIL: rooted reachability optimizer reporting, exported roots, one-rebuild content addressing, or execution drifted"
+        ok := false
+      if !HPTFixtures.papFusionHarnessOk then
+        IO.eprintln "FAIL: checked PAP/apply fusion drifted across saturation classes, rejection gates, reporting, execution, or idempotence"
+        ok := false
+      if !HPTFixtures.fetchForwardHarnessOk then
+        IO.eprintln "FAIL: checked scalar fetch forwarding drifted across allocation/reuse, rejection gates, reporting, exact execution, or idempotence"
+        ok := false
+      if !HPTFixtures.cacheConeOk program precise widened then
+        IO.eprintln "FAIL: HPT cache invalidation escaped or missed the dependency cone"
+        ok := false
+      if !HPTFixtures.persistentCacheOk program precise widened then
+        IO.eprintln "FAIL: persistent HPT cache ingress, recovery, or dependency-cone rebuilding drifted"
+        ok := false
+      if !HPTFixtures.persistentCacheBudgetsOk program precise then
+        IO.eprintln "FAIL: persistent HPT cache resource gates drifted at an exact or one-below boundary"
+        ok := false
+      if !(← HPTFixtures.persistentCacheFileOk program) then
+        IO.eprintln "FAIL: persistent HPT cache file ingress, framing rejection, or local repair drifted"
+        ok := false
+      if !(← HPTFixtures.persistentCacheDirectoryOk program) then
+        IO.eprintln "FAIL: indexed HPT chunk caching, lazy repair, or directory budgets drifted"
+        ok := false
+    | .error message, _ =>
+      IO.eprintln s!"FAIL: precise HPT post-fixpoint was rejected: {message}"
+      ok := false
+    | _, .error message =>
+      IO.eprintln s!"FAIL: widened HPT post-fixpoint was rejected: {message}"
+      ok := false
+    if !HPTFixtures.rejectsBadCertificates program then
+      IO.eprintln "FAIL: HPT checker accepted an underclaim, noncanonical fact, wrong identity, or reordered artifact list"
+      ok := false
+    if !HPTFixtures.resourceBudgetsOk program then
+      IO.eprintln "FAIL: HPT structural preflight drifted at an exact or one-below boundary"
+      ok := false
+    if !HPTFixtures.producerOk program then
+      IO.eprintln "FAIL: deterministic HPT production drifted in precision, repeatability, or bounded fallback"
+      ok := false
+
+  match HPTFixtures.aliasAddressed with
+  | .error message =>
+    IO.eprintln s!"FAIL: HPT alias/reuse fixture did not content-address: {message}"
+    ok := false
+  | .ok program =>
+    if !HPTFixtures.aliasReuseRegressionOk program then
+      IO.eprintln "FAIL: HPT retained a stale constructor fact across aliased reuse"
+      ok := false
+
+  match IxIR1ReaddressAllFixtures.fullyNested with
+  | .error message =>
+    IO.eprintln s!"FAIL: fully addressed nested IxIR₁ lowering failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIR1ReaddressAllFixtures.fullyNestedOk result then
+      IO.eprintln s!"FAIL: fully addressed nested IxIR₁ lowering drifted (map={repr (result.addressMap.map fun entry => Address.toHex entry.2)}, blocks={repr (result.blockAddresses.map Address.toHex)}, stable={repr (result.stable.map fun entry => Address.toHex entry.1)})"
+      ok := false
+  match IxIR1ReaddressAllFixtures.fullyCyclicLowering with
+  | .error message =>
+    IO.eprintln s!"FAIL: source/lifted IxIR₁ cycle lowering failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIR1ReaddressAllFixtures.fullyCyclicLoweringOk result then
+      IO.eprintln s!"FAIL: source/lifted IxIR₁ cycle did not become one two-member block (targets={repr (result.addressMap.map fun entry => Address.toHex entry.2)}, blocks={repr (result.blockAddresses.map Address.toHex)}, declarations={result.declarations.length}, audit={IxIR1ReaddressAllFixtures.fullyLoweredAudit [(IxIR1ReaddressAllFixtures.cyclicSourceKey, IxIR1ReaddressAllFixtures.cyclicSourceDeclaration)] (.ref IxIR1ReaddressAllFixtures.cyclicSourceKey) result})"
+      ok := false
+  if !IxIR1ReaddressAllFixtures.fullyProtectedSourceIdentityRejected then
+    IO.eprintln "FAIL: fully addressed lowering allowed a generated key to capture a constructor identity"
+    ok := false
+
+  match IxIRReaddressFixtures.nestedLowering with
+  | .error message =>
+    IO.eprintln s!"FAIL: nested lifted-lambda readdressing failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIRReaddressFixtures.nestedLoweringOk result then
+      IO.eprintln s!"FAIL: nested lifted-lambda addresses or runtime changed (map={result.addressMap.length}, generated={result.generated.length}, no-transient={result.noTransientReferences}, addressed={result.generatedAreAddressed}, entries={repr result.addressMap})"
+      ok := false
+
+  match IxIRReaddressFixtures.wrapperLowering with
+  | .error message =>
+    IO.eprintln s!"FAIL: constructor-wrapper readdressing failed: {message}"
+    ok := false
+  | .ok result =>
+    if !IxIRReaddressFixtures.wrapperLoweringOk result then
+      IO.eprintln s!"FAIL: constructor-wrapper content addressing drifted (map={result.addressMap.length}, generated={result.generated.length}, no-transient={result.noTransientReferences}, addressed={result.generatedAreAddressed}, entries={repr result.addressMap})"
+      ok := false
+
+  let generatedSummary := Ix.Compiler.IxIR1.WellModedGen.summarize
+  let expectedGeneratedSummary :
+      Ix.Compiler.IxIR1.WellModedGen.Summary :=
+    { checked := 280
+      differential := 180
+      expectedRejections := 100
+      allKindsSeen := true
+      finalState := 1151165198556225096
+      fingerprint := 6965325113816880105 }
+  if generatedSummary != expectedGeneratedSummary then
+    IO.eprintln s!"FAIL: well-moded generator corpus drifted: {repr generatedSummary}"
+    ok := false
+  match Ix.Compiler.IxIR1.WellModedGen.checkCorpus with
+  | none => pure ()
+  | some failure =>
+    IO.eprintln s!"FAIL: seeded IxIR₀ property case failed: {repr failure}"
+    IO.eprintln s!"      original expr: {repr failure.original.template.expr}"
+    IO.eprintln s!"      minimized expr: {repr failure.minimized.template.expr}"
+    ok := false
+
+  let overlongTrimmed : ByteArray := ⟨Array.replicate 9 0⟩
+  match runGet (getU64TrimmedLE 9) overlongTrimmed with
+  | .error message =>
+    if message != "getU64TrimmedLE: byte length 9 exceeds 8" then
+      IO.eprintln s!"FAIL: unexpected overlong u64 error: {message}"
+      ok := false
+  | .ok value =>
+    IO.eprintln s!"FAIL: accepted a nine-byte trimmed u64 as {value}"
+    ok := false
+
+  let duplicateKey := indexedAddress 7
+  let duplicateIndex := Ix.Compiler.AddressEnv.build
+    [(duplicateKey, 11), (duplicateKey, 22), (indexedAddress 8, 33)]
+  let duplicateLookup := Ix.Compiler.AddressEnv.lookup duplicateIndex
+  if duplicateLookup duplicateKey != some 11 then
+    IO.eprintln "FAIL: address index did not preserve first-binding precedence"
+    ok := false
+  if (duplicateLookup (indexedAddress 9)).isSome then
+    IO.eprintln "FAIL: address index returned a value for a missing key"
+    ok := false
+
+  let indexSize := 4096
+  let indexedEntries := (List.range indexSize).map fun n => (indexedAddress n, n)
+  let largeIndex := Ix.Compiler.AddressEnv.build indexedEntries
+  let largeLookup := Ix.Compiler.AddressEnv.lookup largeIndex
+  for n in [:indexSize] do
+    if largeLookup (indexedAddress n) != some n then
+      IO.eprintln s!"FAIL: address index lookup disagreed at entry {n}"
+      ok := false
+
+  -- This root comes from an actual ix-produced 19-member catalog, not the
+  -- local fixture writer.  Reversing the leaves and repeating one also pins
+  -- the canonical sort-and-deduplicate policy.
+  let artifactLeaves := MerkleFixture.memberRoots.reverse.push
+    MerkleFixture.memberRoots[0]!
+  if Merkle.rootCanonical artifactLeaves != MerkleFixture.membersRoot then
+    IO.eprintln "FAIL: canonical Merkle root drifted from the ix catalog artifact"
+    ok := false
+
+  -- Byte-exact production ix contact: a bounded Std closure generated by the
+  -- pinned ixon-v2 writer, independently hex-encoded under Tests/Fixtures/Compiler/.
+  let contactManifest ← CatalogContactFixture.readHex "manifest.hex"
+  let contactPiece ← CatalogContactFixture.readHex
+    "CompilatrixStdContact.ixe.hex"
+  match contactManifest, contactPiece with
+  | .error message, _ | _, .error message =>
+    IO.eprintln s!"FAIL: could not read ix contact fixture: {message}"
+    ok := false
+  | .ok manifestBytes, .ok pieceBytes =>
+    if manifestBytes.size != 267 || pieceBytes.size != 14600 then
+      IO.eprintln s!"FAIL: ix contact byte sizes changed: manifest={manifestBytes.size}, piece={pieceBytes.size}"
+      ok := false
+    if toString (Address.blake3 pieceBytes) !=
+        CatalogContactFixture.expectedPieceHash then
+      IO.eprintln "FAIL: ix contact piece hash changed"
+      ok := false
+    match Catalog.load manifestBytes #[pieceBytes] with
+    | .error error =>
+      IO.eprintln s!"FAIL: production ix contact rejected at ingress: {repr error}"
+      ok := false
+    | .ok loaded =>
+      if toString loaded.manifest.membersRoot !=
+          CatalogContactFixture.expectedMembersRoot ||
+          toString loaded.manifest.contentRoot !=
+            CatalogContactFixture.expectedContentRoot then
+        IO.eprintln s!"FAIL: ix contact catalog roots changed: members={loaded.manifest.membersRoot}, content={loaded.manifest.contentRoot}"
+        ok := false
+      if loaded.stats != CatalogContactFixture.expectedStats then
+        IO.eprintln s!"FAIL: ix contact stats changed: {repr loaded.stats}"
+        ok := false
+      match loaded.manifest.members[0]? with
+      | none =>
+        IO.eprintln "FAIL: ix contact lost its manifest member"
+        ok := false
+      | some member =>
+        if member.label != "CompilatrixStdContact" ||
+            member.toolchain != "leanprover/lean4:v4.33.1" ||
+            member.sourcePin !=
+              "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4" ||
+            member.constCount != 54 then
+          IO.eprintln s!"FAIL: ix contact provenance changed: {repr member}"
+          ok := false
+      match Ix.Compiler.Pipeline.checkProgram loaded.constants with
+      | .error (.usage address .freezeNeeded) =>
+        if toString address != CatalogContactFixture.expectedRemainingFreezeAddress then
+          IO.eprintln s!"FAIL: ix contact pipeline rejection moved to {address}"
+          ok := false
+      | .error error =>
+        IO.eprintln s!"FAIL: ix contact pipeline outcome changed: {repr error}"
+        ok := false
+      | .ok _ =>
+        IO.eprintln "FAIL: ix contact unexpectedly crossed the current usage-policy gate"
+        ok := false
+
+  -- Exact ix `.ixc` + anonymous `.ixe` framing.  The two fat members share
+  -- one closure constant: storage work counts six entries while the semantic
+  -- union contains five.
+  match CatalogFixtures.validFatInput with
+  | .error message =>
+    IO.eprintln s!"FAIL: could not construct valid catalog fixture: {message}"
+    ok := false
+  | .ok input =>
+    let pieces := input.pieces.map (·.bytes)
+    match Catalog.load input.manifestBytes pieces with
+    | .error error =>
+      IO.eprintln s!"FAIL: valid fat catalog rejected: {repr error}"
+      ok := false
+    | .ok loaded =>
+      if loaded.constants.length != 5 || loaded.stats.constantEntries != 6 ||
+          loaded.stats.unionConstants != 5 then
+        IO.eprintln s!"FAIL: fat overlap was not deduplicated exactly: \
+          entries={loaded.stats.constantEntries}, union={loaded.stats.unionConstants}"
+        ok := false
+      let stats := loaded.stats
+      let exactLimits : Catalog.Limits :=
+        { Catalog.defaultLimits with
+          maxManifestBytes := stats.manifestBytes
+          maxMembers := stats.members
+          maxDependencyEdges := stats.dependencyEdges
+          maxStorageUnits := stats.storageUnits
+          maxPieceBytes := stats.pieceBytes
+          maxConstantEntries := stats.constantEntries
+          maxConstantBytes := stats.constantBytes
+          maxBlobEntries := stats.blobEntries
+          maxBlobBytes := stats.blobBytes
+          maxAssumptions := stats.assumptions
+          maxHints := stats.hints
+          maxExpressionUnits := stats.expressionUnits
+          maxExpandedExpressionUnits := stats.expandedExpressionUnits
+          maxLayer1NodeVisits := stats.layer1NodeVisits
+          maxUnionConstants := stats.unionConstants }
+      match Catalog.loadWith exactLimits input.manifestBytes pieces with
+      | .ok _ => pure ()
+      | .error error =>
+        IO.eprintln s!"FAIL: exact aggregate catalog limits rejected: {repr error}"
+        ok := false
+      let tightEntries :=
+        { exactLimits with
+          maxConstantEntries := stats.constantEntries - 1 }
+      match Catalog.loadWith tightEntries input.manifestBytes pieces with
+      | .error (.resource exceeded) =>
+        let expected : Ix.Compiler.Ixon.Work.Exceeded :=
+          ⟨.catalogConstantEntries, stats.constantEntries,
+            stats.constantEntries - 1⟩
+        if exceeded != expected then
+          IO.eprintln s!"FAIL: wrong catalog-entry budget error: {repr exceeded}"
+          ok := false
+      | .error error =>
+        IO.eprintln s!"FAIL: another catalog-entry error surfaced: {repr error}"
+        ok := false
+      | .ok _ =>
+        IO.eprintln "FAIL: catalog crossed its constant-entry budget"
+        ok := false
+      let tightPieceBytes :=
+        { exactLimits with maxPieceBytes := stats.pieceBytes - 1 }
+      match Catalog.loadWith tightPieceBytes input.manifestBytes pieces with
+      | .error (.resource exceeded) =>
+        let expected : Ix.Compiler.Ixon.Work.Exceeded :=
+          ⟨.catalogPieceBytes, stats.pieceBytes, stats.pieceBytes - 1⟩
+        if exceeded != expected then
+          IO.eprintln s!"FAIL: wrong catalog-piece budget error: {repr exceeded}"
+          ok := false
+      | .error error =>
+        IO.eprintln s!"FAIL: another catalog-piece error surfaced: {repr error}"
+        ok := false
+      | .ok _ =>
+        IO.eprintln "FAIL: catalog crossed its aggregate piece-byte budget"
+        ok := false
+
+    let truncatedManifest := input.manifestBytes.extract 0
+      (input.manifestBytes.size - 1)
+    match Catalog.load truncatedManifest pieces with
+    | .error (.syntax .manifest _) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: manifest truncation returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: truncated catalog manifest was accepted"
+      ok := false
+
+    let original := pieces[0]!
+    let changedFile := original.set! 0 (original[0]! ^^^ (1 : UInt8))
+    match Catalog.load input.manifestBytes (pieces.set! 0 changedFile) with
+    | .error (.fileHash (.fat 0) _ _) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: changed piece returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: piece bytes drifted from the manifest hash"
+      ok := false
+
+    -- Remove the hint count and all opaque metadata, then bind the shortened
+    -- file in a fresh manifest.  This reaches semantic-prefix EOF rather than
+    -- stopping at the outer file-size/hash checks.
+    let truncatedPiece := original.extract 0 (original.size - 4)
+    let truncatedPieceManifest := CatalogFixtures.replaceFatBytes
+      input.manifest 0 truncatedPiece
+    match Catalog.load (CatalogFixtures.manifestBytes truncatedPieceManifest)
+        (pieces.set! 0 truncatedPiece) with
+    | .error (.syntax (.piece (.fat 0)) _) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: semantic piece truncation returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: piece truncated inside the anonymous prefix was accepted"
+      ok := false
+
+    -- The final constant payload byte is four bytes before EOF (hint count +
+    -- three empty metadata counts follow it). Rebinding only the file hash
+    -- must expose the inner constant-address mismatch.
+    let payloadIndex := original.size - 5
+    let corruptConstant := original.set! payloadIndex
+      (original[payloadIndex]! ^^^ (1 : UInt8))
+    let corruptManifest := CatalogFixtures.replaceFatBytes
+      input.manifest 0 corruptConstant
+    match Catalog.load (CatalogFixtures.manifestBytes corruptManifest)
+        (pieces.set! 0 corruptConstant) with
+    | .error (.constantHash (.fat 0) _ _ _) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: corrupt constant returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: constant bytes did not bind to their stored address"
+      ok := false
+
+  match CatalogFixtures.duplicateChunkInput with
+  | .error message =>
+    IO.eprintln s!"FAIL: could not construct chunk duplicate fixture: {message}"
+    ok := false
+  | .ok input =>
+    match Catalog.load input.manifestBytes (input.pieces.map (·.bytes)) with
+    | .error (.duplicateChunkAddress _ 0 1) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: chunk duplicate returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: duplicate constant crossed the chunk disjointness gate"
+      ok := false
+
+  match CatalogFixtures.invalidMemberInput with
+  | .error message =>
+    IO.eprintln s!"FAIL: could not construct projection-bound fixture: {message}"
+    ok := false
+  | .ok input =>
+    match Catalog.load input.manifestBytes (input.pieces.map (·.bytes)) with
+    | .error (.projectionMemberIndex _ _ 1 1) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: bad projection member returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: out-of-range projection member crossed store ingress"
+      ok := false
+
+  match CatalogFixtures.invalidOrdinalInput with
+  | .error message =>
+    IO.eprintln s!"FAIL: could not construct constructor-ordinal fixture: {message}"
+    ok := false
+  | .ok input =>
+    match Catalog.load input.manifestBytes (input.pieces.map (·.bytes)) with
+    | .error (.constructorOrdinal _ 0 0 7) => pure ()
+    | .error error =>
+      IO.eprintln s!"FAIL: bad constructor ordinal returned another error: {repr error}"
+      ok := false
+    | .ok _ =>
+      IO.eprintln "FAIL: non-positional constructor cidx crossed store ingress"
+      ok := false
+
+  for test in DecodeCheckFixtures.allCases do
+    let actual := DecodeCheck.decodeChecked (ser test.constant)
+    if !DecodeCheckFixtures.resultEq actual test.expected then
+      IO.eprintln s!"FAIL: checked-decode case '{test.name}'"
+      IO.eprintln s!"      actual:   {repr actual}"
+      IO.eprintln s!"      expected: {repr test.expected}"
+      ok := false
+
+  for test in DecodeCheckFixtures.resourceCases do
+    let actual := DecodeCheck.decodeChecked test.bytes
+    let expected : Except DecodeCheck.Error Constant := .error test.expected
+    if !DecodeCheckFixtures.resultEq actual expected then
+      IO.eprintln s!"FAIL: checked-decode resource case '{test.name}'"
+      IO.eprintln s!"      actual:   {repr actual}"
+      IO.eprintln s!"      expected: {repr expected}"
+      ok := false
+
+  let mut fuzzCases := 0
+  let mut fuzzAccepted := 0
+  for constant in DecodeCheckFixtures.validConstants do
+    for bytes in DecodeFuzz.mutations (ser constant) do
+      match DecodeFuzz.classify bytes with
+      | .rejected => pure ()
+      | .accepted => fuzzAccepted := fuzzAccepted + 1
+      | .roundTripFailure =>
+        IO.eprintln s!"FAIL: checked-codec mutation case {fuzzCases} accepted noncanonical bytes (length {bytes.size})"
+        ok := false
+      fuzzCases := fuzzCases + 1
+
+  let mut fuzzState : UInt64 := 0x6a09e667f3bcc909
+  for _ in [:DecodeFuzz.randomCaseCount] do
+    fuzzState := DecodeFuzz.nextState fuzzState
+    let size := fuzzState.toNat % (DecodeFuzz.maxRandomBytes + 1)
+    let (bytes, next) := DecodeFuzz.randomBytes fuzzState size
+    fuzzState := next
+    match DecodeFuzz.classify bytes with
+    | .rejected => pure ()
+    | .accepted => fuzzAccepted := fuzzAccepted + 1
+    | .roundTripFailure =>
+      IO.eprintln s!"FAIL: checked-codec random case {fuzzCases} accepted noncanonical bytes (length {bytes.size})"
+      ok := false
+    fuzzCases := fuzzCases + 1
+
+  if fuzzAccepted < DecodeCheckFixtures.validConstants.size then
+    IO.eprintln s!"FAIL: fuzz harness accepted only {fuzzAccepted} known-valid inputs"
+    ok := false
+
+  let boundaryBytes := ser DecodeCheckFixtures.validAxiom
+  let boundaryLimits : DecodeCheck.Limits :=
+    { maxObjectBytes := boundaryBytes.size
+      maxExpressionDepth := 2
+      maxUniverseDepth := 1
+      maxSequenceLength := 1 }
+  let boundaryActual := DecodeCheck.decodeCheckedWith boundaryLimits boundaryBytes
+  let boundaryExpected : Except DecodeCheck.Error Constant :=
+    .ok DecodeCheckFixtures.validAxiom
+  if !DecodeCheckFixtures.resultEq boundaryActual boundaryExpected then
+    IO.eprintln s!"FAIL: exact resource boundaries rejected a valid constant: {repr boundaryActual}"
+    ok := false
+
+  let objectLimits :=
+    { boundaryLimits with maxObjectBytes := boundaryBytes.size - 1 }
+  let objectActual := DecodeCheck.decodeCheckedWith objectLimits boundaryBytes
+  let objectExpected : Except DecodeCheck.Error Constant :=
+    .error (.objectTooLarge boundaryBytes.size (boundaryBytes.size - 1))
+  if !DecodeCheckFixtures.resultEq objectActual objectExpected then
+    IO.eprintln s!"FAIL: object byte limit was not enforced before decoding: {repr objectActual}"
+    ok := false
+
+  let sharedBytes := ser DecodeCheckFixtures.validShared
+  let sharedBodies := DecodeCheckFixtures.validShared.info.exprs.toArray
+  let sharedLayer1Work := Ix.Compiler.Ixon.Work.layer1NodeVisits
+    DecodeCheckFixtures.validShared.sharing sharedBodies
+  let exactSharingLimits : DecodeCheck.Limits :=
+    { DecodeCheck.defaultLimits with
+      maxLayer1NodeVisits := sharedLayer1Work }
+  let exactSharingActual := DecodeCheck.decodeCheckedWith exactSharingLimits
+    sharedBytes
+  let exactSharingExpected : Except DecodeCheck.Error Constant :=
+    .ok DecodeCheckFixtures.validShared
+  if !DecodeCheckFixtures.resultEq exactSharingActual exactSharingExpected then
+    IO.eprintln s!"FAIL: exact layer-1 work boundary rejected a valid constant: {repr exactSharingActual}"
+    ok := false
+  let tightSharingLimits :=
+    { exactSharingLimits with maxLayer1NodeVisits := sharedLayer1Work - 1 }
+  let tightSharingActual := DecodeCheck.decodeCheckedWith tightSharingLimits
+    sharedBytes
+  let tightSharingExpected : Except DecodeCheck.Error Constant :=
+    .error (.resource
+      ⟨.layer1NodeVisits, sharedLayer1Work, sharedLayer1Work - 1⟩)
+  if !DecodeCheckFixtures.resultEq tightSharingActual tightSharingExpected then
+    IO.eprintln s!"FAIL: layer-1 work limit returned the wrong failure: {repr tightSharingActual}"
+    ok := false
+
+  match DecodeCheck.decodeChecked (ByteArray.mk #[0xff]) with
+  | .error (.syntax _) => pure ()
+  | actual =>
+    IO.eprintln s!"FAIL: raw parser error was not structurally wrapped: {repr actual}"
+    ok := false
+
+  let malformedSharing := DecodeCheckFixtures.axiomConstant 0
+    (.app (.share 0) (.share 0)) #[] #[] #[]
+  if !(match DecodeCheck.checkConstant malformedSharing with
+      | .error .sharingInvariant => true
+      | _ => false) then
+    IO.eprintln "FAIL: direct local validation accepted malformed sharing"
+    ok := false
+
+  if Sharing.compressorPolicyId != "compilatrix/ixon-v2-sharing/1" then
+    IO.eprintln s!"FAIL: unexpected compressor policy id {Sharing.compressorPolicyId}"
+    ok := false
+  if Sharing.ixonV2PolicyId !=
+      "ix/ixon-v2-sharing@6f18ea907b78d06f7dc0917c43beb385561c35f4" then
+    IO.eprintln s!"FAIL: unexpected ixon-v2 policy id {Sharing.ixonV2PolicyId}"
+    ok := false
+  if wireFormatId != IxRebaseline.wireFormat then
+    IO.eprintln s!"FAIL: captured wire id {IxRebaseline.wireFormat} != {wireFormatId}"
+    ok := false
+  if ser goldenV2 != IxRebaseline.goldenV2Bytes then
+    IO.eprintln "FAIL: local goldenV2 bytes differ from the ix capture"
+    ok := false
+  match (de IxRebaseline.goldenV2Bytes : Except String Constant) with
+  | .ok decoded =>
+    if decoded != goldenV2 then
+      IO.eprintln "FAIL: ix-captured goldenV2 bytes decode to another constant"
+      ok := false
+  | .error message =>
+    IO.eprintln s!"FAIL: ix-captured goldenV2 bytes do not decode: {message}"
+    ok := false
+  if hashNats (Address.blake3 IxRebaseline.goldenV2Bytes) !=
+      IxRebaseline.goldenV2Address then
+    IO.eprintln "FAIL: ix-captured goldenV2 bytes hash to another address"
+    ok := false
+  if IxRebaseline.sharingCaptures.length != SharingPolicy.cases.size then
+    IO.eprintln "FAIL: ix sharing capture/case cardinality changed"
+    ok := false
+  if hashNats SharingPolicy.fingerprint != SharingPolicy.expectedFingerprint then
+    IO.eprintln s!"FAIL: sharing policy fingerprint changed: {hashNats SharingPolicy.fingerprint}"
+    ok := false
+
+  for c in SharingPolicy.cases do
+    match IxRebaseline.sharingCapture? c.name with
+    | none =>
+      IO.eprintln s!"FAIL: no ix capture artifact for {c.name}"
+      ok := false
+    | some capture =>
+      let inputBytes := runPut (SharingPolicy.putExprArray c.input)
+      let outputBytes := runPut (SharingPolicy.putCompression c.ixOutput)
+      if inputBytes != capture.input then
+        IO.eprintln s!"FAIL: transcribed ix input bytes changed for {c.name}"
+        ok := false
+      if outputBytes != capture.output then
+        IO.eprintln s!"FAIL: transcribed ix output bytes changed for {c.name}"
+        ok := false
+    let actual := Sharing.compressUnchecked c.input
+    if actual != c.v2Output then
+      IO.eprintln s!"FAIL: v2 policy vector changed for {c.name}: {repr actual}"
+      ok := false
+    if c.ixOutput.expanded != c.input then
+      IO.eprintln s!"FAIL: transcribed ix vector does not recover {c.name}"
+      ok := false
+    if c.v2Output.expanded != c.input then
+      IO.eprintln s!"FAIL: pinned v2 vector does not recover {c.name}"
+      ok := false
+    match c.relation with
+    | .exactParity =>
+      if c.ixOutput != c.v2Output || actual != c.ixOutput then
+        IO.eprintln s!"FAIL: common-case ix parity changed for {c.name}"
+        ok := false
+    | .intentionalV2Delta =>
+      if c.ixOutput == c.v2Output then
+        IO.eprintln s!"FAIL: declared v2 delta collapsed for {c.name}"
+        ok := false
+    if Sharing.compress? c.input != some c.v2Output then
+      IO.eprintln s!"FAIL: checked compressor diverged from policy vector for {c.name}"
+      ok := false
+    if Sharing.compressIxonV2? c.input != some c.ixOutput ||
+        !Sharing.structuralWF c.ixOutput.table c.ixOutput.bodies ||
+        !Sharing.ixonV2Canonical c.ixOutput.bodies c.ixOutput.table then
+      IO.eprintln s!"FAIL: pinned ixon-v2 recognizer diverged for {c.name}"
+      ok := false
+    if !Sharing.layer1WF c.v2Output.table c.v2Output.bodies ||
+        !Sharing.deletionLocalOptimal c.v2Output ||
+        !Sharing.allEntriesPay c.v2Output ||
+        !Sharing.canonical c.v2Output.bodies c.v2Output.table then
+      IO.eprintln s!"FAIL: pinned v2 vector violates compressor postconditions for {c.name}"
+      ok := false
+
+  let empty := Address.blake3 (ByteArray.mk #[])
+  if empty.hash.size != 32 then
+    IO.eprintln s!"FAIL: hash size = {empty.hash.size}"
+    ok := false
+  if hashNats empty != expectedEmptyBlake3 then
+    IO.eprintln s!"FAIL: blake3(empty) = {hashNats empty}"
+    IO.eprintln s!"      expected       {expectedEmptyBlake3}"
+    ok := false
+
+  if !(Address.blake3 (ByteArray.mk #[1, 2, 3])
+      == Address.blake3 (ByteArray.mk #[1, 2, 3])) then
+    IO.eprintln "FAIL: blake3 nondeterministic"
+    ok := false
+  if Address.blake3 (ByteArray.mk #[1, 2, 3])
+      == Address.blake3 (ByteArray.mk #[1, 2, 4]) then
+    IO.eprintln "FAIL: blake3 input-insensitive"
+    ok := false
+
+  if Sharing.exprHash (.lam .many (.sort 0) (.var 0)) ==
+      Sharing.exprHash (.lam .linear (.sort 0) (.var 0)) then
+    IO.eprintln "FAIL: sharing Merkle hash omitted the v2 lambda mode"
+    ok := false
+
+  let repeated : Expr := .ref 17 #[0, 1, 2]
+  let repeatedInput : Array Expr := #[repeated, repeated, repeated]
+  let repeatedUnits := Ix.Compiler.Ixon.Work.exprArrayUnits repeatedInput
+  match Sharing.compressWithLimit repeatedUnits repeatedInput with
+  | .ok (some _) => pure ()
+  | actual =>
+    IO.eprintln s!"FAIL: exact compressor work boundary rejected input: {repr actual}"
+    ok := false
+  match Sharing.compressWithLimit (repeatedUnits - 1) repeatedInput with
+  | .error exceeded =>
+    if exceeded !=
+        (⟨.compressionInputUnits, repeatedUnits, repeatedUnits - 1⟩ :
+          Ix.Compiler.Ixon.Work.Exceeded) then
+      IO.eprintln s!"FAIL: compressor work limit returned the wrong failure: {repr exceeded}"
+      ok := false
+  | actual =>
+    IO.eprintln s!"FAIL: compressor crossed an over-budget input: {repr actual}"
+    ok := false
+  match Sharing.compress? repeatedInput with
+  | none =>
+    IO.eprintln "FAIL: compressor rejected share-free repeated input"
+    ok := false
+  | some out =>
+    let expectedBodies : Array Expr := #[.share 0, .share 0, .share 0]
+    let expectedTable : Array Expr := #[repeated]
+    if out.bodies != expectedBodies || out.table != expectedTable then
+      IO.eprintln s!"FAIL: unexpected canonical compression {repr out}"
+      ok := false
+    if out.bodies.map (Sharing.inlineExpr out.table) != repeatedInput then
+      IO.eprintln "FAIL: inlining compressed roots did not recover input"
+      ok := false
+    if !Sharing.deletionLocalOptimal out || !Sharing.allEntriesPay out then
+      IO.eprintln "FAIL: compressor output failed the exact deletion audit"
+      ok := false
+    if !Sharing.canonical out.bodies out.table then
+      IO.eprintln "FAIL: compressor output was not a recompression fixpoint"
+      ok := false
+
+  -- Both the lambda and its repeated domain are initially profitable. Once
+  -- the lambda is shared, the domain occurs only once in residual syntax, so
+  -- the exact audit must remove that stale nested candidate.
+  let nestedLeaf : Expr := .ref 23 #[0, 1, 2]
+  let nested : Expr := .lam .many nestedLeaf (.var 0)
+  let nestedInput : Array Expr := #[nested, nested, nested]
+  match Sharing.compress? nestedInput with
+  | none =>
+    IO.eprintln "FAIL: compressor rejected nested repeated input"
+    ok := false
+  | some out =>
+    if out.table != #[nested] || out.bodies != #[.share 0, .share 0, .share 0] then
+      IO.eprintln s!"FAIL: exact audit retained a stale nested candidate {repr out}"
+      ok := false
+    if out.bodies.map (Sharing.inlineExpr out.table) != nestedInput then
+      IO.eprintln "FAIL: audited nested compression did not inline to input"
+      ok := false
+    if !Sharing.deletionLocalOptimal out || !Sharing.allEntriesPay out ||
+        !Sharing.canonical out.bodies out.table then
+      IO.eprintln "FAIL: audited nested compression failed its postconditions"
+      ok := false
+
+  let compressionCorpus : Array (Array Expr) := #[
+    #[],
+    repeatedInput,
+    nestedInput,
+    #[.sort 0, .var 0, .nat 0],
+    #[.ref 130 #[0, 129], .ref 130 #[0, 129], .ref 130 #[0, 129]],
+    #[.lam .many (.ref 9 #[0]) (.var 0),
+      .lam .many (.ref 9 #[0]) (.var 0),
+      .lam .linear (.ref 9 #[0]) (.var 0)],
+    #[.letE false (.sort 0) repeated (.app (.var 0) repeated),
+      .letE false (.sort 0) repeated (.app (.var 0) repeated)],
+    #[.prj 0 1 repeated, .prj 0 1 repeated, .prj 0 1 repeated],
+    #[.app (.app (.ref 3 #[]) repeated) repeated,
+      .app (.app (.ref 3 #[]) repeated) repeated]
+  ]
+  for input in compressionCorpus do
+    match Sharing.compress? input with
+    | none =>
+      IO.eprintln s!"FAIL: compressor rejected corpus input {repr input}"
+      ok := false
+    | some out =>
+      let heuristic := Sharing.compressUnchecked input
+      if !Sharing.layer1WF heuristic.table heuristic.bodies ||
+          !Sharing.allEntriesPay heuristic then
+        IO.eprintln s!"FAIL: raw heuristic violated its corpus invariants {repr heuristic}"
+        ok := false
+      if out != heuristic then
+        IO.eprintln s!"FAIL: certified fallback unexpectedly activated {repr input}"
+        ok := false
+      if Sharing.compress? input != some out then
+        IO.eprintln "FAIL: compressor was nondeterministic"
+        ok := false
+      if !Sharing.layer1WF out.table out.bodies then
+        IO.eprintln s!"FAIL: compressor emitted a non-layer-1 table {repr out}"
+        ok := false
+      if out.bodies.map (Sharing.inlineExpr out.table) != input then
+        IO.eprintln s!"FAIL: corpus compression did not inline to input {repr out}"
+        ok := false
+      if !Sharing.deletionLocalOptimal out || !Sharing.allEntriesPay out then
+        IO.eprintln s!"FAIL: corpus compression retained a non-paying entry {repr out}"
+        ok := false
+      if !Sharing.canonical out.bodies out.table then
+        IO.eprintln s!"FAIL: corpus output was not canonical {repr out}"
+        ok := false
+
+  let doublingTable := WorkBudgetFixtures.doublingTable 3
+  let doublingBodies := WorkBudgetFixtures.doublingBodies doublingTable
+  let doublingLayer1 := Ix.Compiler.Ixon.Work.layer1NodeVisits doublingTable
+    doublingBodies
+  let doublingExpanded :=
+    (Ix.Compiler.Ixon.Work.expandedUnits? doublingTable doublingBodies).getD 0
+  if doublingExpanded != 31 ||
+      !Sharing.layer1WF doublingTable doublingBodies then
+    IO.eprintln s!"FAIL: sharing-expansion budget fixture changed (expanded {doublingExpanded})"
+    ok := false
+  let exactCanonicalLimits : Sharing.ResourceLimits :=
+    { maxLayer1NodeVisits := doublingLayer1
+      maxCompressionInputUnits := doublingExpanded }
+  match Sharing.canonicalWith exactCanonicalLimits doublingBodies doublingTable with
+  | .ok _ => pure ()
+  | .error exceeded =>
+    IO.eprintln s!"FAIL: exact canonicalization work boundary rejected input: {repr exceeded}"
+    ok := false
+  match Sharing.canonicalWith
+      { exactCanonicalLimits with
+        maxLayer1NodeVisits := doublingLayer1 - 1 }
+      doublingBodies doublingTable with
+  | .error exceeded =>
+    if exceeded !=
+        (⟨.layer1NodeVisits, doublingLayer1, doublingLayer1 - 1⟩ :
+          Ix.Compiler.Ixon.Work.Exceeded) then
+      IO.eprintln s!"FAIL: canonical layer-1 limit returned the wrong failure: {repr exceeded}"
+      ok := false
+  | actual =>
+    IO.eprintln s!"FAIL: canonicalizer crossed its layer-1 budget: {repr actual}"
+    ok := false
+  match Sharing.canonicalWith
+      { exactCanonicalLimits with
+        maxCompressionInputUnits := doublingExpanded - 1 }
+      doublingBodies doublingTable with
+  | .error exceeded =>
+    if exceeded !=
+        (⟨.compressionInputUnits, doublingExpanded, doublingExpanded - 1⟩ :
+          Ix.Compiler.Ixon.Work.Exceeded) then
+      IO.eprintln s!"FAIL: canonical expansion limit returned the wrong failure: {repr exceeded}"
+      ok := false
+  | actual =>
+    IO.eprintln s!"FAIL: canonicalizer materialized an over-budget expansion: {repr actual}"
+    ok := false
+
+  let c : Constant :=
+    { info := .axio { isUnsafe := false, lvls := 1, typ := .sort 3 }
+      sharing := #[], refs := #[], univs := #[.zero] }
+  if ser c != IxRebaseline.sampleAxiomBytes then
+    IO.eprintln "FAIL: local sample axiom bytes differ from the ix capture"
+    ok := false
+  match (de IxRebaseline.sampleAxiomBytes : Except String Constant) with
+  | .ok decoded =>
+    if decoded != c then
+      IO.eprintln "FAIL: ix-captured sample bytes decode to another constant"
+      ok := false
+  | .error message =>
+    IO.eprintln s!"FAIL: ix-captured sample bytes do not decode: {message}"
+    ok := false
+  if hashNats (Address.blake3 IxRebaseline.sampleAxiomBytes) !=
+      IxRebaseline.sampleAxiomAddress then
+    IO.eprintln "FAIL: ix-captured sample bytes hash to another address"
+    ok := false
+  -- The upstream codec vectors intentionally contain synthetic out-of-range
+  -- table indices. Their raw hashes stay frozen above, but they are not
+  -- semantic constants and must not cross the strengthened address gate.
+  if c.address?.isSome then
+    IO.eprintln "FAIL: locally malformed sample axiom acquired an address"
+    ok := false
+  if goldenV2.address?.isSome then
+    IO.eprintln "FAIL: locally malformed goldenV2 fixture acquired an address"
+    ok := false
+
+  let addressable := DecodeCheckFixtures.validAxiom
+  match addressable.address? with
+  | none =>
+    IO.eprintln "FAIL: checked canonical constant was not addressable"
+    ok := false
+  | some address =>
+    if address != Address.blake3 (ser addressable) then
+      IO.eprintln "FAIL: checked address gate hashed different bytes"
+      ok := false
+
+  let addressBodies := addressable.info.exprs.toArray
+  let addressLayer1 := Ix.Compiler.Ixon.Work.layer1NodeVisits
+    addressable.sharing addressBodies
+  let addressExpanded :=
+    (Ix.Compiler.Ixon.Work.expandedUnits? addressable.sharing
+      addressBodies).getD 0
+  let exactAddressLimits : Constant.AddressLimits :=
+    { ingress :=
+        { DecodeCheck.defaultLimits with
+          maxLayer1NodeVisits := addressLayer1 }
+      sharing :=
+        { maxLayer1NodeVisits := addressLayer1
+          maxCompressionInputUnits := addressExpanded } }
+  match addressable.addressCheckedWith exactAddressLimits with
+  | .ok address =>
+    if address != Address.blake3 (ser addressable) then
+      IO.eprintln "FAIL: bounded address gate hashed different bytes"
+      ok := false
+  | .error error =>
+    IO.eprintln s!"FAIL: exact bounded address gate rejected input: {repr error}"
+    ok := false
+  let tightAddressLimits : Constant.AddressLimits :=
+    { exactAddressLimits with sharing :=
+        { exactAddressLimits.sharing with
+          maxCompressionInputUnits := addressExpanded - 1 } }
+  match addressable.addressCheckedWith tightAddressLimits with
+  | .error (.resource exceeded) =>
+    if exceeded !=
+        (⟨.compressionInputUnits, addressExpanded, addressExpanded - 1⟩ :
+          Ix.Compiler.Ixon.Work.Exceeded) then
+      IO.eprintln s!"FAIL: bounded address gate returned the wrong resource failure: {repr exceeded}"
+      ok := false
+  | actual =>
+    IO.eprintln s!"FAIL: bounded address gate crossed its compressor budget: {repr actual}"
+    ok := false
+
+  match DecodeCheck.encodeChecked addressable with
+  | .ok bytes =>
+    if bytes != ser addressable then
+      IO.eprintln "FAIL: checked writer changed canonical bytes"
+      ok := false
+  | .error error =>
+    IO.eprintln s!"FAIL: checked writer rejected valid constant: {repr error}"
+    ok := false
+
+  match DecodeCheck.encodeChecked c with
+  | .error (.invalid (.universeIndex _ 3 1)) => pure ()
+  | .error error =>
+    IO.eprintln s!"FAIL: checked writer returned another error: {repr error}"
+    ok := false
+  | .ok _ =>
+    IO.eprintln "FAIL: checked writer accepted the malformed sample"
+    ok := false
+
+  let merelyLayer1 : Constant :=
+    { info := .axio
+        { isUnsafe := false, lvls := 0
+          typ := .app (.share 0) (.share 0) }
+      sharing := #[.sort 0], refs := #[], univs := #[.zero] }
+  if !merelyLayer1.sharingWF then
+    IO.eprintln "FAIL: noncanonical identity fixture was not layer-1 valid"
+    ok := false
+  if merelyLayer1.canonicalSharing then
+    IO.eprintln "FAIL: redundant small sharing table passed layer 2"
+    ok := false
+  if merelyLayer1.address?.isSome then
+    IO.eprintln "FAIL: merely layer-1 constant crossed the address boundary"
+    ok := false
+
+  if ok then
+    IO.println "tests-ok"
+    return 0
+  else
+    return 1
diff --git a/Tests/Compiler/X86ObjectFixture.lean b/Tests/Compiler/X86ObjectFixture.lean
new file mode 100644
index 000000000..45b435f27
--- /dev/null
+++ b/Tests/Compiler/X86ObjectFixture.lean
@@ -0,0 +1,123 @@
+import Ix.Compiler.X86.ELFValidate
+import Ix.Compiler.X86.EvalExamples
+import Ix.Compiler.X86.Select
+import Ix.Compiler.X86.ValidatedScalar
+
+/-! Operational fixture generator for the external ELF/binutils gate. -/
+
+open Ix.Compiler
+open Ix.Compiler.X86
+open Ix.Compiler.Ixon
+
+private def usage : String :=
+  "usage: lake exe compiler-x86-object-fixture (arithmetic|direct-call|runtime|selected-scalar|validated-scalar) <output.o> [natural for validated-scalar]"
+
+/-- Default provenance for the hand-written target and IxIR₂ fixtures.
+The validated Ixon fixture replaces it with its actual addressed IxIR₁ root. -/
+private def fixtureProvenance : X86.ELF.Provenance :=
+  .ixir1Policy (Address.replicate 0x42) 1 1
+
+private structure Fixture where
+  program : Program
+  runtime : Runtime
+  sourceResult : Option Word := none
+  sourceRoot : Option Address := none
+  provenance : X86.ELF.Provenance := fixtureProvenance
+
+private def selectedScalarFixture : Except String Fixture := do
+  let source := X86.Select.scalarMoveProgram 42
+  let selected ← match X86.Select.select source with
+    | .ok output => pure output
+    | .error error => throw s!"IxIR₂ selection failed: {repr error}"
+  let sourceRun ←
+    match IxIR2.Eval.runMain (X86.Select.sourceContext 42) .physical source 3 0 with
+    | .ok result => pure result
+    | .error error => throw s!"IxIR₂ execution failed: {repr error}"
+  let sourceWord ← match sourceRun.value with
+    | .lit (.nat number) =>
+        let word := UInt64.ofNat number
+        if word.toNat == number then pure word
+        else throw "IxIR₂ result exceeded the selected 64-bit scalar range"
+    | _ => throw "IxIR₂ scalar fixture returned a non-Nat value"
+  if sourceWord != selected.word then
+    throw "IxIR₂ and selected target observations disagree"
+  else
+    pure { program := selected.target.program
+           runtime := Runtime.rejecting
+           sourceResult := some sourceWord }
+
+private def validatedScalarFixture (number : Nat) : Except String Fixture := do
+  let compiled ← match X86.ValidatedScalar.compile number with
+    | .ok compiled => pure compiled
+    | .error error => throw s!"validated source compilation failed: {repr error}"
+  let sourceWord ← compiled.observe
+  return { program := compiled.selected.target.program
+           runtime := Runtime.rejecting
+           sourceResult := some sourceWord
+           sourceRoot := some compiled.sourceRoot
+           provenance := compiled.provenance }
+
+private def fixture? (number : Nat) : String → Except String Fixture
+  | "arithmetic" =>
+      pure { program := X86.Examples.arithmeticProgram
+             runtime := Runtime.rejecting }
+  | "direct-call" =>
+      pure { program := X86.Examples.callProgram
+             runtime := Runtime.rejecting }
+  | "runtime" =>
+      pure { program := X86.Examples.runtimeProgram
+             runtime := X86.Examples.fixtureRuntime }
+  | "selected-scalar" => selectedScalarFixture
+  | "validated-scalar" => validatedScalarFixture number
+  | _ => .error usage
+
+def main (args : List String) : IO UInt32 := do
+  let some (fixture, outputPath, number) :=
+      (match args with
+       | [fixture, outputPath] => some (fixture, outputPath, 42)
+       | ["validated-scalar", outputPath, number] =>
+           number.toNat?.map fun number => ("validated-scalar", outputPath, number)
+       | _ => none)
+    | IO.eprintln usage
+      return 2
+  let selectedFixture ← match fixture? number fixture with
+    | .ok selected => pure selected
+    | .error error =>
+        IO.eprintln error
+        return 2
+  let program := selectedFixture.program
+  let runtime := selectedFixture.runtime
+  let checked ← match program.check with
+    | .ok checked => pure checked
+    | .error error =>
+        IO.eprintln s!"x86-object-fixture: validation failed: {repr error}"
+        return 1
+  let localResult ←
+    match (runFrom runtime checked 64 (Core.empty 0x1008)).status with
+    | .halted result => pure result
+    | status =>
+        IO.eprintln s!"x86-object-fixture: local execution failed: {repr status}"
+        return 1
+  let encoded ← match X86.Stream.encode checked with
+    | .ok stream => pure stream.output
+    | .error error =>
+        IO.eprintln s!"x86-object-fixture: encode failed: {repr error}"
+        return 1
+  let object ← match X86.ELF.writeChecked
+      { encoded
+        entryBlock := program.entry
+        provenance := selectedFixture.provenance } with
+    | .ok object => pure object.bytes
+    | .error error =>
+        IO.eprintln s!"x86-object-fixture: ELF write failed: {repr error}"
+        return 1
+  IO.FS.writeBinFile outputPath object
+  let sourceResult := match selectedFixture.sourceResult with
+    | none => "-"
+    | some result => toString result
+  let sourceRoot := match selectedFixture.sourceRoot with
+    | none => "-"
+    | some address => address.toHex
+  IO.println
+    s!"fixture={fixture} source={sourceResult} local={localResult} bytes={object.size} ixon={sourceRoot} ir1={selectedFixture.provenance.root.toHex}"
+  return 0
diff --git a/Tests/Fixtures/Certified/README.md b/Tests/Fixtures/Certified/README.md
new file mode 100644
index 000000000..ca6596f1b
--- /dev/null
+++ b/Tests/Fixtures/Certified/README.md
@@ -0,0 +1,22 @@
+# Frozen C7 adapter evidence
+
+`c7-handoff.tar.gz` preserves the 53 cumulative C2–C7 adapter source files,
+their authenticated patches and source identities, and the historical C7
+reports and regression corpora. Its SHA-256 and the source-to-local mappings
+are recorded in [`ImportManifest.lean`](../../Certified/ImportManifest.lean).
+
+Run `lake run check-certified` from the repository root. The gate checks the
+archive and maintained source identities, the exact declaration audit, seven
+native test programs and three command-line corpora. Generated source and
+envelope bytes and process output must match the frozen evidence. JSON
+requests and aggregate CLI records are compared as parsed values because the
+maintained Lean driver uses different whitespace and object-key ordering.
+
+The archive's historical Python and shell drivers are provenance, not test
+dependencies. Current tests use Lean. Execution requires the usual Linux
+build tools, including `tar`, `sha256sum` and `timeout`.
+
+The complete historical Ix base commit is not included. The preserved patch
+sequence is sufficient to reconstruct the selected adapter files because
+each first appears as a new file. The historical reproduction script still
+requires its original base checkouts; current Ix validation is self-contained.
diff --git a/Tests/Fixtures/Certified/c7-handoff.tar.gz b/Tests/Fixtures/Certified/c7-handoff.tar.gz
new file mode 100644
index 000000000..38e00ee7e
Binary files /dev/null and b/Tests/Fixtures/Certified/c7-handoff.tar.gz differ
diff --git a/Tests/Fixtures/Compiler/ixon-std-contact/CompilatrixStdContact.ixe.hex b/Tests/Fixtures/Compiler/ixon-std-contact/CompilatrixStdContact.ixe.hex
new file mode 100644
index 000000000..f9aa37cb0
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-std-contact/CompilatrixStdContact.ixe.hex
@@ -0,0 +1,457 @@
+e21bc7e2215a1967d8c937f48526facdc7006cd4c9b7b6ef4f1063bb55c50dee
+0200005b029307bb4090930f4aa04c0574d4a5d137cfe1cd4e4ff54248fcdbe3
+9241305c025f66039cd042350daa09eb3e763fe604d34e5dbce27a59f519cbe1
+f794f638e0353e0c696e73744f664e61744e61740538661423236a5d8df6286a
+8633369e2a03c5f90d48eded333222dbee8cdbdd017407c1921d9f9badf79615
+39bc2ec3b06f3e8891fbd63debc2b8961804af83dba70341646408715785c0a5
+3d2f773b543dfa36382a0f976734502c08c16ea80d0e3eecd5c1086164645f63
+6f6d6d091f09a9e781146611e1b8aab10a8da1b5714a5e280c76c44f006a654a
+013a5a0550556e69740afaa49d2f192e628c231bdfae4eb65320c87de05fb833
+3e765e0da562e8f303096d617463685f315f310be59e1e575078ba1909156538
+43de315461ae3bc272404f94d09659c61b0cf103685f320f7fedb3a7a0bcbcbb
+509594f546638b9110c2ef524752a338a76b5a827c06df08626f72726f776564
+10e5cf3d3c8a4f9f3468c8cc58eea84892a22fdadbc1acb22410190044c1d553
+0162135e48e7e8a6c46c54b691dc13e3ce20b8426755ed52ad5f93ebb4b66215
+b318017516681c65cea26cc0910839a985baf545d294d8a6d3baffd0cc04f176
+00045b82015f17762fddd969a453925d65717ac3eea21320b66b54342fde1512
+8d6caf21215f01611a16fe62e91a9f1a8ac18475d8596563e9732f71710c1947
+4972232cfc9e4c900245711fb827399917b499233cce8f094f5c307eda6598d8
+7bfef98c6c15be1981f06e025f4023332d7112ec072609d3c44a4c28ef29e062
+b78d942c634ddf53fddc5fa4c932044461746123c7cdb118db77dddc3b1324a1
+af6f7acca362571391ba35bb25e360e3a0e0d302696424446fefc721193e73f8
+a30fa7e003584204b8ca979c8d9822ad8b14f53a9f4b055050726f642d3adedf
+f11b61f14c886e35afa036736dcd87a74d27b5c1510225d0f592e21301002fe5
+c3b745e6835c336d32d7e8a7c962b5b47d0bcd8e9ddbddc04506488061660662
+7265634f6e36258ac2045cb35461fd1475c36c9d009374d6dfab28535c8d9dfd
+9ae26353ad046841646436335ca82c533790f306cdda6418e43d38b97837c523
+6709a98a8ab14a7ec3c50448416464370e9c8d88a08177c895c5b3f2372f64cc
+146ca71c6b46e1aa7385c869d07b3a095f696e7465726e616c382bccbdbe1817
+861764d0aacd7c006d41cf0fc8cf2223d08446ad5ae05845ba40646461393139
+6463653562653830653366613234613230353462306138653866623631633865
+36366663383832363436333834366265316438386136643137323a03ccc12d75
+44d029ee0b0da9fab4d716042be2b322b6bc5531dd279662dc9c036164643ae7
+d805f6789a6402acb70ad4096a85a56bf6804eaf25c0493ac697548d30b50178
+3d9f3145e465a8bc02b44549c946bb7617912a24895cc7d305647dd81c883d0b
+02ceb141a536dace37fcbedf4420381b43001f83b2b37a317b34ce247b797358
+d4cfa6087a65726f5f61646447379ed30da426823dca68e504f32273f156a05e
+bafb71c240ea699eaf05a8104032323031666566353565393861663062323832
+3666666465633630373663666439306235626637303862366138316466363865
+3764656236386139336130616148fc721fbbc172e0925fa27af1671de225ba92
+7134802998b10a1568a188652b01014a1e506681629e0e6207c17443e07f1683
+408b062a4b34a8788176d3eadea52f056f664e61744a7bd77989f19359d267de
+6560186d2230a488497df4f258738d9c990383d63404696e73744ba778194991
+f338b9d485485ee0aae619168b711d748070760b11f8a075ef5004737563634b
+aeec49c0abd10f12bd22788cef761000290379f7491381835ac04723e61b2007
+5f6879674374784f2cfe7f25b75c53be55b15962e33f48c6715fd9dd6c7eb6fb
+6a8d641f61d6d0047a65726f4f7c337b2ac5ea5a7cc45a3e9e3d4d8ea640fe3c
+27254651a8652fe657e0d63d047265666c55b56aa5e423f54bd9d39e011f2644
+c7dce72443e468be77bf2b3d121e7a04210372666c56fe5043651261131c9df7
+ded34d7f122a4fbabc5af57c6b06c92ed50ff6e6b405426173696357f919d76d
+53affd58ccc723917201e5a2fb42e4818f9ac9472f9337a8c608bb0474686973
+5e7a952975f935f7c214ae01b3242355c7a0cfdbbc7ceb8c920c86cc5943450c
+4033326632616339333065373435346139323834343266353836396561383339
+3530383637323763626463336539646563643534313033353439613464646136
+346216b71f2f00c6068c2c8ba82898fdaf4e70eb8d15119b27e0e24c0143d5d2
+bf04756e69746497f5f55d5b779c94e0d8d309cc2ebf757ec548601d4a98f386
+eab997c75593034e61746ef63f2c9215d5c0cb28d0284aa8f865b51de83a1cb7
+f10e8743051aa1300e05066d6f7469766571fc8c1115e5c45a78024564527db9
+a1b217a94c66a3f86ccee681cc0a65f24c04556e6974744caf711c80a1e8bfac
+2972e9b12c216ef03ea16489e78981a415c6eb11373a05726967687476f0cb0f
+51e3516847d3ba7a9f061dbc6aa4f30f28069f11d40bb9b4690e9fbe40373534
+3731383433326337363764333434623162623463386433616662386138343130
+38363433636237656363326636336538316630366462393662346331347d79cc
+6bfaa03ab6dcfa739695d2e468a9b07bb527c64f59d66bdaf0bb680c1615436f
+6d70696c6174726978537464436f6e7461637483d9dab06011479163c7c4d5fa
+735f911bac86729f56aaa115b7eed2eb66e022016d87e596f34bdd4ba9812a52
+22449c3ed968ef3313c6dc4316dd4e4fcea27e55f2046c65667487f55303cbda
+3e218f3c3209ce170689b327d8c203dcd48e0fd2646a44b0b7d503755f318934
+a72989d96ee7ec949b3b6d2b59acfb4882fbd884de6e2b6c821a5c8d8b570461
+e282819ab05a13b1139a5eb431e3527b2729e379d81d3f7a243e8607eedb5611
+3d7b89076d617463685f319ab388bedc43eaf44150107d17ad090f6b1c34610f
+5740778ddb95d9f06576ee0166a37ed767ced61afe29f082aa92225a6d95bd48
+769ac41f640ed1ebf383c9003c0562656c6f77a3d9053fad3d51dccbf20395a3
+b047093656833582412ab1ae2b984998ae1ce208737563635f616464a74e0b14
+33b54b7a33bfe58e60093239cbcfca8c4bebcbf11b706970b8da2fbb016ea969
+db5dd799057ddb55e4fd8873571b6449e7f5836490267842a8c79727bdd9046e
+5f6968af4f990b45faba3203e0d5af8aa8019354ebb27147adf18c9ec40dfe99
+7dde9c045f687967af8feb40912d08e8cacddf8d0e2540c1ece893543438828a
+ac7d992529b0cbc208696e737448416464b8ef26a30faf2e44014ad1649965ac
+2f86a6e0e744fbe5962b1ad49829e264f102ceb2b973104f7e2fdcd511529bd8
+c0771900b0bb4efb51b98590db6adad4748b01800473796d6dba223fc2a5dc16
+f4bc6a4d095f4ed31318812e52310a420867f640011bbb48cb106e6f496d706c
+696369744c616d626461bc07cda8fb4c967fe567ea9a5d2edd3de2d46483dfdf
+c02fa1327308e400bdd7085f70726976617465bd04da9fe9fde32d4f4ed63f6e
+0fdec77b8cb00f15f3646a6ae92a01f903328e0461e28282bdd9370e54756afe
+dc9499eb502df6a693924b3203aefc30f8484cf1e08f4489025f61c0e199065e
+ef9b207692f6ae9db665a461672e95c166792315d4ba451bf6274602676fc3af
+7b114121534b19203c45ca316c944a90c067bba3dcf1e5625d12730308740168
+c7f5f320c8d04e32a0417f7327413d0387a9d459b9a3b02e287a834bdd99d83b
+036d7072ce9fc5e02643a5a6eb3c5422e74a5c2d505db7695544e1bc1a55d54c
+2d7cd78440613030633237613639353635323737663331393137303235383662
+3530386361663839306638353466653133643433653235626263313033383135
+6131383037cfc437c2d94e9e60cbd3b12ae3a34080a6a19c4428f530899bed46
+f23923e0f604436f7265d5ad9b07a305da3a58a26ae710d2cf02633f60e04420
+1872044f37fa78dcab5f03736e64d6e13445ca661486a33c56a807a1cfa081a1
+37c202c91ae8585d8f542142696e04496e6974d85e5cb5352069503457f56800
+654d5b09c83dd59dfc9cb9f97dfa31229aea85075072656c756465d95cfd7f0d
+77eff3c059903f735df283e30961491d344224e665704b66a1a46103685f31df
+6d3bc1aa3f8c03a55e81d46ed8156602b35e1f15e0d3ef44beb619db987d7407
+63617365734f6ee3a0576e72c3980ff1701795f0a661e33ad2b7ff19792fb682
+bffdc6c520adc340663861613635633935313837383435306236303732366135
+3936376233396330363733626261306139643832316531653235346331313837
+3137373431316465e3c22335ae42bda52fb3b6fd01f3f3bc58a9e447c25bc064
+0da68fa1e2800a740a696e73744164644e6174e4770c4390fd3e8f0d67825260
+87887e839f8b6a306c32bbe209e4ed04908e2103667374eabb89c9e7c89792ae
+7ad7599fe7796ca2b78adcde75e19e11991de1d96bd8bf03465f31eae3fee6f4
+d8898bb62401e3ecb5e1f58da98a39cfc747ae6ec436f6a52bc6b9026d6befec
+3979de99cc41c9dc0bf4dbb03c7fee928d93b77d9a2153090d69f5f7e08a0473
+656c66f20cdf620e4ea6a40753d11169c4c44b295774369e786c02c365a52def
+9e91804032616430386330653432623861396661666363663863363563613736
+6162356664623130616538383233313566303338623732303635633566613531
+36333131f2f21520bebe5d07c6813b972de3617a0a0d50a36be3784e9fece54c
+ff8d80320177f5accc8f3a3e952170ca104b8775665fcc2d750c83bae2c8e01a
+0b739414f655054f664e6174f5ef4b7ebe3b90ecdb764d29ac70bdac6ba27b39
+5caa7320d2f80412c0b9e21f08636f6e6772417267f60d2cc0f29d89288e070b
+add2ab5e6240071da1fe7220d7b2d601fe078328ef02ceb3f9eb15807e32aa5a
+bd21e9435ceaec6546e4aafff0bd78c1b0aa5fce2b84c1c303726563faaa2faf
+acb1f818ce2bb0ffdcd18fc9f602722bad1b798c2041d449d2934c8407616464
+436f6d6dfb2b51dcc2a3fe4ff050e1437e175b88f3daf222ae7889b99e66e708
+83db5d26086f7574506172616dfbf7129093429293d558b3993ca13988daba89
+3f4a191bc2b1c1e5b52a0d01720176fca6cd096edc67635b3f4fa4636dd23122
+895a6a986df54234add7362b4b018c02497836046854886c4f39e9064cae9d05
+e0a58fa108eab17b80c68dc51aa12b4eba50e8816901d009009207b107b172b8
+0972b808712002111071200272b80811108203b103b1742105008103b19107b1
+72b80972b808712002101171200272b8081011102007110a2306000000200171
+b0b171b2b171b3b121030071b5b171b6200071b4b771210401b108092dfe6ad7
+950efae0c52d65b1283cd9818a194f2f219b2a8132a6f7742802f31dfffde48c
+4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59e927714d8c09ca644b
+10decad158d37006e81cdc1b84761312260546449aa02e343b2b0caf2b9d95e1
+ef62e99fd9f8cd585523fee8e91680ec577f94aa3d65478b40f1e8b20ea17ba3
+d9723f0bd06457d9cf48ce26ca36619b946980627de923873e9595db8696e269
+f5593e39baf02fb2bee6caa5dd3a7dc04c9644ca21d8ed9fc5be9fe70d50ea33
+f5f2d68d67aade6ba4bf365002c74c76bf30b0672fe4d71254ccf6f2ef01c616
+3b25df180f44a1d50f32ca4f6e37818832976a64e26dfd8fceb01f0200010009
+2dfe6ad7950efae0c52d65b1283cd9818a194f2f219b2a8132a6f7742802f380
+95d00100712102002000722101002000200300041dfffde48c4ef6653b95ecc5
+474dee8b99461008d26d80ca384f1e59e927714d701f9b251f8d3b9ea3a5b888
+530cb7745c210d19550dfbd4c8c140f4db39b684913d39d8e695c7c752b9fe50
+725bd719934f83d649e8516023f74d440b5f4371f9ac92a11388a7cdca229a80
+24208554feb32d6c0a3af74a7bc12c28b949543c0100131533e96baa7f50ba89
+d01892243e11a1221c8831e2f394eb14f89e9a54c6c4815901d001009407b808
+07b007b507b77113128403b80803b003b503b7742106008103b0711410127111
+20028103b071111009200071210700b071b16171b2712005617112b391072004
+b47113712003109107b0b69107b000081dfffde48c4ef6653b95ecc5474dee8b
+99461008d26d80ca384f1e59e927714d2d3adedff11b61f14c886e35afa03673
+6dcd87a74d27b5c1510225d0f592e21378c03805f8eaf7d367e0f57909abd566
+d94a2bebcf6270fe2fe74af954ed0d008c09ca644b10decad158d37006e81cdc
+1b84761312260546449aa02e343b2b0c9232498667f765f437dedaac828e555f
+6cc67a20e6db28f614fdf3c262710febb093aee1ae257c8c7c99acedec08a1c3
+c1f0289654778a35862d7f0890e17ee5b2f8855b5e76a480493cd6cc922977e6
+0723b4bec665dd7e9b73ca2b215df576c68bfa47519ff72b1d053b86e6e3b735
+6286eb2252616cc5b2acbed59ef1f5f001001ce12e12485a4793aa5baf4f197f
+5d5ceb5fb8e166f1a06640b87f9c91dad72580bbd001019207b107b0018203b1
+03b0742103008103b0012101018203b003017222020201711311101002200091
+07b002041dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59
+e927714d2dfc16af01b82b3b91c2ff704409d76236a83f956c0c6e6659a64fe2
+1d76695b7eac420873e8f1ea8fe66831a6c6f69d88693bed6aeb30bfba82069a
+f60ebea889d6690b0808b1da49e015a4f21df3fc3f00fb96ac502f5f097ce452
+e573704c034001c0020040c00100c01dfffde48c4ef6653b95ecc5474dee8b99
+461008d26d80ca384f1e59e927714d25d600f8aa65c951878450b60726a5967b
+39c0673bba0a9d821e1e254c1187177411de0000002201fef55e98af0b2826ff
+dec6076cfd90b5bf708b6a81df68e7deb68a93a0aa67c1010003030093070007
+0107b104010003000301940700070107b1079207120712127333000506071312
+110221000371b00201f86f6e47b9cb9e885006e35f1daf1613729c92d0ef8cbe
+66dd3b7433681326320801c001c101c202c24001c04001c101c2c0c1c2296ffa
+11c1d2a701af87049c14f7a86991c8a40041bd80bff165f8a7c467c92980a8d0
+09019407010710071107b373b01311128403010310031103b376220000011312
+8203130373b014131073b015111472210201131211100421010171b01271b111
+71b210038b8244ccca6533fbda16be27250053a16864fa9931de1f7428bcfdd2
+bc1b5230b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627de923
+873e9595dc1b4bc0d1ef9ad2a9698ce3423bade6d5ac4827d08fdf448f2773f6
+42ed71060200c02ad08c0e42b8a9fafccf8c65ca76ab5fdb10ae882315f038b7
+2065c5fa51631125c10100010100910700000100010001019207000792071007
+1112713100011100000201c0c02dfc16af01b82b3b91c2ff704409d76236a83f
+956c0c6e6659a64fe21d76695b25d60032f2ac930e7454a928442f5869ea8395
+086727cbdc3e9decd54103549a4dda6400000032f2ac930e7454a928442f5869
+ea8395086727cbdc3e9decd54103549a4dda6414c10100010000000100010000
+00310000000001c050e5d69d806bc1c616cace4230c982a0ee5b350b3efe3b1a
+15801df77fc00c8c26d40000f8aa65c951878450b60726a5967b39c0673bba0a
+9d821e1e254c1187177411de000000701f9b251f8d3b9ea3a5b888530cb7745c
+210d19550dfbd4c8c140f4db39b68426d400002ad08c0e42b8a9fafccf8c65ca
+76ab5fdb10ae882315f038b72065c5fa51631100000074709e3496f1885e85b5
+5e3a5b7b04af022ed763ec7ad762b41dcd71b989592e819f01d009009107b1b8
+0f8103b1732108008103b1b80f102003102309000000200171b0b171b2b171b3
+b171210400b171b5200071b4b671210700b171b8086271b8097120056271b7b8
+0a71b80b1071210601b171b80db80c71b80e100a092dfe6ad7950efae0c52d65
+b1283cd9818a194f2f219b2a8132a6f7742802f31dfffde48c4ef6653b95ecc5
+474dee8b99461008d26d80ca384f1e59e927714d2d3adedff11b61f14c886e35
+afa036736dcd87a74d27b5c1510225d0f592e213aa1684dfa45178dff4d74fae
+7110592f7167ae452b05af984c985f23e821e5b7af2b9d95e1ef62e99fd9f8cd
+585523fee8e91680ec577f94aa3d65478b40f1e8b093aee1ae257c8c7c99aced
+ec08a1c3c1f0289654778a35862d7f0890e17ee5b20ea17ba3d9723f0bd06457
+d9cf48ce26ca36619b946980627de923873e9595c68bfa47519ff72b1d053b86
+e6e3b7356286eb2252616cc5b2acbed59ef1f5f0db8696e269f5593e39baf02f
+b2bee6caa5dd3a7dc04c9644ca21d8ed9fc5be9fe70d50ea33f5f2d68d67aade
+6ba4bf365002c74c76bf30b0672fe4d71254ccf602000100754718432c767d34
+4b1bb4c8d3afb8a84108643cb7ecc2f63e81f06db96b4c1447c1010001020092
+070007200000010001000201930700072000071172310001121100011dfffde4
+8c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59e927714d0201c0c0
+78c03805f8eaf7d367e0f57909abd566d94a2bebcf6270fe2fe74af954ed0d00
+4dd00100200021010000029232498667f765f437dedaac828e555f6cc67a20e6
+db28f614fdf3c262710febdd9285ac45d4ac85d17fa0d3243d7909c782a2a276
+ee3fb0cffefa9afbdb0de10101007bd30c2b05d0c80ccfd8f97f50dc42ecc3bc
+454642d9170599d319700e1a53c380c1d0090296070107020711071207b007b4
+73b514b671111286030103020311031203b003b4762200000115138203150373
+b116141073b5167113157113117221020214b61210079107131321010171b114
+71b21271b311210102711113038b8244ccca6533fbda16be27250053a16864fa
+9931de1f7428bcfdd2bc1b5230b20ea17ba3d9723f0bd06457d9cf48ce26ca36
+619b946980627de923873e9595dc1b4bc0d1ef9ad2a9698ce3423bade6d5ac48
+27d08fdf448f2773f642ed71060300c0c17eac420873e8f1ea8fe66831a6c6f6
+9d88693bed6aeb30bfba82069af60ebea825d600dda919dce5be80e3fa24a205
+4b0a8e8fb61c8e66fc8826463846be1d88a6d17200000088e3a91880060dff3d
+33c277714d72798a8031a1a523ec80ccfb279106c9342226d40000754718432c
+767d344b1bb4c8d3afb8a84108643cb7ecc2f63e81f06db96b4c1400000089d6
+690b0808b1da49e015a4f21df3fc3f00fb96ac502f5f097ce452e573704c80b2
+d10001000001029407b707b607b507b071131002008303b703b603b511018403
+b703b603b503b07211107431000013121110082000711210712002117113b291
+07b1b39107b0b4711020019107b000031dfffde48c4ef6653b95ecc5474dee8b
+99461008d26d80ca384f1e59e927714d50e5d69d806bc1c616cace4230c982a0
+ee5b350b3efe3b1a15801df77fc00c8c8c09ca644b10decad158d37006e81cdc
+1b84761312260546449aa02e343b2b0c01c08b8244ccca6533fbda16be272500
+53a16864fa9931de1f7428bcfdd2bc1b5230808fd10102020101019607010710
+07b80807b207130773b3141310721311100100840301031003b80803b2100971
+2101011271b011721011b121000171b31271b41171b5109107b600910711b702
+b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627de923873e9595
+e308035bdf280c927556824d6a9f9236a1487651f0059a7df3bda85b331f67e6
+02c0c18c09ca644b10decad158d37006e81cdc1b84761312260546449aa02e34
+3b2b0c26d40001f8aa65c951878450b60726a5967b39c0673bba0a9d821e1e25
+4c1187177411de000000913d39d8e695c7c752b9fe50725bd719934f83d649e8
+516023f74d440b5f437125d6002ad08c0e42b8a9fafccf8c65ca76ab5fdb10ae
+882315f038b72065c5fa5163110000009157100b5a69f4ca2b168dfcbe78a090
+fa20d79da1a871852b7c3aef016b6a21811501d001009207b007b5b28303b003
+b503b0762105008203b003b09107b5b010128203b00371b42002118303b003b0
+0371b4712004107120047140031012110620012100009107b0b08103b0b271b1
+b371b410061ce12e12485a4793aa5baf4f197f5d5ceb5fb8e166f1a06640b87f
+9c91dad7251dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e
+59e927714d50e5d69d806bc1c616cace4230c982a0ee5b350b3efe3b1a15801d
+f77fc00c8c7eac420873e8f1ea8fe66831a6c6f69d88693bed6aeb30bfba8206
+9af60ebea88c09ca644b10decad158d37006e81cdc1b84761312260546449aa0
+2e343b2b0cc2f94871321a7dde6210be1fa2bf22bd2a54d4544fa899339df852
+e412a177aa0101009232498667f765f437dedaac828e555f6cc67a20e6db28f6
+14fdf3c262710feb2cd001000021000000012dfc16af01b82b3b91c2ff704409
+d76236a83f956c0c6e6659a64fe21d76695b0101009fa47fcd2070deda91ff26
+790c1b7a805b030377fd00fa93fd26d75b86c8c49c25d600754718432c767d34
+4b1bb4c8d3afb8a84108643cb7ecc2f63e81f06db96b4c14000000a00c27a695
+65277f3191702586b508caf890f854fe13d43e25bbc103815a180725c1010001
+0201930701071007110001000100020092070107107331000111101000000200
+c0a00eee442c1c8ef911bfbe06770ab3e16954054496ac0af738f4bfff09fa24
+5125d6002201fef55e98af0b2826ffdec6076cfd90b5bf708b6a81df68e7deb6
+8a93a0aa000000a3b83ad0799bcd3d1c70c01df44141d79e7358e1f23d7d7e5c
+f9e01dbdc73c8581ce03d001009307b107b82807b172b81171b80e1271b80a10
+8303b103b82803b176200e8203b103b19107b82872b811b80bb80d10128203b1
+0371b827b82b74210401b172b809b82b1171b80cb82b712007118303b103b103
+71b82771200a10a172b81171200ab80b71200ab80d75b2b1b80bb80d200a7140
+09101274211200b81db8207221110073b81000b81db82075b20072b80971200a
+1213b81f8103b172b81172b8091471b812b81710722000121310112c210b0020
+037122080101b1231000000071b3b171b4b171b5b171b0b171b7200171b6b808
+71b8091271b80a1171b8091171b80c1271b8091071b80e11210d0171b810b171
+b80913210f0071b813b171b8146671200c6671b815b81671b80ab81771b812b8
+1871b811b81971b809b81871b81b1371b81ab81c71b80a1371200ab81e71b81a
+b81f21020071b811b80f71b80c1071b822b8239107b1b8248103b1b82571b821
+b82671b8271071b8146571200c6571b829b82a13046854886c4f39e9064cae9d
+05e0a58fa108eab17b80c68dc51aa12b4eba50e8092dfe6ad7950efae0c52d65
+b1283cd9818a194f2f219b2a8132a6f7742802f31ce12e12485a4793aa5baf4f
+197f5d5ceb5fb8e166f1a06640b87f9c91dad7251dfffde48c4ef6653b95ecc5
+474dee8b99461008d26d80ca384f1e59e927714d296ffa11c1d2a701af87049c
+14f7a86991c8a40041bd80bff165f8a7c467c9292d3adedff11b61f14c886e35
+afa036736dcd87a74d27b5c1510225d0f592e21348fc721fbbc172e0925fa27a
+f1671de225ba927134802998b10a1568a188652b74709e3496f1885e85b55e3a
+5b7b04af022ed763ec7ad762b41dcd71b989592e7bd30c2b05d0c80ccfd8f97f
+50dc42ecc3bc454642d9170599d319700e1a53c37eac420873e8f1ea8fe66831
+a6c6f69d88693bed6aeb30bfba82069af60ebea88c09ca644b10decad158d370
+06e81cdc1b84761312260546449aa02e343b2b0caf2b9d95e1ef62e99fd9f8cd
+585523fee8e91680ec577f94aa3d65478b40f1e8b093aee1ae257c8c7c99aced
+ec08a1c3c1f0289654778a35862d7f0890e17ee5b20ea17ba3d9723f0bd06457
+d9cf48ce26ca36619b946980627de923873e9595c53ed07c142e848759bcce77
+6e2070e7e39b4c8186bb8a10a658a0cba9c9571cc68bfa47519ff72b1d053b86
+e6e3b7356286eb2252616cc5b2acbed59ef1f5f0e70d50ea33f5f2d68d67aade
+6ba4bf365002c74c76bf30b0672fe4d71254ccf6ee092915f63880d96a7d51cb
+1491e65334080ca133beb4bf41509ee6d983d7e8ff8a2cdab1f84316fb0af969
+9b1b53e69497c6e39f87225a8b0d2ad2f205a14502000100a516c6bbd046d29b
+a5c6d5c607ef69ae0ce885b5be787ef5ae5af4ba6f7b053526d400002201fef5
+5e98af0b2826ffdec6076cfd90b5bf708b6a81df68e7deb68a93a0aa000000aa
+1684dfa45178dff4d74fae7110592f7167ae452b05af984c985f23e821e5b781
+c802d0010091072003b81a8203200303b81675200181032003b81a1182032008
+0371b815b80f72210d01200371b810b80f820320030371b81571200710762205
+01012003200372200fb80f11112007400610101b210200210b0171b12003230e
+00000071b3200371b4200371b5200321090071b7200371b808200071b6b80921
+0c0071b80b200371b80c6471200a6471b80db80e71b80ab80f71b8101071b2b8
+1171b8121081032003b81371b0b81471b8151071b8101171b2b81771b8181191
+07b816b81910092dfe6ad7950efae0c52d65b1283cd9818a194f2f219b2a8132
+a6f7742802f3131533e96baa7f50ba89d01892243e11a1221c8831e2f394eb14
+f89e9a54c6c41ce12e12485a4793aa5baf4f197f5d5ceb5fb8e166f1a06640b8
+7f9c91dad7251dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f
+1e59e927714d2d3adedff11b61f14c886e35afa036736dcd87a74d27b5c15102
+25d0f592e2137bd30c2b05d0c80ccfd8f97f50dc42ecc3bc454642d9170599d3
+19700e1a53c37eac420873e8f1ea8fe66831a6c6f69d88693bed6aeb30bfba82
+069af60ebea88c09ca644b10decad158d37006e81cdc1b84761312260546449a
+a02e343b2b0c9232498667f765f437dedaac828e555f6cc67a20e6db28f614fd
+f3c262710febaf2b9d95e1ef62e99fd9f8cd585523fee8e91680ec577f94aa3d
+65478b40f1e8b093aee1ae257c8c7c99acedec08a1c3c1f0289654778a35862d
+7f0890e17ee5b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627d
+e923873e9595c68bfa47519ff72b1d053b86e6e3b7356286eb2252616cc5b2ac
+bed59ef1f5f0dc1b4bc0d1ef9ad2a9698ce3423bade6d5ac4827d08fdf448f27
+73f642ed7106e70d50ea33f5f2d68d67aade6ba4bf365002c74c76bf30b0672f
+e4d71254ccf6f9ac92a11388a7cdca229a8024208554feb32d6c0a3af74a7bc1
+2c28b949543c02000100af2b9d95e1ef62e99fd9f8cd585523fee8e91680ec57
+7f94aa3d65478b40f1e880b8d0010192070007b1732301010101111111820300
+03b1742302010101111111820311031274210301131211100221000171b01004
+913d39d8e695c7c752b9fe50725bd719934f83d649e8516023f74d440b5f4371
+a00eee442c1c8ef911bfbe06770ab3e16954054496ac0af738f4bfff09fa2451
+a516c6bbd046d29ba5c6d5c607ef69ae0ce885b5be787ef5ae5af4ba6f7b0535
+bd618000fa6c54b52ae92cd3457f4f2ea4fcace37593926f4f1f02794d102ce3
+0201c0c0b093aee1ae257c8c7c99acedec08a1c3c1f0289654778a35862d7f08
+90e17ee57cd001009107b072210200b0108103b073210100b01010012000031d
+fffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59e927714d88
+e3a91880060dff3d33c277714d72798a8031a1a523ec80ccfb279106c934229f
+a47fcd2070deda91ff26790c1b7a805b030377fd00fa93fd26d75b86c8c49c01
+00b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627de923873e95
+9525d600a00c27a69565277f3191702586b508caf890f854fe13d43e25bbc103
+815a1807000000b2f8855b5e76a480493cd6cc922977e60723b4bec665dd7e9b
+73ca2b215df57680c2d001019407b507b007b107b47113128403b503b003b103
+b47421020013118203b0037114107112111206200071112001712003107113b2
+9107b0b39107b000041dfffde48c4ef6653b95ecc5474dee8b99461008d26d80
+ca384f1e59e927714d50e5d69d806bc1c616cace4230c982a0ee5b350b3efe3b
+1a15801df77fc00c8c89d6690b0808b1da49e015a4f21df3fc3f00fb96ac502f
+5f097ce452e573704c8c09ca644b10decad158d37006e81cdc1b847613122605
+46449aa02e343b2b0c01c0bd618000fa6c54b52ae92cd3457f4f2ea4fcace375
+93926f4f1f02794d102ce341d0010194070007b1071107121382030003b14000
+100221000171b01001913d39d8e695c7c752b9fe50725bd719934f83d649e851
+6023f74d440b5f43710201c0c0c2f94871321a7dde6210be1fa2bf22bd2a54d4
+544fa899339df852e412a177aa80d9d001019507b207b007b007b707b5721413
+128503b203b003b003b703b5742103008103b072151410127111138103b07211
+14100820009107b0009107b0b1721511712002109107b0b39107b0b472131020
+019107b0b6041dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f
+1e59e927714d50e5d69d806bc1c616cace4230c982a0ee5b350b3efe3b1a1580
+1df77fc00c8c8c09ca644b10decad158d37006e81cdc1b84761312260546449a
+a02e343b2b0cb2f8855b5e76a480493cd6cc922977e60723b4bec665dd7e9b73
+ca2b215df57601c0c53ed07c142e848759bcce776e2070e7e39b4c8186bb8a10
+a658a0cba9c9571c812b01d001009507b207b007b007b80907b80a7214131285
+03b203b003b003b80903b80a742104008103b072151410127111138103b07211
+14100b20009107b0009107b0b1721511712002109107b0b371210500b071b561
+71b671200361721310b79107b0b8089107b0b4061dfffde48c4ef6653b95ecc5
+474dee8b99461008d26d80ca384f1e59e927714d2d3adedff11b61f14c886e35
+afa036736dcd87a74d27b5c1510225d0f592e2138c09ca644b10decad158d370
+06e81cdc1b84761312260546449aa02e343b2b0cb093aee1ae257c8c7c99aced
+ec08a1c3c1f0289654778a35862d7f0890e17ee5b2f8855b5e76a480493cd6cc
+922977e60723b4bec665dd7e9b73ca2b215df576c68bfa47519ff72b1d053b86
+e6e3b7356286eb2252616cc5b2acbed59ef1f5f00100c68bfa47519ff72b1d05
+3b86e6e3b7356286eb2252616cc5b2acbed59ef1f5f066d00101930700072000
+07b21283030003200003b24001100321010171b01171b110021dfffde48c4ef6
+653b95ecc5474dee8b99461008d26d80ca384f1e59e927714d9fa47fcd2070de
+da91ff26790c1b7a805b030377fd00fa93fd26d75b86c8c49c0201c0c0cfd1b6
+41b5aea611f6390f397cb00a9e2e00f009e1fdd4dc8a827c733c2cc5e8810101
+d009009207b107b173210301b172b7111072b710118203b103b1722005111008
+2304000000200171b0b171b2b171b3b171210200b171b5200071b4b606092dfe
+6ad7950efae0c52d65b1283cd9818a194f2f219b2a8132a6f7742802f31dfffd
+e48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59e927714daf2b9d
+95e1ef62e99fd9f8cd585523fee8e91680ec577f94aa3d65478b40f1e8b20ea1
+7ba3d9723f0bd06457d9cf48ce26ca36619b946980627de923873e9595e70d50
+ea33f5f2d68d67aade6ba4bf365002c74c76bf30b0672fe4d71254ccf6ef7404
+7d53fa8df1d68683869ee452b777b6c3cfa87e21b60016c6b61f63d568020001
+00d74826f6cacaff36fc07321f88464abdae00e78eff810069058f315dac334d
+3881b201d001019307b80b07b007b572b671121171b2118303b80b03b003b574
+2105008103b0b80a742208010071122003210200721020032107002107008203
+b003b80a742208010071147120061172b671141172b114117212712006111010
+110c200121000171b11271b2109107b37113119107b0b42204010071b6711310
+71b11371b8081071b7b8099107b001091ce12e12485a4793aa5baf4f197f5d5c
+eb5fb8e166f1a06640b87f9c91dad7251dfffde48c4ef6653b95ecc5474dee8b
+99461008d26d80ca384f1e59e927714d2dfc16af01b82b3b91c2ff704409d762
+36a83f956c0c6e6659a64fe21d76695b50e5d69d806bc1c616cace4230c982a0
+ee5b350b3efe3b1a15801df77fc00c8c7eac420873e8f1ea8fe66831a6c6f69d
+88693bed6aeb30bfba82069af60ebea889d6690b0808b1da49e015a4f21df3fc
+3f00fb96ac502f5f097ce452e573704c8c09ca644b10decad158d37006e81cdc
+1b84761312260546449aa02e343b2b0cdd9285ac45d4ac85d17fa0d3243d7909
+c782a2a276ee3fb0cffefa9afbdb0de1f3993d287c47b81c9e0902aa91d22765
+0f6f4e55b3a1c63a87f283b4ed9e418e0240c00100c0db8696e269f5593e39ba
+f02fb2bee6caa5dd3a7dc04c9644ca21d8ed9fc5be9f80bbd001019307b707b0
+07b67112118303b703b003b640027321030012111008200121000071b11271b2
+107113119107b3b49107b0b59107b000041ce12e12485a4793aa5baf4f197f5d
+5ceb5fb8e166f1a06640b87f9c91dad7251dfffde48c4ef6653b95ecc5474dee
+8b99461008d26d80ca384f1e59e927714d7eac420873e8f1ea8fe66831a6c6f6
+9d88693bed6aeb30bfba82069af60ebea8d74826f6cacaff36fc07321f88464a
+bdae00e78eff810069058f315dac334d3801c0dc1b4bc0d1ef9ad2a9698ce342
+3bade6d5ac4827d08fdf448f2773f642ed71065ed00101920700071073210000
+11101082030003107221010011100002b20ea17ba3d9723f0bd06457d9cf48ce
+26ca36619b946980627de923873e9595e308035bdf280c927556824d6a9f9236
+a1487651f0059a7df3bda85b331f67e601c0dd9285ac45d4ac85d17fa0d3243d
+7909c782a2a276ee3fb0cffefa9afbdb0de126d4000032f2ac930e7454a92844
+2f5869ea8395086727cbdc3e9decd54103549a4dda64000000dda919dce5be80
+e3fa24a2054b0a8e8fb61c8e66fc8826463846be1d88a6d1722dc10100020200
+9207010702000100020002029407010702071107117232000102131200000340
+c040c10100c0c1e308035bdf280c927556824d6a9f9236a1487651f0059a7df3
+bda85b331f67e626d40000a00c27a69565277f3191702586b508caf890f854fe
+13d43e25bbc103815a1807000000e70d50ea33f5f2d68d67aade6ba4bf365002
+c74c76bf30b0672fe4d71254ccf67fd00103960700070107b507b30713071313
+840300030103b503b340001006230004050671b01271b11171b21021010371b4
+0202a00eee442c1c8ef911bfbe06770ab3e16954054496ac0af738f4bfff09fa
+2451f86f6e47b9cb9e885006e35f1daf1613729c92d0ef8cbe66dd3b74336813
+26320701c001c101c202c2c0c1c2ee092915f63880d96a7d51cb1491e6533408
+0ca133beb4bf41509ee6d983d7e813d001019207000710118203000310100000
+01c0ef74047d53fa8df1d68683869ee452b777b6c3cfa87e21b60016c6b61f63
+d568814001d009009207b007b072b1b80db80b8203b003b0742105008103b091
+07b072b1b80bb80d102002110e200171210401b0230600000071b2b071b3b071
+b4b021030071b6b071b7200071b5b80871b8091071b80a1171b8091171b80c10
+07092dfe6ad7950efae0c52d65b1283cd9818a194f2f219b2a8132a6f7742802
+f31dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59e92771
+4da3b83ad0799bcd3d1c70c01df44141d79e7358e1f23d7d7e5cf9e01dbdc73c
+85af2b9d95e1ef62e99fd9f8cd585523fee8e91680ec577f94aa3d65478b40f1
+e8b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627de923873e95
+95db8696e269f5593e39baf02fb2bee6caa5dd3a7dc04c9644ca21d8ed9fc5be
+9fe70d50ea33f5f2d68d67aade6ba4bf365002c74c76bf30b0672fe4d71254cc
+f602000100f2ef01c6163b25df180f44a1d50f32ca4f6e37818832976a64e26d
+fd8fceb01f810003d001009307b207b81707b272b80c71b80d1271200771b80a
+128303b203b81703b276200b8203b203b29107b81772b80c72b8097120071211
+71200771b8181110128203b20371b816b81b72210d01b272b80971200711b81b
+8303b203b20371b816b07622050101b2b272200f712007121171b81872b80911
+72b819647120096420077140061012111c71200710230e000000200271b1b271
+b3b271b4b221080071b6b271b7200071b5b80871b80910210a0171b80bb271b8
+09b021010071b80d1171b80cb80f71b80a11712007b81171b810b8129107b2b8
+138103b2b81471b80eb81571b8161071b8091271210c00b271b8196371b81a71
+20096310092dfe6ad7950efae0c52d65b1283cd9818a194f2f219b2a8132a6f7
+742802f31ce12e12485a4793aa5baf4f197f5d5ceb5fb8e166f1a06640b87f9c
+91dad7251dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59
+e927714d2d3adedff11b61f14c886e35afa036736dcd87a74d27b5c1510225d0
+f592e21348fc721fbbc172e0925fa27af1671de225ba927134802998b10a1568
+a188652b7bd30c2b05d0c80ccfd8f97f50dc42ecc3bc454642d9170599d31970
+0e1a53c37eac420873e8f1ea8fe66831a6c6f69d88693bed6aeb30bfba82069a
+f60ebea88c09ca644b10decad158d37006e81cdc1b84761312260546449aa02e
+343b2b0caf2b9d95e1ef62e99fd9f8cd585523fee8e91680ec577f94aa3d6547
+8b40f1e8b093aee1ae257c8c7c99acedec08a1c3c1f0289654778a35862d7f08
+90e17ee5b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627de923
+873e9595c53ed07c142e848759bcce776e2070e7e39b4c8186bb8a10a658a0cb
+a9c9571cc68bfa47519ff72b1d053b86e6e3b7356286eb2252616cc5b2acbed5
+9ef1f5f0dc1b4bc0d1ef9ad2a9698ce3423bade6d5ac4827d08fdf448f2773f6
+42ed7106e70d50ea33f5f2d68d67aade6ba4bf365002c74c76bf30b0672fe4d7
+1254ccf6f9ac92a11388a7cdca229a8024208554feb32d6c0a3af74a7bc12c28
+b949543c02000100f3993d287c47b81c9e0902aa91d227650f6f4e55b3a1c63a
+87f283b4ed9e418e26d40000dda919dce5be80e3fa24a2054b0a8e8fb61c8e66
+fc8826463846be1d88a6d172000000f86f6e47b9cb9e885006e35f1daf161372
+9c92d0ef8cbe66dd3b7433681326320fd001019107000081030010000001c0f8
+aa65c951878450b60726a5967b39c0673bba0a9d821e1e254c1187177411de1e
+c1010000000000020000000000b000000100019107b0b001300000010100f9ac
+92a11388a7cdca229a8024208554feb32d6c0a3af74a7bc12c28b949543c8083
+d001009107b0b18203b003b0742102008103b0b1102001110220009107b0b003
+1dfffde48c4ef6653b95ecc5474dee8b99461008d26d80ca384f1e59e927714d
+9157100b5a69f4ca2b168dfcbe78a090fa20d79da1a871852b7c3aef016b6a21
+db8696e269f5593e39baf02fb2bee6caa5dd3a7dc04c9644ca21d8ed9fc5be9f
+010100ff8a2cdab1f84316fb0af9699b1b53e69497c6e39f87225a8b0d2ad2f2
+05a14580a2d00101940701070107b3071113840301030103b303117622010100
+01128203010372b1131011101374210000011312110421020071b00171b11171
+b21003296ffa11c1d2a701af87049c14f7a86991c8a40041bd80bff165f8a7c4
+67c9298b8244ccca6533fbda16be27250053a16864fa9931de1f7428bcfdd2bc
+1b5230b20ea17ba3d9723f0bd06457d9cf48ce26ca36619b946980627de92387
+3e95950201c0c01e010001040101010103000600020101000701010104010201
+0103010302010101010101010101010001010101010304010103010001010203
+02030103012d3adedff11b61f14c886e35afa036736dcd87a74d27b5c1510225
+d0f592e213000000
diff --git a/Tests/Fixtures/Compiler/ixon-std-contact/README.md b/Tests/Fixtures/Compiler/ixon-std-contact/README.md
new file mode 100644
index 000000000..5f65b050e
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-std-contact/README.md
@@ -0,0 +1,75 @@
+# Bounded ixon-v2 Std contact
+
+This is a byte-exact one-member fat `.ixc` fixture generated by the production
+ix writer at revision
+`6f18ea907b78d06f7dc0917c43beb385561c35f4` (clean source tree
+`c09cfe3df1ee6ff92009672cc9077b4b7e2db63a`) under
+`leanprover/lean4:v4.33.1`.  The source declaration was:
+
+```lean
+module
+
+public import Std
+
+namespace CompilatrixStdContact
+
+public theorem addComm (left right : Nat) : left + right = right + left :=
+  Nat.add_comm left right
+
+end CompilatrixStdContact
+```
+
+The pinned ix development shell and binary produced it with:
+
+```sh
+ix compile CompilatrixStdContact.lean \
+  --consts CompilatrixStdContact.addComm --anon \
+  --out CompilatrixStdContact.ixe \
+  --report CompilatrixStdContact.report.json
+
+ix catalog assemble std-contact.ixc CompilatrixStdContact.ixe \
+  --labels CompilatrixStdContact \
+  --toolchains leanprover/lean4:v4.33.1 \
+  --pins git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4
+
+ix catalog verify std-contact.ixc --deep
+ix check-rs CompilatrixStdContact.ixe --anon --verbose --workers 1
+```
+
+The report records 48 requested-closure constants, 54 unique anonymous
+constants, format version 2, and 14,600 output bytes.  The Rust kernel accepted
+all 47 checked work constants (39 work items).
+
+Frozen commitments:
+
+- `members_root`:
+  `4585514401609ffa79ea09af28a0e1eb87be6b3306fe357511bc59323e18e18e`
+- `content_root` / member environment root:
+  `1bc7e2215a1967d8c937f48526facdc7006cd4c9b7b6ef4f1063bb55c50dee02`
+- full `.ixe` file hash:
+  `688985515005111bde0e25969181c649ada8b77d70287a71e18751f36b495988`
+- manifest bytes: 267
+- piece bytes: 14,600
+
+The binary files are checked in as whitespace-insensitive lowercase hex so
+the fixture remains patch/review friendly.  To reconstruct the directory:
+
+```sh
+mkdir -p std-contact.ixc
+tr -d '[:space:]' < manifest.hex | xxd -r -p > std-contact.ixc/manifest
+tr -d '[:space:]' < CompilatrixStdContact.ixe.hex | xxd -r -p \
+  > std-contact.ixc/CompilatrixStdContact.ixe
+```
+
+`Tests.lean` decodes these exact hex files directly, loads them through
+`Catalog.loadWith`, freezes every measured aggregate counter, and pins the
+current downstream result: catalog ingress succeeds, while
+`Pipeline.checkProgram` rejects address
+`a3b83ad0799bcd3d1c70c01df44141d79e7358e1f23d7d7e5cf9e01dbdc73c85`
+with `UsageErr.freezeNeeded`. C2's shared-closure classification admits the
+original 17-constant slice rooted at
+`131533e96baa7f50ba89d01892243e11a1221c8831e2f394eb14f89e9a54c6c4`
+through usage checking. Checked reuse of identical erased blocks also admits
+IxIR₀ readdressing; the next boundary is a missing root `Covered` certificate,
+recorded with complete artifacts in [source coverage](../../docs/source-coverage.md).
+All original manifest and piece bytes, roots, and ingress counters are unchanged.
diff --git a/Tests/Fixtures/Compiler/ixon-std-contact/manifest.hex b/Tests/Fixtures/Compiler/ixon-std-contact/manifest.hex
new file mode 100644
index 000000000..2ec69dd95
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-std-contact/manifest.hex
@@ -0,0 +1,9 @@
+495843000000000001000000000000004585514401609ffa79ea09af28a0e1eb
+87be6b3306fe357511bc59323e18e18e1bc7e2215a1967d8c937f48526facdc7
+006cd4c9b7b6ef4f1063bb55c50dee02010000001bc7e2215a1967d8c937f485
+26facdc7006cd4c9b7b6ef4f1063bb55c50dee0236000000000000001500436f
+6d70696c6174726978537464436f6e7461637418006c65616e70726f7665722f
+6c65616e343a76342e33332e312f006769743a69784036663138656139303762
+3738643036663764633039313763343362656233383535363163333566340000
+000000688985515005111bde0e25969181c649ada8b77d70287a71e18751f36b
+4959880839000000000000
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/CompilatrixUpstream.lean b/Tests/Fixtures/Compiler/ixon-upstream/CompilatrixUpstream.lean
new file mode 100644
index 000000000..ec26ec580
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/CompilatrixUpstream.lean
@@ -0,0 +1,29 @@
+module
+
+public import Std
+
+namespace CompilatrixUpstream
+
+public def twice (function : Nat → Nat) (value : Nat) : Nat :=
+  function (function value)
+
+public def applyClosed : Nat :=
+  twice (fun value => Nat.succ value) (Nat.succ Nat.zero)
+
+public def captureClosed : Nat :=
+  let seed := Nat.succ (Nat.succ Nat.zero)
+  twice (fun _ => seed) Nat.zero
+
+public def letClosed : Nat :=
+  let step := fun value : Nat => Nat.succ value
+  twice step (Nat.succ (Nat.succ Nat.zero))
+
+public def addClosed : Nat :=
+  Nat.add (Nat.succ (Nat.succ Nat.zero)) (Nat.succ Nat.zero)
+
+public def recClosed : Nat :=
+  Nat.rec (motive := fun _ => Nat) Nat.zero
+    (fun _ result => Nat.succ result)
+    (Nat.succ (Nat.succ (Nat.succ Nat.zero)))
+
+end CompilatrixUpstream
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/README.md b/Tests/Fixtures/Compiler/ixon-upstream/README.md
new file mode 100644
index 000000000..4f4ecfa3e
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/README.md
@@ -0,0 +1,60 @@
+# Pinned upstream executable closures
+
+These five original anonymous Ixon v2 pieces were produced from
+[`CompilatrixUpstream.lean`](CompilatrixUpstream.lean) by ix revision
+`6f18ea907b78d06f7dc0917c43beb385561c35f4`, clean tree
+`c09cfe3df1ee6ff92009672cc9077b4b7e2db63a`, using
+`leanprover/lean4:v4.33.1`. The writer was built from a clean archive of that
+revision with its locked Nix inputs. Each `pack` sets `MAIN` and includes the
+complete dependency closure, with no assumption cuts. Compilatrix consumes
+these bytes directly through `Catalog.load`.
+
+| Entry | Constants | Piece bytes | Upstream kernel | Compilatrix outcome |
+| --- | ---: | ---: | --- | --- |
+| `applyClosed` | 6 | 662 | 5/5 accepted | Certified ELF, Nat 3 |
+| `captureClosed` | 6 | 666 | 5/5 accepted | Certified ELF with a static Nat capture, Nat 2 |
+| `letClosed` | 6 | 670 | 5/5 accepted | Certified ELF, Nat 4 |
+| `addClosed` | 19 | 3072 | 16/16 accepted | Addressed IxIR₀; erasure validation lacks dependency `Covered` |
+| `recClosed` | 6 | 796 | 5/5 accepted | Erasure validation lacks a `Covered` certificate |
+
+Kernel counts are checked work constants; catalog counts also include block
+and projection records. `catalog verify --deep` accepted all five catalogs.
+A second empty project directory reproduced every piece and manifest byte.
+The Lean module's BLAKE3 is
+`f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc`.
+Complete roots, piece hashes, provenance, and stage observations are pinned in
+[`../source-coverage/expected.json`](../source-coverage/expected.json).
+
+The accepted examples exercise fresh higher-order arguments, a shared outer
+capture, and a let-bound closure. They use explicit `Nat.zero`/`Nat.succ`
+source terms. Literal ownership, unique captures, affine/linear callable
+parameters, and unique callable results retain their separate restrictions.
+The `Nat.add` and `Nat.rec` bodies are ordinary upstream definitions; their
+later rejections are preserved as neighboring negative evidence.
+
+To reproduce, copy the four project files in this directory into an empty
+directory, enter the pinned ix development environment, and use the pinned
+writer and Lean 4.33.1 `lake` on `PATH`:
+
+```sh
+ix compile CompilatrixUpstream.lean \
+  --consts CompilatrixUpstream.applyClosed,CompilatrixUpstream.captureClosed,CompilatrixUpstream.letClosed,CompilatrixUpstream.addClosed,CompilatrixUpstream.recClosed \
+  --out CompilatrixUpstream.ixe --report CompilatrixUpstream.report.json
+
+for case in applyClosed captureClosed letClosed addClosed recClosed; do
+  ix pack CompilatrixUpstream.ixe "CompilatrixUpstream.$case" \
+    --anon --out "$case.ixe"
+  ix catalog assemble "$case.ixc" "$case.ixe" \
+    --labels "CompilatrixUpstream.$case" \
+    --toolchains leanprover/lean4:v4.33.1 \
+    --pins git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4
+  ix catalog verify "$case.ixc" --deep
+  ix check-rs "$case.ixe" --anon
+  od -An -v -tx1 "$case.ixe" > "$case.ixe.hex"
+  od -An -v -tx1 "$case.ixc/manifest" > "$case.manifest.hex"
+done
+```
+
+Compare the ten generated hex files against this directory. The checked
+coverage producer reads whitespace-insensitive hex with bounded file sizes;
+it neither regenerates nor rewrites the source constants.
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/addClosed.ixe.hex b/Tests/Fixtures/Compiler/ixon-upstream/addClosed.ixe.hex
new file mode 100644
index 000000000..60e3b1cb0
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/addClosed.ixe.hex
@@ -0,0 +1,192 @@
+ e2 84 b4 c4 00 ac 44 4a e1 21 01 cc 6e 49 cb 18
+ 30 28 1d 56 69 8d e6 8e 09 5e b4 2e b4 74 3b b4
+ b9 01 79 9b 79 39 dc c3 c1 58 62 0a 49 e6 45 c9
+ fe e3 67 67 42 51 e5 29 85 94 bf 88 01 74 7e 49
+ f9 90 00 00 13 1c e1 2e 12 48 5a 47 93 aa 5b af
+ 4f 19 7f 5d 5c eb 5f b8 e1 66 f1 a0 66 40 b8 7f
+ 9c 91 da d7 25 80 bb d0 01 01 92 07 b1 07 b0 01
+ 82 03 b1 03 b0 74 21 03 00 81 03 b0 01 21 01 01
+ 82 03 b0 03 01 72 22 02 02 01 71 13 11 10 10 02
+ 20 00 91 07 b0 02 04 1d ff fd e4 8c 4e f6 65 3b
+ 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38
+ 4f 1e 59 e9 27 71 4d 2d fc 16 af 01 b8 2b 3b 91
+ c2 ff 70 44 09 d7 62 36 a8 3f 95 6c 0c 6e 66 59
+ a6 4f e2 1d 76 69 5b 7e ac 42 08 73 e8 f1 ea 8f
+ e6 68 31 a6 c6 f6 9d 88 69 3b ed 6a eb 30 bf ba
+ 82 06 9a f6 0e be a8 89 d6 69 0b 08 08 b1 da 49
+ e0 15 a4 f2 1d f3 fc 3f 00 fb 96 ac 50 2f 5f 09
+ 7c e4 52 e5 73 70 4c 03 40 01 c0 02 00 40 c0 01
+ 00 c0 1d ff fd e4 8c 4e f6 65 3b 95 ec c5 47 4d
+ ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e 59 e9 27
+ 71 4d 25 d6 00 f8 aa 65 c9 51 87 84 50 b6 07 26
+ a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25 4c 11
+ 87 17 74 11 de 00 00 00 2d fc 16 af 01 b8 2b 3b
+ 91 c2 ff 70 44 09 d7 62 36 a8 3f 95 6c 0c 6e 66
+ 59 a6 4f e2 1d 76 69 5b 25 d6 00 32 f2 ac 93 0e
+ 74 54 a9 28 44 2f 58 69 ea 83 95 08 67 27 cb dc
+ 3e 9d ec d5 41 03 54 9a 4d da 64 00 00 00 32 f2
+ ac 93 0e 74 54 a9 28 44 2f 58 69 ea 83 95 08 67
+ 27 cb dc 3e 9d ec d5 41 03 54 9a 4d da 64 14 c1
+ 01 00 01 00 00 00 01 00 01 00 00 00 31 00 00 00
+ 00 01 c0 50 e5 d6 9d 80 6b c1 c6 16 ca ce 42 30
+ c9 82 a0 ee 5b 35 0b 3e fe 3b 1a 15 80 1d f7 7f
+ c0 0c 8c 26 d4 00 00 f8 aa 65 c9 51 87 84 50 b6
+ 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25
+ 4c 11 87 17 74 11 de 00 00 00 79 9b 79 39 dc c3
+ c1 58 62 0a 49 e6 45 c9 fe e3 67 67 42 51 e5 29
+ 85 94 bf 88 01 74 7e 49 f9 90 80 95 d0 01 00 20
+ 00 72 20 03 71 b0 b1 b1 02 20 02 71 b0 20 01 04
+ 1d ff fd e4 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b
+ 99 46 10 08 d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d
+ 50 e5 d6 9d 80 6b c1 c6 16 ca ce 42 30 c9 82 a0
+ ee 5b 35 0b 3e fe 3b 1a 15 80 1d f7 7f c0 0c 8c
+ 8c 09 ca 64 4b 10 de ca d1 58 d3 70 06 e8 1c dc
+ 1b 84 76 13 12 26 05 46 44 9a a0 2e 34 3b 2b 0c
+ f9 ac 92 a1 13 88 a7 cd ca 22 9a 80 24 20 85 54
+ fe b3 2d 6c 0a 3a f7 4a 7b c1 2c 28 b9 49 54 3c
+ 00 7e ac 42 08 73 e8 f1 ea 8f e6 68 31 a6 c6 f6
+ 9d 88 69 3b ed 6a eb 30 bf ba 82 06 9a f6 0e be
+ a8 25 d6 00 dd a9 19 dc e5 be 80 e3 fa 24 a2 05
+ 4b 0a 8e 8f b6 1c 8e 66 fc 88 26 46 38 46 be 1d
+ 88 a6 d1 72 00 00 00 89 d6 69 0b 08 08 b1 da 49
+ e0 15 a4 f2 1d f3 fc 3f 00 fb 96 ac 50 2f 5f 09
+ 7c e4 52 e5 73 70 4c 80 b2 d1 00 01 00 00 01 02
+ 94 07 b7 07 b6 07 b5 07 b0 71 13 10 02 00 83 03
+ b7 03 b6 03 b5 11 01 84 03 b7 03 b6 03 b5 03 b0
+ 72 11 10 74 31 00 00 13 12 11 10 08 20 00 71 12
+ 10 71 20 02 11 71 13 b2 91 07 b1 b3 91 07 b0 b4
+ 71 10 20 01 91 07 b0 00 03 1d ff fd e4 8c 4e f6
+ 65 3b 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80
+ ca 38 4f 1e 59 e9 27 71 4d 50 e5 d6 9d 80 6b c1
+ c6 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e fe 3b
+ 1a 15 80 1d f7 7f c0 0c 8c 8c 09 ca 64 4b 10 de
+ ca d1 58 d3 70 06 e8 1c dc 1b 84 76 13 12 26 05
+ 46 44 9a a0 2e 34 3b 2b 0c 01 c0 8c 09 ca 64 4b
+ 10 de ca d1 58 d3 70 06 e8 1c dc 1b 84 76 13 12
+ 26 05 46 44 9a a0 2e 34 3b 2b 0c 26 d4 00 01 f8
+ aa 65 c9 51 87 84 50 b6 07 26 a5 96 7b 39 c0 67
+ 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17 74 11 de 00
+ 00 00 91 57 10 0b 5a 69 f4 ca 2b 16 8d fc be 78
+ a0 90 fa 20 d7 9d a1 a8 71 85 2b 7c 3a ef 01 6b
+ 6a 21 81 15 01 d0 01 00 92 07 b0 07 b5 b2 83 03
+ b0 03 b5 03 b0 76 21 05 00 82 03 b0 03 b0 91 07
+ b5 b0 10 12 82 03 b0 03 71 b4 20 02 11 83 03 b0
+ 03 b0 03 71 b4 71 20 04 10 71 20 04 71 40 03 10
+ 12 11 06 20 01 21 00 00 91 07 b0 b0 81 03 b0 b2
+ 71 b1 b3 71 b4 10 06 1c e1 2e 12 48 5a 47 93 aa
+ 5b af 4f 19 7f 5d 5c eb 5f b8 e1 66 f1 a0 66 40
+ b8 7f 9c 91 da d7 25 1d ff fd e4 8c 4e f6 65 3b
+ 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38
+ 4f 1e 59 e9 27 71 4d 50 e5 d6 9d 80 6b c1 c6 16
+ ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e fe 3b 1a 15
+ 80 1d f7 7f c0 0c 8c 7e ac 42 08 73 e8 f1 ea 8f
+ e6 68 31 a6 c6 f6 9d 88 69 3b ed 6a eb 30 bf ba
+ 82 06 9a f6 0e be a8 8c 09 ca 64 4b 10 de ca d1
+ 58 d3 70 06 e8 1c dc 1b 84 76 13 12 26 05 46 44
+ 9a a0 2e 34 3b 2b 0c c2 f9 48 71 32 1a 7d de 62
+ 10 be 1f a2 bf 22 bd 2a 54 d4 54 4f a8 99 33 9d
+ f8 52 e4 12 a1 77 aa 01 01 00 b2 f8 85 5b 5e 76
+ a4 80 49 3c d6 cc 92 29 77 e6 07 23 b4 be c6 65
+ dd 7e 9b 73 ca 2b 21 5d f5 76 80 c2 d0 01 01 94
+ 07 b5 07 b0 07 b1 07 b4 71 13 12 84 03 b5 03 b0
+ 03 b1 03 b4 74 21 02 00 13 11 82 03 b0 03 71 14
+ 10 71 12 11 12 06 20 00 71 11 20 01 71 20 03 10
+ 71 13 b2 91 07 b0 b3 91 07 b0 00 04 1d ff fd e4
+ 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b 99 46 10 08
+ d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d 50 e5 d6 9d
+ 80 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b
+ 3e fe 3b 1a 15 80 1d f7 7f c0 0c 8c 89 d6 69 0b
+ 08 08 b1 da 49 e0 15 a4 f2 1d f3 fc 3f 00 fb 96
+ ac 50 2f 5f 09 7c e4 52 e5 73 70 4c 8c 09 ca 64
+ 4b 10 de ca d1 58 d3 70 06 e8 1c dc 1b 84 76 13
+ 12 26 05 46 44 9a a0 2e 34 3b 2b 0c 01 c0 c2 f9
+ 48 71 32 1a 7d de 62 10 be 1f a2 bf 22 bd 2a 54
+ d4 54 4f a8 99 33 9d f8 52 e4 12 a1 77 aa 80 d9
+ d0 01 01 95 07 b2 07 b0 07 b0 07 b7 07 b5 72 14
+ 13 12 85 03 b2 03 b0 03 b0 03 b7 03 b5 74 21 03
+ 00 81 03 b0 72 15 14 10 12 71 11 13 81 03 b0 72
+ 11 14 10 08 20 00 91 07 b0 00 91 07 b0 b1 72 15
+ 11 71 20 02 10 91 07 b0 b3 91 07 b0 b4 72 13 10
+ 20 01 91 07 b0 b6 04 1d ff fd e4 8c 4e f6 65 3b
+ 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38
+ 4f 1e 59 e9 27 71 4d 50 e5 d6 9d 80 6b c1 c6 16
+ ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e fe 3b 1a 15
+ 80 1d f7 7f c0 0c 8c 8c 09 ca 64 4b 10 de ca d1
+ 58 d3 70 06 e8 1c dc 1b 84 76 13 12 26 05 46 44
+ 9a a0 2e 34 3b 2b 0c b2 f8 85 5b 5e 76 a4 80 49
+ 3c d6 cc 92 29 77 e6 07 23 b4 be c6 65 dd 7e 9b
+ 73 ca 2b 21 5d f5 76 01 c0 d7 48 26 f6 ca ca ff
+ 36 fc 07 32 1f 88 46 4a bd ae 00 e7 8e ff 81 00
+ 69 05 8f 31 5d ac 33 4d 38 81 b2 01 d0 01 01 93
+ 07 b8 0b 07 b0 07 b5 72 b6 71 12 11 71 b2 11 83
+ 03 b8 0b 03 b0 03 b5 74 21 05 00 81 03 b0 b8 0a
+ 74 22 08 01 00 71 12 20 03 21 02 00 72 10 20 03
+ 21 07 00 21 07 00 82 03 b0 03 b8 0a 74 22 08 01
+ 00 71 14 71 20 06 11 72 b6 71 14 11 72 b1 14 11
+ 72 12 71 20 06 11 10 10 11 0c 20 01 21 00 01 71
+ b1 12 71 b2 10 91 07 b3 71 13 11 91 07 b0 b4 22
+ 04 01 00 71 b6 71 13 10 71 b1 13 71 b8 08 10 71
+ b7 b8 09 91 07 b0 01 09 1c e1 2e 12 48 5a 47 93
+ aa 5b af 4f 19 7f 5d 5c eb 5f b8 e1 66 f1 a0 66
+ 40 b8 7f 9c 91 da d7 25 1d ff fd e4 8c 4e f6 65
+ 3b 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca
+ 38 4f 1e 59 e9 27 71 4d 2d fc 16 af 01 b8 2b 3b
+ 91 c2 ff 70 44 09 d7 62 36 a8 3f 95 6c 0c 6e 66
+ 59 a6 4f e2 1d 76 69 5b 50 e5 d6 9d 80 6b c1 c6
+ 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e fe 3b 1a
+ 15 80 1d f7 7f c0 0c 8c 7e ac 42 08 73 e8 f1 ea
+ 8f e6 68 31 a6 c6 f6 9d 88 69 3b ed 6a eb 30 bf
+ ba 82 06 9a f6 0e be a8 89 d6 69 0b 08 08 b1 da
+ 49 e0 15 a4 f2 1d f3 fc 3f 00 fb 96 ac 50 2f 5f
+ 09 7c e4 52 e5 73 70 4c 8c 09 ca 64 4b 10 de ca
+ d1 58 d3 70 06 e8 1c dc 1b 84 76 13 12 26 05 46
+ 44 9a a0 2e 34 3b 2b 0c dd 92 85 ac 45 d4 ac 85
+ d1 7f a0 d3 24 3d 79 09 c7 82 a2 a2 76 ee 3f b0
+ cf fe fa 9a fb db 0d e1 f3 99 3d 28 7c 47 b8 1c
+ 9e 09 02 aa 91 d2 27 65 0f 6f 4e 55 b3 a1 c6 3a
+ 87 f2 83 b4 ed 9e 41 8e 02 40 c0 01 00 c0 db 86
+ 96 e2 69 f5 59 3e 39 ba f0 2f b2 be e6 ca a5 dd
+ 3a 7d c0 4c 96 44 ca 21 d8 ed 9f c5 be 9f 80 bb
+ d0 01 01 93 07 b7 07 b0 07 b6 71 12 11 83 03 b7
+ 03 b0 03 b6 40 02 73 21 03 00 12 11 10 08 20 01
+ 21 00 00 71 b1 12 71 b2 10 71 13 11 91 07 b3 b4
+ 91 07 b0 b5 91 07 b0 00 04 1c e1 2e 12 48 5a 47
+ 93 aa 5b af 4f 19 7f 5d 5c eb 5f b8 e1 66 f1 a0
+ 66 40 b8 7f 9c 91 da d7 25 1d ff fd e4 8c 4e f6
+ 65 3b 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80
+ ca 38 4f 1e 59 e9 27 71 4d 7e ac 42 08 73 e8 f1
+ ea 8f e6 68 31 a6 c6 f6 9d 88 69 3b ed 6a eb 30
+ bf ba 82 06 9a f6 0e be a8 d7 48 26 f6 ca ca ff
+ 36 fc 07 32 1f 88 46 4a bd ae 00 e7 8e ff 81 00
+ 69 05 8f 31 5d ac 33 4d 38 01 c0 dd 92 85 ac 45
+ d4 ac 85 d1 7f a0 d3 24 3d 79 09 c7 82 a2 a2 76
+ ee 3f b0 cf fe fa 9a fb db 0d e1 26 d4 00 00 32
+ f2 ac 93 0e 74 54 a9 28 44 2f 58 69 ea 83 95 08
+ 67 27 cb dc 3e 9d ec d5 41 03 54 9a 4d da 64 00
+ 00 00 dd a9 19 dc e5 be 80 e3 fa 24 a2 05 4b 0a
+ 8e 8f b6 1c 8e 66 fc 88 26 46 38 46 be 1d 88 a6
+ d1 72 2d c1 01 00 02 02 00 92 07 01 07 02 00 01
+ 00 02 00 02 02 94 07 01 07 02 07 11 07 11 72 32
+ 00 01 02 13 12 00 00 03 40 c0 40 c1 01 00 c0 c1
+ f3 99 3d 28 7c 47 b8 1c 9e 09 02 aa 91 d2 27 65
+ 0f 6f 4e 55 b3 a1 c6 3a 87 f2 83 b4 ed 9e 41 8e
+ 26 d4 00 00 dd a9 19 dc e5 be 80 e3 fa 24 a2 05
+ 4b 0a 8e 8f b6 1c 8e 66 fc 88 26 46 38 46 be 1d
+ 88 a6 d1 72 00 00 00 f8 aa 65 c9 51 87 84 50 b6
+ 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25
+ 4c 11 87 17 74 11 de 1e c1 01 00 00 00 00 00 02
+ 00 00 00 00 00 b0 00 00 01 00 01 91 07 b0 b0 01
+ 30 00 00 01 01 00 f9 ac 92 a1 13 88 a7 cd ca 22
+ 9a 80 24 20 85 54 fe b3 2d 6c 0a 3a f7 4a 7b c1
+ 2c 28 b9 49 54 3c 80 83 d0 01 00 91 07 b0 b1 82
+ 03 b0 03 b0 74 21 02 00 81 03 b0 b1 10 20 01 11
+ 02 20 00 91 07 b0 b0 03 1d ff fd e4 8c 4e f6 65
+ 3b 95 ec c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca
+ 38 4f 1e 59 e9 27 71 4d 91 57 10 0b 5a 69 f4 ca
+ 2b 16 8d fc be 78 a0 90 fa 20 d7 9d a1 a8 71 85
+ 2b 7c 3a ef 01 6b 6a 21 db 86 96 e2 69 f5 59 3e
+ 39 ba f0 2f b2 be e6 ca a5 dd 3a 7d c0 4c 96 44
+ ca 21 d8 ed 9f c5 be 9f 01 01 00 08 01 01 05 04
+ 04 01 01 01 01 01 01 01 01 01 05 03 01 2d 3a de
+ df f1 1b 61 f1 4c 88 6e 35 af a0 36 73 6d cd 87
+ a7 4d 27 b5 c1 51 02 25 d0 f5 92 e2 13 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/addClosed.manifest.hex b/Tests/Fixtures/Compiler/ixon-upstream/addClosed.manifest.hex
new file mode 100644
index 000000000..c5ae951c4
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/addClosed.manifest.hex
@@ -0,0 +1,18 @@
+ 49 58 43 00 00 00 00 00 01 00 00 00 00 00 00 00
+ 8e e1 29 c3 78 88 40 0d dd f6 dc fa ba 96 5e a3
+ 5c 68 db dd 39 09 86 38 17 35 26 97 b9 0c cd 32
+ 84 b4 c4 00 ac 44 4a e1 21 01 cc 6e 49 cb 18 30
+ 28 1d 56 69 8d e6 8e 09 5e b4 2e b4 74 3b b4 b9
+ 01 00 00 00 84 b4 c4 00 ac 44 4a e1 21 01 cc 6e
+ 49 cb 18 30 28 1d 56 69 8d e6 8e 09 5e b4 2e b4
+ 74 3b b4 b9 13 00 00 00 00 00 00 00 1d 00 43 6f
+ 6d 70 69 6c 61 74 72 69 78 55 70 73 74 72 65 61
+ 6d 2e 61 64 64 43 6c 6f 73 65 64 18 00 6c 65 61
+ 6e 70 72 6f 76 65 72 2f 6c 65 61 6e 34 3a 76 34
+ 2e 33 33 2e 31 2f 00 67 69 74 3a 69 78 40 36 66
+ 31 38 65 61 39 30 37 62 37 38 64 30 36 66 37 64
+ 63 30 39 31 37 63 34 33 62 65 62 33 38 35 35 36
+ 31 63 33 35 66 34 00 00 00 00 00 ce 2c c4 e1 6f
+ fb e9 16 6b 9b e2 01 c5 24 cb c7 53 07 05 fd c5
+ b8 ff 76 02 62 7a ba 70 f5 f4 d0 00 0c 00 00 00
+ 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/applyClosed.ixe.hex b/Tests/Fixtures/Compiler/ixon-upstream/applyClosed.ixe.hex
new file mode 100644
index 000000000..2a70a200b
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/applyClosed.ixe.hex
@@ -0,0 +1,42 @@
+ e2 2c 4d ce dd 6a c8 b9 de e3 cf bc ea fe 0c 08
+ cb d5 5e 56 8d 28 7f c8 92 56 de 14 4d 86 7a c6
+ 31 01 b8 1b 75 4f 02 c1 b6 32 79 a6 09 ab 4b 55
+ b6 09 fd 6f 87 fa b7 b1 48 79 f4 02 1c 33 27 c2
+ eb 40 00 00 06 1d ff fd e4 8c 4e f6 65 3b 95 ec
+ c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e
+ 59 e9 27 71 4d 25 d6 00 f8 aa 65 c9 51 87 84 50
+ b6 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e
+ 25 4c 11 87 17 74 11 de 00 00 00 50 e5 d6 9d 80
+ 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e
+ fe 3b 1a 15 80 1d f7 7f c0 0c 8c 26 d4 00 00 f8
+ aa 65 c9 51 87 84 50 b6 07 26 a5 96 7b 39 c0 67
+ 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17 74 11 de 00
+ 00 00 8c 09 ca 64 4b 10 de ca d1 58 d3 70 06 e8
+ 1c dc 1b 84 76 13 12 26 05 46 44 9a a0 2e 34 3b
+ 2b 0c 26 d4 00 01 f8 aa 65 c9 51 87 84 50 b6 07
+ 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25 4c
+ 11 87 17 74 11 de 00 00 00 b8 1b 75 4f 02 c1 b6
+ 32 79 a6 09 ab 4b 55 b6 09 fd 6f 87 fa b7 b1 48
+ 79 f4 02 1c 33 27 c2 eb 40 80 98 d0 01 00 20 00
+ 72 20 03 81 03 20 00 71 20 02 10 71 20 02 20 01
+ 00 04 1d ff fd e4 8c 4e f6 65 3b 95 ec c5 47 4d
+ ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e 59 e9 27
+ 71 4d 50 e5 d6 9d 80 6b c1 c6 16 ca ce 42 30 c9
+ 82 a0 ee 5b 35 0b 3e fe 3b 1a 15 80 1d f7 7f c0
+ 0c 8c 8c 09 ca 64 4b 10 de ca d1 58 d3 70 06 e8
+ 1c dc 1b 84 76 13 12 26 05 46 44 9a a0 2e 34 3b
+ 2b 0c f9 25 3a 79 80 25 e3 82 73 75 88 42 d1 2e
+ aa 0b ef 1e e2 68 b8 2d d7 4e 19 1a c3 6c 2d 6c
+ 9b 17 00 f8 aa 65 c9 51 87 84 50 b6 07 26 a5 96
+ 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17
+ 74 11 de 1e c1 01 00 00 00 00 00 02 00 00 00 00
+ 00 b0 00 00 01 00 01 91 07 b0 b0 01 30 00 00 01
+ 01 00 f9 25 3a 79 80 25 e3 82 73 75 88 42 d1 2e
+ aa 0b ef 1e e2 68 b8 2d d7 4e 19 1a c3 6c 2d 6c
+ 9b 17 3a d0 01 00 91 07 b1 b1 82 03 b1 03 b0 71
+ 11 71 11 10 02 20 00 91 07 b0 b0 01 1d ff fd e4
+ 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b 99 46 10 08
+ d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d 00 02 04 04
+ 02 03 01 2d 3a de df f1 1b 61 f1 4c 88 6e 35 af
+ a0 36 73 6d cd 87 a7 4d 27 b5 c1 51 02 25 d0 f5
+ 92 e2 13 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/applyClosed.manifest.hex b/Tests/Fixtures/Compiler/ixon-upstream/applyClosed.manifest.hex
new file mode 100644
index 000000000..0dc7790e0
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/applyClosed.manifest.hex
@@ -0,0 +1,18 @@
+ 49 58 43 00 00 00 00 00 01 00 00 00 00 00 00 00
+ 90 eb 98 fa 54 64 f2 1a cb 0f fe 27 a7 1b b3 f7
+ 2f c0 68 f9 8b a5 a7 fa 9a e6 bd 30 7e 99 2a c7
+ 2c 4d ce dd 6a c8 b9 de e3 cf bc ea fe 0c 08 cb
+ d5 5e 56 8d 28 7f c8 92 56 de 14 4d 86 7a c6 31
+ 01 00 00 00 2c 4d ce dd 6a c8 b9 de e3 cf bc ea
+ fe 0c 08 cb d5 5e 56 8d 28 7f c8 92 56 de 14 4d
+ 86 7a c6 31 06 00 00 00 00 00 00 00 1f 00 43 6f
+ 6d 70 69 6c 61 74 72 69 78 55 70 73 74 72 65 61
+ 6d 2e 61 70 70 6c 79 43 6c 6f 73 65 64 18 00 6c
+ 65 61 6e 70 72 6f 76 65 72 2f 6c 65 61 6e 34 3a
+ 76 34 2e 33 33 2e 31 2f 00 67 69 74 3a 69 78 40
+ 36 66 31 38 65 61 39 30 37 62 37 38 64 30 36 66
+ 37 64 63 30 39 31 37 63 34 33 62 65 62 33 38 35
+ 35 36 31 63 33 35 66 34 00 00 00 00 00 2e 48 73
+ 54 6a fd 75 58 d5 c0 2b 24 4d 27 13 22 9c 02 f6
+ f6 84 c2 98 73 9f 0b 74 31 e7 b8 df 02 96 02 00
+ 00 00 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/captureClosed.ixe.hex b/Tests/Fixtures/Compiler/ixon-upstream/captureClosed.ixe.hex
new file mode 100644
index 000000000..302a2c65a
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/captureClosed.ixe.hex
@@ -0,0 +1,42 @@
+ e2 f4 5a 88 c0 c4 1d cc 24 1a 4a 46 eb c9 89 53
+ 29 1f 7c 81 ed a7 bd 11 c4 99 78 cb 65 ea 82 c9
+ 69 01 56 28 cf e1 b4 f9 59 fb 11 66 61 fc 50 ae
+ 8e 9e 4b fa 47 0a c5 d0 e6 39 a7 5b 9d 23 ae d1
+ 29 53 00 00 06 1d ff fd e4 8c 4e f6 65 3b 95 ec
+ c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e
+ 59 e9 27 71 4d 25 d6 00 f8 aa 65 c9 51 87 84 50
+ b6 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e
+ 25 4c 11 87 17 74 11 de 00 00 00 50 e5 d6 9d 80
+ 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e
+ fe 3b 1a 15 80 1d f7 7f c0 0c 8c 26 d4 00 00 f8
+ aa 65 c9 51 87 84 50 b6 07 26 a5 96 7b 39 c0 67
+ 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17 74 11 de 00
+ 00 00 56 28 cf e1 b4 f9 59 fb 11 66 61 fc 50 ae
+ 8e 9e 4b fa 47 0a c5 d0 e6 39 a7 5b 9d 23 ae d1
+ 29 53 80 9c d0 01 00 b0 a1 b0 71 20 02 71 20 02
+ 20 01 72 20 03 81 03 b0 11 20 01 01 20 00 04 1d
+ ff fd e4 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b 99
+ 46 10 08 d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d 50
+ e5 d6 9d 80 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee
+ 5b 35 0b 3e fe 3b 1a 15 80 1d f7 7f c0 0c 8c 8c
+ 09 ca 64 4b 10 de ca d1 58 d3 70 06 e8 1c dc 1b
+ 84 76 13 12 26 05 46 44 9a a0 2e 34 3b 2b 0c f9
+ 25 3a 79 80 25 e3 82 73 75 88 42 d1 2e aa 0b ef
+ 1e e2 68 b8 2d d7 4e 19 1a c3 6c 2d 6c 9b 17 00
+ 8c 09 ca 64 4b 10 de ca d1 58 d3 70 06 e8 1c dc
+ 1b 84 76 13 12 26 05 46 44 9a a0 2e 34 3b 2b 0c
+ 26 d4 00 01 f8 aa 65 c9 51 87 84 50 b6 07 26 a5
+ 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25 4c 11 87
+ 17 74 11 de 00 00 00 f8 aa 65 c9 51 87 84 50 b6
+ 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25
+ 4c 11 87 17 74 11 de 1e c1 01 00 00 00 00 00 02
+ 00 00 00 00 00 b0 00 00 01 00 01 91 07 b0 b0 01
+ 30 00 00 01 01 00 f9 25 3a 79 80 25 e3 82 73 75
+ 88 42 d1 2e aa 0b ef 1e e2 68 b8 2d d7 4e 19 1a
+ c3 6c 2d 6c 9b 17 3a d0 01 00 91 07 b1 b1 82 03
+ b1 03 b0 71 11 71 11 10 02 20 00 91 07 b0 b0 01
+ 1d ff fd e4 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b
+ 99 46 10 08 d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d
+ 00 02 03 04 03 03 01 2d 3a de df f1 1b 61 f1 4c
+ 88 6e 35 af a0 36 73 6d cd 87 a7 4d 27 b5 c1 51
+ 02 25 d0 f5 92 e2 13 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/captureClosed.manifest.hex b/Tests/Fixtures/Compiler/ixon-upstream/captureClosed.manifest.hex
new file mode 100644
index 000000000..67d80e527
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/captureClosed.manifest.hex
@@ -0,0 +1,18 @@
+ 49 58 43 00 00 00 00 00 01 00 00 00 00 00 00 00
+ b5 40 31 2a 76 5a 85 be a6 bf ec c3 21 c8 4a 0d
+ 3a b9 38 4a ff 14 96 70 7c 51 9a 71 68 50 5b fa
+ f4 5a 88 c0 c4 1d cc 24 1a 4a 46 eb c9 89 53 29
+ 1f 7c 81 ed a7 bd 11 c4 99 78 cb 65 ea 82 c9 69
+ 01 00 00 00 f4 5a 88 c0 c4 1d cc 24 1a 4a 46 eb
+ c9 89 53 29 1f 7c 81 ed a7 bd 11 c4 99 78 cb 65
+ ea 82 c9 69 06 00 00 00 00 00 00 00 21 00 43 6f
+ 6d 70 69 6c 61 74 72 69 78 55 70 73 74 72 65 61
+ 6d 2e 63 61 70 74 75 72 65 43 6c 6f 73 65 64 18
+ 00 6c 65 61 6e 70 72 6f 76 65 72 2f 6c 65 61 6e
+ 34 3a 76 34 2e 33 33 2e 31 2f 00 67 69 74 3a 69
+ 78 40 36 66 31 38 65 61 39 30 37 62 37 38 64 30
+ 36 66 37 64 63 30 39 31 37 63 34 33 62 65 62 33
+ 38 35 35 36 31 63 33 35 66 34 00 00 00 00 00 28
+ 0a b6 f1 57 06 a3 c0 ed 76 51 16 04 ab d5 65 3a
+ 52 4d ba 4b 58 93 b1 93 c9 04 db 2f 66 f8 52 9a
+ 02 00 00 00 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/lake-manifest.json b/Tests/Fixtures/Compiler/ixon-upstream/lake-manifest.json
new file mode 100644
index 000000000..f11f19df2
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/lake-manifest.json
@@ -0,0 +1 @@
+{"version":"1.2.0","packagesDir":".lake/packages","packages":[],"name":"compilatrixUpstream","lakeDir":".lake"}
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/lakefile.toml b/Tests/Fixtures/Compiler/ixon-upstream/lakefile.toml
new file mode 100644
index 000000000..5aee0f42b
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/lakefile.toml
@@ -0,0 +1,5 @@
+name = "compilatrixUpstream"
+version = "0.1.0"
+
+[[lean_lib]]
+name = "CompilatrixUpstream"
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/lean-toolchain b/Tests/Fixtures/Compiler/ixon-upstream/lean-toolchain
new file mode 100644
index 000000000..a8afa7d1b
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/lean-toolchain
@@ -0,0 +1 @@
+leanprover/lean4:v4.33.1
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/letClosed.ixe.hex b/Tests/Fixtures/Compiler/ixon-upstream/letClosed.ixe.hex
new file mode 100644
index 000000000..8ee428200
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/letClosed.ixe.hex
@@ -0,0 +1,42 @@
+ e2 e2 28 72 6e 33 1e dd b2 17 a3 2c 6c ed 86 02
+ 6a 97 a2 6c a7 df 50 70 c9 9b 7f 97 0d ee ef 17
+ a1 01 6c 73 71 71 f1 a3 c4 82 ba 96 cb e4 99 8e
+ a6 60 fd a8 24 c5 78 fe 66 8a b9 fd c4 aa e1 b9
+ 75 4f 00 00 06 1d ff fd e4 8c 4e f6 65 3b 95 ec
+ c5 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e
+ 59 e9 27 71 4d 25 d6 00 f8 aa 65 c9 51 87 84 50
+ b6 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e
+ 25 4c 11 87 17 74 11 de 00 00 00 50 e5 d6 9d 80
+ 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e
+ fe 3b 1a 15 80 1d f7 7f c0 0c 8c 26 d4 00 00 f8
+ aa 65 c9 51 87 84 50 b6 07 26 a5 96 7b 39 c0 67
+ 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17 74 11 de 00
+ 00 00 6c 73 71 71 f1 a3 c4 82 ba 96 cb e4 99 8e
+ a6 60 fd a8 24 c5 78 fe 66 8a b9 fd c4 aa e1 b9
+ 75 4f 80 a0 d0 01 00 b1 a1 91 07 b1 b1 81 03 b1
+ 71 b0 10 72 20 03 10 71 b0 71 b0 20 01 02 20 02
+ 20 00 04 1d ff fd e4 8c 4e f6 65 3b 95 ec c5 47
+ 4d ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e 59 e9
+ 27 71 4d 50 e5 d6 9d 80 6b c1 c6 16 ca ce 42 30
+ c9 82 a0 ee 5b 35 0b 3e fe 3b 1a 15 80 1d f7 7f
+ c0 0c 8c 8c 09 ca 64 4b 10 de ca d1 58 d3 70 06
+ e8 1c dc 1b 84 76 13 12 26 05 46 44 9a a0 2e 34
+ 3b 2b 0c f9 25 3a 79 80 25 e3 82 73 75 88 42 d1
+ 2e aa 0b ef 1e e2 68 b8 2d d7 4e 19 1a c3 6c 2d
+ 6c 9b 17 00 8c 09 ca 64 4b 10 de ca d1 58 d3 70
+ 06 e8 1c dc 1b 84 76 13 12 26 05 46 44 9a a0 2e
+ 34 3b 2b 0c 26 d4 00 01 f8 aa 65 c9 51 87 84 50
+ b6 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e
+ 25 4c 11 87 17 74 11 de 00 00 00 f8 aa 65 c9 51
+ 87 84 50 b6 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d
+ 82 1e 1e 25 4c 11 87 17 74 11 de 1e c1 01 00 00
+ 00 00 00 02 00 00 00 00 00 b0 00 00 01 00 01 91
+ 07 b0 b0 01 30 00 00 01 01 00 f9 25 3a 79 80 25
+ e3 82 73 75 88 42 d1 2e aa 0b ef 1e e2 68 b8 2d
+ d7 4e 19 1a c3 6c 2d 6c 9b 17 3a d0 01 00 91 07
+ b1 b1 82 03 b1 03 b0 71 11 71 11 10 02 20 00 91
+ 07 b0 b0 01 1d ff fd e4 8c 4e f6 65 3b 95 ec c5
+ 47 4d ee 8b 99 46 10 08 d2 6d 80 ca 38 4f 1e 59
+ e9 27 71 4d 00 02 03 04 03 03 01 2d 3a de df f1
+ 1b 61 f1 4c 88 6e 35 af a0 36 73 6d cd 87 a7 4d
+ 27 b5 c1 51 02 25 d0 f5 92 e2 13 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/letClosed.manifest.hex b/Tests/Fixtures/Compiler/ixon-upstream/letClosed.manifest.hex
new file mode 100644
index 000000000..cf0d4f214
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/letClosed.manifest.hex
@@ -0,0 +1,18 @@
+ 49 58 43 00 00 00 00 00 01 00 00 00 00 00 00 00
+ f4 3b 2d db aa 6d 90 25 9f dc 22 53 f1 2a 83 0e
+ 67 3f 74 38 a8 6f e0 4a 25 22 ee 4a cb e8 80 fd
+ e2 28 72 6e 33 1e dd b2 17 a3 2c 6c ed 86 02 6a
+ 97 a2 6c a7 df 50 70 c9 9b 7f 97 0d ee ef 17 a1
+ 01 00 00 00 e2 28 72 6e 33 1e dd b2 17 a3 2c 6c
+ ed 86 02 6a 97 a2 6c a7 df 50 70 c9 9b 7f 97 0d
+ ee ef 17 a1 06 00 00 00 00 00 00 00 1d 00 43 6f
+ 6d 70 69 6c 61 74 72 69 78 55 70 73 74 72 65 61
+ 6d 2e 6c 65 74 43 6c 6f 73 65 64 18 00 6c 65 61
+ 6e 70 72 6f 76 65 72 2f 6c 65 61 6e 34 3a 76 34
+ 2e 33 33 2e 31 2f 00 67 69 74 3a 69 78 40 36 66
+ 31 38 65 61 39 30 37 62 37 38 64 30 36 66 37 64
+ 63 30 39 31 37 63 34 33 62 65 62 33 38 35 35 36
+ 31 63 33 35 66 34 00 00 00 00 00 71 7c 04 ee 46
+ 77 99 46 5d 08 c0 e6 24 f3 12 fe 61 9b ad be 73
+ 94 c7 fa 06 37 f1 b0 c9 75 74 4b 9e 02 00 00 00
+ 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/recClosed.ixe.hex b/Tests/Fixtures/Compiler/ixon-upstream/recClosed.ixe.hex
new file mode 100644
index 000000000..160230edb
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/recClosed.ixe.hex
@@ -0,0 +1,50 @@
+ e2 8a dc f0 6f 26 a4 ad bf d4 58 86 69 be cc 3c
+ d5 dd f4 ec 6a 5f 1d 9b fb cb 90 4b 1f fd 65 05
+ ec 01 12 48 f5 d1 b9 eb 3c 50 a6 81 8d 4d 6d 1e
+ 24 13 a7 e9 58 7e 09 90 de 24 21 e9 97 d7 56 da
+ 7a a1 00 00 06 12 48 f5 d1 b9 eb 3c 50 a6 81 8d
+ 4d 6d 1e 24 13 a7 e9 58 7e 09 90 de 24 21 e9 97
+ d7 56 da 7a a1 80 a7 d0 01 00 b0 74 21 02 00 81
+ 03 b0 b0 20 01 82 03 b0 03 b0 71 b1 10 71 b1 71
+ b1 71 b1 20 01 02 20 00 20 03 04 1d ff fd e4 8c
+ 4e f6 65 3b 95 ec c5 47 4d ee 8b 99 46 10 08 d2
+ 6d 80 ca 38 4f 1e 59 e9 27 71 4d 50 e5 d6 9d 80
+ 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee 5b 35 0b 3e
+ fe 3b 1a 15 80 1d f7 7f c0 0c 8c 89 d6 69 0b 08
+ 08 b1 da 49 e0 15 a4 f2 1d f3 fc 3f 00 fb 96 ac
+ 50 2f 5f 09 7c e4 52 e5 73 70 4c 8c 09 ca 64 4b
+ 10 de ca d1 58 d3 70 06 e8 1c dc 1b 84 76 13 12
+ 26 05 46 44 9a a0 2e 34 3b 2b 0c 01 01 00 1d ff
+ fd e4 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b 99 46
+ 10 08 d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d 25 d6
+ 00 f8 aa 65 c9 51 87 84 50 b6 07 26 a5 96 7b 39
+ c0 67 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17 74 11
+ de 00 00 00 50 e5 d6 9d 80 6b c1 c6 16 ca ce 42
+ 30 c9 82 a0 ee 5b 35 0b 3e fe 3b 1a 15 80 1d f7
+ 7f c0 0c 8c 26 d4 00 00 f8 aa 65 c9 51 87 84 50
+ b6 07 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e
+ 25 4c 11 87 17 74 11 de 00 00 00 89 d6 69 0b 08
+ 08 b1 da 49 e0 15 a4 f2 1d f3 fc 3f 00 fb 96 ac
+ 50 2f 5f 09 7c e4 52 e5 73 70 4c 80 b2 d1 00 01
+ 00 00 01 02 94 07 b7 07 b6 07 b5 07 b0 71 13 10
+ 02 00 83 03 b7 03 b6 03 b5 11 01 84 03 b7 03 b6
+ 03 b5 03 b0 72 11 10 74 31 00 00 13 12 11 10 08
+ 20 00 71 12 10 71 20 02 11 71 13 b2 91 07 b1 b3
+ 91 07 b0 b4 71 10 20 01 91 07 b0 00 03 1d ff fd
+ e4 8c 4e f6 65 3b 95 ec c5 47 4d ee 8b 99 46 10
+ 08 d2 6d 80 ca 38 4f 1e 59 e9 27 71 4d 50 e5 d6
+ 9d 80 6b c1 c6 16 ca ce 42 30 c9 82 a0 ee 5b 35
+ 0b 3e fe 3b 1a 15 80 1d f7 7f c0 0c 8c 8c 09 ca
+ 64 4b 10 de ca d1 58 d3 70 06 e8 1c dc 1b 84 76
+ 13 12 26 05 46 44 9a a0 2e 34 3b 2b 0c 01 c0 8c
+ 09 ca 64 4b 10 de ca d1 58 d3 70 06 e8 1c dc 1b
+ 84 76 13 12 26 05 46 44 9a a0 2e 34 3b 2b 0c 26
+ d4 00 01 f8 aa 65 c9 51 87 84 50 b6 07 26 a5 96
+ 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25 4c 11 87 17
+ 74 11 de 00 00 00 f8 aa 65 c9 51 87 84 50 b6 07
+ 26 a5 96 7b 39 c0 67 3b ba 0a 9d 82 1e 1e 25 4c
+ 11 87 17 74 11 de 1e c1 01 00 00 00 00 00 02 00
+ 00 00 00 00 b0 00 00 01 00 01 91 07 b0 b0 01 30
+ 00 00 01 01 00 01 01 03 01 2d 3a de df f1 1b 61
+ f1 4c 88 6e 35 af a0 36 73 6d cd 87 a7 4d 27 b5
+ c1 51 02 25 d0 f5 92 e2 13 00 00 00
diff --git a/Tests/Fixtures/Compiler/ixon-upstream/recClosed.manifest.hex b/Tests/Fixtures/Compiler/ixon-upstream/recClosed.manifest.hex
new file mode 100644
index 000000000..c0392ae8e
--- /dev/null
+++ b/Tests/Fixtures/Compiler/ixon-upstream/recClosed.manifest.hex
@@ -0,0 +1,18 @@
+ 49 58 43 00 00 00 00 00 01 00 00 00 00 00 00 00
+ f5 6b ea b0 90 94 b6 76 fc 07 6c 38 18 47 d1 0f
+ ed 4c d7 ec 87 89 65 ac 0c 25 4d e5 1c 05 f6 b7
+ 8a dc f0 6f 26 a4 ad bf d4 58 86 69 be cc 3c d5
+ dd f4 ec 6a 5f 1d 9b fb cb 90 4b 1f fd 65 05 ec
+ 01 00 00 00 8a dc f0 6f 26 a4 ad bf d4 58 86 69
+ be cc 3c d5 dd f4 ec 6a 5f 1d 9b fb cb 90 4b 1f
+ fd 65 05 ec 06 00 00 00 00 00 00 00 1d 00 43 6f
+ 6d 70 69 6c 61 74 72 69 78 55 70 73 74 72 65 61
+ 6d 2e 72 65 63 43 6c 6f 73 65 64 18 00 6c 65 61
+ 6e 70 72 6f 76 65 72 2f 6c 65 61 6e 34 3a 76 34
+ 2e 33 33 2e 31 2f 00 67 69 74 3a 69 78 40 36 66
+ 31 38 65 61 39 30 37 62 37 38 64 30 36 66 37 64
+ 63 30 39 31 37 63 34 33 62 65 62 33 38 35 35 36
+ 31 63 33 35 66 34 00 00 00 00 00 4c 0c 64 ad 29
+ 97 00 1a 63 b5 d6 a7 04 75 f6 56 cd 27 eb 8d d3
+ 0b a8 c3 ac b8 bd 87 56 4b 3f 49 1c 03 00 00 00
+ 00 00 00
diff --git a/Tests/Fixtures/Compiler/source-borrow-runtime/expected.json b/Tests/Fixtures/Compiler/source-borrow-runtime/expected.json
new file mode 100644
index 000000000..e7e41967d
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-borrow-runtime/expected.json
@@ -0,0 +1,161 @@
+{
+  "format": "compilatrix/source-borrow-runtime-expected/1",
+  "cases": [
+    {
+      "name": "read-tag-runtime-0",
+      "depth": 0,
+      "source_root": "e99c1323f26099436b9437eead2c90de3c291b6a6f474520cbffe34ebc7f172e",
+      "entry": "59b3b74012c20c6a08e5a363f9954cf101b93c786ee0ac67a2453313cc0890eb",
+      "borrowed_entry": "c4127e70d954dbd85968a60514a03afc1246db56b9c11fa1599b0a661c9d055d",
+      "factory": "b3deded93e50c8326d0b9ca842d3c4837292626cc0c3cf45eb04e1de328d7b8a"
+    },
+    {
+      "name": "read-tag-runtime-1",
+      "depth": 1,
+      "source_root": "db97f65a4aaea7327c6a53fd45033e46304d289b0a088821f765ea57e06d0590",
+      "entry": "9708c017f408b4acf394331c996e09a4ae26e89888e05c2cae35b926124db565",
+      "borrowed_entry": "7b71cd750eb9c5c1bf7b72e9e0218ae770d1350e8f7555994e74c46523aa7839",
+      "factory": "1982fa758c0b519a9a9e333a7d7de266e16b4a34147185536d605c24dabf3507"
+    },
+    {
+      "name": "read-tag-runtime-2",
+      "depth": 2,
+      "source_root": "caed6598f5f4ca6e22923b886614937a34af75c1fa1d6feb8c8749ad07f4e8f7",
+      "entry": "5357eac8b31aa363134bcf09932f5827bcab791c67a098f2c545923414c8bc13",
+      "borrowed_entry": "ee73a274f77b3abe49781ccd1453a0d24124ce99a984a2bac9d0f342d11ab50c",
+      "factory": "c4e8286c7dbc09270e6b0d6dff7eeb47a1e05cbf915c10dd8f1049db5ffcac2a"
+    },
+    {
+      "name": "read-tag-runtime-3",
+      "depth": 3,
+      "source_root": "bcf4c2ce7a45d63e672205ef9cb46beb13638c524c31c8db64ec86af799b755a",
+      "entry": "d0e78a669d873301117f99195c213023048a97096894e605bd74da7824c1f6b2",
+      "borrowed_entry": "e9d735ca0f5e2ce60e17fde4c5a86bb9a9af73d523f8ecc25c4e58da5fe545b0",
+      "factory": "fcaa9a7ce8d5f5920141485b075c7bd35b9ded946b43b635f023a7b4eefcce73"
+    },
+    {
+      "name": "read-tag-runtime-4",
+      "depth": 4,
+      "source_root": "8de19831de0bee738ec693185b0b545cbc69ecc70113015b31a74ce80e18758d",
+      "entry": "7275466ff5aacbb9faac8e67cd99dc9b6bb551ab48dfcec3427772c166e33edc",
+      "borrowed_entry": "35c0307945348396c72e3f02c99e079011cf26f9529a6201802eee89ec2b3278",
+      "factory": "7226105757c1483409d05770cc803d1765b0d7c10d772b4f2d65c517e6a7d22e"
+    },
+    {
+      "name": "read-tag-runtime-5",
+      "depth": 5,
+      "source_root": "83f2623241e16853bb817fc5de0ce349c716025cc25a1bfa7ae25b7f18805cce",
+      "entry": "8e9f1709a92acf3ce11f284416ee46d4e85faa769e76351acf68052394e69ce4",
+      "borrowed_entry": "d11d82a4ee3a0c6927ac6bb30720b896e3b8ef46fe48f9cf6ae78c4563c66b51",
+      "factory": "50efd3a075f7ea80c5d5b9828166de4ddf27315ae202e87a16229285f183c6fc"
+    },
+    {
+      "name": "read-tag-runtime-6",
+      "depth": 6,
+      "source_root": "0b186fa3a95792e663879ff70af070cb2ec84b46709b7a107e8af2b3f60e3a3e",
+      "entry": "d3e794b9c19c74408ef7f2f5a35f97fe3917466cac624460e108acb55800dd1b",
+      "borrowed_entry": "b5fb5ee75a020a8bb33137c3afbde3afee0c82d36fc4ad59a808dcebe7124901",
+      "factory": "a9d9aab8df3c9c82e6f74418d7df5c217d020f4c9daf4ecf4b5850fd31e9304c"
+    },
+    {
+      "name": "read-tag-runtime-7",
+      "depth": 7,
+      "source_root": "6da972fdc4bbb1e8d519ecb5f0add7be933f38e0a3d78413b4c40007cac6994d",
+      "entry": "38d45af46401f5f91c44b4561180cbf552d9bbdad75c5ca86efd24acbeb2ebc3",
+      "borrowed_entry": "cefdb2a85454564b6e7ae4aaacab9214a3285f23628fde4173e49d149ee03954",
+      "factory": "da7d25ce7372e3deaa13ee696320d438c7a888276143092cf1b2ebc09fd4cd8a"
+    },
+    {
+      "name": "read-tag-runtime-8",
+      "depth": 8,
+      "source_root": "679ee49cc590e1e0ed412f80fc56a00d9eea5ef029c15e51ca596a9fd0c46e10",
+      "entry": "add3dcb05ab0d78699e9e22da57d687cbd1622ffa75e6c4f3e9a724ca2b932ee",
+      "borrowed_entry": "08142e783451ab2fc4023e79fe11a08597594f9d8bbd04e682b95ba5b3b2964f",
+      "factory": "9ed372751fa9688d4e5856a89dd90ca6f9c39a58ccf776debd77ffc83ac3189e"
+    }
+  ],
+  "structural_guards": [
+    [
+      "structural-open-certificate",
+      true
+    ],
+    [
+      "cyclic-summary-rejected",
+      true
+    ],
+    [
+      "allocation-peak-hazard-rejected",
+      true
+    ],
+    [
+      "structural-budget-fallback",
+      true
+    ],
+    [
+      "incomplete-summary-rejected",
+      true
+    ],
+    [
+      "borrow-then-reset",
+      true
+    ],
+    [
+      "local-tail-lender-rejected",
+      true
+    ],
+    [
+      "later-reset-keeps-owned-parameter",
+      true
+    ]
+  ],
+  "ownership_guards": [
+    [
+      "return-escape",
+      true
+    ],
+    [
+      "store-escape",
+      true
+    ],
+    [
+      "capture-escape",
+      true
+    ],
+    [
+      "local-tail-lender",
+      true
+    ],
+    [
+      "later-reset",
+      true
+    ],
+    [
+      "peak-regression",
+      true
+    ],
+    [
+      "no-rc-gain",
+      true
+    ],
+    [
+      "replay-budget",
+      true
+    ],
+    [
+      "internal-label-collision",
+      true
+    ],
+    [
+      "duplicate-summary",
+      true
+    ],
+    [
+      "missing-summary-owner",
+      true
+    ],
+    [
+      "candidate-limit",
+      true
+    ]
+  ]
+}
diff --git a/Tests/Fixtures/Compiler/source-borrow/expected.json b/Tests/Fixtures/Compiler/source-borrow/expected.json
new file mode 100644
index 000000000..c98cfc3bd
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-borrow/expected.json
@@ -0,0 +1,181 @@
+{
+  "format": "compilatrix/source-borrow-expectations/1",
+  "cases": [
+    {
+      "name": "read-tag-0-zero",
+      "depth": 0,
+      "successor": false,
+      "source_root": "fb9942fd15ac2f2ecf9516afed0120f50b1d081bf2e0a193b2ac77d733f8bee4",
+      "number": 11
+    },
+    {
+      "name": "read-tag-0-succ",
+      "depth": 0,
+      "successor": true,
+      "source_root": "d025c3820c3e89500a898ded931c80faa56b6251fc3c9a0d0f0b33a7dc600b52",
+      "number": 22
+    },
+    {
+      "name": "read-tag-1-zero",
+      "depth": 1,
+      "successor": false,
+      "source_root": "fc409d7f0c05e20730791e620b2576cd74ecdbe4a880b85894318e2b9f775b35",
+      "number": 11
+    },
+    {
+      "name": "read-tag-1-succ",
+      "depth": 1,
+      "successor": true,
+      "source_root": "556f0f3cc61ddfe66f480860a09b7e96c926c61e0e04f3cf131f6b95ce334248",
+      "number": 22
+    },
+    {
+      "name": "read-tag-2-zero",
+      "depth": 2,
+      "successor": false,
+      "source_root": "7e760358db564bfcfbe793c59bbb7a8fe2f78df17cd6b363066fd5ab73ee9a8b",
+      "number": 11
+    },
+    {
+      "name": "read-tag-2-succ",
+      "depth": 2,
+      "successor": true,
+      "source_root": "ce261debb3c8c69f930889899db7c0fc7e1a3e4589cb0f264929efadd5f53957",
+      "number": 22
+    },
+    {
+      "name": "read-tag-3-zero",
+      "depth": 3,
+      "successor": false,
+      "source_root": "36c9215b71831accddd7163990fc606aa5df7d8d14d3017ec2d1653b3ffa7be5",
+      "number": 11
+    },
+    {
+      "name": "read-tag-3-succ",
+      "depth": 3,
+      "successor": true,
+      "source_root": "20af7da51cf78ca126942fe32b608ce3ae18523bc5de012acb0057fa3da6b02f",
+      "number": 22
+    },
+    {
+      "name": "read-tag-4-zero",
+      "depth": 4,
+      "successor": false,
+      "source_root": "e6f80bef52005fdca7c12691885f74525eb3b274a04722fcc559a391ff2cb887",
+      "number": 11
+    },
+    {
+      "name": "read-tag-4-succ",
+      "depth": 4,
+      "successor": true,
+      "source_root": "e0be4b08c6230c8c97557e3ade8e1f144c11ff5987861d88bfa0201300e3f26d",
+      "number": 22
+    },
+    {
+      "name": "read-tag-5-zero",
+      "depth": 5,
+      "successor": false,
+      "source_root": "f4164487ebc52e522633f35bb612f821f7f4d3ca0dc4ed3e868fb4a491e3392e",
+      "number": 11
+    },
+    {
+      "name": "read-tag-5-succ",
+      "depth": 5,
+      "successor": true,
+      "source_root": "741197e554589585734e7e9c4fef645f4341bbbb8db4807ffe203773d54b8c0f",
+      "number": 22
+    },
+    {
+      "name": "read-tag-6-zero",
+      "depth": 6,
+      "successor": false,
+      "source_root": "e2c85c4fa684c9d5076a4654d707182d69d4f3c9cdc9ae7dbb67b88a937bc572",
+      "number": 11
+    },
+    {
+      "name": "read-tag-6-succ",
+      "depth": 6,
+      "successor": true,
+      "source_root": "689d5524775cc623fb7a7e9e912a72a5d7ad31451c0d4e6e5e84007c751714a1",
+      "number": 22
+    },
+    {
+      "name": "read-tag-7-zero",
+      "depth": 7,
+      "successor": false,
+      "source_root": "a6648a18bf6547067e3da01da5aca89529da7815e523c922da88b232d5d527d9",
+      "number": 11
+    },
+    {
+      "name": "read-tag-7-succ",
+      "depth": 7,
+      "successor": true,
+      "source_root": "50be0acafc0b6679dc631ff92ee38ecaac9e778bf8c5d127ecf10c21bd45c69c",
+      "number": 22
+    },
+    {
+      "name": "read-tag-8-zero",
+      "depth": 8,
+      "successor": false,
+      "source_root": "f44df93af8775ea5b380f2f63a34079fae545514094ec24e45d9bb9a97f6b31b",
+      "number": 11
+    },
+    {
+      "name": "read-tag-8-succ",
+      "depth": 8,
+      "successor": true,
+      "source_root": "91ce9a32914da8ef4ece16c8164c8200ac8109bbaba9f21847fe67974756784d",
+      "number": 22
+    }
+  ],
+  "negative_guards": [
+    [
+      "return-escape",
+      true
+    ],
+    [
+      "store-escape",
+      true
+    ],
+    [
+      "capture-escape",
+      true
+    ],
+    [
+      "local-tail-lender",
+      true
+    ],
+    [
+      "later-reset",
+      true
+    ],
+    [
+      "peak-regression",
+      true
+    ],
+    [
+      "no-rc-gain",
+      true
+    ],
+    [
+      "replay-budget",
+      true
+    ],
+    [
+      "internal-label-collision",
+      true
+    ],
+    [
+      "duplicate-summary",
+      true
+    ],
+    [
+      "missing-summary-owner",
+      true
+    ],
+    [
+      "candidate-limit",
+      true
+    ]
+  ]
+}
diff --git a/Tests/Fixtures/Compiler/source-call-reuse/expected.json b/Tests/Fixtures/Compiler/source-call-reuse/expected.json
new file mode 100644
index 000000000..d0a5589e5
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-call-reuse/expected.json
@@ -0,0 +1,543 @@
+{"policy_and_rejection_checks":
+ ["optional-hot-call",
+  "optional-cold-call",
+  "required-call",
+  "optional-discard-after-return",
+  "required-discard-after-return",
+  "nested-independent-callers",
+  "edge-transfer-after-return",
+  "callSelf-policy-boundary",
+  "double-consumption",
+  "unconsumed-return",
+  "tail-call-live-credit",
+  "tail-self-live-credit",
+  "papp-live-credit",
+  "apply-live-credit",
+  "extern-live-credit",
+  "layout-mismatch-after-return",
+  "duplicate-edge-credit",
+  "omitted-edge-credit",
+  "callee-cannot-consume-ancestor-credit",
+  "checked-baseline-fallback",
+  "site-indirect-call",
+  "site-no-call",
+  "site-live-owner",
+  "site-layout-mismatch",
+  "map-wrong-worker",
+  "map-wrong-step",
+  "map-wrong-base",
+  "map-wrong-recursor",
+  "map-wrong-cons-arity",
+  "map-wrong-nil-tag",
+  "map-wrong-alias",
+  "map-wrong-entry",
+  "map-address-conflict",
+  "map-backend-fallback",
+  "map-literal-fallback-execution"],
+ "format": "compilatrix/source-call-reuse-report/1",
+ "cases":
+ [{"value": {"list": {"values": []}},
+   "unique_prefix": 0,
+   "suspended_calls": 0,
+   "source_root": "c4a815cd67ffa69ad9249d369a79c1f2c1f299b54c5fe0ce5f217f0494996af3",
+   "source_constants": 12,
+   "snapshot": "empty-hot.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 42,
+   "provenance": "3409b202c55a94b2e3b5fbf38603351fb7ee00493da6de65d3b677f86b63f30f",
+   "prefixes": 7,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 1,
+    "peakLiveNodes": 1,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "pass": "shared-call-reuse/1",
+   "name": "empty-hot",
+   "maximum_credits": 0,
+   "map_specialization": "cac37d7c2b6bca2e92d193a4a7ca95e556ec2c42a0cc4fb0fe7db856adcf76c8",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 1,
+    "peakLiveNodes": 1,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "literal_ixir1_root": "1b7879d9b696dcf844c08b0ede2c32f3a0c4ee75884ebf999a34017df5c0add4",
+   "ixir1_root": "2596e71ac03f78d115a8b71e675e083013ad57b1d8a9a0d9c621f109e5f806e7",
+   "input": [],
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8c24ffc88d47c6dc3c19294ca886c3bb7429a99a5440e30dba8542ebc4b25c5b",
+    "7dfe7f19df422182e4788595df7a33ee132988bc79768900e130cfdb2fd476a7"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 1,
+    "peakLiveNodes": 1,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value": {"pair": {"retained": [], "mapped": []}},
+   "unique_prefix": 0,
+   "suspended_calls": 0,
+   "source_root": "9c65b6374ffd58326c9737211ad528e2a474ef54dea3a3ab433fa462bda04ea3",
+   "source_constants": 12,
+   "snapshot": "empty-cold.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 42,
+   "provenance": "64232c8dbd9731c8d636d33496d186da9da0ffabcdad64708922632735831faa",
+   "prefixes": 10,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 2,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 3},
+   "pass": "shared-call-reuse/1",
+   "name": "empty-cold",
+   "maximum_credits": 0,
+   "map_specialization": "cac37d7c2b6bca2e92d193a4a7ca95e556ec2c42a0cc4fb0fe7db856adcf76c8",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 2,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 3},
+   "literal_ixir1_root": "d14aa47fc6e9f8e8bc1e6245c97d8e48daa6ee2c8106a999a38b0a9af13e3fb9",
+   "ixir1_root": "d68eb15fd53b7734817d5807c0be8a59c1f6dc9c5b481f085b4a699105cea455",
+   "input": [],
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8c24ffc88d47c6dc3c19294ca886c3bb7429a99a5440e30dba8542ebc4b25c5b",
+    "7dfe7f19df422182e4788595df7a33ee132988bc79768900e130cfdb2fd476a7"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 2,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 3},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value": {"list": {"values": [42]}},
+   "unique_prefix": 0,
+   "suspended_calls": 2,
+   "source_root": "637acdef997d1d445e45fafcc163ac09469b39cdfed5b5529b2cbae2e606d46c",
+   "source_constants": 12,
+   "snapshot": "singleton-hot.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 42,
+   "provenance": "c51700691fc36603c64da6e5a6582bb4c4d7e878168e224dbad6c2d71d1bc077",
+   "prefixes": 22,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 1,
+    "reusedPayloadUnits": 2,
+    "resetAttempts": 1,
+    "rcops": 2,
+    "peakLiveNodes": 2,
+    "hotResets": 1,
+    "frees": 2,
+    "coldResets": 0,
+    "allocs": 4},
+   "pass": "shared-call-reuse/1",
+   "name": "singleton-hot",
+   "maximum_credits": 1,
+   "map_specialization": "cac37d7c2b6bca2e92d193a4a7ca95e556ec2c42a0cc4fb0fe7db856adcf76c8",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 1,
+    "rcops": 2,
+    "peakLiveNodes": 2,
+    "hotResets": 1,
+    "frees": 3,
+    "coldResets": 0,
+    "allocs": 5},
+   "literal_ixir1_root": "4e47466aa17f19c36c1609430b679c9f7c4bfb3c78e890ac9da5c0480aa0088b",
+   "ixir1_root": "fb9030a18e6fbb5d9cdbba013542c878d885e4bbf14d4a836807f31533681509",
+   "input": [17],
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8c24ffc88d47c6dc3c19294ca886c3bb7429a99a5440e30dba8542ebc4b25c5b",
+    "7dfe7f19df422182e4788595df7a33ee132988bc79768900e130cfdb2fd476a7"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 5,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 3,
+    "coldResets": 0,
+    "allocs": 5},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value": {"pair": {"retained": [17], "mapped": [42]}},
+   "unique_prefix": 0,
+   "suspended_calls": 2,
+   "source_root": "93df2f54f8b19f5c80a11e376e5b0fd7638544eb53547ef16c049fabda5bf5f4",
+   "source_constants": 12,
+   "snapshot": "singleton-cold.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 42,
+   "provenance": "fec2e15d81e2efecf93ad1923ba1022cd0ac4d2133404a60a8a205a8a32af50f",
+   "prefixes": 25,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 1,
+    "rcops": 5,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 1,
+    "allocs": 6},
+   "pass": "shared-call-reuse/1",
+   "name": "singleton-cold",
+   "maximum_credits": 1,
+   "map_specialization": "cac37d7c2b6bca2e92d193a4a7ca95e556ec2c42a0cc4fb0fe7db856adcf76c8",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 1,
+    "rcops": 5,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 1,
+    "allocs": 6},
+   "literal_ixir1_root": "62f4919ffc01a4fe34d2b9125c6c61649981d6525209273f33e7c2cacd9c2fc6",
+   "ixir1_root": "e6299aa5d3924d2806b832940481c00dde5bec140ca302a2bb27050a1a6aed5c",
+   "input": [17],
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8c24ffc88d47c6dc3c19294ca886c3bb7429a99a5440e30dba8542ebc4b25c5b",
+    "7dfe7f19df422182e4788595df7a33ee132988bc79768900e130cfdb2fd476a7"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 5,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 6},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value": {"list": {"values": [42, 42, 42]}},
+   "unique_prefix": 0,
+   "suspended_calls": 6,
+   "source_root": "4de658d192b71a6af23dc73a6e3893d2ff317f0aea25d0e6f1024ff9579c50a4",
+   "source_constants": 12,
+   "snapshot": "three-hot.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 42,
+   "provenance": "416849e5fafb825e52b0c5ceea4e54363db852041a31c36c51b7daa904ba2e4b",
+   "prefixes": 52,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 3,
+    "reusedPayloadUnits": 6,
+    "resetAttempts": 3,
+    "rcops": 4,
+    "peakLiveNodes": 4,
+    "hotResets": 3,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "pass": "shared-call-reuse/1",
+   "name": "three-hot",
+   "maximum_credits": 3,
+   "map_specialization": "cac37d7c2b6bca2e92d193a4a7ca95e556ec2c42a0cc4fb0fe7db856adcf76c8",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 3,
+    "rcops": 4,
+    "peakLiveNodes": 4,
+    "hotResets": 3,
+    "frees": 7,
+    "coldResets": 0,
+    "allocs": 11},
+   "literal_ixir1_root": "c996586646cc4c442c00462801e6caa7fb6867c17570b8f6045d58fc88235268",
+   "ixir1_root": "87a0a6712683dab28d33b72a64aa44fd9b194598a3d07aa47541ced89b0ddf48",
+   "input": [1, 2, 3],
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8c24ffc88d47c6dc3c19294ca886c3bb7429a99a5440e30dba8542ebc4b25c5b",
+    "7dfe7f19df422182e4788595df7a33ee132988bc79768900e130cfdb2fd476a7"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 13,
+    "peakLiveNodes": 4,
+    "hotResets": 0,
+    "frees": 7,
+    "coldResets": 0,
+    "allocs": 11},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value": {"pair": {"retained": [1, 2, 3], "mapped": [42, 42, 42]}},
+   "unique_prefix": 0,
+   "suspended_calls": 6,
+   "source_root": "b5a80f6f0716feab149c3b552dcc790f52150b3e5cbdb41b19ca2c3213bfd611",
+   "source_constants": 12,
+   "snapshot": "three-cold.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 42,
+   "provenance": "cc6a52650572d7d3bad482bf2d4da79d28d963dd25e68a9805f6367bd4b0284a",
+   "prefixes": 55,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 3,
+    "rcops": 11,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 3,
+    "coldResets": 3,
+    "allocs": 12},
+   "pass": "shared-call-reuse/1",
+   "name": "three-cold",
+   "maximum_credits": 3,
+   "map_specialization": "cac37d7c2b6bca2e92d193a4a7ca95e556ec2c42a0cc4fb0fe7db856adcf76c8",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 3,
+    "rcops": 11,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 3,
+    "coldResets": 3,
+    "allocs": 12},
+   "literal_ixir1_root": "b31d4e45ef47f9fef4792e17ba84fa3931535b5e899de08755d779fe39961bf0",
+   "ixir1_root": "3de04da85ef2aa308829556e4f006205a987fad2af1a2a1bf73d2e3bb2bd4f06",
+   "input": [1, 2, 3],
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8c24ffc88d47c6dc3c19294ca886c3bb7429a99a5440e30dba8542ebc4b25c5b",
+    "7dfe7f19df422182e4788595df7a33ee132988bc79768900e130cfdb2fd476a7"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 11,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 3,
+    "coldResets": 0,
+    "allocs": 12},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value":
+   {"list":
+    {"values":
+     [18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623]}},
+   "unique_prefix": 0,
+   "suspended_calls": 14,
+   "source_root": "a8e7292e897e0f1209b21cb7f1708bb9c1e5b9a0852b185df19be72ec92e8f2b",
+   "source_constants": 12,
+   "snapshot": "mixed-values-hot.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 18446744073709551623,
+   "provenance": "9e0f1c6589d38272914091941d421086187b67b875b39248d5931e4044406964",
+   "prefixes": 112,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 7,
+    "reusedPayloadUnits": 14,
+    "resetAttempts": 7,
+    "rcops": 8,
+    "peakLiveNodes": 8,
+    "hotResets": 7,
+    "frees": 8,
+    "coldResets": 0,
+    "allocs": 16},
+   "pass": "shared-call-reuse/1",
+   "name": "mixed-values-hot",
+   "maximum_credits": 7,
+   "map_specialization": "81b69d4cb57753b66b7c47729218cd714acc60d69bd947048c0d506d7a83c817",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 7,
+    "rcops": 8,
+    "peakLiveNodes": 8,
+    "hotResets": 7,
+    "frees": 15,
+    "coldResets": 0,
+    "allocs": 23},
+   "literal_ixir1_root": "52d3f80b5da4f0b5001ef3575d98035cbc8fd8cdabe0e4bd534aa5b07df7f6e3",
+   "ixir1_root": "dd3d01893673b2af2761db463afd72a31695380d41a96e80a1e17a773c03c67b",
+   "input": [0, 3, 3, 18446744073709551616, 1, 42, 0],
+   "hpt_roots":
+   ["36e2c9b0c878be072b231f3dec5c1e4516b432f17b5b8e78eaa29970a93b4b7b",
+    "85779dad86d6d09e0d3d67c22ae988c667a0a33d27baf8e4eeb97fd53a167c0d",
+    "dce5ec128e92a92a5259c2489aa3d73eb4f3d910422092601c2a254a2c620530"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 29,
+    "peakLiveNodes": 8,
+    "hotResets": 0,
+    "frees": 15,
+    "coldResets": 0,
+    "allocs": 23},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value":
+   {"pair":
+    {"retained": [0, 3, 3, 18446744073709551616, 1, 42, 0],
+     "mapped":
+     [18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623,
+      18446744073709551623]}},
+   "unique_prefix": 0,
+   "suspended_calls": 14,
+   "source_root": "0b8c3bf7d51120636c19cefaf603e87ae367844a6ce6581c6b628df486cecc6e",
+   "source_constants": 12,
+   "snapshot": "mixed-values-cold.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 18446744073709551623,
+   "provenance": "84f43be218188fc6ba4ebe64addd8d4bdcd41aecfe308acd4f5325b3b03f0a6a",
+   "prefixes": 115,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 7,
+    "rcops": 23,
+    "peakLiveNodes": 17,
+    "hotResets": 0,
+    "frees": 7,
+    "coldResets": 7,
+    "allocs": 24},
+   "pass": "shared-call-reuse/1",
+   "name": "mixed-values-cold",
+   "maximum_credits": 7,
+   "map_specialization": "81b69d4cb57753b66b7c47729218cd714acc60d69bd947048c0d506d7a83c817",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 7,
+    "rcops": 23,
+    "peakLiveNodes": 17,
+    "hotResets": 0,
+    "frees": 7,
+    "coldResets": 7,
+    "allocs": 24},
+   "literal_ixir1_root": "8b9b6645ba73abef4ac293182296167d1715e5e6d38f226875f738e87325b763",
+   "ixir1_root": "def6cfc72b497a41c7dbfb4e2fc9a9d85f53e45f7be3d4b4303558f1596f81e8",
+   "input": [0, 3, 3, 18446744073709551616, 1, 42, 0],
+   "hpt_roots":
+   ["36e2c9b0c878be072b231f3dec5c1e4516b432f17b5b8e78eaa29970a93b4b7b",
+    "85779dad86d6d09e0d3d67c22ae988c667a0a33d27baf8e4eeb97fd53a167c0d",
+    "dce5ec128e92a92a5259c2489aa3d73eb4f3d910422092601c2a254a2c620530"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 23,
+    "peakLiveNodes": 17,
+    "hotResets": 0,
+    "frees": 7,
+    "coldResets": 0,
+    "allocs": 24},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value": {"pair": {"retained": [3, 2, 1], "mapped": [0, 0, 0, 0, 0]}},
+   "unique_prefix": 2,
+   "suspended_calls": 10,
+   "source_root": "6a7b801e9d9897a8f2295aaf84a4eee4f2f07e8a1525a489f5d8608dd9192684",
+   "source_constants": 12,
+   "snapshot": "mixed-ownership.json",
+   "reuse": {"suspendedCallSites": 2, "scannedBlocks": 6, "rewritten": 1},
+   "replacement": 0,
+   "provenance": "1ee5302dd4896453a76637bd79b6c01af0cf074450dc48e64f90bf1f15dc6cf0",
+   "prefixes": 85,
+   "policy": "suspended-direct-calls/1",
+   "physical":
+   {"reuses": 2,
+    "reusedPayloadUnits": 4,
+    "resetAttempts": 5,
+    "rcops": 13,
+    "peakLiveNodes": 11,
+    "hotResets": 2,
+    "frees": 5,
+    "coldResets": 3,
+    "allocs": 16},
+   "pass": "shared-call-reuse/1",
+   "name": "mixed-ownership",
+   "maximum_credits": 5,
+   "map_specialization": "ef5f4e4812742402ab0deef02145544a38350cb59b5ecc945a04f59ca7a78e04",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 5,
+    "rcops": 13,
+    "peakLiveNodes": 11,
+    "hotResets": 2,
+    "frees": 7,
+    "coldResets": 3,
+    "allocs": 18},
+   "literal_ixir1_root": "7f9b0572dd0f4a0471187701199af1551daa7e399cd8674064bd53849e3c7ba5",
+   "ixir1_root": "1f94d587cae9fb445af245d0393d1b89408d02affb2038e6f0d51fb7e7c8afc8",
+   "input": [5, 4, 3, 2, 1],
+   "hpt_roots":
+   ["30d3d268709cc622a8faead24263731ca8d7fee3c305eef1893bd878c1125e86",
+    "925f4823e7cad3670a6ad6f5d4d3aee8daa32b78b489cdd53f1ed7eadf160ce0",
+    "c1e40d63c070a9e7627865c1ef491f369d3129966d10bd4242f7cde736a71ba1"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 19,
+    "peakLiveNodes": 11,
+    "hotResets": 0,
+    "frees": 7,
+    "coldResets": 0,
+    "allocs": 18},
+   "all_heaps_reclaimed": true,
+   "aliased": true}]}
diff --git a/Tests/Fixtures/Compiler/source-coverage/README.md b/Tests/Fixtures/Compiler/source-coverage/README.md
new file mode 100644
index 000000000..1e7dbed2e
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-coverage/README.md
@@ -0,0 +1,17 @@
+The reviewed `expected.json` matrix records 11 synthetic Ixon cases and two
+production Ixon rejection cases. Its roots, HPT identities, stage boundaries,
+semantic observations, and memory counters are frozen expectations.
+
+Generate complete snapshots with `lake exe source-coverage /tmp/new-coverage`.
+Run `lake exe check-source-coverage --fixture .lake/build/bin/source-coverage`
+to compare two fresh compiler processes against this matrix and each other.
+Add `--cc cc --harness fixtures/x86/native_harness.c` on x86-64 Linux to link
+and run the three source-driven objects.
+
+The full snapshots compare original Ixon bytes, raw and addressed IxIR0/IxIR1
+graphs and maps, canonical HPT certificate/cache records, and structural IxIR2
+diagnostics. They are temporary check outputs. IxIR2 diagnostics are not a
+codec or a persistent content-address format.
+
+Refresh this matrix only after reviewing the compiler policy or fixture
+change that explains the drift. The checker never updates expectations.
diff --git a/Tests/Fixtures/Compiler/source-coverage/expected.json b/Tests/Fixtures/Compiler/source-coverage/expected.json
new file mode 100644
index 000000000..a34ccedc6
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-coverage/expected.json
@@ -0,0 +1,561 @@
+{"source_cases":
+ [{"source_constants": 1,
+   "snapshot": "scalar-zero.json",
+   "root_kind": "constant",
+   "root": "11f9a7889be4f23e910d35b8501542c842e16ef4b4c013525b617b2a9c4f8829",
+   "rejection": null,
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 1,
+    "nat": 0,
+    "hot_resets": 0,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 1, "live": 0, "frees": 1, "allocs": 1},
+    "control_steps": 6,
+    "cold_resets": 0},
+   "object": "scalar-zero.o",
+   "name": "scalar-zero",
+   "last_accepted_stage": "elf",
+   "ir1_root": "a6fd56bbb40c863cd3767059ea82f62fa649e4c906d56fc1d7aec40017c86936",
+   "hpt_roots":
+   ["30d3d268709cc622a8faead24263731ca8d7fee3c305eef1893bd878c1125e86",
+    "ddec297471fe9b1265d89698f84b10ec273e00794fec6c16e9d53ded5cd3cd31"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 1}},
+  {"source_constants": 1,
+   "snapshot": "scalar-42.json",
+   "root_kind": "constant",
+   "root": "2e926c5f48aec39e7f8dccde8e2289a8a97821714339767dc7c789fbb4479874",
+   "rejection": null,
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 1,
+    "nat": 42,
+    "hot_resets": 0,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 1, "live": 0, "frees": 1, "allocs": 1},
+    "control_steps": 6,
+    "cold_resets": 0},
+   "object": "scalar-42.o",
+   "name": "scalar-42",
+   "last_accepted_stage": "elf",
+   "ir1_root": "1898b54e998f21f0f2615354eda8014fb47188a00d9511e6e4ca8f11ac5e20d8",
+   "hpt_roots":
+   ["e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "8a6d68f3b41ba681fc57c2ebd46e5f20329f15e2feb79f29a54b7dd8bdddf036"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 1}},
+  {"source_constants": 1,
+   "snapshot": "scalar-max.json",
+   "root_kind": "constant",
+   "root": "b1657e7f011436f0ed6d2c8eafa4269a8996742f3baaf6845199a00891336781",
+   "rejection": null,
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 1,
+    "nat": 18446744073709551615,
+    "hot_resets": 0,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 1, "live": 0, "frees": 1, "allocs": 1},
+    "control_steps": 6,
+    "cold_resets": 0},
+   "object": "scalar-max.o",
+   "name": "scalar-max",
+   "last_accepted_stage": "elf",
+   "ir1_root": "03cec8b3b1f9fa35a552a76dc26f74499cd62be1e7d3e81bb3c7e2f337e8611f",
+   "hpt_roots":
+   ["6fe3b69eebbe1c1eca84ce72152aa52f49b71972fbf2df61848f8664614febbf",
+    "1994908dec77f83c0d64c6ae2184f7c206adfa2a9c39fa556348dec6f8c0fb4b"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 1}},
+  {"source_constants": 1,
+   "snapshot": "scalar-overflow.json",
+   "root_kind": "constant",
+   "root": "e25089a56add5d2b08d097fcbb17ab22e33f65b140dc069b2225751af54cf909",
+   "rejection":
+   {"stage": "x86-selection",
+    "root": "e25089a56add5d2b08d097fcbb17ab22e33f65b140dc069b2225751af54cf909",
+    "message": null,
+    "code": "unsupportedScalarShape"},
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 1,
+    "nat": 18446744073709551616,
+    "hot_resets": 0,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 1, "live": 0, "frees": 1, "allocs": 1},
+    "control_steps": 6,
+    "cold_resets": 0},
+   "object": null,
+   "name": "scalar-overflow",
+   "last_accepted_stage": "ixir2",
+   "ir1_root": "479379991f825b39ad13654a4541a9bb4ec005b1c6f299bd09aa3eadb9be07a4",
+   "hpt_roots":
+   ["8753bfc46c83e0dd7d183e289f0d49786a1faaa087b6cb6a84044dcf1299cc1d",
+    "79c6c8a7e5863421e045175b362036c8c71740e2438544112f6e2a7d7c2f927c"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 1}},
+  {"source_constants": 4,
+   "snapshot": "direct-call.json",
+   "root_kind": "constant",
+   "root": "7af1bc632982b71b0cf434a1951ecb5e694cb3f4c8570fcc147dc31446891dd1",
+   "rejection":
+   {"stage": "x86-selection",
+    "root": "7af1bc632982b71b0cf434a1951ecb5e694cb3f4c8570fcc147dc31446891dd1",
+    "message": null,
+    "code": "unsupportedScalarShape"},
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 1,
+    "nat": 42,
+    "hot_resets": 0,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 1, "live": 0, "frees": 1, "allocs": 1},
+    "control_steps": 9,
+    "cold_resets": 0},
+   "object": null,
+   "name": "direct-call",
+   "last_accepted_stage": "ixir2",
+   "ir1_root": "fa418d55ddba674c8055a996683121e3532958c63d3b2cfce7f9ce3355c8e26b",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "021ebf02c412c866cb44bb63e2f15198d0471d8a927b167aaf3bc5f7bdbbed8b",
+    "e32ad4290790ebc63674be611e3837d14c1f07dfa15159d7d3fa0d95abbf9949",
+    "ac2a9cdfc7b27d07dfd30b8cdd8914a10dd646093d197256fe9b65dba7fad4de"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 1,
+    "constructorSwitches": 0,
+    "applies": 1}},
+  {"source_constants": 5,
+   "snapshot": "ctor-zero.json",
+   "root_kind": "constant",
+   "root": "c95daf35af17a4226fc831fb8adf09d0fa2b148be828fc59612c969c9c2b8eda",
+   "rejection":
+   {"stage": "x86-selection",
+    "root": "c95daf35af17a4226fc831fb8adf09d0fa2b148be828fc59612c969c9c2b8eda",
+    "message": null,
+    "code": "missingConstructorSchema"},
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 2,
+    "nat": 11,
+    "hot_resets": 0,
+    "heap_work": 4,
+    "heap": {"reuses": 0, "rcops": 3, "live": 0, "frees": 3, "allocs": 3},
+    "control_steps": 14,
+    "cold_resets": 0},
+   "object": null,
+   "name": "ctor-zero",
+   "last_accepted_stage": "ixir2",
+   "ir1_root": "e90569144abfedfd673e51685f07d656342fa5667d225e5b75f77cbd1005761d",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "5aa60798697452ea479579d0e3530a0920cc472db4e35d8707a032f9463467f4",
+    "f0e1ee51fe01c3d408f25ec04c08c36ace33eb0e1f5b48901f03d8852f0d568e",
+    "b769bfedc89d6a25bf9b6b89d759a21b4d59edc13b87ba9f90fcd49fa8169957",
+    "edafb460ef0478deef7e4e49deb86dc3e351728c3ee6a250a98a40a1f1580e70"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 2,
+    "natSwitches": 0,
+    "directCalls": 1,
+    "constructorSwitches": 1,
+    "applies": 2}},
+  {"source_constants": 5,
+   "snapshot": "ctor-succ.json",
+   "root_kind": "constant",
+   "root": "89a90ce06c7c1c064bcc22b3f91f96c35f613eac4ddfedb6286ab7f23f49cbe3",
+   "rejection":
+   {"stage": "x86-selection",
+    "root": "89a90ce06c7c1c064bcc22b3f91f96c35f613eac4ddfedb6286ab7f23f49cbe3",
+    "message": null,
+    "code": "missingConstructorSchema"},
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 2,
+    "nat": 22,
+    "hot_resets": 0,
+    "heap_work": 5,
+    "heap": {"reuses": 0, "rcops": 3, "live": 0, "frees": 3, "allocs": 3},
+    "control_steps": 15,
+    "cold_resets": 0},
+   "object": null,
+   "name": "ctor-succ",
+   "last_accepted_stage": "ixir2",
+   "ir1_root": "225731506e1b9f23f1a28e8552c02e7f64f36c2b132763e5b2bbaabfb6de0f8e",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "5aa60798697452ea479579d0e3530a0920cc472db4e35d8707a032f9463467f4",
+    "f0e1ee51fe01c3d408f25ec04c08c36ace33eb0e1f5b48901f03d8852f0d568e",
+    "ee203957e69fa51b5eb688467a7ab9c30b03096f8e8524c46516d0dc0008dc17",
+    "a5bc350b27ef2d75eea284fbbc4e8c1e1b444264a9868dcdae8dc68d418640f9"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 2,
+    "natSwitches": 0,
+    "directCalls": 1,
+    "constructorSwitches": 1,
+    "applies": 2}},
+  {"source_constants": 5,
+   "snapshot": "nat-zero.json",
+   "root_kind": "constant",
+   "root": "a71f22b953667431b2038c063e0433afbe2177e5c844b63b9b224cf152c06292",
+   "rejection":
+   {"stage": "x86-selection",
+    "root": "a71f22b953667431b2038c063e0433afbe2177e5c844b63b9b224cf152c06292",
+    "message": null,
+    "code": "missingConstructorSchema"},
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 2,
+    "nat": 11,
+    "hot_resets": 0,
+    "heap_work": 4,
+    "heap": {"reuses": 0, "rcops": 2, "live": 0, "frees": 2, "allocs": 2},
+    "control_steps": 13,
+    "cold_resets": 0},
+   "object": null,
+   "name": "nat-zero",
+   "last_accepted_stage": "ixir2",
+   "ir1_root": "4b25d8f622ea931a3a30f189b72bbfda9225e0419721c3bff8a5f8442c25fc1d",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "a474bda81c7f75e723193a35899f29ef6255d0e503b04262c01edf66f29f9121",
+    "132f4c4761383e511219c54050f7f72fb02cf983bb73b1098bb2b9b7daa08ea7",
+    "30d3d268709cc622a8faead24263731ca8d7fee3c305eef1893bd878c1125e86",
+    "5d2e9addb283cce44d2c7bced6fa9a7674bb25638a0a7a8aaa6c778e61ed7335"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 2,
+    "natSwitches": 1,
+    "directCalls": 1,
+    "constructorSwitches": 1,
+    "applies": 2}},
+  {"source_constants": 5,
+   "snapshot": "nat-succ.json",
+   "root_kind": "constant",
+   "root": "c95c2bb1a4ce38e2b45218935439a1e79bc285b6b758596802fc8e1caf796831",
+   "rejection":
+   {"stage": "x86-selection",
+    "root": "c95c2bb1a4ce38e2b45218935439a1e79bc285b6b758596802fc8e1caf796831",
+    "message": null,
+    "code": "missingConstructorSchema"},
+   "origin": "synthetic-ixon",
+   "observation":
+   {"reused_payload_units": 0,
+    "reset_attempts": 0,
+    "peak_live_nodes": 2,
+    "nat": 22,
+    "hot_resets": 0,
+    "heap_work": 4,
+    "heap": {"reuses": 0, "rcops": 2, "live": 0, "frees": 2, "allocs": 2},
+    "control_steps": 13,
+    "cold_resets": 0},
+   "object": null,
+   "name": "nat-succ",
+   "last_accepted_stage": "ixir2",
+   "ir1_root": "06e424b0df885bc66e1c0a7efc8878790f77d6aabd0864abeb86eaebbfb9dc04",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "a474bda81c7f75e723193a35899f29ef6255d0e503b04262c01edf66f29f9121",
+    "132f4c4761383e511219c54050f7f72fb02cf983bb73b1098bb2b9b7daa08ea7",
+    "ee203957e69fa51b5eb688467a7ab9c30b03096f8e8524c46516d0dc0008dc17",
+    "16385dc34fb2a745d8b2197b25f9da3e775014e2fd7c37660d1e8843996e6e1a"],
+   "features":
+   {"tailCalls": 1,
+    "papps": 2,
+    "natSwitches": 1,
+    "directCalls": 1,
+    "constructorSwitches": 1,
+    "applies": 2}},
+  {"source_constants": 1,
+   "snapshot": "bare-literal.json",
+   "root_kind": "constant",
+   "root": "a29b2725659eda05940f81c5042632d471c51e78665b68f0bb58665bc1896a9f",
+   "rejection":
+   {"stage": "usage",
+    "root": "a29b2725659eda05940f81c5042632d471c51e78665b68f0bb58665bc1896a9f",
+    "message": null,
+    "code": "freezeNeeded"},
+   "origin": "synthetic-ixon",
+   "observation": null,
+   "object": null,
+   "name": "bare-literal",
+   "last_accepted_stage": "ixon",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null},
+  {"source_constants": 1,
+   "snapshot": "extern.json",
+   "root_kind": "constant",
+   "root": "2b2d31a29f10197c5d91b12e8b5cf5912bee4e8487b653f8209f9a585eb48708",
+   "rejection":
+   {"stage": "validated-erasure",
+    "root": "2b2d31a29f10197c5d91b12e8b5cf5912bee4e8487b653f8209f9a585eb48708",
+    "message": "validated extern ownership ABI rejects this declaration",
+    "code": "extern-ownership"},
+   "origin": "synthetic-ixon",
+   "observation": null,
+   "object": null,
+   "name": "extern",
+   "last_accepted_stage": "usage",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null},
+  {"source_constants": 54,
+   "snapshot": "std-contact.json",
+   "root_kind": "environment",
+   "root": "1bc7e2215a1967d8c937f48526facdc7006cd4c9b7b6ef4f1063bb55c50dee02",
+   "rejection":
+   {"stage": "usage",
+    "root": "a3b83ad0799bcd3d1c70c01df44141d79e7358e1f23d7d7e5cf9e01dbdc73c85",
+    "message": null,
+    "code": "freezeNeeded"},
+   "origin": "production-ixon",
+   "observation": null,
+   "object": null,
+   "name": "std-contact",
+   "last_accepted_stage": "ixon",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null},
+  {"source_constants": 17,
+   "snapshot": "std-failure-closure.json",
+   "root_kind": "constant",
+   "root": "131533e96baa7f50ba89d01892243e11a1221c8831e2f394eb14f89e9a54c6c4",
+   "rejection":
+   {"stage": "validated-erasure",
+    "root": "131533e96baa7f50ba89d01892243e11a1221c8831e2f394eb14f89e9a54c6c4",
+    "message": "reference lacks a Covered certificate",
+    "code": "missingCovered"},
+   "origin": "production-ixon",
+   "observation": null,
+   "object": null,
+   "name": "std-failure-closure",
+   "last_accepted_stage": "addressed-ixir0",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null},
+  {"source_constants": 6,
+   "snapshot": "upstream-applyClosed.json",
+   "root_kind": "constant",
+   "root": "b81b754f02c1b63279a609ab4b55b609fd6f87fab7b14879f4021c3327c2eb40",
+   "rejection": null,
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "2e4873546afd7558d5c02b244d2713229c02f6f684c298739f0b7431e7b8df02",
+    "members_root": "90eb98fa5464f21acb0ffe27a71bb3f72fc068f98ba5a7fa9ae6bd307e992ac7",
+    "content_root": "2c4dcedd6ac8b9dee3cfbceafe0c08cbd55e568d287fc89256de144d867ac631"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-ixir2; closed-unary-nat-calls/1",
+   "observation":
+   {"reclaimed": {"reuses": 0, "rcops": 7, "live": 0, "frees": 5, "allocs": 5},
+    "peak_live_nodes": 4,
+    "nat": 3,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 3, "live": 4, "frees": 1, "allocs": 5},
+    "control_steps": 13},
+   "object": "upstream-applyClosed.o",
+   "name": "upstream-applyClosed",
+   "last_accepted_stage": "elf",
+   "ir1_root": "b2206f887b930da1debd137efccd3425ca8f7a7b926d7dcce223c2acf3d9e3ec",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "25383b8ee1c3839e788e1a669636e2b2256874b4ebab76d1fe719815f2b72661",
+    "4b0cbe528ec5880e83af94e3cb576411e848139ac8b21bb2ad43ebf3089d5b81",
+    "d5d01500ba05b06f52ca8fe7e17c0a3b613c27d6e5ba51eaf7ac6e026a99ef2d"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 2}},
+  {"source_constants": 6,
+   "snapshot": "upstream-captureClosed.json",
+   "root_kind": "constant",
+   "root": "5628cfe1b4f959fb116661fc50ae8e9e4bfa470ac5d0e639a75b9d23aed12953",
+   "rejection": null,
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "280ab6f15706a3c0ed76511604abd5653a524dba4b5893b193c904db2f66f852",
+    "members_root": "b540312a765a85bea6bfecc321c84a0d3ab9384aff1496707c519a7168505bfa",
+    "content_root": "f45a88c0c41dcc241a4a46ebc98953291f7c81eda7bd11c49978cb65ea82c969"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-ixir2; closed-static-capture-nat-calls/1",
+   "observation":
+   {"reclaimed": {"reuses": 0, "rcops": 11, "live": 0, "frees": 5, "allocs": 5},
+    "peak_live_nodes": 5,
+    "nat": 2,
+    "heap_work": 5,
+    "heap": {"reuses": 0, "rcops": 8, "live": 3, "frees": 2, "allocs": 5},
+    "control_steps": 15},
+   "object": "upstream-captureClosed.o",
+   "name": "upstream-captureClosed",
+   "last_accepted_stage": "elf",
+   "ir1_root": "85e7908d73603431fbf07e4a7b9fe12ab920d8a64f6fc9db9f5416b3741ee1ae",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "25383b8ee1c3839e788e1a669636e2b2256874b4ebab76d1fe719815f2b72661",
+    "29362969dcda1e702e2a82a43364c2c55ca277253cfad9cd96b83244a2519c41",
+    "e9018f5e5055b910e8e3bae5fb279cb949c9049d51f8aafcea414f40206205e1"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 2}},
+  {"source_constants": 6,
+   "snapshot": "upstream-letClosed.json",
+   "root_kind": "constant",
+   "root": "6c737171f1a3c482ba96cbe4998ea660fda824c578fe668ab9fdc4aae1b9754f",
+   "rejection": null,
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "717c04ee467799465d08c0e624f312fe619badbe7394c7fa0637f1b0c975744b",
+    "members_root": "f43b2ddbaa6d90259fdc2253f12a830e673f7438a86fe04a2522ee4acbe880fd",
+    "content_root": "e228726e331eddb217a32c6ced86026a97a26ca7df5070c99b7f970deeef17a1"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-ixir2; closed-unary-nat-calls/1",
+   "observation":
+   {"reclaimed": {"reuses": 0, "rcops": 8, "live": 0, "frees": 6, "allocs": 6},
+    "peak_live_nodes": 5,
+    "nat": 4,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 3, "live": 5, "frees": 1, "allocs": 6},
+    "control_steps": 14},
+   "object": "upstream-letClosed.o",
+   "name": "upstream-letClosed",
+   "last_accepted_stage": "elf",
+   "ir1_root": "35e7976edcdeed9b80c784f73403970b47ce1f38e46bc099fad960c3248d1f6c",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "25383b8ee1c3839e788e1a669636e2b2256874b4ebab76d1fe719815f2b72661",
+    "4b0cbe528ec5880e83af94e3cb576411e848139ac8b21bb2ad43ebf3089d5b81",
+    "2ba4db9286bb1ea83ca95d44c327be1ba88ca579839c4ecd9470616157b46840"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 2}},
+  {"source_constants": 19,
+   "snapshot": "upstream-addClosed.json",
+   "root_kind": "constant",
+   "root": "799b7939dcc3c158620a49e645c9fee367674251e5298594bf8801747e49f990",
+   "rejection":
+   {"stage": "validated-erasure",
+    "root": "1ce12e12485a4793aa5baf4f197f5d5ceb5fb8e166f1a06640b87f9c91dad725",
+    "message": "reference lacks a Covered certificate",
+    "code": "missingCovered"},
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "ce2cc4e16ffbe9166b9be201c524cbc7530705fdc5b8ff7602627aba70f5f4d0",
+    "members_root": "8ee129c37888400dddf6dcfaba965ea35c68dbdd3909863817352697b90ccd32",
+    "content_root": "84b4c400ac444ae12101cc6e49cb1830281d56698de68e095eb42eb4743bb4b9"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-only",
+   "observation": null,
+   "object": null,
+   "name": "upstream-addClosed",
+   "last_accepted_stage": "addressed-ixir0",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null},
+  {"source_constants": 6,
+   "snapshot": "upstream-recClosed.json",
+   "root_kind": "constant",
+   "root": "1248f5d1b9eb3c50a6818d4d6d1e2413a7e9587e0990de2421e997d756da7aa1",
+   "rejection":
+   {"stage": "validated-erasure",
+    "root": "1248f5d1b9eb3c50a6818d4d6d1e2413a7e9587e0990de2421e997d756da7aa1",
+    "message": "reference lacks a Covered certificate",
+    "code": "missingCovered"},
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "4c0c64ad2997001a63b5d6a70475f656cd27eb8dd30ba8c3acb8bd87564b3f49",
+    "members_root": "f56beab09094b676fc076c381847d10fed4cd7ec878965ac0c254de51c05f6b7",
+    "content_root": "8adcf06f26a4adbfd4588669becc3cd5ddf4ec6a5f1d9bfbcb904b1ffd6505ec"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-only",
+   "observation": null,
+   "object": null,
+   "name": "upstream-recClosed",
+   "last_accepted_stage": "addressed-ixir0",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null}],
+ "policy_version": 2,
+ "generated_ir_corpus":
+ {"summary":
+  {"fingerprint": "6965325113816880105",
+   "finalState": "1151165198556225096",
+   "expectedRejections": 100,
+   "differential": 180,
+   "checked": 280,
+   "allKindsSeen": true},
+  "seed": "2611923443488327891",
+  "property": "IxIR0/IxIR1 value agreement and result reclamation, or exact lowering rejection",
+  "origin": "generated-ixir0"},
+ "format": "compilatrix/source-coverage/1"}
diff --git a/Tests/Fixtures/Compiler/source-native-captured-scalar/README.md b/Tests/Fixtures/Compiler/source-native-captured-scalar/README.md
new file mode 100644
index 000000000..88fe7bd99
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-captured-scalar/README.md
@@ -0,0 +1,27 @@
+These nine synthetic Ixon sources export a lambda capturing one exact Word
+Nat. Three bodies project the capture, branch between the capture and the
+argument's predecessor, or compose predecessor/choice helpers. Each is
+compiled separately for captures zero, seven, and the maximum Word through
+the ordinary source compiler and actual physical CFG selector.
+
+`expected.json` pins source and IR roots, selected and emitted function counts,
+text hashes and sizes, finite stack bounds, and the full test inventory.
+The producer emits nine ELF objects, nine full compiler snapshots, and one
+report. The checker compares two complete fresh generations byte for byte.
+
+All 171 boundary cases execute the source and intermediate applications,
+physical bodies, typed native code, and complete ELF bytes. Initialization
+allocates two slots and frees the temporary literal closure. Application
+frees the captured export, leaving two dead slots, two frees and RC operations,
+no reuse, and no live nodes. The independent artifact checker rejects 135
+corruptions, including changed captures, initialization, argument order, and
+reclamation counts.
+
+The C harness uses a unary declaration, checks all three mathematical bodies,
+and varies RSI on the guarded-stack bridge. It makes 1,494 native calls across
+19 boundary and 64 deterministic random inputs per object, on ordinary and
+guarded finite stacks. It checks saved registers, stack restoration, caller
+frames, and reservation canaries.
+
+See [the captured scalar contract](../../docs/source-native-captured-scalar.md)
+for theorem premises, limits, negative cases, and reproduction commands.
diff --git a/Tests/Fixtures/Compiler/source-native-captured-scalar/expected.json b/Tests/Fixtures/Compiler/source-native-captured-scalar/expected.json
new file mode 100644
index 000000000..de22b2a10
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-captured-scalar/expected.json
@@ -0,0 +1,207 @@
+{"wrapper_rejections": 2,
+ "source_evaluations": 171,
+ "runtime_parameters": 1,
+ "policy": "physical-scalar-capture/1",
+ "object_executions": 171,
+ "initializer_rejections":
+ ["non-nullary",
+  "empty-main",
+  "non-closure",
+  "zero-captures",
+  "non-word-capture",
+  "capture-overflow",
+  "extra-live-closure",
+  "shared-rc-two",
+  "missing-target",
+  "unsafe-target",
+  "target-arity",
+  "multiple-captures",
+  "control-limit",
+  "heap-limit",
+  "slot-limit"],
+ "initializer_rejection_runs": 135,
+ "format": "compilatrix/source-native-captured-scalar-report/1",
+ "conversion_rejections": 3,
+ "cases":
+ [{"text_hash": "462ddcda18da621fdf0f225929c555e84a83b47e8f16330f0f77c7f862aedd46",
+   "text_bytes": 201,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "a9217dd04c791c3465b3b19412b664c11d1bf07f8167b8be1657a19129204f2f",
+   "snapshot": "capture-project-zero.json",
+   "selected_functions": 1,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "acdd7ed6dd2ff0f364ea7697b85c32098d843b7ff3daa1f62b4ec2e0dc6d9fc5",
+   "physical_blocks": 1,
+   "object_bytes": 1064,
+   "object": "capture-project-zero.o",
+   "native_blocks": 8,
+   "name": "capture-project-zero",
+   "ir1_root": "c23b31175aec1098ae2e18a7412a567921d03c1ef64f95c3e7ac601b0787e9f5",
+   "functions": 2,
+   "family": "capture-project",
+   "capture": 0,
+   "below_entry_bytes": 536},
+  {"text_hash": "d4aa4ae35fb896a5fd873571f78a7745e972a29b1c75a17a11ed7b4e776e58cf",
+   "text_bytes": 201,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "d950c75fb16921b37e5c72066570a9f3ffbc01f1ef5b02d50f9d8c9f8354d089",
+   "snapshot": "capture-project-seven.json",
+   "selected_functions": 1,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "acdd7ed6dd2ff0f364ea7697b85c32098d843b7ff3daa1f62b4ec2e0dc6d9fc5",
+   "physical_blocks": 1,
+   "object_bytes": 1064,
+   "object": "capture-project-seven.o",
+   "native_blocks": 8,
+   "name": "capture-project-seven",
+   "ir1_root": "9a903638eb0763de81647ac71ca1e016deed8adde8de5630ce8e235b48057eb1",
+   "functions": 2,
+   "family": "capture-project",
+   "capture": 7,
+   "below_entry_bytes": 536},
+  {"text_hash": "9c3291036c11a00860b2eac3298017078435ba74d2da18364f28a6389c7dc9d0",
+   "text_bytes": 201,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "aae275c365f4d79f3d7507425332cde542daafcb9ec6a7fb76e6c14205b18b3d",
+   "snapshot": "capture-project-max.json",
+   "selected_functions": 1,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "acdd7ed6dd2ff0f364ea7697b85c32098d843b7ff3daa1f62b4ec2e0dc6d9fc5",
+   "physical_blocks": 1,
+   "object_bytes": 1064,
+   "object": "capture-project-max.o",
+   "native_blocks": 8,
+   "name": "capture-project-max",
+   "ir1_root": "0e8b455a48e66733394b000763b89581b4dc5f9d0691aa103b9d26ca31e335b5",
+   "functions": 2,
+   "family": "capture-project",
+   "capture": 18446744073709551615,
+   "below_entry_bytes": 536},
+  {"text_hash": "8fc2ecbd9baccc7f944e43643390948f55fa61d781814b73632f199f2cc4e3bc",
+   "text_bytes": 419,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "857c05c7df0c18add554b2b14a28e05b6fe61983df17d0fe933522cd59d00061",
+   "snapshot": "capture-choice-zero.json",
+   "selected_functions": 2,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "9251f81b04fb2a653abc747d3978308fe67eeb27b68bbc4de8fea5dcd77b11e4",
+   "physical_blocks": 4,
+   "object_bytes": 1280,
+   "object": "capture-choice-zero.o",
+   "native_blocks": 18,
+   "name": "capture-choice-zero",
+   "ir1_root": "c94323c359f66635fb866ff1ca06d05f000c6e7712b05f04aa0029c6ea21b2f7",
+   "functions": 3,
+   "family": "capture-choice",
+   "capture": 0,
+   "below_entry_bytes": 808},
+  {"text_hash": "1f4dd4a72f8514806d8f42e90951a619eeb25f39bec17319b21cbf3c8bc48da4",
+   "text_bytes": 419,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "c9cc7e20460d02628029ee7eda09f530901ccff394afb8b5423068dd92a4aed7",
+   "snapshot": "capture-choice-seven.json",
+   "selected_functions": 2,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "9251f81b04fb2a653abc747d3978308fe67eeb27b68bbc4de8fea5dcd77b11e4",
+   "physical_blocks": 4,
+   "object_bytes": 1280,
+   "object": "capture-choice-seven.o",
+   "native_blocks": 18,
+   "name": "capture-choice-seven",
+   "ir1_root": "6f5f1699d4bc5d984ff3464588b59544fb22b4a5df6045dd67b10cd102036a3a",
+   "functions": 3,
+   "family": "capture-choice",
+   "capture": 7,
+   "below_entry_bytes": 808},
+  {"text_hash": "d073df4dd6d662d77eb02cc569e465fbcebea30ae95c008fdb48cf4285980341",
+   "text_bytes": 419,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "85c3eea7564d5ac3496b0b2032c332ee47f6d324ba984f89eb93f3c8973dd229",
+   "snapshot": "capture-choice-max.json",
+   "selected_functions": 2,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "9251f81b04fb2a653abc747d3978308fe67eeb27b68bbc4de8fea5dcd77b11e4",
+   "physical_blocks": 4,
+   "object_bytes": 1280,
+   "object": "capture-choice-max.o",
+   "native_blocks": 18,
+   "name": "capture-choice-max",
+   "ir1_root": "331c38676e71a44cf57d57c74cbdcbab1410286ae10ef6f7e95b4f82161fb5d2",
+   "functions": 3,
+   "family": "capture-choice",
+   "capture": 18446744073709551615,
+   "below_entry_bytes": 808},
+  {"text_hash": "ff877007858c91938e963ad38ccebc0d79fb65bef89f99bd8e9bf1baf3398fac",
+   "text_bytes": 712,
+   "stack_depth": 4,
+   "stack_bytes": 1088,
+   "source_root": "ed69a8c4fcd673a89c1cda1abfa5563bf232b1d9976162e5eb37cd1e20b3d080",
+   "snapshot": "capture-nested-zero.json",
+   "selected_functions": 3,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "26ac0d7ecc5ddac761a7bdf40d3e15bed56c158510839e2645dd93155cdbabe0",
+   "physical_blocks": 7,
+   "object_bytes": 1568,
+   "object": "capture-nested-zero.o",
+   "native_blocks": 32,
+   "name": "capture-nested-zero",
+   "ir1_root": "071f0d8acde7d9f4924f3b643f8e9dd31f837bcefc9ad676853583605cf711e1",
+   "functions": 4,
+   "family": "capture-nested",
+   "capture": 0,
+   "below_entry_bytes": 1080},
+  {"text_hash": "c5bd216071bc24b3ae74ef52cadbe8ca76fe9dec71eb1d3235ef1eda2b0f5228",
+   "text_bytes": 712,
+   "stack_depth": 4,
+   "stack_bytes": 1088,
+   "source_root": "1a8642111c523daa82a920ec21a6c7a223503a935ca1cd6d69af238d3c07c094",
+   "snapshot": "capture-nested-seven.json",
+   "selected_functions": 3,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "26ac0d7ecc5ddac761a7bdf40d3e15bed56c158510839e2645dd93155cdbabe0",
+   "physical_blocks": 7,
+   "object_bytes": 1568,
+   "object": "capture-nested-seven.o",
+   "native_blocks": 32,
+   "name": "capture-nested-seven",
+   "ir1_root": "6e5deb7fea1e0918673cc6716a5a138e8c1777cb65956a4ad541a5a2c5215409",
+   "functions": 4,
+   "family": "capture-nested",
+   "capture": 7,
+   "below_entry_bytes": 1080},
+  {"text_hash": "66505a6f243dff580d31ef28cd1c989628a506fd0f327b2485d28d46f6cc5189",
+   "text_bytes": 712,
+   "stack_depth": 4,
+   "stack_bytes": 1088,
+   "source_root": "2b638ceafd48602d1ecc5ebda2f8dd04f15bf0fd8e8300dfd425957496e9a1b6",
+   "snapshot": "capture-nested-max.json",
+   "selected_functions": 3,
+   "runtime_parameters": 1,
+   "physical_parameters": 2,
+   "physical_entry": "26ac0d7ecc5ddac761a7bdf40d3e15bed56c158510839e2645dd93155cdbabe0",
+   "physical_blocks": 7,
+   "object_bytes": 1568,
+   "object": "capture-nested-max.o",
+   "native_blocks": 32,
+   "name": "capture-nested-max",
+   "ir1_root": "5fa22d0d7d3e9a428c7bb23f0f6141268744296ccf064b4ae2dee902ff130f5c",
+   "functions": 4,
+   "family": "capture-nested",
+   "capture": 18446744073709551615,
+   "below_entry_bytes": 1080}],
+ "capacity_rejections": 18,
+ "application_boundary_checks": 36}
diff --git a/Tests/Fixtures/Compiler/source-native-captured-scalar/native_harness.c b/Tests/Fixtures/Compiler/source-native-captured-scalar/native_harness.c
new file mode 100644
index 000000000..f1b2e8778
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-captured-scalar/native_harness.c
@@ -0,0 +1,97 @@
+#define _GNU_SOURCE
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+#ifndef FAMILY
+#error "FAMILY is required"
+#endif
+#ifndef STACK_DEPTH
+#error "STACK_DEPTH is required"
+#endif
+struct result { uint64_t value, status; };
+#ifndef CAPTURE
+#error "CAPTURE is required"
+#endif
+extern struct result compilatrix_scalar(uint64_t);
+extern struct result scalar_on_stack(void *, uint64_t, uint64_t);
+
+/* The bridge's saved RSP uses RBX, whose preservation is part of the ABI.
+   Six pushes preserve its caller's registers on the original stack. */
+__asm__(
+    ".text\n.globl scalar_on_stack\n.type scalar_on_stack,@function\n"
+    "scalar_on_stack:\n"
+    "push %rbp\npush %rbx\npush %r12\npush %r13\npush %r14\npush %r15\n"
+    "mov %rsp,%rbx\nmov %rdi,%rsp\nmov %rsi,%rdi\nmov %rdx,%rsi\n"
+    "call compilatrix_scalar\nmov %rbx,%rsp\n"
+    "pop %r15\npop %r14\npop %r13\npop %r12\npop %rbx\npop %rbp\nret\n"
+    ".size scalar_on_stack,.-scalar_on_stack\n");
+
+static void need(int condition, const char *message) {
+    if (!condition) { fprintf(stderr, "captured scalar native: %s\n", message); exit(1); }
+}
+static struct result expected(uint64_t a, uint64_t b) {
+    (void)b;
+    switch (FAMILY) {
+    case 0: return (struct result){CAPTURE, 0};
+    case 1: return (struct result){a == 0 ? CAPTURE : a - 1, 0};
+    case 2: return (struct result){a < 3 ? CAPTURE : a - 3, 0};
+    default: abort();
+    }
+}
+__attribute__((noinline)) static void verify(uint64_t a, uint64_t b, void *top) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    volatile uint64_t frame[16];
+    for (size_t i = 0; i < 16; ++i) frame[i] = UINT64_C(0xc13fa9a902a6328f) ^ i;
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp,%0" : "=r"(before));
+    struct result actual = compilatrix_scalar(a);
+    __asm__ volatile("mov %%rsp,%0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    struct result wanted = expected(a, b);
+    need(actual.value == wanted.value && actual.status == wanted.status, "wrong value/status");
+    need(before == after, "stack pointer changed");
+    need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+        r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+        r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5), "saved register changed");
+    for (size_t i = 0; i < 16; ++i) need(frame[i] == (UINT64_C(0xc13fa9a902a6328f) ^ i), "caller frame changed");
+    actual = scalar_on_stack(top, a, b);
+    need(actual.value == wanted.value && actual.status == wanted.status, "guarded-stack result changed");
+}
+int main(void) {
+    size_t page = (size_t)sysconf(_SC_PAGESIZE);
+    need(272 * STACK_DEPTH < page, "guarded reservation is too large");
+    uint8_t *mapping = mmap(NULL, page * 3, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    need(mapping != MAP_FAILED, "stack mapping failed");
+    uint8_t *low = mapping + page;
+    need(mprotect(low, page, PROT_READ | PROT_WRITE) == 0, "stack permissions failed");
+    void *top = low + 272 * STACK_DEPTH;
+    for (size_t i = 272 * STACK_DEPTH; i < page; ++i) low[i] = (uint8_t)(i ^ 0xa7);
+    const uint64_t m = UINT64_MAX;
+    const uint64_t cases[][2] = {
+        {0,0}, {0,1}, {1,0}, {1,1}, {2,3}, {3,2}, {7,7}, {7,19}, {19,7},
+        {0,m}, {m,0}, {m,1}, {1,m}, {m,m}, {m-1,1}, {m-1,2}, {2,m-1}, {m,m-1}, {m-1,m}
+    };
+    for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); ++i) verify(cases[i][0], cases[i][1], top);
+    uint64_t seed = UINT64_C(0xfedcba9876543210);
+    for (size_t i = 0; i < 64; ++i) {
+        seed = seed * UINT64_C(6364136223846793005) + 1;
+        uint64_t a = seed;
+        seed = seed * UINT64_C(6364136223846793005) + 1;
+        verify(a, seed, top);
+    }
+    for (size_t i = 272 * STACK_DEPTH; i < page; ++i)
+        need(low[i] == (uint8_t)(i ^ 0xa7), "guarded stack wrote above its reservation");
+    need(munmap(mapping, page * 3) == 0, "stack unmap failed");
+    printf("{\"calls\":166,\"saved_registers\":true,\"stack\":true,\"caller_frame\":true,\"guarded_stack\":true}\n");
+    return 0;
+}
diff --git a/Tests/Fixtures/Compiler/source-native-physical-scalar/README.md b/Tests/Fixtures/Compiler/source-native-physical-scalar/README.md
new file mode 100644
index 000000000..96c3eb97f
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-physical-scalar/README.md
@@ -0,0 +1,31 @@
+These seven synthetic Ixon sources compile through validated erasure, addressed
+IxIR₁, checked physical IxIR₂, and the general physical scalar CFG selector.
+The sources are in `Compilatrix/X86/PhysicalScalarSources.lean`. Runtime
+operands are literal Nats; the compiler supplies all intermediate graphs.
+
+`expected.json` pins the complete artifact inventory and roots, selected
+function/block counts, text hashes and sizes, finite stack reservations, and
+test inventories. The producer creates fresh ELF objects and full compiler
+snapshots; the checker compares two complete generations byte for byte.
+
+The families return `a`, a zero/successor tag, `a - 1`, a branch choosing `b`
+or `a - 1`, composed predecessor/tag helpers, and composed predecessor/choice
+helpers, plus a unary predecessor export. Subtraction here is truncated Nat
+subtraction. All 19 boundary pairs per family run through Ixon `applyMany`,
+IxIR₀ application, IxIR₁ module initialization and PAP application,
+logical/physical IxIR₂ invocation, typed x86, and the actual ELF byte
+interpreter, including maximum Word inputs. The unary source receives only
+the first argument. Every successful saturated application checks one
+allocation, one free, one RC operation, and an exact single dead heap slot;
+the scalar body preserves that heap. Partial/excess application and incorrect
+physical arities have 42 additional boundary checks. Four separate
+physical CFG cases exercise joins, parallel swaps, reordered blocks, and a
+nullary constant helper across 76 additional inputs.
+
+The C harness independently checks the seven mathematical functions on 19
+boundary and 64 deterministic random pairs, both on the normal stack and on
+a finite stack above a protected page: 1,162 native calls in total. The unary
+export uses a one-argument C declaration. It checks
+saved registers, stack restoration, caller frames, and reservation canaries.
+The selector and object proofs are documented in
+[`docs/source-native-physical-scalar.md`](../../docs/source-native-physical-scalar.md).
diff --git a/Tests/Fixtures/Compiler/source-native-physical-scalar/expected.json b/Tests/Fixtures/Compiler/source-native-physical-scalar/expected.json
new file mode 100644
index 000000000..063058788
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-physical-scalar/expected.json
@@ -0,0 +1,155 @@
+{"source_evaluations": 133,
+ "source_arities": [1, 2],
+ "policy": "physical-scalar-cfg/1",
+ "object_executions": 133,
+ "format": "compilatrix/source-native-physical-scalar-report/2",
+ "export_rejections": 35,
+ "conversion_rejections": 3,
+ "cfg_stream_executions": 76,
+ "cfg_cases":
+ [{"physical_blocks": 4, "name": "diamond", "inputs": 19, "functions": 1},
+  {"physical_blocks": 2, "name": "swap", "inputs": 19, "functions": 1},
+  {"physical_blocks": 5, "name": "permuted", "inputs": 19, "functions": 1},
+  {"physical_blocks": 1, "name": "constant", "inputs": 19, "functions": 2}],
+ "cases":
+ [{"text_hash": "1483085725b9cfa6d425030300d00a213331a97df10c2fbd64cea53ecf9c63eb",
+   "text_bytes": 90,
+   "stack_depth": 1,
+   "stack_bytes": 272,
+   "source_root": "54cfbb4b290e015ba8b5890a67083436c4317e109e930c9aab684ad1debe058a",
+   "snapshot": "project.json",
+   "runtime_parameters": 2,
+   "physical_entry": "acdd7ed6dd2ff0f364ea7697b85c32098d843b7ff3daa1f62b4ec2e0dc6d9fc5",
+   "physical_blocks": 1,
+   "object_bytes": 952,
+   "object": "project.o",
+   "native_blocks": 4,
+   "name": "project",
+   "ir1_root": "a002dd5dd90b88e13c774d3832403f18450da62bdaaa868aaa31dd61b5e096d5",
+   "functions": 1,
+   "below_entry_bytes": 264},
+  {"text_hash": "67c0b64082035ef2e264603df36bdea587dca505a27cb0200f43a4543e7ab9a9",
+   "text_bytes": 310,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "e706309f0d1fd25ce2ce99301bb7ef777165dd1b6852c3cfdb3b78cf6832422a",
+   "snapshot": "tag.json",
+   "runtime_parameters": 2,
+   "physical_entry": "14a6eef84e3ebc6f15f6283b568f3b7ec9a017d651515fa9be461ddc84fc156d",
+   "physical_blocks": 4,
+   "object_bytes": 1168,
+   "object": "tag.o",
+   "native_blocks": 14,
+   "name": "tag",
+   "ir1_root": "e4d9bdf9143b09ac3a49207b0f12545d780c4a1980d6f6b104e5bc4e5d668b14",
+   "functions": 2,
+   "below_entry_bytes": 536},
+  {"text_hash": "3e7c65bb6735c1e2326c572bfbafec94b127242a7c1d9a81d2a1a4f947c4cbc8",
+   "text_bytes": 307,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "567e5aec2dfdba92fa9d09db8a294e96ea3ed6faec8464bab48b76c8004ef658",
+   "snapshot": "pred.json",
+   "runtime_parameters": 2,
+   "physical_entry": "706fd482f1cdfc3433e993afebcb20eaa97c2e56ce875e882037c595d47a0c89",
+   "physical_blocks": 4,
+   "object_bytes": 1168,
+   "object": "pred.o",
+   "native_blocks": 14,
+   "name": "pred",
+   "ir1_root": "63a08ff3a7747e26a057ab51da0f71cbb26ca26805749593e6f703a035f8d54f",
+   "functions": 2,
+   "below_entry_bytes": 536},
+  {"text_hash": "39642ca1809db9c49fab5f2165c2f3b6a3360d6b9d8f8be8f9f0f8eb6817b6c2",
+   "text_bytes": 308,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "cf049184250faa954d1248e1b424a5280725e6938051968497cd3722ba3f1ac2",
+   "snapshot": "choose.json",
+   "runtime_parameters": 2,
+   "physical_entry": "d07870dbc333ce712d78db24cf54229c3a3ac3dc8eca8b2668d42f7c37b31c6f",
+   "physical_blocks": 4,
+   "object_bytes": 1168,
+   "object": "choose.o",
+   "native_blocks": 14,
+   "name": "choose",
+   "ir1_root": "c88f65233e8c3ddd29c07aaed4c779b9fbec4a36fcf860700d772d34138f8940",
+   "functions": 2,
+   "below_entry_bytes": 536},
+  {"text_hash": "0cf5b941205227059bb11f4b53d8d7adc9433b4dad2a53a73c83f2e1587b2875",
+   "text_bytes": 551,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "4dd888b803a45e34e06a8bc342b83959fbb66c1867117c9306ff5c88855a4bfb",
+   "snapshot": "helpers.json",
+   "runtime_parameters": 2,
+   "physical_entry": "f1b189ce49de03b6e8e65bcff821b3fbbefc96a4db8587f0d8df0d735982d16c",
+   "physical_blocks": 7,
+   "object_bytes": 1408,
+   "object": "helpers.o",
+   "native_blocks": 26,
+   "name": "helpers",
+   "ir1_root": "bd09eaa85ea0e18abf38e65eed9e2020b177bfcd81b6474e754bbde532df8243",
+   "functions": 3,
+   "below_entry_bytes": 808},
+  {"text_hash": "0ad45fb5a4ed94a182639deed92578a4341af338e8690d02a2aa4ac53b6f595c",
+   "text_bytes": 601,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "1cf27d5a1c6080dd730d6be22b8ad7b0c8c1b255f7f47b840050950dcd18a839",
+   "snapshot": "nested.json",
+   "runtime_parameters": 2,
+   "physical_entry": "0ef8611ca9fcbfe252710ec19f30525b351da040d9fc6a152e39b186dbf8eb08",
+   "physical_blocks": 7,
+   "object_bytes": 1464,
+   "object": "nested.o",
+   "native_blocks": 28,
+   "name": "nested",
+   "ir1_root": "9ac1c6a558bb3b6ac42642f3b9b1bd0b296ea26605544e2a3b39ee11d4b3c83f",
+   "functions": 3,
+   "below_entry_bytes": 808},
+  {"text_hash": "d1bfb219f1fcee84b0c5df85793be45e7ba69c90914c319ef5d12efb9a7a8011",
+   "text_bytes": 300,
+   "stack_depth": 2,
+   "stack_bytes": 544,
+   "source_root": "06170d815a1a002e09d7b6b97e2c29f56b275069e6a573972147f12a921d5d88",
+   "snapshot": "unary-pred.json",
+   "runtime_parameters": 1,
+   "physical_entry": "4bac9427d996b17af28ee691bbdd0136c1f0cd3b4c94a15ebf04606867c8b6bd",
+   "physical_blocks": 4,
+   "object_bytes": 1160,
+   "object": "unary-pred.o",
+   "native_blocks": 14,
+   "name": "unary-pred",
+   "ir1_root": "f1d39262809164311c6de166caf40ca7456554fdc27885eabded6ce58a0cadb6",
+   "functions": 2,
+   "below_entry_bytes": 536}],
+ "capacity_rejections": 13,
+ "application_boundary_checks": 42,
+ "admission_rejections":
+ ["unknown-register",
+  "erased-result",
+  "literal-overflow",
+  "unknown-block",
+  "edge-arity",
+  "edge-credit",
+  "target-credit",
+  "missing-peel",
+  "constructor-switch",
+  "allocation",
+  "fetch",
+  "extern",
+  "apply",
+  "pap",
+  "self-call",
+  "self-tail-call",
+  "recursive-call",
+  "missing-callee",
+  "extern-callee",
+  "call-arity",
+  "parameters",
+  "no-blocks",
+  "cycle",
+  "local-capacity",
+  "expansion-budget",
+  "instruction-budget"]}
diff --git a/Tests/Fixtures/Compiler/source-native-physical-scalar/native_harness.c b/Tests/Fixtures/Compiler/source-native-physical-scalar/native_harness.c
new file mode 100644
index 000000000..603db4346
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-physical-scalar/native_harness.c
@@ -0,0 +1,105 @@
+#define _GNU_SOURCE
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+#ifndef FAMILY
+#error "FAMILY is required"
+#endif
+#ifndef STACK_DEPTH
+#error "STACK_DEPTH is required"
+#endif
+struct result { uint64_t value, status; };
+#if FAMILY == 6
+extern struct result compilatrix_scalar(uint64_t);
+#else
+extern struct result compilatrix_scalar(uint64_t, uint64_t);
+#endif
+extern struct result scalar_on_stack(void *, uint64_t, uint64_t);
+
+/* The bridge's saved RSP uses RBX, whose preservation is part of the ABI.
+   Six pushes preserve its caller's registers on the original stack. */
+__asm__(
+    ".text\n.globl scalar_on_stack\n.type scalar_on_stack,@function\n"
+    "scalar_on_stack:\n"
+    "push %rbp\npush %rbx\npush %r12\npush %r13\npush %r14\npush %r15\n"
+    "mov %rsp,%rbx\nmov %rdi,%rsp\nmov %rsi,%rdi\nmov %rdx,%rsi\n"
+    "call compilatrix_scalar\nmov %rbx,%rsp\n"
+    "pop %r15\npop %r14\npop %r13\npop %r12\npop %rbx\npop %rbp\nret\n"
+    ".size scalar_on_stack,.-scalar_on_stack\n");
+
+static void need(int condition, const char *message) {
+    if (!condition) { fprintf(stderr, "scalar native: %s\n", message); exit(1); }
+}
+static struct result expected(uint64_t a, uint64_t b) {
+    switch (FAMILY) {
+    case 0: return (struct result){a, 0};
+    case 1: return (struct result){a == 0 ? 11 : 22, 0};
+    case 2:
+    case 6: return (struct result){a == 0 ? 0 : a - 1, 0};
+    case 3: return (struct result){a == 0 ? b : a - 1, 0};
+    case 4: return (struct result){a < 2 ? 11 : 22, 0};
+    case 5: return (struct result){a < 3 ? b : a - 3, 0};
+    default: abort();
+    }
+}
+__attribute__((noinline)) static void verify(uint64_t a, uint64_t b, void *top) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    volatile uint64_t frame[16];
+    for (size_t i = 0; i < 16; ++i) frame[i] = UINT64_C(0xc13fa9a902a6328f) ^ i;
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp,%0" : "=r"(before));
+#if FAMILY == 6
+    struct result actual = compilatrix_scalar(a);
+#else
+    struct result actual = compilatrix_scalar(a, b);
+#endif
+    __asm__ volatile("mov %%rsp,%0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    struct result wanted = expected(a, b);
+    need(actual.value == wanted.value && actual.status == wanted.status, "wrong value/status");
+    need(before == after, "stack pointer changed");
+    need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+        r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+        r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5), "saved register changed");
+    for (size_t i = 0; i < 16; ++i) need(frame[i] == (UINT64_C(0xc13fa9a902a6328f) ^ i), "caller frame changed");
+    actual = scalar_on_stack(top, a, b);
+    need(actual.value == wanted.value && actual.status == wanted.status, "guarded-stack result changed");
+}
+int main(void) {
+    size_t page = (size_t)sysconf(_SC_PAGESIZE);
+    need(272 * STACK_DEPTH < page, "guarded reservation is too large");
+    uint8_t *mapping = mmap(NULL, page * 3, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    need(mapping != MAP_FAILED, "stack mapping failed");
+    uint8_t *low = mapping + page;
+    need(mprotect(low, page, PROT_READ | PROT_WRITE) == 0, "stack permissions failed");
+    void *top = low + 272 * STACK_DEPTH;
+    for (size_t i = 272 * STACK_DEPTH; i < page; ++i) low[i] = (uint8_t)(i ^ 0xa7);
+    const uint64_t m = UINT64_MAX;
+    const uint64_t cases[][2] = {
+        {0,0}, {0,1}, {1,0}, {1,1}, {2,3}, {3,2}, {7,7}, {7,19}, {19,7},
+        {0,m}, {m,0}, {m,1}, {1,m}, {m,m}, {m-1,1}, {m-1,2}, {2,m-1}, {m,m-1}, {m-1,m}
+    };
+    for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); ++i) verify(cases[i][0], cases[i][1], top);
+    uint64_t seed = UINT64_C(0xfedcba9876543210);
+    for (size_t i = 0; i < 64; ++i) {
+        seed = seed * UINT64_C(6364136223846793005) + 1;
+        uint64_t a = seed;
+        seed = seed * UINT64_C(6364136223846793005) + 1;
+        verify(a, seed, top);
+    }
+    for (size_t i = 272 * STACK_DEPTH; i < page; ++i)
+        need(low[i] == (uint8_t)(i ^ 0xa7), "guarded stack wrote above its reservation");
+    need(munmap(mapping, page * 3) == 0, "stack unmap failed");
+    printf("{\"calls\":166,\"saved_registers\":true,\"stack\":true,\"caller_frame\":true,\"guarded_stack\":true}\n");
+    return 0;
+}
diff --git a/Tests/Fixtures/Compiler/source-native-runtime/README.md b/Tests/Fixtures/Compiler/source-native-runtime/README.md
new file mode 100644
index 000000000..51110e6fc
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-runtime/README.md
@@ -0,0 +1,24 @@
+# Runtime native reversal gate
+
+`source-native-runtime` compiles one parameterized Ixon function and emits one
+reversal/release ELF pair. Eight runtime inputs use that same pair. The reviewed
+`expected.json` pins the source, canonical graph, complete pipeline snapshot,
+object/policy identities, values, step counts, and rejection inventory.
+`--counter-fold` emits the checked adjacent reserve/reuse counter rewrite;
+`expected-counter-fold.json` separately pins its policy, objects and shorter
+trace. The baseline fixture stays byte-identical. Both variants retain the
+same source, graph, full results, counters and malformed-call behavior.
+
+The independent checker generates `runtime_cases.h` from the reviewed input
+table and links `native_harness.c` with the pair once. One process runs every
+case, fully releases each result, and checks 203 malformed calls without arena
+writes. No per-input object is generated or linked.
+The checker accepts `--variant baseline|counter-fold`, defaults to baseline,
+and applies twenty artifact/observation corruption regressions to either.
+`--artifacts DIR` additionally requires every supplied artifact to match the
+fresh checked files byte for byte; the paired benchmark uses this to bind
+its linked objects to the independent gate.
+
+Run the [documented gate](../../docs/source-native-runtime.md#artifact-identity-and-gate)
+before reviewing a report or integrity-pin update. The existing ISA, encoder,
+and ELF/linker assumptions remain active.
diff --git a/Tests/Fixtures/Compiler/source-native-runtime/expected-counter-fold.json b/Tests/Fixtures/Compiler/source-native-runtime/expected-counter-fold.json
new file mode 100644
index 000000000..27b7ed73c
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-runtime/expected-counter-fold.json
@@ -0,0 +1,414 @@
+{"source_identity": "98a3fce164301466d4a5bbc36d847a2515d45b1c97b788b38af411a6d2b17815",
+ "release_policy": "ebe239d9851e8c35879b1f4ce54d3f7e00f875778bda910e91ef74f67e24bda4",
+ "release_identity": "ee24dd7813f34e83cc165e2517e1d96a7c21f243d9c0fdf2301b11d63822263d",
+ "pipeline_identity": "3403e174fec71c7e6bec2c5f7db8146a417987e209c39f98a30adc60f710c715",
+ "pipeline": "pipeline.json",
+ "main_policy": "707db421805ea154d0dd81604d018967d4818fbc2741d6c5474bb9c82c945fb2",
+ "main_identity": "9dea01db8ac532714e6ccf4eea73c58d65d0e158dea4aee5876bff3590e79af0",
+ "ixir1_root": "6f0a0fc8cd38011ce68c710019fe0f6dc53ebaf691508cf2c4ce67345865b1df",
+ "format": "compilatrix/source-native-runtime-report/1",
+ "cases":
+ [{"value": [],
+   "snapshot": "empty.json",
+   "release_steps": 16,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding"],
+   "prefixes": 22,
+   "name": "empty",
+   "main_steps": 82,
+   "input": []},
+  {"value": [0],
+   "snapshot": "zero.json",
+   "release_steps": 33,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 29,
+   "name": "zero",
+   "main_steps": 112,
+   "input": [0]},
+  {"value": [17],
+   "snapshot": "singleton.json",
+   "release_steps": 33,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 29,
+   "name": "singleton",
+   "main_steps": 112,
+   "input": [17]},
+  {"value": [3, 2, 1],
+   "snapshot": "three.json",
+   "release_steps": 67,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 43,
+   "name": "three",
+   "main_steps": 172,
+   "input": [1, 2, 3]},
+  {"value": [42, 18446744073709551608, 0, 3, 3, 18446744073709551615, 0],
+   "snapshot": "mixed-words.json",
+   "release_steps": 135,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 71,
+   "name": "mixed-words",
+   "main_steps": 292,
+   "input": [0, 18446744073709551615, 3, 3, 0, 18446744073709551608, 42]},
+  {"value": [18446744073709551615],
+   "snapshot": "word-max.json",
+   "release_steps": 33,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 29,
+   "name": "word-max",
+   "main_steps": 112,
+   "input": [18446744073709551615]},
+  {"value": [9, 9, 9, 9, 9],
+   "snapshot": "repeated.json",
+   "release_steps": 101,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 57,
+   "name": "repeated",
+   "main_steps": 232,
+   "input": [9, 9, 9, 9, 9]},
+  {"value":
+   [63,
+    62,
+    61,
+    60,
+    59,
+    58,
+    57,
+    56,
+    55,
+    54,
+    53,
+    52,
+    51,
+    50,
+    49,
+    48,
+    47,
+    46,
+    45,
+    44,
+    43,
+    42,
+    41,
+    40,
+    39,
+    38,
+    37,
+    36,
+    35,
+    34,
+    33,
+    32,
+    31,
+    30,
+    29,
+    28,
+    27,
+    26,
+    25,
+    24,
+    23,
+    22,
+    21,
+    20,
+    19,
+    18,
+    17,
+    16,
+    15,
+    14,
+    13,
+    12,
+    11,
+    10,
+    9,
+    8,
+    7,
+    6,
+    5,
+    4,
+    3,
+    2,
+    1,
+    0],
+   "snapshot": "sixty-four.json",
+   "release_steps": 1104,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 470,
+   "name": "sixty-four",
+   "main_steps": 2002,
+   "input":
+   [0,
+    1,
+    2,
+    3,
+    4,
+    5,
+    6,
+    7,
+    8,
+    9,
+    10,
+    11,
+    12,
+    13,
+    14,
+    15,
+    16,
+    17,
+    18,
+    19,
+    20,
+    21,
+    22,
+    23,
+    24,
+    25,
+    26,
+    27,
+    28,
+    29,
+    30,
+    31,
+    32,
+    33,
+    34,
+    35,
+    36,
+    37,
+    38,
+    39,
+    40,
+    41,
+    42,
+    43,
+    44,
+    45,
+    46,
+    47,
+    48,
+    49,
+    50,
+    51,
+    52,
+    53,
+    54,
+    55,
+    56,
+    57,
+    58,
+    59,
+    60,
+    61,
+    62,
+    63]}],
+ "adapter_and_selection_rejections":
+ [{"reason": "runtime Nat does not fit an exact 64-bit Word", "name": "word-overflow"},
+  {"reason": "runtime Nat does not fit an exact 64-bit Word", "name": "word-overflow-mixed"},
+  {"reason": "runtime input exceeds 64 cons cells", "name": "length-sixty-five"},
+  {"reason": "disabled", "name": "disabled"},
+  {"reason": "rewrite budget", "name": "rewrite-budget"},
+  {"reason":
+   "runtime consuming target rejected: Ix.Compiler.IxIR2.Validate.Error.limit\n  { owner := Ix.Compiler.IxIR2.Validate.Owner.main, block := 0, instruction := none }\n  (Ix.Compiler.IxIR2.Validate.Resource.declarations)\n  2\n  0",
+   "name": "target-limit-zero"}]}
diff --git a/Tests/Fixtures/Compiler/source-native-runtime/expected.json b/Tests/Fixtures/Compiler/source-native-runtime/expected.json
new file mode 100644
index 000000000..8690d53c6
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-runtime/expected.json
@@ -0,0 +1,414 @@
+{"source_identity": "98a3fce164301466d4a5bbc36d847a2515d45b1c97b788b38af411a6d2b17815",
+ "release_policy": "79669d34a44f709747cbc3f00b147f7a7794b4488941f4d05bc975c4646fe907",
+ "release_identity": "ee24dd7813f34e83cc165e2517e1d96a7c21f243d9c0fdf2301b11d63822263d",
+ "pipeline_identity": "bf9fc4c3d067dde6f3e3513f64910f68add1cb1862c86da616612e503af3b427",
+ "pipeline": "pipeline.json",
+ "main_policy": "23f72a4c6c01926156067b5ccc1a29b0c466b0d5990becf8ddf94bb9f429be15",
+ "main_identity": "2e2e92297dc85259600f807045e2442e3e890812fdaa5af2f85a8f250bb80a9e",
+ "ixir1_root": "6f0a0fc8cd38011ce68c710019fe0f6dc53ebaf691508cf2c4ce67345865b1df",
+ "format": "compilatrix/source-native-runtime-report/1",
+ "cases":
+ [{"value": [],
+   "snapshot": "empty.json",
+   "release_steps": 16,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding"],
+   "prefixes": 22,
+   "name": "empty",
+   "main_steps": 82,
+   "input": []},
+  {"value": [0],
+   "snapshot": "zero.json",
+   "release_steps": 33,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 30,
+   "name": "zero",
+   "main_steps": 124,
+   "input": [0]},
+  {"value": [17],
+   "snapshot": "singleton.json",
+   "release_steps": 33,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 30,
+   "name": "singleton",
+   "main_steps": 124,
+   "input": [17]},
+  {"value": [3, 2, 1],
+   "snapshot": "three.json",
+   "release_steps": 67,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 46,
+   "name": "three",
+   "main_steps": 208,
+   "input": [1, 2, 3]},
+  {"value": [42, 18446744073709551608, 0, 3, 3, 18446744073709551615, 0],
+   "snapshot": "mixed-words.json",
+   "release_steps": 135,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 78,
+   "name": "mixed-words",
+   "main_steps": 376,
+   "input": [0, 18446744073709551615, 3, 3, 0, 18446744073709551608, 42]},
+  {"value": [18446744073709551615],
+   "snapshot": "word-max.json",
+   "release_steps": 33,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 30,
+   "name": "word-max",
+   "main_steps": 124,
+   "input": [18446744073709551615]},
+  {"value": [9, 9, 9, 9, 9],
+   "snapshot": "repeated.json",
+   "release_steps": 101,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 62,
+   "name": "repeated",
+   "main_steps": 292,
+   "input": [9, 9, 9, 9, 9]},
+  {"value":
+   [63,
+    62,
+    61,
+    60,
+    59,
+    58,
+    57,
+    56,
+    55,
+    54,
+    53,
+    52,
+    51,
+    50,
+    49,
+    48,
+    47,
+    46,
+    45,
+    44,
+    43,
+    42,
+    41,
+    40,
+    39,
+    38,
+    37,
+    36,
+    35,
+    34,
+    33,
+    32,
+    31,
+    30,
+    29,
+    28,
+    27,
+    26,
+    25,
+    24,
+    23,
+    22,
+    21,
+    20,
+    19,
+    18,
+    17,
+    16,
+    15,
+    14,
+    13,
+    12,
+    11,
+    10,
+    9,
+    8,
+    7,
+    6,
+    5,
+    4,
+    3,
+    2,
+    1,
+    0],
+   "snapshot": "sixty-four.json",
+   "release_steps": 1104,
+   "rejections":
+   ["length-sixty-five",
+    "length-word-max",
+    "null-descriptor",
+    "misaligned-descriptor",
+    "wrong-cursor",
+    "insufficient-capacity",
+    "zero-capacity",
+    "excess-capacity",
+    "misaligned-capacity",
+    "wrong-allocs",
+    "wrong-frees",
+    "wrong-reuses",
+    "wrong-live",
+    "wrong-peak",
+    "wrong-rcops",
+    "wrong-payload",
+    "wrong-reservations",
+    "nil-tag",
+    "nil-head",
+    "nil-tail",
+    "nil-padding",
+    "cons-tag",
+    "cons-self-tail",
+    "cons-null-tail",
+    "cons-outside-tail",
+    "cons-padding"],
+   "prefixes": 534,
+   "name": "sixty-four",
+   "main_steps": 2770,
+   "input":
+   [0,
+    1,
+    2,
+    3,
+    4,
+    5,
+    6,
+    7,
+    8,
+    9,
+    10,
+    11,
+    12,
+    13,
+    14,
+    15,
+    16,
+    17,
+    18,
+    19,
+    20,
+    21,
+    22,
+    23,
+    24,
+    25,
+    26,
+    27,
+    28,
+    29,
+    30,
+    31,
+    32,
+    33,
+    34,
+    35,
+    36,
+    37,
+    38,
+    39,
+    40,
+    41,
+    42,
+    43,
+    44,
+    45,
+    46,
+    47,
+    48,
+    49,
+    50,
+    51,
+    52,
+    53,
+    54,
+    55,
+    56,
+    57,
+    58,
+    59,
+    60,
+    61,
+    62,
+    63]}],
+ "adapter_and_selection_rejections":
+ [{"reason": "runtime Nat does not fit an exact 64-bit Word", "name": "word-overflow"},
+  {"reason": "runtime Nat does not fit an exact 64-bit Word", "name": "word-overflow-mixed"},
+  {"reason": "runtime input exceeds 64 cons cells", "name": "length-sixty-five"},
+  {"reason": "disabled", "name": "disabled"},
+  {"reason": "rewrite budget", "name": "rewrite-budget"},
+  {"reason":
+   "runtime consuming target rejected: Ix.Compiler.IxIR2.Validate.Error.limit\n  { owner := Ix.Compiler.IxIR2.Validate.Owner.main, block := 0, instruction := none }\n  (Ix.Compiler.IxIR2.Validate.Resource.declarations)\n  2\n  0",
+   "name": "target-limit-zero"}]}
diff --git a/Tests/Fixtures/Compiler/source-native-runtime/native_harness.c b/Tests/Fixtures/Compiler/source-native-runtime/native_harness.c
new file mode 100644
index 000000000..6216192fc
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-runtime/native_harness.c
@@ -0,0 +1,205 @@
+#include <errno.h>
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+enum { MAX_LENGTH = 64, HEADER_WORDS = 10, CELL_WORDS = 4 };
+enum { CURSOR, CAPACITY, ALLOCS, FREES, REUSES, LIVE, PEAK, RCOPS, PAYLOAD, RESERVATIONS };
+
+typedef struct {
+    uint64_t header[HEADER_WORDS];
+    uint64_t cells[][CELL_WORDS];
+} Arena;
+
+extern uint64_t compilatrix_runtime_reverse(Arena *, uint64_t);
+extern uint64_t compilatrix_runtime_drop(Arena *, uint64_t);
+
+static void need(int condition, const char *message) {
+    if (!condition) {
+        fprintf(stderr, "native runtime harness: %s\n", message);
+        exit(1);
+    }
+}
+
+/* Volatile register operands force the checks to observe the physical saved
+   registers on each side of the call. The fixture is built with frame-pointer
+   omission so rbp is available along with all other System V saved registers. */
+__attribute__((noinline))
+static uint64_t checked_call(uint64_t (*entry)(Arena *, uint64_t), Arena *arena, uint64_t root) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp, %0" : "=r"(before));
+    uint64_t result = entry(arena, root);
+    __asm__ volatile("mov %%rsp, %0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    need(before == after, "stack pointer changed");
+    need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+         r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+         r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5),
+         "callee-saved register changed");
+    return result;
+}
+
+static const uint64_t canary = UINT64_C(0xfedcba9876543210);
+
+static void canaries(const uint64_t *storage, size_t words) {
+    need(storage[0] == canary && storage[1] == ~canary &&
+         storage[words + 2] == canary && storage[words + 3] == ~canary,
+         "write escaped the arena");
+}
+
+static size_t index_of(const Arena *arena, size_t capacity, uint64_t pointer) {
+    uintptr_t base = (uintptr_t)&arena->cells[0];
+    need(pointer >= base && pointer < base + capacity * sizeof arena->cells[0], "pointer escaped arena");
+    need((pointer - base) % sizeof arena->cells[0] == 0, "misaligned cell pointer");
+    return (size_t)((pointer - base) / sizeof arena->cells[0]);
+}
+
+static void headers(const Arena *arena, size_t length, int reclaimed) {
+    const uint64_t expected[HEADER_WORDS] = {
+        32 * (length + 2), 32 * (length + 2), length + 2,
+        reclaimed ? length + 2 : 1, length, reclaimed ? 0 : length + 1,
+        length + 2, 0, 2 * length, 0
+    };
+    need(memcmp(arena->header, expected, sizeof expected) == 0, "heap counters disagree");
+}
+
+static void print_heap(const Arena *arena, size_t capacity) {
+    printf("{\"header\":[");
+    for (size_t field = 0; field < HEADER_WORDS; ++field)
+        printf("%s%" PRIu64, field ? "," : "", arena->header[field]);
+    printf("],\"cells\":[");
+    for (size_t index = 0; index < capacity; ++index) {
+        const uint64_t *cell = arena->cells[index];
+        printf("%s[%" PRIu64 ",%" PRIu64 ",", index ? "," : "", cell[0], cell[1]);
+        if (cell[2] == 0) printf("null");
+        else printf("%zu", index_of(arena, capacity, cell[2]));
+        printf(",%" PRIu64 "]", cell[3]);
+    }
+    printf("]}");
+}
+
+typedef struct { const char *name; size_t length; uint64_t values[MAX_LENGTH]; } Input;
+/* The checker generates this table from the independently reviewed report. */
+#include "runtime_cases.h"
+
+static void prepare(Arena *arena, size_t length, const uint64_t *values) {
+    memset(arena, 0, (HEADER_WORDS + CELL_WORDS * (length + 2)) * sizeof(uint64_t));
+    arena->header[CURSOR] = 32 * (length + 1);
+    arena->header[CAPACITY] = 32 * (length + 2);
+    arena->header[ALLOCS] = arena->header[LIVE] = arena->header[PEAK] = length + 1;
+    for (size_t index = 1; index <= length; ++index) {
+        arena->cells[index][0] = 1;
+        arena->cells[index][1] = values[length - index];
+        arena->cells[index][2] = (uintptr_t)arena->cells[index - 1];
+    }
+}
+
+static void run_case(const Input *input) {
+    size_t length = input->length, capacity = length + 2;
+    size_t words = HEADER_WORDS + CELL_WORDS * capacity;
+    uint64_t *storage = calloc(words + 4, sizeof *storage);
+    need(storage != NULL, "allocation failed");
+    storage[0] = storage[words + 2] = canary;
+    storage[1] = storage[words + 3] = ~canary;
+    Arena *arena = (Arena *)(storage + 2);
+    prepare(arena, length, input->values);
+    printf("{\"name\":\"%s\",\"input\":", input->name);
+    print_heap(arena, capacity);
+    uint64_t root = checked_call(compilatrix_runtime_reverse, arena, length);
+    need(root != 0 && index_of(arena, capacity, root) == 1, "wrong result root");
+    headers(arena, length, 0);
+    canaries(storage, words);
+    unsigned char visited[MAX_LENGTH + 2] = {0};
+    uint64_t pointer = root, values[MAX_LENGTH] = {0};
+    for (size_t offset = 0; offset <= length; ++offset) {
+        size_t index = index_of(arena, capacity, pointer);
+        need(!visited[index], "cyclic or aliased list");
+        visited[index] = 1;
+        const uint64_t *cell = arena->cells[index];
+        need(cell[3] == 0, "nonzero cell padding");
+        if (offset < length) {
+            need(cell[0] == 1 && cell[1] == input->values[length - offset - 1], "wrong reversed payload");
+            values[offset] = cell[1];
+            pointer = cell[2];
+        } else need(cell[0] == 0 && cell[1] == 0 && cell[2] == 0, "invalid nil");
+    }
+    for (size_t index = 0; index < capacity; ++index) {
+        if (visited[index]) continue;
+        need(index == 0 && arena->cells[index][0] == 3 && arena->cells[index][1] == 0 &&
+             arena->cells[index][2] == 0 && arena->cells[index][3] == 0, "unowned live allocation");
+    }
+    printf(",\"root\":1,\"value\":[");
+    for (size_t index = 0; index < length; ++index) printf("%s%" PRIu64, index ? "," : "", values[index]);
+    printf("],\"returned\":");
+    print_heap(arena, capacity);
+    need(checked_call(compilatrix_runtime_drop, arena, root) == 0, "release returned nonzero");
+    headers(arena, length, 1);
+    canaries(storage, words);
+    for (size_t index = 0; index < capacity; ++index)
+        need(arena->cells[index][0] == 3 && arena->cells[index][1] == 0 &&
+             arena->cells[index][2] == 0 && arena->cells[index][3] == 0, "incomplete reclamation");
+    printf(",\"reclaimed\":");
+    print_heap(arena, capacity);
+    const char *rejections[] = {
+        "length-sixty-five", "length-word-max", "null-descriptor", "misaligned-descriptor", "wrong-cursor",
+        "insufficient-capacity", "zero-capacity", "excess-capacity", "misaligned-capacity",
+        "wrong-allocs", "wrong-frees", "wrong-reuses", "wrong-live", "wrong-peak", "wrong-rcops",
+        "wrong-payload", "wrong-reservations", "nil-tag", "nil-head", "nil-tail", "nil-padding",
+        "cons-tag", "cons-self-tail", "cons-null-tail", "cons-outside-tail", "cons-padding"
+    };
+    unsigned char *original = malloc(words * sizeof *storage);
+    need(original != NULL, "snapshot allocation failed");
+    printf(",\"rejections\":[");
+    size_t rejected = length == 0 ? 21 : 26;
+    for (size_t test = 0; test < rejected; ++test) {
+        prepare(arena, length, input->values);
+        Arena *descriptor = arena;
+        uint64_t count = length;
+        switch (test) {
+        case 0: count = 65; break;
+        case 1: count = UINT64_MAX; break;
+        case 2: descriptor = NULL; break;
+        case 3: descriptor = (Arena *)((unsigned char *)arena + 1); break;
+        case 4: arena->header[CURSOR] = 1; break;
+        case 5: arena->header[CAPACITY] = 32 * (length + 1); break;
+        case 6: arena->header[CAPACITY] = 0; break;
+        case 7: arena->header[CAPACITY] = 2144; break;
+        case 8: arena->header[CAPACITY] = 32 * (length + 2) + 1; break;
+        case 21: arena->cells[length][0] = 0; break;
+        case 22: arena->cells[length][2] = (uintptr_t)arena->cells[length]; break;
+        case 23: arena->cells[length][2] = 0; break;
+        case 24: arena->cells[length][2] = UINT64_MAX; break;
+        case 25: arena->cells[length][3] = 1; break;
+        default:
+            if (test < 17) arena->header[test - 7] += 1;
+            else arena->cells[0][test - 17] = 1;
+        }
+        memcpy(original, arena, words * sizeof *storage);
+        need(checked_call(compilatrix_runtime_reverse, descriptor, count) == 0, "malformed input accepted");
+        need(memcmp(original, arena, words * sizeof *storage) == 0, "rejection wrote memory");
+        canaries(storage, words);
+        printf("%s\"%s\"", test ? "," : "", rejections[test]);
+    }
+    printf("]}");
+    free(original);
+    free(storage);
+}
+
+int main(void) {
+    printf("[");
+    for (size_t index = 0; index < sizeof inputs / sizeof inputs[0]; ++index) {
+        if (index) printf(",");
+        run_case(&inputs[index]);
+    }
+    printf("]\n");
+    return 0;
+}
diff --git a/Tests/Fixtures/Compiler/source-native-scalar/README.md b/Tests/Fixtures/Compiler/source-native-scalar/README.md
new file mode 100644
index 000000000..fcf256e8e
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-scalar/README.md
@@ -0,0 +1,12 @@
+# Scalar native regression fixtures
+
+`expected.json` pins the five synthetic functions, source and IxIR₁ roots,
+complete native text digests, code sizes, and sufficient stack bounds.
+The producer compiles each function once and supplies inputs later. The C
+harness independently computes expected results with 128-bit arithmetic and
+exercises ordinary and guarded stacks.
+
+See [the fragment, ABI, proofs, and gate](../../docs/source-native-scalar.md).
+Refresh the reviewed report only after inspecting identities, complete text,
+arithmetic/fallback observations, and stack changes. The independent checker
+never refreshes it automatically.
diff --git a/Tests/Fixtures/Compiler/source-native-scalar/expected.json b/Tests/Fixtures/Compiler/source-native-scalar/expected.json
new file mode 100644
index 000000000..fbebd3dee
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-scalar/expected.json
@@ -0,0 +1,75 @@
+{"source_rejections": 35,
+ "source_evaluations": 45,
+ "runtime_arguments": 2,
+ "policy": "source-scalar-runtime/1",
+ "object_executions": 95,
+ "format": "compilatrix/source-native-scalar-report/1",
+ "conversion_rejections": 3,
+ "cases":
+ [{"text_hash": "ff38db0a9b18251ecf2df996b1bcc4df68644678e352dd2ab54ffb751a48817d",
+   "text_bytes": 112,
+   "stack_depth": 1,
+   "stack_bytes": 272,
+   "source_root": "f65a84fea5c204520e3c5efea459251c95639d79fb17679ffe7d105a1b76c993",
+   "snapshot": "add.json",
+   "object_bytes": 968,
+   "object": "add.o",
+   "name": "add",
+   "ir1_root": "09f45b785af302969c4e061bddeceb2b6a609f92ee028759fb055e28d2297576",
+   "functions": 1,
+   "blocks": 4,
+   "below_entry_bytes": 264},
+  {"text_hash": "91b092c75c703948dd084913871b797fb53b4ed79dc147e4110bb03ec3f465c3",
+   "text_bytes": 129,
+   "stack_depth": 1,
+   "stack_bytes": 272,
+   "source_root": "822389d13892cf653a06575799a9d0179196f86cc59fbbdc474698c8b4422c2a",
+   "snapshot": "sub.json",
+   "object_bytes": 992,
+   "object": "sub.o",
+   "name": "sub",
+   "ir1_root": "a74bc94eed4499295a287aa9c0f5cb82e1c550bfbc11a37e3b062e7047985888",
+   "functions": 1,
+   "blocks": 6,
+   "below_entry_bytes": 264},
+  {"text_hash": "62e507080a5b4b0fe3e9553fb197d39ee852d2466d156f46a2a2e3569c51101c",
+   "text_bytes": 215,
+   "stack_depth": 1,
+   "stack_bytes": 272,
+   "source_root": "4c6818e4455d83974d0bae998a37ae6efe48f0e8e0dac648c72f4a3a6a84f8cf",
+   "snapshot": "diamond.json",
+   "object_bytes": 1072,
+   "object": "diamond.o",
+   "name": "diamond",
+   "ir1_root": "af6cb992a84d44b45e390bc157fdaf721d4118501925956eedadf1d3e2c9e4fd",
+   "functions": 1,
+   "blocks": 10,
+   "below_entry_bytes": 264},
+  {"text_hash": "6d4113f3c47e47ec447a0d69ecbc849e5e72dceec9bcdb83843200dfe5312c01",
+   "text_bytes": 404,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "c646b03431b7a8e922a6e5da5bfb0d5889c596d3a6b48f40d6433ee8b16daea5",
+   "snapshot": "helpers.json",
+   "object_bytes": 1264,
+   "object": "helpers.o",
+   "name": "helpers",
+   "ir1_root": "3f3081f21a71a89a668e1b1cfea555401625cf8c6f588bc433bb9a28ca83d83e",
+   "functions": 3,
+   "blocks": 16,
+   "below_entry_bytes": 808},
+  {"text_hash": "d457c687a5394725f9c9c4171600fb847f4d01fd52d302dcf976b7701a38b9af",
+   "text_bytes": 474,
+   "stack_depth": 3,
+   "stack_bytes": 816,
+   "source_root": "e220edd26495ccb8d9f9478112b0173b8ffe9657ba1bd8452a01a63fbd2cac08",
+   "snapshot": "nested.json",
+   "object_bytes": 1336,
+   "object": "nested.o",
+   "name": "nested",
+   "ir1_root": "6f7ceff5cc983f1fc0c9bfd2e5889ac366d6f5aa920d0df8ac7172e9cf0b8cb6",
+   "functions": 3,
+   "blocks": 20,
+   "below_entry_bytes": 808}],
+ "capacity_rejections": 7,
+ "admission_rejections": 5}
diff --git a/Tests/Fixtures/Compiler/source-native-scalar/native_harness.c b/Tests/Fixtures/Compiler/source-native-scalar/native_harness.c
new file mode 100644
index 000000000..c5069414a
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-scalar/native_harness.c
@@ -0,0 +1,97 @@
+#define _GNU_SOURCE
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <unistd.h>
+
+#ifndef FAMILY
+#error "FAMILY is required"
+#endif
+#ifndef STACK_DEPTH
+#error "STACK_DEPTH is required"
+#endif
+struct result { uint64_t value, status; };
+extern struct result compilatrix_scalar(uint64_t, uint64_t);
+extern struct result scalar_on_stack(void *, uint64_t, uint64_t);
+
+/* The bridge's saved RSP uses RBX, whose preservation is part of the ABI.
+   The other six pushes preserve its caller's registers on the original stack. */
+__asm__(
+    ".text\n.globl scalar_on_stack\n.type scalar_on_stack,@function\n"
+    "scalar_on_stack:\n"
+    "push %rbp\npush %rbx\npush %r12\npush %r13\npush %r14\npush %r15\n"
+    "mov %rsp,%rbx\nmov %rdi,%rsp\nmov %rsi,%rdi\nmov %rdx,%rsi\n"
+    "call compilatrix_scalar\nmov %rbx,%rsp\n"
+    "pop %r15\npop %r14\npop %r13\npop %r12\npop %rbx\npop %rbp\nret\n"
+    ".size scalar_on_stack,.-scalar_on_stack\n");
+
+static void need(int condition, const char *message) {
+    if (!condition) { fprintf(stderr, "scalar native: %s\n", message); exit(1); }
+}
+static struct result expected(uint64_t a, uint64_t b) {
+    __uint128_t sum = (__uint128_t)a + b;
+    if (FAMILY == 1) return (struct result){a < b ? 0 : a - b, 0};
+    if (FAMILY == 4) {
+        if (a == 0) return (struct result){7, 0};
+        if (a > b) return (struct result){a - b, 0};
+    }
+    if (sum > UINT64_MAX) return (struct result){0, 1};
+    uint64_t value = (uint64_t)sum;
+    if ((FAMILY == 2 || FAMILY == 3) && value) --value;
+    return (struct result){value, 0};
+}
+__attribute__((noinline)) static void verify(uint64_t a, uint64_t b, void *top) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    volatile uint64_t frame[16];
+    for (size_t i = 0; i < 16; ++i) frame[i] = UINT64_C(0xc13fa9a902a6328f) ^ i;
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp,%0" : "=r"(before));
+    struct result actual = compilatrix_scalar(a, b);
+    __asm__ volatile("mov %%rsp,%0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    struct result wanted = expected(a, b);
+    need(actual.value == wanted.value && actual.status == wanted.status, "wrong value/status");
+    need(before == after, "stack pointer changed");
+    need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+        r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+        r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5), "saved register changed");
+    for (size_t i = 0; i < 16; ++i) need(frame[i] == (UINT64_C(0xc13fa9a902a6328f) ^ i), "caller frame changed");
+    actual = scalar_on_stack(top, a, b);
+    need(actual.value == wanted.value && actual.status == wanted.status, "guarded-stack result changed");
+}
+int main(void) {
+    size_t page = (size_t)sysconf(_SC_PAGESIZE);
+    need(272 * STACK_DEPTH < page, "guarded reservation is too large");
+    uint8_t *mapping = mmap(NULL, page * 3, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    need(mapping != MAP_FAILED, "stack mapping failed");
+    uint8_t *low = mapping + page;
+    need(mprotect(low, page, PROT_READ | PROT_WRITE) == 0, "stack permissions failed");
+    void *top = low + 272 * STACK_DEPTH;
+    for (size_t i = 272 * STACK_DEPTH; i < page; ++i) low[i] = (uint8_t)(i ^ 0xa7);
+    const uint64_t m = UINT64_MAX;
+    const uint64_t cases[][2] = {
+        {0,0}, {0,1}, {1,0}, {1,1}, {2,3}, {3,2}, {7,7}, {7,19}, {19,7},
+        {0,m}, {m,0}, {m,1}, {1,m}, {m,m}, {m-1,1}, {m-1,2}, {2,m-1}, {m,m-1}, {m-1,m}
+    };
+    for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); ++i) verify(cases[i][0], cases[i][1], top);
+    uint64_t seed = UINT64_C(0xfedcba9876543210);
+    for (size_t i = 0; i < 64; ++i) {
+        seed = seed * UINT64_C(6364136223846793005) + 1;
+        uint64_t a = seed;
+        seed = seed * UINT64_C(6364136223846793005) + 1;
+        verify(a, seed, top);
+    }
+    for (size_t i = 272 * STACK_DEPTH; i < page; ++i)
+        need(low[i] == (uint8_t)(i ^ 0xa7), "guarded stack wrote above its reservation");
+    need(munmap(mapping, page * 3) == 0, "stack unmap failed");
+    printf("{\"calls\":166,\"saved_registers\":true,\"stack\":true,\"caller_frame\":true,\"guarded_stack\":true}\n");
+    return 0;
+}
diff --git a/Tests/Fixtures/Compiler/source-native-unique/expected.json b/Tests/Fixtures/Compiler/source-native-unique/expected.json
new file mode 100644
index 000000000..e24f76e62
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-unique/expected.json
@@ -0,0 +1,302 @@
+{"selection_rejections":
+ [{"reason": "native unique reversal contains a Nat outside the 64-bit Word range",
+   "provenance": "8b686baa5ed08c6af9d262224304a902e93ac21f195c5c81ac53b8088971073e",
+   "name": "word-overflow",
+   "input_length": 1,
+   "fallback": "ixir2-checked"},
+  {"reason": "native unique reversal contains a Nat outside the 64-bit Word range",
+   "provenance": "829601898d14d0d51c3038a253723e222455657493a2eb9d6730964bc53e5d76",
+   "name": "word-overflow-mixed",
+   "input_length": 2,
+   "fallback": "ixir2-checked"},
+  {"reason": "native unique reversal exceeds 64 scalar elements",
+   "provenance": "d1b5b1c07d409785e37f17bb39e4cee8eeaba166cee4823b5cdae5f0e066719b",
+   "name": "length-sixty-five",
+   "input_length": 65,
+   "fallback": "ixir2-checked"},
+  {"reason": "native unique reversal requires selected static reuse",
+   "provenance": "289e9e0e9157ed312d5fd3520ffe2f6336e84c87f3cd1936485fbaf70c5e6a13",
+   "name": "static-reuse-disabled",
+   "input_length": 3,
+   "fallback": "ixir2-checked"},
+  {"reason": "native unique reversal requires selected static reuse",
+   "provenance": "289e9e0e9157ed312d5fd3520ffe2f6336e84c87f3cd1936485fbaf70c5e6a13",
+   "name": "rewrite-budget-zero",
+   "input_length": 3,
+   "fallback": "ixir2-checked"},
+  {"reason":
+   "native requires a translated target: consuming target rejected: Ix.Compiler.IxIR2.Validate.Error.limit\n  { owner := Ix.Compiler.IxIR2.Validate.Owner.main, block := 0, instruction := none }\n  (Ix.Compiler.IxIR2.Validate.Resource.declarations)\n  1\n  0",
+   "provenance": "855ac476e245d01427f6ece7d900fd707a34be9198539f3a076ebbc5763c0ed0",
+   "name": "target-limit-zero",
+   "input_length": 3,
+   "fallback": "ixir1-consuming"}],
+ "format": "compilatrix/source-native-unique-report/1",
+ "cases":
+ [{"value": [],
+   "source_policy": "b482d721821cafb9088459e5e7335c93aad358789960335e0aded87b11877bb8",
+   "source_identity": "023aff05bc75990f314fba5df00b4aa5bb8e43ea67edc1bc3afba49e90d4769e",
+   "snapshot": "empty.json",
+   "release_steps": 16,
+   "release_policy": "6e7cd04db1483ae30f60fbd74f126757b957722aff5c7dba2ff9636592ea08a9",
+   "release_object_identity": "8ab090e2f7a5d4b2c801e623ae9a2163958b91158aee38640db560fe6b428ce6",
+   "release_object": "empty-release.o",
+   "name": "empty",
+   "main_steps": 62,
+   "main_policy": "815c6440ce04110a30196bc3f005a527923276dc622c1c1e18e666e6953716f1",
+   "main_object_identity": "1cf37b997422a6f39c1902e5bb14cd3c6cceef7b7911e4bed4f8f65b6ed404c2",
+   "main_object": "empty-main.o",
+   "ixir1_root": "dd08bbe6cfdd179d88241c7e9675aca4fc27619cb2a4af224314c896900acd0a",
+   "input": [],
+   "headers":
+   {"returned": [64, 64, 2, 1, 0, 1, 2, 0, 0, 0], "reclaimed": [64, 64, 2, 2, 0, 0, 2, 0, 0, 0]}},
+  {"value": [0],
+   "source_policy": "07fbe6cedd97c28096c2626cd844921a064b3f661f5988a59ba52c0192987854",
+   "source_identity": "77ea70192cda194f1f2f4e9716a85b99b54cb7a6438ba3bef30e0943ab327d9c",
+   "snapshot": "zero.json",
+   "release_steps": 33,
+   "release_policy": "a7e156396f2a2a9f66df395b99534b16be8fe13e78f3c9eb1acc4c5163a3509c",
+   "release_object_identity": "78b3af06b2026c6b977c8c178a5c7ed55f6478a69fe7e7c490dcbe8e0c7fa4a3",
+   "release_object": "zero-release.o",
+   "name": "zero",
+   "main_steps": 113,
+   "main_policy": "950b3d2e2c3245c4bf63844c7a9f7918db07b1e69f87d95474522a8b4f662d76",
+   "main_object_identity": "f8fd7ff95c00fe4b3eb8eaab6b03ac8ed40ea80ccedbb4834bc1bc4c72a64380",
+   "main_object": "zero-main.o",
+   "ixir1_root": "ab44923cc125a5c1d4924fd410c2ee8d3b0385d14b5b4cf8b42b8bd7425600cc",
+   "input": [0],
+   "headers":
+   {"returned": [96, 96, 3, 1, 1, 2, 3, 0, 2, 0], "reclaimed": [96, 96, 3, 3, 1, 0, 3, 0, 2, 0]}},
+  {"value": [17],
+   "source_policy": "214759c4253b729be7af6f6a6355159c88ce418c807d4bb5951bffb48794d6c2",
+   "source_identity": "054441d784aa53978b310470431381405b1bfeb6af48a2e76ae4da5a8646d19b",
+   "snapshot": "singleton.json",
+   "release_steps": 33,
+   "release_policy": "867a93923c8a862f0ae863fa44b43193b1fb3ccdd1c2fd04134f1ffdcc4668b6",
+   "release_object_identity": "fdb5585fcdc3507ccceba4d42c9f65813113b5ab7ad396b004e7de1ff1d8bc7c",
+   "release_object": "singleton-release.o",
+   "name": "singleton",
+   "main_steps": 113,
+   "main_policy": "c222861c29873010a5a2c65765a0017d5243a4ec4f0f39dd02fd64be94f822a4",
+   "main_object_identity": "f7cb9ffcea1c35ae0dc30ed1d6c1bac3134d480d32eb1aa96477eb4d668a4ac3",
+   "main_object": "singleton-main.o",
+   "ixir1_root": "b2acc752240b518077d9fd11865a50d94163f5a2eebee13dbbd95bf23919e437",
+   "input": [17],
+   "headers":
+   {"returned": [96, 96, 3, 1, 1, 2, 3, 0, 2, 0], "reclaimed": [96, 96, 3, 3, 1, 0, 3, 0, 2, 0]}},
+  {"value": [3, 2, 1],
+   "source_policy": "10d090564dfab1d170e67bf32d1bd8a3cfb660234c13734dc795aeba5a37ed46",
+   "source_identity": "1c2710d39a8f1c958b0fa35d39a30f5ce364aa7ee5e0158bcdc93b3a47e20fe0",
+   "snapshot": "three.json",
+   "release_steps": 67,
+   "release_policy": "5e69ac194e69f6fbc49d02173c642b50b5c51f5e41dd36899f8b59885fe77b0e",
+   "release_object_identity": "bb257e66a323d353aa7008a143b30e6b370a4a7e2e659841de723caa94e47a1e",
+   "release_object": "three-release.o",
+   "name": "three",
+   "main_steps": 215,
+   "main_policy": "ab5f92dcac4364e79ea0df1349ab0205f1a8a7ff778ec83778ba1a15661158be",
+   "main_object_identity": "fb12570dc2ccb878588ae2df305705dbafee5bd47e6b0c6cb2fd9f1c843e8b73",
+   "main_object": "three-main.o",
+   "ixir1_root": "4f51b681481b5eec6928ca1ea66c527db1429e0eee4595b23ed645bd00468b3a",
+   "input": [1, 2, 3],
+   "headers":
+   {"returned": [160, 160, 5, 1, 3, 4, 5, 0, 6, 0],
+    "reclaimed": [160, 160, 5, 5, 3, 0, 5, 0, 6, 0]}},
+  {"value": [42, 18446744073709551608, 0, 3, 3, 18446744073709551615, 0],
+   "source_policy": "5adad3fd05f87c839d853211452d2b07c7ac07778245b52f78df0be26e7eb618",
+   "source_identity": "e00ea38b934d12803e158f16733c8f0a6493ea2496a255cb7743f80f04235b85",
+   "snapshot": "mixed-words.json",
+   "release_steps": 135,
+   "release_policy": "a5b346bd52b366a754c33bec22884ef5f25eb95eae3a4c4cfe1678a1e64f871a",
+   "release_object_identity": "421819a5a9f4fb6b45570a56651a90e7172ce47e5cca4af4230a1f9d54dba394",
+   "release_object": "mixed-words-release.o",
+   "name": "mixed-words",
+   "main_steps": 419,
+   "main_policy": "4fdcdddb46245f54acbef98b0cdbfedbbab797b350558c6a767adedd2bf0d41f",
+   "main_object_identity": "e757dd13852617b919b7af7aa2c2737e0a41a865950e538930b09f477ad91c19",
+   "main_object": "mixed-words-main.o",
+   "ixir1_root": "2ff011f60c438f85391d64018edb348b427d43910b136cdce33e0da2426d401a",
+   "input": [0, 18446744073709551615, 3, 3, 0, 18446744073709551608, 42],
+   "headers":
+   {"returned": [288, 288, 9, 1, 7, 8, 9, 0, 14, 0],
+    "reclaimed": [288, 288, 9, 9, 7, 0, 9, 0, 14, 0]}},
+  {"value": [18446744073709551615],
+   "source_policy": "b1b1dd0cd35c6229854f0944dc3c682d568f12bae33fd11ec53fb65bda3f4f57",
+   "source_identity": "32643c7d92aca46eb4bb54776f49604b867843c401f9f031f165fff37ebe4163",
+   "snapshot": "word-max.json",
+   "release_steps": 33,
+   "release_policy": "39de56f5c172920975ba16c9269701a68b4a4c675df46deb4a280b66b1771ee6",
+   "release_object_identity": "46ca1eb99b03b1fc0253093d185552c7cc26340703817566a2e843733024cef5",
+   "release_object": "word-max-release.o",
+   "name": "word-max",
+   "main_steps": 113,
+   "main_policy": "dda9b103ec65091ecbdfe92be45b0081a0f2467237ec6cbf2e5be89b627a1e46",
+   "main_object_identity": "16fae9aa67df1f1164c5d5f391940c8a2d7181ca3592ea2cbb46a74d8285747b",
+   "main_object": "word-max-main.o",
+   "ixir1_root": "6db418058d66bc76e76463db1372e72b63531281ad5928c363062e5063c69f4b",
+   "input": [18446744073709551615],
+   "headers":
+   {"returned": [96, 96, 3, 1, 1, 2, 3, 0, 2, 0], "reclaimed": [96, 96, 3, 3, 1, 0, 3, 0, 2, 0]}},
+  {"value": [9, 9, 9, 9, 9],
+   "source_policy": "a579357db55b47d16409808fff3f7c8dccef495127d804ea03b7a2d6de2de364",
+   "source_identity": "50e868f1e67d33efe0f6de029e676ba35733d03ecb172b4997966cd3b2abc649",
+   "snapshot": "repeated.json",
+   "release_steps": 101,
+   "release_policy": "efce423f94a51c9847ed2b0ffda4827c06a63da791a36ee1246121dd421c26f1",
+   "release_object_identity": "0ff1792f3974d88c4c52abadae22dd6575df4d9be418b87b7983f1c2dbaf51f4",
+   "release_object": "repeated-release.o",
+   "name": "repeated",
+   "main_steps": 317,
+   "main_policy": "ded0bf7608b7d1cfb24ac7278410f86e652ac59f085f9d7c658962c8033ccc5b",
+   "main_object_identity": "c78d34c6ce4b6772bb19d4b2e2e855ceed8331343778fc0cac51536cffe4755e",
+   "main_object": "repeated-main.o",
+   "ixir1_root": "63fe1bf21fa9a2c701a74e117777d56e74188a6d25ce0754646c35e05f8d8f75",
+   "input": [9, 9, 9, 9, 9],
+   "headers":
+   {"returned": [224, 224, 7, 1, 5, 6, 7, 0, 10, 0],
+    "reclaimed": [224, 224, 7, 7, 5, 0, 7, 0, 10, 0]}},
+  {"value":
+   [63,
+    62,
+    61,
+    60,
+    59,
+    58,
+    57,
+    56,
+    55,
+    54,
+    53,
+    52,
+    51,
+    50,
+    49,
+    48,
+    47,
+    46,
+    45,
+    44,
+    43,
+    42,
+    41,
+    40,
+    39,
+    38,
+    37,
+    36,
+    35,
+    34,
+    33,
+    32,
+    31,
+    30,
+    29,
+    28,
+    27,
+    26,
+    25,
+    24,
+    23,
+    22,
+    21,
+    20,
+    19,
+    18,
+    17,
+    16,
+    15,
+    14,
+    13,
+    12,
+    11,
+    10,
+    9,
+    8,
+    7,
+    6,
+    5,
+    4,
+    3,
+    2,
+    1,
+    0],
+   "source_policy": "5e5858487c5a50ae4748e070e50eacfe22e1b2ac25e6d974d94c2f6bd2a99015",
+   "source_identity": "3bd1be01a9f931f9177edb9d54a1a8d75c34531b11bb3b3fd079f2bc611fe250",
+   "snapshot": "sixty-four.json",
+   "release_steps": 1104,
+   "release_policy": "b53ab1a680f03008b808532b847232074fd5b384dfb9749655c9979f7f120b3c",
+   "release_object_identity": "5acabe6a6b32a22e6b380fb256d6cbfdf533c085e2660332747f312d9be9b0ac",
+   "release_object": "sixty-four-release.o",
+   "name": "sixty-four",
+   "main_steps": 3326,
+   "main_policy": "0ed280c2bcdb4602ca130ed721b84d4517e7ad3c52c62f865bf9dcbd4ce6f1b9",
+   "main_object_identity": "84c1353bfc62bcdf7f842583f124b52862c9d007ed98e85ad190ca25e8ac7a3e",
+   "main_object": "sixty-four-main.o",
+   "ixir1_root": "2e3e9897f6873e9ea6f12d40e87e386837c5b6997ac54a06e886ff67293145b1",
+   "input":
+   [0,
+    1,
+    2,
+    3,
+    4,
+    5,
+    6,
+    7,
+    8,
+    9,
+    10,
+    11,
+    12,
+    13,
+    14,
+    15,
+    16,
+    17,
+    18,
+    19,
+    20,
+    21,
+    22,
+    23,
+    24,
+    25,
+    26,
+    27,
+    28,
+    29,
+    30,
+    31,
+    32,
+    33,
+    34,
+    35,
+    36,
+    37,
+    38,
+    39,
+    40,
+    41,
+    42,
+    43,
+    44,
+    45,
+    46,
+    47,
+    48,
+    49,
+    50,
+    51,
+    52,
+    53,
+    54,
+    55,
+    56,
+    57,
+    58,
+    59,
+    60,
+    61,
+    62,
+    63],
+   "headers":
+   {"returned": [2112, 2112, 66, 1, 64, 65, 66, 0, 128, 0],
+    "reclaimed": [2112, 2112, 66, 66, 64, 0, 66, 0, 128, 0]}}]}
diff --git a/Tests/Fixtures/Compiler/source-native-unique/native_harness.c b/Tests/Fixtures/Compiler/source-native-unique/native_harness.c
new file mode 100644
index 000000000..5b265cb54
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-unique/native_harness.c
@@ -0,0 +1,163 @@
+#include <errno.h>
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+enum { MAX_LENGTH = 64, HEADER_WORDS = 10, CELL_WORDS = 4 };
+enum { CURSOR, CAPACITY, ALLOCS, FREES, REUSES, LIVE, PEAK, RCOPS, PAYLOAD, RESERVATIONS };
+
+typedef struct {
+    uint64_t header[HEADER_WORDS];
+    uint64_t cells[][CELL_WORDS];
+} Arena;
+
+extern uint64_t compilatrix_main(Arena *, uint64_t);
+extern uint64_t compilatrix_unique_drop(Arena *, uint64_t);
+
+static void need(int condition, const char *message) {
+    if (!condition) {
+        fprintf(stderr, "native unique harness: %s\n", message);
+        exit(1);
+    }
+}
+
+/* Volatile register operands force the checks to observe the physical saved
+   registers on each side of the call. The fixture is built with frame-pointer
+   omission so rbp is available along with all other System V saved registers. */
+__attribute__((noinline))
+static uint64_t checked_call(uint64_t (*entry)(Arena *, uint64_t), Arena *arena, uint64_t root) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp, %0" : "=r"(before));
+    uint64_t result = entry(arena, root);
+    __asm__ volatile("mov %%rsp, %0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    need(before == after, "stack pointer changed");
+    need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+         r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+         r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5),
+         "callee-saved register changed");
+    return result;
+}
+
+static const uint64_t canary = UINT64_C(0xfedcba9876543210);
+
+static void canaries(const uint64_t *storage, size_t words) {
+    need(storage[0] == canary && storage[1] == ~canary &&
+         storage[words + 2] == canary && storage[words + 3] == ~canary,
+         "write escaped the arena");
+}
+
+static size_t index_of(const Arena *arena, size_t capacity, uint64_t pointer) {
+    uintptr_t base = (uintptr_t)&arena->cells[0];
+    need(pointer >= base && pointer < base + capacity * sizeof arena->cells[0], "pointer escaped arena");
+    need((pointer - base) % sizeof arena->cells[0] == 0, "misaligned cell pointer");
+    return (size_t)((pointer - base) / sizeof arena->cells[0]);
+}
+
+static void headers(const Arena *arena, size_t length, int reclaimed) {
+    const uint64_t expected[HEADER_WORDS] = {
+        32 * (length + 2), 32 * (length + 2), length + 2,
+        reclaimed ? length + 2 : 1, length, reclaimed ? 0 : length + 1,
+        length + 2, 0, 2 * length, 0
+    };
+    need(memcmp(arena->header, expected, sizeof expected) == 0, "heap counters disagree");
+}
+
+static void print_heap(const Arena *arena, size_t capacity) {
+    printf("{\"header\":[");
+    for (size_t field = 0; field < HEADER_WORDS; ++field)
+        printf("%s%" PRIu64, field ? "," : "", arena->header[field]);
+    printf("],\"cells\":[");
+    for (size_t index = 0; index < capacity; ++index) {
+        const uint64_t *cell = arena->cells[index];
+        printf("%s[%" PRIu64 ",%" PRIu64 ",", index ? "," : "", cell[0], cell[1]);
+        if (cell[2] == 0) printf("null");
+        else printf("%zu", index_of(arena, capacity, cell[2]));
+        printf(",%" PRIu64 "]", cell[3]);
+    }
+    printf("]}");
+}
+
+int main(int argc, char **argv) {
+    need(argc >= 1 && argc <= MAX_LENGTH + 1, "invalid expected input length");
+    size_t length = (size_t)argc - 1;
+    size_t capacity = length + 2;
+    size_t words = HEADER_WORDS + CELL_WORDS * capacity;
+    uint64_t expected[MAX_LENGTH] = {0};
+    for (size_t index = 0; index < length; ++index) {
+        char *end = NULL;
+        errno = 0;
+        need(argv[index + 1][0] >= '0' && argv[index + 1][0] <= '9', "invalid input literal");
+        expected[index] = strtoull(argv[index + 1], &end, 10);
+        need(errno == 0 && end != argv[index + 1] && *end == '\0', "invalid input literal");
+    }
+    uint64_t *storage = calloc(words + 4, sizeof *storage);
+    need(storage != NULL, "allocation failed");
+    storage[0] = storage[words + 2] = canary;
+    storage[1] = storage[words + 3] = ~canary;
+    Arena *arena = (Arena *)(storage + 2);
+    arena->header[CAPACITY] = 32 * capacity;
+    uint64_t root = checked_call(compilatrix_main, arena, 0);
+    need(root != 0 && index_of(arena, capacity, root) == 1, "wrong result root");
+    headers(arena, length, 0);
+    canaries(storage, words);
+    unsigned char visited[MAX_LENGTH + 2] = {0};
+    uint64_t pointer = root;
+    uint64_t values[MAX_LENGTH] = {0};
+    for (size_t offset = 0; offset <= length; ++offset) {
+        size_t index = index_of(arena, capacity, pointer);
+        need(!visited[index], "cyclic or aliased list");
+        visited[index] = 1;
+        const uint64_t *cell = arena->cells[index];
+        need(cell[3] == 0, "nonzero cell padding");
+        if (offset < length) {
+            need(cell[0] == 1 && cell[1] == expected[length - offset - 1], "wrong reversed payload");
+            values[offset] = cell[1];
+            pointer = cell[2];
+        } else need(cell[0] == 0 && cell[1] == 0 && cell[2] == 0, "invalid nil");
+    }
+    for (size_t index = 0; index < capacity; ++index) {
+        if (visited[index]) continue;
+        need(index == 0 && arena->cells[index][0] == 3 && arena->cells[index][1] == 0 &&
+             arena->cells[index][2] == 0 && arena->cells[index][3] == 0, "unowned live allocation");
+    }
+    printf("{\"root\":1,\"value\":[");
+    for (size_t index = 0; index < length; ++index) printf("%s%" PRIu64, index ? "," : "", values[index]);
+    printf("],\"returned\":");
+    print_heap(arena, capacity);
+    need(checked_call(compilatrix_unique_drop, arena, root) == 0, "release returned nonzero");
+    headers(arena, length, 1);
+    canaries(storage, words);
+    for (size_t index = 0; index < capacity; ++index)
+        need(arena->cells[index][0] == 3 && arena->cells[index][1] == 0 &&
+             arena->cells[index][2] == 0 && arena->cells[index][3] == 0, "incomplete reclamation");
+    printf(",\"reclaimed\":");
+    print_heap(arena, capacity);
+    const uint64_t rejection_headers[][2] = {
+        {0, 32 * capacity - 1}, {0, 0}, {1, 32 * capacity}, {UINT64_MAX, 32 * capacity}
+    };
+    unsigned char *original = malloc(words * sizeof *storage);
+    need(original != NULL, "snapshot allocation failed");
+    for (size_t test = 0; test < sizeof rejection_headers / sizeof rejection_headers[0]; ++test) {
+        memset(arena, 0xa5, words * sizeof *storage);
+        arena->header[CURSOR] = rejection_headers[test][0];
+        arena->header[CAPACITY] = rejection_headers[test][1];
+        memcpy(original, arena, words * sizeof *storage);
+        need(checked_call(compilatrix_main, arena, 0) == 0, "capacity guard accepted");
+        need(memcmp(original, arena, words * sizeof *storage) == 0, "capacity rejection wrote memory");
+        canaries(storage, words);
+    }
+    printf(",\"capacity_rejections\":[\"one-byte-short\",\"zero-capacity\",\"nonzero-cursor\",\"cursor-overflow\"]}\n");
+    free(original);
+    free(storage);
+    return 0;
+}
diff --git a/Tests/Fixtures/Compiler/source-native-upstream/expected.json b/Tests/Fixtures/Compiler/source-native-upstream/expected.json
new file mode 100644
index 000000000..2cdfa6cb6
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-upstream/expected.json
@@ -0,0 +1,174 @@
+{"policy": "upstream-closed-nat/2",
+ "format": "compilatrix/source-native-upstream-report/1",
+ "cases":
+ [{"source_constants": 6,
+   "snapshot": "upstream-applyClosed.json",
+   "root_kind": "constant",
+   "root": "b81b754f02c1b63279a609ab4b55b609fd6f87fab7b14879f4021c3327c2eb40",
+   "rejection": null,
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "2e4873546afd7558d5c02b244d2713229c02f6f684c298739f0b7431e7b8df02",
+    "members_root": "90eb98fa5464f21acb0ffe27a71bb3f72fc068f98ba5a7fa9ae6bd307e992ac7",
+    "content_root": "2c4dcedd6ac8b9dee3cfbceafe0c08cbd55e568d287fc89256de144d867ac631"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-ixir2; closed-unary-nat-calls/1",
+   "observation":
+   {"reclaimed": {"reuses": 0, "rcops": 7, "live": 0, "frees": 5, "allocs": 5},
+    "peak_live_nodes": 4,
+    "nat": 3,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 3, "live": 4, "frees": 1, "allocs": 5},
+    "control_steps": 13},
+   "object": "upstream-applyClosed.o",
+   "name": "upstream-applyClosed",
+   "last_accepted_stage": "elf",
+   "ir1_root": "b2206f887b930da1debd137efccd3425ca8f7a7b926d7dcce223c2acf3d9e3ec",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "25383b8ee1c3839e788e1a669636e2b2256874b4ebab76d1fe719815f2b72661",
+    "4b0cbe528ec5880e83af94e3cb576411e848139ac8b21bb2ad43ebf3089d5b81",
+    "d5d01500ba05b06f52ca8fe7e17c0a3b613c27d6e5ba51eaf7ac6e026a99ef2d"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 2}},
+  {"source_constants": 6,
+   "snapshot": "upstream-captureClosed.json",
+   "root_kind": "constant",
+   "root": "5628cfe1b4f959fb116661fc50ae8e9e4bfa470ac5d0e639a75b9d23aed12953",
+   "rejection": null,
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "280ab6f15706a3c0ed76511604abd5653a524dba4b5893b193c904db2f66f852",
+    "members_root": "b540312a765a85bea6bfecc321c84a0d3ab9384aff1496707c519a7168505bfa",
+    "content_root": "f45a88c0c41dcc241a4a46ebc98953291f7c81eda7bd11c49978cb65ea82c969"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-ixir2; closed-static-capture-nat-calls/1",
+   "observation":
+   {"reclaimed": {"reuses": 0, "rcops": 11, "live": 0, "frees": 5, "allocs": 5},
+    "peak_live_nodes": 5,
+    "nat": 2,
+    "heap_work": 5,
+    "heap": {"reuses": 0, "rcops": 8, "live": 3, "frees": 2, "allocs": 5},
+    "control_steps": 15},
+   "object": "upstream-captureClosed.o",
+   "name": "upstream-captureClosed",
+   "last_accepted_stage": "elf",
+   "ir1_root": "85e7908d73603431fbf07e4a7b9fe12ab920d8a64f6fc9db9f5416b3741ee1ae",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "25383b8ee1c3839e788e1a669636e2b2256874b4ebab76d1fe719815f2b72661",
+    "29362969dcda1e702e2a82a43364c2c55ca277253cfad9cd96b83244a2519c41",
+    "e9018f5e5055b910e8e3bae5fb279cb949c9049d51f8aafcea414f40206205e1"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 2}},
+  {"source_constants": 6,
+   "snapshot": "upstream-letClosed.json",
+   "root_kind": "constant",
+   "root": "6c737171f1a3c482ba96cbe4998ea660fda824c578fe668ab9fdc4aae1b9754f",
+   "rejection": null,
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "717c04ee467799465d08c0e624f312fe619badbe7394c7fa0637f1b0c975744b",
+    "members_root": "f43b2ddbaa6d90259fdc2253f12a830e673f7438a86fe04a2522ee4acbe880fd",
+    "content_root": "e228726e331eddb217a32c6ced86026a97a26ca7df5070c99b7f970deeef17a1"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-ixir2; closed-unary-nat-calls/1",
+   "observation":
+   {"reclaimed": {"reuses": 0, "rcops": 8, "live": 0, "frees": 6, "allocs": 6},
+    "peak_live_nodes": 5,
+    "nat": 4,
+    "heap_work": 2,
+    "heap": {"reuses": 0, "rcops": 3, "live": 5, "frees": 1, "allocs": 6},
+    "control_steps": 14},
+   "object": "upstream-letClosed.o",
+   "name": "upstream-letClosed",
+   "last_accepted_stage": "elf",
+   "ir1_root": "35e7976edcdeed9b80c784f73403970b47ce1f38e46bc099fad960c3248d1f6c",
+   "hpt_roots":
+   ["a12bed2f5a56dd313641c970e32c01c21753d76ae8bab35e1c39c9e55937e043",
+    "25383b8ee1c3839e788e1a669636e2b2256874b4ebab76d1fe719815f2b72661",
+    "4b0cbe528ec5880e83af94e3cb576411e848139ac8b21bb2ad43ebf3089d5b81",
+    "2ba4db9286bb1ea83ca95d44c327be1ba88ca579839c4ecd9470616157b46840"],
+   "features":
+   {"tailCalls": 2,
+    "papps": 1,
+    "natSwitches": 0,
+    "directCalls": 0,
+    "constructorSwitches": 0,
+    "applies": 2}},
+  {"source_constants": 19,
+   "snapshot": "upstream-addClosed.json",
+   "root_kind": "constant",
+   "root": "799b7939dcc3c158620a49e645c9fee367674251e5298594bf8801747e49f990",
+   "rejection":
+   {"stage": "validated-erasure",
+    "root": "1ce12e12485a4793aa5baf4f197f5d5ceb5fb8e166f1a06640b87f9c91dad725",
+    "message": "reference lacks a Covered certificate",
+    "code": "missingCovered"},
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "ce2cc4e16ffbe9166b9be201c524cbc7530705fdc5b8ff7602627aba70f5f4d0",
+    "members_root": "8ee129c37888400dddf6dcfaba965ea35c68dbdd3909863817352697b90ccd32",
+    "content_root": "84b4c400ac444ae12101cc6e49cb1830281d56698de68e095eb42eb4743bb4b9"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-only",
+   "observation": null,
+   "object": null,
+   "name": "upstream-addClosed",
+   "last_accepted_stage": "addressed-ixir0",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null},
+  {"source_constants": 6,
+   "snapshot": "upstream-recClosed.json",
+   "root_kind": "constant",
+   "root": "1248f5d1b9eb3c50a6818d4d6d1e2413a7e9587e0990de2421e997d756da7aa1",
+   "rejection":
+   {"stage": "validated-erasure",
+    "root": "1248f5d1b9eb3c50a6818d4d6d1e2413a7e9587e0990de2421e997d756da7aa1",
+    "message": "reference lacks a Covered certificate",
+    "code": "missingCovered"},
+   "provenance":
+   {"toolchain": "leanprover/lean4:v4.33.1",
+    "source_pin": "git:ix@6f18ea907b78d06f7dc0917c43beb385561c35f4",
+    "source_module_hash": "f110212098135fe1087b898312c6736e673080a6de70b858424e4715b129a4bc",
+    "source_module":
+    "6d6f64756c650a0a7075626c696320696d706f7274205374640a0a6e616d65737061636520436f6d70696c6174726978557073747265616d0a0a7075626c696320646566207477696365202866756e6374696f6e203a204e617420e28692204e617429202876616c7565203a204e617429203a204e6174203a3d0a202066756e6374696f6e202866756e6374696f6e2076616c7565290a0a7075626c696320646566206170706c79436c6f736564203a204e6174203a3d0a20207477696365202866756e2076616c7565203d3e204e61742e737563632076616c75652920284e61742e73756363204e61742e7a65726f290a0a7075626c6963206465662063617074757265436c6f736564203a204e6174203a3d0a20206c65742073656564203a3d204e61742e7375636320284e61742e73756363204e61742e7a65726f290a20207477696365202866756e205f203d3e207365656429204e61742e7a65726f0a0a7075626c696320646566206c6574436c6f736564203a204e6174203a3d0a20206c65742073746570203a3d2066756e2076616c7565203a204e6174203d3e204e61742e737563632076616c75650a20207477696365207374657020284e61742e7375636320284e61742e73756363204e61742e7a65726f29290a0a7075626c69632064656620616464436c6f736564203a204e6174203a3d0a20204e61742e61646420284e61742e7375636320284e61742e73756363204e61742e7a65726f292920284e61742e73756363204e61742e7a65726f290a0a7075626c69632064656620726563436c6f736564203a204e6174203a3d0a20204e61742e72656320286d6f74697665203a3d2066756e205f203d3e204e617429204e61742e7a65726f0a202020202866756e205f20726573756c74203d3e204e61742e7375636320726573756c74290a20202020284e61742e7375636320284e61742e7375636320284e61742e73756363204e61742e7a65726f2929290a0a656e6420436f6d70696c6174726978557073747265616d0a",
+    "piece_hash": "4c0c64ad2997001a63b5d6a70475f656cd27eb8dd30ba8c3acb8bd87564b3f49",
+    "members_root": "f56beab09094b676fc076c381847d10fed4cd7ec878965ac0c254de51c05f6b7",
+    "content_root": "8adcf06f26a4adbfd4588669becc3cd5ddf4ec6a5f1d9bfbcb904b1ffd6505ec"},
+   "origin": "upstream-lean",
+   "optimization_policy": "baseline-only",
+   "observation": null,
+   "object": null,
+   "name": "upstream-recClosed",
+   "last_accepted_stage": "addressed-ixir0",
+   "ir1_root": null,
+   "hpt_roots": null,
+   "features": null}]}
diff --git a/Tests/Fixtures/Compiler/source-native-upstream/native_harness.c b/Tests/Fixtures/Compiler/source-native-upstream/native_harness.c
new file mode 100644
index 000000000..1541e7606
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-native-upstream/native_harness.c
@@ -0,0 +1,79 @@
+#define _GNU_SOURCE
+#include <inttypes.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <sys/resource.h>
+
+#ifndef EXPECTED_RESULT
+#error "EXPECTED_RESULT must be defined"
+#endif
+extern uint64_t compilatrix_main(void);
+static volatile uint64_t observed;
+static void need(int condition, const char *message) {
+    if (!condition) { fprintf(stderr, "upstream native: %s\n", message); exit(1); }
+}
+static uint64_t now(void) {
+    struct timespec value;
+    need(clock_gettime(CLOCK_MONOTONIC_RAW, &value) == 0, "timer failed");
+    return (uint64_t)value.tv_sec * UINT64_C(1000000000) + value.tv_nsec;
+}
+__attribute__((noinline)) static void verify(void) {
+    register uint64_t bx __asm__("rbx") = UINT64_C(0x1020304050607080);
+    register uint64_t bp __asm__("rbp") = UINT64_C(0x2131415161718191);
+    register uint64_t r12 __asm__("r12") = UINT64_C(0x32425262728292a2);
+    register uint64_t r13 __asm__("r13") = UINT64_C(0x435363738393a3b3);
+    register uint64_t r14 __asm__("r14") = UINT64_C(0x5464748494a4b4c4);
+    register uint64_t r15 __asm__("r15") = UINT64_C(0x65758595a5b5c5d5);
+    volatile uint64_t frame[32];
+    for (size_t i = 0; i < 32; ++i) frame[i] = UINT64_C(0xc13fa9a902a6328f) ^ i;
+    uintptr_t before, after;
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    __asm__ volatile("mov %%rsp, %0" : "=r"(before));
+    uint64_t result = compilatrix_main();
+    __asm__ volatile("mov %%rsp, %0" : "=r"(after));
+    __asm__ volatile("" : "+r"(bx), "+r"(bp), "+r"(r12), "+r"(r13), "+r"(r14), "+r"(r15) : : "memory");
+    need(result == EXPECTED_RESULT, "wrong result");
+    need(before == after, "stack pointer changed");
+    need(bx == UINT64_C(0x1020304050607080) && bp == UINT64_C(0x2131415161718191) &&
+        r12 == UINT64_C(0x32425262728292a2) && r13 == UINT64_C(0x435363738393a3b3) &&
+        r14 == UINT64_C(0x5464748494a4b4c4) && r15 == UINT64_C(0x65758595a5b5c5d5), "saved register changed");
+    for (size_t i = 0; i < 32; ++i) need(frame[i] == (UINT64_C(0xc13fa9a902a6328f) ^ i), "caller frame changed");
+}
+__attribute__((noinline)) static uint64_t calls(uint64_t operations) {
+    uint64_t sink = 0;
+    for (uint64_t i = 0; i < operations; ++i) sink += compilatrix_main();
+    return sink;
+}
+int main(int argc, char **argv) {
+    verify();
+    if (argc == 1) {
+        printf("{\"value\":%u,\"saved_registers\":true,\"stack\":true,\"caller_frame\":true,\"heap_allocations\":0}\n", (unsigned)EXPECTED_RESULT);
+        return 0;
+    }
+    need(argc == 3, "usage: executable [OPERATIONS SAMPLES]");
+    char *end;
+    uint64_t operations = strtoull(argv[1], &end, 10);
+    need(*end == 0 && operations > 0 && operations <= UINT64_C(100000000000), "invalid operation count");
+    uint64_t samples = strtoull(argv[2], &end, 10);
+    need(*end == 0 && samples > 0 && samples <= 10, "invalid sample count");
+    uint64_t warm = now(), warm_operations = 0;
+    do { observed = calls(65536); warm_operations += 65536; } while (now() - warm < UINT64_C(1000000000));
+    printf("{\"kind\":\"warmup\",\"elapsed_ns\":%" PRIu64 ",\"operations\":%" PRIu64 "}\n", now() - warm, warm_operations);
+    fflush(stdout);
+    for (uint64_t sample = 0; sample < samples; ++sample) {
+        uint64_t start = now(), sink = calls(operations), elapsed = now() - start;
+        observed = sink;
+        need(sink == EXPECTED_RESULT * operations, "timed sink disagrees");
+        struct rusage usage;
+        need(getrusage(RUSAGE_SELF, &usage) == 0, "resource usage failed");
+        printf("{\"kind\":\"sample\",\"sample\":%" PRIu64 ",\"operations\":%" PRIu64
+            ",\"elapsed_ns\":%" PRIu64 ",\"sink\":%" PRIu64 ",\"peak_rss_kb\":%ld}\n",
+            sample, operations, elapsed, sink, usage.ru_maxrss);
+        fflush(stdout);
+        verify();
+    }
+    return 0;
+}
diff --git a/Tests/Fixtures/Compiler/source-recursion/README.md b/Tests/Fixtures/Compiler/source-recursion/README.md
new file mode 100644
index 000000000..a7aefa1a1
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-recursion/README.md
@@ -0,0 +1,31 @@
+The reviewed `expected.json` matrix pins D1's eight canonical synthetic Ixon
+list-reversal cases, their checked HPT identities, and 25 rejection/fallback
+checks. Each input is compiled
+from source constants through the existing validator before optional checked
+recursion recovery, ownership lowering, CFG lowering, and dynamic reuse.
+No fixture supplies intermediate IR.
+
+Generate full snapshots with `lake exe source-recursion /tmp/new-recursion`.
+Run `lake exe check-source-recursion --fixture .lake/build/bin/source-recursion`
+to compare two fresh compiler processes against the reviewed matrix and each
+other. The report plus eight snapshots form the exact nine-file inventory.
+
+The full snapshots retain canonical source/IR bytes, addressing graphs and
+preimages, common lowering certificate checks, HPT candidates and canonical
+cache records, full finite sidecars, configuration, selected CFGs and schemas,
+and every observed and reclaimed heap. Case snapshots use format version 2;
+the recovery policy and report format retain version 1. IxIR₂ JSON is diagnostic
+and has no persistent codec identity.
+The checker independently counts live terminal nodes and checks
+`live + frees = allocs` before inspecting the fully reclaimed heap.
+It also checks `baseline.allocs = selected.allocs + selected.reuses` and the
+corresponding free equation for the actual physical outputs, at halt and
+after release. At both phases, selected RC operations and peak live nodes
+must not exceed the physical baseline.
+The [focused documentation](../../docs/source-recursion.md) records the
+composed source-to-selected-physical cost theorem and its shared-result domain,
+including intermediate execution states. Exact counters and the separate
+literal-to-recovered savings remain finite measurements.
+
+Refresh this matrix only after reviewing the fixture or compiler-policy
+change that explains the drift. The checker never rewrites expectations.
diff --git a/Tests/Fixtures/Compiler/source-recursion/expected.json b/Tests/Fixtures/Compiler/source-recursion/expected.json
new file mode 100644
index 000000000..cb626bb03
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-recursion/expected.json
@@ -0,0 +1,465 @@
+{"source_origin": "canonical synthetic Ixon",
+ "rejection_checks":
+ ["recursive-arity",
+  "nat-peeling",
+  "extra-constructor-rule",
+  "non-immediate-recursion",
+  "wrong-constructor-layout",
+  "wrong-constructor-tag",
+  "wrong-base-function",
+  "below-escape",
+  "below-data-projection",
+  "course-of-values-projection",
+  "changed-accumulator",
+  "returned-below-tuple",
+  "extra-entry-use",
+  "unique-entry-result",
+  "changed-proposal-input",
+  "unrecognized-entry",
+  "first-binding-shadow",
+  "fresh-address-conflict",
+  "cfg-resource-fallback",
+  "scalar-literal-fallback",
+  "source-freeze-rejection",
+  "source-extern-rejection",
+  "lowering-shadowed-source",
+  "lowering-source-extern",
+  "lowering-target-extern"],
+ "recovery_policy": "immediate-list-below/1",
+ "format": "compilatrix/source-recursion-report/1",
+ "cases":
+ [{"value": {"list": {"values": []}},
+   "tail_self_calls": 1,
+   "source_root": "68af80f0f6ae206034a0a18280dda30115d164583a8f5f9e53f0b65401e89ec7",
+   "source_constants": 14,
+   "snapshot": "empty-hot.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "ae7433439f741984c78c67bc3f31a57ff755a655dafdd219f48029fa837ce82e",
+   "recovered_ixir1": {"reuses": 0, "rcops": 1, "live": 1, "frees": 1, "allocs": 2},
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 1,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "name": "empty-hot",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 1,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "literal_ixir1_root": "e8da4132f881bcc4ccf06cc1a5b24f07f586745aedd287fa31957e6c7853085c",
+   "literal_ixir1": {"reuses": 0, "rcops": 12, "live": 1, "frees": 10, "allocs": 11},
+   "input": [],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 1,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value": {"pair": {"reversed": [], "original": []}},
+   "tail_self_calls": 1,
+   "source_root": "5a6f2c218ef025bd02e897ce88db8fa250f1464abd9d96927062e33c9124dcaf",
+   "source_constants": 14,
+   "snapshot": "empty-cold.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "96b03889de7589754033220f7bd84c36c79e0ba68dc92dd6a83b0a5b625a0ec8",
+   "recovered_ixir1": {"reuses": 0, "rcops": 2, "live": 3, "frees": 0, "allocs": 3},
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 2,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 3},
+   "name": "empty-cold",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 2,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 3},
+   "literal_ixir1_root": "860f748162913f7ef1341bc8eae0460b6f32d629a5ed462b4a0383bb48a95953",
+   "literal_ixir1": {"reuses": 0, "rcops": 13, "live": 3, "frees": 9, "allocs": 12},
+   "input": [],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 2,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 3},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value": {"list": {"values": [17]}},
+   "tail_self_calls": 1,
+   "source_root": "0634ad3cca6f2d6dde83c50acedd3a802d4f75f119fc4bfcb8ee4bcdded774bf",
+   "source_constants": 14,
+   "snapshot": "singleton-hot.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "40a39ac8dded63e72b44078eda9e69545f091428b5906909414611f94fee2949",
+   "recovered_ixir1": {"reuses": 0, "rcops": 4, "live": 2, "frees": 2, "allocs": 4},
+   "physical":
+   {"reuses": 1,
+    "reusedPayloadUnits": 2,
+    "resetAttempts": 1,
+    "rcops": 1,
+    "peakLiveNodes": 3,
+    "hotResets": 1,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 3},
+   "name": "singleton-hot",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 1,
+    "rcops": 1,
+    "peakLiveNodes": 3,
+    "hotResets": 1,
+    "frees": 2,
+    "coldResets": 0,
+    "allocs": 4},
+   "literal_ixir1_root": "5b6e0d27584ba69006fb1b5a8a5be630f696a809eab7c606788fcbab70bee0df",
+   "literal_ixir1": {"reuses": 0, "rcops": 31, "live": 2, "frees": 15, "allocs": 17},
+   "input": [17],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 4,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 2,
+    "coldResets": 0,
+    "allocs": 4},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value": {"pair": {"reversed": [17], "original": [17]}},
+   "tail_self_calls": 1,
+   "source_root": "d9fa5287aaae2a4a6daa5c9f41092016da2c6f75cc480dec444b8ed07ce27d38",
+   "source_constants": 14,
+   "snapshot": "singleton-cold.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "9a5d281552bcc35559338a8ae6a08e617954c7faf2a982e03ba17b19abe380b1",
+   "recovered_ixir1": {"reuses": 0, "rcops": 4, "live": 5, "frees": 0, "allocs": 5},
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 1,
+    "rcops": 4,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 1,
+    "allocs": 5},
+   "name": "singleton-cold",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 1,
+    "rcops": 4,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 1,
+    "allocs": 5},
+   "literal_ixir1_root": "1d1b3fa9e288ce7d03d35e8ed256d372a534d3c4d1bdd7da099700cbfa93c6ff",
+   "literal_ixir1": {"reuses": 0, "rcops": 31, "live": 5, "frees": 13, "allocs": 18},
+   "input": [17],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 4,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 5},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value": {"list": {"values": [3, 2, 1]}},
+   "tail_self_calls": 1,
+   "source_root": "20c76501dc305368047d622fc40054614623630be2f8fe73e83e23782fd95d8d",
+   "source_constants": 14,
+   "snapshot": "three-hot.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "d7860003502480a602b3880d196519d3b89a2f7c7f3cdaccd6dce82a2b6de68d",
+   "recovered_ixir1": {"reuses": 0, "rcops": 10, "live": 4, "frees": 4, "allocs": 8},
+   "physical":
+   {"reuses": 3,
+    "reusedPayloadUnits": 6,
+    "resetAttempts": 3,
+    "rcops": 1,
+    "peakLiveNodes": 5,
+    "hotResets": 3,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 5},
+   "name": "three-hot",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 3,
+    "rcops": 1,
+    "peakLiveNodes": 5,
+    "hotResets": 3,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "literal_ixir1_root": "f7c172bad6a37d6c651914d32de55fa3b09fa1211cd9b2c7c085c9fafa615960",
+   "literal_ixir1": {"reuses": 0, "rcops": 69, "live": 4, "frees": 25, "allocs": 29},
+   "input": [1, 2, 3],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 10,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value": {"pair": {"reversed": [3, 2, 1], "original": [1, 2, 3]}},
+   "tail_self_calls": 1,
+   "source_root": "6846a3d50eec14296128a1200f861ae88f7802e271a5a846216523d80512a849",
+   "source_constants": 14,
+   "snapshot": "three-cold.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "13298599fab296b837247c6bc5171ad555ce93c95ae0b344da1729916c1ac251",
+   "recovered_ixir1": {"reuses": 0, "rcops": 8, "live": 9, "frees": 0, "allocs": 9},
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 3,
+    "rcops": 8,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 3,
+    "allocs": 9},
+   "name": "three-cold",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 3,
+    "rcops": 8,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 3,
+    "allocs": 9},
+   "literal_ixir1_root": "5fa14737c08694bee0de54eafe1990bd62d3e08ae33e53f51804fe907dea452a",
+   "literal_ixir1": {"reuses": 0, "rcops": 67, "live": 9, "frees": 21, "allocs": 30},
+   "input": [1, 2, 3],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 8,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 9},
+   "all_heaps_reclaimed": true,
+   "aliased": true},
+  {"value": {"list": {"values": [0, 42, 1, 18446744073709551616, 3, 3, 0]}},
+   "tail_self_calls": 1,
+   "source_root": "147f5444216347014d811ee9ac91c2be7dbf2434a05c1fc7898b284cd0a2dc08",
+   "source_constants": 14,
+   "snapshot": "mixed-hot.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "092d3054ad52e325957e41575bc84a5fd402ff025186a653d6f1f048fa184258",
+   "recovered_ixir1": {"reuses": 0, "rcops": 22, "live": 8, "frees": 8, "allocs": 16},
+   "physical":
+   {"reuses": 7,
+    "reusedPayloadUnits": 14,
+    "resetAttempts": 7,
+    "rcops": 1,
+    "peakLiveNodes": 9,
+    "hotResets": 7,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 9},
+   "name": "mixed-hot",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 7,
+    "rcops": 1,
+    "peakLiveNodes": 9,
+    "hotResets": 7,
+    "frees": 8,
+    "coldResets": 0,
+    "allocs": 16},
+   "literal_ixir1_root": "76c54d13ea3beb49b3666e1baf3cc4d233cf3ad98cba9722f0de5a09d0fc0ed4",
+   "literal_ixir1": {"reuses": 0, "rcops": 145, "live": 8, "frees": 45, "allocs": 53},
+   "input": [0, 3, 3, 18446744073709551616, 1, 42, 0],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 22,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 8,
+    "coldResets": 0,
+    "allocs": 16},
+   "all_heaps_reclaimed": true,
+   "aliased": false},
+  {"value":
+   {"pair":
+    {"reversed": [0, 42, 1, 18446744073709551616, 3, 3, 0],
+     "original": [0, 3, 3, 18446744073709551616, 1, 42, 0]}},
+   "tail_self_calls": 1,
+   "source_root": "06fc38d35e2f279894f876696554ba3e952dd7a55aa759e54346834e722e402a",
+   "source_constants": 14,
+   "snapshot": "mixed-cold.json",
+   "reuse":
+   {"unmappableOperands": 0,
+    "shapeCandidates": 1,
+    "scannedBlocks": 4,
+    "rewritten": 1,
+    "livenessRejected": 0,
+    "incompatibleLayouts": 0,
+    "helperBlocks": 2},
+   "recovered_recursion_root": "b61b507839bfaf66527944fd33a5eefd21babf356e3b9c90aa6bf507f9656542",
+   "recovered_ixir1_root": "61f146fd6412caa1bafe1929991f12352fe41ff9402770fc32d4c0c11424f2ed",
+   "recovered_ixir1": {"reuses": 0, "rcops": 16, "live": 17, "frees": 0, "allocs": 17},
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 7,
+    "rcops": 16,
+    "peakLiveNodes": 17,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 7,
+    "allocs": 17},
+   "name": "mixed-cold",
+   "loop": "eaaf59e9b094712151dbc2fe3745905ac0b95f7c72ce6f582285794e031f05b3",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 7,
+    "rcops": 16,
+    "peakLiveNodes": 17,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 7,
+    "allocs": 17},
+   "literal_ixir1_root": "90e8a45bf0416aa50d1eebc93518aba8162cac2a9893cf38650580b1403b7605",
+   "literal_ixir1": {"reuses": 0, "rcops": 139, "live": 17, "frees": 37, "allocs": 54},
+   "input": [0, 3, 3, 18446744073709551616, 1, 42, 0],
+   "hpt_roots": ["7f946d775a83df362ddaa74c711bdad0e4857e315910fa7528003417c9767391"],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 16,
+    "peakLiveNodes": 17,
+    "hotResets": 0,
+    "frees": 0,
+    "coldResets": 0,
+    "allocs": 17},
+   "all_heaps_reclaimed": true,
+   "aliased": true}]}
diff --git a/Tests/Fixtures/Compiler/source-unique-reuse/expected.json b/Tests/Fixtures/Compiler/source-unique-reuse/expected.json
new file mode 100644
index 000000000..e0243eb25
--- /dev/null
+++ b/Tests/Fixtures/Compiler/source-unique-reuse/expected.json
@@ -0,0 +1,468 @@
+{"policy_and_rejection_checks":
+ ["v0-remains-conservative",
+  "v1-source-modes-accepted",
+  "indexed-recursor",
+  "motive-recursor",
+  "k-recursor",
+  "recursor-telescope-arity",
+  "rule-field-count",
+  "rule-drops-fields",
+  "rule-duplicates-accumulator",
+  "rule-partial-call",
+  "rule-escaping-lambda",
+  "rule-unknown-callable",
+  "argument-mode-identity",
+  "major-mode-identity",
+  "head-mode-identity",
+  "tail-mode-identity",
+  "result-mode-identity",
+  "mode-vector-arity",
+  "raw-wrong-builder",
+  "raw-wrong-recursor",
+  "raw-wrong-cons-arity",
+  "raw-wrong-nil-tag",
+  "raw-wrong-alias",
+  "raw-wrong-entry",
+  "instance-address-conflict",
+  "entry-shared-result",
+  "entry-free-variable",
+  "entry-unresolved-share",
+  "closed-entry-work-budget",
+  "target-duplicate-credit",
+  "target-stranded-credit",
+  "target-use-after-take",
+  "target-duplicate-unique-field",
+  "target-shared-reset-of-unique",
+  "target-wrong-constructor",
+  "target-nil-leak",
+  "target-layout-mismatch",
+  "later-owner-use",
+  "disabled-baseline",
+  "budget-baseline",
+  "target-budget-owned-fallback",
+  "control-budget-independent",
+  "reclamation-budget-independent"],
+ "format": "compilatrix/source-unique-reuse-report/1",
+ "cases":
+ [{"value": [],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "0cece6fe94ded91bebc9e1a42d5e29c4dc9189600ddaadddc06c0bfe9ddd90c9",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "023aff05bc75990f314fba5df00b4aa5bb8e43ea67edc1bc3afba49e90d4769e",
+   "snapshot": "empty.json",
+   "provenance": "b482d721821cafb9088459e5e7335c93aad358789960335e0aded87b11877bb8",
+   "prefixes": 8,
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "optimized": true,
+   "name": "empty",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2},
+   "ixir1_root": "dd08bbe6cfdd179d88241c7e9675aca4fc27619cb2a4af224314c896900acd0a",
+   "input": [],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 2,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 2}},
+  {"value": [17],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "55c6d489ffe64baae5d336d9b1d3a0b3acafbd1db4741af069077c2a1a1e57f9",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "054441d784aa53978b310470431381405b1bfeb6af48a2e76ae4da5a8646d19b",
+   "snapshot": "singleton.json",
+   "provenance": "214759c4253b729be7af6f6a6355159c88ce418c807d4bb5951bffb48794d6c2",
+   "prefixes": 13,
+   "physical":
+   {"reuses": 1,
+    "reusedPayloadUnits": 2,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 3},
+   "optimized": true,
+   "name": "singleton",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 2,
+    "coldResets": 0,
+    "allocs": 4},
+   "ixir1_root": "b2acc752240b518077d9fd11865a50d94163f5a2eebee13dbbd95bf23919e437",
+   "input": [17],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 3,
+    "hotResets": 0,
+    "frees": 2,
+    "coldResets": 0,
+    "allocs": 4}},
+  {"value": [3, 2, 1],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "7e664ab3081fac5d6a37d6ef3d24d3285c1fced39d4c15c8d61d4316831def76",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "1c2710d39a8f1c958b0fa35d39a30f5ce364aa7ee5e0158bcdc93b3a47e20fe0",
+   "snapshot": "three.json",
+   "provenance": "10d090564dfab1d170e67bf32d1bd8a3cfb660234c13734dc795aeba5a37ed46",
+   "prefixes": 23,
+   "physical":
+   {"reuses": 3,
+    "reusedPayloadUnits": 6,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 5},
+   "optimized": true,
+   "name": "three",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "ixir1_root": "4f51b681481b5eec6928ca1ea66c527db1429e0eee4595b23ed645bd00468b3a",
+   "input": [1, 2, 3],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8}},
+  {"value": [42, 18446744073709551623, 0, 3, 3, 18446744073709551616, 0],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "f29010dc556eb112f17a44261b0ddcb4cfa468f7cafa6ea1ef52b960c0192141",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "a9fd23f6a7cc92123d93c8a43bcc921ec53e5c79b43f1454a012821249a37b10",
+   "snapshot": "mixed-values.json",
+   "provenance": "f4d14fa4189a0fc0941b853abe1f0174ee0177a03abb3caf3cb72f836db258ad",
+   "prefixes": 43,
+   "physical":
+   {"reuses": 7,
+    "reusedPayloadUnits": 14,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 9},
+   "optimized": true,
+   "name": "mixed-values",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 8,
+    "coldResets": 0,
+    "allocs": 16},
+   "ixir1_root": "fcde8f3afe221f44bc2f60aefb24f1b44c42a80d538cce2bebb3582568d891cc",
+   "input": [0, 18446744073709551616, 3, 3, 0, 18446744073709551623, 42],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 9,
+    "hotResets": 0,
+    "frees": 8,
+    "coldResets": 0,
+    "allocs": 16}},
+  {"value":
+   [63,
+    62,
+    61,
+    60,
+    59,
+    58,
+    57,
+    56,
+    55,
+    54,
+    53,
+    52,
+    51,
+    50,
+    49,
+    48,
+    47,
+    46,
+    45,
+    44,
+    43,
+    42,
+    41,
+    40,
+    39,
+    38,
+    37,
+    36,
+    35,
+    34,
+    33,
+    32,
+    31,
+    30,
+    29,
+    28,
+    27,
+    26,
+    25,
+    24,
+    23,
+    22,
+    21,
+    20,
+    19,
+    18,
+    17,
+    16,
+    15,
+    14,
+    13,
+    12,
+    11,
+    10,
+    9,
+    8,
+    7,
+    6,
+    5,
+    4,
+    3,
+    2,
+    1,
+    0],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "35827046a4cede2556be331b93c8284fd879d08a1378f146da8edad9c35925b1",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "3bd1be01a9f931f9177edb9d54a1a8d75c34531b11bb3b3fd079f2bc611fe250",
+   "snapshot": "sixty-four.json",
+   "provenance": "5e5858487c5a50ae4748e070e50eacfe22e1b2ac25e6d974d94c2f6bd2a99015",
+   "prefixes": 328,
+   "physical":
+   {"reuses": 64,
+    "reusedPayloadUnits": 128,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 66,
+    "hotResets": 0,
+    "frees": 1,
+    "coldResets": 0,
+    "allocs": 66},
+   "optimized": true,
+   "name": "sixty-four",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 66,
+    "hotResets": 0,
+    "frees": 65,
+    "coldResets": 0,
+    "allocs": 130},
+   "ixir1_root": "2e3e9897f6873e9ea6f12d40e87e386837c5b6997ac54a06e886ff67293145b1",
+   "input":
+   [0,
+    1,
+    2,
+    3,
+    4,
+    5,
+    6,
+    7,
+    8,
+    9,
+    10,
+    11,
+    12,
+    13,
+    14,
+    15,
+    16,
+    17,
+    18,
+    19,
+    20,
+    21,
+    22,
+    23,
+    24,
+    25,
+    26,
+    27,
+    28,
+    29,
+    30,
+    31,
+    32,
+    33,
+    34,
+    35,
+    36,
+    37,
+    38,
+    39,
+    40,
+    41,
+    42,
+    43,
+    44,
+    45,
+    46,
+    47,
+    48,
+    49,
+    50,
+    51,
+    52,
+    53,
+    54,
+    55,
+    56,
+    57,
+    58,
+    59,
+    60,
+    61,
+    62,
+    63],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 66,
+    "hotResets": 0,
+    "frees": 65,
+    "coldResets": 0,
+    "allocs": 130}},
+  {"value": [3, 2, 1],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "7e664ab3081fac5d6a37d6ef3d24d3285c1fced39d4c15c8d61d4316831def76",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "1c2710d39a8f1c958b0fa35d39a30f5ce364aa7ee5e0158bcdc93b3a47e20fe0",
+   "snapshot": "disabled.json",
+   "provenance": "289e9e0e9157ed312d5fd3520ffe2f6336e84c87f3cd1936485fbaf70c5e6a13",
+   "prefixes": 26,
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "optimized": false,
+   "name": "disabled",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "ixir1_root": "4f51b681481b5eec6928ca1ea66c527db1429e0eee4595b23ed645bd00468b3a",
+   "input": [1, 2, 3],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8}},
+  {"value": [3, 2, 1],
+   "specialized_instance": "707da9d55cd9b4ee773182a0aaaf7d0c3e82039c6c67daf3e4ac166259573d7f",
+   "source_root": "7e664ab3081fac5d6a37d6ef3d24d3285c1fced39d4c15c8d61d4316831def76",
+   "source_instance": "c5c7f673266b5f186a98892b7a20fd2a24481cf84ac9e4de28cb722330f345aa",
+   "source_identity": "1c2710d39a8f1c958b0fa35d39a30f5ce364aa7ee5e0158bcdc93b3a47e20fe0",
+   "snapshot": "rewrite-budget.json",
+   "provenance": "289e9e0e9157ed312d5fd3520ffe2f6336e84c87f3cd1936485fbaf70c5e6a13",
+   "prefixes": 26,
+   "physical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "optimized": false,
+   "name": "rewrite-budget",
+   "logical":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8},
+   "ixir1_root": "4f51b681481b5eec6928ca1ea66c527db1429e0eee4595b23ed645bd00468b3a",
+   "input": [1, 2, 3],
+   "baseline":
+   {"reuses": 0,
+    "reusedPayloadUnits": 0,
+    "resetAttempts": 0,
+    "rcops": 0,
+    "peakLiveNodes": 5,
+    "hotResets": 0,
+    "frees": 4,
+    "coldResets": 0,
+    "allocs": 8}}]}
diff --git a/Tests/Fixtures/Compiler/x86/native_harness.c b/Tests/Fixtures/Compiler/x86/native_harness.c
new file mode 100644
index 000000000..ebb358b67
--- /dev/null
+++ b/Tests/Fixtures/Compiler/x86/native_harness.c
@@ -0,0 +1,15 @@
+#include <stdint.h>
+
+#ifndef EXPECTED_RESULT
+#error "EXPECTED_RESULT must be defined"
+#endif
+
+extern uint64_t compilatrix_main(void);
+
+uint64_t compilatrix_rt_allocate(uint64_t size, uint64_t alignment) {
+  return size == 16 && alignment == 8 ? 0x2000 : 0;
+}
+
+int main(void) {
+  return compilatrix_main() == (uint64_t)EXPECTED_RESULT ? 0 : 1;
+}
diff --git a/Tests/Ix/Compile/LevelSpellings.lean b/Tests/Ix/Compile/LevelSpellings.lean
index edf68641c..6f318dbe3 100644
--- a/Tests/Ix/Compile/LevelSpellings.lean
+++ b/Tests/Ix/Compile/LevelSpellings.lean
@@ -19,7 +19,7 @@
   Consumed by: `validateAuxClosure` (validate-aux / aux-gen-diff /
   decompile-diff), and — via the Tests binary env — the whole-env
   tc-roundtrip and kernel-ixon-roundtrip suites, where the stage-1
-  spelling decorations (Lean `Ix.Tc` + Rust kernel) are load-bearing.
+  spelling decorations (Lean `Ix.Kernel` + Rust kernel) are load-bearing.
 
   Import note: `Lean.Elab.BuiltinEvalCommand` (the `run_cmd` elab), NOT
   all of `Lean` — the roundtrip suites' envs are this file's module
diff --git a/Tests/Ix/IxVM.lean b/Tests/Ix/IxVM.lean
index b88fb524f..f31a12be2 100644
--- a/Tests/Ix/IxVM.lean
+++ b/Tests/Ix/IxVM.lean
@@ -397,89 +397,92 @@ private def nameOfString (str : String) : Lean.Name :=
 /-- Exact FFT-cost pins, one per checked constant. These are equality
     assertions, not budgets: any kernel change that shifts the cost of a
     listed constant fails the suite, so a regression cannot land quietly
-    and an improvement has to be acknowledged by re-pinning. -/
+    and an improvement has to be acknowledged by re-pinning. The current
+    pins include the range-checked call ranks that exclude cyclic proof
+    traces. Replaying the saved pre-hoist compiler on all 81 fixtures gave
+    identical shapes, query counts and costs to the repaired compiler. -/
 private def kernelCheckEntries : List (String × Nat) := [
-  ("HEq",                                                        129_564_470),
-  ("HEq.rec",                                                    133_835_705),
-  ("Eq.rec",                                                     133_138_274),
-  ("Nat",                                                        129_621_491),
-  ("Nat.add",                                                    170_279_105),
-  ("Nat.add_comm",                                               321_980_321),
-  ("Nat.decEq",                                                  378_967_182),
-  ("Nat.decLe",                                                  828_229_356),
-  ("Nat.sub_le_of_le_add",                                     2_002_029_582),
-  ("Nat.shiftRight_succ",                                      1_489_636_651),
-  ("Trans.mk",                                                   137_285_131),
-  ("Array.append_assoc",                                       9_591_140_574),
-  ("Vector.append",                                            9_797_860_114),
-  ("IxVMPrim.nat_add_lit",                                       212_935_828),
-  ("IxVMPrim.nat_sub_lit",                                       227_412_521),
-  ("IxVMPrim.nat_mul_lit",                                       203_329_765),
-  ("IxVMPrim.nat_mul_big",                                       201_839_360),
-  ("IxVMPrim.nat_div_lit",                                     1_453_803_136),
-  ("IxVMPrim.nat_mod_lit",                                     1_481_127_703),
-  ("IxVMPrim.nat_succ_lit",                                      144_204_806),
-  ("IxVMPrim.nat_pred_lit",                                      165_892_846),
-  ("IxVMPrim.nat_gcd_lit",                                     2_273_518_909),
-  ("IxVMPrim.nat_land_lit",                                    3_736_043_311),
-  ("IxVMPrim.nat_lor_lit",                                     3_738_141_327),
-  ("IxVMPrim.nat_xor_lit",                                     3_757_476_415),
-  ("IxVMPrim.nat_shl_lit",                                       232_977_972),
-  ("IxVMPrim.nat_shr_lit",                                     1_469_173_067),
-  ("IxVMPrim.nat_pow_big",                                       395_058_294),
-  ("IxVMPrim.nat_beq_lit",                                       201_050_808),
-  ("IxVMPrim.nat_ble_lit",                                       196_411_526),
-  ("IxVMPrim.nat_cases_big",                                     166_086_877),
-  ("IxVMPrim.nat_dec_le",                                        846_205_654),
-  ("IxVMPrim.nat_dec_lt",                                        857_785_145),
-  ("IxVMPrim.nat_dec_eq",                                        418_539_787),
-  ("IxVMPrim.str_size_lit",                                    2_601_268_988),
-  ("IxVMPrim.bv_to_nat_lit",                                   2_171_885_866),
-  ("IxVMInd.Even",                                               206_785_879),
-  ("IxVMInd.Odd",                                                206_790_506),
-  ("IxVMInd.Even.rec",                                           225_866_317),
-  ("IxVMInd.Odd.rec",                                            225_865_388),
-  ("IxVMInd.IdxTeleN.rec",                                       160_997_411),
-  ("IxVMInd.IdxTeleB.rec",                                       160_995_720),
-  ("IxVMInd.SoloA.rec",                                          156_110_660),
-  ("IxVMInd.SoloB.rec",                                          156_109_823),
-  ("IxVMInd.UnsafeSquash",                                       131_444_007),
-  ("IxVMInd.Tree",                                               131_234_364),
-  ("IxVMInd.Tree.rec",                                           142_072_778),
-  ("IxVMInd.DedupM",                                             134_569_557),
-  ("IxVMInd.DedupM.rec",                                         149_125_951),
-  ("IxVMInd.DepthM",                                             132_969_242),
-  ("IxVMInd.DepthM.rec",                                         144_766_024),
-  ("String.Internal.append",                                   2_571_540_103),
-  ("_private.Init.Prelude.0.Lean.extractMainModule._unsafe_rec", 3_816_761_597),
-  ("Lean.Syntax.rec",                                          2_634_207_003),
-  ("IxVMInd.AuxTie",                                             324_655_923),
-  ("IxVMInd.AuxTie.rec",                                         371_218_312),
-  ("IxVMInd.HiddenIdx",                                          130_537_050),
-  ("IxVMInd.HiddenIdx.rec",                                      133_953_792),
-  ("IxVMInd.thmMajorUse",                                        531_481_910),
-  ("IxVMInd.partialKRec",                                        150_273_491),
-  ("IxVMInd.deepRebase",                                         221_413_934),
-  ("String.Slice.Pattern.Model.NoPrefixPatternModel.rec",        3_574_081_528),
-  ("Lean.Widget.TaggedText.rec",                               2_604_242_616),
-  ("Lean.Doc.Part.rec",                                        2_650_681_603),
-  ("Lean.Doc.Block.rec",                                       2_896_995_259),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A", 132_540_004),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec", 136_184_354),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_1", 135_211_786),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_2", 135_211_786),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup2.A.rec_1", 135_211_786),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M", 132_835_263),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec", 144_932_073),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_1", 144_930_491),
-  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_2", 135_211_786),
-  ("strOfListFoldSize",                                        2_887_250_129),
-  ("strOfListFoldSizeAscii",                                   2_888_081_016),
-  ("IxVMPrim.lazy_ble_offset",                                   234_260_320),
-  ("IxVMPrim.lazy_unit_cast",                                    558_687_900),
-  ("IxVMPrim.sizeof_unit",                                       160_835_381),
-  ("IxVMPerf.let_continuations",                                 166_319_792),
-  ("IxVMPerf.mul_row",                                           425_316_349),
+  ("HEq",                                                                  130_090_954),
+  ("HEq.rec",                                                              137_909_914),
+  ("Eq.rec",                                                               136_341_791),
+  ("Nat",                                                                  130_054_762),
+  ("Nat.add",                                                              198_089_355),
+  ("Nat.add_comm",                                                         450_907_517),
+  ("Nat.decEq",                                                            579_933_652),
+  ("Nat.decLe",                                                            1_374_151_686),
+  ("Nat.sub_le_of_le_add",                                                 3_512_717_722),
+  ("Nat.shiftRight_succ",                                                  2_580_607_662),
+  ("Trans.mk",                                                             145_682_713),
+  ("Array.append_assoc",                                                   18_441_968_781),
+  ("Vector.append",                                                        18_792_389_683),
+  ("IxVMPrim.nat_add_lit",                                                 263_185_103),
+  ("IxVMPrim.nat_sub_lit",                                                 284_858_074),
+  ("IxVMPrim.nat_mul_lit",                                                 246_794_381),
+  ("IxVMPrim.nat_mul_big",                                                 244_670_826),
+  ("IxVMPrim.nat_div_lit",                                                 2_516_107_440),
+  ("IxVMPrim.nat_mod_lit",                                                 2_561_262_071),
+  ("IxVMPrim.nat_succ_lit",                                                151_011_643),
+  ("IxVMPrim.nat_pred_lit",                                                183_537_302),
+  ("IxVMPrim.nat_gcd_lit",                                                 3_967_567_725),
+  ("IxVMPrim.nat_land_lit",                                                6_541_881_254),
+  ("IxVMPrim.nat_lor_lit",                                                 6_544_683_932),
+  ("IxVMPrim.nat_xor_lit",                                                 6_572_795_021),
+  ("IxVMPrim.nat_shl_lit",                                                 291_927_345),
+  ("IxVMPrim.nat_shr_lit",                                                 2_537_721_403),
+  ("IxVMPrim.nat_pow_big",                                                 624_709_620),
+  ("IxVMPrim.nat_beq_lit",                                                 245_772_679),
+  ("IxVMPrim.nat_ble_lit",                                                 237_514_885),
+  ("IxVMPrim.nat_cases_big",                                               184_731_598),
+  ("IxVMPrim.nat_dec_le",                                                  1_401_740_664),
+  ("IxVMPrim.nat_dec_lt",                                                  1_419_739_251),
+  ("IxVMPrim.nat_dec_eq",                                                  641_792_129),
+  ("IxVMPrim.str_size_lit",                                                4_458_195_672),
+  ("IxVMPrim.bv_to_nat_lit",                                               3_771_232_141),
+  ("IxVMInd.Even",                                                         251_867_390),
+  ("IxVMInd.Odd",                                                          251_876_385),
+  ("IxVMInd.Even.rec",                                                     283_218_135),
+  ("IxVMInd.Odd.rec",                                                      283_217_206),
+  ("IxVMInd.IdxTeleN.rec",                                                 177_758_079),
+  ("IxVMInd.IdxTeleB.rec",                                                 177_756_387),
+  ("IxVMInd.SoloA.rec",                                                    169_490_637),
+  ("IxVMInd.SoloB.rec",                                                    169_489_800),
+  ("IxVMInd.UnsafeSquash",                                                 132_533_312),
+  ("IxVMInd.Tree",                                                         132_465_361),
+  ("IxVMInd.Tree.rec",                                                     150_007_288),
+  ("IxVMInd.DedupM",                                                       136_849_347),
+  ("IxVMInd.DedupM.rec",                                                   160_704_854),
+  ("IxVMInd.DepthM",                                                       134_794_495),
+  ("IxVMInd.DepthM.rec",                                                   154_786_142),
+  ("String.Internal.append",                                               4_412_600_485),
+  ("_private.Init.Prelude.0.Lean.extractMainModule._unsafe_rec",           6_623_269_202),
+  ("Lean.Syntax.rec",                                                      4_510_647_138),
+  ("IxVMInd.AuxTie",                                                       421_130_253),
+  ("IxVMInd.AuxTie.rec",                                                   498_369_501),
+  ("IxVMInd.HiddenIdx",                                                    131_307_848),
+  ("IxVMInd.HiddenIdx.rec",                                                137_016_950),
+  ("IxVMInd.thmMajorUse",                                                  854_283_334),
+  ("IxVMInd.partialKRec",                                                  162_364_021),
+  ("IxVMInd.deepRebase",                                                   278_978_593),
+  ("String.Slice.Pattern.Model.NoPrefixPatternModel.rec",                  6_264_972_735),
+  ("Lean.Widget.TaggedText.rec",                                           4_471_524_557),
+  ("Lean.Doc.Part.rec",                                                    4_549_127_864),
+  ("Lean.Doc.Block.rec",                                                   5_026_769_752),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A", 134_104_934),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec", 139_542_964),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_1", 139_569_956),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup1.A.rec_2", 139_569_956),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedup2.A.rec_1", 139_569_956),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M", 134_603_274),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec", 154_036_686),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_1", 154_035_103),
+  ("_private.Tests.Ix.Compile.Mutual.0.Tests.Ix.Compile.Mutual.AuxDedupMixed.M.rec_2", 139_569_956),
+  ("strOfListFoldSize",                                                    4_922_575_729),
+  ("strOfListFoldSizeAscii",                                               4_923_622_135),
+  ("IxVMPrim.lazy_ble_offset",                                             297_560_204),
+  ("IxVMPrim.lazy_unit_cast",                                              869_325_424),
+  ("IxVMPrim.sizeof_unit",                                                 174_444_569),
+  ("IxVMPerf.let_continuations",                                           204_655_451),
+  ("IxVMPerf.mul_row",                                                     573_828_577),
 ]
 
 /-- Variant of `kernelChecks`, pinned to the baseline
diff --git a/Tests/Ix/IxVM/Exploits.lean b/Tests/Ix/IxVM/Exploits.lean
index 33419a0a7..13cd8c4f8 100644
--- a/Tests/Ix/IxVM/Exploits.lean
+++ b/Tests/Ix/IxVM/Exploits.lean
@@ -430,7 +430,7 @@ position, the type reconstruction — EXCEPT `minor_var`
 (`Kernel/Check.lean:2573`), where `n_minors` ALONE selects which binder
 each canonical body points at. IxVM never compares the prover's declared
 `motives`/`minors` against the reconstruction; both references do
-(`inductive.rs:4945`, `Ix/Tc/Inductive.lean:2346`, error "arity metadata
+(`inductive.rs:4945`, `Ix/Kernel/Inductive.lean:2346`, error "arity metadata
 mismatch"). -/
 
 /-- Replace the innermost (non-`lam`) body of a `lam` telescope, keeping
@@ -591,9 +591,9 @@ def utf8SizeBeq (eqA boolA beqA sizeA blobA rhsA reflA : Address) :
 argument — the `[self : SizeOf Unit]` instance is never read. But
 `SizeOf` is a one-field class, so its instance is prover-chosen:
 `@SizeOf.sizeOf Unit ⟨fun _ => 5⟩ ()` is `5` in Lean (project the field,
-apply). lean4lean unfolds the instance and computes `5`; IxVM answers
-`1`. The reference IxVM kernels (`whnf.rs`, `Ix/Tc/Whnf.lean`) share the
-blindness, but lean4lean — the ground truth — does not, so the three do
+apply). the named specification unfolds the instance and computes `5`; IxVM answers
+`1`. The reference IxVM kernels (`whnf.rs`, `Ix/Kernel/Whnf.lean`) share the
+blindness, but the named specification — the ground truth — does not, so the three do
 NOT agree and IxVM is free to follow Lean. -/
 
 /-- `theorem _ : @SizeOf.sizeOf Unit ⟨fun _ => payload⟩ () = rhs := Eq.refl Nat rhs`
@@ -623,7 +623,7 @@ def sizeOfUnitInstanceThm (eqA natA sizeOfA mkA unitA unitUnitA reflA : Address)
 
 `is_prop_type` (`Ix/IxVM/Kernel/DefEq.lean:900`) decides Prop by testing
 the inferred sort against the STRUCTURAL node `KLevelNode.Zero`; all three
-references — including lean4lean, the ground truth — test SEMANTIC zero
+references — including the named specification, the ground truth — test SEMANTIC zero
 (`is_semantic_zero` / `isAlwaysZero`). `convert_univ` is a raw conversion,
 so a prover can author `Sort (max 0 0)`: semantically Prop, structurally
 `Max`. `try_struct_eta_iota` (`Whnf.lean:951`) then reduces a recursor on
@@ -1100,7 +1100,7 @@ def cases (base : Ixon.Env) (strAddr falseAddr : Address)
     -- prover-chosen. `@SizeOf.sizeOf Unit ⟨fun _ => 5⟩ ()` is 5 in Lean
     -- (project the field, apply `()`), but `try_reduce_size_of_unit`
     -- reads only the TYPE argument and folds to 1, so `… = 1` typechecks
-    -- by rfl. lean4lean unfolds the instance and rejects.
+    -- by rfl. the named specification unfolds the instance and rejects.
     { name := "sizeof-unit-ignores-instance"
       intent := "`@SizeOf.sizeOf Unit ⟨fun _ => 5⟩ () = 1` accepted by \
         rfl — a false equation, since projecting the prover's instance \
diff --git a/Tests/Ix/Tc/AccelDiff.lean b/Tests/Ix/Kernel/AccelDiff.lean
similarity index 93%
rename from Tests/Ix/Tc/AccelDiff.lean
rename to Tests/Ix/Kernel/AccelDiff.lean
index e9f096ae1..b7ad2f9a5 100644
--- a/Tests/Ix/Tc/AccelDiff.lean
+++ b/Tests/Ix/Kernel/AccelDiff.lean
@@ -1,8 +1,8 @@
 module
 
 public import LSpec
-public import Ix.Tc
-public import Tests.Ix.Tc.ParityEnv
+public import Ix.Kernel
+public import Tests.Ix.Kernel.ParityEnv
 
 /-!
 `tc-accel-diff` (ignored runner): differential fixtures for the
@@ -12,7 +12,7 @@ BOTH kernels (BitVec natives, Decidable natives, `reduceBool`/`reduceNat`
 markers, `Fin.val`-through-`Decidable.rec`), so cross-kernel diffing is
 structurally blind to a common bug — these fixtures check accelerated
 results against genuine pure reduction over the real env (compiled on
-demand — see `Tests.Tc.ParityEnv`; the pure path needs real definitions
+demand — see `Tests.Kernel.ParityEnv`; the pure path needs real definitions
 to delta-unfold).
 Small literals only: the pure path is exponential in literal size by
 design (see `TcState.noAccel`).
@@ -23,10 +23,10 @@ Comparison discipline: representation-producing accels (BitVec→Nat,
 the canonical accel proof term is a different-but-def-eq witness.
 -/
 
-namespace Tests.Tc.AccelDiff
+namespace Tests.Kernel.AccelDiff
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 abbrev AE := KExpr .anon
 
@@ -73,7 +73,7 @@ def ctorCase (ixonEnv : Ixon.Env) (name : String) (e : AE)
 
 public def run : IO UInt32 := do
   IO.println "tc-accel-diff"
-  let path ← Tests.Tc.ParityEnv.ensure
+  let path ← Tests.Kernel.ParityEnv.ensure
   let bytes ← IO.FS.readBinFile path
   match Ixon.deEnvAnon bytes with
   | .error e =>
@@ -99,4 +99,4 @@ public def run : IO UInt32 := do
           ok false == ok true && ok false) : Bool)
     lspecIO (.ofList [("tc-accel-diff", [seq])]) []
 
-end Tests.Tc.AccelDiff
+end Tests.Kernel.AccelDiff
diff --git a/Tests/Ix/Tc/AnonDiff.lean b/Tests/Ix/Kernel/AnonDiff.lean
similarity index 96%
rename from Tests/Ix/Tc/AnonDiff.lean
rename to Tests/Ix/Kernel/AnonDiff.lean
index 7ef55e177..865018fe2 100644
--- a/Tests/Ix/Tc/AnonDiff.lean
+++ b/Tests/Ix/Kernel/AnonDiff.lean
@@ -1,7 +1,7 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.CompileM
 public import Ix.KernelCheck
 public import Ix.Meta
@@ -12,7 +12,7 @@ Anon verdict differential (`tc-anon-diff`, ignored suite).
 
 Compiles Lean closures through the Rust compiler, writes the serialized env
 to a temp `.ixe`, and compares per-target verdicts: Rust kernel
-(`rsCheckAnonFFI`) vs pure-Lean `Ix.Tc.checkEnvAnon` over the same bytes.
+(`rsCheckAnonFFI`) vs pure-Lean `Ix.Kernel.checkEnvAnon` over the same bytes.
 
 Lean verdicts carrying a "not yet ported" stub message are counted and
 skipped — a guard from the incremental port, now expected to count zero
@@ -20,10 +20,10 @@ since inductive/recursor validation is in. Every other verdict must agree
 (pass/fail; messages are not compared).
 -/
 
-namespace Tests.Tc.AnonDiff
+namespace Tests.Kernel.AnonDiff
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 public section
 
@@ -126,4 +126,4 @@ public def suite : List TestSeq := [diffSuite]
 
 end
 
-end Tests.Tc.AnonDiff
+end Tests.Kernel.AnonDiff
diff --git a/Tests/Ix/Kernel/CheckPrimeGaps.lean b/Tests/Ix/Kernel/CheckPrimeGaps.lean
index c972e606b..d876b270c 100644
--- a/Tests/Ix/Kernel/CheckPrimeGaps.lean
+++ b/Tests/Ix/Kernel/CheckPrimeGaps.lean
@@ -71,7 +71,7 @@ def testRustCheckPrimeGaps : TestSeq :=
   ) .done
 
 def testLeanCheckPrimeGaps : TestSeq :=
-  .individualIO s!"Ix.Tc check {focusConsts.size} inlined PrimeGaps consts" none (do
+  .individualIO s!"Ix.Kernel check {focusConsts.size} inlined PrimeGaps consts" none (do
     let names ← filterFocusConsts focusConsts
     let leanEnv ← get_env!
     let (_, closedConsts) :=
diff --git a/Tests/Ix/Kernel/CheckTauCetiReduction.lean b/Tests/Ix/Kernel/CheckTauCetiReduction.lean
index 3af61243b..fc9cbb78f 100644
--- a/Tests/Ix/Kernel/CheckTauCetiReduction.lean
+++ b/Tests/Ix/Kernel/CheckTauCetiReduction.lean
@@ -58,7 +58,7 @@ def testRustCheckTauCetiReduction : TestSeq :=
   ) .done
 
 def testLeanCheckTauCetiReduction : TestSeq :=
-  .individualIO s!"Ix.Tc check {focusConsts.size} inlined TauCeti reductions" none (do
+  .individualIO s!"Ix.Kernel check {focusConsts.size} inlined TauCeti reductions" none (do
     let leanEnv ← get_env!
     let (_, closedConsts) :=
       Tests.Ix.Kernel.TutorialMeta.collectDepsWithExtras leanEnv {} focusConsts.toList
diff --git a/Tests/Ix/Tc/CheckTests.lean b/Tests/Ix/Kernel/CheckTests.lean
similarity index 98%
rename from Tests/Ix/Tc/CheckTests.lean
rename to Tests/Ix/Kernel/CheckTests.lean
index f5026dc06..6e22b7481 100644
--- a/Tests/Ix/Tc/CheckTests.lean
+++ b/Tests/Ix/Kernel/CheckTests.lean
@@ -1,24 +1,24 @@
 module
 
 public import LSpec
-public import Ix.Tc
-public import Tests.Ix.Tc.IxonFixtures
-public import Tests.Ix.Tc.IngressMetaTests
+public import Ix.Kernel
+public import Tests.Ix.Kernel.IxonFixtures
+public import Tests.Ix.Kernel.IngressMetaTests
 
 /-!
 Constant-checking tests: `checkConst` dispatch (axio/defn/theorem/quot paths),
 well-scopedness validation, the safety lattice, defn-block coordination with
 failure replay, the lazy-fault driver end-to-end (`TcState.newLazyAnon`,
-`checkEnvAnon`), and the parallel driver (`Ix.Tc.ParCheck`:
+`checkEnvAnon`), and the parallel driver (`Ix.Kernel.ParCheck`:
 `ingressAnonEnvParallel`/`ingressMetaEnvParallel` + `buildCheckWork` +
 `checkEnvParallel`) against the sequential verdicts.
 -/
 
-namespace Tests.Tc.CheckTests
+namespace Tests.Kernel.CheckTests
 
 open LSpec
-open Ix.Tc
-open Tests.Tc.Fixtures (storeConst storeMutsWithProjs axiomA envA)
+open Ix.Kernel
+open Tests.Kernel.Fixtures (storeConst storeMutsWithProjs axiomA envA)
 
 abbrev AE := KExpr .anon
 
@@ -515,7 +515,7 @@ def cacheIsolationTests : TestSeq :=
 
 Acceleration substitutes native semantics for the declarations at the
 hardcoded primitive addresses, so those must verify even when the caller
-skips integrity checking (`Ix/Tc/Primitive.lean` at `primAddrSet`). -/
+skips integrity checking (`Ix/Kernel/Primitive.lean` at `primAddrSet`). -/
 
 def primVerifyTests : TestSeq :=
   test "prim-addressed constant is verified even under verify := false"
@@ -912,7 +912,7 @@ def recursorTests : TestSeq :=
       failsContaining ixon recAddr
         "populate_recursor_rules_from_block: canonical header mismatch" : Bool))
 
-/-! ### Parallel driver (`Ix.Tc.ParCheck`) -/
+/-! ### Parallel driver (`Ix.Kernel.ParCheck`) -/
 
 /-- Env with two passing standalones (A, idA) and a passing inductive
     block (B, B.mk) — 4 targets, mirrors the `checkEnvAnon` lazy test. -/
@@ -1003,7 +1003,7 @@ def parallelTests : TestSeq :=
            run2 passed={r2.passed} fails={r2.failures.size}")
     | e1, e2 => return (false, 0, 0, some s!"{e1.isOk} {e2.isOk}")) .done
   ++ .individualIO "parallel meta check over meta fixture env" none (do
-    let (env, _, _) := Tests.Tc.IngressMeta.envMetaDefn
+    let (env, _, _) := Tests.Kernel.IngressMeta.envMetaDefn
     match ingressMetaEnvParallel env (chunkSize := 1) with
     | .error e => return (false, 0, 0, some s!"ingress: {e}")
     | .ok kenv =>
@@ -1023,4 +1023,4 @@ public def suite : List TestSeq :=
    lazyTests, cacheIsolationTests, primVerifyTests, inductiveTests,
    recursorTests, parallelTests]
 
-end Tests.Tc.CheckTests
+end Tests.Kernel.CheckTests
diff --git a/Tests/Ix/Tc/Roundtrip.lean b/Tests/Ix/Kernel/CheckerRoundtrip.lean
similarity index 92%
rename from Tests/Ix/Tc/Roundtrip.lean
rename to Tests/Ix/Kernel/CheckerRoundtrip.lean
index 44a990b5b..783f0cd54 100644
--- a/Tests/Ix/Tc/Roundtrip.lean
+++ b/Tests/Ix/Kernel/CheckerRoundtrip.lean
@@ -1,13 +1,13 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.CompileM
 public import Ix.CanonM
 public import Ix.Meta
 public import Ix.Common
-public import Tests.Ix.Tc.AnonDiff
-public import Tests.Ix.Tc.IxonFixtures
+public import Tests.Ix.Kernel.AnonDiff
+public import Tests.Ix.Kernel.IxonFixtures
 
 /-!
 Kernel ↔ Ixon roundtrip (`tc-roundtrip` ignored suite + `tc-unit` entries).
@@ -18,12 +18,12 @@ Two halves, mirroring the Rust `kernel-ixon-roundtrip`'s scope:
 ingressed into the pure-Lean kernel, egressed back to an `Ixon.Constant`,
 and compared **structurally** against the original (canonical forms —
 sharing expanded, tables renumbered, universes reduced; see
-`Ix.Tc.Egress`). Projections compare byte-exact. Certifies exactly the
+`Ix.Kernel.Egress`). Projections compare byte-exact. Certifies exactly the
 kernel-held, hash-relevant structure.
 
 **Meta** (full fidelity): the whole env is meta-ingressed (phase-parallel:
 chunked local envs merged via `KEnv.union`), every named entry is egressed
-back to `Ix.ConstantInfo` (`Ix.Tc.EgressLean`), and compared against
+back to `Ix.ConstantInfo` (`Ix.Kernel.EgressLean`), and compared against
 `CanonM.canonConst` of the source Lean constant with Rust `compare_envs`
 semantics — LEON content hashes are name/info/mdata-sensitive, so this
 certifies metadata fidelity too. Skipped with counts: aux-rewritten
@@ -41,18 +41,18 @@ Layers:
   this module's closure plus the level-spelling fixtures) — anon and
   meta. Parallel over the task pool. Arbitrary Lean files (and
   external `.ixe` images) go through `ix validate-lean` instead, which
-  shares the same drivers (`Ix.Tc.Validate`).
+  shares the same drivers (`Ix.Kernel.Validate`).
 -/
 
-namespace Tests.Tc.Roundtrip
+namespace Tests.Kernel.Roundtrip
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 public section
 
 /-- Roundtrip every work item of an env (shared driver:
-    `Ix.Tc.anonRoundtripEnv`). -/
+    `Ix.Kernel.anonRoundtripEnv`). -/
 def roundtripAll (ixonEnv : Ixon.Env) : Nat × Option String :=
   anonRoundtripEnv ixonEnv
 
@@ -66,7 +66,7 @@ def fixtureEnv : IO Lean.Environment :=
 
 /-! ### Fixture roundtrips + tamper negatives (`tc-unit`) -/
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- All hand-built fixture envs roundtrip clean. Exercises: axioms, defns
     with refs, nat/str literal blobs, `share` normalization, mutual `recur`
     blocks with projections, inductive blocks with ctor projections. -/
@@ -92,7 +92,7 @@ def fixtureTests : TestSeq := Id.run do
     ts := ts ++ .individualIO s!"roundtrip fixture: {label}" none testIO .done
   return ts
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Ingress a standalone fixture constant and hand back
     `(original, kernel constant)` for tampering. -/
 def ingressedStandalone (env : Ixon.Env) (addr : Address) :
@@ -119,7 +119,7 @@ def tamperCaught (original : Ixon.Constant) (tampered : KConst .anon)
     | .ok (some _) => true
     | .error _ => true
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Standalone recursor fixture (`R.rec`-shaped): one rule, for the
     dropped-rule tamper. -/
 def envRecrStandalone : Ixon.Env × Address := Id.run do
@@ -130,7 +130,7 @@ def envRecrStandalone : Ixon.Env × Address := Id.run do
   let addr := Address.blake3 (Ixon.serConstant c)
   return (env.storeConst addr c, addr)
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Standalone defn whose value is a `letE` (for the nonDep-flip tamper). -/
 def envLetDefn : Ixon.Env × Address := Id.run do
   let (env, aAddr) := envA
@@ -143,7 +143,7 @@ def envLetDefn : Ixon.Env × Address := Id.run do
 
 /-- Tamper 1: swap a defn's value for its type. -/
 def tamperDefnValue : Bool :=
-  let (env, _, idAddr) := Tests.Tc.Fixtures.envIdA
+  let (env, _, idAddr) := Tests.Kernel.Fixtures.envIdA
   match ingressedStandalone env idAddr with
   | .error _ => false
   | .ok (orig, kc) =>
@@ -209,7 +209,7 @@ def unitTests : List TestSeq := [fixtureTests, negativeTests]
     constant of the resulting env. -/
 def roundtripOnSeeds (leanEnv : Lean.Environment) (label : String)
     (seeds : List Lean.Name) : IO (Nat × Option String) := do
-  let consts := Tests.Tc.AnonDiff.closureOf leanEnv seeds
+  let consts := Tests.Kernel.AnonDiff.closureOf leanEnv seeds
   if consts.isEmpty then
     return (0, some s!"empty closure for {seeds}")
   let dir ← IO.FS.createTempDir
@@ -222,7 +222,7 @@ def roundtripOnSeeds (leanEnv : Lean.Environment) (label : String)
   | .ok ixonEnv => return roundtripAll ixonEnv
 
 def seedSets : List (String × List Lean.Name) :=
-  Tests.Tc.AnonDiff.seedSets ++
+  Tests.Kernel.AnonDiff.seedSets ++
   [ ("inductives-recursors",
       [`Nat.rec, `List.rec, `Acc.rec, `WellFounded.fix, `Prod.rec,
        `PSigma.rec, `Or.rec]),
@@ -254,7 +254,7 @@ def closureSuite : TestSeq := Id.run do
   let mut ts : TestSeq := .done
   for (label, seeds) in seedSets do
     ts := ts ++ .individualIO s!"roundtrip closure: {label}" none (do
-      let env ← Tests.Tc.Roundtrip.fixtureEnv
+      let env ← Tests.Kernel.Roundtrip.fixtureEnv
       let (rows, err?) ← roundtripOnSeeds env label seeds
       return (err?.isNone, rows, 0, err?)) .done
   return ts
@@ -266,7 +266,7 @@ def closureSuite : TestSeq := Id.run do
     `ix roundtrip-tc <path>` instead. -/
 def wholeEnvSuite : TestSeq :=
   .individualIO "roundtrip whole get_env environment" none (do
-    let leanEnv ← Tests.Tc.Roundtrip.fixtureEnv
+    let leanEnv ← Tests.Kernel.Roundtrip.fixtureEnv
     let consts := leanEnv.constants.toList
     let dir ← IO.FS.createTempDir
     let path := dir / "tc-roundtrip-whole-env.ixe"
@@ -293,10 +293,10 @@ names are informational `notFound`; aux-rewritten entries
 fidelity is covered by the anon roundtrip above). -/
 
 /-- Compile `consts` through the Rust compiler and run the shared meta
-    roundtrip driver (`Ix.Tc.metaRoundtripEnv`) against `leanEnv`. -/
+    roundtrip driver (`Ix.Kernel.metaRoundtripEnv`) against `leanEnv`. -/
 def metaRoundtripOn (leanEnv : Lean.Environment) (label : String)
     (consts : List (Lean.Name × Lean.ConstantInfo)) :
-    IO (Ix.Tc.MetaRoundtripReport × Option String) := do
+    IO (Ix.Kernel.MetaRoundtripReport × Option String) := do
   let dir ← IO.FS.createTempDir
   let path := dir / s!"tc-meta-roundtrip-{label}.ixe"
   let _ ← Ix.CompileM.rsCompileEnvBytesFFI consts path.toString true
@@ -322,8 +322,8 @@ def metaClosureSuite : TestSeq := Id.run do
   let mut ts : TestSeq := .done
   for (label, seeds) in seedSets do
     ts := ts ++ .individualIO s!"meta roundtrip closure: {label}" none (do
-      let env ← Tests.Tc.Roundtrip.fixtureEnv
-      let consts := Tests.Tc.AnonDiff.closureOf env seeds
+      let env ← Tests.Kernel.Roundtrip.fixtureEnv
+      let consts := Tests.Kernel.AnonDiff.closureOf env seeds
       let (report, err?) ← metaRoundtripOn env label consts
       return (err?.isNone, report.checked, 0, err?)) .done
   return ts
@@ -331,7 +331,7 @@ def metaClosureSuite : TestSeq := Id.run do
 /-- The centerpiece: meta roundtrip of the WHOLE current Lean env. -/
 def metaWholeEnvSuite : TestSeq :=
   .individualIO "meta roundtrip whole get_env environment" none (do
-    let leanEnv ← Tests.Tc.Roundtrip.fixtureEnv
+    let leanEnv ← Tests.Kernel.Roundtrip.fixtureEnv
     let (report, err?) ←
       metaRoundtripOn leanEnv "whole-env" leanEnv.constants.toList
     IO.println s!"[tc-meta-roundtrip] checked {report.checked}, \
@@ -344,4 +344,4 @@ public def suite : List TestSeq :=
 
 end
 
-end Tests.Tc.Roundtrip
+end Tests.Kernel.Roundtrip
diff --git a/Tests/Ix/Kernel/FocusedLeanCheck.lean b/Tests/Ix/Kernel/FocusedLeanCheck.lean
index 50a507c00..7919cd400 100644
--- a/Tests/Ix/Kernel/FocusedLeanCheck.lean
+++ b/Tests/Ix/Kernel/FocusedLeanCheck.lean
@@ -32,7 +32,7 @@ def checkClosure (tag fileStem : String)
         {status.ungrounded.size} constant(s); first: {first}")
 
     let bytes ← IO.FS.readBinFile path
-    let cfg : Ix.Tc.ParCheckCfg := {
+    let cfg : Ix.Kernel.ParCheckCfg := {
       workers := 1
       verbose := true
       progressMs := 0
@@ -43,7 +43,7 @@ def checkClosure (tag fileStem : String)
     let only := names.map fun name => toString name
     match ← Ix.Cli.CheckLeanCmd.runMetaCheck bytes cfg true none only none with
     | .error err =>
-        return (false, 0, names.size, some s!"[{tag}] Ix.Tc driver failed: {err}")
+        return (false, 0, names.size, some s!"[{tag}] Ix.Kernel driver failed: {err}")
     | .ok (report, workItems) =>
         IO.println s!"[{tag}] {report.passed}/{report.targetsCovered} passed in \
           {report.elapsedMs}ms"
diff --git a/Tests/Ix/Tc/InferDefEq.lean b/Tests/Ix/Kernel/InferDefEq.lean
similarity index 97%
rename from Tests/Ix/Tc/InferDefEq.lean
rename to Tests/Ix/Kernel/InferDefEq.lean
index 4d88638d0..e47097904 100644
--- a/Tests/Ix/Tc/InferDefEq.lean
+++ b/Tests/Ix/Kernel/InferDefEq.lean
@@ -1,22 +1,22 @@
 module
 
 public import LSpec
-public import Ix.Tc
-public import Tests.Ix.Tc.IxonFixtures
-public import Tests.Ix.Tc.WhnfTests
+public import Ix.Kernel
+public import Tests.Ix.Kernel.IxonFixtures
+public import Tests.Ix.Kernel.WhnfTests
 
 /-!
 Type inference and definitional equality with the real knot
-(`Ix.Tc.methodsN`). Exercises the tiers that were inert under stub methods:
+(`Ix.Kernel.methodsN`). Exercises the tiers that were inert under stub methods:
 K-like ctor synthesis in iota, proof irrelevance, lambda eta, struct eta,
 and unit-like equality.
 -/
 
-namespace Tests.Tc.InferDefEq
+namespace Tests.Kernel.InferDefEq
 
 open LSpec
-open Ix.Tc
-open Tests.Tc.Fixtures (storeConst storeMutsWithProjs axiomA)
+open Ix.Kernel
+open Tests.Kernel.Fixtures (storeConst storeMutsWithProjs axiomA)
 
 abbrev AE := KExpr .anon
 
@@ -137,7 +137,7 @@ def ingressEnvOf (p : Ixon.Env × Address) : AnonEnv :=
 
 /-- `A : Sort 1` plus `idA : A → A := λ a. a` and an axiom `c : A`. -/
 def baseEnv : AnonEnv × Address × Address × Address := Id.run do
-  let (ixon, aAddr) := Tests.Tc.Fixtures.envA
+  let (ixon, aAddr) := Tests.Kernel.Fixtures.envA
   let idDefn : Ixon.Constant :=
     ⟨.defn ⟨.defn, .safe, 0,
       .leanAll (.ref 0 #[]) (.ref 0 #[]), .leanLam (.ref 0 #[]) (.var 0)⟩,
@@ -151,7 +151,7 @@ def baseEnv : AnonEnv × Address × Address × Address := Id.run do
     `idA`. The hint channel is separate from the content-addressed constant. -/
 def sameHeadEnv (hints : Lean.ReducibilityHints) :
     AnonEnv × Address × Address × Address × Address := Id.run do
-  let (ixon, aAddr) := Tests.Tc.Fixtures.envA
+  let (ixon, aAddr) := Tests.Kernel.Fixtures.envA
   let idDefn : Ixon.Constant :=
     ⟨.defn ⟨.defn, .safe, 0,
       .leanAll (.ref 0 #[]) (.ref 0 #[]), .leanLam (.ref 0 #[]) (.var 0)⟩,
@@ -302,7 +302,7 @@ def defEqAdvanced : TestSeq :=
       -- irrelevance can.
       defEq env (pAddr hAddr) (pAddr hoAddr) : Bool))
   ++ test "lambda eta (λ x. f x ≡ f)"
-    ((let (ixon, aAddr) := Tests.Tc.Fixtures.envA
+    ((let (ixon, aAddr) := Tests.Kernel.Fixtures.envA
       let fAxio : Ixon.Constant :=
         ⟨.axio ⟨false, 0, .leanAll (.ref 0 #[]) (.ref 0 #[])⟩, #[], #[aAddr], #[]⟩
       let (ixon, fAddr) := storeConst ixon fAxio
@@ -411,4 +411,4 @@ def natOffsetTests : TestSeq :=
 public def suite : List TestSeq :=
   [knotFuelTests, inferTests, defEqBasics, defEqAdvanced, natOffsetTests]
 
-end Tests.Tc.InferDefEq
+end Tests.Kernel.InferDefEq
diff --git a/Tests/Ix/Tc/IngressMetaTests.lean b/Tests/Ix/Kernel/IngressMetaTests.lean
similarity index 96%
rename from Tests/Ix/Tc/IngressMetaTests.lean
rename to Tests/Ix/Kernel/IngressMetaTests.lean
index 17fe3b422..0801df2f3 100644
--- a/Tests/Ix/Tc/IngressMetaTests.lean
+++ b/Tests/Ix/Kernel/IngressMetaTests.lean
@@ -1,12 +1,12 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.CompileM
 public import Ix.Meta
 public import Ix.Common
-public import Tests.Ix.Tc.AnonDiff
-public import Tests.Ix.Tc.IxonFixtures
+public import Tests.Ix.Kernel.AnonDiff
+public import Tests.Ix.Kernel.IxonFixtures
 
 /-!
 Meta-mode ingress tests (`tc-unit` entries + `tc-ingress-meta` ignored).
@@ -26,10 +26,10 @@ item, and check per-named-entry address parity against the anon ingress
 of the same env. Whole-env meta scale is exercised by the R3 roundtrip.
 -/
 
-namespace Tests.Tc.IngressMeta
+namespace Tests.Kernel.IngressMeta
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 public section
 
@@ -64,7 +64,7 @@ def nId : Ix.Name := Ix.Name.mkStr Ix.Name.mkAnon "idA"
 def nX : Ix.Name := Ix.Name.mkStr Ix.Name.mkAnon "x"
 def nKey : Ix.Name := Ix.Name.mkStr Ix.Name.mkAnon "key"
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Axiom `A : Sort 1` with `.axio` metadata: name `A`, one level param
     `u`, leaf arena. -/
 def envMetaAxiom : Ixon.Env × Address := Id.run do
@@ -74,7 +74,7 @@ def envMetaAxiom : Ixon.Env × Address := Id.run do
   let env := withNamed env nA aAddr cm (extraNames := [nU])
   return (env, aAddr)
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Definition `idA : A → A := fun (x : A) => x` with full arena metadata:
     binder name `x` (implicit), and an mdata layer on the value root. -/
 def envMetaDefn : Ixon.Env × Address × Address := Id.run do
@@ -118,7 +118,7 @@ def metaAxiomChecks : Bool × Bool × Bool := Id.run do
     | some (.axio name levelParams _ _ _) =>
       -- Address parity with the anon ingress of the same env.
       let anonOk := Id.run do
-        match Tests.Tc.Fixtures.runIngress
+        match Tests.Kernel.Fixtures.runIngress
             (ingressAnonAddrShallow env aAddr) with
         | .ok (_, aenv) =>
           match aenv.get? ⟨aAddr, ()⟩, kenv.get? ⟨aAddr, nA⟩ with
@@ -156,7 +156,7 @@ def metaDefnChecks : Bool × Bool × Bool × Bool := Id.run do
 def metaDefnAddrParity : Bool := Id.run do
   let (env, dAddr, _) := envMetaDefn
   match ingressAllMeta env,
-        Tests.Tc.Fixtures.runIngress (ingressAnonAddrShallow env dAddr) with
+        Tests.Kernel.Fixtures.runIngress (ingressAnonAddrShallow env dAddr) with
   | .ok kenv, .ok (_, aenv) =>
     match kenv.get? ⟨dAddr, nId⟩, aenv.get? ⟨dAddr, ()⟩ with
     | some (.defn (ty := mty) (val := mval) ..),
@@ -165,7 +165,7 @@ def metaDefnAddrParity : Bool := Id.run do
     | _, _ => return false
   | _, _ => return false
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- `ref` without an arena `.ref` node is a hard error. -/
 def metaRefMissingArenaCaught : Bool := Id.run do
   let (env, aAddr) := envA
@@ -179,7 +179,7 @@ def metaRefMissingArenaCaught : Bool := Id.run do
   | .error e => return (e.splitOn "has no metadata name").length > 1
   | .ok _ => return false
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- `lam` without an arena binder soft-falls-back to a synthetic name. -/
 def metaLamSynthFallback : Bool := Id.run do
   let (env, aAddr) := envA
@@ -201,7 +201,7 @@ def metaLamSynthFallback : Bool := Id.run do
       return n == Ix.Name.mkStr Ix.Name.mkAnon "_s0"
     | _ => return false
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- A `callSite` arena node distributes canonical-arg metadata and names
     the head from the call-site's `name` field. -/
 def metaCallSiteFixture : Bool := Id.run do
@@ -271,7 +271,7 @@ def weirdULevel : Ix.Level :=
       (Ix.Level.mkParam nU))
     (Ix.Level.mkParam nU)
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Axiom `W.{u} : Sort (imax (imax 1 u) u)` — one weird table entry. -/
 def envWeirdSort : Ixon.Env × Address := Id.run do
   let c : Ixon.Constant := ⟨.axio ⟨false, 1, .sort 0⟩, #[], #[], #[weirdU]⟩
@@ -298,7 +298,7 @@ def decorSortChecks : Bool × Bool × Bool := Id.run do
         ty.addr == (KExpr.mkSort (m := .anon) (.mkParam 0 ())).addr
       -- Anon parity (tc-meta-addr survives the decoration).
       let parityOk := Id.run do
-        match Tests.Tc.Fixtures.runIngress
+        match Tests.Kernel.Fixtures.runIngress
             (ingressAnonAddrShallow env wAddr) with
         | .ok (_, aenv) =>
           match aenv.get? ⟨wAddr, ()⟩ with
@@ -326,7 +326,7 @@ def decorSortEgress : Bool × Bool := Id.run do
       | _ => return (false, false)
     | _ => return (false, false)
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Axiom `T.{u} : Sort (imax (imax 1 u) u) → Sort u` — BOTH spellings of
     one Géran class in one constant (the Design-A killer): the two sort
     occurrences share a semantic address but differ in decoration. -/
@@ -373,7 +373,7 @@ def decorTwinChecks : Bool × Bool × Bool := Id.run do
       | _ => return (false, false, false)
     | _ => return (false, false, false)
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- `gpoly.{u} : @fpoly.{imax (imax 1 u) u} → @fpoly.{u}` — const-arg
     twins: the two `const` occurrences share a semantic address but only
     the weird one carries a decoration (full original list). -/
@@ -422,7 +422,7 @@ def decorConstChecks : Bool × Bool × Bool := Id.run do
       | _ => return (false, false, false)
     | _ => return (false, false, false)
 
-open Tests.Tc.Fixtures in
+open Tests.Kernel.Fixtures in
 /-- Control: an already-normal spelling (`max u v`) gets NO decoration. -/
 def decorNormalControl : Bool := Id.run do
   let c : Ixon.Constant :=
@@ -479,7 +479,7 @@ def unitTests : List TestSeq :=
     `(namedChecked, firstErr?)`. -/
 def closureParity (leanEnv : Lean.Environment) (label : String)
     (seeds : List Lean.Name) : IO (Nat × Option String) := do
-  let consts := Tests.Tc.AnonDiff.closureOf leanEnv seeds
+  let consts := Tests.Kernel.AnonDiff.closureOf leanEnv seeds
   if consts.isEmpty then
     return (0, some s!"empty closure for {seeds}")
   let dir ← IO.FS.createTempDir
@@ -495,7 +495,7 @@ def closureParity (leanEnv : Lean.Environment) (label : String)
       | .error e => return (0, some s!"meta ingress failed: {e}")
       | .ok kenv => pure kenv
     -- Anon ingress of the whole env.
-    let aenv ← match Tests.Tc.Fixtures.runIngress (do
+    let aenv ← match Tests.Kernel.Fixtures.runIngress (do
         match buildAnonWork ixonEnv with
         | .error e => throw e
         | .ok work =>
@@ -529,7 +529,7 @@ def closureParity (leanEnv : Lean.Environment) (label : String)
     return (checked, firstErr)
 
 def suite : List TestSeq :=
-  (Tests.Tc.AnonDiff.seedSets ++
+  (Tests.Kernel.AnonDiff.seedSets ++
     [("inductives-recursors",
       [`Nat.rec, `List.rec, `Acc.rec, `Prod.rec, `PSigma.rec])]).map
     fun (label, seeds) =>
@@ -540,4 +540,4 @@ def suite : List TestSeq :=
 
 end
 
-end Tests.Tc.IngressMeta
+end Tests.Kernel.IngressMeta
diff --git a/Tests/Ix/Tc/InitScale.lean b/Tests/Ix/Kernel/InitScale.lean
similarity index 94%
rename from Tests/Ix/Tc/InitScale.lean
rename to Tests/Ix/Kernel/InitScale.lean
index 19553e059..7bff70048 100644
--- a/Tests/Ix/Tc/InitScale.lean
+++ b/Tests/Ix/Kernel/InitScale.lean
@@ -1,9 +1,9 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.KernelCheck
-public import Tests.Ix.Tc.AnonDiff
+public import Tests.Ix.Kernel.AnonDiff
 
 /-!
 Init-scale anon verdict differential (`tc-init`, ignored suite).
@@ -20,10 +20,10 @@ Two modes:
 Acceptance: zero verdict mismatches vs `rsCheckAnonFFI`.
 -/
 
-namespace Tests.Tc.InitScale
+namespace Tests.Kernel.InitScale
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 /-- Broad Init-representative seeds: arithmetic, containers, characters,
     strings, well-founded recursion, decidability, structures with
@@ -89,11 +89,11 @@ def envGatedSuite : TestSeq := Id.run do
     | none =>
       let env ← get_env!
       let (compared, skipped, diff?) ←
-        Tests.Tc.AnonDiff.diffOnSeeds env "init-scale" initSeeds
+        Tests.Kernel.AnonDiff.diffOnSeeds env "init-scale" initSeeds
       let msg := diff?.map (s!"compared {compared}, skipped {skipped}: " ++ ·)
       return (diff?.isNone && skipped == 0, compared, skipped, msg)) .done
   return ts
 
 public def suite : List TestSeq := [envGatedSuite]
 
-end Tests.Tc.InitScale
+end Tests.Kernel.InitScale
diff --git a/Tests/Ix/Tc/IxonFixtures.lean b/Tests/Ix/Kernel/IxonFixtures.lean
similarity index 98%
rename from Tests/Ix/Tc/IxonFixtures.lean
rename to Tests/Ix/Kernel/IxonFixtures.lean
index d636767f7..e516d38d1 100644
--- a/Tests/Ix/Tc/IxonFixtures.lean
+++ b/Tests/Ix/Kernel/IxonFixtures.lean
@@ -1,26 +1,26 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 
 /-!
-Hand-built `Ixon.Env` fixtures for `Ix.Tc` ingress tests (no FFI, no
+Hand-built `Ixon.Env` fixtures for `Ix.Kernel` ingress tests (no FFI, no
 compiler): constants stored at `blake3 (serConstant c)`, mutual blocks stored
 together with all their projection constants (mirroring what the compiler
 emits), plus ingress negative cases (index OOB, missing blob, missing
 projection, integrity violation).
 
 The accept tests assert exact kernel node addresses computed independently
-via the `Ix.Tc` smart constructors — a pure-Lean end-to-end check of the
+via the `Ix.Kernel` smart constructors — a pure-Lean end-to-end check of the
 index-resolution + Blake3 pipeline.
 -/
 
 public section
 
-namespace Tests.Tc.Fixtures
+namespace Tests.Kernel.Fixtures
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 /-! ### Builders -/
 
@@ -322,6 +322,6 @@ def rejectTests : TestSeq :=
 
 public def suite : List TestSeq := [acceptTests, rejectTests]
 
-end Tests.Tc.Fixtures
+end Tests.Kernel.Fixtures
 
 end
diff --git a/Tests/Ix/Kernel/NatReduction.lean b/Tests/Ix/Kernel/NatReduction.lean
index 0058315cc..89be42574 100644
--- a/Tests/Ix/Kernel/NatReduction.lean
+++ b/Tests/Ix/Kernel/NatReduction.lean
@@ -2,7 +2,7 @@
   Comprehensive Nat literal reduction tests.
 
   See `docs/nat-reduction-audit.md` for the reference comparison
-  (Ix kernel vs `refs/lean4` and `refs/lean4lean`).
+  (Ix kernel vs `refs/lean4` and `refs/the named specification`).
 
   Tests use hand-built `Lean.Declaration` values with raw `.lit (.natVal _)`
   expressions rather than `by rfl` over surface syntax. This bypasses
diff --git a/Tests/Ix/Tc/ParityEnv.lean b/Tests/Ix/Kernel/ParityEnv.lean
similarity index 97%
rename from Tests/Ix/Tc/ParityEnv.lean
rename to Tests/Ix/Kernel/ParityEnv.lean
index 9b2afb0bf..672280506 100644
--- a/Tests/Ix/Tc/ParityEnv.lean
+++ b/Tests/Ix/Kernel/ParityEnv.lean
@@ -16,7 +16,7 @@ plus the checked-in seed list when the file isn't already present, so the tests
 run unconditionally instead of skipping when no fixture is supplied.
 -/
 
-namespace Tests.Tc.ParityEnv
+namespace Tests.Kernel.ParityEnv
 
 open Lean
 
@@ -49,4 +49,4 @@ public def ensure : IO System.FilePath := do
   let _ ← Ix.CompileM.rsCompileEnvBytesFFI closed out.toString false
   return out
 
-end Tests.Tc.ParityEnv
+end Tests.Kernel.ParityEnv
diff --git a/Tests/Ix/Tc/Pins.lean b/Tests/Ix/Kernel/Pins.lean
similarity index 94%
rename from Tests/Ix/Tc/Pins.lean
rename to Tests/Ix/Kernel/Pins.lean
index 0fb67426a..847d9c3e6 100644
--- a/Tests/Ix/Tc/Pins.lean
+++ b/Tests/Ix/Kernel/Pins.lean
@@ -1,26 +1,26 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.Cli.CheckLeanCmd
-public import Tests.Ix.Tc.ParityEnv
+public import Tests.Ix.Kernel.ParityEnv
 
 /-!
 `tc-pins` (ignored runner): regression pins for the pure-Lean kernel
-against a real serialized env (compiled on demand — see `Tests.Tc.ParityEnv`).
+against a real serialized env (compiled on demand — see `Tests.Kernel.ParityEnv`).
 Each pin is a constant that previously OOMed, was falsely rejected at
 depth 2001, or blew the worker stack (see the short-circuit note in
-`Ix/Tc/DefEq.lean` and `ParCheckCfg.stackBytes`); the suite ingresses
+`Ix/Kernel/DefEq.lean` and `ParCheckCfg.stackBytes`); the suite ingresses
 the env once and checks each pin subject-only under a wall-clock budget.
 Budgets are generous — the pins guard ∞/OOM regression classes, not
 micro-perf. Known-slow pins (open perf issues) run only with
 `IX_PINS_SLOW=1`.
 -/
 
-namespace Tests.Tc.Pins
+namespace Tests.Kernel.Pins
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 structure Pin where
   /-- Fail-out-style label (meta-mode Lean name rendering). -/
@@ -76,7 +76,7 @@ def checkPin (kenv : MetaEnv) (prims : Primitives .meta)
 
 public def run : IO UInt32 := do
   IO.println "tc-pins"
-  let path ← Tests.Tc.ParityEnv.ensure
+  let path ← Tests.Kernel.ParityEnv.ensure
   let includeSlow := (← IO.getEnv "IX_PINS_SLOW").isSome
   let t0 ← IO.monoMsNow
   let bytes ← IO.FS.readBinFile path
@@ -99,4 +99,4 @@ public def run : IO UInt32 := do
           seq := seq ++ (← checkPin kenv prims work pin)
       lspecIO (.ofList [("tc-pins", [seq])]) []
 
-end Tests.Tc.Pins
+end Tests.Kernel.Pins
diff --git a/Tests/Ix/Kernel/PrimAddrs.lean b/Tests/Ix/Kernel/PrimAddrs.lean
index 68f638e96..3615c1721 100644
--- a/Tests/Ix/Kernel/PrimAddrs.lean
+++ b/Tests/Ix/Kernel/PrimAddrs.lean
@@ -19,7 +19,7 @@
 
   This test closes that class. It reads the byte arrays out of the
   ELABORATED toplevel — not the source text — and compares each against
-  the address computed at test runtime from `Ix.Tc.PrimAddrs`, which is
+  the address computed at test runtime from `Ix.Kernel.PrimAddrs`, which is
   the same table the host-side closure walker and ingress verifier use.
   Any drift between the two sources of truth fails here.
 
@@ -32,7 +32,7 @@ import Ix.Meta
 import Ix.Aiur.Compiler
 import Ix.IxVM
 import Ix.IxVM.Toplevel
-import Ix.Tc.Primitive
+import Ix.Kernel.Primitive
 import LSpec
 
 open LSpec
@@ -68,12 +68,12 @@ private def collectAddrFns (t : Aiur.Source.Toplevel) :
 
 /-- The canonical address set, computed at test runtime from the Lean
     parity table + reserved markers — the same source the host closure
-    walker (`Ix.Tc.primAddrSet`) consults. -/
+    walker (`Ix.Kernel.primAddrSet`) consults. -/
 private def canonical : Std.HashMap Address String := Id.run do
   let mut m : Std.HashMap Address String := {}
-  for (name, a) in Ix.Tc.PrimAddrs.leanParityTable do
+  for (name, a) in Ix.Kernel.PrimAddrs.leanParityTable do
     m := m.insert a name
-  for (name, a) in Ix.Tc.PrimAddrs.reservedMarkerAddrs do
+  for (name, a) in Ix.Kernel.PrimAddrs.reservedMarkerAddrs do
     m := m.insert a name
   return m
 
diff --git a/Tests/Ix/Tc/Substrate.lean b/Tests/Ix/Kernel/Substrate.lean
similarity index 98%
rename from Tests/Ix/Tc/Substrate.lean
rename to Tests/Ix/Kernel/Substrate.lean
index c5fadfb1d..ebf1139df 100644
--- a/Tests/Ix/Tc/Substrate.lean
+++ b/Tests/Ix/Kernel/Substrate.lean
@@ -1,10 +1,10 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 
 /-!
-Unit tests for the `Ix.Tc` substrate (Equiv/Primitive/Env/Subst/Lctx/Monad):
+Unit tests for the `Ix.Kernel` substrate (Equiv/Primitive/Env/Subst/Lctx/Monad):
 subst/lift/instantiateRev/abstractFVars round-trips (ported from subst.rs
 tests), cheap-beta cases, ctx-id chain determinism, suffix-aware cache keys,
 fuel/tick semantics under EStateM, union-find behavior, local-context
@@ -12,10 +12,10 @@ open/close, universe instantiation, and the primitives parity check against
 the live Rust `PrimAddrs::new()` table (FFI).
 -/
 
-namespace Tests.Tc.Substrate
+namespace Tests.Kernel.Substrate
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 /-! ### Helpers -/
 
@@ -473,4 +473,4 @@ public def suite : List TestSeq :=
    cheapBetaTests, internTests, equivTests, ctxTests, fuelTests,
    openBinderTests, univInstTests, envTests, primsParity]
 
-end Tests.Tc.Substrate
+end Tests.Kernel.Substrate
diff --git a/Tests/Ix/Tc/TutorialTc.lean b/Tests/Ix/Kernel/TutorialTc.lean
similarity index 96%
rename from Tests/Ix/Tc/TutorialTc.lean
rename to Tests/Ix/Kernel/TutorialTc.lean
index a65055b61..91c30e44c 100644
--- a/Tests/Ix/Tc/TutorialTc.lean
+++ b/Tests/Ix/Kernel/TutorialTc.lean
@@ -1,11 +1,11 @@
 /-
-  Kernel tutorial test cases through the pure-Lean `Ix.Tc` kernel
+  Kernel tutorial test cases through the pure-Lean `Ix.Kernel` kernel
   (`tc-tutorial`, ignored suite).
 
   Mirrors `Tests/Ix/Kernel/Tutorial.lean` (the Rust-kernel runner): reads
   the same good/bad test cases registered by `TutorialDefs.lean`, compiles
   each batch through the Rust compiler to Ixon bytes, and checks verdicts
-  with `Ix.Tc.checkEnvAnon` instead of `rsCheckConstsFFI`.
+  with `Ix.Kernel.checkEnvAnon` instead of `rsCheckConstsFFI`.
 
   Differences from the Rust runner, by necessity:
   - Renaming test cases are skipped (their collision check is Lean-side
@@ -26,14 +26,14 @@
 import Ix.Common
 import Ix.Meta
 import Ix.CompileM
-import Ix.Tc
+import Ix.Kernel
 import Tests.Ix.Kernel.TutorialMeta
 import Tests.Ix.Kernel.TutorialDefs
 import LSpec
 
 open LSpec
 
-namespace Tests.Tc.TutorialTc
+namespace Tests.Kernel.TutorialTc
 
 /-- Same closure walk as `Tutorial.lean`'s `collectDepsWithExtras` (that one
     is `private`). -/
@@ -83,7 +83,7 @@ partial def collectDepsWithExtras
   let closed := env.constants.toList.filter fun (n, _) => needed.contains n
   return (needed, closed)
 
-/-- Compile a batch and check it through Ix.Tc. Returns
+/-- Compile a batch and check it through Ix.Kernel. Returns
     `name ↦ (none = passed | some err)`; `.error` when the whole batch
     failed to compile (callers decide how that maps to expectations). -/
 def checkBatchTc (consts : List (Lean.Name × Lean.ConstantInfo))
@@ -106,12 +106,12 @@ def checkBatchTc (consts : List (Lean.Name × Lean.ConstantInfo))
     let fullEnv ← match Ixon.deEnv bytes with
       | .ok env => pure env
       | .error e => return .error s!"deEnv failed: {e}"
-    let verdicts ← match Ix.Tc.checkIxeBytesAnon bytes with
+    let verdicts ← match Ix.Kernel.checkIxeBytesAnon bytes with
       | .ok results => pure (results.foldl (init :=
           (Std.HashMap.emptyWithCapacity results.size :
             Std.HashMap Address (Option String)))
           fun acc r => acc.insert r.addr r.err?)
-      | .error e => return .error s!"Ix.Tc driver failed: {e}"
+      | .error e => return .error s!"Ix.Kernel driver failed: {e}"
     let mut out : Std.HashMap Lean.Name (Option String) := {}
     for n in names do
       let ixName := Ix.Name.fromLeanName n
@@ -124,7 +124,7 @@ def checkBatchTc (consts : List (Lean.Name × Lean.ConstantInfo))
     return .ok out
 
 def testTutorialTc : TestSeq :=
-  .individualIO "Ix.Tc kernel tutorial checks" none (do
+  .individualIO "Ix.Kernel kernel tutorial checks" none (do
     let leanEnv ← get_env!
     let testCases := Tests.Ix.Kernel.TutorialMeta.getTestCases leanEnv
     let rawConsts := Tests.Ix.Kernel.TutorialMeta.getRawConsts leanEnv
@@ -256,4 +256,4 @@ def testTutorialTc : TestSeq :=
 
 def suite : List TestSeq := [testTutorialTc]
 
-end Tests.Tc.TutorialTc
+end Tests.Kernel.TutorialTc
diff --git a/Tests/Ix/Tc/Unit.lean b/Tests/Ix/Kernel/Unit.lean
similarity index 98%
rename from Tests/Ix/Tc/Unit.lean
rename to Tests/Ix/Kernel/Unit.lean
index 40e8cbc1d..7a3dc1766 100644
--- a/Tests/Ix/Tc/Unit.lean
+++ b/Tests/Ix/Kernel/Unit.lean
@@ -1,12 +1,12 @@
 module
 
 public import LSpec
-public import Ix.Tc
+public import Ix.Kernel
 public import Ix.IxonUniv
 public import Tests.Gen.Ixon
 
 /-!
-Unit tests for the `Ix.Tc` foundations (Mode/Id/Level/Expr/Const):
+Unit tests for the `Ix.Kernel` foundations (Mode/Id/Level/Expr/Const):
 
 - raw-node address parity with the existing `Ix.Level` wire constructors
   (shared tag bytes ⇒ shared preimages for closed levels)
@@ -17,10 +17,10 @@ Unit tests for the `Ix.Tc` foundations (Mode/Id/Level/Expr/Const):
 - seeded property tests (xorshift PRNG ported from level.rs)
 -/
 
-namespace Tests.Tc.Unit
+namespace Tests.Kernel.Unit
 
 open LSpec
-open Ix.Tc
+open Ix.Kernel
 
 /-! ### Helpers -/
 
@@ -412,7 +412,7 @@ linearizer bug found during development lived there), plus:
 - P4 against the kernel's own Géran machinery (`Level.normalizeLevel`
   on the mk*-rebuilt `KUniv`s), modulo subsumption's empty-entry
   artifacts — see the `Ix/IxonUniv.lean` module-doc O1 note;
-- the `Ixon.reduceUniv` ≍ `Ix.Tc.reduceIxonUniv` twin pin (same
+- the `Ixon.reduceUniv` ≍ `Ix.Kernel.reduceIxonUniv` twin pin (same
   closure, one via transliterated rules, one via the kernel's actual
   smart constructors — drift here would desync the stage-1 decoration
   test from what ingress really does). -/
@@ -479,7 +479,7 @@ def canonUnivTests : TestSeq :=
   ++ test "canonUniv P4: kernel Géran oracle, modulo empty entries \
            (exhaustive ≤6)" p4
   ++ test "canonUniv P6: mk* rebuild absorbed (exhaustive ≤6)" p6
-  ++ test "reduceUniv ≍ Tc.reduceIxonUniv twin agreement (exhaustive ≤6)"
+  ++ test "reduceUniv ≍ Kernel.reduceIxonUniv twin agreement (exhaustive ≤6)"
     agree
 
 public def suite : List TestSeq :=
@@ -487,4 +487,4 @@ public def suite : List TestSeq :=
     canonicalTotalizationTests, occurrenceTests, exprInfo, smartCtors,
     levelAlgebra, props, modeTests, canonUnivTests]
 
-end Tests.Tc.Unit
+end Tests.Kernel.Unit
diff --git a/Tests/Ix/Tc/WhnfTests.lean b/Tests/Ix/Kernel/WhnfTests.lean
similarity index 98%
rename from Tests/Ix/Tc/WhnfTests.lean
rename to Tests/Ix/Kernel/WhnfTests.lean
index 88c2e1cb1..08f764f4e 100644
--- a/Tests/Ix/Tc/WhnfTests.lean
+++ b/Tests/Ix/Kernel/WhnfTests.lean
@@ -1,8 +1,8 @@
 module
 
 public import LSpec
-public import Ix.Tc
-public import Tests.Ix.Tc.IxonFixtures
+public import Ix.Kernel
+public import Tests.Ix.Kernel.IxonFixtures
 
 /-!
 Whnf tests, run with throw-stub `Methods`: the infer/isDefEq back-edges
@@ -13,11 +13,11 @@ reduction in isolation. Assertions are by exact node address.
 
 public section
 
-namespace Tests.Tc.WhnfTests
+namespace Tests.Kernel.WhnfTests
 
 open LSpec
-open Ix.Tc
-open Tests.Tc.Fixtures (storeConst storeMutsWithProjs runIngress axiomA)
+open Ix.Kernel
+open Tests.Kernel.Fixtures (storeConst storeMutsWithProjs runIngress axiomA)
 
 abbrev AE := KExpr .anon
 
@@ -417,6 +417,6 @@ public def suite : List TestSeq :=
   [pureHelperTests, structuralTests, iotaTests, natTests, nativeTests,
     cacheTests]
 
-end Tests.Tc.WhnfTests
+end Tests.Kernel.WhnfTests
 
 end
diff --git a/Tests/Ix/Lean4Lean.lean b/Tests/Ix/Lean4Lean.lean
deleted file mode 100644
index 00ead89ce..000000000
--- a/Tests/Ix/Lean4Lean.lean
+++ /dev/null
@@ -1,37 +0,0 @@
-import LSpec
-import Benchmarks.Lean4Lean
-
-/-!
-Smoke tests for the lean4lean dependency (ignored runner `lean4lean`):
-the reference Lean4-in-Lean4 kernel accepts a real closure replayed from
-the test env and rejects an ill-typed declaration. Guards the pinned
-require (toolchain drift or an API change in `Lean4Lean.addDecl` surfaces
-here and in `bench-lean4lean`, which shares the replay machinery).
--/
-
-namespace Tests.Ix.Lean4Lean
-
-open LSpec
-
-def run (env : Lean.Environment) : IO UInt32 := do
-  IO.println "lean4lean"
-  let newConstants := env.constants.fold
-    (init := ({} : Std.HashMap Lean.Name Lean.ConstantInfo)) fun m n ci => m.insert n ci
-  -- Accept: replay a real constant's whole closure into a fresh kernel env
-  -- (the `bench-lean4lean --consts` path).
-  let closRes ← (BenchLean4Lean.replayClosure env newConstants `Nat.add_comm false).toBaseIO
-  -- Reject: an axiom whose type is a Nat literal (not a sort) must fail
-  -- `checkConstantVal`.
-  let bogus : Lean.AxiomVal :=
-    { name := `l4lTestBogusAxiom, levelParams := [], type := Lean.mkRawNatLit 0
-      isUnsafe := false }
-  let rejected := !(Lean4Lean.addAxiom env.toKernelEnv bogus).isOk
-  let seq : TestSeq :=
-    (match closRes with
-     | .ok n => test s!"Nat.add_comm closure replays through lean4lean ({n} declarations)"
-         (n > 0)
-     | .error e => test s!"Nat.add_comm closure replay failed: {e}" false)
-    ++ test "ill-typed axiom (type = Nat literal) is rejected" rejected
-  lspecIO (.ofList [("lean4lean", [seq])]) []
-
-end Tests.Ix.Lean4Lean
diff --git a/Tests/Main.lean b/Tests/Main.lean
index 589e6765d..01f9d5b2b 100644
--- a/Tests/Main.lean
+++ b/Tests/Main.lean
@@ -34,19 +34,19 @@ import Tests.Ix.RustSerialize
 import Tests.Ix.RustDecompile
 import Tests.Ix.Sharing
 import Tests.Ix.BenchMeasures
-import Tests.Ix.Tc.Unit
-import Tests.Ix.Tc.Substrate
-import Tests.Ix.Tc.IxonFixtures
-import Tests.Ix.Tc.WhnfTests
-import Tests.Ix.Tc.InferDefEq
-import Tests.Ix.Tc.CheckTests
-import Tests.Ix.Tc.AnonDiff
-import Tests.Ix.Tc.InitScale
-import Tests.Ix.Tc.TutorialTc
-import Tests.Ix.Tc.Roundtrip
-import Tests.Ix.Tc.IngressMetaTests
-import Tests.Ix.Tc.Pins
-import Tests.Ix.Tc.AccelDiff
+import Tests.Ix.Kernel.Unit
+import Tests.Ix.Kernel.Substrate
+import Tests.Ix.Kernel.IxonFixtures
+import Tests.Ix.Kernel.WhnfTests
+import Tests.Ix.Kernel.InferDefEq
+import Tests.Ix.Kernel.CheckTests
+import Tests.Ix.Kernel.AnonDiff
+import Tests.Ix.Kernel.InitScale
+import Tests.Ix.Kernel.TutorialTc
+import Tests.Ix.Kernel.CheckerRoundtrip
+import Tests.Ix.Kernel.IngressMetaTests
+import Tests.Ix.Kernel.Pins
+import Tests.Ix.Kernel.AccelDiff
 import Tests.Ix.CanonM
 import Tests.Ix.GraphM
 import Tests.Ix.CondenseM
@@ -60,7 +60,6 @@ import Tests.Cli
 import Tests.Ix.Ixes
 import Tests.ShardMap
 import Tests.Ix.EnvBody
-import Tests.Ix.Lean4Lean
 import Tests.Ix.MetaEnv
 import Tests.Ix.Catalog
 import Tests.Ix.CatalogDedup
@@ -106,10 +105,10 @@ def primarySuites : Std.HashMap String (List LSpec.TestSeq) := .ofList [
   ("primitive-address-parity", Tests.Ix.Kernel.BuildPrimitives.paritySuite
     ++ Tests.Ix.Kernel.BuildPrimOrigs.paritySuite),
   ("decompile-unit", Tests.Decompile.unitSuite),
-  ("tc-unit", Tests.Tc.Unit.suite ++ Tests.Tc.Substrate.suite
-    ++ Tests.Tc.Fixtures.suite ++ Tests.Tc.WhnfTests.suite
-    ++ Tests.Tc.InferDefEq.suite ++ Tests.Tc.CheckTests.suite
-    ++ Tests.Tc.Roundtrip.unitTests ++ Tests.Tc.IngressMeta.unitTests),
+  ("tc-unit", Tests.Kernel.Unit.suite ++ Tests.Kernel.Substrate.suite
+    ++ Tests.Kernel.Fixtures.suite ++ Tests.Kernel.WhnfTests.suite
+    ++ Tests.Kernel.InferDefEq.suite ++ Tests.Kernel.CheckTests.suite
+    ++ Tests.Kernel.Roundtrip.unitTests ++ Tests.Kernel.IngressMeta.unitTests),
 ]
 
 /-- Ignored test suites - expensive, run only when explicitly requested. These require significant RAM -/
@@ -148,11 +147,11 @@ def ignoredSuites : Std.HashMap String (List LSpec.TestSeq) := .ofList [
   ("kernel-check-tauceti-reduction", Tests.Ix.Kernel.CheckTauCetiReduction.suite),
   ("rust-kernel-build-primitives", Tests.Ix.Kernel.BuildPrimitives.suite),
   ("rust-kernel-build-prim-origs", Tests.Ix.Kernel.BuildPrimOrigs.suite),
-  ("tc-anon-diff", Tests.Tc.AnonDiff.suite),
-  ("tc-init", Tests.Tc.InitScale.suite),
-  ("tc-tutorial", Tests.Tc.TutorialTc.suite),
-  ("tc-roundtrip", Tests.Tc.Roundtrip.suite),
-  ("tc-ingress-meta", Tests.Tc.IngressMeta.suite),
+  ("tc-anon-diff", Tests.Kernel.AnonDiff.suite),
+  ("tc-init", Tests.Kernel.InitScale.suite),
+  ("tc-tutorial", Tests.Kernel.TutorialTc.suite),
+  ("tc-roundtrip", Tests.Kernel.Roundtrip.suite),
+  ("tc-ingress-meta", Tests.Kernel.IngressMeta.suite),
 ]
 
 /-- Primary test runners — quick suites run by default alongside
@@ -276,8 +275,8 @@ def ignoredRunners (env : Lean.Environment) : List (String × IO UInt32) := [
             let actual :=
               (Aiur.computeStats v2Env.compiled qc v2Env.shapes).totalFftCost.round.toUInt64.toNat
             pure (LSpec.test
-              s!"Shard pipeline FFT matches: expected 6_975_769_169, got {actual}"
-              (actual = 6_975_769_169))
+              s!"Shard pipeline FFT matches: expected 10_648_533_799, got {actual}"
+              (actual = 10_648_533_799))
       LSpec.lspecIO
         (.ofList [("ixvm",
           [fullSeq, aiurSeq, arenaSeq, exploitSeq, paritySeq, shardSeq])]) []),
@@ -287,15 +286,12 @@ def ignoredRunners (env : Lean.Environment) : List (String × IO UInt32) := [
   -- Tests.Ix.Compile.AuxGenDiff).
   ("aux-gen-diff", Tests.Compile.AuxGenDiff.run env),
   ("decompile-diff", Tests.Compile.DecompileDiff.run env),
-  -- lean4lean dependency smoke: accept a real closure, reject an
-  -- ill-typed decl (see Tests.Ix.Lean4Lean).
-  ("lean4lean", Tests.Ix.Lean4Lean.run env),
   -- Pure-Lean kernel regression pins against a real .ixe, compiled on
-  -- demand (see Tests.Tc.ParityEnv).
-  ("tc-pins", Tests.Tc.Pins.run),
+  -- demand (see Tests.Kernel.ParityEnv).
+  ("tc-pins", Tests.Kernel.Pins.run),
   -- Accelerated-vs-pure reduction differentials over that same real env
-  -- (see Tests.Tc.AccelDiff and TcState.noAccel).
-  ("tc-accel-diff", Tests.Tc.AccelDiff.run),
+  -- (see Tests.Kernel.AccelDiff and TcState.noAccel).
+  ("tc-accel-diff", Tests.Kernel.AccelDiff.run),
 ]
 
 def main (args : List String) : IO UInt32 := do
diff --git a/Tests/Theory.lean b/Tests/Theory.lean
new file mode 100644
index 000000000..71dc8f405
--- /dev/null
+++ b/Tests/Theory.lean
@@ -0,0 +1,22 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Audit.Certified
+import Tests.Theory.Certified
+import Tests.Theory.Checker
+import Tests.Theory.Acceptance
+import Tests.Theory.Operations
+import Tests.Theory.Suggestions
+import Tests.Theory.Ordinary
+import Tests.Theory.OrdinaryAcceptance
+import Tests.Theory.Standard
+import Tests.Theory.Quotient
+import Tests.Theory.Structure
+import Tests.Theory.Natural
+import Tests.Theory.Claims
+import Tests.Theory.Modeled
+import Tests.Theory.ModeledNested
+import Tests.Theory.ModeledPermutation
+import Tests.Theory.ModeledEquations
diff --git a/Tests/Theory/Acceptance.lean b/Tests/Theory/Acceptance.lean
new file mode 100644
index 000000000..2c40186bb
--- /dev/null
+++ b/Tests/Theory/Acceptance.lean
@@ -0,0 +1,161 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Accept
+import Tests.Theory.Checker
+import Tests.Theory.Certified
+
+open Ix.Theory
+
+namespace Tests.Theory.Acceptance
+
+open Ix.Theory.Certified Ix.Theory.Model
+open Tests.Theory.Checker (identity identityType identityWitness)
+open Tests.Theory.Certified (primitives primitiveStore)
+
+def prelude : Store Nat :=
+  primitiveStore PrimitiveSignature.falseDeclaration primitives.falseElimDeclaration
+
+def identityAnnotations (l : VLevel) : AnnotationTree :=
+  .lam (zeroCondition l).toRaw .leaf (.lam (zeroCondition l).toRaw .leaf .leaf)
+
+def identityTypeAnnotations (l : VLevel) : AnnotationTree :=
+  .forallE (zeroCondition l).toRaw .leaf (.forallE (zeroCondition l).toRaw .leaf .leaf)
+
+def identityTypeLevel (l : VLevel) : VLevel := .imax (.succ l) (.imax l l)
+
+def identityTypeWitness (l : VLevel) : TypingWitness Nat :=
+  .forallE (.succ l) (.imax l l) .sort (.forallE l l .bvar .bvar)
+
+def identityPropositionWitness : TypingWitness Nat :=
+  .conv (.sort (identityTypeLevel .zero)) (.succ .zero) (identityTypeWitness .zero) .sort .sort
+
+def identityInput : ProofInput Nat :=
+  ⟨prelude, 0, (identity .zero).erase, (identityType .zero).erase⟩
+
+def identityProofWitness : ProofWitness Nat :=
+  ⟨[], identityAnnotations .zero, identityTypeAnnotations .zero,
+    identityWitness .zero, identityPropositionWitness⟩
+
+#guard acceptsCertified.{0,0} 50 primitives identityInput identityProofWitness
+
+def withDefinition (declaration : Const Nat) : Store Nat where
+  dom := [10, 11, 12]
+  nodup := by decide
+  blocks b :=
+    if b = 10 then some ⟨[PrimitiveSignature.falseDeclaration]⟩
+    else if b = 11 then some ⟨[primitives.falseElimDeclaration]⟩
+    else if b = 12 then some ⟨[declaration]⟩ else none
+  mem_dom b := by
+    by_cases h : b = 10 <;> by_cases h' : b = 11 <;> by_cases h'' : b = 12 <;> simp_all
+
+def idRef : ConstRef Nat := .member 12 0
+
+def idDeclaration (kind : DefKind := .definition) : Const Nat :=
+  .defn 1 kind (identityType (.param 0)).erase (identity (.param 0)).erase .safe
+
+def idDefinitionWitness : DefinitionWitness Nat :=
+  ⟨idRef, identityTypeAnnotations (.param 0), identityAnnotations (.param 0),
+    identityTypeLevel (.param 0), identityTypeWitness (.param 0), identityWitness (.param 0)⟩
+
+def idDefinitionInput (kind : DefKind := .definition) : ProofInput Nat :=
+  ⟨withDefinition (idDeclaration kind), 0, .const idRef [.zero], (identityType .zero).erase⟩
+
+def idDefinitionProofWitness : ProofWitness Nat :=
+  { identityProofWitness with
+    declarations := [.definition idDefinitionWitness]
+    proofAnnotations := .leaf
+    proofWitness := .const }
+
+#guard acceptsCertified.{0,0} 50 primitives (idDefinitionInput .definition) idDefinitionProofWitness
+#guard acceptsCertified.{0,0} 50 primitives (idDefinitionInput .theorem) idDefinitionProofWitness
+#guard acceptsCertified.{0,0} 50 primitives (idDefinitionInput .opaque) idDefinitionProofWitness
+
+-- Positive-universe instantiation of the same admitted definition occurs as
+-- an argument to a proposition-valued function.
+def largeIdentityUse : AExpr Nat :=
+  .app (.lam .always (identityType (.succ .zero)) (identity .zero))
+    (.const idRef [.succ .zero])
+
+def largeIdentityUseAnnotations : AnnotationTree :=
+  .app (.lam (some []) (identityTypeAnnotations (.succ .zero)) (identityAnnotations .zero)) .leaf
+
+def largeIdentityUseWitness : TypingWitness Nat :=
+  .app .always (identityType (.succ .zero)) (identityType .zero)
+    (.lam (identityTypeLevel (.succ .zero)) .zero (identityType .zero)
+      (identityTypeWitness (.succ .zero)) identityPropositionWitness (identityWitness .zero))
+    .const
+
+#guard acceptsCertified.{0,0} 70 primitives
+  { idDefinitionInput with proof := largeIdentityUse.erase }
+  { idDefinitionProofWitness with
+    proofAnnotations := largeIdentityUseAnnotations
+    proofWitness := largeIdentityUseWitness }
+
+-- Every declaration kind still checks its supplied body.
+def forgedBodyInput (kind : DefKind) : ProofInput Nat :=
+  { idDefinitionInput kind with
+    store := withDefinition (.defn 1 kind (identityType (.param 0)).erase (.sort .zero) .safe) }
+#guard !acceptsCertified.{0,0} 50 primitives (forgedBodyInput .definition) idDefinitionProofWitness
+#guard !acceptsCertified.{0,0} 50 primitives (forgedBodyInput .theorem) idDefinitionProofWitness
+#guard !acceptsCertified.{0,0} 50 primitives (forgedBodyInput .opaque) idDefinitionProofWitness
+
+-- Object axioms cannot enter through the declaration fold.
+#guard !acceptsCertified.{0,0} 50 primitives
+  { idDefinitionInput with
+    store := withDefinition (.axiom 1 (identityType (.param 0)).erase .safe) }
+  idDefinitionProofWitness
+
+-- Missing, repeated, forward, and self dependencies fail at admission.
+#guard !acceptsCertified.{0,0} 50 primitives (idDefinitionInput)
+  { idDefinitionProofWitness with declarations := [] }
+#guard !acceptsCertified.{0,0} 50 primitives (idDefinitionInput)
+  { idDefinitionProofWitness with declarations := [.definition idDefinitionWitness, .definition idDefinitionWitness] }
+#guard !acceptsCertified.{0,0} 50 primitives
+  { idDefinitionInput with
+    store := withDefinition
+      (.defn 1 .definition (identityType (.param 0)).erase (.const idRef [.param 0]) .safe) }
+  { idDefinitionProofWitness with
+    declarations := [.definition { idDefinitionWitness with bodyAnnotations := .leaf, bodyWitness := .const }] }
+
+-- A changed original statement is checked, even with an otherwise valid proof.
+#guard !acceptsCertified.{0,0} 50 primitives
+  { identityInput with proposition := primitives.falseExpr }
+  { identityProofWitness with propositionAnnotations := .leaf, propositionWitness := .const }
+
+-- Complete primitive metadata is checked before even a constant-free proof.
+#guard !acceptsCertified.{0,0} 50 primitives
+  { identityInput with
+    store := primitiveStore (.axiom 0 (.sort .zero) .safe) primitives.falseElimDeclaration }
+  identityProofWitness
+
+def falseA : AExpr Nat := .const primitives.falseType []
+def eliminatorProposition : AExpr Nat := primitives.falseElimReading.instL [.zero]
+def eliminatorAnnotations : AnnotationTree :=
+  .forallE (some []) (.forallE none .leaf .leaf)
+    (.forallE (some []) .leaf (.app .leaf .leaf))
+
+def eliminatorTypeLevel : VLevel :=
+  .imax (.imax .zero (.succ .zero)) (.imax .zero .zero)
+
+def eliminatorPropositionWitness : TypingWitness Nat :=
+  .conv (.sort eliminatorTypeLevel) (.succ .zero)
+    (.forallE (.imax .zero (.succ .zero)) (.imax .zero .zero)
+      (.forallE .zero (.succ .zero) .const .sort)
+      (.forallE .zero .zero .const (.app .never falseA (.sort .zero) .bvar .bvar)))
+    .sort .sort
+
+def eliminatorInput : ProofInput Nat :=
+  ⟨prelude, 0, .const primitives.falseElim [.zero], eliminatorProposition.erase⟩
+def eliminatorProofWitness : ProofWitness Nat :=
+  ⟨[], .leaf, eliminatorAnnotations, .const, eliminatorPropositionWitness⟩
+
+#guard acceptsCertified.{0,0} 50 primitives eliminatorInput eliminatorProofWitness
+#guard !acceptsCertified.{0,0} 50 primitives
+  { eliminatorInput with proof := .const primitives.falseElim [] } eliminatorProofWitness
+#guard !acceptsCertified.{0,0} 50 primitives
+  { eliminatorInput with proof := .const primitives.falseElim [.param 0] } eliminatorProofWitness
+
+end Tests.Theory.Acceptance
diff --git a/Tests/Theory/Audit/Certified.lean b/Tests/Theory/Audit/Certified.lean
new file mode 100644
index 000000000..2239e242a
--- /dev/null
+++ b/Tests/Theory/Audit/Certified.lean
@@ -0,0 +1,484 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean
+import Ix.Theory.Certified
+
+open Ix.Theory
+
+/-!
+# Certified mathematical dependency audit
+
+This audit names the implemented checking, admission, and no-False roots.
+The generated report includes theorem types so that explicit
+mathematical hypotheses remain visible alongside the transitive axiom leaves.
+-/
+
+open Lean Lean.Elab Command
+
+namespace Tests.Theory.Audit.Certified
+
+def roots : Array Name := #[
+  `Ix.Theory.Model.SetTheory.empty_exists,
+  `Ix.Theory.Model.SetTheory.not_mem_empty,
+  `Ix.Theory.VLevel.eval_inst,
+  `Ix.Theory.Certified.PropWhen.eq_iff_holds,
+  `Ix.Theory.Certified.validateZero?_sound,
+  `Ix.Theory.Certified.zeroCondition_correct,
+  `Ix.Theory.Certified.zeroCondition_inst,
+  `Ix.Theory.Certified.instCondition_comp,
+  `Ix.Theory.Model.readAnnotations?,
+  `Ix.Theory.Model.interp_inst,
+  `Ix.Theory.Model.interp_instL,
+  `Ix.Theory.Model.interp_rename,
+  `Ix.Theory.Model.piR_mem_univ,
+  `Ix.Theory.Model.falseValue_uninhabited,
+  `Ix.Theory.Model.falseElimValue_mem,
+  `Ix.Theory.Certified.PrimitiveSignature.validate_iff,
+  `Ix.Theory.Certified.readDefinition?,
+  `Ix.Theory.Certified.LevelEq.check_sound,
+  `Ix.Theory.Certified.LevelEq.leq_sound,
+  `Ix.Theory.Model.wellDenoted_inst,
+  `Ix.Theory.Model.wellDenoted_beta,
+  `Ix.Theory.Model.extend_definition,
+  `Ix.Theory.Model.ConversionClaim.equation,
+  `Ix.Theory.Model.IndexedContainer.closed_exists,
+  `Ix.Theory.Model.IndexedContainer.carrier_eq,
+  `Ix.Theory.Model.IndexedContainer.induction,
+  `Ix.Theory.Model.IndexedContainer.child_wellFounded,
+  `Ix.Theory.Model.IndexedContainer.fold_node,
+  `Ix.Theory.Model.IndexedContainer.fold_mem,
+  `Ix.Theory.Model.IndexedContainer.small_elim,
+  `Ix.Theory.Model.Telescope.applyN_curry,
+  `Ix.Theory.Model.Telescope.curry_applyN,
+  `Ix.Theory.Certified.verifyTelescope_sound,
+  `Ix.Theory.Certified.verifyArguments_sound,
+  `Ix.Theory.Certified.Ordinary.checkShape_sound,
+  `Ix.Theory.Certified.Ordinary.checkLarge_sound,
+  `Ix.Theory.Certified.Ordinary.Shape.container_wf,
+  `Ix.Theory.Certified.Ordinary.Shape.constructorValue_mem,
+  `Ix.Theory.Certified.Ordinary.Shape.decodeField_branches,
+  `Ix.Theory.Certified.Ordinary.Shape.branches_decodeFields,
+  `Ix.Theory.Certified.Ordinary.Shape.container_large,
+  `Ix.Theory.Certified.Ordinary.Shape.largeValue_iota,
+  `Ix.Theory.Certified.Ordinary.Shape.constructorType_interp,
+  `Ix.Theory.Certified.Ordinary.Shape.recursorType_interp,
+  `Ix.Theory.Certified.Ordinary.Shape.closedRecursorValue_mem_source,
+  `Ix.Theory.Certified.Ordinary.Shape.produced_rule_eq,
+  `Ix.Theory.Certified.Ordinary.checkBlock_sound,
+  `Ix.Theory.Certified.Ordinary.Shape.publishedAssignment_realizes,
+  `Ix.Theory.Certified.admitOrdinary?_extends,
+  `Ix.Theory.Model.ConversionClaim.proofIrrel,
+  `Ix.Theory.Certified.Basis.Equality.Interface.of_checked,
+  `Ix.Theory.Certified.Basis.Equality.value_eq_eqv,
+  `Ix.Theory.Certified.Basis.Iff.Interface.of_checked,
+  `Ix.Theory.Certified.Basis.Iff.eq_of_mem,
+  `Ix.Theory.Certified.Basis.Nonempty.Interface.of_checked,
+  `Ix.Theory.Certified.Basis.Nonempty.value_eq_truthVal,
+  `Ix.Theory.Certified.Standard.Spec.value_mem,
+  `Ix.Theory.Certified.Standard.check_sound,
+  `Ix.Theory.Certified.Standard.assignment_realizes,
+  `Ix.Theory.Certified.admitStandard?_extends,
+  `Ix.Theory.Model.SetTheory.quotSet_mem_univ,
+  `Ix.Theory.Model.SetTheory.quotSound,
+  `Ix.Theory.Certified.Signature.checkTypes_sound,
+  `Ix.Theory.Certified.Signature.Formed.realizes,
+  `Ix.Theory.Certified.Quotient.value_mem,
+  `Ix.Theory.Certified.Quotient.liftValue_apply,
+  `Ix.Theory.Certified.Quotient.liftRule_eq,
+  `Ix.Theory.Certified.Quotient.check_sound,
+  `Ix.Theory.Certified.Quotient.assignment_realizes,
+  `Ix.Theory.Certified.admitQuotient?_extends,
+  `Ix.Theory.Model.TypingClaim.fact,
+  `Ix.Theory.Model.TypingClaim.natLit,
+  `Ix.Theory.Model.TypingClaim.betaResult,
+  `Ix.Theory.Model.ConversionClaim.natZero,
+  `Ix.Theory.Model.ConversionClaim.natSucc,
+  `Ix.Theory.Model.ConversionClaim.proj,
+  `Ix.Theory.Certified.Structure.Description.projections_fit,
+  `Ix.Theory.Certified.Structure.Description.constructor_eta,
+  `Ix.Theory.Certified.Structure.Description.constructor_iota,
+  `Ix.Theory.Certified.Structure.Description.projection_meaning,
+  `Ix.Theory.Certified.Structure.Description.eta_eq,
+  `Ix.Theory.Certified.Structure.Description.iota_eq,
+  `Ix.Theory.Certified.Structure.check_sound,
+  `Ix.Theory.Certified.Structure.Description.factAssignment_realizes,
+  `Ix.Theory.Certified.Structure.Description.publishedAssignment_realizes,
+  `Ix.Theory.Certified.admitStructure?_extends,
+  `Ix.Theory.Certified.Natural.value_mem,
+  `Ix.Theory.Certified.Natural.meaning,
+  `Ix.Theory.Certified.Natural.check_sound,
+  `Ix.Theory.Certified.Natural.assignment_realizes,
+  `Ix.Theory.Certified.admitNatural?_extends,
+  `Ix.Theory.Model.interp_mapRefs,
+  `Ix.Theory.Model.wellDenoted_mapRefs,
+  `Ix.Theory.Model.AExpr.mapRefs_restore,
+  `Ix.Theory.Model.interp_mapRefs_restore,
+  `Ix.Theory.Model.interp_mapRefs_permutation,
+  `Ix.Theory.Model.wellDenoted_mapRefs_permutation,
+  `Ix.Theory.Model.interp_mapRefs_merge,
+  `Ix.Theory.Model.wellDenoted_mapRefs_merge,
+  `Ix.Theory.Certified.Modeled.propositional_equation,
+  `Ix.Theory.Certified.Modeled.checkEquation?_sound,
+  `Ix.Theory.Certified.Modeled.CheckedCompanions.fixed_old,
+  `Ix.Theory.Certified.Modeled.environment_wf,
+  `Ix.Theory.Certified.Modeled.assignment_agrees,
+  `Ix.Theory.Certified.Modeled.assignment_realizes,
+  `Ix.Theory.Certified.Modeled.check?_sound,
+  `Ix.Theory.Certified.Modeled.EntrySource.not_axiom,
+  `Ix.Theory.Certified.Modeled.EntrySource.header,
+  `Ix.Theory.Certified.checkModeledExtension?,
+  `Ix.Theory.Certified.admitModeled?_extends,
+  `Ix.Theory.Certified.PrimitiveSignature.compatible_assignment,
+  `Ix.Theory.Certified.checkTypeCertified_sound,
+  `Ix.Theory.Certified.defeqCertified_sound,
+  `Ix.Theory.Certified.inferCertified_sound,
+  `Ix.Theory.Certified.whnfCertified_sound,
+  `Ix.Theory.Certified.admitDefinition?_extends,
+  `Ix.Theory.Certified.checkStoreCertified,
+  `Ix.Theory.Certified.accepted_store_has_model,
+  `Ix.Theory.Certified.EntrySource.header,
+  `Ix.Theory.Certified.CheckedStore.subject_sound,
+  `Ix.Theory.Certified.accepted_store_source_sound,
+  `Ix.Theory.Certified.checkDeclarationExtensions?,
+  `Ix.Theory.Certified.CheckedExtension.admit,
+  `Ix.Theory.Certified.checkFrontier?_refs,
+  `Ix.Theory.Certified.CheckedFrontier.compatible,
+  `Ix.Theory.Certified.ConditionalStore.subject_sound,
+  `Ix.Theory.Certified.EntrySource.axiom_policy,
+  `Ix.Theory.Certified.ConditionalStore.logical_axioms_authorized,
+  `Ix.Theory.Certified.acceptsBatch,
+  `Ix.Theory.Certified.CheckedBatch.closed_has_model,
+  `Ix.Theory.Certified.CheckedBatch.compatible_leaves,
+  `Ix.Theory.Certified.CheckedBatch.frontier_coverage,
+  `Ix.Theory.Certified.DependencyOrder.before,
+  `Ix.Theory.Certified.DependencyOrder.edge_for,
+  `Ix.Theory.Certified.CheckedBatch.acyclic,
+  `Ix.Theory.Certified.CheckedBatch.no_circular_discharge,
+  `Ix.Theory.Certified.CheckedBatch.leaf_axiom_retained,
+  `Ix.Theory.Certified.CheckedBatch.logicalUses_authorized,
+  `Ix.Theory.Certified.checkBatch?_assoc,
+  `Ix.Theory.Certified.CheckedBatch.no_False,
+  `Ix.Theory.Certified.acceptsCertified,
+  `Ix.Theory.Certified.accepted_has_model,
+  `Ix.Theory.Certified.accepted_proof_sound,
+  `Ix.Theory.Certified.no_proof_of_False,
+  `Ix.Theory.Certified.no_proof_of_empty]
+
+private def baseline : Array Name := #[`propext, `Classical.choice, `Quot.sound]
+
+/-- Definitions whose logical content is hidden behind a name in a root's
+pretty-printed type. Changes to their bodies must change the frozen report. -/
+private def premiseDefinitions : Array Name := #[
+  `Ix.Theory.Model.AExpr.mapRefs,
+  `Ix.Theory.Certified.Modeled.EquationWitness.mk,
+  `Ix.Theory.Certified.Modeled.EquationProof.propositional,
+  `Ix.Theory.Certified.Modeled.CheckedEquation.mk,
+  `Ix.Theory.Certified.Modeled.checkEquation?,
+  `Ix.Theory.Certified.Modeled.Companion.mk,
+  `Ix.Theory.Certified.Modeled.Companion.entry,
+  `Ix.Theory.Certified.Modeled.mapping,
+  `Ix.Theory.Certified.Modeled.CompanionChecked.mk,
+  `Ix.Theory.Certified.Modeled.CheckedCompanions.mk,
+  `Ix.Theory.Certified.Modeled.checkCompanions?,
+  `Ix.Theory.Certified.Modeled.assignment,
+  `Ix.Theory.Certified.Modeled.SourceMatches,
+  `Ix.Theory.Certified.Modeled.sourceRefs?,
+  `Ix.Theory.Certified.Modeled.sourceRules?,
+  `Ix.Theory.Certified.Modeled.betaHead?,
+  `Ix.Theory.Certified.Modeled.majorSource?,
+  `Ix.Theory.Certified.Modeled.ruleSource?,
+  `Ix.Theory.Certified.Modeled.Witness.mk,
+  `Ix.Theory.Certified.Modeled.Checked.mk,
+  `Ix.Theory.Certified.Modeled.EntrySource,
+  `Ix.Theory.Model.Equinumerous, `Ix.Theory.Model.IsTGUniverse,
+  `Ix.Theory.Model.SetTheory.mk,
+  `Ix.Theory.Model.AExpr.Scope, `Ix.Theory.Model.Reading,
+  `Ix.Theory.Certified.DefinitionReading.mk,
+  `Ix.Theory.Certified.PrimitiveSignature.mk,
+  `Ix.Theory.Certified.CheckedStore.mk,
+  `Ix.Theory.Certified.SourceHeader.mk,
+  `Ix.Theory.Certified.CheckedInterface.mk,
+  `Ix.Theory.Certified.CheckedExtension.mk,
+  `Ix.Theory.Certified.FrontierWitness.mk,
+  `Ix.Theory.Certified.FrontierHeader.mk,
+  `Ix.Theory.Certified.deferredSource,
+  `Ix.Theory.Certified.CheckedFrontier.mk,
+  `Ix.Theory.Certified.CheckedFrontier.interface,
+  `Ix.Theory.Certified.HeaderPresent,
+  `Ix.Theory.Certified.ConditionalStore.mk,
+  `Ix.Theory.Certified.ClaimNode.mk,
+  `Ix.Theory.Certified.CheckedNode.mk,
+  `Ix.Theory.Certified.ReplayResult.mk,
+  `Ix.Theory.Certified.CheckedBatch.mk,
+  `Ix.Theory.Certified.DependencyOrder.nil,
+  `Ix.Theory.Certified.DependencyOrder.cons,
+  `Ix.Theory.Certified.DependencyEdge,
+  `Ix.Theory.Certified.outstanding,
+  `Ix.Theory.Certified.logicalAxioms,
+  `Ix.Theory.Certified.CheckedBatch.logicalUses,
+  `Ix.Theory.Model.WellDenoted, `Ix.Theory.Model.Context.Valid,
+  `Ix.Theory.Model.TypingClaim, `Ix.Theory.Model.ConversionClaim,
+  `Ix.Theory.Model.ConstantEntry.mk, `Ix.Theory.Model.Realizes.mk,
+  `Ix.Theory.Model.ConstantEquation.mk,
+  `Ix.Theory.Model.ConstantFact.typed,
+  `Ix.Theory.Model.ConstantFact.natural,
+  `Ix.Theory.Model.ConstantFact.Meaning,
+  `Ix.Theory.Model.ConstantFact.Scope,
+  `Ix.Theory.Model.ConstantFact.ReferencesIn,
+  `Ix.Theory.Model.NaturalMeaning.mk,
+  `Ix.Theory.Model.projectValue,
+  `Ix.Theory.Model.Numeral.zero,
+  `Ix.Theory.Model.Numeral.succ,
+  `Ix.Theory.Model.Numeral.value,
+  `Ix.Theory.Model.Environment.WF.mk, `Ix.Theory.Model.Assignment.AgreesOn,
+  `Ix.Theory.Model.IndexedContainer.mk, `Ix.Theory.Model.IndexedContainer.WF.mk,
+  `Ix.Theory.Model.IndexedContainer.LargeElim, `Ix.Theory.Model.IndexedContainer.AlgebraTyping,
+  `Ix.Theory.Certified.TelescopeBound, `Ix.Theory.Certified.TelescopeProp,
+  `Ix.Theory.Certified.ArgumentsFit,
+  `Ix.Theory.Certified.Ordinary.Shape.mk,
+  `Ix.Theory.Certified.Ordinary.Constructor.mk,
+  `Ix.Theory.Certified.Ordinary.RecursiveField.mk,
+  `Ix.Theory.Certified.Ordinary.CheckedShape.mk,
+  `Ix.Theory.Certified.Ordinary.ConstructorEvidence,
+  `Ix.Theory.Certified.Ordinary.RecursiveEvidence,
+  `Ix.Theory.Certified.Ordinary.LargeEvidence,
+  `Ix.Theory.Certified.Ordinary.Shape.container,
+  `Ix.Theory.Certified.Ordinary.FamilyReading.mk,
+  `Ix.Theory.Certified.Ordinary.ConstructorReading.mk,
+  `Ix.Theory.Certified.Ordinary.RecursorReading.mk,
+  `Ix.Theory.Certified.Ordinary.ModeEvidence,
+  `Ix.Theory.Certified.Ordinary.Shape.ConstructorFormation,
+  `Ix.Theory.Certified.Ordinary.Shape.RecursorFormation.mk,
+  `Ix.Theory.Certified.Ordinary.Shape.SupportsK,
+  `Ix.Theory.Certified.Ordinary.Shape.RecursorSourceMatches,
+  `Ix.Theory.Certified.Ordinary.Shape.RuleFormation.mk,
+  `Ix.Theory.Certified.Ordinary.CheckedBlock.mk,
+  `Ix.Theory.Certified.Ordinary.EntrySource,
+  `Ix.Theory.Certified.Ordinary.Shape.recursorAt,
+  `Ix.Theory.Certified.Ordinary.BlockWitness.mk,
+  `Ix.Theory.Certified.DeclarationWitness.definition,
+  `Ix.Theory.Certified.DeclarationWitness.ordinary,
+  `Ix.Theory.Certified.DeclarationWitness.standard,
+  `Ix.Theory.Certified.DeclarationWitness.quotient,
+  `Ix.Theory.Certified.DeclarationWitness.structure,
+  `Ix.Theory.Certified.DeclarationWitness.natural,
+  `Ix.Theory.Certified.Natural.shape,
+  `Ix.Theory.Certified.Natural.fact,
+  `Ix.Theory.Certified.Natural.entry,
+  `Ix.Theory.Certified.Natural.environment,
+  `Ix.Theory.Certified.Natural.Checked.mk,
+  `Ix.Theory.Certified.Natural.EntrySource,
+  `Ix.Theory.Certified.Structure.Field.mk,
+  `Ix.Theory.Certified.Structure.Description.mk,
+  `Ix.Theory.Certified.Structure.Description.ordinary,
+  `Ix.Theory.Certified.Structure.FieldsFormed.nil,
+  `Ix.Theory.Certified.Structure.FieldsFormed.cons,
+  `Ix.Theory.Certified.Structure.fieldResult,
+  `Ix.Theory.Certified.Structure.Description.facts,
+  `Ix.Theory.Certified.Structure.Description.equations,
+  `Ix.Theory.Certified.Structure.Description.iotaEnvironment,
+  `Ix.Theory.Certified.Structure.Description.etaRule,
+  `Ix.Theory.Certified.Structure.Description.iotaRule,
+  `Ix.Theory.Certified.Structure.FactsWitness.mk,
+  `Ix.Theory.Certified.Structure.Witness.mk,
+  `Ix.Theory.Certified.Structure.FactsChecked.mk,
+  `Ix.Theory.Certified.Structure.Checked.mk,
+  `Ix.Theory.Certified.Structure.EntrySource,
+  `Ix.Theory.Model.Environment.HasType,
+  `Ix.Theory.Certified.Basis.Equality.Interface.mk,
+  `Ix.Theory.Certified.Basis.Equality.shape,
+  `Ix.Theory.Certified.Basis.Equality.type,
+  `Ix.Theory.Certified.Basis.Equality.reflType,
+  `Ix.Theory.Certified.Basis.Equality.recType,
+  `Ix.Theory.Certified.Basis.Iff.Interface.mk,
+  `Ix.Theory.Certified.Basis.Iff.shape,
+  `Ix.Theory.Certified.Basis.Iff.type,
+  `Ix.Theory.Certified.Basis.Iff.introType,
+  `Ix.Theory.Certified.Basis.Iff.recType,
+  `Ix.Theory.Certified.Basis.Nonempty.Interface.mk,
+  `Ix.Theory.Certified.Basis.Nonempty.shape,
+  `Ix.Theory.Certified.Basis.Nonempty.type,
+  `Ix.Theory.Certified.Basis.Nonempty.introType,
+  `Ix.Theory.Certified.Basis.Nonempty.recType,
+  `Ix.Theory.Certified.Standard.Spec.Prerequisites,
+  `Ix.Theory.Certified.Standard.Spec.type,
+  `Ix.Theory.Certified.Standard.Spec.value,
+  `Ix.Theory.Certified.Standard.chooseSet,
+  `Ix.Theory.Certified.Standard.Witness.mk,
+  `Ix.Theory.Certified.Standard.Checked.mk,
+  `Ix.Theory.Certified.Standard.EntrySource,
+  `Ix.Theory.Certified.Signature.Header.mk,
+  `Ix.Theory.Certified.Signature.Formed.nil,
+  `Ix.Theory.Certified.Signature.Formed.cons,
+  `Ix.Theory.Certified.Signature.TypeWitness.mk,
+  `Ix.Theory.Certified.Signature.Rule.mk,
+  `Ix.Theory.Certified.Signature.RuleFormed.mk,
+  `Ix.Theory.Certified.Signature.RuleWitness.mk,
+  `Ix.Theory.Model.SetTheory.quotSet,
+  `Ix.Theory.Model.SetTheory.quotClass,
+  `Ix.Theory.Model.SetTheory.qrep,
+  `Ix.Theory.Model.SetTheory.QuotRel.base,
+  `Ix.Theory.Model.SetTheory.QuotRel.refl,
+  `Ix.Theory.Model.SetTheory.QuotRel.symm,
+  `Ix.Theory.Model.SetTheory.QuotRel.trans,
+  `Ix.Theory.Certified.Quotient.Refs.mk,
+  `Ix.Theory.Certified.Quotient.Refs.ExactSource,
+  `Ix.Theory.Certified.Quotient.Refs.environment,
+  `Ix.Theory.Certified.Quotient.Refs.assignment,
+  `Ix.Theory.Certified.Quotient.Refs.entryType,
+  `Ix.Theory.Certified.Quotient.Refs.source,
+  `Ix.Theory.Certified.Quotient.Refs.equations,
+  `Ix.Theory.Certified.Quotient.Reading.mk,
+  `Ix.Theory.Certified.Quotient.Witness.mk,
+  `Ix.Theory.Certified.Quotient.Checked.mk,
+  `Ix.Theory.Certified.Quotient.EntrySource,
+  `Ix.Theory.Certified.Quotient.formerValue,
+  `Ix.Theory.Certified.Quotient.constructorValue,
+  `Ix.Theory.Certified.Quotient.liftValue,
+  `Ix.Theory.Certified.PrimitiveSignature.Compatible.mk,
+  `Ix.Theory.Certified.EntrySource, `Ix.Theory.Certified.Extends.mk,
+  `Ix.Theory.Certified.AdmittedEnvironment.mk,
+  `Ix.Theory.Certified.CheckedClaim.mk,
+  `Ix.Theory.Certified.InferenceResult.mk, `Ix.Theory.Certified.WhnfResult.mk,
+  `Ix.Theory.Store.mk, `Ix.Theory.Certified.ProofInput.mk,
+  `Ix.Theory.Certified.ProofWitness.mk, `Ix.Theory.Certified.CheckedProof.mk]
+
+private def directConstants (info : ConstantInfo) : Array Name :=
+  info.type.getUsedConstants ++ match info with
+  | .thmInfo value => value.value.getUsedConstants
+  | .defnInfo value => value.value.getUsedConstants
+  | .opaqueInfo value => value.value.getUsedConstants
+  | .inductInfo value => value.ctors.toArray
+  | _ => #[]
+
+private partial def closure (env : Environment) (pending : List Name)
+    (seen : NameSet := {}) : NameSet :=
+  match pending with
+  | [] => seen
+  | name :: rest =>
+    if seen.contains name then closure env rest seen
+    else match env.checked.get.find? name with
+    | some info => closure env ((directConstants info).toList ++ rest) (seen.insert name)
+    | none => closure env rest (seen.insert name)
+
+private def axiomsIn (env : Environment) (dependencies : NameSet) : Array Name :=
+  dependencies.toList.toArray.filter fun name =>
+    match env.checked.get.find? name with
+    | some (.axiomInfo _) => true
+    | _ => false
+
+private def forbiddenModule (name : Name) : Bool :=
+  ((`Ix).isPrefixOf name && !(`Ix.Theory).isPrefixOf name) ||
+  #[`Ix.Theory.Named, `Tests, `Benchmarks, `Ix.Theory.Fixtures, `Ix.Theory.Tests, `Ix.Theory.Harness,
+    `Ix.Theory.Audit, `Ix.Theory.Typing.Conjectures,
+    `Ix.Theory.Typing.UniqueTyping].any (·.isPrefixOf name)
+
+run_cmd do
+  let env ← getEnv
+  let modules := env.allImportedModuleNames
+  let some boundary := modules.toList.idxOf? `Ix.Theory.Certified |
+    throwError "certified audit: public target is missing"
+  -- The audit's own Lean import is outside the certified boundary. Walk the
+  -- mathematical import graph from that boundary. Meta-only tactic imports
+  -- are tooling, and are outside this graph; proof constants remain audited.
+  let mut pending := [boundary]
+  let mut visited : List Nat := []
+  while let index :: rest := pending do
+    pending := rest
+    unless visited.contains index do
+      visited := index :: visited
+      let name := modules[index]!
+      if forbiddenModule name || (`Lean).isPrefixOf name then
+        throwError m!"certified target imports forbidden module {name}"
+      for dependency in env.header.moduleData[index]!.imports do
+        unless dependency.isMeta do
+          if let some depIndex := modules.toList.idxOf? dependency.module then
+            pending := depIndex :: pending
+
+  -- Freeze the foundational premise's complete fields. It must never acquire
+  -- a field that postulates kernel acceptance or semantic soundness.
+  let some foundation := getStructureInfo? env `Ix.Theory.Model.SetTheory |
+    throwError "certified audit: SetTheory is missing"
+  let expectedFields : Array Name := #[
+    `Mem, `ext, `upair, `mem_upair, `sUnion, `mem_sUnion, `power, `mem_power,
+    `regularity, `image, `mem_image, `univChain, `univChain_mem, `univChain_tg]
+  unless foundation.fieldNames == expectedFields do
+    throwError m!"certified audit: foundational fields changed: {foundation.fieldNames}"
+
+  let mut declarations : Nat := 0
+  let mut recursionWorkers : Array Name := #[]
+  let mut projectDeclarations : List Name := []
+  for (name, _) in env.constants.toList do
+    if let some index := env.getModuleIdxFor? name then
+      if visited.contains index.toNat && (`Ix.Theory).isPrefixOf modules[index.toNat]! then
+        declarations := declarations + 1
+        projectDeclarations := name :: projectDeclarations
+        -- Compiled replacements and unsafe implementations are a separate
+        -- boundary from proof axioms. User-authored escapes are forbidden;
+        -- the compiler's recursion workers are inventoried in full below.
+        if (Lean.Compiler.getImplementedBy? env name).isSome || Lean.isExtern env name ||
+            Lean.Elab.ComputedFields.computedFieldAttr.hasTag env name then
+          throwError m!"certified declaration has an unreviewed runtime replacement: {name}"
+        if let some replacement := (Lean.Compiler.CSimp.ext.getState env).map.find? name then
+          throwError m!"certified declaration has an unreviewed csimp replacement: {name} -> {replacement.toDeclName}"
+        if let some info := env.find? name then
+          match info with
+          | .defnInfo value =>
+            unless value.safety == .safe do
+              let some parent := Lean.Compiler.isUnsafeRecName? name |
+                throwError m!"certified declaration is unsafe or partial: {name}"
+              let some (.defnInfo original) := env.find? parent |
+                throwError m!"recursion worker has no source definition: {name}"
+              unless original.safety == .safe do
+                throwError m!"recursion worker's source is not safe: {name}"
+              recursionWorkers := recursionWorkers.push name
+          | .opaqueInfo value =>
+            if value.isUnsafe then throwError m!"certified opaque declaration is unsafe: {name}"
+          | _ => pure ()
+  unless declarations > 0 do throwError "certified audit measured no project declarations"
+
+  -- Traverse the checked declarations, including every constructor field.
+  -- Imported axiom summaries can omit dependencies of recursive groups.
+  for axiomName in axiomsIn env (closure env projectDeclarations) do
+    unless baseline.contains axiomName do
+      throwError m!"certified foundation reaches unapproved axiom {axiomName}"
+
+  for root in roots do
+    let some info := env.find? root |
+      throwError m!"certified audit: missing root {root}"
+    let dependencies := closure env [root]
+    unless dependencies.size > 1 do
+      throwError m!"certified audit: empty dependency measurement for {root}"
+    let type ← liftTermElabM <| Meta.ppExpr info.type
+    let axioms := (axiomsIn env dependencies).qsort Name.lt
+    let mut projectModules : NameSet := {}
+    for dependency in dependencies.toList do
+      if let some index := env.getModuleIdxFor? dependency then
+        let moduleName := modules[index.toNat]!
+        if (`Ix.Theory).isPrefixOf moduleName then
+          projectModules := projectModules.insert moduleName
+    let moduleRows := projectModules.toList.toArray.qsort Name.lt
+    logInfo m!"certified root {root}\n  type: {type}\n  axioms: {axioms}\n  constants: {dependencies.size}\n  project modules: {moduleRows}"
+  for name in premiseDefinitions do
+    let some info := env.find? name |
+      throwError m!"certified audit: missing premise definition {name}"
+    let type ← liftTermElabM <| Meta.ppExpr info.type
+    match info with
+    | .defnInfo value =>
+      let body ← liftTermElabM <| Meta.ppExpr value.value
+      logInfo m!"premise definition {name}\n  type: {type}\n  definition: {body}"
+    | .ctorInfo _ => logInfo m!"premise constructor {name}\n  type: {type}"
+    | _ => throwError m!"certified audit: unclassified premise definition {name}"
+  for name in recursionWorkers.qsort Name.lt do
+    let some (.defnInfo value) := env.find? name |
+      throwError m!"certified audit: missing recursion worker {name}"
+    let type ← liftTermElabM <| Meta.ppExpr value.type
+    let body ← liftTermElabM <| Meta.ppExpr value.value
+    logInfo m!"compiler recursion worker {name}\n  type: {type}\n  implementation: {body}"
+  logInfo m!"Certified project runtime audit OK: {recursionWorkers.size} compiler recursion workers inventoried; no other unsafe/partial declarations, extern, implemented_by, computed_field, or csimp replacements in the mathematical import graph"
+  logInfo m!"Certified foundation audit OK: {declarations} declarations; {roots.size} named roots; explicit SetTheory hypothesis; baseline axioms only"
+
+end Tests.Theory.Audit.Certified
diff --git a/Tests/Theory/Certified.lean b/Tests/Theory/Certified.lean
new file mode 100644
index 000000000..75734ccc5
--- /dev/null
+++ b/Tests/Theory/Certified.lean
@@ -0,0 +1,76 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified
+
+open Ix.Theory
+
+/-! Structural and universe-validation regressions. These do not yet exercise
+proof acceptance; that gate will add its own corpus when implemented. -/
+
+namespace Tests.Theory.Certified
+
+open Ix.Theory.Certified Ix.Theory.Model
+
+#guard (PropWhen.ofList [2, 0, 2]).toRaw == some [0, 2]
+#guard PropWhen.fromRaw? 2 (some [0, 1]) |>.isSome
+#guard PropWhen.fromRaw? 2 (some [1, 0]) |>.isNone
+#guard PropWhen.fromRaw? 1 (some [0, 0]) |>.isNone
+#guard PropWhen.fromRaw? 1 (some [1]) |>.isNone
+#guard validateZero? 1 (.param 0) (some [0]) |>.isSome
+#guard validateZero? 1 (.param 0) none |>.isNone
+#guard validateZero? 1 (.param 0) (some []) |>.isNone
+#guard validateZero? 0 (.succ (.param 0)) none |>.isNone
+#guard validateZero? 0 (.imax (.param 0) .zero) (some []) |>.isNone
+#guard validateZero? 2 (.imax (.param 0) (.param 1)) (some [1]) |>.isSome
+#guard (zeroCondition (.imax (.param 0) (.param 1))).holds ([5, 0].getD · 0)
+#guard !(zeroCondition (.imax (.param 0) (.param 1))).holds ([0, 5].getD · 0)
+#guard (instCondition [.succ .zero] (.param 0)).toRaw == none
+#guard (instCondition [.zero] (.param 0)).toRaw == some []
+
+-- Equal zero conditions do not imply equal universes.
+example : zeroCondition (.succ .zero) = zeroCondition (.succ (.succ .zero)) := rfl
+example : VLevel.eval [] (.succ .zero) ≠ VLevel.eval [] (.succ (.succ .zero)) := by decide
+
+def identity : VExpr Nat := .lam (.sort (.param 0)) (.lam (.bvar 0) (.bvar 0))
+def identityAnnotations : AnnotationTree :=
+  .lam (some [0]) .leaf (.lam (some [0]) .leaf .leaf)
+
+#guard readAnnotations? 1 0 identity identityAnnotations |>.isSome
+#guard ((readAnnotations? 1 0 identity identityAnnotations).map (·.val.erase)) == some identity
+#guard readAnnotations? 0 0 identity identityAnnotations |>.isNone
+#guard readAnnotations? 1 0 identity .leaf |>.isNone
+-- The same source node at two context depths is checked separately.
+#guard readAnnotations? 0 1 (VExpr.bvar (β := Nat) 0) .leaf |>.isSome
+#guard readAnnotations? 0 0 (VExpr.bvar (β := Nat) 0) .leaf |>.isNone
+
+def primitives : PrimitiveSignature Nat := ⟨.member 10 0, .member 11 0, by decide, none⟩
+
+def primitiveStore (falseDecl recDecl : Const Nat) : Store Nat where
+  dom := [10, 11]
+  nodup := by decide
+  blocks b := if b = 10 then some ⟨[falseDecl]⟩ else if b = 11 then some ⟨[recDecl]⟩ else none
+  mem_dom b := by
+    by_cases h : b = 10 <;> by_cases h' : b = 11 <;> simp_all
+
+#guard primitives.validate (primitiveStore PrimitiveSignature.falseDeclaration
+  primitives.falseElimDeclaration)
+#guard !primitives.validate (primitiveStore (.axiom 0 (.sort .zero) .safe)
+  primitives.falseElimDeclaration)
+#guard !primitives.validate (primitiveStore PrimitiveSignature.falseDeclaration
+  (.recursor 0 0 0 1 0 primitives.falseElimType [] false .safe))
+#guard !primitives.validate (primitiveStore PrimitiveSignature.falseDeclaration
+  (.recursor 1 0 0 1 0 primitives.falseElimType [] true .safe))
+#guard !primitives.validate (primitiveStore
+  (.induct 0 0 0 (.sort .zero) [⟨0, 0, 0, primitives.falseExpr, .safe⟩] .safe)
+  primitives.falseElimDeclaration)
+
+#guard readDefinition? (Const.axiom 0 primitives.falseExpr .safe) .leaf .leaf |>.isNone
+#guard readDefinition? (Const.axiom (β := Nat) 0 (.forallE (.sort .zero) (.bvar 0)) .safe)
+  .leaf .leaf |>.isNone
+#guard readDefinition? (Const.defn 0 .opaque primitives.falseExpr (.sort .zero) .unsafe)
+  .leaf .leaf |>.isNone
+
+end Tests.Theory.Certified
diff --git a/Tests/Theory/Checker.lean b/Tests/Theory/Checker.lean
new file mode 100644
index 000000000..0d0a8e61f
--- /dev/null
+++ b/Tests/Theory/Checker.lean
@@ -0,0 +1,86 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Checker
+
+open Ix.Theory
+
+namespace Tests.Theory.Checker
+
+open Ix.Theory.Certified Ix.Theory.Model
+
+def emptyEnvironment : Environment Nat := fun _ => none
+
+def identity (l : VLevel) : AExpr Nat :=
+  .lam (zeroCondition l) (.sort l) (.lam (zeroCondition l) (.bvar 0) (.bvar 0))
+
+def identityType (l : VLevel) : AExpr Nat :=
+  .forallE (zeroCondition l) (.sort l) (.forallE (zeroCondition l) (.bvar 0) (.bvar 1))
+
+def identityWitness (l : VLevel) : TypingWitness Nat :=
+  .lam (.succ l) (.imax l l) (.forallE (zeroCondition l) (.bvar 0) (.bvar 1))
+    .sort (.forallE l l .bvar .bvar)
+    (.lam l l (.bvar 1) .bvar .bvar .bvar)
+
+#guard checkTypeCertified.{0,0} 30 1 emptyEnvironment [] (identity (.param 0))
+  (identityType (.param 0)) (identityWitness (.param 0))
+#guard checkTypeCertified.{0,0} 30 0 emptyEnvironment [] (identity .zero)
+  (identityType .zero) (identityWitness .zero)
+#guard checkTypeCertified.{0,0} 30 0 emptyEnvironment [] (identity (.succ .zero))
+  (identityType (.succ .zero)) (identityWitness (.succ .zero))
+
+-- The same parameterized expression is rejected with a missing universe slot.
+#guard !checkTypeCertified.{0,0} 30 0 emptyEnvironment [] (identity (.param 0))
+  (identityType (.param 0)) (identityWitness (.param 0))
+
+-- Structural erasure alone would permit this false annotation.
+def wrongIdentity : AExpr Nat := .lam .never (.sort .zero) (.lam .never (.bvar 0) (.bvar 0))
+def wrongIdentityType : AExpr Nat :=
+  .forallE .never (.sort .zero) (.forallE .never (.bvar 0) (.bvar 1))
+#guard !checkTypeCertified.{0,0} 30 0 emptyEnvironment [] wrongIdentity wrongIdentityType
+  (identityWitness .zero)
+
+def betaSource : AExpr Nat := .app (identity (.succ .zero)) (.sort .zero)
+def betaResult : AExpr Nat := .lam .never (.sort .zero) (.bvar 0)
+def betaWitness : ConversionWitness Nat :=
+  .beta (identityType (.succ .zero)) (identityWitness (.succ .zero)) .sort
+#guard defeqCertified.{0,0} 30 0 emptyEnvironment [] betaSource betaResult betaWitness
+
+-- A proposed beta step cannot substitute an argument outside the lambda domain.
+#guard !defeqCertified.{0,0} 30 0 emptyEnvironment []
+  (.app (identity (.succ .zero)) (.sort (.succ .zero)))
+  (.lam .never (.sort (.succ .zero)) (.bvar 0)) betaWitness
+-- This check is required in the proof-point regime too.
+#guard !defeqCertified.{0,0} 30 0 emptyEnvironment []
+  (.app (identity .zero) (.sort .zero))
+  (.lam .always (.sort .zero) (.bvar 0))
+  (.beta (identityType .zero) (identityWitness .zero) .sort)
+
+def etaSource : AExpr Nat :=
+  .lam .never (.sort (.succ .zero))
+    (.app ((identity (.succ .zero)).liftN 1) (.bvar 0))
+#guard defeqCertified.{0,0} 30 0 emptyEnvironment [] etaSource (identity (.succ .zero))
+  (.eta (.forallE .never (.bvar 0) (.bvar 1)) (identityWitness (.succ .zero)))
+
+def proofContext : Context Nat :=
+  Context.push (.bvar 1) (Context.push (.bvar 0) (Context.push (.sort .zero) []))
+#guard defeqCertified.{0,0} 30 0 emptyEnvironment proofContext (.bvar 0) (.bvar 1)
+  (.proofIrrel (.bvar 2) .bvar .bvar .bvar)
+
+#guard LevelEq.check 1 (.imax (.param 0) (.param 0)) (.param 0)
+#guard LevelEq.check 0 (.imax (.succ .zero) .zero) .zero
+#guard !LevelEq.check 0 (.succ .zero) (.succ (.succ .zero))
+#guard !LevelEq.check 0 (.imax (.param 0) .zero) .zero
+#guard defeqCertified.{0,0} 10 1 emptyEnvironment []
+  (.sort (.imax (.param 0) (.param 0))) (.sort (.param 0)) .sort
+#guard !defeqCertified.{0,0} 10 0 emptyEnvironment []
+  (.sort (.succ .zero)) (.sort (.succ (.succ .zero))) .sort
+
+#guard !checkTypeCertified.{0,0} 0 1 emptyEnvironment [] (identity (.param 0))
+  (identityType (.param 0)) (identityWitness (.param 0))
+#guard !checkTypeCertified.{0,0} 30 0 emptyEnvironment [] (.natLit 0) (.sort .zero) .const
+#guard !checkTypeCertified.{0,0} 30 0 emptyEnvironment [] (.const (.member 42 0) []) (.sort .zero) .const
+
+end Tests.Theory.Checker
diff --git a/Tests/Theory/Claims.lean b/Tests/Theory/Claims.lean
new file mode 100644
index 000000000..f8376371c
--- /dev/null
+++ b/Tests/Theory/Claims.lean
@@ -0,0 +1,130 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Claims
+import Ix.Theory.Certified.ClaimComposition
+import Tests.Theory.Acceptance
+import Tests.Theory.Standard
+
+open Ix.Theory
+
+namespace Tests.Theory.Claims
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certificate
+open Tests.Theory.Certified (primitives)
+open Tests.Theory.Checker (identity identityType)
+
+set_option maxRecDepth 8192
+set_option maxHeartbeats 8000000
+
+def ref (n : Nat) : ConstRef Nat := .member n 0
+def aliasDeclaration (n : Nat) : Const Nat :=
+  .defn 1 .theorem (identityType (.param 0)).erase (.const (ref n) [.param 0]) .safe
+
+def declaration : Nat → Const Nat
+  | 10 => PrimitiveSignature.falseDeclaration
+  | 11 => primitives.falseElimDeclaration
+  | 12 => Acceptance.idDeclaration
+  | 13 | 14 => aliasDeclaration 12
+  | 15 => .defn 1 .theorem (identityType (.param 0)).erase
+      (.app (.lam (identityType (.param 0)).erase (.const (ref 13) [.param 0]))
+        (.const (ref 14) [.param 0])) .safe
+  | _ => .axiom 0 primitives.falseExpr .safe
+
+def store (alter : Nat → Const Nat → Const Nat := fun _ c => c) : Store Nat where
+  dom := [10, 11, 12, 13, 14, 15]
+  nodup := by decide
+  blocks b := if b ∈ [10, 11, 12, 13, 14, 15] then some ⟨[alter b (declaration b)]⟩ else none
+  mem_dom b := by split <;> simp_all
+
+def specs : List (List (ConstRef Nat) × List (ConstRef Nat)) :=
+  [([], [ref 12]), ([ref 12], [ref 13]), ([ref 12], [ref 14]), ([ref 13, ref 14], [ref 15])]
+
+def nodes? (source : Store Nat := store) : Option (List (ClaimNode Nat)) :=
+  specs.mapM fun (frontier, subjects) => claimNode? 1000 primitives source frontier subjects
+
+def accepted (source : Store Nat) (nodes : List (ClaimNode Nat)) : Bool :=
+  (batchFrontier? 1000 primitives source nodes).any fun frontier =>
+    acceptsBatch.{0,0} 1000 primitives source frontier nodes
+
+def positive : Bool := (nodes?).any (accepted store)
+#guard positive
+
+-- Each leaf is independently a valid conditional check.
+#guard (nodes?).any fun nodes => nodes.all fun node =>
+  (checkNode?.{0,0} 1000 primitives store node).isSome
+
+-- The same diamond can retain A as a genuine external obligation.
+#guard (nodes?).any fun nodes => accepted store (nodes.drop 1)
+#guard (nodes?).any fun nodes =>
+  (batchFrontier? 1000 primitives store (nodes.drop 1)).any fun frontier =>
+    (checkBatch?.{0,0} 1000 primitives store frontier (nodes.drop 1)).any fun result =>
+      result.receipt.frontier.refs == [ref 12]
+
+-- Structural discharge closes all four subjects and produces their model.
+#guard (nodes?).any fun nodes =>
+  (checkBatch?.{0,0} 1000 primitives store [] nodes).any fun result =>
+    result.receipt.frontier.refs.isEmpty && nodeSubjects result.nodes == [ref 12, ref 13, ref 14, ref 15]
+
+-- A reverse dependency cannot be supplied by a later node.
+#guard (nodes?).any fun nodes => !accepted store nodes.reverse
+#guard (nodes?).any fun nodes => !accepted store (nodes[0]! :: nodes[3]! :: [nodes[1]!, nodes[2]!])
+-- Repeated subjects share an existing checked interpretation.
+#guard (nodes?).any fun nodes => accepted store (nodes ++ nodes)
+#guard (nodes?).any fun nodes =>
+  !(acceptsBatch.{0,0} 1000 primitives store [] (nodes.drop 1))
+#guard (nodes?).any fun nodes =>
+  !(acceptsBatch.{0,0} 0 primitives store [] nodes)
+
+-- Source changes reject an original valid leaf certificate.
+#guard (nodes?).any fun nodes =>
+  !accepted (store fun n c => if n = 15 then
+    .defn 1 .theorem primitives.falseExpr (.const (ref 13) [.param 0]) .safe else c) nodes
+#guard (nodes?).any fun nodes =>
+  !accepted (store fun n c => if n = 12 then .axiom 1 (identityType (.param 0)).erase .safe else c) nodes
+
+def cyclicStore : Store Nat := store fun n c =>
+  if n = 12 then .defn 0 .theorem primitives.falseExpr (.const (ref 13) []) .safe
+  else if n = 13 then .defn 0 .theorem primitives.falseExpr (.const (ref 12) []) .safe else c
+
+def cyclicNodes? : Option (List (ClaimNode Nat)) := do
+  return [← claimNode? 1000 primitives cyclicStore [ref 13] [ref 12],
+    ← claimNode? 1000 primitives cyclicStore [ref 12] [ref 13]]
+
+-- Both conditional implications pass, but neither circular ordering closes.
+#guard cyclicNodes?.any fun nodes => nodes.all fun node =>
+  (checkNode?.{0,0} 1000 primitives cyclicStore node).isSome
+#guard cyclicNodes?.any fun nodes => !accepted cyclicStore nodes
+#guard cyclicNodes?.any fun nodes => !accepted cyclicStore nodes.reverse
+
+-- Claiming a deferred member as an owned subject is rejected.
+#guard (claimNode? 1000 primitives store [ref 12] [ref 12]).any fun node =>
+  (checkNode?.{0,0} 1000 primitives store node).isNone
+
+-- A source axiom cannot enter as a deferred assumption, including supported
+-- schemas: their semantic producer must run, and their use remains recorded.
+#guard (frontierWitnesses? 1000 Standard.store primitives.environment [Standard.propextRef]).isNone
+
+def standardNodes? : Option (List (ClaimNode Nat)) := do
+  return [← claimNode? 2000 primitives Standard.store [] [Standard.propextRef],
+    ← claimNode? 2000 primitives Standard.store [] [Standard.choiceRef]]
+
+#guard standardNodes?.any fun nodes =>
+  (checkBatch?.{0,0} 2000 primitives Standard.store [] nodes).any fun result =>
+    result.receipt.frontier.refs.isEmpty &&
+      result.logicalUses == [Standard.propextRef, Standard.choiceRef]
+
+-- The recorded axiom remains even when that same reference is a checked subject.
+#guard standardNodes?.any fun nodes =>
+  (checkBatch?.{0,0} 2000 primitives Standard.store [] (nodes.take 1)).any fun result =>
+    Standard.propextRef ∈ nodeSubjects result.nodes &&
+      Standard.propextRef ∈ result.logicalUses
+
+-- Regrouping composition has identical acceptance and complete subjects.
+#guard nodes?.any fun nodes =>
+  accepted store (composeClaims (composeClaims (nodes.take 1) ((nodes.drop 1).take 1)) (nodes.drop 2)) &&
+    accepted store (composeClaims (nodes.take 1) (composeClaims ((nodes.drop 1).take 1) (nodes.drop 2)))
+
+end Tests.Theory.Claims
diff --git a/Tests/Theory/ImportManifest.lean b/Tests/Theory/ImportManifest.lean
new file mode 100644
index 000000000..43e9e7b9c
--- /dev/null
+++ b/Tests/Theory/ImportManifest.lean
@@ -0,0 +1,176 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+/-! Import provenance, recorded from the Lean4Ix working tree on 2026-09-11.
+The working tree contained the new, uncommitted consistency model; the base
+revision alone does not identify these inputs. Source hashes identify each file.
+The selected file inventory is enforced by `Tests/Theory/Provenance.lean`.
+The generated `Ix/Theory.lean` umbrella records its sole upstream import. -/
+
+namespace Tests.Theory.ImportManifest
+
+def lean4IxBaseRevision : String := "ab42e79e2a4e2615a3ca6ef983d510f374057a38"
+def conLecheRevision : String := "86cd20a65660d757cedc81561a44579099b565d0"
+
+structure SourceFile where
+  source : String
+  target : String
+  sourceSha256 : String
+  deriving Repr
+
+def selected : Array SourceFile := #[
+  ⟨"Lean4Ix/Certificate/Build.lean", "Ix/Theory/Certificate/Build.lean", "833e462fae9934f3d7809fc78b7c791d7ede3ab4398732079f26ea73f53abc4c"⟩,
+  ⟨"Lean4Ix/Certificate/Claims.lean", "Ix/Theory/Certificate/Claims.lean", "c3532bd7b49d0657f52913f4da285580aa2de467ecd27b41f5263a165ae34d0f"⟩,
+  ⟨"Lean4Ix/Certificate/Modeled.lean", "Ix/Theory/Certificate/Modeled.lean", "28d4f7cd3bdb5945d31b8f6f10c686d6c22889e96511c765b7a28c59b17ac47a"⟩,
+  ⟨"Lean4Ix/Certificate/Ordinary.lean", "Ix/Theory/Certificate/Ordinary.lean", "7c85145faf3bef4f934087fe9694171dd457c2e84190000f8c5c355af9d357c3"⟩,
+  ⟨"Lean4Ix/Certificate/OrdinarySource.lean", "Ix/Theory/Certificate/OrdinarySource.lean", "291704dd2ff2d53d70ac73876ff1505eb99c96e4a029f46e9428dc64eadd24f4"⟩,
+  ⟨"Lean4Ix/Certificate/Quotient.lean", "Ix/Theory/Certificate/Quotient.lean", "8c5a44003cc09313a600d3e53ebf0de1bfbee5d64c6c24fa6753fc87659aad83"⟩,
+  ⟨"Lean4Ix/Certificate/Standard.lean", "Ix/Theory/Certificate/Standard.lean", "54605d2a22c2671429fe65e9cd210677deee90dc38f629991f1f0f1dc157bea8"⟩,
+  ⟨"Lean4Ix/Certificate/Structure.lean", "Ix/Theory/Certificate/Structure.lean", "a0e5c274ed5c5ced8854841144086396d11c105b080bdb2c46b8ccf44d34a1d2"⟩,
+  ⟨"Lean4Ix/Certificate/Suggest.lean", "Ix/Theory/Certificate/Suggest.lean", "d7863536599fa0554d4ce34427b496b306301982cdef8a9bda2395380fd1ee2a"⟩,
+  ⟨"Lean4Ix/Certified.lean", "Ix/Theory/Certified.lean", "db42519eb53c5c24965b27879cb1ad81eca1010513fc67cf486f324c942fce98"⟩,
+  ⟨"Lean4Ix/Certified/Accept.lean", "Ix/Theory/Certified/Accept.lean", "ce3975aa6a82f020ad6c92a5644945d3bb68ea323f97ef7eace8ba9d5d5aa80e"⟩,
+  ⟨"Lean4Ix/Certified/Admission.lean", "Ix/Theory/Certified/Admission.lean", "ea6a1b8d3126190332557d424957551af7d780abe98aa0af5433a928d97ba991"⟩,
+  ⟨"Lean4Ix/Certified/Basis/Equality.lean", "Ix/Theory/Certified/Basis/Equality.lean", "fa4886a2d0d764ba85c0711a258d0d94888a30cf39db2842290d220b1d7213c0"⟩,
+  ⟨"Lean4Ix/Certified/Basis/Iff.lean", "Ix/Theory/Certified/Basis/Iff.lean", "368fa1c9c359a29a5877af993f16698025d84aed967ce4720122280532644fc8"⟩,
+  ⟨"Lean4Ix/Certified/Basis/Interface.lean", "Ix/Theory/Certified/Basis/Interface.lean", "6bcd43996a8101c48f3f11a17f1950b3db74ca1a7cb970de324cd0fe78f8d4ce"⟩,
+  ⟨"Lean4Ix/Certified/Basis/Nonempty.lean", "Ix/Theory/Certified/Basis/Nonempty.lean", "5f62092f92138ee8433f9f56977aec6c03827819342bb7417080cdc2c19b35d4"⟩,
+  ⟨"Lean4Ix/Certified/Checker.lean", "Ix/Theory/Certified/Checker.lean", "677f0f68b1422d9ccc467234acaa12737fd97f9ecdc43755b46e12f36be9858a"⟩,
+  ⟨"Lean4Ix/Certified/ClaimComposition.lean", "Ix/Theory/Certified/ClaimComposition.lean", "d99702d5199447cb696e365ccbb246b3bf9663b432ead0563b6572101f19f731"⟩,
+  ⟨"Lean4Ix/Certified/Claims.lean", "Ix/Theory/Certified/Claims.lean", "fe28187c7eeabd148c8b737532f0559f0424397b8ba70cf2b990edd7d9623738"⟩,
+  ⟨"Lean4Ix/Certified/Frontier.lean", "Ix/Theory/Certified/Frontier.lean", "a0dfec4872d5e7ef728494a0a71bef107cfb243a42107fe92185e3fb0d371fb0"⟩,
+  ⟨"Lean4Ix/Certified/Level.lean", "Ix/Theory/Certified/Level.lean", "37c6fa05fddfc0a01a70288cf49d870a77625119be6c73bd0061fe76c0d27420"⟩,
+  ⟨"Lean4Ix/Certified/LevelEq.lean", "Ix/Theory/Certified/LevelEq.lean", "a6402afba171af4b4df58ea4de64b3e1517fae90bd8ce145bb96775bb4862923"⟩,
+  ⟨"Lean4Ix/Certified/LogicalPolicy.lean", "Ix/Theory/Certified/LogicalPolicy.lean", "763a20bd20133c2cf235c27cec875f2c67bb0ec0c5a7c25c5df82562531a496a"⟩,
+  ⟨"Lean4Ix/Certified/Modeled/Admission.lean", "Ix/Theory/Certified/Modeled/Admission.lean", "68c0ef0b5e19984d08e8d34c296548eceeb4f5c4f4d86d5df3174be9ae0d939c"⟩,
+  ⟨"Lean4Ix/Certified/Modeled/Equation.lean", "Ix/Theory/Certified/Modeled/Equation.lean", "bb49b60d019b57819c030e0ea41f853727f4d0aecb0174e31c236639747dde4d"⟩,
+  ⟨"Lean4Ix/Certified/Modeled/Source.lean", "Ix/Theory/Certified/Modeled/Source.lean", "ac4a72a22fc77f5a512511a19c0b0c01925cf2eca5b1c1de4f00c111b048c88d"⟩,
+  ⟨"Lean4Ix/Certified/Modeled/Transport.lean", "Ix/Theory/Certified/Modeled/Transport.lean", "d0d020ca9fd123fb036cd35d662b237778f9e1c24119250185cb2946bd3d99ab"⟩,
+  ⟨"Lean4Ix/Certified/Natural/Admission.lean", "Ix/Theory/Certified/Natural/Admission.lean", "8d7ce4e7f0da80d5ffe45b45aeba72320ec7da35bbad3eb3fdc321512ff74a1a"⟩,
+  ⟨"Lean4Ix/Certified/Natural/Checked.lean", "Ix/Theory/Certified/Natural/Checked.lean", "2dd7ad9e96c65a5d74a84f8c6c6cec3ba2693ab6f77aefcd7a29089529d6172b"⟩,
+  ⟨"Lean4Ix/Certified/Natural/Publish.lean", "Ix/Theory/Certified/Natural/Publish.lean", "fac41bc4b4a409d0266d64b4375a638ed1ec281c28ec20c993d7166072d15ca1"⟩,
+  ⟨"Lean4Ix/Certified/Natural/Value.lean", "Ix/Theory/Certified/Natural/Value.lean", "db39def05ce46d1da7b78209acfba10596e67642a2942ad438b38a049ab5d51b"⟩,
+  ⟨"Lean4Ix/Certified/Operations.lean", "Ix/Theory/Certified/Operations.lean", "9c7bb4b947421dfbaa12b7dc7ddbac0021847a0f2b2c092decfb3dd2e582fc34"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Admission.lean", "Ix/Theory/Certified/Ordinary/Admission.lean", "b19b0077e451aae6cc608d9007def64bd66523e89e2a5f558d0cf7abf77926ad"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Checked.lean", "Ix/Theory/Certified/Ordinary/Checked.lean", "04ffd22d2d6b5c0070f8e8bb6b8504b408046ae39ffd07625f2708f7994bed8e"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Computation.lean", "Ix/Theory/Certified/Ordinary/Computation.lean", "27dc5c8f9d2a7990e64c13c2fab256da3dd99d5fa5ba8eeea9134f3d39f44792"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/ConstructorStage.lean", "Ix/Theory/Certified/Ordinary/ConstructorStage.lean", "ebd00026aff885831dc52fa28f33be3a562d19980bbbb50ec0111b9ebbbb60b2"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Constructors.lean", "Ix/Theory/Certified/Ordinary/Constructors.lean", "e57eac74ac4190013c6fc603b14fbf747985266a1369bf1b7d8cdf3785da718c"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Container.lean", "Ix/Theory/Certified/Ordinary/Container.lean", "a5f560feda487c89356faa1e775a4133f2dfc9bfaa8002472a217a227ddac582"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Eliminator.lean", "Ix/Theory/Certified/Ordinary/Eliminator.lean", "8e2162333ed48c3fbeeef2ce15ccc2406628dfa71f927550204eb1c295a2dde2"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Family.lean", "Ix/Theory/Certified/Ordinary/Family.lean", "b668e27738cbe8336059f8cd0313feb8709ab112ee64126d53e28998aac77568"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/LargeElim.lean", "Ix/Theory/Certified/Ordinary/LargeElim.lean", "af7d28444877b6a7524aaaf277944c6fc9b75bdadfa4baf481bdc3edf4ee337f"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Reading.lean", "Ix/Theory/Certified/Ordinary/Reading.lean", "8da97d7af13f89fc5a1983c45f1988bb5c8dea391481825b5040a102599b7cbb"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RecursorReading.lean", "Ix/Theory/Certified/Ordinary/RecursorReading.lean", "0013a5e2233423cc0bfc5e6db6259a86d45649098912594cf5e9bb844d6f1043"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RecursorStage.lean", "Ix/Theory/Certified/Ordinary/RecursorStage.lean", "9e6cbbfee2e9748be9042845d5d7f702b60aaa0516483892d16d974d8315ea26"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RecursorSyntax.lean", "Ix/Theory/Certified/Ordinary/RecursorSyntax.lean", "df1bef5d63e0e84506bc7f3c9be345d080ace1e226b3573073b005a493b9c4fb"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RecursorValue.lean", "Ix/Theory/Certified/Ordinary/RecursorValue.lean", "ab4328139fc3b76b25b71a42e01ddb089ae17e04d811dbc63aead88450370f30"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RuleChecks.lean", "Ix/Theory/Certified/Ordinary/RuleChecks.lean", "ef1fe53fa44205b23ef384cb6b72e0129d3341e07834339184d694a8951225bb"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RuleEquations.lean", "Ix/Theory/Certified/Ordinary/RuleEquations.lean", "40b04a47431f9c12aaf8450c408cddc849aa6da53c77b11c33612fbcfb9b7236"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/RuleReading.lean", "Ix/Theory/Certified/Ordinary/RuleReading.lean", "263f59728e844b9d905c7e28ba20eefc7f3c708b2237157814248490e40d19bd"⟩,
+  ⟨"Lean4Ix/Certified/Ordinary/Shape.lean", "Ix/Theory/Certified/Ordinary/Shape.lean", "e071e91be7609ed73c995623153a28d96cae1c1e057e3b0464373d85f9084c7e"⟩,
+  ⟨"Lean4Ix/Certified/Policy.lean", "Ix/Theory/Certified/Policy.lean", "67f69859dfed1dd21bdb6b253a578b1473d34fca6d408d13bbcd0176644373d9"⟩,
+  ⟨"Lean4Ix/Certified/Prelude.lean", "Ix/Theory/Certified/Prelude.lean", "1cdc62000e9c5532b989c905d7bf1b37c3c1578cd15c19a6cccfae7a1581892c"⟩,
+  ⟨"Lean4Ix/Certified/PropWhen.lean", "Ix/Theory/Certified/PropWhen.lean", "c4d80fc1af048f6bf97841d4b63f8528cf7891a71f6e05744fd33edabc757343"⟩,
+  ⟨"Lean4Ix/Certified/Quotient/Admission.lean", "Ix/Theory/Certified/Quotient/Admission.lean", "4efb5df9a2703a1aaed2f286e47fc0445ea05c0a4891499e9b58e3ddaac7a347"⟩,
+  ⟨"Lean4Ix/Certified/Quotient/Checked.lean", "Ix/Theory/Certified/Quotient/Checked.lean", "d093c1dd39f35be954c8ddbc0267f00cbf6119262a512efb5c9ad96250e208ba"⟩,
+  ⟨"Lean4Ix/Certified/Quotient/Publish.lean", "Ix/Theory/Certified/Quotient/Publish.lean", "e637fa623b20d14592b09fbf8101bd08a741d525dab462404a057fbcafc004bd"⟩,
+  ⟨"Lean4Ix/Certified/Quotient/Reading.lean", "Ix/Theory/Certified/Quotient/Reading.lean", "b20e0748f126fa0281d4c552e242f22d9ba3c2ce2d578de0604794504b199f60"⟩,
+  ⟨"Lean4Ix/Certified/Quotient/Syntax.lean", "Ix/Theory/Certified/Quotient/Syntax.lean", "25ec7aebc6499c1a2778355bef69c0dc262b66a00fe12124c78c38dd7a867adb"⟩,
+  ⟨"Lean4Ix/Certified/Quotient/Value.lean", "Ix/Theory/Certified/Quotient/Value.lean", "08575dd364648ad62fadba8b2d67e514b03e775354c17b029dea6a6b4c7c0985"⟩,
+  ⟨"Lean4Ix/Certified/Signature.lean", "Ix/Theory/Certified/Signature.lean", "7be85d7fa465ce50f0dfc8ab65e364c5562e81763914fa779857a636d97a64b7"⟩,
+  ⟨"Lean4Ix/Certified/Source.lean", "Ix/Theory/Certified/Source.lean", "f1bbfea2e6e31b9969c3acc70da1182b015c2a11700f92ce8d6304c74128b3ec"⟩,
+  ⟨"Lean4Ix/Certified/Standard/Admission.lean", "Ix/Theory/Certified/Standard/Admission.lean", "cfd3c5d8662b25116d3c58cf3fa7429368b36071f0ebc032df154e154fa05ff4"⟩,
+  ⟨"Lean4Ix/Certified/Standard/Checked.lean", "Ix/Theory/Certified/Standard/Checked.lean", "cb58c99a87d53fa919f1a742fef8727df0690d77b2713b42d1c815e880666cfd"⟩,
+  ⟨"Lean4Ix/Certified/Standard/Realization.lean", "Ix/Theory/Certified/Standard/Realization.lean", "2a90165564c1f56591d6b68501dbfa846673f4fe59cf47aeaa16d0fb79e6c172"⟩,
+  ⟨"Lean4Ix/Certified/Store.lean", "Ix/Theory/Certified/Store.lean", "84ab117484c092edd994dff513cea86042f23bb5d076c61bcb640fda3d146842"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Admission.lean", "Ix/Theory/Certified/Structure/Admission.lean", "b38964cc9ff83d383c8a4d110cb3e11d9d0ea66c0b3498e9e7481a31cd560483"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Checked.lean", "Ix/Theory/Certified/Structure/Checked.lean", "1d92b154e7a69cf25bbfbf138aca9f0a77172e55be1e2f5392cc0a2d84f27f33"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Computation.lean", "Ix/Theory/Certified/Structure/Computation.lean", "c537302f6d91deb46c5b9eb29641124fc30fb0acc84d231d51d6ae7c3be4c65f"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Publish.lean", "Ix/Theory/Certified/Structure/Publish.lean", "48015840ff11abaea77db702acca3ec29e479395f4509a5fc409cba7cb2f923d"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Reading.lean", "Ix/Theory/Certified/Structure/Reading.lean", "36074e7c2f8a23d4ea5cece00a703773cdc9bc8907304072038b78845b359ddd"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Syntax.lean", "Ix/Theory/Certified/Structure/Syntax.lean", "ffdbc5cced526a36b7f5139af30cdb2fb3be03222194b56b0f68edb5e72775d4"⟩,
+  ⟨"Lean4Ix/Certified/Structure/Value.lean", "Ix/Theory/Certified/Structure/Value.lean", "6e96be97f9894a209efdc79d2ff96c21f4202ad11afb7afa639f9d5bc5c553ee"⟩,
+  ⟨"Lean4Ix/Certified/Telescope.lean", "Ix/Theory/Certified/Telescope.lean", "40fecfc7cf9d1abafb855079b8c8d55cff471e6ffb9b7ddd919ea90951b78987"⟩,
+  ⟨"Lean4Ix/Theory/Const.lean", "Ix/Theory/Const.lean", "bfb95d9f4af666804e79e34933e2fd094c0a783bce5b5d3da7b8b6061f4d0f0a"⟩,
+  ⟨"Lean4Ix/Theory/Expr.lean", "Ix/Theory/Expr.lean", "c848e36c9654d211718ef4fedba3c338ac0428e4e54024c770022263aecf437b"⟩,
+  ⟨"Lean4Ix/Theory/Inductive/Levels.lean", "Ix/Theory/Inductive/Levels.lean", "59c8752ec02adbe0860adf60eadedd480152d5bf352058f647512158f0a9a6cb"⟩,
+  ⟨"Lean4Ix/Model/Annotated.lean", "Ix/Theory/Model/Annotated.lean", "55f71adb9e40f4a85aae2fbb4349498f4f2007d568a6bc84fffbdec437741a04"⟩,
+  ⟨"Lean4Ix/Model/Context.lean", "Ix/Theory/Model/Context.lean", "b0ce5e4808fc1a4a4d4ca8bf5faf850420675eb9065d3912ce9156de4ba93c37"⟩,
+  ⟨"Lean4Ix/Model/Environment.lean", "Ix/Theory/Model/Environment.lean", "bd646827350485bde61df1825f47a4ff20861ebf6f45853ddb2f3cf611858e38"⟩,
+  ⟨"Lean4Ix/Model/Extension.lean", "Ix/Theory/Model/Extension.lean", "c1f649360ad30417e9ddb84d6dea939e77c0aebc80279fa5b56d806feb22f109"⟩,
+  ⟨"Lean4Ix/Model/Inductive/Codes.lean", "Ix/Theory/Model/Inductive/Codes.lean", "9855264e0038c77b57491c3818c192bbd0bd4fba210e33bf5a2d9dfded591939"⟩,
+  ⟨"Lean4Ix/Model/Inductive/Container.lean", "Ix/Theory/Model/Inductive/Container.lean", "e14328e0152de4f8017a28b0500e96615bc432f98b1475babb229b34967394ba"⟩,
+  ⟨"Lean4Ix/Model/Inductive/Recursor.lean", "Ix/Theory/Model/Inductive/Recursor.lean", "3028689c3bb11d90e38170e680560c8a9d123bce42d46b00f1bfd4e78d4c9026"⟩,
+  ⟨"Lean4Ix/Model/Inductive/Telescope.lean", "Ix/Theory/Model/Inductive/Telescope.lean", "8867df5a379798d10615f7c7b068f4982c3e846b1511cdb18bfc600ec66c7c18"⟩,
+  ⟨"Lean4Ix/Model/Instantiation.lean", "Ix/Theory/Model/Instantiation.lean", "994e4027343d62e996fb814fc32d12c86571d4557fe7a157349a6eaf5b2e81f6"⟩,
+  ⟨"Lean4Ix/Model/Interpret.lean", "Ix/Theory/Model/Interpret.lean", "a505d97b1c6658d72391f0187462c443396cdce88fe6256f070842d71ea3fdf9"⟩,
+  ⟨"Lean4Ix/Model/Judgment.lean", "Ix/Theory/Model/Judgment.lean", "a98aff0288e2db11369e658f7e083309ff4e6794bc66e0b3cab7465aac0a7591"⟩,
+  ⟨"Lean4Ix/Model/PrimitiveValues.lean", "Ix/Theory/Model/PrimitiveValues.lean", "84d16a4015cc253f731494e4c5213170d8b4174b6e33871becc598f9c1a46d55"⟩,
+  ⟨"Lean4Ix/Model/ReferenceMap.lean", "Ix/Theory/Model/ReferenceMap.lean", "a9d50c7c0f6ae0f4258ecfaa828a127361c277a242ae8111b9d149c137acb29e"⟩,
+  ⟨"Lean4Ix/Model/SetModel/Container.lean", "Ix/Theory/Model/SetModel/Container.lean", "bfc5c926aee16b6456151f48832bd8c41bbb9582f541ccc864eec753277c3a25"⟩,
+  ⟨"Lean4Ix/Model/SetModel/Iter.lean", "Ix/Theory/Model/SetModel/Iter.lean", "6962b64d8ccd7b34df2dce7c7e0dff6bf4872b6d11de2ab608807b4787e230a0"⟩,
+  ⟨"Lean4Ix/Model/SetModel/Ops.lean", "Ix/Theory/Model/SetModel/Ops.lean", "17a7e331d36a0fb0a5153bad2e115f3795cdb2db24f20e1a96a3102e845b1955"⟩,
+  ⟨"Lean4Ix/Model/SetModel/RecGraph.lean", "Ix/Theory/Model/SetModel/RecGraph.lean", "e6ca5ce2ab2681efbc6d3f549d596e6c7522860d1656db7bbe3528a874b8593c"⟩,
+  ⟨"Lean4Ix/Model/SetModel/TaggedSum.lean", "Ix/Theory/Model/SetModel/TaggedSum.lean", "3f8f97c2b4d752a97bada45b5e7bc6dd3cb20a054f703a72c5e06af1646286dc"⟩,
+  ⟨"Lean4Ix/Model/SetModel/TupleTower.lean", "Ix/Theory/Model/SetModel/TupleTower.lean", "0665b318c36faad149ccc4ef213fe81be47d36d7283c372ff70f26d80c0fd8a9"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Core.lean", "Ix/Theory/Model/SetTheory/Core.lean", "1ad5614af10cf9d8eb3e390ee279d1161a0704d3af1ba36d50012e8683aa06d5"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Choice.lean", "Ix/Theory/Model/SetTheory/Derive/Choice.lean", "a451c14971f8be37fcc35534a45b6b8f569a87abb87920aa3efb02c352d4ffa5"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Empty.lean", "Ix/Theory/Model/SetTheory/Derive/Empty.lean", "72408fc268cf2d0bd6a39d27873a69576a67f8b75a1539dc26fd6147c11bcbb2"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Graphs.lean", "Ix/Theory/Model/SetTheory/Derive/Graphs.lean", "fcea63a8b11704d8f25b8dcf92fa05c494097a7195673859fe45288503deae00"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Lfp.lean", "Ix/Theory/Model/SetTheory/Derive/Lfp.lean", "9a4f8d03a9b8dca4b112e89862540aa9cf4d53efe7580f7dc6d61690783101b2"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/LfpFam.lean", "Ix/Theory/Model/SetTheory/Derive/LfpFam.lean", "862fce7477e11f1a18c5e07336ba5331b5325e7f9efc6926a87eac836f6715e7"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Omega.lean", "Ix/Theory/Model/SetTheory/Derive/Omega.lean", "aa76b574e7a6fe136cca8f9ba3d87cbd6a9577cec39cbdb91a193c265185d39d"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Pair.lean", "Ix/Theory/Model/SetTheory/Derive/Pair.lean", "99ecac13fda8ad3f3e87e0a2d4bf2f5dd72e8e859dfb98d0da17ca0b14c77134"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Pt.lean", "Ix/Theory/Model/SetTheory/Derive/Pt.lean", "3a2213814398c232d3a1f46365f22fc71d028f0e40f9c55fd1e135d07b304260"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Quot.lean", "Ix/Theory/Model/SetTheory/Derive/Quot.lean", "de5148118f48b3042609d813fdfe930924330af6ca0a5cd1b831560a035a51bc"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Sep.lean", "Ix/Theory/Model/SetTheory/Derive/Sep.lean", "24624815b917df8747786c56e2e47be740fc1e1be9f685f5fd053ac1001dbdc7"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Sigma.lean", "Ix/Theory/Model/SetTheory/Derive/Sigma.lean", "ca545076118e71a0235b6f3f6ada2e6c4c96830ca606e31dade4f3a2e060e681"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Univ.lean", "Ix/Theory/Model/SetTheory/Derive/Univ.lean", "3d59dcca1339d8e1e28bee7efe8792f44c0917fb1d1c749c61ed5a5976fcdeae"⟩,
+  ⟨"Lean4Ix/Model/SetTheory/Derive/Universe.lean", "Ix/Theory/Model/SetTheory/Derive/Universe.lean", "f2c24862145d6624dcd9dacfcd68b845b6c68522d0fc81c1eac06839b455b61e"⟩,
+  ⟨"Lean4Ix/Model/Signature.lean", "Ix/Theory/Model/Signature.lean", "5c6d3f9467466e3d677865a1536309bc05b96aafadf4312f7dc1679710929837"⟩,
+  ⟨"Lean4Ix/Model/Support.lean", "Ix/Theory/Model/Support.lean", "020dc36c6376e3f7f725db8d4fd6a559f4e1ad303cdfb41c5e738f00c6ac05de"⟩,
+  ⟨"Lean4Ix/Model/TelescopeSemantics.lean", "Ix/Theory/Model/TelescopeSemantics.lean", "a717a653a8d8d88d69a52acba0a8fe81b0c5635194c408bfdb503382ec9d0d66"⟩,
+  ⟨"Lean4Ix/Model/Value.lean", "Ix/Theory/Model/Value.lean", "b2cf0796c8bcf6e138136c3f9f017d3df551b2a243d2e860fa943bb8d1411524"⟩,
+  ⟨"Lean4Ix/Model/WellDenoted.lean", "Ix/Theory/Model/WellDenoted.lean", "8fc3eeb787fcc0182da41c880cf416c214d7930a433d0f35f77f393a2e9526e8"⟩,
+  ⟨"Lean4Ix/Theory/Quot.lean", "Ix/Theory/Quot.lean", "321d4c7739af0b052da2a5c59ba875fe1ec35ec334a382d6107e02aeac238b49"⟩,
+  ⟨"Lean4Ix/Theory/Ref.lean", "Ix/Theory/Ref.lean", "885181febe5ce0e1f9c6baac03e4604efb4acea27e0e8b61fde9900c14112f00"⟩,
+  ⟨"Lean4Ix/Theory/Rename.lean", "Ix/Theory/Rename.lean", "3ce70afd260f3d9f68b830e11c5d1937f0d9ccf3b3f8a4e70ffc139a84fb8322"⟩,
+  ⟨"Lean4Ix/Std/Basic.lean", "Ix/Theory/Std/Basic.lean", "450413877e701f1d906d13cf3074149127bb1637a9e5a4bd723d20769662fe89"⟩,
+  ⟨"Lean4Ix/Theory/Store.lean", "Ix/Theory/Store.lean", "316c34c9f083a5d751f0fe9a478c50d6f3fc511a7aa8529042776a5b774fd763"⟩,
+  ⟨"Lean4Ix/Theory/VLevel.lean", "Ix/Theory/VLevel.lean", "fc91db763262069edc1181dcb0ff12ac78d1efdd370a8acb2b297d3fcec963ee"⟩,
+  ⟨"Lean4Ix/Certified.lean", "Ix/Theory.lean", "db42519eb53c5c24965b27879cb1ad81eca1010513fc67cf486f324c942fce98"⟩]
+
+structure ConLecheFile where
+  source : String
+  target : String
+  sourceSha256 : String
+  lean4IxSha256 : String
+  targetSha256 : String
+  deriving Repr
+
+def conLeche : Array ConLecheFile := #[
+  ⟨"ConLeche/SetTheory/Core.lean", "Ix/Theory/Model/SetTheory/Core.lean", "52f54c7f8664a0d00ba04083d428ff81c2b89e7e68fbd6e24ffb349ef441f19a", "1ad5614af10cf9d8eb3e390ee279d1161a0704d3af1ba36d50012e8683aa06d5", "9e8d3537a66ded9e4d9142765c9ebda3eb4c3a8f780927cea6657e076933657b"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Empty.lean", "Ix/Theory/Model/SetTheory/Derive/Empty.lean", "259b3b365926256fbe8281a7066be601e419c3e492452b62086e0fd44e1a3f16", "72408fc268cf2d0bd6a39d27873a69576a67f8b75a1539dc26fd6147c11bcbb2", "b9a961b71e8a0576ceb00fbdc0288231d360576cd7afa72375606c793da15541"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Sep.lean", "Ix/Theory/Model/SetTheory/Derive/Sep.lean", "a6a452a34028ff2e194987de8fc5bc8f847ff8950f962b5d33c6c6ee5045a52e", "24624815b917df8747786c56e2e47be740fc1e1be9f685f5fd053ac1001dbdc7", "38536c268957fe0ad6e0127a1f07677bbfe4a17de82d0a2738b9042db55be2c7"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Pair.lean", "Ix/Theory/Model/SetTheory/Derive/Pair.lean", "851f954187fcc05ba2f43a6b81112df27c91e34f7de54352eaf461380fee1bd7", "99ecac13fda8ad3f3e87e0a2d4bf2f5dd72e8e859dfb98d0da17ca0b14c77134", "a72c5b13f5657a8299b060bd344068f56c3e2fadfc3619e64b9bc28e98085c91"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Universe.lean", "Ix/Theory/Model/SetTheory/Derive/Universe.lean", "57a24b4144088ac14dabdb9b6f88c49cf251a0659f8d4c073aad6682baeb099d", "f2c24862145d6624dcd9dacfcd68b845b6c68522d0fc81c1eac06839b455b61e", "c3eb55ee316ce142c16fa5c9a3e06ac45721767bad845ce8cd4c485ac7cce494"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Pt.lean", "Ix/Theory/Model/SetTheory/Derive/Pt.lean", "93f9ed86375f7af7a004f3ef2612ce8c9d8c6626ce73dbf6c3d6702f95f67eae", "3a2213814398c232d3a1f46365f22fc71d028f0e40f9c55fd1e135d07b304260", "520286bf987d29f56976d32ed2527ddf494ac80592fba05c1ffc4ad7627d9934"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Graphs.lean", "Ix/Theory/Model/SetTheory/Derive/Graphs.lean", "f61433765add5a733b38e95e38e217273f526a5e710b7109f24eb0f83f70faaf", "fcea63a8b11704d8f25b8dcf92fa05c494097a7195673859fe45288503deae00", "5bff626e2b77ea3d83302dd8959ef0e0816e9d9da59d52d573134f139e69316c"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Omega.lean", "Ix/Theory/Model/SetTheory/Derive/Omega.lean", "c0b20ecd0cc88a74ff6091e5a88506269b587bbc6f1919f72cc63083d2f7e55a", "aa76b574e7a6fe136cca8f9ba3d87cbd6a9577cec39cbdb91a193c265185d39d", "0cf178fada4077bfc8ba7dc257d8ceb77e7db8a452a9fba09eb736ad84f475be"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Univ.lean", "Ix/Theory/Model/SetTheory/Derive/Univ.lean", "e1084f7c82d9c0d144281491ceb05b015001d1215947d0d687e4dc07497ff911", "3d59dcca1339d8e1e28bee7efe8792f44c0917fb1d1c749c61ed5a5976fcdeae", "33e83e18da0a782904f42acc563c1c4259b60a1833bf2b22af41a28f1bd797e0"⟩,
+  ⟨"ConLeche/SetModel/Ops.lean", "Ix/Theory/Model/SetModel/Ops.lean", "b19d965f92d1e281afd40a7ee4b2edd1a324b9bdf6d8f26425944dbafe987a11", "17a7e331d36a0fb0a5153bad2e115f3795cdb2db24f20e1a96a3102e845b1955", "6ce498a847103c32824e40f22e51db42163da98c09374f6a69e2a85a69f1e732"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Sigma.lean", "Ix/Theory/Model/SetTheory/Derive/Sigma.lean", "1a844ecb6709ae0ccefd43a4eb8d6da92b3753033e882ce74cfbd27c6890545f", "ca545076118e71a0235b6f3f6ada2e6c4c96830ca606e31dade4f3a2e060e681", "59cfd35485e1b90d199089aea2886fe7ed12bd9f02637d2d7cd5e21536ec6ef5"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Lfp.lean", "Ix/Theory/Model/SetTheory/Derive/Lfp.lean", "d6c1a824ee0b358f4007c2d297c4e29011c95914c2241d402f5bf27da333614f", "9a4f8d03a9b8dca4b112e89862540aa9cf4d53efe7580f7dc6d61690783101b2", "65e44e5bfe2fa0720b334cd31aff2c2eff511364feadfd5fd60c1ebf150b9a89"⟩,
+  ⟨"ConLeche/SetTheory/Derive/LfpFam.lean", "Ix/Theory/Model/SetTheory/Derive/LfpFam.lean", "18fa2c12b37d9786b9a1961ed526e7d411869d93cfa241ebbdf2910d4418ac97", "862fce7477e11f1a18c5e07336ba5331b5325e7f9efc6926a87eac836f6715e7", "0657c96c6dffb7a49fec92c97769356595ec8a6f06b5f73594d4732d2fef8b8f"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Choice.lean", "Ix/Theory/Model/SetTheory/Derive/Choice.lean", "a8404566f4d831874e044dcfba6865b750fda3c9427e13c3d2b68d7ac45d5b48", "a451c14971f8be37fcc35534a45b6b8f569a87abb87920aa3efb02c352d4ffa5", "47e64bd1d52287230b993398ba5ee584d7b15e256b86f4fa0eaf1735c4510b93"⟩,
+  ⟨"ConLeche/SetModel/TupleTower.lean", "Ix/Theory/Model/SetModel/TupleTower.lean", "143b965d29faae965c16288021ba1cf401c3f10e76550386ddb81d9ca1f5cbee", "0665b318c36faad149ccc4ef213fe81be47d36d7283c372ff70f26d80c0fd8a9", "1089b4ea6d9e7ff3ed9902a3c3d8f6697332b2aac23f94e503584b9cdf972750"⟩,
+  ⟨"ConLeche/SetModel/TaggedSum.lean", "Ix/Theory/Model/SetModel/TaggedSum.lean", "eb64def578bf85bc2b197b83648749996ebcd243be573752f617a5f91f3332d8", "3f8f97c2b4d752a97bada45b5e7bc6dd3cb20a054f703a72c5e06af1646286dc", "53b565da9a2ce8848ca2442e52bfa0ff13b3f044017858fe69be42a9b2614aff"⟩,
+  ⟨"ConLeche/SetModel/Iter.lean", "Ix/Theory/Model/SetModel/Iter.lean", "0688fa56fad4dcac618589cd9bafc2860c43b95978dc6dcf6c3e292cafc4b149", "6962b64d8ccd7b34df2dce7c7e0dff6bf4872b6d11de2ab608807b4787e230a0", "019ef9fa62f5d141ccc8c7e41259ff52dfba56412b3a57917ba60c28a2bfb378"⟩,
+  ⟨"ConLeche/SetModel/RecGraph.lean", "Ix/Theory/Model/SetModel/RecGraph.lean", "66de7b97c640cec3987f89c31ae19c4daa27b6da53ba6943767e0078802f1faf", "e6ca5ce2ab2681efbc6d3f549d596e6c7522860d1656db7bbe3528a874b8593c", "da698d1a7346eaaa2f5b4734de06c955a05791ff52728d554082814328bd5caa"⟩,
+  ⟨"ConLeche/SetModel/Container.lean", "Ix/Theory/Model/SetModel/Container.lean", "47b7bbab4764309ad1a11d7e6a3d2061c2968928367e2285e2a7e549bf7e6c0c", "bfc5c926aee16b6456151f48832bd8c41bbb9582f541ccc864eec753277c3a25", "08928de8de78f1fabc535b65e8511b068ad3c8b517055aa363674c2c90cebd4e"⟩,
+  ⟨"ConLeche/SetTheory/Derive/Quot.lean", "Ix/Theory/Model/SetTheory/Derive/Quot.lean", "cadc387495c563d796ba4ca45cc0125cbe8ff5168d81bc47b364bd6776c3898b", "de5148118f48b3042609d813fdfe930924330af6ca0a5cd1b831560a035a51bc", "356b3b639fad5c6a9990bf106a38d49b32d0b0ae80537aba2719aaab8f9d9c84"⟩]
+
+end Tests.Theory.ImportManifest
diff --git a/Tests/Theory/Modeled.lean b/Tests/Theory/Modeled.lean
new file mode 100644
index 000000000..6f62ff1d2
--- /dev/null
+++ b/Tests/Theory/Modeled.lean
@@ -0,0 +1,165 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Modeled
+import Ix.Theory.Certificate.Build
+import Tests.Theory.Ordinary
+import Tests.Theory.Certified
+import Tests.Theory.ModeledFixtures
+
+open Ix.Theory
+
+/-! Model declarations and certificates are generated from actual anonymous
+source data, then checked through the public store entry point. This corpus
+does not substitute a caller-supplied realization for declaration checking. -/
+
+namespace Tests.Theory.Modeled
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certificate Ix.Theory.Inductive
+open Tests.Theory.Certified (primitives)
+
+set_option maxRecDepth 8192
+set_option maxHeartbeats 16000000
+
+def ref (block member : Nat := 0) : ConstRef Nat := .member block member
+def const (block member : Nat := 0) (levels : List VLevel := []) : VExpr Nat := .const (ref block member) levels
+def type0 : VExpr Nat := .sort (.succ .zero)
+def natType : VExpr Nat := const 20
+
+def mutualSource : Block Nat := ModeledFixtures.mutualSource
+def mutualRecursors : Block Nat := ModeledFixtures.mutualRecursors
+
+/-- Both families are modeled by Nat. B's constructor is identity; A has zero
+and successor. The dependent mutual fold is built from the checked Nat fold. -/
+def modelTargets : List (ConstRef Nat) :=
+  [ref 20, .ctor 20 0 0, .ctor 20 0 1, ref 20, ref 40, ref 41, ref 42]
+def modelPairs : List (ConstRef Nat × ConstRef Nat) :=
+  [ref 30, .ctor 30 0 0, .ctor 30 0 1, ref 30 1, .ctor 30 1 0, ref 31, ref 31 1].zip modelTargets
+def mapped (expression : VExpr Nat) : VExpr Nat := expression.mapRefs (Certificate.Modeled.target modelPairs)
+def recursorType (index : Nat) : VExpr Nat :=
+  mapped ((mutualRecursors.members[index]?).map Const.type |>.getD type0)
+def recPrefix : List (VExpr Nat) := (recursorType 0).telN 5
+
+def modelA : VExpr Nat :=
+  .lamN recPrefix (.appN (const 21 0 [.param 0]) [
+    .bvar 4, .bvar 2,
+    .lam natType (.lam (.app (.bvar 5) (.bvar 0))
+      (.appN (.bvar 3) [.bvar 1, .appN (.bvar 2) [.bvar 1, .bvar 0]]))])
+
+def modelB : VExpr Nat :=
+  .lamN (recPrefix ++ [natType]) (.appN (.bvar 1)
+    [.bvar 0, .appN (const 41 0 [.param 0]) (VExpr.bvarRevRange 1 5 ++ [.bvar 0])])
+
+def block : Nat → Block Nat
+  | 10 => ⟨[PrimitiveSignature.falseDeclaration]⟩
+  | 11 => ⟨[primitives.falseElimDeclaration]⟩
+  | 20 => ⟨[Tests.Theory.Ordinary.natShape.source 20]⟩
+  | 21 => ⟨[Tests.Theory.Ordinary.natShape.recursorSource 20 21 .large]⟩
+  | 30 => mutualSource
+  | 31 => mutualRecursors
+  | 40 => ⟨[.defn 0 .definition (.forallE natType natType) (.lam natType (.bvar 0)) .safe]⟩
+  | 41 => ⟨[.defn 1 .definition (recursorType 0) modelA .safe]⟩
+  | 42 => ⟨[.defn 1 .definition (recursorType 1) modelB .safe]⟩
+  | _ => ⟨[]⟩
+
+def store (alter : Nat → Block Nat → Block Nat := fun _ b => b) : Store Nat where
+  dom := List.range 43
+  nodup := List.nodup_range
+  blocks b := if b < 43 then some (alter b (block b)) else none
+  mem_dom b := by split <;> simp_all
+
+def prefixWitnesses? : Option (Environment Nat × List (DeclarationWitness Nat)) :=
+  declarationWitnesses? 3000 store primitives.environment
+    [.ordinary 20 21, .definition (ref 40), .definition (ref 41), .definition (ref 42)]
+
+def modeledWitness? : Option (Ix.Theory.Certified.Modeled.Witness Nat) := do
+  let (entries, _) ← prefixWitnesses?
+  Certificate.Modeled.witness? 3000 entries store 30 [ref 31, ref 31 1] modelTargets
+
+def witnesses? : Option (List (DeclarationWitness Nat)) := do
+  let (_, earlier) ← prefixWitnesses?
+  return earlier ++ [.modeled (← modeledWitness?)]
+
+def accepted : Bool := witnesses?.any fun witnesses =>
+  acceptsStoreCertified.{0,0} 3000 primitives store [ref 30, ref 30 1, ref 31, ref 31 1] witnesses
+
+#guard (Ix.Theory.Certified.Modeled.sourceRefs? store 30 [ref 31, ref 31 1]).isSome
+#guard (Ix.Theory.Certified.Modeled.recursorRules? store (ref 31)).any (fun rules => rules.length == 2)
+#guard (Ix.Theory.Certified.Modeled.recursorRules? store (ref 31 1)).any (fun rules => rules.length == 1)
+#guard store.ctorRuleIndex? (.ctor 30 1 0) == some 2
+#guard prefixWitnesses?.isSome
+#guard modeledWitness?.isSome
+#guard accepted
+
+def candidate : Certificate.Modeled.Candidate Nat := ⟨30, [ref 31, ref 31 1], modelTargets, []⟩
+def generated? : Option (List (DeclarationWitness Nat)) :=
+  Certificate.storeWitness? 3000 primitives store [ref 31, ref 31 1] [candidate]
+#guard generated?.any (acceptsStoreCertified.{0,0} 3000 primitives store [ref 31, ref 31 1])
+
+def computed : VExpr Nat := .appN (const 31 0 [.succ .zero]) [
+  .lam (const 30) (.sort .zero), .lam (const 30 1) (.sort .zero), .bvar 1,
+  .lam (const 30 1) (.lam (.sort .zero) (.bvar 0)),
+  .lam (const 30) (.lam (.sort .zero) (.bvar 0)),
+  .app (.const (.ctor 30 0 1) [])
+    (.app (.const (.ctor 30 1 0) []) (.const (.ctor 30 0 0) []))]
+def proof : VExpr Nat := .lam (.sort .zero) (.lam (.bvar 0) (.bvar 0))
+def proposition : VExpr Nat := .forallE (.sort .zero) (.forallE (.bvar 0) computed)
+def input : ProofInput Nat := ⟨store, 0, proof, proposition⟩
+def proofAccepted : Bool := (Certificate.proofWitness? 3000 primitives input [candidate]).any
+  (acceptsCertified.{0,0} 3000 primitives input)
+#guard proofAccepted
+
+def withRecursor (alter : Const Nat → Const Nat) : Store Nat :=
+  store fun n b => if n = 31 then ⟨b.members.map alter⟩ else b
+def withRules (alter : List (RecRule Nat) → List (RecRule Nat)) : Store Nat :=
+  withRecursor fun c => match c with
+    | .recursor u p i m n t rules k s => .recursor u p i m n t (alter rules) k s
+    | c => c
+def sourceRejected (source : Store Nat) : Bool := witnesses?.any fun witnesses =>
+  !(acceptsStoreCertified.{0,0} 3000 primitives source [ref 31, ref 31 1] witnesses)
+
+-- Both families contribute to the same table. Slot 2 must not become slot 1,
+-- and an equation about the other recursor cannot justify the selected rule.
+#guard sourceRejected (withRules fun rules => rules.reverse)
+#guard sourceRejected (withRules fun rules => rules.take 2)
+#guard sourceRejected (withRules fun rules => rules.map fun r => { r with nfields := r.nfields + 1 })
+#guard sourceRejected (withRules fun rules => rules.map fun r => { r with rhs := .sort .zero })
+#guard sourceRejected (withRecursor fun c => match c with
+  | .recursor u p i m n t rs _ s => .recursor u p i m n t rs true s | c => c)
+#guard sourceRejected (withRecursor fun c => match c with
+  | .recursor u p i m n t rs k _ => .recursor u p i m n t rs k .unsafe | c => c)
+#guard sourceRejected (store fun n b => if n = 40 then
+  ⟨[.axiom 0 (.forallE natType natType) .safe]⟩ else b)
+#guard sourceRejected (store fun n b => if n = 40 then
+  ⟨[.defn 0 .definition (.forallE natType natType) (.const (.ctor 30 1 0) []) .safe]⟩ else b)
+
+def witnessRejected (alter : Ix.Theory.Certified.Modeled.Witness Nat → Ix.Theory.Certified.Modeled.Witness Nat) : Bool :=
+  (prefixWitnesses?).any fun (_, declarations) => (modeledWitness?).any fun witness =>
+    !(acceptsStoreCertified.{0,0} 3000 primitives store [ref 31, ref 31 1]
+      (declarations ++ [.modeled (alter witness)]))
+
+#guard witnessRejected fun w => { w with recursors := w.recursors.reverse }
+#guard witnessRejected fun w => { w with companions := w.companions.reverse }
+#guard witnessRejected fun w => { w with companions := w.companions.drop 1 }
+#guard witnessRejected fun w => { w with equations := w.equations.drop 1 }
+#guard witnessRejected fun w => { w with companions := w.companions.map fun c => { c with model := c.header.ref } }
+#guard witnessRejected fun w => { w with companions := w.companions.map fun c =>
+  { c with rules := c.rules.map fun r => { r with lhs := r.rhs } } }
+#guard witnessRejected fun w => { w with equations := w.equations.map (fun es =>
+  es.map (fun e => { e with proof := .conversion .refl })) }
+
+-- The generic dependency walker rejects a model that depends on the new
+-- source, and does not turn a missing model witness into ordinary admission.
+#guard (Certificate.storeWitness? 3000 primitives store [ref 31] [{ candidate with models :=
+  [ref 30, .ctor 30 0 0, .ctor 30 0 1, ref 30 1, .ctor 30 1 0, ref 31, ref 31 1] }]).isNone
+#guard (Certificate.storeWitness? 3000 primitives store [ref 31]).isNone
+
+-- Model admission supplies no projection or eta facts for the new families.
+#guard (modeledWitness?).all fun w => w.companions.all (fun c => c.entry.facts.isEmpty)
+#guard (prefixWitnesses?).any fun (entries, _) => (modeledWitness?).any fun w =>
+  (inferSource? 3000 0 (Ix.Theory.Certified.Modeled.environment entries w.companions) []
+    (.proj (ref 30 1) 0 (.app (.const (.ctor 30 1 0) []) (.const (.ctor 30 0 0) [])))).isNone
+
+end Tests.Theory.Modeled
diff --git a/Tests/Theory/ModeledEquations.lean b/Tests/Theory/ModeledEquations.lean
new file mode 100644
index 000000000..449e18a8e
--- /dev/null
+++ b/Tests/Theory/ModeledEquations.lean
@@ -0,0 +1,99 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Modeled
+
+open Ix.Theory
+
+namespace Tests.Theory.ModeledEquations
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certificate
+open Tests.Theory.Certified (primitives)
+open Tests.Theory.Modeled (ref)
+
+set_option maxRecDepth 16384
+set_option maxHeartbeats 32000000
+
+def eqRef : ConstRef Nat := ref 60
+def reflRef : ConstRef Nat := .ctor 60 0 0
+def eqRec : ConstRef Nat := ref 61
+def block : Nat → Block Nat
+  | 60 => ⟨[Basis.Equality.shape.source 60]⟩
+  | 61 => ⟨[Basis.Equality.shape.recursorSource 60 61 .large true]⟩
+  | n => Tests.Theory.Modeled.block n
+def store : Store Nat where
+  dom := List.range 62
+  nodup := List.nodup_range
+  blocks b := if b < 62 then some (block b) else none
+  mem_dom b := by split <;> simp_all
+
+def prefixWitnesses? := declarationWitnesses? 4000 store primitives.environment
+  [.ordinary 60 61, .ordinary 20 21, .definition (ref 40), .definition (ref 41), .definition (ref 42)]
+
+/-- Use a checked proof of equality of the complete functions, with their
+entire telescopes as endpoints. No equation is reflected into Theory.IsDefEq. -/
+def propositional? (entries : Environment Nat) (rule : Signature.Rule Nat)
+    (witness : Ix.Theory.Certified.Modeled.EquationWitness Nat) :
+    Option (Ix.Theory.Certified.Modeled.EquationWitness Nat) := do
+  let proof := Basis.Equality.reflexivity reflRef witness.formation.level rule.type rule.lhs
+  let inferred ← inferAnnotated? 4000 rule.universes entries [] proof
+  let typed ← castWith? 4000 rule.universes entries [] inferred
+    (Basis.Equality.applied eqRef witness.formation.level rule.type rule.lhs rule.rhs)
+  return { witness with proof := .propositional eqRef reflRef eqRec proof typed }
+
+def witness? : Option (Ix.Theory.Certified.Modeled.Witness Nat) := do
+  let (entries, _) ← prefixWitnesses?
+  let witness ← Tests.Theory.Modeled.candidate.witness? 4000 entries store
+  let equations ← (witness.companions.zip witness.equations).mapM fun (companion, proofs) =>
+    (companion.rules.zip proofs).mapM fun (rule, proof) =>
+      propositional? entries (Ix.Theory.Certified.Modeled.mapRule witness.companions rule) proof
+  return { witness with equations }
+
+def accepted (alter : Ix.Theory.Certified.Modeled.Witness Nat → Ix.Theory.Certified.Modeled.Witness Nat := id) : Bool :=
+  prefixWitnesses?.any fun (_, earlier) => witness?.any fun witness =>
+    acceptsStoreCertified.{0,0} 4000 primitives store [ref 31, ref 31 1] (earlier ++ [.modeled (alter witness)])
+
+#guard accepted
+#guard !accepted fun w => { w with equations := w.equations.map (fun proofs => proofs.map fun proof =>
+  { proof with proof := .propositional eqRef reflRef eqRec (.sort .zero) .sort }) }
+#guard !accepted fun w => { w with equations := w.equations.map (fun proofs => proofs.map fun proof =>
+  match proof.proof with
+  | .propositional _ r rec term typed => { proof with proof := .propositional (ref 20) r rec term typed }
+  | _ => proof) }
+#guard !accepted fun w => { w with companions := w.companions.map (fun c =>
+  { c with rules := c.rules.map fun rule => { rule with lhs := rule.rhs } }) }
+
+/-- Actual model equation declarations for serialization and command tests.
+Each proof is part of the source store and checked as a normal theorem. -/
+def equationDeclarations? : Option (List (Const Nat)) := do
+  let (entries, _) ← prefixWitnesses?
+  let witness ← Tests.Theory.Modeled.candidate.witness? 4000 entries store
+  return (witness.companions.zip witness.equations).flatMap fun (companion, proofs) =>
+    (companion.rules.zip proofs).map fun (rule, proof) =>
+      let rule := Ix.Theory.Certified.Modeled.mapRule witness.companions rule
+      let type := Basis.Equality.applied eqRef proof.formation.level rule.type rule.lhs rule.rhs
+      let body := Basis.Equality.reflexivity reflRef proof.formation.level rule.type rule.lhs
+      .defn rule.universes .theorem type.erase body.erase .safe
+
+def proofBlock (n : Nat) : Block Nat :=
+  if n < 70 then block n else ⟨((equationDeclarations?.getD [])[n - 70]?).toList⟩
+def proofStore : Store Nat where
+  dom := List.range 73
+  nodup := List.nodup_range
+  blocks b := if b < 73 then some (proofBlock b) else none
+  mem_dom b := by split <;> simp_all
+def hint (n : Nat) : Certificate.Modeled.ProofHint Nat :=
+  ⟨eqRef, reflRef, eqRec, .const (ref n) [.param 0]⟩
+def candidate : Certificate.Modeled.Candidate Nat :=
+  { Tests.Theory.Modeled.candidate with proofs :=
+    [(ref 31, [some (hint 70), some (hint 71)]), (ref 31 1, [some (hint 72)])] }
+def input : ProofInput Nat := ⟨proofStore, 0, Tests.Theory.Modeled.proof, Tests.Theory.Modeled.proposition⟩
+def generatedAccepted : Bool := (Certificate.proofWitness? 4000 primitives input [candidate]).any
+  (acceptsCertified.{0,0} 4000 primitives input)
+#guard generatedAccepted
+#guard (Certificate.proofWitness? 4000 primitives input
+  [{ candidate with proofs := [(ref 31, [some (hint 71), some (hint 70)])] }]).isNone
+
+end Tests.Theory.ModeledEquations
diff --git a/Tests/Theory/ModeledFixtures.lean b/Tests/Theory/ModeledFixtures.lean
new file mode 100644
index 000000000..2369379d7
--- /dev/null
+++ b/Tests/Theory/ModeledFixtures.lean
@@ -0,0 +1,83 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Const
+
+open Ix.Theory
+
+namespace Tests.Theory.ModeledFixtures
+
+/- Frozen source and recursor blocks from Lean4Ix's generator. The model
+tests validate these inputs without importing the old metatheory. -/
+
+def mutualSource : Block Nat := ⟨[
+    .induct 0 0 0 (.sort (.succ .zero)) [
+      ⟨0, 0, 0, (.const (.member 30 0) []), .safe⟩,
+      ⟨0, 0, 1, (.forallE (.const (.member 30 1) []) (.const (.member 30 0) [])), .safe⟩
+    ] .safe,
+    .induct 0 0 0 (.sort (.succ .zero)) [
+      ⟨0, 0, 1, (.forallE (.const (.member 30 0) []) (.const (.member 30 1) [])), .safe⟩
+    ] .safe
+  ]⟩
+
+def mutualRecursors : Block Nat := ⟨[
+    .recursor 1 0 0 2 3 (.forallE (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.forallE (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.forallE (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.forallE (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.forallE (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.forallE (.const (.member 30 0) []) (.app (.bvar 5) (.bvar 0)))))))) [
+      ⟨0, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.bvar 2))))))⟩,
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.lam (.const (.member 30 1) []) (.app (.app (.bvar 2) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 1) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩,
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.lam (.const (.member 30 0) []) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 0) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩
+    ] false .safe,
+    .recursor 1 0 0 2 3 (.forallE (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.forallE (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.forallE (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.forallE (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.forallE (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.forallE (.const (.member 30 1) []) (.app (.bvar 4) (.bvar 0)))))))) [
+      ⟨0, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.bvar 2))))))⟩,
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.lam (.const (.member 30 1) []) (.app (.app (.bvar 2) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 1) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩,
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.app (.bvar 1) (.const (.ctor 30 0 0) [])) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 0 1) []) (.bvar 1))))) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 0) []) (.bvar 1))))) (.lam (.const (.member 30 0) []) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 0) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩
+    ] false .safe
+  ]⟩
+
+def permutedSource : Block Nat := ⟨[
+    .induct 0 0 0 (.sort (.succ .zero)) [
+      ⟨0, 0, 1, (.forallE (.const (.member 30 1) []) (.const (.member 30 0) [])), .safe⟩
+    ] .safe,
+    .induct 0 0 0 (.sort (.succ .zero)) [
+      ⟨0, 0, 0, (.const (.member 30 1) []), .safe⟩,
+      ⟨0, 0, 1, (.forallE (.const (.member 30 0) []) (.const (.member 30 1) [])), .safe⟩
+    ] .safe
+  ]⟩
+
+def permutedRecursors : Block Nat := ⟨[
+    .recursor 1 0 0 2 3 (.forallE (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.forallE (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.forallE (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.forallE (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.forallE (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.forallE (.const (.member 30 0) []) (.app (.bvar 5) (.bvar 0)))))))) [
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.lam (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.lam (.const (.member 30 1) []) (.app (.app (.bvar 3) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 1) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩,
+      ⟨0, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.lam (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.bvar 1))))))⟩,
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.lam (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.lam (.const (.member 30 0) []) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 0) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩
+    ] false .safe,
+    .recursor 1 0 0 2 3 (.forallE (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.forallE (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.forallE (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.forallE (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.forallE (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.forallE (.const (.member 30 1) []) (.app (.bvar 4) (.bvar 0)))))))) [
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.lam (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.lam (.const (.member 30 1) []) (.app (.app (.bvar 3) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 1) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩,
+      ⟨0, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.lam (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.bvar 1))))))⟩,
+      ⟨1, (.lam (.forallE (.const (.member 30 0) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.sort (.param 0))) (.lam (.forallE (.const (.member 30 1) []) (.forallE (.app (.bvar 1) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 30 0 0) []) (.bvar 1))))) (.lam (.app (.bvar 1) (.const (.ctor 30 1 0) [])) (.lam (.forallE (.const (.member 30 0) []) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.const (.ctor 30 1 1) []) (.bvar 1))))) (.lam (.const (.member 30 0) []) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.const (.member 31 0) [(.param 0)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0)))))))))⟩
+    ] false .safe
+  ]⟩
+
+def nestedRecursors : Block Nat := ⟨[
+    .recursor 2 1 0 2 3 (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 1)) (.sort (.param 0))) (.forallE (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.forallE (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 4)) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 6)) (.bvar 1))))) (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5)) (.app (.bvar 5) (.bvar 0))))))))) [
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 4)) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 6)) (.bvar 1))))) (.lam (.bvar 5) (.app (.bvar 3) (.bvar 0)))))))))⟩,
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 4)) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 6)) (.bvar 1))))) (.lam (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 5)) (.app (.app (.bvar 2) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.app (.const (.member 41 1) [(.param 0), (.param 1)]) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0))))))))))⟩,
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 4)) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 6)) (.bvar 1))))) (.lam (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5)) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.app (.const (.member 41 0) [(.param 0), (.param 1)]) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0))))))))))⟩
+    ] false .safe,
+    .recursor 2 1 0 2 3 (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 1)) (.sort (.param 0))) (.forallE (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.forallE (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 4)) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 6)) (.bvar 1))))) (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 5)) (.app (.bvar 4) (.bvar 0))))))))) [
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 4)) (.forallE (.app (.bvar 4) (.bvar 0)) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)))) (.bvar 6)) (.bvar 1))))) (.lam (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5)) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.app (.const (.member 41 0) [(.param 0), (.param 1)]) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0))))))))))⟩
+    ] false .safe
+  ]⟩
+
+def nestedPiRecursors : Block Nat := ⟨[
+    .recursor 2 1 0 2 3 (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 1)) (.sort (.param 0))) (.forallE (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.forallE (.forallE (.forallE (.bvar 4) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5))) (.forallE (.forallE (.bvar 5) (.app (.bvar 5) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 6)) (.bvar 1))))) (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5)) (.app (.bvar 5) (.bvar 0))))))))) [
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.forallE (.bvar 4) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5))) (.forallE (.forallE (.bvar 5) (.app (.bvar 5) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 6)) (.bvar 1))))) (.lam (.bvar 5) (.app (.bvar 3) (.bvar 0)))))))))⟩,
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.forallE (.bvar 4) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5))) (.forallE (.forallE (.bvar 5) (.app (.bvar 5) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 6)) (.bvar 1))))) (.lam (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 5)) (.app (.app (.bvar 2) (.bvar 0)) (.app (.app (.app (.app (.app (.app (.app (.const (.member 41 1) [(.param 0), (.param 1)]) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0))))))))))⟩,
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.forallE (.bvar 4) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5))) (.forallE (.forallE (.bvar 5) (.app (.bvar 5) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 6)) (.bvar 1))))) (.lam (.forallE (.bvar 5) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 6))) (.app (.app (.bvar 1) (.bvar 0)) (.lam (.bvar 6) (.app (.app (.app (.app (.app (.app (.app (.const (.member 41 0) [(.param 0), (.param 1)]) (.bvar 7)) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.app (.bvar 1) (.bvar 0))))))))))))⟩
+    ] false .safe,
+    .recursor 2 1 0 2 3 (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 1)) (.sort (.param 0))) (.forallE (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.forallE (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.forallE (.forallE (.forallE (.bvar 4) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5))) (.forallE (.forallE (.bvar 5) (.app (.bvar 5) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 6)) (.bvar 1))))) (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 5)) (.app (.bvar 4) (.bvar 0))))))))) [
+      ⟨1, (.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 40 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 1)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 40 0 0) [(.param 1)]) (.bvar 3)) (.bvar 0)))) (.lam (.forallE (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.member 20 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 3)) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 4) (.app (.app (.const (.ctor 40 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1))))) (.lam (.forallE (.forallE (.bvar 4) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 5))) (.forallE (.forallE (.bvar 5) (.app (.bvar 5) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 4) (.app (.app (.lam (.sort (.succ (.param 1))) (.app (.const (.ctor 20 0 0) [(.param 1)]) (.forallE (.bvar 0) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 1))))) (.bvar 6)) (.bvar 1))))) (.lam (.forallE (.bvar 5) (.app (.const (.member 40 0) [(.param 1)]) (.bvar 6))) (.app (.app (.bvar 1) (.bvar 0)) (.lam (.bvar 6) (.app (.app (.app (.app (.app (.app (.app (.const (.member 41 0) [(.param 0), (.param 1)]) (.bvar 7)) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.app (.bvar 1) (.bvar 0))))))))))))⟩
+    ] false .safe
+  ]⟩
+
+end Tests.Theory.ModeledFixtures
diff --git a/Tests/Theory/ModeledNested.lean b/Tests/Theory/ModeledNested.lean
new file mode 100644
index 000000000..54bd19390
--- /dev/null
+++ b/Tests/Theory/ModeledNested.lean
@@ -0,0 +1,177 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Modeled
+
+open Ix.Theory
+
+namespace Tests.Theory.ModeledNested
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certificate Ix.Theory.Inductive
+open Tests.Theory.Certified (primitives)
+open Tests.Theory.Modeled (ref const)
+
+set_option maxRecDepth 16384
+set_option maxHeartbeats 32000000
+
+def boxShape : Ix.Theory.Certified.Ordinary.Shape Nat :=
+  ⟨1, [.sort (.succ (.param 0))], [], .succ (.param 0), [⟨[.bvar 0], [], []⟩]⟩
+
+def unaryShape (recursivePi : Bool) : Ix.Theory.Certified.Ordinary.Shape Nat :=
+  ⟨1, [.sort (.succ (.param 0))], [], .succ (.param 0),
+    [⟨[.bvar 0], [], []⟩, ⟨[], [⟨if recursivePi then [.bvar 0] else [], []⟩], []⟩]⟩
+
+def tree (level : VLevel) (parameter : VExpr Nat) : VExpr Nat := .app (const 40 0 [level]) parameter
+def box (level : VLevel) (parameter : VExpr Nat) : VExpr Nat := .app (const 20 0 [level]) parameter
+def unary (level : VLevel) (parameter : VExpr Nat) : VExpr Nat := .app (const 30 0 [level]) parameter
+def branch (recursivePi : Bool) (parameter family : VExpr Nat) : VExpr Nat :=
+  if recursivePi then .forallE parameter (family.liftN 1) else family
+
+def boxMk (level : VLevel) (parameter value : VExpr Nat) : VExpr Nat :=
+  .appN (.const (.ctor 20 0 0) [level]) [parameter, value]
+
+/-- Tree α = leaf α | node (Box (Tree α)), or node (Box (α → Tree α)).
+Both are parameterized nested occurrences with a restored Box recursor. -/
+def treeSource (recursivePi : Bool) : Const Nat := .induct 1 1 0
+  (.forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))) [
+  ⟨1, 1, 1, .forallE (.sort (.succ (.param 0)))
+    (.forallE (.bvar 0) (tree (.param 0) (.bvar 1))), .safe⟩,
+  ⟨1, 1, 1, .forallE (.sort (.succ (.param 0)))
+    (.forallE (box (.param 0) (branch recursivePi (.bvar 0) (tree (.param 0) (.bvar 0)))) (tree (.param 0) (.bvar 1))), .safe⟩] .safe
+
+def sourceBlock (recursivePi : Bool) : Nat → Block Nat
+  | 10 => ⟨[PrimitiveSignature.falseDeclaration]⟩
+  | 11 => ⟨[primitives.falseElimDeclaration]⟩
+  | 20 => ⟨[boxShape.source 20]⟩
+  | 21 => ⟨[boxShape.recursorSource 20 21 .large]⟩
+  | 30 => ⟨[(unaryShape recursivePi).source 30]⟩
+  | 31 => ⟨[(unaryShape recursivePi).recursorSource 30 31 .large]⟩
+  | 40 => ⟨[treeSource recursivePi]⟩
+  | _ => ⟨[]⟩
+
+def storeFor (blocks : Nat → Block Nat) : Store Nat where
+  dom := List.range 53
+  nodup := List.nodup_range
+  blocks b := if b < 53 then some (blocks b) else none
+  mem_dom b := by split <;> simp_all
+
+def sourceStore (recursivePi : Bool) : Store Nat := storeFor (sourceBlock recursivePi)
+def treeRecursors (recursivePi : Bool) : Block Nat :=
+  if recursivePi then ModeledFixtures.nestedPiRecursors else ModeledFixtures.nestedRecursors
+
+def modelTargets : List (ConstRef Nat) := [ref 30, .ctor 30 0 0, ref 50, ref 51, ref 52]
+def modelPairs : List (ConstRef Nat × ConstRef Nat) :=
+  [ref 40, .ctor 40 0 0, .ctor 40 0 1, ref 41, ref 41 1].zip modelTargets
+def mapped (expression : VExpr Nat) : VExpr Nat := expression.mapRefs (Certificate.Modeled.target modelPairs)
+def recursorType (recursivePi : Bool) (index : Nat) : VExpr Nat :=
+  mapped (((treeRecursors recursivePi).members[index]?).map Const.type |>.getD (.sort .zero))
+def recPrefix (recursivePi : Bool) : List (VExpr Nat) := (recursorType recursivePi 0).telN 6
+
+def nodeType (recursivePi : Bool) : VExpr Nat :=
+  match treeSource recursivePi with
+  | .induct _ _ _ _ ctors _ => mapped ((ctors[1]?).map Ctor.type |>.getD (.sort .zero))
+  | _ => .sort .zero
+def nodeBody (recursivePi : Bool) : VExpr Nat := .lam (.sort (.succ (.param 0)))
+  (.lam (box (.param 0) (branch recursivePi (.bvar 0) (unary (.param 0) (.bvar 0))))
+    (.appN (.const (.ctor 30 0 1) [.param 0]) [.bvar 1, .proj (ref 20) 0 (.bvar 0)]))
+
+/-- Ordinary unary recursion supplies both nested calls. The constructor
+and auxiliary recursor use Box's independently checked projection and eta. -/
+def treeModel (recursivePi : Bool) : VExpr Nat := .lamN (recPrefix recursivePi)
+  (.appN (const 31 0 [.param 0, .param 1]) [
+    .bvar 5, .bvar 4, .bvar 2,
+    .lam (branch recursivePi (.bvar 5) (unary (.param 1) (.bvar 5)))
+      (.lam (if recursivePi then .forallE (.bvar 6) (.app (.bvar 6) (.app (.bvar 1) (.bvar 0)))
+          else .app (.bvar 5) (.bvar 0))
+        (.appN (.bvar 3) [boxMk (.param 1) (branch recursivePi (.bvar 7) (unary (.param 1) (.bvar 7))) (.bvar 1),
+          .appN (.bvar 2) [.bvar 1, .bvar 0]]))])
+
+def boxModel (recursivePi : Bool) : VExpr Nat := .lamN (recPrefix recursivePi)
+  (.appN (const 21 0 [.param 0, .param 1]) [
+    branch recursivePi (.bvar 5) (unary (.param 1) (.bvar 5)), .bvar 3,
+    .lam (branch recursivePi (.bvar 5) (unary (.param 1) (.bvar 5)))
+      (.appN (.bvar 1) [.bvar 0,
+        if recursivePi then .lam (.bvar 6)
+          (.appN (const 51 0 [.param 0, .param 1]) (VExpr.bvarRevRange 2 6 ++ [.app (.bvar 1) (.bvar 0)]))
+        else .appN (const 51 0 [.param 0, .param 1]) (VExpr.bvarRevRange 1 6 ++ [.bvar 0])])])
+
+def block (recursivePi : Bool) : Nat → Block Nat
+  | 41 => treeRecursors recursivePi
+  | 50 => ⟨[.defn 1 .definition (nodeType recursivePi) (nodeBody recursivePi) .safe]⟩
+  | 51 => ⟨[.defn 2 .definition (recursorType recursivePi 0) (treeModel recursivePi) .safe]⟩
+  | 52 => ⟨[.defn 2 .definition (recursorType recursivePi 1) (boxModel recursivePi) .safe]⟩
+  | n => sourceBlock recursivePi n
+def store (recursivePi : Bool) : Store Nat := storeFor (block recursivePi)
+def candidate : Certificate.Modeled.Candidate Nat := ⟨40, [ref 41, ref 41 1], modelTargets, []⟩
+
+def prefixWitnesses? (recursivePi : Bool) : Option (Environment Nat × List (DeclarationWitness Nat)) :=
+  declarationWitnesses? 4000 (store recursivePi) primitives.environment
+    [.ordinary 20 21, .ordinary 30 31, .definition (ref 50), .definition (ref 51), .definition (ref 52)]
+def modeledWitness? (recursivePi : Bool) : Option (Ix.Theory.Certified.Modeled.Witness Nat) := do
+  let (entries, _) ← prefixWitnesses? recursivePi
+  candidate.witness? 4000 entries (store recursivePi)
+def generated? (recursivePi : Bool) : Option (List (DeclarationWitness Nat)) :=
+  Certificate.storeWitness? 4000 primitives (store recursivePi) [ref 41, ref 41 1] [candidate]
+def accepted (recursivePi : Bool) : Bool := (generated? recursivePi).any
+  (acceptsStoreCertified.{0,0} 4000 primitives (store recursivePi) [ref 40, ref 41, ref 41 1])
+
+#guard [false, true].all fun recursivePi => (treeRecursors recursivePi).members.length == 2
+#guard [false, true].all fun recursivePi =>
+  (Ix.Theory.Certified.Modeled.sourceRefs? (store recursivePi) 40 [ref 41, ref 41 1]).isSome
+#guard [false, true].all fun recursivePi =>
+  (Ix.Theory.Certified.Modeled.recursorRules? (store recursivePi) (ref 41)).any (fun rules => rules.length == 2)
+#guard [false, true].all fun recursivePi =>
+  (Ix.Theory.Certified.Modeled.recursorRules? (store recursivePi) (ref 41 1)).any (fun rules => rules.length == 1)
+#guard [false, true].all fun recursivePi => (prefixWitnesses? recursivePi).isSome
+#guard [false, true].all fun recursivePi => (modeledWitness? recursivePi).isSome
+#guard [false, true].all accepted
+
+def computed (recursivePi : Bool) : VExpr Nat :=
+  let treeType := tree .zero (.sort .zero)
+  let fieldType := branch recursivePi (.sort .zero) treeType
+  let boxType := box .zero fieldType
+  let leaf := fun value => VExpr.appN (.const (.ctor 40 0 0) [.zero]) [.sort .zero, value]
+  let field := if recursivePi then .lam (.sort .zero) (leaf (.bvar 0)) else leaf (.bvar 1)
+  .appN (const 41 0 [.succ .zero, .zero]) [
+    .sort .zero,
+    .lam treeType (.sort .zero), .lam boxType (.sort .zero),
+    .lam (.sort .zero) (.bvar 0),
+    .lam boxType (.lam (.sort .zero) (.bvar 0)),
+    .lam fieldType (.lam
+      (if recursivePi then .forallE (.sort .zero) (.sort .zero) else .sort .zero)
+      (if recursivePi then .app (.bvar 0) (.bvar 3) else .bvar 0)),
+    .appN (.const (.ctor 40 0 1) [.zero]) [.sort .zero, boxMk .zero fieldType field]]
+
+def input (recursivePi : Bool) : ProofInput Nat :=
+  ⟨store recursivePi, 0, Tests.Theory.Modeled.proof,
+    .forallE (.sort .zero) (.forallE (.bvar 0) (computed recursivePi))⟩
+def proofAccepted (recursivePi : Bool) : Bool :=
+  (Certificate.proofWitness? 4000 primitives (input recursivePi) [candidate]).any
+    (acceptsCertified.{0,0} 4000 primitives (input recursivePi))
+
+#guard [false, true].all proofAccepted
+
+def tampered (recursivePi : Bool) (alter : Const Nat → Const Nat) : Store Nat :=
+  storeFor fun n => if n = 41 then ⟨(treeRecursors recursivePi).members.map alter⟩ else block recursivePi n
+
+def rejected (recursivePi : Bool) (source : Store Nat) : Bool := (generated? recursivePi).any fun witnesses =>
+  !(acceptsStoreCertified.{0,0} 4000 primitives source [ref 41, ref 41 1] witnesses)
+
+#guard [false, true].all fun recursivePi => rejected recursivePi (tampered recursivePi fun c => match c with
+  | .recursor u p i m n t rs k s => .recursor u p i m n (t.instL [.param 1, .param 0]) rs k s
+  | c => c)
+#guard [false, true].all fun recursivePi => rejected recursivePi (tampered recursivePi fun c => match c with
+  | .recursor u p i m n t rs k s => .recursor u p i m n t (rs.map fun r => { r with nfields := 0 }) k s
+  | c => c)
+
+-- Swapping the restored auxiliary with its root, or substituting its model
+-- for the root's model, cannot preserve the actual selected rule statements.
+#guard [false, true].all fun recursivePi => (prefixWitnesses? recursivePi).any fun (entries, _) =>
+  (Certificate.Modeled.witness? 4000 entries (store recursivePi) 40 [ref 41 1, ref 41] modelTargets).isNone
+#guard [false, true].all fun recursivePi => (prefixWitnesses? recursivePi).any fun (entries, _) =>
+  (Certificate.Modeled.witness? 4000 entries (store recursivePi) 40 [ref 41, ref 41 1]
+    [ref 30, .ctor 30 0 0, ref 50, ref 52, ref 51]).isNone
+
+end Tests.Theory.ModeledNested
diff --git a/Tests/Theory/ModeledPermutation.lean b/Tests/Theory/ModeledPermutation.lean
new file mode 100644
index 000000000..8b1eeeaff
--- /dev/null
+++ b/Tests/Theory/ModeledPermutation.lean
@@ -0,0 +1,105 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Modeled
+
+open Ix.Theory
+
+namespace Tests.Theory.ModeledPermutation
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certificate Ix.Theory.Inductive
+open Tests.Theory.Certified (primitives)
+open Tests.Theory.Modeled (ref const)
+
+set_option maxRecDepth 16384
+set_option maxHeartbeats 32000000
+
+def swap : ConstRef Nat → ConstRef Nat
+  | .member 30 0 => .member 30 1
+  | .member 30 1 => .member 30 0
+  | .ctor 30 0 c => .ctor 30 1 c
+  | .ctor 30 1 c => .ctor 30 0 c
+  | .member 31 0 => .member 31 1
+  | .member 31 1 => .member 31 0
+  | ref => ref
+
+def source : Block Nat := ModeledFixtures.permutedSource
+def recursors : Block Nat := ModeledFixtures.permutedRecursors
+def targets : List (ConstRef Nat) :=
+  [ref 20, ref 40, ref 20, .ctor 20 0 0, .ctor 20 0 1, ref 43, ref 44]
+def pairs : List (ConstRef Nat × ConstRef Nat) :=
+  [ref 30, .ctor 30 0 0, ref 30 1, .ctor 30 1 0, .ctor 30 1 1, ref 31, ref 31 1].zip targets
+def type (index : Nat) : VExpr Nat :=
+  (((recursors.members[index]?).map Const.type).getD (.sort .zero)).mapRefs (Certificate.Modeled.target pairs)
+
+/-- Reorder the complete motive/minor telescope when wrapping the earlier
+models. Merely permuting addresses or constructor counts would not typecheck. -/
+def body (index : Nat) : VExpr Nat := .lamN ((type index).telN 5)
+  (.appN (const (if index = 0 then 42 else 41) 0 [.param 0]) [.bvar 3, .bvar 4, .bvar 1, .bvar 0, .bvar 2])
+def block : Nat → Block Nat
+  | 30 => source
+  | 31 => recursors
+  | 43 => ⟨[.defn 1 .definition (type 0) (body 0) .safe]⟩
+  | 44 => ⟨[.defn 1 .definition (type 1) (body 1) .safe]⟩
+  | n => Tests.Theory.Modeled.block n
+def store : Store Nat where
+  dom := List.range 45
+  nodup := List.nodup_range
+  blocks b := if b < 45 then some (block b) else none
+  mem_dom b := by split <;> simp_all
+def candidate : Certificate.Modeled.Candidate Nat := ⟨30, [ref 31, ref 31 1], targets, []⟩
+def witnesses? := Certificate.storeWitness? 4000 primitives store [ref 31, ref 31 1] [candidate]
+def accepted : Bool := witnesses?.any
+  (acceptsStoreCertified.{0,0} 4000 primitives store [ref 30, ref 30 1, ref 31, ref 31 1])
+
+#guard store.ctorRuleIndex? (.ctor 30 1 0) == some 1
+#guard store.ctorRuleIndex? (.ctor 30 1 1) == some 2
+#guard accepted
+#guard (Certificate.storeWitness? 4000 primitives store [ref 31]
+  [{ candidate with models := Tests.Theory.Modeled.modelTargets }]).isNone
+
+def computed : VExpr Nat := .appN (const 31 1 [.succ .zero]) [
+  .lam (const 30) (.sort .zero), .lam (const 30 1) (.sort .zero),
+  .lam (const 30 1) (.lam (.sort .zero) (.bvar 0)), .bvar 1,
+  .lam (const 30) (.lam (.sort .zero) (.bvar 0)),
+  .app (.const (.ctor 30 1 1) [])
+    (.app (.const (.ctor 30 0 0) []) (.const (.ctor 30 1 0) []))]
+def input : ProofInput Nat := ⟨store, 0, Tests.Theory.Modeled.proof,
+  .forallE (.sort .zero) (.forallE (.bvar 0) computed)⟩
+def proofAccepted : Bool := (Certificate.proofWitness? 4000 primitives input [candidate]).any
+  (acceptsCertified.{0,0} 4000 primitives input)
+#guard proofAccepted
+
+/-- Two fresh source auxiliary recursors may share one already checked model.
+Their complete types and own rule statements still pass independent checks. -/
+def mergedBlock : Nat → Block Nat
+  | 45 => ⟨(Tests.Theory.Modeled.mutualRecursors.members[1]?).toList⟩
+  | n => Tests.Theory.Modeled.block n
+def mergedStore : Store Nat where
+  dom := List.range 46
+  nodup := List.nodup_range
+  blocks b := if b < 46 then some (mergedBlock b) else none
+  mem_dom b := by split <;> simp_all
+def mergedCandidate : Certificate.Modeled.Candidate Nat :=
+  ⟨30, [ref 31, ref 31 1, ref 45], Tests.Theory.Modeled.modelTargets ++ [ref 42], []⟩
+def mergedWitnesses? := Certificate.storeWitness? 4000 primitives mergedStore [ref 31 1, ref 45] [mergedCandidate]
+def mergedAccepted : Bool := mergedWitnesses?.any
+  (acceptsStoreCertified.{0,0} 4000 primitives mergedStore [ref 31 1, ref 45])
+#guard mergedAccepted
+#guard (Certificate.storeWitness? 4000 primitives mergedStore [ref 45]
+  [{ mergedCandidate with models := Tests.Theory.Modeled.modelTargets ++ [ref 41] }]).isNone
+
+def mergedComputed : VExpr Nat := .appN (const 45 0 [.succ .zero]) [
+  .lam (const 30) (.sort .zero), .lam (const 30 1) (.sort .zero), .bvar 1,
+  .lam (const 30 1) (.lam (.sort .zero) (.bvar 0)),
+  .lam (const 30) (.lam (.sort .zero) (.bvar 0)),
+  .app (.const (.ctor 30 1 0) []) (.const (.ctor 30 0 0) [])]
+def mergedInput : ProofInput Nat := ⟨mergedStore, 0, Tests.Theory.Modeled.proof,
+  .forallE (.sort .zero) (.forallE (.bvar 0) mergedComputed)⟩
+def mergedProofAccepted : Bool := (Certificate.proofWitness? 4000 primitives mergedInput [mergedCandidate]).any
+  (acceptsCertified.{0,0} 4000 primitives mergedInput)
+#guard mergedProofAccepted
+
+end Tests.Theory.ModeledPermutation
diff --git a/Tests/Theory/NamedManifest.lean b/Tests/Theory/NamedManifest.lean
new file mode 100644
index 000000000..6bdf540cd
--- /dev/null
+++ b/Tests/Theory/NamedManifest.lean
@@ -0,0 +1,123 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+/-! Retained named-specification source inventory. Original modules,
+revision and attribution are recorded in `Ix/Theory/Named/NOTICE`.
+Hashes identify the original inputs, before Ix integration. -/
+
+namespace Tests.Theory.NamedManifest
+
+structure SourceFile where
+  target : String
+  sourceSha256 : String
+
+def selected : Array SourceFile := #[
+  ⟨"Ix/Theory/Named/Reference/Declaration.lean", "cefbf66e2134bec472aa9fd643122a3052bbbfd12ab04e6dbd85fe21e32fb0fa"⟩,
+  ⟨"Ix/Theory/Named/Reference/Environment.lean", "8de5b7407e225c96ed4116bc46e2e3bad5009b6bfb0cb4f68d4ce2799eff4f11"⟩,
+  ⟨"Ix/Theory/Named/Reference/Environment/Basic.lean", "cc39f3a7ae819fed332407c01239dc604a49c8a5dffb379564aade970ff1bcf9"⟩,
+  ⟨"Ix/Theory/Named/Reference/Expr.lean", "6cb6f0e5df484973fc282bb86968bb51a1c73ec32d726010b1d7b2133229ac81"⟩,
+  ⟨"Ix/Theory/Named/Reference/ForEachExprV.lean", "260167ef5e882a5bd2482734dd72749b809857dbe99bc2aa32e28c6b4b2fb37e"⟩,
+  ⟨"Ix/Theory/Named/Reference/FuelConfig.lean", "3ab65df013711059ef867c2683a7516b77cea87a526cf47c1772e9c8a529d35a"⟩,
+  ⟨"Ix/Theory/Named/Reference/Inductive/Add.lean", "17dda89d60cac89cba4fc9a4db8233eee8199ce7aee4de337bcd677d076eceb6"⟩,
+  ⟨"Ix/Theory/Named/Reference/Inductive/EliminationTrace.lean", "d14f7bc2aeb2037701ac12d0217f405b94812fdc441942458656bb543627d095"⟩,
+  ⟨"Ix/Theory/Named/Reference/Inductive/Reduce.lean", "c6daf4dcec4ffc6c27a64e1054500ec025646d6d15c7c2d61c1323e4928dcc17"⟩,
+  ⟨"Ix/Theory/Named/Reference/Inductive/ValidationTrace.lean", "7b4e36920a1286b319237a4db632acfac09e203cb3699835fa7440e31f52bbbd"⟩,
+  ⟨"Ix/Theory/Named/Reference/Instantiate.lean", "ae08b31657faf3b54de22688ae287d0bff362c573d6a2dd09f12f417b1975ec2"⟩,
+  ⟨"Ix/Theory/Named/Reference/Level.lean", "75932c6c1d406cbbf75e60c56b75e4a9b33f743651f5aa50814c7c369edbed76"⟩,
+  ⟨"Ix/Theory/Named/Reference/List.lean", "4ddde2232aff649a50a8d1bec44e9495e2387dd3fcc29833d4f9c67c514431a4"⟩,
+  ⟨"Ix/Theory/Named/Reference/LocalContext.lean", "5baf7b6b379cbbd3902578c5da9d454558031b52f2af508481bc4647c0d91a1b"⟩,
+  ⟨"Ix/Theory/Named/Reference/Primitive.lean", "a8407d6fdb55c15225c5535b89a1c647af7b20729adb810b9887372b1a9ea745"⟩,
+  ⟨"Ix/Theory/Named/Reference/PtrEq.lean", "395e6b6907e548582d9e40e37f5344d6919e597500608c597048e621f27f0aa2"⟩,
+  ⟨"Ix/Theory/Named/Reference/Quot.lean", "79c51dae8b2ac0e09537aaabfb32075fe4a9d5dd34a1a78d47a88229a74926c5"⟩,
+  ⟨"Ix/Theory/Named/Std/Basic.lean", "885fd60674f7ceec447d20b56f34a2945dccc9d1193041d552162b7220ba6d67"⟩,
+  ⟨"Ix/Theory/Named/Std/Control.lean", "71dd61bc6bb315f1590ae79e276ada1c0c5c8eb31e67b0f994ed29f92b05fcc2"⟩,
+  ⟨"Ix/Theory/Named/Std/HashMap.lean", "67afa618c36314613b553eb95dafbbf7c5cca01b9e7d8749b4c024de966c37db"⟩,
+  ⟨"Ix/Theory/Named/Std/NodupKeys.lean", "b0a5f079a7f034f0c436de4ca120fd07197775cba26c625d2a2e1c8054ef460e"⟩,
+  ⟨"Ix/Theory/Named/Std/Ord.lean", "26380558d7e4fd742274d4f4d9396eb2d10feaa0ad945cfd57c0a37b12a04fa4"⟩,
+  ⟨"Ix/Theory/Named/Std/PersistentHashMap.lean", "c619b8962018a8b4fe3afb9fb0ee7c77bb92e75c323fc3f849ed4d8c199a4c59"⟩,
+  ⟨"Ix/Theory/Named/Std/SMap.lean", "574b0996076ccb5814ba381f13f288259fbb821abd33c20f9b891bac6c1e1fb0"⟩,
+  ⟨"Ix/Theory/Named/Std/ToExpr.lean", "5068adbd3d6c0b2d33ec84420efd66e8025dad2b6ed7171b7d10d1453db08e82"⟩,
+  ⟨"Ix/Theory/Named/Std/VariableBang.lean", "783456566db97120957903fc5beccf549507ed8e1f0fcd76cde4d0175f02a012"⟩,
+  ⟨"Ix/Theory/Named/Fixtures/ProjectionExpressibility.lean", "ee30b121ece1f5ea7ca2bb315b8e02557b75b5ef33a9986edb12b7b7dab76de0"⟩,
+  ⟨"Ix/Theory/Named/ConstructorValidityFixtures.lean", "4743314f7fd0e0323463cc7fd403a68792c5e0dabbdbcaaba9e1289136527cde"⟩,
+  ⟨"Ix/Theory/Named/Inductive.lean", "5cf6f5c19b301396b35d141a90b6b0281ae984e0e64c502d657d6dc15fb5dc57"⟩,
+  ⟨"Ix/Theory/Named/InductiveFixtures.lean", "4e663484b880adc47045c4d3760456e3c9192951ff9b0f188eea34eff5adcc55"⟩,
+  ⟨"Ix/Theory/Named/Literals.lean", "cfb64f593c6e3643d83d479d29129d0e73522327529143ef41fd62e162d6998a"⟩,
+  ⟨"Ix/Theory/Named/LocalContext.lean", "e31fe96e8ec2e2718c65bd2eb8a4b9c01286d54956d1a4a23ef47b83706c7d1f"⟩,
+  ⟨"Ix/Theory/Named/Meta.lean", "37f47b54a8b855ee7f0c4f2a322fb3c7ad319d1749861c386d9b966142f2c8b7"⟩,
+  ⟨"Ix/Theory/Named/MutualInductiveFixtures.lean", "907e4cc7a7855eec5b32bf22457baf0eb482b15529e56d8eb2f2369eaaf79414"⟩,
+  ⟨"Ix/Theory/Named/NestedInductive.lean", "c88720c864cd7a4c62d44b116779c7ddb93aacd2b9b51c2fea87e4c1afeddfaf"⟩,
+  ⟨"Ix/Theory/Named/NestedInductiveFixtures.lean", "2b31e2f7691a631007a5a3e4c83227515476c13d812c391e7ab111ceba4b8d99"⟩,
+  ⟨"Ix/Theory/Named/Projection.lean", "9f5108d2192b951a2b8ee05f102fe03bea5c40563f4f10fa27b74c34853884e6"⟩,
+  ⟨"Ix/Theory/Named/Quot.lean", "3742bc54150fb1b410d5807cd64355cc169fd6ea809dbb71662dc9d28a64c617"⟩,
+  ⟨"Ix/Theory/Named/SingletonParity.lean", "018c3ea29f04d2274bd47362ed09d959ab3873abf59f0ad23c79afb03f37eb52"⟩,
+  ⟨"Ix/Theory/Named/Typing/Basic.lean", "24827047806ee6ffb9af8ed457143cbb6b0c57326557e0f433339840272114a5"⟩,
+  ⟨"Ix/Theory/Named/Typing/Env.lean", "72949fadf8565117631d4ce822a2d44ebd671843e52a70a8617f0c9c85411cfa"⟩,
+  ⟨"Ix/Theory/Named/Typing/EnvLemmas.lean", "bd9f777d16b60d6bfa74e5e4e2dbf2423df1c1478c38970144a849078623e80b"⟩,
+  ⟨"Ix/Theory/Named/Typing/InductiveCertificate.lean", "ef4b4970be4680efda15c6ed921584f30d174a462c2643c6bb60c43d2248d353"⟩,
+  ⟨"Ix/Theory/Named/Typing/InductiveLemmas.lean", "90bb4f3964705de120018360d7bcf14ab81f05c621fd7c0c0c49539af301fa77"⟩,
+  ⟨"Ix/Theory/Named/Typing/InductivePattern.lean", "45480de8808c6311c0635ab0afc7fcdbe0c3534558cb1902f7d97d80886c423a"⟩,
+  ⟨"Ix/Theory/Named/Typing/InductivePatternWF.lean", "884955ce4111aed9540b7d02ebc2469aa26168a8efa476b2ee1cdd01ee402926"⟩,
+  ⟨"Ix/Theory/Named/Typing/Injectivity.lean", "e7233bde95305b46aa1d22d3e13e21aea93f7e3f903eeb46865c226ffe0bba88"⟩,
+  ⟨"Ix/Theory/Named/Typing/Lemmas.lean", "f183e28ec58a52dadba983cb53a55537cb9a497d9e8e4f78d2c2ca4cc9427a38"⟩,
+  ⟨"Ix/Theory/Named/Typing/Meta.lean", "16b0fb88d6719cdd1293108ca2520c1ef2c601819ef5562d0aa7c2d007021d9b"⟩,
+  ⟨"Ix/Theory/Named/Typing/NestedInductiveLemmas.lean", "f1dcef8e876386abfbebc5a36ca751dafaa75257b7c6c9f506c7447c4be9cd49"⟩,
+  ⟨"Ix/Theory/Named/Typing/Pattern.lean", "db05a0847000f4d3e2a69f4b053112bfca31dbc2b11082a804052bb44562f4e3"⟩,
+  ⟨"Ix/Theory/Named/Typing/QuotLemmas.lean", "63abdab93b43679259fc25df480afa1b2086edc8cf52cca5b08b2f36be847309"⟩,
+  ⟨"Ix/Theory/Named/Typing/Strong.lean", "266fbcb98287ad2f53c0c7ed11960aaa620471b71d4289def448ec259019d46a"⟩,
+  ⟨"Ix/Theory/Named/Typing/UniqueTyping.lean", "c297cd16f1ec43d6ea4fba930ddd490555cf212d59389f39765beb986dde5a3f"⟩,
+  ⟨"Ix/Theory/Named/VDecl.lean", "94f3032a2aa1e9e71056b1373fb456b242ede7405c88abe593e7f8432f760a66"⟩,
+  ⟨"Ix/Theory/Named/VEnv.lean", "16c9bb411f7482d5c08585a278b8ad8209eb8deb023bcb77f7bad675825a83a9"⟩,
+  ⟨"Ix/Theory/Named/VExpr.lean", "469c797a6eaee8883060470e0830dbe56b4b64f7ca91d9ae63304e288849ac8c"⟩,
+  ⟨"Ix/Theory/Named/VLevel.lean", "a570dff7d2065ca64acd1bb920628ec332b4e39f18a2dc423cbf3a7bd469ba58"⟩,
+  ⟨"Ix/Theory/Named/Reference/TypeChecker.lean", "40f99258932cfa5f2c99a2c2b5f7b59b467c10348cd238b70453f95e61dd7383"⟩,
+  ⟨"Ix/Theory/Named/Verify/Axioms.lean", "4c890728353a1df1b754b09bec3635b75bbfade362aff83a35005b2f316f5863"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/Basic.lean", "161d0abd5c8f4a8a8a09db2ab3bdcd988171aba2c7dcb4a997bd6a8cb32a89ae"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/ConstructorValidation.lean", "2ce3772020b93feed5e88a0a27d3dcdcb32801b0aca24c7c1e5fb694d9cf382e"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/ConstructorValidityMatrix.lean", "4245035c98958b93c3daefa2efd78f1f0c9779d5bd2a5633db0c2f60958b88b7"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/Elimination.lean", "89365c4a39346bcd7b1f94b7f568a272e4e02b64ff1b897df38f598079890011"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesCommon.lean", "1a2dbd72b2538f673c5080abd023c639bee0c200f9d2fd832158f312f726e8b9"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesEdges.lean", "86aaa7338723cdc0005d3646b68c77099ad8e1c113ac283b9d6048783bda4910"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesEq.lean", "371f2bd76c849048b8c27b741af65214e6345374e09c1658e00eceef0bd5e9d4"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesEqNat.lean", "08d2a0352b9a7652ee0c3296b8e6de36e3f3d16b44c77fa962855b355412479a"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesNat.lean", "5fc23bf4dacc65a476fa6416fbf548c75b563574aad7d1c670d28df5a27ce541"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesOrAnd.lean", "993466ee37f03b2f7494116d58dca184614f32308b851d0bceb275ddd4c3a79f"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/EliminationFixturesSmall.lean", "65d5114cba03dbc1e25b5ec644f35d72ac27dc370a376a37536ffb8c9d4e1409"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/IndexedVecCandidate.lean", "ba5fc7e4d21f85c1fbd091bdcdecc51c7c252a00329c6e4ce41cf703cfbfb280"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/IndexedVecConsReplay.lean", "5fc8c9d63d58a208f0318894f9ba77d87cff021f2dc413575da4e8e5ae42d738"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/IndexedVecConstructors.lean", "effb4340d8f020607ef34f0bb0195ee5e4217f15385e0c690b354c1c2aa23b04"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/IndexedVecOuterReplay.lean", "b15ebd574638b1f728439045f06b85421402dabfcc1df1e92fda97198d7de7e8"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/IndexedVecSemanticReplay.lean", "d2793f18d3052acac81951e18e01d5a5a20c3569cae1d831e3064c251bcf05c9"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/InductiveFixtures.lean", "5da7e485923a6e5d9db14361844d48c9628f22b7088072d861f9d24e01acd934"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/Lemmas.lean", "fe1c3fcec718f780e29af9051b62a906b3f6aa53502ac8740d01f8477ab49576"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/MutualInductiveFixtures.lean", "cab86779e590746367fb013f95ecb48f0a3f86b06a56ccf1ac43ae7fec78514d"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/NestedReplay.lean", "c76e7291e064a68f64b3d545de4c887fd8321950d514b485832dce76108bfa28"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/NestedRepresentation.lean", "7e5cd82cf41d35a6844d2cbc1f5af67ab5ccad33f81e199984e4017348487b2d"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/NestedTransformation.lean", "fd1aefd95d4374e0ae87cff11b10c468b7743c822f0f4cbb1a4f3923baee0b0f"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/Normalization.lean", "a9df5c28f597dc88f0cc496a1ad8a2c189ef82fddd194007e2bda7de15c27cdc"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/NormalizationMatrix.lean", "0495afd91d4770ec0dc998431828b370c65b4cc1b894994c06b4a50525b44342"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/SingletonParityMatrix.lean", "abc03daf11487f774a89f18506995d3e1f45e817f99dcc361219da73dd586322"⟩,
+  ⟨"Ix/Theory/Named/Verify/Environment/SingletonParityReplay.lean", "19cf222cf463ad9882c7c2ce278150678310b00141fa712684cb68061d1761c2"⟩,
+  ⟨"Ix/Theory/Named/Verify/Expr.lean", "520da96e974f708a15b738479cea37bdc3458adaca6523975f69b15f7bf52cd4"⟩,
+  ⟨"Ix/Theory/Named/Verify/Level.lean", "66f0ffcb59ae63498e8c6fb9cee87fa4003c67f1628fb87ec7661714975a4e02"⟩,
+  ⟨"Ix/Theory/Named/Verify/LevelStd.lean", "8aada81455e9c6a88eba0dcce86e30daf34ec9215e26ae4dfc9f396a49b8f57c"⟩,
+  ⟨"Ix/Theory/Named/Verify/LocalContext.lean", "91718812c4d727d27f8723e039b5e7d490e03a7d8bb4163ffed26ee1df030fe8"⟩,
+  ⟨"Ix/Theory/Named/Verify/Name.lean", "8a3ae08cc776deba9354b28010327470f241e4c924c335dff142b3f8ec326c78"⟩,
+  ⟨"Ix/Theory/Named/Verify/NameGenerator.lean", "3d7305876fcfc487c625aaee8c737a4bdb1a80b62f70a4fc3cfeaf3cf39219af"⟩,
+  ⟨"Ix/Theory/Named/Verify/NormLt.lean", "970149d18191ecbd889136507e6dd68ea43b833b6170ab825b69a90b4561e2f5"⟩,
+  ⟨"Ix/Theory/Named/Verify/QSort.lean", "79cbf8f96fb223526690c12333a095aa87ecf7d889b4ba2abacd328609550b9a"⟩,
+  ⟨"Ix/Theory/Named/Verify/TypeChecker.lean", "0a8441fa3354c7002b2b4b7491f04eaac94bd137d7eaaf8a1859bae0af6f58be"⟩,
+  ⟨"Ix/Theory/Named/Verify/TypeChecker/Basic.lean", "a9cc58cb6b86a6f84b30f41f520f3b9f26a30bdd56885107efc6f3e03b3df8dc"⟩,
+  ⟨"Ix/Theory/Named/Verify/TypeChecker/InferType.lean", "ddc9fa7ec80b958169d6515a92a723dbe6042ca4b3cdd7d6cfcc6fb859b1f90f"⟩,
+  ⟨"Ix/Theory/Named/Verify/TypeChecker/IsDefEq.lean", "3b9d09d09029eec24514e9905dd00c7435ba103717e506a46939818a80a39c9b"⟩,
+  ⟨"Ix/Theory/Named/Verify/TypeChecker/Reduce.lean", "ddc6abecc09ad21769b83b857d11bbecd3859be58debab62360fa9d9a5ec31cf"⟩,
+  ⟨"Ix/Theory/Named/Verify/TypeChecker/WHNF.lean", "745637e76413130151c0fb21401a3ee10cbb420aa8c9de4203afff147c2bd9cd"⟩,
+  ⟨"Ix/Theory/Named/Verify/Typing/ConditionallyTyped.lean", "2df5d00a10e4497b631a4d2a90b93cf811ab13cbfb735234a5815963928c3255"⟩,
+  ⟨"Ix/Theory/Named/Verify/Typing/Expr.lean", "2f9cb98009b6dcd0d45ec4b967e22756f4af1a32a4d45949ad5b4152b8e416c5"⟩,
+  ⟨"Ix/Theory/Named/Verify/Typing/Lemmas.lean", "ac1a2960dc945d5d9b5b998b438da6dd7ad6160b08a646f3e2c0b56cede54669"⟩,
+  ⟨"Ix/Theory/Named/Verify/VLCtx.lean", "f99f9fb85d79b2f9acd201323cc493f737285c34c064fc2bc68680c595878aa3"⟩
+]
+
+end Tests.Theory.NamedManifest
diff --git a/Tests/Theory/Natural.lean b/Tests/Theory/Natural.lean
new file mode 100644
index 000000000..a0bfa450a
--- /dev/null
+++ b/Tests/Theory/Natural.lean
@@ -0,0 +1,108 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Standard
+
+open Ix.Theory
+
+namespace Tests.Theory.Natural
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certified.Basis Ix.Theory.Certificate
+open Tests.Theory.Certified (primitives)
+
+set_option maxRecDepth 16384
+set_option maxHeartbeats 16000000
+
+def nat : AExpr Nat := .const (.member 200 0) []
+def zero : AExpr Nat := .const (.ctor 200 0 0) []
+def succ (n : AExpr Nat) : AExpr Nat := .app (.const (.ctor 200 0 1) []) n
+def numeral : Nat → AExpr Nat
+  | 0 => zero
+  | n + 1 => succ (numeral n)
+
+def profile : PrimitiveSignature Nat := { primitives with natType := some (.member 200 0) }
+def binaryType : AExpr Nat := .forallE .never nat (.forallE .never nat nat)
+def motive : AExpr Nat := .lam .never nat nat
+def addBody : AExpr Nat :=
+  .lam .never nat (.lam .never nat
+    (.appN (.const (.member 201 0) [.succ .zero])
+      [motive, .bvar 1, .lam .never nat (.lam .never nat (succ (.bvar 0))), .bvar 0]))
+def add (n m : AExpr Nat) : AExpr Nat := .appN (.const (.member 300 0) []) [n, m]
+def mulBody : AExpr Nat :=
+  .lam .never nat (.lam .never nat
+    (.appN (.const (.member 201 0) [.succ .zero])
+      [motive, .natLit 0, .lam .never nat (.lam .never nat (add (.bvar 3) (.bvar 0))), .bvar 0]))
+def mul (n m : AExpr Nat) : AExpr Nat := .appN (.const (.member 301 0) []) [n, m]
+
+def declaration : Nat → Const Nat
+  | 200 => Certified.Natural.shape.source 200
+  | 201 => Certified.Natural.shape.recursorSource 200 201 .large
+  | 300 => .defn 0 .definition binaryType.erase addBody.erase .safe
+  | 301 => .defn 0 .definition binaryType.erase mulBody.erase .safe
+  | 302 => .defn 0 .definition nat.erase (.natLit 3) .safe
+  | b => Standard.declaration b
+
+def store (alter : Nat → Const Nat → Const Nat := fun _ c => c) : Store Nat where
+  dom := [10, 11, 100, 101, 200, 201, 300, 301, 302]
+  nodup := by decide
+  blocks b := if b ∈ [10, 11, 100, 101, 200, 201, 300, 301, 302] then some ⟨[alter b (declaration b)]⟩ else none
+  mem_dom b := by split <;> simp_all
+
+def proposition (lhs rhs : AExpr Nat) : AExpr Nat := Equality.applied Standard.eq (.succ .zero) nat lhs rhs
+def proof (n : Nat) : AExpr Nat := Equality.reflexivity Standard.refl (.succ .zero) nat (.natLit n)
+def input (lhs : AExpr Nat) (value : Nat) : ProofInput Nat :=
+  ⟨store, 0, (proof value).erase, (proposition lhs (.natLit value)).erase⟩
+def accepted (lhs : AExpr Nat) (value : Nat) : Bool :=
+  let input := input lhs value
+  (Certificate.proofWitness? 3200 profile input).any (acceptsCertified.{0,0} 6400 profile input)
+
+#guard accepted zero 0
+#guard accepted (numeral 4) 4
+#guard accepted (succ (.natLit 8)) 9
+#guard accepted (.const (.member 302 0) []) 3
+#guard accepted (add (.natLit 0) (.natLit 0)) 0
+#guard accepted (add (.natLit 2) (.natLit 3)) 5
+#guard accepted (mul (.natLit 2) (.natLit 3)) 6
+#guard accepted (mul (.natLit 5) (.natLit 0)) 0
+
+def sampleInput := input (add (.natLit 2) (.natLit 3)) 5
+def sampleWitness := Certificate.proofWitness? 3200 profile sampleInput
+
+#guard sampleWitness.isSome
+#guard sampleWitness.any fun witness => witness.declarations.any fun declaration => match declaration with
+  | .natural _ => true
+  | _ => false
+
+-- The original successful witness must fail when the primitive selection,
+-- authenticated source, claimed answer or admitted literal fact is changed.
+#guard sampleWitness.any fun witness => !acceptsCertified.{0,0} 6400 primitives sampleInput witness
+#guard sampleWitness.any fun witness =>
+  !acceptsCertified.{0,0} 6400 { profile with natType := some (.member 100 0) } sampleInput witness
+#guard sampleWitness.any fun witness => !acceptsCertified.{0,0} 6400 profile
+  { sampleInput with proposition := (proposition (add (.natLit 2) (.natLit 3)) (.natLit 6)).erase } witness
+#guard sampleWitness.any fun witness =>
+  let declarations := witness.declarations.map fun declaration => match declaration with
+    | .natural block => .ordinary block
+    | _ => declaration
+  !acceptsCertified.{0,0} 6400 profile sampleInput { witness with declarations }
+
+def unsafeNat (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 200 then match c with
+    | .induct n p i type ctors _ => .induct n p i type ctors .unsafe
+    | _ => c
+  else c
+def forgedRule (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 201 then match c with
+    | .recursor n p i m r type rules k safety =>
+      .recursor n p i m r type (rules.map fun rule => { rule with rhs := zero.erase }) k safety
+    | _ => c
+  else c
+def changedAdd (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 300 then .defn 0 .definition binaryType.erase (.lam nat.erase (.lam nat.erase (.natLit 0))) .safe else c
+
+#guard [unsafeNat, forgedRule, changedAdd].all fun alter => sampleWitness.any fun witness =>
+  !acceptsCertified.{0,0} 6400 profile { sampleInput with store := store alter } witness
+
+end Tests.Theory.Natural
diff --git a/Tests/Theory/Operations.lean b/Tests/Theory/Operations.lean
new file mode 100644
index 000000000..b281555e1
--- /dev/null
+++ b/Tests/Theory/Operations.lean
@@ -0,0 +1,49 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certified.Operations
+import Tests.Theory.Acceptance
+
+open Ix.Theory
+
+namespace Tests.Theory.Operations
+
+open Ix.Theory.Certified Ix.Theory.Model
+open Tests.Theory.Checker
+open Tests.Theory.Acceptance (identityAnnotations)
+
+def betaType : AExpr Nat := .forallE .never (.sort .zero) (.sort .zero)
+
+def betaInference : InferenceWitness Nat := {
+  annotations := .app (identityAnnotations (.succ .zero)) .leaf
+  type := betaType
+  typing := .app .never (.sort (.succ .zero)) (.forallE .never (.bvar 0) (.bvar 1))
+    (identityWitness (.succ .zero)) .sort
+}
+
+def betaWhnf : WhnfWitness Nat := {
+  source := betaInference
+  result := betaResult
+  resultTyping := .lam (.succ .zero) (.succ .zero) (.sort .zero) .sort .sort .bvar
+  conversion := betaWitness
+}
+
+#guard inferCertified.{0,0} 50 0 emptyEnvironment [] betaSource.erase betaInference |>.isSome
+#guard whnfCertified.{0,0} 50 0 emptyEnvironment [] betaSource.erase betaWhnf |>.isSome
+
+-- Valid typing plus reflexive conversion does not certify a remaining redex.
+#guard whnfCertified.{0,0} 50 0 emptyEnvironment [] betaSource.erase
+  { betaWhnf with
+    result := betaSource
+    resultTyping := betaInference.typing
+    conversion := .refl } |>.isNone
+
+-- Neither the input reading nor the proposed normal form can change unchecked.
+#guard whnfCertified.{0,0} 50 0 emptyEnvironment []
+  (.app (identity .zero).erase (.sort .zero)) betaWhnf |>.isNone
+#guard whnfCertified.{0,0} 50 0 emptyEnvironment [] betaSource.erase
+  { betaWhnf with result := .sort .zero, resultTyping := .sort } |>.isNone
+
+end Tests.Theory.Operations
diff --git a/Tests/Theory/Ordinary.lean b/Tests/Theory/Ordinary.lean
new file mode 100644
index 000000000..0ba2acd5d
--- /dev/null
+++ b/Tests/Theory/Ordinary.lean
@@ -0,0 +1,203 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Ordinary
+import Ix.Theory.Certified.Ordinary.LargeElim
+import Ix.Theory.Certified.Ordinary.RecursorSyntax
+import Tests.Theory.RecursorGoldens
+
+open Ix.Theory
+
+/-! These exercise shape and evidence production. They do not claim closed
+proof acceptance or VM coverage of inductives. -/
+
+namespace Tests.Theory.Ordinary
+
+open Model Certified Certified.Ordinary
+
+private structure SourceFamily where
+  type : VExpr Nat
+  ctors : List (Ctor Nat)
+
+def natSourceBlock : Nat := 10
+def functionalSourceBlock : Nat := 50
+def indexedSourceBlock : Nat := 60
+
+private def natType : VExpr Nat := .const (.member natSourceBlock 0) []
+private def natFamily : SourceFamily := ⟨.sort (.succ .zero), [
+  ⟨0, 0, 0, natType, .safe⟩,
+  ⟨0, 0, 1, .forallE natType natType, .safe⟩]⟩
+
+private def functionalType : VExpr Nat := .const (.member functionalSourceBlock 0) []
+private def functionalFamily : SourceFamily := ⟨.sort (.succ .zero), [
+  ⟨0, 0, 1, .forallE (.forallE (.sort .zero) functionalType) functionalType, .safe⟩]⟩
+
+private def indexedFamily : SourceFamily :=
+  ⟨.forallE (.sort (.succ .zero)) (.sort (.succ .zero)), [
+    ⟨0, 0, 0, .app (.const (.member indexedSourceBlock 0) []) (.sort .zero), .safe⟩]⟩
+
+def noEntries : Environment Nat := fun _ => none
+
+def singletonStore (source : Nat) (decl : Const Nat) : Store Nat where
+  dom := [source]
+  nodup := by simp
+  blocks b := if b = source then some ⟨[decl]⟩ else none
+  mem_dom b := by by_cases h : b = source <;> simp [h]
+
+def checked (source : Nat) (decl : Const Nat) (shape : Shape Nat) : Bool :=
+  match Certificate.Ordinary.shape? 100 noEntries shape with
+  | none => false
+  | some witness => (checkShape.{0,0} 100 noEntries (singletonStore source decl) source witness).isSome
+
+def largeChecked (shape : Shape Nat) : Bool :=
+  match Certificate.Ordinary.shape? 100 noEntries shape with
+  | none => false
+  | some witness => (checkLarge.{0,0} 100 noEntries witness).isSome
+
+def natShape : Shape Nat :=
+  ⟨0, [], [], .succ .zero, [⟨[], [], []⟩, ⟨[], [⟨[], []⟩], []⟩]⟩
+
+#guard natShape.source natSourceBlock =
+  .induct 0 0 0 natFamily.type natFamily.ctors .safe
+#guard checked natSourceBlock (.induct 0 0 0 natFamily.type natFamily.ctors .safe) natShape
+#guard largeChecked natShape
+
+def functionalShape : Shape Nat :=
+  ⟨0, [], [], .succ .zero, [⟨[], [⟨[.sort .zero], []⟩], []⟩]⟩
+
+#guard functionalShape.source functionalSourceBlock =
+  .induct 0 0 0 functionalFamily.type functionalFamily.ctors .safe
+#guard checked functionalSourceBlock
+  (.induct 0 0 0 functionalFamily.type functionalFamily.ctors .safe) functionalShape
+
+def indexedShape : Shape Nat :=
+  ⟨0, [], [.sort (.succ .zero)], .succ .zero, [⟨[], [], [.sort .zero]⟩]⟩
+
+#guard indexedShape.source indexedSourceBlock =
+  .induct 0 0 1 indexedFamily.type indexedFamily.ctors .safe
+#guard checked indexedSourceBlock
+  (.induct 0 0 1 indexedFamily.type indexedFamily.ctors .safe) indexedShape
+
+def listShape : Shape Nat :=
+  ⟨1, [.sort (.succ (.param 0))], [], .succ (.param 0),
+    [⟨[], [], []⟩, ⟨[.bvar 0], [⟨[], []⟩], []⟩]⟩
+
+def listType : VExpr Nat := .forallE (.sort (.succ (.param 0))) (.sort (.succ (.param 0)))
+def listDecl : Const Nat := .induct 1 1 0 listType [
+  ⟨1, 1, 0, .forallE (.sort (.succ (.param 0))) (.app (.const (.member 70 0) [.param 0]) (.bvar 0)), .safe⟩,
+  ⟨1, 1, 2, .forallE (.sort (.succ (.param 0))) <| .forallE (.bvar 0) <|
+    .forallE (.app (.const (.member 70 0) [.param 0]) (.bvar 1))
+      (.app (.const (.member 70 0) [.param 0]) (.bvar 2)), .safe⟩] .safe
+
+#guard listShape.source 70 = listDecl
+#guard checked 70 listDecl listShape
+#guard largeChecked listShape
+
+-- The branch domain depends on the constructor's ordinary field and a
+-- parameter function: W (A : Type) (B : A → Type), node a (B a → W A B).
+def wShape : Shape Nat :=
+  ⟨0, [.sort (.succ .zero), .forallE .never (.bvar 0) (.sort (.succ .zero))], [], .succ .zero,
+    [⟨[.bvar 1], [⟨[.app (.bvar 1) (.bvar 0)], []⟩], []⟩]⟩
+#guard checked 71 (wShape.source 71) wShape
+#guard largeChecked wShape
+
+-- The second index depends on the first. Checking only a list of arities
+-- would miss an ill-typed second argument.
+def dependentIndices : Shape Nat :=
+  ⟨0, [], [.sort .zero, .bvar 0], .succ .zero,
+    [⟨[.sort .zero, .bvar 0], [], [.bvar 1, .bvar 0]⟩]⟩
+#guard checked 72 (dependentIndices.source 72) dependentIndices
+
+def wrongIndices : Shape Nat :=
+  { dependentIndices with constructors := [⟨[.sort .zero, .bvar 0], [], [.bvar 1, .sort .zero]⟩] }
+#guard !checked 72 (wrongIndices.source 72) wrongIndices
+
+def tooLarge : Shape Nat := ⟨0, [], [], .succ .zero, [⟨[.sort (.succ .zero)], [], []⟩]⟩
+#guard !checked 73 (tooLarge.source 73) tooLarge
+
+-- A negative occurrence and a same-block recursive domain are rejected even
+-- when the proposed descriptor exactly reproduces the source declaration.
+def negative : Shape Nat :=
+  ⟨0, [], [], .succ .zero, [⟨[.forallE .never (.const (.member 74 0) []) (.sort .zero)], [], []⟩]⟩
+#guard !checked 74 (negative.source 74) negative
+def recursiveDomain : Shape Nat :=
+  ⟨0, [], [], .succ .zero, [⟨[], [⟨[.const (.member 75 0) []], []⟩], []⟩]⟩
+#guard !checked 75 (recursiveDomain.source 75) recursiveDomain
+
+def emptyProp : Shape Nat := ⟨0, [], [], .zero, []⟩
+def singletonProp : Shape Nat := ⟨0, [.sort .zero], [], .zero, [⟨[.bvar 0], [], []⟩]⟩
+def manyProp : Shape Nat := ⟨0, [], [], .zero, [⟨[], [], []⟩, ⟨[], [], []⟩]⟩
+def dataProp : Shape Nat := ⟨0, [], [], .zero, [⟨[.sort .zero], [], []⟩]⟩
+
+#guard checked 76 (emptyProp.source 76) emptyProp
+#guard checked 77 (singletonProp.source 77) singletonProp
+#guard checked 78 (manyProp.source 78) manyProp
+#guard checked 79 (dataProp.source 79) dataProp
+#guard largeChecked emptyProp
+#guard largeChecked singletonProp
+#guard !largeChecked manyProp
+#guard !largeChecked dataProp
+
+#guard !checked natSourceBlock (.induct 0 0 0 natFamily.type natFamily.ctors .unsafe) natShape
+#guard !checked (natSourceBlock + 1) (.induct 0 0 0 natFamily.type natFamily.ctors .safe) natShape
+#guard !checked natSourceBlock (.induct 1 0 0 natFamily.type natFamily.ctors .safe) natShape
+
+def recursorSyntaxMatches (name : String) (shape : Shape Nat) (source recursor : Nat)
+    (mode : Inductive.ElimMode) : Bool :=
+  match recursorGoldens.find? (·.1 == name) with
+  | none => false
+  | some (_, expectedType, expectedRules) =>
+    (shape.recursorType source mode).erase == expectedType &&
+      (shape.constructors.zipIdx.map fun (ctor, i) =>
+        ((shape.ruleRhs source recursor mode i ctor).erase,
+          (shape.ruleType source mode i ctor).erase)) == expectedRules
+
+#guard recursorSyntaxMatches "nat" natShape natSourceBlock 90 .large
+#guard recursorSyntaxMatches "list" listShape 70 91 .large
+#guard recursorSyntaxMatches "indexed" indexedShape indexedSourceBlock 92 .large
+#guard recursorSyntaxMatches "functional" functionalShape functionalSourceBlock 93 .large
+#guard recursorSyntaxMatches "w" wShape 71 94 .large
+#guard recursorSyntaxMatches "dependentIndices" dependentIndices 72 95 .large
+#guard recursorSyntaxMatches "manyProp" manyProp 78 96 .small
+#guard recursorSyntaxMatches "singletonProp" singletonProp 77 97 .large
+
+def pairedStore (source recursor : Nat) (h : source ≠ recursor) (decl rec : Const Nat) : Store Nat where
+  dom := [source, recursor]
+  nodup := by simp [h]
+  blocks b := if b = source then some ⟨[decl]⟩ else if b = recursor then some ⟨[rec]⟩ else none
+  mem_dom b := by by_cases hs : b = source <;> by_cases hr : b = recursor <;> simp [hs, hr, Ne.symm h]
+
+def signaturesChecked (shape : Shape Nat) (source recursor : Nat) (mode : Inductive.ElimMode) : Bool := Id.run do
+  if hne : source ≠ recursor then
+    let store := pairedStore source recursor hne (shape.source source) (shape.recursorSource source recursor mode)
+    let some sw := Certificate.Ordinary.shape? 500 noEntries shape | return false
+    let some _ := checkShape.{0,0} 500 noEntries store source sw | return false
+    let some _ := checkMode.{0,0} 500 noEntries sw mode | return false
+    let some cws := Certificate.Ordinary.constructorTypes? 500 noEntries shape source | return false
+    let some _ := shape.checkConstructorTypes.{0,0} 500 noEntries source shape.constructors cws | return false
+    let some rw := Certificate.Ordinary.recursorType? 500 noEntries shape source mode | return false
+    let some _ := shape.checkRecursorType.{0,0} 500 noEntries store source recursor mode rw | return false
+    let some rules := Certificate.Ordinary.rules? 500 noEntries shape source recursor mode | return false
+    return (shape.checkRules.{0,0} 500 (shape.recursorEnvironment noEntries source recursor mode)
+      source recursor mode shape.constructors.zipIdx rules).isSome
+  else return false
+
+#guard signaturesChecked natShape natSourceBlock 90 .large
+#guard signaturesChecked listShape 70 91 .large
+#guard signaturesChecked indexedShape indexedSourceBlock 92 .large
+#guard signaturesChecked functionalShape functionalSourceBlock 93 .large
+#guard signaturesChecked wShape 71 94 .large
+#guard signaturesChecked dependentIndices 72 95 .large
+#guard signaturesChecked manyProp 78 96 .small
+#guard signaturesChecked singletonProp 77 97 .large
+#guard !signaturesChecked manyProp 78 96 .large
+
+-- Formation of a signature alone publishes no equation.
+def formedSignature : Environment Nat := fun r =>
+  if r = .member 80 0 then some ⟨0, .sort (.succ .zero), none, [], []⟩ else none
+#guard !(verifyConversion.{0,0} 10 0 formedSignature [] (.sort .zero) (.sort (.succ .zero))
+  (.equation (.member 80 0) 0 [])).isSome
+
+end Tests.Theory.Ordinary
diff --git a/Tests/Theory/OrdinaryAcceptance.lean b/Tests/Theory/OrdinaryAcceptance.lean
new file mode 100644
index 000000000..3d98da6eb
--- /dev/null
+++ b/Tests/Theory/OrdinaryAcceptance.lean
@@ -0,0 +1,162 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Ordinary
+import Tests.Theory.Acceptance
+import Ix.Theory.Certificate.Build
+
+open Ix.Theory
+
+/-! Closed acceptance through atomic ordinary admission and generated equation
+certificates. These are abstract-source tests; serialized VM coverage has its
+own adapter and corpus. -/
+
+namespace Tests.Theory.OrdinaryAcceptance
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certified.Ordinary Ix.Theory.Certificate
+open Tests.Theory.Certified (primitives)
+open Tests.Theory.Ordinary (natShape listShape indexedShape emptyProp singletonProp manyProp dataProp)
+
+set_option maxRecDepth 4096
+set_option maxHeartbeats 8000000
+
+def storeFor (shape : Shape Nat) (mode : Inductive.ElimMode)
+    (recursorOverride : Option (Const Nat) := none) : Store Nat where
+  dom := [10, 11, 100, 101]
+  nodup := by decide
+  blocks b :=
+    if b = 10 then some ⟨[PrimitiveSignature.falseDeclaration]⟩
+    else if b = 11 then some ⟨[primitives.falseElimDeclaration]⟩
+    else if b = 100 then some ⟨[shape.source 100]⟩
+    else if b = 101 then some ⟨[recursorOverride.getD (shape.recursorSource 100 101 mode)]⟩ else none
+  mem_dom b := by
+    by_cases h0 : b = 10 <;> by_cases h1 : b = 11 <;>
+      by_cases hs : b = 100 <;> by_cases hr : b = 101 <;> simp_all
+
+def admitted (shape : Shape Nat) (mode : Inductive.ElimMode) : Bool :=
+  match initialize?.{0,0} primitives (storeFor shape mode),
+      Certificate.Ordinary.block? 1000 primitives.environment shape 100 101 mode with
+  | some state, some witness => (admitOrdinary?.{0,0} 1000 state witness).isSome
+  | _, _ => false
+
+#guard admitted natShape .large
+#guard admitted listShape .large
+#guard admitted indexedShape .large
+#guard admitted emptyProp .large
+#guard admitted singletonProp .large
+#guard admitted manyProp .small
+#guard !admitted manyProp .large
+#guard !admitted dataProp .large
+
+def identity : AExpr Nat := .lam .always (.sort .zero) (.lam .always (.bvar 0) (.bvar 0))
+def identityType : AExpr Nat := .forallE .always (.sort .zero) (.forallE .always (.bvar 0) (.bvar 1))
+def proposition (computed : AExpr Nat) : AExpr Nat :=
+  .forallE .always (.sort .zero) (.forallE .always (.bvar 0) computed)
+
+def proofWitness? (shape : Shape Nat) (mode : Inductive.ElimMode) (proof proposition : AExpr Nat) :
+    Option (ProofWitness Nat) := do
+  let block ← Certificate.Ordinary.block? 1000 primitives.environment shape 100 101 mode
+  let entries := shape.publishedEnvironment primitives.environment 100 101 mode
+  let P ← inferAnnotated? 1000 0 entries [] proposition
+  let Pw ← castWith? 1000 0 entries [] P (.sort .zero)
+  let e ← inferAnnotated? 1000 0 entries [] proof
+  let ew ← castWith? 1000 0 entries [] e proposition
+  return ⟨[.ordinary block], annotations proof, annotations proposition, ew, Pw⟩
+
+def accepted (shape : Shape Nat) (mode : Inductive.ElimMode) (proof proposition : AExpr Nat)
+    (recursorOverride : Option (Const Nat) := none) : Bool :=
+  match proofWitness? shape mode proof proposition with
+  | none => false
+  | some witness => acceptsCertified.{0,0} 2000 primitives
+      ⟨storeFor shape mode recursorOverride, 0, proof.erase, proposition.erase⟩ witness
+
+def family : AExpr Nat := .const (.member 100 0) []
+def zero : AExpr Nat := .const (.ctor 100 0 0) []
+def succ (n : AExpr Nat) : AExpr Nat := .app (.const (.ctor 100 0 1) []) n
+
+def natComputed : AExpr Nat := .appN (.const (.member 101 0) [.succ .zero])
+  [.lam .never family (.sort .zero), .bvar 1,
+    .lam .never family (.lam .never (.sort .zero) (.bvar 0)), succ zero]
+
+#guard (proofWitness? natShape .large identity (proposition natComputed)).isSome
+#guard accepted natShape .large identity (proposition natComputed)
+
+def listType : AExpr Nat := .app (.const (.member 100 0) [.zero]) (.sort .zero)
+def nil : AExpr Nat := .app (.const (.ctor 100 0 0) [.zero]) (.sort .zero)
+def cons : AExpr Nat := .appN (.const (.ctor 100 0 1) [.zero]) [.sort .zero, .bvar 1, nil]
+def listComputed : AExpr Nat := .appN (.const (.member 101 0) [.succ .zero, .zero])
+  [.sort .zero, .lam .never listType (.sort .zero), .bvar 1,
+    .lam .never (.sort .zero) (.lam .never listType (.lam .never (.sort .zero) (.bvar 0))), cons]
+
+#guard (proofWitness? listShape .large identity (proposition listComputed)).isSome
+#guard accepted listShape .large identity (proposition listComputed)
+
+def indexedComputed : AExpr Nat := .appN (.const (.member 101 0) [.succ .zero])
+  [.lam .never (.sort (.succ .zero)) (.lam .never (.app family (.bvar 0)) (.sort .zero)),
+    .bvar 1, .sort .zero, zero]
+
+#guard accepted indexedShape .large identity (proposition indexedComputed)
+
+def functionalShape : Shape Nat :=
+  ⟨0, [], [], .succ .zero, [⟨[], [], []⟩, ⟨[], [⟨[.sort .zero], []⟩], []⟩]⟩
+def functionalComputed : AExpr Nat := .appN (.const (.member 101 0) [.succ .zero])
+  [.lam .never family (.sort .zero), .bvar 1,
+    .lam .never (.forallE .never (.sort .zero) family)
+      (.lam .never (.forallE .never (.sort .zero) (.sort .zero)) (.app (.bvar 0) (.bvar 3))),
+    succ (.lam .never (.sort .zero) zero)]
+
+#guard admitted functionalShape .large
+#guard (proofWitness? functionalShape .large identity (proposition functionalComputed)).isSome
+#guard accepted functionalShape .large identity (proposition functionalComputed)
+
+def smallProof : AExpr Nat := .lam .always (.sort .zero) (.lam .always (.bvar 0)
+  (.appN (.const (.member 101 0) []) [.lam .never family (.bvar 2), .bvar 0, .bvar 0, zero]))
+#guard accepted manyProp .small smallProof identityType
+
+-- Source rule tampering cannot be repaired by a valid shape/type certificate.
+def forgedNatRecursor : Const Nat :=
+  match natShape.recursorSource 100 101 .large with
+  | .recursor u p i m n type (_ :: rules) k safety =>
+    .recursor u p i m n type (⟨0, .sort .zero⟩ :: rules) k safety
+  | other => other
+#guard !accepted natShape .large identity (proposition natComputed) (some forgedNatRecursor)
+
+-- A staged signature has no equation; the public environment gets the law
+-- only after the entire block checker succeeds.
+def natEquationLicensed (entries : Environment Nat) : Bool := Id.run do
+  let some law := (natShape.recursorLaws 100 101 .large)[0]? | return false
+  return (verifyConversion.{0,0} 1000 0 entries []
+    (law.lhs.instL [.succ .zero]) (law.rhs.instL [.succ .zero])
+    (.equation (.member 101 0) 0 [.succ .zero])).isSome
+
+#guard natEquationLicensed (natShape.publishedEnvironment primitives.environment 100 101 .large)
+#guard !natEquationLicensed (natShape.recursorEnvironment primitives.environment 100 101 .large)
+
+/-- The generic driver recovers its shape and declaration order from the raw
+store. No description is provided to witness construction. -/
+def sourceAccepted (shape : Shape Nat) (mode : Inductive.ElimMode)
+    (proof proposition : AExpr Nat) : Bool :=
+  let input : ProofInput Nat := ⟨storeFor shape mode, 0, proof.erase, proposition.erase⟩
+  (Certificate.proofWitness? 2000 primitives input).any
+    (acceptsCertified.{0,0} 2000 primitives input)
+
+#guard sourceAccepted natShape .large identity (proposition natComputed)
+#guard sourceAccepted listShape .large identity (proposition listComputed)
+#guard sourceAccepted indexedShape .large identity (proposition indexedComputed)
+#guard sourceAccepted functionalShape .large identity (proposition functionalComputed)
+#guard sourceAccepted manyProp .small smallProof identityType
+
+-- The source parser also reconstructs dependent telescopes and more than one
+-- recursive field. It never silently removes a recursive dependency.
+#guard [Tests.Theory.Ordinary.wShape, Tests.Theory.Ordinary.dependentIndices].all fun shape =>
+  (Certificate.Ordinary.description? 1000 primitives.environment 100 (shape.source 100)).isSome
+
+def multipleFields : Shape Nat :=
+  ⟨0, [], [], .succ .zero, [⟨[], [], []⟩, ⟨[], [⟨[], []⟩, ⟨[], []⟩], []⟩]⟩
+#guard (Certificate.Ordinary.description? 1000 primitives.environment 100
+  (multipleFields.source 100)).isSome
+#guard (Certificate.Ordinary.removeVariables? 1 (.bvar 0 : VExpr Nat)).isNone
+
+end Tests.Theory.OrdinaryAcceptance
diff --git a/Tests/Theory/Provenance.lean b/Tests/Theory/Provenance.lean
new file mode 100644
index 000000000..b430036a3
--- /dev/null
+++ b/Tests/Theory/Provenance.lean
@@ -0,0 +1,57 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Lean
+import Tests.Theory.ImportManifest
+import Tests.Theory.NamedManifest
+
+open System Tests.Theory.ImportManifest
+
+private def need (ok : Bool) (message : String) : IO Unit :=
+  unless ok do throw (IO.userError message)
+
+private def sha256 (path : FilePath) : IO String := do
+  let result ← IO.Process.output { cmd := "sha256sum", args := #["--", path.toString] }
+  need (result.exitCode == 0) result.stderr
+  return (result.stdout.splitOn " ").headD ""
+
+private def sameFiles (actual expected : Array String) : IO Unit :=
+  need (actual.qsort (· < ·) == expected.qsort (· < ·)) "theory source inventory changed; review import provenance"
+
+def main (args : List String) : IO Unit := do
+  need (args.length ≤ 1) "usage: lake env lean --run Tests/Theory/Provenance.lean [CON_LECHE_REPOSITORY]"
+  let actual := ((← (FilePath.mk "Ix/Theory").walkDir).filter (·.extension == some "lean")).map (·.toString)
+  let named := actual.filter (·.startsWith "Ix/Theory/Named/")
+  sameFiles ((actual.filter (!·.startsWith "Ix/Theory/Named/")).push "Ix/Theory.lean")
+    (selected.map (·.target))
+  sameFiles named ((Tests.Theory.NamedManifest.selected.map (·.target)).push
+    "Ix/Theory/Named/Std/AxiomAudit.lean")
+  need (← (FilePath.mk "Ix/Theory/Named/LICENSE").pathExists) "missing named-specification Apache license"
+  need (← (FilePath.mk "Ix/Theory/Named/NOTICE").pathExists) "missing named-specification attribution"
+  for row in selected do
+    let contents ← IO.FS.readFile row.target
+    need (!(contents.contains "import Ix.Theory.Named"))
+      s!"set-model foundation depends on named checker proof support: {row.target}"
+  let mut ports := #[]
+  for directory in ["Ix/Theory/Model/SetTheory", "Ix/Theory/Model/SetModel"] do
+    ports := ports ++ ((← (FilePath.mk directory).walkDir).filter (·.extension == some "lean")).map (·.toString)
+  sameFiles ports (conLeche.map (·.target))
+  need (← (FilePath.mk "Ix/Theory/LICENSE-APACHE").pathExists) "missing con-leche Apache license"
+  for row in conLeche do
+    need ((← sha256 row.target) == row.targetSha256) s!"con-leche port changed: {row.target}"
+    let contents ← IO.FS.readFile row.target
+    need (contents.startsWith s!"/-\nPorted from con-leche ({conLecheRevision}).\nSource: {row.source}\n" &&
+      contents.contains "SPDX-License-Identifier: Apache-2.0 AND (MIT OR Apache-2.0)")
+      s!"con-leche notice changed: {row.target}"
+    if let some repository := args.head? then
+      let blob ← IO.Process.output {
+        cmd := "git", args := #["-C", repository, "show", s!"{conLecheRevision}:{row.source}"] }
+      need (blob.exitCode == 0) blob.stderr
+      IO.FS.withTempFile fun handle path => do
+        handle.putStr blob.stdout
+        handle.flush
+        need ((← sha256 path) == row.sourceSha256) s!"con-leche upstream hash mismatch: {row.source}"
+  IO.println s!"Theory provenance OK: {selected.size} selected source files; {conLeche.size} con-leche ports, exact content and notices."
+  IO.println s!"Named proof support: {named.size} local source files; separate from the set-model foundation."
diff --git a/Tests/Theory/Quotient.lean b/Tests/Theory/Quotient.lean
new file mode 100644
index 000000000..792d56c09
--- /dev/null
+++ b/Tests/Theory/Quotient.lean
@@ -0,0 +1,144 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Build
+import Tests.Theory.Certified
+
+open Ix.Theory
+
+namespace Tests.Theory.Quotient
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certified.Basis
+open Tests.Theory.Certified (primitives)
+
+set_option maxRecDepth 8192
+set_option maxHeartbeats 12000000
+
+def refs : Certified.Quotient.Refs Nat where
+  eq := .member 100 0
+  eqRefl := .ctor 100 0 0
+  eqRec := .member 101 0
+  type := .member 200 0
+  ctor := .member 201 0
+  lift := .member 202 0
+  ind := .member 203 0
+  sound := .member 204 0
+
+def declaration : Nat → Const Nat
+  | 10 => PrimitiveSignature.falseDeclaration
+  | 11 => primitives.falseElimDeclaration
+  | 100 => Equality.shape.source 100
+  | 101 => Equality.shape.recursorSource 100 101 .large true
+  | 200 => refs.source .type
+  | 201 => refs.source .ctor
+  | 202 => refs.source .lift
+  | 203 => refs.source .ind
+  | 204 => refs.source .sound
+  | _ => .axiom 0 (.sort .zero) .safe
+
+def addresses : List Nat := [10, 11, 100, 101, 200, 201, 202, 203, 204]
+
+def store (alter : Nat → Const Nat → Const Nat := fun _ c => c) : Store Nat where
+  dom := addresses
+  nodup := by decide
+  blocks b := if b ∈ addresses then some ⟨[alter b (declaration b)]⟩ else none
+  mem_dom b := by split <;> simp_all
+
+def input (n : Nat) (proof proposition : AExpr Nat) : ProofInput Nat :=
+  ⟨store, n, proof.erase, proposition.erase⟩
+
+def accepted (n : Nat) (proof proposition : AExpr Nat) : Bool :=
+  let input := input n proof proposition
+  (Certificate.proofWitness? 3000 primitives input).any (acceptsCertified.{0,0} 3000 primitives input)
+
+#guard (Certificate.Quotient.refs? store refs.type).isSome
+#guard (Certificate.Quotient.refs? store refs.sound).isSome
+
+-- Exact soundness and dependent Prop induction are themselves closed logical
+-- propositions, admitted through source discovery and executable validation.
+#guard accepted 1 (.const refs.sound [.param 0]) (Certified.Quotient.soundType refs)
+#guard accepted 1 (.const refs.ind [.param 0]) (Certified.Quotient.indType refs)
+
+def relation (u : VLevel) (A : AExpr Nat) : AExpr Nat :=
+  .lam .never A (.lam .never (A.liftN 1)
+    (Equality.applied refs.eq u (A.liftN 2) (.bvar 1) (.bvar 0)))
+
+def constantInvariant (u v : VLevel) (A B b : AExpr Nat) : AExpr Nat :=
+  .lamN .always [A, A.liftN 1, .appN ((relation u A).liftN 2) [.bvar 1, .bvar 0]]
+    (Equality.reflexivity refs.eqRefl v (B.liftN 3) (b.liftN 3))
+
+def computed (u v : VLevel) (A B b a : AExpr Nat) : AExpr Nat :=
+  .appN (.const refs.lift [u, v]) [A, relation u A, B,
+    .lam (zeroCondition v) A (b.liftN 1), constantInvariant u v A B b,
+    Certified.Quotient.constructed refs u A (relation u A) a]
+
+def binders (u : VLevel) : List (AExpr Nat) := [.sort u, .bvar 0, .sort .zero, .bvar 0]
+def betaProof (u : VLevel) : AExpr Nat := .lamN .always (binders u) (.bvar 0)
+def betaProposition (u : VLevel) : AExpr Nat :=
+  .forallN .always (binders u) (computed u (.succ .zero) (.bvar 3) (.sort .zero) (.bvar 1) (.bvar 2))
+
+-- The original statement contains a quotient lift returning a proposition.
+-- Conversion to that statement requires the newly admitted computation law.
+#guard accepted 1 (betaProof (.param 0)) (betaProposition (.param 0))
+#guard accepted 0 (betaProof .zero) (betaProposition .zero)
+#guard accepted 0 (betaProof (.succ .zero)) (betaProposition (.succ .zero))
+
+def propLiftProof (u : VLevel) : AExpr Nat :=
+  .lamN .always (binders u) (computed u .zero (.bvar 3) (.bvar 1) (.bvar 0) (.bvar 2))
+def propLiftProposition (u : VLevel) : AExpr Nat := .forallN .always (binders u) (.bvar 1)
+
+#guard accepted 1 (propLiftProof (.param 0)) (propLiftProposition (.param 0))
+#guard accepted 0 (propLiftProof .zero) (propLiftProposition .zero)
+
+def betaInput := input 1 (betaProof (.param 0)) (betaProposition (.param 0))
+def betaWitness := Certificate.proofWitness? 3000 primitives betaInput
+
+#guard betaWitness.isSome
+
+def wrongKind (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 200 then .quot .ctor 1 Certified.Quotient.typeType.erase else c
+def wrongArity (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 201 then .quot .ctor 2 (Certified.Quotient.ctorType refs).erase else c
+def falseSound (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 204 then .axiom 1 primitives.falseExpr .safe else c
+def unsafeSound (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 204 then .axiom 1 (Certified.Quotient.soundType refs).erase .unsafe else c
+def wrongLift (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 202 then .quot .lift 2 (Certified.Quotient.indType refs).erase else c
+
+-- A valid certificate for the original declarations must fail against each
+-- altered source store; this tests the validator, not just producer decline.
+#guard [wrongKind, wrongArity, falseSound, unsafeSound, wrongLift].all fun alter =>
+  betaWitness.any fun witness =>
+    !acceptsCertified.{0,0} 3000 primitives { betaInput with store := store alter } witness
+
+#guard betaWitness.any fun witness =>
+  let declarations := witness.declarations.map fun declaration => match declaration with
+    | .quotient q => DeclarationWitness.quotient { q with types := q.types.drop 1 }
+    | other => other
+  !acceptsCertified.{0,0} 3000 primitives betaInput { witness with declarations }
+
+#guard betaWitness.any fun witness =>
+  let declarations := witness.declarations.map fun declaration => match declaration with
+    | .quotient q => DeclarationWitness.quotient { q with liftRule := q.indRule }
+    | other => other
+  !acceptsCertified.{0,0} 3000 primitives betaInput { witness with declarations }
+
+#guard betaWitness.any fun witness =>
+  let declarations := witness.declarations.map fun declaration => match declaration with
+    | .quotient q => DeclarationWitness.quotient { q with refs := { q.refs with ctor := q.refs.type } }
+    | other => other
+  !acceptsCertified.{0,0} 3000 primitives betaInput { witness with declarations }
+
+#guard betaWitness.any fun witness =>
+  let quotient := witness.declarations.filter fun declaration => match declaration with
+    | .quotient _ => true
+    | _ => false
+  let rest := witness.declarations.filter fun declaration => match declaration with
+    | .quotient _ => false
+    | _ => true
+  !acceptsCertified.{0,0} 3000 primitives betaInput { witness with declarations := quotient ++ rest }
+
+end Tests.Theory.Quotient
diff --git a/Tests/Theory/RecursorGoldens.lean b/Tests/Theory/RecursorGoldens.lean
new file mode 100644
index 000000000..c02b6b8f0
--- /dev/null
+++ b/Tests/Theory/RecursorGoldens.lean
@@ -0,0 +1,45 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Expr
+
+open Ix.Theory
+
+namespace Tests.Theory
+
+/-- Frozen outputs of the former inductive generator, captured during the
+model import. These retain the independent recursor comparisons without
+depending on the old typing/metatheory implementation. -/
+def recursorGoldens : List (String × VExpr Nat × List (VExpr Nat × VExpr Nat)) := [
+  ("nat", (.forallE (.forallE (.const (.member 10 0) []) (.sort (.param 0))) (.forallE (.app (.bvar 0) (.const (.ctor 10 0 0) [])) (.forallE (.forallE (.const (.member 10 0) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 10 0 1) []) (.bvar 1))))) (.forallE (.const (.member 10 0) []) (.app (.bvar 3) (.bvar 0)))))), [
+    ((.lam (.forallE (.const (.member 10 0) []) (.sort (.param 0))) (.lam (.app (.bvar 0) (.const (.ctor 10 0 0) [])) (.lam (.forallE (.const (.member 10 0) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 10 0 1) []) (.bvar 1))))) (.bvar 1)))), (.forallE (.forallE (.const (.member 10 0) []) (.sort (.param 0))) (.forallE (.app (.bvar 0) (.const (.ctor 10 0 0) [])) (.forallE (.forallE (.const (.member 10 0) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 10 0 1) []) (.bvar 1))))) (.app (.bvar 2) (.const (.ctor 10 0 0) [])))))),
+    ((.lam (.forallE (.const (.member 10 0) []) (.sort (.param 0))) (.lam (.app (.bvar 0) (.const (.ctor 10 0 0) [])) (.lam (.forallE (.const (.member 10 0) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 10 0 1) []) (.bvar 1))))) (.lam (.const (.member 10 0) []) (.app (.app (.bvar 1) (.bvar 0)) (.app (.app (.app (.app (.const (.member 90 0) [(.param 0)]) (.bvar 3)) (.bvar 2)) (.bvar 1)) (.bvar 0))))))), (.forallE (.forallE (.const (.member 10 0) []) (.sort (.param 0))) (.forallE (.app (.bvar 0) (.const (.ctor 10 0 0) [])) (.forallE (.forallE (.const (.member 10 0) []) (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.bvar 3) (.app (.const (.ctor 10 0 1) []) (.bvar 1))))) (.forallE (.const (.member 10 0) []) (.app (.bvar 3) (.app (.const (.ctor 10 0 1) []) (.bvar 0))))))))
+  ]),
+  ("list", (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.app (.bvar 0) (.app (.const (.ctor 70 0 0) [(.param 1)]) (.bvar 1))) (.forallE (.forallE (.bvar 2) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 3)) (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.bvar 4) (.app (.app (.app (.const (.ctor 70 0 1) [(.param 1)]) (.bvar 5)) (.bvar 2)) (.bvar 1)))))) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 3)) (.app (.bvar 3) (.bvar 0))))))), [
+    ((.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.app (.bvar 0) (.app (.const (.ctor 70 0 0) [(.param 1)]) (.bvar 1))) (.lam (.forallE (.bvar 2) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 3)) (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.bvar 4) (.app (.app (.app (.const (.ctor 70 0 1) [(.param 1)]) (.bvar 5)) (.bvar 2)) (.bvar 1)))))) (.bvar 1))))), (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.app (.bvar 0) (.app (.const (.ctor 70 0 0) [(.param 1)]) (.bvar 1))) (.forallE (.forallE (.bvar 2) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 3)) (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.bvar 4) (.app (.app (.app (.const (.ctor 70 0 1) [(.param 1)]) (.bvar 5)) (.bvar 2)) (.bvar 1)))))) (.app (.bvar 2) (.app (.const (.ctor 70 0 0) [(.param 1)]) (.bvar 3)))))))),
+    ((.lam (.sort (.succ (.param 1))) (.lam (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.lam (.app (.bvar 0) (.app (.const (.ctor 70 0 0) [(.param 1)]) (.bvar 1))) (.lam (.forallE (.bvar 2) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 3)) (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.bvar 4) (.app (.app (.app (.const (.ctor 70 0 1) [(.param 1)]) (.bvar 5)) (.bvar 2)) (.bvar 1)))))) (.lam (.bvar 3) (.lam (.app (.const (.member 70 0) [(.param 1)]) (.bvar 4)) (.app (.app (.app (.bvar 2) (.bvar 1)) (.bvar 0)) (.app (.app (.app (.app (.app (.const (.member 91 0) [(.param 0), (.param 1)]) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.bvar 2)) (.bvar 0))))))))), (.forallE (.sort (.succ (.param 1))) (.forallE (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 0)) (.sort (.param 0))) (.forallE (.app (.bvar 0) (.app (.const (.ctor 70 0 0) [(.param 1)]) (.bvar 1))) (.forallE (.forallE (.bvar 2) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 3)) (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.bvar 4) (.app (.app (.app (.const (.ctor 70 0 1) [(.param 1)]) (.bvar 5)) (.bvar 2)) (.bvar 1)))))) (.forallE (.bvar 3) (.forallE (.app (.const (.member 70 0) [(.param 1)]) (.bvar 4)) (.app (.bvar 4) (.app (.app (.app (.const (.ctor 70 0 1) [(.param 1)]) (.bvar 5)) (.bvar 1)) (.bvar 0))))))))))
+  ]),
+  ("indexed", (.forallE (.forallE (.sort (.succ .zero)) (.forallE (.app (.const (.member 60 0) []) (.bvar 0)) (.sort (.param 0)))) (.forallE (.app (.app (.bvar 0) (.sort .zero)) (.const (.ctor 60 0 0) [])) (.forallE (.sort (.succ .zero)) (.forallE (.app (.const (.member 60 0) []) (.bvar 0)) (.app (.app (.bvar 3) (.bvar 1)) (.bvar 0)))))), [
+    ((.lam (.forallE (.sort (.succ .zero)) (.forallE (.app (.const (.member 60 0) []) (.bvar 0)) (.sort (.param 0)))) (.lam (.app (.app (.bvar 0) (.sort .zero)) (.const (.ctor 60 0 0) [])) (.bvar 0))), (.forallE (.forallE (.sort (.succ .zero)) (.forallE (.app (.const (.member 60 0) []) (.bvar 0)) (.sort (.param 0)))) (.forallE (.app (.app (.bvar 0) (.sort .zero)) (.const (.ctor 60 0 0) [])) (.app (.app (.bvar 1) (.sort .zero)) (.const (.ctor 60 0 0) [])))))
+  ]),
+  ("functional", (.forallE (.forallE (.const (.member 50 0) []) (.sort (.param 0))) (.forallE (.forallE (.forallE (.sort .zero) (.const (.member 50 0) [])) (.forallE (.forallE (.sort .zero) (.app (.bvar 2) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 2) (.app (.const (.ctor 50 0 0) []) (.bvar 1))))) (.forallE (.const (.member 50 0) []) (.app (.bvar 2) (.bvar 0))))), [
+    ((.lam (.forallE (.const (.member 50 0) []) (.sort (.param 0))) (.lam (.forallE (.forallE (.sort .zero) (.const (.member 50 0) [])) (.forallE (.forallE (.sort .zero) (.app (.bvar 2) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 2) (.app (.const (.ctor 50 0 0) []) (.bvar 1))))) (.lam (.forallE (.sort .zero) (.const (.member 50 0) [])) (.app (.app (.bvar 1) (.bvar 0)) (.lam (.sort .zero) (.app (.app (.app (.const (.member 93 0) [(.param 0)]) (.bvar 3)) (.bvar 2)) (.app (.bvar 1) (.bvar 0)))))))), (.forallE (.forallE (.const (.member 50 0) []) (.sort (.param 0))) (.forallE (.forallE (.forallE (.sort .zero) (.const (.member 50 0) [])) (.forallE (.forallE (.sort .zero) (.app (.bvar 2) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 2) (.app (.const (.ctor 50 0 0) []) (.bvar 1))))) (.forallE (.forallE (.sort .zero) (.const (.member 50 0) [])) (.app (.bvar 2) (.app (.const (.ctor 50 0 0) []) (.bvar 0)))))))
+  ]),
+  ("w", (.forallE (.sort (.succ .zero)) (.forallE (.forallE (.bvar 0) (.sort (.succ .zero))) (.forallE (.forallE (.app (.app (.const (.member 71 0) []) (.bvar 1)) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.bvar 2) (.forallE (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.app (.const (.member 71 0) []) (.bvar 4)) (.bvar 3))) (.forallE (.forallE (.app (.bvar 3) (.bvar 1)) (.app (.bvar 3) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 3) (.app (.app (.app (.app (.const (.ctor 71 0 0) []) (.bvar 5)) (.bvar 4)) (.bvar 2)) (.bvar 1)))))) (.forallE (.app (.app (.const (.member 71 0) []) (.bvar 3)) (.bvar 2)) (.app (.bvar 2) (.bvar 0))))))), [
+    ((.lam (.sort (.succ .zero)) (.lam (.forallE (.bvar 0) (.sort (.succ .zero))) (.lam (.forallE (.app (.app (.const (.member 71 0) []) (.bvar 1)) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.bvar 2) (.forallE (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.app (.const (.member 71 0) []) (.bvar 4)) (.bvar 3))) (.forallE (.forallE (.app (.bvar 3) (.bvar 1)) (.app (.bvar 3) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 3) (.app (.app (.app (.app (.const (.ctor 71 0 0) []) (.bvar 5)) (.bvar 4)) (.bvar 2)) (.bvar 1)))))) (.lam (.bvar 3) (.lam (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.app (.const (.member 71 0) []) (.bvar 5)) (.bvar 4))) (.app (.app (.app (.bvar 2) (.bvar 1)) (.bvar 0)) (.lam (.app (.bvar 4) (.bvar 1)) (.app (.app (.app (.app (.app (.const (.member 94 0) [(.param 0)]) (.bvar 6)) (.bvar 5)) (.bvar 4)) (.bvar 3)) (.app (.bvar 1) (.bvar 0))))))))))), (.forallE (.sort (.succ .zero)) (.forallE (.forallE (.bvar 0) (.sort (.succ .zero))) (.forallE (.forallE (.app (.app (.const (.member 71 0) []) (.bvar 1)) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.bvar 2) (.forallE (.forallE (.app (.bvar 2) (.bvar 0)) (.app (.app (.const (.member 71 0) []) (.bvar 4)) (.bvar 3))) (.forallE (.forallE (.app (.bvar 3) (.bvar 1)) (.app (.bvar 3) (.app (.bvar 1) (.bvar 0)))) (.app (.bvar 3) (.app (.app (.app (.app (.const (.ctor 71 0 0) []) (.bvar 5)) (.bvar 4)) (.bvar 2)) (.bvar 1)))))) (.forallE (.bvar 3) (.forallE (.forallE (.app (.bvar 3) (.bvar 0)) (.app (.app (.const (.member 71 0) []) (.bvar 5)) (.bvar 4))) (.app (.bvar 3) (.app (.app (.app (.app (.const (.ctor 71 0 0) []) (.bvar 5)) (.bvar 4)) (.bvar 1)) (.bvar 0))))))))))
+  ]),
+  ("dependentIndices", (.forallE (.forallE (.sort .zero) (.forallE (.bvar 0) (.forallE (.app (.app (.const (.member 72 0) []) (.bvar 1)) (.bvar 0)) (.sort (.param 0))))) (.forallE (.forallE (.sort .zero) (.forallE (.bvar 0) (.app (.app (.app (.bvar 2) (.bvar 1)) (.bvar 0)) (.app (.app (.const (.ctor 72 0 0) []) (.bvar 1)) (.bvar 0))))) (.forallE (.sort .zero) (.forallE (.bvar 0) (.forallE (.app (.app (.const (.member 72 0) []) (.bvar 1)) (.bvar 0)) (.app (.app (.app (.bvar 4) (.bvar 2)) (.bvar 1)) (.bvar 0))))))), [
+    ((.lam (.forallE (.sort .zero) (.forallE (.bvar 0) (.forallE (.app (.app (.const (.member 72 0) []) (.bvar 1)) (.bvar 0)) (.sort (.param 0))))) (.lam (.forallE (.sort .zero) (.forallE (.bvar 0) (.app (.app (.app (.bvar 2) (.bvar 1)) (.bvar 0)) (.app (.app (.const (.ctor 72 0 0) []) (.bvar 1)) (.bvar 0))))) (.lam (.sort .zero) (.lam (.bvar 0) (.app (.app (.bvar 2) (.bvar 1)) (.bvar 0)))))), (.forallE (.forallE (.sort .zero) (.forallE (.bvar 0) (.forallE (.app (.app (.const (.member 72 0) []) (.bvar 1)) (.bvar 0)) (.sort (.param 0))))) (.forallE (.forallE (.sort .zero) (.forallE (.bvar 0) (.app (.app (.app (.bvar 2) (.bvar 1)) (.bvar 0)) (.app (.app (.const (.ctor 72 0 0) []) (.bvar 1)) (.bvar 0))))) (.forallE (.sort .zero) (.forallE (.bvar 0) (.app (.app (.app (.bvar 3) (.bvar 1)) (.bvar 0)) (.app (.app (.const (.ctor 72 0 0) []) (.bvar 1)) (.bvar 0))))))))
+  ]),
+  ("manyProp", (.forallE (.forallE (.const (.member 78 0) []) (.sort .zero)) (.forallE (.app (.bvar 0) (.const (.ctor 78 0 0) [])) (.forallE (.app (.bvar 1) (.const (.ctor 78 0 1) [])) (.forallE (.const (.member 78 0) []) (.app (.bvar 3) (.bvar 0)))))), [
+    ((.lam (.forallE (.const (.member 78 0) []) (.sort .zero)) (.lam (.app (.bvar 0) (.const (.ctor 78 0 0) [])) (.lam (.app (.bvar 1) (.const (.ctor 78 0 1) [])) (.bvar 1)))), (.forallE (.forallE (.const (.member 78 0) []) (.sort .zero)) (.forallE (.app (.bvar 0) (.const (.ctor 78 0 0) [])) (.forallE (.app (.bvar 1) (.const (.ctor 78 0 1) [])) (.app (.bvar 2) (.const (.ctor 78 0 0) [])))))),
+    ((.lam (.forallE (.const (.member 78 0) []) (.sort .zero)) (.lam (.app (.bvar 0) (.const (.ctor 78 0 0) [])) (.lam (.app (.bvar 1) (.const (.ctor 78 0 1) [])) (.bvar 0)))), (.forallE (.forallE (.const (.member 78 0) []) (.sort .zero)) (.forallE (.app (.bvar 0) (.const (.ctor 78 0 0) [])) (.forallE (.app (.bvar 1) (.const (.ctor 78 0 1) [])) (.app (.bvar 2) (.const (.ctor 78 0 1) []))))))
+  ]),
+  ("singletonProp", (.forallE (.sort .zero) (.forallE (.forallE (.app (.const (.member 77 0) []) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.bvar 1) (.app (.bvar 1) (.app (.app (.const (.ctor 77 0 0) []) (.bvar 2)) (.bvar 0)))) (.forallE (.app (.const (.member 77 0) []) (.bvar 2)) (.app (.bvar 2) (.bvar 0)))))), [
+    ((.lam (.sort .zero) (.lam (.forallE (.app (.const (.member 77 0) []) (.bvar 0)) (.sort (.param 0))) (.lam (.forallE (.bvar 1) (.app (.bvar 1) (.app (.app (.const (.ctor 77 0 0) []) (.bvar 2)) (.bvar 0)))) (.lam (.bvar 2) (.app (.bvar 1) (.bvar 0)))))), (.forallE (.sort .zero) (.forallE (.forallE (.app (.const (.member 77 0) []) (.bvar 0)) (.sort (.param 0))) (.forallE (.forallE (.bvar 1) (.app (.bvar 1) (.app (.app (.const (.ctor 77 0 0) []) (.bvar 2)) (.bvar 0)))) (.forallE (.bvar 2) (.app (.bvar 2) (.app (.app (.const (.ctor 77 0 0) []) (.bvar 3)) (.bvar 0))))))))
+  ])
+]
+
+end Tests.Theory
diff --git a/Tests/Theory/Standard.lean b/Tests/Theory/Standard.lean
new file mode 100644
index 000000000..c04d45074
--- /dev/null
+++ b/Tests/Theory/Standard.lean
@@ -0,0 +1,132 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Build
+import Tests.Theory.Certified
+
+open Ix.Theory
+
+namespace Tests.Theory.Standard
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certified.Basis Ix.Theory.Certificate
+open Tests.Theory.Certified (primitives)
+
+set_option maxRecDepth 8192
+set_option maxHeartbeats 8000000
+
+def eq : ConstRef Nat := .member 100 0
+def refl : ConstRef Nat := .ctor 100 0 0
+def iff : ConstRef Nat := .member 102 0
+def ne : ConstRef Nat := .member 104 0
+def neIntro : ConstRef Nat := .ctor 104 0 0
+def propextRef : ConstRef Nat := .member 106 0
+def choiceRef : ConstRef Nat := .member 107 0
+
+def propextSpec : Certified.Standard.Spec Nat :=
+  .propext eq refl (.member 101 0) iff (.ctor 102 0 0) (.member 103 0)
+def choiceSpec : Certified.Standard.Spec Nat := .choice ne neIntro (.member 105 0)
+
+def declaration : Nat → Const Nat
+  | 10 => PrimitiveSignature.falseDeclaration
+  | 11 => primitives.falseElimDeclaration
+  | 100 => Equality.shape.source 100
+  | 101 => Equality.shape.recursorSource 100 101 .large true
+  | 102 => Iff.shape.source 102
+  | 103 => Iff.shape.recursorSource 102 103 .large
+  | 104 => Nonempty.shape.source 104
+  | 105 => Nonempty.shape.recursorSource 104 105 .small
+  | 106 => propextSpec.source
+  | 107 => choiceSpec.source
+  | _ => .axiom 0 (.sort .zero) .safe
+
+def store (alter : Nat → Const Nat → Const Nat := fun _ c => c) : Store Nat where
+  dom := [10, 11, 100, 101, 102, 103, 104, 105, 106, 107]
+  nodup := by decide
+  blocks b := if b ∈ [10, 11, 100, 101, 102, 103, 104, 105, 106, 107] then
+    some ⟨[alter b (declaration b)]⟩ else none
+  mem_dom b := by split <;> simp_all
+
+def input (n : Nat) (proof proposition : AExpr Nat) : ProofInput Nat :=
+  ⟨store, n, proof.erase, proposition.erase⟩
+
+def accepted (n : Nat) (proof proposition : AExpr Nat) : Bool :=
+  let input := input n proof proposition
+  (Certificate.proofWitness? 2000 primitives input).any (acceptsCertified.{0,0} 2000 primitives input)
+
+#guard accepted 0 (.const propextRef []) propextSpec.type
+#guard accepted 0 (.const choiceRef [.zero]) (choiceSpec.type.instL [.zero])
+
+def chosen (u : VLevel) (A a : AExpr Nat) : AExpr Nat :=
+  .appN (.const choiceRef [u]) [A, Nonempty.introduction neIntro u A a]
+
+-- The choice result is used at its actual positive source universe as an
+-- argument to reflexivity, under arbitrary A and a : A.
+def choiceRefl (u : VLevel) : AExpr Nat :=
+  .lam .always (.sort u) (.lam .always (.bvar 0)
+    (Equality.reflexivity refl u (.bvar 1) (chosen u (.bvar 1) (.bvar 0))))
+def choiceReflType (u : VLevel) : AExpr Nat :=
+  .forallE .always (.sort u) (.forallE .always (.bvar 0)
+    (Equality.applied eq u (.bvar 1) (chosen u (.bvar 1) (.bvar 0)) (chosen u (.bvar 1) (.bvar 0))))
+
+#guard accepted 1 (choiceRefl (.param 0)) (choiceReflType (.param 0))
+#guard accepted 0 (choiceRefl (.succ .zero)) (choiceReflType (.succ .zero))
+#guard accepted 0 (choiceRefl (.succ (.succ .zero))) (choiceReflType (.succ (.succ .zero)))
+
+def kDomain (P : AExpr Nat) : AExpr Nat :=
+  Equality.applied eq (.succ .zero) (.sort .zero) P P
+def kMotive (P : AExpr Nat) : AExpr Nat :=
+  .lam .never (.sort .zero)
+    (.lam .never (Equality.applied eq (.succ .zero) (.sort .zero) (P.liftN 1) (.bvar 0)) (.sort .zero))
+def kComputed (P proof : AExpr Nat) : AExpr Nat :=
+  .appN (.const (.member 101 0) [.succ .zero, .succ .zero])
+    [.sort .zero, P, kMotive P, P, P, proof]
+def kProof : AExpr Nat :=
+  .lam .always (.sort .zero) (.lam .always (.bvar 0)
+    (.lam .always (kDomain (.bvar 1)) (.bvar 1)))
+def kProposition : AExpr Nat :=
+  .forallE .always (.sort .zero) (.forallE .always (.bvar 0)
+    (.forallE .always (kDomain (.bvar 1)) (kComputed (.bvar 2) (.bvar 0))))
+
+-- The major premise is an arbitrary proof of reflexive equality, not a
+-- constructor application. Admission permits the exact Eq K metadata, and
+-- typed proof irrelevance plus the admitted iota law justify this conversion.
+#guard accepted 0 kProof kProposition
+
+#guard Equality.shape.SupportsK (β := Nat)
+#guard ¬ Nonempty.shape.SupportsK (β := Nat)
+
+def propextInput := input 0 (.const propextRef []) propextSpec.type
+def propextWitness := Certificate.proofWitness? 2000 primitives propextInput
+
+#guard propextWitness.isSome
+
+def falseAxiom (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 106 then .axiom 0 primitives.falseExpr .safe else c
+def unsafeAxiom (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 106 then .axiom 0 propextSpec.type.erase .unsafe else c
+def wrongArity (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 106 then .axiom 1 propextSpec.type.erase .safe else c
+
+#guard [falseAxiom, unsafeAxiom, wrongArity].all fun alter => propextWitness.any fun witness =>
+  !acceptsCertified.{0,0} 2000 primitives { propextInput with store := store alter } witness
+
+-- A standard schema cannot be admitted before its realized prerequisites.
+#guard propextWitness.any fun witness =>
+  let axioms := witness.declarations.filter fun declaration => match declaration with
+    | .standard _ => true
+    | _ => false
+  let rest := witness.declarations.filter fun declaration => match declaration with
+    | .standard _ => false
+    | _ => true
+  !acceptsCertified.{0,0} 2000 primitives propextInput { witness with declarations := axioms ++ rest }
+
+-- Removing the actual dependent eliminator's certificate is also a failure.
+#guard propextWitness.any fun witness =>
+  let declarations := witness.declarations.filter fun declaration => match declaration with
+    | .ordinary w => w.source != 100
+    | _ => true
+  !acceptsCertified.{0,0} 2000 primitives propextInput { witness with declarations }
+
+end Tests.Theory.Standard
diff --git a/Tests/Theory/Structure.lean b/Tests/Theory/Structure.lean
new file mode 100644
index 000000000..b4e95e2ec
--- /dev/null
+++ b/Tests/Theory/Structure.lean
@@ -0,0 +1,159 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Tests.Theory.Standard
+
+open Ix.Theory
+
+namespace Tests.Theory.Structure
+
+open Ix.Theory.Model Ix.Theory.Certified Ix.Theory.Certified.Basis Ix.Theory.Certificate
+open Tests.Theory.Certified (primitives)
+
+set_option maxRecDepth 8192
+set_option maxHeartbeats 8000000
+
+def box : Certified.Structure.Description Nat :=
+  ⟨1, [], [⟨.sort (.param 0), .succ (.param 0)⟩, ⟨.bvar 0, .param 0⟩], .succ (.param 0)⟩
+
+def pair : Certified.Structure.Description Nat :=
+  ⟨1, [.sort (.param 0)], [⟨.bvar 0, .param 0⟩, ⟨.bvar 1, .param 0⟩], .param 0⟩
+
+def store (d : Certified.Structure.Description Nat) (alter : Nat → Const Nat → Const Nat := fun _ c => c) : Store Nat where
+  dom := [10, 11, 100, 101, 200, 201]
+  nodup := by decide
+  blocks b := if b ∈ [10, 11, 100, 101, 200, 201] then some ⟨[alter b (match b with
+    | 200 => d.ordinary.source 200
+    | 201 => d.ordinary.recursorSource 200 201 .large
+    | _ => Standard.declaration b)]⟩ else none
+  mem_dom b := by split <;> simp_all
+
+def input (d : Certified.Structure.Description Nat) (n : Nat) (proof proposition : AExpr Nat) : ProofInput Nat :=
+  ⟨store d, n, proof.erase, proposition.erase⟩
+
+def accepted (d : Certified.Structure.Description Nat) (n : Nat) (proof proposition : AExpr Nat) : Bool :=
+  let input := input d n proof proposition
+  (Certificate.proofWitness? 2400 primitives input).any (acceptsCertified.{0,0} 4000 primitives input)
+
+def boxType (u : VLevel) : AExpr Nat := .const (.member 200 0) [u]
+def boxMk (u : VLevel) (A a : AExpr Nat) : AExpr Nat := .appN (.const (.ctor 200 0 0) [u]) [A, a]
+def proj (i : Nat) (s : AExpr Nat) : AExpr Nat := .proj (.member 200 0) i s
+
+def boxProof : AExpr Nat :=
+  .lam .always (.sort .zero) (.lam .always (.bvar 0) (proj 1 (boxMk .zero (.bvar 1) (.bvar 0))))
+def boxProposition : AExpr Nat :=
+  .forallE .always (.sort .zero) (.forallE .always (.bvar 0) (.bvar 1))
+
+#guard accepted box 0 boxProof boxProposition
+
+def etaProof (u : VLevel) : AExpr Nat :=
+  .lam .always (boxType u) (Equality.reflexivity Standard.refl (.succ u) (boxType u) (.bvar 0))
+def etaProposition (u : VLevel) : AExpr Nat :=
+  .forallE .always (boxType u) (Equality.applied Standard.eq (.succ u) (boxType u)
+    (boxMk u (proj 0 (.bvar 0)) (proj 1 (.bvar 0))) (.bvar 0))
+
+#guard accepted box 0 (etaProof .zero) (etaProposition .zero)
+#guard accepted box 1 (etaProof (.param 0)) (etaProposition (.param 0))
+
+def pairProof : AExpr Nat :=
+  .lam .always (.sort .zero) (.lam .always (.bvar 0)
+    (proj 1 (.appN (.const (.ctor 200 0 0) [.zero]) [.bvar 1, .bvar 0, .bvar 0])))
+
+#guard accepted pair 0 pairProof boxProposition
+
+def fieldProof (u : VLevel) : AExpr Nat :=
+  .lam .always (.sort u) (.lam .always (.bvar 0)
+    (Equality.reflexivity Standard.refl u (.bvar 1) (.bvar 0)))
+def fieldProposition (u : VLevel) : AExpr Nat :=
+  .forallE .always (.sort u) (.forallE .always (.bvar 0)
+    (Equality.applied Standard.eq u (.bvar 1) (proj 1 (boxMk u (.bvar 1) (.bvar 0))) (.bvar 0)))
+
+#guard accepted box 0 (fieldProof .zero) (fieldProposition .zero)
+#guard accepted box 0 (fieldProof (.succ .zero)) (fieldProposition (.succ .zero))
+#guard accepted box 1 (fieldProof (.param 0)) (fieldProposition (.param 0))
+
+def pairType (u : VLevel) (A : AExpr Nat) : AExpr Nat := .app (boxType u) A
+def pairEtaProof (u : VLevel) : AExpr Nat :=
+  .lam .always (.sort u) (.lam .always (pairType u (.bvar 0))
+    (Equality.reflexivity Standard.refl u (pairType u (.bvar 1)) (.bvar 0)))
+def pairEtaProposition (u : VLevel) : AExpr Nat :=
+  .forallE .always (.sort u) (.forallE .always (pairType u (.bvar 0))
+    (Equality.applied Standard.eq u (pairType u (.bvar 1))
+      (.appN (.const (.ctor 200 0 0) [u]) [.bvar 1, proj 0 (.bvar 0), proj 1 (.bvar 0)]) (.bvar 0)))
+
+#guard accepted pair 0 (pairEtaProof .zero) (pairEtaProposition .zero)
+#guard accepted pair 1 (pairEtaProof (.param 0)) (pairEtaProposition (.param 0))
+
+def boxInput := input box 0 boxProof boxProposition
+def boxWitness := Certificate.proofWitness? 2400 primitives boxInput
+
+#guard boxWitness.isSome
+#guard boxWitness.any fun w => w.declarations.any fun d => match d with
+  | .structure _ => true
+  | _ => false
+
+-- These mutations are sent to the validator with the original successful
+-- certificate, so a producer decline is not the rejection being tested.
+def wrongFieldCount (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 200 then match c with
+    | .induct n p i type ctors safety => .induct n p i type (ctors.map fun c => { c with nfields := 1 }) safety
+    | _ => c
+  else c
+def wrongRecursor (b : Nat) (c : Const Nat) : Const Nat :=
+  if b = 201 then match c with
+    | .recursor n p i m r type rules _ safety => .recursor n p i m r type rules true safety
+    | _ => c
+  else c
+
+#guard [wrongFieldCount, wrongRecursor].all fun alter => boxWitness.any fun w =>
+  !acceptsCertified.{0,0} 4000 primitives { boxInput with store := store box alter } w
+
+def badProjectionProof (r : ConstRef Nat) (i : Nat) : AExpr Nat :=
+  .lam .always (.sort .zero) (.lam .always (.bvar 0)
+    (.proj r i (boxMk .zero (.bvar 1) (.bvar 0))))
+
+#guard [(.member 200 0, 2), (.member 100 0, 1)].all fun (r, i) => boxWitness.any fun w =>
+  !acceptsCertified.{0,0} 4000 primitives { boxInput with proof := (badProjectionProof r i).erase } w
+
+#guard boxWitness.any fun w =>
+  let declarations := w.declarations.map fun declaration => match declaration with
+    | .structure s => .ordinary s.facts.block
+    | _ => declaration
+  !acceptsCertified.{0,0} 4000 primitives boxInput { w with declarations }
+
+#guard boxWitness.any fun w =>
+  let declarations := w.declarations.map fun declaration => match declaration with
+    | .structure s => .structure { s with facts := { s.facts with description :=
+        { s.facts.description with fields := s.facts.description.fields.map fun f => { f with level := .zero } } } }
+    | _ => declaration
+  !acceptsCertified.{0,0} 4000 primitives boxInput { w with declarations }
+
+#guard boxWitness.any fun w =>
+  let declarations := w.declarations.map fun declaration => match declaration with
+    | .structure s => .structure { s with iota := s.iota.reverse }
+    | _ => declaration
+  !acceptsCertified.{0,0} 4000 primitives boxInput { w with declarations }
+
+-- A Prop constructor with a data field remains an ordinary inductive. Even
+-- a hand-built structure description cannot grant a projection from it.
+def nonempty : Certified.Structure.Description Nat :=
+  ⟨1, [.sort (.param 0)], [⟨.bvar 0, .param 0⟩], .zero⟩
+def nonemptyStore : Store Nat := store nonempty (fun b c =>
+  if b = 201 then nonempty.ordinary.recursorSource 200 201 .small else c)
+def nonemptyBlock := Certificate.Ordinary.sourceBlock? 2400 primitives.environment nonemptyStore 200 201
+
+#guard nonemptyBlock.isSome
+#guard nonemptyBlock.any fun block =>
+  (Certified.Ordinary.checkBlock.{0,0} 4000 primitives.environment nonemptyStore block).isSome &&
+    (Certificate.Structure.description? block).isNone
+#guard nonemptyBlock.any fun block =>
+  let domains := Certificate.Ordinary.domains? 2400 nonempty.universes
+    (nonempty.ordinary.publishedEnvironment primitives.environment 200 201 .small) []
+    (nonempty.projectionDomains 200)
+  domains.any fun domains =>
+    let witness : Certified.Structure.FactsWitness Nat := ⟨nonempty, block, [.bvar], domains⟩
+    (Certified.Structure.checkFacts.{0,0} 4000 primitives.environment nonemptyStore witness).isNone
+
+end Tests.Theory.Structure
diff --git a/Tests/Theory/Suggestions.lean b/Tests/Theory/Suggestions.lean
new file mode 100644
index 000000000..86fbb37db
--- /dev/null
+++ b/Tests/Theory/Suggestions.lean
@@ -0,0 +1,55 @@
+/-
+Copyright (c) 2026 Argument Computer Corporation.
+SPDX-License-Identifier: MIT OR Apache-2.0
+-/
+
+import Ix.Theory.Certificate.Build
+import Tests.Theory.Acceptance
+
+open Ix.Theory
+
+namespace Tests.Theory.Suggestions
+
+open Ix.Theory.Certified Ix.Theory.Model Ix.Theory.Certificate
+open Tests.Theory.Acceptance
+open Tests.Theory.Certified (primitives)
+
+/-- Search success is deliberately insufficient: every test runs the public
+acceptance validator on the produced ordinary witness data. -/
+def autoAccept (input : ProofInput Nat) : Bool :=
+  (proofWitness? 300 primitives input).any (acceptsCertified.{0,0} 300 primitives input)
+
+#guard autoAccept identityInput
+#guard autoAccept (idDefinitionInput .definition)
+#guard autoAccept (idDefinitionInput .theorem)
+#guard autoAccept (idDefinitionInput .opaque)
+#guard autoAccept { idDefinitionInput with proof := largeIdentityUse.erase }
+#guard autoAccept eliminatorInput
+#guard !autoAccept { identityInput with proposition := primitives.falseExpr }
+
+-- Dependent application with a nonempty-domain possibility:
+-- λ A B f x => f x, where B : A → Prop and f : (x : A) → B x.
+def dependentApplication (u : VLevel) : VExpr Nat :=
+  .lam (.sort u)
+    (.lam (.forallE (.bvar 0) (.sort .zero))
+      (.lam (.forallE (.bvar 1) (.app (.bvar 1) (.bvar 0)))
+        (.lam (.bvar 2) (.app (.bvar 1) (.bvar 0)))))
+
+def dependentApplicationType (u : VLevel) : VExpr Nat :=
+  .forallE (.sort u)
+    (.forallE (.forallE (.bvar 0) (.sort .zero))
+      (.forallE (.forallE (.bvar 1) (.app (.bvar 1) (.bvar 0)))
+        (.forallE (.bvar 2) (.app (.bvar 2) (.bvar 0)))))
+
+def dependentInput (n : Nat) (u : VLevel) : ProofInput Nat :=
+  ⟨prelude, n, dependentApplication u, dependentApplicationType u⟩
+
+#guard autoAccept (dependentInput 1 (.param 0))
+#guard autoAccept (dependentInput 0 .zero)
+#guard autoAccept (dependentInput 0 (.succ .zero))
+#guard autoAccept (dependentInput 0 (.succ (.succ .zero)))
+
+-- An out-of-scope universe is still rejected by the producer and validator.
+#guard !autoAccept (dependentInput 0 (.param 0))
+
+end Tests.Theory.Suggestions
diff --git a/Tests/Theory/certified-foundation.txt b/Tests/Theory/certified-foundation.txt
new file mode 100644
index 000000000..df3ab3819
--- /dev/null
+++ b/Tests/Theory/certified-foundation.txt
@@ -0,0 +1,10669 @@
+certified root Ix.Theory.Model.SetTheory.empty_exists
+  type: ∀ {V : Type u} [inst : Model.SetTheory V], ∃ e, ∀ (z : V), ¬Model.SetTheory.Mem z e
+  axioms: []
+  constants: 55
+  project modules: [Ix.Theory.Model.SetTheory.Core, Ix.Theory.Model.SetTheory.Derive.Empty]
+certified root Ix.Theory.Model.SetTheory.not_mem_empty
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] (z : V), ¬Model.SetTheory.Mem z Model.SetTheory.empty
+  axioms: [Classical.choice]
+  constants: 69
+  project modules: [Ix.Theory.Model.SetTheory.Core, Ix.Theory.Model.SetTheory.Derive.Empty]
+certified root Ix.Theory.VLevel.eval_inst
+  type: ∀ {ls : List VLevel} {ns : List Nat} {l : VLevel},
+  VLevel.eval ns (VLevel.inst ls l) = VLevel.eval (List.map (VLevel.eval ns) ls) l
+  axioms: [propext]
+  constants: 669
+  project modules: [Ix.Theory.VLevel]
+certified root Ix.Theory.Certified.PropWhen.eq_iff_holds
+  type: ∀ (p q : Certified.PropWhen),
+  p = q ↔ ∀ (v : Nat → Nat), Certified.PropWhen.holds v p = Certified.PropWhen.holds v q
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1705
+  project modules: [Ix.Theory.Certified.PropWhen]
+certified root Ix.Theory.Certified.validateZero?_sound
+  type: ∀ {n : Nat} {l : VLevel} {raw : Option (List Nat)} {p : Certified.PropWhen},
+  Certified.validateZero? n l raw = some p →
+    VLevel.WF n l ∧ p.toRaw = raw ∧ Certified.PropWhen.WF n p ∧ p = Certified.zeroCondition l
+  axioms: [propext, Quot.sound]
+  constants: 1602
+  project modules: [Ix.Theory.VLevel, Ix.Theory.Certified.Level, Ix.Theory.Certified.PropWhen]
+certified root Ix.Theory.Certified.zeroCondition_correct
+  type: ∀ (l : VLevel) (values : List Nat),
+  Certified.PropWhen.holds (fun x => values.getD x 0) (Certified.zeroCondition l) = (VLevel.eval values l == 0)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1753
+  project modules: [Ix.Theory.VLevel, Ix.Theory.Certified.Level, Ix.Theory.Certified.PropWhen]
+certified root Ix.Theory.Certified.zeroCondition_inst
+  type: ∀ (l : VLevel) (levels : List VLevel),
+  Certified.zeroCondition (VLevel.inst levels l) = Certified.instCondition levels (Certified.zeroCondition l)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1797
+  project modules: [Ix.Theory.VLevel, Ix.Theory.Certified.Level, Ix.Theory.Certified.PropWhen]
+certified root Ix.Theory.Certified.instCondition_comp
+  type: ∀ (p : Certified.PropWhen) (levels levels' : List VLevel),
+  Certified.instCondition levels' (Certified.instCondition levels p) =
+    Certified.instCondition (List.map (VLevel.inst levels') levels) p
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1803
+  project modules: [Ix.Theory.VLevel, Ix.Theory.Certified.Level, Ix.Theory.Certified.PropWhen]
+certified root Ix.Theory.Model.readAnnotations?
+  type: {β : Type u} → (n k : Nat) → (source : VExpr β) → Model.AnnotationTree → Option (Model.Reading n k source)
+  axioms: [propext]
+  constants: 542
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated]
+certified root Ix.Theory.Model.interp_inst
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] (e a : Model.AExpr β) (constants : Model.Assignment β V)
+  (levels : List Nat) (env : Nat → V) (k : Nat),
+  Model.interp constants levels env (e.inst a k) =
+    Model.interp constants levels
+      (Model.Valuation.insert k (Model.interp constants levels (Model.Valuation.skip k 0 env) a) env) e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1621
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.interp_instL
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] (e : Model.AExpr β) (constants : Model.Assignment β V)
+  (levels : List Nat) (env : Nat → V) (ls : List VLevel),
+  Model.interp constants levels env (Model.AExpr.instL ls e) =
+    Model.interp constants (List.map (VLevel.eval levels) ls) env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1863
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.interp_rename
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {γ : Type w} (e : Model.AExpr β) (mapping : β → γ)
+  (constants : Model.Assignment β V) (constants' : Model.Assignment γ V),
+  (∀ (r : ConstRef β) (ls : List Nat), constants' (ConstRef.rename mapping r) ls = constants r ls) →
+    ∀ (levels : List Nat) (env : Nat → V),
+      Model.interp constants' levels env (Model.AExpr.rename mapping e) = Model.interp constants levels env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 725
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.Rename,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.piR_mem_univ
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {a b : Nat} {A : V} {B : V → V},
+  Model.SetTheory.Mem A (Model.SetTheory.univ a) →
+    (∀ (x : V), Model.SetTheory.Mem x A → Model.SetTheory.Mem (B x) (Model.SetTheory.univ b)) →
+      Model.SetTheory.Mem (Model.SetModel.piR b A B) (Model.SetTheory.univ (VLevel.natIMax a b))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 379
+  project modules: [Ix.Theory.VLevel,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.falseValue_uninhabited
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] (x : V), ¬Model.SetTheory.Mem x Model.falseValue
+  axioms: [Classical.choice]
+  constants: 71
+  project modules: [Ix.Theory.Model.Value, Ix.Theory.Model.SetTheory.Core, Ix.Theory.Model.SetTheory.Derive.Empty]
+certified root Ix.Theory.Model.falseElimValue_mem
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] (level : Nat),
+  Model.SetTheory.Mem (Model.falseElimValue level) (Model.falseElimType level)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 290
+  project modules: [Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.PrimitiveSignature.validate_iff
+  type: ∀ {β : Type u} [inst : DecidableEq β] (signature : Certified.PrimitiveSignature β) (store : Store β),
+  signature.validate store = true ↔
+    store.lookup signature.falseType = some Certified.PrimitiveSignature.falseDeclaration ∧
+      store.lookup signature.falseElim = some signature.falseElimDeclaration
+  axioms: [propext]
+  constants: 895
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Policy]
+certified root Ix.Theory.Certified.readDefinition?
+  type: {β : Type u} →
+  (source : Const β) → Model.AnnotationTree → Model.AnnotationTree → Option { entry // entry.erase = source }
+  axioms: [propext]
+  constants: 584
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated]
+certified root Ix.Theory.Certified.LevelEq.check_sound
+  type: ∀ {n : Nat} {a b : VLevel},
+  Certified.LevelEq.check n a b = true →
+    VLevel.WF n a ∧ VLevel.WF n b ∧ ∀ (values : List Nat), VLevel.eval values a = VLevel.eval values b
+  axioms: [propext, Quot.sound]
+  constants: 1747
+  project modules: [Ix.Theory.VLevel, Ix.Theory.Certified.LevelEq]
+certified root Ix.Theory.Certified.LevelEq.leq_sound
+  type: ∀ {a b : VLevel},
+  Certified.LevelEq.leq a b = true → ∀ (values : List Nat), VLevel.eval values a ≤ VLevel.eval values b
+  axioms: [propext, Quot.sound]
+  constants: 1655
+  project modules: [Ix.Theory.VLevel, Ix.Theory.Certified.LevelEq]
+certified root Ix.Theory.Model.wellDenoted_inst
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] (e a : Model.AExpr β) (constants : Model.Assignment β V)
+  (levels : List Nat) (env : Nat → V) (k : Nat),
+  Model.WellDenoted constants levels (Model.Valuation.skip k 0 env) a →
+    Model.WellDenoted constants levels
+        (Model.Valuation.insert k (Model.interp constants levels (Model.Valuation.skip k 0 env) a) env) e →
+      Model.WellDenoted constants levels env (e.inst a k)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1635
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.wellDenoted_beta
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V} {levels : List Nat}
+  {env : Nat → V} {p : Certified.PropWhen} {A b a : Model.AExpr β},
+  Model.WellDenoted constants levels env (Model.AExpr.lam p A b) →
+    Model.WellDenoted constants levels env a →
+      Model.SetTheory.Mem (Model.interp constants levels env a) (Model.interp constants levels env A) →
+        Model.WellDenoted constants levels env (b.inst a) ∧
+          Model.interp constants levels env ((Model.AExpr.lam p A b).app a) =
+            Model.interp constants levels env (b.inst a)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1681
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.extend_definition
+  type: ∀ {β : Type u} [inst : DecidableEq β] {V : Type v} [inst_1 : Model.SetTheory V] {entries : Model.Environment β}
+  {r : ConstRef β} {entry : Model.ConstantEntry β} {body : Model.AExpr β} {level : VLevel},
+  entries.WF →
+    entries r = none →
+      entry.body = some body →
+        entry.equations = [] →
+          entry.facts = [] →
+            Model.AExpr.Scope entry.universes 0 body →
+              Model.AExpr.ReferencesIn entries entry.type →
+                Model.AExpr.ReferencesIn entries body →
+                  Model.TypingClaim entries [] entry.type (Model.AExpr.sort level) →
+                    Model.TypingClaim entries [] body entry.type →
+                      ∀ (constants : Model.Assignment β V),
+                        Model.Realizes constants entries →
+                          ∃ constants',
+                            Model.Realizes constants' (entries.insert r entry) ∧
+                              Model.Assignment.AgreesOn entries constants constants'
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1642
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.ConversionClaim.equation
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {r : ConstRef β}
+  {entry : Model.ConstantEntry β} {law : Model.ConstantEquation β} {ls : List VLevel},
+  entries r = some entry →
+    law ∈ entry.equations →
+      ls.length = entry.universes →
+        Model.ConversionClaim entries Γ (Model.AExpr.instL ls law.lhs) (Model.AExpr.instL ls law.rhs)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1894
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.IndexedContainer.closed_exists
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat},
+  D.WF w → ∃ L, Model.SetTheory.IsClosedFam w D.indices (D.step w) L
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1795
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.IndexedContainer.carrier_eq
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat},
+  D.WF w → ∀ {i : V}, Model.SetTheory.Mem i D.indices → Model.SetTheory.app (D.carrier w) i = D.fibre w (D.carrier w) i
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1803
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.IndexedContainer.induction
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat},
+  D.WF w →
+    ∀ (P : V → V → Prop),
+      (∀ (i : V),
+          Model.SetTheory.Mem i D.indices →
+            ∀ (a : V),
+              Model.SetTheory.Mem a (D.shapes i) →
+                ∀ (g : V),
+                  Model.SetTheory.Mem g
+                      (Model.SetTheory.piSet (D.positions a) fun p =>
+                        Model.SetTheory.app (D.carrier w) (D.target a p)) →
+                    (∀ (p : V), Model.SetTheory.Mem p (D.positions a) → P (D.target a p) (Model.SetTheory.app g p)) →
+                      P i (Model.IndexedContainer.node w a g)) →
+        ∀ (i : V),
+          Model.SetTheory.Mem i D.indices →
+            ∀ (x : V), Model.SetTheory.Mem x (Model.SetTheory.app (D.carrier w) i) → P i x
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1801
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.IndexedContainer.child_wellFounded
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat},
+  D.WF w → D.LargeElim w → WellFounded (D.Child w)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1812
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.IndexedContainer.fold_node
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat} (hD : D.WF w)
+  (hlarge : D.LargeElim w) (algebra : V → V → V → V → V) {i a g : V} (hi : Model.SetTheory.Mem i D.indices)
+  (ha : Model.SetTheory.Mem a (D.shapes i))
+  (hg :
+    Model.SetTheory.Mem g
+      (Model.SetTheory.piSet (D.positions a) fun p => Model.SetTheory.app (D.carrier w) (D.target a p))),
+  Model.IndexedContainer.fold hD hlarge algebra ⟨(i, Model.IndexedContainer.node w a g), ⋯⟩ =
+    algebra i a g (Model.IndexedContainer.childResults hD hi ha hg (Model.IndexedContainer.fold hD hlarge algebra))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1845
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.IndexedContainer.fold_mem
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat} (hD : D.WF w)
+  (hlarge : D.LargeElim w) {M : V → V → V} {algebra : V → V → V → V → V},
+  D.AlgebraTyping w M algebra →
+    ∀ (z : D.Element w), Model.SetTheory.Mem (Model.IndexedContainer.fold hD hlarge algebra z) (M z.val.fst z.val.snd)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1846
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.IndexedContainer.small_elim
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat},
+  D.WF w →
+    ∀ {M : V → V → V} {algebra : V → V → V → V → V},
+      (∀ (i : V),
+          Model.SetTheory.Mem i D.indices →
+            ∀ (x : V),
+              Model.SetTheory.Mem x (Model.SetTheory.app (D.carrier w) i) →
+                Model.SetTheory.Mem (M i x) Model.SetTheory.univZero) →
+        D.AlgebraTyping w M algebra →
+          ∀ (i : V),
+            Model.SetTheory.Mem i D.indices →
+              ∀ (x : V),
+                Model.SetTheory.Mem x (Model.SetTheory.app (D.carrier w) i) →
+                  Model.SetTheory.Mem Model.SetTheory.pt (M i x)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1809
+  project modules: [Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.Telescope.applyN_curry
+  type: ∀ {V : Type v} [inst : Model.SetTheory V] {w n : Nat} (T : Model.SetTheory.Tower.TeleS V n) {f R : List V → V}
+  {xs : List V},
+  Model.SetTheory.Tower.FitsS T xs →
+    (∀ (ys : List V), Model.SetTheory.Tower.FitsS T ys → Model.SetTheory.Mem (f ys) (R ys)) →
+      (w = 0 →
+          ∀ (ys : List V), Model.SetTheory.Tower.FitsS T ys → Model.SetTheory.Mem (R ys) Model.SetTheory.univZero) →
+        Model.Telescope.applyN (Model.Telescope.curry w T f) xs = f xs
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 346
+  project modules: [Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep]
+certified root Ix.Theory.Model.Telescope.curry_applyN
+  type: ∀ {V : Type v} [inst : Model.SetTheory V] {w n : Nat} (T : Model.SetTheory.Tower.TeleS V n) {f : V}
+  {R : List V → V},
+  Model.SetTheory.Mem f (Model.Telescope.piN w T R) →
+    (w = 0 → ∀ (ys : List V), Model.SetTheory.Tower.FitsS T ys → Model.SetTheory.Mem (R ys) Model.SetTheory.univZero) →
+      Model.Telescope.curry w T (Model.Telescope.applyN f) = f
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 352
+  project modules: [Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep]
+certified root Ix.Theory.Certified.verifyTelescope_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel n : Nat} {entries : Model.Environment β} {bound : Option VLevel}
+  {Γ : Model.Context β} {domains : List (Model.AExpr β)} {witnesses : List (Certified.DomainWitness β)}
+  {result :
+    Certified.CheckedClaim
+      (Model.Telescope.Formed entries Γ domains ∧ Certified.TelescopeBound entries Γ domains bound)},
+  Certified.verifyTelescope fuel n entries bound Γ domains witnesses = some result →
+    Model.Telescope.Formed entries Γ domains ∧ Certified.TelescopeBound entries Γ domains bound
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2583
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.verifyArguments_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel n : Nat} {entries : Model.Environment β} {Γ : Model.Context β}
+  {domains args : List (Model.AExpr β)} {witnesses : List (Certified.TypingWitness β)}
+  {result : Certified.CheckedClaim (Certified.ArgumentsFit entries Γ domains args)},
+  Certified.verifyArguments fuel n entries Γ domains args witnesses = some result →
+    Certified.ArgumentsFit entries Γ domains args
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2579
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.checkShape_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {source : β} {witness : Certified.Ordinary.ShapeWitness β}
+  {result : Certified.CheckedClaim (Certified.Ordinary.CheckedShape entries store source witness.shape)},
+  Certified.Ordinary.checkShape fuel entries store source witness = some result →
+    Certified.Ordinary.CheckedShape entries store source witness.shape
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2891
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.checkLarge_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β}
+  {witness : Certified.Ordinary.ShapeWitness β}
+  {result : Certified.CheckedClaim (Certified.Ordinary.LargeEvidence entries witness.shape)},
+  Certified.Ordinary.checkLarge fuel entries witness = some result →
+    Certified.Ordinary.LargeEvidence entries witness.shape
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2612
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.container_wf
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V}
+  {store : Store β} {source : β},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    Model.Realizes constants entries →
+      Model.Context.Valid constants levels shape.parameterContext env →
+        (shape.container constants levels env).WF (VLevel.eval levels shape.level)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2032
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.constructorValue_mem
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V}
+  {ctor : Certified.Ordinary.Constructor β} {store : Store β} {source : β},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    Model.Realizes constants entries →
+      Model.Context.Valid constants levels shape.parameterContext env →
+        ∀ {i : Nat},
+          shape.constructors[i]? = some ctor →
+            ∀ {xs fs : List V},
+              Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env ctor.fields) xs →
+                shape.RecursiveValuesFit constants levels env ctor xs fs →
+                  Model.SetTheory.Mem (shape.constructorValue constants levels env ctor i xs fs)
+                    (Model.SetTheory.app (shape.carrier constants levels env)
+                      (Model.SetTheory.Tower.mkTower
+                        (List.map (Model.interp constants levels (Model.Telescope.extend env xs)) ctor.indices)))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2277
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.decodeField_branches
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V}
+  {ctor : Certified.Ordinary.Constructor β} {i j : Nat} {field : Certified.Ordinary.RecursiveField β},
+  shape.constructors[i]? = some ctor →
+    ctor.recursive[j]? = some field →
+      Certified.Ordinary.ConstructorEvidence entries shape ctor →
+        Model.Realizes constants entries →
+          Model.Context.Valid constants levels shape.parameterContext env →
+            ∀ {xs fs : List V},
+              Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env ctor.fields) xs →
+                shape.RecursiveValuesFit constants levels env ctor xs fs →
+                  shape.decodeField constants levels env xs j field (shape.branches constants levels env ctor i xs fs) =
+                    fs.getD j Model.SetTheory.empty
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1230
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.branches_decodeFields
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V}
+  {ctor : Certified.Ordinary.Constructor β} {i : Nat},
+  shape.constructors[i]? = some ctor →
+    Certified.Ordinary.ConstructorEvidence entries shape ctor →
+      Model.Realizes constants entries →
+        Model.Context.Valid constants levels shape.parameterContext env →
+          ∀ {xs : List V},
+            Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env ctor.fields) xs →
+              ∀ {g : V},
+                Model.SetTheory.Mem g
+                    (Model.SetTheory.piSet
+                      (shape.positions constants levels env
+                        (Model.SetTheory.Tower.inj i (Model.SetTheory.Tower.mkTower xs)))
+                      fun p =>
+                      Model.SetTheory.app (shape.carrier constants levels env)
+                        (shape.targetIndex constants levels env
+                          (Model.SetTheory.Tower.inj i (Model.SetTheory.Tower.mkTower xs)) p)) →
+                  shape.branches constants levels env ctor i xs (shape.decodeFields constants levels env ctor xs g) = g
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1269
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.container_large
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β},
+  Certified.Ordinary.LargeEvidence entries shape →
+    ∀ {constants : Model.Assignment β V},
+      Model.Realizes constants entries →
+        ∀ {levels : List Nat} {env : Nat → V},
+          Model.Context.Valid constants levels shape.parameterContext env →
+            (shape.container constants levels env).LargeElim (VLevel.eval levels shape.level)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1015
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.largeValue_iota
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β} {store : Store β}
+  {source : β} {shape : Certified.Ordinary.Shape β} {constants : Model.Assignment β V} {levels : List Nat}
+  {env : Nat → V},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    Model.Realizes constants entries →
+      Model.Context.Valid constants levels shape.parameterContext env →
+        ∀ {v : Nat} {m : V} {minors : List V},
+          Model.SetTheory.Mem m (shape.motiveSet constants levels env v) →
+            shape.MinorValuesFit constants levels env v m minors →
+              ∀ (hD : (shape.container constants levels env).WF (VLevel.eval levels shape.level))
+                (hlarge : (shape.container constants levels env).LargeElim (VLevel.eval levels shape.level)) {i : Nat}
+                {ctor : Certified.Ordinary.Constructor β},
+                shape.constructors[i]? = some ctor →
+                  ∀ {xs fs : List V},
+                    Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env ctor.fields) xs →
+                      shape.RecursiveValuesFit constants levels env ctor xs fs →
+                        Model.Telescope.applyN (shape.largeValue constants levels env v m minors hD hlarge)
+                            (List.map (Model.interp constants levels (Model.Telescope.extend env xs)) ctor.indices ++
+                              [shape.constructorValue constants levels env ctor i xs fs]) =
+                          Model.Telescope.applyN (minors.getD i Model.SetTheory.empty)
+                            (xs ++ fs ++ shape.recursiveCalls constants levels env v m minors hD hlarge ctor xs fs)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2417
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.constructorType_interp
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source : β} {constants reading : Model.Assignment β V} {levels : List Nat}
+  {store : Store β},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    Certified.Ordinary.FamilyReading entries shape source constants reading →
+      Model.Realizes constants entries →
+        levels.length = shape.universes →
+          ∀ {ctor : Certified.Ordinary.Constructor β},
+            ctor ∈ shape.constructors →
+              Model.interp reading levels (fun x => Model.SetTheory.empty) (ctor.type shape source) =
+                shape.constructorSet constants levels ctor
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2309
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.recursorType_interp
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source : β} {constants reading : Model.Assignment β V} {levels : List Nat}
+  {mode : Inductive.ElimMode} {store : Store β},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    Certified.Ordinary.ConstructorReading entries shape source constants reading →
+      Model.Realizes constants entries →
+        levels.length = mode.recUvars shape.universes →
+          Model.interp reading levels (fun x => Model.SetTheory.empty) (shape.recursorType source mode) =
+            shape.closedRecursorSet constants levels mode
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2719
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.closedRecursorValue_mem_source
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source : β} {store : Store β} {constants : Model.Assignment β V}
+  {levels : List Nat} {mode : Inductive.ElimMode},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    ∀ {reading : Model.Assignment β V},
+      Certified.Ordinary.ConstructorReading entries shape source constants reading →
+        Certified.Ordinary.ModeEvidence entries shape mode →
+          Model.Realizes constants entries →
+            levels.length = mode.recUvars shape.universes →
+              Model.SetTheory.Mem (shape.closedRecursorValue constants levels mode)
+                (Model.interp reading levels (fun x => Model.SetTheory.empty) (shape.recursorType source mode))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2828
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.produced_rule_eq
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source recursor : β} {constants : Model.Assignment β V} {levels : List Nat}
+  {mode : Inductive.ElimMode} [inst_1 : DecidableEq β] {store : Store β},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    entries.WF →
+      Certified.Ordinary.Shape.ConstructorFormation entries shape source →
+        Certified.Ordinary.Shape.RecursorFormation entries store shape source recursor mode →
+          Certified.Ordinary.ModeEvidence entries shape mode →
+            Model.Realizes constants entries →
+              levels.length = mode.recUvars shape.universes →
+                ∀ {i : Nat} {ctor : Certified.Ordinary.Constructor β},
+                  shape.constructors[i]? = some ctor →
+                    Certified.Ordinary.Shape.RuleFormation (shape.recursorEnvironment entries source recursor mode)
+                        shape source recursor mode i ctor →
+                      ∀ (env : Nat → V),
+                        Model.interp (shape.recursorAssignment constants source recursor mode) levels env
+                            (shape.ruleLhs source recursor mode i ctor) =
+                          Model.interp (shape.recursorAssignment constants source recursor mode) levels env
+                            (shape.ruleRhs source recursor mode i ctor)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3127
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.checkBlock_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Ordinary.BlockWitness β}
+  {result :
+    Certified.CheckedClaim
+      (Certified.Ordinary.CheckedBlock entries store witness.source witness.recursor witness.shape.shape witness.mode)},
+  Certified.Ordinary.checkBlock fuel entries store witness = some result →
+    Certified.Ordinary.CheckedBlock entries store witness.source witness.recursor witness.shape.shape witness.mode
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3074
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Ordinary.Shape.publishedAssignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {V : Type v} [inst_1 : Model.SetTheory V] {entries : Model.Environment β}
+  {store : Store β} {source recursor : β} {shape : Certified.Ordinary.Shape β} {mode : Inductive.ElimMode},
+  Certified.Ordinary.CheckedBlock entries store source recursor shape mode →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          Model.Realizes (shape.recursorAssignment constants source recursor mode)
+            (shape.publishedEnvironment entries source recursor mode)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3172
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitOrdinary?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store}
+  {witness : Certified.Ordinary.BlockWitness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitOrdinary? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4207
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.ConversionClaim.proofIrrel
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {A a b : Model.AExpr β},
+  Model.TypingClaim entries Γ A (Model.AExpr.sort VLevel.zero) →
+    Model.TypingClaim entries Γ a A → Model.TypingClaim entries Γ b A → Model.ConversionClaim entries Γ a b
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 752
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Basis.Equality.Interface.of_checked
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β} {source recursor : β},
+  Certified.Ordinary.CheckedBlock entries store source recursor Certified.Basis.Equality.shape
+      Inductive.ElimMode.large →
+    Certified.Basis.Equality.Interface
+      (Certified.Basis.Equality.shape.publishedEnvironment entries source recursor Inductive.ElimMode.large)
+      (ConstRef.member source 0) (ConstRef.ctor source 0 0) (ConstRef.member recursor 0)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2010
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Basis.Equality.value_eq_eqv
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {family refl recursor : ConstRef β} {constants : Model.Assignment β V},
+  Certified.Basis.Equality.Interface entries family refl recursor →
+    Model.Realizes constants entries →
+      ∀ {u : Nat} {A a b : V},
+        Model.SetTheory.Mem A (Model.SetTheory.univ u) →
+          Model.SetTheory.Mem a A →
+            Model.SetTheory.Mem b A → Certified.Basis.Equality.value constants family u A a b = Model.SetTheory.eqv a b
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1106
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Basis.Iff.Interface.of_checked
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β} {source recursor : β},
+  Certified.Ordinary.CheckedBlock entries store source recursor Certified.Basis.Iff.shape Inductive.ElimMode.large →
+    Certified.Basis.Iff.Interface
+      (Certified.Basis.Iff.shape.publishedEnvironment entries source recursor Inductive.ElimMode.large)
+      (ConstRef.member source 0) (ConstRef.ctor source 0 0) (ConstRef.member recursor 0)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2012
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Basis.Iff.eq_of_mem
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {family ctor recursor : ConstRef β} {constants : Model.Assignment β V},
+  Certified.Basis.Iff.Interface entries family ctor recursor →
+    Model.Realizes constants entries →
+      ∀ {P Q proof : V},
+        Model.SetTheory.Mem P Model.SetTheory.univZero →
+          Model.SetTheory.Mem Q Model.SetTheory.univZero →
+            Model.SetTheory.Mem proof (Certified.Basis.Iff.value constants family P Q) → P = Q
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1109
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Basis.Nonempty.Interface.of_checked
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β} {source recursor : β},
+  Certified.Ordinary.CheckedBlock entries store source recursor Certified.Basis.Nonempty.shape
+      Inductive.ElimMode.small →
+    Certified.Basis.Nonempty.Interface
+      (Certified.Basis.Nonempty.shape.publishedEnvironment entries source recursor Inductive.ElimMode.small)
+      (ConstRef.member source 0) (ConstRef.ctor source 0 0) (ConstRef.member recursor 0)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2011
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Basis.Nonempty.value_eq_truthVal
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {family ctor recursor : ConstRef β} {constants : Model.Assignment β V},
+  Certified.Basis.Nonempty.Interface entries family ctor recursor →
+    Model.Realizes constants entries →
+      ∀ {u : Nat} {A : V},
+        Model.SetTheory.Mem A (Model.SetTheory.univ u) →
+          Certified.Basis.Nonempty.value constants family u A = Model.SetTheory.truthVal (∃ a, Model.SetTheory.Mem a A)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 921
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Standard.Spec.value_mem
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {constants : Model.Assignment β V} (spec : Certified.Standard.Spec β),
+  Certified.Standard.Spec.Prerequisites entries spec →
+    Model.Realizes constants entries →
+      ∀ (levels : List Nat),
+        levels.length = spec.universes →
+          ∀ (env : Nat → V),
+            Model.SetTheory.Mem (spec.value constants levels) (Model.interp constants levels env spec.type)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1197
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Standard.check_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Standard.Witness β}
+  {result : Certified.CheckedClaim (Certified.Standard.Checked entries store witness)},
+  Certified.Standard.check fuel entries store witness = some result → Certified.Standard.Checked entries store witness
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2833
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Standard.assignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Standard.Witness β} {V : Type v} [inst_1 : Model.SetTheory V],
+  Certified.Standard.Checked entries store witness →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          Model.Realizes (Certified.Standard.assignment constants witness)
+            (entries.insert witness.ref witness.spec.entry)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1407
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitStandard?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store} {witness : Certified.Standard.Witness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitStandard? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3332
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.SetTheory.quotSet_mem_univ
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {u : Nat} {A R : V},
+  Model.SetTheory.Mem A (Model.SetTheory.univ u) →
+    Model.SetTheory.Mem (Model.SetTheory.quotSet u A R) (Model.SetTheory.univ u)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 225
+  project modules: [Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.SetTheory.quotSound
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {u : Nat} {A R a b w : V},
+  Model.SetTheory.Mem a A →
+    Model.SetTheory.Mem b A →
+      Model.SetTheory.Mem w (Model.SetTheory.app (Model.SetTheory.app R a) b) →
+        Model.SetTheory.quotClass u A R a = Model.SetTheory.quotClass u A R b
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 205
+  project modules: [Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep]
+certified root Ix.Theory.Certified.Signature.checkTypes_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β}
+  {headers : List (Certified.Signature.Header β)} {witnesses : List (Certified.Signature.TypeWitness β)}
+  {result : Certified.CheckedClaim (Certified.Signature.Formed entries headers)},
+  Certified.Signature.checkTypes fuel entries headers witnesses = some result →
+    Certified.Signature.Formed entries headers
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2581
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Signature.Formed.realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {V : Type v} [inst_1 : Model.SetTheory V] {entries : Model.Environment β}
+  {headers : List (Certified.Signature.Header β)},
+  Certified.Signature.Formed entries headers →
+    ∀ {constants : Model.Assignment β V},
+      Model.Realizes constants entries →
+        (∀ (header : Certified.Signature.Header β),
+            header ∈ headers →
+              ∀ (levels : List Nat),
+                levels.length = header.universes →
+                  ∀ (env : Nat → V),
+                    Model.SetTheory.Mem (constants header.ref levels) (Model.interp constants levels env header.type)) →
+          Model.Realizes constants (Certified.Signature.environment entries headers)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 901
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Quotient.value_mem
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {refs : Certified.Quotient.Refs β} {entries : Model.Environment β},
+  Certified.Quotient.Reading constants refs →
+    Certified.Basis.Equality.Interface entries refs.eq refs.eqRefl refs.eqRec →
+      Model.Realizes constants entries →
+        ∀ (kind : Certified.Quotient.Kind) (levels : List Nat),
+          levels.length = kind.universes →
+            ∀ (env : Nat → V),
+              Model.SetTheory.Mem (constants (refs.ref kind) levels)
+                (Model.interp constants levels env (refs.entryType kind))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1236
+  project modules: [Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Quotient.liftValue_apply
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {constants : Model.Assignment β V} {eq refl recursor : ConstRef β},
+  Certified.Basis.Equality.Interface entries eq refl recursor →
+    Model.Realizes constants entries →
+      ∀ {u v : Nat} {A R B f h a : V},
+        Model.SetTheory.Mem A (Model.SetTheory.univ u) →
+          Model.SetTheory.Mem R (Certified.Quotient.relationSet A) →
+            Model.SetTheory.Mem B (Model.SetTheory.univ v) →
+              Model.SetTheory.Mem f (Model.SetModel.piR (Certified.Quotient.bit v) A fun x => B) →
+                Model.SetTheory.Mem h (Certified.Quotient.invariantSet constants eq v A R B f) →
+                  Model.SetTheory.Mem a A →
+                    Model.SetTheory.app
+                        (Model.SetTheory.app
+                          (Model.SetTheory.app
+                            (Model.SetTheory.app
+                              (Model.SetTheory.app
+                                (Model.SetTheory.app (Certified.Quotient.liftValue constants eq u v) A) R)
+                              B)
+                            f)
+                          h)
+                        (Model.SetTheory.quotClass u A R a) =
+                      Model.SetTheory.app f a
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1132
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Quotient.liftRule_eq
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {refs : Certified.Quotient.Refs β} {entries : Model.Environment β},
+  Certified.Quotient.Reading constants refs →
+    Certified.Basis.Equality.Interface entries refs.eq refs.eqRefl refs.eqRec →
+      Model.Realizes constants entries →
+        ∀ (u v : Nat) (env : Nat → V),
+          Model.interp constants [u, v] env (Certified.Quotient.liftRuleLhs refs) =
+            Model.interp constants [u, v] env (Certified.Quotient.liftRuleRhs refs)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1182
+  project modules: [Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Quotient.check_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Quotient.Witness β}
+  {result : Certified.CheckedClaim (Certified.Quotient.Checked entries store witness.refs)},
+  Certified.Quotient.check fuel entries store witness = some result →
+    Certified.Quotient.Checked entries store witness.refs
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2895
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Quotient.assignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {refs : Certified.Quotient.Refs β} {V : Type v} [inst_1 : Model.SetTheory V],
+  Certified.Quotient.Checked entries store refs →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries → Model.Realizes (refs.assignment constants) (refs.environment entries)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1556
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitQuotient?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store} {witness : Certified.Quotient.Witness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitQuotient? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3463
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.TypingClaim.fact
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {r : ConstRef β}
+  {entry : Model.ConstantEntry β} {e A : Model.AExpr β} {ls : List VLevel},
+  entries r = some entry →
+    Model.ConstantFact.typed e A ∈ entry.facts →
+      ls.length = entry.universes → Model.TypingClaim entries Γ (Model.AExpr.instL ls e) (Model.AExpr.instL ls A)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1904
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.TypingClaim.natLit
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {r zero succ : ConstRef β}
+  {entry : Model.ConstantEntry β},
+  entries r = some entry →
+    Model.ConstantFact.natural zero succ ∈ entry.facts →
+      entry.universes = 0 →
+        ∀ (value : Nat), Model.TypingClaim entries Γ (Model.AExpr.natLit value) (Model.AExpr.const r [])
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 741
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.TypingClaim.betaResult
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {p : Certified.PropWhen}
+  {D body arg B : Model.AExpr β},
+  Model.TypingClaim entries Γ (Model.AExpr.lam p D body) (Model.AExpr.forallE p D B) →
+    Model.TypingClaim entries Γ arg D → Model.TypingClaim entries Γ (body.inst arg) (B.inst arg)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1731
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.ConversionClaim.natZero
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {r zero succ : ConstRef β}
+  {entry : Model.ConstantEntry β},
+  entries r = some entry →
+    Model.ConstantFact.natural zero succ ∈ entry.facts →
+      entry.universes = 0 → Model.ConversionClaim entries Γ (Model.AExpr.natLit 0) (Model.AExpr.const zero [])
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 741
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.ConversionClaim.natSucc
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {r zero succ : ConstRef β}
+  {entry : Model.ConstantEntry β},
+  entries r = some entry →
+    Model.ConstantFact.natural zero succ ∈ entry.facts →
+      entry.universes = 0 →
+        ∀ (value : Nat),
+          Model.ConversionClaim entries Γ (Model.AExpr.natLit (value + 1))
+            ((Model.AExpr.const succ []).app (Model.AExpr.natLit value))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 741
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.ConversionClaim.proj
+  type: ∀ {β : Type u} {entries : Model.Environment β} {Γ : Model.Context β} {r : ConstRef β} {i : Nat}
+  {a b : Model.AExpr β},
+  Model.ConversionClaim entries Γ a b →
+    Model.ConversionClaim entries Γ (Model.AExpr.proj r i a) (Model.AExpr.proj r i b)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 739
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Structure.Description.projections_fit
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {d : Certified.Structure.Description β}
+  {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V} {entries : Model.Environment β}
+  {store : Store β} {source : β},
+  Certified.Ordinary.CheckedShape entries store source d.ordinary →
+    Certified.Structure.FieldsFormed entries d.level d.ordinary.parameterContext d.fields →
+      Model.Realizes constants entries →
+        Model.Context.Valid constants levels d.ordinary.parameterContext env →
+          ∀ {x : V},
+            Model.SetTheory.Mem x (Model.SetTheory.app (d.ordinary.carrier constants levels env) Model.SetTheory.pt) →
+              Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env d.constructor.fields)
+                (Certified.Structure.projectValues d.fields.length x)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2282
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.constructor_eta
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {d : Certified.Structure.Description β}
+  {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V} {entries : Model.Environment β}
+  {store : Store β} {source : β},
+  Certified.Ordinary.CheckedShape entries store source d.ordinary →
+    Model.Realizes constants entries →
+      Model.Context.Valid constants levels d.ordinary.parameterContext env →
+        ∀ {x : V},
+          Model.SetTheory.Mem x (Model.SetTheory.app (d.ordinary.carrier constants levels env) Model.SetTheory.pt) →
+            d.ordinary.constructorValue constants levels env d.constructor 0
+                (Certified.Structure.projectValues d.fields.length x) [] =
+              x
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2270
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.constructor_iota
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {d : Certified.Structure.Description β}
+  {constants : Model.Assignment β V} {levels : List Nat} {env : Nat → V} {entries : Model.Environment β},
+  Certified.Structure.FieldsFormed entries d.level d.ordinary.parameterContext d.fields →
+    Model.Realizes constants entries →
+      Model.Context.Valid constants levels d.ordinary.parameterContext env →
+        ∀ {xs : List V},
+          Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env d.constructor.fields) xs →
+            Certified.Structure.projectValues d.fields.length
+                (d.ordinary.constructorValue constants levels env d.constructor 0 xs []) =
+              xs
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1113
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.projection_meaning
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {d : Certified.Structure.Description β}
+  {entries : Model.Environment β} {store : Store β} {source : β} {constants reading : Model.Assignment β V}
+  {levels : List Nat},
+  Certified.Ordinary.CheckedShape entries store source d.ordinary →
+    Certified.Structure.FieldsFormed entries d.level d.ordinary.parameterContext d.fields →
+      Certified.Ordinary.FamilyReading entries d.ordinary source constants reading →
+        Model.Realizes constants entries →
+          levels.length = d.universes →
+            ∀ {stage : Model.Environment β},
+              Model.Realizes reading stage →
+                Model.Telescope.Formed stage [] (d.projectionDomains source) →
+                  ∀ {i : Nat} {field : Certified.Structure.Field β},
+                    d.fields[i]? = some field →
+                      Model.AExpr.Scope d.universes 0 (d.projection source i field) ∧
+                          Model.AExpr.Scope d.universes 0 (d.projectionType source i field) →
+                        ∀ (env : Nat → V),
+                          Model.ConstantFact.Meaning reading (ConstRef.member source 0) levels env
+                            (Model.ConstantFact.typed (d.projection source i field) (d.projectionType source i field))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2669
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.eta_eq
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {d : Certified.Structure.Description β}
+  {entries : Model.Environment β} {store : Store β} {source : β} {constants reading : Model.Assignment β V}
+  {levels : List Nat},
+  Certified.Ordinary.CheckedShape entries store source d.ordinary →
+    Certified.Structure.FieldsFormed entries d.level d.ordinary.parameterContext d.fields →
+      Certified.Ordinary.ConstructorReading entries d.ordinary source constants reading →
+        Model.Realizes constants entries →
+          levels.length = d.universes →
+            Model.interp reading levels (fun x => Model.SetTheory.empty) (d.etaLhs source) =
+              Model.interp reading levels (fun x => Model.SetTheory.empty) (d.etaRhs source)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2437
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.iota_eq
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {d : Certified.Structure.Description β}
+  {entries : Model.Environment β} {store : Store β} {source : β} {constants reading : Model.Assignment β V}
+  {levels : List Nat},
+  Certified.Ordinary.CheckedShape entries store source d.ordinary →
+    Certified.Structure.FieldsFormed entries d.level d.ordinary.parameterContext d.fields →
+      Certified.Ordinary.ConstructorReading entries d.ordinary source constants reading →
+        Model.Realizes constants entries →
+          levels.length = d.universes →
+            ∀ {i : Nat} {field : Certified.Structure.Field β},
+              d.fields[i]? = some field →
+                Model.interp reading levels (fun x => Model.SetTheory.empty) (d.iotaLhs source i field) =
+                  Model.interp reading levels (fun x => Model.SetTheory.empty) (d.iotaRhs i field)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2431
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.check_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Structure.Witness β}
+  {result :
+    Certified.CheckedClaim
+      (Certified.Structure.Checked entries store witness.facts.description witness.facts.block.source
+        witness.facts.block.recursor witness.facts.block.mode)},
+  Certified.Structure.check fuel entries store witness = some result →
+    Certified.Structure.Checked entries store witness.facts.description witness.facts.block.source
+      witness.facts.block.recursor witness.facts.block.mode
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3205
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.factAssignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {d : Certified.Structure.Description β} {entries : Model.Environment β}
+  {store : Store β} {source recursor : β} {mode : Inductive.ElimMode} {V : Type v} [inst_1 : Model.SetTheory V],
+  Certified.Structure.FactsChecked entries store d source recursor mode →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          Model.Realizes (d.ordinary.recursorAssignment constants source recursor mode)
+            (d.factEnvironment entries source recursor mode)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3279
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Structure.Description.publishedAssignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {d : Certified.Structure.Description β} {entries : Model.Environment β}
+  {store : Store β} {source recursor : β} {mode : Inductive.ElimMode} {V : Type v} [inst_1 : Model.SetTheory V],
+  Certified.Structure.Checked entries store d source recursor mode →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          Model.Realizes (d.ordinary.recursorAssignment constants source recursor mode)
+            (d.publishedEnvironment entries source recursor mode)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3312
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitStructure?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store} {witness : Certified.Structure.Witness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitStructure? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4377
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Natural.value_mem
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {entries : Model.Environment β} {store : Store β} {source : β},
+  Certified.Ordinary.CheckedShape entries store source Certified.Natural.shape →
+    Model.Realizes constants entries →
+      ∀ (n : Nat), Model.SetTheory.Mem (Model.Numeral.value n) (Certified.Natural.shape.familyValue constants [])
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2299
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Natural.meaning
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {entries : Model.Environment β} {store : Store β} {source : β},
+  Certified.Ordinary.CheckedShape entries store source Certified.Natural.shape →
+    ∀ {reading : Model.Assignment β V},
+      Certified.Ordinary.ConstructorReading entries Certified.Natural.shape source constants reading →
+        Model.Realizes constants entries →
+          Model.NaturalMeaning reading (ConstRef.member source 0) (ConstRef.ctor source 0 0) (ConstRef.ctor source 0 1)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2324
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Natural.check_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {pin : ConstRef β} {witness : Certified.Ordinary.BlockWitness β}
+  {result :
+    Certified.CheckedClaim (Certified.Natural.Checked entries store pin witness.source witness.recursor witness.mode)},
+  Certified.Natural.check fuel entries store pin witness = some result →
+    Certified.Natural.Checked entries store pin witness.source witness.recursor witness.mode
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3124
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Natural.assignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β} {pin : ConstRef β}
+  {source recursor : β} {mode : Inductive.ElimMode} {V : Type v} [inst_1 : Model.SetTheory V],
+  Certified.Natural.Checked entries store pin source recursor mode →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          Model.Realizes (Certified.Natural.shape.recursorAssignment constants source recursor mode)
+            (Certified.Natural.environment entries source recursor mode)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3196
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitNatural?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store}
+  {witness : Certified.Ordinary.BlockWitness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitNatural? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4275
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Model.interp_mapRefs
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (mapping : ConstRef β → ConstRef γ) (constants : Model.Assignment γ V) (levels : List Nat) (env : Nat → V),
+  Model.interp constants levels env (Model.AExpr.mapRefs mapping e) =
+    Model.interp (fun ref values => constants (mapping ref) values) levels env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 721
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.wellDenoted_mapRefs
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (mapping : ConstRef β → ConstRef γ) (constants : Model.Assignment γ V) (levels : List Nat) (env : Nat → V),
+  Model.WellDenoted constants levels env (Model.AExpr.mapRefs mapping e) ↔
+    Model.WellDenoted (fun ref values => constants (mapping ref) values) levels env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 736
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.AExpr.mapRefs_restore
+  type: ∀ {β : Type u} {γ : Type v} (e : Model.AExpr β) (forward : ConstRef β → ConstRef γ)
+  (backward : ConstRef γ → ConstRef β),
+  (∀ (ref : ConstRef β), ref ∈ e.references → backward (forward ref) = ref) →
+    Model.AExpr.mapRefs backward (Model.AExpr.mapRefs forward e) = e
+  axioms: [propext]
+  constants: 169
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Support]
+certified root Ix.Theory.Model.interp_mapRefs_restore
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (forward : ConstRef β → ConstRef γ) (backward : ConstRef γ → ConstRef β) (constants : Model.Assignment β V),
+  (∀ (ref : ConstRef β), ref ∈ e.references → backward (forward ref) = ref) →
+    ∀ (levels : List Nat) (env : Nat → V),
+      Model.interp constants levels env (Model.AExpr.mapRefs backward (Model.AExpr.mapRefs forward e)) =
+        Model.interp constants levels env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 759
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.interp_mapRefs_permutation
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (forward : ConstRef β → ConstRef γ) (backward : ConstRef γ → ConstRef β) (constants : Model.Assignment β V),
+  (∀ (ref : ConstRef β), ref ∈ e.references → backward (forward ref) = ref) →
+    ∀ (levels : List Nat) (env : Nat → V),
+      Model.interp (fun ref values => constants (backward ref) values) levels env (Model.AExpr.mapRefs forward e) =
+        Model.interp constants levels env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 755
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.wellDenoted_mapRefs_permutation
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (forward : ConstRef β → ConstRef γ) (backward : ConstRef γ → ConstRef β) (constants : Model.Assignment β V),
+  (∀ (ref : ConstRef β), ref ∈ e.references → backward (forward ref) = ref) →
+    ∀ (levels : List Nat) (env : Nat → V),
+      Model.WellDenoted (fun ref values => constants (backward ref) values) levels env (Model.AExpr.mapRefs forward e) ↔
+        Model.WellDenoted constants levels env e
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 771
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.interp_mapRefs_merge
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (before : Model.Assignment β V) (after : Model.Assignment γ V) (mapping : ConstRef β → ConstRef γ),
+  (∀ (ref : ConstRef β), ref ∈ e.references → ∀ (levels : List Nat), before ref levels = after (mapping ref) levels) →
+    ∀ (levels : List Nat) (env : Nat → V),
+      Model.interp before levels env e = Model.interp after levels env (Model.AExpr.mapRefs mapping e)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 755
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Model.wellDenoted_mapRefs_merge
+  type: ∀ {β : Type u} {γ : Type v} {V : Type x} [inst : Model.SetTheory V] (e : Model.AExpr β)
+  (before : Model.Assignment β V) (after : Model.Assignment γ V) (mapping : ConstRef β → ConstRef γ),
+  (∀ (ref : ConstRef β), ref ∈ e.references → ∀ (levels : List Nat), before ref levels = after (mapping ref) levels) →
+    ∀ (levels : List Nat) (env : Nat → V),
+      Model.WellDenoted before levels env e ↔ Model.WellDenoted after levels env (Model.AExpr.mapRefs mapping e)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 771
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Modeled.propositional_equation
+  type: ∀ {β : Type u} {entries : Model.Environment β} {family reflexivity recursor : ConstRef β},
+  Certified.Basis.Equality.Interface entries family reflexivity recursor →
+    ∀ {rule : Certified.Signature.Rule β} {level : VLevel} {proof : Model.AExpr β},
+      Model.TypingClaim entries [] rule.type (Model.AExpr.sort level) →
+        Model.TypingClaim entries [] rule.lhs rule.type →
+          Model.TypingClaim entries [] rule.rhs rule.type →
+            Model.TypingClaim entries [] proof
+                (Certified.Basis.Equality.applied family level rule.type rule.lhs rule.rhs) →
+              Model.ConversionClaim entries [] rule.lhs rule.rhs
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1115
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Modeled.checkEquation?_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β}
+  {rule : Certified.Signature.Rule β} {witness : Certified.Modeled.EquationWitness β}
+  {result : Certified.CheckedClaim (Certified.Modeled.CheckedEquation entries rule)},
+  Certified.Modeled.checkEquation? fuel entries rule witness = some result →
+    Certified.Modeled.CheckedEquation entries rule
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2631
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Modeled.CheckedCompanions.fixed_old
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β}
+  {companions : List (Certified.Modeled.Companion β)},
+  Certified.Modeled.CheckedCompanions entries companions →
+    ∀ {ref : ConstRef β} {entry : Model.ConstantEntry β},
+      entries ref = some entry → Certified.Modeled.mapping companions ref = ref
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 834
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Modeled.environment_wf
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β}
+  {companions : List (Certified.Modeled.Companion β)},
+  Certified.Modeled.CheckedCompanions entries companions →
+    entries.WF → (Certified.Modeled.environment entries companions).WF
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 913
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Modeled.assignment_agrees
+  type: ∀ {β : Type u} [inst : DecidableEq β] {V : Type v} {entries : Model.Environment β}
+  {companions : List (Certified.Modeled.Companion β)},
+  Certified.Modeled.CheckedCompanions entries companions →
+    ∀ (constants : Model.Assignment β V),
+      Model.Assignment.AgreesOn entries constants (Certified.Modeled.assignment constants companions)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 837
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Modeled.assignment_realizes
+  type: ∀ {β : Type u} [inst : DecidableEq β] {V : Type v} [inst_1 : Model.SetTheory V] {entries : Model.Environment β}
+  {companions : List (Certified.Modeled.Companion β)},
+  Certified.Modeled.CheckedCompanions entries companions →
+    entries.WF →
+      ∀ (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          Model.Realizes (Certified.Modeled.assignment constants companions)
+            (Certified.Modeled.environment entries companions)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1030
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.Modeled.check?_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Modeled.Witness β}
+  {result : Certified.CheckedClaim (Certified.Modeled.Checked entries store witness)},
+  Certified.Modeled.check? fuel entries store witness = some result → Certified.Modeled.Checked entries store witness
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2947
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.Modeled.EntrySource.not_axiom
+  type: ∀ {β : Type u} {store : Store β} {ref : ConstRef β} {entry : Model.ConstantEntry β},
+  Certified.Modeled.EntrySource store ref entry →
+    ∀ {n : Nat} {type : VExpr β} {safety : Safety}, store.lookup ref = some (Const.axiom n type safety) → False
+  axioms: [propext]
+  constants: 964
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport]
+certified root Ix.Theory.Certified.Modeled.EntrySource.header
+  type: ∀ {β : Type u} {store : Store β} {ref : ConstRef β} {entry : Model.ConstantEntry β},
+  Certified.Modeled.EntrySource store ref entry → Certified.SourceHeader store ref entry
+  axioms: [propext]
+  constants: 968
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport]
+certified root Ix.Theory.Certified.checkModeledExtension?
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (state : Certified.CheckedInterface signature) →
+            Certified.Modeled.Witness β → Option (Certified.CheckedExtension signature store state)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3257
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitModeled?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store} {witness : Certified.Modeled.Witness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitModeled? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3277
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.PrimitiveSignature.compatible_assignment
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] (signature : Certified.PrimitiveSignature β)
+  [inst_1 : DecidableEq β], signature.Compatible signature.environment signature.assignment
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2006
+  project modules: [Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.checkTypeCertified_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel n : Nat} {entries : Model.Environment β} {Γ : Model.Context β}
+  {e A : Model.AExpr β} {witness : Certified.TypingWitness β},
+  Certified.checkTypeCertified fuel n entries Γ e A witness = true → Model.TypingClaim entries Γ e A
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2553
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.defeqCertified_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel n : Nat} {entries : Model.Environment β} {Γ : Model.Context β}
+  {a b : Model.AExpr β} {witness : Certified.ConversionWitness β},
+  Certified.defeqCertified fuel n entries Γ a b witness = true → Model.ConversionClaim entries Γ a b
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2553
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.inferCertified_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel n : Nat} {entries : Model.Environment β} {Γ : Model.Context β}
+  {source : VExpr β} {witness : Certified.InferenceWitness β} {result : Certified.InferenceResult entries n Γ source},
+  Certified.inferCertified fuel n entries Γ source witness = some result →
+    result.reading.val.erase = source ∧
+      Model.AExpr.Scope n (List.length Γ) result.type ∧ Model.TypingClaim entries Γ result.reading.val result.type
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2610
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Operations,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.whnfCertified_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel n : Nat} {entries : Model.Environment β} {Γ : Model.Context β}
+  {source : VExpr β} {witness : Certified.WhnfWitness β} {result : Certified.WhnfResult entries n Γ source},
+  Certified.whnfCertified fuel n entries Γ source witness = some result →
+    ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+      Model.Realizes constants entries →
+        ∀ (levels : List Nat) (env : Nat → V),
+          Model.Context.Valid constants levels Γ env →
+            result.input.reading.val.erase = source ∧
+              Certified.whnfShape entries result.result = true ∧
+                Model.WellDenoted constants levels env result.input.reading.val ∧
+                  Model.WellDenoted constants levels env result.result ∧
+                    Model.interp constants levels env result.input.reading.val =
+                      Model.interp constants levels env result.result
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2632
+  project modules: [Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Operations,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.admitDefinition?_extends
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {state : Certified.AdmittedEnvironment signature store} {witness : Certified.DefinitionWitness β}
+  {result : { result // Certified.Extends signature state.entries result.entries }},
+  Certified.admitDefinition? fuel state witness = some result →
+    Certified.Extends signature state.entries result.val.entries
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 3145
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.checkStoreCertified
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (signature : Certified.PrimitiveSignature β) →
+        (store : Store β) →
+          (targets : List (ConstRef β)) →
+            List (Certified.DeclarationWitness β) → Option (Certified.CheckedStore signature store targets)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4954
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Store,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.accepted_store_has_model
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {targets : List (ConstRef β)} {witness : List (Certified.DeclarationWitness β)},
+  Certified.acceptsStoreCertified fuel signature store targets witness = true →
+    ∀ (V : Type v) [inst_1 : Model.SetTheory V],
+      ∃ result,
+        Certified.checkStoreCertified fuel signature store targets witness = some result ∧
+          ∃ constants,
+            signature.Compatible result.environment.entries constants ∧
+              ∀ (r : ConstRef β),
+                r ∈ targets →
+                  ∃ entry,
+                    result.environment.entries r = some entry ∧
+                      Certified.EntrySource signature store r entry ∧
+                        ∀ (levels : List Nat),
+                          levels.length = entry.universes →
+                            ∀ (env : Nat → V),
+                              Model.WellDenoted constants levels env entry.type ∧
+                                Model.SetTheory.Mem (constants r levels) (Model.interp constants levels env entry.type)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4958
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Store,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.EntrySource.header
+  type: ∀ {β : Type u} {signature : Certified.PrimitiveSignature β} {store : Store β} {ref : ConstRef β}
+  {entry : Model.ConstantEntry β},
+  Certified.EntrySource signature store ref entry → Certified.SourceHeader store ref entry
+  axioms: [propext, Quot.sound]
+  constants: 2123
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope]
+certified root Ix.Theory.Certified.CheckedStore.subject_sound
+  type: ∀ {β : Type u} {signature : Certified.PrimitiveSignature β} {store : Store β} {subjects : List (ConstRef β)}
+  (result : Certified.CheckedStore signature store subjects) {ref : ConstRef β},
+  ref ∈ subjects →
+    ∃ entry,
+      result.environment.entries ref = some entry ∧
+        Certified.SourceHeader store ref entry ∧
+          ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+            signature.Compatible result.environment.entries constants →
+              ∀ (levels : List Nat),
+                levels.length = entry.universes →
+                  ∀ (env : Nat → V),
+                    Model.WellDenoted constants levels env entry.type ∧
+                      Model.SetTheory.Mem (constants ref levels) (Model.interp constants levels env entry.type)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2252
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Store,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.accepted_store_source_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {subjects : List (ConstRef β)} {witness : List (Certified.DeclarationWitness β)},
+  Certified.acceptsStoreCertified fuel signature store subjects witness = true →
+    ∀ (V : Type v) [inst_1 : Model.SetTheory V],
+      ∃ result,
+        Certified.checkStoreCertified fuel signature store subjects witness = some result ∧
+          ∃ constants,
+            signature.Compatible result.environment.entries constants ∧
+              ∀ (ref : ConstRef β),
+                ref ∈ subjects →
+                  ∃ entry,
+                    result.environment.entries ref = some entry ∧
+                      Certified.SourceHeader store ref entry ∧
+                        ∀ (levels : List Nat),
+                          levels.length = entry.universes →
+                            ∀ (env : Nat → V),
+                              Model.WellDenoted constants levels env entry.type ∧
+                                Model.SetTheory.Mem (constants ref levels)
+                                  (Model.interp constants levels env entry.type)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4976
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Store,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.checkDeclarationExtensions?
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (state : Certified.CheckedInterface signature) →
+            List (Certified.DeclarationWitness β) → Option (Certified.CheckedExtension signature store state)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4897
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedExtension.admit
+  type: {β : Type u} →
+  {signature : Certified.PrimitiveSignature β} →
+    {store : Store β} →
+      (state : Certified.AdmittedEnvironment signature store) →
+        Certified.CheckedExtension signature store state.interface →
+          { result // Certified.Extends signature state.entries result.entries }
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2246
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.checkFrontier?_refs
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {witnesses : List (Certified.FrontierWitness β)}
+  {result : Certified.CheckedFrontier signature store},
+  Certified.checkFrontier? fuel signature store witnesses = some result →
+    result.refs = List.map (fun x => x.ref) witnesses
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2912
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedFrontier.compatible
+  type: ∀ {β : Type u} [inst : DecidableEq β] {signature : Certified.PrimitiveSignature β} {store : Store β}
+  (frontier : Certified.CheckedFrontier signature store) (provider : Certified.CheckedInterface signature),
+  (∀ (header : Certified.Signature.Header β),
+      header ∈ frontier.headers → Certified.HeaderPresent provider.entries header) →
+    ∀ (V : Type v) [inst_1 : Model.SetTheory V] (constants : Model.Assignment β V),
+      signature.Compatible provider.entries constants → signature.Compatible frontier.interface.entries constants
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 1213
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.ConditionalStore.subject_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {signature : Certified.PrimitiveSignature β} {store : Store β}
+  {subjects : List (ConstRef β)} (receipt : Certified.ConditionalStore signature store subjects) (V : Type v)
+  [inst_1 : Model.SetTheory V] (constants : Model.Assignment β V),
+  signature.Compatible receipt.frontier.interface.entries constants →
+    ∃ constants',
+      signature.Compatible receipt.checked.result.entries constants' ∧
+        Model.Assignment.AgreesOn receipt.frontier.interface.entries constants constants' ∧
+          ∀ (ref : ConstRef β),
+            ref ∈ subjects →
+              ∃ entry,
+                receipt.checked.result.entries ref = some entry ∧
+                  Certified.EntrySource signature store ref entry ∧
+                    Certified.SourceHeader store ref entry ∧
+                      ∀ (levels : List Nat),
+                        levels.length = entry.universes →
+                          ∀ (env : Nat → V),
+                            Model.WellDenoted constants' levels env entry.type ∧
+                              Model.SetTheory.Mem (constants' ref levels)
+                                (Model.interp constants' levels env entry.type)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2445
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.EntrySource.axiom_policy
+  type: ∀ {β : Type u} {signature : Certified.PrimitiveSignature β} {store : Store β} {ref : ConstRef β}
+  {entry : Model.ConstantEntry β} {n : Nat} {type : VExpr β} {safety : Safety},
+  Certified.EntrySource signature store ref entry →
+    store.lookup ref = some (Const.axiom n type safety) →
+      Certified.Standard.EntrySource store ref entry ∨ Certified.Quotient.EntrySource store ref entry
+  axioms: [propext, Quot.sound]
+  constants: 2111
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LogicalPolicy,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope]
+certified root Ix.Theory.Certified.ConditionalStore.logical_axioms_authorized
+  type: ∀ {β : Type u} [inst : DecidableEq β] {signature : Certified.PrimitiveSignature β} {store : Store β}
+  {subjects : List (ConstRef β)} (receipt : Certified.ConditionalStore signature store subjects) {ref : ConstRef β},
+  ref ∈ Certified.logicalAxioms store receipt.checked.result.entries →
+    ∃ entry,
+      receipt.checked.result.entries ref = some entry ∧
+        (Certified.Standard.EntrySource store ref entry ∨ Certified.Quotient.EntrySource store ref entry)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 2596
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LogicalPolicy,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ]
+certified root Ix.Theory.Certified.acceptsBatch
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Certified.PrimitiveSignature β →
+        Store β → List (Certified.FrontierWitness β) → List (Certified.ClaimNode β) → Bool
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5081
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.closed_has_model
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)}
+  (batch : Certified.CheckedBatch fuel signature store inputs),
+  batch.receipt.frontier.refs = [] →
+    ∀ (V : Type v) [inst_1 : Model.SetTheory V],
+      ∃ constants,
+        signature.Compatible batch.receipt.checked.result.entries constants ∧
+          ∀ (ref : ConstRef β),
+            ref ∈ Certified.nodeSubjects batch.nodes →
+              ∃ entry,
+                batch.receipt.checked.result.entries ref = some entry ∧
+                  Certified.SourceHeader store ref entry ∧
+                    ∀ (levels : List Nat),
+                      levels.length = entry.universes →
+                        ∀ (env : Nat → V),
+                          Model.SetTheory.Mem (constants ref levels) (Model.interp constants levels env entry.type)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5023
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.compatible_leaves
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)} (batch : Certified.CheckedBatch fuel signature store inputs)
+  (V : Type v) [inst_1 : Model.SetTheory V] (constants : Model.Assignment β V),
+  signature.Compatible batch.receipt.checked.result.entries constants →
+    ∀ {node : Certified.CheckedNode fuel signature store},
+      node ∈ batch.nodes → signature.Compatible node.receipt.frontier.interface.entries constants
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4993
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.frontier_coverage
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)} (batch : Certified.CheckedBatch fuel signature store inputs)
+  {ref : ConstRef β},
+  ref ∈ batch.receipt.frontier.refs ↔
+    (∃ node, node ∈ inputs ∧ ref ∈ List.map (fun x => x.ref) node.frontier) ∧
+      ¬∃ node, node ∈ inputs ∧ ref ∈ node.subjects
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5129
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.DependencyOrder.before
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {known : List (ConstRef β)} {nodes : List (Certified.CheckedNode fuel signature store)},
+  Certified.DependencyOrder known nodes →
+    ∀ {index : Nat} {node : Certified.CheckedNode fuel signature store},
+      nodes[index]? = some node →
+        ∀ {ref : ConstRef β},
+          ref ∈ node.receipt.frontier.refs →
+            ref ∈ known ∨
+              ∃ previous,
+                previous < index ∧ ∃ provider, nodes[previous]? = some provider ∧ ref ∈ provider.input.subjects
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4970
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.DependencyOrder.edge_for
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {known : List (ConstRef β)} {nodes : List (Certified.CheckedNode fuel signature store)},
+  Certified.DependencyOrder known nodes →
+    ∀ {consumer : Nat} {node : Certified.CheckedNode fuel signature store},
+      nodes[consumer]? = some node →
+        ∀ {ref : ConstRef β},
+          ref ∈ node.receipt.frontier.refs → ref ∈ known ∨ ∃ provider, Certified.DependencyEdge nodes provider consumer
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4993
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.acyclic
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)}
+  (batch : Certified.CheckedBatch fuel signature store inputs), WellFounded (Certified.DependencyEdge batch.nodes)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5080
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.no_circular_discharge
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)} (batch : Certified.CheckedBatch fuel signature store inputs)
+  {a b : Nat}, Certified.DependencyEdge batch.nodes a b → Certified.DependencyEdge batch.nodes b a → False
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5078
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.leaf_axiom_retained
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)} (batch : Certified.CheckedBatch fuel signature store inputs)
+  {node : Certified.CheckedNode fuel signature store},
+  node ∈ batch.nodes →
+    ∀ {ref : ConstRef β},
+      ref ∈ Certified.logicalAxioms store node.receipt.checked.result.entries → ref ∈ batch.logicalUses
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5040
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.LogicalPolicy,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.logicalUses_authorized
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)} (batch : Certified.CheckedBatch fuel signature store inputs)
+  {ref : ConstRef β},
+  ref ∈ batch.logicalUses →
+    ∃ entry, Certified.Standard.EntrySource store ref entry ∨ Certified.Quotient.EntrySource store ref entry
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5079
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.LogicalPolicy,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.checkBatch?_assoc
+  type: ∀ {β : Type u} [inst : DecidableEq β] (fuel : Nat) (signature : Certified.PrimitiveSignature β)
+  (store : Store β) (frontier : List (Certified.FrontierWitness β)) (a b c : List (Certified.ClaimNode β)),
+  Certified.acceptsBatch fuel signature store frontier (Certified.composeClaims (Certified.composeClaims a b) c) =
+    Certified.acceptsBatch fuel signature store frontier (Certified.composeClaims a (Certified.composeClaims b c))
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5084
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.CheckedBatch.no_False
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {inputs : List (Certified.ClaimNode β)}
+  (batch : Certified.CheckedBatch fuel signature store inputs),
+  batch.receipt.frontier.refs = [] →
+    ∀ {ref : ConstRef β},
+      ref ∈ Certified.nodeSubjects batch.nodes →
+        store.type ref = some signature.falseExpr → ∀ (V : Type v) [Model.SetTheory V], False
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 5028
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.ClaimComposition,
+ Ix.Theory.Certified.Claims,
+ Ix.Theory.Certified.Frontier,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Source,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.acceptsCertified
+  type: {β : Type u} →
+  [DecidableEq β] → Nat → Certified.PrimitiveSignature β → Certified.ProofInput β → Certified.ProofWitness β → Bool
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4969
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Accept,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.accepted_has_model
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {input : Certified.ProofInput β} {witness : Certified.ProofWitness β},
+  Certified.acceptsCertified fuel signature input witness = true →
+    ∀ (V : Type v) [inst_1 : Model.SetTheory V] (levels : List Nat) (env : Nat → V),
+      ∃ result,
+        Certified.checkProofCertified fuel signature input witness = some result ∧
+          ∃ constants,
+            signature.Compatible result.environment.entries constants ∧
+              Model.WellDenoted constants levels env result.proof.val ∧
+                Model.WellDenoted constants levels env result.proposition.val ∧
+                  Model.SetTheory.Mem (Model.interp constants levels env result.proof.val)
+                    (Model.interp constants levels env result.proposition.val)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4974
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Accept,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.accepted_proof_sound
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {input : Certified.ProofInput β} {witness : Certified.ProofWitness β},
+  Certified.acceptsCertified fuel signature input witness = true →
+    ∃ result,
+      Certified.checkProofCertified fuel signature input witness = some result ∧
+        ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+          signature.Compatible result.environment.entries constants →
+            ∀ (levels : List Nat) (env : Nat → V),
+              Model.SetTheory.Mem (Model.interp constants levels env result.proof.val)
+                (Model.interp constants levels env result.proposition.val)
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4974
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Accept,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.no_proof_of_False
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {input : Certified.ProofInput β} {witness : Certified.ProofWitness β} (V : Type v) [Model.SetTheory V],
+  input.proposition = signature.falseExpr → Certified.acceptsCertified fuel signature input witness = true → False
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4978
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Accept,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+certified root Ix.Theory.Certified.no_proof_of_empty
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {input : Certified.ProofInput β} {witness : Certified.ProofWitness β} (V : Type v) [inst_1 : Model.SetTheory V],
+  (∀ (result : Certified.CheckedProof signature input),
+      Certified.checkProofCertified fuel signature input witness = some result →
+        ∀ (constants : Model.Assignment β V),
+          signature.Compatible result.environment.entries constants →
+            Model.interp constants [] (fun x => Model.SetTheory.empty) result.proposition.val = Model.SetTheory.empty) →
+    Certified.acceptsCertified fuel signature input witness = true → False
+  axioms: [propext, Classical.choice, Quot.sound]
+  constants: 4975
+  project modules: [Ix.Theory.Const,
+ Ix.Theory.Expr,
+ Ix.Theory.Quot,
+ Ix.Theory.Ref,
+ Ix.Theory.Store,
+ Ix.Theory.VLevel,
+ Ix.Theory.Certified.Accept,
+ Ix.Theory.Certified.Admission,
+ Ix.Theory.Certified.Checker,
+ Ix.Theory.Certified.Level,
+ Ix.Theory.Certified.LevelEq,
+ Ix.Theory.Certified.Policy,
+ Ix.Theory.Certified.Prelude,
+ Ix.Theory.Certified.PropWhen,
+ Ix.Theory.Certified.Signature,
+ Ix.Theory.Certified.Telescope,
+ Ix.Theory.Inductive.Levels,
+ Ix.Theory.Model.Annotated,
+ Ix.Theory.Model.Context,
+ Ix.Theory.Model.Environment,
+ Ix.Theory.Model.Extension,
+ Ix.Theory.Model.Instantiation,
+ Ix.Theory.Model.Interpret,
+ Ix.Theory.Model.Judgment,
+ Ix.Theory.Model.PrimitiveValues,
+ Ix.Theory.Model.ReferenceMap,
+ Ix.Theory.Model.Signature,
+ Ix.Theory.Model.Support,
+ Ix.Theory.Model.TelescopeSemantics,
+ Ix.Theory.Model.Value,
+ Ix.Theory.Model.WellDenoted,
+ Ix.Theory.Certified.Basis.Equality,
+ Ix.Theory.Certified.Basis.Iff,
+ Ix.Theory.Certified.Basis.Interface,
+ Ix.Theory.Certified.Basis.Nonempty,
+ Ix.Theory.Certified.Modeled.Admission,
+ Ix.Theory.Certified.Modeled.Equation,
+ Ix.Theory.Certified.Modeled.Source,
+ Ix.Theory.Certified.Modeled.Transport,
+ Ix.Theory.Certified.Natural.Admission,
+ Ix.Theory.Certified.Natural.Checked,
+ Ix.Theory.Certified.Natural.Publish,
+ Ix.Theory.Certified.Natural.Value,
+ Ix.Theory.Certified.Ordinary.Admission,
+ Ix.Theory.Certified.Ordinary.Checked,
+ Ix.Theory.Certified.Ordinary.Computation,
+ Ix.Theory.Certified.Ordinary.ConstructorStage,
+ Ix.Theory.Certified.Ordinary.Constructors,
+ Ix.Theory.Certified.Ordinary.Container,
+ Ix.Theory.Certified.Ordinary.Eliminator,
+ Ix.Theory.Certified.Ordinary.Family,
+ Ix.Theory.Certified.Ordinary.LargeElim,
+ Ix.Theory.Certified.Ordinary.Reading,
+ Ix.Theory.Certified.Ordinary.RecursorReading,
+ Ix.Theory.Certified.Ordinary.RecursorStage,
+ Ix.Theory.Certified.Ordinary.RecursorSyntax,
+ Ix.Theory.Certified.Ordinary.RecursorValue,
+ Ix.Theory.Certified.Ordinary.RuleChecks,
+ Ix.Theory.Certified.Ordinary.RuleEquations,
+ Ix.Theory.Certified.Ordinary.RuleReading,
+ Ix.Theory.Certified.Ordinary.Shape,
+ Ix.Theory.Certified.Quotient.Admission,
+ Ix.Theory.Certified.Quotient.Checked,
+ Ix.Theory.Certified.Quotient.Publish,
+ Ix.Theory.Certified.Quotient.Reading,
+ Ix.Theory.Certified.Quotient.Syntax,
+ Ix.Theory.Certified.Quotient.Value,
+ Ix.Theory.Certified.Standard.Admission,
+ Ix.Theory.Certified.Standard.Checked,
+ Ix.Theory.Certified.Standard.Realization,
+ Ix.Theory.Certified.Structure.Admission,
+ Ix.Theory.Certified.Structure.Checked,
+ Ix.Theory.Certified.Structure.Computation,
+ Ix.Theory.Certified.Structure.Publish,
+ Ix.Theory.Certified.Structure.Reading,
+ Ix.Theory.Certified.Structure.Syntax,
+ Ix.Theory.Certified.Structure.Value,
+ Ix.Theory.Model.Inductive.Codes,
+ Ix.Theory.Model.Inductive.Container,
+ Ix.Theory.Model.Inductive.Recursor,
+ Ix.Theory.Model.Inductive.Telescope,
+ Ix.Theory.Model.SetModel.Container,
+ Ix.Theory.Model.SetModel.Iter,
+ Ix.Theory.Model.SetModel.Ops,
+ Ix.Theory.Model.SetModel.RecGraph,
+ Ix.Theory.Model.SetModel.TaggedSum,
+ Ix.Theory.Model.SetModel.TupleTower,
+ Ix.Theory.Model.SetTheory.Core,
+ Ix.Theory.Model.SetTheory.Derive.Choice,
+ Ix.Theory.Model.SetTheory.Derive.Empty,
+ Ix.Theory.Model.SetTheory.Derive.Graphs,
+ Ix.Theory.Model.SetTheory.Derive.Lfp,
+ Ix.Theory.Model.SetTheory.Derive.LfpFam,
+ Ix.Theory.Model.SetTheory.Derive.Omega,
+ Ix.Theory.Model.SetTheory.Derive.Pair,
+ Ix.Theory.Model.SetTheory.Derive.Pt,
+ Ix.Theory.Model.SetTheory.Derive.Quot,
+ Ix.Theory.Model.SetTheory.Derive.Sep,
+ Ix.Theory.Model.SetTheory.Derive.Sigma,
+ Ix.Theory.Model.SetTheory.Derive.Univ,
+ Ix.Theory.Model.SetTheory.Derive.Universe]
+premise definition Ix.Theory.Model.AExpr.mapRefs
+  type: {β : Type u} → {γ : Type v} → (ConstRef β → ConstRef γ) → Model.AExpr β → Model.AExpr γ
+  definition: fun {β} {γ} mapping x => Model.AExpr.brecOn x (Model.AExpr.mapRefs._f mapping)
+premise constructor Ix.Theory.Certified.Modeled.EquationWitness.mk
+  type: {β : Type u} →
+  Certified.Signature.RuleWitness β → Certified.Modeled.EquationProof β → Certified.Modeled.EquationWitness β
+premise constructor Ix.Theory.Certified.Modeled.EquationProof.propositional
+  type: {β : Type u} →
+  ConstRef β → ConstRef β → ConstRef β → Model.AExpr β → Certified.TypingWitness β → Certified.Modeled.EquationProof β
+premise constructor Ix.Theory.Certified.Modeled.CheckedEquation.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {rule : Certified.Signature.Rule β},
+  Certified.Signature.RuleFormed entries rule →
+    Model.ConversionClaim entries [] rule.lhs rule.rhs → Certified.Modeled.CheckedEquation entries rule
+premise definition Ix.Theory.Certified.Modeled.checkEquation?
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (rule : Certified.Signature.Rule β) →
+          Certified.Modeled.EquationWitness β →
+            Option (Certified.CheckedClaim (Certified.Modeled.CheckedEquation entries rule))
+  definition: fun {β} [DecidableEq β] fuel entries rule witness => do
+  let formed ← Certified.Signature.checkRule fuel entries rule witness.formation
+  match witness.proof with
+    | Certified.Modeled.EquationProof.conversion witness => do
+      let equality ← Certified.verifyConversion fuel rule.universes entries [] rule.lhs rule.rhs witness
+      pure { down := ⋯ }
+    | Certified.Modeled.EquationProof.propositional family reflexivity recursor proof typing =>
+      if hi : Certified.Basis.Equality.Interface entries family reflexivity recursor then do
+        let type ←
+          Certified.verifyType fuel rule.universes entries [] rule.type (Model.AExpr.sort witness.formation.level)
+              witness.formation.type
+        let checked ←
+          Certified.verifyType fuel rule.universes entries [] proof
+              (Certified.Basis.Equality.applied family witness.formation.level rule.type rule.lhs rule.rhs) typing
+        pure { down := ⋯ }
+      else none
+premise constructor Ix.Theory.Certified.Modeled.Companion.mk
+  type: {β : Type u} →
+  Certified.Signature.Header β → ConstRef β → List (Certified.Signature.Rule β) → Certified.Modeled.Companion β
+premise definition Ix.Theory.Certified.Modeled.Companion.entry
+  type: {β : Type u} → Certified.Modeled.Companion β → Model.ConstantEntry β
+  definition: fun {β} companion =>
+  { universes := companion.header.universes, type := companion.header.type, body := none,
+    equations := List.map (fun rule => { lhs := rule.lhs, rhs := rule.rhs }) companion.rules }
+premise definition Ix.Theory.Certified.Modeled.mapping
+  type: {β : Type u} → [DecidableEq β] → List (Certified.Modeled.Companion β) → ConstRef β → ConstRef β
+  definition: fun {β} [DecidableEq β] companions ref =>
+  match Certified.Modeled.lookupCompanion companions ref with
+  | none => ref
+  | some companion => companion.model
+premise constructor Ix.Theory.Certified.Modeled.CompanionChecked.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β}
+  {companions : List (Certified.Modeled.Companion β)} {companion : Certified.Modeled.Companion β},
+  (∃ entry,
+      entries companion.model = some entry ∧
+        entry.universes = companion.header.universes ∧
+          entry.type = Model.AExpr.mapRefs (Certified.Modeled.mapping companions) companion.header.type) →
+    Model.AExpr.Scope companion.header.universes 0 companion.header.type →
+      Model.AExpr.ReferencesIn (Certified.Modeled.environment entries companions) companion.header.type →
+        (∀ (rule : Certified.Signature.Rule β),
+            rule ∈ companion.rules →
+              rule.universes = companion.header.universes ∧
+                Model.AExpr.Scope companion.header.universes 0 rule.lhs ∧
+                  Model.AExpr.Scope companion.header.universes 0 rule.rhs) →
+          (∀ (rule : Certified.Signature.Rule β),
+              rule ∈ companion.rules →
+                Model.AExpr.ReferencesIn (Certified.Modeled.environment entries companions) rule.lhs ∧
+                  Model.AExpr.ReferencesIn (Certified.Modeled.environment entries companions) rule.rhs) →
+            (∀ (rule : Certified.Signature.Rule β),
+                rule ∈ companion.rules →
+                  Certified.Modeled.CheckedEquation entries (Certified.Modeled.mapRule companions rule)) →
+              Certified.Modeled.CompanionChecked entries companions companion
+premise constructor Ix.Theory.Certified.Modeled.CheckedCompanions.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β}
+  {companions : List (Certified.Modeled.Companion β)},
+  (List.map (fun x => x.header.ref) companions).Nodup →
+    (∀ (companion : Certified.Modeled.Companion β), companion ∈ companions → entries companion.header.ref = none) →
+      (∀ (companion : Certified.Modeled.Companion β),
+          companion ∈ companions → Certified.Modeled.CompanionChecked entries companions companion) →
+        Certified.Modeled.CheckedCompanions entries companions
+premise definition Ix.Theory.Certified.Modeled.checkCompanions?
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (companions : List (Certified.Modeled.Companion β)) →
+          List (List (Certified.Modeled.EquationWitness β)) →
+            Option (Certified.CheckedClaim (Certified.Modeled.CheckedCompanions entries companions))
+  definition: fun {β} [DecidableEq β] fuel entries companions witnesses =>
+  if hu : (List.map (fun x => x.header.ref) companions).Nodup then
+    if hf :
+        ∀ (companion : Certified.Modeled.Companion β), companion ∈ companions → entries companion.header.ref = none then
+      do
+      let checked ← Certified.Modeled.checkEach? fuel entries companions companions witnesses
+      pure { down := ⋯ }
+    else none
+  else none
+premise definition Ix.Theory.Certified.Modeled.assignment
+  type: {β : Type u} →
+  [DecidableEq β] → {V : Type v} → Model.Assignment β V → List (Certified.Modeled.Companion β) → Model.Assignment β V
+  definition: fun {β} [DecidableEq β] {V} constants companions ref levels =>
+  constants (Certified.Modeled.mapping companions ref) levels
+premise definition Ix.Theory.Certified.Modeled.SourceMatches
+  type: {β : Type u} → [DecidableEq β] → Store β → Certified.Modeled.Companion β → Prop
+  definition: fun {β} [DecidableEq β] store companion =>
+  store.type companion.header.ref = some companion.header.type.erase ∧
+    store.uvars companion.header.ref = some companion.header.universes ∧
+      Certified.Modeled.sourceRules? store companion.header.ref =
+        some (List.map Certified.Modeled.eraseRule companion.rules)
+premise definition Ix.Theory.Certified.Modeled.sourceRefs?
+  type: {β : Type u} → [DecidableEq β] → Store β → β → List (ConstRef β) → Option (List (ConstRef β))
+  definition: fun {β} [DecidableEq β] store source recursors => do
+  let families ← Certified.Modeled.sourceFamilies? store source
+  if recursors.length < families.length then none
+    else do
+      let majors ←
+        List.mapM
+            (fun ref => do
+              let info ← Certified.Modeled.recursorSource? store ref
+              let major ← Certified.Modeled.majorSource? store info
+              pure major.family)
+            recursors
+      if (List.take families.length majors != families) = true then none
+        else do
+          let members ←
+            List.mapM
+                (fun family => do
+                  let ctors ← Certified.Modeled.familyConstructors? store family
+                  pure (family :: ctors))
+                families
+          pure (members.flatten ++ recursors)
+premise definition Ix.Theory.Certified.Modeled.sourceRules?
+  type: {β : Type u} → [DecidableEq β] → Store β → ConstRef β → Option (List (Certified.Modeled.RawRule β))
+  definition: fun {β} [DecidableEq β] store ref =>
+  match ref with
+  | ConstRef.ctor block member c => do
+    let _ ← Certified.Modeled.familySource? store (ConstRef.member block member)
+    let ctor ← store.lookupCtor ref
+    if ctor.safety = Safety.safe then some [] else none
+  | ConstRef.member b i =>
+    match store.lookup ref with
+    | some (Const.induct uvars nparams nindices type ctors Safety.safe) => some []
+    | some (Const.recursor uvars nparams nindices nmotives nminors type rules k safety) =>
+      Certified.Modeled.recursorRules? store ref
+    | x => none
+premise definition Ix.Theory.Certified.Modeled.betaHead?
+  type: {β : Type u} → Nat → VExpr β → Option (VExpr β)
+  definition: fun {β} x x_1 =>
+  Nat.brecOn (motive := fun x => VExpr β → Option (VExpr β)) x Certified.Modeled.betaHead?._f x_1
+premise definition Ix.Theory.Certified.Modeled.majorSource?
+  type: {β : Type u} →
+  [DecidableEq β] → Store β → Certified.Modeled.RecursorSource β → Option (Certified.Modeled.MajorSource β)
+  definition: fun {β} [DecidableEq β] store source => do
+  let __x ← Certified.Modeled.splitPi? source.prefix source.type
+  match __x with
+    | (prefixDomains, tail) => do
+      let __x ← Certified.Modeled.splitPi? source.indices tail
+      match __x with
+        | (fst, major.forallE body) => do
+          let major ← Certified.Modeled.betaHead? 512 major
+          match major.appHead with
+            | VExpr.const family levels => do
+              let info ← Certified.Modeled.familySource? store family
+              if (info.indices != source.indices || levels.length != info.universes) = true then none
+                else
+                  have arguments := major.appArgs [];
+                  if (arguments.length != info.parameters + source.indices) = true then none
+                  else
+                    if (List.drop info.parameters arguments != VExpr.bvarRevRange 0 source.indices) = true then none
+                    else
+                      have actual := List.take info.parameters arguments;
+                      have parameters := List.map (fun p => p.unliftN source.indices 0) actual;
+                      if (List.map (fun x => VExpr.liftN source.indices x) parameters != actual) = true then none
+                      else
+                        pure
+                          { family := family, levels := levels, parameters := parameters,
+                            prefixDomains := prefixDomains }
+            | x => none
+        | x => none
+premise definition Ix.Theory.Certified.Modeled.ruleSource?
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Store β →
+      ConstRef β →
+        Certified.Modeled.RecursorSource β →
+          Certified.Modeled.MajorSource β → ConstRef β → Option (Certified.Modeled.RawRule β)
+  definition: fun {β} [DecidableEq β] store recursor source major constructor =>
+  match constructor with
+  | ConstRef.ctor block member c =>
+    if (major.family != ConstRef.member block member) = true then none
+    else do
+      let family ← Certified.Modeled.familySource? store major.family
+      let ctor ← store.lookupCtor constructor
+      if (ctor.safety != Safety.safe || ctor.uvars != family.universes || ctor.nparams != family.parameters) = true then
+          none
+        else
+          match store.ctorRuleIndex? constructor with
+          | some slot => do
+            let stored ← source.rules[slot]?
+            if (stored.nfields != ctor.nfields) = true then none
+              else do
+                let specialized ←
+                  Certified.Modeled.applyPi? (VExpr.liftN source.prefix (VExpr.instL major.levels ctor.type))
+                      major.parameters
+                let __x ← Certified.Modeled.splitPi? ctor.nfields specialized
+                match __x with
+                  | (fields, result) =>
+                    if (result.appHead != VExpr.const major.family major.levels) = true then none
+                    else
+                      have args := result.appArgs [];
+                      have parameters := List.map (fun x => VExpr.liftN ctor.nfields x) major.parameters;
+                      if
+                          (args.length != ctor.nparams + source.indices || List.take ctor.nparams args != parameters) =
+                            true then
+                        none
+                      else
+                        have constructorValue :=
+                          (VExpr.const constructor major.levels).appN (parameters ++ VExpr.bvarRevRange 0 ctor.nfields);
+                        have callArgs :=
+                          VExpr.bvarRevRange ctor.nfields source.prefix ++ List.drop ctor.nparams args ++
+                            [constructorValue];
+                        do
+                        let resultType ←
+                          Certified.Modeled.applyPi? (VExpr.liftN (source.prefix + ctor.nfields) source.type) callArgs
+                        have telescope : List (VExpr β) := major.prefixDomains ++ fields
+                        let _ ← Certified.Modeled.splitLam? telescope.length stored.rhs
+                        pure
+                            { universes := source.universes, type := VExpr.forallN telescope resultType,
+                              lhs :=
+                                VExpr.lamN telescope
+                                  ((VExpr.const recursor (List.map VLevel.param (List.range source.universes))).appN
+                                    callArgs),
+                              rhs := stored.rhs }
+          | x => none
+  | x => none
+premise constructor Ix.Theory.Certified.Modeled.Witness.mk
+  type: {β : Type u} →
+  β →
+    List (ConstRef β) →
+      List (Certified.Modeled.Companion β) →
+        List (List (Certified.Modeled.EquationWitness β)) → Certified.Modeled.Witness β
+premise constructor Ix.Theory.Certified.Modeled.Checked.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {witness : Certified.Modeled.Witness β},
+  Certified.Modeled.sourceRefs? store witness.source witness.recursors =
+      some (List.map (fun x => x.header.ref) witness.companions) →
+    (∀ (companion : Certified.Modeled.Companion β),
+        companion ∈ witness.companions → Certified.Modeled.SourceMatches store companion) →
+      Certified.Modeled.CheckedCompanions entries witness.companions → Certified.Modeled.Checked entries store witness
+premise definition Ix.Theory.Certified.Modeled.EntrySource
+  type: {β : Type u} → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} store ref entry =>
+  ∃ decision companion,
+    Certified.Modeled.SourceMatches store companion ∧ ref = companion.header.ref ∧ entry = companion.entry
+premise definition Ix.Theory.Model.Equinumerous
+  type: {V : Type u} → (V → V → Prop) → V → V → Prop
+  definition: fun {V} mem y u =>
+  ∃ f,
+    (∀ (z : V), mem z y → mem (f z) u) ∧
+      (∀ (z z' : V), mem z y → mem z' y → f z = f z' → z = z') ∧ ∀ (w : V), mem w u → ∃ z, mem z y ∧ f z = w
+premise definition Ix.Theory.Model.IsTGUniverse
+  type: {V : Type u} → (V → V → Prop) → V → Prop
+  definition: fun {V} mem u =>
+  (∀ (y z : V), mem y u → mem z y → mem z u) ∧
+    (∀ (y z : V), mem y u → (∀ (w : V), mem w z → mem w y) → mem z u) ∧
+      (∀ (y : V), mem y u → ∃ p, mem p u ∧ ∀ (z : V), (∀ (w : V), mem w z → mem w y) → mem z p) ∧
+        ∀ (y : V), (∀ (w : V), mem w y → mem w u) → Model.Equinumerous mem y u ∨ mem y u
+premise constructor Ix.Theory.Model.SetTheory.mk
+  type: {V : Type u} →
+  (Mem : V → V → Prop) →
+    (∀ {x y : V}, (∀ (z : V), Mem z x ↔ Mem z y) → x = y) →
+      (upair : V → V → V) →
+        (∀ {z a b : V}, Mem z (upair a b) ↔ z = a ∨ z = b) →
+          (sUnion : V → V) →
+            (∀ {z x : V}, Mem z (sUnion x) ↔ ∃ y, Mem y x ∧ Mem z y) →
+              (power : V → V) →
+                (∀ {z x : V}, Mem z (power x) ↔ ∀ (w : V), Mem w z → Mem w x) →
+                  (∀ (x : V), (∃ y, Mem y x) → ∃ y, Mem y x ∧ ¬∃ z, Mem z y ∧ Mem z x) →
+                    (image : (V → V) → V → V) →
+                      (∀ {f : V → V} {a z : V}, Mem z (image f a) ↔ ∃ w, Mem w a ∧ z = f w) →
+                        (univChain : Nat → V) →
+                          (∀ (n : Nat), Mem (univChain n) (univChain (n + 1))) →
+                            (∀ (n : Nat), Model.IsTGUniverse Mem (univChain n)) → Model.SetTheory V
+premise definition Ix.Theory.Model.AExpr.Scope
+  type: {β : Type u_1} → Nat → Nat → Model.AExpr β → Prop
+  definition: fun {β} universes depth x =>
+  Model.AExpr.brecOn (motive := fun x => Nat → Prop) x (Model.AExpr.Scope._f universes) depth
+premise definition Ix.Theory.Model.Reading
+  type: {β : Type u} → Nat → Nat → VExpr β → Type (max 0 u)
+  definition: fun {β} n k source => { e // e.erase = source ∧ Model.AExpr.Scope n k e }
+premise constructor Ix.Theory.Certified.DefinitionReading.mk
+  type: {β : Type u} →
+  (universes : Nat) →
+    Ix.Theory.DefKind →
+      (type body : Model.AExpr β) →
+        Model.AExpr.Scope universes 0 type → Model.AExpr.Scope universes 0 body → Certified.DefinitionReading β
+premise constructor Ix.Theory.Certified.PrimitiveSignature.mk
+  type: {β : Type u} →
+  (falseType falseElim : ConstRef β) → falseType ≠ falseElim → Option (ConstRef β) → Certified.PrimitiveSignature β
+premise constructor Ix.Theory.Certified.CheckedStore.mk
+  type: {β : Type u} →
+  {signature : Certified.PrimitiveSignature β} →
+    {store : Store β} →
+      {targets : List (ConstRef β)} →
+        (environment : Certified.AdmittedEnvironment signature store) →
+          (∀ (r : ConstRef β), r ∈ targets → (environment.entries r).isSome = true) →
+            Certified.CheckedStore signature store targets
+premise constructor Ix.Theory.Certified.SourceHeader.mk
+  type: ∀ {β : Type u} {store : Store β} {ref : ConstRef β} {entry : Model.ConstantEntry β},
+  store.type ref = some entry.type.erase →
+    store.uvars ref = some entry.universes → Certified.SourceHeader store ref entry
+premise constructor Ix.Theory.Certified.CheckedInterface.mk
+  type: {β : Type u} →
+  {signature : Certified.PrimitiveSignature β} →
+    (entries : Model.Environment β) → entries.WF → signature.Present entries → Certified.CheckedInterface signature
+premise constructor Ix.Theory.Certified.CheckedExtension.mk
+  type: {β : Type u} →
+  {signature : Certified.PrimitiveSignature β} →
+    {store : Store β} →
+      {input : Certified.CheckedInterface signature} →
+        (result : Certified.CheckedInterface signature) →
+          Certified.Extends signature input.entries result.entries →
+            (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+                result.entries r = some entry →
+                  input.entries r = some entry ∨ Certified.EntrySource signature store r entry) →
+              Certified.CheckedExtension signature store input
+premise constructor Ix.Theory.Certified.FrontierWitness.mk
+  type: {β : Type u} →
+  ConstRef β → Model.AnnotationTree → VLevel → Certified.TypingWitness β → Certified.FrontierWitness β
+premise constructor Ix.Theory.Certified.FrontierHeader.mk
+  type: {β : Type u} →
+  {store : Store β} →
+    (header : Certified.Signature.Header β) →
+      Certified.SourceHeader store header.ref header.entry →
+        Certified.deferredSource store header.ref = true → Certified.FrontierHeader store
+premise definition Ix.Theory.Certified.deferredSource
+  type: {β : Type u} → Store β → ConstRef β → Bool
+  definition: fun {β} store ref =>
+  match store.lookup ref with
+  | some (Const.defn uvars kind type value Safety.safe) => true
+  | some (Const.induct uvars nparams nindices type ctors Safety.safe) => true
+  | some (Const.recursor uvars nparams nindices nmotives nminors type rules k Safety.safe) => true
+  | some val => false
+  | none =>
+    match store.lookupCtor ref with
+    | some ctor => ctor.safety == Safety.safe
+    | none => false
+premise constructor Ix.Theory.Certified.CheckedFrontier.mk
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {signature : Certified.PrimitiveSignature β} →
+      {store : Store β} →
+        (readings : List (Certified.FrontierHeader store)) →
+          signature.validate store = true →
+            Certified.Signature.Formed signature.environment (List.map (fun x => x.header) readings) →
+              Certified.CheckedFrontier signature store
+premise definition Ix.Theory.Certified.CheckedFrontier.interface
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {signature : Certified.PrimitiveSignature β} →
+      {store : Store β} → Certified.CheckedFrontier signature store → Certified.CheckedInterface signature
+  definition: fun {β} [DecidableEq β] {signature} {store} frontier =>
+  { entries := Certified.Signature.environment signature.environment frontier.headers, wf := ⋯, present := ⋯ }
+premise definition Ix.Theory.Certified.HeaderPresent
+  type: {β : Type u} → Model.Environment β → Certified.Signature.Header β → Prop
+  definition: fun {β} entries header =>
+  match entries header.ref with
+  | none => False
+  | some entry => entry.universes = header.universes ∧ entry.type = header.type
+premise constructor Ix.Theory.Certified.ConditionalStore.mk
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {signature : Certified.PrimitiveSignature β} →
+      {store : Store β} →
+        {subjects : List (ConstRef β)} →
+          (frontier : Certified.CheckedFrontier signature store) →
+            (checked : Certified.CheckedExtension signature store frontier.interface) →
+              (∀ (r : ConstRef β), r ∈ subjects → frontier.interface.entries r = none) →
+                (∀ (r : ConstRef β), r ∈ subjects → (checked.result.entries r).isSome = true) →
+                  Certified.ConditionalStore signature store subjects
+premise constructor Ix.Theory.Certified.ClaimNode.mk
+  type: {β : Type u} →
+  List (ConstRef β) → List (Certified.FrontierWitness β) → List (Certified.DeclarationWitness β) → Certified.ClaimNode β
+premise constructor Ix.Theory.Certified.CheckedNode.mk
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (input : Certified.ClaimNode β) →
+            (receipt : Certified.ConditionalStore signature store input.subjects) →
+              Certified.checkConditionalStore? fuel signature store input.frontier input.subjects input.declarations =
+                  some receipt →
+                Certified.CheckedNode fuel signature store
+premise constructor Ix.Theory.Certified.ReplayResult.mk
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          {state : Certified.CheckedInterface signature} →
+            {known : List (ConstRef β)} →
+              {nodes : List (Certified.CheckedNode fuel signature store)} →
+                (checked : Certified.CheckedExtension signature store state) →
+                  Certified.DependencyOrder known nodes →
+                    (∀ (ref : ConstRef β),
+                        ref ∈ Certified.nodeSubjects nodes → (checked.result.entries ref).isSome = true) →
+                      (∀ (node : Certified.CheckedNode fuel signature store),
+                          node ∈ nodes →
+                            ∀ (header : Certified.Signature.Header β),
+                              header ∈ node.receipt.frontier.headers →
+                                Certified.HeaderPresent checked.result.entries header) →
+                        Certified.ReplayResult state known nodes
+premise constructor Ix.Theory.Certified.CheckedBatch.mk
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          {inputs : List (Certified.ClaimNode β)} →
+            (nodes : List (Certified.CheckedNode fuel signature store)) →
+              List.map (fun x => x.input) nodes = inputs →
+                (receipt : Certified.ConditionalStore signature store (Certified.nodeSubjects nodes)) →
+                  (∀ (ref : ConstRef β), ref ∈ receipt.frontier.refs ↔ ref ∈ Certified.outstanding nodes) →
+                    Certified.DependencyOrder (receipt.frontier.refs ++ [signature.falseType, signature.falseElim])
+                        nodes →
+                      (∀ (node : Certified.CheckedNode fuel signature store),
+                          node ∈ nodes →
+                            ∀ (header : Certified.Signature.Header β),
+                              header ∈ node.receipt.frontier.headers →
+                                Certified.HeaderPresent receipt.checked.result.entries header) →
+                        Certified.CheckedBatch fuel signature store inputs
+premise constructor Ix.Theory.Certified.DependencyOrder.nil
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} (known : List (ConstRef β)), Certified.DependencyOrder known []
+premise constructor Ix.Theory.Certified.DependencyOrder.cons
+  type: ∀ {β : Type u} [inst : DecidableEq β] {fuel : Nat} {signature : Certified.PrimitiveSignature β}
+  {store : Store β} {known : List (ConstRef β)} {node : Certified.CheckedNode fuel signature store}
+  {rest : List (Certified.CheckedNode fuel signature store)},
+  (∀ (ref : ConstRef β), ref ∈ node.receipt.frontier.refs → ref ∈ known) →
+    Certified.DependencyOrder (known ++ node.input.subjects) rest → Certified.DependencyOrder known (node :: rest)
+premise definition Ix.Theory.Certified.DependencyEdge
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} → List (Certified.CheckedNode fuel signature store) → Nat → Nat → Prop
+  definition: fun {β} [DecidableEq β] {fuel} {signature} {store} nodes provider consumer =>
+  ∃ a b ref,
+    nodes[provider]? = some a ∧
+      nodes[consumer]? = some b ∧
+        ref ∈ a.input.subjects ∧
+          ref ∈ b.receipt.frontier.refs ∧
+            ∀ (previous : Nat),
+              previous < provider →
+                ∀ (other : Certified.CheckedNode fuel signature store),
+                  nodes[previous]? = some other → ¬ref ∈ other.input.subjects
+premise definition Ix.Theory.Certified.outstanding
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} → List (Certified.CheckedNode fuel signature store) → List (ConstRef β)
+  definition: fun {β} [DecidableEq β] {fuel} {signature} {store} nodes =>
+  (List.filter (fun ref => !(Certified.nodeSubjects nodes).contains ref) (Certified.nodeFrontiers nodes)).eraseDups
+premise definition Ix.Theory.Certified.logicalAxioms
+  type: {β : Type u} → Store β → Model.Environment β → List (ConstRef β)
+  definition: fun {β} store entries =>
+  List.filter (fun ref => Certified.isLogicalAxiom store ref && (entries ref).isSome) (Certified.sourceMembers store)
+premise definition Ix.Theory.Certified.CheckedBatch.logicalUses
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          {inputs : List (Certified.ClaimNode β)} →
+            Certified.CheckedBatch fuel signature store inputs → List (ConstRef β)
+  definition: fun {β} [DecidableEq β] {fuel} {signature} {store} {inputs} batch =>
+  (Certified.logicalAxioms store batch.receipt.checked.result.entries ++
+      List.flatMap (fun node => Certified.logicalAxioms store node.receipt.checked.result.entries)
+        batch.nodes).eraseDups
+premise definition Ix.Theory.Model.WellDenoted
+  type: {β : Type u} →
+  {V : Type v} → [Model.SetTheory V] → Model.Assignment β V → List Nat → (Nat → V) → Model.AExpr β → Prop
+  definition: fun {β} {V} [Model.SetTheory V] constants levels env x =>
+  Model.AExpr.brecOn (motive := fun x => (Nat → V) → Prop) x (Model.WellDenoted._f constants levels) env
+premise definition Ix.Theory.Model.Context.Valid
+  type: {β : Type u} →
+  {V : Type v} → [Model.SetTheory V] → Model.Assignment β V → List Nat → Model.Context β → (Nat → V) → Prop
+  definition: fun {β} {V} [Model.SetTheory V] constants levels Γ env =>
+  ∀ (i : Nat) (A : Model.AExpr β),
+    Γ[i]? = some A →
+      Model.WellDenoted constants levels env A ∧ Model.SetTheory.Mem (env i) (Model.interp constants levels env A)
+premise definition Ix.Theory.Model.TypingClaim
+  type: {β : Type u} → Model.Environment β → Model.Context β → Model.AExpr β → Model.AExpr β → Prop
+  definition: fun {β} entries Γ e A =>
+  ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+    Model.Realizes constants entries →
+      ∀ (levels : List Nat) (env : Nat → V),
+        Model.Context.Valid constants levels Γ env →
+          Model.WellDenoted constants levels env e ∧
+            Model.WellDenoted constants levels env A ∧
+              Model.SetTheory.Mem (Model.interp constants levels env e) (Model.interp constants levels env A)
+premise definition Ix.Theory.Model.ConversionClaim
+  type: {β : Type u} → Model.Environment β → Model.Context β → Model.AExpr β → Model.AExpr β → Prop
+  definition: fun {β} entries Γ a b =>
+  ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+    Model.Realizes constants entries →
+      ∀ (levels : List Nat) (env : Nat → V),
+        Model.Context.Valid constants levels Γ env →
+          Model.interp constants levels env a = Model.interp constants levels env b
+premise constructor Ix.Theory.Model.ConstantEntry.mk
+  type: {β : Type u} →
+  Nat →
+    Model.AExpr β →
+      Option (Model.AExpr β) → List (Model.ConstantEquation β) → List (Model.ConstantFact β) → Model.ConstantEntry β
+premise constructor Ix.Theory.Model.Realizes.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {entries : Model.Environment β},
+  (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+      entries r = some entry →
+        ∀ (levels : List Nat),
+          levels.length = entry.universes → ∀ (env : Nat → V), Model.WellDenoted constants levels env entry.type) →
+    (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+        entries r = some entry →
+          ∀ (levels : List Nat),
+            levels.length = entry.universes →
+              ∀ (env : Nat → V),
+                Model.SetTheory.Mem (constants r levels) (Model.interp constants levels env entry.type)) →
+      (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+          entries r = some entry →
+            ∀ (body : Model.AExpr β),
+              entry.body = some body →
+                ∀ (levels : List Nat),
+                  levels.length = entry.universes → ∀ (env : Nat → V), Model.WellDenoted constants levels env body) →
+        (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+            entries r = some entry →
+              ∀ (body : Model.AExpr β),
+                entry.body = some body →
+                  ∀ (levels : List Nat),
+                    levels.length = entry.universes →
+                      ∀ (env : Nat → V), constants r levels = Model.interp constants levels env body) →
+          (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+              entries r = some entry →
+                ∀ (equation : Model.ConstantEquation β),
+                  equation ∈ entry.equations →
+                    ∀ (levels : List Nat),
+                      levels.length = entry.universes →
+                        ∀ (env : Nat → V),
+                          Model.interp constants levels env equation.lhs =
+                            Model.interp constants levels env equation.rhs) →
+            (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+                entries r = some entry →
+                  ∀ (fact : Model.ConstantFact β),
+                    fact ∈ entry.facts →
+                      ∀ (levels : List Nat),
+                        levels.length = entry.universes →
+                          ∀ (env : Nat → V), Model.ConstantFact.Meaning constants r levels env fact) →
+              Model.Realizes constants entries
+premise constructor Ix.Theory.Model.ConstantEquation.mk
+  type: {β : Type u} → Model.AExpr β → Model.AExpr β → Model.ConstantEquation β
+premise constructor Ix.Theory.Model.ConstantFact.typed
+  type: {β : Type u} → Model.AExpr β → Model.AExpr β → Model.ConstantFact β
+premise constructor Ix.Theory.Model.ConstantFact.natural
+  type: {β : Type u} → ConstRef β → ConstRef β → Model.ConstantFact β
+premise definition Ix.Theory.Model.ConstantFact.Meaning
+  type: {β : Type u} →
+  {V : Type v} →
+    [Model.SetTheory V] → Model.Assignment β V → ConstRef β → List Nat → (Nat → V) → Model.ConstantFact β → Prop
+  definition: fun {β} {V} [Model.SetTheory V] constants owner levels env x =>
+  match x with
+  | Model.ConstantFact.typed e type =>
+    Model.WellDenoted constants levels env e ∧
+      Model.WellDenoted constants levels env type ∧
+        Model.SetTheory.Mem (Model.interp constants levels env e) (Model.interp constants levels env type)
+  | Model.ConstantFact.natural zero succ => levels = [] ∧ Model.NaturalMeaning constants owner zero succ
+premise definition Ix.Theory.Model.ConstantFact.Scope
+  type: {β : Type u} → Nat → Model.ConstantFact β → Prop
+  definition: fun {β} n x =>
+  match x with
+  | Model.ConstantFact.typed e type => Model.AExpr.Scope n 0 e ∧ Model.AExpr.Scope n 0 type
+  | Model.ConstantFact.natural zero succ => n = 0
+premise definition Ix.Theory.Model.ConstantFact.ReferencesIn
+  type: {β : Type u} → Model.Environment β → Model.ConstantFact β → Prop
+  definition: fun {β} entries fact => ∀ (r : ConstRef β), r ∈ fact.references → (entries r).isSome = true
+premise constructor Ix.Theory.Model.NaturalMeaning.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {family zero succ : ConstRef β},
+  (∀ (n : Nat), Model.SetTheory.Mem (Model.Numeral.value n) (constants family [])) →
+    constants zero [] = Model.Numeral.value 0 →
+      (∀ (n : Nat), Model.SetTheory.app (constants succ []) (Model.Numeral.value n) = Model.Numeral.value (n + 1)) →
+        Model.NaturalMeaning constants family zero succ
+premise definition Ix.Theory.Model.projectValue
+  type: {V : Type u} → [Model.SetTheory V] → Nat → V → V
+  definition: fun {V} [Model.SetTheory V] field value =>
+  Model.SetTheory.Tower.projS field (Model.SetTheory.ssnd (Model.SetTheory.sfst value))
+premise definition Ix.Theory.Model.Numeral.zero
+  type: {V : Type u} → [Model.SetTheory V] → V
+  definition: fun {V} [Model.SetTheory V] =>
+  Model.SetTheory.spair (Model.SetTheory.Tower.inj 0 Model.SetTheory.pt) Model.SetTheory.empty
+premise definition Ix.Theory.Model.Numeral.succ
+  type: {V : Type u} → [Model.SetTheory V] → V → V
+  definition: fun {V} [Model.SetTheory V] n =>
+  Model.SetTheory.spair (Model.SetTheory.Tower.inj 1 Model.SetTheory.pt)
+    (Model.SetTheory.graph (fun x => n) (Model.SetTheory.sing (Model.SetTheory.Tower.inj 0 Model.SetTheory.pt)))
+premise definition Ix.Theory.Model.Numeral.value
+  type: {V : Type u} → [Model.SetTheory V] → Nat → V
+  definition: fun {V} [Model.SetTheory V] x => Nat.brecOn x Model.Numeral.value._f
+premise constructor Ix.Theory.Model.Environment.WF.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β},
+  (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+      entries r = some entry → Model.AExpr.Scope entry.universes 0 entry.type) →
+    (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+        entries r = some entry →
+          ∀ (body : Model.AExpr β), entry.body = some body → Model.AExpr.Scope entry.universes 0 body) →
+      (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+          entries r = some entry → Model.AExpr.ReferencesIn entries entry.type) →
+        (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+            entries r = some entry →
+              ∀ (body : Model.AExpr β), entry.body = some body → Model.AExpr.ReferencesIn entries body) →
+          (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+              entries r = some entry →
+                ∀ (equation : Model.ConstantEquation β),
+                  equation ∈ entry.equations →
+                    Model.AExpr.Scope entry.universes 0 equation.lhs ∧
+                      Model.AExpr.Scope entry.universes 0 equation.rhs) →
+            (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+                entries r = some entry →
+                  ∀ (equation : Model.ConstantEquation β),
+                    equation ∈ entry.equations →
+                      Model.AExpr.ReferencesIn entries equation.lhs ∧ Model.AExpr.ReferencesIn entries equation.rhs) →
+              (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+                  entries r = some entry →
+                    ∀ (fact : Model.ConstantFact β),
+                      fact ∈ entry.facts → Model.ConstantFact.Scope entry.universes fact) →
+                (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+                    entries r = some entry →
+                      ∀ (fact : Model.ConstantFact β),
+                        fact ∈ entry.facts → Model.ConstantFact.ReferencesIn entries fact) →
+                  entries.WF
+premise definition Ix.Theory.Model.Assignment.AgreesOn
+  type: {β : Type u} → {V : Type u_1} → Model.Environment β → Model.Assignment β V → Model.Assignment β V → Prop
+  definition: fun {β} {V} entries constants constants' =>
+  ∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+    entries r = some entry → ∀ (levels : List Nat), constants' r levels = constants r levels
+premise constructor Ix.Theory.Model.IndexedContainer.mk
+  type: {V : Type u} → V → (V → V) → (V → V) → (V → V → V) → Model.IndexedContainer V
+premise constructor Ix.Theory.Model.IndexedContainer.WF.mk
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {D : Model.IndexedContainer V} {w : Nat},
+  (w ≠ 0 → ∀ (i : V), Model.SetTheory.Mem i D.indices → Model.SetTheory.Mem (D.shapes i) (Model.SetTheory.univ w)) →
+    (w ≠ 0 →
+        ∀ (i a : V),
+          Model.SetTheory.Mem i D.indices →
+            Model.SetTheory.Mem a (D.shapes i) → Model.SetTheory.Mem (D.positions a) (Model.SetTheory.univ w)) →
+      (∀ (i a p : V),
+          Model.SetTheory.Mem i D.indices →
+            Model.SetTheory.Mem a (D.shapes i) →
+              Model.SetTheory.Mem p (D.positions a) → Model.SetTheory.Mem (D.target a p) D.indices) →
+        D.WF w
+premise definition Ix.Theory.Model.IndexedContainer.LargeElim
+  type: {V : Type u} → [Model.SetTheory V] → Model.IndexedContainer V → Nat → Prop
+  definition: fun {V} [Model.SetTheory V] D w =>
+  w = 0 →
+    ∀ (i : V),
+      Model.SetTheory.Mem i D.indices →
+        ∀ (a b : V), Model.SetTheory.Mem a (D.shapes i) → Model.SetTheory.Mem b (D.shapes i) → a = b
+premise definition Ix.Theory.Model.IndexedContainer.AlgebraTyping
+  type: {V : Type u} → [Model.SetTheory V] → Model.IndexedContainer V → Nat → (V → V → V) → (V → V → V → V → V) → Prop
+  definition: fun {V} [Model.SetTheory V] D w M algebra =>
+  ∀ (i : V),
+    Model.SetTheory.Mem i D.indices →
+      ∀ (a : V),
+        Model.SetTheory.Mem a (D.shapes i) →
+          ∀ (g : V),
+            Model.SetTheory.Mem g
+                (Model.SetTheory.piSet (D.positions a) fun p => Model.SetTheory.app (D.carrier w) (D.target a p)) →
+              ∀ (ih : V),
+                Model.SetTheory.Mem ih
+                    (Model.SetTheory.piSet (D.positions a) fun p => M (D.target a p) (Model.SetTheory.app g p)) →
+                  Model.SetTheory.Mem (algebra i a g ih) (M i (Model.IndexedContainer.node w a g))
+premise definition Ix.Theory.Certified.TelescopeBound
+  type: {β : Type u} → Model.Environment β → Model.Context β → List (Model.AExpr β) → Option VLevel → Prop
+  definition: fun {β} entries Γ domains bound =>
+  ∀ (w : VLevel),
+    bound = some w →
+      ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+        Model.Realizes constants entries →
+          ∀ (levels : List Nat) (env : Nat → V),
+            Model.Context.Valid constants levels Γ env →
+              VLevel.eval levels w ≠ 0 →
+                Model.SetTheory.Tower.BoundS (VLevel.eval levels w)
+                  (Model.Telescope.interpret constants levels env domains)
+premise definition Ix.Theory.Certified.TelescopeProp
+  type: {β : Type u} → Model.Environment β → Model.Context β → List (Model.AExpr β) → VLevel → Prop
+  definition: fun {β} entries Γ domains atLevel =>
+  ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+    Model.Realizes constants entries →
+      ∀ (levels : List Nat) (env : Nat → V),
+        Model.Context.Valid constants levels Γ env →
+          VLevel.eval levels atLevel = 0 →
+            Model.SetTheory.Tower.PropS (Model.Telescope.interpret constants levels env domains)
+premise definition Ix.Theory.Certified.ArgumentsFit
+  type: {β : Type u} → Model.Environment β → Model.Context β → List (Model.AExpr β) → List (Model.AExpr β) → Prop
+  definition: fun {β} entries Γ domains args =>
+  ∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+    Model.Realizes constants entries →
+      ∀ (levels : List Nat) (env : Nat → V),
+        Model.Context.Valid constants levels Γ env →
+          Model.SetTheory.Tower.FitsS (Model.Telescope.interpret constants levels env domains)
+            (List.map (Model.interp constants levels env) args)
+premise constructor Ix.Theory.Certified.Ordinary.Shape.mk
+  type: {β : Type u} →
+  Nat →
+    List (Model.AExpr β) →
+      List (Model.AExpr β) → VLevel → List (Certified.Ordinary.Constructor β) → Certified.Ordinary.Shape β
+premise constructor Ix.Theory.Certified.Ordinary.Constructor.mk
+  type: {β : Type u} →
+  List (Model.AExpr β) →
+    List (Certified.Ordinary.RecursiveField β) → List (Model.AExpr β) → Certified.Ordinary.Constructor β
+premise constructor Ix.Theory.Certified.Ordinary.RecursiveField.mk
+  type: {β : Type u} → List (Model.AExpr β) → List (Model.AExpr β) → Certified.Ordinary.RecursiveField β
+premise constructor Ix.Theory.Certified.Ordinary.CheckedShape.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {store : Store β} {source : β}
+  {shape : Certified.Ordinary.Shape β},
+  store.blocks source = some { members := [shape.source source] } →
+    (∀ (r : ConstRef β), r ∈ shape.references source → entries r = none) →
+      (∀ (e : Model.AExpr β), e ∈ shape.parameters ++ shape.indices → Model.AExpr.ReferencesIn entries e) →
+        Model.AExpr.Scope shape.universes 0 shape.type →
+          (∀ (ctor : Certified.Ordinary.Constructor β),
+              ctor ∈ shape.constructors → Model.AExpr.Scope shape.universes 0 (ctor.type shape source)) →
+            Model.Telescope.Formed entries [] shape.parameters →
+              Model.Telescope.Formed entries shape.parameterContext shape.indices →
+                (∀ (ctor : Certified.Ordinary.Constructor β),
+                    ctor ∈ shape.constructors → Certified.Ordinary.ConstructorEvidence entries shape ctor) →
+                  Certified.Ordinary.CheckedShape entries store source shape
+premise definition Ix.Theory.Certified.Ordinary.ConstructorEvidence
+  type: {β : Type u} → Model.Environment β → Certified.Ordinary.Shape β → Certified.Ordinary.Constructor β → Prop
+  definition: fun {β} entries shape ctor =>
+  (∀ (e : Model.AExpr β), e ∈ ctor.fields ++ ctor.indices → Model.AExpr.ReferencesIn entries e) ∧
+    Model.Telescope.Formed entries shape.parameterContext ctor.fields ∧
+      Certified.TelescopeBound entries shape.parameterContext ctor.fields (some shape.level) ∧
+        Certified.ArgumentsFit entries (ctor.context shape) (Model.Telescope.lift ctor.fields.length shape.indices)
+            ctor.indices ∧
+          ∀ (field : Certified.Ordinary.RecursiveField β),
+            field ∈ ctor.recursive → Certified.Ordinary.RecursiveEvidence entries shape ctor field
+premise definition Ix.Theory.Certified.Ordinary.RecursiveEvidence
+  type: {β : Type u} →
+  Model.Environment β →
+    Certified.Ordinary.Shape β → Certified.Ordinary.Constructor β → Certified.Ordinary.RecursiveField β → Prop
+  definition: fun {β} entries shape ctor field =>
+  (∀ (e : Model.AExpr β), e ∈ field.domains ++ field.indices → Model.AExpr.ReferencesIn entries e) ∧
+    Model.Telescope.Formed entries (ctor.context shape) field.domains ∧
+      Certified.TelescopeBound entries (ctor.context shape) field.domains (some shape.level) ∧
+        Certified.ArgumentsFit entries (Model.Telescope.context (ctor.context shape) field.domains)
+          (Model.Telescope.lift (ctor.fields.length + field.domains.length) shape.indices) field.indices
+premise definition Ix.Theory.Certified.Ordinary.LargeEvidence
+  type: {β : Type u} → Model.Environment β → Certified.Ordinary.Shape β → Prop
+  definition: fun {β} entries shape =>
+  (∀ (levels : List Nat), VLevel.eval levels shape.level ≠ 0) ∨
+    shape.constructors = [] ∨
+      ∃ ctor,
+        shape.constructors = [ctor] ∧ Certified.TelescopeProp entries shape.parameterContext ctor.fields shape.level
+premise definition Ix.Theory.Certified.Ordinary.Shape.container
+  type: {β : Type u} →
+  {V : Type v} →
+    [Model.SetTheory V] →
+      Certified.Ordinary.Shape β → Model.Assignment β V → List Nat → (Nat → V) → Model.IndexedContainer V
+  definition: fun {β} {V} [Model.SetTheory V] shape constants levels env =>
+  { indices := shape.indexSet constants levels env,
+    shapes := fun i =>
+      Model.SetTheory.sep (shape.allShapes constants levels env) fun a => shape.resultIndex constants levels env a = i,
+    positions := shape.positions constants levels env, target := shape.targetIndex constants levels env }
+premise constructor Ix.Theory.Certified.Ordinary.FamilyReading.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source : β} {constants reading : Model.Assignment β V},
+  Model.Assignment.AgreesOn entries constants reading →
+    (∀ (levels : List Nat),
+        levels.length = shape.universes →
+          reading (ConstRef.member source 0) levels = shape.familyValue constants levels) →
+      Certified.Ordinary.FamilyReading entries shape source constants reading
+premise constructor Ix.Theory.Certified.Ordinary.ConstructorReading.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source : β} {constants reading : Model.Assignment β V},
+  Certified.Ordinary.FamilyReading entries shape source constants reading →
+    (∀ (levels : List Nat),
+        levels.length = shape.universes →
+          ∀ (i : Nat) (ctor : Certified.Ordinary.Constructor β),
+            shape.constructors[i]? = some ctor →
+              reading (ConstRef.ctor source 0 i) levels = shape.constructorClosedValue constants levels i ctor) →
+      Certified.Ordinary.ConstructorReading entries shape source constants reading
+premise constructor Ix.Theory.Certified.Ordinary.RecursorReading.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {entries : Model.Environment β}
+  {shape : Certified.Ordinary.Shape β} {source recursor : β} {mode : Inductive.ElimMode}
+  {constants reading : Model.Assignment β V},
+  Certified.Ordinary.ConstructorReading entries shape source constants reading →
+    (∀ (levels : List Nat),
+        levels.length = mode.recUvars shape.universes →
+          reading (ConstRef.member recursor 0) levels = shape.closedRecursorValue constants levels mode) →
+      Certified.Ordinary.RecursorReading entries shape source recursor mode constants reading
+premise definition Ix.Theory.Certified.Ordinary.ModeEvidence
+  type: {β : Type u} → Model.Environment β → Certified.Ordinary.Shape β → Inductive.ElimMode → Prop
+  definition: fun {β} entries shape x =>
+  match x with
+  | Inductive.ElimMode.small => True
+  | Inductive.ElimMode.large => Certified.Ordinary.LargeEvidence entries shape
+premise definition Ix.Theory.Certified.Ordinary.Shape.ConstructorFormation
+  type: {β : Type u} → [DecidableEq β] → Model.Environment β → Certified.Ordinary.Shape β → β → Prop
+  definition: fun {β} [DecidableEq β] entries shape source =>
+  ∀ (ctor : Certified.Ordinary.Constructor β),
+    ctor ∈ shape.constructors →
+      Model.EntryClosed (shape.familyEnvironment entries source) (shape.constructorEntry source ctor) ∧
+        ∃ l, Model.TypingClaim (shape.familyEnvironment entries source) [] (ctor.type shape source) (Model.AExpr.sort l)
+premise constructor Ix.Theory.Certified.Ordinary.Shape.RecursorFormation.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {shape : Certified.Ordinary.Shape β} {source recursor : β} {mode : Inductive.ElimMode},
+  shape.RecursorSourceMatches store source recursor mode →
+    shape.constructorEnvironment entries source (ConstRef.member recursor 0) = none →
+      Model.EntryClosed (shape.constructorEnvironment entries source) (shape.recursorEntry source mode) →
+        (∃ l,
+            Model.TypingClaim (shape.constructorEnvironment entries source) [] (shape.recursorType source mode)
+              (Model.AExpr.sort l)) →
+          Certified.Ordinary.Shape.RecursorFormation entries store shape source recursor mode
+premise definition Ix.Theory.Certified.Ordinary.Shape.SupportsK
+  type: {β : Type u} → Certified.Ordinary.Shape β → Prop
+  definition: fun {β} shape =>
+  shape.level = VLevel.zero ∧ ∃ ctor, shape.constructors = [ctor] ∧ ctor.fields = [] ∧ ctor.recursive = []
+premise definition Ix.Theory.Certified.Ordinary.Shape.RecursorSourceMatches
+  type: {β : Type u} → Certified.Ordinary.Shape β → Store β → β → β → Inductive.ElimMode → Prop
+  definition: fun {β} shape store source recursor mode =>
+  store.blocks recursor = some { members := [shape.recursorSource source recursor mode] } ∨
+    shape.SupportsK ∧ store.blocks recursor = some { members := [shape.recursorSource source recursor mode true] }
+premise constructor Ix.Theory.Certified.Ordinary.Shape.RuleFormation.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {shape : Certified.Ordinary.Shape β} {source recursor : β}
+  {mode : Inductive.ElimMode} {i : Nat} {ctor : Certified.Ordinary.Constructor β},
+  Model.AExpr.Scope (mode.recUvars shape.universes) 0 (shape.ruleLhs source recursor mode i ctor) ∧
+      Model.AExpr.Scope (mode.recUvars shape.universes) 0 (shape.ruleRhs source recursor mode i ctor) →
+    Model.AExpr.ReferencesIn entries (shape.ruleLhs source recursor mode i ctor) ∧
+        Model.AExpr.ReferencesIn entries (shape.ruleRhs source recursor mode i ctor) →
+      (∃ l,
+          Model.TypingClaim entries [] (shape.ruleType source mode i ctor) (Model.AExpr.sort l) ∧
+            (mode = Inductive.ElimMode.small → ∀ (levels : List Nat), VLevel.eval levels l = 0)) →
+        Model.TypingClaim entries [] (shape.ruleLhs source recursor mode i ctor) (shape.ruleType source mode i ctor) →
+          Model.TypingClaim entries [] (shape.ruleRhs source recursor mode i ctor) (shape.ruleType source mode i ctor) →
+            Certified.Ordinary.Shape.RuleFormation entries shape source recursor mode i ctor
+premise constructor Ix.Theory.Certified.Ordinary.CheckedBlock.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β} {source recursor : β}
+  {shape : Certified.Ordinary.Shape β} {mode : Inductive.ElimMode},
+  Certified.Ordinary.CheckedShape entries store source shape →
+    Certified.Ordinary.Shape.ConstructorFormation entries shape source →
+      Certified.Ordinary.Shape.RecursorFormation entries store shape source recursor mode →
+        Certified.Ordinary.ModeEvidence entries shape mode →
+          (∀ (i : Nat) (ctor : Certified.Ordinary.Constructor β),
+              shape.constructors[i]? = some ctor →
+                Certified.Ordinary.Shape.RuleFormation (shape.recursorEnvironment entries source recursor mode) shape
+                  source recursor mode i ctor) →
+            Certified.Ordinary.CheckedBlock entries store source recursor shape mode
+premise definition Ix.Theory.Certified.Ordinary.EntrySource
+  type: {β : Type u} → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} store r entry =>
+  ∃ shape source recursor mode,
+    store.blocks source = some { members := [shape.source source] } ∧
+      shape.RecursorSourceMatches store source recursor mode ∧
+        (r = ConstRef.member source 0 ∧ entry = shape.familyEntry ∨
+          (∃ i ctor,
+              shape.constructors[i]? = some ctor ∧
+                r = ConstRef.ctor source 0 i ∧ entry = shape.constructorEntry source ctor) ∨
+            r = ConstRef.member recursor 0 ∧ entry = shape.publishedRecursorEntry source recursor mode)
+premise definition Ix.Theory.Certified.Ordinary.Shape.recursorAt
+  type: {β : Type u} →
+  {V : Type v} →
+    [Model.SetTheory V] →
+      Certified.Ordinary.Shape β → Model.Assignment β V → List Nat → (Nat → V) → Inductive.ElimMode → V → List V → V
+  definition: fun {β} {V} [Model.SetTheory V] shape constants levels env mode m minors =>
+  match mode with
+  | Inductive.ElimMode.small => Model.SetTheory.pt
+  | Inductive.ElimMode.large =>
+    if hD :
+        (shape.container constants (mode.sourceArgs levels) env).WF
+          (VLevel.eval (mode.sourceArgs levels) shape.level) then
+      if hlarge :
+          (shape.container constants (mode.sourceArgs levels) env).LargeElim
+            (VLevel.eval (mode.sourceArgs levels) shape.level) then
+        shape.largeValue constants (mode.sourceArgs levels) env (VLevel.eval levels mode.motiveLevel) m minors hD hlarge
+      else Model.SetTheory.pt
+    else Model.SetTheory.pt
+premise constructor Ix.Theory.Certified.Ordinary.BlockWitness.mk
+  type: {β : Type u} →
+  β →
+    β →
+      Certified.Ordinary.ShapeWitness β →
+        Inductive.ElimMode →
+          List (Certified.Ordinary.Shape.TypeWitness β) →
+            Certified.Ordinary.Shape.TypeWitness β →
+              List (Certified.Ordinary.RuleWitness β) → Certified.Ordinary.BlockWitness β
+premise constructor Ix.Theory.Certified.DeclarationWitness.definition
+  type: {β : Type u} → Certified.DefinitionWitness β → Certified.DeclarationWitness β
+premise constructor Ix.Theory.Certified.DeclarationWitness.ordinary
+  type: {β : Type u} → Certified.Ordinary.BlockWitness β → Certified.DeclarationWitness β
+premise constructor Ix.Theory.Certified.DeclarationWitness.standard
+  type: {β : Type u} → Certified.Standard.Witness β → Certified.DeclarationWitness β
+premise constructor Ix.Theory.Certified.DeclarationWitness.quotient
+  type: {β : Type u} → Certified.Quotient.Witness β → Certified.DeclarationWitness β
+premise constructor Ix.Theory.Certified.DeclarationWitness.structure
+  type: {β : Type u} → Certified.Structure.Witness β → Certified.DeclarationWitness β
+premise constructor Ix.Theory.Certified.DeclarationWitness.natural
+  type: {β : Type u} → Certified.Ordinary.BlockWitness β → Certified.DeclarationWitness β
+premise definition Ix.Theory.Certified.Natural.shape
+  type: {β : Type u} → Certified.Ordinary.Shape β
+  definition: fun {β} =>
+  { universes := 0, parameters := [], indices := [], level := VLevel.zero.succ,
+    constructors := [Certified.Natural.zeroConstructor, Certified.Natural.succConstructor] }
+premise definition Ix.Theory.Certified.Natural.fact
+  type: {β : Type u} → β → Model.ConstantFact β
+  definition: fun {β} source => Model.ConstantFact.natural (ConstRef.ctor source 0 0) (ConstRef.ctor source 0 1)
+premise definition Ix.Theory.Certified.Natural.entry
+  type: {β : Type u} → β → Model.ConstantEntry β
+  definition: fun {β} source =>
+  have __src := Certified.Natural.shape.familyEntry;
+  { universes := __src.universes, type := __src.type, body := __src.body, equations := __src.equations,
+    facts := [Certified.Natural.fact source] }
+premise definition Ix.Theory.Certified.Natural.environment
+  type: {β : Type u} → [DecidableEq β] → Model.Environment β → β → β → Inductive.ElimMode → Model.Environment β
+  definition: fun {β} [DecidableEq β] entries source recursor mode =>
+  (Certified.Natural.shape.publishedEnvironment entries source recursor mode).insert (ConstRef.member source 0)
+    (Certified.Natural.entry source)
+premise constructor Ix.Theory.Certified.Natural.Checked.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β} {pin : ConstRef β}
+  {source recursor : β} {mode : Inductive.ElimMode},
+  Certified.Ordinary.CheckedBlock entries store source recursor Certified.Natural.shape mode →
+    pin = ConstRef.member source 0 →
+      Model.ConstantFact.ReferencesIn (Certified.Natural.shape.publishedEnvironment entries source recursor mode)
+          (Certified.Natural.fact source) →
+        Certified.Natural.Checked entries store pin source recursor mode
+premise definition Ix.Theory.Certified.Natural.EntrySource
+  type: {β : Type u} → Option (ConstRef β) → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} pin store r e =>
+  pin = some r ∧
+    ∃ source recursor mode,
+      store.blocks source = some { members := [Certified.Natural.shape.source source] } ∧
+        Certified.Natural.shape.RecursorSourceMatches store source recursor mode ∧
+          r = ConstRef.member source 0 ∧ e = Certified.Natural.entry source
+premise constructor Ix.Theory.Certified.Structure.Field.mk
+  type: {β : Type u} → Model.AExpr β → VLevel → Certified.Structure.Field β
+premise constructor Ix.Theory.Certified.Structure.Description.mk
+  type: {β : Type u} →
+  Nat → List (Model.AExpr β) → List (Certified.Structure.Field β) → VLevel → Certified.Structure.Description β
+premise definition Ix.Theory.Certified.Structure.Description.ordinary
+  type: {β : Type u} → Certified.Structure.Description β → Certified.Ordinary.Shape β
+  definition: fun {β} d =>
+  { universes := d.universes, parameters := d.parameters, indices := [], level := d.level,
+    constructors := [d.constructor] }
+premise constructor Ix.Theory.Certified.Structure.FieldsFormed.nil
+  type: ∀ {β : Type u} {entries : Model.Environment β} {w : VLevel} {Γ : Model.Context β},
+  Certified.Structure.FieldsFormed entries w Γ []
+premise constructor Ix.Theory.Certified.Structure.FieldsFormed.cons
+  type: ∀ {β : Type u} {entries : Model.Environment β} {w : VLevel} {Γ : Model.Context β}
+  {field : Certified.Structure.Field β} {rest : List (Certified.Structure.Field β)},
+  Model.TypingClaim entries Γ field.domain (Model.AExpr.sort field.level) →
+    (∀ (levels : List Nat), VLevel.eval levels w = 0 → VLevel.eval levels field.level = 0) →
+      Certified.Structure.FieldsFormed entries w (Model.Context.push field.domain Γ) rest →
+        Certified.Structure.FieldsFormed entries w Γ (field :: rest)
+premise definition Ix.Theory.Certified.Structure.fieldResult
+  type: {β : Type u} → β → Nat → Certified.Structure.Field β → Model.AExpr β
+  definition: fun {β} source index field =>
+  (Model.AExpr.liftN 1 field.domain index).instRev (Certified.Structure.projections source index)
+premise definition Ix.Theory.Certified.Structure.Description.facts
+  type: {β : Type u} → Certified.Structure.Description β → β → List (Model.ConstantFact β)
+  definition: fun {β} d source =>
+  List.map
+    (fun x =>
+      match x with
+      | (field, i) => Model.ConstantFact.typed (d.projection source i field) (d.projectionType source i field))
+    d.fields.zipIdx
+premise definition Ix.Theory.Certified.Structure.Description.equations
+  type: {β : Type u} → Certified.Structure.Description β → β → List (Model.ConstantEquation β)
+  definition: fun {β} d source =>
+  { lhs := d.etaLhs source, rhs := d.etaRhs source } ::
+    List.map
+      (fun x =>
+        match x with
+        | (field, i) => { lhs := d.iotaLhs source i field, rhs := d.iotaRhs i field })
+      d.fields.zipIdx
+premise definition Ix.Theory.Certified.Structure.Description.iotaEnvironment
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Certified.Structure.Description β → Model.Environment β → β → β → Inductive.ElimMode → Nat → Model.Environment β
+  definition: fun {β} [DecidableEq β] d entries source recursor mode count =>
+  (d.ordinary.publishedEnvironment entries source recursor mode).insert (ConstRef.member source 0)
+    (have __src := d.factEntry source;
+    { universes := __src.universes, type := __src.type, body := __src.body,
+      equations := List.take count (List.drop 1 (d.equations source)), facts := __src.facts })
+premise definition Ix.Theory.Certified.Structure.Description.etaRule
+  type: {β : Type u} → Certified.Structure.Description β → β → Certified.Signature.Rule β
+  definition: fun {β} d source =>
+  { universes := d.universes,
+    type :=
+      Model.AExpr.forallN (Certified.zeroCondition d.level) (d.projectionDomains source)
+        (d.ordinary.familyApp source 1 []),
+    lhs := d.etaLhs source, rhs := d.etaRhs source }
+premise definition Ix.Theory.Certified.Structure.Description.iotaRule
+  type: {β : Type u} →
+  Certified.Structure.Description β → β → Nat → Certified.Structure.Field β → Certified.Signature.Rule β
+  definition: fun {β} d source i field =>
+  { universes := d.universes,
+    type :=
+      Model.AExpr.forallN (Certified.zeroCondition field.level) (d.parameters ++ d.constructor.fields)
+        (Model.AExpr.liftN (d.fields.length - i) field.domain),
+    lhs := d.iotaLhs source i field, rhs := d.iotaRhs i field }
+premise constructor Ix.Theory.Certified.Structure.FactsWitness.mk
+  type: {β : Type u} →
+  Certified.Structure.Description β →
+    Certified.Ordinary.BlockWitness β →
+      List (Certified.TypingWitness β) → List (Certified.DomainWitness β) → Certified.Structure.FactsWitness β
+premise constructor Ix.Theory.Certified.Structure.Witness.mk
+  type: {β : Type u} →
+  Certified.Structure.FactsWitness β →
+    Certified.Signature.RuleWitness β → List (Certified.Signature.RuleWitness β) → Certified.Structure.Witness β
+premise constructor Ix.Theory.Certified.Structure.FactsChecked.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {d : Certified.Structure.Description β} {source recursor : β} {mode : Inductive.ElimMode},
+  Certified.Ordinary.CheckedBlock entries store source recursor d.ordinary mode →
+    Certified.Structure.FieldsFormed entries d.level d.ordinary.parameterContext d.fields →
+      Model.Telescope.Formed (d.ordinary.publishedEnvironment entries source recursor mode) []
+          (d.projectionDomains source) →
+        (∀ (fact : Model.ConstantFact β), fact ∈ d.facts source → Model.ConstantFact.Scope d.universes fact) →
+          (∀ (fact : Model.ConstantFact β),
+              fact ∈ d.facts source →
+                Model.ConstantFact.ReferencesIn (d.ordinary.publishedEnvironment entries source recursor mode) fact) →
+            Certified.Structure.FactsChecked entries store d source recursor mode
+premise constructor Ix.Theory.Certified.Structure.Checked.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {d : Certified.Structure.Description β} {source recursor : β} {mode : Inductive.ElimMode},
+  Certified.Structure.FactsChecked entries store d source recursor mode →
+    Certified.Signature.RuleFormed (d.factEnvironment entries source recursor mode) (d.etaRule source) →
+      (∀ (field : Certified.Structure.Field β) (i : Nat),
+          (field, i) ∈ d.fields.zipIdx →
+            Certified.Signature.RuleFormed (d.iotaEnvironment entries source recursor mode i)
+              (d.iotaRule source i field)) →
+        Certified.Structure.Checked entries store d source recursor mode
+premise definition Ix.Theory.Certified.Structure.EntrySource
+  type: {β : Type u} → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} store r entry =>
+  ∃ d source recursor mode,
+    store.blocks source = some { members := [d.ordinary.source source] } ∧
+      d.ordinary.RecursorSourceMatches store source recursor mode ∧
+        r = ConstRef.member source 0 ∧ entry = d.publishedEntry source
+premise definition Ix.Theory.Model.Environment.HasType
+  type: {β : Type u} → Model.Environment β → ConstRef β → Nat → Model.AExpr β → Prop
+  definition: fun {β} entries ref n type => ∃ entry, entries ref = some entry ∧ entry.universes = n ∧ entry.type = type
+premise constructor Ix.Theory.Certified.Basis.Equality.Interface.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {family refl recursor : ConstRef β},
+  entries.HasType family 1 Certified.Basis.Equality.type →
+    entries.HasType refl 1 (Certified.Basis.Equality.reflType family) →
+      entries.HasType recursor 2 (Certified.Basis.Equality.recType family refl) →
+        Certified.Basis.Equality.Interface entries family refl recursor
+premise definition Ix.Theory.Certified.Basis.Equality.shape
+  type: {β : Type u} → Certified.Ordinary.Shape β
+  definition: fun {β} =>
+  { universes := 1, parameters := [Model.AExpr.sort (VLevel.param 0), Model.AExpr.bvar 0],
+    indices := [Model.AExpr.bvar 1], level := VLevel.zero,
+    constructors := [{ fields := [], recursive := [], indices := [Model.AExpr.bvar 0] }] }
+premise definition Ix.Theory.Certified.Basis.Equality.type
+  type: {β : Type u} → Model.AExpr β
+  definition: fun {β} =>
+  Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.sort (VLevel.param 0))
+    (Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.bvar 0)
+      (Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.bvar 1) (Model.AExpr.sort VLevel.zero)))
+premise definition Ix.Theory.Certified.Basis.Equality.reflType
+  type: {β : Type u} → ConstRef β → Model.AExpr β
+  definition: fun {β} family =>
+  Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.sort (VLevel.param 0))
+    (Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.bvar 0)
+      (Certified.Basis.Equality.applied family (VLevel.param 0) (Model.AExpr.bvar 1) (Model.AExpr.bvar 0)
+        (Model.AExpr.bvar 0)))
+premise definition Ix.Theory.Certified.Basis.Equality.recType
+  type: {β : Type u} → ConstRef β → ConstRef β → Model.AExpr β
+  definition: fun {β} family refl =>
+  Model.AExpr.forallE (Certified.PropWhen.param 0) (Model.AExpr.sort (VLevel.param 1))
+    (Model.AExpr.forallE (Certified.PropWhen.param 0) (Model.AExpr.bvar 0)
+      (Model.AExpr.forallE (Certified.PropWhen.param 0)
+        (Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.bvar 1)
+          (Model.AExpr.forallE Certified.PropWhen.never
+            (Certified.Basis.Equality.applied family (VLevel.param 1) (Model.AExpr.bvar 2) (Model.AExpr.bvar 1)
+              (Model.AExpr.bvar 0))
+            (Model.AExpr.sort (VLevel.param 0))))
+        (Model.AExpr.forallE (Certified.PropWhen.param 0)
+          ((Model.AExpr.bvar 0).appN
+            [Model.AExpr.bvar 1,
+              Certified.Basis.Equality.reflexivity refl (VLevel.param 1) (Model.AExpr.bvar 2) (Model.AExpr.bvar 1)])
+          (Model.AExpr.forallE (Certified.PropWhen.param 0) (Model.AExpr.bvar 3)
+            (Model.AExpr.forallE (Certified.PropWhen.param 0)
+              (Certified.Basis.Equality.applied family (VLevel.param 1) (Model.AExpr.bvar 4) (Model.AExpr.bvar 3)
+                (Model.AExpr.bvar 0))
+              ((Model.AExpr.bvar 3).appN [Model.AExpr.bvar 1, Model.AExpr.bvar 0]))))))
+premise constructor Ix.Theory.Certified.Basis.Iff.Interface.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {family ctor recursor : ConstRef β},
+  entries.HasType family 0 Certified.Basis.Iff.type →
+    entries.HasType ctor 0 (Certified.Basis.Iff.introType family) →
+      entries.HasType recursor 1 (Certified.Basis.Iff.recType family ctor) →
+        Certified.Basis.Iff.Interface entries family ctor recursor
+premise definition Ix.Theory.Certified.Basis.Iff.shape
+  type: {β : Type u} → Certified.Ordinary.Shape β
+  definition: fun {β} =>
+  { universes := 0, parameters := [Model.AExpr.sort VLevel.zero, Model.AExpr.sort VLevel.zero], indices := [],
+    level := VLevel.zero, constructors := [Certified.Basis.Iff.constructor] }
+premise definition Ix.Theory.Certified.Basis.Iff.type
+  type: {β : Type u} → Model.AExpr β
+  definition: fun {β} =>
+  Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.sort VLevel.zero)
+    (Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.sort VLevel.zero) (Model.AExpr.sort VLevel.zero))
+premise definition Ix.Theory.Certified.Basis.Iff.introType
+  type: {β : Type u} → ConstRef β → Model.AExpr β
+  definition: fun {β} family =>
+  Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.sort VLevel.zero)
+    (Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.sort VLevel.zero)
+      (Model.AExpr.forallE Certified.PropWhen.always
+        (Certified.Basis.Iff.arrow (Model.AExpr.bvar 1) (Model.AExpr.bvar 0))
+        (Model.AExpr.forallE Certified.PropWhen.always
+          (Certified.Basis.Iff.arrow (Model.AExpr.bvar 1) (Model.AExpr.bvar 2))
+          (Certified.Basis.Iff.applied family (Model.AExpr.bvar 3) (Model.AExpr.bvar 2)))))
+premise definition Ix.Theory.Certified.Basis.Iff.recType
+  type: {β : Type u} → ConstRef β → ConstRef β → Model.AExpr β
+  definition: fun {β} family ctor =>
+  Model.AExpr.forallE (Certified.PropWhen.param 0) (Model.AExpr.sort VLevel.zero)
+    (Model.AExpr.forallE (Certified.PropWhen.param 0) (Model.AExpr.sort VLevel.zero)
+      (Model.AExpr.forallE (Certified.PropWhen.param 0)
+        (Model.AExpr.forallE Certified.PropWhen.never
+          (Certified.Basis.Iff.applied family (Model.AExpr.bvar 1) (Model.AExpr.bvar 0))
+          (Model.AExpr.sort (VLevel.param 0)))
+        (Model.AExpr.forallE (Certified.PropWhen.param 0)
+          (Model.AExpr.forallE (Certified.PropWhen.param 0)
+            (Certified.Basis.Iff.arrow (Model.AExpr.bvar 2) (Model.AExpr.bvar 1))
+            (Model.AExpr.forallE (Certified.PropWhen.param 0)
+              (Certified.Basis.Iff.arrow (Model.AExpr.bvar 2) (Model.AExpr.bvar 3))
+              ((Model.AExpr.bvar 2).app
+                (Certified.Basis.Iff.introduction ctor (Model.AExpr.bvar 4) (Model.AExpr.bvar 3) (Model.AExpr.bvar 1)
+                  (Model.AExpr.bvar 0)))))
+          (Model.AExpr.forallE (Certified.PropWhen.param 0)
+            (Certified.Basis.Iff.applied family (Model.AExpr.bvar 3) (Model.AExpr.bvar 2))
+            ((Model.AExpr.bvar 2).app (Model.AExpr.bvar 0))))))
+premise constructor Ix.Theory.Certified.Basis.Nonempty.Interface.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {family ctor recursor : ConstRef β},
+  entries.HasType family 1 Certified.Basis.Nonempty.type →
+    entries.HasType ctor 1 (Certified.Basis.Nonempty.introType family) →
+      entries.HasType recursor 1 (Certified.Basis.Nonempty.recType family ctor) →
+        Certified.Basis.Nonempty.Interface entries family ctor recursor
+premise definition Ix.Theory.Certified.Basis.Nonempty.shape
+  type: {β : Type u} → Certified.Ordinary.Shape β
+  definition: fun {β} =>
+  { universes := 1, parameters := [Model.AExpr.sort (VLevel.param 0)], indices := [], level := VLevel.zero,
+    constructors := [Certified.Basis.Nonempty.constructor] }
+premise definition Ix.Theory.Certified.Basis.Nonempty.type
+  type: {β : Type u} → Model.AExpr β
+  definition: fun {β} =>
+  Model.AExpr.forallE Certified.PropWhen.never (Model.AExpr.sort (VLevel.param 0)) (Model.AExpr.sort VLevel.zero)
+premise definition Ix.Theory.Certified.Basis.Nonempty.introType
+  type: {β : Type u} → ConstRef β → Model.AExpr β
+  definition: fun {β} family =>
+  Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.sort (VLevel.param 0))
+    (Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.bvar 0)
+      (Certified.Basis.Nonempty.applied family (VLevel.param 0) (Model.AExpr.bvar 1)))
+premise definition Ix.Theory.Certified.Basis.Nonempty.recType
+  type: {β : Type u} → ConstRef β → ConstRef β → Model.AExpr β
+  definition: fun {β} family ctor =>
+  Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.sort (VLevel.param 0))
+    (Model.AExpr.forallE Certified.PropWhen.always
+      (Model.AExpr.forallE Certified.PropWhen.never
+        (Certified.Basis.Nonempty.applied family (VLevel.param 0) (Model.AExpr.bvar 0)) (Model.AExpr.sort VLevel.zero))
+      (Model.AExpr.forallE Certified.PropWhen.always
+        (Model.AExpr.forallE Certified.PropWhen.always (Model.AExpr.bvar 1)
+          ((Model.AExpr.bvar 1).app
+            (Certified.Basis.Nonempty.introduction ctor (VLevel.param 0) (Model.AExpr.bvar 2) (Model.AExpr.bvar 0))))
+        (Model.AExpr.forallE Certified.PropWhen.always
+          (Certified.Basis.Nonempty.applied family (VLevel.param 0) (Model.AExpr.bvar 2))
+          ((Model.AExpr.bvar 2).app (Model.AExpr.bvar 0)))))
+premise definition Ix.Theory.Certified.Standard.Spec.Prerequisites
+  type: {β : Type u} → Model.Environment β → Certified.Standard.Spec β → Prop
+  definition: fun {β} entries x =>
+  match x with
+  | Certified.Standard.Spec.propext eq eqRefl eqRec iff iffIntro iffRec =>
+    Certified.Basis.Equality.Interface entries eq eqRefl eqRec ∧
+      Certified.Basis.Iff.Interface entries iff iffIntro iffRec
+  | Certified.Standard.Spec.choice nonempty intro recursor =>
+    Certified.Basis.Nonempty.Interface entries nonempty intro recursor
+premise definition Ix.Theory.Certified.Standard.Spec.type
+  type: {β : Type u} → Certified.Standard.Spec β → Model.AExpr β
+  definition: fun {β} x =>
+  match x with
+  | Certified.Standard.Spec.propext eq eqRefl eqRec iff iffIntro iffRec => Certified.Standard.propextType eq iff
+  | Certified.Standard.Spec.choice nonempty intro recursor => Certified.Standard.choiceType nonempty
+premise definition Ix.Theory.Certified.Standard.Spec.value
+  type: {β : Type u} →
+  {V : Type v} → [Model.SetTheory V] → Certified.Standard.Spec β → Model.Assignment β V → List Nat → V
+  definition: fun {β} {V} [Model.SetTheory V] spec constants levels =>
+  match spec with
+  | Certified.Standard.Spec.propext eq eqRefl eqRec iff iffIntro iffRec => Model.SetTheory.pt
+  | Certified.Standard.Spec.choice nonempty intro recursor =>
+    Certified.Standard.choiceValue constants nonempty (levels.getD 0 0)
+premise definition Ix.Theory.Certified.Standard.chooseSet
+  type: {V : Type v} → [Model.SetTheory V] → V → V
+  definition: fun {V} [Model.SetTheory V] A =>
+  if h : ∃ a, Model.SetTheory.Mem a A then Classical.choose h else Model.SetTheory.empty
+premise constructor Ix.Theory.Certified.Standard.Witness.mk
+  type: {β : Type u} →
+  ConstRef β → Certified.Standard.Spec β → VLevel → Certified.TypingWitness β → Certified.Standard.Witness β
+premise constructor Ix.Theory.Certified.Standard.Checked.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {store : Store β} {witness : Certified.Standard.Witness β},
+  store.lookup witness.ref = some witness.spec.source →
+    entries witness.ref = none →
+      Certified.Standard.Spec.Prerequisites entries witness.spec →
+        Model.AExpr.Scope witness.spec.universes 0 witness.spec.type →
+          Model.AExpr.ReferencesIn entries witness.spec.type →
+            Model.TypingClaim entries [] witness.spec.type (Model.AExpr.sort witness.level) →
+              Certified.Standard.Checked entries store witness
+premise definition Ix.Theory.Certified.Standard.EntrySource
+  type: {β : Type u} → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} store ref entry => ∃ spec, store.lookup ref = some spec.source ∧ entry = spec.entry
+premise constructor Ix.Theory.Certified.Signature.Header.mk
+  type: {β : Type u} → ConstRef β → Nat → Model.AExpr β → Certified.Signature.Header β
+premise constructor Ix.Theory.Certified.Signature.Formed.nil
+  type: ∀ {β : Type u} [inst : DecidableEq β] (entries : Model.Environment β), Certified.Signature.Formed entries []
+premise constructor Ix.Theory.Certified.Signature.Formed.cons
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {header : Certified.Signature.Header β}
+  {rest : List (Certified.Signature.Header β)},
+  entries header.ref = none →
+    Model.AExpr.Scope header.universes 0 header.type →
+      Model.AExpr.ReferencesIn entries header.type →
+        ∀ {level : VLevel},
+          Model.TypingClaim entries [] header.type (Model.AExpr.sort level) →
+            Certified.Signature.Formed (entries.insert header.ref header.entry) rest →
+              Certified.Signature.Formed entries (header :: rest)
+premise constructor Ix.Theory.Certified.Signature.TypeWitness.mk
+  type: {β : Type u} → VLevel → Certified.TypingWitness β → Certified.Signature.TypeWitness β
+premise constructor Ix.Theory.Certified.Signature.Rule.mk
+  type: {β : Type u} → Nat → Model.AExpr β → Model.AExpr β → Model.AExpr β → Certified.Signature.Rule β
+premise constructor Ix.Theory.Certified.Signature.RuleFormed.mk
+  type: ∀ {β : Type u} {entries : Model.Environment β} {rule : Certified.Signature.Rule β},
+  Model.AExpr.Scope rule.universes 0 rule.type ∧
+      Model.AExpr.Scope rule.universes 0 rule.lhs ∧ Model.AExpr.Scope rule.universes 0 rule.rhs →
+    Model.AExpr.ReferencesIn entries rule.type ∧
+        Model.AExpr.ReferencesIn entries rule.lhs ∧ Model.AExpr.ReferencesIn entries rule.rhs →
+      (∃ level, Model.TypingClaim entries [] rule.type (Model.AExpr.sort level)) →
+        Model.TypingClaim entries [] rule.lhs rule.type →
+          Model.TypingClaim entries [] rule.rhs rule.type → Certified.Signature.RuleFormed entries rule
+premise constructor Ix.Theory.Certified.Signature.RuleWitness.mk
+  type: {β : Type u} →
+  VLevel →
+    Certified.TypingWitness β →
+      Certified.TypingWitness β → Certified.TypingWitness β → Certified.Signature.RuleWitness β
+premise definition Ix.Theory.Model.SetTheory.quotSet
+  type: {V : Type u} → [Model.SetTheory V] → Nat → V → V → V
+  definition: fun {V} [Model.SetTheory V] u A R =>
+  if u = 0 then Model.SetTheory.image (fun x => Model.SetTheory.pt) A
+  else Model.SetTheory.image (fun a => Model.SetTheory.qclass A R a) A
+premise definition Ix.Theory.Model.SetTheory.quotClass
+  type: {V : Type u} → [Model.SetTheory V] → Nat → V → V → V → V
+  definition: fun {V} [Model.SetTheory V] u A R a => if u = 0 then Model.SetTheory.pt else Model.SetTheory.qclass A R a
+premise definition Ix.Theory.Model.SetTheory.qrep
+  type: {V : Type u} → [Model.SetTheory V] → Nat → V → V → V → V
+  definition: fun {V} [Model.SetTheory V] u A R q =>
+  if h : ∃ a, Model.SetTheory.Mem a A ∧ q = Model.SetTheory.quotClass u A R a then Classical.choose h
+  else Model.SetTheory.empty
+premise constructor Ix.Theory.Model.SetTheory.QuotRel.base
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {A R a b : V},
+  Model.SetTheory.Mem a A →
+    Model.SetTheory.Mem b A →
+      (∃ w, Model.SetTheory.Mem w (Model.SetTheory.app (Model.SetTheory.app R a) b)) → Model.SetTheory.QuotRel A R a b
+premise constructor Ix.Theory.Model.SetTheory.QuotRel.refl
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {A R a : V}, Model.SetTheory.Mem a A → Model.SetTheory.QuotRel A R a a
+premise constructor Ix.Theory.Model.SetTheory.QuotRel.symm
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {A R a b : V},
+  Model.SetTheory.QuotRel A R a b → Model.SetTheory.QuotRel A R b a
+premise constructor Ix.Theory.Model.SetTheory.QuotRel.trans
+  type: ∀ {V : Type u} [inst : Model.SetTheory V] {A R a b c : V},
+  Model.SetTheory.QuotRel A R a b → Model.SetTheory.QuotRel A R b c → Model.SetTheory.QuotRel A R a c
+premise constructor Ix.Theory.Certified.Quotient.Refs.mk
+  type: {β : Type u} → Store.QuotRefs β → ConstRef β → ConstRef β → ConstRef β → Certified.Quotient.Refs β
+premise definition Ix.Theory.Certified.Quotient.Refs.ExactSource
+  type: {β : Type u} → Certified.Quotient.Refs β → Store β → Prop
+  definition: fun {β} refs store =>
+  ∀ (kind : Certified.Quotient.Kind),
+    kind ∈ Certified.Quotient.kinds → store.lookup (refs.ref kind) = some (refs.source kind)
+premise definition Ix.Theory.Certified.Quotient.Refs.environment
+  type: {β : Type u} → [DecidableEq β] → Certified.Quotient.Refs β → Model.Environment β → Model.Environment β
+  definition: fun {β} [DecidableEq β] refs entries r =>
+  match refs.kind? r with
+  | some kind => some (refs.entry kind)
+  | none => entries r
+premise definition Ix.Theory.Certified.Quotient.Refs.assignment
+  type: {β : Type u} →
+  [DecidableEq β] →
+    {V : Type v} → [Model.SetTheory V] → Certified.Quotient.Refs β → Model.Assignment β V → Model.Assignment β V
+  definition: fun {β} [DecidableEq β] {V} [Model.SetTheory V] refs constants r levels =>
+  match refs.kind? r with
+  | some kind => refs.value constants kind levels
+  | none => constants r levels
+premise definition Ix.Theory.Certified.Quotient.Refs.entryType
+  type: {β : Type u} → Certified.Quotient.Refs β → Certified.Quotient.Kind → Model.AExpr β
+  definition: fun {β} refs x =>
+  match x with
+  | Certified.Quotient.Kind.type => Certified.Quotient.typeType
+  | Certified.Quotient.Kind.ctor => Certified.Quotient.ctorType refs
+  | Certified.Quotient.Kind.lift => Certified.Quotient.liftType refs
+  | Certified.Quotient.Kind.ind => Certified.Quotient.indType refs
+  | Certified.Quotient.Kind.sound => Certified.Quotient.soundType refs
+premise definition Ix.Theory.Certified.Quotient.Refs.source
+  type: {β : Type u} → Certified.Quotient.Refs β → Certified.Quotient.Kind → Const β
+  definition: fun {β} refs x =>
+  match x with
+  | Certified.Quotient.Kind.type => Const.quot Ix.Theory.QuotKind.type 1 Certified.Quotient.typeType.erase
+  | Certified.Quotient.Kind.ctor => Const.quot Ix.Theory.QuotKind.ctor 1 (Certified.Quotient.ctorType refs).erase
+  | Certified.Quotient.Kind.lift => Const.quot Ix.Theory.QuotKind.lift 2 (Certified.Quotient.liftType refs).erase
+  | Certified.Quotient.Kind.ind => Const.quot Ix.Theory.QuotKind.ind 1 (Certified.Quotient.indType refs).erase
+  | Certified.Quotient.Kind.sound => Const.axiom 1 (Certified.Quotient.soundType refs).erase Safety.safe
+premise definition Ix.Theory.Certified.Quotient.Refs.equations
+  type: {β : Type u} → Certified.Quotient.Refs β → Certified.Quotient.Kind → List (Model.ConstantEquation β)
+  definition: fun {β} refs x =>
+  match x with
+  | Certified.Quotient.Kind.lift =>
+    [{ lhs := Certified.Quotient.liftRuleLhs refs, rhs := Certified.Quotient.liftRuleRhs refs }]
+  | Certified.Quotient.Kind.ind =>
+    [{ lhs := Certified.Quotient.indRuleLhs refs, rhs := Certified.Quotient.indRuleRhs refs }]
+  | x => []
+premise constructor Ix.Theory.Certified.Quotient.Reading.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {constants : Model.Assignment β V}
+  {refs : Certified.Quotient.Refs β},
+  (∀ (u : Nat), constants refs.type [u] = Certified.Quotient.formerValue u) →
+    (∀ (u : Nat), constants refs.ctor [u] = Certified.Quotient.constructorValue u) →
+      (∀ (u v : Nat), constants refs.lift [u, v] = Certified.Quotient.liftValue constants refs.eq u v) →
+        (∀ (u : Nat), constants refs.ind [u] = Model.SetTheory.pt) →
+          (∀ (u : Nat), constants refs.sound [u] = Model.SetTheory.pt) → Certified.Quotient.Reading constants refs
+premise constructor Ix.Theory.Certified.Quotient.Witness.mk
+  type: {β : Type u} →
+  Certified.Quotient.Refs β →
+    List (Certified.Signature.TypeWitness β) →
+      Certified.Signature.RuleWitness β → Certified.Signature.RuleWitness β → Certified.Quotient.Witness β
+premise constructor Ix.Theory.Certified.Quotient.Checked.mk
+  type: ∀ {β : Type u} [inst : DecidableEq β] {entries : Model.Environment β} {store : Store β}
+  {refs : Certified.Quotient.Refs β},
+  refs.ExactSource store →
+    refs.Fresh entries →
+      Certified.Basis.Equality.Interface entries refs.eq refs.eqRefl refs.eqRec →
+        Certified.Signature.Formed entries refs.headers →
+          Certified.Signature.RuleFormed (refs.typeEnvironment entries) refs.liftRule →
+            Certified.Signature.RuleFormed (refs.typeEnvironment entries) refs.indRule →
+              Certified.Quotient.Checked entries store refs
+premise definition Ix.Theory.Certified.Quotient.EntrySource
+  type: {β : Type u} → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} store r entry => ∃ refs kind, refs.ExactSource store ∧ r = refs.ref kind ∧ entry = refs.entry kind
+premise definition Ix.Theory.Certified.Quotient.formerValue
+  type: {V : Type v} → [Model.SetTheory V] → Nat → V
+  definition: fun {V} [Model.SetTheory V] u =>
+  Model.SetModel.lamR 1 (Model.SetTheory.univ u) fun A =>
+    Model.SetModel.lamR 1 (Certified.Quotient.relationSet A) fun R => Model.SetTheory.quotSet u A R
+premise definition Ix.Theory.Certified.Quotient.constructorValue
+  type: {V : Type v} → [Model.SetTheory V] → Nat → V
+  definition: fun {V} [Model.SetTheory V] u =>
+  Model.SetModel.lamR (Certified.Quotient.bit u) (Model.SetTheory.univ u) fun A =>
+    Model.SetModel.lamR (Certified.Quotient.bit u) (Certified.Quotient.relationSet A) fun R =>
+      Model.SetModel.lamR (Certified.Quotient.bit u) A fun a => Model.SetTheory.quotClass u A R a
+premise definition Ix.Theory.Certified.Quotient.liftValue
+  type: {β : Type u} → {V : Type v} → [Model.SetTheory V] → Model.Assignment β V → ConstRef β → Nat → Nat → V
+  definition: fun {β} {V} [Model.SetTheory V] constants eq u v =>
+  Model.SetModel.lamR (Certified.Quotient.bit v) (Model.SetTheory.univ u) fun A =>
+    Model.SetModel.lamR (Certified.Quotient.bit v) (Certified.Quotient.relationSet A) fun R =>
+      Model.SetModel.lamR (Certified.Quotient.bit v) (Model.SetTheory.univ v) fun B =>
+        Model.SetModel.lamR (Certified.Quotient.bit v) (Model.SetModel.piR (Certified.Quotient.bit v) A fun x => B)
+          fun f =>
+          Model.SetModel.lamR (Certified.Quotient.bit v) (Certified.Quotient.invariantSet constants eq v A R B f)
+            fun x =>
+            Model.SetModel.lamR (Certified.Quotient.bit v) (Model.SetTheory.quotSet u A R) fun q =>
+              Model.SetTheory.app f (Model.SetTheory.qrep u A R q)
+premise constructor Ix.Theory.Certified.PrimitiveSignature.Compatible.mk
+  type: ∀ {β : Type u} {V : Type v} [inst : Model.SetTheory V] {signature : Certified.PrimitiveSignature β}
+  {entries : Model.Environment β} {constants : Model.Assignment β V},
+  Model.Realizes constants entries →
+    (∀ (levels : List Nat), constants signature.falseType levels = Model.SetTheory.empty) →
+      (∀ (levels : List Nat), constants signature.falseElim levels = Model.falseElimValue (levels.getD 0 0)) →
+        signature.Compatible entries constants
+premise definition Ix.Theory.Certified.EntrySource
+  type: {β : Type u} → Certified.PrimitiveSignature β → Store β → ConstRef β → Model.ConstantEntry β → Prop
+  definition: fun {β} signature store r entry =>
+  r = signature.falseType ∧
+      entry = Certified.PrimitiveSignature.falseEntry ∧
+        store.lookup r = some Certified.PrimitiveSignature.falseDeclaration ∨
+    r = signature.falseElim ∧ entry = signature.falseElimEntry ∧ store.lookup r = some signature.falseElimDeclaration ∨
+      (∃ kind body,
+          entry.body = some body ∧
+            entry.equations = [] ∧
+              entry.facts = [] ∧
+                store.lookup r = some (Const.defn entry.universes kind entry.type.erase body.erase Safety.safe)) ∨
+        Certified.Ordinary.EntrySource store r entry ∨
+          Certified.Standard.EntrySource store r entry ∨
+            Certified.Quotient.EntrySource store r entry ∨
+              Certified.Structure.EntrySource store r entry ∨
+                Certified.Natural.EntrySource signature.natType store r entry ∨
+                  Certified.Modeled.EntrySource store r entry
+premise constructor Ix.Theory.Certified.Extends.mk
+  type: ∀ {β : Type u} {signature : Certified.PrimitiveSignature β} {entries entries' : Model.Environment β},
+  (∀ (r : ConstRef β) (entry : Model.ConstantEntry β), entries r = some entry → entries' r = some entry) →
+    (∀ (V : Type v) [inst : Model.SetTheory V] (constants : Model.Assignment β V),
+        signature.Compatible entries constants →
+          ∃ constants',
+            signature.Compatible entries' constants' ∧ Model.Assignment.AgreesOn entries constants constants') →
+      Certified.Extends signature entries entries'
+premise constructor Ix.Theory.Certified.AdmittedEnvironment.mk
+  type: {β : Type u} →
+  {signature : Certified.PrimitiveSignature β} →
+    {store : Store β} →
+      (entries : Model.Environment β) →
+        entries.WF →
+          signature.Present entries →
+            (∀ (r : ConstRef β) (entry : Model.ConstantEntry β),
+                entries r = some entry → Certified.EntrySource signature store r entry) →
+              (∀ (V : Type v) [inst : Model.SetTheory V], ∃ constants, signature.Compatible entries constants) →
+                Certified.AdmittedEnvironment signature store
+premise constructor Ix.Theory.Certified.CheckedClaim.mk
+  type: {claim : Prop} → claim → Certified.CheckedClaim claim
+premise constructor Ix.Theory.Certified.InferenceResult.mk
+  type: {β : Type u} →
+  {entries : Model.Environment β} →
+    {n : Nat} →
+      {Γ : Model.Context β} →
+        {source : VExpr β} →
+          (reading : Model.Reading n (List.length Γ) source) →
+            (type : Model.AExpr β) →
+              Model.AExpr.Scope n (List.length Γ) type →
+                Model.TypingClaim entries Γ reading.val type → Certified.InferenceResult entries n Γ source
+premise constructor Ix.Theory.Certified.WhnfResult.mk
+  type: {β : Type u} →
+  {entries : Model.Environment β} →
+    {n : Nat} →
+      {Γ : Model.Context β} →
+        {source : VExpr β} →
+          (input : Certified.InferenceResult entries n Γ source) →
+            (result : Model.AExpr β) →
+              Model.AExpr.Scope n (List.length Γ) result →
+                Certified.whnfShape entries result = true →
+                  Model.TypingClaim entries Γ result input.type →
+                    Model.ConversionClaim entries Γ input.reading.val result → Certified.WhnfResult entries n Γ source
+premise constructor Ix.Theory.Store.mk
+  type: {β : Type u} →
+  (dom : List β) →
+    dom.Nodup → (blocks : β → Option (Block β)) → (∀ (b : β), (blocks b).isSome = true ↔ b ∈ dom) → Store β
+premise constructor Ix.Theory.Certified.ProofInput.mk
+  type: {β : Type u} → Store β → Nat → VExpr β → VExpr β → Certified.ProofInput β
+premise constructor Ix.Theory.Certified.ProofWitness.mk
+  type: {β : Type u} →
+  List (Certified.DeclarationWitness β) →
+    Model.AnnotationTree →
+      Model.AnnotationTree → Certified.TypingWitness β → Certified.TypingWitness β → Certified.ProofWitness β
+premise constructor Ix.Theory.Certified.CheckedProof.mk
+  type: {β : Type u} →
+  {signature : Certified.PrimitiveSignature β} →
+    {input : Certified.ProofInput β} →
+      (environment : Certified.AdmittedEnvironment signature input.store) →
+        (proof : Model.Reading input.universes 0 input.proof) →
+          (proposition : Model.Reading input.universes 0 input.proposition) →
+            Model.AExpr.ReferencesIn environment.entries proof.val →
+              Model.AExpr.ReferencesIn environment.entries proposition.val →
+                Model.TypingClaim environment.entries [] proof.val proposition.val →
+                  Model.TypingClaim environment.entries [] proposition.val (Model.AExpr.sort VLevel.zero) →
+                    Certified.CheckedProof signature input
+compiler recursion worker Ix.Theory.Certified.admitDefinitions?._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (state : Certified.AdmittedEnvironment signature store) →
+            List (Certified.DefinitionWitness β) →
+              Option { result // Certified.Extends signature state.entries result.entries }
+  implementation: fun {β} [DecidableEq β] fuel {signature} {store} state x =>
+  match x with
+  | [] => some ⟨state, ⋯⟩
+  | witness :: rest => do
+    let step ← Certified.admitDefinition? fuel state witness
+    let rest ← Certified.admitDefinitions?._unsafe_rec fuel step.val rest
+    pure ⟨rest.val, ⋯⟩
+compiler recursion worker Ix.Theory.Certified.checkDeclarationExtensions?._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (state : Certified.CheckedInterface signature) →
+            List (Certified.DeclarationWitness β) → Option (Certified.CheckedExtension signature store state)
+  implementation: fun {β} [DecidableEq β] fuel {signature} {store} state x =>
+  match x with
+  | [] => some (Certified.CheckedExtension.refl state)
+  | witness :: rest => do
+    let step ← Certified.checkDeclarationExtension? fuel state witness
+    let rest ← Certified.checkDeclarationExtensions?._unsafe_rec fuel step.result rest
+    pure (step.trans rest)
+compiler recursion worker Ix.Theory.Certified.replayDeclarations?._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (state : Certified.CheckedInterface signature) →
+            List (Certified.DeclarationWitness β) → Option (Certified.CheckedExtension signature store state)
+  implementation: fun {β} [DecidableEq β] fuel {signature} {store} state x =>
+  match x with
+  | [] => some (Certified.CheckedExtension.refl state)
+  | witness :: rest =>
+    have __do_jp := fun step => do
+      let rest ← Certified.replayDeclarations?._unsafe_rec fuel step.result rest
+      pure (step.trans rest);
+    if (witness.outputs.all fun ref => (state.entries ref).isSome) = true then do
+      let step ← some (Certified.CheckedExtension.refl state)
+      __do_jp step
+    else do
+      let step ← Certified.checkDeclarationExtension? fuel state witness
+      __do_jp step
+compiler recursion worker Ix.Theory.Certified.replayNodes?._unsafe_rec
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    {fuel : Nat} →
+      {signature : Certified.PrimitiveSignature β} →
+        {store : Store β} →
+          (state : Certified.CheckedInterface signature) →
+            (known : List (ConstRef β)) →
+              (nodes : List (Certified.CheckedNode fuel signature store)) →
+                Option (Certified.ReplayResult state known nodes)
+  implementation: fun {β} [DecidableEq β] {fuel} {signature} {store} state known x =>
+  match x with
+  | [] => some { checked := Certified.CheckedExtension.refl state, order := ⋯, subjects := ⋯, frontiers := ⋯ }
+  | node :: nodes =>
+    if available : (node.receipt.frontier.refs.all fun x => known.contains x) = true then
+      if aligned :
+          (node.receipt.frontier.headers.all fun h => decide (Certified.HeaderPresent state.entries h)) = true then do
+        let step ← Certified.replayDeclarations? fuel state node.input.declarations
+        if present : (node.input.subjects.all fun ref => (step.result.entries ref).isSome) = true then do
+            let tail ← Certified.replayNodes?._unsafe_rec step.result (known ++ node.input.subjects) nodes
+            pure { checked := step.trans tail.checked, order := ⋯, subjects := ⋯, frontiers := ⋯ }
+          else none
+      else none
+    else none
+compiler recursion worker Ix.Theory.Certified.verifyArguments._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Model.Environment β) →
+          (Γ : Model.Context β) →
+            (domains args : List (Model.AExpr β)) →
+              List (Certified.TypingWitness β) →
+                Option (Certified.CheckedClaim (Certified.ArgumentsFit entries Γ domains args))
+  implementation: fun {β} [DecidableEq β] fuel n entries Γ x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | [], [], [] => some { down := ⋯ }
+  | A :: domains, a :: args, witness :: witnesses => do
+    let ha ← Certified.verifyType fuel n entries Γ a A witness
+    let hrest ← Certified.verifyArguments._unsafe_rec fuel n entries Γ (Model.Telescope.inst a domains) args witnesses
+    pure { down := ⋯ }
+  | x, x_3, x_4 => none
+compiler recursion worker Ix.Theory.Certified.verifyConversion._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Model.Environment β) →
+          (Γ : Model.Context β) →
+            (a b : Model.AExpr β) →
+              Certified.ConversionWitness β → Option (Certified.CheckedClaim (Model.ConversionClaim entries Γ a b))
+  implementation: fun {β} [inst : DecidableEq β] fuel n entries Γ a b witness =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    if Model.AExpr.Scope n (List.length Γ) a ∧ Model.AExpr.Scope n (List.length Γ) b then
+      match a, b, witness with
+      | a, b, Certified.ConversionWitness.refl => if h : a = b then some { down := ⋯ } else none
+      | a, b, w.symm => do
+        let h ← Certified.verifyConversion._unsafe_rec fuel n entries Γ b a w
+        pure { down := ⋯ }
+      | a, b, Certified.ConversionWitness.trans c w₁ w₂ => do
+        let h₁ ← Certified.verifyConversion._unsafe_rec fuel n entries Γ a c w₁
+        let h₂ ← Certified.verifyConversion._unsafe_rec fuel n entries Γ c b w₂
+        pure { down := ⋯ }
+      | f.app a, f'.app a', wf.app wa => do
+        let hf ← Certified.verifyConversion._unsafe_rec fuel n entries Γ f f' wf
+        let ha ← Certified.verifyConversion._unsafe_rec fuel n entries Γ a a' wa
+        pure { down := ⋯ }
+      | Model.AExpr.proj r i a, Model.AExpr.proj r' i' b, w.proj =>
+        if hr : r = r' then
+          if hi : i = i' then do
+            let h ← Certified.verifyConversion._unsafe_rec fuel n entries Γ a b w
+            pure { down := ⋯ }
+          else none
+        else none
+      | Model.AExpr.lam p D body, Model.AExpr.lam p' D' body', Certified.ConversionWitness.lam lD wD wd wb =>
+        if hp : p = p' then do
+          let hD ← Certified.verifyType._unsafe_rec fuel n entries Γ D (Model.AExpr.sort lD) wD
+          let hd ← Certified.verifyConversion._unsafe_rec fuel n entries Γ D D' wd
+          let hb ← Certified.verifyConversion._unsafe_rec fuel n entries (Model.Context.push D Γ) body body' wb
+          pure { down := ⋯ }
+        else none
+      | Model.AExpr.forallE p D B, Model.AExpr.forallE p' D' B', Certified.ConversionWitness.forallE lD wD wd wb =>
+        if hp : p = p' then do
+          let hD ← Certified.verifyType._unsafe_rec fuel n entries Γ D (Model.AExpr.sort lD) wD
+          let hd ← Certified.verifyConversion._unsafe_rec fuel n entries Γ D D' wd
+          let hb ← Certified.verifyConversion._unsafe_rec fuel n entries (Model.Context.push D Γ) B B' wb
+          pure { down := ⋯ }
+        else none
+      | (Model.AExpr.lam p D body).app arg, result, Certified.ConversionWitness.beta T wl wa =>
+        if hr : result = body.inst arg then do
+          let hl ← Certified.verifyType._unsafe_rec fuel n entries Γ (Model.AExpr.lam p D body) T wl
+          let ha ← Certified.verifyType._unsafe_rec fuel n entries Γ arg D wa
+          pure { down := ⋯ }
+        else none
+      | Model.AExpr.lam p D body, f, Certified.ConversionWitness.eta B wf =>
+        if hb : body = (Model.AExpr.liftN 1 f).app (Model.AExpr.bvar 0) then do
+          let hf ← Certified.verifyType._unsafe_rec fuel n entries Γ f (Model.AExpr.forallE p D B) wf
+          pure { down := ⋯ }
+        else none
+      | a, b, Certified.ConversionWitness.proofIrrel A wA wa wb => do
+        let hA ← Certified.verifyType._unsafe_rec fuel n entries Γ A (Model.AExpr.sort VLevel.zero) wA
+        let ha ← Certified.verifyType._unsafe_rec fuel n entries Γ a A wa
+        let hb ← Certified.verifyType._unsafe_rec fuel n entries Γ b A wb
+        pure { down := ⋯ }
+      | Model.AExpr.const r ls, b, Certified.ConversionWitness.delta =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match h_1 : entry.body with
+          | none => none
+          | some body =>
+            if hn : ls.length = entry.universes then
+              if hB : b = Model.AExpr.instL ls body then some { down := ⋯ } else none
+            else none
+      | Model.AExpr.sort l, Model.AExpr.sort l', Certified.ConversionWitness.sort =>
+        if h : Certified.LevelEq.check n l l' = true then some { down := ⋯ } else none
+      | a, b, Certified.ConversionWitness.equation r index ls =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match he : entry.equations[index]? with
+          | none => none
+          | some law =>
+            if hn : ls.length = entry.universes then
+              if hls : ∀ (l : VLevel), l ∈ ls → VLevel.WF n l then
+                if ha : a = Model.AExpr.instL ls law.lhs then
+                  if hb : b = Model.AExpr.instL ls law.rhs then some { down := ⋯ } else none
+                else none
+              else none
+            else none
+      | Model.AExpr.natLit value, result, Certified.ConversionWitness.natLiteral r index =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (Model.ConstantFact.natural zero succ) =>
+            if hn : entry.universes = 0 then
+              match value with
+              | 0 => if he : result = Model.AExpr.const zero [] then some { down := ⋯ } else none
+              | value.succ =>
+                if he : result = (Model.AExpr.const succ []).app (Model.AExpr.natLit value) then some { down := ⋯ }
+                else none
+            else none
+          | x => none
+      | x, x_1, x_2 => none
+    else none
+compiler recursion worker Ix.Theory.Certified.verifyPropTelescope._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Model.Environment β) →
+          (atLevel : VLevel) →
+            (Γ : Model.Context β) →
+              (domains : List (Model.AExpr β)) →
+                List (Certified.DomainWitness β) →
+                  Option (Certified.CheckedClaim (Certified.TelescopeProp entries Γ domains atLevel))
+  implementation: fun {β} [DecidableEq β] fuel n entries atLevel x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Γ, [], [] => some { down := ⋯ }
+  | Γ, A :: rest, witness :: witnesses =>
+    if hl : Certified.checkZeroImplies atLevel witness.level = true then do
+      let hA ← Certified.verifyType fuel n entries Γ A (Model.AExpr.sort witness.level) witness.typing
+      let htail ←
+        Certified.verifyPropTelescope._unsafe_rec fuel n entries atLevel (Model.Context.push A Γ) rest witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_3, x_4 => none
+compiler recursion worker Ix.Theory.Certified.verifyTelescope._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Model.Environment β) →
+          (bound : Option VLevel) →
+            (Γ : Model.Context β) →
+              (domains : List (Model.AExpr β)) →
+                List (Certified.DomainWitness β) →
+                  Option
+                    (Certified.CheckedClaim
+                      (Model.Telescope.Formed entries Γ domains ∧ Certified.TelescopeBound entries Γ domains bound))
+  implementation: fun {β} [DecidableEq β] fuel n entries bound x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Γ, [], [] => some { down := ⋯ }
+  | Γ, A :: rest, witness :: witnesses =>
+    if hl : Certified.checkDomainBound n bound witness.level = true then do
+      let hA ← Certified.verifyType fuel n entries Γ A (Model.AExpr.sort witness.level) witness.typing
+      let hrest ← Certified.verifyTelescope._unsafe_rec fuel n entries bound (Model.Context.push A Γ) rest witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_3, x_4 => none
+compiler recursion worker Ix.Theory.Certified.verifyType._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Model.Environment β) →
+          (Γ : Model.Context β) →
+            (e A : Model.AExpr β) →
+              Certified.TypingWitness β → Option (Certified.CheckedClaim (Model.TypingClaim entries Γ e A))
+  implementation: fun {β} [inst : DecidableEq β] fuel n entries Γ e A witness =>
+  match fuel with
+  | 0 => none
+  | fuel.succ =>
+    if Model.AExpr.Scope n (List.length Γ) e ∧ Model.AExpr.Scope n (List.length Γ) A then
+      match e, witness with
+      | Model.AExpr.sort l, Certified.TypingWitness.sort =>
+        if h : A = Model.AExpr.sort l.succ then some { down := ⋯ } else none
+      | Model.AExpr.bvar i, Certified.TypingWitness.bvar =>
+        match h : Γ[i]? with
+        | none => none
+        | some B => if hA : A = B then some { down := ⋯ } else none
+      | Model.AExpr.const r ls, Certified.TypingWitness.const =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          if hn : ls.length = entry.universes then
+            if hA : A = Model.AExpr.instL ls entry.type then some { down := ⋯ } else none
+          else none
+      | f.app a, Certified.TypingWitness.app p D B wf wa =>
+        if hA : A = B.inst a then do
+          let hf ← Certified.verifyType._unsafe_rec fuel n entries Γ f (Model.AExpr.forallE p D B) wf
+          let ha ← Certified.verifyType._unsafe_rec fuel n entries Γ a D wa
+          pure { down := ⋯ }
+        else none
+      | Model.AExpr.lam p D body, Certified.TypingWitness.lam lD lB B wD wB wb =>
+        if hp : p = Certified.zeroCondition lB then
+          if hA : A = Model.AExpr.forallE p D B then do
+            let hD ← Certified.verifyType._unsafe_rec fuel n entries Γ D (Model.AExpr.sort lD) wD
+            let hB ← Certified.verifyType._unsafe_rec fuel n entries (Model.Context.push D Γ) B (Model.AExpr.sort lB) wB
+            let hb ← Certified.verifyType._unsafe_rec fuel n entries (Model.Context.push D Γ) body B wb
+            pure { down := ⋯ }
+          else none
+        else none
+      | Model.AExpr.forallE p D B, Certified.TypingWitness.forallE lD lB wD wB =>
+        if hp : p = Certified.zeroCondition lB then
+          if hA : A = Model.AExpr.sort (lD.imax lB) then do
+            let hD ← Certified.verifyType._unsafe_rec fuel n entries Γ D (Model.AExpr.sort lD) wD
+            let hB ← Certified.verifyType._unsafe_rec fuel n entries (Model.Context.push D Γ) B (Model.AExpr.sort lB) wB
+            pure { down := ⋯ }
+          else none
+        else none
+      | e, Certified.TypingWitness.conv B lA we wA wc => do
+        let he ← Certified.verifyType._unsafe_rec fuel n entries Γ e B we
+        let hA ← Certified.verifyType._unsafe_rec fuel n entries Γ A (Model.AExpr.sort lA) wA
+        let hc ← Certified.verifyConversion._unsafe_rec fuel n entries Γ B A wc
+        pure { down := ⋯ }
+      | e, Certified.TypingWitness.fact r index ls =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (Model.ConstantFact.typed value type) =>
+            if hn : ls.length = entry.universes then
+              if ∀ (l : VLevel), l ∈ ls → VLevel.WF n l then
+                if he : e = Model.AExpr.instL ls value then
+                  if hA : A = Model.AExpr.instL ls type then some { down := ⋯ } else none
+                else none
+              else none
+            else none
+          | x => none
+      | Model.AExpr.natLit value, Certified.TypingWitness.natLit r index =>
+        match h : entries r with
+        | none => none
+        | some entry =>
+          match hf : entry.facts[index]? with
+          | some (Model.ConstantFact.natural zero succ) =>
+            if hn : entry.universes = 0 then if hA : A = Model.AExpr.const r [] then some { down := ⋯ } else none
+            else none
+          | x => none
+      | e, Certified.TypingWitness.betaResult p D body arg B wl wa =>
+        if he : e = body.inst arg then
+          if hA : A = B.inst arg then do
+            let hl ←
+              Certified.verifyType._unsafe_rec fuel n entries Γ (Model.AExpr.lam p D body) (Model.AExpr.forallE p D B)
+                  wl
+            let ha ← Certified.verifyType._unsafe_rec fuel n entries Γ arg D wa
+            pure { down := ⋯ }
+          else none
+        else none
+      | x, x_1 => none
+    else none
+compiler recursion worker Ix.Theory.Certified.whnfShape._unsafe_rec
+  type: {β : Type u} → Model.Environment β → Model.AExpr β → Bool
+  implementation: fun {β} entries x =>
+  match x with
+  | Model.AExpr.bvar index => true
+  | Model.AExpr.sort level => true
+  | Model.AExpr.lam condition domain body => true
+  | Model.AExpr.forallE condition domain body => true
+  | Model.AExpr.const r levels => Option.any (fun entry => entry.body.isNone) (entries r)
+  | (Model.AExpr.lam condition domain body).app arg => false
+  | f.app arg => Certified.whnfShape._unsafe_rec entries f
+  | Model.AExpr.natLit value => false
+  | Model.AExpr.proj ref field major => false
+compiler recursion worker Ix.Theory.Certified.zeroCondition._unsafe_rec
+  type: VLevel → Certified.PropWhen
+  implementation: fun x =>
+  match x with
+  | VLevel.zero => Certified.PropWhen.always
+  | a.succ => Certified.PropWhen.never
+  | a.max b => (Certified.zeroCondition._unsafe_rec a).inter (Certified.zeroCondition._unsafe_rec b)
+  | a.imax b => Certified.zeroCondition._unsafe_rec b
+  | VLevel.param i => Certified.PropWhen.param i
+compiler recursion worker Ix.Theory.Lift.comp._unsafe_rec
+  type: Lift → Lift → Lift
+  implementation: fun l₁ l₂ =>
+  match l₂, l₁ with
+  | Lift.refl, l₁ => l₁
+  | l₂.skip, l₁ => (Lift.comp._unsafe_rec l₁ l₂).skip
+  | l₂.cons, Lift.refl => l₂.cons
+  | l₂.cons, l₁.skip => (Lift.comp._unsafe_rec l₁ l₂).skip
+  | l₂.cons, l₁.cons => (Lift.comp._unsafe_rec l₁ l₂).cons
+compiler recursion worker Ix.Theory.Lift.consN._unsafe_rec
+  type: Lift → Nat → Lift
+  implementation: fun l x =>
+  match x with
+  | 0 => l
+  | n.succ => (Lift.consN._unsafe_rec l n).cons
+compiler recursion worker Ix.Theory.Lift.depth._unsafe_rec
+  type: Lift → Nat
+  implementation: fun x =>
+  match x with
+  | Lift.refl => 0
+  | l.skip => Lift.depth._unsafe_rec l + 1
+  | l.cons => Lift.depth._unsafe_rec l
+compiler recursion worker Ix.Theory.Lift.diff._unsafe_rec
+  type: Lift → Lift → Lift
+  implementation: fun x x_1 =>
+  match x, x_1 with
+  | Lift.refl, x => Lift.refl
+  | l, Lift.refl => l
+  | l₁.skip, l₂.skip => Lift.diff._unsafe_rec l₁ l₂
+  | l₁.cons, l₂.skip => Lift.diff._unsafe_rec l₁ l₂
+  | l₁.skip, l₂.cons => (Lift.diff._unsafe_rec l₁ l₂).skip
+  | l₁.cons, l₂.cons => (Lift.diff._unsafe_rec l₁ l₂).cons
+compiler recursion worker Ix.Theory.Lift.dom._unsafe_rec
+  type: Lift → Nat
+  implementation: fun x =>
+  match x with
+  | Lift.refl => 0
+  | l.skip => Lift.dom._unsafe_rec l
+  | l.cons => Lift.dom._unsafe_rec l + 1
+compiler recursion worker Ix.Theory.Lift.liftVar._unsafe_rec
+  type: Lift → Nat → Nat
+  implementation: fun x x_1 =>
+  match x, x_1 with
+  | Lift.refl, n => n
+  | l.skip, n => Lift.liftVar._unsafe_rec l n + 1
+  | tail.cons, 0 => 0
+  | l.cons, n.succ => Lift.liftVar._unsafe_rec l n + 1
+compiler recursion worker Ix.Theory.Lift.size._unsafe_rec
+  type: Lift → Nat
+  implementation: fun x =>
+  match x with
+  | Lift.refl => 0
+  | l.skip => Lift.size._unsafe_rec l + 1
+  | l.cons => Lift.size._unsafe_rec l + 1
+compiler recursion worker Ix.Theory.Lift.skipN._unsafe_rec
+  type: Lift → Nat → Lift
+  implementation: fun l x =>
+  match x with
+  | 0 => l
+  | n.succ => (Lift.skipN._unsafe_rec l n).skip
+compiler recursion worker Ix.Theory.Model.WellDenoted._unsafe_rec
+  type: {β : Type u} →
+  {V : Type v} → [Model.SetTheory V] → Model.Assignment β V → List Nat → (Nat → V) → Model.AExpr β → Prop
+  implementation: fun {β} {V} [Model.SetTheory V] constants levels env x =>
+  match x with
+  | Model.AExpr.bvar index => True
+  | Model.AExpr.sort level => True
+  | Model.AExpr.const ref levels => True
+  | f.app a =>
+    Model.WellDenoted._unsafe_rec constants levels env f ∧
+      Model.WellDenoted._unsafe_rec constants levels env a ∧
+        ∃ v A B,
+          Model.SetTheory.Mem (Model.interp constants levels env f) (Model.SetModel.piR v A B) ∧
+            Model.SetTheory.Mem (Model.interp constants levels env a) A ∧
+              ∀ (x : V), Model.SetTheory.Mem x A → Model.SetTheory.Mem (B x) (Model.SetTheory.univ v)
+  | Model.AExpr.lam p A b =>
+    Model.WellDenoted._unsafe_rec constants levels env A ∧
+      (∀ (x : V),
+          Model.SetTheory.Mem x (Model.interp constants levels env A) →
+            Model.WellDenoted._unsafe_rec constants levels (Model.Valuation.cons x env) b) ∧
+        ∃ v B,
+          (Model.regime p levels = 0 ↔ v = 0) ∧
+            ∀ (x : V),
+              Model.SetTheory.Mem x (Model.interp constants levels env A) →
+                Model.SetTheory.Mem (Model.interp constants levels (Model.Valuation.cons x env) b) (B x) ∧
+                  Model.SetTheory.Mem (B x) (Model.SetTheory.univ v)
+  | Model.AExpr.forallE p A B =>
+    Model.WellDenoted._unsafe_rec constants levels env A ∧
+      (∀ (x : V),
+          Model.SetTheory.Mem x (Model.interp constants levels env A) →
+            Model.WellDenoted._unsafe_rec constants levels (Model.Valuation.cons x env) B) ∧
+        ∃ v,
+          (Model.regime p levels = 0 ↔ v = 0) ∧
+            ∀ (x : V),
+              Model.SetTheory.Mem x (Model.interp constants levels env A) →
+                Model.SetTheory.Mem (Model.interp constants levels (Model.Valuation.cons x env) B)
+                  (Model.SetTheory.univ v)
+  | Model.AExpr.proj ref field e => Model.WellDenoted._unsafe_rec constants levels env e
+  | Model.AExpr.natLit value => True
+compiler recursion worker Ix.Theory.Model.readAnnotations?._unsafe_rec
+  type: {β : Type u} → (n k : Nat) → (source : VExpr β) → Model.AnnotationTree → Option (Model.Reading n k source)
+  implementation: fun {β} n k source tree =>
+  match source, tree with
+  | VExpr.bvar i, Model.AnnotationTree.leaf => if h : i < k then some ⟨Model.AExpr.bvar i, ⋯⟩ else none
+  | VExpr.sort l, Model.AnnotationTree.leaf => if h : VLevel.WF n l then some ⟨Model.AExpr.sort l, ⋯⟩ else none
+  | VExpr.const r ls, Model.AnnotationTree.leaf =>
+    if h : ∀ (l : VLevel), l ∈ ls → VLevel.WF n l then some ⟨Model.AExpr.const r ls, ⋯⟩ else none
+  | f.app a, tf.app ta => do
+    let f' ← Model.readAnnotations?._unsafe_rec n k f tf
+    let a' ← Model.readAnnotations?._unsafe_rec n k a ta
+    pure ⟨f'.val.app a'.val, ⋯⟩
+  | a.lam b, Model.AnnotationTree.lam raw ta tb =>
+    match Ix.Theory.Model.readCondition?✝ n raw with
+    | none => none
+    | some p => do
+      let a' ← Model.readAnnotations?._unsafe_rec n k a ta
+      let b' ← Model.readAnnotations?._unsafe_rec n (k + 1) b tb
+      pure ⟨Model.AExpr.lam p.val a'.val b'.val, ⋯⟩
+  | a.forallE b, Model.AnnotationTree.forallE raw ta tb =>
+    match Ix.Theory.Model.readCondition?✝ n raw with
+    | none => none
+    | some p => do
+      let a' ← Model.readAnnotations?._unsafe_rec n k a ta
+      let b' ← Model.readAnnotations?._unsafe_rec n (k + 1) b tb
+      pure ⟨Model.AExpr.forallE p.val a'.val b'.val, ⋯⟩
+  | VExpr.proj r i e, te.proj => do
+    let e' ← Model.readAnnotations?._unsafe_rec n k e te
+    pure ⟨Model.AExpr.proj r i e'.val, ⋯⟩
+  | VExpr.natLit v, Model.AnnotationTree.leaf => some ⟨Model.AExpr.natLit v, ⋯⟩
+  | x, x_1 => none
+compiler recursion worker Ix.Theory.VExpr.ClosedN._unsafe_rec
+  type: {β : Type u_1} → VExpr β → optParam Nat 0 → Prop
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | VExpr.bvar i, k => i < k
+  | VExpr.sort u, x => True
+  | VExpr.const ref levels, x => True
+  | VExpr.natLit value, x => True
+  | fn.app arg, k => VExpr.ClosedN._unsafe_rec fn k ∧ VExpr.ClosedN._unsafe_rec arg k
+  | ty.lam body, k => VExpr.ClosedN._unsafe_rec ty k ∧ VExpr.ClosedN._unsafe_rec body (k + 1)
+  | ty.forallE body, k => VExpr.ClosedN._unsafe_rec ty k ∧ VExpr.ClosedN._unsafe_rec body (k + 1)
+  | VExpr.proj ref index e, k => VExpr.ClosedN._unsafe_rec e k
+compiler recursion worker Ix.Theory.VExpr.LevelWF._unsafe_rec
+  type: {β : Type u_1} → Nat → VExpr β → Prop
+  implementation: fun {β} U x =>
+  match x with
+  | VExpr.bvar deBruijnIndex => True
+  | VExpr.natLit value => True
+  | VExpr.sort l => VLevel.WF U l
+  | VExpr.const ref levels => ∀ (l : VLevel), l ∈ levels → VLevel.WF U l
+  | e₁.app e₂ => VExpr.LevelWF._unsafe_rec U e₁ ∧ VExpr.LevelWF._unsafe_rec U e₂
+  | e₁.lam e₂ => VExpr.LevelWF._unsafe_rec U e₁ ∧ VExpr.LevelWF._unsafe_rec U e₂
+  | e₁.forallE e₂ => VExpr.LevelWF._unsafe_rec U e₁ ∧ VExpr.LevelWF._unsafe_rec U e₂
+  | VExpr.proj ref index e => VExpr.LevelWF._unsafe_rec U e
+compiler recursion worker Ix.Theory.VExpr.Skips'._unsafe_rec
+  type: {β : Type u_1} → Nat → VExpr β → optParam Nat 0 → Prop
+  implementation: fun {β} n x x_1 =>
+  match x, x_1 with
+  | VExpr.bvar i, k => i < k + n → i < k
+  | VExpr.sort u, x => True
+  | VExpr.const ref levels, x => True
+  | VExpr.natLit value, x => True
+  | fn.app arg, k => VExpr.Skips'._unsafe_rec n fn k ∧ VExpr.Skips'._unsafe_rec n arg k
+  | ty.lam body, k => VExpr.Skips'._unsafe_rec n ty k ∧ VExpr.Skips'._unsafe_rec n body (k + 1)
+  | ty.forallE body, k => VExpr.Skips'._unsafe_rec n ty k ∧ VExpr.Skips'._unsafe_rec n body (k + 1)
+  | VExpr.proj ref index e, k => VExpr.Skips'._unsafe_rec n e k
+compiler recursion worker Ix.Theory.VExpr.appArgs._unsafe_rec
+  type: {β : Type u_1} → VExpr β → List (VExpr β) → List (VExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | f.app a, acc => VExpr.appArgs._unsafe_rec f (a :: acc)
+  | x, acc => acc
+compiler recursion worker Ix.Theory.VExpr.appHead._unsafe_rec
+  type: {β : Type u_1} → VExpr β → VExpr β
+  implementation: fun {β} x =>
+  match x with
+  | f.app arg => VExpr.appHead._unsafe_rec f
+  | e => e
+compiler recursion worker Ix.Theory.VExpr.appN._unsafe_rec
+  type: {β : Type u_1} → VExpr β → List (VExpr β) → VExpr β
+  implementation: fun {β} f x =>
+  match x with
+  | [] => f
+  | a :: as => VExpr.appN._unsafe_rec (f.app a) as
+compiler recursion worker Ix.Theory.VExpr.bvarRevRange._unsafe_rec
+  type: {β : Type u_1} → Nat → Nat → List (VExpr β)
+  implementation: fun {β} off x =>
+  match x with
+  | 0 => []
+  | m.succ => VExpr.bvar (off + m) :: VExpr.bvarRevRange._unsafe_rec off m
+compiler recursion worker Ix.Theory.VExpr.dropN._unsafe_rec
+  type: {β : Type u_1} → Nat → VExpr β → VExpr β
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, e => e
+  | n.succ, binderType.forallE rest => VExpr.dropN._unsafe_rec n rest
+  | n.succ, e => e
+compiler recursion worker Ix.Theory.VExpr.forallN._unsafe_rec
+  type: {β : Type u_1} → List (VExpr β) → VExpr β → VExpr β
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | [], e => e
+  | A :: As, e => A.forallE (VExpr.forallN._unsafe_rec As e)
+compiler recursion worker Ix.Theory.VExpr.inst._unsafe_rec
+  type: {β : Type u_1} → VExpr β → VExpr β → optParam Nat 0 → VExpr β
+  implementation: fun {β} x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | VExpr.bvar i, e, k => VExpr.instVar i e k
+  | VExpr.sort u, x, x_3 => VExpr.sort u
+  | VExpr.const r us, x, x_3 => VExpr.const r us
+  | fn.app arg, e, k => (VExpr.inst._unsafe_rec fn e k).app (VExpr.inst._unsafe_rec arg e k)
+  | ty.lam body, e, k => (VExpr.inst._unsafe_rec ty e k).lam (VExpr.inst._unsafe_rec body e (k + 1))
+  | ty.forallE body, e, k => (VExpr.inst._unsafe_rec ty e k).forallE (VExpr.inst._unsafe_rec body e (k + 1))
+  | VExpr.proj r i p, e, k => VExpr.proj r i (VExpr.inst._unsafe_rec p e k)
+  | VExpr.natLit value, x, x_3 => VExpr.natLit value
+compiler recursion worker Ix.Theory.VExpr.instL._unsafe_rec
+  type: List VLevel → {β : Type u_1} → VExpr β → VExpr β
+  implementation: fun levels {β} x =>
+  match x with
+  | VExpr.bvar i => VExpr.bvar i
+  | VExpr.sort u => VExpr.sort (VLevel.inst levels u)
+  | VExpr.const r us => VExpr.const r (List.map (VLevel.inst levels) us)
+  | fn.app arg => (VExpr.instL._unsafe_rec levels fn).app (VExpr.instL._unsafe_rec levels arg)
+  | ty.lam body => (VExpr.instL._unsafe_rec levels ty).lam (VExpr.instL._unsafe_rec levels body)
+  | ty.forallE body => (VExpr.instL._unsafe_rec levels ty).forallE (VExpr.instL._unsafe_rec levels body)
+  | VExpr.proj r i e => VExpr.proj r i (VExpr.instL._unsafe_rec levels e)
+  | VExpr.natLit value => VExpr.natLit value
+compiler recursion worker Ix.Theory.VExpr.instRev._unsafe_rec
+  type: {β : Type u_1} → VExpr β → List (VExpr β) → VExpr β
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | C, [] => C
+  | C, e :: es => VExpr.instRev._unsafe_rec (C.inst e es.length) es
+compiler recursion worker Ix.Theory.VExpr.instRevAt._unsafe_rec
+  type: {β : Type u_1} → VExpr β → List (VExpr β) → Nat → VExpr β
+  implementation: fun {β} x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | e, [], x => e
+  | e, a :: as, k => VExpr.instRevAt._unsafe_rec (e.inst a (k + as.length)) as k
+compiler recursion worker Ix.Theory.VExpr.instTelN._unsafe_rec
+  type: {β : Type u_1} → VExpr β → List (VExpr β) → Nat → List (VExpr β)
+  implementation: fun {β} a x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: As, k => A.inst a k :: VExpr.instTelN._unsafe_rec a As (k + 1)
+compiler recursion worker Ix.Theory.VExpr.lamN._unsafe_rec
+  type: {β : Type u_1} → List (VExpr β) → VExpr β → VExpr β
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | [], e => e
+  | A :: As, e => A.lam (VExpr.lamN._unsafe_rec As e)
+compiler recursion worker Ix.Theory.VExpr.lift'._unsafe_rec
+  type: {β : Type u_1} → VExpr β → Lift → VExpr β
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | VExpr.bvar i, ρ => VExpr.bvar (ρ.liftVar i)
+  | VExpr.sort u, x => VExpr.sort u
+  | VExpr.const r us, x => VExpr.const r us
+  | fn.app arg, ρ => (VExpr.lift'._unsafe_rec fn ρ).app (VExpr.lift'._unsafe_rec arg ρ)
+  | ty.lam body, ρ => (VExpr.lift'._unsafe_rec ty ρ).lam (VExpr.lift'._unsafe_rec body ρ.cons)
+  | ty.forallE body, ρ => (VExpr.lift'._unsafe_rec ty ρ).forallE (VExpr.lift'._unsafe_rec body ρ.cons)
+  | VExpr.proj r i e, ρ => VExpr.proj r i (VExpr.lift'._unsafe_rec e ρ)
+  | VExpr.natLit value, x => VExpr.natLit value
+compiler recursion worker Ix.Theory.VExpr.liftN._unsafe_rec
+  type: Nat → {β : Type u_1} → VExpr β → optParam Nat 0 → VExpr β
+  implementation: fun n {β} x x_1 =>
+  match x, x_1 with
+  | VExpr.bvar i, k => VExpr.bvar (liftVar n i k)
+  | VExpr.sort u, x => VExpr.sort u
+  | VExpr.const r us, x => VExpr.const r us
+  | fn.app arg, k => (VExpr.liftN._unsafe_rec n fn k).app (VExpr.liftN._unsafe_rec n arg k)
+  | ty.lam body, k => (VExpr.liftN._unsafe_rec n ty k).lam (VExpr.liftN._unsafe_rec n body (k + 1))
+  | ty.forallE body, k => (VExpr.liftN._unsafe_rec n ty k).forallE (VExpr.liftN._unsafe_rec n body (k + 1))
+  | VExpr.proj r i e, k => VExpr.proj r i (VExpr.liftN._unsafe_rec n e k)
+  | VExpr.natLit value, x => VExpr.natLit value
+compiler recursion worker Ix.Theory.VExpr.liftTelN._unsafe_rec
+  type: {β : Type u_1} → Nat → List (VExpr β) → Nat → List (VExpr β)
+  implementation: fun {β} n x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: As, k => VExpr.liftN n A k :: VExpr.liftTelN._unsafe_rec n As (k + 1)
+compiler recursion worker Ix.Theory.VExpr.mapRefs._unsafe_rec
+  type: {β : Type u} → {γ : Type v} → (ConstRef β → ConstRef γ) → VExpr β → VExpr γ
+  implementation: fun {β} {γ} mapping x =>
+  match x with
+  | VExpr.bvar i => VExpr.bvar i
+  | VExpr.sort level => VExpr.sort level
+  | VExpr.const ref levels => VExpr.const (mapping ref) levels
+  | f.app a => (VExpr.mapRefs._unsafe_rec mapping f).app (VExpr.mapRefs._unsafe_rec mapping a)
+  | type.lam body => (VExpr.mapRefs._unsafe_rec mapping type).lam (VExpr.mapRefs._unsafe_rec mapping body)
+  | type.forallE body => (VExpr.mapRefs._unsafe_rec mapping type).forallE (VExpr.mapRefs._unsafe_rec mapping body)
+  | VExpr.proj ref index major => VExpr.proj (mapping ref) index (VExpr.mapRefs._unsafe_rec mapping major)
+  | VExpr.natLit n => VExpr.natLit n
+compiler recursion worker Ix.Theory.VExpr.mentions._unsafe_rec
+  type: {β : Type u_1} → [DecidableEq β] → VExpr β → ConstRef β → Bool
+  implementation: fun {β} [DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | VExpr.bvar deBruijnIndex, x => false
+  | VExpr.sort u, x => false
+  | VExpr.natLit value, x => false
+  | VExpr.const r levels, target => decide (r = target)
+  | e₁.app e₂, target => VExpr.mentions._unsafe_rec e₁ target || VExpr.mentions._unsafe_rec e₂ target
+  | e₁.lam e₂, target => VExpr.mentions._unsafe_rec e₁ target || VExpr.mentions._unsafe_rec e₂ target
+  | e₁.forallE e₂, target => VExpr.mentions._unsafe_rec e₁ target || VExpr.mentions._unsafe_rec e₂ target
+  | VExpr.proj r index e, target => decide (r = target) || VExpr.mentions._unsafe_rec e target
+compiler recursion worker Ix.Theory.VExpr.refs._unsafe_rec
+  type: {β : Type u_1} → VExpr β → List (ConstRef β)
+  implementation: fun {β} x =>
+  match x with
+  | VExpr.bvar deBruijnIndex => []
+  | VExpr.sort u => []
+  | VExpr.natLit value => []
+  | VExpr.const r levels => [r]
+  | e₁.app e₂ => VExpr.refs._unsafe_rec e₁ ++ VExpr.refs._unsafe_rec e₂
+  | e₁.lam e₂ => VExpr.refs._unsafe_rec e₁ ++ VExpr.refs._unsafe_rec e₂
+  | e₁.forallE e₂ => VExpr.refs._unsafe_rec e₁ ++ VExpr.refs._unsafe_rec e₂
+  | VExpr.proj r index e => r :: VExpr.refs._unsafe_rec e
+compiler recursion worker Ix.Theory.VExpr.rename._unsafe_rec
+  type: {β : Type u_1} → {γ : Type u_2} → (β → γ) → VExpr β → VExpr γ
+  implementation: fun {β} {γ} mapping x =>
+  match x with
+  | VExpr.bvar index => VExpr.bvar index
+  | VExpr.sort level => VExpr.sort level
+  | VExpr.const ref levels => VExpr.const (ConstRef.rename mapping ref) levels
+  | function.app argument => (VExpr.rename._unsafe_rec mapping function).app (VExpr.rename._unsafe_rec mapping argument)
+  | domain.lam body => (VExpr.rename._unsafe_rec mapping domain).lam (VExpr.rename._unsafe_rec mapping body)
+  | domain.forallE body => (VExpr.rename._unsafe_rec mapping domain).forallE (VExpr.rename._unsafe_rec mapping body)
+  | VExpr.proj ref field major =>
+    VExpr.proj (ConstRef.rename mapping ref) field (VExpr.rename._unsafe_rec mapping major)
+  | VExpr.natLit value => VExpr.natLit value
+compiler recursion worker Ix.Theory.VExpr.resultOf._unsafe_rec
+  type: {β : Type u_1} → VExpr β → VExpr β
+  implementation: fun {β} x =>
+  match x with
+  | binderType.forallE rest => VExpr.resultOf._unsafe_rec rest
+  | e => e
+compiler recursion worker Ix.Theory.VExpr.substConst._unsafe_rec
+  type: {β : Type u_1} → (ConstRef β → Option (VExpr β)) → VExpr β → VExpr β
+  implementation: fun {β} interp x =>
+  match x with
+  | VExpr.bvar index => VExpr.bvar index
+  | VExpr.sort level => VExpr.sort level
+  | VExpr.const ref levels =>
+    match interp ref with
+    | some value => VExpr.instL levels value
+    | none => VExpr.const ref levels
+  | function.app argument =>
+    (VExpr.substConst._unsafe_rec interp function).app (VExpr.substConst._unsafe_rec interp argument)
+  | domain.lam body => (VExpr.substConst._unsafe_rec interp domain).lam (VExpr.substConst._unsafe_rec interp body)
+  | domain.forallE body =>
+    (VExpr.substConst._unsafe_rec interp domain).forallE (VExpr.substConst._unsafe_rec interp body)
+  | VExpr.proj ref field expression => VExpr.proj ref field (VExpr.substConst._unsafe_rec interp expression)
+  | VExpr.natLit value => VExpr.natLit value
+compiler recursion worker Ix.Theory.VExpr.telN._unsafe_rec
+  type: {β : Type u_1} → Nat → VExpr β → List (VExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, x => []
+  | n.succ, A.forallE rest => A :: VExpr.telN._unsafe_rec n rest
+  | n.succ, x => []
+compiler recursion worker Ix.Theory.VExpr.unliftN._unsafe_rec
+  type: {β : Type u_1} → VExpr β → Nat → Nat → VExpr β
+  implementation: fun {β} e n k =>
+  match n with
+  | 0 => e
+  | n.succ => VExpr.unliftN._unsafe_rec (e.inst default k) n k
+compiler recursion worker Ix.Theory.VLevel.WF._unsafe_rec
+  type: Nat → VLevel → Prop
+  implementation: fun n x =>
+  match x with
+  | VLevel.zero => True
+  | l.succ => VLevel.WF._unsafe_rec n l
+  | l₁.max l₂ => VLevel.WF._unsafe_rec n l₁ ∧ VLevel.WF._unsafe_rec n l₂
+  | l₁.imax l₂ => VLevel.WF._unsafe_rec n l₁ ∧ VLevel.WF._unsafe_rec n l₂
+  | VLevel.param i => i < n
+compiler recursion worker Ix.Theory.VLevel.decidable_WF._unsafe_rec
+  type: {n : Nat} → {l : VLevel} → Decidable (VLevel.WF n l)
+  implementation: fun {n} x =>
+  match x with
+  | VLevel.zero => instDecidableTrue
+  | l.succ => VLevel.decidable_WF._unsafe_rec
+  | a.max a_1 => instDecidableAnd
+  | a.imax a_1 => instDecidableAnd
+  | VLevel.param a => a.decLt n
+compiler recursion worker Ix.Theory.VLevel.eval._unsafe_rec
+  type: List Nat → VLevel → Nat
+  implementation: fun ls x =>
+  match x with
+  | VLevel.zero => 0
+  | l.succ => VLevel.eval._unsafe_rec ls l + 1
+  | l₁.max l₂ => (VLevel.eval._unsafe_rec ls l₁).max (VLevel.eval._unsafe_rec ls l₂)
+  | l₁.imax l₂ => VLevel.natIMax (VLevel.eval._unsafe_rec ls l₁) (VLevel.eval._unsafe_rec ls l₂)
+  | VLevel.param i => ls.getD i 0
+compiler recursion worker Ix.Theory.VLevel.inst._unsafe_rec
+  type: List VLevel → VLevel → VLevel
+  implementation: fun ls x =>
+  match x with
+  | VLevel.zero => VLevel.zero
+  | l.succ => (VLevel.inst._unsafe_rec ls l).succ
+  | l₁.max l₂ => (VLevel.inst._unsafe_rec ls l₁).max (VLevel.inst._unsafe_rec ls l₂)
+  | l₁.imax l₂ => (VLevel.inst._unsafe_rec ls l₁).imax (VLevel.inst._unsafe_rec ls l₂)
+  | VLevel.param i => ls.getD i VLevel.zero
+compiler recursion worker Ix.Theory.instDecidableEqVExpr.decEq._unsafe_rec
+  type: {β : Type u_1} → [DecidableEq β] → (x x_1 : VExpr β) → Decidable (x = x_1)
+  implementation: fun {β} [inst : DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | VExpr.bvar a, VExpr.bvar b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | VExpr.bvar deBruijnIndex, VExpr.sort u => isFalse ⋯
+  | VExpr.bvar deBruijnIndex, VExpr.const ref levels => isFalse ⋯
+  | VExpr.bvar deBruijnIndex, fn.app arg => isFalse ⋯
+  | VExpr.bvar deBruijnIndex, binderType.lam body => isFalse ⋯
+  | VExpr.bvar deBruijnIndex, binderType.forallE body => isFalse ⋯
+  | VExpr.bvar deBruijnIndex, VExpr.proj ref index expr => isFalse ⋯
+  | VExpr.bvar deBruijnIndex, VExpr.natLit value => isFalse ⋯
+  | VExpr.sort u, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | VExpr.sort a, VExpr.sort b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | VExpr.sort u, VExpr.const ref levels => isFalse ⋯
+  | VExpr.sort u, fn.app arg => isFalse ⋯
+  | VExpr.sort u, binderType.lam body => isFalse ⋯
+  | VExpr.sort u, binderType.forallE body => isFalse ⋯
+  | VExpr.sort u, VExpr.proj ref index expr => isFalse ⋯
+  | VExpr.sort u, VExpr.natLit value => isFalse ⋯
+  | VExpr.const ref levels, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | VExpr.const ref levels, VExpr.sort u => isFalse ⋯
+  | VExpr.const a a_1, VExpr.const b b_1 =>
+    if h : a = b then h ▸ if h : a_1 = b_1 then h ▸ isTrue ⋯ else isFalse ⋯ else isFalse ⋯
+  | VExpr.const ref levels, fn.app arg => isFalse ⋯
+  | VExpr.const ref levels, binderType.lam body => isFalse ⋯
+  | VExpr.const ref levels, binderType.forallE body => isFalse ⋯
+  | VExpr.const ref levels, VExpr.proj ref_1 index expr => isFalse ⋯
+  | VExpr.const ref levels, VExpr.natLit value => isFalse ⋯
+  | fn.app arg, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | fn.app arg, VExpr.sort u => isFalse ⋯
+  | fn.app arg, VExpr.const ref levels => isFalse ⋯
+  | a.app a_1, b.app b_1 =>
+    let inst_1 := instDecidableEqVExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := instDecidableEqVExpr.decEq._unsafe_rec a a;
+        let inst_3 := instDecidableEqVExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := instDecidableEqVExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | fn.app arg, binderType.lam body => isFalse ⋯
+  | fn.app arg, binderType.forallE body => isFalse ⋯
+  | fn.app arg, VExpr.proj ref index expr => isFalse ⋯
+  | fn.app arg, VExpr.natLit value => isFalse ⋯
+  | binderType.lam body, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | binderType.lam body, VExpr.sort u => isFalse ⋯
+  | binderType.lam body, VExpr.const ref levels => isFalse ⋯
+  | binderType.lam body, fn.app arg => isFalse ⋯
+  | a.lam a_1, b.lam b_1 =>
+    let inst_1 := instDecidableEqVExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := instDecidableEqVExpr.decEq._unsafe_rec a a;
+        let inst_3 := instDecidableEqVExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := instDecidableEqVExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | binderType.lam body, binderType_1.forallE body_1 => isFalse ⋯
+  | binderType.lam body, VExpr.proj ref index expr => isFalse ⋯
+  | binderType.lam body, VExpr.natLit value => isFalse ⋯
+  | binderType.forallE body, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | binderType.forallE body, VExpr.sort u => isFalse ⋯
+  | binderType.forallE body, VExpr.const ref levels => isFalse ⋯
+  | binderType.forallE body, fn.app arg => isFalse ⋯
+  | binderType.forallE body, binderType_1.lam body_1 => isFalse ⋯
+  | a.forallE a_1, b.forallE b_1 =>
+    let inst_1 := instDecidableEqVExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := instDecidableEqVExpr.decEq._unsafe_rec a a;
+        let inst_3 := instDecidableEqVExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := instDecidableEqVExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | binderType.forallE body, VExpr.proj ref index expr => isFalse ⋯
+  | binderType.forallE body, VExpr.natLit value => isFalse ⋯
+  | VExpr.proj ref index expr, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | VExpr.proj ref index expr, VExpr.sort u => isFalse ⋯
+  | VExpr.proj ref index expr, VExpr.const ref_1 levels => isFalse ⋯
+  | VExpr.proj ref index expr, fn.app arg => isFalse ⋯
+  | VExpr.proj ref index expr, binderType.lam body => isFalse ⋯
+  | VExpr.proj ref index expr, binderType.forallE body => isFalse ⋯
+  | VExpr.proj a a_1 a_2, VExpr.proj b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_1 := instDecidableEqVExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := instDecidableEqVExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | VExpr.proj ref index expr, VExpr.natLit value => isFalse ⋯
+  | VExpr.natLit value, VExpr.bvar deBruijnIndex => isFalse ⋯
+  | VExpr.natLit value, VExpr.sort u => isFalse ⋯
+  | VExpr.natLit value, VExpr.const ref levels => isFalse ⋯
+  | VExpr.natLit value, fn.app arg => isFalse ⋯
+  | VExpr.natLit value, binderType.lam body => isFalse ⋯
+  | VExpr.natLit value, binderType.forallE body => isFalse ⋯
+  | VExpr.natLit value, VExpr.proj ref index expr => isFalse ⋯
+  | VExpr.natLit a, VExpr.natLit b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+compiler recursion worker Ix.Theory.instDecidableEqVLevel.decEq._unsafe_rec
+  type: (x x_1 : VLevel) → Decidable (x = x_1)
+  implementation: fun x x_1 =>
+  match x, x_1 with
+  | VLevel.zero, VLevel.zero => isTrue ⋯
+  | VLevel.zero, a.succ => isFalse ⋯
+  | VLevel.zero, a.max a_1 => isFalse ⋯
+  | VLevel.zero, a.imax a_1 => isFalse ⋯
+  | VLevel.zero, VLevel.param a => isFalse ⋯
+  | a.succ, VLevel.zero => isFalse ⋯
+  | a.succ, b.succ =>
+    let inst := instDecidableEqVLevel.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := instDecidableEqVLevel.decEq._unsafe_rec a a;
+        isTrue ⋯
+    else isFalse ⋯
+  | a.succ, a_1.max a_2 => isFalse ⋯
+  | a.succ, a_1.imax a_2 => isFalse ⋯
+  | a.succ, VLevel.param a_1 => isFalse ⋯
+  | a.max a_1, VLevel.zero => isFalse ⋯
+  | a.max a_1, a_2.succ => isFalse ⋯
+  | a.max a_1, b.max b_1 =>
+    let inst := instDecidableEqVLevel.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := instDecidableEqVLevel.decEq._unsafe_rec a a;
+        let inst := instDecidableEqVLevel.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := instDecidableEqVLevel.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | a.max a_1, a_2.imax a_3 => isFalse ⋯
+  | a.max a_1, VLevel.param a_2 => isFalse ⋯
+  | a.imax a_1, VLevel.zero => isFalse ⋯
+  | a.imax a_1, a_2.succ => isFalse ⋯
+  | a.imax a_1, a_2.max a_3 => isFalse ⋯
+  | a.imax a_1, b.imax b_1 =>
+    let inst := instDecidableEqVLevel.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := instDecidableEqVLevel.decEq._unsafe_rec a a;
+        let inst := instDecidableEqVLevel.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := instDecidableEqVLevel.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | a.imax a_1, VLevel.param a_2 => isFalse ⋯
+  | VLevel.param a, VLevel.zero => isFalse ⋯
+  | VLevel.param a, a_1.succ => isFalse ⋯
+  | VLevel.param a, a_1.max a_2 => isFalse ⋯
+  | VLevel.param a, a_1.imax a_2 => isFalse ⋯
+  | VLevel.param a, VLevel.param b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+compiler recursion worker Ix.Theory.instHashableVExpr.hash._unsafe_rec
+  type: {β : Type u_1} → [Hashable β] → VExpr β → UInt64
+  implementation: fun {β} [Hashable β] x =>
+  match x with
+  | VExpr.bvar a => mixHash 0 (hash a)
+  | VExpr.sort a => mixHash 1 (hash a)
+  | VExpr.const a a_1 => mixHash (mixHash 2 (hash a)) (hash a_1)
+  | a.app a_1 => mixHash (mixHash 3 (instHashableVExpr.hash._unsafe_rec a)) (instHashableVExpr.hash._unsafe_rec a_1)
+  | a.lam a_1 => mixHash (mixHash 4 (instHashableVExpr.hash._unsafe_rec a)) (instHashableVExpr.hash._unsafe_rec a_1)
+  | a.forallE a_1 => mixHash (mixHash 5 (instHashableVExpr.hash._unsafe_rec a)) (instHashableVExpr.hash._unsafe_rec a_1)
+  | VExpr.proj a a_1 a_2 => mixHash (mixHash (mixHash 6 (hash a)) (hash a_1)) (instHashableVExpr.hash._unsafe_rec a_2)
+  | VExpr.natLit a => mixHash 7 (hash a)
+compiler recursion worker Ix.Theory.instHashableVLevel.hash._unsafe_rec
+  type: VLevel → UInt64
+  implementation: fun x =>
+  match x with
+  | VLevel.zero => 0
+  | a.succ => mixHash 1 (instHashableVLevel.hash._unsafe_rec a)
+  | a.max a_1 => mixHash (mixHash 2 (instHashableVLevel.hash._unsafe_rec a)) (instHashableVLevel.hash._unsafe_rec a_1)
+  | a.imax a_1 => mixHash (mixHash 3 (instHashableVLevel.hash._unsafe_rec a)) (instHashableVLevel.hash._unsafe_rec a_1)
+  | VLevel.param a => mixHash 4 (hash a)
+compiler recursion worker Ix.Theory.Certified.IndexSet.insert._unsafe_rec
+  type: Nat → List Nat → List Nat
+  implementation: fun x x_1 =>
+  match x_1 with
+  | [] => [x]
+  | y :: ys =>
+    if x < y then x :: y :: ys else if x = y then y :: ys else y :: Certified.IndexSet.insert._unsafe_rec x ys
+compiler recursion worker Ix.Theory.Certified.IndexSet.normalize._unsafe_rec
+  type: List Nat → List Nat
+  implementation: fun x =>
+  match x with
+  | [] => []
+  | x :: xs => Certified.IndexSet.insert x (Certified.IndexSet.normalize._unsafe_rec xs)
+compiler recursion worker Ix.Theory.Certified.LevelEq.leq._unsafe_rec
+  type: VLevel → VLevel → Bool
+  implementation: fun a b =>
+  if a = b then true
+  else
+    match a, b with
+    | VLevel.zero, x => true
+    | a.max b, c => Certified.LevelEq.leq._unsafe_rec a c && Certified.LevelEq.leq._unsafe_rec b c
+    | a, b.max c => Certified.LevelEq.leq._unsafe_rec a b || Certified.LevelEq.leq._unsafe_rec a c
+    | a.succ, b.succ => Certified.LevelEq.leq._unsafe_rec a b
+    | a, b.succ => Certified.LevelEq.leq._unsafe_rec a b
+    | a.imax b, c => Certified.LevelEq.leq._unsafe_rec a c && Certified.LevelEq.leq._unsafe_rec b c
+    | x, x_1 => false
+compiler recursion worker Ix.Theory.Certified.LevelEq.normalize._unsafe_rec
+  type: VLevel → VLevel
+  implementation: fun x =>
+  match x with
+  | VLevel.zero => VLevel.zero
+  | VLevel.param i => VLevel.param i
+  | a.succ => (Certified.LevelEq.normalize._unsafe_rec a).succ
+  | a.max b =>
+    Certified.LevelEq.max (Certified.LevelEq.normalize._unsafe_rec a) (Certified.LevelEq.normalize._unsafe_rec b)
+  | a.imax b =>
+    Certified.LevelEq.imax (Certified.LevelEq.normalize._unsafe_rec a) (Certified.LevelEq.normalize._unsafe_rec b)
+compiler recursion worker Ix.Theory.Certified.Modeled.applyPi?._unsafe_rec
+  type: {β : Type u} → VExpr β → List (VExpr β) → Option (VExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | type, [] => some type
+  | binderType.forallE body, argument :: rest => Certified.Modeled.applyPi?._unsafe_rec (body.inst argument) rest
+  | x, head :: tail => none
+compiler recursion worker Ix.Theory.Certified.Modeled.betaHead?._unsafe_rec
+  type: {β : Type u} → Nat → VExpr β → Option (VExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, x => none
+  | fuel.succ, function.app argument => do
+    let function ← Certified.Modeled.betaHead?._unsafe_rec fuel function
+    match function with
+      | binderType.lam body => Certified.Modeled.betaHead?._unsafe_rec fuel (body.inst argument)
+      | x => some (function.app argument)
+  | n.succ, expression => some expression
+compiler recursion worker Ix.Theory.Certified.Modeled.checkEach?._unsafe_rec
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (companions pending : List (Certified.Modeled.Companion β)) →
+          List (List (Certified.Modeled.EquationWitness β)) →
+            Option
+              (Certified.CheckedClaim
+                (∀ (companion : Certified.Modeled.Companion β),
+                  companion ∈ pending → Certified.Modeled.CompanionChecked entries companions companion))
+  implementation: fun {β} [DecidableEq β] fuel entries companions x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | companion :: rest, witnesses :: remaining => do
+    let first ← Certified.Modeled.checkCompanion? fuel entries companions companion witnesses
+    let others ← Certified.Modeled.checkEach?._unsafe_rec fuel entries companions rest remaining
+    pure { down := ⋯ }
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Certified.Modeled.checkRules?._unsafe_rec
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (companions : List (Certified.Modeled.Companion β)) →
+          (rules : List (Certified.Signature.Rule β)) →
+            List (Certified.Modeled.EquationWitness β) →
+              Option
+                (Certified.CheckedClaim
+                  (∀ (rule : Certified.Signature.Rule β),
+                    rule ∈ rules →
+                      Certified.Modeled.CheckedEquation entries (Certified.Modeled.mapRule companions rule)))
+  implementation: fun {β} [DecidableEq β] fuel entries companions x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | rule :: rules, witness :: witnesses => do
+    let first ← Certified.Modeled.checkEquation? fuel entries (Certified.Modeled.mapRule companions rule) witness
+    let rest ← Certified.Modeled.checkRules?._unsafe_rec fuel entries companions rules witnesses
+    pure { down := ⋯ }
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Certified.Modeled.lookupCompanion._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] → List (Certified.Modeled.Companion β) → ConstRef β → Option (Certified.Modeled.Companion β)
+  implementation: fun {β} [DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | [], x => none
+  | companion :: rest, ref =>
+    if companion.header.ref = ref then some companion else Certified.Modeled.lookupCompanion._unsafe_rec rest ref
+compiler recursion worker Ix.Theory.Certified.Modeled.splitLam?._unsafe_rec
+  type: {β : Type u} → Nat → VExpr β → Option (List (VExpr β) × VExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, expression => some ([], expression)
+  | n.succ, domain.lam body => do
+    let __x ← Certified.Modeled.splitLam?._unsafe_rec n body
+    match __x with
+      | (domains, result) => pure (domain :: domains, result)
+  | n.succ, x => none
+compiler recursion worker Ix.Theory.Certified.Modeled.splitPi?._unsafe_rec
+  type: {β : Type u} → Nat → VExpr β → Option (List (VExpr β) × VExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | 0, type => some ([], type)
+  | n.succ, domain.forallE body => do
+    let __x ← Certified.Modeled.splitPi?._unsafe_rec n body
+    match __x with
+      | (domains, result) => pure (domain :: domains, result)
+  | n.succ, x => none
+compiler recursion worker Ix.Theory.Certified.Ordinary.checkConstructors._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (shape : Certified.Ordinary.Shape β) →
+          (ctors : List (Certified.Ordinary.Constructor β)) →
+            List (Certified.Ordinary.ConstructorWitness β) →
+              Option
+                (Certified.CheckedClaim
+                  (∀ (ctor : Certified.Ordinary.Constructor β),
+                    ctor ∈ ctors → Certified.Ordinary.ConstructorEvidence entries shape ctor))
+  implementation: fun {β} [DecidableEq β] fuel entries shape x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | ctor :: ctors, witness :: witnesses =>
+    if hrefs : ∀ (e : Model.AExpr β), e ∈ ctor.fields ++ ctor.indices → Model.AExpr.ReferencesIn entries e then do
+      let fields ←
+        Certified.verifyTelescope fuel shape.universes entries (some shape.level) shape.parameterContext ctor.fields
+            witness.fields
+      let indices ←
+        Certified.verifyArguments fuel shape.universes entries (ctor.context shape)
+            (Model.Telescope.lift ctor.fields.length shape.indices) ctor.indices witness.indices
+      let recursive ← Certified.Ordinary.checkRecursive fuel entries shape ctor ctor.recursive witness.recursive
+      let rest ← Certified.Ordinary.checkConstructors._unsafe_rec fuel entries shape ctors witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Certified.Ordinary.checkRecursive._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (shape : Certified.Ordinary.Shape β) →
+          (ctor : Certified.Ordinary.Constructor β) →
+            (fields : List (Certified.Ordinary.RecursiveField β)) →
+              List (Certified.Ordinary.RecursiveWitness β) →
+                Option
+                  (Certified.CheckedClaim
+                    (∀ (field : Certified.Ordinary.RecursiveField β),
+                      field ∈ fields → Certified.Ordinary.RecursiveEvidence entries shape ctor field))
+  implementation: fun {β} [DecidableEq β] fuel entries shape ctor x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | field :: fields, witness :: witnesses =>
+    if hrefs : ∀ (e : Model.AExpr β), e ∈ field.domains ++ field.indices → Model.AExpr.ReferencesIn entries e then do
+      let domains ←
+        Certified.verifyTelescope fuel shape.universes entries (some shape.level) (ctor.context shape) field.domains
+            witness.domains
+      let indices ←
+        Certified.verifyArguments fuel shape.universes entries
+            (Model.Telescope.context (ctor.context shape) field.domains)
+            (Model.Telescope.lift (ctor.fields.length + field.domains.length) shape.indices) field.indices
+            witness.indices
+      let rest ← Certified.Ordinary.checkRecursive._unsafe_rec fuel entries shape ctor fields witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Certified.Ordinary.parameterVars._unsafe_rec
+  type: {β : Type u} → Nat → Nat → List (Model.AExpr β)
+  implementation: fun {β} offset x =>
+  match x with
+  | 0 => []
+  | n.succ => Model.AExpr.bvar (offset + n) :: Certified.Ordinary.parameterVars._unsafe_rec offset n
+compiler recursion worker Ix.Theory.Certified.PropWhen.bindList._unsafe_rec
+  type: (Nat → Certified.PropWhen) → List Nat → Certified.PropWhen
+  implementation: fun f x =>
+  match x with
+  | [] => Certified.PropWhen.always
+  | i :: ps => (f i).inter (Certified.PropWhen.bindList._unsafe_rec f ps)
+compiler recursion worker Ix.Theory.Certified.Signature.checkTypes._unsafe_rec
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (headers : List (Certified.Signature.Header β)) →
+          List (Certified.Signature.TypeWitness β) →
+            Option (Certified.CheckedClaim (Certified.Signature.Formed entries headers))
+  implementation: fun {β} [DecidableEq β] fuel entries x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | header :: headers, witness :: witnesses =>
+    if hf : entries header.ref = none then
+      if hs : Model.AExpr.Scope header.universes 0 header.type then
+        if hr : Model.AExpr.ReferencesIn entries header.type then do
+          let ht ←
+            Certified.verifyType fuel header.universes entries [] header.type (Model.AExpr.sort witness.level)
+                witness.typing
+          let rest ←
+            Certified.Signature.checkTypes._unsafe_rec fuel (entries.insert header.ref header.entry) headers witnesses
+          pure { down := ⋯ }
+        else none
+      else none
+    else none
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Certified.Signature.environment._unsafe_rec
+  type: {β : Type u} → [DecidableEq β] → Model.Environment β → List (Certified.Signature.Header β) → Model.Environment β
+  implementation: fun {β} [DecidableEq β] entries x =>
+  match x with
+  | [] => entries
+  | header :: rest => Certified.Signature.environment._unsafe_rec (entries.insert header.ref header.entry) rest
+compiler recursion worker Ix.Theory.Certified.Structure.checkFields._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      Nat →
+        (entries : Model.Environment β) →
+          (w : VLevel) →
+            (Γ : Model.Context β) →
+              (fields : List (Certified.Structure.Field β)) →
+                List (Certified.TypingWitness β) →
+                  Option (Certified.CheckedClaim (Certified.Structure.FieldsFormed entries w Γ fields))
+  implementation: fun {β} [DecidableEq β] fuel n entries w x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | x, [], [] => some { down := ⋯ }
+  | Γ, field :: fields, witness :: witnesses =>
+    if hz : Certified.checkZeroImplies w field.level = true then do
+      let hA ← Certified.verifyType fuel n entries Γ field.domain (Model.AExpr.sort field.level) witness
+      let rest ←
+        Certified.Structure.checkFields._unsafe_rec fuel n entries w (Model.Context.push field.domain Γ) fields
+            witnesses
+      pure { down := ⋯ }
+    else none
+  | x, x_3, x_4 => none
+compiler recursion worker Ix.Theory.Certified.Structure.checkIota._unsafe_rec
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (d : Certified.Structure.Description β) →
+          (source recursor : β) →
+            (mode : Inductive.ElimMode) →
+              (fields : List (Certified.Structure.Field β × Nat)) →
+                List (Certified.Signature.RuleWitness β) →
+                  Option
+                    (Certified.CheckedClaim
+                      (∀ (field : Certified.Structure.Field β) (i : Nat),
+                        (field, i) ∈ fields →
+                          Certified.Signature.RuleFormed (d.iotaEnvironment entries source recursor mode i)
+                            (d.iotaRule source i field)))
+  implementation: fun {β} [DecidableEq β] fuel entries d source recursor mode x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | (field, i) :: fields, witness :: witnesses => do
+    let ht ←
+      Certified.Signature.checkRule fuel (d.iotaEnvironment entries source recursor mode i) (d.iotaRule source i field)
+          witness
+    let rest ← Certified.Structure.checkIota._unsafe_rec fuel entries d source recursor mode fields witnesses
+    pure { down := ⋯ }
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Model.AExpr.Scope._unsafe_rec
+  type: {β : Type u_1} → Nat → Nat → Model.AExpr β → Prop
+  implementation: fun {β} universes depth x =>
+  match x with
+  | Model.AExpr.bvar i => i < depth
+  | Model.AExpr.sort l => VLevel.WF universes l
+  | Model.AExpr.const ref ls => ∀ (l : VLevel), l ∈ ls → VLevel.WF universes l
+  | f.app a => Model.AExpr.Scope._unsafe_rec universes depth f ∧ Model.AExpr.Scope._unsafe_rec universes depth a
+  | Model.AExpr.lam p a b =>
+    Certified.PropWhen.WF universes p ∧
+      Model.AExpr.Scope._unsafe_rec universes depth a ∧ Model.AExpr.Scope._unsafe_rec universes (depth + 1) b
+  | Model.AExpr.forallE p a b =>
+    Certified.PropWhen.WF universes p ∧
+      Model.AExpr.Scope._unsafe_rec universes depth a ∧ Model.AExpr.Scope._unsafe_rec universes (depth + 1) b
+  | Model.AExpr.proj ref field e => Model.AExpr.Scope._unsafe_rec universes depth e
+  | Model.AExpr.natLit value => True
+compiler recursion worker Ix.Theory.Model.AExpr.appN._unsafe_rec
+  type: {β : Type u} → Model.AExpr β → List (Model.AExpr β) → Model.AExpr β
+  implementation: fun {β} f x =>
+  match x with
+  | [] => f
+  | x :: xs => Model.AExpr.appN._unsafe_rec (f.app x) xs
+compiler recursion worker Ix.Theory.Model.AExpr.decidableScope._unsafe_rec
+  type: {β : Type u_1} → {n k : Nat} → {e : Model.AExpr β} → Decidable (Model.AExpr.Scope n k e)
+  implementation: fun {β} {n k} x =>
+  match x with
+  | Model.AExpr.bvar i => Model.AExpr.decidableScope._aux_1 i
+  | Model.AExpr.sort l => VLevel.decidable_WF
+  | Model.AExpr.const ref ls => Model.AExpr.decidableScope._aux_3 ref ls
+  | f.app a => instDecidableAnd
+  | Model.AExpr.lam p A b => instDecidableAnd
+  | Model.AExpr.forallE p A b => instDecidableAnd
+  | Model.AExpr.proj ref field e => Model.AExpr.decidableScope._unsafe_rec
+  | Model.AExpr.natLit value => instDecidableTrue
+compiler recursion worker Ix.Theory.Model.AExpr.erase._unsafe_rec
+  type: {β : Type u_1} → Model.AExpr β → VExpr β
+  implementation: fun {β} x =>
+  match x with
+  | Model.AExpr.bvar i => VExpr.bvar i
+  | Model.AExpr.sort l => VExpr.sort l
+  | Model.AExpr.const r ls => VExpr.const r ls
+  | f.app a => (Model.AExpr.erase._unsafe_rec f).app (Model.AExpr.erase._unsafe_rec a)
+  | Model.AExpr.lam condition a b => (Model.AExpr.erase._unsafe_rec a).lam (Model.AExpr.erase._unsafe_rec b)
+  | Model.AExpr.forallE condition a b => (Model.AExpr.erase._unsafe_rec a).forallE (Model.AExpr.erase._unsafe_rec b)
+  | Model.AExpr.proj r i e => VExpr.proj r i (Model.AExpr.erase._unsafe_rec e)
+  | Model.AExpr.natLit v => VExpr.natLit v
+compiler recursion worker Ix.Theory.Model.AExpr.forallN._unsafe_rec
+  type: {β : Type u} → Certified.PropWhen → List (Model.AExpr β) → Model.AExpr β → Model.AExpr β
+  implementation: fun {β} p x x_1 =>
+  match x, x_1 with
+  | [], B => B
+  | A :: rest, B => Model.AExpr.forallE p A (Model.AExpr.forallN._unsafe_rec p rest B)
+compiler recursion worker Ix.Theory.Model.AExpr.inst._unsafe_rec
+  type: {β : Type u_1} → Model.AExpr β → Model.AExpr β → optParam Nat 0 → Model.AExpr β
+  implementation: fun {β} x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | Model.AExpr.bvar i, a, k => Model.AExpr.instVar i a k
+  | Model.AExpr.sort l, x, x_3 => Model.AExpr.sort l
+  | Model.AExpr.const r ls, x, x_3 => Model.AExpr.const r ls
+  | f.app a, e, k => (Model.AExpr.inst._unsafe_rec f e k).app (Model.AExpr.inst._unsafe_rec a e k)
+  | Model.AExpr.lam p a b, e, k =>
+    Model.AExpr.lam p (Model.AExpr.inst._unsafe_rec a e k) (Model.AExpr.inst._unsafe_rec b e (k + 1))
+  | Model.AExpr.forallE p a b, e, k =>
+    Model.AExpr.forallE p (Model.AExpr.inst._unsafe_rec a e k) (Model.AExpr.inst._unsafe_rec b e (k + 1))
+  | Model.AExpr.proj r i e, a, k => Model.AExpr.proj r i (Model.AExpr.inst._unsafe_rec e a k)
+  | Model.AExpr.natLit v, x, x_3 => Model.AExpr.natLit v
+compiler recursion worker Ix.Theory.Model.AExpr.instL._unsafe_rec
+  type: {β : Type u_1} → List VLevel → Model.AExpr β → Model.AExpr β
+  implementation: fun {β} levels x =>
+  match x with
+  | Model.AExpr.bvar i => Model.AExpr.bvar i
+  | Model.AExpr.sort l => Model.AExpr.sort (VLevel.inst levels l)
+  | Model.AExpr.const r ls => Model.AExpr.const r (List.map (VLevel.inst levels) ls)
+  | f.app a => (Model.AExpr.instL._unsafe_rec levels f).app (Model.AExpr.instL._unsafe_rec levels a)
+  | Model.AExpr.lam p a b =>
+    Model.AExpr.lam (Certified.instCondition levels p) (Model.AExpr.instL._unsafe_rec levels a)
+      (Model.AExpr.instL._unsafe_rec levels b)
+  | Model.AExpr.forallE p a b =>
+    Model.AExpr.forallE (Certified.instCondition levels p) (Model.AExpr.instL._unsafe_rec levels a)
+      (Model.AExpr.instL._unsafe_rec levels b)
+  | Model.AExpr.proj r i e => Model.AExpr.proj r i (Model.AExpr.instL._unsafe_rec levels e)
+  | Model.AExpr.natLit v => Model.AExpr.natLit v
+compiler recursion worker Ix.Theory.Model.AExpr.instRev._unsafe_rec
+  type: {β : Type u} → Model.AExpr β → List (Model.AExpr β) → Model.AExpr β
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | e, [] => e
+  | e, a :: rest => Model.AExpr.instRev._unsafe_rec (e.inst a rest.length) rest
+compiler recursion worker Ix.Theory.Model.AExpr.lamN._unsafe_rec
+  type: {β : Type u} → Certified.PropWhen → List (Model.AExpr β) → Model.AExpr β → Model.AExpr β
+  implementation: fun {β} p x x_1 =>
+  match x, x_1 with
+  | [], body => body
+  | A :: rest, body => Model.AExpr.lam p A (Model.AExpr.lamN._unsafe_rec p rest body)
+compiler recursion worker Ix.Theory.Model.AExpr.liftN._unsafe_rec
+  type: {β : Type u_1} → Nat → Model.AExpr β → optParam Nat 0 → Model.AExpr β
+  implementation: fun {β} count x x_1 =>
+  match x, x_1 with
+  | Model.AExpr.bvar i, k => Model.AExpr.bvar (liftVar count i k)
+  | Model.AExpr.sort l, x => Model.AExpr.sort l
+  | Model.AExpr.const r ls, x => Model.AExpr.const r ls
+  | f.app a, k => (Model.AExpr.liftN._unsafe_rec count f k).app (Model.AExpr.liftN._unsafe_rec count a k)
+  | Model.AExpr.lam p a b, k =>
+    Model.AExpr.lam p (Model.AExpr.liftN._unsafe_rec count a k) (Model.AExpr.liftN._unsafe_rec count b (k + 1))
+  | Model.AExpr.forallE p a b, k =>
+    Model.AExpr.forallE p (Model.AExpr.liftN._unsafe_rec count a k) (Model.AExpr.liftN._unsafe_rec count b (k + 1))
+  | Model.AExpr.proj r i e, k => Model.AExpr.proj r i (Model.AExpr.liftN._unsafe_rec count e k)
+  | Model.AExpr.natLit v, x => Model.AExpr.natLit v
+compiler recursion worker Ix.Theory.Model.AExpr.mapRefs._unsafe_rec
+  type: {β : Type u} → {γ : Type v} → (ConstRef β → ConstRef γ) → Model.AExpr β → Model.AExpr γ
+  implementation: fun {β} {γ} mapping x =>
+  match x with
+  | Model.AExpr.bvar i => Model.AExpr.bvar i
+  | Model.AExpr.sort level => Model.AExpr.sort level
+  | Model.AExpr.const ref levels => Model.AExpr.const (mapping ref) levels
+  | f.app a => (Model.AExpr.mapRefs._unsafe_rec mapping f).app (Model.AExpr.mapRefs._unsafe_rec mapping a)
+  | Model.AExpr.lam condition type body =>
+    Model.AExpr.lam condition (Model.AExpr.mapRefs._unsafe_rec mapping type)
+      (Model.AExpr.mapRefs._unsafe_rec mapping body)
+  | Model.AExpr.forallE condition type body =>
+    Model.AExpr.forallE condition (Model.AExpr.mapRefs._unsafe_rec mapping type)
+      (Model.AExpr.mapRefs._unsafe_rec mapping body)
+  | Model.AExpr.proj ref index major =>
+    Model.AExpr.proj (mapping ref) index (Model.AExpr.mapRefs._unsafe_rec mapping major)
+  | Model.AExpr.natLit n => Model.AExpr.natLit n
+compiler recursion worker Ix.Theory.Model.AExpr.references._unsafe_rec
+  type: {β : Type u} → Model.AExpr β → List (ConstRef β)
+  implementation: fun {β} x =>
+  match x with
+  | Model.AExpr.bvar index => []
+  | Model.AExpr.sort level => []
+  | Model.AExpr.natLit value => []
+  | Model.AExpr.const r levels => [r]
+  | f.app a => Model.AExpr.references._unsafe_rec f ++ Model.AExpr.references._unsafe_rec a
+  | Model.AExpr.lam condition f a => Model.AExpr.references._unsafe_rec f ++ Model.AExpr.references._unsafe_rec a
+  | Model.AExpr.forallE condition f a => Model.AExpr.references._unsafe_rec f ++ Model.AExpr.references._unsafe_rec a
+  | Model.AExpr.proj r field e => r :: Model.AExpr.references._unsafe_rec e
+compiler recursion worker Ix.Theory.Model.AExpr.rename._unsafe_rec
+  type: {β : Type u_1} → {γ : Type u_2} → (β → γ) → Model.AExpr β → Model.AExpr γ
+  implementation: fun {β} {γ} mapping x =>
+  match x with
+  | Model.AExpr.bvar i => Model.AExpr.bvar i
+  | Model.AExpr.sort l => Model.AExpr.sort l
+  | Model.AExpr.const r ls => Model.AExpr.const (ConstRef.rename mapping r) ls
+  | f.app a => (Model.AExpr.rename._unsafe_rec mapping f).app (Model.AExpr.rename._unsafe_rec mapping a)
+  | Model.AExpr.lam p a b =>
+    Model.AExpr.lam p (Model.AExpr.rename._unsafe_rec mapping a) (Model.AExpr.rename._unsafe_rec mapping b)
+  | Model.AExpr.forallE p a b =>
+    Model.AExpr.forallE p (Model.AExpr.rename._unsafe_rec mapping a) (Model.AExpr.rename._unsafe_rec mapping b)
+  | Model.AExpr.proj r i e => Model.AExpr.proj (ConstRef.rename mapping r) i (Model.AExpr.rename._unsafe_rec mapping e)
+  | Model.AExpr.natLit v => Model.AExpr.natLit v
+compiler recursion worker Ix.Theory.Model.Telescope.context._unsafe_rec
+  type: {β : Type u} → Model.Context β → List (Model.AExpr β) → Model.Context β
+  implementation: fun {β} Γ x =>
+  match x with
+  | [] => Γ
+  | A :: rest => Model.Telescope.context._unsafe_rec (Model.Context.push A Γ) rest
+compiler recursion worker Ix.Theory.Model.Telescope.extend._unsafe_rec
+  type: {V : Type v} → (Nat → V) → List V → Nat → V
+  implementation: fun {V} env x =>
+  match (motive := List V → Nat → V) x with
+  | [] => env
+  | x :: xs => Model.Telescope.extend._unsafe_rec (Model.Valuation.cons x env) xs
+compiler recursion worker Ix.Theory.Model.Telescope.independent._unsafe_rec
+  type: {β : Type u} → List (Model.AExpr β) → optParam Nat 0 → List (Model.AExpr β)
+  implementation: fun {β} x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: rest, offset => Model.AExpr.liftN offset A :: Model.Telescope.independent._unsafe_rec rest (offset + 1)
+compiler recursion worker Ix.Theory.Model.Telescope.inst._unsafe_rec
+  type: {β : Type u} → Model.AExpr β → List (Model.AExpr β) → optParam Nat 0 → List (Model.AExpr β)
+  implementation: fun {β} arg x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: rest, k => A.inst arg k :: Model.Telescope.inst._unsafe_rec arg rest (k + 1)
+compiler recursion worker Ix.Theory.Model.Telescope.lift._unsafe_rec
+  type: {β : Type u} → Nat → List (Model.AExpr β) → optParam Nat 0 → List (Model.AExpr β)
+  implementation: fun {β} count x x_1 =>
+  match x, x_1 with
+  | [], x => []
+  | A :: rest, k => Model.AExpr.liftN count A k :: Model.Telescope.lift._unsafe_rec count rest (k + 1)
+compiler recursion worker Ix.Theory.Model.Telescope.simple._unsafe_rec
+  type: {V : Type v} → (domains : List V) → Model.SetTheory.Tower.TeleS V domains.length
+  implementation: fun {V} x =>
+  match x with
+  | [] => Model.SetTheory.Tower.TeleS.nil
+  | A :: rest => Model.SetTheory.Tower.TeleS.cons A fun x => Model.Telescope.simple._unsafe_rec rest
+compiler recursion worker Ix.Theory.Model.instDecidableEqAExpr.decEq._unsafe_rec
+  type: {β : Type u_1} → [DecidableEq β] → (x x_1 : Model.AExpr β) → Decidable (x = x_1)
+  implementation: fun {β} [inst : DecidableEq β] x x_1 =>
+  match x, x_1 with
+  | Model.AExpr.bvar a, Model.AExpr.bvar b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | Model.AExpr.bvar index, Model.AExpr.sort level => isFalse ⋯
+  | Model.AExpr.bvar index, Model.AExpr.const ref levels => isFalse ⋯
+  | Model.AExpr.bvar index, fn.app arg => isFalse ⋯
+  | Model.AExpr.bvar index, Model.AExpr.lam condition domain body => isFalse ⋯
+  | Model.AExpr.bvar index, Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Model.AExpr.bvar index, Model.AExpr.proj ref field major => isFalse ⋯
+  | Model.AExpr.bvar index, Model.AExpr.natLit value => isFalse ⋯
+  | Model.AExpr.sort level, Model.AExpr.bvar index => isFalse ⋯
+  | Model.AExpr.sort a, Model.AExpr.sort b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+  | Model.AExpr.sort level, Model.AExpr.const ref levels => isFalse ⋯
+  | Model.AExpr.sort level, fn.app arg => isFalse ⋯
+  | Model.AExpr.sort level, Model.AExpr.lam condition domain body => isFalse ⋯
+  | Model.AExpr.sort level, Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Model.AExpr.sort level, Model.AExpr.proj ref field major => isFalse ⋯
+  | Model.AExpr.sort level, Model.AExpr.natLit value => isFalse ⋯
+  | Model.AExpr.const ref levels, Model.AExpr.bvar index => isFalse ⋯
+  | Model.AExpr.const ref levels, Model.AExpr.sort level => isFalse ⋯
+  | Model.AExpr.const a a_1, Model.AExpr.const b b_1 =>
+    if h : a = b then h ▸ if h : a_1 = b_1 then h ▸ isTrue ⋯ else isFalse ⋯ else isFalse ⋯
+  | Model.AExpr.const ref levels, fn.app arg => isFalse ⋯
+  | Model.AExpr.const ref levels, Model.AExpr.lam condition domain body => isFalse ⋯
+  | Model.AExpr.const ref levels, Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Model.AExpr.const ref levels, Model.AExpr.proj ref_1 field major => isFalse ⋯
+  | Model.AExpr.const ref levels, Model.AExpr.natLit value => isFalse ⋯
+  | fn.app arg, Model.AExpr.bvar index => isFalse ⋯
+  | fn.app arg, Model.AExpr.sort level => isFalse ⋯
+  | fn.app arg, Model.AExpr.const ref levels => isFalse ⋯
+  | a.app a_1, b.app b_1 =>
+    let inst_1 := Model.instDecidableEqAExpr.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst_2 := Model.instDecidableEqAExpr.decEq._unsafe_rec a a;
+        let inst_3 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | fn.app arg, Model.AExpr.lam condition domain body => isFalse ⋯
+  | fn.app arg, Model.AExpr.forallE condition domain body => isFalse ⋯
+  | fn.app arg, Model.AExpr.proj ref field major => isFalse ⋯
+  | fn.app arg, Model.AExpr.natLit value => isFalse ⋯
+  | Model.AExpr.lam condition domain body, Model.AExpr.bvar index => isFalse ⋯
+  | Model.AExpr.lam condition domain body, Model.AExpr.sort level => isFalse ⋯
+  | Model.AExpr.lam condition domain body, Model.AExpr.const ref levels => isFalse ⋯
+  | Model.AExpr.lam condition domain body, fn.app arg => isFalse ⋯
+  | Model.AExpr.lam a a_1 a_2, Model.AExpr.lam b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        let inst_1 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_2 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 a_1;
+            let inst_3 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Model.AExpr.lam condition domain body, Model.AExpr.forallE condition_1 domain_1 body_1 => isFalse ⋯
+  | Model.AExpr.lam condition domain body, Model.AExpr.proj ref field major => isFalse ⋯
+  | Model.AExpr.lam condition domain body, Model.AExpr.natLit value => isFalse ⋯
+  | Model.AExpr.forallE condition domain body, Model.AExpr.bvar index => isFalse ⋯
+  | Model.AExpr.forallE condition domain body, Model.AExpr.sort level => isFalse ⋯
+  | Model.AExpr.forallE condition domain body, Model.AExpr.const ref levels => isFalse ⋯
+  | Model.AExpr.forallE condition domain body, fn.app arg => isFalse ⋯
+  | Model.AExpr.forallE condition domain body, Model.AExpr.lam condition_1 domain_1 body_1 => isFalse ⋯
+  | Model.AExpr.forallE a a_1 a_2, Model.AExpr.forallE b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        let inst_1 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_2 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_1 a_1;
+            let inst_3 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Model.AExpr.forallE condition domain body, Model.AExpr.proj ref field major => isFalse ⋯
+  | Model.AExpr.forallE condition domain body, Model.AExpr.natLit value => isFalse ⋯
+  | Model.AExpr.proj ref field major, Model.AExpr.bvar index => isFalse ⋯
+  | Model.AExpr.proj ref field major, Model.AExpr.sort level => isFalse ⋯
+  | Model.AExpr.proj ref field major, Model.AExpr.const ref_1 levels => isFalse ⋯
+  | Model.AExpr.proj ref field major, fn.app arg => isFalse ⋯
+  | Model.AExpr.proj ref field major, Model.AExpr.lam condition domain body => isFalse ⋯
+  | Model.AExpr.proj ref field major, Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Model.AExpr.proj a a_1 a_2, Model.AExpr.proj b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        if h : a_1 = b_1 then
+          h ▸
+            let inst_1 := Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Model.instDecidableEqAExpr.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Model.AExpr.proj ref field major, Model.AExpr.natLit value => isFalse ⋯
+  | Model.AExpr.natLit value, Model.AExpr.bvar index => isFalse ⋯
+  | Model.AExpr.natLit value, Model.AExpr.sort level => isFalse ⋯
+  | Model.AExpr.natLit value, Model.AExpr.const ref levels => isFalse ⋯
+  | Model.AExpr.natLit value, fn.app arg => isFalse ⋯
+  | Model.AExpr.natLit value, Model.AExpr.lam condition domain body => isFalse ⋯
+  | Model.AExpr.natLit value, Model.AExpr.forallE condition domain body => isFalse ⋯
+  | Model.AExpr.natLit value, Model.AExpr.proj ref field major => isFalse ⋯
+  | Model.AExpr.natLit a, Model.AExpr.natLit b => if h : a = b then h ▸ isTrue ⋯ else isFalse ⋯
+compiler recursion worker Ix.Theory.Model.instDecidableEqAnnotationTree.decEq._unsafe_rec
+  type: (x x_1 : Model.AnnotationTree) → Decidable (x = x_1)
+  implementation: fun x x_1 =>
+  match x, x_1 with
+  | Model.AnnotationTree.leaf, Model.AnnotationTree.leaf => isTrue ⋯
+  | Model.AnnotationTree.leaf, fn.app arg => isFalse ⋯
+  | Model.AnnotationTree.leaf, Model.AnnotationTree.lam condition domain body => isFalse ⋯
+  | Model.AnnotationTree.leaf, Model.AnnotationTree.forallE condition domain body => isFalse ⋯
+  | Model.AnnotationTree.leaf, major.proj => isFalse ⋯
+  | fn.app arg, Model.AnnotationTree.leaf => isFalse ⋯
+  | a.app a_1, b.app b_1 =>
+    let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a a;
+        let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_1 a_1;
+            isTrue ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | fn.app arg, Model.AnnotationTree.lam condition domain body => isFalse ⋯
+  | fn.app arg, Model.AnnotationTree.forallE condition domain body => isFalse ⋯
+  | fn.app arg, major.proj => isFalse ⋯
+  | Model.AnnotationTree.lam condition domain body, Model.AnnotationTree.leaf => isFalse ⋯
+  | Model.AnnotationTree.lam condition domain body, fn.app arg => isFalse ⋯
+  | Model.AnnotationTree.lam a a_1 a_2, Model.AnnotationTree.lam b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_1 a_1;
+            let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Model.AnnotationTree.lam condition domain body, Model.AnnotationTree.forallE condition_1 domain_1 body_1 =>
+    isFalse ⋯
+  | Model.AnnotationTree.lam condition domain body, major.proj => isFalse ⋯
+  | Model.AnnotationTree.forallE condition domain body, Model.AnnotationTree.leaf => isFalse ⋯
+  | Model.AnnotationTree.forallE condition domain body, fn.app arg => isFalse ⋯
+  | Model.AnnotationTree.forallE condition domain body, Model.AnnotationTree.lam condition_1 domain_1 body_1 =>
+    isFalse ⋯
+  | Model.AnnotationTree.forallE a a_1 a_2, Model.AnnotationTree.forallE b b_1 b_2 =>
+    if h : a = b then
+      h ▸
+        let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_1 b_1;
+        if h : a_1 = b_1 then
+          h ▸
+            let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_1 a_1;
+            let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_2 b_2;
+            if h : a_2 = b_2 then
+              h ▸
+                let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a_2 a_2;
+                isTrue ⋯
+            else isFalse ⋯
+        else isFalse ⋯
+    else isFalse ⋯
+  | Model.AnnotationTree.forallE condition domain body, major.proj => isFalse ⋯
+  | major.proj, Model.AnnotationTree.leaf => isFalse ⋯
+  | major.proj, fn.app arg => isFalse ⋯
+  | major.proj, Model.AnnotationTree.lam condition domain body => isFalse ⋯
+  | major.proj, Model.AnnotationTree.forallE condition domain body => isFalse ⋯
+  | a.proj, b.proj =>
+    let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a b;
+    if h : a = b then
+      h ▸
+        let inst := Model.instDecidableEqAnnotationTree.decEq._unsafe_rec a a;
+        isTrue ⋯
+    else isFalse ⋯
+compiler recursion worker Ix.Theory.Model.instReprAnnotationTree.repr._unsafe_rec
+  type: Model.AnnotationTree → Nat → Format
+  implementation: fun x prec =>
+  match x with
+  | Model.AnnotationTree.leaf =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2) (Format.text "Ix.Theory.Model.AnnotationTree.leaf")).group prec
+  | a.app a_1 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Ix.Theory.Model.AnnotationTree.app" ++ Format.line ++
+                Model.instReprAnnotationTree.repr._unsafe_rec a 1024 ++
+              Format.line ++
+            Model.instReprAnnotationTree.repr._unsafe_rec a_1 1024)).group
+      prec
+  | Model.AnnotationTree.lam a a_1 a_2 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Ix.Theory.Model.AnnotationTree.lam" ++ Format.line ++ reprArg a ++ Format.line ++
+                Model.instReprAnnotationTree.repr._unsafe_rec a_1 1024 ++
+              Format.line ++
+            Model.instReprAnnotationTree.repr._unsafe_rec a_2 1024)).group
+      prec
+  | Model.AnnotationTree.forallE a a_1 a_2 =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Ix.Theory.Model.AnnotationTree.forallE" ++ Format.line ++ reprArg a ++ Format.line ++
+                Model.instReprAnnotationTree.repr._unsafe_rec a_1 1024 ++
+              Format.line ++
+            Model.instReprAnnotationTree.repr._unsafe_rec a_2 1024)).group
+      prec
+  | a.proj =>
+    Repr.addAppParen
+      (Format.nest (if prec ≥ 1024 then 1 else 2)
+          (Format.text "Ix.Theory.Model.AnnotationTree.proj" ++ Format.line ++
+            Model.instReprAnnotationTree.repr._unsafe_rec a 1024)).group
+      prec
+compiler recursion worker Ix.Theory.Certified.Ordinary.Shape.checkConstructorTypes._unsafe_rec
+  type: {β : Type u} →
+  [inst : DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (shape : Certified.Ordinary.Shape β) →
+          (source : β) →
+            (ctors : List (Certified.Ordinary.Constructor β)) →
+              List (Certified.Ordinary.Shape.TypeWitness β) →
+                Option
+                  (Certified.CheckedClaim
+                    (∀ (ctor : Certified.Ordinary.Constructor β),
+                      ctor ∈ ctors →
+                        Model.EntryClosed (shape.familyEnvironment entries source)
+                            (shape.constructorEntry source ctor) ∧
+                          ∃ l,
+                            Model.TypingClaim (shape.familyEnvironment entries source) [] (ctor.type shape source)
+                              (Model.AExpr.sort l)))
+  implementation: fun {β} [DecidableEq β] fuel entries shape source x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | ctor :: ctors, witness :: witnesses =>
+    if hs : Model.AExpr.Scope shape.universes 0 (ctor.type shape source) then
+      if hr : Model.AExpr.ReferencesIn (shape.familyEnvironment entries source) (ctor.type shape source) then do
+        let ht ←
+          Certified.verifyType fuel shape.universes (shape.familyEnvironment entries source) [] (ctor.type shape source)
+              (Model.AExpr.sort witness.level) witness.witness
+        let rest ← Certified.Ordinary.Shape.checkConstructorTypes._unsafe_rec fuel entries shape source ctors witnesses
+        pure { down := ⋯ }
+      else none
+    else none
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Certified.Ordinary.Shape.checkRules._unsafe_rec
+  type: {β : Type u} →
+  [DecidableEq β] →
+    Nat →
+      (entries : Model.Environment β) →
+        (shape : Certified.Ordinary.Shape β) →
+          (source recursor : β) →
+            (mode : Inductive.ElimMode) →
+              (ctors : List (Certified.Ordinary.Constructor β × Nat)) →
+                List (Certified.Ordinary.RuleWitness β) →
+                  Option
+                    (Certified.CheckedClaim
+                      (∀ (ctor : Certified.Ordinary.Constructor β) (i : Nat),
+                        (ctor, i) ∈ ctors →
+                          Certified.Ordinary.Shape.RuleFormation entries shape source recursor mode i ctor))
+  implementation: fun {β} [DecidableEq β] fuel entries shape source recursor mode x x_1 =>
+  match x, x_1 with
+  | [], [] => some { down := ⋯ }
+  | (ctor, i) :: ctors, witness :: witnesses => do
+    let rule ← Certified.Ordinary.Shape.checkRule fuel entries shape source recursor mode i ctor witness
+    let rest ← Certified.Ordinary.Shape.checkRules._unsafe_rec fuel entries shape source recursor mode ctors witnesses
+    pure { down := ⋯ }
+  | x, x_2 => none
+compiler recursion worker Ix.Theory.Model.SetTheory.Tower.BoundS._unsafe_rec
+  type: {V : Type u} → [Model.SetTheory V] → Nat → {n : Nat} → Model.SetTheory.Tower.TeleS V n → Prop
+  implementation: fun {V} [Model.SetTheory V] w x x_1 =>
+  match x, x_1 with
+  | .(0), Model.SetTheory.Tower.TeleS.nil => True
+  | .(n + 1), Model.SetTheory.Tower.TeleS.cons A B =>
+    Model.SetTheory.Mem A (Model.SetTheory.univ w) ∧
+      ∀ (a : V), Model.SetTheory.Mem a A → Model.SetTheory.Tower.BoundS._unsafe_rec w (B a)
+compiler recursion worker Ix.Theory.Model.SetTheory.Tower.FitsS._unsafe_rec
+  type: {V : Type u} → [Model.SetTheory V] → {n : Nat} → Model.SetTheory.Tower.TeleS V n → List V → Prop
+  implementation: fun {V} [Model.SetTheory V] x x_1 x_2 =>
+  match x, x_1, x_2 with
+  | .(0), Model.SetTheory.Tower.TeleS.nil, [] => True
+  | .(0), Model.SetTheory.Tower.TeleS.nil, head :: tail => False
+  | .(n + 1), Model.SetTheory.Tower.TeleS.cons A B, [] => False
+  | .(n + 1), Model.SetTheory.Tower.TeleS.cons A B, a :: as =>
+    Model.SetTheory.Mem a A ∧ Model.SetTheory.Tower.FitsS._unsafe_rec (B a) as
+compiler recursion worker Ix.Theory.Model.SetTheory.Tower.PropS._unsafe_rec
+  type: {V : Type u} → [Model.SetTheory V] → {n : Nat} → Model.SetTheory.Tower.TeleS V n → Prop
+  implementation: fun {V} [Model.SetTheory V] x x_1 =>
+  match x, x_1 with
+  | .(0), Model.SetTheory.Tower.TeleS.nil => True
+  | .(n + 1), Model.SetTheory.Tower.TeleS.cons A B =>
+    Model.SetTheory.Mem A Model.SetTheory.univZero ∧
+      ∀ (a : V), Model.SetTheory.Mem a A → Model.SetTheory.Tower.PropS._unsafe_rec (B a)
+Certified project runtime audit OK: 101 compiler recursion workers inventoried; no other unsafe/partial declarations, extern, implemented_by, computed_field, or csimp replacements in the mathematical import graph
+Certified foundation audit OK: 6568 declarations; 145 named roots; explicit SetTheory hypothesis; baseline axioms only
diff --git a/crates/aiur/Cargo.toml b/crates/aiur/Cargo.toml
index cf9e4321e..03f03117a 100644
--- a/crates/aiur/Cargo.toml
+++ b/crates/aiur/Cargo.toml
@@ -15,6 +15,23 @@ rustc-hash = { workspace = true }
 tracing = { workspace = true }
 tracing-texray = { workspace = true }
 
+[dev-dependencies]
+# Compare checked chunk and parent hashing with the pinned native implementation.
+blake3 = "=1.8.5"
+# Test the actual selector methods from the same Plonky3 revision as multi-stark.
+p3-commit = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+# Instrument the native verifier's actual challenger without changing the protocol.
+p3-blake3 = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+p3-challenger = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+p3-symmetric = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+# Capture actual binary MMCS hash calls at the same pinned revision.
+p3-merkle-tree = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+# Exercise the actual FRI folding strategy and its index permutation.
+p3-fri = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+p3-util = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+# Compare coefficient arithmetic with the pinned upstream polynomial utilities.
+p3-stir = { git = "https://github.com/Plonky3/Plonky3", rev = "3152b14a89067c83775a8076cc262ffc48a1fd7c" }
+
 [features]
 default = []
 parallel = ["multi-stark/parallel"]
diff --git a/crates/aiur/src/call_order.rs b/crates/aiur/src/call_order.rs
new file mode 100644
index 000000000..214b40aee
--- /dev/null
+++ b/crates/aiur/src/call_order.rs
@@ -0,0 +1,27 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use multi_stark::p3_field::PrimeCharacteristicRing;
+use rustc_hash::FxHashMap;
+
+use crate::G;
+
+/// Ranks and positive call-order gaps are below 2^48. Their sum is below
+/// 2^49, well below the Goldilocks modulus, so an AIR equality cannot wrap.
+pub(crate) const RANK_BYTES: usize = 6;
+pub(crate) const RANK_BOUND: u64 = 1 << (8 * RANK_BYTES);
+pub(crate) const RANK_LOOKUPS: usize = RANK_BYTES / 2;
+
+/// Extra byte-table queries generated by call-order witnesses. Each worker
+/// accumulates locally; the prover merges these before building Bytes2.
+pub(crate) type RankRanges = FxHashMap<[u8; 2], G>;
+
+pub(crate) fn merge_ranges(
+  mut left: RankRanges,
+  right: RankRanges,
+) -> RankRanges {
+  for (pair, count) in right {
+    *left.entry(pair).or_insert(G::ZERO) += count;
+  }
+  left
+}
diff --git a/crates/aiur/src/constraints.rs b/crates/aiur/src/constraints.rs
index 8691198b2..33eeb2826 100644
--- a/crates/aiur/src/constraints.rs
+++ b/crates/aiur/src/constraints.rs
@@ -7,6 +7,7 @@ use std::{array, ops::Range, sync::LazyLock};
 use crate::{
   FxIndexMap, G,
   bytecode::{Block, Ctrl, Op, Toplevel, ValIdx},
+  call_order::{RANK_BYTES, RANK_LOOKUPS},
   function_channel,
   gadgets::{
     AiurGadget,
@@ -22,6 +23,9 @@ use crate::{
 type Expr = multi_stark::expr::Expr<G>;
 type Degree = u8;
 
+#[cfg(test)]
+mod tests;
+
 /// Main-trace column variable at index `i`.
 #[inline]
 fn var(i: usize) -> Expr {
@@ -67,9 +71,10 @@ pub struct Constraints {
 struct ConstraintState {
   /// Index of the circuit member currently being walked.
   function_index: G,
-  /// Exactly one selector: the circuit backs a single function with a
-  /// single leaf block (no matches), so every lookup slot is written by
-  /// exactly one branch.
+  /// Packed 48-bit rank of this row, shared across circuit members.
+  rank: Expr,
+  /// One function with terminal control and one selector: operation slots
+  /// have one writer. Selector count alone does not exclude empty branches.
   branchless: bool,
   /// Input size of the current member (inputs live in columns
   /// `0..input_size` for every member; the circuit reserves the max).
@@ -122,6 +127,17 @@ impl ConstraintState {
     var(self.column - 1)
   }
 
+  fn range_pair(&mut self, sel: &Expr, a: Expr, b: Expr) {
+    let args = vec![
+      self.gate(sel, konst(u8_range_check_channel())),
+      self.gate(sel, a),
+      self.gate(sel, b),
+    ];
+    let lookup = self.next_lookup();
+    combine_lookup_args(lookup, args);
+    lookup.multiplicity = lookup.multiplicity.clone() + sel.clone();
+  }
+
   fn save(&mut self) -> SharedState {
     SharedState {
       column: self.column,
@@ -138,6 +154,20 @@ impl ConstraintState {
 }
 
 impl Toplevel {
+  /// Ungated lookup arguments are safe only with one writer per slot.
+  /// A branch with no return/yield still writes lookups, so counting the
+  /// terminal selectors alone does not establish that condition.
+  pub(crate) fn circuit_is_branchless(&self, circuit_index: usize) -> bool {
+    let circuit = &self.circuits[circuit_index];
+    let [member] = circuit.members.as_slice() else {
+      return false;
+    };
+    circuit.layout.selectors == 1
+      && self.functions.get(*member).is_some_and(|function| {
+        matches!(function.body.ctrl, Ctrl::Return(..) | Ctrl::Yield(..))
+      })
+  }
+
   /// Build the constraints of one circuit. The circuit's members are walked
   /// like branches of a single function: each walk restarts the auxiliary
   /// column / lookup-slot counters (so members share those, like match arms
@@ -158,7 +188,8 @@ impl Toplevel {
     };
     let mut state = ConstraintState {
       function_index: G::ZERO,
-      branchless: layout.selectors == 1,
+      rank: konst(G::ZERO),
+      branchless: self.circuit_is_branchless(circuit_index),
       input_size: 0,
       sel_base: 0,
       column: 0,
@@ -171,8 +202,13 @@ impl Toplevel {
     // The shared multiplicity column: first auxiliary, right after the
     // selectors. The return lookup occupies the first lookup slot.
     let multiplicity = var(layout.input_size + layout.selectors);
-    state.lookups[0].multiplicity = -multiplicity;
+    state.lookups[0].multiplicity = -multiplicity.clone();
     let aux_start = layout.input_size + layout.selectors + 1;
+    let rank_bytes: [Expr; RANK_BYTES] = array::from_fn(|i| var(aux_start + i));
+    state.rank =
+      rank_bytes.iter().enumerate().fold(konst(G::ZERO), |acc, (i, byte)| {
+        acc + byte.clone() * konst(G::from_u64(1 << (8 * i)))
+      });
     let mut sel_base = layout.input_size;
     let mut circuit_sel = Expr::from(G::ZERO);
     for &member in &circuit.members {
@@ -180,8 +216,8 @@ impl Toplevel {
       state.function_index = G::from_usize(member);
       state.input_size = function.layout.input_size;
       state.sel_base = sel_base;
-      state.column = aux_start;
-      state.lookup = 1;
+      state.column = aux_start + RANK_BYTES;
+      state.lookup = 1 + RANK_LOOKUPS;
       state.map.clear();
       (0..function.layout.input_size).for_each(|i| state.map.push((var(i), 1)));
       let body_sel = function.body.get_block_selector(&state);
@@ -205,8 +241,19 @@ impl Toplevel {
       state
         .constraints
         .zeros
-        .push(circuit_sel.clone() * (Expr::from(G::ONE) - circuit_sel));
+        .push(circuit_sel.clone() * (Expr::from(G::ONE) - circuit_sel.clone()));
     }
+    // Rank bytes are shared across members and checked once for an active
+    // circuit row. An inactive row emits no byte-table queries.
+    state.lookup = 1;
+    for pair in rank_bytes.as_chunks::<2>().0 {
+      state.range_pair(&circuit_sel, pair[0].clone(), pair[1].clone());
+    }
+    // Only an active member can supply a return lookup. In particular,
+    // branchless return arguments are ungated, so an inactive row with a
+    // nonzero multiplicity could otherwise supply an arbitrary result.
+    // Keep the lookup multiplicity linear and constrain its activity here.
+    state.constraints.zeros.push(multiplicity * (konst(G::ONE) - circuit_sel));
     (state.constraints, state.lookups)
   }
 }
@@ -312,6 +359,9 @@ impl Ctrl {
         args.extend(
           values.iter().map(|arg| state.gate(&sel, state.map[*arg].0.clone())),
         );
+        // The public root rank is zero. Lookup compression zero-pads short
+        // messages, preserving the public claim's existing byte encoding.
+        args.push(state.gate(&sel, state.rank.clone()));
         let lookup = &mut state.lookups[0];
         combine_lookup_args(lookup, args);
         // multiplicity is already set
@@ -412,10 +462,12 @@ impl Op {
       },
       Op::EqZero(a) => {
         let (a, deg) = state.map[*a].clone();
-        if let Expr::Const(a) = a {
-          assert_eq!(deg, 0);
-          state.map.push((konst(G::from_bool(a == G::ZERO)), 0));
+        if let (Expr::Const(value), 0) = (&a, deg) {
+          state.map.push((konst(G::from_bool(*value == G::ZERO)), 0));
         } else {
+          // Folding (for example 0*x) can produce a constant while its
+          // tracked degree remains positive. Keep the compiler/witness
+          // allocation and constrain the result through the normal path.
           // We have two constraints:
           // 1. ax = 0
           // 2. ad + x = 1
@@ -462,9 +514,28 @@ impl Op {
           lookup_args
             .extend(output.into_iter().map(|col| state.gate(sel, col)));
 
+          let callee_rank = state.next_auxiliary();
+          lookup_args.push(state.gate(sel, callee_rank.clone()));
+
           let lookup = state.next_lookup();
           combine_lookup_args(lookup, lookup_args);
           lookup.multiplicity = lookup.multiplicity.clone() + sel.clone();
+
+          let gap_bytes: [Expr; RANK_BYTES] =
+            array::from_fn(|_| state.next_auxiliary());
+          let gap = gap_bytes.iter().enumerate().fold(
+            konst(G::ZERO),
+            |acc, (i, byte)| {
+              acc + byte.clone() * konst(G::from_u64(1 << (8 * i)))
+            },
+          );
+          state.constraints.zeros.push(
+            sel.clone()
+              * (callee_rank - state.rank.clone() - konst(G::ONE) - gap),
+          );
+          for pair in gap_bytes.as_chunks::<2>().0 {
+            state.range_pair(sel, pair[0].clone(), pair[1].clone());
+          }
         }
       },
       Op::Store(values) => {
diff --git a/crates/aiur/src/constraints/tests.rs b/crates/aiur/src/constraints/tests.rs
new file mode 100644
index 000000000..1838fc3e2
--- /dev/null
+++ b/crates/aiur/src/constraints/tests.rs
@@ -0,0 +1,288 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Compare the actual argument combiner, selector expressions and escaping
+//! yield collector with the checked Lean selector model. The control fixtures
+//! have no operations and zero-width yields, allowing their selector-only
+//! polynomial positions to be identified without evaluating an executor.
+
+use std::{
+  fs::File,
+  io::{self, BufWriter, Write},
+};
+
+use multi_stark::{
+  eval::{VarValues, eval_expr},
+  p3_field::PrimeField64,
+};
+
+use super::*;
+
+mod block_expressions;
+mod block_rows;
+mod circuit_expressions;
+mod circuit_rows;
+mod compiled_keys;
+mod emission_checks;
+mod frontend_expressions;
+mod memory_rows;
+mod operation_expressions;
+mod operation_rows;
+
+fn write_u64(out: &mut impl Write, value: u64) -> io::Result<()> {
+  out.write_all(&value.to_le_bytes())
+}
+
+fn write_values(out: &mut impl Write, values: &[G]) -> io::Result<()> {
+  write_u64(out, values.len() as u64)?;
+  for value in values {
+    write_u64(out, value.as_canonical_u64())?;
+  }
+  Ok(())
+}
+
+fn local_values(row: &[G]) -> VarValues<'_, G> {
+  VarValues {
+    preprocessed: [&[], &[]],
+    main: [row, row],
+    stage2: [&[], &[]],
+    publics: &[],
+    is_first_row: G::ONE,
+    is_last_row: G::ZERO,
+    is_transition: G::ONE,
+  }
+}
+
+fn state(selector_count: usize, branchless: bool) -> ConstraintState {
+  ConstraintState {
+    function_index: G::from_u64(37),
+    rank: konst(G::from_u64(257)),
+    branchless,
+    input_size: 2,
+    sel_base: 2,
+    column: 2 + selector_count,
+    lookup: 1,
+    lookups: vec![empty_lookup()],
+    map: vec![(var(0), 1), (var(1), 1)],
+    constraints: Constraints {
+      zeros: vec![],
+      selectors: 2..2 + selector_count,
+      width: 2 + selector_count + 1024,
+    },
+    // A nested continuation must preserve yields collected before its own
+    // branch region. These distinct markers are never selector columns.
+    yield_info: vec![
+      (konst(G::from_u64(99)), vec![]),
+      (konst(G::from_u64(100)), vec![]),
+    ],
+  }
+}
+
+fn fixture(depth: usize, seed: usize, next_selector: &mut usize) -> Block {
+  let ctrl = if depth == 0 || seed.is_multiple_of(5) {
+    let selector = *next_selector;
+    *next_selector += 1;
+    if seed.is_multiple_of(2) {
+      Ctrl::Return(selector, vec![])
+    } else {
+      Ctrl::Yield(selector, vec![])
+    }
+  } else {
+    let mut cases = FxIndexMap::default();
+    cases.insert(G::ZERO, fixture(depth - 1, seed * 3 + 1, next_selector));
+    cases.insert(G::ONE, fixture(depth - 1, seed * 3 + 2, next_selector));
+    let fallback = seed
+      .is_multiple_of(2)
+      .then(|| Box::new(fixture(depth - 1, seed * 3 + 3, next_selector)));
+    if seed.is_multiple_of(3) {
+      Ctrl::Match(0, cases, fallback)
+    } else {
+      Ctrl::MatchContinue(
+        0,
+        cases,
+        fallback,
+        0,
+        0,
+        0,
+        Box::new(fixture(depth - 1, seed * 3 + 4, next_selector)),
+      )
+    }
+  };
+  Block { ops: vec![], ctrl }
+}
+
+/// Locate selector booleans and continuation links in the actual emitted
+/// constraint vector. All skipped entries are case/default-match equations;
+/// the zero-width fixtures have no merge-column equations or operations.
+fn selector_equation_indices(
+  block: &Block,
+  cursor: &mut usize,
+  selected: &mut Vec<usize>,
+) {
+  assert!(block.ops.is_empty());
+  selected.push(*cursor);
+  *cursor += 1;
+  match &block.ctrl {
+    Ctrl::Return(..) | Ctrl::Yield(..) => {},
+    Ctrl::Match(_, cases, fallback)
+    | Ctrl::MatchContinue(_, cases, fallback, ..) => {
+      for branch in cases.values() {
+        *cursor += 1;
+        selector_equation_indices(branch, cursor, selected);
+      }
+      if let Some(branch) = fallback {
+        *cursor += cases.len();
+        selector_equation_indices(branch, cursor, selected);
+      }
+      if let Ctrl::MatchContinue(_, _, _, outputs, _, _, continuation) =
+        &block.ctrl
+      {
+        assert_eq!(*outputs, 0);
+        selected.push(*cursor);
+        *cursor += 1;
+        selector_equation_indices(continuation, cursor, selected);
+      }
+    },
+  }
+}
+
+fn assignment(pattern: usize, index: usize, count: usize) -> G {
+  match pattern {
+    0 => G::ZERO,
+    1 => G::ONE,
+    2 => G::TWO,
+    3 => -G::ONE,
+    4 => G::from_usize(index + 1),
+    5 => -G::from_usize(index + 1),
+    6 => G::from_bool(index.is_multiple_of(2)),
+    7 => [G::ZERO, -G::ONE, G::ONE, G::TWO][index % 4],
+    hot if hot < 8 + count => G::from_bool(index == hot - 8),
+    cold => G::from_bool(index != cold - 8 - count),
+  }
+}
+
+fn export_control(out: &mut impl Write) -> io::Result<usize> {
+  write_u64(out, 48)?;
+  let mut checked = 0;
+  let mut satisfying = 0;
+  for depth in 0..4 {
+    for seed in 0..12 {
+      let mut selector_count = 0;
+      let block = fixture(depth, seed, &mut selector_count);
+      let mut state = state(selector_count, false);
+      let entry = block.get_block_selector(&state);
+      block.collect_constraints(entry.clone(), &mut state);
+      let mut equation_indices = vec![];
+      let mut cursor = 0;
+      selector_equation_indices(&block, &mut cursor, &mut equation_indices);
+      assert_eq!(cursor, state.constraints.zeros.len());
+      assert!(state.column <= state.constraints.width);
+      let mut row: Vec<G> =
+        (0..state.constraints.width).map(|i| G::from_usize(i + 11)).collect();
+      row[0] = G::from_u64(3);
+      row[1] = G::from_u64(19);
+      write_u64(out, selector_count as u64)?;
+      write_u64(out, (8 + 2 * selector_count) as u64)?;
+      for pattern in 0..8 + 2 * selector_count {
+        for index in 0..selector_count {
+          row[index + 2] = assignment(pattern, index, selector_count);
+        }
+        let values = local_values(&row);
+        let entry = eval_expr(&entry, &values);
+        let yields: Vec<_> = state
+          .yield_info
+          .iter()
+          .map(|(selector, outputs)| {
+            assert!(outputs.is_empty());
+            eval_expr(selector, &values)
+          })
+          .collect();
+        assert_eq!(&yields[..2], &[G::from_u64(99), G::from_u64(100)]);
+        let equations: Vec<_> = equation_indices
+          .iter()
+          .map(|&index| eval_expr(&state.constraints.zeros[index], &values))
+          .collect();
+        let message: Vec<_> = state.lookups[0]
+          .args
+          .iter()
+          .map(|expr| eval_expr(expr, &values))
+          .collect();
+        if equations.iter().all(|value| value.is_zero()) {
+          let return_sum =
+            message.get(1).copied().unwrap_or(G::ZERO) / G::from_u64(37);
+          assert_eq!(
+            entry,
+            return_sum + yields[2..].iter().copied().sum::<G>()
+          );
+          satisfying += 1;
+        }
+        write_u64(out, entry.as_canonical_u64())?;
+        write_values(out, &yields)?;
+        write_values(out, &equations)?;
+        write_values(out, &message)?;
+        checked += 1;
+      }
+    }
+  }
+  assert!(satisfying > 100, "exercise active and inactive solutions");
+  Ok(checked)
+}
+
+fn export_messages(out: &mut impl Write) -> io::Result<usize> {
+  write_u64(out, 2 * 7 * 32 * 8)?;
+  let values = local_values(&[]);
+  let mut checked = 0;
+  for branchless in [false, true] {
+    let state = state(0, branchless);
+    for count in 0..7 {
+      for seed in 0..32 {
+        for pattern in 0..8 {
+          let mut lookup = empty_lookup();
+          for index in 0..count {
+            let selector = konst(assignment(pattern, index, count));
+            let message = (0..(seed + index * 3) % 8).map(|offset| {
+              let value = G::from_usize(17 + seed + index * 5 + offset * 11);
+              state.gate(
+                &selector,
+                konst(if (seed + offset).is_multiple_of(2) {
+                  value
+                } else {
+                  -value
+                }),
+              )
+            });
+            combine_lookup_args(&mut lookup, message);
+            lookup.multiplicity = lookup.multiplicity + selector;
+          }
+          write_u64(
+            out,
+            eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+          )?;
+          let message: Vec<_> =
+            lookup.args.iter().map(|expr| eval_expr(expr, &values)).collect();
+          write_values(out, &message)?;
+          checked += 1;
+        }
+      }
+    }
+  }
+  Ok(checked)
+}
+
+#[test]
+fn selector_control_snapshot() -> io::Result<()> {
+  let mut out = Vec::new();
+  out.write_all(b"Aiur selector control v1\n")?;
+  let controls = export_control(&mut out)?;
+  let messages = export_messages(&mut out)?;
+  assert_eq!(messages, 3584);
+  if let Some(path) = std::env::var_os("IX_SELECTOR_CONTROL_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "selector control: {controls} assignments, {messages} shared messages"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/block_expressions.rs b/crates/aiur/src/constraints/tests/block_expressions.rs
new file mode 100644
index 000000000..ef96ef31f
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/block_expressions.rs
@@ -0,0 +1,194 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Exact expression reflection for complete blocks. The transport includes
+//! the actual control tree, so Lean does not reconstruct an independent fixture.
+
+use super::{
+  frontend_expressions::write_expr,
+  operation_expressions::{write_exprs, write_indices, write_map, write_op},
+  *,
+};
+
+pub(super) fn write_block(
+  out: &mut impl Write,
+  block: &Block,
+) -> io::Result<()> {
+  write_u64(out, block.ops.len() as u64)?;
+  for op in &block.ops {
+    write_op(out, op)?;
+  }
+  match &block.ctrl {
+    Ctrl::Return(index, values) | Ctrl::Yield(index, values) => {
+      out.write_all(&[u8::from(matches!(block.ctrl, Ctrl::Yield(..)))])?;
+      write_u64(out, *index as u64)?;
+      write_indices(out, values)
+    },
+    Ctrl::Match(index, cases, fallback)
+    | Ctrl::MatchContinue(index, cases, fallback, ..) => {
+      let continued = matches!(block.ctrl, Ctrl::MatchContinue(..));
+      out.write_all(&[if continued { 3 } else { 2 }])?;
+      write_u64(out, *index as u64)?;
+      write_u64(out, cases.len() as u64)?;
+      for (value, block) in cases {
+        write_u64(out, value.as_canonical_u64())?;
+        write_block(out, block)?;
+      }
+      out.write_all(&[u8::from(fallback.is_some())])?;
+      if let Some(block) = fallback {
+        write_block(out, block)?;
+      }
+      if let Ctrl::MatchContinue(_, _, _, size, aux, slots, block) = &block.ctrl
+      {
+        write_u64(out, *size as u64)?;
+        write_u64(out, *aux as u64)?;
+        write_u64(out, *slots as u64)?;
+        write_block(out, block)?;
+      }
+      Ok(())
+    },
+  }
+}
+
+fn write_evaluated_map(
+  out: &mut impl Write,
+  map: &[(Expr, Degree)],
+  values: &VarValues<'_, G>,
+) -> io::Result<()> {
+  for (expr, degree) in map {
+    write_u64(out, eval_expr(expr, values).as_canonical_u64())?;
+    write_u64(out, u64::from(*degree))?;
+    out.write_all(&[u8::from(matches!(expr, Expr::Const(_)))])?;
+  }
+  Ok(())
+}
+
+#[test]
+fn block_expressions_snapshot() -> io::Result<()> {
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    -G::ONE,
+    G::from_u64(255),
+    G::from_u64(256),
+    G::from_u64(1 << 32),
+    G::from_u64((1 << 48) - 1),
+    G::from_u64(17),
+  ];
+  let mut out = Vec::new();
+  out.write_all(b"Aiur block expressions v1\n")?;
+  write_u64(&mut out, 384)?;
+  let mut reports = 0;
+  let mut checked = 0;
+  for branchless in [false, true] {
+    for populated in [false, true] {
+      for external_gate in [false, true] {
+        for depth in 0..4 {
+          for seed in 0..12 {
+            let mut selector_count = 0;
+            let block = if populated {
+              block_rows::block_fixture(depth, seed, 2, &mut selector_count)
+            } else {
+              fixture(depth, seed, &mut selector_count)
+            };
+            let mut state = state(selector_count, branchless);
+            state.constraints.width = 2 + selector_count + 4096;
+            state.lookups = (0..4096).map(|_| empty_lookup()).collect();
+            for (_, values) in &mut state.yield_info {
+              *values = state.map.clone();
+            }
+            let selectors: Vec<_> = (0..selector_count)
+              .map(|index| var(state.sel_base + index))
+              .collect();
+            let entry = block.get_block_selector(&state);
+            let incoming = if external_gate {
+              konst(G::TWO) - var(0)
+            } else {
+              entry.clone()
+            };
+            out.write_all(&[u8::from(branchless)])?;
+            write_u64(&mut out, state.function_index.as_canonical_u64())?;
+            write_u64(&mut out, state.input_size as u64)?;
+            write_expr(&mut out, &state.rank)?;
+            write_exprs(&mut out, &selectors)?;
+            write_u64(&mut out, state.column as u64)?;
+            write_u64(&mut out, state.lookup as u64)?;
+            write_expr(&mut out, &incoming)?;
+            write_map(&mut out, &state.map)?;
+            write_block(&mut out, &block)?;
+            write_expr(&mut out, &entry)?;
+            block.collect_constraints(incoming, &mut state);
+            assert!(state.column <= state.constraints.width);
+            assert!(state.lookup + 2 <= state.lookups.len());
+            write_u64(&mut out, state.column as u64)?;
+            write_u64(&mut out, state.lookup as u64)?;
+            write_map(&mut out, &state.map)?;
+            write_exprs(&mut out, &state.constraints.zeros)?;
+            // Include unused slots as well as the shared return channel.
+            write_u64(&mut out, (state.lookup + 2) as u64)?;
+            for lookup in &state.lookups[..state.lookup + 2] {
+              write_expr(&mut out, &lookup.multiplicity)?;
+              write_exprs(&mut out, &lookup.args)?;
+            }
+            write_u64(&mut out, state.yield_info.len() as u64)?;
+            for (gate, map) in &state.yield_info {
+              write_expr(&mut out, gate)?;
+              write_map(&mut out, map)?;
+            }
+            write_u64(&mut out, 4)?;
+            for pattern in [0, 1, 2, 7] {
+              let mut row: Vec<_> = (0..state.column)
+                .map(|index| {
+                  choices[(seed + 5 * index + pattern) % choices.len()]
+                })
+                .collect();
+              for index in 0..selector_count {
+                row[index + 2] = assignment(pattern, index, selector_count);
+              }
+              write_values(&mut out, &row)?;
+              let values = local_values(&row);
+              write_evaluated_map(&mut out, &state.map, &values)?;
+              for expr in &state.constraints.zeros {
+                write_u64(
+                  &mut out,
+                  eval_expr(expr, &values).as_canonical_u64(),
+                )?;
+              }
+              for lookup in &state.lookups[..state.lookup + 2] {
+                write_u64(
+                  &mut out,
+                  eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+                )?;
+                for arg in &lookup.args {
+                  write_u64(
+                    &mut out,
+                    eval_expr(arg, &values).as_canonical_u64(),
+                  )?;
+                }
+              }
+              for (gate, map) in &state.yield_info {
+                write_u64(
+                  &mut out,
+                  eval_expr(gate, &values).as_canonical_u64(),
+                )?;
+                write_evaluated_map(&mut out, map, &values)?;
+              }
+              checked += 1;
+            }
+            reports += 1;
+          }
+        }
+      }
+    }
+  }
+  assert_eq!((reports, checked), (384, 1536));
+  if let Some(path) = std::env::var_os("IX_BLOCK_EXPRESSION_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "block expressions: {reports} control trees, {checked} assignments"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/block_rows.rs b/crates/aiur/src/constraints/tests/block_rows.rs
new file mode 100644
index 000000000..5e7b3e100
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/block_rows.rs
@@ -0,0 +1,168 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Full block emission with shared branch storage and nonempty yields.
+//! Rows include arbitrary selectors and advice, without an executor filter.
+
+use super::*;
+
+pub(super) fn block_fixture(
+  depth: usize,
+  seed: usize,
+  initial_values: usize,
+  next_selector: &mut usize,
+) -> Block {
+  let size = seed % 3;
+  let pointer = initial_values + 3 + size;
+  let count = initial_values + 6 + 2 * size;
+  let ops = vec![
+    Op::Const(G::from_usize(seed + 17)),
+    Op::Mul(0, 1),
+    Op::EqZero(if seed.is_multiple_of(2) { initial_values } else { 0 }),
+    Op::Call(17, vec![0, initial_values], size, false),
+    Op::Store(vec![0, initial_values + 1]),
+    Op::Load(size, pointer),
+    Op::U8Add(0, 1),
+    Op::AssertEq(vec![initial_values + 1], vec![0], None),
+  ];
+  let ctrl = if depth == 0 || seed.is_multiple_of(5) {
+    let selector = *next_selector;
+    *next_selector += 1;
+    let outputs = vec![count - 2, count - 1];
+    if seed.is_multiple_of(2) {
+      Ctrl::Return(selector, outputs)
+    } else {
+      Ctrl::Yield(selector, outputs)
+    }
+  } else {
+    let mut cases = FxIndexMap::default();
+    cases.insert(
+      G::ZERO,
+      block_fixture(depth - 1, seed * 3 + 1, count, next_selector),
+    );
+    cases.insert(
+      G::ONE,
+      block_fixture(depth - 1, seed * 3 + 2, count, next_selector),
+    );
+    let fallback = seed.is_multiple_of(2).then(|| {
+      Box::new(block_fixture(depth - 1, seed * 3 + 3, count, next_selector))
+    });
+    let matched = if seed.is_multiple_of(2) { initial_values } else { 0 };
+    if seed.is_multiple_of(3) {
+      Ctrl::Match(matched, cases, fallback)
+    } else {
+      Ctrl::MatchContinue(
+        matched,
+        cases,
+        fallback,
+        2,
+        0,
+        0,
+        Box::new(block_fixture(
+          depth - 1,
+          seed * 3 + 4,
+          count + 2,
+          next_selector,
+        )),
+      )
+    }
+  };
+  Block { ops, ctrl }
+}
+
+fn write_map(
+  out: &mut impl Write,
+  map: &[(Expr, Degree)],
+  values: &VarValues<'_, G>,
+) -> io::Result<()> {
+  write_u64(out, map.len() as u64)?;
+  for (expr, degree) in map {
+    write_u64(out, eval_expr(expr, values).as_canonical_u64())?;
+    write_u64(out, u64::from(*degree))?;
+    write_u64(out, u64::from(matches!(expr, Expr::Const(_))))?;
+  }
+  Ok(())
+}
+
+#[test]
+fn block_rows_snapshot() -> io::Result<()> {
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    -G::ONE,
+    G::from_u64(255),
+    G::from_u64(256),
+    G::from_u64(1 << 32),
+    G::from_u64((1 << 48) - 1),
+    G::from_u64(17),
+  ];
+  let mut out = Vec::new();
+  out.write_all(b"Aiur block rows v1\n")?;
+  write_u64(&mut out, 96)?;
+  let mut checked = 0;
+  for branchless in [false, true] {
+    for depth in 0..4 {
+      for seed in 0..12 {
+        let mut selector_count = 0;
+        let block = block_fixture(depth, seed, 2, &mut selector_count);
+        let mut state = state(selector_count, branchless);
+        state.constraints.width = 2 + selector_count + 4096;
+        state.lookups = (0..4096).map(|_| empty_lookup()).collect();
+        for (_, values) in &mut state.yield_info {
+          *values = vec![(var(0), 1), (var(1), 1)];
+        }
+        let entry = block.get_block_selector(&state);
+        block.collect_constraints(entry, &mut state);
+        assert!(state.column <= state.constraints.width);
+        assert!(state.lookup <= state.lookups.len());
+        let mut row: Vec<_> = (0..state.constraints.width)
+          .map(|index| choices[(seed + 5 * index) % choices.len()])
+          .collect();
+        write_u64(&mut out, selector_count as u64)?;
+        write_u64(&mut out, (8 + 2 * selector_count) as u64)?;
+        for pattern in 0..8 + 2 * selector_count {
+          for index in 0..selector_count {
+            row[index + 2] = assignment(pattern, index, selector_count);
+          }
+          let values = local_values(&row);
+          write_u64(&mut out, state.column as u64)?;
+          write_u64(&mut out, state.lookup as u64)?;
+          write_map(&mut out, &state.map, &values)?;
+          let equations: Vec<_> = state
+            .constraints
+            .zeros
+            .iter()
+            .map(|expr| eval_expr(expr, &values))
+            .collect();
+          write_values(&mut out, &equations)?;
+          for lookup in &state.lookups[..state.lookup] {
+            write_u64(
+              &mut out,
+              eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+            )?;
+            let args: Vec<_> =
+              lookup.args.iter().map(|expr| eval_expr(expr, &values)).collect();
+            write_values(&mut out, &args)?;
+          }
+          write_u64(&mut out, state.yield_info.len() as u64)?;
+          for (selector, map) in &state.yield_info {
+            write_u64(
+              &mut out,
+              eval_expr(selector, &values).as_canonical_u64(),
+            )?;
+            write_map(&mut out, map, &values)?;
+          }
+          checked += 1;
+        }
+      }
+    }
+  }
+  assert_eq!(checked, 2028);
+  if let Some(path) = std::env::var_os("IX_BLOCK_ROW_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!("block rows: {checked} assignments with shared columns and slots");
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/circuit_expressions.rs b/crates/aiur/src/constraints/tests/circuit_expressions.rs
new file mode 100644
index 000000000..86b50ab09
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/circuit_expressions.rs
@@ -0,0 +1,133 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Transport actual programs and complete circuit-builder expressions.
+
+use super::{
+  block_expressions::write_block,
+  circuit_rows::{circuit_layout, fixture_function},
+  frontend_expressions::write_expr,
+  operation_expressions::{write_exprs, write_indices},
+  *,
+};
+use crate::bytecode::{Circuit, FunctionLayout};
+
+pub(super) fn write_layout(
+  out: &mut impl Write,
+  layout: FunctionLayout,
+) -> io::Result<()> {
+  for count in
+    [layout.input_size, layout.selectors, layout.auxiliaries, layout.lookups]
+  {
+    write_u64(out, count as u64)?;
+  }
+  Ok(())
+}
+
+#[test]
+fn circuit_expressions_snapshot() -> io::Result<()> {
+  let groups: &[&[usize]] =
+    &[&[0], &[1], &[2], &[3], &[0, 1], &[2, 0, 3], &[3, 2, 1, 0], &[]];
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    -G::ONE,
+    G::from_u64(255),
+    G::from_u64(256),
+    G::from_u64(1 << 32),
+    G::from_u64((1 << 48) - 1),
+    G::from_u64(17),
+  ];
+  let mut out = Vec::new();
+  out.write_all(b"Aiur circuit expressions v1\n")?;
+  write_u64(&mut out, 12)?;
+  let mut reports = 0;
+  let mut checked = 0;
+  for seed in 0..12 {
+    let functions: Vec<_> =
+      (0..4).map(|index| fixture_function(seed, index)).collect();
+    let circuits = groups
+      .iter()
+      .map(|members| Circuit {
+        members: members.to_vec(),
+        layout: circuit_layout(&functions, members),
+      })
+      .collect();
+    let top = Toplevel { functions, circuits, memory_sizes: vec![] };
+    assert!(top.validate_row_counts().is_ok());
+    assert!(top.validate_emission().is_ok());
+    write_u64(&mut out, top.functions.len() as u64)?;
+    for function in &top.functions {
+      write_block(&mut out, &function.body)?;
+      write_layout(&mut out, function.layout)?;
+      out.write_all(&[
+        u8::from(function.entry),
+        u8::from(function.constrained),
+      ])?;
+    }
+    write_u64(&mut out, top.circuits.len() as u64)?;
+    for circuit in &top.circuits {
+      write_indices(&mut out, &circuit.members)?;
+      write_layout(&mut out, circuit.layout)?;
+    }
+    for (index, circuit) in top.circuits.iter().enumerate() {
+      out.write_all(&[u8::from(top.circuit_is_branchless(index))])?;
+      let (constraints, lookups) = top.build_constraints(index);
+      let inactive_row = vec![G::ZERO; constraints.width];
+      let inactive_values = local_values(&inactive_row);
+      assert!(
+        constraints
+          .zeros
+          .iter()
+          .all(|expr| eval_expr(expr, &inactive_values) == G::ZERO)
+      );
+      write_u64(&mut out, constraints.width as u64)?;
+      write_u64(&mut out, constraints.selectors.start as u64)?;
+      write_u64(&mut out, constraints.selectors.len() as u64)?;
+      write_exprs(&mut out, &constraints.zeros)?;
+      write_u64(&mut out, lookups.len() as u64)?;
+      for lookup in &lookups {
+        write_expr(&mut out, &lookup.multiplicity)?;
+        write_exprs(&mut out, &lookup.args)?;
+      }
+      write_u64(&mut out, 4)?;
+      for pattern in [0, 1, 2, 7] {
+        let mut row: Vec<_> = (0..constraints.width)
+          .map(|column| {
+            choices[(seed + 5 * column + 3 * pattern) % choices.len()]
+          })
+          .collect();
+        for column in 0..circuit.layout.selectors {
+          row[constraints.selectors.start + column] =
+            assignment(pattern, column, circuit.layout.selectors);
+        }
+        write_values(&mut out, &row)?;
+        let values = local_values(&row);
+        for expr in &constraints.zeros {
+          write_u64(&mut out, eval_expr(expr, &values).as_canonical_u64())?;
+        }
+        for lookup in &lookups {
+          write_u64(
+            &mut out,
+            eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+          )?;
+          for arg in &lookup.args {
+            write_u64(&mut out, eval_expr(arg, &values).as_canonical_u64())?;
+          }
+        }
+        checked += 1;
+      }
+      reports += 1;
+    }
+  }
+  assert_eq!((reports, checked), (96, 384));
+  if let Some(path) = std::env::var_os("IX_CIRCUIT_EXPRESSION_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "circuit expressions: {reports} circuits, {checked} assignments, {reports} inactive zero rows"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/circuit_rows.rs b/crates/aiur/src/constraints/tests/circuit_rows.rs
new file mode 100644
index 000000000..98e66f90c
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/circuit_rows.rs
@@ -0,0 +1,214 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! The actual whole-circuit builder, including grouped member offsets,
+//! shared multiplicity/rank columns, and all physical lookup slots.
+
+use super::*;
+use crate::bytecode::{Circuit, Function, FunctionLayout};
+
+fn close_returns(block: &mut Block, width: usize, escapes: bool) {
+  match &mut block.ctrl {
+    Ctrl::Return(_, outputs) => outputs.truncate(width),
+    Ctrl::Yield(selector, outputs) => {
+      if escapes {
+        block.ctrl = Ctrl::Return(*selector, outputs[..width].to_vec());
+      }
+    },
+    Ctrl::Match(_, cases, fallback) => {
+      for body in cases.values_mut() {
+        close_returns(body, width, escapes);
+      }
+      if let Some(body) = fallback {
+        close_returns(body, width, escapes);
+      }
+    },
+    Ctrl::MatchContinue(_, cases, fallback, _, _, _, continuation) => {
+      for body in cases.values_mut() {
+        close_returns(body, width, false);
+      }
+      if let Some(body) = fallback {
+        close_returns(body, width, false);
+      }
+      close_returns(continuation, width, escapes);
+    },
+  }
+}
+
+pub(super) fn fixture_function(seed: usize, index: usize) -> Function {
+  let input_size = 2 + (seed + index) % 3;
+  let depth = (seed + index) % 3;
+  let mut selectors = 0;
+  let mut body = block_rows::block_fixture(
+    depth,
+    seed * 4 + index,
+    input_size,
+    &mut selectors,
+  );
+  close_returns(&mut body, index % 3, true);
+  if seed.is_multiple_of(4) && index == 0 {
+    body = Block {
+      ops: vec![],
+      ctrl: Ctrl::Match(
+        0,
+        [
+          (
+            G::ZERO,
+            Block {
+              ops: vec![Op::Store(vec![])],
+              ctrl: Ctrl::Match(0, FxIndexMap::default(), None),
+            },
+          ),
+          (G::ONE, body),
+        ]
+        .into_iter()
+        .collect(),
+        None,
+      ),
+    };
+  }
+  let mut measured = state(selectors, false);
+  measured.input_size = input_size;
+  measured.sel_base = input_size;
+  measured.column = input_size + selectors + 7;
+  measured.lookup = 4;
+  measured.map = (0..input_size).map(|i| (var(i), 1)).collect();
+  measured.lookups = (0..4096).map(|_| empty_lookup()).collect();
+  measured.yield_info.clear();
+  let selector = body.get_block_selector(&measured);
+  body.collect_constraints(selector, &mut measured);
+  assert!(measured.yield_info.is_empty());
+  Function {
+    body,
+    layout: FunctionLayout {
+      input_size,
+      selectors,
+      auxiliaries: measured.column - input_size - selectors,
+      lookups: measured.lookup,
+    },
+    entry: true,
+    constrained: true,
+  }
+}
+
+pub(super) fn circuit_layout(
+  functions: &[Function],
+  members: &[usize],
+) -> FunctionLayout {
+  let mut layout =
+    FunctionLayout { input_size: 0, selectors: 0, auxiliaries: 7, lookups: 4 };
+  for &member in members {
+    let next = functions[member].layout;
+    layout.input_size = layout.input_size.max(next.input_size);
+    layout.selectors += next.selectors;
+    layout.auxiliaries = layout.auxiliaries.max(next.auxiliaries);
+    layout.lookups = layout.lookups.max(next.lookups);
+  }
+  layout
+}
+
+#[test]
+fn circuit_rows_snapshot() -> io::Result<()> {
+  let groups: &[&[usize]] =
+    &[&[0], &[1], &[2], &[3], &[0, 1], &[2, 0, 3], &[3, 2, 1, 0], &[]];
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    -G::ONE,
+    G::from_u64(255),
+    G::from_u64(256),
+    G::from_u64(1 << 32),
+    G::from_u64((1 << 48) - 1),
+    G::from_u64(17),
+  ];
+  let mut out = Vec::new();
+  out.write_all(b"Aiur circuit rows v3\n")?;
+  write_u64(&mut out, (12 * groups.len()) as u64)?;
+  let mut checked = 0;
+  for seed in 0..12 {
+    let functions: Vec<_> = (0..4).map(|i| fixture_function(seed, i)).collect();
+    let circuits = groups
+      .iter()
+      .map(|members| Circuit {
+        members: members.to_vec(),
+        layout: circuit_layout(&functions, members),
+      })
+      .collect();
+    let top = Toplevel { functions, circuits, memory_sizes: vec![] };
+    for function in &top.functions {
+      let counts = function.body.control_counts().expect("control counts fit");
+      assert_eq!(counts.leaves, function.layout.selectors);
+      for count in [counts.nodes, counts.leaves, counts.returns, counts.yields]
+      {
+        write_u64(&mut out, count as u64)?;
+      }
+    }
+    assert!(top.validate_row_counts().is_ok());
+    out.push(u8::from(top.validate_row_counts().is_ok()));
+    for circuit_index in 0..groups.len() {
+      let circuit = &top.circuits[circuit_index];
+      let count = circuit.layout.selectors;
+      for limit in [0, count.saturating_sub(1), count, count + 1] {
+        let variant = Circuit {
+          members: circuit.members.clone(),
+          layout: FunctionLayout { selectors: limit, ..circuit.layout },
+        };
+        out.push(u8::from(variant.validate_row_counts(&top).is_ok()));
+      }
+      let mut missing = circuit.members.clone();
+      missing.push(top.functions.len());
+      let missing = Circuit { members: missing, layout: circuit.layout };
+      assert!(missing.validate_row_counts(&top).is_err());
+      out.push(u8::from(missing.validate_row_counts(&top).is_ok()));
+      let doubled =
+        Circuit { members: circuit.members.repeat(2), layout: circuit.layout };
+      out.push(u8::from(doubled.validate_row_counts(&top).is_ok()));
+      out.push(u8::from(top.circuit_is_branchless(circuit_index)));
+      let (constraints, lookups) = top.build_constraints(circuit_index);
+      let selector_count = constraints.selectors.len();
+      write_u64(&mut out, constraints.width as u64)?;
+      write_u64(&mut out, constraints.selectors.start as u64)?;
+      write_u64(&mut out, selector_count as u64)?;
+      write_u64(&mut out, lookups.len() as u64)?;
+      write_u64(&mut out, (8 + 2 * selector_count) as u64)?;
+      for pattern in 0..8 + 2 * selector_count {
+        let mut row: Vec<_> = (0..constraints.width)
+          .map(|index| {
+            choices[(seed + 5 * index + 3 * pattern) % choices.len()]
+          })
+          .collect();
+        for index in 0..selector_count {
+          row[constraints.selectors.start + index] =
+            assignment(pattern, index, selector_count);
+        }
+        let values = local_values(&row);
+        let equations: Vec<_> = constraints
+          .zeros
+          .iter()
+          .map(|expr| eval_expr(expr, &values))
+          .collect();
+        write_values(&mut out, &equations)?;
+        for lookup in &lookups {
+          write_u64(
+            &mut out,
+            eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+          )?;
+          let message: Vec<_> =
+            lookup.args.iter().map(|expr| eval_expr(expr, &values)).collect();
+          write_values(&mut out, &message)?;
+        }
+        checked += 1;
+      }
+    }
+  }
+  assert_eq!(checked, 2022);
+  if let Some(path) = std::env::var_os("IX_CIRCUIT_ROW_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "circuit rows: {checked} assignments, 48 control counts, 588 count checks, 96 branchless decisions"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/compiled_keys.rs b/crates/aiur/src/constraints/tests/compiled_keys.rs
new file mode 100644
index 000000000..149132095
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/compiled_keys.rs
@@ -0,0 +1,199 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Native key construction from transported function fixtures, memories and
+//! both byte tables. Include all native matrix families in the assignments.
+
+use super::{
+  block_expressions::write_block,
+  circuit_expressions::write_layout,
+  circuit_rows::{circuit_layout, fixture_function},
+  operation_expressions::write_indices,
+  *,
+};
+use crate::{
+  bytecode::Circuit,
+  gadgets::{AiurGadget, bytes1::Bytes1, bytes2::Bytes2},
+  memory::Memory,
+  synthesis::AiurConfig,
+  vk_codec,
+};
+use multi_stark::{
+  system::{CircuitInputs, System},
+  types::{CommitmentParameters, FriParameters},
+};
+
+fn inputs(top: &Toplevel) -> Vec<CircuitInputs<G>> {
+  let mut result = Vec::new();
+  for (index, _) in top.circuits.iter().enumerate() {
+    let (constraints, lookups) = top.build_constraints(index);
+    let lookup_group_size =
+      if top.circuit_is_branchless(index) && lookups.len() >= 2 {
+        2
+      } else {
+        1
+      };
+    result.push(CircuitInputs {
+      main_width: constraints.width,
+      constraints: constraints.zeros,
+      lookups,
+      lookup_group_size,
+      ..CircuitInputs::default()
+    });
+  }
+  for &width in &top.memory_sizes {
+    let (memory, constraints, lookups) = Memory::build(width);
+    result.push(CircuitInputs {
+      main_width: memory.width,
+      constraints,
+      lookups,
+      lookup_group_size: 1,
+      ..CircuitInputs::default()
+    });
+  }
+  result.extend([
+    CircuitInputs {
+      main_width: Bytes1.main_width(),
+      preprocessed: Bytes1.preprocessed(),
+      lookups: Bytes1.lookups(),
+      lookup_group_size: 2,
+      ..CircuitInputs::default()
+    },
+    CircuitInputs {
+      main_width: Bytes2.main_width(),
+      preprocessed: Bytes2.preprocessed(),
+      lookups: Bytes2.lookups(),
+      lookup_group_size: 2,
+      ..CircuitInputs::default()
+    },
+  ]);
+  result
+}
+
+fn columns(width: usize, seed: usize, family: usize) -> Vec<G> {
+  (0..width)
+    .map(|index| match seed {
+      0 => G::ZERO,
+      1 => G::ONE,
+      2 => -G::ONE,
+      _ => G::from_usize(17 + family * 31 + index * 13),
+    })
+    .collect()
+}
+
+#[test]
+fn compiled_key_snapshot() -> io::Result<()> {
+  let groups: &[&[usize]] =
+    &[&[0], &[1], &[2], &[3], &[0, 1], &[2, 0, 3], &[3, 2, 1, 0], &[]];
+  let cp = CommitmentParameters { log_blowup: 1, cap_height: 0 };
+  let fp = FriParameters {
+    log_final_poly_len: 0,
+    max_log_arity: 1,
+    num_queries: 64,
+    commit_proof_of_work_bits: 0,
+    query_proof_of_work_bits: 0,
+  };
+  let mut out = b"Aiur compiled keys v1\n".to_vec();
+  write_u64(&mut out, 12)?;
+  let mut assignments = 0;
+  for seed in 0..12 {
+    let functions: Vec<_> =
+      (0..4).map(|index| fixture_function(seed, index)).collect();
+    let circuits = groups
+      .iter()
+      .map(|members| Circuit {
+        members: members.to_vec(),
+        layout: circuit_layout(&functions, members),
+      })
+      .collect();
+    let top =
+      Toplevel { functions, circuits, memory_sizes: vec![0, 1, 2, 4, 8] };
+    write_u64(&mut out, top.functions.len() as u64)?;
+    for function in &top.functions {
+      write_block(&mut out, &function.body)?;
+      write_layout(&mut out, function.layout)?;
+      out.extend([u8::from(function.entry), u8::from(function.constrained)]);
+    }
+    write_u64(&mut out, top.circuits.len() as u64)?;
+    for circuit in &top.circuits {
+      write_indices(&mut out, &circuit.members)?;
+      write_layout(&mut out, circuit.layout)?;
+    }
+    write_indices(&mut out, &top.memory_sizes)?;
+    let inputs = inputs(&top);
+    let expressions: Vec<_> = inputs
+      .iter()
+      .map(|input| (input.constraints.clone(), input.lookups.clone()))
+      .collect();
+    let system = System::new(AiurConfig::new(cp, fp), inputs).0;
+    let key = vk_codec::to_bytes(&system, cp, fp);
+    write_u64(&mut out, key.len() as u64)?;
+    out.extend(key);
+    assert_eq!(system.circuits.len(), 15);
+    for (circuit, (constraints, lookups)) in
+      system.circuits.iter().zip(expressions)
+    {
+      write_u64(&mut out, 4)?;
+      for pattern in 0..4 {
+        let pre = columns(circuit.preprocessed_width, pattern, 0);
+        let pre_next = columns(circuit.preprocessed_width, pattern, 1);
+        let main = columns(circuit.main_width, pattern, 2);
+        let main_next = columns(circuit.main_width, pattern, 3);
+        let stage2 = columns(circuit.stage_2_width, pattern, 4);
+        let stage2_next = columns(circuit.stage_2_width, pattern, 5);
+        let publics = columns(circuit.num_publics, pattern, 6);
+        for cols in
+          [&pre, &pre_next, &main, &main_next, &stage2, &stage2_next, &publics]
+        {
+          write_values(&mut out, cols)?;
+        }
+        let selectors = columns(3, pattern, 7);
+        for selector in &selectors {
+          write_u64(&mut out, selector.as_canonical_u64())?;
+        }
+        let values = VarValues {
+          preprocessed: [&pre, &pre_next],
+          main: [&main, &main_next],
+          stage2: [&stage2, &stage2_next],
+          publics: &publics,
+          is_first_row: selectors[0],
+          is_last_row: selectors[1],
+          is_transition: selectors[2],
+        };
+        write_values(
+          &mut out,
+          &constraints
+            .iter()
+            .map(|expr| eval_expr(expr, &values))
+            .collect::<Vec<_>>(),
+        )?;
+        write_u64(&mut out, lookups.len() as u64)?;
+        for lookup in &lookups {
+          write_u64(
+            &mut out,
+            eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+          )?;
+          write_values(
+            &mut out,
+            &lookup
+              .args
+              .iter()
+              .map(|expr| eval_expr(expr, &values))
+              .collect::<Vec<_>>(),
+          )?;
+        }
+        assignments += 1;
+      }
+    }
+  }
+  assert_eq!(assignments, 720);
+  if let Some(path) = std::env::var_os("IX_COMPILED_KEY_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "compiled keys: 12 systems, 180 circuits, {assignments} assignments"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/emission_checks.rs b/crates/aiur/src/constraints/tests/emission_checks.rs
new file mode 100644
index 000000000..c9bfae43a
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/emission_checks.rs
@@ -0,0 +1,192 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Compare checked scopes without allocating values near machine bounds.
+
+use super::{
+  block_expressions::write_block, block_rows::block_fixture,
+  operation_expressions::write_op, operation_rows::fixtures, *,
+};
+use crate::emission_checks::check_emission_ops;
+
+fn write_result(out: &mut impl Write, result: Option<usize>) -> io::Result<()> {
+  out.write_all(&[u8::from(result.is_some())])?;
+  if let Some(value) = result {
+    write_u64(out, value as u64)?;
+  }
+  Ok(())
+}
+
+fn edge_blocks() -> Vec<Block> {
+  fn ret(index: usize, outputs: Vec<usize>) -> Block {
+    Block { ops: vec![], ctrl: Ctrl::Return(index, outputs) }
+  }
+  fn yielded(index: usize, outputs: Vec<usize>) -> Block {
+    Block { ops: vec![], ctrl: Ctrl::Yield(index, outputs) }
+  }
+  fn continued(arm: Block, size: usize, cont: Block) -> Block {
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::MatchContinue(
+        0,
+        [(G::ZERO, arm)].into_iter().collect(),
+        Some(Box::new(ret(1, vec![]))),
+        size,
+        0,
+        0,
+        Box::new(cont),
+      ),
+    }
+  }
+  vec![
+    ret(0, vec![]),
+    ret(0, vec![0]),
+    ret(1, vec![]),
+    ret(usize::MAX, vec![]),
+    yielded(0, vec![]),
+    yielded(0, vec![0]),
+    Block { ops: vec![], ctrl: Ctrl::Match(0, Default::default(), None) },
+    Block { ops: vec![Op::Store(vec![0])], ctrl: Ctrl::Return(0, vec![0]) },
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::Match(
+        0,
+        [
+          (
+            G::ZERO,
+            Block {
+              ops: vec![Op::Const(G::ONE)],
+              ctrl: Ctrl::Return(0, vec![1]),
+            },
+          ),
+          (G::ONE, ret(1, vec![1])),
+        ]
+        .into_iter()
+        .collect(),
+        None,
+      ),
+    },
+    continued(yielded(0, vec![0]), 1, ret(2, vec![1])),
+    continued(yielded(0, vec![0]), 1, ret(2, vec![2])),
+    continued(yielded(0, vec![]), 1, ret(2, vec![1])),
+    continued(yielded(0, vec![0, 0]), 1, ret(2, vec![1])),
+    continued(ret(0, vec![0]), 0, yielded(2, vec![0])),
+    continued(
+      continued(yielded(0, vec![0]), 1, yielded(2, vec![1])),
+      1,
+      ret(3, vec![1]),
+    ),
+    continued(
+      continued(yielded(0, vec![0]), 1, yielded(2, vec![])),
+      1,
+      ret(3, vec![1]),
+    ),
+    continued(yielded(0, vec![]), usize::MAX, ret(2, vec![])),
+  ]
+}
+
+#[test]
+fn emission_checks_snapshot() -> io::Result<()> {
+  let scopes = [
+    0,
+    1,
+    2,
+    3,
+    4,
+    7,
+    8,
+    9,
+    12,
+    16,
+    usize::MAX - 8,
+    usize::MAX - 1,
+    usize::MAX,
+  ];
+  let mut groups = fixtures();
+  for width in [0, 1, 2, 3, 5, 6] {
+    groups.push(vec![Op::U32ToField(vec![0; width])]);
+    groups.push(vec![Op::UnconstrainedU32Add(vec![0; 4], vec![0; width])]);
+    groups.push(vec![Op::UnconstrainedU32Add3(
+      vec![0; 4],
+      vec![0; width],
+      vec![0; 4],
+    )]);
+  }
+  groups.extend([
+    vec![Op::AssertEq(vec![0], vec![], None)],
+    vec![Op::AssertEq(vec![], vec![0], None)],
+    vec![Op::Store(vec![usize::MAX])],
+    vec![Op::IORead(0, 0, usize::MAX)],
+    vec![Op::Load(usize::MAX, 0)],
+    vec![Op::Call(0, vec![], usize::MAX, true)],
+  ]);
+  let mut out = b"Aiur emission checks v1\n".to_vec();
+  write_u64(&mut out, scopes.len() as u64)?;
+  for &scope in &scopes {
+    write_u64(&mut out, scope as u64)?;
+  }
+  write_u64(&mut out, groups.len() as u64)?;
+  let mut operation_checks = 0;
+  for ops in &groups {
+    write_u64(&mut out, ops.len() as u64)?;
+    for op in ops {
+      write_op(&mut out, op)?;
+      write_u64(&mut out, op.output_size() as u64)?;
+      for &scope in &scopes {
+        out.push(u8::from(op.emission_inputs(scope)));
+        write_result(
+          &mut out,
+          check_emission_ops(std::slice::from_ref(op), scope).ok(),
+        )?;
+        operation_checks += 1;
+      }
+    }
+    for &scope in &scopes {
+      write_result(&mut out, check_emission_ops(ops, scope).ok())?;
+    }
+  }
+  let mut blocks = Vec::new();
+  for depth in 0..4 {
+    for seed in 0..12 {
+      let mut selectors = 0;
+      let block = block_fixture(depth, seed, 2, &mut selectors);
+      blocks.push((block, selectors));
+    }
+  }
+  blocks.extend(edge_blocks().into_iter().map(|block| (block, 4)));
+  write_u64(&mut out, blocks.len() as u64)?;
+  let mut block_checks = 0;
+  for (block, selectors) in &blocks {
+    write_block(&mut out, block)?;
+    let available = [0, 1, 2, 3, usize::MAX];
+    let selectors = [0, selectors.saturating_sub(1), *selectors, selectors + 1];
+    let yields = [None, Some(0), Some(1), Some(2), Some(3)];
+    write_u64(
+      &mut out,
+      (available.len() * selectors.len() * yields.len()) as u64,
+    )?;
+    for available in available {
+      for selectors in selectors {
+        for yield_size in yields {
+          write_u64(&mut out, available as u64)?;
+          write_u64(&mut out, selectors as u64)?;
+          write_result(&mut out, yield_size)?;
+          out.push(u8::from(
+            block.check_emission(available, selectors, yield_size).is_ok(),
+          ));
+          block_checks += 1;
+        }
+      }
+    }
+  }
+  if let Some(path) = std::env::var_os("IX_EMISSION_CHECK_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "emission checks: {operation_checks} operations, {} sequences, {block_checks} control scopes",
+    groups.len() * scopes.len()
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/frontend_expressions.rs b/crates/aiur/src/constraints/tests/frontend_expressions.rs
new file mode 100644
index 000000000..818202518
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/frontend_expressions.rs
@@ -0,0 +1,238 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Export actual smart-constructor trees and scalar operation emission.
+//! Deliberate raw negated constants test the boundary of the folding invariant.
+
+use super::*;
+use multi_stark::expr::{ColRef, RowOffset, Source};
+
+fn fixtures() -> Vec<Expr> {
+  let mut result =
+    vec![konst(G::ZERO), konst(G::ONE), konst(-G::ONE), konst(G::from_u64(17))];
+  for source in [Source::Preprocessed, Source::Main, Source::Stage2] {
+    for offset in [RowOffset::Current, RowOffset::Next] {
+      result.push(Expr::Var(ColRef { source, offset, index: 2 }));
+    }
+  }
+  result.extend([
+    Expr::Public(0),
+    Expr::Public(2),
+    Expr::IsFirstRow,
+    Expr::IsLastRow,
+    Expr::IsTransition,
+    -var(0),
+    Expr::Add(Box::new(var(0)), Box::new(var(1))),
+    Expr::Sub(Box::new(konst(G::ZERO)), Box::new(var(0))),
+    Expr::Mul(Box::new(konst(G::ZERO)), Box::new(var(1))),
+    Expr::Neg(Box::new(konst(G::ZERO))),
+    Expr::Neg(Box::new(konst(G::ONE))),
+    Expr::Neg(Box::new(Expr::Neg(Box::new(var(0))))),
+    Expr::Neg(Box::new(Expr::Neg(Box::new(konst(G::ONE))))),
+    Expr::Add(Box::new(konst(G::ONE)), Box::new(konst(G::ONE))),
+  ]);
+  result
+}
+
+pub(super) fn write_expr(out: &mut impl Write, expr: &Expr) -> io::Result<()> {
+  match expr {
+    Expr::Const(value) => {
+      out.write_all(&[0])?;
+      write_u64(out, value.as_canonical_u64())
+    },
+    Expr::Var(column) => {
+      let source = match column.source {
+        Source::Preprocessed => 0,
+        Source::Main => 1,
+        Source::Stage2 => 2,
+      };
+      let offset = match column.offset {
+        RowOffset::Current => 0,
+        RowOffset::Next => 1,
+      };
+      out.write_all(&[1, source, offset])?;
+      write_u64(out, u64::from(column.index))
+    },
+    Expr::Public(index) => {
+      out.write_all(&[2])?;
+      write_u64(out, u64::from(*index))
+    },
+    Expr::IsFirstRow => out.write_all(&[3]),
+    Expr::IsLastRow => out.write_all(&[4]),
+    Expr::IsTransition => out.write_all(&[5]),
+    Expr::Add(a, b) | Expr::Sub(a, b) | Expr::Mul(a, b) => {
+      let tag = match expr {
+        Expr::Add(..) => 6,
+        Expr::Sub(..) => 7,
+        _ => 8,
+      };
+      out.write_all(&[tag])?;
+      write_expr(out, a)?;
+      write_expr(out, b)
+    },
+    Expr::Neg(child) => {
+      out.write_all(&[9])?;
+      write_expr(out, child)
+    },
+  }
+}
+
+fn assignment(seed: usize) -> [[G; 16]; 7] {
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    G::TWO,
+    G::from_u64(17),
+    G::from_u64(255),
+    G::from_u64(256),
+    G::from_u64(65536),
+    -G::ONE,
+  ];
+  let mut rows = array::from_fn(|slot| {
+    array::from_fn(|index| {
+      choices[(slot * 3 + seed * 5 + index * 7) % choices.len()]
+    })
+  });
+  rows[2][6] = [G::ZERO, G::ONE, G::TWO, -G::ONE][seed];
+  rows
+}
+
+fn eval(expr: &Expr, rows: &[[G; 16]; 7], seed: usize) -> G {
+  eval_expr(
+    expr,
+    &VarValues {
+      preprocessed: [&rows[0], &rows[1]],
+      main: [&rows[2], &rows[3]],
+      stage2: [&rows[4], &rows[5]],
+      publics: &rows[6],
+      is_first_row: G::from_bool(seed == 0),
+      is_last_row: G::from_bool(seed == 3),
+      is_transition: G::from_bool(seed != 3),
+    },
+  )
+}
+
+fn write_smart(
+  out: &mut impl Write,
+  tag: u8,
+  left: usize,
+  right: usize,
+  expr: &Expr,
+) -> io::Result<()> {
+  out.write_all(&[tag])?;
+  write_u64(out, left as u64)?;
+  write_u64(out, right as u64)?;
+  write_expr(out, expr)?;
+  write_u64(out, u64::from(matches!(expr, Expr::Const(_))))?;
+  for seed in 0..4 {
+    write_u64(out, eval(expr, &assignment(seed), seed).as_canonical_u64())?;
+  }
+  Ok(())
+}
+
+fn write_emission(
+  out: &mut impl Write,
+  fixtures: &[Expr],
+  left: usize,
+  right: usize,
+  a_degree: Degree,
+  b_degree: Degree,
+  kind: u8,
+) -> io::Result<()> {
+  let mut state = state(5, false);
+  state.map = vec![
+    (fixtures[left].clone(), a_degree),
+    (fixtures[right].clone(), b_degree),
+  ];
+  state.lookup = 0;
+  state.lookups.clear();
+  let op = match kind {
+    0 => Op::EqZero(0),
+    1 => Op::Add(0, 1),
+    2 => Op::Sub(0, 1),
+    3 => Op::Mul(0, 1),
+    _ => unreachable!(),
+  };
+  op.collect_constraints(&var(6), &mut state);
+  assert_eq!(state.map.len(), 3);
+  assert_eq!(state.lookup, 0);
+  assert!(state.lookups.is_empty());
+  let (output, degree) = &state.map[2];
+  out.write_all(&[kind])?;
+  for number in [
+    left,
+    right,
+    a_degree as usize,
+    b_degree as usize,
+    state.column - 7,
+    *degree as usize,
+  ] {
+    write_u64(out, number as u64)?;
+  }
+  write_expr(out, output)?;
+  write_u64(out, state.constraints.zeros.len() as u64)?;
+  for expr in &state.constraints.zeros {
+    write_expr(out, expr)?;
+  }
+  for seed in 0..4 {
+    let rows = assignment(seed);
+    write_u64(out, eval(output, &rows, seed).as_canonical_u64())?;
+    write_u64(out, u64::from(matches!(output, Expr::Const(_))))?;
+    for expr in &state.constraints.zeros {
+      write_u64(out, eval(expr, &rows, seed).as_canonical_u64())?;
+    }
+  }
+  Ok(())
+}
+
+#[test]
+fn frontend_expressions_snapshot() -> io::Result<()> {
+  let fixtures = fixtures();
+  assert_eq!(fixtures.len(), 24);
+  let mut out = Vec::new();
+  out.write_all(b"Aiur frontend expressions v1\n")?;
+  write_u64(&mut out, fixtures.len() as u64)?;
+  for expr in &fixtures {
+    write_expr(&mut out, expr)?;
+  }
+  write_u64(&mut out, 1752)?;
+  let mut smart = 0;
+  for (left, a) in fixtures.iter().enumerate() {
+    write_smart(&mut out, 3, left, left, &-a.clone())?;
+    smart += 1;
+    for (right, b) in fixtures.iter().enumerate() {
+      for (tag, expr) in [
+        (0, a.clone() + b.clone()),
+        (1, a.clone() - b.clone()),
+        (2, a.clone() * b.clone()),
+      ] {
+        write_smart(&mut out, tag, left, right, &expr)?;
+        smart += 1;
+      }
+    }
+  }
+  assert_eq!(smart, 1752);
+  write_u64(&mut out, 9804)?;
+  let mut emitted = 0;
+  for left in 0..19 {
+    for a_degree in 0..3 {
+      write_emission(&mut out, &fixtures, left, left, a_degree, a_degree, 0)?;
+      emitted += 1;
+      for right in 0..19 {
+        for b_degree in 0..3 {
+          for kind in 1..4 {
+            write_emission(
+              &mut out, &fixtures, left, right, a_degree, b_degree, kind,
+            )?;
+            emitted += 1;
+          }
+        }
+      }
+    }
+  }
+  assert_eq!(emitted, 9804);
+  if let Some(path) = std::env::var_os("IX_FRONTEND_EXPRESSION_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/memory_rows.rs b/crates/aiur/src/constraints/tests/memory_rows.rs
new file mode 100644
index 000000000..931764e3d
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/memory_rows.rs
@@ -0,0 +1,101 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Evaluate the actual memory chip's four equations and its physical lookup,
+//! including cyclic next-row openings and the disabled final transition.
+
+use super::*;
+use crate::memory::Memory;
+
+fn row(height: usize, pattern: usize, index: usize, width: usize) -> Vec<G> {
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    -G::ONE,
+    G::from_u64(255),
+    G::from_u64(256),
+    G::from_u64(1 << 32),
+    G::from_u64((1 << 48) - 1),
+    G::from_u64(17),
+  ];
+  let selector = match pattern % 8 {
+    0 => G::ZERO,
+    1 => G::ONE,
+    2 => G::from_bool(index < height.div_ceil(2)),
+    3 => G::from_bool(index + 1 == height),
+    4 => G::from_bool(index.is_multiple_of(2)),
+    5 => G::TWO,
+    6 => -G::ONE,
+    _ => choices[(index + pattern) % 8],
+  };
+  (0..width)
+    .map(|column| {
+      if pattern == 0 {
+        return G::ZERO;
+      }
+      match column {
+        0 if pattern < 8 && selector == G::ZERO => G::ZERO,
+        0 => choices[(3 * index + pattern) % 8],
+        1 => selector,
+        2 if pattern < 16 => -G::ONE + G::from_usize(index),
+        2 => G::from_usize(255 + 2 * index),
+        _ => choices[(5 * column + 3 * index + pattern) % 8],
+      }
+    })
+    .collect()
+}
+
+#[test]
+fn memory_rows_snapshot() -> io::Result<()> {
+  let mut out = Vec::new();
+  out.write_all(b"Aiur memory rows v1\n")?;
+  write_u64(&mut out, 25)?;
+  let mut checked = 0;
+  for size in [0, 1, 2, 4, 8] {
+    let (memory, constraints, lookups) = Memory::build(size);
+    assert_eq!(memory.width, 3 + size);
+    assert_eq!(constraints.len(), 4);
+    assert_eq!(lookups.len(), 1);
+    for height in [0, 1, 2, 4, 8] {
+      for value in [size, height, memory.width, lookups.len(), 24] {
+        write_u64(&mut out, value as u64)?;
+      }
+      for pattern in 0..24 {
+        for index in 0..height {
+          let current = row(height, pattern, index, memory.width);
+          let next = row(height, pattern, (index + 1) % height, memory.width);
+          let values = VarValues {
+            preprocessed: [&[], &[]],
+            main: [&current, &next],
+            stage2: [&[], &[]],
+            publics: &[],
+            is_first_row: G::from_bool(index == 0),
+            is_last_row: G::from_bool(index + 1 == height),
+            is_transition: G::from_bool(index + 1 < height),
+          };
+          let equations: Vec<_> =
+            constraints.iter().map(|expr| eval_expr(expr, &values)).collect();
+          write_values(&mut out, &equations)?;
+          for lookup in &lookups {
+            write_u64(
+              &mut out,
+              eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+            )?;
+            let message: Vec<_> =
+              lookup.args.iter().map(|expr| eval_expr(expr, &values)).collect();
+            write_values(&mut out, &message)?;
+          }
+          checked += 1;
+        }
+      }
+    }
+  }
+  assert_eq!(checked, 1800);
+  if let Some(path) = std::env::var_os("IX_MEMORY_ROW_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!("memory rows: {checked} assignments across 25 width/height pairs");
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/operation_expressions.rs b/crates/aiur/src/constraints/tests/operation_expressions.rs
new file mode 100644
index 000000000..3e9443a80
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/operation_expressions.rs
@@ -0,0 +1,301 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Export actual operations, incoming expression maps, and complete native
+//! emission. Multiple writers restart their lookup cursors to exercise exact
+//! argument superposition, with different message widths and input metadata.
+
+use std::collections::HashSet;
+
+use super::{frontend_expressions::write_expr, operation_rows, *};
+
+pub(super) fn write_indices(
+  out: &mut impl Write,
+  indices: &[usize],
+) -> io::Result<()> {
+  write_u64(out, indices.len() as u64)?;
+  for index in indices {
+    write_u64(out, *index as u64)?;
+  }
+  Ok(())
+}
+
+fn write_string(out: &mut impl Write, value: &str) -> io::Result<()> {
+  write_u64(out, value.len() as u64)?;
+  out.write_all(value.as_bytes())
+}
+
+fn write_option<W: Write, T>(
+  out: &mut W,
+  value: Option<&T>,
+  write: impl FnOnce(&mut W, &T) -> io::Result<()>,
+) -> io::Result<()> {
+  match value {
+    None => out.write_all(&[0]),
+    Some(value) => {
+      out.write_all(&[1])?;
+      write(out, value)
+    },
+  }
+}
+
+// Test transport tags are explicit and exhaustive, independent of Rust enum
+// layout. The Lean reader receives the operations used by collect_constraints.
+pub(super) fn write_op(out: &mut impl Write, op: &Op) -> io::Result<()> {
+  use Op::*;
+  let tag = match op {
+    Const(_) => 0,
+    Add(..) => 1,
+    Sub(..) => 2,
+    Mul(..) => 3,
+    EqZero(_) => 4,
+    Call(..) => 5,
+    Store(_) => 6,
+    Load(..) => 7,
+    AssertEq(..) => 8,
+    IOGetInfo(..) => 9,
+    IOSetInfo(..) => 10,
+    IORead(..) => 11,
+    IOWrite(..) => 12,
+    U8BitDecomposition(_) => 13,
+    U8ShiftLeft(_) => 14,
+    U8ShiftRight(_) => 15,
+    U8Xor(..) => 16,
+    U8Add(..) => 17,
+    U8Mul(..) => 18,
+    U8Sub(..) => 19,
+    U8And(..) => 20,
+    U8Or(..) => 21,
+    U8LessThan(..) => 22,
+    U32LessThan(..) => 23,
+    U8XorSplit7(..) => 24,
+    U8XorSplit4(..) => 25,
+    Debug(..) => 26,
+    U8RangeCheck(..) => 27,
+    UnconstrainedBigUintDivMod(..) => 28,
+    UnconstrainedGToBytes(_) => 29,
+    UnconstrainedGInverse(_) => 30,
+    UnconstrainedU32Add(..) => 31,
+    UnconstrainedU32Add3(..) => 32,
+    U32ToField(_) => 33,
+  };
+  out.write_all(&[tag])?;
+  match op {
+    Const(value) => write_u64(out, value.as_canonical_u64()),
+    Add(a, b)
+    | Sub(a, b)
+    | Mul(a, b)
+    | U8Xor(a, b)
+    | U8Add(a, b)
+    | U8Mul(a, b)
+    | U8Sub(a, b)
+    | U8And(a, b)
+    | U8Or(a, b)
+    | U8LessThan(a, b)
+    | U32LessThan(a, b)
+    | U8XorSplit7(a, b)
+    | U8XorSplit4(a, b)
+    | U8RangeCheck(a, b)
+    | UnconstrainedBigUintDivMod(a, b)
+    | Load(a, b) => {
+      write_u64(out, *a as u64)?;
+      write_u64(out, *b as u64)
+    },
+    EqZero(a)
+    | U8BitDecomposition(a)
+    | U8ShiftLeft(a)
+    | U8ShiftRight(a)
+    | UnconstrainedGToBytes(a)
+    | UnconstrainedGInverse(a) => write_u64(out, *a as u64),
+    Call(function, indices, size, unconstrained) => {
+      write_u64(out, *function as u64)?;
+      write_indices(out, indices)?;
+      write_u64(out, *size as u64)?;
+      out.write_all(&[u8::from(*unconstrained)])
+    },
+    Store(indices) | U32ToField(indices) => write_indices(out, indices),
+    AssertEq(xs, ys, message) => {
+      write_indices(out, xs)?;
+      write_indices(out, ys)?;
+      write_option(out, message.as_ref(), |out, value| write_string(out, value))
+    },
+    IOGetInfo(a, indices) | IOWrite(a, indices) => {
+      write_u64(out, *a as u64)?;
+      write_indices(out, indices)
+    },
+    IOSetInfo(a, indices, b, c) => {
+      write_u64(out, *a as u64)?;
+      write_indices(out, indices)?;
+      write_u64(out, *b as u64)?;
+      write_u64(out, *c as u64)
+    },
+    IORead(a, b, size) => {
+      write_u64(out, *a as u64)?;
+      write_u64(out, *b as u64)?;
+      write_u64(out, *size as u64)
+    },
+    Debug(message, indices) => {
+      write_string(out, message)?;
+      write_option(out, indices.as_ref(), |out, values| {
+        write_indices(out, values)
+      })
+    },
+    UnconstrainedU32Add(a, b) => {
+      write_indices(out, a)?;
+      write_indices(out, b)
+    },
+    UnconstrainedU32Add3(a, b, c) => {
+      write_indices(out, a)?;
+      write_indices(out, b)?;
+      write_indices(out, c)
+    },
+  }
+}
+
+pub(super) fn write_exprs(
+  out: &mut impl Write,
+  exprs: &[Expr],
+) -> io::Result<()> {
+  write_u64(out, exprs.len() as u64)?;
+  for expr in exprs {
+    write_expr(out, expr)?;
+  }
+  Ok(())
+}
+
+pub(super) fn write_map(
+  out: &mut impl Write,
+  map: &[(Expr, Degree)],
+) -> io::Result<()> {
+  write_u64(out, map.len() as u64)?;
+  for (expr, degree) in map {
+    write_expr(out, expr)?;
+    write_u64(out, u64::from(*degree))?;
+  }
+  Ok(())
+}
+
+#[test]
+fn operation_expressions_snapshot() -> io::Result<()> {
+  let mut fixtures = operation_rows::fixtures();
+  fixtures.extend(operation_rows::constant_degree_fixtures());
+  assert_eq!(fixtures.len(), 73);
+  let kinds: HashSet<_> =
+    fixtures.iter().flatten().map(std::mem::discriminant).collect();
+  assert_eq!(kinds.len(), 34);
+
+  let rows: Vec<_> = [G::ZERO, G::ONE, G::TWO, -G::ONE]
+    .into_iter()
+    .enumerate()
+    .map(|(seed, selector)| operation_rows::row(seed, selector))
+    .collect();
+  let mut out = Vec::new();
+  out.write_all(b"Aiur operation expressions v1\n")?;
+  write_u64(&mut out, rows.len() as u64)?;
+  for row in &rows {
+    write_values(&mut out, row)?;
+  }
+  write_u64(&mut out, 876)?;
+  let mut reports = 0;
+  let mut sequences = 0;
+  let mut shared_slots = 0;
+  for branchless in [false, true] {
+    for metadata in 0..3 {
+      for fixture in 0..fixtures.len() {
+        for writers in [1_usize, 3] {
+          out.write_all(&[u8::from(branchless)])?;
+          write_u64(&mut out, writers as u64)?;
+          let mut state = state(0, branchless);
+          state.lookups = (0..64).map(|_| empty_lookup()).collect();
+          let mut lookup_end = 0;
+          for writer in 0..writers {
+            let ops = &fixtures[(fixture + 23 * writer) % fixtures.len()];
+            state.column = 4 + 40 * writer;
+            state.lookup = writer % 2;
+            state.rank =
+              if writer == 2 { konst(G::from_u64(257)) } else { var(2) };
+            state.map = operation_rows::input_map();
+            // Degree tracking is independent of frontend constant folding.
+            // Exercise zero, ordinary, and conservative positive metadata.
+            if metadata != 1 {
+              state.map[0].1 = metadata;
+              state.map[3].1 = metadata;
+              state.map[5].1 = 2 * metadata;
+            }
+            let selector = var(3 + writer);
+            write_u64(&mut out, state.column as u64)?;
+            write_u64(&mut out, state.lookup as u64)?;
+            write_expr(&mut out, &selector)?;
+            write_expr(&mut out, &state.rank)?;
+            write_map(&mut out, &state.map)?;
+            write_u64(&mut out, ops.len() as u64)?;
+            for op in ops {
+              write_op(&mut out, op)?;
+            }
+            let equation_start = state.constraints.zeros.len();
+            for op in ops {
+              op.collect_constraints(&selector, &mut state);
+            }
+            let equations = &state.constraints.zeros[equation_start..];
+            assert!(state.column <= rows[0].len());
+            write_u64(&mut out, state.column as u64)?;
+            write_u64(&mut out, state.lookup as u64)?;
+            write_map(&mut out, &state.map)?;
+            write_exprs(&mut out, equations)?;
+            for row in &rows {
+              let values = local_values(row);
+              for (expr, _) in &state.map {
+                write_u64(
+                  &mut out,
+                  eval_expr(expr, &values).as_canonical_u64(),
+                )?;
+                out.write_all(&[u8::from(matches!(expr, Expr::Const(_)))])?;
+              }
+              for expr in equations {
+                write_u64(
+                  &mut out,
+                  eval_expr(expr, &values).as_canonical_u64(),
+                )?;
+              }
+            }
+            lookup_end = lookup_end.max(state.lookup);
+            sequences += 1;
+          }
+          // Include untouched slots as well as all slots with contributions.
+          write_u64(&mut out, (lookup_end + 2) as u64)?;
+          for lookup in &state.lookups[..lookup_end + 2] {
+            write_expr(&mut out, &lookup.multiplicity)?;
+            write_exprs(&mut out, &lookup.args)?;
+            for row in &rows {
+              let values = local_values(row);
+              write_u64(
+                &mut out,
+                eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+              )?;
+              let args: Vec<_> = lookup
+                .args
+                .iter()
+                .map(|expr| eval_expr(expr, &values))
+                .collect();
+              write_values(&mut out, &args)?;
+            }
+          }
+          if writers == 3 {
+            shared_slots += 1;
+          }
+          reports += 1;
+        }
+      }
+    }
+  }
+  assert_eq!((reports, sequences, shared_slots), (876, 1752, 438));
+  if let Some(path) = std::env::var_os("IX_OPERATION_EXPRESSION_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "operation expressions: {reports} reports, {sequences} native sequences, {shared_slots} shared-slot cases"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/constraints/tests/operation_rows.rs b/crates/aiur/src/constraints/tests/operation_rows.rs
new file mode 100644
index 000000000..e425637e6
--- /dev/null
+++ b/crates/aiur/src/constraints/tests/operation_rows.rs
@@ -0,0 +1,246 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Evaluate all operation forms against arbitrary rows, including metadata,
+//! allocation, polynomial values and every lookup argument. Sequences reuse
+//! logical outputs and advance the native auxiliary/lookup cursors.
+
+use std::collections::HashSet;
+
+use super::*;
+
+pub(super) fn fixtures() -> Vec<Vec<Op>> {
+  use Op::*;
+  vec![
+    vec![Const(G::ZERO)],
+    vec![Const(G::ONE)],
+    vec![Const(-G::ONE)],
+    vec![Add(0, 1)],
+    vec![Add(0, 3)],
+    vec![Add(3, 4)],
+    vec![Sub(1, 2)],
+    vec![Sub(0, 3)],
+    vec![Sub(3, 4)],
+    vec![Mul(0, 3)],
+    vec![Mul(1, 3)],
+    vec![Mul(2, 1)],
+    vec![Mul(3, 4)],
+    vec![Mul(5, 6)],
+    vec![EqZero(0)],
+    vec![EqZero(1)],
+    vec![EqZero(2)],
+    vec![EqZero(3)],
+    vec![EqZero(4)],
+    vec![EqZero(5)],
+    vec![Call(17, vec![3, 4, 5], 0, false)],
+    vec![Call(17, vec![3, 4, 5], 2, false)],
+    vec![Call(17, vec![3, 4, 5], 0, true)],
+    vec![Call(17, vec![3, 4, 5], 2, true)],
+    vec![Store(vec![])],
+    vec![Store(vec![0, 3, 4])],
+    vec![Load(0, 3)],
+    vec![Load(3, 4)],
+    vec![AssertEq(vec![], vec![], None)],
+    vec![AssertEq(vec![0, 3, 4], vec![1, 4, 3], Some("row".into()))],
+    vec![IOGetInfo(0, vec![1, 2])],
+    vec![IORead(0, 0, 0)],
+    vec![IORead(0, 3, 2)],
+    vec![IOSetInfo(0, vec![1, 2], 3, 4)],
+    vec![IOWrite(0, vec![3, 4])],
+    vec![Debug("row".into(), None)],
+    vec![Debug("row".into(), Some(vec![3, 4]))],
+    vec![U8BitDecomposition(3)],
+    vec![U8ShiftLeft(3)],
+    vec![U8ShiftRight(3)],
+    vec![U8Xor(3, 4)],
+    vec![U8Add(3, 4)],
+    vec![U8Sub(3, 4)],
+    vec![U8And(3, 4)],
+    vec![U8Or(3, 4)],
+    vec![U8LessThan(3, 4)],
+    vec![U8RangeCheck(3, 4)],
+    vec![U8Mul(3, 4)],
+    vec![U8XorSplit7(3, 4)],
+    vec![U8XorSplit4(3, 4)],
+    vec![U32LessThan(3, 4)],
+    vec![UnconstrainedBigUintDivMod(3, 4)],
+    vec![UnconstrainedGToBytes(3)],
+    vec![UnconstrainedGInverse(4)],
+    vec![UnconstrainedU32Add(vec![0, 1, 2, 3], vec![4, 5, 6, 7])],
+    vec![UnconstrainedU32Add3(
+      vec![0, 1, 2, 3],
+      vec![4, 5, 6, 7],
+      vec![7, 6, 5, 4],
+    )],
+    vec![U32ToField(vec![0, 1, 2, 3])],
+    vec![],
+    vec![Const(G::ZERO), Mul(8, 3)],
+    vec![Mul(3, 4), Add(8, 3), EqZero(9)],
+    vec![
+      UnconstrainedGToBytes(3),
+      U8RangeCheck(8, 9),
+      U8Add(8, 9),
+      AssertEq(vec![16], vec![3], None),
+      UnconstrainedGInverse(17),
+    ],
+    vec![
+      Store(vec![3, 4]),
+      Load(2, 8),
+      Call(17, vec![9, 10], 2, false),
+      U8Xor(11, 12),
+    ],
+    vec![
+      IORead(0, 0, 4),
+      UnconstrainedU32Add(vec![8, 9, 10, 11], vec![0, 1, 2, 7]),
+      U32ToField(vec![12, 13, 14, 15]),
+    ],
+    vec![EqZero(0), Add(8, 1), Sub(9, 1), Mul(10, 7)],
+    vec![
+      UnconstrainedBigUintDivMod(3, 4),
+      Call(17, vec![8, 9], 0, false),
+      Debug("row".into(), None),
+    ],
+  ]
+}
+
+pub(super) fn input_map() -> Vec<(Expr, Degree)> {
+  vec![
+    (konst(G::ZERO), 0),
+    (konst(G::ONE), 0),
+    (konst(-G::ONE), 0),
+    (var(0), 1),
+    (var(1), 1),
+    (var(0) + var(1), 1),
+    (var(2), 1),
+    (konst(G::from_u64(257)), 0),
+  ]
+}
+
+pub(super) fn row(seed: usize, selector: G) -> Vec<G> {
+  let choices = [
+    G::ZERO,
+    G::ONE,
+    G::from_u64(255),
+    G::from_u64(256),
+    -G::ONE,
+    -G::TWO,
+    G::from_u64((1 << 32) - 1),
+    G::from_u64(1 << 32),
+    G::from_u64((1 << 48) - 1),
+    G::from_u64(17),
+    G::from_u64(3),
+    G::from_u64(65536),
+  ];
+  let mut row: Vec<_> =
+    (0..512).map(|i| choices[(seed + 5 * i) % choices.len()]).collect();
+  row[0] = choices[seed];
+  row[1] = choices[(seed + 1) % choices.len()];
+  row[2] = choices[(seed + 2) % choices.len()];
+  row[3] = selector;
+  row
+}
+
+fn write_corpus(
+  header: &[u8],
+  fixtures: &[Vec<Op>],
+) -> io::Result<(Vec<u8>, usize)> {
+  let mut out = Vec::new();
+  out.write_all(header)?;
+  write_u64(&mut out, fixtures.len() as u64)?;
+  let mut checked = 0;
+  for branchless in [false, true] {
+    for seed in 0..12 {
+      for selector in [G::ZERO, G::ONE, G::TWO, -G::ONE] {
+        let row = row(seed, selector);
+        let values = local_values(&row);
+        for ops in fixtures {
+          let mut state = state(0, branchless);
+          state.column = 4;
+          state.lookup = 0;
+          state.lookups = (0..64).map(|_| empty_lookup()).collect();
+          state.rank = var(2);
+          state.map = input_map();
+          for op in ops {
+            op.collect_constraints(&var(3), &mut state);
+          }
+          assert!(state.column <= row.len());
+          write_u64(&mut out, state.column as u64)?;
+          write_u64(&mut out, state.map.len() as u64)?;
+          for (expr, degree) in &state.map {
+            write_u64(&mut out, eval_expr(expr, &values).as_canonical_u64())?;
+            write_u64(&mut out, u64::from(*degree))?;
+            write_u64(&mut out, u64::from(matches!(expr, Expr::Const(_))))?;
+          }
+          let equations: Vec<_> = state
+            .constraints
+            .zeros
+            .iter()
+            .map(|expr| eval_expr(expr, &values))
+            .collect();
+          write_values(&mut out, &equations)?;
+          write_u64(&mut out, state.lookup as u64)?;
+          for lookup in &state.lookups[..state.lookup] {
+            write_u64(
+              &mut out,
+              eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+            )?;
+            let args: Vec<_> =
+              lookup.args.iter().map(|expr| eval_expr(expr, &values)).collect();
+            write_values(&mut out, &args)?;
+          }
+          checked += 1;
+        }
+      }
+    }
+  }
+  Ok((out, checked))
+}
+
+#[test]
+fn operation_rows_snapshot() -> io::Result<()> {
+  let fixtures = fixtures();
+  let kinds: HashSet<_> =
+    fixtures.iter().flatten().map(std::mem::discriminant).collect();
+  assert_eq!(kinds.len(), 34, "every bytecode operation constructor");
+  assert_eq!(fixtures.len(), 65, "operation and sequence corpus");
+  let (out, checked) = write_corpus(b"Aiur operation rows v1\n", &fixtures)?;
+  assert_eq!(checked, 6240);
+  if let Some(path) = std::env::var_os("IX_OPERATION_ROW_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!("operation rows: {checked} assignments across all 34 constructors");
+  Ok(())
+}
+
+pub(super) fn constant_degree_fixtures() -> Vec<Vec<Op>> {
+  use Op::*;
+  vec![
+    vec![Const(G::ZERO), Mul(8, 3), EqZero(9)],
+    vec![Const(G::ZERO), Mul(3, 8), EqZero(9)],
+    vec![Mul(0, 3), Add(8, 1), EqZero(9)],
+    vec![Mul(0, 3), Sub(0, 8), EqZero(9)],
+    vec![Mul(0, 3), EqZero(8), EqZero(9)],
+    vec![Mul(0, 3), EqZero(8), Mul(9, 3)],
+    vec![Mul(0, 3), Mul(8, 1), EqZero(9)],
+    vec![Mul(0, 3), Sub(2, 8), EqZero(9)],
+  ]
+}
+
+#[test]
+fn constant_degree_rows_snapshot() -> io::Result<()> {
+  let fixtures = constant_degree_fixtures();
+  let (out, checked) =
+    write_corpus(b"Aiur constant degree rows v1\n", &fixtures)?;
+  assert_eq!(checked, 768);
+  if let Some(path) = std::env::var_os("IX_CONSTANT_DEGREE_ROW_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  eprintln!(
+    "constant degree rows: {checked} arbitrary assignments across eight sequences"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/emission_checks.rs b/crates/aiur/src/emission_checks.rs
new file mode 100644
index 000000000..e2cdfa234
--- /dev/null
+++ b/crates/aiur/src/emission_checks.rs
@@ -0,0 +1,347 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Logical scopes and selector reads required by circuit construction.
+
+use crate::bytecode::{Block, Ctrl, Op, Toplevel};
+
+fn indices_in_scope(available: usize, indices: &[usize]) -> bool {
+  indices.iter().all(|&index| index < available)
+}
+
+fn word_in_scope(available: usize, indices: &[usize]) -> bool {
+  indices.len() == 4 && indices_in_scope(available, indices)
+}
+
+impl Op {
+  /// Includes virtual outputs such as carries, which use no fresh column.
+  pub(crate) fn output_size(&self) -> usize {
+    match self {
+      Self::Const(..)
+      | Self::Add(..)
+      | Self::Sub(..)
+      | Self::Mul(..)
+      | Self::EqZero(..)
+      | Self::Store(..)
+      | Self::U8ShiftLeft(..)
+      | Self::U8ShiftRight(..)
+      | Self::U8Xor(..)
+      | Self::U8And(..)
+      | Self::U8Or(..)
+      | Self::U8LessThan(..)
+      | Self::U32LessThan(..)
+      | Self::UnconstrainedGInverse(..)
+      | Self::U32ToField(..) => 1,
+      Self::Call(_, _, size, _)
+      | Self::Load(size, _)
+      | Self::IORead(_, _, size) => *size,
+      Self::AssertEq(..)
+      | Self::IOSetInfo(..)
+      | Self::IOWrite(..)
+      | Self::Debug(..)
+      | Self::U8RangeCheck(..) => 0,
+      Self::IOGetInfo(..)
+      | Self::U8Add(..)
+      | Self::U8Mul(..)
+      | Self::U8Sub(..)
+      | Self::U8XorSplit7(..)
+      | Self::U8XorSplit4(..)
+      | Self::UnconstrainedBigUintDivMod(..) => 2,
+      Self::U8BitDecomposition(..) | Self::UnconstrainedGToBytes(..) => 8,
+      Self::UnconstrainedU32Add(..) | Self::UnconstrainedU32Add3(..) => 5,
+    }
+  }
+
+  /// Check reads in the incoming scope, before allocating any outputs.
+  /// Advice and I/O operands are not consumed while building constraints.
+  pub(crate) fn emission_inputs(&self, available: usize) -> bool {
+    match self {
+      Self::Add(a, b)
+      | Self::Sub(a, b)
+      | Self::Mul(a, b)
+      | Self::U8Xor(a, b)
+      | Self::U8Add(a, b)
+      | Self::U8Mul(a, b)
+      | Self::U8Sub(a, b)
+      | Self::U8And(a, b)
+      | Self::U8Or(a, b)
+      | Self::U8LessThan(a, b)
+      | Self::U32LessThan(a, b)
+      | Self::U8XorSplit7(a, b)
+      | Self::U8XorSplit4(a, b)
+      | Self::U8RangeCheck(a, b) => *a < available && *b < available,
+      Self::EqZero(index)
+      | Self::Load(_, index)
+      | Self::U8BitDecomposition(index)
+      | Self::U8ShiftLeft(index)
+      | Self::U8ShiftRight(index) => *index < available,
+      Self::Call(_, indices, _, false) | Self::Store(indices) => {
+        indices_in_scope(available, indices)
+      },
+      Self::AssertEq(left, right, _) => {
+        left.len() == right.len()
+          && indices_in_scope(available, left)
+          && indices_in_scope(available, right)
+      },
+      Self::UnconstrainedU32Add(left, right) => {
+        word_in_scope(available, left) && word_in_scope(available, right)
+      },
+      Self::UnconstrainedU32Add3(left, middle, right) => {
+        word_in_scope(available, left)
+          && word_in_scope(available, middle)
+          && word_in_scope(available, right)
+      },
+      Self::U32ToField(indices) => word_in_scope(available, indices),
+      _ => true,
+    }
+  }
+}
+
+pub(crate) fn check_emission_ops(
+  ops: &[Op],
+  mut available: usize,
+) -> Result<usize, &'static str> {
+  for op in ops {
+    if !op.emission_inputs(available) {
+      return Err("operation reads outside its incoming scope or width");
+    }
+    available = available
+      .checked_add(op.output_size())
+      .ok_or("logical value count overflows")?;
+  }
+  Ok(available)
+}
+
+impl Block {
+  pub(crate) fn check_emission(
+    &self,
+    available: usize,
+    selectors: usize,
+    yield_size: Option<usize>,
+  ) -> Result<(), &'static str> {
+    let available = check_emission_ops(&self.ops, available)?;
+    match &self.ctrl {
+      Ctrl::Return(index, outputs) | Ctrl::Yield(index, outputs) => {
+        if *index >= selectors {
+          return Err("terminal reads outside its function's selector region");
+        }
+        if !indices_in_scope(available, outputs) {
+          return Err("terminal reads outside its logical scope");
+        }
+        if matches!(self.ctrl, Ctrl::Yield(..))
+          && yield_size != Some(outputs.len())
+        {
+          return Err("yield width differs from its enclosing continuation");
+        }
+      },
+      Ctrl::Match(index, branches, fallback) => {
+        if *index >= available {
+          return Err("match reads outside its logical scope");
+        }
+        for block in branches.values().chain(fallback.as_deref()) {
+          block.check_emission(available, selectors, yield_size)?;
+        }
+      },
+      Ctrl::MatchContinue(index, branches, fallback, size, _, _, cont) => {
+        if *index >= available {
+          return Err("match reads outside its logical scope");
+        }
+        for block in branches.values().chain(fallback.as_deref()) {
+          block.check_emission(available, selectors, Some(*size))?;
+        }
+        let available = available
+          .checked_add(*size)
+          .ok_or("continuation merge count overflows")?;
+        cont.check_emission(available, selectors, yield_size)?;
+      },
+    }
+    Ok(())
+  }
+}
+
+impl Toplevel {
+  /// Validate every constrained function before native circuit construction.
+  /// This does not typecheck source programs or constrain advice operands.
+  pub fn validate_emission(&self) -> Result<(), &'static str> {
+    for function in &self.functions {
+      if function.constrained {
+        function.body.check_emission(
+          function.layout.input_size,
+          function.layout.selectors,
+          None,
+        )?;
+      }
+    }
+    Ok(())
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use multi_stark::p3_field::PrimeCharacteristicRing;
+  use multi_stark::types::{CommitmentParameters, FriParameters};
+
+  use super::check_emission_ops;
+  use crate::{
+    G,
+    bytecode::{Block, Circuit, Ctrl, Function, FunctionLayout, Op, Toplevel},
+    synthesis::AiurSystem,
+  };
+
+  fn malformed_operand() -> Toplevel {
+    let layout = FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 7,
+      lookups: 4,
+    };
+    Toplevel {
+      functions: vec![Function {
+        body: Block {
+          ops: vec![Op::Add(0, 1)],
+          ctrl: Ctrl::Return(0, vec![1]),
+        },
+        layout,
+        entry: true,
+        constrained: true,
+      }],
+      memory_sizes: vec![],
+      circuits: vec![Circuit { members: vec![0], layout }],
+    }
+  }
+
+  #[test]
+  #[should_panic(expected = "invalid Aiur emission inputs")]
+  fn system_construction_rejects_invalid_operand() {
+    let top = malformed_operand();
+    top.validate_lookup_shapes().unwrap();
+    top.validate_row_counts().unwrap();
+    AiurSystem::build(
+      top,
+      CommitmentParameters { log_blowup: 1, cap_height: 0 },
+      FriParameters {
+        log_final_poly_len: 0,
+        max_log_arity: 1,
+        num_queries: 64,
+        commit_proof_of_work_bits: 0,
+        query_proof_of_work_bits: 0,
+      },
+    );
+  }
+
+  #[test]
+  fn incoming_scopes_exclude_store_pointers_and_include_virtual_carries() {
+    assert!(check_emission_ops(&[Op::Store(vec![1])], 1).is_err());
+    assert_eq!(check_emission_ops(&[Op::Store(vec![0])], 1), Ok(2));
+    let ops = [
+      Op::UnconstrainedU32Add(vec![0, 1, 2, 3], vec![0, 1, 2, 3]),
+      Op::U8RangeCheck(4, 7),
+      Op::Add(8, 0),
+    ];
+    assert_eq!(check_emission_ops(&ops, 4), Ok(10));
+    assert!(
+      check_emission_ops(&[Op::U8RangeCheck(0, 0), Op::Add(1, 0)], 1).is_err()
+    );
+    assert!(check_emission_ops(&[Op::U32ToField(vec![0; 3])], 1).is_err());
+    assert!(check_emission_ops(&[Op::U32ToField(vec![0; 5])], 1).is_err());
+    assert!(
+      check_emission_ops(&[Op::AssertEq(vec![0], vec![], None)], 1).is_err()
+    );
+  }
+
+  fn continuation_body(output: usize, yield_width: usize) -> Block {
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::MatchContinue(
+        0,
+        [(
+          G::ZERO,
+          Block {
+            ops: vec![Op::Const(G::ONE), Op::Const(G::TWO)],
+            ctrl: Ctrl::Yield(0, vec![2; yield_width]),
+          },
+        )]
+        .into_iter()
+        .collect(),
+        Some(Box::new(Block { ops: vec![], ctrl: Ctrl::Return(1, vec![0]) })),
+        1,
+        0,
+        0,
+        Box::new(Block { ops: vec![], ctrl: Ctrl::Return(2, vec![output]) }),
+      ),
+    }
+  }
+
+  #[test]
+  fn continuations_expose_only_merged_values_and_check_every_selector() {
+    assert!(continuation_body(1, 1).check_emission(1, 3, None).is_ok());
+    assert!(continuation_body(2, 1).check_emission(1, 3, None).is_err());
+    assert!(continuation_body(1, 0).check_emission(1, 3, None).is_err());
+    assert!(continuation_body(1, 2).check_emission(1, 3, None).is_err());
+    assert!(continuation_body(1, 1).check_emission(1, 2, None).is_err());
+    assert!(
+      Block { ops: vec![], ctrl: Ctrl::Return(1, vec![]) }
+        .check_emission(0, 1, None)
+        .is_err()
+    );
+    assert!(
+      Block { ops: vec![], ctrl: Ctrl::Yield(0, vec![]) }
+        .check_emission(0, 1, None)
+        .is_err()
+    );
+  }
+
+  #[test]
+  fn siblings_restore_scope_and_native_scope_addition_is_checked() {
+    let block = Block {
+      ops: vec![],
+      ctrl: Ctrl::Match(
+        0,
+        [
+          (
+            G::ZERO,
+            Block {
+              ops: vec![Op::Const(G::ONE)],
+              ctrl: Ctrl::Return(0, vec![1]),
+            },
+          ),
+          (G::ONE, Block { ops: vec![], ctrl: Ctrl::Return(1, vec![1]) }),
+        ]
+        .into_iter()
+        .collect(),
+        None,
+      ),
+    };
+    assert!(block.check_emission(1, 2, None).is_err());
+    assert!(block.check_emission(2, 2, None).is_ok());
+    assert!(check_emission_ops(&[Op::Const(G::ZERO)], usize::MAX).is_err());
+    let block = Block {
+      ops: vec![],
+      ctrl: Ctrl::MatchContinue(
+        0,
+        Default::default(),
+        None,
+        1,
+        0,
+        0,
+        Box::new(Block { ops: vec![], ctrl: Ctrl::Return(0, vec![]) }),
+      ),
+    };
+    assert!(block.check_emission(usize::MAX, 1, None).is_err());
+  }
+
+  #[test]
+  fn unused_advice_operands_do_not_become_constraint_requirements() {
+    let ignored = [
+      Op::Call(usize::MAX, vec![usize::MAX], 2, true),
+      Op::UnconstrainedGInverse(usize::MAX),
+      Op::IOWrite(usize::MAX, vec![usize::MAX]),
+    ];
+    assert_eq!(check_emission_ops(&ignored, 0), Ok(3));
+    let mut top = malformed_operand();
+    assert!(top.validate_emission().is_err());
+    top.functions[0].constrained = false;
+    top.circuits.clear();
+    assert!(top.validate_emission().is_ok());
+  }
+}
diff --git a/crates/aiur/src/execute.rs b/crates/aiur/src/execute.rs
index cfa91823c..11bbfb8fe 100644
--- a/crates/aiur/src/execute.rs
+++ b/crates/aiur/src/execute.rs
@@ -1,6 +1,7 @@
 use multi_stark::p3_field::{Field, PrimeCharacteristicRing, PrimeField64};
 use rustc_hash::FxHashMap;
 use std::collections::hash_map::Entry;
+use std::sync::{Arc, atomic::AtomicU64};
 
 use crate::{
   FxIndexMap, G,
@@ -37,10 +38,11 @@ pub struct QueryRecord {
 
 impl QueryRecord {
   pub fn new(toplevel: &Toplevel) -> Self {
+    let clock = Arc::new(AtomicU64::new(0));
     let function_queries = toplevel
       .functions
       .iter()
-      .map(|f| QueryMap::new(f.layout.input_size))
+      .map(|f| QueryMap::new_function(f.layout.input_size, Arc::clone(&clock)))
       .collect();
     let memory_queries = toplevel
       .memory_sizes
@@ -1094,14 +1096,15 @@ fn build_klimbs_u64(
 
 /// Approximate retained bytes of a record's query maps: field elements
 /// (keys + outputs) at 8 bytes plus ~21 bytes of per-entry index
-/// overhead (hash-table slot, stored hash, multiplicity). Feeds the
+/// overhead (hash-table slot, stored hash, multiplicity), and 8 bytes per
+/// function entry for completion order. Feeds the
 /// witness phase of the prover RAM model
 /// ([`crate::synthesis::AiurSystem::peak_prove_bytes`]).
 pub fn record_retained_bytes(record: &QueryRecord) -> usize {
   let mut elems = 0usize;
   let mut entries = 0usize;
   for m in &record.function_queries {
-    elems += m.retained_elems();
+    elems += m.retained_elems() + m.len();
     entries += m.len();
   }
   for (_, m) in &record.memory_queries {
diff --git a/crates/aiur/src/gadgets/bytes2.rs b/crates/aiur/src/gadgets/bytes2.rs
index e013a6a34..189f42edb 100644
--- a/crates/aiur/src/gadgets/bytes2.rs
+++ b/crates/aiur/src/gadgets/bytes2.rs
@@ -424,6 +424,15 @@ impl Bytes2Queries {
     self.bump_multiplicity_for(i, j, 6)
   }
 
+  pub(crate) fn add_rank_ranges(
+    &mut self,
+    ranges: crate::call_order::RankRanges,
+  ) {
+    for ([i, j], count) in ranges {
+      self.0[256 * usize::from(i) + usize::from(j)][6] += count;
+    }
+  }
+
   pub(crate) fn bump_mul(&mut self, i: &G, j: &G) {
     self.bump_multiplicity_for(i, j, 7)
   }
diff --git a/crates/aiur/src/graph_shape.rs b/crates/aiur/src/graph_shape.rs
new file mode 100644
index 000000000..89614ee81
--- /dev/null
+++ b/crates/aiur/src/graph_shape.rs
@@ -0,0 +1,184 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use multi_stark::{
+  expr::Source,
+  graph::{Node, NodeId},
+  lookup::Lookup,
+};
+
+use crate::G;
+
+#[derive(Clone, Copy)]
+pub(crate) struct GraphWidths {
+  pub preprocessed: usize,
+  pub main: usize,
+  pub stage2: usize,
+  pub publics: usize,
+}
+
+/// Check every read made by a full sweep and by the lookup-prefix sweep.
+/// The latter has no stage-2 values. Check roots before deriving the prefix,
+/// and children before degree recomputation or the native unchecked sweep.
+pub(crate) fn checked_graph_prefix(
+  nodes: &[Node<G>],
+  zeros: &[NodeId],
+  lookups: &[Lookup<NodeId>],
+  widths: GraphWidths,
+) -> Option<usize> {
+  let in_bounds = |id: NodeId| id.index() < nodes.len();
+  if !zeros.iter().copied().all(in_bounds)
+    || !lookups.iter().all(|lookup| {
+      in_bounds(lookup.multiplicity)
+        && lookup.args.iter().copied().all(in_bounds)
+    })
+  {
+    return None;
+  }
+  let prefix = lookups
+    .iter()
+    .flat_map(|lookup| {
+      std::iter::once(lookup.multiplicity).chain(lookup.args.iter().copied())
+    })
+    .map(|id| id.index() + 1)
+    .max()
+    .unwrap_or(0);
+  for (index, node) in nodes.iter().enumerate() {
+    let valid = match *node {
+      Node::Const(_)
+      | Node::IsFirstRow
+      | Node::IsLastRow
+      | Node::IsTransition => true,
+      Node::Var(col) => {
+        let width = match col.source {
+          Source::Preprocessed => widths.preprocessed,
+          Source::Main => widths.main,
+          Source::Stage2 => {
+            if index < prefix {
+              return None;
+            }
+            widths.stage2
+          },
+        };
+        (col.index as usize) < width
+      },
+      Node::Public(public) => (public as usize) < widths.publics,
+      Node::Add(a, b) | Node::Sub(a, b) | Node::Mul(a, b) => {
+        a.index() < index && b.index() < index
+      },
+      Node::Neg(a) => a.index() < index,
+    };
+    if !valid {
+      return None;
+    }
+  }
+  Some(prefix)
+}
+
+#[cfg(test)]
+mod tests {
+  use super::*;
+  use multi_stark::{
+    expr::{ColRef, RowOffset},
+    p3_field::PrimeCharacteristicRing,
+  };
+  use std::{
+    fs::File,
+    io::{self, Write},
+  };
+
+  fn node_choices() -> Vec<Node<G>> {
+    let indices = [0, 1, 3, 7, 8, u16::MAX.into(), u32::MAX];
+    let mut choices = vec![
+      Node::Const(G::ZERO),
+      Node::Const(G::ONE),
+      Node::Const(-G::ONE),
+      Node::Const(G::from_u64(65536)),
+      Node::IsFirstRow,
+      Node::IsLastRow,
+      Node::IsTransition,
+    ];
+    for source in [Source::Preprocessed, Source::Main, Source::Stage2] {
+      for offset in [RowOffset::Current, RowOffset::Next] {
+        for index in indices {
+          choices.push(Node::Var(ColRef { source, offset, index }));
+        }
+      }
+    }
+    for index in indices {
+      choices.push(Node::Public(index));
+    }
+    for left in indices {
+      for right in indices {
+        choices.extend([
+          Node::Add(NodeId(left), NodeId(right)),
+          Node::Sub(NodeId(left), NodeId(right)),
+          Node::Mul(NodeId(left), NodeId(right)),
+        ]);
+      }
+    }
+    for index in indices {
+      choices.push(Node::Neg(NodeId(index)));
+    }
+    assert_eq!(choices.len(), 210);
+    choices
+  }
+
+  fn write_shapes(out: &mut Vec<u8>, nodes: &[Node<G>]) -> usize {
+    let count = u32::try_from(nodes.len()).expect("small test graph");
+    let last = count.saturating_sub(1);
+    for width in [0, 1, 4, 8] {
+      let widths = GraphWidths {
+        preprocessed: width,
+        main: width + 1,
+        stage2: width + 2,
+        publics: width,
+      };
+      for (zeros, lookups) in [
+        (vec![], vec![]),
+        (vec![NodeId(0)], vec![]),
+        (vec![NodeId(last)], vec![]),
+        (vec![NodeId(count)], vec![]),
+        (vec![], vec![Lookup { multiplicity: NodeId(0), args: vec![] }]),
+        (
+          vec![],
+          vec![Lookup { multiplicity: NodeId(last), args: vec![NodeId(0)] }],
+        ),
+        (
+          vec![],
+          vec![Lookup { multiplicity: NodeId(0), args: vec![NodeId(count)] }],
+        ),
+      ] {
+        match checked_graph_prefix(nodes, &zeros, &lookups, widths) {
+          None => out.push(0),
+          Some(prefix) => {
+            out.push(1);
+            out.extend_from_slice(&(prefix as u64).to_le_bytes());
+          },
+        }
+      }
+    }
+    28
+  }
+
+  #[test]
+  fn graph_shape_snapshot() -> io::Result<()> {
+    let mut out = b"Aiur graph shapes v1\n".to_vec();
+    let mut checked = write_shapes(&mut out, &[]);
+    for count in [1, 2, 4, 8] {
+      for index in 0..count {
+        for node in node_choices() {
+          let mut nodes = vec![Node::Const(G::ZERO); count];
+          nodes[index] = node;
+          checked += write_shapes(&mut out, &nodes);
+        }
+      }
+    }
+    assert_eq!(checked, 88_228);
+    if let Some(path) = std::env::var_os("IX_GRAPH_SHAPE_SNAPSHOT") {
+      File::create(path)?.write_all(&out)?;
+    }
+    eprintln!("graph shapes: {checked} checked layouts");
+    Ok(())
+  }
+}
diff --git a/crates/aiur/src/lib.rs b/crates/aiur/src/lib.rs
index 3acf6666a..ecc67e753 100644
--- a/crates/aiur/src/lib.rs
+++ b/crates/aiur/src/lib.rs
@@ -1,11 +1,18 @@
 pub mod bytecode;
+mod call_order;
 pub mod constraints;
+mod emission_checks;
 pub mod execute;
 pub mod gadgets;
+mod graph_shape;
+mod lookup_budget;
+mod lookup_shapes;
 pub mod memory;
 pub mod querymap;
+mod row_counts;
 pub mod synthesis;
 pub mod trace;
+mod trace_heights;
 pub mod vk_codec;
 
 use indexmap::IndexMap;
diff --git a/crates/aiur/src/lookup_budget.rs b/crates/aiur/src/lookup_budget.rs
new file mode 100644
index 000000000..023d466c1
--- /dev/null
+++ b/crates/aiur/src/lookup_budget.rs
@@ -0,0 +1,34 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use multi_stark::p3_field::PrimeField64;
+
+use crate::G;
+
+/// Upper bound on unit lookup consumers: one public claim plus every
+/// lookup slot of every active trace row. Provider slots also count, making
+/// this conservative without relying on witness multiplicities. Degrees
+/// are indexed by active position; slot counts use canonical circuit order.
+/// Reject malformed alignment and any bound reaching the characteristic.
+pub(crate) fn lookup_query_bound(
+  slot_counts: impl ExactSizeIterator<Item = usize>,
+  active: &[bool],
+  log_degrees: &[u8],
+) -> Option<u64> {
+  if slot_counts.len() != active.len() || !active.contains(&true) {
+    return None;
+  }
+  let mut degrees = log_degrees.iter();
+  let mut total = 1_u64;
+  for (slots, &is_active) in slot_counts.zip(active) {
+    if is_active {
+      let height = 1_u64.checked_shl(u32::from(*degrees.next()?))?;
+      let count = height.checked_mul(u64::try_from(slots).ok()?)?;
+      total = total.checked_add(count)?;
+      if total >= G::ORDER_U64 {
+        return None;
+      }
+    }
+  }
+  degrees.next().is_none().then_some(total)
+}
diff --git a/crates/aiur/src/lookup_shapes.rs b/crates/aiur/src/lookup_shapes.rs
new file mode 100644
index 000000000..a361b01bf
--- /dev/null
+++ b/crates/aiur/src/lookup_shapes.rs
@@ -0,0 +1,138 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Structural checks required by zero-padded function lookup messages.
+//! Inputs, outputs and the final rank have no separators in the message.
+//! Their boundaries must agree at every constrained call and public claim.
+
+use multi_stark::p3_field::PrimeField64;
+
+use crate::{
+  G,
+  bytecode::{Block, Ctrl, Op, Toplevel},
+  function_channel,
+};
+
+fn canonical_size(size: usize) -> bool {
+  u64::try_from(size).is_ok_and(|size| size < G::ORDER_U64)
+}
+
+impl Block {
+  /// Every function return, including an early return from a continuation
+  /// arm, has this output arity. Yields return to their own continuation.
+  pub(crate) fn returns_have_size(&self, size: usize) -> bool {
+    match &self.ctrl {
+      Ctrl::Return(_, values) => values.len() == size,
+      Ctrl::Yield(..) => true,
+      Ctrl::Match(_, branches, fallback) => {
+        branches.values().all(|block| block.returns_have_size(size))
+          && fallback.as_ref().is_none_or(|block| block.returns_have_size(size))
+      },
+      Ctrl::MatchContinue(_, branches, fallback, _, _, _, continuation) => {
+        branches.values().all(|block| block.returns_have_size(size))
+          && fallback.as_ref().is_none_or(|block| block.returns_have_size(size))
+          && continuation.returns_have_size(size)
+      },
+    }
+  }
+
+  fn check_lookup_shapes(
+    &self,
+    program: &Toplevel,
+    yield_size: Option<usize>,
+  ) -> Result<(), &'static str> {
+    for op in &self.ops {
+      match op {
+        Op::Call(index, inputs, outputs, false) => {
+          let Some(callee) = program.functions.get(*index) else {
+            return Err("constrained call refers to a missing function");
+          };
+          if !callee.constrained {
+            return Err("constrained call refers to an unconstrained function");
+          }
+          if callee.layout.input_size != inputs.len() {
+            return Err("constrained call input arity differs from its callee");
+          }
+          if !callee.body.returns_have_size(*outputs) {
+            return Err(
+              "constrained call output arity differs from its callee",
+            );
+          }
+        },
+        Op::Store(values) if !canonical_size(values.len()) => {
+          return Err("memory width is not a canonical field element");
+        },
+        Op::Load(size, _) if !canonical_size(*size) => {
+          return Err("memory width is not a canonical field element");
+        },
+        _ => {},
+      }
+    }
+    match &self.ctrl {
+      Ctrl::Return(..) => {},
+      Ctrl::Yield(_, values) => {
+        if yield_size != Some(values.len()) {
+          return Err("yield arity differs from its enclosing continuation");
+        }
+      },
+      Ctrl::Match(_, branches, fallback) => {
+        for block in branches.values() {
+          block.check_lookup_shapes(program, yield_size)?;
+        }
+        if let Some(block) = fallback {
+          block.check_lookup_shapes(program, yield_size)?;
+        }
+      },
+      Ctrl::MatchContinue(_, branches, fallback, size, _, _, continuation) => {
+        for block in branches.values() {
+          block.check_lookup_shapes(program, Some(*size))?;
+        }
+        if let Some(block) = fallback {
+          block.check_lookup_shapes(program, Some(*size))?;
+        }
+        continuation.check_lookup_shapes(program, yield_size)?;
+      },
+    }
+    Ok(())
+  }
+}
+
+impl Toplevel {
+  /// Check the static boundaries of all constrained function messages.
+  /// This does not check value indices, layouts or arithmetic constraints.
+  pub fn validate_lookup_shapes(&self) -> Result<(), &'static str> {
+    if !canonical_size(self.functions.len()) {
+      return Err("function index domain exceeds the field characteristic");
+    }
+    if self.memory_sizes.iter().any(|&size| !canonical_size(size)) {
+      return Err("memory width is not a canonical field element");
+    }
+    for function in &self.functions {
+      if function.constrained {
+        function.body.check_lookup_shapes(self, None)?;
+      }
+    }
+    Ok(())
+  }
+
+  pub(crate) fn valid_claim_shape(&self, claim: &[G]) -> bool {
+    let [channel, index, arguments @ ..] = claim else {
+      return false;
+    };
+    if *channel != function_channel() {
+      return false;
+    }
+    let Ok(index) = usize::try_from(index.as_canonical_u64()) else {
+      return false;
+    };
+    let Some(function) = self.functions.get(index) else {
+      return false;
+    };
+    function.entry
+      && function.constrained
+      && arguments.len() >= function.layout.input_size
+      && function
+        .body
+        .returns_have_size(arguments.len() - function.layout.input_size)
+  }
+}
diff --git a/crates/aiur/src/memory.rs b/crates/aiur/src/memory.rs
index c3fd487d0..64dc80ea1 100644
--- a/crates/aiur/src/memory.rs
+++ b/crates/aiur/src/memory.rs
@@ -46,7 +46,7 @@ impl Memory {
     }
     let width = Self::width(size);
     // pull = negated multiplicity.
-    let lookups = vec![Lookup { multiplicity: -multiplicity, args }];
+    let lookups = vec![Lookup { multiplicity: -multiplicity.clone(), args }];
 
     // Transition constraints (formerly the `Air::eval` body): the selector is
     // boolean; a real next row implies a real current row; and the pointer
@@ -59,6 +59,8 @@ impl Memory {
     let is_real_transition = is_real_next * Expr::IsTransition;
     let constraints = vec![
       is_real.clone() * (is_real.clone() - one()),
+      // Padding cannot supply a memory lookup with nonzero multiplicity.
+      multiplicity * (one() - is_real.clone()),
       is_real_transition.clone() * (is_real - one()),
       is_real_transition * (ptr + one() - ptr_next),
     ];
diff --git a/crates/aiur/src/querymap.rs b/crates/aiur/src/querymap.rs
index c82df6928..9cc8997cd 100644
--- a/crates/aiur/src/querymap.rs
+++ b/crates/aiur/src/querymap.rs
@@ -1,12 +1,17 @@
 use multi_stark::p3_field::{PrimeCharacteristicRing, PrimeField64};
+use std::sync::{
+  Arc,
+  atomic::{AtomicU64, Ordering},
+};
 
-use crate::G;
+use crate::{G, call_order::RANK_BOUND};
 
 /// Immutable view of one query entry.
 #[derive(Clone, Copy)]
 pub struct QueryRef<'a> {
   pub(crate) output: &'a [G],
   pub multiplicity: G,
+  pub(crate) rank: u64,
 }
 
 /// Mutable view of one query entry: the output is fixed at insertion,
@@ -215,6 +220,10 @@ impl SegU64s {
     self.segs[i >> SEG_BITS].slice(i & SEG_MASK, 1)[0]
   }
 
+  fn set(&mut self, i: usize, value: u64) {
+    self.segs[i >> SEG_BITS].slice_mut(i & SEG_MASK, 1)[0] = value;
+  }
+
   #[inline]
   fn push(&mut self, h: u64) {
     let seg = self.entries >> SEG_BITS;
@@ -226,6 +235,30 @@ impl SegU64s {
   }
 }
 
+/// Shared completion order across function maps. Memory maps omit it.
+/// Reverse completion order gives the root rank zero and every constrained
+/// callee a strictly greater rank than its caller.
+struct CompletionOrder {
+  clock: Arc<AtomicU64>,
+  times: SegU64s,
+}
+
+impl CompletionOrder {
+  fn next(&self) -> u64 {
+    let time = self.clock.fetch_add(1, Ordering::Relaxed);
+    assert!(
+      time < RANK_BOUND,
+      "function completion count exceeds 48-bit rank bound"
+    );
+    time
+  }
+
+  fn rank(&self, i: usize) -> u64 {
+    let last = self.clock.load(Ordering::Relaxed) - 1;
+    last - self.times.at(i)
+  }
+}
+
 /// Append-only query store with a hash index.
 ///
 /// Functionally the insertion-ordered map `args -> (output, multiplicity)`
@@ -252,6 +285,7 @@ pub struct QueryMap {
   mults: SegStore,
   hashes: SegU64s,
   table: hashbrown::HashTable<u32>,
+  completion: Option<CompletionOrder>,
 }
 
 impl QueryMap {
@@ -263,9 +297,20 @@ impl QueryMap {
       mults: SegStore::new(1),
       hashes: SegU64s::new(),
       table: hashbrown::HashTable::new(),
+      completion: None,
     }
   }
 
+  pub(crate) fn new_function(key_stride: usize, clock: Arc<AtomicU64>) -> Self {
+    let mut map = Self::new(key_stride);
+    map.completion = Some(CompletionOrder { clock, times: SegU64s::new() });
+    map
+  }
+
+  fn rank_at(&self, i: usize) -> u64 {
+    self.completion.as_ref().map_or(0, |order| order.rank(i))
+  }
+
   #[inline]
   pub fn len(&self) -> usize {
     self.mults.entries
@@ -296,6 +341,7 @@ impl QueryMap {
     Some(QueryRef {
       output: self.outs.at(i),
       multiplicity: self.mults.at(i)[0],
+      rank: self.rank_at(i),
     })
   }
 
@@ -334,6 +380,12 @@ impl QueryMap {
       debug_assert_eq!(self.outs.at(i), output);
       if constrained {
         self.bump_multiplicity(i);
+        // Promotion executes/promotes children first, so its new completion
+        // time must follow them even when the hint entry was inserted early.
+        if let Some(order) = &mut self.completion {
+          let time = order.next();
+          order.times.set(i, time);
+        }
       }
     } else {
       self.insert(key, output, G::from_bool(constrained));
@@ -358,6 +410,10 @@ impl QueryMap {
     self.outs.push(output);
     self.mults.push(&[multiplicity]);
     self.hashes.push(hash);
+    if let Some(order) = &mut self.completion {
+      let time = order.next();
+      order.times.push(time);
+    }
     let hashes = &self.hashes;
     self.table.insert_unique(hash, i, |&j| hashes.at(j as usize));
   }
@@ -377,7 +433,11 @@ impl QueryMap {
     }
     Some((
       self.keys.at(i),
-      QueryRef { output: self.outs.at(i), multiplicity: self.mults.at(i)[0] },
+      QueryRef {
+        output: self.outs.at(i),
+        multiplicity: self.mults.at(i)[0],
+        rank: self.rank_at(i),
+      },
     ))
   }
 
@@ -385,7 +445,11 @@ impl QueryMap {
     (0..self.len()).map(|i| {
       (
         self.keys.at(i),
-        QueryRef { output: self.outs.at(i), multiplicity: self.mults.at(i)[0] },
+        QueryRef {
+          output: self.outs.at(i),
+          multiplicity: self.mults.at(i)[0],
+          rank: self.rank_at(i),
+        },
       )
     })
   }
diff --git a/crates/aiur/src/row_counts.rs b/crates/aiur/src/row_counts.rs
new file mode 100644
index 000000000..76cb19d1c
--- /dev/null
+++ b/crates/aiur/src/row_counts.rs
@@ -0,0 +1,210 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Witness-independent bounds for branch selection and terminal counts.
+//! Every return/yield allocates a selector, including consumed yields.
+
+use multi_stark::p3_field::PrimeField64;
+
+use crate::{
+  G,
+  bytecode::{Block, Circuit, Ctrl, Toplevel},
+};
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub(crate) struct ControlCounts {
+  pub(crate) nodes: usize,
+  pub(crate) leaves: usize,
+  pub(crate) returns: usize,
+  pub(crate) yields: usize,
+}
+
+impl ControlCounts {
+  fn checked_add(self, other: Self) -> Option<Self> {
+    Some(Self {
+      nodes: self.nodes.checked_add(other.nodes)?,
+      leaves: self.leaves.checked_add(other.leaves)?,
+      returns: self.returns.checked_add(other.returns)?,
+      yields: self.yields.checked_add(other.yields)?,
+    })
+  }
+
+  fn branches<'a>(blocks: impl Iterator<Item = &'a Block>) -> Option<Self> {
+    let mut counts = Self::default();
+    for block in blocks {
+      counts = counts.checked_add(block.control_counts()?)?;
+    }
+    counts.nodes = counts.nodes.checked_add(1)?;
+    Some(counts)
+  }
+
+  fn continued(self, continuation: Self) -> Option<Self> {
+    Some(Self {
+      nodes: self.nodes.checked_add(continuation.nodes)?,
+      leaves: self.leaves.checked_add(continuation.leaves)?,
+      returns: self.returns.checked_add(continuation.returns)?,
+      yields: continuation.yields,
+    })
+  }
+}
+
+impl Block {
+  pub(crate) fn control_counts(&self) -> Option<ControlCounts> {
+    match &self.ctrl {
+      Ctrl::Return(..) => {
+        Some(ControlCounts { nodes: 1, leaves: 1, returns: 1, yields: 0 })
+      },
+      Ctrl::Yield(..) => {
+        Some(ControlCounts { nodes: 1, leaves: 1, returns: 0, yields: 1 })
+      },
+      Ctrl::Match(_, branches, fallback) => {
+        ControlCounts::branches(branches.values().chain(fallback.as_deref()))
+      },
+      Ctrl::MatchContinue(_, branches, fallback, _, _, _, continuation) => {
+        ControlCounts::branches(branches.values().chain(fallback.as_deref()))?
+          .continued(continuation.control_counts()?)
+      },
+    }
+  }
+}
+
+fn canonical_count(count: usize) -> bool {
+  u64::try_from(count).is_ok_and(|count| count < G::ORDER_U64)
+}
+
+impl Circuit {
+  pub(crate) fn validate_row_counts(
+    &self,
+    program: &Toplevel,
+  ) -> Result<(), &'static str> {
+    if !canonical_count(self.members.len()) {
+      return Err("circuit member count exceeds the field characteristic");
+    }
+    let mut leaves = 0usize;
+    for &index in &self.members {
+      let Some(function) = program.functions.get(index) else {
+        return Err("circuit refers to a missing function");
+      };
+      let Some(counts) = function.body.control_counts() else {
+        return Err("function control count overflows");
+      };
+      if !canonical_count(counts.nodes) {
+        return Err("function control count exceeds the field characteristic");
+      }
+      leaves = leaves
+        .checked_add(counts.leaves)
+        .ok_or("circuit leaf count overflows")?;
+    }
+    if leaves > self.layout.selectors {
+      return Err("circuit has fewer selectors than return/yield leaves");
+    }
+    Ok(())
+  }
+}
+
+impl Toplevel {
+  pub fn validate_row_counts(&self) -> Result<(), &'static str> {
+    for circuit in &self.circuits {
+      circuit.validate_row_counts(self)?;
+    }
+    Ok(())
+  }
+}
+
+#[cfg(test)]
+mod tests {
+  use multi_stark::{
+    p3_field::PrimeCharacteristicRing,
+    types::{CommitmentParameters, FriParameters},
+  };
+
+  use super::*;
+  use crate::{
+    FxIndexMap,
+    bytecode::{Function, FunctionLayout},
+    synthesis::AiurSystem,
+  };
+
+  fn continued_body() -> Block {
+    let mut branches = FxIndexMap::default();
+    branches
+      .insert(G::ZERO, Block { ops: vec![], ctrl: Ctrl::Return(0, vec![]) });
+    branches
+      .insert(G::ONE, Block { ops: vec![], ctrl: Ctrl::Yield(1, vec![]) });
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::MatchContinue(
+        0,
+        branches,
+        None,
+        0,
+        0,
+        0,
+        Box::new(Block { ops: vec![], ctrl: Ctrl::Return(2, vec![]) }),
+      ),
+    }
+  }
+
+  fn continued_program(selectors: usize) -> Toplevel {
+    let layout =
+      FunctionLayout { input_size: 1, selectors, auxiliaries: 7, lookups: 4 };
+    Toplevel {
+      functions: vec![Function {
+        body: continued_body(),
+        layout,
+        entry: true,
+        constrained: true,
+      }],
+      memory_sizes: vec![],
+      circuits: vec![Circuit { members: vec![0], layout }],
+    }
+  }
+
+  #[test]
+  fn counts_include_consumed_yields_and_empty_matches() {
+    assert_eq!(
+      continued_body().control_counts(),
+      Some(ControlCounts { nodes: 4, leaves: 3, returns: 2, yields: 0 })
+    );
+    let empty =
+      Block { ops: vec![], ctrl: Ctrl::Match(0, FxIndexMap::default(), None) };
+    assert_eq!(
+      empty.control_counts(),
+      Some(ControlCounts { nodes: 1, ..ControlCounts::default() })
+    );
+    assert!(continued_program(3).validate_row_counts().is_ok());
+    assert!(continued_program(2).validate_row_counts().is_err());
+    assert!(continued_program(1).validate_row_counts().is_err());
+  }
+
+  #[test]
+  fn count_bounds_reject_machine_overflow_and_field_wrap() {
+    let maximal = ControlCounts { nodes: usize::MAX, ..Default::default() };
+    let one = ControlCounts { nodes: 1, ..Default::default() };
+    assert!(maximal.checked_add(one).is_none());
+    assert!(maximal.continued(one).is_none());
+    if let Ok(order) = usize::try_from(G::ORDER_U64) {
+      assert!(canonical_count(order - 1));
+      assert!(!canonical_count(order));
+      assert!(!canonical_count(usize::MAX));
+    }
+  }
+
+  #[test]
+  #[should_panic(expected = "invalid Aiur control counts")]
+  fn system_construction_rejects_missing_leaf_selectors() {
+    let top = continued_program(1);
+    top.validate_lookup_shapes().unwrap();
+    AiurSystem::build(
+      top,
+      CommitmentParameters { log_blowup: 1, cap_height: 0 },
+      FriParameters {
+        log_final_poly_len: 0,
+        max_log_arity: 1,
+        num_queries: 64,
+        commit_proof_of_work_bits: 0,
+        query_proof_of_work_bits: 0,
+      },
+    );
+  }
+}
diff --git a/crates/aiur/src/synthesis.rs b/crates/aiur/src/synthesis.rs
index ae7e2ac89..6229f6d80 100644
--- a/crates/aiur/src/synthesis.rs
+++ b/crates/aiur/src/synthesis.rs
@@ -20,7 +20,9 @@ use crate::{
   execute::{ExecError, IOBuffer, QueryRecord},
   function_channel,
   gadgets::{AiurGadget, bytes1::Bytes1, bytes2::Bytes2},
+  lookup_budget::lookup_query_bound,
   memory::Memory,
+  trace_heights::fixed_trace_heights,
 };
 
 /// The concrete STARK configuration Aiur instantiates multi-stark with.
@@ -134,6 +136,9 @@ impl AiurSystem {
     commitment_parameters: CommitmentParameters,
     fri_parameters: FriParameters,
   ) -> Self {
+    toplevel.validate_lookup_shapes().expect("invalid Aiur lookup shapes");
+    toplevel.validate_row_counts().expect("invalid Aiur control counts");
+    toplevel.validate_emission().expect("invalid Aiur emission inputs");
     let mut circuit_inputs: Vec<CircuitInputs<G>> = Vec::new();
     let mut slot_widths: Vec<Vec<usize>> = Vec::new();
 
@@ -164,7 +169,7 @@ impl AiurSystem {
       // superposed arguments are degree 2, and grouping would push the
       // logUp constraints past the quotient budget.
       let group_size =
-        if toplevel.circuits[i].layout.selectors == 1 && lookups.len() >= 2 {
+        if toplevel.circuit_is_branchless(i) && lookups.len() >= 2 {
           2
         } else {
           1
@@ -404,11 +409,14 @@ impl AiurSystem {
     fun_idx: FunIdx,
     input: &[G],
     io_buffer: &IOBuffer,
-    query_record: QueryRecord,
+    mut query_record: QueryRecord,
     output: &[G],
   ) -> (Vec<G>, AiurProof) {
     let _g = tracing::info_span!("aiur/witness").entered();
-    let circuit_types = self.circuit_types();
+    let mut circuit_types = self.circuit_types();
+    // Function traces supply call-order range queries. Bytes2 consumes the
+    // merged counts after the other circuits finish their parallel work.
+    assert!(matches!(circuit_types.pop(), Some(CircuitType::Bytes2)));
     let witness_data = circuit_types
       .into_par_iter()
       .enumerate()
@@ -422,19 +430,33 @@ impl AiurSystem {
             &slot_arg_widths,
           ),
           CircuitType::Memory { width } => {
-            Memory::witness_data(width, &query_record, &slot_arg_widths)
+            let (trace, lookups) =
+              Memory::witness_data(width, &query_record, &slot_arg_widths);
+            (trace, lookups, crate::call_order::RankRanges::default())
           },
           CircuitType::Bytes1 => {
-            Bytes1.witness_data(&query_record, &slot_arg_widths)
+            let (trace, lookups) =
+              Bytes1.witness_data(&query_record, &slot_arg_widths);
+            (trace, lookups, crate::call_order::RankRanges::default())
           },
           CircuitType::Bytes2 => {
-            Bytes2.witness_data(&query_record, &slot_arg_widths)
+            unreachable!("Bytes2 is built after rank queries")
           },
         }
       })
       .collect::<Vec<_>>();
+    let mut traces = Vec::with_capacity(witness_data.len() + 1);
+    let mut lookups = Vec::with_capacity(witness_data.len() + 1);
+    for (trace, lookup, ranges) in witness_data {
+      traces.push(trace);
+      lookups.push(lookup);
+      query_record.bytes2_queries.add_rank_ranges(ranges);
+    }
+    let (trace, lookup) =
+      Bytes2.witness_data(&query_record, &self.slot_arg_widths(traces.len()));
+    traces.push(trace);
+    lookups.push(lookup);
     drop(query_record); // Early drop to free memory.
-    let (traces, lookups) = witness_data.into_iter().unzip();
     let witness = SystemWitness { traces, lookups };
     drop(_g);
 
@@ -574,6 +596,32 @@ impl AiurSystem {
     claim: &[G],
     proof: &AiurProof,
   ) -> Result<(), VerificationError<PcsError>> {
+    if !self.toplevel.valid_claim_shape(claim) {
+      return Err(VerificationError::InvalidClaim);
+    }
+    if !fixed_trace_heights(
+      self.system.circuits.iter().map(|circuit| circuit.preprocessed_height),
+      &proof.active,
+      &proof.log_degrees,
+    ) {
+      return Err(VerificationError::InvalidProofShape);
+    }
+    if !crate::trace_heights::trace_cap_coverage(
+      self.commitment_parameters.log_blowup,
+      self.commitment_parameters.cap_height,
+      &proof.log_degrees,
+    ) {
+      return Err(VerificationError::InvalidProofShape);
+    }
+    if lookup_query_bound(
+      self.slot_widths.iter().map(Vec::len),
+      &proof.active,
+      &proof.log_degrees,
+    )
+    .is_none()
+    {
+      return Err(VerificationError::InvalidProofShape);
+    }
     self.system.verify(claim, proof)
   }
 
@@ -591,6 +639,35 @@ impl AiurSystem {
 
 #[cfg(test)]
 mod tests {
+  mod acceptance;
+  mod advice;
+  mod blake3;
+  mod branchless;
+  mod byte_gadgets;
+  mod byte_shapes;
+  mod call_order;
+  mod constant_degree;
+  #[cfg(not(feature = "cuda"))]
+  mod extension_mmcs;
+  mod folding;
+  mod fri_domain;
+  #[cfg(not(feature = "cuda"))]
+  mod fri_query;
+  mod interpolation;
+  mod lookup_budget;
+  mod lookup_shapes;
+  mod memory;
+  #[cfg(not(feature = "cuda"))]
+  mod merkle;
+  mod mmcs;
+  mod polynomial;
+  mod proof_codec;
+  mod proof_shapes;
+  #[cfg(not(feature = "cuda"))]
+  mod pruned_merkle;
+  mod scalar;
+  mod transcript;
+
   use super::*;
   use crate::{
     bytecode::{Block, Ctrl, Function, FunctionLayout, Op, Toplevel},
@@ -636,12 +713,12 @@ mod tests {
   /// Layout — matched against how `constraints.rs`/`trace.rs` walk the block:
   /// - `input_size = 2`: the two inputs `a`, `b`.
   /// - `selectors = 1`: the single `Return` (selector index 0).
-  /// - `auxiliaries = 2`: the multiplicity column (allocated first for every
-  ///   function) plus one auxiliary for the `Mul` — `a` and `b` each have
+  /// - `auxiliaries = 8`: multiplicity, six rank bytes and one auxiliary
+  ///   for the `Mul` — `a` and `b` each have
   ///   degree 1, so `a*b` has degree 2 and `constraints.rs` spills it into a
   ///   fresh auxiliary column pinned by `sel * (col - a*b)`.
-  /// - `lookups = 1`: the function-provide (return) lookup in slot 0, which
-  ///   pulls the claim `[function_channel, fun_idx, a, b, a*b]`.
+  /// - `lookups = 4`: the function return in slot 0, followed by three rank
+  ///   range lookups. Rank zero preserves the public multiplication claim.
   ///
   /// Test-side singleton partition (production circuits come pre-built from
   /// the Lean compiler).
@@ -669,8 +746,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 2,
         selectors: 1,
-        auxiliaries: 2,
-        lookups: 1,
+        auxiliaries: 8,
+        lookups: 4,
       },
       entry: true,
       constrained: true,
@@ -688,8 +765,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 2,
         selectors: 1,
-        auxiliaries: 5,
-        lookups: 3,
+        auxiliaries: 11,
+        lookups: 6,
       },
       entry: true,
       constrained: true,
@@ -733,7 +810,7 @@ mod tests {
   /// - `f` (idx 0, entry): `f(a, b) = g(a) * b`, but routing `b` through
   ///   memory so the memory path is live:
   ///   - `Call(1, [a], 1, false)` → `g(a)` at value idx 2, allocating one
-  ///     output auxiliary + one function-channel lookup slot.
+  ///     output auxiliary, seven order auxiliaries and four lookup slots.
   ///   - `Store([b])` → pointer at value idx 3, allocating one pointer
   ///     auxiliary + one memory-channel lookup slot (multiplicity pushed).
   ///   - `Load(1, 3)` → the loaded `b` at value idx 4, allocating one value
@@ -746,15 +823,15 @@ mod tests {
   ///   the block:
   ///   - `input_size = 2` (`a`, `b`).
   ///   - `selectors = 1` (the single `Return`).
-  ///   - `auxiliaries = 5`: multiplicity(1) + call output(1) + store ptr(1) +
-  ///     load value(1) + mul spill(1).
-  ///   - `lookups = 4`: return(slot 0) + call(1) + store(1) + load(1).
+  ///   - `auxiliaries = 18`: multiplicity(1), rank bytes(6), call output(1),
+  ///     call order(7), store pointer(1), load value(1), multiplication(1).
+  ///   - `lookups = 10`: return(1), rank ranges(3), call/order(4), memory(2).
   ///
   /// - `g` (idx 1): `g(x) = x + 1`:
   ///   - `Const(1)` at value idx 1, `Add(0, 1)` at value idx 2,
   ///     `Return(0, [2])`. `Const`/`Add` allocate no auxiliaries.
-  ///   - Layout: `input_size = 1`, `selectors = 1`, `auxiliaries = 1`
-  ///     (multiplicity only), `lookups = 1` (return only).
+  ///   - Layout: `input_size = 1`, `selectors = 1`, `auxiliaries = 7`
+  ///     (multiplicity and rank), `lookups = 4` (return and rank ranges).
   ///
   /// `memory_sizes = [1]`: a memory of size-1 values, which materializes one
   /// `Memory` circuit. The single `Store` inserts the entry (memory
@@ -777,8 +854,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 2,
         selectors: 1,
-        auxiliaries: 5,
-        lookups: 4,
+        auxiliaries: 18,
+        lookups: 10,
       },
       entry: true,
       constrained: true,
@@ -793,8 +870,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 1,
         selectors: 1,
-        auxiliaries: 1,
-        lookups: 1,
+        auxiliaries: 7,
+        lookups: 4,
       },
       entry: false,
       constrained: true,
@@ -857,8 +934,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 1,
         selectors: 1,
-        auxiliaries: 3,
-        lookups: 2,
+        auxiliaries: 16,
+        lookups: 8,
       },
       entry: true,
       constrained: true,
@@ -872,8 +949,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 1,
         selectors: 1,
-        auxiliaries: 2,
-        lookups: 2,
+        auxiliaries: 15,
+        lookups: 8,
       },
       entry: false,
       constrained: true,
@@ -887,8 +964,8 @@ mod tests {
       layout: FunctionLayout {
         input_size: 1,
         selectors: 1,
-        auxiliaries: 1,
-        lookups: 1,
+        auxiliaries: 7,
+        lookups: 4,
       },
       entry: false,
       constrained: true,
@@ -968,8 +1045,8 @@ mod tests {
 
     // Function circuits: main width = inputs + selectors + auxiliaries, no
     // preprocessed matrix.
-    assert_eq!(shapes[0].main_width, 2 + 1 + 5);
-    assert_eq!(shapes[1].main_width, 1 + 1 + 1);
+    assert_eq!(shapes[0].main_width, 2 + 1 + 18);
+    assert_eq!(shapes[1].main_width, 1 + 1 + 7);
     // Memory of size 1: multiplicity + selector + pointer + 1 value.
     assert_eq!(shapes[2].main_width, 3 + 1);
     for shape in &shapes[..3] {
diff --git a/crates/aiur/src/synthesis/tests/acceptance.rs b/crates/aiur/src/synthesis/tests/acceptance.rs
new file mode 100644
index 000000000..d40eb9683
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/acceptance.rs
@@ -0,0 +1,219 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+use multi_stark::eval::{VarValues, eval_expr};
+
+fn values<'a>(row: &'a [G], next: &'a [G]) -> VarValues<'a, G> {
+  VarValues {
+    preprocessed: [&[], &[]],
+    main: [row, next],
+    stage2: [&[], &[]],
+    publics: &[],
+    is_first_row: G::ONE,
+    is_last_row: G::ZERO,
+    is_transition: G::ONE,
+  }
+}
+
+/// Retain the entry singleton and group the nested callees, whose auxiliary
+/// and lookup widths differ and whose selectors occupy separate columns.
+fn grouped_promotion_toplevel() -> Toplevel {
+  let mut top = unconstrained_call_promotion_toplevel();
+  top.circuits.truncate(1);
+  top.circuits.push(crate::bytecode::Circuit {
+    members: vec![1, 2],
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 2,
+      auxiliaries: 15,
+      lookups: 8,
+    },
+  });
+  top
+}
+
+#[test]
+fn inactive_function_multiplicity_is_constrained_in_every_partition() {
+  for mut top in [mul_toplevel(), grouped_promotion_toplevel()] {
+    // Generate a concrete active row for each member. Entry visibility is
+    // only an executor guard and does not alter these AIR constraints.
+    for function in &mut top.functions {
+      function.entry = true;
+    }
+    for (idx, circuit) in top.circuits.iter().enumerate() {
+      let (constraints, lookups) = top.build_constraints(idx);
+      let mut row = vec![G::ZERO; constraints.width];
+      let multiplicity = circuit.layout.input_size + circuit.layout.selectors;
+      for nonzero in [G::ONE, -G::ONE, G::from_u8(7)] {
+        row[multiplicity] = nonzero;
+        assert!(
+          constraints
+            .zeros
+            .iter()
+            .any(|c| eval_expr(c, &values(&row, &row)) != G::ZERO),
+          "inactive circuit {idx} accepted multiplicity {nonzero}"
+        );
+        // Every fixture member has one return selector. Activating any
+        // member must permit the multiplicity, including the later members
+        // of a group. These are local constraint checks; the roundtrip
+        // below also checks global lookup balance for an honest execution.
+        for &member in &circuit.members {
+          assert_eq!(top.functions[member].layout.selectors, 1);
+          let mut io_buffer = empty_io_buffer();
+          let input = vec![G::ZERO; top.functions[member].layout.input_size];
+          let (record, _) = top.execute(member, input, &mut io_buffer).unwrap();
+          let widths =
+            lookups.iter().map(|lookup| lookup.args.len()).collect::<Vec<_>>();
+          let (trace, _, _) =
+            top.witness_data(idx, &record, &io_buffer, &widths);
+          let mut active = trace.values[..constraints.width].to_vec();
+          active[multiplicity] = nonzero;
+          assert!(
+            constraints
+              .zeros
+              .iter()
+              .all(|c| eval_expr(c, &values(&active, &active)) == G::ZERO),
+            "active member {member} rejected multiplicity {nonzero}"
+          );
+        }
+      }
+      row[multiplicity] = G::ZERO;
+      assert!(
+        constraints
+          .zeros
+          .iter()
+          .all(|c| eval_expr(c, &values(&row, &row)) == G::ZERO)
+      );
+    }
+  }
+}
+
+#[test]
+fn inactive_memory_multiplicity_is_constrained() {
+  for width in [1, 4, 8] {
+    let (memory, constraints, _) = Memory::build(width);
+    let mut row = vec![G::ZERO; memory.width];
+    let next = row.clone();
+    for nonzero in [G::ONE, -G::ONE, G::from_u8(7)] {
+      row[0] = nonzero;
+      assert!(
+        constraints
+          .iter()
+          .any(|c| eval_expr(c, &values(&row, &next)) != G::ZERO)
+      );
+      row[1] = G::ONE;
+      assert!(
+        constraints
+          .iter()
+          .all(|c| eval_expr(c, &values(&row, &next)) == G::ZERO)
+      );
+      row[1] = G::ZERO;
+    }
+    row[0] = G::ZERO;
+    assert!(
+      constraints.iter().all(|c| eval_expr(c, &values(&row, &next)) == G::ZERO)
+    );
+  }
+}
+
+#[test]
+fn active_grouped_returns_verify() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(grouped_promotion_toplevel(), cp, fp);
+  let input = [G::from_u8(3)];
+  let (claim, proof) = system.prove(0, &input, &mut empty_io_buffer());
+  assert_eq!(
+    claim,
+    vec![function_channel(), G::ZERO, input[0], input[0] + G::ONE]
+  );
+  system.verify(&claim, &proof).expect("active grouped returns must verify");
+}
+
+/// Exercise the public verifier with supplied trace rows, independently of
+/// the execution record. A successful honest execution alone cannot check
+/// whether inactive rows are permitted to provide a function result.
+#[test]
+fn inactive_return_cannot_supply_claim() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let a = G::from_u8(3);
+  let b = G::from_u8(5);
+  let wrong_result = G::from_u8(16);
+  assert_ne!(a * b, wrong_result);
+  let claim = vec![function_channel(), G::ZERO, a, b, wrong_result];
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(i, shape)| {
+      let height = if i == 0 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if i == 0 {
+        // Inputs, inactive selector, return multiplicity, six rank bytes,
+        // then unconstrained product advice.
+        rows[..4].copy_from_slice(&[a, b, G::ZERO, G::ONE]);
+        rows[10] = wrong_result;
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert!(
+    system.verify(&claim, &proof).is_err(),
+    "an inactive function row supplied an incorrect public result"
+  );
+}
+
+/// A function that only calls itself has no finite execution. Its return
+/// lookup must not be justified by the same row's recursive call lookup.
+#[test]
+fn recursive_cycle_cannot_supply_claim() {
+  let function = Function {
+    body: Block {
+      ops: vec![Op::Call(0, vec![0], 1, false)],
+      ctrl: Ctrl::Return(0, vec![1]),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 15,
+      lookups: 8,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let top = with_singleton_circuits(vec![function], vec![]);
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(top, cp, fp);
+  let input = G::from_u8(3);
+  let output = G::from_u8(7);
+  let claim = vec![function_channel(), G::ZERO, input, output];
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(i, shape)| {
+      let height = if i == 0 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if i == 0 {
+        // One active row provides twice: once to its own recursive call,
+        // and once to the public claim. No evaluator is used.
+        rows[..3].copy_from_slice(&[input, G::ONE, G::from_u8(2)]);
+        rows[9] = output;
+      } else if i == system.toplevel.circuits.len() + 1 {
+        // Six zero-byte pairs: three for the row rank and three for the
+        // call gap. Balance these lookups so rejection tests call order.
+        rows[6] = G::from_u8(6);
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert!(
+    system.verify(&claim, &proof).is_err(),
+    "a recursive cycle supplied a public return value without a finite execution"
+  );
+}
diff --git a/crates/aiur/src/synthesis/tests/advice.rs b/crates/aiur/src/synthesis/tests/advice.rs
new file mode 100644
index 000000000..ced84d0ad
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/advice.rs
@@ -0,0 +1,156 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+
+/// Supply function rows directly, with only the rank-zero byte requests.
+/// This deliberately does not use the executor or its hint implementations.
+fn supplied_proof(
+  system: &AiurSystem,
+  claim: &[G],
+  input: &[G],
+  auxiliaries_after_rank: &[G],
+) -> AiurProof {
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(index, shape)| {
+      let height = if index == 0 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if index == 0 {
+        rows[..input.len()].copy_from_slice(input);
+        rows[input.len()] = G::ONE; // selector
+        rows[input.len() + 1] = G::ONE; // public return multiplicity
+        let start = input.len() + 8; // selector, multiplicity, six rank bytes
+        assert_eq!(start + auxiliaries_after_rank.len(), shape.main_width);
+        rows[start..shape.main_width].copy_from_slice(auxiliaries_after_rank);
+      } else if index == system.toplevel.circuits.len() + 1 {
+        rows[6] = G::from_u8(3); // three rank-byte pairs (0, 0)
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  system.system.prove(&system.key, claim, witness)
+}
+
+fn pack_word(bytes: &[G]) -> G {
+  assert_eq!(bytes.len(), 4);
+  bytes.iter().enumerate().fold(G::ZERO, |sum, (index, byte)| {
+    sum + *byte * G::from_u64(1 << (8 * index))
+  })
+}
+
+/// All unconstrained operations can receive arbitrary per-row advice.
+/// The u32 carries are virtual expressions and therefore are still pinned.
+/// I/O writes, key insertion and debugging do not constrain these rows.
+#[test]
+fn supplied_advice_has_relational_semantics() {
+  let function = Function {
+    body: Block {
+      ops: vec![
+        Op::IOGetInfo(0, vec![]),
+        Op::IORead(0, 1, 2),
+        Op::UnconstrainedBigUintDivMod(0, 1),
+        Op::UnconstrainedGToBytes(0),
+        Op::UnconstrainedGInverse(0),
+        Op::Call(1, vec![0], 1, true),
+        Op::UnconstrainedU32Add(vec![0, 1, 2, 3], vec![4, 5, 6, 7]),
+        Op::UnconstrainedU32Add3(
+          vec![0, 1, 2, 3],
+          vec![4, 5, 6, 7],
+          vec![8, 9, 10, 11],
+        ),
+        Op::IOSetInfo(0, vec![], 1, 2),
+        Op::IOWrite(0, vec![12, 13]),
+        Op::Debug("advice effects".into(), Some(vec![14, 15])),
+      ],
+      ctrl: Ctrl::Return(0, (12..38).collect()),
+    },
+    layout: FunctionLayout {
+      input_size: 12,
+      selectors: 1,
+      auxiliaries: 31,
+      lookups: 4,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let callee = Function {
+    body: Block {
+      ops: vec![Op::Const(G::ZERO)],
+      ctrl: Ctrl::Return(0, vec![1]),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 7,
+      lookups: 4,
+    },
+    entry: false,
+    constrained: false,
+  };
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(
+    with_singleton_circuits(vec![function, callee], vec![]),
+    cp,
+    fp,
+  );
+  let input: Vec<_> = (1..=12).map(G::from_u64).collect();
+  // Even the advice called "bytes" is outside the byte range. The bare
+  // hints impose no range check; a caller must add one when required.
+  let advice: Vec<_> = (300..324).map(G::from_u64).collect();
+  let mut output = advice[..20].to_vec();
+  let inverse_2_32 = G::from_u64(0xffff_fffe_0000_0002);
+  let x = pack_word(&input[..4]);
+  let y = pack_word(&input[4..8]);
+  let z = pack_word(&input[8..12]);
+  output.push((x + y - pack_word(&advice[16..20])) * inverse_2_32);
+  output.extend_from_slice(&advice[20..24]);
+  output.push((x + y + z - pack_word(&advice[20..24])) * inverse_2_32);
+  let mut claim = vec![function_channel(), G::ZERO];
+  claim.extend_from_slice(&input);
+  claim.extend_from_slice(&output);
+  let proof = supplied_proof(&system, &claim, &input, &advice);
+  system.verify(&claim, &proof).expect("unchecked advice is permitted");
+
+  // A changed public carry is not supplied by this same local computation.
+  *claim.last_mut().unwrap() += G::ONE;
+  let proof = supplied_proof(&system, &claim, &input, &advice);
+  assert!(system.verify(&claim, &proof).is_err());
+}
+
+#[test]
+fn checked_inverse_advice_rejects_incorrect_value() {
+  let function = Function {
+    body: Block {
+      ops: vec![
+        Op::UnconstrainedGInverse(0),
+        Op::Mul(0, 1),
+        Op::Const(G::ONE),
+        Op::AssertEq(vec![2], vec![3], None),
+      ],
+      ctrl: Ctrl::Return(0, vec![1]),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 9,
+      lookups: 4,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let (cp, fp) = test_parameters();
+  let system =
+    AiurSystem::build(with_singleton_circuits(vec![function], vec![]), cp, fp);
+  let input = [G::from_u8(3)];
+  let wrong = G::from_u8(4);
+  let claim = [function_channel(), G::ZERO, input[0], wrong];
+  let proof =
+    supplied_proof(&system, &claim, &input, &[wrong, input[0] * wrong]);
+  assert!(system.verify(&claim, &proof).is_err());
+  let (claim, proof) = system.prove(0, &input, &mut empty_io_buffer());
+  system.verify(&claim, &proof).expect("checked honest inverse must verify");
+}
diff --git a/crates/aiur/src/synthesis/tests/blake3.rs b/crates/aiur/src/synthesis/tests/blake3.rs
new file mode 100644
index 000000000..e93d9b81c
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/blake3.rs
@@ -0,0 +1,101 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Independent native outputs for the checked unkeyed BLAKE3 implementation.
+
+use ::blake3::{
+  Hasher,
+  hazmat::{
+    HasherExt, Mode, left_subtree_len, merge_subtrees_non_root,
+    merge_subtrees_root,
+  },
+};
+use p3_symmetric::CryptographicHasher;
+use std::collections::BTreeSet;
+
+fn number(out: &mut Vec<u8>, value: u64) {
+  out.extend(value.to_le_bytes());
+}
+
+fn bytes(out: &mut Vec<u8>, value: &[u8]) {
+  number(out, u64::try_from(value.len()).unwrap());
+  out.extend(value);
+}
+
+fn input(length: usize, salt: usize) -> Vec<u8> {
+  (0..length)
+    .map(|i| u8::try_from((i * 17 + i / 251 * 13 + salt * 29) % 256).unwrap())
+    .collect()
+}
+
+#[test]
+fn blake3_snapshot() -> std::io::Result<()> {
+  let mut out = b"Aiur Blake3 v1\n".to_vec();
+  let mut lengths: BTreeSet<usize> = (0..=128).chain(960..=1024).collect();
+  lengths.extend([255, 256, 257, 511, 512, 513]);
+  for chunks in (1..=17).chain([32, 64, 128]) {
+    lengths.extend([chunks * 1024 - 1, chunks * 1024, chunks * 1024 + 1]);
+  }
+  number(&mut out, u64::try_from(lengths.len()).unwrap());
+  for (case, length) in lengths.into_iter().enumerate() {
+    let data = input(length, case);
+    let expected = ::blake3::hash(&data);
+    let p3: [u8; 32] = p3_blake3::Blake3.hash_iter(data.iter().copied());
+    assert_eq!(p3, *expected.as_bytes());
+    let mut stream = Hasher::new();
+    for part in
+      data.chunks([1, 63, 64, 65, 511, 512, 1023, 1024, 1025][case % 9])
+    {
+      stream.update(part);
+    }
+    assert_eq!(stream.finalize(), expected);
+    bytes(&mut out, &data);
+    out.extend(expected.as_bytes());
+    if length > 1024 {
+      let split = left_subtree_len(u64::try_from(length).unwrap());
+      number(&mut out, split);
+      let split = usize::try_from(split).unwrap();
+      let left = Hasher::new().update(&data[..split]).finalize_non_root();
+      let right = Hasher::new()
+        .set_input_offset(u64::try_from(split).unwrap())
+        .update(&data[split..])
+        .finalize_non_root();
+      assert_eq!(merge_subtrees_root(&left, &right, Mode::Hash), expected);
+      out.extend(left);
+      out.extend(right);
+    }
+  }
+  let counters = [0, 1, 2, 255, (1 << 32) - 1, 1 << 32, (1 << 54) - 1];
+  let chunk_lengths = [1, 63, 64, 65, 1023, 1024];
+  number(
+    &mut out,
+    u64::try_from(counters.len() * chunk_lengths.len()).unwrap(),
+  );
+  for counter in counters {
+    for length in chunk_lengths {
+      let data = input(length, usize::try_from(counter % 251).unwrap());
+      let cv = Hasher::new()
+        .set_input_offset(counter * 1024)
+        .update(&data)
+        .finalize_non_root();
+      number(&mut out, counter);
+      bytes(&mut out, &data);
+      out.extend(cv);
+    }
+  }
+  number(&mut out, 64);
+  for salt in 0..64 {
+    let left: [u8; 32] = input(32, salt).try_into().unwrap();
+    let right: [u8; 32] = input(32, salt + 83).try_into().unwrap();
+    out.extend(left);
+    out.extend(right);
+    out.extend(merge_subtrees_non_root(&left, &right, Mode::Hash));
+    out.extend(merge_subtrees_root(&left, &right, Mode::Hash).as_bytes());
+    // PCS Merkle compression is an ordinary hash of 64 digest bytes.
+    out.extend(::blake3::hash(&[left, right].concat()).as_bytes());
+  }
+  if let Some(path) = std::env::var_os("IX_BLAKE3_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/branchless.rs b/crates/aiur/src/synthesis/tests/branchless.rs
new file mode 100644
index 000000000..3cac25114
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/branchless.rs
@@ -0,0 +1,124 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+use crate::FxIndexMap;
+use multi_stark::eval::{VarValues, eval_expr};
+
+fn empty_branch_toplevel() -> Toplevel {
+  let dead = Block {
+    ops: vec![Op::Store(vec![])],
+    ctrl: Ctrl::Match(0, FxIndexMap::default(), None),
+  };
+  let called = Block {
+    ops: vec![Op::Call(1, vec![], 1, false)],
+    ctrl: Ctrl::Return(0, vec![1]),
+  };
+  let caller = Function {
+    body: Block {
+      ops: vec![],
+      ctrl: Ctrl::Match(
+        0,
+        [(G::ZERO, dead), (G::ONE, called)].into_iter().collect(),
+        None,
+      ),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 15,
+      lookups: 8,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let callee = Function {
+    body: Block {
+      ops: vec![Op::Const(G::ONE)],
+      ctrl: Ctrl::Return(0, vec![0]),
+    },
+    layout: FunctionLayout {
+      input_size: 0,
+      selectors: 1,
+      auxiliaries: 7,
+      lookups: 4,
+    },
+    entry: false,
+    constrained: true,
+  };
+  with_singleton_circuits(vec![caller, callee], vec![0, 1])
+}
+
+#[test]
+fn empty_branch_preserves_honest_execution() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(empty_branch_toplevel(), cp, fp);
+  let (claim, proof) = system.prove(0, &[G::ONE], &mut empty_io_buffer());
+  assert_eq!(claim, vec![function_channel(), G::ZERO, G::ONE, G::ONE]);
+  system.verify(&claim, &proof).unwrap();
+}
+
+/// A zero-leaf branch can still emit a lookup. Its inactive store must not
+/// turn the selected call's function channel into a memory channel merely
+/// because the entire circuit has one return selector.
+#[test]
+fn empty_branch_cannot_redirect_a_call_to_memory() {
+  let top = empty_branch_toplevel();
+  top.validate_lookup_shapes().unwrap();
+  top.validate_row_counts().unwrap();
+  assert!(!top.circuit_is_branchless(0));
+  assert!(top.circuit_is_branchless(1));
+  let (_, expected) =
+    top.execute(0, vec![G::ONE], &mut empty_io_buffer()).unwrap();
+  assert_eq!(expected, vec![G::ONE]);
+  let forged = G::from_u8(7);
+  assert_ne!(expected, vec![forged]);
+  let (constraints, lookups) = top.build_constraints(0);
+  let mut row = vec![G::ZERO; constraints.width];
+  row[0] = G::ONE;
+  row[1] = G::ONE;
+  row[2] = G::ONE;
+  row[9] = forged;
+  row[10] = G::ONE;
+  let values = VarValues {
+    preprocessed: [&[], &[]],
+    main: [&row, &row],
+    stage2: [&[], &[]],
+    publics: &[],
+    is_first_row: G::ONE,
+    is_last_row: G::ZERO,
+    is_transition: G::ONE,
+  };
+  assert!(constraints.zeros.iter().all(|c| eval_expr(c, &values) == G::ZERO));
+  let combined: Vec<_> =
+    lookups[4].args.iter().map(|arg| eval_expr(arg, &values)).collect();
+  assert_eq!(combined, vec![function_channel(), G::ONE, forged, G::ONE]);
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(top, cp, fp);
+  let claim = vec![function_channel(), G::ZERO, G::ONE, forged];
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(index, shape)| {
+      let height = if index < 4 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if index == 0 {
+        rows[..shape.main_width].copy_from_slice(&row);
+      } else if index == 3 {
+        // Supply the redirected memory lookup, with no callee row.
+        rows[..4].copy_from_slice(&[G::ONE, G::ONE, forged + forged, G::ONE]);
+      } else if index == 5 {
+        // The caller's root rank and all three call-gap pairs are zero.
+        rows[6] = G::from_u8(6);
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert!(
+    system.verify(&claim, &proof).is_err(),
+    "an inactive empty branch redirected a call to memory and supplied a false public result"
+  );
+}
diff --git a/crates/aiur/src/synthesis/tests/byte_gadgets.rs b/crates/aiur/src/synthesis/tests/byte_gadgets.rs
new file mode 100644
index 000000000..6bad5671c
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/byte_gadgets.rs
@@ -0,0 +1,243 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Export the actual fixed byte-chip rows and evaluated lookup messages for
+//! the Lean component gate. No program executor is involved.
+
+use std::{
+  fs::File,
+  io::{self, BufWriter, Write},
+};
+
+use super::{
+  AiurSystem, Block, Ctrl, Function, FunctionLayout, Op, RowMajorMatrix,
+  SystemWitness, function_channel, test_parameters, with_singleton_circuits,
+};
+use crate::{
+  G,
+  gadgets::{AiurGadget, bytes1::Bytes1, bytes2::Bytes2},
+};
+use multi_stark::{
+  eval::{VarValues, eval_expr},
+  p3_field::{PrimeCharacteristicRing, PrimeField64},
+  p3_matrix::Matrix,
+};
+
+fn local_values(row: &[G]) -> VarValues<'_, G> {
+  VarValues {
+    preprocessed: [&[], &[]],
+    main: [row, row],
+    stage2: [&[], &[]],
+    publics: &[],
+    is_first_row: G::ONE,
+    is_last_row: G::ZERO,
+    is_transition: G::ONE,
+  }
+}
+
+fn write_u64(out: &mut impl Write, value: u64) -> io::Result<()> {
+  out.write_all(&value.to_le_bytes())
+}
+
+fn export<T: AiurGadget>(gadget: &T, out: &mut impl Write) -> io::Result<()> {
+  let preprocessed = gadget.preprocessed().expect("fixed byte chip");
+  let lookups = gadget.lookups();
+  write_u64(out, preprocessed.height() as u64)?;
+  write_u64(out, preprocessed.width() as u64)?;
+  write_u64(out, lookups.len() as u64)?;
+  for lookup in &lookups {
+    write_u64(out, lookup.args.len() as u64)?;
+  }
+  // Distinct weights also pin the lookup-slot-to-multiplicity-column map.
+  let weights: Vec<G> =
+    (0..gadget.main_width()).map(|index| G::from_usize(index + 17)).collect();
+  for row in preprocessed.values.chunks_exact(preprocessed.width()) {
+    for value in row {
+      write_u64(out, value.as_canonical_u64())?;
+    }
+    let values = VarValues {
+      preprocessed: [row, row],
+      main: [&weights, &weights],
+      stage2: [&[], &[]],
+      publics: &[],
+      is_first_row: G::ZERO,
+      is_last_row: G::ZERO,
+      is_transition: G::ZERO,
+    };
+    for lookup in &lookups {
+      write_u64(
+        out,
+        eval_expr(&lookup.multiplicity, &values).as_canonical_u64(),
+      )?;
+      for argument in &lookup.args {
+        write_u64(out, eval_expr(argument, &values).as_canonical_u64())?;
+      }
+    }
+  }
+  Ok(())
+}
+
+#[test]
+fn byte_gadget_snapshot() -> io::Result<()> {
+  let mut out = Vec::new();
+  out.write_all(b"Aiur byte gadgets v1\n")?;
+  export(&Bytes1, &mut out)?;
+  export(&Bytes2, &mut out)?;
+  assert_eq!(out.len(), 34_664_621, "complete row and lookup inventory");
+  if let Some(path) = std::env::var_os("IX_BYTE_GADGET_SNAPSHOT") {
+    let mut file = BufWriter::new(File::create(path)?);
+    file.write_all(&out)?;
+    file.flush()?;
+  }
+  Ok(())
+}
+
+#[test]
+fn emitted_virtual_byte_carries_match_all_input_pairs() {
+  for addition in [true, false] {
+    let op = if addition { Op::U8Add(0, 1) } else { Op::U8Sub(0, 1) };
+    let top = with_singleton_circuits(
+      vec![Function {
+        body: Block { ops: vec![op], ctrl: Ctrl::Return(0, vec![2, 3]) },
+        layout: FunctionLayout {
+          input_size: 2,
+          selectors: 1,
+          auxiliaries: 8,
+          lookups: 5,
+        },
+        entry: true,
+        constrained: true,
+      }],
+      vec![],
+    );
+    let (constraints, lookups) = top.build_constraints(0);
+    assert_eq!(constraints.width, 11);
+    let mut row = vec![G::ZERO; constraints.width];
+    row[2] = G::ONE;
+    row[3] = G::ONE;
+    for x in 0..=u8::MAX {
+      for y in 0..=u8::MAX {
+        let (low, carry) =
+          if addition { x.overflowing_add(y) } else { x.overflowing_sub(y) };
+        row[0] = G::from_u8(x);
+        row[1] = G::from_u8(y);
+        row[10] = G::from_u8(low);
+        let values = local_values(&row);
+        assert_eq!(eval_expr(&lookups[0].args[4], &values), G::from_u8(low));
+        assert_eq!(
+          eval_expr(&lookups[0].args[5], &values),
+          G::from_bool(carry),
+          "addition {addition}, x {x}, y {y}"
+        );
+      }
+    }
+  }
+}
+
+#[test]
+fn supplied_u32_comparison_checks_carries_decomposition_and_range() {
+  let top = with_singleton_circuits(
+    vec![Function {
+      body: Block {
+        ops: vec![Op::U32LessThan(0, 1)],
+        ctrl: Ctrl::Return(0, vec![2]),
+      },
+      layout: FunctionLayout {
+        input_size: 2,
+        selectors: 1,
+        auxiliaries: 19,
+        lookups: 10,
+      },
+      entry: true,
+      constrained: true,
+    }],
+    vec![],
+  );
+  let (constraints, lookups) = top.build_constraints(0);
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(top, cp, fp);
+  let honest = [
+    (0u32, 0u32),
+    (0, 1),
+    (1, 0),
+    (u32::MAX, u32::MAX),
+    (u32::MAX, 0),
+    (0, u32::MAX),
+    (256, 255),
+  ];
+  // Kind 0 is honest; mutations 1, 2 and 3 isolate carry, decomposition
+  // and byte-range constraints while keeping the public return message.
+  let cases = honest.into_iter().map(|(x, z)| (x, z, 0)).chain([
+    (0, 1, 1),
+    (0, 1, 2),
+    (0, 1, 3),
+  ]);
+  for (x, z, mutation) in cases {
+    let y = z.wrapping_sub(x).wrapping_sub(1);
+    let mut row = vec![G::ZERO; constraints.width];
+    row[0] = G::from_u32(x);
+    row[1] = G::from_u32(z);
+    row[2] = G::ONE;
+    row[3] = G::ONE;
+    for (slot, byte) in row[10..].iter_mut().zip(
+      x.to_le_bytes().into_iter().chain(y.to_le_bytes()).chain(z.to_le_bytes()),
+    ) {
+      *slot = G::from_u8(byte);
+    }
+    match mutation {
+      1 => row[14] = G::ONE,
+      2 => row[0] = G::from_u8(2),
+      3 => row[14..18].copy_from_slice(&[
+        G::from_u16(256),
+        G::from_u8(255),
+        G::from_u8(255),
+        G::from_u8(255),
+      ]),
+      _ => (),
+    }
+    let values = local_values(&row);
+    let output = eval_expr(&lookups[0].args[4], &values);
+    assert_eq!(
+      constraints.zeros.iter().all(|e| eval_expr(e, &values) == G::ZERO),
+      mutation == 0 || mutation == 3
+    );
+    if mutation == 0 {
+      assert_eq!(output, G::from_bool(x < z));
+    } else if mutation == 2 {
+      assert_eq!(output, G::ONE, "forged 2 < 1");
+    } else if mutation == 3 {
+      assert_eq!(output, G::ZERO, "forged 0 >= 1 with out-of-range byte");
+    }
+    let claim = [function_channel(), G::ZERO, row[0], row[1], output];
+    let traces = system
+      .circuit_shapes()
+      .iter()
+      .enumerate()
+      .map(|(index, shape)| {
+        let height = if index == 0 { 4 } else { shape.preprocessed_height };
+        let mut rows = vec![G::ZERO; height * shape.main_width];
+        if index == 0 {
+          rows[..row.len()].copy_from_slice(&row);
+        } else if index == 2 {
+          rows[6] = G::from_u8(3);
+          for pair in row[10..].as_chunks::<2>().0 {
+            let first = pair[0].as_canonical_u64();
+            let second = pair[1].as_canonical_u64();
+            if first < 256 && second < 256 {
+              let index = usize::try_from(first * 256 + second).unwrap();
+              rows[index * shape.main_width + 6] += G::ONE;
+            }
+          }
+        }
+        RowMajorMatrix::new(rows, shape.main_width)
+      })
+      .collect();
+    let witness = SystemWitness::from_stage_1(traces, &system.system);
+    let proof = system.system.prove(&system.key, &claim, witness);
+    assert_eq!(
+      system.verify(&claim, &proof).is_ok(),
+      mutation == 0,
+      "x {x}, z {z}, mutation {mutation}"
+    );
+  }
+}
diff --git a/crates/aiur/src/synthesis/tests/byte_shapes.rs b/crates/aiur/src/synthesis/tests/byte_shapes.rs
new file mode 100644
index 000000000..75a4ef945
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/byte_shapes.rs
@@ -0,0 +1,152 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+
+fn fixed(heights: &[usize], active: &[bool], degrees: &[u8]) -> bool {
+  fixed_trace_heights(heights.iter().copied(), active, degrees)
+}
+
+#[test]
+fn fixed_heights_follow_active_positions_and_require_fixed_tables() {
+  assert!(fixed(&[], &[], &[]));
+  assert!(fixed(&[0, 0], &[false, false], &[]));
+  assert!(fixed(&[0, 256, 0, 65536], &[true, true, false, true], &[3, 8, 16]));
+  assert!(fixed(&[0, 256, 0, 65536], &[false, true, false, true], &[8, 16]));
+  // The separate global budget guard bounds unfixed circuit degrees.
+  assert!(fixed(&[0], &[true], &[255]));
+  for (heights, active, degrees) in [
+    (vec![256, 65536], vec![false, false], vec![]),
+    (vec![], vec![false], vec![]),
+    (vec![256], vec![], vec![]),
+    (vec![256], vec![true], vec![]),
+    (vec![256], vec![false], vec![8]),
+    (vec![256], vec![true], vec![7]),
+    (vec![256], vec![true], vec![9]),
+    (vec![65536], vec![true], vec![15]),
+    (vec![65536], vec![true], vec![17]),
+    (vec![256, 65536], vec![true, true], vec![16, 8]),
+    (vec![256, 65536], vec![false, true], vec![8, 16]),
+    (vec![usize::MAX], vec![true], vec![255]),
+  ] {
+    assert!(!fixed(&heights, &active, &degrees));
+  }
+}
+
+/// All degree bytes, non-power-of-two heights, inactive positions and
+/// independently malformed sequence lengths match the total Lean guard.
+#[cfg(target_pointer_width = "64")]
+#[test]
+fn fixed_trace_height_snapshot() -> std::io::Result<()> {
+  let header = b"Aiur fixed trace heights v1\n";
+  let mut out = header.to_vec();
+  for height in [0, 1, 2, 3, 256, 65536, 1 << 31, 1 << 32, 1 << 63, usize::MAX]
+  {
+    for degree in 0..=255 {
+      out.push(u8::from(fixed(&[height], &[true], &[degree])));
+      out.push(u8::from(fixed(
+        &[0, height, 0],
+        &[false, true, false],
+        &[degree],
+      )));
+      out.push(u8::from(fixed(
+        &[0, height, 65536],
+        &[true, true, true],
+        &[2, degree, 16],
+      )));
+    }
+  }
+  let heights = [0, 256, 0, 65536];
+  for height_count in 0..=4 {
+    for active_count in 0..=4 {
+      for mask in 0..(1 << active_count) {
+        let active = (0..active_count)
+          .map(|bit| mask & (1 << bit) != 0)
+          .collect::<Vec<_>>();
+        for degree_count in 0..=5 {
+          for degree in [0, 1, 7, 8, 9, 15, 16, 17, 63, 64, 255] {
+            out.push(u8::from(fixed(
+              &heights[..height_count],
+              &active,
+              &vec![degree; degree_count],
+            )));
+          }
+        }
+      }
+    }
+  }
+  assert_eq!(out.len(), header.len() + 17_910);
+  if let Some(path) = std::env::var_os("IX_FIXED_TRACE_HEIGHT_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
+
+#[test]
+fn public_verify_checks_fixed_byte_heights_before_openings() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let (claim, mut proof) =
+    system.prove(0, &[G::ONE, G::ONE], &mut empty_io_buffer());
+  system.verify(&claim, &proof).unwrap();
+  let mut position = 0;
+  for (circuit, &active) in system.system.circuits.iter().zip(&proof.active) {
+    if active {
+      let original = proof.log_degrees[position];
+      if circuit.preprocessed_height != 0 {
+        for changed in [original - 1, original + 1] {
+          proof.log_degrees[position] = changed;
+          // The generic shape check has no direct fixed-height condition.
+          // Aiur must establish it before relying on fixed byte-table rows.
+          system.system.verify_shape(&proof).unwrap();
+          assert!(matches!(
+            system.verify(&claim, &proof),
+            Err(VerificationError::InvalidProofShape)
+          ));
+        }
+      }
+      proof.log_degrees[position] = original;
+      position += 1;
+    }
+  }
+  system.verify(&claim, &proof).unwrap();
+}
+
+#[test]
+fn public_verify_checks_fixed_byte_activity_before_openings() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let claim = [function_channel(), G::ZERO, G::ONE, G::ONE, G::ONE];
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(index, shape)| {
+      let height = if index == 0 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if index == 0 {
+        rows[..4].fill(G::ONE);
+        rows[10] = G::ONE;
+      } else if index == 2 {
+        rows[6] = G::from_u8(3);
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let mut witness = SystemWitness::from_stage_1(traces, &system.system);
+  // There are no unary-byte queries. The generic shape check permits
+  // omission, but the PCS rejects a matrix without opening points. Aiur
+  // makes the required activity explicit before entering that verifier.
+  witness.traces[1].values.clear();
+  witness.lookups[1] =
+    multi_stark::lookup::LookupValues::builder(0, &system.slot_arg_widths(1))
+      .finish();
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert_eq!(proof.active, vec![true, false, true]);
+  assert_eq!(proof.log_degrees, vec![2, 16]);
+  system.system.verify_shape(&proof).unwrap();
+  assert!(matches!(
+    system.verify(&claim, &proof),
+    Err(VerificationError::InvalidProofShape)
+  ));
+}
diff --git a/crates/aiur/src/synthesis/tests/call_order.rs b/crates/aiur/src/synthesis/tests/call_order.rs
new file mode 100644
index 000000000..d005e3fcc
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/call_order.rs
@@ -0,0 +1,396 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+use crate::call_order::{RANK_BOUND, RANK_BYTES, RankRanges};
+use multi_stark::eval::{VarValues, eval_expr};
+
+fn cycle_toplevel(grouped: bool) -> Toplevel {
+  // Public f calls g; g and h call each other without a base case.
+  let functions = [1, 2, 1]
+    .into_iter()
+    .enumerate()
+    .map(|(i, callee)| Function {
+      body: Block {
+        ops: vec![Op::Call(callee, vec![0], 1, false)],
+        ctrl: Ctrl::Return(0, vec![1]),
+      },
+      layout: FunctionLayout {
+        input_size: 1,
+        selectors: 1,
+        auxiliaries: 15,
+        lookups: 8,
+      },
+      entry: i == 0,
+      constrained: true,
+    })
+    .collect();
+  let mut top = with_singleton_circuits(functions, vec![]);
+  if grouped {
+    top.circuits.truncate(1);
+    top.circuits.push(crate::bytecode::Circuit {
+      members: vec![1, 2],
+      layout: FunctionLayout {
+        input_size: 1,
+        selectors: 2,
+        auxiliaries: 15,
+        lookups: 8,
+      },
+    });
+  }
+  top
+}
+
+fn fill_bytes(row: &mut [G], value: u64, ranges: &mut RankRanges) {
+  assert!(value < RANK_BOUND);
+  let bytes = value.to_le_bytes();
+  for (field, byte) in row.iter_mut().zip(&bytes[..RANK_BYTES]) {
+    *field = G::from_u8(*byte);
+  }
+  for pair in bytes[..RANK_BYTES].as_chunks::<2>().0 {
+    *ranges.entry([pair[0], pair[1]]).or_insert(G::ZERO) += G::ONE;
+  }
+}
+
+fn row_values(row: &[G]) -> VarValues<'_, G> {
+  VarValues {
+    preprocessed: [&[], &[]],
+    main: [row, row],
+    stage2: [&[], &[]],
+    publics: &[],
+    is_first_row: G::ONE,
+    is_last_row: G::ZERO,
+    is_transition: G::ONE,
+  }
+}
+
+fn normalized(mut args: Vec<G>) -> Vec<G> {
+  while args.last() == Some(&G::ZERO) {
+    args.pop();
+  }
+  args
+}
+
+/// Verify exact tuple balance independently of random lookup compression.
+fn assert_lookup_balance(
+  top: &Toplevel,
+  traces: &[RowMajorMatrix<G>],
+  ranges: &RankRanges,
+  claim: &[G],
+) {
+  let mut balance = FxHashMap::<Vec<G>, G>::default();
+  *balance.entry(normalized(claim.to_vec())).or_insert(G::ZERO) += G::ONE;
+  for (i, circuit) in top.circuits.iter().enumerate() {
+    let (_, lookups) = top.build_constraints(i);
+    for row in traces[i].values.chunks_exact(circuit.layout.width()) {
+      let values = row_values(row);
+      for lookup in &lookups {
+        let args =
+          lookup.args.iter().map(|arg| eval_expr(arg, &values)).collect();
+        *balance.entry(normalized(args)).or_insert(G::ZERO) +=
+          eval_expr(&lookup.multiplicity, &values);
+      }
+    }
+  }
+  for ([a, b], count) in ranges {
+    *balance
+      .entry(normalized(vec![
+        crate::u8_range_check_channel(),
+        G::from_u8(*a),
+        G::from_u8(*b),
+      ]))
+      .or_insert(G::ZERO) -= *count;
+  }
+  assert!(
+    balance.values().all(|count| *count == G::ZERO),
+    "unbalanced supplied witness"
+  );
+}
+
+#[test]
+fn mutual_cycles_reject_with_balanced_lookups_in_both_partitions() {
+  for grouped in [false, true] {
+    let (cp, fp) = test_parameters();
+    let system = AiurSystem::build(cycle_toplevel(grouped), cp, fp);
+    let input = G::from_u8(3);
+    let output = G::from_u8(7);
+    let claim = vec![function_channel(), G::ZERO, input, output];
+    let mut ranges = RankRanges::default();
+    let mut traces = Vec::new();
+    let mut violated = 0;
+    for (i, shape) in system.circuit_shapes().iter().enumerate() {
+      let is_function = i < system.toplevel.circuits.len();
+      let height = if is_function { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if is_function {
+        let circuit = &system.toplevel.circuits[i];
+        let (constraints, _) = system.toplevel.build_constraints(i);
+        for (offset, &member) in circuit.members.iter().enumerate() {
+          let row = &mut rows
+            [offset * shape.main_width..(offset + 1) * shape.main_width];
+          row[0] = input;
+          row[1 + offset] = G::ONE;
+          let aux = 1 + circuit.layout.selectors;
+          row[aux] = if member == 1 { G::from_u8(2) } else { G::ONE };
+          fill_bytes(&mut row[aux + 1..aux + 7], member as u64, &mut ranges);
+          row[aux + 7] = output;
+          row[aux + 8] =
+            G::from_usize(if member == 2 { 1 } else { member + 1 });
+          let gap = if member == 2 { RANK_BOUND - 2 } else { 0 };
+          fill_bytes(&mut row[aux + 9..aux + 15], gap, &mut ranges);
+          violated += constraints
+            .zeros
+            .iter()
+            .filter(|expr| eval_expr(expr, &row_values(row)) != G::ZERO)
+            .count();
+        }
+      } else if i == system.toplevel.circuits.len() + 1 {
+        // Bytes2 is the last circuit (there are no memories).
+        for ([a, b], count) in &ranges {
+          rows[(256 * usize::from(*a) + usize::from(*b)) * shape.main_width
+            + 6] = *count;
+        }
+      }
+      traces.push(RowMajorMatrix::new(rows, shape.main_width));
+    }
+    assert_eq!(
+      violated, 1,
+      "only the closing h -> g call should violate a polynomial"
+    );
+    assert_lookup_balance(&system.toplevel, &traces, &ranges, &claim);
+    let witness = SystemWitness::from_stage_1(traces, &system.system);
+    let proof = system.system.prove(&system.key, &claim, witness);
+    assert!(
+      system.verify(&claim, &proof).is_err(),
+      "cyclic return accepted (grouped={grouped})"
+    );
+  }
+}
+
+#[test]
+fn call_order_polynomial_checks_strict_unsigned_order() {
+  let top = cycle_toplevel(false);
+  let (constraints, _) = top.build_constraints(0);
+  for (parent, child, gap, accepted) in [
+    (0, 1, 0, true),
+    (0, RANK_BOUND - 1, RANK_BOUND - 2, true),
+    (RANK_BOUND - 2, RANK_BOUND - 1, 0, true),
+    (0, 0, 0, false),
+    (1, 0, RANK_BOUND - 2, false),
+    (RANK_BOUND - 1, 0, 0, false),
+  ] {
+    let mut row = vec![G::ZERO; constraints.width];
+    let mut ranges = RankRanges::default();
+    row[1] = G::ONE;
+    row[2] = G::ONE;
+    fill_bytes(&mut row[3..9], parent, &mut ranges);
+    row[10] = G::from_u64(child);
+    fill_bytes(&mut row[11..17], gap, &mut ranges);
+    let satisfied = constraints
+      .zeros
+      .iter()
+      .all(|expr| eval_expr(expr, &row_values(&row)) == G::ZERO);
+    assert_eq!(satisfied, accepted, "ranks {parent} -> {child}, gap {gap}");
+  }
+}
+
+#[test]
+fn out_of_range_gaps_cannot_hide_a_cycle_in_field_arithmetic() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(cycle_toplevel(false), cp, fp);
+  let claim = vec![function_channel(), G::ZERO, G::from_u8(3), G::from_u8(7)];
+  let traces =
+    system
+      .circuit_shapes()
+      .iter()
+      .enumerate()
+      .map(|(i, shape)| {
+        let mut rows = vec![
+          G::ZERO;
+          if i < 3 {
+            4 * shape.main_width
+          } else {
+            shape.preprocessed_height * shape.main_width
+          }
+        ];
+        if i < 3 {
+          rows[0] = claim[2];
+          rows[1] = G::ONE;
+          rows[2] = G::from_u8(if i == 1 { 2 } else { 1 });
+          rows[9] = claim[3];
+          // All ranks are zero. A forged "byte" -1 makes 0 - 0 - 1 - gap
+          // vanish as a field expression, but cannot pass the byte table.
+          rows[11] = -G::ONE;
+          let (constraints, _) = system.toplevel.build_constraints(i);
+          assert!(constraints.zeros.iter().all(|expr| eval_expr(
+            expr,
+            &row_values(&rows[..shape.main_width])
+          ) == G::ZERO));
+        } else if i == 4 {
+          // Five valid zero-byte pairs per function, plus one impossible
+          // (-1, 0) pair. Supply every valid pair and no fabricated table row.
+          rows[6] = G::from_u8(15);
+        }
+        RowMajorMatrix::new(rows, shape.main_width)
+      })
+      .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert!(
+    system.verify(&claim, &proof).is_err(),
+    "unbounded gap allowed cyclic justification"
+  );
+}
+
+#[test]
+fn out_of_range_function_rank_is_rejected_by_the_byte_table() {
+  let mut top = cycle_toplevel(false);
+  top.functions.truncate(2);
+  top.circuits.truncate(2);
+  top.functions[1].body = Block {
+    ops: vec![Op::Const(G::from_u8(7))],
+    ctrl: Ctrl::Return(0, vec![1]),
+  };
+  top.functions[1].layout.auxiliaries = 7;
+  top.functions[1].layout.lookups = 4;
+  top.circuits[1].layout = top.functions[1].layout;
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(top, cp, fp);
+  let claim = vec![function_channel(), G::ZERO, G::from_u8(3), G::from_u8(7)];
+  let traces =
+    system
+      .circuit_shapes()
+      .iter()
+      .enumerate()
+      .map(|(i, shape)| {
+        let mut rows = vec![
+          G::ZERO;
+          if i < 2 {
+            4 * shape.main_width
+          } else {
+            shape.preprocessed_height * shape.main_width
+          }
+        ];
+        if i < 2 {
+          rows[0] = claim[2];
+          rows[1] = G::ONE;
+          rows[2] = G::ONE;
+          if i == 0 {
+            rows[9] = claim[3];
+            rows[10] = G::from_u64(RANK_BOUND);
+            rows[11..17].fill(G::from_u8(255));
+          } else {
+            // 256 in the high byte packs to 2^48. The edge's field equality
+            // and all ordinary constraints hold; the rank range check must fail.
+            rows[8] = G::from_u64(256);
+          }
+          let (constraints, _) = system.toplevel.build_constraints(i);
+          assert!(constraints.zeros.iter().all(|expr| eval_expr(
+            expr,
+            &row_values(&rows[..shape.main_width])
+          ) == G::ZERO));
+        } else if i == 3 {
+          rows[6] = G::from_u8(5);
+          rows[(256 * 255 + 255) * shape.main_width + 6] = G::from_u8(3);
+        }
+        RowMajorMatrix::new(rows, shape.main_width)
+      })
+      .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert!(
+    system.verify(&claim, &proof).is_err(),
+    "unbounded function rank accepted"
+  );
+}
+
+#[test]
+fn finite_recursive_calls_verify() {
+  let base = Block {
+    ops: vec![Op::Const(G::from_u8(7))],
+    ctrl: Ctrl::Return(0, vec![1]),
+  };
+  let step = Block {
+    ops: vec![Op::Const(G::ONE), Op::Sub(0, 1), Op::Call(0, vec![2], 1, false)],
+    ctrl: Ctrl::Return(1, vec![3]),
+  };
+  let function = Function {
+    body: Block {
+      ops: vec![],
+      ctrl: Ctrl::Match(
+        0,
+        [(G::ZERO, base)].into_iter().collect(),
+        Some(Box::new(step)),
+      ),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 2,
+      auxiliaries: 16,
+      lookups: 8,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let (cp, fp) = test_parameters();
+  let system =
+    AiurSystem::build(with_singleton_circuits(vec![function], vec![]), cp, fp);
+  for n in [0, 1, 7] {
+    let (claim, proof) =
+      system.prove(0, &[G::from_u8(n)], &mut empty_io_buffer());
+    assert_eq!(
+      claim,
+      vec![function_channel(), G::ZERO, G::from_u8(n), G::from_u8(7)]
+    );
+    system.verify(&claim, &proof).expect("finite recursion must verify");
+  }
+}
+
+#[test]
+fn shared_callee_keeps_one_consistent_rank() {
+  let root = Function {
+    body: Block {
+      ops: vec![
+        Op::Call(1, vec![0], 1, false),
+        Op::Call(1, vec![0], 1, false),
+        Op::Add(1, 2),
+      ],
+      ctrl: Ctrl::Return(0, vec![3]),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 23,
+      lookups: 12,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let leaf = Function {
+    body: Block {
+      ops: vec![Op::Const(G::ONE), Op::Add(0, 1)],
+      ctrl: Ctrl::Return(0, vec![2]),
+    },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 7,
+      lookups: 4,
+    },
+    entry: false,
+    constrained: true,
+  };
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(
+    with_singleton_circuits(vec![root, leaf], vec![]),
+    cp,
+    fp,
+  );
+  let (claim, proof) =
+    system.prove(0, &[G::from_u8(3)], &mut empty_io_buffer());
+  assert_eq!(
+    claim,
+    vec![function_channel(), G::ZERO, G::from_u8(3), G::from_u8(8)]
+  );
+  system.verify(&claim, &proof).expect("shared callee must verify");
+}
diff --git a/crates/aiur/src/synthesis/tests/constant_degree.rs b/crates/aiur/src/synthesis/tests/constant_degree.rs
new file mode 100644
index 000000000..346d12aa6
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/constant_degree.rs
@@ -0,0 +1,37 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+
+fn folded_zero_toplevel() -> Toplevel {
+  with_singleton_circuits(
+    vec![Function {
+      body: Block {
+        ops: vec![Op::Const(G::ZERO), Op::Mul(1, 0), Op::EqZero(2)],
+        ctrl: Ctrl::Return(0, vec![3]),
+      },
+      // The compiler and witness builder retain the conservative product
+      // degree 1, so EqZero reserves two auxiliary columns.
+      layout: FunctionLayout {
+        input_size: 1,
+        selectors: 1,
+        auxiliaries: 9,
+        lookups: 4,
+      },
+      entry: true,
+      constrained: true,
+    }],
+    vec![],
+  )
+}
+
+#[test]
+fn folded_zero_product_can_be_tested_for_zero() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(folded_zero_toplevel(), cp, fp);
+  for input in [G::ZERO, G::ONE, G::from_u64(17), -G::ONE] {
+    let (claim, proof) = system.prove(0, &[input], &mut empty_io_buffer());
+    assert_eq!(claim, vec![function_channel(), G::ZERO, input, G::ONE]);
+    system.verify(&claim, &proof).unwrap();
+  }
+}
diff --git a/crates/aiur/src/synthesis/tests/extension_mmcs.rs b/crates/aiur/src/synthesis/tests/extension_mmcs.rs
new file mode 100644
index 000000000..27f2a11b4
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/extension_mmcs.rs
@@ -0,0 +1,364 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Actual extension MMCS delegation, coordinate order and machine widths.
+
+use super::merkle::{
+  Calls, Digest, RecordingHash, RecordingMmcs, digests, number,
+};
+use super::*;
+use multi_stark::{
+  p3_field::{BasedVectorSpace, PrimeField64},
+  p3_matrix::{Dimensions, Matrix},
+  types::{ExtMmcs, ExtVal, Mmcs},
+};
+use p3_blake3::Blake3;
+use p3_commit::{BatchOpeningRef, ExtensionMmcs, Mmcs as _};
+use p3_merkle_tree::PrunedMerklePaths;
+use p3_symmetric::{
+  CompressionFunctionFromHasher, MerkleCap, SerializingHasher,
+};
+
+#[derive(Clone)]
+struct Case {
+  shared: bool,
+  dimensions: Vec<Dimensions>,
+  indices: Vec<usize>,
+  rows: Vec<Vec<Vec<ExtVal>>>,
+  proof: Vec<Digest>,
+  cap: Vec<Digest>,
+  cap_height: usize,
+}
+
+#[derive(Default)]
+struct Corpus {
+  body: Vec<u8>,
+  count: usize,
+  shared: usize,
+  accepted: usize,
+  omitted: usize,
+  overflow: usize,
+  late: usize,
+  calls: usize,
+}
+
+impl Corpus {
+  fn record(&mut self, case: &Case, expected: Option<bool>) {
+    let base = Mmcs::new(
+      SerializingHasher::new(Blake3),
+      CompressionFunctionFromHasher::new(Blake3),
+      case.cap_height,
+    );
+    let native = ExtMmcs::new(base.clone());
+    let cap = MerkleCap::new(case.cap.clone());
+    let proof = PrunedMerklePaths { sibling_hashes: case.proof.clone() };
+    let accepted = if case.shared {
+      native.verify_multi_batch(
+        &cap,
+        &case.dimensions,
+        &case.indices,
+        &case.rows,
+        &proof,
+      )
+    } else {
+      native.verify_batch(
+        &cap,
+        &case.dimensions,
+        case.indices[0],
+        BatchOpeningRef::new(&case.rows[0], &case.proof),
+      )
+    }
+    .is_ok();
+    if let Some(expected) = expected {
+      assert_eq!(accepted, expected);
+    }
+    let dimensions: Vec<_> = case
+      .dimensions
+      .iter()
+      .map(|dim| Dimensions {
+        width: dim.width.wrapping_mul(2),
+        height: dim.height,
+      })
+      .collect();
+    let rows: Vec<Vec<Vec<G>>> = case
+      .rows
+      .iter()
+      .map(|rows| rows.iter().cloned().map(ExtVal::flatten_to_base).collect())
+      .collect();
+    let delegated = if case.shared {
+      base.verify_multi_batch(&cap, &dimensions, &case.indices, &rows, &proof)
+    } else {
+      base.verify_batch(
+        &cap,
+        &dimensions,
+        case.indices[0],
+        BatchOpeningRef::new(&rows[0], &case.proof),
+      )
+    }
+    .is_ok();
+    assert_eq!(accepted, delegated);
+    let calls = Calls::default();
+    let hash = RecordingHash(calls.clone());
+    let recording = ExtensionMmcs::<G, ExtVal, _>::new(RecordingMmcs::new(
+      SerializingHasher::new(hash.clone()),
+      CompressionFunctionFromHasher::new(hash),
+      case.cap_height,
+    ));
+    let recorded = if case.shared {
+      recording.verify_multi_batch(
+        &cap,
+        &case.dimensions,
+        &case.indices,
+        &case.rows,
+        &proof,
+      )
+    } else {
+      recording.verify_batch(
+        &cap,
+        &case.dimensions,
+        case.indices[0],
+        BatchOpeningRef::new(&case.rows[0], &case.proof),
+      )
+    }
+    .is_ok();
+    assert_eq!(accepted, recorded);
+    let calls = calls.lock().unwrap();
+    let degrees: Vec<u8> = case
+      .dimensions
+      .iter()
+      .map(|dim| u8::try_from(dim.height.ilog2()).unwrap())
+      .collect();
+    let covered =
+      crate::trace_heights::trace_cap_coverage(0, case.cap_height, &degrees);
+    let widths_fit =
+      case.dimensions.iter().all(|dim| dim.width.checked_mul(2).is_some());
+    self.count += 1;
+    self.shared += usize::from(case.shared);
+    self.accepted += usize::from(accepted);
+    self.omitted += usize::from(accepted && !covered);
+    self.overflow += usize::from(!widths_fit);
+    self.late += usize::from(!accepted && !calls.is_empty());
+    self.calls += calls.len();
+    let out = &mut self.body;
+    out.push(u8::from(case.shared));
+    number(out, case.dimensions.len());
+    for dim in &case.dimensions {
+      number(out, dim.width);
+      number(out, usize::try_from(dim.height.ilog2()).unwrap());
+    }
+    number(out, case.cap_height);
+    number(out, case.indices.len());
+    for &index in &case.indices {
+      number(out, index);
+    }
+    number(out, case.rows.len());
+    for rows in &case.rows {
+      number(out, rows.len());
+      for row in rows {
+        number(out, row.len());
+        for value in row {
+          let coordinates: &[G] = value.as_basis_coefficients_slice();
+          for coordinate in coordinates {
+            out.extend(coordinate.as_canonical_u64().to_le_bytes());
+          }
+        }
+      }
+    }
+    digests(out, &case.proof);
+    digests(out, &case.cap);
+    out.extend([u8::from(accepted), u8::from(covered), u8::from(widths_fit)]);
+    number(out, calls.len());
+    for (input, digest) in calls.iter() {
+      number(out, input.len());
+      out.extend(input);
+      out.extend(digest);
+    }
+  }
+
+  fn mutations(&mut self, case: &Case, logs: &[usize]) {
+    self.record(case, Some(true));
+    let mut changed = case.clone();
+    changed.proof.push([0; 32]);
+    self.record(&changed, Some(false));
+    let mut changed = case.clone();
+    changed.dimensions.clear();
+    self.record(&changed, Some(false));
+    if case.shared {
+      let mut changed = case.clone();
+      changed.rows.push(vec![]);
+      self.record(&changed, Some(false));
+    }
+    if case.indices.is_empty() {
+      return;
+    }
+    let max_log = *logs.iter().max().unwrap();
+    for (matrix, &log) in logs.iter().enumerate() {
+      let omitted = log < case.cap_height.min(max_log);
+      for increment in [ExtVal::ONE, ExtVal::new([G::ZERO, G::ONE])] {
+        let mut changed = case.clone();
+        for query in &mut changed.rows {
+          query[matrix][0] += increment;
+        }
+        self.record(&changed, Some(omitted));
+        if case.shared {
+          let mut changed = case.clone();
+          changed.rows[0][matrix][0] += increment;
+          self.record(&changed, if omitted { None } else { Some(false) });
+        }
+      }
+    }
+    if !case.proof.is_empty() {
+      let mut changed = case.clone();
+      changed.proof.pop();
+      self.record(&changed, Some(false));
+      let mut changed = case.clone();
+      changed.proof[0][0] ^= 1;
+      self.record(&changed, Some(false));
+    }
+    let mut changed = case.clone();
+    changed.dimensions[0].width += 1;
+    self.record(&changed, Some(false));
+    let mut changed = case.clone();
+    changed.indices[0] = 1 << max_log;
+    self.record(&changed, Some(false));
+    let mut changed = case.clone();
+    changed.cap[0][0] ^= 1;
+    self.record(&changed, None);
+    let mut changed = case.clone();
+    changed.cap.truncate(1);
+    self.record(&changed, None);
+    let mut changed = case.clone();
+    changed.rows[0].pop();
+    self.record(&changed, Some(false));
+    // The adapter multiplies verifier metadata using release usize arithmetic.
+    // Exercise the wrap explicitly; debug builds instead check overflow.
+    if !cfg!(debug_assertions) {
+      let mut changed = case.clone();
+      changed.dimensions[0].width += 1usize << (usize::BITS - 1);
+      self.record(&changed, Some(true));
+    }
+  }
+}
+
+#[test]
+fn extension_mmcs_snapshot() -> std::io::Result<()> {
+  let shapes = [
+    vec![0],
+    vec![1],
+    vec![3],
+    vec![5],
+    vec![3, 1],
+    vec![1, 3],
+    vec![3, 0, 2, 1],
+    vec![2, 2, 2],
+    vec![1, 4, 1, 4, 0],
+  ];
+  let widths = [1, 2, 3, 9, 17, 65];
+  let mut corpus = Corpus::default();
+  for (fixture, logs) in shapes.into_iter().enumerate() {
+    let max_log = *logs.iter().max().unwrap();
+    let height = 1 << max_log;
+    let matrices: Vec<_> = logs
+      .iter()
+      .enumerate()
+      .map(|(matrix, log)| {
+        let width = widths[(fixture + matrix * 3) % widths.len()];
+        let values = (0..width * (1 << log))
+          .map(|i| {
+            ExtVal::new([
+              G::from_u64(u64::try_from(i * 65537 + fixture).unwrap()),
+              if i % 3 == 0 {
+                -G::ONE
+              } else {
+                G::from_u64(u64::try_from(i * 257 + matrix + 1).unwrap())
+              },
+            ])
+          })
+          .collect();
+        RowMajorMatrix::new(values, width)
+      })
+      .collect();
+    let dimensions: Vec<_> = matrices.iter().map(Matrix::dimensions).collect();
+    let flat_matrices: Vec<_> = matrices
+      .iter()
+      .map(|matrix| {
+        RowMajorMatrix::new(
+          ExtVal::flatten_to_base(matrix.values.clone()),
+          matrix.width * 2,
+        )
+      })
+      .collect();
+    let queries = [
+      vec![],
+      vec![0],
+      vec![height - 1],
+      (0..height).rev().collect(),
+      (0..height).step_by(2).collect(),
+      (1..height).step_by(2).collect(),
+      vec![height - 1, 0, height / 2, height - 1, 0],
+      vec![0, (2 % height)],
+    ];
+    for cap_height in 0..=max_log + 2 {
+      let base = Mmcs::new(
+        SerializingHasher::new(Blake3),
+        CompressionFunctionFromHasher::new(Blake3),
+        cap_height,
+      );
+      let mmcs = ExtMmcs::new(base.clone());
+      let (cap, data) = mmcs.commit(matrices.clone());
+      let (base_cap, _) = base.commit(flat_matrices.clone());
+      assert_eq!(cap, base_cap);
+      for index in [0, height / 2, height - 1] {
+        let (rows, proof) = mmcs.open_batch(index, &data).unpack();
+        corpus.mutations(
+          &Case {
+            shared: false,
+            dimensions: dimensions.clone(),
+            indices: vec![index],
+            rows: vec![rows],
+            proof,
+            cap: cap.roots().to_vec(),
+            cap_height,
+          },
+          &logs,
+        );
+      }
+      for indices in &queries {
+        let (rows, proof) = mmcs.open_multi_batch(indices, &data);
+        corpus.mutations(
+          &Case {
+            shared: true,
+            dimensions: dimensions.clone(),
+            indices: indices.clone(),
+            rows,
+            proof: proof.sibling_hashes,
+            cap: cap.roots().to_vec(),
+            cap_height,
+          },
+          &logs,
+        );
+      }
+    }
+  }
+  let counts = [
+    corpus.count,
+    corpus.shared,
+    corpus.accepted,
+    corpus.omitted,
+    corpus.overflow,
+    corpus.late,
+    corpus.calls,
+  ];
+  assert!(corpus.count > 1000 && corpus.calls > 1000);
+  println!("Extension MMCS: {counts:?}");
+  let mut out = b"Aiur extension MMCS v1\n".to_vec();
+  number(&mut out, usize::BITS as usize);
+  for count in counts {
+    number(&mut out, count);
+  }
+  out.extend(corpus.body);
+  if let Some(path) = std::env::var_os("IX_EXTENSION_MMCS_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/folding.rs b/crates/aiur/src/synthesis/tests/folding.rs
new file mode 100644
index 000000000..55af36f4f
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/folding.rs
@@ -0,0 +1,230 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Native FRI folds of global polynomials spanning several coefficient blocks.
+
+use multi_stark::{
+  p3_field::{
+    BasedVectorSpace, HornerIter, PrimeCharacteristicRing, PrimeField64,
+    TwoAdicField,
+  },
+  p3_matrix::dense::RowMajorMatrix,
+  types::{ExtVal, Val},
+};
+use p3_fri::{FriFoldingStrategy, TwoAdicFriFolding};
+use p3_util::reverse_bits_len;
+use std::{io, marker::PhantomData};
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  let coordinates: &[Val] = value.as_basis_coefficients_slice();
+  for &coordinate in coordinates {
+    out.extend(coordinate.as_canonical_u64().to_le_bytes());
+  }
+}
+
+fn extensions(out: &mut Vec<u8>, values: &[ExtVal]) {
+  nat(out, values.len());
+  for &value in values {
+    extension(out, value);
+  }
+}
+
+fn sample(seed: usize) -> ExtVal {
+  ExtVal::new([Val::from_usize(seed * 67 + 3), Val::from_usize(seed * 13 + 1)])
+}
+
+fn coefficients(arity: usize, variant: usize) -> Vec<ExtVal> {
+  let length = match variant {
+    0 => 0,
+    1 => 1,
+    2 => arity - 1,
+    3 => arity,
+    4 => arity + 1,
+    5 => 2 * arity + 1,
+    6 => 3 * arity,
+    _ => 3 * arity + 2,
+  };
+  (0..length)
+    .map(|index| match variant {
+      6 => {
+        if index + 1 == length {
+          ExtVal::ONE
+        } else {
+          ExtVal::ZERO
+        }
+      },
+      7 if index > arity => ExtVal::ZERO,
+      _ => sample(index + 17),
+    })
+    .collect()
+}
+
+fn query_point(bits: usize, index: usize) -> ExtVal {
+  Val::two_adic_generator(bits)
+    .exp_u64(u64::try_from(reverse_bits_len(index, bits)).unwrap())
+    .into()
+}
+
+fn nodes(parent: usize, log_arity: usize, index: usize) -> Vec<ExtVal> {
+  (0..1 << log_arity)
+    .map(|slot| query_point(parent, (index << log_arity) + slot))
+    .collect()
+}
+
+fn fold_row(
+  index: usize,
+  height: usize,
+  log_arity: usize,
+  challenge: ExtVal,
+  values: &[ExtVal],
+) -> ExtVal {
+  <TwoAdicFriFolding<(), ()> as FriFoldingStrategy<Val, ExtVal>>::fold_row(
+    &TwoAdicFriFolding(PhantomData),
+    index,
+    height,
+    log_arity,
+    challenge,
+    values.iter().copied(),
+  )
+}
+
+fn folded_coefficients(
+  coefficients: &[ExtVal],
+  arity: usize,
+  challenge: ExtVal,
+) -> Vec<ExtVal> {
+  coefficients
+    .chunks(arity)
+    .map(|block| block.iter().copied().horner(challenge))
+    .collect()
+}
+
+#[test]
+fn folding_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur global FRI folding v1\n".to_vec();
+  let mut rows = 0;
+  let mut evaluations = 0;
+  for parent in 0..=32 {
+    for log_arity in 0..=parent.min(6) {
+      let height = parent - log_arity;
+      let arity = 1 << log_arity;
+      let mask = (1_usize << height) - 1;
+      let mut indices = vec![0, mask / 2, mask];
+      indices.sort_unstable();
+      indices.dedup();
+      nat(&mut out, indices.len());
+      for index in indices {
+        nat(&mut out, index);
+        let nodes = nodes(parent, log_arity, index);
+        for variant in 0..8 {
+          let polynomial = coefficients(arity, variant);
+          let values: Vec<_> = nodes
+            .iter()
+            .map(|&node| polynomial.iter().copied().horner(node))
+            .collect();
+          extensions(&mut out, &polynomial);
+          extensions(&mut out, &values);
+          for challenge in
+            [ExtVal::ZERO, sample(41), ExtVal::ONE, nodes[0], nodes[arity - 1]]
+          {
+            let folded = folded_coefficients(&polynomial, arity, challenge);
+            let result = fold_row(index, height, log_arity, challenge, &values);
+            assert_eq!(
+              result,
+              folded.iter().copied().horner(query_point(height, index))
+            );
+            extension(&mut out, challenge);
+            extensions(&mut out, &folded);
+            extension(&mut out, result);
+            evaluations += 1;
+          }
+          rows += 1;
+        }
+      }
+    }
+  }
+  let mut matrices = 0;
+  let mut matrix_rows = 0;
+  for parent in 1..=9 {
+    for log_arity in 1..=parent.min(6) {
+      let arity = 1 << log_arity;
+      let height = parent - log_arity;
+      for variant in 0..8 {
+        let polynomial = coefficients(arity, variant);
+        let data: Vec<_> = (0..1 << parent)
+          .map(|index| {
+            polynomial.iter().copied().horner(query_point(parent, index))
+          })
+          .collect();
+        extensions(&mut out, &polynomial);
+        extensions(&mut out, &data);
+        for challenge in [ExtVal::ZERO, sample(41), ExtVal::ONE] {
+          let folded = folded_coefficients(&polynomial, arity, challenge);
+          let result = <TwoAdicFriFolding<(), ()> as FriFoldingStrategy<
+            Val,
+            ExtVal,
+          >>::fold_matrix(
+            &TwoAdicFriFolding(PhantomData),
+            challenge,
+            log_arity,
+            RowMajorMatrix::new(data.clone(), arity),
+          );
+          assert_eq!(result.len(), 1 << height);
+          for (index, &value) in result.iter().enumerate() {
+            assert_eq!(
+              value,
+              folded.iter().copied().horner(query_point(height, index))
+            );
+            matrix_rows += 1;
+          }
+          extension(&mut out, challenge);
+          extensions(&mut out, &folded);
+          extensions(&mut out, &result);
+          matrices += 1;
+        }
+      }
+    }
+  }
+  let mut pairs = 0;
+  let mut pair_evaluations = 0;
+  for log_arity in 0..=6 {
+    let arity = 1 << log_arity;
+    let parent = log_arity + 2;
+    let mut challenges = nodes(parent, log_arity, 1);
+    challenges.extend([ExtVal::ZERO, sample(41)]);
+    let left: Vec<_> = (0..arity).map(|index| sample(index + 7)).collect();
+    let mut right = left.clone();
+    right[arity / 2] += sample(131);
+    extensions(&mut out, &left);
+    extensions(&mut out, &right);
+    let mut agreements = 0;
+    for challenge in challenges {
+      let first = fold_row(1, 2, log_arity, challenge, &left);
+      let second = fold_row(1, 2, log_arity, challenge, &right);
+      agreements += usize::from(first == second);
+      extension(&mut out, challenge);
+      extension(&mut out, first);
+      extension(&mut out, second);
+      pair_evaluations += 1;
+    }
+    assert_eq!(agreements, arity - 1);
+    nat(&mut out, agreements);
+    pairs += 1;
+  }
+  for count in
+    [rows, evaluations, matrices, matrix_rows, pairs, pair_evaluations]
+  {
+    nat(&mut out, count);
+  }
+  if let Ok(path) = std::env::var("IX_FOLDING_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  println!(
+    "Global FRI folding: {rows} rows, {evaluations} evaluations, {matrices} matrices, {matrix_rows} matrix rows, {pairs} distinct row pairs, {pair_evaluations} pair evaluations"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/fri_domain.rs b/crates/aiur/src/synthesis/tests/fri_domain.rs
new file mode 100644
index 000000000..20ca63b1d
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/fri_domain.rs
@@ -0,0 +1,180 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Native bit reversal, FRI interpolation node selection and domain reduction.
+
+use multi_stark::{
+  p3_field::{
+    BasedVectorSpace, PrimeCharacteristicRing, PrimeField64, TwoAdicField,
+  },
+  types::{ExtVal, Val},
+};
+use p3_fri::{FriFoldingStrategy, TwoAdicFriFolding};
+use p3_util::{reverse_bits_len, reverse_slice_index_bits};
+use std::{io, marker::PhantomData};
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  let coordinates: &[Val] = value.as_basis_coefficients_slice();
+  for &coordinate in coordinates {
+    field(out, coordinate);
+  }
+}
+
+fn samples(bits: usize, exhaustive: usize) -> Vec<usize> {
+  let mask =
+    if bits == 0 { 0 } else { usize::MAX >> (usize::BITS as usize - bits) };
+  let mut indices: Vec<_> = (0..=mask.min(exhaustive - 1)).collect();
+  indices.extend([mask, mask / 2, mask.saturating_sub(1)]);
+  for seed in 0..16_usize {
+    indices.push(seed.wrapping_mul(0x0a37_51c9) & mask);
+  }
+  indices.sort_unstable();
+  indices.dedup();
+  indices
+}
+
+#[test]
+fn fri_domain_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur FRI domains v1\n".to_vec();
+  let word_bits = usize::BITS as usize;
+  assert!(word_bits == 32 || word_bits == 64);
+  nat(&mut out, word_bits);
+  let mut reversals = 0;
+  for bits in 0..=word_bits {
+    let indices = samples(bits, 1024);
+    nat(&mut out, indices.len());
+    for index in indices {
+      let reversed = reverse_bits_len(index, bits);
+      assert_eq!(reverse_bits_len(reversed, bits), index);
+      nat(&mut out, index);
+      nat(&mut out, reversed);
+      reversals += 1;
+    }
+  }
+  // Width zero is an overflowing shift, so an inadmissible nonzero index
+  // retains its full-word reverse. The correspondence theorem needs a bound.
+  nat(&mut out, reverse_bits_len(1, 0));
+  assert_eq!(reverse_bits_len(1, 0), 1 << (word_bits - 1));
+
+  let mut points = 0;
+  for bits in 0..=32 {
+    let generator = Val::two_adic_generator(bits);
+    let indices = samples(bits, 1024);
+    nat(&mut out, indices.len());
+    for index in indices {
+      let reversed = reverse_bits_len(index, bits);
+      let point = generator.exp_u64(u64::try_from(reversed).unwrap());
+      let input = Val::from_u64(7) * point;
+      assert_eq!(point.exp_power_of_2(bits), Val::ONE);
+      assert_ne!(input.exp_power_of_2(bits), Val::ONE);
+      nat(&mut out, index);
+      field(&mut out, point);
+      field(&mut out, input);
+      points += 1;
+    }
+  }
+
+  let mut nested = 0;
+  for parent in 0..=32 {
+    let generator = Val::two_adic_generator(parent);
+    for child in 0..=parent {
+      assert_eq!(
+        generator.exp_power_of_2(parent - child),
+        Val::two_adic_generator(child)
+      );
+      let indices = samples(child, 4);
+      nat(&mut out, indices.len());
+      for index in indices {
+        let padded = generator
+          .exp_u64(u64::try_from(reverse_bits_len(index, parent)).unwrap());
+        let reduced = Val::two_adic_generator(child)
+          .exp_u64(u64::try_from(reverse_bits_len(index, child)).unwrap());
+        assert_eq!(padded, reduced);
+        nat(&mut out, index);
+        field(&mut out, padded);
+        nested += 1;
+      }
+    }
+  }
+
+  let folding = TwoAdicFriFolding::<(), ()>(PhantomData);
+  assert_eq!(<TwoAdicFriFolding<(), ()> as FriFoldingStrategy<Val, ExtVal>>::extra_query_index_bits(&folding), 0);
+  let mut rows = 0;
+  let mut slots = 0;
+  for parent in 0..=32 {
+    // Arity one covers the public helper's boundary. Accepted FRI rounds
+    // additionally require a positive arity logarithm.
+    for log_arity in 0..=parent.min(8) {
+      let height = parent - log_arity;
+      let arity = 1 << log_arity;
+      let mask =
+        if height == 0 { 0 } else { usize::MAX >> (word_bits - height) };
+      let mut indices = vec![0, mask / 2, mask, 0x0a37_51c9 & mask];
+      indices.sort_unstable();
+      indices.dedup();
+      nat(&mut out, indices.len());
+      for index in indices {
+        nat(&mut out, index);
+        let start = Val::two_adic_generator(parent)
+          .exp_u64(u64::try_from(reverse_bits_len(index, height)).unwrap());
+        let mut nodes: Vec<_> = Val::two_adic_generator(log_arity)
+          .shifted_powers(start)
+          .take(arity)
+          .collect();
+        reverse_slice_index_bits(&mut nodes);
+        let values: Vec<_> = (0..arity)
+          .map(|slot| {
+            ExtVal::new([
+              Val::from_usize(slot + 1),
+              Val::from_usize(slot * 19 + 3),
+            ])
+          })
+          .collect();
+        let child = Val::two_adic_generator(height)
+          .exp_u64(u64::try_from(reverse_bits_len(index, height)).unwrap());
+        for (slot, &node) in nodes.iter().enumerate() {
+          let query = index * arity + slot;
+          let direct = Val::two_adic_generator(parent)
+            .exp_u64(u64::try_from(reverse_bits_len(query, parent)).unwrap());
+          assert_eq!(node, direct);
+          assert_eq!(node.exp_power_of_2(log_arity), child);
+          let folded = <TwoAdicFriFolding<(), ()> as FriFoldingStrategy<
+            Val,
+            ExtVal,
+          >>::fold_row(
+            &folding,
+            index,
+            height,
+            log_arity,
+            ExtVal::from(node),
+            values.iter().copied(),
+          );
+          assert_eq!(folded, values[slot]);
+          field(&mut out, node);
+          field(&mut out, child);
+          extension(&mut out, folded);
+          slots += 1;
+        }
+        rows += 1;
+      }
+    }
+  }
+  for count in [reversals, points, nested, rows, slots] {
+    nat(&mut out, count);
+  }
+  if let Ok(path) = std::env::var("IX_FRI_DOMAIN_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  println!(
+    "FRI domains: {reversals} reversals, {points} query points, {nested} nested points, {rows} rows and {slots} native fold-node selections"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/fri_query.rs b/crates/aiur/src/synthesis/tests/fri_query.rs
new file mode 100644
index 000000000..64323ece4
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/fri_query.rs
@@ -0,0 +1,439 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Record the real FRI verifier's private query routine through its public
+//! folding strategy hook, with honest PCS proofs and the concrete MMCS.
+
+use super::*;
+use multi_stark::{
+  config::StarkGenericConfig,
+  p3_field::{BasedVectorSpace, Field, HornerIter, PrimeField64, TwoAdicField},
+  p3_matrix::{Matrix, dense::RowMajorMatrix},
+  types::{Challenger, ExtMmcs, ExtVal, Mmcs, Pcs, Val},
+};
+use p3_blake3::Blake3;
+use p3_challenger::{
+  CanObserve, CanSample, CanSampleBits, FieldChallenger, GrindingChallenger,
+};
+use p3_commit::{Mmcs as MmcsTrait, Pcs as PcsTrait};
+use p3_fri::{
+  BatchMultiOpening, FriFoldingStrategy, FriParameters as NativeParameters,
+  TwoAdicFriFolding, verifier::verify_fri,
+};
+use p3_symmetric::{
+  CompressionFunctionFromHasher, MerkleCap, SerializingHasher,
+};
+use p3_util::reverse_bits_len;
+use std::{cell::RefCell, io, marker::PhantomData};
+
+type Dft = <AiurConfig as StarkGenericConfig>::Dft;
+type Commitment = MerkleCap<Val, [u8; 32]>;
+type NativeFolding = TwoAdicFriFolding<
+  Vec<BatchMultiOpening<Val, Mmcs>>,
+  <Mmcs as MmcsTrait<Val>>::Error,
+>;
+
+struct FoldCall {
+  index: usize,
+  height: usize,
+  log_arity: usize,
+  challenge: ExtVal,
+  values: Vec<ExtVal>,
+  result: ExtVal,
+}
+
+#[derive(Default)]
+struct RecordingFolding(RefCell<Vec<FoldCall>>);
+
+impl FriFoldingStrategy<Val, ExtVal> for RecordingFolding {
+  type InputProof = Vec<BatchMultiOpening<Val, Mmcs>>;
+  type InputError = <Mmcs as MmcsTrait<Val>>::Error;
+
+  fn extra_query_index_bits(&self) -> usize {
+    let native: NativeFolding = TwoAdicFriFolding(PhantomData);
+    <NativeFolding as FriFoldingStrategy<Val, ExtVal>>::extra_query_index_bits(
+      &native,
+    )
+  }
+
+  fn fold_row(
+    &self,
+    index: usize,
+    height: usize,
+    log_arity: usize,
+    challenge: ExtVal,
+    evals: impl Iterator<Item = ExtVal>,
+  ) -> ExtVal {
+    let values: Vec<_> = evals.collect();
+    let native: NativeFolding = TwoAdicFriFolding(PhantomData);
+    let result = <NativeFolding as FriFoldingStrategy<Val, ExtVal>>::fold_row(
+      &native,
+      index,
+      height,
+      log_arity,
+      challenge,
+      values.iter().copied(),
+    );
+    self.0.borrow_mut().push(FoldCall {
+      index,
+      height,
+      log_arity,
+      challenge,
+      values,
+      result,
+    });
+    result
+  }
+
+  fn fold_matrix<M: Matrix<ExtVal>>(
+    &self,
+    challenge: ExtVal,
+    log_arity: usize,
+    matrix: M,
+  ) -> Vec<ExtVal> {
+    let native: NativeFolding = TwoAdicFriFolding(PhantomData);
+    <NativeFolding as FriFoldingStrategy<Val, ExtVal>>::fold_matrix(
+      &native, challenge, log_arity, matrix,
+    )
+  }
+}
+
+#[derive(Clone)]
+struct RecordingChallenger {
+  inner: Challenger,
+  fields: Vec<Val>,
+  indices: Vec<(usize, usize)>,
+}
+
+impl CanObserve<Val> for RecordingChallenger {
+  fn observe(&mut self, value: Val) {
+    self.inner.observe(value);
+  }
+}
+
+impl CanObserve<Commitment> for RecordingChallenger {
+  fn observe(&mut self, value: Commitment) {
+    self.inner.observe(value);
+  }
+}
+
+impl CanSample<Val> for RecordingChallenger {
+  fn sample(&mut self) -> Val {
+    let value = self.inner.sample();
+    self.fields.push(value);
+    value
+  }
+}
+
+impl CanSample<ExtVal> for RecordingChallenger {
+  fn sample(&mut self) -> ExtVal {
+    self.sample_algebra_element()
+  }
+}
+
+impl CanSampleBits<usize> for RecordingChallenger {
+  fn sample_bits(&mut self, bits: usize) -> usize {
+    let value = self.inner.sample_bits(bits);
+    self.indices.push((bits, value));
+    value
+  }
+}
+
+impl FieldChallenger<Val> for RecordingChallenger {}
+
+impl GrindingChallenger for RecordingChallenger {
+  type Witness = Val;
+
+  fn grind(&mut self, bits: usize) -> Val {
+    self.inner.grind(bits)
+  }
+}
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  for &coordinate in value.as_basis_coefficients_slice() {
+    field(out, coordinate);
+  }
+}
+
+fn extensions(out: &mut Vec<u8>, values: &[ExtVal]) {
+  nat(out, values.len());
+  for &value in values {
+    extension(out, value);
+  }
+}
+
+fn query_point(bits: usize, index: usize) -> Val {
+  Val::two_adic_generator(bits)
+    .exp_u64(u64::try_from(reverse_bits_len(index, bits)).unwrap())
+}
+
+fn layout(index: usize, final_bits: usize) -> Vec<Vec<usize>> {
+  let offsets = match index {
+    0 => vec![vec![0]],
+    1 => vec![vec![2]],
+    2 => vec![vec![6, 2], vec![2, 0]],
+    _ => vec![vec![3, 6], vec![3]],
+  };
+  offsets
+    .into_iter()
+    .map(|batch| {
+      batch
+        .into_iter()
+        .map(|bits| bits + final_bits + usize::from(final_bits != 0))
+        .collect()
+    })
+    .collect()
+}
+
+fn polynomial(seed: usize, bits: usize, column: usize) -> Vec<Val> {
+  (0..1 << bits)
+    .map(|index| Val::from_usize(seed * 101 + column * 29 + index * 13 + 1))
+    .collect()
+}
+
+#[test]
+fn fri_query_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur native FRI query chains v1\n".to_vec();
+  let mut cases = 0;
+  let mut total_queries = 0;
+  let mut total_rounds = 0;
+  let mut total_calls = 0;
+  for blowup in 1..=2 {
+    for final_bits in 0..=2 {
+      for max_arity in 1..=4 {
+        for layout_index in 0..4 {
+          let logs = layout(layout_index, final_bits);
+          let queries = 1 + layout_index + final_bits;
+          let global_bits =
+            logs.iter().flatten().copied().max().unwrap() + blowup;
+          let mmcs = Mmcs::new(
+            SerializingHasher::new(Blake3),
+            CompressionFunctionFromHasher::new(Blake3),
+            0,
+          );
+          let parameters = NativeParameters {
+            log_blowup: blowup,
+            log_final_poly_len: final_bits,
+            max_log_arity: max_arity,
+            num_queries: queries,
+            commit_proof_of_work_bits: 0,
+            query_proof_of_work_bits: 0,
+            mmcs: ExtMmcs::new(mmcs.clone()),
+          };
+          let pcs = Pcs::new(Dft::default(), mmcs.clone(), parameters.clone());
+          let sources: Vec<Vec<Vec<Vec<Val>>>> = logs
+            .iter()
+            .enumerate()
+            .map(|(batch, matrices)| {
+              matrices
+                .iter()
+                .enumerate()
+                .map(|(matrix, &bits)| {
+                  (0..2 + matrix)
+                    .map(|column| {
+                      polynomial(cases + batch * 7 + matrix, bits, column)
+                    })
+                    .collect()
+                })
+                .collect()
+            })
+            .collect();
+          let (commits, data): (Vec<_>, Vec<_>) = logs
+            .iter()
+            .zip(&sources)
+            .map(|(matrices, sources)| {
+              let evaluations = matrices.iter().zip(sources).map(|(&bits, columns)| {
+                let domain = <Pcs as PcsTrait<ExtVal, Challenger>>::natural_domain_for_degree(&pcs, 1 << bits);
+                let mut values = Vec::new();
+                for point in Val::two_adic_generator(bits).powers().take(1 << bits) {
+                  values.extend(columns.iter().map(|p| p.iter().copied().horner::<Val, _>(point)));
+                }
+                (domain, RowMajorMatrix::new(values, columns.len()))
+              });
+              <Pcs as PcsTrait<ExtVal, Challenger>>::commit(&pcs, evaluations)
+            })
+            .unzip();
+          let mut prefix =
+            Challenger::from_hasher(b"ix/fri-query-corpus/v1".to_vec(), Blake3);
+          prefix.observe_slice(&commits);
+          let zeta: ExtVal = prefix.sample_algebra_element();
+          let mut points = vec![zeta];
+          if layout_index % 2 == 1 {
+            points
+              .push(zeta + ExtVal::new([Val::from_u64(19), Val::from_u64(3)]));
+          }
+          let requests = data
+            .iter()
+            .zip(&logs)
+            .map(|(data, matrices)| {
+              (data, matrices.iter().map(|_| points.clone()).collect())
+            })
+            .collect();
+          let (opened, proof) = pcs.open(requests, &mut prefix.clone());
+          let claims: Vec<_> = commits.into_iter().zip(&logs).zip(&opened).map(|((commit, matrices), opened)| {
+            let matrices = matrices.iter().zip(opened).map(|(&bits, values)| {
+              let domain = <Pcs as PcsTrait<ExtVal, Challenger>>::natural_domain_for_degree(&pcs, 1 << bits);
+              (domain, points.iter().copied().zip(values.iter().cloned()).collect())
+            }).collect();
+            (commit, matrices)
+          }).collect();
+          let ordinary =
+            pcs.verify(claims.clone(), &proof, &mut prefix.clone());
+          assert!(ordinary.is_ok(), "ordinary PCS case {cases}: {ordinary:?}");
+          // The PCS caller absorbs every claimed evaluation before it
+          // enters verify_fri. Preserve that exact prefix for the recorder.
+          for values in opened.iter().flatten().flatten() {
+            prefix.observe_algebra_slice(values);
+          }
+          let folding = RecordingFolding::default();
+          let mut challenger = RecordingChallenger {
+            inner: prefix,
+            fields: vec![],
+            indices: vec![],
+          };
+          verify_fri(
+            &folding,
+            &parameters,
+            &proof,
+            &mut challenger,
+            &claims,
+            &mmcs,
+          )
+          .unwrap();
+          let rounds = proof.commit_phase_openings.len();
+          assert_eq!(challenger.fields.len(), 2 * (rounds + 1));
+          assert_eq!(challenger.indices.len(), queries);
+          let random: Vec<_> = challenger
+            .fields
+            .as_chunks::<2>()
+            .0
+            .iter()
+            .map(|pair| ExtVal::new([pair[0], pair[1]]))
+            .collect();
+          let calls = folding.0.into_inner();
+          assert_eq!(calls.len(), queries * rounds);
+          for value in
+            [blowup, final_bits, max_arity, queries, layout_index, global_bits]
+          {
+            nat(&mut out, value);
+          }
+          nat(&mut out, logs.len());
+          for (batch, (matrices, columns)) in
+            logs.iter().zip(&sources).enumerate()
+          {
+            nat(&mut out, matrices.len());
+            for (matrix, (&bits, columns)) in
+              matrices.iter().zip(columns).enumerate()
+            {
+              nat(&mut out, bits);
+              nat(&mut out, columns.len());
+              for polynomial in columns {
+                nat(&mut out, polynomial.len());
+                for &coefficient in polynomial {
+                  field(&mut out, coefficient);
+                }
+              }
+              for (&point, values) in points.iter().zip(&opened[batch][matrix])
+              {
+                let expected: Vec<_> = columns
+                  .iter()
+                  .map(|p| p.iter().copied().map(ExtVal::from).horner(point))
+                  .collect();
+                assert_eq!(*values, expected);
+              }
+            }
+          }
+          extensions(&mut out, &points);
+          for batch in &opened {
+            for matrix in batch {
+              for point in matrix {
+                extensions(&mut out, point);
+              }
+            }
+          }
+          for (batch, opened_batch) in proof.input_openings.iter().enumerate() {
+            for (query, &(width, index)) in
+              challenger.indices.iter().enumerate()
+            {
+              assert_eq!(width, global_bits);
+              for (matrix, row) in
+                opened_batch.opened_values[query].iter().enumerate()
+              {
+                let height = logs[batch][matrix] + blowup;
+                let point = Val::GENERATOR
+                  * query_point(height, index >> (global_bits - height));
+                let expected: Vec<_> = sources[batch][matrix]
+                  .iter()
+                  .map(|p| p.iter().copied().horner(point))
+                  .collect();
+                assert_eq!(*row, expected);
+                nat(&mut out, row.len());
+                for &value in row {
+                  field(&mut out, value);
+                }
+              }
+            }
+          }
+          extensions(&mut out, &random);
+          for &(width, index) in &challenger.indices {
+            nat(&mut out, width);
+            nat(&mut out, index);
+          }
+          nat(&mut out, rounds);
+          for round in &proof.commit_phase_openings {
+            nat(&mut out, usize::from(round.log_arity));
+            for siblings in &round.sibling_values {
+              extensions(&mut out, siblings);
+            }
+          }
+          extensions(&mut out, &proof.final_poly);
+          nat(&mut out, calls.len());
+          for call in &calls {
+            for value in [call.index, call.height, call.log_arity] {
+              nat(&mut out, value);
+            }
+            extension(&mut out, call.challenge);
+            extensions(&mut out, &call.values);
+            extension(&mut out, call.result);
+          }
+          for (query, &(_, index)) in challenger.indices.iter().enumerate() {
+            let final_index = if rounds == 0 {
+              index
+            } else {
+              calls[(query + 1) * rounds - 1].index
+            };
+            let value: ExtVal = proof
+              .final_poly
+              .iter()
+              .copied()
+              .horner(query_point(global_bits, final_index));
+            nat(&mut out, final_index);
+            extension(&mut out, value);
+          }
+          cases += 1;
+          total_queries += queries;
+          total_rounds += rounds;
+          total_calls += calls.len();
+        }
+      }
+    }
+  }
+  for value in [cases, total_queries, total_rounds, total_calls] {
+    nat(&mut out, value);
+  }
+  if let Ok(path) = std::env::var("IX_FRI_QUERY_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  println!(
+    "Native FRI query chains: {cases} proofs, {total_queries} queries, {total_rounds} rounds, {total_calls} fold calls"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/interpolation.rs b/crates/aiur/src/synthesis/tests/interpolation.rs
new file mode 100644
index 000000000..a1c315180
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/interpolation.rs
@@ -0,0 +1,174 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Actual FRI row interpolation and both native matrix folding paths.
+
+use multi_stark::{
+  p3_field::{
+    BasedVectorSpace, Field, HornerIter, PrimeCharacteristicRing, PrimeField64,
+    TwoAdicField,
+  },
+  p3_matrix::dense::RowMajorMatrix,
+  types::{ExtVal, Val},
+};
+use p3_fri::{FriFoldingStrategy, TwoAdicFriFolding};
+use p3_util::{reverse_bits_len, reverse_slice_index_bits};
+use std::{io, marker::PhantomData};
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  let coordinates: &[Val] = value.as_basis_coefficients_slice();
+  for &coordinate in coordinates {
+    field(out, coordinate);
+  }
+}
+
+fn extensions(out: &mut Vec<u8>, values: &[ExtVal]) {
+  nat(out, values.len());
+  for &value in values {
+    extension(out, value);
+  }
+}
+
+fn sample(seed: usize) -> ExtVal {
+  ExtVal::new([Val::from_usize(seed * 67 + 3), Val::from_usize(seed * 13 + 1)])
+}
+
+fn coefficients(arity: usize, variant: usize) -> Vec<ExtVal> {
+  match variant {
+    0 => vec![],
+    1 => vec![sample(1)],
+    2 => (0..arity)
+      .map(|index| if index + 1 == arity { ExtVal::ONE } else { ExtVal::ZERO })
+      .collect(),
+    _ => (0..arity).map(|index| sample(index + 17)).collect(),
+  }
+}
+
+fn fold_row(
+  index: usize,
+  height: usize,
+  log_arity: usize,
+  point: ExtVal,
+  values: &[ExtVal],
+) -> ExtVal {
+  <TwoAdicFriFolding<(), ()> as FriFoldingStrategy<Val, ExtVal>>::fold_row(
+    &TwoAdicFriFolding(PhantomData),
+    index,
+    height,
+    log_arity,
+    point,
+    values.iter().copied(),
+  )
+}
+
+#[test]
+fn interpolation_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur FRI interpolation v1\n".to_vec();
+  let mut rows = 0;
+  let mut evaluations = 0;
+  for parent in 0..=32 {
+    for log_arity in 0..=parent.min(6) {
+      let height = parent - log_arity;
+      let arity = 1 << log_arity;
+      let mask = if height == 0 {
+        0
+      } else {
+        usize::MAX >> (usize::BITS as usize - height)
+      };
+      let mut indices = vec![0, mask / 2, mask];
+      indices.sort_unstable();
+      indices.dedup();
+      nat(&mut out, indices.len());
+      for index in indices {
+        nat(&mut out, index);
+        let start = Val::two_adic_generator(parent)
+          .exp_u64(u64::try_from(reverse_bits_len(index, height)).unwrap());
+        let mut nodes: Vec<_> = Val::two_adic_generator(log_arity)
+          .shifted_powers(start)
+          .take(arity)
+          .collect();
+        reverse_slice_index_bits(&mut nodes);
+        let scale = (Val::from_usize(arity)
+          * nodes[0].exp_power_of_2(log_arity))
+        .inverse();
+        field(&mut out, scale);
+        for variant in 0..4 {
+          let polynomial = coefficients(arity, variant);
+          let values: Vec<ExtVal> = nodes
+            .iter()
+            .map(|&node| polynomial.iter().copied().horner(ExtVal::from(node)))
+            .collect();
+          extensions(&mut out, &polynomial);
+          extensions(&mut out, &values);
+          for point in [
+            ExtVal::ZERO,
+            ExtVal::from(Val::from_u64(7)),
+            sample(41),
+            ExtVal::from(nodes[0]),
+            ExtVal::from(nodes[arity - 1]),
+          ] {
+            let result = fold_row(index, height, log_arity, point, &values);
+            assert_eq!(result, polynomial.iter().copied().horner(point));
+            extension(&mut out, point);
+            extension(&mut out, result);
+            evaluations += 1;
+          }
+          rows += 1;
+        }
+      }
+    }
+  }
+  let mut matrices = 0;
+  let mut matrix_rows = 0;
+  for parent in 1..=9 {
+    // fold_matrix requires a positive arity logarithm in the accepted FRI
+    // profile; the row helper above also tests its singleton boundary.
+    for log_arity in 1..=parent.min(6) {
+      let arity = 1 << log_arity;
+      let height = parent - log_arity;
+      let data: Vec<_> =
+        (0..1 << parent).map(|index| sample(index + parent * 19)).collect();
+      for point in [ExtVal::ZERO, sample(41), ExtVal::ONE] {
+        let folded = <TwoAdicFriFolding<(), ()> as FriFoldingStrategy<
+          Val,
+          ExtVal,
+        >>::fold_matrix(
+          &TwoAdicFriFolding(PhantomData),
+          point,
+          log_arity,
+          RowMajorMatrix::new(data.clone(), arity),
+        );
+        assert_eq!(folded.len(), 1 << height);
+        for (index, row) in data.chunks_exact(arity).enumerate() {
+          assert_eq!(
+            folded[index],
+            fold_row(index, height, log_arity, point, row)
+          );
+          matrix_rows += 1;
+        }
+        extension(&mut out, point);
+        extensions(&mut out, &data);
+        extensions(&mut out, &folded);
+        matrices += 1;
+      }
+    }
+  }
+  for count in [rows, evaluations, matrices, matrix_rows] {
+    nat(&mut out, count);
+  }
+  if let Ok(path) = std::env::var("IX_INTERPOLATION_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  println!(
+    "FRI interpolation: {rows} rows, {evaluations} challenge evaluations, {matrices} matrices, {matrix_rows} matrix rows"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/lookup_budget.rs b/crates/aiur/src/synthesis/tests/lookup_budget.rs
new file mode 100644
index 000000000..adb55e575
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/lookup_budget.rs
@@ -0,0 +1,186 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+
+fn bound(slots: &[usize], active: &[bool], degrees: &[u8]) -> Option<u64> {
+  lookup_query_bound(slots.iter().copied(), active, degrees)
+}
+
+/// The corpus exercises every u8 exponent, machine/field boundaries,
+/// active-position indexing and independently malformed sequence lengths.
+#[cfg(target_pointer_width = "64")]
+#[test]
+fn lookup_budget_snapshot() -> std::io::Result<()> {
+  use multi_stark::p3_field::PrimeField64;
+  fn append(out: &mut Vec<u8>, value: Option<u64>) {
+    out.push(u8::from(value.is_some()));
+    out.extend(value.unwrap_or(0).to_le_bytes());
+  }
+  let header = b"Aiur lookup budget v1\n";
+  let mut out = header.to_vec();
+  let p = usize::try_from(G::ORDER_U64).unwrap();
+  let cases = [
+    0,
+    1,
+    2,
+    3,
+    4,
+    255,
+    65536,
+    1 << 31,
+    1 << 32,
+    (1 << 32) - 1,
+    p / 2 - 1,
+    p - 3,
+    p - 2,
+    p - 1,
+    p,
+    usize::MAX,
+  ];
+  for slots in cases {
+    for degree in 0..=255 {
+      append(&mut out, bound(&[slots], &[true], &[degree]));
+      append(
+        &mut out,
+        bound(
+          &[usize::MAX, slots, usize::MAX],
+          &[false, true, false],
+          &[degree],
+        ),
+      );
+      append(&mut out, bound(&[slots, 3], &[true, true], &[degree, 31]));
+      append(&mut out, bound(&[3, slots], &[true, true], &[31, degree]));
+    }
+  }
+  let slots = [2, 7, 0, 13];
+  for slot_count in 0..=4 {
+    for active_count in 0..=4 {
+      for mask in 0..(1 << active_count) {
+        let active = (0..active_count)
+          .map(|bit| mask & (1 << bit) != 0)
+          .collect::<Vec<_>>();
+        for degree_count in 0..=5 {
+          for degree in [0, 1, 31, 63, 64, 255] {
+            append(
+              &mut out,
+              bound(&slots[..slot_count], &active, &vec![degree; degree_count]),
+            );
+          }
+        }
+      }
+    }
+  }
+  assert_eq!(out.len(), header.len() + 21_964 * 9);
+  if let Some(path) = std::env::var_os("IX_LOOKUP_BUDGET_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
+
+#[test]
+fn query_budget_uses_canonical_slots_and_active_heights() {
+  assert_eq!(
+    bound(&[2, 999, 3, 999], &[true, false, true, false], &[4, 5]),
+    Some(129)
+  );
+  assert_eq!(
+    bound(&[999, 3, 999, 2], &[false, true, false, true], &[5, 4]),
+    Some(129)
+  );
+  assert_eq!(bound(&[0], &[true], &[0]), Some(1));
+  assert_eq!(bound(&[1], &[true], &[63]), Some((1_u64 << 63) + 1));
+}
+
+#[test]
+fn query_budget_rejects_malformed_alignment_and_shifts() {
+  for (slots, active, degrees) in [
+    (vec![], vec![], vec![]),
+    (vec![1], vec![false], vec![]),
+    (vec![1], vec![], vec![]),
+    (vec![], vec![true], vec![0]),
+    (vec![1, 2], vec![true], vec![0]),
+    (vec![1], vec![true, false], vec![0]),
+    (vec![1], vec![true], vec![]),
+    (vec![1], vec![true], vec![0, 0]),
+    (vec![1, 2], vec![false, true], vec![0, 0]),
+  ] {
+    assert_eq!(bound(&slots, &active, &degrees), None);
+  }
+  for degree in 64..=255 {
+    for slots in [0, 1, usize::MAX] {
+      assert_eq!(bound(&[slots], &[true], &[degree]), None);
+    }
+  }
+}
+
+#[cfg(target_pointer_width = "64")]
+#[test]
+fn query_budget_checks_the_global_sum_and_both_overflows() {
+  use multi_stark::p3_field::PrimeField64;
+  let p = usize::try_from(G::ORDER_U64).unwrap();
+  assert_eq!(bound(&[p - 2], &[true], &[0]), Some(G::ORDER_U64 - 1));
+  assert_eq!(bound(&[p - 1], &[true], &[0]), None);
+  assert_eq!(
+    bound(&[p - 3, 1], &[true, true], &[0, 0]),
+    Some(G::ORDER_U64 - 1)
+  );
+  assert_eq!(bound(&[p - 3, 2], &[true, true], &[0, 0]), None);
+  assert_eq!(bound(&[usize::MAX], &[true], &[1]), None);
+  assert_eq!(bound(&[usize::MAX], &[true], &[0]), None);
+  assert_eq!(bound(&[1, usize::MAX], &[true, false], &[0]), Some(2));
+  let slots = (p - 2) >> 31;
+  assert!(bound(&[slots], &[true], &[31]).is_some());
+  assert_eq!(bound(&[slots + 1], &[true], &[31]), None);
+}
+
+#[test]
+fn public_verify_checks_lookup_metadata() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let (claim, mut proof) =
+    system.prove(0, &[G::ONE, G::ONE], &mut empty_io_buffer());
+  system.verify(&claim, &proof).unwrap();
+  assert!(
+    lookup_query_bound(
+      system.slot_widths.iter().map(Vec::len),
+      &proof.active,
+      &proof.log_degrees
+    )
+    .is_some()
+  );
+  let degrees = proof.log_degrees.clone();
+  for malformed in
+    [vec![], vec![0; degrees.len() + 1], vec![255; degrees.len()]]
+  {
+    proof.log_degrees = malformed;
+    assert!(matches!(
+      system.verify(&claim, &proof),
+      Err(VerificationError::InvalidProofShape)
+    ));
+  }
+  proof.log_degrees = degrees;
+  let active = proof.active.clone();
+  for malformed in
+    [vec![], vec![false; active.len()], vec![true; active.len() + 1]]
+  {
+    proof.active = malformed;
+    assert!(matches!(
+      system.verify(&claim, &proof),
+      Err(VerificationError::InvalidProofShape)
+    ));
+  }
+  proof.active = active;
+  system.verify(&claim, &proof).unwrap();
+}
+
+#[test]
+fn serialized_key_maximum_lookup_budget_fits_characteristic() {
+  use multi_stark::p3_field::PrimeField64;
+  let slots = vec![65535; 65535];
+  let active = vec![true; 65535];
+  let degrees = vec![32; 65535];
+  let maximum = 1 + 65535_u64.pow(2) * (1_u64 << 32);
+  assert!(maximum < G::ORDER_U64);
+  assert_eq!(bound(&slots, &active, &degrees), Some(maximum));
+}
diff --git a/crates/aiur/src/synthesis/tests/lookup_shapes.rs b/crates/aiur/src/synthesis/tests/lookup_shapes.rs
new file mode 100644
index 000000000..0b4d077e9
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/lookup_shapes.rs
@@ -0,0 +1,298 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+
+fn snapshot_body(tag: usize) -> Block {
+  fn ret(size: usize) -> Block {
+    Block { ops: vec![], ctrl: Ctrl::Return(0, vec![0; size]) }
+  }
+  fn yield_values(size: usize) -> Block {
+    Block { ops: vec![], ctrl: Ctrl::Yield(0, vec![0; size]) }
+  }
+  fn matched(arm: Option<Block>, fallback: Option<Block>) -> Block {
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::Match(
+        0,
+        arm.into_iter().map(|block| (G::ZERO, block)).collect(),
+        fallback.map(Box::new),
+      ),
+    }
+  }
+  fn continued(arm: Block, continuation: Block) -> Block {
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::MatchContinue(
+        0,
+        [(G::ZERO, arm)].into_iter().collect(),
+        Some(Box::new(yield_values(2))),
+        2,
+        0,
+        0,
+        Box::new(continuation),
+      ),
+    }
+  }
+  match tag {
+    0..=2 => ret(tag),
+    3 => yield_values(0),
+    4 => yield_values(1),
+    5 => matched(Some(ret(1)), Some(ret(1))),
+    6 => matched(Some(ret(0)), Some(ret(1))),
+    7 => matched(Some(ret(1)), None),
+    8 => matched(None, None),
+    9 => continued(yield_values(2), ret(1)),
+    10 => continued(ret(1), ret(1)),
+    11 => continued(ret(0), ret(1)),
+    12 => continued(yield_values(1), ret(1)),
+    13 => continued(yield_values(2), yield_values(0)),
+    14 => continued(continued(yield_values(2), yield_values(2)), ret(1)),
+    15 => continued(continued(yield_values(2), yield_values(1)), ret(1)),
+    16 => matched(Some(continued(ret(1), ret(1))), Some(ret(1))),
+    _ => unreachable!(),
+  }
+}
+
+fn snapshot_function(
+  body: Block,
+  inputs: usize,
+  entry: bool,
+  constrained: bool,
+) -> Function {
+  Function {
+    body,
+    layout: FunctionLayout {
+      input_size: inputs,
+      selectors: 1,
+      auxiliaries: 7,
+      lookups: 4,
+    },
+    entry,
+    constrained,
+  }
+}
+
+/// Compare the Rust guards with the total Lean validators across nested
+/// control forms, all small arities, visibility and advice-call modes.
+/// These fixtures test structural checks independently of layout/value
+/// validation; they are never passed to the constraint emitter.
+#[test]
+fn lookup_shape_snapshot() -> std::io::Result<()> {
+  let header = b"Aiur lookup shapes v1\n";
+  let mut out = header.to_vec();
+  for tag in 0..17 {
+    for size in 0..4 {
+      out.push(u8::from(snapshot_body(tag).returns_have_size(size)));
+    }
+  }
+  for tag in 0..17 {
+    for callee_inputs in 0..4 {
+      for caller_inputs in 0..4 {
+        for outputs in 0..4 {
+          for advice in [false, true] {
+            for constrained in [false, true] {
+              let caller = snapshot_function(
+                Block {
+                  ops: vec![Op::Call(
+                    1,
+                    vec![0; caller_inputs],
+                    outputs,
+                    advice,
+                  )],
+                  ctrl: Ctrl::Return(0, vec![]),
+                },
+                3,
+                true,
+                true,
+              );
+              let callee = snapshot_function(
+                snapshot_body(tag),
+                callee_inputs,
+                false,
+                constrained,
+              );
+              let top = Toplevel {
+                functions: vec![caller, callee],
+                memory_sizes: vec![],
+                circuits: vec![],
+              };
+              out.push(u8::from(top.validate_lookup_shapes().is_ok()));
+            }
+          }
+        }
+      }
+    }
+  }
+  for tag in 0..17 {
+    for inputs in 0..4 {
+      for entry in [false, true] {
+        for constrained in [false, true] {
+          let top = Toplevel {
+            functions: vec![snapshot_function(
+              snapshot_body(tag),
+              inputs,
+              entry,
+              constrained,
+            )],
+            memory_sizes: vec![],
+            circuits: vec![],
+          };
+          for channel in 0..3 {
+            for function in [0, 1, 99] {
+              for arguments in 0..7 {
+                let mut claim = vec![G::from_u8(channel), G::from_u8(function)];
+                claim.extend(std::iter::repeat_n(G::ZERO, arguments));
+                out.push(u8::from(top.valid_claim_shape(&claim)));
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  assert_eq!(out.len(), header.len() + 21_556);
+  if let Some(path) = std::env::var_os("IX_LOOKUP_SHAPE_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
+
+/// The public claim omits rank zero. A short return at rank seven must not
+/// be interpreted as a public return value of seven through zero padding.
+#[test]
+fn public_output_cannot_be_supplied_by_a_displaced_rank() {
+  let function = Function {
+    body: Block { ops: vec![], ctrl: Ctrl::Return(0, vec![]) },
+    layout: FunctionLayout {
+      input_size: 0,
+      selectors: 1,
+      auxiliaries: 7,
+      lookups: 4,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let (cp, fp) = test_parameters();
+  let system =
+    AiurSystem::build(with_singleton_circuits(vec![function], vec![]), cp, fp);
+  let claim = [function_channel(), G::ZERO, G::from_u8(7)];
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(index, shape)| {
+      let height = if index == 0 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if index == 0 {
+        // Active empty return, multiplicity one, rank seven.
+        rows[..3].copy_from_slice(&[G::ONE, G::ONE, G::from_u8(7)]);
+      } else if index == 2 {
+        // All three rank pairs are supplied by the fixed byte table.
+        rows[6] = G::from_u8(2);
+        rows[(7 * 256) * shape.main_width + 6] = G::ONE;
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  assert!(
+    system.verify(&claim, &proof).is_err(),
+    "a call-order rank was accepted as a function output"
+  );
+}
+
+#[test]
+fn public_claim_shape_checks_channel_visibility_and_arity() {
+  let top = mul_toplevel();
+  assert!(top.valid_claim_shape(&[G::ZERO, G::ZERO, G::ONE, G::ONE, G::ONE]));
+  for claim in [
+    vec![],
+    vec![G::ZERO],
+    vec![G::ONE, G::ZERO, G::ONE, G::ONE, G::ONE],
+    vec![G::ZERO, G::ONE, G::ONE, G::ONE, G::ONE],
+    vec![G::ZERO, G::ZERO, G::ONE],
+    vec![G::ZERO, G::ZERO, G::ONE, G::ONE],
+    vec![G::ZERO, G::ZERO, G::ONE, G::ONE, G::ONE, G::ZERO],
+  ] {
+    assert!(!top.valid_claim_shape(&claim));
+  }
+  for constrained in [true, false] {
+    let mut top = mul_toplevel();
+    top.functions[0].entry = !constrained;
+    top.functions[0].constrained = constrained;
+    assert!(!top.valid_claim_shape(&[G::ZERO; 5]));
+  }
+}
+
+#[test]
+fn constrained_calls_check_both_message_boundaries() {
+  let top = call_and_memory_toplevel();
+  top.validate_lookup_shapes().unwrap();
+  for malformed in [
+    Op::Call(1, vec![], 1, false),
+    Op::Call(1, vec![0], 0, false),
+    Op::Call(1, vec![0], 2, false),
+    Op::Call(99, vec![0], 1, false),
+  ] {
+    let mut top = call_and_memory_toplevel();
+    top.functions[0].body.ops.push(malformed);
+    assert!(top.validate_lookup_shapes().is_err());
+  }
+  let mut top = call_and_memory_toplevel();
+  top.functions[1].constrained = false;
+  assert!(top.validate_lookup_shapes().is_err());
+  // An unconstrained call supplies advice and emits no function lookup.
+  let mut top = mul_toplevel();
+  top.functions[0].body.ops.push(Op::Call(99, vec![], 17, true));
+  top.validate_lookup_shapes().unwrap();
+}
+
+#[test]
+fn nested_continuations_check_returns_and_yields() {
+  fn returning(size: usize) -> Block {
+    Block { ops: vec![], ctrl: Ctrl::Return(0, vec![0; size]) }
+  }
+  fn yielding(size: usize) -> Block {
+    Block { ops: vec![], ctrl: Ctrl::Yield(0, vec![0; size]) }
+  }
+  fn continuation(arm: Block, continued: Block) -> Block {
+    Block {
+      ops: vec![],
+      ctrl: Ctrl::MatchContinue(
+        0,
+        [(G::ZERO, arm)].into_iter().collect(),
+        Some(Box::new(yielding(2))),
+        2,
+        0,
+        0,
+        Box::new(continued),
+      ),
+    }
+  }
+  for arm in [returning(1), yielding(2)] {
+    let body = continuation(arm, returning(1));
+    assert!(body.returns_have_size(1));
+    assert!(!body.returns_have_size(0));
+    let mut top = mul_toplevel();
+    top.functions[0].body = body;
+    top.validate_lookup_shapes().unwrap();
+  }
+  assert!(!continuation(returning(0), returning(1)).returns_have_size(1));
+  assert!(!continuation(yielding(2), returning(0)).returns_have_size(1));
+  for body in [
+    yielding(2),
+    continuation(yielding(1), returning(1)),
+    continuation(yielding(2), yielding(2)),
+    continuation(continuation(yielding(2), yielding(1)), returning(1)),
+  ] {
+    let mut top = mul_toplevel();
+    top.functions[0].body = body;
+    assert!(top.validate_lookup_shapes().is_err());
+  }
+  let mut top = mul_toplevel();
+  top.functions[0].body =
+    continuation(continuation(returning(1), yielding(2)), returning(1));
+  top.validate_lookup_shapes().unwrap();
+}
diff --git a/crates/aiur/src/synthesis/tests/memory.rs b/crates/aiur/src/synthesis/tests/memory.rs
new file mode 100644
index 000000000..0cc61f6c6
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/memory.rs
@@ -0,0 +1,112 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+use multi_stark::eval::{VarValues, eval_expr};
+
+fn values<'a>(row: &'a [G], next: &'a [G]) -> VarValues<'a, G> {
+  VarValues {
+    preprocessed: [&[], &[]],
+    main: [row, next],
+    stage2: [&[], &[]],
+    publics: &[],
+    is_first_row: G::ZERO,
+    is_last_row: G::ZERO,
+    is_transition: G::ONE,
+  }
+}
+
+#[test]
+fn memory_transitions_allow_wrap_but_reject_duplicate_pointers() {
+  for width in [1, 4, 8] {
+    let (memory, constraints, _) = Memory::build(width);
+    for first in [G::from_u8(7), -G::from_u8(2)] {
+      let rows: Vec<_> = (0..4)
+        .map(|index| {
+          let mut row = vec![G::ZERO; memory.width];
+          row[0] = G::ONE;
+          row[1] = G::ONE;
+          row[2] = first + G::from_u64(index);
+          row[3..].fill(G::from_u64(index + 3));
+          row
+        })
+        .collect();
+      for pair in rows.windows(2) {
+        assert!(constraints.iter().all(|constraint| eval_expr(
+          constraint,
+          &values(&pair[0], &pair[1])
+        ) == G::ZERO));
+      }
+      let mut duplicate = rows[1].clone();
+      duplicate[2] = rows[0][2];
+      assert_ne!(
+        eval_expr(&constraints[3], &values(&rows[0], &duplicate)),
+        G::ZERO,
+        "the pointer transition must reject consecutive duplicates"
+      );
+      let mut inactive = rows[0].clone();
+      inactive[0] = G::ZERO;
+      inactive[1] = G::ZERO;
+      assert_ne!(
+        eval_expr(&constraints[2], &values(&inactive, &rows[1])),
+        G::ZERO,
+        "an active successor requires an active predecessor"
+      );
+    }
+  }
+}
+
+/// The memory table is immutable witness data, with no first-pointer-zero
+/// constraint or requirement for a preceding runtime store. Here pointers
+/// start at p-1 and wrap to zero. The zero pointer must load the second row.
+#[test]
+fn supplied_wrapping_memory_load_verifies() {
+  let function = Function {
+    body: Block { ops: vec![Op::Load(1, 0)], ctrl: Ctrl::Return(0, vec![1]) },
+    layout: FunctionLayout {
+      input_size: 1,
+      selectors: 1,
+      auxiliaries: 8,
+      lookups: 5,
+    },
+    entry: true,
+    constrained: true,
+  };
+  let (cp, fp) = test_parameters();
+  let system =
+    AiurSystem::build(with_singleton_circuits(vec![function], vec![1]), cp, fp);
+  let expected = G::from_u8(8);
+  let claim = [function_channel(), G::ZERO, G::ZERO, expected];
+  let traces = system
+    .circuit_shapes()
+    .iter()
+    .enumerate()
+    .map(|(index, shape)| {
+      let height = if index < 2 { 4 } else { shape.preprocessed_height };
+      let mut rows = vec![G::ZERO; height * shape.main_width];
+      if index == 0 {
+        rows[1] = G::ONE;
+        rows[2] = G::ONE;
+        rows[9] = expected;
+      } else if index == 1 {
+        assert_eq!(shape.main_width, 4);
+        rows[..8].copy_from_slice(&[
+          G::ZERO,
+          G::ONE,
+          -G::ONE,
+          G::from_u8(7),
+          G::ONE,
+          G::ONE,
+          G::ZERO,
+          expected,
+        ]);
+      } else if index == 3 {
+        rows[6] = G::from_u8(3);
+      }
+      RowMajorMatrix::new(rows, shape.main_width)
+    })
+    .collect();
+  let witness = SystemWitness::from_stage_1(traces, &system.system);
+  let proof = system.system.prove(&system.key, &claim, witness);
+  system.verify(&claim, &proof).expect("wrapping immutable memory is allowed");
+}
diff --git a/crates/aiur/src/synthesis/tests/merkle.rs b/crates/aiur/src/synthesis/tests/merkle.rs
new file mode 100644
index 000000000..41400678a
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/merkle.rs
@@ -0,0 +1,287 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Record the pinned native individual verifier's actual hash calls.
+//! Commit/open use the production CPU MMCS; the recording hasher delegates
+//! every call to the same native BLAKE3 implementation.
+
+use super::*;
+use multi_stark::{
+  p3_field::PrimeField64,
+  p3_matrix::{Dimensions, Matrix},
+  types::Mmcs,
+};
+use p3_blake3::Blake3;
+use p3_commit::{BatchOpeningRef, Mmcs as _};
+use p3_merkle_tree::MerkleTreeMmcs;
+use p3_symmetric::{
+  CompressionFunctionFromHasher, CryptographicHasher, MerkleCap,
+  SerializingHasher,
+};
+use std::sync::{Arc, Mutex};
+
+pub(super) type Digest = [u8; 32];
+pub(super) type Calls = Arc<Mutex<Vec<(Vec<u8>, Digest)>>>;
+
+#[derive(Clone)]
+pub(super) struct RecordingHash(pub(super) Calls);
+
+impl CryptographicHasher<u8, Digest> for RecordingHash {
+  fn hash_iter<I: IntoIterator<Item = u8>>(&self, input: I) -> Digest {
+    let bytes: Vec<_> = input.into_iter().collect();
+    let digest = Blake3.hash_iter(bytes.iter().copied());
+    self.0.lock().unwrap().push((bytes, digest));
+    digest
+  }
+}
+
+pub(super) type RecordingMmcs = MerkleTreeMmcs<
+  G,
+  u8,
+  SerializingHasher<RecordingHash>,
+  CompressionFunctionFromHasher<RecordingHash, 2, 32>,
+  2,
+  32,
+>;
+
+#[derive(Clone)]
+struct Case {
+  dimensions: Vec<Dimensions>,
+  rows: Vec<Vec<G>>,
+  proof: Vec<Digest>,
+  cap: Vec<Digest>,
+  cap_height: usize,
+  index: usize,
+}
+
+pub(super) fn number(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+pub(super) fn digests(out: &mut Vec<u8>, values: &[Digest]) {
+  number(out, values.len());
+  out.extend(values.iter().flatten());
+}
+
+#[derive(Default)]
+struct Corpus {
+  body: Vec<u8>,
+  count: usize,
+  accepted: usize,
+  omitted: usize,
+  unhashed: usize,
+  calls: usize,
+}
+
+impl Corpus {
+  fn record(&mut self, case: &Case, expected: Option<bool>) {
+    let native = Mmcs::new(
+      SerializingHasher::new(Blake3),
+      CompressionFunctionFromHasher::new(Blake3),
+      case.cap_height,
+    );
+    let cap = MerkleCap::new(case.cap.clone());
+    let accepted = native
+      .verify_batch(
+        &cap,
+        &case.dimensions,
+        case.index,
+        BatchOpeningRef::new(&case.rows, &case.proof),
+      )
+      .is_ok();
+    if let Some(expected) = expected {
+      assert_eq!(accepted, expected);
+    }
+    let calls = Calls::default();
+    let hash = RecordingHash(calls.clone());
+    let recording = RecordingMmcs::new(
+      SerializingHasher::new(hash.clone()),
+      CompressionFunctionFromHasher::new(hash),
+      case.cap_height,
+    );
+    let recorded = recording
+      .verify_batch(
+        &cap,
+        &case.dimensions,
+        case.index,
+        BatchOpeningRef::new(&case.rows, &case.proof),
+      )
+      .is_ok();
+    assert_eq!(accepted, recorded);
+    let calls = calls.lock().unwrap();
+    let degrees: Vec<u8> = case
+      .dimensions
+      .iter()
+      .map(|dims| u8::try_from(dims.height.ilog2()).unwrap())
+      .collect();
+    let covered =
+      crate::trace_heights::trace_cap_coverage(0, case.cap_height, &degrees);
+    self.count += 1;
+    self.accepted += usize::from(accepted);
+    self.omitted += usize::from(accepted && !covered);
+    self.unhashed += usize::from(calls.is_empty());
+    self.calls += calls.len();
+    let out = &mut self.body;
+    number(out, case.dimensions.len());
+    for dims in &case.dimensions {
+      number(out, dims.width);
+      number(out, usize::try_from(dims.height.ilog2()).unwrap());
+    }
+    number(out, case.cap_height);
+    number(out, case.index);
+    number(out, case.rows.len());
+    for row in &case.rows {
+      number(out, row.len());
+      for value in row {
+        out.extend(value.as_canonical_u64().to_le_bytes());
+      }
+    }
+    digests(out, &case.proof);
+    digests(out, &case.cap);
+    out.extend([u8::from(accepted), u8::from(covered)]);
+    number(out, calls.len());
+    for (input, digest) in calls.iter() {
+      number(out, input.len());
+      out.extend(input);
+      out.extend(digest);
+    }
+  }
+}
+
+#[test]
+fn merkle_path_snapshot() -> std::io::Result<()> {
+  let shapes = [
+    vec![0],
+    vec![1],
+    vec![2],
+    vec![3],
+    vec![4],
+    vec![7],
+    vec![3, 1],
+    vec![1, 3],
+    vec![3, 0, 2, 1],
+    vec![2, 2, 2],
+    vec![1, 4, 1, 4, 0],
+    vec![4, 2, 3, 2],
+  ];
+  let widths = [1, 2, 3, 7, 8, 9, 16, 17, 31, 32, 33, 129];
+  let mut corpus = Corpus::default();
+  for (fixture, logs) in shapes.into_iter().enumerate() {
+    let max_log = *logs.iter().max().unwrap();
+    let height = 1 << max_log;
+    let matrices: Vec<_> = logs
+      .iter()
+      .enumerate()
+      .map(|(matrix, log)| {
+        let width = widths[(fixture + matrix * 3) % widths.len()];
+        let values = (0..width * (1 << log))
+          .map(|i| {
+            let value = match i % 7 {
+              0 => 0,
+              1 => 1,
+              2 => 0xffff_ffff_0000_0000,
+              3 => 0xffff_ffff,
+              4 => 0x1_0000_0000,
+              _ => u64::try_from(i * 65537 + matrix * 257 + fixture).unwrap(),
+            };
+            G::from_u64(value)
+          })
+          .collect();
+        RowMajorMatrix::new(values, width)
+      })
+      .collect();
+    let dimensions: Vec<_> = matrices.iter().map(Matrix::dimensions).collect();
+    let indices: Vec<_> = if height <= 16 {
+      (0..height).collect()
+    } else {
+      vec![0, 1, 2, height / 2 - 1, height / 2, height - 2, height - 1]
+    };
+    for cap_height in 0..=max_log + 2 {
+      let mmcs = Mmcs::new(
+        SerializingHasher::new(Blake3),
+        CompressionFunctionFromHasher::new(Blake3),
+        cap_height,
+      );
+      let (cap, data) = mmcs.commit(matrices.clone());
+      for &index in &indices {
+        let opening = mmcs.open_batch(index, &data);
+        let case = Case {
+          dimensions: dimensions.clone(),
+          rows: opening.opened_values,
+          proof: opening.opening_proof,
+          cap: cap.roots().to_vec(),
+          cap_height,
+          index,
+        };
+        corpus.record(&case, Some(true));
+        for (matrix, &log) in logs.iter().enumerate() {
+          let mut changed = case.clone();
+          changed.rows[matrix][0] += G::ONE;
+          corpus.record(&changed, Some(log < cap_height.min(max_log)));
+        }
+        if !case.proof.is_empty() {
+          let mut changed = case.clone();
+          changed.proof.pop();
+          corpus.record(&changed, Some(false));
+          let mut changed = case.clone();
+          changed.proof[0][index % 32] ^= 1;
+          corpus.record(&changed, Some(false));
+        }
+        let mut changed = case.clone();
+        changed.proof.push([0; 32]);
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.rows.pop();
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.dimensions[0].width += 1;
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.index = height;
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.cap[index >> case.proof.len()][index % 32] ^= 1;
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.dimensions[0].height *= 2;
+        corpus.record(&changed, None);
+        let mut changed = case.clone();
+        changed.dimensions[0].width = 0;
+        changed.rows[0].clear();
+        corpus.record(&changed, None);
+        let mut changed = case.clone();
+        changed.cap.truncate(1);
+        corpus.record(&changed, None);
+        let mut changed = case.clone();
+        changed.dimensions.clear();
+        changed.rows.clear();
+        corpus.record(&changed, Some(false));
+      }
+    }
+  }
+  assert!(corpus.accepted > 500 && corpus.omitted > 100);
+  assert!(corpus.unhashed > 1000 && corpus.calls > 10000);
+  let mut out = b"Aiur Merkle paths v1\n".to_vec();
+  for count in [
+    corpus.count,
+    corpus.accepted,
+    corpus.omitted,
+    corpus.unhashed,
+    corpus.calls,
+  ] {
+    number(&mut out, count);
+  }
+  out.extend(corpus.body);
+  println!(
+    "Merkle paths: {} cases, {} accepted, {} omitted, {} unhashed, {} calls",
+    corpus.count,
+    corpus.accepted,
+    corpus.omitted,
+    corpus.unhashed,
+    corpus.calls
+  );
+  if let Some(path) = std::env::var_os("IX_MERKLE_PATH_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/mmcs.rs b/crates/aiur/src/synthesis/tests/mmcs.rs
new file mode 100644
index 000000000..4df5323c6
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/mmcs.rs
@@ -0,0 +1,137 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Native binary Merkle authentication and the cap coverage boundary.
+
+use super::*;
+
+#[cfg(not(feature = "cuda"))]
+#[test]
+fn native_cap_can_omit_a_shorter_matrix() {
+  use multi_stark::p3_matrix::Matrix;
+  use multi_stark::types::Mmcs;
+  use p3_blake3::Blake3;
+  use p3_commit::Mmcs as _;
+  use p3_symmetric::{CompressionFunctionFromHasher, SerializingHasher};
+
+  for cap_height in 0..=4 {
+    let mmcs = Mmcs::new(
+      SerializingHasher::new(Blake3),
+      CompressionFunctionFromHasher::new(Blake3),
+      cap_height,
+    );
+    let tall = RowMajorMatrix::new((1..=8).map(G::from_u32).collect(), 1);
+    let short = RowMajorMatrix::new(vec![G::from_u32(21), G::from_u32(22)], 1);
+    let dimensions = vec![tall.dimensions(), short.dimensions()];
+    let (commitment, data) = mmcs.commit(vec![tall.clone(), short]);
+    let mut changed = mmcs.open_batch(5, &data);
+    mmcs.verify_batch(&commitment, &dimensions, 5, (&changed).into()).unwrap();
+    changed.opened_values[1][0] += G::ONE;
+    let accepted =
+      mmcs.verify_batch(&commitment, &dimensions, 5, (&changed).into()).is_ok();
+    assert_eq!(accepted, cap_height > 1);
+
+    let indices = [5, 0, 5, 7];
+    let (mut rows, proof) = mmcs.open_multi_batch(&indices, &data);
+    mmcs
+      .verify_multi_batch(&commitment, &dimensions, &indices, &rows, &proof)
+      .unwrap();
+    for query in &mut rows {
+      query[1][0] += G::ONE;
+    }
+    let accepted = mmcs
+      .verify_multi_batch(&commitment, &dimensions, &indices, &rows, &proof)
+      .is_ok();
+    assert_eq!(accepted, cap_height > 1);
+
+    let different =
+      RowMajorMatrix::new(vec![G::from_u32(31), G::from_u32(32)], 1);
+    let (other_commitment, _) = mmcs.commit(vec![tall, different]);
+    assert_eq!(commitment == other_commitment, cap_height > 1);
+  }
+}
+
+#[cfg(not(feature = "cuda"))]
+#[test]
+fn public_verify_rejects_a_cap_above_the_shortest_trace_lde() {
+  let (mut cp, fp) = test_parameters();
+  cp.cap_height = 2;
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let (claim, proof) =
+    system.prove(0, &[G::ONE, G::ONE], &mut empty_io_buffer());
+  assert_eq!(proof.log_degrees[0], 0);
+  system.system.verify(&claim, &proof).unwrap();
+  assert!(matches!(
+    system.verify(&claim, &proof),
+    Err(VerificationError::InvalidProofShape)
+  ));
+}
+
+#[test]
+fn public_verify_accepts_a_cap_at_the_shortest_trace_lde() {
+  let (mut cp, fp) = test_parameters();
+  #[cfg(not(feature = "cuda"))]
+  {
+    cp.cap_height = 1;
+  }
+  #[cfg(feature = "cuda")]
+  {
+    cp.cap_height = 0;
+  }
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let (claim, proof) =
+    system.prove(0, &[G::from_u32(3), G::from_u32(5)], &mut empty_io_buffer());
+  assert_eq!(proof.log_degrees[0], 0);
+  system.verify(&claim, &proof).unwrap();
+  let mut changed = claim.clone();
+  *changed.last_mut().unwrap() += G::ONE;
+  assert!(system.verify(&changed, &proof).is_err());
+}
+
+#[cfg(target_pointer_width = "64")]
+#[test]
+fn merkle_cap_snapshot() -> std::io::Result<()> {
+  use crate::trace_heights::trace_cap_coverage;
+  let mut out = b"Aiur Merkle caps v1\n".to_vec();
+  let parameters = [
+    0,
+    1,
+    2,
+    3,
+    8,
+    16,
+    31,
+    32,
+    63,
+    64,
+    255,
+    256,
+    65535,
+    usize::MAX - 255,
+    usize::MAX,
+  ];
+  let mut total = 0;
+  for blowup in parameters {
+    for cap in parameters {
+      out.push(u8::from(trace_cap_coverage(blowup, cap, &[])));
+      total += 1;
+      for degree in 0..=255 {
+        for degrees in [
+          vec![degree],
+          vec![degree, 0],
+          vec![degree, 8, 16],
+          vec![degree, degree],
+          vec![255, degree],
+        ] {
+          out.push(u8::from(trace_cap_coverage(blowup, cap, &degrees)));
+          total += 1;
+        }
+      }
+    }
+  }
+  assert_eq!(total, 288225);
+  if let Some(path) = std::env::var_os("IX_MERKLE_CAP_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/polynomial.rs b/crates/aiur/src/synthesis/tests/polynomial.rs
new file mode 100644
index 000000000..8ab59a530
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/polynomial.rs
@@ -0,0 +1,214 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Native final-polynomial Horner evaluation and upstream coefficient helpers.
+
+use multi_stark::{
+  p3_field::{
+    BasedVectorSpace, Field, HornerIter, PrimeCharacteristicRing, PrimeField64,
+  },
+  types::{ExtVal, Val},
+};
+use p3_stir::utils::{
+  add_polys, divide_by_linear, eval_poly, vanishing_poly_from_roots,
+};
+use std::io;
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  let coordinates: &[Val] = value.as_basis_coefficients_slice();
+  for &coordinate in coordinates {
+    field(out, coordinate);
+  }
+}
+
+fn values<F: Copy>(
+  out: &mut Vec<u8>,
+  values: &[F],
+  write: fn(&mut Vec<u8>, F),
+) {
+  nat(out, values.len());
+  for &value in values {
+    write(out, value);
+  }
+}
+
+fn base_sample(seed: usize) -> Val {
+  if seed == 2 { Val::NEG_ONE } else { Val::from_usize(seed) }
+}
+
+fn extension_sample(seed: usize) -> ExtVal {
+  if seed < 3 {
+    ExtVal::from(base_sample(seed))
+  } else {
+    ExtVal::new([Val::from_usize(seed * 67), Val::from_usize(seed + 1)])
+  }
+}
+
+fn coefficients<F: Field>(
+  length: usize,
+  seed: usize,
+  sample: fn(usize) -> F,
+) -> Vec<F> {
+  (0..length)
+    .map(|index| match seed {
+      0 => F::ZERO,
+      1 => {
+        if index + 1 == length {
+          F::ONE
+        } else {
+          F::ZERO
+        }
+      },
+      2 if index >= length / 2 => F::ZERO,
+      _ => sample(seed * 67 + index * 13 + 3),
+    })
+    .collect()
+}
+
+fn cases<F: Field>(
+  out: &mut Vec<u8>,
+  sample: fn(usize) -> F,
+  write: fn(&mut Vec<u8>, F),
+) -> [usize; 5] {
+  let domain: Vec<_> = (0..80).map(sample).collect();
+  for (index, value) in domain.iter().enumerate() {
+    assert!(!domain[..index].contains(value));
+  }
+  values(out, &domain, write);
+  let mut count = 0;
+  let mut divisions = 0;
+  let mut zero_cases = 0;
+  let mut root_sets = 0;
+  let mut repeated_sets = 0;
+  for length in [0, 1, 2, 3, 4, 7, 8, 9, 16, 31, 32, 65] {
+    for right_length in [0, 1, length, length + 3] {
+      for seed in 0..8 {
+        let left = coefficients(length, seed, sample);
+        let right = coefficients(right_length, seed, sample);
+        let root = sample(seed);
+        let point = if seed % 3 == 0 { root } else { sample(seed + 19) };
+        values(out, &left, write);
+        values(out, &right, write);
+        write(out, root);
+        write(out, point);
+        let at_point: F = left.iter().copied().horner(point);
+        let at_root: F = left.iter().copied().horner(root);
+        let right_value: F = right.iter().copied().horner(point);
+        assert_eq!(at_point, eval_poly(&left, point));
+        assert_eq!(at_root, eval_poly(&left, root));
+        assert_eq!(right_value, eval_poly(&right, point));
+        write(out, at_point);
+        write(out, at_root);
+        write(out, right_value);
+        let added = add_polys(&left, &right);
+        let difference = add_polys(
+          &left,
+          &right.iter().map(|&value| -value).collect::<Vec<_>>(),
+        );
+        values(out, &added, write);
+        values(out, &difference, write);
+        assert_eq!(eval_poly(&added, point), at_point + right_value);
+        assert_eq!(eval_poly(&difference, point), at_point - right_value);
+        if !left.is_empty() {
+          let (quotient, remainder) = divide_by_linear(&left, root);
+          assert_eq!(quotient.len(), left.len() - 1);
+          assert_eq!(remainder, at_root);
+          assert_eq!(
+            (point - root) * eval_poly(&quotient, point) + remainder,
+            at_point
+          );
+          values(out, &quotient, write);
+          write(out, remainder);
+          divisions += 1;
+        }
+        let roots = domain
+          .iter()
+          .filter(|&&value| eval_poly(&left, value).is_zero())
+          .count();
+        let agreements = domain
+          .iter()
+          .filter(|&&value| eval_poly(&difference, value).is_zero())
+          .count();
+        let zero = left.iter().all(|value| value.is_zero());
+        if zero {
+          zero_cases += 1;
+        } else {
+          assert!(roots < left.len());
+        }
+        if difference.iter().any(|value| !value.is_zero()) {
+          assert!(agreements < left.len().max(right.len()));
+        }
+        nat(out, roots);
+        nat(out, agreements);
+        count += 1;
+      }
+    }
+  }
+  for length in [0, 1, 2, 3, 7, 16, 31, 32, 63] {
+    for variant in 0..4 {
+      let roots: Vec<_> = (0..length)
+        .map(|index| {
+          sample(match variant {
+            0 => index,
+            1 => length - index - 1,
+            2 => 0,
+            _ => index / 2,
+          })
+        })
+        .collect();
+      let repeated = roots
+        .iter()
+        .enumerate()
+        .any(|(index, value)| roots[..index].contains(value));
+      let polynomial = vanishing_poly_from_roots(&roots);
+      assert_eq!(polynomial.len(), roots.len() + 1);
+      assert_eq!(polynomial.last(), Some(&F::ONE));
+      values(out, &roots, write);
+      values(out, &polynomial, write);
+      for point in [sample(0), sample(2), sample(17), sample(79)] {
+        assert_eq!(
+          eval_poly(&polynomial, point),
+          roots.iter().map(|&root| point - root).product()
+        );
+        write(out, eval_poly(&polynomial, point));
+      }
+      let count = domain
+        .iter()
+        .filter(|&&point| eval_poly(&polynomial, point).is_zero())
+        .count();
+      assert!(count <= roots.len());
+      if !repeated {
+        assert_eq!(count, roots.len());
+      }
+      nat(out, count);
+      root_sets += 1;
+      repeated_sets += usize::from(repeated);
+    }
+  }
+  [count, divisions, zero_cases, root_sets, repeated_sets]
+}
+
+#[test]
+fn polynomial_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur coefficient polynomials v1\n".to_vec();
+  let base = cases(&mut out, base_sample, field);
+  let extension = cases(&mut out, extension_sample, extension);
+  for count in base.into_iter().chain(extension) {
+    nat(&mut out, count);
+  }
+  if let Ok(path) = std::env::var("IX_POLYNOMIAL_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  println!(
+    "Native polynomial arithmetic/divisions/zero cases/root sets/repeated sets: base {base:?}, extension {extension:?}"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/proof_codec.rs b/crates/aiur/src/synthesis/tests/proof_codec.rs
new file mode 100644
index 000000000..73c62138d
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/proof_codec.rs
@@ -0,0 +1,262 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Compare the complete native proof object with the total Lean codec.
+//! The semantic view deliberately differs from bincode's field order and
+//! represents every scalar/digest byte as a u64 to expose framing mistakes.
+
+use super::*;
+use multi_stark::{
+  p3_field::{BasedVectorSpace, PrimeField64},
+  types::ExtVal,
+};
+
+fn vector<T>(
+  out: &mut Vec<u64>,
+  values: &[T],
+  item: impl Fn(&mut Vec<u64>, &T),
+) {
+  out.push(u64::try_from(values.len()).unwrap());
+  for value in values {
+    item(out, value);
+  }
+}
+
+fn field(out: &mut Vec<u64>, value: &G) {
+  out.push(value.as_canonical_u64());
+}
+
+fn extension(out: &mut Vec<u64>, value: &ExtVal) {
+  let coordinates: &[G] = value.as_basis_coefficients_slice();
+  out.push(coordinates[0].as_canonical_u64());
+  out.push(coordinates[1].as_canonical_u64());
+}
+
+fn hashes(out: &mut Vec<u64>, values: &[[u8; 32]]) {
+  vector(out, values, |out, digest| {
+    out.extend(digest.iter().map(|byte| u64::from(*byte)));
+  });
+}
+
+fn openings<T>(
+  out: &mut Vec<u64>,
+  values: &[Vec<Vec<T>>],
+  item: impl Fn(&mut Vec<u64>, &T),
+) {
+  vector(out, values, |out, matrix| {
+    vector(out, matrix, |out, row| vector(out, row, &item));
+  });
+}
+
+fn view(proof: &AiurProof) -> Vec<u64> {
+  let mut out = Vec::new();
+  vector(&mut out, &proof.log_degrees, |out, degree| {
+    out.push(u64::from(*degree));
+  });
+  vector(&mut out, &proof.active, |out, enabled| {
+    out.push(u64::from(*enabled));
+  });
+  openings(&mut out, &proof.stage_2_opened_values, extension);
+  openings(&mut out, &proof.stage_1_opened_values, extension);
+  out.push(u64::from(proof.preprocessed_opened_values.is_some()));
+  if let Some(values) = &proof.preprocessed_opened_values {
+    openings(&mut out, values, extension);
+  }
+  openings(&mut out, &proof.quotient_opened_values, extension);
+  vector(&mut out, &proof.intermediate_accumulators, extension);
+  hashes(&mut out, proof.commitments.quotient_chunks.roots());
+  hashes(&mut out, proof.commitments.stage_2_trace.roots());
+  hashes(&mut out, proof.commitments.stage_1_trace.roots());
+  let fri = &proof.opening_proof;
+  field(&mut out, &fri.query_pow_witness);
+  vector(&mut out, &fri.final_poly, extension);
+  vector(&mut out, &fri.commit_phase_openings, |out, step| {
+    hashes(out, &step.opening_proof.sibling_hashes);
+    vector(out, &step.sibling_values, |out, row| vector(out, row, extension));
+    out.push(u64::from(step.log_arity));
+  });
+  vector(&mut out, &fri.input_openings, |out, batch| {
+    hashes(out, &batch.opening_proof.sibling_hashes);
+    openings(out, &batch.opened_values, field);
+  });
+  vector(&mut out, &fri.commit_pow_witnesses, field);
+  vector(&mut out, &fri.commit_phase_commits, |out, cap| {
+    hashes(out, cap.roots());
+  });
+  out
+}
+
+fn bytes(out: &mut Vec<u8>, value: &[u8]) {
+  out.extend(u64::try_from(value.len()).unwrap().to_le_bytes());
+  out.extend(value);
+}
+
+fn write_case(out: &mut Vec<u8>, value: &[u8]) -> bool {
+  bytes(out, value);
+  let parsed = AiurProof::from_bytes(value);
+  out.push(u8::from(parsed.is_ok()));
+  if let Ok(proof) = parsed {
+    bytes(out, &proof.to_bytes().unwrap());
+    let words = view(&proof);
+    out.extend(u64::try_from(words.len()).unwrap().to_le_bytes());
+    out.extend(words.iter().flat_map(|word| word.to_le_bytes()));
+    true
+  } else {
+    false
+  }
+}
+
+fn sparse(proof: &AiurProof) -> AiurProof {
+  let mut result = proof.clone();
+  result.active = vec![true, false, true];
+  result.log_degrees = vec![0, 8, 16, 255];
+  result.intermediate_accumulators = vec![
+    ExtVal::from_basis_coefficients_slice(&[G::ZERO, -G::ONE]).unwrap(),
+    ExtVal::from_basis_coefficients_slice(&[G::ONE, G::from_u64(1 << 32)])
+      .unwrap(),
+  ];
+  result.quotient_opened_values = vec![vec![], vec![vec![]]];
+  result.preprocessed_opened_values = None;
+  result.stage_1_opened_values = vec![];
+  result.stage_2_opened_values =
+    vec![vec![result.intermediate_accumulators.clone()]];
+  let fri = &mut result.opening_proof;
+  fri.commit_phase_commits.truncate(1);
+  fri.commit_pow_witnesses = vec![G::ZERO, G::ONE, -G::ONE];
+  fri.input_openings.truncate(1);
+  for batch in &mut fri.input_openings {
+    batch.opened_values = vec![vec![], vec![vec![G::ONE, -G::ONE]]];
+    batch.opening_proof.sibling_hashes.truncate(3);
+  }
+  fri.commit_phase_openings.truncate(1);
+  for step in &mut fri.commit_phase_openings {
+    step.log_arity = 255;
+    step.sibling_values =
+      vec![vec![], result.intermediate_accumulators.clone()];
+    step.opening_proof.sibling_hashes.truncate(2);
+  }
+  fri.final_poly = result.intermediate_accumulators.clone();
+  fri.query_pow_witness = -G::ONE;
+  result
+}
+
+#[test]
+fn proof_codec_snapshot() -> std::io::Result<()> {
+  let mut cases = Vec::new();
+  let mut keys = Vec::new();
+  for seed in 0..4 {
+    let (mut cp, mut fp) = test_parameters();
+    cp.cap_height = seed % 2 * 2;
+    fp.max_log_arity = seed % 2 + 1;
+    fp.num_queries = 8;
+    let top = match seed {
+      0 => mul_toplevel(),
+      1 => call_and_memory_toplevel(),
+      2 => xor_splits_toplevel(),
+      _ => unconstrained_call_promotion_toplevel(),
+    };
+    let input = if seed == 3 {
+      vec![G::from_u8(7)]
+    } else {
+      vec![G::from_u8(3), G::from_u8(5)]
+    };
+    let system = AiurSystem::build(top, cp, fp);
+    let (claim, proof) = system.prove(0, &input, &mut empty_io_buffer());
+    system.system.verify(&claim, &proof).unwrap();
+    // Preserve the original wire corpus, including native-accepted caps
+    // whose shortest trace is now excluded by the Aiur coverage guard.
+    assert_eq!(
+      system.verify(&claim, &proof).is_ok(),
+      crate::trace_heights::trace_cap_coverage(
+        cp.log_blowup,
+        cp.cap_height,
+        &proof.log_degrees
+      )
+    );
+    keys.push(crate::vk_codec::to_bytes(&system.system, cp, fp));
+    cases.push(proof.to_bytes().unwrap());
+    let fixture = sparse(&proof);
+    let encoded = fixture.to_bytes().unwrap();
+    cases.push(encoded.clone());
+    let mut some_empty = fixture.clone();
+    some_empty.preprocessed_opened_values = Some(vec![]);
+    cases.push(some_empty.to_bytes().unwrap());
+    for suffix in [&[0][..], &[1, 2, 3][..]] {
+      let mut changed = encoded.clone();
+      changed.extend(suffix);
+      assert!(AiurProof::from_bytes(&changed).is_ok());
+      cases.push(changed);
+    }
+    // Truncate at every byte of the small, fully populated fixture. Native
+    // serde must fail even inside extension coordinates and digest arrays.
+    for length in 0..encoded.len() {
+      let changed = encoded[..length].to_vec();
+      assert!(AiurProof::from_bytes(&changed).is_err());
+      cases.push(changed);
+    }
+    // The first active boolean and the first extension coordinate have
+    // independently known offsets from the native object's lengths.
+    for tag in [2, 127, 255] {
+      let mut changed = encoded.clone();
+      changed[8] = tag;
+      assert!(AiurProof::from_bytes(&changed).is_err());
+      cases.push(changed);
+    }
+    let first_accumulator = 8
+      + fixture.active.len()
+      + 3 * 8
+      + 32
+        * (fixture.commitments.stage_1_trace.num_roots()
+          + fixture.commitments.stage_2_trace.num_roots()
+          + fixture.commitments.quotient_chunks.num_roots())
+      + 8;
+    for offset in [first_accumulator, first_accumulator + 8] {
+      for noncanonical in [G::ORDER_U64, u64::MAX] {
+        let mut changed = encoded.clone();
+        changed[offset..offset + 8]
+          .copy_from_slice(&noncanonical.to_le_bytes());
+        assert!(AiurProof::from_bytes(&changed).is_err());
+        cases.push(changed);
+      }
+    }
+  }
+  let mut out = b"Aiur proof codec v1\n".to_vec();
+  out.extend(u64::try_from(keys.len()).unwrap().to_le_bytes());
+  for key in &keys {
+    bytes(&mut out, key);
+  }
+  out.extend(u64::try_from(cases.len()).unwrap().to_le_bytes());
+  let mut accepted = 0;
+  for case in &cases {
+    accepted += usize::from(write_case(&mut out, case));
+  }
+  assert_eq!(accepted, 20);
+  assert_eq!(cases.len(), 3636);
+  if let Some(path) = std::env::var_os("IX_PROOF_CODEC_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  eprintln!(
+    "proof codec: 4 verified native proofs, {} byte cases, {accepted} decodable",
+    cases.len()
+  );
+  Ok(())
+}
+
+#[test]
+fn malformed_proof_caps_reject_without_panicking() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(mul_toplevel(), cp, fp);
+  let (claim, proof) =
+    system.prove(0, &[G::ONE, G::ONE], &mut empty_io_buffer());
+  let mut bytes = proof.to_bytes().unwrap();
+  let offset = 8 + proof.active.len();
+  let roots = proof.commitments.stage_1_trace.num_roots();
+  bytes[offset..offset + 8].copy_from_slice(&0_u64.to_le_bytes());
+  bytes.drain(offset + 8..offset + 8 + roots * 32);
+  let malformed = AiurProof::from_bytes(&bytes).unwrap();
+  let result = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+    system.verify(&claim, &malformed)
+  }));
+  assert!(result.is_ok(), "deserialized proof cap caused verifier panic");
+  assert!(result.unwrap().is_err());
+}
diff --git a/crates/aiur/src/synthesis/tests/proof_shapes.rs b/crates/aiur/src/synthesis/tests/proof_shapes.rs
new file mode 100644
index 000000000..a3e79f8fa
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/proof_shapes.rs
@@ -0,0 +1,195 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Complete native shape checks with independent activation, domain and
+//! matrix dimension mutations. The PCS data is removed because shape
+//! acceptance alone makes no polynomial authentication assertion.
+
+use super::*;
+use multi_stark::types::ExtVal;
+
+fn bytes(out: &mut Vec<u8>, value: &[u8]) {
+  out.extend(u64::try_from(value.len()).unwrap().to_le_bytes());
+  out.extend(value);
+}
+
+fn modified(
+  proof: &AiurProof,
+  change: impl FnOnce(&mut AiurProof),
+) -> AiurProof {
+  let mut result = proof.clone();
+  change(&mut result);
+  result
+}
+
+fn remove_active(system: &AiurSystem, proof: &mut AiurProof, ci: usize) {
+  let position = proof.active[..ci].iter().filter(|&&active| active).count();
+  assert!(proof.active[ci]);
+  proof.active[ci] = false;
+  proof.log_degrees.remove(position);
+  let _ = proof.intermediate_accumulators.remove(position);
+  proof.stage_1_opened_values.remove(position);
+  proof.stage_2_opened_values.remove(position);
+  proof.quotient_opened_values.remove(position);
+  if let Some(slot) = system.system.preprocessed_indices[ci] {
+    proof.preprocessed_opened_values.as_mut().unwrap()[slot].clear();
+  }
+}
+
+fn variants(system: &AiurSystem, proof: &AiurProof) -> Vec<AiurProof> {
+  let mut cases = vec![proof.clone()];
+  cases.extend([
+    modified(proof, |p| p.active.clear()),
+    modified(proof, |p| p.active.push(false)),
+    modified(proof, |p| {
+      p.active.pop();
+    }),
+    modified(proof, |p| p.active.fill(false)),
+    modified(proof, |p| p.log_degrees.clear()),
+    modified(proof, |p| p.log_degrees.push(0)),
+    modified(proof, |p| {
+      p.log_degrees.pop();
+    }),
+    modified(proof, |p| p.intermediate_accumulators.clear()),
+    modified(proof, |p| p.intermediate_accumulators.push(ExtVal::ZERO)),
+    modified(proof, |p| {
+      p.intermediate_accumulators.pop();
+    }),
+    modified(proof, |p| p.intermediate_accumulators.fill(ExtVal::ONE)),
+    modified(proof, |p| p.preprocessed_opened_values = None),
+    modified(proof, |p| p.preprocessed_opened_values = Some(vec![])),
+    modified(proof, |p| {
+      p.preprocessed_opened_values.as_mut().unwrap().push(vec![])
+    }),
+    modified(proof, |p| {
+      p.preprocessed_opened_values.as_mut().unwrap().pop();
+    }),
+  ]);
+  for ci in 0..proof.active.len() {
+    cases.push(modified(proof, |p| p.active[ci] = !p.active[ci]));
+    if proof.active[ci] {
+      let inactive = modified(proof, |p| remove_active(system, p, ci));
+      system.system.verify_shape(&inactive).unwrap();
+      cases.push(inactive);
+    }
+  }
+  for position in 0..proof.log_degrees.len() {
+    for degree in 0..=255 {
+      cases.push(modified(proof, |p| p.log_degrees[position] = degree));
+    }
+  }
+  // Independently remove/append outer matrices, opening points and columns
+  // in each of the four rounds, including every quotient slice coordinate.
+  for round in 0..4 {
+    let select: fn(&mut AiurProof) -> &mut Vec<Vec<Vec<ExtVal>>> = match round {
+      0 => |p| &mut p.stage_1_opened_values,
+      1 => |p| &mut p.stage_2_opened_values,
+      2 => |p| &mut p.quotient_opened_values,
+      _ => |p| p.preprocessed_opened_values.as_mut().unwrap(),
+    };
+    cases.push(modified(proof, |p| select(p).clear()));
+    cases.push(modified(proof, |p| select(p).push(vec![])));
+    cases.push(modified(proof, |p| {
+      select(p).pop();
+    }));
+    let values = match round {
+      0 => &proof.stage_1_opened_values,
+      1 => &proof.stage_2_opened_values,
+      2 => &proof.quotient_opened_values,
+      _ => proof.preprocessed_opened_values.as_ref().unwrap(),
+    };
+    for (matrix, points) in values.iter().enumerate() {
+      cases.push(modified(proof, |p| select(p)[matrix].clear()));
+      cases.push(modified(proof, |p| select(p)[matrix].push(vec![])));
+      cases.push(modified(proof, |p| {
+        select(p)[matrix].pop();
+      }));
+      for point in 0..points.len() {
+        cases.push(modified(proof, |p| select(p)[matrix][point].clear()));
+        cases.push(modified(proof, |p| {
+          select(p)[matrix][point].push(ExtVal::ZERO)
+        }));
+        cases.push(modified(proof, |p| {
+          select(p)[matrix][point].pop();
+        }));
+      }
+    }
+  }
+  cases
+}
+
+#[test]
+fn proof_shape_snapshot() -> std::io::Result<()> {
+  let mut out = b"Aiur proof shapes v2\n".to_vec();
+  out.extend(4_u64.to_le_bytes());
+  let mut total = 0;
+  let mut accepted = 0;
+  for seed in 0..4 {
+    let (mut cp, mut fp) = test_parameters();
+    cp.log_blowup = 1 + seed % 2;
+    cp.cap_height = seed % 2 * 2;
+    fp.max_log_arity = seed % 2 + 1;
+    fp.num_queries = 8;
+    let top = match seed {
+      0 => mul_toplevel(),
+      1 => call_and_memory_toplevel(),
+      2 => xor_splits_toplevel(),
+      _ => unconstrained_call_promotion_toplevel(),
+    };
+    let input = if seed == 3 {
+      vec![G::from_u8(7)]
+    } else {
+      vec![G::from_u8(3), G::from_u8(5)]
+    };
+    let system = AiurSystem::build(top, cp, fp);
+    let (claim, mut proof) = system.prove(0, &input, &mut empty_io_buffer());
+    system.verify(&claim, &proof).unwrap();
+    proof.opening_proof.commit_phase_commits.clear();
+    proof.opening_proof.commit_pow_witnesses.clear();
+    proof.opening_proof.input_openings.clear();
+    proof.opening_proof.commit_phase_openings.clear();
+    proof.opening_proof.final_poly.clear();
+    proof.opening_proof.query_pow_witness = G::ZERO;
+    bytes(&mut out, &crate::vk_codec::to_bytes(&system.system, cp, fp));
+    let cases = variants(&system, &proof);
+    total += cases.len();
+    out.extend(u64::try_from(cases.len()).unwrap().to_le_bytes());
+    for case in cases {
+      bytes(&mut out, &case.to_bytes().unwrap());
+      let result = system.system.verify_shape(&case);
+      out.push(u8::from(result.is_ok()));
+      if let Ok(degrees) = result {
+        accepted += 1;
+        out.extend(u64::try_from(degrees.len()).unwrap().to_le_bytes());
+        for degree in degrees {
+          out.extend(u64::try_from(degree).unwrap().to_le_bytes());
+        }
+      }
+      out.push(u8::from(fixed_trace_heights(
+        system.system.circuits.iter().map(|c| c.preprocessed_height),
+        &case.active,
+        &case.log_degrees,
+      )));
+      let budget = lookup_query_bound(
+        system.slot_widths.iter().map(Vec::len),
+        &case.active,
+        &case.log_degrees,
+      );
+      out.push(u8::from(budget.is_some()));
+      if let Some(bound) = budget {
+        out.extend(bound.to_le_bytes());
+      }
+      out.push(u8::from(crate::trace_heights::trace_cap_coverage(
+        cp.log_blowup,
+        cp.cap_height,
+        &case.log_degrees,
+      )));
+    }
+  }
+  if let Some(path) = std::env::var_os("IX_PROOF_SHAPE_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  assert_eq!((total, accepted), (4696, 510));
+  eprintln!("proof shapes: {total} native cases, {accepted} accepted shapes");
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/pruned_merkle.rs b/crates/aiur/src/synthesis/tests/pruned_merkle.rs
new file mode 100644
index 000000000..a97e4a138
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/pruned_merkle.rs
@@ -0,0 +1,279 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Actual shared MMCS decisions and hash calls, including late failures.
+
+use super::merkle::{
+  Calls, Digest, RecordingHash, RecordingMmcs, digests, number,
+};
+use super::*;
+use multi_stark::{
+  p3_field::PrimeField64,
+  p3_matrix::{Dimensions, Matrix},
+  types::Mmcs,
+};
+use p3_blake3::Blake3;
+use p3_commit::Mmcs as _;
+use p3_merkle_tree::PrunedMerklePaths;
+use p3_symmetric::{
+  CompressionFunctionFromHasher, MerkleCap, SerializingHasher,
+};
+
+#[derive(Clone)]
+struct Case {
+  dimensions: Vec<Dimensions>,
+  indices: Vec<usize>,
+  rows: Vec<Vec<Vec<G>>>,
+  proof: Vec<Digest>,
+  cap: Vec<Digest>,
+  cap_height: usize,
+}
+
+#[derive(Default)]
+struct Corpus {
+  body: Vec<u8>,
+  count: usize,
+  accepted: usize,
+  omitted: usize,
+  unhashed: usize,
+  late: usize,
+  calls: usize,
+}
+
+impl Corpus {
+  fn record(&mut self, case: &Case, expected: Option<bool>) -> usize {
+    let native = Mmcs::new(
+      SerializingHasher::new(Blake3),
+      CompressionFunctionFromHasher::new(Blake3),
+      case.cap_height,
+    );
+    let cap = MerkleCap::new(case.cap.clone());
+    let proof = PrunedMerklePaths { sibling_hashes: case.proof.clone() };
+    let accepted = native
+      .verify_multi_batch(
+        &cap,
+        &case.dimensions,
+        &case.indices,
+        &case.rows,
+        &proof,
+      )
+      .is_ok();
+    if let Some(expected) = expected {
+      assert_eq!(accepted, expected);
+    }
+    let calls = Calls::default();
+    let hash = RecordingHash(calls.clone());
+    let recording = RecordingMmcs::new(
+      SerializingHasher::new(hash.clone()),
+      CompressionFunctionFromHasher::new(hash),
+      case.cap_height,
+    );
+    let recorded = recording
+      .verify_multi_batch(
+        &cap,
+        &case.dimensions,
+        &case.indices,
+        &case.rows,
+        &proof,
+      )
+      .is_ok();
+    assert_eq!(accepted, recorded);
+    let calls = calls.lock().unwrap();
+    let degrees: Vec<u8> = case
+      .dimensions
+      .iter()
+      .map(|dims| u8::try_from(dims.height.ilog2()).unwrap())
+      .collect();
+    let covered =
+      crate::trace_heights::trace_cap_coverage(0, case.cap_height, &degrees);
+    self.count += 1;
+    self.accepted += usize::from(accepted);
+    self.omitted += usize::from(accepted && !covered);
+    self.unhashed += usize::from(calls.is_empty());
+    self.late += usize::from(!accepted && !calls.is_empty());
+    self.calls += calls.len();
+    let out = &mut self.body;
+    number(out, case.dimensions.len());
+    for dims in &case.dimensions {
+      number(out, dims.width);
+      number(out, usize::try_from(dims.height.ilog2()).unwrap());
+    }
+    number(out, case.cap_height);
+    number(out, case.indices.len());
+    for &index in &case.indices {
+      number(out, index);
+    }
+    number(out, case.rows.len());
+    for query in &case.rows {
+      number(out, query.len());
+      for row in query {
+        number(out, row.len());
+        for value in row {
+          out.extend(value.as_canonical_u64().to_le_bytes());
+        }
+      }
+    }
+    digests(out, &case.proof);
+    digests(out, &case.cap);
+    out.extend([u8::from(accepted), u8::from(covered)]);
+    number(out, calls.len());
+    for (input, digest) in calls.iter() {
+      number(out, input.len());
+      out.extend(input);
+      out.extend(digest);
+    }
+    calls.len()
+  }
+}
+
+#[test]
+fn pruned_merkle_snapshot() -> std::io::Result<()> {
+  let shapes = [
+    vec![0],
+    vec![1],
+    vec![3],
+    vec![5],
+    vec![3, 1],
+    vec![1, 3],
+    vec![3, 0, 2, 1],
+    vec![2, 2, 2],
+    vec![1, 4, 1, 4, 0],
+    vec![4, 2, 3, 2],
+  ];
+  let widths = [1, 2, 3, 17, 33, 129];
+  let mut corpus = Corpus::default();
+  for (fixture, logs) in shapes.into_iter().enumerate() {
+    let max_log = *logs.iter().max().unwrap();
+    let height = 1 << max_log;
+    let matrices: Vec<_> = logs
+      .iter()
+      .enumerate()
+      .map(|(matrix, log)| {
+        let width = widths[(fixture + matrix * 3) % widths.len()];
+        let values = (0..width * (1 << log))
+          .map(|i| {
+            if i % 5 == 0 {
+              -G::ONE
+            } else {
+              G::from_u64(
+                u64::try_from(i * 65537 + matrix * 257 + fixture).unwrap(),
+              )
+            }
+          })
+          .collect();
+        RowMajorMatrix::new(values, width)
+      })
+      .collect();
+    let dimensions: Vec<_> = matrices.iter().map(Matrix::dimensions).collect();
+    let queries = [
+      vec![],
+      vec![0],
+      vec![height - 1],
+      (0..height).collect(),
+      (0..height).rev().collect(),
+      (0..height).step_by(2).collect(),
+      (1..height).step_by(2).collect(),
+      vec![height - 1, 0, height / 2, height - 1, 0],
+      vec![0, 0, 0],
+      vec![0, (2 % height)],
+    ];
+    for cap_height in 0..=max_log + 2 {
+      let mmcs = Mmcs::new(
+        SerializingHasher::new(Blake3),
+        CompressionFunctionFromHasher::new(Blake3),
+        cap_height,
+      );
+      let (cap, data) = mmcs.commit(matrices.clone());
+      for indices in &queries {
+        let (rows, proof) = mmcs.open_multi_batch(indices, &data);
+        let case = Case {
+          dimensions: dimensions.clone(),
+          indices: indices.clone(),
+          rows,
+          proof: proof.sibling_hashes,
+          cap: cap.roots().to_vec(),
+          cap_height,
+        };
+        corpus.record(&case, Some(true));
+        let mut changed = case.clone();
+        changed.proof.push([0; 32]);
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.rows.push(vec![]);
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.dimensions.clear();
+        corpus.record(&changed, Some(false));
+        if case.indices.is_empty() {
+          continue;
+        }
+        for (matrix, &log) in logs.iter().enumerate() {
+          let omitted = log < cap_height.min(max_log);
+          let mut changed = case.clone();
+          for query in &mut changed.rows {
+            query[matrix][0] += G::ONE;
+          }
+          corpus.record(&changed, Some(omitted));
+          let mut changed = case.clone();
+          changed.rows[0][matrix][0] += G::ONE;
+          corpus.record(&changed, if omitted { None } else { Some(false) });
+        }
+        if !case.proof.is_empty() {
+          let mut changed = case.clone();
+          changed.proof.pop();
+          corpus.record(&changed, Some(false));
+          let mut changed = case.clone();
+          changed.proof[0][fixture % 32] ^= 1;
+          corpus.record(&changed, Some(false));
+        }
+        let mut changed = case.clone();
+        changed.dimensions[0].width += 1;
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.indices[0] = height;
+        corpus.record(&changed, Some(false));
+        let mut changed = case.clone();
+        changed.cap[0][fixture % 32] ^= 1;
+        corpus.record(&changed, None);
+        let mut changed = case.clone();
+        changed.cap.truncate(1);
+        corpus.record(&changed, None);
+        let mut changed = case.clone();
+        changed.rows[0].pop();
+        corpus.record(&changed, Some(false));
+        if logs == [3, 1] && cap_height == 0 && indices == &[0, 2] {
+          let mut changed = case.clone();
+          changed.rows[1][1][0] += G::ONE;
+          assert_eq!(corpus.record(&changed, Some(false)), 5);
+        }
+      }
+    }
+  }
+  assert!(corpus.accepted > 100 && corpus.omitted > 100);
+  assert!(corpus.unhashed > 1000 && corpus.late > 1000);
+  let mut out = b"Aiur pruned Merkle v1\n".to_vec();
+  for count in [
+    corpus.count,
+    corpus.accepted,
+    corpus.omitted,
+    corpus.unhashed,
+    corpus.late,
+    corpus.calls,
+  ] {
+    number(&mut out, count);
+  }
+  out.extend(corpus.body);
+  println!(
+    "Pruned Merkle: {} cases, {} accepted, {} omitted, {} unhashed, {} late, {} calls",
+    corpus.count,
+    corpus.accepted,
+    corpus.omitted,
+    corpus.unhashed,
+    corpus.late,
+    corpus.calls
+  );
+  if let Some(path) = std::env::var_os("IX_PRUNED_MERKLE_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/synthesis/tests/scalar.rs b/crates/aiur/src/synthesis/tests/scalar.rs
new file mode 100644
index 000000000..09be7db57
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/scalar.rs
@@ -0,0 +1,125 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+use multi_stark::eval::{VarValues, eval_expr};
+use multi_stark::p3_field::Field;
+
+fn eq_zero_program() -> Toplevel {
+  with_singleton_circuits(
+    vec![Function {
+      body: Block { ops: vec![Op::EqZero(0)], ctrl: Ctrl::Return(0, vec![1]) },
+      layout: FunctionLayout {
+        input_size: 1,
+        selectors: 1,
+        auxiliaries: 9,
+        lookups: 4,
+      },
+      entry: true,
+      constrained: true,
+    }],
+    vec![],
+  )
+}
+
+/// Check the actual emitted expressions over inactive, active and malformed
+/// selectors. Inactive rows may carry arbitrary equality-test advice.
+#[test]
+fn scalar_constraints_extract_boolean_and_eq_zero_semantics() {
+  let top = eq_zero_program();
+  let (function, _) = top.build_constraints(0);
+  let (_, memory, _) = Memory::build(1);
+  let inputs = [G::ZERO, G::from_u8(3), -G::ONE];
+  let selectors = [G::ZERO, G::ONE, G::from_u8(2), -G::ONE];
+  let outputs = [G::ZERO, G::ONE, G::from_u8(2)];
+  for input in inputs {
+    for selector in selectors {
+      for output in outputs {
+        for inverse in
+          [G::ZERO, G::from_u8(4), input.try_inverse().unwrap_or_default()]
+        {
+          let mut row = vec![G::ZERO; function.width];
+          row[0] = input;
+          row[1] = selector;
+          row[9] = inverse;
+          row[10] = output;
+          let values = VarValues {
+            preprocessed: [&[], &[]],
+            main: [&row, &row],
+            stage2: [&[], &[]],
+            publics: &[],
+            is_first_row: G::ZERO,
+            is_last_row: G::ONE,
+            is_transition: G::ZERO,
+          };
+          let satisfied =
+            function.zeros.iter().all(|e| eval_expr(e, &values) == G::ZERO);
+          let expected = selector == G::ZERO
+            || (selector == G::ONE
+              && output == G::from_bool(input == G::ZERO)
+              && (input == G::ZERO || Some(inverse) == input.try_inverse()));
+          assert_eq!(
+            satisfied, expected,
+            "input {input}, selector {selector}, output {output}, inverse {inverse}"
+          );
+          // Same selector column in memory. Multiplicity remains zero and
+          // this last row has no active transition constraints.
+          let memory_row = [G::ZERO, selector, G::from_u8(7), G::from_u8(8)];
+          let memory_values =
+            VarValues { main: [&memory_row, &memory_row], ..values };
+          assert_eq!(
+            memory.iter().all(|e| eval_expr(e, &memory_values) == G::ZERO),
+            selector == G::ZERO || selector == G::ONE,
+            "memory selector {selector}"
+          );
+        }
+      }
+    }
+  }
+}
+
+/// Supply rows independently of the executor, with balanced public/function
+/// and rank-byte messages. Forged outputs must fail the native verifier.
+#[test]
+fn supplied_eq_zero_outputs_are_constrained() {
+  let (cp, fp) = test_parameters();
+  let system = AiurSystem::build(eq_zero_program(), cp, fp);
+  let three = G::from_u8(3);
+  let inverse = three.inverse();
+  let cases = [
+    (G::ZERO, G::from_u8(4), G::ONE, true),
+    (three, inverse, G::ZERO, true),
+    (G::ZERO, G::from_u8(4), G::ZERO, false),
+    (three, G::ZERO, G::ONE, false),
+    (three, -inverse, G::from_u8(2), false),
+  ];
+  for (input, advice, output, accepted) in cases {
+    let claim = [function_channel(), G::ZERO, input, output];
+    let traces = system
+      .circuit_shapes()
+      .iter()
+      .enumerate()
+      .map(|(index, shape)| {
+        let height = if index == 0 { 4 } else { shape.preprocessed_height };
+        let mut rows = vec![G::ZERO; height * shape.main_width];
+        if index == 0 {
+          rows[0] = input;
+          rows[1] = G::ONE;
+          rows[2] = G::ONE;
+          rows[9] = advice;
+          rows[10] = output;
+        } else if index == 2 {
+          rows[6] = G::from_u8(3);
+        }
+        RowMajorMatrix::new(rows, shape.main_width)
+      })
+      .collect();
+    let witness = SystemWitness::from_stage_1(traces, &system.system);
+    let proof = system.system.prove(&system.key, &claim, witness);
+    assert_eq!(
+      system.verify(&claim, &proof).is_ok(),
+      accepted,
+      "input {input}, inverse advice {advice}, output {output}"
+    );
+  }
+}
diff --git a/crates/aiur/src/synthesis/tests/transcript.rs b/crates/aiur/src/synthesis/tests/transcript.rs
new file mode 100644
index 000000000..91c1bb82c
--- /dev/null
+++ b/crates/aiur/src/synthesis/tests/transcript.rs
@@ -0,0 +1,379 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Record the actual generic native verifier's transcript, including its
+//! PCS continuation. The wrapper delegates every operation to the pinned
+//! challenger. Separate mock-hash cases force rejection sampling boundaries.
+
+use super::*;
+use multi_stark::{
+  config::StarkGenericConfig,
+  p3_field::PrimeField64,
+  types::{Challenger, ExtVal, Pcs},
+};
+use p3_blake3::Blake3;
+use p3_challenger::{
+  CanObserve, CanSample, CanSampleBits, FieldChallenger, GrindingChallenger,
+  HashChallenger, SerializingChallenger64,
+};
+use p3_symmetric::{CryptographicHasher, MerkleCap};
+use std::sync::{Arc, Mutex};
+
+#[derive(Clone, Debug)]
+enum Event {
+  Observe(Vec<u8>),
+  Field(G),
+  Bits(usize, usize),
+}
+
+type Events = Arc<Mutex<Vec<Event>>>;
+type Dft = <AiurConfig as StarkGenericConfig>::Dft;
+type Commitment = MerkleCap<G, [u8; 32]>;
+
+#[derive(Clone)]
+struct RecordingChallenger {
+  inner: Challenger,
+  events: Events,
+}
+
+impl CanObserve<G> for RecordingChallenger {
+  fn observe(&mut self, value: G) {
+    self.inner.observe(value);
+    self
+      .events
+      .lock()
+      .unwrap()
+      .push(Event::Observe(value.as_canonical_u64().to_le_bytes().to_vec()));
+  }
+}
+
+impl CanObserve<Commitment> for RecordingChallenger {
+  fn observe(&mut self, value: Commitment) {
+    self.inner.observe(value.clone());
+    self
+      .events
+      .lock()
+      .unwrap()
+      .push(Event::Observe(value.roots().iter().flatten().copied().collect()));
+  }
+}
+
+impl CanSample<G> for RecordingChallenger {
+  fn sample(&mut self) -> G {
+    let value = self.inner.sample();
+    self.events.lock().unwrap().push(Event::Field(value));
+    value
+  }
+}
+
+impl CanSample<ExtVal> for RecordingChallenger {
+  fn sample(&mut self) -> ExtVal {
+    self.sample_algebra_element()
+  }
+}
+
+impl CanSampleBits<usize> for RecordingChallenger {
+  fn sample_bits(&mut self, bits: usize) -> usize {
+    let value = self.inner.sample_bits(bits);
+    self.events.lock().unwrap().push(Event::Bits(bits, value));
+    value
+  }
+}
+
+impl FieldChallenger<G> for RecordingChallenger {}
+
+impl GrindingChallenger for RecordingChallenger {
+  type Witness = G;
+
+  fn grind(&mut self, bits: usize) -> G {
+    self.inner.grind(bits)
+  }
+  // The trait's check_witness calls our observed-field and sampled-bit
+  // methods, and consumes nothing at zero bits, just like the native type.
+}
+
+struct RecordingConfig {
+  inner: AiurConfig,
+  events: Events,
+}
+
+impl StarkGenericConfig for RecordingConfig {
+  type Pcs = Pcs;
+  type Dft = Dft;
+  type Challenge = ExtVal;
+  type Challenger = RecordingChallenger;
+
+  fn pcs(&self) -> &Pcs {
+    self.inner.pcs()
+  }
+  fn dft(&self) -> &Dft {
+    self.inner.dft()
+  }
+  fn initialise_challenger(&self) -> RecordingChallenger {
+    RecordingChallenger {
+      inner: self.inner.initialise_challenger(),
+      events: self.events.clone(),
+    }
+  }
+  fn max_log_degree(&self) -> usize {
+    self.inner.max_log_degree()
+  }
+  fn max_quotient_degree(&self) -> usize {
+    self.inner.max_quotient_degree()
+  }
+  fn log_blowup(&self) -> usize {
+    self.inner.log_blowup()
+  }
+}
+
+fn number(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn bytes(out: &mut Vec<u8>, value: &[u8]) {
+  number(out, value.len());
+  out.extend(value);
+}
+
+fn field(out: &mut Vec<u8>, value: G) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn event(out: &mut Vec<u8>, event: &Event) {
+  match event {
+    Event::Observe(value) => {
+      out.push(0);
+      bytes(out, value);
+    },
+    Event::Field(value) => {
+      out.push(1);
+      field(out, *value);
+    },
+    Event::Bits(bits, value) => {
+      out.push(2);
+      number(out, *bits);
+      number(out, *value);
+    },
+  }
+}
+
+fn record(
+  out: &mut Vec<u8>,
+  system: &AiurSystem,
+  proof: &AiurProof,
+  claims: &[Vec<G>],
+  expected: bool,
+) {
+  let cp = system.commitment_parameters;
+  let fp = system.fri_parameters;
+  let events = Events::default();
+  let key_bytes = crate::vk_codec::to_bytes(&system.system, cp, fp);
+  let (decoded, _, _) = crate::vk_codec::from_bytes(&key_bytes).unwrap();
+  let instrumented = System {
+    config: RecordingConfig {
+      inner: AiurConfig::new(cp, fp),
+      events: events.clone(),
+    },
+    circuits: decoded.circuits,
+    preprocessed_commit: decoded.preprocessed_commit,
+    preprocessed_indices: decoded.preprocessed_indices,
+  };
+  let proof_bytes = proof.to_bytes().unwrap();
+  let copied = Proof::<RecordingConfig>::from_bytes(&proof_bytes).unwrap();
+  let claim_slices: Vec<&[G]> = claims.iter().map(Vec::as_slice).collect();
+  let accepted = instrumented.verify_multiple_claims(&claim_slices, &copied);
+  assert_eq!(accepted.is_ok(), expected);
+  // Compare with the original concrete native configuration as well.
+  assert_eq!(
+    system.system.verify_multiple_claims(&claim_slices, proof).is_ok(),
+    expected
+  );
+  let events = events.lock().unwrap();
+  assert!(events.iter().filter(|e| matches!(e, Event::Field(_))).count() >= 8);
+  bytes(out, &key_bytes);
+  bytes(out, &proof_bytes);
+  number(out, claims.len());
+  for claim in claims {
+    number(out, claim.len());
+    for value in claim {
+      field(out, *value);
+    }
+  }
+  out.push(u8::from(expected));
+  number(out, events.len());
+  for value in events.iter() {
+    event(out, value);
+  }
+}
+
+#[derive(Clone)]
+struct ScriptHasher {
+  first: [u8; 32],
+  later: [u8; 32],
+}
+
+impl CryptographicHasher<u8, [u8; 32]> for ScriptHasher {
+  fn hash_iter<I: IntoIterator<Item = u8>>(&self, input: I) -> [u8; 32] {
+    if input.into_iter().count() == 1 { self.first } else { self.later }
+  }
+}
+
+#[derive(Clone)]
+struct CountedBytes<C> {
+  inner: C,
+  consumed: Arc<Mutex<usize>>,
+}
+
+impl<C: CanSample<u8>> CanSample<u8> for CountedBytes<C> {
+  fn sample(&mut self) -> u8 {
+    *self.consumed.lock().unwrap() += 1;
+    self.inner.sample()
+  }
+}
+
+impl<C: CanObserve<u8>> CanObserve<u8> for CountedBytes<C> {
+  fn observe(&mut self, value: u8) {
+    self.inner.observe(value);
+  }
+}
+
+fn digest(words: [u64; 4]) -> [u8; 32] {
+  let mut value: Vec<u8> =
+    words.iter().flat_map(|word| word.to_le_bytes()).collect();
+  value.reverse();
+  value.try_into().unwrap()
+}
+
+fn rejections(out: &mut Vec<u8>) {
+  number(out, 16);
+  for mask in 0..16 {
+    let first = digest(std::array::from_fn(|i| {
+      if mask & (1 << i) == 0 {
+        [G::ORDER_U64, G::ORDER_U64 + 1, u64::MAX, G::ORDER_U64 + 3][i]
+      } else {
+        [0, G::ORDER_U64 - 1, 1 << 32, u64::MAX - (1 << 32)][i]
+      }
+    }));
+    let later = digest([11, 12, 13, 14]);
+    let consumed = Arc::new(Mutex::new(0));
+    let inner = HashChallenger::new(vec![mask], ScriptHasher { first, later });
+    let mut native = SerializingChallenger64::<G, _>::new(CountedBytes {
+      inner,
+      consumed: consumed.clone(),
+    });
+    let c0: G = native.sample();
+    let first_attempts = *consumed.lock().unwrap() / 8;
+    let c1: G = native.sample();
+    let second_attempts = *consumed.lock().unwrap() / 8 - first_attempts;
+    assert!((1..=5).contains(&first_attempts));
+    assert!((1..=4).contains(&second_attempts));
+    out.push(mask);
+    out.extend(first);
+    out.extend(later);
+    field(out, c0);
+    field(out, c1);
+    number(out, first_attempts);
+    number(out, second_attempts);
+    // Raw bit samples also verify where both rejection loops left the stream.
+    for bits in [0, 1, 7, 31, 32, 63] {
+      number(out, native.sample_bits(bits));
+    }
+  }
+}
+
+fn byte_streams(out: &mut Vec<u8>) {
+  number(out, 16);
+  for seed in 0..16usize {
+    let initial: Vec<u8> =
+      (0..seed * 17).map(|i| u8::try_from(i * 73 % 256).unwrap()).collect();
+    bytes(out, &initial);
+    let mut native = HashChallenger::new(initial, Blake3);
+    number(out, 80);
+    for step in 0..80 {
+      if step % 7 == 0 {
+        let values: Vec<u8> = (0..(step + seed) % 5)
+          .map(|i| u8::try_from((i + step * 31) % 256).unwrap())
+          .collect();
+        native.observe_slice(&values);
+        event(out, &Event::Observe(values));
+      } else {
+        let value: u8 = native.sample();
+        out.push(3);
+        out.push(value);
+      }
+    }
+  }
+}
+
+fn witnesses(out: &mut Vec<u8>) {
+  number(out, 48);
+  for seed in 0..8 {
+    for bits in [0, 1, 2, 3, 7, 12] {
+      let initial = vec![seed, 93, bits];
+      bytes(out, &initial);
+      let mut native = Challenger::from_hasher(initial, Blake3);
+      // Populate pending output first to distinguish an empty observation
+      // from an output reset, including the zero-bit witness branch.
+      field(out, native.sample());
+      number(out, usize::from(bits));
+      let witness = G::from_u8(seed) - G::ONE;
+      field(out, witness);
+      out.push(u8::from(native.check_witness(usize::from(bits), witness)));
+      field(out, native.sample());
+    }
+  }
+}
+
+#[test]
+fn transcript_snapshot() -> std::io::Result<()> {
+  let mut out = b"Aiur transcript v1\n".to_vec();
+  byte_streams(&mut out);
+  rejections(&mut out);
+  witnesses(&mut out);
+  number(&mut out, 40);
+  for seed in 0..4 {
+    let (mut cp, mut fp) = test_parameters();
+    cp.cap_height = seed % 2 * 2;
+    fp.max_log_arity = seed % 2 + 1;
+    fp.num_queries = 8;
+    fp.commit_proof_of_work_bits = if seed == 2 { 3 } else { 0 };
+    fp.query_proof_of_work_bits = if seed == 2 { 3 } else { 0 };
+    let top = match seed {
+      0 => mul_toplevel(),
+      1 => call_and_memory_toplevel(),
+      2 => xor_splits_toplevel(),
+      _ => unconstrained_call_promotion_toplevel(),
+    };
+    let input = if seed == 3 {
+      vec![G::from_u8(7)]
+    } else {
+      vec![G::from_u8(3), G::from_u8(5)]
+    };
+    let system = AiurSystem::build(top, cp, fp);
+    let (claim, proof) = system.prove(0, &input, &mut empty_io_buffer());
+    for variant in 0..10 {
+      let mut proof = proof.clone();
+      let mut claims = vec![claim.clone()];
+      match variant {
+        0 => {},
+        1 => claims[0][0] += G::ONE,
+        2 => claims = vec![claim[..1].to_vec(), claim[1..].to_vec()],
+        3 => claims.clear(),
+        4 => claims = vec![vec![], vec![]],
+        5 => claims[0].push(G::ZERO),
+        6 => claims.insert(0, vec![]),
+        7 => {
+          proof.commitments.stage_1_trace =
+            proof.commitments.stage_2_trace.clone()
+        },
+        8 => proof.stage_1_opened_values[0][0][0] += ExtVal::ONE,
+        _ => proof.log_degrees[0] += 1,
+      }
+      record(&mut out, &system, &proof, &claims, variant == 0);
+    }
+  }
+  if let Some(path) = std::env::var_os("IX_TRANSCRIPT_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/trace.rs b/crates/aiur/src/trace.rs
index 66e88cf92..957c4900a 100644
--- a/crates/aiur/src/trace.rs
+++ b/crates/aiur/src/trace.rs
@@ -13,6 +13,7 @@ use rayon::{
 use crate::{
   FxIndexMap, G,
   bytecode::{Block, Ctrl, Function, FunctionLayout, Op, Toplevel},
+  call_order::{RANK_BOUND, RANK_BYTES, RankRanges, merge_ranges},
   execute::{
     IOBuffer, IOKeyInfo, QueryRecord, find_unconstrained_big_uint_div_mod,
     g_inverse_value,
@@ -37,6 +38,7 @@ struct ColumnMutSlice<'a, 'b> {
   selectors: &'a mut [G],
   auxiliaries: &'a mut [G],
   lookups: &'a mut LookupRowMut<'b, G>,
+  rank_ranges: &'a mut RankRanges,
 }
 
 type Degree = u8;
@@ -66,6 +68,7 @@ impl<'a, 'b> ColumnMutSlice<'a, 'b> {
     sel_offset: usize,
     slice: &'a mut [G],
     lookups: &'a mut LookupRowMut<'b, G>,
+    rank_ranges: &'a mut RankRanges,
   ) -> Self {
     let (inputs, slice) = slice.split_at_mut(circuit_layout.input_size);
     let (selectors, auxiliaries) = slice.split_at_mut(circuit_layout.selectors);
@@ -73,7 +76,7 @@ impl<'a, 'b> ColumnMutSlice<'a, 'b> {
     let inputs = &mut inputs[..function.layout.input_size];
     let selectors =
       &mut selectors[sel_offset..sel_offset + function.layout.selectors];
-    Self { inputs, selectors, auxiliaries, lookups }
+    Self { inputs, selectors, auxiliaries, lookups, rank_ranges }
   }
 
   fn push_auxiliary(&mut self, index: &mut ColumnIndex, t: G) {
@@ -90,12 +93,29 @@ impl<'a, 'b> ColumnMutSlice<'a, 'b> {
     self.lookups.push(index.lookup, multiplicity, args);
     index.lookup += 1;
   }
+
+  fn push_rank_bytes(&mut self, index: &mut ColumnIndex, rank: u64) {
+    assert!(rank < RANK_BOUND, "call-order rank exceeds 48 bits");
+    let bytes = rank.to_le_bytes();
+    for &byte in &bytes[..RANK_BYTES] {
+      self.push_auxiliary(index, G::from_u8(byte));
+    }
+    for pair in bytes[..RANK_BYTES].as_chunks::<2>().0 {
+      self.push_lookup(
+        index,
+        G::ONE,
+        &[u8_range_check_channel(), G::from_u8(pair[0]), G::from_u8(pair[1])],
+      );
+      *self.rank_ranges.entry([pair[0], pair[1]]).or_insert(G::ZERO) += G::ONE;
+    }
+  }
 }
 
 #[derive(Clone, Copy)]
 struct TraceContext<'a> {
   function_index: G,
   multiplicity: G,
+  rank: u64,
   inputs: &'a [G],
   output: &'a [G],
   query_record: &'a QueryRecord,
@@ -113,13 +133,13 @@ struct RowMeta<'a> {
 }
 
 impl Toplevel {
-  pub fn witness_data(
+  pub(crate) fn witness_data(
     &self,
     circuit_index: usize,
     query_record: &QueryRecord,
     io_buffer: &IOBuffer,
     slot_arg_widths: &[usize],
-  ) -> (RowMajorMatrix<G>, LookupValues<G>) {
+  ) -> (RowMajorMatrix<G>, LookupValues<G>, RankRanges) {
     let circuit = &self.circuits[circuit_index];
     let layout = &circuit.layout;
     let width = layout.width();
@@ -157,11 +177,11 @@ impl Toplevel {
     // rows need no writes at all.
     let mut builder = LookupValues::builder(height, slot_arg_widths);
     let mut row_writers = builder.rows_mut();
-    rows_no_padding
+    let rank_ranges = rows_no_padding
       .par_chunks_mut(width)
       .zip(row_writers[..height_no_padding].par_iter_mut())
       .enumerate()
-      .for_each(|(i, (row, lookups))| {
+      .fold(RankRanges::default, |mut rank_ranges, (i, (row, lookups))| {
         let meta = &rows_meta[i];
         let index = &mut ColumnIndex {
           auxiliary: 0,
@@ -174,19 +194,23 @@ impl Toplevel {
           meta.sel_offset,
           row,
           lookups,
+          &mut rank_ranges,
         );
         let context = TraceContext {
           function_index: meta.function_index,
           inputs: meta.inputs,
           multiplicity: meta.result.multiplicity,
+          rank: meta.result.rank,
           output: meta.result.output,
           query_record,
         };
         meta.function.populate_row(index, slice, context, io_buffer);
-      });
+        rank_ranges
+      })
+      .reduce(RankRanges::default, merge_ranges);
     drop(row_writers);
     let trace = RowMajorMatrix::new(rows, width);
-    (trace, builder.finish())
+    (trace, builder.finish(), rank_ranges)
   }
 }
 
@@ -217,6 +241,7 @@ impl Function {
       .for_each(|(i, arg)| slice.inputs[i] = *arg);
     // Push the multiplicity
     slice.push_auxiliary(index, context.multiplicity);
+    slice.push_rank_bytes(index, context.rank);
     let _ = self.body.populate_row(map, index, slice, context, io_buffer);
   }
 }
@@ -279,6 +304,7 @@ impl Ctrl {
           context.function_index,
           context.inputs,
           context.output,
+          context.rank,
         );
         // The first lookup slot is reserved for the function return, which
         // pulls the query claim with the query's multiplicity.
@@ -391,8 +417,15 @@ impl Op {
             G::from_usize(*function_index),
             &inputs,
             result.output,
+            result.rank,
           );
+          slice.push_auxiliary(index, G::from_u64(result.rank));
           slice.push_lookup(index, G::ONE, &args);
+          let gap = result
+            .rank
+            .checked_sub(context.rank + 1)
+            .expect("constrained call does not increase rank");
+          slice.push_rank_bytes(index, gap);
         }
       },
       Op::Store(values) => {
@@ -696,9 +729,11 @@ fn function_lookup_args(
   function_index: G,
   inputs: &[G],
   output: &[G],
+  rank: u64,
 ) -> Vec<G> {
   let mut args = vec![function_channel(), function_index];
   args.extend(inputs);
   args.extend(output);
+  args.push(G::from_u64(rank));
   args
 }
diff --git a/crates/aiur/src/trace_heights.rs b/crates/aiur/src/trace_heights.rs
new file mode 100644
index 000000000..3db0dc178
--- /dev/null
+++ b/crates/aiur/src/trace_heights.rs
@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+/// Match active-order degrees to canonical fixed preprocessed heights.
+/// Zero denotes a circuit without a fixed height; inactive unfixed circuits
+/// consume no degree. Fixed circuits must be active. This check precedes PCS
+/// verification so fixed-table extraction
+/// has an explicit height condition at the Aiur verifier boundary.
+pub(crate) fn fixed_trace_heights(
+  heights: impl ExactSizeIterator<Item = usize>,
+  active: &[bool],
+  log_degrees: &[u8],
+) -> bool {
+  if heights.len() != active.len() {
+    return false;
+  }
+  let mut degrees = log_degrees.iter();
+  for (height, &is_active) in heights.zip(active) {
+    if height != 0 && !is_active {
+      return false;
+    }
+    if is_active {
+      let Some(&degree) = degrees.next() else {
+        return false;
+      };
+      if height != 0 {
+        let Some(actual) = 1_u64.checked_shl(u32::from(degree)) else {
+          return false;
+        };
+        if u64::try_from(height) != Ok(actual) {
+          return false;
+        }
+      }
+    }
+  }
+  degrees.next().is_none()
+}
+
+/// Every input matrix must be injected before the path reaches the cap.
+/// The native MMCS clamps a cap to the tallest matrix's tree depth; that
+/// still omits shorter matrices when the cap lies below their injection.
+/// Subtract the shared blowup first, avoiding machine addition overflow.
+pub(crate) fn trace_cap_coverage(
+  log_blowup: usize,
+  cap_height: usize,
+  log_degrees: &[u8],
+) -> bool {
+  let maximum = log_degrees.iter().copied().max().unwrap_or(0);
+  let effective =
+    cap_height.saturating_sub(log_blowup).min(usize::from(maximum));
+  log_degrees.iter().all(|&degree| effective <= usize::from(degree))
+}
diff --git a/crates/aiur/src/vk_codec.rs b/crates/aiur/src/vk_codec.rs
index 9fa9e00ec..f70657734 100644
--- a/crates/aiur/src/vk_codec.rs
+++ b/crates/aiur/src/vk_codec.rs
@@ -28,12 +28,11 @@
 //!                log_final_poly_len, max_log_arity, num_queries,
 //!                commit_proof_of_work_bits, query_proof_of_work_bits)
 //!   u16          circuit count
-//! PER-CIRCUIT RECORDS (circuit count times; each is `u32 LE len` + `len` bytes
-//!                      so a record is a contiguous byte range)
+//! PER-CIRCUIT RECORDS (circuit count times, without a length prefix)
 //!   u16 main_width, u16 preprocessed_width, u32 preprocessed_height,
 //!   u16 max_constraint_degree (combined user + logUp),
 //!   u8 lookup_group_size (k: lookups per chained accumulator step)
-//!   node_count nodes, each a u8 tag then payload:
+//!   u16 node_count, then node_count nodes, each a u8 tag then payload:
 //!     0  ConstSmall: u16 LE canonical value
 //!     1  ConstBig:   u64 LE canonical value
 //!     2  Public:     u8 index
@@ -42,8 +41,8 @@
 //!     9  Neg: u16 LE child node id
 //!     10..=15  Var (tag = 10 + 2*source + offset; source 0 Preprocessed
 //!              1 Main 2 Stage2, offset 0 current 1 next): u16 LE column
-//!   u32 zero_count, then zero_count x u16 LE constraint-root node ids
-//!   u32 lookup_count, then per lookup:
+//!   u16 zero_count, then zero_count x u16 LE constraint-root node ids
+//!   u16 lookup_count, then per lookup:
 //!     u16 LE multiplicity node id
 //!     u16 LE arg count, then arg_count x u16 LE arg node ids
 //! TRAILER
@@ -70,11 +69,40 @@ use multi_stark::{
   types::{Commitment, CommitmentParameters, FriParameters, Val},
 };
 
+use crate::graph_shape::{GraphWidths, checked_graph_prefix};
 use crate::synthesis::{AiurConfig, AiurSystem};
 
 /// Sentinel for `None` in the preprocessed-index trailer.
 const NO_PREP_INDEX: u16 = u16::MAX;
 
+#[cfg(test)]
+#[path = "vk_codec/tests/graphs.rs"]
+mod graph_tests;
+
+#[cfg(test)]
+#[path = "vk_codec/tests/compilation.rs"]
+mod compilation_tests;
+
+#[cfg(test)]
+#[path = "vk_codec/tests/codec.rs"]
+mod codec_tests;
+
+#[cfg(test)]
+#[path = "vk_codec/tests/extension_arithmetic.rs"]
+mod extension_arithmetic_tests;
+
+#[cfg(test)]
+#[path = "vk_codec/tests/logup.rs"]
+mod logup_tests;
+
+#[cfg(test)]
+#[path = "vk_codec/tests/domain.rs"]
+mod domain_tests;
+
+#[cfg(test)]
+#[path = "vk_codec/tests/verifier_arithmetic.rs"]
+mod verifier_arithmetic_tests;
+
 // ════════════════════════════════════════════════════════════════════════════
 // Encoder — System<AiurConfig> -> bytes
 // ════════════════════════════════════════════════════════════════════════════
@@ -321,7 +349,7 @@ fn decode_node(seg: &mut Seg<'_>) -> Result<Node<Val>, String> {
 
 /// Recompute per-node degree multiples in node order (children precede parents
 /// in the compiled vector).
-fn recompute_degrees(nodes: &[Node<Val>]) -> Vec<u32> {
+fn recompute_degrees(nodes: &[Node<Val>]) -> Result<Vec<u32>, String> {
   let mut degrees: Vec<u32> = Vec::with_capacity(nodes.len());
   for node in nodes {
     let d = match *node {
@@ -330,12 +358,37 @@ fn recompute_degrees(nodes: &[Node<Val>]) -> Vec<u32> {
       Node::Add(a, b) | Node::Sub(a, b) => {
         degrees[a.0 as usize].max(degrees[b.0 as usize])
       },
-      Node::Mul(a, b) => degrees[a.0 as usize] + degrees[b.0 as usize],
+      Node::Mul(a, b) => degrees[a.0 as usize]
+        .checked_add(degrees[b.0 as usize])
+        .ok_or("node degree overflow")?,
       Node::Neg(a) => degrees[a.0 as usize],
     };
     degrees.push(d);
   }
-  degrees
+  Ok(degrees)
+}
+
+/// Use u64 for the at-most-eight-term degree sums so malformed graphs cannot
+/// overflow the native u32 analytic logUp calculation before rejection.
+fn checked_max_degree(
+  graph: &ConstraintGraph<Val>,
+  group_size: usize,
+) -> Result<usize, String> {
+  let degree = |id: NodeId| u64::from(graph.degrees[id.index()]);
+  let mut maximum = u64::from(graph.max_constraint_degree).max(1);
+  for group in graph.lookups.chunks(group_size) {
+    let messages: Vec<_> = group
+      .iter()
+      .map(|lookup| lookup.args.iter().copied().map(degree).max().unwrap_or(0))
+      .collect();
+    let sum: u64 = messages.iter().sum();
+    maximum = maximum.max(sum + 1);
+    for (lookup, message_degree) in group.iter().zip(messages) {
+      maximum = maximum.max(degree(lookup.multiplicity) + sum - message_degree);
+    }
+  }
+  usize::try_from(maximum)
+    .map_err(|error| format!("constraint degree overflow: {error}"))
 }
 
 fn decode_circuit(seg: &mut Seg<'_>) -> Result<Circuit<Val>, String> {
@@ -369,7 +422,30 @@ fn decode_circuit(seg: &mut Seg<'_>) -> Result<Circuit<Val>, String> {
     lookups.push(Lookup { multiplicity, args });
   }
 
-  let degrees = recompute_degrees(&nodes);
+  let num_lookups = lookups.len();
+  let ext_degree =
+    <multi_stark::types::ExtVal as multi_stark::p3_field::BasedVectorSpace<
+      Val,
+    >>::DIMENSION;
+  let stage_2_width = multi_stark::lookup::stage2_width(
+    num_lookups,
+    lookup_group_size,
+    ext_degree,
+  );
+  let num_publics = multi_stark::lookup::num_publics(ext_degree);
+  let lookup_prefix_len = checked_graph_prefix(
+    &nodes,
+    &zeros,
+    &lookups,
+    GraphWidths {
+      preprocessed: preprocessed_width,
+      main: main_width,
+      stage2: stage_2_width,
+      publics: num_publics,
+    },
+  )
+  .ok_or("invalid graph indices or lookup prefix")?;
+  let degrees = recompute_degrees(&nodes)?;
   // The graph's own max degree covers only the user roots (the serialized
   // `max_constraint_degree` is the combined user + analytic-logUp value).
   let user_max_degree = zeros
@@ -377,15 +453,6 @@ fn decode_circuit(seg: &mut Seg<'_>) -> Result<Circuit<Val>, String> {
     .map(|z| degrees[usize::try_from(z.0).expect("node id")])
     .max()
     .unwrap_or(0);
-  // The lookup prefix is exactly the nodes interned while compiling the
-  // lookup expressions, all of which are reachable from (and bounded by)
-  // the lookup roots — children always precede parents.
-  let lookup_prefix_len = lookups
-    .iter()
-    .flat_map(|l| std::iter::once(l.multiplicity).chain(l.args.iter().copied()))
-    .map(|id| id.0 as usize + 1)
-    .max()
-    .unwrap_or(0);
   let graph = ConstraintGraph {
     nodes,
     degrees,
@@ -394,11 +461,9 @@ fn decode_circuit(seg: &mut Seg<'_>) -> Result<Circuit<Val>, String> {
     lookup_prefix_len,
     max_constraint_degree: user_max_degree,
   };
-  let num_lookups = graph.lookups.len();
-  let ext_degree =
-    <multi_stark::types::ExtVal as multi_stark::p3_field::BasedVectorSpace<
-      Val,
-    >>::DIMENSION;
+  if checked_max_degree(&graph, lookup_group_size)? != max_constraint_degree {
+    return Err("incorrect maximum constraint degree".into());
+  }
   Ok(Circuit {
     graph,
     main_width,
@@ -406,12 +471,8 @@ fn decode_circuit(seg: &mut Seg<'_>) -> Result<Circuit<Val>, String> {
     preprocessed_width,
     preprocessed_height,
     num_lookups,
-    stage_2_width: multi_stark::lookup::stage2_width(
-      num_lookups,
-      lookup_group_size,
-      ext_degree,
-    ),
-    num_publics: multi_stark::lookup::num_publics(ext_degree),
+    stage_2_width,
+    num_publics,
     lookup_group_size,
     constraint_count: zeros_plus_logup(
       zero_count,
@@ -462,6 +523,9 @@ pub(crate) fn from_bytes(
     0 => None,
     1 => {
       let n = r.u16()? as usize;
+      if !n.is_power_of_two() {
+        return Err("preprocessed cap size must be a power of two".into());
+      }
       let mut caps = Vec::with_capacity(n.min(1 << 16));
       for _ in 0..n {
         let mut d = [0u8; 32];
@@ -571,8 +635,7 @@ mod tests {
     assert!(from_bytes(&bytes).is_err(), "should reject trailing data");
   }
 
-  /// A tampered per-circuit record length must be rejected (the record reader
-  /// enforces exact consumption).
+  /// Truncation and trailing bytes must be rejected for the unframed stream.
   #[test]
   fn rejects_bad_record_length() {
     let (system, cp, fp) = test_system();
@@ -588,4 +651,119 @@ mod tests {
     padded.push(0);
     assert!(from_bytes(&padded).is_err(), "should reject padded vk");
   }
+
+  #[test]
+  fn rejects_forward_node_reference_without_panicking() {
+    let mut bytes = Vec::new();
+    for width in [1, 0] {
+      push_u16(&mut bytes, width);
+    }
+    push_u32(&mut bytes, 0);
+    push_u16(&mut bytes, 2);
+    bytes.push(1);
+    push_u16(&mut bytes, 1);
+    push_node(&mut bytes, &Node::Neg(NodeId(0)));
+    push_u16(&mut bytes, 0);
+    push_u16(&mut bytes, 0);
+    let decoded = std::panic::catch_unwind(|| {
+      decode_circuit(&mut Seg { buf: &bytes, pos: 0 })
+    });
+    assert!(decoded.is_ok(), "malformed graph must return an error");
+    assert!(decoded.unwrap().is_err(), "self-reference must be rejected");
+  }
+
+  fn circuit_bytes(
+    nodes: &[Node<Val>],
+    zeros: &[NodeId],
+    lookups: &[Lookup<NodeId>],
+    maximum: usize,
+  ) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    push_u16(&mut bytes, 1);
+    push_u16(&mut bytes, 1);
+    push_u32(&mut bytes, 256);
+    push_u16(&mut bytes, maximum);
+    bytes.push(1);
+    push_u16(&mut bytes, nodes.len());
+    for node in nodes {
+      push_node(&mut bytes, node);
+    }
+    push_u16(&mut bytes, zeros.len());
+    for &root in zeros {
+      push_node_id(&mut bytes, root);
+    }
+    push_u16(&mut bytes, lookups.len());
+    for lookup in lookups {
+      push_node_id(&mut bytes, lookup.multiplicity);
+      push_u16(&mut bytes, lookup.args.len());
+      for &arg in &lookup.args {
+        push_node_id(&mut bytes, arg);
+      }
+    }
+    bytes
+  }
+
+  fn assert_bad_graph(bytes: &[u8]) {
+    let decoded = std::panic::catch_unwind(|| {
+      decode_circuit(&mut Seg { buf: bytes, pos: 0 })
+    });
+    assert!(decoded.is_ok(), "invalid graph must not panic");
+    assert!(decoded.unwrap().is_err(), "invalid graph must be rejected");
+  }
+
+  #[test]
+  fn rejects_malformed_graph_reads() {
+    let leaf = Node::Const(Val::ONE);
+    for node in [
+      Node::Add(NodeId(0), NodeId(1)),
+      Node::Sub(NodeId(1), NodeId(0)),
+      Node::Mul(NodeId(0), NodeId(u16::MAX.into())),
+      Node::Neg(NodeId(2)),
+    ] {
+      assert_bad_graph(&circuit_bytes(&[leaf, node], &[], &[], 1));
+    }
+    assert_bad_graph(&circuit_bytes(&[leaf], &[NodeId(1)], &[], 1));
+    for lookup in [
+      Lookup { multiplicity: NodeId(1), args: vec![] },
+      Lookup { multiplicity: NodeId(0), args: vec![NodeId(1)] },
+    ] {
+      assert_bad_graph(&circuit_bytes(&[leaf], &[], &[lookup], 1));
+    }
+    for source in [Source::Preprocessed, Source::Main, Source::Stage2] {
+      for offset in [RowOffset::Current, RowOffset::Next] {
+        let index = if source == Source::Stage2 { 2 } else { 1 };
+        let node = Node::Var(ColRef { source, offset, index });
+        assert_bad_graph(&circuit_bytes(&[node], &[], &[], 1));
+      }
+    }
+    assert_bad_graph(&circuit_bytes(&[Node::Public(8)], &[], &[], 1));
+    let stage2 = Node::Var(ColRef {
+      source: Source::Stage2,
+      offset: RowOffset::Current,
+      index: 0,
+    });
+    // Even an unreachable stage-2 node in the dense prefix is read by its sweep.
+    let lookup = Lookup { multiplicity: NodeId(1), args: vec![] };
+    assert_bad_graph(&circuit_bytes(&[stage2, leaf], &[], &[lookup], 1));
+    let bytes = circuit_bytes(&[stage2], &[NodeId(0)], &[], 1);
+    assert!(decode_circuit(&mut Seg { buf: &bytes, pos: 0 }).is_ok());
+  }
+
+  #[test]
+  fn rejects_overflowing_and_incorrect_graph_degrees() {
+    let mut nodes = vec![Node::IsFirstRow];
+    for i in 0..32 {
+      nodes.push(Node::Mul(NodeId(i), NodeId(i)));
+    }
+    assert_bad_graph(&circuit_bytes(&nodes, &[], &[], 1));
+    // Each node fits u32, but the product's analytic logUp degree exceeds it.
+    nodes.pop();
+    let lookup = Lookup { multiplicity: NodeId(31), args: vec![NodeId(31)] };
+    let mut bytes = circuit_bytes(&nodes, &[], &[lookup.clone(), lookup], 1);
+    bytes[10] = 2;
+    assert_bad_graph(&bytes);
+    for maximum in [0, 2, u16::MAX.into()] {
+      assert_bad_graph(&circuit_bytes(&[Node::IsFirstRow], &[], &[], maximum));
+    }
+  }
 }
diff --git a/crates/aiur/src/vk_codec/tests/codec.rs b/crates/aiur/src/vk_codec/tests/codec.rs
new file mode 100644
index 000000000..ee9baa323
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/codec.rs
@@ -0,0 +1,297 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Transport actual full keys and adversarial v5 bytes to the total Lean codec.
+
+use super::*;
+use multi_stark::system::CircuitInputs;
+use std::{fs, io};
+
+fn parameters() -> (CommitmentParameters, FriParameters) {
+  (
+    CommitmentParameters { log_blowup: 1, cap_height: 0 },
+    FriParameters {
+      log_final_poly_len: 0,
+      max_log_arity: 1,
+      num_queries: 64,
+      commit_proof_of_work_bits: 0,
+      query_proof_of_work_bits: 0,
+    },
+  )
+}
+
+fn record(
+  nodes: Vec<Node<Val>>,
+  zeros: Vec<NodeId>,
+  lookups: Vec<Lookup<NodeId>>,
+  group: usize,
+  maximum: usize,
+) -> Vec<u8> {
+  let circuit = Circuit {
+    graph: ConstraintGraph {
+      nodes,
+      zeros,
+      lookups,
+      degrees: vec![],
+      lookup_prefix_len: 0,
+      max_constraint_degree: 0,
+    },
+    main_width: 1,
+    preprocessed: None,
+    preprocessed_width: 1,
+    preprocessed_height: 256,
+    lookup_group_size: group,
+    max_constraint_degree: maximum,
+    num_lookups: 0,
+    stage_2_width: 0,
+    num_publics: 8,
+    constraint_count: 0,
+  };
+  let mut bytes = vec![];
+  encode_circuit(&mut bytes, &circuit);
+  bytes
+}
+
+fn key(records: &[Vec<u8>], commitment: Option<&[u8]>) -> Vec<u8> {
+  let mut bytes = vec![];
+  for parameter in [1, 0, 0, 1, 64, 0, 0] {
+    push_u16(&mut bytes, parameter);
+  }
+  push_u16(&mut bytes, records.len());
+  for record in records {
+    bytes.extend_from_slice(record);
+  }
+  match commitment {
+    None => bytes.push(0),
+    Some(digests) => {
+      assert_eq!(digests.len() % 32, 0);
+      bytes.push(1);
+      push_u16(&mut bytes, digests.len() / 32);
+      bytes.extend_from_slice(digests);
+    },
+  }
+  for index in 0..records.len() {
+    push_u16(&mut bytes, if commitment.is_some() { index } else { 65535 });
+  }
+  bytes
+}
+
+fn every_tag_record() -> Vec<u8> {
+  let mut nodes = vec![
+    Node::Const(Val::ZERO),
+    Node::Const(Val::ONE),
+    Node::Const(Val::from_u64(65535)),
+    Node::Const(Val::from_u64(65536)),
+    Node::Const(-Val::ONE),
+    Node::Public(7),
+    Node::IsFirstRow,
+    Node::IsLastRow,
+    Node::IsTransition,
+    Node::Add(NodeId(1), NodeId(6)),
+    Node::Sub(NodeId(9), NodeId(2)),
+    Node::Mul(NodeId(9), NodeId(10)),
+    Node::Neg(NodeId(11)),
+  ];
+  for source in [Source::Preprocessed, Source::Main, Source::Stage2] {
+    for offset in [RowOffset::Current, RowOffset::Next] {
+      nodes.push(Node::Var(ColRef { source, offset, index: 0 }));
+    }
+  }
+  record(
+    nodes,
+    vec![NodeId(12), NodeId(17), NodeId(18)],
+    vec![Lookup { multiplicity: NodeId(1), args: vec![NodeId(9)] }],
+    1,
+    2,
+  )
+}
+
+fn cases() -> Vec<Vec<u8>> {
+  let (cp, fp) = parameters();
+  let actual = graph_tests::graph_system();
+  let mut cases = vec![to_bytes(&actual, cp, fp)];
+  for inputs in [vec![], vec![CircuitInputs::default()]] {
+    let system = System::new(AiurConfig::new(cp, fp), inputs).0;
+    cases.push(to_bytes(&system, cp, fp));
+  }
+  let every_tag = every_tag_record();
+  let mut small = vec![
+    key(&[], None),
+    key(&[], Some(&[])),
+    key(std::slice::from_ref(&every_tag), None),
+    key(std::slice::from_ref(&every_tag), Some(&[7; 32])),
+    key(&[every_tag.clone(), every_tag.clone()], Some(&[19; 64])),
+  ];
+  // Constants that the decoder reduces or accepts in a nonminimal tag.
+  for value in [0, 1, 65535, 65536, Val::ORDER_U64, u64::MAX] {
+    let mut record = record(vec![Node::Const(Val::ONE)], vec![], vec![], 1, 1);
+    record.splice(13..16, std::iter::once(1).chain(value.to_le_bytes()));
+    small.push(key(&[record], None));
+  }
+  cases.extend(small.iter().cloned());
+  for bytes in &small {
+    // Every truncation and every trailing-byte value, including zeros.
+    cases.extend((0..bytes.len()).map(|end| bytes[..end].to_vec()));
+    for suffix in 0..=255 {
+      let mut extended = bytes.clone();
+      extended.push(suffix);
+      cases.push(extended);
+    }
+  }
+  let mutations = key(&[every_tag], Some(&[7; 32]));
+  for offset in 14..mutations.len() {
+    for value in [0, 1, 15, 16, 255] {
+      let mut bytes = mutations.clone();
+      bytes[offset] = value;
+      cases.push(bytes);
+    }
+  }
+  let leaf = Node::Const(Val::ONE);
+  for group in [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 255] {
+    for count in [0, 1, 2, 3, 7, 8, 9, 16, 17] {
+      let lookups =
+        vec![Lookup { multiplicity: NodeId(0), args: vec![] }; count];
+      cases.push(key(&[record(vec![leaf], vec![], lookups, group, 1)], None));
+    }
+  }
+  for node in [
+    Node::Add(NodeId(0), NodeId(1)),
+    Node::Sub(NodeId(1), NodeId(0)),
+    Node::Mul(NodeId(0), NodeId(65535)),
+    Node::Neg(NodeId(1)),
+    Node::Public(8),
+    Node::Public(255),
+  ] {
+    cases.push(key(&[record(vec![leaf, node], vec![], vec![], 1, 1)], None));
+  }
+  for source in [Source::Preprocessed, Source::Main, Source::Stage2] {
+    for offset in [RowOffset::Current, RowOffset::Next] {
+      for index in [0, 1, 2, 65535] {
+        let var = Node::Var(ColRef { source, offset, index });
+        for lookups in
+          [vec![], vec![Lookup { multiplicity: NodeId(1), args: vec![] }]]
+        {
+          cases
+            .push(key(&[record(vec![var, leaf], vec![], lookups, 1, 1)], None));
+        }
+      }
+    }
+  }
+  for invalid in [1, 65535] {
+    cases.push(key(
+      &[record(vec![leaf], vec![NodeId(invalid)], vec![], 1, 1)],
+      None,
+    ));
+    for lookup in [
+      Lookup { multiplicity: NodeId(invalid), args: vec![] },
+      Lookup { multiplicity: NodeId(0), args: vec![NodeId(invalid)] },
+    ] {
+      cases.push(key(&[record(vec![leaf], vec![], vec![lookup], 1, 1)], None));
+    }
+  }
+  for maximum in [0, 1, 2, 65535] {
+    cases.push(key(
+      &[record(vec![Node::IsFirstRow], vec![], vec![], 1, maximum)],
+      None,
+    ));
+  }
+  let mut nodes = vec![Node::IsFirstRow];
+  for index in 0..32 {
+    nodes.push(Node::Mul(NodeId(index), NodeId(index)));
+  }
+  cases.push(key(&[record(nodes.clone(), vec![], vec![], 1, 1)], None));
+  nodes.pop();
+  for group in 1..=8 {
+    let lookup = Lookup { multiplicity: NodeId(31), args: vec![NodeId(31)] };
+    cases.push(key(
+      &[record(nodes.clone(), vec![], vec![lookup; group], group, 1)],
+      None,
+    ));
+  }
+  // The largest serialized degree is valid, even though this decoder does
+  // not check the chosen PCS's quotient budget (System::new does).
+  nodes.truncate(16);
+  let mut root = 15;
+  for power in (0..15).rev() {
+    nodes.push(Node::Mul(NodeId(root), NodeId(power)));
+    root += 1;
+  }
+  let mut maximum = record(nodes, vec![NodeId(root)], vec![], 8, 65535);
+  maximum[0..4].copy_from_slice(&[255; 4]);
+  maximum[4..8].copy_from_slice(&[255; 4]);
+  cases.push(key(&[maximum], Some(&[255; 32])));
+  cases
+}
+
+fn write_nat(out: &mut Vec<u8>, value: usize) {
+  out.extend_from_slice(&(value as u64).to_le_bytes());
+}
+
+fn write_bytes(out: &mut Vec<u8>, bytes: &[u8]) {
+  write_nat(out, bytes.len());
+  out.extend_from_slice(bytes);
+}
+
+#[test]
+fn rejects_invalid_commitment_cap_sizes_without_panicking() {
+  for count in [0, 3, 5, 7] {
+    let bytes = key(&[], Some(&vec![0; count * 32]));
+    let decoded = std::panic::catch_unwind(|| from_bytes(&bytes));
+    assert!(decoded.is_ok(), "invalid cap size must return an error");
+    assert!(decoded.unwrap().is_err(), "invalid cap size must be rejected");
+  }
+}
+
+#[test]
+fn key_codec_snapshot() -> io::Result<()> {
+  let cases = cases();
+  let mut out = b"Aiur key codec v1\n".to_vec();
+  write_nat(&mut out, cases.len());
+  let mut accepted = 0;
+  let mut noncanonical = 0;
+  let mut circuits = 0;
+  for bytes in &cases {
+    write_bytes(&mut out, bytes);
+    match from_bytes(bytes) {
+      Err(_) => out.push(0),
+      Ok((system, cp, fp)) => {
+        out.push(1);
+        accepted += 1;
+        let canonical = to_bytes(&system, cp, fp);
+        noncanonical += usize::from(canonical != *bytes);
+        write_bytes(&mut out, &canonical);
+        write_nat(&mut out, system.circuits.len());
+        for circuit in system.circuits {
+          circuits += 1;
+          for value in [
+            circuit.main_width,
+            circuit.preprocessed_width,
+            circuit.preprocessed_height,
+            circuit.max_constraint_degree,
+            circuit.lookup_group_size,
+            circuit.stage_2_width,
+            circuit.num_publics,
+            circuit.constraint_count,
+            circuit.graph.lookup_prefix_len,
+            circuit.graph.max_constraint_degree as usize,
+          ] {
+            write_nat(&mut out, value);
+          }
+          write_nat(&mut out, circuit.graph.degrees.len());
+          for degree in circuit.graph.degrees {
+            write_nat(&mut out, degree as usize);
+          }
+        }
+      },
+    }
+  }
+  assert!(accepted > 100 && noncanonical >= 5 && circuits > 100);
+  if let Ok(path) = std::env::var("IX_KEY_CODEC_SNAPSHOT") {
+    fs::write(path, out)?;
+  }
+  println!(
+    "key codec: {} cases, {accepted} accepted, {noncanonical} noncanonical, {circuits} circuits",
+    cases.len(),
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/vk_codec/tests/compilation.rs b/crates/aiur/src/vk_codec/tests/compilation.rs
new file mode 100644
index 000000000..5cfeb8121
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/compilation.rs
@@ -0,0 +1,490 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Export complete native base graphs and rejected source specifications.
+
+use super::*;
+use multi_stark::{
+  eval::{VarValues, eval_expr},
+  expr::Expr,
+  p3_matrix::dense::RowMajorMatrix,
+  system::CircuitInputs,
+};
+use std::{fs, io, panic::catch_unwind};
+
+#[derive(Clone)]
+struct Spec {
+  constraints: Vec<Expr<Val>>,
+  lookups: Vec<Lookup<Expr<Val>>>,
+}
+
+impl Spec {
+  fn inputs(&self) -> CircuitInputs<Val> {
+    CircuitInputs {
+      main_width: 4,
+      preprocessed: Some(RowMajorMatrix::new(vec![Val::ZERO; 8], 4)),
+      constraints: self.constraints.clone(),
+      lookups: self.lookups.clone(),
+      ..CircuitInputs::default()
+    }
+  }
+
+  fn widths(&self) -> [usize; 4] {
+    [4, 4, self.lookups.len().max(1) * 2, 8]
+  }
+}
+
+fn binary(kind: usize, a: &Expr<Val>, b: &Expr<Val>) -> Expr<Val> {
+  let a = Box::new(a.clone());
+  let b = Box::new(b.clone());
+  match kind {
+    0 => Expr::Add(a, b),
+    1 => Expr::Sub(a, b),
+    _ => Expr::Mul(a, b),
+  }
+}
+
+fn fixtures() -> Vec<Expr<Val>> {
+  let x = Expr::main(0);
+  let y = Expr::main(1);
+  let zero = Expr::Const(Val::ZERO);
+  let one = Expr::Const(Val::ONE);
+  let mut result = vec![
+    zero.clone(),
+    one.clone(),
+    Expr::Const(-Val::ONE),
+    Expr::Const(Val::from_u64(17)),
+  ];
+  for source in [Source::Preprocessed, Source::Main] {
+    for offset in [RowOffset::Current, RowOffset::Next] {
+      result.push(Expr::Var(ColRef { source, offset, index: 2 }));
+    }
+  }
+  result.extend([
+    Expr::Public(0),
+    Expr::Public(2),
+    Expr::IsFirstRow,
+    Expr::IsLastRow,
+    Expr::IsTransition,
+    Expr::Neg(Box::new(x.clone())),
+    binary(0, &x, &y),
+    binary(1, &zero, &x),
+    binary(2, &zero, &y),
+    Expr::Neg(Box::new(zero)),
+    Expr::Neg(Box::new(one.clone())),
+    Expr::Neg(Box::new(Expr::Neg(Box::new(x)))),
+    Expr::Neg(Box::new(Expr::Neg(Box::new(one.clone())))),
+    binary(0, &one, &one),
+  ]);
+  assert_eq!(result.len(), 22);
+  result
+}
+
+fn accepted_specs() -> Vec<Spec> {
+  let fixtures = fixtures();
+  let zero = Expr::Const(Val::ZERO);
+  let one = Expr::Const(Val::ONE);
+  let anchor = Expr::main(3);
+  let mut specs = vec![
+    Spec { constraints: vec![], lookups: vec![] },
+    Spec {
+      constraints: vec![zero.clone()],
+      lookups: vec![Lookup {
+        multiplicity: one.clone(),
+        args: fixtures.clone(),
+      }],
+    },
+  ];
+  for left in &fixtures {
+    for right in &fixtures {
+      for kind in 0..3 {
+        let root = binary(kind, left, right);
+        let reverse = binary(kind, right, left);
+        let constraint = binary(1, &root, &anchor);
+        specs.push(Spec {
+          constraints: vec![
+            constraint.clone(),
+            constraint,
+            binary(1, &reverse, &anchor),
+            binary(1, &root, &root),
+          ],
+          lookups: vec![
+            Lookup {
+              multiplicity: left.clone(),
+              args: vec![right.clone(), root.clone(), reverse, root],
+            },
+            // The final unused leaf extends the stored lookup prefix.
+            Lookup {
+              multiplicity: one.clone(),
+              args: vec![binary(2, &zero, &anchor)],
+            },
+          ],
+        });
+      }
+    }
+    let negated = Expr::Neg(Box::new(left.clone()));
+    specs.push(Spec {
+      constraints: vec![binary(1, &negated, &anchor)],
+      lookups: vec![Lookup {
+        multiplicity: one.clone(),
+        args: vec![left.clone(), negated],
+      }],
+    });
+  }
+  let x = Expr::main(0);
+  let y = Expr::main(1);
+  let mut ordered = vec![
+    binary(0, &x, &y),
+    binary(0, &y, &x),
+    binary(2, &x, &y),
+    binary(2, &y, &x),
+    binary(1, &x, &y),
+    binary(1, &y, &x),
+    Expr::Neg(Box::new(x.clone())),
+    Expr::Neg(Box::new(Expr::Neg(Box::new(x)))),
+  ];
+  for _ in 0..8 {
+    specs.push(Spec { constraints: ordered.clone(), lookups: vec![] });
+    ordered.rotate_left(1);
+  }
+  assert_eq!(specs.len(), 1484);
+  specs
+}
+
+fn rejected_specs() -> Vec<(Spec, &'static str)> {
+  let mut specs = Vec::new();
+  let lookup_spec = |expr| Spec {
+    constraints: vec![],
+    lookups: vec![Lookup {
+      multiplicity: Expr::Const(Val::ONE),
+      args: vec![expr],
+    }],
+  };
+  for source in [Source::Preprocessed, Source::Main, Source::Stage2] {
+    let error = if source == Source::Stage2 {
+      "Stage2InBaseContext"
+    } else {
+      "ColumnOutOfRange"
+    };
+    for offset in [RowOffset::Current, RowOffset::Next] {
+      for index in [4, 7, u32::MAX] {
+        specs.push((
+          lookup_spec(Expr::Var(ColRef { source, offset, index })),
+          error,
+        ));
+      }
+      let index = if source == Source::Stage2 { 0 } else { 4 };
+      let invalid = Expr::Var(ColRef { source, offset, index });
+      // Raw folds still visit and reject their invalid children.
+      specs.push((
+        lookup_spec(binary(2, &Expr::Const(Val::ZERO), &invalid)),
+        error,
+      ));
+      specs.push((lookup_spec(binary(1, &invalid, &invalid)), error));
+    }
+  }
+  for index in [8, 9, u32::MAX] {
+    specs.push((lookup_spec(Expr::Public(index)), "PublicOutOfRange"));
+  }
+  for constant in [Val::ONE, -Val::ONE, Val::from_u64(17)] {
+    specs.push((
+      Spec { constraints: vec![Expr::Const(constant)], lookups: vec![] },
+      "UnsatisfiableConstant",
+    ));
+  }
+  specs.push((
+    Spec {
+      constraints: vec![binary(
+        0,
+        &Expr::Const(Val::ONE),
+        &Expr::Const(Val::ONE),
+      )],
+      lookups: vec![],
+    },
+    "UnsatisfiableConstant",
+  ));
+  specs.push((
+    Spec {
+      constraints: vec![Expr::main(0), Expr::Const(Val::ONE)],
+      lookups: vec![],
+    },
+    "UnsatisfiableConstant",
+  ));
+  assert_eq!(specs.len(), 38);
+  specs
+}
+
+fn write_nat(out: &mut Vec<u8>, value: usize) {
+  out.extend_from_slice(&(value as u64).to_le_bytes());
+}
+
+fn write_field(out: &mut Vec<u8>, value: Val) {
+  out.extend_from_slice(&value.as_canonical_u64().to_le_bytes());
+}
+
+fn write_values(out: &mut Vec<u8>, values: &[Val]) {
+  write_nat(out, values.len());
+  for &value in values {
+    write_field(out, value);
+  }
+}
+
+fn write_column(out: &mut Vec<u8>, column: ColRef) {
+  out.push(match column.source {
+    Source::Preprocessed => 0,
+    Source::Main => 1,
+    Source::Stage2 => 2,
+  });
+  out.push(match column.offset {
+    RowOffset::Current => 0,
+    RowOffset::Next => 1,
+  });
+  write_nat(out, column.index as usize);
+}
+
+fn write_expr(out: &mut Vec<u8>, expr: &Expr<Val>) {
+  match expr {
+    Expr::Const(value) => {
+      out.push(0);
+      write_field(out, *value);
+    },
+    Expr::Var(column) => {
+      out.push(1);
+      write_column(out, *column);
+    },
+    Expr::Public(index) => {
+      out.push(2);
+      write_nat(out, *index as usize);
+    },
+    Expr::IsFirstRow => out.push(3),
+    Expr::IsLastRow => out.push(4),
+    Expr::IsTransition => out.push(5),
+    Expr::Add(a, b) | Expr::Sub(a, b) | Expr::Mul(a, b) => {
+      out.push(match expr {
+        Expr::Add(..) => 6,
+        Expr::Sub(..) => 7,
+        _ => 8,
+      });
+      write_expr(out, a);
+      write_expr(out, b);
+    },
+    Expr::Neg(child) => {
+      out.push(9);
+      write_expr(out, child);
+    },
+  }
+}
+
+fn write_spec(out: &mut Vec<u8>, spec: &Spec) {
+  for width in spec.widths() {
+    write_nat(out, width);
+  }
+  write_nat(out, spec.lookups.len());
+  for lookup in &spec.lookups {
+    write_expr(out, &lookup.multiplicity);
+    write_nat(out, lookup.args.len());
+    for arg in &lookup.args {
+      write_expr(out, arg);
+    }
+  }
+  write_nat(out, spec.constraints.len());
+  for expr in &spec.constraints {
+    write_expr(out, expr);
+  }
+}
+
+fn write_graph(out: &mut Vec<u8>, graph: &ConstraintGraph<Val>) {
+  write_nat(out, graph.nodes.len());
+  for node in &graph.nodes {
+    match *node {
+      Node::Const(value) => {
+        out.push(0);
+        write_field(out, value);
+      },
+      Node::Var(column) => {
+        out.push(1);
+        write_column(out, column);
+      },
+      Node::Public(index) => {
+        out.push(2);
+        write_nat(out, index as usize);
+      },
+      Node::IsFirstRow => out.push(3),
+      Node::IsLastRow => out.push(4),
+      Node::IsTransition => out.push(5),
+      Node::Add(a, b) | Node::Sub(a, b) | Node::Mul(a, b) => {
+        out.push(match node {
+          Node::Add(..) => 6,
+          Node::Sub(..) => 7,
+          _ => 8,
+        });
+        write_nat(out, a.index());
+        write_nat(out, b.index());
+      },
+      Node::Neg(child) => {
+        out.push(9);
+        write_nat(out, child.index());
+      },
+    }
+  }
+  for &degree in &graph.degrees {
+    write_nat(out, degree as usize);
+  }
+  write_nat(out, graph.zeros.len());
+  for root in &graph.zeros {
+    write_nat(out, root.index());
+  }
+  write_nat(out, graph.lookups.len());
+  for lookup in &graph.lookups {
+    write_nat(out, lookup.multiplicity.index());
+    write_nat(out, lookup.args.len());
+    for arg in &lookup.args {
+      write_nat(out, arg.index());
+    }
+  }
+  write_nat(out, graph.lookup_prefix_len);
+  write_nat(out, graph.max_constraint_degree as usize);
+}
+
+fn config() -> AiurConfig {
+  AiurConfig::new(
+    CommitmentParameters { log_blowup: 3, cap_height: 0 },
+    FriParameters {
+      log_final_poly_len: 0,
+      max_log_arity: 1,
+      num_queries: 64,
+      commit_proof_of_work_bits: 0,
+      query_proof_of_work_bits: 0,
+    },
+  )
+}
+
+fn assignment(width: usize, slot: usize, seed: usize) -> Vec<Val> {
+  let choices = [
+    Val::ZERO,
+    Val::ONE,
+    -Val::ONE,
+    Val::from_u64(17),
+    Val::from_u64(255),
+    Val::from_u64(256),
+    Val::from_u64(65536),
+    Val::TWO,
+  ];
+  (0..width)
+    .map(|index| {
+      if seed < 3 {
+        choices[seed]
+      } else {
+        choices[(3 * slot + 5 * seed + 7 * index) % choices.len()]
+      }
+    })
+    .collect()
+}
+
+#[test]
+fn graph_compilation_snapshot() -> io::Result<()> {
+  let specs = accepted_specs();
+  let (system, _) = System::new(config(), specs.iter().map(Spec::inputs));
+  let mut out = b"Aiur graph compilation v1\n".to_vec();
+  write_nat(&mut out, specs.len());
+  let mut assignments = 0;
+  let mut node_values = 0;
+  for (spec, circuit) in specs.iter().zip(&system.circuits) {
+    assert_eq!(
+      spec.widths(),
+      [
+        circuit.preprocessed_width,
+        circuit.main_width,
+        circuit.stage_2_width,
+        circuit.num_publics
+      ]
+    );
+    write_spec(&mut out, spec);
+    write_graph(&mut out, &circuit.graph);
+    for seed in 0..8 {
+      let [pre, main, stage, publics] = spec.widths();
+      let rows: Vec<_> = [pre, pre, main, main, stage, stage, publics, 3]
+        .into_iter()
+        .enumerate()
+        .map(|(slot, width)| assignment(width, slot, seed))
+        .collect();
+      for row in &rows {
+        write_values(&mut out, row);
+      }
+      let values = VarValues {
+        preprocessed: [&rows[0], &rows[1]],
+        main: [&rows[2], &rows[3]],
+        stage2: [&rows[4], &rows[5]],
+        publics: &rows[6],
+        is_first_row: rows[7][0],
+        is_last_row: rows[7][1],
+        is_transition: rows[7][2],
+      };
+      let mut buffer = Vec::new();
+      circuit.graph.sweep(&values, &mut buffer);
+      write_values(&mut out, &buffer);
+      let mut prefix = Vec::new();
+      circuit.graph.sweep_lookup_prefix(
+        &VarValues { stage2: [&[], &[]], ..values },
+        &mut prefix,
+      );
+      assert_eq!(prefix, buffer[..circuit.graph.lookup_prefix_len]);
+      write_values(&mut out, &prefix);
+      let original: Vec<_> =
+        spec.constraints.iter().map(|expr| eval_expr(expr, &values)).collect();
+      write_values(&mut out, &original);
+      assert_eq!(
+        original.iter().all(|v| *v == Val::ZERO),
+        circuit
+          .graph
+          .constraint_values(&buffer)
+          .iter()
+          .all(|v| *v == Val::ZERO)
+      );
+      let lookups: Vec<_> = spec
+        .lookups
+        .iter()
+        .map(|lookup| Lookup {
+          multiplicity: eval_expr(&lookup.multiplicity, &values),
+          args: lookup
+            .args
+            .iter()
+            .map(|expr| eval_expr(expr, &values))
+            .collect(),
+        })
+        .collect();
+      assert_eq!(lookups, circuit.graph.lookup_values(&prefix));
+      for lookup in lookups {
+        write_field(&mut out, lookup.multiplicity);
+        write_values(&mut out, &lookup.args);
+      }
+      assignments += 1;
+      node_values += buffer.len();
+    }
+  }
+  let rejected = rejected_specs();
+  write_nat(&mut out, rejected.len());
+  for (spec, expected_error) in &rejected {
+    let failed = catch_unwind(|| System::new(config(), [spec.inputs()]));
+    let Err(error) = failed else {
+      panic!("invalid graph unexpectedly compiled")
+    };
+    let message = error
+      .downcast_ref::<String>()
+      .map(String::as_str)
+      .or_else(|| error.downcast_ref::<&str>().copied())
+      .expect("string compilation error");
+    assert!(message.contains("constraint compilation failed:"), "{message}");
+    assert!(message.contains(expected_error), "{message}");
+    write_spec(&mut out, spec);
+  }
+  if let Some(path) = std::env::var_os("IX_GRAPH_COMPILATION_SNAPSHOT") {
+    fs::write(path, out)?;
+  }
+  eprintln!(
+    "graph compilation: {} complete graphs, {} rejected specifications, {assignments} assignments, {node_values} node values",
+    specs.len(),
+    rejected.len()
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/vk_codec/tests/domain.rs b/crates/aiur/src/vk_codec/tests/domain.rs
new file mode 100644
index 000000000..88ea5a3d6
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/domain.rs
@@ -0,0 +1,249 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! The actual pinned polynomial-space selectors, at all supported domain
+//! sizes and on complete small cosets. Large domains are never enumerated.
+
+use super::*;
+use multi_stark::{
+  p3_field::{
+    BasedVectorSpace, Field, TwoAdicField, coset::TwoAdicMultiplicativeCoset,
+  },
+  types::ExtVal,
+};
+use p3_commit::PolynomialSpace;
+use std::io;
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  for &coordinate in value.as_basis_coefficients_slice() {
+    field(out, coordinate);
+  }
+}
+
+fn selector_values(
+  out: &mut Vec<u8>,
+  values: &p3_commit::LagrangeSelectors<ExtVal>,
+) {
+  extension(out, values.is_first_row);
+  extension(out, values.is_last_row);
+  extension(out, values.is_transition);
+  extension(out, values.inv_vanishing);
+}
+
+fn challenges(last: Val) -> Vec<ExtVal> {
+  let mut values: Vec<_> = [
+    Val::ZERO,
+    Val::ONE,
+    Val::NEG_ONE,
+    last,
+    Val::from_u64(7),
+    Val::from_u64(1 << 32),
+    Val::from_u64(1 << 63),
+    Val::from_u64(Val::ORDER_U64 - 2),
+  ]
+  .into_iter()
+  .map(ExtVal::from)
+  .collect();
+  let mut state = 0x04c9_bd65_a678_10fb_u64;
+  let mut next = || {
+    state ^= state << 13;
+    state ^= state >> 7;
+    state ^= state << 17;
+    Val::from_u64(state)
+  };
+  for _ in 0..56 {
+    values.push(ExtVal::new([next(), next()]));
+  }
+  values
+}
+
+#[test]
+fn domain_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur trace domains v1\n".to_vec();
+  assert_eq!(Val::TWO_ADICITY, 32);
+  nat(&mut out, 33);
+  for bits in 0..=32 {
+    let domain =
+      TwoAdicMultiplicativeCoset::<Val>::new(Val::ONE, bits).unwrap();
+    let n = domain.size();
+    let generator = domain.subgroup_generator();
+    let last = generator.inverse();
+    let normalizer = Val::from_usize(n) * generator;
+    nat(&mut out, bits);
+    nat(&mut out, n);
+    field(&mut out, generator);
+    field(&mut out, last);
+    field(&mut out, normalizer);
+    field(&mut out, normalizer.inverse());
+    assert_eq!(domain.first_point(), Val::ONE);
+    assert_eq!(generator.exp_power_of_2(bits), Val::ONE);
+    if bits > 0 {
+      assert_eq!(generator.exp_power_of_2(bits - 1), Val::NEG_ONE);
+    }
+    let mut indices: Vec<_> = (0..n.min(16)).collect();
+    indices.extend([n / 2, n - 1, n.saturating_sub(2)]);
+    for seed in 0..16_usize {
+      indices.push(seed.wrapping_mul(0x0a37_51c9) % n);
+    }
+    indices.sort_unstable();
+    indices.dedup();
+    nat(&mut out, indices.len());
+    for index in indices {
+      let point = generator.exp_u64(u64::try_from(index).unwrap());
+      let next = domain.next_point(ExtVal::from(point)).unwrap();
+      nat(&mut out, index);
+      field(&mut out, point);
+      extension(&mut out, next);
+      assert_eq!(next, ExtVal::from(point * generator));
+      assert_eq!(
+        next,
+        ExtVal::from(
+          generator.exp_u64(u64::try_from((index + 1) % n).unwrap())
+        )
+      );
+      assert_eq!(
+        domain.vanishing_poly_at_point(ExtVal::from(point)),
+        ExtVal::ZERO
+      );
+    }
+    let points = challenges(last);
+    nat(&mut out, points.len());
+    for point in points {
+      let vanishing = domain.vanishing_poly_at_point(point);
+      extension(&mut out, point);
+      extension(&mut out, vanishing);
+      out.push(u8::from(vanishing != ExtVal::ZERO));
+      if vanishing != ExtVal::ZERO {
+        selector_values(&mut out, &domain.selectors_at_point(point));
+      }
+    }
+  }
+  // Each complete coset is disjoint from the trace domain. The bulk native
+  // algorithm and the single-point native algorithm must agree at every point.
+  nat(&mut out, 9);
+  for bits in 0..9 {
+    let domain =
+      TwoAdicMultiplicativeCoset::<Val>::new(Val::ONE, bits).unwrap();
+    let coset =
+      TwoAdicMultiplicativeCoset::<Val>::new(Val::GENERATOR, bits).unwrap();
+    let bulk = domain.selectors_on_coset(coset);
+    nat(&mut out, bits);
+    nat(&mut out, coset.size());
+    for (index, point) in coset.iter().enumerate() {
+      let single = domain.selectors_at_point(ExtVal::from(point));
+      assert_eq!(single.is_first_row, ExtVal::from(bulk.is_first_row[index]));
+      assert_eq!(single.is_last_row, ExtVal::from(bulk.is_last_row[index]));
+      assert_eq!(single.is_transition, ExtVal::from(bulk.is_transition[index]));
+      assert_eq!(single.inv_vanishing, ExtVal::from(bulk.inv_vanishing[index]));
+      field(&mut out, point);
+      selector_values(&mut out, &single);
+    }
+  }
+  for invalid in [33, 64, 255, 256, usize::MAX] {
+    assert!(
+      TwoAdicMultiplicativeCoset::<Val>::new(Val::ONE, invalid).is_none()
+    );
+  }
+  if let Some(path) = std::env::var_os("IX_DOMAIN_SNAPSHOT") {
+    std::fs::write(path, &out)?;
+  }
+  Ok(())
+}
+
+fn extensions(out: &mut Vec<u8>, values: &[ExtVal]) {
+  nat(out, values.len());
+  for &value in values {
+    extension(out, value);
+  }
+}
+
+// This reproduces the verifier's private recombination helper with native
+// basis elements, power iterator and field operations. Domain selector calls
+// above and below invoke PolynomialSpace's actual implementation directly.
+fn quotient_value(point: ExtVal, bits: usize, row: &[ExtVal]) -> ExtVal {
+  row
+    .as_chunks::<2>()
+    .0
+    .iter()
+    .zip(point.exp_power_of_2(bits).powers())
+    .map(|(chunk, power)| {
+      let coefficient = chunk
+        .iter()
+        .enumerate()
+        .map(|(index, value)| {
+          *value
+            * <ExtVal as BasedVectorSpace<Val>>::ith_basis_element(index)
+              .unwrap()
+        })
+        .sum::<ExtVal>();
+      power * coefficient
+    })
+    .sum()
+}
+
+#[test]
+fn quotient_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur quotient arithmetic v1\n".to_vec();
+  let logs = [0, 1, 2, 4, 8, 16, 31, 32];
+  let counts = [0, 1, 2, 3, 4, 7, 8, 9, 16, 31, 32];
+  let values = challenges(Val::from_u64(17));
+  nat(&mut out, logs.len() * counts.len() * 8);
+  for bits in logs {
+    let domain =
+      TwoAdicMultiplicativeCoset::<Val>::new(Val::ONE, bits).unwrap();
+    for count in counts {
+      for seed in 0..8 {
+        let point = values[8 + seed];
+        let alpha = values[seed];
+        let constraints: Vec<_> = (0..count)
+          .map(|index| values[(index * 7 + seed) % values.len()])
+          .collect();
+        let composition = constraints
+          .iter()
+          .fold(ExtVal::ZERO, |acc, &value| acc * alpha + value);
+        let mut row: Vec<_> = (0..2 * count)
+          .map(|index| values[(index * 11 + seed + 13) % values.len()])
+          .collect();
+        let selectors = domain.selectors_at_point(point);
+        let expected = composition * selectors.inv_vanishing;
+        if seed % 2 == 0 && count != 0 {
+          let error = expected - quotient_value(point, bits, &row);
+          row[0] += error;
+        }
+        let quotient = quotient_value(point, bits, &row);
+        let accepted = expected == quotient;
+        if seed % 2 == 0 || count == 0 {
+          assert!(accepted);
+        } else {
+          assert!(!accepted);
+        }
+        nat(&mut out, bits);
+        nat(&mut out, count);
+        nat(&mut out, seed);
+        extension(&mut out, point);
+        extension(&mut out, alpha);
+        extensions(&mut out, &constraints);
+        extensions(&mut out, &row);
+        extension(&mut out, composition);
+        extension(&mut out, quotient);
+        out.push(u8::from(accepted));
+        if accepted && !row.is_empty() {
+          row[0] += ExtVal::ONE;
+          assert_ne!(expected, quotient_value(point, bits, &row));
+        }
+      }
+    }
+  }
+  if let Some(path) = std::env::var_os("IX_QUOTIENT_SNAPSHOT") {
+    std::fs::write(path, &out)?;
+  }
+  Ok(())
+}
diff --git a/crates/aiur/src/vk_codec/tests/extension_arithmetic.rs b/crates/aiur/src/vk_codec/tests/extension_arithmetic.rs
new file mode 100644
index 000000000..2ffef7095
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/extension_arithmetic.rs
@@ -0,0 +1,256 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Arithmetic from the pinned field implementation, including full-width
+//! exponents and arbitrary quadratic values in the actual compiled graphs.
+
+use super::*;
+use multi_stark::{
+  eval::VarValues,
+  p3_field::{BasedVectorSpace, Field, extension::HasFrobenius},
+  types::ExtVal,
+};
+use std::io;
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  for &coordinate in value.as_basis_coefficients_slice() {
+    field(out, coordinate);
+  }
+}
+
+fn extensions(out: &mut Vec<u8>, values: &[ExtVal]) {
+  nat(out, values.len());
+  for &value in values {
+    extension(out, value);
+  }
+}
+
+fn inverse(out: &mut Vec<u8>, value: Option<ExtVal>) {
+  out.push(u8::from(value.is_some()));
+  if let Some(value) = value {
+    extension(out, value);
+  }
+}
+
+fn scalars() -> Vec<Val> {
+  let p = Val::ORDER_U64;
+  [
+    0,
+    1,
+    2,
+    7,
+    17,
+    255,
+    256,
+    65535,
+    65536,
+    (1 << 32) - 1,
+    1 << 32,
+    (1 << 48) - 1,
+    1 << 63,
+    p - 3,
+    p - 2,
+    p - 1,
+  ]
+  .into_iter()
+  .map(Val::from_u64)
+  .collect()
+}
+
+fn values() -> Vec<ExtVal> {
+  let scalars = scalars();
+  let mut values = Vec::new();
+  for &first in &scalars {
+    for &second in &scalars {
+      values.push(ExtVal::new([first, second]));
+    }
+  }
+  // Reproducible full-word coordinates, independent in the two slots.
+  let mut state = 0x19a9_391d_0582_a7a5_u64;
+  let mut next = || {
+    state ^= state << 13;
+    state ^= state >> 7;
+    state ^= state << 17;
+    Val::from_u64(state)
+  };
+  for _ in 0..128 {
+    values.push(ExtVal::new([next(), next()]));
+  }
+  values
+}
+
+fn exponents() -> [u128; 20] {
+  let p = u128::from(Val::ORDER_U64);
+  [
+    0,
+    1,
+    2,
+    3,
+    7,
+    8,
+    15,
+    16,
+    31,
+    32,
+    63,
+    64,
+    p - 2,
+    p - 1,
+    p,
+    u128::from(u64::MAX),
+    1 << 64,
+    p * p - 2,
+    (1 << 127) + 1,
+    u128::MAX,
+  ]
+}
+
+fn native_power(value: ExtVal, exponent: u128) -> ExtVal {
+  let low = u64::try_from(exponent & u128::from(u64::MAX)).unwrap();
+  let high = u64::try_from(exponent >> 64).unwrap();
+  value.exp_u64(low) * value.exp_u64(high).exp_power_of_2(64)
+}
+
+#[test]
+fn extension_arithmetic_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur extension arithmetic v1\n".to_vec();
+  let scalars = scalars();
+  nat(&mut out, scalars.len());
+  for value in scalars {
+    field(&mut out, value);
+    field(&mut out, value.try_inverse().unwrap_or(Val::ZERO));
+  }
+  let values = values();
+  let exponents = exponents();
+  extensions(&mut out, &values);
+  nat(&mut out, exponents.len());
+  for exponent in exponents {
+    out.extend(exponent.to_le_bytes());
+  }
+  let mut inverses = 0;
+  for &value in &values {
+    extension(&mut out, -value);
+    extension(&mut out, value.square());
+    extension(&mut out, value.frobenius());
+    let norm = value * value.frobenius();
+    let norm_coordinates: &[Val] = norm.as_basis_coefficients_slice();
+    assert_eq!(norm_coordinates[1], Val::ZERO);
+    field(&mut out, norm_coordinates[0]);
+    let inv = value.try_inverse();
+    if let Some(inv) = inv {
+      assert_eq!(value * inv, ExtVal::ONE);
+      inverses += 1;
+    }
+    inverse(&mut out, inv);
+    for exponent in exponents {
+      extension(&mut out, native_power(value, exponent));
+    }
+  }
+  for &left in &values {
+    for &right in &values {
+      extension(&mut out, left + right);
+      extension(&mut out, left - right);
+      extension(&mut out, left * right);
+    }
+  }
+  assert_eq!((values.len(), inverses), (384, 383));
+  if let Some(path) = std::env::var_os("IX_EXTENSION_ARITHMETIC_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  eprintln!(
+    "extension arithmetic: {} values, {} powers, {} ordered pairs",
+    values.len(),
+    values.len() * exponents.len(),
+    values.len() * values.len()
+  );
+  Ok(())
+}
+
+fn assignment(
+  values: &[ExtVal],
+  width: usize,
+  slot: usize,
+  seed: usize,
+) -> Vec<ExtVal> {
+  (0..width)
+    .map(|index| match seed {
+      0 => ExtVal::ZERO,
+      1 => ExtVal::ONE,
+      2 => -ExtVal::ONE,
+      _ => values[(index * 37 + slot * 61 + seed * 19) % values.len()],
+    })
+    .collect()
+}
+
+#[test]
+fn extension_graph_snapshot() -> io::Result<()> {
+  let system = graph_tests::graph_system();
+  let values = values();
+  let mut out = b"Aiur extension graphs v1\n".to_vec();
+  nat(&mut out, system.circuits.len());
+  let mut nodes = 0;
+  for circuit in &system.circuits {
+    let mut encoded = Vec::new();
+    encode_circuit(&mut encoded, circuit);
+    nat(&mut out, encoded.len());
+    out.extend(encoded);
+    nat(&mut out, 24);
+    for seed in 0..24 {
+      let widths = [
+        circuit.preprocessed_width,
+        circuit.preprocessed_width,
+        circuit.main_width,
+        circuit.main_width,
+        circuit.stage_2_width,
+        circuit.stage_2_width,
+        circuit.num_publics,
+      ];
+      let rows: Vec<_> = widths
+        .into_iter()
+        .enumerate()
+        .map(|(slot, width)| assignment(&values, width, slot, seed))
+        .collect();
+      for row in &rows {
+        extensions(&mut out, row);
+      }
+      let selectors = assignment(&values, 3, 7, seed);
+      for &selector in &selectors {
+        extension(&mut out, selector);
+      }
+      let view = VarValues {
+        preprocessed: [&rows[0], &rows[1]],
+        main: [&rows[2], &rows[3]],
+        stage2: [&rows[4], &rows[5]],
+        publics: &rows[6],
+        is_first_row: selectors[0],
+        is_last_row: selectors[1],
+        is_transition: selectors[2],
+      };
+      let mut buffer = Vec::new();
+      circuit.graph.sweep(&view, &mut buffer);
+      nodes += buffer.len();
+      extensions(&mut out, &buffer);
+      extensions(&mut out, &circuit.graph.constraint_values(&buffer));
+      let lookups = circuit.graph.lookup_values(&buffer);
+      nat(&mut out, lookups.len());
+      for lookup in lookups {
+        extension(&mut out, lookup.multiplicity);
+        extensions(&mut out, &lookup.args);
+      }
+    }
+  }
+  assert_eq!((system.circuits.len(), nodes), (10, 8016));
+  if let Some(path) = std::env::var_os("IX_EXTENSION_GRAPH_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  eprintln!("extension graphs: 240 native assignments, {nodes} node values");
+  Ok(())
+}
diff --git a/crates/aiur/src/vk_codec/tests/graphs.rs b/crates/aiur/src/vk_codec/tests/graphs.rs
new file mode 100644
index 000000000..48651c9aa
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/graphs.rs
@@ -0,0 +1,285 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+use super::*;
+use crate::{
+  bytecode::{
+    Block, Circuit as BytecodeCircuit, Ctrl, Function, FunctionLayout, Op,
+    Toplevel,
+  },
+  gadgets::{AiurGadget, bytes1::Bytes1, bytes2::Bytes2},
+  memory::Memory,
+};
+use multi_stark::{
+  eval::VarValues,
+  expr::{Expr, ExtExpr},
+  p3_matrix::dense::RowMajorMatrix,
+  system::CircuitInputs,
+};
+use std::{
+  fs::File,
+  io::{self, Write},
+};
+
+fn expression_input() -> CircuitInputs<Val> {
+  let x = Expr::main(0);
+  let y = Expr::main_next(1);
+  let constraints = vec![
+    x.clone() + Expr::preprocessed(0),
+    y.clone() - Expr::public(1),
+    -x.clone(),
+    Expr::IsTransition * (x.clone() * x.clone() - y.clone()),
+    // Exercise explicit frontend nodes, folding and duplicate roots.
+    Expr::Add(Box::new(Expr::Const(Val::ZERO)), Box::new(x.clone())),
+    Expr::Sub(Box::new(x.clone()), Box::new(x.clone())),
+    x.clone(),
+    x.clone(),
+  ];
+  let ext = ExtExpr::stage2(0, 2, RowOffset::Current);
+  let ext_constraints = vec![
+    ext.clone() * ext.clone() - ExtExpr::stage2(0, 2, RowOffset::Next),
+    -ext + ExtExpr::Coords(vec![x.clone(), y.clone()]),
+  ];
+  let lookups = vec![Lookup {
+    multiplicity: -x.clone(),
+    args: vec![
+      x,
+      y,
+      Expr::preprocessed(1),
+      Expr::preprocessed_next(0),
+      Expr::public(0),
+      Expr::IsFirstRow,
+      Expr::IsLastRow,
+      Expr::IsTransition,
+      Expr::Const(Val::from_u64(65536)),
+      Expr::Const(-Val::ONE),
+      // Compilation interns Main(2), then folds the expression to zero.
+      // The compiler's lookup prefix can therefore exceed the root-derived
+      // prefix reconstructed by the codec, without changing lookup values.
+      Expr::Mul(Box::new(Expr::Const(Val::ZERO)), Box::new(Expr::main(2))),
+    ],
+  }];
+  CircuitInputs {
+    main_width: 3,
+    preprocessed: Some(RowMajorMatrix::new(vec![Val::ZERO; 4], 2)),
+    constraints,
+    ext_constraints,
+    lookups,
+    lookup_group_size: 1,
+  }
+}
+
+fn function_inputs() -> Vec<CircuitInputs<Val>> {
+  let layout =
+    FunctionLayout { input_size: 2, selectors: 1, auxiliaries: 8, lookups: 4 };
+  let function = || Function {
+    body: Block { ops: vec![Op::Mul(0, 1)], ctrl: Ctrl::Return(0, vec![2]) },
+    layout,
+    entry: true,
+    constrained: true,
+  };
+  let top = Toplevel {
+    functions: vec![function(), function()],
+    circuits: vec![
+      BytecodeCircuit { members: vec![0], layout },
+      BytecodeCircuit {
+        members: vec![0, 1],
+        layout: FunctionLayout { selectors: 2, ..layout },
+      },
+    ],
+    memory_sizes: vec![],
+  };
+  (0..top.circuits.len())
+    .map(|index| {
+      let (constraints, lookups) = top.build_constraints(index);
+      CircuitInputs {
+        main_width: constraints.width,
+        constraints: constraints.zeros,
+        lookups,
+        lookup_group_size: 1,
+        ..CircuitInputs::default()
+      }
+    })
+    .collect()
+}
+
+pub(super) fn graph_system() -> System<AiurConfig> {
+  let mut inputs = vec![expression_input()];
+  for size in [0, 1, 2, 4, 8] {
+    let (memory, constraints, lookups) = Memory::build(size);
+    inputs.push(CircuitInputs {
+      main_width: memory.width,
+      constraints,
+      lookups,
+      lookup_group_size: 1,
+      ..CircuitInputs::default()
+    });
+  }
+  inputs.extend([
+    CircuitInputs {
+      main_width: Bytes1.main_width(),
+      preprocessed: Bytes1.preprocessed(),
+      lookups: Bytes1.lookups(),
+      lookup_group_size: 1,
+      ..CircuitInputs::default()
+    },
+    CircuitInputs {
+      main_width: Bytes2.main_width(),
+      preprocessed: Bytes2.preprocessed(),
+      lookups: Bytes2.lookups(),
+      lookup_group_size: 2,
+      ..CircuitInputs::default()
+    },
+  ]);
+  inputs.extend(function_inputs());
+  let cp = CommitmentParameters { log_blowup: 1, cap_height: 0 };
+  let fp = FriParameters {
+    log_final_poly_len: 0,
+    max_log_arity: 1,
+    num_queries: 64,
+    commit_proof_of_work_bits: 0,
+    query_proof_of_work_bits: 0,
+  };
+  System::new(AiurConfig::new(cp, fp), inputs).0
+}
+
+fn write_nat(out: &mut Vec<u8>, value: usize) {
+  out.extend_from_slice(&(value as u64).to_le_bytes());
+}
+
+fn write_values(out: &mut Vec<u8>, values: &[Val]) {
+  write_nat(out, values.len());
+  for value in values {
+    out.extend_from_slice(&value.as_canonical_u64().to_le_bytes());
+  }
+}
+
+fn assignment(width: usize, matrix: usize, pattern: usize) -> Vec<Val> {
+  let choices = [
+    Val::ZERO,
+    Val::ONE,
+    -Val::ONE,
+    Val::from_u64(255),
+    Val::from_u64(256),
+    Val::from_u64(1 << 32),
+    Val::from_u64((1 << 48) - 1),
+    Val::from_u64(17),
+  ];
+  (0..width)
+    .map(|index| match pattern {
+      0 => Val::ZERO,
+      1 => Val::ONE,
+      2 => -Val::ONE,
+      _ => choices[(5 * index + 3 * pattern + matrix) % choices.len()],
+    })
+    .collect()
+}
+
+#[test]
+fn expression_graph_snapshot() -> io::Result<()> {
+  let system = graph_system();
+  let mut out = b"Aiur expression graphs v1\n".to_vec();
+  write_nat(&mut out, system.circuits.len());
+  let mut checked = 0;
+  let mut nodes_evaluated = 0;
+  let mut shortened_prefixes = 0;
+  for circuit in &system.circuits {
+    let mut encoded = Vec::new();
+    encode_circuit(&mut encoded, circuit);
+    // Exercise the production decoder's new checks on every actual graph.
+    let mut segment = Seg { buf: &encoded, pos: 0 };
+    let decoded = decode_circuit(&mut segment).expect("actual graph decodes");
+    segment.done("circuit").unwrap();
+    assert_eq!(decoded.graph.nodes, circuit.graph.nodes);
+    assert_eq!(decoded.graph.degrees, circuit.graph.degrees);
+    assert_eq!(decoded.graph.zeros, circuit.graph.zeros);
+    assert_eq!(decoded.graph.lookups, circuit.graph.lookups);
+    assert_eq!(
+      decoded.graph.max_constraint_degree,
+      circuit.graph.max_constraint_degree
+    );
+    assert!(decoded.graph.lookup_prefix_len <= circuit.graph.lookup_prefix_len);
+    if decoded.graph.lookup_prefix_len < circuit.graph.lookup_prefix_len {
+      shortened_prefixes += 1;
+    }
+    let mut reencoded = Vec::new();
+    encode_circuit(&mut reencoded, &decoded);
+    assert_eq!(reencoded, encoded);
+    write_nat(&mut out, encoded.len());
+    out.extend_from_slice(&encoded);
+    write_nat(&mut out, 24);
+    for pattern in 0..24 {
+      let widths = [
+        circuit.preprocessed_width,
+        circuit.preprocessed_width,
+        circuit.main_width,
+        circuit.main_width,
+        circuit.stage_2_width,
+        circuit.stage_2_width,
+      ];
+      let rows: Vec<_> = widths
+        .into_iter()
+        .enumerate()
+        .map(|(matrix, width)| assignment(width, matrix, pattern))
+        .collect();
+      let publics = assignment(circuit.num_publics, 6, pattern);
+      for row in &rows {
+        write_values(&mut out, row);
+      }
+      write_values(&mut out, &publics);
+      let selectors = [
+        Val::from_bool(pattern % 4 == 0),
+        Val::from_bool(pattern % 4 == 1),
+        Val::from_bool(pattern % 4 != 1),
+      ];
+      for value in selectors {
+        out.extend_from_slice(&value.as_canonical_u64().to_le_bytes());
+      }
+      let values = VarValues {
+        preprocessed: [&rows[0], &rows[1]],
+        main: [&rows[2], &rows[3]],
+        stage2: [&rows[4], &rows[5]],
+        publics: &publics,
+        is_first_row: selectors[0],
+        is_last_row: selectors[1],
+        is_transition: selectors[2],
+      };
+      let mut full = Vec::new();
+      circuit.graph.sweep(&values, &mut full);
+      let mut prefix = Vec::new();
+      let mut compiled_prefix = Vec::new();
+      circuit.graph.sweep_lookup_prefix(
+        &VarValues { stage2: [&[], &[]], ..values },
+        &mut compiled_prefix,
+      );
+      decoded.graph.sweep_lookup_prefix(
+        &VarValues { stage2: [&[], &[]], ..values },
+        &mut prefix,
+      );
+      assert_eq!(prefix, compiled_prefix[..prefix.len()]);
+      assert_eq!(prefix, full[..prefix.len()]);
+      write_values(&mut out, &full);
+      write_values(&mut out, &prefix);
+      write_values(&mut out, &circuit.graph.constraint_values(&full));
+      let lookups = circuit.graph.lookup_values(&prefix);
+      write_nat(&mut out, lookups.len());
+      for lookup in lookups {
+        out.extend_from_slice(
+          &lookup.multiplicity.as_canonical_u64().to_le_bytes(),
+        );
+        write_values(&mut out, &lookup.args);
+      }
+      nodes_evaluated += full.len();
+      checked += 1;
+    }
+  }
+  assert_eq!(checked, 240);
+  assert!(shortened_prefixes > 0, "include folded, unused lookup nodes");
+  if let Some(path) = std::env::var_os("IX_EXPRESSION_GRAPH_SNAPSHOT") {
+    File::create(path)?.write_all(&out)?;
+  }
+  eprintln!(
+    "expression graphs: {checked} native assignments, {nodes_evaluated} node values"
+  );
+  Ok(())
+}
diff --git a/crates/aiur/src/vk_codec/tests/logup.rs b/crates/aiur/src/vk_codec/tests/logup.rs
new file mode 100644
index 000000000..a1400b6b5
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/logup.rs
@@ -0,0 +1,355 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! The pinned direct evaluator in both scalar domains, its independent
+//! symbolic specification, and the actual grouped stage-2 trace builder.
+
+use super::*;
+use multi_stark::{
+  eval::{VarValues, eval_ext_expr},
+  expr::Expr,
+  graph::ExtensionParams,
+  lookup::{
+    LookupValues, logup_constraint_values, stage2_width, synthesize_lookups,
+  },
+  p3_field::{
+    Algebra, BasedVectorSpace, Field, TwoAdicField,
+    extension::BinomiallyExtendable,
+  },
+  types::ExtVal,
+};
+use std::io;
+
+const COUNTS: [usize; 22] = [
+  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 15, 16, 17, 23, 24, 25, 31, 32, 33, 63, 64, 65,
+];
+const ARITIES: [usize; 10] = [0, 1, 2, 3, 4, 7, 8, 9, 16, 17];
+const SEEDS: usize = 12;
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  for &coordinate in value.as_basis_coefficients_slice() {
+    field(out, coordinate);
+  }
+}
+
+fn vector<W: Copy>(
+  out: &mut Vec<u8>,
+  values: &[W],
+  encode: fn(&mut Vec<u8>, W),
+) {
+  nat(out, values.len());
+  for &value in values {
+    encode(out, value);
+  }
+}
+
+fn scalar(seed: usize, slot: usize, index: usize) -> Val {
+  let mut value = 0x508c_4dd3_50c9_1a2b_u64
+    .wrapping_add(u64::try_from(seed).unwrap().wrapping_mul(0x36d3_2817))
+    .wrapping_add(u64::try_from(slot).unwrap().wrapping_mul(0x792b_586f))
+    .wrapping_add(u64::try_from(index).unwrap().wrapping_mul(0x650d_810b));
+  for _ in 0..4 {
+    value ^= value << 13;
+    value ^= value >> 7;
+    value ^= value << 17;
+  }
+  if seed < 6 {
+    let boundary = [
+      0,
+      1,
+      2,
+      7,
+      255,
+      65536,
+      (1 << 32) - 1,
+      1 << 63,
+      Val::ORDER_U64 - 2,
+      Val::ORDER_U64 - 1,
+    ];
+    Val::from_u64(boundary[(seed + slot + index) % boundary.len()])
+  } else {
+    Val::from_u64(value)
+  }
+}
+
+fn assignment<W: Field>(
+  seed: usize,
+  slot: usize,
+  length: usize,
+  make: fn(Val, Val) -> W,
+) -> Vec<W> {
+  (0..length)
+    .map(|index| match seed {
+      0 => W::ZERO,
+      1 => W::ONE,
+      2 => W::NEG_ONE,
+      _ => {
+        make(scalar(seed, 2 * slot, index), scalar(seed, 2 * slot + 1, index))
+      },
+    })
+    .collect()
+}
+
+fn lookup_ids(count: usize) -> (Vec<Lookup<NodeId>>, usize) {
+  let mut next = 1;
+  let lookups = (0..count)
+    .map(|index| {
+      let multiplicity = NodeId(u32::try_from(next).unwrap());
+      next += 1;
+      let args = (0..ARITIES[index % ARITIES.len()])
+        .map(|arg| {
+          let id = if arg % 3 == 2 { 0 } else { next };
+          next += 1;
+          NodeId(u32::try_from(id).unwrap())
+        })
+        .collect();
+      Lookup { multiplicity, args }
+    })
+    .collect();
+  (lookups, next)
+}
+
+fn encode_ids(out: &mut Vec<u8>, lookups: &[Lookup<NodeId>]) {
+  nat(out, lookups.len());
+  for lookup in lookups {
+    nat(out, lookup.multiplicity.index());
+    nat(out, lookup.args.len());
+    for &arg in &lookup.args {
+      nat(out, arg.index());
+    }
+  }
+}
+
+fn direct_cases<W: Field + Algebra<Val>>(
+  out: &mut Vec<u8>,
+  make: fn(Val, Val) -> W,
+  encode: fn(&mut Vec<u8>, W),
+) {
+  nat(out, COUNTS.len() * 9 * SEEDS);
+  for count in COUNTS {
+    let (lookups, nodes) = lookup_ids(count);
+    let symbolic: Vec<Lookup<Expr<W>>> = lookups
+      .iter()
+      .map(|lookup| Lookup {
+        multiplicity: Expr::main(lookup.multiplicity.0),
+        args: lookup.args.iter().map(|id| Expr::main(id.0)).collect(),
+      })
+      .collect();
+    for group_size in 0..=8 {
+      let expressions = synthesize_lookups(&symbolic, 2, group_size);
+      let params = ExtensionParams {
+        degree: 2,
+        w: W::from(Val::from_u8(7)),
+        karatsuba: false,
+      };
+      for seed in 0..SEEDS {
+        nat(out, count);
+        nat(out, group_size);
+        nat(out, seed);
+        encode_ids(out, &lookups);
+        let node_values = assignment(seed, 0, nodes, make);
+        let width = stage2_width(count, group_size, 2);
+        let current = assignment(seed, 1, width, make);
+        let next = assignment(seed, 2, width, make);
+        let publics = assignment(seed, 3, 8, make);
+        let delta = [publics[6] - publics[4], publics[7] - publics[5]];
+        let is_last = assignment(seed, 4, 1, make)[0];
+        let view = VarValues {
+          preprocessed: [&[], &[]],
+          main: [&node_values, &[]],
+          stage2: [&current, &next],
+          publics: &publics,
+          is_first_row: W::ZERO,
+          is_last_row: is_last,
+          is_transition: W::ONE,
+        };
+        let reference: Vec<W> = expressions
+          .iter()
+          .flat_map(|expression| eval_ext_expr(expression, &view, &params))
+          .collect();
+        // Appending must retain the user constraints that precede logUp.
+        let mut direct = vec![W::from_u8(3), W::from_u8(9)];
+        logup_constraint_values(
+          &lookups,
+          &node_values,
+          &current,
+          &next,
+          &publics,
+          &delta,
+          is_last,
+          Val::from_u8(7),
+          2,
+          group_size,
+          &mut direct,
+        );
+        assert_eq!(&direct[..2], &[W::from_u8(3), W::from_u8(9)]);
+        assert_eq!(&direct[2..], reference);
+        assert_eq!(reference.len(), width);
+        for values in [&node_values, &current, &next, &publics] {
+          vector(out, values, encode);
+        }
+        vector(out, &delta, encode);
+        encode(out, is_last);
+        vector(out, &direct[2..], encode);
+      }
+    }
+  }
+}
+
+#[test]
+fn logup_snapshot() -> io::Result<()> {
+  assert_eq!(<ExtVal as BasedVectorSpace<Val>>::DIMENSION, 2);
+  assert_eq!(<Val as BinomiallyExtendable<2>>::W, Val::from_u8(7));
+  let mut out = b"Aiur grouped logup v1\n".to_vec();
+  direct_cases(&mut out, |first, _| first, field);
+  direct_cases(
+    &mut out,
+    |first, second| ExtVal::new([first, second]),
+    extension,
+  );
+  if let Some(path) = std::env::var_os("IX_LOGUP_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  eprintln!(
+    "grouped logup: {} direct/reference cases",
+    2 * COUNTS.len() * 9 * SEEDS
+  );
+  Ok(())
+}
+
+fn flatten(values: &[ExtVal]) -> Vec<Val> {
+  values
+    .iter()
+    .flat_map(|value| value.as_basis_coefficients_slice().iter().copied())
+    .collect()
+}
+
+fn rows(circuit: usize, seed: usize) -> Vec<Vec<Lookup<Val>>> {
+  let height = [1, 2, 4, 8, 4][circuit];
+  let count = [0, 1, 9, 17, 25][circuit];
+  (0..height)
+    .map(|row| {
+      (0..count)
+        .map(|lookup| Lookup {
+          multiplicity: scalar(seed + 3, row, lookup),
+          args: (0..ARITIES[(lookup + row) % ARITIES.len()])
+            .map(|arg| scalar(seed + 7, lookup, arg + row * 31))
+            .collect(),
+        })
+        .collect()
+    })
+    .collect()
+}
+
+fn message(beta: ExtVal, gamma: ExtVal, args: &[Val]) -> ExtVal {
+  beta + args.iter().rev().fold(ExtVal::ZERO, |acc, &arg| acc * gamma + arg)
+}
+
+#[test]
+fn logup_stage_snapshot() -> io::Result<()> {
+  let mut out = b"Aiur grouped logup stages v1\n".to_vec();
+  nat(&mut out, 27);
+  let mut row_count = 0;
+  for group_size in 0..=8 {
+    for seed in 0..3 {
+      let beta = ExtVal::new([Val::from_usize(5 + seed), Val::from_u8(13)]);
+      let gamma = ExtVal::new([Val::from_u8(7), Val::from_usize(11 + seed)]);
+      let initial = ExtVal::new([Val::from_u8(17), Val::from_usize(19 + seed)]);
+      let raw: Vec<_> = (0..5).map(|circuit| rows(circuit, seed)).collect();
+      for row in raw.iter().flatten() {
+        for lookup in row {
+          assert!(message(beta, gamma, &lookup.args).try_inverse().is_some());
+        }
+      }
+      let circuits: Vec<_> =
+        raw.iter().cloned().map(LookupValues::from_rows).collect();
+      let (traces, accumulators) = LookupValues::stage_2_traces(
+        &circuits,
+        &[group_size; 5],
+        beta,
+        &gamma,
+        initial,
+      );
+      nat(&mut out, group_size);
+      nat(&mut out, seed);
+      extension(&mut out, beta);
+      extension(&mut out, gamma);
+      extension(&mut out, initial);
+      nat(&mut out, raw.len());
+      let mut entering = initial;
+      for ((rows, trace), &leaving) in
+        raw.iter().zip(&traces).zip(&accumulators)
+      {
+        nat(&mut out, rows.len());
+        nat(&mut out, rows[0].len());
+        nat(&mut out, trace.width);
+        vector(&mut out, &trace.values, extension);
+        extension(&mut out, leaving);
+        let normalizer = Val::from_usize(rows.len())
+          * Val::two_adic_generator(
+            usize::try_from(rows.len().ilog2()).unwrap(),
+          );
+        field(&mut out, normalizer);
+        let delta = flatten(&[(leaving - entering) * normalizer.inverse()]);
+        let publics = flatten(&[beta, gamma, entering, leaving]);
+        for (row_index, row) in rows.iter().enumerate() {
+          nat(&mut out, row.len());
+          let mut node_values = Vec::new();
+          let mut ids = Vec::new();
+          for lookup in row {
+            field(&mut out, lookup.multiplicity);
+            vector(&mut out, &lookup.args, field);
+            let multiplicity =
+              NodeId(u32::try_from(node_values.len()).unwrap());
+            node_values.push(lookup.multiplicity);
+            let mut args = Vec::new();
+            for &arg in &lookup.args {
+              args.push(NodeId(u32::try_from(node_values.len()).unwrap()));
+              node_values.push(arg);
+            }
+            ids.push(Lookup { multiplicity, args });
+          }
+          let start = row_index * trace.width;
+          let next_start = (row_index + 1) % rows.len() * trace.width;
+          let current = flatten(&trace.values[start..start + trace.width]);
+          let next =
+            flatten(&trace.values[next_start..next_start + trace.width]);
+          let is_last =
+            if row_index + 1 == rows.len() { normalizer } else { Val::ZERO };
+          let mut equations = Vec::new();
+          logup_constraint_values(
+            &ids,
+            &node_values,
+            &current,
+            &next,
+            &publics,
+            &delta,
+            is_last,
+            Val::from_u8(7),
+            2,
+            group_size,
+            &mut equations,
+          );
+          assert!(equations.iter().all(|&value| value == Val::ZERO));
+          vector(&mut out, &equations, field);
+          row_count += 1;
+        }
+        entering = leaving;
+      }
+    }
+  }
+  assert_eq!(row_count, 513);
+  if let Some(path) = std::env::var_os("IX_LOGUP_STAGE_SNAPSHOT") {
+    std::fs::write(path, out)?;
+  }
+  eprintln!("grouped stages: 27 batches, 135 circuits, {row_count} rows");
+  Ok(())
+}
diff --git a/crates/aiur/src/vk_codec/tests/verifier_arithmetic.rs b/crates/aiur/src/vk_codec/tests/verifier_arithmetic.rs
new file mode 100644
index 000000000..0438e5e76
--- /dev/null
+++ b/crates/aiur/src/vk_codec/tests/verifier_arithmetic.rs
@@ -0,0 +1,432 @@
+// Copyright (c) 2026 Argument Computer Corporation.
+// SPDX-License-Identifier: MIT OR Apache-2.0
+
+//! Combined opened-row arithmetic using the actual graph sweep, direct
+//! logUp evaluator and domain selectors. The private verifier's wiring,
+//! Horner fold, quotient recombination and claim loop are reproduced here;
+//! these deliberately constructed openings are not authenticated proofs.
+
+use super::*;
+use multi_stark::{
+  eval::VarValues,
+  lookup::logup_constraint_values,
+  p3_field::{
+    BasedVectorSpace, Field, TwoAdicField, coset::TwoAdicMultiplicativeCoset,
+  },
+  system::Circuit,
+  types::ExtVal,
+};
+use p3_commit::{LagrangeSelectors, PolynomialSpace};
+use std::io;
+
+#[derive(Clone, Copy)]
+struct Challenges {
+  beta: ExtVal,
+  gamma: ExtVal,
+  alpha: ExtVal,
+  zeta: ExtVal,
+}
+
+struct Opening {
+  index: usize,
+  bits: usize,
+  main: [Vec<ExtVal>; 2],
+  stage2: [Vec<ExtVal>; 2],
+  preprocessed: Option<[Vec<ExtVal>; 2]>,
+  quotient: Vec<ExtVal>,
+  accumulator: ExtVal,
+}
+
+struct Evaluation {
+  selectors: LagrangeSelectors<ExtVal>,
+  publics: Vec<ExtVal>,
+  delta: Vec<ExtVal>,
+  nodes: Vec<ExtVal>,
+  user: Vec<ExtVal>,
+  lookups: Vec<ExtVal>,
+  composition: ExtVal,
+  quotient: ExtVal,
+}
+
+impl Evaluation {
+  fn accepts(&self) -> bool {
+    self.composition * self.selectors.inv_vanishing == self.quotient
+  }
+}
+
+fn nat(out: &mut Vec<u8>, value: usize) {
+  out.extend(u64::try_from(value).unwrap().to_le_bytes());
+}
+
+fn field(out: &mut Vec<u8>, value: Val) {
+  out.extend(value.as_canonical_u64().to_le_bytes());
+}
+
+fn extension(out: &mut Vec<u8>, value: ExtVal) {
+  for &value in value.as_basis_coefficients_slice() {
+    field(out, value);
+  }
+}
+
+fn extensions(out: &mut Vec<u8>, values: &[ExtVal]) {
+  nat(out, values.len());
+  for &value in values {
+    extension(out, value);
+  }
+}
+
+fn scalar(seed: usize, slot: usize, index: usize) -> Val {
+  let mut word = 0x79e3_4987_6a8b_051f_u64
+    .wrapping_add(u64::try_from(seed).unwrap().wrapping_mul(0x74d8_b901))
+    .wrapping_add(u64::try_from(slot).unwrap().wrapping_mul(0x5982_6407))
+    .wrapping_add(u64::try_from(index).unwrap().wrapping_mul(0x8071_5823));
+  for _ in 0..4 {
+    word ^= word << 13;
+    word ^= word >> 7;
+    word ^= word << 17;
+  }
+  Val::from_u64(word)
+}
+
+fn value(seed: usize, slot: usize, index: usize) -> ExtVal {
+  ExtVal::new([
+    scalar(seed, slot * 2, index),
+    scalar(seed, slot * 2 + 1, index),
+  ])
+}
+
+fn challenges(seed: usize) -> Challenges {
+  Challenges {
+    beta: value(seed, 40, 0),
+    gamma: value(seed, 41, 0),
+    alpha: match seed % 6 {
+      0 => ExtVal::ZERO,
+      1 => ExtVal::ONE,
+      2 => ExtVal::NEG_ONE,
+      3 => ExtVal::new([Val::ZERO, Val::ONE]),
+      _ => value(seed, 42, 0),
+    },
+    zeta: value(seed, 43, 0),
+  }
+}
+
+fn opening(
+  circuit: &Circuit<Val>,
+  index: usize,
+  bits: usize,
+  seed: usize,
+) -> Opening {
+  let assignment =
+    |width, slot| (0..width).map(|index| value(seed, slot, index)).collect();
+  Opening {
+    index,
+    bits,
+    main: [
+      assignment(circuit.main_width, 0),
+      assignment(circuit.main_width, 1),
+    ],
+    stage2: [
+      assignment(circuit.stage_2_width, 2),
+      assignment(circuit.stage_2_width, 3),
+    ],
+    preprocessed: (circuit.preprocessed_width != 0).then(|| {
+      [
+        assignment(circuit.preprocessed_width, 4),
+        assignment(circuit.preprocessed_width, 5),
+      ]
+    }),
+    quotient: assignment(circuit.quotient_degree() * 2, 6),
+    accumulator: value(seed, 7, 0),
+  }
+}
+
+fn evaluate(
+  circuit: &Circuit<Val>,
+  row: &Opening,
+  challenges: Challenges,
+  entering: ExtVal,
+) -> Evaluation {
+  let domain =
+    TwoAdicMultiplicativeCoset::<Val>::new(Val::ONE, row.bits).unwrap();
+  assert_ne!(domain.vanishing_poly_at_point(challenges.zeta), ExtVal::ZERO);
+  let selectors = domain.selectors_at_point(challenges.zeta);
+  let publics: Vec<_> =
+    [challenges.beta, challenges.gamma, entering, row.accumulator]
+      .iter()
+      .flat_map(|value| {
+        let coordinates: &[Val] = value.as_basis_coefficients_slice();
+        coordinates.iter().copied().map(ExtVal::from)
+      })
+      .collect();
+  let norm = ExtVal::from(
+    (Val::from_usize(domain.size()) * Val::two_adic_generator(row.bits))
+      .inverse(),
+  );
+  let delta: Vec<_> = (0..2)
+    .map(|index| (publics[6 + index] - publics[4 + index]) * norm)
+    .collect();
+  let empty = Vec::new();
+  let preprocessed = row
+    .preprocessed
+    .as_ref()
+    .map_or([&empty, &empty], |rows| [&rows[0], &rows[1]]);
+  let view = VarValues {
+    preprocessed: [preprocessed[0], preprocessed[1]],
+    main: [&row.main[0], &row.main[1]],
+    stage2: [&row.stage2[0], &row.stage2[1]],
+    publics: &publics,
+    is_first_row: selectors.is_first_row,
+    is_last_row: selectors.is_last_row,
+    is_transition: selectors.is_transition,
+  };
+  let mut nodes = Vec::new();
+  circuit.graph.sweep(&view, &mut nodes);
+  let user = circuit.graph.constraint_values(&nodes);
+  let mut lookups = Vec::new();
+  logup_constraint_values(
+    &circuit.graph.lookups,
+    &nodes,
+    view.stage2[0],
+    view.stage2[1],
+    &publics,
+    &delta,
+    selectors.is_last_row,
+    Val::from_u64(7),
+    2,
+    circuit.lookup_group_size,
+    &mut lookups,
+  );
+  assert_eq!(user.len() + lookups.len(), circuit.constraint_count());
+  let composition = user
+    .iter()
+    .chain(&lookups)
+    .fold(ExtVal::ZERO, |acc, &value| acc * challenges.alpha + value);
+  let quotient = row
+    .quotient
+    .as_chunks::<2>()
+    .0
+    .iter()
+    .zip(challenges.zeta.exp_power_of_2(row.bits).powers())
+    .map(|(chunk, power)| {
+      power
+        * (chunk[0]
+          + chunk[1]
+            * <ExtVal as BasedVectorSpace<Val>>::ith_basis_element(1).unwrap())
+    })
+    .sum();
+  Evaluation {
+    selectors,
+    publics,
+    delta,
+    nodes,
+    user,
+    lookups,
+    composition,
+    quotient,
+  }
+}
+
+fn adjust(
+  circuit: &Circuit<Val>,
+  row: &mut Opening,
+  challenges: Challenges,
+  entering: ExtVal,
+  accepted: bool,
+) {
+  let evaluated = evaluate(circuit, row, challenges, entering);
+  row.quotient[0] += evaluated.composition * evaluated.selectors.inv_vanishing
+    - evaluated.quotient;
+  if !accepted {
+    row.quotient[0] += ExtVal::ONE;
+  }
+  assert_eq!(evaluate(circuit, row, challenges, entering).accepts(), accepted);
+}
+
+fn write_challenges(out: &mut Vec<u8>, challenges: Challenges) {
+  for value in
+    [challenges.beta, challenges.gamma, challenges.alpha, challenges.zeta]
+  {
+    extension(out, value);
+  }
+}
+
+fn write_opening(out: &mut Vec<u8>, row: &Opening) {
+  nat(out, row.index);
+  nat(out, row.bits);
+  for pair in [&row.main, &row.stage2] {
+    for values in pair {
+      extensions(out, values);
+    }
+  }
+  out.push(u8::from(row.preprocessed.is_some()));
+  if let Some(rows) = &row.preprocessed {
+    for values in rows {
+      extensions(out, values);
+    }
+  }
+  extensions(out, &row.quotient);
+  extension(out, row.accumulator);
+}
+
+fn write_evaluation(out: &mut Vec<u8>, evaluated: &Evaluation) {
+  for value in [
+    evaluated.selectors.is_first_row,
+    evaluated.selectors.is_last_row,
+    evaluated.selectors.is_transition,
+    evaluated.selectors.inv_vanishing,
+  ] {
+    extension(out, value);
+  }
+  for values in [
+    &evaluated.publics,
+    &evaluated.delta,
+    &evaluated.nodes,
+    &evaluated.user,
+    &evaluated.lookups,
+  ] {
+    extensions(out, values);
+  }
+  extension(out, evaluated.composition);
+  extension(out, evaluated.quotient);
+  out.push(u8::from(evaluated.accepts()));
+}
+
+fn claim_message(challenges: Challenges, claim: &[Val]) -> ExtVal {
+  challenges.beta
+    + claim
+      .iter()
+      .rfold(ExtVal::ZERO, |acc, &value| acc * challenges.gamma + value)
+}
+
+fn initial(challenges: Challenges, claims: &[Vec<Val>]) -> Option<ExtVal> {
+  claims.iter().try_fold(ExtVal::ZERO, |acc, claim| {
+    Some(acc + claim_message(challenges, claim).try_inverse()?)
+  })
+}
+
+fn claims(seed: usize, count: usize) -> Vec<Vec<Val>> {
+  let lengths = [0, 1, 2, 3, 7, 16, 17];
+  (0..count)
+    .map(|index| {
+      (0..lengths[(seed + index) % lengths.len()])
+        .map(|arg| scalar(seed, 70 + index, arg))
+        .collect()
+    })
+    .collect()
+}
+
+fn write_claims(out: &mut Vec<u8>, claims: &[Vec<Val>]) {
+  nat(out, claims.len());
+  for claim in claims {
+    nat(out, claim.len());
+    for &value in claim {
+      field(out, value);
+    }
+  }
+}
+
+#[test]
+fn verifier_arithmetic_snapshot() -> io::Result<()> {
+  let system = graph_tests::graph_system();
+  let mut out = b"Aiur verifier arithmetic v1\n".to_vec();
+  nat(&mut out, system.circuits.len());
+  for circuit in &system.circuits {
+    let mut encoded = Vec::new();
+    encode_circuit(&mut encoded, circuit);
+    nat(&mut out, encoded.len());
+    out.extend(encoded);
+  }
+  nat(&mut out, system.circuits.len() * 8 * 12);
+  let mut nodes = 0;
+  for (index, circuit) in system.circuits.iter().enumerate() {
+    let largest =
+      31 - usize::try_from(circuit.quotient_degree().trailing_zeros()).unwrap();
+    for bits in [0, 1, 2, 4, 8, 16, 24, largest] {
+      for seed in 0..12 {
+        let challenges = challenges(seed);
+        let entering = value(seed, 50, 0);
+        let mut row = opening(circuit, index, bits, seed);
+        adjust(circuit, &mut row, challenges, entering, seed % 2 == 0);
+        let evaluated = evaluate(circuit, &row, challenges, entering);
+        nat(&mut out, seed);
+        write_challenges(&mut out, challenges);
+        extension(&mut out, entering);
+        write_opening(&mut out, &row);
+        write_evaluation(&mut out, &evaluated);
+        nodes += evaluated.nodes.len();
+      }
+    }
+  }
+  // Direct native inverse calls also cover poles; the total Lean model
+  // rejects them before the private verifier's unguarded inverse call.
+  nat(&mut out, 12 * 6);
+  for seed in 0..12 {
+    for count in [0, 1, 2, 3, 7, 16] {
+      let mut challenges = challenges(seed);
+      let claims = claims(seed, count);
+      if seed % 3 == 0 && count != 0 {
+        challenges.beta -= claim_message(challenges, &claims[0]);
+      }
+      let accumulator = initial(challenges, &claims);
+      assert_eq!(accumulator.is_some(), seed % 3 != 0 || count == 0);
+      write_challenges(&mut out, challenges);
+      write_claims(&mut out, &claims);
+      for claim in &claims {
+        extension(&mut out, claim_message(challenges, claim));
+      }
+      out.push(u8::from(accumulator.is_some()));
+      if let Some(accumulator) = accumulator {
+        extension(&mut out, accumulator);
+      }
+    }
+  }
+  // Vary the active order, chain length, final boundary and an interior
+  // quotient. Reusing the initial accumulator on every row changes these
+  // native node/public/lookup values even when alpha is zero or one.
+  nat(&mut out, 12 * 4);
+  for seed in 0..12 {
+    for count in [1, 2, 3, 10] {
+      let challenges = challenges(seed + 20);
+      let claims = claims(seed + 20, seed % 4);
+      let mut entering = initial(challenges, &claims).unwrap();
+      write_challenges(&mut out, challenges);
+      write_claims(&mut out, &claims);
+      nat(&mut out, count);
+      let all_rows = seed % 3 != 1;
+      for position in 0..count {
+        let index = (position * 7 + seed) % system.circuits.len();
+        let circuit = &system.circuits[index];
+        let mut row =
+          opening(circuit, index, 2 + position % 7, seed + 20 + position);
+        if position + 1 == count && seed % 3 != 2 {
+          row.accumulator = ExtVal::ZERO;
+        }
+        adjust(
+          circuit,
+          &mut row,
+          challenges,
+          entering,
+          all_rows || position != count / 2,
+        );
+        write_opening(&mut out, &row);
+        write_evaluation(
+          &mut out,
+          &evaluate(circuit, &row, challenges, entering),
+        );
+        entering = row.accumulator;
+      }
+      out.push(u8::from(all_rows));
+      if all_rows {
+        out.push(u8::from(entering == ExtVal::ZERO));
+      }
+    }
+  }
+  assert_eq!((system.circuits.len(), nodes), (10, 32064));
+  if let Some(path) = std::env::var_os("IX_VERIFIER_ARITHMETIC_SNAPSHOT") {
+    std::fs::write(path, &out)?;
+  }
+  eprintln!(
+    "verifier arithmetic: 960 openings, {nodes} node values, 72 claim cases, 48 accumulator chains"
+  );
+  Ok(())
+}
diff --git a/crates/common/src/prim_addrs.rs b/crates/common/src/prim_addrs.rs
index 661dc145e..c299da373 100644
--- a/crates/common/src/prim_addrs.rs
+++ b/crates/common/src/prim_addrs.rs
@@ -10,7 +10,7 @@
 //! Regenerate with `lake test -- --ignored rust-kernel-build-primitives`, which
 //! dumps the current `(name, hex)` pairs — paste the updated lines into
 //! `PrimAddrs::new`. `lake test -- prim-addrs` pins this table against
-//! the Lean mirror in `Ix/Tc/Primitive.lean`.
+//! the Lean mirror in `Ix/Kernel/Primitive.lean`.
 
 use std::sync::LazyLock;
 
diff --git a/crates/compile/src/compile/aux_gen/expr_utils.rs b/crates/compile/src/compile/aux_gen/expr_utils.rs
index 84b51fcd6..546e2490c 100644
--- a/crates/compile/src/compile/aux_gen/expr_utils.rs
+++ b/crates/compile/src/compile/aux_gen/expr_utils.rs
@@ -547,7 +547,7 @@ pub(super) fn batch_abstract(
 /// shifted — it's inserted as-is at the substitution depth.
 ///
 /// `instantiate1` is used when peeling forall binders during recursor
-/// construction (matching Lean C++ and lean4lean).
+/// construction (matching Lean C++ and the named specification).
 pub fn instantiate1(body: &LeanExpr, replacement: &LeanExpr) -> LeanExpr {
   instantiate1_at(body, replacement, 0)
 }
diff --git a/crates/compile/src/compile/aux_gen/source_name_hints_reference.rs b/crates/compile/src/compile/aux_gen/source_name_hints_reference.rs
index 77ab0bede..498eaf067 100644
--- a/crates/compile/src/compile/aux_gen/source_name_hints_reference.rs
+++ b/crates/compile/src/compile/aux_gen/source_name_hints_reference.rs
@@ -10,7 +10,7 @@ pub(super) fn source_name_hint_candidate(expr: &LeanExpr) -> bool {
 
 /// Name-erased structural content key for the source-name hint map.
 ///
-/// Mirrors the equivalence of the Lean pipeline's `Ix.Tc.KExpr` content
+/// Mirrors the equivalence of the Lean pipeline's `Ix.Kernel.KExpr` content
 /// addresses (`toKexprStatic ... |>.addr` in `Ix/AuxGen/Kernel.lean`) and
 /// of the kernel's `ExprKey`/`structural_eq`: display names, binder
 /// names, binder infos, and mdata are excluded; `Const`/`Prj` contribute
diff --git a/crates/ffi/src/kernel.rs b/crates/ffi/src/kernel.rs
index 02525767a..b9bb7cb3d 100644
--- a/crates/ffi/src/kernel.rs
+++ b/crates/ffi/src/kernel.rs
@@ -969,7 +969,7 @@ unsafe extern "C" {
   fn lean_internal_set_thread_stack_size(size: usize);
 }
 
-/// `Ix.Tc.setLeanThreadStackSize : USize → BaseIO Unit`
+/// `Ix.Kernel.setLeanThreadStackSize : USize → BaseIO Unit`
 ///
 /// ABI adapter: the runtime setter is a bare `void(size_t)`, so Lean can't
 /// `@[extern]` it directly. The pure-Lean parallel checker calls this before
diff --git a/crates/ffi/src/lean_build.rs b/crates/ffi/src/lean_build.rs
index 94971078f..445a11ba7 100644
--- a/crates/ffi/src/lean_build.rs
+++ b/crates/ffi/src/lean_build.rs
@@ -25,7 +25,7 @@
 //!
 //! Expression encoding is iterative (explicit frame stack): Init-scale
 //! terms overflow default runtime stacks (same reason
-//! `Ix/Tc/EgressLean.lean` uses a stack machine).
+//! `Ix/Kernel/EgressLean.lean` uses a stack machine).
 //!
 //! Known hole, deliberate: `DataValue::OfInt` inside mdata is rejected
 //! with an error. Lean's runtime `Int` is scalar-or-mpz (no exported
diff --git a/crates/ixon/src/canon_univ.rs b/crates/ixon/src/canon_univ.rs
index 66d347bb5..6bddd28af 100644
--- a/crates/ixon/src/canon_univ.rs
+++ b/crates/ixon/src/canon_univ.rs
@@ -6,7 +6,7 @@
 //! compilers, the Tc egress, and probes can all use it (the three kernel
 //! `NormLevel` implementations stay untouched and serve as the P4
 //! oracle). Mirrors `Ix/IxonUniv.lean`; the Géran machinery is the
-//! transliteration of `Ix/Tc/Level.lean:227-472` /
+//! transliteration of `Ix/Kernel/Level.lean:227-472` /
 //! `crates/kernel/src/level.rs` onto `ixon::univ::Univ`.
 //!
 //! The frozen kernel `mk*` rule set (M1–M8 / I1–I6, from Lean's
@@ -79,7 +79,7 @@ fn peel_offset(u: &Arc<Univ>) -> (Arc<Univ>, u64) {
   }
 }
 
-/// `mkMax` (Lean `kernel/level.cpp:81-103`; `Ix/Tc/Level.lean` `mkMax`;
+/// `mkMax` (Lean `kernel/level.cpp:81-103`; `Ix/Kernel/Level.lean` `mkMax`;
 /// `crates/kernel/src/level.rs` `KUniv::max`) transliterated to `Univ`.
 /// First applicable rule wins: M1 numerals → the larger (ties → `a`);
 /// M2 `max a a = a`; M3/M4 zero sides; M5/M6 absorption; M7 same-base
@@ -143,7 +143,7 @@ pub fn n_imax(a: Arc<Univ>, b: Arc<Univ>) -> Arc<Univ> {
 
 /// The kernel-rebuild closure on stored trees: bottom-up rebuild through
 /// the simplifying constructors — exactly what anon/meta ingress does.
-/// Mirrors `Ix.Tc.reduceIxonUniv`. A non-fixpoint entry reaches the
+/// Mirrors `Ix.Kernel.reduceIxonUniv`. A non-fixpoint entry reaches the
 /// kernel changed (the stage-1 decoration-presence test), and P6 pins
 /// that this rebuild refines into the Géran classes.
 pub fn reduce_univ(u: &Arc<Univ>) -> Arc<Univ> {
@@ -159,7 +159,7 @@ pub fn reduce_univ(u: &Arc<Univ>) -> Arc<Univ> {
 }
 
 // ============================================================================
-// Géran canonical form (Ix/Tc/Level.lean:231-431 on Univ)
+// Géran canonical form (Ix/Kernel/Level.lean:231-431 on Univ)
 // ============================================================================
 
 /// An imax-conditioning chain: sorted param indices.
@@ -185,7 +185,7 @@ pub type NormLevel = BTreeMap<Path, Node>;
 
 /// Insert `(idx, k)` into the sorted var list, max-merging offsets. `k`
 /// must be the current succ-accumulator (the classic port bug is
-/// dropping it — `Ix/Tc/Level.lean:249-252`).
+/// dropping it — `Ix/Kernel/Level.lean:249-252`).
 fn node_add_var(n: &mut Node, idx: u64, k: u64) {
   match n.vars.iter().position(|v| idx <= v.0) {
     Some(p) => {
@@ -309,7 +309,7 @@ fn is_subset(p2: &[u64], p1: &[u64]) -> bool {
 }
 
 /// Keep only the `xs` entries not dominated by a `ys` entry (merge-walk
-/// over sorted var lists). Mirrors `Ix.Tc.Level.subsumeVars`.
+/// over sorted var lists). Mirrors `Ix.Kernel.Level.subsumeVars`.
 fn subsume_vars(xs: &[(u64, u64)], ys: &[(u64, u64)]) -> Vec<(u64, u64)> {
   let mut out = Vec::new();
   let (mut xi, mut yi) = (0, 0);
diff --git a/crates/ixon/src/diff.rs b/crates/ixon/src/diff.rs
index 3e39b4d5e..2dfd9db11 100644
--- a/crates/ixon/src/diff.rs
+++ b/crates/ixon/src/diff.rs
@@ -2630,7 +2630,7 @@ mod tests {
   // ==========================================================================
   //
   // Prototype `canonUniv` = draft linearizer ∘ subsumption ∘ normalizeAux
-  // (the Géran machinery ported from `Ix/Tc/Level.lean:227-472` /
+  // (the Géran machinery ported from `Ix/Kernel/Level.lean:227-472` /
   // `crates/kernel/src/level.rs`) plus the frozen kernel `mk*` reducer,
   // both transliterated onto `ixon::univ::Univ`. Promoted to the real
   // implementation in stage 2 (the linearizer gating construction is the
diff --git a/crates/ixvm-codegen/src/aiur_ix_aggr.rs b/crates/ixvm-codegen/src/aiur_ix_aggr.rs
index b8385f1e4..2408e776c 100644
--- a/crates/ixvm-codegen/src/aiur_ix_aggr.rs
+++ b/crates/ixvm-codegen/src/aiur_ix_aggr.rs
@@ -1108,44 +1108,44 @@ fn aiur_fn_16(
     if !unconstrained { let __vi = __v_3; let __vj = __v_4; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_5; let __vj = __v_6; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_7; let __vj = __v_8; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_9: G = G::from_u64(1020);
-    let __v_10: G = (__v_8 - __v_9);
-    let __v_11: G = (__v_7 + __v_10);
-    let __v_12: G = (__v_6 + __v_11);
-    let __v_13: G = (__v_5 + __v_12);
-    let __v_14: G = G::from_bool((__v_13 == G::ZERO));
-    let __v_15: G = (__v_3 + __v_4);
-    let __v_16: G = (__v_2 + __v_15);
-    let __v_17: G = (__v_1 + __v_16);
-    let __v_18: G = G::from_bool((__v_17 == G::ZERO));
-    let __v_19: G = G::from_u64(256);
-    let __v_20: G = (__v_19 * __v_2);
-    let __v_21: G = G::from_u64(65536);
-    let __v_22: G = (__v_21 * __v_3);
-    let __v_23: G = G::from_u64(16777216);
-    let __v_24: G = (__v_23 * __v_4);
-    let __v_25: G = G::from_u64(4294967296);
-    let __v_26: G = (__v_25 * __v_5);
-    let __v_27: G = G::from_u64(1099511627776);
-    let __v_28: G = (__v_27 * __v_6);
-    let __v_29: G = G::from_u64(281474976710656);
-    let __v_30: G = (__v_29 * __v_7);
-    let __v_31: G = G::from_u64(72057594037927936);
-    let __v_32: G = (__v_31 * __v_8);
-    let __v_33: G = (__v_30 + __v_32);
-    let __v_34: G = (__v_28 + __v_33);
-    let __v_35: G = (__v_26 + __v_34);
-    let __v_36: G = (__v_24 + __v_35);
-    let __v_37: G = (__v_22 + __v_36);
-    let __v_38: G = (__v_20 + __v_37);
-    let __v_39: G = (__v_1 + __v_38);
-    if (__v_39 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
+    let __v_9: G = G::from_u64(256);
+    let __v_10: G = (__v_9 * __v_2);
+    let __v_11: G = G::from_u64(65536);
+    let __v_12: G = (__v_11 * __v_3);
+    let __v_13: G = G::from_u64(16777216);
+    let __v_14: G = (__v_13 * __v_4);
+    let __v_15: G = G::from_u64(4294967296);
+    let __v_16: G = (__v_15 * __v_5);
+    let __v_17: G = G::from_u64(1099511627776);
+    let __v_18: G = (__v_17 * __v_6);
+    let __v_19: G = G::from_u64(281474976710656);
+    let __v_20: G = (__v_19 * __v_7);
+    let __v_21: G = G::from_u64(72057594037927936);
+    let __v_22: G = (__v_21 * __v_8);
+    let __v_23: G = (__v_20 + __v_22);
+    let __v_24: G = (__v_18 + __v_23);
+    let __v_25: G = (__v_16 + __v_24);
+    let __v_26: G = (__v_14 + __v_25);
+    let __v_27: G = (__v_12 + __v_26);
+    let __v_28: G = (__v_10 + __v_27);
+    let __v_29: G = (__v_1 + __v_28);
+    if (__v_29 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_29.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
     }
+    let __v_30: G = G::from_u64(1020);
+    let __v_31: G = (__v_8 - __v_30);
+    let __v_32: G = (__v_7 + __v_31);
+    let __v_33: G = (__v_6 + __v_32);
+    let __v_34: G = (__v_5 + __v_33);
+    let __v_35: G = G::from_bool((__v_34 == G::ZERO));
+    let __v_36: G = (__v_3 + __v_4);
+    let __v_37: G = (__v_2 + __v_36);
+    let __v_38: G = (__v_1 + __v_37);
+    let __v_39: G = G::from_bool((__v_38 == G::ZERO));
     let __v_40: G = G::from_u64(1);
     let __v_41: G = G::from_u64(1);
-    let __v_42: G = (__v_41 - __v_18);
-    let __v_43: G = (__v_14 * __v_42);
+    let __v_42: G = (__v_41 - __v_39);
+    let __v_43: G = (__v_35 * __v_42);
     let __v_44: G = (__v_40 - __v_43);
     let __v_45: G = G::from_u64(1);
     if (__v_44 != __v_45) {
@@ -2067,9 +2067,9 @@ fn aiur_fn_40(
         let __r_arr: [G; OUT_40] = { let __args: [G; IN_40] = [__v_37, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[40].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[40].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[40].bump_multiplicity(__i); } let __ret: [G; OUT_40] = unsafe { *(record.function_queries[40].output_at(__i).as_ptr() as *const [G; OUT_40]) }; __ret }, _ => aiur_fn_40(__args, record, io_buffer, __cu)? } };
         let __v_40: G = __r_arr[0];
         let __v_41: G = __r_arr[1];
-        let __v_42: G = G::from_u64(0);
-        let __v_43: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_44: G = { let __values: [G; 3] = [__v_42, __v_43, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_42: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_43: G = G::from_u64(0);
+        let __v_44: G = { let __values: [G; 3] = [__v_43, __v_42, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_40] = [__v_44, __v_41];
         record.function_queries[40].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -4552,7 +4552,7 @@ fn aiur_fn_70(
       _ => {
         let __v_2: G = G::from_u64(0);
         let __v_3: G = G::from_u64(0);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_5: G = G::from_u64(1);
         let __v_6: G = (__v_1 - __v_5);
         let __r_arr: [G; OUT_70] = { let __args: [G; IN_70] = [__v_4, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[70].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[70].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[70].bump_multiplicity(__i); } let __ret: [G; OUT_70] = unsafe { *(record.function_queries[70].output_at(__i).as_ptr() as *const [G; OUT_70]) }; __ret }, _ => aiur_fn_70(__args, record, io_buffer, __cu)? } };
@@ -4745,41 +4745,41 @@ fn aiur_fn_71(
                                             let __v_144: G = G::from_u64(0);
                                             let __v_145: G = G::from_u64(0);
                                             let __v_146: G = G::from_u64(0);
-                                            let __v_147: G = G::from_u64(0);
-                                            let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_147, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_140, __v_141, __v_142, __v_18, __v_143, __v_144, __v_145, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-                                            let __v_148: G = __r_arr[0];
-                                            let __v_149: G = __r_arr[1];
-                                            let __v_150: G = __r_arr[2];
-                                            let __v_151: G = __r_arr[3];
-                                            let __v_152: G = __r_arr[4];
-                                            let __v_153: G = __r_arr[5];
-                                            let __v_154: G = __r_arr[6];
-                                            let __v_155: G = __r_arr[7];
-                                            let __v_156: G = __r_arr[8];
-                                            let __v_157: G = __r_arr[9];
-                                            let __v_158: G = __r_arr[10];
-                                            let __v_159: G = __r_arr[11];
-                                            let __v_160: G = __r_arr[12];
-                                            let __v_161: G = __r_arr[13];
-                                            let __v_162: G = __r_arr[14];
-                                            let __v_163: G = __r_arr[15];
-                                            let __v_164: G = __r_arr[16];
-                                            let __v_165: G = __r_arr[17];
-                                            let __v_166: G = __r_arr[18];
-                                            let __v_167: G = __r_arr[19];
-                                            let __v_168: G = __r_arr[20];
-                                            let __v_169: G = __r_arr[21];
-                                            let __v_170: G = __r_arr[22];
-                                            let __v_171: G = __r_arr[23];
-                                            let __v_172: G = __r_arr[24];
-                                            let __v_173: G = __r_arr[25];
-                                            let __v_174: G = __r_arr[26];
-                                            let __v_175: G = __r_arr[27];
-                                            let __v_176: G = __r_arr[28];
-                                            let __v_177: G = __r_arr[29];
-                                            let __v_178: G = __r_arr[30];
-                                            let __v_179: G = __r_arr[31];
-                                            let __v_180: G = { let __values: [G; 34] = [__v_146, __v_5, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_146, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_140, __v_141, __v_142, __v_18, __v_143, __v_144, __v_145, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+                                            let __v_147: G = __r_arr[0];
+                                            let __v_148: G = __r_arr[1];
+                                            let __v_149: G = __r_arr[2];
+                                            let __v_150: G = __r_arr[3];
+                                            let __v_151: G = __r_arr[4];
+                                            let __v_152: G = __r_arr[5];
+                                            let __v_153: G = __r_arr[6];
+                                            let __v_154: G = __r_arr[7];
+                                            let __v_155: G = __r_arr[8];
+                                            let __v_156: G = __r_arr[9];
+                                            let __v_157: G = __r_arr[10];
+                                            let __v_158: G = __r_arr[11];
+                                            let __v_159: G = __r_arr[12];
+                                            let __v_160: G = __r_arr[13];
+                                            let __v_161: G = __r_arr[14];
+                                            let __v_162: G = __r_arr[15];
+                                            let __v_163: G = __r_arr[16];
+                                            let __v_164: G = __r_arr[17];
+                                            let __v_165: G = __r_arr[18];
+                                            let __v_166: G = __r_arr[19];
+                                            let __v_167: G = __r_arr[20];
+                                            let __v_168: G = __r_arr[21];
+                                            let __v_169: G = __r_arr[22];
+                                            let __v_170: G = __r_arr[23];
+                                            let __v_171: G = __r_arr[24];
+                                            let __v_172: G = __r_arr[25];
+                                            let __v_173: G = __r_arr[26];
+                                            let __v_174: G = __r_arr[27];
+                                            let __v_175: G = __r_arr[28];
+                                            let __v_176: G = __r_arr[29];
+                                            let __v_177: G = __r_arr[30];
+                                            let __v_178: G = __r_arr[31];
+                                            let __v_179: G = G::from_u64(0);
+                                            let __v_180: G = { let __values: [G; 34] = [__v_179, __v_5, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                             let __ret: [G; OUT_71] = [__v_180];
                                             record.function_queries[71].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
@@ -4841,41 +4841,41 @@ fn aiur_fn_71(
             }
           },
           _ => {
-            let __v_9: G = G::from_u64(0);
             let __loaded: [G; 32] = { let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; let __ptr_u64 = __v_4.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 32 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 32] = __args[..32].try_into().unwrap(); __arr };
-            let __v_10: G = __loaded[0];
-            let __v_11: G = __loaded[1];
-            let __v_12: G = __loaded[2];
-            let __v_13: G = __loaded[3];
-            let __v_14: G = __loaded[4];
-            let __v_15: G = __loaded[5];
-            let __v_16: G = __loaded[6];
-            let __v_17: G = __loaded[7];
-            let __v_18: G = __loaded[8];
-            let __v_19: G = __loaded[9];
-            let __v_20: G = __loaded[10];
-            let __v_21: G = __loaded[11];
-            let __v_22: G = __loaded[12];
-            let __v_23: G = __loaded[13];
-            let __v_24: G = __loaded[14];
-            let __v_25: G = __loaded[15];
-            let __v_26: G = __loaded[16];
-            let __v_27: G = __loaded[17];
-            let __v_28: G = __loaded[18];
-            let __v_29: G = __loaded[19];
-            let __v_30: G = __loaded[20];
-            let __v_31: G = __loaded[21];
-            let __v_32: G = __loaded[22];
-            let __v_33: G = __loaded[23];
-            let __v_34: G = __loaded[24];
-            let __v_35: G = __loaded[25];
-            let __v_36: G = __loaded[26];
-            let __v_37: G = __loaded[27];
-            let __v_38: G = __loaded[28];
-            let __v_39: G = __loaded[29];
-            let __v_40: G = __loaded[30];
-            let __v_41: G = __loaded[31];
-            let __v_42: G = { let __values: [G; 34] = [__v_9, __v_5, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = __loaded[0];
+            let __v_10: G = __loaded[1];
+            let __v_11: G = __loaded[2];
+            let __v_12: G = __loaded[3];
+            let __v_13: G = __loaded[4];
+            let __v_14: G = __loaded[5];
+            let __v_15: G = __loaded[6];
+            let __v_16: G = __loaded[7];
+            let __v_17: G = __loaded[8];
+            let __v_18: G = __loaded[9];
+            let __v_19: G = __loaded[10];
+            let __v_20: G = __loaded[11];
+            let __v_21: G = __loaded[12];
+            let __v_22: G = __loaded[13];
+            let __v_23: G = __loaded[14];
+            let __v_24: G = __loaded[15];
+            let __v_25: G = __loaded[16];
+            let __v_26: G = __loaded[17];
+            let __v_27: G = __loaded[18];
+            let __v_28: G = __loaded[19];
+            let __v_29: G = __loaded[20];
+            let __v_30: G = __loaded[21];
+            let __v_31: G = __loaded[22];
+            let __v_32: G = __loaded[23];
+            let __v_33: G = __loaded[24];
+            let __v_34: G = __loaded[25];
+            let __v_35: G = __loaded[26];
+            let __v_36: G = __loaded[27];
+            let __v_37: G = __loaded[28];
+            let __v_38: G = __loaded[29];
+            let __v_39: G = __loaded[30];
+            let __v_40: G = __loaded[31];
+            let __v_41: G = G::from_u64(0);
+            let __v_42: G = { let __values: [G; 34] = [__v_41, __v_5, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_71] = [__v_42];
             record.function_queries[71].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -5034,41 +5034,41 @@ fn aiur_fn_71(
         let __v_151: G = G::from_u64(0);
         let __v_152: G = G::from_u64(0);
         let __v_153: G = G::from_u64(0);
-        let __v_154: G = G::from_u64(0);
-        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_154, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_1, __v_147, __v_148, __v_149, __v_23, __v_150, __v_151, __v_152, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-        let __v_155: G = __r_arr[0];
-        let __v_156: G = __r_arr[1];
-        let __v_157: G = __r_arr[2];
-        let __v_158: G = __r_arr[3];
-        let __v_159: G = __r_arr[4];
-        let __v_160: G = __r_arr[5];
-        let __v_161: G = __r_arr[6];
-        let __v_162: G = __r_arr[7];
-        let __v_163: G = __r_arr[8];
-        let __v_164: G = __r_arr[9];
-        let __v_165: G = __r_arr[10];
-        let __v_166: G = __r_arr[11];
-        let __v_167: G = __r_arr[12];
-        let __v_168: G = __r_arr[13];
-        let __v_169: G = __r_arr[14];
-        let __v_170: G = __r_arr[15];
-        let __v_171: G = __r_arr[16];
-        let __v_172: G = __r_arr[17];
-        let __v_173: G = __r_arr[18];
-        let __v_174: G = __r_arr[19];
-        let __v_175: G = __r_arr[20];
-        let __v_176: G = __r_arr[21];
-        let __v_177: G = __r_arr[22];
-        let __v_178: G = __r_arr[23];
-        let __v_179: G = __r_arr[24];
-        let __v_180: G = __r_arr[25];
-        let __v_181: G = __r_arr[26];
-        let __v_182: G = __r_arr[27];
-        let __v_183: G = __r_arr[28];
-        let __v_184: G = __r_arr[29];
-        let __v_185: G = __r_arr[30];
-        let __v_186: G = __r_arr[31];
-        let __v_187: G = { let __values: [G; 34] = [__v_153, __v_5, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_153, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_1, __v_147, __v_148, __v_149, __v_23, __v_150, __v_151, __v_152, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+        let __v_154: G = __r_arr[0];
+        let __v_155: G = __r_arr[1];
+        let __v_156: G = __r_arr[2];
+        let __v_157: G = __r_arr[3];
+        let __v_158: G = __r_arr[4];
+        let __v_159: G = __r_arr[5];
+        let __v_160: G = __r_arr[6];
+        let __v_161: G = __r_arr[7];
+        let __v_162: G = __r_arr[8];
+        let __v_163: G = __r_arr[9];
+        let __v_164: G = __r_arr[10];
+        let __v_165: G = __r_arr[11];
+        let __v_166: G = __r_arr[12];
+        let __v_167: G = __r_arr[13];
+        let __v_168: G = __r_arr[14];
+        let __v_169: G = __r_arr[15];
+        let __v_170: G = __r_arr[16];
+        let __v_171: G = __r_arr[17];
+        let __v_172: G = __r_arr[18];
+        let __v_173: G = __r_arr[19];
+        let __v_174: G = __r_arr[20];
+        let __v_175: G = __r_arr[21];
+        let __v_176: G = __r_arr[22];
+        let __v_177: G = __r_arr[23];
+        let __v_178: G = __r_arr[24];
+        let __v_179: G = __r_arr[25];
+        let __v_180: G = __r_arr[26];
+        let __v_181: G = __r_arr[27];
+        let __v_182: G = __r_arr[28];
+        let __v_183: G = __r_arr[29];
+        let __v_184: G = __r_arr[30];
+        let __v_185: G = __r_arr[31];
+        let __v_186: G = G::from_u64(0);
+        let __v_187: G = { let __values: [G; 34] = [__v_186, __v_5, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_71] = [__v_187];
         record.function_queries[71].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -5277,41 +5277,41 @@ fn aiur_fn_72(
         let __v_179: G = G::from_u64(0);
         let __v_180: G = G::from_u64(0);
         let __v_181: G = G::from_u64(0);
-        let __v_182: G = G::from_u64(0);
-        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_182, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_175, __v_176, __v_177, __v_85, __v_178, __v_179, __v_180, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-        let __v_183: G = __r_arr[0];
-        let __v_184: G = __r_arr[1];
-        let __v_185: G = __r_arr[2];
-        let __v_186: G = __r_arr[3];
-        let __v_187: G = __r_arr[4];
-        let __v_188: G = __r_arr[5];
-        let __v_189: G = __r_arr[6];
-        let __v_190: G = __r_arr[7];
-        let __v_191: G = __r_arr[8];
-        let __v_192: G = __r_arr[9];
-        let __v_193: G = __r_arr[10];
-        let __v_194: G = __r_arr[11];
-        let __v_195: G = __r_arr[12];
-        let __v_196: G = __r_arr[13];
-        let __v_197: G = __r_arr[14];
-        let __v_198: G = __r_arr[15];
-        let __v_199: G = __r_arr[16];
-        let __v_200: G = __r_arr[17];
-        let __v_201: G = __r_arr[18];
-        let __v_202: G = __r_arr[19];
-        let __v_203: G = __r_arr[20];
-        let __v_204: G = __r_arr[21];
-        let __v_205: G = __r_arr[22];
-        let __v_206: G = __r_arr[23];
-        let __v_207: G = __r_arr[24];
-        let __v_208: G = __r_arr[25];
-        let __v_209: G = __r_arr[26];
-        let __v_210: G = __r_arr[27];
-        let __v_211: G = __r_arr[28];
-        let __v_212: G = __r_arr[29];
-        let __v_213: G = __r_arr[30];
-        let __v_214: G = __r_arr[31];
-        let __v_215: G = { let __values: [G; 34] = [__v_181, __v_5, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_181, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_175, __v_176, __v_177, __v_85, __v_178, __v_179, __v_180, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+        let __v_182: G = __r_arr[0];
+        let __v_183: G = __r_arr[1];
+        let __v_184: G = __r_arr[2];
+        let __v_185: G = __r_arr[3];
+        let __v_186: G = __r_arr[4];
+        let __v_187: G = __r_arr[5];
+        let __v_188: G = __r_arr[6];
+        let __v_189: G = __r_arr[7];
+        let __v_190: G = __r_arr[8];
+        let __v_191: G = __r_arr[9];
+        let __v_192: G = __r_arr[10];
+        let __v_193: G = __r_arr[11];
+        let __v_194: G = __r_arr[12];
+        let __v_195: G = __r_arr[13];
+        let __v_196: G = __r_arr[14];
+        let __v_197: G = __r_arr[15];
+        let __v_198: G = __r_arr[16];
+        let __v_199: G = __r_arr[17];
+        let __v_200: G = __r_arr[18];
+        let __v_201: G = __r_arr[19];
+        let __v_202: G = __r_arr[20];
+        let __v_203: G = __r_arr[21];
+        let __v_204: G = __r_arr[22];
+        let __v_205: G = __r_arr[23];
+        let __v_206: G = __r_arr[24];
+        let __v_207: G = __r_arr[25];
+        let __v_208: G = __r_arr[26];
+        let __v_209: G = __r_arr[27];
+        let __v_210: G = __r_arr[28];
+        let __v_211: G = __r_arr[29];
+        let __v_212: G = __r_arr[30];
+        let __v_213: G = __r_arr[31];
+        let __v_214: G = G::from_u64(0);
+        let __v_215: G = { let __values: [G; 34] = [__v_214, __v_5, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_216: G = G::from_u64(1);
         let __v_217: G = G::from_u64(1);
         let __v_218: G = { let __values: [G; 3] = [__v_216, __v_217, __v_217]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -8196,9 +8196,9 @@ fn aiur_fn_85(
         let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_37, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
         let __v_40: G = __r_arr[0];
         let __v_41: G = __r_arr[1];
-        let __v_42: G = G::from_u64(0);
-        let __v_43: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_44: G = { let __values: [G; 3] = [__v_42, __v_43, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_42: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_43: G = G::from_u64(0);
+        let __v_44: G = { let __values: [G; 3] = [__v_43, __v_42, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_85] = [__v_44, __v_41];
         record.function_queries[85].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8245,7 +8245,7 @@ fn aiur_fn_86(
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8262,7 +8262,7 @@ fn aiur_fn_86(
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8276,10 +8276,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(2);
+            let __v_10: G = G::from_u64(2);
+            let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8290,10 +8290,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_3, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_6: G = __r_arr[0];
             let __v_7: G = __r_arr[1];
-            let __v_8: G = G::from_u64(0);
+            let __v_8: G = G::from_u64(3);
             let __v_9: G = G::from_u64(3);
-            let __v_10: G = G::from_u64(3);
-            let __v_11: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_10, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(0);
+            let __v_11: G = { let __values: [G; 6] = [__v_10, __v_8, __v_9, __v_9, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_11, __v_7];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8304,10 +8304,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_3, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_6: G = __r_arr[0];
             let __v_7: G = __r_arr[1];
-            let __v_8: G = G::from_u64(0);
+            let __v_8: G = G::from_u64(4);
             let __v_9: G = G::from_u64(4);
-            let __v_10: G = G::from_u64(4);
-            let __v_11: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_10, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(0);
+            let __v_11: G = { let __values: [G; 6] = [__v_10, __v_8, __v_9, __v_9, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_11, __v_7];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8318,10 +8318,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_3, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_6: G = __r_arr[0];
             let __v_7: G = __r_arr[1];
-            let __v_8: G = G::from_u64(0);
+            let __v_8: G = G::from_u64(5);
             let __v_9: G = G::from_u64(5);
-            let __v_10: G = G::from_u64(5);
-            let __v_11: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_10, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(0);
+            let __v_11: G = { let __values: [G; 6] = [__v_10, __v_8, __v_9, __v_9, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_11, __v_7];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8338,10 +8338,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
             let __v_11: G = __r_arr[1];
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(6);
+            let __v_12: G = G::from_u64(6);
+            let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 6] = [__v_12, __v_13, __v_4, __v_6, __v_14, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_14, __v_12, __v_4, __v_6, __v_13, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_15, __v_11];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8358,10 +8358,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
             let __v_11: G = __r_arr[1];
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(7);
+            let __v_12: G = G::from_u64(7);
+            let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 6] = [__v_12, __v_13, __v_4, __v_6, __v_14, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_14, __v_12, __v_4, __v_6, __v_13, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_15, __v_11];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8378,10 +8378,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
             let __v_11: G = __r_arr[1];
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(8);
+            let __v_12: G = G::from_u64(8);
+            let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 6] = [__v_12, __v_13, __v_4, __v_6, __v_14, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_14, __v_12, __v_4, __v_6, __v_13, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_15, __v_11];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8395,10 +8395,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(9);
+            let __v_10: G = G::from_u64(9);
+            let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8413,10 +8413,10 @@ fn aiur_fn_86(
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(0);
+            let __v_11: G = G::from_u64(0);
+            let __v_12: G = G::from_u64(1);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8432,9 +8432,9 @@ fn aiur_fn_86(
             let __v_9: G = __r_arr[1];
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = G::from_u64(1);
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8448,11 +8448,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
+            let __v_10: G = G::from_u64(1);
+            let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(1);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8466,11 +8466,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
+            let __v_10: G = G::from_u64(1);
             let __v_11: G = G::from_u64(1);
             let __v_12: G = G::from_u64(1);
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8484,11 +8484,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(2);
+            let __v_10: G = G::from_u64(2);
+            let __v_11: G = G::from_u64(0);
+            let __v_12: G = G::from_u64(1);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8502,11 +8502,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
+            let __v_10: G = G::from_u64(2);
             let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(2);
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = G::from_u64(1);
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8777,44 +8777,44 @@ fn aiur_fn_91(
     if !unconstrained { let __vi = __v_63; let __vj = __v_64; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_65; let __vj = __v_66; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_67; let __vj = __v_68; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_69: G = G::from_u64(1020);
-    let __v_70: G = (__v_68 - __v_69);
-    let __v_71: G = (__v_67 + __v_70);
-    let __v_72: G = (__v_66 + __v_71);
-    let __v_73: G = (__v_65 + __v_72);
-    let __v_74: G = G::from_bool((__v_73 == G::ZERO));
-    let __v_75: G = (__v_63 + __v_64);
-    let __v_76: G = (__v_62 + __v_75);
-    let __v_77: G = (__v_61 + __v_76);
-    let __v_78: G = G::from_bool((__v_77 == G::ZERO));
-    let __v_79: G = G::from_u64(256);
-    let __v_80: G = (__v_79 * __v_62);
-    let __v_81: G = G::from_u64(65536);
-    let __v_82: G = (__v_81 * __v_63);
-    let __v_83: G = G::from_u64(16777216);
-    let __v_84: G = (__v_83 * __v_64);
-    let __v_85: G = G::from_u64(4294967296);
-    let __v_86: G = (__v_85 * __v_65);
-    let __v_87: G = G::from_u64(1099511627776);
-    let __v_88: G = (__v_87 * __v_66);
-    let __v_89: G = G::from_u64(281474976710656);
-    let __v_90: G = (__v_89 * __v_67);
-    let __v_91: G = G::from_u64(72057594037927936);
-    let __v_92: G = (__v_91 * __v_68);
-    let __v_93: G = (__v_90 + __v_92);
-    let __v_94: G = (__v_88 + __v_93);
-    let __v_95: G = (__v_86 + __v_94);
-    let __v_96: G = (__v_84 + __v_95);
-    let __v_97: G = (__v_82 + __v_96);
-    let __v_98: G = (__v_80 + __v_97);
-    let __v_99: G = (__v_61 + __v_98);
-    if (__v_99 != __v_60) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_99.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
-    }
+    let __v_69: G = G::from_u64(256);
+    let __v_70: G = (__v_69 * __v_62);
+    let __v_71: G = G::from_u64(65536);
+    let __v_72: G = (__v_71 * __v_63);
+    let __v_73: G = G::from_u64(16777216);
+    let __v_74: G = (__v_73 * __v_64);
+    let __v_75: G = G::from_u64(4294967296);
+    let __v_76: G = (__v_75 * __v_65);
+    let __v_77: G = G::from_u64(1099511627776);
+    let __v_78: G = (__v_77 * __v_66);
+    let __v_79: G = G::from_u64(281474976710656);
+    let __v_80: G = (__v_79 * __v_67);
+    let __v_81: G = G::from_u64(72057594037927936);
+    let __v_82: G = (__v_81 * __v_68);
+    let __v_83: G = (__v_80 + __v_82);
+    let __v_84: G = (__v_78 + __v_83);
+    let __v_85: G = (__v_76 + __v_84);
+    let __v_86: G = (__v_74 + __v_85);
+    let __v_87: G = (__v_72 + __v_86);
+    let __v_88: G = (__v_70 + __v_87);
+    let __v_89: G = (__v_61 + __v_88);
+    if (__v_89 != __v_60) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
+    }
+    let __v_90: G = G::from_u64(1020);
+    let __v_91: G = (__v_68 - __v_90);
+    let __v_92: G = (__v_67 + __v_91);
+    let __v_93: G = (__v_66 + __v_92);
+    let __v_94: G = (__v_65 + __v_93);
+    let __v_95: G = G::from_bool((__v_94 == G::ZERO));
+    let __v_96: G = (__v_63 + __v_64);
+    let __v_97: G = (__v_62 + __v_96);
+    let __v_98: G = (__v_61 + __v_97);
+    let __v_99: G = G::from_bool((__v_98 == G::ZERO));
     let __v_100: G = G::from_u64(1);
     let __v_101: G = G::from_u64(1);
-    let __v_102: G = (__v_101 - __v_78);
-    let __v_103: G = (__v_74 * __v_102);
+    let __v_102: G = (__v_101 - __v_99);
+    let __v_103: G = (__v_95 * __v_102);
     let __v_104: G = (__v_100 - __v_103);
     let __v_105: G = G::from_u64(1);
     if (__v_104 != __v_105) {
@@ -8834,44 +8834,44 @@ fn aiur_fn_91(
     if !unconstrained { let __vi = __v_109; let __vj = __v_110; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_111; let __vj = __v_112; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_113; let __vj = __v_114; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_115: G = G::from_u64(1020);
-    let __v_116: G = (__v_114 - __v_115);
-    let __v_117: G = (__v_113 + __v_116);
-    let __v_118: G = (__v_112 + __v_117);
-    let __v_119: G = (__v_111 + __v_118);
-    let __v_120: G = G::from_bool((__v_119 == G::ZERO));
-    let __v_121: G = (__v_109 + __v_110);
-    let __v_122: G = (__v_108 + __v_121);
-    let __v_123: G = (__v_107 + __v_122);
-    let __v_124: G = G::from_bool((__v_123 == G::ZERO));
-    let __v_125: G = G::from_u64(256);
-    let __v_126: G = (__v_125 * __v_108);
-    let __v_127: G = G::from_u64(65536);
-    let __v_128: G = (__v_127 * __v_109);
-    let __v_129: G = G::from_u64(16777216);
-    let __v_130: G = (__v_129 * __v_110);
-    let __v_131: G = G::from_u64(4294967296);
-    let __v_132: G = (__v_131 * __v_111);
-    let __v_133: G = G::from_u64(1099511627776);
-    let __v_134: G = (__v_133 * __v_112);
-    let __v_135: G = G::from_u64(281474976710656);
-    let __v_136: G = (__v_135 * __v_113);
-    let __v_137: G = G::from_u64(72057594037927936);
-    let __v_138: G = (__v_137 * __v_114);
-    let __v_139: G = (__v_136 + __v_138);
-    let __v_140: G = (__v_134 + __v_139);
-    let __v_141: G = (__v_132 + __v_140);
-    let __v_142: G = (__v_130 + __v_141);
-    let __v_143: G = (__v_128 + __v_142);
-    let __v_144: G = (__v_126 + __v_143);
-    let __v_145: G = (__v_107 + __v_144);
-    if (__v_145 != __v_106) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_145.as_canonical_u64(), rhs: __v_106.as_canonical_u64(), msg: None });
-    }
+    let __v_115: G = G::from_u64(256);
+    let __v_116: G = (__v_115 * __v_108);
+    let __v_117: G = G::from_u64(65536);
+    let __v_118: G = (__v_117 * __v_109);
+    let __v_119: G = G::from_u64(16777216);
+    let __v_120: G = (__v_119 * __v_110);
+    let __v_121: G = G::from_u64(4294967296);
+    let __v_122: G = (__v_121 * __v_111);
+    let __v_123: G = G::from_u64(1099511627776);
+    let __v_124: G = (__v_123 * __v_112);
+    let __v_125: G = G::from_u64(281474976710656);
+    let __v_126: G = (__v_125 * __v_113);
+    let __v_127: G = G::from_u64(72057594037927936);
+    let __v_128: G = (__v_127 * __v_114);
+    let __v_129: G = (__v_126 + __v_128);
+    let __v_130: G = (__v_124 + __v_129);
+    let __v_131: G = (__v_122 + __v_130);
+    let __v_132: G = (__v_120 + __v_131);
+    let __v_133: G = (__v_118 + __v_132);
+    let __v_134: G = (__v_116 + __v_133);
+    let __v_135: G = (__v_107 + __v_134);
+    if (__v_135 != __v_106) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_135.as_canonical_u64(), rhs: __v_106.as_canonical_u64(), msg: None });
+    }
+    let __v_136: G = G::from_u64(1020);
+    let __v_137: G = (__v_114 - __v_136);
+    let __v_138: G = (__v_113 + __v_137);
+    let __v_139: G = (__v_112 + __v_138);
+    let __v_140: G = (__v_111 + __v_139);
+    let __v_141: G = G::from_bool((__v_140 == G::ZERO));
+    let __v_142: G = (__v_109 + __v_110);
+    let __v_143: G = (__v_108 + __v_142);
+    let __v_144: G = (__v_107 + __v_143);
+    let __v_145: G = G::from_bool((__v_144 == G::ZERO));
     let __v_146: G = G::from_u64(1);
     let __v_147: G = G::from_u64(1);
-    let __v_148: G = (__v_147 - __v_124);
-    let __v_149: G = (__v_120 * __v_148);
+    let __v_148: G = (__v_147 - __v_145);
+    let __v_149: G = (__v_141 * __v_148);
     let __v_150: G = (__v_146 - __v_149);
     let __v_151: G = G::from_u64(1);
     if (__v_150 != __v_151) {
@@ -8890,44 +8890,44 @@ fn aiur_fn_91(
     if !unconstrained { let __vi = __v_154; let __vj = __v_155; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_156; let __vj = __v_157; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_158; let __vj = __v_159; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_160: G = G::from_u64(1020);
-    let __v_161: G = (__v_159 - __v_160);
-    let __v_162: G = (__v_158 + __v_161);
-    let __v_163: G = (__v_157 + __v_162);
-    let __v_164: G = (__v_156 + __v_163);
-    let __v_165: G = G::from_bool((__v_164 == G::ZERO));
-    let __v_166: G = (__v_154 + __v_155);
-    let __v_167: G = (__v_153 + __v_166);
-    let __v_168: G = (__v_152 + __v_167);
-    let __v_169: G = G::from_bool((__v_168 == G::ZERO));
-    let __v_170: G = G::from_u64(256);
-    let __v_171: G = (__v_170 * __v_153);
-    let __v_172: G = G::from_u64(65536);
-    let __v_173: G = (__v_172 * __v_154);
-    let __v_174: G = G::from_u64(16777216);
-    let __v_175: G = (__v_174 * __v_155);
-    let __v_176: G = G::from_u64(4294967296);
-    let __v_177: G = (__v_176 * __v_156);
-    let __v_178: G = G::from_u64(1099511627776);
-    let __v_179: G = (__v_178 * __v_157);
-    let __v_180: G = G::from_u64(281474976710656);
-    let __v_181: G = (__v_180 * __v_158);
-    let __v_182: G = G::from_u64(72057594037927936);
-    let __v_183: G = (__v_182 * __v_159);
-    let __v_184: G = (__v_181 + __v_183);
-    let __v_185: G = (__v_179 + __v_184);
-    let __v_186: G = (__v_177 + __v_185);
-    let __v_187: G = (__v_175 + __v_186);
-    let __v_188: G = (__v_173 + __v_187);
-    let __v_189: G = (__v_171 + __v_188);
-    let __v_190: G = (__v_152 + __v_189);
-    if (__v_190 != __v_41) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_190.as_canonical_u64(), rhs: __v_41.as_canonical_u64(), msg: None });
-    }
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_153);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_154);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_155);
+    let __v_166: G = G::from_u64(4294967296);
+    let __v_167: G = (__v_166 * __v_156);
+    let __v_168: G = G::from_u64(1099511627776);
+    let __v_169: G = (__v_168 * __v_157);
+    let __v_170: G = G::from_u64(281474976710656);
+    let __v_171: G = (__v_170 * __v_158);
+    let __v_172: G = G::from_u64(72057594037927936);
+    let __v_173: G = (__v_172 * __v_159);
+    let __v_174: G = (__v_171 + __v_173);
+    let __v_175: G = (__v_169 + __v_174);
+    let __v_176: G = (__v_167 + __v_175);
+    let __v_177: G = (__v_165 + __v_176);
+    let __v_178: G = (__v_163 + __v_177);
+    let __v_179: G = (__v_161 + __v_178);
+    let __v_180: G = (__v_152 + __v_179);
+    if (__v_180 != __v_41) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_180.as_canonical_u64(), rhs: __v_41.as_canonical_u64(), msg: None });
+    }
+    let __v_181: G = G::from_u64(1020);
+    let __v_182: G = (__v_159 - __v_181);
+    let __v_183: G = (__v_158 + __v_182);
+    let __v_184: G = (__v_157 + __v_183);
+    let __v_185: G = (__v_156 + __v_184);
+    let __v_186: G = G::from_bool((__v_185 == G::ZERO));
+    let __v_187: G = (__v_154 + __v_155);
+    let __v_188: G = (__v_153 + __v_187);
+    let __v_189: G = (__v_152 + __v_188);
+    let __v_190: G = G::from_bool((__v_189 == G::ZERO));
     let __v_191: G = G::from_u64(1);
     let __v_192: G = G::from_u64(1);
-    let __v_193: G = (__v_192 - __v_169);
-    let __v_194: G = (__v_165 * __v_193);
+    let __v_193: G = (__v_192 - __v_190);
+    let __v_194: G = (__v_186 * __v_193);
     let __v_195: G = (__v_191 - __v_194);
     let __v_196: G = G::from_u64(1);
     if (__v_195 != __v_196) {
@@ -9007,19 +9007,19 @@ fn aiur_fn_92(
     let __v_55: G = inp[55];
     let __v_56: G = inp[56];
     let __v_57: G = G::from_u64(0);
-    let __v_58: G = G::from_u64(0);
+    let __v_58: G = { let __values: [G; 10] = [__v_57, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_59: G = G::from_u64(0);
-    let __v_60: G = G::from_u64(0);
+    let __v_60: G = { let __values: [G; 10] = [__v_59, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_58]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_61: G = G::from_u64(0);
-    let __v_62: G = G::from_u64(0);
+    let __v_62: G = { let __values: [G; 10] = [__v_61, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_60]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_63: G = G::from_u64(0);
-    let __v_64: G = { let __values: [G; 10] = [__v_63, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_65: G = { let __values: [G; 10] = [__v_62, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_64]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_66: G = { let __values: [G; 10] = [__v_61, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_65]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_67: G = { let __values: [G; 10] = [__v_60, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_66]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_68: G = { let __values: [G; 10] = [__v_59, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_67]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_69: G = { let __values: [G; 10] = [__v_58, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_68]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_70: G = { let __values: [G; 10] = [__v_57, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_69]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_64: G = { let __values: [G; 10] = [__v_63, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_62]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_65: G = G::from_u64(0);
+    let __v_66: G = { let __values: [G; 10] = [__v_65, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_64]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_67: G = G::from_u64(0);
+    let __v_68: G = { let __values: [G; 10] = [__v_67, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_66]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_69: G = G::from_u64(0);
+    let __v_70: G = { let __values: [G; 10] = [__v_69, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_68]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_92] = [__v_70];
     record.function_queries[92].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -9136,44 +9136,44 @@ fn aiur_fn_93(
         if !unconstrained { let __vi = __v_64; let __vj = __v_65; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_66; let __vj = __v_67; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_68; let __vj = __v_69; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_70: G = G::from_u64(1020);
-        let __v_71: G = (__v_69 - __v_70);
-        let __v_72: G = (__v_68 + __v_71);
-        let __v_73: G = (__v_67 + __v_72);
-        let __v_74: G = (__v_66 + __v_73);
-        let __v_75: G = G::from_bool((__v_74 == G::ZERO));
-        let __v_76: G = (__v_64 + __v_65);
-        let __v_77: G = (__v_63 + __v_76);
-        let __v_78: G = (__v_62 + __v_77);
-        let __v_79: G = G::from_bool((__v_78 == G::ZERO));
-        let __v_80: G = G::from_u64(256);
-        let __v_81: G = (__v_80 * __v_63);
-        let __v_82: G = G::from_u64(65536);
-        let __v_83: G = (__v_82 * __v_64);
-        let __v_84: G = G::from_u64(16777216);
-        let __v_85: G = (__v_84 * __v_65);
-        let __v_86: G = G::from_u64(4294967296);
-        let __v_87: G = (__v_86 * __v_66);
-        let __v_88: G = G::from_u64(1099511627776);
-        let __v_89: G = (__v_88 * __v_67);
-        let __v_90: G = G::from_u64(281474976710656);
-        let __v_91: G = (__v_90 * __v_68);
-        let __v_92: G = G::from_u64(72057594037927936);
-        let __v_93: G = (__v_92 * __v_69);
-        let __v_94: G = (__v_91 + __v_93);
-        let __v_95: G = (__v_89 + __v_94);
-        let __v_96: G = (__v_87 + __v_95);
-        let __v_97: G = (__v_85 + __v_96);
-        let __v_98: G = (__v_83 + __v_97);
-        let __v_99: G = (__v_81 + __v_98);
-        let __v_100: G = (__v_62 + __v_99);
-        if (__v_100 != __v_61) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_100.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: None });
+        let __v_70: G = G::from_u64(256);
+        let __v_71: G = (__v_70 * __v_63);
+        let __v_72: G = G::from_u64(65536);
+        let __v_73: G = (__v_72 * __v_64);
+        let __v_74: G = G::from_u64(16777216);
+        let __v_75: G = (__v_74 * __v_65);
+        let __v_76: G = G::from_u64(4294967296);
+        let __v_77: G = (__v_76 * __v_66);
+        let __v_78: G = G::from_u64(1099511627776);
+        let __v_79: G = (__v_78 * __v_67);
+        let __v_80: G = G::from_u64(281474976710656);
+        let __v_81: G = (__v_80 * __v_68);
+        let __v_82: G = G::from_u64(72057594037927936);
+        let __v_83: G = (__v_82 * __v_69);
+        let __v_84: G = (__v_81 + __v_83);
+        let __v_85: G = (__v_79 + __v_84);
+        let __v_86: G = (__v_77 + __v_85);
+        let __v_87: G = (__v_75 + __v_86);
+        let __v_88: G = (__v_73 + __v_87);
+        let __v_89: G = (__v_71 + __v_88);
+        let __v_90: G = (__v_62 + __v_89);
+        if (__v_90 != __v_61) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_90.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: None });
         }
+        let __v_91: G = G::from_u64(1020);
+        let __v_92: G = (__v_69 - __v_91);
+        let __v_93: G = (__v_68 + __v_92);
+        let __v_94: G = (__v_67 + __v_93);
+        let __v_95: G = (__v_66 + __v_94);
+        let __v_96: G = G::from_bool((__v_95 == G::ZERO));
+        let __v_97: G = (__v_64 + __v_65);
+        let __v_98: G = (__v_63 + __v_97);
+        let __v_99: G = (__v_62 + __v_98);
+        let __v_100: G = G::from_bool((__v_99 == G::ZERO));
         let __v_101: G = G::from_u64(1);
         let __v_102: G = G::from_u64(1);
-        let __v_103: G = (__v_102 - __v_79);
-        let __v_104: G = (__v_75 * __v_103);
+        let __v_103: G = (__v_102 - __v_100);
+        let __v_104: G = (__v_96 * __v_103);
         let __v_105: G = (__v_101 - __v_104);
         let __v_106: G = G::from_u64(1);
         if (__v_105 != __v_106) {
@@ -9193,44 +9193,44 @@ fn aiur_fn_93(
         if !unconstrained { let __vi = __v_110; let __vj = __v_111; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_112; let __vj = __v_113; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_114; let __vj = __v_115; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_116: G = G::from_u64(1020);
-        let __v_117: G = (__v_115 - __v_116);
-        let __v_118: G = (__v_114 + __v_117);
-        let __v_119: G = (__v_113 + __v_118);
-        let __v_120: G = (__v_112 + __v_119);
-        let __v_121: G = G::from_bool((__v_120 == G::ZERO));
-        let __v_122: G = (__v_110 + __v_111);
-        let __v_123: G = (__v_109 + __v_122);
-        let __v_124: G = (__v_108 + __v_123);
-        let __v_125: G = G::from_bool((__v_124 == G::ZERO));
-        let __v_126: G = G::from_u64(256);
-        let __v_127: G = (__v_126 * __v_109);
-        let __v_128: G = G::from_u64(65536);
-        let __v_129: G = (__v_128 * __v_110);
-        let __v_130: G = G::from_u64(16777216);
-        let __v_131: G = (__v_130 * __v_111);
-        let __v_132: G = G::from_u64(4294967296);
-        let __v_133: G = (__v_132 * __v_112);
-        let __v_134: G = G::from_u64(1099511627776);
-        let __v_135: G = (__v_134 * __v_113);
-        let __v_136: G = G::from_u64(281474976710656);
-        let __v_137: G = (__v_136 * __v_114);
-        let __v_138: G = G::from_u64(72057594037927936);
-        let __v_139: G = (__v_138 * __v_115);
-        let __v_140: G = (__v_137 + __v_139);
-        let __v_141: G = (__v_135 + __v_140);
-        let __v_142: G = (__v_133 + __v_141);
-        let __v_143: G = (__v_131 + __v_142);
-        let __v_144: G = (__v_129 + __v_143);
-        let __v_145: G = (__v_127 + __v_144);
-        let __v_146: G = (__v_108 + __v_145);
-        if (__v_146 != __v_107) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_146.as_canonical_u64(), rhs: __v_107.as_canonical_u64(), msg: None });
+        let __v_116: G = G::from_u64(256);
+        let __v_117: G = (__v_116 * __v_109);
+        let __v_118: G = G::from_u64(65536);
+        let __v_119: G = (__v_118 * __v_110);
+        let __v_120: G = G::from_u64(16777216);
+        let __v_121: G = (__v_120 * __v_111);
+        let __v_122: G = G::from_u64(4294967296);
+        let __v_123: G = (__v_122 * __v_112);
+        let __v_124: G = G::from_u64(1099511627776);
+        let __v_125: G = (__v_124 * __v_113);
+        let __v_126: G = G::from_u64(281474976710656);
+        let __v_127: G = (__v_126 * __v_114);
+        let __v_128: G = G::from_u64(72057594037927936);
+        let __v_129: G = (__v_128 * __v_115);
+        let __v_130: G = (__v_127 + __v_129);
+        let __v_131: G = (__v_125 + __v_130);
+        let __v_132: G = (__v_123 + __v_131);
+        let __v_133: G = (__v_121 + __v_132);
+        let __v_134: G = (__v_119 + __v_133);
+        let __v_135: G = (__v_117 + __v_134);
+        let __v_136: G = (__v_108 + __v_135);
+        if (__v_136 != __v_107) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_136.as_canonical_u64(), rhs: __v_107.as_canonical_u64(), msg: None });
         }
+        let __v_137: G = G::from_u64(1020);
+        let __v_138: G = (__v_115 - __v_137);
+        let __v_139: G = (__v_114 + __v_138);
+        let __v_140: G = (__v_113 + __v_139);
+        let __v_141: G = (__v_112 + __v_140);
+        let __v_142: G = G::from_bool((__v_141 == G::ZERO));
+        let __v_143: G = (__v_110 + __v_111);
+        let __v_144: G = (__v_109 + __v_143);
+        let __v_145: G = (__v_108 + __v_144);
+        let __v_146: G = G::from_bool((__v_145 == G::ZERO));
         let __v_147: G = G::from_u64(1);
         let __v_148: G = G::from_u64(1);
-        let __v_149: G = (__v_148 - __v_125);
-        let __v_150: G = (__v_121 * __v_149);
+        let __v_149: G = (__v_148 - __v_146);
+        let __v_150: G = (__v_142 * __v_149);
         let __v_151: G = (__v_147 - __v_150);
         let __v_152: G = G::from_u64(1);
         if (__v_151 != __v_152) {
@@ -9249,44 +9249,44 @@ fn aiur_fn_93(
         if !unconstrained { let __vi = __v_155; let __vj = __v_156; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_157; let __vj = __v_158; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_159; let __vj = __v_160; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_161: G = G::from_u64(1020);
-        let __v_162: G = (__v_160 - __v_161);
-        let __v_163: G = (__v_159 + __v_162);
-        let __v_164: G = (__v_158 + __v_163);
-        let __v_165: G = (__v_157 + __v_164);
-        let __v_166: G = G::from_bool((__v_165 == G::ZERO));
-        let __v_167: G = (__v_155 + __v_156);
-        let __v_168: G = (__v_154 + __v_167);
-        let __v_169: G = (__v_153 + __v_168);
-        let __v_170: G = G::from_bool((__v_169 == G::ZERO));
-        let __v_171: G = G::from_u64(256);
-        let __v_172: G = (__v_171 * __v_154);
-        let __v_173: G = G::from_u64(65536);
-        let __v_174: G = (__v_173 * __v_155);
-        let __v_175: G = G::from_u64(16777216);
-        let __v_176: G = (__v_175 * __v_156);
-        let __v_177: G = G::from_u64(4294967296);
-        let __v_178: G = (__v_177 * __v_157);
-        let __v_179: G = G::from_u64(1099511627776);
-        let __v_180: G = (__v_179 * __v_158);
-        let __v_181: G = G::from_u64(281474976710656);
-        let __v_182: G = (__v_181 * __v_159);
-        let __v_183: G = G::from_u64(72057594037927936);
-        let __v_184: G = (__v_183 * __v_160);
-        let __v_185: G = (__v_182 + __v_184);
-        let __v_186: G = (__v_180 + __v_185);
-        let __v_187: G = (__v_178 + __v_186);
-        let __v_188: G = (__v_176 + __v_187);
-        let __v_189: G = (__v_174 + __v_188);
-        let __v_190: G = (__v_172 + __v_189);
-        let __v_191: G = (__v_153 + __v_190);
-        if (__v_191 != __v_42) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_191.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: None });
+        let __v_161: G = G::from_u64(256);
+        let __v_162: G = (__v_161 * __v_154);
+        let __v_163: G = G::from_u64(65536);
+        let __v_164: G = (__v_163 * __v_155);
+        let __v_165: G = G::from_u64(16777216);
+        let __v_166: G = (__v_165 * __v_156);
+        let __v_167: G = G::from_u64(4294967296);
+        let __v_168: G = (__v_167 * __v_157);
+        let __v_169: G = G::from_u64(1099511627776);
+        let __v_170: G = (__v_169 * __v_158);
+        let __v_171: G = G::from_u64(281474976710656);
+        let __v_172: G = (__v_171 * __v_159);
+        let __v_173: G = G::from_u64(72057594037927936);
+        let __v_174: G = (__v_173 * __v_160);
+        let __v_175: G = (__v_172 + __v_174);
+        let __v_176: G = (__v_170 + __v_175);
+        let __v_177: G = (__v_168 + __v_176);
+        let __v_178: G = (__v_166 + __v_177);
+        let __v_179: G = (__v_164 + __v_178);
+        let __v_180: G = (__v_162 + __v_179);
+        let __v_181: G = (__v_153 + __v_180);
+        if (__v_181 != __v_42) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_181.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: None });
         }
+        let __v_182: G = G::from_u64(1020);
+        let __v_183: G = (__v_160 - __v_182);
+        let __v_184: G = (__v_159 + __v_183);
+        let __v_185: G = (__v_158 + __v_184);
+        let __v_186: G = (__v_157 + __v_185);
+        let __v_187: G = G::from_bool((__v_186 == G::ZERO));
+        let __v_188: G = (__v_155 + __v_156);
+        let __v_189: G = (__v_154 + __v_188);
+        let __v_190: G = (__v_153 + __v_189);
+        let __v_191: G = G::from_bool((__v_190 == G::ZERO));
         let __v_192: G = G::from_u64(1);
         let __v_193: G = G::from_u64(1);
-        let __v_194: G = (__v_193 - __v_170);
-        let __v_195: G = (__v_166 * __v_194);
+        let __v_194: G = (__v_193 - __v_191);
+        let __v_195: G = (__v_187 * __v_194);
         let __v_196: G = (__v_192 - __v_195);
         let __v_197: G = G::from_u64(1);
         if (__v_196 != __v_197) {
@@ -9301,19 +9301,19 @@ fn aiur_fn_93(
         let __v_203: G = G::from_u64(0);
         let __v_204: G = { let __values: [G; 8] = [__v_203, __v_46, __v_44, __v_50, __v_32, __v_54, __v_42, __v_200]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_205: G = G::from_u64(0);
-        let __v_206: G = G::from_u64(0);
+        let __v_206: G = { let __values: [G; 10] = [__v_205, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_201]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_207: G = G::from_u64(0);
-        let __v_208: G = G::from_u64(0);
+        let __v_208: G = { let __values: [G; 10] = [__v_207, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_206]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_209: G = G::from_u64(0);
-        let __v_210: G = G::from_u64(0);
+        let __v_210: G = { let __values: [G; 10] = [__v_209, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_208]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_211: G = G::from_u64(0);
-        let __v_212: G = { let __values: [G; 10] = [__v_211, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_201]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_213: G = { let __values: [G; 10] = [__v_210, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_212]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_214: G = { let __values: [G; 10] = [__v_209, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_213]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_215: G = { let __values: [G; 10] = [__v_208, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_214]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_216: G = { let __values: [G; 10] = [__v_207, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_215]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_217: G = { let __values: [G; 10] = [__v_206, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_216]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_218: G = { let __values: [G; 10] = [__v_205, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_217]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_212: G = { let __values: [G; 10] = [__v_211, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_210]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_213: G = G::from_u64(0);
+        let __v_214: G = { let __values: [G; 10] = [__v_213, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_212]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_215: G = G::from_u64(0);
+        let __v_216: G = { let __values: [G; 10] = [__v_215, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_214]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_217: G = G::from_u64(0);
+        let __v_218: G = { let __values: [G; 10] = [__v_217, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_216]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_93] = [__v_204, __v_218, __v_202];
         record.function_queries[93].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -9395,15 +9395,15 @@ fn aiur_fn_95(
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 4] = [__v_10, __v_8, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_95] = [__v_11, __v_7];
             record.function_queries[95].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           _ => {
-            let __v_8: G = G::from_u64(0);
-            let __v_9: G = G::from_u64(1);
-            let __v_10: G = { let __values: [G; 4] = [__v_8, __v_9, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_8: G = G::from_u64(1);
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 4] = [__v_9, __v_8, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_95] = [__v_10, __v_7];
             record.function_queries[95].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -9502,23 +9502,23 @@ fn aiur_fn_96(
     let __v_68: G = __r_arr[7];
     let __v_69: G = __r_arr[8];
     let __v_70: G = __r_arr[9];
-    let __v_71: G = G::from_u64(0);
-    let __v_72: G = G::from_u64(0);
-    let __v_73: G = G::from_u64(0);
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = G::from_u64(1);
+    let __v_73: G = { let __values: [G; 10] = [__v_71, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_74: G = G::from_u64(0);
-    let __v_75: G = G::from_u64(0);
+    let __v_75: G = { let __values: [G; 10] = [__v_74, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_73]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_76: G = G::from_u64(0);
-    let __v_77: G = G::from_u64(0);
-    let __v_78: G = G::from_u64(1);
-    let __v_79: G = G::from_u64(1);
-    let __v_80: G = { let __values: [G; 10] = [__v_78, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_81: G = { let __values: [G; 10] = [__v_77, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_80]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_82: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_83: G = { let __values: [G; 10] = [__v_75, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_82]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_84: G = { let __values: [G; 10] = [__v_74, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_85: G = { let __values: [G; 10] = [__v_73, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_84]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_86: G = { let __values: [G; 10] = [__v_72, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_87: G = { let __values: [G; 10] = [__v_71, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_86]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_77: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_75]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_78: G = G::from_u64(0);
+    let __v_79: G = { let __values: [G; 10] = [__v_78, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_77]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_80: G = G::from_u64(0);
+    let __v_81: G = { let __values: [G; 10] = [__v_80, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_82: G = G::from_u64(0);
+    let __v_83: G = { let __values: [G; 10] = [__v_82, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_84: G = G::from_u64(0);
+    let __v_85: G = { let __values: [G; 10] = [__v_84, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_86: G = G::from_u64(0);
+    let __v_87: G = { let __values: [G; 10] = [__v_86, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_96] = [__v_1, __v_11, __v_21, __v_31, __v_41, __v_51, __v_61, __v_87, __v_70];
     record.function_queries[96].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -9613,23 +9613,23 @@ fn aiur_fn_97(
     let __v_68: G = __r_arr[7];
     let __v_69: G = __r_arr[8];
     let __v_70: G = __r_arr[9];
-    let __v_71: G = G::from_u64(0);
-    let __v_72: G = G::from_u64(0);
-    let __v_73: G = G::from_u64(0);
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = G::from_u64(1);
+    let __v_73: G = { let __values: [G; 10] = [__v_71, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_74: G = G::from_u64(0);
-    let __v_75: G = G::from_u64(0);
+    let __v_75: G = { let __values: [G; 10] = [__v_74, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_73]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_76: G = G::from_u64(0);
-    let __v_77: G = G::from_u64(0);
-    let __v_78: G = G::from_u64(1);
-    let __v_79: G = G::from_u64(1);
-    let __v_80: G = { let __values: [G; 10] = [__v_78, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_81: G = { let __values: [G; 10] = [__v_77, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_80]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_82: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_83: G = { let __values: [G; 10] = [__v_75, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_82]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_84: G = { let __values: [G; 10] = [__v_74, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_85: G = { let __values: [G; 10] = [__v_73, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_84]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_86: G = { let __values: [G; 10] = [__v_72, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_87: G = { let __values: [G; 10] = [__v_71, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_86]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_77: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_75]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_78: G = G::from_u64(0);
+    let __v_79: G = { let __values: [G; 10] = [__v_78, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_77]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_80: G = G::from_u64(0);
+    let __v_81: G = { let __values: [G; 10] = [__v_80, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_82: G = G::from_u64(0);
+    let __v_83: G = { let __values: [G; 10] = [__v_82, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_84: G = G::from_u64(0);
+    let __v_85: G = { let __values: [G; 10] = [__v_84, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_86: G = G::from_u64(0);
+    let __v_87: G = { let __values: [G; 10] = [__v_86, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_70]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_88: G = __r_arr[0];
     let __v_89: G = __r_arr[1];
@@ -9678,13 +9678,13 @@ fn aiur_fn_98(
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
     let __v_5: G = G::from_u64(0);
-    let __v_6: G = G::from_u64(0);
+    let __v_6: G = { let __values: [G; 3] = [__v_5, __v_3, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(0);
-    let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_10: G = { let __values: [G; 3] = [__v_7, __v_2, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_11: G = { let __values: [G; 3] = [__v_6, __v_1, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_12: G = { let __values: [G; 3] = [__v_5, __v_0, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_8: G = { let __values: [G; 3] = [__v_7, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = G::from_u64(0);
+    let __v_10: G = { let __values: [G; 3] = [__v_9, __v_1, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 3] = [__v_11, __v_0, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_98] = [__v_12];
     record.function_queries[98].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -10132,10 +10132,10 @@ fn aiur_fn_104(
                     return Ok(__ret);
                   },
                   _ => {
-                    let __v_21: G = G::from_u64(0);
                     let __r_arr: [G; OUT_104] = { let __args: [G; IN_104] = [__v_5, __v_8, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[104].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[104].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[104].bump_multiplicity(__i); } let __ret: [G; OUT_104] = unsafe { *(record.function_queries[104].output_at(__i).as_ptr() as *const [G; OUT_104]) }; __ret }, _ => aiur_fn_104(__args, record, io_buffer, __cu)? } };
-                    let __v_22: G = __r_arr[0];
-                    let __v_23: G = { let __values: [G; 3] = [__v_21, __v_4, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_21: G = __r_arr[0];
+                    let __v_22: G = G::from_u64(0);
+                    let __v_23: G = { let __values: [G; 3] = [__v_22, __v_4, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_104] = [__v_23];
                     record.function_queries[104].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -10219,10 +10219,10 @@ fn aiur_fn_105(
                     return Ok(__ret);
                   },
                   _ => {
-                    let __v_20: G = G::from_u64(0);
                     let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_5, __v_8, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
-                    let __v_21: G = __r_arr[0];
-                    let __v_22: G = { let __values: [G; 3] = [__v_20, __v_4, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_20: G = __r_arr[0];
+                    let __v_21: G = G::from_u64(0);
+                    let __v_22: G = { let __values: [G; 3] = [__v_21, __v_4, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_105] = [__v_22];
                     record.function_queries[105].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -10302,44 +10302,44 @@ fn aiur_fn_106(
         if !unconstrained { let __vi = __v_35; let __vj = __v_36; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_37; let __vj = __v_38; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_39; let __vj = __v_40; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_41: G = G::from_u64(1020);
-        let __v_42: G = (__v_40 - __v_41);
-        let __v_43: G = (__v_39 + __v_42);
-        let __v_44: G = (__v_38 + __v_43);
-        let __v_45: G = (__v_37 + __v_44);
-        let __v_46: G = G::from_bool((__v_45 == G::ZERO));
-        let __v_47: G = (__v_35 + __v_36);
-        let __v_48: G = (__v_34 + __v_47);
-        let __v_49: G = (__v_33 + __v_48);
-        let __v_50: G = G::from_bool((__v_49 == G::ZERO));
-        let __v_51: G = G::from_u64(256);
-        let __v_52: G = (__v_51 * __v_34);
-        let __v_53: G = G::from_u64(65536);
-        let __v_54: G = (__v_53 * __v_35);
-        let __v_55: G = G::from_u64(16777216);
-        let __v_56: G = (__v_55 * __v_36);
-        let __v_57: G = G::from_u64(4294967296);
-        let __v_58: G = (__v_57 * __v_37);
-        let __v_59: G = G::from_u64(1099511627776);
-        let __v_60: G = (__v_59 * __v_38);
-        let __v_61: G = G::from_u64(281474976710656);
-        let __v_62: G = (__v_61 * __v_39);
-        let __v_63: G = G::from_u64(72057594037927936);
-        let __v_64: G = (__v_63 * __v_40);
-        let __v_65: G = (__v_62 + __v_64);
-        let __v_66: G = (__v_60 + __v_65);
-        let __v_67: G = (__v_58 + __v_66);
-        let __v_68: G = (__v_56 + __v_67);
-        let __v_69: G = (__v_54 + __v_68);
-        let __v_70: G = (__v_52 + __v_69);
-        let __v_71: G = (__v_33 + __v_70);
-        if (__v_71 != __v_32) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_71.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: None });
+        let __v_41: G = G::from_u64(256);
+        let __v_42: G = (__v_41 * __v_34);
+        let __v_43: G = G::from_u64(65536);
+        let __v_44: G = (__v_43 * __v_35);
+        let __v_45: G = G::from_u64(16777216);
+        let __v_46: G = (__v_45 * __v_36);
+        let __v_47: G = G::from_u64(4294967296);
+        let __v_48: G = (__v_47 * __v_37);
+        let __v_49: G = G::from_u64(1099511627776);
+        let __v_50: G = (__v_49 * __v_38);
+        let __v_51: G = G::from_u64(281474976710656);
+        let __v_52: G = (__v_51 * __v_39);
+        let __v_53: G = G::from_u64(72057594037927936);
+        let __v_54: G = (__v_53 * __v_40);
+        let __v_55: G = (__v_52 + __v_54);
+        let __v_56: G = (__v_50 + __v_55);
+        let __v_57: G = (__v_48 + __v_56);
+        let __v_58: G = (__v_46 + __v_57);
+        let __v_59: G = (__v_44 + __v_58);
+        let __v_60: G = (__v_42 + __v_59);
+        let __v_61: G = (__v_33 + __v_60);
+        if (__v_61 != __v_32) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_61.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: None });
         }
+        let __v_62: G = G::from_u64(1020);
+        let __v_63: G = (__v_40 - __v_62);
+        let __v_64: G = (__v_39 + __v_63);
+        let __v_65: G = (__v_38 + __v_64);
+        let __v_66: G = (__v_37 + __v_65);
+        let __v_67: G = G::from_bool((__v_66 == G::ZERO));
+        let __v_68: G = (__v_35 + __v_36);
+        let __v_69: G = (__v_34 + __v_68);
+        let __v_70: G = (__v_33 + __v_69);
+        let __v_71: G = G::from_bool((__v_70 == G::ZERO));
         let __v_72: G = G::from_u64(1);
         let __v_73: G = G::from_u64(1);
-        let __v_74: G = (__v_73 - __v_50);
-        let __v_75: G = (__v_46 * __v_74);
+        let __v_74: G = (__v_73 - __v_71);
+        let __v_75: G = (__v_67 * __v_74);
         let __v_76: G = (__v_72 - __v_75);
         let __v_77: G = G::from_u64(1);
         if (__v_76 != __v_77) {
@@ -10585,41 +10585,41 @@ fn aiur_fn_107(
                                         let __v_151: G = G::from_u64(0);
                                         let __v_152: G = G::from_u64(0);
                                         let __v_153: G = G::from_u64(0);
-                                        let __v_154: G = G::from_u64(0);
-                                        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_154, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_147, __v_148, __v_149, __v_130, __v_150, __v_151, __v_152, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-                                        let __v_155: G = __r_arr[0];
-                                        let __v_156: G = __r_arr[1];
-                                        let __v_157: G = __r_arr[2];
-                                        let __v_158: G = __r_arr[3];
-                                        let __v_159: G = __r_arr[4];
-                                        let __v_160: G = __r_arr[5];
-                                        let __v_161: G = __r_arr[6];
-                                        let __v_162: G = __r_arr[7];
-                                        let __v_163: G = __r_arr[8];
-                                        let __v_164: G = __r_arr[9];
-                                        let __v_165: G = __r_arr[10];
-                                        let __v_166: G = __r_arr[11];
-                                        let __v_167: G = __r_arr[12];
-                                        let __v_168: G = __r_arr[13];
-                                        let __v_169: G = __r_arr[14];
-                                        let __v_170: G = __r_arr[15];
-                                        let __v_171: G = __r_arr[16];
-                                        let __v_172: G = __r_arr[17];
-                                        let __v_173: G = __r_arr[18];
-                                        let __v_174: G = __r_arr[19];
-                                        let __v_175: G = __r_arr[20];
-                                        let __v_176: G = __r_arr[21];
-                                        let __v_177: G = __r_arr[22];
-                                        let __v_178: G = __r_arr[23];
-                                        let __v_179: G = __r_arr[24];
-                                        let __v_180: G = __r_arr[25];
-                                        let __v_181: G = __r_arr[26];
-                                        let __v_182: G = __r_arr[27];
-                                        let __v_183: G = __r_arr[28];
-                                        let __v_184: G = __r_arr[29];
-                                        let __v_185: G = __r_arr[30];
-                                        let __v_186: G = __r_arr[31];
-                                        let __v_187: G = { let __values: [G; 34] = [__v_153, __v_5, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_153, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_147, __v_148, __v_149, __v_130, __v_150, __v_151, __v_152, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+                                        let __v_154: G = __r_arr[0];
+                                        let __v_155: G = __r_arr[1];
+                                        let __v_156: G = __r_arr[2];
+                                        let __v_157: G = __r_arr[3];
+                                        let __v_158: G = __r_arr[4];
+                                        let __v_159: G = __r_arr[5];
+                                        let __v_160: G = __r_arr[6];
+                                        let __v_161: G = __r_arr[7];
+                                        let __v_162: G = __r_arr[8];
+                                        let __v_163: G = __r_arr[9];
+                                        let __v_164: G = __r_arr[10];
+                                        let __v_165: G = __r_arr[11];
+                                        let __v_166: G = __r_arr[12];
+                                        let __v_167: G = __r_arr[13];
+                                        let __v_168: G = __r_arr[14];
+                                        let __v_169: G = __r_arr[15];
+                                        let __v_170: G = __r_arr[16];
+                                        let __v_171: G = __r_arr[17];
+                                        let __v_172: G = __r_arr[18];
+                                        let __v_173: G = __r_arr[19];
+                                        let __v_174: G = __r_arr[20];
+                                        let __v_175: G = __r_arr[21];
+                                        let __v_176: G = __r_arr[22];
+                                        let __v_177: G = __r_arr[23];
+                                        let __v_178: G = __r_arr[24];
+                                        let __v_179: G = __r_arr[25];
+                                        let __v_180: G = __r_arr[26];
+                                        let __v_181: G = __r_arr[27];
+                                        let __v_182: G = __r_arr[28];
+                                        let __v_183: G = __r_arr[29];
+                                        let __v_184: G = __r_arr[30];
+                                        let __v_185: G = __r_arr[31];
+                                        let __v_186: G = G::from_u64(0);
+                                        let __v_187: G = { let __values: [G; 34] = [__v_186, __v_5, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                         let __ret: [G; OUT_107] = [__v_187];
                                         record.function_queries[107].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
@@ -11351,10 +11351,10 @@ fn aiur_fn_112(
                     let __v_14: G = __r_arr[0];
                     match __v_14.as_canonical_u64() {
                       1u64 => {
-                        let __v_15: G = G::from_u64(0);
                         let __r_arr: [G; OUT_112] = { let __args: [G; IN_112] = [__v_7, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[112].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[112].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[112].bump_multiplicity(__i); } let __ret: [G; OUT_112] = unsafe { *(record.function_queries[112].output_at(__i).as_ptr() as *const [G; OUT_112]) }; __ret }, _ => aiur_fn_112(__args, record, io_buffer, __cu)? } };
-                        let __v_16: G = __r_arr[0];
-                        let __v_17: G = { let __values: [G; 6] = [__v_15, __v_3, __v_4, __v_5, __v_6, __v_16]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_15: G = __r_arr[0];
+                        let __v_16: G = G::from_u64(0);
+                        let __v_17: G = { let __values: [G; 6] = [__v_16, __v_3, __v_4, __v_5, __v_6, __v_15]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_112] = [__v_17];
                         record.function_queries[112].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -11370,19 +11370,19 @@ fn aiur_fn_112(
                             if (__v_5 != __v_11) {
                               return Err(ExecError::AssertEqMismatch { lhs: __v_5.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: None });
                             }
-                            let __v_17: G = G::from_u64(0);
                             let __r_arr: [G; OUT_112] = { let __args: [G; IN_112] = [__v_7, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[112].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[112].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[112].bump_multiplicity(__i); } let __ret: [G; OUT_112] = unsafe { *(record.function_queries[112].output_at(__i).as_ptr() as *const [G; OUT_112]) }; __ret }, _ => aiur_fn_112(__args, record, io_buffer, __cu)? } };
-                            let __v_18: G = __r_arr[0];
-                            let __v_19: G = { let __values: [G; 6] = [__v_17, __v_3, __v_4, __v_5, __v_6, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_17: G = __r_arr[0];
+                            let __v_18: G = G::from_u64(0);
+                            let __v_19: G = { let __values: [G; 6] = [__v_18, __v_3, __v_4, __v_5, __v_6, __v_17]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_112] = [__v_19];
                             record.function_queries[112].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                           _ => {
-                            let __v_17: G = G::from_u64(0);
                             let __r_arr: [G; OUT_112] = { let __args: [G; IN_112] = [__v_0, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[112].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[112].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[112].bump_multiplicity(__i); } let __ret: [G; OUT_112] = unsafe { *(record.function_queries[112].output_at(__i).as_ptr() as *const [G; OUT_112]) }; __ret }, _ => aiur_fn_112(__args, record, io_buffer, __cu)? } };
-                            let __v_18: G = __r_arr[0];
-                            let __v_19: G = { let __values: [G; 6] = [__v_17, __v_9, __v_10, __v_11, __v_12, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_17: G = __r_arr[0];
+                            let __v_18: G = G::from_u64(0);
+                            let __v_19: G = { let __values: [G; 6] = [__v_18, __v_9, __v_10, __v_11, __v_12, __v_17]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_112] = [__v_19];
                             record.function_queries[112].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
@@ -11447,11 +11447,11 @@ fn aiur_fn_113(
         let __v_12: G = __loaded[5];
         match __v_7.as_canonical_u64() {
           1u64 => {
-            let __v_13: G = G::from_u64(0);
+            let __v_13: G = G::from_u64(1);
             let __v_14: G = G::from_u64(1);
-            let __v_15: G = G::from_u64(1);
-            let __v_16: G = { let __values: [G; 6] = [__v_14, __v_15, __v_15, __v_15, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_17: G = { let __values: [G; 6] = [__v_13, __v_2, __v_3, __v_4, __v_5, __v_16]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_13, __v_14, __v_14, __v_14, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = G::from_u64(0);
+            let __v_17: G = { let __values: [G; 6] = [__v_16, __v_2, __v_3, __v_4, __v_5, __v_15]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_18: G = G::from_u64(1);
             let __v_19: G = G::from_u64(1);
             let __v_20: G = { let __values: [G; 6] = [__v_18, __v_19, __v_19, __v_19, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -11589,12 +11589,12 @@ fn aiur_fn_115(
           0u64 => {
             let __r_arr: [G; OUT_109] = { let __args: [G; IN_109] = [__v_8, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[109].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[109].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[109].bump_multiplicity(__i); } let __ret: [G; OUT_109] = unsafe { *(record.function_queries[109].output_at(__i).as_ptr() as *const [G; OUT_109]) }; __ret }, _ => aiur_fn_109(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
-            let __v_11: G = G::from_u64(0);
             let __r_arr: [G; OUT_111] = { let __args: [G; IN_111] = [__v_5]; let __cu = unconstrained; let __hit = record.function_queries[111].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[111].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[111].bump_multiplicity(__i); } let __ret: [G; OUT_111] = unsafe { *(record.function_queries[111].output_at(__i).as_ptr() as *const [G; OUT_111]) }; __ret }, _ => aiur_fn_111(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
+            let __v_11: G = __r_arr[0];
             let __r_arr: [G; OUT_115] = { let __args: [G; IN_115] = [__v_6, __v_9, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[115].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[115].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[115].bump_multiplicity(__i); } let __ret: [G; OUT_115] = unsafe { *(record.function_queries[115].output_at(__i).as_ptr() as *const [G; OUT_115]) }; __ret }, _ => aiur_fn_115(__args, record, io_buffer, __cu)? } };
-            let __v_13: G = __r_arr[0];
-            let __v_14: G = { let __values: [G; 6] = [__v_11, __v_12, __v_5, __v_8, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = __r_arr[0];
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_11, __v_5, __v_8, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_115] = [__v_14];
             record.function_queries[115].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -11675,23 +11675,23 @@ fn aiur_fn_116(
                             let __v_25: G = G::from_bool((__v_24 == G::ZERO));
                             match __v_25.as_canonical_u64() {
                               1u64 => {
-                                let __r_arr: [G; OUT_101] = { let __args: [G; IN_101] = [__v_8, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[101].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[101].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[101].bump_multiplicity(__i); } let __ret: [G; OUT_101] = unsafe { *(record.function_queries[101].output_at(__i).as_ptr() as *const [G; OUT_101]) }; __ret }, _ => aiur_fn_101(__args, record, io_buffer, __cu)? } };
+                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_7, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
                                 let __v_26: G = __r_arr[0];
-                                let __r_arr: [G; OUT_110] = { let __args: [G; IN_110] = [__v_7, __v_2, __v_3, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[110].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[110].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[110].bump_multiplicity(__i); } let __ret: [G; OUT_110] = unsafe { *(record.function_queries[110].output_at(__i).as_ptr() as *const [G; OUT_110]) }; __ret }, _ => aiur_fn_110(__args, record, io_buffer, __cu)? } };
+                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_17, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
                                 let __v_27: G = __r_arr[0];
-                                let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_19, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
+                                if (__v_26 != __v_27) {
+                                  return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: None });
+                                }
+                                let __r_arr: [G; OUT_101] = { let __args: [G; IN_101] = [__v_8, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[101].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[101].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[101].bump_multiplicity(__i); } let __ret: [G; OUT_101] = unsafe { *(record.function_queries[101].output_at(__i).as_ptr() as *const [G; OUT_101]) }; __ret }, _ => aiur_fn_101(__args, record, io_buffer, __cu)? } };
                                 let __v_28: G = __r_arr[0];
-                                let __v_29: G = __r_arr[1];
-                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_7, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
+                                let __r_arr: [G; OUT_110] = { let __args: [G; IN_110] = [__v_7, __v_2, __v_3, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[110].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[110].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[110].bump_multiplicity(__i); } let __ret: [G; OUT_110] = unsafe { *(record.function_queries[110].output_at(__i).as_ptr() as *const [G; OUT_110]) }; __ret }, _ => aiur_fn_110(__args, record, io_buffer, __cu)? } };
+                                let __v_29: G = __r_arr[0];
+                                let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_19, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
                                 let __v_30: G = __r_arr[0];
-                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_17, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
-                                let __v_31: G = __r_arr[0];
-                                if (__v_30 != __v_31) {
-                                  return Err(ExecError::AssertEqMismatch { lhs: __v_30.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
-                                }
+                                let __v_31: G = __r_arr[1];
                                 let __v_32: G = G::from_u64(0);
-                                let __v_33: G = { let __values: [G; 6] = [__v_32, __v_13, __v_12, __v_7, __v_27, __v_28]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_116] = [__v_33, __v_29];
+                                let __v_33: G = { let __values: [G; 6] = [__v_32, __v_13, __v_12, __v_7, __v_29, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __ret: [G; OUT_116] = [__v_33, __v_31];
                                 record.function_queries[116].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
@@ -11740,11 +11740,11 @@ fn aiur_fn_116(
                         let __v_23: G = __r_arr[0];
                         let __r_arr: [G; OUT_110] = { let __args: [G; IN_110] = [__v_7, __v_2, __v_3, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[110].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[110].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[110].bump_multiplicity(__i); } let __ret: [G; OUT_110] = unsafe { *(record.function_queries[110].output_at(__i).as_ptr() as *const [G; OUT_110]) }; __ret }, _ => aiur_fn_110(__args, record, io_buffer, __cu)? } };
                         let __v_24: G = __r_arr[0];
-                        let __v_25: G = G::from_u64(0);
+                        let __v_25: G = G::from_u64(1);
                         let __v_26: G = G::from_u64(1);
-                        let __v_27: G = G::from_u64(1);
-                        let __v_28: G = { let __values: [G; 6] = [__v_26, __v_27, __v_27, __v_27, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_29: G = { let __values: [G; 6] = [__v_25, __v_13, __v_12, __v_7, __v_24, __v_28]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_27: G = { let __values: [G; 6] = [__v_25, __v_26, __v_26, __v_26, __v_26, __v_26]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_28: G = G::from_u64(0);
+                        let __v_29: G = { let __values: [G; 6] = [__v_28, __v_13, __v_12, __v_7, __v_24, __v_27]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_116] = [__v_29, __v_22];
                         record.function_queries[116].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -11828,49 +11828,49 @@ fn aiur_fn_118(
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
     let __v_5: G = inp[5];
-    let __r_arr: [G; OUT_115] = { let __args: [G; IN_115] = [__v_3, __v_1, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[115].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[115].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[115].bump_multiplicity(__i); } let __ret: [G; OUT_115] = unsafe { *(record.function_queries[115].output_at(__i).as_ptr() as *const [G; OUT_115]) }; __ret }, _ => aiur_fn_115(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
     let __v_6: G = __r_arr[0];
-    let __r_arr: [G; OUT_114] = { let __args: [G; IN_114] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[114].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[114].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[114].bump_multiplicity(__i); } let __ret: [G; OUT_114] = unsafe { *(record.function_queries[114].output_at(__i).as_ptr() as *const [G; OUT_114]) }; __ret }, _ => aiur_fn_114(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
     let __v_7: G = __r_arr[0];
-    let __r_arr: [G; OUT_117] = { let __args: [G; IN_117] = [__v_7, __v_4, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[117].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[117].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[117].bump_multiplicity(__i); } let __ret: [G; OUT_117] = unsafe { *(record.function_queries[117].output_at(__i).as_ptr() as *const [G; OUT_117]) }; __ret }, _ => aiur_fn_117(__args, record, io_buffer, __cu)? } };
-    let __v_8: G = __r_arr[0];
-    let __v_9: G = __r_arr[1];
-    let __loaded: [G; 6] = { let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; let __ptr_u64 = __v_8.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 6 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 6] = __args[..6].try_into().unwrap(); __arr };
-    let __v_10: G = __loaded[0];
-    let __v_11: G = __loaded[1];
-    let __v_12: G = __loaded[2];
-    let __v_13: G = __loaded[3];
-    let __v_14: G = __loaded[4];
-    let __v_15: G = __loaded[5];
-    match __v_10.as_canonical_u64() {
+    let __v_8: G = (__v_6 - __v_7);
+    let __v_9: G = G::from_bool((__v_8 == G::ZERO));
+    let __v_10: G = G::from_u64(1);
+    if (__v_9 != __v_10) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: None });
+    }
+    let __r_arr: [G; OUT_115] = { let __args: [G; IN_115] = [__v_3, __v_1, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[115].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[115].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[115].bump_multiplicity(__i); } let __ret: [G; OUT_115] = unsafe { *(record.function_queries[115].output_at(__i).as_ptr() as *const [G; OUT_115]) }; __ret }, _ => aiur_fn_115(__args, record, io_buffer, __cu)? } };
+    let __v_11: G = __r_arr[0];
+    let __r_arr: [G; OUT_114] = { let __args: [G; IN_114] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[114].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[114].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[114].bump_multiplicity(__i); } let __ret: [G; OUT_114] = unsafe { *(record.function_queries[114].output_at(__i).as_ptr() as *const [G; OUT_114]) }; __ret }, _ => aiur_fn_114(__args, record, io_buffer, __cu)? } };
+    let __v_12: G = __r_arr[0];
+    let __r_arr: [G; OUT_117] = { let __args: [G; IN_117] = [__v_12, __v_4, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[117].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[117].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[117].bump_multiplicity(__i); } let __ret: [G; OUT_117] = unsafe { *(record.function_queries[117].output_at(__i).as_ptr() as *const [G; OUT_117]) }; __ret }, _ => aiur_fn_117(__args, record, io_buffer, __cu)? } };
+    let __v_13: G = __r_arr[0];
+    let __v_14: G = __r_arr[1];
+    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_14]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+    let __v_15: G = __r_arr[0];
+    let __v_16: G = G::from_u64(0);
+    if (__v_15 != __v_16) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_15.as_canonical_u64(), rhs: __v_16.as_canonical_u64(), msg: None });
+    }
+    let __loaded: [G; 6] = { let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; let __ptr_u64 = __v_13.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 6 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 6] = __args[..6].try_into().unwrap(); __arr };
+    let __v_17: G = __loaded[0];
+    let __v_18: G = __loaded[1];
+    let __v_19: G = __loaded[2];
+    let __v_20: G = __loaded[3];
+    let __v_21: G = __loaded[4];
+    let __v_22: G = __loaded[5];
+    match __v_17.as_canonical_u64() {
       0u64 => {
-        match __v_11.as_canonical_u64() {
+        let __r_arr: [G; OUT_248] = { let __args: [G; IN_248] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[248].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[248].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[248].bump_multiplicity(__i); } let __ret: [G; OUT_248] = unsafe { *(record.function_queries[248].output_at(__i).as_ptr() as *const [G; OUT_248]) }; __ret }, _ => aiur_fn_248(__args, record, io_buffer, __cu)? } };
+        let __v_23: G = __r_arr[0];
+        let __v_24: G = G::from_u64(0);
+        if (__v_23 != __v_24) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: None });
+        }
+        match __v_18.as_canonical_u64() {
           _ => {
-            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-            let __v_16: G = __r_arr[0];
-            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-            let __v_17: G = __r_arr[0];
-            let __v_18: G = (__v_16 - __v_17);
-            let __v_19: G = G::from_bool((__v_18 == G::ZERO));
-            let __v_20: G = G::from_u64(1);
-            if (__v_19 != __v_20) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-            let __v_21: G = __r_arr[0];
-            let __v_22: G = G::from_u64(0);
-            if (__v_21 != __v_22) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_21.as_canonical_u64(), rhs: __v_22.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_248] = { let __args: [G; IN_248] = [__v_15]; let __cu = unconstrained; let __hit = record.function_queries[248].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[248].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[248].bump_multiplicity(__i); } let __ret: [G; OUT_248] = unsafe { *(record.function_queries[248].output_at(__i).as_ptr() as *const [G; OUT_248]) }; __ret }, _ => aiur_fn_248(__args, record, io_buffer, __cu)? } };
-            let __v_23: G = __r_arr[0];
-            let __v_24: G = G::from_u64(0);
-            if (__v_23 != __v_24) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_0, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_0, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
             let __v_25: G = __r_arr[0];
-            let __v_26: G = (__v_25 - __v_14);
+            let __v_26: G = (__v_25 - __v_21);
             let __v_27: G = G::from_bool((__v_26 == G::ZERO));
             let __ret: [G; OUT_118] = [__v_27];
             record.function_queries[118].finish(&inp[..], &__ret[..], !unconstrained);
@@ -11879,7 +11879,7 @@ fn aiur_fn_118(
         }
       },
       _ => {
-        return Err(ExecError::MatchNoCase(__v_10.as_canonical_u64()));
+        return Err(ExecError::MatchNoCase(__v_17.as_canonical_u64()));
       },
     }
   })
@@ -12258,100 +12258,100 @@ fn aiur_fn_124(
         if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_10; let __vj = __v_11; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_12; let __vj = __v_13; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_14: G = G::from_u64(1020);
-        let __v_15: G = (__v_13 - __v_14);
-        let __v_16: G = (__v_12 + __v_15);
-        let __v_17: G = (__v_11 + __v_16);
-        let __v_18: G = (__v_10 + __v_17);
-        let __v_19: G = G::from_bool((__v_18 == G::ZERO));
-        let __v_20: G = (__v_8 + __v_9);
-        let __v_21: G = (__v_7 + __v_20);
-        let __v_22: G = (__v_6 + __v_21);
-        let __v_23: G = G::from_bool((__v_22 == G::ZERO));
-        let __gb: [u8; 8] = __v_4.as_canonical_u64().to_le_bytes();
-        let __v_24: G = G::from_u8(__gb[0]);
-        let __v_25: G = G::from_u8(__gb[1]);
-        let __v_26: G = G::from_u8(__gb[2]);
-        let __v_27: G = G::from_u8(__gb[3]);
-        let __v_28: G = G::from_u8(__gb[4]);
-        let __v_29: G = G::from_u8(__gb[5]);
-        let __v_30: G = G::from_u8(__gb[6]);
-        let __v_31: G = G::from_u8(__gb[7]);
-        if !unconstrained { let __vi = __v_24; let __vj = __v_25; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        if !unconstrained { let __vi = __v_26; let __vj = __v_27; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        if !unconstrained { let __vi = __v_28; let __vj = __v_29; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        if !unconstrained { let __vi = __v_30; let __vj = __v_31; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_32: G = G::from_u64(1020);
-        let __v_33: G = (__v_31 - __v_32);
-        let __v_34: G = (__v_30 + __v_33);
-        let __v_35: G = (__v_29 + __v_34);
-        let __v_36: G = (__v_28 + __v_35);
-        let __v_37: G = G::from_bool((__v_36 == G::ZERO));
-        let __v_38: G = (__v_26 + __v_27);
-        let __v_39: G = (__v_25 + __v_38);
-        let __v_40: G = (__v_24 + __v_39);
-        let __v_41: G = G::from_bool((__v_40 == G::ZERO));
-        let __v_42: G = G::from_u64(256);
-        let __v_43: G = (__v_42 * __v_7);
-        let __v_44: G = G::from_u64(65536);
-        let __v_45: G = (__v_44 * __v_8);
-        let __v_46: G = G::from_u64(16777216);
-        let __v_47: G = (__v_46 * __v_9);
-        let __v_48: G = G::from_u64(4294967296);
-        let __v_49: G = (__v_48 * __v_10);
-        let __v_50: G = G::from_u64(1099511627776);
-        let __v_51: G = (__v_50 * __v_11);
-        let __v_52: G = G::from_u64(281474976710656);
-        let __v_53: G = (__v_52 * __v_12);
-        let __v_54: G = G::from_u64(72057594037927936);
-        let __v_55: G = (__v_54 * __v_13);
-        let __v_56: G = (__v_53 + __v_55);
-        let __v_57: G = (__v_51 + __v_56);
-        let __v_58: G = (__v_49 + __v_57);
-        let __v_59: G = (__v_47 + __v_58);
-        let __v_60: G = (__v_45 + __v_59);
-        let __v_61: G = (__v_43 + __v_60);
-        let __v_62: G = (__v_6 + __v_61);
-        if (__v_62 != __v_3) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_62.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
+        let __v_14: G = G::from_u64(256);
+        let __v_15: G = (__v_14 * __v_7);
+        let __v_16: G = G::from_u64(65536);
+        let __v_17: G = (__v_16 * __v_8);
+        let __v_18: G = G::from_u64(16777216);
+        let __v_19: G = (__v_18 * __v_9);
+        let __v_20: G = G::from_u64(4294967296);
+        let __v_21: G = (__v_20 * __v_10);
+        let __v_22: G = G::from_u64(1099511627776);
+        let __v_23: G = (__v_22 * __v_11);
+        let __v_24: G = G::from_u64(281474976710656);
+        let __v_25: G = (__v_24 * __v_12);
+        let __v_26: G = G::from_u64(72057594037927936);
+        let __v_27: G = (__v_26 * __v_13);
+        let __v_28: G = (__v_25 + __v_27);
+        let __v_29: G = (__v_23 + __v_28);
+        let __v_30: G = (__v_21 + __v_29);
+        let __v_31: G = (__v_19 + __v_30);
+        let __v_32: G = (__v_17 + __v_31);
+        let __v_33: G = (__v_15 + __v_32);
+        let __v_34: G = (__v_6 + __v_33);
+        if (__v_34 != __v_3) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
         }
-        let __v_63: G = G::from_u64(1);
-        let __v_64: G = G::from_u64(1);
-        let __v_65: G = (__v_64 - __v_23);
-        let __v_66: G = (__v_19 * __v_65);
-        let __v_67: G = (__v_63 - __v_66);
-        let __v_68: G = G::from_u64(1);
-        if (__v_67 != __v_68) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_67.as_canonical_u64(), rhs: __v_68.as_canonical_u64(), msg: None });
+        let __v_35: G = G::from_u64(1020);
+        let __v_36: G = (__v_13 - __v_35);
+        let __v_37: G = (__v_12 + __v_36);
+        let __v_38: G = (__v_11 + __v_37);
+        let __v_39: G = (__v_10 + __v_38);
+        let __v_40: G = G::from_bool((__v_39 == G::ZERO));
+        let __v_41: G = (__v_8 + __v_9);
+        let __v_42: G = (__v_7 + __v_41);
+        let __v_43: G = (__v_6 + __v_42);
+        let __v_44: G = G::from_bool((__v_43 == G::ZERO));
+        let __v_45: G = G::from_u64(1);
+        let __v_46: G = G::from_u64(1);
+        let __v_47: G = (__v_46 - __v_44);
+        let __v_48: G = (__v_40 * __v_47);
+        let __v_49: G = (__v_45 - __v_48);
+        let __v_50: G = G::from_u64(1);
+        if (__v_49 != __v_50) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_49.as_canonical_u64(), rhs: __v_50.as_canonical_u64(), msg: None });
         }
-        let __v_69: G = G::from_u64(256);
-        let __v_70: G = (__v_69 * __v_25);
-        let __v_71: G = G::from_u64(65536);
-        let __v_72: G = (__v_71 * __v_26);
-        let __v_73: G = G::from_u64(16777216);
-        let __v_74: G = (__v_73 * __v_27);
-        let __v_75: G = G::from_u64(4294967296);
-        let __v_76: G = (__v_75 * __v_28);
-        let __v_77: G = G::from_u64(1099511627776);
-        let __v_78: G = (__v_77 * __v_29);
-        let __v_79: G = G::from_u64(281474976710656);
-        let __v_80: G = (__v_79 * __v_30);
-        let __v_81: G = G::from_u64(72057594037927936);
-        let __v_82: G = (__v_81 * __v_31);
-        let __v_83: G = (__v_80 + __v_82);
-        let __v_84: G = (__v_78 + __v_83);
-        let __v_85: G = (__v_76 + __v_84);
-        let __v_86: G = (__v_74 + __v_85);
-        let __v_87: G = (__v_72 + __v_86);
-        let __v_88: G = (__v_70 + __v_87);
-        let __v_89: G = (__v_24 + __v_88);
-        if (__v_89 != __v_4) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: None });
+        let __gb: [u8; 8] = __v_4.as_canonical_u64().to_le_bytes();
+        let __v_51: G = G::from_u8(__gb[0]);
+        let __v_52: G = G::from_u8(__gb[1]);
+        let __v_53: G = G::from_u8(__gb[2]);
+        let __v_54: G = G::from_u8(__gb[3]);
+        let __v_55: G = G::from_u8(__gb[4]);
+        let __v_56: G = G::from_u8(__gb[5]);
+        let __v_57: G = G::from_u8(__gb[6]);
+        let __v_58: G = G::from_u8(__gb[7]);
+        if !unconstrained { let __vi = __v_51; let __vj = __v_52; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        if !unconstrained { let __vi = __v_53; let __vj = __v_54; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        if !unconstrained { let __vi = __v_55; let __vj = __v_56; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        if !unconstrained { let __vi = __v_57; let __vj = __v_58; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        let __v_59: G = G::from_u64(256);
+        let __v_60: G = (__v_59 * __v_52);
+        let __v_61: G = G::from_u64(65536);
+        let __v_62: G = (__v_61 * __v_53);
+        let __v_63: G = G::from_u64(16777216);
+        let __v_64: G = (__v_63 * __v_54);
+        let __v_65: G = G::from_u64(4294967296);
+        let __v_66: G = (__v_65 * __v_55);
+        let __v_67: G = G::from_u64(1099511627776);
+        let __v_68: G = (__v_67 * __v_56);
+        let __v_69: G = G::from_u64(281474976710656);
+        let __v_70: G = (__v_69 * __v_57);
+        let __v_71: G = G::from_u64(72057594037927936);
+        let __v_72: G = (__v_71 * __v_58);
+        let __v_73: G = (__v_70 + __v_72);
+        let __v_74: G = (__v_68 + __v_73);
+        let __v_75: G = (__v_66 + __v_74);
+        let __v_76: G = (__v_64 + __v_75);
+        let __v_77: G = (__v_62 + __v_76);
+        let __v_78: G = (__v_60 + __v_77);
+        let __v_79: G = (__v_51 + __v_78);
+        if (__v_79 != __v_4) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: None });
         }
+        let __v_80: G = G::from_u64(1020);
+        let __v_81: G = (__v_58 - __v_80);
+        let __v_82: G = (__v_57 + __v_81);
+        let __v_83: G = (__v_56 + __v_82);
+        let __v_84: G = (__v_55 + __v_83);
+        let __v_85: G = G::from_bool((__v_84 == G::ZERO));
+        let __v_86: G = (__v_53 + __v_54);
+        let __v_87: G = (__v_52 + __v_86);
+        let __v_88: G = (__v_51 + __v_87);
+        let __v_89: G = G::from_bool((__v_88 == G::ZERO));
         let __v_90: G = G::from_u64(1);
         let __v_91: G = G::from_u64(1);
-        let __v_92: G = (__v_91 - __v_41);
-        let __v_93: G = (__v_37 * __v_92);
+        let __v_92: G = (__v_91 - __v_89);
+        let __v_93: G = (__v_85 * __v_92);
         let __v_94: G = (__v_90 - __v_93);
         let __v_95: G = G::from_u64(1);
         if (__v_94 != __v_95) {
@@ -12359,7 +12359,7 @@ fn aiur_fn_124(
         }
         let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
         let __v_96: G = __r_arr[0];
-        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_96]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_96]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
         let __v_97: G = __r_arr[0];
         let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_97]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
         let __v_98: G = __r_arr[0];
@@ -12650,50 +12650,50 @@ fn aiur_fn_130(
             let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_36, __v_6, __v_16, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
             let __v_38: G = __r_arr[0];
             let __v_39: G = __r_arr[1];
-            let __v_40: G = G::from_u64(0);
-            let __v_41: G = G::from_u64(256);
-            let __v_42: G = (__v_41 * __v_21);
-            let __v_43: G = G::from_u64(65536);
-            let __v_44: G = (__v_43 * __v_22);
-            let __v_45: G = G::from_u64(16777216);
-            let __v_46: G = (__v_45 * __v_23);
-            let __v_47: G = G::from_u64(4294967296);
-            let __v_48: G = (__v_47 * __v_24);
-            let __v_49: G = G::from_u64(1099511627776);
-            let __v_50: G = (__v_49 * __v_25);
-            let __v_51: G = G::from_u64(281474976710656);
-            let __v_52: G = (__v_51 * __v_26);
-            let __v_53: G = G::from_u64(72057594037927936);
-            let __v_54: G = (__v_53 * __v_27);
-            let __v_55: G = (__v_52 + __v_54);
-            let __v_56: G = (__v_50 + __v_55);
-            let __v_57: G = (__v_48 + __v_56);
-            let __v_58: G = (__v_46 + __v_57);
-            let __v_59: G = (__v_44 + __v_58);
-            let __v_60: G = (__v_42 + __v_59);
-            let __v_61: G = (__v_20 + __v_60);
-            let __v_62: G = G::from_u64(256);
-            let __v_63: G = (__v_62 * __v_29);
-            let __v_64: G = G::from_u64(65536);
-            let __v_65: G = (__v_64 * __v_30);
-            let __v_66: G = G::from_u64(16777216);
-            let __v_67: G = (__v_66 * __v_31);
-            let __v_68: G = G::from_u64(4294967296);
-            let __v_69: G = (__v_68 * __v_32);
-            let __v_70: G = G::from_u64(1099511627776);
-            let __v_71: G = (__v_70 * __v_33);
-            let __v_72: G = G::from_u64(281474976710656);
-            let __v_73: G = (__v_72 * __v_34);
-            let __v_74: G = G::from_u64(72057594037927936);
-            let __v_75: G = (__v_74 * __v_35);
-            let __v_76: G = (__v_73 + __v_75);
-            let __v_77: G = (__v_71 + __v_76);
-            let __v_78: G = (__v_69 + __v_77);
-            let __v_79: G = (__v_67 + __v_78);
-            let __v_80: G = (__v_65 + __v_79);
-            let __v_81: G = (__v_63 + __v_80);
-            let __v_82: G = (__v_28 + __v_81);
-            let __v_83: G = { let __values: [G; 4] = [__v_40, __v_61, __v_82, __v_38]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_40: G = G::from_u64(256);
+            let __v_41: G = (__v_40 * __v_21);
+            let __v_42: G = G::from_u64(65536);
+            let __v_43: G = (__v_42 * __v_22);
+            let __v_44: G = G::from_u64(16777216);
+            let __v_45: G = (__v_44 * __v_23);
+            let __v_46: G = G::from_u64(4294967296);
+            let __v_47: G = (__v_46 * __v_24);
+            let __v_48: G = G::from_u64(1099511627776);
+            let __v_49: G = (__v_48 * __v_25);
+            let __v_50: G = G::from_u64(281474976710656);
+            let __v_51: G = (__v_50 * __v_26);
+            let __v_52: G = G::from_u64(72057594037927936);
+            let __v_53: G = (__v_52 * __v_27);
+            let __v_54: G = (__v_51 + __v_53);
+            let __v_55: G = (__v_49 + __v_54);
+            let __v_56: G = (__v_47 + __v_55);
+            let __v_57: G = (__v_45 + __v_56);
+            let __v_58: G = (__v_43 + __v_57);
+            let __v_59: G = (__v_41 + __v_58);
+            let __v_60: G = (__v_20 + __v_59);
+            let __v_61: G = G::from_u64(256);
+            let __v_62: G = (__v_61 * __v_29);
+            let __v_63: G = G::from_u64(65536);
+            let __v_64: G = (__v_63 * __v_30);
+            let __v_65: G = G::from_u64(16777216);
+            let __v_66: G = (__v_65 * __v_31);
+            let __v_67: G = G::from_u64(4294967296);
+            let __v_68: G = (__v_67 * __v_32);
+            let __v_69: G = G::from_u64(1099511627776);
+            let __v_70: G = (__v_69 * __v_33);
+            let __v_71: G = G::from_u64(281474976710656);
+            let __v_72: G = (__v_71 * __v_34);
+            let __v_73: G = G::from_u64(72057594037927936);
+            let __v_74: G = (__v_73 * __v_35);
+            let __v_75: G = (__v_72 + __v_74);
+            let __v_76: G = (__v_70 + __v_75);
+            let __v_77: G = (__v_68 + __v_76);
+            let __v_78: G = (__v_66 + __v_77);
+            let __v_79: G = (__v_64 + __v_78);
+            let __v_80: G = (__v_62 + __v_79);
+            let __v_81: G = (__v_28 + __v_80);
+            let __v_82: G = G::from_u64(0);
+            let __v_83: G = { let __values: [G; 4] = [__v_82, __v_60, __v_81, __v_38]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_130] = [__v_83, __v_39];
             record.function_queries[130].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -12800,16 +12800,16 @@ fn aiur_fn_132(
             return Ok(__ret);
           },
           _ => {
-            let __v_6: G = G::from_u64(0);
-            let __v_7: G = G::from_u64(1);
+            let __v_6: G = G::from_u64(1);
+            let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = (__v_3 - __v_11);
-            let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_0, __v_1, __v_2, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
-            let __v_13: G = __r_arr[0];
-            let __v_14: G = { let __values: [G; 7] = [__v_6, __v_3, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(1);
+            let __v_11: G = (__v_3 - __v_10);
+            let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_0, __v_1, __v_2, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
+            let __v_12: G = __r_arr[0];
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 7] = [__v_13, __v_3, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_132] = [__v_14];
             record.function_queries[132].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -12886,10 +12886,10 @@ fn aiur_fn_133(
                 return Ok(__ret);
               },
               _ => {
-                let __v_17: G = G::from_u64(0);
                 let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_14, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
-                let __v_18: G = __r_arr[0];
-                let __v_19: G = { let __values: [G; 7] = [__v_17, __v_9, __v_10, __v_11, __v_12, __v_13, __v_18]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = __r_arr[0];
+                let __v_18: G = G::from_u64(0);
+                let __v_19: G = { let __values: [G; 7] = [__v_18, __v_9, __v_10, __v_11, __v_12, __v_13, __v_17]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_133] = [__v_19];
                 record.function_queries[133].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -13025,57 +13025,57 @@ fn aiur_fn_136(
     let __v_7: G = inp[7];
     let __v_8: G = inp[8];
     let __v_9: G = inp[9];
-    let __v_10: G = (__v_3 - __v_1);
-    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_2, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
+    let __v_10: G = __r_arr[0];
+    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
     let __v_11: G = __r_arr[0];
-    let __v_12: G = G::from_u64(7);
-    let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
-    let __v_13: G = __r_arr[0];
+    let __v_12: G = (__v_10 - __v_11);
+    let __v_13: G = G::from_bool((__v_12 == G::ZERO));
     let __v_14: G = G::from_u64(1);
-    let __v_15: G = G::from_u64(1);
-    let __v_16: G = { let __values: [G; 3] = [__v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_119] = { let __args: [G; IN_119] = [__v_11, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[119].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[119].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[119].bump_multiplicity(__i); } let __ret: [G; OUT_119] = unsafe { *(record.function_queries[119].output_at(__i).as_ptr() as *const [G; OUT_119]) }; __ret }, _ => aiur_fn_119(__args, record, io_buffer, __cu)? } };
-    let __v_17: G = __r_arr[0];
-    let __r_arr: [G; OUT_120] = { let __args: [G; IN_120] = [__v_13, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[120].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[120].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[120].bump_multiplicity(__i); } let __ret: [G; OUT_120] = unsafe { *(record.function_queries[120].output_at(__i).as_ptr() as *const [G; OUT_120]) }; __ret }, _ => aiur_fn_120(__args, record, io_buffer, __cu)? } };
+    if (__v_13 != __v_14) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: None });
+    }
+    let __v_15: G = (__v_3 - __v_1);
+    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_2, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+    let __v_16: G = __r_arr[0];
+    let __v_17: G = G::from_u64(7);
+    let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
     let __v_18: G = __r_arr[0];
-    let __v_19: G = (__v_12 * __v_18);
-    let __v_20: G = G::from_u64(0);
-    let __v_21: G = (__v_4 - __v_19);
-    let __v_22: G = (__v_5 - __v_20);
-    let __v_23: G = (__v_21 * __v_21);
-    let __v_24: G = G::from_u64(7);
-    let __v_25: G = (__v_22 * __v_22);
-    let __v_26: G = (__v_24 * __v_25);
-    let __v_27: G = (__v_23 - __v_26);
-    let __v_28: G = g_inverse_value(__v_27);
-    let __v_29: G = (__v_27 * __v_28);
-    let __v_30: G = G::from_u64(1);
-    let __v_31: G = (__v_29 - __v_30);
-    let __v_32: G = (__v_27 * __v_31);
-    let __v_33: G = G::from_u64(0);
-    if (__v_32 != __v_33) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_32.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: None });
+    let __v_19: G = G::from_u64(1);
+    let __v_20: G = G::from_u64(1);
+    let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_119] = { let __args: [G; IN_119] = [__v_16, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[119].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[119].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[119].bump_multiplicity(__i); } let __ret: [G; OUT_119] = unsafe { *(record.function_queries[119].output_at(__i).as_ptr() as *const [G; OUT_119]) }; __ret }, _ => aiur_fn_119(__args, record, io_buffer, __cu)? } };
+    let __v_22: G = __r_arr[0];
+    let __r_arr: [G; OUT_120] = { let __args: [G; IN_120] = [__v_18, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[120].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[120].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[120].bump_multiplicity(__i); } let __ret: [G; OUT_120] = unsafe { *(record.function_queries[120].output_at(__i).as_ptr() as *const [G; OUT_120]) }; __ret }, _ => aiur_fn_120(__args, record, io_buffer, __cu)? } };
+    let __v_23: G = __r_arr[0];
+    let __v_24: G = (__v_17 * __v_23);
+    let __v_25: G = G::from_u64(0);
+    let __v_26: G = (__v_4 - __v_24);
+    let __v_27: G = (__v_5 - __v_25);
+    let __v_28: G = (__v_26 * __v_26);
+    let __v_29: G = G::from_u64(7);
+    let __v_30: G = (__v_27 * __v_27);
+    let __v_31: G = (__v_29 * __v_30);
+    let __v_32: G = (__v_28 - __v_31);
+    let __v_33: G = g_inverse_value(__v_32);
+    let __v_34: G = (__v_32 * __v_33);
+    let __v_35: G = G::from_u64(1);
+    let __v_36: G = (__v_34 - __v_35);
+    let __v_37: G = (__v_32 * __v_36);
+    let __v_38: G = G::from_u64(0);
+    if (__v_37 != __v_38) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_37.as_canonical_u64(), rhs: __v_38.as_canonical_u64(), msg: None });
     }
-    let __v_34: G = (__v_28 * __v_31);
-    let __v_35: G = G::from_u64(0);
-    if (__v_34 != __v_35) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: None });
-    }
-    let __v_36: G = (__v_21 * __v_28);
-    let __v_37: G = G::from_u64(0);
-    let __v_38: G = (__v_37 - __v_22);
-    let __v_39: G = (__v_38 * __v_28);
-    let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
-    let __v_40: G = __r_arr[0];
-    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-    let __v_41: G = __r_arr[0];
-    let __v_42: G = (__v_40 - __v_41);
-    let __v_43: G = G::from_bool((__v_42 == G::ZERO));
-    let __v_44: G = G::from_u64(1);
-    if (__v_43 != __v_44) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: None });
+    let __v_39: G = (__v_33 * __v_36);
+    let __v_40: G = G::from_u64(0);
+    if (__v_39 != __v_40) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: None });
     }
-    let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_0, __v_1, __v_6, __v_7, __v_36, __v_39, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
+    let __v_41: G = (__v_26 * __v_33);
+    let __v_42: G = G::from_u64(0);
+    let __v_43: G = (__v_42 - __v_27);
+    let __v_44: G = (__v_43 * __v_33);
+    let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_0, __v_1, __v_6, __v_7, __v_41, __v_44, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
     let __v_45: G = __r_arr[0];
     let __ret: [G; OUT_136] = [__v_45];
     record.function_queries[136].finish(&inp[..], &__ret[..], !unconstrained);
@@ -13355,21 +13355,21 @@ fn aiur_fn_141(
         let __v_16: G = __r_arr[0];
         match __v_16.as_canonical_u64() {
           _ => {
-            let __v_17: G = G::from_u64(0);
-            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_6, __v_10, __v_5, __v_7, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
-            let __v_18: G = __r_arr[0];
-            let __r_arr: [G; OUT_143] = { let __args: [G; IN_143] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[143].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[143].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[143].bump_multiplicity(__i); } let __ret: [G; OUT_143] = unsafe { *(record.function_queries[143].output_at(__i).as_ptr() as *const [G; OUT_143]) }; __ret }, _ => aiur_fn_143(__args, record, io_buffer, __cu)? } };
-            let __v_19: G = __r_arr[0];
             let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-            let __v_20: G = __r_arr[0];
+            let __v_17: G = __r_arr[0];
             let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-            let __v_21: G = __r_arr[0];
-            let __v_22: G = (__v_20 - __v_21);
-            let __v_23: G = G::from_bool((__v_22 == G::ZERO));
-            let __v_24: G = G::from_u64(1);
-            if (__v_23 != __v_24) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: None });
+            let __v_18: G = __r_arr[0];
+            let __v_19: G = (__v_17 - __v_18);
+            let __v_20: G = G::from_bool((__v_19 == G::ZERO));
+            let __v_21: G = G::from_u64(1);
+            if (__v_20 != __v_21) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: None });
             }
+            let __v_22: G = G::from_u64(0);
+            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_6, __v_10, __v_5, __v_7, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
+            let __v_23: G = __r_arr[0];
+            let __r_arr: [G; OUT_143] = { let __args: [G; IN_143] = [__v_23]; let __cu = unconstrained; let __hit = record.function_queries[143].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[143].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[143].bump_multiplicity(__i); } let __ret: [G; OUT_143] = unsafe { *(record.function_queries[143].output_at(__i).as_ptr() as *const [G; OUT_143]) }; __ret }, _ => aiur_fn_143(__args, record, io_buffer, __cu)? } };
+            let __v_24: G = __r_arr[0];
             let __v_25: G = G::from_u64(0);
             let __v_26: G = G::from_u64(0);
             let __r_arr: [G; OUT_140] = { let __args: [G; IN_140] = [__v_0, __v_8, __v_9, __v_10, __v_25, __v_7, __v_26, __v_6, __v_5, __v_11, __v_12, __v_16, __v_4, __v_13, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[140].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[140].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[140].bump_multiplicity(__i); } let __ret: [G; OUT_140] = unsafe { *(record.function_queries[140].output_at(__i).as_ptr() as *const [G; OUT_140]) }; __ret }, _ => aiur_fn_140(__args, record, io_buffer, __cu)? } };
@@ -13411,17 +13411,17 @@ fn aiur_fn_142(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
         let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_0, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
-        let __v_6: G = (__v_5 + __v_1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = (__v_2 - __v_7);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_3 + __v_9);
-        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_0, __v_1, __v_8, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 3] = [__v_4, __v_6, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = __r_arr[0];
+        let __v_5: G = (__v_4 + __v_1);
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = (__v_2 - __v_6);
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_3 + __v_8);
+        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_0, __v_1, __v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_5, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_142] = [__v_12];
         record.function_queries[142].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -13517,17 +13517,17 @@ fn aiur_fn_144(
             return Ok(__ret);
           },
           1u64 => {
-            let __v_7: G = G::from_u64(0);
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_0, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = (__v_8 + __v_1);
-            let __v_10: G = G::from_u64(1);
-            let __v_11: G = (__v_3 - __v_10);
-            let __v_12: G = G::from_u64(1);
-            let __v_13: G = (__v_4 + __v_12);
-            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_0, __v_1, __v_2, __v_11, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
-            let __v_14: G = __r_arr[0];
-            let __v_15: G = { let __values: [G; 3] = [__v_7, __v_9, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = (__v_7 + __v_1);
+            let __v_9: G = G::from_u64(1);
+            let __v_10: G = (__v_3 - __v_9);
+            let __v_11: G = G::from_u64(1);
+            let __v_12: G = (__v_4 + __v_11);
+            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_0, __v_1, __v_2, __v_10, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
+            let __v_13: G = __r_arr[0];
+            let __v_14: G = G::from_u64(0);
+            let __v_15: G = { let __values: [G; 3] = [__v_14, __v_8, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_144] = [__v_15];
             record.function_queries[144].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -13598,228 +13598,228 @@ fn aiur_fn_146(
     if !unconstrained { let __vi = __v_6; let __vj = __v_7; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_10; let __vj = __v_11; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_12: G = G::from_u64(1020);
-    let __v_13: G = (__v_11 - __v_12);
-    let __v_14: G = (__v_10 + __v_13);
-    let __v_15: G = (__v_9 + __v_14);
-    let __v_16: G = (__v_8 + __v_15);
-    let __v_17: G = G::from_bool((__v_16 == G::ZERO));
-    let __v_18: G = (__v_6 + __v_7);
-    let __v_19: G = (__v_5 + __v_18);
-    let __v_20: G = (__v_4 + __v_19);
-    let __v_21: G = G::from_bool((__v_20 == G::ZERO));
+    let __v_12: G = G::from_u64(256);
+    let __v_13: G = (__v_12 * __v_5);
+    let __v_14: G = G::from_u64(65536);
+    let __v_15: G = (__v_14 * __v_6);
+    let __v_16: G = G::from_u64(16777216);
+    let __v_17: G = (__v_16 * __v_7);
+    let __v_18: G = G::from_u64(4294967296);
+    let __v_19: G = (__v_18 * __v_8);
+    let __v_20: G = G::from_u64(1099511627776);
+    let __v_21: G = (__v_20 * __v_9);
+    let __v_22: G = G::from_u64(281474976710656);
+    let __v_23: G = (__v_22 * __v_10);
+    let __v_24: G = G::from_u64(72057594037927936);
+    let __v_25: G = (__v_24 * __v_11);
+    let __v_26: G = (__v_23 + __v_25);
+    let __v_27: G = (__v_21 + __v_26);
+    let __v_28: G = (__v_19 + __v_27);
+    let __v_29: G = (__v_17 + __v_28);
+    let __v_30: G = (__v_15 + __v_29);
+    let __v_31: G = (__v_13 + __v_30);
+    let __v_32: G = (__v_4 + __v_31);
+    if (__v_32 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_32.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
+    }
+    let __v_33: G = G::from_u64(1020);
+    let __v_34: G = (__v_11 - __v_33);
+    let __v_35: G = (__v_10 + __v_34);
+    let __v_36: G = (__v_9 + __v_35);
+    let __v_37: G = (__v_8 + __v_36);
+    let __v_38: G = G::from_bool((__v_37 == G::ZERO));
+    let __v_39: G = (__v_6 + __v_7);
+    let __v_40: G = (__v_5 + __v_39);
+    let __v_41: G = (__v_4 + __v_40);
+    let __v_42: G = G::from_bool((__v_41 == G::ZERO));
+    let __v_43: G = G::from_u64(1);
+    let __v_44: G = G::from_u64(1);
+    let __v_45: G = (__v_44 - __v_42);
+    let __v_46: G = (__v_38 * __v_45);
+    let __v_47: G = (__v_43 - __v_46);
+    let __v_48: G = G::from_u64(1);
+    if (__v_47 != __v_48) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_47.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: None });
+    }
     let __gb: [u8; 8] = __v_1.as_canonical_u64().to_le_bytes();
-    let __v_22: G = G::from_u8(__gb[0]);
-    let __v_23: G = G::from_u8(__gb[1]);
-    let __v_24: G = G::from_u8(__gb[2]);
-    let __v_25: G = G::from_u8(__gb[3]);
-    let __v_26: G = G::from_u8(__gb[4]);
-    let __v_27: G = G::from_u8(__gb[5]);
-    let __v_28: G = G::from_u8(__gb[6]);
-    let __v_29: G = G::from_u8(__gb[7]);
-    if !unconstrained { let __vi = __v_22; let __vj = __v_23; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_24; let __vj = __v_25; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_26; let __vj = __v_27; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_28; let __vj = __v_29; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_30: G = G::from_u64(1020);
-    let __v_31: G = (__v_29 - __v_30);
-    let __v_32: G = (__v_28 + __v_31);
-    let __v_33: G = (__v_27 + __v_32);
-    let __v_34: G = (__v_26 + __v_33);
-    let __v_35: G = G::from_bool((__v_34 == G::ZERO));
-    let __v_36: G = (__v_24 + __v_25);
-    let __v_37: G = (__v_23 + __v_36);
-    let __v_38: G = (__v_22 + __v_37);
-    let __v_39: G = G::from_bool((__v_38 == G::ZERO));
+    let __v_49: G = G::from_u8(__gb[0]);
+    let __v_50: G = G::from_u8(__gb[1]);
+    let __v_51: G = G::from_u8(__gb[2]);
+    let __v_52: G = G::from_u8(__gb[3]);
+    let __v_53: G = G::from_u8(__gb[4]);
+    let __v_54: G = G::from_u8(__gb[5]);
+    let __v_55: G = G::from_u8(__gb[6]);
+    let __v_56: G = G::from_u8(__gb[7]);
+    if !unconstrained { let __vi = __v_49; let __vj = __v_50; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_51; let __vj = __v_52; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_53; let __vj = __v_54; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_55; let __vj = __v_56; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    let __v_57: G = G::from_u64(256);
+    let __v_58: G = (__v_57 * __v_50);
+    let __v_59: G = G::from_u64(65536);
+    let __v_60: G = (__v_59 * __v_51);
+    let __v_61: G = G::from_u64(16777216);
+    let __v_62: G = (__v_61 * __v_52);
+    let __v_63: G = G::from_u64(4294967296);
+    let __v_64: G = (__v_63 * __v_53);
+    let __v_65: G = G::from_u64(1099511627776);
+    let __v_66: G = (__v_65 * __v_54);
+    let __v_67: G = G::from_u64(281474976710656);
+    let __v_68: G = (__v_67 * __v_55);
+    let __v_69: G = G::from_u64(72057594037927936);
+    let __v_70: G = (__v_69 * __v_56);
+    let __v_71: G = (__v_68 + __v_70);
+    let __v_72: G = (__v_66 + __v_71);
+    let __v_73: G = (__v_64 + __v_72);
+    let __v_74: G = (__v_62 + __v_73);
+    let __v_75: G = (__v_60 + __v_74);
+    let __v_76: G = (__v_58 + __v_75);
+    let __v_77: G = (__v_49 + __v_76);
+    if (__v_77 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: None });
+    }
+    let __v_78: G = G::from_u64(1020);
+    let __v_79: G = (__v_56 - __v_78);
+    let __v_80: G = (__v_55 + __v_79);
+    let __v_81: G = (__v_54 + __v_80);
+    let __v_82: G = (__v_53 + __v_81);
+    let __v_83: G = G::from_bool((__v_82 == G::ZERO));
+    let __v_84: G = (__v_51 + __v_52);
+    let __v_85: G = (__v_50 + __v_84);
+    let __v_86: G = (__v_49 + __v_85);
+    let __v_87: G = G::from_bool((__v_86 == G::ZERO));
+    let __v_88: G = G::from_u64(1);
+    let __v_89: G = G::from_u64(1);
+    let __v_90: G = (__v_89 - __v_87);
+    let __v_91: G = (__v_83 * __v_90);
+    let __v_92: G = (__v_88 - __v_91);
+    let __v_93: G = G::from_u64(1);
+    if (__v_92 != __v_93) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_92.as_canonical_u64(), rhs: __v_93.as_canonical_u64(), msg: None });
+    }
     let __gb: [u8; 8] = __v_2.as_canonical_u64().to_le_bytes();
-    let __v_40: G = G::from_u8(__gb[0]);
-    let __v_41: G = G::from_u8(__gb[1]);
-    let __v_42: G = G::from_u8(__gb[2]);
-    let __v_43: G = G::from_u8(__gb[3]);
-    let __v_44: G = G::from_u8(__gb[4]);
-    let __v_45: G = G::from_u8(__gb[5]);
-    let __v_46: G = G::from_u8(__gb[6]);
-    let __v_47: G = G::from_u8(__gb[7]);
-    if !unconstrained { let __vi = __v_40; let __vj = __v_41; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_42; let __vj = __v_43; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_44; let __vj = __v_45; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_46; let __vj = __v_47; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_48: G = G::from_u64(1020);
-    let __v_49: G = (__v_47 - __v_48);
-    let __v_50: G = (__v_46 + __v_49);
-    let __v_51: G = (__v_45 + __v_50);
-    let __v_52: G = (__v_44 + __v_51);
-    let __v_53: G = G::from_bool((__v_52 == G::ZERO));
-    let __v_54: G = (__v_42 + __v_43);
-    let __v_55: G = (__v_41 + __v_54);
-    let __v_56: G = (__v_40 + __v_55);
-    let __v_57: G = G::from_bool((__v_56 == G::ZERO));
-    let __gb: [u8; 8] = __v_3.as_canonical_u64().to_le_bytes();
-    let __v_58: G = G::from_u8(__gb[0]);
-    let __v_59: G = G::from_u8(__gb[1]);
-    let __v_60: G = G::from_u8(__gb[2]);
-    let __v_61: G = G::from_u8(__gb[3]);
-    let __v_62: G = G::from_u8(__gb[4]);
-    let __v_63: G = G::from_u8(__gb[5]);
-    let __v_64: G = G::from_u8(__gb[6]);
-    let __v_65: G = G::from_u8(__gb[7]);
-    if !unconstrained { let __vi = __v_58; let __vj = __v_59; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_60; let __vj = __v_61; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_62; let __vj = __v_63; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_64; let __vj = __v_65; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_66: G = G::from_u64(1020);
-    let __v_67: G = (__v_65 - __v_66);
-    let __v_68: G = (__v_64 + __v_67);
-    let __v_69: G = (__v_63 + __v_68);
-    let __v_70: G = (__v_62 + __v_69);
-    let __v_71: G = G::from_bool((__v_70 == G::ZERO));
-    let __v_72: G = (__v_60 + __v_61);
-    let __v_73: G = (__v_59 + __v_72);
-    let __v_74: G = (__v_58 + __v_73);
-    let __v_75: G = G::from_bool((__v_74 == G::ZERO));
-    let __v_76: G = G::from_u64(0);
-    let __v_77: G = G::from_u64(256);
-    let __v_78: G = (__v_77 * __v_5);
-    let __v_79: G = G::from_u64(65536);
-    let __v_80: G = (__v_79 * __v_6);
-    let __v_81: G = G::from_u64(16777216);
-    let __v_82: G = (__v_81 * __v_7);
-    let __v_83: G = G::from_u64(4294967296);
-    let __v_84: G = (__v_83 * __v_8);
-    let __v_85: G = G::from_u64(1099511627776);
-    let __v_86: G = (__v_85 * __v_9);
-    let __v_87: G = G::from_u64(281474976710656);
-    let __v_88: G = (__v_87 * __v_10);
-    let __v_89: G = G::from_u64(72057594037927936);
-    let __v_90: G = (__v_89 * __v_11);
-    let __v_91: G = (__v_88 + __v_90);
-    let __v_92: G = (__v_86 + __v_91);
-    let __v_93: G = (__v_84 + __v_92);
-    let __v_94: G = (__v_82 + __v_93);
-    let __v_95: G = (__v_80 + __v_94);
-    let __v_96: G = (__v_78 + __v_95);
-    let __v_97: G = (__v_4 + __v_96);
-    if (__v_97 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_97.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
-    }
-    let __v_98: G = G::from_u64(1);
-    let __v_99: G = G::from_u64(1);
-    let __v_100: G = (__v_99 - __v_21);
-    let __v_101: G = (__v_17 * __v_100);
-    let __v_102: G = (__v_98 - __v_101);
-    let __v_103: G = G::from_u64(1);
-    if (__v_102 != __v_103) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_102.as_canonical_u64(), rhs: __v_103.as_canonical_u64(), msg: None });
+    let __v_94: G = G::from_u8(__gb[0]);
+    let __v_95: G = G::from_u8(__gb[1]);
+    let __v_96: G = G::from_u8(__gb[2]);
+    let __v_97: G = G::from_u8(__gb[3]);
+    let __v_98: G = G::from_u8(__gb[4]);
+    let __v_99: G = G::from_u8(__gb[5]);
+    let __v_100: G = G::from_u8(__gb[6]);
+    let __v_101: G = G::from_u8(__gb[7]);
+    if !unconstrained { let __vi = __v_94; let __vj = __v_95; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_96; let __vj = __v_97; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_98; let __vj = __v_99; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_100; let __vj = __v_101; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    let __v_102: G = G::from_u64(256);
+    let __v_103: G = (__v_102 * __v_95);
+    let __v_104: G = G::from_u64(65536);
+    let __v_105: G = (__v_104 * __v_96);
+    let __v_106: G = G::from_u64(16777216);
+    let __v_107: G = (__v_106 * __v_97);
+    let __v_108: G = G::from_u64(4294967296);
+    let __v_109: G = (__v_108 * __v_98);
+    let __v_110: G = G::from_u64(1099511627776);
+    let __v_111: G = (__v_110 * __v_99);
+    let __v_112: G = G::from_u64(281474976710656);
+    let __v_113: G = (__v_112 * __v_100);
+    let __v_114: G = G::from_u64(72057594037927936);
+    let __v_115: G = (__v_114 * __v_101);
+    let __v_116: G = (__v_113 + __v_115);
+    let __v_117: G = (__v_111 + __v_116);
+    let __v_118: G = (__v_109 + __v_117);
+    let __v_119: G = (__v_107 + __v_118);
+    let __v_120: G = (__v_105 + __v_119);
+    let __v_121: G = (__v_103 + __v_120);
+    let __v_122: G = (__v_94 + __v_121);
+    if (__v_122 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_122.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: None });
+    }
+    let __v_123: G = G::from_u64(1020);
+    let __v_124: G = (__v_101 - __v_123);
+    let __v_125: G = (__v_100 + __v_124);
+    let __v_126: G = (__v_99 + __v_125);
+    let __v_127: G = (__v_98 + __v_126);
+    let __v_128: G = G::from_bool((__v_127 == G::ZERO));
+    let __v_129: G = (__v_96 + __v_97);
+    let __v_130: G = (__v_95 + __v_129);
+    let __v_131: G = (__v_94 + __v_130);
+    let __v_132: G = G::from_bool((__v_131 == G::ZERO));
+    let __v_133: G = G::from_u64(1);
+    let __v_134: G = G::from_u64(1);
+    let __v_135: G = (__v_134 - __v_132);
+    let __v_136: G = (__v_128 * __v_135);
+    let __v_137: G = (__v_133 - __v_136);
+    let __v_138: G = G::from_u64(1);
+    if (__v_137 != __v_138) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_137.as_canonical_u64(), rhs: __v_138.as_canonical_u64(), msg: None });
     }
-    let __v_104: G = G::from_u64(0);
-    let __v_105: G = G::from_u64(256);
-    let __v_106: G = (__v_105 * __v_23);
-    let __v_107: G = G::from_u64(65536);
-    let __v_108: G = (__v_107 * __v_24);
-    let __v_109: G = G::from_u64(16777216);
-    let __v_110: G = (__v_109 * __v_25);
-    let __v_111: G = G::from_u64(4294967296);
-    let __v_112: G = (__v_111 * __v_26);
-    let __v_113: G = G::from_u64(1099511627776);
-    let __v_114: G = (__v_113 * __v_27);
-    let __v_115: G = G::from_u64(281474976710656);
-    let __v_116: G = (__v_115 * __v_28);
-    let __v_117: G = G::from_u64(72057594037927936);
-    let __v_118: G = (__v_117 * __v_29);
-    let __v_119: G = (__v_116 + __v_118);
-    let __v_120: G = (__v_114 + __v_119);
-    let __v_121: G = (__v_112 + __v_120);
-    let __v_122: G = (__v_110 + __v_121);
-    let __v_123: G = (__v_108 + __v_122);
-    let __v_124: G = (__v_106 + __v_123);
-    let __v_125: G = (__v_22 + __v_124);
-    if (__v_125 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_125.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: None });
-    }
-    let __v_126: G = G::from_u64(1);
-    let __v_127: G = G::from_u64(1);
-    let __v_128: G = (__v_127 - __v_39);
-    let __v_129: G = (__v_35 * __v_128);
-    let __v_130: G = (__v_126 - __v_129);
-    let __v_131: G = G::from_u64(1);
-    if (__v_130 != __v_131) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
-    }
-    let __v_132: G = G::from_u64(0);
-    let __v_133: G = G::from_u64(256);
-    let __v_134: G = (__v_133 * __v_41);
-    let __v_135: G = G::from_u64(65536);
-    let __v_136: G = (__v_135 * __v_42);
-    let __v_137: G = G::from_u64(16777216);
-    let __v_138: G = (__v_137 * __v_43);
-    let __v_139: G = G::from_u64(4294967296);
-    let __v_140: G = (__v_139 * __v_44);
-    let __v_141: G = G::from_u64(1099511627776);
-    let __v_142: G = (__v_141 * __v_45);
-    let __v_143: G = G::from_u64(281474976710656);
-    let __v_144: G = (__v_143 * __v_46);
-    let __v_145: G = G::from_u64(72057594037927936);
-    let __v_146: G = (__v_145 * __v_47);
-    let __v_147: G = (__v_144 + __v_146);
-    let __v_148: G = (__v_142 + __v_147);
-    let __v_149: G = (__v_140 + __v_148);
-    let __v_150: G = (__v_138 + __v_149);
-    let __v_151: G = (__v_136 + __v_150);
-    let __v_152: G = (__v_134 + __v_151);
-    let __v_153: G = (__v_40 + __v_152);
-    if (__v_153 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_153.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: None });
-    }
-    let __v_154: G = G::from_u64(1);
-    let __v_155: G = G::from_u64(1);
-    let __v_156: G = (__v_155 - __v_57);
-    let __v_157: G = (__v_53 * __v_156);
-    let __v_158: G = (__v_154 - __v_157);
-    let __v_159: G = G::from_u64(1);
-    if (__v_158 != __v_159) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_158.as_canonical_u64(), rhs: __v_159.as_canonical_u64(), msg: None });
-    }
-    let __v_160: G = G::from_u64(0);
-    let __v_161: G = G::from_u64(256);
-    let __v_162: G = (__v_161 * __v_59);
-    let __v_163: G = G::from_u64(65536);
-    let __v_164: G = (__v_163 * __v_60);
-    let __v_165: G = G::from_u64(16777216);
-    let __v_166: G = (__v_165 * __v_61);
-    let __v_167: G = G::from_u64(4294967296);
-    let __v_168: G = (__v_167 * __v_62);
-    let __v_169: G = G::from_u64(1099511627776);
-    let __v_170: G = (__v_169 * __v_63);
-    let __v_171: G = G::from_u64(281474976710656);
-    let __v_172: G = (__v_171 * __v_64);
-    let __v_173: G = G::from_u64(72057594037927936);
-    let __v_174: G = (__v_173 * __v_65);
-    let __v_175: G = (__v_172 + __v_174);
-    let __v_176: G = (__v_170 + __v_175);
-    let __v_177: G = (__v_168 + __v_176);
-    let __v_178: G = (__v_166 + __v_177);
-    let __v_179: G = (__v_164 + __v_178);
-    let __v_180: G = (__v_162 + __v_179);
-    let __v_181: G = (__v_58 + __v_180);
-    if (__v_181 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_181.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
-    }
-    let __v_182: G = G::from_u64(1);
+    let __gb: [u8; 8] = __v_3.as_canonical_u64().to_le_bytes();
+    let __v_139: G = G::from_u8(__gb[0]);
+    let __v_140: G = G::from_u8(__gb[1]);
+    let __v_141: G = G::from_u8(__gb[2]);
+    let __v_142: G = G::from_u8(__gb[3]);
+    let __v_143: G = G::from_u8(__gb[4]);
+    let __v_144: G = G::from_u8(__gb[5]);
+    let __v_145: G = G::from_u8(__gb[6]);
+    let __v_146: G = G::from_u8(__gb[7]);
+    if !unconstrained { let __vi = __v_139; let __vj = __v_140; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_141; let __vj = __v_142; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_143; let __vj = __v_144; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_145; let __vj = __v_146; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    let __v_147: G = G::from_u64(256);
+    let __v_148: G = (__v_147 * __v_140);
+    let __v_149: G = G::from_u64(65536);
+    let __v_150: G = (__v_149 * __v_141);
+    let __v_151: G = G::from_u64(16777216);
+    let __v_152: G = (__v_151 * __v_142);
+    let __v_153: G = G::from_u64(4294967296);
+    let __v_154: G = (__v_153 * __v_143);
+    let __v_155: G = G::from_u64(1099511627776);
+    let __v_156: G = (__v_155 * __v_144);
+    let __v_157: G = G::from_u64(281474976710656);
+    let __v_158: G = (__v_157 * __v_145);
+    let __v_159: G = G::from_u64(72057594037927936);
+    let __v_160: G = (__v_159 * __v_146);
+    let __v_161: G = (__v_158 + __v_160);
+    let __v_162: G = (__v_156 + __v_161);
+    let __v_163: G = (__v_154 + __v_162);
+    let __v_164: G = (__v_152 + __v_163);
+    let __v_165: G = (__v_150 + __v_164);
+    let __v_166: G = (__v_148 + __v_165);
+    let __v_167: G = (__v_139 + __v_166);
+    if (__v_167 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_167.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
+    }
+    let __v_168: G = G::from_u64(1020);
+    let __v_169: G = (__v_146 - __v_168);
+    let __v_170: G = (__v_145 + __v_169);
+    let __v_171: G = (__v_144 + __v_170);
+    let __v_172: G = (__v_143 + __v_171);
+    let __v_173: G = G::from_bool((__v_172 == G::ZERO));
+    let __v_174: G = (__v_141 + __v_142);
+    let __v_175: G = (__v_140 + __v_174);
+    let __v_176: G = (__v_139 + __v_175);
+    let __v_177: G = G::from_bool((__v_176 == G::ZERO));
+    let __v_178: G = G::from_u64(1);
+    let __v_179: G = G::from_u64(1);
+    let __v_180: G = (__v_179 - __v_177);
+    let __v_181: G = (__v_173 * __v_180);
+    let __v_182: G = (__v_178 - __v_181);
     let __v_183: G = G::from_u64(1);
-    let __v_184: G = (__v_183 - __v_75);
-    let __v_185: G = (__v_71 * __v_184);
-    let __v_186: G = (__v_182 - __v_185);
-    let __v_187: G = G::from_u64(1);
-    if (__v_186 != __v_187) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_186.as_canonical_u64(), rhs: __v_187.as_canonical_u64(), msg: None });
-    }
-    let __v_188: G = G::from_u64(1);
-    let __v_189: G = G::from_u64(1);
-    let __v_190: G = { let __values: [G; 10] = [__v_188, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_191: G = { let __values: [G; 10] = [__v_160, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_190]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_192: G = { let __values: [G; 10] = [__v_132, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_191]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_193: G = { let __values: [G; 10] = [__v_104, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_192]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_194: G = { let __values: [G; 10] = [__v_76, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_193]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    if (__v_182 != __v_183) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_182.as_canonical_u64(), rhs: __v_183.as_canonical_u64(), msg: None });
+    }
+    let __v_184: G = G::from_u64(1);
+    let __v_185: G = G::from_u64(1);
+    let __v_186: G = { let __values: [G; 10] = [__v_184, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_187: G = G::from_u64(0);
+    let __v_188: G = { let __values: [G; 10] = [__v_187, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_186]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_189: G = G::from_u64(0);
+    let __v_190: G = { let __values: [G; 10] = [__v_189, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_188]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_191: G = G::from_u64(0);
+    let __v_192: G = { let __values: [G; 10] = [__v_191, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_190]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_193: G = G::from_u64(0);
+    let __v_194: G = { let __values: [G; 10] = [__v_193, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_192]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_146] = [__v_194];
     record.function_queries[146].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -13958,291 +13958,291 @@ fn aiur_fn_148(
               0u64 => {
                 match __v_10.as_canonical_u64() {
                   _ => {
+                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                    let __v_20: G = __r_arr[0];
+                    let __v_21: G = G::from_u64(1);
+                    if (__v_20 != __v_21) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: None });
+                    }
                     let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_5.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-                    let __v_20: G = __loaded[0];
-                    let __v_21: G = __loaded[1];
-                    let __v_22: G = __loaded[2];
-                    match __v_20.as_canonical_u64() {
+                    let __v_22: G = __loaded[0];
+                    let __v_23: G = __loaded[1];
+                    let __v_24: G = __loaded[2];
+                    match __v_22.as_canonical_u64() {
                       0u64 => {
-                        let __v_23: G = G::from_u64(1);
-                        let __v_24: G = (__v_6 - __v_23);
-                        let __v_25: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_11, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-                        let __v_26: G = __r_arr[0];
-                        let __v_27: G = __r_arr[1];
-                        let __mc_out___mc_0: [G; 4] = '__mc_0: { match __v_21.as_canonical_u64() {
+                        let __v_25: G = G::from_u64(1);
+                        let __v_26: G = (__v_6 - __v_25);
+                        let __v_27: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_11, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+                        let __v_28: G = __r_arr[0];
+                        let __v_29: G = __r_arr[1];
+                        let __mc_out___mc_0: [G; 4] = '__mc_0: { match __v_23.as_canonical_u64() {
   0u64 => {
-    break '__mc_0 [__v_0, __v_1, __v_26, __v_27];
+    break '__mc_0 [__v_0, __v_1, __v_28, __v_29];
   },
   _ => {
-    break '__mc_0 [__v_26, __v_27, __v_0, __v_1];
+    break '__mc_0 [__v_28, __v_29, __v_0, __v_1];
   },
 }
  };
-                        let __v_28: G = __mc_out___mc_0[0];
-                        let __v_29: G = __mc_out___mc_0[1];
-                        let __v_30: G = __mc_out___mc_0[2];
-                        let __v_31: G = __mc_out___mc_0[3];
-                        let __r_arr: [G; OUT_121] = { let __args: [G; IN_121] = [__v_22, __v_24, __v_14, __v_15, __v_28, __v_29, __v_30, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[121].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[121].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[121].bump_multiplicity(__i); } let __ret: [G; OUT_121] = unsafe { *(record.function_queries[121].output_at(__i).as_ptr() as *const [G; OUT_121]) }; __ret }, _ => aiur_fn_121(__args, record, io_buffer, __cu)? } };
-                        let __v_32: G = __r_arr[0];
-                        let __v_33: G = __r_arr[1];
-                        let __r_arr: [G; OUT_147] = { let __args: [G; IN_147] = [__v_32, __v_33, __v_24, __v_14, __v_15, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[147].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[147].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[147].bump_multiplicity(__i); } let __ret: [G; OUT_147] = unsafe { *(record.function_queries[147].output_at(__i).as_ptr() as *const [G; OUT_147]) }; __ret }, _ => aiur_fn_147(__args, record, io_buffer, __cu)? } };
+                        let __v_30: G = __mc_out___mc_0[0];
+                        let __v_31: G = __mc_out___mc_0[1];
+                        let __v_32: G = __mc_out___mc_0[2];
+                        let __v_33: G = __mc_out___mc_0[3];
+                        let __r_arr: [G; OUT_121] = { let __args: [G; IN_121] = [__v_24, __v_26, __v_14, __v_15, __v_30, __v_31, __v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[121].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[121].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[121].bump_multiplicity(__i); } let __ret: [G; OUT_121] = unsafe { *(record.function_queries[121].output_at(__i).as_ptr() as *const [G; OUT_121]) }; __ret }, _ => aiur_fn_121(__args, record, io_buffer, __cu)? } };
                         let __v_34: G = __r_arr[0];
                         let __v_35: G = __r_arr[1];
-                        let __v_36: G = __r_arr[2];
-                        let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_34, __v_35, __v_16, __v_19, __v_12, __v_22, __v_24, __v_36, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
-                        let __v_37: G = __r_arr[0];
-                        let __v_38: G = __r_arr[1];
-                        let __v_39: G = __r_arr[2];
-                        let __gb: [u8; 8] = __v_28.as_canonical_u64().to_le_bytes();
-                        let __v_40: G = G::from_u8(__gb[0]);
-                        let __v_41: G = G::from_u8(__gb[1]);
-                        let __v_42: G = G::from_u8(__gb[2]);
-                        let __v_43: G = G::from_u8(__gb[3]);
-                        let __v_44: G = G::from_u8(__gb[4]);
-                        let __v_45: G = G::from_u8(__gb[5]);
-                        let __v_46: G = G::from_u8(__gb[6]);
-                        let __v_47: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_40; let __vj = __v_41; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __r_arr: [G; OUT_147] = { let __args: [G; IN_147] = [__v_34, __v_35, __v_26, __v_14, __v_15, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[147].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[147].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[147].bump_multiplicity(__i); } let __ret: [G; OUT_147] = unsafe { *(record.function_queries[147].output_at(__i).as_ptr() as *const [G; OUT_147]) }; __ret }, _ => aiur_fn_147(__args, record, io_buffer, __cu)? } };
+                        let __v_36: G = __r_arr[0];
+                        let __v_37: G = __r_arr[1];
+                        let __v_38: G = __r_arr[2];
+                        let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_36, __v_37, __v_16, __v_19, __v_12, __v_24, __v_26, __v_38, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
+                        let __v_39: G = __r_arr[0];
+                        let __v_40: G = __r_arr[1];
+                        let __v_41: G = __r_arr[2];
+                        let __gb: [u8; 8] = __v_30.as_canonical_u64().to_le_bytes();
+                        let __v_42: G = G::from_u8(__gb[0]);
+                        let __v_43: G = G::from_u8(__gb[1]);
+                        let __v_44: G = G::from_u8(__gb[2]);
+                        let __v_45: G = G::from_u8(__gb[3]);
+                        let __v_46: G = G::from_u8(__gb[4]);
+                        let __v_47: G = G::from_u8(__gb[5]);
+                        let __v_48: G = G::from_u8(__gb[6]);
+                        let __v_49: G = G::from_u8(__gb[7]);
                         if !unconstrained { let __vi = __v_42; let __vj = __v_43; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
                         if !unconstrained { let __vi = __v_44; let __vj = __v_45; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
                         if !unconstrained { let __vi = __v_46; let __vj = __v_47; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_48: G = G::from_u64(1020);
-                        let __v_49: G = (__v_47 - __v_48);
-                        let __v_50: G = (__v_46 + __v_49);
-                        let __v_51: G = (__v_45 + __v_50);
-                        let __v_52: G = (__v_44 + __v_51);
-                        let __v_53: G = G::from_bool((__v_52 == G::ZERO));
-                        let __v_54: G = (__v_42 + __v_43);
-                        let __v_55: G = (__v_41 + __v_54);
-                        let __v_56: G = (__v_40 + __v_55);
-                        let __v_57: G = G::from_bool((__v_56 == G::ZERO));
-                        let __gb: [u8; 8] = __v_29.as_canonical_u64().to_le_bytes();
-                        let __v_58: G = G::from_u8(__gb[0]);
-                        let __v_59: G = G::from_u8(__gb[1]);
-                        let __v_60: G = G::from_u8(__gb[2]);
-                        let __v_61: G = G::from_u8(__gb[3]);
-                        let __v_62: G = G::from_u8(__gb[4]);
-                        let __v_63: G = G::from_u8(__gb[5]);
-                        let __v_64: G = G::from_u8(__gb[6]);
-                        let __v_65: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_58; let __vj = __v_59; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_60; let __vj = __v_61; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_62; let __vj = __v_63; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_64; let __vj = __v_65; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_66: G = G::from_u64(1020);
-                        let __v_67: G = (__v_65 - __v_66);
-                        let __v_68: G = (__v_64 + __v_67);
-                        let __v_69: G = (__v_63 + __v_68);
-                        let __v_70: G = (__v_62 + __v_69);
-                        let __v_71: G = G::from_bool((__v_70 == G::ZERO));
-                        let __v_72: G = (__v_60 + __v_61);
-                        let __v_73: G = (__v_59 + __v_72);
-                        let __v_74: G = (__v_58 + __v_73);
-                        let __v_75: G = G::from_bool((__v_74 == G::ZERO));
-                        let __gb: [u8; 8] = __v_30.as_canonical_u64().to_le_bytes();
-                        let __v_76: G = G::from_u8(__gb[0]);
-                        let __v_77: G = G::from_u8(__gb[1]);
-                        let __v_78: G = G::from_u8(__gb[2]);
-                        let __v_79: G = G::from_u8(__gb[3]);
-                        let __v_80: G = G::from_u8(__gb[4]);
-                        let __v_81: G = G::from_u8(__gb[5]);
-                        let __v_82: G = G::from_u8(__gb[6]);
-                        let __v_83: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_76; let __vj = __v_77; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_78; let __vj = __v_79; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_80; let __vj = __v_81; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_82; let __vj = __v_83; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_84: G = G::from_u64(1020);
-                        let __v_85: G = (__v_83 - __v_84);
-                        let __v_86: G = (__v_82 + __v_85);
-                        let __v_87: G = (__v_81 + __v_86);
-                        let __v_88: G = (__v_80 + __v_87);
-                        let __v_89: G = G::from_bool((__v_88 == G::ZERO));
-                        let __v_90: G = (__v_78 + __v_79);
-                        let __v_91: G = (__v_77 + __v_90);
-                        let __v_92: G = (__v_76 + __v_91);
-                        let __v_93: G = G::from_bool((__v_92 == G::ZERO));
-                        let __gb: [u8; 8] = __v_31.as_canonical_u64().to_le_bytes();
-                        let __v_94: G = G::from_u8(__gb[0]);
-                        let __v_95: G = G::from_u8(__gb[1]);
-                        let __v_96: G = G::from_u8(__gb[2]);
-                        let __v_97: G = G::from_u8(__gb[3]);
-                        let __v_98: G = G::from_u8(__gb[4]);
-                        let __v_99: G = G::from_u8(__gb[5]);
-                        let __v_100: G = G::from_u8(__gb[6]);
-                        let __v_101: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_94; let __vj = __v_95; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_96; let __vj = __v_97; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_98; let __vj = __v_99; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_100; let __vj = __v_101; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_102: G = G::from_u64(1020);
-                        let __v_103: G = (__v_101 - __v_102);
-                        let __v_104: G = (__v_100 + __v_103);
-                        let __v_105: G = (__v_99 + __v_104);
-                        let __v_106: G = (__v_98 + __v_105);
-                        let __v_107: G = G::from_bool((__v_106 == G::ZERO));
-                        let __v_108: G = (__v_96 + __v_97);
-                        let __v_109: G = (__v_95 + __v_108);
-                        let __v_110: G = (__v_94 + __v_109);
-                        let __v_111: G = G::from_bool((__v_110 == G::ZERO));
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_112: G = __r_arr[0];
-                        let __v_113: G = G::from_u64(1);
-                        if (__v_112 != __v_113) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_112.as_canonical_u64(), rhs: __v_113.as_canonical_u64(), msg: None });
-                        }
-                        let __v_114: G = G::from_u64(0);
-                        let __v_115: G = G::from_u64(0);
-                        let __v_116: G = G::from_u64(256);
-                        let __v_117: G = (__v_116 * __v_41);
-                        let __v_118: G = G::from_u64(65536);
-                        let __v_119: G = (__v_118 * __v_42);
-                        let __v_120: G = G::from_u64(16777216);
-                        let __v_121: G = (__v_120 * __v_43);
-                        let __v_122: G = G::from_u64(4294967296);
-                        let __v_123: G = (__v_122 * __v_44);
-                        let __v_124: G = G::from_u64(1099511627776);
-                        let __v_125: G = (__v_124 * __v_45);
-                        let __v_126: G = G::from_u64(281474976710656);
-                        let __v_127: G = (__v_126 * __v_46);
-                        let __v_128: G = G::from_u64(72057594037927936);
-                        let __v_129: G = (__v_128 * __v_47);
-                        let __v_130: G = (__v_127 + __v_129);
-                        let __v_131: G = (__v_125 + __v_130);
-                        let __v_132: G = (__v_123 + __v_131);
-                        let __v_133: G = (__v_121 + __v_132);
-                        let __v_134: G = (__v_119 + __v_133);
-                        let __v_135: G = (__v_117 + __v_134);
-                        let __v_136: G = (__v_40 + __v_135);
-                        if (__v_136 != __v_28) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_136.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: None });
+                        if !unconstrained { let __vi = __v_48; let __vj = __v_49; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_50: G = G::from_u64(256);
+                        let __v_51: G = (__v_50 * __v_43);
+                        let __v_52: G = G::from_u64(65536);
+                        let __v_53: G = (__v_52 * __v_44);
+                        let __v_54: G = G::from_u64(16777216);
+                        let __v_55: G = (__v_54 * __v_45);
+                        let __v_56: G = G::from_u64(4294967296);
+                        let __v_57: G = (__v_56 * __v_46);
+                        let __v_58: G = G::from_u64(1099511627776);
+                        let __v_59: G = (__v_58 * __v_47);
+                        let __v_60: G = G::from_u64(281474976710656);
+                        let __v_61: G = (__v_60 * __v_48);
+                        let __v_62: G = G::from_u64(72057594037927936);
+                        let __v_63: G = (__v_62 * __v_49);
+                        let __v_64: G = (__v_61 + __v_63);
+                        let __v_65: G = (__v_59 + __v_64);
+                        let __v_66: G = (__v_57 + __v_65);
+                        let __v_67: G = (__v_55 + __v_66);
+                        let __v_68: G = (__v_53 + __v_67);
+                        let __v_69: G = (__v_51 + __v_68);
+                        let __v_70: G = (__v_42 + __v_69);
+                        if (__v_70 != __v_30) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_70.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: None });
                         }
-                        let __v_137: G = G::from_u64(1);
-                        let __v_138: G = G::from_u64(1);
-                        let __v_139: G = (__v_138 - __v_57);
-                        let __v_140: G = (__v_53 * __v_139);
-                        let __v_141: G = (__v_137 - __v_140);
-                        let __v_142: G = G::from_u64(1);
-                        if (__v_141 != __v_142) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_142.as_canonical_u64(), msg: None });
+                        let __v_71: G = G::from_u64(1020);
+                        let __v_72: G = (__v_49 - __v_71);
+                        let __v_73: G = (__v_48 + __v_72);
+                        let __v_74: G = (__v_47 + __v_73);
+                        let __v_75: G = (__v_46 + __v_74);
+                        let __v_76: G = G::from_bool((__v_75 == G::ZERO));
+                        let __v_77: G = (__v_44 + __v_45);
+                        let __v_78: G = (__v_43 + __v_77);
+                        let __v_79: G = (__v_42 + __v_78);
+                        let __v_80: G = G::from_bool((__v_79 == G::ZERO));
+                        let __v_81: G = G::from_u64(1);
+                        let __v_82: G = G::from_u64(1);
+                        let __v_83: G = (__v_82 - __v_80);
+                        let __v_84: G = (__v_76 * __v_83);
+                        let __v_85: G = (__v_81 - __v_84);
+                        let __v_86: G = G::from_u64(1);
+                        if (__v_85 != __v_86) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_86.as_canonical_u64(), msg: None });
                         }
-                        let __v_143: G = G::from_u64(0);
-                        let __v_144: G = G::from_u64(256);
-                        let __v_145: G = (__v_144 * __v_59);
-                        let __v_146: G = G::from_u64(65536);
-                        let __v_147: G = (__v_146 * __v_60);
-                        let __v_148: G = G::from_u64(16777216);
-                        let __v_149: G = (__v_148 * __v_61);
-                        let __v_150: G = G::from_u64(4294967296);
-                        let __v_151: G = (__v_150 * __v_62);
-                        let __v_152: G = G::from_u64(1099511627776);
-                        let __v_153: G = (__v_152 * __v_63);
-                        let __v_154: G = G::from_u64(281474976710656);
-                        let __v_155: G = (__v_154 * __v_64);
-                        let __v_156: G = G::from_u64(72057594037927936);
-                        let __v_157: G = (__v_156 * __v_65);
-                        let __v_158: G = (__v_155 + __v_157);
-                        let __v_159: G = (__v_153 + __v_158);
-                        let __v_160: G = (__v_151 + __v_159);
-                        let __v_161: G = (__v_149 + __v_160);
-                        let __v_162: G = (__v_147 + __v_161);
-                        let __v_163: G = (__v_145 + __v_162);
-                        let __v_164: G = (__v_58 + __v_163);
-                        if (__v_164 != __v_29) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_164.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: None });
+                        let __gb: [u8; 8] = __v_31.as_canonical_u64().to_le_bytes();
+                        let __v_87: G = G::from_u8(__gb[0]);
+                        let __v_88: G = G::from_u8(__gb[1]);
+                        let __v_89: G = G::from_u8(__gb[2]);
+                        let __v_90: G = G::from_u8(__gb[3]);
+                        let __v_91: G = G::from_u8(__gb[4]);
+                        let __v_92: G = G::from_u8(__gb[5]);
+                        let __v_93: G = G::from_u8(__gb[6]);
+                        let __v_94: G = G::from_u8(__gb[7]);
+                        if !unconstrained { let __vi = __v_87; let __vj = __v_88; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_89; let __vj = __v_90; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_91; let __vj = __v_92; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_93; let __vj = __v_94; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_95: G = G::from_u64(256);
+                        let __v_96: G = (__v_95 * __v_88);
+                        let __v_97: G = G::from_u64(65536);
+                        let __v_98: G = (__v_97 * __v_89);
+                        let __v_99: G = G::from_u64(16777216);
+                        let __v_100: G = (__v_99 * __v_90);
+                        let __v_101: G = G::from_u64(4294967296);
+                        let __v_102: G = (__v_101 * __v_91);
+                        let __v_103: G = G::from_u64(1099511627776);
+                        let __v_104: G = (__v_103 * __v_92);
+                        let __v_105: G = G::from_u64(281474976710656);
+                        let __v_106: G = (__v_105 * __v_93);
+                        let __v_107: G = G::from_u64(72057594037927936);
+                        let __v_108: G = (__v_107 * __v_94);
+                        let __v_109: G = (__v_106 + __v_108);
+                        let __v_110: G = (__v_104 + __v_109);
+                        let __v_111: G = (__v_102 + __v_110);
+                        let __v_112: G = (__v_100 + __v_111);
+                        let __v_113: G = (__v_98 + __v_112);
+                        let __v_114: G = (__v_96 + __v_113);
+                        let __v_115: G = (__v_87 + __v_114);
+                        if (__v_115 != __v_31) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_115.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
                         }
-                        let __v_165: G = G::from_u64(1);
-                        let __v_166: G = G::from_u64(1);
-                        let __v_167: G = (__v_166 - __v_75);
-                        let __v_168: G = (__v_71 * __v_167);
-                        let __v_169: G = (__v_165 - __v_168);
-                        let __v_170: G = G::from_u64(1);
-                        if (__v_169 != __v_170) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_169.as_canonical_u64(), rhs: __v_170.as_canonical_u64(), msg: None });
+                        let __v_116: G = G::from_u64(1020);
+                        let __v_117: G = (__v_94 - __v_116);
+                        let __v_118: G = (__v_93 + __v_117);
+                        let __v_119: G = (__v_92 + __v_118);
+                        let __v_120: G = (__v_91 + __v_119);
+                        let __v_121: G = G::from_bool((__v_120 == G::ZERO));
+                        let __v_122: G = (__v_89 + __v_90);
+                        let __v_123: G = (__v_88 + __v_122);
+                        let __v_124: G = (__v_87 + __v_123);
+                        let __v_125: G = G::from_bool((__v_124 == G::ZERO));
+                        let __v_126: G = G::from_u64(1);
+                        let __v_127: G = G::from_u64(1);
+                        let __v_128: G = (__v_127 - __v_125);
+                        let __v_129: G = (__v_121 * __v_128);
+                        let __v_130: G = (__v_126 - __v_129);
+                        let __v_131: G = G::from_u64(1);
+                        if (__v_130 != __v_131) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
                         }
-                        let __v_171: G = G::from_u64(0);
-                        let __v_172: G = G::from_u64(256);
-                        let __v_173: G = (__v_172 * __v_77);
-                        let __v_174: G = G::from_u64(65536);
-                        let __v_175: G = (__v_174 * __v_78);
-                        let __v_176: G = G::from_u64(16777216);
-                        let __v_177: G = (__v_176 * __v_79);
-                        let __v_178: G = G::from_u64(4294967296);
-                        let __v_179: G = (__v_178 * __v_80);
-                        let __v_180: G = G::from_u64(1099511627776);
-                        let __v_181: G = (__v_180 * __v_81);
-                        let __v_182: G = G::from_u64(281474976710656);
-                        let __v_183: G = (__v_182 * __v_82);
-                        let __v_184: G = G::from_u64(72057594037927936);
-                        let __v_185: G = (__v_184 * __v_83);
-                        let __v_186: G = (__v_183 + __v_185);
-                        let __v_187: G = (__v_181 + __v_186);
-                        let __v_188: G = (__v_179 + __v_187);
-                        let __v_189: G = (__v_177 + __v_188);
-                        let __v_190: G = (__v_175 + __v_189);
-                        let __v_191: G = (__v_173 + __v_190);
-                        let __v_192: G = (__v_76 + __v_191);
-                        if (__v_192 != __v_30) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_192.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: None });
+                        let __gb: [u8; 8] = __v_32.as_canonical_u64().to_le_bytes();
+                        let __v_132: G = G::from_u8(__gb[0]);
+                        let __v_133: G = G::from_u8(__gb[1]);
+                        let __v_134: G = G::from_u8(__gb[2]);
+                        let __v_135: G = G::from_u8(__gb[3]);
+                        let __v_136: G = G::from_u8(__gb[4]);
+                        let __v_137: G = G::from_u8(__gb[5]);
+                        let __v_138: G = G::from_u8(__gb[6]);
+                        let __v_139: G = G::from_u8(__gb[7]);
+                        if !unconstrained { let __vi = __v_132; let __vj = __v_133; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_134; let __vj = __v_135; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_136; let __vj = __v_137; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_138; let __vj = __v_139; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_140: G = G::from_u64(256);
+                        let __v_141: G = (__v_140 * __v_133);
+                        let __v_142: G = G::from_u64(65536);
+                        let __v_143: G = (__v_142 * __v_134);
+                        let __v_144: G = G::from_u64(16777216);
+                        let __v_145: G = (__v_144 * __v_135);
+                        let __v_146: G = G::from_u64(4294967296);
+                        let __v_147: G = (__v_146 * __v_136);
+                        let __v_148: G = G::from_u64(1099511627776);
+                        let __v_149: G = (__v_148 * __v_137);
+                        let __v_150: G = G::from_u64(281474976710656);
+                        let __v_151: G = (__v_150 * __v_138);
+                        let __v_152: G = G::from_u64(72057594037927936);
+                        let __v_153: G = (__v_152 * __v_139);
+                        let __v_154: G = (__v_151 + __v_153);
+                        let __v_155: G = (__v_149 + __v_154);
+                        let __v_156: G = (__v_147 + __v_155);
+                        let __v_157: G = (__v_145 + __v_156);
+                        let __v_158: G = (__v_143 + __v_157);
+                        let __v_159: G = (__v_141 + __v_158);
+                        let __v_160: G = (__v_132 + __v_159);
+                        if (__v_160 != __v_32) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_160.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: None });
                         }
-                        let __v_193: G = G::from_u64(1);
-                        let __v_194: G = G::from_u64(1);
-                        let __v_195: G = (__v_194 - __v_93);
-                        let __v_196: G = (__v_89 * __v_195);
-                        let __v_197: G = (__v_193 - __v_196);
-                        let __v_198: G = G::from_u64(1);
-                        if (__v_197 != __v_198) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_197.as_canonical_u64(), rhs: __v_198.as_canonical_u64(), msg: None });
+                        let __v_161: G = G::from_u64(1020);
+                        let __v_162: G = (__v_139 - __v_161);
+                        let __v_163: G = (__v_138 + __v_162);
+                        let __v_164: G = (__v_137 + __v_163);
+                        let __v_165: G = (__v_136 + __v_164);
+                        let __v_166: G = G::from_bool((__v_165 == G::ZERO));
+                        let __v_167: G = (__v_134 + __v_135);
+                        let __v_168: G = (__v_133 + __v_167);
+                        let __v_169: G = (__v_132 + __v_168);
+                        let __v_170: G = G::from_bool((__v_169 == G::ZERO));
+                        let __v_171: G = G::from_u64(1);
+                        let __v_172: G = G::from_u64(1);
+                        let __v_173: G = (__v_172 - __v_170);
+                        let __v_174: G = (__v_166 * __v_173);
+                        let __v_175: G = (__v_171 - __v_174);
+                        let __v_176: G = G::from_u64(1);
+                        if (__v_175 != __v_176) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_175.as_canonical_u64(), rhs: __v_176.as_canonical_u64(), msg: None });
                         }
-                        let __v_199: G = G::from_u64(0);
-                        let __v_200: G = G::from_u64(256);
-                        let __v_201: G = (__v_200 * __v_95);
-                        let __v_202: G = G::from_u64(65536);
-                        let __v_203: G = (__v_202 * __v_96);
-                        let __v_204: G = G::from_u64(16777216);
-                        let __v_205: G = (__v_204 * __v_97);
-                        let __v_206: G = G::from_u64(4294967296);
-                        let __v_207: G = (__v_206 * __v_98);
-                        let __v_208: G = G::from_u64(1099511627776);
-                        let __v_209: G = (__v_208 * __v_99);
-                        let __v_210: G = G::from_u64(281474976710656);
-                        let __v_211: G = (__v_210 * __v_100);
-                        let __v_212: G = G::from_u64(72057594037927936);
-                        let __v_213: G = (__v_212 * __v_101);
-                        let __v_214: G = (__v_211 + __v_213);
-                        let __v_215: G = (__v_209 + __v_214);
-                        let __v_216: G = (__v_207 + __v_215);
-                        let __v_217: G = (__v_205 + __v_216);
-                        let __v_218: G = (__v_203 + __v_217);
-                        let __v_219: G = (__v_201 + __v_218);
-                        let __v_220: G = (__v_94 + __v_219);
-                        if (__v_220 != __v_31) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_220.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
+                        let __gb: [u8; 8] = __v_33.as_canonical_u64().to_le_bytes();
+                        let __v_177: G = G::from_u8(__gb[0]);
+                        let __v_178: G = G::from_u8(__gb[1]);
+                        let __v_179: G = G::from_u8(__gb[2]);
+                        let __v_180: G = G::from_u8(__gb[3]);
+                        let __v_181: G = G::from_u8(__gb[4]);
+                        let __v_182: G = G::from_u8(__gb[5]);
+                        let __v_183: G = G::from_u8(__gb[6]);
+                        let __v_184: G = G::from_u8(__gb[7]);
+                        if !unconstrained { let __vi = __v_177; let __vj = __v_178; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_179; let __vj = __v_180; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_181; let __vj = __v_182; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_183; let __vj = __v_184; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_185: G = G::from_u64(256);
+                        let __v_186: G = (__v_185 * __v_178);
+                        let __v_187: G = G::from_u64(65536);
+                        let __v_188: G = (__v_187 * __v_179);
+                        let __v_189: G = G::from_u64(16777216);
+                        let __v_190: G = (__v_189 * __v_180);
+                        let __v_191: G = G::from_u64(4294967296);
+                        let __v_192: G = (__v_191 * __v_181);
+                        let __v_193: G = G::from_u64(1099511627776);
+                        let __v_194: G = (__v_193 * __v_182);
+                        let __v_195: G = G::from_u64(281474976710656);
+                        let __v_196: G = (__v_195 * __v_183);
+                        let __v_197: G = G::from_u64(72057594037927936);
+                        let __v_198: G = (__v_197 * __v_184);
+                        let __v_199: G = (__v_196 + __v_198);
+                        let __v_200: G = (__v_194 + __v_199);
+                        let __v_201: G = (__v_192 + __v_200);
+                        let __v_202: G = (__v_190 + __v_201);
+                        let __v_203: G = (__v_188 + __v_202);
+                        let __v_204: G = (__v_186 + __v_203);
+                        let __v_205: G = (__v_177 + __v_204);
+                        if (__v_205 != __v_33) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_205.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: None });
                         }
+                        let __v_206: G = G::from_u64(1020);
+                        let __v_207: G = (__v_184 - __v_206);
+                        let __v_208: G = (__v_183 + __v_207);
+                        let __v_209: G = (__v_182 + __v_208);
+                        let __v_210: G = (__v_181 + __v_209);
+                        let __v_211: G = G::from_bool((__v_210 == G::ZERO));
+                        let __v_212: G = (__v_179 + __v_180);
+                        let __v_213: G = (__v_178 + __v_212);
+                        let __v_214: G = (__v_177 + __v_213);
+                        let __v_215: G = G::from_bool((__v_214 == G::ZERO));
+                        let __v_216: G = G::from_u64(1);
+                        let __v_217: G = G::from_u64(1);
+                        let __v_218: G = (__v_217 - __v_215);
+                        let __v_219: G = (__v_211 * __v_218);
+                        let __v_220: G = (__v_216 - __v_219);
                         let __v_221: G = G::from_u64(1);
-                        let __v_222: G = G::from_u64(1);
-                        let __v_223: G = (__v_222 - __v_111);
-                        let __v_224: G = (__v_107 * __v_223);
-                        let __v_225: G = (__v_221 - __v_224);
-                        let __v_226: G = G::from_u64(1);
-                        if (__v_225 != __v_226) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_225.as_canonical_u64(), rhs: __v_226.as_canonical_u64(), msg: None });
+                        if (__v_220 != __v_221) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_220.as_canonical_u64(), rhs: __v_221.as_canonical_u64(), msg: None });
                         }
-                        let __v_227: G = G::from_u64(1);
-                        let __v_228: G = G::from_u64(1);
-                        let __v_229: G = { let __values: [G; 10] = [__v_227, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_230: G = { let __values: [G; 10] = [__v_199, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_229]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_231: G = { let __values: [G; 10] = [__v_171, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_230]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_232: G = { let __values: [G; 10] = [__v_143, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_231]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_233: G = { let __values: [G; 10] = [__v_115, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_232]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_234: G = { let __values: [G; 3] = [__v_114, __v_233, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __ret: [G; OUT_148] = [__v_37, __v_38, __v_234];
+                        let __v_222: G = G::from_u64(1);
+                        let __v_223: G = G::from_u64(1);
+                        let __v_224: G = { let __values: [G; 10] = [__v_222, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_225: G = G::from_u64(0);
+                        let __v_226: G = { let __values: [G; 10] = [__v_225, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_224]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_227: G = G::from_u64(0);
+                        let __v_228: G = { let __values: [G; 10] = [__v_227, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_226]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_229: G = G::from_u64(0);
+                        let __v_230: G = { let __values: [G; 10] = [__v_229, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_228]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_231: G = G::from_u64(0);
+                        let __v_232: G = { let __values: [G; 10] = [__v_231, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_230]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_233: G = G::from_u64(0);
+                        let __v_234: G = { let __values: [G; 3] = [__v_233, __v_232, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __ret: [G; OUT_148] = [__v_39, __v_40, __v_234];
                         record.function_queries[148].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
                       },
                       _ => {
-                        return Err(ExecError::MatchNoCase(__v_20.as_canonical_u64()));
+                        return Err(ExecError::MatchNoCase(__v_22.as_canonical_u64()));
                       },
                     }
                   },
@@ -14302,126 +14302,126 @@ fn aiur_fn_149(
     let __v_24: G = inp[24];
     match __v_1.as_canonical_u64() {
       _ => {
-        let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_15, __v_19, __v_18, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
         let __v_25: G = __r_arr[0];
-        let __v_26: G = G::from_u64(0);
-        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_15, __v_19, __v_18, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
-        let __v_27: G = __r_arr[0];
-        let __v_28: G = G::from_u64(0);
-        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_26: G = (__v_25 - __v_24);
+        let __v_27: G = G::from_bool((__v_26 == G::ZERO));
+        let __v_28: G = G::from_u64(1);
+        if (__v_27 != __v_28) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_27.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
         let __v_29: G = __r_arr[0];
-        match __v_29.as_canonical_u64() {
+        let __v_30: G = G::from_u64(3);
+        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+        let __v_31: G = __r_arr[0];
+        let __v_32: G = (__v_30 + __v_31);
+        let __v_33: G = (__v_29 - __v_32);
+        let __v_34: G = G::from_bool((__v_33 == G::ZERO));
+        let __v_35: G = G::from_u64(1);
+        if (__v_34 != __v_35) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_15, __v_19, __v_18, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
+        let __v_36: G = __r_arr[0];
+        let __v_37: G = G::from_u64(0);
+        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_15, __v_19, __v_18, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
+        let __v_38: G = __r_arr[0];
+        let __v_39: G = G::from_u64(0);
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_40: G = __r_arr[0];
+        match __v_40.as_canonical_u64() {
           _ => {
-            let __v_30: G = G::from_u64(0);
-            let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_25, __v_0, __v_20, __v_19, __v_30, __v_18, __v_15, __v_16, __v_17, __v_29, __v_5, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
-            let __v_31: G = __r_arr[0];
-            let __v_32: G = G::from_u64(1);
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_33: G = __r_arr[0];
-            match __v_33.as_canonical_u64() {
+            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+            let __v_41: G = __r_arr[0];
+            let __v_42: G = (__v_41 - __v_18);
+            let __v_43: G = G::from_bool((__v_42 == G::ZERO));
+            let __v_44: G = G::from_u64(1);
+            if (__v_43 != __v_44) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: None });
+            }
+            let __v_45: G = G::from_u64(0);
+            let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_36, __v_0, __v_20, __v_19, __v_45, __v_18, __v_15, __v_16, __v_17, __v_40, __v_5, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
+            let __v_46: G = __r_arr[0];
+            let __v_47: G = G::from_u64(1);
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1, __v_47]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_48: G = __r_arr[0];
+            match __v_48.as_canonical_u64() {
               _ => {
-                let __v_34: G = G::from_u64(0);
-                let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_31, __v_0, __v_20, __v_19, __v_34, __v_18, __v_15, __v_16, __v_17, __v_33, __v_6, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
-                let __v_35: G = __r_arr[0];
-                let __v_36: G = G::from_u64(2);
-                let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                let __v_37: G = __r_arr[0];
-                match __v_37.as_canonical_u64() {
+                let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                let __v_49: G = __r_arr[0];
+                let __v_50: G = (__v_49 - __v_18);
+                let __v_51: G = G::from_bool((__v_50 == G::ZERO));
+                let __v_52: G = G::from_u64(1);
+                if (__v_51 != __v_52) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_51.as_canonical_u64(), rhs: __v_52.as_canonical_u64(), msg: None });
+                }
+                let __v_53: G = G::from_u64(0);
+                let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_46, __v_0, __v_20, __v_19, __v_53, __v_18, __v_15, __v_16, __v_17, __v_48, __v_6, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
+                let __v_54: G = __r_arr[0];
+                let __v_55: G = G::from_u64(2);
+                let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                let __v_56: G = __r_arr[0];
+                match __v_56.as_canonical_u64() {
                   _ => {
-                    let __v_38: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_139] = { let __args: [G; IN_139] = [__v_35, __v_0, __v_20, __v_19, __v_38, __v_18, __v_15, __v_16, __v_17, __v_37, __v_7, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[139].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[139].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[139].bump_multiplicity(__i); } let __ret: [G; OUT_139] = unsafe { *(record.function_queries[139].output_at(__i).as_ptr() as *const [G; OUT_139]) }; __ret }, _ => aiur_fn_139(__args, record, io_buffer, __cu)? } };
-                    let __v_39: G = __r_arr[0];
-                    let __r_arr: [G; OUT_141] = { let __args: [G; IN_141] = [__v_39, __v_1, __v_13, __v_8, __v_9, __v_14, __v_15, __v_18, __v_0, __v_20, __v_19, __v_16, __v_17, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[141].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[141].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[141].bump_multiplicity(__i); } let __ret: [G; OUT_141] = unsafe { *(record.function_queries[141].output_at(__i).as_ptr() as *const [G; OUT_141]) }; __ret }, _ => aiur_fn_141(__args, record, io_buffer, __cu)? } };
-                    let __v_40: G = __r_arr[0];
-                    let __r_arr: [G; OUT_134] = { let __args: [G; IN_134] = [__v_40, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[134].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[134].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[134].bump_multiplicity(__i); } let __ret: [G; OUT_134] = unsafe { *(record.function_queries[134].output_at(__i).as_ptr() as *const [G; OUT_134]) }; __ret }, _ => aiur_fn_134(__args, record, io_buffer, __cu)? } };
-                    let __v_41: G = __r_arr[0];
-                    let __loaded: [G; 7] = { let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; let __ptr_u64 = __v_40.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 7 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 7] = __args[..7].try_into().unwrap(); __arr };
-                    let __v_42: G = __loaded[0];
-                    let __v_43: G = __loaded[1];
-                    let __v_44: G = __loaded[2];
-                    let __v_45: G = __loaded[3];
-                    let __v_46: G = __loaded[4];
-                    let __v_47: G = __loaded[5];
-                    let __v_48: G = __loaded[6];
-                    match __v_42.as_canonical_u64() {
+                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_56]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                    let __v_57: G = __r_arr[0];
+                    let __v_58: G = (__v_57 - __v_18);
+                    let __v_59: G = G::from_bool((__v_58 == G::ZERO));
+                    let __v_60: G = G::from_u64(1);
+                    if (__v_59 != __v_60) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_59.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
+                    }
+                    let __v_61: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_139] = { let __args: [G; IN_139] = [__v_54, __v_0, __v_20, __v_19, __v_61, __v_18, __v_15, __v_16, __v_17, __v_56, __v_7, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[139].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[139].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[139].bump_multiplicity(__i); } let __ret: [G; OUT_139] = unsafe { *(record.function_queries[139].output_at(__i).as_ptr() as *const [G; OUT_139]) }; __ret }, _ => aiur_fn_139(__args, record, io_buffer, __cu)? } };
+                    let __v_62: G = __r_arr[0];
+                    let __r_arr: [G; OUT_141] = { let __args: [G; IN_141] = [__v_62, __v_1, __v_13, __v_8, __v_9, __v_14, __v_15, __v_18, __v_0, __v_20, __v_19, __v_16, __v_17, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[141].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[141].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[141].bump_multiplicity(__i); } let __ret: [G; OUT_141] = unsafe { *(record.function_queries[141].output_at(__i).as_ptr() as *const [G; OUT_141]) }; __ret }, _ => aiur_fn_141(__args, record, io_buffer, __cu)? } };
+                    let __v_63: G = __r_arr[0];
+                    let __r_arr: [G; OUT_134] = { let __args: [G; IN_134] = [__v_63, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[134].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[134].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[134].bump_multiplicity(__i); } let __ret: [G; OUT_134] = unsafe { *(record.function_queries[134].output_at(__i).as_ptr() as *const [G; OUT_134]) }; __ret }, _ => aiur_fn_134(__args, record, io_buffer, __cu)? } };
+                    let __v_64: G = __r_arr[0];
+                    let __loaded: [G; 7] = { let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; let __ptr_u64 = __v_63.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 7 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 7] = __args[..7].try_into().unwrap(); __arr };
+                    let __v_65: G = __loaded[0];
+                    let __v_66: G = __loaded[1];
+                    let __v_67: G = __loaded[2];
+                    let __v_68: G = __loaded[3];
+                    let __v_69: G = __loaded[4];
+                    let __v_70: G = __loaded[5];
+                    let __v_71: G = __loaded[6];
+                    match __v_65.as_canonical_u64() {
                       0u64 => {
-                        match __v_43.as_canonical_u64() {
+                        match __v_66.as_canonical_u64() {
                           _ => {
-                            let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_46, __v_47, __v_21, __v_22, __v_2, __v_0, __v_20, __v_48, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
-                            let __v_49: G = __r_arr[0];
-                            let __v_50: G = __r_arr[1];
-                            let __v_51: G = __r_arr[2];
-                            let __v_52: G = G::from_u64(0);
-                            let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_23, __v_52]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-                            let __v_53: G = __r_arr[0];
-                            let __v_54: G = __r_arr[1];
-                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                            let __v_55: G = __r_arr[0];
-                            let __v_56: G = (__v_55 - __v_24);
-                            let __v_57: G = G::from_bool((__v_56 == G::ZERO));
-                            let __v_58: G = G::from_u64(1);
-                            if (__v_57 != __v_58) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_58.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_59: G = __r_arr[0];
-                            let __v_60: G = G::from_u64(3);
-                            let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
-                            let __v_61: G = __r_arr[0];
-                            let __v_62: G = (__v_60 + __v_61);
-                            let __v_63: G = (__v_59 - __v_62);
-                            let __v_64: G = G::from_bool((__v_63 == G::ZERO));
-                            let __v_65: G = G::from_u64(1);
-                            if (__v_64 != __v_65) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_64.as_canonical_u64(), rhs: __v_65.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_29]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_66: G = __r_arr[0];
-                            let __v_67: G = (__v_66 - __v_18);
-                            let __v_68: G = G::from_bool((__v_67 == G::ZERO));
-                            let __v_69: G = G::from_u64(1);
-                            if (__v_68 != __v_69) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_68.as_canonical_u64(), rhs: __v_69.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_33]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_70: G = __r_arr[0];
-                            let __v_71: G = (__v_70 - __v_18);
-                            let __v_72: G = G::from_bool((__v_71 == G::ZERO));
-                            let __v_73: G = G::from_u64(1);
-                            if (__v_72 != __v_73) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_72.as_canonical_u64(), rhs: __v_73.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_37]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_74: G = __r_arr[0];
-                            let __v_75: G = (__v_74 - __v_18);
-                            let __v_76: G = G::from_bool((__v_75 == G::ZERO));
-                            let __v_77: G = G::from_u64(1);
-                            if (__v_76 != __v_77) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_77.as_canonical_u64(), msg: None });
-                            }
-                            let __v_78: G = (__v_43 - __v_20);
-                            let __v_79: G = G::from_bool((__v_78 == G::ZERO));
-                            let __v_80: G = G::from_u64(1);
-                            if (__v_79 != __v_80) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
+                            let __v_72: G = (__v_66 - __v_20);
+                            let __v_73: G = G::from_bool((__v_72 == G::ZERO));
+                            let __v_74: G = G::from_u64(1);
+                            if (__v_73 != __v_74) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_73.as_canonical_u64(), rhs: __v_74.as_canonical_u64(), msg: None });
                             }
-                            let __v_81: G = (__v_53 - __v_49);
+                            let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_69, __v_70, __v_21, __v_22, __v_2, __v_0, __v_20, __v_71, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
+                            let __v_75: G = __r_arr[0];
+                            let __v_76: G = __r_arr[1];
+                            let __v_77: G = __r_arr[2];
+                            let __v_78: G = G::from_u64(0);
+                            let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_23, __v_78]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+                            let __v_79: G = __r_arr[0];
+                            let __v_80: G = __r_arr[1];
+                            let __v_81: G = (__v_79 - __v_75);
                             let __v_82: G = G::from_bool((__v_81 == G::ZERO));
-                            let __v_83: G = (__v_54 - __v_50);
+                            let __v_83: G = (__v_80 - __v_76);
                             let __v_84: G = G::from_bool((__v_83 == G::ZERO));
                             let __v_85: G = (__v_82 * __v_84);
                             let __v_86: G = G::from_u64(1);
                             if (__v_85 != __v_86) {
                               return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_86.as_canonical_u64(), msg: None });
                             }
-                            let __ret: [G; OUT_149] = [__v_51];
+                            let __ret: [G; OUT_149] = [__v_77];
                             record.function_queries[149].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                         }
                       },
                       _ => {
-                        return Err(ExecError::MatchNoCase(__v_42.as_canonical_u64()));
+                        return Err(ExecError::MatchNoCase(__v_65.as_canonical_u64()));
                       },
                     }
                   },
@@ -14491,10 +14491,10 @@ fn aiur_fn_150(
         let __v_31: G = __r_arr[2];
         let __r_arr: [G; OUT_149] = { let __args: [G; IN_149] = [__v_29, __v_26, __v_27, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[149].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[149].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[149].bump_multiplicity(__i); } let __ret: [G; OUT_149] = unsafe { *(record.function_queries[149].output_at(__i).as_ptr() as *const [G; OUT_149]) }; __ret }, _ => aiur_fn_149(__args, record, io_buffer, __cu)? } };
         let __v_32: G = __r_arr[0];
-        let __v_33: G = G::from_u64(0);
         let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_30, __v_31, __v_28, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-        let __v_34: G = __r_arr[0];
-        let __v_35: G = { let __values: [G; 3] = [__v_33, __v_32, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_33: G = __r_arr[0];
+        let __v_34: G = G::from_u64(0);
+        let __v_35: G = { let __values: [G; 3] = [__v_34, __v_32, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_150] = [__v_35];
         record.function_queries[150].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14534,12 +14534,12 @@ fn aiur_fn_151(
         let __v_4: G = __r_arr[0];
         let __v_5: G = __r_arr[1];
         let __v_6: G = __r_arr[2];
-        let __v_7: G = G::from_u64(0);
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = (__v_2 - __v_8);
-        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_5, __v_6, __v_9, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-        let __v_10: G = __r_arr[0];
-        let __v_11: G = { let __values: [G; 3] = [__v_7, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = G::from_u64(1);
+        let __v_8: G = (__v_2 - __v_7);
+        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_5, __v_6, __v_8, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+        let __v_9: G = __r_arr[0];
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = { let __values: [G; 3] = [__v_10, __v_4, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_151] = [__v_11];
         record.function_queries[151].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14577,12 +14577,12 @@ fn aiur_fn_152(
       0u64 => {
         match __v_3.as_canonical_u64() {
           _ => {
-            let __v_6: G = G::from_u64(0);
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_7: G = __r_arr[0];
+            let __v_6: G = __r_arr[0];
             let __r_arr: [G; OUT_152] = { let __args: [G; IN_152] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[152].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[152].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[152].bump_multiplicity(__i); } let __ret: [G; OUT_152] = unsafe { *(record.function_queries[152].output_at(__i).as_ptr() as *const [G; OUT_152]) }; __ret }, _ => aiur_fn_152(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = { let __values: [G; 3] = [__v_6, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = G::from_u64(0);
+            let __v_9: G = { let __values: [G; 3] = [__v_8, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_152] = [__v_9];
             record.function_queries[152].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -14626,12 +14626,12 @@ fn aiur_fn_153(
       0u64 => {
         match __v_3.as_canonical_u64() {
           _ => {
-            let __v_7: G = G::from_u64(0);
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
+            let __v_7: G = __r_arr[0];
             let __r_arr: [G; OUT_153] = { let __args: [G; IN_153] = [__v_6, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[153].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[153].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[153].bump_multiplicity(__i); } let __ret: [G; OUT_153] = unsafe { *(record.function_queries[153].output_at(__i).as_ptr() as *const [G; OUT_153]) }; __ret }, _ => aiur_fn_153(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
-            let __v_10: G = { let __values: [G; 4] = [__v_7, __v_3, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 4] = [__v_9, __v_3, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_153] = [__v_10];
             record.function_queries[153].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -14669,18 +14669,18 @@ fn aiur_fn_154(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
         let __r_arr: [G; OUT_152] = { let __args: [G; IN_152] = [__v_0, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[152].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[152].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[152].bump_multiplicity(__i); } let __ret: [G; OUT_152] = unsafe { *(record.function_queries[152].output_at(__i).as_ptr() as *const [G; OUT_152]) }; __ret }, _ => aiur_fn_152(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
+        let __v_4: G = __r_arr[0];
         let __r_arr: [G; OUT_153] = { let __args: [G; IN_153] = [__v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[153].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[153].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[153].bump_multiplicity(__i); } let __ret: [G; OUT_153] = unsafe { *(record.function_queries[153].output_at(__i).as_ptr() as *const [G; OUT_153]) }; __ret }, _ => aiur_fn_153(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = (__v_2 + __v_7);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_3 - __v_9);
-        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_0, __v_1, __v_8, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 4] = [__v_4, __v_5, __v_6, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = (__v_2 + __v_6);
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_3 - __v_8);
+        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_0, __v_1, __v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 4] = [__v_11, __v_4, __v_5, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_154] = [__v_12];
         record.function_queries[154].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14817,12 +14817,12 @@ fn aiur_fn_156(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
         let __r_arr: [G; OUT_156] = { let __args: [G; IN_156] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[156].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[156].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[156].bump_multiplicity(__i); } let __ret: [G; OUT_156] = unsafe { *(record.function_queries[156].output_at(__i).as_ptr() as *const [G; OUT_156]) }; __ret }, _ => aiur_fn_156(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 3] = [__v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_7, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_156] = [__v_8];
         record.function_queries[156].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14860,17 +14860,17 @@ fn aiur_fn_157(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_11: G = { let __values: [G; 3] = [__v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = G::from_u64(1);
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_9, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_157] = { let __args: [G; IN_157] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[157].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[157].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[157].bump_multiplicity(__i); } let __ret: [G; OUT_157] = unsafe { *(record.function_queries[157].output_at(__i).as_ptr() as *const [G; OUT_157]) }; __ret }, _ => aiur_fn_157(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 3] = [__v_5, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(0);
+        let __v_13: G = { let __values: [G; 3] = [__v_12, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_157] = [__v_13];
         record.function_queries[157].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14923,29 +14923,29 @@ fn aiur_fn_158(
             match __v_7.as_canonical_u64() {
               _ => {
                 let __v_14: G = G::from_u64(1);
-                let __r_arr: [G; OUT_156] = { let __args: [G; IN_156] = [__v_3, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[156].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[156].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[156].bump_multiplicity(__i); } let __ret: [G; OUT_156] = unsafe { *(record.function_queries[156].output_at(__i).as_ptr() as *const [G; OUT_156]) }; __ret }, _ => aiur_fn_156(__args, record, io_buffer, __cu)? } };
-                let __v_15: G = __r_arr[0];
-                let __v_16: G = G::from_u64(1);
-                let __v_17: G = (__v_5 - __v_16);
-                let __v_18: G = G::from_u64(1);
-                if (__v_7 != __v_18) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_18.as_canonical_u64(), msg: None });
+                if (__v_7 != __v_14) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: None });
                 }
                 let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                let __v_19: G = __r_arr[0];
+                let __v_15: G = __r_arr[0];
                 let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                let __v_20: G = __r_arr[0];
-                if (__v_19 != __v_20) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: None });
+                let __v_16: G = __r_arr[0];
+                if (__v_15 != __v_16) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_15.as_canonical_u64(), rhs: __v_16.as_canonical_u64(), msg: None });
                 }
+                let __v_17: G = G::from_u64(1);
+                let __r_arr: [G; OUT_156] = { let __args: [G; IN_156] = [__v_3, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[156].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[156].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[156].bump_multiplicity(__i); } let __ret: [G; OUT_156] = unsafe { *(record.function_queries[156].output_at(__i).as_ptr() as *const [G; OUT_156]) }; __ret }, _ => aiur_fn_156(__args, record, io_buffer, __cu)? } };
+                let __v_18: G = __r_arr[0];
+                let __v_19: G = G::from_u64(1);
+                let __v_20: G = (__v_5 - __v_19);
                 let __r_arr: [G; OUT_157] = { let __args: [G; IN_157] = [__v_2, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[157].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[157].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[157].bump_multiplicity(__i); } let __ret: [G; OUT_157] = unsafe { *(record.function_queries[157].output_at(__i).as_ptr() as *const [G; OUT_157]) }; __ret }, _ => aiur_fn_157(__args, record, io_buffer, __cu)? } };
                 let __v_21: G = __r_arr[0];
-                let __v_22: G = G::from_u64(0);
+                let __v_22: G = G::from_u64(1);
                 let __v_23: G = G::from_u64(1);
-                let __v_24: G = G::from_u64(1);
-                let __v_25: G = { let __values: [G; 3] = [__v_23, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_26: G = { let __values: [G; 3] = [__v_22, __v_17, __v_25]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_118] = { let __args: [G; IN_118] = [__v_12, __v_21, __v_26, __v_15, __v_9, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[118].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[118].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[118].bump_multiplicity(__i); } let __ret: [G; OUT_118] = unsafe { *(record.function_queries[118].output_at(__i).as_ptr() as *const [G; OUT_118]) }; __ret }, _ => aiur_fn_118(__args, record, io_buffer, __cu)? } };
+                let __v_24: G = { let __values: [G; 3] = [__v_22, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_25: G = G::from_u64(0);
+                let __v_26: G = { let __values: [G; 3] = [__v_25, __v_20, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __r_arr: [G; OUT_118] = { let __args: [G; IN_118] = [__v_12, __v_21, __v_26, __v_18, __v_9, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[118].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[118].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[118].bump_multiplicity(__i); } let __ret: [G; OUT_118] = unsafe { *(record.function_queries[118].output_at(__i).as_ptr() as *const [G; OUT_118]) }; __ret }, _ => aiur_fn_118(__args, record, io_buffer, __cu)? } };
                 let __v_27: G = __r_arr[0];
                 let __v_28: G = G::from_u64(1);
                 if (__v_27 != __v_28) {
@@ -14953,7 +14953,7 @@ fn aiur_fn_158(
                 }
                 let __v_29: G = G::from_u64(1);
                 let __v_30: G = (__v_4 + __v_29);
-                let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_10, __v_13, __v_2, __v_15, __v_30, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_10, __v_13, __v_2, __v_18, __v_30, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
                 let __v_31: G = __r_arr[0];
                 let __ret: [G; OUT_158] = [__v_31];
                 record.function_queries[158].finish(&inp[..], &__ret[..], !unconstrained);
@@ -15019,164 +15019,164 @@ fn aiur_fn_159(
       _ => {
         let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
         let __v_32: G = __r_arr[0];
-        let __v_33: G = G::from_u64(1);
-        let __v_34: G = G::from_u64(1);
-        let __v_35: G = { let __values: [G; 3] = [__v_33, __v_34, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
+        let __v_33: G = __r_arr[0];
+        let __v_34: G = (__v_33 - __v_32);
+        let __v_35: G = G::from_bool((__v_34 == G::ZERO));
+        let __v_36: G = G::from_u64(1);
+        if (__v_35 != __v_36) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_35.as_canonical_u64(), rhs: __v_36.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+        let __v_37: G = __r_arr[0];
+        let __v_38: G = G::from_u64(3);
+        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_4, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+        let __v_39: G = __r_arr[0];
+        let __v_40: G = (__v_38 + __v_39);
+        if (__v_37 != __v_40) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_37.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
+        let __v_41: G = __r_arr[0];
+        let __v_42: G = (__v_41 - __v_32);
+        let __v_43: G = G::from_bool((__v_42 == G::ZERO));
+        let __v_44: G = G::from_u64(1);
+        if (__v_43 != __v_44) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+        let __v_45: G = __r_arr[0];
+        let __v_46: G = G::from_u64(1);
+        if (__v_45 != __v_46) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_46.as_canonical_u64(), msg: None });
+        }
+        let __v_47: G = G::from_u64(1);
+        let __v_48: G = G::from_u64(1);
+        let __v_49: G = { let __values: [G; 3] = [__v_47, __v_48, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_4.as_canonical_u64() {
   0u64 => {
-    break '__mc_0 [__v_35];
+    break '__mc_0 [__v_49];
   },
   1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_5, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_36: G = __r_arr[0];
-    break '__mc_0 [__v_36];
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_5, __v_49]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_50: G = __r_arr[0];
+    break '__mc_0 [__v_50];
   },
   _ => {
     return Err(ExecError::MatchNoCase(__v_4.as_canonical_u64()));
   },
 }
  };
-        let __v_36: G = __mc_out___mc_0[0];
-        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_3, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-        let __v_37: G = __r_arr[0];
-        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_2, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-        let __v_38: G = __r_arr[0];
-        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_1, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-        let __v_39: G = __r_arr[0];
-        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_0, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-        let __v_40: G = __r_arr[0];
-        let __v_41: G = G::from_u64(1);
-        let __v_42: G = G::from_u64(1);
-        let __v_43: G = { let __values: [G; 3] = [__v_41, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_40, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-        let __v_44: G = __r_arr[0];
-        let __v_45: G = __r_arr[1];
-        let __v_46: G = __r_arr[2];
-        let __v_47: G = __r_arr[3];
-        let __v_48: G = __r_arr[4];
-        let __v_49: G = __r_arr[5];
-        let __v_50: G = __r_arr[6];
-        let __v_51: G = __r_arr[7];
-        let __v_52: G = __r_arr[8];
-        let __v_53: G = __r_arr[9];
-        let __v_54: G = __r_arr[10];
-        let __v_55: G = __r_arr[11];
-        let __v_56: G = __r_arr[12];
-        let __v_57: G = __r_arr[13];
-        let __v_58: G = __r_arr[14];
-        let __v_59: G = __r_arr[15];
-        let __v_60: G = __r_arr[16];
-        let __v_61: G = __r_arr[17];
-        let __v_62: G = G::from_u64(256);
-        let __v_63: G = (__v_62 * __v_45);
-        let __v_64: G = G::from_u64(65536);
-        let __v_65: G = (__v_64 * __v_46);
-        let __v_66: G = G::from_u64(16777216);
-        let __v_67: G = (__v_66 * __v_47);
-        let __v_68: G = G::from_u64(4294967296);
-        let __v_69: G = (__v_68 * __v_48);
-        let __v_70: G = G::from_u64(1099511627776);
-        let __v_71: G = (__v_70 * __v_49);
-        let __v_72: G = G::from_u64(281474976710656);
-        let __v_73: G = (__v_72 * __v_50);
-        let __v_74: G = G::from_u64(72057594037927936);
-        let __v_75: G = (__v_74 * __v_51);
-        let __v_76: G = (__v_73 + __v_75);
-        let __v_77: G = (__v_71 + __v_76);
-        let __v_78: G = (__v_69 + __v_77);
-        let __v_79: G = (__v_67 + __v_78);
-        let __v_80: G = (__v_65 + __v_79);
-        let __v_81: G = (__v_63 + __v_80);
-        let __v_82: G = (__v_44 + __v_81);
-        let __v_83: G = G::from_u64(256);
-        let __v_84: G = (__v_83 * __v_53);
-        let __v_85: G = G::from_u64(65536);
-        let __v_86: G = (__v_85 * __v_54);
-        let __v_87: G = G::from_u64(16777216);
-        let __v_88: G = (__v_87 * __v_55);
-        let __v_89: G = G::from_u64(4294967296);
-        let __v_90: G = (__v_89 * __v_56);
-        let __v_91: G = G::from_u64(1099511627776);
-        let __v_92: G = (__v_91 * __v_57);
-        let __v_93: G = G::from_u64(281474976710656);
-        let __v_94: G = (__v_93 * __v_58);
-        let __v_95: G = G::from_u64(72057594037927936);
-        let __v_96: G = (__v_95 * __v_59);
-        let __v_97: G = (__v_94 + __v_96);
-        let __v_98: G = (__v_92 + __v_97);
-        let __v_99: G = (__v_90 + __v_98);
-        let __v_100: G = (__v_88 + __v_99);
-        let __v_101: G = (__v_86 + __v_100);
-        let __v_102: G = (__v_84 + __v_101);
-        let __v_103: G = (__v_52 + __v_102);
-        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_60, __v_6, __v_7, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-        let __v_104: G = __r_arr[0];
-        let __v_105: G = __r_arr[1];
-        let __v_106: G = G::from_u64(1);
-        let __v_107: G = G::from_u64(1);
-        let __v_108: G = { let __values: [G; 3] = [__v_106, __v_107, __v_107]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_10, __v_108]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-        let __v_109: G = __r_arr[0];
-        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_105, __v_109]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-        let __v_110: G = __r_arr[0];
-        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_110, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-        let __v_111: G = __r_arr[0];
-        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_111, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-        let __v_112: G = __r_arr[0];
-        let __v_113: G = __r_arr[1];
-        let __v_114: G = (__v_32 + __v_28);
-        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_112, __v_113, __v_29, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-        let __v_115: G = __r_arr[0];
-        let __v_116: G = G::from_u64(0);
-        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_8, __v_9, __v_116, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-        let __v_117: G = __r_arr[0];
-        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_112, __v_113, __v_117, __v_82, __v_103, __v_1, __v_2, __v_3, __v_4, __v_5, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_114, __v_104, __v_6, __v_10, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+        let __v_50: G = __mc_out___mc_0[0];
+        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_3, __v_50]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+        let __v_51: G = __r_arr[0];
+        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_2, __v_51]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+        let __v_52: G = __r_arr[0];
+        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_1, __v_52]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+        let __v_53: G = __r_arr[0];
+        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_0, __v_53]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+        let __v_54: G = __r_arr[0];
+        let __v_55: G = G::from_u64(1);
+        let __v_56: G = G::from_u64(1);
+        let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_54, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+        let __v_58: G = __r_arr[0];
+        let __v_59: G = __r_arr[1];
+        let __v_60: G = __r_arr[2];
+        let __v_61: G = __r_arr[3];
+        let __v_62: G = __r_arr[4];
+        let __v_63: G = __r_arr[5];
+        let __v_64: G = __r_arr[6];
+        let __v_65: G = __r_arr[7];
+        let __v_66: G = __r_arr[8];
+        let __v_67: G = __r_arr[9];
+        let __v_68: G = __r_arr[10];
+        let __v_69: G = __r_arr[11];
+        let __v_70: G = __r_arr[12];
+        let __v_71: G = __r_arr[13];
+        let __v_72: G = __r_arr[14];
+        let __v_73: G = __r_arr[15];
+        let __v_74: G = __r_arr[16];
+        let __v_75: G = __r_arr[17];
+        let __v_76: G = G::from_u64(256);
+        let __v_77: G = (__v_76 * __v_59);
+        let __v_78: G = G::from_u64(65536);
+        let __v_79: G = (__v_78 * __v_60);
+        let __v_80: G = G::from_u64(16777216);
+        let __v_81: G = (__v_80 * __v_61);
+        let __v_82: G = G::from_u64(4294967296);
+        let __v_83: G = (__v_82 * __v_62);
+        let __v_84: G = G::from_u64(1099511627776);
+        let __v_85: G = (__v_84 * __v_63);
+        let __v_86: G = G::from_u64(281474976710656);
+        let __v_87: G = (__v_86 * __v_64);
+        let __v_88: G = G::from_u64(72057594037927936);
+        let __v_89: G = (__v_88 * __v_65);
+        let __v_90: G = (__v_87 + __v_89);
+        let __v_91: G = (__v_85 + __v_90);
+        let __v_92: G = (__v_83 + __v_91);
+        let __v_93: G = (__v_81 + __v_92);
+        let __v_94: G = (__v_79 + __v_93);
+        let __v_95: G = (__v_77 + __v_94);
+        let __v_96: G = (__v_58 + __v_95);
+        let __v_97: G = G::from_u64(256);
+        let __v_98: G = (__v_97 * __v_67);
+        let __v_99: G = G::from_u64(65536);
+        let __v_100: G = (__v_99 * __v_68);
+        let __v_101: G = G::from_u64(16777216);
+        let __v_102: G = (__v_101 * __v_69);
+        let __v_103: G = G::from_u64(4294967296);
+        let __v_104: G = (__v_103 * __v_70);
+        let __v_105: G = G::from_u64(1099511627776);
+        let __v_106: G = (__v_105 * __v_71);
+        let __v_107: G = G::from_u64(281474976710656);
+        let __v_108: G = (__v_107 * __v_72);
+        let __v_109: G = G::from_u64(72057594037927936);
+        let __v_110: G = (__v_109 * __v_73);
+        let __v_111: G = (__v_108 + __v_110);
+        let __v_112: G = (__v_106 + __v_111);
+        let __v_113: G = (__v_104 + __v_112);
+        let __v_114: G = (__v_102 + __v_113);
+        let __v_115: G = (__v_100 + __v_114);
+        let __v_116: G = (__v_98 + __v_115);
+        let __v_117: G = (__v_66 + __v_116);
+        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_74, __v_6, __v_7, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
         let __v_118: G = __r_arr[0];
-        let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
-        let __v_119: G = __r_arr[0];
-        let __v_120: G = (__v_119 - __v_32);
-        let __v_121: G = G::from_bool((__v_120 == G::ZERO));
-        let __v_122: G = G::from_u64(1);
-        if (__v_121 != __v_122) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_121.as_canonical_u64(), rhs: __v_122.as_canonical_u64(), msg: None });
-        }
-        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+        let __v_119: G = __r_arr[1];
+        let __v_120: G = G::from_u64(1);
+        let __v_121: G = G::from_u64(1);
+        let __v_122: G = { let __values: [G; 3] = [__v_120, __v_121, __v_121]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_10, __v_122]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
         let __v_123: G = __r_arr[0];
-        let __v_124: G = G::from_u64(3);
-        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_4, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_119, __v_123]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+        let __v_124: G = __r_arr[0];
+        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_124, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
         let __v_125: G = __r_arr[0];
-        let __v_126: G = (__v_124 + __v_125);
-        if (__v_123 != __v_126) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_123.as_canonical_u64(), rhs: __v_126.as_canonical_u64(), msg: None });
-        }
-        let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
-        let __v_127: G = __r_arr[0];
-        let __v_128: G = (__v_127 - __v_32);
-        let __v_129: G = G::from_bool((__v_128 == G::ZERO));
-        let __v_130: G = G::from_u64(1);
-        if (__v_129 != __v_130) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_129.as_canonical_u64(), rhs: __v_130.as_canonical_u64(), msg: None });
-        }
-        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-        let __v_131: G = __r_arr[0];
-        let __v_132: G = G::from_u64(1);
-        if (__v_131 != __v_132) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_131.as_canonical_u64(), rhs: __v_132.as_canonical_u64(), msg: None });
+        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_125, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+        let __v_126: G = __r_arr[0];
+        let __v_127: G = __r_arr[1];
+        let __v_128: G = (__v_32 + __v_28);
+        let __v_129: G = G::from_u64(33);
+        let __v_130: G = { let __a_val = __v_128.as_canonical_u64(); let __b_val = __v_129.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+        let __v_131: G = G::from_u64(1);
+        if (__v_130 != __v_131) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
         }
-        let __v_133: G = G::from_u64(33);
-        let __v_134: G = { let __a_val = __v_114.as_canonical_u64(); let __b_val = __v_133.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-        let __v_135: G = G::from_u64(1);
-        if (__v_134 != __v_135) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_134.as_canonical_u64(), rhs: __v_135.as_canonical_u64(), msg: None });
+        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_126, __v_127, __v_29, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+        let __v_132: G = __r_arr[0];
+        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_8, __v_132, __v_19, __v_20, __v_21, __v_22, __v_4, __v_5, __v_23, __v_24, __v_27, __v_28, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+        let __v_133: G = __r_arr[0];
+        let __v_134: G = G::from_u64(1);
+        if (__v_133 != __v_134) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_133.as_canonical_u64(), rhs: __v_134.as_canonical_u64(), msg: None });
         }
-        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_8, __v_115, __v_19, __v_20, __v_21, __v_22, __v_4, __v_5, __v_23, __v_24, __v_27, __v_28, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+        let __v_135: G = G::from_u64(0);
+        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_8, __v_9, __v_135, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
         let __v_136: G = __r_arr[0];
-        let __v_137: G = G::from_u64(1);
-        if (__v_136 != __v_137) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_136.as_canonical_u64(), rhs: __v_137.as_canonical_u64(), msg: None });
-        }
+        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_126, __v_127, __v_136, __v_96, __v_117, __v_1, __v_2, __v_3, __v_4, __v_5, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_128, __v_118, __v_6, __v_10, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+        let __v_137: G = __r_arr[0];
         let __v_138: G = G::from_u64(0);
-        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_9, __v_6, __v_118, __v_115, __v_138, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_9, __v_6, __v_137, __v_132, __v_138, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
         let __v_139: G = __r_arr[0];
         let __ret: [G; OUT_159] = [__v_139];
         record.function_queries[159].finish(&inp[..], &__ret[..], !unconstrained);
@@ -15281,21 +15281,21 @@ fn aiur_fn_162(
     let __v_7: G = inp[7];
     let __v_8: G = inp[8];
     let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(0);
+    let __v_10: G = { let __values: [G; 3] = [__v_9, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_11: G = G::from_u64(0);
-    let __v_12: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 3] = [__v_11, __v_6, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_13: G = G::from_u64(0);
-    let __v_14: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 3] = [__v_13, __v_5, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = G::from_u64(0);
-    let __v_17: G = { let __values: [G; 3] = [__v_16, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_18: G = { let __values: [G; 3] = [__v_15, __v_6, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_19: G = { let __values: [G; 3] = [__v_14, __v_5, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_20: G = { let __values: [G; 3] = [__v_13, __v_4, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_21: G = { let __values: [G; 3] = [__v_12, __v_3, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_22: G = { let __values: [G; 3] = [__v_11, __v_2, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_23: G = { let __values: [G; 3] = [__v_10, __v_1, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_24: G = { let __values: [G; 3] = [__v_9, __v_0, __v_23]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_16: G = { let __values: [G; 3] = [__v_15, __v_4, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_17: G = G::from_u64(0);
+    let __v_18: G = { let __values: [G; 3] = [__v_17, __v_3, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_19: G = G::from_u64(0);
+    let __v_20: G = { let __values: [G; 3] = [__v_19, __v_2, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_21: G = G::from_u64(0);
+    let __v_22: G = { let __values: [G; 3] = [__v_21, __v_1, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_23: G = G::from_u64(0);
+    let __v_24: G = { let __values: [G; 3] = [__v_23, __v_0, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_162] = [__v_24];
     record.function_queries[162].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -15921,12 +15921,12 @@ fn aiur_fn_169(
         let __v_4: G = __loaded[2];
         match __v_2.as_canonical_u64() {
           0u64 => {
-            let __v_5: G = G::from_u64(0);
-            let __v_6: G = G::from_u64(1);
-            let __v_7: G = (__v_1 - __v_6);
-            let __r_arr: [G; OUT_169] = { let __args: [G; IN_169] = [__v_4, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[169].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[169].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[169].bump_multiplicity(__i); } let __ret: [G; OUT_169] = unsafe { *(record.function_queries[169].output_at(__i).as_ptr() as *const [G; OUT_169]) }; __ret }, _ => aiur_fn_169(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = { let __values: [G; 3] = [__v_5, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_5: G = G::from_u64(1);
+            let __v_6: G = (__v_1 - __v_5);
+            let __r_arr: [G; OUT_169] = { let __args: [G; IN_169] = [__v_4, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[169].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[169].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[169].bump_multiplicity(__i); } let __ret: [G; OUT_169] = unsafe { *(record.function_queries[169].output_at(__i).as_ptr() as *const [G; OUT_169]) }; __ret }, _ => aiur_fn_169(__args, record, io_buffer, __cu)? } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = G::from_u64(0);
+            let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_169] = [__v_9];
             record.function_queries[169].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -16087,48 +16087,48 @@ fn aiur_fn_173(
 ) -> Result<[G; OUT_173], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
-    let __v_1: G = G::from_u64(0);
-    let __v_2: G = G::from_u64(109);
-    let __v_3: G = G::from_u64(0);
-    let __v_4: G = G::from_u64(117);
-    let __v_5: G = G::from_u64(0);
-    let __v_6: G = G::from_u64(108);
-    let __v_7: G = G::from_u64(0);
+    let __v_1: G = G::from_u64(109);
+    let __v_2: G = G::from_u64(117);
+    let __v_3: G = G::from_u64(108);
+    let __v_4: G = G::from_u64(116);
+    let __v_5: G = G::from_u64(105);
+    let __v_6: G = G::from_u64(45);
+    let __v_7: G = G::from_u64(115);
     let __v_8: G = G::from_u64(116);
-    let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(105);
-    let __v_11: G = G::from_u64(0);
-    let __v_12: G = G::from_u64(45);
-    let __v_13: G = G::from_u64(0);
-    let __v_14: G = G::from_u64(115);
+    let __v_9: G = G::from_u64(97);
+    let __v_10: G = G::from_u64(114);
+    let __v_11: G = G::from_u64(107);
+    let __v_12: G = G::from_u64(47);
+    let __v_13: G = G::from_u64(118);
+    let __v_14: G = G::from_u64(48);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = G::from_u64(116);
+    let __v_16: G = { let __values: [G; 3] = [__v_15, __v_14, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_17: G = G::from_u64(0);
-    let __v_18: G = G::from_u64(97);
+    let __v_18: G = { let __values: [G; 3] = [__v_17, __v_13, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_19: G = G::from_u64(0);
-    let __v_20: G = G::from_u64(114);
+    let __v_20: G = { let __values: [G; 3] = [__v_19, __v_12, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_21: G = G::from_u64(0);
-    let __v_22: G = G::from_u64(107);
+    let __v_22: G = { let __values: [G; 3] = [__v_21, __v_11, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_23: G = G::from_u64(0);
-    let __v_24: G = G::from_u64(47);
+    let __v_24: G = { let __values: [G; 3] = [__v_23, __v_10, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_25: G = G::from_u64(0);
-    let __v_26: G = G::from_u64(118);
+    let __v_26: G = { let __values: [G; 3] = [__v_25, __v_9, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_27: G = G::from_u64(0);
-    let __v_28: G = G::from_u64(48);
-    let __v_29: G = { let __values: [G; 3] = [__v_27, __v_28, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_30: G = { let __values: [G; 3] = [__v_25, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_31: G = { let __values: [G; 3] = [__v_23, __v_24, __v_30]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_32: G = { let __values: [G; 3] = [__v_21, __v_22, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_33: G = { let __values: [G; 3] = [__v_19, __v_20, __v_32]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_34: G = { let __values: [G; 3] = [__v_17, __v_18, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_35: G = { let __values: [G; 3] = [__v_15, __v_16, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_36: G = { let __values: [G; 3] = [__v_13, __v_14, __v_35]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_37: G = { let __values: [G; 3] = [__v_11, __v_12, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_38: G = { let __values: [G; 3] = [__v_9, __v_10, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_39: G = { let __values: [G; 3] = [__v_7, __v_8, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_40: G = { let __values: [G; 3] = [__v_5, __v_6, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_41: G = { let __values: [G; 3] = [__v_3, __v_4, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_42: G = { let __values: [G; 3] = [__v_1, __v_2, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_28: G = { let __values: [G; 3] = [__v_27, __v_8, __v_26]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = G::from_u64(0);
+    let __v_30: G = { let __values: [G; 3] = [__v_29, __v_7, __v_28]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_31: G = G::from_u64(0);
+    let __v_32: G = { let __values: [G; 3] = [__v_31, __v_6, __v_30]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_33: G = G::from_u64(0);
+    let __v_34: G = { let __values: [G; 3] = [__v_33, __v_5, __v_32]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_35: G = G::from_u64(0);
+    let __v_36: G = { let __values: [G; 3] = [__v_35, __v_4, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_37: G = G::from_u64(0);
+    let __v_38: G = { let __values: [G; 3] = [__v_37, __v_3, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_39: G = G::from_u64(0);
+    let __v_40: G = { let __values: [G; 3] = [__v_39, __v_2, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_41: G = G::from_u64(0);
+    let __v_42: G = { let __values: [G; 3] = [__v_41, __v_1, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_173] = [__v_42];
     record.function_queries[173].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -16242,48 +16242,48 @@ fn aiur_fn_176(
     let __v_12: G = __r_arr[0];
     let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_0, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
     let __v_13: G = __r_arr[0];
-    let __v_14: G = G::from_u64(0);
-    let __v_15: G = G::from_u64(109);
-    let __v_16: G = G::from_u64(0);
-    let __v_17: G = G::from_u64(117);
-    let __v_18: G = G::from_u64(0);
-    let __v_19: G = G::from_u64(108);
-    let __v_20: G = G::from_u64(0);
+    let __v_14: G = G::from_u64(109);
+    let __v_15: G = G::from_u64(117);
+    let __v_16: G = G::from_u64(108);
+    let __v_17: G = G::from_u64(116);
+    let __v_18: G = G::from_u64(105);
+    let __v_19: G = G::from_u64(45);
+    let __v_20: G = G::from_u64(115);
     let __v_21: G = G::from_u64(116);
-    let __v_22: G = G::from_u64(0);
-    let __v_23: G = G::from_u64(105);
-    let __v_24: G = G::from_u64(0);
-    let __v_25: G = G::from_u64(45);
-    let __v_26: G = G::from_u64(0);
-    let __v_27: G = G::from_u64(115);
+    let __v_22: G = G::from_u64(97);
+    let __v_23: G = G::from_u64(114);
+    let __v_24: G = G::from_u64(107);
+    let __v_25: G = G::from_u64(47);
+    let __v_26: G = G::from_u64(118);
+    let __v_27: G = G::from_u64(48);
     let __v_28: G = G::from_u64(0);
-    let __v_29: G = G::from_u64(116);
+    let __v_29: G = { let __values: [G; 3] = [__v_28, __v_27, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_30: G = G::from_u64(0);
-    let __v_31: G = G::from_u64(97);
+    let __v_31: G = { let __values: [G; 3] = [__v_30, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_32: G = G::from_u64(0);
-    let __v_33: G = G::from_u64(114);
+    let __v_33: G = { let __values: [G; 3] = [__v_32, __v_25, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_34: G = G::from_u64(0);
-    let __v_35: G = G::from_u64(107);
+    let __v_35: G = { let __values: [G; 3] = [__v_34, __v_24, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_36: G = G::from_u64(0);
-    let __v_37: G = G::from_u64(47);
+    let __v_37: G = { let __values: [G; 3] = [__v_36, __v_23, __v_35]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_38: G = G::from_u64(0);
-    let __v_39: G = G::from_u64(118);
+    let __v_39: G = { let __values: [G; 3] = [__v_38, __v_22, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_40: G = G::from_u64(0);
-    let __v_41: G = G::from_u64(48);
-    let __v_42: G = { let __values: [G; 3] = [__v_40, __v_41, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_43: G = { let __values: [G; 3] = [__v_38, __v_39, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_44: G = { let __values: [G; 3] = [__v_36, __v_37, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_45: G = { let __values: [G; 3] = [__v_34, __v_35, __v_44]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_46: G = { let __values: [G; 3] = [__v_32, __v_33, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_47: G = { let __values: [G; 3] = [__v_30, __v_31, __v_46]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_48: G = { let __values: [G; 3] = [__v_28, __v_29, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_49: G = { let __values: [G; 3] = [__v_26, __v_27, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_50: G = { let __values: [G; 3] = [__v_24, __v_25, __v_49]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_51: G = { let __values: [G; 3] = [__v_22, __v_23, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_52: G = { let __values: [G; 3] = [__v_20, __v_21, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_53: G = { let __values: [G; 3] = [__v_18, __v_19, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_54: G = { let __values: [G; 3] = [__v_16, __v_17, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_55: G = { let __values: [G; 3] = [__v_14, __v_15, __v_54]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_41: G = { let __values: [G; 3] = [__v_40, __v_21, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_42: G = G::from_u64(0);
+    let __v_43: G = { let __values: [G; 3] = [__v_42, __v_20, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_44: G = G::from_u64(0);
+    let __v_45: G = { let __values: [G; 3] = [__v_44, __v_19, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_46: G = G::from_u64(0);
+    let __v_47: G = { let __values: [G; 3] = [__v_46, __v_18, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_48: G = G::from_u64(0);
+    let __v_49: G = { let __values: [G; 3] = [__v_48, __v_17, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_50: G = G::from_u64(0);
+    let __v_51: G = { let __values: [G; 3] = [__v_50, __v_16, __v_49]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_52: G = G::from_u64(0);
+    let __v_53: G = { let __values: [G; 3] = [__v_52, __v_15, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_54: G = G::from_u64(0);
+    let __v_55: G = { let __values: [G; 3] = [__v_54, __v_14, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_56: G = G::from_u64(1);
     let __v_57: G = G::from_u64(1);
     let __v_58: G = { let __values: [G; 3] = [__v_56, __v_57, __v_57]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -17020,13 +17020,13 @@ fn aiur_fn_185(
         let __v_8: G = __loaded[3];
         match __v_5.as_canonical_u64() {
           0u64 => {
-            let __v_9: G = G::from_u64(0);
             let __r_arr: [G; OUT_184] = { let __args: [G; IN_184] = [__v_2, __v_3, __v_6, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[184].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[184].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[184].bump_multiplicity(__i); } let __ret: [G; OUT_184] = unsafe { *(record.function_queries[184].output_at(__i).as_ptr() as *const [G; OUT_184]) }; __ret }, _ => aiur_fn_184(__args, record, io_buffer, __cu)? } };
-            let __v_10: G = __r_arr[0];
-            let __v_11: G = __r_arr[1];
+            let __v_9: G = __r_arr[0];
+            let __v_10: G = __r_arr[1];
             let __r_arr: [G; OUT_185] = { let __args: [G; IN_185] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[185].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[185].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[185].bump_multiplicity(__i); } let __ret: [G; OUT_185] = unsafe { *(record.function_queries[185].output_at(__i).as_ptr() as *const [G; OUT_185]) }; __ret }, _ => aiur_fn_185(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
-            let __v_13: G = { let __values: [G; 4] = [__v_9, __v_10, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = __r_arr[0];
+            let __v_12: G = G::from_u64(0);
+            let __v_13: G = { let __values: [G; 4] = [__v_12, __v_9, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_185] = [__v_13];
             record.function_queries[185].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -17325,27 +17325,27 @@ fn aiur_fn_188(
     let __v_31: G = (__v_16 * __v_25);
     let __v_32: G = (__v_17 * __v_22);
     let __v_33: G = (__v_31 + __v_32);
-    let __v_34: G = (__v_0 * __v_6);
-    let __v_35: G = G::from_u64(7);
-    let __v_36: G = (__v_1 * __v_7);
-    let __v_37: G = (__v_35 * __v_36);
-    let __v_38: G = (__v_34 + __v_37);
-    let __v_39: G = (__v_0 * __v_7);
-    let __v_40: G = (__v_1 * __v_6);
-    let __v_41: G = (__v_39 + __v_40);
-    let __v_42: G = (__v_2 * __v_4);
-    let __v_43: G = G::from_u64(7);
-    let __v_44: G = (__v_3 * __v_5);
-    let __v_45: G = (__v_43 * __v_44);
-    let __v_46: G = (__v_42 + __v_45);
-    let __v_47: G = (__v_2 * __v_5);
-    let __v_48: G = (__v_3 * __v_4);
-    let __v_49: G = (__v_47 + __v_48);
-    let __v_50: G = (__v_12 + __v_30);
-    let __v_51: G = (__v_15 + __v_33);
-    let __v_52: G = (__v_38 + __v_46);
-    let __v_53: G = (__v_41 + __v_49);
-    let __ret: [G; OUT_188] = [__v_50, __v_51, __v_52, __v_53];
+    let __v_34: G = (__v_12 + __v_30);
+    let __v_35: G = (__v_15 + __v_33);
+    let __v_36: G = (__v_0 * __v_6);
+    let __v_37: G = G::from_u64(7);
+    let __v_38: G = (__v_1 * __v_7);
+    let __v_39: G = (__v_37 * __v_38);
+    let __v_40: G = (__v_36 + __v_39);
+    let __v_41: G = (__v_0 * __v_7);
+    let __v_42: G = (__v_1 * __v_6);
+    let __v_43: G = (__v_41 + __v_42);
+    let __v_44: G = (__v_2 * __v_4);
+    let __v_45: G = G::from_u64(7);
+    let __v_46: G = (__v_3 * __v_5);
+    let __v_47: G = (__v_45 * __v_46);
+    let __v_48: G = (__v_44 + __v_47);
+    let __v_49: G = (__v_2 * __v_5);
+    let __v_50: G = (__v_3 * __v_4);
+    let __v_51: G = (__v_49 + __v_50);
+    let __v_52: G = (__v_40 + __v_48);
+    let __v_53: G = (__v_43 + __v_51);
+    let __ret: [G; OUT_188] = [__v_34, __v_35, __v_52, __v_53];
     record.function_queries[188].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -17854,25 +17854,25 @@ fn aiur_fn_192(
     let __v_13: G = G::from_u64(0);
     let __v_14: G = G::from_u64(0);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = G::from_u64(0);
-    let __v_17: G = G::from_u64(0);
-    let __v_18: G = G::from_u64(0);
+    let __v_16: G = G::from_u64(1);
+    let __v_17: G = G::from_u64(1);
+    let __v_18: G = { let __values: [G; 4] = [__v_16, __v_17, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_19: G = G::from_u64(0);
-    let __v_20: G = G::from_u64(0);
+    let __v_20: G = { let __values: [G; 4] = [__v_19, __v_7, __v_15, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_21: G = G::from_u64(0);
-    let __v_22: G = G::from_u64(0);
+    let __v_22: G = { let __values: [G; 4] = [__v_21, __v_6, __v_14, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_23: G = G::from_u64(0);
-    let __v_24: G = G::from_u64(1);
-    let __v_25: G = G::from_u64(1);
-    let __v_26: G = { let __values: [G; 4] = [__v_24, __v_25, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_27: G = { let __values: [G; 4] = [__v_22, __v_7, __v_23, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_28: G = { let __values: [G; 4] = [__v_20, __v_6, __v_21, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_29: G = { let __values: [G; 4] = [__v_18, __v_5, __v_19, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_30: G = { let __values: [G; 4] = [__v_16, __v_4, __v_17, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_31: G = { let __values: [G; 4] = [__v_14, __v_3, __v_15, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_32: G = { let __values: [G; 4] = [__v_12, __v_2, __v_13, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_33: G = { let __values: [G; 4] = [__v_10, __v_1, __v_11, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_34: G = { let __values: [G; 4] = [__v_8, __v_0, __v_9, __v_33]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_24: G = { let __values: [G; 4] = [__v_23, __v_5, __v_13, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_25: G = G::from_u64(0);
+    let __v_26: G = { let __values: [G; 4] = [__v_25, __v_4, __v_12, __v_24]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_27: G = G::from_u64(0);
+    let __v_28: G = { let __values: [G; 4] = [__v_27, __v_3, __v_11, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = G::from_u64(0);
+    let __v_30: G = { let __values: [G; 4] = [__v_29, __v_2, __v_10, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_31: G = G::from_u64(0);
+    let __v_32: G = { let __values: [G; 4] = [__v_31, __v_1, __v_9, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_33: G = G::from_u64(0);
+    let __v_34: G = { let __values: [G; 4] = [__v_33, __v_0, __v_8, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_192] = [__v_34];
     record.function_queries[192].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -18185,61 +18185,67 @@ fn aiur_fn_196(
           _ => {
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_2, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
             let __v_28: G = __r_arr[0];
+            let __v_29: G = G::from_u64(32);
+            let __v_30: G = if unconstrained { Bytes2::less_than(&__v_28, &__v_29) } else { bytes2_less_than_value(__v_28, __v_29, record) };
+            let __v_31: G = G::from_u64(1);
+            if (__v_30 != __v_31) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_30.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
+            }
             let __r_arr: [G; OUT_194] = { let __args: [G; IN_194] = [__v_24]; let __cu = unconstrained; let __hit = record.function_queries[194].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[194].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[194].bump_multiplicity(__i); } let __ret: [G; OUT_194] = unsafe { *(record.function_queries[194].output_at(__i).as_ptr() as *const [G; OUT_194]) }; __ret }, _ => aiur_fn_194(__args, record, io_buffer, __cu)? } };
-            let __v_29: G = __r_arr[0];
+            let __v_32: G = __r_arr[0];
             let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_3, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-            let __v_30: G = __r_arr[0];
-            let __v_31: G = __r_arr[1];
+            let __v_33: G = __r_arr[0];
+            let __v_34: G = __r_arr[1];
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_4, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_32: G = __r_arr[0];
-            let __v_33: G = G::from_u64(0);
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_34: G = __r_arr[0];
-            let __v_35: G = G::from_u64(1);
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_32, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_36: G = __r_arr[0];
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_5, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_35: G = __r_arr[0];
+            let __v_36: G = G::from_u64(0);
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_35, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
             let __v_37: G = __r_arr[0];
-            let __v_38: G = G::from_u64(0);
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_37, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_38: G = G::from_u64(1);
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_35, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
             let __v_39: G = __r_arr[0];
-            let __v_40: G = G::from_u64(1);
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_37, __v_40]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_41: G = __r_arr[0];
-            let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_5, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_40: G = __r_arr[0];
+            let __v_41: G = G::from_u64(0);
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_40, __v_41]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
             let __v_42: G = __r_arr[0];
-            let __v_43: G = __r_arr[1];
-            let __mc_out___mc_0: [G; 2] = '__mc_0: { match __v_42.as_canonical_u64() {
+            let __v_43: G = G::from_u64(1);
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_40, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_44: G = __r_arr[0];
+            let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+            let __v_45: G = __r_arr[0];
+            let __v_46: G = __r_arr[1];
+            let __mc_out___mc_0: [G; 2] = '__mc_0: { match __v_45.as_canonical_u64() {
   0u64 => {
-    let __v_44: G = G::from_u64(1);
-    let __v_45: G = G::from_u64(1);
-    let __v_46: G = { let __values: [G; 4] = [__v_44, __v_45, __v_45, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_47: G = G::from_u64(1);
     let __v_48: G = G::from_u64(1);
     let __v_49: G = { let __values: [G; 4] = [__v_47, __v_48, __v_48, __v_48]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_0 [__v_46, __v_49];
+    let __v_50: G = G::from_u64(1);
+    let __v_51: G = G::from_u64(1);
+    let __v_52: G = { let __values: [G; 4] = [__v_50, __v_51, __v_51, __v_51]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_49, __v_52];
   },
   1u64 => {
     match __v_6.as_canonical_u64() {
       0u64 => {
-        let __v_44: G = G::from_u64(1);
-        let __v_45: G = G::from_u64(1);
-        let __v_46: G = { let __values: [G; 4] = [__v_44, __v_45, __v_45, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_47: G = G::from_u64(1);
         let __v_48: G = G::from_u64(1);
         let __v_49: G = { let __values: [G; 4] = [__v_47, __v_48, __v_48, __v_48]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        break '__mc_0 [__v_46, __v_49];
+        let __v_50: G = G::from_u64(1);
+        let __v_51: G = G::from_u64(1);
+        let __v_52: G = { let __values: [G; 4] = [__v_50, __v_51, __v_51, __v_51]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        break '__mc_0 [__v_49, __v_52];
       },
       1u64 => {
-        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_7, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-        let __v_44: G = __r_arr[0];
-        let __v_45: G = G::from_u64(0);
-        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-        let __v_46: G = __r_arr[0];
-        let __v_47: G = G::from_u64(1);
-        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_44, __v_47]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-        let __v_48: G = __r_arr[0];
-        break '__mc_0 [__v_46, __v_48];
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_7, __v_46]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_47: G = __r_arr[0];
+        let __v_48: G = G::from_u64(0);
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_47, __v_48]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_49: G = __r_arr[0];
+        let __v_50: G = G::from_u64(1);
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_47, __v_50]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_51: G = __r_arr[0];
+        break '__mc_0 [__v_49, __v_51];
       },
       _ => {
         return Err(ExecError::MatchNoCase(__v_6.as_canonical_u64()));
@@ -18247,133 +18253,130 @@ fn aiur_fn_196(
     }
   },
   _ => {
-    return Err(ExecError::MatchNoCase(__v_42.as_canonical_u64()));
+    return Err(ExecError::MatchNoCase(__v_45.as_canonical_u64()));
   },
 }
  };
-            let __v_44: G = __mc_out___mc_0[0];
-            let __v_45: G = __mc_out___mc_0[1];
+            let __v_47: G = __mc_out___mc_0[0];
+            let __v_48: G = __mc_out___mc_0[1];
             let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = [__v_18, __v_19, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
-            let __v_46: G = __r_arr[0];
-            let __v_47: G = __r_arr[1];
-            let __v_48: G = G::from_u64(1);
-            let __v_49: G = G::from_u64(0);
-            let __v_50: G = (__v_46 - __v_48);
-            let __v_51: G = (__v_47 - __v_49);
+            let __v_49: G = __r_arr[0];
+            let __v_50: G = __r_arr[1];
+            let __v_51: G = G::from_u64(1);
+            let __v_52: G = G::from_u64(0);
+            let __v_53: G = (__v_49 - __v_51);
+            let __v_54: G = (__v_50 - __v_52);
             let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
-            let __v_52: G = __r_arr[0];
-            let __v_53: G = g_inverse_value(__v_52);
-            let __v_54: G = (__v_52 * __v_53);
-            let __v_55: G = G::from_u64(1);
-            let __v_56: G = (__v_54 - __v_55);
-            let __v_57: G = (__v_52 * __v_56);
-            let __v_58: G = G::from_u64(0);
-            if (__v_57 != __v_58) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_58.as_canonical_u64(), msg: None });
+            let __v_55: G = __r_arr[0];
+            let __v_56: G = g_inverse_value(__v_55);
+            let __v_57: G = (__v_55 * __v_56);
+            let __v_58: G = G::from_u64(1);
+            let __v_59: G = (__v_57 - __v_58);
+            let __v_60: G = (__v_55 * __v_59);
+            let __v_61: G = G::from_u64(0);
+            if (__v_60 != __v_61) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_60.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: None });
             }
-            let __v_59: G = (__v_53 * __v_56);
-            let __v_60: G = G::from_u64(0);
-            if (__v_59 != __v_60) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_59.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
+            let __v_62: G = (__v_56 * __v_59);
+            let __v_63: G = G::from_u64(0);
+            if (__v_62 != __v_63) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_62.as_canonical_u64(), rhs: __v_63.as_canonical_u64(), msg: None });
             }
-            let __v_61: G = G::from_u64(1);
-            let __v_62: G = G::from_u64(0);
-            let __v_63: G = (__v_18 - __v_61);
-            let __v_64: G = (__v_19 - __v_62);
-            let __v_65: G = (__v_63 * __v_63);
-            let __v_66: G = G::from_u64(7);
-            let __v_67: G = (__v_64 * __v_64);
-            let __v_68: G = (__v_66 * __v_67);
-            let __v_69: G = (__v_65 - __v_68);
-            let __v_70: G = g_inverse_value(__v_69);
+            let __v_64: G = G::from_u64(1);
+            let __v_65: G = G::from_u64(0);
+            let __v_66: G = (__v_18 - __v_64);
+            let __v_67: G = (__v_19 - __v_65);
+            let __v_68: G = (__v_66 * __v_66);
+            let __v_69: G = G::from_u64(7);
+            let __v_70: G = (__v_67 * __v_67);
             let __v_71: G = (__v_69 * __v_70);
-            let __v_72: G = G::from_u64(1);
-            let __v_73: G = (__v_71 - __v_72);
-            let __v_74: G = (__v_69 * __v_73);
-            let __v_75: G = G::from_u64(0);
-            if (__v_74 != __v_75) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_74.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
+            let __v_72: G = (__v_68 - __v_71);
+            let __v_73: G = g_inverse_value(__v_72);
+            let __v_74: G = (__v_72 * __v_73);
+            let __v_75: G = G::from_u64(1);
+            let __v_76: G = (__v_74 - __v_75);
+            let __v_77: G = (__v_72 * __v_76);
+            let __v_78: G = G::from_u64(0);
+            if (__v_77 != __v_78) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_78.as_canonical_u64(), msg: None });
             }
-            let __v_76: G = (__v_70 * __v_73);
-            let __v_77: G = G::from_u64(0);
-            if (__v_76 != __v_77) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_77.as_canonical_u64(), msg: None });
+            let __v_79: G = (__v_73 * __v_76);
+            let __v_80: G = G::from_u64(0);
+            if (__v_79 != __v_80) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
             }
-            let __v_78: G = (__v_63 * __v_70);
-            let __v_79: G = G::from_u64(0);
-            let __v_80: G = (__v_79 - __v_64);
-            let __v_81: G = (__v_80 * __v_70);
-            let __v_82: G = (__v_50 * __v_78);
-            let __v_83: G = G::from_u64(7);
-            let __v_84: G = (__v_51 * __v_81);
-            let __v_85: G = (__v_83 * __v_84);
-            let __v_86: G = (__v_82 + __v_85);
-            let __v_87: G = (__v_50 * __v_81);
-            let __v_88: G = (__v_51 * __v_78);
-            let __v_89: G = (__v_87 + __v_88);
-            let __v_90: G = G::from_u64(0);
-            let __v_91: G = (__v_18 - __v_53);
-            let __v_92: G = (__v_19 - __v_90);
-            let __v_93: G = (__v_91 * __v_91);
-            let __v_94: G = G::from_u64(7);
-            let __v_95: G = (__v_92 * __v_92);
-            let __v_96: G = (__v_94 * __v_95);
-            let __v_97: G = (__v_93 - __v_96);
-            let __v_98: G = g_inverse_value(__v_97);
+            let __v_81: G = (__v_66 * __v_73);
+            let __v_82: G = G::from_u64(0);
+            let __v_83: G = (__v_82 - __v_67);
+            let __v_84: G = (__v_83 * __v_73);
+            let __v_85: G = (__v_53 * __v_81);
+            let __v_86: G = G::from_u64(7);
+            let __v_87: G = (__v_54 * __v_84);
+            let __v_88: G = (__v_86 * __v_87);
+            let __v_89: G = (__v_85 + __v_88);
+            let __v_90: G = (__v_53 * __v_84);
+            let __v_91: G = (__v_54 * __v_81);
+            let __v_92: G = (__v_90 + __v_91);
+            let __v_93: G = G::from_u64(0);
+            let __v_94: G = (__v_18 - __v_56);
+            let __v_95: G = (__v_19 - __v_93);
+            let __v_96: G = (__v_94 * __v_94);
+            let __v_97: G = G::from_u64(7);
+            let __v_98: G = (__v_95 * __v_95);
             let __v_99: G = (__v_97 * __v_98);
-            let __v_100: G = G::from_u64(1);
-            let __v_101: G = (__v_99 - __v_100);
-            let __v_102: G = (__v_97 * __v_101);
-            let __v_103: G = G::from_u64(0);
-            if (__v_102 != __v_103) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_102.as_canonical_u64(), rhs: __v_103.as_canonical_u64(), msg: None });
+            let __v_100: G = (__v_96 - __v_99);
+            let __v_101: G = g_inverse_value(__v_100);
+            let __v_102: G = (__v_100 * __v_101);
+            let __v_103: G = G::from_u64(1);
+            let __v_104: G = (__v_102 - __v_103);
+            let __v_105: G = (__v_100 * __v_104);
+            let __v_106: G = G::from_u64(0);
+            if (__v_105 != __v_106) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_105.as_canonical_u64(), rhs: __v_106.as_canonical_u64(), msg: None });
             }
-            let __v_104: G = (__v_98 * __v_101);
-            let __v_105: G = G::from_u64(0);
-            if (__v_104 != __v_105) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_104.as_canonical_u64(), rhs: __v_105.as_canonical_u64(), msg: None });
+            let __v_107: G = (__v_101 * __v_104);
+            let __v_108: G = G::from_u64(0);
+            if (__v_107 != __v_108) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_107.as_canonical_u64(), rhs: __v_108.as_canonical_u64(), msg: None });
             }
-            let __v_106: G = (__v_91 * __v_98);
-            let __v_107: G = G::from_u64(0);
-            let __v_108: G = (__v_107 - __v_92);
-            let __v_109: G = (__v_108 * __v_98);
-            let __v_110: G = (__v_50 * __v_106);
-            let __v_111: G = G::from_u64(7);
-            let __v_112: G = (__v_51 * __v_109);
-            let __v_113: G = (__v_111 * __v_112);
-            let __v_114: G = (__v_110 + __v_113);
-            let __v_115: G = (__v_50 * __v_109);
-            let __v_116: G = (__v_51 * __v_106);
-            let __v_117: G = (__v_115 + __v_116);
-            let __v_118: G = G::from_u64(0);
-            let __v_119: G = (__v_18 - __v_53);
-            let __v_120: G = (__v_19 - __v_118);
-            let __v_121: G = (__v_50 * __v_50);
-            let __v_122: G = G::from_u64(7);
-            let __v_123: G = (__v_51 * __v_51);
-            let __v_124: G = (__v_122 * __v_123);
-            let __v_125: G = (__v_121 - __v_124);
-            let __v_126: G = g_inverse_value(__v_125);
+            let __v_109: G = (__v_94 * __v_101);
+            let __v_110: G = G::from_u64(0);
+            let __v_111: G = (__v_110 - __v_95);
+            let __v_112: G = (__v_111 * __v_101);
+            let __v_113: G = (__v_53 * __v_109);
+            let __v_114: G = G::from_u64(7);
+            let __v_115: G = (__v_54 * __v_112);
+            let __v_116: G = (__v_114 * __v_115);
+            let __v_117: G = (__v_113 + __v_116);
+            let __v_118: G = (__v_53 * __v_112);
+            let __v_119: G = (__v_54 * __v_109);
+            let __v_120: G = (__v_118 + __v_119);
+            let __v_121: G = G::from_u64(0);
+            let __v_122: G = (__v_18 - __v_56);
+            let __v_123: G = (__v_19 - __v_121);
+            let __v_124: G = (__v_53 * __v_53);
+            let __v_125: G = G::from_u64(7);
+            let __v_126: G = (__v_54 * __v_54);
             let __v_127: G = (__v_125 * __v_126);
-            let __v_128: G = G::from_u64(1);
-            let __v_129: G = (__v_127 - __v_128);
-            let __v_130: G = (__v_125 * __v_129);
-            let __v_131: G = G::from_u64(0);
-            if (__v_130 != __v_131) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
+            let __v_128: G = (__v_124 - __v_127);
+            let __v_129: G = g_inverse_value(__v_128);
+            let __v_130: G = (__v_128 * __v_129);
+            let __v_131: G = G::from_u64(1);
+            let __v_132: G = (__v_130 - __v_131);
+            let __v_133: G = (__v_128 * __v_132);
+            let __v_134: G = G::from_u64(0);
+            if (__v_133 != __v_134) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_133.as_canonical_u64(), rhs: __v_134.as_canonical_u64(), msg: None });
             }
-            let __v_132: G = (__v_126 * __v_129);
-            let __v_133: G = G::from_u64(0);
-            if (__v_132 != __v_133) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_132.as_canonical_u64(), rhs: __v_133.as_canonical_u64(), msg: None });
+            let __v_135: G = (__v_129 * __v_132);
+            let __v_136: G = G::from_u64(0);
+            if (__v_135 != __v_136) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_135.as_canonical_u64(), rhs: __v_136.as_canonical_u64(), msg: None });
             }
-            let __v_134: G = (__v_50 * __v_126);
-            let __v_135: G = G::from_u64(0);
-            let __v_136: G = (__v_135 - __v_51);
-            let __v_137: G = (__v_136 * __v_126);
+            let __v_137: G = (__v_53 * __v_129);
             let __v_138: G = G::from_u64(0);
-            let __v_139: G = G::from_u64(0);
-            let __v_140: G = G::from_u64(0);
+            let __v_139: G = (__v_138 - __v_54);
+            let __v_140: G = (__v_139 * __v_129);
             let __v_141: G = G::from_u64(0);
             let __v_142: G = G::from_u64(0);
             let __v_143: G = G::from_u64(0);
@@ -18382,196 +18385,193 @@ fn aiur_fn_196(
             let __v_146: G = G::from_u64(0);
             let __v_147: G = G::from_u64(0);
             let __v_148: G = G::from_u64(0);
-            let __v_149: G = G::from_u64(0);
-            let __v_150: G = G::from_u64(0);
-            let __v_151: G = G::from_u64(0);
+            let __v_149: G = G::from_u64(1);
+            let __v_150: G = G::from_u64(1);
+            let __v_151: G = { let __values: [G; 4] = [__v_149, __v_150, __v_150, __v_150]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_152: G = G::from_u64(0);
-            let __v_153: G = G::from_u64(0);
-            let __v_154: G = G::from_u64(1);
-            let __v_155: G = G::from_u64(1);
-            let __v_156: G = { let __values: [G; 4] = [__v_154, __v_155, __v_155, __v_155]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_157: G = { let __values: [G; 4] = [__v_152, __v_31, __v_153, __v_156]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_158: G = { let __values: [G; 4] = [__v_150, __v_30, __v_151, __v_157]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_159: G = { let __values: [G; 4] = [__v_148, __v_11, __v_149, __v_158]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_160: G = { let __values: [G; 4] = [__v_146, __v_10, __v_147, __v_159]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_161: G = { let __values: [G; 4] = [__v_144, __v_15, __v_145, __v_160]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_162: G = { let __values: [G; 4] = [__v_142, __v_14, __v_143, __v_161]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_163: G = { let __values: [G; 4] = [__v_140, __v_13, __v_141, __v_162]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_164: G = { let __values: [G; 4] = [__v_138, __v_12, __v_139, __v_163]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_153: G = { let __values: [G; 4] = [__v_152, __v_34, __v_148, __v_151]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_154: G = G::from_u64(0);
+            let __v_155: G = { let __values: [G; 4] = [__v_154, __v_33, __v_147, __v_153]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_156: G = G::from_u64(0);
+            let __v_157: G = { let __values: [G; 4] = [__v_156, __v_11, __v_146, __v_155]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_158: G = G::from_u64(0);
+            let __v_159: G = { let __values: [G; 4] = [__v_158, __v_10, __v_145, __v_157]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_160: G = G::from_u64(0);
+            let __v_161: G = { let __values: [G; 4] = [__v_160, __v_15, __v_144, __v_159]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_162: G = G::from_u64(0);
+            let __v_163: G = { let __values: [G; 4] = [__v_162, __v_14, __v_143, __v_161]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_164: G = G::from_u64(0);
+            let __v_165: G = { let __values: [G; 4] = [__v_164, __v_13, __v_142, __v_163]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_166: G = G::from_u64(0);
+            let __v_167: G = { let __values: [G; 4] = [__v_166, __v_12, __v_141, __v_165]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __r_arr: [G; OUT_180] = { let __args: [G; IN_180] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[180].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[180].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[180].bump_multiplicity(__i); } let __ret: [G; OUT_180] = unsafe { *(record.function_queries[180].output_at(__i).as_ptr() as *const [G; OUT_180]) }; __ret }, _ => aiur_fn_180(__args, record, io_buffer, __cu)? } };
-            let __v_165: G = __r_arr[0];
+            let __v_168: G = __r_arr[0];
             let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
-            let __v_166: G = __r_arr[0];
-            let __v_167: G = (__v_165 * __v_166);
-            let __v_168: G = g_inverse_value(__v_167);
-            let __v_169: G = (__v_167 * __v_168);
-            let __v_170: G = G::from_u64(1);
-            let __v_171: G = (__v_169 - __v_170);
-            let __v_172: G = (__v_167 * __v_171);
-            let __v_173: G = G::from_u64(0);
-            if (__v_172 != __v_173) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_172.as_canonical_u64(), rhs: __v_173.as_canonical_u64(), msg: None });
+            let __v_169: G = __r_arr[0];
+            let __v_170: G = (__v_168 * __v_169);
+            let __v_171: G = g_inverse_value(__v_170);
+            let __v_172: G = (__v_170 * __v_171);
+            let __v_173: G = G::from_u64(1);
+            let __v_174: G = (__v_172 - __v_173);
+            let __v_175: G = (__v_170 * __v_174);
+            let __v_176: G = G::from_u64(0);
+            if (__v_175 != __v_176) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_175.as_canonical_u64(), rhs: __v_176.as_canonical_u64(), msg: None });
             }
-            let __v_174: G = (__v_168 * __v_171);
-            let __v_175: G = G::from_u64(0);
-            if (__v_174 != __v_175) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_174.as_canonical_u64(), rhs: __v_175.as_canonical_u64(), msg: None });
+            let __v_177: G = (__v_171 * __v_174);
+            let __v_178: G = G::from_u64(0);
+            if (__v_177 != __v_178) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_178.as_canonical_u64(), msg: None });
             }
-            let __v_176: G = G::from_u64(0);
-            let __v_177: G = G::from_u64(0);
-            let __r_arr: [G; OUT_187] = { let __args: [G; IN_187] = [__v_176, __v_177, __v_16, __v_17, __v_23, __v_21, __v_34, __v_36, __v_44, __v_45, __v_39, __v_41, __v_164, __v_86, __v_89, __v_114, __v_117, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[187].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[187].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[187].bump_multiplicity(__i); } let __ret: [G; OUT_187] = unsafe { *(record.function_queries[187].output_at(__i).as_ptr() as *const [G; OUT_187]) }; __ret }, _ => aiur_fn_187(__args, record, io_buffer, __cu)? } };
-            let __v_178: G = __r_arr[0];
-            let __v_179: G = __r_arr[1];
+            let __v_179: G = G::from_u64(0);
             let __v_180: G = G::from_u64(0);
-            let __v_181: G = G::from_u64(0);
-            let __v_182: G = G::from_u64(0);
+            let __r_arr: [G; OUT_187] = { let __args: [G; IN_187] = [__v_179, __v_180, __v_16, __v_17, __v_23, __v_21, __v_37, __v_39, __v_47, __v_48, __v_42, __v_44, __v_167, __v_89, __v_92, __v_117, __v_120, __v_122, __v_123]; let __cu = unconstrained; let __hit = record.function_queries[187].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[187].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[187].bump_multiplicity(__i); } let __ret: [G; OUT_187] = unsafe { *(record.function_queries[187].output_at(__i).as_ptr() as *const [G; OUT_187]) }; __ret }, _ => aiur_fn_187(__args, record, io_buffer, __cu)? } };
+            let __v_181: G = __r_arr[0];
+            let __v_182: G = __r_arr[1];
             let __v_183: G = G::from_u64(0);
             let __v_184: G = G::from_u64(0);
             let __v_185: G = G::from_u64(0);
             let __v_186: G = G::from_u64(0);
             let __v_187: G = G::from_u64(0);
-            let __v_188: G = (__v_30 - __v_10);
-            let __v_189: G = (__v_186 - __v_184);
+            let __v_188: G = G::from_u64(0);
+            let __v_189: G = G::from_u64(0);
             let __v_190: G = G::from_u64(0);
-            let __v_191: G = (__v_188 * __v_168);
-            let __v_192: G = G::from_u64(7);
-            let __v_193: G = (__v_189 * __v_190);
-            let __v_194: G = (__v_192 * __v_193);
-            let __v_195: G = (__v_191 + __v_194);
-            let __v_196: G = (__v_188 * __v_190);
-            let __v_197: G = (__v_189 * __v_168);
-            let __v_198: G = (__v_196 + __v_197);
-            let __v_199: G = (__v_114 * __v_195);
-            let __v_200: G = G::from_u64(7);
-            let __v_201: G = (__v_117 * __v_198);
-            let __v_202: G = (__v_200 * __v_201);
-            let __v_203: G = (__v_199 + __v_202);
-            let __v_204: G = (__v_114 * __v_198);
-            let __v_205: G = (__v_117 * __v_195);
-            let __v_206: G = (__v_204 + __v_205);
-            let __v_207: G = (__v_31 - __v_11);
-            let __v_208: G = (__v_187 - __v_185);
-            let __v_209: G = G::from_u64(0);
-            let __v_210: G = (__v_207 * __v_168);
-            let __v_211: G = G::from_u64(7);
-            let __v_212: G = (__v_208 * __v_209);
-            let __v_213: G = (__v_211 * __v_212);
-            let __v_214: G = (__v_210 + __v_213);
-            let __v_215: G = (__v_207 * __v_209);
-            let __v_216: G = (__v_208 * __v_168);
-            let __v_217: G = (__v_215 + __v_216);
-            let __v_218: G = (__v_114 * __v_214);
-            let __v_219: G = G::from_u64(7);
-            let __v_220: G = (__v_117 * __v_217);
-            let __v_221: G = (__v_219 * __v_220);
-            let __v_222: G = (__v_218 + __v_221);
-            let __v_223: G = (__v_114 * __v_217);
-            let __v_224: G = (__v_117 * __v_214);
-            let __v_225: G = (__v_223 + __v_224);
+            let __v_191: G = (__v_33 - __v_10);
+            let __v_192: G = (__v_189 - __v_187);
+            let __v_193: G = G::from_u64(0);
+            let __v_194: G = (__v_191 * __v_171);
+            let __v_195: G = G::from_u64(7);
+            let __v_196: G = (__v_192 * __v_193);
+            let __v_197: G = (__v_195 * __v_196);
+            let __v_198: G = (__v_194 + __v_197);
+            let __v_199: G = (__v_191 * __v_193);
+            let __v_200: G = (__v_192 * __v_171);
+            let __v_201: G = (__v_199 + __v_200);
+            let __v_202: G = (__v_117 * __v_198);
+            let __v_203: G = G::from_u64(7);
+            let __v_204: G = (__v_120 * __v_201);
+            let __v_205: G = (__v_203 * __v_204);
+            let __v_206: G = (__v_202 + __v_205);
+            let __v_207: G = (__v_117 * __v_201);
+            let __v_208: G = (__v_120 * __v_198);
+            let __v_209: G = (__v_207 + __v_208);
+            let __v_210: G = (__v_34 - __v_11);
+            let __v_211: G = (__v_190 - __v_188);
+            let __v_212: G = G::from_u64(0);
+            let __v_213: G = (__v_210 * __v_171);
+            let __v_214: G = G::from_u64(7);
+            let __v_215: G = (__v_211 * __v_212);
+            let __v_216: G = (__v_214 * __v_215);
+            let __v_217: G = (__v_213 + __v_216);
+            let __v_218: G = (__v_210 * __v_212);
+            let __v_219: G = (__v_211 * __v_171);
+            let __v_220: G = (__v_218 + __v_219);
+            let __v_221: G = (__v_117 * __v_217);
+            let __v_222: G = G::from_u64(7);
+            let __v_223: G = (__v_120 * __v_220);
+            let __v_224: G = (__v_222 * __v_223);
+            let __v_225: G = (__v_221 + __v_224);
+            let __v_226: G = (__v_117 * __v_220);
+            let __v_227: G = (__v_120 * __v_217);
+            let __v_228: G = (__v_226 + __v_227);
             let __loaded: [G; 4] = { let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; let __ptr_u64 = __v_25.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 4 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 4] = __args[..4].try_into().unwrap(); __arr };
-            let __v_226: G = __loaded[0];
-            let __v_227: G = __loaded[1];
-            let __v_228: G = __loaded[2];
-            let __v_229: G = __loaded[3];
-            let __mc_out___mc_1: [G; 2] = '__mc_1: { match __v_226.as_canonical_u64() {
+            let __v_229: G = __loaded[0];
+            let __v_230: G = __loaded[1];
+            let __v_231: G = __loaded[2];
+            let __v_232: G = __loaded[3];
+            let __mc_out___mc_1: [G; 2] = '__mc_1: { match __v_229.as_canonical_u64() {
   1u64 => {
-    let __v_230: G = G::from_u64(0);
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_41, __v_230]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-    let __v_231: G = __r_arr[0];
-    let __v_232: G = __r_arr[1];
     let __v_233: G = G::from_u64(0);
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_39, __v_233]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_44, __v_233]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
     let __v_234: G = __r_arr[0];
     let __v_235: G = __r_arr[1];
-    let __v_236: G = (__v_231 - __v_234);
-    let __v_237: G = (__v_232 - __v_235);
-    let __v_238: G = (__v_236 + __v_203);
-    let __v_239: G = (__v_237 + __v_206);
-    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_178, __v_179, __v_16, __v_17, __v_238, __v_239]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
-    let __v_240: G = __r_arr[0];
-    let __v_241: G = __r_arr[1];
-    let __v_242: G = G::from_u64(1);
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_41, __v_242]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __v_236: G = G::from_u64(0);
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_42, __v_236]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __v_237: G = __r_arr[0];
+    let __v_238: G = __r_arr[1];
+    let __v_239: G = (__v_234 - __v_237);
+    let __v_240: G = (__v_235 - __v_238);
+    let __v_241: G = (__v_239 + __v_206);
+    let __v_242: G = (__v_240 + __v_209);
+    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_181, __v_182, __v_16, __v_17, __v_241, __v_242]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
     let __v_243: G = __r_arr[0];
     let __v_244: G = __r_arr[1];
     let __v_245: G = G::from_u64(1);
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_39, __v_245]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_44, __v_245]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
     let __v_246: G = __r_arr[0];
     let __v_247: G = __r_arr[1];
-    let __v_248: G = (__v_243 - __v_246);
-    let __v_249: G = (__v_244 - __v_247);
-    let __v_250: G = (__v_248 + __v_222);
-    let __v_251: G = (__v_249 + __v_225);
-    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_240, __v_241, __v_16, __v_17, __v_250, __v_251]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
-    let __v_252: G = __r_arr[0];
-    let __v_253: G = __r_arr[1];
-    break '__mc_1 [__v_252, __v_253];
+    let __v_248: G = G::from_u64(1);
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_42, __v_248]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __v_249: G = __r_arr[0];
+    let __v_250: G = __r_arr[1];
+    let __v_251: G = (__v_246 - __v_249);
+    let __v_252: G = (__v_247 - __v_250);
+    let __v_253: G = (__v_251 + __v_225);
+    let __v_254: G = (__v_252 + __v_228);
+    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_243, __v_244, __v_16, __v_17, __v_253, __v_254]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
+    let __v_255: G = __r_arr[0];
+    let __v_256: G = __r_arr[1];
+    break '__mc_1 [__v_255, __v_256];
   },
   0u64 => {
-    let __v_230: G = G::from_u64(0);
+    let __v_233: G = G::from_u64(0);
     let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_25]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-    let __v_231: G = __r_arr[0];
-    let __v_232: G = G::from_u64(0);
-    let __v_233: G = G::from_u64(1);
-    let __v_234: G = G::from_u64(0);
+    let __v_234: G = __r_arr[0];
     let __v_235: G = G::from_u64(0);
-    let __v_236: G = G::from_u64(0);
+    let __v_236: G = G::from_u64(1);
     let __v_237: G = G::from_u64(0);
     let __v_238: G = G::from_u64(0);
     let __v_239: G = G::from_u64(0);
     let __v_240: G = G::from_u64(0);
-    let __r_arr: [G; OUT_190] = { let __args: [G; IN_190] = [__v_178, __v_179, __v_16, __v_17, __v_25, __v_230, __v_231, __v_232, __v_26, __v_26, __v_233, __v_234, __v_235, __v_236, __v_237, __v_238, __v_239, __v_240, __v_203, __v_206, __v_222, __v_225, __v_12, __v_180, __v_13, __v_181, __v_14, __v_182, __v_15, __v_183, __v_21, __v_34, __v_36, __v_44, __v_45, __v_39, __v_41, __v_164, __v_86, __v_89, __v_114, __v_117, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[190].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[190].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[190].bump_multiplicity(__i); } let __ret: [G; OUT_190] = unsafe { *(record.function_queries[190].output_at(__i).as_ptr() as *const [G; OUT_190]) }; __ret }, _ => aiur_fn_190(__args, record, io_buffer, __cu)? } };
-    let __v_241: G = __r_arr[0];
-    let __v_242: G = __r_arr[1];
-    break '__mc_1 [__v_241, __v_242];
+    let __v_241: G = G::from_u64(0);
+    let __v_242: G = G::from_u64(0);
+    let __v_243: G = G::from_u64(0);
+    let __r_arr: [G; OUT_190] = { let __args: [G; IN_190] = [__v_181, __v_182, __v_16, __v_17, __v_25, __v_233, __v_234, __v_235, __v_26, __v_26, __v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_206, __v_209, __v_225, __v_228, __v_12, __v_183, __v_13, __v_184, __v_14, __v_185, __v_15, __v_186, __v_21, __v_37, __v_39, __v_47, __v_48, __v_42, __v_44, __v_167, __v_89, __v_92, __v_117, __v_120, __v_122, __v_123]; let __cu = unconstrained; let __hit = record.function_queries[190].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[190].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[190].bump_multiplicity(__i); } let __ret: [G; OUT_190] = unsafe { *(record.function_queries[190].output_at(__i).as_ptr() as *const [G; OUT_190]) }; __ret }, _ => aiur_fn_190(__args, record, io_buffer, __cu)? } };
+    let __v_244: G = __r_arr[0];
+    let __v_245: G = __r_arr[1];
+    break '__mc_1 [__v_244, __v_245];
   },
   _ => {
-    return Err(ExecError::MatchNoCase(__v_226.as_canonical_u64()));
+    return Err(ExecError::MatchNoCase(__v_229.as_canonical_u64()));
   },
 }
  };
-            let __v_230: G = __mc_out___mc_1[0];
-            let __v_231: G = __mc_out___mc_1[1];
+            let __v_233: G = __mc_out___mc_1[0];
+            let __v_234: G = __mc_out___mc_1[1];
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_232: G = __r_arr[0];
-            let __v_233: G = G::from_u64(0);
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_232, __v_233]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_234: G = __r_arr[0];
-            let __r_arr: [G; OUT_185] = { let __args: [G; IN_185] = [__v_234]; let __cu = unconstrained; let __hit = record.function_queries[185].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[185].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[185].bump_multiplicity(__i); } let __ret: [G; OUT_185] = unsafe { *(record.function_queries[185].output_at(__i).as_ptr() as *const [G; OUT_185]) }; __ret }, _ => aiur_fn_185(__args, record, io_buffer, __cu)? } };
             let __v_235: G = __r_arr[0];
-            let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = [__v_18, __v_19, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
-            let __v_236: G = __r_arr[0];
-            let __v_237: G = __r_arr[1];
-            let __v_238: G = G::from_u64(1);
-            let __v_239: G = G::from_u64(0);
-            let __r_arr: [G; OUT_193] = { let __args: [G; IN_193] = [__v_235, __v_236, __v_237, __v_238, __v_239]; let __cu = unconstrained; let __hit = record.function_queries[193].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[193].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[193].bump_multiplicity(__i); } let __ret: [G; OUT_193] = unsafe { *(record.function_queries[193].output_at(__i).as_ptr() as *const [G; OUT_193]) }; __ret }, _ => aiur_fn_193(__args, record, io_buffer, __cu)? } };
-            let __v_240: G = __r_arr[0];
-            let __v_241: G = __r_arr[1];
-            let __v_242: G = (__v_230 * __v_134);
-            let __v_243: G = G::from_u64(7);
-            let __v_244: G = (__v_231 * __v_137);
-            let __v_245: G = (__v_243 * __v_244);
-            let __v_246: G = (__v_242 + __v_245);
-            let __v_247: G = (__v_230 * __v_137);
-            let __v_248: G = (__v_231 * __v_134);
-            let __v_249: G = (__v_247 + __v_248);
-            let __v_250: G = G::from_u64(32);
-            let __v_251: G = if unconstrained { Bytes2::less_than(&__v_28, &__v_250) } else { bytes2_less_than_value(__v_28, __v_250, record) };
-            let __v_252: G = G::from_u64(1);
-            if (__v_251 != __v_252) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_251.as_canonical_u64(), rhs: __v_252.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_235]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-            let __v_253: G = __r_arr[0];
-            let __v_254: G = (__v_253 - __v_29);
-            let __v_255: G = G::from_bool((__v_254 == G::ZERO));
-            let __v_256: G = G::from_u64(1);
-            if (__v_255 != __v_256) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_255.as_canonical_u64(), rhs: __v_256.as_canonical_u64(), msg: None });
+            let __v_236: G = G::from_u64(0);
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_235, __v_236]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_237: G = __r_arr[0];
+            let __r_arr: [G; OUT_185] = { let __args: [G; IN_185] = [__v_237]; let __cu = unconstrained; let __hit = record.function_queries[185].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[185].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[185].bump_multiplicity(__i); } let __ret: [G; OUT_185] = unsafe { *(record.function_queries[185].output_at(__i).as_ptr() as *const [G; OUT_185]) }; __ret }, _ => aiur_fn_185(__args, record, io_buffer, __cu)? } };
+            let __v_238: G = __r_arr[0];
+            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_238]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+            let __v_239: G = __r_arr[0];
+            let __v_240: G = (__v_239 - __v_32);
+            let __v_241: G = G::from_bool((__v_240 == G::ZERO));
+            let __v_242: G = G::from_u64(1);
+            if (__v_241 != __v_242) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_241.as_canonical_u64(), rhs: __v_242.as_canonical_u64(), msg: None });
             }
-            let __v_257: G = (__v_246 - __v_240);
+            let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = [__v_18, __v_19, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
+            let __v_243: G = __r_arr[0];
+            let __v_244: G = __r_arr[1];
+            let __v_245: G = G::from_u64(1);
+            let __v_246: G = G::from_u64(0);
+            let __r_arr: [G; OUT_193] = { let __args: [G; IN_193] = [__v_238, __v_243, __v_244, __v_245, __v_246]; let __cu = unconstrained; let __hit = record.function_queries[193].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[193].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[193].bump_multiplicity(__i); } let __ret: [G; OUT_193] = unsafe { *(record.function_queries[193].output_at(__i).as_ptr() as *const [G; OUT_193]) }; __ret }, _ => aiur_fn_193(__args, record, io_buffer, __cu)? } };
+            let __v_247: G = __r_arr[0];
+            let __v_248: G = __r_arr[1];
+            let __v_249: G = (__v_233 * __v_137);
+            let __v_250: G = G::from_u64(7);
+            let __v_251: G = (__v_234 * __v_140);
+            let __v_252: G = (__v_250 * __v_251);
+            let __v_253: G = (__v_249 + __v_252);
+            let __v_254: G = (__v_233 * __v_140);
+            let __v_255: G = (__v_234 * __v_137);
+            let __v_256: G = (__v_254 + __v_255);
+            let __v_257: G = (__v_253 - __v_247);
             let __v_258: G = G::from_bool((__v_257 == G::ZERO));
-            let __v_259: G = (__v_249 - __v_241);
+            let __v_259: G = (__v_256 - __v_248);
             let __v_260: G = G::from_bool((__v_259 == G::ZERO));
             let __v_261: G = (__v_258 * __v_260);
             let __v_262: G = G::from_u64(1);
@@ -18580,7 +18580,7 @@ fn aiur_fn_196(
             }
             let __v_263: G = G::from_u64(1);
             let __v_264: G = (__v_9 + __v_263);
-            let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_27, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_264, __v_30, __v_31, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_27, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_264, __v_33, __v_34, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
             let __v_265: G = __r_arr[0];
             let __ret: [G; OUT_196] = [__v_265];
             record.function_queries[196].finish(&inp[..], &__ret[..], !unconstrained);
@@ -18798,20 +18798,58 @@ fn aiur_fn_199(
       _ => {
         match __v_0.as_canonical_u64() {
           _ => {
+            let __v_38: G = G::from_u64(0);
+            if (__v_1 != __v_38) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_38.as_canonical_u64(), msg: None });
+            }
+            let __v_39: G = G::from_u64(0);
+            if (__v_2 != __v_39) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_39.as_canonical_u64(), msg: None });
+            }
+            let __v_40: G = G::from_u64(1);
+            if (__v_3 != __v_40) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: None });
+            }
             match __v_12.as_canonical_u64() {
               _ => {
+                let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
+                let __v_41: G = __r_arr[0];
+                let __v_42: G = G::from_u64(1);
+                if (__v_41 != __v_42) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_41.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: None });
+                }
+                let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                let __v_43: G = __r_arr[0];
+                let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
+                let __v_44: G = __r_arr[0];
+                let __v_45: G = (__v_43 - __v_44);
+                let __v_46: G = G::from_bool((__v_45 == G::ZERO));
+                let __v_47: G = G::from_u64(1);
+                if (__v_46 != __v_47) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_46.as_canonical_u64(), rhs: __v_47.as_canonical_u64(), msg: None });
+                }
                 let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_8, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-                let __v_38: G = __r_arr[0];
+                let __v_48: G = __r_arr[0];
                 let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_11, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-                let __v_39: G = __r_arr[0];
+                let __v_49: G = __r_arr[0];
+                let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
+                let __v_50: G = __r_arr[0];
+                let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                let __v_51: G = __r_arr[0];
+                let __v_52: G = (__v_50 - __v_51);
+                let __v_53: G = G::from_bool((__v_52 == G::ZERO));
+                let __v_54: G = G::from_u64(1);
+                if (__v_53 != __v_54) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_53.as_canonical_u64(), rhs: __v_54.as_canonical_u64(), msg: None });
+                }
                 match __v_13.as_canonical_u64() {
                   _ => {
                     let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_9.as_canonical_u64() {
   0u64 => {
-    let __v_40: G = G::from_u64(1);
-    let __v_41: G = G::from_u64(1);
-    let __v_42: G = { let __values: [G; 3] = [__v_40, __v_41, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_0 [__v_42];
+    let __v_55: G = G::from_u64(1);
+    let __v_56: G = G::from_u64(1);
+    let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_57];
   },
   1u64 => {
     break '__mc_0 [__v_10];
@@ -18821,554 +18859,516 @@ fn aiur_fn_199(
   },
 }
  };
-                    let __v_40: G = __mc_out___mc_0[0];
+                    let __v_55: G = __mc_out___mc_0[0];
                     let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_17, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                    let __v_41: G = __r_arr[0];
-                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_13, __v_41]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                    let __v_42: G = __r_arr[0];
-                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_40, __v_42]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                    let __v_43: G = __r_arr[0];
-                    let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_12, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                    let __v_44: G = __r_arr[0];
-                    let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_44]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
-                    let __v_45: G = __r_arr[0];
-                    let __v_46: G = G::from_u64(0);
-                    let __v_47: G = G::from_u64(109);
-                    let __v_48: G = G::from_u64(0);
-                    let __v_49: G = G::from_u64(117);
-                    let __v_50: G = G::from_u64(0);
-                    let __v_51: G = G::from_u64(108);
-                    let __v_52: G = G::from_u64(0);
-                    let __v_53: G = G::from_u64(116);
-                    let __v_54: G = G::from_u64(0);
-                    let __v_55: G = G::from_u64(105);
-                    let __v_56: G = G::from_u64(0);
-                    let __v_57: G = G::from_u64(45);
-                    let __v_58: G = G::from_u64(0);
-                    let __v_59: G = G::from_u64(115);
-                    let __v_60: G = G::from_u64(0);
-                    let __v_61: G = G::from_u64(116);
-                    let __v_62: G = G::from_u64(0);
-                    let __v_63: G = G::from_u64(97);
-                    let __v_64: G = G::from_u64(0);
-                    let __v_65: G = G::from_u64(114);
-                    let __v_66: G = G::from_u64(0);
-                    let __v_67: G = G::from_u64(107);
-                    let __v_68: G = G::from_u64(0);
-                    let __v_69: G = G::from_u64(47);
-                    let __v_70: G = G::from_u64(0);
-                    let __v_71: G = G::from_u64(118);
-                    let __v_72: G = G::from_u64(0);
-                    let __v_73: G = G::from_u64(48);
-                    let __v_74: G = { let __values: [G; 3] = [__v_72, __v_73, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_75: G = { let __values: [G; 3] = [__v_70, __v_71, __v_74]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_76: G = { let __values: [G; 3] = [__v_68, __v_69, __v_75]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_77: G = { let __values: [G; 3] = [__v_66, __v_67, __v_76]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_78: G = { let __values: [G; 3] = [__v_64, __v_65, __v_77]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_79: G = { let __values: [G; 3] = [__v_62, __v_63, __v_78]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_80: G = { let __values: [G; 3] = [__v_60, __v_61, __v_79]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_81: G = { let __values: [G; 3] = [__v_58, __v_59, __v_80]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_82: G = { let __values: [G; 3] = [__v_56, __v_57, __v_81]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_83: G = { let __values: [G; 3] = [__v_54, __v_55, __v_82]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_84: G = { let __values: [G; 3] = [__v_52, __v_53, __v_83]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_85: G = { let __values: [G; 3] = [__v_50, __v_51, __v_84]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_86: G = { let __values: [G; 3] = [__v_48, __v_49, __v_85]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_87: G = { let __values: [G; 3] = [__v_46, __v_47, __v_86]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_88: G = G::from_u64(1);
-                    let __v_89: G = G::from_u64(1);
-                    let __v_90: G = { let __values: [G; 3] = [__v_88, __v_89, __v_89]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_87, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_91: G = __r_arr[0];
-                    let __v_92: G = __r_arr[1];
-                    let __v_93: G = __r_arr[2];
-                    let __v_94: G = __r_arr[3];
-                    let __v_95: G = __r_arr[4];
-                    let __v_96: G = __r_arr[5];
-                    let __v_97: G = __r_arr[6];
-                    let __v_98: G = __r_arr[7];
-                    let __v_99: G = __r_arr[8];
-                    let __v_100: G = __r_arr[9];
-                    let __v_101: G = __r_arr[10];
-                    let __v_102: G = __r_arr[11];
-                    let __v_103: G = __r_arr[12];
-                    let __v_104: G = __r_arr[13];
-                    let __v_105: G = __r_arr[14];
-                    let __v_106: G = __r_arr[15];
-                    let __v_107: G = __r_arr[16];
-                    let __v_108: G = __r_arr[17];
-                    let __v_109: G = G::from_u64(1);
-                    let __v_110: G = G::from_u64(1);
-                    let __v_111: G = { let __values: [G; 3] = [__v_109, __v_110, __v_110]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_111]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_112: G = __r_arr[0];
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_112]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_113: G = __r_arr[0];
-                    let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_107, __v_113]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                    let __v_114: G = __r_arr[0];
-                    let __v_115: G = G::from_u64(1);
-                    let __v_116: G = G::from_u64(1);
-                    let __v_117: G = { let __values: [G; 3] = [__v_115, __v_116, __v_116]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_114, __v_117]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_118: G = __r_arr[0];
-                    let __v_119: G = __r_arr[1];
-                    let __v_120: G = __r_arr[2];
-                    let __v_121: G = __r_arr[3];
-                    let __v_122: G = __r_arr[4];
-                    let __v_123: G = __r_arr[5];
-                    let __v_124: G = __r_arr[6];
-                    let __v_125: G = __r_arr[7];
-                    let __v_126: G = __r_arr[8];
-                    let __v_127: G = __r_arr[9];
-                    let __v_128: G = __r_arr[10];
-                    let __v_129: G = __r_arr[11];
-                    let __v_130: G = __r_arr[12];
-                    let __v_131: G = __r_arr[13];
-                    let __v_132: G = __r_arr[14];
-                    let __v_133: G = __r_arr[15];
-                    let __v_134: G = __r_arr[16];
-                    let __v_135: G = __r_arr[17];
-                    let __v_136: G = G::from_u64(1);
-                    let __v_137: G = G::from_u64(1);
-                    let __v_138: G = { let __values: [G; 3] = [__v_136, __v_137, __v_137]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_138]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_139: G = __r_arr[0];
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_139]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_140: G = __r_arr[0];
-                    let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_134, __v_140]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                    let __v_141: G = __r_arr[0];
-                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_141, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
-                    let __v_142: G = __r_arr[0];
-                    let __v_143: G = G::from_u64(1);
-                    let __v_144: G = G::from_u64(1);
-                    let __v_145: G = { let __values: [G; 3] = [__v_143, __v_144, __v_144]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_16, __v_145]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                    let __v_146: G = __r_arr[0];
-                    let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_142, __v_146]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                    let __v_147: G = __r_arr[0];
-                    let __v_148: G = G::from_u64(1);
-                    let __v_149: G = G::from_u64(1);
-                    let __v_150: G = { let __values: [G; 3] = [__v_148, __v_149, __v_149]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_147, __v_150]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_151: G = __r_arr[0];
-                    let __v_152: G = __r_arr[1];
-                    let __v_153: G = __r_arr[2];
-                    let __v_154: G = __r_arr[3];
-                    let __v_155: G = __r_arr[4];
-                    let __v_156: G = __r_arr[5];
-                    let __v_157: G = __r_arr[6];
-                    let __v_158: G = __r_arr[7];
-                    let __v_159: G = __r_arr[8];
-                    let __v_160: G = __r_arr[9];
-                    let __v_161: G = __r_arr[10];
-                    let __v_162: G = __r_arr[11];
-                    let __v_163: G = __r_arr[12];
-                    let __v_164: G = __r_arr[13];
-                    let __v_165: G = __r_arr[14];
-                    let __v_166: G = __r_arr[15];
-                    let __v_167: G = __r_arr[16];
-                    let __v_168: G = __r_arr[17];
-                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_167, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
-                    let __v_169: G = __r_arr[0];
-                    let __v_170: G = G::from_u64(1);
-                    let __v_171: G = G::from_u64(1);
-                    let __v_172: G = { let __values: [G; 3] = [__v_170, __v_171, __v_171]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_169, __v_172]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_173: G = __r_arr[0];
-                    let __v_174: G = __r_arr[1];
-                    let __v_175: G = __r_arr[2];
-                    let __v_176: G = __r_arr[3];
-                    let __v_177: G = __r_arr[4];
-                    let __v_178: G = __r_arr[5];
-                    let __v_179: G = __r_arr[6];
-                    let __v_180: G = __r_arr[7];
-                    let __v_181: G = __r_arr[8];
-                    let __v_182: G = __r_arr[9];
-                    let __v_183: G = __r_arr[10];
-                    let __v_184: G = __r_arr[11];
-                    let __v_185: G = __r_arr[12];
-                    let __v_186: G = __r_arr[13];
-                    let __v_187: G = __r_arr[14];
-                    let __v_188: G = __r_arr[15];
-                    let __v_189: G = __r_arr[16];
-                    let __v_190: G = __r_arr[17];
-                    let __v_191: G = G::from_u64(256);
-                    let __v_192: G = (__v_191 * __v_92);
-                    let __v_193: G = G::from_u64(65536);
-                    let __v_194: G = (__v_193 * __v_93);
-                    let __v_195: G = G::from_u64(16777216);
-                    let __v_196: G = (__v_195 * __v_94);
-                    let __v_197: G = G::from_u64(4294967296);
-                    let __v_198: G = (__v_197 * __v_95);
-                    let __v_199: G = G::from_u64(1099511627776);
-                    let __v_200: G = (__v_199 * __v_96);
-                    let __v_201: G = G::from_u64(281474976710656);
-                    let __v_202: G = (__v_201 * __v_97);
-                    let __v_203: G = G::from_u64(72057594037927936);
-                    let __v_204: G = (__v_203 * __v_98);
-                    let __v_205: G = (__v_202 + __v_204);
-                    let __v_206: G = (__v_200 + __v_205);
-                    let __v_207: G = (__v_198 + __v_206);
-                    let __v_208: G = (__v_196 + __v_207);
-                    let __v_209: G = (__v_194 + __v_208);
-                    let __v_210: G = (__v_192 + __v_209);
-                    let __v_211: G = (__v_91 + __v_210);
-                    let __v_212: G = G::from_u64(256);
-                    let __v_213: G = (__v_212 * __v_100);
-                    let __v_214: G = G::from_u64(65536);
-                    let __v_215: G = (__v_214 * __v_101);
-                    let __v_216: G = G::from_u64(16777216);
-                    let __v_217: G = (__v_216 * __v_102);
-                    let __v_218: G = G::from_u64(4294967296);
-                    let __v_219: G = (__v_218 * __v_103);
-                    let __v_220: G = G::from_u64(1099511627776);
-                    let __v_221: G = (__v_220 * __v_104);
-                    let __v_222: G = G::from_u64(281474976710656);
-                    let __v_223: G = (__v_222 * __v_105);
-                    let __v_224: G = G::from_u64(72057594037927936);
-                    let __v_225: G = (__v_224 * __v_106);
-                    let __v_226: G = (__v_223 + __v_225);
-                    let __v_227: G = (__v_221 + __v_226);
-                    let __v_228: G = (__v_219 + __v_227);
-                    let __v_229: G = (__v_217 + __v_228);
-                    let __v_230: G = (__v_215 + __v_229);
-                    let __v_231: G = (__v_213 + __v_230);
-                    let __v_232: G = (__v_99 + __v_231);
-                    let __v_233: G = G::from_u64(256);
-                    let __v_234: G = (__v_233 * __v_119);
-                    let __v_235: G = G::from_u64(65536);
-                    let __v_236: G = (__v_235 * __v_120);
-                    let __v_237: G = G::from_u64(16777216);
-                    let __v_238: G = (__v_237 * __v_121);
-                    let __v_239: G = G::from_u64(4294967296);
-                    let __v_240: G = (__v_239 * __v_122);
-                    let __v_241: G = G::from_u64(1099511627776);
-                    let __v_242: G = (__v_241 * __v_123);
-                    let __v_243: G = G::from_u64(281474976710656);
-                    let __v_244: G = (__v_243 * __v_124);
-                    let __v_245: G = G::from_u64(72057594037927936);
-                    let __v_246: G = (__v_245 * __v_125);
-                    let __v_247: G = (__v_244 + __v_246);
-                    let __v_248: G = (__v_242 + __v_247);
-                    let __v_249: G = (__v_240 + __v_248);
-                    let __v_250: G = (__v_238 + __v_249);
-                    let __v_251: G = (__v_236 + __v_250);
-                    let __v_252: G = (__v_234 + __v_251);
-                    let __v_253: G = (__v_118 + __v_252);
-                    let __v_254: G = G::from_u64(256);
-                    let __v_255: G = (__v_254 * __v_127);
-                    let __v_256: G = G::from_u64(65536);
-                    let __v_257: G = (__v_256 * __v_128);
-                    let __v_258: G = G::from_u64(16777216);
-                    let __v_259: G = (__v_258 * __v_129);
-                    let __v_260: G = G::from_u64(4294967296);
-                    let __v_261: G = (__v_260 * __v_130);
-                    let __v_262: G = G::from_u64(1099511627776);
-                    let __v_263: G = (__v_262 * __v_131);
-                    let __v_264: G = G::from_u64(281474976710656);
-                    let __v_265: G = (__v_264 * __v_132);
-                    let __v_266: G = G::from_u64(72057594037927936);
-                    let __v_267: G = (__v_266 * __v_133);
-                    let __v_268: G = (__v_265 + __v_267);
-                    let __v_269: G = (__v_263 + __v_268);
-                    let __v_270: G = (__v_261 + __v_269);
-                    let __v_271: G = (__v_259 + __v_270);
-                    let __v_272: G = (__v_257 + __v_271);
-                    let __v_273: G = (__v_255 + __v_272);
-                    let __v_274: G = (__v_126 + __v_273);
-                    let __v_275: G = G::from_u64(256);
-                    let __v_276: G = (__v_275 * __v_152);
-                    let __v_277: G = G::from_u64(65536);
-                    let __v_278: G = (__v_277 * __v_153);
-                    let __v_279: G = G::from_u64(16777216);
-                    let __v_280: G = (__v_279 * __v_154);
-                    let __v_281: G = G::from_u64(4294967296);
-                    let __v_282: G = (__v_281 * __v_155);
-                    let __v_283: G = G::from_u64(1099511627776);
-                    let __v_284: G = (__v_283 * __v_156);
-                    let __v_285: G = G::from_u64(281474976710656);
-                    let __v_286: G = (__v_285 * __v_157);
-                    let __v_287: G = G::from_u64(72057594037927936);
-                    let __v_288: G = (__v_287 * __v_158);
-                    let __v_289: G = (__v_286 + __v_288);
-                    let __v_290: G = (__v_284 + __v_289);
-                    let __v_291: G = (__v_282 + __v_290);
-                    let __v_292: G = (__v_280 + __v_291);
-                    let __v_293: G = (__v_278 + __v_292);
-                    let __v_294: G = (__v_276 + __v_293);
-                    let __v_295: G = (__v_151 + __v_294);
-                    let __v_296: G = G::from_u64(256);
-                    let __v_297: G = (__v_296 * __v_160);
-                    let __v_298: G = G::from_u64(65536);
-                    let __v_299: G = (__v_298 * __v_161);
-                    let __v_300: G = G::from_u64(16777216);
-                    let __v_301: G = (__v_300 * __v_162);
-                    let __v_302: G = G::from_u64(4294967296);
-                    let __v_303: G = (__v_302 * __v_163);
-                    let __v_304: G = G::from_u64(1099511627776);
-                    let __v_305: G = (__v_304 * __v_164);
-                    let __v_306: G = G::from_u64(281474976710656);
-                    let __v_307: G = (__v_306 * __v_165);
-                    let __v_308: G = G::from_u64(72057594037927936);
-                    let __v_309: G = (__v_308 * __v_166);
-                    let __v_310: G = (__v_307 + __v_309);
-                    let __v_311: G = (__v_305 + __v_310);
-                    let __v_312: G = (__v_303 + __v_311);
-                    let __v_313: G = (__v_301 + __v_312);
-                    let __v_314: G = (__v_299 + __v_313);
-                    let __v_315: G = (__v_297 + __v_314);
-                    let __v_316: G = (__v_159 + __v_315);
-                    let __v_317: G = G::from_u64(256);
-                    let __v_318: G = (__v_317 * __v_174);
-                    let __v_319: G = G::from_u64(65536);
-                    let __v_320: G = (__v_319 * __v_175);
-                    let __v_321: G = G::from_u64(16777216);
-                    let __v_322: G = (__v_321 * __v_176);
-                    let __v_323: G = G::from_u64(4294967296);
-                    let __v_324: G = (__v_323 * __v_177);
-                    let __v_325: G = G::from_u64(1099511627776);
-                    let __v_326: G = (__v_325 * __v_178);
-                    let __v_327: G = G::from_u64(281474976710656);
-                    let __v_328: G = (__v_327 * __v_179);
-                    let __v_329: G = G::from_u64(72057594037927936);
-                    let __v_330: G = (__v_329 * __v_180);
-                    let __v_331: G = (__v_328 + __v_330);
-                    let __v_332: G = (__v_326 + __v_331);
-                    let __v_333: G = (__v_324 + __v_332);
-                    let __v_334: G = (__v_322 + __v_333);
-                    let __v_335: G = (__v_320 + __v_334);
-                    let __v_336: G = (__v_318 + __v_335);
-                    let __v_337: G = (__v_173 + __v_336);
-                    let __v_338: G = G::from_u64(256);
-                    let __v_339: G = (__v_338 * __v_182);
-                    let __v_340: G = G::from_u64(65536);
-                    let __v_341: G = (__v_340 * __v_183);
-                    let __v_342: G = G::from_u64(16777216);
-                    let __v_343: G = (__v_342 * __v_184);
-                    let __v_344: G = G::from_u64(4294967296);
-                    let __v_345: G = (__v_344 * __v_185);
-                    let __v_346: G = G::from_u64(1099511627776);
-                    let __v_347: G = (__v_346 * __v_186);
-                    let __v_348: G = G::from_u64(281474976710656);
-                    let __v_349: G = (__v_348 * __v_187);
-                    let __v_350: G = G::from_u64(72057594037927936);
-                    let __v_351: G = (__v_350 * __v_188);
-                    let __v_352: G = (__v_349 + __v_351);
-                    let __v_353: G = (__v_347 + __v_352);
-                    let __v_354: G = (__v_345 + __v_353);
-                    let __v_355: G = (__v_343 + __v_354);
-                    let __v_356: G = (__v_341 + __v_355);
-                    let __v_357: G = (__v_339 + __v_356);
-                    let __v_358: G = (__v_181 + __v_357);
-                    let __v_359: G = G::from_u64(0);
-                    let __v_360: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_359, __v_360, __v_36, __v_211, __v_232, __v_253, __v_274]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
-                    let __v_361: G = __r_arr[0];
-                    let __v_362: G = __r_arr[1];
-                    let __v_363: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_38, __v_39, __v_17, __v_16, __v_34, __v_35, __v_32, __v_33, __v_31, __v_363, __v_361, __v_362, __v_211, __v_232, __v_253, __v_274, __v_295, __v_316, __v_337, __v_358]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
-                    let __v_364: G = __r_arr[0];
-                    let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
-                    let __v_365: G = __r_arr[0];
+                    let __v_56: G = __r_arr[0];
+                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_13, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                    let __v_57: G = __r_arr[0];
+                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_55, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                    let __v_58: G = __r_arr[0];
+                    let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_12, __v_58]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                    let __v_59: G = __r_arr[0];
+                    let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_59]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
+                    let __v_60: G = __r_arr[0];
+                    let __v_61: G = G::from_u64(109);
+                    let __v_62: G = G::from_u64(117);
+                    let __v_63: G = G::from_u64(108);
+                    let __v_64: G = G::from_u64(116);
+                    let __v_65: G = G::from_u64(105);
+                    let __v_66: G = G::from_u64(45);
+                    let __v_67: G = G::from_u64(115);
+                    let __v_68: G = G::from_u64(116);
+                    let __v_69: G = G::from_u64(97);
+                    let __v_70: G = G::from_u64(114);
+                    let __v_71: G = G::from_u64(107);
+                    let __v_72: G = G::from_u64(47);
+                    let __v_73: G = G::from_u64(118);
+                    let __v_74: G = G::from_u64(48);
+                    let __v_75: G = G::from_u64(0);
+                    let __v_76: G = { let __values: [G; 3] = [__v_75, __v_74, __v_60]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_77: G = G::from_u64(0);
+                    let __v_78: G = { let __values: [G; 3] = [__v_77, __v_73, __v_76]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_79: G = G::from_u64(0);
+                    let __v_80: G = { let __values: [G; 3] = [__v_79, __v_72, __v_78]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_81: G = G::from_u64(0);
+                    let __v_82: G = { let __values: [G; 3] = [__v_81, __v_71, __v_80]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_83: G = G::from_u64(0);
+                    let __v_84: G = { let __values: [G; 3] = [__v_83, __v_70, __v_82]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_85: G = G::from_u64(0);
+                    let __v_86: G = { let __values: [G; 3] = [__v_85, __v_69, __v_84]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_87: G = G::from_u64(0);
+                    let __v_88: G = { let __values: [G; 3] = [__v_87, __v_68, __v_86]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_89: G = G::from_u64(0);
+                    let __v_90: G = { let __values: [G; 3] = [__v_89, __v_67, __v_88]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_91: G = G::from_u64(0);
+                    let __v_92: G = { let __values: [G; 3] = [__v_91, __v_66, __v_90]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_93: G = G::from_u64(0);
+                    let __v_94: G = { let __values: [G; 3] = [__v_93, __v_65, __v_92]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_95: G = G::from_u64(0);
+                    let __v_96: G = { let __values: [G; 3] = [__v_95, __v_64, __v_94]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_97: G = G::from_u64(0);
+                    let __v_98: G = { let __values: [G; 3] = [__v_97, __v_63, __v_96]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_99: G = G::from_u64(0);
+                    let __v_100: G = { let __values: [G; 3] = [__v_99, __v_62, __v_98]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_101: G = G::from_u64(0);
+                    let __v_102: G = { let __values: [G; 3] = [__v_101, __v_61, __v_100]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_103: G = G::from_u64(1);
+                    let __v_104: G = G::from_u64(1);
+                    let __v_105: G = { let __values: [G; 3] = [__v_103, __v_104, __v_104]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_102, __v_105]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_106: G = __r_arr[0];
+                    let __v_107: G = __r_arr[1];
+                    let __v_108: G = __r_arr[2];
+                    let __v_109: G = __r_arr[3];
+                    let __v_110: G = __r_arr[4];
+                    let __v_111: G = __r_arr[5];
+                    let __v_112: G = __r_arr[6];
+                    let __v_113: G = __r_arr[7];
+                    let __v_114: G = __r_arr[8];
+                    let __v_115: G = __r_arr[9];
+                    let __v_116: G = __r_arr[10];
+                    let __v_117: G = __r_arr[11];
+                    let __v_118: G = __r_arr[12];
+                    let __v_119: G = __r_arr[13];
+                    let __v_120: G = __r_arr[14];
+                    let __v_121: G = __r_arr[15];
+                    let __v_122: G = __r_arr[16];
+                    let __v_123: G = __r_arr[17];
+                    let __v_124: G = G::from_u64(1);
+                    let __v_125: G = G::from_u64(1);
+                    let __v_126: G = { let __values: [G; 3] = [__v_124, __v_125, __v_125]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_126]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_127: G = __r_arr[0];
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_127]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_128: G = __r_arr[0];
+                    let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_122, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                    let __v_129: G = __r_arr[0];
+                    let __v_130: G = G::from_u64(1);
+                    let __v_131: G = G::from_u64(1);
+                    let __v_132: G = { let __values: [G; 3] = [__v_130, __v_131, __v_131]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_129, __v_132]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_133: G = __r_arr[0];
+                    let __v_134: G = __r_arr[1];
+                    let __v_135: G = __r_arr[2];
+                    let __v_136: G = __r_arr[3];
+                    let __v_137: G = __r_arr[4];
+                    let __v_138: G = __r_arr[5];
+                    let __v_139: G = __r_arr[6];
+                    let __v_140: G = __r_arr[7];
+                    let __v_141: G = __r_arr[8];
+                    let __v_142: G = __r_arr[9];
+                    let __v_143: G = __r_arr[10];
+                    let __v_144: G = __r_arr[11];
+                    let __v_145: G = __r_arr[12];
+                    let __v_146: G = __r_arr[13];
+                    let __v_147: G = __r_arr[14];
+                    let __v_148: G = __r_arr[15];
+                    let __v_149: G = __r_arr[16];
+                    let __v_150: G = __r_arr[17];
+                    let __v_151: G = G::from_u64(1);
+                    let __v_152: G = G::from_u64(1);
+                    let __v_153: G = { let __values: [G; 3] = [__v_151, __v_152, __v_152]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_153]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_154: G = __r_arr[0];
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_154]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_155: G = __r_arr[0];
+                    let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_149, __v_155]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                    let __v_156: G = __r_arr[0];
+                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_156, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                    let __v_157: G = __r_arr[0];
+                    let __v_158: G = G::from_u64(1);
+                    let __v_159: G = G::from_u64(1);
+                    let __v_160: G = { let __values: [G; 3] = [__v_158, __v_159, __v_159]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_16, __v_160]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                    let __v_161: G = __r_arr[0];
+                    let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_157, __v_161]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                    let __v_162: G = __r_arr[0];
+                    let __v_163: G = G::from_u64(1);
+                    let __v_164: G = G::from_u64(1);
+                    let __v_165: G = { let __values: [G; 3] = [__v_163, __v_164, __v_164]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_162, __v_165]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_166: G = __r_arr[0];
+                    let __v_167: G = __r_arr[1];
+                    let __v_168: G = __r_arr[2];
+                    let __v_169: G = __r_arr[3];
+                    let __v_170: G = __r_arr[4];
+                    let __v_171: G = __r_arr[5];
+                    let __v_172: G = __r_arr[6];
+                    let __v_173: G = __r_arr[7];
+                    let __v_174: G = __r_arr[8];
+                    let __v_175: G = __r_arr[9];
+                    let __v_176: G = __r_arr[10];
+                    let __v_177: G = __r_arr[11];
+                    let __v_178: G = __r_arr[12];
+                    let __v_179: G = __r_arr[13];
+                    let __v_180: G = __r_arr[14];
+                    let __v_181: G = __r_arr[15];
+                    let __v_182: G = __r_arr[16];
+                    let __v_183: G = __r_arr[17];
+                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_182, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                    let __v_184: G = __r_arr[0];
+                    let __v_185: G = G::from_u64(1);
+                    let __v_186: G = G::from_u64(1);
+                    let __v_187: G = { let __values: [G; 3] = [__v_185, __v_186, __v_186]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_184, __v_187]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_188: G = __r_arr[0];
+                    let __v_189: G = __r_arr[1];
+                    let __v_190: G = __r_arr[2];
+                    let __v_191: G = __r_arr[3];
+                    let __v_192: G = __r_arr[4];
+                    let __v_193: G = __r_arr[5];
+                    let __v_194: G = __r_arr[6];
+                    let __v_195: G = __r_arr[7];
+                    let __v_196: G = __r_arr[8];
+                    let __v_197: G = __r_arr[9];
+                    let __v_198: G = __r_arr[10];
+                    let __v_199: G = __r_arr[11];
+                    let __v_200: G = __r_arr[12];
+                    let __v_201: G = __r_arr[13];
+                    let __v_202: G = __r_arr[14];
+                    let __v_203: G = __r_arr[15];
+                    let __v_204: G = __r_arr[16];
+                    let __v_205: G = __r_arr[17];
+                    let __v_206: G = G::from_u64(256);
+                    let __v_207: G = (__v_206 * __v_107);
+                    let __v_208: G = G::from_u64(65536);
+                    let __v_209: G = (__v_208 * __v_108);
+                    let __v_210: G = G::from_u64(16777216);
+                    let __v_211: G = (__v_210 * __v_109);
+                    let __v_212: G = G::from_u64(4294967296);
+                    let __v_213: G = (__v_212 * __v_110);
+                    let __v_214: G = G::from_u64(1099511627776);
+                    let __v_215: G = (__v_214 * __v_111);
+                    let __v_216: G = G::from_u64(281474976710656);
+                    let __v_217: G = (__v_216 * __v_112);
+                    let __v_218: G = G::from_u64(72057594037927936);
+                    let __v_219: G = (__v_218 * __v_113);
+                    let __v_220: G = (__v_217 + __v_219);
+                    let __v_221: G = (__v_215 + __v_220);
+                    let __v_222: G = (__v_213 + __v_221);
+                    let __v_223: G = (__v_211 + __v_222);
+                    let __v_224: G = (__v_209 + __v_223);
+                    let __v_225: G = (__v_207 + __v_224);
+                    let __v_226: G = (__v_106 + __v_225);
+                    let __v_227: G = G::from_u64(256);
+                    let __v_228: G = (__v_227 * __v_115);
+                    let __v_229: G = G::from_u64(65536);
+                    let __v_230: G = (__v_229 * __v_116);
+                    let __v_231: G = G::from_u64(16777216);
+                    let __v_232: G = (__v_231 * __v_117);
+                    let __v_233: G = G::from_u64(4294967296);
+                    let __v_234: G = (__v_233 * __v_118);
+                    let __v_235: G = G::from_u64(1099511627776);
+                    let __v_236: G = (__v_235 * __v_119);
+                    let __v_237: G = G::from_u64(281474976710656);
+                    let __v_238: G = (__v_237 * __v_120);
+                    let __v_239: G = G::from_u64(72057594037927936);
+                    let __v_240: G = (__v_239 * __v_121);
+                    let __v_241: G = (__v_238 + __v_240);
+                    let __v_242: G = (__v_236 + __v_241);
+                    let __v_243: G = (__v_234 + __v_242);
+                    let __v_244: G = (__v_232 + __v_243);
+                    let __v_245: G = (__v_230 + __v_244);
+                    let __v_246: G = (__v_228 + __v_245);
+                    let __v_247: G = (__v_114 + __v_246);
+                    let __v_248: G = G::from_u64(256);
+                    let __v_249: G = (__v_248 * __v_134);
+                    let __v_250: G = G::from_u64(65536);
+                    let __v_251: G = (__v_250 * __v_135);
+                    let __v_252: G = G::from_u64(16777216);
+                    let __v_253: G = (__v_252 * __v_136);
+                    let __v_254: G = G::from_u64(4294967296);
+                    let __v_255: G = (__v_254 * __v_137);
+                    let __v_256: G = G::from_u64(1099511627776);
+                    let __v_257: G = (__v_256 * __v_138);
+                    let __v_258: G = G::from_u64(281474976710656);
+                    let __v_259: G = (__v_258 * __v_139);
+                    let __v_260: G = G::from_u64(72057594037927936);
+                    let __v_261: G = (__v_260 * __v_140);
+                    let __v_262: G = (__v_259 + __v_261);
+                    let __v_263: G = (__v_257 + __v_262);
+                    let __v_264: G = (__v_255 + __v_263);
+                    let __v_265: G = (__v_253 + __v_264);
+                    let __v_266: G = (__v_251 + __v_265);
+                    let __v_267: G = (__v_249 + __v_266);
+                    let __v_268: G = (__v_133 + __v_267);
+                    let __v_269: G = G::from_u64(256);
+                    let __v_270: G = (__v_269 * __v_142);
+                    let __v_271: G = G::from_u64(65536);
+                    let __v_272: G = (__v_271 * __v_143);
+                    let __v_273: G = G::from_u64(16777216);
+                    let __v_274: G = (__v_273 * __v_144);
+                    let __v_275: G = G::from_u64(4294967296);
+                    let __v_276: G = (__v_275 * __v_145);
+                    let __v_277: G = G::from_u64(1099511627776);
+                    let __v_278: G = (__v_277 * __v_146);
+                    let __v_279: G = G::from_u64(281474976710656);
+                    let __v_280: G = (__v_279 * __v_147);
+                    let __v_281: G = G::from_u64(72057594037927936);
+                    let __v_282: G = (__v_281 * __v_148);
+                    let __v_283: G = (__v_280 + __v_282);
+                    let __v_284: G = (__v_278 + __v_283);
+                    let __v_285: G = (__v_276 + __v_284);
+                    let __v_286: G = (__v_274 + __v_285);
+                    let __v_287: G = (__v_272 + __v_286);
+                    let __v_288: G = (__v_270 + __v_287);
+                    let __v_289: G = (__v_141 + __v_288);
+                    let __v_290: G = G::from_u64(256);
+                    let __v_291: G = (__v_290 * __v_167);
+                    let __v_292: G = G::from_u64(65536);
+                    let __v_293: G = (__v_292 * __v_168);
+                    let __v_294: G = G::from_u64(16777216);
+                    let __v_295: G = (__v_294 * __v_169);
+                    let __v_296: G = G::from_u64(4294967296);
+                    let __v_297: G = (__v_296 * __v_170);
+                    let __v_298: G = G::from_u64(1099511627776);
+                    let __v_299: G = (__v_298 * __v_171);
+                    let __v_300: G = G::from_u64(281474976710656);
+                    let __v_301: G = (__v_300 * __v_172);
+                    let __v_302: G = G::from_u64(72057594037927936);
+                    let __v_303: G = (__v_302 * __v_173);
+                    let __v_304: G = (__v_301 + __v_303);
+                    let __v_305: G = (__v_299 + __v_304);
+                    let __v_306: G = (__v_297 + __v_305);
+                    let __v_307: G = (__v_295 + __v_306);
+                    let __v_308: G = (__v_293 + __v_307);
+                    let __v_309: G = (__v_291 + __v_308);
+                    let __v_310: G = (__v_166 + __v_309);
+                    let __v_311: G = G::from_u64(256);
+                    let __v_312: G = (__v_311 * __v_175);
+                    let __v_313: G = G::from_u64(65536);
+                    let __v_314: G = (__v_313 * __v_176);
+                    let __v_315: G = G::from_u64(16777216);
+                    let __v_316: G = (__v_315 * __v_177);
+                    let __v_317: G = G::from_u64(4294967296);
+                    let __v_318: G = (__v_317 * __v_178);
+                    let __v_319: G = G::from_u64(1099511627776);
+                    let __v_320: G = (__v_319 * __v_179);
+                    let __v_321: G = G::from_u64(281474976710656);
+                    let __v_322: G = (__v_321 * __v_180);
+                    let __v_323: G = G::from_u64(72057594037927936);
+                    let __v_324: G = (__v_323 * __v_181);
+                    let __v_325: G = (__v_322 + __v_324);
+                    let __v_326: G = (__v_320 + __v_325);
+                    let __v_327: G = (__v_318 + __v_326);
+                    let __v_328: G = (__v_316 + __v_327);
+                    let __v_329: G = (__v_314 + __v_328);
+                    let __v_330: G = (__v_312 + __v_329);
+                    let __v_331: G = (__v_174 + __v_330);
+                    let __v_332: G = G::from_u64(256);
+                    let __v_333: G = (__v_332 * __v_189);
+                    let __v_334: G = G::from_u64(65536);
+                    let __v_335: G = (__v_334 * __v_190);
+                    let __v_336: G = G::from_u64(16777216);
+                    let __v_337: G = (__v_336 * __v_191);
+                    let __v_338: G = G::from_u64(4294967296);
+                    let __v_339: G = (__v_338 * __v_192);
+                    let __v_340: G = G::from_u64(1099511627776);
+                    let __v_341: G = (__v_340 * __v_193);
+                    let __v_342: G = G::from_u64(281474976710656);
+                    let __v_343: G = (__v_342 * __v_194);
+                    let __v_344: G = G::from_u64(72057594037927936);
+                    let __v_345: G = (__v_344 * __v_195);
+                    let __v_346: G = (__v_343 + __v_345);
+                    let __v_347: G = (__v_341 + __v_346);
+                    let __v_348: G = (__v_339 + __v_347);
+                    let __v_349: G = (__v_337 + __v_348);
+                    let __v_350: G = (__v_335 + __v_349);
+                    let __v_351: G = (__v_333 + __v_350);
+                    let __v_352: G = (__v_188 + __v_351);
+                    let __v_353: G = G::from_u64(256);
+                    let __v_354: G = (__v_353 * __v_197);
+                    let __v_355: G = G::from_u64(65536);
+                    let __v_356: G = (__v_355 * __v_198);
+                    let __v_357: G = G::from_u64(16777216);
+                    let __v_358: G = (__v_357 * __v_199);
+                    let __v_359: G = G::from_u64(4294967296);
+                    let __v_360: G = (__v_359 * __v_200);
+                    let __v_361: G = G::from_u64(1099511627776);
+                    let __v_362: G = (__v_361 * __v_201);
+                    let __v_363: G = G::from_u64(281474976710656);
+                    let __v_364: G = (__v_363 * __v_202);
+                    let __v_365: G = G::from_u64(72057594037927936);
+                    let __v_366: G = (__v_365 * __v_203);
+                    let __v_367: G = (__v_364 + __v_366);
+                    let __v_368: G = (__v_362 + __v_367);
+                    let __v_369: G = (__v_360 + __v_368);
+                    let __v_370: G = (__v_358 + __v_369);
+                    let __v_371: G = (__v_356 + __v_370);
+                    let __v_372: G = (__v_354 + __v_371);
+                    let __v_373: G = (__v_196 + __v_372);
+                    let __v_374: G = G::from_u64(0);
+                    let __v_375: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_374, __v_375, __v_36, __v_226, __v_247, __v_268, __v_289]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
+                    let __v_376: G = __r_arr[0];
+                    let __v_377: G = __r_arr[1];
+                    let __v_378: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_48, __v_49, __v_17, __v_16, __v_34, __v_35, __v_32, __v_33, __v_31, __v_378, __v_376, __v_377, __v_226, __v_247, __v_268, __v_289, __v_310, __v_331, __v_352, __v_373]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+                    let __v_379: G = __r_arr[0];
+                    let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
+                    let __v_380: G = __r_arr[0];
                     match __v_18.as_canonical_u64() {
                       _ => {
                         let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                        let __v_366: G = __r_arr[0];
-                        let __v_367: G = G::from_u64(1);
-                        let __v_368: G = G::from_u64(1);
-                        let __v_369: G = { let __values: [G; 3] = [__v_367, __v_368, __v_368]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_381: G = __r_arr[0];
+                        let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_19]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
+                        let __v_382: G = __r_arr[0];
+                        let __v_383: G = (__v_382 - __v_381);
+                        let __v_384: G = G::from_bool((__v_383 == G::ZERO));
+                        let __v_385: G = G::from_u64(1);
+                        if (__v_384 != __v_385) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_384.as_canonical_u64(), rhs: __v_385.as_canonical_u64(), msg: None });
+                        }
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_20]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_386: G = __r_arr[0];
+                        let __v_387: G = G::from_u64(3);
+                        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                        let __v_388: G = __r_arr[0];
+                        let __v_389: G = (__v_387 + __v_388);
+                        if (__v_386 != __v_389) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_386.as_canonical_u64(), rhs: __v_389.as_canonical_u64(), msg: None });
+                        }
+                        let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
+                        let __v_390: G = __r_arr[0];
+                        let __v_391: G = (__v_390 - __v_381);
+                        let __v_392: G = G::from_bool((__v_391 == G::ZERO));
+                        let __v_393: G = G::from_u64(1);
+                        if (__v_392 != __v_393) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_392.as_canonical_u64(), rhs: __v_393.as_canonical_u64(), msg: None });
+                        }
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_394: G = __r_arr[0];
+                        let __v_395: G = G::from_u64(1);
+                        if (__v_394 != __v_395) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_394.as_canonical_u64(), rhs: __v_395.as_canonical_u64(), msg: None });
+                        }
+                        let __v_396: G = G::from_u64(1);
+                        let __v_397: G = G::from_u64(1);
+                        let __v_398: G = { let __values: [G; 3] = [__v_396, __v_397, __v_397]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_32.as_canonical_u64() {
   0u64 => {
-    break '__mc_1 [__v_369];
+    break '__mc_1 [__v_398];
   },
   1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_33, __v_369]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_370: G = __r_arr[0];
-    break '__mc_1 [__v_370];
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_33, __v_398]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_399: G = __r_arr[0];
+    break '__mc_1 [__v_399];
   },
   _ => {
     return Err(ExecError::MatchNoCase(__v_32.as_canonical_u64()));
   },
 }
  };
-                        let __v_370: G = __mc_out___mc_1[0];
-                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_31, __v_370]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                        let __v_371: G = __r_arr[0];
-                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_35, __v_371]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                        let __v_372: G = __r_arr[0];
-                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_34, __v_372]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                        let __v_373: G = __r_arr[0];
-                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_189, __v_373]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                        let __v_374: G = __r_arr[0];
-                        let __v_375: G = G::from_u64(1);
-                        let __v_376: G = G::from_u64(1);
-                        let __v_377: G = { let __values: [G; 3] = [__v_375, __v_376, __v_376]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_374, __v_377]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_378: G = __r_arr[0];
-                        let __v_379: G = __r_arr[1];
-                        let __v_380: G = __r_arr[2];
-                        let __v_381: G = __r_arr[3];
-                        let __v_382: G = __r_arr[4];
-                        let __v_383: G = __r_arr[5];
-                        let __v_384: G = __r_arr[6];
-                        let __v_385: G = __r_arr[7];
-                        let __v_386: G = __r_arr[8];
-                        let __v_387: G = __r_arr[9];
-                        let __v_388: G = __r_arr[10];
-                        let __v_389: G = __r_arr[11];
-                        let __v_390: G = __r_arr[12];
-                        let __v_391: G = __r_arr[13];
-                        let __v_392: G = __r_arr[14];
-                        let __v_393: G = __r_arr[15];
-                        let __v_394: G = __r_arr[16];
-                        let __v_395: G = __r_arr[17];
-                        let __v_396: G = G::from_u64(256);
-                        let __v_397: G = (__v_396 * __v_379);
-                        let __v_398: G = G::from_u64(65536);
-                        let __v_399: G = (__v_398 * __v_380);
-                        let __v_400: G = G::from_u64(16777216);
-                        let __v_401: G = (__v_400 * __v_381);
-                        let __v_402: G = G::from_u64(4294967296);
-                        let __v_403: G = (__v_402 * __v_382);
-                        let __v_404: G = G::from_u64(1099511627776);
-                        let __v_405: G = (__v_404 * __v_383);
-                        let __v_406: G = G::from_u64(281474976710656);
-                        let __v_407: G = (__v_406 * __v_384);
-                        let __v_408: G = G::from_u64(72057594037927936);
-                        let __v_409: G = (__v_408 * __v_385);
-                        let __v_410: G = (__v_407 + __v_409);
-                        let __v_411: G = (__v_405 + __v_410);
-                        let __v_412: G = (__v_403 + __v_411);
-                        let __v_413: G = (__v_401 + __v_412);
-                        let __v_414: G = (__v_399 + __v_413);
-                        let __v_415: G = (__v_397 + __v_414);
-                        let __v_416: G = (__v_378 + __v_415);
-                        let __v_417: G = G::from_u64(256);
-                        let __v_418: G = (__v_417 * __v_387);
-                        let __v_419: G = G::from_u64(65536);
-                        let __v_420: G = (__v_419 * __v_388);
-                        let __v_421: G = G::from_u64(16777216);
-                        let __v_422: G = (__v_421 * __v_389);
-                        let __v_423: G = G::from_u64(4294967296);
-                        let __v_424: G = (__v_423 * __v_390);
-                        let __v_425: G = G::from_u64(1099511627776);
-                        let __v_426: G = (__v_425 * __v_391);
-                        let __v_427: G = G::from_u64(281474976710656);
-                        let __v_428: G = (__v_427 * __v_392);
-                        let __v_429: G = G::from_u64(72057594037927936);
-                        let __v_430: G = (__v_429 * __v_393);
-                        let __v_431: G = (__v_428 + __v_430);
-                        let __v_432: G = (__v_426 + __v_431);
-                        let __v_433: G = (__v_424 + __v_432);
-                        let __v_434: G = (__v_422 + __v_433);
-                        let __v_435: G = (__v_420 + __v_434);
-                        let __v_436: G = (__v_418 + __v_435);
-                        let __v_437: G = (__v_386 + __v_436);
-                        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_394, __v_18, __v_19, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-                        let __v_438: G = __r_arr[0];
-                        let __v_439: G = __r_arr[1];
-                        let __v_440: G = G::from_u64(1);
-                        let __v_441: G = G::from_u64(1);
-                        let __v_442: G = { let __values: [G; 3] = [__v_440, __v_441, __v_441]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_22, __v_442]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                        let __v_443: G = __r_arr[0];
-                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_439, __v_443]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                        let __v_444: G = __r_arr[0];
-                        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_444, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-                        let __v_445: G = __r_arr[0];
-                        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_445, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-                        let __v_446: G = __r_arr[0];
-                        let __v_447: G = __r_arr[1];
-                        let __v_448: G = (__v_366 + __v_0);
-                        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_446, __v_447, __v_4, __v_448]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-                        let __v_449: G = __r_arr[0];
-                        let __v_450: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_20, __v_21, __v_450, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-                        let __v_451: G = __r_arr[0];
-                        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_446, __v_447, __v_451, __v_416, __v_437, __v_34, __v_35, __v_31, __v_32, __v_33, __v_13, __v_14, __v_15, __v_40, __v_39, __v_17, __v_337, __v_358, __v_365, __v_0, __v_448, __v_438, __v_18, __v_22, __v_366]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-                        let __v_452: G = __r_arr[0];
-                        let __v_453: G = G::from_u64(0);
-                        if (__v_1 != __v_453) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_453.as_canonical_u64(), msg: None });
-                        }
-                        let __v_454: G = G::from_u64(0);
-                        if (__v_2 != __v_454) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_454.as_canonical_u64(), msg: None });
-                        }
-                        let __v_455: G = G::from_u64(1);
-                        if (__v_3 != __v_455) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_455.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
-                        let __v_456: G = __r_arr[0];
-                        let __v_457: G = G::from_u64(1);
-                        if (__v_456 != __v_457) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_456.as_canonical_u64(), rhs: __v_457.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                        let __v_458: G = __r_arr[0];
-                        let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
-                        let __v_459: G = __r_arr[0];
-                        let __v_460: G = (__v_458 - __v_459);
-                        let __v_461: G = G::from_bool((__v_460 == G::ZERO));
-                        let __v_462: G = G::from_u64(1);
-                        if (__v_461 != __v_462) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_461.as_canonical_u64(), rhs: __v_462.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
-                        let __v_463: G = __r_arr[0];
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_464: G = __r_arr[0];
-                        let __v_465: G = (__v_463 - __v_464);
-                        let __v_466: G = G::from_bool((__v_465 == G::ZERO));
-                        let __v_467: G = G::from_u64(1);
-                        if (__v_466 != __v_467) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_466.as_canonical_u64(), rhs: __v_467.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_19]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
-                        let __v_468: G = __r_arr[0];
-                        let __v_469: G = (__v_468 - __v_366);
-                        let __v_470: G = G::from_bool((__v_469 == G::ZERO));
-                        let __v_471: G = G::from_u64(1);
-                        if (__v_470 != __v_471) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_470.as_canonical_u64(), rhs: __v_471.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_20]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_399: G = __mc_out___mc_1[0];
+                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_31, __v_399]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                        let __v_400: G = __r_arr[0];
+                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_35, __v_400]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                        let __v_401: G = __r_arr[0];
+                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_34, __v_401]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                        let __v_402: G = __r_arr[0];
+                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_204, __v_402]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                        let __v_403: G = __r_arr[0];
+                        let __v_404: G = G::from_u64(1);
+                        let __v_405: G = G::from_u64(1);
+                        let __v_406: G = { let __values: [G; 3] = [__v_404, __v_405, __v_405]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_403, __v_406]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_407: G = __r_arr[0];
+                        let __v_408: G = __r_arr[1];
+                        let __v_409: G = __r_arr[2];
+                        let __v_410: G = __r_arr[3];
+                        let __v_411: G = __r_arr[4];
+                        let __v_412: G = __r_arr[5];
+                        let __v_413: G = __r_arr[6];
+                        let __v_414: G = __r_arr[7];
+                        let __v_415: G = __r_arr[8];
+                        let __v_416: G = __r_arr[9];
+                        let __v_417: G = __r_arr[10];
+                        let __v_418: G = __r_arr[11];
+                        let __v_419: G = __r_arr[12];
+                        let __v_420: G = __r_arr[13];
+                        let __v_421: G = __r_arr[14];
+                        let __v_422: G = __r_arr[15];
+                        let __v_423: G = __r_arr[16];
+                        let __v_424: G = __r_arr[17];
+                        let __v_425: G = G::from_u64(256);
+                        let __v_426: G = (__v_425 * __v_408);
+                        let __v_427: G = G::from_u64(65536);
+                        let __v_428: G = (__v_427 * __v_409);
+                        let __v_429: G = G::from_u64(16777216);
+                        let __v_430: G = (__v_429 * __v_410);
+                        let __v_431: G = G::from_u64(4294967296);
+                        let __v_432: G = (__v_431 * __v_411);
+                        let __v_433: G = G::from_u64(1099511627776);
+                        let __v_434: G = (__v_433 * __v_412);
+                        let __v_435: G = G::from_u64(281474976710656);
+                        let __v_436: G = (__v_435 * __v_413);
+                        let __v_437: G = G::from_u64(72057594037927936);
+                        let __v_438: G = (__v_437 * __v_414);
+                        let __v_439: G = (__v_436 + __v_438);
+                        let __v_440: G = (__v_434 + __v_439);
+                        let __v_441: G = (__v_432 + __v_440);
+                        let __v_442: G = (__v_430 + __v_441);
+                        let __v_443: G = (__v_428 + __v_442);
+                        let __v_444: G = (__v_426 + __v_443);
+                        let __v_445: G = (__v_407 + __v_444);
+                        let __v_446: G = G::from_u64(256);
+                        let __v_447: G = (__v_446 * __v_416);
+                        let __v_448: G = G::from_u64(65536);
+                        let __v_449: G = (__v_448 * __v_417);
+                        let __v_450: G = G::from_u64(16777216);
+                        let __v_451: G = (__v_450 * __v_418);
+                        let __v_452: G = G::from_u64(4294967296);
+                        let __v_453: G = (__v_452 * __v_419);
+                        let __v_454: G = G::from_u64(1099511627776);
+                        let __v_455: G = (__v_454 * __v_420);
+                        let __v_456: G = G::from_u64(281474976710656);
+                        let __v_457: G = (__v_456 * __v_421);
+                        let __v_458: G = G::from_u64(72057594037927936);
+                        let __v_459: G = (__v_458 * __v_422);
+                        let __v_460: G = (__v_457 + __v_459);
+                        let __v_461: G = (__v_455 + __v_460);
+                        let __v_462: G = (__v_453 + __v_461);
+                        let __v_463: G = (__v_451 + __v_462);
+                        let __v_464: G = (__v_449 + __v_463);
+                        let __v_465: G = (__v_447 + __v_464);
+                        let __v_466: G = (__v_415 + __v_465);
+                        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_423, __v_18, __v_19, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
+                        let __v_467: G = __r_arr[0];
+                        let __v_468: G = __r_arr[1];
+                        let __v_469: G = G::from_u64(1);
+                        let __v_470: G = G::from_u64(1);
+                        let __v_471: G = { let __values: [G; 3] = [__v_469, __v_470, __v_470]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_22, __v_471]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
                         let __v_472: G = __r_arr[0];
-                        let __v_473: G = G::from_u64(3);
-                        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_468, __v_472]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                        let __v_473: G = __r_arr[0];
+                        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_473, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
                         let __v_474: G = __r_arr[0];
-                        let __v_475: G = (__v_473 + __v_474);
-                        if (__v_472 != __v_475) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_472.as_canonical_u64(), rhs: __v_475.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
-                        let __v_476: G = __r_arr[0];
-                        let __v_477: G = (__v_476 - __v_366);
-                        let __v_478: G = G::from_bool((__v_477 == G::ZERO));
-                        let __v_479: G = G::from_u64(1);
-                        if (__v_478 != __v_479) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_478.as_canonical_u64(), rhs: __v_479.as_canonical_u64(), msg: None });
+                        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_474, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+                        let __v_475: G = __r_arr[0];
+                        let __v_476: G = __r_arr[1];
+                        let __v_477: G = (__v_381 + __v_0);
+                        let __v_478: G = G::from_u64(33);
+                        let __v_479: G = { let __a_val = __v_477.as_canonical_u64(); let __b_val = __v_478.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+                        let __v_480: G = G::from_u64(1);
+                        if (__v_479 != __v_480) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_479.as_canonical_u64(), rhs: __v_480.as_canonical_u64(), msg: None });
                         }
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_480: G = __r_arr[0];
-                        let __v_481: G = G::from_u64(1);
-                        if (__v_480 != __v_481) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_480.as_canonical_u64(), rhs: __v_481.as_canonical_u64(), msg: None });
+                        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_475, __v_476, __v_4, __v_477]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+                        let __v_481: G = __r_arr[0];
+                        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_20, __v_481, __v_13, __v_14, __v_15, __v_55, __v_32, __v_33, __v_49, __v_17, __v_380, __v_0, __v_477]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                        let __v_482: G = __r_arr[0];
+                        let __v_483: G = G::from_u64(1);
+                        if (__v_482 != __v_483) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_482.as_canonical_u64(), rhs: __v_483.as_canonical_u64(), msg: None });
                         }
-                        let __v_482: G = G::from_u64(33);
-                        let __v_483: G = { let __a_val = __v_448.as_canonical_u64(); let __b_val = __v_482.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-                        let __v_484: G = G::from_u64(1);
-                        if (__v_483 != __v_484) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_483.as_canonical_u64(), rhs: __v_484.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_20, __v_449, __v_13, __v_14, __v_15, __v_40, __v_32, __v_33, __v_39, __v_17, __v_365, __v_0, __v_448]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                        let __v_484: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_20, __v_21, __v_484, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
                         let __v_485: G = __r_arr[0];
-                        let __v_486: G = G::from_u64(1);
-                        if (__v_485 != __v_486) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_485.as_canonical_u64(), rhs: __v_486.as_canonical_u64(), msg: None });
-                        }
+                        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_475, __v_476, __v_485, __v_445, __v_466, __v_34, __v_35, __v_31, __v_32, __v_33, __v_13, __v_14, __v_15, __v_55, __v_49, __v_17, __v_352, __v_373, __v_380, __v_0, __v_477, __v_467, __v_18, __v_22, __v_381]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+                        let __v_486: G = __r_arr[0];
                         let __v_487: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_21, __v_18, __v_452, __v_449, __v_487, __v_448]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_21, __v_18, __v_486, __v_481, __v_487, __v_477]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
                         let __v_488: G = __r_arr[0];
                         let __ret: [G; OUT_199] = [__v_488];
                         record.function_queries[199].finish(&inp[..], &__ret[..], !unconstrained);
@@ -19475,10 +19475,10 @@ fn aiur_fn_201(
                 return Ok(__ret);
               },
               _ => {
-                let __v_13: G = G::from_u64(0);
                 let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_9, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-                let __v_14: G = __r_arr[0];
-                let __v_15: G = { let __values: [G; 8] = [__v_13, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_14]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_13: G = __r_arr[0];
+                let __v_14: G = G::from_u64(0);
+                let __v_15: G = { let __values: [G; 8] = [__v_14, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_13]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_201] = [__v_15];
                 record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -19539,10 +19539,10 @@ fn aiur_fn_202(
                 return Ok(__ret);
               },
               _ => {
-                let __v_9: G = G::from_u64(0);
                 let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_5, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-                let __v_10: G = __r_arr[0];
-                let __v_11: G = { let __values: [G; 4] = [__v_9, __v_3, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_9: G = __r_arr[0];
+                let __v_10: G = G::from_u64(0);
+                let __v_11: G = { let __values: [G; 4] = [__v_10, __v_3, __v_4, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_202] = [__v_11];
                 record.function_queries[202].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -20323,9 +20323,9 @@ fn aiur_fn_210(
     let __v_5: G = __r_arr[0];
     let __r_arr: [G; OUT_208] = { let __args: [G; IN_208] = [__v_0, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[208].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[208].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[208].bump_multiplicity(__i); } let __ret: [G; OUT_208] = unsafe { *(record.function_queries[208].output_at(__i).as_ptr() as *const [G; OUT_208]) }; __ret }, _ => aiur_fn_208(__args, record, io_buffer, __cu)? } };
     let __v_6: G = __r_arr[0];
-    let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(1);
-    let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(1);
+    let __v_8: G = G::from_u64(0);
+    let __v_9: G = { let __values: [G; 3] = [__v_8, __v_7, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_65] = { let __args: [G; IN_65] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[65].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[65].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[65].bump_multiplicity(__i); } let __ret: [G; OUT_65] = unsafe { *(record.function_queries[65].output_at(__i).as_ptr() as *const [G; OUT_65]) }; __ret }, _ => aiur_fn_65(__args, record, io_buffer, __cu)? } };
     let __v_10: G = __r_arr[0];
     let __ret: [G; OUT_210] = [__v_10];
@@ -20352,7 +20352,7 @@ fn aiur_fn_211(
     let __v_4: G = __r_arr[0];
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = { let __values: [G; 3] = [__v_6, __v_5, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_65] = { let __args: [G; IN_65] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[65].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[65].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[65].bump_multiplicity(__i); } let __ret: [G; OUT_65] = unsafe { *(record.function_queries[65].output_at(__i).as_ptr() as *const [G; OUT_65]) }; __ret }, _ => aiur_fn_65(__args, record, io_buffer, __cu)? } };
     let __v_8: G = __r_arr[0];
     let __ret: [G; OUT_211] = [__v_8];
@@ -20870,11 +20870,11 @@ fn aiur_fn_215(
         let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
         let __v_3: G = __r_arr[0];
         let __v_4: G = __r_arr[1];
-        let __v_5: G = G::from_u64(0);
+        let __v_5: G = G::from_u64(1);
         let __v_6: G = G::from_u64(1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_9: G = { let __values: [G; 3] = [__v_5, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = G::from_u64(0);
+        let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_215] = [__v_9, __v_4];
         record.function_queries[215].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -20932,12 +20932,12 @@ fn aiur_fn_216(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_4: G = G::from_u64(0);
         let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
+        let __v_4: G = __r_arr[0];
         let __r_arr: [G; OUT_216] = { let __args: [G; IN_216] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[216].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[216].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[216].bump_multiplicity(__i); } let __ret: [G; OUT_216] = unsafe { *(record.function_queries[216].output_at(__i).as_ptr() as *const [G; OUT_216]) }; __ret }, _ => aiur_fn_216(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = { let __values: [G; 3] = [__v_4, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_6, __v_4, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_216] = [__v_7];
         record.function_queries[216].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -21013,24 +21013,24 @@ fn aiur_fn_217(
             let __v_37: G = G::from_u64(0);
             let __v_38: G = G::from_u64(0);
             let __v_39: G = { let __values: [G; 32] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_40: G = G::from_u64(0);
             let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_2, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-            let __v_41: G = __r_arr[0];
+            let __v_40: G = __r_arr[0];
+            let __v_41: G = G::from_u64(1);
             let __v_42: G = G::from_u64(1);
-            let __v_43: G = G::from_u64(1);
-            let __v_44: G = { let __values: [G; 3] = [__v_42, __v_43, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_45: G = { let __values: [G; 3] = [__v_40, __v_41, __v_44]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_43: G = { let __values: [G; 3] = [__v_41, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_44: G = G::from_u64(0);
+            let __v_45: G = { let __values: [G; 3] = [__v_44, __v_40, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_217] = [__v_45];
             record.function_queries[217].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           0u64 => {
-            let __v_7: G = G::from_u64(0);
             let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
+            let __v_7: G = __r_arr[0];
             let __r_arr: [G; OUT_217] = { let __args: [G; IN_217] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[217].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[217].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[217].bump_multiplicity(__i); } let __ret: [G; OUT_217] = unsafe { *(record.function_queries[217].output_at(__i).as_ptr() as *const [G; OUT_217]) }; __ret }, _ => aiur_fn_217(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
-            let __v_10: G = { let __values: [G; 3] = [__v_7, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 3] = [__v_9, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_217] = [__v_10];
             record.function_queries[217].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -21167,44 +21167,44 @@ fn aiur_fn_220(
     let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_37]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
     let __v_38: G = __r_arr[0];
     let __v_39: G = __r_arr[1];
-    let __r_arr: [G; OUT_215] = { let __args: [G; IN_215] = [__v_39]; let __cu = unconstrained; let __hit = record.function_queries[215].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[215].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[215].bump_multiplicity(__i); } let __ret: [G; OUT_215] = unsafe { *(record.function_queries[215].output_at(__i).as_ptr() as *const [G; OUT_215]) }; __ret }, _ => aiur_fn_215(__args, record, io_buffer, __cu)? } };
-    let __v_40: G = __r_arr[0];
-    let __v_41: G = __r_arr[1];
-    let __r_arr: [G; OUT_214] = { let __args: [G; IN_214] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[214].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[214].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[214].bump_multiplicity(__i); } let __ret: [G; OUT_214] = unsafe { *(record.function_queries[214].output_at(__i).as_ptr() as *const [G; OUT_214]) }; __ret }, _ => aiur_fn_214(__args, record, io_buffer, __cu)? } };
-    let __r_arr: [G; OUT_219] = { let __args: [G; IN_219] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[219].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[219].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[219].bump_multiplicity(__i); } let __ret: [G; OUT_219] = unsafe { *(record.function_queries[219].output_at(__i).as_ptr() as *const [G; OUT_219]) }; __ret }, _ => aiur_fn_219(__args, record, io_buffer, __cu)? } };
-    let __v_42: G = __r_arr[0];
-    let __v_43: G = G::from_u64(226);
-    if (__v_38 != __v_43) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_43.as_canonical_u64(), msg: Some("aggr: tree has the wrong Ixon tag".to_string()) });
+    let __v_40: G = G::from_u64(226);
+    if (__v_38 != __v_40) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: Some("aggr: tree has the wrong Ixon tag".to_string()) });
     }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_41.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_44: G = __loaded[0];
-    let __v_45: G = __loaded[1];
-    let __v_46: G = __loaded[2];
+    let __r_arr: [G; OUT_215] = { let __args: [G; IN_215] = [__v_39]; let __cu = unconstrained; let __hit = record.function_queries[215].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[215].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[215].bump_multiplicity(__i); } let __ret: [G; OUT_215] = unsafe { *(record.function_queries[215].output_at(__i).as_ptr() as *const [G; OUT_215]) }; __ret }, _ => aiur_fn_215(__args, record, io_buffer, __cu)? } };
+    let __v_41: G = __r_arr[0];
+    let __v_42: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_42.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_43: G = __loaded[0];
+    let __v_44: G = __loaded[1];
+    let __v_45: G = __loaded[2];
+    let __v_46: G = G::from_u64(1);
     let __v_47: G = G::from_u64(1);
-    let __v_48: G = G::from_u64(1);
+    if (__v_43 != __v_46) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_46.as_canonical_u64(), msg: Some("aggr: trailing bytes after AssumptionTree".to_string()) });
+    }
     if (__v_44 != __v_47) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_44.as_canonical_u64(), rhs: __v_47.as_canonical_u64(), msg: Some("aggr: trailing bytes after AssumptionTree".to_string()) });
     }
-    if (__v_45 != __v_48) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("aggr: trailing bytes after AssumptionTree".to_string()) });
+    if (__v_45 != __v_47) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_47.as_canonical_u64(), msg: Some("aggr: trailing bytes after AssumptionTree".to_string()) });
     }
-    if (__v_46 != __v_48) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_46.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("aggr: trailing bytes after AssumptionTree".to_string()) });
-    }
-    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
-    let __v_49: G = __r_arr[0];
-    let __v_50: G = G::from_u64(0);
-    if (__v_49 != __v_50) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_49.as_canonical_u64(), rhs: __v_50.as_canonical_u64(), msg: Some("aggr: a present tree must contain at least one leaf".to_string()) });
+    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+    let __v_48: G = __r_arr[0];
+    let __v_49: G = G::from_u64(0);
+    if (__v_48 != __v_49) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_48.as_canonical_u64(), rhs: __v_49.as_canonical_u64(), msg: Some("aggr: a present tree must contain at least one leaf".to_string()) });
     }
-    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_42, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_214] = { let __args: [G; IN_214] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[214].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[214].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[214].bump_multiplicity(__i); } let __ret: [G; OUT_214] = unsafe { *(record.function_queries[214].output_at(__i).as_ptr() as *const [G; OUT_214]) }; __ret }, _ => aiur_fn_214(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_219] = { let __args: [G; IN_219] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[219].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[219].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[219].bump_multiplicity(__i); } let __ret: [G; OUT_219] = unsafe { *(record.function_queries[219].output_at(__i).as_ptr() as *const [G; OUT_219]) }; __ret }, _ => aiur_fn_219(__args, record, io_buffer, __cu)? } };
+    let __v_50: G = __r_arr[0];
+    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_50, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
     let __v_51: G = __r_arr[0];
     let __v_52: G = G::from_u64(1);
     if (__v_51 != __v_52) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_51.as_canonical_u64(), rhs: __v_52.as_canonical_u64(), msg: Some("aggr: tree leaves do not reproduce the canonical root".to_string()) });
     }
-    let __ret: [G; OUT_220] = [__v_40];
+    let __ret: [G; OUT_220] = [__v_41];
     record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -21652,32 +21652,32 @@ fn aiur_fn_227(
         let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
         let __v_3: G = __r_arr[0];
         let __v_4: G = __r_arr[1];
+        let __v_5: G = G::from_u64(2);
+        let __v_6: G = if unconstrained { Bytes2::less_than(&__v_3, &__v_5) } else { bytes2_less_than_value(__v_3, __v_5, record) };
+        let __v_7: G = G::from_u64(1);
+        if (__v_6 != __v_7) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("aggr structural: path side must be 0 or 1".to_string()) });
+        }
         let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
-        let __v_6: G = __r_arr[1];
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = __r_arr[1];
         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_3.as_canonical_u64() {
   0u64 => {
-    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_5, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    break '__mc_0 [__v_7];
+    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_8, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
+    let __v_10: G = __r_arr[0];
+    break '__mc_0 [__v_10];
   },
   _ => {
-    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_0, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    break '__mc_0 [__v_7];
+    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_0, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
+    let __v_10: G = __r_arr[0];
+    break '__mc_0 [__v_10];
   },
 }
  };
-        let __v_7: G = __mc_out___mc_0[0];
-        let __v_8: G = G::from_u64(2);
-        let __v_9: G = if unconstrained { Bytes2::less_than(&__v_3, &__v_8) } else { bytes2_less_than_value(__v_3, __v_8, record) };
-        let __v_10: G = G::from_u64(1);
-        if (__v_9 != __v_10) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("aggr structural: path side must be 0 or 1".to_string()) });
-        }
+        let __v_10: G = __mc_out___mc_0[0];
         let __v_11: G = G::from_u64(1);
         let __v_12: G = (__v_1 - __v_11);
-        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_7, __v_12, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_10, __v_12, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
         let __v_13: G = __r_arr[0];
         let __v_14: G = __r_arr[1];
         let __ret: [G; OUT_227] = [__v_13, __v_14];
@@ -21775,18 +21775,18 @@ fn aiur_fn_228(
         let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
         let __v_44: G = __r_arr[0];
         let __v_45: G = __r_arr[1];
-        let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
-        let __v_46: G = __r_arr[0];
-        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_46, __v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
-        let __v_47: G = __r_arr[0];
-        let __v_48: G = __r_arr[1];
-        let __v_49: G = G::from_u64(65);
-        let __v_50: G = if unconstrained { Bytes2::less_than(&__v_44, &__v_49) } else { bytes2_less_than_value(__v_44, __v_49, record) };
-        let __v_51: G = G::from_u64(1);
-        if (__v_50 != __v_51) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_50.as_canonical_u64(), rhs: __v_51.as_canonical_u64(), msg: Some("aggr structural: Merkle path exceeds 64 steps".to_string()) });
+        let __v_46: G = G::from_u64(65);
+        let __v_47: G = if unconstrained { Bytes2::less_than(&__v_44, &__v_46) } else { bytes2_less_than_value(__v_44, __v_46, record) };
+        let __v_48: G = G::from_u64(1);
+        if (__v_47 != __v_48) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_47.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("aggr structural: Merkle path exceeds 64 steps".to_string()) });
         }
-        let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_48.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+        let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
+        let __v_49: G = __r_arr[0];
+        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_49, __v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
+        let __v_50: G = __r_arr[0];
+        let __v_51: G = __r_arr[1];
+        let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_51.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
         let __v_52: G = __loaded[0];
         let __v_53: G = __loaded[1];
         let __v_54: G = __loaded[2];
@@ -21801,7 +21801,7 @@ fn aiur_fn_228(
         if (__v_54 != __v_56) {
           return Err(ExecError::AssertEqMismatch { lhs: __v_54.as_canonical_u64(), rhs: __v_56.as_canonical_u64(), msg: Some("aggr structural: trailing bytes after Merkle path".to_string()) });
         }
-        let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_47, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_50, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
         let __v_57: G = __r_arr[0];
         let __v_58: G = G::from_u64(1);
         if (__v_57 != __v_58) {
@@ -21950,18 +21950,18 @@ fn aiur_fn_231(
     let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
     let __v_1: G = __r_arr[0];
     let __v_2: G = __r_arr[1];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_3: G = __r_arr[0];
-    let __v_4: G = __r_arr[1];
-    let __r_arr: [G; OUT_230] = { let __args: [G; IN_230] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[230].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[230].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[230].bump_multiplicity(__i); } let __ret: [G; OUT_230] = unsafe { *(record.function_queries[230].output_at(__i).as_ptr() as *const [G; OUT_230]) }; __ret }, _ => aiur_fn_230(__args, record, io_buffer, __cu)? } };
-    let __v_5: G = __r_arr[0];
-    let __v_6: G = __r_arr[1];
-    let __v_7: G = __r_arr[2];
-    let __v_8: G = G::from_u64(229);
-    if (__v_1 != __v_8) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("aggr: claim is not CheckEnv".to_string()) });
+    let __v_3: G = G::from_u64(229);
+    if (__v_1 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("aggr: claim is not CheckEnv".to_string()) });
     }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_7.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_4: G = __r_arr[0];
+    let __v_5: G = __r_arr[1];
+    let __r_arr: [G; OUT_230] = { let __args: [G; IN_230] = [__v_5]; let __cu = unconstrained; let __hit = record.function_queries[230].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[230].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[230].bump_multiplicity(__i); } let __ret: [G; OUT_230] = unsafe { *(record.function_queries[230].output_at(__i).as_ptr() as *const [G; OUT_230]) }; __ret }, _ => aiur_fn_230(__args, record, io_buffer, __cu)? } };
+    let __v_6: G = __r_arr[0];
+    let __v_7: G = __r_arr[1];
+    let __v_8: G = __r_arr[2];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_8.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
     let __v_9: G = __loaded[0];
     let __v_10: G = __loaded[1];
     let __v_11: G = __loaded[2];
@@ -21976,7 +21976,7 @@ fn aiur_fn_231(
     if (__v_11 != __v_13) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("aggr: trailing bytes after CheckEnv claim".to_string()) });
     }
-    let __ret: [G; OUT_231] = [__v_3, __v_5, __v_6];
+    let __ret: [G; OUT_231] = [__v_4, __v_6, __v_7];
     record.function_queries[231].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -22668,23 +22668,23 @@ fn aiur_fn_237(
     let __v_244: G = __r_arr[7];
     let __v_245: G = __r_arr[8];
     let __v_246: G = __r_arr[9];
-    let __v_247: G = G::from_u64(0);
-    let __v_248: G = G::from_u64(0);
-    let __v_249: G = G::from_u64(0);
+    let __v_247: G = G::from_u64(1);
+    let __v_248: G = G::from_u64(1);
+    let __v_249: G = { let __values: [G; 10] = [__v_247, __v_248, __v_248, __v_248, __v_248, __v_248, __v_248, __v_248, __v_248, __v_248]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_250: G = G::from_u64(0);
-    let __v_251: G = G::from_u64(0);
+    let __v_251: G = { let __values: [G; 10] = [__v_250, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_244, __v_245, __v_249]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_252: G = G::from_u64(0);
-    let __v_253: G = G::from_u64(0);
-    let __v_254: G = G::from_u64(1);
-    let __v_255: G = G::from_u64(1);
-    let __v_256: G = { let __values: [G; 10] = [__v_254, __v_255, __v_255, __v_255, __v_255, __v_255, __v_255, __v_255, __v_255, __v_255]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_257: G = { let __values: [G; 10] = [__v_253, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_244, __v_245, __v_256]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_258: G = { let __values: [G; 10] = [__v_252, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_257]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_259: G = { let __values: [G; 10] = [__v_251, __v_218, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_258]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_260: G = { let __values: [G; 10] = [__v_250, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_259]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_261: G = { let __values: [G; 10] = [__v_249, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_260]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_262: G = { let __values: [G; 10] = [__v_248, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_261]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_263: G = { let __values: [G; 10] = [__v_247, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_262]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_253: G = { let __values: [G; 10] = [__v_252, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_251]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_254: G = G::from_u64(0);
+    let __v_255: G = { let __values: [G; 10] = [__v_254, __v_218, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_253]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_256: G = G::from_u64(0);
+    let __v_257: G = { let __values: [G; 10] = [__v_256, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_255]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_258: G = G::from_u64(0);
+    let __v_259: G = { let __values: [G; 10] = [__v_258, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_257]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_260: G = G::from_u64(0);
+    let __v_261: G = { let __values: [G; 10] = [__v_260, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_259]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_262: G = G::from_u64(0);
+    let __v_263: G = { let __values: [G; 10] = [__v_262, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_261]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_246]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_264: G = __r_arr[0];
     let __v_265: G = __r_arr[1];
@@ -22830,41 +22830,129 @@ fn aiur_fn_238(
     let __r_arr: [G; OUT_47] = { let __args: [G; IN_47] = [__v_63]; let __cu = unconstrained; let __hit = record.function_queries[47].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[47].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[47].bump_multiplicity(__i); } let __ret: [G; OUT_47] = unsafe { *(record.function_queries[47].output_at(__i).as_ptr() as *const [G; OUT_47]) }; __ret }, _ => aiur_fn_47(__args, record, io_buffer, __cu)? } };
     let __v_64: G = __r_arr[0];
     let __v_65: G = __r_arr[1];
-    let __v_66: G = G::from_u64(2);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_12]; let __info = io_buffer.get_info(__v_66, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_67: G = __io_pair.0;
-    let __v_68: G = __io_pair.1;
-    let __v_69: G = G::from_u64(2);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_69, __v_67, __v_68]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_70: G = __r_arr[0];
-    let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_70]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
+    let __v_66: G = (__v_14 + __v_15);
+    if (__v_65 != __v_66) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_65.as_canonical_u64(), rhs: __v_66.as_canonical_u64(), msg: None });
+    }
+    let __v_67: G = G::from_u64(2);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_12]; let __info = io_buffer.get_info(__v_67, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_68: G = __io_pair.0;
+    let __v_69: G = __io_pair.1;
+    let __v_70: G = G::from_u64(2);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_70, __v_68, __v_69]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
     let __v_71: G = __r_arr[0];
-    let __v_72: G = __r_arr[1];
-    let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_72, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
-    let __v_73: G = __r_arr[0];
-    let __v_74: G = __r_arr[1];
+    let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_71]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
+    let __v_72: G = __r_arr[0];
+    let __v_73: G = __r_arr[1];
+    let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_73, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
+    let __v_74: G = __r_arr[0];
+    let __v_75: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_75.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_76: G = __loaded[0];
+    let __v_77: G = __loaded[1];
+    let __v_78: G = __loaded[2];
+    let __v_79: G = G::from_u64(1);
+    let __v_80: G = G::from_u64(1);
+    if (__v_76 != __v_79) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_79.as_canonical_u64(), msg: None });
+    }
+    if (__v_77 != __v_80) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
+    }
+    if (__v_78 != __v_80) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_78.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
+    }
     match __v_18.as_canonical_u64() {
       _ => {
         let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-        let __v_75: G = __r_arr[0];
+        let __v_81: G = __r_arr[0];
+        let __v_82: G = G::from_bool((__v_81 == G::ZERO));
+        let __v_83: G = G::from_u64(0);
+        if (__v_82 != __v_83) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_82.as_canonical_u64(), rhs: __v_83.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_62]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_84: G = __r_arr[0];
+        if (__v_84 != __v_81) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_84.as_canonical_u64(), rhs: __v_81.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_64]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_85: G = __r_arr[0];
+        if (__v_85 != __v_81) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_81.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_57]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_86: G = __r_arr[0];
+        if (__v_86 != __v_81) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_86.as_canonical_u64(), rhs: __v_81.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_161] = { let __args: [G; IN_161] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[161].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[161].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[161].bump_multiplicity(__i); } let __ret: [G; OUT_161] = unsafe { *(record.function_queries[161].output_at(__i).as_ptr() as *const [G; OUT_161]) }; __ret }, _ => aiur_fn_161(__args, record, io_buffer, __cu)? } };
+        let __v_87: G = __r_arr[0];
+        let __v_88: G = G::from_u64(1);
+        if (__v_87 != __v_88) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_87.as_canonical_u64(), rhs: __v_88.as_canonical_u64(), msg: None });
+        }
+        let __v_89: G = G::from_u64(1);
+        let __v_90: G = G::from_u64(1);
+        if (__v_89 != __v_90) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_90.as_canonical_u64(), msg: None });
+        }
         match __v_0.as_canonical_u64() {
           _ => {
             match __v_0.as_canonical_u64() {
               _ => {
+                let __v_91: G = G::from_u64(0);
+                if (__v_1 != __v_91) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_91.as_canonical_u64(), msg: None });
+                }
+                let __v_92: G = G::from_u64(0);
+                if (__v_2 != __v_92) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_92.as_canonical_u64(), msg: None });
+                }
+                let __v_93: G = G::from_u64(1);
+                if (__v_3 != __v_93) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_93.as_canonical_u64(), msg: None });
+                }
                 match __v_18.as_canonical_u64() {
                   _ => {
+                    let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
+                    let __v_94: G = __r_arr[0];
+                    let __v_95: G = G::from_u64(1);
+                    if (__v_94 != __v_95) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_94.as_canonical_u64(), rhs: __v_95.as_canonical_u64(), msg: None });
+                    }
+                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                    let __v_96: G = __r_arr[0];
+                    let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
+                    let __v_97: G = __r_arr[0];
+                    let __v_98: G = (__v_96 - __v_97);
+                    let __v_99: G = G::from_bool((__v_98 == G::ZERO));
+                    let __v_100: G = G::from_u64(1);
+                    if (__v_99 != __v_100) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_99.as_canonical_u64(), rhs: __v_100.as_canonical_u64(), msg: None });
+                    }
                     let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_8, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-                    let __v_76: G = __r_arr[0];
+                    let __v_101: G = __r_arr[0];
                     let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_11, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-                    let __v_77: G = __r_arr[0];
+                    let __v_102: G = __r_arr[0];
+                    let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_101]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
+                    let __v_103: G = __r_arr[0];
+                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                    let __v_104: G = __r_arr[0];
+                    let __v_105: G = (__v_103 - __v_104);
+                    let __v_106: G = G::from_bool((__v_105 == G::ZERO));
+                    let __v_107: G = G::from_u64(1);
+                    if (__v_106 != __v_107) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_106.as_canonical_u64(), rhs: __v_107.as_canonical_u64(), msg: None });
+                    }
                     match __v_20.as_canonical_u64() {
                       _ => {
                         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_9.as_canonical_u64() {
   0u64 => {
-    let __v_78: G = G::from_u64(1);
-    let __v_79: G = G::from_u64(1);
-    let __v_80: G = { let __values: [G; 3] = [__v_78, __v_79, __v_79]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_0 [__v_80];
+    let __v_108: G = G::from_u64(1);
+    let __v_109: G = G::from_u64(1);
+    let __v_110: G = { let __values: [G; 3] = [__v_108, __v_109, __v_109]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_110];
   },
   1u64 => {
     break '__mc_0 [__v_10];
@@ -22874,610 +22962,522 @@ fn aiur_fn_238(
   },
 }
  };
-                        let __v_78: G = __mc_out___mc_0[0];
-                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_30, __v_70]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                        let __v_79: G = __r_arr[0];
-                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_20, __v_79]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                        let __v_80: G = __r_arr[0];
-                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_78, __v_80]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                        let __v_81: G = __r_arr[0];
-                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_18, __v_81]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                        let __v_82: G = __r_arr[0];
-                        let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_82]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
-                        let __v_83: G = __r_arr[0];
-                        let __v_84: G = G::from_u64(0);
-                        let __v_85: G = G::from_u64(109);
-                        let __v_86: G = G::from_u64(0);
-                        let __v_87: G = G::from_u64(117);
-                        let __v_88: G = G::from_u64(0);
-                        let __v_89: G = G::from_u64(108);
-                        let __v_90: G = G::from_u64(0);
-                        let __v_91: G = G::from_u64(116);
-                        let __v_92: G = G::from_u64(0);
-                        let __v_93: G = G::from_u64(105);
-                        let __v_94: G = G::from_u64(0);
-                        let __v_95: G = G::from_u64(45);
-                        let __v_96: G = G::from_u64(0);
-                        let __v_97: G = G::from_u64(115);
-                        let __v_98: G = G::from_u64(0);
-                        let __v_99: G = G::from_u64(116);
-                        let __v_100: G = G::from_u64(0);
-                        let __v_101: G = G::from_u64(97);
-                        let __v_102: G = G::from_u64(0);
-                        let __v_103: G = G::from_u64(114);
-                        let __v_104: G = G::from_u64(0);
-                        let __v_105: G = G::from_u64(107);
-                        let __v_106: G = G::from_u64(0);
-                        let __v_107: G = G::from_u64(47);
-                        let __v_108: G = G::from_u64(0);
-                        let __v_109: G = G::from_u64(118);
-                        let __v_110: G = G::from_u64(0);
-                        let __v_111: G = G::from_u64(48);
-                        let __v_112: G = { let __values: [G; 3] = [__v_110, __v_111, __v_83]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_113: G = { let __values: [G; 3] = [__v_108, __v_109, __v_112]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_114: G = { let __values: [G; 3] = [__v_106, __v_107, __v_113]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_115: G = { let __values: [G; 3] = [__v_104, __v_105, __v_114]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_116: G = { let __values: [G; 3] = [__v_102, __v_103, __v_115]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_117: G = { let __values: [G; 3] = [__v_100, __v_101, __v_116]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_118: G = { let __values: [G; 3] = [__v_98, __v_99, __v_117]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_119: G = { let __values: [G; 3] = [__v_96, __v_97, __v_118]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_120: G = { let __values: [G; 3] = [__v_94, __v_95, __v_119]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_121: G = { let __values: [G; 3] = [__v_92, __v_93, __v_120]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_122: G = { let __values: [G; 3] = [__v_90, __v_91, __v_121]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_123: G = { let __values: [G; 3] = [__v_88, __v_89, __v_122]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_124: G = { let __values: [G; 3] = [__v_86, __v_87, __v_123]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_125: G = { let __values: [G; 3] = [__v_84, __v_85, __v_124]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_126: G = G::from_u64(1);
-                        let __v_127: G = G::from_u64(1);
-                        let __v_128: G = { let __values: [G; 3] = [__v_126, __v_127, __v_127]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_125, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_129: G = __r_arr[0];
-                        let __v_130: G = __r_arr[1];
-                        let __v_131: G = __r_arr[2];
-                        let __v_132: G = __r_arr[3];
-                        let __v_133: G = __r_arr[4];
-                        let __v_134: G = __r_arr[5];
-                        let __v_135: G = __r_arr[6];
-                        let __v_136: G = __r_arr[7];
-                        let __v_137: G = __r_arr[8];
-                        let __v_138: G = __r_arr[9];
-                        let __v_139: G = __r_arr[10];
-                        let __v_140: G = __r_arr[11];
-                        let __v_141: G = __r_arr[12];
-                        let __v_142: G = __r_arr[13];
-                        let __v_143: G = __r_arr[14];
-                        let __v_144: G = __r_arr[15];
-                        let __v_145: G = __r_arr[16];
-                        let __v_146: G = __r_arr[17];
-                        let __v_147: G = G::from_u64(1);
-                        let __v_148: G = G::from_u64(1);
-                        let __v_149: G = { let __values: [G; 3] = [__v_147, __v_148, __v_148]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_149]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_150: G = __r_arr[0];
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_150]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_151: G = __r_arr[0];
-                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_145, __v_151]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                        let __v_152: G = __r_arr[0];
-                        let __v_153: G = G::from_u64(1);
-                        let __v_154: G = G::from_u64(1);
-                        let __v_155: G = { let __values: [G; 3] = [__v_153, __v_154, __v_154]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_152, __v_155]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_156: G = __r_arr[0];
-                        let __v_157: G = __r_arr[1];
-                        let __v_158: G = __r_arr[2];
-                        let __v_159: G = __r_arr[3];
-                        let __v_160: G = __r_arr[4];
-                        let __v_161: G = __r_arr[5];
-                        let __v_162: G = __r_arr[6];
-                        let __v_163: G = __r_arr[7];
-                        let __v_164: G = __r_arr[8];
-                        let __v_165: G = __r_arr[9];
-                        let __v_166: G = __r_arr[10];
-                        let __v_167: G = __r_arr[11];
-                        let __v_168: G = __r_arr[12];
-                        let __v_169: G = __r_arr[13];
-                        let __v_170: G = __r_arr[14];
-                        let __v_171: G = __r_arr[15];
-                        let __v_172: G = __r_arr[16];
-                        let __v_173: G = __r_arr[17];
-                        let __v_174: G = G::from_u64(1);
-                        let __v_175: G = G::from_u64(1);
-                        let __v_176: G = { let __values: [G; 3] = [__v_174, __v_175, __v_175]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_176]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_177: G = __r_arr[0];
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_177]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_178: G = __r_arr[0];
-                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_172, __v_178]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                        let __v_179: G = __r_arr[0];
-                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_179, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_108: G = __mc_out___mc_0[0];
+                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_30, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                        let __v_109: G = __r_arr[0];
+                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_20, __v_109]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                        let __v_110: G = __r_arr[0];
+                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_108, __v_110]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                        let __v_111: G = __r_arr[0];
+                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_18, __v_111]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                        let __v_112: G = __r_arr[0];
+                        let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_112]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
+                        let __v_113: G = __r_arr[0];
+                        let __v_114: G = G::from_u64(109);
+                        let __v_115: G = G::from_u64(117);
+                        let __v_116: G = G::from_u64(108);
+                        let __v_117: G = G::from_u64(116);
+                        let __v_118: G = G::from_u64(105);
+                        let __v_119: G = G::from_u64(45);
+                        let __v_120: G = G::from_u64(115);
+                        let __v_121: G = G::from_u64(116);
+                        let __v_122: G = G::from_u64(97);
+                        let __v_123: G = G::from_u64(114);
+                        let __v_124: G = G::from_u64(107);
+                        let __v_125: G = G::from_u64(47);
+                        let __v_126: G = G::from_u64(118);
+                        let __v_127: G = G::from_u64(48);
+                        let __v_128: G = G::from_u64(0);
+                        let __v_129: G = { let __values: [G; 3] = [__v_128, __v_127, __v_113]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_130: G = G::from_u64(0);
+                        let __v_131: G = { let __values: [G; 3] = [__v_130, __v_126, __v_129]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_132: G = G::from_u64(0);
+                        let __v_133: G = { let __values: [G; 3] = [__v_132, __v_125, __v_131]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_134: G = G::from_u64(0);
+                        let __v_135: G = { let __values: [G; 3] = [__v_134, __v_124, __v_133]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_136: G = G::from_u64(0);
+                        let __v_137: G = { let __values: [G; 3] = [__v_136, __v_123, __v_135]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_138: G = G::from_u64(0);
+                        let __v_139: G = { let __values: [G; 3] = [__v_138, __v_122, __v_137]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_140: G = G::from_u64(0);
+                        let __v_141: G = { let __values: [G; 3] = [__v_140, __v_121, __v_139]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_142: G = G::from_u64(0);
+                        let __v_143: G = { let __values: [G; 3] = [__v_142, __v_120, __v_141]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_144: G = G::from_u64(0);
+                        let __v_145: G = { let __values: [G; 3] = [__v_144, __v_119, __v_143]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_146: G = G::from_u64(0);
+                        let __v_147: G = { let __values: [G; 3] = [__v_146, __v_118, __v_145]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_148: G = G::from_u64(0);
+                        let __v_149: G = { let __values: [G; 3] = [__v_148, __v_117, __v_147]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_150: G = G::from_u64(0);
+                        let __v_151: G = { let __values: [G; 3] = [__v_150, __v_116, __v_149]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_152: G = G::from_u64(0);
+                        let __v_153: G = { let __values: [G; 3] = [__v_152, __v_115, __v_151]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_154: G = G::from_u64(0);
+                        let __v_155: G = { let __values: [G; 3] = [__v_154, __v_114, __v_153]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_156: G = G::from_u64(1);
+                        let __v_157: G = G::from_u64(1);
+                        let __v_158: G = { let __values: [G; 3] = [__v_156, __v_157, __v_157]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_155, __v_158]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_159: G = __r_arr[0];
+                        let __v_160: G = __r_arr[1];
+                        let __v_161: G = __r_arr[2];
+                        let __v_162: G = __r_arr[3];
+                        let __v_163: G = __r_arr[4];
+                        let __v_164: G = __r_arr[5];
+                        let __v_165: G = __r_arr[6];
+                        let __v_166: G = __r_arr[7];
+                        let __v_167: G = __r_arr[8];
+                        let __v_168: G = __r_arr[9];
+                        let __v_169: G = __r_arr[10];
+                        let __v_170: G = __r_arr[11];
+                        let __v_171: G = __r_arr[12];
+                        let __v_172: G = __r_arr[13];
+                        let __v_173: G = __r_arr[14];
+                        let __v_174: G = __r_arr[15];
+                        let __v_175: G = __r_arr[16];
+                        let __v_176: G = __r_arr[17];
+                        let __v_177: G = G::from_u64(1);
+                        let __v_178: G = G::from_u64(1);
+                        let __v_179: G = { let __values: [G; 3] = [__v_177, __v_178, __v_178]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_179]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
                         let __v_180: G = __r_arr[0];
-                        let __v_181: G = G::from_u64(1);
-                        let __v_182: G = G::from_u64(1);
-                        let __v_183: G = { let __values: [G; 3] = [__v_181, __v_182, __v_182]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_26, __v_183]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                        let __v_184: G = __r_arr[0];
-                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_180, __v_184]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                        let __v_185: G = __r_arr[0];
-                        let __v_186: G = G::from_u64(1);
-                        let __v_187: G = G::from_u64(1);
-                        let __v_188: G = { let __values: [G; 3] = [__v_186, __v_187, __v_187]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_185, __v_188]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_189: G = __r_arr[0];
-                        let __v_190: G = __r_arr[1];
-                        let __v_191: G = __r_arr[2];
-                        let __v_192: G = __r_arr[3];
-                        let __v_193: G = __r_arr[4];
-                        let __v_194: G = __r_arr[5];
-                        let __v_195: G = __r_arr[6];
-                        let __v_196: G = __r_arr[7];
-                        let __v_197: G = __r_arr[8];
-                        let __v_198: G = __r_arr[9];
-                        let __v_199: G = __r_arr[10];
-                        let __v_200: G = __r_arr[11];
-                        let __v_201: G = __r_arr[12];
-                        let __v_202: G = __r_arr[13];
-                        let __v_203: G = __r_arr[14];
-                        let __v_204: G = __r_arr[15];
-                        let __v_205: G = __r_arr[16];
-                        let __v_206: G = __r_arr[17];
-                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_205, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_180]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_181: G = __r_arr[0];
+                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_175, __v_181]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                        let __v_182: G = __r_arr[0];
+                        let __v_183: G = G::from_u64(1);
+                        let __v_184: G = G::from_u64(1);
+                        let __v_185: G = { let __values: [G; 3] = [__v_183, __v_184, __v_184]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_182, __v_185]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_186: G = __r_arr[0];
+                        let __v_187: G = __r_arr[1];
+                        let __v_188: G = __r_arr[2];
+                        let __v_189: G = __r_arr[3];
+                        let __v_190: G = __r_arr[4];
+                        let __v_191: G = __r_arr[5];
+                        let __v_192: G = __r_arr[6];
+                        let __v_193: G = __r_arr[7];
+                        let __v_194: G = __r_arr[8];
+                        let __v_195: G = __r_arr[9];
+                        let __v_196: G = __r_arr[10];
+                        let __v_197: G = __r_arr[11];
+                        let __v_198: G = __r_arr[12];
+                        let __v_199: G = __r_arr[13];
+                        let __v_200: G = __r_arr[14];
+                        let __v_201: G = __r_arr[15];
+                        let __v_202: G = __r_arr[16];
+                        let __v_203: G = __r_arr[17];
+                        let __v_204: G = G::from_u64(1);
+                        let __v_205: G = G::from_u64(1);
+                        let __v_206: G = { let __values: [G; 3] = [__v_204, __v_205, __v_205]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_206]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
                         let __v_207: G = __r_arr[0];
-                        let __v_208: G = G::from_u64(1);
-                        let __v_209: G = G::from_u64(1);
-                        let __v_210: G = { let __values: [G; 3] = [__v_208, __v_209, __v_209]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_207, __v_210]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_211: G = __r_arr[0];
-                        let __v_212: G = __r_arr[1];
-                        let __v_213: G = __r_arr[2];
-                        let __v_214: G = __r_arr[3];
-                        let __v_215: G = __r_arr[4];
-                        let __v_216: G = __r_arr[5];
-                        let __v_217: G = __r_arr[6];
-                        let __v_218: G = __r_arr[7];
-                        let __v_219: G = __r_arr[8];
-                        let __v_220: G = __r_arr[9];
-                        let __v_221: G = __r_arr[10];
-                        let __v_222: G = __r_arr[11];
-                        let __v_223: G = __r_arr[12];
-                        let __v_224: G = __r_arr[13];
-                        let __v_225: G = __r_arr[14];
-                        let __v_226: G = __r_arr[15];
-                        let __v_227: G = __r_arr[16];
-                        let __v_228: G = __r_arr[17];
-                        let __v_229: G = G::from_u64(256);
-                        let __v_230: G = (__v_229 * __v_130);
-                        let __v_231: G = G::from_u64(65536);
-                        let __v_232: G = (__v_231 * __v_131);
-                        let __v_233: G = G::from_u64(16777216);
-                        let __v_234: G = (__v_233 * __v_132);
-                        let __v_235: G = G::from_u64(4294967296);
-                        let __v_236: G = (__v_235 * __v_133);
-                        let __v_237: G = G::from_u64(1099511627776);
-                        let __v_238: G = (__v_237 * __v_134);
-                        let __v_239: G = G::from_u64(281474976710656);
-                        let __v_240: G = (__v_239 * __v_135);
-                        let __v_241: G = G::from_u64(72057594037927936);
-                        let __v_242: G = (__v_241 * __v_136);
-                        let __v_243: G = (__v_240 + __v_242);
-                        let __v_244: G = (__v_238 + __v_243);
-                        let __v_245: G = (__v_236 + __v_244);
-                        let __v_246: G = (__v_234 + __v_245);
-                        let __v_247: G = (__v_232 + __v_246);
-                        let __v_248: G = (__v_230 + __v_247);
-                        let __v_249: G = (__v_129 + __v_248);
-                        let __v_250: G = G::from_u64(256);
-                        let __v_251: G = (__v_250 * __v_138);
-                        let __v_252: G = G::from_u64(65536);
-                        let __v_253: G = (__v_252 * __v_139);
-                        let __v_254: G = G::from_u64(16777216);
-                        let __v_255: G = (__v_254 * __v_140);
-                        let __v_256: G = G::from_u64(4294967296);
-                        let __v_257: G = (__v_256 * __v_141);
-                        let __v_258: G = G::from_u64(1099511627776);
-                        let __v_259: G = (__v_258 * __v_142);
-                        let __v_260: G = G::from_u64(281474976710656);
-                        let __v_261: G = (__v_260 * __v_143);
-                        let __v_262: G = G::from_u64(72057594037927936);
-                        let __v_263: G = (__v_262 * __v_144);
-                        let __v_264: G = (__v_261 + __v_263);
-                        let __v_265: G = (__v_259 + __v_264);
-                        let __v_266: G = (__v_257 + __v_265);
-                        let __v_267: G = (__v_255 + __v_266);
-                        let __v_268: G = (__v_253 + __v_267);
-                        let __v_269: G = (__v_251 + __v_268);
-                        let __v_270: G = (__v_137 + __v_269);
-                        let __v_271: G = G::from_u64(256);
-                        let __v_272: G = (__v_271 * __v_157);
-                        let __v_273: G = G::from_u64(65536);
-                        let __v_274: G = (__v_273 * __v_158);
-                        let __v_275: G = G::from_u64(16777216);
-                        let __v_276: G = (__v_275 * __v_159);
-                        let __v_277: G = G::from_u64(4294967296);
-                        let __v_278: G = (__v_277 * __v_160);
-                        let __v_279: G = G::from_u64(1099511627776);
-                        let __v_280: G = (__v_279 * __v_161);
-                        let __v_281: G = G::from_u64(281474976710656);
-                        let __v_282: G = (__v_281 * __v_162);
-                        let __v_283: G = G::from_u64(72057594037927936);
-                        let __v_284: G = (__v_283 * __v_163);
-                        let __v_285: G = (__v_282 + __v_284);
-                        let __v_286: G = (__v_280 + __v_285);
-                        let __v_287: G = (__v_278 + __v_286);
-                        let __v_288: G = (__v_276 + __v_287);
-                        let __v_289: G = (__v_274 + __v_288);
-                        let __v_290: G = (__v_272 + __v_289);
-                        let __v_291: G = (__v_156 + __v_290);
-                        let __v_292: G = G::from_u64(256);
-                        let __v_293: G = (__v_292 * __v_165);
-                        let __v_294: G = G::from_u64(65536);
-                        let __v_295: G = (__v_294 * __v_166);
-                        let __v_296: G = G::from_u64(16777216);
-                        let __v_297: G = (__v_296 * __v_167);
-                        let __v_298: G = G::from_u64(4294967296);
-                        let __v_299: G = (__v_298 * __v_168);
-                        let __v_300: G = G::from_u64(1099511627776);
-                        let __v_301: G = (__v_300 * __v_169);
-                        let __v_302: G = G::from_u64(281474976710656);
-                        let __v_303: G = (__v_302 * __v_170);
-                        let __v_304: G = G::from_u64(72057594037927936);
-                        let __v_305: G = (__v_304 * __v_171);
-                        let __v_306: G = (__v_303 + __v_305);
-                        let __v_307: G = (__v_301 + __v_306);
-                        let __v_308: G = (__v_299 + __v_307);
-                        let __v_309: G = (__v_297 + __v_308);
-                        let __v_310: G = (__v_295 + __v_309);
-                        let __v_311: G = (__v_293 + __v_310);
-                        let __v_312: G = (__v_164 + __v_311);
-                        let __v_313: G = G::from_u64(256);
-                        let __v_314: G = (__v_313 * __v_190);
-                        let __v_315: G = G::from_u64(65536);
-                        let __v_316: G = (__v_315 * __v_191);
-                        let __v_317: G = G::from_u64(16777216);
-                        let __v_318: G = (__v_317 * __v_192);
-                        let __v_319: G = G::from_u64(4294967296);
-                        let __v_320: G = (__v_319 * __v_193);
-                        let __v_321: G = G::from_u64(1099511627776);
-                        let __v_322: G = (__v_321 * __v_194);
-                        let __v_323: G = G::from_u64(281474976710656);
-                        let __v_324: G = (__v_323 * __v_195);
-                        let __v_325: G = G::from_u64(72057594037927936);
-                        let __v_326: G = (__v_325 * __v_196);
-                        let __v_327: G = (__v_324 + __v_326);
-                        let __v_328: G = (__v_322 + __v_327);
-                        let __v_329: G = (__v_320 + __v_328);
-                        let __v_330: G = (__v_318 + __v_329);
-                        let __v_331: G = (__v_316 + __v_330);
-                        let __v_332: G = (__v_314 + __v_331);
-                        let __v_333: G = (__v_189 + __v_332);
-                        let __v_334: G = G::from_u64(256);
-                        let __v_335: G = (__v_334 * __v_198);
-                        let __v_336: G = G::from_u64(65536);
-                        let __v_337: G = (__v_336 * __v_199);
-                        let __v_338: G = G::from_u64(16777216);
-                        let __v_339: G = (__v_338 * __v_200);
-                        let __v_340: G = G::from_u64(4294967296);
-                        let __v_341: G = (__v_340 * __v_201);
-                        let __v_342: G = G::from_u64(1099511627776);
-                        let __v_343: G = (__v_342 * __v_202);
-                        let __v_344: G = G::from_u64(281474976710656);
-                        let __v_345: G = (__v_344 * __v_203);
-                        let __v_346: G = G::from_u64(72057594037927936);
-                        let __v_347: G = (__v_346 * __v_204);
-                        let __v_348: G = (__v_345 + __v_347);
-                        let __v_349: G = (__v_343 + __v_348);
-                        let __v_350: G = (__v_341 + __v_349);
-                        let __v_351: G = (__v_339 + __v_350);
-                        let __v_352: G = (__v_337 + __v_351);
-                        let __v_353: G = (__v_335 + __v_352);
-                        let __v_354: G = (__v_197 + __v_353);
-                        let __v_355: G = G::from_u64(256);
-                        let __v_356: G = (__v_355 * __v_212);
-                        let __v_357: G = G::from_u64(65536);
-                        let __v_358: G = (__v_357 * __v_213);
-                        let __v_359: G = G::from_u64(16777216);
-                        let __v_360: G = (__v_359 * __v_214);
-                        let __v_361: G = G::from_u64(4294967296);
-                        let __v_362: G = (__v_361 * __v_215);
-                        let __v_363: G = G::from_u64(1099511627776);
-                        let __v_364: G = (__v_363 * __v_216);
-                        let __v_365: G = G::from_u64(281474976710656);
-                        let __v_366: G = (__v_365 * __v_217);
-                        let __v_367: G = G::from_u64(72057594037927936);
-                        let __v_368: G = (__v_367 * __v_218);
-                        let __v_369: G = (__v_366 + __v_368);
-                        let __v_370: G = (__v_364 + __v_369);
-                        let __v_371: G = (__v_362 + __v_370);
-                        let __v_372: G = (__v_360 + __v_371);
-                        let __v_373: G = (__v_358 + __v_372);
-                        let __v_374: G = (__v_356 + __v_373);
-                        let __v_375: G = (__v_211 + __v_374);
-                        let __v_376: G = G::from_u64(256);
-                        let __v_377: G = (__v_376 * __v_220);
-                        let __v_378: G = G::from_u64(65536);
-                        let __v_379: G = (__v_378 * __v_221);
-                        let __v_380: G = G::from_u64(16777216);
-                        let __v_381: G = (__v_380 * __v_222);
-                        let __v_382: G = G::from_u64(4294967296);
-                        let __v_383: G = (__v_382 * __v_223);
-                        let __v_384: G = G::from_u64(1099511627776);
-                        let __v_385: G = (__v_384 * __v_224);
-                        let __v_386: G = G::from_u64(281474976710656);
-                        let __v_387: G = (__v_386 * __v_225);
-                        let __v_388: G = G::from_u64(72057594037927936);
-                        let __v_389: G = (__v_388 * __v_226);
-                        let __v_390: G = (__v_387 + __v_389);
-                        let __v_391: G = (__v_385 + __v_390);
-                        let __v_392: G = (__v_383 + __v_391);
-                        let __v_393: G = (__v_381 + __v_392);
-                        let __v_394: G = (__v_379 + __v_393);
-                        let __v_395: G = (__v_377 + __v_394);
-                        let __v_396: G = (__v_219 + __v_395);
-                        let __v_397: G = G::from_u64(0);
-                        let __v_398: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_397, __v_398, __v_73, __v_249, __v_270, __v_291, __v_312]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
-                        let __v_399: G = __r_arr[0];
-                        let __v_400: G = __r_arr[1];
-                        let __v_401: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_76, __v_77, __v_30, __v_26, __v_62, __v_64, __v_59, __v_60, __v_57, __v_401, __v_399, __v_400, __v_249, __v_270, __v_291, __v_312, __v_333, __v_354, __v_375, __v_396]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
-                        let __v_402: G = __r_arr[0];
-                        let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_76]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
-                        let __v_403: G = __r_arr[0];
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_207]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_208: G = __r_arr[0];
+                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_202, __v_208]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                        let __v_209: G = __r_arr[0];
+                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_209, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_210: G = __r_arr[0];
+                        let __v_211: G = G::from_u64(1);
+                        let __v_212: G = G::from_u64(1);
+                        let __v_213: G = { let __values: [G; 3] = [__v_211, __v_212, __v_212]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_26, __v_213]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                        let __v_214: G = __r_arr[0];
+                        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_210, __v_214]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                        let __v_215: G = __r_arr[0];
+                        let __v_216: G = G::from_u64(1);
+                        let __v_217: G = G::from_u64(1);
+                        let __v_218: G = { let __values: [G; 3] = [__v_216, __v_217, __v_217]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_215, __v_218]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_219: G = __r_arr[0];
+                        let __v_220: G = __r_arr[1];
+                        let __v_221: G = __r_arr[2];
+                        let __v_222: G = __r_arr[3];
+                        let __v_223: G = __r_arr[4];
+                        let __v_224: G = __r_arr[5];
+                        let __v_225: G = __r_arr[6];
+                        let __v_226: G = __r_arr[7];
+                        let __v_227: G = __r_arr[8];
+                        let __v_228: G = __r_arr[9];
+                        let __v_229: G = __r_arr[10];
+                        let __v_230: G = __r_arr[11];
+                        let __v_231: G = __r_arr[12];
+                        let __v_232: G = __r_arr[13];
+                        let __v_233: G = __r_arr[14];
+                        let __v_234: G = __r_arr[15];
+                        let __v_235: G = __r_arr[16];
+                        let __v_236: G = __r_arr[17];
+                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_235, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_237: G = __r_arr[0];
+                        let __v_238: G = G::from_u64(1);
+                        let __v_239: G = G::from_u64(1);
+                        let __v_240: G = { let __values: [G; 3] = [__v_238, __v_239, __v_239]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_237, __v_240]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_241: G = __r_arr[0];
+                        let __v_242: G = __r_arr[1];
+                        let __v_243: G = __r_arr[2];
+                        let __v_244: G = __r_arr[3];
+                        let __v_245: G = __r_arr[4];
+                        let __v_246: G = __r_arr[5];
+                        let __v_247: G = __r_arr[6];
+                        let __v_248: G = __r_arr[7];
+                        let __v_249: G = __r_arr[8];
+                        let __v_250: G = __r_arr[9];
+                        let __v_251: G = __r_arr[10];
+                        let __v_252: G = __r_arr[11];
+                        let __v_253: G = __r_arr[12];
+                        let __v_254: G = __r_arr[13];
+                        let __v_255: G = __r_arr[14];
+                        let __v_256: G = __r_arr[15];
+                        let __v_257: G = __r_arr[16];
+                        let __v_258: G = __r_arr[17];
+                        let __v_259: G = G::from_u64(256);
+                        let __v_260: G = (__v_259 * __v_160);
+                        let __v_261: G = G::from_u64(65536);
+                        let __v_262: G = (__v_261 * __v_161);
+                        let __v_263: G = G::from_u64(16777216);
+                        let __v_264: G = (__v_263 * __v_162);
+                        let __v_265: G = G::from_u64(4294967296);
+                        let __v_266: G = (__v_265 * __v_163);
+                        let __v_267: G = G::from_u64(1099511627776);
+                        let __v_268: G = (__v_267 * __v_164);
+                        let __v_269: G = G::from_u64(281474976710656);
+                        let __v_270: G = (__v_269 * __v_165);
+                        let __v_271: G = G::from_u64(72057594037927936);
+                        let __v_272: G = (__v_271 * __v_166);
+                        let __v_273: G = (__v_270 + __v_272);
+                        let __v_274: G = (__v_268 + __v_273);
+                        let __v_275: G = (__v_266 + __v_274);
+                        let __v_276: G = (__v_264 + __v_275);
+                        let __v_277: G = (__v_262 + __v_276);
+                        let __v_278: G = (__v_260 + __v_277);
+                        let __v_279: G = (__v_159 + __v_278);
+                        let __v_280: G = G::from_u64(256);
+                        let __v_281: G = (__v_280 * __v_168);
+                        let __v_282: G = G::from_u64(65536);
+                        let __v_283: G = (__v_282 * __v_169);
+                        let __v_284: G = G::from_u64(16777216);
+                        let __v_285: G = (__v_284 * __v_170);
+                        let __v_286: G = G::from_u64(4294967296);
+                        let __v_287: G = (__v_286 * __v_171);
+                        let __v_288: G = G::from_u64(1099511627776);
+                        let __v_289: G = (__v_288 * __v_172);
+                        let __v_290: G = G::from_u64(281474976710656);
+                        let __v_291: G = (__v_290 * __v_173);
+                        let __v_292: G = G::from_u64(72057594037927936);
+                        let __v_293: G = (__v_292 * __v_174);
+                        let __v_294: G = (__v_291 + __v_293);
+                        let __v_295: G = (__v_289 + __v_294);
+                        let __v_296: G = (__v_287 + __v_295);
+                        let __v_297: G = (__v_285 + __v_296);
+                        let __v_298: G = (__v_283 + __v_297);
+                        let __v_299: G = (__v_281 + __v_298);
+                        let __v_300: G = (__v_167 + __v_299);
+                        let __v_301: G = G::from_u64(256);
+                        let __v_302: G = (__v_301 * __v_187);
+                        let __v_303: G = G::from_u64(65536);
+                        let __v_304: G = (__v_303 * __v_188);
+                        let __v_305: G = G::from_u64(16777216);
+                        let __v_306: G = (__v_305 * __v_189);
+                        let __v_307: G = G::from_u64(4294967296);
+                        let __v_308: G = (__v_307 * __v_190);
+                        let __v_309: G = G::from_u64(1099511627776);
+                        let __v_310: G = (__v_309 * __v_191);
+                        let __v_311: G = G::from_u64(281474976710656);
+                        let __v_312: G = (__v_311 * __v_192);
+                        let __v_313: G = G::from_u64(72057594037927936);
+                        let __v_314: G = (__v_313 * __v_193);
+                        let __v_315: G = (__v_312 + __v_314);
+                        let __v_316: G = (__v_310 + __v_315);
+                        let __v_317: G = (__v_308 + __v_316);
+                        let __v_318: G = (__v_306 + __v_317);
+                        let __v_319: G = (__v_304 + __v_318);
+                        let __v_320: G = (__v_302 + __v_319);
+                        let __v_321: G = (__v_186 + __v_320);
+                        let __v_322: G = G::from_u64(256);
+                        let __v_323: G = (__v_322 * __v_195);
+                        let __v_324: G = G::from_u64(65536);
+                        let __v_325: G = (__v_324 * __v_196);
+                        let __v_326: G = G::from_u64(16777216);
+                        let __v_327: G = (__v_326 * __v_197);
+                        let __v_328: G = G::from_u64(4294967296);
+                        let __v_329: G = (__v_328 * __v_198);
+                        let __v_330: G = G::from_u64(1099511627776);
+                        let __v_331: G = (__v_330 * __v_199);
+                        let __v_332: G = G::from_u64(281474976710656);
+                        let __v_333: G = (__v_332 * __v_200);
+                        let __v_334: G = G::from_u64(72057594037927936);
+                        let __v_335: G = (__v_334 * __v_201);
+                        let __v_336: G = (__v_333 + __v_335);
+                        let __v_337: G = (__v_331 + __v_336);
+                        let __v_338: G = (__v_329 + __v_337);
+                        let __v_339: G = (__v_327 + __v_338);
+                        let __v_340: G = (__v_325 + __v_339);
+                        let __v_341: G = (__v_323 + __v_340);
+                        let __v_342: G = (__v_194 + __v_341);
+                        let __v_343: G = G::from_u64(256);
+                        let __v_344: G = (__v_343 * __v_220);
+                        let __v_345: G = G::from_u64(65536);
+                        let __v_346: G = (__v_345 * __v_221);
+                        let __v_347: G = G::from_u64(16777216);
+                        let __v_348: G = (__v_347 * __v_222);
+                        let __v_349: G = G::from_u64(4294967296);
+                        let __v_350: G = (__v_349 * __v_223);
+                        let __v_351: G = G::from_u64(1099511627776);
+                        let __v_352: G = (__v_351 * __v_224);
+                        let __v_353: G = G::from_u64(281474976710656);
+                        let __v_354: G = (__v_353 * __v_225);
+                        let __v_355: G = G::from_u64(72057594037927936);
+                        let __v_356: G = (__v_355 * __v_226);
+                        let __v_357: G = (__v_354 + __v_356);
+                        let __v_358: G = (__v_352 + __v_357);
+                        let __v_359: G = (__v_350 + __v_358);
+                        let __v_360: G = (__v_348 + __v_359);
+                        let __v_361: G = (__v_346 + __v_360);
+                        let __v_362: G = (__v_344 + __v_361);
+                        let __v_363: G = (__v_219 + __v_362);
+                        let __v_364: G = G::from_u64(256);
+                        let __v_365: G = (__v_364 * __v_228);
+                        let __v_366: G = G::from_u64(65536);
+                        let __v_367: G = (__v_366 * __v_229);
+                        let __v_368: G = G::from_u64(16777216);
+                        let __v_369: G = (__v_368 * __v_230);
+                        let __v_370: G = G::from_u64(4294967296);
+                        let __v_371: G = (__v_370 * __v_231);
+                        let __v_372: G = G::from_u64(1099511627776);
+                        let __v_373: G = (__v_372 * __v_232);
+                        let __v_374: G = G::from_u64(281474976710656);
+                        let __v_375: G = (__v_374 * __v_233);
+                        let __v_376: G = G::from_u64(72057594037927936);
+                        let __v_377: G = (__v_376 * __v_234);
+                        let __v_378: G = (__v_375 + __v_377);
+                        let __v_379: G = (__v_373 + __v_378);
+                        let __v_380: G = (__v_371 + __v_379);
+                        let __v_381: G = (__v_369 + __v_380);
+                        let __v_382: G = (__v_367 + __v_381);
+                        let __v_383: G = (__v_365 + __v_382);
+                        let __v_384: G = (__v_227 + __v_383);
+                        let __v_385: G = G::from_u64(256);
+                        let __v_386: G = (__v_385 * __v_242);
+                        let __v_387: G = G::from_u64(65536);
+                        let __v_388: G = (__v_387 * __v_243);
+                        let __v_389: G = G::from_u64(16777216);
+                        let __v_390: G = (__v_389 * __v_244);
+                        let __v_391: G = G::from_u64(4294967296);
+                        let __v_392: G = (__v_391 * __v_245);
+                        let __v_393: G = G::from_u64(1099511627776);
+                        let __v_394: G = (__v_393 * __v_246);
+                        let __v_395: G = G::from_u64(281474976710656);
+                        let __v_396: G = (__v_395 * __v_247);
+                        let __v_397: G = G::from_u64(72057594037927936);
+                        let __v_398: G = (__v_397 * __v_248);
+                        let __v_399: G = (__v_396 + __v_398);
+                        let __v_400: G = (__v_394 + __v_399);
+                        let __v_401: G = (__v_392 + __v_400);
+                        let __v_402: G = (__v_390 + __v_401);
+                        let __v_403: G = (__v_388 + __v_402);
+                        let __v_404: G = (__v_386 + __v_403);
+                        let __v_405: G = (__v_241 + __v_404);
+                        let __v_406: G = G::from_u64(256);
+                        let __v_407: G = (__v_406 * __v_250);
+                        let __v_408: G = G::from_u64(65536);
+                        let __v_409: G = (__v_408 * __v_251);
+                        let __v_410: G = G::from_u64(16777216);
+                        let __v_411: G = (__v_410 * __v_252);
+                        let __v_412: G = G::from_u64(4294967296);
+                        let __v_413: G = (__v_412 * __v_253);
+                        let __v_414: G = G::from_u64(1099511627776);
+                        let __v_415: G = (__v_414 * __v_254);
+                        let __v_416: G = G::from_u64(281474976710656);
+                        let __v_417: G = (__v_416 * __v_255);
+                        let __v_418: G = G::from_u64(72057594037927936);
+                        let __v_419: G = (__v_418 * __v_256);
+                        let __v_420: G = (__v_417 + __v_419);
+                        let __v_421: G = (__v_415 + __v_420);
+                        let __v_422: G = (__v_413 + __v_421);
+                        let __v_423: G = (__v_411 + __v_422);
+                        let __v_424: G = (__v_409 + __v_423);
+                        let __v_425: G = (__v_407 + __v_424);
+                        let __v_426: G = (__v_249 + __v_425);
+                        let __v_427: G = G::from_u64(0);
+                        let __v_428: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_427, __v_428, __v_74, __v_279, __v_300, __v_321, __v_342]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
+                        let __v_429: G = __r_arr[0];
+                        let __v_430: G = __r_arr[1];
+                        let __v_431: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_101, __v_102, __v_30, __v_26, __v_62, __v_64, __v_59, __v_60, __v_57, __v_431, __v_429, __v_430, __v_279, __v_300, __v_321, __v_342, __v_363, __v_384, __v_405, __v_426]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+                        let __v_432: G = __r_arr[0];
+                        let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_101]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
+                        let __v_433: G = __r_arr[0];
                         match __v_34.as_canonical_u64() {
                           _ => {
                             let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_34]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_404: G = __r_arr[0];
-                            let __v_405: G = G::from_u64(1);
-                            let __v_406: G = G::from_u64(1);
-                            let __v_407: G = { let __values: [G; 3] = [__v_405, __v_406, __v_406]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_434: G = __r_arr[0];
+                            let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_36]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
+                            let __v_435: G = __r_arr[0];
+                            let __v_436: G = (__v_435 - __v_434);
+                            let __v_437: G = G::from_bool((__v_436 == G::ZERO));
+                            let __v_438: G = G::from_u64(1);
+                            if (__v_437 != __v_438) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_437.as_canonical_u64(), rhs: __v_438.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_439: G = __r_arr[0];
+                            let __v_440: G = G::from_u64(3);
+                            let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_59, __v_60]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                            let __v_441: G = __r_arr[0];
+                            let __v_442: G = (__v_440 + __v_441);
+                            if (__v_439 != __v_442) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_439.as_canonical_u64(), rhs: __v_442.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_44]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
+                            let __v_443: G = __r_arr[0];
+                            let __v_444: G = (__v_443 - __v_434);
+                            let __v_445: G = G::from_bool((__v_444 == G::ZERO));
+                            let __v_446: G = G::from_u64(1);
+                            if (__v_445 != __v_446) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_445.as_canonical_u64(), rhs: __v_446.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_46]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_447: G = __r_arr[0];
+                            let __v_448: G = G::from_u64(1);
+                            if (__v_447 != __v_448) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_447.as_canonical_u64(), rhs: __v_448.as_canonical_u64(), msg: None });
+                            }
+                            let __v_449: G = G::from_u64(1);
+                            let __v_450: G = G::from_u64(1);
+                            let __v_451: G = { let __values: [G; 3] = [__v_449, __v_450, __v_450]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_59.as_canonical_u64() {
   0u64 => {
-    break '__mc_1 [__v_407];
+    break '__mc_1 [__v_451];
   },
   1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_60, __v_407]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_408: G = __r_arr[0];
-    break '__mc_1 [__v_408];
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_60, __v_451]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_452: G = __r_arr[0];
+    break '__mc_1 [__v_452];
   },
   _ => {
     return Err(ExecError::MatchNoCase(__v_59.as_canonical_u64()));
   },
 }
  };
-                            let __v_408: G = __mc_out___mc_1[0];
-                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_57, __v_408]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                            let __v_409: G = __r_arr[0];
-                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_64, __v_409]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                            let __v_410: G = __r_arr[0];
-                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_62, __v_410]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                            let __v_411: G = __r_arr[0];
-                            let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_227, __v_411]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                            let __v_412: G = __r_arr[0];
-                            let __v_413: G = G::from_u64(1);
-                            let __v_414: G = G::from_u64(1);
-                            let __v_415: G = { let __values: [G; 3] = [__v_413, __v_414, __v_414]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_412, __v_415]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                            let __v_416: G = __r_arr[0];
-                            let __v_417: G = __r_arr[1];
-                            let __v_418: G = __r_arr[2];
-                            let __v_419: G = __r_arr[3];
-                            let __v_420: G = __r_arr[4];
-                            let __v_421: G = __r_arr[5];
-                            let __v_422: G = __r_arr[6];
-                            let __v_423: G = __r_arr[7];
-                            let __v_424: G = __r_arr[8];
-                            let __v_425: G = __r_arr[9];
-                            let __v_426: G = __r_arr[10];
-                            let __v_427: G = __r_arr[11];
-                            let __v_428: G = __r_arr[12];
-                            let __v_429: G = __r_arr[13];
-                            let __v_430: G = __r_arr[14];
-                            let __v_431: G = __r_arr[15];
-                            let __v_432: G = __r_arr[16];
-                            let __v_433: G = __r_arr[17];
-                            let __v_434: G = G::from_u64(256);
-                            let __v_435: G = (__v_434 * __v_417);
-                            let __v_436: G = G::from_u64(65536);
-                            let __v_437: G = (__v_436 * __v_418);
-                            let __v_438: G = G::from_u64(16777216);
-                            let __v_439: G = (__v_438 * __v_419);
-                            let __v_440: G = G::from_u64(4294967296);
-                            let __v_441: G = (__v_440 * __v_420);
-                            let __v_442: G = G::from_u64(1099511627776);
-                            let __v_443: G = (__v_442 * __v_421);
-                            let __v_444: G = G::from_u64(281474976710656);
-                            let __v_445: G = (__v_444 * __v_422);
-                            let __v_446: G = G::from_u64(72057594037927936);
-                            let __v_447: G = (__v_446 * __v_423);
-                            let __v_448: G = (__v_445 + __v_447);
-                            let __v_449: G = (__v_443 + __v_448);
-                            let __v_450: G = (__v_441 + __v_449);
-                            let __v_451: G = (__v_439 + __v_450);
-                            let __v_452: G = (__v_437 + __v_451);
-                            let __v_453: G = (__v_435 + __v_452);
-                            let __v_454: G = (__v_416 + __v_453);
-                            let __v_455: G = G::from_u64(256);
-                            let __v_456: G = (__v_455 * __v_425);
-                            let __v_457: G = G::from_u64(65536);
-                            let __v_458: G = (__v_457 * __v_426);
-                            let __v_459: G = G::from_u64(16777216);
-                            let __v_460: G = (__v_459 * __v_427);
-                            let __v_461: G = G::from_u64(4294967296);
-                            let __v_462: G = (__v_461 * __v_428);
-                            let __v_463: G = G::from_u64(1099511627776);
-                            let __v_464: G = (__v_463 * __v_429);
-                            let __v_465: G = G::from_u64(281474976710656);
-                            let __v_466: G = (__v_465 * __v_430);
-                            let __v_467: G = G::from_u64(72057594037927936);
-                            let __v_468: G = (__v_467 * __v_431);
-                            let __v_469: G = (__v_466 + __v_468);
-                            let __v_470: G = (__v_464 + __v_469);
-                            let __v_471: G = (__v_462 + __v_470);
-                            let __v_472: G = (__v_460 + __v_471);
-                            let __v_473: G = (__v_458 + __v_472);
-                            let __v_474: G = (__v_456 + __v_473);
-                            let __v_475: G = (__v_424 + __v_474);
-                            let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_432, __v_34, __v_36, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-                            let __v_476: G = __r_arr[0];
-                            let __v_477: G = __r_arr[1];
-                            let __v_478: G = G::from_u64(1);
-                            let __v_479: G = G::from_u64(1);
-                            let __v_480: G = { let __values: [G; 3] = [__v_478, __v_479, __v_479]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_46, __v_480]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                            let __v_481: G = __r_arr[0];
-                            let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_477, __v_481]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-                            let __v_482: G = __r_arr[0];
-                            let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_482, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-                            let __v_483: G = __r_arr[0];
-                            let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_483, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-                            let __v_484: G = __r_arr[0];
-                            let __v_485: G = __r_arr[1];
-                            let __v_486: G = (__v_404 + __v_0);
-                            let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_484, __v_485, __v_4, __v_486]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-                            let __v_487: G = __r_arr[0];
-                            let __v_488: G = G::from_u64(0);
-                            let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_40, __v_44, __v_488, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-                            let __v_489: G = __r_arr[0];
-                            let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_484, __v_485, __v_489, __v_454, __v_475, __v_62, __v_64, __v_57, __v_59, __v_60, __v_20, __v_22, __v_24, __v_78, __v_77, __v_30, __v_375, __v_396, __v_403, __v_0, __v_486, __v_476, __v_34, __v_46, __v_404]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-                            let __v_490: G = __r_arr[0];
-                            let __v_491: G = (__v_14 + __v_15);
-                            if (__v_65 != __v_491) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_65.as_canonical_u64(), rhs: __v_491.as_canonical_u64(), msg: None });
-                            }
-                            let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_74.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-                            let __v_492: G = __loaded[0];
-                            let __v_493: G = __loaded[1];
-                            let __v_494: G = __loaded[2];
-                            let __v_495: G = G::from_u64(1);
-                            let __v_496: G = G::from_u64(1);
-                            if (__v_492 != __v_495) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_492.as_canonical_u64(), rhs: __v_495.as_canonical_u64(), msg: None });
-                            }
-                            if (__v_493 != __v_496) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_493.as_canonical_u64(), rhs: __v_496.as_canonical_u64(), msg: None });
-                            }
-                            if (__v_494 != __v_496) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_494.as_canonical_u64(), rhs: __v_496.as_canonical_u64(), msg: None });
-                            }
-                            let __v_497: G = G::from_bool((__v_75 == G::ZERO));
-                            let __v_498: G = G::from_u64(0);
-                            if (__v_497 != __v_498) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_497.as_canonical_u64(), rhs: __v_498.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_62]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_499: G = __r_arr[0];
-                            if (__v_499 != __v_75) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_499.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_64]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_500: G = __r_arr[0];
-                            if (__v_500 != __v_75) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_500.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_57]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_501: G = __r_arr[0];
-                            if (__v_501 != __v_75) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_501.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_161] = { let __args: [G; IN_161] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[161].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[161].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[161].bump_multiplicity(__i); } let __ret: [G; OUT_161] = unsafe { *(record.function_queries[161].output_at(__i).as_ptr() as *const [G; OUT_161]) }; __ret }, _ => aiur_fn_161(__args, record, io_buffer, __cu)? } };
-                            let __v_502: G = __r_arr[0];
-                            let __v_503: G = G::from_u64(1);
-                            if (__v_502 != __v_503) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_502.as_canonical_u64(), rhs: __v_503.as_canonical_u64(), msg: None });
-                            }
-                            let __v_504: G = G::from_u64(1);
-                            let __v_505: G = G::from_u64(1);
-                            if (__v_504 != __v_505) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_504.as_canonical_u64(), rhs: __v_505.as_canonical_u64(), msg: None });
-                            }
-                            let __v_506: G = G::from_u64(0);
-                            if (__v_1 != __v_506) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_506.as_canonical_u64(), msg: None });
-                            }
-                            let __v_507: G = G::from_u64(0);
-                            if (__v_2 != __v_507) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_507.as_canonical_u64(), msg: None });
-                            }
-                            let __v_508: G = G::from_u64(1);
-                            if (__v_3 != __v_508) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_508.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
-                            let __v_509: G = __r_arr[0];
-                            let __v_510: G = G::from_u64(1);
-                            if (__v_509 != __v_510) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_509.as_canonical_u64(), rhs: __v_510.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_511: G = __r_arr[0];
-                            let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
-                            let __v_512: G = __r_arr[0];
-                            let __v_513: G = (__v_511 - __v_512);
-                            let __v_514: G = G::from_bool((__v_513 == G::ZERO));
-                            let __v_515: G = G::from_u64(1);
-                            if (__v_514 != __v_515) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_514.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_257] = { let __args: [G; IN_257] = [__v_76]; let __cu = unconstrained; let __hit = record.function_queries[257].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[257].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[257].bump_multiplicity(__i); } let __ret: [G; OUT_257] = unsafe { *(record.function_queries[257].output_at(__i).as_ptr() as *const [G; OUT_257]) }; __ret }, _ => aiur_fn_257(__args, record, io_buffer, __cu)? } };
-                            let __v_516: G = __r_arr[0];
-                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                            let __v_517: G = __r_arr[0];
-                            let __v_518: G = (__v_516 - __v_517);
-                            let __v_519: G = G::from_bool((__v_518 == G::ZERO));
-                            let __v_520: G = G::from_u64(1);
-                            if (__v_519 != __v_520) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_519.as_canonical_u64(), rhs: __v_520.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_36]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
-                            let __v_521: G = __r_arr[0];
-                            let __v_522: G = (__v_521 - __v_404);
-                            let __v_523: G = G::from_bool((__v_522 == G::ZERO));
-                            let __v_524: G = G::from_u64(1);
-                            if (__v_523 != __v_524) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_523.as_canonical_u64(), rhs: __v_524.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_452: G = __mc_out___mc_1[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_57, __v_452]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_453: G = __r_arr[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_64, __v_453]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_454: G = __r_arr[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_62, __v_454]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_455: G = __r_arr[0];
+                            let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_257, __v_455]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                            let __v_456: G = __r_arr[0];
+                            let __v_457: G = G::from_u64(1);
+                            let __v_458: G = G::from_u64(1);
+                            let __v_459: G = { let __values: [G; 3] = [__v_457, __v_458, __v_458]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_456, __v_459]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                            let __v_460: G = __r_arr[0];
+                            let __v_461: G = __r_arr[1];
+                            let __v_462: G = __r_arr[2];
+                            let __v_463: G = __r_arr[3];
+                            let __v_464: G = __r_arr[4];
+                            let __v_465: G = __r_arr[5];
+                            let __v_466: G = __r_arr[6];
+                            let __v_467: G = __r_arr[7];
+                            let __v_468: G = __r_arr[8];
+                            let __v_469: G = __r_arr[9];
+                            let __v_470: G = __r_arr[10];
+                            let __v_471: G = __r_arr[11];
+                            let __v_472: G = __r_arr[12];
+                            let __v_473: G = __r_arr[13];
+                            let __v_474: G = __r_arr[14];
+                            let __v_475: G = __r_arr[15];
+                            let __v_476: G = __r_arr[16];
+                            let __v_477: G = __r_arr[17];
+                            let __v_478: G = G::from_u64(256);
+                            let __v_479: G = (__v_478 * __v_461);
+                            let __v_480: G = G::from_u64(65536);
+                            let __v_481: G = (__v_480 * __v_462);
+                            let __v_482: G = G::from_u64(16777216);
+                            let __v_483: G = (__v_482 * __v_463);
+                            let __v_484: G = G::from_u64(4294967296);
+                            let __v_485: G = (__v_484 * __v_464);
+                            let __v_486: G = G::from_u64(1099511627776);
+                            let __v_487: G = (__v_486 * __v_465);
+                            let __v_488: G = G::from_u64(281474976710656);
+                            let __v_489: G = (__v_488 * __v_466);
+                            let __v_490: G = G::from_u64(72057594037927936);
+                            let __v_491: G = (__v_490 * __v_467);
+                            let __v_492: G = (__v_489 + __v_491);
+                            let __v_493: G = (__v_487 + __v_492);
+                            let __v_494: G = (__v_485 + __v_493);
+                            let __v_495: G = (__v_483 + __v_494);
+                            let __v_496: G = (__v_481 + __v_495);
+                            let __v_497: G = (__v_479 + __v_496);
+                            let __v_498: G = (__v_460 + __v_497);
+                            let __v_499: G = G::from_u64(256);
+                            let __v_500: G = (__v_499 * __v_469);
+                            let __v_501: G = G::from_u64(65536);
+                            let __v_502: G = (__v_501 * __v_470);
+                            let __v_503: G = G::from_u64(16777216);
+                            let __v_504: G = (__v_503 * __v_471);
+                            let __v_505: G = G::from_u64(4294967296);
+                            let __v_506: G = (__v_505 * __v_472);
+                            let __v_507: G = G::from_u64(1099511627776);
+                            let __v_508: G = (__v_507 * __v_473);
+                            let __v_509: G = G::from_u64(281474976710656);
+                            let __v_510: G = (__v_509 * __v_474);
+                            let __v_511: G = G::from_u64(72057594037927936);
+                            let __v_512: G = (__v_511 * __v_475);
+                            let __v_513: G = (__v_510 + __v_512);
+                            let __v_514: G = (__v_508 + __v_513);
+                            let __v_515: G = (__v_506 + __v_514);
+                            let __v_516: G = (__v_504 + __v_515);
+                            let __v_517: G = (__v_502 + __v_516);
+                            let __v_518: G = (__v_500 + __v_517);
+                            let __v_519: G = (__v_468 + __v_518);
+                            let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_476, __v_34, __v_36, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
+                            let __v_520: G = __r_arr[0];
+                            let __v_521: G = __r_arr[1];
+                            let __v_522: G = G::from_u64(1);
+                            let __v_523: G = G::from_u64(1);
+                            let __v_524: G = { let __values: [G; 3] = [__v_522, __v_523, __v_523]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_46, __v_524]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
                             let __v_525: G = __r_arr[0];
-                            let __v_526: G = G::from_u64(3);
-                            let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_59, __v_60]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                            let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_521, __v_525]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+                            let __v_526: G = __r_arr[0];
+                            let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_526, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
                             let __v_527: G = __r_arr[0];
-                            let __v_528: G = (__v_526 + __v_527);
-                            if (__v_525 != __v_528) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_525.as_canonical_u64(), rhs: __v_528.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_44]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
-                            let __v_529: G = __r_arr[0];
-                            let __v_530: G = (__v_529 - __v_404);
-                            let __v_531: G = G::from_bool((__v_530 == G::ZERO));
-                            let __v_532: G = G::from_u64(1);
-                            if (__v_531 != __v_532) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_531.as_canonical_u64(), rhs: __v_532.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_46]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                            let __v_533: G = __r_arr[0];
-                            let __v_534: G = G::from_u64(1);
-                            if (__v_533 != __v_534) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_533.as_canonical_u64(), rhs: __v_534.as_canonical_u64(), msg: None });
+                            let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_527, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+                            let __v_528: G = __r_arr[0];
+                            let __v_529: G = __r_arr[1];
+                            let __v_530: G = (__v_434 + __v_0);
+                            let __v_531: G = G::from_u64(33);
+                            let __v_532: G = { let __a_val = __v_530.as_canonical_u64(); let __b_val = __v_531.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+                            let __v_533: G = G::from_u64(1);
+                            if (__v_532 != __v_533) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_532.as_canonical_u64(), rhs: __v_533.as_canonical_u64(), msg: None });
                             }
-                            let __v_535: G = G::from_u64(33);
-                            let __v_536: G = { let __a_val = __v_486.as_canonical_u64(); let __b_val = __v_535.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-                            let __v_537: G = G::from_u64(1);
-                            if (__v_536 != __v_537) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_536.as_canonical_u64(), rhs: __v_537.as_canonical_u64(), msg: None });
+                            let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_528, __v_529, __v_4, __v_530]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+                            let __v_534: G = __r_arr[0];
+                            let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_40, __v_534, __v_20, __v_22, __v_24, __v_108, __v_59, __v_60, __v_102, __v_30, __v_433, __v_0, __v_530]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                            let __v_535: G = __r_arr[0];
+                            let __v_536: G = G::from_u64(1);
+                            if (__v_535 != __v_536) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_535.as_canonical_u64(), rhs: __v_536.as_canonical_u64(), msg: None });
                             }
-                            let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_40, __v_487, __v_20, __v_22, __v_24, __v_78, __v_59, __v_60, __v_77, __v_30, __v_403, __v_0, __v_486]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                            let __v_537: G = G::from_u64(0);
+                            let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_40, __v_44, __v_537, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
                             let __v_538: G = __r_arr[0];
-                            let __v_539: G = G::from_u64(1);
-                            if (__v_538 != __v_539) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_538.as_canonical_u64(), rhs: __v_539.as_canonical_u64(), msg: None });
-                            }
+                            let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_528, __v_529, __v_538, __v_498, __v_519, __v_62, __v_64, __v_57, __v_59, __v_60, __v_20, __v_22, __v_24, __v_108, __v_102, __v_30, __v_405, __v_426, __v_433, __v_0, __v_530, __v_520, __v_34, __v_46, __v_434]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+                            let __v_539: G = __r_arr[0];
                             let __v_540: G = G::from_u64(0);
-                            let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_44, __v_34, __v_490, __v_487, __v_540, __v_486]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                            let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_44, __v_34, __v_539, __v_534, __v_540, __v_530]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
                             let __v_541: G = __r_arr[0];
                             let __v_542: G = G::from_u64(1);
                             if (__v_541 != __v_542) {
                               return Err(ExecError::AssertEqMismatch { lhs: __v_541.as_canonical_u64(), rhs: __v_542.as_canonical_u64(), msg: None });
                             }
-                            let __ret: [G; OUT_238] = [__v_73];
+                            let __ret: [G; OUT_238] = [__v_74];
                             record.function_queries[238].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -23586,29 +23586,29 @@ fn aiur_fn_239(
         return Ok(__ret);
       },
       _ => {
-        let __v_45: G = G::from_u64(2);
-        let __r_arr: [G; OUT_234] = { let __args: [G; IN_234] = [__v_41, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[234].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[234].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[234].bump_multiplicity(__i); } let __ret: [G; OUT_234] = unsafe { *(record.function_queries[234].output_at(__i).as_ptr() as *const [G; OUT_234]) }; __ret }, _ => aiur_fn_234(__args, record, io_buffer, __cu)? } };
-        let __v_46: G = __r_arr[0];
-        let __v_47: G = __r_arr[1];
-        let __v_48: G = __r_arr[2];
-        let __v_49: G = __r_arr[3];
-        let __v_50: G = __r_arr[4];
-        let __v_51: G = __r_arr[5];
-        let __v_52: G = __r_arr[6];
-        let __v_53: G = __r_arr[7];
-        let __r_arr: [G; OUT_235] = { let __args: [G; IN_235] = [__v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[235].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[235].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[235].bump_multiplicity(__i); } let __ret: [G; OUT_235] = unsafe { *(record.function_queries[235].output_at(__i).as_ptr() as *const [G; OUT_235]) }; __ret }, _ => aiur_fn_235(__args, record, io_buffer, __cu)? } };
         let __r_arr: [G; OUT_250] = { let __args: [G; IN_250] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[250].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[250].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[250].bump_multiplicity(__i); } let __ret: [G; OUT_250] = unsafe { *(record.function_queries[250].output_at(__i).as_ptr() as *const [G; OUT_250]) }; __ret }, _ => aiur_fn_250(__args, record, io_buffer, __cu)? } };
-        let __v_54: G = __r_arr[0];
-        let __v_55: G = G::from_u64(18);
-        if (__v_54 != __v_55) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_54.as_canonical_u64(), rhs: __v_55.as_canonical_u64(), msg: Some("aggr: recursive child must expose an 18-word ix_aggr claim".to_string()) });
+        let __v_45: G = __r_arr[0];
+        let __v_46: G = G::from_u64(18);
+        if (__v_45 != __v_46) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_46.as_canonical_u64(), msg: Some("aggr: recursive child must expose an 18-word ix_aggr claim".to_string()) });
         }
-        let __v_56: G = G::from_u64(1);
-        let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_41, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
-        let __v_57: G = __r_arr[0];
-        if (__v_57 != __v_19) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("aggr: recursive child has the wrong entrypoint".to_string()) });
+        let __v_47: G = G::from_u64(1);
+        let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_41, __v_47]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
+        let __v_48: G = __r_arr[0];
+        if (__v_48 != __v_19) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_48.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("aggr: recursive child has the wrong entrypoint".to_string()) });
         }
+        let __v_49: G = G::from_u64(2);
+        let __r_arr: [G; OUT_234] = { let __args: [G; IN_234] = [__v_41, __v_49]; let __cu = unconstrained; let __hit = record.function_queries[234].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[234].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[234].bump_multiplicity(__i); } let __ret: [G; OUT_234] = unsafe { *(record.function_queries[234].output_at(__i).as_ptr() as *const [G; OUT_234]) }; __ret }, _ => aiur_fn_234(__args, record, io_buffer, __cu)? } };
+        let __v_50: G = __r_arr[0];
+        let __v_51: G = __r_arr[1];
+        let __v_52: G = __r_arr[2];
+        let __v_53: G = __r_arr[3];
+        let __v_54: G = __r_arr[4];
+        let __v_55: G = __r_arr[5];
+        let __v_56: G = __r_arr[6];
+        let __v_57: G = __r_arr[7];
+        let __r_arr: [G; OUT_235] = { let __args: [G; IN_235] = [__v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[235].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[235].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[235].bump_multiplicity(__i); } let __ret: [G; OUT_235] = unsafe { *(record.function_queries[235].output_at(__i).as_ptr() as *const [G; OUT_235]) }; __ret }, _ => aiur_fn_235(__args, record, io_buffer, __cu)? } };
         let __v_58: G = G::from_u64(10);
         let __r_arr: [G; OUT_234] = { let __args: [G; IN_234] = [__v_41, __v_58]; let __cu = unconstrained; let __hit = record.function_queries[234].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[234].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[234].bump_multiplicity(__i); } let __ret: [G; OUT_234] = unsafe { *(record.function_queries[234].output_at(__i).as_ptr() as *const [G; OUT_234]) }; __ret }, _ => aiur_fn_234(__args, record, io_buffer, __cu)? } };
         let __v_59: G = __r_arr[0];
@@ -23860,120 +23860,120 @@ fn aiur_fn_241(
     let __v_148: G = __r_arr[29];
     let __v_149: G = __r_arr[30];
     let __v_150: G = __r_arr[31];
-    let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_67]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
-    let __v_151: G = __r_arr[0];
-    let __v_152: G = __r_arr[1];
-    let __v_153: G = __r_arr[2];
-    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_55]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
-    let __v_154: G = __r_arr[0];
-    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_59]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
-    let __v_155: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_56, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_156: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_60, __v_61]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_157: G = __r_arr[0];
-    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_151]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
-    let __v_158: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_152, __v_153]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_159: G = __r_arr[0];
-    let __r_arr: [G; OUT_223] = { let __args: [G; IN_223] = [__v_154, __v_155, __v_158]; let __cu = unconstrained; let __hit = record.function_queries[223].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[223].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[223].bump_multiplicity(__i); } let __ret: [G; OUT_223] = unsafe { *(record.function_queries[223].output_at(__i).as_ptr() as *const [G; OUT_223]) }; __ret }, _ => aiur_fn_223(__args, record, io_buffer, __cu)? } };
-    let __r_arr: [G; OUT_226] = { let __args: [G; IN_226] = [__v_156, __v_157, __v_158, __v_159]; let __cu = unconstrained; let __hit = record.function_queries[226].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[226].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[226].bump_multiplicity(__i); } let __ret: [G; OUT_226] = unsafe { *(record.function_queries[226].output_at(__i).as_ptr() as *const [G; OUT_226]) }; __ret }, _ => aiur_fn_226(__args, record, io_buffer, __cu)? } };
+    let __v_151: G = G::from_u64(256);
+    let __v_152: G = (__v_151 * __v_120);
+    let __v_153: G = G::from_u64(65536);
+    let __v_154: G = (__v_153 * __v_121);
+    let __v_155: G = G::from_u64(16777216);
+    let __v_156: G = (__v_155 * __v_122);
+    let __v_157: G = (__v_154 + __v_156);
+    let __v_158: G = (__v_152 + __v_157);
+    let __v_159: G = (__v_119 + __v_158);
     let __v_160: G = G::from_u64(256);
-    let __v_161: G = (__v_160 * __v_120);
+    let __v_161: G = (__v_160 * __v_124);
     let __v_162: G = G::from_u64(65536);
-    let __v_163: G = (__v_162 * __v_121);
+    let __v_163: G = (__v_162 * __v_125);
     let __v_164: G = G::from_u64(16777216);
-    let __v_165: G = (__v_164 * __v_122);
+    let __v_165: G = (__v_164 * __v_126);
     let __v_166: G = (__v_163 + __v_165);
     let __v_167: G = (__v_161 + __v_166);
-    let __v_168: G = (__v_119 + __v_167);
+    let __v_168: G = (__v_123 + __v_167);
     let __v_169: G = G::from_u64(256);
-    let __v_170: G = (__v_169 * __v_124);
+    let __v_170: G = (__v_169 * __v_128);
     let __v_171: G = G::from_u64(65536);
-    let __v_172: G = (__v_171 * __v_125);
+    let __v_172: G = (__v_171 * __v_129);
     let __v_173: G = G::from_u64(16777216);
-    let __v_174: G = (__v_173 * __v_126);
+    let __v_174: G = (__v_173 * __v_130);
     let __v_175: G = (__v_172 + __v_174);
     let __v_176: G = (__v_170 + __v_175);
-    let __v_177: G = (__v_123 + __v_176);
+    let __v_177: G = (__v_127 + __v_176);
     let __v_178: G = G::from_u64(256);
-    let __v_179: G = (__v_178 * __v_128);
+    let __v_179: G = (__v_178 * __v_132);
     let __v_180: G = G::from_u64(65536);
-    let __v_181: G = (__v_180 * __v_129);
+    let __v_181: G = (__v_180 * __v_133);
     let __v_182: G = G::from_u64(16777216);
-    let __v_183: G = (__v_182 * __v_130);
+    let __v_183: G = (__v_182 * __v_134);
     let __v_184: G = (__v_181 + __v_183);
     let __v_185: G = (__v_179 + __v_184);
-    let __v_186: G = (__v_127 + __v_185);
+    let __v_186: G = (__v_131 + __v_185);
     let __v_187: G = G::from_u64(256);
-    let __v_188: G = (__v_187 * __v_132);
+    let __v_188: G = (__v_187 * __v_136);
     let __v_189: G = G::from_u64(65536);
-    let __v_190: G = (__v_189 * __v_133);
+    let __v_190: G = (__v_189 * __v_137);
     let __v_191: G = G::from_u64(16777216);
-    let __v_192: G = (__v_191 * __v_134);
+    let __v_192: G = (__v_191 * __v_138);
     let __v_193: G = (__v_190 + __v_192);
     let __v_194: G = (__v_188 + __v_193);
-    let __v_195: G = (__v_131 + __v_194);
+    let __v_195: G = (__v_135 + __v_194);
     let __v_196: G = G::from_u64(256);
-    let __v_197: G = (__v_196 * __v_136);
+    let __v_197: G = (__v_196 * __v_140);
     let __v_198: G = G::from_u64(65536);
-    let __v_199: G = (__v_198 * __v_137);
+    let __v_199: G = (__v_198 * __v_141);
     let __v_200: G = G::from_u64(16777216);
-    let __v_201: G = (__v_200 * __v_138);
+    let __v_201: G = (__v_200 * __v_142);
     let __v_202: G = (__v_199 + __v_201);
     let __v_203: G = (__v_197 + __v_202);
-    let __v_204: G = (__v_135 + __v_203);
+    let __v_204: G = (__v_139 + __v_203);
     let __v_205: G = G::from_u64(256);
-    let __v_206: G = (__v_205 * __v_140);
+    let __v_206: G = (__v_205 * __v_144);
     let __v_207: G = G::from_u64(65536);
-    let __v_208: G = (__v_207 * __v_141);
+    let __v_208: G = (__v_207 * __v_145);
     let __v_209: G = G::from_u64(16777216);
-    let __v_210: G = (__v_209 * __v_142);
+    let __v_210: G = (__v_209 * __v_146);
     let __v_211: G = (__v_208 + __v_210);
     let __v_212: G = (__v_206 + __v_211);
-    let __v_213: G = (__v_139 + __v_212);
+    let __v_213: G = (__v_143 + __v_212);
     let __v_214: G = G::from_u64(256);
-    let __v_215: G = (__v_214 * __v_144);
+    let __v_215: G = (__v_214 * __v_148);
     let __v_216: G = G::from_u64(65536);
-    let __v_217: G = (__v_216 * __v_145);
+    let __v_217: G = (__v_216 * __v_149);
     let __v_218: G = G::from_u64(16777216);
-    let __v_219: G = (__v_218 * __v_146);
+    let __v_219: G = (__v_218 * __v_150);
     let __v_220: G = (__v_217 + __v_219);
     let __v_221: G = (__v_215 + __v_220);
-    let __v_222: G = (__v_143 + __v_221);
-    let __v_223: G = G::from_u64(256);
-    let __v_224: G = (__v_223 * __v_148);
-    let __v_225: G = G::from_u64(65536);
-    let __v_226: G = (__v_225 * __v_149);
-    let __v_227: G = G::from_u64(16777216);
-    let __v_228: G = (__v_227 * __v_150);
-    let __v_229: G = (__v_226 + __v_228);
-    let __v_230: G = (__v_224 + __v_229);
-    let __v_231: G = (__v_147 + __v_230);
-    if (__v_168 != __v_28) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    let __v_222: G = (__v_147 + __v_221);
+    if (__v_159 != __v_28) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_159.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_177 != __v_29) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_168 != __v_29) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_186 != __v_30) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_186.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_177 != __v_30) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_195 != __v_31) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_195.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_186 != __v_31) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_186.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_204 != __v_32) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_204.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_195 != __v_32) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_195.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_213 != __v_33) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_213.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_204 != __v_33) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_204.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_222 != __v_34) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_222.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_213 != __v_34) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_213.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
-    if (__v_231 != __v_35) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_231.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
+    if (__v_222 != __v_35) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_222.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("aggr: output claim digest mismatch".to_string()) });
     }
+    let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_67]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
+    let __v_223: G = __r_arr[0];
+    let __v_224: G = __r_arr[1];
+    let __v_225: G = __r_arr[2];
+    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_55]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_226: G = __r_arr[0];
+    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_59]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_227: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_56, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_228: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_60, __v_61]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_229: G = __r_arr[0];
+    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_223]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_230: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_224, __v_225]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_231: G = __r_arr[0];
+    let __r_arr: [G; OUT_223] = { let __args: [G; IN_223] = [__v_226, __v_227, __v_230]; let __cu = unconstrained; let __hit = record.function_queries[223].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[223].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[223].bump_multiplicity(__i); } let __ret: [G; OUT_223] = unsafe { *(record.function_queries[223].output_at(__i).as_ptr() as *const [G; OUT_223]) }; __ret }, _ => aiur_fn_223(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_226] = { let __args: [G; IN_226] = [__v_228, __v_229, __v_230, __v_231]; let __cu = unconstrained; let __hit = record.function_queries[226].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[226].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[226].bump_multiplicity(__i); } let __ret: [G; OUT_226] = unsafe { *(record.function_queries[226].output_at(__i).as_ptr() as *const [G; OUT_226]) }; __ret }, _ => aiur_fn_226(__args, record, io_buffer, __cu)? } };
     let __ret: [G; OUT_241] = [];
     record.function_queries[241].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -24151,121 +24151,121 @@ fn aiur_fn_242(
     let __v_148: G = __r_arr[29];
     let __v_149: G = __r_arr[30];
     let __v_150: G = __r_arr[31];
+    let __v_151: G = G::from_u64(256);
+    let __v_152: G = (__v_151 * __v_120);
+    let __v_153: G = G::from_u64(65536);
+    let __v_154: G = (__v_153 * __v_121);
+    let __v_155: G = G::from_u64(16777216);
+    let __v_156: G = (__v_155 * __v_122);
+    let __v_157: G = (__v_154 + __v_156);
+    let __v_158: G = (__v_152 + __v_157);
+    let __v_159: G = (__v_119 + __v_158);
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_124);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_125);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_126);
+    let __v_166: G = (__v_163 + __v_165);
+    let __v_167: G = (__v_161 + __v_166);
+    let __v_168: G = (__v_123 + __v_167);
+    let __v_169: G = G::from_u64(256);
+    let __v_170: G = (__v_169 * __v_128);
+    let __v_171: G = G::from_u64(65536);
+    let __v_172: G = (__v_171 * __v_129);
+    let __v_173: G = G::from_u64(16777216);
+    let __v_174: G = (__v_173 * __v_130);
+    let __v_175: G = (__v_172 + __v_174);
+    let __v_176: G = (__v_170 + __v_175);
+    let __v_177: G = (__v_127 + __v_176);
+    let __v_178: G = G::from_u64(256);
+    let __v_179: G = (__v_178 * __v_132);
+    let __v_180: G = G::from_u64(65536);
+    let __v_181: G = (__v_180 * __v_133);
+    let __v_182: G = G::from_u64(16777216);
+    let __v_183: G = (__v_182 * __v_134);
+    let __v_184: G = (__v_181 + __v_183);
+    let __v_185: G = (__v_179 + __v_184);
+    let __v_186: G = (__v_131 + __v_185);
+    let __v_187: G = G::from_u64(256);
+    let __v_188: G = (__v_187 * __v_136);
+    let __v_189: G = G::from_u64(65536);
+    let __v_190: G = (__v_189 * __v_137);
+    let __v_191: G = G::from_u64(16777216);
+    let __v_192: G = (__v_191 * __v_138);
+    let __v_193: G = (__v_190 + __v_192);
+    let __v_194: G = (__v_188 + __v_193);
+    let __v_195: G = (__v_135 + __v_194);
+    let __v_196: G = G::from_u64(256);
+    let __v_197: G = (__v_196 * __v_140);
+    let __v_198: G = G::from_u64(65536);
+    let __v_199: G = (__v_198 * __v_141);
+    let __v_200: G = G::from_u64(16777216);
+    let __v_201: G = (__v_200 * __v_142);
+    let __v_202: G = (__v_199 + __v_201);
+    let __v_203: G = (__v_197 + __v_202);
+    let __v_204: G = (__v_139 + __v_203);
+    let __v_205: G = G::from_u64(256);
+    let __v_206: G = (__v_205 * __v_144);
+    let __v_207: G = G::from_u64(65536);
+    let __v_208: G = (__v_207 * __v_145);
+    let __v_209: G = G::from_u64(16777216);
+    let __v_210: G = (__v_209 * __v_146);
+    let __v_211: G = (__v_208 + __v_210);
+    let __v_212: G = (__v_206 + __v_211);
+    let __v_213: G = (__v_143 + __v_212);
+    let __v_214: G = G::from_u64(256);
+    let __v_215: G = (__v_214 * __v_148);
+    let __v_216: G = G::from_u64(65536);
+    let __v_217: G = (__v_216 * __v_149);
+    let __v_218: G = G::from_u64(16777216);
+    let __v_219: G = (__v_218 * __v_150);
+    let __v_220: G = (__v_217 + __v_219);
+    let __v_221: G = (__v_215 + __v_220);
+    let __v_222: G = (__v_147 + __v_221);
+    if (__v_159 != __v_28) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_159.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_168 != __v_29) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_177 != __v_30) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_186 != __v_31) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_186.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_195 != __v_32) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_195.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_204 != __v_33) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_204.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_213 != __v_34) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_213.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
+    if (__v_222 != __v_35) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_222.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
+    }
     let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_67]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
-    let __v_151: G = __r_arr[0];
-    let __v_152: G = __r_arr[1];
-    let __v_153: G = __r_arr[2];
+    let __v_223: G = __r_arr[0];
+    let __v_224: G = __r_arr[1];
+    let __v_225: G = __r_arr[2];
     let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_55, __v_59]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-    let __v_154: G = __r_arr[0];
+    let __v_226: G = __r_arr[0];
+    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_223, __v_226]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+    let __v_227: G = __r_arr[0];
+    let __v_228: G = G::from_u64(1);
+    if (__v_227 != __v_228) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_227.as_canonical_u64(), rhs: __v_228.as_canonical_u64(), msg: Some("aggr structural: output subject root is not nodeHash(left, right)".to_string()) });
+    }
     let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_56, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_155: G = __r_arr[0];
+    let __v_229: G = __r_arr[0];
     let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_60, __v_61]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_156: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_152, __v_153]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_157: G = __r_arr[0];
-    let __r_arr: [G; OUT_229] = { let __args: [G; IN_229] = [__v_155, __v_156, __v_151, __v_157]; let __cu = unconstrained; let __hit = record.function_queries[229].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[229].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[229].bump_multiplicity(__i); } let __ret: [G; OUT_229] = unsafe { *(record.function_queries[229].output_at(__i).as_ptr() as *const [G; OUT_229]) }; __ret }, _ => aiur_fn_229(__args, record, io_buffer, __cu)? } };
-    let __v_158: G = G::from_u64(256);
-    let __v_159: G = (__v_158 * __v_120);
-    let __v_160: G = G::from_u64(65536);
-    let __v_161: G = (__v_160 * __v_121);
-    let __v_162: G = G::from_u64(16777216);
-    let __v_163: G = (__v_162 * __v_122);
-    let __v_164: G = (__v_161 + __v_163);
-    let __v_165: G = (__v_159 + __v_164);
-    let __v_166: G = (__v_119 + __v_165);
-    let __v_167: G = G::from_u64(256);
-    let __v_168: G = (__v_167 * __v_124);
-    let __v_169: G = G::from_u64(65536);
-    let __v_170: G = (__v_169 * __v_125);
-    let __v_171: G = G::from_u64(16777216);
-    let __v_172: G = (__v_171 * __v_126);
-    let __v_173: G = (__v_170 + __v_172);
-    let __v_174: G = (__v_168 + __v_173);
-    let __v_175: G = (__v_123 + __v_174);
-    let __v_176: G = G::from_u64(256);
-    let __v_177: G = (__v_176 * __v_128);
-    let __v_178: G = G::from_u64(65536);
-    let __v_179: G = (__v_178 * __v_129);
-    let __v_180: G = G::from_u64(16777216);
-    let __v_181: G = (__v_180 * __v_130);
-    let __v_182: G = (__v_179 + __v_181);
-    let __v_183: G = (__v_177 + __v_182);
-    let __v_184: G = (__v_127 + __v_183);
-    let __v_185: G = G::from_u64(256);
-    let __v_186: G = (__v_185 * __v_132);
-    let __v_187: G = G::from_u64(65536);
-    let __v_188: G = (__v_187 * __v_133);
-    let __v_189: G = G::from_u64(16777216);
-    let __v_190: G = (__v_189 * __v_134);
-    let __v_191: G = (__v_188 + __v_190);
-    let __v_192: G = (__v_186 + __v_191);
-    let __v_193: G = (__v_131 + __v_192);
-    let __v_194: G = G::from_u64(256);
-    let __v_195: G = (__v_194 * __v_136);
-    let __v_196: G = G::from_u64(65536);
-    let __v_197: G = (__v_196 * __v_137);
-    let __v_198: G = G::from_u64(16777216);
-    let __v_199: G = (__v_198 * __v_138);
-    let __v_200: G = (__v_197 + __v_199);
-    let __v_201: G = (__v_195 + __v_200);
-    let __v_202: G = (__v_135 + __v_201);
-    let __v_203: G = G::from_u64(256);
-    let __v_204: G = (__v_203 * __v_140);
-    let __v_205: G = G::from_u64(65536);
-    let __v_206: G = (__v_205 * __v_141);
-    let __v_207: G = G::from_u64(16777216);
-    let __v_208: G = (__v_207 * __v_142);
-    let __v_209: G = (__v_206 + __v_208);
-    let __v_210: G = (__v_204 + __v_209);
-    let __v_211: G = (__v_139 + __v_210);
-    let __v_212: G = G::from_u64(256);
-    let __v_213: G = (__v_212 * __v_144);
-    let __v_214: G = G::from_u64(65536);
-    let __v_215: G = (__v_214 * __v_145);
-    let __v_216: G = G::from_u64(16777216);
-    let __v_217: G = (__v_216 * __v_146);
-    let __v_218: G = (__v_215 + __v_217);
-    let __v_219: G = (__v_213 + __v_218);
-    let __v_220: G = (__v_143 + __v_219);
-    let __v_221: G = G::from_u64(256);
-    let __v_222: G = (__v_221 * __v_148);
-    let __v_223: G = G::from_u64(65536);
-    let __v_224: G = (__v_223 * __v_149);
-    let __v_225: G = G::from_u64(16777216);
-    let __v_226: G = (__v_225 * __v_150);
-    let __v_227: G = (__v_224 + __v_226);
-    let __v_228: G = (__v_222 + __v_227);
-    let __v_229: G = (__v_147 + __v_228);
-    if (__v_166 != __v_28) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_166.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_175 != __v_29) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_175.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_184 != __v_30) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_184.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_193 != __v_31) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_193.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_202 != __v_32) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_202.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_211 != __v_33) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_211.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_220 != __v_34) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_220.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    if (__v_229 != __v_35) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_229.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("aggr structural: output claim digest mismatch".to_string()) });
-    }
-    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_151, __v_154]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
     let __v_230: G = __r_arr[0];
-    let __v_231: G = G::from_u64(1);
-    if (__v_230 != __v_231) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_230.as_canonical_u64(), rhs: __v_231.as_canonical_u64(), msg: Some("aggr structural: output subject root is not nodeHash(left, right)".to_string()) });
-    }
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_224, __v_225]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_231: G = __r_arr[0];
+    let __r_arr: [G; OUT_229] = { let __args: [G; IN_229] = [__v_229, __v_230, __v_223, __v_231]; let __cu = unconstrained; let __hit = record.function_queries[229].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[229].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[229].bump_multiplicity(__i); } let __ret: [G; OUT_229] = unsafe { *(record.function_queries[229].output_at(__i).as_ptr() as *const [G; OUT_229]) }; __ret }, _ => aiur_fn_229(__args, record, io_buffer, __cu)? } };
     let __ret: [G; OUT_242] = [];
     record.function_queries[242].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -24303,45 +24303,48 @@ fn aiur_fn_243(
     let __io_pair: (G, G) = { let __key: [G; 1] = [__v_17]; let __info = io_buffer.get_info(__v_16, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
     let __v_18: G = __io_pair.0;
     let __v_19: G = __io_pair.1;
-    let __v_20: G = G::from_u64(3);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_20, __v_18, __v_19]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_21: G = __r_arr[0];
-    let __v_22: G = G::from_u64(103);
-    let __v_23: G = G::from_u64(230);
-    let __v_24: G = G::from_u64(9);
-    let __v_25: G = G::from_u64(106);
-    let __v_26: G = G::from_u64(133);
-    let __v_27: G = G::from_u64(174);
-    let __v_28: G = G::from_u64(103);
-    let __v_29: G = G::from_u64(187);
-    let __v_30: G = G::from_u64(114);
-    let __v_31: G = G::from_u64(243);
-    let __v_32: G = G::from_u64(110);
-    let __v_33: G = G::from_u64(60);
-    let __v_34: G = G::from_u64(58);
-    let __v_35: G = G::from_u64(245);
-    let __v_36: G = G::from_u64(79);
-    let __v_37: G = G::from_u64(165);
-    let __v_38: G = G::from_u64(127);
-    let __v_39: G = G::from_u64(82);
-    let __v_40: G = G::from_u64(14);
-    let __v_41: G = G::from_u64(81);
-    let __v_42: G = G::from_u64(140);
-    let __v_43: G = G::from_u64(104);
-    let __v_44: G = G::from_u64(5);
-    let __v_45: G = G::from_u64(155);
-    let __v_46: G = G::from_u64(171);
-    let __v_47: G = G::from_u64(217);
-    let __v_48: G = G::from_u64(131);
-    let __v_49: G = G::from_u64(31);
-    let __v_50: G = G::from_u64(25);
-    let __v_51: G = G::from_u64(205);
-    let __v_52: G = G::from_u64(224);
-    let __v_53: G = G::from_u64(91);
-    let __v_54: G = G::from_u64(1);
+    let __v_20: G = G::from_u64(80);
+    if (__v_19 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
+    }
+    let __v_21: G = G::from_u64(3);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_21, __v_18, __v_19]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_22: G = __r_arr[0];
+    let __v_23: G = G::from_u64(103);
+    let __v_24: G = G::from_u64(230);
+    let __v_25: G = G::from_u64(9);
+    let __v_26: G = G::from_u64(106);
+    let __v_27: G = G::from_u64(133);
+    let __v_28: G = G::from_u64(174);
+    let __v_29: G = G::from_u64(103);
+    let __v_30: G = G::from_u64(187);
+    let __v_31: G = G::from_u64(114);
+    let __v_32: G = G::from_u64(243);
+    let __v_33: G = G::from_u64(110);
+    let __v_34: G = G::from_u64(60);
+    let __v_35: G = G::from_u64(58);
+    let __v_36: G = G::from_u64(245);
+    let __v_37: G = G::from_u64(79);
+    let __v_38: G = G::from_u64(165);
+    let __v_39: G = G::from_u64(127);
+    let __v_40: G = G::from_u64(82);
+    let __v_41: G = G::from_u64(14);
+    let __v_42: G = G::from_u64(81);
+    let __v_43: G = G::from_u64(140);
+    let __v_44: G = G::from_u64(104);
+    let __v_45: G = G::from_u64(5);
+    let __v_46: G = G::from_u64(155);
+    let __v_47: G = G::from_u64(171);
+    let __v_48: G = G::from_u64(217);
+    let __v_49: G = G::from_u64(131);
+    let __v_50: G = G::from_u64(31);
+    let __v_51: G = G::from_u64(25);
+    let __v_52: G = G::from_u64(205);
+    let __v_53: G = G::from_u64(224);
+    let __v_54: G = G::from_u64(91);
     let __v_55: G = G::from_u64(1);
-    let __v_56: G = { let __values: [G; 3] = [__v_54, __v_55, __v_55]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_57: G = G::from_u64(0);
+    let __v_56: G = G::from_u64(1);
+    let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_58: G = G::from_u64(0);
     let __v_59: G = G::from_u64(0);
     let __v_60: G = G::from_u64(0);
@@ -24351,253 +24354,250 @@ fn aiur_fn_243(
     let __v_64: G = G::from_u64(0);
     let __v_65: G = G::from_u64(0);
     let __v_66: G = G::from_u64(0);
-    let __v_67: G = { let __values: [G; 8] = [__v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_68: G = { let __values: [G; 32] = [__v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_69: G = G::from_u64(1);
+    let __v_67: G = G::from_u64(0);
+    let __v_68: G = { let __values: [G; 8] = [__v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_69: G = { let __values: [G; 32] = [__v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_70: G = G::from_u64(1);
-    let __v_71: G = { let __values: [G; 34] = [__v_69, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_21, __v_56, __v_57, __v_58, __v_67, __v_68, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_72: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_72]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = { let __values: [G; 34] = [__v_70, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_22, __v_57, __v_58, __v_59, __v_68, __v_69, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
     let __v_73: G = __r_arr[0];
-    let __v_74: G = __r_arr[1];
-    let __v_75: G = __r_arr[2];
-    let __v_76: G = __r_arr[3];
-    let __v_77: G = __r_arr[4];
-    let __v_78: G = __r_arr[5];
-    let __v_79: G = __r_arr[6];
-    let __v_80: G = __r_arr[7];
-    let __v_81: G = __r_arr[8];
-    let __v_82: G = __r_arr[9];
-    let __v_83: G = __r_arr[10];
-    let __v_84: G = __r_arr[11];
-    let __v_85: G = __r_arr[12];
-    let __v_86: G = __r_arr[13];
-    let __v_87: G = __r_arr[14];
-    let __v_88: G = __r_arr[15];
-    let __v_89: G = __r_arr[16];
-    let __v_90: G = __r_arr[17];
-    let __v_91: G = __r_arr[18];
-    let __v_92: G = __r_arr[19];
-    let __v_93: G = __r_arr[20];
-    let __v_94: G = __r_arr[21];
-    let __v_95: G = __r_arr[22];
-    let __v_96: G = __r_arr[23];
-    let __v_97: G = __r_arr[24];
-    let __v_98: G = __r_arr[25];
-    let __v_99: G = __r_arr[26];
-    let __v_100: G = __r_arr[27];
-    let __v_101: G = __r_arr[28];
-    let __v_102: G = __r_arr[29];
-    let __v_103: G = __r_arr[30];
-    let __v_104: G = __r_arr[31];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_105: G = __r_arr[0];
-    let __v_106: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_106]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_107: G = __r_arr[0];
-    let __v_108: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_108]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_109: G = __r_arr[0];
-    let __v_110: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_110]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_111: G = __r_arr[0];
-    let __v_112: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_112]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_113: G = __r_arr[0];
-    let __v_114: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_114]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_115: G = __r_arr[0];
-    let __v_116: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_116]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_117: G = __r_arr[0];
-    let __v_118: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_118]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_119: G = __r_arr[0];
-    let __v_120: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_120]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_121: G = __r_arr[0];
-    let __v_122: G = __r_arr[1];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_122]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_123: G = __r_arr[0];
-    let __v_124: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_124]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_125: G = __r_arr[0];
-    let __v_126: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_126]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_127: G = __r_arr[0];
-    let __v_128: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_128]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_129: G = __r_arr[0];
-    let __v_130: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_130]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_131: G = __r_arr[0];
-    let __v_132: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_132]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_133: G = __r_arr[0];
-    let __v_134: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_134]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_135: G = __r_arr[0];
-    let __v_136: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_136]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_137: G = __r_arr[0];
-    let __v_138: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_138]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_139: G = __r_arr[0];
-    let __v_140: G = __r_arr[1];
-    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_141: G = __r_arr[0];
-    let __v_142: G = __r_arr[1];
-    let __v_143: G = __r_arr[2];
-    let __v_144: G = __r_arr[3];
-    let __v_145: G = __r_arr[4];
-    let __v_146: G = __r_arr[5];
-    let __v_147: G = __r_arr[6];
-    let __v_148: G = __r_arr[7];
-    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_123]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_149: G = __r_arr[0];
-    let __v_150: G = __r_arr[1];
-    let __v_151: G = __r_arr[2];
-    let __v_152: G = __r_arr[3];
-    let __v_153: G = __r_arr[4];
-    let __v_154: G = __r_arr[5];
-    let __v_155: G = __r_arr[6];
-    let __v_156: G = __r_arr[7];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_107, __v_109, __v_111, __v_113, __v_115, __v_117, __v_119, __v_121]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
-    let __v_157: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_125, __v_127, __v_129, __v_131, __v_133, __v_135, __v_137, __v_139]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
-    let __v_158: G = __r_arr[0];
-    let __v_159: G = G::from_u64(6);
-    let __v_160: G = G::from_u64(0);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_160]; let __info = io_buffer.get_info(__v_159, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_161: G = __io_pair.0;
-    let __v_162: G = __io_pair.1;
-    let __v_163: G = G::from_u64(6);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_163, __v_161, __v_162]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_164: G = __r_arr[0];
-    let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_164]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
-    let __v_165: G = __r_arr[0];
-    let __v_166: G = __r_arr[1];
-    let __v_167: G = G::from_u64(80);
-    if (__v_19 != __v_167) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_167.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
-    }
-    let __v_168: G = G::from_u64(256);
-    let __v_169: G = (__v_168 * __v_74);
-    let __v_170: G = G::from_u64(65536);
-    let __v_171: G = (__v_170 * __v_75);
-    let __v_172: G = G::from_u64(16777216);
-    let __v_173: G = (__v_172 * __v_76);
-    let __v_174: G = (__v_171 + __v_173);
-    let __v_175: G = (__v_169 + __v_174);
-    let __v_176: G = (__v_73 + __v_175);
-    let __v_177: G = G::from_u64(256);
-    let __v_178: G = (__v_177 * __v_78);
-    let __v_179: G = G::from_u64(65536);
-    let __v_180: G = (__v_179 * __v_79);
-    let __v_181: G = G::from_u64(16777216);
-    let __v_182: G = (__v_181 * __v_80);
-    let __v_183: G = (__v_180 + __v_182);
-    let __v_184: G = (__v_178 + __v_183);
-    let __v_185: G = (__v_77 + __v_184);
-    let __v_186: G = G::from_u64(256);
-    let __v_187: G = (__v_186 * __v_82);
-    let __v_188: G = G::from_u64(65536);
-    let __v_189: G = (__v_188 * __v_83);
-    let __v_190: G = G::from_u64(16777216);
-    let __v_191: G = (__v_190 * __v_84);
-    let __v_192: G = (__v_189 + __v_191);
-    let __v_193: G = (__v_187 + __v_192);
-    let __v_194: G = (__v_81 + __v_193);
-    let __v_195: G = G::from_u64(256);
-    let __v_196: G = (__v_195 * __v_86);
-    let __v_197: G = G::from_u64(65536);
-    let __v_198: G = (__v_197 * __v_87);
-    let __v_199: G = G::from_u64(16777216);
-    let __v_200: G = (__v_199 * __v_88);
-    let __v_201: G = (__v_198 + __v_200);
-    let __v_202: G = (__v_196 + __v_201);
-    let __v_203: G = (__v_85 + __v_202);
-    let __v_204: G = G::from_u64(256);
-    let __v_205: G = (__v_204 * __v_90);
-    let __v_206: G = G::from_u64(65536);
-    let __v_207: G = (__v_206 * __v_91);
-    let __v_208: G = G::from_u64(16777216);
-    let __v_209: G = (__v_208 * __v_92);
-    let __v_210: G = (__v_207 + __v_209);
-    let __v_211: G = (__v_205 + __v_210);
-    let __v_212: G = (__v_89 + __v_211);
-    let __v_213: G = G::from_u64(256);
-    let __v_214: G = (__v_213 * __v_94);
-    let __v_215: G = G::from_u64(65536);
-    let __v_216: G = (__v_215 * __v_95);
-    let __v_217: G = G::from_u64(16777216);
-    let __v_218: G = (__v_217 * __v_96);
-    let __v_219: G = (__v_216 + __v_218);
-    let __v_220: G = (__v_214 + __v_219);
-    let __v_221: G = (__v_93 + __v_220);
-    let __v_222: G = G::from_u64(256);
-    let __v_223: G = (__v_222 * __v_98);
-    let __v_224: G = G::from_u64(65536);
-    let __v_225: G = (__v_224 * __v_99);
-    let __v_226: G = G::from_u64(16777216);
-    let __v_227: G = (__v_226 * __v_100);
-    let __v_228: G = (__v_225 + __v_227);
-    let __v_229: G = (__v_223 + __v_228);
-    let __v_230: G = (__v_97 + __v_229);
-    let __v_231: G = G::from_u64(256);
-    let __v_232: G = (__v_231 * __v_102);
-    let __v_233: G = G::from_u64(65536);
-    let __v_234: G = (__v_233 * __v_103);
-    let __v_235: G = G::from_u64(16777216);
-    let __v_236: G = (__v_235 * __v_104);
-    let __v_237: G = (__v_234 + __v_236);
-    let __v_238: G = (__v_232 + __v_237);
-    let __v_239: G = (__v_101 + __v_238);
-    if (__v_176 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_176.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_185 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_185.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_194 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_194.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_203 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_203.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_212 != __v_4) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_212.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_221 != __v_5) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_221.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_230 != __v_6) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_230.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_239 != __v_7) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_239.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_140.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_240: G = __loaded[0];
-    let __v_241: G = __loaded[1];
-    let __v_242: G = __loaded[2];
-    let __v_243: G = G::from_u64(1);
-    let __v_244: G = G::from_u64(1);
-    if (__v_240 != __v_243) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_240.as_canonical_u64(), rhs: __v_243.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
-    }
-    if (__v_241 != __v_244) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_241.as_canonical_u64(), rhs: __v_244.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
-    }
-    if (__v_242 != __v_244) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_242.as_canonical_u64(), rhs: __v_244.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
-    }
-    let __v_245: G = G::from_u64(1);
-    if (__v_162 != __v_245) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_162.as_canonical_u64(), rhs: __v_245.as_canonical_u64(), msg: Some("aggr: shape hint must be exactly one byte".to_string()) });
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_73]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_74: G = __r_arr[0];
+    let __v_75: G = __r_arr[1];
+    let __v_76: G = __r_arr[2];
+    let __v_77: G = __r_arr[3];
+    let __v_78: G = __r_arr[4];
+    let __v_79: G = __r_arr[5];
+    let __v_80: G = __r_arr[6];
+    let __v_81: G = __r_arr[7];
+    let __v_82: G = __r_arr[8];
+    let __v_83: G = __r_arr[9];
+    let __v_84: G = __r_arr[10];
+    let __v_85: G = __r_arr[11];
+    let __v_86: G = __r_arr[12];
+    let __v_87: G = __r_arr[13];
+    let __v_88: G = __r_arr[14];
+    let __v_89: G = __r_arr[15];
+    let __v_90: G = __r_arr[16];
+    let __v_91: G = __r_arr[17];
+    let __v_92: G = __r_arr[18];
+    let __v_93: G = __r_arr[19];
+    let __v_94: G = __r_arr[20];
+    let __v_95: G = __r_arr[21];
+    let __v_96: G = __r_arr[22];
+    let __v_97: G = __r_arr[23];
+    let __v_98: G = __r_arr[24];
+    let __v_99: G = __r_arr[25];
+    let __v_100: G = __r_arr[26];
+    let __v_101: G = __r_arr[27];
+    let __v_102: G = __r_arr[28];
+    let __v_103: G = __r_arr[29];
+    let __v_104: G = __r_arr[30];
+    let __v_105: G = __r_arr[31];
+    let __v_106: G = G::from_u64(256);
+    let __v_107: G = (__v_106 * __v_75);
+    let __v_108: G = G::from_u64(65536);
+    let __v_109: G = (__v_108 * __v_76);
+    let __v_110: G = G::from_u64(16777216);
+    let __v_111: G = (__v_110 * __v_77);
+    let __v_112: G = (__v_109 + __v_111);
+    let __v_113: G = (__v_107 + __v_112);
+    let __v_114: G = (__v_74 + __v_113);
+    let __v_115: G = G::from_u64(256);
+    let __v_116: G = (__v_115 * __v_79);
+    let __v_117: G = G::from_u64(65536);
+    let __v_118: G = (__v_117 * __v_80);
+    let __v_119: G = G::from_u64(16777216);
+    let __v_120: G = (__v_119 * __v_81);
+    let __v_121: G = (__v_118 + __v_120);
+    let __v_122: G = (__v_116 + __v_121);
+    let __v_123: G = (__v_78 + __v_122);
+    let __v_124: G = G::from_u64(256);
+    let __v_125: G = (__v_124 * __v_83);
+    let __v_126: G = G::from_u64(65536);
+    let __v_127: G = (__v_126 * __v_84);
+    let __v_128: G = G::from_u64(16777216);
+    let __v_129: G = (__v_128 * __v_85);
+    let __v_130: G = (__v_127 + __v_129);
+    let __v_131: G = (__v_125 + __v_130);
+    let __v_132: G = (__v_82 + __v_131);
+    let __v_133: G = G::from_u64(256);
+    let __v_134: G = (__v_133 * __v_87);
+    let __v_135: G = G::from_u64(65536);
+    let __v_136: G = (__v_135 * __v_88);
+    let __v_137: G = G::from_u64(16777216);
+    let __v_138: G = (__v_137 * __v_89);
+    let __v_139: G = (__v_136 + __v_138);
+    let __v_140: G = (__v_134 + __v_139);
+    let __v_141: G = (__v_86 + __v_140);
+    let __v_142: G = G::from_u64(256);
+    let __v_143: G = (__v_142 * __v_91);
+    let __v_144: G = G::from_u64(65536);
+    let __v_145: G = (__v_144 * __v_92);
+    let __v_146: G = G::from_u64(16777216);
+    let __v_147: G = (__v_146 * __v_93);
+    let __v_148: G = (__v_145 + __v_147);
+    let __v_149: G = (__v_143 + __v_148);
+    let __v_150: G = (__v_90 + __v_149);
+    let __v_151: G = G::from_u64(256);
+    let __v_152: G = (__v_151 * __v_95);
+    let __v_153: G = G::from_u64(65536);
+    let __v_154: G = (__v_153 * __v_96);
+    let __v_155: G = G::from_u64(16777216);
+    let __v_156: G = (__v_155 * __v_97);
+    let __v_157: G = (__v_154 + __v_156);
+    let __v_158: G = (__v_152 + __v_157);
+    let __v_159: G = (__v_94 + __v_158);
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_99);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_100);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_101);
+    let __v_166: G = (__v_163 + __v_165);
+    let __v_167: G = (__v_161 + __v_166);
+    let __v_168: G = (__v_98 + __v_167);
+    let __v_169: G = G::from_u64(256);
+    let __v_170: G = (__v_169 * __v_103);
+    let __v_171: G = G::from_u64(65536);
+    let __v_172: G = (__v_171 * __v_104);
+    let __v_173: G = G::from_u64(16777216);
+    let __v_174: G = (__v_173 * __v_105);
+    let __v_175: G = (__v_172 + __v_174);
+    let __v_176: G = (__v_170 + __v_175);
+    let __v_177: G = (__v_102 + __v_176);
+    if (__v_114 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_114.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_123 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_123.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_132 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_132.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_141 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_150 != __v_4) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_150.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_159 != __v_5) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_159.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_168 != __v_6) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_177 != __v_7) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("aggr: allowed blob digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_178: G = __r_arr[0];
+    let __v_179: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_179]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_180: G = __r_arr[0];
+    let __v_181: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_181]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_182: G = __r_arr[0];
+    let __v_183: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_183]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_184: G = __r_arr[0];
+    let __v_185: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_185]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_186: G = __r_arr[0];
+    let __v_187: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_188: G = __r_arr[0];
+    let __v_189: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_189]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_190: G = __r_arr[0];
+    let __v_191: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_191]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_192: G = __r_arr[0];
+    let __v_193: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_193]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_194: G = __r_arr[0];
+    let __v_195: G = __r_arr[1];
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_195]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_196: G = __r_arr[0];
+    let __v_197: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_197]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_198: G = __r_arr[0];
+    let __v_199: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_199]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_200: G = __r_arr[0];
+    let __v_201: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_201]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_202: G = __r_arr[0];
+    let __v_203: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_203]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_204: G = __r_arr[0];
+    let __v_205: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_205]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_206: G = __r_arr[0];
+    let __v_207: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_207]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_208: G = __r_arr[0];
+    let __v_209: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_209]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_210: G = __r_arr[0];
+    let __v_211: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_211]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_212: G = __r_arr[0];
+    let __v_213: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_213.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_214: G = __loaded[0];
+    let __v_215: G = __loaded[1];
+    let __v_216: G = __loaded[2];
+    let __v_217: G = G::from_u64(1);
+    let __v_218: G = G::from_u64(1);
+    if (__v_214 != __v_217) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_214.as_canonical_u64(), rhs: __v_217.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
+    }
+    if (__v_215 != __v_218) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_215.as_canonical_u64(), rhs: __v_218.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
+    }
+    if (__v_216 != __v_218) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_216.as_canonical_u64(), rhs: __v_218.as_canonical_u64(), msg: Some("aggr: allowed blob must be exactly 80 bytes".to_string()) });
+    }
+    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_178]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
+    let __v_219: G = __r_arr[0];
+    let __v_220: G = __r_arr[1];
+    let __v_221: G = __r_arr[2];
+    let __v_222: G = __r_arr[3];
+    let __v_223: G = __r_arr[4];
+    let __v_224: G = __r_arr[5];
+    let __v_225: G = __r_arr[6];
+    let __v_226: G = __r_arr[7];
+    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_196]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
+    let __v_227: G = __r_arr[0];
+    let __v_228: G = __r_arr[1];
+    let __v_229: G = __r_arr[2];
+    let __v_230: G = __r_arr[3];
+    let __v_231: G = __r_arr[4];
+    let __v_232: G = __r_arr[5];
+    let __v_233: G = __r_arr[6];
+    let __v_234: G = __r_arr[7];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_180, __v_182, __v_184, __v_186, __v_188, __v_190, __v_192, __v_194]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_235: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_198, __v_200, __v_202, __v_204, __v_206, __v_208, __v_210, __v_212]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_236: G = __r_arr[0];
+    let __v_237: G = G::from_u64(6);
+    let __v_238: G = G::from_u64(0);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_238]; let __info = io_buffer.get_info(__v_237, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_239: G = __io_pair.0;
+    let __v_240: G = __io_pair.1;
+    let __v_241: G = G::from_u64(1);
+    if (__v_240 != __v_241) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_240.as_canonical_u64(), rhs: __v_241.as_canonical_u64(), msg: Some("aggr: shape hint must be exactly one byte".to_string()) });
     }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_166.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_242: G = G::from_u64(6);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_242, __v_239, __v_240]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_243: G = __r_arr[0];
+    let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_243]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
+    let __v_244: G = __r_arr[0];
+    let __v_245: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_245.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
     let __v_246: G = __loaded[0];
     let __v_247: G = __loaded[1];
     let __v_248: G = __loaded[2];
@@ -24612,17 +24612,17 @@ fn aiur_fn_243(
     if (__v_248 != __v_250) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_248.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("aggr: trailing bytes after shape hint".to_string()) });
     }
-    match __v_165.as_canonical_u64() {
+    match __v_244.as_canonical_u64() {
       0u64 => {
         let __v_251: G = G::from_u64(0);
-        let __r_arr: [G; OUT_240] = { let __args: [G; IN_240] = [__v_251, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[240].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[240].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[240].bump_multiplicity(__i); } let __ret: [G; OUT_240] = unsafe { *(record.function_queries[240].output_at(__i).as_ptr() as *const [G; OUT_240]) }; __ret }, _ => aiur_fn_240(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_240] = { let __args: [G; IN_240] = [__v_251, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[240].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[240].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[240].bump_multiplicity(__i); } let __ret: [G; OUT_240] = unsafe { *(record.function_queries[240].output_at(__i).as_ptr() as *const [G; OUT_240]) }; __ret }, _ => aiur_fn_240(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       1u64 => {
         let __v_251: G = G::from_u64(1);
-        let __r_arr: [G; OUT_240] = { let __args: [G; IN_240] = [__v_251, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[240].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[240].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[240].bump_multiplicity(__i); } let __ret: [G; OUT_240] = unsafe { *(record.function_queries[240].output_at(__i).as_ptr() as *const [G; OUT_240]) }; __ret }, _ => aiur_fn_240(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_240] = { let __args: [G; IN_240] = [__v_251, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[240].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[240].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[240].bump_multiplicity(__i); } let __ret: [G; OUT_240] = unsafe { *(record.function_queries[240].output_at(__i).as_ptr() as *const [G; OUT_240]) }; __ret }, _ => aiur_fn_240(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24630,7 +24630,7 @@ fn aiur_fn_243(
       2u64 => {
         let __v_251: G = G::from_u64(0);
         let __v_252: G = G::from_u64(0);
-        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24638,7 +24638,7 @@ fn aiur_fn_243(
       3u64 => {
         let __v_251: G = G::from_u64(0);
         let __v_252: G = G::from_u64(1);
-        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24646,7 +24646,7 @@ fn aiur_fn_243(
       4u64 => {
         let __v_251: G = G::from_u64(1);
         let __v_252: G = G::from_u64(0);
-        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24654,7 +24654,7 @@ fn aiur_fn_243(
       5u64 => {
         let __v_251: G = G::from_u64(1);
         let __v_252: G = G::from_u64(1);
-        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_241] = { let __args: [G; IN_241] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[241].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[241].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[241].bump_multiplicity(__i); } let __ret: [G; OUT_241] = unsafe { *(record.function_queries[241].output_at(__i).as_ptr() as *const [G; OUT_241]) }; __ret }, _ => aiur_fn_241(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24662,7 +24662,7 @@ fn aiur_fn_243(
       6u64 => {
         let __v_251: G = G::from_u64(0);
         let __v_252: G = G::from_u64(0);
-        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24670,7 +24670,7 @@ fn aiur_fn_243(
       7u64 => {
         let __v_251: G = G::from_u64(0);
         let __v_252: G = G::from_u64(1);
-        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24678,7 +24678,7 @@ fn aiur_fn_243(
       8u64 => {
         let __v_251: G = G::from_u64(1);
         let __v_252: G = G::from_u64(0);
-        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -24686,13 +24686,13 @@ fn aiur_fn_243(
       9u64 => {
         let __v_251: G = G::from_u64(1);
         let __v_252: G = G::from_u64(1);
-        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_242] = { let __args: [G; IN_242] = [__v_251, __v_252, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230, __v_231, __v_232, __v_233, __v_234, __v_235, __v_236, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[242].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[242].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[242].bump_multiplicity(__i); } let __ret: [G; OUT_242] = unsafe { *(record.function_queries[242].output_at(__i).as_ptr() as *const [G; OUT_242]) }; __ret }, _ => aiur_fn_242(__args, record, io_buffer, __cu)? } };
         let __ret: [G; OUT_243] = [];
         record.function_queries[243].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       _ => {
-        return Err(ExecError::MatchNoCase(__v_165.as_canonical_u64()));
+        return Err(ExecError::MatchNoCase(__v_244.as_canonical_u64()));
       },
     }
   })
@@ -24829,10 +24829,10 @@ fn aiur_fn_247(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_3, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_6, __v_3, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_247] = [__v_7];
         record.function_queries[247].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -25103,10 +25103,10 @@ fn aiur_fn_254(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_12: G = G::from_u64(0);
         let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_11, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
-        let __v_13: G = __r_arr[0];
-        let __v_14: G = { let __values: [G; 10] = [__v_12, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = __r_arr[0];
+        let __v_13: G = G::from_u64(0);
+        let __v_14: G = { let __values: [G; 10] = [__v_13, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_254] = [__v_14];
         record.function_queries[254].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
diff --git a/crates/ixvm-codegen/src/aiur_ixvm.rs b/crates/ixvm-codegen/src/aiur_ixvm.rs
index 5ed198239..28d9447b6 100644
--- a/crates/ixvm-codegen/src/aiur_ixvm.rs
+++ b/crates/ixvm-codegen/src/aiur_ixvm.rs
@@ -4618,7 +4618,7 @@ fn aiur_fn_27(
       _ => {
         let __v_2: G = G::from_u64(0);
         let __v_3: G = G::from_u64(0);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_5: G = G::from_u64(1);
         let __v_6: G = (__v_1 - __v_5);
         let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_4, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
@@ -4811,41 +4811,41 @@ fn aiur_fn_28(
                                             let __v_144: G = G::from_u64(0);
                                             let __v_145: G = G::from_u64(0);
                                             let __v_146: G = G::from_u64(0);
-                                            let __v_147: G = G::from_u64(0);
-                                            let __r_arr: [G; OUT_33] = { let __args: [G; IN_33] = [__v_147, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_140, __v_141, __v_142, __v_18, __v_143, __v_144, __v_145, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[33].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[33].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[33].bump_multiplicity(__i); } let __ret: [G; OUT_33] = unsafe { *(record.function_queries[33].output_at(__i).as_ptr() as *const [G; OUT_33]) }; __ret }, _ => aiur_fn_33(__args, record, io_buffer, __cu)? } };
-                                            let __v_148: G = __r_arr[0];
-                                            let __v_149: G = __r_arr[1];
-                                            let __v_150: G = __r_arr[2];
-                                            let __v_151: G = __r_arr[3];
-                                            let __v_152: G = __r_arr[4];
-                                            let __v_153: G = __r_arr[5];
-                                            let __v_154: G = __r_arr[6];
-                                            let __v_155: G = __r_arr[7];
-                                            let __v_156: G = __r_arr[8];
-                                            let __v_157: G = __r_arr[9];
-                                            let __v_158: G = __r_arr[10];
-                                            let __v_159: G = __r_arr[11];
-                                            let __v_160: G = __r_arr[12];
-                                            let __v_161: G = __r_arr[13];
-                                            let __v_162: G = __r_arr[14];
-                                            let __v_163: G = __r_arr[15];
-                                            let __v_164: G = __r_arr[16];
-                                            let __v_165: G = __r_arr[17];
-                                            let __v_166: G = __r_arr[18];
-                                            let __v_167: G = __r_arr[19];
-                                            let __v_168: G = __r_arr[20];
-                                            let __v_169: G = __r_arr[21];
-                                            let __v_170: G = __r_arr[22];
-                                            let __v_171: G = __r_arr[23];
-                                            let __v_172: G = __r_arr[24];
-                                            let __v_173: G = __r_arr[25];
-                                            let __v_174: G = __r_arr[26];
-                                            let __v_175: G = __r_arr[27];
-                                            let __v_176: G = __r_arr[28];
-                                            let __v_177: G = __r_arr[29];
-                                            let __v_178: G = __r_arr[30];
-                                            let __v_179: G = __r_arr[31];
-                                            let __v_180: G = { let __values: [G; 34] = [__v_146, __v_5, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __r_arr: [G; OUT_33] = { let __args: [G; IN_33] = [__v_146, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_140, __v_141, __v_142, __v_18, __v_143, __v_144, __v_145, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[33].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[33].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[33].bump_multiplicity(__i); } let __ret: [G; OUT_33] = unsafe { *(record.function_queries[33].output_at(__i).as_ptr() as *const [G; OUT_33]) }; __ret }, _ => aiur_fn_33(__args, record, io_buffer, __cu)? } };
+                                            let __v_147: G = __r_arr[0];
+                                            let __v_148: G = __r_arr[1];
+                                            let __v_149: G = __r_arr[2];
+                                            let __v_150: G = __r_arr[3];
+                                            let __v_151: G = __r_arr[4];
+                                            let __v_152: G = __r_arr[5];
+                                            let __v_153: G = __r_arr[6];
+                                            let __v_154: G = __r_arr[7];
+                                            let __v_155: G = __r_arr[8];
+                                            let __v_156: G = __r_arr[9];
+                                            let __v_157: G = __r_arr[10];
+                                            let __v_158: G = __r_arr[11];
+                                            let __v_159: G = __r_arr[12];
+                                            let __v_160: G = __r_arr[13];
+                                            let __v_161: G = __r_arr[14];
+                                            let __v_162: G = __r_arr[15];
+                                            let __v_163: G = __r_arr[16];
+                                            let __v_164: G = __r_arr[17];
+                                            let __v_165: G = __r_arr[18];
+                                            let __v_166: G = __r_arr[19];
+                                            let __v_167: G = __r_arr[20];
+                                            let __v_168: G = __r_arr[21];
+                                            let __v_169: G = __r_arr[22];
+                                            let __v_170: G = __r_arr[23];
+                                            let __v_171: G = __r_arr[24];
+                                            let __v_172: G = __r_arr[25];
+                                            let __v_173: G = __r_arr[26];
+                                            let __v_174: G = __r_arr[27];
+                                            let __v_175: G = __r_arr[28];
+                                            let __v_176: G = __r_arr[29];
+                                            let __v_177: G = __r_arr[30];
+                                            let __v_178: G = __r_arr[31];
+                                            let __v_179: G = G::from_u64(0);
+                                            let __v_180: G = { let __values: [G; 34] = [__v_179, __v_5, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                             let __ret: [G; OUT_28] = [__v_180];
                                             record.function_queries[28].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
@@ -4907,41 +4907,41 @@ fn aiur_fn_28(
             }
           },
           _ => {
-            let __v_9: G = G::from_u64(0);
             let __loaded: [G; 32] = { let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; let __ptr_u64 = __v_4.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 32 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 32] = __args[..32].try_into().unwrap(); __arr };
-            let __v_10: G = __loaded[0];
-            let __v_11: G = __loaded[1];
-            let __v_12: G = __loaded[2];
-            let __v_13: G = __loaded[3];
-            let __v_14: G = __loaded[4];
-            let __v_15: G = __loaded[5];
-            let __v_16: G = __loaded[6];
-            let __v_17: G = __loaded[7];
-            let __v_18: G = __loaded[8];
-            let __v_19: G = __loaded[9];
-            let __v_20: G = __loaded[10];
-            let __v_21: G = __loaded[11];
-            let __v_22: G = __loaded[12];
-            let __v_23: G = __loaded[13];
-            let __v_24: G = __loaded[14];
-            let __v_25: G = __loaded[15];
-            let __v_26: G = __loaded[16];
-            let __v_27: G = __loaded[17];
-            let __v_28: G = __loaded[18];
-            let __v_29: G = __loaded[19];
-            let __v_30: G = __loaded[20];
-            let __v_31: G = __loaded[21];
-            let __v_32: G = __loaded[22];
-            let __v_33: G = __loaded[23];
-            let __v_34: G = __loaded[24];
-            let __v_35: G = __loaded[25];
-            let __v_36: G = __loaded[26];
-            let __v_37: G = __loaded[27];
-            let __v_38: G = __loaded[28];
-            let __v_39: G = __loaded[29];
-            let __v_40: G = __loaded[30];
-            let __v_41: G = __loaded[31];
-            let __v_42: G = { let __values: [G; 34] = [__v_9, __v_5, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = __loaded[0];
+            let __v_10: G = __loaded[1];
+            let __v_11: G = __loaded[2];
+            let __v_12: G = __loaded[3];
+            let __v_13: G = __loaded[4];
+            let __v_14: G = __loaded[5];
+            let __v_15: G = __loaded[6];
+            let __v_16: G = __loaded[7];
+            let __v_17: G = __loaded[8];
+            let __v_18: G = __loaded[9];
+            let __v_19: G = __loaded[10];
+            let __v_20: G = __loaded[11];
+            let __v_21: G = __loaded[12];
+            let __v_22: G = __loaded[13];
+            let __v_23: G = __loaded[14];
+            let __v_24: G = __loaded[15];
+            let __v_25: G = __loaded[16];
+            let __v_26: G = __loaded[17];
+            let __v_27: G = __loaded[18];
+            let __v_28: G = __loaded[19];
+            let __v_29: G = __loaded[20];
+            let __v_30: G = __loaded[21];
+            let __v_31: G = __loaded[22];
+            let __v_32: G = __loaded[23];
+            let __v_33: G = __loaded[24];
+            let __v_34: G = __loaded[25];
+            let __v_35: G = __loaded[26];
+            let __v_36: G = __loaded[27];
+            let __v_37: G = __loaded[28];
+            let __v_38: G = __loaded[29];
+            let __v_39: G = __loaded[30];
+            let __v_40: G = __loaded[31];
+            let __v_41: G = G::from_u64(0);
+            let __v_42: G = { let __values: [G; 34] = [__v_41, __v_5, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_28] = [__v_42];
             record.function_queries[28].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -5100,41 +5100,41 @@ fn aiur_fn_28(
         let __v_151: G = G::from_u64(0);
         let __v_152: G = G::from_u64(0);
         let __v_153: G = G::from_u64(0);
-        let __v_154: G = G::from_u64(0);
-        let __r_arr: [G; OUT_33] = { let __args: [G; IN_33] = [__v_154, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_1, __v_147, __v_148, __v_149, __v_23, __v_150, __v_151, __v_152, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[33].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[33].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[33].bump_multiplicity(__i); } let __ret: [G; OUT_33] = unsafe { *(record.function_queries[33].output_at(__i).as_ptr() as *const [G; OUT_33]) }; __ret }, _ => aiur_fn_33(__args, record, io_buffer, __cu)? } };
-        let __v_155: G = __r_arr[0];
-        let __v_156: G = __r_arr[1];
-        let __v_157: G = __r_arr[2];
-        let __v_158: G = __r_arr[3];
-        let __v_159: G = __r_arr[4];
-        let __v_160: G = __r_arr[5];
-        let __v_161: G = __r_arr[6];
-        let __v_162: G = __r_arr[7];
-        let __v_163: G = __r_arr[8];
-        let __v_164: G = __r_arr[9];
-        let __v_165: G = __r_arr[10];
-        let __v_166: G = __r_arr[11];
-        let __v_167: G = __r_arr[12];
-        let __v_168: G = __r_arr[13];
-        let __v_169: G = __r_arr[14];
-        let __v_170: G = __r_arr[15];
-        let __v_171: G = __r_arr[16];
-        let __v_172: G = __r_arr[17];
-        let __v_173: G = __r_arr[18];
-        let __v_174: G = __r_arr[19];
-        let __v_175: G = __r_arr[20];
-        let __v_176: G = __r_arr[21];
-        let __v_177: G = __r_arr[22];
-        let __v_178: G = __r_arr[23];
-        let __v_179: G = __r_arr[24];
-        let __v_180: G = __r_arr[25];
-        let __v_181: G = __r_arr[26];
-        let __v_182: G = __r_arr[27];
-        let __v_183: G = __r_arr[28];
-        let __v_184: G = __r_arr[29];
-        let __v_185: G = __r_arr[30];
-        let __v_186: G = __r_arr[31];
-        let __v_187: G = { let __values: [G; 34] = [__v_153, __v_5, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_33] = { let __args: [G; IN_33] = [__v_153, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_1, __v_147, __v_148, __v_149, __v_23, __v_150, __v_151, __v_152, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[33].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[33].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[33].bump_multiplicity(__i); } let __ret: [G; OUT_33] = unsafe { *(record.function_queries[33].output_at(__i).as_ptr() as *const [G; OUT_33]) }; __ret }, _ => aiur_fn_33(__args, record, io_buffer, __cu)? } };
+        let __v_154: G = __r_arr[0];
+        let __v_155: G = __r_arr[1];
+        let __v_156: G = __r_arr[2];
+        let __v_157: G = __r_arr[3];
+        let __v_158: G = __r_arr[4];
+        let __v_159: G = __r_arr[5];
+        let __v_160: G = __r_arr[6];
+        let __v_161: G = __r_arr[7];
+        let __v_162: G = __r_arr[8];
+        let __v_163: G = __r_arr[9];
+        let __v_164: G = __r_arr[10];
+        let __v_165: G = __r_arr[11];
+        let __v_166: G = __r_arr[12];
+        let __v_167: G = __r_arr[13];
+        let __v_168: G = __r_arr[14];
+        let __v_169: G = __r_arr[15];
+        let __v_170: G = __r_arr[16];
+        let __v_171: G = __r_arr[17];
+        let __v_172: G = __r_arr[18];
+        let __v_173: G = __r_arr[19];
+        let __v_174: G = __r_arr[20];
+        let __v_175: G = __r_arr[21];
+        let __v_176: G = __r_arr[22];
+        let __v_177: G = __r_arr[23];
+        let __v_178: G = __r_arr[24];
+        let __v_179: G = __r_arr[25];
+        let __v_180: G = __r_arr[26];
+        let __v_181: G = __r_arr[27];
+        let __v_182: G = __r_arr[28];
+        let __v_183: G = __r_arr[29];
+        let __v_184: G = __r_arr[30];
+        let __v_185: G = __r_arr[31];
+        let __v_186: G = G::from_u64(0);
+        let __v_187: G = { let __values: [G; 34] = [__v_186, __v_5, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_28] = [__v_187];
         record.function_queries[28].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -5343,41 +5343,41 @@ fn aiur_fn_29(
         let __v_179: G = G::from_u64(0);
         let __v_180: G = G::from_u64(0);
         let __v_181: G = G::from_u64(0);
-        let __v_182: G = G::from_u64(0);
-        let __r_arr: [G; OUT_33] = { let __args: [G; IN_33] = [__v_182, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_175, __v_176, __v_177, __v_85, __v_178, __v_179, __v_180, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[33].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[33].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[33].bump_multiplicity(__i); } let __ret: [G; OUT_33] = unsafe { *(record.function_queries[33].output_at(__i).as_ptr() as *const [G; OUT_33]) }; __ret }, _ => aiur_fn_33(__args, record, io_buffer, __cu)? } };
-        let __v_183: G = __r_arr[0];
-        let __v_184: G = __r_arr[1];
-        let __v_185: G = __r_arr[2];
-        let __v_186: G = __r_arr[3];
-        let __v_187: G = __r_arr[4];
-        let __v_188: G = __r_arr[5];
-        let __v_189: G = __r_arr[6];
-        let __v_190: G = __r_arr[7];
-        let __v_191: G = __r_arr[8];
-        let __v_192: G = __r_arr[9];
-        let __v_193: G = __r_arr[10];
-        let __v_194: G = __r_arr[11];
-        let __v_195: G = __r_arr[12];
-        let __v_196: G = __r_arr[13];
-        let __v_197: G = __r_arr[14];
-        let __v_198: G = __r_arr[15];
-        let __v_199: G = __r_arr[16];
-        let __v_200: G = __r_arr[17];
-        let __v_201: G = __r_arr[18];
-        let __v_202: G = __r_arr[19];
-        let __v_203: G = __r_arr[20];
-        let __v_204: G = __r_arr[21];
-        let __v_205: G = __r_arr[22];
-        let __v_206: G = __r_arr[23];
-        let __v_207: G = __r_arr[24];
-        let __v_208: G = __r_arr[25];
-        let __v_209: G = __r_arr[26];
-        let __v_210: G = __r_arr[27];
-        let __v_211: G = __r_arr[28];
-        let __v_212: G = __r_arr[29];
-        let __v_213: G = __r_arr[30];
-        let __v_214: G = __r_arr[31];
-        let __v_215: G = { let __values: [G; 34] = [__v_181, __v_5, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_33] = { let __args: [G; IN_33] = [__v_181, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_175, __v_176, __v_177, __v_85, __v_178, __v_179, __v_180, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[33].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[33].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[33].bump_multiplicity(__i); } let __ret: [G; OUT_33] = unsafe { *(record.function_queries[33].output_at(__i).as_ptr() as *const [G; OUT_33]) }; __ret }, _ => aiur_fn_33(__args, record, io_buffer, __cu)? } };
+        let __v_182: G = __r_arr[0];
+        let __v_183: G = __r_arr[1];
+        let __v_184: G = __r_arr[2];
+        let __v_185: G = __r_arr[3];
+        let __v_186: G = __r_arr[4];
+        let __v_187: G = __r_arr[5];
+        let __v_188: G = __r_arr[6];
+        let __v_189: G = __r_arr[7];
+        let __v_190: G = __r_arr[8];
+        let __v_191: G = __r_arr[9];
+        let __v_192: G = __r_arr[10];
+        let __v_193: G = __r_arr[11];
+        let __v_194: G = __r_arr[12];
+        let __v_195: G = __r_arr[13];
+        let __v_196: G = __r_arr[14];
+        let __v_197: G = __r_arr[15];
+        let __v_198: G = __r_arr[16];
+        let __v_199: G = __r_arr[17];
+        let __v_200: G = __r_arr[18];
+        let __v_201: G = __r_arr[19];
+        let __v_202: G = __r_arr[20];
+        let __v_203: G = __r_arr[21];
+        let __v_204: G = __r_arr[22];
+        let __v_205: G = __r_arr[23];
+        let __v_206: G = __r_arr[24];
+        let __v_207: G = __r_arr[25];
+        let __v_208: G = __r_arr[26];
+        let __v_209: G = __r_arr[27];
+        let __v_210: G = __r_arr[28];
+        let __v_211: G = __r_arr[29];
+        let __v_212: G = __r_arr[30];
+        let __v_213: G = __r_arr[31];
+        let __v_214: G = G::from_u64(0);
+        let __v_215: G = { let __values: [G; 34] = [__v_214, __v_5, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_216: G = G::from_u64(1);
         let __v_217: G = G::from_u64(1);
         let __v_218: G = { let __values: [G; 3] = [__v_216, __v_217, __v_217]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -8207,12 +8207,12 @@ fn aiur_fn_35(
       },
       _ => {
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = G::from_u64(0);
-        let __v_12: G = G::from_u64(1);
-        let __v_13: G = (__v_8 - __v_12);
-        let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_10, __v_13, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-        let __v_14: G = __r_arr[0];
-        let __v_15: G = { let __values: [G; 3] = [__v_11, __v_0, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = G::from_u64(1);
+        let __v_12: G = (__v_8 - __v_11);
+        let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_10, __v_12, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
+        let __v_13: G = __r_arr[0];
+        let __v_14: G = G::from_u64(0);
+        let __v_15: G = { let __values: [G; 3] = [__v_14, __v_0, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_35] = [__v_15];
         record.function_queries[35].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8259,10 +8259,10 @@ fn aiur_fn_36(
             let __v_13: G = G::from_u64(1);
             let __v_14: G = (__v_9 - __v_13);
             let __v_15: G = (__v_12 + __v_14);
-            let __v_16: G = G::from_u64(0);
             let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_9, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-            let __v_17: G = __r_arr[0];
-            let __v_18: G = { let __values: [G; 3] = [__v_16, __v_15, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = __r_arr[0];
+            let __v_17: G = G::from_u64(0);
+            let __v_18: G = { let __values: [G; 3] = [__v_17, __v_15, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_36] = [__v_18];
             record.function_queries[36].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8274,10 +8274,10 @@ fn aiur_fn_36(
         let __v_13: G = G::from_u64(1);
         let __v_14: G = (__v_9 - __v_13);
         let __v_15: G = (__v_12 + __v_14);
-        let __v_16: G = G::from_u64(0);
         let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_9, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-        let __v_17: G = __r_arr[0];
-        let __v_18: G = { let __values: [G; 3] = [__v_16, __v_15, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_16: G = __r_arr[0];
+        let __v_17: G = G::from_u64(0);
+        let __v_18: G = { let __values: [G; 3] = [__v_17, __v_15, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_36] = [__v_18];
         record.function_queries[36].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8331,10 +8331,10 @@ fn aiur_fn_37(
             let __v_17: G = (__v_10 - __v_16);
             let __v_18: G = (__v_15 + __v_17);
             let __v_19: G = (__v_14 + __v_18);
-            let __v_20: G = G::from_u64(0);
             let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_10, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-            let __v_21: G = __r_arr[0];
-            let __v_22: G = { let __values: [G; 3] = [__v_20, __v_19, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_20: G = __r_arr[0];
+            let __v_21: G = G::from_u64(0);
+            let __v_22: G = { let __values: [G; 3] = [__v_21, __v_19, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_37] = [__v_22];
             record.function_queries[37].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8349,10 +8349,10 @@ fn aiur_fn_37(
         let __v_17: G = (__v_10 - __v_16);
         let __v_18: G = (__v_15 + __v_17);
         let __v_19: G = (__v_14 + __v_18);
-        let __v_20: G = G::from_u64(0);
         let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_10, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-        let __v_21: G = __r_arr[0];
-        let __v_22: G = { let __values: [G; 3] = [__v_20, __v_19, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_20: G = __r_arr[0];
+        let __v_21: G = G::from_u64(0);
+        let __v_22: G = { let __values: [G; 3] = [__v_21, __v_19, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_37] = [__v_22];
         record.function_queries[37].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8406,10 +8406,10 @@ fn aiur_fn_38(
             let __v_17: G = (__v_10 - __v_16);
             let __v_18: G = (__v_15 + __v_17);
             let __v_19: G = (__v_14 + __v_18);
-            let __v_20: G = G::from_u64(0);
             let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_10, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-            let __v_21: G = __r_arr[0];
-            let __v_22: G = { let __values: [G; 3] = [__v_20, __v_19, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_20: G = __r_arr[0];
+            let __v_21: G = G::from_u64(0);
+            let __v_22: G = { let __values: [G; 3] = [__v_21, __v_19, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_38] = [__v_22];
             record.function_queries[38].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8424,10 +8424,10 @@ fn aiur_fn_38(
         let __v_17: G = (__v_10 - __v_16);
         let __v_18: G = (__v_15 + __v_17);
         let __v_19: G = (__v_14 + __v_18);
-        let __v_20: G = G::from_u64(0);
         let __r_arr: [G; OUT_35] = { let __args: [G; IN_35] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_10, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[35].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[35].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[35].bump_multiplicity(__i); } let __ret: [G; OUT_35] = unsafe { *(record.function_queries[35].output_at(__i).as_ptr() as *const [G; OUT_35]) }; __ret }, _ => aiur_fn_35(__args, record, io_buffer, __cu)? } };
-        let __v_21: G = __r_arr[0];
-        let __v_22: G = { let __values: [G; 3] = [__v_20, __v_19, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_20: G = __r_arr[0];
+        let __v_21: G = G::from_u64(0);
+        let __v_22: G = { let __values: [G; 3] = [__v_21, __v_19, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_38] = [__v_22];
         record.function_queries[38].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8497,31 +8497,31 @@ fn aiur_fn_40(
       0u64 => {
         let __v_2: G = G::from_u64(0);
         let __v_3: G = G::from_u64(0);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_40] = [__v_4];
         record.function_queries[40].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       1u64 => {
-        let __v_2: G = G::from_u64(0);
-        let __v_3: G = G::from_u64(1);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_2: G = G::from_u64(1);
+        let __v_3: G = G::from_u64(0);
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_40] = [__v_4];
         record.function_queries[40].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       2u64 => {
-        let __v_2: G = G::from_u64(0);
-        let __v_3: G = G::from_u64(2);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_2: G = G::from_u64(2);
+        let __v_3: G = G::from_u64(0);
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_40] = [__v_4];
         record.function_queries[40].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       3u64 => {
-        let __v_2: G = G::from_u64(0);
-        let __v_3: G = G::from_u64(3);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_2: G = G::from_u64(3);
+        let __v_3: G = G::from_u64(0);
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_40] = [__v_4];
         record.function_queries[40].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8552,15 +8552,15 @@ fn aiur_fn_41(
           0u64 => {
             let __v_3: G = G::from_u64(0);
             let __v_4: G = G::from_u64(0);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(4);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(4);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8573,17 +8573,17 @@ fn aiur_fn_41(
       1u64 => {
         match __v_1.as_canonical_u64() {
           0u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(1);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(1);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(5);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(5);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8596,17 +8596,17 @@ fn aiur_fn_41(
       2u64 => {
         match __v_1.as_canonical_u64() {
           0u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(2);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(2);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(6);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(6);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8619,17 +8619,17 @@ fn aiur_fn_41(
       3u64 => {
         match __v_1.as_canonical_u64() {
           0u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(3);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(3);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_3: G = G::from_u64(0);
-            let __v_4: G = G::from_u64(7);
-            let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_3: G = G::from_u64(7);
+            let __v_4: G = G::from_u64(0);
+            let __v_5: G = { let __values: [G; 3] = [__v_4, __v_3, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_41] = [__v_5];
             record.function_queries[41].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -9536,7 +9536,7 @@ fn aiur_fn_52(
       0u64 => {
         let __v_10: G = G::from_u64(0);
         let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_10, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_52] = [__v_12];
         record.function_queries[52].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -9873,14 +9873,14 @@ fn aiur_fn_56(
         let __v_48: G = __loaded[17];
         let __r_arr: [G; OUT_49] = { let __args: [G; IN_49] = [__v_0, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[49].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[49].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[49].bump_multiplicity(__i); } let __ret: [G; OUT_49] = unsafe { *(record.function_queries[49].output_at(__i).as_ptr() as *const [G; OUT_49]) }; __ret }, _ => aiur_fn_49(__args, record, io_buffer, __cu)? } };
         let __v_49: G = __r_arr[0];
-        let __v_50: G = G::from_u64(0);
         let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
+        let __v_50: G = __r_arr[0];
+        let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_50]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
         let __v_51: G = __r_arr[0];
-        let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_51]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_51]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_52: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_52]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
-        let __v_53: G = __r_arr[0];
-        let __v_54: G = { let __values: [G; 3] = [__v_50, __v_49, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_53: G = G::from_u64(0);
+        let __v_54: G = { let __values: [G; 3] = [__v_53, __v_49, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_56] = [__v_54];
         record.function_queries[56].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -10076,24 +10076,24 @@ fn aiur_fn_59(
         let __v_71: G = __r_arr[5];
         let __v_72: G = __r_arr[6];
         let __v_73: G = __r_arr[7];
-        let __v_74: G = G::from_u64(0);
         let __r_arr: [G; OUT_58] = { let __args: [G; IN_58] = [__v_43, __v_44]; let __cu = unconstrained; let __hit = record.function_queries[58].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[58].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[58].bump_multiplicity(__i); } let __ret: [G; OUT_58] = unsafe { *(record.function_queries[58].output_at(__i).as_ptr() as *const [G; OUT_58]) }; __ret }, _ => aiur_fn_58(__args, record, io_buffer, __cu)? } };
+        let __v_74: G = __r_arr[0];
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_75: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_75]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_75]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
         let __v_76: G = __r_arr[0];
-        let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_76]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_76]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_77: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_77]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_77]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_78: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_78]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_78]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_79: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_79]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_79]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_80: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_80]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_80]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_81: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_81]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
-        let __v_82: G = __r_arr[0];
-        let __v_83: G = { let __values: [G; 3] = [__v_74, __v_65, __v_82]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_82: G = G::from_u64(0);
+        let __v_83: G = { let __values: [G; 3] = [__v_82, __v_65, __v_81]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_59] = [__v_83];
         record.function_queries[59].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -10144,12 +10144,12 @@ fn aiur_fn_60(
         let __v_26: G = __loaded[15];
         let __v_27: G = __loaded[16];
         let __v_28: G = __loaded[17];
-        let __v_29: G = G::from_u64(0);
         let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
+        let __v_29: G = __r_arr[0];
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_30: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
-        let __v_31: G = __r_arr[0];
-        let __v_32: G = { let __values: [G; 3] = [__v_29, __v_0, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = G::from_u64(0);
+        let __v_32: G = { let __values: [G; 3] = [__v_31, __v_0, __v_30]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_60] = [__v_32];
         record.function_queries[60].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -10280,18 +10280,18 @@ fn aiur_fn_62(
         let __v_50: G = __loaded[15];
         let __v_51: G = __loaded[16];
         let __v_52: G = __loaded[17];
-        let __v_53: G = G::from_u64(0);
         let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
+        let __v_53: G = __r_arr[0];
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_53]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_54: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_54]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_54]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_55: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_56: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_57: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
-        let __v_58: G = __r_arr[0];
-        let __v_59: G = { let __values: [G; 3] = [__v_53, __v_0, __v_58]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_58: G = G::from_u64(0);
+        let __v_59: G = { let __values: [G; 3] = [__v_58, __v_0, __v_57]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_62] = [__v_59];
         record.function_queries[62].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -10439,20 +10439,20 @@ fn aiur_fn_64(
         let __v_51: G = __r_arr[5];
         let __v_52: G = __r_arr[6];
         let __v_53: G = __r_arr[7];
-        let __v_54: G = G::from_u64(0);
         let __r_arr: [G; OUT_63] = { let __args: [G; IN_63] = [__v_26, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[63].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[63].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[63].bump_multiplicity(__i); } let __ret: [G; OUT_63] = unsafe { *(record.function_queries[63].output_at(__i).as_ptr() as *const [G; OUT_63]) }; __ret }, _ => aiur_fn_63(__args, record, io_buffer, __cu)? } };
+        let __v_54: G = __r_arr[0];
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_55: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
         let __v_56: G = __r_arr[0];
-        let __r_arr: [G; OUT_34] = { let __args: [G; IN_34] = [__v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[34].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[34].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[34].bump_multiplicity(__i); } let __ret: [G; OUT_34] = unsafe { *(record.function_queries[34].output_at(__i).as_ptr() as *const [G; OUT_34]) }; __ret }, _ => aiur_fn_34(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_57: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_58: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_58]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_58]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
         let __v_59: G = __r_arr[0];
-        let __r_arr: [G; OUT_36] = { let __args: [G; IN_36] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_59]; let __cu = unconstrained; let __hit = record.function_queries[36].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[36].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[36].bump_multiplicity(__i); } let __ret: [G; OUT_36] = unsafe { *(record.function_queries[36].output_at(__i).as_ptr() as *const [G; OUT_36]) }; __ret }, _ => aiur_fn_36(__args, record, io_buffer, __cu)? } };
-        let __v_60: G = __r_arr[0];
-        let __v_61: G = { let __values: [G; 3] = [__v_54, __v_0, __v_60]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_60: G = G::from_u64(0);
+        let __v_61: G = { let __values: [G; 3] = [__v_60, __v_0, __v_59]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_64] = [__v_61];
         record.function_queries[64].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -10598,30 +10598,30 @@ fn aiur_fn_67(
     match __v_0.as_canonical_u64() {
       0u64 => {
         let __v_46: G = G::from_u64(0);
-        let __v_47: G = G::from_u64(0);
         let __r_arr: [G; OUT_56] = { let __args: [G; IN_56] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[56].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[56].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[56].bump_multiplicity(__i); } let __ret: [G; OUT_56] = unsafe { *(record.function_queries[56].output_at(__i).as_ptr() as *const [G; OUT_56]) }; __ret }, _ => aiur_fn_56(__args, record, io_buffer, __cu)? } };
-        let __v_48: G = __r_arr[0];
-        let __v_49: G = { let __values: [G; 3] = [__v_46, __v_47, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_47: G = __r_arr[0];
+        let __v_48: G = G::from_u64(0);
+        let __v_49: G = { let __values: [G; 3] = [__v_48, __v_46, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_67] = [__v_49];
         record.function_queries[67].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       1u64 => {
-        let __v_46: G = G::from_u64(0);
-        let __v_47: G = G::from_u64(1);
+        let __v_46: G = G::from_u64(1);
         let __r_arr: [G; OUT_64] = { let __args: [G; IN_64] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[64].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[64].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[64].bump_multiplicity(__i); } let __ret: [G; OUT_64] = unsafe { *(record.function_queries[64].output_at(__i).as_ptr() as *const [G; OUT_64]) }; __ret }, _ => aiur_fn_64(__args, record, io_buffer, __cu)? } };
-        let __v_48: G = __r_arr[0];
-        let __v_49: G = { let __values: [G; 3] = [__v_46, __v_47, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_47: G = __r_arr[0];
+        let __v_48: G = G::from_u64(0);
+        let __v_49: G = { let __values: [G; 3] = [__v_48, __v_46, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_67] = [__v_49];
         record.function_queries[67].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       2u64 => {
-        let __v_46: G = G::from_u64(0);
-        let __v_47: G = G::from_u64(2);
+        let __v_46: G = G::from_u64(2);
         let __r_arr: [G; OUT_59] = { let __args: [G; IN_59] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[59].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[59].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[59].bump_multiplicity(__i); } let __ret: [G; OUT_59] = unsafe { *(record.function_queries[59].output_at(__i).as_ptr() as *const [G; OUT_59]) }; __ret }, _ => aiur_fn_59(__args, record, io_buffer, __cu)? } };
-        let __v_48: G = __r_arr[0];
-        let __v_49: G = { let __values: [G; 3] = [__v_46, __v_47, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_47: G = __r_arr[0];
+        let __v_48: G = G::from_u64(0);
+        let __v_49: G = { let __values: [G; 3] = [__v_48, __v_46, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_67] = [__v_49];
         record.function_queries[67].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -11409,23 +11409,23 @@ fn aiur_fn_77(
           _ => {
             let __v_27: G = G::from_u64(1);
             let __v_28: G = (__v_26 + __v_27);
-            let __r_arr: [G; OUT_75] = { let __args: [G; IN_75] = [__v_3, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[75].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[75].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[75].bump_multiplicity(__i); } let __ret: [G; OUT_75] = unsafe { *(record.function_queries[75].output_at(__i).as_ptr() as *const [G; OUT_75]) }; __ret }, _ => aiur_fn_75(__args, record, io_buffer, __cu)? } };
-            let __v_29: G = __r_arr[0];
-            let __v_30: G = __r_arr[1];
-            let __v_31: G = __r_arr[2];
-            let __v_32: G = __r_arr[3];
-            let __v_33: G = __r_arr[4];
-            let __v_34: G = __r_arr[5];
-            let __v_35: G = __r_arr[6];
-            let __v_36: G = __r_arr[7];
-            let __v_37: G = __r_arr[8];
-            let __v_38: G = G::from_u64(9);
-            let __v_39: G = if unconstrained { Bytes2::less_than(&__v_28, &__v_38) } else { bytes2_less_than_value(__v_28, __v_38, record) };
-            let __v_40: G = G::from_u64(1);
-            if (__v_39 != __v_40) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: Some("tag2: payload width exceeds 8 bytes".to_string()) });
+            let __v_29: G = G::from_u64(9);
+            let __v_30: G = if unconstrained { Bytes2::less_than(&__v_28, &__v_29) } else { bytes2_less_than_value(__v_28, __v_29, record) };
+            let __v_31: G = G::from_u64(1);
+            if (__v_30 != __v_31) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_30.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("tag2: payload width exceeds 8 bytes".to_string()) });
             }
-            let __ret: [G; OUT_77] = [__v_14, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37];
+            let __r_arr: [G; OUT_75] = { let __args: [G; IN_75] = [__v_3, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[75].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[75].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[75].bump_multiplicity(__i); } let __ret: [G; OUT_75] = unsafe { *(record.function_queries[75].output_at(__i).as_ptr() as *const [G; OUT_75]) }; __ret }, _ => aiur_fn_75(__args, record, io_buffer, __cu)? } };
+            let __v_32: G = __r_arr[0];
+            let __v_33: G = __r_arr[1];
+            let __v_34: G = __r_arr[2];
+            let __v_35: G = __r_arr[3];
+            let __v_36: G = __r_arr[4];
+            let __v_37: G = __r_arr[5];
+            let __v_38: G = __r_arr[6];
+            let __v_39: G = __r_arr[7];
+            let __v_40: G = __r_arr[8];
+            let __ret: [G; OUT_77] = [__v_14, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40];
             record.function_queries[77].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
@@ -12105,16 +12105,16 @@ fn aiur_fn_85(
         return Ok(__ret);
       },
       7u64 => {
-        let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = __r_arr[1];
         let __r_arr: [G; OUT_5] = { let __args: [G; IN_5] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[5].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[5].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[5].bump_multiplicity(__i); } let __ret: [G; OUT_5] = unsafe { *(record.function_queries[5].output_at(__i).as_ptr() as *const [G; OUT_5]) }; __ret }, _ => aiur_fn_5(__args, record, io_buffer, __cu)? } };
-        let __v_13: G = __r_arr[0];
-        let __v_14: G = G::from_u64(0);
-        if (__v_13 != __v_14) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("App with zero arguments".to_string()) });
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(0);
+        if (__v_11 != __v_12) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("App with zero arguments".to_string()) });
         }
-        let __loaded: [G; 18] = { let __mq = record.memory_queries.get_mut(&18).ok_or(ExecError::InvalidMemorySize(18))?; let __ptr_u64 = __v_11.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 18 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 18] = __args[..18].try_into().unwrap(); __arr };
+        let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
+        let __v_13: G = __r_arr[0];
+        let __v_14: G = __r_arr[1];
+        let __loaded: [G; 18] = { let __mq = record.memory_queries.get_mut(&18).ok_or(ExecError::InvalidMemorySize(18))?; let __ptr_u64 = __v_13.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 18 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 18] = __args[..18].try_into().unwrap(); __arr };
         let __v_15: G = __loaded[0];
         let __v_16: G = __loaded[1];
         let __v_17: G = __loaded[2];
@@ -12140,7 +12140,7 @@ fn aiur_fn_85(
             if (__v_33 != __v_34) {
               return Err(ExecError::AssertEqMismatch { lhs: __v_33.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("non-canonical application telescope".to_string()) });
             }
-            let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_11, __v_12, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_13, __v_14, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
             let __v_35: G = __r_arr[0];
             let __v_36: G = __r_arr[1];
             let __ret: [G; OUT_85] = [__v_35, __v_36];
@@ -12148,7 +12148,7 @@ fn aiur_fn_85(
             return Ok(__ret);
           },
           _ => {
-            let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_11, __v_12, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_13, __v_14, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
             let __v_33: G = __r_arr[0];
             let __v_34: G = __r_arr[1];
             let __ret: [G; OUT_85] = [__v_33, __v_34];
@@ -12247,24 +12247,24 @@ fn aiur_fn_86(
     let __v_25: G = G::from_u64(0);
     let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
     let __v_26: G = __r_arr[0];
+    let __v_27: G = (__v_17 + __v_26);
+    let __v_28: G = G::from_u64(1);
+    if (__v_27 != __v_28) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_27.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("invalid let nonDep flag".to_string()) });
+    }
     let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
-    let __v_27: G = __r_arr[0];
-    let __v_28: G = __r_arr[1];
-    let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
     let __v_29: G = __r_arr[0];
     let __v_30: G = __r_arr[1];
     let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
     let __v_31: G = __r_arr[0];
     let __v_32: G = __r_arr[1];
-    let __v_33: G = (__v_17 + __v_26);
-    let __v_34: G = G::from_u64(1);
-    if (__v_33 != __v_34) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_33.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("invalid let nonDep flag".to_string()) });
-    }
+    let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_32]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
+    let __v_33: G = __r_arr[0];
+    let __v_34: G = __r_arr[1];
     let __v_35: G = G::from_u64(10);
     let __v_36: G = G::from_u64(0);
-    let __v_37: G = { let __values: [G; 18] = [__v_35, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_27, __v_29, __v_31, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36]; let __mq = record.memory_queries.get_mut(&18).ok_or(ExecError::InvalidMemorySize(18))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __ret: [G; OUT_86] = [__v_37, __v_32];
+    let __v_37: G = { let __values: [G; 18] = [__v_35, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_29, __v_31, __v_33, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36]; let __mq = record.memory_queries.get_mut(&18).ok_or(ExecError::InvalidMemorySize(18))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __ret: [G; OUT_86] = [__v_37, __v_34];
     record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -12325,10 +12325,10 @@ fn aiur_fn_87(
         let __v_32: G = __r_arr[6];
         let __v_33: G = __r_arr[7];
         let __v_34: G = __r_arr[8];
-        let __v_35: G = G::from_u64(1);
-        let __v_36: G = { let __values: [G; 9] = [__v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_35: G = { let __values: [G; 9] = [__v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_36: G = G::from_u64(1);
         let __v_37: G = G::from_u64(0);
-        let __ret: [G; OUT_87] = [__v_35, __v_36, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37];
+        let __ret: [G; OUT_87] = [__v_36, __v_35, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37];
         record.function_queries[87].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -12427,11 +12427,11 @@ fn aiur_fn_88(
         let __v_28: G = __r_arr[7];
         let __v_29: G = __r_arr[8];
         let __v_30: G = __r_arr[9];
-        let __v_31: G = G::from_u64(2);
-        let __v_32: G = { let __values: [G; 9] = [__v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_33: G = { let __values: [G; 9] = [__v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = { let __values: [G; 9] = [__v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_32: G = { let __values: [G; 9] = [__v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_33: G = G::from_u64(2);
         let __v_34: G = G::from_u64(0);
-        let __ret: [G; OUT_88] = [__v_31, __v_32, __v_33, __v_34, __v_34, __v_34, __v_34, __v_34, __v_34, __v_30];
+        let __ret: [G; OUT_88] = [__v_33, __v_31, __v_32, __v_34, __v_34, __v_34, __v_34, __v_34, __v_34, __v_30];
         record.function_queries[88].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -12458,11 +12458,11 @@ fn aiur_fn_88(
         let __v_28: G = __r_arr[7];
         let __v_29: G = __r_arr[8];
         let __v_30: G = __r_arr[9];
-        let __v_31: G = G::from_u64(3);
-        let __v_32: G = { let __values: [G; 9] = [__v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_33: G = { let __values: [G; 9] = [__v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = { let __values: [G; 9] = [__v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_32: G = { let __values: [G; 9] = [__v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_33: G = G::from_u64(3);
         let __v_34: G = G::from_u64(0);
-        let __ret: [G; OUT_88] = [__v_31, __v_32, __v_33, __v_34, __v_34, __v_34, __v_34, __v_34, __v_34, __v_30];
+        let __ret: [G; OUT_88] = [__v_33, __v_31, __v_32, __v_34, __v_34, __v_34, __v_34, __v_34, __v_34, __v_30];
         record.function_queries[88].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -12962,9 +12962,9 @@ fn aiur_fn_91(
         let __r_arr: [G; OUT_91] = { let __args: [G; IN_91] = [__v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[91].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[91].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[91].bump_multiplicity(__i); } let __ret: [G; OUT_91] = unsafe { *(record.function_queries[91].output_at(__i).as_ptr() as *const [G; OUT_91]) }; __ret }, _ => aiur_fn_91(__args, record, io_buffer, __cu)? } };
         let __v_28: G = __r_arr[0];
         let __v_29: G = __r_arr[1];
-        let __v_30: G = G::from_u64(0);
-        let __v_31: G = { let __values: [G; 9] = [__v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_32: G = { let __values: [G; 3] = [__v_30, __v_31, __v_28]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_30: G = { let __values: [G; 9] = [__v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __mq = record.memory_queries.get_mut(&9).ok_or(ExecError::InvalidMemorySize(9))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = G::from_u64(0);
+        let __v_32: G = { let __values: [G; 3] = [__v_31, __v_30, __v_28]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_91] = [__v_32, __v_29];
         record.function_queries[91].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14671,19 +14671,19 @@ fn aiur_fn_116(
     let __v_10: G = __loaded[9];
     match __v_1.as_canonical_u64() {
       1u64 => {
-        let __v_11: G = G::from_u64(0);
-        let __v_12: G = G::from_u64(1);
+        let __v_11: G = G::from_u64(1);
+        let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
         let __v_14: G = G::from_u64(0);
         let __v_15: G = G::from_u64(0);
         let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
         let __v_18: G = G::from_u64(0);
-        let __v_19: G = G::from_u64(0);
+        let __v_19: G = G::from_u64(1);
         let __v_20: G = G::from_u64(1);
-        let __v_21: G = G::from_u64(1);
-        let __v_22: G = { let __values: [G; 10] = [__v_20, __v_21, __v_21, __v_21, __v_21, __v_21, __v_21, __v_21, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_23: G = { let __values: [G; 10] = [__v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_22]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_21: G = { let __values: [G; 10] = [__v_19, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_22: G = G::from_u64(0);
+        let __v_23: G = { let __values: [G; 10] = [__v_22, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_21]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_116] = [__v_23];
         record.function_queries[116].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14716,10 +14716,10 @@ fn aiur_fn_116(
             return Ok(__ret);
           },
           _ => {
-            let __v_28: G = G::from_u64(0);
             let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
-            let __v_29: G = __r_arr[0];
-            let __v_30: G = { let __values: [G; 10] = [__v_28, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_28: G = __r_arr[0];
+            let __v_29: G = G::from_u64(0);
+            let __v_30: G = { let __values: [G; 10] = [__v_29, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_28]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_116] = [__v_30];
             record.function_queries[116].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -14832,10 +14832,10 @@ fn aiur_fn_117(
             let __v_46: G = __r_arr[7];
             let __v_47: G = __r_arr[8];
             let __v_48: G = (__v_31 + __v_47);
-            let __v_49: G = G::from_u64(0);
             let __r_arr: [G; OUT_117] = { let __args: [G; IN_117] = [__v_12, __v_22, __v_48]; let __cu = unconstrained; let __hit = record.function_queries[117].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[117].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[117].bump_multiplicity(__i); } let __ret: [G; OUT_117] = unsafe { *(record.function_queries[117].output_at(__i).as_ptr() as *const [G; OUT_117]) }; __ret }, _ => aiur_fn_117(__args, record, io_buffer, __cu)? } };
-            let __v_50: G = __r_arr[0];
-            let __v_51: G = { let __values: [G; 10] = [__v_49, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_50]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_49: G = __r_arr[0];
+            let __v_50: G = G::from_u64(0);
+            let __v_51: G = { let __values: [G; 10] = [__v_50, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_49]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_117] = [__v_51];
             record.function_queries[117].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -15171,10 +15171,10 @@ fn aiur_fn_121(
         if !unconstrained { let __vi = __v_4; let __vj = __v_5; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_6; let __vj = __v_7; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_11: G = G::from_u64(0);
         let __r_arr: [G; OUT_121] = { let __args: [G; IN_121] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[121].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[121].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[121].bump_multiplicity(__i); } let __ret: [G; OUT_121] = unsafe { *(record.function_queries[121].output_at(__i).as_ptr() as *const [G; OUT_121]) }; __ret }, _ => aiur_fn_121(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 10] = [__v_11, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(0);
+        let __v_13: G = { let __values: [G; 10] = [__v_12, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_121] = [__v_13];
         record.function_queries[121].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -15245,11 +15245,11 @@ fn aiur_fn_122(
                 return Ok(__ret);
               },
               0u64 => {
-                let __v_23: G = G::from_u64(0);
+                let __v_23: G = G::from_u64(1);
                 let __v_24: G = G::from_u64(1);
-                let __v_25: G = G::from_u64(1);
-                let __v_26: G = { let __values: [G; 10] = [__v_24, __v_25, __v_25, __v_25, __v_25, __v_25, __v_25, __v_25, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_27: G = { let __values: [G; 10] = [__v_23, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_26]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_25: G = { let __values: [G; 10] = [__v_23, __v_24, __v_24, __v_24, __v_24, __v_24, __v_24, __v_24, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_26: G = G::from_u64(0);
+                let __v_27: G = { let __values: [G; 10] = [__v_26, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_25]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_122] = [__v_27];
                 record.function_queries[122].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -15367,19 +15367,19 @@ fn aiur_fn_125(
 ) -> Result<[G; OUT_125], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
-    let __v_1: G = G::from_u64(0);
-    let __v_2: G = G::from_u64(1);
+    let __v_1: G = G::from_u64(1);
+    let __v_2: G = G::from_u64(0);
     let __v_3: G = G::from_u64(0);
     let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
     let __v_7: G = G::from_u64(0);
     let __v_8: G = G::from_u64(0);
-    let __v_9: G = G::from_u64(0);
+    let __v_9: G = G::from_u64(1);
     let __v_10: G = G::from_u64(1);
-    let __v_11: G = G::from_u64(1);
-    let __v_12: G = { let __values: [G; 10] = [__v_10, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_13: G = { let __values: [G; 10] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = { let __values: [G; 10] = [__v_9, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = G::from_u64(0);
+    let __v_13: G = { let __values: [G; 10] = [__v_12, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_123] = { let __args: [G; IN_123] = [__v_0, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[123].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[123].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[123].bump_multiplicity(__i); } let __ret: [G; OUT_123] = unsafe { *(record.function_queries[123].output_at(__i).as_ptr() as *const [G; OUT_123]) }; __ret }, _ => aiur_fn_123(__args, record, io_buffer, __cu)? } };
     let __v_14: G = __r_arr[0];
     let __ret: [G; OUT_125] = [__v_14];
@@ -15602,19 +15602,19 @@ fn aiur_fn_128(
     let __v_136: G = G::from_u64(0);
     let __v_137: G = if unconstrained { Bytes2::xor(&__v_131, &__v_136) } else { bytes2_xor_value(__v_131, __v_136, record) };
     let __v_138: G = G::from_u64(256);
-    let __v_139: G = (__v_138 * __v_137);
-    let __v_140: G = (__v_135 + __v_139);
-    let __v_141: G = (__v_19 + __v_140);
-    let __v_142: G = G::from_u64(256);
-    let __v_143: G = (__v_142 * __v_135);
-    let __v_144: G = G::from_u64(65536);
+    let __v_139: G = (__v_138 * __v_135);
+    let __v_140: G = G::from_u64(65536);
+    let __v_141: G = (__v_140 * __v_137);
+    let __v_142: G = (__v_139 + __v_141);
+    let __v_143: G = (__v_133 + __v_142);
+    if (__v_16 != __v_143) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_16.as_canonical_u64(), rhs: __v_143.as_canonical_u64(), msg: Some("u64_mul column 0: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_144: G = G::from_u64(256);
     let __v_145: G = (__v_144 * __v_137);
-    let __v_146: G = (__v_143 + __v_145);
-    let __v_147: G = (__v_133 + __v_146);
-    if (__v_16 != __v_147) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_16.as_canonical_u64(), rhs: __v_147.as_canonical_u64(), msg: Some("u64_mul column 0: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_141]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_146: G = (__v_135 + __v_145);
+    let __v_147: G = (__v_19 + __v_146);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_147]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_148: G = __r_arr[0];
     let __v_149: G = __r_arr[1];
     let __v_150: G = __r_arr[2];
@@ -15625,19 +15625,19 @@ fn aiur_fn_128(
     let __v_155: G = G::from_u64(0);
     let __v_156: G = if unconstrained { Bytes2::xor(&__v_150, &__v_155) } else { bytes2_xor_value(__v_150, __v_155, record) };
     let __v_157: G = G::from_u64(256);
-    let __v_158: G = (__v_157 * __v_156);
-    let __v_159: G = (__v_154 + __v_158);
-    let __v_160: G = (__v_24 + __v_159);
-    let __v_161: G = G::from_u64(256);
-    let __v_162: G = (__v_161 * __v_154);
-    let __v_163: G = G::from_u64(65536);
+    let __v_158: G = (__v_157 * __v_154);
+    let __v_159: G = G::from_u64(65536);
+    let __v_160: G = (__v_159 * __v_156);
+    let __v_161: G = (__v_158 + __v_160);
+    let __v_162: G = (__v_152 + __v_161);
+    if (__v_147 != __v_162) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_147.as_canonical_u64(), rhs: __v_162.as_canonical_u64(), msg: Some("u64_mul column 1: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_163: G = G::from_u64(256);
     let __v_164: G = (__v_163 * __v_156);
-    let __v_165: G = (__v_162 + __v_164);
-    let __v_166: G = (__v_152 + __v_165);
-    if (__v_141 != __v_166) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_166.as_canonical_u64(), msg: Some("u64_mul column 1: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_160]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_165: G = (__v_154 + __v_164);
+    let __v_166: G = (__v_24 + __v_165);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_166]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_167: G = __r_arr[0];
     let __v_168: G = __r_arr[1];
     let __v_169: G = __r_arr[2];
@@ -15648,19 +15648,19 @@ fn aiur_fn_128(
     let __v_174: G = G::from_u64(0);
     let __v_175: G = if unconstrained { Bytes2::xor(&__v_169, &__v_174) } else { bytes2_xor_value(__v_169, __v_174, record) };
     let __v_176: G = G::from_u64(256);
-    let __v_177: G = (__v_176 * __v_175);
-    let __v_178: G = (__v_173 + __v_177);
-    let __v_179: G = (__v_31 + __v_178);
-    let __v_180: G = G::from_u64(256);
-    let __v_181: G = (__v_180 * __v_173);
-    let __v_182: G = G::from_u64(65536);
+    let __v_177: G = (__v_176 * __v_173);
+    let __v_178: G = G::from_u64(65536);
+    let __v_179: G = (__v_178 * __v_175);
+    let __v_180: G = (__v_177 + __v_179);
+    let __v_181: G = (__v_171 + __v_180);
+    if (__v_166 != __v_181) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_166.as_canonical_u64(), rhs: __v_181.as_canonical_u64(), msg: Some("u64_mul column 2: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_182: G = G::from_u64(256);
     let __v_183: G = (__v_182 * __v_175);
-    let __v_184: G = (__v_181 + __v_183);
-    let __v_185: G = (__v_171 + __v_184);
-    if (__v_160 != __v_185) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_160.as_canonical_u64(), rhs: __v_185.as_canonical_u64(), msg: Some("u64_mul column 2: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_179]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_184: G = (__v_173 + __v_183);
+    let __v_185: G = (__v_31 + __v_184);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_185]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_186: G = __r_arr[0];
     let __v_187: G = __r_arr[1];
     let __v_188: G = __r_arr[2];
@@ -15671,19 +15671,19 @@ fn aiur_fn_128(
     let __v_193: G = G::from_u64(0);
     let __v_194: G = if unconstrained { Bytes2::xor(&__v_188, &__v_193) } else { bytes2_xor_value(__v_188, __v_193, record) };
     let __v_195: G = G::from_u64(256);
-    let __v_196: G = (__v_195 * __v_194);
-    let __v_197: G = (__v_192 + __v_196);
-    let __v_198: G = (__v_40 + __v_197);
-    let __v_199: G = G::from_u64(256);
-    let __v_200: G = (__v_199 * __v_192);
-    let __v_201: G = G::from_u64(65536);
+    let __v_196: G = (__v_195 * __v_192);
+    let __v_197: G = G::from_u64(65536);
+    let __v_198: G = (__v_197 * __v_194);
+    let __v_199: G = (__v_196 + __v_198);
+    let __v_200: G = (__v_190 + __v_199);
+    if (__v_185 != __v_200) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_185.as_canonical_u64(), rhs: __v_200.as_canonical_u64(), msg: Some("u64_mul column 3: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_201: G = G::from_u64(256);
     let __v_202: G = (__v_201 * __v_194);
-    let __v_203: G = (__v_200 + __v_202);
-    let __v_204: G = (__v_190 + __v_203);
-    if (__v_179 != __v_204) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_179.as_canonical_u64(), rhs: __v_204.as_canonical_u64(), msg: Some("u64_mul column 3: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_198]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_203: G = (__v_192 + __v_202);
+    let __v_204: G = (__v_40 + __v_203);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_204]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_205: G = __r_arr[0];
     let __v_206: G = __r_arr[1];
     let __v_207: G = __r_arr[2];
@@ -15694,19 +15694,19 @@ fn aiur_fn_128(
     let __v_212: G = G::from_u64(0);
     let __v_213: G = if unconstrained { Bytes2::xor(&__v_207, &__v_212) } else { bytes2_xor_value(__v_207, __v_212, record) };
     let __v_214: G = G::from_u64(256);
-    let __v_215: G = (__v_214 * __v_213);
-    let __v_216: G = (__v_211 + __v_215);
-    let __v_217: G = (__v_51 + __v_216);
-    let __v_218: G = G::from_u64(256);
-    let __v_219: G = (__v_218 * __v_211);
-    let __v_220: G = G::from_u64(65536);
+    let __v_215: G = (__v_214 * __v_211);
+    let __v_216: G = G::from_u64(65536);
+    let __v_217: G = (__v_216 * __v_213);
+    let __v_218: G = (__v_215 + __v_217);
+    let __v_219: G = (__v_209 + __v_218);
+    if (__v_204 != __v_219) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_204.as_canonical_u64(), rhs: __v_219.as_canonical_u64(), msg: Some("u64_mul column 4: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_220: G = G::from_u64(256);
     let __v_221: G = (__v_220 * __v_213);
-    let __v_222: G = (__v_219 + __v_221);
-    let __v_223: G = (__v_209 + __v_222);
-    if (__v_198 != __v_223) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_198.as_canonical_u64(), rhs: __v_223.as_canonical_u64(), msg: Some("u64_mul column 4: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_217]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_222: G = (__v_211 + __v_221);
+    let __v_223: G = (__v_51 + __v_222);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_223]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_224: G = __r_arr[0];
     let __v_225: G = __r_arr[1];
     let __v_226: G = __r_arr[2];
@@ -15717,19 +15717,19 @@ fn aiur_fn_128(
     let __v_231: G = G::from_u64(0);
     let __v_232: G = if unconstrained { Bytes2::xor(&__v_226, &__v_231) } else { bytes2_xor_value(__v_226, __v_231, record) };
     let __v_233: G = G::from_u64(256);
-    let __v_234: G = (__v_233 * __v_232);
-    let __v_235: G = (__v_230 + __v_234);
-    let __v_236: G = (__v_64 + __v_235);
-    let __v_237: G = G::from_u64(256);
-    let __v_238: G = (__v_237 * __v_230);
-    let __v_239: G = G::from_u64(65536);
+    let __v_234: G = (__v_233 * __v_230);
+    let __v_235: G = G::from_u64(65536);
+    let __v_236: G = (__v_235 * __v_232);
+    let __v_237: G = (__v_234 + __v_236);
+    let __v_238: G = (__v_228 + __v_237);
+    if (__v_223 != __v_238) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_223.as_canonical_u64(), rhs: __v_238.as_canonical_u64(), msg: Some("u64_mul column 5: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_239: G = G::from_u64(256);
     let __v_240: G = (__v_239 * __v_232);
-    let __v_241: G = (__v_238 + __v_240);
-    let __v_242: G = (__v_228 + __v_241);
-    if (__v_217 != __v_242) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_217.as_canonical_u64(), rhs: __v_242.as_canonical_u64(), msg: Some("u64_mul column 5: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_236]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_241: G = (__v_230 + __v_240);
+    let __v_242: G = (__v_64 + __v_241);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_242]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_243: G = __r_arr[0];
     let __v_244: G = __r_arr[1];
     let __v_245: G = __r_arr[2];
@@ -15740,19 +15740,19 @@ fn aiur_fn_128(
     let __v_250: G = G::from_u64(0);
     let __v_251: G = if unconstrained { Bytes2::xor(&__v_245, &__v_250) } else { bytes2_xor_value(__v_245, __v_250, record) };
     let __v_252: G = G::from_u64(256);
-    let __v_253: G = (__v_252 * __v_251);
-    let __v_254: G = (__v_249 + __v_253);
-    let __v_255: G = (__v_79 + __v_254);
-    let __v_256: G = G::from_u64(256);
-    let __v_257: G = (__v_256 * __v_249);
-    let __v_258: G = G::from_u64(65536);
+    let __v_253: G = (__v_252 * __v_249);
+    let __v_254: G = G::from_u64(65536);
+    let __v_255: G = (__v_254 * __v_251);
+    let __v_256: G = (__v_253 + __v_255);
+    let __v_257: G = (__v_247 + __v_256);
+    if (__v_242 != __v_257) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_242.as_canonical_u64(), rhs: __v_257.as_canonical_u64(), msg: Some("u64_mul column 6: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_258: G = G::from_u64(256);
     let __v_259: G = (__v_258 * __v_251);
-    let __v_260: G = (__v_257 + __v_259);
-    let __v_261: G = (__v_247 + __v_260);
-    if (__v_236 != __v_261) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_236.as_canonical_u64(), rhs: __v_261.as_canonical_u64(), msg: Some("u64_mul column 6: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_255]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_260: G = (__v_249 + __v_259);
+    let __v_261: G = (__v_79 + __v_260);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_261]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_262: G = __r_arr[0];
     let __v_263: G = __r_arr[1];
     let __v_264: G = __r_arr[2];
@@ -15763,19 +15763,19 @@ fn aiur_fn_128(
     let __v_269: G = G::from_u64(0);
     let __v_270: G = if unconstrained { Bytes2::xor(&__v_264, &__v_269) } else { bytes2_xor_value(__v_264, __v_269, record) };
     let __v_271: G = G::from_u64(256);
-    let __v_272: G = (__v_271 * __v_270);
-    let __v_273: G = (__v_268 + __v_272);
-    let __v_274: G = (__v_92 + __v_273);
-    let __v_275: G = G::from_u64(256);
-    let __v_276: G = (__v_275 * __v_268);
-    let __v_277: G = G::from_u64(65536);
+    let __v_272: G = (__v_271 * __v_268);
+    let __v_273: G = G::from_u64(65536);
+    let __v_274: G = (__v_273 * __v_270);
+    let __v_275: G = (__v_272 + __v_274);
+    let __v_276: G = (__v_266 + __v_275);
+    if (__v_261 != __v_276) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_261.as_canonical_u64(), rhs: __v_276.as_canonical_u64(), msg: Some("u64_mul column 7: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_277: G = G::from_u64(256);
     let __v_278: G = (__v_277 * __v_270);
-    let __v_279: G = (__v_276 + __v_278);
-    let __v_280: G = (__v_266 + __v_279);
-    if (__v_255 != __v_280) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_255.as_canonical_u64(), rhs: __v_280.as_canonical_u64(), msg: Some("u64_mul column 7: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_274]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_279: G = (__v_268 + __v_278);
+    let __v_280: G = (__v_92 + __v_279);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_280]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_281: G = __r_arr[0];
     let __v_282: G = __r_arr[1];
     let __v_283: G = __r_arr[2];
@@ -15786,19 +15786,19 @@ fn aiur_fn_128(
     let __v_288: G = G::from_u64(0);
     let __v_289: G = if unconstrained { Bytes2::xor(&__v_283, &__v_288) } else { bytes2_xor_value(__v_283, __v_288, record) };
     let __v_290: G = G::from_u64(256);
-    let __v_291: G = (__v_290 * __v_289);
-    let __v_292: G = (__v_287 + __v_291);
-    let __v_293: G = (__v_103 + __v_292);
-    let __v_294: G = G::from_u64(256);
-    let __v_295: G = (__v_294 * __v_287);
-    let __v_296: G = G::from_u64(65536);
+    let __v_291: G = (__v_290 * __v_287);
+    let __v_292: G = G::from_u64(65536);
+    let __v_293: G = (__v_292 * __v_289);
+    let __v_294: G = (__v_291 + __v_293);
+    let __v_295: G = (__v_285 + __v_294);
+    if (__v_280 != __v_295) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_280.as_canonical_u64(), rhs: __v_295.as_canonical_u64(), msg: Some("u64_mul column 8: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_296: G = G::from_u64(256);
     let __v_297: G = (__v_296 * __v_289);
-    let __v_298: G = (__v_295 + __v_297);
-    let __v_299: G = (__v_285 + __v_298);
-    if (__v_274 != __v_299) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_274.as_canonical_u64(), rhs: __v_299.as_canonical_u64(), msg: Some("u64_mul column 8: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_293]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_298: G = (__v_287 + __v_297);
+    let __v_299: G = (__v_103 + __v_298);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_299]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_300: G = __r_arr[0];
     let __v_301: G = __r_arr[1];
     let __v_302: G = __r_arr[2];
@@ -15809,19 +15809,19 @@ fn aiur_fn_128(
     let __v_307: G = G::from_u64(0);
     let __v_308: G = if unconstrained { Bytes2::xor(&__v_302, &__v_307) } else { bytes2_xor_value(__v_302, __v_307, record) };
     let __v_309: G = G::from_u64(256);
-    let __v_310: G = (__v_309 * __v_308);
-    let __v_311: G = (__v_306 + __v_310);
-    let __v_312: G = (__v_112 + __v_311);
-    let __v_313: G = G::from_u64(256);
-    let __v_314: G = (__v_313 * __v_306);
-    let __v_315: G = G::from_u64(65536);
+    let __v_310: G = (__v_309 * __v_306);
+    let __v_311: G = G::from_u64(65536);
+    let __v_312: G = (__v_311 * __v_308);
+    let __v_313: G = (__v_310 + __v_312);
+    let __v_314: G = (__v_304 + __v_313);
+    if (__v_299 != __v_314) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_299.as_canonical_u64(), rhs: __v_314.as_canonical_u64(), msg: Some("u64_mul column 9: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_315: G = G::from_u64(256);
     let __v_316: G = (__v_315 * __v_308);
-    let __v_317: G = (__v_314 + __v_316);
-    let __v_318: G = (__v_304 + __v_317);
-    if (__v_293 != __v_318) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_293.as_canonical_u64(), rhs: __v_318.as_canonical_u64(), msg: Some("u64_mul column 9: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_312]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_317: G = (__v_306 + __v_316);
+    let __v_318: G = (__v_112 + __v_317);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_318]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_319: G = __r_arr[0];
     let __v_320: G = __r_arr[1];
     let __v_321: G = __r_arr[2];
@@ -15832,19 +15832,19 @@ fn aiur_fn_128(
     let __v_326: G = G::from_u64(0);
     let __v_327: G = if unconstrained { Bytes2::xor(&__v_321, &__v_326) } else { bytes2_xor_value(__v_321, __v_326, record) };
     let __v_328: G = G::from_u64(256);
-    let __v_329: G = (__v_328 * __v_327);
-    let __v_330: G = (__v_325 + __v_329);
-    let __v_331: G = (__v_119 + __v_330);
-    let __v_332: G = G::from_u64(256);
-    let __v_333: G = (__v_332 * __v_325);
-    let __v_334: G = G::from_u64(65536);
+    let __v_329: G = (__v_328 * __v_325);
+    let __v_330: G = G::from_u64(65536);
+    let __v_331: G = (__v_330 * __v_327);
+    let __v_332: G = (__v_329 + __v_331);
+    let __v_333: G = (__v_323 + __v_332);
+    if (__v_318 != __v_333) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_318.as_canonical_u64(), rhs: __v_333.as_canonical_u64(), msg: Some("u64_mul column 10: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_334: G = G::from_u64(256);
     let __v_335: G = (__v_334 * __v_327);
-    let __v_336: G = (__v_333 + __v_335);
-    let __v_337: G = (__v_323 + __v_336);
-    if (__v_312 != __v_337) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_312.as_canonical_u64(), rhs: __v_337.as_canonical_u64(), msg: Some("u64_mul column 10: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_331]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_336: G = (__v_325 + __v_335);
+    let __v_337: G = (__v_119 + __v_336);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_337]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_338: G = __r_arr[0];
     let __v_339: G = __r_arr[1];
     let __v_340: G = __r_arr[2];
@@ -15855,19 +15855,19 @@ fn aiur_fn_128(
     let __v_345: G = G::from_u64(0);
     let __v_346: G = if unconstrained { Bytes2::xor(&__v_340, &__v_345) } else { bytes2_xor_value(__v_340, __v_345, record) };
     let __v_347: G = G::from_u64(256);
-    let __v_348: G = (__v_347 * __v_346);
-    let __v_349: G = (__v_344 + __v_348);
-    let __v_350: G = (__v_124 + __v_349);
-    let __v_351: G = G::from_u64(256);
-    let __v_352: G = (__v_351 * __v_344);
-    let __v_353: G = G::from_u64(65536);
+    let __v_348: G = (__v_347 * __v_344);
+    let __v_349: G = G::from_u64(65536);
+    let __v_350: G = (__v_349 * __v_346);
+    let __v_351: G = (__v_348 + __v_350);
+    let __v_352: G = (__v_342 + __v_351);
+    if (__v_337 != __v_352) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_337.as_canonical_u64(), rhs: __v_352.as_canonical_u64(), msg: Some("u64_mul column 11: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_353: G = G::from_u64(256);
     let __v_354: G = (__v_353 * __v_346);
-    let __v_355: G = (__v_352 + __v_354);
-    let __v_356: G = (__v_342 + __v_355);
-    if (__v_331 != __v_356) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_331.as_canonical_u64(), rhs: __v_356.as_canonical_u64(), msg: Some("u64_mul column 11: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_350]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_355: G = (__v_344 + __v_354);
+    let __v_356: G = (__v_124 + __v_355);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_356]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_357: G = __r_arr[0];
     let __v_358: G = __r_arr[1];
     let __v_359: G = __r_arr[2];
@@ -15878,19 +15878,19 @@ fn aiur_fn_128(
     let __v_364: G = G::from_u64(0);
     let __v_365: G = if unconstrained { Bytes2::xor(&__v_359, &__v_364) } else { bytes2_xor_value(__v_359, __v_364, record) };
     let __v_366: G = G::from_u64(256);
-    let __v_367: G = (__v_366 * __v_365);
-    let __v_368: G = (__v_363 + __v_367);
-    let __v_369: G = (__v_127 + __v_368);
-    let __v_370: G = G::from_u64(256);
-    let __v_371: G = (__v_370 * __v_363);
-    let __v_372: G = G::from_u64(65536);
+    let __v_367: G = (__v_366 * __v_363);
+    let __v_368: G = G::from_u64(65536);
+    let __v_369: G = (__v_368 * __v_365);
+    let __v_370: G = (__v_367 + __v_369);
+    let __v_371: G = (__v_361 + __v_370);
+    if (__v_356 != __v_371) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_356.as_canonical_u64(), rhs: __v_371.as_canonical_u64(), msg: Some("u64_mul column 12: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_372: G = G::from_u64(256);
     let __v_373: G = (__v_372 * __v_365);
-    let __v_374: G = (__v_371 + __v_373);
-    let __v_375: G = (__v_361 + __v_374);
-    if (__v_350 != __v_375) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_350.as_canonical_u64(), rhs: __v_375.as_canonical_u64(), msg: Some("u64_mul column 12: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_369]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_374: G = (__v_363 + __v_373);
+    let __v_375: G = (__v_127 + __v_374);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_375]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_376: G = __r_arr[0];
     let __v_377: G = __r_arr[1];
     let __v_378: G = __r_arr[2];
@@ -15901,19 +15901,19 @@ fn aiur_fn_128(
     let __v_383: G = G::from_u64(0);
     let __v_384: G = if unconstrained { Bytes2::xor(&__v_378, &__v_383) } else { bytes2_xor_value(__v_378, __v_383, record) };
     let __v_385: G = G::from_u64(256);
-    let __v_386: G = (__v_385 * __v_384);
-    let __v_387: G = (__v_382 + __v_386);
-    let __v_388: G = (__v_128 + __v_387);
-    let __v_389: G = G::from_u64(256);
-    let __v_390: G = (__v_389 * __v_382);
-    let __v_391: G = G::from_u64(65536);
+    let __v_386: G = (__v_385 * __v_382);
+    let __v_387: G = G::from_u64(65536);
+    let __v_388: G = (__v_387 * __v_384);
+    let __v_389: G = (__v_386 + __v_388);
+    let __v_390: G = (__v_380 + __v_389);
+    if (__v_375 != __v_390) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_375.as_canonical_u64(), rhs: __v_390.as_canonical_u64(), msg: Some("u64_mul column 13: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_391: G = G::from_u64(256);
     let __v_392: G = (__v_391 * __v_384);
-    let __v_393: G = (__v_390 + __v_392);
-    let __v_394: G = (__v_380 + __v_393);
-    if (__v_369 != __v_394) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_369.as_canonical_u64(), rhs: __v_394.as_canonical_u64(), msg: Some("u64_mul column 13: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_388]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
+    let __v_393: G = (__v_382 + __v_392);
+    let __v_394: G = (__v_128 + __v_393);
+    let __r_arr: [G; OUT_127] = { let __args: [G; IN_127] = [__v_394]; let __cu = true; let __hit = record.function_queries[127].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_127] = unsafe { *(record.function_queries[127].output_at(__i).as_ptr() as *const [G; OUT_127]) }; __ret }, _ => aiur_fn_127(__args, record, io_buffer, __cu)? } };
     let __v_395: G = __r_arr[0];
     let __v_396: G = __r_arr[1];
     let __v_397: G = __r_arr[2];
@@ -15924,18 +15924,18 @@ fn aiur_fn_128(
     let __v_402: G = G::from_u64(0);
     let __v_403: G = if unconstrained { Bytes2::xor(&__v_397, &__v_402) } else { bytes2_xor_value(__v_397, __v_402, record) };
     let __v_404: G = G::from_u64(256);
-    let __v_405: G = (__v_404 * __v_403);
-    let __v_406: G = (__v_401 + __v_405);
-    let __v_407: G = G::from_u64(256);
-    let __v_408: G = (__v_407 * __v_401);
-    let __v_409: G = G::from_u64(65536);
-    let __v_410: G = (__v_409 * __v_403);
-    let __v_411: G = (__v_408 + __v_410);
-    let __v_412: G = (__v_399 + __v_411);
-    if (__v_388 != __v_412) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_388.as_canonical_u64(), rhs: __v_412.as_canonical_u64(), msg: Some("u64_mul column 14: split_carry hint does not recompose to the column sum".to_string()) });
-    }
-    let __ret: [G; OUT_128] = [__v_133, __v_152, __v_171, __v_190, __v_209, __v_228, __v_247, __v_266, __v_285, __v_304, __v_323, __v_342, __v_361, __v_380, __v_399, __v_406];
+    let __v_405: G = (__v_404 * __v_401);
+    let __v_406: G = G::from_u64(65536);
+    let __v_407: G = (__v_406 * __v_403);
+    let __v_408: G = (__v_405 + __v_407);
+    let __v_409: G = (__v_399 + __v_408);
+    if (__v_394 != __v_409) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_394.as_canonical_u64(), rhs: __v_409.as_canonical_u64(), msg: Some("u64_mul column 14: split_carry hint does not recompose to the column sum".to_string()) });
+    }
+    let __v_410: G = G::from_u64(256);
+    let __v_411: G = (__v_410 * __v_403);
+    let __v_412: G = (__v_401 + __v_411);
+    let __ret: [G; OUT_128] = [__v_133, __v_152, __v_171, __v_190, __v_209, __v_228, __v_247, __v_266, __v_285, __v_304, __v_323, __v_342, __v_361, __v_380, __v_399, __v_412];
     record.function_queries[128].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -16078,11 +16078,11 @@ fn aiur_fn_131(
             return Ok(__ret);
           },
           0u64 => {
-            let __v_28: G = G::from_u64(0);
+            let __v_28: G = G::from_u64(1);
             let __v_29: G = G::from_u64(1);
-            let __v_30: G = G::from_u64(1);
-            let __v_31: G = { let __values: [G; 10] = [__v_29, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_32: G = { let __values: [G; 10] = [__v_28, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_31]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_30: G = { let __values: [G; 10] = [__v_28, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_31: G = G::from_u64(0);
+            let __v_32: G = { let __values: [G; 10] = [__v_31, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_131] = [__v_32];
             record.function_queries[131].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -16137,10 +16137,10 @@ fn aiur_fn_131(
         let __v_65: G = __r_arr[6];
         let __v_66: G = __r_arr[7];
         let __v_67: G = __r_arr[8];
-        let __v_68: G = G::from_u64(0);
         let __r_arr: [G; OUT_131] = { let __args: [G; IN_131] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_26, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66]; let __cu = unconstrained; let __hit = record.function_queries[131].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[131].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[131].bump_multiplicity(__i); } let __ret: [G; OUT_131] = unsafe { *(record.function_queries[131].output_at(__i).as_ptr() as *const [G; OUT_131]) }; __ret }, _ => aiur_fn_131(__args, record, io_buffer, __cu)? } };
-        let __v_69: G = __r_arr[0];
-        let __v_70: G = { let __values: [G; 10] = [__v_68, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_69]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_68: G = __r_arr[0];
+        let __v_69: G = G::from_u64(0);
+        let __v_70: G = { let __values: [G; 10] = [__v_69, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_68]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_131] = [__v_70];
         record.function_queries[131].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -16180,7 +16180,7 @@ fn aiur_fn_132(
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 10] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_0]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 10] = [__v_10, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_0]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_12: G = G::from_u64(1);
         let __v_13: G = (__v_1 - __v_12);
         let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_11, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
@@ -16396,37 +16396,37 @@ fn aiur_fn_138(
     let __v_2: G = __r_arr[0];
     match __v_2.as_canonical_u64() {
       1u64 => {
-        let __v_3: G = G::from_u64(0);
-        let __v_4: G = G::from_u64(1);
+        let __v_3: G = G::from_u64(1);
+        let __v_4: G = G::from_u64(0);
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = G::from_u64(0);
+        let __v_11: G = G::from_u64(1);
         let __v_12: G = G::from_u64(1);
-        let __v_13: G = G::from_u64(1);
-        let __v_14: G = { let __values: [G; 10] = [__v_12, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_15: G = { let __values: [G; 10] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_14]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 10] = [__v_11, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = G::from_u64(0);
+        let __v_15: G = { let __values: [G; 10] = [__v_14, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_138] = [__v_15];
         record.function_queries[138].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       0u64 => {
-        let __v_3: G = G::from_u64(0);
-        let __v_4: G = G::from_u64(2);
+        let __v_3: G = G::from_u64(2);
+        let __v_4: G = G::from_u64(0);
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = G::from_u64(0);
+        let __v_11: G = G::from_u64(1);
         let __v_12: G = G::from_u64(1);
-        let __v_13: G = G::from_u64(1);
-        let __v_14: G = { let __values: [G; 10] = [__v_12, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_15: G = { let __values: [G; 10] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_14]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 10] = [__v_11, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = G::from_u64(0);
+        let __v_15: G = { let __values: [G; 10] = [__v_14, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_134] = { let __args: [G; IN_134] = [__v_1, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[134].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[134].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[134].bump_multiplicity(__i); } let __ret: [G; OUT_134] = unsafe { *(record.function_queries[134].output_at(__i).as_ptr() as *const [G; OUT_134]) }; __ret }, _ => aiur_fn_134(__args, record, io_buffer, __cu)? } };
         let __v_16: G = __r_arr[0];
         let __v_17: G = __r_arr[1];
@@ -16639,19 +16639,19 @@ fn aiur_fn_142(
             return Ok(__ret);
           },
           0u64 => {
-            let __v_22: G = G::from_u64(0);
             let __r_arr: [G; OUT_139] = { let __args: [G; IN_139] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[139].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[139].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[139].bump_multiplicity(__i); } let __ret: [G; OUT_139] = unsafe { *(record.function_queries[139].output_at(__i).as_ptr() as *const [G; OUT_139]) }; __ret }, _ => aiur_fn_139(__args, record, io_buffer, __cu)? } };
-            let __v_23: G = __r_arr[0];
-            let __v_24: G = __r_arr[1];
-            let __v_25: G = __r_arr[2];
-            let __v_26: G = __r_arr[3];
-            let __v_27: G = __r_arr[4];
-            let __v_28: G = __r_arr[5];
-            let __v_29: G = __r_arr[6];
-            let __v_30: G = __r_arr[7];
+            let __v_22: G = __r_arr[0];
+            let __v_23: G = __r_arr[1];
+            let __v_24: G = __r_arr[2];
+            let __v_25: G = __r_arr[3];
+            let __v_26: G = __r_arr[4];
+            let __v_27: G = __r_arr[5];
+            let __v_28: G = __r_arr[6];
+            let __v_29: G = __r_arr[7];
             let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_11, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
-            let __v_31: G = __r_arr[0];
-            let __v_32: G = { let __values: [G; 10] = [__v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_30: G = __r_arr[0];
+            let __v_31: G = G::from_u64(0);
+            let __v_32: G = { let __values: [G; 10] = [__v_31, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_142] = [__v_32];
             record.function_queries[142].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -16716,19 +16716,19 @@ fn aiur_fn_143(
             return Ok(__ret);
           },
           0u64 => {
-            let __v_22: G = G::from_u64(0);
             let __r_arr: [G; OUT_140] = { let __args: [G; IN_140] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[140].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[140].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[140].bump_multiplicity(__i); } let __ret: [G; OUT_140] = unsafe { *(record.function_queries[140].output_at(__i).as_ptr() as *const [G; OUT_140]) }; __ret }, _ => aiur_fn_140(__args, record, io_buffer, __cu)? } };
-            let __v_23: G = __r_arr[0];
-            let __v_24: G = __r_arr[1];
-            let __v_25: G = __r_arr[2];
-            let __v_26: G = __r_arr[3];
-            let __v_27: G = __r_arr[4];
-            let __v_28: G = __r_arr[5];
-            let __v_29: G = __r_arr[6];
-            let __v_30: G = __r_arr[7];
+            let __v_22: G = __r_arr[0];
+            let __v_23: G = __r_arr[1];
+            let __v_24: G = __r_arr[2];
+            let __v_25: G = __r_arr[3];
+            let __v_26: G = __r_arr[4];
+            let __v_27: G = __r_arr[5];
+            let __v_28: G = __r_arr[6];
+            let __v_29: G = __r_arr[7];
             let __r_arr: [G; OUT_143] = { let __args: [G; IN_143] = [__v_11, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[143].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[143].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[143].bump_multiplicity(__i); } let __ret: [G; OUT_143] = unsafe { *(record.function_queries[143].output_at(__i).as_ptr() as *const [G; OUT_143]) }; __ret }, _ => aiur_fn_143(__args, record, io_buffer, __cu)? } };
-            let __v_31: G = __r_arr[0];
-            let __v_32: G = { let __values: [G; 10] = [__v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_30: G = __r_arr[0];
+            let __v_31: G = G::from_u64(0);
+            let __v_32: G = { let __values: [G; 10] = [__v_31, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_143] = [__v_32];
             record.function_queries[143].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -16793,19 +16793,19 @@ fn aiur_fn_144(
             return Ok(__ret);
           },
           0u64 => {
-            let __v_22: G = G::from_u64(0);
             let __r_arr: [G; OUT_141] = { let __args: [G; IN_141] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[141].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[141].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[141].bump_multiplicity(__i); } let __ret: [G; OUT_141] = unsafe { *(record.function_queries[141].output_at(__i).as_ptr() as *const [G; OUT_141]) }; __ret }, _ => aiur_fn_141(__args, record, io_buffer, __cu)? } };
-            let __v_23: G = __r_arr[0];
-            let __v_24: G = __r_arr[1];
-            let __v_25: G = __r_arr[2];
-            let __v_26: G = __r_arr[3];
-            let __v_27: G = __r_arr[4];
-            let __v_28: G = __r_arr[5];
-            let __v_29: G = __r_arr[6];
-            let __v_30: G = __r_arr[7];
+            let __v_22: G = __r_arr[0];
+            let __v_23: G = __r_arr[1];
+            let __v_24: G = __r_arr[2];
+            let __v_25: G = __r_arr[3];
+            let __v_26: G = __r_arr[4];
+            let __v_27: G = __r_arr[5];
+            let __v_28: G = __r_arr[6];
+            let __v_29: G = __r_arr[7];
             let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_11, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
-            let __v_31: G = __r_arr[0];
-            let __v_32: G = { let __values: [G; 10] = [__v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_30: G = __r_arr[0];
+            let __v_31: G = G::from_u64(0);
+            let __v_32: G = { let __values: [G; 10] = [__v_31, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_144] = [__v_32];
             record.function_queries[144].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -16834,19 +16834,19 @@ fn aiur_fn_145(
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
     let __v_1: G = inp[1];
-    let __v_2: G = G::from_u64(0);
-    let __v_3: G = G::from_u64(2);
+    let __v_2: G = G::from_u64(2);
+    let __v_3: G = G::from_u64(0);
     let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
     let __v_7: G = G::from_u64(0);
     let __v_8: G = G::from_u64(0);
     let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(0);
+    let __v_10: G = G::from_u64(1);
     let __v_11: G = G::from_u64(1);
-    let __v_12: G = G::from_u64(1);
-    let __v_13: G = { let __values: [G; 10] = [__v_11, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_14: G = { let __values: [G; 10] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = { let __values: [G; 10] = [__v_10, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 10] = [__v_13, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_14, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
     let __v_15: G = __r_arr[0];
     let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_0, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
@@ -16869,19 +16869,19 @@ fn aiur_fn_146(
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
     let __v_1: G = inp[1];
-    let __v_2: G = G::from_u64(0);
-    let __v_3: G = G::from_u64(2);
+    let __v_2: G = G::from_u64(2);
+    let __v_3: G = G::from_u64(0);
     let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
     let __v_7: G = G::from_u64(0);
     let __v_8: G = G::from_u64(0);
     let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(0);
+    let __v_10: G = G::from_u64(1);
     let __v_11: G = G::from_u64(1);
-    let __v_12: G = G::from_u64(1);
-    let __v_13: G = { let __values: [G; 10] = [__v_11, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_14: G = { let __values: [G; 10] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = { let __values: [G; 10] = [__v_10, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 10] = [__v_13, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_14, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
     let __v_15: G = __r_arr[0];
     let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_0, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
@@ -18803,23 +18803,23 @@ fn aiur_fn_185(
   unconstrained: bool,
 ) -> Result<[G; OUT_185], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
-    let __v_0: G = G::from_u64(0);
-    let __v_1: G = G::from_u64(64);
+    let __v_0: G = G::from_u64(64);
+    let __v_1: G = G::from_u64(0);
     let __v_2: G = G::from_u64(0);
     let __v_3: G = G::from_u64(0);
     let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
     let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(0);
+    let __v_8: G = G::from_u64(1);
     let __v_9: G = G::from_u64(1);
-    let __v_10: G = G::from_u64(1);
-    let __v_11: G = { let __values: [G; 10] = [__v_9, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_12: G = { let __values: [G; 10] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_13: G = G::from_u64(7);
-    let __v_14: G = G::from_u64(0);
+    let __v_10: G = { let __values: [G; 10] = [__v_8, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 10] = [__v_11, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = G::from_u64(7);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_185] = [__v_16];
     record.function_queries[185].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -18836,23 +18836,23 @@ fn aiur_fn_186(
   unconstrained: bool,
 ) -> Result<[G; OUT_186], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
-    let __v_0: G = G::from_u64(0);
-    let __v_1: G = G::from_u64(1);
+    let __v_0: G = G::from_u64(1);
+    let __v_1: G = G::from_u64(0);
     let __v_2: G = G::from_u64(0);
     let __v_3: G = G::from_u64(0);
     let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
     let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(0);
+    let __v_8: G = G::from_u64(1);
     let __v_9: G = G::from_u64(1);
-    let __v_10: G = G::from_u64(1);
-    let __v_11: G = { let __values: [G; 10] = [__v_9, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_12: G = { let __values: [G; 10] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_13: G = G::from_u64(7);
-    let __v_14: G = G::from_u64(0);
+    let __v_10: G = { let __values: [G; 10] = [__v_8, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 10] = [__v_11, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = G::from_u64(7);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_186] = [__v_16];
     record.function_queries[186].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -18929,7 +18929,7 @@ fn aiur_fn_187(
                     let __v_15: G = G::from_u64(0);
                     let __v_16: G = G::from_u64(0);
                     let __v_17: G = G::from_u64(0);
-                    let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_187] = [__v_14, __v_18];
                     record.function_queries[187].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -18945,7 +18945,7 @@ fn aiur_fn_187(
                         let __v_18: G = G::from_u64(0);
                         let __v_19: G = G::from_u64(0);
                         let __v_20: G = G::from_u64(0);
-                        let __v_21: G = { let __values: [G; 4] = [__v_18, __v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_187] = [__v_17, __v_21];
                         record.function_queries[187].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -19008,7 +19008,7 @@ fn aiur_fn_188(
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_5, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_188] = [__v_4, __v_8];
         record.function_queries[188].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -19045,7 +19045,7 @@ fn aiur_fn_188(
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_188] = [__v_14, __v_18];
                 record.function_queries[188].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -19057,7 +19057,7 @@ fn aiur_fn_188(
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_188] = [__v_12, __v_16];
             record.function_queries[188].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -19101,7 +19101,7 @@ fn aiur_fn_189(
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_189] = [__v_10, __v_14];
             record.function_queries[189].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -19119,7 +19119,7 @@ fn aiur_fn_189(
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_189] = [__v_5, __v_9];
         record.function_queries[189].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -19158,7 +19158,7 @@ fn aiur_fn_190(
             let __v_6: G = G::from_u64(0);
             let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
-            let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_190] = [__v_5, __v_9];
             record.function_queries[190].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -19170,7 +19170,7 @@ fn aiur_fn_190(
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_190] = [__v_5, __v_9];
         record.function_queries[190].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -19546,27 +19546,27 @@ fn aiur_fn_198(
     let __v_0: G = inp[0];
     match __v_0.as_canonical_u64() {
       0u64 => {
-        let __v_1: G = G::from_u64(2);
         let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = []; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
-        let __v_2: G = __r_arr[0];
+        let __v_1: G = __r_arr[0];
+        let __v_2: G = G::from_u64(1);
         let __v_3: G = G::from_u64(1);
-        let __v_4: G = G::from_u64(1);
-        let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_3]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = G::from_u64(2);
         let __v_6: G = G::from_u64(0);
-        let __v_7: G = { let __values: [G; 4] = [__v_1, __v_2, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 4] = [__v_5, __v_1, __v_4, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_198] = [__v_7];
         record.function_queries[198].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       _ => {
-        let __v_1: G = G::from_u64(2);
         let __r_arr: [G; OUT_176] = { let __args: [G; IN_176] = []; let __cu = unconstrained; let __hit = record.function_queries[176].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[176].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[176].bump_multiplicity(__i); } let __ret: [G; OUT_176] = unsafe { *(record.function_queries[176].output_at(__i).as_ptr() as *const [G; OUT_176]) }; __ret }, _ => aiur_fn_176(__args, record, io_buffer, __cu)? } };
-        let __v_2: G = __r_arr[0];
+        let __v_1: G = __r_arr[0];
+        let __v_2: G = G::from_u64(1);
         let __v_3: G = G::from_u64(1);
-        let __v_4: G = G::from_u64(1);
-        let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_3]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = G::from_u64(2);
         let __v_6: G = G::from_u64(0);
-        let __v_7: G = { let __values: [G; 4] = [__v_1, __v_2, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 4] = [__v_5, __v_1, __v_4, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_198] = [__v_7];
         record.function_queries[198].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -19630,19 +19630,19 @@ fn aiur_fn_199(
                 return Ok(__ret);
               },
               1u64 => {
-                let __v_9: G = G::from_u64(0);
-                let __v_10: G = G::from_u64(2);
+                let __v_9: G = G::from_u64(2);
+                let __v_10: G = G::from_u64(0);
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
                 let __v_14: G = G::from_u64(0);
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
-                let __v_17: G = G::from_u64(0);
+                let __v_17: G = G::from_u64(1);
                 let __v_18: G = G::from_u64(1);
-                let __v_19: G = G::from_u64(1);
-                let __v_20: G = { let __values: [G; 10] = [__v_18, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_21: G = { let __values: [G; 10] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_20]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_19: G = { let __values: [G; 10] = [__v_17, __v_18, __v_18, __v_18, __v_18, __v_18, __v_18, __v_18, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_20: G = G::from_u64(0);
+                let __v_21: G = { let __values: [G; 10] = [__v_20, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_19]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_21, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
                 let __v_22: G = __r_arr[0];
                 let __v_23: G = G::from_u64(1);
@@ -19692,7 +19692,7 @@ fn aiur_fn_200(
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_5, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_200] = [__v_4, __v_8];
         record.function_queries[200].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -19716,7 +19716,7 @@ fn aiur_fn_200(
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_200] = [__v_12, __v_16];
             record.function_queries[200].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -19731,7 +19731,7 @@ fn aiur_fn_200(
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_200] = [__v_14, __v_18];
                 record.function_queries[200].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -19783,7 +19783,7 @@ fn aiur_fn_201(
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_5, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_201] = [__v_4, __v_8];
         record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -19812,7 +19812,7 @@ fn aiur_fn_201(
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_201] = [__v_14, __v_18];
                 record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -19828,7 +19828,7 @@ fn aiur_fn_201(
                     let __v_18: G = G::from_u64(0);
                     let __v_19: G = G::from_u64(0);
                     let __v_20: G = G::from_u64(0);
-                    let __v_21: G = { let __values: [G; 4] = [__v_18, __v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_201] = [__v_17, __v_21];
                     record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -19857,7 +19857,7 @@ fn aiur_fn_201(
                             let __v_28: G = G::from_u64(0);
                             let __v_29: G = G::from_u64(0);
                             let __v_30: G = G::from_u64(0);
-                            let __v_31: G = { let __values: [G; 4] = [__v_28, __v_29, __v_30, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_31: G = { let __values: [G; 4] = [__v_29, __v_28, __v_30, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_201] = [__v_27, __v_31];
                             record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
@@ -19873,7 +19873,7 @@ fn aiur_fn_201(
                                 let __v_31: G = G::from_u64(0);
                                 let __v_32: G = G::from_u64(0);
                                 let __v_33: G = G::from_u64(0);
-                                let __v_34: G = { let __values: [G; 4] = [__v_31, __v_32, __v_33, __v_33]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_34: G = { let __values: [G; 4] = [__v_32, __v_31, __v_33, __v_33]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                 let __ret: [G; OUT_201] = [__v_30, __v_34];
                                 record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
@@ -19888,15 +19888,15 @@ fn aiur_fn_201(
                                 let __v_34: G = G::from_u64(3);
                                 let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_7, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
                                 let __v_35: G = __r_arr[0];
-                                let __v_36: G = G::from_u64(0);
-                                let __v_37: G = G::from_u64(0);
-                                let __v_38: G = G::from_u64(0);
-                                let __v_39: G = G::from_u64(1);
-                                let __v_40: G = G::from_u64(1);
-                                let __v_41: G = { let __values: [G; 3] = [__v_39, __v_40, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_42: G = { let __values: [G; 3] = [__v_38, __v_35, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_43: G = { let __values: [G; 3] = [__v_37, __v_33, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_44: G = { let __values: [G; 3] = [__v_36, __v_31, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_36: G = G::from_u64(1);
+                                let __v_37: G = G::from_u64(1);
+                                let __v_38: G = { let __values: [G; 3] = [__v_36, __v_37, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_39: G = G::from_u64(0);
+                                let __v_40: G = { let __values: [G; 3] = [__v_39, __v_35, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_41: G = G::from_u64(0);
+                                let __v_42: G = { let __values: [G; 3] = [__v_41, __v_33, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_43: G = G::from_u64(0);
+                                let __v_44: G = { let __values: [G; 3] = [__v_43, __v_31, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                 let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_44]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
                                 let __v_45: G = __r_arr[0];
                                 let __v_46: G = __r_arr[1];
@@ -19913,7 +19913,7 @@ fn aiur_fn_201(
                         let __v_26: G = G::from_u64(0);
                         let __v_27: G = G::from_u64(0);
                         let __v_28: G = G::from_u64(0);
-                        let __v_29: G = { let __values: [G; 4] = [__v_26, __v_27, __v_28, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_29: G = { let __values: [G; 4] = [__v_27, __v_26, __v_28, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_201] = [__v_25, __v_29];
                         record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -19929,7 +19929,7 @@ fn aiur_fn_201(
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_201] = [__v_12, __v_16];
             record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -19989,11 +19989,11 @@ fn aiur_fn_202(
                 let __v_13: G = G::from_u64(0);
                 let __v_14: G = G::from_u64(0);
                 let __v_15: G = G::from_u64(0);
-                let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_17: G = G::from_u64(0);
                 let __v_18: G = G::from_u64(0);
                 let __v_19: G = G::from_u64(0);
-                let __v_20: G = { let __values: [G; 4] = [__v_17, __v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_20: G = { let __values: [G; 4] = [__v_18, __v_17, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_202] = [__v_12, __v_16, __v_20];
                 record.function_queries[202].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -20005,11 +20005,11 @@ fn aiur_fn_202(
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
             let __v_16: G = G::from_u64(0);
-            let __v_17: G = { let __values: [G; 4] = [__v_14, __v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_17: G = { let __values: [G; 4] = [__v_15, __v_14, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_202] = [__v_9, __v_13, __v_17];
             record.function_queries[202].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -20021,11 +20021,11 @@ fn aiur_fn_202(
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
         let __v_14: G = G::from_u64(0);
-        let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_202] = [__v_7, __v_11, __v_15];
         record.function_queries[202].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -20063,7 +20063,7 @@ fn aiur_fn_203(
             let __v_9: G = G::from_u64(0);
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
-            let __v_12: G = { let __values: [G; 4] = [__v_9, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_203] = [__v_8, __v_12];
             record.function_queries[203].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -20086,7 +20086,7 @@ fn aiur_fn_203(
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
                 let __v_18: G = G::from_u64(0);
-                let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_203] = [__v_15, __v_19];
                 record.function_queries[203].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -20141,7 +20141,7 @@ fn aiur_fn_203(
                 let __v_10: G = G::from_u64(0);
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
-                let __v_13: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_203] = [__v_9, __v_13];
                 record.function_queries[203].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -20206,11 +20206,11 @@ fn aiur_fn_204(
                 let __r_arr: [G; OUT_205] = { let __args: [G; IN_205] = [__v_10, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[205].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[205].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[205].bump_multiplicity(__i); } let __ret: [G; OUT_205] = unsafe { *(record.function_queries[205].output_at(__i).as_ptr() as *const [G; OUT_205]) }; __ret }, _ => aiur_fn_205(__args, record, io_buffer, __cu)? } };
                 let __v_13: G = __r_arr[0];
                 let __v_14: G = G::from_u64(0);
-                let __v_15: G = G::from_u64(0);
+                let __v_15: G = { let __values: [G; 3] = [__v_14, __v_13, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_16: G = G::from_u64(0);
-                let __v_17: G = { let __values: [G; 3] = [__v_16, __v_13, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_18: G = { let __values: [G; 3] = [__v_15, __v_12, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_19: G = { let __values: [G; 3] = [__v_14, __v_4, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = { let __values: [G; 3] = [__v_16, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = G::from_u64(0);
+                let __v_19: G = { let __values: [G; 3] = [__v_18, __v_4, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_204] = [__v_19];
                 record.function_queries[204].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -21042,10 +21042,10 @@ fn aiur_fn_220(
             match __v_8.as_canonical_u64() {
               1u64 => {
                 let __v_10: G = G::from_u64(1);
-                let __v_11: G = G::from_u64(7);
-                let __v_12: G = G::from_u64(1);
+                let __v_11: G = G::from_u64(1);
+                let __v_12: G = G::from_u64(7);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_9, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_9, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_220] = [__v_10, __v_14];
                 record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -21055,7 +21055,7 @@ fn aiur_fn_220(
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_220] = [__v_10, __v_14];
                 record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -21070,7 +21070,7 @@ fn aiur_fn_220(
             let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
-            let __v_10: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_220] = [__v_6, __v_10];
             record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -21092,7 +21092,7 @@ fn aiur_fn_220(
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_220] = [__v_10, __v_14];
                 record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -21115,10 +21115,10 @@ fn aiur_fn_220(
                         let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
                         let __v_17: G = __r_arr[0];
                         let __v_18: G = G::from_u64(1);
-                        let __v_19: G = G::from_u64(7);
-                        let __v_20: G = G::from_u64(0);
+                        let __v_19: G = G::from_u64(0);
+                        let __v_20: G = G::from_u64(7);
                         let __v_21: G = G::from_u64(0);
-                        let __v_22: G = { let __values: [G; 4] = [__v_19, __v_20, __v_17, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_22: G = { let __values: [G; 4] = [__v_20, __v_19, __v_17, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_220] = [__v_18, __v_22];
                         record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -21128,7 +21128,7 @@ fn aiur_fn_220(
                         let __v_17: G = G::from_u64(0);
                         let __v_18: G = G::from_u64(0);
                         let __v_19: G = G::from_u64(0);
-                        let __v_20: G = { let __values: [G; 4] = [__v_17, __v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_20: G = { let __values: [G; 4] = [__v_18, __v_17, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_220] = [__v_16, __v_20];
                         record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -21140,7 +21140,7 @@ fn aiur_fn_220(
                     let __v_17: G = G::from_u64(0);
                     let __v_18: G = G::from_u64(0);
                     let __v_19: G = G::from_u64(0);
-                    let __v_20: G = { let __values: [G; 4] = [__v_17, __v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_20: G = { let __values: [G; 4] = [__v_18, __v_17, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_220] = [__v_16, __v_20];
                     record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -21220,7 +21220,7 @@ fn aiur_fn_220(
                                     let __v_21: G = G::from_u64(0);
                                     let __v_22: G = G::from_u64(0);
                                     let __v_23: G = G::from_u64(0);
-                                    let __v_24: G = { let __values: [G; 4] = [__v_21, __v_22, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_24: G = { let __values: [G; 4] = [__v_22, __v_21, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                     let __ret: [G; OUT_220] = [__v_20, __v_24];
                                     record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
@@ -21253,10 +21253,10 @@ fn aiur_fn_220(
                                                     let __r_arr: [G; OUT_770] = { let __args: [G; IN_770] = [__v_26, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[770].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[770].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[770].bump_multiplicity(__i); } let __ret: [G; OUT_770] = unsafe { *(record.function_queries[770].output_at(__i).as_ptr() as *const [G; OUT_770]) }; __ret }, _ => aiur_fn_770(__args, record, io_buffer, __cu)? } };
                                                     let __v_32: G = __r_arr[0];
                                                     let __v_33: G = G::from_u64(1);
-                                                    let __v_34: G = G::from_u64(7);
-                                                    let __v_35: G = G::from_u64(1);
+                                                    let __v_34: G = G::from_u64(1);
+                                                    let __v_35: G = G::from_u64(7);
                                                     let __v_36: G = G::from_u64(0);
-                                                    let __v_37: G = { let __values: [G; 4] = [__v_34, __v_35, __v_32, __v_36]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_37: G = { let __values: [G; 4] = [__v_35, __v_34, __v_32, __v_36]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                                     let __ret: [G; OUT_220] = [__v_33, __v_37];
                                                     record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                                     return Ok(__ret);
@@ -21266,7 +21266,7 @@ fn aiur_fn_220(
                                                     let __v_33: G = G::from_u64(0);
                                                     let __v_34: G = G::from_u64(0);
                                                     let __v_35: G = G::from_u64(0);
-                                                    let __v_36: G = { let __values: [G; 4] = [__v_33, __v_34, __v_35, __v_35]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_36: G = { let __values: [G; 4] = [__v_34, __v_33, __v_35, __v_35]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                                     let __ret: [G; OUT_220] = [__v_32, __v_36];
                                                     record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                                     return Ok(__ret);
@@ -21278,7 +21278,7 @@ fn aiur_fn_220(
                                                 let __v_33: G = G::from_u64(0);
                                                 let __v_34: G = G::from_u64(0);
                                                 let __v_35: G = G::from_u64(0);
-                                                let __v_36: G = { let __values: [G; 4] = [__v_33, __v_34, __v_35, __v_35]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_36: G = { let __values: [G; 4] = [__v_34, __v_33, __v_35, __v_35]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                                 let __ret: [G; OUT_220] = [__v_32, __v_36];
                                                 record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
@@ -21290,7 +21290,7 @@ fn aiur_fn_220(
                                             let __v_29: G = G::from_u64(0);
                                             let __v_30: G = G::from_u64(0);
                                             let __v_31: G = G::from_u64(0);
-                                            let __v_32: G = { let __values: [G; 4] = [__v_29, __v_30, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_32: G = { let __values: [G; 4] = [__v_30, __v_29, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                             let __ret: [G; OUT_220] = [__v_28, __v_32];
                                             record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
@@ -21302,7 +21302,7 @@ fn aiur_fn_220(
                                         let __v_29: G = G::from_u64(0);
                                         let __v_30: G = G::from_u64(0);
                                         let __v_31: G = G::from_u64(0);
-                                        let __v_32: G = { let __values: [G; 4] = [__v_29, __v_30, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_32: G = { let __values: [G; 4] = [__v_30, __v_29, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                         let __ret: [G; OUT_220] = [__v_28, __v_32];
                                         record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
@@ -21316,7 +21316,7 @@ fn aiur_fn_220(
                                 let __v_19: G = G::from_u64(0);
                                 let __v_20: G = G::from_u64(0);
                                 let __v_21: G = G::from_u64(0);
-                                let __v_22: G = { let __values: [G; 4] = [__v_19, __v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_22: G = { let __values: [G; 4] = [__v_20, __v_19, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                 let __ret: [G; OUT_220] = [__v_18, __v_22];
                                 record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
@@ -21358,7 +21358,7 @@ fn aiur_fn_221(
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_5, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_221] = [__v_4, __v_8];
         record.function_queries[221].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -21380,18 +21380,18 @@ fn aiur_fn_221(
                 let __v_10: G = __r_arr[0];
                 let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
                 let __v_11: G = __r_arr[0];
-                let __v_12: G = G::from_u64(7);
-                let __v_13: G = G::from_u64(0);
+                let __v_12: G = G::from_u64(0);
+                let __v_13: G = G::from_u64(7);
                 let __v_14: G = G::from_u64(0);
-                let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_11, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_16: G = G::from_u64(2);
+                let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_11, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = []; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-                let __v_17: G = __r_arr[0];
+                let __v_16: G = __r_arr[0];
+                let __v_17: G = G::from_u64(1);
                 let __v_18: G = G::from_u64(1);
-                let __v_19: G = G::from_u64(1);
-                let __v_20: G = { let __values: [G; 3] = [__v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_19: G = { let __values: [G; 3] = [__v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_20: G = G::from_u64(2);
                 let __v_21: G = G::from_u64(0);
-                let __v_22: G = { let __values: [G; 4] = [__v_16, __v_17, __v_20, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_22: G = { let __values: [G; 4] = [__v_20, __v_16, __v_19, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_23: G = G::from_u64(1);
                 let __v_24: G = G::from_u64(3);
                 let __v_25: G = G::from_u64(0);
@@ -21405,7 +21405,7 @@ fn aiur_fn_221(
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_221] = [__v_10, __v_14];
                 record.function_queries[221].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -21417,7 +21417,7 @@ fn aiur_fn_221(
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_221] = [__v_10, __v_14];
             record.function_queries[221].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -21449,7 +21449,7 @@ fn aiur_fn_222(
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_5, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_222] = [__v_4, __v_8];
         record.function_queries[222].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -21474,14 +21474,14 @@ fn aiur_fn_222(
                 match __v_10.as_canonical_u64() {
                   1u64 => {
                     let __v_13: G = G::from_u64(1);
-                    let __v_14: G = G::from_u64(2);
                     let __r_arr: [G; OUT_216] = { let __args: [G; IN_216] = []; let __cu = unconstrained; let __hit = record.function_queries[216].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[216].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[216].bump_multiplicity(__i); } let __ret: [G; OUT_216] = unsafe { *(record.function_queries[216].output_at(__i).as_ptr() as *const [G; OUT_216]) }; __ret }, _ => aiur_fn_216(__args, record, io_buffer, __cu)? } };
-                    let __v_15: G = __r_arr[0];
+                    let __v_14: G = __r_arr[0];
+                    let __v_15: G = G::from_u64(1);
                     let __v_16: G = G::from_u64(1);
-                    let __v_17: G = G::from_u64(1);
-                    let __v_18: G = { let __values: [G; 3] = [__v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_17: G = { let __values: [G; 3] = [__v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_18: G = G::from_u64(2);
                     let __v_19: G = G::from_u64(0);
-                    let __v_20: G = { let __values: [G; 4] = [__v_14, __v_15, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_20: G = { let __values: [G; 4] = [__v_18, __v_14, __v_17, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_222] = [__v_13, __v_20];
                     record.function_queries[222].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -21491,7 +21491,7 @@ fn aiur_fn_222(
                     let __v_14: G = G::from_u64(0);
                     let __v_15: G = G::from_u64(0);
                     let __v_16: G = G::from_u64(0);
-                    let __v_17: G = { let __values: [G; 4] = [__v_14, __v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_17: G = { let __values: [G; 4] = [__v_15, __v_14, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_222] = [__v_13, __v_17];
                     record.function_queries[222].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -21503,7 +21503,7 @@ fn aiur_fn_222(
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_222] = [__v_10, __v_14];
                 record.function_queries[222].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -21515,7 +21515,7 @@ fn aiur_fn_222(
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_222] = [__v_10, __v_14];
             record.function_queries[222].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -21853,45 +21853,45 @@ fn aiur_fn_228(
     let __v_1: G = G::from_u64(0);
     let __v_2: G = G::from_u64(0);
     let __v_3: G = { let __values: [G; 3] = [__v_1, __v_2, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_4: G = G::from_u64(0);
+    let __v_4: G = G::from_u64(1);
     let __v_5: G = G::from_u64(1);
-    let __v_6: G = G::from_u64(1);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_8: G = { let __values: [G; 3] = [__v_4, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_9: G = G::from_u64(2);
+    let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(0);
+    let __v_8: G = { let __values: [G; 3] = [__v_7, __v_3, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = []; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-    let __v_10: G = __r_arr[0];
+    let __v_9: G = __r_arr[0];
+    let __v_10: G = G::from_u64(2);
     let __v_11: G = G::from_u64(0);
-    let __v_12: G = { let __values: [G; 4] = [__v_9, __v_10, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_13: G = G::from_u64(2);
+    let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = []; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
-    let __v_14: G = __r_arr[0];
+    let __v_13: G = __r_arr[0];
+    let __v_14: G = G::from_u64(2);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_8, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_17: G = G::from_u64(2);
+    let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_8, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_212] = { let __args: [G; IN_212] = []; let __cu = unconstrained; let __hit = record.function_queries[212].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[212].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[212].bump_multiplicity(__i); } let __ret: [G; OUT_212] = unsafe { *(record.function_queries[212].output_at(__i).as_ptr() as *const [G; OUT_212]) }; __ret }, _ => aiur_fn_212(__args, record, io_buffer, __cu)? } };
-    let __v_18: G = __r_arr[0];
+    let __v_17: G = __r_arr[0];
+    let __v_18: G = G::from_u64(1);
     let __v_19: G = G::from_u64(1);
-    let __v_20: G = G::from_u64(1);
-    let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_20: G = { let __values: [G; 3] = [__v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_21: G = G::from_u64(2);
     let __v_22: G = G::from_u64(0);
-    let __v_23: G = { let __values: [G; 4] = [__v_17, __v_18, __v_21, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_24: G = G::from_u64(2);
+    let __v_23: G = { let __values: [G; 4] = [__v_21, __v_17, __v_20, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = []; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_25: G = __r_arr[0];
+    let __v_24: G = __r_arr[0];
+    let __v_25: G = G::from_u64(1);
     let __v_26: G = G::from_u64(1);
-    let __v_27: G = G::from_u64(1);
-    let __v_28: G = { let __values: [G; 3] = [__v_26, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_27: G = { let __values: [G; 3] = [__v_25, __v_26, __v_26]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_28: G = G::from_u64(2);
     let __v_29: G = G::from_u64(0);
-    let __v_30: G = { let __values: [G; 4] = [__v_24, __v_25, __v_28, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_31: G = G::from_u64(2);
+    let __v_30: G = { let __values: [G; 4] = [__v_28, __v_24, __v_27, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_208] = { let __args: [G; IN_208] = []; let __cu = unconstrained; let __hit = record.function_queries[208].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[208].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[208].bump_multiplicity(__i); } let __ret: [G; OUT_208] = unsafe { *(record.function_queries[208].output_at(__i).as_ptr() as *const [G; OUT_208]) }; __ret }, _ => aiur_fn_208(__args, record, io_buffer, __cu)? } };
-    let __v_32: G = __r_arr[0];
+    let __v_31: G = __r_arr[0];
+    let __v_32: G = G::from_u64(1);
     let __v_33: G = G::from_u64(1);
-    let __v_34: G = G::from_u64(1);
-    let __v_35: G = { let __values: [G; 3] = [__v_33, __v_34, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_34: G = { let __values: [G; 3] = [__v_32, __v_33, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_35: G = G::from_u64(2);
     let __v_36: G = G::from_u64(0);
-    let __v_37: G = { let __values: [G; 4] = [__v_31, __v_32, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_37: G = { let __values: [G; 4] = [__v_35, __v_31, __v_34, __v_36]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_38: G = G::from_u64(3);
     let __v_39: G = G::from_u64(0);
     let __v_40: G = { let __values: [G; 4] = [__v_38, __v_12, __v_23, __v_39]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -21939,10 +21939,10 @@ fn aiur_fn_229(
         let __v_8: G = __r_arr[1];
         let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
         let __v_9: G = __r_arr[0];
-        let __v_10: G = G::from_u64(7);
-        let __v_11: G = G::from_u64(0);
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = G::from_u64(7);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_10, __v_11, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_14: G = G::from_u64(3);
         let __v_15: G = G::from_u64(0);
         let __v_16: G = { let __values: [G; 4] = [__v_14, __v_3, __v_13, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -22182,11 +22182,11 @@ fn aiur_fn_233(
     let __v_23: G = G::from_u64(0);
     let __v_24: G = G::from_u64(0);
     let __v_25: G = G::from_u64(0);
-    let __v_26: G = G::from_u64(0);
+    let __v_26: G = G::from_u64(1);
     let __v_27: G = G::from_u64(1);
-    let __v_28: G = G::from_u64(1);
-    let __v_29: G = { let __values: [G; 10] = [__v_27, __v_28, __v_28, __v_28, __v_28, __v_28, __v_28, __v_28, __v_28, __v_28]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_30: G = { let __values: [G; 10] = [__v_22, __v_6, __v_8, __v_10, __v_12, __v_23, __v_24, __v_25, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_28: G = { let __values: [G; 10] = [__v_26, __v_27, __v_27, __v_27, __v_27, __v_27, __v_27, __v_27, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = G::from_u64(0);
+    let __v_30: G = { let __values: [G; 10] = [__v_29, __v_6, __v_8, __v_10, __v_12, __v_22, __v_23, __v_24, __v_25, __v_28]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_122] = { let __args: [G; IN_122] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[122].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[122].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[122].bump_multiplicity(__i); } let __ret: [G; OUT_122] = unsafe { *(record.function_queries[122].output_at(__i).as_ptr() as *const [G; OUT_122]) }; __ret }, _ => aiur_fn_122(__args, record, io_buffer, __cu)? } };
     let __v_31: G = __r_arr[0];
     let __ret: [G; OUT_233] = [__v_31];
@@ -22742,9 +22742,9 @@ fn aiur_fn_240(
             let __v_41: G = G::from_u64(192);
             let __v_42: G = (__v_9 + __v_41);
             let __v_43: G = G::from_u64(0);
-            let __v_44: G = G::from_u64(0);
-            let __v_45: G = { let __values: [G; 3] = [__v_44, __v_40, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_46: G = { let __values: [G; 3] = [__v_43, __v_42, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_44: G = { let __values: [G; 3] = [__v_43, __v_40, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_45: G = G::from_u64(0);
+            let __v_46: G = { let __values: [G; 3] = [__v_45, __v_42, __v_44]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_240] = [__v_46];
             record.function_queries[240].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -22761,11 +22761,11 @@ fn aiur_fn_240(
                 let __v_45: G = G::from_u64(224);
                 let __v_46: G = (__v_11 + __v_45);
                 let __v_47: G = G::from_u64(0);
-                let __v_48: G = G::from_u64(0);
+                let __v_48: G = { let __values: [G; 3] = [__v_47, __v_42, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_49: G = G::from_u64(0);
-                let __v_50: G = { let __values: [G; 3] = [__v_49, __v_42, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_51: G = { let __values: [G; 3] = [__v_48, __v_44, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_52: G = { let __values: [G; 3] = [__v_47, __v_46, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_50: G = { let __values: [G; 3] = [__v_49, __v_44, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_51: G = G::from_u64(0);
+                let __v_52: G = { let __values: [G; 3] = [__v_51, __v_46, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_240] = [__v_52];
                 record.function_queries[240].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -22780,13 +22780,13 @@ fn aiur_fn_240(
                 let __v_47: G = G::from_u64(240);
                 let __v_48: G = (__v_13 + __v_47);
                 let __v_49: G = G::from_u64(0);
-                let __v_50: G = G::from_u64(0);
+                let __v_50: G = { let __values: [G; 3] = [__v_49, __v_42, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_51: G = G::from_u64(0);
-                let __v_52: G = G::from_u64(0);
-                let __v_53: G = { let __values: [G; 3] = [__v_52, __v_42, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_54: G = { let __values: [G; 3] = [__v_51, __v_44, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_55: G = { let __values: [G; 3] = [__v_50, __v_46, __v_54]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_56: G = { let __values: [G; 3] = [__v_49, __v_48, __v_55]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_52: G = { let __values: [G; 3] = [__v_51, __v_44, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_53: G = G::from_u64(0);
+                let __v_54: G = { let __values: [G; 3] = [__v_53, __v_46, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_55: G = G::from_u64(0);
+                let __v_56: G = { let __values: [G; 3] = [__v_55, __v_48, __v_54]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_240] = [__v_56];
                 record.function_queries[240].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -23273,10 +23273,10 @@ fn aiur_fn_245(
 ) -> Result<[G; OUT_245], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
-    let __v_1: G = G::from_u64(7);
-    let __v_2: G = G::from_u64(0);
+    let __v_1: G = G::from_u64(0);
+    let __v_2: G = G::from_u64(7);
     let __v_3: G = G::from_u64(0);
-    let __v_4: G = { let __values: [G; 4] = [__v_1, __v_2, __v_0, __v_3]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_4: G = { let __values: [G; 4] = [__v_2, __v_1, __v_0, __v_3]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_245] = [__v_4];
     record.function_queries[245].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -23443,17 +23443,17 @@ fn aiur_fn_247(
 }
  };
     let __v_8: G = __mc_out___mc_1[0];
-    let __v_9: G = G::from_u64(3);
-    let __v_10: G = G::from_u64(2);
-    let __v_11: G = G::from_u64(1);
-    let __v_12: G = G::from_u64(1);
-    let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_14: G = G::from_u64(0);
-    let __v_15: G = { let __values: [G; 4] = [__v_10, __v_7, __v_13, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = G::from_u64(1);
+    let __v_10: G = G::from_u64(1);
+    let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = G::from_u64(2);
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 4] = [__v_12, __v_7, __v_11, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-    let __v_16: G = __r_arr[0];
+    let __v_15: G = __r_arr[0];
+    let __v_16: G = G::from_u64(3);
     let __v_17: G = G::from_u64(0);
-    let __v_18: G = { let __values: [G; 4] = [__v_9, __v_15, __v_16, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_18: G = { let __values: [G; 4] = [__v_16, __v_14, __v_15, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_247] = [__v_18];
     record.function_queries[247].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -23682,19 +23682,19 @@ fn aiur_fn_251(
 }
  };
         let __v_9: G = __mc_out___mc_0[0];
-        let __v_10: G = G::from_u64(0);
-        let __v_11: G = G::from_u64(2);
+        let __v_10: G = G::from_u64(2);
+        let __v_11: G = G::from_u64(0);
         let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
         let __v_14: G = G::from_u64(0);
         let __v_15: G = G::from_u64(0);
         let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
-        let __v_18: G = G::from_u64(0);
+        let __v_18: G = G::from_u64(1);
         let __v_19: G = G::from_u64(1);
-        let __v_20: G = G::from_u64(1);
-        let __v_21: G = { let __values: [G; 10] = [__v_19, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_22: G = { let __values: [G; 10] = [__v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_21]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_20: G = { let __values: [G; 10] = [__v_18, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_21: G = G::from_u64(0);
+        let __v_22: G = { let __values: [G; 10] = [__v_21, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_20]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
         let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_23, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
@@ -23797,19 +23797,19 @@ fn aiur_fn_252(
         let __v_17: G = __r_arr[0];
         let __v_18: G = (__v_16 - __v_17);
         let __v_19: G = (__v_0 * __v_18);
-        let __v_20: G = G::from_u64(0);
-        let __v_21: G = G::from_u64(2);
+        let __v_20: G = G::from_u64(2);
+        let __v_21: G = G::from_u64(0);
         let __v_22: G = G::from_u64(0);
         let __v_23: G = G::from_u64(0);
         let __v_24: G = G::from_u64(0);
         let __v_25: G = G::from_u64(0);
         let __v_26: G = G::from_u64(0);
         let __v_27: G = G::from_u64(0);
-        let __v_28: G = G::from_u64(0);
+        let __v_28: G = G::from_u64(1);
         let __v_29: G = G::from_u64(1);
-        let __v_30: G = G::from_u64(1);
-        let __v_31: G = { let __values: [G; 10] = [__v_29, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_32: G = { let __values: [G; 10] = [__v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_31]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_30: G = { let __values: [G; 10] = [__v_28, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = G::from_u64(0);
+        let __v_32: G = { let __values: [G; 10] = [__v_31, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
         let __v_33: G = __r_arr[0];
         let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_33, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
@@ -23826,19 +23826,19 @@ fn aiur_fn_252(
           },
           _ => {
             let __v_36: G = G::from_u64(0);
-            let __v_37: G = G::from_u64(0);
-            let __v_38: G = G::from_u64(1);
+            let __v_37: G = G::from_u64(1);
+            let __v_38: G = G::from_u64(0);
             let __v_39: G = G::from_u64(0);
             let __v_40: G = G::from_u64(0);
             let __v_41: G = G::from_u64(0);
             let __v_42: G = G::from_u64(0);
             let __v_43: G = G::from_u64(0);
             let __v_44: G = G::from_u64(0);
-            let __v_45: G = G::from_u64(0);
+            let __v_45: G = G::from_u64(1);
             let __v_46: G = G::from_u64(1);
-            let __v_47: G = G::from_u64(1);
-            let __v_48: G = { let __values: [G; 10] = [__v_46, __v_47, __v_47, __v_47, __v_47, __v_47, __v_47, __v_47, __v_47, __v_47]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_49: G = { let __values: [G; 10] = [__v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_48]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_47: G = { let __values: [G; 10] = [__v_45, __v_46, __v_46, __v_46, __v_46, __v_46, __v_46, __v_46, __v_46, __v_46]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_48: G = G::from_u64(0);
+            let __v_49: G = { let __values: [G; 10] = [__v_48, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_47]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __r_arr: [G; OUT_248] = { let __args: [G; IN_248] = [__v_19, __v_15, __v_36, __v_49]; let __cu = unconstrained; let __hit = record.function_queries[248].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[248].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[248].bump_multiplicity(__i); } let __ret: [G; OUT_248] = unsafe { *(record.function_queries[248].output_at(__i).as_ptr() as *const [G; OUT_248]) }; __ret }, _ => aiur_fn_248(__args, record, io_buffer, __cu)? } };
             let __v_50: G = __r_arr[0];
             let __ret: [G; OUT_252] = [__v_50];
@@ -23887,7 +23887,7 @@ fn aiur_fn_253(
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_253] = [__v_12, __v_16];
             record.function_queries[253].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -23942,7 +23942,7 @@ fn aiur_fn_253(
                 let __v_18: G = G::from_u64(0);
                 let __v_19: G = G::from_u64(0);
                 let __v_20: G = G::from_u64(0);
-                let __v_21: G = { let __values: [G; 4] = [__v_18, __v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_253] = [__v_17, __v_21];
                 record.function_queries[253].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -23960,7 +23960,7 @@ fn aiur_fn_253(
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_253] = [__v_12, __v_16];
             record.function_queries[253].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -23987,7 +23987,7 @@ fn aiur_fn_253(
                 let __v_18: G = G::from_u64(0);
                 let __v_19: G = G::from_u64(0);
                 let __v_20: G = G::from_u64(0);
-                let __v_21: G = { let __values: [G; 4] = [__v_18, __v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_253] = [__v_17, __v_21];
                 record.function_queries[253].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -24060,19 +24060,19 @@ fn aiur_fn_254(
         break '__mc_0 [__v_20];
       },
       _ => {
-        let __v_20: G = G::from_u64(0);
-        let __v_21: G = G::from_u64(2);
+        let __v_20: G = G::from_u64(2);
+        let __v_21: G = G::from_u64(0);
         let __v_22: G = G::from_u64(0);
         let __v_23: G = G::from_u64(0);
         let __v_24: G = G::from_u64(0);
         let __v_25: G = G::from_u64(0);
         let __v_26: G = G::from_u64(0);
         let __v_27: G = G::from_u64(0);
-        let __v_28: G = G::from_u64(0);
+        let __v_28: G = G::from_u64(1);
         let __v_29: G = G::from_u64(1);
-        let __v_30: G = G::from_u64(1);
-        let __v_31: G = { let __values: [G; 10] = [__v_29, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_32: G = { let __values: [G; 10] = [__v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_31]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_30: G = { let __values: [G; 10] = [__v_28, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = G::from_u64(0);
+        let __v_32: G = { let __values: [G; 10] = [__v_31, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_30]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_33: G = G::from_u64(1);
         let __r_arr: [G; OUT_136] = { let __args: [G; IN_136] = [__v_15, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[136].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[136].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[136].bump_multiplicity(__i); } let __ret: [G; OUT_136] = unsafe { *(record.function_queries[136].output_at(__i).as_ptr() as *const [G; OUT_136]) }; __ret }, _ => aiur_fn_136(__args, record, io_buffer, __cu)? } };
         let __v_34: G = __r_arr[0];
@@ -24106,7 +24106,7 @@ fn aiur_fn_254(
             let __v_17: G = G::from_u64(0);
             let __v_18: G = G::from_u64(0);
             let __v_19: G = G::from_u64(0);
-            let __v_20: G = { let __values: [G; 4] = [__v_17, __v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_20: G = { let __values: [G; 4] = [__v_18, __v_17, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_254] = [__v_16, __v_20];
             record.function_queries[254].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -24219,7 +24219,7 @@ fn aiur_fn_254(
             let __v_18: G = G::from_u64(0);
             let __v_19: G = G::from_u64(0);
             let __v_20: G = G::from_u64(0);
-            let __v_21: G = { let __values: [G; 4] = [__v_18, __v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_254] = [__v_17, __v_21];
             record.function_queries[254].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -24534,7 +24534,7 @@ fn aiur_fn_256(
                                                             let __v_32: G = G::from_u64(0);
                                                             let __v_33: G = G::from_u64(0);
                                                             let __v_34: G = G::from_u64(0);
-                                                            let __v_35: G = { let __values: [G; 4] = [__v_32, __v_33, __v_34, __v_34]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                            let __v_35: G = { let __values: [G; 4] = [__v_33, __v_32, __v_34, __v_34]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                                             let __ret: [G; OUT_256] = [__v_31, __v_35];
                                                             record.function_queries[256].finish(&inp[..], &__ret[..], !unconstrained);
                                                             return Ok(__ret);
@@ -24689,31 +24689,31 @@ fn aiur_fn_258(
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
     let __v_1: G = inp[1];
-    let __v_2: G = G::from_u64(0);
-    let __v_3: G = G::from_u64(1);
+    let __v_2: G = G::from_u64(1);
+    let __v_3: G = G::from_u64(0);
     let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
     let __v_7: G = G::from_u64(0);
     let __v_8: G = G::from_u64(0);
     let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(0);
+    let __v_10: G = G::from_u64(1);
     let __v_11: G = G::from_u64(1);
-    let __v_12: G = G::from_u64(1);
-    let __v_13: G = { let __values: [G; 10] = [__v_11, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_14: G = { let __values: [G; 10] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = { let __values: [G; 10] = [__v_10, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 10] = [__v_13, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_123] = { let __args: [G; IN_123] = [__v_1, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[123].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[123].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[123].bump_multiplicity(__i); } let __ret: [G; OUT_123] = unsafe { *(record.function_queries[123].output_at(__i).as_ptr() as *const [G; OUT_123]) }; __ret }, _ => aiur_fn_123(__args, record, io_buffer, __cu)? } };
     let __v_15: G = __r_arr[0];
     let __r_arr: [G; OUT_122] = { let __args: [G; IN_122] = [__v_15]; let __cu = unconstrained; let __hit = record.function_queries[122].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[122].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[122].bump_multiplicity(__i); } let __ret: [G; OUT_122] = unsafe { *(record.function_queries[122].output_at(__i).as_ptr() as *const [G; OUT_122]) }; __ret }, _ => aiur_fn_122(__args, record, io_buffer, __cu)? } };
     let __v_16: G = __r_arr[0];
-    let __v_17: G = G::from_u64(2);
     let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = []; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
-    let __v_18: G = __r_arr[0];
+    let __v_17: G = __r_arr[0];
+    let __v_18: G = G::from_u64(1);
     let __v_19: G = G::from_u64(1);
-    let __v_20: G = G::from_u64(1);
-    let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_20: G = { let __values: [G; 3] = [__v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_21: G = G::from_u64(2);
     let __v_22: G = G::from_u64(0);
-    let __v_23: G = { let __values: [G; 4] = [__v_17, __v_18, __v_21, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_23: G = { let __values: [G; 4] = [__v_21, __v_17, __v_20, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
     let __v_24: G = __r_arr[0];
     match __v_24.as_canonical_u64() {
@@ -24726,24 +24726,24 @@ fn aiur_fn_258(
         return Ok(__ret);
       },
       _ => {
-        let __v_25: G = G::from_u64(2);
         let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = []; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-        let __v_26: G = __r_arr[0];
+        let __v_25: G = __r_arr[0];
+        let __v_26: G = G::from_u64(1);
         let __v_27: G = G::from_u64(1);
-        let __v_28: G = G::from_u64(1);
-        let __v_29: G = { let __values: [G; 3] = [__v_27, __v_28, __v_28]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_28: G = { let __values: [G; 3] = [__v_26, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_29: G = G::from_u64(2);
         let __v_30: G = G::from_u64(0);
-        let __v_31: G = { let __values: [G; 4] = [__v_25, __v_26, __v_29, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_32: G = G::from_u64(7);
-        let __v_33: G = G::from_u64(0);
+        let __v_31: G = { let __values: [G; 4] = [__v_29, __v_25, __v_28, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_32: G = G::from_u64(0);
+        let __v_33: G = G::from_u64(7);
         let __v_34: G = G::from_u64(0);
-        let __v_35: G = { let __values: [G; 4] = [__v_32, __v_33, __v_16, __v_34]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_35: G = { let __values: [G; 4] = [__v_33, __v_32, __v_16, __v_34]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_36: G = G::from_u64(3);
-        let __v_37: G = G::from_u64(3);
-        let __v_38: G = G::from_u64(0);
-        let __v_39: G = { let __values: [G; 4] = [__v_37, __v_31, __v_0, __v_38]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_37: G = G::from_u64(0);
+        let __v_38: G = { let __values: [G; 4] = [__v_36, __v_31, __v_0, __v_37]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_39: G = G::from_u64(3);
         let __v_40: G = G::from_u64(0);
-        let __v_41: G = { let __values: [G; 4] = [__v_36, __v_39, __v_35, __v_40]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_41: G = { let __values: [G; 4] = [__v_39, __v_38, __v_35, __v_40]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_42: G = G::from_u64(3);
         let __v_43: G = G::from_u64(0);
         let __v_44: G = { let __values: [G; 4] = [__v_42, __v_23, __v_41, __v_43]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -24856,22 +24856,22 @@ fn aiur_fn_260(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(2);
         let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = []; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
+        let __v_4: G = __r_arr[0];
+        let __v_5: G = G::from_u64(1);
         let __v_6: G = G::from_u64(1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = G::from_u64(2);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_4, __v_5, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_4, __v_7, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_11: G = G::from_u64(3);
-        let __v_12: G = G::from_u64(3);
-        let __v_13: G = G::from_u64(0);
-        let __v_14: G = { let __values: [G; 4] = [__v_12, __v_10, __v_0, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = G::from_u64(0);
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_0, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-        let __v_15: G = __r_arr[0];
+        let __v_14: G = __r_arr[0];
+        let __v_15: G = G::from_u64(3);
         let __v_16: G = G::from_u64(0);
-        let __v_17: G = { let __values: [G; 4] = [__v_11, __v_14, __v_15, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_17: G = { let __values: [G; 4] = [__v_15, __v_13, __v_14, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_18: G = G::from_u64(1);
         let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_17, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
         let __v_19: G = __r_arr[0];
@@ -25018,7 +25018,7 @@ fn aiur_fn_262(
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_262] = [__v_7, __v_11];
         record.function_queries[262].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -25035,7 +25035,7 @@ fn aiur_fn_262(
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_262] = [__v_10, __v_14];
             record.function_queries[262].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -25054,7 +25054,7 @@ fn aiur_fn_262(
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
                 let __v_18: G = G::from_u64(0);
-                let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_262] = [__v_15, __v_19];
                 record.function_queries[262].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -25136,7 +25136,7 @@ fn aiur_fn_263(
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_263] = [__v_10, __v_14];
             record.function_queries[263].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -25169,7 +25169,7 @@ fn aiur_fn_263(
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_263] = [__v_14, __v_18];
                 record.function_queries[263].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -25189,7 +25189,7 @@ fn aiur_fn_263(
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_263] = [__v_10, __v_14];
                 record.function_queries[263].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -25224,7 +25224,7 @@ fn aiur_fn_263(
                     let __v_15: G = G::from_u64(0);
                     let __v_16: G = G::from_u64(0);
                     let __v_17: G = G::from_u64(0);
-                    let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_263] = [__v_14, __v_18];
                     record.function_queries[263].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -25268,7 +25268,7 @@ fn aiur_fn_264(
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_264] = [__v_5, __v_9];
         record.function_queries[264].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -25310,7 +25310,7 @@ fn aiur_fn_264(
                     let __v_16: G = G::from_u64(0);
                     let __v_17: G = G::from_u64(0);
                     let __v_18: G = G::from_u64(0);
-                    let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_264] = [__v_15, __v_19];
                     record.function_queries[264].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -25322,7 +25322,7 @@ fn aiur_fn_264(
                 let __v_14: G = G::from_u64(0);
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
-                let __v_17: G = { let __values: [G; 4] = [__v_14, __v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = { let __values: [G; 4] = [__v_15, __v_14, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_264] = [__v_13, __v_17];
                 record.function_queries[264].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -25347,7 +25347,7 @@ fn aiur_fn_264(
                 let __v_14: G = G::from_u64(0);
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
-                let __v_17: G = { let __values: [G; 4] = [__v_14, __v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = { let __values: [G; 4] = [__v_15, __v_14, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_264] = [__v_13, __v_17];
                 record.function_queries[264].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -25408,7 +25408,7 @@ fn aiur_fn_265(
         let __v_23: G = G::from_u64(0);
         let __v_24: G = G::from_u64(0);
         let __v_25: G = G::from_u64(0);
-        let __v_26: G = { let __values: [G; 4] = [__v_23, __v_24, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_26: G = { let __values: [G; 4] = [__v_24, __v_23, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_265] = [__v_22, __v_26];
         record.function_queries[265].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -25434,7 +25434,7 @@ fn aiur_fn_265(
                 let __v_27: G = G::from_u64(0);
                 let __v_28: G = G::from_u64(0);
                 let __v_29: G = G::from_u64(0);
-                let __v_30: G = { let __values: [G; 4] = [__v_27, __v_28, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_30: G = { let __values: [G; 4] = [__v_28, __v_27, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_265] = [__v_26, __v_30];
                 record.function_queries[265].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -25469,20 +25469,20 @@ fn aiur_fn_266(
     let __v_1: G = inp[1];
     let __v_2: G = inp[2];
     let __v_3: G = inp[3];
-    let __v_4: G = G::from_u64(2);
+    let __v_4: G = G::from_u64(1);
     let __v_5: G = G::from_u64(1);
-    let __v_6: G = G::from_u64(1);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(2);
     let __v_8: G = G::from_u64(0);
-    let __v_9: G = { let __values: [G; 4] = [__v_4, __v_0, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = { let __values: [G; 4] = [__v_7, __v_0, __v_6, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_10: G = G::from_u64(3);
-    let __v_11: G = G::from_u64(3);
-    let __v_12: G = G::from_u64(0);
-    let __v_13: G = { let __values: [G; 4] = [__v_11, __v_9, __v_1, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_1, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-    let __v_14: G = __r_arr[0];
+    let __v_13: G = __r_arr[0];
+    let __v_14: G = G::from_u64(3);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = { let __values: [G; 4] = [__v_10, __v_13, __v_14, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_16: G = { let __values: [G; 4] = [__v_14, __v_12, __v_13, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_16, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
     let __v_17: G = __r_arr[0];
     let __ret: [G; OUT_266] = [__v_17];
@@ -25787,11 +25787,11 @@ fn aiur_fn_269(
             return Ok(__ret);
           },
           0u64 => {
-            let __v_35: G = G::from_u64(0);
+            let __v_35: G = G::from_u64(1);
             let __v_36: G = G::from_u64(1);
-            let __v_37: G = G::from_u64(1);
-            let __v_38: G = { let __values: [G; 10] = [__v_36, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37, __v_37]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_39: G = { let __values: [G; 10] = [__v_35, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_38]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_37: G = { let __values: [G; 10] = [__v_35, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_38: G = G::from_u64(0);
+            let __v_39: G = { let __values: [G; 10] = [__v_38, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_37]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_269] = [__v_39];
             record.function_queries[269].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -25843,43 +25843,43 @@ fn aiur_fn_270(
         return Ok(__ret);
       },
       1u64 => {
-        let __v_10: G = G::from_u64(1);
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(1);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 3] = [__v_10, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 3] = [__v_11, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_270] = [__v_13];
         record.function_queries[270].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       2u64 => {
-        let __v_10: G = G::from_u64(2);
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_10: G = __r_arr[0];
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 3] = [__v_10, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(2);
+        let __v_13: G = { let __values: [G; 3] = [__v_12, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_270] = [__v_13];
         record.function_queries[270].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       3u64 => {
-        let __v_10: G = G::from_u64(3);
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_10: G = __r_arr[0];
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 3] = [__v_10, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(3);
+        let __v_13: G = { let __values: [G; 3] = [__v_12, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_270] = [__v_13];
         record.function_queries[270].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_10: G = G::from_u64(4);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(4);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 3] = [__v_10, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 3] = [__v_11, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_270] = [__v_13];
         record.function_queries[270].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -25928,12 +25928,12 @@ fn aiur_fn_271(
         let __v_12: G = __r_arr[0];
         let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_1, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
         let __v_13: G = __r_arr[0];
-        let __v_14: G = G::from_u64(0);
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_13]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_15: G = __r_arr[0];
+        let __v_14: G = __r_arr[0];
         let __r_arr: [G; OUT_271] = { let __args: [G; IN_271] = [__v_11, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[271].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[271].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[271].bump_multiplicity(__i); } let __ret: [G; OUT_271] = unsafe { *(record.function_queries[271].output_at(__i).as_ptr() as *const [G; OUT_271]) }; __ret }, _ => aiur_fn_271(__args, record, io_buffer, __cu)? } };
-        let __v_16: G = __r_arr[0];
-        let __v_17: G = { let __values: [G; 3] = [__v_14, __v_15, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = __r_arr[0];
+        let __v_16: G = G::from_u64(0);
+        let __v_17: G = { let __values: [G; 3] = [__v_16, __v_14, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_271] = [__v_17];
         record.function_queries[271].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -25985,21 +25985,21 @@ fn aiur_fn_272(
         let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_4, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
         let __v_24: G = __r_arr[0];
-        let __v_25: G = G::from_u64(1);
         let __r_arr: [G; OUT_270] = { let __args: [G; IN_270] = [__v_24]; let __cu = unconstrained; let __hit = record.function_queries[270].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[270].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[270].bump_multiplicity(__i); } let __ret: [G; OUT_270] = unsafe { *(record.function_queries[270].output_at(__i).as_ptr() as *const [G; OUT_270]) }; __ret }, _ => aiur_fn_270(__args, record, io_buffer, __cu)? } };
-        let __v_26: G = __r_arr[0];
+        let __v_25: G = __r_arr[0];
+        let __v_26: G = G::from_u64(1);
         let __v_27: G = G::from_u64(0);
-        let __v_28: G = { let __values: [G; 4] = [__v_25, __v_26, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_28: G = { let __values: [G; 4] = [__v_26, __v_25, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_28];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       1u64 => {
-        let __v_23: G = G::from_u64(0);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_24: G = __r_arr[0];
+        let __v_23: G = __r_arr[0];
+        let __v_24: G = G::from_u64(0);
         let __v_25: G = G::from_u64(0);
-        let __v_26: G = { let __values: [G; 4] = [__v_23, __v_24, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_26: G = { let __values: [G; 4] = [__v_24, __v_23, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_26];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -26037,12 +26037,12 @@ fn aiur_fn_272(
         let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_2, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
         let __v_24: G = __r_arr[0];
-        let __v_25: G = G::from_u64(8);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_26: G = __r_arr[0];
+        let __v_25: G = __r_arr[0];
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_22, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_27: G = __r_arr[0];
-        let __v_28: G = { let __values: [G; 4] = [__v_25, __v_24, __v_26, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_26: G = __r_arr[0];
+        let __v_27: G = G::from_u64(8);
+        let __v_28: G = { let __values: [G; 4] = [__v_27, __v_24, __v_25, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_28];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -26055,10 +26055,10 @@ fn aiur_fn_272(
         let __r_arr: [G; OUT_284] = { let __args: [G; IN_284] = [__v_24]; let __cu = unconstrained; let __hit = record.function_queries[284].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[284].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[284].bump_multiplicity(__i); } let __ret: [G; OUT_284] = unsafe { *(record.function_queries[284].output_at(__i).as_ptr() as *const [G; OUT_284]) }; __ret }, _ => aiur_fn_284(__args, record, io_buffer, __cu)? } };
         let __v_25: G = __r_arr[0];
         let __r_arr: [G; OUT_223] = { let __args: [G; IN_223] = [__v_25]; let __cu = unconstrained; let __hit = record.function_queries[223].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[223].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[223].bump_multiplicity(__i); } let __ret: [G; OUT_223] = unsafe { *(record.function_queries[223].output_at(__i).as_ptr() as *const [G; OUT_223]) }; __ret }, _ => aiur_fn_223(__args, record, io_buffer, __cu)? } };
-        let __v_26: G = G::from_u64(7);
-        let __v_27: G = G::from_u64(1);
+        let __v_26: G = G::from_u64(1);
+        let __v_27: G = G::from_u64(7);
         let __v_28: G = G::from_u64(0);
-        let __v_29: G = { let __values: [G; 4] = [__v_26, __v_27, __v_25, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_29: G = { let __values: [G; 4] = [__v_27, __v_26, __v_25, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_29];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -26072,59 +26072,59 @@ fn aiur_fn_272(
         let __v_25: G = __r_arr[0];
         let __r_arr: [G; OUT_269] = { let __args: [G; IN_269] = [__v_25]; let __cu = unconstrained; let __hit = record.function_queries[269].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[269].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[269].bump_multiplicity(__i); } let __ret: [G; OUT_269] = unsafe { *(record.function_queries[269].output_at(__i).as_ptr() as *const [G; OUT_269]) }; __ret }, _ => aiur_fn_269(__args, record, io_buffer, __cu)? } };
         let __v_26: G = __r_arr[0];
-        let __v_27: G = G::from_u64(7);
-        let __v_28: G = G::from_u64(0);
+        let __v_27: G = G::from_u64(0);
+        let __v_28: G = G::from_u64(7);
         let __v_29: G = G::from_u64(0);
-        let __v_30: G = { let __values: [G; 4] = [__v_27, __v_28, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_30: G = { let __values: [G; 4] = [__v_28, __v_27, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_30];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       7u64 => {
-        let __v_23: G = G::from_u64(3);
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_6, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_24: G = __r_arr[0];
+        let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_7, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_25: G = __r_arr[0];
+        let __v_24: G = __r_arr[0];
+        let __v_25: G = G::from_u64(3);
         let __v_26: G = G::from_u64(0);
-        let __v_27: G = { let __values: [G; 4] = [__v_23, __v_24, __v_25, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_27: G = { let __values: [G; 4] = [__v_25, __v_23, __v_24, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_27];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       8u64 => {
-        let __v_23: G = G::from_u64(4);
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_7, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_24: G = __r_arr[0];
+        let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_8, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_25: G = __r_arr[0];
+        let __v_24: G = __r_arr[0];
+        let __v_25: G = G::from_u64(4);
         let __v_26: G = G::from_u64(0);
-        let __v_27: G = { let __values: [G; 4] = [__v_23, __v_24, __v_25, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_27: G = { let __values: [G; 4] = [__v_25, __v_23, __v_24, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_27];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       9u64 => {
-        let __v_23: G = G::from_u64(5);
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_8, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_24: G = __r_arr[0];
+        let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_9, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_25: G = __r_arr[0];
+        let __v_24: G = __r_arr[0];
+        let __v_25: G = G::from_u64(5);
         let __v_26: G = G::from_u64(0);
-        let __v_27: G = { let __values: [G; 4] = [__v_23, __v_24, __v_25, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_27: G = { let __values: [G; 4] = [__v_25, __v_23, __v_24, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_27];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       10u64 => {
-        let __v_23: G = G::from_u64(6);
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_14, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_24: G = __r_arr[0];
+        let __v_23: G = __r_arr[0];
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_15, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_25: G = __r_arr[0];
+        let __v_24: G = __r_arr[0];
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_16, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
-        let __v_26: G = __r_arr[0];
-        let __v_27: G = { let __values: [G; 4] = [__v_23, __v_24, __v_25, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_25: G = __r_arr[0];
+        let __v_26: G = G::from_u64(6);
+        let __v_27: G = { let __values: [G; 4] = [__v_26, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_272] = [__v_27];
         record.function_queries[272].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -26264,11 +26264,11 @@ fn aiur_fn_274(
       _ => {
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_9, __v_10, __v_11, __v_12, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
         let __v_14: G = __r_arr[0];
-        let __v_15: G = G::from_u64(0);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_16: G = __r_arr[0];
+        let __v_15: G = __r_arr[0];
+        let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
-        let __ret: [G; OUT_274] = [__v_15, __v_16, __v_14, __v_0, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17];
+        let __ret: [G; OUT_274] = [__v_16, __v_15, __v_14, __v_0, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17];
         record.function_queries[274].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -26304,11 +26304,11 @@ fn aiur_fn_275(
       _ => {
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_9, __v_10, __v_11, __v_12, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
         let __v_14: G = __r_arr[0];
-        let __v_15: G = G::from_u64(4);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_16: G = __r_arr[0];
+        let __v_15: G = __r_arr[0];
+        let __v_16: G = G::from_u64(4);
         let __v_17: G = G::from_u64(0);
-        let __ret: [G; OUT_275] = [__v_15, __v_16, __v_14, __v_0, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17];
+        let __ret: [G; OUT_275] = [__v_16, __v_15, __v_14, __v_0, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17, __v_17];
         record.function_queries[275].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -26542,17 +26542,17 @@ fn aiur_fn_278(
       _ => {
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_25, __v_29, __v_30, __v_31, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
         let __v_33: G = __r_arr[0];
-        let __v_34: G = G::from_u64(5);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_35: G = __r_arr[0];
+        let __v_34: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_36: G = __r_arr[0];
+        let __v_35: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_37: G = __r_arr[0];
+        let __v_36: G = __r_arr[0];
         let __r_arr: [G; OUT_276] = { let __args: [G; IN_276] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[276].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[276].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[276].bump_multiplicity(__i); } let __ret: [G; OUT_276] = unsafe { *(record.function_queries[276].output_at(__i).as_ptr() as *const [G; OUT_276]) }; __ret }, _ => aiur_fn_276(__args, record, io_buffer, __cu)? } };
-        let __v_38: G = __r_arr[0];
+        let __v_37: G = __r_arr[0];
+        let __v_38: G = G::from_u64(5);
         let __v_39: G = G::from_u64(0);
-        let __ret: [G; OUT_278] = [__v_34, __v_35, __v_33, __v_36, __v_37, __v_38, __v_0, __v_27, __v_28, __v_39, __v_39, __v_39];
+        let __ret: [G; OUT_278] = [__v_38, __v_34, __v_33, __v_35, __v_36, __v_37, __v_0, __v_27, __v_28, __v_39, __v_39, __v_39];
         record.function_queries[278].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -26614,17 +26614,17 @@ fn aiur_fn_279(
       _ => {
         let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_33, __v_36, __v_37, __v_38, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
         let __v_40: G = __r_arr[0];
-        let __v_41: G = G::from_u64(6);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_42: G = __r_arr[0];
+        let __v_41: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_43: G = __r_arr[0];
+        let __v_42: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_44: G = __r_arr[0];
+        let __v_43: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_45: G = __r_arr[0];
+        let __v_44: G = __r_arr[0];
+        let __v_45: G = G::from_u64(6);
         let __v_46: G = G::from_u64(0);
-        let __ret: [G; OUT_279] = [__v_41, __v_42, __v_40, __v_34, __v_35, __v_43, __v_44, __v_45, __v_0, __v_46, __v_46, __v_46];
+        let __ret: [G; OUT_279] = [__v_45, __v_41, __v_40, __v_34, __v_35, __v_42, __v_43, __v_44, __v_0, __v_46, __v_46, __v_46];
         record.function_queries[279].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -26674,14 +26674,14 @@ fn aiur_fn_280(
           _ => {
             let __r_arr: [G; OUT_272] = { let __args: [G; IN_272] = [__v_15, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[272].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[272].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[272].bump_multiplicity(__i); } let __ret: [G; OUT_272] = unsafe { *(record.function_queries[272].output_at(__i).as_ptr() as *const [G; OUT_272]) }; __ret }, _ => aiur_fn_272(__args, record, io_buffer, __cu)? } };
             let __v_17: G = __r_arr[0];
-            let __v_18: G = G::from_u64(0);
             let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-            let __v_19: G = __r_arr[0];
-            let __v_20: G = G::from_u64(1);
-            let __v_21: G = (__v_5 + __v_20);
-            let __r_arr: [G; OUT_280] = { let __args: [G; IN_280] = [__v_16, __v_1, __v_2, __v_3, __v_4, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[280].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[280].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[280].bump_multiplicity(__i); } let __ret: [G; OUT_280] = unsafe { *(record.function_queries[280].output_at(__i).as_ptr() as *const [G; OUT_280]) }; __ret }, _ => aiur_fn_280(__args, record, io_buffer, __cu)? } };
-            let __v_22: G = __r_arr[0];
-            let __v_23: G = { let __values: [G; 5] = [__v_18, __v_5, __v_19, __v_17, __v_22]; let __mq = record.memory_queries.get_mut(&5).ok_or(ExecError::InvalidMemorySize(5))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_18: G = __r_arr[0];
+            let __v_19: G = G::from_u64(1);
+            let __v_20: G = (__v_5 + __v_19);
+            let __r_arr: [G; OUT_280] = { let __args: [G; IN_280] = [__v_16, __v_1, __v_2, __v_3, __v_4, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[280].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[280].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[280].bump_multiplicity(__i); } let __ret: [G; OUT_280] = unsafe { *(record.function_queries[280].output_at(__i).as_ptr() as *const [G; OUT_280]) }; __ret }, _ => aiur_fn_280(__args, record, io_buffer, __cu)? } };
+            let __v_21: G = __r_arr[0];
+            let __v_22: G = G::from_u64(0);
+            let __v_23: G = { let __values: [G; 5] = [__v_22, __v_5, __v_18, __v_17, __v_21]; let __mq = record.memory_queries.get_mut(&5).ok_or(ExecError::InvalidMemorySize(5))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_280] = [__v_23];
             record.function_queries[280].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -26762,18 +26762,18 @@ fn aiur_fn_281(
         let __v_51: G = G::from_u64(0);
         let __r_arr: [G; OUT_280] = { let __args: [G; IN_280] = [__v_43, __v_46, __v_47, __v_48, __v_49, __v_51]; let __cu = unconstrained; let __hit = record.function_queries[280].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[280].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[280].bump_multiplicity(__i); } let __ret: [G; OUT_280] = unsafe { *(record.function_queries[280].output_at(__i).as_ptr() as *const [G; OUT_280]) }; __ret }, _ => aiur_fn_280(__args, record, io_buffer, __cu)? } };
         let __v_52: G = __r_arr[0];
-        let __v_53: G = G::from_u64(7);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_54: G = __r_arr[0];
+        let __v_53: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_55: G = __r_arr[0];
+        let __v_54: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_56: G = __r_arr[0];
+        let __v_55: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_57: G = __r_arr[0];
+        let __v_56: G = __r_arr[0];
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_58: G = __r_arr[0];
-        let __ret: [G; OUT_281] = [__v_53, __v_54, __v_50, __v_55, __v_56, __v_57, __v_58, __v_52, __v_0, __v_1, __v_44, __v_45];
+        let __v_57: G = __r_arr[0];
+        let __v_58: G = G::from_u64(7);
+        let __ret: [G; OUT_281] = [__v_58, __v_53, __v_50, __v_54, __v_55, __v_56, __v_57, __v_52, __v_0, __v_1, __v_44, __v_45];
         record.function_queries[281].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -27216,11 +27216,11 @@ fn aiur_fn_287(
         break '__mc_0 [__v_53];
       },
       _ => {
-        let __v_51: G = G::from_u64(0);
+        let __v_51: G = G::from_u64(1);
         let __v_52: G = G::from_u64(1);
-        let __v_53: G = G::from_u64(1);
-        let __v_54: G = { let __values: [G; 3] = [__v_52, __v_53, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_55: G = { let __values: [G; 3] = [__v_51, __v_0, __v_54]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_53: G = { let __values: [G; 3] = [__v_51, __v_52, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_54: G = G::from_u64(0);
+        let __v_55: G = { let __values: [G; 3] = [__v_54, __v_0, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         break '__mc_0 [__v_55];
       },
     }
@@ -27343,11 +27343,11 @@ fn aiur_fn_287(
             }
           },
           1u64 => {
-            let __v_49: G = G::from_u64(0);
+            let __v_49: G = G::from_u64(1);
             let __v_50: G = G::from_u64(1);
-            let __v_51: G = G::from_u64(1);
-            let __v_52: G = { let __values: [G; 3] = [__v_50, __v_51, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_53: G = { let __values: [G; 3] = [__v_49, __v_0, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_51: G = { let __values: [G; 3] = [__v_49, __v_50, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_52: G = G::from_u64(0);
+            let __v_53: G = { let __values: [G; 3] = [__v_52, __v_0, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_54: G = G::from_u64(0);
             let __r_arr: [G; OUT_281] = { let __args: [G; IN_281] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_0, __v_54, __v_46, __v_47, __v_53, __v_48]; let __cu = unconstrained; let __hit = record.function_queries[281].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[281].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[281].bump_multiplicity(__i); } let __ret: [G; OUT_281] = unsafe { *(record.function_queries[281].output_at(__i).as_ptr() as *const [G; OUT_281]) }; __ret }, _ => aiur_fn_281(__args, record, io_buffer, __cu)? } };
             let __v_55: G = __r_arr[0];
@@ -28428,14 +28428,14 @@ fn aiur_fn_296(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_51: G = G::from_u64(0);
         let __r_arr: [G; OUT_294] = { let __args: [G; IN_294] = [__v_0, __v_1, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[294].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[294].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[294].bump_multiplicity(__i); } let __ret: [G; OUT_294] = unsafe { *(record.function_queries[294].output_at(__i).as_ptr() as *const [G; OUT_294]) }; __ret }, _ => aiur_fn_294(__args, record, io_buffer, __cu)? } };
-        let __v_52: G = __r_arr[0];
-        let __v_53: G = G::from_u64(1);
-        let __v_54: G = (__v_3 + __v_53);
-        let __r_arr: [G; OUT_296] = { let __args: [G; IN_296] = [__v_0, __v_1, __v_50, __v_54]; let __cu = unconstrained; let __hit = record.function_queries[296].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[296].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[296].bump_multiplicity(__i); } let __ret: [G; OUT_296] = unsafe { *(record.function_queries[296].output_at(__i).as_ptr() as *const [G; OUT_296]) }; __ret }, _ => aiur_fn_296(__args, record, io_buffer, __cu)? } };
-        let __v_55: G = __r_arr[0];
-        let __v_56: G = { let __values: [G; 3] = [__v_51, __v_52, __v_55]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_51: G = __r_arr[0];
+        let __v_52: G = G::from_u64(1);
+        let __v_53: G = (__v_3 + __v_52);
+        let __r_arr: [G; OUT_296] = { let __args: [G; IN_296] = [__v_0, __v_1, __v_50, __v_53]; let __cu = unconstrained; let __hit = record.function_queries[296].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[296].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[296].bump_multiplicity(__i); } let __ret: [G; OUT_296] = unsafe { *(record.function_queries[296].output_at(__i).as_ptr() as *const [G; OUT_296]) }; __ret }, _ => aiur_fn_296(__args, record, io_buffer, __cu)? } };
+        let __v_54: G = __r_arr[0];
+        let __v_55: G = G::from_u64(0);
+        let __v_56: G = { let __values: [G; 3] = [__v_55, __v_51, __v_54]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_296] = [__v_56];
         record.function_queries[296].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -28931,11 +28931,11 @@ fn aiur_fn_302(
     match __v_2.as_canonical_u64() {
       1u64 => {
         let __v_5: G = G::from_u64(1);
-        let __v_6: G = G::from_u64(0);
+        let __v_6: G = G::from_u64(1);
         let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_10: G = { let __values: [G; 3] = [__v_6, __v_0, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_9, __v_0, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_302] = [__v_5, __v_10];
         record.function_queries[302].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -29006,12 +29006,12 @@ fn aiur_fn_303(
     let __v_5: G = __loaded[2];
     match __v_3.as_canonical_u64() {
       1u64 => {
-        let __v_6: G = G::from_u64(0);
-        let __v_7: G = { let __values: [G; 2] = [__v_1, __v_2]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = { let __values: [G; 2] = [__v_1, __v_2]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = G::from_u64(1);
         let __v_8: G = G::from_u64(1);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_11: G = { let __values: [G; 3] = [__v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = { let __values: [G; 3] = [__v_10, __v_6, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_303] = [__v_11];
         record.function_queries[303].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -29025,9 +29025,9 @@ fn aiur_fn_303(
             let __v_8: G = { let __a_val = __v_1.as_canonical_u64(); let __b_val = __v_6.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
             match __v_8.as_canonical_u64() {
               1u64 => {
-                let __v_9: G = G::from_u64(0);
-                let __v_10: G = { let __values: [G; 2] = [__v_1, __v_2]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_9: G = { let __values: [G; 2] = [__v_1, __v_2]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_10: G = G::from_u64(0);
+                let __v_11: G = { let __values: [G; 3] = [__v_10, __v_9, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_303] = [__v_11];
                 record.function_queries[303].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -29036,10 +29036,10 @@ fn aiur_fn_303(
                 let __v_9: G = { let __a_val = __v_6.as_canonical_u64(); let __b_val = __v_1.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
                 match __v_9.as_canonical_u64() {
                   1u64 => {
-                    let __v_10: G = G::from_u64(0);
                     let __r_arr: [G; OUT_303] = { let __args: [G; IN_303] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[303].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[303].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[303].bump_multiplicity(__i); } let __ret: [G; OUT_303] = unsafe { *(record.function_queries[303].output_at(__i).as_ptr() as *const [G; OUT_303]) }; __ret }, _ => aiur_fn_303(__args, record, io_buffer, __cu)? } };
-                    let __v_11: G = __r_arr[0];
-                    let __v_12: G = { let __values: [G; 3] = [__v_10, __v_4, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_10: G = __r_arr[0];
+                    let __v_11: G = G::from_u64(0);
+                    let __v_12: G = { let __values: [G; 3] = [__v_11, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_303] = [__v_12];
                     record.function_queries[303].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -29048,9 +29048,9 @@ fn aiur_fn_303(
                     let __v_10: G = { let __a_val = __v_7.as_canonical_u64(); let __b_val = __v_2.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
                     match __v_10.as_canonical_u64() {
                       1u64 => {
-                        let __v_11: G = G::from_u64(0);
-                        let __v_12: G = { let __values: [G; 2] = [__v_6, __v_2]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_11: G = { let __values: [G; 2] = [__v_6, __v_2]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_12: G = G::from_u64(0);
+                        let __v_13: G = { let __values: [G; 3] = [__v_12, __v_11, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_303] = [__v_13];
                         record.function_queries[303].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -29294,10 +29294,10 @@ fn aiur_fn_306(
                     let __v_12: G = { let __a_val = __v_8.as_canonical_u64(); let __b_val = __v_10.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
                     match __v_12.as_canonical_u64() {
                       1u64 => {
-                        let __v_13: G = G::from_u64(0);
                         let __r_arr: [G; OUT_306] = { let __args: [G; IN_306] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[306].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[306].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[306].bump_multiplicity(__i); } let __ret: [G; OUT_306] = unsafe { *(record.function_queries[306].output_at(__i).as_ptr() as *const [G; OUT_306]) }; __ret }, _ => aiur_fn_306(__args, record, io_buffer, __cu)? } };
-                        let __v_14: G = __r_arr[0];
-                        let __v_15: G = { let __values: [G; 3] = [__v_13, __v_3, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_13: G = __r_arr[0];
+                        let __v_14: G = G::from_u64(0);
+                        let __v_15: G = { let __values: [G; 3] = [__v_14, __v_3, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_306] = [__v_15];
                         record.function_queries[306].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -29316,10 +29316,10 @@ fn aiur_fn_306(
                             let __v_14: G = { let __a_val = __v_11.as_canonical_u64(); let __b_val = __v_9.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
                             match __v_14.as_canonical_u64() {
                               1u64 => {
-                                let __v_15: G = G::from_u64(0);
                                 let __r_arr: [G; OUT_306] = { let __args: [G; IN_306] = [__v_4, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[306].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[306].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[306].bump_multiplicity(__i); } let __ret: [G; OUT_306] = unsafe { *(record.function_queries[306].output_at(__i).as_ptr() as *const [G; OUT_306]) }; __ret }, _ => aiur_fn_306(__args, record, io_buffer, __cu)? } };
-                                let __v_16: G = __r_arr[0];
-                                let __v_17: G = { let __values: [G; 3] = [__v_15, __v_3, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_15: G = __r_arr[0];
+                                let __v_16: G = G::from_u64(0);
+                                let __v_17: G = { let __values: [G; 3] = [__v_16, __v_3, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                 let __ret: [G; OUT_306] = [__v_17];
                                 record.function_queries[306].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
@@ -29434,15 +29434,15 @@ fn aiur_fn_308(
     let __v_5: G = __loaded[2];
     match __v_3.as_canonical_u64() {
       1u64 => {
-        let __v_6: G = G::from_u64(0);
+        let __v_6: G = G::from_u64(1);
         let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_10: G = { let __values: [G; 3] = [__v_1, __v_2, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 3] = [__v_1, __v_2, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = G::from_u64(1);
         let __v_11: G = G::from_u64(1);
-        let __v_12: G = G::from_u64(1);
-        let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_14: G = { let __values: [G; 3] = [__v_6, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = G::from_u64(0);
+        let __v_14: G = { let __values: [G; 3] = [__v_13, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_308] = [__v_14];
         record.function_queries[308].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -29461,9 +29461,9 @@ fn aiur_fn_308(
                 let __v_10: G = { let __a_val = __v_7.as_canonical_u64(); let __b_val = __v_2.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
                 match __v_10.as_canonical_u64() {
                   1u64 => {
-                    let __v_11: G = G::from_u64(0);
-                    let __v_12: G = { let __values: [G; 3] = [__v_6, __v_2, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_11: G = { let __values: [G; 3] = [__v_6, __v_2, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_12: G = G::from_u64(0);
+                    let __v_13: G = { let __values: [G; 3] = [__v_12, __v_11, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_308] = [__v_13];
                     record.function_queries[308].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -29479,21 +29479,21 @@ fn aiur_fn_308(
                 }
               },
               1u64 => {
-                let __v_10: G = G::from_u64(0);
+                let __v_10: G = G::from_u64(1);
                 let __v_11: G = G::from_u64(1);
-                let __v_12: G = G::from_u64(1);
-                let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_14: G = { let __values: [G; 3] = [__v_1, __v_2, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_15: G = { let __values: [G; 3] = [__v_10, __v_14, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_13: G = { let __values: [G; 3] = [__v_1, __v_2, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = G::from_u64(0);
+                let __v_15: G = { let __values: [G; 3] = [__v_14, __v_13, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_308] = [__v_15];
                 record.function_queries[308].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
               },
               _ => {
-                let __v_10: G = G::from_u64(0);
                 let __r_arr: [G; OUT_308] = { let __args: [G; IN_308] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[308].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[308].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[308].bump_multiplicity(__i); } let __ret: [G; OUT_308] = unsafe { *(record.function_queries[308].output_at(__i).as_ptr() as *const [G; OUT_308]) }; __ret }, _ => aiur_fn_308(__args, record, io_buffer, __cu)? } };
-                let __v_11: G = __r_arr[0];
-                let __v_12: G = { let __values: [G; 3] = [__v_10, __v_4, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_10: G = __r_arr[0];
+                let __v_11: G = G::from_u64(0);
+                let __v_12: G = { let __values: [G; 3] = [__v_11, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_308] = [__v_12];
                 record.function_queries[308].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -29530,18 +29530,18 @@ fn aiur_fn_309(
     match __v_4.as_canonical_u64() {
       1u64 => {
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = G::from_u64(0);
-        let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 2] = [__v_2, __v_3]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_11: G = G::from_u64(1);
-        let __v_12: G = G::from_u64(1);
-        let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_14: G = { let __values: [G; 3] = [__v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_15: G = { let __values: [G; 3] = [__v_1, __v_8, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 2] = [__v_2, __v_3]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(1);
+        let __v_10: G = G::from_u64(1);
+        let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = G::from_u64(0);
+        let __v_13: G = { let __values: [G; 3] = [__v_12, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = { let __values: [G; 3] = [__v_1, __v_7, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = G::from_u64(1);
         let __v_16: G = G::from_u64(1);
-        let __v_17: G = G::from_u64(1);
-        let __v_18: G = { let __values: [G; 3] = [__v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_19: G = { let __values: [G; 3] = [__v_7, __v_15, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_17: G = { let __values: [G; 3] = [__v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_18: G = G::from_u64(0);
+        let __v_19: G = { let __values: [G; 3] = [__v_18, __v_14, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_309] = [__v_19];
         record.function_queries[309].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -29557,35 +29557,35 @@ fn aiur_fn_309(
             let __v_10: G = __r_arr[0];
             match __v_10.as_canonical_u64() {
               0u64 => {
-                let __v_11: G = G::from_u64(0);
                 let __r_arr: [G; OUT_303] = { let __args: [G; IN_303] = [__v_9, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[303].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[303].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[303].bump_multiplicity(__i); } let __ret: [G; OUT_303] = unsafe { *(record.function_queries[303].output_at(__i).as_ptr() as *const [G; OUT_303]) }; __ret }, _ => aiur_fn_303(__args, record, io_buffer, __cu)? } };
-                let __v_12: G = __r_arr[0];
-                let __v_13: G = { let __values: [G; 3] = [__v_7, __v_8, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_14: G = { let __values: [G; 3] = [__v_11, __v_13, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_11: G = __r_arr[0];
+                let __v_12: G = { let __values: [G; 3] = [__v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_13: G = G::from_u64(0);
+                let __v_14: G = { let __values: [G; 3] = [__v_13, __v_12, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_309] = [__v_14];
                 record.function_queries[309].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
               },
               1u64 => {
                 let __v_11: G = G::from_u64(0);
-                let __v_12: G = G::from_u64(0);
-                let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 2] = [__v_2, __v_3]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_15: G = G::from_u64(1);
-                let __v_16: G = G::from_u64(1);
-                let __v_17: G = { let __values: [G; 3] = [__v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_18: G = { let __values: [G; 3] = [__v_13, __v_14, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_19: G = { let __values: [G; 3] = [__v_1, __v_12, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_20: G = { let __values: [G; 3] = [__v_11, __v_19, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_12: G = { let __values: [G; 2] = [__v_2, __v_3]; let __mq = record.memory_queries.get_mut(&2).ok_or(ExecError::InvalidMemorySize(2))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_13: G = G::from_u64(1);
+                let __v_14: G = G::from_u64(1);
+                let __v_15: G = { let __values: [G; 3] = [__v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_16: G = G::from_u64(0);
+                let __v_17: G = { let __values: [G; 3] = [__v_16, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 3] = [__v_1, __v_11, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_19: G = G::from_u64(0);
+                let __v_20: G = { let __values: [G; 3] = [__v_19, __v_18, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_309] = [__v_20];
                 record.function_queries[309].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
               },
               _ => {
-                let __v_11: G = G::from_u64(0);
                 let __r_arr: [G; OUT_309] = { let __args: [G; IN_309] = [__v_6, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[309].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[309].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[309].bump_multiplicity(__i); } let __ret: [G; OUT_309] = unsafe { *(record.function_queries[309].output_at(__i).as_ptr() as *const [G; OUT_309]) }; __ret }, _ => aiur_fn_309(__args, record, io_buffer, __cu)? } };
-                let __v_12: G = __r_arr[0];
-                let __v_13: G = { let __values: [G; 3] = [__v_11, __v_5, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_11: G = __r_arr[0];
+                let __v_12: G = G::from_u64(0);
+                let __v_13: G = { let __values: [G; 3] = [__v_12, __v_5, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_309] = [__v_13];
                 record.function_queries[309].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -29820,12 +29820,12 @@ fn aiur_fn_312(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_313] = { let __args: [G; IN_313] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[313].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[313].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[313].bump_multiplicity(__i); } let __ret: [G; OUT_313] = unsafe { *(record.function_queries[313].output_at(__i).as_ptr() as *const [G; OUT_313]) }; __ret }, _ => aiur_fn_313(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
         let __r_arr: [G; OUT_312] = { let __args: [G; IN_312] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[312].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[312].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[312].bump_multiplicity(__i); } let __ret: [G; OUT_312] = unsafe { *(record.function_queries[312].output_at(__i).as_ptr() as *const [G; OUT_312]) }; __ret }, _ => aiur_fn_312(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 3] = [__v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_7, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_312] = [__v_8];
         record.function_queries[312].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -30641,19 +30641,19 @@ fn aiur_fn_322(
 ) -> Result<[G; OUT_322], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
-    let __v_1: G = G::from_u64(0);
+    let __v_1: G = G::from_u64(1);
     let __v_2: G = G::from_u64(1);
-    let __v_3: G = G::from_u64(1);
-    let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_3]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_5: G = G::from_u64(0);
+    let __v_3: G = { let __values: [G; 3] = [__v_1, __v_2, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_4: G = G::from_u64(0);
+    let __v_5: G = G::from_u64(1);
     let __v_6: G = G::from_u64(1);
-    let __v_7: G = G::from_u64(1);
-    let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_9: G = { let __values: [G; 3] = [__v_4, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_8: G = { let __values: [G; 3] = [__v_3, __v_4, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = G::from_u64(1);
     let __v_10: G = G::from_u64(1);
-    let __v_11: G = G::from_u64(1);
-    let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_13: G = { let __values: [G; 3] = [__v_1, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = G::from_u64(0);
+    let __v_13: G = { let __values: [G; 3] = [__v_12, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_14: G = G::from_u64(1);
     let __v_15: G = G::from_u64(1);
     let __v_16: G = { let __values: [G; 3] = [__v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -31377,11 +31377,11 @@ fn aiur_fn_333(
         return Ok(__ret);
       },
       1u64 => {
-        let __v_4: G = G::from_u64(1);
         let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
+        let __v_4: G = __r_arr[0];
+        let __v_5: G = G::from_u64(1);
         let __v_6: G = G::from_u64(0);
-        let __v_7: G = { let __values: [G; 3] = [__v_4, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_4, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_333] = [__v_7];
         record.function_queries[333].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -31441,11 +31441,11 @@ fn aiur_fn_334(
         return Ok(__ret);
       },
       1u64 => {
-        let __v_5: G = G::from_u64(1);
         let __r_arr: [G; OUT_334] = { let __args: [G; IN_334] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[334].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[334].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[334].bump_multiplicity(__i); } let __ret: [G; OUT_334] = unsafe { *(record.function_queries[334].output_at(__i).as_ptr() as *const [G; OUT_334]) }; __ret }, _ => aiur_fn_334(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(1);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 3] = [__v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_334] = [__v_8];
         record.function_queries[334].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -31512,12 +31512,12 @@ fn aiur_fn_335(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_334] = { let __args: [G; IN_334] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[334].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[334].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[334].bump_multiplicity(__i); } let __ret: [G; OUT_334] = unsafe { *(record.function_queries[334].output_at(__i).as_ptr() as *const [G; OUT_334]) }; __ret }, _ => aiur_fn_334(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
         let __r_arr: [G; OUT_335] = { let __args: [G; IN_335] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[335].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[335].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[335].bump_multiplicity(__i); } let __ret: [G; OUT_335] = unsafe { *(record.function_queries[335].output_at(__i).as_ptr() as *const [G; OUT_335]) }; __ret }, _ => aiur_fn_335(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 3] = [__v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_7, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_335] = [__v_8];
         record.function_queries[335].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -31589,70 +31589,70 @@ fn aiur_fn_337(
         return Ok(__ret);
       },
       1u64 => {
-        let __v_6: G = G::from_u64(1);
         let __r_arr: [G; OUT_334] = { let __args: [G; IN_334] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[334].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[334].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[334].bump_multiplicity(__i); } let __ret: [G; OUT_334] = unsafe { *(record.function_queries[334].output_at(__i).as_ptr() as *const [G; OUT_334]) }; __ret }, _ => aiur_fn_334(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(1);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_9];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       2u64 => {
-        let __v_6: G = G::from_u64(2);
         let __r_arr: [G; OUT_335] = { let __args: [G; IN_335] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[335].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[335].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[335].bump_multiplicity(__i); } let __ret: [G; OUT_335] = unsafe { *(record.function_queries[335].output_at(__i).as_ptr() as *const [G; OUT_335]) }; __ret }, _ => aiur_fn_335(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(2);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_3, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_3, __v_6, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_9];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       3u64 => {
-        let __v_6: G = G::from_u64(3);
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(3);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_6, __v_7, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_10];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_6: G = G::from_u64(4);
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(4);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_6, __v_7, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_10];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       5u64 => {
-        let __v_6: G = G::from_u64(5);
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(5);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_6, __v_7, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_10];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       6u64 => {
-        let __v_6: G = G::from_u64(6);
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
-        let __v_10: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(6);
+        let __v_10: G = { let __values: [G; 4] = [__v_9, __v_6, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_10];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -31666,10 +31666,10 @@ fn aiur_fn_337(
         return Ok(__ret);
       },
       8u64 => {
-        let __v_6: G = G::from_u64(8);
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_3, __v_4, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(8);
+        let __v_8: G = { let __values: [G; 4] = [__v_7, __v_3, __v_4, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_337] = [__v_8];
         record.function_queries[337].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -32840,41 +32840,41 @@ fn aiur_fn_359(
         return Ok(__ret);
       },
       3u64 => {
-        let __v_7: G = G::from_u64(3);
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(3);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_7, __v_8, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_359] = [__v_11];
         record.function_queries[359].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_7: G = G::from_u64(4);
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(4);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_359] = [__v_13];
         record.function_queries[359].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       5u64 => {
-        let __v_7: G = G::from_u64(5);
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(5);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_359] = [__v_13];
         record.function_queries[359].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -32895,10 +32895,10 @@ fn aiur_fn_359(
         return Ok(__ret);
       },
       8u64 => {
-        let __v_7: G = G::from_u64(8);
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_6, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_4, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(8);
+        let __v_9: G = { let __values: [G; 4] = [__v_8, __v_4, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_359] = [__v_9];
         record.function_queries[359].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -32934,10 +32934,10 @@ fn aiur_fn_360(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_4: G = G::from_u64(0);
-        let __v_5: G = (__v_0 + __v_1);
+        let __v_4: G = (__v_0 + __v_1);
+        let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
-        let __v_7: G = { let __values: [G; 4] = [__v_4, __v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 4] = [__v_5, __v_4, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_360] = [__v_7];
         record.function_queries[360].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -32964,16 +32964,16 @@ fn aiur_fn_361(
     let __v_2: G = inp[2];
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
-    let __v_5: G = G::from_u64(6);
     let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_0, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-    let __v_6: G = __r_arr[0];
+    let __v_5: G = __r_arr[0];
     let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_1, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    let __v_8: G = G::from_u64(1);
-    let __v_9: G = (__v_4 + __v_8);
-    let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_2, __v_3, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-    let __v_10: G = __r_arr[0];
-    let __v_11: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = __r_arr[0];
+    let __v_7: G = G::from_u64(1);
+    let __v_8: G = (__v_4 + __v_7);
+    let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_2, __v_3, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
+    let __v_9: G = __r_arr[0];
+    let __v_10: G = G::from_u64(6);
+    let __v_11: G = { let __values: [G; 4] = [__v_10, __v_5, __v_6, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_361] = [__v_11];
     record.function_queries[361].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -33054,10 +33054,10 @@ fn aiur_fn_363(
             return Ok(__ret);
           },
           0u64 => {
-            let __v_8: G = G::from_u64(0);
-            let __v_9: G = (__v_4 - __v_1);
+            let __v_8: G = (__v_4 - __v_1);
+            let __v_9: G = G::from_u64(0);
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_363] = [__v_11];
             record.function_queries[363].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -33084,56 +33084,56 @@ fn aiur_fn_363(
         return Ok(__ret);
       },
       3u64 => {
-        let __v_7: G = G::from_u64(3);
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(3);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_7, __v_8, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_363] = [__v_11];
         record.function_queries[363].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_7: G = G::from_u64(4);
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(4);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_363] = [__v_13];
         record.function_queries[363].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       5u64 => {
-        let __v_7: G = G::from_u64(5);
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(5);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_363] = [__v_13];
         record.function_queries[363].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       6u64 => {
-        let __v_7: G = G::from_u64(6);
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
-        let __v_10: G = G::from_u64(1);
-        let __v_11: G = (__v_2 + __v_10);
-        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_6, __v_1, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(1);
+        let __v_10: G = (__v_2 + __v_9);
+        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_6, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(6);
+        let __v_13: G = { let __values: [G; 4] = [__v_12, __v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_363] = [__v_13];
         record.function_queries[363].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33147,10 +33147,10 @@ fn aiur_fn_363(
         return Ok(__ret);
       },
       8u64 => {
-        let __v_7: G = G::from_u64(8);
         let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_6, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_4, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(8);
+        let __v_9: G = { let __values: [G; 4] = [__v_8, __v_4, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_363] = [__v_9];
         record.function_queries[363].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33433,41 +33433,41 @@ fn aiur_fn_368(
         return Ok(__ret);
       },
       3u64 => {
-        let __v_7: G = G::from_u64(3);
         let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
         let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(3);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_7, __v_8, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_368] = [__v_11];
         record.function_queries[368].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_7: G = G::from_u64(4);
         let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(4);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_368] = [__v_13];
         record.function_queries[368].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       5u64 => {
-        let __v_7: G = G::from_u64(5);
         let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(5);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_368] = [__v_13];
         record.function_queries[368].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33488,10 +33488,10 @@ fn aiur_fn_368(
         return Ok(__ret);
       },
       8u64 => {
-        let __v_7: G = G::from_u64(8);
         let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_6, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_4, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(8);
+        let __v_9: G = { let __values: [G; 4] = [__v_8, __v_4, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_368] = [__v_9];
         record.function_queries[368].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33539,11 +33539,11 @@ fn aiur_fn_369(
             return Ok(__ret);
           },
           _ => {
-            let __v_5: G = G::from_u64(0);
-            let __v_6: G = G::from_u64(1);
-            let __v_7: G = (__v_0 - __v_6);
+            let __v_5: G = G::from_u64(1);
+            let __v_6: G = (__v_0 - __v_5);
+            let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
-            let __v_9: G = { let __values: [G; 4] = [__v_5, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_369] = [__v_9];
             record.function_queries[369].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -33572,16 +33572,16 @@ fn aiur_fn_370(
     let __v_2: G = inp[2];
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
-    let __v_5: G = G::from_u64(6);
     let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_0, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-    let __v_6: G = __r_arr[0];
+    let __v_5: G = __r_arr[0];
     let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_1, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    let __v_8: G = G::from_u64(1);
-    let __v_9: G = (__v_4 + __v_8);
-    let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_2, __v_3, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
-    let __v_10: G = __r_arr[0];
-    let __v_11: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = __r_arr[0];
+    let __v_7: G = G::from_u64(1);
+    let __v_8: G = (__v_4 + __v_7);
+    let __r_arr: [G; OUT_367] = { let __args: [G; IN_367] = [__v_2, __v_3, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[367].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[367].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[367].bump_multiplicity(__i); } let __ret: [G; OUT_367] = unsafe { *(record.function_queries[367].output_at(__i).as_ptr() as *const [G; OUT_367]) }; __ret }, _ => aiur_fn_367(__args, record, io_buffer, __cu)? } };
+    let __v_9: G = __r_arr[0];
+    let __v_10: G = G::from_u64(6);
+    let __v_11: G = { let __values: [G; 4] = [__v_10, __v_5, __v_6, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_370] = [__v_11];
     record.function_queries[370].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -33681,10 +33681,10 @@ fn aiur_fn_372(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_6: G = G::from_u64(0);
-        let __v_7: G = (__v_0 - __v_3);
+        let __v_6: G = (__v_0 - __v_3);
+        let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_372] = [__v_9];
         record.function_queries[372].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33739,41 +33739,41 @@ fn aiur_fn_373(
         return Ok(__ret);
       },
       3u64 => {
-        let __v_7: G = G::from_u64(3);
         let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
         let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(3);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_7, __v_8, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_373] = [__v_11];
         record.function_queries[373].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_7: G = G::from_u64(4);
         let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(4);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_373] = [__v_13];
         record.function_queries[373].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       5u64 => {
-        let __v_7: G = G::from_u64(5);
         let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_5, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(5);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_7, __v_8, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_7, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_373] = [__v_13];
         record.function_queries[373].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33794,10 +33794,10 @@ fn aiur_fn_373(
         return Ok(__ret);
       },
       8u64 => {
-        let __v_7: G = G::from_u64(8);
         let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_6, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_4, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(8);
+        let __v_9: G = { let __values: [G; 4] = [__v_8, __v_4, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_373] = [__v_9];
         record.function_queries[373].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -33824,16 +33824,16 @@ fn aiur_fn_374(
     let __v_2: G = inp[2];
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
-    let __v_5: G = G::from_u64(6);
     let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_0, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-    let __v_6: G = __r_arr[0];
+    let __v_5: G = __r_arr[0];
     let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_1, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    let __v_8: G = G::from_u64(1);
-    let __v_9: G = (__v_4 + __v_8);
-    let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_2, __v_3, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
-    let __v_10: G = __r_arr[0];
-    let __v_11: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = __r_arr[0];
+    let __v_7: G = G::from_u64(1);
+    let __v_8: G = (__v_4 + __v_7);
+    let __r_arr: [G; OUT_371] = { let __args: [G; IN_371] = [__v_2, __v_3, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[371].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[371].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[371].bump_multiplicity(__i); } let __ret: [G; OUT_371] = unsafe { *(record.function_queries[371].output_at(__i).as_ptr() as *const [G; OUT_371]) }; __ret }, _ => aiur_fn_371(__args, record, io_buffer, __cu)? } };
+    let __v_9: G = __r_arr[0];
+    let __v_10: G = G::from_u64(6);
+    let __v_11: G = { let __values: [G; 4] = [__v_10, __v_5, __v_6, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_374] = [__v_11];
     record.function_queries[374].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -34436,7 +34436,7 @@ fn aiur_fn_385(
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_385] = [__v_6, __v_10];
         record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -34461,7 +34461,7 @@ fn aiur_fn_385(
                     let __v_13: G = G::from_u64(0);
                     let __v_14: G = G::from_u64(0);
                     let __v_15: G = G::from_u64(0);
-                    let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_385] = [__v_12, __v_16];
                     record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -34477,7 +34477,7 @@ fn aiur_fn_385(
                         let __v_16: G = G::from_u64(0);
                         let __v_17: G = G::from_u64(0);
                         let __v_18: G = G::from_u64(0);
-                        let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_385] = [__v_15, __v_19];
                         record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -34529,14 +34529,14 @@ fn aiur_fn_385(
                                     let __v_44: G = G::from_u64(4);
                                     let __v_45: G = G::from_u64(0);
                                     let __v_46: G = { let __values: [G; 4] = [__v_44, __v_39, __v_43, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __v_47: G = G::from_u64(2);
                                     let __r_arr: [G; OUT_381] = { let __args: [G; IN_381] = []; let __cu = unconstrained; let __hit = record.function_queries[381].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[381].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[381].bump_multiplicity(__i); } let __ret: [G; OUT_381] = unsafe { *(record.function_queries[381].output_at(__i).as_ptr() as *const [G; OUT_381]) }; __ret }, _ => aiur_fn_381(__args, record, io_buffer, __cu)? } };
-                                    let __v_48: G = __r_arr[0];
+                                    let __v_47: G = __r_arr[0];
+                                    let __v_48: G = G::from_u64(1);
                                     let __v_49: G = G::from_u64(1);
-                                    let __v_50: G = G::from_u64(1);
-                                    let __v_51: G = { let __values: [G; 3] = [__v_49, __v_50, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_50: G = { let __values: [G; 3] = [__v_48, __v_49, __v_49]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_51: G = G::from_u64(2);
                                     let __v_52: G = G::from_u64(0);
-                                    let __v_53: G = { let __values: [G; 4] = [__v_47, __v_48, __v_51, __v_52]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_53: G = { let __values: [G; 4] = [__v_51, __v_47, __v_50, __v_52]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                     let __v_54: G = G::from_u64(4);
                                     let __v_55: G = G::from_u64(0);
                                     let __v_56: G = { let __values: [G; 4] = [__v_54, __v_26, __v_53, __v_55]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -34573,7 +34573,7 @@ fn aiur_fn_385(
                                     let __v_43: G = G::from_u64(0);
                                     let __v_44: G = G::from_u64(0);
                                     let __v_45: G = G::from_u64(0);
-                                    let __v_46: G = { let __values: [G; 4] = [__v_43, __v_44, __v_45, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_46: G = { let __values: [G; 4] = [__v_44, __v_43, __v_45, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                     let __ret: [G; OUT_385] = [__v_42, __v_46];
                                     record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
@@ -34585,7 +34585,7 @@ fn aiur_fn_385(
                                 let __v_34: G = G::from_u64(0);
                                 let __v_35: G = G::from_u64(0);
                                 let __v_36: G = G::from_u64(0);
-                                let __v_37: G = { let __values: [G; 4] = [__v_34, __v_35, __v_36, __v_36]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_37: G = { let __values: [G; 4] = [__v_35, __v_34, __v_36, __v_36]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                 let __ret: [G; OUT_385] = [__v_33, __v_37];
                                 record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
@@ -34597,7 +34597,7 @@ fn aiur_fn_385(
                             let __v_30: G = G::from_u64(0);
                             let __v_31: G = G::from_u64(0);
                             let __v_32: G = G::from_u64(0);
-                            let __v_33: G = { let __values: [G; 4] = [__v_30, __v_31, __v_32, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_33: G = { let __values: [G; 4] = [__v_31, __v_30, __v_32, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_385] = [__v_29, __v_33];
                             record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
@@ -34613,7 +34613,7 @@ fn aiur_fn_385(
                 let __v_11: G = G::from_u64(0);
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_385] = [__v_10, __v_14];
                 record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -34625,7 +34625,7 @@ fn aiur_fn_385(
             let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
-            let __v_10: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_385] = [__v_6, __v_10];
             record.function_queries[385].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -34663,15 +34663,15 @@ fn aiur_fn_386(
       _ => {
         let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(0);
-        let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 4] = [__v_7, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(1);
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
         let __v_14: G = G::from_u64(0);
-        let __v_15: G = { let __values: [G; 12] = [__v_5, __v_6, __v_12, __v_13, __v_14, __v_14, __v_14, __v_14, __v_14, __v_14, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = { let __values: [G; 12] = [__v_13, __v_5, __v_11, __v_12, __v_14, __v_14, __v_14, __v_14, __v_14, __v_14, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_386] = [__v_15];
         record.function_queries[386].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -34708,10 +34708,10 @@ fn aiur_fn_387(
       0u64 => {
         let __r_arr: [G; OUT_417] = { let __args: [G; IN_417] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[417].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[417].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[417].bump_multiplicity(__i); } let __ret: [G; OUT_417] = unsafe { *(record.function_queries[417].output_at(__i).as_ptr() as *const [G; OUT_417]) }; __ret }, _ => aiur_fn_417(__args, record, io_buffer, __cu)? } };
         let __v_5: G = __r_arr[0];
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_387] = { let __args: [G; IN_387] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[387].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[387].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[387].bump_multiplicity(__i); } let __ret: [G; OUT_387] = unsafe { *(record.function_queries[387].output_at(__i).as_ptr() as *const [G; OUT_387]) }; __ret }, _ => aiur_fn_387(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_7, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_387] = [__v_8];
         record.function_queries[387].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -34758,7 +34758,7 @@ fn aiur_fn_388(
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_388] = [__v_11, __v_15];
             record.function_queries[388].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -34791,7 +34791,7 @@ fn aiur_fn_388(
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
                 let __v_18: G = G::from_u64(0);
-                let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_388] = [__v_15, __v_19];
                 record.function_queries[388].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -34811,7 +34811,7 @@ fn aiur_fn_388(
                 let __v_12: G = G::from_u64(0);
                 let __v_13: G = G::from_u64(0);
                 let __v_14: G = G::from_u64(0);
-                let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_388] = [__v_11, __v_15];
                 record.function_queries[388].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -34846,7 +34846,7 @@ fn aiur_fn_388(
                     let __v_16: G = G::from_u64(0);
                     let __v_17: G = G::from_u64(0);
                     let __v_18: G = G::from_u64(0);
-                    let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_388] = [__v_15, __v_19];
                     record.function_queries[388].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -34915,9 +34915,9 @@ fn aiur_fn_389(
             let __r_arr: [G; OUT_417] = { let __args: [G; IN_417] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[417].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[417].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[417].bump_multiplicity(__i); } let __ret: [G; OUT_417] = unsafe { *(record.function_queries[417].output_at(__i).as_ptr() as *const [G; OUT_417]) }; __ret }, _ => aiur_fn_417(__args, record, io_buffer, __cu)? } };
             let __v_13: G = __r_arr[0];
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 3] = [__v_15, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_17: G = { let __values: [G; 3] = [__v_14, __v_13, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 3] = [__v_14, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = G::from_u64(0);
+            let __v_17: G = { let __values: [G; 3] = [__v_16, __v_13, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_389] = [__v_17];
             record.function_queries[389].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -35290,7 +35290,7 @@ fn aiur_fn_391(
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_391] = [__v_5, __v_9];
         record.function_queries[391].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -35344,7 +35344,7 @@ fn aiur_fn_392(
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_392] = [__v_7, __v_11];
             record.function_queries[392].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -35377,7 +35377,7 @@ fn aiur_fn_393(
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_393] = [__v_5, __v_9];
         record.function_queries[393].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -35412,7 +35412,7 @@ fn aiur_fn_393(
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_393] = [__v_11, __v_15];
             record.function_queries[393].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -35445,7 +35445,7 @@ fn aiur_fn_394(
         let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_394] = [__v_5, __v_9];
         record.function_queries[394].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -35480,7 +35480,7 @@ fn aiur_fn_394(
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_394] = [__v_11, __v_15];
             record.function_queries[394].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -35540,7 +35540,7 @@ fn aiur_fn_395(
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_395] = [__v_14, __v_18];
                 record.function_queries[395].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -35552,7 +35552,7 @@ fn aiur_fn_395(
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_395] = [__v_11, __v_15];
             record.function_queries[395].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -35564,7 +35564,7 @@ fn aiur_fn_395(
         let __v_10: G = G::from_u64(0);
         let __v_11: G = G::from_u64(0);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_395] = [__v_9, __v_13];
         record.function_queries[395].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -35796,7 +35796,7 @@ fn aiur_fn_397(
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_397] = [__v_10, __v_14];
             record.function_queries[397].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -35822,7 +35822,7 @@ fn aiur_fn_397(
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
         let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 4] = [__v_9, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_397] = [__v_8, __v_12];
         record.function_queries[397].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -36039,14 +36039,14 @@ fn aiur_fn_399(
             let __v_5: G = __r_arr[0];
             match __v_5.as_canonical_u64() {
               1u64 => {
-                let __v_6: G = G::from_u64(2);
                 let __r_arr: [G; OUT_147] = { let __args: [G; IN_147] = []; let __cu = unconstrained; let __hit = record.function_queries[147].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[147].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[147].bump_multiplicity(__i); } let __ret: [G; OUT_147] = unsafe { *(record.function_queries[147].output_at(__i).as_ptr() as *const [G; OUT_147]) }; __ret }, _ => aiur_fn_147(__args, record, io_buffer, __cu)? } };
-                let __v_7: G = __r_arr[0];
+                let __v_6: G = __r_arr[0];
+                let __v_7: G = G::from_u64(1);
                 let __v_8: G = G::from_u64(1);
-                let __v_9: G = G::from_u64(1);
-                let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_10: G = G::from_u64(2);
                 let __v_11: G = G::from_u64(0);
-                let __v_12: G = { let __values: [G; 4] = [__v_6, __v_7, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_12: G = { let __values: [G; 4] = [__v_10, __v_6, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_399] = [__v_12];
                 record.function_queries[399].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -36056,18 +36056,18 @@ fn aiur_fn_399(
                 let __v_6: G = __r_arr[0];
                 let __r_arr: [G; OUT_122] = { let __args: [G; IN_122] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[122].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[122].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[122].bump_multiplicity(__i); } let __ret: [G; OUT_122] = unsafe { *(record.function_queries[122].output_at(__i).as_ptr() as *const [G; OUT_122]) }; __ret }, _ => aiur_fn_122(__args, record, io_buffer, __cu)? } };
                 let __v_7: G = __r_arr[0];
-                let __v_8: G = G::from_u64(7);
-                let __v_9: G = G::from_u64(0);
+                let __v_8: G = G::from_u64(0);
+                let __v_9: G = G::from_u64(7);
                 let __v_10: G = G::from_u64(0);
-                let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_12: G = G::from_u64(2);
+                let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = []; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
-                let __v_13: G = __r_arr[0];
+                let __v_12: G = __r_arr[0];
+                let __v_13: G = G::from_u64(1);
                 let __v_14: G = G::from_u64(1);
-                let __v_15: G = G::from_u64(1);
-                let __v_16: G = { let __values: [G; 3] = [__v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_15: G = { let __values: [G; 3] = [__v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_16: G = G::from_u64(2);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_12, __v_13, __v_16, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_12, __v_15, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_19: G = G::from_u64(3);
                 let __v_20: G = G::from_u64(0);
                 let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_11, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -36135,7 +36135,7 @@ fn aiur_fn_400(
                 let __v_20: G = G::from_u64(0);
                 let __v_21: G = G::from_u64(0);
                 let __v_22: G = G::from_u64(0);
-                let __v_23: G = { let __values: [G; 4] = [__v_20, __v_21, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_23: G = { let __values: [G; 4] = [__v_21, __v_20, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_400] = [__v_19, __v_23];
                 record.function_queries[400].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -36151,7 +36151,7 @@ fn aiur_fn_400(
                     let __v_22: G = G::from_u64(0);
                     let __v_23: G = G::from_u64(0);
                     let __v_24: G = G::from_u64(0);
-                    let __v_25: G = { let __values: [G; 4] = [__v_22, __v_23, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_25: G = { let __values: [G; 4] = [__v_23, __v_22, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_400] = [__v_21, __v_25];
                     record.function_queries[400].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -36189,7 +36189,7 @@ fn aiur_fn_400(
         let __v_15: G = G::from_u64(0);
         let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
-        let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_400] = [__v_14, __v_18];
         record.function_queries[400].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -36310,11 +36310,11 @@ fn aiur_fn_402(
     let __v_5: G = (__v_1 + __v_4);
     let __r_arr: [G; OUT_782] = { let __args: [G; IN_782] = [__v_0, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[782].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[782].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[782].bump_multiplicity(__i); } let __ret: [G; OUT_782] = unsafe { *(record.function_queries[782].output_at(__i).as_ptr() as *const [G; OUT_782]) }; __ret }, _ => aiur_fn_782(__args, record, io_buffer, __cu)? } };
     let __v_6: G = __r_arr[0];
-    let __v_7: G = G::from_u64(0);
+    let __v_7: G = G::from_u64(1);
     let __v_8: G = G::from_u64(1);
-    let __v_9: G = G::from_u64(1);
-    let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_11: G = { let __values: [G; 3] = [__v_7, __v_2, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_10: G = G::from_u64(0);
+    let __v_11: G = { let __values: [G; 3] = [__v_10, __v_2, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_770] = { let __args: [G; IN_770] = [__v_3, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[770].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[770].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[770].bump_multiplicity(__i); } let __ret: [G; OUT_770] = unsafe { *(record.function_queries[770].output_at(__i).as_ptr() as *const [G; OUT_770]) }; __ret }, _ => aiur_fn_770(__args, record, io_buffer, __cu)? } };
     let __v_12: G = __r_arr[0];
     let __r_arr: [G; OUT_770] = { let __args: [G; IN_770] = [__v_12, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[770].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[770].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[770].bump_multiplicity(__i); } let __ret: [G; OUT_770] = unsafe { *(record.function_queries[770].output_at(__i).as_ptr() as *const [G; OUT_770]) }; __ret }, _ => aiur_fn_770(__args, record, io_buffer, __cu)? } };
@@ -36424,7 +36424,7 @@ fn aiur_fn_404(
         let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
         let __v_18: G = G::from_u64(0);
-        let __v_19: G = { let __values: [G; 4] = [__v_16, __v_17, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_19: G = { let __values: [G; 4] = [__v_17, __v_16, __v_18, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_404] = [__v_15, __v_19];
         record.function_queries[404].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -36458,17 +36458,17 @@ fn aiur_fn_404(
             let __v_25: G = __r_arr[3];
             match __v_22.as_canonical_u64() {
               1u64 => {
-                let __r_arr: [G; OUT_406] = { let __args: [G; IN_406] = [__v_6, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[406].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[406].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[406].bump_multiplicity(__i); } let __ret: [G; OUT_406] = unsafe { *(record.function_queries[406].output_at(__i).as_ptr() as *const [G; OUT_406]) }; __ret }, _ => aiur_fn_406(__args, record, io_buffer, __cu)? } };
-                let __v_26: G = __r_arr[0];
-                let __v_27: G = __r_arr[1];
-                let __v_28: G = __r_arr[2];
                 let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_24, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
-                let __v_29: G = __r_arr[0];
-                let __v_30: G = G::from_u64(1);
-                if (__v_29 != __v_30) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_29.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("iota: major's constructor belongs to a different inductive".to_string()) });
+                let __v_26: G = __r_arr[0];
+                let __v_27: G = G::from_u64(1);
+                if (__v_26 != __v_27) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("iota: major's constructor belongs to a different inductive".to_string()) });
                 }
-                match __v_26.as_canonical_u64() {
+                let __r_arr: [G; OUT_406] = { let __args: [G; IN_406] = [__v_6, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[406].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[406].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[406].bump_multiplicity(__i); } let __ret: [G; OUT_406] = unsafe { *(record.function_queries[406].output_at(__i).as_ptr() as *const [G; OUT_406]) }; __ret }, _ => aiur_fn_406(__args, record, io_buffer, __cu)? } };
+                let __v_28: G = __r_arr[0];
+                let __v_29: G = __r_arr[1];
+                let __v_30: G = __r_arr[2];
+                match __v_28.as_canonical_u64() {
                   0u64 => {
                     let __r_arr: [G; OUT_402] = { let __args: [G; IN_402] = [__v_1, __v_12, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[402].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[402].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[402].bump_multiplicity(__i); } let __ret: [G; OUT_402] = unsafe { *(record.function_queries[402].output_at(__i).as_ptr() as *const [G; OUT_402]) }; __ret }, _ => aiur_fn_402(__args, record, io_buffer, __cu)? } };
                     let __v_31: G = __r_arr[0];
@@ -36480,7 +36480,7 @@ fn aiur_fn_404(
                     return Ok(__ret);
                   },
                   1u64 => {
-                    let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_28, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
+                    let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_30, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
                     let __v_31: G = __r_arr[0];
                     let __v_32: G = (__v_3 + __v_4);
                     let __v_33: G = (__v_2 + __v_32);
@@ -36488,7 +36488,7 @@ fn aiur_fn_404(
                     let __v_34: G = __r_arr[0];
                     let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_25]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
                     let __v_35: G = __r_arr[0];
-                    let __v_36: G = (__v_35 - __v_27);
+                    let __v_36: G = (__v_35 - __v_29);
                     let __r_arr: [G; OUT_782] = { let __args: [G; IN_782] = [__v_25, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[782].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[782].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[782].bump_multiplicity(__i); } let __ret: [G; OUT_782] = unsafe { *(record.function_queries[782].output_at(__i).as_ptr() as *const [G; OUT_782]) }; __ret }, _ => aiur_fn_782(__args, record, io_buffer, __cu)? } };
                     let __v_37: G = __r_arr[0];
                     let __v_38: G = G::from_u64(1);
@@ -36507,7 +36507,7 @@ fn aiur_fn_404(
                     return Ok(__ret);
                   },
                   _ => {
-                    return Err(ExecError::MatchNoCase(__v_26.as_canonical_u64()));
+                    return Err(ExecError::MatchNoCase(__v_28.as_canonical_u64()));
                   },
                 }
               },
@@ -36691,7 +36691,7 @@ fn aiur_fn_406(
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
         let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 4] = [__v_9, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_406] = [__v_7, __v_8, __v_12];
         record.function_queries[406].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -36758,7 +36758,7 @@ fn aiur_fn_407(
         let __v_15: G = G::from_u64(0);
         let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
-        let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_407] = [__v_14, __v_18];
         record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -36776,7 +36776,7 @@ fn aiur_fn_407(
             let __v_20: G = G::from_u64(0);
             let __v_21: G = G::from_u64(0);
             let __v_22: G = G::from_u64(0);
-            let __v_23: G = { let __values: [G; 4] = [__v_20, __v_21, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_23: G = { let __values: [G; 4] = [__v_21, __v_20, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_407] = [__v_19, __v_23];
             record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -36796,7 +36796,7 @@ fn aiur_fn_407(
                     let __v_25: G = G::from_u64(0);
                     let __v_26: G = G::from_u64(0);
                     let __v_27: G = G::from_u64(0);
-                    let __v_28: G = { let __values: [G; 4] = [__v_25, __v_26, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_28: G = { let __values: [G; 4] = [__v_26, __v_25, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_407] = [__v_24, __v_28];
                     record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -36833,7 +36833,7 @@ fn aiur_fn_407(
                                     let __v_41: G = G::from_u64(0);
                                     let __v_42: G = G::from_u64(0);
                                     let __v_43: G = G::from_u64(0);
-                                    let __v_44: G = { let __values: [G; 4] = [__v_41, __v_42, __v_43, __v_43]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_44: G = { let __values: [G; 4] = [__v_42, __v_41, __v_43, __v_43]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                     let __ret: [G; OUT_407] = [__v_40, __v_44];
                                     record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
@@ -36853,7 +36853,7 @@ fn aiur_fn_407(
                                         let __v_45: G = G::from_u64(0);
                                         let __v_46: G = G::from_u64(0);
                                         let __v_47: G = G::from_u64(0);
-                                        let __v_48: G = { let __values: [G; 4] = [__v_45, __v_46, __v_47, __v_47]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_48: G = { let __values: [G; 4] = [__v_46, __v_45, __v_47, __v_47]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                         let __ret: [G; OUT_407] = [__v_44, __v_48];
                                         record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
@@ -36869,7 +36869,7 @@ fn aiur_fn_407(
                                             let __v_47: G = G::from_u64(0);
                                             let __v_48: G = G::from_u64(0);
                                             let __v_49: G = G::from_u64(0);
-                                            let __v_50: G = { let __values: [G; 4] = [__v_47, __v_48, __v_49, __v_49]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_50: G = { let __values: [G; 4] = [__v_48, __v_47, __v_49, __v_49]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                             let __ret: [G; OUT_407] = [__v_46, __v_50];
                                             record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
@@ -36908,7 +36908,7 @@ fn aiur_fn_407(
                                 let __v_40: G = G::from_u64(0);
                                 let __v_41: G = G::from_u64(0);
                                 let __v_42: G = G::from_u64(0);
-                                let __v_43: G = { let __values: [G; 4] = [__v_40, __v_41, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_43: G = { let __values: [G; 4] = [__v_41, __v_40, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                 let __ret: [G; OUT_407] = [__v_39, __v_43];
                                 record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
@@ -36920,7 +36920,7 @@ fn aiur_fn_407(
                             let __v_40: G = G::from_u64(0);
                             let __v_41: G = G::from_u64(0);
                             let __v_42: G = G::from_u64(0);
-                            let __v_43: G = { let __values: [G; 4] = [__v_40, __v_41, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_43: G = { let __values: [G; 4] = [__v_41, __v_40, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_407] = [__v_39, __v_43];
                             record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
@@ -36932,7 +36932,7 @@ fn aiur_fn_407(
                         let __v_38: G = G::from_u64(0);
                         let __v_39: G = G::from_u64(0);
                         let __v_40: G = G::from_u64(0);
-                        let __v_41: G = { let __values: [G; 4] = [__v_38, __v_39, __v_40, __v_40]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_41: G = { let __values: [G; 4] = [__v_39, __v_38, __v_40, __v_40]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_407] = [__v_37, __v_41];
                         record.function_queries[407].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -37294,11 +37294,11 @@ fn aiur_fn_411(
             return Ok(__ret);
           },
           _ => {
-            let __v_50: G = G::from_u64(0);
+            let __v_50: G = G::from_u64(1);
             let __v_51: G = G::from_u64(1);
-            let __v_52: G = G::from_u64(1);
-            let __v_53: G = { let __values: [G; 3] = [__v_51, __v_52, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_54: G = { let __values: [G; 3] = [__v_50, __v_0, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_52: G = { let __values: [G; 3] = [__v_50, __v_51, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_53: G = G::from_u64(0);
+            let __v_54: G = { let __values: [G; 3] = [__v_53, __v_0, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_411] = [__v_54];
             record.function_queries[411].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -38391,7 +38391,7 @@ fn aiur_fn_428(
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
         let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 4] = [__v_9, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         break '__mc_0 [__v_8, __v_12];
       },
     }
@@ -38773,13 +38773,13 @@ fn aiur_fn_432(
       },
       1u64 => {
         let __v_8: G = G::from_u64(1);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 3] = [__v_9, __v_5, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_5, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(1);
         let __v_13: G = G::from_u64(0);
-        let __v_14: G = { let __values: [G; 4] = [__v_8, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_432] = [__v_14];
         record.function_queries[432].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -38802,14 +38802,14 @@ fn aiur_fn_432(
         let __v_20: G = __loaded[11];
         let __r_arr: [G; OUT_430] = { let __args: [G; IN_430] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[430].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[430].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[430].bump_multiplicity(__i); } let __ret: [G; OUT_430] = unsafe { *(record.function_queries[430].output_at(__i).as_ptr() as *const [G; OUT_430]) }; __ret }, _ => aiur_fn_430(__args, record, io_buffer, __cu)? } };
         let __v_21: G = __r_arr[0];
-        let __r_arr: [G; OUT_431] = { let __args: [G; IN_431] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[431].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[431].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[431].bump_multiplicity(__i); } let __ret: [G; OUT_431] = unsafe { *(record.function_queries[431].output_at(__i).as_ptr() as *const [G; OUT_431]) }; __ret }, _ => aiur_fn_431(__args, record, io_buffer, __cu)? } };
-        let __v_22: G = __r_arr[0];
         let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
-        let __v_23: G = __r_arr[0];
-        if (__v_23 != __v_21) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: Some("Const applied to wrong number of universe levels".to_string()) });
+        let __v_22: G = __r_arr[0];
+        if (__v_22 != __v_21) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: Some("Const applied to wrong number of universe levels".to_string()) });
         }
-        let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_22, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_431] = { let __args: [G; IN_431] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[431].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[431].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[431].bump_multiplicity(__i); } let __ret: [G; OUT_431] = unsafe { *(record.function_queries[431].output_at(__i).as_ptr() as *const [G; OUT_431]) }; __ret }, _ => aiur_fn_431(__args, record, io_buffer, __cu)? } };
+        let __v_23: G = __r_arr[0];
+        let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_23, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
         let __v_24: G = __r_arr[0];
         let __ret: [G; OUT_432] = [__v_24];
         record.function_queries[432].finish(&inp[..], &__ret[..], !unconstrained);
@@ -38875,11 +38875,11 @@ fn aiur_fn_432(
         let __v_10: G = { let __values: [G; 3] = [__v_9, __v_5, __v_3]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_434] = { let __args: [G; IN_434] = [__v_6, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[434].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[434].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[434].bump_multiplicity(__i); } let __ret: [G; OUT_434] = unsafe { *(record.function_queries[434].output_at(__i).as_ptr() as *const [G; OUT_434]) }; __ret }, _ => aiur_fn_434(__args, record, io_buffer, __cu)? } };
         let __v_11: G = __r_arr[0];
-        let __v_12: G = G::from_u64(1);
         let __r_arr: [G; OUT_332] = { let __args: [G; IN_332] = [__v_8, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[332].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[332].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[332].bump_multiplicity(__i); } let __ret: [G; OUT_332] = unsafe { *(record.function_queries[332].output_at(__i).as_ptr() as *const [G; OUT_332]) }; __ret }, _ => aiur_fn_332(__args, record, io_buffer, __cu)? } };
-        let __v_13: G = __r_arr[0];
+        let __v_12: G = __r_arr[0];
+        let __v_13: G = G::from_u64(1);
         let __v_14: G = G::from_u64(0);
-        let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_432] = [__v_15];
         record.function_queries[432].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -38897,27 +38897,27 @@ fn aiur_fn_432(
       7u64 => {
         match __v_5.as_canonical_u64() {
           0u64 => {
-            let __v_8: G = G::from_u64(2);
             let __r_arr: [G; OUT_381] = { let __args: [G; IN_381] = []; let __cu = unconstrained; let __hit = record.function_queries[381].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[381].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[381].bump_multiplicity(__i); } let __ret: [G; OUT_381] = unsafe { *(record.function_queries[381].output_at(__i).as_ptr() as *const [G; OUT_381]) }; __ret }, _ => aiur_fn_381(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(1);
             let __v_10: G = G::from_u64(1);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = G::from_u64(2);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_8, __v_9, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_8, __v_11, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_432] = [__v_14];
             record.function_queries[432].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_8: G = G::from_u64(2);
             let __r_arr: [G; OUT_218] = { let __args: [G; IN_218] = []; let __cu = unconstrained; let __hit = record.function_queries[218].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[218].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[218].bump_multiplicity(__i); } let __ret: [G; OUT_218] = unsafe { *(record.function_queries[218].output_at(__i).as_ptr() as *const [G; OUT_218]) }; __ret }, _ => aiur_fn_218(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(1);
             let __v_10: G = G::from_u64(1);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = G::from_u64(2);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_8, __v_9, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_8, __v_11, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_432] = [__v_14];
             record.function_queries[432].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -38942,6 +38942,9 @@ fn aiur_fn_432(
         let __v_15: G = __loaded[3];
         match __v_12.as_canonical_u64() {
           2u64 => {
+            if (__v_13 != __v_5) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("projection's structure type differs from the value's head".to_string()) });
+            }
             let __r_arr: [G; OUT_287] = { let __args: [G; IN_287] = [__v_13]; let __cu = unconstrained; let __hit = record.function_queries[287].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[287].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[287].bump_multiplicity(__i); } let __ret: [G; OUT_287] = unsafe { *(record.function_queries[287].output_at(__i).as_ptr() as *const [G; OUT_287]) }; __ret }, _ => aiur_fn_287(__args, record, io_buffer, __cu)? } };
             let __v_16: G = __r_arr[0];
             let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_16.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
@@ -38957,34 +38960,31 @@ fn aiur_fn_432(
             let __v_26: G = __loaded[9];
             let __v_27: G = __loaded[10];
             let __v_28: G = __loaded[11];
-            if (__v_13 != __v_5) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("projection's structure type differs from the value's head".to_string()) });
-            }
             match __v_17.as_canonical_u64() {
               5u64 => {
-                let __v_29: G = G::from_u64(0);
-                let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_24, __v_25, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
-                let __v_30: G = __r_arr[0];
-                let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_30.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
-                let __v_31: G = __loaded[0];
-                let __v_32: G = __loaded[1];
-                let __v_33: G = __loaded[2];
-                let __v_34: G = __loaded[3];
-                let __v_35: G = __loaded[4];
-                let __v_36: G = __loaded[5];
-                let __v_37: G = __loaded[6];
-                let __v_38: G = __loaded[7];
-                let __v_39: G = __loaded[8];
-                let __v_40: G = __loaded[9];
-                let __v_41: G = __loaded[10];
-                let __v_42: G = __loaded[11];
-                let __v_43: G = G::from_u64(1);
-                if (__v_22 != __v_43) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_43.as_canonical_u64(), msg: Some("projection on an inductive with more than one constructor".to_string()) });
+                let __v_29: G = G::from_u64(1);
+                if (__v_22 != __v_29) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("projection on an inductive with more than one constructor".to_string()) });
                 }
-                match __v_31.as_canonical_u64() {
+                let __v_30: G = G::from_u64(0);
+                let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_24, __v_25, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
+                let __v_31: G = __r_arr[0];
+                let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_31.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
+                let __v_32: G = __loaded[0];
+                let __v_33: G = __loaded[1];
+                let __v_34: G = __loaded[2];
+                let __v_35: G = __loaded[3];
+                let __v_36: G = __loaded[4];
+                let __v_37: G = __loaded[5];
+                let __v_38: G = __loaded[6];
+                let __v_39: G = __loaded[7];
+                let __v_40: G = __loaded[8];
+                let __v_41: G = __loaded[9];
+                let __v_42: G = __loaded[10];
+                let __v_43: G = __loaded[11];
+                match __v_32.as_canonical_u64() {
                   6u64 => {
-                    let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_33, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
+                    let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_34, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
                     let __v_44: G = __r_arr[0];
                     let __r_arr: [G; OUT_435] = { let __args: [G; IN_435] = [__v_44, __v_11, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[435].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[435].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[435].bump_multiplicity(__i); } let __ret: [G; OUT_435] = unsafe { *(record.function_queries[435].output_at(__i).as_ptr() as *const [G; OUT_435]) }; __ret }, _ => aiur_fn_435(__args, record, io_buffer, __cu)? } };
                     let __v_45: G = __r_arr[0];
@@ -38996,7 +38996,7 @@ fn aiur_fn_432(
                     return Ok(__ret);
                   },
                   _ => {
-                    return Err(ExecError::MatchNoCase(__v_31.as_canonical_u64()));
+                    return Err(ExecError::MatchNoCase(__v_32.as_canonical_u64()));
                   },
                 }
               },
@@ -39049,13 +39049,13 @@ fn aiur_fn_433(
       },
       1u64 => {
         let __v_6: G = G::from_u64(1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
-        let __v_10: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
+        let __v_9: G = __r_arr[0];
+        let __v_10: G = G::from_u64(1);
         let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 4] = [__v_6, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_433] = [__v_12];
         record.function_queries[433].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -39078,14 +39078,14 @@ fn aiur_fn_433(
         let __v_18: G = __loaded[11];
         let __r_arr: [G; OUT_430] = { let __args: [G; IN_430] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[430].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[430].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[430].bump_multiplicity(__i); } let __ret: [G; OUT_430] = unsafe { *(record.function_queries[430].output_at(__i).as_ptr() as *const [G; OUT_430]) }; __ret }, _ => aiur_fn_430(__args, record, io_buffer, __cu)? } };
         let __v_19: G = __r_arr[0];
-        let __r_arr: [G; OUT_431] = { let __args: [G; IN_431] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[431].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[431].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[431].bump_multiplicity(__i); } let __ret: [G; OUT_431] = unsafe { *(record.function_queries[431].output_at(__i).as_ptr() as *const [G; OUT_431]) }; __ret }, _ => aiur_fn_431(__args, record, io_buffer, __cu)? } };
-        let __v_20: G = __r_arr[0];
         let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
-        let __v_21: G = __r_arr[0];
-        if (__v_21 != __v_19) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_21.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("Const applied to wrong number of universe levels".to_string()) });
+        let __v_20: G = __r_arr[0];
+        if (__v_20 != __v_19) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("Const applied to wrong number of universe levels".to_string()) });
         }
-        let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_20, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_431] = { let __args: [G; IN_431] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[431].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[431].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[431].bump_multiplicity(__i); } let __ret: [G; OUT_431] = unsafe { *(record.function_queries[431].output_at(__i).as_ptr() as *const [G; OUT_431]) }; __ret }, _ => aiur_fn_431(__args, record, io_buffer, __cu)? } };
+        let __v_21: G = __r_arr[0];
+        let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_21, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
         let __v_22: G = __r_arr[0];
         let __ret: [G; OUT_433] = [__v_22];
         record.function_queries[433].finish(&inp[..], &__ret[..], !unconstrained);
@@ -39151,11 +39151,11 @@ fn aiur_fn_433(
         let __v_8: G = { let __values: [G; 3] = [__v_7, __v_3, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_434] = { let __args: [G; IN_434] = [__v_4, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[434].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[434].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[434].bump_multiplicity(__i); } let __ret: [G; OUT_434] = unsafe { *(record.function_queries[434].output_at(__i).as_ptr() as *const [G; OUT_434]) }; __ret }, _ => aiur_fn_434(__args, record, io_buffer, __cu)? } };
         let __v_9: G = __r_arr[0];
-        let __v_10: G = G::from_u64(1);
         let __r_arr: [G; OUT_332] = { let __args: [G; IN_332] = [__v_6, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[332].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[332].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[332].bump_multiplicity(__i); } let __ret: [G; OUT_332] = unsafe { *(record.function_queries[332].output_at(__i).as_ptr() as *const [G; OUT_332]) }; __ret }, _ => aiur_fn_332(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(1);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_433] = [__v_13];
         record.function_queries[433].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -39173,27 +39173,27 @@ fn aiur_fn_433(
       7u64 => {
         match __v_3.as_canonical_u64() {
           0u64 => {
-            let __v_6: G = G::from_u64(2);
             let __r_arr: [G; OUT_381] = { let __args: [G; IN_381] = []; let __cu = unconstrained; let __hit = record.function_queries[381].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[381].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[381].bump_multiplicity(__i); } let __ret: [G; OUT_381] = unsafe { *(record.function_queries[381].output_at(__i).as_ptr() as *const [G; OUT_381]) }; __ret }, _ => aiur_fn_381(__args, record, io_buffer, __cu)? } };
-            let __v_7: G = __r_arr[0];
+            let __v_6: G = __r_arr[0];
+            let __v_7: G = G::from_u64(1);
             let __v_8: G = G::from_u64(1);
-            let __v_9: G = G::from_u64(1);
-            let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(2);
             let __v_11: G = G::from_u64(0);
-            let __v_12: G = { let __values: [G; 4] = [__v_6, __v_7, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = { let __values: [G; 4] = [__v_10, __v_6, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_433] = [__v_12];
             record.function_queries[433].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_6: G = G::from_u64(2);
             let __r_arr: [G; OUT_218] = { let __args: [G; IN_218] = []; let __cu = unconstrained; let __hit = record.function_queries[218].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[218].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[218].bump_multiplicity(__i); } let __ret: [G; OUT_218] = unsafe { *(record.function_queries[218].output_at(__i).as_ptr() as *const [G; OUT_218]) }; __ret }, _ => aiur_fn_218(__args, record, io_buffer, __cu)? } };
-            let __v_7: G = __r_arr[0];
+            let __v_6: G = __r_arr[0];
+            let __v_7: G = G::from_u64(1);
             let __v_8: G = G::from_u64(1);
-            let __v_9: G = G::from_u64(1);
-            let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(2);
             let __v_11: G = G::from_u64(0);
-            let __v_12: G = { let __values: [G; 4] = [__v_6, __v_7, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = { let __values: [G; 4] = [__v_10, __v_6, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_433] = [__v_12];
             record.function_queries[433].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -39218,6 +39218,9 @@ fn aiur_fn_433(
         let __v_13: G = __loaded[3];
         match __v_10.as_canonical_u64() {
           2u64 => {
+            if (__v_11 != __v_3) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("projection's structure type differs from the value's head".to_string()) });
+            }
             let __r_arr: [G; OUT_287] = { let __args: [G; IN_287] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[287].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[287].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[287].bump_multiplicity(__i); } let __ret: [G; OUT_287] = unsafe { *(record.function_queries[287].output_at(__i).as_ptr() as *const [G; OUT_287]) }; __ret }, _ => aiur_fn_287(__args, record, io_buffer, __cu)? } };
             let __v_14: G = __r_arr[0];
             let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_14.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
@@ -39233,34 +39236,31 @@ fn aiur_fn_433(
             let __v_24: G = __loaded[9];
             let __v_25: G = __loaded[10];
             let __v_26: G = __loaded[11];
-            if (__v_11 != __v_3) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("projection's structure type differs from the value's head".to_string()) });
-            }
             match __v_15.as_canonical_u64() {
               5u64 => {
-                let __v_27: G = G::from_u64(0);
-                let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_22, __v_23, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
-                let __v_28: G = __r_arr[0];
-                let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_28.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
-                let __v_29: G = __loaded[0];
-                let __v_30: G = __loaded[1];
-                let __v_31: G = __loaded[2];
-                let __v_32: G = __loaded[3];
-                let __v_33: G = __loaded[4];
-                let __v_34: G = __loaded[5];
-                let __v_35: G = __loaded[6];
-                let __v_36: G = __loaded[7];
-                let __v_37: G = __loaded[8];
-                let __v_38: G = __loaded[9];
-                let __v_39: G = __loaded[10];
-                let __v_40: G = __loaded[11];
-                let __v_41: G = G::from_u64(1);
-                if (__v_20 != __v_41) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_41.as_canonical_u64(), msg: Some("projection on an inductive with more than one constructor".to_string()) });
+                let __v_27: G = G::from_u64(1);
+                if (__v_20 != __v_27) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("projection on an inductive with more than one constructor".to_string()) });
                 }
-                match __v_29.as_canonical_u64() {
+                let __v_28: G = G::from_u64(0);
+                let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_22, __v_23, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
+                let __v_29: G = __r_arr[0];
+                let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_29.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
+                let __v_30: G = __loaded[0];
+                let __v_31: G = __loaded[1];
+                let __v_32: G = __loaded[2];
+                let __v_33: G = __loaded[3];
+                let __v_34: G = __loaded[4];
+                let __v_35: G = __loaded[5];
+                let __v_36: G = __loaded[6];
+                let __v_37: G = __loaded[7];
+                let __v_38: G = __loaded[8];
+                let __v_39: G = __loaded[9];
+                let __v_40: G = __loaded[10];
+                let __v_41: G = __loaded[11];
+                match __v_30.as_canonical_u64() {
                   6u64 => {
-                    let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_31, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
+                    let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_32, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
                     let __v_42: G = __r_arr[0];
                     let __r_arr: [G; OUT_435] = { let __args: [G; IN_435] = [__v_42, __v_9, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[435].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[435].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[435].bump_multiplicity(__i); } let __ret: [G; OUT_435] = unsafe { *(record.function_queries[435].output_at(__i).as_ptr() as *const [G; OUT_435]) }; __ret }, _ => aiur_fn_435(__args, record, io_buffer, __cu)? } };
                     let __v_43: G = __r_arr[0];
@@ -39272,7 +39272,7 @@ fn aiur_fn_433(
                     return Ok(__ret);
                   },
                   _ => {
-                    return Err(ExecError::MatchNoCase(__v_29.as_canonical_u64()));
+                    return Err(ExecError::MatchNoCase(__v_30.as_canonical_u64()));
                   },
                 }
               },
@@ -42010,7 +42010,7 @@ fn aiur_fn_468(
             let __v_14: G = G::from_u64(0);
             let __v_15: G = G::from_u64(0);
             let __v_16: G = G::from_u64(0);
-            let __v_17: G = { let __values: [G; 4] = [__v_14, __v_15, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_17: G = { let __values: [G; 4] = [__v_15, __v_14, __v_16, __v_16]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_18: G = G::from_u64(3);
             let __v_19: G = G::from_u64(0);
             let __v_20: G = { let __values: [G; 4] = [__v_18, __v_13, __v_17, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -43647,13 +43647,13 @@ fn aiur_fn_489(
       },
       1u64 => {
         let __v_6: G = G::from_u64(1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
-        let __v_10: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_333] = { let __args: [G; IN_333] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[333].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[333].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[333].bump_multiplicity(__i); } let __ret: [G; OUT_333] = unsafe { *(record.function_queries[333].output_at(__i).as_ptr() as *const [G; OUT_333]) }; __ret }, _ => aiur_fn_333(__args, record, io_buffer, __cu)? } };
+        let __v_9: G = __r_arr[0];
+        let __v_10: G = G::from_u64(1);
         let __v_11: G = G::from_u64(0);
-        let __v_12: G = { let __values: [G; 4] = [__v_6, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_489] = [__v_12];
         record.function_queries[489].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -43678,11 +43678,11 @@ fn aiur_fn_489(
         let __v_19: G = __r_arr[0];
         let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
         let __v_20: G = __r_arr[0];
-        let __r_arr: [G; OUT_431] = { let __args: [G; IN_431] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[431].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[431].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[431].bump_multiplicity(__i); } let __ret: [G; OUT_431] = unsafe { *(record.function_queries[431].output_at(__i).as_ptr() as *const [G; OUT_431]) }; __ret }, _ => aiur_fn_431(__args, record, io_buffer, __cu)? } };
-        let __v_21: G = __r_arr[0];
         if (__v_20 != __v_19) {
           return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("Const applied to wrong number of universe levels".to_string()) });
         }
+        let __r_arr: [G; OUT_431] = { let __args: [G; IN_431] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[431].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[431].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[431].bump_multiplicity(__i); } let __ret: [G; OUT_431] = unsafe { *(record.function_queries[431].output_at(__i).as_ptr() as *const [G; OUT_431]) }; __ret }, _ => aiur_fn_431(__args, record, io_buffer, __cu)? } };
+        let __v_21: G = __r_arr[0];
         let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_21, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
         let __v_22: G = __r_arr[0];
         let __ret: [G; OUT_489] = [__v_22];
@@ -43725,11 +43725,11 @@ fn aiur_fn_489(
         let __v_8: G = { let __values: [G; 3] = [__v_7, __v_3, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_505] = { let __args: [G; IN_505] = [__v_4, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[505].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[505].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[505].bump_multiplicity(__i); } let __ret: [G; OUT_505] = unsafe { *(record.function_queries[505].output_at(__i).as_ptr() as *const [G; OUT_505]) }; __ret }, _ => aiur_fn_505(__args, record, io_buffer, __cu)? } };
         let __v_9: G = __r_arr[0];
-        let __v_10: G = G::from_u64(1);
         let __r_arr: [G; OUT_332] = { let __args: [G; IN_332] = [__v_6, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[332].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[332].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[332].bump_multiplicity(__i); } let __ret: [G; OUT_332] = unsafe { *(record.function_queries[332].output_at(__i).as_ptr() as *const [G; OUT_332]) }; __ret }, _ => aiur_fn_332(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(1);
         let __v_12: G = G::from_u64(0);
-        let __v_13: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 4] = [__v_11, __v_10, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_489] = [__v_13];
         record.function_queries[489].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -43953,7 +43953,7 @@ fn aiur_fn_494(
             let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
-            let __v_10: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_494] = [__v_10, __v_4];
             record.function_queries[494].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -44058,65 +44058,65 @@ fn aiur_fn_495(
             }
           },
           3u64 => {
-            let __v_10: G = G::from_u64(3);
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_7, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_11: G = __r_arr[0];
+            let __v_10: G = __r_arr[0];
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_8, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
+            let __v_11: G = __r_arr[0];
+            let __v_12: G = G::from_u64(3);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 4] = [__v_12, __v_10, __v_11, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_495] = [__v_14];
             record.function_queries[495].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           4u64 => {
-            let __v_10: G = G::from_u64(4);
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_7, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_11: G = __r_arr[0];
-            let __v_12: G = G::from_u64(1);
-            let __v_13: G = (__v_3 + __v_12);
-            let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_8, __v_1, __v_2, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_14: G = __r_arr[0];
+            let __v_10: G = __r_arr[0];
+            let __v_11: G = G::from_u64(1);
+            let __v_12: G = (__v_3 + __v_11);
+            let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_8, __v_1, __v_2, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
+            let __v_13: G = __r_arr[0];
+            let __v_14: G = G::from_u64(4);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_10, __v_11, __v_14, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_10, __v_13, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_495] = [__v_16];
             record.function_queries[495].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           5u64 => {
-            let __v_10: G = G::from_u64(5);
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_7, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_11: G = __r_arr[0];
-            let __v_12: G = G::from_u64(1);
-            let __v_13: G = (__v_3 + __v_12);
-            let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_8, __v_1, __v_2, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_14: G = __r_arr[0];
+            let __v_10: G = __r_arr[0];
+            let __v_11: G = G::from_u64(1);
+            let __v_12: G = (__v_3 + __v_11);
+            let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_8, __v_1, __v_2, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
+            let __v_13: G = __r_arr[0];
+            let __v_14: G = G::from_u64(5);
             let __v_15: G = G::from_u64(0);
-            let __v_16: G = { let __values: [G; 4] = [__v_10, __v_11, __v_14, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 4] = [__v_14, __v_10, __v_13, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_495] = [__v_16];
             record.function_queries[495].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           6u64 => {
-            let __v_10: G = G::from_u64(6);
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_7, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_11: G = __r_arr[0];
+            let __v_10: G = __r_arr[0];
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_8, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = (__v_3 + __v_13);
-            let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_9, __v_1, __v_2, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_15: G = __r_arr[0];
-            let __v_16: G = { let __values: [G; 4] = [__v_10, __v_11, __v_12, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = __r_arr[0];
+            let __v_12: G = G::from_u64(1);
+            let __v_13: G = (__v_3 + __v_12);
+            let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_9, __v_1, __v_2, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
+            let __v_14: G = __r_arr[0];
+            let __v_15: G = G::from_u64(6);
+            let __v_16: G = { let __values: [G; 4] = [__v_15, __v_10, __v_11, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_495] = [__v_16];
             record.function_queries[495].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           8u64 => {
-            let __v_10: G = G::from_u64(8);
             let __r_arr: [G; OUT_495] = { let __args: [G; IN_495] = [__v_9, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[495].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[495].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[495].bump_multiplicity(__i); } let __ret: [G; OUT_495] = unsafe { *(record.function_queries[495].output_at(__i).as_ptr() as *const [G; OUT_495]) }; __ret }, _ => aiur_fn_495(__args, record, io_buffer, __cu)? } };
-            let __v_11: G = __r_arr[0];
-            let __v_12: G = { let __values: [G; 4] = [__v_10, __v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = __r_arr[0];
+            let __v_11: G = G::from_u64(8);
+            let __v_12: G = { let __values: [G; 4] = [__v_11, __v_7, __v_8, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_495] = [__v_12];
             record.function_queries[495].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -44187,10 +44187,10 @@ fn aiur_fn_496(
             let __v_12: G = G::from_u64(0);
             let __v_13: G = { let __values: [G; 3] = [__v_12, __v_10, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_14: G = G::from_u64(1);
-            let __v_15: G = G::from_u64(1);
-            let __v_16: G = (__v_3 + __v_15);
+            let __v_15: G = (__v_3 + __v_14);
+            let __v_16: G = G::from_u64(1);
             let __v_17: G = G::from_u64(0);
-            let __v_18: G = { let __values: [G; 5] = [__v_14, __v_10, __v_16, __v_1, __v_17]; let __mq = record.memory_queries.get_mut(&5).ok_or(ExecError::InvalidMemorySize(5))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_18: G = { let __values: [G; 5] = [__v_16, __v_10, __v_15, __v_1, __v_17]; let __mq = record.memory_queries.get_mut(&5).ok_or(ExecError::InvalidMemorySize(5))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_19: G = G::from_u64(1);
             let __v_20: G = (__v_3 + __v_19);
             let __r_arr: [G; OUT_496] = { let __args: [G; IN_496] = [__v_7, __v_18, __v_13, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[496].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[496].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[496].bump_multiplicity(__i); } let __ret: [G; OUT_496] = unsafe { *(record.function_queries[496].output_at(__i).as_ptr() as *const [G; OUT_496]) }; __ret }, _ => aiur_fn_496(__args, record, io_buffer, __cu)? } };
@@ -44211,10 +44211,10 @@ fn aiur_fn_496(
             let __v_12: G = G::from_u64(0);
             let __v_13: G = { let __values: [G; 3] = [__v_12, __v_10, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_14: G = G::from_u64(1);
-            let __v_15: G = G::from_u64(1);
-            let __v_16: G = (__v_3 + __v_15);
+            let __v_15: G = (__v_3 + __v_14);
+            let __v_16: G = G::from_u64(1);
             let __v_17: G = G::from_u64(0);
-            let __v_18: G = { let __values: [G; 5] = [__v_14, __v_10, __v_16, __v_1, __v_17]; let __mq = record.memory_queries.get_mut(&5).ok_or(ExecError::InvalidMemorySize(5))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_18: G = { let __values: [G; 5] = [__v_16, __v_10, __v_15, __v_1, __v_17]; let __mq = record.memory_queries.get_mut(&5).ok_or(ExecError::InvalidMemorySize(5))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_19: G = G::from_u64(1);
             let __v_20: G = (__v_3 + __v_19);
             let __r_arr: [G; OUT_496] = { let __args: [G; IN_496] = [__v_7, __v_18, __v_13, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[496].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[496].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[496].bump_multiplicity(__i); } let __ret: [G; OUT_496] = unsafe { *(record.function_queries[496].output_at(__i).as_ptr() as *const [G; OUT_496]) }; __ret }, _ => aiur_fn_496(__args, record, io_buffer, __cu)? } };
@@ -44228,11 +44228,11 @@ fn aiur_fn_496(
             let __v_26: G = __loaded[3];
             match __v_23.as_canonical_u64() {
               1u64 => {
-                let __v_27: G = G::from_u64(1);
                 let __r_arr: [G; OUT_332] = { let __args: [G; IN_332] = [__v_11, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[332].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[332].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[332].bump_multiplicity(__i); } let __ret: [G; OUT_332] = unsafe { *(record.function_queries[332].output_at(__i).as_ptr() as *const [G; OUT_332]) }; __ret }, _ => aiur_fn_332(__args, record, io_buffer, __cu)? } };
-                let __v_28: G = __r_arr[0];
+                let __v_27: G = __r_arr[0];
+                let __v_28: G = G::from_u64(1);
                 let __v_29: G = G::from_u64(0);
-                let __v_30: G = { let __values: [G; 4] = [__v_27, __v_28, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_30: G = { let __values: [G; 4] = [__v_28, __v_27, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_496] = [__v_30];
                 record.function_queries[496].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -44428,11 +44428,11 @@ fn aiur_fn_497(
             match __v_14.as_canonical_u64() {
               5u64 => {
                 let __r_arr: [G; OUT_506] = { let __args: [G; IN_506] = [__v_5, __v_15, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[506].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[506].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[506].bump_multiplicity(__i); } let __ret: [G; OUT_506] = unsafe { *(record.function_queries[506].output_at(__i).as_ptr() as *const [G; OUT_506]) }; __ret }, _ => aiur_fn_506(__args, record, io_buffer, __cu)? } };
-                let __v_18: G = G::from_u64(0);
+                let __v_18: G = G::from_u64(1);
                 let __v_19: G = G::from_u64(1);
-                let __v_20: G = G::from_u64(1);
-                let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_22: G = { let __values: [G; 3] = [__v_18, __v_5, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_20: G = { let __values: [G; 3] = [__v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_21: G = G::from_u64(0);
+                let __v_22: G = { let __values: [G; 3] = [__v_21, __v_5, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __r_arr: [G; OUT_497] = { let __args: [G; IN_497] = [__v_16, __v_6, __v_22, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[497].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[497].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[497].bump_multiplicity(__i); } let __ret: [G; OUT_497] = unsafe { *(record.function_queries[497].output_at(__i).as_ptr() as *const [G; OUT_497]) }; __ret }, _ => aiur_fn_497(__args, record, io_buffer, __cu)? } };
                 let __v_23: G = __r_arr[0];
                 let __ret: [G; OUT_497] = [__v_23];
@@ -44467,27 +44467,27 @@ fn aiur_fn_498(
     let __v_1: G = inp[1];
     match __v_0.as_canonical_u64() {
       0u64 => {
-        let __v_2: G = G::from_u64(2);
         let __r_arr: [G; OUT_381] = { let __args: [G; IN_381] = []; let __cu = unconstrained; let __hit = record.function_queries[381].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[381].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[381].bump_multiplicity(__i); } let __ret: [G; OUT_381] = unsafe { *(record.function_queries[381].output_at(__i).as_ptr() as *const [G; OUT_381]) }; __ret }, _ => aiur_fn_381(__args, record, io_buffer, __cu)? } };
-        let __v_3: G = __r_arr[0];
+        let __v_2: G = __r_arr[0];
+        let __v_3: G = G::from_u64(1);
         let __v_4: G = G::from_u64(1);
-        let __v_5: G = G::from_u64(1);
-        let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = G::from_u64(2);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_2, __v_3, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_2, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_498] = [__v_8];
         record.function_queries[498].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       1u64 => {
-        let __v_2: G = G::from_u64(2);
         let __r_arr: [G; OUT_218] = { let __args: [G; IN_218] = []; let __cu = unconstrained; let __hit = record.function_queries[218].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[218].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[218].bump_multiplicity(__i); } let __ret: [G; OUT_218] = unsafe { *(record.function_queries[218].output_at(__i).as_ptr() as *const [G; OUT_218]) }; __ret }, _ => aiur_fn_218(__args, record, io_buffer, __cu)? } };
-        let __v_3: G = __r_arr[0];
+        let __v_2: G = __r_arr[0];
+        let __v_3: G = G::from_u64(1);
         let __v_4: G = G::from_u64(1);
-        let __v_5: G = G::from_u64(1);
-        let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = G::from_u64(2);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_2, __v_3, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_2, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_498] = [__v_8];
         record.function_queries[498].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -44766,6 +44766,9 @@ fn aiur_fn_504(
     let __v_11: G = __loaded[3];
     match __v_8.as_canonical_u64() {
       2u64 => {
+        if (__v_9 != __v_0) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("projection's structure type differs from the value's head".to_string()) });
+        }
         let __r_arr: [G; OUT_287] = { let __args: [G; IN_287] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[287].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[287].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[287].bump_multiplicity(__i); } let __ret: [G; OUT_287] = unsafe { *(record.function_queries[287].output_at(__i).as_ptr() as *const [G; OUT_287]) }; __ret }, _ => aiur_fn_287(__args, record, io_buffer, __cu)? } };
         let __v_12: G = __r_arr[0];
         let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_12.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
@@ -44781,34 +44784,31 @@ fn aiur_fn_504(
         let __v_22: G = __loaded[9];
         let __v_23: G = __loaded[10];
         let __v_24: G = __loaded[11];
-        if (__v_9 != __v_0) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("projection's structure type differs from the value's head".to_string()) });
-        }
         match __v_13.as_canonical_u64() {
           5u64 => {
-            let __v_25: G = G::from_u64(0);
-            let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_20, __v_21, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
-            let __v_26: G = __r_arr[0];
-            let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_26.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
-            let __v_27: G = __loaded[0];
-            let __v_28: G = __loaded[1];
-            let __v_29: G = __loaded[2];
-            let __v_30: G = __loaded[3];
-            let __v_31: G = __loaded[4];
-            let __v_32: G = __loaded[5];
-            let __v_33: G = __loaded[6];
-            let __v_34: G = __loaded[7];
-            let __v_35: G = __loaded[8];
-            let __v_36: G = __loaded[9];
-            let __v_37: G = __loaded[10];
-            let __v_38: G = __loaded[11];
-            let __v_39: G = G::from_u64(1);
-            if (__v_18 != __v_39) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_18.as_canonical_u64(), rhs: __v_39.as_canonical_u64(), msg: Some("projection on an inductive with more than one constructor".to_string()) });
+            let __v_25: G = G::from_u64(1);
+            if (__v_18 != __v_25) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_18.as_canonical_u64(), rhs: __v_25.as_canonical_u64(), msg: Some("projection on an inductive with more than one constructor".to_string()) });
             }
-            match __v_27.as_canonical_u64() {
+            let __v_26: G = G::from_u64(0);
+            let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_20, __v_21, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
+            let __v_27: G = __r_arr[0];
+            let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_27.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
+            let __v_28: G = __loaded[0];
+            let __v_29: G = __loaded[1];
+            let __v_30: G = __loaded[2];
+            let __v_31: G = __loaded[3];
+            let __v_32: G = __loaded[4];
+            let __v_33: G = __loaded[5];
+            let __v_34: G = __loaded[6];
+            let __v_35: G = __loaded[7];
+            let __v_36: G = __loaded[8];
+            let __v_37: G = __loaded[9];
+            let __v_38: G = __loaded[10];
+            let __v_39: G = __loaded[11];
+            match __v_28.as_canonical_u64() {
               6u64 => {
-                let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_29, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
+                let __r_arr: [G; OUT_336] = { let __args: [G; IN_336] = [__v_30, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[336].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[336].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[336].bump_multiplicity(__i); } let __ret: [G; OUT_336] = unsafe { *(record.function_queries[336].output_at(__i).as_ptr() as *const [G; OUT_336]) }; __ret }, _ => aiur_fn_336(__args, record, io_buffer, __cu)? } };
                 let __v_40: G = __r_arr[0];
                 let __r_arr: [G; OUT_435] = { let __args: [G; IN_435] = [__v_40, __v_7, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[435].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[435].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[435].bump_multiplicity(__i); } let __ret: [G; OUT_435] = unsafe { *(record.function_queries[435].output_at(__i).as_ptr() as *const [G; OUT_435]) }; __ret }, _ => aiur_fn_435(__args, record, io_buffer, __cu)? } };
                 let __v_41: G = __r_arr[0];
@@ -44823,7 +44823,7 @@ fn aiur_fn_504(
                 return Ok(__ret);
               },
               _ => {
-                return Err(ExecError::MatchNoCase(__v_27.as_canonical_u64()));
+                return Err(ExecError::MatchNoCase(__v_28.as_canonical_u64()));
               },
             }
           },
@@ -45886,16 +45886,16 @@ fn aiur_fn_524(
 }
  };
     let __v_2: G = __mc_out___mc_0[0];
-    let __v_3: G = G::from_u64(2);
+    let __v_3: G = G::from_u64(1);
     let __v_4: G = G::from_u64(1);
-    let __v_5: G = G::from_u64(1);
-    let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = G::from_u64(2);
     let __v_7: G = G::from_u64(0);
-    let __v_8: G = { let __values: [G; 4] = [__v_3, __v_2, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_9: G = G::from_u64(7);
-    let __v_10: G = G::from_u64(0);
+    let __v_8: G = { let __values: [G; 4] = [__v_6, __v_2, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = G::from_u64(0);
+    let __v_10: G = G::from_u64(7);
     let __v_11: G = G::from_u64(0);
-    let __v_12: G = { let __values: [G; 4] = [__v_9, __v_10, __v_1, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_1, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_13: G = G::from_u64(3);
     let __v_14: G = G::from_u64(0);
     let __v_15: G = { let __values: [G; 4] = [__v_13, __v_8, __v_12, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -45929,7 +45929,7 @@ fn aiur_fn_525(
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_525] = [__v_7, __v_11];
         record.function_queries[525].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -45957,7 +45957,7 @@ fn aiur_fn_525(
                 let __v_18: G = G::from_u64(0);
                 let __v_19: G = G::from_u64(0);
                 let __v_20: G = G::from_u64(0);
-                let __v_21: G = { let __values: [G; 4] = [__v_18, __v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_21: G = { let __values: [G; 4] = [__v_19, __v_18, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_525] = [__v_17, __v_21];
                 record.function_queries[525].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -46046,7 +46046,7 @@ fn aiur_fn_526(
             let __v_15: G = G::from_u64(0);
             let __v_16: G = G::from_u64(0);
             let __v_17: G = G::from_u64(0);
-            let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_526] = [__v_14, __v_18];
             record.function_queries[526].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -46058,7 +46058,7 @@ fn aiur_fn_526(
         let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
         let __v_14: G = G::from_u64(0);
-        let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_526] = [__v_11, __v_15];
         record.function_queries[526].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46091,7 +46091,7 @@ fn aiur_fn_527(
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_527] = [__v_7, __v_11];
         record.function_queries[527].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46176,7 +46176,7 @@ fn aiur_fn_528(
         let __v_11: G = G::from_u64(0);
         let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
-        let __v_14: G = { let __values: [G; 4] = [__v_11, __v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = { let __values: [G; 4] = [__v_12, __v_11, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_528] = [__v_10, __v_14];
         record.function_queries[528].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46186,11 +46186,11 @@ fn aiur_fn_528(
         let __v_10: G = __r_arr[0];
         let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
         let __v_11: G = __r_arr[0];
-        let __v_12: G = G::from_u64(2);
         let __r_arr: [G; OUT_507] = { let __args: [G; IN_507] = []; let __cu = unconstrained; let __hit = record.function_queries[507].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[507].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[507].bump_multiplicity(__i); } let __ret: [G; OUT_507] = unsafe { *(record.function_queries[507].output_at(__i).as_ptr() as *const [G; OUT_507]) }; __ret }, _ => aiur_fn_507(__args, record, io_buffer, __cu)? } };
-        let __v_13: G = __r_arr[0];
+        let __v_12: G = __r_arr[0];
+        let __v_13: G = G::from_u64(2);
         let __v_14: G = G::from_u64(0);
-        let __v_15: G = { let __values: [G; 4] = [__v_12, __v_13, __v_0, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = { let __values: [G; 4] = [__v_13, __v_12, __v_0, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_16: G = G::from_u64(3);
         let __v_17: G = G::from_u64(0);
         let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_11, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -46249,7 +46249,7 @@ fn aiur_fn_529(
         let __v_15: G = G::from_u64(0);
         let __v_16: G = G::from_u64(0);
         let __v_17: G = G::from_u64(0);
-        let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_529] = [__v_14, __v_18];
         record.function_queries[529].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46264,7 +46264,7 @@ fn aiur_fn_529(
             let __v_17: G = G::from_u64(0);
             let __v_18: G = G::from_u64(0);
             let __v_19: G = G::from_u64(0);
-            let __v_20: G = { let __values: [G; 4] = [__v_17, __v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_20: G = { let __values: [G; 4] = [__v_18, __v_17, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_529] = [__v_16, __v_20];
             record.function_queries[529].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -46331,36 +46331,36 @@ fn aiur_fn_530(
         let __v_13: G = G::from_u64(0);
         let __v_14: G = G::from_u64(0);
         let __v_15: G = G::from_u64(0);
-        let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_16: G = { let __values: [G; 4] = [__v_14, __v_13, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_530] = [__v_12, __v_16];
         record.function_queries[530].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       _ => {
-        let __v_12: G = G::from_u64(1);
+        let __v_12: G = G::from_u64(0);
         let __v_13: G = G::from_u64(0);
-        let __v_14: G = G::from_u64(0);
-        let __v_15: G = { let __values: [G; 3] = [__v_13, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = { let __values: [G; 3] = [__v_12, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = G::from_u64(1);
         let __v_16: G = G::from_u64(0);
-        let __v_17: G = { let __values: [G; 3] = [__v_12, __v_15, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_18: G = G::from_u64(0);
+        let __v_17: G = { let __values: [G; 3] = [__v_15, __v_14, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_18: G = G::from_u64(1);
         let __v_19: G = G::from_u64(1);
-        let __v_20: G = G::from_u64(1);
-        let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_22: G = { let __values: [G; 3] = [__v_18, __v_17, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_23: G = G::from_u64(2);
+        let __v_20: G = { let __values: [G; 3] = [__v_18, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_21: G = G::from_u64(0);
+        let __v_22: G = { let __values: [G; 3] = [__v_21, __v_17, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_517] = { let __args: [G; IN_517] = []; let __cu = unconstrained; let __hit = record.function_queries[517].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[517].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[517].bump_multiplicity(__i); } let __ret: [G; OUT_517] = unsafe { *(record.function_queries[517].output_at(__i).as_ptr() as *const [G; OUT_517]) }; __ret }, _ => aiur_fn_517(__args, record, io_buffer, __cu)? } };
-        let __v_24: G = __r_arr[0];
+        let __v_23: G = __r_arr[0];
+        let __v_24: G = G::from_u64(2);
         let __v_25: G = G::from_u64(0);
-        let __v_26: G = { let __values: [G; 4] = [__v_23, __v_24, __v_22, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_27: G = G::from_u64(2);
+        let __v_26: G = { let __values: [G; 4] = [__v_24, __v_23, __v_22, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_516] = { let __args: [G; IN_516] = []; let __cu = unconstrained; let __hit = record.function_queries[516].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[516].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[516].bump_multiplicity(__i); } let __ret: [G; OUT_516] = unsafe { *(record.function_queries[516].output_at(__i).as_ptr() as *const [G; OUT_516]) }; __ret }, _ => aiur_fn_516(__args, record, io_buffer, __cu)? } };
-        let __v_28: G = __r_arr[0];
+        let __v_27: G = __r_arr[0];
+        let __v_28: G = G::from_u64(1);
         let __v_29: G = G::from_u64(1);
-        let __v_30: G = G::from_u64(1);
-        let __v_31: G = { let __values: [G; 3] = [__v_29, __v_30, __v_30]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_30: G = { let __values: [G; 3] = [__v_28, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_31: G = G::from_u64(2);
         let __v_32: G = G::from_u64(0);
-        let __v_33: G = { let __values: [G; 4] = [__v_27, __v_28, __v_31, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_33: G = { let __values: [G; 4] = [__v_31, __v_27, __v_30, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_2.as_canonical_u64() {
   1u64 => {
     let __r_arr: [G; OUT_176] = { let __args: [G; IN_176] = []; let __cu = unconstrained; let __hit = record.function_queries[176].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[176].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[176].bump_multiplicity(__i); } let __ret: [G; OUT_176] = unsafe { *(record.function_queries[176].output_at(__i).as_ptr() as *const [G; OUT_176]) }; __ret }, _ => aiur_fn_176(__args, record, io_buffer, __cu)? } };
@@ -46375,12 +46375,12 @@ fn aiur_fn_530(
 }
  };
         let __v_34: G = __mc_out___mc_0[0];
-        let __v_35: G = G::from_u64(2);
+        let __v_35: G = G::from_u64(1);
         let __v_36: G = G::from_u64(1);
-        let __v_37: G = G::from_u64(1);
-        let __v_38: G = { let __values: [G; 3] = [__v_36, __v_37, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_37: G = { let __values: [G; 3] = [__v_35, __v_36, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_38: G = G::from_u64(2);
         let __v_39: G = G::from_u64(0);
-        let __v_40: G = { let __values: [G; 4] = [__v_35, __v_34, __v_38, __v_39]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_40: G = { let __values: [G; 4] = [__v_38, __v_34, __v_37, __v_39]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_41: G = G::from_u64(3);
         let __v_42: G = G::from_u64(0);
         let __v_43: G = { let __values: [G; 4] = [__v_41, __v_26, __v_33, __v_42]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -46419,12 +46419,12 @@ fn aiur_fn_530(
 }
  };
         let __v_47: G = __mc_out___mc_1[0];
-        let __v_48: G = G::from_u64(2);
+        let __v_48: G = G::from_u64(1);
         let __v_49: G = G::from_u64(1);
-        let __v_50: G = G::from_u64(1);
-        let __v_51: G = { let __values: [G; 3] = [__v_49, __v_50, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_50: G = { let __values: [G; 3] = [__v_48, __v_49, __v_49]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_51: G = G::from_u64(2);
         let __v_52: G = G::from_u64(0);
-        let __v_53: G = { let __values: [G; 4] = [__v_48, __v_47, __v_51, __v_52]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_53: G = { let __values: [G; 4] = [__v_51, __v_47, __v_50, __v_52]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_54: G = G::from_u64(3);
         let __v_55: G = G::from_u64(0);
         let __v_56: G = { let __values: [G; 4] = [__v_54, __v_53, __v_3, __v_55]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -46468,7 +46468,7 @@ fn aiur_fn_531(
         let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_7, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_531] = [__v_6, __v_10];
         record.function_queries[531].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46506,7 +46506,7 @@ fn aiur_fn_531(
                             let __v_20: G = G::from_u64(0);
                             let __v_21: G = G::from_u64(0);
                             let __v_22: G = G::from_u64(0);
-                            let __v_23: G = { let __values: [G; 4] = [__v_20, __v_21, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_23: G = { let __values: [G; 4] = [__v_21, __v_20, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_531] = [__v_19, __v_23];
                             record.function_queries[531].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
@@ -46526,7 +46526,7 @@ fn aiur_fn_531(
                         let __v_19: G = G::from_u64(0);
                         let __v_20: G = G::from_u64(0);
                         let __v_21: G = G::from_u64(0);
-                        let __v_22: G = { let __values: [G; 4] = [__v_19, __v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_22: G = { let __values: [G; 4] = [__v_20, __v_19, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_531] = [__v_18, __v_22];
                         record.function_queries[531].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -46538,7 +46538,7 @@ fn aiur_fn_531(
                     let __v_19: G = G::from_u64(0);
                     let __v_20: G = G::from_u64(0);
                     let __v_21: G = G::from_u64(0);
-                    let __v_22: G = { let __values: [G; 4] = [__v_19, __v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_22: G = { let __values: [G; 4] = [__v_20, __v_19, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_531] = [__v_18, __v_22];
                     record.function_queries[531].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -46550,7 +46550,7 @@ fn aiur_fn_531(
                 let __v_15: G = G::from_u64(0);
                 let __v_16: G = G::from_u64(0);
                 let __v_17: G = G::from_u64(0);
-                let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_531] = [__v_14, __v_18];
                 record.function_queries[531].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -46562,7 +46562,7 @@ fn aiur_fn_531(
             let __v_15: G = G::from_u64(0);
             let __v_16: G = G::from_u64(0);
             let __v_17: G = G::from_u64(0);
-            let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_531] = [__v_14, __v_18];
             record.function_queries[531].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -46587,46 +46587,46 @@ fn aiur_fn_532(
     let __v_1: G = inp[1];
     let __v_2: G = inp[2];
     let __v_3: G = inp[3];
-    let __v_4: G = G::from_u64(1);
+    let __v_4: G = G::from_u64(0);
     let __v_5: G = G::from_u64(0);
-    let __v_6: G = G::from_u64(0);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(1);
     let __v_8: G = G::from_u64(0);
-    let __v_9: G = { let __values: [G; 3] = [__v_4, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_10: G = G::from_u64(0);
+    let __v_9: G = { let __values: [G; 3] = [__v_7, __v_6, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_10: G = G::from_u64(1);
     let __v_11: G = G::from_u64(1);
-    let __v_12: G = G::from_u64(1);
-    let __v_13: G = { let __values: [G; 3] = [__v_11, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_14: G = { let __values: [G; 3] = [__v_10, __v_9, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_15: G = G::from_u64(2);
+    let __v_12: G = { let __values: [G; 3] = [__v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_13: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 3] = [__v_13, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_517] = { let __args: [G; IN_517] = []; let __cu = unconstrained; let __hit = record.function_queries[517].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[517].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[517].bump_multiplicity(__i); } let __ret: [G; OUT_517] = unsafe { *(record.function_queries[517].output_at(__i).as_ptr() as *const [G; OUT_517]) }; __ret }, _ => aiur_fn_517(__args, record, io_buffer, __cu)? } };
-    let __v_16: G = __r_arr[0];
+    let __v_15: G = __r_arr[0];
+    let __v_16: G = G::from_u64(2);
     let __v_17: G = G::from_u64(0);
-    let __v_18: G = { let __values: [G; 4] = [__v_15, __v_16, __v_14, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_19: G = G::from_u64(2);
+    let __v_18: G = { let __values: [G; 4] = [__v_16, __v_15, __v_14, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_218] = { let __args: [G; IN_218] = []; let __cu = unconstrained; let __hit = record.function_queries[218].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[218].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[218].bump_multiplicity(__i); } let __ret: [G; OUT_218] = unsafe { *(record.function_queries[218].output_at(__i).as_ptr() as *const [G; OUT_218]) }; __ret }, _ => aiur_fn_218(__args, record, io_buffer, __cu)? } };
-    let __v_20: G = __r_arr[0];
+    let __v_19: G = __r_arr[0];
+    let __v_20: G = G::from_u64(1);
     let __v_21: G = G::from_u64(1);
-    let __v_22: G = G::from_u64(1);
-    let __v_23: G = { let __values: [G; 3] = [__v_21, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_22: G = { let __values: [G; 3] = [__v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_23: G = G::from_u64(2);
     let __v_24: G = G::from_u64(0);
-    let __v_25: G = { let __values: [G; 4] = [__v_19, __v_20, __v_23, __v_24]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_26: G = G::from_u64(7);
-    let __v_27: G = G::from_u64(1);
+    let __v_25: G = { let __values: [G; 4] = [__v_23, __v_19, __v_22, __v_24]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_26: G = G::from_u64(1);
+    let __v_27: G = G::from_u64(7);
     let __v_28: G = G::from_u64(0);
-    let __v_29: G = { let __values: [G; 4] = [__v_26, __v_27, __v_0, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = { let __values: [G; 4] = [__v_27, __v_26, __v_0, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_30: G = G::from_u64(3);
     let __v_31: G = G::from_u64(0);
     let __v_32: G = { let __values: [G; 4] = [__v_30, __v_18, __v_25, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_33: G = G::from_u64(3);
     let __v_34: G = G::from_u64(0);
     let __v_35: G = { let __values: [G; 4] = [__v_33, __v_32, __v_29, __v_34]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_36: G = G::from_u64(2);
+    let __v_36: G = G::from_u64(1);
     let __v_37: G = G::from_u64(1);
-    let __v_38: G = G::from_u64(1);
-    let __v_39: G = { let __values: [G; 3] = [__v_37, __v_38, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_38: G = { let __values: [G; 3] = [__v_36, __v_37, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_39: G = G::from_u64(2);
     let __v_40: G = G::from_u64(0);
-    let __v_41: G = { let __values: [G; 4] = [__v_36, __v_1, __v_39, __v_40]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_41: G = { let __values: [G; 4] = [__v_39, __v_1, __v_38, __v_40]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_42: G = G::from_u64(2);
     let __r_arr: [G; OUT_781] = { let __args: [G; IN_781] = [__v_2, __v_42]; let __cu = unconstrained; let __hit = record.function_queries[781].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[781].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[781].bump_multiplicity(__i); } let __ret: [G; OUT_781] = unsafe { *(record.function_queries[781].output_at(__i).as_ptr() as *const [G; OUT_781]) }; __ret }, _ => aiur_fn_781(__args, record, io_buffer, __cu)? } };
     let __v_43: G = __r_arr[0];
@@ -46649,7 +46649,7 @@ fn aiur_fn_532(
         let __v_53: G = G::from_u64(0);
         let __v_54: G = G::from_u64(0);
         let __v_55: G = G::from_u64(0);
-        let __v_56: G = { let __values: [G; 4] = [__v_53, __v_54, __v_55, __v_55]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_56: G = { let __values: [G; 4] = [__v_54, __v_53, __v_55, __v_55]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_532] = [__v_52, __v_56];
         record.function_queries[532].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46658,14 +46658,14 @@ fn aiur_fn_532(
         let __v_52: G = G::from_u64(0);
         let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_48, __v_52]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
         let __v_53: G = __r_arr[0];
-        let __v_54: G = G::from_u64(2);
         let __r_arr: [G; OUT_510] = { let __args: [G; IN_510] = []; let __cu = unconstrained; let __hit = record.function_queries[510].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[510].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[510].bump_multiplicity(__i); } let __ret: [G; OUT_510] = unsafe { *(record.function_queries[510].output_at(__i).as_ptr() as *const [G; OUT_510]) }; __ret }, _ => aiur_fn_510(__args, record, io_buffer, __cu)? } };
-        let __v_55: G = __r_arr[0];
+        let __v_54: G = __r_arr[0];
+        let __v_55: G = G::from_u64(1);
         let __v_56: G = G::from_u64(1);
-        let __v_57: G = G::from_u64(1);
-        let __v_58: G = { let __values: [G; 3] = [__v_56, __v_57, __v_57]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_58: G = G::from_u64(2);
         let __v_59: G = G::from_u64(0);
-        let __v_60: G = { let __values: [G; 4] = [__v_54, __v_55, __v_58, __v_59]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_60: G = { let __values: [G; 4] = [__v_58, __v_54, __v_57, __v_59]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_61: G = G::from_u64(3);
         let __v_62: G = G::from_u64(0);
         let __v_63: G = { let __values: [G; 4] = [__v_61, __v_60, __v_53, __v_62]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -46741,7 +46741,7 @@ fn aiur_fn_533(
         let __v_21: G = G::from_u64(0);
         let __v_22: G = G::from_u64(0);
         let __v_23: G = G::from_u64(0);
-        let __v_24: G = { let __values: [G; 4] = [__v_21, __v_22, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_24: G = { let __values: [G; 4] = [__v_22, __v_21, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_533] = [__v_20, __v_24];
         record.function_queries[533].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -46750,12 +46750,12 @@ fn aiur_fn_533(
         let __v_20: G = G::from_u64(0);
         let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_16, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
         let __v_21: G = __r_arr[0];
-        let __v_22: G = G::from_u64(2);
+        let __v_22: G = G::from_u64(1);
         let __v_23: G = G::from_u64(1);
-        let __v_24: G = G::from_u64(1);
-        let __v_25: G = { let __values: [G; 3] = [__v_23, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_24: G = { let __values: [G; 3] = [__v_22, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_25: G = G::from_u64(2);
         let __v_26: G = G::from_u64(0);
-        let __v_27: G = { let __values: [G; 4] = [__v_22, __v_6, __v_25, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_27: G = { let __values: [G; 4] = [__v_25, __v_6, __v_24, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_28: G = G::from_u64(3);
         let __v_29: G = G::from_u64(0);
         let __v_30: G = { let __values: [G; 4] = [__v_28, __v_27, __v_21, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -48974,25 +48974,25 @@ fn aiur_fn_561(
     let __v_0: G = inp[0];
     let __v_1: G = inp[1];
     let __v_2: G = inp[2];
-    let __v_3: G = G::from_u64(4);
     let __r_arr: [G; OUT_293] = { let __args: [G; IN_293] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[293].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[293].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[293].bump_multiplicity(__i); } let __ret: [G; OUT_293] = unsafe { *(record.function_queries[293].output_at(__i).as_ptr() as *const [G; OUT_293]) }; __ret }, _ => aiur_fn_293(__args, record, io_buffer, __cu)? } };
-    let __v_4: G = __r_arr[0];
-    let __v_5: G = __r_arr[1];
-    let __v_6: G = __r_arr[2];
-    let __v_7: G = __r_arr[3];
-    let __v_8: G = __r_arr[4];
-    let __v_9: G = __r_arr[5];
-    let __v_10: G = __r_arr[6];
-    let __v_11: G = __r_arr[7];
+    let __v_3: G = __r_arr[0];
+    let __v_4: G = __r_arr[1];
+    let __v_5: G = __r_arr[2];
+    let __v_6: G = __r_arr[3];
+    let __v_7: G = __r_arr[4];
+    let __v_8: G = __r_arr[5];
+    let __v_9: G = __r_arr[6];
+    let __v_10: G = __r_arr[7];
     let __r_arr: [G; OUT_293] = { let __args: [G; IN_293] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[293].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[293].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[293].bump_multiplicity(__i); } let __ret: [G; OUT_293] = unsafe { *(record.function_queries[293].output_at(__i).as_ptr() as *const [G; OUT_293]) }; __ret }, _ => aiur_fn_293(__args, record, io_buffer, __cu)? } };
-    let __v_12: G = __r_arr[0];
-    let __v_13: G = __r_arr[1];
-    let __v_14: G = __r_arr[2];
-    let __v_15: G = __r_arr[3];
-    let __v_16: G = __r_arr[4];
-    let __v_17: G = __r_arr[5];
-    let __v_18: G = __r_arr[6];
-    let __v_19: G = __r_arr[7];
+    let __v_11: G = __r_arr[0];
+    let __v_12: G = __r_arr[1];
+    let __v_13: G = __r_arr[2];
+    let __v_14: G = __r_arr[3];
+    let __v_15: G = __r_arr[4];
+    let __v_16: G = __r_arr[5];
+    let __v_17: G = __r_arr[6];
+    let __v_18: G = __r_arr[7];
+    let __v_19: G = G::from_u64(4);
     let __v_20: G = G::from_u64(0);
     let __v_21: G = G::from_u64(1);
     let __v_22: G = G::from_u64(1);
@@ -49006,7 +49006,7 @@ fn aiur_fn_561(
     let __v_30: G = G::from_u64(1);
     let __v_31: G = G::from_u64(1);
     let __v_32: G = { let __values: [G; 3] = [__v_30, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_73] = { let __args: [G; IN_73] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_0, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_23, __v_26, __v_29, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[73].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[73].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[73].bump_multiplicity(__i); } let __ret: [G; OUT_73] = unsafe { *(record.function_queries[73].output_at(__i).as_ptr() as *const [G; OUT_73]) }; __ret }, _ => aiur_fn_73(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_73] = { let __args: [G; IN_73] = [__v_19, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_0, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_20, __v_23, __v_26, __v_29, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[73].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[73].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[73].bump_multiplicity(__i); } let __ret: [G; OUT_73] = unsafe { *(record.function_queries[73].output_at(__i).as_ptr() as *const [G; OUT_73]) }; __ret }, _ => aiur_fn_73(__args, record, io_buffer, __cu)? } };
     let __v_33: G = __r_arr[0];
     let __r_arr: [G; OUT_22] = { let __args: [G; IN_22] = [__v_33]; let __cu = unconstrained; let __hit = record.function_queries[22].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[22].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[22].bump_multiplicity(__i); } let __ret: [G; OUT_22] = unsafe { *(record.function_queries[22].output_at(__i).as_ptr() as *const [G; OUT_22]) }; __ret }, _ => aiur_fn_22(__args, record, io_buffer, __cu)? } };
     let __v_34: G = __r_arr[0];
@@ -49204,12 +49204,12 @@ fn aiur_fn_566(
         let __v_11: G = G::from_u64(0);
         let __r_arr: [G; OUT_567] = { let __args: [G; IN_567] = [__v_2, __v_6, __v_10, __v_4, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[567].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[567].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[567].bump_multiplicity(__i); } let __ret: [G; OUT_567] = unsafe { *(record.function_queries[567].output_at(__i).as_ptr() as *const [G; OUT_567]) }; __ret }, _ => aiur_fn_567(__args, record, io_buffer, __cu)? } };
         let __v_12: G = __r_arr[0];
-        let __v_13: G = G::from_u64(0);
         let __r_arr: [G; OUT_773] = { let __args: [G; IN_773] = [__v_1, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[773].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[773].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[773].bump_multiplicity(__i); } let __ret: [G; OUT_773] = unsafe { *(record.function_queries[773].output_at(__i).as_ptr() as *const [G; OUT_773]) }; __ret }, _ => aiur_fn_773(__args, record, io_buffer, __cu)? } };
-        let __v_14: G = __r_arr[0];
+        let __v_13: G = __r_arr[0];
         let __r_arr: [G; OUT_766] = { let __args: [G; IN_766] = [__v_12, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[766].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[766].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[766].bump_multiplicity(__i); } let __ret: [G; OUT_766] = unsafe { *(record.function_queries[766].output_at(__i).as_ptr() as *const [G; OUT_766]) }; __ret }, _ => aiur_fn_766(__args, record, io_buffer, __cu)? } };
-        let __v_15: G = __r_arr[0];
-        let __v_16: G = { let __values: [G; 4] = [__v_13, __v_14, __v_3, __v_15]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = __r_arr[0];
+        let __v_15: G = G::from_u64(0);
+        let __v_16: G = { let __values: [G; 4] = [__v_15, __v_13, __v_3, __v_14]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_17: G = { let __a_val = __v_9.as_canonical_u64(); let __b_val = __v_10.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
         match __v_17.as_canonical_u64() {
           1u64 => {
@@ -49257,15 +49257,15 @@ fn aiur_fn_567(
         return Ok(__ret);
       },
       _ => {
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_561] = { let __args: [G; IN_561] = [__v_0, __v_1, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[561].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[561].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[561].bump_multiplicity(__i); } let __ret: [G; OUT_561] = unsafe { *(record.function_queries[561].output_at(__i).as_ptr() as *const [G; OUT_561]) }; __ret }, _ => aiur_fn_561(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = (__v_3 + __v_4);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_4 + __v_9);
-        let __r_arr: [G; OUT_567] = { let __args: [G; IN_567] = [__v_0, __v_1, __v_2, __v_3, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[567].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[567].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[567].bump_multiplicity(__i); } let __ret: [G; OUT_567] = unsafe { *(record.function_queries[567].output_at(__i).as_ptr() as *const [G; OUT_567]) }; __ret }, _ => aiur_fn_567(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 4] = [__v_6, __v_7, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = (__v_3 + __v_4);
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_4 + __v_8);
+        let __r_arr: [G; OUT_567] = { let __args: [G; IN_567] = [__v_0, __v_1, __v_2, __v_3, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[567].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[567].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[567].bump_multiplicity(__i); } let __ret: [G; OUT_567] = unsafe { *(record.function_queries[567].output_at(__i).as_ptr() as *const [G; OUT_567]) }; __ret }, _ => aiur_fn_567(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 4] = [__v_11, __v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_567] = [__v_12];
         record.function_queries[567].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -49287,11 +49287,11 @@ fn aiur_fn_568(
     let __v_0: G = inp[0];
     let __v_1: G = inp[1];
     let __v_2: G = inp[2];
-    let __v_3: G = G::from_u64(0);
+    let __v_3: G = G::from_u64(1);
     let __v_4: G = G::from_u64(1);
-    let __v_5: G = G::from_u64(1);
-    let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_7: G = { let __values: [G; 3] = [__v_3, __v_0, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_5: G = { let __values: [G; 3] = [__v_3, __v_4, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = G::from_u64(0);
+    let __v_7: G = { let __values: [G; 3] = [__v_6, __v_0, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_8: G = G::from_u64(1);
     let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
     let __v_9: G = __r_arr[0];
@@ -49424,11 +49424,11 @@ fn aiur_fn_571(
         return Ok(__ret);
       },
       1u64 => {
-        let __v_4: G = G::from_u64(0);
+        let __v_4: G = G::from_u64(1);
         let __v_5: G = G::from_u64(1);
-        let __v_6: G = G::from_u64(1);
-        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_8: G = { let __values: [G; 3] = [__v_4, __v_0, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_7, __v_0, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_571] = [__v_8];
         record.function_queries[571].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -49508,11 +49508,11 @@ fn aiur_fn_573(
     let __v_6: G = __loaded[2];
     match __v_4.as_canonical_u64() {
       1u64 => {
-        let __v_7: G = G::from_u64(0);
+        let __v_7: G = G::from_u64(1);
         let __v_8: G = G::from_u64(1);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_11: G = { let __values: [G; 3] = [__v_7, __v_0, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = { let __values: [G; 3] = [__v_10, __v_0, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_573] = [__v_11];
         record.function_queries[573].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -49556,10 +49556,10 @@ fn aiur_fn_573(
             return Ok(__ret);
           },
           _ => {
-            let __v_33: G = G::from_u64(0);
             let __r_arr: [G; OUT_573] = { let __args: [G; IN_573] = [__v_0, __v_6, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[573].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[573].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[573].bump_multiplicity(__i); } let __ret: [G; OUT_573] = unsafe { *(record.function_queries[573].output_at(__i).as_ptr() as *const [G; OUT_573]) }; __ret }, _ => aiur_fn_573(__args, record, io_buffer, __cu)? } };
-            let __v_34: G = __r_arr[0];
-            let __v_35: G = { let __values: [G; 3] = [__v_33, __v_5, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_33: G = __r_arr[0];
+            let __v_34: G = G::from_u64(0);
+            let __v_35: G = { let __values: [G; 3] = [__v_34, __v_5, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_573] = [__v_35];
             record.function_queries[573].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -49600,11 +49600,11 @@ fn aiur_fn_574(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_6: G = G::from_u64(0);
+        let __v_6: G = G::from_u64(1);
         let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_10: G = { let __values: [G; 3] = [__v_6, __v_4, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_9, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_575] = { let __args: [G; IN_575] = [__v_5, __v_1, __v_2, __v_4, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[575].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[575].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[575].bump_multiplicity(__i); } let __ret: [G; OUT_575] = unsafe { *(record.function_queries[575].output_at(__i).as_ptr() as *const [G; OUT_575]) }; __ret }, _ => aiur_fn_575(__args, record, io_buffer, __cu)? } };
         let __v_11: G = __r_arr[0];
         let __ret: [G; OUT_574] = [__v_11];
@@ -49639,11 +49639,11 @@ fn aiur_fn_575(
     let __v_7: G = __loaded[2];
     match __v_5.as_canonical_u64() {
       1u64 => {
-        let __v_8: G = G::from_u64(0);
+        let __v_8: G = G::from_u64(1);
         let __v_9: G = G::from_u64(1);
-        let __v_10: G = G::from_u64(1);
-        let __v_11: G = { let __values: [G; 3] = [__v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_12: G = { let __values: [G; 3] = [__v_8, __v_4, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_575] = [__v_12];
         record.function_queries[575].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -49689,15 +49689,15 @@ fn aiur_fn_575(
             return Ok(__ret);
           },
           _ => {
-            let __v_34: G = G::from_u64(0);
-            let __v_35: G = G::from_u64(0);
-            let __v_36: G = G::from_u64(1);
-            let __v_37: G = G::from_u64(1);
-            let __v_38: G = { let __values: [G; 3] = [__v_36, __v_37, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_39: G = { let __values: [G; 3] = [__v_35, __v_6, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __r_arr: [G; OUT_575] = { let __args: [G; IN_575] = [__v_7, __v_1, __v_2, __v_6, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[575].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[575].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[575].bump_multiplicity(__i); } let __ret: [G; OUT_575] = unsafe { *(record.function_queries[575].output_at(__i).as_ptr() as *const [G; OUT_575]) }; __ret }, _ => aiur_fn_575(__args, record, io_buffer, __cu)? } };
-            let __v_40: G = __r_arr[0];
-            let __v_41: G = { let __values: [G; 3] = [__v_34, __v_4, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_34: G = G::from_u64(1);
+            let __v_35: G = G::from_u64(1);
+            let __v_36: G = { let __values: [G; 3] = [__v_34, __v_35, __v_35]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_37: G = G::from_u64(0);
+            let __v_38: G = { let __values: [G; 3] = [__v_37, __v_6, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __r_arr: [G; OUT_575] = { let __args: [G; IN_575] = [__v_7, __v_1, __v_2, __v_6, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[575].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[575].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[575].bump_multiplicity(__i); } let __ret: [G; OUT_575] = unsafe { *(record.function_queries[575].output_at(__i).as_ptr() as *const [G; OUT_575]) }; __ret }, _ => aiur_fn_575(__args, record, io_buffer, __cu)? } };
+            let __v_39: G = __r_arr[0];
+            let __v_40: G = G::from_u64(0);
+            let __v_41: G = { let __values: [G; 3] = [__v_40, __v_4, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_575] = [__v_41];
             record.function_queries[575].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -50149,21 +50149,21 @@ fn aiur_fn_581(
       _ => {
         match __v_1.as_canonical_u64() {
           8u64 => {
-            let __v_49: G = G::from_u64(0);
-            let __r_arr: [G; OUT_579] = { let __args: [G; IN_579] = [__v_2, __v_49]; let __cu = unconstrained; let __hit = record.function_queries[579].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[579].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[579].bump_multiplicity(__i); } let __ret: [G; OUT_579] = unsafe { *(record.function_queries[579].output_at(__i).as_ptr() as *const [G; OUT_579]) }; __ret }, _ => aiur_fn_579(__args, record, io_buffer, __cu)? } };
+            let __v_49: G = G::from_u64(1);
+            let __r_arr: [G; OUT_580] = { let __args: [G; IN_580] = [__v_2, __v_49]; let __cu = unconstrained; let __hit = record.function_queries[580].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[580].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[580].bump_multiplicity(__i); } let __ret: [G; OUT_580] = unsafe { *(record.function_queries[580].output_at(__i).as_ptr() as *const [G; OUT_580]) }; __ret }, _ => aiur_fn_580(__args, record, io_buffer, __cu)? } };
             let __v_50: G = __r_arr[0];
-            let __v_51: G = G::from_u64(1);
+            let __v_51: G = G::from_u64(0);
             let __r_arr: [G; OUT_580] = { let __args: [G; IN_580] = [__v_2, __v_51]; let __cu = unconstrained; let __hit = record.function_queries[580].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[580].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[580].bump_multiplicity(__i); } let __ret: [G; OUT_580] = unsafe { *(record.function_queries[580].output_at(__i).as_ptr() as *const [G; OUT_580]) }; __ret }, _ => aiur_fn_580(__args, record, io_buffer, __cu)? } };
             let __v_52: G = __r_arr[0];
-            let __v_53: G = G::from_u64(0);
-            let __r_arr: [G; OUT_580] = { let __args: [G; IN_580] = [__v_2, __v_53]; let __cu = unconstrained; let __hit = record.function_queries[580].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[580].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[580].bump_multiplicity(__i); } let __ret: [G; OUT_580] = unsafe { *(record.function_queries[580].output_at(__i).as_ptr() as *const [G; OUT_580]) }; __ret }, _ => aiur_fn_580(__args, record, io_buffer, __cu)? } };
-            let __v_54: G = __r_arr[0];
-            let __v_55: G = (__v_52 * __v_54);
-            let __v_56: G = G::from_u64(0);
-            if (__v_55 != __v_56) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_55.as_canonical_u64(), rhs: __v_56.as_canonical_u64(), msg: Some("mutual block mixes a definition member with inductives".to_string()) });
+            let __v_53: G = (__v_50 * __v_52);
+            let __v_54: G = G::from_u64(0);
+            if (__v_53 != __v_54) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_53.as_canonical_u64(), rhs: __v_54.as_canonical_u64(), msg: Some("mutual block mixes a definition member with inductives".to_string()) });
             }
-            let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_50]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
+            let __v_55: G = G::from_u64(0);
+            let __r_arr: [G; OUT_579] = { let __args: [G; IN_579] = [__v_2, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[579].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[579].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[579].bump_multiplicity(__i); } let __ret: [G; OUT_579] = unsafe { *(record.function_queries[579].output_at(__i).as_ptr() as *const [G; OUT_579]) }; __ret }, _ => aiur_fn_579(__args, record, io_buffer, __cu)? } };
+            let __v_56: G = __r_arr[0];
+            let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_56]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
             let __v_57: G = __r_arr[0];
             let __v_58: G = G::from_u64(2);
             let __v_59: G = { let __a_val = __v_57.as_canonical_u64(); let __b_val = __v_58.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
@@ -50176,13 +50176,13 @@ fn aiur_fn_581(
               _ => {
                 let __r_arr: [G; OUT_295] = { let __args: [G; IN_295] = [__v_2, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[295].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[295].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[295].bump_multiplicity(__i); } let __ret: [G; OUT_295] = unsafe { *(record.function_queries[295].output_at(__i).as_ptr() as *const [G; OUT_295]) }; __ret }, _ => aiur_fn_295(__args, record, io_buffer, __cu)? } };
                 let __v_60: G = __r_arr[0];
-                let __v_61: G = G::from_u64(0);
+                let __v_61: G = G::from_u64(1);
                 let __v_62: G = G::from_u64(1);
-                let __v_63: G = G::from_u64(1);
-                let __v_64: G = { let __values: [G; 3] = [__v_62, __v_63, __v_63]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_65: G = { let __values: [G; 3] = [__v_61, __v_50, __v_64]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_63: G = { let __values: [G; 3] = [__v_61, __v_62, __v_62]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_64: G = G::from_u64(0);
+                let __v_65: G = { let __values: [G; 3] = [__v_64, __v_56, __v_63]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_66: G = G::from_u64(1);
-                let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_50]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
+                let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_56]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
                 let __v_67: G = __r_arr[0];
                 let __v_68: G = (__v_66 + __v_67);
                 let __r_arr: [G; OUT_569] = { let __args: [G; IN_569] = [__v_65, __v_60, __v_0, __v_68]; let __cu = unconstrained; let __hit = record.function_queries[569].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[569].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[569].bump_multiplicity(__i); } let __ret: [G; OUT_569] = unsafe { *(record.function_queries[569].output_at(__i).as_ptr() as *const [G; OUT_569]) }; __ret }, _ => aiur_fn_569(__args, record, io_buffer, __cu)? } };
@@ -50195,7 +50195,7 @@ fn aiur_fn_581(
                 }
                 let __r_arr: [G; OUT_577] = { let __args: [G; IN_577] = [__v_69]; let __cu = unconstrained; let __hit = record.function_queries[577].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[577].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[577].bump_multiplicity(__i); } let __ret: [G; OUT_577] = unsafe { *(record.function_queries[577].output_at(__i).as_ptr() as *const [G; OUT_577]) }; __ret }, _ => aiur_fn_577(__args, record, io_buffer, __cu)? } };
                 let __v_72: G = __r_arr[0];
-                let __r_arr: [G; OUT_339] = { let __args: [G; IN_339] = [__v_72, __v_50]; let __cu = unconstrained; let __hit = record.function_queries[339].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[339].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[339].bump_multiplicity(__i); } let __ret: [G; OUT_339] = unsafe { *(record.function_queries[339].output_at(__i).as_ptr() as *const [G; OUT_339]) }; __ret }, _ => aiur_fn_339(__args, record, io_buffer, __cu)? } };
+                let __r_arr: [G; OUT_339] = { let __args: [G; IN_339] = [__v_72, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[339].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[339].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[339].bump_multiplicity(__i); } let __ret: [G; OUT_339] = unsafe { *(record.function_queries[339].output_at(__i).as_ptr() as *const [G; OUT_339]) }; __ret }, _ => aiur_fn_339(__args, record, io_buffer, __cu)? } };
                 let __v_73: G = __r_arr[0];
                 let __v_74: G = G::from_u64(1);
                 if (__v_73 != __v_74) {
@@ -50902,7 +50902,6 @@ fn aiur_fn_592(
     break '__mc_0 [__v_7, __v_8];
   },
   2u64 => {
-    let __r_arr: [G; OUT_591] = { let __args: [G; IN_591] = []; let __cu = unconstrained; let __hit = record.function_queries[591].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[591].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[591].bump_multiplicity(__i); } let __ret: [G; OUT_591] = unsafe { *(record.function_queries[591].output_at(__i).as_ptr() as *const [G; OUT_591]) }; __ret }, _ => aiur_fn_591(__args, record, io_buffer, __cu)? } };
     let __r_arr: [G; OUT_383] = { let __args: [G; IN_383] = []; let __cu = unconstrained; let __hit = record.function_queries[383].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[383].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[383].bump_multiplicity(__i); } let __ret: [G; OUT_383] = unsafe { *(record.function_queries[383].output_at(__i).as_ptr() as *const [G; OUT_383]) }; __ret }, _ => aiur_fn_383(__args, record, io_buffer, __cu)? } };
     let __v_4: G = __r_arr[0];
     let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_0, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
@@ -50911,6 +50910,7 @@ fn aiur_fn_592(
     if (__v_5 != __v_6) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_5.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("Quot.lift declared at a non-canonical address".to_string()) });
     }
+    let __r_arr: [G; OUT_591] = { let __args: [G; IN_591] = []; let __cu = unconstrained; let __hit = record.function_queries[591].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[591].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[591].bump_multiplicity(__i); } let __ret: [G; OUT_591] = unsafe { *(record.function_queries[591].output_at(__i).as_ptr() as *const [G; OUT_591]) }; __ret }, _ => aiur_fn_591(__args, record, io_buffer, __cu)? } };
     let __v_7: G = G::from_u64(2);
     let __v_8: G = G::from_u64(6);
     break '__mc_0 [__v_7, __v_8];
@@ -51032,14 +51032,14 @@ fn aiur_fn_594(
             let __v_8: G = __loaded[2];
             match __v_6.as_canonical_u64() {
               4u64 => {
+                if (__v_7 != __v_2) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("ctor return type: universe level is not Param(i) in order".to_string()) });
+                }
                 let __v_9: G = G::from_u64(1);
                 let __v_10: G = (__v_1 - __v_9);
                 let __v_11: G = G::from_u64(1);
                 let __v_12: G = (__v_2 + __v_11);
                 let __r_arr: [G; OUT_594] = { let __args: [G; IN_594] = [__v_5, __v_10, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[594].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[594].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[594].bump_multiplicity(__i); } let __ret: [G; OUT_594] = unsafe { *(record.function_queries[594].output_at(__i).as_ptr() as *const [G; OUT_594]) }; __ret }, _ => aiur_fn_594(__args, record, io_buffer, __cu)? } };
-                if (__v_7 != __v_2) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("ctor return type: universe level is not Param(i) in order".to_string()) });
-                }
                 let __ret: [G; OUT_594] = [];
                 record.function_queries[594].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -51093,16 +51093,16 @@ fn aiur_fn_595(
             let __v_11: G = __loaded[3];
             match __v_8.as_canonical_u64() {
               0u64 => {
-                let __v_12: G = G::from_u64(1);
-                let __v_13: G = (__v_3 + __v_12);
-                let __r_arr: [G; OUT_595] = { let __args: [G; IN_595] = [__v_7, __v_1, __v_2, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[595].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[595].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[595].bump_multiplicity(__i); } let __ret: [G; OUT_595] = unsafe { *(record.function_queries[595].output_at(__i).as_ptr() as *const [G; OUT_595]) }; __ret }, _ => aiur_fn_595(__args, record, io_buffer, __cu)? } };
-                let __v_14: G = (__v_2 + __v_1);
-                let __v_15: G = G::from_u64(1);
-                let __v_16: G = (__v_14 - __v_15);
-                let __v_17: G = (__v_16 - __v_3);
-                if (__v_9 != __v_17) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_17.as_canonical_u64(), msg: Some("ctor return type: param arg is not the expected param BVar".to_string()) });
+                let __v_12: G = (__v_2 + __v_1);
+                let __v_13: G = G::from_u64(1);
+                let __v_14: G = (__v_12 - __v_13);
+                let __v_15: G = (__v_14 - __v_3);
+                if (__v_9 != __v_15) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("ctor return type: param arg is not the expected param BVar".to_string()) });
                 }
+                let __v_16: G = G::from_u64(1);
+                let __v_17: G = (__v_3 + __v_16);
+                let __r_arr: [G; OUT_595] = { let __args: [G; IN_595] = [__v_7, __v_1, __v_2, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[595].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[595].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[595].bump_multiplicity(__i); } let __ret: [G; OUT_595] = unsafe { *(record.function_queries[595].output_at(__i).as_ptr() as *const [G; OUT_595]) }; __ret }, _ => aiur_fn_595(__args, record, io_buffer, __cu)? } };
                 let __ret: [G; OUT_595] = [];
                 record.function_queries[595].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -51204,22 +51204,22 @@ fn aiur_fn_597(
         let __r_arr: [G; OUT_596] = { let __args: [G; IN_596] = [__v_12, __v_5, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[596].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[596].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[596].bump_multiplicity(__i); } let __ret: [G; OUT_596] = unsafe { *(record.function_queries[596].output_at(__i).as_ptr() as *const [G; OUT_596]) }; __ret }, _ => aiur_fn_596(__args, record, io_buffer, __cu)? } };
         let __v_15: G = G::from_u64(0);
         let __r_arr: [G; OUT_594] = { let __args: [G; IN_594] = [__v_13, __v_4, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[594].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[594].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[594].bump_multiplicity(__i); } let __ret: [G; OUT_594] = unsafe { *(record.function_queries[594].output_at(__i).as_ptr() as *const [G; OUT_594]) }; __ret }, _ => aiur_fn_594(__args, record, io_buffer, __cu)? } };
-        let __v_16: G = G::from_u64(0);
-        let __r_arr: [G; OUT_595] = { let __args: [G; IN_595] = [__v_10, __v_1, __v_3, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[595].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[595].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[595].bump_multiplicity(__i); } let __ret: [G; OUT_595] = unsafe { *(record.function_queries[595].output_at(__i).as_ptr() as *const [G; OUT_595]) }; __ret }, _ => aiur_fn_595(__args, record, io_buffer, __cu)? } };
-        let __r_arr: [G; OUT_782] = { let __args: [G; IN_782] = [__v_10, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[782].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[782].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[782].bump_multiplicity(__i); } let __ret: [G; OUT_782] = unsafe { *(record.function_queries[782].output_at(__i).as_ptr() as *const [G; OUT_782]) }; __ret }, _ => aiur_fn_782(__args, record, io_buffer, __cu)? } };
-        let __v_17: G = __r_arr[0];
-        let __v_18: G = G::from_u64(0);
-        let __v_19: G = G::from_u64(1);
-        let __v_20: G = G::from_u64(1);
-        let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_22: G = { let __values: [G; 3] = [__v_18, __v_5, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
-        let __v_23: G = __r_arr[0];
-        let __v_24: G = (__v_1 + __v_2);
-        if (__v_23 != __v_24) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: Some("ctor return type: wrong number of spine arguments".to_string()) });
+        let __v_16: G = __r_arr[0];
+        let __v_17: G = (__v_1 + __v_2);
+        if (__v_16 != __v_17) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_16.as_canonical_u64(), rhs: __v_17.as_canonical_u64(), msg: Some("ctor return type: wrong number of spine arguments".to_string()) });
         }
-        let __r_arr: [G; OUT_608] = { let __args: [G; IN_608] = [__v_17, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[608].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[608].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[608].bump_multiplicity(__i); } let __ret: [G; OUT_608] = unsafe { *(record.function_queries[608].output_at(__i).as_ptr() as *const [G; OUT_608]) }; __ret }, _ => aiur_fn_608(__args, record, io_buffer, __cu)? } };
+        let __v_18: G = G::from_u64(0);
+        let __r_arr: [G; OUT_595] = { let __args: [G; IN_595] = [__v_10, __v_1, __v_3, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[595].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[595].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[595].bump_multiplicity(__i); } let __ret: [G; OUT_595] = unsafe { *(record.function_queries[595].output_at(__i).as_ptr() as *const [G; OUT_595]) }; __ret }, _ => aiur_fn_595(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_782] = { let __args: [G; IN_782] = [__v_10, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[782].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[782].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[782].bump_multiplicity(__i); } let __ret: [G; OUT_782] = unsafe { *(record.function_queries[782].output_at(__i).as_ptr() as *const [G; OUT_782]) }; __ret }, _ => aiur_fn_782(__args, record, io_buffer, __cu)? } };
+        let __v_19: G = __r_arr[0];
+        let __v_20: G = G::from_u64(1);
+        let __v_21: G = G::from_u64(1);
+        let __v_22: G = { let __values: [G; 3] = [__v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_23: G = G::from_u64(0);
+        let __v_24: G = { let __values: [G; 3] = [__v_23, __v_5, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_608] = { let __args: [G; IN_608] = [__v_19, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[608].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[608].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[608].bump_multiplicity(__i); } let __ret: [G; OUT_608] = unsafe { *(record.function_queries[608].output_at(__i).as_ptr() as *const [G; OUT_608]) }; __ret }, _ => aiur_fn_608(__args, record, io_buffer, __cu)? } };
         let __v_25: G = __r_arr[0];
         let __v_26: G = G::from_u64(0);
         if (__v_25 != __v_26) {
@@ -51273,15 +51273,15 @@ fn aiur_fn_598(
               5u64 => {
                 let __r_arr: [G; OUT_438] = { let __args: [G; IN_438] = [__v_5, __v_9, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[438].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[438].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[438].bump_multiplicity(__i); } let __ret: [G; OUT_438] = unsafe { *(record.function_queries[438].output_at(__i).as_ptr() as *const [G; OUT_438]) }; __ret }, _ => aiur_fn_438(__args, record, io_buffer, __cu)? } };
                 let __v_12: G = __r_arr[0];
-                let __v_13: G = G::from_u64(0);
-                let __v_14: G = { let __values: [G; 3] = [__v_13, __v_5, __v_3]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_15: G = G::from_u64(1);
-                if (__v_12 != __v_15) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_12.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("ctor parameter type disagrees with the inductive's".to_string()) });
+                let __v_13: G = G::from_u64(1);
+                if (__v_12 != __v_13) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_12.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("ctor parameter type disagrees with the inductive's".to_string()) });
                 }
+                let __v_14: G = G::from_u64(0);
+                let __v_15: G = { let __values: [G; 3] = [__v_14, __v_5, __v_3]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __v_16: G = G::from_u64(1);
                 let __v_17: G = (__v_2 - __v_16);
-                let __r_arr: [G; OUT_598] = { let __args: [G; IN_598] = [__v_6, __v_10, __v_17, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[598].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[598].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[598].bump_multiplicity(__i); } let __ret: [G; OUT_598] = unsafe { *(record.function_queries[598].output_at(__i).as_ptr() as *const [G; OUT_598]) }; __ret }, _ => aiur_fn_598(__args, record, io_buffer, __cu)? } };
+                let __r_arr: [G; OUT_598] = { let __args: [G; IN_598] = [__v_6, __v_10, __v_17, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[598].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[598].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[598].bump_multiplicity(__i); } let __ret: [G; OUT_598] = unsafe { *(record.function_queries[598].output_at(__i).as_ptr() as *const [G; OUT_598]) }; __ret }, _ => aiur_fn_598(__args, record, io_buffer, __cu)? } };
                 let __ret: [G; OUT_598] = [];
                 record.function_queries[598].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -51963,14 +51963,14 @@ fn aiur_fn_611(
       5u64 => {
         let __v_18: G = G::from_u64(0);
         let __r_arr: [G; OUT_594] = { let __args: [G; IN_594] = [__v_1, __v_7, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[594].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[594].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[594].bump_multiplicity(__i); } let __ret: [G; OUT_594] = unsafe { *(record.function_queries[594].output_at(__i).as_ptr() as *const [G; OUT_594]) }; __ret }, _ => aiur_fn_594(__args, record, io_buffer, __cu)? } };
-        let __v_19: G = G::from_u64(0);
-        let __r_arr: [G; OUT_610] = { let __args: [G; IN_610] = [__v_2, __v_9, __v_4, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[610].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[610].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[610].bump_multiplicity(__i); } let __ret: [G; OUT_610] = unsafe { *(record.function_queries[610].output_at(__i).as_ptr() as *const [G; OUT_610]) }; __ret }, _ => aiur_fn_610(__args, record, io_buffer, __cu)? } };
         let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
-        let __v_20: G = __r_arr[0];
-        let __v_21: G = (__v_9 + __v_10);
-        if (__v_20 != __v_21) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: Some("recursive occurrence is not fully applied".to_string()) });
+        let __v_19: G = __r_arr[0];
+        let __v_20: G = (__v_9 + __v_10);
+        if (__v_19 != __v_20) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("recursive occurrence is not fully applied".to_string()) });
         }
+        let __v_21: G = G::from_u64(0);
+        let __r_arr: [G; OUT_610] = { let __args: [G; IN_610] = [__v_2, __v_9, __v_4, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[610].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[610].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[610].bump_multiplicity(__i); } let __ret: [G; OUT_610] = unsafe { *(record.function_queries[610].output_at(__i).as_ptr() as *const [G; OUT_610]) }; __ret }, _ => aiur_fn_610(__args, record, io_buffer, __cu)? } };
         let __r_arr: [G; OUT_782] = { let __args: [G; IN_782] = [__v_2, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[782].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[782].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[782].bump_multiplicity(__i); } let __ret: [G; OUT_782] = unsafe { *(record.function_queries[782].output_at(__i).as_ptr() as *const [G; OUT_782]) }; __ret }, _ => aiur_fn_782(__args, record, io_buffer, __cu)? } };
         let __v_22: G = __r_arr[0];
         let __r_arr: [G; OUT_608] = { let __args: [G; IN_608] = [__v_22, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[608].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[608].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[608].bump_multiplicity(__i); } let __ret: [G; OUT_608] = unsafe { *(record.function_queries[608].output_at(__i).as_ptr() as *const [G; OUT_608]) }; __ret }, _ => aiur_fn_608(__args, record, io_buffer, __cu)? } };
@@ -52022,15 +52022,15 @@ fn aiur_fn_612(
         let __v_9: G = __loaded[3];
         match __v_6.as_canonical_u64() {
           5u64 => {
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = { let __values: [G; 3] = [__v_10, __v_7, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __r_arr: [G; OUT_607] = { let __args: [G; IN_607] = [__v_7, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[607].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[607].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[607].bump_multiplicity(__i); } let __ret: [G; OUT_607] = unsafe { *(record.function_queries[607].output_at(__i).as_ptr() as *const [G; OUT_607]) }; __ret }, _ => aiur_fn_607(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
-            let __v_13: G = G::from_u64(0);
-            if (__v_12 != __v_13) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_12.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("strict positivity: block occurs left of an arrow".to_string()) });
+            let __v_10: G = __r_arr[0];
+            let __v_11: G = G::from_u64(0);
+            if (__v_10 != __v_11) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_10.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("strict positivity: block occurs left of an arrow".to_string()) });
             }
-            let __r_arr: [G; OUT_612] = { let __args: [G; IN_612] = [__v_8, __v_1, __v_11, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[612].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[612].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[612].bump_multiplicity(__i); } let __ret: [G; OUT_612] = unsafe { *(record.function_queries[612].output_at(__i).as_ptr() as *const [G; OUT_612]) }; __ret }, _ => aiur_fn_612(__args, record, io_buffer, __cu)? } };
+            let __v_12: G = G::from_u64(0);
+            let __v_13: G = { let __values: [G; 3] = [__v_12, __v_7, __v_2]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __r_arr: [G; OUT_612] = { let __args: [G; IN_612] = [__v_8, __v_1, __v_13, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[612].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[612].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[612].bump_multiplicity(__i); } let __ret: [G; OUT_612] = unsafe { *(record.function_queries[612].output_at(__i).as_ptr() as *const [G; OUT_612]) }; __ret }, _ => aiur_fn_612(__args, record, io_buffer, __cu)? } };
             let __ret: [G; OUT_612] = [];
             record.function_queries[612].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -52086,20 +52086,20 @@ fn aiur_fn_612(
                       5u64 => {
                         let __r_arr: [G; OUT_782] = { let __args: [G; IN_782] = [__v_11, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[782].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[782].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[782].bump_multiplicity(__i); } let __ret: [G; OUT_782] = unsafe { *(record.function_queries[782].output_at(__i).as_ptr() as *const [G; OUT_782]) }; __ret }, _ => aiur_fn_782(__args, record, io_buffer, __cu)? } };
                         let __v_30: G = __r_arr[0];
-                        let __v_31: G = G::from_u64(0);
-                        let __v_32: G = { let __values: [G; 3] = [__v_31, __v_25, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_781] = { let __args: [G; IN_781] = [__v_11, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[781].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[781].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[781].bump_multiplicity(__i); } let __ret: [G; OUT_781] = unsafe { *(record.function_queries[781].output_at(__i).as_ptr() as *const [G; OUT_781]) }; __ret }, _ => aiur_fn_781(__args, record, io_buffer, __cu)? } };
-                        let __v_33: G = __r_arr[0];
-                        let __r_arr: [G; OUT_769] = { let __args: [G; IN_769] = [__v_33]; let __cu = unconstrained; let __hit = record.function_queries[769].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[769].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[769].bump_multiplicity(__i); } let __ret: [G; OUT_769] = unsafe { *(record.function_queries[769].output_at(__i).as_ptr() as *const [G; OUT_769]) }; __ret }, _ => aiur_fn_769(__args, record, io_buffer, __cu)? } };
-                        let __v_34: G = __r_arr[0];
                         let __r_arr: [G; OUT_608] = { let __args: [G; IN_608] = [__v_30, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[608].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[608].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[608].bump_multiplicity(__i); } let __ret: [G; OUT_608] = unsafe { *(record.function_queries[608].output_at(__i).as_ptr() as *const [G; OUT_608]) }; __ret }, _ => aiur_fn_608(__args, record, io_buffer, __cu)? } };
-                        let __v_35: G = __r_arr[0];
-                        let __v_36: G = G::from_u64(0);
-                        if (__v_35 != __v_36) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_35.as_canonical_u64(), rhs: __v_36.as_canonical_u64(), msg: Some("strict positivity: block occurs in a nested inductive's index args".to_string()) });
+                        let __v_31: G = __r_arr[0];
+                        let __v_32: G = G::from_u64(0);
+                        if (__v_31 != __v_32) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_31.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("strict positivity: block occurs in a nested inductive's index args".to_string()) });
                         }
+                        let __v_33: G = G::from_u64(0);
+                        let __v_34: G = { let __values: [G; 3] = [__v_33, __v_25, __v_1]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_781] = { let __args: [G; IN_781] = [__v_11, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[781].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[781].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[781].bump_multiplicity(__i); } let __ret: [G; OUT_781] = unsafe { *(record.function_queries[781].output_at(__i).as_ptr() as *const [G; OUT_781]) }; __ret }, _ => aiur_fn_781(__args, record, io_buffer, __cu)? } };
+                        let __v_35: G = __r_arr[0];
+                        let __r_arr: [G; OUT_769] = { let __args: [G; IN_769] = [__v_35]; let __cu = unconstrained; let __hit = record.function_queries[769].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[769].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[769].bump_multiplicity(__i); } let __ret: [G; OUT_769] = unsafe { *(record.function_queries[769].output_at(__i).as_ptr() as *const [G; OUT_769]) }; __ret }, _ => aiur_fn_769(__args, record, io_buffer, __cu)? } };
+                        let __v_36: G = __r_arr[0];
                         let __v_37: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_613] = { let __args: [G; IN_613] = [__v_25, __v_26, __v_23, __v_32, __v_37, __v_21, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[613].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[613].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[613].bump_multiplicity(__i); } let __ret: [G; OUT_613] = unsafe { *(record.function_queries[613].output_at(__i).as_ptr() as *const [G; OUT_613]) }; __ret }, _ => aiur_fn_613(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_613] = { let __args: [G; IN_613] = [__v_25, __v_26, __v_23, __v_34, __v_37, __v_21, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[613].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[613].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[613].bump_multiplicity(__i); } let __ret: [G; OUT_613] = unsafe { *(record.function_queries[613].output_at(__i).as_ptr() as *const [G; OUT_613]) }; __ret }, _ => aiur_fn_613(__args, record, io_buffer, __cu)? } };
                         let __ret: [G; OUT_612] = [];
                         record.function_queries[612].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -52246,11 +52246,11 @@ fn aiur_fn_615(
     let __v_1: G = inp[1];
     let __v_2: G = inp[2];
     let __v_3: G = inp[3];
-    let __v_4: G = G::from_u64(0);
+    let __v_4: G = G::from_u64(1);
     let __v_5: G = G::from_u64(1);
-    let __v_6: G = G::from_u64(1);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_8: G = { let __values: [G; 3] = [__v_4, __v_2, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_6: G = { let __values: [G; 3] = [__v_4, __v_5, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(0);
+    let __v_8: G = { let __values: [G; 3] = [__v_7, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_609] = { let __args: [G; IN_609] = [__v_0, __v_1, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[609].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[609].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[609].bump_multiplicity(__i); } let __ret: [G; OUT_609] = unsafe { *(record.function_queries[609].output_at(__i).as_ptr() as *const [G; OUT_609]) }; __ret }, _ => aiur_fn_609(__args, record, io_buffer, __cu)? } };
     let __v_9: G = __r_arr[0];
     let __v_10: G = __r_arr[1];
@@ -52339,22 +52339,6 @@ fn aiur_fn_617(
         let __v_23: G = __loaded[11];
         match __v_12.as_canonical_u64() {
           6u64 => {
-            let __r_arr: [G; OUT_599] = { let __args: [G; IN_599] = [__v_0, __v_14, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[599].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[599].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[599].bump_multiplicity(__i); } let __ret: [G; OUT_599] = unsafe { *(record.function_queries[599].output_at(__i).as_ptr() as *const [G; OUT_599]) }; __ret }, _ => aiur_fn_599(__args, record, io_buffer, __cu)? } };
-            let __r_arr: [G; OUT_597] = { let __args: [G; IN_597] = [__v_14, __v_18, __v_2, __v_19, __v_4, __v_5, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[597].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[597].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[597].bump_multiplicity(__i); } let __ret: [G; OUT_597] = unsafe { *(record.function_queries[597].output_at(__i).as_ptr() as *const [G; OUT_597]) }; __ret }, _ => aiur_fn_597(__args, record, io_buffer, __cu)? } };
-            let __r_arr: [G; OUT_603] = { let __args: [G; IN_603] = [__v_14, __v_18, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[603].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[603].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[603].bump_multiplicity(__i); } let __ret: [G; OUT_603] = unsafe { *(record.function_queries[603].output_at(__i).as_ptr() as *const [G; OUT_603]) }; __ret }, _ => aiur_fn_603(__args, record, io_buffer, __cu)? } };
-            let __mc_out___mc_0: [G; 0] = '__mc_0: { match __v_8.as_canonical_u64() {
-  0u64 => {
-    let __v_24: G = G::from_u64(1);
-    let __v_25: G = G::from_u64(1);
-    let __v_26: G = { let __values: [G; 3] = [__v_24, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_615] = { let __args: [G; IN_615] = [__v_14, __v_18, __v_5, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[615].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[615].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[615].bump_multiplicity(__i); } let __ret: [G; OUT_615] = unsafe { *(record.function_queries[615].output_at(__i).as_ptr() as *const [G; OUT_615]) }; __ret }, _ => aiur_fn_615(__args, record, io_buffer, __cu)? } };
-    break '__mc_0 [];
-  },
-  _ => {
-    break '__mc_0 [];
-  },
-}
- };
             let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_15, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
             let __v_24: G = __r_arr[0];
             let __v_25: G = G::from_u64(1);
@@ -52370,6 +52354,22 @@ fn aiur_fn_617(
             if (__v_18 != __v_1) {
               return Err(ExecError::AssertEqMismatch { lhs: __v_18.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("ctor parameter count differs from the inductive's".to_string()) });
             }
+            let __r_arr: [G; OUT_599] = { let __args: [G; IN_599] = [__v_0, __v_14, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[599].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[599].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[599].bump_multiplicity(__i); } let __ret: [G; OUT_599] = unsafe { *(record.function_queries[599].output_at(__i).as_ptr() as *const [G; OUT_599]) }; __ret }, _ => aiur_fn_599(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_597] = { let __args: [G; IN_597] = [__v_14, __v_18, __v_2, __v_19, __v_4, __v_5, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[597].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[597].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[597].bump_multiplicity(__i); } let __ret: [G; OUT_597] = unsafe { *(record.function_queries[597].output_at(__i).as_ptr() as *const [G; OUT_597]) }; __ret }, _ => aiur_fn_597(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_603] = { let __args: [G; IN_603] = [__v_14, __v_18, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[603].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[603].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[603].bump_multiplicity(__i); } let __ret: [G; OUT_603] = unsafe { *(record.function_queries[603].output_at(__i).as_ptr() as *const [G; OUT_603]) }; __ret }, _ => aiur_fn_603(__args, record, io_buffer, __cu)? } };
+            let __mc_out___mc_0: [G; 0] = '__mc_0: { match __v_8.as_canonical_u64() {
+  0u64 => {
+    let __v_26: G = G::from_u64(1);
+    let __v_27: G = G::from_u64(1);
+    let __v_28: G = { let __values: [G; 3] = [__v_26, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_615] = { let __args: [G; IN_615] = [__v_14, __v_18, __v_5, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[615].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[615].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[615].bump_multiplicity(__i); } let __ret: [G; OUT_615] = unsafe { *(record.function_queries[615].output_at(__i).as_ptr() as *const [G; OUT_615]) }; __ret }, _ => aiur_fn_615(__args, record, io_buffer, __cu)? } };
+    break '__mc_0 [];
+  },
+  _ => {
+    break '__mc_0 [];
+  },
+}
+ };
             let __v_26: G = G::from_u64(1);
             let __v_27: G = (__v_9 + __v_26);
             let __r_arr: [G; OUT_617] = { let __args: [G; IN_617] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[617].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[617].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[617].bump_multiplicity(__i); } let __ret: [G; OUT_617] = unsafe { *(record.function_queries[617].output_at(__i).as_ptr() as *const [G; OUT_617]) }; __ret }, _ => aiur_fn_617(__args, record, io_buffer, __cu)? } };
@@ -52640,6 +52640,9 @@ fn aiur_fn_620(
                 let __v_68: G = __loaded[11];
                 match __v_57.as_canonical_u64() {
                   5u64 => {
+                    if (__v_60 != __v_2) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_60.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("mutual block peers disagree on parameter count".to_string()) });
+                    }
                     let __r_arr: [G; OUT_599] = { let __args: [G; IN_599] = [__v_1, __v_59, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[599].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[599].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[599].bump_multiplicity(__i); } let __ret: [G; OUT_599] = unsafe { *(record.function_queries[599].output_at(__i).as_ptr() as *const [G; OUT_599]) }; __ret }, _ => aiur_fn_599(__args, record, io_buffer, __cu)? } };
                     let __v_69: G = (__v_2 + __v_3);
                     let __v_70: G = G::from_u64(1);
@@ -52653,9 +52656,6 @@ fn aiur_fn_620(
                     let __v_77: G = { let __values: [G; 3] = [__v_75, __v_76, __v_76]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __r_arr: [G; OUT_600] = { let __args: [G; IN_600] = [__v_59, __v_74, __v_77]; let __cu = unconstrained; let __hit = record.function_queries[600].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[600].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[600].bump_multiplicity(__i); } let __ret: [G; OUT_600] = unsafe { *(record.function_queries[600].output_at(__i).as_ptr() as *const [G; OUT_600]) }; __ret }, _ => aiur_fn_600(__args, record, io_buffer, __cu)? } };
                     let __v_78: G = __r_arr[0];
-                    if (__v_60 != __v_2) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_60.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("mutual block peers disagree on parameter count".to_string()) });
-                    }
                     let __r_arr: [G; OUT_324] = { let __args: [G; IN_324] = [__v_73, __v_78]; let __cu = unconstrained; let __hit = record.function_queries[324].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[324].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[324].bump_multiplicity(__i); } let __ret: [G; OUT_324] = unsafe { *(record.function_queries[324].output_at(__i).as_ptr() as *const [G; OUT_324]) }; __ret }, _ => aiur_fn_324(__args, record, io_buffer, __cu)? } };
                     let __v_79: G = __r_arr[0];
                     let __v_80: G = G::from_u64(1);
@@ -53660,12 +53660,12 @@ fn aiur_fn_633(
           return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("nested occurrence's parameter references a motive, minor, or index binder".to_string()) });
         }
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = G::from_u64(0);
-        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_3, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
-        let __v_10: G = __r_arr[0];
+        let __r_arr: [G; OUT_362] = { let __args: [G; IN_362] = [__v_3, __v_1, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[362].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[362].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[362].bump_multiplicity(__i); } let __ret: [G; OUT_362] = unsafe { *(record.function_queries[362].output_at(__i).as_ptr() as *const [G; OUT_362]) }; __ret }, _ => aiur_fn_362(__args, record, io_buffer, __cu)? } };
+        let __v_9: G = __r_arr[0];
         let __r_arr: [G; OUT_633] = { let __args: [G; IN_633] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[633].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[633].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[633].bump_multiplicity(__i); } let __ret: [G; OUT_633] = unsafe { *(record.function_queries[633].output_at(__i).as_ptr() as *const [G; OUT_633]) }; __ret }, _ => aiur_fn_633(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 3] = [__v_8, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_9, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_633] = [__v_12];
         record.function_queries[633].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -53701,16 +53701,16 @@ fn aiur_fn_634(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
+        let __v_4: G = (__v_0 + __v_2);
         let __v_5: G = G::from_u64(4);
-        let __v_6: G = (__v_0 + __v_2);
-        let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 3] = [__v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_2 + __v_9);
-        let __r_arr: [G; OUT_634] = { let __args: [G; IN_634] = [__v_0, __v_1, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[634].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[634].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[634].bump_multiplicity(__i); } let __ret: [G; OUT_634] = unsafe { *(record.function_queries[634].output_at(__i).as_ptr() as *const [G; OUT_634]) }; __ret }, _ => aiur_fn_634(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 3] = [__v_4, __v_8, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_4, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_2 + __v_8);
+        let __r_arr: [G; OUT_634] = { let __args: [G; IN_634] = [__v_0, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[634].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[634].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[634].bump_multiplicity(__i); } let __ret: [G; OUT_634] = unsafe { *(record.function_queries[634].output_at(__i).as_ptr() as *const [G; OUT_634]) }; __ret }, _ => aiur_fn_634(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_634] = [__v_12];
         record.function_queries[634].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -53813,14 +53813,14 @@ fn aiur_fn_635(
                 let __r_arr: [G; OUT_634] = { let __args: [G; IN_634] = [__v_1, __v_52, __v_63]; let __cu = unconstrained; let __hit = record.function_queries[634].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[634].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[634].bump_multiplicity(__i); } let __ret: [G; OUT_634] = unsafe { *(record.function_queries[634].output_at(__i).as_ptr() as *const [G; OUT_634]) }; __ret }, _ => aiur_fn_634(__args, record, io_buffer, __cu)? } };
                 let __v_64: G = __r_arr[0];
                 let __v_65: G = G::from_u64(0);
-                let __v_66: G = G::from_u64(0);
+                let __v_66: G = G::from_u64(1);
                 let __v_67: G = G::from_u64(1);
-                let __v_68: G = G::from_u64(1);
-                let __v_69: G = { let __values: [G; 3] = [__v_67, __v_68, __v_68]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_68: G = { let __values: [G; 3] = [__v_66, __v_67, __v_67]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_69: G = G::from_u64(1);
                 let __v_70: G = G::from_u64(1);
-                let __v_71: G = G::from_u64(1);
-                let __v_72: G = { let __values: [G; 6] = [__v_70, __v_71, __v_71, __v_71, __v_71, __v_71]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_73: G = { let __values: [G; 6] = [__v_65, __v_0, __v_66, __v_69, __v_64, __v_72]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_71: G = { let __values: [G; 6] = [__v_69, __v_70, __v_70, __v_70, __v_70, __v_70]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_72: G = G::from_u64(0);
+                let __v_73: G = { let __values: [G; 6] = [__v_72, __v_0, __v_65, __v_68, __v_64, __v_71]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_635] = [__v_73];
                 record.function_queries[635].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -53948,15 +53948,15 @@ fn aiur_fn_636(
             let __r_arr: [G; OUT_634] = { let __args: [G; IN_634] = [__v_3, __v_66, __v_67]; let __cu = unconstrained; let __hit = record.function_queries[634].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[634].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[634].bump_multiplicity(__i); } let __ret: [G; OUT_634] = unsafe { *(record.function_queries[634].output_at(__i).as_ptr() as *const [G; OUT_634]) }; __ret }, _ => aiur_fn_634(__args, record, io_buffer, __cu)? } };
             let __v_68: G = __r_arr[0];
             let __v_69: G = G::from_u64(0);
-            let __v_70: G = G::from_u64(0);
+            let __v_70: G = G::from_u64(1);
             let __v_71: G = G::from_u64(1);
-            let __v_72: G = G::from_u64(1);
-            let __v_73: G = { let __values: [G; 3] = [__v_71, __v_72, __v_72]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_74: G = G::from_u64(1);
-            let __v_75: G = (__v_4 + __v_74);
-            let __r_arr: [G; OUT_636] = { let __args: [G; IN_636] = [__v_0, __v_51, __v_2, __v_3, __v_75]; let __cu = unconstrained; let __hit = record.function_queries[636].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[636].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[636].bump_multiplicity(__i); } let __ret: [G; OUT_636] = unsafe { *(record.function_queries[636].output_at(__i).as_ptr() as *const [G; OUT_636]) }; __ret }, _ => aiur_fn_636(__args, record, io_buffer, __cu)? } };
-            let __v_76: G = __r_arr[0];
-            let __v_77: G = { let __values: [G; 6] = [__v_69, __v_52, __v_70, __v_73, __v_68, __v_76]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_72: G = { let __values: [G; 3] = [__v_70, __v_71, __v_71]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_73: G = G::from_u64(1);
+            let __v_74: G = (__v_4 + __v_73);
+            let __r_arr: [G; OUT_636] = { let __args: [G; IN_636] = [__v_0, __v_51, __v_2, __v_3, __v_74]; let __cu = unconstrained; let __hit = record.function_queries[636].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[636].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[636].bump_multiplicity(__i); } let __ret: [G; OUT_636] = unsafe { *(record.function_queries[636].output_at(__i).as_ptr() as *const [G; OUT_636]) }; __ret }, _ => aiur_fn_636(__args, record, io_buffer, __cu)? } };
+            let __v_75: G = __r_arr[0];
+            let __v_76: G = G::from_u64(0);
+            let __v_77: G = { let __values: [G; 6] = [__v_76, __v_52, __v_69, __v_72, __v_68, __v_75]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_636] = [__v_77];
             record.function_queries[636].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -54986,14 +54986,14 @@ fn aiur_fn_644(
             let __r_arr: [G; OUT_634] = { let __args: [G; IN_634] = [__v_2, __v_102, __v_113]; let __cu = unconstrained; let __hit = record.function_queries[634].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[634].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[634].bump_multiplicity(__i); } let __ret: [G; OUT_634] = unsafe { *(record.function_queries[634].output_at(__i).as_ptr() as *const [G; OUT_634]) }; __ret }, _ => aiur_fn_634(__args, record, io_buffer, __cu)? } };
             let __v_114: G = __r_arr[0];
             let __v_115: G = G::from_u64(0);
-            let __v_116: G = G::from_u64(0);
+            let __v_116: G = G::from_u64(1);
             let __v_117: G = G::from_u64(1);
-            let __v_118: G = G::from_u64(1);
-            let __v_119: G = { let __values: [G; 3] = [__v_117, __v_118, __v_118]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_118: G = { let __values: [G; 3] = [__v_116, __v_117, __v_117]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_119: G = G::from_u64(1);
             let __v_120: G = G::from_u64(1);
-            let __v_121: G = G::from_u64(1);
-            let __v_122: G = { let __values: [G; 6] = [__v_120, __v_121, __v_121, __v_121, __v_121, __v_121]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_123: G = { let __values: [G; 6] = [__v_115, __v_51, __v_116, __v_119, __v_114, __v_122]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_121: G = { let __values: [G; 6] = [__v_119, __v_120, __v_120, __v_120, __v_120, __v_120]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_122: G = G::from_u64(0);
+            let __v_123: G = { let __values: [G; 6] = [__v_122, __v_51, __v_115, __v_118, __v_114, __v_121]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             break '__mc_1 [__v_123];
           },
           _ => {
@@ -55577,12 +55577,12 @@ fn aiur_fn_650(
     let __v_3: G = inp[3];
     match __v_2.as_canonical_u64() {
       0u64 => {
-        let __v_4: G = G::from_u64(0);
-        let __v_5: G = G::from_u64(1);
-        let __v_6: G = (__v_1 - __v_5);
-        let __v_7: G = (__v_6 - __v_0);
+        let __v_4: G = G::from_u64(1);
+        let __v_5: G = (__v_1 - __v_4);
+        let __v_6: G = (__v_5 - __v_0);
+        let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_4, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_650] = [__v_9];
         record.function_queries[650].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -55600,12 +55600,12 @@ fn aiur_fn_650(
             return Ok(__ret);
           },
           _ => {
-            let __v_6: G = G::from_u64(0);
-            let __v_7: G = G::from_u64(1);
-            let __v_8: G = (__v_1 - __v_7);
-            let __v_9: G = (__v_8 - __v_0);
+            let __v_6: G = G::from_u64(1);
+            let __v_7: G = (__v_1 - __v_6);
+            let __v_8: G = (__v_7 - __v_0);
+            let __v_9: G = G::from_u64(0);
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = { let __values: [G; 4] = [__v_6, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_650] = [__v_11];
             record.function_queries[650].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -55699,12 +55699,12 @@ fn aiur_fn_652(
         let __v_5: G = __loaded[3];
         match __v_2.as_canonical_u64() {
           5u64 => {
-            let __v_6: G = G::from_u64(0);
-            let __v_7: G = G::from_u64(1);
-            let __v_8: G = (__v_1 - __v_7);
-            let __r_arr: [G; OUT_652] = { let __args: [G; IN_652] = [__v_4, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[652].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[652].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[652].bump_multiplicity(__i); } let __ret: [G; OUT_652] = unsafe { *(record.function_queries[652].output_at(__i).as_ptr() as *const [G; OUT_652]) }; __ret }, _ => aiur_fn_652(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
-            let __v_10: G = { let __values: [G; 3] = [__v_6, __v_3, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_6: G = G::from_u64(1);
+            let __v_7: G = (__v_1 - __v_6);
+            let __r_arr: [G; OUT_652] = { let __args: [G; IN_652] = [__v_4, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[652].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[652].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[652].bump_multiplicity(__i); } let __ret: [G; OUT_652] = unsafe { *(record.function_queries[652].output_at(__i).as_ptr() as *const [G; OUT_652]) }; __ret }, _ => aiur_fn_652(__args, record, io_buffer, __cu)? } };
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 3] = [__v_9, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_652] = [__v_10];
             record.function_queries[652].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -55722,12 +55722,12 @@ fn aiur_fn_652(
             let __v_13: G = __loaded[3];
             match __v_10.as_canonical_u64() {
               5u64 => {
-                let __v_14: G = G::from_u64(0);
-                let __v_15: G = G::from_u64(1);
-                let __v_16: G = (__v_1 - __v_15);
-                let __r_arr: [G; OUT_652] = { let __args: [G; IN_652] = [__v_12, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[652].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[652].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[652].bump_multiplicity(__i); } let __ret: [G; OUT_652] = unsafe { *(record.function_queries[652].output_at(__i).as_ptr() as *const [G; OUT_652]) }; __ret }, _ => aiur_fn_652(__args, record, io_buffer, __cu)? } };
-                let __v_17: G = __r_arr[0];
-                let __v_18: G = { let __values: [G; 3] = [__v_14, __v_11, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_14: G = G::from_u64(1);
+                let __v_15: G = (__v_1 - __v_14);
+                let __r_arr: [G; OUT_652] = { let __args: [G; IN_652] = [__v_12, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[652].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[652].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[652].bump_multiplicity(__i); } let __ret: [G; OUT_652] = unsafe { *(record.function_queries[652].output_at(__i).as_ptr() as *const [G; OUT_652]) }; __ret }, _ => aiur_fn_652(__args, record, io_buffer, __cu)? } };
+                let __v_16: G = __r_arr[0];
+                let __v_17: G = G::from_u64(0);
+                let __v_18: G = { let __values: [G; 3] = [__v_17, __v_11, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_652] = [__v_18];
                 record.function_queries[652].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -55770,13 +55770,13 @@ fn aiur_fn_653(
         return Ok(__ret);
       },
       _ => {
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = G::from_u64(1);
-        let __v_7: G = (__v_1 - __v_6);
-        let __v_8: G = (__v_7 - __v_3);
-        let __v_9: G = (__v_8 + __v_2);
+        let __v_5: G = G::from_u64(1);
+        let __v_6: G = (__v_1 - __v_5);
+        let __v_7: G = (__v_6 - __v_3);
+        let __v_8: G = (__v_7 + __v_2);
+        let __v_9: G = G::from_u64(0);
         let __v_10: G = G::from_u64(0);
-        let __v_11: G = { let __values: [G; 4] = [__v_5, __v_9, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 4] = [__v_9, __v_8, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_12: G = G::from_u64(3);
         let __v_13: G = G::from_u64(0);
         let __v_14: G = { let __values: [G; 4] = [__v_12, __v_0, __v_11, __v_13]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -55891,12 +55891,12 @@ fn aiur_fn_656(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
-        let __v_5: G = G::from_u64(1);
-        let __v_6: G = (__v_1 - __v_5);
-        let __v_7: G = (__v_6 - __v_2);
+        let __v_4: G = G::from_u64(1);
+        let __v_5: G = (__v_1 - __v_4);
+        let __v_6: G = (__v_5 - __v_2);
+        let __v_7: G = G::from_u64(0);
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = { let __values: [G; 4] = [__v_4, __v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = { let __values: [G; 4] = [__v_7, __v_6, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_10: G = G::from_u64(3);
         let __v_11: G = G::from_u64(0);
         let __v_12: G = { let __values: [G; 4] = [__v_10, __v_0, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -55935,11 +55935,11 @@ fn aiur_fn_657(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(5);
         let __r_arr: [G; OUT_657] = { let __args: [G; IN_657] = [__v_0, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[657].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[657].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[657].bump_multiplicity(__i); } let __ret: [G; OUT_657] = unsafe { *(record.function_queries[657].output_at(__i).as_ptr() as *const [G; OUT_657]) }; __ret }, _ => aiur_fn_657(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(5);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_3, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_3, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_657] = [__v_8];
         record.function_queries[657].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -56058,14 +56058,14 @@ fn aiur_fn_659(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = (__v_2 + __v_8);
-        let __r_arr: [G; OUT_659] = { let __args: [G; IN_659] = [__v_5, __v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[659].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[659].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[659].bump_multiplicity(__i); } let __ret: [G; OUT_659] = unsafe { *(record.function_queries[659].output_at(__i).as_ptr() as *const [G; OUT_659]) }; __ret }, _ => aiur_fn_659(__args, record, io_buffer, __cu)? } };
-        let __v_10: G = __r_arr[0];
-        let __v_11: G = { let __values: [G; 3] = [__v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(1);
+        let __v_8: G = (__v_2 + __v_7);
+        let __r_arr: [G; OUT_659] = { let __args: [G; IN_659] = [__v_5, __v_1, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[659].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[659].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[659].bump_multiplicity(__i); } let __ret: [G; OUT_659] = unsafe { *(record.function_queries[659].output_at(__i).as_ptr() as *const [G; OUT_659]) }; __ret }, _ => aiur_fn_659(__args, record, io_buffer, __cu)? } };
+        let __v_9: G = __r_arr[0];
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = { let __values: [G; 3] = [__v_10, __v_6, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_659] = [__v_11];
         record.function_queries[659].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -56134,10 +56134,10 @@ fn aiur_fn_661(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
-        let __v_5: G = (__v_1 - __v_2);
+        let __v_4: G = (__v_1 - __v_2);
+        let __v_5: G = G::from_u64(0);
         let __v_6: G = G::from_u64(0);
-        let __v_7: G = { let __values: [G; 4] = [__v_4, __v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 4] = [__v_5, __v_4, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_8: G = G::from_u64(3);
         let __v_9: G = G::from_u64(0);
         let __v_10: G = { let __values: [G; 4] = [__v_8, __v_0, __v_7, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -56258,10 +56258,10 @@ fn aiur_fn_664(
         return Ok(__ret);
       },
       _ => {
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = (__v_2 - __v_3);
+        let __v_5: G = (__v_2 - __v_3);
+        let __v_6: G = G::from_u64(0);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_5, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_9: G = G::from_u64(3);
         let __v_10: G = G::from_u64(0);
         let __v_11: G = { let __values: [G; 4] = [__v_9, __v_0, __v_8, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -56300,11 +56300,11 @@ fn aiur_fn_665(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(4);
         let __r_arr: [G; OUT_665] = { let __args: [G; IN_665] = [__v_0, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[665].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[665].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[665].bump_multiplicity(__i); } let __ret: [G; OUT_665] = unsafe { *(record.function_queries[665].output_at(__i).as_ptr() as *const [G; OUT_665]) }; __ret }, _ => aiur_fn_665(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(4);
         let __v_7: G = G::from_u64(0);
-        let __v_8: G = { let __values: [G; 4] = [__v_5, __v_3, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_3, __v_5, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_665] = [__v_8];
         record.function_queries[665].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -56485,13 +56485,13 @@ fn aiur_fn_667(
         let __v_66: G = G::from_u64(0);
         let __r_arr: [G; OUT_661] = { let __args: [G; IN_661] = [__v_65, __v_5, __v_66]; let __cu = unconstrained; let __hit = record.function_queries[661].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[661].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[661].bump_multiplicity(__i); } let __ret: [G; OUT_661] = unsafe { *(record.function_queries[661].output_at(__i).as_ptr() as *const [G; OUT_661]) }; __ret }, _ => aiur_fn_661(__args, record, io_buffer, __cu)? } };
         let __v_67: G = __r_arr[0];
-        let __v_68: G = G::from_u64(3);
+        let __v_68: G = G::from_u64(0);
         let __v_69: G = G::from_u64(0);
         let __v_70: G = G::from_u64(0);
-        let __v_71: G = G::from_u64(0);
-        let __v_72: G = { let __values: [G; 4] = [__v_69, __v_70, __v_71, __v_71]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_71: G = { let __values: [G; 4] = [__v_69, __v_68, __v_70, __v_70]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_72: G = G::from_u64(3);
         let __v_73: G = G::from_u64(0);
-        let __v_74: G = { let __values: [G; 4] = [__v_68, __v_67, __v_72, __v_73]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_74: G = { let __values: [G; 4] = [__v_72, __v_67, __v_71, __v_73]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_75: G = G::from_u64(5);
         let __v_76: G = G::from_u64(0);
         let __v_77: G = { let __values: [G; 4] = [__v_75, __v_56, __v_74, __v_76]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -56579,15 +56579,15 @@ fn aiur_fn_668(
     let __v_26: G = G::from_u64(0);
     let __v_27: G = G::from_u64(0);
     let __v_28: G = G::from_u64(0);
-    let __v_29: G = G::from_u64(1);
-    let __v_30: G = G::from_u64(0);
-    let __v_31: G = G::from_u64(0);
-    let __v_32: G = { let __values: [G; 3] = [__v_30, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_33: G = G::from_u64(0);
-    let __v_34: G = { let __values: [G; 4] = [__v_29, __v_32, __v_33, __v_33]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = G::from_u64(0);
+    let __v_30: G = { let __values: [G; 3] = [__v_28, __v_29, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_31: G = G::from_u64(1);
+    let __v_32: G = G::from_u64(0);
+    let __v_33: G = { let __values: [G; 4] = [__v_31, __v_30, __v_32, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_34: G = G::from_u64(0);
     let __v_35: G = G::from_u64(0);
     let __v_36: G = G::from_u64(0);
-    break '__mc_0 [__v_26, __v_27, __v_28, __v_34, __v_35, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36];
+    break '__mc_0 [__v_26, __v_35, __v_27, __v_33, __v_34, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36, __v_36];
   },
 }
  };
@@ -56616,10 +56616,10 @@ fn aiur_fn_668(
             let __v_45: G = __r_arr[0];
             let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_45.as_canonical_u64() {
   1u64 => {
-    let __v_46: G = G::from_u64(4);
-    let __v_47: G = G::from_u64(0);
+    let __v_46: G = G::from_u64(0);
+    let __v_47: G = G::from_u64(4);
     let __v_48: G = G::from_u64(0);
-    let __v_49: G = { let __values: [G; 3] = [__v_46, __v_47, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_49: G = { let __values: [G; 3] = [__v_47, __v_46, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     break '__mc_1 [__v_49];
   },
   _ => {
@@ -56744,35 +56744,35 @@ fn aiur_fn_669(
     let __v_21: G = __r_arr[3];
     let __r_arr: [G; OUT_666] = { let __args: [G; IN_666] = [__v_13, __v_14, __v_5, __v_15, __v_16, __v_17, __v_0, __v_10, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[666].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[666].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[666].bump_multiplicity(__i); } let __ret: [G; OUT_666] = unsafe { *(record.function_queries[666].output_at(__i).as_ptr() as *const [G; OUT_666]) }; __ret }, _ => aiur_fn_666(__args, record, io_buffer, __cu)? } };
     let __v_22: G = __r_arr[0];
+    let __v_23: G = G::from_u64(1);
+    let __v_24: G = G::from_u64(1);
+    let __v_25: G = { let __values: [G; 3] = [__v_23, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_438] = { let __args: [G; IN_438] = [__v_12, __v_22, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[438].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[438].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[438].bump_multiplicity(__i); } let __ret: [G; OUT_438] = unsafe { *(record.function_queries[438].output_at(__i).as_ptr() as *const [G; OUT_438]) }; __ret }, _ => aiur_fn_438(__args, record, io_buffer, __cu)? } };
+    let __v_26: G = __r_arr[0];
+    let __v_27: G = G::from_u64(1);
+    if (__v_26 != __v_27) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("recursor's declared type is not def-eq to the canonical reconstruction".to_string()) });
+    }
     let __r_arr: [G; OUT_785] = { let __args: [G; IN_785] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[785].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[785].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[785].bump_multiplicity(__i); } let __ret: [G; OUT_785] = unsafe { *(record.function_queries[785].output_at(__i).as_ptr() as *const [G; OUT_785]) }; __ret }, _ => aiur_fn_785(__args, record, io_buffer, __cu)? } };
-    let __v_23: G = __r_arr[0];
-    let __r_arr: [G; OUT_681] = { let __args: [G; IN_681] = [__v_0, __v_10, __v_5, __v_23, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[681].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[681].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[681].bump_multiplicity(__i); } let __ret: [G; OUT_681] = unsafe { *(record.function_queries[681].output_at(__i).as_ptr() as *const [G; OUT_681]) }; __ret }, _ => aiur_fn_681(__args, record, io_buffer, __cu)? } };
-    let __v_24: G = __r_arr[0];
-    let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_24]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
-    let __v_25: G = __r_arr[0];
-    let __v_26: G = G::from_u64(0);
-    let __r_arr: [G; OUT_670] = { let __args: [G; IN_670] = [__v_0, __v_1, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[670].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[670].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[670].bump_multiplicity(__i); } let __ret: [G; OUT_670] = unsafe { *(record.function_queries[670].output_at(__i).as_ptr() as *const [G; OUT_670]) }; __ret }, _ => aiur_fn_670(__args, record, io_buffer, __cu)? } };
-    let __v_27: G = __r_arr[0];
-    let __v_28: G = G::from_u64(0);
-    let __r_arr: [G; OUT_671] = { let __args: [G; IN_671] = [__v_2, __v_27, __v_3, __v_4, __v_5, __v_6, __v_7, __v_21, __v_8, __v_0, __v_9, __v_10, __v_19, __v_20, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[671].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[671].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[671].bump_multiplicity(__i); } let __ret: [G; OUT_671] = unsafe { *(record.function_queries[671].output_at(__i).as_ptr() as *const [G; OUT_671]) }; __ret }, _ => aiur_fn_671(__args, record, io_buffer, __cu)? } };
+    let __v_28: G = __r_arr[0];
+    let __r_arr: [G; OUT_681] = { let __args: [G; IN_681] = [__v_0, __v_10, __v_5, __v_28, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[681].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[681].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[681].bump_multiplicity(__i); } let __ret: [G; OUT_681] = unsafe { *(record.function_queries[681].output_at(__i).as_ptr() as *const [G; OUT_681]) }; __ret }, _ => aiur_fn_681(__args, record, io_buffer, __cu)? } };
     let __v_29: G = __r_arr[0];
-    let __v_30: G = G::from_u64(1);
-    let __v_31: G = G::from_u64(1);
-    let __v_32: G = { let __values: [G; 3] = [__v_30, __v_31, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_438] = { let __args: [G; IN_438] = [__v_12, __v_22, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[438].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[438].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[438].bump_multiplicity(__i); } let __ret: [G; OUT_438] = unsafe { *(record.function_queries[438].output_at(__i).as_ptr() as *const [G; OUT_438]) }; __ret }, _ => aiur_fn_438(__args, record, io_buffer, __cu)? } };
-    let __v_33: G = __r_arr[0];
-    let __v_34: G = G::from_u64(1);
-    if (__v_33 != __v_34) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_33.as_canonical_u64(), rhs: __v_34.as_canonical_u64(), msg: Some("recursor's declared type is not def-eq to the canonical reconstruction".to_string()) });
-    }
-    if (__v_6 != __v_23) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("recursor motive count disagrees with the canonical reconstruction".to_string()) });
+    let __r_arr: [G; OUT_771] = { let __args: [G; IN_771] = [__v_29]; let __cu = unconstrained; let __hit = record.function_queries[771].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[771].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[771].bump_multiplicity(__i); } let __ret: [G; OUT_771] = unsafe { *(record.function_queries[771].output_at(__i).as_ptr() as *const [G; OUT_771]) }; __ret }, _ => aiur_fn_771(__args, record, io_buffer, __cu)? } };
+    let __v_30: G = __r_arr[0];
+    if (__v_6 != __v_28) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("recursor motive count disagrees with the canonical reconstruction".to_string()) });
     }
-    if (__v_7 != __v_25) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_25.as_canonical_u64(), msg: Some("recursor minor count disagrees with the canonical reconstruction".to_string()) });
+    if (__v_7 != __v_30) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("recursor minor count disagrees with the canonical reconstruction".to_string()) });
     }
+    let __v_31: G = G::from_u64(0);
+    let __r_arr: [G; OUT_670] = { let __args: [G; IN_670] = [__v_0, __v_1, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[670].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[670].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[670].bump_multiplicity(__i); } let __ret: [G; OUT_670] = unsafe { *(record.function_queries[670].output_at(__i).as_ptr() as *const [G; OUT_670]) }; __ret }, _ => aiur_fn_670(__args, record, io_buffer, __cu)? } };
+    let __v_32: G = __r_arr[0];
+    let __v_33: G = G::from_u64(0);
+    let __r_arr: [G; OUT_671] = { let __args: [G; IN_671] = [__v_2, __v_32, __v_3, __v_4, __v_5, __v_6, __v_7, __v_21, __v_8, __v_0, __v_9, __v_10, __v_19, __v_20, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[671].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[671].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[671].bump_multiplicity(__i); } let __ret: [G; OUT_671] = unsafe { *(record.function_queries[671].output_at(__i).as_ptr() as *const [G; OUT_671]) }; __ret }, _ => aiur_fn_671(__args, record, io_buffer, __cu)? } };
+    let __v_34: G = __r_arr[0];
     let __v_35: G = G::from_u64(0);
-    let __r_arr: [G; OUT_672] = { let __args: [G; IN_672] = [__v_11, __v_29, __v_5, __v_6, __v_7, __v_3, __v_4, __v_2, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[672].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[672].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[672].bump_multiplicity(__i); } let __ret: [G; OUT_672] = unsafe { *(record.function_queries[672].output_at(__i).as_ptr() as *const [G; OUT_672]) }; __ret }, _ => aiur_fn_672(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_672] = { let __args: [G; IN_672] = [__v_11, __v_34, __v_5, __v_6, __v_7, __v_3, __v_4, __v_2, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[672].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[672].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[672].bump_multiplicity(__i); } let __ret: [G; OUT_672] = unsafe { *(record.function_queries[672].output_at(__i).as_ptr() as *const [G; OUT_672]) }; __ret }, _ => aiur_fn_672(__args, record, io_buffer, __cu)? } };
     let __ret: [G; OUT_669] = [];
     record.function_queries[669].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -56916,12 +56916,12 @@ fn aiur_fn_671(
             let __v_29: G = (__v_1 + __v_14);
             let __r_arr: [G; OUT_674] = { let __args: [G; IN_674] = [__v_19, __v_29, __v_4, __v_5, __v_6, __v_23, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[674].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[674].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[674].bump_multiplicity(__i); } let __ret: [G; OUT_674] = unsafe { *(record.function_queries[674].output_at(__i).as_ptr() as *const [G; OUT_674]) }; __ret }, _ => aiur_fn_674(__args, record, io_buffer, __cu)? } };
             let __v_30: G = __r_arr[0];
-            let __v_31: G = G::from_u64(0);
-            let __v_32: G = G::from_u64(1);
-            let __v_33: G = (__v_14 + __v_32);
-            let __r_arr: [G; OUT_671] = { let __args: [G; IN_671] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[671].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[671].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[671].bump_multiplicity(__i); } let __ret: [G; OUT_671] = unsafe { *(record.function_queries[671].output_at(__i).as_ptr() as *const [G; OUT_671]) }; __ret }, _ => aiur_fn_671(__args, record, io_buffer, __cu)? } };
-            let __v_34: G = __r_arr[0];
-            let __v_35: G = { let __values: [G; 3] = [__v_31, __v_30, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_31: G = G::from_u64(1);
+            let __v_32: G = (__v_14 + __v_31);
+            let __r_arr: [G; OUT_671] = { let __args: [G; IN_671] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[671].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[671].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[671].bump_multiplicity(__i); } let __ret: [G; OUT_671] = unsafe { *(record.function_queries[671].output_at(__i).as_ptr() as *const [G; OUT_671]) }; __ret }, _ => aiur_fn_671(__args, record, io_buffer, __cu)? } };
+            let __v_33: G = __r_arr[0];
+            let __v_34: G = G::from_u64(0);
+            let __v_35: G = { let __values: [G; 3] = [__v_34, __v_30, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_671] = [__v_35];
             record.function_queries[671].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -56974,41 +56974,41 @@ fn aiur_fn_672(
       0u64 => {
         match __v_10.as_canonical_u64() {
           _ => {
+            if (__v_10 != __v_8) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_10.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("recursor rule is out of ctor order".to_string()) });
+            }
+            let __v_14: G = { let __a_val = __v_10.as_canonical_u64(); let __b_val = __v_7.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+            let __v_15: G = G::from_u64(1);
+            if (__v_14 != __v_15) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_14.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("recursor rule names a ctor index out of range".to_string()) });
+            }
             let __r_arr: [G; OUT_290] = { let __args: [G; IN_290] = [__v_5, __v_6, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[290].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[290].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[290].bump_multiplicity(__i); } let __ret: [G; OUT_290] = unsafe { *(record.function_queries[290].output_at(__i).as_ptr() as *const [G; OUT_290]) }; __ret }, _ => aiur_fn_290(__args, record, io_buffer, __cu)? } };
-            let __v_14: G = __r_arr[0];
-            let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_14.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
-            let __v_15: G = __loaded[0];
-            let __v_16: G = __loaded[1];
-            let __v_17: G = __loaded[2];
-            let __v_18: G = __loaded[3];
-            let __v_19: G = __loaded[4];
-            let __v_20: G = __loaded[5];
-            let __v_21: G = __loaded[6];
-            let __v_22: G = __loaded[7];
-            let __v_23: G = __loaded[8];
-            let __v_24: G = __loaded[9];
-            let __v_25: G = __loaded[10];
-            let __v_26: G = __loaded[11];
-            let __mc_out___mc_0: [G; 0] = '__mc_0: { match __v_15.as_canonical_u64() {
+            let __v_16: G = __r_arr[0];
+            let __loaded: [G; 12] = { let __mq = record.memory_queries.get_mut(&12).ok_or(ExecError::InvalidMemorySize(12))?; let __ptr_u64 = __v_16.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 12 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 12] = __args[..12].try_into().unwrap(); __arr };
+            let __v_17: G = __loaded[0];
+            let __v_18: G = __loaded[1];
+            let __v_19: G = __loaded[2];
+            let __v_20: G = __loaded[3];
+            let __v_21: G = __loaded[4];
+            let __v_22: G = __loaded[5];
+            let __v_23: G = __loaded[6];
+            let __v_24: G = __loaded[7];
+            let __v_25: G = __loaded[8];
+            let __v_26: G = __loaded[9];
+            let __v_27: G = __loaded[10];
+            let __v_28: G = __loaded[11];
+            let __mc_out___mc_0: [G; 0] = '__mc_0: { match __v_17.as_canonical_u64() {
   6u64 => {
-    if (__v_11 != __v_22) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_22.as_canonical_u64(), msg: Some("recursor rule field count differs from the ctor's".to_string()) });
+    if (__v_11 != __v_24) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: Some("recursor rule field count differs from the ctor's".to_string()) });
     }
     break '__mc_0 [];
   },
   _ => {
-    return Err(ExecError::MatchNoCase(__v_15.as_canonical_u64()));
+    return Err(ExecError::MatchNoCase(__v_17.as_canonical_u64()));
   },
 }
  };
-            if (__v_10 != __v_8) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_10.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("recursor rule is out of ctor order".to_string()) });
-            }
-            let __v_27: G = { let __a_val = __v_10.as_canonical_u64(); let __b_val = __v_7.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-            let __v_28: G = G::from_u64(1);
-            if (__v_27 != __v_28) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_27.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("recursor rule names a ctor index out of range".to_string()) });
-            }
             let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_1.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
             let __v_29: G = __loaded[0];
             let __v_30: G = __loaded[1];
@@ -57327,10 +57327,10 @@ fn aiur_fn_675(
       0u64 => {
         let __r_arr: [G; OUT_676] = { let __args: [G; IN_676] = [__v_1, __v_4, __v_6, __v_5, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[676].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[676].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[676].bump_multiplicity(__i); } let __ret: [G; OUT_676] = unsafe { *(record.function_queries[676].output_at(__i).as_ptr() as *const [G; OUT_676]) }; __ret }, _ => aiur_fn_676(__args, record, io_buffer, __cu)? } };
         let __v_9: G = __r_arr[0];
-        let __v_10: G = G::from_u64(0);
         let __r_arr: [G; OUT_675] = { let __args: [G; IN_675] = [__v_8, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[675].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[675].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[675].bump_multiplicity(__i); } let __ret: [G; OUT_675] = unsafe { *(record.function_queries[675].output_at(__i).as_ptr() as *const [G; OUT_675]) }; __ret }, _ => aiur_fn_675(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 3] = [__v_10, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_9, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_675] = [__v_12];
         record.function_queries[675].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -57670,10 +57670,10 @@ fn aiur_fn_678(
 }
  };
         let __v_20: G = __mc_out___mc_0[0];
-        let __v_21: G = G::from_u64(0);
         let __r_arr: [G; OUT_678] = { let __args: [G; IN_678] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[678].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[678].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[678].bump_multiplicity(__i); } let __ret: [G; OUT_678] = unsafe { *(record.function_queries[678].output_at(__i).as_ptr() as *const [G; OUT_678]) }; __ret }, _ => aiur_fn_678(__args, record, io_buffer, __cu)? } };
-        let __v_22: G = __r_arr[0];
-        let __v_23: G = { let __values: [G; 3] = [__v_21, __v_20, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_21: G = __r_arr[0];
+        let __v_22: G = G::from_u64(0);
+        let __v_23: G = { let __values: [G; 3] = [__v_22, __v_20, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_678] = [__v_23];
         record.function_queries[678].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -57797,14 +57797,14 @@ fn aiur_fn_680(
             let __v_29: G = __r_arr[0];
             let __r_arr: [G; OUT_686] = { let __args: [G; IN_686] = [__v_29, __v_19, __v_23, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_13, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[686].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[686].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[686].bump_multiplicity(__i); } let __ret: [G; OUT_686] = unsafe { *(record.function_queries[686].output_at(__i).as_ptr() as *const [G; OUT_686]) }; __ret }, _ => aiur_fn_686(__args, record, io_buffer, __cu)? } };
             let __v_30: G = __r_arr[0];
-            let __v_31: G = G::from_u64(0);
-            let __v_32: G = G::from_u64(1);
-            let __v_33: G = (__v_13 + __v_32);
-            let __v_34: G = G::from_u64(1);
-            let __v_35: G = (__v_14 + __v_34);
-            let __r_arr: [G; OUT_680] = { let __args: [G; IN_680] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_33, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[680].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[680].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[680].bump_multiplicity(__i); } let __ret: [G; OUT_680] = unsafe { *(record.function_queries[680].output_at(__i).as_ptr() as *const [G; OUT_680]) }; __ret }, _ => aiur_fn_680(__args, record, io_buffer, __cu)? } };
-            let __v_36: G = __r_arr[0];
-            let __v_37: G = { let __values: [G; 3] = [__v_31, __v_30, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_31: G = G::from_u64(1);
+            let __v_32: G = (__v_13 + __v_31);
+            let __v_33: G = G::from_u64(1);
+            let __v_34: G = (__v_14 + __v_33);
+            let __r_arr: [G; OUT_680] = { let __args: [G; IN_680] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_32, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[680].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[680].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[680].bump_multiplicity(__i); } let __ret: [G; OUT_680] = unsafe { *(record.function_queries[680].output_at(__i).as_ptr() as *const [G; OUT_680]) }; __ret }, _ => aiur_fn_680(__args, record, io_buffer, __cu)? } };
+            let __v_35: G = __r_arr[0];
+            let __v_36: G = G::from_u64(0);
+            let __v_37: G = { let __values: [G; 3] = [__v_36, __v_30, __v_35]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_680] = [__v_37];
             record.function_queries[680].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -57946,12 +57946,12 @@ fn aiur_fn_683(
     let __v_4: G = inp[4];
     match __v_3.as_canonical_u64() {
       0u64 => {
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = G::from_u64(1);
-        let __v_7: G = (__v_1 - __v_6);
-        let __v_8: G = (__v_7 - __v_0);
+        let __v_5: G = G::from_u64(1);
+        let __v_6: G = (__v_1 - __v_5);
+        let __v_7: G = (__v_6 - __v_0);
+        let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_5, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_683] = [__v_10];
         record.function_queries[683].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -57972,12 +57972,12 @@ fn aiur_fn_683(
             return Ok(__ret);
           },
           _ => {
-            let __v_7: G = G::from_u64(0);
-            let __v_8: G = G::from_u64(1);
-            let __v_9: G = (__v_1 - __v_8);
-            let __v_10: G = (__v_9 - __v_0);
+            let __v_7: G = G::from_u64(1);
+            let __v_8: G = (__v_1 - __v_7);
+            let __v_9: G = (__v_8 - __v_0);
+            let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
-            let __v_12: G = { let __values: [G; 4] = [__v_7, __v_10, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = { let __values: [G; 4] = [__v_10, __v_9, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_683] = [__v_12];
             record.function_queries[683].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -58351,12 +58351,12 @@ fn aiur_fn_689(
         let __v_52: G = { let __values: [G; 4] = [__v_50, __v_44, __v_49, __v_51]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_657] = { let __args: [G; IN_657] = [__v_52, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[657].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[657].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[657].bump_multiplicity(__i); } let __ret: [G; OUT_657] = unsafe { *(record.function_queries[657].output_at(__i).as_ptr() as *const [G; OUT_657]) }; __ret }, _ => aiur_fn_657(__args, record, io_buffer, __cu)? } };
         let __v_53: G = __r_arr[0];
-        let __v_54: G = G::from_u64(0);
-        let __v_55: G = G::from_u64(1);
-        let __v_56: G = (__v_7 + __v_55);
-        let __r_arr: [G; OUT_689] = { let __args: [G; IN_689] = [__v_10, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[689].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[689].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[689].bump_multiplicity(__i); } let __ret: [G; OUT_689] = unsafe { *(record.function_queries[689].output_at(__i).as_ptr() as *const [G; OUT_689]) }; __ret }, _ => aiur_fn_689(__args, record, io_buffer, __cu)? } };
-        let __v_57: G = __r_arr[0];
-        let __v_58: G = { let __values: [G; 3] = [__v_54, __v_53, __v_57]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_54: G = G::from_u64(1);
+        let __v_55: G = (__v_7 + __v_54);
+        let __r_arr: [G; OUT_689] = { let __args: [G; IN_689] = [__v_10, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[689].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[689].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[689].bump_multiplicity(__i); } let __ret: [G; OUT_689] = unsafe { *(record.function_queries[689].output_at(__i).as_ptr() as *const [G; OUT_689]) }; __ret }, _ => aiur_fn_689(__args, record, io_buffer, __cu)? } };
+        let __v_56: G = __r_arr[0];
+        let __v_57: G = G::from_u64(0);
+        let __v_58: G = { let __values: [G; 3] = [__v_57, __v_53, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_689] = [__v_58];
         record.function_queries[689].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -58395,12 +58395,12 @@ fn aiur_fn_690(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_4, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
+        let __v_6: G = __r_arr[0];
         let __r_arr: [G; OUT_690] = { let __args: [G; IN_690] = [__v_5, __v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[690].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[690].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[690].bump_multiplicity(__i); } let __ret: [G; OUT_690] = unsafe { *(record.function_queries[690].output_at(__i).as_ptr() as *const [G; OUT_690]) }; __ret }, _ => aiur_fn_690(__args, record, io_buffer, __cu)? } };
-        let __v_8: G = __r_arr[0];
-        let __v_9: G = { let __values: [G; 3] = [__v_6, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = __r_arr[0];
+        let __v_8: G = G::from_u64(0);
+        let __v_9: G = { let __values: [G; 3] = [__v_8, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_690] = [__v_9];
         record.function_queries[690].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -58434,12 +58434,12 @@ fn aiur_fn_691(
         return Ok(__ret);
       },
       _ => {
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = G::from_u64(1);
-        let __v_7: G = (__v_2 - __v_6);
-        let __v_8: G = (__v_7 - __v_3);
+        let __v_5: G = G::from_u64(1);
+        let __v_6: G = (__v_2 - __v_5);
+        let __v_7: G = (__v_6 - __v_3);
+        let __v_8: G = G::from_u64(0);
         let __v_9: G = G::from_u64(0);
-        let __v_10: G = { let __values: [G; 4] = [__v_5, __v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_10: G = { let __values: [G; 4] = [__v_8, __v_7, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_11: G = G::from_u64(3);
         let __v_12: G = G::from_u64(0);
         let __v_13: G = { let __values: [G; 4] = [__v_11, __v_0, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -58852,12 +58852,12 @@ fn aiur_fn_698(
             let __v_24: G = G::from_u64(0);
             let __r_arr: [G; OUT_358] = { let __args: [G; IN_358] = [__v_23, __v_3, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[358].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[358].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[358].bump_multiplicity(__i); } let __ret: [G; OUT_358] = unsafe { *(record.function_queries[358].output_at(__i).as_ptr() as *const [G; OUT_358]) }; __ret }, _ => aiur_fn_358(__args, record, io_buffer, __cu)? } };
             let __v_25: G = __r_arr[0];
-            let __v_26: G = G::from_u64(0);
-            let __v_27: G = G::from_u64(1);
-            let __v_28: G = (__v_3 + __v_27);
-            let __r_arr: [G; OUT_698] = { let __args: [G; IN_698] = [__v_9, __v_1, __v_2, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[698].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[698].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[698].bump_multiplicity(__i); } let __ret: [G; OUT_698] = unsafe { *(record.function_queries[698].output_at(__i).as_ptr() as *const [G; OUT_698]) }; __ret }, _ => aiur_fn_698(__args, record, io_buffer, __cu)? } };
-            let __v_29: G = __r_arr[0];
-            let __v_30: G = { let __values: [G; 3] = [__v_26, __v_25, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_26: G = G::from_u64(1);
+            let __v_27: G = (__v_3 + __v_26);
+            let __r_arr: [G; OUT_698] = { let __args: [G; IN_698] = [__v_9, __v_1, __v_2, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[698].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[698].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[698].bump_multiplicity(__i); } let __ret: [G; OUT_698] = unsafe { *(record.function_queries[698].output_at(__i).as_ptr() as *const [G; OUT_698]) }; __ret }, _ => aiur_fn_698(__args, record, io_buffer, __cu)? } };
+            let __v_28: G = __r_arr[0];
+            let __v_29: G = G::from_u64(0);
+            let __v_30: G = { let __values: [G; 3] = [__v_29, __v_25, __v_28]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_698] = [__v_30];
             record.function_queries[698].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -58932,16 +58932,21 @@ fn aiur_fn_699(
             let __v_31: G = (__v_29 - __v_30);
             let __v_32: G = (__v_28 * __v_31);
             let __v_33: G = (__v_27 * __v_32);
-            let __v_34: G = (__v_3 + __v_5);
-            let __v_35: G = (__v_6 + __v_4);
-            let __v_36: G = (__v_34 + __v_35);
-            let __v_37: G = G::from_u64(1);
-            let __v_38: G = (__v_36 + __v_37);
-            let __r_arr: [G; OUT_593] = { let __args: [G; IN_593] = [__v_2, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[593].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[593].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[593].bump_multiplicity(__i); } let __ret: [G; OUT_593] = unsafe { *(record.function_queries[593].output_at(__i).as_ptr() as *const [G; OUT_593]) }; __ret }, _ => aiur_fn_593(__args, record, io_buffer, __cu)? } };
-            let __v_39: G = __r_arr[0];
-            let __v_40: G = (__v_5 + __v_6);
-            let __v_41: G = (__v_3 + __v_40);
-            let __r_arr: [G; OUT_702] = { let __args: [G; IN_702] = [__v_7, __v_41, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[702].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[702].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[702].bump_multiplicity(__i); } let __ret: [G; OUT_702] = unsafe { *(record.function_queries[702].output_at(__i).as_ptr() as *const [G; OUT_702]) }; __ret }, _ => aiur_fn_702(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_783] = { let __args: [G; IN_783] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[783].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[783].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[783].bump_multiplicity(__i); } let __ret: [G; OUT_783] = unsafe { *(record.function_queries[783].output_at(__i).as_ptr() as *const [G; OUT_783]) }; __ret }, _ => aiur_fn_783(__args, record, io_buffer, __cu)? } };
+            let __v_34: G = __r_arr[0];
+            if (__v_34 != __v_20) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("recursor rule count differs from the inductive's ctor count".to_string()) });
+            }
+            let __v_35: G = (__v_3 + __v_5);
+            let __v_36: G = (__v_6 + __v_4);
+            let __v_37: G = (__v_35 + __v_36);
+            let __v_38: G = G::from_u64(1);
+            let __v_39: G = (__v_37 + __v_38);
+            let __r_arr: [G; OUT_593] = { let __args: [G; IN_593] = [__v_2, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[593].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[593].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[593].bump_multiplicity(__i); } let __ret: [G; OUT_593] = unsafe { *(record.function_queries[593].output_at(__i).as_ptr() as *const [G; OUT_593]) }; __ret }, _ => aiur_fn_593(__args, record, io_buffer, __cu)? } };
+            let __v_40: G = __r_arr[0];
+            let __v_41: G = (__v_5 + __v_6);
+            let __v_42: G = (__v_3 + __v_41);
+            let __r_arr: [G; OUT_702] = { let __args: [G; IN_702] = [__v_7, __v_42, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[702].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[702].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[702].bump_multiplicity(__i); } let __ret: [G; OUT_702] = unsafe { *(record.function_queries[702].output_at(__i).as_ptr() as *const [G; OUT_702]) }; __ret }, _ => aiur_fn_702(__args, record, io_buffer, __cu)? } };
             let __mc_out___mc_0: [G; 0] = '__mc_0: { match __v_33.as_canonical_u64() {
   1u64 => {
     break '__mc_0 [];
@@ -58953,23 +58958,18 @@ fn aiur_fn_699(
     if (__v_4 != __v_19) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_4.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("recursor index count differs from its inductive's".to_string()) });
     }
-    let __v_42: G = (__v_18 + __v_19);
-    let __r_arr: [G; OUT_700] = { let __args: [G; IN_700] = [__v_2, __v_3, __v_5, __v_6, __v_4, __v_42]; let __cu = unconstrained; let __hit = record.function_queries[700].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[700].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[700].bump_multiplicity(__i); } let __ret: [G; OUT_700] = unsafe { *(record.function_queries[700].output_at(__i).as_ptr() as *const [G; OUT_700]) }; __ret }, _ => aiur_fn_700(__args, record, io_buffer, __cu)? } };
+    let __v_43: G = (__v_18 + __v_19);
+    let __r_arr: [G; OUT_700] = { let __args: [G; IN_700] = [__v_2, __v_3, __v_5, __v_6, __v_4, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[700].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[700].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[700].bump_multiplicity(__i); } let __ret: [G; OUT_700] = unsafe { *(record.function_queries[700].output_at(__i).as_ptr() as *const [G; OUT_700]) }; __ret }, _ => aiur_fn_700(__args, record, io_buffer, __cu)? } };
     break '__mc_0 [];
   },
 }
  };
             let __r_arr: [G; OUT_626] = { let __args: [G; IN_626] = [__v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[626].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[626].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[626].bump_multiplicity(__i); } let __ret: [G; OUT_626] = unsafe { *(record.function_queries[626].output_at(__i).as_ptr() as *const [G; OUT_626]) }; __ret }, _ => aiur_fn_626(__args, record, io_buffer, __cu)? } };
-            let __v_42: G = __r_arr[0];
-            let __r_arr: [G; OUT_618] = { let __args: [G; IN_618] = [__v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[618].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[618].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[618].bump_multiplicity(__i); } let __ret: [G; OUT_618] = unsafe { *(record.function_queries[618].output_at(__i).as_ptr() as *const [G; OUT_618]) }; __ret }, _ => aiur_fn_618(__args, record, io_buffer, __cu)? } };
-            let __r_arr: [G; OUT_783] = { let __args: [G; IN_783] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[783].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[783].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[783].bump_multiplicity(__i); } let __ret: [G; OUT_783] = unsafe { *(record.function_queries[783].output_at(__i).as_ptr() as *const [G; OUT_783]) }; __ret }, _ => aiur_fn_783(__args, record, io_buffer, __cu)? } };
             let __v_43: G = __r_arr[0];
-            if (__v_43 != __v_20) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("recursor rule count differs from the inductive's ctor count".to_string()) });
-            }
-            if (__v_8 != __v_42) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_8.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: Some("recursor k_flag disagrees with its inductive's K eligibility".to_string()) });
+            if (__v_8 != __v_43) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_8.as_canonical_u64(), rhs: __v_43.as_canonical_u64(), msg: Some("recursor k_flag disagrees with its inductive's K eligibility".to_string()) });
             }
+            let __r_arr: [G; OUT_618] = { let __args: [G; IN_618] = [__v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[618].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[618].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[618].bump_multiplicity(__i); } let __ret: [G; OUT_618] = unsafe { *(record.function_queries[618].output_at(__i).as_ptr() as *const [G; OUT_618]) }; __ret }, _ => aiur_fn_618(__args, record, io_buffer, __cu)? } };
             let __r_arr: [G; OUT_668] = { let __args: [G; IN_668] = [__v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[668].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[668].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[668].bump_multiplicity(__i); } let __ret: [G; OUT_668] = unsafe { *(record.function_queries[668].output_at(__i).as_ptr() as *const [G; OUT_668]) }; __ret }, _ => aiur_fn_668(__args, record, io_buffer, __cu)? } };
             let __ret: [G; OUT_699] = [];
             record.function_queries[699].finish(&inp[..], &__ret[..], !unconstrained);
@@ -59057,15 +59057,15 @@ fn aiur_fn_701(
         return Ok(__ret);
       },
       _ => {
-        let __v_3: G = G::from_u64(0);
-        let __v_4: G = G::from_u64(4);
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = { let __values: [G; 3] = [__v_4, __v_1, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = (__v_1 + __v_7);
-        let __r_arr: [G; OUT_701] = { let __args: [G; IN_701] = [__v_0, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[701].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[701].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[701].bump_multiplicity(__i); } let __ret: [G; OUT_701] = unsafe { *(record.function_queries[701].output_at(__i).as_ptr() as *const [G; OUT_701]) }; __ret }, _ => aiur_fn_701(__args, record, io_buffer, __cu)? } };
-        let __v_9: G = __r_arr[0];
-        let __v_10: G = { let __values: [G; 3] = [__v_3, __v_6, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_3: G = G::from_u64(4);
+        let __v_4: G = G::from_u64(0);
+        let __v_5: G = { let __values: [G; 3] = [__v_3, __v_1, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = (__v_1 + __v_6);
+        let __r_arr: [G; OUT_701] = { let __args: [G; IN_701] = [__v_0, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[701].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[701].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[701].bump_multiplicity(__i); } let __ret: [G; OUT_701] = unsafe { *(record.function_queries[701].output_at(__i).as_ptr() as *const [G; OUT_701]) }; __ret }, _ => aiur_fn_701(__args, record, io_buffer, __cu)? } };
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_9, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_701] = [__v_10];
         record.function_queries[701].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -59240,8 +59240,6 @@ fn aiur_fn_704(
         let __v_18: G = { let __values: [G; 3] = [__v_16, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_505] = { let __args: [G; IN_505] = [__v_2, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[505].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[505].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[505].bump_multiplicity(__i); } let __ret: [G; OUT_505] = unsafe { *(record.function_queries[505].output_at(__i).as_ptr() as *const [G; OUT_505]) }; __ret }, _ => aiur_fn_505(__args, record, io_buffer, __cu)? } };
         let __v_19: G = __r_arr[0];
-        let __r_arr: [G; OUT_584] = { let __args: [G; IN_584] = [__v_13, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[584].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[584].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[584].bump_multiplicity(__i); } let __ret: [G; OUT_584] = unsafe { *(record.function_queries[584].output_at(__i).as_ptr() as *const [G; OUT_584]) }; __ret }, _ => aiur_fn_584(__args, record, io_buffer, __cu)? } };
-        let __r_arr: [G; OUT_584] = { let __args: [G; IN_584] = [__v_13, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[584].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[584].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[584].bump_multiplicity(__i); } let __ret: [G; OUT_584] = unsafe { *(record.function_queries[584].output_at(__i).as_ptr() as *const [G; OUT_584]) }; __ret }, _ => aiur_fn_584(__args, record, io_buffer, __cu)? } };
         let __v_20: G = G::from_u64(0);
         let __v_21: G = G::from_u64(0);
         let __v_22: G = { let __values: [G; 3] = [__v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -59251,6 +59249,8 @@ fn aiur_fn_704(
         if (__v_23 != __v_24) {
           return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: Some("theorem's type is not a Prop".to_string()) });
         }
+        let __r_arr: [G; OUT_584] = { let __args: [G; IN_584] = [__v_13, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[584].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[584].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[584].bump_multiplicity(__i); } let __ret: [G; OUT_584] = unsafe { *(record.function_queries[584].output_at(__i).as_ptr() as *const [G; OUT_584]) }; __ret }, _ => aiur_fn_584(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_584] = { let __args: [G; IN_584] = [__v_13, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[584].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[584].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[584].bump_multiplicity(__i); } let __ret: [G; OUT_584] = unsafe { *(record.function_queries[584].output_at(__i).as_ptr() as *const [G; OUT_584]) }; __ret }, _ => aiur_fn_584(__args, record, io_buffer, __cu)? } };
         let __v_25: G = G::from_u64(1);
         let __v_26: G = G::from_u64(1);
         let __v_27: G = { let __values: [G; 3] = [__v_25, __v_26, __v_26]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -59335,6 +59335,9 @@ fn aiur_fn_704(
         let __v_31: G = __loaded[11];
         match __v_20.as_canonical_u64() {
           5u64 => {
+            if (__v_6 != __v_23) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("ctor parameter count differs from its inductive's".to_string()) });
+            }
             let __r_arr: [G; OUT_599] = { let __args: [G; IN_599] = [__v_22, __v_2, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[599].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[599].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[599].bump_multiplicity(__i); } let __ret: [G; OUT_599] = unsafe { *(record.function_queries[599].output_at(__i).as_ptr() as *const [G; OUT_599]) }; __ret }, _ => aiur_fn_599(__args, record, io_buffer, __cu)? } };
             let __r_arr: [G; OUT_597] = { let __args: [G; IN_597] = [__v_2, __v_6, __v_24, __v_7, __v_21, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[597].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[597].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[597].bump_multiplicity(__i); } let __ret: [G; OUT_597] = unsafe { *(record.function_queries[597].output_at(__i).as_ptr() as *const [G; OUT_597]) }; __ret }, _ => aiur_fn_597(__args, record, io_buffer, __cu)? } };
             let __v_32: G = (__v_23 + __v_24);
@@ -59344,9 +59347,6 @@ fn aiur_fn_704(
             let __r_arr: [G; OUT_600] = { let __args: [G; IN_600] = [__v_22, __v_32, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[600].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[600].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[600].bump_multiplicity(__i); } let __ret: [G; OUT_600] = unsafe { *(record.function_queries[600].output_at(__i).as_ptr() as *const [G; OUT_600]) }; __ret }, _ => aiur_fn_600(__args, record, io_buffer, __cu)? } };
             let __v_36: G = __r_arr[0];
             let __r_arr: [G; OUT_603] = { let __args: [G; IN_603] = [__v_2, __v_6, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[603].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[603].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[603].bump_multiplicity(__i); } let __ret: [G; OUT_603] = unsafe { *(record.function_queries[603].output_at(__i).as_ptr() as *const [G; OUT_603]) }; __ret }, _ => aiur_fn_603(__args, record, io_buffer, __cu)? } };
-            if (__v_6 != __v_23) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("ctor parameter count differs from its inductive's".to_string()) });
-            }
             match __v_26.as_canonical_u64() {
               0u64 => {
                 let __v_37: G = G::from_u64(1);
@@ -59456,24 +59456,24 @@ fn aiur_fn_706(
     let __v_18: G = __loaded[17];
     match __v_1.as_canonical_u64() {
       2u64 => {
-        let __v_19: G = G::from_u64(0);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_20: G = __r_arr[0];
+        let __v_19: G = __r_arr[0];
+        let __v_20: G = G::from_u64(1);
         let __v_21: G = G::from_u64(1);
-        let __v_22: G = G::from_u64(1);
-        let __v_23: G = { let __values: [G; 3] = [__v_21, __v_22, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_24: G = { let __values: [G; 3] = [__v_19, __v_20, __v_23]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_22: G = { let __values: [G; 3] = [__v_20, __v_21, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_23: G = G::from_u64(0);
+        let __v_24: G = { let __values: [G; 3] = [__v_23, __v_19, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_706] = [__v_24];
         record.function_queries[706].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       4u64 => {
-        let __v_19: G = G::from_u64(0);
         let __r_arr: [G; OUT_17] = { let __args: [G; IN_17] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[17].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[17].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[17].bump_multiplicity(__i); } let __ret: [G; OUT_17] = unsafe { *(record.function_queries[17].output_at(__i).as_ptr() as *const [G; OUT_17]) }; __ret }, _ => aiur_fn_17(__args, record, io_buffer, __cu)? } };
-        let __v_20: G = __r_arr[0];
+        let __v_19: G = __r_arr[0];
         let __r_arr: [G; OUT_706] = { let __args: [G; IN_706] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[706].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[706].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[706].bump_multiplicity(__i); } let __ret: [G; OUT_706] = unsafe { *(record.function_queries[706].output_at(__i).as_ptr() as *const [G; OUT_706]) }; __ret }, _ => aiur_fn_706(__args, record, io_buffer, __cu)? } };
-        let __v_21: G = __r_arr[0];
-        let __v_22: G = { let __values: [G; 3] = [__v_19, __v_20, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_20: G = __r_arr[0];
+        let __v_21: G = G::from_u64(0);
+        let __v_22: G = { let __values: [G; 3] = [__v_21, __v_19, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_706] = [__v_22];
         record.function_queries[706].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -60399,7 +60399,7 @@ fn aiur_fn_717(
     let __v_4: G = __r_arr[0];
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = { let __values: [G; 3] = [__v_6, __v_5, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_22] = { let __args: [G; IN_22] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[22].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[22].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[22].bump_multiplicity(__i); } let __ret: [G; OUT_22] = unsafe { *(record.function_queries[22].output_at(__i).as_ptr() as *const [G; OUT_22]) }; __ret }, _ => aiur_fn_22(__args, record, io_buffer, __cu)? } };
     let __v_8: G = __r_arr[0];
     let __ret: [G; OUT_717] = [__v_8];
@@ -60427,9 +60427,9 @@ fn aiur_fn_718(
     let __v_5: G = __r_arr[0];
     let __r_arr: [G; OUT_48] = { let __args: [G; IN_48] = [__v_0, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[48].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[48].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[48].bump_multiplicity(__i); } let __ret: [G; OUT_48] = unsafe { *(record.function_queries[48].output_at(__i).as_ptr() as *const [G; OUT_48]) }; __ret }, _ => aiur_fn_48(__args, record, io_buffer, __cu)? } };
     let __v_6: G = __r_arr[0];
-    let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(1);
-    let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(1);
+    let __v_8: G = G::from_u64(0);
+    let __v_9: G = { let __values: [G; 3] = [__v_8, __v_7, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_22] = { let __args: [G; IN_22] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[22].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[22].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[22].bump_multiplicity(__i); } let __ret: [G; OUT_22] = unsafe { *(record.function_queries[22].output_at(__i).as_ptr() as *const [G; OUT_22]) }; __ret }, _ => aiur_fn_22(__args, record, io_buffer, __cu)? } };
     let __v_10: G = __r_arr[0];
     let __ret: [G; OUT_718] = [__v_10];
@@ -60459,11 +60459,11 @@ fn aiur_fn_719(
         let __v_4: G = __r_arr[1];
         let __r_arr: [G; OUT_717] = { let __args: [G; IN_717] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[717].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[717].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[717].bump_multiplicity(__i); } let __ret: [G; OUT_717] = unsafe { *(record.function_queries[717].output_at(__i).as_ptr() as *const [G; OUT_717]) }; __ret }, _ => aiur_fn_717(__args, record, io_buffer, __cu)? } };
         let __v_5: G = __r_arr[0];
-        let __v_6: G = G::from_u64(0);
+        let __v_6: G = G::from_u64(1);
         let __v_7: G = G::from_u64(1);
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_10: G = { let __values: [G; 3] = [__v_6, __v_3, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_9, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_719] = [__v_5, __v_10, __v_4];
         record.function_queries[719].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -60595,163 +60595,163 @@ fn aiur_fn_720(
     let __v_45: G = __r_arr[7];
     let __v_46: G = __r_arr[8];
     let __v_47: G = __r_arr[9];
-    let __r_arr: [G; OUT_719] = { let __args: [G; IN_719] = [__v_47]; let __cu = unconstrained; let __hit = record.function_queries[719].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[719].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[719].bump_multiplicity(__i); } let __ret: [G; OUT_719] = unsafe { *(record.function_queries[719].output_at(__i).as_ptr() as *const [G; OUT_719]) }; __ret }, _ => aiur_fn_719(__args, record, io_buffer, __cu)? } };
-    let __v_48: G = __r_arr[0];
-    let __v_49: G = __r_arr[1];
-    let __v_50: G = __r_arr[2];
-    let __loaded: [G; 32] = { let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; let __ptr_u64 = __v_48.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 32 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 32] = __args[..32].try_into().unwrap(); __arr };
-    let __v_51: G = __loaded[0];
-    let __v_52: G = __loaded[1];
-    let __v_53: G = __loaded[2];
-    let __v_54: G = __loaded[3];
-    let __v_55: G = __loaded[4];
-    let __v_56: G = __loaded[5];
-    let __v_57: G = __loaded[6];
-    let __v_58: G = __loaded[7];
-    let __v_59: G = __loaded[8];
-    let __v_60: G = __loaded[9];
-    let __v_61: G = __loaded[10];
-    let __v_62: G = __loaded[11];
-    let __v_63: G = __loaded[12];
-    let __v_64: G = __loaded[13];
-    let __v_65: G = __loaded[14];
-    let __v_66: G = __loaded[15];
-    let __v_67: G = __loaded[16];
-    let __v_68: G = __loaded[17];
-    let __v_69: G = __loaded[18];
-    let __v_70: G = __loaded[19];
-    let __v_71: G = __loaded[20];
-    let __v_72: G = __loaded[21];
-    let __v_73: G = __loaded[22];
-    let __v_74: G = __loaded[23];
-    let __v_75: G = __loaded[24];
-    let __v_76: G = __loaded[25];
-    let __v_77: G = __loaded[26];
-    let __v_78: G = __loaded[27];
-    let __v_79: G = __loaded[28];
-    let __v_80: G = __loaded[29];
-    let __v_81: G = __loaded[30];
-    let __v_82: G = __loaded[31];
-    let __v_83: G = G::from_u64(14);
-    if (__v_38 != __v_83) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_83.as_canonical_u64(), msg: Some("assumption tree: wrong tag4 flag".to_string()) });
-    }
-    let __v_84: G = G::from_u64(2);
-    if (__v_39 != __v_84) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_84.as_canonical_u64(), msg: Some("assumption tree: wrong tag4 variant".to_string()) });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_50.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_85: G = __loaded[0];
-    let __v_86: G = __loaded[1];
-    let __v_87: G = __loaded[2];
-    let __v_88: G = G::from_u64(1);
-    let __v_89: G = G::from_u64(1);
-    if (__v_85 != __v_88) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_88.as_canonical_u64(), msg: Some("assumption tree: trailing bytes after tree body".to_string()) });
-    }
-    if (__v_86 != __v_89) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_86.as_canonical_u64(), rhs: __v_89.as_canonical_u64(), msg: Some("assumption tree: trailing bytes after tree body".to_string()) });
-    }
-    if (__v_87 != __v_89) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_87.as_canonical_u64(), rhs: __v_89.as_canonical_u64(), msg: Some("assumption tree: trailing bytes after tree body".to_string()) });
-    }
-    if (__v_51 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_51.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_52 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_52.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_53 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_53.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_54 != __v_4) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_54.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_55 != __v_5) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_55.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_56 != __v_6) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_56.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_57 != __v_7) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_58 != __v_8) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_58.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_59 != __v_9) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_59.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_60 != __v_10) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_60.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_61 != __v_11) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_61.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_62 != __v_12) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_62.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_63 != __v_13) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_63.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_64 != __v_14) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_64.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_65 != __v_15) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_65.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_66 != __v_16) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_66.as_canonical_u64(), rhs: __v_16.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
-    }
-    if (__v_67 != __v_17) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_67.as_canonical_u64(), rhs: __v_17.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    let __v_48: G = G::from_u64(14);
+    if (__v_38 != __v_48) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("assumption tree: wrong tag4 flag".to_string()) });
     }
-    if (__v_68 != __v_18) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_68.as_canonical_u64(), rhs: __v_18.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    let __v_49: G = G::from_u64(2);
+    if (__v_39 != __v_49) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_49.as_canonical_u64(), msg: Some("assumption tree: wrong tag4 variant".to_string()) });
     }
-    if (__v_69 != __v_19) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_69.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    let __r_arr: [G; OUT_719] = { let __args: [G; IN_719] = [__v_47]; let __cu = unconstrained; let __hit = record.function_queries[719].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[719].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[719].bump_multiplicity(__i); } let __ret: [G; OUT_719] = unsafe { *(record.function_queries[719].output_at(__i).as_ptr() as *const [G; OUT_719]) }; __ret }, _ => aiur_fn_719(__args, record, io_buffer, __cu)? } };
+    let __v_50: G = __r_arr[0];
+    let __v_51: G = __r_arr[1];
+    let __v_52: G = __r_arr[2];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_52.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_53: G = __loaded[0];
+    let __v_54: G = __loaded[1];
+    let __v_55: G = __loaded[2];
+    let __v_56: G = G::from_u64(1);
+    let __v_57: G = G::from_u64(1);
+    if (__v_53 != __v_56) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_53.as_canonical_u64(), rhs: __v_56.as_canonical_u64(), msg: Some("assumption tree: trailing bytes after tree body".to_string()) });
+    }
+    if (__v_54 != __v_57) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_54.as_canonical_u64(), rhs: __v_57.as_canonical_u64(), msg: Some("assumption tree: trailing bytes after tree body".to_string()) });
+    }
+    if (__v_55 != __v_57) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_55.as_canonical_u64(), rhs: __v_57.as_canonical_u64(), msg: Some("assumption tree: trailing bytes after tree body".to_string()) });
+    }
+    let __loaded: [G; 32] = { let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; let __ptr_u64 = __v_50.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 32 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 32] = __args[..32].try_into().unwrap(); __arr };
+    let __v_58: G = __loaded[0];
+    let __v_59: G = __loaded[1];
+    let __v_60: G = __loaded[2];
+    let __v_61: G = __loaded[3];
+    let __v_62: G = __loaded[4];
+    let __v_63: G = __loaded[5];
+    let __v_64: G = __loaded[6];
+    let __v_65: G = __loaded[7];
+    let __v_66: G = __loaded[8];
+    let __v_67: G = __loaded[9];
+    let __v_68: G = __loaded[10];
+    let __v_69: G = __loaded[11];
+    let __v_70: G = __loaded[12];
+    let __v_71: G = __loaded[13];
+    let __v_72: G = __loaded[14];
+    let __v_73: G = __loaded[15];
+    let __v_74: G = __loaded[16];
+    let __v_75: G = __loaded[17];
+    let __v_76: G = __loaded[18];
+    let __v_77: G = __loaded[19];
+    let __v_78: G = __loaded[20];
+    let __v_79: G = __loaded[21];
+    let __v_80: G = __loaded[22];
+    let __v_81: G = __loaded[23];
+    let __v_82: G = __loaded[24];
+    let __v_83: G = __loaded[25];
+    let __v_84: G = __loaded[26];
+    let __v_85: G = __loaded[27];
+    let __v_86: G = __loaded[28];
+    let __v_87: G = __loaded[29];
+    let __v_88: G = __loaded[30];
+    let __v_89: G = __loaded[31];
+    if (__v_58 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_58.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_59 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_59.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_60 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_60.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_61 != __v_4) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_61.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_62 != __v_5) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_62.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_63 != __v_6) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_63.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_64 != __v_7) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_64.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_65 != __v_8) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_65.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_66 != __v_9) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_66.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_67 != __v_10) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_67.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_68 != __v_11) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_68.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_69 != __v_12) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_69.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_70 != __v_13) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_70.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_71 != __v_14) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_71.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_72 != __v_15) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_72.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_73 != __v_16) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_73.as_canonical_u64(), rhs: __v_16.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_74 != __v_17) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_74.as_canonical_u64(), rhs: __v_17.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_75 != __v_18) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_75.as_canonical_u64(), rhs: __v_18.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    }
+    if (__v_76 != __v_19) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_70 != __v_20) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_70.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_77 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_71 != __v_21) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_71.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_78 != __v_21) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_78.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_72 != __v_22) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_72.as_canonical_u64(), rhs: __v_22.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_79 != __v_22) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_22.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_73 != __v_23) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_73.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_80 != __v_23) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_80.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_74 != __v_24) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_74.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_81 != __v_24) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_81.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_75 != __v_25) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_75.as_canonical_u64(), rhs: __v_25.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_82 != __v_25) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_82.as_canonical_u64(), rhs: __v_25.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_76 != __v_26) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_26.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_83 != __v_26) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_83.as_canonical_u64(), rhs: __v_26.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_77 != __v_27) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_84 != __v_27) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_84.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_78 != __v_28) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_78.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_85 != __v_28) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_79 != __v_29) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_86 != __v_29) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_86.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_80 != __v_30) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_80.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_87 != __v_30) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_87.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_81 != __v_31) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_81.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_88 != __v_31) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_88.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    if (__v_82 != __v_32) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_82.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
+    if (__v_89 != __v_32) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("assumption tree: recomputed merkle root != requested root".to_string()) });
     }
-    let __ret: [G; OUT_720] = [__v_49];
+    let __ret: [G; OUT_720] = [__v_51];
     record.function_queries[720].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -61339,21 +61339,21 @@ fn aiur_fn_731(
           0u64 => {
             let __v_4: G = G::from_u64(0);
             let __v_5: G = G::from_u64(0);
-            let __ret: [G; OUT_731] = [__v_4, __v_5, __v_3];
+            let __ret: [G; OUT_731] = [__v_5, __v_4, __v_3];
             record.function_queries[731].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_4: G = G::from_u64(0);
-            let __v_5: G = G::from_u64(1);
-            let __ret: [G; OUT_731] = [__v_4, __v_5, __v_3];
+            let __v_4: G = G::from_u64(1);
+            let __v_5: G = G::from_u64(0);
+            let __ret: [G; OUT_731] = [__v_5, __v_4, __v_3];
             record.function_queries[731].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           2u64 => {
-            let __v_4: G = G::from_u64(0);
-            let __v_5: G = G::from_u64(2);
-            let __ret: [G; OUT_731] = [__v_4, __v_5, __v_3];
+            let __v_4: G = G::from_u64(2);
+            let __v_5: G = G::from_u64(0);
+            let __ret: [G; OUT_731] = [__v_5, __v_4, __v_3];
             record.function_queries[731].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
@@ -61394,28 +61394,28 @@ fn aiur_fn_732(
           0u64 => {
             let __v_4: G = G::from_u64(0);
             let __v_5: G = G::from_u64(0);
-            let __ret: [G; OUT_732] = [__v_4, __v_5, __v_3];
+            let __ret: [G; OUT_732] = [__v_5, __v_4, __v_3];
             record.function_queries[732].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           1u64 => {
-            let __v_4: G = G::from_u64(0);
-            let __v_5: G = G::from_u64(1);
-            let __ret: [G; OUT_732] = [__v_4, __v_5, __v_3];
+            let __v_4: G = G::from_u64(1);
+            let __v_5: G = G::from_u64(0);
+            let __ret: [G; OUT_732] = [__v_5, __v_4, __v_3];
             record.function_queries[732].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           2u64 => {
-            let __v_4: G = G::from_u64(0);
-            let __v_5: G = G::from_u64(2);
-            let __ret: [G; OUT_732] = [__v_4, __v_5, __v_3];
+            let __v_4: G = G::from_u64(2);
+            let __v_5: G = G::from_u64(0);
+            let __ret: [G; OUT_732] = [__v_5, __v_4, __v_3];
             record.function_queries[732].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           3u64 => {
-            let __v_4: G = G::from_u64(0);
-            let __v_5: G = G::from_u64(3);
-            let __ret: [G; OUT_732] = [__v_4, __v_5, __v_3];
+            let __v_4: G = G::from_u64(3);
+            let __v_5: G = G::from_u64(0);
+            let __ret: [G; OUT_732] = [__v_5, __v_4, __v_3];
             record.function_queries[732].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
@@ -63377,8 +63377,6 @@ fn aiur_fn_752(
               _ => {
                 match __v_30.as_canonical_u64() {
                   _ => {
-                    let __v_40: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_751] = { let __args: [G; IN_751] = [__v_38, __v_40, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[751].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[751].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[751].bump_multiplicity(__i); } let __ret: [G; OUT_751] = unsafe { *(record.function_queries[751].output_at(__i).as_ptr() as *const [G; OUT_751]) }; __ret }, _ => aiur_fn_751(__args, record, io_buffer, __cu)? } };
                     if (__v_11 != __v_2) {
                       return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("Reveal: claimed recursor rule index != its position".to_string()) });
                     }
@@ -63427,6 +63425,8 @@ fn aiur_fn_752(
                     if (__v_37 != __v_26) {
                       return Err(ExecError::AssertEqMismatch { lhs: __v_37.as_canonical_u64(), rhs: __v_26.as_canonical_u64(), msg: Some("Reveal: claimed recursor rule field count != real".to_string()) });
                     }
+                    let __v_40: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_751] = { let __args: [G; IN_751] = [__v_38, __v_40, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[751].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[751].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[751].bump_multiplicity(__i); } let __ret: [G; OUT_751] = unsafe { *(record.function_queries[751].output_at(__i).as_ptr() as *const [G; OUT_751]) }; __ret }, _ => aiur_fn_751(__args, record, io_buffer, __cu)? } };
                     let __r_arr: [G; OUT_15] = { let __args: [G; IN_15] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[15].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[15].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[15].bump_multiplicity(__i); } let __ret: [G; OUT_15] = unsafe { *(record.function_queries[15].output_at(__i).as_ptr() as *const [G; OUT_15]) }; __ret }, _ => aiur_fn_15(__args, record, io_buffer, __cu)? } };
                     let __v_41: G = __r_arr[0];
                     let __v_42: G = __r_arr[1];
@@ -64486,130 +64486,130 @@ fn aiur_fn_761(
     let __v_93: G = __r_arr[29];
     let __v_94: G = __r_arr[30];
     let __v_95: G = __r_arr[31];
-    let __r_arr: [G; OUT_78] = { let __args: [G; IN_78] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[78].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[78].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[78].bump_multiplicity(__i); } let __ret: [G; OUT_78] = unsafe { *(record.function_queries[78].output_at(__i).as_ptr() as *const [G; OUT_78]) }; __ret }, _ => aiur_fn_78(__args, record, io_buffer, __cu)? } };
-    let __v_96: G = __r_arr[0];
-    let __v_97: G = __r_arr[1];
-    let __v_98: G = __r_arr[2];
-    let __v_99: G = __r_arr[3];
-    let __v_100: G = __r_arr[4];
-    let __v_101: G = __r_arr[5];
-    let __v_102: G = __r_arr[6];
-    let __v_103: G = __r_arr[7];
-    let __v_104: G = __r_arr[8];
-    let __v_105: G = __r_arr[9];
-    let __v_106: G = G::from_u64(256);
-    let __v_107: G = (__v_106 * __v_65);
-    let __v_108: G = G::from_u64(65536);
-    let __v_109: G = (__v_108 * __v_66);
-    let __v_110: G = G::from_u64(16777216);
-    let __v_111: G = (__v_110 * __v_67);
-    let __v_112: G = (__v_109 + __v_111);
-    let __v_113: G = (__v_107 + __v_112);
-    let __v_114: G = (__v_64 + __v_113);
-    let __v_115: G = G::from_u64(256);
-    let __v_116: G = (__v_115 * __v_69);
-    let __v_117: G = G::from_u64(65536);
-    let __v_118: G = (__v_117 * __v_70);
-    let __v_119: G = G::from_u64(16777216);
-    let __v_120: G = (__v_119 * __v_71);
-    let __v_121: G = (__v_118 + __v_120);
-    let __v_122: G = (__v_116 + __v_121);
-    let __v_123: G = (__v_68 + __v_122);
-    let __v_124: G = G::from_u64(256);
-    let __v_125: G = (__v_124 * __v_73);
-    let __v_126: G = G::from_u64(65536);
-    let __v_127: G = (__v_126 * __v_74);
-    let __v_128: G = G::from_u64(16777216);
-    let __v_129: G = (__v_128 * __v_75);
-    let __v_130: G = (__v_127 + __v_129);
-    let __v_131: G = (__v_125 + __v_130);
-    let __v_132: G = (__v_72 + __v_131);
-    let __v_133: G = G::from_u64(256);
-    let __v_134: G = (__v_133 * __v_77);
-    let __v_135: G = G::from_u64(65536);
-    let __v_136: G = (__v_135 * __v_78);
-    let __v_137: G = G::from_u64(16777216);
-    let __v_138: G = (__v_137 * __v_79);
-    let __v_139: G = (__v_136 + __v_138);
-    let __v_140: G = (__v_134 + __v_139);
-    let __v_141: G = (__v_76 + __v_140);
-    let __v_142: G = G::from_u64(256);
-    let __v_143: G = (__v_142 * __v_81);
-    let __v_144: G = G::from_u64(65536);
-    let __v_145: G = (__v_144 * __v_82);
-    let __v_146: G = G::from_u64(16777216);
-    let __v_147: G = (__v_146 * __v_83);
-    let __v_148: G = (__v_145 + __v_147);
-    let __v_149: G = (__v_143 + __v_148);
-    let __v_150: G = (__v_80 + __v_149);
-    let __v_151: G = G::from_u64(256);
-    let __v_152: G = (__v_151 * __v_85);
-    let __v_153: G = G::from_u64(65536);
-    let __v_154: G = (__v_153 * __v_86);
-    let __v_155: G = G::from_u64(16777216);
-    let __v_156: G = (__v_155 * __v_87);
-    let __v_157: G = (__v_154 + __v_156);
-    let __v_158: G = (__v_152 + __v_157);
-    let __v_159: G = (__v_84 + __v_158);
-    let __v_160: G = G::from_u64(256);
-    let __v_161: G = (__v_160 * __v_89);
-    let __v_162: G = G::from_u64(65536);
-    let __v_163: G = (__v_162 * __v_90);
-    let __v_164: G = G::from_u64(16777216);
-    let __v_165: G = (__v_164 * __v_91);
-    let __v_166: G = (__v_163 + __v_165);
-    let __v_167: G = (__v_161 + __v_166);
-    let __v_168: G = (__v_88 + __v_167);
-    let __v_169: G = G::from_u64(256);
-    let __v_170: G = (__v_169 * __v_93);
-    let __v_171: G = G::from_u64(65536);
-    let __v_172: G = (__v_171 * __v_94);
-    let __v_173: G = G::from_u64(16777216);
-    let __v_174: G = (__v_173 * __v_95);
-    let __v_175: G = (__v_172 + __v_174);
-    let __v_176: G = (__v_170 + __v_175);
-    let __v_177: G = (__v_92 + __v_176);
-    if (__v_114 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_114.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_123 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_123.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_132 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_132.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_141 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_150 != __v_4) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_150.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_159 != __v_5) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_159.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_168 != __v_6) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
-    }
-    if (__v_177 != __v_7) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    let __v_96: G = G::from_u64(256);
+    let __v_97: G = (__v_96 * __v_65);
+    let __v_98: G = G::from_u64(65536);
+    let __v_99: G = (__v_98 * __v_66);
+    let __v_100: G = G::from_u64(16777216);
+    let __v_101: G = (__v_100 * __v_67);
+    let __v_102: G = (__v_99 + __v_101);
+    let __v_103: G = (__v_97 + __v_102);
+    let __v_104: G = (__v_64 + __v_103);
+    let __v_105: G = G::from_u64(256);
+    let __v_106: G = (__v_105 * __v_69);
+    let __v_107: G = G::from_u64(65536);
+    let __v_108: G = (__v_107 * __v_70);
+    let __v_109: G = G::from_u64(16777216);
+    let __v_110: G = (__v_109 * __v_71);
+    let __v_111: G = (__v_108 + __v_110);
+    let __v_112: G = (__v_106 + __v_111);
+    let __v_113: G = (__v_68 + __v_112);
+    let __v_114: G = G::from_u64(256);
+    let __v_115: G = (__v_114 * __v_73);
+    let __v_116: G = G::from_u64(65536);
+    let __v_117: G = (__v_116 * __v_74);
+    let __v_118: G = G::from_u64(16777216);
+    let __v_119: G = (__v_118 * __v_75);
+    let __v_120: G = (__v_117 + __v_119);
+    let __v_121: G = (__v_115 + __v_120);
+    let __v_122: G = (__v_72 + __v_121);
+    let __v_123: G = G::from_u64(256);
+    let __v_124: G = (__v_123 * __v_77);
+    let __v_125: G = G::from_u64(65536);
+    let __v_126: G = (__v_125 * __v_78);
+    let __v_127: G = G::from_u64(16777216);
+    let __v_128: G = (__v_127 * __v_79);
+    let __v_129: G = (__v_126 + __v_128);
+    let __v_130: G = (__v_124 + __v_129);
+    let __v_131: G = (__v_76 + __v_130);
+    let __v_132: G = G::from_u64(256);
+    let __v_133: G = (__v_132 * __v_81);
+    let __v_134: G = G::from_u64(65536);
+    let __v_135: G = (__v_134 * __v_82);
+    let __v_136: G = G::from_u64(16777216);
+    let __v_137: G = (__v_136 * __v_83);
+    let __v_138: G = (__v_135 + __v_137);
+    let __v_139: G = (__v_133 + __v_138);
+    let __v_140: G = (__v_80 + __v_139);
+    let __v_141: G = G::from_u64(256);
+    let __v_142: G = (__v_141 * __v_85);
+    let __v_143: G = G::from_u64(65536);
+    let __v_144: G = (__v_143 * __v_86);
+    let __v_145: G = G::from_u64(16777216);
+    let __v_146: G = (__v_145 * __v_87);
+    let __v_147: G = (__v_144 + __v_146);
+    let __v_148: G = (__v_142 + __v_147);
+    let __v_149: G = (__v_84 + __v_148);
+    let __v_150: G = G::from_u64(256);
+    let __v_151: G = (__v_150 * __v_89);
+    let __v_152: G = G::from_u64(65536);
+    let __v_153: G = (__v_152 * __v_90);
+    let __v_154: G = G::from_u64(16777216);
+    let __v_155: G = (__v_154 * __v_91);
+    let __v_156: G = (__v_153 + __v_155);
+    let __v_157: G = (__v_151 + __v_156);
+    let __v_158: G = (__v_88 + __v_157);
+    let __v_159: G = G::from_u64(256);
+    let __v_160: G = (__v_159 * __v_93);
+    let __v_161: G = G::from_u64(65536);
+    let __v_162: G = (__v_161 * __v_94);
+    let __v_163: G = G::from_u64(16777216);
+    let __v_164: G = (__v_163 * __v_95);
+    let __v_165: G = (__v_162 + __v_164);
+    let __v_166: G = (__v_160 + __v_165);
+    let __v_167: G = (__v_92 + __v_166);
+    if (__v_104 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_104.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_113 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_113.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_122 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_122.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_131 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_131.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_140 != __v_4) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_140.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_149 != __v_5) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_149.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_158 != __v_6) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_158.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
+    }
+    if (__v_167 != __v_7) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_167.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("claim: bytes do not hash to the public claim digest".to_string()) });
     }
+    let __r_arr: [G; OUT_78] = { let __args: [G; IN_78] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[78].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[78].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[78].bump_multiplicity(__i); } let __ret: [G; OUT_78] = unsafe { *(record.function_queries[78].output_at(__i).as_ptr() as *const [G; OUT_78]) }; __ret }, _ => aiur_fn_78(__args, record, io_buffer, __cu)? } };
+    let __v_168: G = __r_arr[0];
+    let __v_169: G = __r_arr[1];
+    let __v_170: G = __r_arr[2];
+    let __v_171: G = __r_arr[3];
+    let __v_172: G = __r_arr[4];
+    let __v_173: G = __r_arr[5];
+    let __v_174: G = __r_arr[6];
+    let __v_175: G = __r_arr[7];
+    let __v_176: G = __r_arr[8];
+    let __v_177: G = __r_arr[9];
     let __v_178: G = G::from_u64(14);
-    if (__v_96 != __v_178) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_96.as_canonical_u64(), rhs: __v_178.as_canonical_u64(), msg: Some("claim: wrong tag4 flag".to_string()) });
-    }
-    let __v_179: G = (__v_98 + __v_99);
-    let __v_180: G = (__v_179 + __v_100);
-    let __v_181: G = (__v_180 + __v_101);
-    let __v_182: G = (__v_181 + __v_102);
-    let __v_183: G = (__v_182 + __v_103);
-    let __v_184: G = (__v_183 + __v_104);
+    if (__v_168 != __v_178) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_178.as_canonical_u64(), msg: Some("claim: wrong tag4 flag".to_string()) });
+    }
+    let __v_179: G = (__v_170 + __v_171);
+    let __v_180: G = (__v_179 + __v_172);
+    let __v_181: G = (__v_180 + __v_173);
+    let __v_182: G = (__v_181 + __v_174);
+    let __v_183: G = (__v_182 + __v_175);
+    let __v_184: G = (__v_183 + __v_176);
     let __v_185: G = G::from_u64(0);
     if (__v_184 != __v_185) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_184.as_canonical_u64(), rhs: __v_185.as_canonical_u64(), msg: Some("claim: tag4 size exceeds a single byte".to_string()) });
     }
-    match __v_97.as_canonical_u64() {
+    match __v_169.as_canonical_u64() {
       4u64 => {
-        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_177]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
         let __v_186: G = __r_arr[0];
         let __v_187: G = __r_arr[1];
         let __r_arr: [G; OUT_727] = { let __args: [G; IN_727] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[727].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[727].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[727].bump_multiplicity(__i); } let __ret: [G; OUT_727] = unsafe { *(record.function_queries[727].output_at(__i).as_ptr() as *const [G; OUT_727]) }; __ret }, _ => aiur_fn_727(__args, record, io_buffer, __cu)? } };
@@ -64649,7 +64649,7 @@ fn aiur_fn_761(
         }
       },
       5u64 => {
-        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_177]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
         let __v_186: G = __r_arr[0];
         let __v_187: G = __r_arr[1];
         let __r_arr: [G; OUT_727] = { let __args: [G; IN_727] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[727].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[727].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[727].bump_multiplicity(__i); } let __ret: [G; OUT_727] = unsafe { *(record.function_queries[727].output_at(__i).as_ptr() as *const [G; OUT_727]) }; __ret }, _ => aiur_fn_727(__args, record, io_buffer, __cu)? } };
@@ -64662,7 +64662,7 @@ fn aiur_fn_761(
         return Ok(__ret);
       },
       6u64 => {
-        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_177]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
         let __v_186: G = __r_arr[0];
         let __v_187: G = __r_arr[1];
         let __r_arr: [G; OUT_742] = { let __args: [G; IN_742] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[742].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[742].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[742].bump_multiplicity(__i); } let __ret: [G; OUT_742] = unsafe { *(record.function_queries[742].output_at(__i).as_ptr() as *const [G; OUT_742]) }; __ret }, _ => aiur_fn_742(__args, record, io_buffer, __cu)? } };
@@ -64727,7 +64727,7 @@ fn aiur_fn_761(
         return Ok(__ret);
       },
       7u64 => {
-        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_177]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
         let __v_186: G = __r_arr[0];
         let __v_187: G = __r_arr[1];
         let __r_arr: [G; OUT_89] = { let __args: [G; IN_89] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[89].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[89].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[89].bump_multiplicity(__i); } let __ret: [G; OUT_89] = unsafe { *(record.function_queries[89].output_at(__i).as_ptr() as *const [G; OUT_89]) }; __ret }, _ => aiur_fn_89(__args, record, io_buffer, __cu)? } };
@@ -64739,7 +64739,7 @@ fn aiur_fn_761(
         return Ok(__ret);
       },
       _ => {
-        return Err(ExecError::MatchNoCase(__v_97.as_canonical_u64()));
+        return Err(ExecError::MatchNoCase(__v_169.as_canonical_u64()));
       },
     }
   })
@@ -64825,20 +64825,20 @@ fn aiur_fn_764(
     let __v_4: G = __loaded[2];
     match __v_2.as_canonical_u64() {
       1u64 => {
-        let __v_5: G = G::from_u64(0);
+        let __v_5: G = G::from_u64(1);
         let __v_6: G = G::from_u64(1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_9: G = { let __values: [G; 3] = [__v_5, __v_1, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = G::from_u64(0);
+        let __v_9: G = { let __values: [G; 3] = [__v_8, __v_1, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_764] = [__v_9];
         record.function_queries[764].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_764] = { let __args: [G; IN_764] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[764].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[764].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[764].bump_multiplicity(__i); } let __ret: [G; OUT_764] = unsafe { *(record.function_queries[764].output_at(__i).as_ptr() as *const [G; OUT_764]) }; __ret }, _ => aiur_fn_764(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_3, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_6, __v_3, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_764] = [__v_7];
         record.function_queries[764].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -64940,10 +64940,10 @@ fn aiur_fn_766(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_766] = { let __args: [G; IN_766] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[766].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[766].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[766].bump_multiplicity(__i); } let __ret: [G; OUT_766] = unsafe { *(record.function_queries[766].output_at(__i).as_ptr() as *const [G; OUT_766]) }; __ret }, _ => aiur_fn_766(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 4] = [__v_6, __v_3, __v_4, __v_7]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 4] = [__v_7, __v_3, __v_4, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_766] = [__v_8];
         record.function_queries[766].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -65133,10 +65133,10 @@ fn aiur_fn_770(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_770] = { let __args: [G; IN_770] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[770].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[770].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[770].bump_multiplicity(__i); } let __ret: [G; OUT_770] = unsafe { *(record.function_queries[770].output_at(__i).as_ptr() as *const [G; OUT_770]) }; __ret }, _ => aiur_fn_770(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_3, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_6, __v_3, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_770] = [__v_7];
         record.function_queries[770].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -65859,20 +65859,20 @@ fn aiur_fn_780(
     let __v_10: G = __loaded[5];
     match __v_5.as_canonical_u64() {
       1u64 => {
-        let __v_11: G = G::from_u64(0);
+        let __v_11: G = G::from_u64(1);
         let __v_12: G = G::from_u64(1);
-        let __v_13: G = G::from_u64(1);
-        let __v_14: G = { let __values: [G; 6] = [__v_12, __v_13, __v_13, __v_13, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_15: G = { let __values: [G; 6] = [__v_11, __v_1, __v_2, __v_3, __v_4, __v_14]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_13: G = { let __values: [G; 6] = [__v_11, __v_12, __v_12, __v_12, __v_12, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_14: G = G::from_u64(0);
+        let __v_15: G = { let __values: [G; 6] = [__v_14, __v_1, __v_2, __v_3, __v_4, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_780] = [__v_15];
         record.function_queries[780].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
       0u64 => {
-        let __v_11: G = G::from_u64(0);
         let __r_arr: [G; OUT_780] = { let __args: [G; IN_780] = [__v_10, __v_1, __v_2, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[780].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[780].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[780].bump_multiplicity(__i); } let __ret: [G; OUT_780] = unsafe { *(record.function_queries[780].output_at(__i).as_ptr() as *const [G; OUT_780]) }; __ret }, _ => aiur_fn_780(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 6] = [__v_11, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(0);
+        let __v_13: G = { let __values: [G; 6] = [__v_12, __v_6, __v_7, __v_8, __v_9, __v_11]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_780] = [__v_13];
         record.function_queries[780].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -65912,12 +65912,12 @@ fn aiur_fn_781(
         let __v_4: G = __loaded[2];
         match __v_2.as_canonical_u64() {
           0u64 => {
-            let __v_5: G = G::from_u64(0);
-            let __v_6: G = G::from_u64(1);
-            let __v_7: G = (__v_1 - __v_6);
-            let __r_arr: [G; OUT_781] = { let __args: [G; IN_781] = [__v_4, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[781].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[781].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[781].bump_multiplicity(__i); } let __ret: [G; OUT_781] = unsafe { *(record.function_queries[781].output_at(__i).as_ptr() as *const [G; OUT_781]) }; __ret }, _ => aiur_fn_781(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = { let __values: [G; 3] = [__v_5, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_5: G = G::from_u64(1);
+            let __v_6: G = (__v_1 - __v_5);
+            let __r_arr: [G; OUT_781] = { let __args: [G; IN_781] = [__v_4, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[781].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[781].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[781].bump_multiplicity(__i); } let __ret: [G; OUT_781] = unsafe { *(record.function_queries[781].output_at(__i).as_ptr() as *const [G; OUT_781]) }; __ret }, _ => aiur_fn_781(__args, record, io_buffer, __cu)? } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = G::from_u64(0);
+            let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_781] = [__v_9];
             record.function_queries[781].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -66040,9 +66040,9 @@ fn aiur_fn_784(
     let __v_13: G = __r_arr[5];
     match __v_8.as_canonical_u64() {
       0u64 => {
-        let __v_14: G = G::from_u64(0);
-        let __v_15: G = G::from_u64(1);
-        let __ret: [G; OUT_784] = [__v_14, __v_15, __v_10, __v_11, __v_12, __v_13];
+        let __v_14: G = G::from_u64(1);
+        let __v_15: G = G::from_u64(0);
+        let __ret: [G; OUT_784] = [__v_15, __v_14, __v_10, __v_11, __v_12, __v_13];
         record.function_queries[784].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -66153,14 +66153,14 @@ fn aiur_fn_787(
     match __v_2.as_canonical_u64() {
       1u64 => {
         let __v_8: G = G::from_u64(0);
-        let __v_9: G = G::from_u64(0);
+        let __v_9: G = G::from_u64(1);
         let __v_10: G = G::from_u64(1);
-        let __v_11: G = G::from_u64(1);
-        let __v_12: G = { let __values: [G; 6] = [__v_10, __v_11, __v_11, __v_11, __v_11, __v_11]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = { let __values: [G; 6] = [__v_9, __v_10, __v_10, __v_10, __v_10, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = G::from_u64(1);
         let __v_13: G = G::from_u64(1);
-        let __v_14: G = G::from_u64(1);
-        let __v_15: G = { let __values: [G; 6] = [__v_13, __v_14, __v_14, __v_14, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __ret: [G; OUT_787] = [__v_8, __v_9, __v_0, __v_1, __v_12, __v_15];
+        let __v_14: G = { let __values: [G; 6] = [__v_12, __v_13, __v_13, __v_13, __v_13, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_15: G = G::from_u64(0);
+        let __ret: [G; OUT_787] = [__v_15, __v_8, __v_0, __v_1, __v_11, __v_14];
         record.function_queries[787].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -66204,10 +66204,10 @@ fn aiur_fn_787(
             let __v_21: G = (__v_0 - __v_4);
             match __v_21.as_canonical_u64() {
               0u64 => {
-                let __v_22: G = G::from_u64(0);
-                let __v_23: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_24: G = { let __values: [G; 6] = [__v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __ret: [G; OUT_787] = [__v_22, __v_3, __v_0, __v_1, __v_23, __v_24];
+                let __v_22: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_23: G = { let __values: [G; 6] = [__v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_24: G = G::from_u64(0);
+                let __ret: [G; OUT_787] = [__v_24, __v_3, __v_0, __v_1, __v_22, __v_23];
                 record.function_queries[787].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
               },
@@ -66280,10 +66280,10 @@ fn aiur_fn_788(
         return Ok(__ret);
       },
       _ => {
-        let __v_15: G = G::from_u64(0);
-        let __v_16: G = { let __values: [G; 6] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_17: G = { let __values: [G; 6] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __ret: [G; OUT_788] = [__v_15, __v_0, __v_1, __v_2, __v_16, __v_17];
+        let __v_15: G = { let __values: [G; 6] = [__v_3, __v_4, __v_5, __v_6, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_16: G = { let __values: [G; 6] = [__v_9, __v_10, __v_11, __v_12, __v_13, __v_14]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_17: G = G::from_u64(0);
+        let __ret: [G; OUT_788] = [__v_17, __v_0, __v_1, __v_2, __v_15, __v_16];
         record.function_queries[788].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
       },
@@ -66331,15 +66331,15 @@ fn aiur_fn_789(
                 match __v_15.as_canonical_u64() {
                   0u64 => {
                     let __v_20: G = G::from_u64(0);
-                    let __v_21: G = G::from_u64(0);
+                    let __v_21: G = G::from_u64(1);
                     let __v_22: G = G::from_u64(0);
-                    let __v_23: G = G::from_u64(1);
-                    let __v_24: G = { let __values: [G; 6] = [__v_22, __v_23, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_25: G = G::from_u64(0);
-                    let __v_26: G = G::from_u64(1);
-                    let __v_27: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_28: G = { let __values: [G; 6] = [__v_25, __v_26, __v_0, __v_1, __v_7, __v_27]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __ret: [G; OUT_789] = [__v_20, __v_21, __v_4, __v_5, __v_24, __v_28];
+                    let __v_23: G = { let __values: [G; 6] = [__v_22, __v_21, __v_16, __v_17, __v_18, __v_19]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_24: G = G::from_u64(1);
+                    let __v_25: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_26: G = G::from_u64(0);
+                    let __v_27: G = { let __values: [G; 6] = [__v_26, __v_24, __v_0, __v_1, __v_7, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_28: G = G::from_u64(0);
+                    let __ret: [G; OUT_789] = [__v_28, __v_20, __v_4, __v_5, __v_23, __v_27];
                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
                   },
@@ -66356,15 +66356,15 @@ fn aiur_fn_789(
                         match __v_21.as_canonical_u64() {
                           0u64 => {
                             let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(0);
+                            let __v_27: G = G::from_u64(1);
                             let __v_28: G = G::from_u64(0);
-                            let __v_29: G = G::from_u64(1);
-                            let __v_30: G = { let __values: [G; 6] = [__v_28, __v_29, __v_4, __v_5, __v_6, __v_24]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_31: G = G::from_u64(0);
-                            let __v_32: G = G::from_u64(1);
-                            let __v_33: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_34: G = { let __values: [G; 6] = [__v_31, __v_32, __v_0, __v_1, __v_25, __v_33]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_22, __v_23, __v_30, __v_34];
+                            let __v_29: G = { let __values: [G; 6] = [__v_28, __v_27, __v_4, __v_5, __v_6, __v_24]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_30: G = G::from_u64(1);
+                            let __v_31: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_32: G = G::from_u64(0);
+                            let __v_33: G = { let __values: [G; 6] = [__v_32, __v_30, __v_0, __v_1, __v_25, __v_31]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_34: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_34, __v_26, __v_22, __v_23, __v_29, __v_33];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -66385,15 +66385,15 @@ fn aiur_fn_789(
                                         match __v_27.as_canonical_u64() {
                                           0u64 => {
                                             let __v_32: G = G::from_u64(0);
-                                            let __v_33: G = G::from_u64(0);
-                                            let __v_34: G = G::from_u64(0);
-                                            let __v_35: G = G::from_u64(1);
-                                            let __v_36: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_37: G = { let __values: [G; 6] = [__v_34, __v_35, __v_0, __v_1, __v_36, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_33: G = G::from_u64(1);
+                                            let __v_34: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_35: G = G::from_u64(0);
+                                            let __v_36: G = { let __values: [G; 6] = [__v_35, __v_33, __v_0, __v_1, __v_34, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_37: G = G::from_u64(1);
                                             let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_38, __v_39, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_32, __v_33, __v_28, __v_29, __v_37, __v_40];
+                                            let __v_39: G = { let __values: [G; 6] = [__v_38, __v_37, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_40, __v_32, __v_28, __v_29, __v_36, __v_39];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
@@ -66410,35 +66410,35 @@ fn aiur_fn_789(
                                                 match __v_33.as_canonical_u64() {
                                                   0u64 => {
                                                     let __v_38: G = G::from_u64(0);
-                                                    let __v_39: G = G::from_u64(0);
-                                                    let __v_40: G = G::from_u64(0);
-                                                    let __v_41: G = G::from_u64(1);
-                                                    let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                    let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_39: G = G::from_u64(1);
+                                                    let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_41: G = G::from_u64(0);
+                                                    let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_43: G = G::from_u64(1);
                                                     let __v_44: G = G::from_u64(0);
-                                                    let __v_45: G = G::from_u64(1);
-                                                    let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                    let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                                    let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_46: G = G::from_u64(0);
+                                                    let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                     return Ok(__ret);
                                                   },
                                                   _ => {
-                                                    let __v_38: G = G::from_u64(0);
-                                                    let __v_39: G = G::from_u64(1);
-                                                    let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                    let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                    let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                                    let __v_38: G = G::from_u64(1);
+                                                    let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                    let __v_41: G = G::from_u64(0);
+                                                    let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                     return Ok(__ret);
                                                   },
                                                 }
                                               },
                                               _ => {
-                                                let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(1);
-                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                                let __v_38: G = G::from_u64(1);
+                                                let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
@@ -66459,35 +66459,35 @@ fn aiur_fn_789(
                                             match __v_33.as_canonical_u64() {
                                               0u64 => {
                                                 let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(0);
-                                                let __v_40: G = G::from_u64(0);
-                                                let __v_41: G = G::from_u64(1);
-                                                let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_39: G = G::from_u64(1);
+                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_43: G = G::from_u64(1);
                                                 let __v_44: G = G::from_u64(0);
-                                                let __v_45: G = G::from_u64(1);
-                                                let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                                let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_46: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
                                               _ => {
-                                                let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(1);
-                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                                let __v_38: G = G::from_u64(1);
+                                                let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
                                             }
                                           },
                                           _ => {
-                                            let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                            let __v_38: G = G::from_u64(1);
+                                            let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
@@ -66496,22 +66496,22 @@ fn aiur_fn_789(
                                     }
                                   },
                                   _ => {
-                                    let __v_26: G = G::from_u64(0);
-                                    let __v_27: G = G::from_u64(1);
-                                    let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                    let __v_26: G = G::from_u64(1);
+                                    let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_29: G = G::from_u64(0);
+                                    let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
                                   },
                                 }
                               },
                               _ => {
-                                let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(1);
-                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                let __v_26: G = G::from_u64(1);
+                                let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
@@ -66536,15 +66536,15 @@ fn aiur_fn_789(
                                     match __v_27.as_canonical_u64() {
                                       0u64 => {
                                         let __v_32: G = G::from_u64(0);
-                                        let __v_33: G = G::from_u64(0);
-                                        let __v_34: G = G::from_u64(0);
-                                        let __v_35: G = G::from_u64(1);
-                                        let __v_36: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_37: G = { let __values: [G; 6] = [__v_34, __v_35, __v_0, __v_1, __v_36, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_33: G = G::from_u64(1);
+                                        let __v_34: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_35: G = G::from_u64(0);
+                                        let __v_36: G = { let __values: [G; 6] = [__v_35, __v_33, __v_0, __v_1, __v_34, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_37: G = G::from_u64(1);
                                         let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(1);
-                                        let __v_40: G = { let __values: [G; 6] = [__v_38, __v_39, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_32, __v_33, __v_28, __v_29, __v_37, __v_40];
+                                        let __v_39: G = { let __values: [G; 6] = [__v_38, __v_37, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_40: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_40, __v_32, __v_28, __v_29, __v_36, __v_39];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
@@ -66561,35 +66561,35 @@ fn aiur_fn_789(
                                             match __v_33.as_canonical_u64() {
                                               0u64 => {
                                                 let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(0);
-                                                let __v_40: G = G::from_u64(0);
-                                                let __v_41: G = G::from_u64(1);
-                                                let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_39: G = G::from_u64(1);
+                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_43: G = G::from_u64(1);
                                                 let __v_44: G = G::from_u64(0);
-                                                let __v_45: G = G::from_u64(1);
-                                                let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                                let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_46: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
                                               _ => {
-                                                let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(1);
-                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                                let __v_38: G = G::from_u64(1);
+                                                let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
                                             }
                                           },
                                           _ => {
-                                            let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                            let __v_38: G = G::from_u64(1);
+                                            let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
@@ -66610,35 +66610,35 @@ fn aiur_fn_789(
                                         match __v_33.as_canonical_u64() {
                                           0u64 => {
                                             let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(0);
-                                            let __v_40: G = G::from_u64(0);
-                                            let __v_41: G = G::from_u64(1);
-                                            let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_39: G = G::from_u64(1);
+                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_43: G = G::from_u64(1);
                                             let __v_44: G = G::from_u64(0);
-                                            let __v_45: G = G::from_u64(1);
-                                            let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                            let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_46: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
                                           _ => {
-                                            let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                            let __v_38: G = G::from_u64(1);
+                                            let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
                                         }
                                       },
                                       _ => {
-                                        let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(1);
-                                        let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                        let __v_38: G = G::from_u64(1);
+                                        let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_41: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
@@ -66647,22 +66647,22 @@ fn aiur_fn_789(
                                 }
                               },
                               _ => {
-                                let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(1);
-                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                let __v_26: G = G::from_u64(1);
+                                let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
                             }
                           },
                           _ => {
-                            let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                            let __v_26: G = G::from_u64(1);
+                            let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -66685,15 +66685,15 @@ fn aiur_fn_789(
                     match __v_21.as_canonical_u64() {
                       0u64 => {
                         let __v_26: G = G::from_u64(0);
-                        let __v_27: G = G::from_u64(0);
+                        let __v_27: G = G::from_u64(1);
                         let __v_28: G = G::from_u64(0);
-                        let __v_29: G = G::from_u64(1);
-                        let __v_30: G = { let __values: [G; 6] = [__v_28, __v_29, __v_4, __v_5, __v_6, __v_24]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_31: G = G::from_u64(0);
-                        let __v_32: G = G::from_u64(1);
-                        let __v_33: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_34: G = { let __values: [G; 6] = [__v_31, __v_32, __v_0, __v_1, __v_25, __v_33]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __ret: [G; OUT_789] = [__v_26, __v_27, __v_22, __v_23, __v_30, __v_34];
+                        let __v_29: G = { let __values: [G; 6] = [__v_28, __v_27, __v_4, __v_5, __v_6, __v_24]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_30: G = G::from_u64(1);
+                        let __v_31: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_32: G = G::from_u64(0);
+                        let __v_33: G = { let __values: [G; 6] = [__v_32, __v_30, __v_0, __v_1, __v_25, __v_31]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_34: G = G::from_u64(0);
+                        let __ret: [G; OUT_789] = [__v_34, __v_26, __v_22, __v_23, __v_29, __v_33];
                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
                       },
@@ -66714,15 +66714,15 @@ fn aiur_fn_789(
                                     match __v_27.as_canonical_u64() {
                                       0u64 => {
                                         let __v_32: G = G::from_u64(0);
-                                        let __v_33: G = G::from_u64(0);
-                                        let __v_34: G = G::from_u64(0);
-                                        let __v_35: G = G::from_u64(1);
-                                        let __v_36: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_37: G = { let __values: [G; 6] = [__v_34, __v_35, __v_0, __v_1, __v_36, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_33: G = G::from_u64(1);
+                                        let __v_34: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_35: G = G::from_u64(0);
+                                        let __v_36: G = { let __values: [G; 6] = [__v_35, __v_33, __v_0, __v_1, __v_34, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_37: G = G::from_u64(1);
                                         let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(1);
-                                        let __v_40: G = { let __values: [G; 6] = [__v_38, __v_39, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_32, __v_33, __v_28, __v_29, __v_37, __v_40];
+                                        let __v_39: G = { let __values: [G; 6] = [__v_38, __v_37, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_40: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_40, __v_32, __v_28, __v_29, __v_36, __v_39];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
@@ -66739,35 +66739,35 @@ fn aiur_fn_789(
                                             match __v_33.as_canonical_u64() {
                                               0u64 => {
                                                 let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(0);
-                                                let __v_40: G = G::from_u64(0);
-                                                let __v_41: G = G::from_u64(1);
-                                                let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_39: G = G::from_u64(1);
+                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_43: G = G::from_u64(1);
                                                 let __v_44: G = G::from_u64(0);
-                                                let __v_45: G = G::from_u64(1);
-                                                let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                                let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_46: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
                                               _ => {
-                                                let __v_38: G = G::from_u64(0);
-                                                let __v_39: G = G::from_u64(1);
-                                                let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                                let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                                let __v_38: G = G::from_u64(1);
+                                                let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                                let __v_41: G = G::from_u64(0);
+                                                let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                                 return Ok(__ret);
                                               },
                                             }
                                           },
                                           _ => {
-                                            let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                            let __v_38: G = G::from_u64(1);
+                                            let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
@@ -66788,35 +66788,35 @@ fn aiur_fn_789(
                                         match __v_33.as_canonical_u64() {
                                           0u64 => {
                                             let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(0);
-                                            let __v_40: G = G::from_u64(0);
-                                            let __v_41: G = G::from_u64(1);
-                                            let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_39: G = G::from_u64(1);
+                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_43: G = G::from_u64(1);
                                             let __v_44: G = G::from_u64(0);
-                                            let __v_45: G = G::from_u64(1);
-                                            let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                            let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_46: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
                                           _ => {
-                                            let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                            let __v_38: G = G::from_u64(1);
+                                            let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
                                         }
                                       },
                                       _ => {
-                                        let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(1);
-                                        let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                        let __v_38: G = G::from_u64(1);
+                                        let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_41: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
@@ -66825,22 +66825,22 @@ fn aiur_fn_789(
                                 }
                               },
                               _ => {
-                                let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(1);
-                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                let __v_26: G = G::from_u64(1);
+                                let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
                             }
                           },
                           _ => {
-                            let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                            let __v_26: G = G::from_u64(1);
+                            let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -66865,15 +66865,15 @@ fn aiur_fn_789(
                                 match __v_27.as_canonical_u64() {
                                   0u64 => {
                                     let __v_32: G = G::from_u64(0);
-                                    let __v_33: G = G::from_u64(0);
-                                    let __v_34: G = G::from_u64(0);
-                                    let __v_35: G = G::from_u64(1);
-                                    let __v_36: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __v_37: G = { let __values: [G; 6] = [__v_34, __v_35, __v_0, __v_1, __v_36, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_33: G = G::from_u64(1);
+                                    let __v_34: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_35: G = G::from_u64(0);
+                                    let __v_36: G = { let __values: [G; 6] = [__v_35, __v_33, __v_0, __v_1, __v_34, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_37: G = G::from_u64(1);
                                     let __v_38: G = G::from_u64(0);
-                                    let __v_39: G = G::from_u64(1);
-                                    let __v_40: G = { let __values: [G; 6] = [__v_38, __v_39, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __ret: [G; OUT_789] = [__v_32, __v_33, __v_28, __v_29, __v_37, __v_40];
+                                    let __v_39: G = { let __values: [G; 6] = [__v_38, __v_37, __v_10, __v_11, __v_31, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_40: G = G::from_u64(0);
+                                    let __ret: [G; OUT_789] = [__v_40, __v_32, __v_28, __v_29, __v_36, __v_39];
                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
                                   },
@@ -66890,35 +66890,35 @@ fn aiur_fn_789(
                                         match __v_33.as_canonical_u64() {
                                           0u64 => {
                                             let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(0);
-                                            let __v_40: G = G::from_u64(0);
-                                            let __v_41: G = G::from_u64(1);
-                                            let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_39: G = G::from_u64(1);
+                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_43: G = G::from_u64(1);
                                             let __v_44: G = G::from_u64(0);
-                                            let __v_45: G = G::from_u64(1);
-                                            let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                            let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_46: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
                                           _ => {
-                                            let __v_38: G = G::from_u64(0);
-                                            let __v_39: G = G::from_u64(1);
-                                            let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                            let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                            let __v_38: G = G::from_u64(1);
+                                            let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __v_41: G = G::from_u64(0);
+                                            let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
                                           },
                                         }
                                       },
                                       _ => {
-                                        let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(1);
-                                        let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                        let __v_38: G = G::from_u64(1);
+                                        let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_41: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
@@ -66939,35 +66939,35 @@ fn aiur_fn_789(
                                     match __v_33.as_canonical_u64() {
                                       0u64 => {
                                         let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(0);
-                                        let __v_40: G = G::from_u64(0);
-                                        let __v_41: G = G::from_u64(1);
-                                        let __v_42: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_43: G = { let __values: [G; 6] = [__v_40, __v_41, __v_0, __v_1, __v_42, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_39: G = G::from_u64(1);
+                                        let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_41: G = G::from_u64(0);
+                                        let __v_42: G = { let __values: [G; 6] = [__v_41, __v_39, __v_0, __v_1, __v_40, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_43: G = G::from_u64(1);
                                         let __v_44: G = G::from_u64(0);
-                                        let __v_45: G = G::from_u64(1);
-                                        let __v_46: G = { let __values: [G; 6] = [__v_44, __v_45, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_38, __v_39, __v_10, __v_11, __v_43, __v_46];
+                                        let __v_45: G = { let __values: [G; 6] = [__v_44, __v_43, __v_34, __v_35, __v_36, __v_37]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_46: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_46, __v_38, __v_10, __v_11, __v_42, __v_45];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
                                       _ => {
-                                        let __v_38: G = G::from_u64(0);
-                                        let __v_39: G = G::from_u64(1);
-                                        let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                        let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                        let __v_38: G = G::from_u64(1);
+                                        let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __v_41: G = G::from_u64(0);
+                                        let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
                                       },
                                     }
                                   },
                                   _ => {
-                                    let __v_38: G = G::from_u64(0);
-                                    let __v_39: G = G::from_u64(1);
-                                    let __v_40: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __v_41: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __ret: [G; OUT_789] = [__v_38, __v_39, __v_0, __v_1, __v_40, __v_41];
+                                    let __v_38: G = G::from_u64(1);
+                                    let __v_39: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_40: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_41: G = G::from_u64(0);
+                                    let __ret: [G; OUT_789] = [__v_41, __v_38, __v_0, __v_1, __v_39, __v_40];
                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
                                   },
@@ -66976,22 +66976,22 @@ fn aiur_fn_789(
                             }
                           },
                           _ => {
-                            let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                            let __v_26: G = G::from_u64(1);
+                            let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                         }
                       },
                       _ => {
-                        let __v_26: G = G::from_u64(0);
-                        let __v_27: G = G::from_u64(1);
-                        let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                        let __v_26: G = G::from_u64(1);
+                        let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_29: G = G::from_u64(0);
+                        let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
                       },
@@ -67018,15 +67018,15 @@ fn aiur_fn_789(
                         match __v_15.as_canonical_u64() {
                           0u64 => {
                             let __v_20: G = G::from_u64(0);
-                            let __v_21: G = G::from_u64(0);
-                            let __v_22: G = G::from_u64(0);
-                            let __v_23: G = G::from_u64(1);
-                            let __v_24: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_25: G = { let __values: [G; 6] = [__v_22, __v_23, __v_0, __v_1, __v_24, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_21: G = G::from_u64(1);
+                            let __v_22: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_23: G = G::from_u64(0);
+                            let __v_24: G = { let __values: [G; 6] = [__v_23, __v_21, __v_0, __v_1, __v_22, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_25: G = G::from_u64(1);
                             let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_26, __v_27, __v_10, __v_11, __v_19, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_20, __v_21, __v_16, __v_17, __v_25, __v_28];
+                            let __v_27: G = { let __values: [G; 6] = [__v_26, __v_25, __v_10, __v_11, __v_19, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_28, __v_20, __v_16, __v_17, __v_24, __v_27];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -67043,35 +67043,35 @@ fn aiur_fn_789(
                                 match __v_21.as_canonical_u64() {
                                   0u64 => {
                                     let __v_26: G = G::from_u64(0);
-                                    let __v_27: G = G::from_u64(0);
-                                    let __v_28: G = G::from_u64(0);
-                                    let __v_29: G = G::from_u64(1);
-                                    let __v_30: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __v_31: G = { let __values: [G; 6] = [__v_28, __v_29, __v_0, __v_1, __v_30, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_27: G = G::from_u64(1);
+                                    let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_29: G = G::from_u64(0);
+                                    let __v_30: G = { let __values: [G; 6] = [__v_29, __v_27, __v_0, __v_1, __v_28, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_31: G = G::from_u64(1);
                                     let __v_32: G = G::from_u64(0);
-                                    let __v_33: G = G::from_u64(1);
-                                    let __v_34: G = { let __values: [G; 6] = [__v_32, __v_33, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __ret: [G; OUT_789] = [__v_26, __v_27, __v_10, __v_11, __v_31, __v_34];
+                                    let __v_33: G = { let __values: [G; 6] = [__v_32, __v_31, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_34: G = G::from_u64(0);
+                                    let __ret: [G; OUT_789] = [__v_34, __v_26, __v_10, __v_11, __v_30, __v_33];
                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
                                   },
                                   _ => {
-                                    let __v_26: G = G::from_u64(0);
-                                    let __v_27: G = G::from_u64(1);
-                                    let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                    let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                    let __v_26: G = G::from_u64(1);
+                                    let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                    let __v_29: G = G::from_u64(0);
+                                    let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                     return Ok(__ret);
                                   },
                                 }
                               },
                               _ => {
-                                let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(1);
-                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                let __v_26: G = G::from_u64(1);
+                                let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
@@ -67092,35 +67092,35 @@ fn aiur_fn_789(
                             match __v_21.as_canonical_u64() {
                               0u64 => {
                                 let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(0);
-                                let __v_28: G = G::from_u64(0);
-                                let __v_29: G = G::from_u64(1);
-                                let __v_30: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_31: G = { let __values: [G; 6] = [__v_28, __v_29, __v_0, __v_1, __v_30, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_27: G = G::from_u64(1);
+                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __v_30: G = { let __values: [G; 6] = [__v_29, __v_27, __v_0, __v_1, __v_28, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_31: G = G::from_u64(1);
                                 let __v_32: G = G::from_u64(0);
-                                let __v_33: G = G::from_u64(1);
-                                let __v_34: G = { let __values: [G; 6] = [__v_32, __v_33, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_10, __v_11, __v_31, __v_34];
+                                let __v_33: G = { let __values: [G; 6] = [__v_32, __v_31, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_34: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_34, __v_26, __v_10, __v_11, __v_30, __v_33];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
                               _ => {
-                                let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(1);
-                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                let __v_26: G = G::from_u64(1);
+                                let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
                             }
                           },
                           _ => {
-                            let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                            let __v_26: G = G::from_u64(1);
+                            let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -67129,22 +67129,22 @@ fn aiur_fn_789(
                     }
                   },
                   _ => {
-                    let __v_14: G = G::from_u64(0);
-                    let __v_15: G = G::from_u64(1);
-                    let __v_16: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_17: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __ret: [G; OUT_789] = [__v_14, __v_15, __v_0, __v_1, __v_16, __v_17];
+                    let __v_14: G = G::from_u64(1);
+                    let __v_15: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_16: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_17: G = G::from_u64(0);
+                    let __ret: [G; OUT_789] = [__v_17, __v_14, __v_0, __v_1, __v_15, __v_16];
                     record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
                   },
                 }
               },
               _ => {
-                let __v_14: G = G::from_u64(0);
-                let __v_15: G = G::from_u64(1);
-                let __v_16: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_17: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __ret: [G; OUT_789] = [__v_14, __v_15, __v_0, __v_1, __v_16, __v_17];
+                let __v_14: G = G::from_u64(1);
+                let __v_15: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_16: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = G::from_u64(0);
+                let __ret: [G; OUT_789] = [__v_17, __v_14, __v_0, __v_1, __v_15, __v_16];
                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
               },
@@ -67169,15 +67169,15 @@ fn aiur_fn_789(
                     match __v_15.as_canonical_u64() {
                       0u64 => {
                         let __v_20: G = G::from_u64(0);
-                        let __v_21: G = G::from_u64(0);
-                        let __v_22: G = G::from_u64(0);
-                        let __v_23: G = G::from_u64(1);
-                        let __v_24: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_25: G = { let __values: [G; 6] = [__v_22, __v_23, __v_0, __v_1, __v_24, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_21: G = G::from_u64(1);
+                        let __v_22: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_23: G = G::from_u64(0);
+                        let __v_24: G = { let __values: [G; 6] = [__v_23, __v_21, __v_0, __v_1, __v_22, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_25: G = G::from_u64(1);
                         let __v_26: G = G::from_u64(0);
-                        let __v_27: G = G::from_u64(1);
-                        let __v_28: G = { let __values: [G; 6] = [__v_26, __v_27, __v_10, __v_11, __v_19, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __ret: [G; OUT_789] = [__v_20, __v_21, __v_16, __v_17, __v_25, __v_28];
+                        let __v_27: G = { let __values: [G; 6] = [__v_26, __v_25, __v_10, __v_11, __v_19, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_28: G = G::from_u64(0);
+                        let __ret: [G; OUT_789] = [__v_28, __v_20, __v_16, __v_17, __v_24, __v_27];
                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
                       },
@@ -67194,35 +67194,35 @@ fn aiur_fn_789(
                             match __v_21.as_canonical_u64() {
                               0u64 => {
                                 let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(0);
-                                let __v_28: G = G::from_u64(0);
-                                let __v_29: G = G::from_u64(1);
-                                let __v_30: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_31: G = { let __values: [G; 6] = [__v_28, __v_29, __v_0, __v_1, __v_30, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_27: G = G::from_u64(1);
+                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __v_30: G = { let __values: [G; 6] = [__v_29, __v_27, __v_0, __v_1, __v_28, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_31: G = G::from_u64(1);
                                 let __v_32: G = G::from_u64(0);
-                                let __v_33: G = G::from_u64(1);
-                                let __v_34: G = { let __values: [G; 6] = [__v_32, __v_33, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_10, __v_11, __v_31, __v_34];
+                                let __v_33: G = { let __values: [G; 6] = [__v_32, __v_31, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_34: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_34, __v_26, __v_10, __v_11, __v_30, __v_33];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
                               _ => {
-                                let __v_26: G = G::from_u64(0);
-                                let __v_27: G = G::from_u64(1);
-                                let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                                let __v_26: G = G::from_u64(1);
+                                let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __v_29: G = G::from_u64(0);
+                                let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
                             }
                           },
                           _ => {
-                            let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                            let __v_26: G = G::from_u64(1);
+                            let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -67243,35 +67243,35 @@ fn aiur_fn_789(
                         match __v_21.as_canonical_u64() {
                           0u64 => {
                             let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(0);
-                            let __v_28: G = G::from_u64(0);
-                            let __v_29: G = G::from_u64(1);
-                            let __v_30: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_31: G = { let __values: [G; 6] = [__v_28, __v_29, __v_0, __v_1, __v_30, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_27: G = G::from_u64(1);
+                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __v_30: G = { let __values: [G; 6] = [__v_29, __v_27, __v_0, __v_1, __v_28, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_31: G = G::from_u64(1);
                             let __v_32: G = G::from_u64(0);
-                            let __v_33: G = G::from_u64(1);
-                            let __v_34: G = { let __values: [G; 6] = [__v_32, __v_33, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_10, __v_11, __v_31, __v_34];
+                            let __v_33: G = { let __values: [G; 6] = [__v_32, __v_31, __v_22, __v_23, __v_24, __v_25]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_34: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_34, __v_26, __v_10, __v_11, __v_30, __v_33];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                           _ => {
-                            let __v_26: G = G::from_u64(0);
-                            let __v_27: G = G::from_u64(1);
-                            let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                            let __v_26: G = G::from_u64(1);
+                            let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_29: G = G::from_u64(0);
+                            let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                         }
                       },
                       _ => {
-                        let __v_26: G = G::from_u64(0);
-                        let __v_27: G = G::from_u64(1);
-                        let __v_28: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_29: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __ret: [G; OUT_789] = [__v_26, __v_27, __v_0, __v_1, __v_28, __v_29];
+                        let __v_26: G = G::from_u64(1);
+                        let __v_27: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_28: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_29: G = G::from_u64(0);
+                        let __ret: [G; OUT_789] = [__v_29, __v_26, __v_0, __v_1, __v_27, __v_28];
                         record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
                       },
@@ -67280,22 +67280,22 @@ fn aiur_fn_789(
                 }
               },
               _ => {
-                let __v_14: G = G::from_u64(0);
-                let __v_15: G = G::from_u64(1);
-                let __v_16: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_17: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __ret: [G; OUT_789] = [__v_14, __v_15, __v_0, __v_1, __v_16, __v_17];
+                let __v_14: G = G::from_u64(1);
+                let __v_15: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_16: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = G::from_u64(0);
+                let __ret: [G; OUT_789] = [__v_17, __v_14, __v_0, __v_1, __v_15, __v_16];
                 record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
               },
             }
           },
           _ => {
-            let __v_14: G = G::from_u64(0);
-            let __v_15: G = G::from_u64(1);
-            let __v_16: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_17: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __ret: [G; OUT_789] = [__v_14, __v_15, __v_0, __v_1, __v_16, __v_17];
+            let __v_14: G = G::from_u64(1);
+            let __v_15: G = { let __values: [G; 6] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_11, __v_12, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_17: G = G::from_u64(0);
+            let __ret: [G; OUT_789] = [__v_17, __v_14, __v_0, __v_1, __v_15, __v_16];
             record.function_queries[789].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
diff --git a/crates/ixvm-codegen/src/aiur_ixvm_witness.rs b/crates/ixvm-codegen/src/aiur_ixvm_witness.rs
index 67d3a95c5..b6ac6a561 100644
--- a/crates/ixvm-codegen/src/aiur_ixvm_witness.rs
+++ b/crates/ixvm-codegen/src/aiur_ixvm_witness.rs
@@ -239,7 +239,7 @@ pub fn build_claim_check_witness(
 /// Every primitive address the kernel can name, as the Lean seeder sees
 /// them: the parity table plus the reserved reduction markers. Built from
 /// `ix_common::prim_addrs::PrimAddrs`, which the `prim-addrs` parity test
-/// pins against `Ix.Tc.PrimAddrs`, so both seeders cover the same set by
+/// pins against `Ix.Kernel.PrimAddrs`, so both seeders cover the same set by
 /// construction.
 fn prim_addrs() -> Vec<Address> {
   let mut v: Vec<Address> = PrimAddrs::lean_parity_table()
diff --git a/crates/ixvm-codegen/src/aiur_multi_stark.rs b/crates/ixvm-codegen/src/aiur_multi_stark.rs
index 4fc87a632..7be8c34aa 100644
--- a/crates/ixvm-codegen/src/aiur_multi_stark.rs
+++ b/crates/ixvm-codegen/src/aiur_multi_stark.rs
@@ -1108,44 +1108,44 @@ fn aiur_fn_16(
     if !unconstrained { let __vi = __v_3; let __vj = __v_4; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_5; let __vj = __v_6; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_7; let __vj = __v_8; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_9: G = G::from_u64(1020);
-    let __v_10: G = (__v_8 - __v_9);
-    let __v_11: G = (__v_7 + __v_10);
-    let __v_12: G = (__v_6 + __v_11);
-    let __v_13: G = (__v_5 + __v_12);
-    let __v_14: G = G::from_bool((__v_13 == G::ZERO));
-    let __v_15: G = (__v_3 + __v_4);
-    let __v_16: G = (__v_2 + __v_15);
-    let __v_17: G = (__v_1 + __v_16);
-    let __v_18: G = G::from_bool((__v_17 == G::ZERO));
-    let __v_19: G = G::from_u64(256);
-    let __v_20: G = (__v_19 * __v_2);
-    let __v_21: G = G::from_u64(65536);
-    let __v_22: G = (__v_21 * __v_3);
-    let __v_23: G = G::from_u64(16777216);
-    let __v_24: G = (__v_23 * __v_4);
-    let __v_25: G = G::from_u64(4294967296);
-    let __v_26: G = (__v_25 * __v_5);
-    let __v_27: G = G::from_u64(1099511627776);
-    let __v_28: G = (__v_27 * __v_6);
-    let __v_29: G = G::from_u64(281474976710656);
-    let __v_30: G = (__v_29 * __v_7);
-    let __v_31: G = G::from_u64(72057594037927936);
-    let __v_32: G = (__v_31 * __v_8);
-    let __v_33: G = (__v_30 + __v_32);
-    let __v_34: G = (__v_28 + __v_33);
-    let __v_35: G = (__v_26 + __v_34);
-    let __v_36: G = (__v_24 + __v_35);
-    let __v_37: G = (__v_22 + __v_36);
-    let __v_38: G = (__v_20 + __v_37);
-    let __v_39: G = (__v_1 + __v_38);
-    if (__v_39 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
+    let __v_9: G = G::from_u64(256);
+    let __v_10: G = (__v_9 * __v_2);
+    let __v_11: G = G::from_u64(65536);
+    let __v_12: G = (__v_11 * __v_3);
+    let __v_13: G = G::from_u64(16777216);
+    let __v_14: G = (__v_13 * __v_4);
+    let __v_15: G = G::from_u64(4294967296);
+    let __v_16: G = (__v_15 * __v_5);
+    let __v_17: G = G::from_u64(1099511627776);
+    let __v_18: G = (__v_17 * __v_6);
+    let __v_19: G = G::from_u64(281474976710656);
+    let __v_20: G = (__v_19 * __v_7);
+    let __v_21: G = G::from_u64(72057594037927936);
+    let __v_22: G = (__v_21 * __v_8);
+    let __v_23: G = (__v_20 + __v_22);
+    let __v_24: G = (__v_18 + __v_23);
+    let __v_25: G = (__v_16 + __v_24);
+    let __v_26: G = (__v_14 + __v_25);
+    let __v_27: G = (__v_12 + __v_26);
+    let __v_28: G = (__v_10 + __v_27);
+    let __v_29: G = (__v_1 + __v_28);
+    if (__v_29 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_29.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
     }
+    let __v_30: G = G::from_u64(1020);
+    let __v_31: G = (__v_8 - __v_30);
+    let __v_32: G = (__v_7 + __v_31);
+    let __v_33: G = (__v_6 + __v_32);
+    let __v_34: G = (__v_5 + __v_33);
+    let __v_35: G = G::from_bool((__v_34 == G::ZERO));
+    let __v_36: G = (__v_3 + __v_4);
+    let __v_37: G = (__v_2 + __v_36);
+    let __v_38: G = (__v_1 + __v_37);
+    let __v_39: G = G::from_bool((__v_38 == G::ZERO));
     let __v_40: G = G::from_u64(1);
     let __v_41: G = G::from_u64(1);
-    let __v_42: G = (__v_41 - __v_18);
-    let __v_43: G = (__v_14 * __v_42);
+    let __v_42: G = (__v_41 - __v_39);
+    let __v_43: G = (__v_35 * __v_42);
     let __v_44: G = (__v_40 - __v_43);
     let __v_45: G = G::from_u64(1);
     if (__v_44 != __v_45) {
@@ -2067,9 +2067,9 @@ fn aiur_fn_40(
         let __r_arr: [G; OUT_40] = { let __args: [G; IN_40] = [__v_37, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[40].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[40].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[40].bump_multiplicity(__i); } let __ret: [G; OUT_40] = unsafe { *(record.function_queries[40].output_at(__i).as_ptr() as *const [G; OUT_40]) }; __ret }, _ => aiur_fn_40(__args, record, io_buffer, __cu)? } };
         let __v_40: G = __r_arr[0];
         let __v_41: G = __r_arr[1];
-        let __v_42: G = G::from_u64(0);
-        let __v_43: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_44: G = { let __values: [G; 3] = [__v_42, __v_43, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_42: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_43: G = G::from_u64(0);
+        let __v_44: G = { let __values: [G; 3] = [__v_43, __v_42, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_40] = [__v_44, __v_41];
         record.function_queries[40].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -4552,7 +4552,7 @@ fn aiur_fn_70(
       _ => {
         let __v_2: G = G::from_u64(0);
         let __v_3: G = G::from_u64(0);
-        let __v_4: G = { let __values: [G; 3] = [__v_2, __v_3, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = { let __values: [G; 3] = [__v_3, __v_2, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_5: G = G::from_u64(1);
         let __v_6: G = (__v_1 - __v_5);
         let __r_arr: [G; OUT_70] = { let __args: [G; IN_70] = [__v_4, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[70].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[70].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[70].bump_multiplicity(__i); } let __ret: [G; OUT_70] = unsafe { *(record.function_queries[70].output_at(__i).as_ptr() as *const [G; OUT_70]) }; __ret }, _ => aiur_fn_70(__args, record, io_buffer, __cu)? } };
@@ -4745,41 +4745,41 @@ fn aiur_fn_71(
                                             let __v_144: G = G::from_u64(0);
                                             let __v_145: G = G::from_u64(0);
                                             let __v_146: G = G::from_u64(0);
-                                            let __v_147: G = G::from_u64(0);
-                                            let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_147, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_140, __v_141, __v_142, __v_18, __v_143, __v_144, __v_145, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-                                            let __v_148: G = __r_arr[0];
-                                            let __v_149: G = __r_arr[1];
-                                            let __v_150: G = __r_arr[2];
-                                            let __v_151: G = __r_arr[3];
-                                            let __v_152: G = __r_arr[4];
-                                            let __v_153: G = __r_arr[5];
-                                            let __v_154: G = __r_arr[6];
-                                            let __v_155: G = __r_arr[7];
-                                            let __v_156: G = __r_arr[8];
-                                            let __v_157: G = __r_arr[9];
-                                            let __v_158: G = __r_arr[10];
-                                            let __v_159: G = __r_arr[11];
-                                            let __v_160: G = __r_arr[12];
-                                            let __v_161: G = __r_arr[13];
-                                            let __v_162: G = __r_arr[14];
-                                            let __v_163: G = __r_arr[15];
-                                            let __v_164: G = __r_arr[16];
-                                            let __v_165: G = __r_arr[17];
-                                            let __v_166: G = __r_arr[18];
-                                            let __v_167: G = __r_arr[19];
-                                            let __v_168: G = __r_arr[20];
-                                            let __v_169: G = __r_arr[21];
-                                            let __v_170: G = __r_arr[22];
-                                            let __v_171: G = __r_arr[23];
-                                            let __v_172: G = __r_arr[24];
-                                            let __v_173: G = __r_arr[25];
-                                            let __v_174: G = __r_arr[26];
-                                            let __v_175: G = __r_arr[27];
-                                            let __v_176: G = __r_arr[28];
-                                            let __v_177: G = __r_arr[29];
-                                            let __v_178: G = __r_arr[30];
-                                            let __v_179: G = __r_arr[31];
-                                            let __v_180: G = { let __values: [G; 34] = [__v_146, __v_5, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                            let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_146, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_140, __v_141, __v_142, __v_18, __v_143, __v_144, __v_145, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+                                            let __v_147: G = __r_arr[0];
+                                            let __v_148: G = __r_arr[1];
+                                            let __v_149: G = __r_arr[2];
+                                            let __v_150: G = __r_arr[3];
+                                            let __v_151: G = __r_arr[4];
+                                            let __v_152: G = __r_arr[5];
+                                            let __v_153: G = __r_arr[6];
+                                            let __v_154: G = __r_arr[7];
+                                            let __v_155: G = __r_arr[8];
+                                            let __v_156: G = __r_arr[9];
+                                            let __v_157: G = __r_arr[10];
+                                            let __v_158: G = __r_arr[11];
+                                            let __v_159: G = __r_arr[12];
+                                            let __v_160: G = __r_arr[13];
+                                            let __v_161: G = __r_arr[14];
+                                            let __v_162: G = __r_arr[15];
+                                            let __v_163: G = __r_arr[16];
+                                            let __v_164: G = __r_arr[17];
+                                            let __v_165: G = __r_arr[18];
+                                            let __v_166: G = __r_arr[19];
+                                            let __v_167: G = __r_arr[20];
+                                            let __v_168: G = __r_arr[21];
+                                            let __v_169: G = __r_arr[22];
+                                            let __v_170: G = __r_arr[23];
+                                            let __v_171: G = __r_arr[24];
+                                            let __v_172: G = __r_arr[25];
+                                            let __v_173: G = __r_arr[26];
+                                            let __v_174: G = __r_arr[27];
+                                            let __v_175: G = __r_arr[28];
+                                            let __v_176: G = __r_arr[29];
+                                            let __v_177: G = __r_arr[30];
+                                            let __v_178: G = __r_arr[31];
+                                            let __v_179: G = G::from_u64(0);
+                                            let __v_180: G = { let __values: [G; 34] = [__v_179, __v_5, __v_147, __v_148, __v_149, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                             let __ret: [G; OUT_71] = [__v_180];
                                             record.function_queries[71].finish(&inp[..], &__ret[..], !unconstrained);
                                             return Ok(__ret);
@@ -4841,41 +4841,41 @@ fn aiur_fn_71(
             }
           },
           _ => {
-            let __v_9: G = G::from_u64(0);
             let __loaded: [G; 32] = { let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; let __ptr_u64 = __v_4.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 32 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 32] = __args[..32].try_into().unwrap(); __arr };
-            let __v_10: G = __loaded[0];
-            let __v_11: G = __loaded[1];
-            let __v_12: G = __loaded[2];
-            let __v_13: G = __loaded[3];
-            let __v_14: G = __loaded[4];
-            let __v_15: G = __loaded[5];
-            let __v_16: G = __loaded[6];
-            let __v_17: G = __loaded[7];
-            let __v_18: G = __loaded[8];
-            let __v_19: G = __loaded[9];
-            let __v_20: G = __loaded[10];
-            let __v_21: G = __loaded[11];
-            let __v_22: G = __loaded[12];
-            let __v_23: G = __loaded[13];
-            let __v_24: G = __loaded[14];
-            let __v_25: G = __loaded[15];
-            let __v_26: G = __loaded[16];
-            let __v_27: G = __loaded[17];
-            let __v_28: G = __loaded[18];
-            let __v_29: G = __loaded[19];
-            let __v_30: G = __loaded[20];
-            let __v_31: G = __loaded[21];
-            let __v_32: G = __loaded[22];
-            let __v_33: G = __loaded[23];
-            let __v_34: G = __loaded[24];
-            let __v_35: G = __loaded[25];
-            let __v_36: G = __loaded[26];
-            let __v_37: G = __loaded[27];
-            let __v_38: G = __loaded[28];
-            let __v_39: G = __loaded[29];
-            let __v_40: G = __loaded[30];
-            let __v_41: G = __loaded[31];
-            let __v_42: G = { let __values: [G; 34] = [__v_9, __v_5, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_9: G = __loaded[0];
+            let __v_10: G = __loaded[1];
+            let __v_11: G = __loaded[2];
+            let __v_12: G = __loaded[3];
+            let __v_13: G = __loaded[4];
+            let __v_14: G = __loaded[5];
+            let __v_15: G = __loaded[6];
+            let __v_16: G = __loaded[7];
+            let __v_17: G = __loaded[8];
+            let __v_18: G = __loaded[9];
+            let __v_19: G = __loaded[10];
+            let __v_20: G = __loaded[11];
+            let __v_21: G = __loaded[12];
+            let __v_22: G = __loaded[13];
+            let __v_23: G = __loaded[14];
+            let __v_24: G = __loaded[15];
+            let __v_25: G = __loaded[16];
+            let __v_26: G = __loaded[17];
+            let __v_27: G = __loaded[18];
+            let __v_28: G = __loaded[19];
+            let __v_29: G = __loaded[20];
+            let __v_30: G = __loaded[21];
+            let __v_31: G = __loaded[22];
+            let __v_32: G = __loaded[23];
+            let __v_33: G = __loaded[24];
+            let __v_34: G = __loaded[25];
+            let __v_35: G = __loaded[26];
+            let __v_36: G = __loaded[27];
+            let __v_37: G = __loaded[28];
+            let __v_38: G = __loaded[29];
+            let __v_39: G = __loaded[30];
+            let __v_40: G = __loaded[31];
+            let __v_41: G = G::from_u64(0);
+            let __v_42: G = { let __values: [G; 34] = [__v_41, __v_5, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_71] = [__v_42];
             record.function_queries[71].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -5034,41 +5034,41 @@ fn aiur_fn_71(
         let __v_151: G = G::from_u64(0);
         let __v_152: G = G::from_u64(0);
         let __v_153: G = G::from_u64(0);
-        let __v_154: G = G::from_u64(0);
-        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_154, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_1, __v_147, __v_148, __v_149, __v_23, __v_150, __v_151, __v_152, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-        let __v_155: G = __r_arr[0];
-        let __v_156: G = __r_arr[1];
-        let __v_157: G = __r_arr[2];
-        let __v_158: G = __r_arr[3];
-        let __v_159: G = __r_arr[4];
-        let __v_160: G = __r_arr[5];
-        let __v_161: G = __r_arr[6];
-        let __v_162: G = __r_arr[7];
-        let __v_163: G = __r_arr[8];
-        let __v_164: G = __r_arr[9];
-        let __v_165: G = __r_arr[10];
-        let __v_166: G = __r_arr[11];
-        let __v_167: G = __r_arr[12];
-        let __v_168: G = __r_arr[13];
-        let __v_169: G = __r_arr[14];
-        let __v_170: G = __r_arr[15];
-        let __v_171: G = __r_arr[16];
-        let __v_172: G = __r_arr[17];
-        let __v_173: G = __r_arr[18];
-        let __v_174: G = __r_arr[19];
-        let __v_175: G = __r_arr[20];
-        let __v_176: G = __r_arr[21];
-        let __v_177: G = __r_arr[22];
-        let __v_178: G = __r_arr[23];
-        let __v_179: G = __r_arr[24];
-        let __v_180: G = __r_arr[25];
-        let __v_181: G = __r_arr[26];
-        let __v_182: G = __r_arr[27];
-        let __v_183: G = __r_arr[28];
-        let __v_184: G = __r_arr[29];
-        let __v_185: G = __r_arr[30];
-        let __v_186: G = __r_arr[31];
-        let __v_187: G = { let __values: [G; 34] = [__v_153, __v_5, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_153, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_122, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_1, __v_147, __v_148, __v_149, __v_23, __v_150, __v_151, __v_152, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+        let __v_154: G = __r_arr[0];
+        let __v_155: G = __r_arr[1];
+        let __v_156: G = __r_arr[2];
+        let __v_157: G = __r_arr[3];
+        let __v_158: G = __r_arr[4];
+        let __v_159: G = __r_arr[5];
+        let __v_160: G = __r_arr[6];
+        let __v_161: G = __r_arr[7];
+        let __v_162: G = __r_arr[8];
+        let __v_163: G = __r_arr[9];
+        let __v_164: G = __r_arr[10];
+        let __v_165: G = __r_arr[11];
+        let __v_166: G = __r_arr[12];
+        let __v_167: G = __r_arr[13];
+        let __v_168: G = __r_arr[14];
+        let __v_169: G = __r_arr[15];
+        let __v_170: G = __r_arr[16];
+        let __v_171: G = __r_arr[17];
+        let __v_172: G = __r_arr[18];
+        let __v_173: G = __r_arr[19];
+        let __v_174: G = __r_arr[20];
+        let __v_175: G = __r_arr[21];
+        let __v_176: G = __r_arr[22];
+        let __v_177: G = __r_arr[23];
+        let __v_178: G = __r_arr[24];
+        let __v_179: G = __r_arr[25];
+        let __v_180: G = __r_arr[26];
+        let __v_181: G = __r_arr[27];
+        let __v_182: G = __r_arr[28];
+        let __v_183: G = __r_arr[29];
+        let __v_184: G = __r_arr[30];
+        let __v_185: G = __r_arr[31];
+        let __v_186: G = G::from_u64(0);
+        let __v_187: G = { let __values: [G; 34] = [__v_186, __v_5, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_71] = [__v_187];
         record.function_queries[71].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -5277,41 +5277,41 @@ fn aiur_fn_72(
         let __v_179: G = G::from_u64(0);
         let __v_180: G = G::from_u64(0);
         let __v_181: G = G::from_u64(0);
-        let __v_182: G = G::from_u64(0);
-        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_182, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_175, __v_176, __v_177, __v_85, __v_178, __v_179, __v_180, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-        let __v_183: G = __r_arr[0];
-        let __v_184: G = __r_arr[1];
-        let __v_185: G = __r_arr[2];
-        let __v_186: G = __r_arr[3];
-        let __v_187: G = __r_arr[4];
-        let __v_188: G = __r_arr[5];
-        let __v_189: G = __r_arr[6];
-        let __v_190: G = __r_arr[7];
-        let __v_191: G = __r_arr[8];
-        let __v_192: G = __r_arr[9];
-        let __v_193: G = __r_arr[10];
-        let __v_194: G = __r_arr[11];
-        let __v_195: G = __r_arr[12];
-        let __v_196: G = __r_arr[13];
-        let __v_197: G = __r_arr[14];
-        let __v_198: G = __r_arr[15];
-        let __v_199: G = __r_arr[16];
-        let __v_200: G = __r_arr[17];
-        let __v_201: G = __r_arr[18];
-        let __v_202: G = __r_arr[19];
-        let __v_203: G = __r_arr[20];
-        let __v_204: G = __r_arr[21];
-        let __v_205: G = __r_arr[22];
-        let __v_206: G = __r_arr[23];
-        let __v_207: G = __r_arr[24];
-        let __v_208: G = __r_arr[25];
-        let __v_209: G = __r_arr[26];
-        let __v_210: G = __r_arr[27];
-        let __v_211: G = __r_arr[28];
-        let __v_212: G = __r_arr[29];
-        let __v_213: G = __r_arr[30];
-        let __v_214: G = __r_arr[31];
-        let __v_215: G = { let __values: [G; 34] = [__v_181, __v_5, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_181, __v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_149, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_150, __v_151, __v_152, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_175, __v_176, __v_177, __v_85, __v_178, __v_179, __v_180, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+        let __v_182: G = __r_arr[0];
+        let __v_183: G = __r_arr[1];
+        let __v_184: G = __r_arr[2];
+        let __v_185: G = __r_arr[3];
+        let __v_186: G = __r_arr[4];
+        let __v_187: G = __r_arr[5];
+        let __v_188: G = __r_arr[6];
+        let __v_189: G = __r_arr[7];
+        let __v_190: G = __r_arr[8];
+        let __v_191: G = __r_arr[9];
+        let __v_192: G = __r_arr[10];
+        let __v_193: G = __r_arr[11];
+        let __v_194: G = __r_arr[12];
+        let __v_195: G = __r_arr[13];
+        let __v_196: G = __r_arr[14];
+        let __v_197: G = __r_arr[15];
+        let __v_198: G = __r_arr[16];
+        let __v_199: G = __r_arr[17];
+        let __v_200: G = __r_arr[18];
+        let __v_201: G = __r_arr[19];
+        let __v_202: G = __r_arr[20];
+        let __v_203: G = __r_arr[21];
+        let __v_204: G = __r_arr[22];
+        let __v_205: G = __r_arr[23];
+        let __v_206: G = __r_arr[24];
+        let __v_207: G = __r_arr[25];
+        let __v_208: G = __r_arr[26];
+        let __v_209: G = __r_arr[27];
+        let __v_210: G = __r_arr[28];
+        let __v_211: G = __r_arr[29];
+        let __v_212: G = __r_arr[30];
+        let __v_213: G = __r_arr[31];
+        let __v_214: G = G::from_u64(0);
+        let __v_215: G = { let __values: [G; 34] = [__v_214, __v_5, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_216: G = G::from_u64(1);
         let __v_217: G = G::from_u64(1);
         let __v_218: G = { let __values: [G; 3] = [__v_216, __v_217, __v_217]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -8196,9 +8196,9 @@ fn aiur_fn_85(
         let __r_arr: [G; OUT_85] = { let __args: [G; IN_85] = [__v_37, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[85].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[85].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[85].bump_multiplicity(__i); } let __ret: [G; OUT_85] = unsafe { *(record.function_queries[85].output_at(__i).as_ptr() as *const [G; OUT_85]) }; __ret }, _ => aiur_fn_85(__args, record, io_buffer, __cu)? } };
         let __v_40: G = __r_arr[0];
         let __v_41: G = __r_arr[1];
-        let __v_42: G = G::from_u64(0);
-        let __v_43: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_44: G = { let __values: [G; 3] = [__v_42, __v_43, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_42: G = { let __values: [G; 32] = [__v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_43: G = G::from_u64(0);
+        let __v_44: G = { let __values: [G; 3] = [__v_43, __v_42, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_85] = [__v_44, __v_41];
         record.function_queries[85].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -8245,7 +8245,7 @@ fn aiur_fn_86(
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8262,7 +8262,7 @@ fn aiur_fn_86(
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8276,10 +8276,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(2);
+            let __v_10: G = G::from_u64(2);
+            let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8290,10 +8290,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_3, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_6: G = __r_arr[0];
             let __v_7: G = __r_arr[1];
-            let __v_8: G = G::from_u64(0);
+            let __v_8: G = G::from_u64(3);
             let __v_9: G = G::from_u64(3);
-            let __v_10: G = G::from_u64(3);
-            let __v_11: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_10, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(0);
+            let __v_11: G = { let __values: [G; 6] = [__v_10, __v_8, __v_9, __v_9, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_11, __v_7];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8304,10 +8304,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_3, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_6: G = __r_arr[0];
             let __v_7: G = __r_arr[1];
-            let __v_8: G = G::from_u64(0);
+            let __v_8: G = G::from_u64(4);
             let __v_9: G = G::from_u64(4);
-            let __v_10: G = G::from_u64(4);
-            let __v_11: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_10, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(0);
+            let __v_11: G = { let __values: [G; 6] = [__v_10, __v_8, __v_9, __v_9, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_11, __v_7];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8318,10 +8318,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_3, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_6: G = __r_arr[0];
             let __v_7: G = __r_arr[1];
-            let __v_8: G = G::from_u64(0);
+            let __v_8: G = G::from_u64(5);
             let __v_9: G = G::from_u64(5);
-            let __v_10: G = G::from_u64(5);
-            let __v_11: G = { let __values: [G; 6] = [__v_8, __v_9, __v_10, __v_10, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(0);
+            let __v_11: G = { let __values: [G; 6] = [__v_10, __v_8, __v_9, __v_9, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_11, __v_7];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8338,10 +8338,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
             let __v_11: G = __r_arr[1];
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(6);
+            let __v_12: G = G::from_u64(6);
+            let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 6] = [__v_12, __v_13, __v_4, __v_6, __v_14, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_14, __v_12, __v_4, __v_6, __v_13, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_15, __v_11];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8358,10 +8358,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
             let __v_11: G = __r_arr[1];
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(7);
+            let __v_12: G = G::from_u64(7);
+            let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 6] = [__v_12, __v_13, __v_4, __v_6, __v_14, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_14, __v_12, __v_4, __v_6, __v_13, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_15, __v_11];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8378,10 +8378,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
             let __v_11: G = __r_arr[1];
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(8);
+            let __v_12: G = G::from_u64(8);
+            let __v_13: G = G::from_u64(0);
             let __v_14: G = G::from_u64(0);
-            let __v_15: G = { let __values: [G; 6] = [__v_12, __v_13, __v_4, __v_6, __v_14, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_14, __v_12, __v_4, __v_6, __v_13, __v_10]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_15, __v_11];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8395,10 +8395,10 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(9);
+            let __v_10: G = G::from_u64(9);
+            let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(0);
-            let __v_13: G = { let __values: [G; 6] = [__v_10, __v_11, __v_4, __v_12, __v_12, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = { let __values: [G; 6] = [__v_12, __v_10, __v_4, __v_11, __v_11, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_13, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8413,10 +8413,10 @@ fn aiur_fn_86(
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(0);
+            let __v_11: G = G::from_u64(0);
+            let __v_12: G = G::from_u64(1);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8432,9 +8432,9 @@ fn aiur_fn_86(
             let __v_9: G = __r_arr[1];
             let __v_10: G = G::from_u64(0);
             let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(0);
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = G::from_u64(1);
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8448,11 +8448,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
+            let __v_10: G = G::from_u64(1);
+            let __v_11: G = G::from_u64(0);
             let __v_12: G = G::from_u64(1);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8466,11 +8466,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
+            let __v_10: G = G::from_u64(1);
             let __v_11: G = G::from_u64(1);
             let __v_12: G = G::from_u64(1);
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8484,11 +8484,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(2);
+            let __v_10: G = G::from_u64(2);
+            let __v_11: G = G::from_u64(0);
+            let __v_12: G = G::from_u64(1);
             let __v_13: G = G::from_u64(0);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8502,11 +8502,11 @@ fn aiur_fn_86(
             let __r_arr: [G; OUT_86] = { let __args: [G; IN_86] = [__v_5, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[86].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[86].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[86].bump_multiplicity(__i); } let __ret: [G; OUT_86] = unsafe { *(record.function_queries[86].output_at(__i).as_ptr() as *const [G; OUT_86]) }; __ret }, _ => aiur_fn_86(__args, record, io_buffer, __cu)? } };
             let __v_8: G = __r_arr[0];
             let __v_9: G = __r_arr[1];
-            let __v_10: G = G::from_u64(0);
+            let __v_10: G = G::from_u64(2);
             let __v_11: G = G::from_u64(1);
-            let __v_12: G = G::from_u64(2);
-            let __v_13: G = G::from_u64(1);
-            let __v_14: G = { let __values: [G; 6] = [__v_10, __v_11, __v_12, __v_13, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = G::from_u64(1);
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_12, __v_10, __v_11, __v_4, __v_8]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_86] = [__v_14, __v_9];
             record.function_queries[86].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -8777,44 +8777,44 @@ fn aiur_fn_91(
     if !unconstrained { let __vi = __v_63; let __vj = __v_64; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_65; let __vj = __v_66; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_67; let __vj = __v_68; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_69: G = G::from_u64(1020);
-    let __v_70: G = (__v_68 - __v_69);
-    let __v_71: G = (__v_67 + __v_70);
-    let __v_72: G = (__v_66 + __v_71);
-    let __v_73: G = (__v_65 + __v_72);
-    let __v_74: G = G::from_bool((__v_73 == G::ZERO));
-    let __v_75: G = (__v_63 + __v_64);
-    let __v_76: G = (__v_62 + __v_75);
-    let __v_77: G = (__v_61 + __v_76);
-    let __v_78: G = G::from_bool((__v_77 == G::ZERO));
-    let __v_79: G = G::from_u64(256);
-    let __v_80: G = (__v_79 * __v_62);
-    let __v_81: G = G::from_u64(65536);
-    let __v_82: G = (__v_81 * __v_63);
-    let __v_83: G = G::from_u64(16777216);
-    let __v_84: G = (__v_83 * __v_64);
-    let __v_85: G = G::from_u64(4294967296);
-    let __v_86: G = (__v_85 * __v_65);
-    let __v_87: G = G::from_u64(1099511627776);
-    let __v_88: G = (__v_87 * __v_66);
-    let __v_89: G = G::from_u64(281474976710656);
-    let __v_90: G = (__v_89 * __v_67);
-    let __v_91: G = G::from_u64(72057594037927936);
-    let __v_92: G = (__v_91 * __v_68);
-    let __v_93: G = (__v_90 + __v_92);
-    let __v_94: G = (__v_88 + __v_93);
-    let __v_95: G = (__v_86 + __v_94);
-    let __v_96: G = (__v_84 + __v_95);
-    let __v_97: G = (__v_82 + __v_96);
-    let __v_98: G = (__v_80 + __v_97);
-    let __v_99: G = (__v_61 + __v_98);
-    if (__v_99 != __v_60) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_99.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
-    }
+    let __v_69: G = G::from_u64(256);
+    let __v_70: G = (__v_69 * __v_62);
+    let __v_71: G = G::from_u64(65536);
+    let __v_72: G = (__v_71 * __v_63);
+    let __v_73: G = G::from_u64(16777216);
+    let __v_74: G = (__v_73 * __v_64);
+    let __v_75: G = G::from_u64(4294967296);
+    let __v_76: G = (__v_75 * __v_65);
+    let __v_77: G = G::from_u64(1099511627776);
+    let __v_78: G = (__v_77 * __v_66);
+    let __v_79: G = G::from_u64(281474976710656);
+    let __v_80: G = (__v_79 * __v_67);
+    let __v_81: G = G::from_u64(72057594037927936);
+    let __v_82: G = (__v_81 * __v_68);
+    let __v_83: G = (__v_80 + __v_82);
+    let __v_84: G = (__v_78 + __v_83);
+    let __v_85: G = (__v_76 + __v_84);
+    let __v_86: G = (__v_74 + __v_85);
+    let __v_87: G = (__v_72 + __v_86);
+    let __v_88: G = (__v_70 + __v_87);
+    let __v_89: G = (__v_61 + __v_88);
+    if (__v_89 != __v_60) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
+    }
+    let __v_90: G = G::from_u64(1020);
+    let __v_91: G = (__v_68 - __v_90);
+    let __v_92: G = (__v_67 + __v_91);
+    let __v_93: G = (__v_66 + __v_92);
+    let __v_94: G = (__v_65 + __v_93);
+    let __v_95: G = G::from_bool((__v_94 == G::ZERO));
+    let __v_96: G = (__v_63 + __v_64);
+    let __v_97: G = (__v_62 + __v_96);
+    let __v_98: G = (__v_61 + __v_97);
+    let __v_99: G = G::from_bool((__v_98 == G::ZERO));
     let __v_100: G = G::from_u64(1);
     let __v_101: G = G::from_u64(1);
-    let __v_102: G = (__v_101 - __v_78);
-    let __v_103: G = (__v_74 * __v_102);
+    let __v_102: G = (__v_101 - __v_99);
+    let __v_103: G = (__v_95 * __v_102);
     let __v_104: G = (__v_100 - __v_103);
     let __v_105: G = G::from_u64(1);
     if (__v_104 != __v_105) {
@@ -8834,44 +8834,44 @@ fn aiur_fn_91(
     if !unconstrained { let __vi = __v_109; let __vj = __v_110; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_111; let __vj = __v_112; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_113; let __vj = __v_114; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_115: G = G::from_u64(1020);
-    let __v_116: G = (__v_114 - __v_115);
-    let __v_117: G = (__v_113 + __v_116);
-    let __v_118: G = (__v_112 + __v_117);
-    let __v_119: G = (__v_111 + __v_118);
-    let __v_120: G = G::from_bool((__v_119 == G::ZERO));
-    let __v_121: G = (__v_109 + __v_110);
-    let __v_122: G = (__v_108 + __v_121);
-    let __v_123: G = (__v_107 + __v_122);
-    let __v_124: G = G::from_bool((__v_123 == G::ZERO));
-    let __v_125: G = G::from_u64(256);
-    let __v_126: G = (__v_125 * __v_108);
-    let __v_127: G = G::from_u64(65536);
-    let __v_128: G = (__v_127 * __v_109);
-    let __v_129: G = G::from_u64(16777216);
-    let __v_130: G = (__v_129 * __v_110);
-    let __v_131: G = G::from_u64(4294967296);
-    let __v_132: G = (__v_131 * __v_111);
-    let __v_133: G = G::from_u64(1099511627776);
-    let __v_134: G = (__v_133 * __v_112);
-    let __v_135: G = G::from_u64(281474976710656);
-    let __v_136: G = (__v_135 * __v_113);
-    let __v_137: G = G::from_u64(72057594037927936);
-    let __v_138: G = (__v_137 * __v_114);
-    let __v_139: G = (__v_136 + __v_138);
-    let __v_140: G = (__v_134 + __v_139);
-    let __v_141: G = (__v_132 + __v_140);
-    let __v_142: G = (__v_130 + __v_141);
-    let __v_143: G = (__v_128 + __v_142);
-    let __v_144: G = (__v_126 + __v_143);
-    let __v_145: G = (__v_107 + __v_144);
-    if (__v_145 != __v_106) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_145.as_canonical_u64(), rhs: __v_106.as_canonical_u64(), msg: None });
-    }
+    let __v_115: G = G::from_u64(256);
+    let __v_116: G = (__v_115 * __v_108);
+    let __v_117: G = G::from_u64(65536);
+    let __v_118: G = (__v_117 * __v_109);
+    let __v_119: G = G::from_u64(16777216);
+    let __v_120: G = (__v_119 * __v_110);
+    let __v_121: G = G::from_u64(4294967296);
+    let __v_122: G = (__v_121 * __v_111);
+    let __v_123: G = G::from_u64(1099511627776);
+    let __v_124: G = (__v_123 * __v_112);
+    let __v_125: G = G::from_u64(281474976710656);
+    let __v_126: G = (__v_125 * __v_113);
+    let __v_127: G = G::from_u64(72057594037927936);
+    let __v_128: G = (__v_127 * __v_114);
+    let __v_129: G = (__v_126 + __v_128);
+    let __v_130: G = (__v_124 + __v_129);
+    let __v_131: G = (__v_122 + __v_130);
+    let __v_132: G = (__v_120 + __v_131);
+    let __v_133: G = (__v_118 + __v_132);
+    let __v_134: G = (__v_116 + __v_133);
+    let __v_135: G = (__v_107 + __v_134);
+    if (__v_135 != __v_106) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_135.as_canonical_u64(), rhs: __v_106.as_canonical_u64(), msg: None });
+    }
+    let __v_136: G = G::from_u64(1020);
+    let __v_137: G = (__v_114 - __v_136);
+    let __v_138: G = (__v_113 + __v_137);
+    let __v_139: G = (__v_112 + __v_138);
+    let __v_140: G = (__v_111 + __v_139);
+    let __v_141: G = G::from_bool((__v_140 == G::ZERO));
+    let __v_142: G = (__v_109 + __v_110);
+    let __v_143: G = (__v_108 + __v_142);
+    let __v_144: G = (__v_107 + __v_143);
+    let __v_145: G = G::from_bool((__v_144 == G::ZERO));
     let __v_146: G = G::from_u64(1);
     let __v_147: G = G::from_u64(1);
-    let __v_148: G = (__v_147 - __v_124);
-    let __v_149: G = (__v_120 * __v_148);
+    let __v_148: G = (__v_147 - __v_145);
+    let __v_149: G = (__v_141 * __v_148);
     let __v_150: G = (__v_146 - __v_149);
     let __v_151: G = G::from_u64(1);
     if (__v_150 != __v_151) {
@@ -8890,44 +8890,44 @@ fn aiur_fn_91(
     if !unconstrained { let __vi = __v_154; let __vj = __v_155; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_156; let __vj = __v_157; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_158; let __vj = __v_159; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_160: G = G::from_u64(1020);
-    let __v_161: G = (__v_159 - __v_160);
-    let __v_162: G = (__v_158 + __v_161);
-    let __v_163: G = (__v_157 + __v_162);
-    let __v_164: G = (__v_156 + __v_163);
-    let __v_165: G = G::from_bool((__v_164 == G::ZERO));
-    let __v_166: G = (__v_154 + __v_155);
-    let __v_167: G = (__v_153 + __v_166);
-    let __v_168: G = (__v_152 + __v_167);
-    let __v_169: G = G::from_bool((__v_168 == G::ZERO));
-    let __v_170: G = G::from_u64(256);
-    let __v_171: G = (__v_170 * __v_153);
-    let __v_172: G = G::from_u64(65536);
-    let __v_173: G = (__v_172 * __v_154);
-    let __v_174: G = G::from_u64(16777216);
-    let __v_175: G = (__v_174 * __v_155);
-    let __v_176: G = G::from_u64(4294967296);
-    let __v_177: G = (__v_176 * __v_156);
-    let __v_178: G = G::from_u64(1099511627776);
-    let __v_179: G = (__v_178 * __v_157);
-    let __v_180: G = G::from_u64(281474976710656);
-    let __v_181: G = (__v_180 * __v_158);
-    let __v_182: G = G::from_u64(72057594037927936);
-    let __v_183: G = (__v_182 * __v_159);
-    let __v_184: G = (__v_181 + __v_183);
-    let __v_185: G = (__v_179 + __v_184);
-    let __v_186: G = (__v_177 + __v_185);
-    let __v_187: G = (__v_175 + __v_186);
-    let __v_188: G = (__v_173 + __v_187);
-    let __v_189: G = (__v_171 + __v_188);
-    let __v_190: G = (__v_152 + __v_189);
-    if (__v_190 != __v_41) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_190.as_canonical_u64(), rhs: __v_41.as_canonical_u64(), msg: None });
-    }
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_153);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_154);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_155);
+    let __v_166: G = G::from_u64(4294967296);
+    let __v_167: G = (__v_166 * __v_156);
+    let __v_168: G = G::from_u64(1099511627776);
+    let __v_169: G = (__v_168 * __v_157);
+    let __v_170: G = G::from_u64(281474976710656);
+    let __v_171: G = (__v_170 * __v_158);
+    let __v_172: G = G::from_u64(72057594037927936);
+    let __v_173: G = (__v_172 * __v_159);
+    let __v_174: G = (__v_171 + __v_173);
+    let __v_175: G = (__v_169 + __v_174);
+    let __v_176: G = (__v_167 + __v_175);
+    let __v_177: G = (__v_165 + __v_176);
+    let __v_178: G = (__v_163 + __v_177);
+    let __v_179: G = (__v_161 + __v_178);
+    let __v_180: G = (__v_152 + __v_179);
+    if (__v_180 != __v_41) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_180.as_canonical_u64(), rhs: __v_41.as_canonical_u64(), msg: None });
+    }
+    let __v_181: G = G::from_u64(1020);
+    let __v_182: G = (__v_159 - __v_181);
+    let __v_183: G = (__v_158 + __v_182);
+    let __v_184: G = (__v_157 + __v_183);
+    let __v_185: G = (__v_156 + __v_184);
+    let __v_186: G = G::from_bool((__v_185 == G::ZERO));
+    let __v_187: G = (__v_154 + __v_155);
+    let __v_188: G = (__v_153 + __v_187);
+    let __v_189: G = (__v_152 + __v_188);
+    let __v_190: G = G::from_bool((__v_189 == G::ZERO));
     let __v_191: G = G::from_u64(1);
     let __v_192: G = G::from_u64(1);
-    let __v_193: G = (__v_192 - __v_169);
-    let __v_194: G = (__v_165 * __v_193);
+    let __v_193: G = (__v_192 - __v_190);
+    let __v_194: G = (__v_186 * __v_193);
     let __v_195: G = (__v_191 - __v_194);
     let __v_196: G = G::from_u64(1);
     if (__v_195 != __v_196) {
@@ -9007,19 +9007,19 @@ fn aiur_fn_92(
     let __v_55: G = inp[55];
     let __v_56: G = inp[56];
     let __v_57: G = G::from_u64(0);
-    let __v_58: G = G::from_u64(0);
+    let __v_58: G = { let __values: [G; 10] = [__v_57, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_59: G = G::from_u64(0);
-    let __v_60: G = G::from_u64(0);
+    let __v_60: G = { let __values: [G; 10] = [__v_59, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_58]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_61: G = G::from_u64(0);
-    let __v_62: G = G::from_u64(0);
+    let __v_62: G = { let __values: [G; 10] = [__v_61, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_60]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_63: G = G::from_u64(0);
-    let __v_64: G = { let __values: [G; 10] = [__v_63, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_65: G = { let __values: [G; 10] = [__v_62, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_64]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_66: G = { let __values: [G; 10] = [__v_61, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_65]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_67: G = { let __values: [G; 10] = [__v_60, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_66]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_68: G = { let __values: [G; 10] = [__v_59, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_67]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_69: G = { let __values: [G; 10] = [__v_58, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_68]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_70: G = { let __values: [G; 10] = [__v_57, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_69]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_64: G = { let __values: [G; 10] = [__v_63, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_62]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_65: G = G::from_u64(0);
+    let __v_66: G = { let __values: [G; 10] = [__v_65, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_64]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_67: G = G::from_u64(0);
+    let __v_68: G = { let __values: [G; 10] = [__v_67, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_66]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_69: G = G::from_u64(0);
+    let __v_70: G = { let __values: [G; 10] = [__v_69, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_68]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_92] = [__v_70];
     record.function_queries[92].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -9136,44 +9136,44 @@ fn aiur_fn_93(
         if !unconstrained { let __vi = __v_64; let __vj = __v_65; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_66; let __vj = __v_67; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_68; let __vj = __v_69; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_70: G = G::from_u64(1020);
-        let __v_71: G = (__v_69 - __v_70);
-        let __v_72: G = (__v_68 + __v_71);
-        let __v_73: G = (__v_67 + __v_72);
-        let __v_74: G = (__v_66 + __v_73);
-        let __v_75: G = G::from_bool((__v_74 == G::ZERO));
-        let __v_76: G = (__v_64 + __v_65);
-        let __v_77: G = (__v_63 + __v_76);
-        let __v_78: G = (__v_62 + __v_77);
-        let __v_79: G = G::from_bool((__v_78 == G::ZERO));
-        let __v_80: G = G::from_u64(256);
-        let __v_81: G = (__v_80 * __v_63);
-        let __v_82: G = G::from_u64(65536);
-        let __v_83: G = (__v_82 * __v_64);
-        let __v_84: G = G::from_u64(16777216);
-        let __v_85: G = (__v_84 * __v_65);
-        let __v_86: G = G::from_u64(4294967296);
-        let __v_87: G = (__v_86 * __v_66);
-        let __v_88: G = G::from_u64(1099511627776);
-        let __v_89: G = (__v_88 * __v_67);
-        let __v_90: G = G::from_u64(281474976710656);
-        let __v_91: G = (__v_90 * __v_68);
-        let __v_92: G = G::from_u64(72057594037927936);
-        let __v_93: G = (__v_92 * __v_69);
-        let __v_94: G = (__v_91 + __v_93);
-        let __v_95: G = (__v_89 + __v_94);
-        let __v_96: G = (__v_87 + __v_95);
-        let __v_97: G = (__v_85 + __v_96);
-        let __v_98: G = (__v_83 + __v_97);
-        let __v_99: G = (__v_81 + __v_98);
-        let __v_100: G = (__v_62 + __v_99);
-        if (__v_100 != __v_61) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_100.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: None });
+        let __v_70: G = G::from_u64(256);
+        let __v_71: G = (__v_70 * __v_63);
+        let __v_72: G = G::from_u64(65536);
+        let __v_73: G = (__v_72 * __v_64);
+        let __v_74: G = G::from_u64(16777216);
+        let __v_75: G = (__v_74 * __v_65);
+        let __v_76: G = G::from_u64(4294967296);
+        let __v_77: G = (__v_76 * __v_66);
+        let __v_78: G = G::from_u64(1099511627776);
+        let __v_79: G = (__v_78 * __v_67);
+        let __v_80: G = G::from_u64(281474976710656);
+        let __v_81: G = (__v_80 * __v_68);
+        let __v_82: G = G::from_u64(72057594037927936);
+        let __v_83: G = (__v_82 * __v_69);
+        let __v_84: G = (__v_81 + __v_83);
+        let __v_85: G = (__v_79 + __v_84);
+        let __v_86: G = (__v_77 + __v_85);
+        let __v_87: G = (__v_75 + __v_86);
+        let __v_88: G = (__v_73 + __v_87);
+        let __v_89: G = (__v_71 + __v_88);
+        let __v_90: G = (__v_62 + __v_89);
+        if (__v_90 != __v_61) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_90.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: None });
         }
+        let __v_91: G = G::from_u64(1020);
+        let __v_92: G = (__v_69 - __v_91);
+        let __v_93: G = (__v_68 + __v_92);
+        let __v_94: G = (__v_67 + __v_93);
+        let __v_95: G = (__v_66 + __v_94);
+        let __v_96: G = G::from_bool((__v_95 == G::ZERO));
+        let __v_97: G = (__v_64 + __v_65);
+        let __v_98: G = (__v_63 + __v_97);
+        let __v_99: G = (__v_62 + __v_98);
+        let __v_100: G = G::from_bool((__v_99 == G::ZERO));
         let __v_101: G = G::from_u64(1);
         let __v_102: G = G::from_u64(1);
-        let __v_103: G = (__v_102 - __v_79);
-        let __v_104: G = (__v_75 * __v_103);
+        let __v_103: G = (__v_102 - __v_100);
+        let __v_104: G = (__v_96 * __v_103);
         let __v_105: G = (__v_101 - __v_104);
         let __v_106: G = G::from_u64(1);
         if (__v_105 != __v_106) {
@@ -9193,44 +9193,44 @@ fn aiur_fn_93(
         if !unconstrained { let __vi = __v_110; let __vj = __v_111; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_112; let __vj = __v_113; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_114; let __vj = __v_115; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_116: G = G::from_u64(1020);
-        let __v_117: G = (__v_115 - __v_116);
-        let __v_118: G = (__v_114 + __v_117);
-        let __v_119: G = (__v_113 + __v_118);
-        let __v_120: G = (__v_112 + __v_119);
-        let __v_121: G = G::from_bool((__v_120 == G::ZERO));
-        let __v_122: G = (__v_110 + __v_111);
-        let __v_123: G = (__v_109 + __v_122);
-        let __v_124: G = (__v_108 + __v_123);
-        let __v_125: G = G::from_bool((__v_124 == G::ZERO));
-        let __v_126: G = G::from_u64(256);
-        let __v_127: G = (__v_126 * __v_109);
-        let __v_128: G = G::from_u64(65536);
-        let __v_129: G = (__v_128 * __v_110);
-        let __v_130: G = G::from_u64(16777216);
-        let __v_131: G = (__v_130 * __v_111);
-        let __v_132: G = G::from_u64(4294967296);
-        let __v_133: G = (__v_132 * __v_112);
-        let __v_134: G = G::from_u64(1099511627776);
-        let __v_135: G = (__v_134 * __v_113);
-        let __v_136: G = G::from_u64(281474976710656);
-        let __v_137: G = (__v_136 * __v_114);
-        let __v_138: G = G::from_u64(72057594037927936);
-        let __v_139: G = (__v_138 * __v_115);
-        let __v_140: G = (__v_137 + __v_139);
-        let __v_141: G = (__v_135 + __v_140);
-        let __v_142: G = (__v_133 + __v_141);
-        let __v_143: G = (__v_131 + __v_142);
-        let __v_144: G = (__v_129 + __v_143);
-        let __v_145: G = (__v_127 + __v_144);
-        let __v_146: G = (__v_108 + __v_145);
-        if (__v_146 != __v_107) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_146.as_canonical_u64(), rhs: __v_107.as_canonical_u64(), msg: None });
+        let __v_116: G = G::from_u64(256);
+        let __v_117: G = (__v_116 * __v_109);
+        let __v_118: G = G::from_u64(65536);
+        let __v_119: G = (__v_118 * __v_110);
+        let __v_120: G = G::from_u64(16777216);
+        let __v_121: G = (__v_120 * __v_111);
+        let __v_122: G = G::from_u64(4294967296);
+        let __v_123: G = (__v_122 * __v_112);
+        let __v_124: G = G::from_u64(1099511627776);
+        let __v_125: G = (__v_124 * __v_113);
+        let __v_126: G = G::from_u64(281474976710656);
+        let __v_127: G = (__v_126 * __v_114);
+        let __v_128: G = G::from_u64(72057594037927936);
+        let __v_129: G = (__v_128 * __v_115);
+        let __v_130: G = (__v_127 + __v_129);
+        let __v_131: G = (__v_125 + __v_130);
+        let __v_132: G = (__v_123 + __v_131);
+        let __v_133: G = (__v_121 + __v_132);
+        let __v_134: G = (__v_119 + __v_133);
+        let __v_135: G = (__v_117 + __v_134);
+        let __v_136: G = (__v_108 + __v_135);
+        if (__v_136 != __v_107) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_136.as_canonical_u64(), rhs: __v_107.as_canonical_u64(), msg: None });
         }
+        let __v_137: G = G::from_u64(1020);
+        let __v_138: G = (__v_115 - __v_137);
+        let __v_139: G = (__v_114 + __v_138);
+        let __v_140: G = (__v_113 + __v_139);
+        let __v_141: G = (__v_112 + __v_140);
+        let __v_142: G = G::from_bool((__v_141 == G::ZERO));
+        let __v_143: G = (__v_110 + __v_111);
+        let __v_144: G = (__v_109 + __v_143);
+        let __v_145: G = (__v_108 + __v_144);
+        let __v_146: G = G::from_bool((__v_145 == G::ZERO));
         let __v_147: G = G::from_u64(1);
         let __v_148: G = G::from_u64(1);
-        let __v_149: G = (__v_148 - __v_125);
-        let __v_150: G = (__v_121 * __v_149);
+        let __v_149: G = (__v_148 - __v_146);
+        let __v_150: G = (__v_142 * __v_149);
         let __v_151: G = (__v_147 - __v_150);
         let __v_152: G = G::from_u64(1);
         if (__v_151 != __v_152) {
@@ -9249,44 +9249,44 @@ fn aiur_fn_93(
         if !unconstrained { let __vi = __v_155; let __vj = __v_156; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_157; let __vj = __v_158; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_159; let __vj = __v_160; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_161: G = G::from_u64(1020);
-        let __v_162: G = (__v_160 - __v_161);
-        let __v_163: G = (__v_159 + __v_162);
-        let __v_164: G = (__v_158 + __v_163);
-        let __v_165: G = (__v_157 + __v_164);
-        let __v_166: G = G::from_bool((__v_165 == G::ZERO));
-        let __v_167: G = (__v_155 + __v_156);
-        let __v_168: G = (__v_154 + __v_167);
-        let __v_169: G = (__v_153 + __v_168);
-        let __v_170: G = G::from_bool((__v_169 == G::ZERO));
-        let __v_171: G = G::from_u64(256);
-        let __v_172: G = (__v_171 * __v_154);
-        let __v_173: G = G::from_u64(65536);
-        let __v_174: G = (__v_173 * __v_155);
-        let __v_175: G = G::from_u64(16777216);
-        let __v_176: G = (__v_175 * __v_156);
-        let __v_177: G = G::from_u64(4294967296);
-        let __v_178: G = (__v_177 * __v_157);
-        let __v_179: G = G::from_u64(1099511627776);
-        let __v_180: G = (__v_179 * __v_158);
-        let __v_181: G = G::from_u64(281474976710656);
-        let __v_182: G = (__v_181 * __v_159);
-        let __v_183: G = G::from_u64(72057594037927936);
-        let __v_184: G = (__v_183 * __v_160);
-        let __v_185: G = (__v_182 + __v_184);
-        let __v_186: G = (__v_180 + __v_185);
-        let __v_187: G = (__v_178 + __v_186);
-        let __v_188: G = (__v_176 + __v_187);
-        let __v_189: G = (__v_174 + __v_188);
-        let __v_190: G = (__v_172 + __v_189);
-        let __v_191: G = (__v_153 + __v_190);
-        if (__v_191 != __v_42) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_191.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: None });
+        let __v_161: G = G::from_u64(256);
+        let __v_162: G = (__v_161 * __v_154);
+        let __v_163: G = G::from_u64(65536);
+        let __v_164: G = (__v_163 * __v_155);
+        let __v_165: G = G::from_u64(16777216);
+        let __v_166: G = (__v_165 * __v_156);
+        let __v_167: G = G::from_u64(4294967296);
+        let __v_168: G = (__v_167 * __v_157);
+        let __v_169: G = G::from_u64(1099511627776);
+        let __v_170: G = (__v_169 * __v_158);
+        let __v_171: G = G::from_u64(281474976710656);
+        let __v_172: G = (__v_171 * __v_159);
+        let __v_173: G = G::from_u64(72057594037927936);
+        let __v_174: G = (__v_173 * __v_160);
+        let __v_175: G = (__v_172 + __v_174);
+        let __v_176: G = (__v_170 + __v_175);
+        let __v_177: G = (__v_168 + __v_176);
+        let __v_178: G = (__v_166 + __v_177);
+        let __v_179: G = (__v_164 + __v_178);
+        let __v_180: G = (__v_162 + __v_179);
+        let __v_181: G = (__v_153 + __v_180);
+        if (__v_181 != __v_42) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_181.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: None });
         }
+        let __v_182: G = G::from_u64(1020);
+        let __v_183: G = (__v_160 - __v_182);
+        let __v_184: G = (__v_159 + __v_183);
+        let __v_185: G = (__v_158 + __v_184);
+        let __v_186: G = (__v_157 + __v_185);
+        let __v_187: G = G::from_bool((__v_186 == G::ZERO));
+        let __v_188: G = (__v_155 + __v_156);
+        let __v_189: G = (__v_154 + __v_188);
+        let __v_190: G = (__v_153 + __v_189);
+        let __v_191: G = G::from_bool((__v_190 == G::ZERO));
         let __v_192: G = G::from_u64(1);
         let __v_193: G = G::from_u64(1);
-        let __v_194: G = (__v_193 - __v_170);
-        let __v_195: G = (__v_166 * __v_194);
+        let __v_194: G = (__v_193 - __v_191);
+        let __v_195: G = (__v_187 * __v_194);
         let __v_196: G = (__v_192 - __v_195);
         let __v_197: G = G::from_u64(1);
         if (__v_196 != __v_197) {
@@ -9301,19 +9301,19 @@ fn aiur_fn_93(
         let __v_203: G = G::from_u64(0);
         let __v_204: G = { let __values: [G; 8] = [__v_203, __v_46, __v_44, __v_50, __v_32, __v_54, __v_42, __v_200]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_205: G = G::from_u64(0);
-        let __v_206: G = G::from_u64(0);
+        let __v_206: G = { let __values: [G; 10] = [__v_205, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_201]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_207: G = G::from_u64(0);
-        let __v_208: G = G::from_u64(0);
+        let __v_208: G = { let __values: [G; 10] = [__v_207, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_206]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_209: G = G::from_u64(0);
-        let __v_210: G = G::from_u64(0);
+        let __v_210: G = { let __values: [G; 10] = [__v_209, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_208]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_211: G = G::from_u64(0);
-        let __v_212: G = { let __values: [G; 10] = [__v_211, __v_153, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_201]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_213: G = { let __values: [G; 10] = [__v_210, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_212]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_214: G = { let __values: [G; 10] = [__v_209, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_213]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_215: G = { let __values: [G; 10] = [__v_208, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_214]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_216: G = { let __values: [G; 10] = [__v_207, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_215]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_217: G = { let __values: [G; 10] = [__v_206, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_216]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_218: G = { let __values: [G; 10] = [__v_205, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_217]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_212: G = { let __values: [G; 10] = [__v_211, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_210]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_213: G = G::from_u64(0);
+        let __v_214: G = { let __values: [G; 10] = [__v_213, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_212]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_215: G = G::from_u64(0);
+        let __v_216: G = { let __values: [G; 10] = [__v_215, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_214]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_217: G = G::from_u64(0);
+        let __v_218: G = { let __values: [G; 10] = [__v_217, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_216]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_93] = [__v_204, __v_218, __v_202];
         record.function_queries[93].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -9395,15 +9395,15 @@ fn aiur_fn_95(
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
             let __v_10: G = G::from_u64(0);
-            let __v_11: G = { let __values: [G; 4] = [__v_8, __v_9, __v_10, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = { let __values: [G; 4] = [__v_10, __v_8, __v_9, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_95] = [__v_11, __v_7];
             record.function_queries[95].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           _ => {
-            let __v_8: G = G::from_u64(0);
-            let __v_9: G = G::from_u64(1);
-            let __v_10: G = { let __values: [G; 4] = [__v_8, __v_9, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_8: G = G::from_u64(1);
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 4] = [__v_9, __v_8, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_95] = [__v_10, __v_7];
             record.function_queries[95].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -9502,23 +9502,23 @@ fn aiur_fn_96(
     let __v_68: G = __r_arr[7];
     let __v_69: G = __r_arr[8];
     let __v_70: G = __r_arr[9];
-    let __v_71: G = G::from_u64(0);
-    let __v_72: G = G::from_u64(0);
-    let __v_73: G = G::from_u64(0);
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = G::from_u64(1);
+    let __v_73: G = { let __values: [G; 10] = [__v_71, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_74: G = G::from_u64(0);
-    let __v_75: G = G::from_u64(0);
+    let __v_75: G = { let __values: [G; 10] = [__v_74, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_73]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_76: G = G::from_u64(0);
-    let __v_77: G = G::from_u64(0);
-    let __v_78: G = G::from_u64(1);
-    let __v_79: G = G::from_u64(1);
-    let __v_80: G = { let __values: [G; 10] = [__v_78, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_81: G = { let __values: [G; 10] = [__v_77, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_80]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_82: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_83: G = { let __values: [G; 10] = [__v_75, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_82]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_84: G = { let __values: [G; 10] = [__v_74, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_85: G = { let __values: [G; 10] = [__v_73, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_84]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_86: G = { let __values: [G; 10] = [__v_72, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_87: G = { let __values: [G; 10] = [__v_71, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_86]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_77: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_75]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_78: G = G::from_u64(0);
+    let __v_79: G = { let __values: [G; 10] = [__v_78, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_77]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_80: G = G::from_u64(0);
+    let __v_81: G = { let __values: [G; 10] = [__v_80, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_82: G = G::from_u64(0);
+    let __v_83: G = { let __values: [G; 10] = [__v_82, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_84: G = G::from_u64(0);
+    let __v_85: G = { let __values: [G; 10] = [__v_84, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_86: G = G::from_u64(0);
+    let __v_87: G = { let __values: [G; 10] = [__v_86, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_96] = [__v_1, __v_11, __v_21, __v_31, __v_41, __v_51, __v_61, __v_87, __v_70];
     record.function_queries[96].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -9613,23 +9613,23 @@ fn aiur_fn_97(
     let __v_68: G = __r_arr[7];
     let __v_69: G = __r_arr[8];
     let __v_70: G = __r_arr[9];
-    let __v_71: G = G::from_u64(0);
-    let __v_72: G = G::from_u64(0);
-    let __v_73: G = G::from_u64(0);
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = G::from_u64(1);
+    let __v_73: G = { let __values: [G; 10] = [__v_71, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72, __v_72]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_74: G = G::from_u64(0);
-    let __v_75: G = G::from_u64(0);
+    let __v_75: G = { let __values: [G; 10] = [__v_74, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_73]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_76: G = G::from_u64(0);
-    let __v_77: G = G::from_u64(0);
-    let __v_78: G = G::from_u64(1);
-    let __v_79: G = G::from_u64(1);
-    let __v_80: G = { let __values: [G; 10] = [__v_78, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_81: G = { let __values: [G; 10] = [__v_77, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_80]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_82: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_83: G = { let __values: [G; 10] = [__v_75, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_82]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_84: G = { let __values: [G; 10] = [__v_74, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_85: G = { let __values: [G; 10] = [__v_73, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_84]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_86: G = { let __values: [G; 10] = [__v_72, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_87: G = { let __values: [G; 10] = [__v_71, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_86]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_77: G = { let __values: [G; 10] = [__v_76, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_75]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_78: G = G::from_u64(0);
+    let __v_79: G = { let __values: [G; 10] = [__v_78, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_77]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_80: G = G::from_u64(0);
+    let __v_81: G = { let __values: [G; 10] = [__v_80, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_79]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_82: G = G::from_u64(0);
+    let __v_83: G = { let __values: [G; 10] = [__v_82, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_81]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_84: G = G::from_u64(0);
+    let __v_85: G = { let __values: [G; 10] = [__v_84, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_83]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_86: G = G::from_u64(0);
+    let __v_87: G = { let __values: [G; 10] = [__v_86, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_85]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_70]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_88: G = __r_arr[0];
     let __v_89: G = __r_arr[1];
@@ -9678,13 +9678,13 @@ fn aiur_fn_98(
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
     let __v_5: G = G::from_u64(0);
-    let __v_6: G = G::from_u64(0);
+    let __v_6: G = { let __values: [G; 3] = [__v_5, __v_3, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(0);
-    let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_10: G = { let __values: [G; 3] = [__v_7, __v_2, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_11: G = { let __values: [G; 3] = [__v_6, __v_1, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_12: G = { let __values: [G; 3] = [__v_5, __v_0, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_8: G = { let __values: [G; 3] = [__v_7, __v_2, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_9: G = G::from_u64(0);
+    let __v_10: G = { let __values: [G; 3] = [__v_9, __v_1, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_11: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 3] = [__v_11, __v_0, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_98] = [__v_12];
     record.function_queries[98].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -10132,10 +10132,10 @@ fn aiur_fn_104(
                     return Ok(__ret);
                   },
                   _ => {
-                    let __v_21: G = G::from_u64(0);
                     let __r_arr: [G; OUT_104] = { let __args: [G; IN_104] = [__v_5, __v_8, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[104].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[104].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[104].bump_multiplicity(__i); } let __ret: [G; OUT_104] = unsafe { *(record.function_queries[104].output_at(__i).as_ptr() as *const [G; OUT_104]) }; __ret }, _ => aiur_fn_104(__args, record, io_buffer, __cu)? } };
-                    let __v_22: G = __r_arr[0];
-                    let __v_23: G = { let __values: [G; 3] = [__v_21, __v_4, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_21: G = __r_arr[0];
+                    let __v_22: G = G::from_u64(0);
+                    let __v_23: G = { let __values: [G; 3] = [__v_22, __v_4, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_104] = [__v_23];
                     record.function_queries[104].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -10219,10 +10219,10 @@ fn aiur_fn_105(
                     return Ok(__ret);
                   },
                   _ => {
-                    let __v_20: G = G::from_u64(0);
                     let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_5, __v_8, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
-                    let __v_21: G = __r_arr[0];
-                    let __v_22: G = { let __values: [G; 3] = [__v_20, __v_4, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_20: G = __r_arr[0];
+                    let __v_21: G = G::from_u64(0);
+                    let __v_22: G = { let __values: [G; 3] = [__v_21, __v_4, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                     let __ret: [G; OUT_105] = [__v_22];
                     record.function_queries[105].finish(&inp[..], &__ret[..], !unconstrained);
                     return Ok(__ret);
@@ -10302,44 +10302,44 @@ fn aiur_fn_106(
         if !unconstrained { let __vi = __v_35; let __vj = __v_36; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_37; let __vj = __v_38; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_39; let __vj = __v_40; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_41: G = G::from_u64(1020);
-        let __v_42: G = (__v_40 - __v_41);
-        let __v_43: G = (__v_39 + __v_42);
-        let __v_44: G = (__v_38 + __v_43);
-        let __v_45: G = (__v_37 + __v_44);
-        let __v_46: G = G::from_bool((__v_45 == G::ZERO));
-        let __v_47: G = (__v_35 + __v_36);
-        let __v_48: G = (__v_34 + __v_47);
-        let __v_49: G = (__v_33 + __v_48);
-        let __v_50: G = G::from_bool((__v_49 == G::ZERO));
-        let __v_51: G = G::from_u64(256);
-        let __v_52: G = (__v_51 * __v_34);
-        let __v_53: G = G::from_u64(65536);
-        let __v_54: G = (__v_53 * __v_35);
-        let __v_55: G = G::from_u64(16777216);
-        let __v_56: G = (__v_55 * __v_36);
-        let __v_57: G = G::from_u64(4294967296);
-        let __v_58: G = (__v_57 * __v_37);
-        let __v_59: G = G::from_u64(1099511627776);
-        let __v_60: G = (__v_59 * __v_38);
-        let __v_61: G = G::from_u64(281474976710656);
-        let __v_62: G = (__v_61 * __v_39);
-        let __v_63: G = G::from_u64(72057594037927936);
-        let __v_64: G = (__v_63 * __v_40);
-        let __v_65: G = (__v_62 + __v_64);
-        let __v_66: G = (__v_60 + __v_65);
-        let __v_67: G = (__v_58 + __v_66);
-        let __v_68: G = (__v_56 + __v_67);
-        let __v_69: G = (__v_54 + __v_68);
-        let __v_70: G = (__v_52 + __v_69);
-        let __v_71: G = (__v_33 + __v_70);
-        if (__v_71 != __v_32) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_71.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: None });
+        let __v_41: G = G::from_u64(256);
+        let __v_42: G = (__v_41 * __v_34);
+        let __v_43: G = G::from_u64(65536);
+        let __v_44: G = (__v_43 * __v_35);
+        let __v_45: G = G::from_u64(16777216);
+        let __v_46: G = (__v_45 * __v_36);
+        let __v_47: G = G::from_u64(4294967296);
+        let __v_48: G = (__v_47 * __v_37);
+        let __v_49: G = G::from_u64(1099511627776);
+        let __v_50: G = (__v_49 * __v_38);
+        let __v_51: G = G::from_u64(281474976710656);
+        let __v_52: G = (__v_51 * __v_39);
+        let __v_53: G = G::from_u64(72057594037927936);
+        let __v_54: G = (__v_53 * __v_40);
+        let __v_55: G = (__v_52 + __v_54);
+        let __v_56: G = (__v_50 + __v_55);
+        let __v_57: G = (__v_48 + __v_56);
+        let __v_58: G = (__v_46 + __v_57);
+        let __v_59: G = (__v_44 + __v_58);
+        let __v_60: G = (__v_42 + __v_59);
+        let __v_61: G = (__v_33 + __v_60);
+        if (__v_61 != __v_32) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_61.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: None });
         }
+        let __v_62: G = G::from_u64(1020);
+        let __v_63: G = (__v_40 - __v_62);
+        let __v_64: G = (__v_39 + __v_63);
+        let __v_65: G = (__v_38 + __v_64);
+        let __v_66: G = (__v_37 + __v_65);
+        let __v_67: G = G::from_bool((__v_66 == G::ZERO));
+        let __v_68: G = (__v_35 + __v_36);
+        let __v_69: G = (__v_34 + __v_68);
+        let __v_70: G = (__v_33 + __v_69);
+        let __v_71: G = G::from_bool((__v_70 == G::ZERO));
         let __v_72: G = G::from_u64(1);
         let __v_73: G = G::from_u64(1);
-        let __v_74: G = (__v_73 - __v_50);
-        let __v_75: G = (__v_46 * __v_74);
+        let __v_74: G = (__v_73 - __v_71);
+        let __v_75: G = (__v_67 * __v_74);
         let __v_76: G = (__v_72 - __v_75);
         let __v_77: G = G::from_u64(1);
         if (__v_76 != __v_77) {
@@ -10585,41 +10585,41 @@ fn aiur_fn_107(
                                         let __v_151: G = G::from_u64(0);
                                         let __v_152: G = G::from_u64(0);
                                         let __v_153: G = G::from_u64(0);
-                                        let __v_154: G = G::from_u64(0);
-                                        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_154, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_147, __v_148, __v_149, __v_130, __v_150, __v_151, __v_152, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
-                                        let __v_155: G = __r_arr[0];
-                                        let __v_156: G = __r_arr[1];
-                                        let __v_157: G = __r_arr[2];
-                                        let __v_158: G = __r_arr[3];
-                                        let __v_159: G = __r_arr[4];
-                                        let __v_160: G = __r_arr[5];
-                                        let __v_161: G = __r_arr[6];
-                                        let __v_162: G = __r_arr[7];
-                                        let __v_163: G = __r_arr[8];
-                                        let __v_164: G = __r_arr[9];
-                                        let __v_165: G = __r_arr[10];
-                                        let __v_166: G = __r_arr[11];
-                                        let __v_167: G = __r_arr[12];
-                                        let __v_168: G = __r_arr[13];
-                                        let __v_169: G = __r_arr[14];
-                                        let __v_170: G = __r_arr[15];
-                                        let __v_171: G = __r_arr[16];
-                                        let __v_172: G = __r_arr[17];
-                                        let __v_173: G = __r_arr[18];
-                                        let __v_174: G = __r_arr[19];
-                                        let __v_175: G = __r_arr[20];
-                                        let __v_176: G = __r_arr[21];
-                                        let __v_177: G = __r_arr[22];
-                                        let __v_178: G = __r_arr[23];
-                                        let __v_179: G = __r_arr[24];
-                                        let __v_180: G = __r_arr[25];
-                                        let __v_181: G = __r_arr[26];
-                                        let __v_182: G = __r_arr[27];
-                                        let __v_183: G = __r_arr[28];
-                                        let __v_184: G = __r_arr[29];
-                                        let __v_185: G = __r_arr[30];
-                                        let __v_186: G = __r_arr[31];
-                                        let __v_187: G = { let __values: [G; 34] = [__v_153, __v_5, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                        let __r_arr: [G; OUT_76] = { let __args: [G; IN_76] = [__v_153, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_121, __v_122, __v_123, __v_124, __v_125, __v_126, __v_127, __v_128, __v_129, __v_147, __v_148, __v_149, __v_130, __v_150, __v_151, __v_152, __v_57, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67, __v_68, __v_69, __v_70, __v_71, __v_72, __v_73, __v_74, __v_75, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[76].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[76].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[76].bump_multiplicity(__i); } let __ret: [G; OUT_76] = unsafe { *(record.function_queries[76].output_at(__i).as_ptr() as *const [G; OUT_76]) }; __ret }, _ => aiur_fn_76(__args, record, io_buffer, __cu)? } };
+                                        let __v_154: G = __r_arr[0];
+                                        let __v_155: G = __r_arr[1];
+                                        let __v_156: G = __r_arr[2];
+                                        let __v_157: G = __r_arr[3];
+                                        let __v_158: G = __r_arr[4];
+                                        let __v_159: G = __r_arr[5];
+                                        let __v_160: G = __r_arr[6];
+                                        let __v_161: G = __r_arr[7];
+                                        let __v_162: G = __r_arr[8];
+                                        let __v_163: G = __r_arr[9];
+                                        let __v_164: G = __r_arr[10];
+                                        let __v_165: G = __r_arr[11];
+                                        let __v_166: G = __r_arr[12];
+                                        let __v_167: G = __r_arr[13];
+                                        let __v_168: G = __r_arr[14];
+                                        let __v_169: G = __r_arr[15];
+                                        let __v_170: G = __r_arr[16];
+                                        let __v_171: G = __r_arr[17];
+                                        let __v_172: G = __r_arr[18];
+                                        let __v_173: G = __r_arr[19];
+                                        let __v_174: G = __r_arr[20];
+                                        let __v_175: G = __r_arr[21];
+                                        let __v_176: G = __r_arr[22];
+                                        let __v_177: G = __r_arr[23];
+                                        let __v_178: G = __r_arr[24];
+                                        let __v_179: G = __r_arr[25];
+                                        let __v_180: G = __r_arr[26];
+                                        let __v_181: G = __r_arr[27];
+                                        let __v_182: G = __r_arr[28];
+                                        let __v_183: G = __r_arr[29];
+                                        let __v_184: G = __r_arr[30];
+                                        let __v_185: G = __r_arr[31];
+                                        let __v_186: G = G::from_u64(0);
+                                        let __v_187: G = { let __values: [G; 34] = [__v_186, __v_5, __v_154, __v_155, __v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                                         let __ret: [G; OUT_107] = [__v_187];
                                         record.function_queries[107].finish(&inp[..], &__ret[..], !unconstrained);
                                         return Ok(__ret);
@@ -11351,10 +11351,10 @@ fn aiur_fn_112(
                     let __v_14: G = __r_arr[0];
                     match __v_14.as_canonical_u64() {
                       1u64 => {
-                        let __v_15: G = G::from_u64(0);
                         let __r_arr: [G; OUT_112] = { let __args: [G; IN_112] = [__v_7, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[112].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[112].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[112].bump_multiplicity(__i); } let __ret: [G; OUT_112] = unsafe { *(record.function_queries[112].output_at(__i).as_ptr() as *const [G; OUT_112]) }; __ret }, _ => aiur_fn_112(__args, record, io_buffer, __cu)? } };
-                        let __v_16: G = __r_arr[0];
-                        let __v_17: G = { let __values: [G; 6] = [__v_15, __v_3, __v_4, __v_5, __v_6, __v_16]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_15: G = __r_arr[0];
+                        let __v_16: G = G::from_u64(0);
+                        let __v_17: G = { let __values: [G; 6] = [__v_16, __v_3, __v_4, __v_5, __v_6, __v_15]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_112] = [__v_17];
                         record.function_queries[112].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -11370,19 +11370,19 @@ fn aiur_fn_112(
                             if (__v_5 != __v_11) {
                               return Err(ExecError::AssertEqMismatch { lhs: __v_5.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: None });
                             }
-                            let __v_17: G = G::from_u64(0);
                             let __r_arr: [G; OUT_112] = { let __args: [G; IN_112] = [__v_7, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[112].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[112].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[112].bump_multiplicity(__i); } let __ret: [G; OUT_112] = unsafe { *(record.function_queries[112].output_at(__i).as_ptr() as *const [G; OUT_112]) }; __ret }, _ => aiur_fn_112(__args, record, io_buffer, __cu)? } };
-                            let __v_18: G = __r_arr[0];
-                            let __v_19: G = { let __values: [G; 6] = [__v_17, __v_3, __v_4, __v_5, __v_6, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_17: G = __r_arr[0];
+                            let __v_18: G = G::from_u64(0);
+                            let __v_19: G = { let __values: [G; 6] = [__v_18, __v_3, __v_4, __v_5, __v_6, __v_17]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_112] = [__v_19];
                             record.function_queries[112].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                           _ => {
-                            let __v_17: G = G::from_u64(0);
                             let __r_arr: [G; OUT_112] = { let __args: [G; IN_112] = [__v_0, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[112].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[112].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[112].bump_multiplicity(__i); } let __ret: [G; OUT_112] = unsafe { *(record.function_queries[112].output_at(__i).as_ptr() as *const [G; OUT_112]) }; __ret }, _ => aiur_fn_112(__args, record, io_buffer, __cu)? } };
-                            let __v_18: G = __r_arr[0];
-                            let __v_19: G = { let __values: [G; 6] = [__v_17, __v_9, __v_10, __v_11, __v_12, __v_18]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __v_17: G = __r_arr[0];
+                            let __v_18: G = G::from_u64(0);
+                            let __v_19: G = { let __values: [G; 6] = [__v_18, __v_9, __v_10, __v_11, __v_12, __v_17]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                             let __ret: [G; OUT_112] = [__v_19];
                             record.function_queries[112].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
@@ -11447,11 +11447,11 @@ fn aiur_fn_113(
         let __v_12: G = __loaded[5];
         match __v_7.as_canonical_u64() {
           1u64 => {
-            let __v_13: G = G::from_u64(0);
+            let __v_13: G = G::from_u64(1);
             let __v_14: G = G::from_u64(1);
-            let __v_15: G = G::from_u64(1);
-            let __v_16: G = { let __values: [G; 6] = [__v_14, __v_15, __v_15, __v_15, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_17: G = { let __values: [G; 6] = [__v_13, __v_2, __v_3, __v_4, __v_5, __v_16]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_15: G = { let __values: [G; 6] = [__v_13, __v_14, __v_14, __v_14, __v_14, __v_14]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_16: G = G::from_u64(0);
+            let __v_17: G = { let __values: [G; 6] = [__v_16, __v_2, __v_3, __v_4, __v_5, __v_15]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_18: G = G::from_u64(1);
             let __v_19: G = G::from_u64(1);
             let __v_20: G = { let __values: [G; 6] = [__v_18, __v_19, __v_19, __v_19, __v_19, __v_19]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -11589,12 +11589,12 @@ fn aiur_fn_115(
           0u64 => {
             let __r_arr: [G; OUT_109] = { let __args: [G; IN_109] = [__v_8, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[109].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[109].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[109].bump_multiplicity(__i); } let __ret: [G; OUT_109] = unsafe { *(record.function_queries[109].output_at(__i).as_ptr() as *const [G; OUT_109]) }; __ret }, _ => aiur_fn_109(__args, record, io_buffer, __cu)? } };
             let __v_10: G = __r_arr[0];
-            let __v_11: G = G::from_u64(0);
             let __r_arr: [G; OUT_111] = { let __args: [G; IN_111] = [__v_5]; let __cu = unconstrained; let __hit = record.function_queries[111].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[111].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[111].bump_multiplicity(__i); } let __ret: [G; OUT_111] = unsafe { *(record.function_queries[111].output_at(__i).as_ptr() as *const [G; OUT_111]) }; __ret }, _ => aiur_fn_111(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
+            let __v_11: G = __r_arr[0];
             let __r_arr: [G; OUT_115] = { let __args: [G; IN_115] = [__v_6, __v_9, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[115].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[115].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[115].bump_multiplicity(__i); } let __ret: [G; OUT_115] = unsafe { *(record.function_queries[115].output_at(__i).as_ptr() as *const [G; OUT_115]) }; __ret }, _ => aiur_fn_115(__args, record, io_buffer, __cu)? } };
-            let __v_13: G = __r_arr[0];
-            let __v_14: G = { let __values: [G; 6] = [__v_11, __v_12, __v_5, __v_8, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_12: G = __r_arr[0];
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 6] = [__v_13, __v_11, __v_5, __v_8, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_115] = [__v_14];
             record.function_queries[115].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -11675,23 +11675,23 @@ fn aiur_fn_116(
                             let __v_25: G = G::from_bool((__v_24 == G::ZERO));
                             match __v_25.as_canonical_u64() {
                               1u64 => {
-                                let __r_arr: [G; OUT_101] = { let __args: [G; IN_101] = [__v_8, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[101].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[101].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[101].bump_multiplicity(__i); } let __ret: [G; OUT_101] = unsafe { *(record.function_queries[101].output_at(__i).as_ptr() as *const [G; OUT_101]) }; __ret }, _ => aiur_fn_101(__args, record, io_buffer, __cu)? } };
+                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_7, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
                                 let __v_26: G = __r_arr[0];
-                                let __r_arr: [G; OUT_110] = { let __args: [G; IN_110] = [__v_7, __v_2, __v_3, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[110].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[110].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[110].bump_multiplicity(__i); } let __ret: [G; OUT_110] = unsafe { *(record.function_queries[110].output_at(__i).as_ptr() as *const [G; OUT_110]) }; __ret }, _ => aiur_fn_110(__args, record, io_buffer, __cu)? } };
+                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_17, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
                                 let __v_27: G = __r_arr[0];
-                                let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_19, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
+                                if (__v_26 != __v_27) {
+                                  return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_27.as_canonical_u64(), msg: None });
+                                }
+                                let __r_arr: [G; OUT_101] = { let __args: [G; IN_101] = [__v_8, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[101].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[101].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[101].bump_multiplicity(__i); } let __ret: [G; OUT_101] = unsafe { *(record.function_queries[101].output_at(__i).as_ptr() as *const [G; OUT_101]) }; __ret }, _ => aiur_fn_101(__args, record, io_buffer, __cu)? } };
                                 let __v_28: G = __r_arr[0];
-                                let __v_29: G = __r_arr[1];
-                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_7, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
+                                let __r_arr: [G; OUT_110] = { let __args: [G; IN_110] = [__v_7, __v_2, __v_3, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[110].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[110].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[110].bump_multiplicity(__i); } let __ret: [G; OUT_110] = unsafe { *(record.function_queries[110].output_at(__i).as_ptr() as *const [G; OUT_110]) }; __ret }, _ => aiur_fn_110(__args, record, io_buffer, __cu)? } };
+                                let __v_29: G = __r_arr[0];
+                                let __r_arr: [G; OUT_116] = { let __args: [G; IN_116] = [__v_19, __v_1, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[116].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[116].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[116].bump_multiplicity(__i); } let __ret: [G; OUT_116] = unsafe { *(record.function_queries[116].output_at(__i).as_ptr() as *const [G; OUT_116]) }; __ret }, _ => aiur_fn_116(__args, record, io_buffer, __cu)? } };
                                 let __v_30: G = __r_arr[0];
-                                let __r_arr: [G; OUT_105] = { let __args: [G; IN_105] = [__v_17, __v_2, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[105].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[105].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[105].bump_multiplicity(__i); } let __ret: [G; OUT_105] = unsafe { *(record.function_queries[105].output_at(__i).as_ptr() as *const [G; OUT_105]) }; __ret }, _ => aiur_fn_105(__args, record, io_buffer, __cu)? } };
-                                let __v_31: G = __r_arr[0];
-                                if (__v_30 != __v_31) {
-                                  return Err(ExecError::AssertEqMismatch { lhs: __v_30.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
-                                }
+                                let __v_31: G = __r_arr[1];
                                 let __v_32: G = G::from_u64(0);
-                                let __v_33: G = { let __values: [G; 6] = [__v_32, __v_13, __v_12, __v_7, __v_27, __v_28]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                                let __ret: [G; OUT_116] = [__v_33, __v_29];
+                                let __v_33: G = { let __values: [G; 6] = [__v_32, __v_13, __v_12, __v_7, __v_29, __v_30]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                                let __ret: [G; OUT_116] = [__v_33, __v_31];
                                 record.function_queries[116].finish(&inp[..], &__ret[..], !unconstrained);
                                 return Ok(__ret);
                               },
@@ -11740,11 +11740,11 @@ fn aiur_fn_116(
                         let __v_23: G = __r_arr[0];
                         let __r_arr: [G; OUT_110] = { let __args: [G; IN_110] = [__v_7, __v_2, __v_3, __v_23]; let __cu = unconstrained; let __hit = record.function_queries[110].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[110].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[110].bump_multiplicity(__i); } let __ret: [G; OUT_110] = unsafe { *(record.function_queries[110].output_at(__i).as_ptr() as *const [G; OUT_110]) }; __ret }, _ => aiur_fn_110(__args, record, io_buffer, __cu)? } };
                         let __v_24: G = __r_arr[0];
-                        let __v_25: G = G::from_u64(0);
+                        let __v_25: G = G::from_u64(1);
                         let __v_26: G = G::from_u64(1);
-                        let __v_27: G = G::from_u64(1);
-                        let __v_28: G = { let __values: [G; 6] = [__v_26, __v_27, __v_27, __v_27, __v_27, __v_27]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_29: G = { let __values: [G; 6] = [__v_25, __v_13, __v_12, __v_7, __v_24, __v_28]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_27: G = { let __values: [G; 6] = [__v_25, __v_26, __v_26, __v_26, __v_26, __v_26]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_28: G = G::from_u64(0);
+                        let __v_29: G = { let __values: [G; 6] = [__v_28, __v_13, __v_12, __v_7, __v_24, __v_27]; let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __ret: [G; OUT_116] = [__v_29, __v_22];
                         record.function_queries[116].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
@@ -11828,49 +11828,49 @@ fn aiur_fn_118(
     let __v_3: G = inp[3];
     let __v_4: G = inp[4];
     let __v_5: G = inp[5];
-    let __r_arr: [G; OUT_115] = { let __args: [G; IN_115] = [__v_3, __v_1, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[115].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[115].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[115].bump_multiplicity(__i); } let __ret: [G; OUT_115] = unsafe { *(record.function_queries[115].output_at(__i).as_ptr() as *const [G; OUT_115]) }; __ret }, _ => aiur_fn_115(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
     let __v_6: G = __r_arr[0];
-    let __r_arr: [G; OUT_114] = { let __args: [G; IN_114] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[114].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[114].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[114].bump_multiplicity(__i); } let __ret: [G; OUT_114] = unsafe { *(record.function_queries[114].output_at(__i).as_ptr() as *const [G; OUT_114]) }; __ret }, _ => aiur_fn_114(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
     let __v_7: G = __r_arr[0];
-    let __r_arr: [G; OUT_117] = { let __args: [G; IN_117] = [__v_7, __v_4, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[117].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[117].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[117].bump_multiplicity(__i); } let __ret: [G; OUT_117] = unsafe { *(record.function_queries[117].output_at(__i).as_ptr() as *const [G; OUT_117]) }; __ret }, _ => aiur_fn_117(__args, record, io_buffer, __cu)? } };
-    let __v_8: G = __r_arr[0];
-    let __v_9: G = __r_arr[1];
-    let __loaded: [G; 6] = { let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; let __ptr_u64 = __v_8.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 6 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 6] = __args[..6].try_into().unwrap(); __arr };
-    let __v_10: G = __loaded[0];
-    let __v_11: G = __loaded[1];
-    let __v_12: G = __loaded[2];
-    let __v_13: G = __loaded[3];
-    let __v_14: G = __loaded[4];
-    let __v_15: G = __loaded[5];
-    match __v_10.as_canonical_u64() {
+    let __v_8: G = (__v_6 - __v_7);
+    let __v_9: G = G::from_bool((__v_8 == G::ZERO));
+    let __v_10: G = G::from_u64(1);
+    if (__v_9 != __v_10) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: None });
+    }
+    let __r_arr: [G; OUT_115] = { let __args: [G; IN_115] = [__v_3, __v_1, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[115].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[115].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[115].bump_multiplicity(__i); } let __ret: [G; OUT_115] = unsafe { *(record.function_queries[115].output_at(__i).as_ptr() as *const [G; OUT_115]) }; __ret }, _ => aiur_fn_115(__args, record, io_buffer, __cu)? } };
+    let __v_11: G = __r_arr[0];
+    let __r_arr: [G; OUT_114] = { let __args: [G; IN_114] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[114].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[114].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[114].bump_multiplicity(__i); } let __ret: [G; OUT_114] = unsafe { *(record.function_queries[114].output_at(__i).as_ptr() as *const [G; OUT_114]) }; __ret }, _ => aiur_fn_114(__args, record, io_buffer, __cu)? } };
+    let __v_12: G = __r_arr[0];
+    let __r_arr: [G; OUT_117] = { let __args: [G; IN_117] = [__v_12, __v_4, __v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[117].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[117].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[117].bump_multiplicity(__i); } let __ret: [G; OUT_117] = unsafe { *(record.function_queries[117].output_at(__i).as_ptr() as *const [G; OUT_117]) }; __ret }, _ => aiur_fn_117(__args, record, io_buffer, __cu)? } };
+    let __v_13: G = __r_arr[0];
+    let __v_14: G = __r_arr[1];
+    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_14]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+    let __v_15: G = __r_arr[0];
+    let __v_16: G = G::from_u64(0);
+    if (__v_15 != __v_16) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_15.as_canonical_u64(), rhs: __v_16.as_canonical_u64(), msg: None });
+    }
+    let __loaded: [G; 6] = { let __mq = record.memory_queries.get_mut(&6).ok_or(ExecError::InvalidMemorySize(6))?; let __ptr_u64 = __v_13.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 6 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 6] = __args[..6].try_into().unwrap(); __arr };
+    let __v_17: G = __loaded[0];
+    let __v_18: G = __loaded[1];
+    let __v_19: G = __loaded[2];
+    let __v_20: G = __loaded[3];
+    let __v_21: G = __loaded[4];
+    let __v_22: G = __loaded[5];
+    match __v_17.as_canonical_u64() {
       0u64 => {
-        match __v_11.as_canonical_u64() {
+        let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
+        let __v_23: G = __r_arr[0];
+        let __v_24: G = G::from_u64(0);
+        if (__v_23 != __v_24) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: None });
+        }
+        match __v_18.as_canonical_u64() {
           _ => {
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_16: G = __r_arr[0];
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_17: G = __r_arr[0];
-            let __v_18: G = (__v_16 - __v_17);
-            let __v_19: G = G::from_bool((__v_18 == G::ZERO));
-            let __v_20: G = G::from_u64(1);
-            if (__v_19 != __v_20) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_21: G = __r_arr[0];
-            let __v_22: G = G::from_u64(0);
-            if (__v_21 != __v_22) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_21.as_canonical_u64(), rhs: __v_22.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_247] = { let __args: [G; IN_247] = [__v_15]; let __cu = unconstrained; let __hit = record.function_queries[247].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[247].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[247].bump_multiplicity(__i); } let __ret: [G; OUT_247] = unsafe { *(record.function_queries[247].output_at(__i).as_ptr() as *const [G; OUT_247]) }; __ret }, _ => aiur_fn_247(__args, record, io_buffer, __cu)? } };
-            let __v_23: G = __r_arr[0];
-            let __v_24: G = G::from_u64(0);
-            if (__v_23 != __v_24) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_0, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_0, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
             let __v_25: G = __r_arr[0];
-            let __v_26: G = (__v_25 - __v_14);
+            let __v_26: G = (__v_25 - __v_21);
             let __v_27: G = G::from_bool((__v_26 == G::ZERO));
             let __ret: [G; OUT_118] = [__v_27];
             record.function_queries[118].finish(&inp[..], &__ret[..], !unconstrained);
@@ -11879,7 +11879,7 @@ fn aiur_fn_118(
         }
       },
       _ => {
-        return Err(ExecError::MatchNoCase(__v_10.as_canonical_u64()));
+        return Err(ExecError::MatchNoCase(__v_17.as_canonical_u64()));
       },
     }
   })
@@ -12258,100 +12258,100 @@ fn aiur_fn_124(
         if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_10; let __vj = __v_11; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
         if !unconstrained { let __vi = __v_12; let __vj = __v_13; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_14: G = G::from_u64(1020);
-        let __v_15: G = (__v_13 - __v_14);
-        let __v_16: G = (__v_12 + __v_15);
-        let __v_17: G = (__v_11 + __v_16);
-        let __v_18: G = (__v_10 + __v_17);
-        let __v_19: G = G::from_bool((__v_18 == G::ZERO));
-        let __v_20: G = (__v_8 + __v_9);
-        let __v_21: G = (__v_7 + __v_20);
-        let __v_22: G = (__v_6 + __v_21);
-        let __v_23: G = G::from_bool((__v_22 == G::ZERO));
-        let __gb: [u8; 8] = __v_4.as_canonical_u64().to_le_bytes();
-        let __v_24: G = G::from_u8(__gb[0]);
-        let __v_25: G = G::from_u8(__gb[1]);
-        let __v_26: G = G::from_u8(__gb[2]);
-        let __v_27: G = G::from_u8(__gb[3]);
-        let __v_28: G = G::from_u8(__gb[4]);
-        let __v_29: G = G::from_u8(__gb[5]);
-        let __v_30: G = G::from_u8(__gb[6]);
-        let __v_31: G = G::from_u8(__gb[7]);
-        if !unconstrained { let __vi = __v_24; let __vj = __v_25; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        if !unconstrained { let __vi = __v_26; let __vj = __v_27; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        if !unconstrained { let __vi = __v_28; let __vj = __v_29; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        if !unconstrained { let __vi = __v_30; let __vj = __v_31; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-        let __v_32: G = G::from_u64(1020);
-        let __v_33: G = (__v_31 - __v_32);
-        let __v_34: G = (__v_30 + __v_33);
-        let __v_35: G = (__v_29 + __v_34);
-        let __v_36: G = (__v_28 + __v_35);
-        let __v_37: G = G::from_bool((__v_36 == G::ZERO));
-        let __v_38: G = (__v_26 + __v_27);
-        let __v_39: G = (__v_25 + __v_38);
-        let __v_40: G = (__v_24 + __v_39);
-        let __v_41: G = G::from_bool((__v_40 == G::ZERO));
-        let __v_42: G = G::from_u64(256);
-        let __v_43: G = (__v_42 * __v_7);
-        let __v_44: G = G::from_u64(65536);
-        let __v_45: G = (__v_44 * __v_8);
-        let __v_46: G = G::from_u64(16777216);
-        let __v_47: G = (__v_46 * __v_9);
-        let __v_48: G = G::from_u64(4294967296);
-        let __v_49: G = (__v_48 * __v_10);
-        let __v_50: G = G::from_u64(1099511627776);
-        let __v_51: G = (__v_50 * __v_11);
-        let __v_52: G = G::from_u64(281474976710656);
-        let __v_53: G = (__v_52 * __v_12);
-        let __v_54: G = G::from_u64(72057594037927936);
-        let __v_55: G = (__v_54 * __v_13);
-        let __v_56: G = (__v_53 + __v_55);
-        let __v_57: G = (__v_51 + __v_56);
-        let __v_58: G = (__v_49 + __v_57);
-        let __v_59: G = (__v_47 + __v_58);
-        let __v_60: G = (__v_45 + __v_59);
-        let __v_61: G = (__v_43 + __v_60);
-        let __v_62: G = (__v_6 + __v_61);
-        if (__v_62 != __v_3) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_62.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
+        let __v_14: G = G::from_u64(256);
+        let __v_15: G = (__v_14 * __v_7);
+        let __v_16: G = G::from_u64(65536);
+        let __v_17: G = (__v_16 * __v_8);
+        let __v_18: G = G::from_u64(16777216);
+        let __v_19: G = (__v_18 * __v_9);
+        let __v_20: G = G::from_u64(4294967296);
+        let __v_21: G = (__v_20 * __v_10);
+        let __v_22: G = G::from_u64(1099511627776);
+        let __v_23: G = (__v_22 * __v_11);
+        let __v_24: G = G::from_u64(281474976710656);
+        let __v_25: G = (__v_24 * __v_12);
+        let __v_26: G = G::from_u64(72057594037927936);
+        let __v_27: G = (__v_26 * __v_13);
+        let __v_28: G = (__v_25 + __v_27);
+        let __v_29: G = (__v_23 + __v_28);
+        let __v_30: G = (__v_21 + __v_29);
+        let __v_31: G = (__v_19 + __v_30);
+        let __v_32: G = (__v_17 + __v_31);
+        let __v_33: G = (__v_15 + __v_32);
+        let __v_34: G = (__v_6 + __v_33);
+        if (__v_34 != __v_3) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
         }
-        let __v_63: G = G::from_u64(1);
-        let __v_64: G = G::from_u64(1);
-        let __v_65: G = (__v_64 - __v_23);
-        let __v_66: G = (__v_19 * __v_65);
-        let __v_67: G = (__v_63 - __v_66);
-        let __v_68: G = G::from_u64(1);
-        if (__v_67 != __v_68) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_67.as_canonical_u64(), rhs: __v_68.as_canonical_u64(), msg: None });
+        let __v_35: G = G::from_u64(1020);
+        let __v_36: G = (__v_13 - __v_35);
+        let __v_37: G = (__v_12 + __v_36);
+        let __v_38: G = (__v_11 + __v_37);
+        let __v_39: G = (__v_10 + __v_38);
+        let __v_40: G = G::from_bool((__v_39 == G::ZERO));
+        let __v_41: G = (__v_8 + __v_9);
+        let __v_42: G = (__v_7 + __v_41);
+        let __v_43: G = (__v_6 + __v_42);
+        let __v_44: G = G::from_bool((__v_43 == G::ZERO));
+        let __v_45: G = G::from_u64(1);
+        let __v_46: G = G::from_u64(1);
+        let __v_47: G = (__v_46 - __v_44);
+        let __v_48: G = (__v_40 * __v_47);
+        let __v_49: G = (__v_45 - __v_48);
+        let __v_50: G = G::from_u64(1);
+        if (__v_49 != __v_50) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_49.as_canonical_u64(), rhs: __v_50.as_canonical_u64(), msg: None });
         }
-        let __v_69: G = G::from_u64(256);
-        let __v_70: G = (__v_69 * __v_25);
-        let __v_71: G = G::from_u64(65536);
-        let __v_72: G = (__v_71 * __v_26);
-        let __v_73: G = G::from_u64(16777216);
-        let __v_74: G = (__v_73 * __v_27);
-        let __v_75: G = G::from_u64(4294967296);
-        let __v_76: G = (__v_75 * __v_28);
-        let __v_77: G = G::from_u64(1099511627776);
-        let __v_78: G = (__v_77 * __v_29);
-        let __v_79: G = G::from_u64(281474976710656);
-        let __v_80: G = (__v_79 * __v_30);
-        let __v_81: G = G::from_u64(72057594037927936);
-        let __v_82: G = (__v_81 * __v_31);
-        let __v_83: G = (__v_80 + __v_82);
-        let __v_84: G = (__v_78 + __v_83);
-        let __v_85: G = (__v_76 + __v_84);
-        let __v_86: G = (__v_74 + __v_85);
-        let __v_87: G = (__v_72 + __v_86);
-        let __v_88: G = (__v_70 + __v_87);
-        let __v_89: G = (__v_24 + __v_88);
-        if (__v_89 != __v_4) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: None });
+        let __gb: [u8; 8] = __v_4.as_canonical_u64().to_le_bytes();
+        let __v_51: G = G::from_u8(__gb[0]);
+        let __v_52: G = G::from_u8(__gb[1]);
+        let __v_53: G = G::from_u8(__gb[2]);
+        let __v_54: G = G::from_u8(__gb[3]);
+        let __v_55: G = G::from_u8(__gb[4]);
+        let __v_56: G = G::from_u8(__gb[5]);
+        let __v_57: G = G::from_u8(__gb[6]);
+        let __v_58: G = G::from_u8(__gb[7]);
+        if !unconstrained { let __vi = __v_51; let __vj = __v_52; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        if !unconstrained { let __vi = __v_53; let __vj = __v_54; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        if !unconstrained { let __vi = __v_55; let __vj = __v_56; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        if !unconstrained { let __vi = __v_57; let __vj = __v_58; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+        let __v_59: G = G::from_u64(256);
+        let __v_60: G = (__v_59 * __v_52);
+        let __v_61: G = G::from_u64(65536);
+        let __v_62: G = (__v_61 * __v_53);
+        let __v_63: G = G::from_u64(16777216);
+        let __v_64: G = (__v_63 * __v_54);
+        let __v_65: G = G::from_u64(4294967296);
+        let __v_66: G = (__v_65 * __v_55);
+        let __v_67: G = G::from_u64(1099511627776);
+        let __v_68: G = (__v_67 * __v_56);
+        let __v_69: G = G::from_u64(281474976710656);
+        let __v_70: G = (__v_69 * __v_57);
+        let __v_71: G = G::from_u64(72057594037927936);
+        let __v_72: G = (__v_71 * __v_58);
+        let __v_73: G = (__v_70 + __v_72);
+        let __v_74: G = (__v_68 + __v_73);
+        let __v_75: G = (__v_66 + __v_74);
+        let __v_76: G = (__v_64 + __v_75);
+        let __v_77: G = (__v_62 + __v_76);
+        let __v_78: G = (__v_60 + __v_77);
+        let __v_79: G = (__v_51 + __v_78);
+        if (__v_79 != __v_4) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: None });
         }
+        let __v_80: G = G::from_u64(1020);
+        let __v_81: G = (__v_58 - __v_80);
+        let __v_82: G = (__v_57 + __v_81);
+        let __v_83: G = (__v_56 + __v_82);
+        let __v_84: G = (__v_55 + __v_83);
+        let __v_85: G = G::from_bool((__v_84 == G::ZERO));
+        let __v_86: G = (__v_53 + __v_54);
+        let __v_87: G = (__v_52 + __v_86);
+        let __v_88: G = (__v_51 + __v_87);
+        let __v_89: G = G::from_bool((__v_88 == G::ZERO));
         let __v_90: G = G::from_u64(1);
         let __v_91: G = G::from_u64(1);
-        let __v_92: G = (__v_91 - __v_41);
-        let __v_93: G = (__v_37 * __v_92);
+        let __v_92: G = (__v_91 - __v_89);
+        let __v_93: G = (__v_85 * __v_92);
         let __v_94: G = (__v_90 - __v_93);
         let __v_95: G = G::from_u64(1);
         if (__v_94 != __v_95) {
@@ -12359,7 +12359,7 @@ fn aiur_fn_124(
         }
         let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
         let __v_96: G = __r_arr[0];
-        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_96]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_96]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
         let __v_97: G = __r_arr[0];
         let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_97]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
         let __v_98: G = __r_arr[0];
@@ -12650,50 +12650,50 @@ fn aiur_fn_130(
             let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_36, __v_6, __v_16, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
             let __v_38: G = __r_arr[0];
             let __v_39: G = __r_arr[1];
-            let __v_40: G = G::from_u64(0);
-            let __v_41: G = G::from_u64(256);
-            let __v_42: G = (__v_41 * __v_21);
-            let __v_43: G = G::from_u64(65536);
-            let __v_44: G = (__v_43 * __v_22);
-            let __v_45: G = G::from_u64(16777216);
-            let __v_46: G = (__v_45 * __v_23);
-            let __v_47: G = G::from_u64(4294967296);
-            let __v_48: G = (__v_47 * __v_24);
-            let __v_49: G = G::from_u64(1099511627776);
-            let __v_50: G = (__v_49 * __v_25);
-            let __v_51: G = G::from_u64(281474976710656);
-            let __v_52: G = (__v_51 * __v_26);
-            let __v_53: G = G::from_u64(72057594037927936);
-            let __v_54: G = (__v_53 * __v_27);
-            let __v_55: G = (__v_52 + __v_54);
-            let __v_56: G = (__v_50 + __v_55);
-            let __v_57: G = (__v_48 + __v_56);
-            let __v_58: G = (__v_46 + __v_57);
-            let __v_59: G = (__v_44 + __v_58);
-            let __v_60: G = (__v_42 + __v_59);
-            let __v_61: G = (__v_20 + __v_60);
-            let __v_62: G = G::from_u64(256);
-            let __v_63: G = (__v_62 * __v_29);
-            let __v_64: G = G::from_u64(65536);
-            let __v_65: G = (__v_64 * __v_30);
-            let __v_66: G = G::from_u64(16777216);
-            let __v_67: G = (__v_66 * __v_31);
-            let __v_68: G = G::from_u64(4294967296);
-            let __v_69: G = (__v_68 * __v_32);
-            let __v_70: G = G::from_u64(1099511627776);
-            let __v_71: G = (__v_70 * __v_33);
-            let __v_72: G = G::from_u64(281474976710656);
-            let __v_73: G = (__v_72 * __v_34);
-            let __v_74: G = G::from_u64(72057594037927936);
-            let __v_75: G = (__v_74 * __v_35);
-            let __v_76: G = (__v_73 + __v_75);
-            let __v_77: G = (__v_71 + __v_76);
-            let __v_78: G = (__v_69 + __v_77);
-            let __v_79: G = (__v_67 + __v_78);
-            let __v_80: G = (__v_65 + __v_79);
-            let __v_81: G = (__v_63 + __v_80);
-            let __v_82: G = (__v_28 + __v_81);
-            let __v_83: G = { let __values: [G; 4] = [__v_40, __v_61, __v_82, __v_38]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_40: G = G::from_u64(256);
+            let __v_41: G = (__v_40 * __v_21);
+            let __v_42: G = G::from_u64(65536);
+            let __v_43: G = (__v_42 * __v_22);
+            let __v_44: G = G::from_u64(16777216);
+            let __v_45: G = (__v_44 * __v_23);
+            let __v_46: G = G::from_u64(4294967296);
+            let __v_47: G = (__v_46 * __v_24);
+            let __v_48: G = G::from_u64(1099511627776);
+            let __v_49: G = (__v_48 * __v_25);
+            let __v_50: G = G::from_u64(281474976710656);
+            let __v_51: G = (__v_50 * __v_26);
+            let __v_52: G = G::from_u64(72057594037927936);
+            let __v_53: G = (__v_52 * __v_27);
+            let __v_54: G = (__v_51 + __v_53);
+            let __v_55: G = (__v_49 + __v_54);
+            let __v_56: G = (__v_47 + __v_55);
+            let __v_57: G = (__v_45 + __v_56);
+            let __v_58: G = (__v_43 + __v_57);
+            let __v_59: G = (__v_41 + __v_58);
+            let __v_60: G = (__v_20 + __v_59);
+            let __v_61: G = G::from_u64(256);
+            let __v_62: G = (__v_61 * __v_29);
+            let __v_63: G = G::from_u64(65536);
+            let __v_64: G = (__v_63 * __v_30);
+            let __v_65: G = G::from_u64(16777216);
+            let __v_66: G = (__v_65 * __v_31);
+            let __v_67: G = G::from_u64(4294967296);
+            let __v_68: G = (__v_67 * __v_32);
+            let __v_69: G = G::from_u64(1099511627776);
+            let __v_70: G = (__v_69 * __v_33);
+            let __v_71: G = G::from_u64(281474976710656);
+            let __v_72: G = (__v_71 * __v_34);
+            let __v_73: G = G::from_u64(72057594037927936);
+            let __v_74: G = (__v_73 * __v_35);
+            let __v_75: G = (__v_72 + __v_74);
+            let __v_76: G = (__v_70 + __v_75);
+            let __v_77: G = (__v_68 + __v_76);
+            let __v_78: G = (__v_66 + __v_77);
+            let __v_79: G = (__v_64 + __v_78);
+            let __v_80: G = (__v_62 + __v_79);
+            let __v_81: G = (__v_28 + __v_80);
+            let __v_82: G = G::from_u64(0);
+            let __v_83: G = { let __values: [G; 4] = [__v_82, __v_60, __v_81, __v_38]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_130] = [__v_83, __v_39];
             record.function_queries[130].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -12800,16 +12800,16 @@ fn aiur_fn_132(
             return Ok(__ret);
           },
           _ => {
-            let __v_6: G = G::from_u64(0);
-            let __v_7: G = G::from_u64(1);
+            let __v_6: G = G::from_u64(1);
+            let __v_7: G = G::from_u64(0);
             let __v_8: G = G::from_u64(0);
             let __v_9: G = G::from_u64(0);
-            let __v_10: G = G::from_u64(0);
-            let __v_11: G = G::from_u64(1);
-            let __v_12: G = (__v_3 - __v_11);
-            let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_0, __v_1, __v_2, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
-            let __v_13: G = __r_arr[0];
-            let __v_14: G = { let __values: [G; 7] = [__v_6, __v_3, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_10: G = G::from_u64(1);
+            let __v_11: G = (__v_3 - __v_10);
+            let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_0, __v_1, __v_2, __v_11]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
+            let __v_12: G = __r_arr[0];
+            let __v_13: G = G::from_u64(0);
+            let __v_14: G = { let __values: [G; 7] = [__v_13, __v_3, __v_6, __v_7, __v_8, __v_9, __v_12]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_132] = [__v_14];
             record.function_queries[132].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -12886,10 +12886,10 @@ fn aiur_fn_133(
                 return Ok(__ret);
               },
               _ => {
-                let __v_17: G = G::from_u64(0);
                 let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_14, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
-                let __v_18: G = __r_arr[0];
-                let __v_19: G = { let __values: [G; 7] = [__v_17, __v_9, __v_10, __v_11, __v_12, __v_13, __v_18]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_17: G = __r_arr[0];
+                let __v_18: G = G::from_u64(0);
+                let __v_19: G = { let __values: [G; 7] = [__v_18, __v_9, __v_10, __v_11, __v_12, __v_13, __v_17]; let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_133] = [__v_19];
                 record.function_queries[133].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -13025,57 +13025,57 @@ fn aiur_fn_136(
     let __v_7: G = inp[7];
     let __v_8: G = inp[8];
     let __v_9: G = inp[9];
-    let __v_10: G = (__v_3 - __v_1);
-    let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_2, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
+    let __v_10: G = __r_arr[0];
+    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
     let __v_11: G = __r_arr[0];
-    let __v_12: G = G::from_u64(7);
-    let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
-    let __v_13: G = __r_arr[0];
+    let __v_12: G = (__v_10 - __v_11);
+    let __v_13: G = G::from_bool((__v_12 == G::ZERO));
     let __v_14: G = G::from_u64(1);
-    let __v_15: G = G::from_u64(1);
-    let __v_16: G = { let __values: [G; 3] = [__v_14, __v_15, __v_15]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_119] = { let __args: [G; IN_119] = [__v_11, __v_16]; let __cu = unconstrained; let __hit = record.function_queries[119].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[119].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[119].bump_multiplicity(__i); } let __ret: [G; OUT_119] = unsafe { *(record.function_queries[119].output_at(__i).as_ptr() as *const [G; OUT_119]) }; __ret }, _ => aiur_fn_119(__args, record, io_buffer, __cu)? } };
-    let __v_17: G = __r_arr[0];
-    let __r_arr: [G; OUT_120] = { let __args: [G; IN_120] = [__v_13, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[120].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[120].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[120].bump_multiplicity(__i); } let __ret: [G; OUT_120] = unsafe { *(record.function_queries[120].output_at(__i).as_ptr() as *const [G; OUT_120]) }; __ret }, _ => aiur_fn_120(__args, record, io_buffer, __cu)? } };
+    if (__v_13 != __v_14) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_13.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: None });
+    }
+    let __v_15: G = (__v_3 - __v_1);
+    let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_2, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
+    let __v_16: G = __r_arr[0];
+    let __v_17: G = G::from_u64(7);
+    let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
     let __v_18: G = __r_arr[0];
-    let __v_19: G = (__v_12 * __v_18);
-    let __v_20: G = G::from_u64(0);
-    let __v_21: G = (__v_4 - __v_19);
-    let __v_22: G = (__v_5 - __v_20);
-    let __v_23: G = (__v_21 * __v_21);
-    let __v_24: G = G::from_u64(7);
-    let __v_25: G = (__v_22 * __v_22);
-    let __v_26: G = (__v_24 * __v_25);
-    let __v_27: G = (__v_23 - __v_26);
-    let __v_28: G = g_inverse_value(__v_27);
-    let __v_29: G = (__v_27 * __v_28);
-    let __v_30: G = G::from_u64(1);
-    let __v_31: G = (__v_29 - __v_30);
-    let __v_32: G = (__v_27 * __v_31);
-    let __v_33: G = G::from_u64(0);
-    if (__v_32 != __v_33) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_32.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: None });
+    let __v_19: G = G::from_u64(1);
+    let __v_20: G = G::from_u64(1);
+    let __v_21: G = { let __values: [G; 3] = [__v_19, __v_20, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_119] = { let __args: [G; IN_119] = [__v_16, __v_21]; let __cu = unconstrained; let __hit = record.function_queries[119].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[119].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[119].bump_multiplicity(__i); } let __ret: [G; OUT_119] = unsafe { *(record.function_queries[119].output_at(__i).as_ptr() as *const [G; OUT_119]) }; __ret }, _ => aiur_fn_119(__args, record, io_buffer, __cu)? } };
+    let __v_22: G = __r_arr[0];
+    let __r_arr: [G; OUT_120] = { let __args: [G; IN_120] = [__v_18, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[120].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[120].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[120].bump_multiplicity(__i); } let __ret: [G; OUT_120] = unsafe { *(record.function_queries[120].output_at(__i).as_ptr() as *const [G; OUT_120]) }; __ret }, _ => aiur_fn_120(__args, record, io_buffer, __cu)? } };
+    let __v_23: G = __r_arr[0];
+    let __v_24: G = (__v_17 * __v_23);
+    let __v_25: G = G::from_u64(0);
+    let __v_26: G = (__v_4 - __v_24);
+    let __v_27: G = (__v_5 - __v_25);
+    let __v_28: G = (__v_26 * __v_26);
+    let __v_29: G = G::from_u64(7);
+    let __v_30: G = (__v_27 * __v_27);
+    let __v_31: G = (__v_29 * __v_30);
+    let __v_32: G = (__v_28 - __v_31);
+    let __v_33: G = g_inverse_value(__v_32);
+    let __v_34: G = (__v_32 * __v_33);
+    let __v_35: G = G::from_u64(1);
+    let __v_36: G = (__v_34 - __v_35);
+    let __v_37: G = (__v_32 * __v_36);
+    let __v_38: G = G::from_u64(0);
+    if (__v_37 != __v_38) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_37.as_canonical_u64(), rhs: __v_38.as_canonical_u64(), msg: None });
     }
-    let __v_34: G = (__v_28 * __v_31);
-    let __v_35: G = G::from_u64(0);
-    if (__v_34 != __v_35) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: None });
+    let __v_39: G = (__v_33 * __v_36);
+    let __v_40: G = G::from_u64(0);
+    if (__v_39 != __v_40) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_39.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: None });
     }
-    let __v_36: G = (__v_21 * __v_28);
-    let __v_37: G = G::from_u64(0);
-    let __v_38: G = (__v_37 - __v_22);
-    let __v_39: G = (__v_38 * __v_28);
-    let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-    let __v_40: G = __r_arr[0];
-    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-    let __v_41: G = __r_arr[0];
-    let __v_42: G = (__v_40 - __v_41);
-    let __v_43: G = G::from_bool((__v_42 == G::ZERO));
-    let __v_44: G = G::from_u64(1);
-    if (__v_43 != __v_44) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: None });
-    }
-    let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_0, __v_1, __v_6, __v_7, __v_36, __v_39, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
+    let __v_41: G = (__v_26 * __v_33);
+    let __v_42: G = G::from_u64(0);
+    let __v_43: G = (__v_42 - __v_27);
+    let __v_44: G = (__v_43 * __v_33);
+    let __r_arr: [G; OUT_133] = { let __args: [G; IN_133] = [__v_0, __v_1, __v_6, __v_7, __v_41, __v_44, __v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[133].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[133].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[133].bump_multiplicity(__i); } let __ret: [G; OUT_133] = unsafe { *(record.function_queries[133].output_at(__i).as_ptr() as *const [G; OUT_133]) }; __ret }, _ => aiur_fn_133(__args, record, io_buffer, __cu)? } };
     let __v_45: G = __r_arr[0];
     let __ret: [G; OUT_136] = [__v_45];
     record.function_queries[136].finish(&inp[..], &__ret[..], !unconstrained);
@@ -13355,21 +13355,21 @@ fn aiur_fn_141(
         let __v_16: G = __r_arr[0];
         match __v_16.as_canonical_u64() {
           _ => {
-            let __v_17: G = G::from_u64(0);
-            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_6, __v_10, __v_5, __v_7, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
-            let __v_18: G = __r_arr[0];
-            let __r_arr: [G; OUT_143] = { let __args: [G; IN_143] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[143].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[143].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[143].bump_multiplicity(__i); } let __ret: [G; OUT_143] = unsafe { *(record.function_queries[143].output_at(__i).as_ptr() as *const [G; OUT_143]) }; __ret }, _ => aiur_fn_143(__args, record, io_buffer, __cu)? } };
-            let __v_19: G = __r_arr[0];
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_20: G = __r_arr[0];
+            let __v_17: G = __r_arr[0];
             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-            let __v_21: G = __r_arr[0];
-            let __v_22: G = (__v_20 - __v_21);
-            let __v_23: G = G::from_bool((__v_22 == G::ZERO));
-            let __v_24: G = G::from_u64(1);
-            if (__v_23 != __v_24) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_24.as_canonical_u64(), msg: None });
+            let __v_18: G = __r_arr[0];
+            let __v_19: G = (__v_17 - __v_18);
+            let __v_20: G = G::from_bool((__v_19 == G::ZERO));
+            let __v_21: G = G::from_u64(1);
+            if (__v_20 != __v_21) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: None });
             }
+            let __v_22: G = G::from_u64(0);
+            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_6, __v_10, __v_5, __v_7, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
+            let __v_23: G = __r_arr[0];
+            let __r_arr: [G; OUT_143] = { let __args: [G; IN_143] = [__v_23]; let __cu = unconstrained; let __hit = record.function_queries[143].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[143].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[143].bump_multiplicity(__i); } let __ret: [G; OUT_143] = unsafe { *(record.function_queries[143].output_at(__i).as_ptr() as *const [G; OUT_143]) }; __ret }, _ => aiur_fn_143(__args, record, io_buffer, __cu)? } };
+            let __v_24: G = __r_arr[0];
             let __v_25: G = G::from_u64(0);
             let __v_26: G = G::from_u64(0);
             let __r_arr: [G; OUT_140] = { let __args: [G; IN_140] = [__v_0, __v_8, __v_9, __v_10, __v_25, __v_7, __v_26, __v_6, __v_5, __v_11, __v_12, __v_16, __v_4, __v_13, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[140].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[140].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[140].bump_multiplicity(__i); } let __ret: [G; OUT_140] = unsafe { *(record.function_queries[140].output_at(__i).as_ptr() as *const [G; OUT_140]) }; __ret }, _ => aiur_fn_140(__args, record, io_buffer, __cu)? } };
@@ -13411,17 +13411,17 @@ fn aiur_fn_142(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
         let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_0, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
-        let __v_6: G = (__v_5 + __v_1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = (__v_2 - __v_7);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_3 + __v_9);
-        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_0, __v_1, __v_8, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 3] = [__v_4, __v_6, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_4: G = __r_arr[0];
+        let __v_5: G = (__v_4 + __v_1);
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = (__v_2 - __v_6);
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_3 + __v_8);
+        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_0, __v_1, __v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 3] = [__v_11, __v_5, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_142] = [__v_12];
         record.function_queries[142].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -13517,17 +13517,17 @@ fn aiur_fn_144(
             return Ok(__ret);
           },
           1u64 => {
-            let __v_7: G = G::from_u64(0);
             let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_0, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = (__v_8 + __v_1);
-            let __v_10: G = G::from_u64(1);
-            let __v_11: G = (__v_3 - __v_10);
-            let __v_12: G = G::from_u64(1);
-            let __v_13: G = (__v_4 + __v_12);
-            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_0, __v_1, __v_2, __v_11, __v_13]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
-            let __v_14: G = __r_arr[0];
-            let __v_15: G = { let __values: [G; 3] = [__v_7, __v_9, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = (__v_7 + __v_1);
+            let __v_9: G = G::from_u64(1);
+            let __v_10: G = (__v_3 - __v_9);
+            let __v_11: G = G::from_u64(1);
+            let __v_12: G = (__v_4 + __v_11);
+            let __r_arr: [G; OUT_144] = { let __args: [G; IN_144] = [__v_0, __v_1, __v_2, __v_10, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[144].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[144].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[144].bump_multiplicity(__i); } let __ret: [G; OUT_144] = unsafe { *(record.function_queries[144].output_at(__i).as_ptr() as *const [G; OUT_144]) }; __ret }, _ => aiur_fn_144(__args, record, io_buffer, __cu)? } };
+            let __v_13: G = __r_arr[0];
+            let __v_14: G = G::from_u64(0);
+            let __v_15: G = { let __values: [G; 3] = [__v_14, __v_8, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_144] = [__v_15];
             record.function_queries[144].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -13598,228 +13598,228 @@ fn aiur_fn_146(
     if !unconstrained { let __vi = __v_6; let __vj = __v_7; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_8; let __vj = __v_9; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
     if !unconstrained { let __vi = __v_10; let __vj = __v_11; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_12: G = G::from_u64(1020);
-    let __v_13: G = (__v_11 - __v_12);
-    let __v_14: G = (__v_10 + __v_13);
-    let __v_15: G = (__v_9 + __v_14);
-    let __v_16: G = (__v_8 + __v_15);
-    let __v_17: G = G::from_bool((__v_16 == G::ZERO));
-    let __v_18: G = (__v_6 + __v_7);
-    let __v_19: G = (__v_5 + __v_18);
-    let __v_20: G = (__v_4 + __v_19);
-    let __v_21: G = G::from_bool((__v_20 == G::ZERO));
+    let __v_12: G = G::from_u64(256);
+    let __v_13: G = (__v_12 * __v_5);
+    let __v_14: G = G::from_u64(65536);
+    let __v_15: G = (__v_14 * __v_6);
+    let __v_16: G = G::from_u64(16777216);
+    let __v_17: G = (__v_16 * __v_7);
+    let __v_18: G = G::from_u64(4294967296);
+    let __v_19: G = (__v_18 * __v_8);
+    let __v_20: G = G::from_u64(1099511627776);
+    let __v_21: G = (__v_20 * __v_9);
+    let __v_22: G = G::from_u64(281474976710656);
+    let __v_23: G = (__v_22 * __v_10);
+    let __v_24: G = G::from_u64(72057594037927936);
+    let __v_25: G = (__v_24 * __v_11);
+    let __v_26: G = (__v_23 + __v_25);
+    let __v_27: G = (__v_21 + __v_26);
+    let __v_28: G = (__v_19 + __v_27);
+    let __v_29: G = (__v_17 + __v_28);
+    let __v_30: G = (__v_15 + __v_29);
+    let __v_31: G = (__v_13 + __v_30);
+    let __v_32: G = (__v_4 + __v_31);
+    if (__v_32 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_32.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
+    }
+    let __v_33: G = G::from_u64(1020);
+    let __v_34: G = (__v_11 - __v_33);
+    let __v_35: G = (__v_10 + __v_34);
+    let __v_36: G = (__v_9 + __v_35);
+    let __v_37: G = (__v_8 + __v_36);
+    let __v_38: G = G::from_bool((__v_37 == G::ZERO));
+    let __v_39: G = (__v_6 + __v_7);
+    let __v_40: G = (__v_5 + __v_39);
+    let __v_41: G = (__v_4 + __v_40);
+    let __v_42: G = G::from_bool((__v_41 == G::ZERO));
+    let __v_43: G = G::from_u64(1);
+    let __v_44: G = G::from_u64(1);
+    let __v_45: G = (__v_44 - __v_42);
+    let __v_46: G = (__v_38 * __v_45);
+    let __v_47: G = (__v_43 - __v_46);
+    let __v_48: G = G::from_u64(1);
+    if (__v_47 != __v_48) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_47.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: None });
+    }
     let __gb: [u8; 8] = __v_1.as_canonical_u64().to_le_bytes();
-    let __v_22: G = G::from_u8(__gb[0]);
-    let __v_23: G = G::from_u8(__gb[1]);
-    let __v_24: G = G::from_u8(__gb[2]);
-    let __v_25: G = G::from_u8(__gb[3]);
-    let __v_26: G = G::from_u8(__gb[4]);
-    let __v_27: G = G::from_u8(__gb[5]);
-    let __v_28: G = G::from_u8(__gb[6]);
-    let __v_29: G = G::from_u8(__gb[7]);
-    if !unconstrained { let __vi = __v_22; let __vj = __v_23; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_24; let __vj = __v_25; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_26; let __vj = __v_27; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_28; let __vj = __v_29; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_30: G = G::from_u64(1020);
-    let __v_31: G = (__v_29 - __v_30);
-    let __v_32: G = (__v_28 + __v_31);
-    let __v_33: G = (__v_27 + __v_32);
-    let __v_34: G = (__v_26 + __v_33);
-    let __v_35: G = G::from_bool((__v_34 == G::ZERO));
-    let __v_36: G = (__v_24 + __v_25);
-    let __v_37: G = (__v_23 + __v_36);
-    let __v_38: G = (__v_22 + __v_37);
-    let __v_39: G = G::from_bool((__v_38 == G::ZERO));
+    let __v_49: G = G::from_u8(__gb[0]);
+    let __v_50: G = G::from_u8(__gb[1]);
+    let __v_51: G = G::from_u8(__gb[2]);
+    let __v_52: G = G::from_u8(__gb[3]);
+    let __v_53: G = G::from_u8(__gb[4]);
+    let __v_54: G = G::from_u8(__gb[5]);
+    let __v_55: G = G::from_u8(__gb[6]);
+    let __v_56: G = G::from_u8(__gb[7]);
+    if !unconstrained { let __vi = __v_49; let __vj = __v_50; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_51; let __vj = __v_52; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_53; let __vj = __v_54; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_55; let __vj = __v_56; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    let __v_57: G = G::from_u64(256);
+    let __v_58: G = (__v_57 * __v_50);
+    let __v_59: G = G::from_u64(65536);
+    let __v_60: G = (__v_59 * __v_51);
+    let __v_61: G = G::from_u64(16777216);
+    let __v_62: G = (__v_61 * __v_52);
+    let __v_63: G = G::from_u64(4294967296);
+    let __v_64: G = (__v_63 * __v_53);
+    let __v_65: G = G::from_u64(1099511627776);
+    let __v_66: G = (__v_65 * __v_54);
+    let __v_67: G = G::from_u64(281474976710656);
+    let __v_68: G = (__v_67 * __v_55);
+    let __v_69: G = G::from_u64(72057594037927936);
+    let __v_70: G = (__v_69 * __v_56);
+    let __v_71: G = (__v_68 + __v_70);
+    let __v_72: G = (__v_66 + __v_71);
+    let __v_73: G = (__v_64 + __v_72);
+    let __v_74: G = (__v_62 + __v_73);
+    let __v_75: G = (__v_60 + __v_74);
+    let __v_76: G = (__v_58 + __v_75);
+    let __v_77: G = (__v_49 + __v_76);
+    if (__v_77 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: None });
+    }
+    let __v_78: G = G::from_u64(1020);
+    let __v_79: G = (__v_56 - __v_78);
+    let __v_80: G = (__v_55 + __v_79);
+    let __v_81: G = (__v_54 + __v_80);
+    let __v_82: G = (__v_53 + __v_81);
+    let __v_83: G = G::from_bool((__v_82 == G::ZERO));
+    let __v_84: G = (__v_51 + __v_52);
+    let __v_85: G = (__v_50 + __v_84);
+    let __v_86: G = (__v_49 + __v_85);
+    let __v_87: G = G::from_bool((__v_86 == G::ZERO));
+    let __v_88: G = G::from_u64(1);
+    let __v_89: G = G::from_u64(1);
+    let __v_90: G = (__v_89 - __v_87);
+    let __v_91: G = (__v_83 * __v_90);
+    let __v_92: G = (__v_88 - __v_91);
+    let __v_93: G = G::from_u64(1);
+    if (__v_92 != __v_93) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_92.as_canonical_u64(), rhs: __v_93.as_canonical_u64(), msg: None });
+    }
     let __gb: [u8; 8] = __v_2.as_canonical_u64().to_le_bytes();
-    let __v_40: G = G::from_u8(__gb[0]);
-    let __v_41: G = G::from_u8(__gb[1]);
-    let __v_42: G = G::from_u8(__gb[2]);
-    let __v_43: G = G::from_u8(__gb[3]);
-    let __v_44: G = G::from_u8(__gb[4]);
-    let __v_45: G = G::from_u8(__gb[5]);
-    let __v_46: G = G::from_u8(__gb[6]);
-    let __v_47: G = G::from_u8(__gb[7]);
-    if !unconstrained { let __vi = __v_40; let __vj = __v_41; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_42; let __vj = __v_43; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_44; let __vj = __v_45; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_46; let __vj = __v_47; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_48: G = G::from_u64(1020);
-    let __v_49: G = (__v_47 - __v_48);
-    let __v_50: G = (__v_46 + __v_49);
-    let __v_51: G = (__v_45 + __v_50);
-    let __v_52: G = (__v_44 + __v_51);
-    let __v_53: G = G::from_bool((__v_52 == G::ZERO));
-    let __v_54: G = (__v_42 + __v_43);
-    let __v_55: G = (__v_41 + __v_54);
-    let __v_56: G = (__v_40 + __v_55);
-    let __v_57: G = G::from_bool((__v_56 == G::ZERO));
-    let __gb: [u8; 8] = __v_3.as_canonical_u64().to_le_bytes();
-    let __v_58: G = G::from_u8(__gb[0]);
-    let __v_59: G = G::from_u8(__gb[1]);
-    let __v_60: G = G::from_u8(__gb[2]);
-    let __v_61: G = G::from_u8(__gb[3]);
-    let __v_62: G = G::from_u8(__gb[4]);
-    let __v_63: G = G::from_u8(__gb[5]);
-    let __v_64: G = G::from_u8(__gb[6]);
-    let __v_65: G = G::from_u8(__gb[7]);
-    if !unconstrained { let __vi = __v_58; let __vj = __v_59; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_60; let __vj = __v_61; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_62; let __vj = __v_63; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    if !unconstrained { let __vi = __v_64; let __vj = __v_65; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-    let __v_66: G = G::from_u64(1020);
-    let __v_67: G = (__v_65 - __v_66);
-    let __v_68: G = (__v_64 + __v_67);
-    let __v_69: G = (__v_63 + __v_68);
-    let __v_70: G = (__v_62 + __v_69);
-    let __v_71: G = G::from_bool((__v_70 == G::ZERO));
-    let __v_72: G = (__v_60 + __v_61);
-    let __v_73: G = (__v_59 + __v_72);
-    let __v_74: G = (__v_58 + __v_73);
-    let __v_75: G = G::from_bool((__v_74 == G::ZERO));
-    let __v_76: G = G::from_u64(0);
-    let __v_77: G = G::from_u64(256);
-    let __v_78: G = (__v_77 * __v_5);
-    let __v_79: G = G::from_u64(65536);
-    let __v_80: G = (__v_79 * __v_6);
-    let __v_81: G = G::from_u64(16777216);
-    let __v_82: G = (__v_81 * __v_7);
-    let __v_83: G = G::from_u64(4294967296);
-    let __v_84: G = (__v_83 * __v_8);
-    let __v_85: G = G::from_u64(1099511627776);
-    let __v_86: G = (__v_85 * __v_9);
-    let __v_87: G = G::from_u64(281474976710656);
-    let __v_88: G = (__v_87 * __v_10);
-    let __v_89: G = G::from_u64(72057594037927936);
-    let __v_90: G = (__v_89 * __v_11);
-    let __v_91: G = (__v_88 + __v_90);
-    let __v_92: G = (__v_86 + __v_91);
-    let __v_93: G = (__v_84 + __v_92);
-    let __v_94: G = (__v_82 + __v_93);
-    let __v_95: G = (__v_80 + __v_94);
-    let __v_96: G = (__v_78 + __v_95);
-    let __v_97: G = (__v_4 + __v_96);
-    if (__v_97 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_97.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
-    }
-    let __v_98: G = G::from_u64(1);
-    let __v_99: G = G::from_u64(1);
-    let __v_100: G = (__v_99 - __v_21);
-    let __v_101: G = (__v_17 * __v_100);
-    let __v_102: G = (__v_98 - __v_101);
-    let __v_103: G = G::from_u64(1);
-    if (__v_102 != __v_103) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_102.as_canonical_u64(), rhs: __v_103.as_canonical_u64(), msg: None });
+    let __v_94: G = G::from_u8(__gb[0]);
+    let __v_95: G = G::from_u8(__gb[1]);
+    let __v_96: G = G::from_u8(__gb[2]);
+    let __v_97: G = G::from_u8(__gb[3]);
+    let __v_98: G = G::from_u8(__gb[4]);
+    let __v_99: G = G::from_u8(__gb[5]);
+    let __v_100: G = G::from_u8(__gb[6]);
+    let __v_101: G = G::from_u8(__gb[7]);
+    if !unconstrained { let __vi = __v_94; let __vj = __v_95; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_96; let __vj = __v_97; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_98; let __vj = __v_99; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_100; let __vj = __v_101; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    let __v_102: G = G::from_u64(256);
+    let __v_103: G = (__v_102 * __v_95);
+    let __v_104: G = G::from_u64(65536);
+    let __v_105: G = (__v_104 * __v_96);
+    let __v_106: G = G::from_u64(16777216);
+    let __v_107: G = (__v_106 * __v_97);
+    let __v_108: G = G::from_u64(4294967296);
+    let __v_109: G = (__v_108 * __v_98);
+    let __v_110: G = G::from_u64(1099511627776);
+    let __v_111: G = (__v_110 * __v_99);
+    let __v_112: G = G::from_u64(281474976710656);
+    let __v_113: G = (__v_112 * __v_100);
+    let __v_114: G = G::from_u64(72057594037927936);
+    let __v_115: G = (__v_114 * __v_101);
+    let __v_116: G = (__v_113 + __v_115);
+    let __v_117: G = (__v_111 + __v_116);
+    let __v_118: G = (__v_109 + __v_117);
+    let __v_119: G = (__v_107 + __v_118);
+    let __v_120: G = (__v_105 + __v_119);
+    let __v_121: G = (__v_103 + __v_120);
+    let __v_122: G = (__v_94 + __v_121);
+    if (__v_122 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_122.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: None });
+    }
+    let __v_123: G = G::from_u64(1020);
+    let __v_124: G = (__v_101 - __v_123);
+    let __v_125: G = (__v_100 + __v_124);
+    let __v_126: G = (__v_99 + __v_125);
+    let __v_127: G = (__v_98 + __v_126);
+    let __v_128: G = G::from_bool((__v_127 == G::ZERO));
+    let __v_129: G = (__v_96 + __v_97);
+    let __v_130: G = (__v_95 + __v_129);
+    let __v_131: G = (__v_94 + __v_130);
+    let __v_132: G = G::from_bool((__v_131 == G::ZERO));
+    let __v_133: G = G::from_u64(1);
+    let __v_134: G = G::from_u64(1);
+    let __v_135: G = (__v_134 - __v_132);
+    let __v_136: G = (__v_128 * __v_135);
+    let __v_137: G = (__v_133 - __v_136);
+    let __v_138: G = G::from_u64(1);
+    if (__v_137 != __v_138) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_137.as_canonical_u64(), rhs: __v_138.as_canonical_u64(), msg: None });
     }
-    let __v_104: G = G::from_u64(0);
-    let __v_105: G = G::from_u64(256);
-    let __v_106: G = (__v_105 * __v_23);
-    let __v_107: G = G::from_u64(65536);
-    let __v_108: G = (__v_107 * __v_24);
-    let __v_109: G = G::from_u64(16777216);
-    let __v_110: G = (__v_109 * __v_25);
-    let __v_111: G = G::from_u64(4294967296);
-    let __v_112: G = (__v_111 * __v_26);
-    let __v_113: G = G::from_u64(1099511627776);
-    let __v_114: G = (__v_113 * __v_27);
-    let __v_115: G = G::from_u64(281474976710656);
-    let __v_116: G = (__v_115 * __v_28);
-    let __v_117: G = G::from_u64(72057594037927936);
-    let __v_118: G = (__v_117 * __v_29);
-    let __v_119: G = (__v_116 + __v_118);
-    let __v_120: G = (__v_114 + __v_119);
-    let __v_121: G = (__v_112 + __v_120);
-    let __v_122: G = (__v_110 + __v_121);
-    let __v_123: G = (__v_108 + __v_122);
-    let __v_124: G = (__v_106 + __v_123);
-    let __v_125: G = (__v_22 + __v_124);
-    if (__v_125 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_125.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: None });
-    }
-    let __v_126: G = G::from_u64(1);
-    let __v_127: G = G::from_u64(1);
-    let __v_128: G = (__v_127 - __v_39);
-    let __v_129: G = (__v_35 * __v_128);
-    let __v_130: G = (__v_126 - __v_129);
-    let __v_131: G = G::from_u64(1);
-    if (__v_130 != __v_131) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
-    }
-    let __v_132: G = G::from_u64(0);
-    let __v_133: G = G::from_u64(256);
-    let __v_134: G = (__v_133 * __v_41);
-    let __v_135: G = G::from_u64(65536);
-    let __v_136: G = (__v_135 * __v_42);
-    let __v_137: G = G::from_u64(16777216);
-    let __v_138: G = (__v_137 * __v_43);
-    let __v_139: G = G::from_u64(4294967296);
-    let __v_140: G = (__v_139 * __v_44);
-    let __v_141: G = G::from_u64(1099511627776);
-    let __v_142: G = (__v_141 * __v_45);
-    let __v_143: G = G::from_u64(281474976710656);
-    let __v_144: G = (__v_143 * __v_46);
-    let __v_145: G = G::from_u64(72057594037927936);
-    let __v_146: G = (__v_145 * __v_47);
-    let __v_147: G = (__v_144 + __v_146);
-    let __v_148: G = (__v_142 + __v_147);
-    let __v_149: G = (__v_140 + __v_148);
-    let __v_150: G = (__v_138 + __v_149);
-    let __v_151: G = (__v_136 + __v_150);
-    let __v_152: G = (__v_134 + __v_151);
-    let __v_153: G = (__v_40 + __v_152);
-    if (__v_153 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_153.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: None });
-    }
-    let __v_154: G = G::from_u64(1);
-    let __v_155: G = G::from_u64(1);
-    let __v_156: G = (__v_155 - __v_57);
-    let __v_157: G = (__v_53 * __v_156);
-    let __v_158: G = (__v_154 - __v_157);
-    let __v_159: G = G::from_u64(1);
-    if (__v_158 != __v_159) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_158.as_canonical_u64(), rhs: __v_159.as_canonical_u64(), msg: None });
-    }
-    let __v_160: G = G::from_u64(0);
-    let __v_161: G = G::from_u64(256);
-    let __v_162: G = (__v_161 * __v_59);
-    let __v_163: G = G::from_u64(65536);
-    let __v_164: G = (__v_163 * __v_60);
-    let __v_165: G = G::from_u64(16777216);
-    let __v_166: G = (__v_165 * __v_61);
-    let __v_167: G = G::from_u64(4294967296);
-    let __v_168: G = (__v_167 * __v_62);
-    let __v_169: G = G::from_u64(1099511627776);
-    let __v_170: G = (__v_169 * __v_63);
-    let __v_171: G = G::from_u64(281474976710656);
-    let __v_172: G = (__v_171 * __v_64);
-    let __v_173: G = G::from_u64(72057594037927936);
-    let __v_174: G = (__v_173 * __v_65);
-    let __v_175: G = (__v_172 + __v_174);
-    let __v_176: G = (__v_170 + __v_175);
-    let __v_177: G = (__v_168 + __v_176);
-    let __v_178: G = (__v_166 + __v_177);
-    let __v_179: G = (__v_164 + __v_178);
-    let __v_180: G = (__v_162 + __v_179);
-    let __v_181: G = (__v_58 + __v_180);
-    if (__v_181 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_181.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
-    }
-    let __v_182: G = G::from_u64(1);
+    let __gb: [u8; 8] = __v_3.as_canonical_u64().to_le_bytes();
+    let __v_139: G = G::from_u8(__gb[0]);
+    let __v_140: G = G::from_u8(__gb[1]);
+    let __v_141: G = G::from_u8(__gb[2]);
+    let __v_142: G = G::from_u8(__gb[3]);
+    let __v_143: G = G::from_u8(__gb[4]);
+    let __v_144: G = G::from_u8(__gb[5]);
+    let __v_145: G = G::from_u8(__gb[6]);
+    let __v_146: G = G::from_u8(__gb[7]);
+    if !unconstrained { let __vi = __v_139; let __vj = __v_140; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_141; let __vj = __v_142; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_143; let __vj = __v_144; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    if !unconstrained { let __vi = __v_145; let __vj = __v_146; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+    let __v_147: G = G::from_u64(256);
+    let __v_148: G = (__v_147 * __v_140);
+    let __v_149: G = G::from_u64(65536);
+    let __v_150: G = (__v_149 * __v_141);
+    let __v_151: G = G::from_u64(16777216);
+    let __v_152: G = (__v_151 * __v_142);
+    let __v_153: G = G::from_u64(4294967296);
+    let __v_154: G = (__v_153 * __v_143);
+    let __v_155: G = G::from_u64(1099511627776);
+    let __v_156: G = (__v_155 * __v_144);
+    let __v_157: G = G::from_u64(281474976710656);
+    let __v_158: G = (__v_157 * __v_145);
+    let __v_159: G = G::from_u64(72057594037927936);
+    let __v_160: G = (__v_159 * __v_146);
+    let __v_161: G = (__v_158 + __v_160);
+    let __v_162: G = (__v_156 + __v_161);
+    let __v_163: G = (__v_154 + __v_162);
+    let __v_164: G = (__v_152 + __v_163);
+    let __v_165: G = (__v_150 + __v_164);
+    let __v_166: G = (__v_148 + __v_165);
+    let __v_167: G = (__v_139 + __v_166);
+    if (__v_167 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_167.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
+    }
+    let __v_168: G = G::from_u64(1020);
+    let __v_169: G = (__v_146 - __v_168);
+    let __v_170: G = (__v_145 + __v_169);
+    let __v_171: G = (__v_144 + __v_170);
+    let __v_172: G = (__v_143 + __v_171);
+    let __v_173: G = G::from_bool((__v_172 == G::ZERO));
+    let __v_174: G = (__v_141 + __v_142);
+    let __v_175: G = (__v_140 + __v_174);
+    let __v_176: G = (__v_139 + __v_175);
+    let __v_177: G = G::from_bool((__v_176 == G::ZERO));
+    let __v_178: G = G::from_u64(1);
+    let __v_179: G = G::from_u64(1);
+    let __v_180: G = (__v_179 - __v_177);
+    let __v_181: G = (__v_173 * __v_180);
+    let __v_182: G = (__v_178 - __v_181);
     let __v_183: G = G::from_u64(1);
-    let __v_184: G = (__v_183 - __v_75);
-    let __v_185: G = (__v_71 * __v_184);
-    let __v_186: G = (__v_182 - __v_185);
-    let __v_187: G = G::from_u64(1);
-    if (__v_186 != __v_187) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_186.as_canonical_u64(), rhs: __v_187.as_canonical_u64(), msg: None });
-    }
-    let __v_188: G = G::from_u64(1);
-    let __v_189: G = G::from_u64(1);
-    let __v_190: G = { let __values: [G; 10] = [__v_188, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189, __v_189]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_191: G = { let __values: [G; 10] = [__v_160, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_190]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_192: G = { let __values: [G; 10] = [__v_132, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_191]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_193: G = { let __values: [G; 10] = [__v_104, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_192]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_194: G = { let __values: [G; 10] = [__v_76, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_193]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    if (__v_182 != __v_183) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_182.as_canonical_u64(), rhs: __v_183.as_canonical_u64(), msg: None });
+    }
+    let __v_184: G = G::from_u64(1);
+    let __v_185: G = G::from_u64(1);
+    let __v_186: G = { let __values: [G; 10] = [__v_184, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185, __v_185]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_187: G = G::from_u64(0);
+    let __v_188: G = { let __values: [G; 10] = [__v_187, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_186]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_189: G = G::from_u64(0);
+    let __v_190: G = { let __values: [G; 10] = [__v_189, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_188]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_191: G = G::from_u64(0);
+    let __v_192: G = { let __values: [G; 10] = [__v_191, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_56, __v_190]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_193: G = G::from_u64(0);
+    let __v_194: G = { let __values: [G; 10] = [__v_193, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_192]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_146] = [__v_194];
     record.function_queries[146].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -13958,291 +13958,291 @@ fn aiur_fn_148(
               0u64 => {
                 match __v_10.as_canonical_u64() {
                   _ => {
+                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                    let __v_20: G = __r_arr[0];
+                    let __v_21: G = G::from_u64(1);
+                    if (__v_20 != __v_21) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_20.as_canonical_u64(), rhs: __v_21.as_canonical_u64(), msg: None });
+                    }
                     let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_5.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-                    let __v_20: G = __loaded[0];
-                    let __v_21: G = __loaded[1];
-                    let __v_22: G = __loaded[2];
-                    match __v_20.as_canonical_u64() {
+                    let __v_22: G = __loaded[0];
+                    let __v_23: G = __loaded[1];
+                    let __v_24: G = __loaded[2];
+                    match __v_22.as_canonical_u64() {
                       0u64 => {
-                        let __v_23: G = G::from_u64(1);
-                        let __v_24: G = (__v_6 - __v_23);
-                        let __v_25: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_11, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
-                        let __v_26: G = __r_arr[0];
-                        let __v_27: G = __r_arr[1];
-                        let __mc_out___mc_0: [G; 4] = '__mc_0: { match __v_21.as_canonical_u64() {
+                        let __v_25: G = G::from_u64(1);
+                        let __v_26: G = (__v_6 - __v_25);
+                        let __v_27: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_11, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+                        let __v_28: G = __r_arr[0];
+                        let __v_29: G = __r_arr[1];
+                        let __mc_out___mc_0: [G; 4] = '__mc_0: { match __v_23.as_canonical_u64() {
   0u64 => {
-    break '__mc_0 [__v_0, __v_1, __v_26, __v_27];
+    break '__mc_0 [__v_0, __v_1, __v_28, __v_29];
   },
   _ => {
-    break '__mc_0 [__v_26, __v_27, __v_0, __v_1];
+    break '__mc_0 [__v_28, __v_29, __v_0, __v_1];
   },
 }
  };
-                        let __v_28: G = __mc_out___mc_0[0];
-                        let __v_29: G = __mc_out___mc_0[1];
-                        let __v_30: G = __mc_out___mc_0[2];
-                        let __v_31: G = __mc_out___mc_0[3];
-                        let __r_arr: [G; OUT_121] = { let __args: [G; IN_121] = [__v_22, __v_24, __v_14, __v_15, __v_28, __v_29, __v_30, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[121].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[121].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[121].bump_multiplicity(__i); } let __ret: [G; OUT_121] = unsafe { *(record.function_queries[121].output_at(__i).as_ptr() as *const [G; OUT_121]) }; __ret }, _ => aiur_fn_121(__args, record, io_buffer, __cu)? } };
-                        let __v_32: G = __r_arr[0];
-                        let __v_33: G = __r_arr[1];
-                        let __r_arr: [G; OUT_147] = { let __args: [G; IN_147] = [__v_32, __v_33, __v_24, __v_14, __v_15, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[147].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[147].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[147].bump_multiplicity(__i); } let __ret: [G; OUT_147] = unsafe { *(record.function_queries[147].output_at(__i).as_ptr() as *const [G; OUT_147]) }; __ret }, _ => aiur_fn_147(__args, record, io_buffer, __cu)? } };
+                        let __v_30: G = __mc_out___mc_0[0];
+                        let __v_31: G = __mc_out___mc_0[1];
+                        let __v_32: G = __mc_out___mc_0[2];
+                        let __v_33: G = __mc_out___mc_0[3];
+                        let __r_arr: [G; OUT_121] = { let __args: [G; IN_121] = [__v_24, __v_26, __v_14, __v_15, __v_30, __v_31, __v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[121].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[121].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[121].bump_multiplicity(__i); } let __ret: [G; OUT_121] = unsafe { *(record.function_queries[121].output_at(__i).as_ptr() as *const [G; OUT_121]) }; __ret }, _ => aiur_fn_121(__args, record, io_buffer, __cu)? } };
                         let __v_34: G = __r_arr[0];
                         let __v_35: G = __r_arr[1];
-                        let __v_36: G = __r_arr[2];
-                        let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_34, __v_35, __v_16, __v_19, __v_12, __v_22, __v_24, __v_36, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
-                        let __v_37: G = __r_arr[0];
-                        let __v_38: G = __r_arr[1];
-                        let __v_39: G = __r_arr[2];
-                        let __gb: [u8; 8] = __v_28.as_canonical_u64().to_le_bytes();
-                        let __v_40: G = G::from_u8(__gb[0]);
-                        let __v_41: G = G::from_u8(__gb[1]);
-                        let __v_42: G = G::from_u8(__gb[2]);
-                        let __v_43: G = G::from_u8(__gb[3]);
-                        let __v_44: G = G::from_u8(__gb[4]);
-                        let __v_45: G = G::from_u8(__gb[5]);
-                        let __v_46: G = G::from_u8(__gb[6]);
-                        let __v_47: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_40; let __vj = __v_41; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __r_arr: [G; OUT_147] = { let __args: [G; IN_147] = [__v_34, __v_35, __v_26, __v_14, __v_15, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[147].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[147].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[147].bump_multiplicity(__i); } let __ret: [G; OUT_147] = unsafe { *(record.function_queries[147].output_at(__i).as_ptr() as *const [G; OUT_147]) }; __ret }, _ => aiur_fn_147(__args, record, io_buffer, __cu)? } };
+                        let __v_36: G = __r_arr[0];
+                        let __v_37: G = __r_arr[1];
+                        let __v_38: G = __r_arr[2];
+                        let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_36, __v_37, __v_16, __v_19, __v_12, __v_24, __v_26, __v_38, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
+                        let __v_39: G = __r_arr[0];
+                        let __v_40: G = __r_arr[1];
+                        let __v_41: G = __r_arr[2];
+                        let __gb: [u8; 8] = __v_30.as_canonical_u64().to_le_bytes();
+                        let __v_42: G = G::from_u8(__gb[0]);
+                        let __v_43: G = G::from_u8(__gb[1]);
+                        let __v_44: G = G::from_u8(__gb[2]);
+                        let __v_45: G = G::from_u8(__gb[3]);
+                        let __v_46: G = G::from_u8(__gb[4]);
+                        let __v_47: G = G::from_u8(__gb[5]);
+                        let __v_48: G = G::from_u8(__gb[6]);
+                        let __v_49: G = G::from_u8(__gb[7]);
                         if !unconstrained { let __vi = __v_42; let __vj = __v_43; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
                         if !unconstrained { let __vi = __v_44; let __vj = __v_45; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
                         if !unconstrained { let __vi = __v_46; let __vj = __v_47; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_48: G = G::from_u64(1020);
-                        let __v_49: G = (__v_47 - __v_48);
-                        let __v_50: G = (__v_46 + __v_49);
-                        let __v_51: G = (__v_45 + __v_50);
-                        let __v_52: G = (__v_44 + __v_51);
-                        let __v_53: G = G::from_bool((__v_52 == G::ZERO));
-                        let __v_54: G = (__v_42 + __v_43);
-                        let __v_55: G = (__v_41 + __v_54);
-                        let __v_56: G = (__v_40 + __v_55);
-                        let __v_57: G = G::from_bool((__v_56 == G::ZERO));
-                        let __gb: [u8; 8] = __v_29.as_canonical_u64().to_le_bytes();
-                        let __v_58: G = G::from_u8(__gb[0]);
-                        let __v_59: G = G::from_u8(__gb[1]);
-                        let __v_60: G = G::from_u8(__gb[2]);
-                        let __v_61: G = G::from_u8(__gb[3]);
-                        let __v_62: G = G::from_u8(__gb[4]);
-                        let __v_63: G = G::from_u8(__gb[5]);
-                        let __v_64: G = G::from_u8(__gb[6]);
-                        let __v_65: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_58; let __vj = __v_59; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_60; let __vj = __v_61; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_62; let __vj = __v_63; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_64; let __vj = __v_65; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_66: G = G::from_u64(1020);
-                        let __v_67: G = (__v_65 - __v_66);
-                        let __v_68: G = (__v_64 + __v_67);
-                        let __v_69: G = (__v_63 + __v_68);
-                        let __v_70: G = (__v_62 + __v_69);
-                        let __v_71: G = G::from_bool((__v_70 == G::ZERO));
-                        let __v_72: G = (__v_60 + __v_61);
-                        let __v_73: G = (__v_59 + __v_72);
-                        let __v_74: G = (__v_58 + __v_73);
-                        let __v_75: G = G::from_bool((__v_74 == G::ZERO));
-                        let __gb: [u8; 8] = __v_30.as_canonical_u64().to_le_bytes();
-                        let __v_76: G = G::from_u8(__gb[0]);
-                        let __v_77: G = G::from_u8(__gb[1]);
-                        let __v_78: G = G::from_u8(__gb[2]);
-                        let __v_79: G = G::from_u8(__gb[3]);
-                        let __v_80: G = G::from_u8(__gb[4]);
-                        let __v_81: G = G::from_u8(__gb[5]);
-                        let __v_82: G = G::from_u8(__gb[6]);
-                        let __v_83: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_76; let __vj = __v_77; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_78; let __vj = __v_79; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_80; let __vj = __v_81; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_82; let __vj = __v_83; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_84: G = G::from_u64(1020);
-                        let __v_85: G = (__v_83 - __v_84);
-                        let __v_86: G = (__v_82 + __v_85);
-                        let __v_87: G = (__v_81 + __v_86);
-                        let __v_88: G = (__v_80 + __v_87);
-                        let __v_89: G = G::from_bool((__v_88 == G::ZERO));
-                        let __v_90: G = (__v_78 + __v_79);
-                        let __v_91: G = (__v_77 + __v_90);
-                        let __v_92: G = (__v_76 + __v_91);
-                        let __v_93: G = G::from_bool((__v_92 == G::ZERO));
-                        let __gb: [u8; 8] = __v_31.as_canonical_u64().to_le_bytes();
-                        let __v_94: G = G::from_u8(__gb[0]);
-                        let __v_95: G = G::from_u8(__gb[1]);
-                        let __v_96: G = G::from_u8(__gb[2]);
-                        let __v_97: G = G::from_u8(__gb[3]);
-                        let __v_98: G = G::from_u8(__gb[4]);
-                        let __v_99: G = G::from_u8(__gb[5]);
-                        let __v_100: G = G::from_u8(__gb[6]);
-                        let __v_101: G = G::from_u8(__gb[7]);
-                        if !unconstrained { let __vi = __v_94; let __vj = __v_95; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_96; let __vj = __v_97; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_98; let __vj = __v_99; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        if !unconstrained { let __vi = __v_100; let __vj = __v_101; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
-                        let __v_102: G = G::from_u64(1020);
-                        let __v_103: G = (__v_101 - __v_102);
-                        let __v_104: G = (__v_100 + __v_103);
-                        let __v_105: G = (__v_99 + __v_104);
-                        let __v_106: G = (__v_98 + __v_105);
-                        let __v_107: G = G::from_bool((__v_106 == G::ZERO));
-                        let __v_108: G = (__v_96 + __v_97);
-                        let __v_109: G = (__v_95 + __v_108);
-                        let __v_110: G = (__v_94 + __v_109);
-                        let __v_111: G = G::from_bool((__v_110 == G::ZERO));
-                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_11]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                        let __v_112: G = __r_arr[0];
-                        let __v_113: G = G::from_u64(1);
-                        if (__v_112 != __v_113) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_112.as_canonical_u64(), rhs: __v_113.as_canonical_u64(), msg: None });
+                        if !unconstrained { let __vi = __v_48; let __vj = __v_49; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_50: G = G::from_u64(256);
+                        let __v_51: G = (__v_50 * __v_43);
+                        let __v_52: G = G::from_u64(65536);
+                        let __v_53: G = (__v_52 * __v_44);
+                        let __v_54: G = G::from_u64(16777216);
+                        let __v_55: G = (__v_54 * __v_45);
+                        let __v_56: G = G::from_u64(4294967296);
+                        let __v_57: G = (__v_56 * __v_46);
+                        let __v_58: G = G::from_u64(1099511627776);
+                        let __v_59: G = (__v_58 * __v_47);
+                        let __v_60: G = G::from_u64(281474976710656);
+                        let __v_61: G = (__v_60 * __v_48);
+                        let __v_62: G = G::from_u64(72057594037927936);
+                        let __v_63: G = (__v_62 * __v_49);
+                        let __v_64: G = (__v_61 + __v_63);
+                        let __v_65: G = (__v_59 + __v_64);
+                        let __v_66: G = (__v_57 + __v_65);
+                        let __v_67: G = (__v_55 + __v_66);
+                        let __v_68: G = (__v_53 + __v_67);
+                        let __v_69: G = (__v_51 + __v_68);
+                        let __v_70: G = (__v_42 + __v_69);
+                        if (__v_70 != __v_30) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_70.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: None });
                         }
-                        let __v_114: G = G::from_u64(0);
-                        let __v_115: G = G::from_u64(0);
-                        let __v_116: G = G::from_u64(256);
-                        let __v_117: G = (__v_116 * __v_41);
-                        let __v_118: G = G::from_u64(65536);
-                        let __v_119: G = (__v_118 * __v_42);
-                        let __v_120: G = G::from_u64(16777216);
-                        let __v_121: G = (__v_120 * __v_43);
-                        let __v_122: G = G::from_u64(4294967296);
-                        let __v_123: G = (__v_122 * __v_44);
-                        let __v_124: G = G::from_u64(1099511627776);
-                        let __v_125: G = (__v_124 * __v_45);
-                        let __v_126: G = G::from_u64(281474976710656);
-                        let __v_127: G = (__v_126 * __v_46);
-                        let __v_128: G = G::from_u64(72057594037927936);
-                        let __v_129: G = (__v_128 * __v_47);
-                        let __v_130: G = (__v_127 + __v_129);
-                        let __v_131: G = (__v_125 + __v_130);
-                        let __v_132: G = (__v_123 + __v_131);
-                        let __v_133: G = (__v_121 + __v_132);
-                        let __v_134: G = (__v_119 + __v_133);
-                        let __v_135: G = (__v_117 + __v_134);
-                        let __v_136: G = (__v_40 + __v_135);
-                        if (__v_136 != __v_28) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_136.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: None });
+                        let __v_71: G = G::from_u64(1020);
+                        let __v_72: G = (__v_49 - __v_71);
+                        let __v_73: G = (__v_48 + __v_72);
+                        let __v_74: G = (__v_47 + __v_73);
+                        let __v_75: G = (__v_46 + __v_74);
+                        let __v_76: G = G::from_bool((__v_75 == G::ZERO));
+                        let __v_77: G = (__v_44 + __v_45);
+                        let __v_78: G = (__v_43 + __v_77);
+                        let __v_79: G = (__v_42 + __v_78);
+                        let __v_80: G = G::from_bool((__v_79 == G::ZERO));
+                        let __v_81: G = G::from_u64(1);
+                        let __v_82: G = G::from_u64(1);
+                        let __v_83: G = (__v_82 - __v_80);
+                        let __v_84: G = (__v_76 * __v_83);
+                        let __v_85: G = (__v_81 - __v_84);
+                        let __v_86: G = G::from_u64(1);
+                        if (__v_85 != __v_86) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_86.as_canonical_u64(), msg: None });
                         }
-                        let __v_137: G = G::from_u64(1);
-                        let __v_138: G = G::from_u64(1);
-                        let __v_139: G = (__v_138 - __v_57);
-                        let __v_140: G = (__v_53 * __v_139);
-                        let __v_141: G = (__v_137 - __v_140);
-                        let __v_142: G = G::from_u64(1);
-                        if (__v_141 != __v_142) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_142.as_canonical_u64(), msg: None });
-                        }
-                        let __v_143: G = G::from_u64(0);
-                        let __v_144: G = G::from_u64(256);
-                        let __v_145: G = (__v_144 * __v_59);
-                        let __v_146: G = G::from_u64(65536);
-                        let __v_147: G = (__v_146 * __v_60);
-                        let __v_148: G = G::from_u64(16777216);
-                        let __v_149: G = (__v_148 * __v_61);
-                        let __v_150: G = G::from_u64(4294967296);
-                        let __v_151: G = (__v_150 * __v_62);
-                        let __v_152: G = G::from_u64(1099511627776);
-                        let __v_153: G = (__v_152 * __v_63);
-                        let __v_154: G = G::from_u64(281474976710656);
-                        let __v_155: G = (__v_154 * __v_64);
-                        let __v_156: G = G::from_u64(72057594037927936);
-                        let __v_157: G = (__v_156 * __v_65);
-                        let __v_158: G = (__v_155 + __v_157);
-                        let __v_159: G = (__v_153 + __v_158);
-                        let __v_160: G = (__v_151 + __v_159);
-                        let __v_161: G = (__v_149 + __v_160);
-                        let __v_162: G = (__v_147 + __v_161);
-                        let __v_163: G = (__v_145 + __v_162);
-                        let __v_164: G = (__v_58 + __v_163);
-                        if (__v_164 != __v_29) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_164.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: None });
+                        let __gb: [u8; 8] = __v_31.as_canonical_u64().to_le_bytes();
+                        let __v_87: G = G::from_u8(__gb[0]);
+                        let __v_88: G = G::from_u8(__gb[1]);
+                        let __v_89: G = G::from_u8(__gb[2]);
+                        let __v_90: G = G::from_u8(__gb[3]);
+                        let __v_91: G = G::from_u8(__gb[4]);
+                        let __v_92: G = G::from_u8(__gb[5]);
+                        let __v_93: G = G::from_u8(__gb[6]);
+                        let __v_94: G = G::from_u8(__gb[7]);
+                        if !unconstrained { let __vi = __v_87; let __vj = __v_88; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_89; let __vj = __v_90; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_91; let __vj = __v_92; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_93; let __vj = __v_94; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_95: G = G::from_u64(256);
+                        let __v_96: G = (__v_95 * __v_88);
+                        let __v_97: G = G::from_u64(65536);
+                        let __v_98: G = (__v_97 * __v_89);
+                        let __v_99: G = G::from_u64(16777216);
+                        let __v_100: G = (__v_99 * __v_90);
+                        let __v_101: G = G::from_u64(4294967296);
+                        let __v_102: G = (__v_101 * __v_91);
+                        let __v_103: G = G::from_u64(1099511627776);
+                        let __v_104: G = (__v_103 * __v_92);
+                        let __v_105: G = G::from_u64(281474976710656);
+                        let __v_106: G = (__v_105 * __v_93);
+                        let __v_107: G = G::from_u64(72057594037927936);
+                        let __v_108: G = (__v_107 * __v_94);
+                        let __v_109: G = (__v_106 + __v_108);
+                        let __v_110: G = (__v_104 + __v_109);
+                        let __v_111: G = (__v_102 + __v_110);
+                        let __v_112: G = (__v_100 + __v_111);
+                        let __v_113: G = (__v_98 + __v_112);
+                        let __v_114: G = (__v_96 + __v_113);
+                        let __v_115: G = (__v_87 + __v_114);
+                        if (__v_115 != __v_31) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_115.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
                         }
-                        let __v_165: G = G::from_u64(1);
-                        let __v_166: G = G::from_u64(1);
-                        let __v_167: G = (__v_166 - __v_75);
-                        let __v_168: G = (__v_71 * __v_167);
-                        let __v_169: G = (__v_165 - __v_168);
-                        let __v_170: G = G::from_u64(1);
-                        if (__v_169 != __v_170) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_169.as_canonical_u64(), rhs: __v_170.as_canonical_u64(), msg: None });
+                        let __v_116: G = G::from_u64(1020);
+                        let __v_117: G = (__v_94 - __v_116);
+                        let __v_118: G = (__v_93 + __v_117);
+                        let __v_119: G = (__v_92 + __v_118);
+                        let __v_120: G = (__v_91 + __v_119);
+                        let __v_121: G = G::from_bool((__v_120 == G::ZERO));
+                        let __v_122: G = (__v_89 + __v_90);
+                        let __v_123: G = (__v_88 + __v_122);
+                        let __v_124: G = (__v_87 + __v_123);
+                        let __v_125: G = G::from_bool((__v_124 == G::ZERO));
+                        let __v_126: G = G::from_u64(1);
+                        let __v_127: G = G::from_u64(1);
+                        let __v_128: G = (__v_127 - __v_125);
+                        let __v_129: G = (__v_121 * __v_128);
+                        let __v_130: G = (__v_126 - __v_129);
+                        let __v_131: G = G::from_u64(1);
+                        if (__v_130 != __v_131) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
                         }
-                        let __v_171: G = G::from_u64(0);
-                        let __v_172: G = G::from_u64(256);
-                        let __v_173: G = (__v_172 * __v_77);
-                        let __v_174: G = G::from_u64(65536);
-                        let __v_175: G = (__v_174 * __v_78);
-                        let __v_176: G = G::from_u64(16777216);
-                        let __v_177: G = (__v_176 * __v_79);
-                        let __v_178: G = G::from_u64(4294967296);
-                        let __v_179: G = (__v_178 * __v_80);
-                        let __v_180: G = G::from_u64(1099511627776);
-                        let __v_181: G = (__v_180 * __v_81);
-                        let __v_182: G = G::from_u64(281474976710656);
-                        let __v_183: G = (__v_182 * __v_82);
-                        let __v_184: G = G::from_u64(72057594037927936);
-                        let __v_185: G = (__v_184 * __v_83);
-                        let __v_186: G = (__v_183 + __v_185);
-                        let __v_187: G = (__v_181 + __v_186);
-                        let __v_188: G = (__v_179 + __v_187);
-                        let __v_189: G = (__v_177 + __v_188);
-                        let __v_190: G = (__v_175 + __v_189);
-                        let __v_191: G = (__v_173 + __v_190);
-                        let __v_192: G = (__v_76 + __v_191);
-                        if (__v_192 != __v_30) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_192.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: None });
+                        let __gb: [u8; 8] = __v_32.as_canonical_u64().to_le_bytes();
+                        let __v_132: G = G::from_u8(__gb[0]);
+                        let __v_133: G = G::from_u8(__gb[1]);
+                        let __v_134: G = G::from_u8(__gb[2]);
+                        let __v_135: G = G::from_u8(__gb[3]);
+                        let __v_136: G = G::from_u8(__gb[4]);
+                        let __v_137: G = G::from_u8(__gb[5]);
+                        let __v_138: G = G::from_u8(__gb[6]);
+                        let __v_139: G = G::from_u8(__gb[7]);
+                        if !unconstrained { let __vi = __v_132; let __vj = __v_133; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_134; let __vj = __v_135; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_136; let __vj = __v_137; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_138; let __vj = __v_139; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_140: G = G::from_u64(256);
+                        let __v_141: G = (__v_140 * __v_133);
+                        let __v_142: G = G::from_u64(65536);
+                        let __v_143: G = (__v_142 * __v_134);
+                        let __v_144: G = G::from_u64(16777216);
+                        let __v_145: G = (__v_144 * __v_135);
+                        let __v_146: G = G::from_u64(4294967296);
+                        let __v_147: G = (__v_146 * __v_136);
+                        let __v_148: G = G::from_u64(1099511627776);
+                        let __v_149: G = (__v_148 * __v_137);
+                        let __v_150: G = G::from_u64(281474976710656);
+                        let __v_151: G = (__v_150 * __v_138);
+                        let __v_152: G = G::from_u64(72057594037927936);
+                        let __v_153: G = (__v_152 * __v_139);
+                        let __v_154: G = (__v_151 + __v_153);
+                        let __v_155: G = (__v_149 + __v_154);
+                        let __v_156: G = (__v_147 + __v_155);
+                        let __v_157: G = (__v_145 + __v_156);
+                        let __v_158: G = (__v_143 + __v_157);
+                        let __v_159: G = (__v_141 + __v_158);
+                        let __v_160: G = (__v_132 + __v_159);
+                        if (__v_160 != __v_32) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_160.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: None });
                         }
-                        let __v_193: G = G::from_u64(1);
-                        let __v_194: G = G::from_u64(1);
-                        let __v_195: G = (__v_194 - __v_93);
-                        let __v_196: G = (__v_89 * __v_195);
-                        let __v_197: G = (__v_193 - __v_196);
-                        let __v_198: G = G::from_u64(1);
-                        if (__v_197 != __v_198) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_197.as_canonical_u64(), rhs: __v_198.as_canonical_u64(), msg: None });
+                        let __v_161: G = G::from_u64(1020);
+                        let __v_162: G = (__v_139 - __v_161);
+                        let __v_163: G = (__v_138 + __v_162);
+                        let __v_164: G = (__v_137 + __v_163);
+                        let __v_165: G = (__v_136 + __v_164);
+                        let __v_166: G = G::from_bool((__v_165 == G::ZERO));
+                        let __v_167: G = (__v_134 + __v_135);
+                        let __v_168: G = (__v_133 + __v_167);
+                        let __v_169: G = (__v_132 + __v_168);
+                        let __v_170: G = G::from_bool((__v_169 == G::ZERO));
+                        let __v_171: G = G::from_u64(1);
+                        let __v_172: G = G::from_u64(1);
+                        let __v_173: G = (__v_172 - __v_170);
+                        let __v_174: G = (__v_166 * __v_173);
+                        let __v_175: G = (__v_171 - __v_174);
+                        let __v_176: G = G::from_u64(1);
+                        if (__v_175 != __v_176) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_175.as_canonical_u64(), rhs: __v_176.as_canonical_u64(), msg: None });
                         }
-                        let __v_199: G = G::from_u64(0);
-                        let __v_200: G = G::from_u64(256);
-                        let __v_201: G = (__v_200 * __v_95);
-                        let __v_202: G = G::from_u64(65536);
-                        let __v_203: G = (__v_202 * __v_96);
-                        let __v_204: G = G::from_u64(16777216);
-                        let __v_205: G = (__v_204 * __v_97);
-                        let __v_206: G = G::from_u64(4294967296);
-                        let __v_207: G = (__v_206 * __v_98);
-                        let __v_208: G = G::from_u64(1099511627776);
-                        let __v_209: G = (__v_208 * __v_99);
-                        let __v_210: G = G::from_u64(281474976710656);
-                        let __v_211: G = (__v_210 * __v_100);
-                        let __v_212: G = G::from_u64(72057594037927936);
-                        let __v_213: G = (__v_212 * __v_101);
-                        let __v_214: G = (__v_211 + __v_213);
-                        let __v_215: G = (__v_209 + __v_214);
-                        let __v_216: G = (__v_207 + __v_215);
-                        let __v_217: G = (__v_205 + __v_216);
-                        let __v_218: G = (__v_203 + __v_217);
-                        let __v_219: G = (__v_201 + __v_218);
-                        let __v_220: G = (__v_94 + __v_219);
-                        if (__v_220 != __v_31) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_220.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
+                        let __gb: [u8; 8] = __v_33.as_canonical_u64().to_le_bytes();
+                        let __v_177: G = G::from_u8(__gb[0]);
+                        let __v_178: G = G::from_u8(__gb[1]);
+                        let __v_179: G = G::from_u8(__gb[2]);
+                        let __v_180: G = G::from_u8(__gb[3]);
+                        let __v_181: G = G::from_u8(__gb[4]);
+                        let __v_182: G = G::from_u8(__gb[5]);
+                        let __v_183: G = G::from_u8(__gb[6]);
+                        let __v_184: G = G::from_u8(__gb[7]);
+                        if !unconstrained { let __vi = __v_177; let __vj = __v_178; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_179; let __vj = __v_180; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_181; let __vj = __v_182; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        if !unconstrained { let __vi = __v_183; let __vj = __v_184; let __bi = __vi.as_canonical_u64(); let __bj = __vj.as_canonical_u64(); if __bi >= 256 { return Err(ExecError::U8RangeCheckFailed(__bi)); } if __bj >= 256 { return Err(ExecError::U8RangeCheckFailed(__bj)); } record.bytes2_queries.bump_range_check(&__vi, &__vj); };
+                        let __v_185: G = G::from_u64(256);
+                        let __v_186: G = (__v_185 * __v_178);
+                        let __v_187: G = G::from_u64(65536);
+                        let __v_188: G = (__v_187 * __v_179);
+                        let __v_189: G = G::from_u64(16777216);
+                        let __v_190: G = (__v_189 * __v_180);
+                        let __v_191: G = G::from_u64(4294967296);
+                        let __v_192: G = (__v_191 * __v_181);
+                        let __v_193: G = G::from_u64(1099511627776);
+                        let __v_194: G = (__v_193 * __v_182);
+                        let __v_195: G = G::from_u64(281474976710656);
+                        let __v_196: G = (__v_195 * __v_183);
+                        let __v_197: G = G::from_u64(72057594037927936);
+                        let __v_198: G = (__v_197 * __v_184);
+                        let __v_199: G = (__v_196 + __v_198);
+                        let __v_200: G = (__v_194 + __v_199);
+                        let __v_201: G = (__v_192 + __v_200);
+                        let __v_202: G = (__v_190 + __v_201);
+                        let __v_203: G = (__v_188 + __v_202);
+                        let __v_204: G = (__v_186 + __v_203);
+                        let __v_205: G = (__v_177 + __v_204);
+                        if (__v_205 != __v_33) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_205.as_canonical_u64(), rhs: __v_33.as_canonical_u64(), msg: None });
                         }
+                        let __v_206: G = G::from_u64(1020);
+                        let __v_207: G = (__v_184 - __v_206);
+                        let __v_208: G = (__v_183 + __v_207);
+                        let __v_209: G = (__v_182 + __v_208);
+                        let __v_210: G = (__v_181 + __v_209);
+                        let __v_211: G = G::from_bool((__v_210 == G::ZERO));
+                        let __v_212: G = (__v_179 + __v_180);
+                        let __v_213: G = (__v_178 + __v_212);
+                        let __v_214: G = (__v_177 + __v_213);
+                        let __v_215: G = G::from_bool((__v_214 == G::ZERO));
+                        let __v_216: G = G::from_u64(1);
+                        let __v_217: G = G::from_u64(1);
+                        let __v_218: G = (__v_217 - __v_215);
+                        let __v_219: G = (__v_211 * __v_218);
+                        let __v_220: G = (__v_216 - __v_219);
                         let __v_221: G = G::from_u64(1);
-                        let __v_222: G = G::from_u64(1);
-                        let __v_223: G = (__v_222 - __v_111);
-                        let __v_224: G = (__v_107 * __v_223);
-                        let __v_225: G = (__v_221 - __v_224);
-                        let __v_226: G = G::from_u64(1);
-                        if (__v_225 != __v_226) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_225.as_canonical_u64(), rhs: __v_226.as_canonical_u64(), msg: None });
+                        if (__v_220 != __v_221) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_220.as_canonical_u64(), rhs: __v_221.as_canonical_u64(), msg: None });
                         }
-                        let __v_227: G = G::from_u64(1);
-                        let __v_228: G = G::from_u64(1);
-                        let __v_229: G = { let __values: [G; 10] = [__v_227, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228, __v_228]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_230: G = { let __values: [G; 10] = [__v_199, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_229]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_231: G = { let __values: [G; 10] = [__v_171, __v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_230]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_232: G = { let __values: [G; 10] = [__v_143, __v_58, __v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_231]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_233: G = { let __values: [G; 10] = [__v_115, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_232]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_234: G = { let __values: [G; 3] = [__v_114, __v_233, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __ret: [G; OUT_148] = [__v_37, __v_38, __v_234];
+                        let __v_222: G = G::from_u64(1);
+                        let __v_223: G = G::from_u64(1);
+                        let __v_224: G = { let __values: [G; 10] = [__v_222, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223, __v_223]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_225: G = G::from_u64(0);
+                        let __v_226: G = { let __values: [G; 10] = [__v_225, __v_177, __v_178, __v_179, __v_180, __v_181, __v_182, __v_183, __v_184, __v_224]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_227: G = G::from_u64(0);
+                        let __v_228: G = { let __values: [G; 10] = [__v_227, __v_132, __v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_226]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_229: G = G::from_u64(0);
+                        let __v_230: G = { let __values: [G; 10] = [__v_229, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_228]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_231: G = G::from_u64(0);
+                        let __v_232: G = { let __values: [G; 10] = [__v_231, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_230]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_233: G = G::from_u64(0);
+                        let __v_234: G = { let __values: [G; 3] = [__v_233, __v_232, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __ret: [G; OUT_148] = [__v_39, __v_40, __v_234];
                         record.function_queries[148].finish(&inp[..], &__ret[..], !unconstrained);
                         return Ok(__ret);
                       },
                       _ => {
-                        return Err(ExecError::MatchNoCase(__v_20.as_canonical_u64()));
+                        return Err(ExecError::MatchNoCase(__v_22.as_canonical_u64()));
                       },
                     }
                   },
@@ -14302,126 +14302,126 @@ fn aiur_fn_149(
     let __v_24: G = inp[24];
     match __v_1.as_canonical_u64() {
       _ => {
-        let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_15, __v_19, __v_18, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
         let __v_25: G = __r_arr[0];
-        let __v_26: G = G::from_u64(0);
-        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_15, __v_19, __v_18, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
-        let __v_27: G = __r_arr[0];
-        let __v_28: G = G::from_u64(0);
-        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_1, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+        let __v_26: G = (__v_25 - __v_24);
+        let __v_27: G = G::from_bool((__v_26 == G::ZERO));
+        let __v_28: G = G::from_u64(1);
+        if (__v_27 != __v_28) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_27.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
         let __v_29: G = __r_arr[0];
-        match __v_29.as_canonical_u64() {
+        let __v_30: G = G::from_u64(3);
+        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+        let __v_31: G = __r_arr[0];
+        let __v_32: G = (__v_30 + __v_31);
+        let __v_33: G = (__v_29 - __v_32);
+        let __v_34: G = G::from_bool((__v_33 == G::ZERO));
+        let __v_35: G = G::from_u64(1);
+        if (__v_34 != __v_35) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_132] = { let __args: [G; IN_132] = [__v_15, __v_19, __v_18, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[132].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[132].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[132].bump_multiplicity(__i); } let __ret: [G; OUT_132] = unsafe { *(record.function_queries[132].output_at(__i).as_ptr() as *const [G; OUT_132]) }; __ret }, _ => aiur_fn_132(__args, record, io_buffer, __cu)? } };
+        let __v_36: G = __r_arr[0];
+        let __v_37: G = G::from_u64(0);
+        let __r_arr: [G; OUT_142] = { let __args: [G; IN_142] = [__v_15, __v_19, __v_18, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[142].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[142].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[142].bump_multiplicity(__i); } let __ret: [G; OUT_142] = unsafe { *(record.function_queries[142].output_at(__i).as_ptr() as *const [G; OUT_142]) }; __ret }, _ => aiur_fn_142(__args, record, io_buffer, __cu)? } };
+        let __v_38: G = __r_arr[0];
+        let __v_39: G = G::from_u64(0);
+        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_1, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+        let __v_40: G = __r_arr[0];
+        match __v_40.as_canonical_u64() {
           _ => {
-            let __v_30: G = G::from_u64(0);
-            let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_25, __v_0, __v_20, __v_19, __v_30, __v_18, __v_15, __v_16, __v_17, __v_29, __v_5, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
-            let __v_31: G = __r_arr[0];
-            let __v_32: G = G::from_u64(1);
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_1, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_33: G = __r_arr[0];
-            match __v_33.as_canonical_u64() {
+            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+            let __v_41: G = __r_arr[0];
+            let __v_42: G = (__v_41 - __v_18);
+            let __v_43: G = G::from_bool((__v_42 == G::ZERO));
+            let __v_44: G = G::from_u64(1);
+            if (__v_43 != __v_44) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: None });
+            }
+            let __v_45: G = G::from_u64(0);
+            let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_36, __v_0, __v_20, __v_19, __v_45, __v_18, __v_15, __v_16, __v_17, __v_40, __v_5, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
+            let __v_46: G = __r_arr[0];
+            let __v_47: G = G::from_u64(1);
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_1, __v_47]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __v_48: G = __r_arr[0];
+            match __v_48.as_canonical_u64() {
               _ => {
-                let __v_34: G = G::from_u64(0);
-                let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_31, __v_0, __v_20, __v_19, __v_34, __v_18, __v_15, __v_16, __v_17, __v_33, __v_6, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
-                let __v_35: G = __r_arr[0];
-                let __v_36: G = G::from_u64(2);
-                let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_1, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-                let __v_37: G = __r_arr[0];
-                match __v_37.as_canonical_u64() {
+                let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                let __v_49: G = __r_arr[0];
+                let __v_50: G = (__v_49 - __v_18);
+                let __v_51: G = G::from_bool((__v_50 == G::ZERO));
+                let __v_52: G = G::from_u64(1);
+                if (__v_51 != __v_52) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_51.as_canonical_u64(), rhs: __v_52.as_canonical_u64(), msg: None });
+                }
+                let __v_53: G = G::from_u64(0);
+                let __r_arr: [G; OUT_138] = { let __args: [G; IN_138] = [__v_46, __v_0, __v_20, __v_19, __v_53, __v_18, __v_15, __v_16, __v_17, __v_48, __v_6, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[138].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[138].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[138].bump_multiplicity(__i); } let __ret: [G; OUT_138] = unsafe { *(record.function_queries[138].output_at(__i).as_ptr() as *const [G; OUT_138]) }; __ret }, _ => aiur_fn_138(__args, record, io_buffer, __cu)? } };
+                let __v_54: G = __r_arr[0];
+                let __v_55: G = G::from_u64(2);
+                let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_1, __v_55]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+                let __v_56: G = __r_arr[0];
+                match __v_56.as_canonical_u64() {
                   _ => {
-                    let __v_38: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_139] = { let __args: [G; IN_139] = [__v_35, __v_0, __v_20, __v_19, __v_38, __v_18, __v_15, __v_16, __v_17, __v_37, __v_7, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[139].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[139].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[139].bump_multiplicity(__i); } let __ret: [G; OUT_139] = unsafe { *(record.function_queries[139].output_at(__i).as_ptr() as *const [G; OUT_139]) }; __ret }, _ => aiur_fn_139(__args, record, io_buffer, __cu)? } };
-                    let __v_39: G = __r_arr[0];
-                    let __r_arr: [G; OUT_141] = { let __args: [G; IN_141] = [__v_39, __v_1, __v_13, __v_8, __v_9, __v_14, __v_15, __v_18, __v_0, __v_20, __v_19, __v_16, __v_17, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[141].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[141].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[141].bump_multiplicity(__i); } let __ret: [G; OUT_141] = unsafe { *(record.function_queries[141].output_at(__i).as_ptr() as *const [G; OUT_141]) }; __ret }, _ => aiur_fn_141(__args, record, io_buffer, __cu)? } };
-                    let __v_40: G = __r_arr[0];
-                    let __r_arr: [G; OUT_134] = { let __args: [G; IN_134] = [__v_40, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[134].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[134].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[134].bump_multiplicity(__i); } let __ret: [G; OUT_134] = unsafe { *(record.function_queries[134].output_at(__i).as_ptr() as *const [G; OUT_134]) }; __ret }, _ => aiur_fn_134(__args, record, io_buffer, __cu)? } };
-                    let __v_41: G = __r_arr[0];
-                    let __loaded: [G; 7] = { let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; let __ptr_u64 = __v_40.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 7 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 7] = __args[..7].try_into().unwrap(); __arr };
-                    let __v_42: G = __loaded[0];
-                    let __v_43: G = __loaded[1];
-                    let __v_44: G = __loaded[2];
-                    let __v_45: G = __loaded[3];
-                    let __v_46: G = __loaded[4];
-                    let __v_47: G = __loaded[5];
-                    let __v_48: G = __loaded[6];
-                    match __v_42.as_canonical_u64() {
+                    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_56]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                    let __v_57: G = __r_arr[0];
+                    let __v_58: G = (__v_57 - __v_18);
+                    let __v_59: G = G::from_bool((__v_58 == G::ZERO));
+                    let __v_60: G = G::from_u64(1);
+                    if (__v_59 != __v_60) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_59.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
+                    }
+                    let __v_61: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_139] = { let __args: [G; IN_139] = [__v_54, __v_0, __v_20, __v_19, __v_61, __v_18, __v_15, __v_16, __v_17, __v_56, __v_7, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[139].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[139].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[139].bump_multiplicity(__i); } let __ret: [G; OUT_139] = unsafe { *(record.function_queries[139].output_at(__i).as_ptr() as *const [G; OUT_139]) }; __ret }, _ => aiur_fn_139(__args, record, io_buffer, __cu)? } };
+                    let __v_62: G = __r_arr[0];
+                    let __r_arr: [G; OUT_141] = { let __args: [G; IN_141] = [__v_62, __v_1, __v_13, __v_8, __v_9, __v_14, __v_15, __v_18, __v_0, __v_20, __v_19, __v_16, __v_17, __v_3, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[141].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[141].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[141].bump_multiplicity(__i); } let __ret: [G; OUT_141] = unsafe { *(record.function_queries[141].output_at(__i).as_ptr() as *const [G; OUT_141]) }; __ret }, _ => aiur_fn_141(__args, record, io_buffer, __cu)? } };
+                    let __v_63: G = __r_arr[0];
+                    let __r_arr: [G; OUT_134] = { let __args: [G; IN_134] = [__v_63, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[134].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[134].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[134].bump_multiplicity(__i); } let __ret: [G; OUT_134] = unsafe { *(record.function_queries[134].output_at(__i).as_ptr() as *const [G; OUT_134]) }; __ret }, _ => aiur_fn_134(__args, record, io_buffer, __cu)? } };
+                    let __v_64: G = __r_arr[0];
+                    let __loaded: [G; 7] = { let __mq = record.memory_queries.get_mut(&7).ok_or(ExecError::InvalidMemorySize(7))?; let __ptr_u64 = __v_63.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 7 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 7] = __args[..7].try_into().unwrap(); __arr };
+                    let __v_65: G = __loaded[0];
+                    let __v_66: G = __loaded[1];
+                    let __v_67: G = __loaded[2];
+                    let __v_68: G = __loaded[3];
+                    let __v_69: G = __loaded[4];
+                    let __v_70: G = __loaded[5];
+                    let __v_71: G = __loaded[6];
+                    match __v_65.as_canonical_u64() {
                       0u64 => {
-                        match __v_43.as_canonical_u64() {
+                        match __v_66.as_canonical_u64() {
                           _ => {
-                            let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_46, __v_47, __v_21, __v_22, __v_2, __v_0, __v_20, __v_48, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
-                            let __v_49: G = __r_arr[0];
-                            let __v_50: G = __r_arr[1];
-                            let __v_51: G = __r_arr[2];
-                            let __v_52: G = G::from_u64(0);
-                            let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_23, __v_52]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
-                            let __v_53: G = __r_arr[0];
-                            let __v_54: G = __r_arr[1];
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_55: G = __r_arr[0];
-                            let __v_56: G = (__v_55 - __v_24);
-                            let __v_57: G = G::from_bool((__v_56 == G::ZERO));
-                            let __v_58: G = G::from_u64(1);
-                            if (__v_57 != __v_58) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_58.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_1]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_59: G = __r_arr[0];
-                            let __v_60: G = G::from_u64(3);
-                            let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
-                            let __v_61: G = __r_arr[0];
-                            let __v_62: G = (__v_60 + __v_61);
-                            let __v_63: G = (__v_59 - __v_62);
-                            let __v_64: G = G::from_bool((__v_63 == G::ZERO));
-                            let __v_65: G = G::from_u64(1);
-                            if (__v_64 != __v_65) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_64.as_canonical_u64(), rhs: __v_65.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_29]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_66: G = __r_arr[0];
-                            let __v_67: G = (__v_66 - __v_18);
-                            let __v_68: G = G::from_bool((__v_67 == G::ZERO));
-                            let __v_69: G = G::from_u64(1);
-                            if (__v_68 != __v_69) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_68.as_canonical_u64(), rhs: __v_69.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_33]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_70: G = __r_arr[0];
-                            let __v_71: G = (__v_70 - __v_18);
-                            let __v_72: G = G::from_bool((__v_71 == G::ZERO));
-                            let __v_73: G = G::from_u64(1);
-                            if (__v_72 != __v_73) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_72.as_canonical_u64(), rhs: __v_73.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_37]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_74: G = __r_arr[0];
-                            let __v_75: G = (__v_74 - __v_18);
-                            let __v_76: G = G::from_bool((__v_75 == G::ZERO));
-                            let __v_77: G = G::from_u64(1);
-                            if (__v_76 != __v_77) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_77.as_canonical_u64(), msg: None });
+                            let __v_72: G = (__v_66 - __v_20);
+                            let __v_73: G = G::from_bool((__v_72 == G::ZERO));
+                            let __v_74: G = G::from_u64(1);
+                            if (__v_73 != __v_74) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_73.as_canonical_u64(), rhs: __v_74.as_canonical_u64(), msg: None });
                             }
-                            let __v_78: G = (__v_43 - __v_20);
-                            let __v_79: G = G::from_bool((__v_78 == G::ZERO));
-                            let __v_80: G = G::from_u64(1);
-                            if (__v_79 != __v_80) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
-                            }
-                            let __v_81: G = (__v_53 - __v_49);
+                            let __r_arr: [G; OUT_148] = { let __args: [G; IN_148] = [__v_69, __v_70, __v_21, __v_22, __v_2, __v_0, __v_20, __v_71, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[148].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[148].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[148].bump_multiplicity(__i); } let __ret: [G; OUT_148] = unsafe { *(record.function_queries[148].output_at(__i).as_ptr() as *const [G; OUT_148]) }; __ret }, _ => aiur_fn_148(__args, record, io_buffer, __cu)? } };
+                            let __v_75: G = __r_arr[0];
+                            let __v_76: G = __r_arr[1];
+                            let __v_77: G = __r_arr[2];
+                            let __v_78: G = G::from_u64(0);
+                            let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_23, __v_78]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+                            let __v_79: G = __r_arr[0];
+                            let __v_80: G = __r_arr[1];
+                            let __v_81: G = (__v_79 - __v_75);
                             let __v_82: G = G::from_bool((__v_81 == G::ZERO));
-                            let __v_83: G = (__v_54 - __v_50);
+                            let __v_83: G = (__v_80 - __v_76);
                             let __v_84: G = G::from_bool((__v_83 == G::ZERO));
                             let __v_85: G = (__v_82 * __v_84);
                             let __v_86: G = G::from_u64(1);
                             if (__v_85 != __v_86) {
                               return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_86.as_canonical_u64(), msg: None });
                             }
-                            let __ret: [G; OUT_149] = [__v_51];
+                            let __ret: [G; OUT_149] = [__v_77];
                             record.function_queries[149].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
                         }
                       },
                       _ => {
-                        return Err(ExecError::MatchNoCase(__v_42.as_canonical_u64()));
+                        return Err(ExecError::MatchNoCase(__v_65.as_canonical_u64()));
                       },
                     }
                   },
@@ -14491,10 +14491,10 @@ fn aiur_fn_150(
         let __v_31: G = __r_arr[2];
         let __r_arr: [G; OUT_149] = { let __args: [G; IN_149] = [__v_29, __v_26, __v_27, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[149].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[149].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[149].bump_multiplicity(__i); } let __ret: [G; OUT_149] = unsafe { *(record.function_queries[149].output_at(__i).as_ptr() as *const [G; OUT_149]) }; __ret }, _ => aiur_fn_149(__args, record, io_buffer, __cu)? } };
         let __v_32: G = __r_arr[0];
-        let __v_33: G = G::from_u64(0);
         let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_30, __v_31, __v_28, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-        let __v_34: G = __r_arr[0];
-        let __v_35: G = { let __values: [G; 3] = [__v_33, __v_32, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_33: G = __r_arr[0];
+        let __v_34: G = G::from_u64(0);
+        let __v_35: G = { let __values: [G; 3] = [__v_34, __v_32, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_150] = [__v_35];
         record.function_queries[150].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14534,12 +14534,12 @@ fn aiur_fn_151(
         let __v_4: G = __r_arr[0];
         let __v_5: G = __r_arr[1];
         let __v_6: G = __r_arr[2];
-        let __v_7: G = G::from_u64(0);
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = (__v_2 - __v_8);
-        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_5, __v_6, __v_9, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-        let __v_10: G = __r_arr[0];
-        let __v_11: G = { let __values: [G; 3] = [__v_7, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = G::from_u64(1);
+        let __v_8: G = (__v_2 - __v_7);
+        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_5, __v_6, __v_8, __v_3]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+        let __v_9: G = __r_arr[0];
+        let __v_10: G = G::from_u64(0);
+        let __v_11: G = { let __values: [G; 3] = [__v_10, __v_4, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_151] = [__v_11];
         record.function_queries[151].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14577,12 +14577,12 @@ fn aiur_fn_152(
       0u64 => {
         match __v_3.as_canonical_u64() {
           _ => {
-            let __v_6: G = G::from_u64(0);
             let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_7: G = __r_arr[0];
+            let __v_6: G = __r_arr[0];
             let __r_arr: [G; OUT_152] = { let __args: [G; IN_152] = [__v_5, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[152].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[152].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[152].bump_multiplicity(__i); } let __ret: [G; OUT_152] = unsafe { *(record.function_queries[152].output_at(__i).as_ptr() as *const [G; OUT_152]) }; __ret }, _ => aiur_fn_152(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = { let __values: [G; 3] = [__v_6, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = G::from_u64(0);
+            let __v_9: G = { let __values: [G; 3] = [__v_8, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_152] = [__v_9];
             record.function_queries[152].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -14626,12 +14626,12 @@ fn aiur_fn_153(
       0u64 => {
         match __v_3.as_canonical_u64() {
           _ => {
-            let __v_7: G = G::from_u64(0);
             let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
+            let __v_7: G = __r_arr[0];
             let __r_arr: [G; OUT_153] = { let __args: [G; IN_153] = [__v_6, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[153].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[153].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[153].bump_multiplicity(__i); } let __ret: [G; OUT_153] = unsafe { *(record.function_queries[153].output_at(__i).as_ptr() as *const [G; OUT_153]) }; __ret }, _ => aiur_fn_153(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
-            let __v_10: G = { let __values: [G; 4] = [__v_7, __v_3, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 4] = [__v_9, __v_3, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_153] = [__v_10];
             record.function_queries[153].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -14669,18 +14669,18 @@ fn aiur_fn_154(
         return Ok(__ret);
       },
       _ => {
-        let __v_4: G = G::from_u64(0);
         let __r_arr: [G; OUT_152] = { let __args: [G; IN_152] = [__v_0, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[152].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[152].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[152].bump_multiplicity(__i); } let __ret: [G; OUT_152] = unsafe { *(record.function_queries[152].output_at(__i).as_ptr() as *const [G; OUT_152]) }; __ret }, _ => aiur_fn_152(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
+        let __v_4: G = __r_arr[0];
         let __r_arr: [G; OUT_153] = { let __args: [G; IN_153] = [__v_1, __v_2]; let __cu = unconstrained; let __hit = record.function_queries[153].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[153].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[153].bump_multiplicity(__i); } let __ret: [G; OUT_153] = unsafe { *(record.function_queries[153].output_at(__i).as_ptr() as *const [G; OUT_153]) }; __ret }, _ => aiur_fn_153(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = (__v_2 + __v_7);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = (__v_3 - __v_9);
-        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_0, __v_1, __v_8, __v_10]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-        let __v_11: G = __r_arr[0];
-        let __v_12: G = { let __values: [G; 4] = [__v_4, __v_5, __v_6, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = (__v_2 + __v_6);
+        let __v_8: G = G::from_u64(1);
+        let __v_9: G = (__v_3 - __v_8);
+        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_0, __v_1, __v_7, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
+        let __v_10: G = __r_arr[0];
+        let __v_11: G = G::from_u64(0);
+        let __v_12: G = { let __values: [G; 4] = [__v_11, __v_4, __v_5, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_154] = [__v_12];
         record.function_queries[154].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14817,12 +14817,12 @@ fn aiur_fn_156(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_255] = { let __args: [G; IN_255] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[255].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[255].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[255].bump_multiplicity(__i); } let __ret: [G; OUT_255] = unsafe { *(record.function_queries[255].output_at(__i).as_ptr() as *const [G; OUT_255]) }; __ret }, _ => aiur_fn_255(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
+        let __v_5: G = __r_arr[0];
         let __r_arr: [G; OUT_156] = { let __args: [G; IN_156] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[156].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[156].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[156].bump_multiplicity(__i); } let __ret: [G; OUT_156] = unsafe { *(record.function_queries[156].output_at(__i).as_ptr() as *const [G; OUT_156]) }; __ret }, _ => aiur_fn_156(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = { let __values: [G; 3] = [__v_5, __v_6, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_6: G = __r_arr[0];
+        let __v_7: G = G::from_u64(0);
+        let __v_8: G = { let __values: [G; 3] = [__v_7, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_156] = [__v_8];
         record.function_queries[156].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14860,17 +14860,17 @@ fn aiur_fn_157(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
-        let __v_6: G = G::from_u64(0);
         let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_3, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-        let __v_7: G = __r_arr[0];
-        let __v_8: G = G::from_u64(1);
-        let __v_9: G = G::from_u64(1);
-        let __v_10: G = { let __values: [G; 3] = [__v_8, __v_9, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_11: G = { let __values: [G; 3] = [__v_6, __v_7, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(1);
+        let __v_7: G = G::from_u64(1);
+        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_9: G = G::from_u64(0);
+        let __v_10: G = { let __values: [G; 3] = [__v_9, __v_5, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __r_arr: [G; OUT_157] = { let __args: [G; IN_157] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[157].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[157].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[157].bump_multiplicity(__i); } let __ret: [G; OUT_157] = unsafe { *(record.function_queries[157].output_at(__i).as_ptr() as *const [G; OUT_157]) }; __ret }, _ => aiur_fn_157(__args, record, io_buffer, __cu)? } };
-        let __v_12: G = __r_arr[0];
-        let __v_13: G = { let __values: [G; 3] = [__v_5, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_11: G = __r_arr[0];
+        let __v_12: G = G::from_u64(0);
+        let __v_13: G = { let __values: [G; 3] = [__v_12, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_157] = [__v_13];
         record.function_queries[157].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -14923,29 +14923,29 @@ fn aiur_fn_158(
             match __v_7.as_canonical_u64() {
               _ => {
                 let __v_14: G = G::from_u64(1);
-                let __r_arr: [G; OUT_156] = { let __args: [G; IN_156] = [__v_3, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[156].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[156].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[156].bump_multiplicity(__i); } let __ret: [G; OUT_156] = unsafe { *(record.function_queries[156].output_at(__i).as_ptr() as *const [G; OUT_156]) }; __ret }, _ => aiur_fn_156(__args, record, io_buffer, __cu)? } };
-                let __v_15: G = __r_arr[0];
-                let __v_16: G = G::from_u64(1);
-                let __v_17: G = (__v_5 - __v_16);
-                let __v_18: G = G::from_u64(1);
-                if (__v_7 != __v_18) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_18.as_canonical_u64(), msg: None });
+                if (__v_7 != __v_14) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_7.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: None });
                 }
                 let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                let __v_19: G = __r_arr[0];
+                let __v_15: G = __r_arr[0];
                 let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                let __v_20: G = __r_arr[0];
-                if (__v_19 != __v_20) {
-                  return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: None });
+                let __v_16: G = __r_arr[0];
+                if (__v_15 != __v_16) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_15.as_canonical_u64(), rhs: __v_16.as_canonical_u64(), msg: None });
                 }
+                let __v_17: G = G::from_u64(1);
+                let __r_arr: [G; OUT_156] = { let __args: [G; IN_156] = [__v_3, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[156].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[156].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[156].bump_multiplicity(__i); } let __ret: [G; OUT_156] = unsafe { *(record.function_queries[156].output_at(__i).as_ptr() as *const [G; OUT_156]) }; __ret }, _ => aiur_fn_156(__args, record, io_buffer, __cu)? } };
+                let __v_18: G = __r_arr[0];
+                let __v_19: G = G::from_u64(1);
+                let __v_20: G = (__v_5 - __v_19);
                 let __r_arr: [G; OUT_157] = { let __args: [G; IN_157] = [__v_2, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[157].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[157].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[157].bump_multiplicity(__i); } let __ret: [G; OUT_157] = unsafe { *(record.function_queries[157].output_at(__i).as_ptr() as *const [G; OUT_157]) }; __ret }, _ => aiur_fn_157(__args, record, io_buffer, __cu)? } };
                 let __v_21: G = __r_arr[0];
-                let __v_22: G = G::from_u64(0);
+                let __v_22: G = G::from_u64(1);
                 let __v_23: G = G::from_u64(1);
-                let __v_24: G = G::from_u64(1);
-                let __v_25: G = { let __values: [G; 3] = [__v_23, __v_24, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_26: G = { let __values: [G; 3] = [__v_22, __v_17, __v_25]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_118] = { let __args: [G; IN_118] = [__v_12, __v_21, __v_26, __v_15, __v_9, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[118].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[118].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[118].bump_multiplicity(__i); } let __ret: [G; OUT_118] = unsafe { *(record.function_queries[118].output_at(__i).as_ptr() as *const [G; OUT_118]) }; __ret }, _ => aiur_fn_118(__args, record, io_buffer, __cu)? } };
+                let __v_24: G = { let __values: [G; 3] = [__v_22, __v_23, __v_23]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_25: G = G::from_u64(0);
+                let __v_26: G = { let __values: [G; 3] = [__v_25, __v_20, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __r_arr: [G; OUT_118] = { let __args: [G; IN_118] = [__v_12, __v_21, __v_26, __v_18, __v_9, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[118].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[118].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[118].bump_multiplicity(__i); } let __ret: [G; OUT_118] = unsafe { *(record.function_queries[118].output_at(__i).as_ptr() as *const [G; OUT_118]) }; __ret }, _ => aiur_fn_118(__args, record, io_buffer, __cu)? } };
                 let __v_27: G = __r_arr[0];
                 let __v_28: G = G::from_u64(1);
                 if (__v_27 != __v_28) {
@@ -14953,7 +14953,7 @@ fn aiur_fn_158(
                 }
                 let __v_29: G = G::from_u64(1);
                 let __v_30: G = (__v_4 + __v_29);
-                let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_10, __v_13, __v_2, __v_15, __v_30, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_10, __v_13, __v_2, __v_18, __v_30, __v_20]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
                 let __v_31: G = __r_arr[0];
                 let __ret: [G; OUT_158] = [__v_31];
                 record.function_queries[158].finish(&inp[..], &__ret[..], !unconstrained);
@@ -15019,164 +15019,164 @@ fn aiur_fn_159(
       _ => {
         let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
         let __v_32: G = __r_arr[0];
-        let __v_33: G = G::from_u64(1);
-        let __v_34: G = G::from_u64(1);
-        let __v_35: G = { let __values: [G; 3] = [__v_33, __v_34, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
+        let __v_33: G = __r_arr[0];
+        let __v_34: G = (__v_33 - __v_32);
+        let __v_35: G = G::from_bool((__v_34 == G::ZERO));
+        let __v_36: G = G::from_u64(1);
+        if (__v_35 != __v_36) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_35.as_canonical_u64(), rhs: __v_36.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_37: G = __r_arr[0];
+        let __v_38: G = G::from_u64(3);
+        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_4, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+        let __v_39: G = __r_arr[0];
+        let __v_40: G = (__v_38 + __v_39);
+        if (__v_37 != __v_40) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_37.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
+        let __v_41: G = __r_arr[0];
+        let __v_42: G = (__v_41 - __v_32);
+        let __v_43: G = G::from_bool((__v_42 == G::ZERO));
+        let __v_44: G = G::from_u64(1);
+        if (__v_43 != __v_44) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_44.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_45: G = __r_arr[0];
+        let __v_46: G = G::from_u64(1);
+        if (__v_45 != __v_46) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_46.as_canonical_u64(), msg: None });
+        }
+        let __v_47: G = G::from_u64(1);
+        let __v_48: G = G::from_u64(1);
+        let __v_49: G = { let __values: [G; 3] = [__v_47, __v_48, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_4.as_canonical_u64() {
   0u64 => {
-    break '__mc_0 [__v_35];
+    break '__mc_0 [__v_49];
   },
   1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_5, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_36: G = __r_arr[0];
-    break '__mc_0 [__v_36];
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_5, __v_49]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_50: G = __r_arr[0];
+    break '__mc_0 [__v_50];
   },
   _ => {
     return Err(ExecError::MatchNoCase(__v_4.as_canonical_u64()));
   },
 }
  };
-        let __v_36: G = __mc_out___mc_0[0];
-        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_3, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-        let __v_37: G = __r_arr[0];
-        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_2, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-        let __v_38: G = __r_arr[0];
-        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_1, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-        let __v_39: G = __r_arr[0];
-        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_0, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-        let __v_40: G = __r_arr[0];
-        let __v_41: G = G::from_u64(1);
-        let __v_42: G = G::from_u64(1);
-        let __v_43: G = { let __values: [G; 3] = [__v_41, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_40, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-        let __v_44: G = __r_arr[0];
-        let __v_45: G = __r_arr[1];
-        let __v_46: G = __r_arr[2];
-        let __v_47: G = __r_arr[3];
-        let __v_48: G = __r_arr[4];
-        let __v_49: G = __r_arr[5];
-        let __v_50: G = __r_arr[6];
-        let __v_51: G = __r_arr[7];
-        let __v_52: G = __r_arr[8];
-        let __v_53: G = __r_arr[9];
-        let __v_54: G = __r_arr[10];
-        let __v_55: G = __r_arr[11];
-        let __v_56: G = __r_arr[12];
-        let __v_57: G = __r_arr[13];
-        let __v_58: G = __r_arr[14];
-        let __v_59: G = __r_arr[15];
-        let __v_60: G = __r_arr[16];
-        let __v_61: G = __r_arr[17];
-        let __v_62: G = G::from_u64(256);
-        let __v_63: G = (__v_62 * __v_45);
-        let __v_64: G = G::from_u64(65536);
-        let __v_65: G = (__v_64 * __v_46);
-        let __v_66: G = G::from_u64(16777216);
-        let __v_67: G = (__v_66 * __v_47);
-        let __v_68: G = G::from_u64(4294967296);
-        let __v_69: G = (__v_68 * __v_48);
-        let __v_70: G = G::from_u64(1099511627776);
-        let __v_71: G = (__v_70 * __v_49);
-        let __v_72: G = G::from_u64(281474976710656);
-        let __v_73: G = (__v_72 * __v_50);
-        let __v_74: G = G::from_u64(72057594037927936);
-        let __v_75: G = (__v_74 * __v_51);
-        let __v_76: G = (__v_73 + __v_75);
-        let __v_77: G = (__v_71 + __v_76);
-        let __v_78: G = (__v_69 + __v_77);
-        let __v_79: G = (__v_67 + __v_78);
-        let __v_80: G = (__v_65 + __v_79);
-        let __v_81: G = (__v_63 + __v_80);
-        let __v_82: G = (__v_44 + __v_81);
-        let __v_83: G = G::from_u64(256);
-        let __v_84: G = (__v_83 * __v_53);
-        let __v_85: G = G::from_u64(65536);
-        let __v_86: G = (__v_85 * __v_54);
-        let __v_87: G = G::from_u64(16777216);
-        let __v_88: G = (__v_87 * __v_55);
-        let __v_89: G = G::from_u64(4294967296);
-        let __v_90: G = (__v_89 * __v_56);
-        let __v_91: G = G::from_u64(1099511627776);
-        let __v_92: G = (__v_91 * __v_57);
-        let __v_93: G = G::from_u64(281474976710656);
-        let __v_94: G = (__v_93 * __v_58);
-        let __v_95: G = G::from_u64(72057594037927936);
-        let __v_96: G = (__v_95 * __v_59);
-        let __v_97: G = (__v_94 + __v_96);
-        let __v_98: G = (__v_92 + __v_97);
-        let __v_99: G = (__v_90 + __v_98);
-        let __v_100: G = (__v_88 + __v_99);
-        let __v_101: G = (__v_86 + __v_100);
-        let __v_102: G = (__v_84 + __v_101);
-        let __v_103: G = (__v_52 + __v_102);
-        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_60, __v_6, __v_7, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-        let __v_104: G = __r_arr[0];
-        let __v_105: G = __r_arr[1];
-        let __v_106: G = G::from_u64(1);
-        let __v_107: G = G::from_u64(1);
-        let __v_108: G = { let __values: [G; 3] = [__v_106, __v_107, __v_107]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_10, __v_108]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-        let __v_109: G = __r_arr[0];
-        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_105, __v_109]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-        let __v_110: G = __r_arr[0];
-        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_110, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-        let __v_111: G = __r_arr[0];
-        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_111, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-        let __v_112: G = __r_arr[0];
-        let __v_113: G = __r_arr[1];
-        let __v_114: G = (__v_32 + __v_28);
-        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_112, __v_113, __v_29, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-        let __v_115: G = __r_arr[0];
-        let __v_116: G = G::from_u64(0);
-        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_8, __v_9, __v_116, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-        let __v_117: G = __r_arr[0];
-        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_112, __v_113, __v_117, __v_82, __v_103, __v_1, __v_2, __v_3, __v_4, __v_5, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_114, __v_104, __v_6, __v_10, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+        let __v_50: G = __mc_out___mc_0[0];
+        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_3, __v_50]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+        let __v_51: G = __r_arr[0];
+        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_2, __v_51]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+        let __v_52: G = __r_arr[0];
+        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_1, __v_52]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+        let __v_53: G = __r_arr[0];
+        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_0, __v_53]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+        let __v_54: G = __r_arr[0];
+        let __v_55: G = G::from_u64(1);
+        let __v_56: G = G::from_u64(1);
+        let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_54, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+        let __v_58: G = __r_arr[0];
+        let __v_59: G = __r_arr[1];
+        let __v_60: G = __r_arr[2];
+        let __v_61: G = __r_arr[3];
+        let __v_62: G = __r_arr[4];
+        let __v_63: G = __r_arr[5];
+        let __v_64: G = __r_arr[6];
+        let __v_65: G = __r_arr[7];
+        let __v_66: G = __r_arr[8];
+        let __v_67: G = __r_arr[9];
+        let __v_68: G = __r_arr[10];
+        let __v_69: G = __r_arr[11];
+        let __v_70: G = __r_arr[12];
+        let __v_71: G = __r_arr[13];
+        let __v_72: G = __r_arr[14];
+        let __v_73: G = __r_arr[15];
+        let __v_74: G = __r_arr[16];
+        let __v_75: G = __r_arr[17];
+        let __v_76: G = G::from_u64(256);
+        let __v_77: G = (__v_76 * __v_59);
+        let __v_78: G = G::from_u64(65536);
+        let __v_79: G = (__v_78 * __v_60);
+        let __v_80: G = G::from_u64(16777216);
+        let __v_81: G = (__v_80 * __v_61);
+        let __v_82: G = G::from_u64(4294967296);
+        let __v_83: G = (__v_82 * __v_62);
+        let __v_84: G = G::from_u64(1099511627776);
+        let __v_85: G = (__v_84 * __v_63);
+        let __v_86: G = G::from_u64(281474976710656);
+        let __v_87: G = (__v_86 * __v_64);
+        let __v_88: G = G::from_u64(72057594037927936);
+        let __v_89: G = (__v_88 * __v_65);
+        let __v_90: G = (__v_87 + __v_89);
+        let __v_91: G = (__v_85 + __v_90);
+        let __v_92: G = (__v_83 + __v_91);
+        let __v_93: G = (__v_81 + __v_92);
+        let __v_94: G = (__v_79 + __v_93);
+        let __v_95: G = (__v_77 + __v_94);
+        let __v_96: G = (__v_58 + __v_95);
+        let __v_97: G = G::from_u64(256);
+        let __v_98: G = (__v_97 * __v_67);
+        let __v_99: G = G::from_u64(65536);
+        let __v_100: G = (__v_99 * __v_68);
+        let __v_101: G = G::from_u64(16777216);
+        let __v_102: G = (__v_101 * __v_69);
+        let __v_103: G = G::from_u64(4294967296);
+        let __v_104: G = (__v_103 * __v_70);
+        let __v_105: G = G::from_u64(1099511627776);
+        let __v_106: G = (__v_105 * __v_71);
+        let __v_107: G = G::from_u64(281474976710656);
+        let __v_108: G = (__v_107 * __v_72);
+        let __v_109: G = G::from_u64(72057594037927936);
+        let __v_110: G = (__v_109 * __v_73);
+        let __v_111: G = (__v_108 + __v_110);
+        let __v_112: G = (__v_106 + __v_111);
+        let __v_113: G = (__v_104 + __v_112);
+        let __v_114: G = (__v_102 + __v_113);
+        let __v_115: G = (__v_100 + __v_114);
+        let __v_116: G = (__v_98 + __v_115);
+        let __v_117: G = (__v_66 + __v_116);
+        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_74, __v_6, __v_7, __v_30]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
         let __v_118: G = __r_arr[0];
-        let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-        let __v_119: G = __r_arr[0];
-        let __v_120: G = (__v_119 - __v_32);
-        let __v_121: G = G::from_bool((__v_120 == G::ZERO));
-        let __v_122: G = G::from_u64(1);
-        if (__v_121 != __v_122) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_121.as_canonical_u64(), rhs: __v_122.as_canonical_u64(), msg: None });
-        }
-        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_119: G = __r_arr[1];
+        let __v_120: G = G::from_u64(1);
+        let __v_121: G = G::from_u64(1);
+        let __v_122: G = { let __values: [G; 3] = [__v_120, __v_121, __v_121]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_10, __v_122]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
         let __v_123: G = __r_arr[0];
-        let __v_124: G = G::from_u64(3);
-        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_4, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_119, __v_123]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+        let __v_124: G = __r_arr[0];
+        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_124, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
         let __v_125: G = __r_arr[0];
-        let __v_126: G = (__v_124 + __v_125);
-        if (__v_123 != __v_126) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_123.as_canonical_u64(), rhs: __v_126.as_canonical_u64(), msg: None });
-        }
-        let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
-        let __v_127: G = __r_arr[0];
-        let __v_128: G = (__v_127 - __v_32);
-        let __v_129: G = G::from_bool((__v_128 == G::ZERO));
-        let __v_130: G = G::from_u64(1);
-        if (__v_129 != __v_130) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_129.as_canonical_u64(), rhs: __v_130.as_canonical_u64(), msg: None });
-        }
-        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_10]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-        let __v_131: G = __r_arr[0];
-        let __v_132: G = G::from_u64(1);
-        if (__v_131 != __v_132) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_131.as_canonical_u64(), rhs: __v_132.as_canonical_u64(), msg: None });
+        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_125, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_31]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+        let __v_126: G = __r_arr[0];
+        let __v_127: G = __r_arr[1];
+        let __v_128: G = (__v_32 + __v_28);
+        let __v_129: G = G::from_u64(33);
+        let __v_130: G = { let __a_val = __v_128.as_canonical_u64(); let __b_val = __v_129.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+        let __v_131: G = G::from_u64(1);
+        if (__v_130 != __v_131) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
         }
-        let __v_133: G = G::from_u64(33);
-        let __v_134: G = { let __a_val = __v_114.as_canonical_u64(); let __b_val = __v_133.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-        let __v_135: G = G::from_u64(1);
-        if (__v_134 != __v_135) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_134.as_canonical_u64(), rhs: __v_135.as_canonical_u64(), msg: None });
+        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_126, __v_127, __v_29, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+        let __v_132: G = __r_arr[0];
+        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_8, __v_132, __v_19, __v_20, __v_21, __v_22, __v_4, __v_5, __v_23, __v_24, __v_27, __v_28, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+        let __v_133: G = __r_arr[0];
+        let __v_134: G = G::from_u64(1);
+        if (__v_133 != __v_134) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_133.as_canonical_u64(), rhs: __v_134.as_canonical_u64(), msg: None });
         }
-        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_8, __v_115, __v_19, __v_20, __v_21, __v_22, __v_4, __v_5, __v_23, __v_24, __v_27, __v_28, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+        let __v_135: G = G::from_u64(0);
+        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_8, __v_9, __v_135, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
         let __v_136: G = __r_arr[0];
-        let __v_137: G = G::from_u64(1);
-        if (__v_136 != __v_137) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_136.as_canonical_u64(), rhs: __v_137.as_canonical_u64(), msg: None });
-        }
+        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_126, __v_127, __v_136, __v_96, __v_117, __v_1, __v_2, __v_3, __v_4, __v_5, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_128, __v_118, __v_6, __v_10, __v_32]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+        let __v_137: G = __r_arr[0];
         let __v_138: G = G::from_u64(0);
-        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_9, __v_6, __v_118, __v_115, __v_138, __v_114]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_9, __v_6, __v_137, __v_132, __v_138, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
         let __v_139: G = __r_arr[0];
         let __ret: [G; OUT_159] = [__v_139];
         record.function_queries[159].finish(&inp[..], &__ret[..], !unconstrained);
@@ -15281,21 +15281,21 @@ fn aiur_fn_162(
     let __v_7: G = inp[7];
     let __v_8: G = inp[8];
     let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(0);
+    let __v_10: G = { let __values: [G; 3] = [__v_9, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_11: G = G::from_u64(0);
-    let __v_12: G = G::from_u64(0);
+    let __v_12: G = { let __values: [G; 3] = [__v_11, __v_6, __v_10]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_13: G = G::from_u64(0);
-    let __v_14: G = G::from_u64(0);
+    let __v_14: G = { let __values: [G; 3] = [__v_13, __v_5, __v_12]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = G::from_u64(0);
-    let __v_17: G = { let __values: [G; 3] = [__v_16, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_18: G = { let __values: [G; 3] = [__v_15, __v_6, __v_17]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_19: G = { let __values: [G; 3] = [__v_14, __v_5, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_20: G = { let __values: [G; 3] = [__v_13, __v_4, __v_19]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_21: G = { let __values: [G; 3] = [__v_12, __v_3, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_22: G = { let __values: [G; 3] = [__v_11, __v_2, __v_21]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_23: G = { let __values: [G; 3] = [__v_10, __v_1, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_24: G = { let __values: [G; 3] = [__v_9, __v_0, __v_23]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_16: G = { let __values: [G; 3] = [__v_15, __v_4, __v_14]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_17: G = G::from_u64(0);
+    let __v_18: G = { let __values: [G; 3] = [__v_17, __v_3, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_19: G = G::from_u64(0);
+    let __v_20: G = { let __values: [G; 3] = [__v_19, __v_2, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_21: G = G::from_u64(0);
+    let __v_22: G = { let __values: [G; 3] = [__v_21, __v_1, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_23: G = G::from_u64(0);
+    let __v_24: G = { let __values: [G; 3] = [__v_23, __v_0, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_162] = [__v_24];
     record.function_queries[162].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -15921,12 +15921,12 @@ fn aiur_fn_169(
         let __v_4: G = __loaded[2];
         match __v_2.as_canonical_u64() {
           0u64 => {
-            let __v_5: G = G::from_u64(0);
-            let __v_6: G = G::from_u64(1);
-            let __v_7: G = (__v_1 - __v_6);
-            let __r_arr: [G; OUT_169] = { let __args: [G; IN_169] = [__v_4, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[169].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[169].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[169].bump_multiplicity(__i); } let __ret: [G; OUT_169] = unsafe { *(record.function_queries[169].output_at(__i).as_ptr() as *const [G; OUT_169]) }; __ret }, _ => aiur_fn_169(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
-            let __v_9: G = { let __values: [G; 3] = [__v_5, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_5: G = G::from_u64(1);
+            let __v_6: G = (__v_1 - __v_5);
+            let __r_arr: [G; OUT_169] = { let __args: [G; IN_169] = [__v_4, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[169].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[169].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[169].bump_multiplicity(__i); } let __ret: [G; OUT_169] = unsafe { *(record.function_queries[169].output_at(__i).as_ptr() as *const [G; OUT_169]) }; __ret }, _ => aiur_fn_169(__args, record, io_buffer, __cu)? } };
+            let __v_7: G = __r_arr[0];
+            let __v_8: G = G::from_u64(0);
+            let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_169] = [__v_9];
             record.function_queries[169].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -16087,53 +16087,53 @@ fn aiur_fn_173(
 ) -> Result<[G; OUT_173], ExecError> {
   stacker::maybe_grow(64 * 1024, 4 * 1024 * 1024, || {
     let __v_0: G = inp[0];
-    let __v_1: G = G::from_u64(0);
-    let __v_2: G = G::from_u64(109);
-    let __v_3: G = G::from_u64(0);
-    let __v_4: G = G::from_u64(117);
-    let __v_5: G = G::from_u64(0);
-    let __v_6: G = G::from_u64(108);
-    let __v_7: G = G::from_u64(0);
+    let __v_1: G = G::from_u64(109);
+    let __v_2: G = G::from_u64(117);
+    let __v_3: G = G::from_u64(108);
+    let __v_4: G = G::from_u64(116);
+    let __v_5: G = G::from_u64(105);
+    let __v_6: G = G::from_u64(45);
+    let __v_7: G = G::from_u64(115);
     let __v_8: G = G::from_u64(116);
-    let __v_9: G = G::from_u64(0);
-    let __v_10: G = G::from_u64(105);
-    let __v_11: G = G::from_u64(0);
-    let __v_12: G = G::from_u64(45);
-    let __v_13: G = G::from_u64(0);
-    let __v_14: G = G::from_u64(115);
+    let __v_9: G = G::from_u64(97);
+    let __v_10: G = G::from_u64(114);
+    let __v_11: G = G::from_u64(107);
+    let __v_12: G = G::from_u64(47);
+    let __v_13: G = G::from_u64(118);
+    let __v_14: G = G::from_u64(48);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = G::from_u64(116);
+    let __v_16: G = { let __values: [G; 3] = [__v_15, __v_14, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_17: G = G::from_u64(0);
-    let __v_18: G = G::from_u64(97);
+    let __v_18: G = { let __values: [G; 3] = [__v_17, __v_13, __v_16]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_19: G = G::from_u64(0);
-    let __v_20: G = G::from_u64(114);
+    let __v_20: G = { let __values: [G; 3] = [__v_19, __v_12, __v_18]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_21: G = G::from_u64(0);
-    let __v_22: G = G::from_u64(107);
+    let __v_22: G = { let __values: [G; 3] = [__v_21, __v_11, __v_20]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_23: G = G::from_u64(0);
-    let __v_24: G = G::from_u64(47);
+    let __v_24: G = { let __values: [G; 3] = [__v_23, __v_10, __v_22]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_25: G = G::from_u64(0);
-    let __v_26: G = G::from_u64(118);
+    let __v_26: G = { let __values: [G; 3] = [__v_25, __v_9, __v_24]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_27: G = G::from_u64(0);
-    let __v_28: G = G::from_u64(48);
-    let __v_29: G = { let __values: [G; 3] = [__v_27, __v_28, __v_0]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_30: G = { let __values: [G; 3] = [__v_25, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_31: G = { let __values: [G; 3] = [__v_23, __v_24, __v_30]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_32: G = { let __values: [G; 3] = [__v_21, __v_22, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_33: G = { let __values: [G; 3] = [__v_19, __v_20, __v_32]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_34: G = { let __values: [G; 3] = [__v_17, __v_18, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_35: G = { let __values: [G; 3] = [__v_15, __v_16, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_36: G = { let __values: [G; 3] = [__v_13, __v_14, __v_35]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_37: G = { let __values: [G; 3] = [__v_11, __v_12, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_38: G = { let __values: [G; 3] = [__v_9, __v_10, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_39: G = { let __values: [G; 3] = [__v_7, __v_8, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_40: G = { let __values: [G; 3] = [__v_5, __v_6, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_41: G = { let __values: [G; 3] = [__v_3, __v_4, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_42: G = { let __values: [G; 3] = [__v_1, __v_2, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __ret: [G; OUT_173] = [__v_42];
-    record.function_queries[173].finish(&inp[..], &__ret[..], !unconstrained);
-    return Ok(__ret);
-  })
-}
+    let __v_28: G = { let __values: [G; 3] = [__v_27, __v_8, __v_26]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = G::from_u64(0);
+    let __v_30: G = { let __values: [G; 3] = [__v_29, __v_7, __v_28]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_31: G = G::from_u64(0);
+    let __v_32: G = { let __values: [G; 3] = [__v_31, __v_6, __v_30]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_33: G = G::from_u64(0);
+    let __v_34: G = { let __values: [G; 3] = [__v_33, __v_5, __v_32]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_35: G = G::from_u64(0);
+    let __v_36: G = { let __values: [G; 3] = [__v_35, __v_4, __v_34]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_37: G = G::from_u64(0);
+    let __v_38: G = { let __values: [G; 3] = [__v_37, __v_3, __v_36]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_39: G = G::from_u64(0);
+    let __v_40: G = { let __values: [G; 3] = [__v_39, __v_2, __v_38]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_41: G = G::from_u64(0);
+    let __v_42: G = { let __values: [G; 3] = [__v_41, __v_1, __v_40]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __ret: [G; OUT_173] = [__v_42];
+    record.function_queries[173].finish(&inp[..], &__ret[..], !unconstrained);
+    return Ok(__ret);
+  })
+}
 
 const INPUT_SIZE_174: usize = 2;
 const IN_174: usize = 2;
@@ -16242,48 +16242,48 @@ fn aiur_fn_176(
     let __v_12: G = __r_arr[0];
     let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_0, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
     let __v_13: G = __r_arr[0];
-    let __v_14: G = G::from_u64(0);
-    let __v_15: G = G::from_u64(109);
-    let __v_16: G = G::from_u64(0);
-    let __v_17: G = G::from_u64(117);
-    let __v_18: G = G::from_u64(0);
-    let __v_19: G = G::from_u64(108);
-    let __v_20: G = G::from_u64(0);
+    let __v_14: G = G::from_u64(109);
+    let __v_15: G = G::from_u64(117);
+    let __v_16: G = G::from_u64(108);
+    let __v_17: G = G::from_u64(116);
+    let __v_18: G = G::from_u64(105);
+    let __v_19: G = G::from_u64(45);
+    let __v_20: G = G::from_u64(115);
     let __v_21: G = G::from_u64(116);
-    let __v_22: G = G::from_u64(0);
-    let __v_23: G = G::from_u64(105);
-    let __v_24: G = G::from_u64(0);
-    let __v_25: G = G::from_u64(45);
-    let __v_26: G = G::from_u64(0);
-    let __v_27: G = G::from_u64(115);
+    let __v_22: G = G::from_u64(97);
+    let __v_23: G = G::from_u64(114);
+    let __v_24: G = G::from_u64(107);
+    let __v_25: G = G::from_u64(47);
+    let __v_26: G = G::from_u64(118);
+    let __v_27: G = G::from_u64(48);
     let __v_28: G = G::from_u64(0);
-    let __v_29: G = G::from_u64(116);
+    let __v_29: G = { let __values: [G; 3] = [__v_28, __v_27, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_30: G = G::from_u64(0);
-    let __v_31: G = G::from_u64(97);
+    let __v_31: G = { let __values: [G; 3] = [__v_30, __v_26, __v_29]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_32: G = G::from_u64(0);
-    let __v_33: G = G::from_u64(114);
+    let __v_33: G = { let __values: [G; 3] = [__v_32, __v_25, __v_31]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_34: G = G::from_u64(0);
-    let __v_35: G = G::from_u64(107);
+    let __v_35: G = { let __values: [G; 3] = [__v_34, __v_24, __v_33]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_36: G = G::from_u64(0);
-    let __v_37: G = G::from_u64(47);
+    let __v_37: G = { let __values: [G; 3] = [__v_36, __v_23, __v_35]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_38: G = G::from_u64(0);
-    let __v_39: G = G::from_u64(118);
+    let __v_39: G = { let __values: [G; 3] = [__v_38, __v_22, __v_37]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_40: G = G::from_u64(0);
-    let __v_41: G = G::from_u64(48);
-    let __v_42: G = { let __values: [G; 3] = [__v_40, __v_41, __v_13]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_43: G = { let __values: [G; 3] = [__v_38, __v_39, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_44: G = { let __values: [G; 3] = [__v_36, __v_37, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_45: G = { let __values: [G; 3] = [__v_34, __v_35, __v_44]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_46: G = { let __values: [G; 3] = [__v_32, __v_33, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_47: G = { let __values: [G; 3] = [__v_30, __v_31, __v_46]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_48: G = { let __values: [G; 3] = [__v_28, __v_29, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_49: G = { let __values: [G; 3] = [__v_26, __v_27, __v_48]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_50: G = { let __values: [G; 3] = [__v_24, __v_25, __v_49]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_51: G = { let __values: [G; 3] = [__v_22, __v_23, __v_50]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_52: G = { let __values: [G; 3] = [__v_20, __v_21, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_53: G = { let __values: [G; 3] = [__v_18, __v_19, __v_52]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_54: G = { let __values: [G; 3] = [__v_16, __v_17, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_55: G = { let __values: [G; 3] = [__v_14, __v_15, __v_54]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_41: G = { let __values: [G; 3] = [__v_40, __v_21, __v_39]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_42: G = G::from_u64(0);
+    let __v_43: G = { let __values: [G; 3] = [__v_42, __v_20, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_44: G = G::from_u64(0);
+    let __v_45: G = { let __values: [G; 3] = [__v_44, __v_19, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_46: G = G::from_u64(0);
+    let __v_47: G = { let __values: [G; 3] = [__v_46, __v_18, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_48: G = G::from_u64(0);
+    let __v_49: G = { let __values: [G; 3] = [__v_48, __v_17, __v_47]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_50: G = G::from_u64(0);
+    let __v_51: G = { let __values: [G; 3] = [__v_50, __v_16, __v_49]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_52: G = G::from_u64(0);
+    let __v_53: G = { let __values: [G; 3] = [__v_52, __v_15, __v_51]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_54: G = G::from_u64(0);
+    let __v_55: G = { let __values: [G; 3] = [__v_54, __v_14, __v_53]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_56: G = G::from_u64(1);
     let __v_57: G = G::from_u64(1);
     let __v_58: G = { let __values: [G; 3] = [__v_56, __v_57, __v_57]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
@@ -17020,13 +17020,13 @@ fn aiur_fn_185(
         let __v_8: G = __loaded[3];
         match __v_5.as_canonical_u64() {
           0u64 => {
-            let __v_9: G = G::from_u64(0);
             let __r_arr: [G; OUT_184] = { let __args: [G; IN_184] = [__v_2, __v_3, __v_6, __v_7]; let __cu = unconstrained; let __hit = record.function_queries[184].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[184].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[184].bump_multiplicity(__i); } let __ret: [G; OUT_184] = unsafe { *(record.function_queries[184].output_at(__i).as_ptr() as *const [G; OUT_184]) }; __ret }, _ => aiur_fn_184(__args, record, io_buffer, __cu)? } };
-            let __v_10: G = __r_arr[0];
-            let __v_11: G = __r_arr[1];
+            let __v_9: G = __r_arr[0];
+            let __v_10: G = __r_arr[1];
             let __r_arr: [G; OUT_185] = { let __args: [G; IN_185] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[185].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[185].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[185].bump_multiplicity(__i); } let __ret: [G; OUT_185] = unsafe { *(record.function_queries[185].output_at(__i).as_ptr() as *const [G; OUT_185]) }; __ret }, _ => aiur_fn_185(__args, record, io_buffer, __cu)? } };
-            let __v_12: G = __r_arr[0];
-            let __v_13: G = { let __values: [G; 4] = [__v_9, __v_10, __v_11, __v_12]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_11: G = __r_arr[0];
+            let __v_12: G = G::from_u64(0);
+            let __v_13: G = { let __values: [G; 4] = [__v_12, __v_9, __v_10, __v_11]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_185] = [__v_13];
             record.function_queries[185].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -17325,27 +17325,27 @@ fn aiur_fn_188(
     let __v_31: G = (__v_16 * __v_25);
     let __v_32: G = (__v_17 * __v_22);
     let __v_33: G = (__v_31 + __v_32);
-    let __v_34: G = (__v_0 * __v_6);
-    let __v_35: G = G::from_u64(7);
-    let __v_36: G = (__v_1 * __v_7);
-    let __v_37: G = (__v_35 * __v_36);
-    let __v_38: G = (__v_34 + __v_37);
-    let __v_39: G = (__v_0 * __v_7);
-    let __v_40: G = (__v_1 * __v_6);
-    let __v_41: G = (__v_39 + __v_40);
-    let __v_42: G = (__v_2 * __v_4);
-    let __v_43: G = G::from_u64(7);
-    let __v_44: G = (__v_3 * __v_5);
-    let __v_45: G = (__v_43 * __v_44);
-    let __v_46: G = (__v_42 + __v_45);
-    let __v_47: G = (__v_2 * __v_5);
-    let __v_48: G = (__v_3 * __v_4);
-    let __v_49: G = (__v_47 + __v_48);
-    let __v_50: G = (__v_12 + __v_30);
-    let __v_51: G = (__v_15 + __v_33);
-    let __v_52: G = (__v_38 + __v_46);
-    let __v_53: G = (__v_41 + __v_49);
-    let __ret: [G; OUT_188] = [__v_50, __v_51, __v_52, __v_53];
+    let __v_34: G = (__v_12 + __v_30);
+    let __v_35: G = (__v_15 + __v_33);
+    let __v_36: G = (__v_0 * __v_6);
+    let __v_37: G = G::from_u64(7);
+    let __v_38: G = (__v_1 * __v_7);
+    let __v_39: G = (__v_37 * __v_38);
+    let __v_40: G = (__v_36 + __v_39);
+    let __v_41: G = (__v_0 * __v_7);
+    let __v_42: G = (__v_1 * __v_6);
+    let __v_43: G = (__v_41 + __v_42);
+    let __v_44: G = (__v_2 * __v_4);
+    let __v_45: G = G::from_u64(7);
+    let __v_46: G = (__v_3 * __v_5);
+    let __v_47: G = (__v_45 * __v_46);
+    let __v_48: G = (__v_44 + __v_47);
+    let __v_49: G = (__v_2 * __v_5);
+    let __v_50: G = (__v_3 * __v_4);
+    let __v_51: G = (__v_49 + __v_50);
+    let __v_52: G = (__v_40 + __v_48);
+    let __v_53: G = (__v_43 + __v_51);
+    let __ret: [G; OUT_188] = [__v_34, __v_35, __v_52, __v_53];
     record.function_queries[188].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -17854,25 +17854,25 @@ fn aiur_fn_192(
     let __v_13: G = G::from_u64(0);
     let __v_14: G = G::from_u64(0);
     let __v_15: G = G::from_u64(0);
-    let __v_16: G = G::from_u64(0);
-    let __v_17: G = G::from_u64(0);
-    let __v_18: G = G::from_u64(0);
+    let __v_16: G = G::from_u64(1);
+    let __v_17: G = G::from_u64(1);
+    let __v_18: G = { let __values: [G; 4] = [__v_16, __v_17, __v_17, __v_17]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_19: G = G::from_u64(0);
-    let __v_20: G = G::from_u64(0);
+    let __v_20: G = { let __values: [G; 4] = [__v_19, __v_7, __v_15, __v_18]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_21: G = G::from_u64(0);
-    let __v_22: G = G::from_u64(0);
+    let __v_22: G = { let __values: [G; 4] = [__v_21, __v_6, __v_14, __v_20]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_23: G = G::from_u64(0);
-    let __v_24: G = G::from_u64(1);
-    let __v_25: G = G::from_u64(1);
-    let __v_26: G = { let __values: [G; 4] = [__v_24, __v_25, __v_25, __v_25]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_27: G = { let __values: [G; 4] = [__v_22, __v_7, __v_23, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_28: G = { let __values: [G; 4] = [__v_20, __v_6, __v_21, __v_27]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_29: G = { let __values: [G; 4] = [__v_18, __v_5, __v_19, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_30: G = { let __values: [G; 4] = [__v_16, __v_4, __v_17, __v_29]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_31: G = { let __values: [G; 4] = [__v_14, __v_3, __v_15, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_32: G = { let __values: [G; 4] = [__v_12, __v_2, __v_13, __v_31]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_33: G = { let __values: [G; 4] = [__v_10, __v_1, __v_11, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_34: G = { let __values: [G; 4] = [__v_8, __v_0, __v_9, __v_33]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_24: G = { let __values: [G; 4] = [__v_23, __v_5, __v_13, __v_22]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_25: G = G::from_u64(0);
+    let __v_26: G = { let __values: [G; 4] = [__v_25, __v_4, __v_12, __v_24]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_27: G = G::from_u64(0);
+    let __v_28: G = { let __values: [G; 4] = [__v_27, __v_3, __v_11, __v_26]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_29: G = G::from_u64(0);
+    let __v_30: G = { let __values: [G; 4] = [__v_29, __v_2, __v_10, __v_28]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_31: G = G::from_u64(0);
+    let __v_32: G = { let __values: [G; 4] = [__v_31, __v_1, __v_9, __v_30]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_33: G = G::from_u64(0);
+    let __v_34: G = { let __values: [G; 4] = [__v_33, __v_0, __v_8, __v_32]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __ret: [G; OUT_192] = [__v_34];
     record.function_queries[192].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -18185,61 +18185,67 @@ fn aiur_fn_196(
           _ => {
             let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_2, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
             let __v_28: G = __r_arr[0];
+            let __v_29: G = G::from_u64(32);
+            let __v_30: G = if unconstrained { Bytes2::less_than(&__v_28, &__v_29) } else { bytes2_less_than_value(__v_28, __v_29, record) };
+            let __v_31: G = G::from_u64(1);
+            if (__v_30 != __v_31) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_30.as_canonical_u64(), rhs: __v_31.as_canonical_u64(), msg: None });
+            }
             let __r_arr: [G; OUT_194] = { let __args: [G; IN_194] = [__v_24]; let __cu = unconstrained; let __hit = record.function_queries[194].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[194].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[194].bump_multiplicity(__i); } let __ret: [G; OUT_194] = unsafe { *(record.function_queries[194].output_at(__i).as_ptr() as *const [G; OUT_194]) }; __ret }, _ => aiur_fn_194(__args, record, io_buffer, __cu)? } };
-            let __v_29: G = __r_arr[0];
+            let __v_32: G = __r_arr[0];
             let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_3, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
-            let __v_30: G = __r_arr[0];
-            let __v_31: G = __r_arr[1];
+            let __v_33: G = __r_arr[0];
+            let __v_34: G = __r_arr[1];
             let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_4, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_32: G = __r_arr[0];
-            let __v_33: G = G::from_u64(0);
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_34: G = __r_arr[0];
-            let __v_35: G = G::from_u64(1);
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_32, __v_35]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_36: G = __r_arr[0];
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_5, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __v_35: G = __r_arr[0];
+            let __v_36: G = G::from_u64(0);
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_35, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
             let __v_37: G = __r_arr[0];
-            let __v_38: G = G::from_u64(0);
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_37, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __v_38: G = G::from_u64(1);
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_35, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
             let __v_39: G = __r_arr[0];
-            let __v_40: G = G::from_u64(1);
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_37, __v_40]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_41: G = __r_arr[0];
-            let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_5, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __v_40: G = __r_arr[0];
+            let __v_41: G = G::from_u64(0);
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_40, __v_41]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
             let __v_42: G = __r_arr[0];
-            let __v_43: G = __r_arr[1];
-            let __mc_out___mc_0: [G; 2] = '__mc_0: { match __v_42.as_canonical_u64() {
+            let __v_43: G = G::from_u64(1);
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_40, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __v_44: G = __r_arr[0];
+            let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_1, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+            let __v_45: G = __r_arr[0];
+            let __v_46: G = __r_arr[1];
+            let __mc_out___mc_0: [G; 2] = '__mc_0: { match __v_45.as_canonical_u64() {
   0u64 => {
-    let __v_44: G = G::from_u64(1);
-    let __v_45: G = G::from_u64(1);
-    let __v_46: G = { let __values: [G; 4] = [__v_44, __v_45, __v_45, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_47: G = G::from_u64(1);
     let __v_48: G = G::from_u64(1);
     let __v_49: G = { let __values: [G; 4] = [__v_47, __v_48, __v_48, __v_48]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_0 [__v_46, __v_49];
+    let __v_50: G = G::from_u64(1);
+    let __v_51: G = G::from_u64(1);
+    let __v_52: G = { let __values: [G; 4] = [__v_50, __v_51, __v_51, __v_51]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_49, __v_52];
   },
   1u64 => {
     match __v_6.as_canonical_u64() {
       0u64 => {
-        let __v_44: G = G::from_u64(1);
-        let __v_45: G = G::from_u64(1);
-        let __v_46: G = { let __values: [G; 4] = [__v_44, __v_45, __v_45, __v_45]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __v_47: G = G::from_u64(1);
         let __v_48: G = G::from_u64(1);
         let __v_49: G = { let __values: [G; 4] = [__v_47, __v_48, __v_48, __v_48]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        break '__mc_0 [__v_46, __v_49];
+        let __v_50: G = G::from_u64(1);
+        let __v_51: G = G::from_u64(1);
+        let __v_52: G = { let __values: [G; 4] = [__v_50, __v_51, __v_51, __v_51]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        break '__mc_0 [__v_49, __v_52];
       },
       1u64 => {
-        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_7, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-        let __v_44: G = __r_arr[0];
-        let __v_45: G = G::from_u64(0);
-        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-        let __v_46: G = __r_arr[0];
-        let __v_47: G = G::from_u64(1);
-        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_44, __v_47]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-        let __v_48: G = __r_arr[0];
-        break '__mc_0 [__v_46, __v_48];
+        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_7, __v_46]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+        let __v_47: G = __r_arr[0];
+        let __v_48: G = G::from_u64(0);
+        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_47, __v_48]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+        let __v_49: G = __r_arr[0];
+        let __v_50: G = G::from_u64(1);
+        let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_47, __v_50]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+        let __v_51: G = __r_arr[0];
+        break '__mc_0 [__v_49, __v_51];
       },
       _ => {
         return Err(ExecError::MatchNoCase(__v_6.as_canonical_u64()));
@@ -18247,133 +18253,130 @@ fn aiur_fn_196(
     }
   },
   _ => {
-    return Err(ExecError::MatchNoCase(__v_42.as_canonical_u64()));
+    return Err(ExecError::MatchNoCase(__v_45.as_canonical_u64()));
   },
 }
  };
-            let __v_44: G = __mc_out___mc_0[0];
-            let __v_45: G = __mc_out___mc_0[1];
+            let __v_47: G = __mc_out___mc_0[0];
+            let __v_48: G = __mc_out___mc_0[1];
             let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = [__v_18, __v_19, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
-            let __v_46: G = __r_arr[0];
-            let __v_47: G = __r_arr[1];
-            let __v_48: G = G::from_u64(1);
-            let __v_49: G = G::from_u64(0);
-            let __v_50: G = (__v_46 - __v_48);
-            let __v_51: G = (__v_47 - __v_49);
+            let __v_49: G = __r_arr[0];
+            let __v_50: G = __r_arr[1];
+            let __v_51: G = G::from_u64(1);
+            let __v_52: G = G::from_u64(0);
+            let __v_53: G = (__v_49 - __v_51);
+            let __v_54: G = (__v_50 - __v_52);
             let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
-            let __v_52: G = __r_arr[0];
-            let __v_53: G = g_inverse_value(__v_52);
-            let __v_54: G = (__v_52 * __v_53);
-            let __v_55: G = G::from_u64(1);
-            let __v_56: G = (__v_54 - __v_55);
-            let __v_57: G = (__v_52 * __v_56);
-            let __v_58: G = G::from_u64(0);
-            if (__v_57 != __v_58) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_57.as_canonical_u64(), rhs: __v_58.as_canonical_u64(), msg: None });
+            let __v_55: G = __r_arr[0];
+            let __v_56: G = g_inverse_value(__v_55);
+            let __v_57: G = (__v_55 * __v_56);
+            let __v_58: G = G::from_u64(1);
+            let __v_59: G = (__v_57 - __v_58);
+            let __v_60: G = (__v_55 * __v_59);
+            let __v_61: G = G::from_u64(0);
+            if (__v_60 != __v_61) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_60.as_canonical_u64(), rhs: __v_61.as_canonical_u64(), msg: None });
             }
-            let __v_59: G = (__v_53 * __v_56);
-            let __v_60: G = G::from_u64(0);
-            if (__v_59 != __v_60) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_59.as_canonical_u64(), rhs: __v_60.as_canonical_u64(), msg: None });
+            let __v_62: G = (__v_56 * __v_59);
+            let __v_63: G = G::from_u64(0);
+            if (__v_62 != __v_63) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_62.as_canonical_u64(), rhs: __v_63.as_canonical_u64(), msg: None });
             }
-            let __v_61: G = G::from_u64(1);
-            let __v_62: G = G::from_u64(0);
-            let __v_63: G = (__v_18 - __v_61);
-            let __v_64: G = (__v_19 - __v_62);
-            let __v_65: G = (__v_63 * __v_63);
-            let __v_66: G = G::from_u64(7);
-            let __v_67: G = (__v_64 * __v_64);
-            let __v_68: G = (__v_66 * __v_67);
-            let __v_69: G = (__v_65 - __v_68);
-            let __v_70: G = g_inverse_value(__v_69);
+            let __v_64: G = G::from_u64(1);
+            let __v_65: G = G::from_u64(0);
+            let __v_66: G = (__v_18 - __v_64);
+            let __v_67: G = (__v_19 - __v_65);
+            let __v_68: G = (__v_66 * __v_66);
+            let __v_69: G = G::from_u64(7);
+            let __v_70: G = (__v_67 * __v_67);
             let __v_71: G = (__v_69 * __v_70);
-            let __v_72: G = G::from_u64(1);
-            let __v_73: G = (__v_71 - __v_72);
-            let __v_74: G = (__v_69 * __v_73);
-            let __v_75: G = G::from_u64(0);
-            if (__v_74 != __v_75) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_74.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
+            let __v_72: G = (__v_68 - __v_71);
+            let __v_73: G = g_inverse_value(__v_72);
+            let __v_74: G = (__v_72 * __v_73);
+            let __v_75: G = G::from_u64(1);
+            let __v_76: G = (__v_74 - __v_75);
+            let __v_77: G = (__v_72 * __v_76);
+            let __v_78: G = G::from_u64(0);
+            if (__v_77 != __v_78) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_78.as_canonical_u64(), msg: None });
             }
-            let __v_76: G = (__v_70 * __v_73);
-            let __v_77: G = G::from_u64(0);
-            if (__v_76 != __v_77) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_77.as_canonical_u64(), msg: None });
+            let __v_79: G = (__v_73 * __v_76);
+            let __v_80: G = G::from_u64(0);
+            if (__v_79 != __v_80) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_79.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
             }
-            let __v_78: G = (__v_63 * __v_70);
-            let __v_79: G = G::from_u64(0);
-            let __v_80: G = (__v_79 - __v_64);
-            let __v_81: G = (__v_80 * __v_70);
-            let __v_82: G = (__v_50 * __v_78);
-            let __v_83: G = G::from_u64(7);
-            let __v_84: G = (__v_51 * __v_81);
-            let __v_85: G = (__v_83 * __v_84);
-            let __v_86: G = (__v_82 + __v_85);
-            let __v_87: G = (__v_50 * __v_81);
-            let __v_88: G = (__v_51 * __v_78);
-            let __v_89: G = (__v_87 + __v_88);
-            let __v_90: G = G::from_u64(0);
-            let __v_91: G = (__v_18 - __v_53);
-            let __v_92: G = (__v_19 - __v_90);
-            let __v_93: G = (__v_91 * __v_91);
-            let __v_94: G = G::from_u64(7);
-            let __v_95: G = (__v_92 * __v_92);
-            let __v_96: G = (__v_94 * __v_95);
-            let __v_97: G = (__v_93 - __v_96);
-            let __v_98: G = g_inverse_value(__v_97);
+            let __v_81: G = (__v_66 * __v_73);
+            let __v_82: G = G::from_u64(0);
+            let __v_83: G = (__v_82 - __v_67);
+            let __v_84: G = (__v_83 * __v_73);
+            let __v_85: G = (__v_53 * __v_81);
+            let __v_86: G = G::from_u64(7);
+            let __v_87: G = (__v_54 * __v_84);
+            let __v_88: G = (__v_86 * __v_87);
+            let __v_89: G = (__v_85 + __v_88);
+            let __v_90: G = (__v_53 * __v_84);
+            let __v_91: G = (__v_54 * __v_81);
+            let __v_92: G = (__v_90 + __v_91);
+            let __v_93: G = G::from_u64(0);
+            let __v_94: G = (__v_18 - __v_56);
+            let __v_95: G = (__v_19 - __v_93);
+            let __v_96: G = (__v_94 * __v_94);
+            let __v_97: G = G::from_u64(7);
+            let __v_98: G = (__v_95 * __v_95);
             let __v_99: G = (__v_97 * __v_98);
-            let __v_100: G = G::from_u64(1);
-            let __v_101: G = (__v_99 - __v_100);
-            let __v_102: G = (__v_97 * __v_101);
-            let __v_103: G = G::from_u64(0);
-            if (__v_102 != __v_103) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_102.as_canonical_u64(), rhs: __v_103.as_canonical_u64(), msg: None });
+            let __v_100: G = (__v_96 - __v_99);
+            let __v_101: G = g_inverse_value(__v_100);
+            let __v_102: G = (__v_100 * __v_101);
+            let __v_103: G = G::from_u64(1);
+            let __v_104: G = (__v_102 - __v_103);
+            let __v_105: G = (__v_100 * __v_104);
+            let __v_106: G = G::from_u64(0);
+            if (__v_105 != __v_106) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_105.as_canonical_u64(), rhs: __v_106.as_canonical_u64(), msg: None });
             }
-            let __v_104: G = (__v_98 * __v_101);
-            let __v_105: G = G::from_u64(0);
-            if (__v_104 != __v_105) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_104.as_canonical_u64(), rhs: __v_105.as_canonical_u64(), msg: None });
+            let __v_107: G = (__v_101 * __v_104);
+            let __v_108: G = G::from_u64(0);
+            if (__v_107 != __v_108) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_107.as_canonical_u64(), rhs: __v_108.as_canonical_u64(), msg: None });
             }
-            let __v_106: G = (__v_91 * __v_98);
-            let __v_107: G = G::from_u64(0);
-            let __v_108: G = (__v_107 - __v_92);
-            let __v_109: G = (__v_108 * __v_98);
-            let __v_110: G = (__v_50 * __v_106);
-            let __v_111: G = G::from_u64(7);
-            let __v_112: G = (__v_51 * __v_109);
-            let __v_113: G = (__v_111 * __v_112);
-            let __v_114: G = (__v_110 + __v_113);
-            let __v_115: G = (__v_50 * __v_109);
-            let __v_116: G = (__v_51 * __v_106);
-            let __v_117: G = (__v_115 + __v_116);
-            let __v_118: G = G::from_u64(0);
-            let __v_119: G = (__v_18 - __v_53);
-            let __v_120: G = (__v_19 - __v_118);
-            let __v_121: G = (__v_50 * __v_50);
-            let __v_122: G = G::from_u64(7);
-            let __v_123: G = (__v_51 * __v_51);
-            let __v_124: G = (__v_122 * __v_123);
-            let __v_125: G = (__v_121 - __v_124);
-            let __v_126: G = g_inverse_value(__v_125);
+            let __v_109: G = (__v_94 * __v_101);
+            let __v_110: G = G::from_u64(0);
+            let __v_111: G = (__v_110 - __v_95);
+            let __v_112: G = (__v_111 * __v_101);
+            let __v_113: G = (__v_53 * __v_109);
+            let __v_114: G = G::from_u64(7);
+            let __v_115: G = (__v_54 * __v_112);
+            let __v_116: G = (__v_114 * __v_115);
+            let __v_117: G = (__v_113 + __v_116);
+            let __v_118: G = (__v_53 * __v_112);
+            let __v_119: G = (__v_54 * __v_109);
+            let __v_120: G = (__v_118 + __v_119);
+            let __v_121: G = G::from_u64(0);
+            let __v_122: G = (__v_18 - __v_56);
+            let __v_123: G = (__v_19 - __v_121);
+            let __v_124: G = (__v_53 * __v_53);
+            let __v_125: G = G::from_u64(7);
+            let __v_126: G = (__v_54 * __v_54);
             let __v_127: G = (__v_125 * __v_126);
-            let __v_128: G = G::from_u64(1);
-            let __v_129: G = (__v_127 - __v_128);
-            let __v_130: G = (__v_125 * __v_129);
-            let __v_131: G = G::from_u64(0);
-            if (__v_130 != __v_131) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_130.as_canonical_u64(), rhs: __v_131.as_canonical_u64(), msg: None });
+            let __v_128: G = (__v_124 - __v_127);
+            let __v_129: G = g_inverse_value(__v_128);
+            let __v_130: G = (__v_128 * __v_129);
+            let __v_131: G = G::from_u64(1);
+            let __v_132: G = (__v_130 - __v_131);
+            let __v_133: G = (__v_128 * __v_132);
+            let __v_134: G = G::from_u64(0);
+            if (__v_133 != __v_134) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_133.as_canonical_u64(), rhs: __v_134.as_canonical_u64(), msg: None });
             }
-            let __v_132: G = (__v_126 * __v_129);
-            let __v_133: G = G::from_u64(0);
-            if (__v_132 != __v_133) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_132.as_canonical_u64(), rhs: __v_133.as_canonical_u64(), msg: None });
+            let __v_135: G = (__v_129 * __v_132);
+            let __v_136: G = G::from_u64(0);
+            if (__v_135 != __v_136) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_135.as_canonical_u64(), rhs: __v_136.as_canonical_u64(), msg: None });
             }
-            let __v_134: G = (__v_50 * __v_126);
-            let __v_135: G = G::from_u64(0);
-            let __v_136: G = (__v_135 - __v_51);
-            let __v_137: G = (__v_136 * __v_126);
+            let __v_137: G = (__v_53 * __v_129);
             let __v_138: G = G::from_u64(0);
-            let __v_139: G = G::from_u64(0);
-            let __v_140: G = G::from_u64(0);
+            let __v_139: G = (__v_138 - __v_54);
+            let __v_140: G = (__v_139 * __v_129);
             let __v_141: G = G::from_u64(0);
             let __v_142: G = G::from_u64(0);
             let __v_143: G = G::from_u64(0);
@@ -18382,196 +18385,193 @@ fn aiur_fn_196(
             let __v_146: G = G::from_u64(0);
             let __v_147: G = G::from_u64(0);
             let __v_148: G = G::from_u64(0);
-            let __v_149: G = G::from_u64(0);
-            let __v_150: G = G::from_u64(0);
-            let __v_151: G = G::from_u64(0);
+            let __v_149: G = G::from_u64(1);
+            let __v_150: G = G::from_u64(1);
+            let __v_151: G = { let __values: [G; 4] = [__v_149, __v_150, __v_150, __v_150]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __v_152: G = G::from_u64(0);
-            let __v_153: G = G::from_u64(0);
-            let __v_154: G = G::from_u64(1);
-            let __v_155: G = G::from_u64(1);
-            let __v_156: G = { let __values: [G; 4] = [__v_154, __v_155, __v_155, __v_155]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_157: G = { let __values: [G; 4] = [__v_152, __v_31, __v_153, __v_156]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_158: G = { let __values: [G; 4] = [__v_150, __v_30, __v_151, __v_157]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_159: G = { let __values: [G; 4] = [__v_148, __v_11, __v_149, __v_158]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_160: G = { let __values: [G; 4] = [__v_146, __v_10, __v_147, __v_159]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_161: G = { let __values: [G; 4] = [__v_144, __v_15, __v_145, __v_160]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_162: G = { let __values: [G; 4] = [__v_142, __v_14, __v_143, __v_161]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_163: G = { let __values: [G; 4] = [__v_140, __v_13, __v_141, __v_162]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_164: G = { let __values: [G; 4] = [__v_138, __v_12, __v_139, __v_163]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_153: G = { let __values: [G; 4] = [__v_152, __v_34, __v_148, __v_151]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_154: G = G::from_u64(0);
+            let __v_155: G = { let __values: [G; 4] = [__v_154, __v_33, __v_147, __v_153]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_156: G = G::from_u64(0);
+            let __v_157: G = { let __values: [G; 4] = [__v_156, __v_11, __v_146, __v_155]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_158: G = G::from_u64(0);
+            let __v_159: G = { let __values: [G; 4] = [__v_158, __v_10, __v_145, __v_157]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_160: G = G::from_u64(0);
+            let __v_161: G = { let __values: [G; 4] = [__v_160, __v_15, __v_144, __v_159]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_162: G = G::from_u64(0);
+            let __v_163: G = { let __values: [G; 4] = [__v_162, __v_14, __v_143, __v_161]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_164: G = G::from_u64(0);
+            let __v_165: G = { let __values: [G; 4] = [__v_164, __v_13, __v_142, __v_163]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_166: G = G::from_u64(0);
+            let __v_167: G = { let __values: [G; 4] = [__v_166, __v_12, __v_141, __v_165]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __r_arr: [G; OUT_180] = { let __args: [G; IN_180] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[180].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[180].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[180].bump_multiplicity(__i); } let __ret: [G; OUT_180] = unsafe { *(record.function_queries[180].output_at(__i).as_ptr() as *const [G; OUT_180]) }; __ret }, _ => aiur_fn_180(__args, record, io_buffer, __cu)? } };
-            let __v_165: G = __r_arr[0];
+            let __v_168: G = __r_arr[0];
             let __r_arr: [G; OUT_178] = { let __args: [G; IN_178] = [__v_28]; let __cu = unconstrained; let __hit = record.function_queries[178].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[178].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[178].bump_multiplicity(__i); } let __ret: [G; OUT_178] = unsafe { *(record.function_queries[178].output_at(__i).as_ptr() as *const [G; OUT_178]) }; __ret }, _ => aiur_fn_178(__args, record, io_buffer, __cu)? } };
-            let __v_166: G = __r_arr[0];
-            let __v_167: G = (__v_165 * __v_166);
-            let __v_168: G = g_inverse_value(__v_167);
-            let __v_169: G = (__v_167 * __v_168);
-            let __v_170: G = G::from_u64(1);
-            let __v_171: G = (__v_169 - __v_170);
-            let __v_172: G = (__v_167 * __v_171);
-            let __v_173: G = G::from_u64(0);
-            if (__v_172 != __v_173) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_172.as_canonical_u64(), rhs: __v_173.as_canonical_u64(), msg: None });
+            let __v_169: G = __r_arr[0];
+            let __v_170: G = (__v_168 * __v_169);
+            let __v_171: G = g_inverse_value(__v_170);
+            let __v_172: G = (__v_170 * __v_171);
+            let __v_173: G = G::from_u64(1);
+            let __v_174: G = (__v_172 - __v_173);
+            let __v_175: G = (__v_170 * __v_174);
+            let __v_176: G = G::from_u64(0);
+            if (__v_175 != __v_176) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_175.as_canonical_u64(), rhs: __v_176.as_canonical_u64(), msg: None });
             }
-            let __v_174: G = (__v_168 * __v_171);
-            let __v_175: G = G::from_u64(0);
-            if (__v_174 != __v_175) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_174.as_canonical_u64(), rhs: __v_175.as_canonical_u64(), msg: None });
+            let __v_177: G = (__v_171 * __v_174);
+            let __v_178: G = G::from_u64(0);
+            if (__v_177 != __v_178) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_178.as_canonical_u64(), msg: None });
             }
-            let __v_176: G = G::from_u64(0);
-            let __v_177: G = G::from_u64(0);
-            let __r_arr: [G; OUT_187] = { let __args: [G; IN_187] = [__v_176, __v_177, __v_16, __v_17, __v_23, __v_21, __v_34, __v_36, __v_44, __v_45, __v_39, __v_41, __v_164, __v_86, __v_89, __v_114, __v_117, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[187].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[187].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[187].bump_multiplicity(__i); } let __ret: [G; OUT_187] = unsafe { *(record.function_queries[187].output_at(__i).as_ptr() as *const [G; OUT_187]) }; __ret }, _ => aiur_fn_187(__args, record, io_buffer, __cu)? } };
-            let __v_178: G = __r_arr[0];
-            let __v_179: G = __r_arr[1];
+            let __v_179: G = G::from_u64(0);
             let __v_180: G = G::from_u64(0);
-            let __v_181: G = G::from_u64(0);
-            let __v_182: G = G::from_u64(0);
+            let __r_arr: [G; OUT_187] = { let __args: [G; IN_187] = [__v_179, __v_180, __v_16, __v_17, __v_23, __v_21, __v_37, __v_39, __v_47, __v_48, __v_42, __v_44, __v_167, __v_89, __v_92, __v_117, __v_120, __v_122, __v_123]; let __cu = unconstrained; let __hit = record.function_queries[187].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[187].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[187].bump_multiplicity(__i); } let __ret: [G; OUT_187] = unsafe { *(record.function_queries[187].output_at(__i).as_ptr() as *const [G; OUT_187]) }; __ret }, _ => aiur_fn_187(__args, record, io_buffer, __cu)? } };
+            let __v_181: G = __r_arr[0];
+            let __v_182: G = __r_arr[1];
             let __v_183: G = G::from_u64(0);
             let __v_184: G = G::from_u64(0);
             let __v_185: G = G::from_u64(0);
             let __v_186: G = G::from_u64(0);
             let __v_187: G = G::from_u64(0);
-            let __v_188: G = (__v_30 - __v_10);
-            let __v_189: G = (__v_186 - __v_184);
+            let __v_188: G = G::from_u64(0);
+            let __v_189: G = G::from_u64(0);
             let __v_190: G = G::from_u64(0);
-            let __v_191: G = (__v_188 * __v_168);
-            let __v_192: G = G::from_u64(7);
-            let __v_193: G = (__v_189 * __v_190);
-            let __v_194: G = (__v_192 * __v_193);
-            let __v_195: G = (__v_191 + __v_194);
-            let __v_196: G = (__v_188 * __v_190);
-            let __v_197: G = (__v_189 * __v_168);
-            let __v_198: G = (__v_196 + __v_197);
-            let __v_199: G = (__v_114 * __v_195);
-            let __v_200: G = G::from_u64(7);
-            let __v_201: G = (__v_117 * __v_198);
-            let __v_202: G = (__v_200 * __v_201);
-            let __v_203: G = (__v_199 + __v_202);
-            let __v_204: G = (__v_114 * __v_198);
-            let __v_205: G = (__v_117 * __v_195);
-            let __v_206: G = (__v_204 + __v_205);
-            let __v_207: G = (__v_31 - __v_11);
-            let __v_208: G = (__v_187 - __v_185);
-            let __v_209: G = G::from_u64(0);
-            let __v_210: G = (__v_207 * __v_168);
-            let __v_211: G = G::from_u64(7);
-            let __v_212: G = (__v_208 * __v_209);
-            let __v_213: G = (__v_211 * __v_212);
-            let __v_214: G = (__v_210 + __v_213);
-            let __v_215: G = (__v_207 * __v_209);
-            let __v_216: G = (__v_208 * __v_168);
-            let __v_217: G = (__v_215 + __v_216);
-            let __v_218: G = (__v_114 * __v_214);
-            let __v_219: G = G::from_u64(7);
-            let __v_220: G = (__v_117 * __v_217);
-            let __v_221: G = (__v_219 * __v_220);
-            let __v_222: G = (__v_218 + __v_221);
-            let __v_223: G = (__v_114 * __v_217);
-            let __v_224: G = (__v_117 * __v_214);
-            let __v_225: G = (__v_223 + __v_224);
+            let __v_191: G = (__v_33 - __v_10);
+            let __v_192: G = (__v_189 - __v_187);
+            let __v_193: G = G::from_u64(0);
+            let __v_194: G = (__v_191 * __v_171);
+            let __v_195: G = G::from_u64(7);
+            let __v_196: G = (__v_192 * __v_193);
+            let __v_197: G = (__v_195 * __v_196);
+            let __v_198: G = (__v_194 + __v_197);
+            let __v_199: G = (__v_191 * __v_193);
+            let __v_200: G = (__v_192 * __v_171);
+            let __v_201: G = (__v_199 + __v_200);
+            let __v_202: G = (__v_117 * __v_198);
+            let __v_203: G = G::from_u64(7);
+            let __v_204: G = (__v_120 * __v_201);
+            let __v_205: G = (__v_203 * __v_204);
+            let __v_206: G = (__v_202 + __v_205);
+            let __v_207: G = (__v_117 * __v_201);
+            let __v_208: G = (__v_120 * __v_198);
+            let __v_209: G = (__v_207 + __v_208);
+            let __v_210: G = (__v_34 - __v_11);
+            let __v_211: G = (__v_190 - __v_188);
+            let __v_212: G = G::from_u64(0);
+            let __v_213: G = (__v_210 * __v_171);
+            let __v_214: G = G::from_u64(7);
+            let __v_215: G = (__v_211 * __v_212);
+            let __v_216: G = (__v_214 * __v_215);
+            let __v_217: G = (__v_213 + __v_216);
+            let __v_218: G = (__v_210 * __v_212);
+            let __v_219: G = (__v_211 * __v_171);
+            let __v_220: G = (__v_218 + __v_219);
+            let __v_221: G = (__v_117 * __v_217);
+            let __v_222: G = G::from_u64(7);
+            let __v_223: G = (__v_120 * __v_220);
+            let __v_224: G = (__v_222 * __v_223);
+            let __v_225: G = (__v_221 + __v_224);
+            let __v_226: G = (__v_117 * __v_220);
+            let __v_227: G = (__v_120 * __v_217);
+            let __v_228: G = (__v_226 + __v_227);
             let __loaded: [G; 4] = { let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; let __ptr_u64 = __v_25.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 4 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 4] = __args[..4].try_into().unwrap(); __arr };
-            let __v_226: G = __loaded[0];
-            let __v_227: G = __loaded[1];
-            let __v_228: G = __loaded[2];
-            let __v_229: G = __loaded[3];
-            let __mc_out___mc_1: [G; 2] = '__mc_1: { match __v_226.as_canonical_u64() {
+            let __v_229: G = __loaded[0];
+            let __v_230: G = __loaded[1];
+            let __v_231: G = __loaded[2];
+            let __v_232: G = __loaded[3];
+            let __mc_out___mc_1: [G; 2] = '__mc_1: { match __v_229.as_canonical_u64() {
   1u64 => {
-    let __v_230: G = G::from_u64(0);
-    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_41, __v_230]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
-    let __v_231: G = __r_arr[0];
-    let __v_232: G = __r_arr[1];
     let __v_233: G = G::from_u64(0);
-    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_39, __v_233]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_44, __v_233]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
     let __v_234: G = __r_arr[0];
     let __v_235: G = __r_arr[1];
-    let __v_236: G = (__v_231 - __v_234);
-    let __v_237: G = (__v_232 - __v_235);
-    let __v_238: G = (__v_236 + __v_203);
-    let __v_239: G = (__v_237 + __v_206);
-    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_178, __v_179, __v_16, __v_17, __v_238, __v_239]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
-    let __v_240: G = __r_arr[0];
-    let __v_241: G = __r_arr[1];
-    let __v_242: G = G::from_u64(1);
-    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_41, __v_242]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+    let __v_236: G = G::from_u64(0);
+    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_42, __v_236]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+    let __v_237: G = __r_arr[0];
+    let __v_238: G = __r_arr[1];
+    let __v_239: G = (__v_234 - __v_237);
+    let __v_240: G = (__v_235 - __v_238);
+    let __v_241: G = (__v_239 + __v_206);
+    let __v_242: G = (__v_240 + __v_209);
+    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_181, __v_182, __v_16, __v_17, __v_241, __v_242]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
     let __v_243: G = __r_arr[0];
     let __v_244: G = __r_arr[1];
     let __v_245: G = G::from_u64(1);
-    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_39, __v_245]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_44, __v_245]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
     let __v_246: G = __r_arr[0];
     let __v_247: G = __r_arr[1];
-    let __v_248: G = (__v_243 - __v_246);
-    let __v_249: G = (__v_244 - __v_247);
-    let __v_250: G = (__v_248 + __v_222);
-    let __v_251: G = (__v_249 + __v_225);
-    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_240, __v_241, __v_16, __v_17, __v_250, __v_251]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
-    let __v_252: G = __r_arr[0];
-    let __v_253: G = __r_arr[1];
-    break '__mc_1 [__v_252, __v_253];
+    let __v_248: G = G::from_u64(1);
+    let __r_arr: [G; OUT_252] = { let __args: [G; IN_252] = [__v_42, __v_248]; let __cu = unconstrained; let __hit = record.function_queries[252].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[252].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[252].bump_multiplicity(__i); } let __ret: [G; OUT_252] = unsafe { *(record.function_queries[252].output_at(__i).as_ptr() as *const [G; OUT_252]) }; __ret }, _ => aiur_fn_252(__args, record, io_buffer, __cu)? } };
+    let __v_249: G = __r_arr[0];
+    let __v_250: G = __r_arr[1];
+    let __v_251: G = (__v_246 - __v_249);
+    let __v_252: G = (__v_247 - __v_250);
+    let __v_253: G = (__v_251 + __v_225);
+    let __v_254: G = (__v_252 + __v_228);
+    let __r_arr: [G; OUT_183] = { let __args: [G; IN_183] = [__v_243, __v_244, __v_16, __v_17, __v_253, __v_254]; let __cu = unconstrained; let __hit = record.function_queries[183].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[183].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[183].bump_multiplicity(__i); } let __ret: [G; OUT_183] = unsafe { *(record.function_queries[183].output_at(__i).as_ptr() as *const [G; OUT_183]) }; __ret }, _ => aiur_fn_183(__args, record, io_buffer, __cu)? } };
+    let __v_255: G = __r_arr[0];
+    let __v_256: G = __r_arr[1];
+    break '__mc_1 [__v_255, __v_256];
   },
   0u64 => {
-    let __v_230: G = G::from_u64(0);
+    let __v_233: G = G::from_u64(0);
     let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_25]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-    let __v_231: G = __r_arr[0];
-    let __v_232: G = G::from_u64(0);
-    let __v_233: G = G::from_u64(1);
-    let __v_234: G = G::from_u64(0);
+    let __v_234: G = __r_arr[0];
     let __v_235: G = G::from_u64(0);
-    let __v_236: G = G::from_u64(0);
+    let __v_236: G = G::from_u64(1);
     let __v_237: G = G::from_u64(0);
     let __v_238: G = G::from_u64(0);
     let __v_239: G = G::from_u64(0);
     let __v_240: G = G::from_u64(0);
-    let __r_arr: [G; OUT_190] = { let __args: [G; IN_190] = [__v_178, __v_179, __v_16, __v_17, __v_25, __v_230, __v_231, __v_232, __v_26, __v_26, __v_233, __v_234, __v_235, __v_236, __v_237, __v_238, __v_239, __v_240, __v_203, __v_206, __v_222, __v_225, __v_12, __v_180, __v_13, __v_181, __v_14, __v_182, __v_15, __v_183, __v_21, __v_34, __v_36, __v_44, __v_45, __v_39, __v_41, __v_164, __v_86, __v_89, __v_114, __v_117, __v_119, __v_120]; let __cu = unconstrained; let __hit = record.function_queries[190].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[190].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[190].bump_multiplicity(__i); } let __ret: [G; OUT_190] = unsafe { *(record.function_queries[190].output_at(__i).as_ptr() as *const [G; OUT_190]) }; __ret }, _ => aiur_fn_190(__args, record, io_buffer, __cu)? } };
-    let __v_241: G = __r_arr[0];
-    let __v_242: G = __r_arr[1];
-    break '__mc_1 [__v_241, __v_242];
+    let __v_241: G = G::from_u64(0);
+    let __v_242: G = G::from_u64(0);
+    let __v_243: G = G::from_u64(0);
+    let __r_arr: [G; OUT_190] = { let __args: [G; IN_190] = [__v_181, __v_182, __v_16, __v_17, __v_25, __v_233, __v_234, __v_235, __v_26, __v_26, __v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243, __v_206, __v_209, __v_225, __v_228, __v_12, __v_183, __v_13, __v_184, __v_14, __v_185, __v_15, __v_186, __v_21, __v_37, __v_39, __v_47, __v_48, __v_42, __v_44, __v_167, __v_89, __v_92, __v_117, __v_120, __v_122, __v_123]; let __cu = unconstrained; let __hit = record.function_queries[190].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[190].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[190].bump_multiplicity(__i); } let __ret: [G; OUT_190] = unsafe { *(record.function_queries[190].output_at(__i).as_ptr() as *const [G; OUT_190]) }; __ret }, _ => aiur_fn_190(__args, record, io_buffer, __cu)? } };
+    let __v_244: G = __r_arr[0];
+    let __v_245: G = __r_arr[1];
+    break '__mc_1 [__v_244, __v_245];
   },
   _ => {
-    return Err(ExecError::MatchNoCase(__v_226.as_canonical_u64()));
+    return Err(ExecError::MatchNoCase(__v_229.as_canonical_u64()));
   },
 }
  };
-            let __v_230: G = __mc_out___mc_1[0];
-            let __v_231: G = __mc_out___mc_1[1];
+            let __v_233: G = __mc_out___mc_1[0];
+            let __v_234: G = __mc_out___mc_1[1];
             let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_8, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_232: G = __r_arr[0];
-            let __v_233: G = G::from_u64(0);
-            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_232, __v_233]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
-            let __v_234: G = __r_arr[0];
-            let __r_arr: [G; OUT_185] = { let __args: [G; IN_185] = [__v_234]; let __cu = unconstrained; let __hit = record.function_queries[185].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[185].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[185].bump_multiplicity(__i); } let __ret: [G; OUT_185] = unsafe { *(record.function_queries[185].output_at(__i).as_ptr() as *const [G; OUT_185]) }; __ret }, _ => aiur_fn_185(__args, record, io_buffer, __cu)? } };
             let __v_235: G = __r_arr[0];
-            let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = [__v_18, __v_19, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
-            let __v_236: G = __r_arr[0];
-            let __v_237: G = __r_arr[1];
-            let __v_238: G = G::from_u64(1);
-            let __v_239: G = G::from_u64(0);
-            let __r_arr: [G; OUT_193] = { let __args: [G; IN_193] = [__v_235, __v_236, __v_237, __v_238, __v_239]; let __cu = unconstrained; let __hit = record.function_queries[193].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[193].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[193].bump_multiplicity(__i); } let __ret: [G; OUT_193] = unsafe { *(record.function_queries[193].output_at(__i).as_ptr() as *const [G; OUT_193]) }; __ret }, _ => aiur_fn_193(__args, record, io_buffer, __cu)? } };
-            let __v_240: G = __r_arr[0];
-            let __v_241: G = __r_arr[1];
-            let __v_242: G = (__v_230 * __v_134);
-            let __v_243: G = G::from_u64(7);
-            let __v_244: G = (__v_231 * __v_137);
-            let __v_245: G = (__v_243 * __v_244);
-            let __v_246: G = (__v_242 + __v_245);
-            let __v_247: G = (__v_230 * __v_137);
-            let __v_248: G = (__v_231 * __v_134);
-            let __v_249: G = (__v_247 + __v_248);
-            let __v_250: G = G::from_u64(32);
-            let __v_251: G = if unconstrained { Bytes2::less_than(&__v_28, &__v_250) } else { bytes2_less_than_value(__v_28, __v_250, record) };
-            let __v_252: G = G::from_u64(1);
-            if (__v_251 != __v_252) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_251.as_canonical_u64(), rhs: __v_252.as_canonical_u64(), msg: None });
-            }
-            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_235]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-            let __v_253: G = __r_arr[0];
-            let __v_254: G = (__v_253 - __v_29);
-            let __v_255: G = G::from_bool((__v_254 == G::ZERO));
-            let __v_256: G = G::from_u64(1);
-            if (__v_255 != __v_256) {
-              return Err(ExecError::AssertEqMismatch { lhs: __v_255.as_canonical_u64(), rhs: __v_256.as_canonical_u64(), msg: None });
+            let __v_236: G = G::from_u64(0);
+            let __r_arr: [G; OUT_243] = { let __args: [G; IN_243] = [__v_235, __v_236]; let __cu = unconstrained; let __hit = record.function_queries[243].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[243].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[243].bump_multiplicity(__i); } let __ret: [G; OUT_243] = unsafe { *(record.function_queries[243].output_at(__i).as_ptr() as *const [G; OUT_243]) }; __ret }, _ => aiur_fn_243(__args, record, io_buffer, __cu)? } };
+            let __v_237: G = __r_arr[0];
+            let __r_arr: [G; OUT_185] = { let __args: [G; IN_185] = [__v_237]; let __cu = unconstrained; let __hit = record.function_queries[185].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[185].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[185].bump_multiplicity(__i); } let __ret: [G; OUT_185] = unsafe { *(record.function_queries[185].output_at(__i).as_ptr() as *const [G; OUT_185]) }; __ret }, _ => aiur_fn_185(__args, record, io_buffer, __cu)? } };
+            let __v_238: G = __r_arr[0];
+            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_238]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+            let __v_239: G = __r_arr[0];
+            let __v_240: G = (__v_239 - __v_32);
+            let __v_241: G = G::from_bool((__v_240 == G::ZERO));
+            let __v_242: G = G::from_u64(1);
+            if (__v_241 != __v_242) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_241.as_canonical_u64(), rhs: __v_242.as_canonical_u64(), msg: None });
             }
-            let __v_257: G = (__v_246 - __v_240);
+            let __r_arr: [G; OUT_177] = { let __args: [G; IN_177] = [__v_18, __v_19, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[177].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[177].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[177].bump_multiplicity(__i); } let __ret: [G; OUT_177] = unsafe { *(record.function_queries[177].output_at(__i).as_ptr() as *const [G; OUT_177]) }; __ret }, _ => aiur_fn_177(__args, record, io_buffer, __cu)? } };
+            let __v_243: G = __r_arr[0];
+            let __v_244: G = __r_arr[1];
+            let __v_245: G = G::from_u64(1);
+            let __v_246: G = G::from_u64(0);
+            let __r_arr: [G; OUT_193] = { let __args: [G; IN_193] = [__v_238, __v_243, __v_244, __v_245, __v_246]; let __cu = unconstrained; let __hit = record.function_queries[193].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[193].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[193].bump_multiplicity(__i); } let __ret: [G; OUT_193] = unsafe { *(record.function_queries[193].output_at(__i).as_ptr() as *const [G; OUT_193]) }; __ret }, _ => aiur_fn_193(__args, record, io_buffer, __cu)? } };
+            let __v_247: G = __r_arr[0];
+            let __v_248: G = __r_arr[1];
+            let __v_249: G = (__v_233 * __v_137);
+            let __v_250: G = G::from_u64(7);
+            let __v_251: G = (__v_234 * __v_140);
+            let __v_252: G = (__v_250 * __v_251);
+            let __v_253: G = (__v_249 + __v_252);
+            let __v_254: G = (__v_233 * __v_140);
+            let __v_255: G = (__v_234 * __v_137);
+            let __v_256: G = (__v_254 + __v_255);
+            let __v_257: G = (__v_253 - __v_247);
             let __v_258: G = G::from_bool((__v_257 == G::ZERO));
-            let __v_259: G = (__v_249 - __v_241);
+            let __v_259: G = (__v_256 - __v_248);
             let __v_260: G = G::from_bool((__v_259 == G::ZERO));
             let __v_261: G = (__v_258 * __v_260);
             let __v_262: G = G::from_u64(1);
@@ -18580,7 +18580,7 @@ fn aiur_fn_196(
             }
             let __v_263: G = G::from_u64(1);
             let __v_264: G = (__v_9 + __v_263);
-            let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_27, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_264, __v_30, __v_31, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+            let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_27, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_264, __v_33, __v_34, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
             let __v_265: G = __r_arr[0];
             let __ret: [G; OUT_196] = [__v_265];
             record.function_queries[196].finish(&inp[..], &__ret[..], !unconstrained);
@@ -18798,20 +18798,58 @@ fn aiur_fn_199(
       _ => {
         match __v_0.as_canonical_u64() {
           _ => {
+            let __v_38: G = G::from_u64(0);
+            if (__v_1 != __v_38) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_38.as_canonical_u64(), msg: None });
+            }
+            let __v_39: G = G::from_u64(0);
+            if (__v_2 != __v_39) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_39.as_canonical_u64(), msg: None });
+            }
+            let __v_40: G = G::from_u64(1);
+            if (__v_3 != __v_40) {
+              return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: None });
+            }
             match __v_12.as_canonical_u64() {
               _ => {
+                let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
+                let __v_41: G = __r_arr[0];
+                let __v_42: G = G::from_u64(1);
+                if (__v_41 != __v_42) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_41.as_canonical_u64(), rhs: __v_42.as_canonical_u64(), msg: None });
+                }
+                let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                let __v_43: G = __r_arr[0];
+                let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                let __v_44: G = __r_arr[0];
+                let __v_45: G = (__v_43 - __v_44);
+                let __v_46: G = G::from_bool((__v_45 == G::ZERO));
+                let __v_47: G = G::from_u64(1);
+                if (__v_46 != __v_47) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_46.as_canonical_u64(), rhs: __v_47.as_canonical_u64(), msg: None });
+                }
                 let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_8, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-                let __v_38: G = __r_arr[0];
+                let __v_48: G = __r_arr[0];
                 let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_11, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-                let __v_39: G = __r_arr[0];
+                let __v_49: G = __r_arr[0];
+                let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                let __v_50: G = __r_arr[0];
+                let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                let __v_51: G = __r_arr[0];
+                let __v_52: G = (__v_50 - __v_51);
+                let __v_53: G = G::from_bool((__v_52 == G::ZERO));
+                let __v_54: G = G::from_u64(1);
+                if (__v_53 != __v_54) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_53.as_canonical_u64(), rhs: __v_54.as_canonical_u64(), msg: None });
+                }
                 match __v_13.as_canonical_u64() {
                   _ => {
                     let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_9.as_canonical_u64() {
   0u64 => {
-    let __v_40: G = G::from_u64(1);
-    let __v_41: G = G::from_u64(1);
-    let __v_42: G = { let __values: [G; 3] = [__v_40, __v_41, __v_41]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_0 [__v_42];
+    let __v_55: G = G::from_u64(1);
+    let __v_56: G = G::from_u64(1);
+    let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_57];
   },
   1u64 => {
     break '__mc_0 [__v_10];
@@ -18821,554 +18859,516 @@ fn aiur_fn_199(
   },
 }
  };
-                    let __v_40: G = __mc_out___mc_0[0];
+                    let __v_55: G = __mc_out___mc_0[0];
                     let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_17, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                    let __v_41: G = __r_arr[0];
-                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_13, __v_41]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                    let __v_42: G = __r_arr[0];
-                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_40, __v_42]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                    let __v_43: G = __r_arr[0];
-                    let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_12, __v_43]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                    let __v_44: G = __r_arr[0];
-                    let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_44]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
-                    let __v_45: G = __r_arr[0];
-                    let __v_46: G = G::from_u64(0);
-                    let __v_47: G = G::from_u64(109);
-                    let __v_48: G = G::from_u64(0);
-                    let __v_49: G = G::from_u64(117);
-                    let __v_50: G = G::from_u64(0);
-                    let __v_51: G = G::from_u64(108);
-                    let __v_52: G = G::from_u64(0);
-                    let __v_53: G = G::from_u64(116);
-                    let __v_54: G = G::from_u64(0);
-                    let __v_55: G = G::from_u64(105);
-                    let __v_56: G = G::from_u64(0);
-                    let __v_57: G = G::from_u64(45);
-                    let __v_58: G = G::from_u64(0);
-                    let __v_59: G = G::from_u64(115);
-                    let __v_60: G = G::from_u64(0);
-                    let __v_61: G = G::from_u64(116);
-                    let __v_62: G = G::from_u64(0);
-                    let __v_63: G = G::from_u64(97);
-                    let __v_64: G = G::from_u64(0);
-                    let __v_65: G = G::from_u64(114);
-                    let __v_66: G = G::from_u64(0);
-                    let __v_67: G = G::from_u64(107);
-                    let __v_68: G = G::from_u64(0);
-                    let __v_69: G = G::from_u64(47);
-                    let __v_70: G = G::from_u64(0);
-                    let __v_71: G = G::from_u64(118);
-                    let __v_72: G = G::from_u64(0);
-                    let __v_73: G = G::from_u64(48);
-                    let __v_74: G = { let __values: [G; 3] = [__v_72, __v_73, __v_45]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_75: G = { let __values: [G; 3] = [__v_70, __v_71, __v_74]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_76: G = { let __values: [G; 3] = [__v_68, __v_69, __v_75]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_77: G = { let __values: [G; 3] = [__v_66, __v_67, __v_76]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_78: G = { let __values: [G; 3] = [__v_64, __v_65, __v_77]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_79: G = { let __values: [G; 3] = [__v_62, __v_63, __v_78]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_80: G = { let __values: [G; 3] = [__v_60, __v_61, __v_79]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_81: G = { let __values: [G; 3] = [__v_58, __v_59, __v_80]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_82: G = { let __values: [G; 3] = [__v_56, __v_57, __v_81]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_83: G = { let __values: [G; 3] = [__v_54, __v_55, __v_82]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_84: G = { let __values: [G; 3] = [__v_52, __v_53, __v_83]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_85: G = { let __values: [G; 3] = [__v_50, __v_51, __v_84]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_86: G = { let __values: [G; 3] = [__v_48, __v_49, __v_85]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_87: G = { let __values: [G; 3] = [__v_46, __v_47, __v_86]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __v_88: G = G::from_u64(1);
-                    let __v_89: G = G::from_u64(1);
-                    let __v_90: G = { let __values: [G; 3] = [__v_88, __v_89, __v_89]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_87, __v_90]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_91: G = __r_arr[0];
-                    let __v_92: G = __r_arr[1];
-                    let __v_93: G = __r_arr[2];
-                    let __v_94: G = __r_arr[3];
-                    let __v_95: G = __r_arr[4];
-                    let __v_96: G = __r_arr[5];
-                    let __v_97: G = __r_arr[6];
-                    let __v_98: G = __r_arr[7];
-                    let __v_99: G = __r_arr[8];
-                    let __v_100: G = __r_arr[9];
-                    let __v_101: G = __r_arr[10];
-                    let __v_102: G = __r_arr[11];
-                    let __v_103: G = __r_arr[12];
-                    let __v_104: G = __r_arr[13];
-                    let __v_105: G = __r_arr[14];
-                    let __v_106: G = __r_arr[15];
-                    let __v_107: G = __r_arr[16];
-                    let __v_108: G = __r_arr[17];
-                    let __v_109: G = G::from_u64(1);
-                    let __v_110: G = G::from_u64(1);
-                    let __v_111: G = { let __values: [G; 3] = [__v_109, __v_110, __v_110]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_111]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_112: G = __r_arr[0];
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_112]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_113: G = __r_arr[0];
-                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_107, __v_113]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                    let __v_114: G = __r_arr[0];
-                    let __v_115: G = G::from_u64(1);
-                    let __v_116: G = G::from_u64(1);
-                    let __v_117: G = { let __values: [G; 3] = [__v_115, __v_116, __v_116]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_114, __v_117]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_118: G = __r_arr[0];
-                    let __v_119: G = __r_arr[1];
-                    let __v_120: G = __r_arr[2];
-                    let __v_121: G = __r_arr[3];
-                    let __v_122: G = __r_arr[4];
-                    let __v_123: G = __r_arr[5];
-                    let __v_124: G = __r_arr[6];
-                    let __v_125: G = __r_arr[7];
-                    let __v_126: G = __r_arr[8];
-                    let __v_127: G = __r_arr[9];
-                    let __v_128: G = __r_arr[10];
-                    let __v_129: G = __r_arr[11];
-                    let __v_130: G = __r_arr[12];
-                    let __v_131: G = __r_arr[13];
-                    let __v_132: G = __r_arr[14];
-                    let __v_133: G = __r_arr[15];
-                    let __v_134: G = __r_arr[16];
-                    let __v_135: G = __r_arr[17];
-                    let __v_136: G = G::from_u64(1);
-                    let __v_137: G = G::from_u64(1);
-                    let __v_138: G = { let __values: [G; 3] = [__v_136, __v_137, __v_137]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_126, __v_127, __v_128, __v_129, __v_130, __v_131, __v_132, __v_133, __v_138]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_139: G = __r_arr[0];
-                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_118, __v_119, __v_120, __v_121, __v_122, __v_123, __v_124, __v_125, __v_139]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                    let __v_140: G = __r_arr[0];
-                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_134, __v_140]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                    let __v_141: G = __r_arr[0];
-                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_141, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
-                    let __v_142: G = __r_arr[0];
-                    let __v_143: G = G::from_u64(1);
-                    let __v_144: G = G::from_u64(1);
-                    let __v_145: G = { let __values: [G; 3] = [__v_143, __v_144, __v_144]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_16, __v_145]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                    let __v_146: G = __r_arr[0];
-                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_142, __v_146]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                    let __v_147: G = __r_arr[0];
-                    let __v_148: G = G::from_u64(1);
-                    let __v_149: G = G::from_u64(1);
-                    let __v_150: G = { let __values: [G; 3] = [__v_148, __v_149, __v_149]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_147, __v_150]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_151: G = __r_arr[0];
-                    let __v_152: G = __r_arr[1];
-                    let __v_153: G = __r_arr[2];
-                    let __v_154: G = __r_arr[3];
-                    let __v_155: G = __r_arr[4];
-                    let __v_156: G = __r_arr[5];
-                    let __v_157: G = __r_arr[6];
-                    let __v_158: G = __r_arr[7];
-                    let __v_159: G = __r_arr[8];
-                    let __v_160: G = __r_arr[9];
-                    let __v_161: G = __r_arr[10];
-                    let __v_162: G = __r_arr[11];
-                    let __v_163: G = __r_arr[12];
-                    let __v_164: G = __r_arr[13];
-                    let __v_165: G = __r_arr[14];
-                    let __v_166: G = __r_arr[15];
-                    let __v_167: G = __r_arr[16];
-                    let __v_168: G = __r_arr[17];
-                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_167, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
-                    let __v_169: G = __r_arr[0];
-                    let __v_170: G = G::from_u64(1);
-                    let __v_171: G = G::from_u64(1);
-                    let __v_172: G = { let __values: [G; 3] = [__v_170, __v_171, __v_171]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_169, __v_172]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_173: G = __r_arr[0];
-                    let __v_174: G = __r_arr[1];
-                    let __v_175: G = __r_arr[2];
-                    let __v_176: G = __r_arr[3];
-                    let __v_177: G = __r_arr[4];
-                    let __v_178: G = __r_arr[5];
-                    let __v_179: G = __r_arr[6];
-                    let __v_180: G = __r_arr[7];
-                    let __v_181: G = __r_arr[8];
-                    let __v_182: G = __r_arr[9];
-                    let __v_183: G = __r_arr[10];
-                    let __v_184: G = __r_arr[11];
-                    let __v_185: G = __r_arr[12];
-                    let __v_186: G = __r_arr[13];
-                    let __v_187: G = __r_arr[14];
-                    let __v_188: G = __r_arr[15];
-                    let __v_189: G = __r_arr[16];
-                    let __v_190: G = __r_arr[17];
-                    let __v_191: G = G::from_u64(256);
-                    let __v_192: G = (__v_191 * __v_92);
-                    let __v_193: G = G::from_u64(65536);
-                    let __v_194: G = (__v_193 * __v_93);
-                    let __v_195: G = G::from_u64(16777216);
-                    let __v_196: G = (__v_195 * __v_94);
-                    let __v_197: G = G::from_u64(4294967296);
-                    let __v_198: G = (__v_197 * __v_95);
-                    let __v_199: G = G::from_u64(1099511627776);
-                    let __v_200: G = (__v_199 * __v_96);
-                    let __v_201: G = G::from_u64(281474976710656);
-                    let __v_202: G = (__v_201 * __v_97);
-                    let __v_203: G = G::from_u64(72057594037927936);
-                    let __v_204: G = (__v_203 * __v_98);
-                    let __v_205: G = (__v_202 + __v_204);
-                    let __v_206: G = (__v_200 + __v_205);
-                    let __v_207: G = (__v_198 + __v_206);
-                    let __v_208: G = (__v_196 + __v_207);
-                    let __v_209: G = (__v_194 + __v_208);
-                    let __v_210: G = (__v_192 + __v_209);
-                    let __v_211: G = (__v_91 + __v_210);
-                    let __v_212: G = G::from_u64(256);
-                    let __v_213: G = (__v_212 * __v_100);
-                    let __v_214: G = G::from_u64(65536);
-                    let __v_215: G = (__v_214 * __v_101);
-                    let __v_216: G = G::from_u64(16777216);
-                    let __v_217: G = (__v_216 * __v_102);
-                    let __v_218: G = G::from_u64(4294967296);
-                    let __v_219: G = (__v_218 * __v_103);
-                    let __v_220: G = G::from_u64(1099511627776);
-                    let __v_221: G = (__v_220 * __v_104);
-                    let __v_222: G = G::from_u64(281474976710656);
-                    let __v_223: G = (__v_222 * __v_105);
-                    let __v_224: G = G::from_u64(72057594037927936);
-                    let __v_225: G = (__v_224 * __v_106);
-                    let __v_226: G = (__v_223 + __v_225);
-                    let __v_227: G = (__v_221 + __v_226);
-                    let __v_228: G = (__v_219 + __v_227);
-                    let __v_229: G = (__v_217 + __v_228);
-                    let __v_230: G = (__v_215 + __v_229);
-                    let __v_231: G = (__v_213 + __v_230);
-                    let __v_232: G = (__v_99 + __v_231);
-                    let __v_233: G = G::from_u64(256);
-                    let __v_234: G = (__v_233 * __v_119);
-                    let __v_235: G = G::from_u64(65536);
-                    let __v_236: G = (__v_235 * __v_120);
-                    let __v_237: G = G::from_u64(16777216);
-                    let __v_238: G = (__v_237 * __v_121);
-                    let __v_239: G = G::from_u64(4294967296);
-                    let __v_240: G = (__v_239 * __v_122);
-                    let __v_241: G = G::from_u64(1099511627776);
-                    let __v_242: G = (__v_241 * __v_123);
-                    let __v_243: G = G::from_u64(281474976710656);
-                    let __v_244: G = (__v_243 * __v_124);
-                    let __v_245: G = G::from_u64(72057594037927936);
-                    let __v_246: G = (__v_245 * __v_125);
-                    let __v_247: G = (__v_244 + __v_246);
-                    let __v_248: G = (__v_242 + __v_247);
-                    let __v_249: G = (__v_240 + __v_248);
-                    let __v_250: G = (__v_238 + __v_249);
-                    let __v_251: G = (__v_236 + __v_250);
-                    let __v_252: G = (__v_234 + __v_251);
-                    let __v_253: G = (__v_118 + __v_252);
-                    let __v_254: G = G::from_u64(256);
-                    let __v_255: G = (__v_254 * __v_127);
-                    let __v_256: G = G::from_u64(65536);
-                    let __v_257: G = (__v_256 * __v_128);
-                    let __v_258: G = G::from_u64(16777216);
-                    let __v_259: G = (__v_258 * __v_129);
-                    let __v_260: G = G::from_u64(4294967296);
-                    let __v_261: G = (__v_260 * __v_130);
-                    let __v_262: G = G::from_u64(1099511627776);
-                    let __v_263: G = (__v_262 * __v_131);
-                    let __v_264: G = G::from_u64(281474976710656);
-                    let __v_265: G = (__v_264 * __v_132);
-                    let __v_266: G = G::from_u64(72057594037927936);
-                    let __v_267: G = (__v_266 * __v_133);
-                    let __v_268: G = (__v_265 + __v_267);
-                    let __v_269: G = (__v_263 + __v_268);
-                    let __v_270: G = (__v_261 + __v_269);
-                    let __v_271: G = (__v_259 + __v_270);
-                    let __v_272: G = (__v_257 + __v_271);
-                    let __v_273: G = (__v_255 + __v_272);
-                    let __v_274: G = (__v_126 + __v_273);
-                    let __v_275: G = G::from_u64(256);
-                    let __v_276: G = (__v_275 * __v_152);
-                    let __v_277: G = G::from_u64(65536);
-                    let __v_278: G = (__v_277 * __v_153);
-                    let __v_279: G = G::from_u64(16777216);
-                    let __v_280: G = (__v_279 * __v_154);
-                    let __v_281: G = G::from_u64(4294967296);
-                    let __v_282: G = (__v_281 * __v_155);
-                    let __v_283: G = G::from_u64(1099511627776);
-                    let __v_284: G = (__v_283 * __v_156);
-                    let __v_285: G = G::from_u64(281474976710656);
-                    let __v_286: G = (__v_285 * __v_157);
-                    let __v_287: G = G::from_u64(72057594037927936);
-                    let __v_288: G = (__v_287 * __v_158);
-                    let __v_289: G = (__v_286 + __v_288);
-                    let __v_290: G = (__v_284 + __v_289);
-                    let __v_291: G = (__v_282 + __v_290);
-                    let __v_292: G = (__v_280 + __v_291);
-                    let __v_293: G = (__v_278 + __v_292);
-                    let __v_294: G = (__v_276 + __v_293);
-                    let __v_295: G = (__v_151 + __v_294);
-                    let __v_296: G = G::from_u64(256);
-                    let __v_297: G = (__v_296 * __v_160);
-                    let __v_298: G = G::from_u64(65536);
-                    let __v_299: G = (__v_298 * __v_161);
-                    let __v_300: G = G::from_u64(16777216);
-                    let __v_301: G = (__v_300 * __v_162);
-                    let __v_302: G = G::from_u64(4294967296);
-                    let __v_303: G = (__v_302 * __v_163);
-                    let __v_304: G = G::from_u64(1099511627776);
-                    let __v_305: G = (__v_304 * __v_164);
-                    let __v_306: G = G::from_u64(281474976710656);
-                    let __v_307: G = (__v_306 * __v_165);
-                    let __v_308: G = G::from_u64(72057594037927936);
-                    let __v_309: G = (__v_308 * __v_166);
-                    let __v_310: G = (__v_307 + __v_309);
-                    let __v_311: G = (__v_305 + __v_310);
-                    let __v_312: G = (__v_303 + __v_311);
-                    let __v_313: G = (__v_301 + __v_312);
-                    let __v_314: G = (__v_299 + __v_313);
-                    let __v_315: G = (__v_297 + __v_314);
-                    let __v_316: G = (__v_159 + __v_315);
-                    let __v_317: G = G::from_u64(256);
-                    let __v_318: G = (__v_317 * __v_174);
-                    let __v_319: G = G::from_u64(65536);
-                    let __v_320: G = (__v_319 * __v_175);
-                    let __v_321: G = G::from_u64(16777216);
-                    let __v_322: G = (__v_321 * __v_176);
-                    let __v_323: G = G::from_u64(4294967296);
-                    let __v_324: G = (__v_323 * __v_177);
-                    let __v_325: G = G::from_u64(1099511627776);
-                    let __v_326: G = (__v_325 * __v_178);
-                    let __v_327: G = G::from_u64(281474976710656);
-                    let __v_328: G = (__v_327 * __v_179);
-                    let __v_329: G = G::from_u64(72057594037927936);
-                    let __v_330: G = (__v_329 * __v_180);
-                    let __v_331: G = (__v_328 + __v_330);
-                    let __v_332: G = (__v_326 + __v_331);
-                    let __v_333: G = (__v_324 + __v_332);
-                    let __v_334: G = (__v_322 + __v_333);
-                    let __v_335: G = (__v_320 + __v_334);
-                    let __v_336: G = (__v_318 + __v_335);
-                    let __v_337: G = (__v_173 + __v_336);
-                    let __v_338: G = G::from_u64(256);
-                    let __v_339: G = (__v_338 * __v_182);
-                    let __v_340: G = G::from_u64(65536);
-                    let __v_341: G = (__v_340 * __v_183);
-                    let __v_342: G = G::from_u64(16777216);
-                    let __v_343: G = (__v_342 * __v_184);
-                    let __v_344: G = G::from_u64(4294967296);
-                    let __v_345: G = (__v_344 * __v_185);
-                    let __v_346: G = G::from_u64(1099511627776);
-                    let __v_347: G = (__v_346 * __v_186);
-                    let __v_348: G = G::from_u64(281474976710656);
-                    let __v_349: G = (__v_348 * __v_187);
-                    let __v_350: G = G::from_u64(72057594037927936);
-                    let __v_351: G = (__v_350 * __v_188);
-                    let __v_352: G = (__v_349 + __v_351);
-                    let __v_353: G = (__v_347 + __v_352);
-                    let __v_354: G = (__v_345 + __v_353);
-                    let __v_355: G = (__v_343 + __v_354);
-                    let __v_356: G = (__v_341 + __v_355);
-                    let __v_357: G = (__v_339 + __v_356);
-                    let __v_358: G = (__v_181 + __v_357);
-                    let __v_359: G = G::from_u64(0);
-                    let __v_360: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_359, __v_360, __v_36, __v_211, __v_232, __v_253, __v_274]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
-                    let __v_361: G = __r_arr[0];
-                    let __v_362: G = __r_arr[1];
-                    let __v_363: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_38, __v_39, __v_17, __v_16, __v_34, __v_35, __v_32, __v_33, __v_31, __v_363, __v_361, __v_362, __v_211, __v_232, __v_253, __v_274, __v_295, __v_316, __v_337, __v_358]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
-                    let __v_364: G = __r_arr[0];
-                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                    let __v_365: G = __r_arr[0];
+                    let __v_56: G = __r_arr[0];
+                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_13, __v_56]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                    let __v_57: G = __r_arr[0];
+                    let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_55, __v_57]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                    let __v_58: G = __r_arr[0];
+                    let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_12, __v_58]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                    let __v_59: G = __r_arr[0];
+                    let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_59]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
+                    let __v_60: G = __r_arr[0];
+                    let __v_61: G = G::from_u64(109);
+                    let __v_62: G = G::from_u64(117);
+                    let __v_63: G = G::from_u64(108);
+                    let __v_64: G = G::from_u64(116);
+                    let __v_65: G = G::from_u64(105);
+                    let __v_66: G = G::from_u64(45);
+                    let __v_67: G = G::from_u64(115);
+                    let __v_68: G = G::from_u64(116);
+                    let __v_69: G = G::from_u64(97);
+                    let __v_70: G = G::from_u64(114);
+                    let __v_71: G = G::from_u64(107);
+                    let __v_72: G = G::from_u64(47);
+                    let __v_73: G = G::from_u64(118);
+                    let __v_74: G = G::from_u64(48);
+                    let __v_75: G = G::from_u64(0);
+                    let __v_76: G = { let __values: [G; 3] = [__v_75, __v_74, __v_60]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_77: G = G::from_u64(0);
+                    let __v_78: G = { let __values: [G; 3] = [__v_77, __v_73, __v_76]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_79: G = G::from_u64(0);
+                    let __v_80: G = { let __values: [G; 3] = [__v_79, __v_72, __v_78]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_81: G = G::from_u64(0);
+                    let __v_82: G = { let __values: [G; 3] = [__v_81, __v_71, __v_80]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_83: G = G::from_u64(0);
+                    let __v_84: G = { let __values: [G; 3] = [__v_83, __v_70, __v_82]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_85: G = G::from_u64(0);
+                    let __v_86: G = { let __values: [G; 3] = [__v_85, __v_69, __v_84]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_87: G = G::from_u64(0);
+                    let __v_88: G = { let __values: [G; 3] = [__v_87, __v_68, __v_86]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_89: G = G::from_u64(0);
+                    let __v_90: G = { let __values: [G; 3] = [__v_89, __v_67, __v_88]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_91: G = G::from_u64(0);
+                    let __v_92: G = { let __values: [G; 3] = [__v_91, __v_66, __v_90]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_93: G = G::from_u64(0);
+                    let __v_94: G = { let __values: [G; 3] = [__v_93, __v_65, __v_92]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_95: G = G::from_u64(0);
+                    let __v_96: G = { let __values: [G; 3] = [__v_95, __v_64, __v_94]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_97: G = G::from_u64(0);
+                    let __v_98: G = { let __values: [G; 3] = [__v_97, __v_63, __v_96]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_99: G = G::from_u64(0);
+                    let __v_100: G = { let __values: [G; 3] = [__v_99, __v_62, __v_98]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_101: G = G::from_u64(0);
+                    let __v_102: G = { let __values: [G; 3] = [__v_101, __v_61, __v_100]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __v_103: G = G::from_u64(1);
+                    let __v_104: G = G::from_u64(1);
+                    let __v_105: G = { let __values: [G; 3] = [__v_103, __v_104, __v_104]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_102, __v_105]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_106: G = __r_arr[0];
+                    let __v_107: G = __r_arr[1];
+                    let __v_108: G = __r_arr[2];
+                    let __v_109: G = __r_arr[3];
+                    let __v_110: G = __r_arr[4];
+                    let __v_111: G = __r_arr[5];
+                    let __v_112: G = __r_arr[6];
+                    let __v_113: G = __r_arr[7];
+                    let __v_114: G = __r_arr[8];
+                    let __v_115: G = __r_arr[9];
+                    let __v_116: G = __r_arr[10];
+                    let __v_117: G = __r_arr[11];
+                    let __v_118: G = __r_arr[12];
+                    let __v_119: G = __r_arr[13];
+                    let __v_120: G = __r_arr[14];
+                    let __v_121: G = __r_arr[15];
+                    let __v_122: G = __r_arr[16];
+                    let __v_123: G = __r_arr[17];
+                    let __v_124: G = G::from_u64(1);
+                    let __v_125: G = G::from_u64(1);
+                    let __v_126: G = { let __values: [G; 3] = [__v_124, __v_125, __v_125]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121, __v_126]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_127: G = __r_arr[0];
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_106, __v_107, __v_108, __v_109, __v_110, __v_111, __v_112, __v_113, __v_127]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_128: G = __r_arr[0];
+                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_122, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                    let __v_129: G = __r_arr[0];
+                    let __v_130: G = G::from_u64(1);
+                    let __v_131: G = G::from_u64(1);
+                    let __v_132: G = { let __values: [G; 3] = [__v_130, __v_131, __v_131]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_129, __v_132]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_133: G = __r_arr[0];
+                    let __v_134: G = __r_arr[1];
+                    let __v_135: G = __r_arr[2];
+                    let __v_136: G = __r_arr[3];
+                    let __v_137: G = __r_arr[4];
+                    let __v_138: G = __r_arr[5];
+                    let __v_139: G = __r_arr[6];
+                    let __v_140: G = __r_arr[7];
+                    let __v_141: G = __r_arr[8];
+                    let __v_142: G = __r_arr[9];
+                    let __v_143: G = __r_arr[10];
+                    let __v_144: G = __r_arr[11];
+                    let __v_145: G = __r_arr[12];
+                    let __v_146: G = __r_arr[13];
+                    let __v_147: G = __r_arr[14];
+                    let __v_148: G = __r_arr[15];
+                    let __v_149: G = __r_arr[16];
+                    let __v_150: G = __r_arr[17];
+                    let __v_151: G = G::from_u64(1);
+                    let __v_152: G = G::from_u64(1);
+                    let __v_153: G = { let __values: [G; 3] = [__v_151, __v_152, __v_152]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_141, __v_142, __v_143, __v_144, __v_145, __v_146, __v_147, __v_148, __v_153]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_154: G = __r_arr[0];
+                    let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_133, __v_134, __v_135, __v_136, __v_137, __v_138, __v_139, __v_140, __v_154]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                    let __v_155: G = __r_arr[0];
+                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_149, __v_155]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                    let __v_156: G = __r_arr[0];
+                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_156, __v_14]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                    let __v_157: G = __r_arr[0];
+                    let __v_158: G = G::from_u64(1);
+                    let __v_159: G = G::from_u64(1);
+                    let __v_160: G = { let __values: [G; 3] = [__v_158, __v_159, __v_159]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_16, __v_160]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                    let __v_161: G = __r_arr[0];
+                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_157, __v_161]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                    let __v_162: G = __r_arr[0];
+                    let __v_163: G = G::from_u64(1);
+                    let __v_164: G = G::from_u64(1);
+                    let __v_165: G = { let __values: [G; 3] = [__v_163, __v_164, __v_164]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_162, __v_165]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_166: G = __r_arr[0];
+                    let __v_167: G = __r_arr[1];
+                    let __v_168: G = __r_arr[2];
+                    let __v_169: G = __r_arr[3];
+                    let __v_170: G = __r_arr[4];
+                    let __v_171: G = __r_arr[5];
+                    let __v_172: G = __r_arr[6];
+                    let __v_173: G = __r_arr[7];
+                    let __v_174: G = __r_arr[8];
+                    let __v_175: G = __r_arr[9];
+                    let __v_176: G = __r_arr[10];
+                    let __v_177: G = __r_arr[11];
+                    let __v_178: G = __r_arr[12];
+                    let __v_179: G = __r_arr[13];
+                    let __v_180: G = __r_arr[14];
+                    let __v_181: G = __r_arr[15];
+                    let __v_182: G = __r_arr[16];
+                    let __v_183: G = __r_arr[17];
+                    let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_182, __v_15]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                    let __v_184: G = __r_arr[0];
+                    let __v_185: G = G::from_u64(1);
+                    let __v_186: G = G::from_u64(1);
+                    let __v_187: G = { let __values: [G; 3] = [__v_185, __v_186, __v_186]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_184, __v_187]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                    let __v_188: G = __r_arr[0];
+                    let __v_189: G = __r_arr[1];
+                    let __v_190: G = __r_arr[2];
+                    let __v_191: G = __r_arr[3];
+                    let __v_192: G = __r_arr[4];
+                    let __v_193: G = __r_arr[5];
+                    let __v_194: G = __r_arr[6];
+                    let __v_195: G = __r_arr[7];
+                    let __v_196: G = __r_arr[8];
+                    let __v_197: G = __r_arr[9];
+                    let __v_198: G = __r_arr[10];
+                    let __v_199: G = __r_arr[11];
+                    let __v_200: G = __r_arr[12];
+                    let __v_201: G = __r_arr[13];
+                    let __v_202: G = __r_arr[14];
+                    let __v_203: G = __r_arr[15];
+                    let __v_204: G = __r_arr[16];
+                    let __v_205: G = __r_arr[17];
+                    let __v_206: G = G::from_u64(256);
+                    let __v_207: G = (__v_206 * __v_107);
+                    let __v_208: G = G::from_u64(65536);
+                    let __v_209: G = (__v_208 * __v_108);
+                    let __v_210: G = G::from_u64(16777216);
+                    let __v_211: G = (__v_210 * __v_109);
+                    let __v_212: G = G::from_u64(4294967296);
+                    let __v_213: G = (__v_212 * __v_110);
+                    let __v_214: G = G::from_u64(1099511627776);
+                    let __v_215: G = (__v_214 * __v_111);
+                    let __v_216: G = G::from_u64(281474976710656);
+                    let __v_217: G = (__v_216 * __v_112);
+                    let __v_218: G = G::from_u64(72057594037927936);
+                    let __v_219: G = (__v_218 * __v_113);
+                    let __v_220: G = (__v_217 + __v_219);
+                    let __v_221: G = (__v_215 + __v_220);
+                    let __v_222: G = (__v_213 + __v_221);
+                    let __v_223: G = (__v_211 + __v_222);
+                    let __v_224: G = (__v_209 + __v_223);
+                    let __v_225: G = (__v_207 + __v_224);
+                    let __v_226: G = (__v_106 + __v_225);
+                    let __v_227: G = G::from_u64(256);
+                    let __v_228: G = (__v_227 * __v_115);
+                    let __v_229: G = G::from_u64(65536);
+                    let __v_230: G = (__v_229 * __v_116);
+                    let __v_231: G = G::from_u64(16777216);
+                    let __v_232: G = (__v_231 * __v_117);
+                    let __v_233: G = G::from_u64(4294967296);
+                    let __v_234: G = (__v_233 * __v_118);
+                    let __v_235: G = G::from_u64(1099511627776);
+                    let __v_236: G = (__v_235 * __v_119);
+                    let __v_237: G = G::from_u64(281474976710656);
+                    let __v_238: G = (__v_237 * __v_120);
+                    let __v_239: G = G::from_u64(72057594037927936);
+                    let __v_240: G = (__v_239 * __v_121);
+                    let __v_241: G = (__v_238 + __v_240);
+                    let __v_242: G = (__v_236 + __v_241);
+                    let __v_243: G = (__v_234 + __v_242);
+                    let __v_244: G = (__v_232 + __v_243);
+                    let __v_245: G = (__v_230 + __v_244);
+                    let __v_246: G = (__v_228 + __v_245);
+                    let __v_247: G = (__v_114 + __v_246);
+                    let __v_248: G = G::from_u64(256);
+                    let __v_249: G = (__v_248 * __v_134);
+                    let __v_250: G = G::from_u64(65536);
+                    let __v_251: G = (__v_250 * __v_135);
+                    let __v_252: G = G::from_u64(16777216);
+                    let __v_253: G = (__v_252 * __v_136);
+                    let __v_254: G = G::from_u64(4294967296);
+                    let __v_255: G = (__v_254 * __v_137);
+                    let __v_256: G = G::from_u64(1099511627776);
+                    let __v_257: G = (__v_256 * __v_138);
+                    let __v_258: G = G::from_u64(281474976710656);
+                    let __v_259: G = (__v_258 * __v_139);
+                    let __v_260: G = G::from_u64(72057594037927936);
+                    let __v_261: G = (__v_260 * __v_140);
+                    let __v_262: G = (__v_259 + __v_261);
+                    let __v_263: G = (__v_257 + __v_262);
+                    let __v_264: G = (__v_255 + __v_263);
+                    let __v_265: G = (__v_253 + __v_264);
+                    let __v_266: G = (__v_251 + __v_265);
+                    let __v_267: G = (__v_249 + __v_266);
+                    let __v_268: G = (__v_133 + __v_267);
+                    let __v_269: G = G::from_u64(256);
+                    let __v_270: G = (__v_269 * __v_142);
+                    let __v_271: G = G::from_u64(65536);
+                    let __v_272: G = (__v_271 * __v_143);
+                    let __v_273: G = G::from_u64(16777216);
+                    let __v_274: G = (__v_273 * __v_144);
+                    let __v_275: G = G::from_u64(4294967296);
+                    let __v_276: G = (__v_275 * __v_145);
+                    let __v_277: G = G::from_u64(1099511627776);
+                    let __v_278: G = (__v_277 * __v_146);
+                    let __v_279: G = G::from_u64(281474976710656);
+                    let __v_280: G = (__v_279 * __v_147);
+                    let __v_281: G = G::from_u64(72057594037927936);
+                    let __v_282: G = (__v_281 * __v_148);
+                    let __v_283: G = (__v_280 + __v_282);
+                    let __v_284: G = (__v_278 + __v_283);
+                    let __v_285: G = (__v_276 + __v_284);
+                    let __v_286: G = (__v_274 + __v_285);
+                    let __v_287: G = (__v_272 + __v_286);
+                    let __v_288: G = (__v_270 + __v_287);
+                    let __v_289: G = (__v_141 + __v_288);
+                    let __v_290: G = G::from_u64(256);
+                    let __v_291: G = (__v_290 * __v_167);
+                    let __v_292: G = G::from_u64(65536);
+                    let __v_293: G = (__v_292 * __v_168);
+                    let __v_294: G = G::from_u64(16777216);
+                    let __v_295: G = (__v_294 * __v_169);
+                    let __v_296: G = G::from_u64(4294967296);
+                    let __v_297: G = (__v_296 * __v_170);
+                    let __v_298: G = G::from_u64(1099511627776);
+                    let __v_299: G = (__v_298 * __v_171);
+                    let __v_300: G = G::from_u64(281474976710656);
+                    let __v_301: G = (__v_300 * __v_172);
+                    let __v_302: G = G::from_u64(72057594037927936);
+                    let __v_303: G = (__v_302 * __v_173);
+                    let __v_304: G = (__v_301 + __v_303);
+                    let __v_305: G = (__v_299 + __v_304);
+                    let __v_306: G = (__v_297 + __v_305);
+                    let __v_307: G = (__v_295 + __v_306);
+                    let __v_308: G = (__v_293 + __v_307);
+                    let __v_309: G = (__v_291 + __v_308);
+                    let __v_310: G = (__v_166 + __v_309);
+                    let __v_311: G = G::from_u64(256);
+                    let __v_312: G = (__v_311 * __v_175);
+                    let __v_313: G = G::from_u64(65536);
+                    let __v_314: G = (__v_313 * __v_176);
+                    let __v_315: G = G::from_u64(16777216);
+                    let __v_316: G = (__v_315 * __v_177);
+                    let __v_317: G = G::from_u64(4294967296);
+                    let __v_318: G = (__v_317 * __v_178);
+                    let __v_319: G = G::from_u64(1099511627776);
+                    let __v_320: G = (__v_319 * __v_179);
+                    let __v_321: G = G::from_u64(281474976710656);
+                    let __v_322: G = (__v_321 * __v_180);
+                    let __v_323: G = G::from_u64(72057594037927936);
+                    let __v_324: G = (__v_323 * __v_181);
+                    let __v_325: G = (__v_322 + __v_324);
+                    let __v_326: G = (__v_320 + __v_325);
+                    let __v_327: G = (__v_318 + __v_326);
+                    let __v_328: G = (__v_316 + __v_327);
+                    let __v_329: G = (__v_314 + __v_328);
+                    let __v_330: G = (__v_312 + __v_329);
+                    let __v_331: G = (__v_174 + __v_330);
+                    let __v_332: G = G::from_u64(256);
+                    let __v_333: G = (__v_332 * __v_189);
+                    let __v_334: G = G::from_u64(65536);
+                    let __v_335: G = (__v_334 * __v_190);
+                    let __v_336: G = G::from_u64(16777216);
+                    let __v_337: G = (__v_336 * __v_191);
+                    let __v_338: G = G::from_u64(4294967296);
+                    let __v_339: G = (__v_338 * __v_192);
+                    let __v_340: G = G::from_u64(1099511627776);
+                    let __v_341: G = (__v_340 * __v_193);
+                    let __v_342: G = G::from_u64(281474976710656);
+                    let __v_343: G = (__v_342 * __v_194);
+                    let __v_344: G = G::from_u64(72057594037927936);
+                    let __v_345: G = (__v_344 * __v_195);
+                    let __v_346: G = (__v_343 + __v_345);
+                    let __v_347: G = (__v_341 + __v_346);
+                    let __v_348: G = (__v_339 + __v_347);
+                    let __v_349: G = (__v_337 + __v_348);
+                    let __v_350: G = (__v_335 + __v_349);
+                    let __v_351: G = (__v_333 + __v_350);
+                    let __v_352: G = (__v_188 + __v_351);
+                    let __v_353: G = G::from_u64(256);
+                    let __v_354: G = (__v_353 * __v_197);
+                    let __v_355: G = G::from_u64(65536);
+                    let __v_356: G = (__v_355 * __v_198);
+                    let __v_357: G = G::from_u64(16777216);
+                    let __v_358: G = (__v_357 * __v_199);
+                    let __v_359: G = G::from_u64(4294967296);
+                    let __v_360: G = (__v_359 * __v_200);
+                    let __v_361: G = G::from_u64(1099511627776);
+                    let __v_362: G = (__v_361 * __v_201);
+                    let __v_363: G = G::from_u64(281474976710656);
+                    let __v_364: G = (__v_363 * __v_202);
+                    let __v_365: G = G::from_u64(72057594037927936);
+                    let __v_366: G = (__v_365 * __v_203);
+                    let __v_367: G = (__v_364 + __v_366);
+                    let __v_368: G = (__v_362 + __v_367);
+                    let __v_369: G = (__v_360 + __v_368);
+                    let __v_370: G = (__v_358 + __v_369);
+                    let __v_371: G = (__v_356 + __v_370);
+                    let __v_372: G = (__v_354 + __v_371);
+                    let __v_373: G = (__v_196 + __v_372);
+                    let __v_374: G = G::from_u64(0);
+                    let __v_375: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_374, __v_375, __v_36, __v_226, __v_247, __v_268, __v_289]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
+                    let __v_376: G = __r_arr[0];
+                    let __v_377: G = __r_arr[1];
+                    let __v_378: G = G::from_u64(0);
+                    let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_48, __v_49, __v_17, __v_16, __v_34, __v_35, __v_32, __v_33, __v_31, __v_378, __v_376, __v_377, __v_226, __v_247, __v_268, __v_289, __v_310, __v_331, __v_352, __v_373]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+                    let __v_379: G = __r_arr[0];
+                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                    let __v_380: G = __r_arr[0];
                     match __v_18.as_canonical_u64() {
                       _ => {
                         let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                        let __v_366: G = __r_arr[0];
-                        let __v_367: G = G::from_u64(1);
-                        let __v_368: G = G::from_u64(1);
-                        let __v_369: G = { let __values: [G; 3] = [__v_367, __v_368, __v_368]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_381: G = __r_arr[0];
+                        let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_19]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
+                        let __v_382: G = __r_arr[0];
+                        let __v_383: G = (__v_382 - __v_381);
+                        let __v_384: G = G::from_bool((__v_383 == G::ZERO));
+                        let __v_385: G = G::from_u64(1);
+                        if (__v_384 != __v_385) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_384.as_canonical_u64(), rhs: __v_385.as_canonical_u64(), msg: None });
+                        }
+                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_20]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                        let __v_386: G = __r_arr[0];
+                        let __v_387: G = G::from_u64(3);
+                        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                        let __v_388: G = __r_arr[0];
+                        let __v_389: G = (__v_387 + __v_388);
+                        if (__v_386 != __v_389) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_386.as_canonical_u64(), rhs: __v_389.as_canonical_u64(), msg: None });
+                        }
+                        let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
+                        let __v_390: G = __r_arr[0];
+                        let __v_391: G = (__v_390 - __v_381);
+                        let __v_392: G = G::from_bool((__v_391 == G::ZERO));
+                        let __v_393: G = G::from_u64(1);
+                        if (__v_392 != __v_393) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_392.as_canonical_u64(), rhs: __v_393.as_canonical_u64(), msg: None });
+                        }
+                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                        let __v_394: G = __r_arr[0];
+                        let __v_395: G = G::from_u64(1);
+                        if (__v_394 != __v_395) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_394.as_canonical_u64(), rhs: __v_395.as_canonical_u64(), msg: None });
+                        }
+                        let __v_396: G = G::from_u64(1);
+                        let __v_397: G = G::from_u64(1);
+                        let __v_398: G = { let __values: [G; 3] = [__v_396, __v_397, __v_397]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                         let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_32.as_canonical_u64() {
   0u64 => {
-    break '__mc_1 [__v_369];
+    break '__mc_1 [__v_398];
   },
   1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_33, __v_369]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_370: G = __r_arr[0];
-    break '__mc_1 [__v_370];
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_33, __v_398]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_399: G = __r_arr[0];
+    break '__mc_1 [__v_399];
   },
   _ => {
     return Err(ExecError::MatchNoCase(__v_32.as_canonical_u64()));
   },
 }
  };
-                        let __v_370: G = __mc_out___mc_1[0];
-                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_31, __v_370]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                        let __v_371: G = __r_arr[0];
-                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_35, __v_371]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                        let __v_372: G = __r_arr[0];
-                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_34, __v_372]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                        let __v_373: G = __r_arr[0];
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_189, __v_373]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_374: G = __r_arr[0];
-                        let __v_375: G = G::from_u64(1);
-                        let __v_376: G = G::from_u64(1);
-                        let __v_377: G = { let __values: [G; 3] = [__v_375, __v_376, __v_376]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_374, __v_377]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_378: G = __r_arr[0];
-                        let __v_379: G = __r_arr[1];
-                        let __v_380: G = __r_arr[2];
-                        let __v_381: G = __r_arr[3];
-                        let __v_382: G = __r_arr[4];
-                        let __v_383: G = __r_arr[5];
-                        let __v_384: G = __r_arr[6];
-                        let __v_385: G = __r_arr[7];
-                        let __v_386: G = __r_arr[8];
-                        let __v_387: G = __r_arr[9];
-                        let __v_388: G = __r_arr[10];
-                        let __v_389: G = __r_arr[11];
-                        let __v_390: G = __r_arr[12];
-                        let __v_391: G = __r_arr[13];
-                        let __v_392: G = __r_arr[14];
-                        let __v_393: G = __r_arr[15];
-                        let __v_394: G = __r_arr[16];
-                        let __v_395: G = __r_arr[17];
-                        let __v_396: G = G::from_u64(256);
-                        let __v_397: G = (__v_396 * __v_379);
-                        let __v_398: G = G::from_u64(65536);
-                        let __v_399: G = (__v_398 * __v_380);
-                        let __v_400: G = G::from_u64(16777216);
-                        let __v_401: G = (__v_400 * __v_381);
-                        let __v_402: G = G::from_u64(4294967296);
-                        let __v_403: G = (__v_402 * __v_382);
-                        let __v_404: G = G::from_u64(1099511627776);
-                        let __v_405: G = (__v_404 * __v_383);
-                        let __v_406: G = G::from_u64(281474976710656);
-                        let __v_407: G = (__v_406 * __v_384);
-                        let __v_408: G = G::from_u64(72057594037927936);
-                        let __v_409: G = (__v_408 * __v_385);
-                        let __v_410: G = (__v_407 + __v_409);
-                        let __v_411: G = (__v_405 + __v_410);
-                        let __v_412: G = (__v_403 + __v_411);
-                        let __v_413: G = (__v_401 + __v_412);
-                        let __v_414: G = (__v_399 + __v_413);
-                        let __v_415: G = (__v_397 + __v_414);
-                        let __v_416: G = (__v_378 + __v_415);
-                        let __v_417: G = G::from_u64(256);
-                        let __v_418: G = (__v_417 * __v_387);
-                        let __v_419: G = G::from_u64(65536);
-                        let __v_420: G = (__v_419 * __v_388);
-                        let __v_421: G = G::from_u64(16777216);
-                        let __v_422: G = (__v_421 * __v_389);
-                        let __v_423: G = G::from_u64(4294967296);
-                        let __v_424: G = (__v_423 * __v_390);
-                        let __v_425: G = G::from_u64(1099511627776);
-                        let __v_426: G = (__v_425 * __v_391);
-                        let __v_427: G = G::from_u64(281474976710656);
-                        let __v_428: G = (__v_427 * __v_392);
-                        let __v_429: G = G::from_u64(72057594037927936);
-                        let __v_430: G = (__v_429 * __v_393);
-                        let __v_431: G = (__v_428 + __v_430);
-                        let __v_432: G = (__v_426 + __v_431);
-                        let __v_433: G = (__v_424 + __v_432);
-                        let __v_434: G = (__v_422 + __v_433);
-                        let __v_435: G = (__v_420 + __v_434);
-                        let __v_436: G = (__v_418 + __v_435);
-                        let __v_437: G = (__v_386 + __v_436);
-                        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_394, __v_18, __v_19, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-                        let __v_438: G = __r_arr[0];
-                        let __v_439: G = __r_arr[1];
-                        let __v_440: G = G::from_u64(1);
-                        let __v_441: G = G::from_u64(1);
-                        let __v_442: G = { let __values: [G; 3] = [__v_440, __v_441, __v_441]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_22, __v_442]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                        let __v_443: G = __r_arr[0];
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_439, __v_443]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_444: G = __r_arr[0];
-                        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_444, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-                        let __v_445: G = __r_arr[0];
-                        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_445, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-                        let __v_446: G = __r_arr[0];
-                        let __v_447: G = __r_arr[1];
-                        let __v_448: G = (__v_366 + __v_0);
-                        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_446, __v_447, __v_4, __v_448]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-                        let __v_449: G = __r_arr[0];
-                        let __v_450: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_20, __v_21, __v_450, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-                        let __v_451: G = __r_arr[0];
-                        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_446, __v_447, __v_451, __v_416, __v_437, __v_34, __v_35, __v_31, __v_32, __v_33, __v_13, __v_14, __v_15, __v_40, __v_39, __v_17, __v_337, __v_358, __v_365, __v_0, __v_448, __v_438, __v_18, __v_22, __v_366]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-                        let __v_452: G = __r_arr[0];
-                        let __v_453: G = G::from_u64(0);
-                        if (__v_1 != __v_453) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_453.as_canonical_u64(), msg: None });
-                        }
-                        let __v_454: G = G::from_u64(0);
-                        if (__v_2 != __v_454) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_454.as_canonical_u64(), msg: None });
-                        }
-                        let __v_455: G = G::from_u64(1);
-                        if (__v_3 != __v_455) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_455.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
-                        let __v_456: G = __r_arr[0];
-                        let __v_457: G = G::from_u64(1);
-                        if (__v_456 != __v_457) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_456.as_canonical_u64(), rhs: __v_457.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_12]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                        let __v_458: G = __r_arr[0];
-                        let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                        let __v_459: G = __r_arr[0];
-                        let __v_460: G = (__v_458 - __v_459);
-                        let __v_461: G = G::from_bool((__v_460 == G::ZERO));
-                        let __v_462: G = G::from_u64(1);
-                        if (__v_461 != __v_462) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_461.as_canonical_u64(), rhs: __v_462.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                        let __v_463: G = __r_arr[0];
-                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                        let __v_464: G = __r_arr[0];
-                        let __v_465: G = (__v_463 - __v_464);
-                        let __v_466: G = G::from_bool((__v_465 == G::ZERO));
-                        let __v_467: G = G::from_u64(1);
-                        if (__v_466 != __v_467) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_466.as_canonical_u64(), rhs: __v_467.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_19]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-                        let __v_468: G = __r_arr[0];
-                        let __v_469: G = (__v_468 - __v_366);
-                        let __v_470: G = G::from_bool((__v_469 == G::ZERO));
-                        let __v_471: G = G::from_u64(1);
-                        if (__v_470 != __v_471) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_470.as_canonical_u64(), rhs: __v_471.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_20]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                        let __v_399: G = __mc_out___mc_1[0];
+                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_31, __v_399]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                        let __v_400: G = __r_arr[0];
+                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_35, __v_400]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                        let __v_401: G = __r_arr[0];
+                        let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_34, __v_401]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                        let __v_402: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_204, __v_402]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_403: G = __r_arr[0];
+                        let __v_404: G = G::from_u64(1);
+                        let __v_405: G = G::from_u64(1);
+                        let __v_406: G = { let __values: [G; 3] = [__v_404, __v_405, __v_405]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_403, __v_406]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_407: G = __r_arr[0];
+                        let __v_408: G = __r_arr[1];
+                        let __v_409: G = __r_arr[2];
+                        let __v_410: G = __r_arr[3];
+                        let __v_411: G = __r_arr[4];
+                        let __v_412: G = __r_arr[5];
+                        let __v_413: G = __r_arr[6];
+                        let __v_414: G = __r_arr[7];
+                        let __v_415: G = __r_arr[8];
+                        let __v_416: G = __r_arr[9];
+                        let __v_417: G = __r_arr[10];
+                        let __v_418: G = __r_arr[11];
+                        let __v_419: G = __r_arr[12];
+                        let __v_420: G = __r_arr[13];
+                        let __v_421: G = __r_arr[14];
+                        let __v_422: G = __r_arr[15];
+                        let __v_423: G = __r_arr[16];
+                        let __v_424: G = __r_arr[17];
+                        let __v_425: G = G::from_u64(256);
+                        let __v_426: G = (__v_425 * __v_408);
+                        let __v_427: G = G::from_u64(65536);
+                        let __v_428: G = (__v_427 * __v_409);
+                        let __v_429: G = G::from_u64(16777216);
+                        let __v_430: G = (__v_429 * __v_410);
+                        let __v_431: G = G::from_u64(4294967296);
+                        let __v_432: G = (__v_431 * __v_411);
+                        let __v_433: G = G::from_u64(1099511627776);
+                        let __v_434: G = (__v_433 * __v_412);
+                        let __v_435: G = G::from_u64(281474976710656);
+                        let __v_436: G = (__v_435 * __v_413);
+                        let __v_437: G = G::from_u64(72057594037927936);
+                        let __v_438: G = (__v_437 * __v_414);
+                        let __v_439: G = (__v_436 + __v_438);
+                        let __v_440: G = (__v_434 + __v_439);
+                        let __v_441: G = (__v_432 + __v_440);
+                        let __v_442: G = (__v_430 + __v_441);
+                        let __v_443: G = (__v_428 + __v_442);
+                        let __v_444: G = (__v_426 + __v_443);
+                        let __v_445: G = (__v_407 + __v_444);
+                        let __v_446: G = G::from_u64(256);
+                        let __v_447: G = (__v_446 * __v_416);
+                        let __v_448: G = G::from_u64(65536);
+                        let __v_449: G = (__v_448 * __v_417);
+                        let __v_450: G = G::from_u64(16777216);
+                        let __v_451: G = (__v_450 * __v_418);
+                        let __v_452: G = G::from_u64(4294967296);
+                        let __v_453: G = (__v_452 * __v_419);
+                        let __v_454: G = G::from_u64(1099511627776);
+                        let __v_455: G = (__v_454 * __v_420);
+                        let __v_456: G = G::from_u64(281474976710656);
+                        let __v_457: G = (__v_456 * __v_421);
+                        let __v_458: G = G::from_u64(72057594037927936);
+                        let __v_459: G = (__v_458 * __v_422);
+                        let __v_460: G = (__v_457 + __v_459);
+                        let __v_461: G = (__v_455 + __v_460);
+                        let __v_462: G = (__v_453 + __v_461);
+                        let __v_463: G = (__v_451 + __v_462);
+                        let __v_464: G = (__v_449 + __v_463);
+                        let __v_465: G = (__v_447 + __v_464);
+                        let __v_466: G = (__v_415 + __v_465);
+                        let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_423, __v_18, __v_19, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
+                        let __v_467: G = __r_arr[0];
+                        let __v_468: G = __r_arr[1];
+                        let __v_469: G = G::from_u64(1);
+                        let __v_470: G = G::from_u64(1);
+                        let __v_471: G = { let __values: [G; 3] = [__v_469, __v_470, __v_470]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_22, __v_471]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
                         let __v_472: G = __r_arr[0];
-                        let __v_473: G = G::from_u64(3);
-                        let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_32, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_468, __v_472]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_473: G = __r_arr[0];
+                        let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_473, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
                         let __v_474: G = __r_arr[0];
-                        let __v_475: G = (__v_473 + __v_474);
-                        if (__v_472 != __v_475) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_472.as_canonical_u64(), rhs: __v_475.as_canonical_u64(), msg: None });
+                        let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_474, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+                        let __v_475: G = __r_arr[0];
+                        let __v_476: G = __r_arr[1];
+                        let __v_477: G = (__v_381 + __v_0);
+                        let __v_478: G = G::from_u64(33);
+                        let __v_479: G = { let __a_val = __v_477.as_canonical_u64(); let __b_val = __v_478.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+                        let __v_480: G = G::from_u64(1);
+                        if (__v_479 != __v_480) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_479.as_canonical_u64(), rhs: __v_480.as_canonical_u64(), msg: None });
                         }
-                        let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
-                        let __v_476: G = __r_arr[0];
-                        let __v_477: G = (__v_476 - __v_366);
-                        let __v_478: G = G::from_bool((__v_477 == G::ZERO));
-                        let __v_479: G = G::from_u64(1);
-                        if (__v_478 != __v_479) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_478.as_canonical_u64(), rhs: __v_479.as_canonical_u64(), msg: None });
-                        }
-                        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                        let __v_480: G = __r_arr[0];
-                        let __v_481: G = G::from_u64(1);
-                        if (__v_480 != __v_481) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_480.as_canonical_u64(), rhs: __v_481.as_canonical_u64(), msg: None });
-                        }
-                        let __v_482: G = G::from_u64(33);
-                        let __v_483: G = { let __a_val = __v_448.as_canonical_u64(); let __b_val = __v_482.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-                        let __v_484: G = G::from_u64(1);
-                        if (__v_483 != __v_484) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_483.as_canonical_u64(), rhs: __v_484.as_canonical_u64(), msg: None });
+                        let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_475, __v_476, __v_4, __v_477]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+                        let __v_481: G = __r_arr[0];
+                        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_20, __v_481, __v_13, __v_14, __v_15, __v_55, __v_32, __v_33, __v_49, __v_17, __v_380, __v_0, __v_477]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                        let __v_482: G = __r_arr[0];
+                        let __v_483: G = G::from_u64(1);
+                        if (__v_482 != __v_483) {
+                          return Err(ExecError::AssertEqMismatch { lhs: __v_482.as_canonical_u64(), rhs: __v_483.as_canonical_u64(), msg: None });
                         }
-                        let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_20, __v_449, __v_13, __v_14, __v_15, __v_40, __v_32, __v_33, __v_39, __v_17, __v_365, __v_0, __v_448]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                        let __v_484: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_20, __v_21, __v_484, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
                         let __v_485: G = __r_arr[0];
-                        let __v_486: G = G::from_u64(1);
-                        if (__v_485 != __v_486) {
-                          return Err(ExecError::AssertEqMismatch { lhs: __v_485.as_canonical_u64(), rhs: __v_486.as_canonical_u64(), msg: None });
-                        }
+                        let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_475, __v_476, __v_485, __v_445, __v_466, __v_34, __v_35, __v_31, __v_32, __v_33, __v_13, __v_14, __v_15, __v_55, __v_49, __v_17, __v_352, __v_373, __v_380, __v_0, __v_477, __v_467, __v_18, __v_22, __v_381]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+                        let __v_486: G = __r_arr[0];
                         let __v_487: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_21, __v_18, __v_452, __v_449, __v_487, __v_448]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_21, __v_18, __v_486, __v_481, __v_487, __v_477]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
                         let __v_488: G = __r_arr[0];
                         let __ret: [G; OUT_199] = [__v_488];
                         record.function_queries[199].finish(&inp[..], &__ret[..], !unconstrained);
@@ -19475,10 +19475,10 @@ fn aiur_fn_201(
                 return Ok(__ret);
               },
               _ => {
-                let __v_13: G = G::from_u64(0);
                 let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_9, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-                let __v_14: G = __r_arr[0];
-                let __v_15: G = { let __values: [G; 8] = [__v_13, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_14]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_13: G = __r_arr[0];
+                let __v_14: G = G::from_u64(0);
+                let __v_15: G = { let __values: [G; 8] = [__v_14, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_13]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_201] = [__v_15];
                 record.function_queries[201].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -19539,10 +19539,10 @@ fn aiur_fn_202(
                 return Ok(__ret);
               },
               _ => {
-                let __v_9: G = G::from_u64(0);
                 let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_5, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-                let __v_10: G = __r_arr[0];
-                let __v_11: G = { let __values: [G; 4] = [__v_9, __v_3, __v_4, __v_10]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                let __v_9: G = __r_arr[0];
+                let __v_10: G = G::from_u64(0);
+                let __v_11: G = { let __values: [G; 4] = [__v_10, __v_3, __v_4, __v_9]; let __mq = record.memory_queries.get_mut(&4).ok_or(ExecError::InvalidMemorySize(4))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
                 let __ret: [G; OUT_202] = [__v_11];
                 record.function_queries[202].finish(&inp[..], &__ret[..], !unconstrained);
                 return Ok(__ret);
@@ -20323,9 +20323,9 @@ fn aiur_fn_210(
     let __v_5: G = __r_arr[0];
     let __r_arr: [G; OUT_208] = { let __args: [G; IN_208] = [__v_0, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[208].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[208].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[208].bump_multiplicity(__i); } let __ret: [G; OUT_208] = unsafe { *(record.function_queries[208].output_at(__i).as_ptr() as *const [G; OUT_208]) }; __ret }, _ => aiur_fn_208(__args, record, io_buffer, __cu)? } };
     let __v_6: G = __r_arr[0];
-    let __v_7: G = G::from_u64(0);
-    let __v_8: G = G::from_u64(1);
-    let __v_9: G = { let __values: [G; 3] = [__v_7, __v_8, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = G::from_u64(1);
+    let __v_8: G = G::from_u64(0);
+    let __v_9: G = { let __values: [G; 3] = [__v_8, __v_7, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_65] = { let __args: [G; IN_65] = [__v_9]; let __cu = unconstrained; let __hit = record.function_queries[65].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[65].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[65].bump_multiplicity(__i); } let __ret: [G; OUT_65] = unsafe { *(record.function_queries[65].output_at(__i).as_ptr() as *const [G; OUT_65]) }; __ret }, _ => aiur_fn_65(__args, record, io_buffer, __cu)? } };
     let __v_10: G = __r_arr[0];
     let __ret: [G; OUT_210] = [__v_10];
@@ -20352,7 +20352,7 @@ fn aiur_fn_211(
     let __v_4: G = __r_arr[0];
     let __v_5: G = G::from_u64(0);
     let __v_6: G = G::from_u64(0);
-    let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_7: G = { let __values: [G; 3] = [__v_6, __v_5, __v_4]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __r_arr: [G; OUT_65] = { let __args: [G; IN_65] = [__v_7]; let __cu = unconstrained; let __hit = record.function_queries[65].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[65].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[65].bump_multiplicity(__i); } let __ret: [G; OUT_65] = unsafe { *(record.function_queries[65].output_at(__i).as_ptr() as *const [G; OUT_65]) }; __ret }, _ => aiur_fn_65(__args, record, io_buffer, __cu)? } };
     let __v_8: G = __r_arr[0];
     let __ret: [G; OUT_211] = [__v_8];
@@ -20870,11 +20870,11 @@ fn aiur_fn_215(
         let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
         let __v_3: G = __r_arr[0];
         let __v_4: G = __r_arr[1];
-        let __v_5: G = G::from_u64(0);
+        let __v_5: G = G::from_u64(1);
         let __v_6: G = G::from_u64(1);
-        let __v_7: G = G::from_u64(1);
-        let __v_8: G = { let __values: [G; 3] = [__v_6, __v_7, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-        let __v_9: G = { let __values: [G; 3] = [__v_5, __v_3, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_6, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_8: G = G::from_u64(0);
+        let __v_9: G = { let __values: [G; 3] = [__v_8, __v_3, __v_7]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_215] = [__v_9, __v_4];
         record.function_queries[215].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -20932,12 +20932,12 @@ fn aiur_fn_216(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_4: G = G::from_u64(0);
         let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
+        let __v_4: G = __r_arr[0];
         let __r_arr: [G; OUT_216] = { let __args: [G; IN_216] = [__v_3]; let __cu = unconstrained; let __hit = record.function_queries[216].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[216].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[216].bump_multiplicity(__i); } let __ret: [G; OUT_216] = unsafe { *(record.function_queries[216].output_at(__i).as_ptr() as *const [G; OUT_216]) }; __ret }, _ => aiur_fn_216(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = { let __values: [G; 3] = [__v_4, __v_5, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_6, __v_4, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_216] = [__v_7];
         record.function_queries[216].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -21013,24 +21013,24 @@ fn aiur_fn_217(
             let __v_37: G = G::from_u64(0);
             let __v_38: G = G::from_u64(0);
             let __v_39: G = { let __values: [G; 32] = [__v_7, __v_8, __v_9, __v_10, __v_11, __v_12, __v_13, __v_14, __v_15, __v_16, __v_17, __v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_40: G = G::from_u64(0);
             let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_2, __v_39]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-            let __v_41: G = __r_arr[0];
+            let __v_40: G = __r_arr[0];
+            let __v_41: G = G::from_u64(1);
             let __v_42: G = G::from_u64(1);
-            let __v_43: G = G::from_u64(1);
-            let __v_44: G = { let __values: [G; 3] = [__v_42, __v_43, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-            let __v_45: G = { let __values: [G; 3] = [__v_40, __v_41, __v_44]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_43: G = { let __values: [G; 3] = [__v_41, __v_42, __v_42]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_44: G = G::from_u64(0);
+            let __v_45: G = { let __values: [G; 3] = [__v_44, __v_40, __v_43]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_217] = [__v_45];
             record.function_queries[217].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
           },
           0u64 => {
-            let __v_7: G = G::from_u64(0);
             let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_2, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-            let __v_8: G = __r_arr[0];
+            let __v_7: G = __r_arr[0];
             let __r_arr: [G; OUT_217] = { let __args: [G; IN_217] = [__v_6]; let __cu = unconstrained; let __hit = record.function_queries[217].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[217].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[217].bump_multiplicity(__i); } let __ret: [G; OUT_217] = unsafe { *(record.function_queries[217].output_at(__i).as_ptr() as *const [G; OUT_217]) }; __ret }, _ => aiur_fn_217(__args, record, io_buffer, __cu)? } };
-            let __v_9: G = __r_arr[0];
-            let __v_10: G = { let __values: [G; 3] = [__v_7, __v_8, __v_9]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+            let __v_8: G = __r_arr[0];
+            let __v_9: G = G::from_u64(0);
+            let __v_10: G = { let __values: [G; 3] = [__v_9, __v_7, __v_8]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
             let __ret: [G; OUT_217] = [__v_10];
             record.function_queries[217].finish(&inp[..], &__ret[..], !unconstrained);
             return Ok(__ret);
@@ -21167,44 +21167,44 @@ fn aiur_fn_220(
     let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_37]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
     let __v_38: G = __r_arr[0];
     let __v_39: G = __r_arr[1];
-    let __r_arr: [G; OUT_215] = { let __args: [G; IN_215] = [__v_39]; let __cu = unconstrained; let __hit = record.function_queries[215].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[215].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[215].bump_multiplicity(__i); } let __ret: [G; OUT_215] = unsafe { *(record.function_queries[215].output_at(__i).as_ptr() as *const [G; OUT_215]) }; __ret }, _ => aiur_fn_215(__args, record, io_buffer, __cu)? } };
-    let __v_40: G = __r_arr[0];
-    let __v_41: G = __r_arr[1];
-    let __r_arr: [G; OUT_214] = { let __args: [G; IN_214] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[214].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[214].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[214].bump_multiplicity(__i); } let __ret: [G; OUT_214] = unsafe { *(record.function_queries[214].output_at(__i).as_ptr() as *const [G; OUT_214]) }; __ret }, _ => aiur_fn_214(__args, record, io_buffer, __cu)? } };
-    let __r_arr: [G; OUT_219] = { let __args: [G; IN_219] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[219].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[219].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[219].bump_multiplicity(__i); } let __ret: [G; OUT_219] = unsafe { *(record.function_queries[219].output_at(__i).as_ptr() as *const [G; OUT_219]) }; __ret }, _ => aiur_fn_219(__args, record, io_buffer, __cu)? } };
-    let __v_42: G = __r_arr[0];
-    let __v_43: G = G::from_u64(226);
-    if (__v_38 != __v_43) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_43.as_canonical_u64(), msg: Some("join: tree has the wrong Ixon tag".to_string()) });
+    let __v_40: G = G::from_u64(226);
+    if (__v_38 != __v_40) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_38.as_canonical_u64(), rhs: __v_40.as_canonical_u64(), msg: Some("join: tree has the wrong Ixon tag".to_string()) });
     }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_41.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_44: G = __loaded[0];
-    let __v_45: G = __loaded[1];
-    let __v_46: G = __loaded[2];
+    let __r_arr: [G; OUT_215] = { let __args: [G; IN_215] = [__v_39]; let __cu = unconstrained; let __hit = record.function_queries[215].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[215].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[215].bump_multiplicity(__i); } let __ret: [G; OUT_215] = unsafe { *(record.function_queries[215].output_at(__i).as_ptr() as *const [G; OUT_215]) }; __ret }, _ => aiur_fn_215(__args, record, io_buffer, __cu)? } };
+    let __v_41: G = __r_arr[0];
+    let __v_42: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_42.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_43: G = __loaded[0];
+    let __v_44: G = __loaded[1];
+    let __v_45: G = __loaded[2];
+    let __v_46: G = G::from_u64(1);
     let __v_47: G = G::from_u64(1);
-    let __v_48: G = G::from_u64(1);
+    if (__v_43 != __v_46) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_43.as_canonical_u64(), rhs: __v_46.as_canonical_u64(), msg: Some("join: trailing bytes after AssumptionTree".to_string()) });
+    }
     if (__v_44 != __v_47) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_44.as_canonical_u64(), rhs: __v_47.as_canonical_u64(), msg: Some("join: trailing bytes after AssumptionTree".to_string()) });
     }
-    if (__v_45 != __v_48) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("join: trailing bytes after AssumptionTree".to_string()) });
-    }
-    if (__v_46 != __v_48) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_46.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("join: trailing bytes after AssumptionTree".to_string()) });
+    if (__v_45 != __v_47) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_45.as_canonical_u64(), rhs: __v_47.as_canonical_u64(), msg: Some("join: trailing bytes after AssumptionTree".to_string()) });
     }
-    let __r_arr: [G; OUT_251] = { let __args: [G; IN_251] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[251].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[251].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[251].bump_multiplicity(__i); } let __ret: [G; OUT_251] = unsafe { *(record.function_queries[251].output_at(__i).as_ptr() as *const [G; OUT_251]) }; __ret }, _ => aiur_fn_251(__args, record, io_buffer, __cu)? } };
-    let __v_49: G = __r_arr[0];
-    let __v_50: G = G::from_u64(0);
-    if (__v_49 != __v_50) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_49.as_canonical_u64(), rhs: __v_50.as_canonical_u64(), msg: Some("join: a present tree must contain at least one leaf".to_string()) });
+    let __r_arr: [G; OUT_251] = { let __args: [G; IN_251] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[251].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[251].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[251].bump_multiplicity(__i); } let __ret: [G; OUT_251] = unsafe { *(record.function_queries[251].output_at(__i).as_ptr() as *const [G; OUT_251]) }; __ret }, _ => aiur_fn_251(__args, record, io_buffer, __cu)? } };
+    let __v_48: G = __r_arr[0];
+    let __v_49: G = G::from_u64(0);
+    if (__v_48 != __v_49) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_48.as_canonical_u64(), rhs: __v_49.as_canonical_u64(), msg: Some("join: a present tree must contain at least one leaf".to_string()) });
     }
-    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_42, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_214] = { let __args: [G; IN_214] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[214].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[214].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[214].bump_multiplicity(__i); } let __ret: [G; OUT_214] = unsafe { *(record.function_queries[214].output_at(__i).as_ptr() as *const [G; OUT_214]) }; __ret }, _ => aiur_fn_214(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_219] = { let __args: [G; IN_219] = [__v_41]; let __cu = unconstrained; let __hit = record.function_queries[219].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[219].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[219].bump_multiplicity(__i); } let __ret: [G; OUT_219] = unsafe { *(record.function_queries[219].output_at(__i).as_ptr() as *const [G; OUT_219]) }; __ret }, _ => aiur_fn_219(__args, record, io_buffer, __cu)? } };
+    let __v_50: G = __r_arr[0];
+    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_50, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
     let __v_51: G = __r_arr[0];
     let __v_52: G = G::from_u64(1);
     if (__v_51 != __v_52) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_51.as_canonical_u64(), rhs: __v_52.as_canonical_u64(), msg: Some("join: tree leaves do not reproduce the canonical root".to_string()) });
     }
-    let __ret: [G; OUT_220] = [__v_40];
+    let __ret: [G; OUT_220] = [__v_41];
     record.function_queries[220].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -21652,32 +21652,32 @@ fn aiur_fn_227(
         let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
         let __v_3: G = __r_arr[0];
         let __v_4: G = __r_arr[1];
+        let __v_5: G = G::from_u64(2);
+        let __v_6: G = if unconstrained { Bytes2::less_than(&__v_3, &__v_5) } else { bytes2_less_than_value(__v_3, __v_5, record) };
+        let __v_7: G = G::from_u64(1);
+        if (__v_6 != __v_7) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_6.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("structural join: path side must be 0 or 1".to_string()) });
+        }
         let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-        let __v_5: G = __r_arr[0];
-        let __v_6: G = __r_arr[1];
+        let __v_8: G = __r_arr[0];
+        let __v_9: G = __r_arr[1];
         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_3.as_canonical_u64() {
   0u64 => {
-    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_5, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    break '__mc_0 [__v_7];
+    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_8, __v_0]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
+    let __v_10: G = __r_arr[0];
+    break '__mc_0 [__v_10];
   },
   _ => {
-    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_0, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
-    let __v_7: G = __r_arr[0];
-    break '__mc_0 [__v_7];
+    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_0, __v_8]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
+    let __v_10: G = __r_arr[0];
+    break '__mc_0 [__v_10];
   },
 }
  };
-        let __v_7: G = __mc_out___mc_0[0];
-        let __v_8: G = G::from_u64(2);
-        let __v_9: G = if unconstrained { Bytes2::less_than(&__v_3, &__v_8) } else { bytes2_less_than_value(__v_3, __v_8, record) };
-        let __v_10: G = G::from_u64(1);
-        if (__v_9 != __v_10) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_9.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("structural join: path side must be 0 or 1".to_string()) });
-        }
+        let __v_10: G = __mc_out___mc_0[0];
         let __v_11: G = G::from_u64(1);
         let __v_12: G = (__v_1 - __v_11);
-        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_7, __v_12, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_10, __v_12, __v_9]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
         let __v_13: G = __r_arr[0];
         let __v_14: G = __r_arr[1];
         let __ret: [G; OUT_227] = [__v_13, __v_14];
@@ -21775,18 +21775,18 @@ fn aiur_fn_228(
         let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
         let __v_44: G = __r_arr[0];
         let __v_45: G = __r_arr[1];
-        let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
-        let __v_46: G = __r_arr[0];
-        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_46, __v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
-        let __v_47: G = __r_arr[0];
-        let __v_48: G = __r_arr[1];
-        let __v_49: G = G::from_u64(65);
-        let __v_50: G = if unconstrained { Bytes2::less_than(&__v_44, &__v_49) } else { bytes2_less_than_value(__v_44, __v_49, record) };
-        let __v_51: G = G::from_u64(1);
-        if (__v_50 != __v_51) {
-          return Err(ExecError::AssertEqMismatch { lhs: __v_50.as_canonical_u64(), rhs: __v_51.as_canonical_u64(), msg: Some("structural join: Merkle path exceeds 64 steps".to_string()) });
+        let __v_46: G = G::from_u64(65);
+        let __v_47: G = if unconstrained { Bytes2::less_than(&__v_44, &__v_46) } else { bytes2_less_than_value(__v_44, __v_46, record) };
+        let __v_48: G = G::from_u64(1);
+        if (__v_47 != __v_48) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_47.as_canonical_u64(), rhs: __v_48.as_canonical_u64(), msg: Some("structural join: Merkle path exceeds 64 steps".to_string()) });
         }
-        let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_48.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+        let __r_arr: [G; OUT_211] = { let __args: [G; IN_211] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[211].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[211].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[211].bump_multiplicity(__i); } let __ret: [G; OUT_211] = unsafe { *(record.function_queries[211].output_at(__i).as_ptr() as *const [G; OUT_211]) }; __ret }, _ => aiur_fn_211(__args, record, io_buffer, __cu)? } };
+        let __v_49: G = __r_arr[0];
+        let __r_arr: [G; OUT_227] = { let __args: [G; IN_227] = [__v_49, __v_44, __v_45]; let __cu = unconstrained; let __hit = record.function_queries[227].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[227].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[227].bump_multiplicity(__i); } let __ret: [G; OUT_227] = unsafe { *(record.function_queries[227].output_at(__i).as_ptr() as *const [G; OUT_227]) }; __ret }, _ => aiur_fn_227(__args, record, io_buffer, __cu)? } };
+        let __v_50: G = __r_arr[0];
+        let __v_51: G = __r_arr[1];
+        let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_51.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
         let __v_52: G = __loaded[0];
         let __v_53: G = __loaded[1];
         let __v_54: G = __loaded[2];
@@ -21801,7 +21801,7 @@ fn aiur_fn_228(
         if (__v_54 != __v_56) {
           return Err(ExecError::AssertEqMismatch { lhs: __v_54.as_canonical_u64(), rhs: __v_56.as_canonical_u64(), msg: Some("structural join: trailing bytes after Merkle path".to_string()) });
         }
-        let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_47, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+        let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_50, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
         let __v_57: G = __r_arr[0];
         let __v_58: G = G::from_u64(1);
         if (__v_57 != __v_58) {
@@ -21950,18 +21950,18 @@ fn aiur_fn_231(
     let __r_arr: [G; OUT_77] = { let __args: [G; IN_77] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[77].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[77].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[77].bump_multiplicity(__i); } let __ret: [G; OUT_77] = unsafe { *(record.function_queries[77].output_at(__i).as_ptr() as *const [G; OUT_77]) }; __ret }, _ => aiur_fn_77(__args, record, io_buffer, __cu)? } };
     let __v_1: G = __r_arr[0];
     let __v_2: G = __r_arr[1];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_3: G = __r_arr[0];
-    let __v_4: G = __r_arr[1];
-    let __r_arr: [G; OUT_230] = { let __args: [G; IN_230] = [__v_4]; let __cu = unconstrained; let __hit = record.function_queries[230].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[230].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[230].bump_multiplicity(__i); } let __ret: [G; OUT_230] = unsafe { *(record.function_queries[230].output_at(__i).as_ptr() as *const [G; OUT_230]) }; __ret }, _ => aiur_fn_230(__args, record, io_buffer, __cu)? } };
-    let __v_5: G = __r_arr[0];
-    let __v_6: G = __r_arr[1];
-    let __v_7: G = __r_arr[2];
-    let __v_8: G = G::from_u64(229);
-    if (__v_1 != __v_8) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("join: child claim is not CheckEnv".to_string()) });
+    let __v_3: G = G::from_u64(229);
+    if (__v_1 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("join: child claim is not CheckEnv".to_string()) });
     }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_7.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_2]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_4: G = __r_arr[0];
+    let __v_5: G = __r_arr[1];
+    let __r_arr: [G; OUT_230] = { let __args: [G; IN_230] = [__v_5]; let __cu = unconstrained; let __hit = record.function_queries[230].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[230].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[230].bump_multiplicity(__i); } let __ret: [G; OUT_230] = unsafe { *(record.function_queries[230].output_at(__i).as_ptr() as *const [G; OUT_230]) }; __ret }, _ => aiur_fn_230(__args, record, io_buffer, __cu)? } };
+    let __v_6: G = __r_arr[0];
+    let __v_7: G = __r_arr[1];
+    let __v_8: G = __r_arr[2];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_8.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
     let __v_9: G = __loaded[0];
     let __v_10: G = __loaded[1];
     let __v_11: G = __loaded[2];
@@ -21976,7 +21976,7 @@ fn aiur_fn_231(
     if (__v_11 != __v_13) {
       return Err(ExecError::AssertEqMismatch { lhs: __v_11.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("join: trailing bytes after CheckEnv claim".to_string()) });
     }
-    let __ret: [G; OUT_231] = [__v_3, __v_5, __v_6];
+    let __ret: [G; OUT_231] = [__v_4, __v_6, __v_7];
     record.function_queries[231].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
   })
@@ -22487,41 +22487,129 @@ fn aiur_fn_237(
     let __r_arr: [G; OUT_47] = { let __args: [G; IN_47] = [__v_63]; let __cu = unconstrained; let __hit = record.function_queries[47].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[47].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[47].bump_multiplicity(__i); } let __ret: [G; OUT_47] = unsafe { *(record.function_queries[47].output_at(__i).as_ptr() as *const [G; OUT_47]) }; __ret }, _ => aiur_fn_47(__args, record, io_buffer, __cu)? } };
     let __v_64: G = __r_arr[0];
     let __v_65: G = __r_arr[1];
-    let __v_66: G = G::from_u64(2);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_12]; let __info = io_buffer.get_info(__v_66, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_67: G = __io_pair.0;
-    let __v_68: G = __io_pair.1;
-    let __v_69: G = G::from_u64(2);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_69, __v_67, __v_68]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_70: G = __r_arr[0];
-    let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_70]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
+    let __v_66: G = (__v_14 + __v_15);
+    if (__v_65 != __v_66) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_65.as_canonical_u64(), rhs: __v_66.as_canonical_u64(), msg: None });
+    }
+    let __v_67: G = G::from_u64(2);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_12]; let __info = io_buffer.get_info(__v_67, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_68: G = __io_pair.0;
+    let __v_69: G = __io_pair.1;
+    let __v_70: G = G::from_u64(2);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_70, __v_68, __v_69]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
     let __v_71: G = __r_arr[0];
-    let __v_72: G = __r_arr[1];
-    let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_72, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
-    let __v_73: G = __r_arr[0];
-    let __v_74: G = __r_arr[1];
+    let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_71]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
+    let __v_72: G = __r_arr[0];
+    let __v_73: G = __r_arr[1];
+    let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_73, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
+    let __v_74: G = __r_arr[0];
+    let __v_75: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_75.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_76: G = __loaded[0];
+    let __v_77: G = __loaded[1];
+    let __v_78: G = __loaded[2];
+    let __v_79: G = G::from_u64(1);
+    let __v_80: G = G::from_u64(1);
+    if (__v_76 != __v_79) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_76.as_canonical_u64(), rhs: __v_79.as_canonical_u64(), msg: None });
+    }
+    if (__v_77 != __v_80) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_77.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
+    }
+    if (__v_78 != __v_80) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_78.as_canonical_u64(), rhs: __v_80.as_canonical_u64(), msg: None });
+    }
     match __v_18.as_canonical_u64() {
       _ => {
         let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-        let __v_75: G = __r_arr[0];
+        let __v_81: G = __r_arr[0];
+        let __v_82: G = G::from_bool((__v_81 == G::ZERO));
+        let __v_83: G = G::from_u64(0);
+        if (__v_82 != __v_83) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_82.as_canonical_u64(), rhs: __v_83.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_62]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_84: G = __r_arr[0];
+        if (__v_84 != __v_81) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_84.as_canonical_u64(), rhs: __v_81.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_64]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_85: G = __r_arr[0];
+        if (__v_85 != __v_81) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_85.as_canonical_u64(), rhs: __v_81.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_57]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_86: G = __r_arr[0];
+        if (__v_86 != __v_81) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_86.as_canonical_u64(), rhs: __v_81.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_161] = { let __args: [G; IN_161] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[161].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[161].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[161].bump_multiplicity(__i); } let __ret: [G; OUT_161] = unsafe { *(record.function_queries[161].output_at(__i).as_ptr() as *const [G; OUT_161]) }; __ret }, _ => aiur_fn_161(__args, record, io_buffer, __cu)? } };
+        let __v_87: G = __r_arr[0];
+        let __v_88: G = G::from_u64(1);
+        if (__v_87 != __v_88) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_87.as_canonical_u64(), rhs: __v_88.as_canonical_u64(), msg: None });
+        }
+        let __v_89: G = G::from_u64(1);
+        let __v_90: G = G::from_u64(1);
+        if (__v_89 != __v_90) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_89.as_canonical_u64(), rhs: __v_90.as_canonical_u64(), msg: None });
+        }
         match __v_0.as_canonical_u64() {
           _ => {
             match __v_0.as_canonical_u64() {
               _ => {
+                let __v_91: G = G::from_u64(0);
+                if (__v_1 != __v_91) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_91.as_canonical_u64(), msg: None });
+                }
+                let __v_92: G = G::from_u64(0);
+                if (__v_2 != __v_92) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_92.as_canonical_u64(), msg: None });
+                }
+                let __v_93: G = G::from_u64(1);
+                if (__v_3 != __v_93) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_93.as_canonical_u64(), msg: None });
+                }
                 match __v_18.as_canonical_u64() {
                   _ => {
+                    let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
+                    let __v_94: G = __r_arr[0];
+                    let __v_95: G = G::from_u64(1);
+                    if (__v_94 != __v_95) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_94.as_canonical_u64(), rhs: __v_95.as_canonical_u64(), msg: None });
+                    }
+                    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                    let __v_96: G = __r_arr[0];
+                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                    let __v_97: G = __r_arr[0];
+                    let __v_98: G = (__v_96 - __v_97);
+                    let __v_99: G = G::from_bool((__v_98 == G::ZERO));
+                    let __v_100: G = G::from_u64(1);
+                    if (__v_99 != __v_100) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_99.as_canonical_u64(), rhs: __v_100.as_canonical_u64(), msg: None });
+                    }
                     let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_8, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-                    let __v_76: G = __r_arr[0];
+                    let __v_101: G = __r_arr[0];
                     let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_11, __v_18]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-                    let __v_77: G = __r_arr[0];
+                    let __v_102: G = __r_arr[0];
+                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_101]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                    let __v_103: G = __r_arr[0];
+                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                    let __v_104: G = __r_arr[0];
+                    let __v_105: G = (__v_103 - __v_104);
+                    let __v_106: G = G::from_bool((__v_105 == G::ZERO));
+                    let __v_107: G = G::from_u64(1);
+                    if (__v_106 != __v_107) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_106.as_canonical_u64(), rhs: __v_107.as_canonical_u64(), msg: None });
+                    }
                     match __v_20.as_canonical_u64() {
                       _ => {
                         let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_9.as_canonical_u64() {
   0u64 => {
-    let __v_78: G = G::from_u64(1);
-    let __v_79: G = G::from_u64(1);
-    let __v_80: G = { let __values: [G; 3] = [__v_78, __v_79, __v_79]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_0 [__v_80];
+    let __v_108: G = G::from_u64(1);
+    let __v_109: G = G::from_u64(1);
+    let __v_110: G = { let __values: [G; 3] = [__v_108, __v_109, __v_109]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_110];
   },
   1u64 => {
     break '__mc_0 [__v_10];
@@ -22531,610 +22619,522 @@ fn aiur_fn_237(
   },
 }
  };
-                        let __v_78: G = __mc_out___mc_0[0];
-                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_30, __v_70]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                        let __v_79: G = __r_arr[0];
-                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_20, __v_79]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                        let __v_80: G = __r_arr[0];
-                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_78, __v_80]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                        let __v_81: G = __r_arr[0];
-                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_18, __v_81]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                        let __v_82: G = __r_arr[0];
-                        let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_82]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
-                        let __v_83: G = __r_arr[0];
-                        let __v_84: G = G::from_u64(0);
-                        let __v_85: G = G::from_u64(109);
-                        let __v_86: G = G::from_u64(0);
-                        let __v_87: G = G::from_u64(117);
-                        let __v_88: G = G::from_u64(0);
-                        let __v_89: G = G::from_u64(108);
-                        let __v_90: G = G::from_u64(0);
-                        let __v_91: G = G::from_u64(116);
-                        let __v_92: G = G::from_u64(0);
-                        let __v_93: G = G::from_u64(105);
-                        let __v_94: G = G::from_u64(0);
-                        let __v_95: G = G::from_u64(45);
-                        let __v_96: G = G::from_u64(0);
-                        let __v_97: G = G::from_u64(115);
-                        let __v_98: G = G::from_u64(0);
-                        let __v_99: G = G::from_u64(116);
-                        let __v_100: G = G::from_u64(0);
-                        let __v_101: G = G::from_u64(97);
-                        let __v_102: G = G::from_u64(0);
-                        let __v_103: G = G::from_u64(114);
-                        let __v_104: G = G::from_u64(0);
-                        let __v_105: G = G::from_u64(107);
-                        let __v_106: G = G::from_u64(0);
-                        let __v_107: G = G::from_u64(47);
-                        let __v_108: G = G::from_u64(0);
-                        let __v_109: G = G::from_u64(118);
-                        let __v_110: G = G::from_u64(0);
-                        let __v_111: G = G::from_u64(48);
-                        let __v_112: G = { let __values: [G; 3] = [__v_110, __v_111, __v_83]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_113: G = { let __values: [G; 3] = [__v_108, __v_109, __v_112]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_114: G = { let __values: [G; 3] = [__v_106, __v_107, __v_113]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_115: G = { let __values: [G; 3] = [__v_104, __v_105, __v_114]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_116: G = { let __values: [G; 3] = [__v_102, __v_103, __v_115]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_117: G = { let __values: [G; 3] = [__v_100, __v_101, __v_116]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_118: G = { let __values: [G; 3] = [__v_98, __v_99, __v_117]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_119: G = { let __values: [G; 3] = [__v_96, __v_97, __v_118]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_120: G = { let __values: [G; 3] = [__v_94, __v_95, __v_119]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_121: G = { let __values: [G; 3] = [__v_92, __v_93, __v_120]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_122: G = { let __values: [G; 3] = [__v_90, __v_91, __v_121]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_123: G = { let __values: [G; 3] = [__v_88, __v_89, __v_122]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_124: G = { let __values: [G; 3] = [__v_86, __v_87, __v_123]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_125: G = { let __values: [G; 3] = [__v_84, __v_85, __v_124]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __v_126: G = G::from_u64(1);
-                        let __v_127: G = G::from_u64(1);
-                        let __v_128: G = { let __values: [G; 3] = [__v_126, __v_127, __v_127]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_125, __v_128]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_129: G = __r_arr[0];
-                        let __v_130: G = __r_arr[1];
-                        let __v_131: G = __r_arr[2];
-                        let __v_132: G = __r_arr[3];
-                        let __v_133: G = __r_arr[4];
-                        let __v_134: G = __r_arr[5];
-                        let __v_135: G = __r_arr[6];
-                        let __v_136: G = __r_arr[7];
-                        let __v_137: G = __r_arr[8];
-                        let __v_138: G = __r_arr[9];
-                        let __v_139: G = __r_arr[10];
-                        let __v_140: G = __r_arr[11];
-                        let __v_141: G = __r_arr[12];
-                        let __v_142: G = __r_arr[13];
-                        let __v_143: G = __r_arr[14];
-                        let __v_144: G = __r_arr[15];
-                        let __v_145: G = __r_arr[16];
-                        let __v_146: G = __r_arr[17];
-                        let __v_147: G = G::from_u64(1);
-                        let __v_148: G = G::from_u64(1);
-                        let __v_149: G = { let __values: [G; 3] = [__v_147, __v_148, __v_148]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_137, __v_138, __v_139, __v_140, __v_141, __v_142, __v_143, __v_144, __v_149]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_150: G = __r_arr[0];
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_129, __v_130, __v_131, __v_132, __v_133, __v_134, __v_135, __v_136, __v_150]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_151: G = __r_arr[0];
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_145, __v_151]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_152: G = __r_arr[0];
-                        let __v_153: G = G::from_u64(1);
-                        let __v_154: G = G::from_u64(1);
-                        let __v_155: G = { let __values: [G; 3] = [__v_153, __v_154, __v_154]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_152, __v_155]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_156: G = __r_arr[0];
-                        let __v_157: G = __r_arr[1];
-                        let __v_158: G = __r_arr[2];
-                        let __v_159: G = __r_arr[3];
-                        let __v_160: G = __r_arr[4];
-                        let __v_161: G = __r_arr[5];
-                        let __v_162: G = __r_arr[6];
-                        let __v_163: G = __r_arr[7];
-                        let __v_164: G = __r_arr[8];
-                        let __v_165: G = __r_arr[9];
-                        let __v_166: G = __r_arr[10];
-                        let __v_167: G = __r_arr[11];
-                        let __v_168: G = __r_arr[12];
-                        let __v_169: G = __r_arr[13];
-                        let __v_170: G = __r_arr[14];
-                        let __v_171: G = __r_arr[15];
-                        let __v_172: G = __r_arr[16];
-                        let __v_173: G = __r_arr[17];
-                        let __v_174: G = G::from_u64(1);
-                        let __v_175: G = G::from_u64(1);
-                        let __v_176: G = { let __values: [G; 3] = [__v_174, __v_175, __v_175]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_164, __v_165, __v_166, __v_167, __v_168, __v_169, __v_170, __v_171, __v_176]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_177: G = __r_arr[0];
-                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_156, __v_157, __v_158, __v_159, __v_160, __v_161, __v_162, __v_163, __v_177]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                        let __v_178: G = __r_arr[0];
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_172, __v_178]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_179: G = __r_arr[0];
-                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_179, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_108: G = __mc_out___mc_0[0];
+                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_30, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                        let __v_109: G = __r_arr[0];
+                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_20, __v_109]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                        let __v_110: G = __r_arr[0];
+                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_108, __v_110]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                        let __v_111: G = __r_arr[0];
+                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_18, __v_111]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                        let __v_112: G = __r_arr[0];
+                        let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_7, __v_112]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
+                        let __v_113: G = __r_arr[0];
+                        let __v_114: G = G::from_u64(109);
+                        let __v_115: G = G::from_u64(117);
+                        let __v_116: G = G::from_u64(108);
+                        let __v_117: G = G::from_u64(116);
+                        let __v_118: G = G::from_u64(105);
+                        let __v_119: G = G::from_u64(45);
+                        let __v_120: G = G::from_u64(115);
+                        let __v_121: G = G::from_u64(116);
+                        let __v_122: G = G::from_u64(97);
+                        let __v_123: G = G::from_u64(114);
+                        let __v_124: G = G::from_u64(107);
+                        let __v_125: G = G::from_u64(47);
+                        let __v_126: G = G::from_u64(118);
+                        let __v_127: G = G::from_u64(48);
+                        let __v_128: G = G::from_u64(0);
+                        let __v_129: G = { let __values: [G; 3] = [__v_128, __v_127, __v_113]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_130: G = G::from_u64(0);
+                        let __v_131: G = { let __values: [G; 3] = [__v_130, __v_126, __v_129]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_132: G = G::from_u64(0);
+                        let __v_133: G = { let __values: [G; 3] = [__v_132, __v_125, __v_131]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_134: G = G::from_u64(0);
+                        let __v_135: G = { let __values: [G; 3] = [__v_134, __v_124, __v_133]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_136: G = G::from_u64(0);
+                        let __v_137: G = { let __values: [G; 3] = [__v_136, __v_123, __v_135]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_138: G = G::from_u64(0);
+                        let __v_139: G = { let __values: [G; 3] = [__v_138, __v_122, __v_137]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_140: G = G::from_u64(0);
+                        let __v_141: G = { let __values: [G; 3] = [__v_140, __v_121, __v_139]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_142: G = G::from_u64(0);
+                        let __v_143: G = { let __values: [G; 3] = [__v_142, __v_120, __v_141]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_144: G = G::from_u64(0);
+                        let __v_145: G = { let __values: [G; 3] = [__v_144, __v_119, __v_143]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_146: G = G::from_u64(0);
+                        let __v_147: G = { let __values: [G; 3] = [__v_146, __v_118, __v_145]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_148: G = G::from_u64(0);
+                        let __v_149: G = { let __values: [G; 3] = [__v_148, __v_117, __v_147]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_150: G = G::from_u64(0);
+                        let __v_151: G = { let __values: [G; 3] = [__v_150, __v_116, __v_149]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_152: G = G::from_u64(0);
+                        let __v_153: G = { let __values: [G; 3] = [__v_152, __v_115, __v_151]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_154: G = G::from_u64(0);
+                        let __v_155: G = { let __values: [G; 3] = [__v_154, __v_114, __v_153]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_156: G = G::from_u64(1);
+                        let __v_157: G = G::from_u64(1);
+                        let __v_158: G = { let __values: [G; 3] = [__v_156, __v_157, __v_157]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_155, __v_158]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_159: G = __r_arr[0];
+                        let __v_160: G = __r_arr[1];
+                        let __v_161: G = __r_arr[2];
+                        let __v_162: G = __r_arr[3];
+                        let __v_163: G = __r_arr[4];
+                        let __v_164: G = __r_arr[5];
+                        let __v_165: G = __r_arr[6];
+                        let __v_166: G = __r_arr[7];
+                        let __v_167: G = __r_arr[8];
+                        let __v_168: G = __r_arr[9];
+                        let __v_169: G = __r_arr[10];
+                        let __v_170: G = __r_arr[11];
+                        let __v_171: G = __r_arr[12];
+                        let __v_172: G = __r_arr[13];
+                        let __v_173: G = __r_arr[14];
+                        let __v_174: G = __r_arr[15];
+                        let __v_175: G = __r_arr[16];
+                        let __v_176: G = __r_arr[17];
+                        let __v_177: G = G::from_u64(1);
+                        let __v_178: G = G::from_u64(1);
+                        let __v_179: G = { let __values: [G; 3] = [__v_177, __v_178, __v_178]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_167, __v_168, __v_169, __v_170, __v_171, __v_172, __v_173, __v_174, __v_179]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
                         let __v_180: G = __r_arr[0];
-                        let __v_181: G = G::from_u64(1);
-                        let __v_182: G = G::from_u64(1);
-                        let __v_183: G = { let __values: [G; 3] = [__v_181, __v_182, __v_182]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_26, __v_183]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                        let __v_184: G = __r_arr[0];
-                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_180, __v_184]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                        let __v_185: G = __r_arr[0];
-                        let __v_186: G = G::from_u64(1);
-                        let __v_187: G = G::from_u64(1);
-                        let __v_188: G = { let __values: [G; 3] = [__v_186, __v_187, __v_187]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_185, __v_188]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_189: G = __r_arr[0];
-                        let __v_190: G = __r_arr[1];
-                        let __v_191: G = __r_arr[2];
-                        let __v_192: G = __r_arr[3];
-                        let __v_193: G = __r_arr[4];
-                        let __v_194: G = __r_arr[5];
-                        let __v_195: G = __r_arr[6];
-                        let __v_196: G = __r_arr[7];
-                        let __v_197: G = __r_arr[8];
-                        let __v_198: G = __r_arr[9];
-                        let __v_199: G = __r_arr[10];
-                        let __v_200: G = __r_arr[11];
-                        let __v_201: G = __r_arr[12];
-                        let __v_202: G = __r_arr[13];
-                        let __v_203: G = __r_arr[14];
-                        let __v_204: G = __r_arr[15];
-                        let __v_205: G = __r_arr[16];
-                        let __v_206: G = __r_arr[17];
-                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_205, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_159, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_180]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_181: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_175, __v_181]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_182: G = __r_arr[0];
+                        let __v_183: G = G::from_u64(1);
+                        let __v_184: G = G::from_u64(1);
+                        let __v_185: G = { let __values: [G; 3] = [__v_183, __v_184, __v_184]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_182, __v_185]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_186: G = __r_arr[0];
+                        let __v_187: G = __r_arr[1];
+                        let __v_188: G = __r_arr[2];
+                        let __v_189: G = __r_arr[3];
+                        let __v_190: G = __r_arr[4];
+                        let __v_191: G = __r_arr[5];
+                        let __v_192: G = __r_arr[6];
+                        let __v_193: G = __r_arr[7];
+                        let __v_194: G = __r_arr[8];
+                        let __v_195: G = __r_arr[9];
+                        let __v_196: G = __r_arr[10];
+                        let __v_197: G = __r_arr[11];
+                        let __v_198: G = __r_arr[12];
+                        let __v_199: G = __r_arr[13];
+                        let __v_200: G = __r_arr[14];
+                        let __v_201: G = __r_arr[15];
+                        let __v_202: G = __r_arr[16];
+                        let __v_203: G = __r_arr[17];
+                        let __v_204: G = G::from_u64(1);
+                        let __v_205: G = G::from_u64(1);
+                        let __v_206: G = { let __values: [G; 3] = [__v_204, __v_205, __v_205]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_194, __v_195, __v_196, __v_197, __v_198, __v_199, __v_200, __v_201, __v_206]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
                         let __v_207: G = __r_arr[0];
-                        let __v_208: G = G::from_u64(1);
-                        let __v_209: G = G::from_u64(1);
-                        let __v_210: G = { let __values: [G; 3] = [__v_208, __v_209, __v_209]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_207, __v_210]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                        let __v_211: G = __r_arr[0];
-                        let __v_212: G = __r_arr[1];
-                        let __v_213: G = __r_arr[2];
-                        let __v_214: G = __r_arr[3];
-                        let __v_215: G = __r_arr[4];
-                        let __v_216: G = __r_arr[5];
-                        let __v_217: G = __r_arr[6];
-                        let __v_218: G = __r_arr[7];
-                        let __v_219: G = __r_arr[8];
-                        let __v_220: G = __r_arr[9];
-                        let __v_221: G = __r_arr[10];
-                        let __v_222: G = __r_arr[11];
-                        let __v_223: G = __r_arr[12];
-                        let __v_224: G = __r_arr[13];
-                        let __v_225: G = __r_arr[14];
-                        let __v_226: G = __r_arr[15];
-                        let __v_227: G = __r_arr[16];
-                        let __v_228: G = __r_arr[17];
-                        let __v_229: G = G::from_u64(256);
-                        let __v_230: G = (__v_229 * __v_130);
-                        let __v_231: G = G::from_u64(65536);
-                        let __v_232: G = (__v_231 * __v_131);
-                        let __v_233: G = G::from_u64(16777216);
-                        let __v_234: G = (__v_233 * __v_132);
-                        let __v_235: G = G::from_u64(4294967296);
-                        let __v_236: G = (__v_235 * __v_133);
-                        let __v_237: G = G::from_u64(1099511627776);
-                        let __v_238: G = (__v_237 * __v_134);
-                        let __v_239: G = G::from_u64(281474976710656);
-                        let __v_240: G = (__v_239 * __v_135);
-                        let __v_241: G = G::from_u64(72057594037927936);
-                        let __v_242: G = (__v_241 * __v_136);
-                        let __v_243: G = (__v_240 + __v_242);
-                        let __v_244: G = (__v_238 + __v_243);
-                        let __v_245: G = (__v_236 + __v_244);
-                        let __v_246: G = (__v_234 + __v_245);
-                        let __v_247: G = (__v_232 + __v_246);
-                        let __v_248: G = (__v_230 + __v_247);
-                        let __v_249: G = (__v_129 + __v_248);
-                        let __v_250: G = G::from_u64(256);
-                        let __v_251: G = (__v_250 * __v_138);
-                        let __v_252: G = G::from_u64(65536);
-                        let __v_253: G = (__v_252 * __v_139);
-                        let __v_254: G = G::from_u64(16777216);
-                        let __v_255: G = (__v_254 * __v_140);
-                        let __v_256: G = G::from_u64(4294967296);
-                        let __v_257: G = (__v_256 * __v_141);
-                        let __v_258: G = G::from_u64(1099511627776);
-                        let __v_259: G = (__v_258 * __v_142);
-                        let __v_260: G = G::from_u64(281474976710656);
-                        let __v_261: G = (__v_260 * __v_143);
-                        let __v_262: G = G::from_u64(72057594037927936);
-                        let __v_263: G = (__v_262 * __v_144);
-                        let __v_264: G = (__v_261 + __v_263);
-                        let __v_265: G = (__v_259 + __v_264);
-                        let __v_266: G = (__v_257 + __v_265);
-                        let __v_267: G = (__v_255 + __v_266);
-                        let __v_268: G = (__v_253 + __v_267);
-                        let __v_269: G = (__v_251 + __v_268);
-                        let __v_270: G = (__v_137 + __v_269);
-                        let __v_271: G = G::from_u64(256);
-                        let __v_272: G = (__v_271 * __v_157);
-                        let __v_273: G = G::from_u64(65536);
-                        let __v_274: G = (__v_273 * __v_158);
-                        let __v_275: G = G::from_u64(16777216);
-                        let __v_276: G = (__v_275 * __v_159);
-                        let __v_277: G = G::from_u64(4294967296);
-                        let __v_278: G = (__v_277 * __v_160);
-                        let __v_279: G = G::from_u64(1099511627776);
-                        let __v_280: G = (__v_279 * __v_161);
-                        let __v_281: G = G::from_u64(281474976710656);
-                        let __v_282: G = (__v_281 * __v_162);
-                        let __v_283: G = G::from_u64(72057594037927936);
-                        let __v_284: G = (__v_283 * __v_163);
-                        let __v_285: G = (__v_282 + __v_284);
-                        let __v_286: G = (__v_280 + __v_285);
-                        let __v_287: G = (__v_278 + __v_286);
-                        let __v_288: G = (__v_276 + __v_287);
-                        let __v_289: G = (__v_274 + __v_288);
-                        let __v_290: G = (__v_272 + __v_289);
-                        let __v_291: G = (__v_156 + __v_290);
-                        let __v_292: G = G::from_u64(256);
-                        let __v_293: G = (__v_292 * __v_165);
-                        let __v_294: G = G::from_u64(65536);
-                        let __v_295: G = (__v_294 * __v_166);
-                        let __v_296: G = G::from_u64(16777216);
-                        let __v_297: G = (__v_296 * __v_167);
-                        let __v_298: G = G::from_u64(4294967296);
-                        let __v_299: G = (__v_298 * __v_168);
-                        let __v_300: G = G::from_u64(1099511627776);
-                        let __v_301: G = (__v_300 * __v_169);
-                        let __v_302: G = G::from_u64(281474976710656);
-                        let __v_303: G = (__v_302 * __v_170);
-                        let __v_304: G = G::from_u64(72057594037927936);
-                        let __v_305: G = (__v_304 * __v_171);
-                        let __v_306: G = (__v_303 + __v_305);
-                        let __v_307: G = (__v_301 + __v_306);
-                        let __v_308: G = (__v_299 + __v_307);
-                        let __v_309: G = (__v_297 + __v_308);
-                        let __v_310: G = (__v_295 + __v_309);
-                        let __v_311: G = (__v_293 + __v_310);
-                        let __v_312: G = (__v_164 + __v_311);
-                        let __v_313: G = G::from_u64(256);
-                        let __v_314: G = (__v_313 * __v_190);
-                        let __v_315: G = G::from_u64(65536);
-                        let __v_316: G = (__v_315 * __v_191);
-                        let __v_317: G = G::from_u64(16777216);
-                        let __v_318: G = (__v_317 * __v_192);
-                        let __v_319: G = G::from_u64(4294967296);
-                        let __v_320: G = (__v_319 * __v_193);
-                        let __v_321: G = G::from_u64(1099511627776);
-                        let __v_322: G = (__v_321 * __v_194);
-                        let __v_323: G = G::from_u64(281474976710656);
-                        let __v_324: G = (__v_323 * __v_195);
-                        let __v_325: G = G::from_u64(72057594037927936);
-                        let __v_326: G = (__v_325 * __v_196);
-                        let __v_327: G = (__v_324 + __v_326);
-                        let __v_328: G = (__v_322 + __v_327);
-                        let __v_329: G = (__v_320 + __v_328);
-                        let __v_330: G = (__v_318 + __v_329);
-                        let __v_331: G = (__v_316 + __v_330);
-                        let __v_332: G = (__v_314 + __v_331);
-                        let __v_333: G = (__v_189 + __v_332);
-                        let __v_334: G = G::from_u64(256);
-                        let __v_335: G = (__v_334 * __v_198);
-                        let __v_336: G = G::from_u64(65536);
-                        let __v_337: G = (__v_336 * __v_199);
-                        let __v_338: G = G::from_u64(16777216);
-                        let __v_339: G = (__v_338 * __v_200);
-                        let __v_340: G = G::from_u64(4294967296);
-                        let __v_341: G = (__v_340 * __v_201);
-                        let __v_342: G = G::from_u64(1099511627776);
-                        let __v_343: G = (__v_342 * __v_202);
-                        let __v_344: G = G::from_u64(281474976710656);
-                        let __v_345: G = (__v_344 * __v_203);
-                        let __v_346: G = G::from_u64(72057594037927936);
-                        let __v_347: G = (__v_346 * __v_204);
-                        let __v_348: G = (__v_345 + __v_347);
-                        let __v_349: G = (__v_343 + __v_348);
-                        let __v_350: G = (__v_341 + __v_349);
-                        let __v_351: G = (__v_339 + __v_350);
-                        let __v_352: G = (__v_337 + __v_351);
-                        let __v_353: G = (__v_335 + __v_352);
-                        let __v_354: G = (__v_197 + __v_353);
-                        let __v_355: G = G::from_u64(256);
-                        let __v_356: G = (__v_355 * __v_212);
-                        let __v_357: G = G::from_u64(65536);
-                        let __v_358: G = (__v_357 * __v_213);
-                        let __v_359: G = G::from_u64(16777216);
-                        let __v_360: G = (__v_359 * __v_214);
-                        let __v_361: G = G::from_u64(4294967296);
-                        let __v_362: G = (__v_361 * __v_215);
-                        let __v_363: G = G::from_u64(1099511627776);
-                        let __v_364: G = (__v_363 * __v_216);
-                        let __v_365: G = G::from_u64(281474976710656);
-                        let __v_366: G = (__v_365 * __v_217);
-                        let __v_367: G = G::from_u64(72057594037927936);
-                        let __v_368: G = (__v_367 * __v_218);
-                        let __v_369: G = (__v_366 + __v_368);
-                        let __v_370: G = (__v_364 + __v_369);
-                        let __v_371: G = (__v_362 + __v_370);
-                        let __v_372: G = (__v_360 + __v_371);
-                        let __v_373: G = (__v_358 + __v_372);
-                        let __v_374: G = (__v_356 + __v_373);
-                        let __v_375: G = (__v_211 + __v_374);
-                        let __v_376: G = G::from_u64(256);
-                        let __v_377: G = (__v_376 * __v_220);
-                        let __v_378: G = G::from_u64(65536);
-                        let __v_379: G = (__v_378 * __v_221);
-                        let __v_380: G = G::from_u64(16777216);
-                        let __v_381: G = (__v_380 * __v_222);
-                        let __v_382: G = G::from_u64(4294967296);
-                        let __v_383: G = (__v_382 * __v_223);
-                        let __v_384: G = G::from_u64(1099511627776);
-                        let __v_385: G = (__v_384 * __v_224);
-                        let __v_386: G = G::from_u64(281474976710656);
-                        let __v_387: G = (__v_386 * __v_225);
-                        let __v_388: G = G::from_u64(72057594037927936);
-                        let __v_389: G = (__v_388 * __v_226);
-                        let __v_390: G = (__v_387 + __v_389);
-                        let __v_391: G = (__v_385 + __v_390);
-                        let __v_392: G = (__v_383 + __v_391);
-                        let __v_393: G = (__v_381 + __v_392);
-                        let __v_394: G = (__v_379 + __v_393);
-                        let __v_395: G = (__v_377 + __v_394);
-                        let __v_396: G = (__v_219 + __v_395);
-                        let __v_397: G = G::from_u64(0);
-                        let __v_398: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_397, __v_398, __v_73, __v_249, __v_270, __v_291, __v_312]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
-                        let __v_399: G = __r_arr[0];
-                        let __v_400: G = __r_arr[1];
-                        let __v_401: G = G::from_u64(0);
-                        let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_76, __v_77, __v_30, __v_26, __v_62, __v_64, __v_59, __v_60, __v_57, __v_401, __v_399, __v_400, __v_249, __v_270, __v_291, __v_312, __v_333, __v_354, __v_375, __v_396]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
-                        let __v_402: G = __r_arr[0];
-                        let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_76]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                        let __v_403: G = __r_arr[0];
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_186, __v_187, __v_188, __v_189, __v_190, __v_191, __v_192, __v_193, __v_207]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_208: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_202, __v_208]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_209: G = __r_arr[0];
+                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_209, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_210: G = __r_arr[0];
+                        let __v_211: G = G::from_u64(1);
+                        let __v_212: G = G::from_u64(1);
+                        let __v_213: G = { let __values: [G; 3] = [__v_211, __v_212, __v_212]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_26, __v_213]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                        let __v_214: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_210, __v_214]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_215: G = __r_arr[0];
+                        let __v_216: G = G::from_u64(1);
+                        let __v_217: G = G::from_u64(1);
+                        let __v_218: G = { let __values: [G; 3] = [__v_216, __v_217, __v_217]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_215, __v_218]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_219: G = __r_arr[0];
+                        let __v_220: G = __r_arr[1];
+                        let __v_221: G = __r_arr[2];
+                        let __v_222: G = __r_arr[3];
+                        let __v_223: G = __r_arr[4];
+                        let __v_224: G = __r_arr[5];
+                        let __v_225: G = __r_arr[6];
+                        let __v_226: G = __r_arr[7];
+                        let __v_227: G = __r_arr[8];
+                        let __v_228: G = __r_arr[9];
+                        let __v_229: G = __r_arr[10];
+                        let __v_230: G = __r_arr[11];
+                        let __v_231: G = __r_arr[12];
+                        let __v_232: G = __r_arr[13];
+                        let __v_233: G = __r_arr[14];
+                        let __v_234: G = __r_arr[15];
+                        let __v_235: G = __r_arr[16];
+                        let __v_236: G = __r_arr[17];
+                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_235, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_237: G = __r_arr[0];
+                        let __v_238: G = G::from_u64(1);
+                        let __v_239: G = G::from_u64(1);
+                        let __v_240: G = { let __values: [G; 3] = [__v_238, __v_239, __v_239]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_237, __v_240]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_241: G = __r_arr[0];
+                        let __v_242: G = __r_arr[1];
+                        let __v_243: G = __r_arr[2];
+                        let __v_244: G = __r_arr[3];
+                        let __v_245: G = __r_arr[4];
+                        let __v_246: G = __r_arr[5];
+                        let __v_247: G = __r_arr[6];
+                        let __v_248: G = __r_arr[7];
+                        let __v_249: G = __r_arr[8];
+                        let __v_250: G = __r_arr[9];
+                        let __v_251: G = __r_arr[10];
+                        let __v_252: G = __r_arr[11];
+                        let __v_253: G = __r_arr[12];
+                        let __v_254: G = __r_arr[13];
+                        let __v_255: G = __r_arr[14];
+                        let __v_256: G = __r_arr[15];
+                        let __v_257: G = __r_arr[16];
+                        let __v_258: G = __r_arr[17];
+                        let __v_259: G = G::from_u64(256);
+                        let __v_260: G = (__v_259 * __v_160);
+                        let __v_261: G = G::from_u64(65536);
+                        let __v_262: G = (__v_261 * __v_161);
+                        let __v_263: G = G::from_u64(16777216);
+                        let __v_264: G = (__v_263 * __v_162);
+                        let __v_265: G = G::from_u64(4294967296);
+                        let __v_266: G = (__v_265 * __v_163);
+                        let __v_267: G = G::from_u64(1099511627776);
+                        let __v_268: G = (__v_267 * __v_164);
+                        let __v_269: G = G::from_u64(281474976710656);
+                        let __v_270: G = (__v_269 * __v_165);
+                        let __v_271: G = G::from_u64(72057594037927936);
+                        let __v_272: G = (__v_271 * __v_166);
+                        let __v_273: G = (__v_270 + __v_272);
+                        let __v_274: G = (__v_268 + __v_273);
+                        let __v_275: G = (__v_266 + __v_274);
+                        let __v_276: G = (__v_264 + __v_275);
+                        let __v_277: G = (__v_262 + __v_276);
+                        let __v_278: G = (__v_260 + __v_277);
+                        let __v_279: G = (__v_159 + __v_278);
+                        let __v_280: G = G::from_u64(256);
+                        let __v_281: G = (__v_280 * __v_168);
+                        let __v_282: G = G::from_u64(65536);
+                        let __v_283: G = (__v_282 * __v_169);
+                        let __v_284: G = G::from_u64(16777216);
+                        let __v_285: G = (__v_284 * __v_170);
+                        let __v_286: G = G::from_u64(4294967296);
+                        let __v_287: G = (__v_286 * __v_171);
+                        let __v_288: G = G::from_u64(1099511627776);
+                        let __v_289: G = (__v_288 * __v_172);
+                        let __v_290: G = G::from_u64(281474976710656);
+                        let __v_291: G = (__v_290 * __v_173);
+                        let __v_292: G = G::from_u64(72057594037927936);
+                        let __v_293: G = (__v_292 * __v_174);
+                        let __v_294: G = (__v_291 + __v_293);
+                        let __v_295: G = (__v_289 + __v_294);
+                        let __v_296: G = (__v_287 + __v_295);
+                        let __v_297: G = (__v_285 + __v_296);
+                        let __v_298: G = (__v_283 + __v_297);
+                        let __v_299: G = (__v_281 + __v_298);
+                        let __v_300: G = (__v_167 + __v_299);
+                        let __v_301: G = G::from_u64(256);
+                        let __v_302: G = (__v_301 * __v_187);
+                        let __v_303: G = G::from_u64(65536);
+                        let __v_304: G = (__v_303 * __v_188);
+                        let __v_305: G = G::from_u64(16777216);
+                        let __v_306: G = (__v_305 * __v_189);
+                        let __v_307: G = G::from_u64(4294967296);
+                        let __v_308: G = (__v_307 * __v_190);
+                        let __v_309: G = G::from_u64(1099511627776);
+                        let __v_310: G = (__v_309 * __v_191);
+                        let __v_311: G = G::from_u64(281474976710656);
+                        let __v_312: G = (__v_311 * __v_192);
+                        let __v_313: G = G::from_u64(72057594037927936);
+                        let __v_314: G = (__v_313 * __v_193);
+                        let __v_315: G = (__v_312 + __v_314);
+                        let __v_316: G = (__v_310 + __v_315);
+                        let __v_317: G = (__v_308 + __v_316);
+                        let __v_318: G = (__v_306 + __v_317);
+                        let __v_319: G = (__v_304 + __v_318);
+                        let __v_320: G = (__v_302 + __v_319);
+                        let __v_321: G = (__v_186 + __v_320);
+                        let __v_322: G = G::from_u64(256);
+                        let __v_323: G = (__v_322 * __v_195);
+                        let __v_324: G = G::from_u64(65536);
+                        let __v_325: G = (__v_324 * __v_196);
+                        let __v_326: G = G::from_u64(16777216);
+                        let __v_327: G = (__v_326 * __v_197);
+                        let __v_328: G = G::from_u64(4294967296);
+                        let __v_329: G = (__v_328 * __v_198);
+                        let __v_330: G = G::from_u64(1099511627776);
+                        let __v_331: G = (__v_330 * __v_199);
+                        let __v_332: G = G::from_u64(281474976710656);
+                        let __v_333: G = (__v_332 * __v_200);
+                        let __v_334: G = G::from_u64(72057594037927936);
+                        let __v_335: G = (__v_334 * __v_201);
+                        let __v_336: G = (__v_333 + __v_335);
+                        let __v_337: G = (__v_331 + __v_336);
+                        let __v_338: G = (__v_329 + __v_337);
+                        let __v_339: G = (__v_327 + __v_338);
+                        let __v_340: G = (__v_325 + __v_339);
+                        let __v_341: G = (__v_323 + __v_340);
+                        let __v_342: G = (__v_194 + __v_341);
+                        let __v_343: G = G::from_u64(256);
+                        let __v_344: G = (__v_343 * __v_220);
+                        let __v_345: G = G::from_u64(65536);
+                        let __v_346: G = (__v_345 * __v_221);
+                        let __v_347: G = G::from_u64(16777216);
+                        let __v_348: G = (__v_347 * __v_222);
+                        let __v_349: G = G::from_u64(4294967296);
+                        let __v_350: G = (__v_349 * __v_223);
+                        let __v_351: G = G::from_u64(1099511627776);
+                        let __v_352: G = (__v_351 * __v_224);
+                        let __v_353: G = G::from_u64(281474976710656);
+                        let __v_354: G = (__v_353 * __v_225);
+                        let __v_355: G = G::from_u64(72057594037927936);
+                        let __v_356: G = (__v_355 * __v_226);
+                        let __v_357: G = (__v_354 + __v_356);
+                        let __v_358: G = (__v_352 + __v_357);
+                        let __v_359: G = (__v_350 + __v_358);
+                        let __v_360: G = (__v_348 + __v_359);
+                        let __v_361: G = (__v_346 + __v_360);
+                        let __v_362: G = (__v_344 + __v_361);
+                        let __v_363: G = (__v_219 + __v_362);
+                        let __v_364: G = G::from_u64(256);
+                        let __v_365: G = (__v_364 * __v_228);
+                        let __v_366: G = G::from_u64(65536);
+                        let __v_367: G = (__v_366 * __v_229);
+                        let __v_368: G = G::from_u64(16777216);
+                        let __v_369: G = (__v_368 * __v_230);
+                        let __v_370: G = G::from_u64(4294967296);
+                        let __v_371: G = (__v_370 * __v_231);
+                        let __v_372: G = G::from_u64(1099511627776);
+                        let __v_373: G = (__v_372 * __v_232);
+                        let __v_374: G = G::from_u64(281474976710656);
+                        let __v_375: G = (__v_374 * __v_233);
+                        let __v_376: G = G::from_u64(72057594037927936);
+                        let __v_377: G = (__v_376 * __v_234);
+                        let __v_378: G = (__v_375 + __v_377);
+                        let __v_379: G = (__v_373 + __v_378);
+                        let __v_380: G = (__v_371 + __v_379);
+                        let __v_381: G = (__v_369 + __v_380);
+                        let __v_382: G = (__v_367 + __v_381);
+                        let __v_383: G = (__v_365 + __v_382);
+                        let __v_384: G = (__v_227 + __v_383);
+                        let __v_385: G = G::from_u64(256);
+                        let __v_386: G = (__v_385 * __v_242);
+                        let __v_387: G = G::from_u64(65536);
+                        let __v_388: G = (__v_387 * __v_243);
+                        let __v_389: G = G::from_u64(16777216);
+                        let __v_390: G = (__v_389 * __v_244);
+                        let __v_391: G = G::from_u64(4294967296);
+                        let __v_392: G = (__v_391 * __v_245);
+                        let __v_393: G = G::from_u64(1099511627776);
+                        let __v_394: G = (__v_393 * __v_246);
+                        let __v_395: G = G::from_u64(281474976710656);
+                        let __v_396: G = (__v_395 * __v_247);
+                        let __v_397: G = G::from_u64(72057594037927936);
+                        let __v_398: G = (__v_397 * __v_248);
+                        let __v_399: G = (__v_396 + __v_398);
+                        let __v_400: G = (__v_394 + __v_399);
+                        let __v_401: G = (__v_392 + __v_400);
+                        let __v_402: G = (__v_390 + __v_401);
+                        let __v_403: G = (__v_388 + __v_402);
+                        let __v_404: G = (__v_386 + __v_403);
+                        let __v_405: G = (__v_241 + __v_404);
+                        let __v_406: G = G::from_u64(256);
+                        let __v_407: G = (__v_406 * __v_250);
+                        let __v_408: G = G::from_u64(65536);
+                        let __v_409: G = (__v_408 * __v_251);
+                        let __v_410: G = G::from_u64(16777216);
+                        let __v_411: G = (__v_410 * __v_252);
+                        let __v_412: G = G::from_u64(4294967296);
+                        let __v_413: G = (__v_412 * __v_253);
+                        let __v_414: G = G::from_u64(1099511627776);
+                        let __v_415: G = (__v_414 * __v_254);
+                        let __v_416: G = G::from_u64(281474976710656);
+                        let __v_417: G = (__v_416 * __v_255);
+                        let __v_418: G = G::from_u64(72057594037927936);
+                        let __v_419: G = (__v_418 * __v_256);
+                        let __v_420: G = (__v_417 + __v_419);
+                        let __v_421: G = (__v_415 + __v_420);
+                        let __v_422: G = (__v_413 + __v_421);
+                        let __v_423: G = (__v_411 + __v_422);
+                        let __v_424: G = (__v_409 + __v_423);
+                        let __v_425: G = (__v_407 + __v_424);
+                        let __v_426: G = (__v_249 + __v_425);
+                        let __v_427: G = G::from_u64(0);
+                        let __v_428: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_427, __v_428, __v_74, __v_279, __v_300, __v_321, __v_342]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
+                        let __v_429: G = __r_arr[0];
+                        let __v_430: G = __r_arr[1];
+                        let __v_431: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_101, __v_102, __v_30, __v_26, __v_62, __v_64, __v_59, __v_60, __v_57, __v_431, __v_429, __v_430, __v_279, __v_300, __v_321, __v_342, __v_363, __v_384, __v_405, __v_426]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+                        let __v_432: G = __r_arr[0];
+                        let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_101]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                        let __v_433: G = __r_arr[0];
                         match __v_34.as_canonical_u64() {
                           _ => {
                             let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_34]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_404: G = __r_arr[0];
-                            let __v_405: G = G::from_u64(1);
-                            let __v_406: G = G::from_u64(1);
-                            let __v_407: G = { let __values: [G; 3] = [__v_405, __v_406, __v_406]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_59.as_canonical_u64() {
-  0u64 => {
-    break '__mc_1 [__v_407];
-  },
-  1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_60, __v_407]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_408: G = __r_arr[0];
-    break '__mc_1 [__v_408];
-  },
-  _ => {
-    return Err(ExecError::MatchNoCase(__v_59.as_canonical_u64()));
-  },
-}
- };
-                            let __v_408: G = __mc_out___mc_1[0];
-                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_57, __v_408]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                            let __v_409: G = __r_arr[0];
-                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_64, __v_409]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                            let __v_410: G = __r_arr[0];
-                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_62, __v_410]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                            let __v_411: G = __r_arr[0];
-                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_227, __v_411]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                            let __v_412: G = __r_arr[0];
-                            let __v_413: G = G::from_u64(1);
-                            let __v_414: G = G::from_u64(1);
-                            let __v_415: G = { let __values: [G; 3] = [__v_413, __v_414, __v_414]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_412, __v_415]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                            let __v_416: G = __r_arr[0];
-                            let __v_417: G = __r_arr[1];
-                            let __v_418: G = __r_arr[2];
-                            let __v_419: G = __r_arr[3];
-                            let __v_420: G = __r_arr[4];
-                            let __v_421: G = __r_arr[5];
-                            let __v_422: G = __r_arr[6];
-                            let __v_423: G = __r_arr[7];
-                            let __v_424: G = __r_arr[8];
-                            let __v_425: G = __r_arr[9];
-                            let __v_426: G = __r_arr[10];
-                            let __v_427: G = __r_arr[11];
-                            let __v_428: G = __r_arr[12];
-                            let __v_429: G = __r_arr[13];
-                            let __v_430: G = __r_arr[14];
-                            let __v_431: G = __r_arr[15];
-                            let __v_432: G = __r_arr[16];
-                            let __v_433: G = __r_arr[17];
-                            let __v_434: G = G::from_u64(256);
-                            let __v_435: G = (__v_434 * __v_417);
-                            let __v_436: G = G::from_u64(65536);
-                            let __v_437: G = (__v_436 * __v_418);
-                            let __v_438: G = G::from_u64(16777216);
-                            let __v_439: G = (__v_438 * __v_419);
-                            let __v_440: G = G::from_u64(4294967296);
-                            let __v_441: G = (__v_440 * __v_420);
-                            let __v_442: G = G::from_u64(1099511627776);
-                            let __v_443: G = (__v_442 * __v_421);
-                            let __v_444: G = G::from_u64(281474976710656);
-                            let __v_445: G = (__v_444 * __v_422);
-                            let __v_446: G = G::from_u64(72057594037927936);
-                            let __v_447: G = (__v_446 * __v_423);
-                            let __v_448: G = (__v_445 + __v_447);
-                            let __v_449: G = (__v_443 + __v_448);
-                            let __v_450: G = (__v_441 + __v_449);
-                            let __v_451: G = (__v_439 + __v_450);
-                            let __v_452: G = (__v_437 + __v_451);
-                            let __v_453: G = (__v_435 + __v_452);
-                            let __v_454: G = (__v_416 + __v_453);
-                            let __v_455: G = G::from_u64(256);
-                            let __v_456: G = (__v_455 * __v_425);
-                            let __v_457: G = G::from_u64(65536);
-                            let __v_458: G = (__v_457 * __v_426);
-                            let __v_459: G = G::from_u64(16777216);
-                            let __v_460: G = (__v_459 * __v_427);
-                            let __v_461: G = G::from_u64(4294967296);
-                            let __v_462: G = (__v_461 * __v_428);
-                            let __v_463: G = G::from_u64(1099511627776);
-                            let __v_464: G = (__v_463 * __v_429);
-                            let __v_465: G = G::from_u64(281474976710656);
-                            let __v_466: G = (__v_465 * __v_430);
-                            let __v_467: G = G::from_u64(72057594037927936);
-                            let __v_468: G = (__v_467 * __v_431);
-                            let __v_469: G = (__v_466 + __v_468);
-                            let __v_470: G = (__v_464 + __v_469);
-                            let __v_471: G = (__v_462 + __v_470);
-                            let __v_472: G = (__v_460 + __v_471);
-                            let __v_473: G = (__v_458 + __v_472);
-                            let __v_474: G = (__v_456 + __v_473);
-                            let __v_475: G = (__v_424 + __v_474);
-                            let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_432, __v_34, __v_36, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-                            let __v_476: G = __r_arr[0];
-                            let __v_477: G = __r_arr[1];
-                            let __v_478: G = G::from_u64(1);
-                            let __v_479: G = G::from_u64(1);
-                            let __v_480: G = { let __values: [G; 3] = [__v_478, __v_479, __v_479]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                            let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_46, __v_480]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                            let __v_481: G = __r_arr[0];
-                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_477, __v_481]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                            let __v_482: G = __r_arr[0];
-                            let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_482, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-                            let __v_483: G = __r_arr[0];
-                            let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_483, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-                            let __v_484: G = __r_arr[0];
-                            let __v_485: G = __r_arr[1];
-                            let __v_486: G = (__v_404 + __v_0);
-                            let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_484, __v_485, __v_4, __v_486]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-                            let __v_487: G = __r_arr[0];
-                            let __v_488: G = G::from_u64(0);
-                            let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_40, __v_44, __v_488, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-                            let __v_489: G = __r_arr[0];
-                            let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_484, __v_485, __v_489, __v_454, __v_475, __v_62, __v_64, __v_57, __v_59, __v_60, __v_20, __v_22, __v_24, __v_78, __v_77, __v_30, __v_375, __v_396, __v_403, __v_0, __v_486, __v_476, __v_34, __v_46, __v_404]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-                            let __v_490: G = __r_arr[0];
-                            let __v_491: G = (__v_14 + __v_15);
-                            if (__v_65 != __v_491) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_65.as_canonical_u64(), rhs: __v_491.as_canonical_u64(), msg: None });
-                            }
-                            let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_74.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-                            let __v_492: G = __loaded[0];
-                            let __v_493: G = __loaded[1];
-                            let __v_494: G = __loaded[2];
-                            let __v_495: G = G::from_u64(1);
-                            let __v_496: G = G::from_u64(1);
-                            if (__v_492 != __v_495) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_492.as_canonical_u64(), rhs: __v_495.as_canonical_u64(), msg: None });
-                            }
-                            if (__v_493 != __v_496) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_493.as_canonical_u64(), rhs: __v_496.as_canonical_u64(), msg: None });
-                            }
-                            if (__v_494 != __v_496) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_494.as_canonical_u64(), rhs: __v_496.as_canonical_u64(), msg: None });
-                            }
-                            let __v_497: G = G::from_bool((__v_75 == G::ZERO));
-                            let __v_498: G = G::from_u64(0);
-                            if (__v_497 != __v_498) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_497.as_canonical_u64(), rhs: __v_498.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_62]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_499: G = __r_arr[0];
-                            if (__v_499 != __v_75) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_499.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_64]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_500: G = __r_arr[0];
-                            if (__v_500 != __v_75) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_500.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_57]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_501: G = __r_arr[0];
-                            if (__v_501 != __v_75) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_501.as_canonical_u64(), rhs: __v_75.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_161] = { let __args: [G; IN_161] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[161].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[161].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[161].bump_multiplicity(__i); } let __ret: [G; OUT_161] = unsafe { *(record.function_queries[161].output_at(__i).as_ptr() as *const [G; OUT_161]) }; __ret }, _ => aiur_fn_161(__args, record, io_buffer, __cu)? } };
-                            let __v_502: G = __r_arr[0];
-                            let __v_503: G = G::from_u64(1);
-                            if (__v_502 != __v_503) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_502.as_canonical_u64(), rhs: __v_503.as_canonical_u64(), msg: None });
-                            }
-                            let __v_504: G = G::from_u64(1);
-                            let __v_505: G = G::from_u64(1);
-                            if (__v_504 != __v_505) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_504.as_canonical_u64(), rhs: __v_505.as_canonical_u64(), msg: None });
-                            }
-                            let __v_506: G = G::from_u64(0);
-                            if (__v_1 != __v_506) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_1.as_canonical_u64(), rhs: __v_506.as_canonical_u64(), msg: None });
-                            }
-                            let __v_507: G = G::from_u64(0);
-                            if (__v_2 != __v_507) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_2.as_canonical_u64(), rhs: __v_507.as_canonical_u64(), msg: None });
-                            }
-                            let __v_508: G = G::from_u64(1);
-                            if (__v_3 != __v_508) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_3.as_canonical_u64(), rhs: __v_508.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
-                            let __v_509: G = __r_arr[0];
-                            let __v_510: G = G::from_u64(1);
-                            if (__v_509 != __v_510) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_509.as_canonical_u64(), rhs: __v_510.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_18]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                            let __v_511: G = __r_arr[0];
-                            let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_8]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                            let __v_512: G = __r_arr[0];
-                            let __v_513: G = (__v_511 - __v_512);
-                            let __v_514: G = G::from_bool((__v_513 == G::ZERO));
-                            let __v_515: G = G::from_u64(1);
-                            if (__v_514 != __v_515) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_514.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: None });
-                            }
-                            let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_76]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                            let __v_516: G = __r_arr[0];
-                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_26]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_517: G = __r_arr[0];
-                            let __v_518: G = (__v_516 - __v_517);
-                            let __v_519: G = G::from_bool((__v_518 == G::ZERO));
-                            let __v_520: G = G::from_u64(1);
-                            if (__v_519 != __v_520) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_519.as_canonical_u64(), rhs: __v_520.as_canonical_u64(), msg: None });
-                            }
+                            let __v_434: G = __r_arr[0];
                             let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_36]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-                            let __v_521: G = __r_arr[0];
-                            let __v_522: G = (__v_521 - __v_404);
-                            let __v_523: G = G::from_bool((__v_522 == G::ZERO));
-                            let __v_524: G = G::from_u64(1);
-                            if (__v_523 != __v_524) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_523.as_canonical_u64(), rhs: __v_524.as_canonical_u64(), msg: None });
+                            let __v_435: G = __r_arr[0];
+                            let __v_436: G = (__v_435 - __v_434);
+                            let __v_437: G = G::from_bool((__v_436 == G::ZERO));
+                            let __v_438: G = G::from_u64(1);
+                            if (__v_437 != __v_438) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_437.as_canonical_u64(), rhs: __v_438.as_canonical_u64(), msg: None });
                             }
                             let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_525: G = __r_arr[0];
-                            let __v_526: G = G::from_u64(3);
+                            let __v_439: G = __r_arr[0];
+                            let __v_440: G = G::from_u64(3);
                             let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_59, __v_60]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
-                            let __v_527: G = __r_arr[0];
-                            let __v_528: G = (__v_526 + __v_527);
-                            if (__v_525 != __v_528) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_525.as_canonical_u64(), rhs: __v_528.as_canonical_u64(), msg: None });
+                            let __v_441: G = __r_arr[0];
+                            let __v_442: G = (__v_440 + __v_441);
+                            if (__v_439 != __v_442) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_439.as_canonical_u64(), rhs: __v_442.as_canonical_u64(), msg: None });
                             }
                             let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_44]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
-                            let __v_529: G = __r_arr[0];
-                            let __v_530: G = (__v_529 - __v_404);
-                            let __v_531: G = G::from_bool((__v_530 == G::ZERO));
-                            let __v_532: G = G::from_u64(1);
-                            if (__v_531 != __v_532) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_531.as_canonical_u64(), rhs: __v_532.as_canonical_u64(), msg: None });
+                            let __v_443: G = __r_arr[0];
+                            let __v_444: G = (__v_443 - __v_434);
+                            let __v_445: G = G::from_bool((__v_444 == G::ZERO));
+                            let __v_446: G = G::from_u64(1);
+                            if (__v_445 != __v_446) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_445.as_canonical_u64(), rhs: __v_446.as_canonical_u64(), msg: None });
                             }
                             let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_46]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                            let __v_533: G = __r_arr[0];
-                            let __v_534: G = G::from_u64(1);
-                            if (__v_533 != __v_534) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_533.as_canonical_u64(), rhs: __v_534.as_canonical_u64(), msg: None });
+                            let __v_447: G = __r_arr[0];
+                            let __v_448: G = G::from_u64(1);
+                            if (__v_447 != __v_448) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_447.as_canonical_u64(), rhs: __v_448.as_canonical_u64(), msg: None });
+                            }
+                            let __v_449: G = G::from_u64(1);
+                            let __v_450: G = G::from_u64(1);
+                            let __v_451: G = { let __values: [G; 3] = [__v_449, __v_450, __v_450]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_59.as_canonical_u64() {
+  0u64 => {
+    break '__mc_1 [__v_451];
+  },
+  1u64 => {
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_60, __v_451]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_452: G = __r_arr[0];
+    break '__mc_1 [__v_452];
+  },
+  _ => {
+    return Err(ExecError::MatchNoCase(__v_59.as_canonical_u64()));
+  },
+}
+ };
+                            let __v_452: G = __mc_out___mc_1[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_57, __v_452]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_453: G = __r_arr[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_64, __v_453]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_454: G = __r_arr[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_62, __v_454]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_455: G = __r_arr[0];
+                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_257, __v_455]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_456: G = __r_arr[0];
+                            let __v_457: G = G::from_u64(1);
+                            let __v_458: G = G::from_u64(1);
+                            let __v_459: G = { let __values: [G; 3] = [__v_457, __v_458, __v_458]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_456, __v_459]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                            let __v_460: G = __r_arr[0];
+                            let __v_461: G = __r_arr[1];
+                            let __v_462: G = __r_arr[2];
+                            let __v_463: G = __r_arr[3];
+                            let __v_464: G = __r_arr[4];
+                            let __v_465: G = __r_arr[5];
+                            let __v_466: G = __r_arr[6];
+                            let __v_467: G = __r_arr[7];
+                            let __v_468: G = __r_arr[8];
+                            let __v_469: G = __r_arr[9];
+                            let __v_470: G = __r_arr[10];
+                            let __v_471: G = __r_arr[11];
+                            let __v_472: G = __r_arr[12];
+                            let __v_473: G = __r_arr[13];
+                            let __v_474: G = __r_arr[14];
+                            let __v_475: G = __r_arr[15];
+                            let __v_476: G = __r_arr[16];
+                            let __v_477: G = __r_arr[17];
+                            let __v_478: G = G::from_u64(256);
+                            let __v_479: G = (__v_478 * __v_461);
+                            let __v_480: G = G::from_u64(65536);
+                            let __v_481: G = (__v_480 * __v_462);
+                            let __v_482: G = G::from_u64(16777216);
+                            let __v_483: G = (__v_482 * __v_463);
+                            let __v_484: G = G::from_u64(4294967296);
+                            let __v_485: G = (__v_484 * __v_464);
+                            let __v_486: G = G::from_u64(1099511627776);
+                            let __v_487: G = (__v_486 * __v_465);
+                            let __v_488: G = G::from_u64(281474976710656);
+                            let __v_489: G = (__v_488 * __v_466);
+                            let __v_490: G = G::from_u64(72057594037927936);
+                            let __v_491: G = (__v_490 * __v_467);
+                            let __v_492: G = (__v_489 + __v_491);
+                            let __v_493: G = (__v_487 + __v_492);
+                            let __v_494: G = (__v_485 + __v_493);
+                            let __v_495: G = (__v_483 + __v_494);
+                            let __v_496: G = (__v_481 + __v_495);
+                            let __v_497: G = (__v_479 + __v_496);
+                            let __v_498: G = (__v_460 + __v_497);
+                            let __v_499: G = G::from_u64(256);
+                            let __v_500: G = (__v_499 * __v_469);
+                            let __v_501: G = G::from_u64(65536);
+                            let __v_502: G = (__v_501 * __v_470);
+                            let __v_503: G = G::from_u64(16777216);
+                            let __v_504: G = (__v_503 * __v_471);
+                            let __v_505: G = G::from_u64(4294967296);
+                            let __v_506: G = (__v_505 * __v_472);
+                            let __v_507: G = G::from_u64(1099511627776);
+                            let __v_508: G = (__v_507 * __v_473);
+                            let __v_509: G = G::from_u64(281474976710656);
+                            let __v_510: G = (__v_509 * __v_474);
+                            let __v_511: G = G::from_u64(72057594037927936);
+                            let __v_512: G = (__v_511 * __v_475);
+                            let __v_513: G = (__v_510 + __v_512);
+                            let __v_514: G = (__v_508 + __v_513);
+                            let __v_515: G = (__v_506 + __v_514);
+                            let __v_516: G = (__v_504 + __v_515);
+                            let __v_517: G = (__v_502 + __v_516);
+                            let __v_518: G = (__v_500 + __v_517);
+                            let __v_519: G = (__v_468 + __v_518);
+                            let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_476, __v_34, __v_36, __v_5]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
+                            let __v_520: G = __r_arr[0];
+                            let __v_521: G = __r_arr[1];
+                            let __v_522: G = G::from_u64(1);
+                            let __v_523: G = G::from_u64(1);
+                            let __v_524: G = { let __values: [G; 3] = [__v_522, __v_523, __v_523]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_46, __v_524]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                            let __v_525: G = __r_arr[0];
+                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_521, __v_525]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_526: G = __r_arr[0];
+                            let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_526, __v_34]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
+                            let __v_527: G = __r_arr[0];
+                            let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_527, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54, __v_55, __v_6]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+                            let __v_528: G = __r_arr[0];
+                            let __v_529: G = __r_arr[1];
+                            let __v_530: G = (__v_434 + __v_0);
+                            let __v_531: G = G::from_u64(33);
+                            let __v_532: G = { let __a_val = __v_530.as_canonical_u64(); let __b_val = __v_531.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+                            let __v_533: G = G::from_u64(1);
+                            if (__v_532 != __v_533) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_532.as_canonical_u64(), rhs: __v_533.as_canonical_u64(), msg: None });
                             }
-                            let __v_535: G = G::from_u64(33);
-                            let __v_536: G = { let __a_val = __v_486.as_canonical_u64(); let __b_val = __v_535.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-                            let __v_537: G = G::from_u64(1);
-                            if (__v_536 != __v_537) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_536.as_canonical_u64(), rhs: __v_537.as_canonical_u64(), msg: None });
+                            let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_528, __v_529, __v_4, __v_530]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+                            let __v_534: G = __r_arr[0];
+                            let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_40, __v_534, __v_20, __v_22, __v_24, __v_108, __v_59, __v_60, __v_102, __v_30, __v_433, __v_0, __v_530]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                            let __v_535: G = __r_arr[0];
+                            let __v_536: G = G::from_u64(1);
+                            if (__v_535 != __v_536) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_535.as_canonical_u64(), rhs: __v_536.as_canonical_u64(), msg: None });
                             }
-                            let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_40, __v_487, __v_20, __v_22, __v_24, __v_78, __v_59, __v_60, __v_77, __v_30, __v_403, __v_0, __v_486]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                            let __v_537: G = G::from_u64(0);
+                            let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_40, __v_44, __v_537, __v_4]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
                             let __v_538: G = __r_arr[0];
-                            let __v_539: G = G::from_u64(1);
-                            if (__v_538 != __v_539) {
-                              return Err(ExecError::AssertEqMismatch { lhs: __v_538.as_canonical_u64(), rhs: __v_539.as_canonical_u64(), msg: None });
-                            }
+                            let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_528, __v_529, __v_538, __v_498, __v_519, __v_62, __v_64, __v_57, __v_59, __v_60, __v_20, __v_22, __v_24, __v_108, __v_102, __v_30, __v_405, __v_426, __v_433, __v_0, __v_530, __v_520, __v_34, __v_46, __v_434]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+                            let __v_539: G = __r_arr[0];
                             let __v_540: G = G::from_u64(0);
-                            let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_44, __v_34, __v_490, __v_487, __v_540, __v_486]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                            let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_44, __v_34, __v_539, __v_534, __v_540, __v_530]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
                             let __v_541: G = __r_arr[0];
                             let __v_542: G = G::from_u64(1);
                             if (__v_541 != __v_542) {
                               return Err(ExecError::AssertEqMismatch { lhs: __v_541.as_canonical_u64(), rhs: __v_542.as_canonical_u64(), msg: None });
                             }
-                            let __ret: [G; OUT_237] = [__v_73];
+                            let __ret: [G; OUT_237] = [__v_74];
                             record.function_queries[237].finish(&inp[..], &__ret[..], !unconstrained);
                             return Ok(__ret);
                           },
@@ -23182,53 +23182,53 @@ fn aiur_fn_238(
     let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_13, __v_12]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
     let __v_14: G = __r_arr[0];
     let __v_15: G = __r_arr[1];
-    let __r_arr: [G; OUT_236] = { let __args: [G; IN_236] = [__v_14]; let __cu = unconstrained; let __hit = record.function_queries[236].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[236].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[236].bump_multiplicity(__i); } let __ret: [G; OUT_236] = unsafe { *(record.function_queries[236].output_at(__i).as_ptr() as *const [G; OUT_236]) }; __ret }, _ => aiur_fn_236(__args, record, io_buffer, __cu)? } };
-    let __v_16: G = __r_arr[0];
-    let __v_17: G = G::from_u64(2);
-    let __r_arr: [G; OUT_234] = { let __args: [G; IN_234] = [__v_16, __v_17]; let __cu = unconstrained; let __hit = record.function_queries[234].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[234].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[234].bump_multiplicity(__i); } let __ret: [G; OUT_234] = unsafe { *(record.function_queries[234].output_at(__i).as_ptr() as *const [G; OUT_234]) }; __ret }, _ => aiur_fn_234(__args, record, io_buffer, __cu)? } };
-    let __v_18: G = __r_arr[0];
-    let __v_19: G = __r_arr[1];
-    let __v_20: G = __r_arr[2];
-    let __v_21: G = __r_arr[3];
-    let __v_22: G = __r_arr[4];
-    let __v_23: G = __r_arr[5];
-    let __v_24: G = __r_arr[6];
-    let __v_25: G = __r_arr[7];
     let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_15.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_26: G = __loaded[0];
-    let __v_27: G = __loaded[1];
-    let __v_28: G = __loaded[2];
-    let __v_29: G = G::from_u64(1);
-    let __v_30: G = G::from_u64(1);
-    if (__v_26 != __v_29) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_26.as_canonical_u64(), rhs: __v_29.as_canonical_u64(), msg: None });
+    let __v_16: G = __loaded[0];
+    let __v_17: G = __loaded[1];
+    let __v_18: G = __loaded[2];
+    let __v_19: G = G::from_u64(1);
+    let __v_20: G = G::from_u64(1);
+    if (__v_16 != __v_19) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_16.as_canonical_u64(), rhs: __v_19.as_canonical_u64(), msg: None });
     }
-    if (__v_27 != __v_30) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_27.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: None });
+    if (__v_17 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_17.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: None });
     }
-    if (__v_28 != __v_30) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_28.as_canonical_u64(), rhs: __v_30.as_canonical_u64(), msg: None });
+    if (__v_18 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_18.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: None });
     }
-    let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_16]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-    let __v_31: G = __r_arr[0];
-    let __v_32: G = G::from_u64(10);
-    if (__v_31 != __v_32) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_31.as_canonical_u64(), rhs: __v_32.as_canonical_u64(), msg: Some("join: IxVM lift must expose a 10-word verify_claim claim".to_string()) });
+    let __r_arr: [G; OUT_236] = { let __args: [G; IN_236] = [__v_14]; let __cu = unconstrained; let __hit = record.function_queries[236].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[236].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[236].bump_multiplicity(__i); } let __ret: [G; OUT_236] = unsafe { *(record.function_queries[236].output_at(__i).as_ptr() as *const [G; OUT_236]) }; __ret }, _ => aiur_fn_236(__args, record, io_buffer, __cu)? } };
+    let __v_21: G = __r_arr[0];
+    let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
+    let __v_22: G = __r_arr[0];
+    let __v_23: G = G::from_u64(10);
+    if (__v_22 != __v_23) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("join: IxVM lift must expose a 10-word verify_claim claim".to_string()) });
     }
-    let __v_33: G = G::from_u64(0);
-    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_16, __v_33]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
-    let __v_34: G = __r_arr[0];
-    let __v_35: G = G::from_u64(0);
-    if (__v_34 != __v_35) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_34.as_canonical_u64(), rhs: __v_35.as_canonical_u64(), msg: Some("join: IxVM child has the wrong claim channel".to_string()) });
+    let __v_24: G = G::from_u64(0);
+    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_21, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
+    let __v_25: G = __r_arr[0];
+    let __v_26: G = G::from_u64(0);
+    if (__v_25 != __v_26) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_25.as_canonical_u64(), rhs: __v_26.as_canonical_u64(), msg: Some("join: IxVM child has the wrong claim channel".to_string()) });
     }
-    let __v_36: G = G::from_u64(1);
-    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_16, __v_36]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
-    let __v_37: G = __r_arr[0];
-    if (__v_37 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_37.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("join: IxVM child has the wrong entrypoint".to_string()) });
+    let __v_27: G = G::from_u64(1);
+    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_21, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
+    let __v_28: G = __r_arr[0];
+    if (__v_28 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_28.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("join: IxVM child has the wrong entrypoint".to_string()) });
     }
-    let __r_arr: [G; OUT_232] = { let __args: [G; IN_232] = [__v_18, __v_19, __v_20, __v_21, __v_22, __v_23, __v_24, __v_25]; let __cu = unconstrained; let __hit = record.function_queries[232].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[232].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[232].bump_multiplicity(__i); } let __ret: [G; OUT_232] = unsafe { *(record.function_queries[232].output_at(__i).as_ptr() as *const [G; OUT_232]) }; __ret }, _ => aiur_fn_232(__args, record, io_buffer, __cu)? } };
+    let __v_29: G = G::from_u64(2);
+    let __r_arr: [G; OUT_234] = { let __args: [G; IN_234] = [__v_21, __v_29]; let __cu = unconstrained; let __hit = record.function_queries[234].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[234].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[234].bump_multiplicity(__i); } let __ret: [G; OUT_234] = unsafe { *(record.function_queries[234].output_at(__i).as_ptr() as *const [G; OUT_234]) }; __ret }, _ => aiur_fn_234(__args, record, io_buffer, __cu)? } };
+    let __v_30: G = __r_arr[0];
+    let __v_31: G = __r_arr[1];
+    let __v_32: G = __r_arr[2];
+    let __v_33: G = __r_arr[3];
+    let __v_34: G = __r_arr[4];
+    let __v_35: G = __r_arr[5];
+    let __v_36: G = __r_arr[6];
+    let __v_37: G = __r_arr[7];
+    let __r_arr: [G; OUT_232] = { let __args: [G; IN_232] = [__v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37]; let __cu = unconstrained; let __hit = record.function_queries[232].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[232].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[232].bump_multiplicity(__i); } let __ret: [G; OUT_232] = unsafe { *(record.function_queries[232].output_at(__i).as_ptr() as *const [G; OUT_232]) }; __ret }, _ => aiur_fn_232(__args, record, io_buffer, __cu)? } };
     let __v_38: G = __r_arr[0];
     let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
     let __v_39: G = __r_arr[0];
@@ -23273,23 +23273,23 @@ fn aiur_fn_239(
     let __v_20: G = inp[20];
     let __r_arr: [G; OUT_236] = { let __args: [G; IN_236] = [__v_0]; let __cu = unconstrained; let __hit = record.function_queries[236].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[236].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[236].bump_multiplicity(__i); } let __ret: [G; OUT_236] = unsafe { *(record.function_queries[236].output_at(__i).as_ptr() as *const [G; OUT_236]) }; __ret }, _ => aiur_fn_236(__args, record, io_buffer, __cu)? } };
     let __v_21: G = __r_arr[0];
-    let __v_22: G = G::from_u64(1);
-    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_21, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
-    let __v_23: G = __r_arr[0];
     let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-    let __v_24: G = __r_arr[0];
-    let __v_25: G = G::from_u64(18);
-    if (__v_24 != __v_25) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_24.as_canonical_u64(), rhs: __v_25.as_canonical_u64(), msg: Some("join: recursive child claim must contain 16 public inputs".to_string()) });
+    let __v_22: G = __r_arr[0];
+    let __v_23: G = G::from_u64(18);
+    if (__v_22 != __v_23) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_22.as_canonical_u64(), rhs: __v_23.as_canonical_u64(), msg: Some("join: recursive child claim must contain 16 public inputs".to_string()) });
     }
+    let __v_24: G = G::from_u64(0);
+    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_21, __v_24]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
+    let __v_25: G = __r_arr[0];
     let __v_26: G = G::from_u64(0);
-    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_21, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
-    let __v_27: G = __r_arr[0];
-    let __v_28: G = G::from_u64(0);
-    if (__v_27 != __v_28) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_27.as_canonical_u64(), rhs: __v_28.as_canonical_u64(), msg: Some("join: recursive child has the wrong claim channel".to_string()) });
+    if (__v_25 != __v_26) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_25.as_canonical_u64(), rhs: __v_26.as_canonical_u64(), msg: Some("join: recursive child has the wrong claim channel".to_string()) });
     }
-    let __v_29: G = (__v_23 - __v_18);
+    let __v_27: G = G::from_u64(1);
+    let __r_arr: [G; OUT_233] = { let __args: [G; IN_233] = [__v_21, __v_27]; let __cu = unconstrained; let __hit = record.function_queries[233].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[233].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[233].bump_multiplicity(__i); } let __ret: [G; OUT_233] = unsafe { *(record.function_queries[233].output_at(__i).as_ptr() as *const [G; OUT_233]) }; __ret }, _ => aiur_fn_233(__args, record, io_buffer, __cu)? } };
+    let __v_28: G = __r_arr[0];
+    let __v_29: G = (__v_28 - __v_18);
     let __v_30: G = G::from_bool((__v_29 == G::ZERO));
     match __v_30.as_canonical_u64() {
       1u64 => {
@@ -23313,15 +23313,15 @@ fn aiur_fn_239(
         return Ok(__ret);
       },
       _ => {
-        let __v_31: G = (__v_23 - __v_19);
+        let __v_31: G = (__v_28 - __v_19);
         let __v_32: G = G::from_bool((__v_31 == G::ZERO));
         let __mc_out___mc_0: [G; 0] = '__mc_0: { match __v_32.as_canonical_u64() {
   1u64 => {
     break '__mc_0 [];
   },
   _ => {
-    if (__v_23 != __v_20) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_23.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("join: child is neither lift, flat join, nor structural join".to_string()) });
+    if (__v_28 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_28.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("join: child is neither lift, flat join, nor structural join".to_string()) });
     }
     break '__mc_0 [];
   },
@@ -23393,45 +23393,48 @@ fn aiur_fn_240(
     let __io_pair: (G, G) = { let __key: [G; 1] = [__v_17]; let __info = io_buffer.get_info(__v_16, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
     let __v_18: G = __io_pair.0;
     let __v_19: G = __io_pair.1;
-    let __v_20: G = G::from_u64(3);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_20, __v_18, __v_19]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_21: G = __r_arr[0];
-    let __v_22: G = G::from_u64(103);
-    let __v_23: G = G::from_u64(230);
-    let __v_24: G = G::from_u64(9);
-    let __v_25: G = G::from_u64(106);
-    let __v_26: G = G::from_u64(133);
-    let __v_27: G = G::from_u64(174);
-    let __v_28: G = G::from_u64(103);
-    let __v_29: G = G::from_u64(187);
-    let __v_30: G = G::from_u64(114);
-    let __v_31: G = G::from_u64(243);
-    let __v_32: G = G::from_u64(110);
-    let __v_33: G = G::from_u64(60);
-    let __v_34: G = G::from_u64(58);
-    let __v_35: G = G::from_u64(245);
-    let __v_36: G = G::from_u64(79);
-    let __v_37: G = G::from_u64(165);
-    let __v_38: G = G::from_u64(127);
-    let __v_39: G = G::from_u64(82);
-    let __v_40: G = G::from_u64(14);
-    let __v_41: G = G::from_u64(81);
-    let __v_42: G = G::from_u64(140);
-    let __v_43: G = G::from_u64(104);
-    let __v_44: G = G::from_u64(5);
-    let __v_45: G = G::from_u64(155);
-    let __v_46: G = G::from_u64(171);
-    let __v_47: G = G::from_u64(217);
-    let __v_48: G = G::from_u64(131);
-    let __v_49: G = G::from_u64(31);
-    let __v_50: G = G::from_u64(25);
-    let __v_51: G = G::from_u64(205);
-    let __v_52: G = G::from_u64(224);
-    let __v_53: G = G::from_u64(91);
-    let __v_54: G = G::from_u64(1);
+    let __v_20: G = G::from_u64(96);
+    if (__v_19 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    let __v_21: G = G::from_u64(3);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_21, __v_18, __v_19]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_22: G = __r_arr[0];
+    let __v_23: G = G::from_u64(103);
+    let __v_24: G = G::from_u64(230);
+    let __v_25: G = G::from_u64(9);
+    let __v_26: G = G::from_u64(106);
+    let __v_27: G = G::from_u64(133);
+    let __v_28: G = G::from_u64(174);
+    let __v_29: G = G::from_u64(103);
+    let __v_30: G = G::from_u64(187);
+    let __v_31: G = G::from_u64(114);
+    let __v_32: G = G::from_u64(243);
+    let __v_33: G = G::from_u64(110);
+    let __v_34: G = G::from_u64(60);
+    let __v_35: G = G::from_u64(58);
+    let __v_36: G = G::from_u64(245);
+    let __v_37: G = G::from_u64(79);
+    let __v_38: G = G::from_u64(165);
+    let __v_39: G = G::from_u64(127);
+    let __v_40: G = G::from_u64(82);
+    let __v_41: G = G::from_u64(14);
+    let __v_42: G = G::from_u64(81);
+    let __v_43: G = G::from_u64(140);
+    let __v_44: G = G::from_u64(104);
+    let __v_45: G = G::from_u64(5);
+    let __v_46: G = G::from_u64(155);
+    let __v_47: G = G::from_u64(171);
+    let __v_48: G = G::from_u64(217);
+    let __v_49: G = G::from_u64(131);
+    let __v_50: G = G::from_u64(31);
+    let __v_51: G = G::from_u64(25);
+    let __v_52: G = G::from_u64(205);
+    let __v_53: G = G::from_u64(224);
+    let __v_54: G = G::from_u64(91);
     let __v_55: G = G::from_u64(1);
-    let __v_56: G = { let __values: [G; 3] = [__v_54, __v_55, __v_55]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_57: G = G::from_u64(0);
+    let __v_56: G = G::from_u64(1);
+    let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_58: G = G::from_u64(0);
     let __v_59: G = G::from_u64(0);
     let __v_60: G = G::from_u64(0);
@@ -23441,834 +23444,831 @@ fn aiur_fn_240(
     let __v_64: G = G::from_u64(0);
     let __v_65: G = G::from_u64(0);
     let __v_66: G = G::from_u64(0);
-    let __v_67: G = { let __values: [G; 8] = [__v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_68: G = { let __values: [G; 32] = [__v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_69: G = G::from_u64(1);
+    let __v_67: G = G::from_u64(0);
+    let __v_68: G = { let __values: [G; 8] = [__v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_69: G = { let __values: [G; 32] = [__v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_70: G = G::from_u64(1);
-    let __v_71: G = { let __values: [G; 34] = [__v_69, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_21, __v_56, __v_57, __v_58, __v_67, __v_68, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_72: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_72]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = { let __values: [G; 34] = [__v_70, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_22, __v_57, __v_58, __v_59, __v_68, __v_69, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
     let __v_73: G = __r_arr[0];
-    let __v_74: G = __r_arr[1];
-    let __v_75: G = __r_arr[2];
-    let __v_76: G = __r_arr[3];
-    let __v_77: G = __r_arr[4];
-    let __v_78: G = __r_arr[5];
-    let __v_79: G = __r_arr[6];
-    let __v_80: G = __r_arr[7];
-    let __v_81: G = __r_arr[8];
-    let __v_82: G = __r_arr[9];
-    let __v_83: G = __r_arr[10];
-    let __v_84: G = __r_arr[11];
-    let __v_85: G = __r_arr[12];
-    let __v_86: G = __r_arr[13];
-    let __v_87: G = __r_arr[14];
-    let __v_88: G = __r_arr[15];
-    let __v_89: G = __r_arr[16];
-    let __v_90: G = __r_arr[17];
-    let __v_91: G = __r_arr[18];
-    let __v_92: G = __r_arr[19];
-    let __v_93: G = __r_arr[20];
-    let __v_94: G = __r_arr[21];
-    let __v_95: G = __r_arr[22];
-    let __v_96: G = __r_arr[23];
-    let __v_97: G = __r_arr[24];
-    let __v_98: G = __r_arr[25];
-    let __v_99: G = __r_arr[26];
-    let __v_100: G = __r_arr[27];
-    let __v_101: G = __r_arr[28];
-    let __v_102: G = __r_arr[29];
-    let __v_103: G = __r_arr[30];
-    let __v_104: G = __r_arr[31];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_105: G = __r_arr[0];
-    let __v_106: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_106]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_107: G = __r_arr[0];
-    let __v_108: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_108]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_109: G = __r_arr[0];
-    let __v_110: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_110]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_111: G = __r_arr[0];
-    let __v_112: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_112]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_113: G = __r_arr[0];
-    let __v_114: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_114]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_115: G = __r_arr[0];
-    let __v_116: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_116]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_117: G = __r_arr[0];
-    let __v_118: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_118]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_119: G = __r_arr[0];
-    let __v_120: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_120]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_121: G = __r_arr[0];
-    let __v_122: G = __r_arr[1];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_122]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_123: G = __r_arr[0];
-    let __v_124: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_124]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_125: G = __r_arr[0];
-    let __v_126: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_126]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_127: G = __r_arr[0];
-    let __v_128: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_128]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_129: G = __r_arr[0];
-    let __v_130: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_130]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_131: G = __r_arr[0];
-    let __v_132: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_132]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_133: G = __r_arr[0];
-    let __v_134: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_134]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_135: G = __r_arr[0];
-    let __v_136: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_136]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_137: G = __r_arr[0];
-    let __v_138: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_138]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_139: G = __r_arr[0];
-    let __v_140: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_140]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_141: G = __r_arr[0];
-    let __v_142: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_142]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_143: G = __r_arr[0];
-    let __v_144: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_144]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_145: G = __r_arr[0];
-    let __v_146: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_146]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_147: G = __r_arr[0];
-    let __v_148: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_148]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_149: G = __r_arr[0];
-    let __v_150: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_150]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_151: G = __r_arr[0];
-    let __v_152: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_152]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_153: G = __r_arr[0];
-    let __v_154: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_154]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_155: G = __r_arr[0];
-    let __v_156: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_156]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_157: G = __r_arr[0];
-    let __v_158: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_158]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_159: G = __r_arr[0];
-    let __v_160: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_160]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_161: G = __r_arr[0];
-    let __v_162: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_162]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_163: G = __r_arr[0];
-    let __v_164: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_164]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_165: G = __r_arr[0];
-    let __v_166: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_166]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_167: G = __r_arr[0];
-    let __v_168: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_168]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_169: G = __r_arr[0];
-    let __v_170: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_170]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_171: G = __r_arr[0];
-    let __v_172: G = __r_arr[1];
-    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_173: G = __r_arr[0];
-    let __v_174: G = __r_arr[1];
-    let __v_175: G = __r_arr[2];
-    let __v_176: G = __r_arr[3];
-    let __v_177: G = __r_arr[4];
-    let __v_178: G = __r_arr[5];
-    let __v_179: G = __r_arr[6];
-    let __v_180: G = __r_arr[7];
-    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_123]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_181: G = __r_arr[0];
-    let __v_182: G = __r_arr[1];
-    let __v_183: G = __r_arr[2];
-    let __v_184: G = __r_arr[3];
-    let __v_185: G = __r_arr[4];
-    let __v_186: G = __r_arr[5];
-    let __v_187: G = __r_arr[6];
-    let __v_188: G = __r_arr[7];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_107, __v_109, __v_111, __v_113, __v_115, __v_117, __v_119, __v_121]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
-    let __v_189: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_125, __v_127, __v_129, __v_131, __v_133, __v_135, __v_137, __v_139]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_73]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_74: G = __r_arr[0];
+    let __v_75: G = __r_arr[1];
+    let __v_76: G = __r_arr[2];
+    let __v_77: G = __r_arr[3];
+    let __v_78: G = __r_arr[4];
+    let __v_79: G = __r_arr[5];
+    let __v_80: G = __r_arr[6];
+    let __v_81: G = __r_arr[7];
+    let __v_82: G = __r_arr[8];
+    let __v_83: G = __r_arr[9];
+    let __v_84: G = __r_arr[10];
+    let __v_85: G = __r_arr[11];
+    let __v_86: G = __r_arr[12];
+    let __v_87: G = __r_arr[13];
+    let __v_88: G = __r_arr[14];
+    let __v_89: G = __r_arr[15];
+    let __v_90: G = __r_arr[16];
+    let __v_91: G = __r_arr[17];
+    let __v_92: G = __r_arr[18];
+    let __v_93: G = __r_arr[19];
+    let __v_94: G = __r_arr[20];
+    let __v_95: G = __r_arr[21];
+    let __v_96: G = __r_arr[22];
+    let __v_97: G = __r_arr[23];
+    let __v_98: G = __r_arr[24];
+    let __v_99: G = __r_arr[25];
+    let __v_100: G = __r_arr[26];
+    let __v_101: G = __r_arr[27];
+    let __v_102: G = __r_arr[28];
+    let __v_103: G = __r_arr[29];
+    let __v_104: G = __r_arr[30];
+    let __v_105: G = __r_arr[31];
+    let __v_106: G = G::from_u64(256);
+    let __v_107: G = (__v_106 * __v_75);
+    let __v_108: G = G::from_u64(65536);
+    let __v_109: G = (__v_108 * __v_76);
+    let __v_110: G = G::from_u64(16777216);
+    let __v_111: G = (__v_110 * __v_77);
+    let __v_112: G = (__v_109 + __v_111);
+    let __v_113: G = (__v_107 + __v_112);
+    let __v_114: G = (__v_74 + __v_113);
+    let __v_115: G = G::from_u64(256);
+    let __v_116: G = (__v_115 * __v_79);
+    let __v_117: G = G::from_u64(65536);
+    let __v_118: G = (__v_117 * __v_80);
+    let __v_119: G = G::from_u64(16777216);
+    let __v_120: G = (__v_119 * __v_81);
+    let __v_121: G = (__v_118 + __v_120);
+    let __v_122: G = (__v_116 + __v_121);
+    let __v_123: G = (__v_78 + __v_122);
+    let __v_124: G = G::from_u64(256);
+    let __v_125: G = (__v_124 * __v_83);
+    let __v_126: G = G::from_u64(65536);
+    let __v_127: G = (__v_126 * __v_84);
+    let __v_128: G = G::from_u64(16777216);
+    let __v_129: G = (__v_128 * __v_85);
+    let __v_130: G = (__v_127 + __v_129);
+    let __v_131: G = (__v_125 + __v_130);
+    let __v_132: G = (__v_82 + __v_131);
+    let __v_133: G = G::from_u64(256);
+    let __v_134: G = (__v_133 * __v_87);
+    let __v_135: G = G::from_u64(65536);
+    let __v_136: G = (__v_135 * __v_88);
+    let __v_137: G = G::from_u64(16777216);
+    let __v_138: G = (__v_137 * __v_89);
+    let __v_139: G = (__v_136 + __v_138);
+    let __v_140: G = (__v_134 + __v_139);
+    let __v_141: G = (__v_86 + __v_140);
+    let __v_142: G = G::from_u64(256);
+    let __v_143: G = (__v_142 * __v_91);
+    let __v_144: G = G::from_u64(65536);
+    let __v_145: G = (__v_144 * __v_92);
+    let __v_146: G = G::from_u64(16777216);
+    let __v_147: G = (__v_146 * __v_93);
+    let __v_148: G = (__v_145 + __v_147);
+    let __v_149: G = (__v_143 + __v_148);
+    let __v_150: G = (__v_90 + __v_149);
+    let __v_151: G = G::from_u64(256);
+    let __v_152: G = (__v_151 * __v_95);
+    let __v_153: G = G::from_u64(65536);
+    let __v_154: G = (__v_153 * __v_96);
+    let __v_155: G = G::from_u64(16777216);
+    let __v_156: G = (__v_155 * __v_97);
+    let __v_157: G = (__v_154 + __v_156);
+    let __v_158: G = (__v_152 + __v_157);
+    let __v_159: G = (__v_94 + __v_158);
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_99);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_100);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_101);
+    let __v_166: G = (__v_163 + __v_165);
+    let __v_167: G = (__v_161 + __v_166);
+    let __v_168: G = (__v_98 + __v_167);
+    let __v_169: G = G::from_u64(256);
+    let __v_170: G = (__v_169 * __v_103);
+    let __v_171: G = G::from_u64(65536);
+    let __v_172: G = (__v_171 * __v_104);
+    let __v_173: G = G::from_u64(16777216);
+    let __v_174: G = (__v_173 * __v_105);
+    let __v_175: G = (__v_172 + __v_174);
+    let __v_176: G = (__v_170 + __v_175);
+    let __v_177: G = (__v_102 + __v_176);
+    if (__v_114 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_114.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_123 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_123.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_132 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_132.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_141 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_150 != __v_4) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_150.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_159 != __v_5) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_159.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_168 != __v_6) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_177 != __v_7) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_178: G = __r_arr[0];
+    let __v_179: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_179]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_180: G = __r_arr[0];
+    let __v_181: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_181]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_182: G = __r_arr[0];
+    let __v_183: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_183]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_184: G = __r_arr[0];
+    let __v_185: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_185]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_186: G = __r_arr[0];
+    let __v_187: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_188: G = __r_arr[0];
+    let __v_189: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_189]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
     let __v_190: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_141, __v_143, __v_145, __v_147, __v_149, __v_151, __v_153, __v_155]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
-    let __v_191: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_157, __v_159, __v_161, __v_163, __v_165, __v_167, __v_169, __v_171]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_191: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_191]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
     let __v_192: G = __r_arr[0];
-    let __v_193: G = G::from_u64(1);
-    let __v_194: G = G::from_u64(0);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_194]; let __info = io_buffer.get_info(__v_193, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_195: G = __io_pair.0;
-    let __v_196: G = __io_pair.1;
-    let __v_197: G = G::from_u64(1);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_197, __v_195, __v_196]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_193: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_193]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_194: G = __r_arr[0];
+    let __v_195: G = __r_arr[1];
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_195]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_196: G = __r_arr[0];
+    let __v_197: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_197]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
     let __v_198: G = __r_arr[0];
-    let __v_199: G = G::from_u64(103);
-    let __v_200: G = G::from_u64(230);
-    let __v_201: G = G::from_u64(9);
-    let __v_202: G = G::from_u64(106);
-    let __v_203: G = G::from_u64(133);
-    let __v_204: G = G::from_u64(174);
-    let __v_205: G = G::from_u64(103);
-    let __v_206: G = G::from_u64(187);
-    let __v_207: G = G::from_u64(114);
-    let __v_208: G = G::from_u64(243);
-    let __v_209: G = G::from_u64(110);
-    let __v_210: G = G::from_u64(60);
-    let __v_211: G = G::from_u64(58);
-    let __v_212: G = G::from_u64(245);
-    let __v_213: G = G::from_u64(79);
-    let __v_214: G = G::from_u64(165);
-    let __v_215: G = G::from_u64(127);
-    let __v_216: G = G::from_u64(82);
-    let __v_217: G = G::from_u64(14);
-    let __v_218: G = G::from_u64(81);
-    let __v_219: G = G::from_u64(140);
-    let __v_220: G = G::from_u64(104);
-    let __v_221: G = G::from_u64(5);
-    let __v_222: G = G::from_u64(155);
-    let __v_223: G = G::from_u64(171);
-    let __v_224: G = G::from_u64(217);
-    let __v_225: G = G::from_u64(131);
-    let __v_226: G = G::from_u64(31);
-    let __v_227: G = G::from_u64(25);
-    let __v_228: G = G::from_u64(205);
-    let __v_229: G = G::from_u64(224);
-    let __v_230: G = G::from_u64(91);
-    let __v_231: G = G::from_u64(1);
-    let __v_232: G = G::from_u64(1);
-    let __v_233: G = { let __values: [G; 3] = [__v_231, __v_232, __v_232]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_234: G = G::from_u64(0);
-    let __v_235: G = G::from_u64(0);
-    let __v_236: G = G::from_u64(0);
-    let __v_237: G = G::from_u64(0);
-    let __v_238: G = G::from_u64(0);
-    let __v_239: G = G::from_u64(0);
-    let __v_240: G = G::from_u64(0);
-    let __v_241: G = G::from_u64(0);
-    let __v_242: G = G::from_u64(0);
-    let __v_243: G = G::from_u64(0);
-    let __v_244: G = { let __values: [G; 8] = [__v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_245: G = { let __values: [G; 32] = [__v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_216, __v_217, __v_218, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_246: G = G::from_u64(1);
-    let __v_247: G = G::from_u64(1);
-    let __v_248: G = { let __values: [G; 34] = [__v_246, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_198, __v_233, __v_234, __v_235, __v_244, __v_245, __v_248]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_249: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_249]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
-    let __v_250: G = __r_arr[0];
-    let __v_251: G = __r_arr[1];
-    let __v_252: G = __r_arr[2];
-    let __v_253: G = __r_arr[3];
-    let __v_254: G = __r_arr[4];
-    let __v_255: G = __r_arr[5];
-    let __v_256: G = __r_arr[6];
-    let __v_257: G = __r_arr[7];
-    let __v_258: G = __r_arr[8];
-    let __v_259: G = __r_arr[9];
-    let __v_260: G = __r_arr[10];
-    let __v_261: G = __r_arr[11];
-    let __v_262: G = __r_arr[12];
-    let __v_263: G = __r_arr[13];
-    let __v_264: G = __r_arr[14];
-    let __v_265: G = __r_arr[15];
-    let __v_266: G = __r_arr[16];
-    let __v_267: G = __r_arr[17];
-    let __v_268: G = __r_arr[18];
-    let __v_269: G = __r_arr[19];
-    let __v_270: G = __r_arr[20];
-    let __v_271: G = __r_arr[21];
-    let __v_272: G = __r_arr[22];
-    let __v_273: G = __r_arr[23];
-    let __v_274: G = __r_arr[24];
-    let __v_275: G = __r_arr[25];
-    let __v_276: G = __r_arr[26];
-    let __v_277: G = __r_arr[27];
-    let __v_278: G = __r_arr[28];
-    let __v_279: G = __r_arr[29];
-    let __v_280: G = __r_arr[30];
-    let __v_281: G = __r_arr[31];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_198]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_282: G = __r_arr[0];
-    let __v_283: G = __r_arr[1];
-    let __v_284: G = __r_arr[2];
-    let __v_285: G = __r_arr[3];
-    let __v_286: G = __r_arr[4];
-    let __v_287: G = __r_arr[5];
-    let __v_288: G = __r_arr[6];
-    let __v_289: G = __r_arr[7];
-    let __v_290: G = __r_arr[8];
-    let __v_291: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_291]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_292: G = __r_arr[0];
-    let __v_293: G = __r_arr[1];
-    let __v_294: G = __r_arr[2];
-    let __v_295: G = __r_arr[3];
-    let __v_296: G = __r_arr[4];
-    let __v_297: G = __r_arr[5];
-    let __v_298: G = __r_arr[6];
-    let __v_299: G = __r_arr[7];
-    let __v_300: G = __r_arr[8];
-    let __v_301: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_301]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_302: G = __r_arr[0];
-    let __v_303: G = __r_arr[1];
-    let __v_304: G = __r_arr[2];
-    let __v_305: G = __r_arr[3];
-    let __v_306: G = __r_arr[4];
-    let __v_307: G = __r_arr[5];
-    let __v_308: G = __r_arr[6];
-    let __v_309: G = __r_arr[7];
-    let __v_310: G = __r_arr[8];
-    let __v_311: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_311]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_312: G = __r_arr[0];
-    let __v_313: G = __r_arr[1];
-    let __v_314: G = __r_arr[2];
-    let __v_315: G = __r_arr[3];
-    let __v_316: G = __r_arr[4];
-    let __v_317: G = __r_arr[5];
-    let __v_318: G = __r_arr[6];
-    let __v_319: G = __r_arr[7];
-    let __v_320: G = __r_arr[8];
-    let __v_321: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_321]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_322: G = __r_arr[0];
-    let __v_323: G = __r_arr[1];
-    let __v_324: G = __r_arr[2];
-    let __v_325: G = __r_arr[3];
-    let __v_326: G = __r_arr[4];
-    let __v_327: G = __r_arr[5];
-    let __v_328: G = __r_arr[6];
-    let __v_329: G = __r_arr[7];
-    let __v_330: G = __r_arr[8];
-    let __v_331: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_331]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_332: G = __r_arr[0];
-    let __v_333: G = __r_arr[1];
-    let __v_334: G = __r_arr[2];
-    let __v_335: G = __r_arr[3];
-    let __v_336: G = __r_arr[4];
-    let __v_337: G = __r_arr[5];
-    let __v_338: G = __r_arr[6];
-    let __v_339: G = __r_arr[7];
-    let __v_340: G = __r_arr[8];
-    let __v_341: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_341]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_342: G = __r_arr[0];
-    let __v_343: G = __r_arr[1];
-    let __v_344: G = __r_arr[2];
-    let __v_345: G = __r_arr[3];
-    let __v_346: G = __r_arr[4];
-    let __v_347: G = __r_arr[5];
-    let __v_348: G = __r_arr[6];
-    let __v_349: G = __r_arr[7];
-    let __v_350: G = __r_arr[8];
-    let __v_351: G = __r_arr[9];
-    let __v_352: G = G::from_u64(0);
-    let __v_353: G = G::from_u64(0);
-    let __v_354: G = G::from_u64(0);
-    let __v_355: G = G::from_u64(0);
-    let __v_356: G = G::from_u64(0);
-    let __v_357: G = G::from_u64(0);
-    let __v_358: G = G::from_u64(0);
-    let __v_359: G = G::from_u64(1);
-    let __v_360: G = G::from_u64(1);
-    let __v_361: G = { let __values: [G; 10] = [__v_359, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_362: G = { let __values: [G; 10] = [__v_358, __v_343, __v_344, __v_345, __v_346, __v_347, __v_348, __v_349, __v_350, __v_361]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_363: G = { let __values: [G; 10] = [__v_357, __v_333, __v_334, __v_335, __v_336, __v_337, __v_338, __v_339, __v_340, __v_362]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_364: G = { let __values: [G; 10] = [__v_356, __v_323, __v_324, __v_325, __v_326, __v_327, __v_328, __v_329, __v_330, __v_363]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_365: G = { let __values: [G; 10] = [__v_355, __v_313, __v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_320, __v_364]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_366: G = { let __values: [G; 10] = [__v_354, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308, __v_309, __v_310, __v_365]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_367: G = { let __values: [G; 10] = [__v_353, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_366]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_368: G = { let __values: [G; 10] = [__v_352, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_367]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_351]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_369: G = __r_arr[0];
-    let __v_370: G = __r_arr[1];
-    let __v_371: G = __r_arr[2];
-    let __v_372: G = __r_arr[3];
-    let __v_373: G = __r_arr[4];
-    let __v_374: G = __r_arr[5];
-    let __v_375: G = __r_arr[6];
-    let __v_376: G = __r_arr[7];
-    let __v_377: G = __r_arr[8];
-    let __v_378: G = __r_arr[9];
-    let __r_arr: [G; OUT_93] = { let __args: [G; IN_93] = [__v_378, __v_369]; let __cu = unconstrained; let __hit = record.function_queries[93].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[93].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[93].bump_multiplicity(__i); } let __ret: [G; OUT_93] = unsafe { *(record.function_queries[93].output_at(__i).as_ptr() as *const [G; OUT_93]) }; __ret }, _ => aiur_fn_93(__args, record, io_buffer, __cu)? } };
-    let __v_379: G = __r_arr[0];
-    let __v_380: G = __r_arr[1];
-    let __v_381: G = __r_arr[2];
-    let __r_arr: [G; OUT_94] = { let __args: [G; IN_94] = [__v_381]; let __cu = unconstrained; let __hit = record.function_queries[94].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[94].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[94].bump_multiplicity(__i); } let __ret: [G; OUT_94] = unsafe { *(record.function_queries[94].output_at(__i).as_ptr() as *const [G; OUT_94]) }; __ret }, _ => aiur_fn_94(__args, record, io_buffer, __cu)? } };
-    let __v_382: G = __r_arr[0];
-    let __v_383: G = __r_arr[1];
-    let __v_384: G = __r_arr[2];
-    let __r_arr: [G; OUT_95] = { let __args: [G; IN_95] = [__v_384, __v_369]; let __cu = unconstrained; let __hit = record.function_queries[95].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[95].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[95].bump_multiplicity(__i); } let __ret: [G; OUT_95] = unsafe { *(record.function_queries[95].output_at(__i).as_ptr() as *const [G; OUT_95]) }; __ret }, _ => aiur_fn_95(__args, record, io_buffer, __cu)? } };
-    let __v_385: G = __r_arr[0];
-    let __v_386: G = __r_arr[1];
-    let __v_387: G = G::from_u64(0);
-    let __v_388: G = { let __values: [G; 10] = [__v_387, __v_370, __v_371, __v_372, __v_373, __v_374, __v_375, __v_376, __v_377, __v_380]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_368, __v_388]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-    let __v_389: G = __r_arr[0];
-    let __v_390: G = G::from_u64(0);
-    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_282, __v_292, __v_302, __v_312, __v_322, __v_332, __v_342, __v_389, __v_379, __v_382, __v_383, __v_385, __v_390]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
-    let __v_391: G = __r_arr[0];
-    let __v_392: G = G::from_u64(1);
-    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_282, __v_292, __v_302, __v_312, __v_322, __v_332, __v_342, __v_389, __v_379, __v_382, __v_383, __v_385, __v_392]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
-    let __v_393: G = __r_arr[0];
-    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_391, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_189, __v_190, __v_191, __v_192]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
-    let __v_394: G = __r_arr[0];
-    let __v_395: G = __r_arr[1];
-    let __v_396: G = __r_arr[2];
-    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_393, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_189, __v_190, __v_191, __v_192]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
-    let __v_397: G = __r_arr[0];
-    let __v_398: G = __r_arr[1];
-    let __v_399: G = __r_arr[2];
-    let __v_400: G = G::from_u64(2);
-    let __v_401: G = G::from_u64(2);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_401]; let __info = io_buffer.get_info(__v_400, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_402: G = __io_pair.0;
-    let __v_403: G = __io_pair.1;
-    let __v_404: G = G::from_u64(2);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_404, __v_402, __v_403]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_405: G = __r_arr[0];
-    let __v_406: G = G::from_u64(103);
-    let __v_407: G = G::from_u64(230);
-    let __v_408: G = G::from_u64(9);
-    let __v_409: G = G::from_u64(106);
-    let __v_410: G = G::from_u64(133);
-    let __v_411: G = G::from_u64(174);
-    let __v_412: G = G::from_u64(103);
-    let __v_413: G = G::from_u64(187);
-    let __v_414: G = G::from_u64(114);
-    let __v_415: G = G::from_u64(243);
-    let __v_416: G = G::from_u64(110);
-    let __v_417: G = G::from_u64(60);
-    let __v_418: G = G::from_u64(58);
-    let __v_419: G = G::from_u64(245);
-    let __v_420: G = G::from_u64(79);
-    let __v_421: G = G::from_u64(165);
-    let __v_422: G = G::from_u64(127);
-    let __v_423: G = G::from_u64(82);
-    let __v_424: G = G::from_u64(14);
-    let __v_425: G = G::from_u64(81);
-    let __v_426: G = G::from_u64(140);
-    let __v_427: G = G::from_u64(104);
-    let __v_428: G = G::from_u64(5);
-    let __v_429: G = G::from_u64(155);
-    let __v_430: G = G::from_u64(171);
-    let __v_431: G = G::from_u64(217);
-    let __v_432: G = G::from_u64(131);
-    let __v_433: G = G::from_u64(31);
-    let __v_434: G = G::from_u64(25);
-    let __v_435: G = G::from_u64(205);
-    let __v_436: G = G::from_u64(224);
-    let __v_437: G = G::from_u64(91);
-    let __v_438: G = G::from_u64(1);
-    let __v_439: G = G::from_u64(1);
-    let __v_440: G = { let __values: [G; 3] = [__v_438, __v_439, __v_439]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_441: G = G::from_u64(0);
-    let __v_442: G = G::from_u64(0);
-    let __v_443: G = G::from_u64(0);
-    let __v_444: G = G::from_u64(0);
-    let __v_445: G = G::from_u64(0);
-    let __v_446: G = G::from_u64(0);
-    let __v_447: G = G::from_u64(0);
-    let __v_448: G = G::from_u64(0);
-    let __v_449: G = G::from_u64(0);
-    let __v_450: G = G::from_u64(0);
-    let __v_451: G = { let __values: [G; 8] = [__v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_449, __v_450]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_452: G = { let __values: [G; 32] = [__v_406, __v_407, __v_408, __v_409, __v_410, __v_411, __v_412, __v_413, __v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_430, __v_431, __v_432, __v_433, __v_434, __v_435, __v_436, __v_437]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_453: G = G::from_u64(1);
-    let __v_454: G = G::from_u64(1);
-    let __v_455: G = { let __values: [G; 34] = [__v_453, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_405, __v_440, __v_441, __v_442, __v_451, __v_452, __v_455]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_456: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_456]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
-    let __v_457: G = __r_arr[0];
-    let __v_458: G = __r_arr[1];
-    let __v_459: G = __r_arr[2];
-    let __v_460: G = __r_arr[3];
-    let __v_461: G = __r_arr[4];
-    let __v_462: G = __r_arr[5];
-    let __v_463: G = __r_arr[6];
-    let __v_464: G = __r_arr[7];
-    let __v_465: G = __r_arr[8];
-    let __v_466: G = __r_arr[9];
-    let __v_467: G = __r_arr[10];
-    let __v_468: G = __r_arr[11];
-    let __v_469: G = __r_arr[12];
-    let __v_470: G = __r_arr[13];
-    let __v_471: G = __r_arr[14];
-    let __v_472: G = __r_arr[15];
-    let __v_473: G = __r_arr[16];
-    let __v_474: G = __r_arr[17];
-    let __v_475: G = __r_arr[18];
-    let __v_476: G = __r_arr[19];
-    let __v_477: G = __r_arr[20];
-    let __v_478: G = __r_arr[21];
-    let __v_479: G = __r_arr[22];
-    let __v_480: G = __r_arr[23];
-    let __v_481: G = __r_arr[24];
-    let __v_482: G = __r_arr[25];
-    let __v_483: G = __r_arr[26];
-    let __v_484: G = __r_arr[27];
-    let __v_485: G = __r_arr[28];
-    let __v_486: G = __r_arr[29];
-    let __v_487: G = __r_arr[30];
-    let __v_488: G = __r_arr[31];
-    let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_405]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
-    let __v_489: G = __r_arr[0];
-    let __v_490: G = __r_arr[1];
-    let __v_491: G = __r_arr[2];
-    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_394]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_199: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_199]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_200: G = __r_arr[0];
+    let __v_201: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_201]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_202: G = __r_arr[0];
+    let __v_203: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_203]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_204: G = __r_arr[0];
+    let __v_205: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_205]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_206: G = __r_arr[0];
+    let __v_207: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_207]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_208: G = __r_arr[0];
+    let __v_209: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_209]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_210: G = __r_arr[0];
+    let __v_211: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_211]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_212: G = __r_arr[0];
+    let __v_213: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_213]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_214: G = __r_arr[0];
+    let __v_215: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_215]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_216: G = __r_arr[0];
+    let __v_217: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_217]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_218: G = __r_arr[0];
+    let __v_219: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_219]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_220: G = __r_arr[0];
+    let __v_221: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_221]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_222: G = __r_arr[0];
+    let __v_223: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_223]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_224: G = __r_arr[0];
+    let __v_225: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_225]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_226: G = __r_arr[0];
+    let __v_227: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_227]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_228: G = __r_arr[0];
+    let __v_229: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_229]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_230: G = __r_arr[0];
+    let __v_231: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_231]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_232: G = __r_arr[0];
+    let __v_233: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_233]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_234: G = __r_arr[0];
+    let __v_235: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_235]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_236: G = __r_arr[0];
+    let __v_237: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_237]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_238: G = __r_arr[0];
+    let __v_239: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_239]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_240: G = __r_arr[0];
+    let __v_241: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_241]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_242: G = __r_arr[0];
+    let __v_243: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_243]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_244: G = __r_arr[0];
+    let __v_245: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_245.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_246: G = __loaded[0];
+    let __v_247: G = __loaded[1];
+    let __v_248: G = __loaded[2];
+    let __v_249: G = G::from_u64(1);
+    let __v_250: G = G::from_u64(1);
+    if (__v_246 != __v_249) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_246.as_canonical_u64(), rhs: __v_249.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    if (__v_247 != __v_250) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_247.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    if (__v_248 != __v_250) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_248.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_178]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
+    let __v_251: G = __r_arr[0];
+    let __v_252: G = __r_arr[1];
+    let __v_253: G = __r_arr[2];
+    let __v_254: G = __r_arr[3];
+    let __v_255: G = __r_arr[4];
+    let __v_256: G = __r_arr[5];
+    let __v_257: G = __r_arr[6];
+    let __v_258: G = __r_arr[7];
+    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_196]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
+    let __v_259: G = __r_arr[0];
+    let __v_260: G = __r_arr[1];
+    let __v_261: G = __r_arr[2];
+    let __v_262: G = __r_arr[3];
+    let __v_263: G = __r_arr[4];
+    let __v_264: G = __r_arr[5];
+    let __v_265: G = __r_arr[6];
+    let __v_266: G = __r_arr[7];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_180, __v_182, __v_184, __v_186, __v_188, __v_190, __v_192, __v_194]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_267: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_198, __v_200, __v_202, __v_204, __v_206, __v_208, __v_210, __v_212]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_268: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_214, __v_216, __v_218, __v_220, __v_222, __v_224, __v_226, __v_228]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_269: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_230, __v_232, __v_234, __v_236, __v_238, __v_240, __v_242, __v_244]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_270: G = __r_arr[0];
+    let __v_271: G = G::from_u64(1);
+    let __v_272: G = G::from_u64(0);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_272]; let __info = io_buffer.get_info(__v_271, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_273: G = __io_pair.0;
+    let __v_274: G = __io_pair.1;
+    let __v_275: G = G::from_u64(1);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_275, __v_273, __v_274]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_276: G = __r_arr[0];
+    let __v_277: G = G::from_u64(103);
+    let __v_278: G = G::from_u64(230);
+    let __v_279: G = G::from_u64(9);
+    let __v_280: G = G::from_u64(106);
+    let __v_281: G = G::from_u64(133);
+    let __v_282: G = G::from_u64(174);
+    let __v_283: G = G::from_u64(103);
+    let __v_284: G = G::from_u64(187);
+    let __v_285: G = G::from_u64(114);
+    let __v_286: G = G::from_u64(243);
+    let __v_287: G = G::from_u64(110);
+    let __v_288: G = G::from_u64(60);
+    let __v_289: G = G::from_u64(58);
+    let __v_290: G = G::from_u64(245);
+    let __v_291: G = G::from_u64(79);
+    let __v_292: G = G::from_u64(165);
+    let __v_293: G = G::from_u64(127);
+    let __v_294: G = G::from_u64(82);
+    let __v_295: G = G::from_u64(14);
+    let __v_296: G = G::from_u64(81);
+    let __v_297: G = G::from_u64(140);
+    let __v_298: G = G::from_u64(104);
+    let __v_299: G = G::from_u64(5);
+    let __v_300: G = G::from_u64(155);
+    let __v_301: G = G::from_u64(171);
+    let __v_302: G = G::from_u64(217);
+    let __v_303: G = G::from_u64(131);
+    let __v_304: G = G::from_u64(31);
+    let __v_305: G = G::from_u64(25);
+    let __v_306: G = G::from_u64(205);
+    let __v_307: G = G::from_u64(224);
+    let __v_308: G = G::from_u64(91);
+    let __v_309: G = G::from_u64(1);
+    let __v_310: G = G::from_u64(1);
+    let __v_311: G = { let __values: [G; 3] = [__v_309, __v_310, __v_310]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_312: G = G::from_u64(0);
+    let __v_313: G = G::from_u64(0);
+    let __v_314: G = G::from_u64(0);
+    let __v_315: G = G::from_u64(0);
+    let __v_316: G = G::from_u64(0);
+    let __v_317: G = G::from_u64(0);
+    let __v_318: G = G::from_u64(0);
+    let __v_319: G = G::from_u64(0);
+    let __v_320: G = G::from_u64(0);
+    let __v_321: G = G::from_u64(0);
+    let __v_322: G = { let __values: [G; 8] = [__v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_320, __v_321]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_323: G = { let __values: [G; 32] = [__v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_324: G = G::from_u64(1);
+    let __v_325: G = G::from_u64(1);
+    let __v_326: G = { let __values: [G; 34] = [__v_324, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_276, __v_311, __v_312, __v_313, __v_322, __v_323, __v_326]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
+    let __v_327: G = __r_arr[0];
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_327]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_328: G = __r_arr[0];
+    let __v_329: G = __r_arr[1];
+    let __v_330: G = __r_arr[2];
+    let __v_331: G = __r_arr[3];
+    let __v_332: G = __r_arr[4];
+    let __v_333: G = __r_arr[5];
+    let __v_334: G = __r_arr[6];
+    let __v_335: G = __r_arr[7];
+    let __v_336: G = __r_arr[8];
+    let __v_337: G = __r_arr[9];
+    let __v_338: G = __r_arr[10];
+    let __v_339: G = __r_arr[11];
+    let __v_340: G = __r_arr[12];
+    let __v_341: G = __r_arr[13];
+    let __v_342: G = __r_arr[14];
+    let __v_343: G = __r_arr[15];
+    let __v_344: G = __r_arr[16];
+    let __v_345: G = __r_arr[17];
+    let __v_346: G = __r_arr[18];
+    let __v_347: G = __r_arr[19];
+    let __v_348: G = __r_arr[20];
+    let __v_349: G = __r_arr[21];
+    let __v_350: G = __r_arr[22];
+    let __v_351: G = __r_arr[23];
+    let __v_352: G = __r_arr[24];
+    let __v_353: G = __r_arr[25];
+    let __v_354: G = __r_arr[26];
+    let __v_355: G = __r_arr[27];
+    let __v_356: G = __r_arr[28];
+    let __v_357: G = __r_arr[29];
+    let __v_358: G = __r_arr[30];
+    let __v_359: G = __r_arr[31];
+    let __v_360: G = G::from_u64(256);
+    let __v_361: G = (__v_360 * __v_329);
+    let __v_362: G = G::from_u64(65536);
+    let __v_363: G = (__v_362 * __v_330);
+    let __v_364: G = G::from_u64(16777216);
+    let __v_365: G = (__v_364 * __v_331);
+    let __v_366: G = (__v_363 + __v_365);
+    let __v_367: G = (__v_361 + __v_366);
+    let __v_368: G = (__v_328 + __v_367);
+    let __v_369: G = G::from_u64(256);
+    let __v_370: G = (__v_369 * __v_333);
+    let __v_371: G = G::from_u64(65536);
+    let __v_372: G = (__v_371 * __v_334);
+    let __v_373: G = G::from_u64(16777216);
+    let __v_374: G = (__v_373 * __v_335);
+    let __v_375: G = (__v_372 + __v_374);
+    let __v_376: G = (__v_370 + __v_375);
+    let __v_377: G = (__v_332 + __v_376);
+    let __v_378: G = G::from_u64(256);
+    let __v_379: G = (__v_378 * __v_337);
+    let __v_380: G = G::from_u64(65536);
+    let __v_381: G = (__v_380 * __v_338);
+    let __v_382: G = G::from_u64(16777216);
+    let __v_383: G = (__v_382 * __v_339);
+    let __v_384: G = (__v_381 + __v_383);
+    let __v_385: G = (__v_379 + __v_384);
+    let __v_386: G = (__v_336 + __v_385);
+    let __v_387: G = G::from_u64(256);
+    let __v_388: G = (__v_387 * __v_341);
+    let __v_389: G = G::from_u64(65536);
+    let __v_390: G = (__v_389 * __v_342);
+    let __v_391: G = G::from_u64(16777216);
+    let __v_392: G = (__v_391 * __v_343);
+    let __v_393: G = (__v_390 + __v_392);
+    let __v_394: G = (__v_388 + __v_393);
+    let __v_395: G = (__v_340 + __v_394);
+    let __v_396: G = G::from_u64(256);
+    let __v_397: G = (__v_396 * __v_345);
+    let __v_398: G = G::from_u64(65536);
+    let __v_399: G = (__v_398 * __v_346);
+    let __v_400: G = G::from_u64(16777216);
+    let __v_401: G = (__v_400 * __v_347);
+    let __v_402: G = (__v_399 + __v_401);
+    let __v_403: G = (__v_397 + __v_402);
+    let __v_404: G = (__v_344 + __v_403);
+    let __v_405: G = G::from_u64(256);
+    let __v_406: G = (__v_405 * __v_349);
+    let __v_407: G = G::from_u64(65536);
+    let __v_408: G = (__v_407 * __v_350);
+    let __v_409: G = G::from_u64(16777216);
+    let __v_410: G = (__v_409 * __v_351);
+    let __v_411: G = (__v_408 + __v_410);
+    let __v_412: G = (__v_406 + __v_411);
+    let __v_413: G = (__v_348 + __v_412);
+    let __v_414: G = G::from_u64(256);
+    let __v_415: G = (__v_414 * __v_353);
+    let __v_416: G = G::from_u64(65536);
+    let __v_417: G = (__v_416 * __v_354);
+    let __v_418: G = G::from_u64(16777216);
+    let __v_419: G = (__v_418 * __v_355);
+    let __v_420: G = (__v_417 + __v_419);
+    let __v_421: G = (__v_415 + __v_420);
+    let __v_422: G = (__v_352 + __v_421);
+    let __v_423: G = G::from_u64(256);
+    let __v_424: G = (__v_423 * __v_357);
+    let __v_425: G = G::from_u64(65536);
+    let __v_426: G = (__v_425 * __v_358);
+    let __v_427: G = G::from_u64(16777216);
+    let __v_428: G = (__v_427 * __v_359);
+    let __v_429: G = (__v_426 + __v_428);
+    let __v_430: G = (__v_424 + __v_429);
+    let __v_431: G = (__v_356 + __v_430);
+    if (__v_368 != __v_259) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_368.as_canonical_u64(), rhs: __v_259.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_377 != __v_260) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_377.as_canonical_u64(), rhs: __v_260.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_386 != __v_261) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_386.as_canonical_u64(), rhs: __v_261.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_395 != __v_262) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_395.as_canonical_u64(), rhs: __v_262.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_404 != __v_263) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_404.as_canonical_u64(), rhs: __v_263.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_413 != __v_264) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_413.as_canonical_u64(), rhs: __v_264.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_422 != __v_265) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_422.as_canonical_u64(), rhs: __v_265.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_431 != __v_266) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_431.as_canonical_u64(), rhs: __v_266.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_276]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_432: G = __r_arr[0];
+    let __v_433: G = __r_arr[1];
+    let __v_434: G = __r_arr[2];
+    let __v_435: G = __r_arr[3];
+    let __v_436: G = __r_arr[4];
+    let __v_437: G = __r_arr[5];
+    let __v_438: G = __r_arr[6];
+    let __v_439: G = __r_arr[7];
+    let __v_440: G = __r_arr[8];
+    let __v_441: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_441]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_442: G = __r_arr[0];
+    let __v_443: G = __r_arr[1];
+    let __v_444: G = __r_arr[2];
+    let __v_445: G = __r_arr[3];
+    let __v_446: G = __r_arr[4];
+    let __v_447: G = __r_arr[5];
+    let __v_448: G = __r_arr[6];
+    let __v_449: G = __r_arr[7];
+    let __v_450: G = __r_arr[8];
+    let __v_451: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_451]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_452: G = __r_arr[0];
+    let __v_453: G = __r_arr[1];
+    let __v_454: G = __r_arr[2];
+    let __v_455: G = __r_arr[3];
+    let __v_456: G = __r_arr[4];
+    let __v_457: G = __r_arr[5];
+    let __v_458: G = __r_arr[6];
+    let __v_459: G = __r_arr[7];
+    let __v_460: G = __r_arr[8];
+    let __v_461: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_461]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_462: G = __r_arr[0];
+    let __v_463: G = __r_arr[1];
+    let __v_464: G = __r_arr[2];
+    let __v_465: G = __r_arr[3];
+    let __v_466: G = __r_arr[4];
+    let __v_467: G = __r_arr[5];
+    let __v_468: G = __r_arr[6];
+    let __v_469: G = __r_arr[7];
+    let __v_470: G = __r_arr[8];
+    let __v_471: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_471]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_472: G = __r_arr[0];
+    let __v_473: G = __r_arr[1];
+    let __v_474: G = __r_arr[2];
+    let __v_475: G = __r_arr[3];
+    let __v_476: G = __r_arr[4];
+    let __v_477: G = __r_arr[5];
+    let __v_478: G = __r_arr[6];
+    let __v_479: G = __r_arr[7];
+    let __v_480: G = __r_arr[8];
+    let __v_481: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_481]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_482: G = __r_arr[0];
+    let __v_483: G = __r_arr[1];
+    let __v_484: G = __r_arr[2];
+    let __v_485: G = __r_arr[3];
+    let __v_486: G = __r_arr[4];
+    let __v_487: G = __r_arr[5];
+    let __v_488: G = __r_arr[6];
+    let __v_489: G = __r_arr[7];
+    let __v_490: G = __r_arr[8];
+    let __v_491: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_491]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_492: G = __r_arr[0];
-    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_397]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
-    let __v_493: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_395, __v_396]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_494: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_398, __v_399]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_495: G = __r_arr[0];
-    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_489]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
-    let __v_496: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_490, __v_491]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_497: G = __r_arr[0];
-    let __r_arr: [G; OUT_223] = { let __args: [G; IN_223] = [__v_492, __v_493, __v_496]; let __cu = unconstrained; let __hit = record.function_queries[223].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[223].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[223].bump_multiplicity(__i); } let __ret: [G; OUT_223] = unsafe { *(record.function_queries[223].output_at(__i).as_ptr() as *const [G; OUT_223]) }; __ret }, _ => aiur_fn_223(__args, record, io_buffer, __cu)? } };
-    let __r_arr: [G; OUT_226] = { let __args: [G; IN_226] = [__v_494, __v_495, __v_496, __v_497]; let __cu = unconstrained; let __hit = record.function_queries[226].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[226].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[226].bump_multiplicity(__i); } let __ret: [G; OUT_226] = unsafe { *(record.function_queries[226].output_at(__i).as_ptr() as *const [G; OUT_226]) }; __ret }, _ => aiur_fn_226(__args, record, io_buffer, __cu)? } };
-    let __v_498: G = G::from_u64(96);
-    if (__v_19 != __v_498) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_498.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    let __v_499: G = G::from_u64(256);
-    let __v_500: G = (__v_499 * __v_74);
-    let __v_501: G = G::from_u64(65536);
-    let __v_502: G = (__v_501 * __v_75);
-    let __v_503: G = G::from_u64(16777216);
-    let __v_504: G = (__v_503 * __v_76);
-    let __v_505: G = (__v_502 + __v_504);
-    let __v_506: G = (__v_500 + __v_505);
-    let __v_507: G = (__v_73 + __v_506);
-    let __v_508: G = G::from_u64(256);
-    let __v_509: G = (__v_508 * __v_78);
-    let __v_510: G = G::from_u64(65536);
-    let __v_511: G = (__v_510 * __v_79);
-    let __v_512: G = G::from_u64(16777216);
-    let __v_513: G = (__v_512 * __v_80);
-    let __v_514: G = (__v_511 + __v_513);
-    let __v_515: G = (__v_509 + __v_514);
-    let __v_516: G = (__v_77 + __v_515);
-    let __v_517: G = G::from_u64(256);
-    let __v_518: G = (__v_517 * __v_82);
-    let __v_519: G = G::from_u64(65536);
-    let __v_520: G = (__v_519 * __v_83);
-    let __v_521: G = G::from_u64(16777216);
-    let __v_522: G = (__v_521 * __v_84);
-    let __v_523: G = (__v_520 + __v_522);
-    let __v_524: G = (__v_518 + __v_523);
-    let __v_525: G = (__v_81 + __v_524);
-    let __v_526: G = G::from_u64(256);
-    let __v_527: G = (__v_526 * __v_86);
-    let __v_528: G = G::from_u64(65536);
-    let __v_529: G = (__v_528 * __v_87);
-    let __v_530: G = G::from_u64(16777216);
-    let __v_531: G = (__v_530 * __v_88);
-    let __v_532: G = (__v_529 + __v_531);
-    let __v_533: G = (__v_527 + __v_532);
-    let __v_534: G = (__v_85 + __v_533);
-    let __v_535: G = G::from_u64(256);
-    let __v_536: G = (__v_535 * __v_90);
-    let __v_537: G = G::from_u64(65536);
-    let __v_538: G = (__v_537 * __v_91);
-    let __v_539: G = G::from_u64(16777216);
-    let __v_540: G = (__v_539 * __v_92);
-    let __v_541: G = (__v_538 + __v_540);
-    let __v_542: G = (__v_536 + __v_541);
-    let __v_543: G = (__v_89 + __v_542);
-    let __v_544: G = G::from_u64(256);
-    let __v_545: G = (__v_544 * __v_94);
-    let __v_546: G = G::from_u64(65536);
-    let __v_547: G = (__v_546 * __v_95);
-    let __v_548: G = G::from_u64(16777216);
-    let __v_549: G = (__v_548 * __v_96);
-    let __v_550: G = (__v_547 + __v_549);
-    let __v_551: G = (__v_545 + __v_550);
-    let __v_552: G = (__v_93 + __v_551);
-    let __v_553: G = G::from_u64(256);
-    let __v_554: G = (__v_553 * __v_98);
-    let __v_555: G = G::from_u64(65536);
-    let __v_556: G = (__v_555 * __v_99);
-    let __v_557: G = G::from_u64(16777216);
-    let __v_558: G = (__v_557 * __v_100);
-    let __v_559: G = (__v_556 + __v_558);
-    let __v_560: G = (__v_554 + __v_559);
-    let __v_561: G = (__v_97 + __v_560);
-    let __v_562: G = G::from_u64(256);
-    let __v_563: G = (__v_562 * __v_102);
-    let __v_564: G = G::from_u64(65536);
-    let __v_565: G = (__v_564 * __v_103);
-    let __v_566: G = G::from_u64(16777216);
-    let __v_567: G = (__v_566 * __v_104);
-    let __v_568: G = (__v_565 + __v_567);
-    let __v_569: G = (__v_563 + __v_568);
-    let __v_570: G = (__v_101 + __v_569);
-    if (__v_507 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_507.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_516 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_516.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_525 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_525.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_534 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_534.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_543 != __v_4) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_543.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_552 != __v_5) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_552.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_561 != __v_6) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_561.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_570 != __v_7) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_570.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("join: allowed blob digest mismatch".to_string()) });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_172.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_571: G = __loaded[0];
-    let __v_572: G = __loaded[1];
-    let __v_573: G = __loaded[2];
-    let __v_574: G = G::from_u64(1);
-    let __v_575: G = G::from_u64(1);
-    if (__v_571 != __v_574) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_571.as_canonical_u64(), rhs: __v_574.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    if (__v_572 != __v_575) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_572.as_canonical_u64(), rhs: __v_575.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    if (__v_573 != __v_575) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_573.as_canonical_u64(), rhs: __v_575.as_canonical_u64(), msg: Some("join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    let __v_576: G = G::from_u64(256);
-    let __v_577: G = (__v_576 * __v_251);
-    let __v_578: G = G::from_u64(65536);
-    let __v_579: G = (__v_578 * __v_252);
-    let __v_580: G = G::from_u64(16777216);
-    let __v_581: G = (__v_580 * __v_253);
-    let __v_582: G = (__v_579 + __v_581);
-    let __v_583: G = (__v_577 + __v_582);
-    let __v_584: G = (__v_250 + __v_583);
-    let __v_585: G = G::from_u64(256);
-    let __v_586: G = (__v_585 * __v_255);
-    let __v_587: G = G::from_u64(65536);
-    let __v_588: G = (__v_587 * __v_256);
-    let __v_589: G = G::from_u64(16777216);
-    let __v_590: G = (__v_589 * __v_257);
-    let __v_591: G = (__v_588 + __v_590);
-    let __v_592: G = (__v_586 + __v_591);
-    let __v_593: G = (__v_254 + __v_592);
-    let __v_594: G = G::from_u64(256);
-    let __v_595: G = (__v_594 * __v_259);
-    let __v_596: G = G::from_u64(65536);
-    let __v_597: G = (__v_596 * __v_260);
-    let __v_598: G = G::from_u64(16777216);
-    let __v_599: G = (__v_598 * __v_261);
-    let __v_600: G = (__v_597 + __v_599);
-    let __v_601: G = (__v_595 + __v_600);
-    let __v_602: G = (__v_258 + __v_601);
-    let __v_603: G = G::from_u64(256);
-    let __v_604: G = (__v_603 * __v_263);
-    let __v_605: G = G::from_u64(65536);
-    let __v_606: G = (__v_605 * __v_264);
-    let __v_607: G = G::from_u64(16777216);
-    let __v_608: G = (__v_607 * __v_265);
-    let __v_609: G = (__v_606 + __v_608);
-    let __v_610: G = (__v_604 + __v_609);
-    let __v_611: G = (__v_262 + __v_610);
-    let __v_612: G = G::from_u64(256);
-    let __v_613: G = (__v_612 * __v_267);
-    let __v_614: G = G::from_u64(65536);
-    let __v_615: G = (__v_614 * __v_268);
-    let __v_616: G = G::from_u64(16777216);
-    let __v_617: G = (__v_616 * __v_269);
-    let __v_618: G = (__v_615 + __v_617);
-    let __v_619: G = (__v_613 + __v_618);
-    let __v_620: G = (__v_266 + __v_619);
-    let __v_621: G = G::from_u64(256);
-    let __v_622: G = (__v_621 * __v_271);
-    let __v_623: G = G::from_u64(65536);
-    let __v_624: G = (__v_623 * __v_272);
-    let __v_625: G = G::from_u64(16777216);
-    let __v_626: G = (__v_625 * __v_273);
-    let __v_627: G = (__v_624 + __v_626);
-    let __v_628: G = (__v_622 + __v_627);
-    let __v_629: G = (__v_270 + __v_628);
-    let __v_630: G = G::from_u64(256);
-    let __v_631: G = (__v_630 * __v_275);
-    let __v_632: G = G::from_u64(65536);
-    let __v_633: G = (__v_632 * __v_276);
-    let __v_634: G = G::from_u64(16777216);
-    let __v_635: G = (__v_634 * __v_277);
-    let __v_636: G = (__v_633 + __v_635);
-    let __v_637: G = (__v_631 + __v_636);
-    let __v_638: G = (__v_274 + __v_637);
-    let __v_639: G = G::from_u64(256);
-    let __v_640: G = (__v_639 * __v_279);
-    let __v_641: G = G::from_u64(65536);
-    let __v_642: G = (__v_641 * __v_280);
-    let __v_643: G = G::from_u64(16777216);
-    let __v_644: G = (__v_643 * __v_281);
-    let __v_645: G = (__v_642 + __v_644);
-    let __v_646: G = (__v_640 + __v_645);
-    let __v_647: G = (__v_278 + __v_646);
-    if (__v_584 != __v_181) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_584.as_canonical_u64(), rhs: __v_181.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_593 != __v_182) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_593.as_canonical_u64(), rhs: __v_182.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_602 != __v_183) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_602.as_canonical_u64(), rhs: __v_183.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_611 != __v_184) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_611.as_canonical_u64(), rhs: __v_184.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_620 != __v_185) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_620.as_canonical_u64(), rhs: __v_185.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_629 != __v_186) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_629.as_canonical_u64(), rhs: __v_186.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_638 != __v_187) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_638.as_canonical_u64(), rhs: __v_187.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_647 != __v_188) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_647.as_canonical_u64(), rhs: __v_188.as_canonical_u64(), msg: Some("join: recursion vk digest mismatch".to_string()) });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_386.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_648: G = __loaded[0];
-    let __v_649: G = __loaded[1];
-    let __v_650: G = __loaded[2];
-    let __v_651: G = G::from_u64(1);
-    let __v_652: G = G::from_u64(1);
-    if (__v_648 != __v_651) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_648.as_canonical_u64(), rhs: __v_651.as_canonical_u64(), msg: None });
-    }
-    if (__v_649 != __v_652) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_649.as_canonical_u64(), rhs: __v_652.as_canonical_u64(), msg: None });
-    }
-    if (__v_650 != __v_652) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_650.as_canonical_u64(), rhs: __v_652.as_canonical_u64(), msg: None });
-    }
+    let __v_493: G = __r_arr[1];
+    let __v_494: G = __r_arr[2];
+    let __v_495: G = __r_arr[3];
+    let __v_496: G = __r_arr[4];
+    let __v_497: G = __r_arr[5];
+    let __v_498: G = __r_arr[6];
+    let __v_499: G = __r_arr[7];
+    let __v_500: G = __r_arr[8];
+    let __v_501: G = __r_arr[9];
+    let __v_502: G = G::from_u64(1);
+    let __v_503: G = G::from_u64(1);
+    let __v_504: G = { let __values: [G; 10] = [__v_502, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_505: G = G::from_u64(0);
+    let __v_506: G = { let __values: [G; 10] = [__v_505, __v_493, __v_494, __v_495, __v_496, __v_497, __v_498, __v_499, __v_500, __v_504]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_507: G = G::from_u64(0);
+    let __v_508: G = { let __values: [G; 10] = [__v_507, __v_483, __v_484, __v_485, __v_486, __v_487, __v_488, __v_489, __v_490, __v_506]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_509: G = G::from_u64(0);
+    let __v_510: G = { let __values: [G; 10] = [__v_509, __v_473, __v_474, __v_475, __v_476, __v_477, __v_478, __v_479, __v_480, __v_508]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_511: G = G::from_u64(0);
+    let __v_512: G = { let __values: [G; 10] = [__v_511, __v_463, __v_464, __v_465, __v_466, __v_467, __v_468, __v_469, __v_470, __v_510]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_513: G = G::from_u64(0);
+    let __v_514: G = { let __values: [G; 10] = [__v_513, __v_453, __v_454, __v_455, __v_456, __v_457, __v_458, __v_459, __v_460, __v_512]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_515: G = G::from_u64(0);
+    let __v_516: G = { let __values: [G; 10] = [__v_515, __v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_449, __v_450, __v_514]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_517: G = G::from_u64(0);
+    let __v_518: G = { let __values: [G; 10] = [__v_517, __v_433, __v_434, __v_435, __v_436, __v_437, __v_438, __v_439, __v_440, __v_516]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_501]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_519: G = __r_arr[0];
+    let __v_520: G = __r_arr[1];
+    let __v_521: G = __r_arr[2];
+    let __v_522: G = __r_arr[3];
+    let __v_523: G = __r_arr[4];
+    let __v_524: G = __r_arr[5];
+    let __v_525: G = __r_arr[6];
+    let __v_526: G = __r_arr[7];
+    let __v_527: G = __r_arr[8];
+    let __v_528: G = __r_arr[9];
+    let __r_arr: [G; OUT_93] = { let __args: [G; IN_93] = [__v_528, __v_519]; let __cu = unconstrained; let __hit = record.function_queries[93].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[93].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[93].bump_multiplicity(__i); } let __ret: [G; OUT_93] = unsafe { *(record.function_queries[93].output_at(__i).as_ptr() as *const [G; OUT_93]) }; __ret }, _ => aiur_fn_93(__args, record, io_buffer, __cu)? } };
+    let __v_529: G = __r_arr[0];
+    let __v_530: G = __r_arr[1];
+    let __v_531: G = __r_arr[2];
+    let __r_arr: [G; OUT_94] = { let __args: [G; IN_94] = [__v_531]; let __cu = unconstrained; let __hit = record.function_queries[94].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[94].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[94].bump_multiplicity(__i); } let __ret: [G; OUT_94] = unsafe { *(record.function_queries[94].output_at(__i).as_ptr() as *const [G; OUT_94]) }; __ret }, _ => aiur_fn_94(__args, record, io_buffer, __cu)? } };
+    let __v_532: G = __r_arr[0];
+    let __v_533: G = __r_arr[1];
+    let __v_534: G = __r_arr[2];
+    let __r_arr: [G; OUT_95] = { let __args: [G; IN_95] = [__v_534, __v_519]; let __cu = unconstrained; let __hit = record.function_queries[95].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[95].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[95].bump_multiplicity(__i); } let __ret: [G; OUT_95] = unsafe { *(record.function_queries[95].output_at(__i).as_ptr() as *const [G; OUT_95]) }; __ret }, _ => aiur_fn_95(__args, record, io_buffer, __cu)? } };
+    let __v_535: G = __r_arr[0];
+    let __v_536: G = __r_arr[1];
+    let __v_537: G = G::from_u64(0);
+    let __v_538: G = { let __values: [G; 10] = [__v_537, __v_520, __v_521, __v_522, __v_523, __v_524, __v_525, __v_526, __v_527, __v_530]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_518, __v_538]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __v_539: G = __r_arr[0];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_536.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_540: G = __loaded[0];
+    let __v_541: G = __loaded[1];
+    let __v_542: G = __loaded[2];
+    let __v_543: G = G::from_u64(1);
+    let __v_544: G = G::from_u64(1);
+    if (__v_540 != __v_543) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_540.as_canonical_u64(), rhs: __v_543.as_canonical_u64(), msg: None });
+    }
+    if (__v_541 != __v_544) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_541.as_canonical_u64(), rhs: __v_544.as_canonical_u64(), msg: None });
+    }
+    if (__v_542 != __v_544) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_542.as_canonical_u64(), rhs: __v_544.as_canonical_u64(), msg: None });
+    }
+    let __v_545: G = G::from_u64(0);
+    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_432, __v_442, __v_452, __v_462, __v_472, __v_482, __v_492, __v_539, __v_529, __v_532, __v_533, __v_535, __v_545]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
+    let __v_546: G = __r_arr[0];
+    let __v_547: G = G::from_u64(1);
+    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_432, __v_442, __v_452, __v_462, __v_472, __v_482, __v_492, __v_539, __v_529, __v_532, __v_533, __v_535, __v_547]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
+    let __v_548: G = __r_arr[0];
+    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_546, __v_251, __v_252, __v_253, __v_254, __v_255, __v_256, __v_257, __v_258, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_267, __v_268, __v_269, __v_270]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
+    let __v_549: G = __r_arr[0];
+    let __v_550: G = __r_arr[1];
+    let __v_551: G = __r_arr[2];
+    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_548, __v_251, __v_252, __v_253, __v_254, __v_255, __v_256, __v_257, __v_258, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_267, __v_268, __v_269, __v_270]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
+    let __v_552: G = __r_arr[0];
+    let __v_553: G = __r_arr[1];
+    let __v_554: G = __r_arr[2];
+    let __v_555: G = G::from_u64(2);
+    let __v_556: G = G::from_u64(2);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_556]; let __info = io_buffer.get_info(__v_555, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_557: G = __io_pair.0;
+    let __v_558: G = __io_pair.1;
+    let __v_559: G = G::from_u64(2);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_559, __v_557, __v_558]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_560: G = __r_arr[0];
+    let __v_561: G = G::from_u64(103);
+    let __v_562: G = G::from_u64(230);
+    let __v_563: G = G::from_u64(9);
+    let __v_564: G = G::from_u64(106);
+    let __v_565: G = G::from_u64(133);
+    let __v_566: G = G::from_u64(174);
+    let __v_567: G = G::from_u64(103);
+    let __v_568: G = G::from_u64(187);
+    let __v_569: G = G::from_u64(114);
+    let __v_570: G = G::from_u64(243);
+    let __v_571: G = G::from_u64(110);
+    let __v_572: G = G::from_u64(60);
+    let __v_573: G = G::from_u64(58);
+    let __v_574: G = G::from_u64(245);
+    let __v_575: G = G::from_u64(79);
+    let __v_576: G = G::from_u64(165);
+    let __v_577: G = G::from_u64(127);
+    let __v_578: G = G::from_u64(82);
+    let __v_579: G = G::from_u64(14);
+    let __v_580: G = G::from_u64(81);
+    let __v_581: G = G::from_u64(140);
+    let __v_582: G = G::from_u64(104);
+    let __v_583: G = G::from_u64(5);
+    let __v_584: G = G::from_u64(155);
+    let __v_585: G = G::from_u64(171);
+    let __v_586: G = G::from_u64(217);
+    let __v_587: G = G::from_u64(131);
+    let __v_588: G = G::from_u64(31);
+    let __v_589: G = G::from_u64(25);
+    let __v_590: G = G::from_u64(205);
+    let __v_591: G = G::from_u64(224);
+    let __v_592: G = G::from_u64(91);
+    let __v_593: G = G::from_u64(1);
+    let __v_594: G = G::from_u64(1);
+    let __v_595: G = { let __values: [G; 3] = [__v_593, __v_594, __v_594]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_596: G = G::from_u64(0);
+    let __v_597: G = G::from_u64(0);
+    let __v_598: G = G::from_u64(0);
+    let __v_599: G = G::from_u64(0);
+    let __v_600: G = G::from_u64(0);
+    let __v_601: G = G::from_u64(0);
+    let __v_602: G = G::from_u64(0);
+    let __v_603: G = G::from_u64(0);
+    let __v_604: G = G::from_u64(0);
+    let __v_605: G = G::from_u64(0);
+    let __v_606: G = { let __values: [G; 8] = [__v_598, __v_599, __v_600, __v_601, __v_602, __v_603, __v_604, __v_605]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_607: G = { let __values: [G; 32] = [__v_561, __v_562, __v_563, __v_564, __v_565, __v_566, __v_567, __v_568, __v_569, __v_570, __v_571, __v_572, __v_573, __v_574, __v_575, __v_576, __v_577, __v_578, __v_579, __v_580, __v_581, __v_582, __v_583, __v_584, __v_585, __v_586, __v_587, __v_588, __v_589, __v_590, __v_591, __v_592]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_608: G = G::from_u64(1);
+    let __v_609: G = G::from_u64(1);
+    let __v_610: G = { let __values: [G; 34] = [__v_608, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_560, __v_595, __v_596, __v_597, __v_606, __v_607, __v_610]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
+    let __v_611: G = __r_arr[0];
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_611]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_612: G = __r_arr[0];
+    let __v_613: G = __r_arr[1];
+    let __v_614: G = __r_arr[2];
+    let __v_615: G = __r_arr[3];
+    let __v_616: G = __r_arr[4];
+    let __v_617: G = __r_arr[5];
+    let __v_618: G = __r_arr[6];
+    let __v_619: G = __r_arr[7];
+    let __v_620: G = __r_arr[8];
+    let __v_621: G = __r_arr[9];
+    let __v_622: G = __r_arr[10];
+    let __v_623: G = __r_arr[11];
+    let __v_624: G = __r_arr[12];
+    let __v_625: G = __r_arr[13];
+    let __v_626: G = __r_arr[14];
+    let __v_627: G = __r_arr[15];
+    let __v_628: G = __r_arr[16];
+    let __v_629: G = __r_arr[17];
+    let __v_630: G = __r_arr[18];
+    let __v_631: G = __r_arr[19];
+    let __v_632: G = __r_arr[20];
+    let __v_633: G = __r_arr[21];
+    let __v_634: G = __r_arr[22];
+    let __v_635: G = __r_arr[23];
+    let __v_636: G = __r_arr[24];
+    let __v_637: G = __r_arr[25];
+    let __v_638: G = __r_arr[26];
+    let __v_639: G = __r_arr[27];
+    let __v_640: G = __r_arr[28];
+    let __v_641: G = __r_arr[29];
+    let __v_642: G = __r_arr[30];
+    let __v_643: G = __r_arr[31];
+    let __v_644: G = G::from_u64(256);
+    let __v_645: G = (__v_644 * __v_613);
+    let __v_646: G = G::from_u64(65536);
+    let __v_647: G = (__v_646 * __v_614);
+    let __v_648: G = G::from_u64(16777216);
+    let __v_649: G = (__v_648 * __v_615);
+    let __v_650: G = (__v_647 + __v_649);
+    let __v_651: G = (__v_645 + __v_650);
+    let __v_652: G = (__v_612 + __v_651);
     let __v_653: G = G::from_u64(256);
-    let __v_654: G = (__v_653 * __v_458);
+    let __v_654: G = (__v_653 * __v_617);
     let __v_655: G = G::from_u64(65536);
-    let __v_656: G = (__v_655 * __v_459);
+    let __v_656: G = (__v_655 * __v_618);
     let __v_657: G = G::from_u64(16777216);
-    let __v_658: G = (__v_657 * __v_460);
+    let __v_658: G = (__v_657 * __v_619);
     let __v_659: G = (__v_656 + __v_658);
     let __v_660: G = (__v_654 + __v_659);
-    let __v_661: G = (__v_457 + __v_660);
+    let __v_661: G = (__v_616 + __v_660);
     let __v_662: G = G::from_u64(256);
-    let __v_663: G = (__v_662 * __v_462);
+    let __v_663: G = (__v_662 * __v_621);
     let __v_664: G = G::from_u64(65536);
-    let __v_665: G = (__v_664 * __v_463);
+    let __v_665: G = (__v_664 * __v_622);
     let __v_666: G = G::from_u64(16777216);
-    let __v_667: G = (__v_666 * __v_464);
+    let __v_667: G = (__v_666 * __v_623);
     let __v_668: G = (__v_665 + __v_667);
     let __v_669: G = (__v_663 + __v_668);
-    let __v_670: G = (__v_461 + __v_669);
+    let __v_670: G = (__v_620 + __v_669);
     let __v_671: G = G::from_u64(256);
-    let __v_672: G = (__v_671 * __v_466);
+    let __v_672: G = (__v_671 * __v_625);
     let __v_673: G = G::from_u64(65536);
-    let __v_674: G = (__v_673 * __v_467);
+    let __v_674: G = (__v_673 * __v_626);
     let __v_675: G = G::from_u64(16777216);
-    let __v_676: G = (__v_675 * __v_468);
+    let __v_676: G = (__v_675 * __v_627);
     let __v_677: G = (__v_674 + __v_676);
     let __v_678: G = (__v_672 + __v_677);
-    let __v_679: G = (__v_465 + __v_678);
+    let __v_679: G = (__v_624 + __v_678);
     let __v_680: G = G::from_u64(256);
-    let __v_681: G = (__v_680 * __v_470);
+    let __v_681: G = (__v_680 * __v_629);
     let __v_682: G = G::from_u64(65536);
-    let __v_683: G = (__v_682 * __v_471);
+    let __v_683: G = (__v_682 * __v_630);
     let __v_684: G = G::from_u64(16777216);
-    let __v_685: G = (__v_684 * __v_472);
+    let __v_685: G = (__v_684 * __v_631);
     let __v_686: G = (__v_683 + __v_685);
     let __v_687: G = (__v_681 + __v_686);
-    let __v_688: G = (__v_469 + __v_687);
+    let __v_688: G = (__v_628 + __v_687);
     let __v_689: G = G::from_u64(256);
-    let __v_690: G = (__v_689 * __v_474);
+    let __v_690: G = (__v_689 * __v_633);
     let __v_691: G = G::from_u64(65536);
-    let __v_692: G = (__v_691 * __v_475);
+    let __v_692: G = (__v_691 * __v_634);
     let __v_693: G = G::from_u64(16777216);
-    let __v_694: G = (__v_693 * __v_476);
+    let __v_694: G = (__v_693 * __v_635);
     let __v_695: G = (__v_692 + __v_694);
     let __v_696: G = (__v_690 + __v_695);
-    let __v_697: G = (__v_473 + __v_696);
+    let __v_697: G = (__v_632 + __v_696);
     let __v_698: G = G::from_u64(256);
-    let __v_699: G = (__v_698 * __v_478);
+    let __v_699: G = (__v_698 * __v_637);
     let __v_700: G = G::from_u64(65536);
-    let __v_701: G = (__v_700 * __v_479);
+    let __v_701: G = (__v_700 * __v_638);
     let __v_702: G = G::from_u64(16777216);
-    let __v_703: G = (__v_702 * __v_480);
+    let __v_703: G = (__v_702 * __v_639);
     let __v_704: G = (__v_701 + __v_703);
     let __v_705: G = (__v_699 + __v_704);
-    let __v_706: G = (__v_477 + __v_705);
+    let __v_706: G = (__v_636 + __v_705);
     let __v_707: G = G::from_u64(256);
-    let __v_708: G = (__v_707 * __v_482);
+    let __v_708: G = (__v_707 * __v_641);
     let __v_709: G = G::from_u64(65536);
-    let __v_710: G = (__v_709 * __v_483);
+    let __v_710: G = (__v_709 * __v_642);
     let __v_711: G = G::from_u64(16777216);
-    let __v_712: G = (__v_711 * __v_484);
+    let __v_712: G = (__v_711 * __v_643);
     let __v_713: G = (__v_710 + __v_712);
     let __v_714: G = (__v_708 + __v_713);
-    let __v_715: G = (__v_481 + __v_714);
-    let __v_716: G = G::from_u64(256);
-    let __v_717: G = (__v_716 * __v_486);
-    let __v_718: G = G::from_u64(65536);
-    let __v_719: G = (__v_718 * __v_487);
-    let __v_720: G = G::from_u64(16777216);
-    let __v_721: G = (__v_720 * __v_488);
-    let __v_722: G = (__v_719 + __v_721);
-    let __v_723: G = (__v_717 + __v_722);
-    let __v_724: G = (__v_485 + __v_723);
-    if (__v_661 != __v_8) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_661.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_670 != __v_9) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_670.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_679 != __v_10) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_679.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_688 != __v_11) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_688.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_697 != __v_12) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_697.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_706 != __v_13) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_706.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_715 != __v_14) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_715.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_724 != __v_15) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_724.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
-    }
+    let __v_715: G = (__v_640 + __v_714);
+    if (__v_652 != __v_8) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_652.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_661 != __v_9) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_661.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_670 != __v_10) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_670.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_679 != __v_11) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_679.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_688 != __v_12) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_688.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_697 != __v_13) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_697.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_706 != __v_14) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_706.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_715 != __v_15) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_715.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("join: output claim digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_560]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
+    let __v_716: G = __r_arr[0];
+    let __v_717: G = __r_arr[1];
+    let __v_718: G = __r_arr[2];
+    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_549]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_719: G = __r_arr[0];
+    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_552]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_720: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_550, __v_551]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_721: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_553, __v_554]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_722: G = __r_arr[0];
+    let __r_arr: [G; OUT_220] = { let __args: [G; IN_220] = [__v_716]; let __cu = unconstrained; let __hit = record.function_queries[220].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[220].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[220].bump_multiplicity(__i); } let __ret: [G; OUT_220] = unsafe { *(record.function_queries[220].output_at(__i).as_ptr() as *const [G; OUT_220]) }; __ret }, _ => aiur_fn_220(__args, record, io_buffer, __cu)? } };
+    let __v_723: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_717, __v_718]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_724: G = __r_arr[0];
+    let __r_arr: [G; OUT_223] = { let __args: [G; IN_223] = [__v_719, __v_720, __v_723]; let __cu = unconstrained; let __hit = record.function_queries[223].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[223].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[223].bump_multiplicity(__i); } let __ret: [G; OUT_223] = unsafe { *(record.function_queries[223].output_at(__i).as_ptr() as *const [G; OUT_223]) }; __ret }, _ => aiur_fn_223(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_226] = { let __args: [G; IN_226] = [__v_721, __v_722, __v_723, __v_724]; let __cu = unconstrained; let __hit = record.function_queries[226].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[226].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[226].bump_multiplicity(__i); } let __ret: [G; OUT_226] = unsafe { *(record.function_queries[226].output_at(__i).as_ptr() as *const [G; OUT_226]) }; __ret }, _ => aiur_fn_226(__args, record, io_buffer, __cu)? } };
     let __ret: [G; OUT_240] = [];
     record.function_queries[240].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -24306,45 +24306,48 @@ fn aiur_fn_241(
     let __io_pair: (G, G) = { let __key: [G; 1] = [__v_17]; let __info = io_buffer.get_info(__v_16, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
     let __v_18: G = __io_pair.0;
     let __v_19: G = __io_pair.1;
-    let __v_20: G = G::from_u64(3);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_20, __v_18, __v_19]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_21: G = __r_arr[0];
-    let __v_22: G = G::from_u64(103);
-    let __v_23: G = G::from_u64(230);
-    let __v_24: G = G::from_u64(9);
-    let __v_25: G = G::from_u64(106);
-    let __v_26: G = G::from_u64(133);
-    let __v_27: G = G::from_u64(174);
-    let __v_28: G = G::from_u64(103);
-    let __v_29: G = G::from_u64(187);
-    let __v_30: G = G::from_u64(114);
-    let __v_31: G = G::from_u64(243);
-    let __v_32: G = G::from_u64(110);
-    let __v_33: G = G::from_u64(60);
-    let __v_34: G = G::from_u64(58);
-    let __v_35: G = G::from_u64(245);
-    let __v_36: G = G::from_u64(79);
-    let __v_37: G = G::from_u64(165);
-    let __v_38: G = G::from_u64(127);
-    let __v_39: G = G::from_u64(82);
-    let __v_40: G = G::from_u64(14);
-    let __v_41: G = G::from_u64(81);
-    let __v_42: G = G::from_u64(140);
-    let __v_43: G = G::from_u64(104);
-    let __v_44: G = G::from_u64(5);
-    let __v_45: G = G::from_u64(155);
-    let __v_46: G = G::from_u64(171);
-    let __v_47: G = G::from_u64(217);
-    let __v_48: G = G::from_u64(131);
-    let __v_49: G = G::from_u64(31);
-    let __v_50: G = G::from_u64(25);
-    let __v_51: G = G::from_u64(205);
-    let __v_52: G = G::from_u64(224);
-    let __v_53: G = G::from_u64(91);
-    let __v_54: G = G::from_u64(1);
+    let __v_20: G = G::from_u64(96);
+    if (__v_19 != __v_20) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_20.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    let __v_21: G = G::from_u64(3);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_21, __v_18, __v_19]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_22: G = __r_arr[0];
+    let __v_23: G = G::from_u64(103);
+    let __v_24: G = G::from_u64(230);
+    let __v_25: G = G::from_u64(9);
+    let __v_26: G = G::from_u64(106);
+    let __v_27: G = G::from_u64(133);
+    let __v_28: G = G::from_u64(174);
+    let __v_29: G = G::from_u64(103);
+    let __v_30: G = G::from_u64(187);
+    let __v_31: G = G::from_u64(114);
+    let __v_32: G = G::from_u64(243);
+    let __v_33: G = G::from_u64(110);
+    let __v_34: G = G::from_u64(60);
+    let __v_35: G = G::from_u64(58);
+    let __v_36: G = G::from_u64(245);
+    let __v_37: G = G::from_u64(79);
+    let __v_38: G = G::from_u64(165);
+    let __v_39: G = G::from_u64(127);
+    let __v_40: G = G::from_u64(82);
+    let __v_41: G = G::from_u64(14);
+    let __v_42: G = G::from_u64(81);
+    let __v_43: G = G::from_u64(140);
+    let __v_44: G = G::from_u64(104);
+    let __v_45: G = G::from_u64(5);
+    let __v_46: G = G::from_u64(155);
+    let __v_47: G = G::from_u64(171);
+    let __v_48: G = G::from_u64(217);
+    let __v_49: G = G::from_u64(131);
+    let __v_50: G = G::from_u64(31);
+    let __v_51: G = G::from_u64(25);
+    let __v_52: G = G::from_u64(205);
+    let __v_53: G = G::from_u64(224);
+    let __v_54: G = G::from_u64(91);
     let __v_55: G = G::from_u64(1);
-    let __v_56: G = { let __values: [G; 3] = [__v_54, __v_55, __v_55]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_57: G = G::from_u64(0);
+    let __v_56: G = G::from_u64(1);
+    let __v_57: G = { let __values: [G; 3] = [__v_55, __v_56, __v_56]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_58: G = G::from_u64(0);
     let __v_59: G = G::from_u64(0);
     let __v_60: G = G::from_u64(0);
@@ -24354,835 +24357,832 @@ fn aiur_fn_241(
     let __v_64: G = G::from_u64(0);
     let __v_65: G = G::from_u64(0);
     let __v_66: G = G::from_u64(0);
-    let __v_67: G = { let __values: [G; 8] = [__v_59, __v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_68: G = { let __values: [G; 32] = [__v_22, __v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_69: G = G::from_u64(1);
+    let __v_67: G = G::from_u64(0);
+    let __v_68: G = { let __values: [G; 8] = [__v_60, __v_61, __v_62, __v_63, __v_64, __v_65, __v_66, __v_67]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_69: G = { let __values: [G; 32] = [__v_23, __v_24, __v_25, __v_26, __v_27, __v_28, __v_29, __v_30, __v_31, __v_32, __v_33, __v_34, __v_35, __v_36, __v_37, __v_38, __v_39, __v_40, __v_41, __v_42, __v_43, __v_44, __v_45, __v_46, __v_47, __v_48, __v_49, __v_50, __v_51, __v_52, __v_53, __v_54]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_70: G = G::from_u64(1);
-    let __v_71: G = { let __values: [G; 34] = [__v_69, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70, __v_70]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_21, __v_56, __v_57, __v_58, __v_67, __v_68, __v_71]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_72: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_72]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = { let __values: [G; 34] = [__v_70, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71, __v_71]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_22, __v_57, __v_58, __v_59, __v_68, __v_69, __v_72]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
     let __v_73: G = __r_arr[0];
-    let __v_74: G = __r_arr[1];
-    let __v_75: G = __r_arr[2];
-    let __v_76: G = __r_arr[3];
-    let __v_77: G = __r_arr[4];
-    let __v_78: G = __r_arr[5];
-    let __v_79: G = __r_arr[6];
-    let __v_80: G = __r_arr[7];
-    let __v_81: G = __r_arr[8];
-    let __v_82: G = __r_arr[9];
-    let __v_83: G = __r_arr[10];
-    let __v_84: G = __r_arr[11];
-    let __v_85: G = __r_arr[12];
-    let __v_86: G = __r_arr[13];
-    let __v_87: G = __r_arr[14];
-    let __v_88: G = __r_arr[15];
-    let __v_89: G = __r_arr[16];
-    let __v_90: G = __r_arr[17];
-    let __v_91: G = __r_arr[18];
-    let __v_92: G = __r_arr[19];
-    let __v_93: G = __r_arr[20];
-    let __v_94: G = __r_arr[21];
-    let __v_95: G = __r_arr[22];
-    let __v_96: G = __r_arr[23];
-    let __v_97: G = __r_arr[24];
-    let __v_98: G = __r_arr[25];
-    let __v_99: G = __r_arr[26];
-    let __v_100: G = __r_arr[27];
-    let __v_101: G = __r_arr[28];
-    let __v_102: G = __r_arr[29];
-    let __v_103: G = __r_arr[30];
-    let __v_104: G = __r_arr[31];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_21]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_105: G = __r_arr[0];
-    let __v_106: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_106]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_107: G = __r_arr[0];
-    let __v_108: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_108]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_109: G = __r_arr[0];
-    let __v_110: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_110]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_111: G = __r_arr[0];
-    let __v_112: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_112]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_113: G = __r_arr[0];
-    let __v_114: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_114]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_115: G = __r_arr[0];
-    let __v_116: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_116]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_117: G = __r_arr[0];
-    let __v_118: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_118]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_119: G = __r_arr[0];
-    let __v_120: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_120]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_121: G = __r_arr[0];
-    let __v_122: G = __r_arr[1];
-    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_122]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
-    let __v_123: G = __r_arr[0];
-    let __v_124: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_124]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_125: G = __r_arr[0];
-    let __v_126: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_126]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_127: G = __r_arr[0];
-    let __v_128: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_128]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_129: G = __r_arr[0];
-    let __v_130: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_130]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_131: G = __r_arr[0];
-    let __v_132: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_132]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_133: G = __r_arr[0];
-    let __v_134: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_134]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_135: G = __r_arr[0];
-    let __v_136: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_136]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_137: G = __r_arr[0];
-    let __v_138: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_138]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_139: G = __r_arr[0];
-    let __v_140: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_140]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_141: G = __r_arr[0];
-    let __v_142: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_142]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_143: G = __r_arr[0];
-    let __v_144: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_144]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_145: G = __r_arr[0];
-    let __v_146: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_146]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_147: G = __r_arr[0];
-    let __v_148: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_148]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_149: G = __r_arr[0];
-    let __v_150: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_150]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_151: G = __r_arr[0];
-    let __v_152: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_152]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_153: G = __r_arr[0];
-    let __v_154: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_154]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_155: G = __r_arr[0];
-    let __v_156: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_156]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_157: G = __r_arr[0];
-    let __v_158: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_158]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_159: G = __r_arr[0];
-    let __v_160: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_160]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_161: G = __r_arr[0];
-    let __v_162: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_162]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_163: G = __r_arr[0];
-    let __v_164: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_164]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_165: G = __r_arr[0];
-    let __v_166: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_166]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_167: G = __r_arr[0];
-    let __v_168: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_168]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_169: G = __r_arr[0];
-    let __v_170: G = __r_arr[1];
-    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_170]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
-    let __v_171: G = __r_arr[0];
-    let __v_172: G = __r_arr[1];
-    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_105]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_173: G = __r_arr[0];
-    let __v_174: G = __r_arr[1];
-    let __v_175: G = __r_arr[2];
-    let __v_176: G = __r_arr[3];
-    let __v_177: G = __r_arr[4];
-    let __v_178: G = __r_arr[5];
-    let __v_179: G = __r_arr[6];
-    let __v_180: G = __r_arr[7];
-    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_123]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
-    let __v_181: G = __r_arr[0];
-    let __v_182: G = __r_arr[1];
-    let __v_183: G = __r_arr[2];
-    let __v_184: G = __r_arr[3];
-    let __v_185: G = __r_arr[4];
-    let __v_186: G = __r_arr[5];
-    let __v_187: G = __r_arr[6];
-    let __v_188: G = __r_arr[7];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_107, __v_109, __v_111, __v_113, __v_115, __v_117, __v_119, __v_121]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
-    let __v_189: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_125, __v_127, __v_129, __v_131, __v_133, __v_135, __v_137, __v_139]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_73]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_74: G = __r_arr[0];
+    let __v_75: G = __r_arr[1];
+    let __v_76: G = __r_arr[2];
+    let __v_77: G = __r_arr[3];
+    let __v_78: G = __r_arr[4];
+    let __v_79: G = __r_arr[5];
+    let __v_80: G = __r_arr[6];
+    let __v_81: G = __r_arr[7];
+    let __v_82: G = __r_arr[8];
+    let __v_83: G = __r_arr[9];
+    let __v_84: G = __r_arr[10];
+    let __v_85: G = __r_arr[11];
+    let __v_86: G = __r_arr[12];
+    let __v_87: G = __r_arr[13];
+    let __v_88: G = __r_arr[14];
+    let __v_89: G = __r_arr[15];
+    let __v_90: G = __r_arr[16];
+    let __v_91: G = __r_arr[17];
+    let __v_92: G = __r_arr[18];
+    let __v_93: G = __r_arr[19];
+    let __v_94: G = __r_arr[20];
+    let __v_95: G = __r_arr[21];
+    let __v_96: G = __r_arr[22];
+    let __v_97: G = __r_arr[23];
+    let __v_98: G = __r_arr[24];
+    let __v_99: G = __r_arr[25];
+    let __v_100: G = __r_arr[26];
+    let __v_101: G = __r_arr[27];
+    let __v_102: G = __r_arr[28];
+    let __v_103: G = __r_arr[29];
+    let __v_104: G = __r_arr[30];
+    let __v_105: G = __r_arr[31];
+    let __v_106: G = G::from_u64(256);
+    let __v_107: G = (__v_106 * __v_75);
+    let __v_108: G = G::from_u64(65536);
+    let __v_109: G = (__v_108 * __v_76);
+    let __v_110: G = G::from_u64(16777216);
+    let __v_111: G = (__v_110 * __v_77);
+    let __v_112: G = (__v_109 + __v_111);
+    let __v_113: G = (__v_107 + __v_112);
+    let __v_114: G = (__v_74 + __v_113);
+    let __v_115: G = G::from_u64(256);
+    let __v_116: G = (__v_115 * __v_79);
+    let __v_117: G = G::from_u64(65536);
+    let __v_118: G = (__v_117 * __v_80);
+    let __v_119: G = G::from_u64(16777216);
+    let __v_120: G = (__v_119 * __v_81);
+    let __v_121: G = (__v_118 + __v_120);
+    let __v_122: G = (__v_116 + __v_121);
+    let __v_123: G = (__v_78 + __v_122);
+    let __v_124: G = G::from_u64(256);
+    let __v_125: G = (__v_124 * __v_83);
+    let __v_126: G = G::from_u64(65536);
+    let __v_127: G = (__v_126 * __v_84);
+    let __v_128: G = G::from_u64(16777216);
+    let __v_129: G = (__v_128 * __v_85);
+    let __v_130: G = (__v_127 + __v_129);
+    let __v_131: G = (__v_125 + __v_130);
+    let __v_132: G = (__v_82 + __v_131);
+    let __v_133: G = G::from_u64(256);
+    let __v_134: G = (__v_133 * __v_87);
+    let __v_135: G = G::from_u64(65536);
+    let __v_136: G = (__v_135 * __v_88);
+    let __v_137: G = G::from_u64(16777216);
+    let __v_138: G = (__v_137 * __v_89);
+    let __v_139: G = (__v_136 + __v_138);
+    let __v_140: G = (__v_134 + __v_139);
+    let __v_141: G = (__v_86 + __v_140);
+    let __v_142: G = G::from_u64(256);
+    let __v_143: G = (__v_142 * __v_91);
+    let __v_144: G = G::from_u64(65536);
+    let __v_145: G = (__v_144 * __v_92);
+    let __v_146: G = G::from_u64(16777216);
+    let __v_147: G = (__v_146 * __v_93);
+    let __v_148: G = (__v_145 + __v_147);
+    let __v_149: G = (__v_143 + __v_148);
+    let __v_150: G = (__v_90 + __v_149);
+    let __v_151: G = G::from_u64(256);
+    let __v_152: G = (__v_151 * __v_95);
+    let __v_153: G = G::from_u64(65536);
+    let __v_154: G = (__v_153 * __v_96);
+    let __v_155: G = G::from_u64(16777216);
+    let __v_156: G = (__v_155 * __v_97);
+    let __v_157: G = (__v_154 + __v_156);
+    let __v_158: G = (__v_152 + __v_157);
+    let __v_159: G = (__v_94 + __v_158);
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_99);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_100);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_101);
+    let __v_166: G = (__v_163 + __v_165);
+    let __v_167: G = (__v_161 + __v_166);
+    let __v_168: G = (__v_98 + __v_167);
+    let __v_169: G = G::from_u64(256);
+    let __v_170: G = (__v_169 * __v_103);
+    let __v_171: G = G::from_u64(65536);
+    let __v_172: G = (__v_171 * __v_104);
+    let __v_173: G = G::from_u64(16777216);
+    let __v_174: G = (__v_173 * __v_105);
+    let __v_175: G = (__v_172 + __v_174);
+    let __v_176: G = (__v_170 + __v_175);
+    let __v_177: G = (__v_102 + __v_176);
+    if (__v_114 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_114.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_123 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_123.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_132 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_132.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_141 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_141.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_150 != __v_4) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_150.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_159 != __v_5) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_159.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_168 != __v_6) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    if (__v_177 != __v_7) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_178: G = __r_arr[0];
+    let __v_179: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_179]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_180: G = __r_arr[0];
+    let __v_181: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_181]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_182: G = __r_arr[0];
+    let __v_183: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_183]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_184: G = __r_arr[0];
+    let __v_185: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_185]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_186: G = __r_arr[0];
+    let __v_187: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_187]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_188: G = __r_arr[0];
+    let __v_189: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_189]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
     let __v_190: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_141, __v_143, __v_145, __v_147, __v_149, __v_151, __v_153, __v_155]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
-    let __v_191: G = __r_arr[0];
-    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_157, __v_159, __v_161, __v_163, __v_165, __v_167, __v_169, __v_171]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_191: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_191]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
     let __v_192: G = __r_arr[0];
-    let __v_193: G = G::from_u64(1);
-    let __v_194: G = G::from_u64(0);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_194]; let __info = io_buffer.get_info(__v_193, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_195: G = __io_pair.0;
-    let __v_196: G = __io_pair.1;
-    let __v_197: G = G::from_u64(1);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_197, __v_195, __v_196]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_193: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_193]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_194: G = __r_arr[0];
+    let __v_195: G = __r_arr[1];
+    let __r_arr: [G; OUT_207] = { let __args: [G; IN_207] = [__v_195]; let __cu = unconstrained; let __hit = record.function_queries[207].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[207].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[207].bump_multiplicity(__i); } let __ret: [G; OUT_207] = unsafe { *(record.function_queries[207].output_at(__i).as_ptr() as *const [G; OUT_207]) }; __ret }, _ => aiur_fn_207(__args, record, io_buffer, __cu)? } };
+    let __v_196: G = __r_arr[0];
+    let __v_197: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_197]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
     let __v_198: G = __r_arr[0];
-    let __v_199: G = G::from_u64(103);
-    let __v_200: G = G::from_u64(230);
-    let __v_201: G = G::from_u64(9);
-    let __v_202: G = G::from_u64(106);
-    let __v_203: G = G::from_u64(133);
-    let __v_204: G = G::from_u64(174);
-    let __v_205: G = G::from_u64(103);
-    let __v_206: G = G::from_u64(187);
-    let __v_207: G = G::from_u64(114);
-    let __v_208: G = G::from_u64(243);
-    let __v_209: G = G::from_u64(110);
-    let __v_210: G = G::from_u64(60);
-    let __v_211: G = G::from_u64(58);
-    let __v_212: G = G::from_u64(245);
-    let __v_213: G = G::from_u64(79);
-    let __v_214: G = G::from_u64(165);
-    let __v_215: G = G::from_u64(127);
-    let __v_216: G = G::from_u64(82);
-    let __v_217: G = G::from_u64(14);
-    let __v_218: G = G::from_u64(81);
-    let __v_219: G = G::from_u64(140);
-    let __v_220: G = G::from_u64(104);
-    let __v_221: G = G::from_u64(5);
-    let __v_222: G = G::from_u64(155);
-    let __v_223: G = G::from_u64(171);
-    let __v_224: G = G::from_u64(217);
-    let __v_225: G = G::from_u64(131);
-    let __v_226: G = G::from_u64(31);
-    let __v_227: G = G::from_u64(25);
-    let __v_228: G = G::from_u64(205);
-    let __v_229: G = G::from_u64(224);
-    let __v_230: G = G::from_u64(91);
-    let __v_231: G = G::from_u64(1);
-    let __v_232: G = G::from_u64(1);
-    let __v_233: G = { let __values: [G; 3] = [__v_231, __v_232, __v_232]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_234: G = G::from_u64(0);
-    let __v_235: G = G::from_u64(0);
-    let __v_236: G = G::from_u64(0);
-    let __v_237: G = G::from_u64(0);
-    let __v_238: G = G::from_u64(0);
-    let __v_239: G = G::from_u64(0);
-    let __v_240: G = G::from_u64(0);
-    let __v_241: G = G::from_u64(0);
-    let __v_242: G = G::from_u64(0);
-    let __v_243: G = G::from_u64(0);
-    let __v_244: G = { let __values: [G; 8] = [__v_236, __v_237, __v_238, __v_239, __v_240, __v_241, __v_242, __v_243]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_245: G = { let __values: [G; 32] = [__v_199, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_208, __v_209, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_216, __v_217, __v_218, __v_219, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_228, __v_229, __v_230]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_246: G = G::from_u64(1);
-    let __v_247: G = G::from_u64(1);
-    let __v_248: G = { let __values: [G; 34] = [__v_246, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247, __v_247]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_198, __v_233, __v_234, __v_235, __v_244, __v_245, __v_248]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_249: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_249]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
-    let __v_250: G = __r_arr[0];
-    let __v_251: G = __r_arr[1];
-    let __v_252: G = __r_arr[2];
-    let __v_253: G = __r_arr[3];
-    let __v_254: G = __r_arr[4];
-    let __v_255: G = __r_arr[5];
-    let __v_256: G = __r_arr[6];
-    let __v_257: G = __r_arr[7];
-    let __v_258: G = __r_arr[8];
-    let __v_259: G = __r_arr[9];
-    let __v_260: G = __r_arr[10];
-    let __v_261: G = __r_arr[11];
-    let __v_262: G = __r_arr[12];
-    let __v_263: G = __r_arr[13];
-    let __v_264: G = __r_arr[14];
-    let __v_265: G = __r_arr[15];
-    let __v_266: G = __r_arr[16];
-    let __v_267: G = __r_arr[17];
-    let __v_268: G = __r_arr[18];
-    let __v_269: G = __r_arr[19];
-    let __v_270: G = __r_arr[20];
-    let __v_271: G = __r_arr[21];
-    let __v_272: G = __r_arr[22];
-    let __v_273: G = __r_arr[23];
-    let __v_274: G = __r_arr[24];
-    let __v_275: G = __r_arr[25];
-    let __v_276: G = __r_arr[26];
-    let __v_277: G = __r_arr[27];
-    let __v_278: G = __r_arr[28];
-    let __v_279: G = __r_arr[29];
-    let __v_280: G = __r_arr[30];
-    let __v_281: G = __r_arr[31];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_198]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_282: G = __r_arr[0];
-    let __v_283: G = __r_arr[1];
-    let __v_284: G = __r_arr[2];
-    let __v_285: G = __r_arr[3];
-    let __v_286: G = __r_arr[4];
-    let __v_287: G = __r_arr[5];
-    let __v_288: G = __r_arr[6];
-    let __v_289: G = __r_arr[7];
-    let __v_290: G = __r_arr[8];
-    let __v_291: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_291]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_292: G = __r_arr[0];
-    let __v_293: G = __r_arr[1];
-    let __v_294: G = __r_arr[2];
-    let __v_295: G = __r_arr[3];
-    let __v_296: G = __r_arr[4];
-    let __v_297: G = __r_arr[5];
-    let __v_298: G = __r_arr[6];
-    let __v_299: G = __r_arr[7];
-    let __v_300: G = __r_arr[8];
-    let __v_301: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_301]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_302: G = __r_arr[0];
-    let __v_303: G = __r_arr[1];
-    let __v_304: G = __r_arr[2];
-    let __v_305: G = __r_arr[3];
-    let __v_306: G = __r_arr[4];
-    let __v_307: G = __r_arr[5];
-    let __v_308: G = __r_arr[6];
-    let __v_309: G = __r_arr[7];
-    let __v_310: G = __r_arr[8];
-    let __v_311: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_311]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_312: G = __r_arr[0];
-    let __v_313: G = __r_arr[1];
-    let __v_314: G = __r_arr[2];
-    let __v_315: G = __r_arr[3];
-    let __v_316: G = __r_arr[4];
-    let __v_317: G = __r_arr[5];
-    let __v_318: G = __r_arr[6];
-    let __v_319: G = __r_arr[7];
-    let __v_320: G = __r_arr[8];
-    let __v_321: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_321]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_322: G = __r_arr[0];
-    let __v_323: G = __r_arr[1];
-    let __v_324: G = __r_arr[2];
-    let __v_325: G = __r_arr[3];
-    let __v_326: G = __r_arr[4];
-    let __v_327: G = __r_arr[5];
-    let __v_328: G = __r_arr[6];
-    let __v_329: G = __r_arr[7];
-    let __v_330: G = __r_arr[8];
-    let __v_331: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_331]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_332: G = __r_arr[0];
-    let __v_333: G = __r_arr[1];
-    let __v_334: G = __r_arr[2];
-    let __v_335: G = __r_arr[3];
-    let __v_336: G = __r_arr[4];
-    let __v_337: G = __r_arr[5];
-    let __v_338: G = __r_arr[6];
-    let __v_339: G = __r_arr[7];
-    let __v_340: G = __r_arr[8];
-    let __v_341: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_341]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_342: G = __r_arr[0];
-    let __v_343: G = __r_arr[1];
-    let __v_344: G = __r_arr[2];
-    let __v_345: G = __r_arr[3];
-    let __v_346: G = __r_arr[4];
-    let __v_347: G = __r_arr[5];
-    let __v_348: G = __r_arr[6];
-    let __v_349: G = __r_arr[7];
-    let __v_350: G = __r_arr[8];
-    let __v_351: G = __r_arr[9];
-    let __v_352: G = G::from_u64(0);
-    let __v_353: G = G::from_u64(0);
-    let __v_354: G = G::from_u64(0);
-    let __v_355: G = G::from_u64(0);
-    let __v_356: G = G::from_u64(0);
-    let __v_357: G = G::from_u64(0);
-    let __v_358: G = G::from_u64(0);
-    let __v_359: G = G::from_u64(1);
-    let __v_360: G = G::from_u64(1);
-    let __v_361: G = { let __values: [G; 10] = [__v_359, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360, __v_360]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_362: G = { let __values: [G; 10] = [__v_358, __v_343, __v_344, __v_345, __v_346, __v_347, __v_348, __v_349, __v_350, __v_361]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_363: G = { let __values: [G; 10] = [__v_357, __v_333, __v_334, __v_335, __v_336, __v_337, __v_338, __v_339, __v_340, __v_362]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_364: G = { let __values: [G; 10] = [__v_356, __v_323, __v_324, __v_325, __v_326, __v_327, __v_328, __v_329, __v_330, __v_363]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_365: G = { let __values: [G; 10] = [__v_355, __v_313, __v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_320, __v_364]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_366: G = { let __values: [G; 10] = [__v_354, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308, __v_309, __v_310, __v_365]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_367: G = { let __values: [G; 10] = [__v_353, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_366]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_368: G = { let __values: [G; 10] = [__v_352, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_367]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_351]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_369: G = __r_arr[0];
-    let __v_370: G = __r_arr[1];
-    let __v_371: G = __r_arr[2];
-    let __v_372: G = __r_arr[3];
-    let __v_373: G = __r_arr[4];
-    let __v_374: G = __r_arr[5];
-    let __v_375: G = __r_arr[6];
-    let __v_376: G = __r_arr[7];
-    let __v_377: G = __r_arr[8];
-    let __v_378: G = __r_arr[9];
-    let __r_arr: [G; OUT_93] = { let __args: [G; IN_93] = [__v_378, __v_369]; let __cu = unconstrained; let __hit = record.function_queries[93].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[93].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[93].bump_multiplicity(__i); } let __ret: [G; OUT_93] = unsafe { *(record.function_queries[93].output_at(__i).as_ptr() as *const [G; OUT_93]) }; __ret }, _ => aiur_fn_93(__args, record, io_buffer, __cu)? } };
-    let __v_379: G = __r_arr[0];
-    let __v_380: G = __r_arr[1];
-    let __v_381: G = __r_arr[2];
-    let __r_arr: [G; OUT_94] = { let __args: [G; IN_94] = [__v_381]; let __cu = unconstrained; let __hit = record.function_queries[94].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[94].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[94].bump_multiplicity(__i); } let __ret: [G; OUT_94] = unsafe { *(record.function_queries[94].output_at(__i).as_ptr() as *const [G; OUT_94]) }; __ret }, _ => aiur_fn_94(__args, record, io_buffer, __cu)? } };
-    let __v_382: G = __r_arr[0];
-    let __v_383: G = __r_arr[1];
-    let __v_384: G = __r_arr[2];
-    let __r_arr: [G; OUT_95] = { let __args: [G; IN_95] = [__v_384, __v_369]; let __cu = unconstrained; let __hit = record.function_queries[95].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[95].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[95].bump_multiplicity(__i); } let __ret: [G; OUT_95] = unsafe { *(record.function_queries[95].output_at(__i).as_ptr() as *const [G; OUT_95]) }; __ret }, _ => aiur_fn_95(__args, record, io_buffer, __cu)? } };
-    let __v_385: G = __r_arr[0];
-    let __v_386: G = __r_arr[1];
-    let __v_387: G = G::from_u64(0);
-    let __v_388: G = { let __values: [G; 10] = [__v_387, __v_370, __v_371, __v_372, __v_373, __v_374, __v_375, __v_376, __v_377, __v_380]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_368, __v_388]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-    let __v_389: G = __r_arr[0];
-    let __v_390: G = G::from_u64(0);
-    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_282, __v_292, __v_302, __v_312, __v_322, __v_332, __v_342, __v_389, __v_379, __v_382, __v_383, __v_385, __v_390]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
-    let __v_391: G = __r_arr[0];
-    let __v_392: G = G::from_u64(1);
-    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_282, __v_292, __v_302, __v_312, __v_322, __v_332, __v_342, __v_389, __v_379, __v_382, __v_383, __v_385, __v_392]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
-    let __v_393: G = __r_arr[0];
-    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_391, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_189, __v_190, __v_191, __v_192]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
-    let __v_394: G = __r_arr[0];
-    let __v_395: G = __r_arr[1];
-    let __v_396: G = __r_arr[2];
-    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_393, __v_173, __v_174, __v_175, __v_176, __v_177, __v_178, __v_179, __v_180, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_189, __v_190, __v_191, __v_192]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
-    let __v_397: G = __r_arr[0];
-    let __v_398: G = __r_arr[1];
-    let __v_399: G = __r_arr[2];
-    let __v_400: G = G::from_u64(2);
-    let __v_401: G = G::from_u64(2);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_401]; let __info = io_buffer.get_info(__v_400, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_402: G = __io_pair.0;
-    let __v_403: G = __io_pair.1;
-    let __v_404: G = G::from_u64(2);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_404, __v_402, __v_403]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_405: G = __r_arr[0];
-    let __v_406: G = G::from_u64(103);
-    let __v_407: G = G::from_u64(230);
-    let __v_408: G = G::from_u64(9);
-    let __v_409: G = G::from_u64(106);
-    let __v_410: G = G::from_u64(133);
-    let __v_411: G = G::from_u64(174);
-    let __v_412: G = G::from_u64(103);
-    let __v_413: G = G::from_u64(187);
-    let __v_414: G = G::from_u64(114);
-    let __v_415: G = G::from_u64(243);
-    let __v_416: G = G::from_u64(110);
-    let __v_417: G = G::from_u64(60);
-    let __v_418: G = G::from_u64(58);
-    let __v_419: G = G::from_u64(245);
-    let __v_420: G = G::from_u64(79);
-    let __v_421: G = G::from_u64(165);
-    let __v_422: G = G::from_u64(127);
-    let __v_423: G = G::from_u64(82);
-    let __v_424: G = G::from_u64(14);
-    let __v_425: G = G::from_u64(81);
-    let __v_426: G = G::from_u64(140);
-    let __v_427: G = G::from_u64(104);
-    let __v_428: G = G::from_u64(5);
-    let __v_429: G = G::from_u64(155);
-    let __v_430: G = G::from_u64(171);
-    let __v_431: G = G::from_u64(217);
-    let __v_432: G = G::from_u64(131);
-    let __v_433: G = G::from_u64(31);
-    let __v_434: G = G::from_u64(25);
-    let __v_435: G = G::from_u64(205);
-    let __v_436: G = G::from_u64(224);
-    let __v_437: G = G::from_u64(91);
-    let __v_438: G = G::from_u64(1);
-    let __v_439: G = G::from_u64(1);
-    let __v_440: G = { let __values: [G; 3] = [__v_438, __v_439, __v_439]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_441: G = G::from_u64(0);
-    let __v_442: G = G::from_u64(0);
-    let __v_443: G = G::from_u64(0);
-    let __v_444: G = G::from_u64(0);
-    let __v_445: G = G::from_u64(0);
-    let __v_446: G = G::from_u64(0);
-    let __v_447: G = G::from_u64(0);
-    let __v_448: G = G::from_u64(0);
-    let __v_449: G = G::from_u64(0);
-    let __v_450: G = G::from_u64(0);
-    let __v_451: G = { let __values: [G; 8] = [__v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_449, __v_450]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_452: G = { let __values: [G; 32] = [__v_406, __v_407, __v_408, __v_409, __v_410, __v_411, __v_412, __v_413, __v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_430, __v_431, __v_432, __v_433, __v_434, __v_435, __v_436, __v_437]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_453: G = G::from_u64(1);
-    let __v_454: G = G::from_u64(1);
-    let __v_455: G = { let __values: [G; 34] = [__v_453, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454, __v_454]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_405, __v_440, __v_441, __v_442, __v_451, __v_452, __v_455]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_456: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_456]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
-    let __v_457: G = __r_arr[0];
-    let __v_458: G = __r_arr[1];
-    let __v_459: G = __r_arr[2];
-    let __v_460: G = __r_arr[3];
-    let __v_461: G = __r_arr[4];
-    let __v_462: G = __r_arr[5];
-    let __v_463: G = __r_arr[6];
-    let __v_464: G = __r_arr[7];
-    let __v_465: G = __r_arr[8];
-    let __v_466: G = __r_arr[9];
-    let __v_467: G = __r_arr[10];
-    let __v_468: G = __r_arr[11];
-    let __v_469: G = __r_arr[12];
-    let __v_470: G = __r_arr[13];
-    let __v_471: G = __r_arr[14];
-    let __v_472: G = __r_arr[15];
-    let __v_473: G = __r_arr[16];
-    let __v_474: G = __r_arr[17];
-    let __v_475: G = __r_arr[18];
-    let __v_476: G = __r_arr[19];
-    let __v_477: G = __r_arr[20];
-    let __v_478: G = __r_arr[21];
-    let __v_479: G = __r_arr[22];
-    let __v_480: G = __r_arr[23];
-    let __v_481: G = __r_arr[24];
-    let __v_482: G = __r_arr[25];
-    let __v_483: G = __r_arr[26];
-    let __v_484: G = __r_arr[27];
-    let __v_485: G = __r_arr[28];
-    let __v_486: G = __r_arr[29];
-    let __v_487: G = __r_arr[30];
-    let __v_488: G = __r_arr[31];
-    let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_405]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
-    let __v_489: G = __r_arr[0];
-    let __v_490: G = __r_arr[1];
-    let __v_491: G = __r_arr[2];
-    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_394, __v_397]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
+    let __v_199: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_199]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_200: G = __r_arr[0];
+    let __v_201: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_201]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_202: G = __r_arr[0];
+    let __v_203: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_203]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_204: G = __r_arr[0];
+    let __v_205: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_205]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_206: G = __r_arr[0];
+    let __v_207: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_207]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_208: G = __r_arr[0];
+    let __v_209: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_209]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_210: G = __r_arr[0];
+    let __v_211: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_211]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_212: G = __r_arr[0];
+    let __v_213: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_213]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_214: G = __r_arr[0];
+    let __v_215: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_215]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_216: G = __r_arr[0];
+    let __v_217: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_217]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_218: G = __r_arr[0];
+    let __v_219: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_219]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_220: G = __r_arr[0];
+    let __v_221: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_221]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_222: G = __r_arr[0];
+    let __v_223: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_223]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_224: G = __r_arr[0];
+    let __v_225: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_225]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_226: G = __r_arr[0];
+    let __v_227: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_227]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_228: G = __r_arr[0];
+    let __v_229: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_229]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_230: G = __r_arr[0];
+    let __v_231: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_231]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_232: G = __r_arr[0];
+    let __v_233: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_233]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_234: G = __r_arr[0];
+    let __v_235: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_235]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_236: G = __r_arr[0];
+    let __v_237: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_237]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_238: G = __r_arr[0];
+    let __v_239: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_239]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_240: G = __r_arr[0];
+    let __v_241: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_241]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_242: G = __r_arr[0];
+    let __v_243: G = __r_arr[1];
+    let __r_arr: [G; OUT_25] = { let __args: [G; IN_25] = [__v_243]; let __cu = unconstrained; let __hit = record.function_queries[25].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[25].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[25].bump_multiplicity(__i); } let __ret: [G; OUT_25] = unsafe { *(record.function_queries[25].output_at(__i).as_ptr() as *const [G; OUT_25]) }; __ret }, _ => aiur_fn_25(__args, record, io_buffer, __cu)? } };
+    let __v_244: G = __r_arr[0];
+    let __v_245: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_245.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_246: G = __loaded[0];
+    let __v_247: G = __loaded[1];
+    let __v_248: G = __loaded[2];
+    let __v_249: G = G::from_u64(1);
+    let __v_250: G = G::from_u64(1);
+    if (__v_246 != __v_249) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_246.as_canonical_u64(), rhs: __v_249.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    if (__v_247 != __v_250) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_247.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    if (__v_248 != __v_250) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_248.as_canonical_u64(), rhs: __v_250.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
+    }
+    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_178]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
+    let __v_251: G = __r_arr[0];
+    let __v_252: G = __r_arr[1];
+    let __v_253: G = __r_arr[2];
+    let __v_254: G = __r_arr[3];
+    let __v_255: G = __r_arr[4];
+    let __v_256: G = __r_arr[5];
+    let __v_257: G = __r_arr[6];
+    let __v_258: G = __r_arr[7];
+    let __r_arr: [G; OUT_209] = { let __args: [G; IN_209] = [__v_196]; let __cu = unconstrained; let __hit = record.function_queries[209].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[209].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[209].bump_multiplicity(__i); } let __ret: [G; OUT_209] = unsafe { *(record.function_queries[209].output_at(__i).as_ptr() as *const [G; OUT_209]) }; __ret }, _ => aiur_fn_209(__args, record, io_buffer, __cu)? } };
+    let __v_259: G = __r_arr[0];
+    let __v_260: G = __r_arr[1];
+    let __v_261: G = __r_arr[2];
+    let __v_262: G = __r_arr[3];
+    let __v_263: G = __r_arr[4];
+    let __v_264: G = __r_arr[5];
+    let __v_265: G = __r_arr[6];
+    let __v_266: G = __r_arr[7];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_180, __v_182, __v_184, __v_186, __v_188, __v_190, __v_192, __v_194]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_267: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_198, __v_200, __v_202, __v_204, __v_206, __v_208, __v_210, __v_212]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_268: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_214, __v_216, __v_218, __v_220, __v_222, __v_224, __v_226, __v_228]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_269: G = __r_arr[0];
+    let __r_arr: [G; OUT_13] = { let __args: [G; IN_13] = [__v_230, __v_232, __v_234, __v_236, __v_238, __v_240, __v_242, __v_244]; let __cu = unconstrained; let __hit = record.function_queries[13].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[13].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[13].bump_multiplicity(__i); } let __ret: [G; OUT_13] = unsafe { *(record.function_queries[13].output_at(__i).as_ptr() as *const [G; OUT_13]) }; __ret }, _ => aiur_fn_13(__args, record, io_buffer, __cu)? } };
+    let __v_270: G = __r_arr[0];
+    let __v_271: G = G::from_u64(1);
+    let __v_272: G = G::from_u64(0);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_272]; let __info = io_buffer.get_info(__v_271, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_273: G = __io_pair.0;
+    let __v_274: G = __io_pair.1;
+    let __v_275: G = G::from_u64(1);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_275, __v_273, __v_274]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_276: G = __r_arr[0];
+    let __v_277: G = G::from_u64(103);
+    let __v_278: G = G::from_u64(230);
+    let __v_279: G = G::from_u64(9);
+    let __v_280: G = G::from_u64(106);
+    let __v_281: G = G::from_u64(133);
+    let __v_282: G = G::from_u64(174);
+    let __v_283: G = G::from_u64(103);
+    let __v_284: G = G::from_u64(187);
+    let __v_285: G = G::from_u64(114);
+    let __v_286: G = G::from_u64(243);
+    let __v_287: G = G::from_u64(110);
+    let __v_288: G = G::from_u64(60);
+    let __v_289: G = G::from_u64(58);
+    let __v_290: G = G::from_u64(245);
+    let __v_291: G = G::from_u64(79);
+    let __v_292: G = G::from_u64(165);
+    let __v_293: G = G::from_u64(127);
+    let __v_294: G = G::from_u64(82);
+    let __v_295: G = G::from_u64(14);
+    let __v_296: G = G::from_u64(81);
+    let __v_297: G = G::from_u64(140);
+    let __v_298: G = G::from_u64(104);
+    let __v_299: G = G::from_u64(5);
+    let __v_300: G = G::from_u64(155);
+    let __v_301: G = G::from_u64(171);
+    let __v_302: G = G::from_u64(217);
+    let __v_303: G = G::from_u64(131);
+    let __v_304: G = G::from_u64(31);
+    let __v_305: G = G::from_u64(25);
+    let __v_306: G = G::from_u64(205);
+    let __v_307: G = G::from_u64(224);
+    let __v_308: G = G::from_u64(91);
+    let __v_309: G = G::from_u64(1);
+    let __v_310: G = G::from_u64(1);
+    let __v_311: G = { let __values: [G; 3] = [__v_309, __v_310, __v_310]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_312: G = G::from_u64(0);
+    let __v_313: G = G::from_u64(0);
+    let __v_314: G = G::from_u64(0);
+    let __v_315: G = G::from_u64(0);
+    let __v_316: G = G::from_u64(0);
+    let __v_317: G = G::from_u64(0);
+    let __v_318: G = G::from_u64(0);
+    let __v_319: G = G::from_u64(0);
+    let __v_320: G = G::from_u64(0);
+    let __v_321: G = G::from_u64(0);
+    let __v_322: G = { let __values: [G; 8] = [__v_314, __v_315, __v_316, __v_317, __v_318, __v_319, __v_320, __v_321]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_323: G = { let __values: [G; 32] = [__v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304, __v_305, __v_306, __v_307, __v_308]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_324: G = G::from_u64(1);
+    let __v_325: G = G::from_u64(1);
+    let __v_326: G = { let __values: [G; 34] = [__v_324, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325, __v_325]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_276, __v_311, __v_312, __v_313, __v_322, __v_323, __v_326]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
+    let __v_327: G = __r_arr[0];
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_327]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_328: G = __r_arr[0];
+    let __v_329: G = __r_arr[1];
+    let __v_330: G = __r_arr[2];
+    let __v_331: G = __r_arr[3];
+    let __v_332: G = __r_arr[4];
+    let __v_333: G = __r_arr[5];
+    let __v_334: G = __r_arr[6];
+    let __v_335: G = __r_arr[7];
+    let __v_336: G = __r_arr[8];
+    let __v_337: G = __r_arr[9];
+    let __v_338: G = __r_arr[10];
+    let __v_339: G = __r_arr[11];
+    let __v_340: G = __r_arr[12];
+    let __v_341: G = __r_arr[13];
+    let __v_342: G = __r_arr[14];
+    let __v_343: G = __r_arr[15];
+    let __v_344: G = __r_arr[16];
+    let __v_345: G = __r_arr[17];
+    let __v_346: G = __r_arr[18];
+    let __v_347: G = __r_arr[19];
+    let __v_348: G = __r_arr[20];
+    let __v_349: G = __r_arr[21];
+    let __v_350: G = __r_arr[22];
+    let __v_351: G = __r_arr[23];
+    let __v_352: G = __r_arr[24];
+    let __v_353: G = __r_arr[25];
+    let __v_354: G = __r_arr[26];
+    let __v_355: G = __r_arr[27];
+    let __v_356: G = __r_arr[28];
+    let __v_357: G = __r_arr[29];
+    let __v_358: G = __r_arr[30];
+    let __v_359: G = __r_arr[31];
+    let __v_360: G = G::from_u64(256);
+    let __v_361: G = (__v_360 * __v_329);
+    let __v_362: G = G::from_u64(65536);
+    let __v_363: G = (__v_362 * __v_330);
+    let __v_364: G = G::from_u64(16777216);
+    let __v_365: G = (__v_364 * __v_331);
+    let __v_366: G = (__v_363 + __v_365);
+    let __v_367: G = (__v_361 + __v_366);
+    let __v_368: G = (__v_328 + __v_367);
+    let __v_369: G = G::from_u64(256);
+    let __v_370: G = (__v_369 * __v_333);
+    let __v_371: G = G::from_u64(65536);
+    let __v_372: G = (__v_371 * __v_334);
+    let __v_373: G = G::from_u64(16777216);
+    let __v_374: G = (__v_373 * __v_335);
+    let __v_375: G = (__v_372 + __v_374);
+    let __v_376: G = (__v_370 + __v_375);
+    let __v_377: G = (__v_332 + __v_376);
+    let __v_378: G = G::from_u64(256);
+    let __v_379: G = (__v_378 * __v_337);
+    let __v_380: G = G::from_u64(65536);
+    let __v_381: G = (__v_380 * __v_338);
+    let __v_382: G = G::from_u64(16777216);
+    let __v_383: G = (__v_382 * __v_339);
+    let __v_384: G = (__v_381 + __v_383);
+    let __v_385: G = (__v_379 + __v_384);
+    let __v_386: G = (__v_336 + __v_385);
+    let __v_387: G = G::from_u64(256);
+    let __v_388: G = (__v_387 * __v_341);
+    let __v_389: G = G::from_u64(65536);
+    let __v_390: G = (__v_389 * __v_342);
+    let __v_391: G = G::from_u64(16777216);
+    let __v_392: G = (__v_391 * __v_343);
+    let __v_393: G = (__v_390 + __v_392);
+    let __v_394: G = (__v_388 + __v_393);
+    let __v_395: G = (__v_340 + __v_394);
+    let __v_396: G = G::from_u64(256);
+    let __v_397: G = (__v_396 * __v_345);
+    let __v_398: G = G::from_u64(65536);
+    let __v_399: G = (__v_398 * __v_346);
+    let __v_400: G = G::from_u64(16777216);
+    let __v_401: G = (__v_400 * __v_347);
+    let __v_402: G = (__v_399 + __v_401);
+    let __v_403: G = (__v_397 + __v_402);
+    let __v_404: G = (__v_344 + __v_403);
+    let __v_405: G = G::from_u64(256);
+    let __v_406: G = (__v_405 * __v_349);
+    let __v_407: G = G::from_u64(65536);
+    let __v_408: G = (__v_407 * __v_350);
+    let __v_409: G = G::from_u64(16777216);
+    let __v_410: G = (__v_409 * __v_351);
+    let __v_411: G = (__v_408 + __v_410);
+    let __v_412: G = (__v_406 + __v_411);
+    let __v_413: G = (__v_348 + __v_412);
+    let __v_414: G = G::from_u64(256);
+    let __v_415: G = (__v_414 * __v_353);
+    let __v_416: G = G::from_u64(65536);
+    let __v_417: G = (__v_416 * __v_354);
+    let __v_418: G = G::from_u64(16777216);
+    let __v_419: G = (__v_418 * __v_355);
+    let __v_420: G = (__v_417 + __v_419);
+    let __v_421: G = (__v_415 + __v_420);
+    let __v_422: G = (__v_352 + __v_421);
+    let __v_423: G = G::from_u64(256);
+    let __v_424: G = (__v_423 * __v_357);
+    let __v_425: G = G::from_u64(65536);
+    let __v_426: G = (__v_425 * __v_358);
+    let __v_427: G = G::from_u64(16777216);
+    let __v_428: G = (__v_427 * __v_359);
+    let __v_429: G = (__v_426 + __v_428);
+    let __v_430: G = (__v_424 + __v_429);
+    let __v_431: G = (__v_356 + __v_430);
+    if (__v_368 != __v_259) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_368.as_canonical_u64(), rhs: __v_259.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_377 != __v_260) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_377.as_canonical_u64(), rhs: __v_260.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_386 != __v_261) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_386.as_canonical_u64(), rhs: __v_261.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_395 != __v_262) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_395.as_canonical_u64(), rhs: __v_262.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_404 != __v_263) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_404.as_canonical_u64(), rhs: __v_263.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_413 != __v_264) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_413.as_canonical_u64(), rhs: __v_264.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_422 != __v_265) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_422.as_canonical_u64(), rhs: __v_265.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    if (__v_431 != __v_266) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_431.as_canonical_u64(), rhs: __v_266.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_276]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_432: G = __r_arr[0];
+    let __v_433: G = __r_arr[1];
+    let __v_434: G = __r_arr[2];
+    let __v_435: G = __r_arr[3];
+    let __v_436: G = __r_arr[4];
+    let __v_437: G = __r_arr[5];
+    let __v_438: G = __r_arr[6];
+    let __v_439: G = __r_arr[7];
+    let __v_440: G = __r_arr[8];
+    let __v_441: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_441]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_442: G = __r_arr[0];
+    let __v_443: G = __r_arr[1];
+    let __v_444: G = __r_arr[2];
+    let __v_445: G = __r_arr[3];
+    let __v_446: G = __r_arr[4];
+    let __v_447: G = __r_arr[5];
+    let __v_448: G = __r_arr[6];
+    let __v_449: G = __r_arr[7];
+    let __v_450: G = __r_arr[8];
+    let __v_451: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_451]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_452: G = __r_arr[0];
+    let __v_453: G = __r_arr[1];
+    let __v_454: G = __r_arr[2];
+    let __v_455: G = __r_arr[3];
+    let __v_456: G = __r_arr[4];
+    let __v_457: G = __r_arr[5];
+    let __v_458: G = __r_arr[6];
+    let __v_459: G = __r_arr[7];
+    let __v_460: G = __r_arr[8];
+    let __v_461: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_461]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_462: G = __r_arr[0];
+    let __v_463: G = __r_arr[1];
+    let __v_464: G = __r_arr[2];
+    let __v_465: G = __r_arr[3];
+    let __v_466: G = __r_arr[4];
+    let __v_467: G = __r_arr[5];
+    let __v_468: G = __r_arr[6];
+    let __v_469: G = __r_arr[7];
+    let __v_470: G = __r_arr[8];
+    let __v_471: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_471]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_472: G = __r_arr[0];
+    let __v_473: G = __r_arr[1];
+    let __v_474: G = __r_arr[2];
+    let __v_475: G = __r_arr[3];
+    let __v_476: G = __r_arr[4];
+    let __v_477: G = __r_arr[5];
+    let __v_478: G = __r_arr[6];
+    let __v_479: G = __r_arr[7];
+    let __v_480: G = __r_arr[8];
+    let __v_481: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_481]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_482: G = __r_arr[0];
+    let __v_483: G = __r_arr[1];
+    let __v_484: G = __r_arr[2];
+    let __v_485: G = __r_arr[3];
+    let __v_486: G = __r_arr[4];
+    let __v_487: G = __r_arr[5];
+    let __v_488: G = __r_arr[6];
+    let __v_489: G = __r_arr[7];
+    let __v_490: G = __r_arr[8];
+    let __v_491: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_491]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_492: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_395, __v_396]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_493: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_398, __v_399]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_494: G = __r_arr[0];
-    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_490, __v_491]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
-    let __v_495: G = __r_arr[0];
-    let __r_arr: [G; OUT_229] = { let __args: [G; IN_229] = [__v_493, __v_494, __v_489, __v_495]; let __cu = unconstrained; let __hit = record.function_queries[229].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[229].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[229].bump_multiplicity(__i); } let __ret: [G; OUT_229] = unsafe { *(record.function_queries[229].output_at(__i).as_ptr() as *const [G; OUT_229]) }; __ret }, _ => aiur_fn_229(__args, record, io_buffer, __cu)? } };
-    let __v_496: G = G::from_u64(96);
-    if (__v_19 != __v_496) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_19.as_canonical_u64(), rhs: __v_496.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    let __v_497: G = G::from_u64(256);
-    let __v_498: G = (__v_497 * __v_74);
-    let __v_499: G = G::from_u64(65536);
-    let __v_500: G = (__v_499 * __v_75);
-    let __v_501: G = G::from_u64(16777216);
-    let __v_502: G = (__v_501 * __v_76);
-    let __v_503: G = (__v_500 + __v_502);
-    let __v_504: G = (__v_498 + __v_503);
-    let __v_505: G = (__v_73 + __v_504);
-    let __v_506: G = G::from_u64(256);
-    let __v_507: G = (__v_506 * __v_78);
-    let __v_508: G = G::from_u64(65536);
-    let __v_509: G = (__v_508 * __v_79);
-    let __v_510: G = G::from_u64(16777216);
-    let __v_511: G = (__v_510 * __v_80);
-    let __v_512: G = (__v_509 + __v_511);
-    let __v_513: G = (__v_507 + __v_512);
-    let __v_514: G = (__v_77 + __v_513);
-    let __v_515: G = G::from_u64(256);
-    let __v_516: G = (__v_515 * __v_82);
-    let __v_517: G = G::from_u64(65536);
-    let __v_518: G = (__v_517 * __v_83);
-    let __v_519: G = G::from_u64(16777216);
-    let __v_520: G = (__v_519 * __v_84);
-    let __v_521: G = (__v_518 + __v_520);
-    let __v_522: G = (__v_516 + __v_521);
-    let __v_523: G = (__v_81 + __v_522);
-    let __v_524: G = G::from_u64(256);
-    let __v_525: G = (__v_524 * __v_86);
-    let __v_526: G = G::from_u64(65536);
-    let __v_527: G = (__v_526 * __v_87);
-    let __v_528: G = G::from_u64(16777216);
-    let __v_529: G = (__v_528 * __v_88);
-    let __v_530: G = (__v_527 + __v_529);
-    let __v_531: G = (__v_525 + __v_530);
-    let __v_532: G = (__v_85 + __v_531);
-    let __v_533: G = G::from_u64(256);
-    let __v_534: G = (__v_533 * __v_90);
-    let __v_535: G = G::from_u64(65536);
-    let __v_536: G = (__v_535 * __v_91);
-    let __v_537: G = G::from_u64(16777216);
-    let __v_538: G = (__v_537 * __v_92);
-    let __v_539: G = (__v_536 + __v_538);
-    let __v_540: G = (__v_534 + __v_539);
-    let __v_541: G = (__v_89 + __v_540);
-    let __v_542: G = G::from_u64(256);
-    let __v_543: G = (__v_542 * __v_94);
-    let __v_544: G = G::from_u64(65536);
-    let __v_545: G = (__v_544 * __v_95);
-    let __v_546: G = G::from_u64(16777216);
-    let __v_547: G = (__v_546 * __v_96);
-    let __v_548: G = (__v_545 + __v_547);
-    let __v_549: G = (__v_543 + __v_548);
-    let __v_550: G = (__v_93 + __v_549);
-    let __v_551: G = G::from_u64(256);
-    let __v_552: G = (__v_551 * __v_98);
-    let __v_553: G = G::from_u64(65536);
-    let __v_554: G = (__v_553 * __v_99);
-    let __v_555: G = G::from_u64(16777216);
-    let __v_556: G = (__v_555 * __v_100);
-    let __v_557: G = (__v_554 + __v_556);
-    let __v_558: G = (__v_552 + __v_557);
-    let __v_559: G = (__v_97 + __v_558);
-    let __v_560: G = G::from_u64(256);
-    let __v_561: G = (__v_560 * __v_102);
-    let __v_562: G = G::from_u64(65536);
-    let __v_563: G = (__v_562 * __v_103);
-    let __v_564: G = G::from_u64(16777216);
-    let __v_565: G = (__v_564 * __v_104);
-    let __v_566: G = (__v_563 + __v_565);
-    let __v_567: G = (__v_561 + __v_566);
-    let __v_568: G = (__v_101 + __v_567);
-    if (__v_505 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_505.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_514 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_514.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_523 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_523.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_532 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_532.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_541 != __v_4) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_541.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_550 != __v_5) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_550.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_559 != __v_6) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_559.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    if (__v_568 != __v_7) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_568.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: Some("structural join: allowed blob digest mismatch".to_string()) });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_172.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_569: G = __loaded[0];
-    let __v_570: G = __loaded[1];
-    let __v_571: G = __loaded[2];
-    let __v_572: G = G::from_u64(1);
-    let __v_573: G = G::from_u64(1);
-    if (__v_569 != __v_572) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_569.as_canonical_u64(), rhs: __v_572.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    if (__v_570 != __v_573) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_570.as_canonical_u64(), rhs: __v_573.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    if (__v_571 != __v_573) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_571.as_canonical_u64(), rhs: __v_573.as_canonical_u64(), msg: Some("structural join: allowed blob must be exactly 96 bytes".to_string()) });
-    }
-    let __v_574: G = G::from_u64(256);
-    let __v_575: G = (__v_574 * __v_251);
-    let __v_576: G = G::from_u64(65536);
-    let __v_577: G = (__v_576 * __v_252);
-    let __v_578: G = G::from_u64(16777216);
-    let __v_579: G = (__v_578 * __v_253);
-    let __v_580: G = (__v_577 + __v_579);
-    let __v_581: G = (__v_575 + __v_580);
-    let __v_582: G = (__v_250 + __v_581);
-    let __v_583: G = G::from_u64(256);
-    let __v_584: G = (__v_583 * __v_255);
-    let __v_585: G = G::from_u64(65536);
-    let __v_586: G = (__v_585 * __v_256);
-    let __v_587: G = G::from_u64(16777216);
-    let __v_588: G = (__v_587 * __v_257);
-    let __v_589: G = (__v_586 + __v_588);
-    let __v_590: G = (__v_584 + __v_589);
-    let __v_591: G = (__v_254 + __v_590);
-    let __v_592: G = G::from_u64(256);
-    let __v_593: G = (__v_592 * __v_259);
-    let __v_594: G = G::from_u64(65536);
-    let __v_595: G = (__v_594 * __v_260);
-    let __v_596: G = G::from_u64(16777216);
-    let __v_597: G = (__v_596 * __v_261);
-    let __v_598: G = (__v_595 + __v_597);
-    let __v_599: G = (__v_593 + __v_598);
-    let __v_600: G = (__v_258 + __v_599);
-    let __v_601: G = G::from_u64(256);
-    let __v_602: G = (__v_601 * __v_263);
-    let __v_603: G = G::from_u64(65536);
-    let __v_604: G = (__v_603 * __v_264);
-    let __v_605: G = G::from_u64(16777216);
-    let __v_606: G = (__v_605 * __v_265);
-    let __v_607: G = (__v_604 + __v_606);
-    let __v_608: G = (__v_602 + __v_607);
-    let __v_609: G = (__v_262 + __v_608);
-    let __v_610: G = G::from_u64(256);
-    let __v_611: G = (__v_610 * __v_267);
-    let __v_612: G = G::from_u64(65536);
-    let __v_613: G = (__v_612 * __v_268);
-    let __v_614: G = G::from_u64(16777216);
-    let __v_615: G = (__v_614 * __v_269);
-    let __v_616: G = (__v_613 + __v_615);
-    let __v_617: G = (__v_611 + __v_616);
-    let __v_618: G = (__v_266 + __v_617);
-    let __v_619: G = G::from_u64(256);
-    let __v_620: G = (__v_619 * __v_271);
-    let __v_621: G = G::from_u64(65536);
-    let __v_622: G = (__v_621 * __v_272);
-    let __v_623: G = G::from_u64(16777216);
-    let __v_624: G = (__v_623 * __v_273);
-    let __v_625: G = (__v_622 + __v_624);
-    let __v_626: G = (__v_620 + __v_625);
-    let __v_627: G = (__v_270 + __v_626);
-    let __v_628: G = G::from_u64(256);
-    let __v_629: G = (__v_628 * __v_275);
-    let __v_630: G = G::from_u64(65536);
-    let __v_631: G = (__v_630 * __v_276);
-    let __v_632: G = G::from_u64(16777216);
-    let __v_633: G = (__v_632 * __v_277);
-    let __v_634: G = (__v_631 + __v_633);
-    let __v_635: G = (__v_629 + __v_634);
-    let __v_636: G = (__v_274 + __v_635);
-    let __v_637: G = G::from_u64(256);
-    let __v_638: G = (__v_637 * __v_279);
-    let __v_639: G = G::from_u64(65536);
-    let __v_640: G = (__v_639 * __v_280);
-    let __v_641: G = G::from_u64(16777216);
-    let __v_642: G = (__v_641 * __v_281);
-    let __v_643: G = (__v_640 + __v_642);
-    let __v_644: G = (__v_638 + __v_643);
-    let __v_645: G = (__v_278 + __v_644);
-    if (__v_582 != __v_181) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_582.as_canonical_u64(), rhs: __v_181.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_591 != __v_182) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_591.as_canonical_u64(), rhs: __v_182.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_600 != __v_183) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_600.as_canonical_u64(), rhs: __v_183.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_609 != __v_184) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_609.as_canonical_u64(), rhs: __v_184.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_618 != __v_185) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_618.as_canonical_u64(), rhs: __v_185.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_627 != __v_186) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_627.as_canonical_u64(), rhs: __v_186.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_636 != __v_187) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_636.as_canonical_u64(), rhs: __v_187.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    if (__v_645 != __v_188) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_645.as_canonical_u64(), rhs: __v_188.as_canonical_u64(), msg: Some("structural join: recursion vk digest mismatch".to_string()) });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_386.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_646: G = __loaded[0];
-    let __v_647: G = __loaded[1];
-    let __v_648: G = __loaded[2];
-    let __v_649: G = G::from_u64(1);
-    let __v_650: G = G::from_u64(1);
-    if (__v_646 != __v_649) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_646.as_canonical_u64(), rhs: __v_649.as_canonical_u64(), msg: None });
-    }
-    if (__v_647 != __v_650) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_647.as_canonical_u64(), rhs: __v_650.as_canonical_u64(), msg: None });
-    }
-    if (__v_648 != __v_650) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_648.as_canonical_u64(), rhs: __v_650.as_canonical_u64(), msg: None });
-    }
-    let __v_651: G = G::from_u64(256);
-    let __v_652: G = (__v_651 * __v_458);
-    let __v_653: G = G::from_u64(65536);
-    let __v_654: G = (__v_653 * __v_459);
-    let __v_655: G = G::from_u64(16777216);
-    let __v_656: G = (__v_655 * __v_460);
-    let __v_657: G = (__v_654 + __v_656);
-    let __v_658: G = (__v_652 + __v_657);
-    let __v_659: G = (__v_457 + __v_658);
-    let __v_660: G = G::from_u64(256);
-    let __v_661: G = (__v_660 * __v_462);
-    let __v_662: G = G::from_u64(65536);
-    let __v_663: G = (__v_662 * __v_463);
-    let __v_664: G = G::from_u64(16777216);
-    let __v_665: G = (__v_664 * __v_464);
-    let __v_666: G = (__v_663 + __v_665);
-    let __v_667: G = (__v_661 + __v_666);
-    let __v_668: G = (__v_461 + __v_667);
-    let __v_669: G = G::from_u64(256);
-    let __v_670: G = (__v_669 * __v_466);
-    let __v_671: G = G::from_u64(65536);
-    let __v_672: G = (__v_671 * __v_467);
-    let __v_673: G = G::from_u64(16777216);
-    let __v_674: G = (__v_673 * __v_468);
-    let __v_675: G = (__v_672 + __v_674);
-    let __v_676: G = (__v_670 + __v_675);
-    let __v_677: G = (__v_465 + __v_676);
-    let __v_678: G = G::from_u64(256);
-    let __v_679: G = (__v_678 * __v_470);
-    let __v_680: G = G::from_u64(65536);
-    let __v_681: G = (__v_680 * __v_471);
-    let __v_682: G = G::from_u64(16777216);
-    let __v_683: G = (__v_682 * __v_472);
-    let __v_684: G = (__v_681 + __v_683);
-    let __v_685: G = (__v_679 + __v_684);
-    let __v_686: G = (__v_469 + __v_685);
-    let __v_687: G = G::from_u64(256);
-    let __v_688: G = (__v_687 * __v_474);
-    let __v_689: G = G::from_u64(65536);
-    let __v_690: G = (__v_689 * __v_475);
-    let __v_691: G = G::from_u64(16777216);
-    let __v_692: G = (__v_691 * __v_476);
-    let __v_693: G = (__v_690 + __v_692);
-    let __v_694: G = (__v_688 + __v_693);
-    let __v_695: G = (__v_473 + __v_694);
-    let __v_696: G = G::from_u64(256);
-    let __v_697: G = (__v_696 * __v_478);
-    let __v_698: G = G::from_u64(65536);
-    let __v_699: G = (__v_698 * __v_479);
-    let __v_700: G = G::from_u64(16777216);
-    let __v_701: G = (__v_700 * __v_480);
-    let __v_702: G = (__v_699 + __v_701);
-    let __v_703: G = (__v_697 + __v_702);
-    let __v_704: G = (__v_477 + __v_703);
-    let __v_705: G = G::from_u64(256);
-    let __v_706: G = (__v_705 * __v_482);
-    let __v_707: G = G::from_u64(65536);
-    let __v_708: G = (__v_707 * __v_483);
-    let __v_709: G = G::from_u64(16777216);
-    let __v_710: G = (__v_709 * __v_484);
-    let __v_711: G = (__v_708 + __v_710);
-    let __v_712: G = (__v_706 + __v_711);
-    let __v_713: G = (__v_481 + __v_712);
-    let __v_714: G = G::from_u64(256);
-    let __v_715: G = (__v_714 * __v_486);
-    let __v_716: G = G::from_u64(65536);
-    let __v_717: G = (__v_716 * __v_487);
-    let __v_718: G = G::from_u64(16777216);
-    let __v_719: G = (__v_718 * __v_488);
-    let __v_720: G = (__v_717 + __v_719);
-    let __v_721: G = (__v_715 + __v_720);
-    let __v_722: G = (__v_485 + __v_721);
-    if (__v_659 != __v_8) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_659.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_668 != __v_9) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_668.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_677 != __v_10) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_677.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_686 != __v_11) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_686.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_695 != __v_12) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_695.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_704 != __v_13) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_704.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_713 != __v_14) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_713.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    if (__v_722 != __v_15) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_722.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
-    }
-    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_489, __v_492]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+    let __v_493: G = __r_arr[1];
+    let __v_494: G = __r_arr[2];
+    let __v_495: G = __r_arr[3];
+    let __v_496: G = __r_arr[4];
+    let __v_497: G = __r_arr[5];
+    let __v_498: G = __r_arr[6];
+    let __v_499: G = __r_arr[7];
+    let __v_500: G = __r_arr[8];
+    let __v_501: G = __r_arr[9];
+    let __v_502: G = G::from_u64(1);
+    let __v_503: G = G::from_u64(1);
+    let __v_504: G = { let __values: [G; 10] = [__v_502, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503, __v_503]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_505: G = G::from_u64(0);
+    let __v_506: G = { let __values: [G; 10] = [__v_505, __v_493, __v_494, __v_495, __v_496, __v_497, __v_498, __v_499, __v_500, __v_504]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_507: G = G::from_u64(0);
+    let __v_508: G = { let __values: [G; 10] = [__v_507, __v_483, __v_484, __v_485, __v_486, __v_487, __v_488, __v_489, __v_490, __v_506]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_509: G = G::from_u64(0);
+    let __v_510: G = { let __values: [G; 10] = [__v_509, __v_473, __v_474, __v_475, __v_476, __v_477, __v_478, __v_479, __v_480, __v_508]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_511: G = G::from_u64(0);
+    let __v_512: G = { let __values: [G; 10] = [__v_511, __v_463, __v_464, __v_465, __v_466, __v_467, __v_468, __v_469, __v_470, __v_510]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_513: G = G::from_u64(0);
+    let __v_514: G = { let __values: [G; 10] = [__v_513, __v_453, __v_454, __v_455, __v_456, __v_457, __v_458, __v_459, __v_460, __v_512]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_515: G = G::from_u64(0);
+    let __v_516: G = { let __values: [G; 10] = [__v_515, __v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_449, __v_450, __v_514]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_517: G = G::from_u64(0);
+    let __v_518: G = { let __values: [G; 10] = [__v_517, __v_433, __v_434, __v_435, __v_436, __v_437, __v_438, __v_439, __v_440, __v_516]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_501]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_519: G = __r_arr[0];
+    let __v_520: G = __r_arr[1];
+    let __v_521: G = __r_arr[2];
+    let __v_522: G = __r_arr[3];
+    let __v_523: G = __r_arr[4];
+    let __v_524: G = __r_arr[5];
+    let __v_525: G = __r_arr[6];
+    let __v_526: G = __r_arr[7];
+    let __v_527: G = __r_arr[8];
+    let __v_528: G = __r_arr[9];
+    let __r_arr: [G; OUT_93] = { let __args: [G; IN_93] = [__v_528, __v_519]; let __cu = unconstrained; let __hit = record.function_queries[93].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[93].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[93].bump_multiplicity(__i); } let __ret: [G; OUT_93] = unsafe { *(record.function_queries[93].output_at(__i).as_ptr() as *const [G; OUT_93]) }; __ret }, _ => aiur_fn_93(__args, record, io_buffer, __cu)? } };
+    let __v_529: G = __r_arr[0];
+    let __v_530: G = __r_arr[1];
+    let __v_531: G = __r_arr[2];
+    let __r_arr: [G; OUT_94] = { let __args: [G; IN_94] = [__v_531]; let __cu = unconstrained; let __hit = record.function_queries[94].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[94].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[94].bump_multiplicity(__i); } let __ret: [G; OUT_94] = unsafe { *(record.function_queries[94].output_at(__i).as_ptr() as *const [G; OUT_94]) }; __ret }, _ => aiur_fn_94(__args, record, io_buffer, __cu)? } };
+    let __v_532: G = __r_arr[0];
+    let __v_533: G = __r_arr[1];
+    let __v_534: G = __r_arr[2];
+    let __r_arr: [G; OUT_95] = { let __args: [G; IN_95] = [__v_534, __v_519]; let __cu = unconstrained; let __hit = record.function_queries[95].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[95].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[95].bump_multiplicity(__i); } let __ret: [G; OUT_95] = unsafe { *(record.function_queries[95].output_at(__i).as_ptr() as *const [G; OUT_95]) }; __ret }, _ => aiur_fn_95(__args, record, io_buffer, __cu)? } };
+    let __v_535: G = __r_arr[0];
+    let __v_536: G = __r_arr[1];
+    let __v_537: G = G::from_u64(0);
+    let __v_538: G = { let __values: [G; 10] = [__v_537, __v_520, __v_521, __v_522, __v_523, __v_524, __v_525, __v_526, __v_527, __v_530]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_518, __v_538]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __v_539: G = __r_arr[0];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_536.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_540: G = __loaded[0];
+    let __v_541: G = __loaded[1];
+    let __v_542: G = __loaded[2];
+    let __v_543: G = G::from_u64(1);
+    let __v_544: G = G::from_u64(1);
+    if (__v_540 != __v_543) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_540.as_canonical_u64(), rhs: __v_543.as_canonical_u64(), msg: None });
+    }
+    if (__v_541 != __v_544) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_541.as_canonical_u64(), rhs: __v_544.as_canonical_u64(), msg: None });
+    }
+    if (__v_542 != __v_544) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_542.as_canonical_u64(), rhs: __v_544.as_canonical_u64(), msg: None });
+    }
+    let __v_545: G = G::from_u64(0);
+    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_432, __v_442, __v_452, __v_462, __v_472, __v_482, __v_492, __v_539, __v_529, __v_532, __v_533, __v_535, __v_545]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
+    let __v_546: G = __r_arr[0];
+    let __v_547: G = G::from_u64(1);
+    let __r_arr: [G; OUT_237] = { let __args: [G; IN_237] = [__v_432, __v_442, __v_452, __v_462, __v_472, __v_482, __v_492, __v_539, __v_529, __v_532, __v_533, __v_535, __v_547]; let __cu = unconstrained; let __hit = record.function_queries[237].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[237].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[237].bump_multiplicity(__i); } let __ret: [G; OUT_237] = unsafe { *(record.function_queries[237].output_at(__i).as_ptr() as *const [G; OUT_237]) }; __ret }, _ => aiur_fn_237(__args, record, io_buffer, __cu)? } };
+    let __v_548: G = __r_arr[0];
+    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_546, __v_251, __v_252, __v_253, __v_254, __v_255, __v_256, __v_257, __v_258, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_267, __v_268, __v_269, __v_270]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
+    let __v_549: G = __r_arr[0];
+    let __v_550: G = __r_arr[1];
+    let __v_551: G = __r_arr[2];
+    let __r_arr: [G; OUT_239] = { let __args: [G; IN_239] = [__v_548, __v_251, __v_252, __v_253, __v_254, __v_255, __v_256, __v_257, __v_258, __v_0, __v_1, __v_2, __v_3, __v_4, __v_5, __v_6, __v_7, __v_267, __v_268, __v_269, __v_270]; let __cu = unconstrained; let __hit = record.function_queries[239].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[239].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[239].bump_multiplicity(__i); } let __ret: [G; OUT_239] = unsafe { *(record.function_queries[239].output_at(__i).as_ptr() as *const [G; OUT_239]) }; __ret }, _ => aiur_fn_239(__args, record, io_buffer, __cu)? } };
+    let __v_552: G = __r_arr[0];
+    let __v_553: G = __r_arr[1];
+    let __v_554: G = __r_arr[2];
+    let __v_555: G = G::from_u64(2);
+    let __v_556: G = G::from_u64(2);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_556]; let __info = io_buffer.get_info(__v_555, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_557: G = __io_pair.0;
+    let __v_558: G = __io_pair.1;
+    let __v_559: G = G::from_u64(2);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_559, __v_557, __v_558]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_560: G = __r_arr[0];
+    let __v_561: G = G::from_u64(103);
+    let __v_562: G = G::from_u64(230);
+    let __v_563: G = G::from_u64(9);
+    let __v_564: G = G::from_u64(106);
+    let __v_565: G = G::from_u64(133);
+    let __v_566: G = G::from_u64(174);
+    let __v_567: G = G::from_u64(103);
+    let __v_568: G = G::from_u64(187);
+    let __v_569: G = G::from_u64(114);
+    let __v_570: G = G::from_u64(243);
+    let __v_571: G = G::from_u64(110);
+    let __v_572: G = G::from_u64(60);
+    let __v_573: G = G::from_u64(58);
+    let __v_574: G = G::from_u64(245);
+    let __v_575: G = G::from_u64(79);
+    let __v_576: G = G::from_u64(165);
+    let __v_577: G = G::from_u64(127);
+    let __v_578: G = G::from_u64(82);
+    let __v_579: G = G::from_u64(14);
+    let __v_580: G = G::from_u64(81);
+    let __v_581: G = G::from_u64(140);
+    let __v_582: G = G::from_u64(104);
+    let __v_583: G = G::from_u64(5);
+    let __v_584: G = G::from_u64(155);
+    let __v_585: G = G::from_u64(171);
+    let __v_586: G = G::from_u64(217);
+    let __v_587: G = G::from_u64(131);
+    let __v_588: G = G::from_u64(31);
+    let __v_589: G = G::from_u64(25);
+    let __v_590: G = G::from_u64(205);
+    let __v_591: G = G::from_u64(224);
+    let __v_592: G = G::from_u64(91);
+    let __v_593: G = G::from_u64(1);
+    let __v_594: G = G::from_u64(1);
+    let __v_595: G = { let __values: [G; 3] = [__v_593, __v_594, __v_594]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_596: G = G::from_u64(0);
+    let __v_597: G = G::from_u64(0);
+    let __v_598: G = G::from_u64(0);
+    let __v_599: G = G::from_u64(0);
+    let __v_600: G = G::from_u64(0);
+    let __v_601: G = G::from_u64(0);
+    let __v_602: G = G::from_u64(0);
+    let __v_603: G = G::from_u64(0);
+    let __v_604: G = G::from_u64(0);
+    let __v_605: G = G::from_u64(0);
+    let __v_606: G = { let __values: [G; 8] = [__v_598, __v_599, __v_600, __v_601, __v_602, __v_603, __v_604, __v_605]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_607: G = { let __values: [G; 32] = [__v_561, __v_562, __v_563, __v_564, __v_565, __v_566, __v_567, __v_568, __v_569, __v_570, __v_571, __v_572, __v_573, __v_574, __v_575, __v_576, __v_577, __v_578, __v_579, __v_580, __v_581, __v_582, __v_583, __v_584, __v_585, __v_586, __v_587, __v_588, __v_589, __v_590, __v_591, __v_592]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_608: G = G::from_u64(1);
+    let __v_609: G = G::from_u64(1);
+    let __v_610: G = { let __values: [G; 34] = [__v_608, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609, __v_609]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_560, __v_595, __v_596, __v_597, __v_606, __v_607, __v_610]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
+    let __v_611: G = __r_arr[0];
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_611]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_612: G = __r_arr[0];
+    let __v_613: G = __r_arr[1];
+    let __v_614: G = __r_arr[2];
+    let __v_615: G = __r_arr[3];
+    let __v_616: G = __r_arr[4];
+    let __v_617: G = __r_arr[5];
+    let __v_618: G = __r_arr[6];
+    let __v_619: G = __r_arr[7];
+    let __v_620: G = __r_arr[8];
+    let __v_621: G = __r_arr[9];
+    let __v_622: G = __r_arr[10];
+    let __v_623: G = __r_arr[11];
+    let __v_624: G = __r_arr[12];
+    let __v_625: G = __r_arr[13];
+    let __v_626: G = __r_arr[14];
+    let __v_627: G = __r_arr[15];
+    let __v_628: G = __r_arr[16];
+    let __v_629: G = __r_arr[17];
+    let __v_630: G = __r_arr[18];
+    let __v_631: G = __r_arr[19];
+    let __v_632: G = __r_arr[20];
+    let __v_633: G = __r_arr[21];
+    let __v_634: G = __r_arr[22];
+    let __v_635: G = __r_arr[23];
+    let __v_636: G = __r_arr[24];
+    let __v_637: G = __r_arr[25];
+    let __v_638: G = __r_arr[26];
+    let __v_639: G = __r_arr[27];
+    let __v_640: G = __r_arr[28];
+    let __v_641: G = __r_arr[29];
+    let __v_642: G = __r_arr[30];
+    let __v_643: G = __r_arr[31];
+    let __v_644: G = G::from_u64(256);
+    let __v_645: G = (__v_644 * __v_613);
+    let __v_646: G = G::from_u64(65536);
+    let __v_647: G = (__v_646 * __v_614);
+    let __v_648: G = G::from_u64(16777216);
+    let __v_649: G = (__v_648 * __v_615);
+    let __v_650: G = (__v_647 + __v_649);
+    let __v_651: G = (__v_645 + __v_650);
+    let __v_652: G = (__v_612 + __v_651);
+    let __v_653: G = G::from_u64(256);
+    let __v_654: G = (__v_653 * __v_617);
+    let __v_655: G = G::from_u64(65536);
+    let __v_656: G = (__v_655 * __v_618);
+    let __v_657: G = G::from_u64(16777216);
+    let __v_658: G = (__v_657 * __v_619);
+    let __v_659: G = (__v_656 + __v_658);
+    let __v_660: G = (__v_654 + __v_659);
+    let __v_661: G = (__v_616 + __v_660);
+    let __v_662: G = G::from_u64(256);
+    let __v_663: G = (__v_662 * __v_621);
+    let __v_664: G = G::from_u64(65536);
+    let __v_665: G = (__v_664 * __v_622);
+    let __v_666: G = G::from_u64(16777216);
+    let __v_667: G = (__v_666 * __v_623);
+    let __v_668: G = (__v_665 + __v_667);
+    let __v_669: G = (__v_663 + __v_668);
+    let __v_670: G = (__v_620 + __v_669);
+    let __v_671: G = G::from_u64(256);
+    let __v_672: G = (__v_671 * __v_625);
+    let __v_673: G = G::from_u64(65536);
+    let __v_674: G = (__v_673 * __v_626);
+    let __v_675: G = G::from_u64(16777216);
+    let __v_676: G = (__v_675 * __v_627);
+    let __v_677: G = (__v_674 + __v_676);
+    let __v_678: G = (__v_672 + __v_677);
+    let __v_679: G = (__v_624 + __v_678);
+    let __v_680: G = G::from_u64(256);
+    let __v_681: G = (__v_680 * __v_629);
+    let __v_682: G = G::from_u64(65536);
+    let __v_683: G = (__v_682 * __v_630);
+    let __v_684: G = G::from_u64(16777216);
+    let __v_685: G = (__v_684 * __v_631);
+    let __v_686: G = (__v_683 + __v_685);
+    let __v_687: G = (__v_681 + __v_686);
+    let __v_688: G = (__v_628 + __v_687);
+    let __v_689: G = G::from_u64(256);
+    let __v_690: G = (__v_689 * __v_633);
+    let __v_691: G = G::from_u64(65536);
+    let __v_692: G = (__v_691 * __v_634);
+    let __v_693: G = G::from_u64(16777216);
+    let __v_694: G = (__v_693 * __v_635);
+    let __v_695: G = (__v_692 + __v_694);
+    let __v_696: G = (__v_690 + __v_695);
+    let __v_697: G = (__v_632 + __v_696);
+    let __v_698: G = G::from_u64(256);
+    let __v_699: G = (__v_698 * __v_637);
+    let __v_700: G = G::from_u64(65536);
+    let __v_701: G = (__v_700 * __v_638);
+    let __v_702: G = G::from_u64(16777216);
+    let __v_703: G = (__v_702 * __v_639);
+    let __v_704: G = (__v_701 + __v_703);
+    let __v_705: G = (__v_699 + __v_704);
+    let __v_706: G = (__v_636 + __v_705);
+    let __v_707: G = G::from_u64(256);
+    let __v_708: G = (__v_707 * __v_641);
+    let __v_709: G = G::from_u64(65536);
+    let __v_710: G = (__v_709 * __v_642);
+    let __v_711: G = G::from_u64(16777216);
+    let __v_712: G = (__v_711 * __v_643);
+    let __v_713: G = (__v_710 + __v_712);
+    let __v_714: G = (__v_708 + __v_713);
+    let __v_715: G = (__v_640 + __v_714);
+    if (__v_652 != __v_8) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_652.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_661 != __v_9) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_661.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_670 != __v_10) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_670.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_679 != __v_11) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_679.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_688 != __v_12) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_688.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_697 != __v_13) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_697.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_706 != __v_14) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_706.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    if (__v_715 != __v_15) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_715.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: Some("structural join: output claim digest mismatch".to_string()) });
+    }
+    let __r_arr: [G; OUT_231] = { let __args: [G; IN_231] = [__v_560]; let __cu = unconstrained; let __hit = record.function_queries[231].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[231].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[231].bump_multiplicity(__i); } let __ret: [G; OUT_231] = unsafe { *(record.function_queries[231].output_at(__i).as_ptr() as *const [G; OUT_231]) }; __ret }, _ => aiur_fn_231(__args, record, io_buffer, __cu)? } };
+    let __v_716: G = __r_arr[0];
+    let __v_717: G = __r_arr[1];
+    let __v_718: G = __r_arr[2];
+    let __r_arr: [G; OUT_210] = { let __args: [G; IN_210] = [__v_549, __v_552]; let __cu = unconstrained; let __hit = record.function_queries[210].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[210].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[210].bump_multiplicity(__i); } let __ret: [G; OUT_210] = unsafe { *(record.function_queries[210].output_at(__i).as_ptr() as *const [G; OUT_210]) }; __ret }, _ => aiur_fn_210(__args, record, io_buffer, __cu)? } };
+    let __v_719: G = __r_arr[0];
+    let __r_arr: [G; OUT_2] = { let __args: [G; IN_2] = [__v_716, __v_719]; let __cu = unconstrained; let __hit = record.function_queries[2].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[2].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[2].bump_multiplicity(__i); } let __ret: [G; OUT_2] = unsafe { *(record.function_queries[2].output_at(__i).as_ptr() as *const [G; OUT_2]) }; __ret }, _ => aiur_fn_2(__args, record, io_buffer, __cu)? } };
+    let __v_720: G = __r_arr[0];
+    let __v_721: G = G::from_u64(1);
+    if (__v_720 != __v_721) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_720.as_canonical_u64(), rhs: __v_721.as_canonical_u64(), msg: Some("structural join: output subject root is not nodeHash(left, right)".to_string()) });
+    }
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_550, __v_551]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_722: G = __r_arr[0];
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_553, __v_554]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
     let __v_723: G = __r_arr[0];
-    let __v_724: G = G::from_u64(1);
-    if (__v_723 != __v_724) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_723.as_canonical_u64(), rhs: __v_724.as_canonical_u64(), msg: Some("structural join: output subject root is not nodeHash(left, right)".to_string()) });
-    }
+    let __r_arr: [G; OUT_221] = { let __args: [G; IN_221] = [__v_717, __v_718]; let __cu = unconstrained; let __hit = record.function_queries[221].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[221].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[221].bump_multiplicity(__i); } let __ret: [G; OUT_221] = unsafe { *(record.function_queries[221].output_at(__i).as_ptr() as *const [G; OUT_221]) }; __ret }, _ => aiur_fn_221(__args, record, io_buffer, __cu)? } };
+    let __v_724: G = __r_arr[0];
+    let __r_arr: [G; OUT_229] = { let __args: [G; IN_229] = [__v_722, __v_723, __v_716, __v_724]; let __cu = unconstrained; let __hit = record.function_queries[229].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[229].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[229].bump_multiplicity(__i); } let __ret: [G; OUT_229] = unsafe { *(record.function_queries[229].output_at(__i).as_ptr() as *const [G; OUT_229]) }; __ret }, _ => aiur_fn_229(__args, record, io_buffer, __cu)? } };
     let __ret: [G; OUT_241] = [];
     record.function_queries[241].finish(&inp[..], &__ret[..], !unconstrained);
     return Ok(__ret);
@@ -25291,50 +25291,53 @@ fn aiur_fn_242(
     let __r_arr: [G; OUT_47] = { let __args: [G; IN_47] = [__v_67]; let __cu = unconstrained; let __hit = record.function_queries[47].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[47].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[47].bump_multiplicity(__i); } let __ret: [G; OUT_47] = unsafe { *(record.function_queries[47].output_at(__i).as_ptr() as *const [G; OUT_47]) }; __ret }, _ => aiur_fn_47(__args, record, io_buffer, __cu)? } };
     let __v_68: G = __r_arr[0];
     let __v_69: G = __r_arr[1];
-    let __v_70: G = G::from_u64(1);
-    let __v_71: G = G::from_u64(0);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_71]; let __info = io_buffer.get_info(__v_70, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_72: G = __io_pair.0;
-    let __v_73: G = __io_pair.1;
-    let __v_74: G = G::from_u64(1);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_74, __v_72, __v_73]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
-    let __v_75: G = __r_arr[0];
-    let __v_76: G = G::from_u64(103);
-    let __v_77: G = G::from_u64(230);
-    let __v_78: G = G::from_u64(9);
-    let __v_79: G = G::from_u64(106);
-    let __v_80: G = G::from_u64(133);
-    let __v_81: G = G::from_u64(174);
-    let __v_82: G = G::from_u64(103);
-    let __v_83: G = G::from_u64(187);
-    let __v_84: G = G::from_u64(114);
-    let __v_85: G = G::from_u64(243);
-    let __v_86: G = G::from_u64(110);
-    let __v_87: G = G::from_u64(60);
-    let __v_88: G = G::from_u64(58);
-    let __v_89: G = G::from_u64(245);
-    let __v_90: G = G::from_u64(79);
-    let __v_91: G = G::from_u64(165);
-    let __v_92: G = G::from_u64(127);
-    let __v_93: G = G::from_u64(82);
-    let __v_94: G = G::from_u64(14);
-    let __v_95: G = G::from_u64(81);
-    let __v_96: G = G::from_u64(140);
-    let __v_97: G = G::from_u64(104);
-    let __v_98: G = G::from_u64(5);
-    let __v_99: G = G::from_u64(155);
-    let __v_100: G = G::from_u64(171);
-    let __v_101: G = G::from_u64(217);
-    let __v_102: G = G::from_u64(131);
-    let __v_103: G = G::from_u64(31);
-    let __v_104: G = G::from_u64(25);
-    let __v_105: G = G::from_u64(205);
-    let __v_106: G = G::from_u64(224);
-    let __v_107: G = G::from_u64(91);
-    let __v_108: G = G::from_u64(1);
+    let __v_70: G = (__v_18 + __v_19);
+    if (__v_69 != __v_70) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_69.as_canonical_u64(), rhs: __v_70.as_canonical_u64(), msg: None });
+    }
+    let __v_71: G = G::from_u64(1);
+    let __v_72: G = G::from_u64(0);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_72]; let __info = io_buffer.get_info(__v_71, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_73: G = __io_pair.0;
+    let __v_74: G = __io_pair.1;
+    let __v_75: G = G::from_u64(1);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_75, __v_73, __v_74]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_76: G = __r_arr[0];
+    let __v_77: G = G::from_u64(103);
+    let __v_78: G = G::from_u64(230);
+    let __v_79: G = G::from_u64(9);
+    let __v_80: G = G::from_u64(106);
+    let __v_81: G = G::from_u64(133);
+    let __v_82: G = G::from_u64(174);
+    let __v_83: G = G::from_u64(103);
+    let __v_84: G = G::from_u64(187);
+    let __v_85: G = G::from_u64(114);
+    let __v_86: G = G::from_u64(243);
+    let __v_87: G = G::from_u64(110);
+    let __v_88: G = G::from_u64(60);
+    let __v_89: G = G::from_u64(58);
+    let __v_90: G = G::from_u64(245);
+    let __v_91: G = G::from_u64(79);
+    let __v_92: G = G::from_u64(165);
+    let __v_93: G = G::from_u64(127);
+    let __v_94: G = G::from_u64(82);
+    let __v_95: G = G::from_u64(14);
+    let __v_96: G = G::from_u64(81);
+    let __v_97: G = G::from_u64(140);
+    let __v_98: G = G::from_u64(104);
+    let __v_99: G = G::from_u64(5);
+    let __v_100: G = G::from_u64(155);
+    let __v_101: G = G::from_u64(171);
+    let __v_102: G = G::from_u64(217);
+    let __v_103: G = G::from_u64(131);
+    let __v_104: G = G::from_u64(31);
+    let __v_105: G = G::from_u64(25);
+    let __v_106: G = G::from_u64(205);
+    let __v_107: G = G::from_u64(224);
+    let __v_108: G = G::from_u64(91);
     let __v_109: G = G::from_u64(1);
-    let __v_110: G = { let __values: [G; 3] = [__v_108, __v_109, __v_109]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_111: G = G::from_u64(0);
+    let __v_110: G = G::from_u64(1);
+    let __v_111: G = { let __values: [G; 3] = [__v_109, __v_110, __v_110]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_112: G = G::from_u64(0);
     let __v_113: G = G::from_u64(0);
     let __v_114: G = G::from_u64(0);
@@ -25344,878 +25347,1110 @@ fn aiur_fn_242(
     let __v_118: G = G::from_u64(0);
     let __v_119: G = G::from_u64(0);
     let __v_120: G = G::from_u64(0);
-    let __v_121: G = { let __values: [G; 8] = [__v_113, __v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_122: G = { let __values: [G; 32] = [__v_76, __v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_123: G = G::from_u64(1);
+    let __v_121: G = G::from_u64(0);
+    let __v_122: G = { let __values: [G; 8] = [__v_114, __v_115, __v_116, __v_117, __v_118, __v_119, __v_120, __v_121]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_123: G = { let __values: [G; 32] = [__v_77, __v_78, __v_79, __v_80, __v_81, __v_82, __v_83, __v_84, __v_85, __v_86, __v_87, __v_88, __v_89, __v_90, __v_91, __v_92, __v_93, __v_94, __v_95, __v_96, __v_97, __v_98, __v_99, __v_100, __v_101, __v_102, __v_103, __v_104, __v_105, __v_106, __v_107, __v_108]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_124: G = G::from_u64(1);
-    let __v_125: G = { let __values: [G; 34] = [__v_123, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124, __v_124]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_75, __v_110, __v_111, __v_112, __v_121, __v_122, __v_125]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_126: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_126]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_125: G = G::from_u64(1);
+    let __v_126: G = { let __values: [G; 34] = [__v_124, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125, __v_125]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_76, __v_111, __v_112, __v_113, __v_122, __v_123, __v_126]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
     let __v_127: G = __r_arr[0];
-    let __v_128: G = __r_arr[1];
-    let __v_129: G = __r_arr[2];
-    let __v_130: G = __r_arr[3];
-    let __v_131: G = __r_arr[4];
-    let __v_132: G = __r_arr[5];
-    let __v_133: G = __r_arr[6];
-    let __v_134: G = __r_arr[7];
-    let __v_135: G = __r_arr[8];
-    let __v_136: G = __r_arr[9];
-    let __v_137: G = __r_arr[10];
-    let __v_138: G = __r_arr[11];
-    let __v_139: G = __r_arr[12];
-    let __v_140: G = __r_arr[13];
-    let __v_141: G = __r_arr[14];
-    let __v_142: G = __r_arr[15];
-    let __v_143: G = __r_arr[16];
-    let __v_144: G = __r_arr[17];
-    let __v_145: G = __r_arr[18];
-    let __v_146: G = __r_arr[19];
-    let __v_147: G = __r_arr[20];
-    let __v_148: G = __r_arr[21];
-    let __v_149: G = __r_arr[22];
-    let __v_150: G = __r_arr[23];
-    let __v_151: G = __r_arr[24];
-    let __v_152: G = __r_arr[25];
-    let __v_153: G = __r_arr[26];
-    let __v_154: G = __r_arr[27];
-    let __v_155: G = __r_arr[28];
-    let __v_156: G = __r_arr[29];
-    let __v_157: G = __r_arr[30];
-    let __v_158: G = __r_arr[31];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_75]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_159: G = __r_arr[0];
-    let __v_160: G = __r_arr[1];
-    let __v_161: G = __r_arr[2];
-    let __v_162: G = __r_arr[3];
-    let __v_163: G = __r_arr[4];
-    let __v_164: G = __r_arr[5];
-    let __v_165: G = __r_arr[6];
-    let __v_166: G = __r_arr[7];
-    let __v_167: G = __r_arr[8];
-    let __v_168: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_168]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_169: G = __r_arr[0];
-    let __v_170: G = __r_arr[1];
-    let __v_171: G = __r_arr[2];
-    let __v_172: G = __r_arr[3];
-    let __v_173: G = __r_arr[4];
-    let __v_174: G = __r_arr[5];
-    let __v_175: G = __r_arr[6];
-    let __v_176: G = __r_arr[7];
-    let __v_177: G = __r_arr[8];
-    let __v_178: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_178]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_179: G = __r_arr[0];
-    let __v_180: G = __r_arr[1];
-    let __v_181: G = __r_arr[2];
-    let __v_182: G = __r_arr[3];
-    let __v_183: G = __r_arr[4];
-    let __v_184: G = __r_arr[5];
-    let __v_185: G = __r_arr[6];
-    let __v_186: G = __r_arr[7];
-    let __v_187: G = __r_arr[8];
-    let __v_188: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_188]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_189: G = __r_arr[0];
-    let __v_190: G = __r_arr[1];
-    let __v_191: G = __r_arr[2];
-    let __v_192: G = __r_arr[3];
-    let __v_193: G = __r_arr[4];
-    let __v_194: G = __r_arr[5];
-    let __v_195: G = __r_arr[6];
-    let __v_196: G = __r_arr[7];
-    let __v_197: G = __r_arr[8];
-    let __v_198: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_198]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_199: G = __r_arr[0];
-    let __v_200: G = __r_arr[1];
-    let __v_201: G = __r_arr[2];
-    let __v_202: G = __r_arr[3];
-    let __v_203: G = __r_arr[4];
-    let __v_204: G = __r_arr[5];
-    let __v_205: G = __r_arr[6];
-    let __v_206: G = __r_arr[7];
-    let __v_207: G = __r_arr[8];
-    let __v_208: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_208]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_209: G = __r_arr[0];
-    let __v_210: G = __r_arr[1];
-    let __v_211: G = __r_arr[2];
-    let __v_212: G = __r_arr[3];
-    let __v_213: G = __r_arr[4];
-    let __v_214: G = __r_arr[5];
-    let __v_215: G = __r_arr[6];
-    let __v_216: G = __r_arr[7];
-    let __v_217: G = __r_arr[8];
-    let __v_218: G = __r_arr[9];
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_218]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_219: G = __r_arr[0];
-    let __v_220: G = __r_arr[1];
-    let __v_221: G = __r_arr[2];
-    let __v_222: G = __r_arr[3];
-    let __v_223: G = __r_arr[4];
-    let __v_224: G = __r_arr[5];
-    let __v_225: G = __r_arr[6];
-    let __v_226: G = __r_arr[7];
-    let __v_227: G = __r_arr[8];
-    let __v_228: G = __r_arr[9];
-    let __v_229: G = G::from_u64(0);
-    let __v_230: G = G::from_u64(0);
-    let __v_231: G = G::from_u64(0);
-    let __v_232: G = G::from_u64(0);
-    let __v_233: G = G::from_u64(0);
-    let __v_234: G = G::from_u64(0);
-    let __v_235: G = G::from_u64(0);
-    let __v_236: G = G::from_u64(1);
-    let __v_237: G = G::from_u64(1);
-    let __v_238: G = { let __values: [G; 10] = [__v_236, __v_237, __v_237, __v_237, __v_237, __v_237, __v_237, __v_237, __v_237, __v_237]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_239: G = { let __values: [G; 10] = [__v_235, __v_220, __v_221, __v_222, __v_223, __v_224, __v_225, __v_226, __v_227, __v_238]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_240: G = { let __values: [G; 10] = [__v_234, __v_210, __v_211, __v_212, __v_213, __v_214, __v_215, __v_216, __v_217, __v_239]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_241: G = { let __values: [G; 10] = [__v_233, __v_200, __v_201, __v_202, __v_203, __v_204, __v_205, __v_206, __v_207, __v_240]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_242: G = { let __values: [G; 10] = [__v_232, __v_190, __v_191, __v_192, __v_193, __v_194, __v_195, __v_196, __v_197, __v_241]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_243: G = { let __values: [G; 10] = [__v_231, __v_180, __v_181, __v_182, __v_183, __v_184, __v_185, __v_186, __v_187, __v_242]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_244: G = { let __values: [G; 10] = [__v_230, __v_170, __v_171, __v_172, __v_173, __v_174, __v_175, __v_176, __v_177, __v_243]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_245: G = { let __values: [G; 10] = [__v_229, __v_160, __v_161, __v_162, __v_163, __v_164, __v_165, __v_166, __v_167, __v_244]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_228]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
-    let __v_246: G = __r_arr[0];
-    let __v_247: G = __r_arr[1];
-    let __v_248: G = __r_arr[2];
-    let __v_249: G = __r_arr[3];
-    let __v_250: G = __r_arr[4];
-    let __v_251: G = __r_arr[5];
-    let __v_252: G = __r_arr[6];
-    let __v_253: G = __r_arr[7];
-    let __v_254: G = __r_arr[8];
-    let __v_255: G = __r_arr[9];
-    let __r_arr: [G; OUT_93] = { let __args: [G; IN_93] = [__v_255, __v_246]; let __cu = unconstrained; let __hit = record.function_queries[93].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[93].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[93].bump_multiplicity(__i); } let __ret: [G; OUT_93] = unsafe { *(record.function_queries[93].output_at(__i).as_ptr() as *const [G; OUT_93]) }; __ret }, _ => aiur_fn_93(__args, record, io_buffer, __cu)? } };
-    let __v_256: G = __r_arr[0];
-    let __v_257: G = __r_arr[1];
-    let __v_258: G = __r_arr[2];
-    let __r_arr: [G; OUT_94] = { let __args: [G; IN_94] = [__v_258]; let __cu = unconstrained; let __hit = record.function_queries[94].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[94].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[94].bump_multiplicity(__i); } let __ret: [G; OUT_94] = unsafe { *(record.function_queries[94].output_at(__i).as_ptr() as *const [G; OUT_94]) }; __ret }, _ => aiur_fn_94(__args, record, io_buffer, __cu)? } };
-    let __v_259: G = __r_arr[0];
-    let __v_260: G = __r_arr[1];
-    let __v_261: G = __r_arr[2];
-    let __r_arr: [G; OUT_95] = { let __args: [G; IN_95] = [__v_261, __v_246]; let __cu = unconstrained; let __hit = record.function_queries[95].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[95].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[95].bump_multiplicity(__i); } let __ret: [G; OUT_95] = unsafe { *(record.function_queries[95].output_at(__i).as_ptr() as *const [G; OUT_95]) }; __ret }, _ => aiur_fn_95(__args, record, io_buffer, __cu)? } };
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_127]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_128: G = __r_arr[0];
+    let __v_129: G = __r_arr[1];
+    let __v_130: G = __r_arr[2];
+    let __v_131: G = __r_arr[3];
+    let __v_132: G = __r_arr[4];
+    let __v_133: G = __r_arr[5];
+    let __v_134: G = __r_arr[6];
+    let __v_135: G = __r_arr[7];
+    let __v_136: G = __r_arr[8];
+    let __v_137: G = __r_arr[9];
+    let __v_138: G = __r_arr[10];
+    let __v_139: G = __r_arr[11];
+    let __v_140: G = __r_arr[12];
+    let __v_141: G = __r_arr[13];
+    let __v_142: G = __r_arr[14];
+    let __v_143: G = __r_arr[15];
+    let __v_144: G = __r_arr[16];
+    let __v_145: G = __r_arr[17];
+    let __v_146: G = __r_arr[18];
+    let __v_147: G = __r_arr[19];
+    let __v_148: G = __r_arr[20];
+    let __v_149: G = __r_arr[21];
+    let __v_150: G = __r_arr[22];
+    let __v_151: G = __r_arr[23];
+    let __v_152: G = __r_arr[24];
+    let __v_153: G = __r_arr[25];
+    let __v_154: G = __r_arr[26];
+    let __v_155: G = __r_arr[27];
+    let __v_156: G = __r_arr[28];
+    let __v_157: G = __r_arr[29];
+    let __v_158: G = __r_arr[30];
+    let __v_159: G = __r_arr[31];
+    let __v_160: G = G::from_u64(256);
+    let __v_161: G = (__v_160 * __v_129);
+    let __v_162: G = G::from_u64(65536);
+    let __v_163: G = (__v_162 * __v_130);
+    let __v_164: G = G::from_u64(16777216);
+    let __v_165: G = (__v_164 * __v_131);
+    let __v_166: G = (__v_163 + __v_165);
+    let __v_167: G = (__v_161 + __v_166);
+    let __v_168: G = (__v_128 + __v_167);
+    let __v_169: G = G::from_u64(256);
+    let __v_170: G = (__v_169 * __v_133);
+    let __v_171: G = G::from_u64(65536);
+    let __v_172: G = (__v_171 * __v_134);
+    let __v_173: G = G::from_u64(16777216);
+    let __v_174: G = (__v_173 * __v_135);
+    let __v_175: G = (__v_172 + __v_174);
+    let __v_176: G = (__v_170 + __v_175);
+    let __v_177: G = (__v_132 + __v_176);
+    let __v_178: G = G::from_u64(256);
+    let __v_179: G = (__v_178 * __v_137);
+    let __v_180: G = G::from_u64(65536);
+    let __v_181: G = (__v_180 * __v_138);
+    let __v_182: G = G::from_u64(16777216);
+    let __v_183: G = (__v_182 * __v_139);
+    let __v_184: G = (__v_181 + __v_183);
+    let __v_185: G = (__v_179 + __v_184);
+    let __v_186: G = (__v_136 + __v_185);
+    let __v_187: G = G::from_u64(256);
+    let __v_188: G = (__v_187 * __v_141);
+    let __v_189: G = G::from_u64(65536);
+    let __v_190: G = (__v_189 * __v_142);
+    let __v_191: G = G::from_u64(16777216);
+    let __v_192: G = (__v_191 * __v_143);
+    let __v_193: G = (__v_190 + __v_192);
+    let __v_194: G = (__v_188 + __v_193);
+    let __v_195: G = (__v_140 + __v_194);
+    let __v_196: G = G::from_u64(256);
+    let __v_197: G = (__v_196 * __v_145);
+    let __v_198: G = G::from_u64(65536);
+    let __v_199: G = (__v_198 * __v_146);
+    let __v_200: G = G::from_u64(16777216);
+    let __v_201: G = (__v_200 * __v_147);
+    let __v_202: G = (__v_199 + __v_201);
+    let __v_203: G = (__v_197 + __v_202);
+    let __v_204: G = (__v_144 + __v_203);
+    let __v_205: G = G::from_u64(256);
+    let __v_206: G = (__v_205 * __v_149);
+    let __v_207: G = G::from_u64(65536);
+    let __v_208: G = (__v_207 * __v_150);
+    let __v_209: G = G::from_u64(16777216);
+    let __v_210: G = (__v_209 * __v_151);
+    let __v_211: G = (__v_208 + __v_210);
+    let __v_212: G = (__v_206 + __v_211);
+    let __v_213: G = (__v_148 + __v_212);
+    let __v_214: G = G::from_u64(256);
+    let __v_215: G = (__v_214 * __v_153);
+    let __v_216: G = G::from_u64(65536);
+    let __v_217: G = (__v_216 * __v_154);
+    let __v_218: G = G::from_u64(16777216);
+    let __v_219: G = (__v_218 * __v_155);
+    let __v_220: G = (__v_217 + __v_219);
+    let __v_221: G = (__v_215 + __v_220);
+    let __v_222: G = (__v_152 + __v_221);
+    let __v_223: G = G::from_u64(256);
+    let __v_224: G = (__v_223 * __v_157);
+    let __v_225: G = G::from_u64(65536);
+    let __v_226: G = (__v_225 * __v_158);
+    let __v_227: G = G::from_u64(16777216);
+    let __v_228: G = (__v_227 * __v_159);
+    let __v_229: G = (__v_226 + __v_228);
+    let __v_230: G = (__v_224 + __v_229);
+    let __v_231: G = (__v_156 + __v_230);
+    if (__v_168 != __v_0) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_168.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
+    }
+    if (__v_177 != __v_1) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_177.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: None });
+    }
+    if (__v_186 != __v_2) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_186.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: None });
+    }
+    if (__v_195 != __v_3) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_195.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
+    }
+    if (__v_204 != __v_4) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_204.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: None });
+    }
+    if (__v_213 != __v_5) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_213.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: None });
+    }
+    if (__v_222 != __v_6) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_222.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: None });
+    }
+    if (__v_231 != __v_7) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_231.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: None });
+    }
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_76]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_232: G = __r_arr[0];
+    let __v_233: G = __r_arr[1];
+    let __v_234: G = __r_arr[2];
+    let __v_235: G = __r_arr[3];
+    let __v_236: G = __r_arr[4];
+    let __v_237: G = __r_arr[5];
+    let __v_238: G = __r_arr[6];
+    let __v_239: G = __r_arr[7];
+    let __v_240: G = __r_arr[8];
+    let __v_241: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_241]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_242: G = __r_arr[0];
+    let __v_243: G = __r_arr[1];
+    let __v_244: G = __r_arr[2];
+    let __v_245: G = __r_arr[3];
+    let __v_246: G = __r_arr[4];
+    let __v_247: G = __r_arr[5];
+    let __v_248: G = __r_arr[6];
+    let __v_249: G = __r_arr[7];
+    let __v_250: G = __r_arr[8];
+    let __v_251: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_251]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_252: G = __r_arr[0];
+    let __v_253: G = __r_arr[1];
+    let __v_254: G = __r_arr[2];
+    let __v_255: G = __r_arr[3];
+    let __v_256: G = __r_arr[4];
+    let __v_257: G = __r_arr[5];
+    let __v_258: G = __r_arr[6];
+    let __v_259: G = __r_arr[7];
+    let __v_260: G = __r_arr[8];
+    let __v_261: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_261]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_262: G = __r_arr[0];
     let __v_263: G = __r_arr[1];
-    let __v_264: G = G::from_u64(0);
-    let __v_265: G = { let __values: [G; 10] = [__v_264, __v_247, __v_248, __v_249, __v_250, __v_251, __v_252, __v_253, __v_254, __v_257]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_245, __v_265]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-    let __v_266: G = __r_arr[0];
-    let __v_267: G = G::from_u64(2);
-    let __v_268: G = G::from_u64(0);
-    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_268]; let __info = io_buffer.get_info(__v_267, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
-    let __v_269: G = __io_pair.0;
-    let __v_270: G = __io_pair.1;
-    let __v_271: G = G::from_u64(2);
-    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_271, __v_269, __v_270]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_264: G = __r_arr[2];
+    let __v_265: G = __r_arr[3];
+    let __v_266: G = __r_arr[4];
+    let __v_267: G = __r_arr[5];
+    let __v_268: G = __r_arr[6];
+    let __v_269: G = __r_arr[7];
+    let __v_270: G = __r_arr[8];
+    let __v_271: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_271]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
     let __v_272: G = __r_arr[0];
-    let __v_273: G = G::from_u64(103);
-    let __v_274: G = G::from_u64(230);
-    let __v_275: G = G::from_u64(9);
-    let __v_276: G = G::from_u64(106);
-    let __v_277: G = G::from_u64(133);
-    let __v_278: G = G::from_u64(174);
-    let __v_279: G = G::from_u64(103);
-    let __v_280: G = G::from_u64(187);
-    let __v_281: G = G::from_u64(114);
-    let __v_282: G = G::from_u64(243);
-    let __v_283: G = G::from_u64(110);
-    let __v_284: G = G::from_u64(60);
-    let __v_285: G = G::from_u64(58);
-    let __v_286: G = G::from_u64(245);
-    let __v_287: G = G::from_u64(79);
-    let __v_288: G = G::from_u64(165);
-    let __v_289: G = G::from_u64(127);
-    let __v_290: G = G::from_u64(82);
-    let __v_291: G = G::from_u64(14);
-    let __v_292: G = G::from_u64(81);
-    let __v_293: G = G::from_u64(140);
-    let __v_294: G = G::from_u64(104);
-    let __v_295: G = G::from_u64(5);
-    let __v_296: G = G::from_u64(155);
-    let __v_297: G = G::from_u64(171);
-    let __v_298: G = G::from_u64(217);
-    let __v_299: G = G::from_u64(131);
-    let __v_300: G = G::from_u64(31);
-    let __v_301: G = G::from_u64(25);
-    let __v_302: G = G::from_u64(205);
-    let __v_303: G = G::from_u64(224);
-    let __v_304: G = G::from_u64(91);
-    let __v_305: G = G::from_u64(1);
-    let __v_306: G = G::from_u64(1);
-    let __v_307: G = { let __values: [G; 3] = [__v_305, __v_306, __v_306]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_308: G = G::from_u64(0);
+    let __v_273: G = __r_arr[1];
+    let __v_274: G = __r_arr[2];
+    let __v_275: G = __r_arr[3];
+    let __v_276: G = __r_arr[4];
+    let __v_277: G = __r_arr[5];
+    let __v_278: G = __r_arr[6];
+    let __v_279: G = __r_arr[7];
+    let __v_280: G = __r_arr[8];
+    let __v_281: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_281]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_282: G = __r_arr[0];
+    let __v_283: G = __r_arr[1];
+    let __v_284: G = __r_arr[2];
+    let __v_285: G = __r_arr[3];
+    let __v_286: G = __r_arr[4];
+    let __v_287: G = __r_arr[5];
+    let __v_288: G = __r_arr[6];
+    let __v_289: G = __r_arr[7];
+    let __v_290: G = __r_arr[8];
+    let __v_291: G = __r_arr[9];
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_291]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_292: G = __r_arr[0];
+    let __v_293: G = __r_arr[1];
+    let __v_294: G = __r_arr[2];
+    let __v_295: G = __r_arr[3];
+    let __v_296: G = __r_arr[4];
+    let __v_297: G = __r_arr[5];
+    let __v_298: G = __r_arr[6];
+    let __v_299: G = __r_arr[7];
+    let __v_300: G = __r_arr[8];
+    let __v_301: G = __r_arr[9];
+    let __v_302: G = G::from_u64(1);
+    let __v_303: G = G::from_u64(1);
+    let __v_304: G = { let __values: [G; 10] = [__v_302, __v_303, __v_303, __v_303, __v_303, __v_303, __v_303, __v_303, __v_303, __v_303]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_305: G = G::from_u64(0);
+    let __v_306: G = { let __values: [G; 10] = [__v_305, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_304]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_307: G = G::from_u64(0);
+    let __v_308: G = { let __values: [G; 10] = [__v_307, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_306]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_309: G = G::from_u64(0);
-    let __v_310: G = G::from_u64(0);
+    let __v_310: G = { let __values: [G; 10] = [__v_309, __v_273, __v_274, __v_275, __v_276, __v_277, __v_278, __v_279, __v_280, __v_308]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_311: G = G::from_u64(0);
-    let __v_312: G = G::from_u64(0);
+    let __v_312: G = { let __values: [G; 10] = [__v_311, __v_263, __v_264, __v_265, __v_266, __v_267, __v_268, __v_269, __v_270, __v_310]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_313: G = G::from_u64(0);
-    let __v_314: G = G::from_u64(0);
+    let __v_314: G = { let __values: [G; 10] = [__v_313, __v_253, __v_254, __v_255, __v_256, __v_257, __v_258, __v_259, __v_260, __v_312]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_315: G = G::from_u64(0);
-    let __v_316: G = G::from_u64(0);
+    let __v_316: G = { let __values: [G; 10] = [__v_315, __v_243, __v_244, __v_245, __v_246, __v_247, __v_248, __v_249, __v_250, __v_314]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
     let __v_317: G = G::from_u64(0);
-    let __v_318: G = { let __values: [G; 8] = [__v_310, __v_311, __v_312, __v_313, __v_314, __v_315, __v_316, __v_317]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_319: G = { let __values: [G; 32] = [__v_273, __v_274, __v_275, __v_276, __v_277, __v_278, __v_279, __v_280, __v_281, __v_282, __v_283, __v_284, __v_285, __v_286, __v_287, __v_288, __v_289, __v_290, __v_291, __v_292, __v_293, __v_294, __v_295, __v_296, __v_297, __v_298, __v_299, __v_300, __v_301, __v_302, __v_303, __v_304]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __v_320: G = G::from_u64(1);
-    let __v_321: G = G::from_u64(1);
-    let __v_322: G = { let __values: [G; 34] = [__v_320, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321, __v_321]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_272, __v_307, __v_308, __v_309, __v_318, __v_319, __v_322]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
-    let __v_323: G = __r_arr[0];
-    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_323]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
-    let __v_324: G = __r_arr[0];
-    let __v_325: G = __r_arr[1];
-    let __v_326: G = __r_arr[2];
-    let __v_327: G = __r_arr[3];
-    let __v_328: G = __r_arr[4];
-    let __v_329: G = __r_arr[5];
-    let __v_330: G = __r_arr[6];
-    let __v_331: G = __r_arr[7];
-    let __v_332: G = __r_arr[8];
-    let __v_333: G = __r_arr[9];
-    let __v_334: G = __r_arr[10];
-    let __v_335: G = __r_arr[11];
-    let __v_336: G = __r_arr[12];
-    let __v_337: G = __r_arr[13];
-    let __v_338: G = __r_arr[14];
-    let __v_339: G = __r_arr[15];
-    let __v_340: G = __r_arr[16];
-    let __v_341: G = __r_arr[17];
-    let __v_342: G = __r_arr[18];
-    let __v_343: G = __r_arr[19];
-    let __v_344: G = __r_arr[20];
-    let __v_345: G = __r_arr[21];
-    let __v_346: G = __r_arr[22];
-    let __v_347: G = __r_arr[23];
-    let __v_348: G = __r_arr[24];
-    let __v_349: G = __r_arr[25];
-    let __v_350: G = __r_arr[26];
-    let __v_351: G = __r_arr[27];
-    let __v_352: G = __r_arr[28];
-    let __v_353: G = __r_arr[29];
-    let __v_354: G = __r_arr[30];
-    let __v_355: G = __r_arr[31];
-    let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_272]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
-    let __v_356: G = __r_arr[0];
-    let __v_357: G = __r_arr[1];
-    let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_357, __v_356]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
-    let __v_358: G = __r_arr[0];
-    let __v_359: G = __r_arr[1];
-    let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_22.as_canonical_u64() {
-  _ => {
-    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-    let __v_360: G = __r_arr[0];
-    let __v_361: G = G::from_bool((__v_360 == G::ZERO));
-    let __v_362: G = G::from_u64(0);
-    if (__v_361 != __v_362) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_361.as_canonical_u64(), rhs: __v_362.as_canonical_u64(), msg: None });
-    }
-    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_66]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-    let __v_363: G = __r_arr[0];
-    if (__v_363 != __v_360) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_363.as_canonical_u64(), rhs: __v_360.as_canonical_u64(), msg: None });
-    }
-    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_68]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-    let __v_364: G = __r_arr[0];
-    if (__v_364 != __v_360) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_364.as_canonical_u64(), rhs: __v_360.as_canonical_u64(), msg: None });
-    }
-    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_61]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-    let __v_365: G = __r_arr[0];
-    if (__v_365 != __v_360) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_365.as_canonical_u64(), rhs: __v_360.as_canonical_u64(), msg: None });
-    }
-    let __r_arr: [G; OUT_161] = { let __args: [G; IN_161] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[161].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[161].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[161].bump_multiplicity(__i); } let __ret: [G; OUT_161] = unsafe { *(record.function_queries[161].output_at(__i).as_ptr() as *const [G; OUT_161]) }; __ret }, _ => aiur_fn_161(__args, record, io_buffer, __cu)? } };
-    let __v_366: G = __r_arr[0];
-    let __v_367: G = G::from_u64(1);
-    if (__v_366 != __v_367) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_366.as_canonical_u64(), rhs: __v_367.as_canonical_u64(), msg: None });
-    }
-    let __v_368: G = G::from_u64(1);
-    break '__mc_0 [__v_368];
-  },
-}
- };
-    let __v_360: G = __mc_out___mc_0[0];
-    let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_159.as_canonical_u64() {
-  _ => {
-    match __v_159.as_canonical_u64() {
+    let __v_318: G = { let __values: [G; 10] = [__v_317, __v_233, __v_234, __v_235, __v_236, __v_237, __v_238, __v_239, __v_240, __v_316]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_80] = { let __args: [G; IN_80] = [__v_301]; let __cu = unconstrained; let __hit = record.function_queries[80].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[80].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[80].bump_multiplicity(__i); } let __ret: [G; OUT_80] = unsafe { *(record.function_queries[80].output_at(__i).as_ptr() as *const [G; OUT_80]) }; __ret }, _ => aiur_fn_80(__args, record, io_buffer, __cu)? } };
+    let __v_319: G = __r_arr[0];
+    let __v_320: G = __r_arr[1];
+    let __v_321: G = __r_arr[2];
+    let __v_322: G = __r_arr[3];
+    let __v_323: G = __r_arr[4];
+    let __v_324: G = __r_arr[5];
+    let __v_325: G = __r_arr[6];
+    let __v_326: G = __r_arr[7];
+    let __v_327: G = __r_arr[8];
+    let __v_328: G = __r_arr[9];
+    let __r_arr: [G; OUT_93] = { let __args: [G; IN_93] = [__v_328, __v_319]; let __cu = unconstrained; let __hit = record.function_queries[93].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[93].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[93].bump_multiplicity(__i); } let __ret: [G; OUT_93] = unsafe { *(record.function_queries[93].output_at(__i).as_ptr() as *const [G; OUT_93]) }; __ret }, _ => aiur_fn_93(__args, record, io_buffer, __cu)? } };
+    let __v_329: G = __r_arr[0];
+    let __v_330: G = __r_arr[1];
+    let __v_331: G = __r_arr[2];
+    let __r_arr: [G; OUT_94] = { let __args: [G; IN_94] = [__v_331]; let __cu = unconstrained; let __hit = record.function_queries[94].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[94].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[94].bump_multiplicity(__i); } let __ret: [G; OUT_94] = unsafe { *(record.function_queries[94].output_at(__i).as_ptr() as *const [G; OUT_94]) }; __ret }, _ => aiur_fn_94(__args, record, io_buffer, __cu)? } };
+    let __v_332: G = __r_arr[0];
+    let __v_333: G = __r_arr[1];
+    let __v_334: G = __r_arr[2];
+    let __r_arr: [G; OUT_95] = { let __args: [G; IN_95] = [__v_334, __v_319]; let __cu = unconstrained; let __hit = record.function_queries[95].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[95].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[95].bump_multiplicity(__i); } let __ret: [G; OUT_95] = unsafe { *(record.function_queries[95].output_at(__i).as_ptr() as *const [G; OUT_95]) }; __ret }, _ => aiur_fn_95(__args, record, io_buffer, __cu)? } };
+    let __v_335: G = __r_arr[0];
+    let __v_336: G = __r_arr[1];
+    let __v_337: G = G::from_u64(0);
+    let __v_338: G = { let __values: [G; 10] = [__v_337, __v_320, __v_321, __v_322, __v_323, __v_324, __v_325, __v_326, __v_327, __v_330]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_318, __v_338]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
+    let __v_339: G = __r_arr[0];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_336.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_340: G = __loaded[0];
+    let __v_341: G = __loaded[1];
+    let __v_342: G = __loaded[2];
+    let __v_343: G = G::from_u64(1);
+    let __v_344: G = G::from_u64(1);
+    if (__v_340 != __v_343) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_340.as_canonical_u64(), rhs: __v_343.as_canonical_u64(), msg: None });
+    }
+    if (__v_341 != __v_344) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_341.as_canonical_u64(), rhs: __v_344.as_canonical_u64(), msg: None });
+    }
+    if (__v_342 != __v_344) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_342.as_canonical_u64(), rhs: __v_344.as_canonical_u64(), msg: None });
+    }
+    let __v_345: G = G::from_u64(2);
+    let __v_346: G = G::from_u64(0);
+    let __io_pair: (G, G) = { let __key: [G; 1] = [__v_346]; let __info = io_buffer.get_info(__v_345, &__key[..])?; (G::from_usize(__info.idx), G::from_usize(__info.len)) };
+    let __v_347: G = __io_pair.0;
+    let __v_348: G = __io_pair.1;
+    let __v_349: G = G::from_u64(2);
+    let __r_arr: [G; OUT_3] = { let __args: [G; IN_3] = [__v_349, __v_347, __v_348]; let __cu = true; let __hit = record.function_queries[3].get_index_of(&__args[..]); match __hit { Some(__i) if true => { let __ret: [G; OUT_3] = unsafe { *(record.function_queries[3].output_at(__i).as_ptr() as *const [G; OUT_3]) }; __ret }, _ => aiur_fn_3(__args, record, io_buffer, __cu)? } };
+    let __v_350: G = __r_arr[0];
+    let __v_351: G = G::from_u64(103);
+    let __v_352: G = G::from_u64(230);
+    let __v_353: G = G::from_u64(9);
+    let __v_354: G = G::from_u64(106);
+    let __v_355: G = G::from_u64(133);
+    let __v_356: G = G::from_u64(174);
+    let __v_357: G = G::from_u64(103);
+    let __v_358: G = G::from_u64(187);
+    let __v_359: G = G::from_u64(114);
+    let __v_360: G = G::from_u64(243);
+    let __v_361: G = G::from_u64(110);
+    let __v_362: G = G::from_u64(60);
+    let __v_363: G = G::from_u64(58);
+    let __v_364: G = G::from_u64(245);
+    let __v_365: G = G::from_u64(79);
+    let __v_366: G = G::from_u64(165);
+    let __v_367: G = G::from_u64(127);
+    let __v_368: G = G::from_u64(82);
+    let __v_369: G = G::from_u64(14);
+    let __v_370: G = G::from_u64(81);
+    let __v_371: G = G::from_u64(140);
+    let __v_372: G = G::from_u64(104);
+    let __v_373: G = G::from_u64(5);
+    let __v_374: G = G::from_u64(155);
+    let __v_375: G = G::from_u64(171);
+    let __v_376: G = G::from_u64(217);
+    let __v_377: G = G::from_u64(131);
+    let __v_378: G = G::from_u64(31);
+    let __v_379: G = G::from_u64(25);
+    let __v_380: G = G::from_u64(205);
+    let __v_381: G = G::from_u64(224);
+    let __v_382: G = G::from_u64(91);
+    let __v_383: G = G::from_u64(1);
+    let __v_384: G = G::from_u64(1);
+    let __v_385: G = { let __values: [G; 3] = [__v_383, __v_384, __v_384]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_386: G = G::from_u64(0);
+    let __v_387: G = G::from_u64(0);
+    let __v_388: G = G::from_u64(0);
+    let __v_389: G = G::from_u64(0);
+    let __v_390: G = G::from_u64(0);
+    let __v_391: G = G::from_u64(0);
+    let __v_392: G = G::from_u64(0);
+    let __v_393: G = G::from_u64(0);
+    let __v_394: G = G::from_u64(0);
+    let __v_395: G = G::from_u64(0);
+    let __v_396: G = { let __values: [G; 8] = [__v_388, __v_389, __v_390, __v_391, __v_392, __v_393, __v_394, __v_395]; let __mq = record.memory_queries.get_mut(&8).ok_or(ExecError::InvalidMemorySize(8))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_397: G = { let __values: [G; 32] = [__v_351, __v_352, __v_353, __v_354, __v_355, __v_356, __v_357, __v_358, __v_359, __v_360, __v_361, __v_362, __v_363, __v_364, __v_365, __v_366, __v_367, __v_368, __v_369, __v_370, __v_371, __v_372, __v_373, __v_374, __v_375, __v_376, __v_377, __v_378, __v_379, __v_380, __v_381, __v_382]; let __mq = record.memory_queries.get_mut(&32).ok_or(ExecError::InvalidMemorySize(32))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __v_398: G = G::from_u64(1);
+    let __v_399: G = G::from_u64(1);
+    let __v_400: G = { let __values: [G; 34] = [__v_398, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399, __v_399]; let __mq = record.memory_queries.get_mut(&34).ok_or(ExecError::InvalidMemorySize(34))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    let __r_arr: [G; OUT_68] = { let __args: [G; IN_68] = [__v_350, __v_385, __v_386, __v_387, __v_396, __v_397, __v_400]; let __cu = unconstrained; let __hit = record.function_queries[68].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[68].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[68].bump_multiplicity(__i); } let __ret: [G; OUT_68] = unsafe { *(record.function_queries[68].output_at(__i).as_ptr() as *const [G; OUT_68]) }; __ret }, _ => aiur_fn_68(__args, record, io_buffer, __cu)? } };
+    let __v_401: G = __r_arr[0];
+    let __r_arr: [G; OUT_67] = { let __args: [G; IN_67] = [__v_401]; let __cu = unconstrained; let __hit = record.function_queries[67].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[67].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[67].bump_multiplicity(__i); } let __ret: [G; OUT_67] = unsafe { *(record.function_queries[67].output_at(__i).as_ptr() as *const [G; OUT_67]) }; __ret }, _ => aiur_fn_67(__args, record, io_buffer, __cu)? } };
+    let __v_402: G = __r_arr[0];
+    let __v_403: G = __r_arr[1];
+    let __v_404: G = __r_arr[2];
+    let __v_405: G = __r_arr[3];
+    let __v_406: G = __r_arr[4];
+    let __v_407: G = __r_arr[5];
+    let __v_408: G = __r_arr[6];
+    let __v_409: G = __r_arr[7];
+    let __v_410: G = __r_arr[8];
+    let __v_411: G = __r_arr[9];
+    let __v_412: G = __r_arr[10];
+    let __v_413: G = __r_arr[11];
+    let __v_414: G = __r_arr[12];
+    let __v_415: G = __r_arr[13];
+    let __v_416: G = __r_arr[14];
+    let __v_417: G = __r_arr[15];
+    let __v_418: G = __r_arr[16];
+    let __v_419: G = __r_arr[17];
+    let __v_420: G = __r_arr[18];
+    let __v_421: G = __r_arr[19];
+    let __v_422: G = __r_arr[20];
+    let __v_423: G = __r_arr[21];
+    let __v_424: G = __r_arr[22];
+    let __v_425: G = __r_arr[23];
+    let __v_426: G = __r_arr[24];
+    let __v_427: G = __r_arr[25];
+    let __v_428: G = __r_arr[26];
+    let __v_429: G = __r_arr[27];
+    let __v_430: G = __r_arr[28];
+    let __v_431: G = __r_arr[29];
+    let __v_432: G = __r_arr[30];
+    let __v_433: G = __r_arr[31];
+    let __v_434: G = G::from_u64(256);
+    let __v_435: G = (__v_434 * __v_403);
+    let __v_436: G = G::from_u64(65536);
+    let __v_437: G = (__v_436 * __v_404);
+    let __v_438: G = G::from_u64(16777216);
+    let __v_439: G = (__v_438 * __v_405);
+    let __v_440: G = (__v_437 + __v_439);
+    let __v_441: G = (__v_435 + __v_440);
+    let __v_442: G = (__v_402 + __v_441);
+    let __v_443: G = G::from_u64(256);
+    let __v_444: G = (__v_443 * __v_407);
+    let __v_445: G = G::from_u64(65536);
+    let __v_446: G = (__v_445 * __v_408);
+    let __v_447: G = G::from_u64(16777216);
+    let __v_448: G = (__v_447 * __v_409);
+    let __v_449: G = (__v_446 + __v_448);
+    let __v_450: G = (__v_444 + __v_449);
+    let __v_451: G = (__v_406 + __v_450);
+    let __v_452: G = G::from_u64(256);
+    let __v_453: G = (__v_452 * __v_411);
+    let __v_454: G = G::from_u64(65536);
+    let __v_455: G = (__v_454 * __v_412);
+    let __v_456: G = G::from_u64(16777216);
+    let __v_457: G = (__v_456 * __v_413);
+    let __v_458: G = (__v_455 + __v_457);
+    let __v_459: G = (__v_453 + __v_458);
+    let __v_460: G = (__v_410 + __v_459);
+    let __v_461: G = G::from_u64(256);
+    let __v_462: G = (__v_461 * __v_415);
+    let __v_463: G = G::from_u64(65536);
+    let __v_464: G = (__v_463 * __v_416);
+    let __v_465: G = G::from_u64(16777216);
+    let __v_466: G = (__v_465 * __v_417);
+    let __v_467: G = (__v_464 + __v_466);
+    let __v_468: G = (__v_462 + __v_467);
+    let __v_469: G = (__v_414 + __v_468);
+    let __v_470: G = G::from_u64(256);
+    let __v_471: G = (__v_470 * __v_419);
+    let __v_472: G = G::from_u64(65536);
+    let __v_473: G = (__v_472 * __v_420);
+    let __v_474: G = G::from_u64(16777216);
+    let __v_475: G = (__v_474 * __v_421);
+    let __v_476: G = (__v_473 + __v_475);
+    let __v_477: G = (__v_471 + __v_476);
+    let __v_478: G = (__v_418 + __v_477);
+    let __v_479: G = G::from_u64(256);
+    let __v_480: G = (__v_479 * __v_423);
+    let __v_481: G = G::from_u64(65536);
+    let __v_482: G = (__v_481 * __v_424);
+    let __v_483: G = G::from_u64(16777216);
+    let __v_484: G = (__v_483 * __v_425);
+    let __v_485: G = (__v_482 + __v_484);
+    let __v_486: G = (__v_480 + __v_485);
+    let __v_487: G = (__v_422 + __v_486);
+    let __v_488: G = G::from_u64(256);
+    let __v_489: G = (__v_488 * __v_427);
+    let __v_490: G = G::from_u64(65536);
+    let __v_491: G = (__v_490 * __v_428);
+    let __v_492: G = G::from_u64(16777216);
+    let __v_493: G = (__v_492 * __v_429);
+    let __v_494: G = (__v_491 + __v_493);
+    let __v_495: G = (__v_489 + __v_494);
+    let __v_496: G = (__v_426 + __v_495);
+    let __v_497: G = G::from_u64(256);
+    let __v_498: G = (__v_497 * __v_431);
+    let __v_499: G = G::from_u64(65536);
+    let __v_500: G = (__v_499 * __v_432);
+    let __v_501: G = G::from_u64(16777216);
+    let __v_502: G = (__v_501 * __v_433);
+    let __v_503: G = (__v_500 + __v_502);
+    let __v_504: G = (__v_498 + __v_503);
+    let __v_505: G = (__v_430 + __v_504);
+    if (__v_442 != __v_8) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_442.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: None });
+    }
+    if (__v_451 != __v_9) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_451.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: None });
+    }
+    if (__v_460 != __v_10) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_460.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: None });
+    }
+    if (__v_469 != __v_11) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_469.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: None });
+    }
+    if (__v_478 != __v_12) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_478.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: None });
+    }
+    if (__v_487 != __v_13) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_487.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: None });
+    }
+    if (__v_496 != __v_14) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_496.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: None });
+    }
+    if (__v_505 != __v_15) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_505.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: None });
+    }
+    let __r_arr: [G; OUT_27] = { let __args: [G; IN_27] = [__v_350]; let __cu = unconstrained; let __hit = record.function_queries[27].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[27].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[27].bump_multiplicity(__i); } let __ret: [G; OUT_27] = unsafe { *(record.function_queries[27].output_at(__i).as_ptr() as *const [G; OUT_27]) }; __ret }, _ => aiur_fn_27(__args, record, io_buffer, __cu)? } };
+    let __v_506: G = __r_arr[0];
+    let __v_507: G = __r_arr[1];
+    let __r_arr: [G; OUT_204] = { let __args: [G; IN_204] = [__v_507, __v_506]; let __cu = unconstrained; let __hit = record.function_queries[204].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[204].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[204].bump_multiplicity(__i); } let __ret: [G; OUT_204] = unsafe { *(record.function_queries[204].output_at(__i).as_ptr() as *const [G; OUT_204]) }; __ret }, _ => aiur_fn_204(__args, record, io_buffer, __cu)? } };
+    let __v_508: G = __r_arr[0];
+    let __v_509: G = __r_arr[1];
+    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_509.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
+    let __v_510: G = __loaded[0];
+    let __v_511: G = __loaded[1];
+    let __v_512: G = __loaded[2];
+    let __v_513: G = G::from_u64(1);
+    let __v_514: G = G::from_u64(1);
+    if (__v_510 != __v_513) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_510.as_canonical_u64(), rhs: __v_513.as_canonical_u64(), msg: None });
+    }
+    if (__v_511 != __v_514) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_511.as_canonical_u64(), rhs: __v_514.as_canonical_u64(), msg: None });
+    }
+    if (__v_512 != __v_514) {
+      return Err(ExecError::AssertEqMismatch { lhs: __v_512.as_canonical_u64(), rhs: __v_514.as_canonical_u64(), msg: None });
+    }
+    match __v_22.as_canonical_u64() {
       _ => {
-        match __v_22.as_canonical_u64() {
+        let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+        let __v_515: G = __r_arr[0];
+        let __v_516: G = G::from_bool((__v_515 == G::ZERO));
+        let __v_517: G = G::from_u64(0);
+        if (__v_516 != __v_517) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_516.as_canonical_u64(), rhs: __v_517.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_66]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_518: G = __r_arr[0];
+        if (__v_518 != __v_515) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_518.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_68]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_519: G = __r_arr[0];
+        if (__v_519 != __v_515) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_519.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_61]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+        let __v_520: G = __r_arr[0];
+        if (__v_520 != __v_515) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_520.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: None });
+        }
+        let __r_arr: [G; OUT_161] = { let __args: [G; IN_161] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[161].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[161].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[161].bump_multiplicity(__i); } let __ret: [G; OUT_161] = unsafe { *(record.function_queries[161].output_at(__i).as_ptr() as *const [G; OUT_161]) }; __ret }, _ => aiur_fn_161(__args, record, io_buffer, __cu)? } };
+        let __v_521: G = __r_arr[0];
+        let __v_522: G = G::from_u64(1);
+        if (__v_521 != __v_522) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_521.as_canonical_u64(), rhs: __v_522.as_canonical_u64(), msg: None });
+        }
+        let __v_523: G = G::from_u64(1);
+        let __v_524: G = G::from_u64(1);
+        if (__v_523 != __v_524) {
+          return Err(ExecError::AssertEqMismatch { lhs: __v_523.as_canonical_u64(), rhs: __v_524.as_canonical_u64(), msg: None });
+        }
+        match __v_232.as_canonical_u64() {
           _ => {
-            let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_256, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
-            let __v_361: G = __r_arr[0];
-            let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_262, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
-            let __v_362: G = __r_arr[0];
-            match __v_24.as_canonical_u64() {
+            match __v_232.as_canonical_u64() {
               _ => {
-                let __mc_out___mc_2: [G; 1] = '__mc_2: { match __v_259.as_canonical_u64() {
+                let __v_525: G = G::from_u64(0);
+                if (__v_242 != __v_525) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_242.as_canonical_u64(), rhs: __v_525.as_canonical_u64(), msg: None });
+                }
+                let __v_526: G = G::from_u64(0);
+                if (__v_252 != __v_526) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_252.as_canonical_u64(), rhs: __v_526.as_canonical_u64(), msg: None });
+                }
+                let __v_527: G = G::from_u64(1);
+                if (__v_262 != __v_527) {
+                  return Err(ExecError::AssertEqMismatch { lhs: __v_262.as_canonical_u64(), rhs: __v_527.as_canonical_u64(), msg: None });
+                }
+                match __v_22.as_canonical_u64() {
+                  _ => {
+                    let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
+                    let __v_528: G = __r_arr[0];
+                    let __v_529: G = G::from_u64(1);
+                    if (__v_528 != __v_529) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_528.as_canonical_u64(), rhs: __v_529.as_canonical_u64(), msg: None });
+                    }
+                    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                    let __v_530: G = __r_arr[0];
+                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_329]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                    let __v_531: G = __r_arr[0];
+                    let __v_532: G = (__v_530 - __v_531);
+                    let __v_533: G = G::from_bool((__v_532 == G::ZERO));
+                    let __v_534: G = G::from_u64(1);
+                    if (__v_533 != __v_534) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_533.as_canonical_u64(), rhs: __v_534.as_canonical_u64(), msg: None });
+                    }
+                    let __r_arr: [G; OUT_201] = { let __args: [G; IN_201] = [__v_329, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[201].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[201].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[201].bump_multiplicity(__i); } let __ret: [G; OUT_201] = unsafe { *(record.function_queries[201].output_at(__i).as_ptr() as *const [G; OUT_201]) }; __ret }, _ => aiur_fn_201(__args, record, io_buffer, __cu)? } };
+                    let __v_535: G = __r_arr[0];
+                    let __r_arr: [G; OUT_202] = { let __args: [G; IN_202] = [__v_335, __v_22]; let __cu = unconstrained; let __hit = record.function_queries[202].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[202].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[202].bump_multiplicity(__i); } let __ret: [G; OUT_202] = unsafe { *(record.function_queries[202].output_at(__i).as_ptr() as *const [G; OUT_202]) }; __ret }, _ => aiur_fn_202(__args, record, io_buffer, __cu)? } };
+                    let __v_536: G = __r_arr[0];
+                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_535]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                    let __v_537: G = __r_arr[0];
+                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                    let __v_538: G = __r_arr[0];
+                    let __v_539: G = (__v_537 - __v_538);
+                    let __v_540: G = G::from_bool((__v_539 == G::ZERO));
+                    let __v_541: G = G::from_u64(1);
+                    if (__v_540 != __v_541) {
+                      return Err(ExecError::AssertEqMismatch { lhs: __v_540.as_canonical_u64(), rhs: __v_541.as_canonical_u64(), msg: None });
+                    }
+                    match __v_24.as_canonical_u64() {
+                      _ => {
+                        let __mc_out___mc_0: [G; 1] = '__mc_0: { match __v_332.as_canonical_u64() {
   0u64 => {
-    let __v_363: G = G::from_u64(1);
-    let __v_364: G = G::from_u64(1);
-    let __v_365: G = { let __values: [G; 3] = [__v_363, __v_364, __v_364]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-    break '__mc_2 [__v_365];
+    let __v_542: G = G::from_u64(1);
+    let __v_543: G = G::from_u64(1);
+    let __v_544: G = { let __values: [G; 3] = [__v_542, __v_543, __v_543]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+    break '__mc_0 [__v_544];
   },
   1u64 => {
-    break '__mc_2 [__v_260];
+    break '__mc_0 [__v_333];
   },
   _ => {
-    return Err(ExecError::MatchNoCase(__v_259.as_canonical_u64()));
+    return Err(ExecError::MatchNoCase(__v_332.as_canonical_u64()));
   },
 }
  };
-                let __v_363: G = __mc_out___mc_2[0];
-                let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_34, __v_272]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                let __v_364: G = __r_arr[0];
-                let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_24, __v_364]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                let __v_365: G = __r_arr[0];
-                let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_363, __v_365]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
-                let __v_366: G = __r_arr[0];
-                let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_22, __v_366]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
-                let __v_367: G = __r_arr[0];
-                let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_266, __v_367]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
-                let __v_368: G = __r_arr[0];
-                let __v_369: G = G::from_u64(0);
-                let __v_370: G = G::from_u64(109);
-                let __v_371: G = G::from_u64(0);
-                let __v_372: G = G::from_u64(117);
-                let __v_373: G = G::from_u64(0);
-                let __v_374: G = G::from_u64(108);
-                let __v_375: G = G::from_u64(0);
-                let __v_376: G = G::from_u64(116);
-                let __v_377: G = G::from_u64(0);
-                let __v_378: G = G::from_u64(105);
-                let __v_379: G = G::from_u64(0);
-                let __v_380: G = G::from_u64(45);
-                let __v_381: G = G::from_u64(0);
-                let __v_382: G = G::from_u64(115);
-                let __v_383: G = G::from_u64(0);
-                let __v_384: G = G::from_u64(116);
-                let __v_385: G = G::from_u64(0);
-                let __v_386: G = G::from_u64(97);
-                let __v_387: G = G::from_u64(0);
-                let __v_388: G = G::from_u64(114);
-                let __v_389: G = G::from_u64(0);
-                let __v_390: G = G::from_u64(107);
-                let __v_391: G = G::from_u64(0);
-                let __v_392: G = G::from_u64(47);
-                let __v_393: G = G::from_u64(0);
-                let __v_394: G = G::from_u64(118);
-                let __v_395: G = G::from_u64(0);
-                let __v_396: G = G::from_u64(48);
-                let __v_397: G = { let __values: [G; 3] = [__v_395, __v_396, __v_368]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_398: G = { let __values: [G; 3] = [__v_393, __v_394, __v_397]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_399: G = { let __values: [G; 3] = [__v_391, __v_392, __v_398]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_400: G = { let __values: [G; 3] = [__v_389, __v_390, __v_399]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_401: G = { let __values: [G; 3] = [__v_387, __v_388, __v_400]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_402: G = { let __values: [G; 3] = [__v_385, __v_386, __v_401]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_403: G = { let __values: [G; 3] = [__v_383, __v_384, __v_402]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_404: G = { let __values: [G; 3] = [__v_381, __v_382, __v_403]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_405: G = { let __values: [G; 3] = [__v_379, __v_380, __v_404]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_406: G = { let __values: [G; 3] = [__v_377, __v_378, __v_405]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_407: G = { let __values: [G; 3] = [__v_375, __v_376, __v_406]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_408: G = { let __values: [G; 3] = [__v_373, __v_374, __v_407]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_409: G = { let __values: [G; 3] = [__v_371, __v_372, __v_408]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_410: G = { let __values: [G; 3] = [__v_369, __v_370, __v_409]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __v_411: G = G::from_u64(1);
-                let __v_412: G = G::from_u64(1);
-                let __v_413: G = { let __values: [G; 3] = [__v_411, __v_412, __v_412]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_410, __v_413]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                let __v_414: G = __r_arr[0];
-                let __v_415: G = __r_arr[1];
-                let __v_416: G = __r_arr[2];
-                let __v_417: G = __r_arr[3];
-                let __v_418: G = __r_arr[4];
-                let __v_419: G = __r_arr[5];
-                let __v_420: G = __r_arr[6];
-                let __v_421: G = __r_arr[7];
-                let __v_422: G = __r_arr[8];
-                let __v_423: G = __r_arr[9];
-                let __v_424: G = __r_arr[10];
-                let __v_425: G = __r_arr[11];
-                let __v_426: G = __r_arr[12];
-                let __v_427: G = __r_arr[13];
-                let __v_428: G = __r_arr[14];
-                let __v_429: G = __r_arr[15];
-                let __v_430: G = __r_arr[16];
-                let __v_431: G = __r_arr[17];
-                let __v_432: G = G::from_u64(1);
-                let __v_433: G = G::from_u64(1);
-                let __v_434: G = { let __values: [G; 3] = [__v_432, __v_433, __v_433]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_422, __v_423, __v_424, __v_425, __v_426, __v_427, __v_428, __v_429, __v_434]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                let __v_435: G = __r_arr[0];
-                let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_414, __v_415, __v_416, __v_417, __v_418, __v_419, __v_420, __v_421, __v_435]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                let __v_436: G = __r_arr[0];
-                let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_430, __v_436]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                let __v_437: G = __r_arr[0];
-                let __v_438: G = G::from_u64(1);
-                let __v_439: G = G::from_u64(1);
-                let __v_440: G = { let __values: [G; 3] = [__v_438, __v_439, __v_439]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_437, __v_440]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                let __v_441: G = __r_arr[0];
-                let __v_442: G = __r_arr[1];
-                let __v_443: G = __r_arr[2];
-                let __v_444: G = __r_arr[3];
-                let __v_445: G = __r_arr[4];
-                let __v_446: G = __r_arr[5];
-                let __v_447: G = __r_arr[6];
-                let __v_448: G = __r_arr[7];
-                let __v_449: G = __r_arr[8];
-                let __v_450: G = __r_arr[9];
-                let __v_451: G = __r_arr[10];
-                let __v_452: G = __r_arr[11];
-                let __v_453: G = __r_arr[12];
-                let __v_454: G = __r_arr[13];
-                let __v_455: G = __r_arr[14];
-                let __v_456: G = __r_arr[15];
-                let __v_457: G = __r_arr[16];
-                let __v_458: G = __r_arr[17];
-                let __v_459: G = G::from_u64(1);
-                let __v_460: G = G::from_u64(1);
-                let __v_461: G = { let __values: [G; 3] = [__v_459, __v_460, __v_460]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_449, __v_450, __v_451, __v_452, __v_453, __v_454, __v_455, __v_456, __v_461]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                let __v_462: G = __r_arr[0];
-                let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_441, __v_442, __v_443, __v_444, __v_445, __v_446, __v_447, __v_448, __v_462]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
-                let __v_463: G = __r_arr[0];
-                let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_457, __v_463]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                let __v_464: G = __r_arr[0];
-                let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_464, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
-                let __v_465: G = __r_arr[0];
-                let __v_466: G = G::from_u64(1);
-                let __v_467: G = G::from_u64(1);
-                let __v_468: G = { let __values: [G; 3] = [__v_466, __v_467, __v_467]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_30, __v_468]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                let __v_469: G = __r_arr[0];
-                let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_465, __v_469]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                let __v_470: G = __r_arr[0];
-                let __v_471: G = G::from_u64(1);
-                let __v_472: G = G::from_u64(1);
-                let __v_473: G = { let __values: [G; 3] = [__v_471, __v_472, __v_472]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_470, __v_473]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                let __v_474: G = __r_arr[0];
-                let __v_475: G = __r_arr[1];
-                let __v_476: G = __r_arr[2];
-                let __v_477: G = __r_arr[3];
-                let __v_478: G = __r_arr[4];
-                let __v_479: G = __r_arr[5];
-                let __v_480: G = __r_arr[6];
-                let __v_481: G = __r_arr[7];
-                let __v_482: G = __r_arr[8];
-                let __v_483: G = __r_arr[9];
-                let __v_484: G = __r_arr[10];
-                let __v_485: G = __r_arr[11];
-                let __v_486: G = __r_arr[12];
-                let __v_487: G = __r_arr[13];
-                let __v_488: G = __r_arr[14];
-                let __v_489: G = __r_arr[15];
-                let __v_490: G = __r_arr[16];
-                let __v_491: G = __r_arr[17];
-                let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_490, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
-                let __v_492: G = __r_arr[0];
-                let __v_493: G = G::from_u64(1);
-                let __v_494: G = G::from_u64(1);
-                let __v_495: G = { let __values: [G; 3] = [__v_493, __v_494, __v_494]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_492, __v_495]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                let __v_496: G = __r_arr[0];
-                let __v_497: G = __r_arr[1];
-                let __v_498: G = __r_arr[2];
-                let __v_499: G = __r_arr[3];
-                let __v_500: G = __r_arr[4];
-                let __v_501: G = __r_arr[5];
-                let __v_502: G = __r_arr[6];
-                let __v_503: G = __r_arr[7];
-                let __v_504: G = __r_arr[8];
-                let __v_505: G = __r_arr[9];
-                let __v_506: G = __r_arr[10];
-                let __v_507: G = __r_arr[11];
-                let __v_508: G = __r_arr[12];
-                let __v_509: G = __r_arr[13];
-                let __v_510: G = __r_arr[14];
-                let __v_511: G = __r_arr[15];
-                let __v_512: G = __r_arr[16];
-                let __v_513: G = __r_arr[17];
-                let __v_514: G = G::from_u64(256);
-                let __v_515: G = (__v_514 * __v_415);
-                let __v_516: G = G::from_u64(65536);
-                let __v_517: G = (__v_516 * __v_416);
-                let __v_518: G = G::from_u64(16777216);
-                let __v_519: G = (__v_518 * __v_417);
-                let __v_520: G = G::from_u64(4294967296);
-                let __v_521: G = (__v_520 * __v_418);
-                let __v_522: G = G::from_u64(1099511627776);
-                let __v_523: G = (__v_522 * __v_419);
-                let __v_524: G = G::from_u64(281474976710656);
-                let __v_525: G = (__v_524 * __v_420);
-                let __v_526: G = G::from_u64(72057594037927936);
-                let __v_527: G = (__v_526 * __v_421);
-                let __v_528: G = (__v_525 + __v_527);
-                let __v_529: G = (__v_523 + __v_528);
-                let __v_530: G = (__v_521 + __v_529);
-                let __v_531: G = (__v_519 + __v_530);
-                let __v_532: G = (__v_517 + __v_531);
-                let __v_533: G = (__v_515 + __v_532);
-                let __v_534: G = (__v_414 + __v_533);
-                let __v_535: G = G::from_u64(256);
-                let __v_536: G = (__v_535 * __v_423);
-                let __v_537: G = G::from_u64(65536);
-                let __v_538: G = (__v_537 * __v_424);
-                let __v_539: G = G::from_u64(16777216);
-                let __v_540: G = (__v_539 * __v_425);
-                let __v_541: G = G::from_u64(4294967296);
-                let __v_542: G = (__v_541 * __v_426);
-                let __v_543: G = G::from_u64(1099511627776);
-                let __v_544: G = (__v_543 * __v_427);
-                let __v_545: G = G::from_u64(281474976710656);
-                let __v_546: G = (__v_545 * __v_428);
-                let __v_547: G = G::from_u64(72057594037927936);
-                let __v_548: G = (__v_547 * __v_429);
-                let __v_549: G = (__v_546 + __v_548);
-                let __v_550: G = (__v_544 + __v_549);
-                let __v_551: G = (__v_542 + __v_550);
-                let __v_552: G = (__v_540 + __v_551);
-                let __v_553: G = (__v_538 + __v_552);
-                let __v_554: G = (__v_536 + __v_553);
-                let __v_555: G = (__v_422 + __v_554);
-                let __v_556: G = G::from_u64(256);
-                let __v_557: G = (__v_556 * __v_442);
-                let __v_558: G = G::from_u64(65536);
-                let __v_559: G = (__v_558 * __v_443);
-                let __v_560: G = G::from_u64(16777216);
-                let __v_561: G = (__v_560 * __v_444);
-                let __v_562: G = G::from_u64(4294967296);
-                let __v_563: G = (__v_562 * __v_445);
-                let __v_564: G = G::from_u64(1099511627776);
-                let __v_565: G = (__v_564 * __v_446);
-                let __v_566: G = G::from_u64(281474976710656);
-                let __v_567: G = (__v_566 * __v_447);
-                let __v_568: G = G::from_u64(72057594037927936);
-                let __v_569: G = (__v_568 * __v_448);
-                let __v_570: G = (__v_567 + __v_569);
-                let __v_571: G = (__v_565 + __v_570);
-                let __v_572: G = (__v_563 + __v_571);
-                let __v_573: G = (__v_561 + __v_572);
-                let __v_574: G = (__v_559 + __v_573);
-                let __v_575: G = (__v_557 + __v_574);
-                let __v_576: G = (__v_441 + __v_575);
-                let __v_577: G = G::from_u64(256);
-                let __v_578: G = (__v_577 * __v_450);
-                let __v_579: G = G::from_u64(65536);
-                let __v_580: G = (__v_579 * __v_451);
-                let __v_581: G = G::from_u64(16777216);
-                let __v_582: G = (__v_581 * __v_452);
-                let __v_583: G = G::from_u64(4294967296);
-                let __v_584: G = (__v_583 * __v_453);
-                let __v_585: G = G::from_u64(1099511627776);
-                let __v_586: G = (__v_585 * __v_454);
-                let __v_587: G = G::from_u64(281474976710656);
-                let __v_588: G = (__v_587 * __v_455);
-                let __v_589: G = G::from_u64(72057594037927936);
-                let __v_590: G = (__v_589 * __v_456);
-                let __v_591: G = (__v_588 + __v_590);
-                let __v_592: G = (__v_586 + __v_591);
-                let __v_593: G = (__v_584 + __v_592);
-                let __v_594: G = (__v_582 + __v_593);
-                let __v_595: G = (__v_580 + __v_594);
-                let __v_596: G = (__v_578 + __v_595);
-                let __v_597: G = (__v_449 + __v_596);
-                let __v_598: G = G::from_u64(256);
-                let __v_599: G = (__v_598 * __v_475);
-                let __v_600: G = G::from_u64(65536);
-                let __v_601: G = (__v_600 * __v_476);
-                let __v_602: G = G::from_u64(16777216);
-                let __v_603: G = (__v_602 * __v_477);
-                let __v_604: G = G::from_u64(4294967296);
-                let __v_605: G = (__v_604 * __v_478);
-                let __v_606: G = G::from_u64(1099511627776);
-                let __v_607: G = (__v_606 * __v_479);
-                let __v_608: G = G::from_u64(281474976710656);
-                let __v_609: G = (__v_608 * __v_480);
-                let __v_610: G = G::from_u64(72057594037927936);
-                let __v_611: G = (__v_610 * __v_481);
-                let __v_612: G = (__v_609 + __v_611);
-                let __v_613: G = (__v_607 + __v_612);
-                let __v_614: G = (__v_605 + __v_613);
-                let __v_615: G = (__v_603 + __v_614);
-                let __v_616: G = (__v_601 + __v_615);
-                let __v_617: G = (__v_599 + __v_616);
-                let __v_618: G = (__v_474 + __v_617);
-                let __v_619: G = G::from_u64(256);
-                let __v_620: G = (__v_619 * __v_483);
-                let __v_621: G = G::from_u64(65536);
-                let __v_622: G = (__v_621 * __v_484);
-                let __v_623: G = G::from_u64(16777216);
-                let __v_624: G = (__v_623 * __v_485);
-                let __v_625: G = G::from_u64(4294967296);
-                let __v_626: G = (__v_625 * __v_486);
-                let __v_627: G = G::from_u64(1099511627776);
-                let __v_628: G = (__v_627 * __v_487);
-                let __v_629: G = G::from_u64(281474976710656);
-                let __v_630: G = (__v_629 * __v_488);
-                let __v_631: G = G::from_u64(72057594037927936);
-                let __v_632: G = (__v_631 * __v_489);
-                let __v_633: G = (__v_630 + __v_632);
-                let __v_634: G = (__v_628 + __v_633);
-                let __v_635: G = (__v_626 + __v_634);
-                let __v_636: G = (__v_624 + __v_635);
-                let __v_637: G = (__v_622 + __v_636);
-                let __v_638: G = (__v_620 + __v_637);
-                let __v_639: G = (__v_482 + __v_638);
-                let __v_640: G = G::from_u64(256);
-                let __v_641: G = (__v_640 * __v_497);
-                let __v_642: G = G::from_u64(65536);
-                let __v_643: G = (__v_642 * __v_498);
-                let __v_644: G = G::from_u64(16777216);
-                let __v_645: G = (__v_644 * __v_499);
-                let __v_646: G = G::from_u64(4294967296);
-                let __v_647: G = (__v_646 * __v_500);
-                let __v_648: G = G::from_u64(1099511627776);
-                let __v_649: G = (__v_648 * __v_501);
-                let __v_650: G = G::from_u64(281474976710656);
-                let __v_651: G = (__v_650 * __v_502);
-                let __v_652: G = G::from_u64(72057594037927936);
-                let __v_653: G = (__v_652 * __v_503);
-                let __v_654: G = (__v_651 + __v_653);
-                let __v_655: G = (__v_649 + __v_654);
-                let __v_656: G = (__v_647 + __v_655);
-                let __v_657: G = (__v_645 + __v_656);
-                let __v_658: G = (__v_643 + __v_657);
-                let __v_659: G = (__v_641 + __v_658);
-                let __v_660: G = (__v_496 + __v_659);
-                let __v_661: G = G::from_u64(256);
-                let __v_662: G = (__v_661 * __v_505);
-                let __v_663: G = G::from_u64(65536);
-                let __v_664: G = (__v_663 * __v_506);
-                let __v_665: G = G::from_u64(16777216);
-                let __v_666: G = (__v_665 * __v_507);
-                let __v_667: G = G::from_u64(4294967296);
-                let __v_668: G = (__v_667 * __v_508);
-                let __v_669: G = G::from_u64(1099511627776);
-                let __v_670: G = (__v_669 * __v_509);
-                let __v_671: G = G::from_u64(281474976710656);
-                let __v_672: G = (__v_671 * __v_510);
-                let __v_673: G = G::from_u64(72057594037927936);
-                let __v_674: G = (__v_673 * __v_511);
-                let __v_675: G = (__v_672 + __v_674);
-                let __v_676: G = (__v_670 + __v_675);
-                let __v_677: G = (__v_668 + __v_676);
-                let __v_678: G = (__v_666 + __v_677);
-                let __v_679: G = (__v_664 + __v_678);
-                let __v_680: G = (__v_662 + __v_679);
-                let __v_681: G = (__v_504 + __v_680);
-                let __v_682: G = G::from_u64(0);
-                let __v_683: G = G::from_u64(0);
-                let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_682, __v_683, __v_358, __v_534, __v_555, __v_576, __v_597]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
-                let __v_684: G = __r_arr[0];
-                let __v_685: G = __r_arr[1];
-                let __v_686: G = G::from_u64(0);
-                let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_361, __v_362, __v_34, __v_30, __v_66, __v_68, __v_63, __v_64, __v_61, __v_686, __v_684, __v_685, __v_534, __v_555, __v_576, __v_597, __v_618, __v_639, __v_660, __v_681]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
-                let __v_687: G = __r_arr[0];
-                let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_361]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                let __v_688: G = __r_arr[0];
-                match __v_38.as_canonical_u64() {
-                  _ => {
-                    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                    let __v_689: G = __r_arr[0];
-                    let __v_690: G = G::from_u64(1);
-                    let __v_691: G = G::from_u64(1);
-                    let __v_692: G = { let __values: [G; 3] = [__v_690, __v_691, __v_691]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __mc_out___mc_3: [G; 1] = '__mc_3: { match __v_63.as_canonical_u64() {
+                        let __v_542: G = __mc_out___mc_0[0];
+                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_34, __v_350]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                        let __v_543: G = __r_arr[0];
+                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_24, __v_543]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                        let __v_544: G = __r_arr[0];
+                        let __r_arr: [G; OUT_164] = { let __args: [G; IN_164] = [__v_542, __v_544]; let __cu = unconstrained; let __hit = record.function_queries[164].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[164].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[164].bump_multiplicity(__i); } let __ret: [G; OUT_164] = unsafe { *(record.function_queries[164].output_at(__i).as_ptr() as *const [G; OUT_164]) }; __ret }, _ => aiur_fn_164(__args, record, io_buffer, __cu)? } };
+                        let __v_545: G = __r_arr[0];
+                        let __r_arr: [G; OUT_165] = { let __args: [G; IN_165] = [__v_22, __v_545]; let __cu = unconstrained; let __hit = record.function_queries[165].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[165].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[165].bump_multiplicity(__i); } let __ret: [G; OUT_165] = unsafe { *(record.function_queries[165].output_at(__i).as_ptr() as *const [G; OUT_165]) }; __ret }, _ => aiur_fn_165(__args, record, io_buffer, __cu)? } };
+                        let __v_546: G = __r_arr[0];
+                        let __r_arr: [G; OUT_174] = { let __args: [G; IN_174] = [__v_339, __v_546]; let __cu = unconstrained; let __hit = record.function_queries[174].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[174].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[174].bump_multiplicity(__i); } let __ret: [G; OUT_174] = unsafe { *(record.function_queries[174].output_at(__i).as_ptr() as *const [G; OUT_174]) }; __ret }, _ => aiur_fn_174(__args, record, io_buffer, __cu)? } };
+                        let __v_547: G = __r_arr[0];
+                        let __v_548: G = G::from_u64(109);
+                        let __v_549: G = G::from_u64(117);
+                        let __v_550: G = G::from_u64(108);
+                        let __v_551: G = G::from_u64(116);
+                        let __v_552: G = G::from_u64(105);
+                        let __v_553: G = G::from_u64(45);
+                        let __v_554: G = G::from_u64(115);
+                        let __v_555: G = G::from_u64(116);
+                        let __v_556: G = G::from_u64(97);
+                        let __v_557: G = G::from_u64(114);
+                        let __v_558: G = G::from_u64(107);
+                        let __v_559: G = G::from_u64(47);
+                        let __v_560: G = G::from_u64(118);
+                        let __v_561: G = G::from_u64(48);
+                        let __v_562: G = G::from_u64(0);
+                        let __v_563: G = { let __values: [G; 3] = [__v_562, __v_561, __v_547]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_564: G = G::from_u64(0);
+                        let __v_565: G = { let __values: [G; 3] = [__v_564, __v_560, __v_563]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_566: G = G::from_u64(0);
+                        let __v_567: G = { let __values: [G; 3] = [__v_566, __v_559, __v_565]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_568: G = G::from_u64(0);
+                        let __v_569: G = { let __values: [G; 3] = [__v_568, __v_558, __v_567]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_570: G = G::from_u64(0);
+                        let __v_571: G = { let __values: [G; 3] = [__v_570, __v_557, __v_569]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_572: G = G::from_u64(0);
+                        let __v_573: G = { let __values: [G; 3] = [__v_572, __v_556, __v_571]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_574: G = G::from_u64(0);
+                        let __v_575: G = { let __values: [G; 3] = [__v_574, __v_555, __v_573]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_576: G = G::from_u64(0);
+                        let __v_577: G = { let __values: [G; 3] = [__v_576, __v_554, __v_575]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_578: G = G::from_u64(0);
+                        let __v_579: G = { let __values: [G; 3] = [__v_578, __v_553, __v_577]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_580: G = G::from_u64(0);
+                        let __v_581: G = { let __values: [G; 3] = [__v_580, __v_552, __v_579]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_582: G = G::from_u64(0);
+                        let __v_583: G = { let __values: [G; 3] = [__v_582, __v_551, __v_581]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_584: G = G::from_u64(0);
+                        let __v_585: G = { let __values: [G; 3] = [__v_584, __v_550, __v_583]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_586: G = G::from_u64(0);
+                        let __v_587: G = { let __values: [G; 3] = [__v_586, __v_549, __v_585]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_588: G = G::from_u64(0);
+                        let __v_589: G = { let __values: [G; 3] = [__v_588, __v_548, __v_587]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __v_590: G = G::from_u64(1);
+                        let __v_591: G = G::from_u64(1);
+                        let __v_592: G = { let __values: [G; 3] = [__v_590, __v_591, __v_591]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_589, __v_592]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_593: G = __r_arr[0];
+                        let __v_594: G = __r_arr[1];
+                        let __v_595: G = __r_arr[2];
+                        let __v_596: G = __r_arr[3];
+                        let __v_597: G = __r_arr[4];
+                        let __v_598: G = __r_arr[5];
+                        let __v_599: G = __r_arr[6];
+                        let __v_600: G = __r_arr[7];
+                        let __v_601: G = __r_arr[8];
+                        let __v_602: G = __r_arr[9];
+                        let __v_603: G = __r_arr[10];
+                        let __v_604: G = __r_arr[11];
+                        let __v_605: G = __r_arr[12];
+                        let __v_606: G = __r_arr[13];
+                        let __v_607: G = __r_arr[14];
+                        let __v_608: G = __r_arr[15];
+                        let __v_609: G = __r_arr[16];
+                        let __v_610: G = __r_arr[17];
+                        let __v_611: G = G::from_u64(1);
+                        let __v_612: G = G::from_u64(1);
+                        let __v_613: G = { let __values: [G; 3] = [__v_611, __v_612, __v_612]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_601, __v_602, __v_603, __v_604, __v_605, __v_606, __v_607, __v_608, __v_613]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_614: G = __r_arr[0];
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_593, __v_594, __v_595, __v_596, __v_597, __v_598, __v_599, __v_600, __v_614]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_615: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_609, __v_615]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_616: G = __r_arr[0];
+                        let __v_617: G = G::from_u64(1);
+                        let __v_618: G = G::from_u64(1);
+                        let __v_619: G = { let __values: [G; 3] = [__v_617, __v_618, __v_618]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_616, __v_619]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_620: G = __r_arr[0];
+                        let __v_621: G = __r_arr[1];
+                        let __v_622: G = __r_arr[2];
+                        let __v_623: G = __r_arr[3];
+                        let __v_624: G = __r_arr[4];
+                        let __v_625: G = __r_arr[5];
+                        let __v_626: G = __r_arr[6];
+                        let __v_627: G = __r_arr[7];
+                        let __v_628: G = __r_arr[8];
+                        let __v_629: G = __r_arr[9];
+                        let __v_630: G = __r_arr[10];
+                        let __v_631: G = __r_arr[11];
+                        let __v_632: G = __r_arr[12];
+                        let __v_633: G = __r_arr[13];
+                        let __v_634: G = __r_arr[14];
+                        let __v_635: G = __r_arr[15];
+                        let __v_636: G = __r_arr[16];
+                        let __v_637: G = __r_arr[17];
+                        let __v_638: G = G::from_u64(1);
+                        let __v_639: G = G::from_u64(1);
+                        let __v_640: G = { let __values: [G; 3] = [__v_638, __v_639, __v_639]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_628, __v_629, __v_630, __v_631, __v_632, __v_633, __v_634, __v_635, __v_640]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_641: G = __r_arr[0];
+                        let __r_arr: [G; OUT_162] = { let __args: [G; IN_162] = [__v_620, __v_621, __v_622, __v_623, __v_624, __v_625, __v_626, __v_627, __v_641]; let __cu = unconstrained; let __hit = record.function_queries[162].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[162].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[162].bump_multiplicity(__i); } let __ret: [G; OUT_162] = unsafe { *(record.function_queries[162].output_at(__i).as_ptr() as *const [G; OUT_162]) }; __ret }, _ => aiur_fn_162(__args, record, io_buffer, __cu)? } };
+                        let __v_642: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_636, __v_642]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_643: G = __r_arr[0];
+                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_643, __v_26]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_644: G = __r_arr[0];
+                        let __v_645: G = G::from_u64(1);
+                        let __v_646: G = G::from_u64(1);
+                        let __v_647: G = { let __values: [G; 3] = [__v_645, __v_646, __v_646]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_30, __v_647]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                        let __v_648: G = __r_arr[0];
+                        let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_644, __v_648]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                        let __v_649: G = __r_arr[0];
+                        let __v_650: G = G::from_u64(1);
+                        let __v_651: G = G::from_u64(1);
+                        let __v_652: G = { let __values: [G; 3] = [__v_650, __v_651, __v_651]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_649, __v_652]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_653: G = __r_arr[0];
+                        let __v_654: G = __r_arr[1];
+                        let __v_655: G = __r_arr[2];
+                        let __v_656: G = __r_arr[3];
+                        let __v_657: G = __r_arr[4];
+                        let __v_658: G = __r_arr[5];
+                        let __v_659: G = __r_arr[6];
+                        let __v_660: G = __r_arr[7];
+                        let __v_661: G = __r_arr[8];
+                        let __v_662: G = __r_arr[9];
+                        let __v_663: G = __r_arr[10];
+                        let __v_664: G = __r_arr[11];
+                        let __v_665: G = __r_arr[12];
+                        let __v_666: G = __r_arr[13];
+                        let __v_667: G = __r_arr[14];
+                        let __v_668: G = __r_arr[15];
+                        let __v_669: G = __r_arr[16];
+                        let __v_670: G = __r_arr[17];
+                        let __r_arr: [G; OUT_172] = { let __args: [G; IN_172] = [__v_669, __v_28]; let __cu = unconstrained; let __hit = record.function_queries[172].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[172].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[172].bump_multiplicity(__i); } let __ret: [G; OUT_172] = unsafe { *(record.function_queries[172].output_at(__i).as_ptr() as *const [G; OUT_172]) }; __ret }, _ => aiur_fn_172(__args, record, io_buffer, __cu)? } };
+                        let __v_671: G = __r_arr[0];
+                        let __v_672: G = G::from_u64(1);
+                        let __v_673: G = G::from_u64(1);
+                        let __v_674: G = { let __values: [G; 3] = [__v_672, __v_673, __v_673]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                        let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_671, __v_674]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                        let __v_675: G = __r_arr[0];
+                        let __v_676: G = __r_arr[1];
+                        let __v_677: G = __r_arr[2];
+                        let __v_678: G = __r_arr[3];
+                        let __v_679: G = __r_arr[4];
+                        let __v_680: G = __r_arr[5];
+                        let __v_681: G = __r_arr[6];
+                        let __v_682: G = __r_arr[7];
+                        let __v_683: G = __r_arr[8];
+                        let __v_684: G = __r_arr[9];
+                        let __v_685: G = __r_arr[10];
+                        let __v_686: G = __r_arr[11];
+                        let __v_687: G = __r_arr[12];
+                        let __v_688: G = __r_arr[13];
+                        let __v_689: G = __r_arr[14];
+                        let __v_690: G = __r_arr[15];
+                        let __v_691: G = __r_arr[16];
+                        let __v_692: G = __r_arr[17];
+                        let __v_693: G = G::from_u64(256);
+                        let __v_694: G = (__v_693 * __v_594);
+                        let __v_695: G = G::from_u64(65536);
+                        let __v_696: G = (__v_695 * __v_595);
+                        let __v_697: G = G::from_u64(16777216);
+                        let __v_698: G = (__v_697 * __v_596);
+                        let __v_699: G = G::from_u64(4294967296);
+                        let __v_700: G = (__v_699 * __v_597);
+                        let __v_701: G = G::from_u64(1099511627776);
+                        let __v_702: G = (__v_701 * __v_598);
+                        let __v_703: G = G::from_u64(281474976710656);
+                        let __v_704: G = (__v_703 * __v_599);
+                        let __v_705: G = G::from_u64(72057594037927936);
+                        let __v_706: G = (__v_705 * __v_600);
+                        let __v_707: G = (__v_704 + __v_706);
+                        let __v_708: G = (__v_702 + __v_707);
+                        let __v_709: G = (__v_700 + __v_708);
+                        let __v_710: G = (__v_698 + __v_709);
+                        let __v_711: G = (__v_696 + __v_710);
+                        let __v_712: G = (__v_694 + __v_711);
+                        let __v_713: G = (__v_593 + __v_712);
+                        let __v_714: G = G::from_u64(256);
+                        let __v_715: G = (__v_714 * __v_602);
+                        let __v_716: G = G::from_u64(65536);
+                        let __v_717: G = (__v_716 * __v_603);
+                        let __v_718: G = G::from_u64(16777216);
+                        let __v_719: G = (__v_718 * __v_604);
+                        let __v_720: G = G::from_u64(4294967296);
+                        let __v_721: G = (__v_720 * __v_605);
+                        let __v_722: G = G::from_u64(1099511627776);
+                        let __v_723: G = (__v_722 * __v_606);
+                        let __v_724: G = G::from_u64(281474976710656);
+                        let __v_725: G = (__v_724 * __v_607);
+                        let __v_726: G = G::from_u64(72057594037927936);
+                        let __v_727: G = (__v_726 * __v_608);
+                        let __v_728: G = (__v_725 + __v_727);
+                        let __v_729: G = (__v_723 + __v_728);
+                        let __v_730: G = (__v_721 + __v_729);
+                        let __v_731: G = (__v_719 + __v_730);
+                        let __v_732: G = (__v_717 + __v_731);
+                        let __v_733: G = (__v_715 + __v_732);
+                        let __v_734: G = (__v_601 + __v_733);
+                        let __v_735: G = G::from_u64(256);
+                        let __v_736: G = (__v_735 * __v_621);
+                        let __v_737: G = G::from_u64(65536);
+                        let __v_738: G = (__v_737 * __v_622);
+                        let __v_739: G = G::from_u64(16777216);
+                        let __v_740: G = (__v_739 * __v_623);
+                        let __v_741: G = G::from_u64(4294967296);
+                        let __v_742: G = (__v_741 * __v_624);
+                        let __v_743: G = G::from_u64(1099511627776);
+                        let __v_744: G = (__v_743 * __v_625);
+                        let __v_745: G = G::from_u64(281474976710656);
+                        let __v_746: G = (__v_745 * __v_626);
+                        let __v_747: G = G::from_u64(72057594037927936);
+                        let __v_748: G = (__v_747 * __v_627);
+                        let __v_749: G = (__v_746 + __v_748);
+                        let __v_750: G = (__v_744 + __v_749);
+                        let __v_751: G = (__v_742 + __v_750);
+                        let __v_752: G = (__v_740 + __v_751);
+                        let __v_753: G = (__v_738 + __v_752);
+                        let __v_754: G = (__v_736 + __v_753);
+                        let __v_755: G = (__v_620 + __v_754);
+                        let __v_756: G = G::from_u64(256);
+                        let __v_757: G = (__v_756 * __v_629);
+                        let __v_758: G = G::from_u64(65536);
+                        let __v_759: G = (__v_758 * __v_630);
+                        let __v_760: G = G::from_u64(16777216);
+                        let __v_761: G = (__v_760 * __v_631);
+                        let __v_762: G = G::from_u64(4294967296);
+                        let __v_763: G = (__v_762 * __v_632);
+                        let __v_764: G = G::from_u64(1099511627776);
+                        let __v_765: G = (__v_764 * __v_633);
+                        let __v_766: G = G::from_u64(281474976710656);
+                        let __v_767: G = (__v_766 * __v_634);
+                        let __v_768: G = G::from_u64(72057594037927936);
+                        let __v_769: G = (__v_768 * __v_635);
+                        let __v_770: G = (__v_767 + __v_769);
+                        let __v_771: G = (__v_765 + __v_770);
+                        let __v_772: G = (__v_763 + __v_771);
+                        let __v_773: G = (__v_761 + __v_772);
+                        let __v_774: G = (__v_759 + __v_773);
+                        let __v_775: G = (__v_757 + __v_774);
+                        let __v_776: G = (__v_628 + __v_775);
+                        let __v_777: G = G::from_u64(256);
+                        let __v_778: G = (__v_777 * __v_654);
+                        let __v_779: G = G::from_u64(65536);
+                        let __v_780: G = (__v_779 * __v_655);
+                        let __v_781: G = G::from_u64(16777216);
+                        let __v_782: G = (__v_781 * __v_656);
+                        let __v_783: G = G::from_u64(4294967296);
+                        let __v_784: G = (__v_783 * __v_657);
+                        let __v_785: G = G::from_u64(1099511627776);
+                        let __v_786: G = (__v_785 * __v_658);
+                        let __v_787: G = G::from_u64(281474976710656);
+                        let __v_788: G = (__v_787 * __v_659);
+                        let __v_789: G = G::from_u64(72057594037927936);
+                        let __v_790: G = (__v_789 * __v_660);
+                        let __v_791: G = (__v_788 + __v_790);
+                        let __v_792: G = (__v_786 + __v_791);
+                        let __v_793: G = (__v_784 + __v_792);
+                        let __v_794: G = (__v_782 + __v_793);
+                        let __v_795: G = (__v_780 + __v_794);
+                        let __v_796: G = (__v_778 + __v_795);
+                        let __v_797: G = (__v_653 + __v_796);
+                        let __v_798: G = G::from_u64(256);
+                        let __v_799: G = (__v_798 * __v_662);
+                        let __v_800: G = G::from_u64(65536);
+                        let __v_801: G = (__v_800 * __v_663);
+                        let __v_802: G = G::from_u64(16777216);
+                        let __v_803: G = (__v_802 * __v_664);
+                        let __v_804: G = G::from_u64(4294967296);
+                        let __v_805: G = (__v_804 * __v_665);
+                        let __v_806: G = G::from_u64(1099511627776);
+                        let __v_807: G = (__v_806 * __v_666);
+                        let __v_808: G = G::from_u64(281474976710656);
+                        let __v_809: G = (__v_808 * __v_667);
+                        let __v_810: G = G::from_u64(72057594037927936);
+                        let __v_811: G = (__v_810 * __v_668);
+                        let __v_812: G = (__v_809 + __v_811);
+                        let __v_813: G = (__v_807 + __v_812);
+                        let __v_814: G = (__v_805 + __v_813);
+                        let __v_815: G = (__v_803 + __v_814);
+                        let __v_816: G = (__v_801 + __v_815);
+                        let __v_817: G = (__v_799 + __v_816);
+                        let __v_818: G = (__v_661 + __v_817);
+                        let __v_819: G = G::from_u64(256);
+                        let __v_820: G = (__v_819 * __v_676);
+                        let __v_821: G = G::from_u64(65536);
+                        let __v_822: G = (__v_821 * __v_677);
+                        let __v_823: G = G::from_u64(16777216);
+                        let __v_824: G = (__v_823 * __v_678);
+                        let __v_825: G = G::from_u64(4294967296);
+                        let __v_826: G = (__v_825 * __v_679);
+                        let __v_827: G = G::from_u64(1099511627776);
+                        let __v_828: G = (__v_827 * __v_680);
+                        let __v_829: G = G::from_u64(281474976710656);
+                        let __v_830: G = (__v_829 * __v_681);
+                        let __v_831: G = G::from_u64(72057594037927936);
+                        let __v_832: G = (__v_831 * __v_682);
+                        let __v_833: G = (__v_830 + __v_832);
+                        let __v_834: G = (__v_828 + __v_833);
+                        let __v_835: G = (__v_826 + __v_834);
+                        let __v_836: G = (__v_824 + __v_835);
+                        let __v_837: G = (__v_822 + __v_836);
+                        let __v_838: G = (__v_820 + __v_837);
+                        let __v_839: G = (__v_675 + __v_838);
+                        let __v_840: G = G::from_u64(256);
+                        let __v_841: G = (__v_840 * __v_684);
+                        let __v_842: G = G::from_u64(65536);
+                        let __v_843: G = (__v_842 * __v_685);
+                        let __v_844: G = G::from_u64(16777216);
+                        let __v_845: G = (__v_844 * __v_686);
+                        let __v_846: G = G::from_u64(4294967296);
+                        let __v_847: G = (__v_846 * __v_687);
+                        let __v_848: G = G::from_u64(1099511627776);
+                        let __v_849: G = (__v_848 * __v_688);
+                        let __v_850: G = G::from_u64(281474976710656);
+                        let __v_851: G = (__v_850 * __v_689);
+                        let __v_852: G = G::from_u64(72057594037927936);
+                        let __v_853: G = (__v_852 * __v_690);
+                        let __v_854: G = (__v_851 + __v_853);
+                        let __v_855: G = (__v_849 + __v_854);
+                        let __v_856: G = (__v_847 + __v_855);
+                        let __v_857: G = (__v_845 + __v_856);
+                        let __v_858: G = (__v_843 + __v_857);
+                        let __v_859: G = (__v_841 + __v_858);
+                        let __v_860: G = (__v_683 + __v_859);
+                        let __v_861: G = G::from_u64(0);
+                        let __v_862: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_198] = { let __args: [G; IN_198] = [__v_861, __v_862, __v_508, __v_713, __v_734, __v_755, __v_776]; let __cu = unconstrained; let __hit = record.function_queries[198].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[198].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[198].bump_multiplicity(__i); } let __ret: [G; OUT_198] = unsafe { *(record.function_queries[198].output_at(__i).as_ptr() as *const [G; OUT_198]) }; __ret }, _ => aiur_fn_198(__args, record, io_buffer, __cu)? } };
+                        let __v_863: G = __r_arr[0];
+                        let __v_864: G = __r_arr[1];
+                        let __v_865: G = G::from_u64(0);
+                        let __r_arr: [G; OUT_196] = { let __args: [G; IN_196] = [__v_535, __v_536, __v_34, __v_30, __v_66, __v_68, __v_63, __v_64, __v_61, __v_865, __v_863, __v_864, __v_713, __v_734, __v_755, __v_776, __v_797, __v_818, __v_839, __v_860]; let __cu = unconstrained; let __hit = record.function_queries[196].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[196].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[196].bump_multiplicity(__i); } let __ret: [G; OUT_196] = unsafe { *(record.function_queries[196].output_at(__i).as_ptr() as *const [G; OUT_196]) }; __ret }, _ => aiur_fn_196(__args, record, io_buffer, __cu)? } };
+                        let __v_866: G = __r_arr[0];
+                        let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_535]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
+                        let __v_867: G = __r_arr[0];
+                        match __v_38.as_canonical_u64() {
+                          _ => {
+                            let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_38]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
+                            let __v_868: G = __r_arr[0];
+                            let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
+                            let __v_869: G = __r_arr[0];
+                            let __v_870: G = (__v_869 - __v_868);
+                            let __v_871: G = G::from_bool((__v_870 == G::ZERO));
+                            let __v_872: G = G::from_u64(1);
+                            if (__v_871 != __v_872) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_871.as_canonical_u64(), rhs: __v_872.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_44]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                            let __v_873: G = __r_arr[0];
+                            let __v_874: G = G::from_u64(3);
+                            let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_63, __v_64]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
+                            let __v_875: G = __r_arr[0];
+                            let __v_876: G = (__v_874 + __v_875);
+                            if (__v_873 != __v_876) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_873.as_canonical_u64(), rhs: __v_876.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
+                            let __v_877: G = __r_arr[0];
+                            let __v_878: G = (__v_877 - __v_868);
+                            let __v_879: G = G::from_bool((__v_878 == G::ZERO));
+                            let __v_880: G = G::from_u64(1);
+                            if (__v_879 != __v_880) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_879.as_canonical_u64(), rhs: __v_880.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_50]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
+                            let __v_881: G = __r_arr[0];
+                            let __v_882: G = G::from_u64(1);
+                            if (__v_881 != __v_882) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_881.as_canonical_u64(), rhs: __v_882.as_canonical_u64(), msg: None });
+                            }
+                            let __v_883: G = G::from_u64(1);
+                            let __v_884: G = G::from_u64(1);
+                            let __v_885: G = { let __values: [G; 3] = [__v_883, __v_884, __v_884]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __mc_out___mc_1: [G; 1] = '__mc_1: { match __v_63.as_canonical_u64() {
   0u64 => {
-    break '__mc_3 [__v_692];
+    break '__mc_1 [__v_885];
   },
   1u64 => {
-    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_64, __v_692]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-    let __v_693: G = __r_arr[0];
-    break '__mc_3 [__v_693];
+    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_64, __v_885]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+    let __v_886: G = __r_arr[0];
+    break '__mc_1 [__v_886];
   },
   _ => {
     return Err(ExecError::MatchNoCase(__v_63.as_canonical_u64()));
   },
 }
  };
-                    let __v_693: G = __mc_out___mc_3[0];
-                    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_61, __v_693]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                    let __v_694: G = __r_arr[0];
-                    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_68, __v_694]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                    let __v_695: G = __r_arr[0];
-                    let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_66, __v_695]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
-                    let __v_696: G = __r_arr[0];
-                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_512, __v_696]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                    let __v_697: G = __r_arr[0];
-                    let __v_698: G = G::from_u64(1);
-                    let __v_699: G = G::from_u64(1);
-                    let __v_700: G = { let __values: [G; 3] = [__v_698, __v_699, __v_699]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_697, __v_700]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
-                    let __v_701: G = __r_arr[0];
-                    let __v_702: G = __r_arr[1];
-                    let __v_703: G = __r_arr[2];
-                    let __v_704: G = __r_arr[3];
-                    let __v_705: G = __r_arr[4];
-                    let __v_706: G = __r_arr[5];
-                    let __v_707: G = __r_arr[6];
-                    let __v_708: G = __r_arr[7];
-                    let __v_709: G = __r_arr[8];
-                    let __v_710: G = __r_arr[9];
-                    let __v_711: G = __r_arr[10];
-                    let __v_712: G = __r_arr[11];
-                    let __v_713: G = __r_arr[12];
-                    let __v_714: G = __r_arr[13];
-                    let __v_715: G = __r_arr[14];
-                    let __v_716: G = __r_arr[15];
-                    let __v_717: G = __r_arr[16];
-                    let __v_718: G = __r_arr[17];
-                    let __v_719: G = G::from_u64(256);
-                    let __v_720: G = (__v_719 * __v_702);
-                    let __v_721: G = G::from_u64(65536);
-                    let __v_722: G = (__v_721 * __v_703);
-                    let __v_723: G = G::from_u64(16777216);
-                    let __v_724: G = (__v_723 * __v_704);
-                    let __v_725: G = G::from_u64(4294967296);
-                    let __v_726: G = (__v_725 * __v_705);
-                    let __v_727: G = G::from_u64(1099511627776);
-                    let __v_728: G = (__v_727 * __v_706);
-                    let __v_729: G = G::from_u64(281474976710656);
-                    let __v_730: G = (__v_729 * __v_707);
-                    let __v_731: G = G::from_u64(72057594037927936);
-                    let __v_732: G = (__v_731 * __v_708);
-                    let __v_733: G = (__v_730 + __v_732);
-                    let __v_734: G = (__v_728 + __v_733);
-                    let __v_735: G = (__v_726 + __v_734);
-                    let __v_736: G = (__v_724 + __v_735);
-                    let __v_737: G = (__v_722 + __v_736);
-                    let __v_738: G = (__v_720 + __v_737);
-                    let __v_739: G = (__v_701 + __v_738);
-                    let __v_740: G = G::from_u64(256);
-                    let __v_741: G = (__v_740 * __v_710);
-                    let __v_742: G = G::from_u64(65536);
-                    let __v_743: G = (__v_742 * __v_711);
-                    let __v_744: G = G::from_u64(16777216);
-                    let __v_745: G = (__v_744 * __v_712);
-                    let __v_746: G = G::from_u64(4294967296);
-                    let __v_747: G = (__v_746 * __v_713);
-                    let __v_748: G = G::from_u64(1099511627776);
-                    let __v_749: G = (__v_748 * __v_714);
-                    let __v_750: G = G::from_u64(281474976710656);
-                    let __v_751: G = (__v_750 * __v_715);
-                    let __v_752: G = G::from_u64(72057594037927936);
-                    let __v_753: G = (__v_752 * __v_716);
-                    let __v_754: G = (__v_751 + __v_753);
-                    let __v_755: G = (__v_749 + __v_754);
-                    let __v_756: G = (__v_747 + __v_755);
-                    let __v_757: G = (__v_745 + __v_756);
-                    let __v_758: G = (__v_743 + __v_757);
-                    let __v_759: G = (__v_741 + __v_758);
-                    let __v_760: G = (__v_709 + __v_759);
-                    let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_717, __v_38, __v_40, __v_209]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
-                    let __v_761: G = __r_arr[0];
-                    let __v_762: G = __r_arr[1];
-                    let __v_763: G = G::from_u64(1);
-                    let __v_764: G = G::from_u64(1);
-                    let __v_765: G = { let __values: [G; 3] = [__v_763, __v_764, __v_764]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
-                    let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_50, __v_765]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
-                    let __v_766: G = __r_arr[0];
-                    let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_762, __v_766]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-                    let __v_767: G = __r_arr[0];
-                    let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_767, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
-                    let __v_768: G = __r_arr[0];
-                    let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_768, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_219]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
-                    let __v_769: G = __r_arr[0];
-                    let __v_770: G = __r_arr[1];
-                    let __v_771: G = (__v_689 + __v_159);
-                    let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_769, __v_770, __v_199, __v_771]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
-                    let __v_772: G = __r_arr[0];
-                    let __v_773: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_44, __v_48, __v_773, __v_199]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
-                    let __v_774: G = __r_arr[0];
-                    let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_769, __v_770, __v_774, __v_739, __v_760, __v_66, __v_68, __v_61, __v_63, __v_64, __v_24, __v_26, __v_28, __v_363, __v_362, __v_34, __v_660, __v_681, __v_688, __v_159, __v_771, __v_761, __v_38, __v_50, __v_689]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
-                    let __v_775: G = __r_arr[0];
-                    let __v_776: G = G::from_u64(0);
-                    if (__v_169 != __v_776) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_169.as_canonical_u64(), rhs: __v_776.as_canonical_u64(), msg: None });
-                    }
-                    let __v_777: G = G::from_u64(0);
-                    if (__v_179 != __v_777) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_179.as_canonical_u64(), rhs: __v_777.as_canonical_u64(), msg: None });
-                    }
-                    let __v_778: G = G::from_u64(1);
-                    if (__v_189 != __v_778) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_189.as_canonical_u64(), rhs: __v_778.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_200] = { let __args: [G; IN_200] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[200].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[200].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[200].bump_multiplicity(__i); } let __ret: [G; OUT_200] = unsafe { *(record.function_queries[200].output_at(__i).as_ptr() as *const [G; OUT_200]) }; __ret }, _ => aiur_fn_200(__args, record, io_buffer, __cu)? } };
-                    let __v_779: G = __r_arr[0];
-                    let __v_780: G = G::from_u64(1);
-                    if (__v_779 != __v_780) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_779.as_canonical_u64(), rhs: __v_780.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_244] = { let __args: [G; IN_244] = [__v_22]; let __cu = unconstrained; let __hit = record.function_queries[244].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[244].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[244].bump_multiplicity(__i); } let __ret: [G; OUT_244] = unsafe { *(record.function_queries[244].output_at(__i).as_ptr() as *const [G; OUT_244]) }; __ret }, _ => aiur_fn_244(__args, record, io_buffer, __cu)? } };
-                    let __v_781: G = __r_arr[0];
-                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_256]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                    let __v_782: G = __r_arr[0];
-                    let __v_783: G = (__v_781 - __v_782);
-                    let __v_784: G = G::from_bool((__v_783 == G::ZERO));
-                    let __v_785: G = G::from_u64(1);
-                    if (__v_784 != __v_785) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_784.as_canonical_u64(), rhs: __v_785.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_256] = { let __args: [G; IN_256] = [__v_361]; let __cu = unconstrained; let __hit = record.function_queries[256].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[256].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[256].bump_multiplicity(__i); } let __ret: [G; OUT_256] = unsafe { *(record.function_queries[256].output_at(__i).as_ptr() as *const [G; OUT_256]) }; __ret }, _ => aiur_fn_256(__args, record, io_buffer, __cu)? } };
-                    let __v_786: G = __r_arr[0];
-                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_30]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                    let __v_787: G = __r_arr[0];
-                    let __v_788: G = (__v_786 - __v_787);
-                    let __v_789: G = G::from_bool((__v_788 == G::ZERO));
-                    let __v_790: G = G::from_u64(1);
-                    if (__v_789 != __v_790) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_789.as_canonical_u64(), rhs: __v_790.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_249] = { let __args: [G; IN_249] = [__v_40]; let __cu = unconstrained; let __hit = record.function_queries[249].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[249].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[249].bump_multiplicity(__i); } let __ret: [G; OUT_249] = unsafe { *(record.function_queries[249].output_at(__i).as_ptr() as *const [G; OUT_249]) }; __ret }, _ => aiur_fn_249(__args, record, io_buffer, __cu)? } };
-                    let __v_791: G = __r_arr[0];
-                    let __v_792: G = (__v_791 - __v_689);
-                    let __v_793: G = G::from_bool((__v_792 == G::ZERO));
-                    let __v_794: G = G::from_u64(1);
-                    if (__v_793 != __v_794) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_793.as_canonical_u64(), rhs: __v_794.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_44]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                    let __v_795: G = __r_arr[0];
-                    let __v_796: G = G::from_u64(3);
-                    let __r_arr: [G; OUT_135] = { let __args: [G; IN_135] = [__v_63, __v_64]; let __cu = unconstrained; let __hit = record.function_queries[135].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[135].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[135].bump_multiplicity(__i); } let __ret: [G; OUT_135] = unsafe { *(record.function_queries[135].output_at(__i).as_ptr() as *const [G; OUT_135]) }; __ret }, _ => aiur_fn_135(__args, record, io_buffer, __cu)? } };
-                    let __v_797: G = __r_arr[0];
-                    let __v_798: G = (__v_796 + __v_797);
-                    if (__v_795 != __v_798) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_795.as_canonical_u64(), rhs: __v_798.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_254] = { let __args: [G; IN_254] = [__v_48]; let __cu = unconstrained; let __hit = record.function_queries[254].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[254].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[254].bump_multiplicity(__i); } let __ret: [G; OUT_254] = unsafe { *(record.function_queries[254].output_at(__i).as_ptr() as *const [G; OUT_254]) }; __ret }, _ => aiur_fn_254(__args, record, io_buffer, __cu)? } };
-                    let __v_799: G = __r_arr[0];
-                    let __v_800: G = (__v_799 - __v_689);
-                    let __v_801: G = G::from_bool((__v_800 == G::ZERO));
-                    let __v_802: G = G::from_u64(1);
-                    if (__v_801 != __v_802) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_801.as_canonical_u64(), rhs: __v_802.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_245] = { let __args: [G; IN_245] = [__v_50]; let __cu = unconstrained; let __hit = record.function_queries[245].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[245].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[245].bump_multiplicity(__i); } let __ret: [G; OUT_245] = unsafe { *(record.function_queries[245].output_at(__i).as_ptr() as *const [G; OUT_245]) }; __ret }, _ => aiur_fn_245(__args, record, io_buffer, __cu)? } };
-                    let __v_803: G = __r_arr[0];
-                    let __v_804: G = G::from_u64(1);
-                    if (__v_803 != __v_804) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_803.as_canonical_u64(), rhs: __v_804.as_canonical_u64(), msg: None });
-                    }
-                    let __v_805: G = G::from_u64(33);
-                    let __v_806: G = { let __a_val = __v_771.as_canonical_u64(); let __b_val = __v_805.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
-                    let __v_807: G = G::from_u64(1);
-                    if (__v_806 != __v_807) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_806.as_canonical_u64(), rhs: __v_807.as_canonical_u64(), msg: None });
-                    }
-                    let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_44, __v_772, __v_24, __v_26, __v_28, __v_363, __v_63, __v_64, __v_362, __v_34, __v_688, __v_159, __v_771]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
-                    let __v_808: G = __r_arr[0];
-                    let __v_809: G = G::from_u64(1);
-                    if (__v_808 != __v_809) {
-                      return Err(ExecError::AssertEqMismatch { lhs: __v_808.as_canonical_u64(), rhs: __v_809.as_canonical_u64(), msg: None });
+                            let __v_886: G = __mc_out___mc_1[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_61, __v_886]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_887: G = __r_arr[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_68, __v_887]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_888: G = __r_arr[0];
+                            let __r_arr: [G; OUT_126] = { let __args: [G; IN_126] = [__v_66, __v_888]; let __cu = unconstrained; let __hit = record.function_queries[126].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[126].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[126].bump_multiplicity(__i); } let __ret: [G; OUT_126] = unsafe { *(record.function_queries[126].output_at(__i).as_ptr() as *const [G; OUT_126]) }; __ret }, _ => aiur_fn_126(__args, record, io_buffer, __cu)? } };
+                            let __v_889: G = __r_arr[0];
+                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_691, __v_889]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_890: G = __r_arr[0];
+                            let __v_891: G = G::from_u64(1);
+                            let __v_892: G = G::from_u64(1);
+                            let __v_893: G = { let __values: [G; 3] = [__v_891, __v_892, __v_892]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __r_arr: [G; OUT_168] = { let __args: [G; IN_168] = [__v_890, __v_893]; let __cu = unconstrained; let __hit = record.function_queries[168].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[168].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[168].bump_multiplicity(__i); } let __ret: [G; OUT_168] = unsafe { *(record.function_queries[168].output_at(__i).as_ptr() as *const [G; OUT_168]) }; __ret }, _ => aiur_fn_168(__args, record, io_buffer, __cu)? } };
+                            let __v_894: G = __r_arr[0];
+                            let __v_895: G = __r_arr[1];
+                            let __v_896: G = __r_arr[2];
+                            let __v_897: G = __r_arr[3];
+                            let __v_898: G = __r_arr[4];
+                            let __v_899: G = __r_arr[5];
+                            let __v_900: G = __r_arr[6];
+                            let __v_901: G = __r_arr[7];
+                            let __v_902: G = __r_arr[8];
+                            let __v_903: G = __r_arr[9];
+                            let __v_904: G = __r_arr[10];
+                            let __v_905: G = __r_arr[11];
+                            let __v_906: G = __r_arr[12];
+                            let __v_907: G = __r_arr[13];
+                            let __v_908: G = __r_arr[14];
+                            let __v_909: G = __r_arr[15];
+                            let __v_910: G = __r_arr[16];
+                            let __v_911: G = __r_arr[17];
+                            let __v_912: G = G::from_u64(256);
+                            let __v_913: G = (__v_912 * __v_895);
+                            let __v_914: G = G::from_u64(65536);
+                            let __v_915: G = (__v_914 * __v_896);
+                            let __v_916: G = G::from_u64(16777216);
+                            let __v_917: G = (__v_916 * __v_897);
+                            let __v_918: G = G::from_u64(4294967296);
+                            let __v_919: G = (__v_918 * __v_898);
+                            let __v_920: G = G::from_u64(1099511627776);
+                            let __v_921: G = (__v_920 * __v_899);
+                            let __v_922: G = G::from_u64(281474976710656);
+                            let __v_923: G = (__v_922 * __v_900);
+                            let __v_924: G = G::from_u64(72057594037927936);
+                            let __v_925: G = (__v_924 * __v_901);
+                            let __v_926: G = (__v_923 + __v_925);
+                            let __v_927: G = (__v_921 + __v_926);
+                            let __v_928: G = (__v_919 + __v_927);
+                            let __v_929: G = (__v_917 + __v_928);
+                            let __v_930: G = (__v_915 + __v_929);
+                            let __v_931: G = (__v_913 + __v_930);
+                            let __v_932: G = (__v_894 + __v_931);
+                            let __v_933: G = G::from_u64(256);
+                            let __v_934: G = (__v_933 * __v_903);
+                            let __v_935: G = G::from_u64(65536);
+                            let __v_936: G = (__v_935 * __v_904);
+                            let __v_937: G = G::from_u64(16777216);
+                            let __v_938: G = (__v_937 * __v_905);
+                            let __v_939: G = G::from_u64(4294967296);
+                            let __v_940: G = (__v_939 * __v_906);
+                            let __v_941: G = G::from_u64(1099511627776);
+                            let __v_942: G = (__v_941 * __v_907);
+                            let __v_943: G = G::from_u64(281474976710656);
+                            let __v_944: G = (__v_943 * __v_908);
+                            let __v_945: G = G::from_u64(72057594037927936);
+                            let __v_946: G = (__v_945 * __v_909);
+                            let __v_947: G = (__v_944 + __v_946);
+                            let __v_948: G = (__v_942 + __v_947);
+                            let __v_949: G = (__v_940 + __v_948);
+                            let __v_950: G = (__v_938 + __v_949);
+                            let __v_951: G = (__v_936 + __v_950);
+                            let __v_952: G = (__v_934 + __v_951);
+                            let __v_953: G = (__v_902 + __v_952);
+                            let __r_arr: [G; OUT_130] = { let __args: [G; IN_130] = [__v_910, __v_38, __v_40, __v_282]; let __cu = unconstrained; let __hit = record.function_queries[130].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[130].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[130].bump_multiplicity(__i); } let __ret: [G; OUT_130] = unsafe { *(record.function_queries[130].output_at(__i).as_ptr() as *const [G; OUT_130]) }; __ret }, _ => aiur_fn_130(__args, record, io_buffer, __cu)? } };
+                            let __v_954: G = __r_arr[0];
+                            let __v_955: G = __r_arr[1];
+                            let __v_956: G = G::from_u64(1);
+                            let __v_957: G = G::from_u64(1);
+                            let __v_958: G = { let __values: [G; 3] = [__v_956, __v_957, __v_957]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+                            let __r_arr: [G; OUT_124] = { let __args: [G; IN_124] = [__v_50, __v_958]; let __cu = unconstrained; let __hit = record.function_queries[124].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[124].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[124].bump_multiplicity(__i); } let __ret: [G; OUT_124] = unsafe { *(record.function_queries[124].output_at(__i).as_ptr() as *const [G; OUT_124]) }; __ret }, _ => aiur_fn_124(__args, record, io_buffer, __cu)? } };
+                            let __v_959: G = __r_arr[0];
+                            let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_955, __v_959]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
+                            let __v_960: G = __r_arr[0];
+                            let __r_arr: [G; OUT_128] = { let __args: [G; IN_128] = [__v_960, __v_38]; let __cu = unconstrained; let __hit = record.function_queries[128].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[128].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[128].bump_multiplicity(__i); } let __ret: [G; OUT_128] = unsafe { *(record.function_queries[128].output_at(__i).as_ptr() as *const [G; OUT_128]) }; __ret }, _ => aiur_fn_128(__args, record, io_buffer, __cu)? } };
+                            let __v_961: G = __r_arr[0];
+                            let __r_arr: [G; OUT_129] = { let __args: [G; IN_129] = [__v_961, __v_52, __v_53, __v_54, __v_55, __v_56, __v_57, __v_58, __v_59, __v_292]; let __cu = unconstrained; let __hit = record.function_queries[129].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[129].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[129].bump_multiplicity(__i); } let __ret: [G; OUT_129] = unsafe { *(record.function_queries[129].output_at(__i).as_ptr() as *const [G; OUT_129]) }; __ret }, _ => aiur_fn_129(__args, record, io_buffer, __cu)? } };
+                            let __v_962: G = __r_arr[0];
+                            let __v_963: G = __r_arr[1];
+                            let __v_964: G = (__v_868 + __v_232);
+                            let __v_965: G = G::from_u64(33);
+                            let __v_966: G = { let __a_val = __v_964.as_canonical_u64(); let __b_val = __v_965.as_canonical_u64(); let __a_u32 = u32::try_from(__a_val).ok().ok_or(ExecError::U32OutOfRange(__a_val))?; let __b_u32 = u32::try_from(__b_val).ok().ok_or(ExecError::U32OutOfRange(__b_val))?; let __result = G::from_bool(__a_u32 < __b_u32); if !unconstrained { let __x_bytes = __a_u32.to_le_bytes(); let __z_bytes = __b_u32.to_le_bytes(); let __c_u32 = __b_u32.wrapping_sub(__a_u32).wrapping_sub(1); let __y_bytes = __c_u32.to_le_bytes(); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[0]), &G::from_u8(__x_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__x_bytes[2]), &G::from_u8(__x_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[0]), &G::from_u8(__y_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__y_bytes[2]), &G::from_u8(__y_bytes[3])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[0]), &G::from_u8(__z_bytes[1])); record.bytes2_queries.bump_range_check(&G::from_u8(__z_bytes[2]), &G::from_u8(__z_bytes[3])); } __result };
+                            let __v_967: G = G::from_u64(1);
+                            if (__v_966 != __v_967) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_966.as_canonical_u64(), rhs: __v_967.as_canonical_u64(), msg: None });
+                            }
+                            let __r_arr: [G; OUT_151] = { let __args: [G; IN_151] = [__v_962, __v_963, __v_272, __v_964]; let __cu = unconstrained; let __hit = record.function_queries[151].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[151].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[151].bump_multiplicity(__i); } let __ret: [G; OUT_151] = unsafe { *(record.function_queries[151].output_at(__i).as_ptr() as *const [G; OUT_151]) }; __ret }, _ => aiur_fn_151(__args, record, io_buffer, __cu)? } };
+                            let __v_968: G = __r_arr[0];
+                            let __r_arr: [G; OUT_155] = { let __args: [G; IN_155] = [__v_44, __v_968, __v_24, __v_26, __v_28, __v_542, __v_63, __v_64, __v_536, __v_34, __v_867, __v_232, __v_964]; let __cu = unconstrained; let __hit = record.function_queries[155].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[155].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[155].bump_multiplicity(__i); } let __ret: [G; OUT_155] = unsafe { *(record.function_queries[155].output_at(__i).as_ptr() as *const [G; OUT_155]) }; __ret }, _ => aiur_fn_155(__args, record, io_buffer, __cu)? } };
+                            let __v_969: G = __r_arr[0];
+                            let __v_970: G = G::from_u64(1);
+                            if (__v_969 != __v_970) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_969.as_canonical_u64(), rhs: __v_970.as_canonical_u64(), msg: None });
+                            }
+                            let __v_971: G = G::from_u64(0);
+                            let __r_arr: [G; OUT_154] = { let __args: [G; IN_154] = [__v_44, __v_48, __v_971, __v_272]; let __cu = unconstrained; let __hit = record.function_queries[154].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[154].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[154].bump_multiplicity(__i); } let __ret: [G; OUT_154] = unsafe { *(record.function_queries[154].output_at(__i).as_ptr() as *const [G; OUT_154]) }; __ret }, _ => aiur_fn_154(__args, record, io_buffer, __cu)? } };
+                            let __v_972: G = __r_arr[0];
+                            let __r_arr: [G; OUT_150] = { let __args: [G; IN_150] = [__v_962, __v_963, __v_972, __v_932, __v_953, __v_66, __v_68, __v_61, __v_63, __v_64, __v_24, __v_26, __v_28, __v_542, __v_536, __v_34, __v_839, __v_860, __v_867, __v_232, __v_964, __v_954, __v_38, __v_50, __v_868]; let __cu = unconstrained; let __hit = record.function_queries[150].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[150].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[150].bump_multiplicity(__i); } let __ret: [G; OUT_150] = unsafe { *(record.function_queries[150].output_at(__i).as_ptr() as *const [G; OUT_150]) }; __ret }, _ => aiur_fn_150(__args, record, io_buffer, __cu)? } };
+                            let __v_973: G = __r_arr[0];
+                            let __v_974: G = G::from_u64(0);
+                            let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_48, __v_38, __v_973, __v_968, __v_974, __v_964]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
+                            let __v_975: G = __r_arr[0];
+                            let __v_976: G = G::from_u64(1);
+                            if (__v_975 != __v_976) {
+                              return Err(ExecError::AssertEqMismatch { lhs: __v_975.as_canonical_u64(), rhs: __v_976.as_canonical_u64(), msg: None });
+                            }
+                            let __ret: [G; OUT_242] = [];
+                            record.function_queries[242].finish(&inp[..], &__ret[..], !unconstrained);
+                            return Ok(__ret);
+                          },
+                        }
+                      },
                     }
-                    let __v_810: G = G::from_u64(0);
-                    let __r_arr: [G; OUT_158] = { let __args: [G; IN_158] = [__v_48, __v_38, __v_775, __v_772, __v_810, __v_771]; let __cu = unconstrained; let __hit = record.function_queries[158].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[158].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[158].bump_multiplicity(__i); } let __ret: [G; OUT_158] = unsafe { *(record.function_queries[158].output_at(__i).as_ptr() as *const [G; OUT_158]) }; __ret }, _ => aiur_fn_158(__args, record, io_buffer, __cu)? } };
-                    let __v_811: G = __r_arr[0];
-                    break '__mc_1 [__v_811];
                   },
                 }
               },
@@ -26224,247 +26459,6 @@ fn aiur_fn_242(
         }
       },
     }
-  },
-}
- };
-    let __v_361: G = __mc_out___mc_1[0];
-    let __v_362: G = (__v_18 + __v_19);
-    if (__v_69 != __v_362) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_69.as_canonical_u64(), rhs: __v_362.as_canonical_u64(), msg: None });
-    }
-    let __v_363: G = G::from_u64(256);
-    let __v_364: G = (__v_363 * __v_128);
-    let __v_365: G = G::from_u64(65536);
-    let __v_366: G = (__v_365 * __v_129);
-    let __v_367: G = G::from_u64(16777216);
-    let __v_368: G = (__v_367 * __v_130);
-    let __v_369: G = (__v_366 + __v_368);
-    let __v_370: G = (__v_364 + __v_369);
-    let __v_371: G = (__v_127 + __v_370);
-    let __v_372: G = G::from_u64(256);
-    let __v_373: G = (__v_372 * __v_132);
-    let __v_374: G = G::from_u64(65536);
-    let __v_375: G = (__v_374 * __v_133);
-    let __v_376: G = G::from_u64(16777216);
-    let __v_377: G = (__v_376 * __v_134);
-    let __v_378: G = (__v_375 + __v_377);
-    let __v_379: G = (__v_373 + __v_378);
-    let __v_380: G = (__v_131 + __v_379);
-    let __v_381: G = G::from_u64(256);
-    let __v_382: G = (__v_381 * __v_136);
-    let __v_383: G = G::from_u64(65536);
-    let __v_384: G = (__v_383 * __v_137);
-    let __v_385: G = G::from_u64(16777216);
-    let __v_386: G = (__v_385 * __v_138);
-    let __v_387: G = (__v_384 + __v_386);
-    let __v_388: G = (__v_382 + __v_387);
-    let __v_389: G = (__v_135 + __v_388);
-    let __v_390: G = G::from_u64(256);
-    let __v_391: G = (__v_390 * __v_140);
-    let __v_392: G = G::from_u64(65536);
-    let __v_393: G = (__v_392 * __v_141);
-    let __v_394: G = G::from_u64(16777216);
-    let __v_395: G = (__v_394 * __v_142);
-    let __v_396: G = (__v_393 + __v_395);
-    let __v_397: G = (__v_391 + __v_396);
-    let __v_398: G = (__v_139 + __v_397);
-    let __v_399: G = G::from_u64(256);
-    let __v_400: G = (__v_399 * __v_144);
-    let __v_401: G = G::from_u64(65536);
-    let __v_402: G = (__v_401 * __v_145);
-    let __v_403: G = G::from_u64(16777216);
-    let __v_404: G = (__v_403 * __v_146);
-    let __v_405: G = (__v_402 + __v_404);
-    let __v_406: G = (__v_400 + __v_405);
-    let __v_407: G = (__v_143 + __v_406);
-    let __v_408: G = G::from_u64(256);
-    let __v_409: G = (__v_408 * __v_148);
-    let __v_410: G = G::from_u64(65536);
-    let __v_411: G = (__v_410 * __v_149);
-    let __v_412: G = G::from_u64(16777216);
-    let __v_413: G = (__v_412 * __v_150);
-    let __v_414: G = (__v_411 + __v_413);
-    let __v_415: G = (__v_409 + __v_414);
-    let __v_416: G = (__v_147 + __v_415);
-    let __v_417: G = G::from_u64(256);
-    let __v_418: G = (__v_417 * __v_152);
-    let __v_419: G = G::from_u64(65536);
-    let __v_420: G = (__v_419 * __v_153);
-    let __v_421: G = G::from_u64(16777216);
-    let __v_422: G = (__v_421 * __v_154);
-    let __v_423: G = (__v_420 + __v_422);
-    let __v_424: G = (__v_418 + __v_423);
-    let __v_425: G = (__v_151 + __v_424);
-    let __v_426: G = G::from_u64(256);
-    let __v_427: G = (__v_426 * __v_156);
-    let __v_428: G = G::from_u64(65536);
-    let __v_429: G = (__v_428 * __v_157);
-    let __v_430: G = G::from_u64(16777216);
-    let __v_431: G = (__v_430 * __v_158);
-    let __v_432: G = (__v_429 + __v_431);
-    let __v_433: G = (__v_427 + __v_432);
-    let __v_434: G = (__v_155 + __v_433);
-    if (__v_371 != __v_0) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_371.as_canonical_u64(), rhs: __v_0.as_canonical_u64(), msg: None });
-    }
-    if (__v_380 != __v_1) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_380.as_canonical_u64(), rhs: __v_1.as_canonical_u64(), msg: None });
-    }
-    if (__v_389 != __v_2) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_389.as_canonical_u64(), rhs: __v_2.as_canonical_u64(), msg: None });
-    }
-    if (__v_398 != __v_3) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_398.as_canonical_u64(), rhs: __v_3.as_canonical_u64(), msg: None });
-    }
-    if (__v_407 != __v_4) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_407.as_canonical_u64(), rhs: __v_4.as_canonical_u64(), msg: None });
-    }
-    if (__v_416 != __v_5) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_416.as_canonical_u64(), rhs: __v_5.as_canonical_u64(), msg: None });
-    }
-    if (__v_425 != __v_6) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_425.as_canonical_u64(), rhs: __v_6.as_canonical_u64(), msg: None });
-    }
-    if (__v_434 != __v_7) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_434.as_canonical_u64(), rhs: __v_7.as_canonical_u64(), msg: None });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_263.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_435: G = __loaded[0];
-    let __v_436: G = __loaded[1];
-    let __v_437: G = __loaded[2];
-    let __v_438: G = G::from_u64(1);
-    let __v_439: G = G::from_u64(1);
-    if (__v_435 != __v_438) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_435.as_canonical_u64(), rhs: __v_438.as_canonical_u64(), msg: None });
-    }
-    if (__v_436 != __v_439) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_436.as_canonical_u64(), rhs: __v_439.as_canonical_u64(), msg: None });
-    }
-    if (__v_437 != __v_439) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_437.as_canonical_u64(), rhs: __v_439.as_canonical_u64(), msg: None });
-    }
-    let __v_440: G = G::from_u64(256);
-    let __v_441: G = (__v_440 * __v_325);
-    let __v_442: G = G::from_u64(65536);
-    let __v_443: G = (__v_442 * __v_326);
-    let __v_444: G = G::from_u64(16777216);
-    let __v_445: G = (__v_444 * __v_327);
-    let __v_446: G = (__v_443 + __v_445);
-    let __v_447: G = (__v_441 + __v_446);
-    let __v_448: G = (__v_324 + __v_447);
-    let __v_449: G = G::from_u64(256);
-    let __v_450: G = (__v_449 * __v_329);
-    let __v_451: G = G::from_u64(65536);
-    let __v_452: G = (__v_451 * __v_330);
-    let __v_453: G = G::from_u64(16777216);
-    let __v_454: G = (__v_453 * __v_331);
-    let __v_455: G = (__v_452 + __v_454);
-    let __v_456: G = (__v_450 + __v_455);
-    let __v_457: G = (__v_328 + __v_456);
-    let __v_458: G = G::from_u64(256);
-    let __v_459: G = (__v_458 * __v_333);
-    let __v_460: G = G::from_u64(65536);
-    let __v_461: G = (__v_460 * __v_334);
-    let __v_462: G = G::from_u64(16777216);
-    let __v_463: G = (__v_462 * __v_335);
-    let __v_464: G = (__v_461 + __v_463);
-    let __v_465: G = (__v_459 + __v_464);
-    let __v_466: G = (__v_332 + __v_465);
-    let __v_467: G = G::from_u64(256);
-    let __v_468: G = (__v_467 * __v_337);
-    let __v_469: G = G::from_u64(65536);
-    let __v_470: G = (__v_469 * __v_338);
-    let __v_471: G = G::from_u64(16777216);
-    let __v_472: G = (__v_471 * __v_339);
-    let __v_473: G = (__v_470 + __v_472);
-    let __v_474: G = (__v_468 + __v_473);
-    let __v_475: G = (__v_336 + __v_474);
-    let __v_476: G = G::from_u64(256);
-    let __v_477: G = (__v_476 * __v_341);
-    let __v_478: G = G::from_u64(65536);
-    let __v_479: G = (__v_478 * __v_342);
-    let __v_480: G = G::from_u64(16777216);
-    let __v_481: G = (__v_480 * __v_343);
-    let __v_482: G = (__v_479 + __v_481);
-    let __v_483: G = (__v_477 + __v_482);
-    let __v_484: G = (__v_340 + __v_483);
-    let __v_485: G = G::from_u64(256);
-    let __v_486: G = (__v_485 * __v_345);
-    let __v_487: G = G::from_u64(65536);
-    let __v_488: G = (__v_487 * __v_346);
-    let __v_489: G = G::from_u64(16777216);
-    let __v_490: G = (__v_489 * __v_347);
-    let __v_491: G = (__v_488 + __v_490);
-    let __v_492: G = (__v_486 + __v_491);
-    let __v_493: G = (__v_344 + __v_492);
-    let __v_494: G = G::from_u64(256);
-    let __v_495: G = (__v_494 * __v_349);
-    let __v_496: G = G::from_u64(65536);
-    let __v_497: G = (__v_496 * __v_350);
-    let __v_498: G = G::from_u64(16777216);
-    let __v_499: G = (__v_498 * __v_351);
-    let __v_500: G = (__v_497 + __v_499);
-    let __v_501: G = (__v_495 + __v_500);
-    let __v_502: G = (__v_348 + __v_501);
-    let __v_503: G = G::from_u64(256);
-    let __v_504: G = (__v_503 * __v_353);
-    let __v_505: G = G::from_u64(65536);
-    let __v_506: G = (__v_505 * __v_354);
-    let __v_507: G = G::from_u64(16777216);
-    let __v_508: G = (__v_507 * __v_355);
-    let __v_509: G = (__v_506 + __v_508);
-    let __v_510: G = (__v_504 + __v_509);
-    let __v_511: G = (__v_352 + __v_510);
-    if (__v_448 != __v_8) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_448.as_canonical_u64(), rhs: __v_8.as_canonical_u64(), msg: None });
-    }
-    if (__v_457 != __v_9) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_457.as_canonical_u64(), rhs: __v_9.as_canonical_u64(), msg: None });
-    }
-    if (__v_466 != __v_10) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_466.as_canonical_u64(), rhs: __v_10.as_canonical_u64(), msg: None });
-    }
-    if (__v_475 != __v_11) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_475.as_canonical_u64(), rhs: __v_11.as_canonical_u64(), msg: None });
-    }
-    if (__v_484 != __v_12) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_484.as_canonical_u64(), rhs: __v_12.as_canonical_u64(), msg: None });
-    }
-    if (__v_493 != __v_13) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_493.as_canonical_u64(), rhs: __v_13.as_canonical_u64(), msg: None });
-    }
-    if (__v_502 != __v_14) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_502.as_canonical_u64(), rhs: __v_14.as_canonical_u64(), msg: None });
-    }
-    if (__v_511 != __v_15) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_511.as_canonical_u64(), rhs: __v_15.as_canonical_u64(), msg: None });
-    }
-    let __loaded: [G; 3] = { let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; let __ptr_u64 = __v_359.as_canonical_u64(); let __ptr_usize = usize::try_from(__ptr_u64).ok().ok_or(ExecError::PointerTooLarge(__ptr_u64))?; if __ptr_usize >= __mq.len() { return Err(ExecError::UnboundPointer { ptr: __ptr_u64, size: 3 }); } if !unconstrained { __mq.bump_multiplicity(__ptr_usize); } let (__args, _) = __mq.get_index(__ptr_usize).expect("bounds checked above"); let __arr: [G; 3] = __args[..3].try_into().unwrap(); __arr };
-    let __v_512: G = __loaded[0];
-    let __v_513: G = __loaded[1];
-    let __v_514: G = __loaded[2];
-    let __v_515: G = G::from_u64(1);
-    let __v_516: G = G::from_u64(1);
-    if (__v_512 != __v_515) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_512.as_canonical_u64(), rhs: __v_515.as_canonical_u64(), msg: None });
-    }
-    if (__v_513 != __v_516) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_513.as_canonical_u64(), rhs: __v_516.as_canonical_u64(), msg: None });
-    }
-    if (__v_514 != __v_516) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_514.as_canonical_u64(), rhs: __v_516.as_canonical_u64(), msg: None });
-    }
-    let __v_517: G = G::from_u64(1);
-    if (__v_360 != __v_517) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_360.as_canonical_u64(), rhs: __v_517.as_canonical_u64(), msg: None });
-    }
-    let __v_518: G = G::from_u64(1);
-    if (__v_361 != __v_518) {
-      return Err(ExecError::AssertEqMismatch { lhs: __v_361.as_canonical_u64(), rhs: __v_518.as_canonical_u64(), msg: None });
-    }
-    let __ret: [G; OUT_242] = [];
-    record.function_queries[242].finish(&inp[..], &__ret[..], !unconstrained);
-    return Ok(__ret);
   })
 }
 
@@ -26599,10 +26593,10 @@ fn aiur_fn_246(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_5: G = G::from_u64(0);
         let __r_arr: [G; OUT_246] = { let __args: [G; IN_246] = [__v_4, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[246].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[246].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[246].bump_multiplicity(__i); } let __ret: [G; OUT_246] = unsafe { *(record.function_queries[246].output_at(__i).as_ptr() as *const [G; OUT_246]) }; __ret }, _ => aiur_fn_246(__args, record, io_buffer, __cu)? } };
-        let __v_6: G = __r_arr[0];
-        let __v_7: G = { let __values: [G; 3] = [__v_5, __v_3, __v_6]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_5: G = __r_arr[0];
+        let __v_6: G = G::from_u64(0);
+        let __v_7: G = { let __values: [G; 3] = [__v_6, __v_3, __v_5]; let __mq = record.memory_queries.get_mut(&3).ok_or(ExecError::InvalidMemorySize(3))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_246] = [__v_7];
         record.function_queries[246].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
@@ -26873,10 +26867,10 @@ fn aiur_fn_253(
         return Ok(__ret);
       },
       0u64 => {
-        let __v_12: G = G::from_u64(0);
         let __r_arr: [G; OUT_253] = { let __args: [G; IN_253] = [__v_11, __v_1]; let __cu = unconstrained; let __hit = record.function_queries[253].get_index_of(&__args[..]); match __hit { Some(__i) if __cu || record.function_queries[253].mult_at(__i) != G::ZERO => { if !unconstrained { record.function_queries[253].bump_multiplicity(__i); } let __ret: [G; OUT_253] = unsafe { *(record.function_queries[253].output_at(__i).as_ptr() as *const [G; OUT_253]) }; __ret }, _ => aiur_fn_253(__args, record, io_buffer, __cu)? } };
-        let __v_13: G = __r_arr[0];
-        let __v_14: G = { let __values: [G; 10] = [__v_12, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_13]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
+        let __v_12: G = __r_arr[0];
+        let __v_13: G = G::from_u64(0);
+        let __v_14: G = { let __values: [G; 10] = [__v_13, __v_3, __v_4, __v_5, __v_6, __v_7, __v_8, __v_9, __v_10, __v_12]; let __mq = record.memory_queries.get_mut(&10).ok_or(ExecError::InvalidMemorySize(10))?; if let Some(__i) = __mq.get_index_of(&__values[..]) { if !unconstrained { __mq.bump_multiplicity(__i); } __mq.output_at(__i)[0] } else { let __ptr = G::from_usize(__mq.len()); __mq.insert(&__values[..], &[__ptr], G::from_bool(!unconstrained)); __ptr } };
         let __ret: [G; OUT_253] = [__v_14];
         record.function_queries[253].finish(&inp[..], &__ret[..], !unconstrained);
         return Ok(__ret);
diff --git a/crates/kernel/src/def_eq.rs b/crates/kernel/src/def_eq.rs
index 7e04e0170..4c5cbc50f 100644
--- a/crates/kernel/src/def_eq.rs
+++ b/crates/kernel/src/def_eq.rs
@@ -1,6 +1,6 @@
 //! Definitional equality checking.
 //!
-//! Multi-tier strategy following lean4lean:
+//! Multi-tier strategy following the named specification:
 //! 1. Quick structural (same constructor, same children)
 //! 2. WHNF without delta, quick structural
 //! 3. Proof irrelevance (before delta)
@@ -87,9 +87,9 @@ const PROJECTION_PROBE_FUEL: u64 = 4_096;
 
 /// Step journal (`IX_STEP_TRACE=1`): one `[deq] <fuel> <a8> ~ <b8>` line
 /// per `is_def_eq` entry (plus `[whnf+]` lines in whnf.rs), mirroring the
-/// Lean kernel's `IX_TC_STEP_TRACE` journal (`Ix.Tc` / `TcM.stepTrace`).
+/// Lean kernel's `IX_TC_STEP_TRACE` journal (`Ix.Kernel` / `TcM.stepTrace`).
 /// Diffing the two sequences localizes a behavioral divergence at the
-/// first fork (workflow in `Ix/Tc/ParCheck.lean`). Unscoped by design —
+/// first fork (workflow in `Ix/Kernel/ParCheck.lean`). Unscoped by design —
 /// pair with a seeded single-constant run (`--consts <name>`).
 pub(crate) static IX_STEP_TRACE: crate::EnvFlag =
   crate::EnvFlag::new(|| crate::env_var("IX_STEP_TRACE").is_ok());
@@ -420,12 +420,12 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       log::info!("  wb: {wb}");
     }
 
-    // Tier 4b: post-delta congruence checks (lean4lean isDefEqConst/Fvar/Proj)
+    // Tier 4b: post-delta congruence checks (the named specification isDefEqConst/Fvar/Proj)
     if self.try_structural_congruence(&wa, &wb)? {
       return Ok(true);
     }
 
-    // Tier 4c: second structural pass (lean4lean:683-686, lean4
+    // Tier 4c: second structural pass (the named specification:683-686, lean4
     // type_checker.cpp:1109-1110). This is deliberately `whnfCore`, not full
     // `whnf`: full WHNF would delta-unfold stuck open primitives such as
     // `Nat.ble` and can literally walk enormous Nat literals in their
@@ -448,7 +448,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       return Ok(true);
     }
 
-    // Tier 4d: app spine comparison (lean4lean isDefEqApp, lean4 type_checker.cpp:1115)
+    // Tier 4d: app spine comparison (the named specification isDefEqApp, lean4 type_checker.cpp:1115)
     if self.try_def_eq_app(&wa, &wb)? {
       return Ok(true);
     }
@@ -485,7 +485,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     wa: &mut KExpr<M>,
     wb: &mut KExpr<M>,
   ) -> Result<Option<bool>, TcError<M>> {
-    // Tier 4: iterative lazy delta (lean4lean lazyDeltaReduction)
+    // Tier 4: iterative lazy delta (the named specification lazyDeltaReduction)
     let mut fuel = MAX_WHNF_FUEL;
     loop {
       if fuel == 0 {
@@ -495,14 +495,14 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       }
       fuel -= 1;
 
-      // M2: Nat offset reduction at top of loop (lean4lean isDefEqOffset)
+      // M2: Nat offset reduction at top of loop (the named specification isDefEqOffset)
       if let Some(result) = self.try_def_eq_offset(wa, wb)? {
         return Ok(Some(result));
       }
 
       // Nat primitive reduction inside lazy delta. Mirrors lean4
-      // (`refs/lean4/src/kernel/type_checker.cpp:978-984`) and lean4lean
-      // (`refs/lean4lean/Lean4Lean/TypeChecker.lean:619`): skip Nat
+      // (`refs/lean4/src/kernel/type_checker.cpp:978-984`) and the named specification
+      // (`refs/the named specification/Ix.Theory.Named/TypeChecker.lean:619`): skip Nat
       // primitives entirely when either side has a free variable, unless
       // eagerReduce is active.
       let nat_ok = (!wa.has_fvars() && !wb.has_fvars()) || self.eager_reduce;
@@ -523,7 +523,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
 
       // Native reduction inside lazy delta. Reference order is
       // `is_def_eq_offset → reduce_nat (gated) → reduce_native → delta`
-      // (lean4 `type_checker.cpp:986-991`, lean4lean `TypeChecker.lean:625-628`).
+      // (lean4 `type_checker.cpp:986-991`, the named specification `TypeChecker.lean:625-628`).
       // Ix-specific `try_reduce_decidable` runs after native to keep the
       // reference-aligned segment tight.
       if fam_a == PrimFamily::Native
@@ -564,7 +564,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       }
 
       // C6: Before unfolding a definition, try reducing projection apps
-      // on the non-definition side (lean4lean tryUnfoldProjApp).
+      // on the non-definition side (the named specification tryUnfoldProjApp).
       if a_delta && !b_delta {
         if let Some(wb2) = self.try_unfold_proj_app(wb)? {
           *wb = wb2;
@@ -622,7 +622,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
               );
             }
           }
-          // H1: Equal height — unfold BOTH sides (lean4lean:596)
+          // H1: Equal height — unfold BOTH sides (the named specification:596)
           let ua = self.delta_unfold_one(wa)?;
           let ub = self.delta_unfold_one(wb)?;
           match (ua, ub) {
@@ -1152,7 +1152,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     }
   }
 
-  /// M2: Nat offset reduction for lazy delta loop (lean4lean isDefEqOffset),
+  /// M2: Nat offset reduction for lazy delta loop (the named specification isDefEqOffset),
   /// generalized to offset form: each side decomposes to `base + offset`
   /// (`Lit n`, `succ` layers, and `Nat.add base (Lit m)` — the compact stuck
   /// form WHNF now leaves — all read in O(1) per layer), the shared offset
@@ -1236,8 +1236,8 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   /// Convert a string literal to constructor form:
   /// `"abc"` → `String.ofList (List.cons (Char.ofNat 97) (List.cons (Char.ofNat 98) (... List.nil)))`
   ///
-  /// Uses `Char.ofNat` (not `Char.mk`) matching lean4lean/C++ kernel.
-  /// Uses `String.ofList` (= `String.mk` in our env) matching lean4lean/C++ kernel.
+  /// Uses `Char.ofNat` (not `Char.mk`) matching the named specification/C++ kernel.
+  /// Uses `String.ofList` (= `String.mk` in our env) matching the named specification/C++ kernel.
   pub(super) fn str_lit_to_constructor(&mut self, s: &str) -> KExpr<M> {
     let char_const =
       self.intern(KExpr::cnst(self.prims.char_type.clone(), Box::new([])));
@@ -1305,7 +1305,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   // Eta expansion
   // -----------------------------------------------------------------------
 
-  /// Lambda eta expansion (lean4lean style): if `t` is a lambda and `s` is not,
+  /// Lambda eta expansion (the named specification style): if `t` is a lambda and `s` is not,
   /// infer `s`'s type, WHNF to get a forall, wrap `s` as `λ(ty). s #0`, compare with `t`.
   fn try_eta_expansion(
     &mut self,
@@ -1341,7 +1341,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     self.is_def_eq(t, &s_lam)
   }
 
-  /// Struct eta (lean4lean style): if `s` is a fully-applied constructor of a
+  /// Struct eta (the named specification style): if `s` is a fully-applied constructor of a
   /// struct-like type, check `proj(i, t) ≡ s.args[params+i]` for each field.
   /// Tries `tryEtaStructCore(t, s)` — caller should try both directions.
   fn try_eta_struct(
@@ -1392,7 +1392,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       return Ok(false);
     }
 
-    // Types must be def-eq (lean4lean tryEtaStructCore, line 515).
+    // Types must be def-eq (the named specification tryEtaStructCore, line 515).
     // No Prop guard here — struct eta in def-eq is safe even for Prop types
     // because we're checking equality, not constructing terms. The Prop guard
     // is only needed in iota's toCtorWhenStruct (whnf.rs try_struct_eta_iota)
@@ -1477,7 +1477,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     Ok(base)
   }
 
-  /// App spine comparison (lean4lean isDefEqApp): decompose both sides into
+  /// App spine comparison (the named specification isDefEqApp): decompose both sides into
   /// head + args and compare componentwise. Handles multi-arg apps.
   fn try_def_eq_app(
     &mut self,
@@ -1569,7 +1569,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   // Post-delta congruence and projection unfolding (C5, C6)
   // -----------------------------------------------------------------------
 
-  /// Structural congruence after lazy delta exhaustion (lean4lean isDefEqConst/Proj).
+  /// Structural congruence after lazy delta exhaustion (the named specification isDefEqConst/Proj).
   /// Checks Const-Const, Var-Var, Prj-Prj without further reduction.
   fn try_structural_congruence(
     &mut self,
@@ -1796,7 +1796,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   }
 
   /// If the head of `e` is a projection, try reducing it via whnf_no_delta.
-  /// Returns the reduced form if it changed, None otherwise (lean4lean tryUnfoldProjApp).
+  /// Returns the reduced form if it changed, None otherwise (the named specification tryUnfoldProjApp).
   fn try_unfold_proj_app(
     &mut self,
     e: &KExpr<M>,
diff --git a/crates/kernel/src/def_eq/application.rs b/crates/kernel/src/def_eq/application.rs
index a0682f29a..1c9b0f77c 100644
--- a/crates/kernel/src/def_eq/application.rs
+++ b/crates/kernel/src/def_eq/application.rs
@@ -3,7 +3,7 @@
 //! Invariant: a Finish frame is reached ONLY after both child comparisons
 //! succeeded in the frame's original context. Thus every published equality
 //! follows from application congruence, not from a pending/visited-pair guess.
-//! See Ix/Tc/Verify/DefEq/SpineArguments.lean (TrAppSpine.defEq_of_zip) for the
+//! See Ix/Kernel/Verify/DefEq/SpineArguments.lean (TrAppSpine.defEq_of_zip) for the
 //! corresponding semantic rule. That theorem does not certify this Rust loop.
 //!
 //! No binders are opened here. All non-App pairs use ordinary conversion,
diff --git a/crates/kernel/src/def_eq/binders.rs b/crates/kernel/src/def_eq/binders.rs
index 4e7e9f00c..69e96e2f6 100644
--- a/crates/kernel/src/def_eq/binders.rs
+++ b/crates/kernel/src/def_eq/binders.rs
@@ -3,8 +3,8 @@
 //! Domains are compared under the already-accepted prefix, before adding
 //! the SAME fresh local to both sides. The terminal bodies are opened once.
 //! Each accepted binder therefore follows the existing single-binder rule.
-//! See Ix/Tc/Verify/DefEq/Structural.lean (quickBinder_wf) and the lamDF /
-//! forallEDF rules in lean4lean. Those proofs do not certify this Rust loop.
+//! See Ix/Kernel/Verify/DefEq/Structural.lean (quickBinder_wf) and the lamDF /
+//! forallEDF rules in the named specification. Those proofs do not certify this Rust loop.
 //!
 //! This is not a complete conversion procedure for binder terms: skipping
 //! intermediate conversion can miss reduction/proof-irrelevance/cache wins.
diff --git a/crates/kernel/src/env.rs b/crates/kernel/src/env.rs
index 4768cdf78..9e999db22 100644
--- a/crates/kernel/src/env.rs
+++ b/crates/kernel/src/env.rs
@@ -678,8 +678,8 @@ pub struct KEnv<M: KernelMode> {
   /// `whnf_no_delta_for_def_eq` from scratch (mathlib hot path).
   pub whnf_no_delta_cheap_cache: FxHashMap<(Addr, CtxAddr), KExpr<M>>,
   /// WHNF core cache: structural-only reduction (beta/iota/zeta/proj),
-  /// no native primitives, no delta. Mirrors lean4lean's `whnfCoreCache`
-  /// (refs/lean4lean/Lean4Lean/TypeChecker.lean:19) and lean4 C++'s
+  /// no native primitives, no delta. Mirrors the named specification's `whnfCoreCache`
+  /// (refs/the named specification/Ix.Theory.Named/TypeChecker.lean:19) and lean4 C++'s
   /// `m_whnf_core`. Populated only when flags are FULL — cheap-projection
   /// results are not safe to share with full callers.
   pub whnf_core_cache: FxHashMap<(Addr, CtxAddr), KExpr<M>>,
diff --git a/crates/kernel/src/inductive.rs b/crates/kernel/src/inductive.rs
index b5f0bc436..d4e60d879 100644
--- a/crates/kernel/src/inductive.rs
+++ b/crates/kernel/src/inductive.rs
@@ -2,7 +2,7 @@
 //!
 //! Validates inductive declarations (parameter agreement, positivity, universe
 //! constraints, return types) and generates canonical recursors following
-//! lean4lean's constructive approach, then compares with provided recursors.
+//! the named specification's constructive approach, then compares with provided recursors.
 
 use ix_common::address::Address;
 
@@ -359,7 +359,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     //
     // References: lean4 `src/kernel/inductive.cpp:211–262 check_inductive_types`
     // (line 230–231: "parameters of all inductive datatypes must match")
-    // and lean4lean `Lean4Lean/Inductive/Add.lean:80–82`.
+    // and the named specification `Ix.Theory.Named/Inductive/Add.lean:80–82`.
     //
     // Memoization: the check is invariant across all peers of the block —
     // if peer[0] agrees with each of peer[1..N], then by transitivity all
@@ -711,7 +711,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
 
   /// Build the "flat" block for recursor generation, detecting nested occurrences.
   ///
-  /// Mirrors lean4lean's `ElimNestedInductive.run`: walks constructor fields,
+  /// Mirrors the named specification's `ElimNestedInductive.run`: walks constructor fields,
   /// detects `ExtInd(block_member_ref)` patterns, and adds auxiliary entries
   /// for each nested external inductive. Queue-based for transitive nesting.
   fn build_flat_block(
@@ -929,7 +929,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       // local de Bruijn refs. Either case means the would-be aux parameter
       // depends on a constructor field, so it is not a valid nested inductive
       // parameter. Allow Var(0)..Var(n_rec_params-1) as shared parameter refs.
-      // (lean4lean: isNestedInductiveApp? checks looseBVars on param args.)
+      // (the named specification: isNestedInductiveApp? checks looseBVars on param args.)
       let param_depth =
         checked_usize_to_u64::<M>("nested parameter depth", param_depth)?;
       let param_bound = checked_metadata_sum::<M>(
@@ -1985,7 +1985,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   }
 
   /// Check that a field domain doesn't have block inductives in negative position.
-  /// Follows lean4lean's `checkPositivity`: recurse through foralls, reject if
+  /// Follows the named specification's `checkPositivity`: recurse through foralls, reject if
   /// inductive in domain (negative), accept if result is a valid inductive app
   /// (direct or nested).
   ///
@@ -2020,7 +2020,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
           return Err(TcError::Other("strict positivity violation".into()));
         }
         // H4: Open binder with fvar so WHNF works correctly on dependent
-        // types (lean4lean Add.lean:187-189 uses withLocalDecl).
+        // types (the named specification Add.lean:187-189 uses withLocalDecl).
         let saved = self.lctx.len();
         let (inner_open, _) =
           self.open_binder_anon(inner_dom.clone(), inner_body);
@@ -2458,7 +2458,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   }
 
   /// Determine whether the recursor for this block is a large eliminator
-  /// (can target any universe). Follows lean4lean's isLargeEliminator.
+  /// (can target any universe). Follows the named specification's isLargeEliminator.
   ///
   /// Returns true if:
   /// 1. The inductive is NOT in Prop, OR
@@ -2549,7 +2549,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     }
   }
 
-  /// Generate recursors for all inductives in a block (lean4lean-style).
+  /// Generate recursors for all inductives in a block (the named specification-style).
   ///
   /// Detects nested occurrences (à la `ElimNestedInductive`), builds a flat
   /// block with auxiliary entries, and generates canonical recursor types for
@@ -4398,7 +4398,7 @@ flat[{gi}].id={}, rec_ids[{gi}]={}; complete recursor types differ",
     let target_n_params = u64_to_usize::<M>(flat[target_bi].own_params)?;
 
     // Use the TARGET recursor (the one for the inductive the field recurses on),
-    // matching lean4lean (Add.lean:427), lean4 C++ (inductive.cpp:738),
+    // matching the named specification (Add.lean:427), lean4 C++ (inductive.cpp:738),
     // and ix/kernel (recursor.rs:1391).
     let peer_rec = &peer_recs[target_bi];
     let peer_rec_lvls = match self.try_get_const(peer_rec)? {
diff --git a/crates/kernel/src/infer.rs b/crates/kernel/src/infer.rs
index 291d91934..edd415cb2 100644
--- a/crates/kernel/src/infer.rs
+++ b/crates/kernel/src/infer.rs
@@ -84,7 +84,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       // context. No lift is needed: every type pushed to `lctx` is closed
       // under fvar identity (its outer Vars/FVars were already
       // instantiate_rev'd or were absent), so the stored type is depth-
-      // invariant. Mirrors lean4lean's `inferType` `.fvar` branch.
+      // invariant. Mirrors the named specification's `inferType` `.fvar` branch.
       ExprData::FVar(id, _, _) => match self.lctx.find(*id) {
         Some(decl) => decl.ty().clone(),
         None => {
@@ -167,7 +167,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
           let t = self.infer(ty)?;
           self.ensure_sort(&t)?;
         }
-        // Open the binder with a fresh fvar. Mirrors lean4lean
+        // Open the binder with a fresh fvar. Mirrors the named specification
         // `inferLambda` (TypeChecker.lean:122) and the C++
         // `infer_lambda` (refs/lean4/src/kernel/type_checker.cpp:116).
         self.with_lctx_scope(|tc| {
@@ -246,7 +246,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
             return Err(TcError::DeclTypeMismatch);
           }
         }
-        // Open with let-bound fvar. Mirrors lean4lean `inferLet`
+        // Open with let-bound fvar. Mirrors the named specification `inferLet`
         // (TypeChecker.lean:165). The let value lives in the LDecl so
         // WHNF can zeta-reduce on FVar(let) lookup, and so the closing
         // step below produces a `Let` wrapper whose body is the
diff --git a/crates/kernel/src/level.rs b/crates/kernel/src/level.rs
index d90d70cb7..5b4848c50 100644
--- a/crates/kernel/src/level.rs
+++ b/crates/kernel/src/level.rs
@@ -5,31 +5,31 @@
 //! `M::MField<Name>` — the parameter name in Meta mode, erased to `()` in
 //! Anon mode.
 //!
-//! # Relationship to Lean4Lean
+//! # Relationship to Ix.Theory.Named
 //!
-//! `normalize_level` is a line-by-line port of Lean4Lean's `Level.Normalize`
-//! (see `refs/lean4lean/Lean4Lean/Level.lean`), based on Yoan Géran's paper
+//! `normalize_level` is a line-by-line port of Ix.Theory.Named's `Level.Normalize`
+//! (see `refs/the named specification/Ix.Theory.Named/Level.lean`), based on Yoan Géran's paper
 //! "A Canonical Form for Universe Levels in Impredicative Type Theory"
 //! (<https://lmf.cnrs.fr/downloads/Perso/long.pdf>). The Rust `NormLevel` is
 //! a `BTreeMap<Vec<u64>, Node>` indexed by sorted param-index paths — the
-//! Rust analogue of Lean4Lean's `Std.TreeMap (List Name) Node`, with `u64`
+//! Rust analogue of Ix.Theory.Named's `Std.TreeMap (List Name) Node`, with `u64`
 //! param indices replacing `Name` since our anon-mode params are positional.
 //!
 //! Point of divergence: `norm_level_le` is intentionally stronger than
-//! Lean4Lean's `NormLevel.le`. Lean4Lean's variant looks for a *single*
+//! Ix.Theory.Named's `NormLevel.le`. Ix.Theory.Named's variant looks for a *single*
 //! `p2 ⊆ p1` entry in `l2` that dominates both the constant and the variable
 //! contributions of `n_p1`; ours splits that into independent per-ingredient
 //! searches (`covers_const` and `covers_var`). See the detailed doc on
 //! `norm_level_le` for the concrete witness that motivated the change.
 //!
 //! This is a soundness-preserving completeness strengthening, not a
-//! disagreement with the canonical-form theory: Lean4Lean's
+//! disagreement with the canonical-form theory: Ix.Theory.Named's
 //! `NormLevel.subsumption_eval` is `sorry` in
-//! `refs/lean4lean/Lean4Lean/Verify/Level.lean:545`, and there is no
+//! `refs/the named specification/Ix.Theory.Named/Verify/Level.lean:545`, and there is no
 //! `geq'_wf` / `NormLevel.le_wf` theorem anywhere in the Verify tree, so the
-//! "complete for level algebra" claim in Lean4Lean's `divergences.md` is
+//! "complete for level algebra" claim in Ix.Theory.Named's `divergences.md` is
 //! aspirational for `geq'` specifically. `univ_eq` (via `norm_level_eq`)
-//! matches Lean4Lean's `isEquiv'` bit-for-bit, since that direction *is*
+//! matches Ix.Theory.Named's `isEquiv'` bit-for-bit, since that direction *is*
 //! proven sound (`isEquiv'_wf`, `Verify/Level.lean:578`) and the witness
 //! that exposed `NormLevel.le`'s gap is not an equality case.
 
@@ -351,8 +351,8 @@ fn norm_add_var(s: &mut NormLevel, idx: u64, k: u64, path: &[u64]) {
 }
 
 /// Insert `(idx, k)` into the var list at `path`, taking the max of offsets
-/// when `idx` is already present. Mirrors Lean4Lean's
-/// `NormLevel.addNode v k path'` (`refs/lean4lean/Lean4Lean/Level.lean:92`);
+/// when `idx` is already present. Mirrors Ix.Theory.Named's
+/// `NormLevel.addNode v k path'` (`refs/the named specification/Ix.Theory.Named/Level.lean:92`);
 /// `k` must be the current succ-accumulator from `normalize_aux`.
 ///
 /// An earlier port of this function dropped `k` and always inserted
@@ -432,7 +432,7 @@ fn normalize_aux<M: KernelMode>(
           // Param(idx) is already in path (so we're in an `imax(u, v)` where
           // v = Param(idx) and idx is fixed > 0 by the enclosing chain).
           // The outer k Succ's still contribute when idx > 0, which it is
-          // along this path. Matches Lean4Lean's `acc.addVar v k path`.
+          // along this path. Matches Ix.Theory.Named's `acc.addVar v k path`.
           if k != 0 {
             norm_add_var(acc, idx, k, path);
           }
@@ -508,7 +508,7 @@ fn normalize_imax_dispatch<M: KernelMode>(
       normalize_aux(a, &new_path, k, acc);
     } else {
       // idx is already in path; outer k Succ's still contribute.
-      // Matches Lean4Lean's `acc.addVar v k path`.
+      // Matches Ix.Theory.Named's `acc.addVar v k path`.
       if k != 0 {
         norm_add_var(acc, idx, k, path);
       }
@@ -623,9 +623,9 @@ fn covers_var(l2: &NormLevel, p1: &[u64], w: u64, off: u64) -> bool {
 /// where `p1`'s params are all positive must be dominated by the max of
 /// contributions from `{(p2, n_p2) : p2 ⊆ p1}` in the same branch.
 ///
-/// # Divergence from Lean4Lean
+/// # Divergence from Ix.Theory.Named
 ///
-/// Lean4Lean's `NormLevel.le` (`refs/lean4lean/Lean4Lean/Level.lean:164`)
+/// Ix.Theory.Named's `NormLevel.le` (`refs/the named specification/Ix.Theory.Named/Level.lean:164`)
 /// looks for a *single* `p2` covering both `n1.const` and `n1.var`
 /// simultaneously — sound, but incomplete. Concrete witness (see
 /// `prop_univ_max_is_geq_both_components_imax_witness`):
@@ -646,7 +646,7 @@ fn covers_var(l2: &NormLevel, p1: &[u64], w: u64, off: u64) -> bool {
 /// Checking `b ≤ m` at `p1 = [0,1]` needs both `const=3` and `var=[(0,0)]`.
 /// `m[[]]` covers the const (no var); `m[[0,1]]` covers the var (const was
 /// zeroed out by subsumption against `m[[]]`). No single `p2 ⊆ [0,1]` in
-/// `m` has both, so Lean4Lean's `le` reports `m ≱ b` even though `m ≥ b`
+/// `m` has both, so Ix.Theory.Named's `le` reports `m ≱ b` even though `m ≥ b`
 /// holds for every parameter assignment.
 ///
 /// The version here splits the check into `covers_const` and `covers_var`,
@@ -662,7 +662,7 @@ fn covers_var(l2: &NormLevel, p1: &[u64], w: u64, off: u64) -> bool {
 ///   n_p2.var` with `off' ≥ off`, then `l2`'s contribution along active
 ///   `p1` is at least `u_w + off' ≥ u_w + off`.
 ///
-/// This matches what Lean4Lean's paper-level theory expects but its
+/// This matches what Ix.Theory.Named's paper-level theory expects but its
 /// implementation doesn't cover (cf. the `sorry` on
 /// `NormLevel.subsumption_eval` in `Verify/Level.lean:545`, and the absence
 /// of any `geq'_wf`).
@@ -1284,7 +1284,7 @@ mod tests {
   /// Param(0)), Param(1))` and `a = Succ^3(0)`. Semantically the property
   /// holds for every parameter assignment.
   ///
-  /// The original Lean4Lean `NormLevel.le` was incomplete: it searched for
+  /// The original Ix.Theory.Named `NormLevel.le` was incomplete: it searched for
   /// a single `p2 ⊆ p1` in `l2` covering both the constant and variable
   /// ingredients of `n_p1`. Here `m`'s canonical form splits its `const=3`
   /// at `[]` from its `var=[(0,0)]` at `[0,1]`, while `b`'s `[0,1]` carries
diff --git a/crates/kernel/src/subst.rs b/crates/kernel/src/subst.rs
index 271a7b331..96bf4d9d1 100644
--- a/crates/kernel/src/subst.rs
+++ b/crates/kernel/src/subst.rs
@@ -7,9 +7,9 @@
 //! times (well-founded-recursion unfolds, recursor rules with repeated
 //! motives, etc.); without per-call memoization we re-walk every shared
 //! occurrence, turning a DAG walk into a tree walk and blowing O(N)
-//! sharing into O(2^k) work. Mirrors `lean4lean`'s `replaceM` which
+//! sharing into O(2^k) work. Mirrors `the named specification`'s `replaceM` which
 //! uses a `PtrMap Expr Expr` for the same reason (see
-//! `refs/lean4lean/Lean4Lean/Expr.lean:14`).
+//! `refs/the named specification/Ix.Theory.Named/Expr.lean:14`).
 
 use std::cell::OnceCell;
 use std::sync::Arc;
@@ -769,8 +769,8 @@ fn clo_subst_cached<M: KernelMode>(
 /// Cheap beta reduction: peephole-reduce `App(λ...λ. body, args)` shapes
 /// without invoking the full [`subst`] machinery in trivial cases.
 ///
-/// Mirrors `lean4lean`'s `Expr.cheapBetaReduce`
-/// (refs/lean4lean/Lean4Lean/Instantiate.lean:8-27) and the C++ kernel's
+/// Mirrors `the named specification`'s `Expr.cheapBetaReduce`
+/// (refs/the named specification/Ix.Theory.Named/Instantiate.lean:8-27) and the C++ kernel's
 /// `cheap_beta_reduce` (refs/lean4/src/kernel/instantiate.cpp:211).
 ///
 /// For a spine `App(λx_0 ... λx_{n-1}. body, a_0, ..., a_{m-1})` we peel
@@ -1485,7 +1485,7 @@ mod tests {
   }
 
   // ---------------------------------------------------------------------
-  // cheap_beta_reduce — see lean4lean Instantiate.lean:8-27.
+  // cheap_beta_reduce — see the named specification Instantiate.lean:8-27.
   // ---------------------------------------------------------------------
 
   #[test]
diff --git a/crates/kernel/src/tc.rs b/crates/kernel/src/tc.rs
index acbff3560..49ede51d5 100644
--- a/crates/kernel/src/tc.rs
+++ b/crates/kernel/src/tc.rs
@@ -46,7 +46,7 @@ pub const MAX_DEF_EQ_DEPTH: u32 = 2_000;
 /// Shared recursive fuel budget, consumed by recursive whnf/infer/isDefEq
 /// entries and by productive structural-WHNF beta/zeta/iota transitions.
 /// This is cumulative work per declaration, not a recursion-depth limit;
-/// its units are not directly comparable to lean4lean's step-indexed depth
+/// its units are not directly comparable to the named specification's step-indexed depth
 /// allowance or the Lean C++ kernel's heartbeats.
 ///
 /// Large FLT proofs can finish successfully after roughly 54M counted steps
@@ -143,7 +143,7 @@ pub struct TypeChecker<'a, M: KernelMode> {
   ctx_id_stack: Vec<CtxAddr>,
 
   // -- Thread-local optimization --
-  /// Union-find for transitive def-eq caching (lean4lean EquivManager).
+  /// Union-find for transitive def-eq caching (the named specification EquivManager).
   /// Thread-local: path halving mutates on reads, not safe to share.
   pub equiv_manager: EquivManager,
 
@@ -494,7 +494,7 @@ impl<'a, M: KernelMode> TypeChecker<'a, M> {
   }
 
   /// Push a let-bound variable (type + value). WHNF will zeta-reduce references
-  /// to this variable by substituting the value (lean4lean withExtendedLetCtx).
+  /// to this variable by substituting the value (the named specification withExtendedLetCtx).
   pub fn push_let(&mut self, ty: KExpr<M>, val: KExpr<M>) {
     let ty = self.env.intern.intern_expr(ty);
     let val = self.env.intern.intern_expr(val);
@@ -570,7 +570,7 @@ impl<'a, M: KernelMode> TypeChecker<'a, M> {
   /// fvar (with `Var(>=1)` shifting down). Returns the opened body and
   /// the fresh fvar id (the caller may pass `_` to discard).
   ///
-  /// Mirrors lean4lean's `withLocalDecl` in shape; differs in that the
+  /// Mirrors the named specification's `withLocalDecl` in shape; differs in that the
   /// caller is responsible for `lctx.truncate(saved_len)` when leaving
   /// the binder scope.
   pub fn open_binder(
diff --git a/crates/kernel/src/tutorial/defeq.rs b/crates/kernel/src/tutorial/defeq.rs
index 46fb671b5..be88b8054 100644
--- a/crates/kernel/src/tutorial/defeq.rs
+++ b/crates/kernel/src/tutorial/defeq.rs
@@ -645,7 +645,7 @@ mod tests {
     //   Acc.intro fields = 1 (h)
     //   Rule rhs: λ motive intro_case h, intro_case ... h ...
     //
-    // The lean4lean rule rhs for Acc.rec.intro is:
+    // The the named specification rule rhs for Acc.rec.intro is:
     //   λ motive intro_case h, intro_case (Acc.intro-major-x) h (λ y hr, Acc.rec motive intro_case y (h y hr))
     // But x comes from the major argument's decomposition, substituted for the index.
     //
diff --git a/crates/kernel/src/whnf.rs b/crates/kernel/src/whnf.rs
index 0a04f2aeb..0b59eba8a 100644
--- a/crates/kernel/src/whnf.rs
+++ b/crates/kernel/src/whnf.rs
@@ -86,13 +86,13 @@ use bignat::Nat;
 
 /// Reduction policy for structural WHNF.
 ///
-/// `cheap_proj` and `cheap_rec` mirror Lean4Lean's `cheapProj` and `cheapRec`
-/// flags (`refs/lean4lean/Lean4Lean/TypeChecker.lean:337–341`): when set,
+/// `cheap_proj` and `cheap_rec` mirror Ix.Theory.Named's `cheapProj` and `cheapRec`
+/// flags (`refs/the named specification/Ix.Theory.Named/TypeChecker.lean:337–341`): when set,
 /// projection-of-`Prj`'s value uses `whnf_core` instead of full `whnf`, and
 /// the recursor's major premise reduces with the same structural variant.
 ///
 /// The only non-full policy currently used is `DEF_EQ_CORE`, matching
-/// Lean/Lean4Lean's `whnfCore (cheapProj := true)` scaffold in def-eq.
+/// Lean/Ix.Theory.Named's `whnfCore (cheapProj := true)` scaffold in def-eq.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 struct WhnfFlags {
   cheap_rec: bool,
@@ -443,7 +443,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
         continue;
       }
 
-      // Nat primitive reduction in main WHNF loop (lean4lean TypeChecker.lean:439).
+      // Nat primitive reduction in main WHNF loop (the named specification TypeChecker.lean:439).
       // Must run BEFORE delta_unfold_one, so that Nat.sub/Nat.pow/etc. get
       // short-circuited before their bodies (which use Nat.rec) are exposed.
       if family == PrimFamily::Nat
@@ -525,7 +525,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   }
 
   /// Structural WHNF for def-eq's cheap projection scaffold:
-  /// `whnfCore (cheapProj := true)` in Lean/Lean4Lean. Projection values are
+  /// `whnfCore (cheapProj := true)` in Lean/Ix.Theory.Named. Projection values are
   /// reduced structurally instead of through full WHNF, but recursor majors
   /// still use full WHNF because def-eq does not enable `cheapRec` here.
   ///
@@ -548,7 +548,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   /// accidentally unfold projected values.
   ///
   /// FULL-mode results are cached in [`KEnv::whnf_core_cache`], mirroring
-  /// lean4lean's `whnfCoreCache` (TypeChecker.lean:19) and lean4 C++'s
+  /// the named specification's `whnfCoreCache` (TypeChecker.lean:19) and lean4 C++'s
   /// `m_whnf_core`. Cheap-mode results are NOT cached — projection values
   /// reduce structurally instead of through full WHNF, so cheap output is
   /// not safe to share with full callers.
@@ -646,8 +646,8 @@ impl<M: KernelMode> TypeChecker<'_, M> {
           return Ok(cur);
         },
         // Let-bound fvar zeta-reduction: substitute the let-bound value.
-        // Mirrors lean4lean's `whnfFVar` branch
-        // (refs/lean4lean/Lean4Lean/TypeChecker.lean:233).
+        // Mirrors the named specification's `whnfFVar` branch
+        // (refs/the named specification/Ix.Theory.Named/TypeChecker.lean:233).
         ExprData::FVar(id, _, _) => {
           if let Some(super::lctx::LocalDecl::LDecl { val, .. }) =
             self.lctx.find(*id)
@@ -664,8 +664,8 @@ impl<M: KernelMode> TypeChecker<'_, M> {
         | ExprData::Str(..)
         | ExprData::Const(..) => return Ok(cur),
 
-        // Projection reduction. Matches Lean4Lean's `reduceProj`
-        // (`refs/lean4lean/Lean4Lean/TypeChecker.lean:284–292`):
+        // Projection reduction. Matches Ix.Theory.Named's `reduceProj`
+        // (`refs/the named specification/Ix.Theory.Named/TypeChecker.lean:284–292`):
         //   let mut c ← (if cheapProj then whnfCore struct cheapRec cheapProj
         //                else whnf struct)
         //
@@ -971,7 +971,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
         if spine.len() <= major_idx {
           return Ok(None);
         }
-        // H6: level params arity (lean4lean Reduce.lean:76).
+        // H6: level params arity (the named specification Reduce.lean:76).
         if rec_us.len() as u64 != lvls {
           return Ok(None);
         }
@@ -1026,7 +1026,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     if cidx >= recr.rules.len() {
       return Ok(None);
     }
-    // H5: nfields ≤ major args (lean4lean Reduce.lean:75).
+    // H5: nfields ≤ major args (the named specification Reduce.lean:75).
     if ctor_fields > ctor_args.len() {
       return Ok(None);
     }
@@ -1327,7 +1327,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   ///
   /// Flags-threaded: when `flags.cheap_rec` is set, the major premise (and
   /// the freshly-built string-literal constructor) reduce with cheap WHNF,
-  /// mirroring Lean4Lean's `cheapRec` behaviour at TypeChecker.lean:337–341.
+  /// mirroring Ix.Theory.Named's `cheapRec` behaviour at TypeChecker.lean:337–341.
   /// Internal-only — callers go through `whnf_core_with_flags`.
   fn try_iota_with_flags(
     &mut self,
@@ -1395,7 +1395,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     };
 
     // WHNF the major premise. Cheap mode skips delta on the major itself,
-    // matching Lean4Lean's `cheapRec` (TypeChecker.lean:337–341); the rest of
+    // matching Ix.Theory.Named's `cheapRec` (TypeChecker.lean:337–341); the rest of
     // the iota machinery still gets a structural normal form to inspect.
     let mut major_whnf = if flags.cheap_rec {
       self.whnf_core_with_flags(&major, flags)?
@@ -1406,7 +1406,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     // Nat literal → constructor form (one level: n → Nat.succ(lit(n-1))).
     //
     // Mirrors lean4 (`refs/lean4/src/kernel/inductive.h:91-93`) and
-    // lean4lean (`refs/lean4lean/Lean4Lean/Inductive/Reduce.lean:70`):
+    // the named specification (`refs/the named specification/Ix.Theory.Named/Inductive/Reduce.lean:70`):
     // unconditional peel. Truly runaway recursors (step case forces the
     // IH on every iteration) are bounded by `MAX_WHNF_FUEL` / outer
     // `MaxRecDepth`, same as upstream. An earlier ix-specific
@@ -1435,7 +1435,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
     if let Some(cleaned) = self.cleanup_nat_offset_major(&major_whnf)? {
       major_whnf = cleaned;
     }
-    // String literal → constructor form (matching lean4lean
+    // String literal → constructor form (matching the named specification
     // Reduce.lean:71 / C++ inductive.h:95). The expansion takes one
     // delta step past `String.ofList` (see `str_lit_to_ctor_app`) so the
     // native collapse rule in `try_reduce_string` can't fold it straight
@@ -1496,11 +1496,11 @@ impl<M: KernelMode> TypeChecker<'_, M> {
         return Ok(None);
       }
       let rule = &recr.rules[cidx];
-      // H6: Check level params arity (lean4lean Reduce.lean:76)
+      // H6: Check level params arity (the named specification Reduce.lean:76)
       if rec_us.len() as u64 != recr.lvls {
         return Ok(None);
       }
-      // H5: Check nfields ≤ major_args (lean4lean Reduce.lean:75)
+      // H5: Check nfields ≤ major_args (the named specification Reduce.lean:75)
       if ctor_fields > ctor_args.len() {
         return Ok(None);
       }
@@ -1902,7 +1902,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
       return Ok(None);
     }
 
-    // H3: Prop guard — don't eta-expand Prop-typed structures (lean4lean toCtorWhenStruct:51)
+    // H3: Prop guard — don't eta-expand Prop-typed structures (the named specification toCtorWhenStruct:51)
     let major = &spine[recr.major_idx];
     let major_ty = match self.with_infer_only(|tc| tc.infer(major)) {
       Ok(ty) => ty,
@@ -1946,7 +1946,7 @@ impl<M: KernelMode> TypeChecker<'_, M> {
   /// definitive rejection; optional probe misses and cheap-mode false results
   /// are inconclusive and preserve the ordinary major-WHNF fallback.
   ///
-  /// Algorithm (following lean4lean/nanoda):
+  /// Algorithm (following the named specification/nanoda):
   /// 1. Infer major's type, WHNF it
   /// 2. Check head constant matches the recursor's target inductive
   /// 3. Build nullary ctor: `Ctor.{levels} params...`
@@ -3762,7 +3762,7 @@ static NAT_ZERO_LITERAL: LazyLock<Nat> =
 /// Extract a nat value from a literal or `Nat.zero` constructor.
 ///
 /// Matches both `Nat(n)` literals and the `Nat.zero` constructor constant,
-/// mirroring C++ `is_nat_lit_ext` and lean4lean `rawNatLitExt?`. After iota
+/// mirroring C++ `is_nat_lit_ext` and the named specification `rawNatLitExt?`. After iota
 /// reduction, `Nat.zero` can appear as `Const(Nat.zero, [])` which must be
 /// recognized for native Nat operations to fire.
 fn extract_nat_lit<'a, M: KernelMode>(
@@ -3868,7 +3868,7 @@ fn compute_nat_bin<M: KernelMode>(
   } else if *addr == p.nat_mod.addr {
     if b.0 == zero { a.0.clone() } else { &a.0 % &b.0 }
   } else if *addr == p.nat_pow.addr {
-    // Limit matches C++ kernel `ReducePowMaxExp` and lean4lean `reducePowMaxExp`.
+    // Limit matches C++ kernel `ReducePowMaxExp` and the named specification `reducePowMaxExp`.
     const REDUCE_POW_MAX_EXP: u64 = 1 << 24; // 16_777_216
     match b.to_u64() {
       #[allow(clippy::cast_possible_truncation)] // guarded: exp <= 2^24
diff --git a/docs/aiur-bug-inventory.md b/docs/aiur-bug-inventory.md
new file mode 100644
index 000000000..76731fcb8
--- /dev/null
+++ b/docs/aiur-bug-inventory.md
@@ -0,0 +1,205 @@
+# Aiur bug inventory
+
+This records the fixes completed during the C8 work, including the subsequent
+graph-decoder, constant-degree, operand-scope and key-cap repairs. The nine main entries group
+related failures by cause: four demonstrated verifier soundness defects,
+three compiler defects, one reference-evaluator defect and one constraint
+construction defect. Regression cases
+are counted separately from bug classes.
+
+| Defect | Observed failure | Implemented repair and regression evidence |
+| --- | --- | --- |
+| Inactive rows could supply results | An inactive function row supplied a false public result: `3 * 5 = 16` verified. Its return multiplicity remained nonzero while its computation constraints were disabled. | Enforce `multiplicity * (1 - selector) = 0` for function and memory rows. The supplied false result now rejects; local tests cover every grouped member and inactive memory rows. [Activity regressions](../crates/aiur/src/synthesis/tests/acceptance.rs), [checked arithmetic](../Ix/Aiur/Proofs/Activity.lean). The function forgery was demonstrated; the same missing condition was repaired in memory. |
+| Cyclic calls could justify themselves | `f(x) = f(x)` admitted a public proof without any finite execution. A row's return could balance both the public request and its own recursive call. Mutually recursive rows could do the same. | Add range-checked 48-bit call ranks and nonnegative gaps, enforcing strict rank increase along constrained calls. Self/mutual cycles, equal/reversed ranks and attempted wraparound reject; finite recursion and shared callees verify. [Self-cycle regression](../crates/aiur/src/synthesis/tests/acceptance.rs), [rank and mutual-cycle regressions](../crates/aiur/src/synthesis/tests/call_order.rs), [well-foundedness proof](../Ix/Aiur/Proofs/CallOrder.lean). |
+| A rank could be interpreted as an output | A function returning no values at rank seven verified against a public claim with output seven. Zero padding made the different message boundaries indistinguishable. | Check public channel, function visibility, input/output arity, constrained-call arities and continuation yields. The displaced-rank claim now rejects. [Native regressions](../crates/aiur/src/synthesis/tests/lookup_shapes.rs), [structural checks](../Ix/Aiur/LookupShapes.lean), [padding proofs and counterexample](../Ix/Aiur/Proofs/LookupMessages.lean). |
+| The branchless optimization admitted inactive lookup writers | An empty match branch still contained a store lookup. Because the circuit had only one terminal selector, the optimization emitted its arguments without gating; they changed a live call's channel into a memory channel. Output seven verified for a program whose result was one, with all local equations and construction checks satisfied. | Require a single function with terminal control and one selector before omitting argument gates. Constraint emission and lookup grouping use the same decision. The forged result rejects and the honest result verifies. [Supplied-witness regression](../crates/aiur/src/synthesis/tests/branchless.rs), [unique-writer proof](../Ix/Aiur/Proofs/BranchlessSlots.lean). |
+| Let hoisting changed effect order | Five programs reversed observable writes: array-update arguments, an operand before a later argument's lets, an I/O operation before its continuation, tuple elements and array elements. Both bytecode engines disagreed with both source evaluators. | Normalize each argument completely in source order; preserve operation/continuation sequencing; evaluate an array update's new value before its array in both normalization and lowering. The five cases now agree across all four evaluators. [Compiler regressions](../Tests/Aiur/Hoisting.lean), [normalization](../Ix/Aiur/Stages/Source.lean), [lowering](../Ix/Aiur/Compiler/Lower.lean). |
+| Hoisting captured a shadowed variable | `let x = 10; (let x = 3; x) + x` compiled to six instead of thirteen. | Use distinct local names during argument normalization and preserve lexical scope during renaming. Renaming also preserves shared binders in pattern alternatives and local function-call occurrences. The `lexical-binding-scope` regression returns thirteen in both bytecode engines. [Regression](../Tests/Aiur/Hoisting.lean), [implementation](../Ix/Aiur/Stages/Source.lean). |
+| Inlining lost the callee's return boundary | An explicit tail return was rejected after inlining; an early return escaped its callee and produced seven instead of ten in the caller. | Retain a normal call when the expanded callee contains an explicit return. Both tail-return and early-return cases pass in both bytecode engines. [Regressions](../Tests/Aiur/Hoisting.lean), [inlining guard](../Ix/Aiur/Stages/Source.lean). |
+| The source reference skipped debug-argument effects | An argument that wrote one before a continuation wrote two produced `[2]` in the source reference and `[1, 2]` in the source interpreter. | Evaluate the optional debug argument, including its errors and early returns, before the continuation. The ninth compiler/reference fixture requires `[1, 2]` across all four evaluators. [Regression](../Tests/Aiur/Hoisting.lean), [reference evaluator](../Ix/Aiur/Semantics/SourceEval.lean). |
+| Constant folding could crash constraint construction | The honest source program `eq_zero(0 * x)` panicked: the expression folded to a constant, but its independently tracked degree remained one. The emitter asserted that a constant must have degree zero. | Take the constant shortcut only at tracked degree zero; otherwise emit the usual two auxiliary columns and equations, as reserved by the compiler and witness generator. Six source variants verify at four inputs under singleton and grouped circuits; eight altered public outputs reject. A further 768 native/Lean row assignments compare outputs, metadata, column allocation and constraints. [Source/proving regressions](../Tests/Aiur/ConstantDegree.lean), [native regression](../crates/aiur/src/synthesis/tests/constant_degree.rs), [valued emission](../Ix/Aiur/Proofs/OperationRows.lean). |
+
+The activity, rank and branchless AIR repairs change affected verification
+keys; those systems need rebuilt keys. The arity repair adds validation without
+changing AIR columns or expressions. Compiler fixes required regenerating the
+three Rust VM files; generated-code parity and the existing VM checks passed.
+The compiler repairs have regression coverage and supporting lemmas; complete
+preservation proofs for normalization and inlining remain open.
+
+Five additional implementation bugs were fixed during this work:
+
+- **Deduplication emitted panic diagnostics for invalid callees.** Unchecked
+  indexing printed panic messages even when the process returned success.
+  Explicit default lookups preserve the previous result with empty stderr.
+  The original 23-program syntax/remapping corpus still matches exactly.
+  [Deduplication](../Ix/Aiur/Compiler/Dedup.lean),
+  [compatibility and adversarial tests](../Tests/Aiur/Dedup.lean).
+- **A proof example caused an import-time allocation failure.** The newly
+  introduced symbolic memory counterexample was initially a closed array of
+  `p + 1` rows, so native initialization attempted to allocate it. Making the
+  period an argument keeps the example symbolic in theorem statements and
+  avoids eager allocation. [Corrected example](../Ix/Aiur/Proofs/Memory.lean).
+- **Malformed key graphs could panic during decoding.** A self-referencing
+  node indexed an empty degree vector. The regression now returns an error.
+  The decoder also checks forward references, root and column bounds,
+  stage-two reads in lookup prefixes, degree overflow and incorrect maximum
+  degrees before constructing a graph for evaluation. Valid keys retain the
+  same bytes. This native decoder currently has no production callers in the
+  workspace; serialization is the connected key path. No accepted false claim
+  was demonstrated for this failure. [Decoder regressions](../crates/aiur/src/vk_codec.rs),
+  [read-layout checks](../crates/aiur/src/graph_shape.rs),
+  [checked graph evaluation](../Ix/Aiur/Proofs/ExpressionGraph.lean).
+- **Malformed bytecode could reach an out-of-bounds operand read.** A
+  constrained function with one input and `Add(0, 1)` passed the existing
+  lookup-shape and control-count guards, then panicked inside constraint
+  construction. The new structural check rejects it before construction.
+  It also checks incoming store reads, every return/yield selector, exact
+  word/assertion widths, branch scopes, continuation merges and native index
+  overflow. Unused advice and I/O operands remain outside AIR requirements.
+  This is a demonstrated construction failure, with no accepted false claim
+  shown. [Native guard and regressions](../crates/aiur/src/emission_checks.rs),
+  [total checker](../Ix/Aiur/EmissionChecks.lean),
+  [emission-completion proofs](../Ix/Aiur/Proofs/CheckedCircuit.lean).
+- **Malformed key commitment caps could panic during decoding.** A present
+  cap with zero roots reached a native constructor that asserts its root count
+  is a power of two. The decoder now rejects zero and non-power-of-two counts
+  before constructing the cap. Regressions cover counts 0, 3, 5 and 7; the
+  full-key corpus compares 4,536 native/Lean cases. This decoder has no
+  production callers in the workspace, and no accepted false claim was shown.
+  [Decoder](../crates/aiur/src/vk_codec.rs),
+  [regressions and native corpus](../crates/aiur/src/vk_codec/tests/codec.rs),
+  [total codec and proofs](../Ix/Aiur/Proofs/KeyCodec.lean).
+
+Several checks were added to discharge proof obligations without a demonstrated
+accepted false claim for each one: checked deduplication with identity fallback,
+global lookup-count/overflow bounds, and circuit membership/control-count
+validation. Total comparison, hashing and tail-match definitions also removed
+partial implementation boundaries. These are tracked in the
+[verification documentation](kernel-verification.md); they are not additional
+observed semantic bugs in the nine-entry count above.
+
+Subsequent fixed-table hardening adds explicit activity and height checks at
+the Aiur verifier boundary. The generic shape check permits altered byte-table
+degree metadata and inactive fixed tables; the current PCS rejects an inactive
+committed matrix without opening points. Aiur now requires fixed tables active
+at their exact preprocessed heights before checking openings. The four native
+regressions and all 17,910 native/Lean guard cases pass. This is not an additional
+demonstrated false-claim acceptance. [Guard and regressions](../crates/aiur/src/synthesis/tests/byte_shapes.rs),
+[checked model and column extraction](../Ix/Aiur/Proofs/ByteColumns.lean).
+
+A subsequent **native Merkle cap binding defect** was reproduced during
+commitment-verifier reflection. With heights eight and two and cap height
+two, the native path stops before the shorter matrix is injected. Replacing
+that whole matrix produces the same commitment; individual and shared
+opening verifiers also accept altered rows from it. This is an additional
+demonstrated commitment-binding failure, distinct from the four forged
+public-claim examples in the main table.
+
+The native Aiur verifier and checked Lean wrapper now require every active
+matrix's injection to occur within the authenticated path. The guard
+includes LDE blowup and effective cap clamping. Its regression failed
+before the repair and passes afterward; a cap at the exact shortest height
+still verifies, while a changed public output rejects. All 288,225 native/Lean
+guard cases and 91 native release tests pass. The proof codec preserves
+its existing bytes and tests native acceptance separately from the new
+checked coverage requirement. No forged IxVM public claim was demonstrated
+for this cap defect. The pinned MMCS dependency remains unchanged, so callers
+that bypass the Aiur guard still need their own coverage check.
+[Native reproducer and regressions](../crates/aiur/src/synthesis/tests/mmcs.rs),
+[native guard](../crates/aiur/src/trace_heights.rs),
+[checked coverage and injection bounds](../Ix/Aiur/Proofs/MerkleCap.lean).
+
+The separate effectful-call memoization mismatch remains unresolved:
+the reference evaluators omit the runtime cache, so repeated identical calls
+can have different I/O behavior. This mismatch is not counted as fixed here.
+
+The subsequent byte-column checkpoint passes 54 parallel release Rust tests,
+release Clippy with warnings denied, nine compiler/reference regression programs,
+nine native comparison corpora, the complete Aiur component gate and all 1,345
+broader execution/cost/proving assertions. Its exact audit covers 308 roots.
+These results do not establish the remaining native verifier,
+compiler and certified semantic/cryptographic obligations of full C8.
+
+The graph checkpoint adds the decoder regression and passes all 59 parallel
+release Rust tests, release Clippy, eleven native comparison corpora and the
+complete component gate. Its 338-root audit preserves every earlier root,
+frozen definition and worker body. The new graph corpora compare 88,228 layout
+checks and 240 assignments across ten actual native graphs.
+
+The constant-degree repair preserves the original 6,240 operation-row records
+byte for byte. Its exact audit changes only the `eq_zero` branch of the frozen
+valued emitter; all 338 theorem statements and axiom sets remain unchanged.
+The native release suite passes 61 tests and release Clippy. This failure
+prevented honest proof construction; it did not demonstrate acceptance of a
+false claim. Existing programs that built successfully retain their emitted
+AIR, column layouts and verification keys.
+
+The frontend checkpoint connects symbolic addition, subtraction, multiplication
+and equality-test emission to the valued model. All 1,752 smart-constructor
+trees, 9,804 scalar emissions and 46,224 evaluated assignments match the actual
+Rust frontend. Its 388-root audit preserves the repaired emitter and all 338
+earlier root statements, axiom sets and worker bodies. This proof work adds no
+new observed bug class; full compiler and cryptographic soundness remain open.
+
+The base-graph checkpoint extends reflection through node sharing, graph folds,
+constraint-root canonicalization and ordered lookup compilation. Its 425-root
+audit preserves every earlier statement, axiom set and frozen definition.
+All 1,484 native base graphs, 38 rejected specifications and 11,872 assignments
+match Lean. This work adds no observed bug class; Rust refinement, extension
+expansion and the cryptographic reduction remain open.
+
+The operation checkpoint covers symbolic emission for all 34 operations,
+complete sequences and lookup-slot accumulation. All 1,752 native sequences,
+7,008 assignments and 438 cases with shared slots match exact expression trees
+and evaluated results. Its 520-root audit preserves all prior statements,
+axiom sets and frozen definitions. It adds no observed bug class or native AIR
+change.
+
+The block/circuit checkpoint extends symbolic reflection through recursive
+branches, continuation merges and grouped circuit construction, then composes
+it with base-graph compilation. All 384 native block trees / 1,536 assignments
+and 96 native circuits / 384 assignments match exact expressions and valued
+results. Its 586-root audit preserves every earlier statement, axiom set,
+frozen definition and recursion worker. No new bug or native AIR change was
+found. Rust refinement, accepted-proof extraction, earlier compiler passes
+and the certified semantic/cryptographic endpoint remain open.
+
+The allocation checkpoint proves agreement between actual compiler layout and
+successful symbolic operation/block emission. Its 647-root audit preserves all
+earlier statements, axiom sets, frozen definitions and recursion workers. The
+native comparisons cover 1,168 operation sequences satisfying the degree-zero
+constant invariant, 384 block layouts and 48 function layouts. No new bug or
+native behavior change was found; complete compiler validity and the remaining
+full-C8 obligations remain open.
+
+The circuit-allocation checkpoint derives physical read bounds from successful
+compilation and the checked circuit layout, including grouped selector regions.
+Its 687-root audit preserves every earlier statement, axiom set, frozen
+definition and recursion worker. All 96 native circuit bounds and 384 composed
+graph assignments match. No new bug or native behavior change was found;
+successful symbolic compilation and the remaining full-C8 obligations stay open.
+
+The circuit-completion checkpoint proves that successful symbolic emission
+produces a base graph at the physical circuit width. A satisfying inactive row
+rules out contradictory constant constraints. Native and Lean checks pass for
+96 such rows, and the 719-root audit preserves all prior statements and frozen
+definitions. This adds no observed bug class or native production change;
+symbolic-emission validity and the remaining full-C8 obligations stay open.
+
+The checked-emission checkpoint adds the operand-scope guard and constructs
+the symbolic circuit and physical graph for every checked backend circuit.
+All 9,022 new Rust/Lean guard comparisons, 72 Rust release tests, release
+Clippy, the eighteen-corpus component gate and 1,345 broader Aiur assertions
+pass. The C2 VM recheck retains 12 accepted, 16 rejected and two excluded
+cases. Its 749-root audit preserves all 719 earlier theorem statements and
+axiom sets; the backend now records and enforces the new guard. Native runtime
+refinement and the remaining compiler/semantic/cryptographic obligations stay
+open. Accepted programs retain their AIR expressions, layouts and keys.
+
+The key-codec checkpoint adds canonical byte interpretation to backend
+construction, retaining the decoded graph and selected parameters. Its
+796-root audit preserves all 749 earlier theorem statements and axiom sets.
+All 74 native release tests, release Clippy, the 4,536 full-key comparisons
+and the nineteen-corpus component gate pass. The cap repair changes no serialized key bytes or AIR. Equality between
+the decoded key graph and the compiler model, native acceptance and the
+remaining semantic/cryptographic obligations stay open.
diff --git a/docs/benchmarking.md b/docs/benchmarking.md
index e5a566412..e545248f6 100644
--- a/docs/benchmarking.md
+++ b/docs/benchmarking.md
@@ -85,11 +85,6 @@ ix bench fetch-main --sha $(git merge-base origin/main HEAD) \
 ix bench compare --backend aiur --env InitStd --mode prove \
   --base main.json --pr .lake/benches/aiur-InitStd-prove.json
 
-# The lean4lean reference kernel over InitStd — whole-library replay plus
-# per-constant closure rows, from oleans (no .ixe needed). Read next to the
-# ooc cell's rows for the Rust-vs-reference-kernel gap on the same library:
-ix bench run --backend lean4lean --env InitStd
-ix bench compare --backend lean4lean --env InitStd
 ```
 
 `--repo <dir>` points the run at another checkout: the *measured* tools
@@ -104,7 +99,6 @@ a PR tree and compare them — exactly what the PR workflow does.
 | `zisk`    | ZisK VM execute: cycles, execute-time, throughput, peak-rss, constants (pre-shard closure count, same universe as aiur's), shards (the runtime-planned partition size; 1 when the closure fits) | `zisk-host` |
 | `sp1`     | SP1 VM execute (currently disabled in the registry) | `sp1-host` |
 | `ooc`     | out-of-circuit Rust kernel: whole-env row + one full-closure row per constant (`check-time` wraps only the check — the env loads once, outside every row's timed window) | `ix check-rs --json` |
-| `lean4lean` | the reference Lean4-in-Lean4 kernel ([digama0/lean4lean](https://github.com/digama0/lean4lean), required by the lakefile at a pinned rev) — the external yardstick for the Ix kernels on the same libraries. Olean-driven (no `.ixe`): the whole-library row replays every module in the env's import closure through lean4lean, module-parallel (check-time, constants, throughput, peak-rss; tune parallelism with `LEAN_NUM_THREADS`), plus one full-closure row per constant (the name's transitive closure into a fresh kernel env), mirroring ooc's row shape. Registry-disabled for CI (no bencher testbed yet); `ix bench run --backend lean4lean` works locally regardless | `bench-lean4lean` |
 | `compile` | `ix compile <env>.lean → <env>.ixe`: compile-time, file-size, constants, throughput | `ix compile --json` |
 | `decompile` | inverse of compile — `ix decompile <env>.ixe → Lean consts`: decompile-time, throughput, peak-rss, constants, file-size (input `.ixe`). Consumes the compile cell's `.ixe` rather than producing one; a malformed decompile reddens the cell. Deep roundtrip fidelity is gated by the canonical checks (`ix validate` / roundtrip tests), which need the original Lean env the `.ixe` can't supply | `ix decompile --json` |
 
diff --git a/docs/certified-checking.md b/docs/certified-checking.md
new file mode 100644
index 000000000..452add813
--- /dev/null
+++ b/docs/certified-checking.md
@@ -0,0 +1,158 @@
+# Certified source and claim checking
+
+Ix contains the cumulative C2–C7 certified host adapters under
+`Ix.Certified`, with checker wrappers in `Ix.Kernel.Certified` and
+`Ix.Kernel.CertifiedClaims`. Successful validation constructs receipts that
+connect the authenticated Ixon source to the set model in `Ix.Theory`.
+The maintained implementation and its regression evidence are local to this
+repository.
+
+The certificate profile checks a specific collection of declaration forms
+and logical schemas. Witness search supplies proposals; the certified
+validator checks every proposal before reporting success. Unsupported forms,
+missing models and unsuccessful searches decline. These commands provide an
+explicit entry point for that profile.
+
+## Commands
+
+Build the source and claim commands:
+
+```sh
+lake build --wfail certified-check certified-claim-check
+```
+
+Source checking takes a lazy `.ixe` file and a JSON request that selects the
+target or subjects, primitive addresses, source objects and natural values:
+
+```sh
+.lake/build/bin/certified-check proof SOURCE.ixe REQUEST.json
+.lake/build/bin/certified-check store SOURCE.ixe REQUEST.json
+```
+
+The request fields are `target`, `subjects`, `objects`, `naturals`,
+`falseType`, `falseElim`, nullable `natType`, and optional `models`. Addresses
+are 32-byte hexadecimal strings. Model hints select earlier source
+declarations; the validator checks their types and complete source equations.
+The request parser is defined in
+[`Command.lean`](../Ix/Certified/Command.lean).
+
+For a runnable source example:
+
+```sh
+lake build certified-source-tests
+.lake/build/bin/certified-source-tests /tmp/ix-certified-examples
+.lake/build/bin/certified-check proof \
+  /tmp/ix-certified-examples/identity/source.ixe \
+  /tmp/ix-certified-examples/identity/request.json
+```
+
+Claim checking also takes the exact serialized envelope. The JSON request
+selects its expected address and supplies logical, membership or revelation
+witness hints:
+
+```sh
+.lake/build/bin/certified-claim-check SOURCE.ixe ENVELOPE.bin REQUEST.json
+```
+
+The envelope binds the claim, primitive profile, logical-axiom manifest and
+protocol versions. The current checker version is **2**; format, codec,
+policy and aggregation versions are **1**. Exact decoding, canonical
+re-encoding, the expected content address and all versions are checked.
+Trailing bytes and older checker envelopes reject. See
+[`Envelope.lean`](../Ix/Certified/Envelope.lean) and
+[`ClaimCommand.lean`](../Ix/Certified/ClaimCommand.lean).
+
+Both commands currently use fuel 6,400. Success exits 0 and prints a JSON
+acceptance record; a rejected request exits 1. Fuel or witness-search failure
+can reject a valid source, so success and completeness are separate
+properties.
+
+## Semantic contract
+
+`ClaimCommand.run_meaning` proves that successful pure command execution
+produces a receipt for the exact envelope bytes and establishes
+`SemanticClaimMeaning`. For logical claims, the receipt preserves the
+original source statements and constructs a compatible interpretation while
+preserving the declared frontier. Model companions for mutual and nested
+inductives must already have been checked; their complete recursor equations
+are validated before the new source package is admitted.
+
+For a logical receipt with no structural frontier,
+`LogicalReceipt.closed_subject_meaning` constructs its model.
+`LogicalReceipt.no_False` then rules out a checked subject whose type is the
+profile's false proposition, under the explicit `[SetTheory V]` hypothesis.
+The admitted logical schemas have realizations in that model. A closed
+structural frontier does not imply an empty logical-axiom manifest; the
+manifest records admitted source axioms under the enforced policy.
+
+Membership and revelation establish their respective structural meanings.
+Evaluation claims are excluded from this semantic profile. The relevant
+definitions and statements are in
+[`ClaimAccept.lean`](../Ix/Certified/ClaimAccept.lean),
+[`ClaimMeaning.lean`](../Ix/Certified/ClaimMeaning.lean) and
+[`LogicalPolicy.lean`](../Ix/Theory/Certified/LogicalPolicy.lean).
+
+The mathematical contract concerns the Lean functions. Native Lean
+execution, filesystem loading and the BLAKE3 foreign interface remain
+execution boundaries. The imported C2 VM pilot covers a smaller,
+host-decoded certificate format and declines modeled witnesses. Full
+production-checker refinement and execution of C5–C7 certification inside an
+authenticated Aiur proof remain separate obligations described in
+[`kernel-verification.md`](kernel-verification.md).
+
+## Audits and regression evidence
+
+Run the complete local gate with:
+
+```sh
+lake run check-certified
+```
+
+The gate builds the adapters, audits and test programs with warnings treated
+as errors. It compares the exact foundation report, checks the frozen source
+archive and maintained import identities, runs seven native test programs,
+and exercises the actual source and claim executables on all three CLI
+corpora. CI runs the same gate.
+
+The combined audit covers **86 distinct roots**, **74 premise definitions or
+constructor types**, **9,682 logical declarations** and **10,957 declarations
+including runtime dependencies**. The five historical component audits
+remain independently callable. All 90 historical root occurrences and 75
+premise occurrences retain their statements after namespace qualification is
+normalized. The exact report is
+[`Tests/Certified/foundation.txt`](../Tests/Certified/foundation.txt).
+
+The audit traverses full checked types, bodies and inductive constructors.
+It checks exact axiom sets and follows compiler recursion workers and
+executable replacements transitively, including private constants. These
+roots use only `propext`, `Classical.choice` and `Quot.sound`. The runtime
+inventory records five BLAKE3 foreign operations and 130 recursion workers
+with safe source definitions; it permits no partial opaque worker source or
+executable replacement.
+
+This stronger traversal exposed a native-evaluation axiom that the historical
+imported axiom summaries missed. It came from the BLAKE3 helper's 32-byte
+output bound. `Address.blake3` now supplies a kernel-checked proof of that
+bound. The wrapper is definitionally equal to the former hash operation,
+and the native reports and generated source/envelope corpora are unchanged.
+The affected kernel and source-compiler audits also remove this dependency.
+
+| Actual command corpus | Fixtures | Accepted | Rejected |
+| --- | ---: | ---: | ---: |
+| Source proof/store | 42 source fixtures | 84 | 562 |
+| Versioned claims | 1,578 claim fixtures | 584 | 5,454 |
+| Modeled source and claims | 44 source and 74 claim fixtures | 30 | 540 |
+
+The native modeled tests additionally cover 29 source mutations with accepted
+controls, 42 forged witnesses and nine malformed mutual inputs. The other
+native suites cover source fidelity, lazy loading, cold/warm caches,
+rollback, claim cycles, shared dependencies, membership and revelation.
+
+All generated source and envelope bytes, native reports and CLI process
+outputs are compared against the frozen C7 evidence. CLI JSON requests and
+aggregate records are compared as parsed values because the maintained Lean
+driver formats JSON differently. The archive, source mappings, licenses and
+historical reproduction limits are documented in
+[`Tests/Fixtures/Certified`](../Tests/Fixtures/Certified/README.md). The archive
+recovers the selected adapter sources and fixtures; it does not include the
+complete historical Ix base checkout.
diff --git a/docs/compiler/README.md b/docs/compiler/README.md
new file mode 100644
index 000000000..3ef8d1642
--- /dev/null
+++ b/docs/compiler/README.md
@@ -0,0 +1,52 @@
+# Compiler
+
+`Ix.Compiler` contains the Ixon compiler, intermediate languages, semantic
+proofs, optimizers, and experimental x86-64 backend imported from Compilatrix.
+Its input syntax and APIs currently live under `Ix.Compiler.Ixon`.
+
+Build the library with `lake build IxCompiler`. Run its complete validation
+suite with `lake run check-compiler`. The latter builds every `compiler-*`
+executable, checks the proof and native trust boundaries, exercises byte and
+object corruption cases, compares independent artifact runs, and checks the
+benchmark analyzer. GNU `objdump`, `readelf`, and `sha256sum` are required.
+On x86-64 Linux it also uses `cc` to link and execute the native fixtures.
+
+The executable names have a `compiler-` prefix, for example:
+
+```text
+lake exe compiler-tests
+lake exe compiler-source-native-runtime -- /tmp/ix-runtime-artifacts
+lake exe compiler-benchmark -- analysis-self-check
+```
+
+Fixture inputs and reviewed expected outputs are in `Tests/Fixtures/Compiler`.
+The imported JSON fixture/report formats and lowercase `compilatrix/...` hash
+domains retain their existing compatibility meaning. Three expected rejection
+messages and two diagnostic-report hashes change with the Lean namespace.
+Canonical source/IR addresses, native object bytes, and embedded native
+provenance retain their existing identities.
+
+The benchmark runner in `Benchmarks/Compiler` retains the existing measurement
+protocol and accepts explicit comparison toolchains. Running the full comparison
+requires those external tools; the normal compiler check runs its analyzer's
+regressions. Historical measurements and generated benchmark archives are not
+part of this source import.
+
+See [the design](compiler-design.md), [current lowering restrictions](lowering-restrictions.md),
+and [trust assumptions](trusted-extern-ledger.md). These targets are independent
+of the current `ix compile` command, which exports Lean declarations to Ixon.
+
+## Provenance
+
+The import starts from Compilatrix commit
+`1c3b6fba316a210ac1f0f7541de3a1a769880374`. All 410 original library modules were
+ported from `Compilatrix` to `Ix.Compiler`, together with the tests, fixture
+producers, native durability shim, and benchmark sources. The port adapts paths,
+Lake targets, and the component trust audit to this monorepo.
+
+The monorepo uses Lean 4.33.1 and its existing Blake3.lean revision; the source
+project used Lean 4.33.0 and an older Blake3.lean revision. The complete compiler
+axiom fence is checked on the new pins. One exact expectation changes:
+`IxIR2.Lower.CheckedRun.valid` no longer depends on `Classical.choice`.
+The two imported license texts are retained in `Ix/Compiler/LICENSE-MIT` and
+`Ix/Compiler/LICENSE-APACHE`.
diff --git a/docs/compiler/compiler-design.md b/docs/compiler/compiler-design.md
new file mode 100644
index 000000000..6b552451b
--- /dev/null
+++ b/docs/compiler/compiler-design.md
@@ -0,0 +1,45 @@
+# Compiler design
+
+The compiler refines executable Ixon semantics through explicit intermediate
+languages. Its implementation and proofs live in `Ix/Compiler`.
+
+| Layer | Role |
+| --- | --- |
+| `Ixon` | Source expressions, declarations, canonical sharing, serialization, addresses, and usage checking. |
+| `IxIR0` | Erased, curried, call-by-value semantics with address-indexed globals and explicit external oracles. |
+| `IxIR1` | Calls, partial applications, heap operations, ownership worlds, and reference-count costs. |
+| `IxIR2` | Checked consuming operations, reuse credits, borrowed-call attachments, and source-pipeline refinement. |
+| `X86` | Selected bounded native families, instruction and byte semantics, encoders, object generation, and execution checks. |
+
+The public theorem inventory is checked in `Ix/Compiler/Fence.lean`. Each
+theorem's premises determine its supported source, heap, resource, and external
+oracle conditions. The presence of a backend module does not establish native
+correctness for every source program.
+
+## Ownership, borrowing, and callable values
+
+Usage annotations distinguish erased, affine, linear, and reusable arguments.
+Shared values can be duplicated through the reference-count discipline; unique
+values require exclusive ownership. Saturated calls to known functions can
+carry stronger ownership contracts than shared partial applications. Borrowed
+attachments validate their lender lifetime and resource behavior separately.
+
+### Freeze, duplication, and mixed fields
+
+The ordinary lowerer does not implicitly convert unique values into shared
+values. Such a conversion would need an explicit operation with ownership and
+cost rules. A projection or shared callable representation cannot silently
+publish an owned unique child. See the [restriction table](lowering-restrictions.md).
+
+## Identity and proofs
+
+Canonical source and IR serializations determine content addresses. The port
+preserves the existing hash domain strings and native symbol names. Hash-dependent
+identity results state their collision premises; evaluator refinements carry
+their own semantic premises. External oracles are parameters of the model.
+
+The compiler's source syntax and the consistency model's syntax are currently
+separate types. Transport from these compiler stages or the production `Ix.Kernel`
+checker to `Ix.Theory` requires additional refinement proofs. The component's
+[trust ledger](trusted-extern-ledger.md) describes the native and specification
+assumptions that remain in execution claims.
diff --git a/docs/compiler/lowering-restrictions.md b/docs/compiler/lowering-restrictions.md
new file mode 100644
index 000000000..23557ad09
--- /dev/null
+++ b/docs/compiler/lowering-restrictions.md
@@ -0,0 +1,19 @@
+# Current lowering restrictions
+
+The ordinary `IxIR0` to `IxIR1` lowerer rejects the following unsupported
+ownership and callable forms. `Ix.Compiler.IxIR1.Lower.RestrictionKind.all`
+enumerates all six cases; executable witnesses pin their diagnostics.
+
+| Restriction | Reason |
+| --- | --- |
+| No implicit freeze | A unique value cannot enter a shared argument, binding, or result without a justified ownership conversion. |
+| No general unique destructuring | Extracting a unique child must consume the parent and account for every remaining field. The separate checked unique-list endpoint handles its supported schemas. |
+| Shared, all-reusable function values | Shared partial applications duplicate their stored arguments. Saturated known calls have separate ownership contracts. |
+| No unique captures | A shared closure cannot retain an exclusively owned captured value. |
+| Mode-monomorphic ordinary recursors | The ordinary recursor representation does not carry the argument and result ownership information needed for general unique recursion. |
+| Saturated-only `recSelf` | A recursive self reference has an arity and direct-call meaning; it has no general escaping or partially applied closure representation. |
+
+The separate unique-list and borrowed-call compiler attachments validate their
+own source schemas, lifetime conditions, and resource contracts. They do not
+remove these ordinary-lowering restrictions. A rejected program has no native
+correctness claim through the rejected path.
diff --git a/docs/compiler/trusted-extern-ledger.md b/docs/compiler/trusted-extern-ledger.md
new file mode 100644
index 000000000..dbd6c0fa8
--- /dev/null
+++ b/docs/compiler/trusted-extern-ledger.md
@@ -0,0 +1,38 @@
+# Compiler trust boundary
+
+The reviewed native/build profile is typed Lean data in
+`Ix/Compiler/Tools/TrustProfile.lean`. `lake run check-compiler` validates it and
+runs mutation tests for the audit's failure paths.
+
+| Boundary | Assumption and evidence |
+| --- | --- |
+| `Blake3.Rust.hash` | The native implementation computes BLAKE3 over the supplied bytes. Runtime vectors and canonical artifact fixtures check compatibility. Address-identity theorems use explicit pairwise `Address.Blake3NoCollision` premises. |
+| `DurableSync.file` and `DurableSync.directory` | The operating system and storage honor the synchronization requests. Cache contents still pass their independent validation; synchronization supplies no logical proof. |
+| Lean and native build tools | The pinned Lean compiler/runtime, Rust toolchain, C compiler, linker, binutils, and host execute their specified operations. Their execution is outside the logical compiler simulation proofs. |
+| x86 and object models | The formal instruction, byte, ABI, and object models describe the supported target behavior. Independent disassembly, object inspection, native execution, and corruption tests supply evidence for the modeled machine boundary. |
+| External semantic oracles | Oracle functions are parameters of the interpreter and its theorems. An example oracle does not certify a linked native implementation. |
+
+The complete compiler theorem axiom inventory is enforced by
+`Ix/Compiler/Fence.lean`. Some address-dependent results include the existing
+Blake3 dependency's native proof leaf. They must not be described as depending
+only on Lean's logical axioms. Replacing this boundary requires a pure hash
+specification and a refinement proof for the implementation.
+
+The audit inventories every Lean file under the declared compiler library,
+test, and benchmark roots. It rejects new project axioms, proof holes, native
+decision tactics, unreviewed imports or qualified native entry points, changed
+extern inventories, and changes to the reviewed compiler Lake section. It
+checks both durability C exports and the source hash, all 12 Blake3 package
+externs (including the unimported C module), the complete Cargo lock hash and
+package identities, the Lean pin, and matching Blake3 Lake/Nix revisions.
+
+This is a compiler-component audit. The monorepo's other dependencies, CI action
+versions, and global Nix build configuration remain governed by the monorepo's
+existing build and review process. The standalone Compilatrix whole-repository
+Nix/CI integrity ledger is not a claim about this monorepo. The runtime and
+proof gates are exposed as separate CI jobs here.
+
+The current profile uses Lean 4.33.1, Blake3.lean
+`78f5bc4b22de1172af8a5d91e7039128084fad3a`, BLAKE3 1.8.7, and lean-ffi
+`93c7e52952ae94546be08313f4ff3922984c84d5`. Dependency updates require reviewing
+the profile, theorem axiom fence, and compatibility fixtures together.
diff --git a/docs/ix_canonicity.md b/docs/ix_canonicity.md
index 0616e2197..bdaa5bc19 100644
--- a/docs/ix_canonicity.md
+++ b/docs/ix_canonicity.md
@@ -1490,7 +1490,7 @@ this rule closes that gap.
 **The quotient.** Universe-level spellings are presentation, not
 content. Two levels are identified in canonical form exactly when the
 kernels' semantic level equality holds — `univEq`
-(`Ix/Tc/Level.lean`), the relation all three kernels decide during
+(`Ix/Kernel/Level.lean`), the relation all three kernels decide during
 defeq. `univEq`'s normal-form comparison ignores EMPTY subsumption
 entries (constant 0, no vars — bookkeeping the subsumption pass
 leaves behind rather than removing; `normLevelLe` always ignored
@@ -1518,7 +1518,7 @@ unnormalized substitution results).
 
 **Canonical representative.** `canonUniv : Univ → Univ` is
 `linearize ∘ subsumption ∘ normalizeAux` — the kernels' Géran
-comparison form (`normalizeLevel`, `Ix/Tc/Level.lean:227-472`;
+comparison form (`normalizeLevel`, `Ix/Kernel/Level.lean:227-472`;
 `crates/kernel/src/level.rs:335-696`;
 `Ix/IxVM/Kernel/Levels.lean:336-386`), transliterated to positional
 `Ixon.Univ` and then linearized back into a level term. The Géran
@@ -1556,7 +1556,7 @@ tests in both languages:
 - **P5 (mirror parity):** Rust and Lean `canonUniv` agree
   byte-for-byte on serialized output.
 - **P6 (mk\* absorption):** `canonUniv ∘ reduceIxonUniv = canonUniv`
-  (`reduceIxonUniv`, `Ix/Tc/Ingress.lean`, is the retained oracle
+  (`reduceIxonUniv`, `Ix/Kernel/Ingress.lean`, is the retained oracle
   for this).
 
 `canonUniv` lives next to the wire type (`crates/ixon/src/univ.rs`
@@ -1565,13 +1565,13 @@ and probes share one implementation per language; the three kernel
 `NormLevel` implementations stay untouched as the P4 oracle. Worst
 case, canonical forms are exponential in nested `imax`-of-`max`
 depth (the Géran distribution rules duplicate the left subterm,
-`Ix/Tc/Level.lean:333-351`); real levels are a handful of nodes, and
+`Ix/Kernel/Level.lean:333-351`); real levels are a handful of nodes, and
 the blowup is paid once at compile time by whoever writes a
 pathological spelling — never by readers of stored canonical forms.
 
 **The kernel-rebuild rule set.** The `mk*` simplification rules —
 Lean `kernel/level.cpp:81-103`/`:112-120`, mirrored at
-`Ix/Tc/Level.lean:144-197`, `crates/kernel/src/level.rs:162-247`,
+`Ix/Kernel/Level.lean:144-197`, `crates/kernel/src/level.rs:162-247`,
 `Ix/IxVM/Kernel/Levels.lean:637-680` — are normative here in three
 roles: the P3 fixpoint target (kernel ingress rebuilds through them),
 the stage-1 decoration-presence test (below), and the P6 oracle.
@@ -1601,7 +1601,7 @@ They are **not** the address quotient (they miss commutative twins).
 | I6 | otherwise raw `imax a b` | — |
 
 with predicates `isZero` / `isExplicit` (`succ^n zero`) /
-`isNeverZero` / `offset` exactly as in `Ix/Tc/Level.lean:64-95` /
+`isNeverZero` / `offset` exactly as in `Ix/Kernel/Level.lean:64-95` /
 `crates/kernel/src/level.rs:111-150`. Both rule sets — `mk*` and the
 Géran linearization — are **frozen** at the pinned toolchain's
 behavior; upstream drift mints new spellings, which simply
@@ -1663,11 +1663,11 @@ class as binder names, and is caught by the strict roundtrip gates).
 one kernel-side consumer: the original spelling rides as a
 **decoration** on meta-mode `sort`/`const` occurrence nodes — folded
 into the metadata-aware `metaAddr` (so interning and egress
-memoization never collapse spelling twins, `Ix/Tc/Expr.lean:61-72`)
+memoization never collapse spelling twins, `Ix/Kernel/Expr.lean:61-72`)
 and **never** into the semantic `addr` (anon/meta address parity,
 `tc-meta-addr`, is preserved; checking never sees spellings). Meta
 egress replays the decoration at its `sort`/`const` arms
-(`Ix/Tc/EgressLean.lean:119-128`) instead of egressing the
+(`Ix/Kernel/EgressLean.lean:119-128`) instead of egressing the
 normalized kernel level. Decorations must not live on `KUniv` nodes
 — KUniv interning is semantic-address-keyed and would collapse
 spelling twins first-wins, the same lossiness as table-keyed
@@ -1677,7 +1677,7 @@ comparison and is an active spelling-fidelity gate through the
 kernel's data path, complementing the decompiler gate (phase 5).
 With stored content canonical, the anon roundtrip comparison is
 strict too (the `reduceIxonUniv` modulo in `canonExpr` was deleted;
-`Ix/Tc/Egress.lean` module doc).
+`Ix/Kernel/Egress.lean` module doc).
 
 **Decoration source.** Patches are the primary source: meta ingress
 looks the occurrence's (post-mdata) arena index up in `univPatches`
@@ -2309,13 +2309,13 @@ Phase 2 paths already were). Remaining audit items:
   `restoreLeanSourceNameHints` / `restoreSourceNamesSameContent` in
   `Ix/AuxGen/Kernel.lean`) match arm-for-arm; what diverged — and
   produced the Mathlib redStep instance — was the **key
-  equivalence**: the Lean side keys hints by `Ix.Tc.KExpr` content
+  equivalence**: the Lean side keys hints by `Ix.Kernel.KExpr` content
   addresses, while the Rust side keyed by `KExpr::hash_key()`, which
   is an intern-assigned uid, fresh for every un-interned
   `to_kexpr_static` construction — so no restore-time key ever
   matched a collect-time key and the Rust hint pass restored nothing.
   Originally fixed by `kexpr_content_key` (a pure name-erased structural
-  digest mirroring the `ExprKey`/`Ix.Tc` equivalence) and by making the
+  digest mirroring the `ExprKey`/`Ix.Kernel` equivalence) and by making the
   WHNF no-op test structural (`==`) rather than uid equality. The hint
   pass now uses exact, pass-local structural identities instead of that
   digest, with full shallow-key equality on hash collisions. Any future
@@ -2378,7 +2378,7 @@ pipelines; decompile patch replay; the decoration source switch to
 patches (stage-1 rule retained as the patchless fallback); phase 3
 strict; `univEq` empty-entry-insensitive (the exact semantic
 quotient, §10.6); primitive pins regenerated in all mirrors
-(`prim_addrs.rs`, `Ix/Tc/Primitive.lean`, the IxVM address
+(`prim_addrs.rs`, `Ix/Kernel/Primitive.lean`, the IxVM address
 literals); artifacts regenerated with the format-break hint.
 
 **Acceptance evidence:** `ix validate` and `ix validate-lean` at
diff --git a/docs/kernel-verification.md b/docs/kernel-verification.md
new file mode 100644
index 000000000..f42b3247c
--- /dev/null
+++ b/docs/kernel-verification.md
@@ -0,0 +1,1573 @@
+# Kernel verification
+
+`Ix.Kernel` is the production Lean checker. `Ix.Kernel.Verify` contains its
+implementation proofs; `Ix.Compile.Verify` contains the Lean-to-Ixon compiler
+proofs. Their named specification and reference implementation lemmas are local
+under `Ix.Theory.Named`. Building or checking them requires no external
+formalization repository.
+
+The named development retains the 104 source modules needed by the existing
+proof dependency graph, including the inductive fixtures consumed by Ix.
+Standalone applications, benchmarks, and unrelated tests are excluded. Its
+original source hashes and attribution are recorded in `Ix/Theory/Named/NOTICE`
+and `Tests/Theory/NamedManifest.lean`; the Apache license is preserved alongside
+the sources. The added axiom-audit helper is authored in Ix.
+
+## Connection to the consistency model
+
+The name-indexed specification and the set model use the same
+`Ix.Theory.VLevel`. The set model and its foundational audit remain independent
+of the named development. Mathlib is confined to the separate
+[set-theory model package](../Models/SetTheory/README.md).
+
+`Ix.Kernel.Verify.Consistency` proves the following direct connections:
+
+- Production universe equality and ordering agree with model evaluation,
+  under the existing finite address-faithfulness and arithmetic bounds.
+- A structural reader maps kernel expressions to model syntax, resolves
+  addresses to explicit store references, preserves projections and natural
+  literals, and substitutes let values. Free variables, unresolved addresses,
+  and string literals are outside the current reader's domain.
+- Hash equality and intern-table reuse preserve that reading under their
+  stated address/key collision assumptions. Metadata cannot change it.
+- `inferUncached_sort_sound` interprets an actual successful execution of the
+  production sort-inference branch. It proves the model typing postcondition
+  for the returned type, including intern-table reuse.
+- `ModelTyping.no_false` rules out a closed model-typed kernel expression at
+  primitive False when its environment has been admitted by the certified
+  interface and the set-theory assumption has an instance.
+
+The last theorem assumes semantic typing; it does not assume or prove that
+arbitrary checker success supplies it. A complete checker consistency theorem
+still requires the remaining inference/conversion cases, cache invariants,
+address-to-store resolution, and declaration admission to establish that
+postcondition for `checkEnvAnon`. The existing named-calculus proofs are retained
+to support this refinement, rather than being treated as a set-model proof.
+
+## Trust checks
+
+The audits traverse checked declaration types and bodies, including inductive
+constructors. They compare exact axiom sets and record direct origins of
+`sorryAx`; they do not rely on cached imported axiom summaries. During the
+migration, full traversal of the original sources exposed two wrapper reports
+that listed 3 axioms but depended on 30. Their boundaries now include the
+existing implementation assumptions and unfinished metatheory. All 441 retained
+named-specification assertions use the original full dependency graphs as their
+migration baseline.
+
+The same traversal covers 2,034 kernel manifest roots. Thirteen entries omitted
+logical or native dependencies through constructor fields; their corrected
+boundaries were checked against freshly compiled pre-migration sources. Direct
+dependency lookups are cached within a fixed environment, while each root's
+reachable declarations, axioms, and proof-hole origins are computed separately.
+
+`Ix.Kernel.Frontier.Pending` quarantines the remaining explicit metatheory
+axioms. Completed roots cannot depend on that namespace. Named-specification
+proof holes and implementation bridge axioms are tracked separately from
+Lean's logical axioms and generated native proofs. No direct consistency root
+permits a proof hole or a metatheory/implementation bridge axiom. Both the
+context hash and content-address hash now use kernel-checked proofs of their
+32-byte output bounds on both platform sizes. Their former generated native
+assumptions have been removed from the affected exact audits.
+
+Run:
+
+```sh
+lake build IxKernelVerify IxCompileVerify
+lake build --wfail IxKernelConsistency
+lake run check-theory
+lake test --wfail -- tc-unit
+```
+
+The consistency target checks 18 exact theorem boundaries. Its remaining
+native assumptions are explicitly named proofs reached through production
+smart-constructor code; the model's no-False theorem itself uses only
+`propext`, `Classical.choice`, and `Quot.sound`, with set theory as a hypothesis.
+
+## Certified host adapters
+
+The cumulative C2–C7 source and claim adapters are maintained under
+`Ix.Certified`, with explicit certified entry points in `Ix.Kernel`.
+`ClaimCommand.run_meaning` connects successful source validation to the exact
+versioned envelope and its semantic meaning. A closed logical receipt
+constructs its model and excludes a checked subject of the profile's false
+type under the set-theory hypothesis.
+
+Run `lake run check-certified` for the exact 86-root foundation audit and
+native/CLI regressions against the locally preserved C7 evidence. The audit
+permits only the three standard Lean axioms in these roots and inventories
+the separate BLAKE3 and native execution boundaries. See
+[the command interface, theorem contracts and evidence](certified-checking.md).
+
+These host results do not cover the full production inference dispatcher or
+prove that an Aiur public verifier executes the C5–C7 validator. The imported
+C2 VM pilot still uses host-decoded inputs and declines modeled witnesses.
+
+## Aiur lookup activity
+
+Aiur's function and memory circuits require inactive rows to have zero lookup
+multiplicity. The function constraint uses the sum of the circuit's member
+selectors, so it covers both singleton and grouped circuits:
+
+```text
+return_multiplicity * (1 - circuit_activity) = 0
+memory_multiplicity * (1 - is_real) = 0
+```
+
+Lookup multiplicities remain linear. Active rows retain their previous
+behavior. Without the function constraint, a supplied inactive row could
+disable multiplication constraints while providing an incorrect public result.
+The regression in `crates/aiur/src/synthesis/tests/acceptance.rs` constructs
+trace rows independently of the honest evaluator, produces a proof of
+`3 * 5 = 16`, and requires `AiurSystem::verify` to reject it. Additional tests
+cover each grouped member, inactive rows, zero padding and memory widths
+1, 4 and 8, including positive and negative field multiplicities. Honest
+grouped and memory executions must still verify.
+
+The new constraint roots change serialized verification keys. Deployments
+must regenerate their keys and update permitted key identities, including
+recursive aggregation. An old serialized key still describes the old
+constraints; rebuilding application code does not repair that key.
+
+Run `cargo test --locked --release -p aiur -- --test-threads=1` to exercise
+the repair. This closes the activity/multiplicity counterexample; full
+compiler/AIR reflection and public acceptance-to-model soundness remain open.
+
+## Aiur call order
+
+Function lookups also bind a 48-bit rank. Each active row supplies six
+little-endian bytes, checked against the preprocessed Bytes2 table. A
+constrained call supplies the callee's rank and six range-checked gap bytes:
+
+```text
+callee_rank - caller_rank - 1 - gap = 0
+```
+
+The caller and callee ranks and the gap are below 2^48. These bounds prevent
+field wraparound and force strict increase along constrained calls. The
+return lookup includes the row's packed rank, so the callee must use the
+rank requested by its caller. The public entry rank is zero; the lookup
+fingerprint's existing trailing-zero padding preserves the public message
+encoding.
+
+This closes a separate circular-justification case: an active row for
+`f(x) = f(x)` could previously supply both its own call and a public result,
+despite having no finite execution. Supplied-witness tests require self-calls
+and mutual cycles to reject, including grouped circuits and out-of-range
+rank or gap bytes. Honest finite recursion, shared callees and promotion of
+unconstrained calls still verify.
+
+The honest executor assigns ranks from reverse function completion order,
+with the final entrypoint at rank zero. It records one extra eight-byte
+timestamp per function query and permits at most 2^48 completion events.
+Function rows require six extra auxiliary columns and three byte-range
+lookups; each constrained call requires seven extra columns and three extra
+byte-range lookups. Grouped members share the row-rank columns. Verification
+keys must be regenerated for these constraints.
+
+`Ix.Aiur.Proofs.CallOrder` proves the byte-packing bound, strict field order
+and well-foundedness of any call relation satisfying the bounded constraint.
+These are arithmetic and relation theorems.
+
+`Ix.Aiur.Proofs.Lookup` recovers the byte bounds from exact lookup balance
+against the fixed 256-by-256 byte table, with arbitrary field multiplicities
+in the table. It proves that every unit-weight query has a nonzero provider
+when the total number of queries is below the field characteristic, then
+uses the three byte-pair queries for each rank to establish strict call
+order. The count bound is necessary: a separate theorem shows that exactly
+one characteristic's worth of identical queries has zero field weight even
+without any providers.
+
+Exact message balance, query-count bounds and identification of these
+mathematical queries with the native emitter remain explicit premises.
+Extracting them from public verifier acceptance remains part of full C8.
+
+## Aiur compiler and verifier components
+
+`Ix.Aiur.BoundVerifier` binds verification to a caller-selected source program,
+explicit circuit grouping, entrypoint and function index, input arity, expected
+output, commitment/FRI parameters, and complete verification key bytes. It
+compiles that selection and checks the actual system's key. Submitted proof
+bytes pass through checked parsing before the stored system verifies the
+caller's statement. Environment grouping overrides cannot change this path.
+Construction also checks constrained-call and continuation-yield arities and
+checks every entrypoint return against the selected success output size.
+
+Zero-padded function messages need these arity checks because inputs, outputs
+and the final call-order rank have no length separators. A supplied native
+trace for an empty return at rank seven previously verified against a public
+claim containing one output, seven. The message for that empty return was
+identical to the claimed output followed by the omitted zero root rank.
+The native verifier now validates the claim's channel, function visibility
+and input/output widths before checking the proof. Native construction and
+the selected-key builder also reject incompatible constrained-call arities.
+The regression now rejects the supplied claim. This validation repair adds
+no AIR columns or constraints.
+
+The proofs under `Ix.Aiur.Proofs` establish these component contracts:
+
+- The field activity constraint forces inactive-row multiplicity to zero.
+  This arithmetic theorem does not establish all Rust AIR constraints.
+- The Goldilocks modulus is prime, proved from 32 kernel-checked modular
+  squarings and a divisor argument. No native-evaluation axiom or external
+  primality oracle is used. Products have no zero divisors, so selector and
+  `eq_zero` polynomial equations imply their semantic values. Active case and
+  default equations imply equality and disequality of the matched key.
+- A boolean selector sum activates at most one branch when its number of
+  summands is below the characteristic. An active sum contains exactly one
+  active occurrence, and an inactive sum contains none. A full-characteristic
+  cancellation counterexample shows why the size bound is needed.
+- The range-bounded call-order constraint forces strict rank increase and
+  a well-founded call relation.
+- Exact lookup balance with bounded query counts supplies matching providers
+  and recovers the rank-byte bounds from the fixed byte table.
+- Zero padding preserves exact message balance when the channel and function
+  arities determine each active message's length. Zero-weight providers need
+  no shape condition. Channel filtering preserves balance, and function and
+  memory encodings recover the typed requests. A checked counterexample
+  demonstrates the output/rank ambiguity when arities differ.
+- The total return-size validator implies the output arity of every local
+  execution, including early returns from match arms. The call-shape
+  validator implies that every emitted constrained call uses its callee's
+  input and return widths. The selected backend retains both validation
+  proofs and produces public claims of the checked shape.
+- Exact byte-chip lookup balance supplies both input ranges and operation
+  outputs for all 13 byte channels. Addition and subtraction also recover the
+  virtual carry/borrow outputs omitted from their lookup messages. The step
+  theorems produce the corresponding relational bytecode operations.
+- The four-byte comparison gadget's range and boolean-carry equations imply
+  its strict unsigned comparison result. Its proof derives an integer carry
+  identity and both input bounds, including equality and wraparound cases.
+- Locally interpreted function rows, exact function/byte lookup balance and
+  bounded query counts imply finite relational executions for every public
+  request. Matching callees are derived from nonzero providers, and the rank
+  equations justify induction; callee termination is not assumed. The local
+  row interpretation and shared memory facts still need extraction from the
+  native AIR.
+- One mixed, padded lookup pool now supplies function providers, immutable
+  memory facts and all 13 byte operations. Its channels separate the four
+  provider families; structural return checks prevent padding aliases without
+  requiring a uniform arity table for functions that never return. Checked
+  call shapes propagate along reachable calls. Rank and gap bounds from the
+  same pool then give finite executions for the selected backend's success
+  request. Circuit witnesses now supply the locally valid function rows.
+  Native row reflection, padded balance, and the global consumer count and
+  message-width bounds remain explicit obligations.
+- The native verifier checks a conservative global consumer budget: one
+  public claim plus every lookup slot in every active trace row. It checks
+  active-position degree indexing, sequence lengths and arithmetic overflow,
+  and requires the sum below the characteristic. The total Lean model proves
+  this count bound and its converse. It also proves that version-five keys'
+  16-bit circuit/slot limits fit the budget at the maximum Goldilocks trace
+  height of `2^32`; the guard preserves proofs within those existing limits.
+  Canonical circuit traces now derive the number of emitted unit consumers
+  within those slots. Each active trace has exactly `2^degree` row assignments,
+  and its bitmap and degrees follow canonical and active order respectively.
+  The checked global budget supplies the count bound used by backend
+  execution. Native accepted-proof metadata and trace extraction remain open.
+- Shared lookup arguments recover the uniquely selected padded message even
+  when inactive branches contribute different message lengths. Continuation
+  merge equations similarly recover the selected yield's values. The
+  branchless optimization now requires one function with terminal control
+  and one selector. Its single-writer property is proved from that check.
+- Selector equations computed over the actual bytecode tree conserve returns
+  and escaping yields through nested continuations. Each continuation consumes
+  its nearest yields; early returns bypass it. With the existing shape check,
+  the function has no escaping yields, and a nonzero provider multiplicity
+  selects one return under the terminal-count bound. The emitter gates a
+  continuation with its yield sum; a separate proof uses the link equation
+  to identify these actual return gates with the leaf selectors. Native
+  expression, argument-value and layout reflection remain obligations.
+- Active case/default equations select a matching arm of the actual bytecode,
+  retaining its selector constraints for recursive extraction. The number of
+  arms must be below the field characteristic.
+- Valued emission of all 34 operation forms tracks logical values, expression
+  degrees, constant folding, auxiliary columns, polynomial values and raw
+  lookup contributions. Active satisfying emissions give relational operation
+  steps and sequences using the global pool's byte and memory facts. Every
+  recorded constrained call retains its function query, gap range queries and
+  rank-order equation. Native expression reflection and index/layout validity
+  remain explicit obligations.
+- Whole-block valued emission composes those operation steps with case/default
+  selection, early returns and nonempty continuation merges. Its selector
+  equations follow from the emitted polynomials. The resulting execution
+  preserves the original function inputs and tracks every selected call's
+  query and rank constraints. Function extraction derives local row validity
+  and identifies the combined return message with the same semantic call.
+  Count bounds and valid layouts remain explicit; these are theorems about the
+  valued model, with native refinement still open.
+- Shared lookup slots have at most one active query. The proof follows their
+  allocated intervals, branch selector equations and continuation cursors.
+  Slot multiplicity is zero or one; each active combined message equals the
+  uniquely decoded query after padding. Decoding preserves exact padded
+  balance and emits at most one query per slot. Function-row validity uses
+  this computed query pool without a separate raw-query membership premise.
+  The circuit count validator establishes the single-return condition;
+  the checked branchless predicate establishes unique consumer-slot writers.
+- The complete valued circuit model includes member selector offsets, shared
+  multiplicity and rank columns, header constraints and the physical return
+  slot. A satisfying circuit with nonzero multiplicity selects an actual
+  program function and yields a valid function row. Its inputs, rank and
+  multiplicity agree with the circuit, its padded return message encodes
+  that same call, and all selected call and rank-byte queries occur in the
+  computed circuit pool. This covers singleton and grouped circuits, with
+  native refinement and the explicit shape/layout conditions still open.
+- Total control counts bound branch arities, continuation joins and return
+  counts for every selector assignment. Both native system construction and
+  the Lean binding builder check circuit membership and these count bounds,
+  including consumed yields in the selector budget. A constructed backend
+  retains the successful check. It discharges the four count/single-return
+  premises of the circuit execution theorem; physical column, index and
+  lookup-cursor correctness remain separate.
+- Complete circuit witnesses now produce the locally valid function table
+  used by finite execution extraction. A preliminary provider-only table
+  supplies byte and memory facts; the final table's row validity is proved
+  from each circuit's equations. Matching nonzero padded provider messages
+  preserve global balance through both constructions, including arbitrary
+  field multiplicities and zero-weight rows.
+- Encoded circuit consumer slots have the same padded messages and count as
+  the decoded pool. Their message widths bound decoded widths. Together with
+  physical return providers, this gives execution of the selected public
+  success call from valued circuit witnesses and encoded lookup balance.
+  Native witness extraction and cryptographic reduction remain separate.
+- Memory-table activity and pointer-increment constraints give a unique
+  contents value for each width and pointer when table height is below the
+  field characteristic. Exact lookup balance then makes store/load requests
+  consistent. Initial pointers may be arbitrary and may wrap in the field.
+  The separate query-count bound prevents cancellation of requests; a checked
+  full-cycle counterexample shows why the height bound cannot be discarded.
+  The polynomial interface derives boolean selectors from their equations.
+- Successful compilation returns the exact artifact built from its actual
+  inlining, checking/simplification, concretization and lowering stages.
+- Total recursive bytecode comparison reflects exact syntax equality,
+  including layout metadata and nested continuations. This supplies lawful
+  keys for the deduplication hash maps.
+- Tail-match restoration preserves the complete source evaluator result,
+  including errors, early returns, memory and I/O, at unchanged call fuel.
+  The helper and the source evaluator's memory-key hash are total definitions.
+  Inlining expansion and let hoisting still need their own proofs.
+- Splitting and combining leading let frames preserves the complete source
+  result. Moving a return across those frames and sequencing I/O, assertion
+  and debug continuations with wildcard lets also preserve it. Call modes
+  have identical source evaluator meaning. These identities do not establish
+  fresh-name correctness or preservation of the complete normalization pass.
+- Deduplication validates every proposed function renaming against the full
+  rewritten bodies, layouts and call domains. Invalid candidates retain the
+  original program. The pass preserves and reflects successful reference
+  execution at every fuel, including memory, I/O and early returns; its proof
+  makes no correctness assumption about partition refinement.
+- Final reachability metadata and circuit partition construction preserve
+  reference bytecode execution. Their combination with checked deduplication
+  preserves success at the actual remapping of each original function index.
+- Successful explicit grouping preserves the source, name map, function
+  array and memory sizes. It therefore preserves reference execution for
+  every function, input, initial I/O state and fuel value, including errors
+  and final I/O state.
+- `BoundVerifier.Backend.execution_reflects_raw` combines grouping, final
+  metadata and checked deduplication: successful reference execution of the
+  selected backend reflects to the same named function in the actual lowering
+  output. The proof recovers its original index from the compiler's name map.
+- `BoundVerifier.verify_success` extracts input-arity agreement, successful
+  checked proof parsing, and acceptance of the selected statement by the
+  stored native verifier.
+
+Run `lake run check-aiur` to build the component proofs and native tests with
+warnings treated as errors, compare the complete audit report against
+`Tests/Aiur/backend-foundation.txt`, and exercise the native verifier binding.
+CI runs the same check. Native bytecode comparison and hashing must reproduce
+the output captured from the original compiler derivations: 395 fixtures,
+156,025 comparisons and every operation constructor. Deduplication tests
+retain complete original syntax and index-map snapshots for 23 programs,
+reject 14 altered candidates with the original program as fallback, and
+exercise merged execution through early returns, continuations, memory and
+I/O. Explicit default lookups avoid native panic diagnostics for invalid
+callee indices. Native tail-match restoration reproduces 281 original syntax
+snapshots, and source-value hashing reproduces 99 original hash values.
+Nine compiler regressions compare both source evaluators with reference and
+native bytecode execution. They cover argument and continuation effect order,
+lexical shadowing, and the call boundary of an inlined callee with an explicit
+return. Argument normalization uses distinct local names and sequences each
+argument completely; callees containing explicit returns retain normal calls.
+The source reference also evaluates debug arguments before their continuations,
+preserving their effects and early returns.
+These repairs have regression coverage; their full preservation proofs remain
+open.
+The binding tests accept
+multiplication and grouped programs and reject 15 mutations of the selected
+program, statement, grouping, parameters, key or proof bytes.
+Supplied native equality-test witnesses accept zero and nonzero inputs with
+correct outputs and reject three forged outputs. Direct native expression
+checks cover 108 combinations of input, selector, output and inverse advice,
+including unconstrained inactive rows and nonboolean function/memory selectors.
+The component gate also compares every native preprocessed byte-chip column,
+lookup argument and multiplicity-column mapping with Lean: 65,792 rows,
+656,128 lookup messages and 34,664,621 bytes, generated in a temporary
+directory. Native tests exhaust all 131,072 addition/subtraction input pairs
+and accept seven supplied 32-bit comparison witnesses while rejecting three
+that isolate carry, decomposition and byte-range constraints.
+The gate also compares 21,556 native and Lean structural checks across return
+sizes, constrained and advice calls, nested continuations, visibility and
+public-claim widths. All 54 parallel release Rust tests pass, including the
+supplied rank/output ambiguity regression; release Clippy denies warnings.
+
+The audit checks 1,544 roots by traversing checked types, bodies and inductive
+constructors. Fifty-seven roots use no axioms; one uses only `Quot.sound`;
+245 depend only on `propext`; 470 use exactly `propext` and `Quot.sound`;
+the other 771 use exactly
+`propext`, `Classical.choice` and `Quot.sound`. The combined closure
+has 20,298 logical declarations and 21,114 declarations after following runtime
+workers and replacements. The frozen report records four native runtime entry points,
+three partial opaque sources and all 196 Ix recursion worker implementations.
+Bytecode comparison/hashing, tail-match restoration and source-value hashing
+use total definitions. Type hashing and type/pattern formatting remain partial.
+These remaining implementations and
+foreign runtime are inventoried without a refinement proof. Lean/Std runtime
+primitives remain outside this project-specific runtime inventory. The report
+also freezes the rank bound, packing, polynomial, compiler layout, exact
+lookup balance, byte-table definitions, bytecode comparison/hash instances,
+the checked deduplication definitions, tail-match restoration and source-value
+hash instance, and the argument normalization and inlining entry points.
+It also freezes the relational operation/control semantics and the function
+row, request, provider and byte-query definitions.
+The memory row/transition, validity, provider and immutable-fact definitions
+and the symbolic full-cycle counterexample are frozen too.
+The modular-squaring certificate, both selector polynomial forms, selector
+summation order and memory polynomial interface are also frozen.
+The byte channels, fixed rows, lookup messages/providers, bytecode operation
+mapping, inverse-of-256 constant and four-byte carry-chain definitions are
+frozen as well. Padding, channel-width schemas, typed message encodings and
+all structural validator definitions are frozen. The backend constructor is
+strengthened by checked entrypoint return arity, program lookup shapes and
+circuit control counts;
+the mixed lookup provider table, balance/count/width interface and range-query
+encoding are frozen too, together with the total slot-sum and query-budget
+definitions. The shared-message, selector-flow, return-gate, valued operation
+emission, call-inventory and branch-polynomial definitions are also frozen.
+The whole-block emitter, projection, execution premises, input preservation
+and function-row interface are frozen as well, together with slot intervals,
+active counts, message combination/decoding and the computed query pool.
+The circuit/member emitter, physical lookup encoding, circuit query pool,
+source-membership interface and layout-width definition are frozen too.
+Control-count definitions, the guarded backend builder, provider-table
+construction and circuit witnesses are also frozen, together with the
+branchless predicate, unique-writer interface and encoded circuit pool.
+Canonical circuit traces, their metadata and emission are frozen, together
+with four recursion workers whose safe source definitions are checked.
+Compiler and grouping invariants establish that every circuit member is a
+constrained function. These discharge witness shape validity from the selected
+backend's checked program. `LookupLayout` also proves that the compiler's
+physical lookup allocation equals the valued emitter's extent, including
+nested branches and continuations. Renaming and deduplication preserve the
+count; singleton and grouped circuit layouts bound every member. The backend
+trace execution theorem therefore requires no separate witness-shape or
+lookup-limit hypothesis. The singleton circuit constructor, membership and
+lookup-bound predicates, and total lookup-count definitions are frozen as well.
+`MemoryColumns` decodes the native memory layout, four polynomial equations
+and selector-scaled lookup. Satisfied canonical memory traces supply valid
+rows and equivalent weighted providers. Compilation gives distinct canonical
+memory widths; the checked global trace budget bounds table heights and
+establishes functional memory. `Backend.memory_trace_execution` therefore
+requires no independent memory-validity or canonical-width premise. The
+memory comparison checks 1,800 native/Lean assignments over five widths and
+five heights, including empty tables, cyclic next-row openings, final-row
+transition gates, wrapping pointers, invalid selectors and inactive advice.
+`ByteColumns` identifies all thirteen physical byte lookup slots with the
+logical fixed-table providers, including their differing enumeration order.
+The native Aiur verifier now checks that fixed preprocessed tables are active
+and have the exact committed heights before entering the cryptographic
+verifier. Its total Lean counterpart recovers byte degrees 8 and 16 from
+canonical and active-order metadata. All 17,910 guard comparisons match;
+the exhaustive byte corpus now evaluates the physical column lookup model.
+The guard adds no AIR expression or key-format change. `SystemTraces` combines
+function, memory and byte columns with their exact metadata and global budget.
+`Backend.column_trace_execution` derives the selected public execution from
+satisfaction and padded balance of these columns. Native extraction must still
+establish those conditions for an accepted proof.
+`ExpressionGraph` models the native node syntax and checked graph layout.
+Valid layouts have bounded leaf/root indices, children before parents and no
+stage-two column reads in the lookup prefix. Both forward sweeps are defined;
+their shared values and extracted lookups agree. Unfolding produces expression
+trees with the same evaluation for arbitrary working operations. The codec's
+root-derived lookup prefix may be shorter than the compiler's stored prefix
+after constant folding; the native corpus checks that both give the same
+lookup values. All 88,228 layout cases and 240 assignments across ten actual
+native graphs match Lean, including all 8,016 node values, constraint roots
+and lookup messages. The corpus uses the existing v5 node encoding.
+The native key decoder now validates graph reads before degree recomputation,
+checks degree overflow and verifies the combined maximum degree. Its focused
+regression originally panicked on a self-reference and now returns an error.
+This decoder currently has no production callers in the workspace; key
+serialization is the connected path. The parser, Rust execution, frontend
+compilation and acceptance-to-satisfaction reduction still require refinement.
+That checkpoint preserved all 308 earlier root statements and axiom sets,
+318 premise definitions and 146 worker bodies byte for byte; it added 30 roots,
+58 frozen definitions and four safe-source graph workers. The preceding branchless
+repair's reviewed emitter change remains frozen. The concrete failures and
+repairs are recorded in the [Aiur bug inventory](aiur-bug-inventory.md).
+`FrontendExpressions` models the native smart constructors and proves their
+evaluation laws, including constant folding and double-negation cancellation.
+The proof works for any compatible working operations; the algebra laws are
+proved for Goldilocks. A preserved check excludes negated constant children,
+which is needed to identify syntactic constant flags after subtraction.
+Expression degrees remain independent of those flags.
+The addition, subtraction, multiplication and equality-test emitters now reflect
+the valued operation model, including output metadata, allocated columns and
+every equation. The reflection theorems require reads only from allocated
+columns. The native corpus compares 1,752 exact smart-constructor trees and
+9,804 actual scalar emissions at four assignments each, for 46,224 matching
+evaluations. It includes raw negated constants outside the invariant and
+degree metadata zero, one and two. That 388-root audit preserved all 338 earlier
+root statements and axiom sets, 376 frozen definitions and 150 worker bodies.
+It added 50 roots, 23 definitions/constructors and the total negation-check worker.
+`GraphCompilation` extends reflection through the native base graph's structural
+sharing, sorted commutative operands, equal-id subtraction and constant folds.
+Every compilation step preserves previously assigned node values. Successful
+base compilation preserves constraint satisfaction in both directions, including
+dropped zero constants and sorted, deduplicated roots. Compiled lookup
+multiplicities and arguments equal the original expressions in their original
+order. These results hold for compatible working algebras, with the additional
+commutativity and self-subtraction laws proved for Goldilocks.
+The native corpus compares all nodes, degrees, root ids and stored lookup
+prefixes in 1,484 actual base graphs. All 38 rejected source specifications,
+11,872 assignments and 86,680 node values match Lean. Invalid children remain
+rejected even inside raw multiplication by zero or equal-expression subtraction.
+The 425-root audit preserves all 388 earlier statements and axiom sets, all 399
+frozen definitions and all 151 prior workers. It adds 37 roots, 31 frozen
+definitions/constructors and four total recursion workers. The native release
+suite passes 63 tests and release Clippy; the strict 140-job proof/test build
+and complete component gate pass with fourteen native comparison corpora.
+The graph model uses natural-number indices and a linear structural interner.
+Rust execution and hash-table refinement, machine bounds, extension-coordinate
+expansion and native acceptance-to-satisfaction
+reduction remain open. Aiur's native system builder supplies no user extension
+constraints: its function, memory and byte circuits all use the base graph.
+
+`OperationExpressions`, `OperationReflection` and `OperationSequences` cover all
+34 operation forms and complete operation lists. Successful symbolic emission
+and evaluation of the incoming value map derive the entire valued emission:
+output expressions and tracked metadata, fresh-column cursor, equations, raw
+queries, and call records with their six rank-gap expressions. The normal-form
+invariant is preserved across every output and sequence. Fresh reads are
+required only for allocated columns, with the sequence theorem requiring
+exactly the consumed interval. Selector values need not be Boolean for this
+reflection. Checked incoming indices still have to be connected to the native
+store's reads after its pointer is appended.
+
+`LookupExpressions` proves selector gating and argument accumulation evaluate
+to the existing physical-slot multiplicity and message definitions. It covers
+unequal message widths, empty slots and repeated writers, in emission order.
+Its expression lookups feed the checked base-graph compiler. The native corpus
+provides the actual operations, incoming trees and assignments; all 1,752
+sequences, 7,008 assignments and 438 cases with shared slots match. It checks
+exact output and constraint trees, independent degree metadata, both cursors,
+and the full combined lookup expressions under both gating modes.
+The 520-root audit preserves every prior 425 statement and axiom set, all 430
+frozen definitions and all 155 worker bodies. It adds 95 roots, 44 definitions
+and constructors, and two inspected total recursion workers. The strict build,
+64 parallel release Rust tests, release Clippy and the component gate with
+fifteen native comparison corpora pass. This checkpoint changes no native AIR,
+compiler output or verification-key format.
+
+`BlockSelectors`, `BlockExpressions` and `BlockReflection` extend symbolic
+reflection through recursive control and complete blocks. The proof derives
+the valued equations, logical maps, cursors, raw queries, returns, escaping
+yields and gated calls. It accounts for branch column reuse, default inverse
+advice, continuation merge columns and consumed yields. Selector tables are
+finite; incoming gates need not equal block entries or be Boolean. Required
+fresh reads cover only the consumed column interval. `BlockLookups` handles
+the shared return channel without adding to its multiplicity. All 384 actual
+native control trees and 1,536 assignments match, including zero-width merges
+and preserved outer yields. The test transports Rust's operations and control
+trees instead of generating corresponding Lean fixtures.
+
+`CircuitExpressions` and `CircuitReflection` compose grouped members with
+consecutive selector regions, shared rank and multiplicity columns, the three
+rank-byte queries, and every physical lookup slot. Successful symbolic emission
+and reads from its finite header/member allocation derive complete valued
+circuit emission. The read bound is explicit and must fit the supplied trace;
+the proof does not assume equation values or lookup messages. All 96 actual
+native circuit builds and 384 assignments match exact expression trees,
+layouts, branchless decisions and evaluated results, including empty circuits
+and empty branches that emit lookups. All corpus read bounds fit native widths.
+
+`CompiledCircuitRows.compileCircuit_reflects` connects this emission to the
+checked base-graph compiler. It derives a valued circuit row and a defined
+graph sweep, proves graph-root satisfaction equivalent to all valued equations
+vanishing, and identifies the entire physical lookup vector. The circuit
+corpus also checks this composition for every assignment. This establishes
+the composition for the Lean emitter and compiler models; refinement of the
+Rust execution and the accepted-proof boundary remains open.
+
+The 586-root audit preserves all 520 earlier statements and axiom sets, all 474
+frozen definitions and all 157 worker bodies. It adds 66 roots, 54 definitions
+and constructors, and five inspected total recursion workers. The new native
+release suite passes 66 tests and release Clippy. The strict 283-job build and
+complete component gate pass with seventeen native comparison corpora.
+Native AIR, compiler output
+and verification-key formats are unchanged. Earlier compiler-pass reflection,
+runtime refinement and the certified semantic/cryptographic endpoint remain
+separate obligations.
+
+`OperationDegrees` and `BlockDegrees` prove that tracked degree zero implies a
+constant expression, starting from advice inputs and surviving every operation,
+branch and continuation. Positive tracked degrees may accompany folded
+constants. This distinction justifies the compiler's zero-column equality-test
+case without excluding conservative metadata used by native emission.
+`OperationAllocation` and `CompilerAllocation` identify the actual compiler's
+logical output degrees and auxiliary allocation for all 34 operations.
+`EmissionAllocation`, `CompilerBranches` and `BlockAllocation` prove agreement
+with successful symbolic emission through complete operation sequences and
+recursive blocks. The proofs account for degree-based multiplication allocation,
+word packing and carries, branch reuse, default inverse columns and continuation
+advice. They do not assume equality of compiler and emitter allocation.
+
+The allocation comparisons reuse the native expression corpora. All 1,168
+sequences whose inputs satisfy the degree-zero invariant, all 384 block layouts
+and all 48 function layouts agree with the actual compiler. The remaining 584
+operation sequences deliberately contain degree-zero nonconstant inputs; all
+their earlier expression and value comparisons still run. The 647-root audit
+preserves all 586 earlier statements and axiom sets, 528 frozen definitions and
+162 worker bodies, adding 61 roots and nine definitions/constructors. The strict
+297-job build and complete component gate pass with seventeen native comparison
+corpora. This checkpoint adds no native behavior change.
+
+`CompilerLayout` proves input-width preservation, exact leaf-selector allocation,
+monotonic auxiliary allocation, and preservation of the entire computed layout
+state under function renaming. `FunctionLayout` carries the exact layout through
+successful lowering, deduplication and final compilation to the checked backend.
+`CircuitLayout` proves that singleton and grouped circuits contain every member's
+input and auxiliary columns, including the seven reserved header columns.
+These facts combine with the existing checked row counts in `CircuitAllocation`
+to bound consecutive member selector regions and every symbolic read by the
+physical circuit width.
+
+`Backend.compileCircuit_reflects` now derives the valued row from the supplied
+physical columns, with graph-root satisfaction and the complete lookup vector.
+It has no independent read-bound premise. Successful symbolic compilation,
+the graph-width binding and values fitting those widths remain explicit;
+Rust execution and cryptographic acceptance are not assumed proved. All 96
+native circuit layouts satisfy the column and selector bounds, and all 384
+assignments pass the complete symbolic-circuit/base-graph composition.
+The 687-root audit adds 40 roots and four definitions while preserving all 647
+prior statements and axiom sets, 537 frozen definitions and 162 worker bodies.
+The strict 305-job build and full component gate pass with seventeen native
+comparison corpora. No native implementation changes. Deriving successful symbolic compilation,
+earlier compiler-pass reflection, runtime refinement and the certified
+semantic/cryptographic endpoint remain open.
+
+`GraphCompletion` proves that defined reads supply expression and lookup
+compilation, and that a satisfying assignment excludes rejection of nonzero
+constant constraints. The constant interpretation must be injective; Goldilocks
+satisfies that requirement. `InactiveRows` proves that zero selectors satisfy
+every successfully emitted block for arbitrary logical values and advice.
+It also proves that every successfully emitted circuit has a satisfying
+all-zero row. This is a construction witness for the circuit equations; it
+does not supply an active public call or an accepted proof.
+
+`CircuitCompletion` uses that row and the physical bounds to construct the
+base graph. `Backend.emittedCircuit_reflects` derives graph construction, a
+valued circuit row, graph-root satisfaction and every lookup value from
+successful symbolic emission and physical column values. It no longer assumes
+base-graph compilation succeeds. The canonical base-graph widths are derived
+from the circuit. Successful symbolic emission itself, refinement of native
+execution, proof acceptance and source/claim meaning remain open.
+The native builder and Lean both satisfy the zero-row check for all 96 circuit
+fixtures; all 384 transported assignments continue to match. The 719-root
+audit adds 32 roots and three definitions while preserving all 687 prior
+statements and axiom sets, 541 frozen definitions and 162 worker bodies.
+All 66 Rust release tests, release Clippy and formatting checks pass. There
+are no native production-code changes. The strict 311-job build and full
+component gate pass with all seventeen comparison corpora.
+
+`EmissionChecks` validates the incoming logical scope of every emitted read,
+the exact output count of all 34 operations, every terminal selector and
+the widths of words, assertions and continuation yields. Branches restore
+their incoming scope; continuations append only merge values. Virtual carries
+count as logical outputs. Native scope additions use checked arithmetic, and
+the Lean check uses the same 64-bit bound. Advice and I/O operands that the
+constraint builder does not read impose no additional AIR requirement.
+Both `BoundVerifier.build` and native system construction enforce the check.
+A malformed one-input `Add(0, 1)` function previously passed the earlier guards
+and panicked during constraint construction; it now rejects at the new guard.
+No false-claim acceptance was demonstrated for this failure.
+
+`EmissionInputs`, `EmissionControls` and `BlockCompletion` prove that the checks
+supply operation and recursive block emission, including scoped yields.
+`CheckedCircuit` carries the result through constrained circuit membership.
+`Backend.circuit_graph_reflects` constructs the symbolic circuit, physical base
+graph and valued row for column values fitting the circuit's derived widths.
+It proves graph-root satisfaction equivalent to all valued equations vanishing
+and identifies every lookup value. There is no separate emission-success,
+graph-construction-success or physical read-bound premise. Native runtime
+refinement, accepted-proof extraction, source semantics and the certified
+semantic/cryptographic endpoint remain open.
+
+The new comparison matches 1,365 operation checks, 1,157 sequences and 6,500
+control scopes, including invalid reads, missing selectors, branch-local
+values, nested continuations, wrong widths and machine boundaries. The 96
+native circuit fixtures also pass the new guard. All 72 Rust release tests,
+release Clippy and formatting checks pass. The 749-root audit preserves all
+719 previous statements and axiom sets, 542 frozen definitions and 162 worker
+bodies. The backend constructor and builder now record and enforce the check;
+30 roots, 11 definitions and three inspected total recursion workers are added.
+The strict 324-job build and full component gate pass with all eighteen native
+comparison corpora. All 1,345 broader Aiur assertions pass. The C2 VM recheck
+passes with 12 accepted packets, 16 rejections, the same two documented profile
+exclusions and no unexpected errors. The guard preserves the emitted equations,
+layouts and key bytes of programs that pass it.
+
+`KeyCodec` supplies a total host decoder and encoder for the complete native
+v5 key: all seven parameters, circuit metadata, every node tag, constraint
+roots, lookup records, preprocessed Merkle cap and circuit indices. Checked
+decoding validates graph reads, node-degree arithmetic, the combined user and
+logUp degree, lookup grouping and the cap's power-of-two root count. Derived
+widths and constraint counts retain the pass-through accumulator even for a
+circuit with no lookups. Parsing consumes the complete byte array.
+
+The codec proofs establish round trips within the wire bounds, including
+arbitrary surrounding bytes, and injectivity of canonical encoding. Accepted
+decoding supplies valid graphs and a well-shaped cap. The optional canonical
+gate rejects the native decoder's alternative representations of constants.
+`BoundVerifier.build` enforces that gate on the selected key, retains its
+decoded value and checks all parameters against the deployment selection.
+`Backend.key_graph_reflects` supplies full and lookup-prefix sweeps of each
+decoded graph and identifies their roots and messages with expression
+evaluation. It takes neither a parsing-success nor a graph-validity premise.
+It does not identify that graph with the compiler model or prove native
+verifier execution. Parameter admissibility, preprocessed commitment meaning,
+accepted-proof extraction and the remaining certified semantic/cryptographic
+endpoint remain separate obligations.
+
+The new native comparison covers 4,536 full-key byte cases: 509 accepted keys,
+22 accepted noncanonical encodings and 517 decoded circuit records. It checks
+exact canonical bytes, every derived metadata field and every node degree.
+Cases include all tags, truncations, suffixes, malformed graph reads, degree
+overflow, all supported lookup group sizes, empty circuits and maximum wire
+fields. The existing ten-graph evaluation corpus now uses this checked codec.
+An empty Merkle cap exposed a native constructor panic; zero and non-power-of-two
+cap sizes now return an error. The native decoder still has no production
+callers in the workspace, and no false-claim acceptance was shown.
+
+The 796-root audit preserves all 749 prior theorem statements and axiom sets,
+553 frozen definitions and 165 worker bodies. Its two reviewed definition
+changes are the backend constructor and builder; 47 roots, 49 definitions and
+four inspected total codec workers are added. All 74 Rust release tests and
+release Clippy pass, as do the canonical-key comparisons and the existing
+two accepted/fifteen rejected native binding cases. The strict 332-job build
+and full component gate pass with all nineteen native corpora. Native AIR expressions,
+layouts and serialized keys are unchanged.
+
+`BoundVerifier.buildCompiled` now checks the entire decoded circuit list
+against a total compiler model and returns a `CompiledBackend` retaining that
+check. Function circuits appear in compilation order, followed by the memory
+widths and both byte tables. Equality covers every graph node, constraint
+root, ordered lookup, matrix dimension, degree, grouping choice and
+preprocessed index. The existing generic `build` remains available.
+
+Successful graph compilation is unchanged when additional columns are
+available. This connects the function compiler's physical main width to the
+key's complete layout, including stage-two and public-input columns. The
+memory and byte expression builders evaluate to their physical column models.
+The `CompiledBackend` graph-reflection theorems use the enforced comparison
+to supply graph equality, compilation success and dimensions for every circuit
+family. They derive the same equations and ordered weighted messages from
+values fitting the selected key. No independent graph-equality or read-bound
+premise is required. Native verifier execution, preprocessed commitment
+meaning, parameter admissibility and cryptographic acceptance remain open.
+
+Native comparison covers twelve complete systems, 180 circuits and 720
+assignments to all matrix families, public values and row selectors. It
+compares the actual encoded keys and emitted equations and lookups with the
+checked compiler and physical models. All 168 altered keys retain valid
+canonical syntax and fail the new circuit-binding guard. The ordinary and
+grouped backend tests now use `buildCompiled`: two valid proofs are accepted
+and fifteen altered cases are rejected. All 75 parallel Rust release tests
+and release Clippy pass. The 831-root audit adds 35 roots and twenty frozen
+definitions; every prior statement, axiom set, definition and all 169 worker
+bodies are unchanged. The strict 346-job build and complete component gate
+pass with all twenty native corpora. Native production code and key bytes
+are unchanged.
+
+`BoundVerifier.verifyShaped` now decodes the accepted bytes into a complete
+proof artifact and checks its opening dimensions against a `CompiledBackend`.
+The total codec retains every commitment, quadratic extension coordinate,
+FRI round, opened value and Merkle authentication digest. Its proofs establish
+round trips, injective canonical encoding, complete consumption, u64 vector
+length bounds and 32-byte digest bounds. Native bincode permits a trailing
+suffix; this host entry point requires exact canonical framing.
+
+The checked proof records are indexed by the actual activation bitmap and
+the selected key's canonical circuit order. They retain both opening points,
+quotient slices and accumulators, with checked column widths and domain
+bounds. Acceptance also supplies fixed trace heights and the strict global
+lookup budget. The wrapper then verifies the same bytes and the selected
+public statement through the existing native interface. Its theorem provides
+these framing and shape facts directly from success; it does not yet derive
+authenticated polynomials, satisfying traces or cryptographic failure bounds.
+Native execution refinement and the certified release remain open.
+
+The proof codec comparison covers 3,636 native/Lean byte cases, all fields of
+twenty decoded records and eight native-accepted suffixes rejected by the
+host framing gate. Four original proofs pass full native verification. The
+shape comparison checks 4,696 cases across four systems, including every u8
+degree and independent changes to activation, matrices, opening points and
+columns. Native and Lean agree on 510 accepted shapes; 266 also meet the
+fixed-height and budget guards. These shape fixtures deliberately omit PCS
+data and make no cryptographic acceptance claim. The ordinary and grouped
+backend tests use `verifyShaped`, accepting two valid proofs and rejecting
+seventeen altered cases. All 78 parallel Rust release tests and release
+Clippy pass. The 884-root audit adds 53 roots and 65 frozen definitions and
+constructors, preserving all prior statements, axiom sets, definitions and
+169 worker bodies. The strict 364-job build and complete component gate pass
+with all twenty-two native corpora.
+Native production behavior and serialized proof/key bytes are unchanged.
+
+`Extension` gives the proof codec's two canonical coordinates their pinned
+arithmetic meaning, with basis `1, u` and `u² = 7`. It implements addition,
+subtraction, negation, multiplication, conjugation, norm, scalar multiplication,
+binary exponentiation and checked inversion. `GoldilocksAlgebra` proves the
+ring laws through an injective residue map, and relates the existing
+64-bit repeated-squaring routine to mathematical powers.
+`GoldilocksInverse` proves Fermat's theorem by permuting the nonzero residues
+and cancelling their product. The enumeration is a noncomputable proof
+definition and generates no runtime initialization code.
+
+`ExtensionField` proves that seven has no square root using a
+kernel-evaluated Euler certificate and the proved Fermat theorem. It derives
+the absence of zero divisors, the nonzero norm of every nonzero extension
+value, and correctness and uniqueness of the concrete inverse formula.
+Checked inversion returns a value exactly when its product with the input
+is one; zero returns `none`. The extension ring laws instantiate the same
+working-operation interface used by the existing expression reflection.
+
+The native comparisons cover sixteen base inverses, 384 extension values,
+7,680 powers and 147,456 ordered operand pairs. Exponents include both field
+boundaries, `2^64`, the quadratic-field inverse exponent, and `2^128 - 1`.
+All 240 extension assignments and 8,016 node values from ten actual compiled
+graphs agree with both graph sweeping and expression evaluation. The audit
+adds 71 roots, 32 definitions and instances, and two inspected recursion
+workers; all 884 prior statements and axiom sets, 689 definitions and 169
+worker bodies are unchanged. Native field-instruction refinement and the
+connection to verifier acceptance remain open.
+All 80 parallel Rust release tests, release Clippy with warnings denied and
+formatting pass. The strict 379-job build and complete component gate pass
+with all twenty-four native corpora and the unchanged two accepted and
+seventeen rejected backend cases.
+
+`LookupCoordinates` retains the two separate coordinates checked by native
+degree-two logUp. Its Karatsuba multiplication has proved ring laws over
+any commutative coefficient ring. For base-field trace values, the pair
+identifies with the proved native extension field. At an out-of-domain opening,
+each coordinate is itself an extension value: combining the pair with the
+extension basis loses a constraint. A checked example gives a nonzero pair
+`(-u, 1)` that combines to zero. No field or cancellation law is assumed for
+that coordinate algebra.
+
+`LogUp` models the direct evaluator with checked node, public, accumulator and
+boundary-coordinate reads. It normalizes group size zero to one, rejects sizes
+above eight, and covers the empty pass-through, singleton, full-group and tail
+cases. `LogUpAlgebra` relates Horner fingerprints and seeded prefix/suffix scans
+to the denominator-cleared grouped polynomial. Padding arguments with trailing
+zeros preserves the fingerprint. Successful evaluation yields every group's
+two polynomial equations in native order, and the graph reflection theorem
+connects lookup reads to the corresponding frontend expressions.
+
+`LogUpFractions` proves that, on base-field trace rows with no zero message
+denominators, the grouped equation vanishes exactly when the accumulator
+difference equals the weighted sum of message inverses. It also proves a
+counterexample showing why the denominator condition is necessary.
+`LogUpAccumulator` telescopes all groups in a complete checked row, retaining
+the last-row injection supplied by the caller. Further ring lemmas sum a
+cyclic sequence of rows and a chain of circuit accumulators. The domain
+results below supply the selector normalization and cyclic row indexing.
+Extracting the corresponding polynomials from authenticated openings, and
+excluding poles and compression collisions to obtain exact message balance,
+remain obligations.
+
+The comparison corpus checks 4,752 direct native evaluations against the
+independent symbolic schoolbook reference and the Lean model, in both the
+base and extension fields. It covers all group sizes zero through eight,
+22 lookup counts through 65, ten argument widths, field boundaries, zero
+denominators and arbitrary extension-valued coordinates and selectors.
+The checked Lean reader additionally rejects 42,768 malformed inputs.
+Native stage-2 construction matches all partial accumulators and zero equations
+in 27 batches, 135 circuits and 513 rows, including variable argument padding,
+cyclic next rows and the raw last-row selector with a scaled boundary delta.
+These comparisons do not prove Rust implementation refinement or extract
+vanishing equations from native verifier acceptance.
+
+The logUp audit adds 95 roots, 36 definitions and instances, and one inspected
+structural recursion worker. All 955 prior root statements and axiom sets,
+721 definitions and 171 worker bodies are unchanged. The native runtime
+entry points and partial opaque sources remain the same. All 82 parallel
+Rust release tests, release Clippy with warnings denied, and formatting pass.
+The strict 396-job build and complete component gate pass with all twenty-six
+native corpora and the unchanged two accepted and seventeen rejected backend
+cases.
+
+`Domain` retains all 33 pinned Goldilocks generators and represents rows by
+finite indices, without enumerating large domains. Kernel-evaluated bounded
+squaring certificates prove the generators' full and half orders and adjacent
+square relations. The resulting order theorem proves distinct row points,
+cyclic next-row multiplication, and the inverse-generator last point for
+every supported size from one through `2^32`. The domain size and the
+last-row normalization factor `n * generator` are nonzero in Goldilocks.
+
+`SelectorAlgebra` proves the divided-power polynomial identities underlying
+the selectors. `Selectors` proves that the checked rational evaluator is
+defined exactly where the vanishing polynomial is nonzero, and agrees there
+with the selector polynomials. On trace rows, the first selector equals `n`
+only at the first row; the last equals `n * generator` only at the last row.
+These facts include the size-one case. `DomainAccumulator` cancels the native
+inverse normalization and derives the complete circuit fraction sum from
+all cyclic rows' checked lookup equations, with an explicit pole-free premise.
+It also extracts the actual lookup values from the node buffers.
+
+`Quotient` rejects incomplete coordinate pairs and recombines every quotient
+slice with the native extension basis in ascending powers of `zeta^n`.
+The constraint fold uses descending powers of `alpha`, preserving the user
+constraints followed by both coordinates of each lookup equation. Successful
+arithmetic checking is equivalent to a nonzero vanishing value and
+`composition = vanishing * quotient`. This equivalence alone does not prove
+that openings come from committed low-degree polynomials or that a random
+challenge detects a violated constraint.
+
+The domain corpus directly calls the pinned native polynomial-space methods.
+All 33 generators, 966 row samples, 1,987 defined and 125 rejected selector
+assignments, and 511 complete small-coset points match Lean. The quotient
+corpus reproduces the verifier's private recombination expression with native
+basis, power and field operations: 384 accepting and 320 rejecting arithmetic
+cases match. Lean additionally rejects odd quotient rows and selector poles
+in every case, and rejects 320 altered accepted quotient rows. These are
+arithmetic comparisons, not cryptographic proof acceptance tests.
+
+The domain and quotient audit adds 73 roots, 17 definitions, and one inspected
+structural coordinate-pairing worker. All 1,050 prior root statements and
+axiom sets, 757 definitions and 172 worker bodies are unchanged. The native
+entry points and partial opaque sources remain the same. The selector
+polynomial is symbolic and has no runtime enumeration or initialization.
+All 84 parallel Rust release tests, release Clippy with warnings denied,
+formatting, the strict 415-job build and the complete component gate pass.
+The gate covers all twenty-eight native corpora and the unchanged two
+accepted and seventeen rejected backend cases.
+
+`VerifierArithmetic` connects the opened rows to the complete arithmetic
+check with explicit `beta`, `gamma`, `alpha` and `zeta` inputs. It embeds the
+eight base coordinates of the lookup challenges and entering/leaving
+accumulators separately, sweeps the graph once, reads the user roots, and
+appends both coordinates of every grouped lookup equation. The boundary
+difference uses the proved inverse of `n * generator`. Quotient coordinates
+are paired and folded in the native order.
+
+`OpeningShape` derives an invariant not supplied by row dimensions alone:
+an absent preprocessed slot in the selected compiled key implies width zero.
+The key binding and checked proof shape then supply every graph and lookup
+read. Evaluation is defined exactly when the challenge avoids the domain's
+vanishing polynomial. `CompiledBackend.checked_row_values` ties each
+arithmetic-accepted row to its actual proof position, entering accumulator,
+unfolded user and lookup expressions, and the quotient identity. The
+initial accumulator equals the positive fraction sum of the public claims;
+the checked active-row chain passes each leaving accumulator to the next
+row and ends at zero. Combining this chain with per-circuit fraction
+identities gives their sum plus the public claim sum equal to zero.
+Deriving the circuit identities from authenticated trace polynomials
+remains part of extraction.
+
+The combined corpus calls the native graph sweep, direct LogUp evaluator
+and domain selectors. It reproduces the private verifier's surrounding
+wiring, fold, quotient recombination and claim loop. All 960 opening cases
+and 32,064 graph values match Lean, with 480 accepting and 480 rejecting
+arithmetic cases. The comparison also rejects malformed stage-two reads,
+roots, exponents, quotient rows, missing preprocessed data and selector
+poles, and detects altered accepted quotients. Public initialization matches
+52 defined cases and 20 poles. Forty-eight ordered accumulator chains cover
+16 accepted, 16 unbalanced and 16 rejected interior-equation cases. These
+constructed openings are arithmetic fixtures, not authenticated proofs.
+
+The arithmetic integration adds 39 roots, 17 definitions and one inspected
+structural row-chain worker. All 1,123 prior statements and axiom sets,
+774 definitions and 173 worker bodies are unchanged. Native entry points
+and partial opaque sources remain the same. All 85 parallel Rust release
+tests, release Clippy with warnings denied, formatting, the strict 426-job
+build and the complete component gate pass. The gate covers twenty-nine
+native corpora and the unchanged two accepted and seventeen rejected
+backend cases. This checkpoint changes no native production behavior,
+compiler output or serialized encoding.
+
+`Challenger` models the native hash buffers and serializing Goldilocks
+sampler. It retains the forward digest as the next hash input and consumes
+output bytes from the digest's end. Slice observation appends once, with a
+proof that this equals the native byte-by-byte loop; an empty slice preserves
+pending output. Field sampling reads eight bytes in little-endian order and
+rejects noncanonical words. A finite sampling relation characterizes success
+under explicit fuel, proves that the returned representative is the first
+canonical word, and preserves both value and state when fuel increases.
+Extension coordinates use consecutive base samples. Bit sampling uses the
+proved low-bit mask without field rejection; zero-bit sampling consumes a
+word, while a zero-bit proof-of-work check preserves the entire state.
+
+`Transcript` derives the lookup, fingerprint, folding and out-of-domain
+challenges from the selected key's parameters and circuit metadata, the
+complete activation bitmap, commitments, trace heights, framed public claims
+and intermediate accumulators. The two lookup challenges are re-observed
+before sampling continues. The replay retains the exact state for PCS
+verification. Its buffer invariant and fuel monotonicity are proved, and
+`CompiledBackend.transcript_row` connects the resulting challenges to each
+checked row's source position, accumulator and quotient identity.
+
+The native corpus instruments the actual `System::verify_multiple_claims`
+method through a forwarding challenger, including its actual `observe_shape`
+call and PCS continuation. All forty schedules match, covering four accepted
+proofs and altered claims, claim boundaries, commitments, openings and trace
+heights. Each accepted proof also passes the transcript-derived Lean
+arithmetic. Separate cases compare 1,280 byte operations, sixteen forced
+rejection patterns containing 26 rejected limbs, and 48 witness checks,
+including eight zero-bit checks with pending output. Rejection cases cross
+digest boundaries and test exhaustion and continuation, including the field
+modulus and maximum u64 word.
+
+The generic replay theorems quantify over an explicit 32-byte hash function.
+The concrete replay below supplies checked Blake3 code. The comparison
+executable also runs an independent test-only FFI hash; the proof audit does
+not acquire its opaque definitions or default-proof axioms. PCS authentication,
+extraction and quantitative cryptographic guarantees remain necessary for full C8.
+Native comparisons establish compatibility on the corpus. A universal
+refinement theorem for the Rust verifier remains open.
+
+The transcript integration adds 69 roots, 32 definitions and two inspected structural
+sampling workers. All 1,162 prior statements and axiom sets, 791 definitions
+and 174 worker bodies are unchanged. The test dependencies use the existing
+pinned Plonky3 revision and change no dependency versions. All 86 parallel
+Rust release tests, Clippy with warnings denied and formatting pass.
+The strict 445-job build and complete component gate pass, including thirty
+fresh native corpora and the unchanged two accepted and seventeen rejected
+backend cases. Native production behavior, compiler output and serialized
+encodings are unchanged.
+
+`NativeAIR.Blake3` implements unkeyed 32-byte BLAKE3 using total Lean code.
+Fixed-size vectors check every compression index. Its word serialization
+round-trips in both directions, rotations agree with the bitvector operation,
+and the seven message schedules are proved permutations with the specified
+successive reordering. The compression state splits its full 64-bit counter
+into the low and high words without loss.
+
+`ChunkReads` characterizes every compression step and final output. Full
+final blocks retain the end flag rather than creating an extra empty block;
+only the empty input has an empty final block. Each chunk uses at most
+sixteen blocks. `TreeHash` independently specifies the canonical tree by
+full power-of-two left subtrees and nonempty right subtrees no larger than
+their siblings. The implementation satisfies that specification, and every
+such tree has the same output. The root counter is zero. Under the explicit
+native input bound of fewer than 2^64 bytes, every reached chunk counter is
+below 2^54 and its conversion to UInt64 is exact.
+
+`Blake3.replay` and `Blake3.verifyArithmetic` instantiate the transcript with
+this exact function. `CompiledBackend.blake3_transcript_row` connects their
+success to the selected row's source, accumulator and quotient identity.
+This supplies a checked algorithm for the hash parameter; cryptographic
+security and refinement of the Rust implementation remain separate obligations.
+
+Native comparisons cover 258 full inputs, including empty input, all short
+final-block byte lengths, chunk boundaries and trees through 128 chunks plus
+one byte. They also compare 58 canonical splits and both subtree chaining
+values, 42 chunk cases including counters above 32 bits, and 64 pairs of
+internal parent and PCS Merkle hashes. An internal BLAKE3 parent uses the
+PARENT compression flag; PCS instead hashes the concatenation of two digests
+as an ordinary 64-byte input. The corpus checks both operations against the
+pinned native implementation. All forty recorded verifier schedules and PCS
+continuations, byte streams and witness checks now run with the pure hash;
+the transcript tests also compare it with the independent FFI hash.
+
+This hash integration adds 49 roots, 35 definitions and constructors, and two
+inspected recursion workers with proved decreases in input length. All
+1,231 prior statements and axiom sets, 823 premise definitions and 176 worker
+bodies remain unchanged. All 87 parallel native release tests, Clippy with
+warnings denied, the strict 452-job build and the complete component gate
+with thirty-one fresh native corpora pass. The backend cases remain two
+accepted and seventeen rejected, with no unexpected outcomes.
+The native hash test dependency uses the already locked
+BLAKE3 1.8.5 version. Production native behavior and serialized formats do
+not change.
+
+The subsequent Merkle cap coverage check closes a demonstrated native
+commitment-binding defect. In the pinned binary MMCS, a cap can stop the
+authentication path before shorter matrices are injected. With matrix
+heights eight and two and cap height two, changing the entire shorter
+matrix leaves the commitment unchanged. Both individual and shared native
+opening verification accept changed shorter rows. The regression also
+checks duplicate and reordered query indices. This is a commitment-binding
+failure; no forged IxVM public claim was demonstrated for this defect.
+
+`MerkleCap.coverage` requires the effective cap to include every active
+matrix height, accounting for the shared LDE blowup and the native clamp
+to the tallest tree's depth. Its checked arithmetic avoids machine
+addition overflow. The guard is enforced by native `AiurSystem.verify`
+and the selected Lean `readProof` wrapper. `CheckedProof` retains success
+as a field; each selected row consequently has its injection depth within
+the authenticated path length. Coverage is preserved by matrix subsets,
+and a uniformly sized batch permits the native cap clamp. The individual
+path and shared-opening theorems below use these cap properties;
+cryptographic extraction remains open.
+
+The repair adds 22 roots and three definitions. All 1,280 prior root
+statements and axiom sets, 856 prior premise definitions and 178 worker
+bodies are unchanged. The two changed premises are the checked-proof
+constructor and reader, which now require cap coverage. The native guard
+matches Lean on 288,225 cases covering every degree byte, mixed and uniform
+heights, empty batches and machine parameter boundaries. Native tests
+reject the uncovered cap at the Aiur boundary, accept a cap at the exact
+shortest height, and reject an altered public result under that valid cap.
+All 91 parallel Rust release tests, strict Clippy, the strict 459-job build
+and the full gate with thirty-two fresh native corpora pass. The backend
+cases remain two accepted and seventeen rejected, with no unexpected
+outcomes. All 1,345 broader Aiur assertions pass. The rebuilt C2 VM pilot
+retains twelve accepted packets, sixteen rejected packets, two documented
+profile exclusions and no unexpected errors.
+
+Proofs whose caps omit a committed matrix now reject before PCS verification.
+The proof codec retains its original 3,636 cases and four native-accepted
+proofs; its checked-admission assertions distinguish the uncovered caps.
+The proof-shape corpus additionally compares cap coverage for all 4,696
+records. The AIR, serialized keys and proof format do not change; affected
+parameter selections need a cap that covers every matrix and new proofs
+under that selection. The pinned upstream MMCS itself remains unchanged.
+
+`NativeAIR.Merkle` replays individual binary MMCS openings for selected
+power-of-two matrix heights. It checks matrix counts, row widths, query
+bounds and the exact number of siblings before hashing. Rows at the same
+height retain their original matrix order and serialize as canonical
+eight-byte Goldilocks values. Each step hashes the ordered sibling pair,
+then injects any row group at the next height. Its final index is bounded
+by the effective cap layer. Every hash input is retained in execution order.
+
+`Merkle.blake3_collision` proves that two different row openings accepted
+at the same dimensions, cap and index, with cap coverage, yield a collision
+in the concrete checked BLAKE3 function. The witness lies among at most
+`2 + 6 * (maxLogHeight - capHeight)` hash inputs from those two replays.
+Fixed-width field packing and the checked row widths recover every row
+boundary. All queried inputs fit the native BLAKE3 byte-length bound when
+each opening contains fewer than 2^61 field elements. The theorem derives
+the collision itself; a quantitative probability bound still requires the
+cryptographic security argument.
+
+The native comparison exercises 8,913 valid and malformed individual paths
+and compares all 16,456 hash inputs and outputs with the pinned verifier.
+Production commit/open generates the fixtures. An instrumented MMCS
+delegates hashing to native BLAKE3 and must agree with the production MMCS
+on every decision. Cases cover unsorted and repeated heights, wide rows,
+canonical field boundaries, every query of the smaller trees, cap clamps,
+altered row values, siblings, dimensions and cap roots, and failures before
+hashing. Raw replay reproduces the known cap omission; `verifyCovered`
+excludes it. The corpus has 1,802 native acceptances, including 1,161 with
+uncovered caps, and 3,941 structural rejections with no hash calls.
+
+This component adds 34 roots, 20 definitions and three inspected structural
+recursion workers. All 1,302 prior root statements and axiom sets, 861 premise
+definitions and 178 worker bodies remain unchanged. All 92 parallel native
+release tests, Clippy with warnings denied, the strict 466-job build and the
+complete gate with thirty-three fresh native corpora pass. The backend cases
+remain two accepted and seventeen rejected, with no unexpected outcomes.
+The added test dependency
+uses the existing Plonky3 revision. Native production code and serialized
+encodings are unchanged. The actual PCS uses the shared openings described
+below. PCS/FRI extraction and native refinement remain separate obligations.
+
+`NativeAIR.PrunedMerkle` replays the binary shared-opening algorithm. It sorts
+and deduplicates query indices, requires duplicate indices to supply identical
+rows, checks the frontier's boundary-proof length, and hashes each unique
+initial row group. Adjacent even/odd nodes share their parent hash; other
+nodes consume a boundary sibling. The whole layer is paired before any
+shorter rows are injected. Merged queries must agree on each injected row
+group. The replay retains hash inputs even when a later group rejects.
+
+The checked refinement follows every original query through deduplication,
+pairing and injection. It constructs an individual sibling path ending at
+the same cap index and digest and proves that every input on that path
+occurs in the shared execution log. An intermediate invariant describes
+paired nodes before shorter rows are injected, preserving the native order
+of operations. Acceptance of a shared opening implies acceptance of each
+reconstructed individual opening.
+
+With cap coverage, different rows accepted at a common public index,
+dimensions and cap expose a collision in the concrete checked BLAKE3
+function. The witness uses at most
+`2 + 6 * (maxLogHeight - capHeight)` inputs from two reconstructed paths,
+all included in the actual shared hash logs. Each witness input has at most
+64 bytes or eight times the larger opening's field count. Openings with
+fewer than 2^61 fields therefore give collision witnesses within BLAKE3's
+native input bound. This is a collision reduction; quantitative security
+still requires a cryptographic failure bound.
+
+Native comparisons cover 7,946 shared openings, including empty, full,
+reordered and repeated query sets, mixed and repeated matrix heights,
+wide rows, cap clamps and malformed inputs. Production commit/open creates
+the fixtures, and instrumented verification must agree with the production
+verifier. Every decision and all 42,803 hash inputs and outputs match Lean.
+All 19,709 reconstructed individual paths also reach their shared node and
+use inputs from its execution log. The corpus includes 1,619 acceptances,
+1,069 acceptances with uncovered caps, and 2,534 rejections after hashing.
+An explicit merged-row disagreement rejects after exactly five hash calls
+in both implementations. Covered verification excludes the cap omission.
+
+The shared-opening proof adds 33 roots and 27 definitions and constructors,
+including the logging monad and path invariants, and five inspected structural
+recursion workers. All 1,336 prior root statements and axiom sets, 881 premise
+definitions and 181 worker bodies remain unchanged. All 93 parallel native
+release tests, Clippy with warnings denied, the strict 473-job build and
+the complete gate with thirty-four fresh native corpora pass. The backend
+cases remain two accepted and seventeen rejected, with no unexpected outcomes.
+
+PCS/FRI verification and extraction, quantitative security, and universal
+Rust refinement remain separate obligations. Native comparisons establish
+compatibility on the corpus.
+
+`NativeAIR.ExtensionMmcs` models the quadratic-extension adapter used for
+FRI commitments. Each extension value contributes its `c0` and `c1`
+coordinates, in that order. The adapter doubles matrix widths and retains
+heights, cap roots, query indices and sibling digests. Both individual and
+shared verification delegate to the base-field Merkle algorithms above.
+The coordinate packing is injective, so their authentication and collision
+theorems carry back to the original extension-field rows.
+
+Width multiplication uses the selected machine word size, including wrapping
+in native release builds. The model preserves that behavior. `WidthsFit`
+states when doubling is exact; under this condition, base-row shape is
+equivalent to the original extension-row shape. A FRI matrix with width
+`2^logArity` fits this doubling on a 64-bit machine when `logArity ≤ 32`.
+Deriving that condition from the complete native FRI acceptance path is part
+of the remaining verifier connection.
+
+Every query in an accepted shared extension opening has an accepted individual
+extension path using only inputs from the shared hash log. With cap coverage,
+different accepted extension rows at a common public index expose a BLAKE3
+collision in at most `2 + 6 * (maxLogHeight - capHeight)` witness inputs.
+The witness inputs fit the native hash bound when each queried opening
+contains fewer than 2^60 extension elements. Recovering the original row
+width additionally uses `WidthsFit`; the collision reduction itself also
+covers the modeled wrapping behavior.
+
+The native corpus contains 9,597 cases, including 7,362 shared cases. It
+checks actual extension commit/open/verify, equality with the flattened
+base-field commitment and verifier, and instrumented hash calls. All 42,969
+hash inputs and outputs agree with Lean, along with all 20,448 individual
+paths. Cases alter both coordinates, repeated and merged queries, row widths,
+caps, dimensions and sibling proofs. They include 507 release width wraps,
+2,566 acceptances, 1,661 acceptances with uncovered caps and 3,513 rejections
+after hashing. Cap coverage and width overflow are checked separately.
+
+This adapter adds 22 roots, eleven definitions and one inspected structural
+shape worker. All 1,369 prior root statements and axiom sets, 908 premise
+definitions and 186 worker bodies remain unchanged. All 94 parallel native
+release tests, Clippy with warnings denied, the strict 480-job build and the
+complete gate with thirty-five fresh native corpora pass. The backend cases
+remain two accepted and seventeen rejected, with no unexpected outcomes.
+
+`NativeAIR.FriDomain` connects FRI query indices to the checked Goldilocks
+domains. Bit reversal is an involution and a permutation on admitted indices.
+Its split and padding identities relate the native word operations, folding
+groups and final-domain queries. The machine-operation correspondence needs
+both a supported bit count and an index bound: at width zero, the native
+overflowing shift retains a nonzero input's full-word reverse, while the
+only admitted index is zero.
+
+Nested generators have the required power relation. Every interpolation node
+in a folding row equals the corresponding parent query point; the nodes are
+distinct and nonzero. Raising any node to the folding arity yields the reduced
+query point. Evaluating a bounded final index using the original global
+generator and bit width agrees with evaluation in the final domain. The
+input-opening points use the separate shift by seven, whose checked power
+certificate proves that this coset is disjoint from the trace subgroups.
+
+The native comparison covers 58,295 bit reversals through the full 64-bit word
+width, 24,951 query points across all 33 field domains, 9,617 nested-domain
+points and 990 folding rows. It calls the actual FRI `fold_row` method at all
+50,042 sampled interpolation nodes, with both extension coordinates populated.
+The folding corpus uses arity logarithms zero through eight; zero tests the
+public helper's singleton boundary, while accepted FRI rounds require a
+positive logarithm. The proofs apply to every admitted field domain and arity.
+The polynomial and interpolation components below supply the folding algebra.
+The full FRI verifier and quantitative proximity soundness remain separate
+obligations.
+
+These domain proofs add 34 roots and five definitions. All 1,391 prior root
+statements and axiom sets, 919 premise definitions and 187 worker bodies
+remain unchanged. The native and Lean values agree throughout the corpus.
+All 95 parallel native release tests, Clippy with warnings denied, the
+487-job strict build and the full gate with thirty-six fresh native corpora
+pass. The backend still accepts two cases and rejects seventeen, with no
+unexpected outcomes.
+
+`NativeAIR.Polynomial` uses the verifier's existing ascending-coefficient
+Horner evaluator. It supplies coefficient addition, subtraction, scaling,
+linear factors, vanishing polynomials and synthetic division. `IsZero`
+identifies all-zero coefficient lists, including lists with trailing zeros.
+`Monic` records a final coefficient of one. Division proves the exact
+factor-and-remainder identity and lowers the coefficient length by one.
+
+A nonzero polynomial has fewer distinct roots than its coefficient length.
+The proof factors out one root and inducts on the remaining length; the
+no-zero-divisor condition is discharged for Goldilocks and its quadratic
+extension. Consequently, agreement at sufficiently many distinct points
+determines the polynomial, and the finite count of false agreements is
+bounded by the maximum coefficient length minus one. These are deterministic
+counting results; a protocol probability bound additionally needs the
+challenge distribution and the appropriate nonzero-polynomial event.
+
+Monic polynomial identity gives the exact FRI vanishing polynomial. For
+every admitted folding row and every extension-field point `x`, the product
+of differences from the row's nodes is `x^n - c`, where `n` is the arity and
+`c` is the reduced query point. This instantiates the nodes, distinctness and
+common-power hypotheses using the domain theorems above. The interpolation
+component below derives the evaluation formula. The FRI proximity guarantee
+remains separate work.
+
+The native comparison calls the actual `HornerIter` used by the FRI final
+polynomial check. It also compares the pinned upstream STIR coefficient
+utilities: addition, linear division and vanishing-polynomial construction.
+STIR is an independent reference for these coefficient operations; FRI's
+interpolation helper is private and is exercised through `fold_row`.
+The corpus contains 768 arithmetic cases, 704 divisions and 72 root-set
+polynomials across both fields. It includes 160 zero-polynomial cases and
+28 repeated-root sets, as well as empty inputs, constants and trailing zeros.
+Every coefficient, remainder, evaluation and sampled root count agrees with
+Lean. The total model defines an empty quotient for empty input; the native
+division utility requires a nonempty polynomial.
+
+This component adds 51 roots, ten definitions and three inspected structural
+recursion workers. All 1,425 prior root statements and axiom sets, 924 premise
+definitions and 187 worker bodies remain unchanged.
+All 96 parallel native release tests, Clippy with warnings denied, the
+494-job strict build and the complete gate with thirty-seven fresh native
+corpora pass. The backend still accepts two cases and rejects seventeen,
+with no unexpected outcomes.
+
+`NativeAIR.Interpolation` constructs the polynomial for each FRI folding row.
+For nodes satisfying `x_i^n = c`, differentiating the checked vanishing
+polynomial gives the diagonal weight `x_i / (n*c)`. Synthetic division gives
+zero at the other nodes. Their weighted sum has coefficient length at most
+`n` and agrees with every row value. The root bound proves uniqueness up to
+zero padding and equality with every other polynomial of degree below `n`
+that agrees on the row.
+
+The executable evaluator first returns the row value when the challenge
+equals a node. Otherwise, it sums the weighted inverse differences and
+multiplies by the vanishing product. Both branches are proved to evaluate
+the constructed coefficients. For the actual FRI domains, distinctness,
+common powers and the invertibility of `n*c` follow from the checked domain
+and field theorems. The accepted-fold theorem extracts the row shape, a
+polynomial of the required degree, agreement at every node and the result's
+evaluation equation. Invalid arities, query indices and row lengths reject.
+
+The native corpus calls the actual `TwoAdicFriFolding.fold_row`, including
+its private interpolation helper and batch inversion. It checks 2,436 rows
+and 12,180 challenge evaluations across all 33 field domains, with folding
+arity logarithms zero through six. Zero, constant, highest-degree monomial
+and dense extension polynomials exercise both node returns and challenges
+outside the nodes. The Lean replay also checks constructed coefficients and
+diagonal weights for arities up to eight. A further 117 native matrices with
+arbitrary extension values give 3,006 row comparisons, exercising the binary
+fast path and the larger-arity path with successive squared challenges.
+The matrix implementation is compared by execution; the formal theorem
+establishes the row interpolator's mathematical behavior. The model checks
+individual inverses, while the native helper batches them.
+
+This component adds 30 roots, eight definitions and three inspected
+structural recursion workers. All 1,476 prior root statements and axiom
+sets, 934 premise definitions and 190 worker bodies remain unchanged.
+All 97 parallel native release tests, Clippy with warnings denied, the
+501-job strict build and the complete gate with thirty-eight fresh native
+corpora pass. The backend accepts two cases and rejects seventeen, with no
+unexpected outcomes.
+Connecting these folds to the complete authenticated FRI transcript and
+deriving quantitative proximity soundness remain separate obligations.
+
+`NativeAIR.Folding` connects each row to one global polynomial. Write the
+ascending coefficient list in blocks of `n` terms. Evaluating each block at
+the folding challenge gives the coefficients of the folded polynomial.
+Restricting the original polynomial to a coset `x^n = c` combines those
+blocks with weights `1, c, c², …`. The restriction has at most `n`
+coefficients and agrees with the original polynomial at every coset node.
+Evaluating it at the challenge equals the folded polynomial evaluated at
+`c`. The checked row interpolator therefore returns the same global folded
+polynomial at every child-domain query point. An original coefficient bound
+of `n*d` becomes a bound of `d`, including empty polynomials, incomplete
+blocks and trailing zero coefficients.
+
+For two fixed, different rows of length `n`, their interpolating polynomials
+have a nonzero difference: agreement as polynomials would recover the same
+value at every row node. The polynomial root bound then limits equal fold
+results to at most `n−1` challenges in any list of distinct extension-field
+elements. This is a deterministic count for fixed rows; it does not supply
+an adaptive FRI proximity argument or a Fiat–Shamir probability bound.
+
+The native folding corpus uses global polynomials spanning several
+coefficient blocks and compares both native matrix paths and the actual
+row helper with the folded coefficient polynomial. It covers 4,872 rows,
+24,360 challenge evaluations, 936 matrices and 24,048 matrix rows. Seven
+distinct row pairs, differing at one node, attain exactly `n−1` agreements
+over 141 tested challenges. The Lean replay checks complete input recipes,
+both extension coordinates, folded coefficients, coset restrictions,
+degree bounds and native outputs.
+
+This component adds twelve roots, two definitions and two inspected
+recursion workers. All 1,506 prior root statements and axiom sets, 942
+premise definitions and 193 worker bodies remain unchanged.
+All 98 parallel native release tests, Clippy with warnings denied, the
+508-job strict build and the complete gate with thirty-nine fresh native
+corpora pass. The backend accepts two cases and rejects seventeen, with no
+unexpected outcomes.
+
+`NativeAIR.FriQuery` proves the query chain that reconstructs and folds each
+opened row. Reconstruction inserts the carried value at the query's slot,
+preserves every sibling in order and produces the exact arity. Each accepted
+step reduces the domain and index, interpolates the reconstructed row and
+then adds at most one reduced input at the new height, weighted by `beta^n`.
+The row recorded for authentication precedes this addition. Its interpolant
+agrees with the carried value at the parent query point; agreement with a
+global polynomial gives the corresponding global fold and input addition.
+
+An accepted chain consumes all remaining reduced inputs. Their heights are
+strictly descending, the final domain is exact, and the final index is the
+original index divided by the product of the arities. The final polynomial
+check uses the native expression with the initial domain's root and the
+reduced index. The padding theorem identifies that expression with evaluation
+at the final domain's query point. The model exposes the private native
+routine's caller preconditions as guards; final polynomial length and row
+authentication belong to the surrounding verifier.
+
+The native corpus generates 96 ordinary PCS proofs and verifies them with
+the concrete Merkle scheme. A delegating folding hook captures calls made
+by the actual private query routine through the public FRI verifier. The
+Lean reader derives reduced openings independently from known source
+polynomials by synthetic division and batching by height. It checks every
+claimed evaluation, authenticated input row, reconstructed row, folding
+result and final value across 336 queries, 246 rounds and 1,030 fold calls.
+Profiles include arities through sixteen, repeated and differing matrix
+heights, multiple batches and opening points, no-round proofs, and final
+polynomials of lengths one, two and four. Positive final degrees obey the
+native prover's strict minimum input-height condition. The recorded
+challenger includes the PCS caller's observation of all claimed evaluations
+before entering FRI.
+
+This component adds 26 roots, eleven definitions and constructors, and one
+inspected structural recursion worker. All 1,518 prior root statements and
+axiom sets, 944 premise definitions and 195 worker bodies remain unchanged.
+All 99 parallel native release tests, Clippy with warnings denied, the
+515-job strict build and the complete gate with forty fresh native corpora
+pass. The backend accepts two cases and rejects seventeen, with no
+unexpected outcomes.
+The complete authenticated PCS/FRI transcript, committed-trace extraction
+and quantitative proximity and Fiat–Shamir bounds remain open.
+
+The budget comparison covers
+21,964 Rust/Lean cases, including
+all byte-sized degree values, field and machine boundaries, inactive circuits
+and malformed metadata lengths. The selector comparison covers 1,014 field
+assignments across 48 control trees and 3,584 shared-message cases. It compares
+the actual native selector expressions, selector polynomial projection,
+escaping-yield collection and return arguments, including unsatisfied link
+equations and different raw message lengths. The operation comparison covers
+6,240 assignments across all 34 constructors and sequences that reuse outputs.
+It compares logical values, degree and constant metadata, column and lookup
+cursors, all polynomial values and all gated query arguments. A further 768
+assignments cover folded constants with positive tracked degree, including
+`eq_zero(0 * x)`. Those inputs previously crashed native constraint construction.
+The repair emits the ordinary two-column equality test when the tracked degree
+is positive, matching the compiler and witness layout. Six source variants
+pass at four inputs in singleton and grouped circuits, with eight honest proofs
+accepted and eight altered public outputs rejected. The original 6,240 records
+are unchanged. The 338-root audit changes only the frozen valued emitter's
+`eq_zero` branch; its theorem statements, axiom sets and recursion workers are
+unchanged. The native release suite passes 61 tests and release Clippy.
+The whole-block
+comparison covers 2,028 assignments across 96 fixtures with shared branch
+columns and lookup slots, default inverse advice, nonempty yields, early
+returns and continuation scope. It compares all emitted equations and lookup
+arguments, logical values and their metadata, and escaping yield values,
+including on assignments with unsatisfied selector links.
+The slot-message and multiplicity definitions used by the extraction proofs
+are also used in that native comparison.
+The whole-circuit comparison matches 2,022 assignments across 96 fixtures
+against the actual Rust circuit builder. It covers singleton, grouped and
+empty circuits, different member orders, input and return widths, shared
+multiplicity/rank columns and all physical lookup slots, including invalid
+selector and rank-byte assignments. It also compares 48 complete control-count
+records and 588 native/Lean validator outcomes, including insufficient selector
+budgets, missing members, duplicated members and empty circuits. The corpus
+now includes empty branches that emit lookups and compares all 96 branchless
+decisions. Native
+regressions exercise consumed yields, empty matches, machine/field boundaries
+and construction-time rejection. All 49 native release tests and Clippy pass.
+The branchless repair addresses a supplied-witness counterexample: a function
+whose reference result is `1` previously verified the public result `7`.
+An inactive empty branch's store message had altered the selected call's
+channel because both messages were sent without selector gating. Such
+circuits now use gated messages and one lookup per accumulator step. The
+invalid result is rejected, while the honest generated proof verifies.
+Verification keys must be rebuilt for circuits whose optimization changes.
+Padded balance still needs extraction from randomized compression, together
+with the Rust refinement connecting the reflected emitter model to execution.
+
+The call-rank repair increases proving cost through its range-checked columns
+and lookups. The IxVM FFT estimate for `Nat.add_comm` rises from 321,980,321 to
+450,907,517, and for `Array.append_assoc` from 9,591,140,574 to 18,441,968,781.
+Replaying the compiler from before the hoisting repair on all 81 pinned
+constants gives identical outputs, I/O, query counts, circuit shapes and costs
+to the repaired compiler. The hoisting repair adds no cost on that corpus.
+
+These results reach the bytecode produced by lowering. Full C8 requires public
+certified verification to imply the claim's intended source meaning, under
+the explicit set-theory hypothesis and a quantitative cryptographic failure
+bound. The remaining components are:
+
+| Component | Remaining obligation |
+| --- | --- |
+| Native verifier | Connect the enforced proof codec and shape checks, concrete Blake3 transcript and complete opened-row arithmetic to PCS acceptance, then extract satisfying committed traces. |
+| Cryptography | Prove the commitment, polynomial-testing, FRI and Fiat–Shamir guarantees with admissible parameters and explicit failure bounds. |
+| Randomized lookups | Derive the exact bounded weighted message balance used by execution extraction, excluding specified compression collisions and denominator failures. |
+| Fixed tables | Bind the preprocessed commitments and openings to the proved byte tables and their required dimensions. |
+| Compiler | Complete backward execution reflection through lowering and the remaining source transformations. |
+| Certified checker | Connect successful execution of the selected checker program to the host checker and claim-semantic results. |
+| Public release and runtime | Instantiate that checker, entrypoint, statement encoding, parameters and key in the public path, with the required native/FFI and cache correspondence. |
+
+Satisfying physical function, memory and byte rows already compose with
+bounded exact lookup balance to give execution of the selected bytecode
+success call. The conditions must still be derived from actual verifier
+acceptance, and that execution must be carried back to the certified claim.
+Taking these conditions as theorem hypotheses does not discharge them.
+
+The source and bytecode references use uncached calls. Repeated effectful calls
+can behave differently in the caching interpreter and native runtime: writes
+may occur once instead of twice, and a repeated key insertion may succeed
+because its second call is cached. A general native-to-reference theorem for
+arbitrary effectful programs therefore needs a different execution model or
+proved restrictions on the selected program. Cache refinement remains open.
+
+`Ix.Aiur.Semantics.AIR` supplies the relational model used for AIR extraction.
+It covers every bytecode operation, keeps returns separate from continuation
+yields, and represents constrained calls as requests for other rows. Advice
+is chosen per operation: I/O reads, key information and unconstrained calls
+or hints need not equal the runtime's computed values. I/O writes, key
+insertion and debugging impose no AIR relation. The four result bytes of
+an unconstrained u32 sum are advice, but its carry remains a field expression.
+Memory facts relate a width and pointer to contents. `Proofs/Memory.lean`
+proves their functionality from the local memory constraints and trace-height
+bound, and extracts queried facts from exact balance with bounded query counts.
+Extracting these rows and their satisfaction from native verifier acceptance,
+along with the selected certified program's checks, remains open.
+
+The component gate exercises 45 operation fixtures, the virtual carry
+equation, and checked derivations for shared callees, memory, continuation
+scope and early returns. Supplied native trace tests accept unchecked advice
+whose purported bytes exceed 255, reject a changed public carry, and reject
+an incorrect inverse when the program constrains its product to one. Honest
+checked inverse execution also verifies. These tests establish the intended
+model boundary; they do not prove the native row-extraction theorem.
+
+The memory regressions additionally accept a supplied native proof whose
+memory pointers start at the field's maximum element and wrap to zero. The
+same table has a checked local-validity proof in Lean. Local native checks
+for widths 1, 4 and 8 reject duplicate consecutive pointers and active rows
+after padding. These memory tables need not follow runtime insertion order,
+deduplicate equal contents, or represent acyclic data; source reflection must
+establish the properties actually needed by the selected certified program.
diff --git a/docs/tc-context-digest-collision-boundary.md b/docs/tc-context-digest-collision-boundary.md
index f7b4fb1a4..63e539edc 100644
--- a/docs/tc-context-digest-collision-boundary.md
+++ b/docs/tc-context-digest-collision-boundary.md
@@ -1,4 +1,4 @@
-# Ix.Tc context-digest collision boundary
+# Ix.Kernel context-digest collision boundary
 
 Snapshot: 2026-07-31. This note records a proof boundary for the K1/K2 cache
 soundness argument.
diff --git a/docs/tc-k0-backedge-audit.md b/docs/tc-k0-backedge-audit.md
index 243e79e71..0db491bee 100644
--- a/docs/tc-k0-backedge-audit.md
+++ b/docs/tc-k0-backedge-audit.md
@@ -1,4 +1,4 @@
-# Ix.Tc K0 recursion and back-edge audit
+# Ix.Kernel K0 recursion and back-edge audit
 
 Snapshot: 2026-07-27. This is the named K0 tick/measure artifact required by
 the formal-verification plan. Its production scope is the kernel call graph
@@ -67,7 +67,7 @@ The direct-read audit is:
 
 ```text
 rg -n '\(← read\)\.(whnf|whnfCore|whnfMode|whnfCoreFlags|infer|isDefEq)' \
-  Ix/Tc --glob '*.lean'
+  Ix/Kernel --glob '*.lean'
 ```
 
 The live edges have the following roles:
@@ -116,11 +116,11 @@ adversarial inputs that could previously diverge in an unbounded loop now
 return `.maxRecDepth` at the documented cap. Valid-corpus verdict and
 headroom parity is the A5 closure gate. Rust and Aiur are deliberately
 unchanged in K0; any corresponding hardening is a later transport obligation
-after the Ix.Tc theorem interface is stable.
+after the Ix.Kernel theorem interface is stable.
 
 ## Proof and regression surface
 
-`Ix.Tc.Verify.Totalization` exposes, and the completed trust manifest audits:
+`Ix.Kernel.Verify.Totalization` exposes, and the completed trust manifest audits:
 
 - zero/successor equations for all six `methodsN` fields;
 - unchanged-error-state equations for all six `methodsOut` fields;
@@ -142,11 +142,11 @@ The reproducible source audits are:
 
 ```text
 rg -n '^\s*partial def' \
-  Ix/Tc/{Whnf,Infer,DefEq,Inductive,Check}.lean
+  Ix/Kernel/{Whnf,Infer,DefEq,Inductive,Check}.lean
 rg -n '^\s*(while|repeat)\b' \
-  Ix/Tc/{Whnf,Infer,DefEq,Inductive,Check}.lean
+  Ix/Kernel/{Whnf,Infer,DefEq,Inductive,Check}.lean
 rg -n 'TcM\.tick' \
-  Ix/Tc/{Whnf,Infer,DefEq,Inductive,Check}.lean
+  Ix/Kernel/{Whnf,Infer,DefEq,Inductive,Check}.lean
 ```
 
 The first two must return no matches; the last must return exactly the WHNF
@@ -168,13 +168,13 @@ The 2026-07-27 K0 closure run passed all of the following:
 
 - exact four-statement sorry-frontier check;
 - completed (295 roots) and statement (4 roots) trust audits;
-- `lake build IxTcVerify` and the default `lake build`;
+- `lake build IxKernelVerify` and the default `lake build`;
 - strict `tc-unit` with warnings treated as failures;
 - pinned Init/Std stress constants and accelerated-versus-pure differential;
 - Init-scale anon verdict parity;
 - focused anon differential, full anon/meta roundtrip, and `tc-init` suites;
-- Lean4Lean replay and tutorial suites.
+- Kernel replay and tutorial suites.
 
 No production source in the Rust kernel or Aiur IxVM was changed. Their
-acceptance simulation/refinement work remains downstream of the Ix.Tc
+acceptance simulation/refinement work remains downstream of the Ix.Kernel
 soundness theorem.
diff --git a/docs/theory.md b/docs/theory.md
new file mode 100644
index 000000000..c1f4da3d6
--- /dev/null
+++ b/docs/theory.md
@@ -0,0 +1,67 @@
+# Consistency model
+
+`Ix.Theory` contains Ix's set-theoretic consistency model, its certified acceptance
+interface, and certificate construction. Build it with `lake build IxTheory`;
+run the selected regression tests, provenance check, and exact foundation
+audit with `lake run check-theory`.
+
+`Ix.Theory.Certified.accepted_has_model` constructs a model for accepted
+declarations. `accepted_proof_sound` and `no_proof_of_False` give the corresponding semantic
+and consistency results. These theorems explicitly assume a type `V` equipped
+with `Ix.Theory.Model.SetTheory V`: set operations and laws together with a
+countable tower of Grothendieck universes. The separate
+[`Models/SetTheory`](../Models/SetTheory/README.md) package constructs this
+structure on Mathlib's `ZFSet` from a strictly increasing countable sequence
+of strongly inaccessible cardinals. Its `carneiro_implies_ix` theorem retains
+that large-cardinal hypothesis explicitly and passes an axiom guard for
+`propext`, `Classical.choice`, and `Quot.sound`. User-supplied logical axioms and
+open frontiers retain their stated model hypotheses.
+
+These are relative consistency results for the certified interface. The
+[kernel verification](kernel-verification.md) now shares its universe syntax
+and proves direct model results for universe comparison, structural expression
+reading, interning, and the production sort-inference branch. A complete bridge
+from `Ix.Kernel.checkEnvAnon`, serialized Ixon, or compiler/backend execution
+to model admission remains unfinished.
+
+`Ix.Theory.Named` retains the local name-indexed specification and proof
+support needed by the existing kernel and compiler verification. It shares
+`Ix.Theory.VLevel`; its expression calculus remains separate from the store
+references and annotated semantics of the set model. The `IxTheory` build and
+foundation import graph exclude this auxiliary development.
+
+The foundation audit freezes 145 named roots, their types and dependencies,
+the fields of the set-theory assumption, and the compiler-generated recursion
+workers. It rejects proof holes and unapproved axioms, native implementations,
+and mathematical imports from the checker, compiler, test harnesses, or older
+metatheory. Its exact report is `Tests/Theory/certified-foundation.txt`.
+The axiom checks read checked declaration types, bodies, and constructor fields
+directly, including the full graph of every declaration in the mathematical
+import boundary.
+
+## Provenance and scope
+
+The port contains 120 selected source modules and a certified umbrella, from
+the Lean4Ix working tree on 2026-09-11,
+based on commit `ab42e79e2a4e2615a3ca6ef983d510f374057a38`. The new model included
+uncommitted files, so that revision alone is insufficient to identify the
+input. `Tests/Theory/ImportManifest.lean` records each selected source path and
+SHA-256. Namespace changes move `Lean4Ix` to `Ix.Theory` and flatten the former
+`Lean4Ix.Theory` syntax helpers.
+
+The import includes the exact dependencies of the certified interface and
+certificate builders. The old full theory umbrella, generators, conjecture
+frontier, and harness are excluded. Matching model tests live in `Tests/Theory`.
+Tests that formerly invoked the old generators use frozen constructor and
+recursor data extracted from their upstream compiled test fixtures.
+
+The model's 20 con-leche foundation files derive from revision
+`86cd20a65660d757cedc81561a44579099b565d0`. Their upstream and intermediate hashes,
+ported content hashes, and notices are retained and checked. Imported license
+and notice texts are under `Ix/Theory`; `PORTING.md` explains their scope.
+
+On recompilation in the monorepo, two roots—`Modeled.CheckedCompanions.fixed_old`
+and `Modeled.assignment_agrees`—acquire `Classical.choice` and `Quot.sound` in
+addition to `propext`, all already permitted baseline axioms. The reviewed
+report also accounts for namespace qualification and module ordering. All root
+types, constant counts, and module sets otherwise match the source report.
diff --git a/flake.nix b/flake.nix
index 84079f7f7..07981c6a9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -194,22 +194,6 @@
           };
           lakeDeps = lake2nix.buildDeps {
             src = leanSrc;
-            depOverride = {
-              # lean4-nix guesses a dep's library target by capitalizing the
-              # package name ("lean4lean" -> "Lean4lean"), but this package's
-              # library is `Lean4Lean`. Build the stock default targets
-              # (Lean4Lean, the lean4lean exe, Theory, Verify, Tests) plus the
-              # shared/static facets so consumers linking exes find the
-              # module `.o` files in the read-only store path.
-              lean4lean = {
-                buildPhase = ''
-                  runHook preBuild
-                  lake build
-                  lake build Lean4Lean:shared Lean4Lean:static
-                  runHook postBuild
-                '';
-              };
-            };
             depOverrideDeriv = {
               Blake3 = blake3-lean.packages.${system}.rust;
             };
diff --git a/lake-manifest.json b/lake-manifest.json
index 1f571e9bb..d10016758 100644
--- a/lake-manifest.json
+++ b/lake-manifest.json
@@ -1,17 +1,7 @@
 {"version": "1.2.0",
  "packagesDir": ".lake/packages",
  "packages":
- [{"url": "https://github.com/argumentcomputer/lean4ix",
-   "type": "git",
-   "subDir": null,
-   "scope": "",
-   "rev": "a4188d7c2979378d85c6bb41fdd96c3a48a71371",
-   "name": "lean4lean",
-   "manifestFile": "lake-manifest.json",
-   "inputRev": "a4188d7c2979378d85c6bb41fdd96c3a48a71371",
-   "inherited": false,
-   "configFile": "lakefile.toml"},
-  {"url": "https://github.com/leanprover-community/batteries",
+ [{"url": "https://github.com/leanprover-community/batteries",
    "type": "git",
    "subDir": null,
    "scope": "",
diff --git a/lakefile.lean b/lakefile.lean
index 98fe391ce..c801bfc7e 100644
--- a/lakefile.lean
+++ b/lakefile.lean
@@ -10,7 +10,7 @@ require LSpec from git
 /- Blake3 precompiles its libraries, so Lake loads their shared objects -- which
 bundle the C and Rust FFI objects -- into any process elaborating a module that
 imports them. That is what supplies the BLAKE3 backend to Lean's native evaluator
-for the `native_decide` proofs in `IxTcVerify`, so this pin must stay at or after
+for the `native_decide` proofs in `IxKernelVerify`, so this pin must stay at or after
 the revision that turned precompilation on. Before it, Blake3 exposed a
 `blake3_rs_shared` cdylib that `ix_native_decide_dynlib` had to fetch and link;
 that target no longer exists. -/
@@ -23,20 +23,6 @@ require Cli from git
 require batteries from git
   "https://github.com/leanprover-community/batteries" @ "v4.33.0"
 
-/- Reference Lean4-in-Lean4 theory and checker. `IxTcVerify` imports its
-Theory/Verify specification surface, while `bench-lean4lean` and the ignored
-`lean4lean` test runner exercise the implementation. The default `ix` target
-still does not build this dependency. Pin `argumentcomputer/lean4ix` exactly --
-the Argument development line, a standalone repository rather than a GitHub
-fork of digama0/lean4lean: this revision carries the upstream v4.32/v4.33
-kernel hardening — including the `checkNoMVarNoFVar` check on an opaque's
-value (leanprover/lean4#14498), which the replay path in
-`Benchmarks/Lean4Lean.lean` reaches — on top of that line's certified
-inductive-environment and projection development, and tracks Lean v4.33.1 as
-this package does. -/
-require lean4lean from git
-  "https://github.com/argumentcomputer/lean4ix" @ "a4188d7c2979378d85c6bb41fdd96c3a48a71371"
-
 /-! ## FFI
 
 The Rust static libraries use `target` + `moreLinkObjs` instead of `extern_lib` because different Lean executables need different Cargo features:
@@ -194,18 +180,6 @@ lean_exe «bench-aggregate-policy» where
   -- symbols are then resolved from ix_ffi and not pulled twice.
   moreLinkObjs := #[ix_rs]
 
-/- The lean4lean replay machinery as an importable lib: the
-`bench-lean4lean` exe root and the ignored `lean4lean` test runner both
-import `Benchmarks.Lean4Lean`, and modules under `Benchmarks/` belong to
-no other lib target, so without this Lake cannot schedule the module from
-the Tests import graph. -/
-lean_lib Lean4LeanBench where
-  globs := #[.one `Benchmarks.Lean4Lean]
-
-lean_exe «bench-lean4lean» where
-  root := `Benchmarks.Lean4LeanMain
-  supportInterpreter := true
-
 lean_exe «bench-compile-init» where
   root := `Benchmarks.CompileInit
 
@@ -228,9 +202,13 @@ lean_exe truthmines where
 
 end Benchmarks
 
-section IxTcVerify
+lean_lib IxTheoryNamed where
+  roots := #[]
+  globs := #[.submodules `Ix.Theory.Named]
+
+section IxKernelVerify
 
-/-- Loadable FFI for Lean's native evaluator while `IxTcVerify` is elaborated.
+/-- Loadable FFI for Lean's native evaluator while `IxKernelVerify` is elaborated.
 
 `native_decide` runs compiled Lean before any executable is linked, so for each
 opaque `@[extern]` it reaches, both symbol layers must be loadable up front:
@@ -255,31 +233,176 @@ target ix_native_decide_dynlib pkg : Dynlib := do
     (pkg.buildDir / nameToSharedLib "ix_native_decide")
     (boxedObjs.push ixCdylib) #[]
 
-/- Formal verification of `Ix.Tc` against the lean4lean `Theory` spec.
+/- Formal verification of `Ix.Kernel` against the internal named specification.
 Non-default: `lake build ix` never
 touches it, and `build-all` (the lint driver) skips it by name because its
-pinned Lean4Lean dependencies still emit named `sorry` warnings — `lake lint
+internal named-specification proofs still emit named `sorry` warnings — `lake lint
 -- --wfail` would otherwise fail even though the Ix verification source has
 no local `sorry` tokens. Required CI builds it separately without `--wfail`,
 audits the exact local sorry frontier, and checks exact per-root transitive
 axiom plus direct-`sorryAx`-origin manifests. Dev loop:
-`lake build IxTcVerify`; focused trust audit:
-`lake build Ix.Tc.Verify.Audit.Completed Ix.Tc.Verify.Audit.Conditional
-Ix.Tc.Verify.Audit.Statements`. -/
-lean_lib IxTcVerify where
-  globs := #[.submodules `Ix.Tc.Verify]
+`lake build IxKernelVerify`; focused trust audit:
+`lake build Ix.Kernel.Verify.Audit.Completed Ix.Kernel.Verify.Audit.Conditional
+Ix.Kernel.Verify.Audit.Statements`. -/
+lean_lib IxKernelVerify where
+  globs := #[.submodules `Ix.Kernel.Verify]
   -- `supportInterpreter` is a `lean_exe` option and takes effect only when
   -- that executable is linked, after its modules have been elaborated.
   -- These native-decide proofs need the boxed FFI symbols while the library
   -- modules are being elaborated, so they must be supplied as a dynlib.
   dynlibs := #[ix_native_decide_dynlib]
 
-end IxTcVerify
+end IxKernelVerify
+
+/- Refinement of production kernel operations into the new consistency model.
+Checked independently so its proved roots have their own axiom boundary. -/
+lean_lib IxKernelConsistency where
+  roots := #[`Ix.Kernel.Verify.Consistency]
+  globs := #[.andSubmodules `Ix.Kernel.Verify.Consistency]
+
+/- Compiler and verifier-binding components with an independent exact audit. -/
+lean_lib IxAiurVerify where
+  roots := #[`Ix.Aiur.Proofs]
+  globs := #[.andSubmodules `Ix.Aiur.Proofs]
+
+lean_exe «aiur-backend-tests» where
+  root := `Tests.Aiur.Backend
+
+lean_exe «aiur-bytecode-tests» where
+  root := `Tests.Aiur.BytecodeCompare
+  supportInterpreter := true
+
+lean_exe «aiur-dedup-tests» where
+  root := `Tests.Aiur.Dedup
+  supportInterpreter := true
+
+lean_exe «aiur-tail-match-tests» where
+  root := `Tests.Aiur.TailMatches
+  supportInterpreter := true
+
+lean_exe «aiur-source-value-tests» where
+  root := `Tests.Aiur.SourceValues
+  supportInterpreter := true
+
+lean_exe «aiur-hoisting-tests» where
+  root := `Tests.Aiur.Hoisting
+  supportInterpreter := true
+
+lean_exe «aiur-air-tests» where
+  root := `Tests.Aiur.AIRSemantics
+
+lean_exe «aiur-byte-gadget-tests» where
+  root := `Tests.Aiur.ByteGadgets
+
+lean_exe «aiur-lookup-shape-tests» where
+  root := `Tests.Aiur.LookupShapes
+
+lean_exe «aiur-lookup-budget-tests» where
+  root := `Tests.Aiur.LookupBudget
+
+lean_exe «aiur-selector-control-tests» where
+  root := `Tests.Aiur.SelectorControl
+
+lean_exe «aiur-operation-row-tests» where
+  root := `Tests.Aiur.OperationRows
+
+lean_exe «aiur-block-row-tests» where
+  root := `Tests.Aiur.BlockRows
+
+lean_exe «aiur-circuit-row-tests» where
+  root := `Tests.Aiur.CircuitRows
+
+lean_exe «aiur-memory-row-tests» where
+  root := `Tests.Aiur.MemoryRows
+
+lean_exe «aiur-trace-height-tests» where
+  root := `Tests.Aiur.TraceHeights
+
+lean_exe «aiur-expression-graph-tests» where
+  root := `Tests.Aiur.ExpressionGraph
+
+lean_exe «aiur-constant-degree-tests» where
+  root := `Tests.Aiur.ConstantDegree
+
+lean_exe «aiur-frontend-expression-tests» where
+  root := `Tests.Aiur.FrontendExpressions
+
+lean_exe «aiur-graph-compilation-tests» where
+  root := `Tests.Aiur.GraphCompilation
+
+lean_exe «aiur-operation-expression-tests» where
+  root := `Tests.Aiur.OperationExpressions
+
+lean_exe «aiur-block-expression-tests» where
+  root := `Tests.Aiur.BlockExpressions
+
+lean_exe «aiur-circuit-expression-tests» where
+  root := `Tests.Aiur.CircuitExpressions
+
+lean_exe «aiur-emission-check-tests» where
+  root := `Tests.Aiur.EmissionChecks
+
+lean_exe «aiur-key-codec-tests» where
+  root := `Tests.Aiur.KeyCodec
+
+lean_exe «aiur-compiled-key-tests» where
+  root := `Tests.Aiur.CompiledKey
+
+lean_exe «aiur-proof-codec-tests» where
+  root := `Tests.Aiur.ProofCodec
+
+lean_exe «aiur-proof-shape-tests» where
+  root := `Tests.Aiur.ProofShape
+
+lean_exe «aiur-extension-tests» where
+  root := `Tests.Aiur.Extension
+
+lean_exe «aiur-logup-tests» where
+  root := `Tests.Aiur.LogUp
+
+lean_exe «aiur-domain-tests» where
+  root := `Tests.Aiur.Domain
+
+lean_exe «aiur-verifier-arithmetic-tests» where
+  root := `Tests.Aiur.VerifierArithmetic
+
+lean_exe «aiur-transcript-tests» where
+  root := `Tests.Aiur.Transcript
+
+lean_exe «aiur-blake3-tests» where
+  root := `Tests.Aiur.Blake3
+
+lean_exe «aiur-merkle-cap-tests» where
+  root := `Tests.Aiur.MerkleCap
+
+lean_exe «aiur-merkle-tests» where
+  root := `Tests.Aiur.Merkle
+
+lean_exe «aiur-pruned-merkle-tests» where
+  root := `Tests.Aiur.PrunedMerkle
+
+lean_exe «aiur-extension-mmcs-tests» where
+  root := `Tests.Aiur.ExtensionMmcs
+
+lean_exe «aiur-fri-domain-tests» where
+  root := `Tests.Aiur.FriDomain
+
+lean_exe «aiur-polynomial-tests» where
+  root := `Tests.Aiur.Polynomial
+
+lean_exe «aiur-interpolation-tests» where
+  root := `Tests.Aiur.Interpolation
+
+lean_exe «aiur-folding-tests» where
+  root := `Tests.Aiur.Folding
+
+lean_exe «aiur-fri-query-tests» where
+  root := `Tests.Aiur.FriQuery
 
 section IxCompileVerify
 
 /- Formal verification of the Lean-to-Ixon compiler against the same
-Lean4Lean Theory endpoint as `IxTcVerify`.  Kept as a separate non-default
+internal named-specification endpoint as `IxKernelVerify`.  Kept as a separate non-default
 library so compiler proofs cannot accidentally inherit checker acceptance
 theorems as their specification. -/
 lean_lib IxCompileVerify where
@@ -342,12 +465,16 @@ script "get-exe-targets" := do
 @[lint_driver]
 script "build-all" (args) := do
   let pkg ← getRootPackage
-  let libNames := pkg.configTargets LeanLib.configKind |>.map (·.name.toString)
-  let exeNames := pkg.configTargets LeanExe.configKind |>.map (·.name.toString)
-  -- IxTcVerify is the WIP proofs lib: sorry-bearing by design while the
+  let libNames := pkg.configTargets LeanLib.configKind |>.map (·.name.toString false)
+  let exeNames := pkg.configTargets LeanExe.configKind |>.map (·.name.toString false)
+  -- IxKernelVerify is the WIP proofs lib: sorry-bearing by design while the
   -- verification frontier is open, so it must not run under `--wfail`.
   -- Required CI builds it separately and audits the exact frontier.
-  let allNames := (libNames ++ exeNames |>.toList).filter (· != "IxTcVerify")
+  -- Compiler and theory checks have dedicated CI jobs and scripts below.
+  let allNames := (libNames ++ exeNames |>.toList).filter fun name =>
+    name != "IxKernelVerify" && name != "IxCompileVerify" && !name.startsWith "IxCompiler" &&
+      !name.startsWith "IxTheory" && !name.startsWith "compiler-" &&
+      !name.startsWith "theory-"
   for name in allNames do
     IO.println s!"Building: {name}"
     let child ← IO.Process.spawn {
@@ -358,3 +485,483 @@ script "build-all" (args) := do
   return 0
 
 end Scripts
+
+section Compiler
+
+/- Independent compiler and theory imports. These are not dependencies of
+the production Ix umbrella or CLI. Their checks run in separate CI jobs. -/
+target compiler_hpt_cache_sync pkg : FilePath := do
+  let source ← inputTextFile <| pkg.dir / "native/compiler/hpt_cache_sync.c"
+  let object := pkg.buildDir / "native" / "compiler_hpt_cache_sync.o"
+  let includeDir ← getLeanIncludeDir
+  buildO object source #["-fPIC", "-I", includeDir.toString] #[] "cc" getLeanTrace
+
+lean_lib IxCompiler where
+  roots := #[`Ix.Compiler]
+  globs := #[.andSubmodules `Ix.Compiler]
+  moreLinkObjs := #[compiler_hpt_cache_sync]
+
+lean_lib IxCompilerTests where
+  roots := #[`Tests.Compiler]
+  globs := #[]
+
+lean_lib IxCompilerBench where
+  roots := #[`Benchmarks.Compiler]
+
+lean_exe «compiler-benchmark» where
+  root := `Benchmarks.Compiler
+
+lean_exe «compiler-tests» where
+  root := `Tests.Compiler.Tests
+
+lean_exe «compiler-catalog-contact» where
+  root := `Tests.Compiler.CatalogContact
+
+lean_exe «compiler-x86-object-fixture» where
+  root := `Tests.Compiler.X86ObjectFixture
+
+lean_exe «compiler-source-coverage» where
+  root := `Tests.Compiler.SourceCoverage
+
+lean_exe «compiler-source-recursion» where
+  root := `Tests.Compiler.SourceRecursion
+
+lean_exe «compiler-source-call-reuse» where
+  root := `Tests.Compiler.SourceCallReuse
+
+lean_exe «compiler-source-unique-reuse» where
+  root := `Tests.Compiler.SourceUniqueReuse
+
+lean_exe «compiler-source-native-unique» where
+  root := `Tests.Compiler.SourceNativeUnique
+
+lean_exe «compiler-source-native-runtime» where
+  root := `Tests.Compiler.SourceNativeRuntime
+
+lean_exe «compiler-source-native-upstream» where
+  root := `Tests.Compiler.SourceNativeUpstream
+
+lean_exe «compiler-source-native-scalar» where
+  root := `Tests.Compiler.SourceNativeScalar
+
+lean_exe «compiler-source-native-physical-scalar» where
+  root := `Tests.Compiler.SourceNativePhysicalScalar
+
+lean_exe «compiler-source-native-captured-scalar» where
+  root := `Tests.Compiler.SourceNativeCapturedScalar
+
+lean_exe «compiler-source-borrow» where
+  root := `Tests.Compiler.SourceBorrow
+
+lean_exe «compiler-source-borrow-runtime» where
+  root := `Tests.Compiler.SourceBorrowRuntime
+
+lean_exe «compiler-check-x86-encoder» where
+  root := `Tests.Compiler.Checks.CheckX86Encoder
+
+lean_exe «compiler-check-x86-bytes» where
+  root := `Tests.Compiler.Checks.CheckX86Bytes
+
+lean_exe «compiler-check-x86-streams» where
+  root := `Tests.Compiler.Checks.CheckX86Streams
+
+lean_exe «compiler-check-x86-object» where
+  root := `Tests.Compiler.Checks.CheckX86Object
+
+lean_exe «compiler-check-trusted-externs» where
+  root := `Tests.Compiler.Checks.CheckTrustedExterns
+
+lean_exe «compiler-check-source-coverage» where
+  root := `Tests.Compiler.Checks.CheckSourceCoverage
+
+lean_exe «compiler-check-source-recursion» where
+  root := `Tests.Compiler.Checks.CheckSourceRecursion
+
+lean_exe «compiler-check-source-call-reuse» where
+  root := `Tests.Compiler.Checks.CheckSourceCallReuse
+
+lean_exe «compiler-check-source-unique-reuse» where
+  root := `Tests.Compiler.Checks.CheckSourceUniqueReuse
+
+lean_exe «compiler-check-source-native-unique» where
+  root := `Tests.Compiler.Checks.CheckSourceNativeUnique
+
+lean_exe «compiler-check-source-native-runtime» where
+  root := `Tests.Compiler.Checks.CheckSourceNativeRuntime
+
+lean_exe «compiler-check-source-native-upstream» where
+  root := `Tests.Compiler.Checks.CheckSourceNativeUpstream
+
+lean_exe «compiler-check-source-native-scalar» where
+  root := `Tests.Compiler.Checks.CheckSourceNativeScalar
+
+lean_exe «compiler-check-source-native-physical-scalar» where
+  root := `Tests.Compiler.Checks.CheckSourceNativePhysicalScalar
+
+lean_exe «compiler-check-source-native-captured-scalar» where
+  root := `Tests.Compiler.Checks.CheckSourceNativeCapturedScalar
+
+lean_exe «compiler-check-source-borrow» where
+  root := `Tests.Compiler.Checks.CheckSourceBorrow
+
+lean_exe «compiler-check-source-borrow-runtime» where
+  root := `Tests.Compiler.Checks.CheckSourceBorrowRuntime
+
+lean_exe «compiler-check-tools-tests» where
+  root := `Tests.Compiler.Checks.CheckToolsTests
+
+end Compiler
+
+section Theory
+
+lean_lib IxTheory where
+  roots := #[`Ix.Theory]
+  -- The set model has its own import graph and trust audit. Named kernel
+  -- proof support belongs to IxTheoryNamed and is checked separately.
+  globs := #[.one `Ix.Theory, .one `Ix.Theory.Certified,
+    .one `Ix.Theory.Const, .one `Ix.Theory.Expr, .one `Ix.Theory.Quot,
+    .one `Ix.Theory.Ref, .one `Ix.Theory.Rename, .one `Ix.Theory.Store,
+    .one `Ix.Theory.VLevel, .submodules `Ix.Theory.Certificate,
+    .submodules `Ix.Theory.Certified, .submodules `Ix.Theory.Inductive,
+    .submodules `Ix.Theory.Model, .submodules `Ix.Theory.Std]
+
+lean_lib IxTheoryCertified where
+  roots := #[`Ix.Theory.Certified]
+
+lean_lib IxTheoryTests where
+  roots := #[`Tests.Theory]
+
+lean_exe «theory-provenance» where
+  root := `Tests.Theory.Provenance
+
+end Theory
+
+section Certified
+
+lean_lib IxCertified where
+  roots := #[`Ix.Certified]
+  moreLinkObjs := #[ix_rs]
+
+lean_lib IxCertifiedAudit where
+  roots := #[`Ix.Certified.AuditAll]
+
+lean_exe "certified-cli-tests" where
+  root := `Tests.Certified.CLI
+  supportInterpreter := true
+
+lean_exe "certified-adapter-tests" where
+  root := `Tests.Certified.Check
+  supportInterpreter := true
+
+lean_exe «certified-check» where
+  root := `Ix.Certified.Main
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-claim-check» where
+  root := `Ix.Certified.ClaimMain
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-feature-tests» where
+  root := `Tests.Certified.Features
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-ordinary-tests» where
+  root := `Tests.Certified.Ordinary
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-vm-tests» where
+  root := `Tests.Certified.VM
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-source-tests» where
+  root := `Tests.Certified.SourceMain
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-fidelity-tests» where
+  root := `Tests.Certified.FidelityMain
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-claim-tests» where
+  root := `Tests.Certified.ClaimsMain
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+lean_exe «certified-modeled-tests» where
+  root := `Tests.Certified.ModeledMain
+  supportInterpreter := true
+  moreLinkObjs := #[ix_rs]
+
+end Certified
+
+namespace ComponentChecks
+
+private def run (command : String) (args : Array String := #[]) : IO Unit := do
+  IO.println s!"Running: {command} {String.intercalate " " args.toList}"
+  let child ← IO.Process.spawn { cmd := command, args, stdout := .inherit, stderr := .inherit }
+  let code ← child.wait
+  unless code == 0 do throw (IO.userError s!"{command} failed ({code})")
+
+private def compilerExe (name : String) : String := s!".lake/build/bin/compiler-{name}"
+
+end ComponentChecks
+
+open ComponentChecks
+
+/-- Build every compiler target, then exercise independent byte/native checks. -/
+script "check-compiler" := do
+  let pkg ← getRootPackage
+  let executables := pkg.configTargets LeanExe.configKind |>.map (·.name.toString false)
+    |>.filter (·.startsWith "compiler-")
+  run "lake" (#["build", "IxCompiler"] ++ executables)
+  for name in ["tests", "check-trusted-externs", "check-tools-tests",
+      "check-x86-encoder", "check-x86-bytes", "check-x86-streams"] do
+    run (compilerExe name)
+  let host ← IO.Process.output { cmd := "uname", args := #["-sm"] }
+  unless host.exitCode == 0 do throw (IO.userError "unable to identify native test host")
+  let native := host.stdout.trimAscii.toString == "Linux x86_64"
+  let nativeArgs (fixture : String) : Array String := if native then
+    #["--cc", "cc", "--harness", s!"Tests/Fixtures/Compiler/{fixture}/native_harness.c"] else #[]
+  run (compilerExe "check-x86-object")
+    (#["--fixture", compilerExe "x86-object-fixture"] ++ nativeArgs "x86")
+  run (compilerExe "check-source-coverage")
+    (#["--fixture", compilerExe "source-coverage"] ++ nativeArgs "x86")
+  for name in ["source-recursion", "source-call-reuse", "source-unique-reuse",
+      "source-borrow", "source-borrow-runtime"] do
+    run (compilerExe s!"check-{name}") #["--fixture", compilerExe name]
+  for name in ["source-native-unique", "source-native-runtime", "source-native-upstream",
+      "source-native-scalar", "source-native-physical-scalar", "source-native-captured-scalar"] do
+    run (compilerExe s!"check-{name}") (#["--fixture", compilerExe name] ++ nativeArgs name)
+  run (compilerExe "check-source-native-runtime")
+    (#["--fixture", compilerExe "source-native-runtime", "--variant", "counter-fold"] ++
+      nativeArgs "source-native-runtime")
+  run (compilerExe "benchmark") #["analysis-self-check"]
+  IO.println s!"Compiler checks passed (native execution: {native})."
+  return 0
+
+/-- Check the selected theory, its provenance, and the exact foundation report. -/
+script "check-theory" := do
+  run "lake" #["build", "--wfail", "IxTheory", "IxTheoryTests", "theory-provenance"]
+  run ".lake/build/bin/theory-provenance"
+  let report ← IO.Process.output {
+    cmd := "lake", args := #["env", "lean", "Tests/Theory/Audit/Certified.lean"] }
+  unless report.exitCode == 0 do throw (IO.userError s!"{report.stdout}{report.stderr}")
+  let expected ← IO.FS.readFile "Tests/Theory/certified-foundation.txt"
+  unless report.stdout == expected do
+    IO.FS.withTempFile fun handle path => do
+      handle.putStr report.stdout
+      handle.flush
+      let child ← IO.Process.spawn {
+        cmd := "diff", args := #["-u", "Tests/Theory/certified-foundation.txt", path.toString]
+        stdout := .inherit, stderr := .inherit }
+      let _ ← child.wait
+      throw (IO.userError "certified foundation report differs from the reviewed manifest")
+  IO.println "Theory checks passed: exact root types, axioms, dependencies, and runtime inventory."
+  return 0
+
+/-- Audit Aiur components and exercise their actual native verifier binding. -/
+script "check-aiur" := do
+  run "lake" #["build", "--wfail", "IxAiurVerify", "aiur-backend-tests",
+    "aiur-bytecode-tests", "aiur-dedup-tests", "aiur-tail-match-tests", "aiur-source-value-tests",
+    "aiur-hoisting-tests", "aiur-air-tests", "aiur-byte-gadget-tests", "aiur-lookup-shape-tests",
+    "aiur-lookup-budget-tests", "aiur-selector-control-tests", "aiur-operation-row-tests",
+    "aiur-block-row-tests", "aiur-circuit-row-tests", "aiur-memory-row-tests", "aiur-trace-height-tests",
+    "aiur-expression-graph-tests", "aiur-constant-degree-tests", "aiur-frontend-expression-tests",
+    "aiur-graph-compilation-tests", "aiur-operation-expression-tests", "aiur-block-expression-tests",
+    "aiur-circuit-expression-tests", "aiur-emission-check-tests", "aiur-key-codec-tests", "aiur-compiled-key-tests",
+    "aiur-proof-codec-tests", "aiur-proof-shape-tests", "aiur-extension-tests", "aiur-logup-tests", "aiur-domain-tests",
+    "aiur-verifier-arithmetic-tests", "aiur-transcript-tests", "aiur-blake3-tests", "aiur-merkle-cap-tests",
+    "aiur-merkle-tests", "aiur-pruned-merkle-tests", "aiur-extension-mmcs-tests", "aiur-fri-domain-tests",
+    "aiur-polynomial-tests", "aiur-interpolation-tests", "aiur-folding-tests", "aiur-fri-query-tests"]
+  let report ← IO.Process.output {
+    cmd := "lake", args := #["env", "lean", "-DwarningAsError=true", "Ix/Aiur/Proofs/Audit.lean"] }
+  unless report.exitCode == 0 do throw (IO.userError s!"{report.stdout}{report.stderr}")
+  let expectedPath := "Tests/Aiur/backend-foundation.txt"
+  let expected ← IO.FS.readFile expectedPath
+  unless report.stdout == expected do
+    IO.FS.withTempFile fun handle path => do
+      handle.putStr report.stdout
+      handle.flush
+      let child ← IO.Process.spawn {
+        cmd := "diff", args := #["-u", expectedPath, path.toString]
+        stdout := .inherit, stderr := .inherit }
+      let _ ← child.wait
+      throw (IO.userError "Aiur component report differs from the reviewed manifest")
+  let snapshots : Array (String × Array String × String) := #[
+    ("aiur-bytecode-tests", #[], "Tests/Aiur/bytecode-compatibility.txt"),
+    ("aiur-dedup-tests", #["--snapshot"], "Tests/Aiur/dedup-compatibility.txt"),
+    ("aiur-tail-match-tests", #[], "Tests/Aiur/tail-match-compatibility.txt"),
+    ("aiur-source-value-tests", #[], "Tests/Aiur/source-value-compatibility.txt")]
+  for (program, args, comparisonPath) in snapshots do
+    let comparison ← IO.Process.output { cmd := s!".lake/build/bin/{program}", args }
+    unless comparison.exitCode == 0 && comparison.stderr.isEmpty do
+      throw (IO.userError s!"{comparison.stdout}{comparison.stderr}")
+    unless comparison.stdout == (← IO.FS.readFile comparisonPath) do
+      IO.FS.withTempFile fun handle path => do
+        handle.putStr comparison.stdout
+        handle.flush
+        let child ← IO.Process.spawn {
+          cmd := "diff", args := #["-u", comparisonPath, path.toString]
+          stdout := .inherit, stderr := .inherit }
+        let _ ← child.wait
+        throw (IO.userError s!"{program} differs from its original native snapshot")
+  run ".lake/build/bin/aiur-dedup-tests"
+  run ".lake/build/bin/aiur-hoisting-tests"
+  run ".lake/build/bin/aiur-air-tests"
+  run ".lake/build/bin/aiur-constant-degree-tests"
+  IO.FS.withTempDir fun directory => do
+    let snapshot := directory / "native-byte-gadgets.bin"
+    let shapeSnapshot := directory / "native-lookup-shapes.bin"
+    let budgetSnapshot := directory / "native-lookup-budget.bin"
+    let selectorSnapshot := directory / "native-selector-control.bin"
+    let operationSnapshot := directory / "native-operation-rows.bin"
+    let blockSnapshot := directory / "native-block-rows.bin"
+    let circuitSnapshot := directory / "native-circuit-rows.bin"
+    let memorySnapshot := directory / "native-memory-rows.bin"
+    let traceHeightSnapshot := directory / "native-trace-heights.bin"
+    let graphShapeSnapshot := directory / "native-graph-shapes.bin"
+    let expressionGraphSnapshot := directory / "native-expression-graphs.bin"
+    let constantDegreeSnapshot := directory / "native-constant-degree-rows.bin"
+    let frontendSnapshot := directory / "native-frontend-expressions.bin"
+    let compilationSnapshot := directory / "native-graph-compilation.bin"
+    let operationExpressionSnapshot := directory / "native-operation-expressions.bin"
+    let blockExpressionSnapshot := directory / "native-block-expressions.bin"
+    let circuitExpressionSnapshot := directory / "native-circuit-expressions.bin"
+    let emissionCheckSnapshot := directory / "native-emission-checks.bin"
+    let keyCodecSnapshot := directory / "native-key-codec.bin"
+    let compiledKeySnapshot := directory / "native-compiled-keys.bin"
+    let proofCodecSnapshot := directory / "native-proof-codec.bin"
+    let proofShapeSnapshot := directory / "native-proof-shapes.bin"
+    let extensionSnapshot := directory / "native-extension-arithmetic.bin"
+    let extensionGraphSnapshot := directory / "native-extension-graphs.bin"
+    let logupSnapshot := directory / "native-logup.bin"
+    let logupStageSnapshot := directory / "native-logup-stages.bin"
+    let domainSnapshot := directory / "native-domains.bin"
+    let quotientSnapshot := directory / "native-quotients.bin"
+    let verifierArithmeticSnapshot := directory / "native-verifier-arithmetic.bin"
+    let transcriptSnapshot := directory / "native-transcript.bin"
+    let blake3Snapshot := directory / "native-blake3.bin"
+    let merkleCapSnapshot := directory / "native-merkle-cap.bin"
+    let merklePathSnapshot := directory / "native-merkle-path.bin"
+    let prunedMerkleSnapshot := directory / "native-pruned-merkle.bin"
+    let extensionMmcsSnapshot := directory / "native-extension-mmcs.bin"
+    let friDomainSnapshot := directory / "native-fri-domains.bin"
+    let polynomialSnapshot := directory / "native-polynomials.bin"
+    let interpolationSnapshot := directory / "native-interpolation.bin"
+    let foldingSnapshot := directory / "native-folding.bin"
+    let friQuerySnapshot := directory / "native-fri-query.bin"
+    let exporter ← IO.Process.spawn {
+      cmd := "cargo"
+      args := #["test", "--locked", "--release", "-p", "aiur",
+        "_snapshot"]
+      env := #[("IX_BYTE_GADGET_SNAPSHOT", some snapshot.toString),
+        ("IX_LOOKUP_SHAPE_SNAPSHOT", some shapeSnapshot.toString),
+        ("IX_LOOKUP_BUDGET_SNAPSHOT", some budgetSnapshot.toString),
+        ("IX_SELECTOR_CONTROL_SNAPSHOT", some selectorSnapshot.toString),
+        ("IX_OPERATION_ROW_SNAPSHOT", some operationSnapshot.toString),
+        ("IX_BLOCK_ROW_SNAPSHOT", some blockSnapshot.toString),
+        ("IX_CIRCUIT_ROW_SNAPSHOT", some circuitSnapshot.toString),
+        ("IX_MEMORY_ROW_SNAPSHOT", some memorySnapshot.toString),
+        ("IX_FIXED_TRACE_HEIGHT_SNAPSHOT", some traceHeightSnapshot.toString),
+        ("IX_GRAPH_SHAPE_SNAPSHOT", some graphShapeSnapshot.toString),
+        ("IX_EXPRESSION_GRAPH_SNAPSHOT", some expressionGraphSnapshot.toString),
+        ("IX_CONSTANT_DEGREE_ROW_SNAPSHOT", some constantDegreeSnapshot.toString),
+        ("IX_FRONTEND_EXPRESSION_SNAPSHOT", some frontendSnapshot.toString),
+        ("IX_GRAPH_COMPILATION_SNAPSHOT", some compilationSnapshot.toString),
+        ("IX_OPERATION_EXPRESSION_SNAPSHOT", some operationExpressionSnapshot.toString),
+        ("IX_BLOCK_EXPRESSION_SNAPSHOT", some blockExpressionSnapshot.toString),
+        ("IX_CIRCUIT_EXPRESSION_SNAPSHOT", some circuitExpressionSnapshot.toString),
+        ("IX_EMISSION_CHECK_SNAPSHOT", some emissionCheckSnapshot.toString),
+        ("IX_KEY_CODEC_SNAPSHOT", some keyCodecSnapshot.toString),
+        ("IX_COMPILED_KEY_SNAPSHOT", some compiledKeySnapshot.toString),
+        ("IX_PROOF_CODEC_SNAPSHOT", some proofCodecSnapshot.toString),
+        ("IX_PROOF_SHAPE_SNAPSHOT", some proofShapeSnapshot.toString),
+        ("IX_EXTENSION_ARITHMETIC_SNAPSHOT", some extensionSnapshot.toString),
+        ("IX_EXTENSION_GRAPH_SNAPSHOT", some extensionGraphSnapshot.toString),
+        ("IX_LOGUP_SNAPSHOT", some logupSnapshot.toString),
+        ("IX_LOGUP_STAGE_SNAPSHOT", some logupStageSnapshot.toString),
+        ("IX_DOMAIN_SNAPSHOT", some domainSnapshot.toString),
+        ("IX_QUOTIENT_SNAPSHOT", some quotientSnapshot.toString),
+        ("IX_VERIFIER_ARITHMETIC_SNAPSHOT", some verifierArithmeticSnapshot.toString),
+        ("IX_TRANSCRIPT_SNAPSHOT", some transcriptSnapshot.toString),
+        ("IX_BLAKE3_SNAPSHOT", some blake3Snapshot.toString),
+        ("IX_MERKLE_CAP_SNAPSHOT", some merkleCapSnapshot.toString),
+        ("IX_MERKLE_PATH_SNAPSHOT", some merklePathSnapshot.toString),
+        ("IX_PRUNED_MERKLE_SNAPSHOT", some prunedMerkleSnapshot.toString),
+        ("IX_EXTENSION_MMCS_SNAPSHOT", some extensionMmcsSnapshot.toString),
+        ("IX_FRI_DOMAIN_SNAPSHOT", some friDomainSnapshot.toString),
+        ("IX_POLYNOMIAL_SNAPSHOT", some polynomialSnapshot.toString),
+        ("IX_INTERPOLATION_SNAPSHOT", some interpolationSnapshot.toString),
+        ("IX_FOLDING_SNAPSHOT", some foldingSnapshot.toString),
+        ("IX_FRI_QUERY_SNAPSHOT", some friQuerySnapshot.toString)]
+      stdout := .inherit
+      stderr := .inherit }
+    unless (← exporter.wait) == 0 do
+      throw (IO.userError "native Aiur component snapshot export failed")
+    run ".lake/build/bin/aiur-byte-gadget-tests" #[snapshot.toString]
+    run ".lake/build/bin/aiur-lookup-shape-tests" #[shapeSnapshot.toString]
+    run ".lake/build/bin/aiur-lookup-budget-tests" #[budgetSnapshot.toString]
+    run ".lake/build/bin/aiur-selector-control-tests" #[selectorSnapshot.toString]
+    run ".lake/build/bin/aiur-operation-row-tests" #[operationSnapshot.toString, constantDegreeSnapshot.toString]
+    run ".lake/build/bin/aiur-frontend-expression-tests" #[frontendSnapshot.toString]
+    run ".lake/build/bin/aiur-graph-compilation-tests" #[compilationSnapshot.toString]
+    run ".lake/build/bin/aiur-operation-expression-tests" #[operationExpressionSnapshot.toString]
+    run ".lake/build/bin/aiur-block-expression-tests" #[blockExpressionSnapshot.toString]
+    run ".lake/build/bin/aiur-circuit-expression-tests" #[circuitExpressionSnapshot.toString]
+    run ".lake/build/bin/aiur-emission-check-tests" #[emissionCheckSnapshot.toString]
+    run ".lake/build/bin/aiur-key-codec-tests" #[keyCodecSnapshot.toString]
+    run ".lake/build/bin/aiur-compiled-key-tests" #[compiledKeySnapshot.toString]
+    run ".lake/build/bin/aiur-proof-codec-tests" #[proofCodecSnapshot.toString]
+    run ".lake/build/bin/aiur-proof-shape-tests" #[proofShapeSnapshot.toString]
+    run ".lake/build/bin/aiur-extension-tests" #[extensionSnapshot.toString, extensionGraphSnapshot.toString]
+    run ".lake/build/bin/aiur-logup-tests" #[logupSnapshot.toString, logupStageSnapshot.toString]
+    run ".lake/build/bin/aiur-domain-tests" #[domainSnapshot.toString, quotientSnapshot.toString]
+    run ".lake/build/bin/aiur-verifier-arithmetic-tests" #[verifierArithmeticSnapshot.toString]
+    run ".lake/build/bin/aiur-transcript-tests" #[transcriptSnapshot.toString]
+    run ".lake/build/bin/aiur-blake3-tests" #[blake3Snapshot.toString]
+    run ".lake/build/bin/aiur-merkle-cap-tests" #[merkleCapSnapshot.toString]
+    run ".lake/build/bin/aiur-merkle-tests" #[merklePathSnapshot.toString]
+    run ".lake/build/bin/aiur-pruned-merkle-tests" #[prunedMerkleSnapshot.toString]
+    run ".lake/build/bin/aiur-extension-mmcs-tests" #[extensionMmcsSnapshot.toString]
+    run ".lake/build/bin/aiur-fri-domain-tests" #[friDomainSnapshot.toString]
+    run ".lake/build/bin/aiur-polynomial-tests" #[polynomialSnapshot.toString]
+    run ".lake/build/bin/aiur-interpolation-tests" #[interpolationSnapshot.toString]
+    run ".lake/build/bin/aiur-folding-tests" #[foldingSnapshot.toString]
+    run ".lake/build/bin/aiur-fri-query-tests" #[friQuerySnapshot.toString]
+    run ".lake/build/bin/aiur-block-row-tests" #[blockSnapshot.toString]
+    run ".lake/build/bin/aiur-circuit-row-tests" #[circuitSnapshot.toString]
+    run ".lake/build/bin/aiur-memory-row-tests" #[memorySnapshot.toString]
+    run ".lake/build/bin/aiur-trace-height-tests" #[traceHeightSnapshot.toString]
+    run ".lake/build/bin/aiur-expression-graph-tests" #[graphShapeSnapshot.toString, expressionGraphSnapshot.toString]
+  run ".lake/build/bin/aiur-backend-tests"
+  IO.println "Aiur component checks passed: exact proof/runtime boundaries, compiler compatibility and native binding."
+  return 0
+
+/-- Validate certified host adapters against exact audits and frozen C7 evidence. -/
+script "check-certified" := do
+  run "lake" #["build", "--wfail", "IxCertified", "IxCertifiedAudit",
+    "certified-check", "certified-claim-check", "certified-feature-tests",
+    "certified-ordinary-tests", "certified-vm-tests", "certified-source-tests",
+    "certified-fidelity-tests", "certified-claim-tests", "certified-modeled-tests",
+    "certified-cli-tests", "certified-adapter-tests"]
+  let report ← IO.Process.output {
+    cmd := "lake", args := #["env", "lean", "-DwarningAsError=true", "Ix/Certified/AuditAll.lean"] }
+  unless report.exitCode == 0 do throw (IO.userError s!"{report.stdout}{report.stderr}")
+  let expectedPath := "Tests/Certified/foundation.txt"
+  unless report.stdout == (← IO.FS.readFile expectedPath) do
+    IO.FS.withTempFile fun handle path => do
+      handle.putStr report.stdout
+      handle.flush
+      let child ← IO.Process.spawn {
+        cmd := "diff", args := #["-u", expectedPath, path.toString]
+        stdout := .inherit, stderr := .inherit }
+      let _ ← child.wait
+      throw (IO.userError "certified adapter report differs from the reviewed manifest")
+  run ".lake/build/bin/certified-adapter-tests"
+  return 0
diff --git a/native/compiler/hpt_cache_sync.c b/native/compiler/hpt_cache_sync.c
new file mode 100644
index 000000000..2a5fc5fc8
--- /dev/null
+++ b/native/compiler/hpt_cache_sync.c
@@ -0,0 +1,105 @@
+#include <lean/lean.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+static lean_obj_res compilatrix_sync_error(int error, b_lean_obj_arg path) {
+    return lean_io_result_mk_error(lean_decode_io_error(error, path));
+}
+
+static int compilatrix_open_retry(char const *path, int flags) {
+    int descriptor;
+    do {
+        descriptor = open(path, flags);
+    } while (descriptor < 0 && errno == EINTR);
+    return descriptor;
+}
+
+static int compilatrix_fsync_retry(int descriptor) {
+    int result;
+    do {
+        result = fsync(descriptor);
+    } while (result < 0 && errno == EINTR);
+    return result;
+}
+
+static int compilatrix_sync_regular_file(int descriptor) {
+#if defined(__APPLE__) && defined(F_FULLFSYNC)
+    int result;
+    do {
+        result = fcntl(descriptor, F_FULLFSYNC, 0);
+    } while (result < 0 && errno == EINTR);
+    if (result == 0) {
+        return 0;
+    }
+    if (errno != EINVAL && errno != ENOTSUP) {
+        return result;
+    }
+#endif
+    return compilatrix_fsync_retry(descriptor);
+}
+
+static lean_obj_res compilatrix_sync_path(
+    b_lean_obj_arg path,
+    int expected_directory
+) {
+    int flags = expected_directory ? O_RDONLY : O_RDWR;
+#ifdef O_CLOEXEC
+    flags |= O_CLOEXEC;
+#endif
+#ifdef O_NOFOLLOW
+    flags |= O_NOFOLLOW;
+#endif
+#ifdef O_DIRECTORY
+    if (expected_directory) {
+        flags |= O_DIRECTORY;
+    }
+#endif
+
+    int descriptor = compilatrix_open_retry(lean_string_cstr(path), flags);
+    if (descriptor < 0) {
+        return compilatrix_sync_error(errno, path);
+    }
+
+    struct stat metadata;
+    if (fstat(descriptor, &metadata) < 0) {
+        int error = errno;
+        (void)close(descriptor);
+        return compilatrix_sync_error(error, path);
+    }
+    if (expected_directory ? !S_ISDIR(metadata.st_mode) : !S_ISREG(metadata.st_mode)) {
+        int error = expected_directory ? ENOTDIR : EISDIR;
+        (void)close(descriptor);
+        return compilatrix_sync_error(error, path);
+    }
+
+    int result = expected_directory
+        ? compilatrix_fsync_retry(descriptor)
+        : compilatrix_sync_regular_file(descriptor);
+    int error = result < 0 ? errno : 0;
+    if (close(descriptor) < 0 && error == 0) {
+        error = errno;
+    }
+    if (error != 0) {
+        return compilatrix_sync_error(error, path);
+    }
+    return lean_io_result_mk_ok(lean_box(0));
+}
+
+LEAN_EXPORT lean_obj_res compilatrix_durable_sync_file(
+    b_lean_obj_arg path,
+    lean_obj_arg world
+) {
+    (void)world;
+    return compilatrix_sync_path(path, 0);
+}
+
+LEAN_EXPORT lean_obj_res compilatrix_durable_sync_directory(
+    b_lean_obj_arg path,
+    lean_obj_arg world
+) {
+    (void)world;
+    return compilatrix_sync_path(path, 1);
+}